From a0f804163ae44b215df94c2abbd1844dd466951a Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Mon, 14 Sep 2020 12:45:46 -0600 Subject: [PATCH 001/216] Add metrics collection from cost explorer into aws/billing metricset (#20527) * Add cost metricset for aws module * Add cost_explorer_config for billing metricset with group_by_dimension_keys and group_by_tag_keys --- CHANGELOG.next.asciidoc | 1 + metricbeat/docs/fields.asciidoc | 163 +++- .../metricbeat-aws-billing-overview.png | Bin 390797 -> 826205 bytes x-pack/metricbeat/include/list.go | 1 + x-pack/metricbeat/module/aws/_meta/config.yml | 11 +- .../Metricbeat-aws-billing-overview.json | 735 ++++++++++++++---- .../module/aws/billing/_meta/data.json | 44 +- .../aws/billing/_meta/data_cloudwatch.json | 29 + .../_meta/data_group_by_instance_type.json | 55 ++ .../module/aws/billing/_meta/docs.asciidoc | 42 +- .../module/aws/billing/_meta/fields.yml | 77 +- .../metricbeat/module/aws/billing/billing.go | 407 ++++++++++ .../aws/billing/billing_integration_test.go | 47 +- .../module/aws/billing/billing_test.go | 104 ++- .../module/aws/billing/manifest.yml | 10 - x-pack/metricbeat/module/aws/fields.go | 2 +- x-pack/metricbeat/modules.d/aws.yml.disabled | 11 +- 17 files changed, 1536 insertions(+), 203 deletions(-) create mode 100644 x-pack/metricbeat/module/aws/billing/_meta/data_cloudwatch.json create mode 100644 x-pack/metricbeat/module/aws/billing/_meta/data_group_by_instance_type.json create mode 100644 x-pack/metricbeat/module/aws/billing/billing.go delete mode 100644 x-pack/metricbeat/module/aws/billing/manifest.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index b62b9187856..062fae87a46 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -677,6 +677,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add state_daemonset metricset for Kubernetes Metricbeat module {pull}20649[20649] - Add host inventory metrics to azure compute_vm metricset. {pull}20641[20641] - Add host inventory metrics to googlecloud compute metricset. {pull}20391[20391] +- Add billing data collection from Cost Explorer into aws billing metricset. {pull}20527[20527] {issue}20103[20103] - Migrate `compute_vm` metricset to a light one, map `cloud.instance.id` field. {pull}20889[20889] - Request prometheus endpoints to be gzipped by default {pull}20766[20766] - Release all kubernetes `state` metricsets as GA {pull}20901[20901] diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index 0a48bcf033c..ae34419db2e 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -1569,8 +1569,7 @@ type: object - -*`aws.billing.metrics.EstimatedCharges.max`*:: +*`aws.billing.EstimatedCharges`*:: + -- Maximum estimated charges for AWS acccount. @@ -1579,6 +1578,166 @@ type: long -- +*`aws.billing.Currency`*:: ++ +-- +Estimated charges currency unit. + +type: keyword + +-- + +*`aws.billing.ServiceName`*:: ++ +-- +Service name for the maximum estimated charges. + +type: keyword + +-- + + +*`aws.billing.AmortizedCost.amount`*:: ++ +-- +Amortized cost amount + +type: double + +-- + +*`aws.billing.AmortizedCost.unit`*:: ++ +-- +Amortized cost unit + +type: keyword + +-- + + +*`aws.billing.BlendedCost.amount`*:: ++ +-- +Blended cost amount + +type: double + +-- + +*`aws.billing.BlendedCost.unit`*:: ++ +-- +Blended cost unit + +type: keyword + +-- + + +*`aws.billing.NormalizedUsageAmount.amount`*:: ++ +-- +Normalized usage amount + +type: double + +-- + +*`aws.billing.NormalizedUsageAmount.unit`*:: ++ +-- +Normalized usage amount unit + +type: keyword + +-- + + +*`aws.billing.UnblendedCost.amount`*:: ++ +-- +Unblended cost amount + +type: double + +-- + +*`aws.billing.UnblendedCost.unit`*:: ++ +-- +Unblended cost unit + +type: keyword + +-- + + +*`aws.billing.UsageQuantity.amount`*:: ++ +-- +Usage quantity amount + +type: double + +-- + +*`aws.billing.UsageQuantity.unit`*:: ++ +-- +Usage quantity unit + +type: keyword + +-- + +*`aws.billing.start_date`*:: ++ +-- +Start date for retrieving AWS costs + +type: keyword + +-- + +*`aws.billing.end_date`*:: ++ +-- +End date for retrieving AWS costs + +type: keyword + +-- + + +*`aws.billing.group_definition.key`*:: ++ +-- +The string that represents a key for a specified group + +type: keyword + +-- + +*`aws.billing.group_definition.type`*:: ++ +-- +The string that represents the type of group + +type: keyword + +-- + +*`aws.billing.group_by.*`*:: ++ +-- +Cost explorer group by key values + + +type: object + +-- + [float] === cloudwatch diff --git a/metricbeat/docs/images/metricbeat-aws-billing-overview.png b/metricbeat/docs/images/metricbeat-aws-billing-overview.png index 9544b1fa8a889b43c0b6aca7d526f2ad32584446..283f2398f99a9c5d1d4dde278ea27508f49ef7b0 100644 GIT binary patch literal 826205 zcmcG$cU%)s*EWuTARwTiAVoo?SLwY=uhM&w-g^yI5Co-2?*XJpN2(AY0wU6T4ZVdP zYC;HsH{Q?vl=u0)zyH35PqLexIlDWvGjpzUoh!s@X($pCQWIifVG%1Uz1GIUB0tB% zB7AiZ4|Al6w_*fR23`tsVm1KIO2i6H|?mm9V!QRGJWN8#P_kgHbUZ(5l9S8P6n_*p{ zUD)bFKg2M=eL1UDWF|3&@2$~-_WIyiE z6b!Ga^bY<0?GgUF_y*Jt!ye1*v=*Y+U%9=lE$ZJ;ZN-xAzgKozyyy~@^I2f%v8oML zLBeytNqOFrCoA%qY%+we11vvHGG7ipDNEop4q0SoihEy2g%v;+^HLcxr66E%9iaICCBj`uCi)8-&kd0Q3d3$s!EE0rvE_3pPCyo$VO2KiK# zjYO9&w%6h^YS#=}ak^J$4e!$Y9NikdYVWt^>HuD**=KeU z#OK;PAbEG^>Cbl@^nZF@M*80CaPAH6^mu_DV;1ul4@-$`e3(wxFMXOnI7{UnZLUTw zwtqv2c``0f{90jr4U)7q(YYIrV0|y^88ko)J6XcOACg-x<^%Gnk;4| zmx#8+dieDY+t}UcACC<0h^^u-hEpEnM9@Ea9sVTg-Zl=`gK(GPQ+Z1&!@GnsJaf3s z5ngrp2RJc5-gsd1hx4ssf5&zUhZK;DV=onuw&V7!N<4W_e-HojbHZXGDw*vh&P`k% zdODT|gfT@0uUYP@#Jo)nPRzz53Z_Q-ZLe&2zURH=OJ`W_DtqZDq&nSuflxc z6BY_K?6fEqIb|(&E%~q7x{MWg(@{?HOESJ+qP2iyhWvNc6(NNkW6yUC`6=@v%_Gbc zxfJPSXTNY4!U_OmJv;7CcopcZKc4)o;~~iO8G51iy!4SbmQGCTr`@0DR?F7k45??x z_7jM^nBMZ$sear42C8eCvvUz^rWAYEv*zR3EbMNIn-H0@M(8Q#q38kieEMB-QL&wH z`5r8aw3~TN{&MW}{Uf-z;Yn7BBy z*lq%6!h|==MF#$o`LpdN@h01;{He~VqF!7@2b)P+S(|o~Y?FDD+(jC-%&=*Exu6B7 zX0`5N@d9VlbKiGu??qMfzI4iV$f8rPBrYBj$3=fph*D_&6%^k?JUlcMUIA-T`)->xl>)`JYHkMVoQPwldI#E8oJB6%Loh6w^-*N~oJ1^Ra zJH2%zbFN<~p4p6L9Z$8&wriVi?Dd%&`t6cF&)eYC5VMWz9o_mP7!+8E#3xey81S)) zf|vp)T{PWgP<+s7uutEH-J+7VQl%0!W9S_1TYAB@4-u@3uZ;gu+P$65>9TLf-ne87 zk$lRxWZmWvv~>>fV-PDft1)XbOOzOvTnudri9}aY+3_XYx#W+FZsbH(%BA;&#waFa zCln@BKFy(B5uO+J%wx+v5>3gA%ry`d5(WEx^IZcS__e}RJoC2NW}130Dsw%PAW=i-OXb`*QyWfu z0sI2&cQ|p_3)liU);NPWK)fv65_~;;Vtf!DH?bQ@S5(w{7n0UKK}+v>y@NF^#MoA0 zMz@mHxYd@`Xt!%O^H7jDB)HkZPY(BkrJ_r00GT6I7I|P0iJ!)1Zk)*I z7uqlB@=XdlMU=1U5<=-V=o)yo-&E;Ui8nK9aB_*%upP+-O9v|l`*(ke+9D7lyC8cX z8?XGm_SbyVtA+5x zT$K?eHZfoOy;m8%OCuruXB)0t#HSrd#_Jn?SYvWygb(bTb2k#(LZ;kO={H$Ak%fJf z%|ZWV64mFxS2~{`1NCy^M>YB-87Cgu#&L1-n|=?l0?p~0vK)<^49%zWaS)`?Cdp0& zPAE`4rb=}isNP)Z2Y7{ev3p5z#hLhcef#xxd_70iCB4dI0!W#PnAASkKAK3k{WYl1 zxoR5|OT}!Pbi!qehvH$e@ ziucLg0OyXGBjhu5$1$qecVyqM3Z?&(z0LeU%hdSVR>B{BK}Q?Lf|B|6+*J;u&=L<4 zvJ#3F^mTD7ys~92up6S!Qu9y9aZgj-L3x?JP4K3;VCc*b< zQ|JJm;#&c;v32B}%v8+Ip@O%8_D@S{zCNq4(3V=Hci3@Lb8(S+98^)#Us-Jj-!3HDr3^BmXcTYD^f);x5y@EKiZSa9V%!<%)wkP6 zRxTTinx3`$?TKy#^$@qvTnL%D&!E?@RLycsOwgPNllT@1H=(9c7pd7bi07Kdk34q& zd4G4Gks}va++kZ7H_{vtvW$+vHzGBc8VV7zYEqLd(`V}Oj^Br^(T7p(U>)~kN*yBawxq~xNMX-{~tsSj37&RCcY zmAbz9E|U9d5n+64d}4<-S!%&wX>E6=ilq&_l0>0*Vu}*m=tx7}20Ni?Z(GBB#wiyw z>T72#ays9K0IGiLv;3qbun&GD{hUZc6=!u=#zs;DH~ihugP*PBXBXe4$yabUaBs*p zhgLV%@uZ21ekr`v=fmntvi(dNo=t~kZT;pGU3gwz+P=jLb#K4y5Aw35szZwJ*Q@Vf zeP_bzRCyFPZbsNUi&pwZisdkpmAT*d^8xZ#W@W_YLqCDgLHygK*sNP_i5s2BZ-k~l zq%MGEEOZNeEY`^w#G7twsBEXMj>U%AzlU}A4jC2>X73K>59q4}?U z?K>?0u7iz*72}A7`|mo&nC+ie66TGu{`VFqIT{Ne^NkGijw-uR5Z(+PZl=xcewQ>S@OuAn;H!^2WlVVEpsGqpZzvjD>~m>!@q!W2mks zYVGdIWo6_3)|M;4)#J~3u*3sIF}tp|K34Prt}brgq5%>w{#8R1v;XHX_Y3-eRq=6_ zcwwlnMK9;>WlJx>#n1KXg(M+8J-xV>jh(3WYlVNCW4=keaPaZ*5as6f_xI=W=i_qs zvghUz5fR~j#mmjh%ZaJM=^g0iV->*Z=Kbpw0h z{^w+(dfv8Pa_+9Kwr)O>|J~!_|GLuuRrufc`5%T_jsdnVhOZqlmfn~)Neb}rzWTS> z|1SD}ni~DLDX*~b|7H3=ivEY`pGJskdO2e5)ap+!O7e(v|9_7C@A}%d-tI2Gf2!-b zIr>QQ{@dh#9sakKIQO3i^FJQce~f~E9mNa-NkVb%{~A(~gemrq4Y9DKv6NrS=my+5 zSoF8l?Oo_QVa{WST7K84C7ZS^BdsMZ{mrtYw!;);_+z=w8o?&0Tld1RLbnon!PEQlwvfkJVz*h#u%ct`4>9J4FZ$wAo2+VPFz>P4^C8)de z7EZ#~;-2QeJ={pDF0G{0br)$HJ#Go!w4vEUD5a!N)Vp*^BxPlE^ZdneXaD8Lu>g^c z`L!{qDLfpD;67n;c!4yyIXgd_$+5gV+0E-`BY$iS+ft>#sWVp?9w2ye0e&(uI!d+Vd;^C`#$>e>2?_}HSSmM9aCd|7LTOXU(da(b<8Fv zCKxVtEuxT#1hh+as(xX7W(ifo6q^QL^#fVaD@2T6m5PX=Vl!g?P3Kd%Vl`T5QbzhJ zmm@qh5ukdpVX%gc{`lNpZI60_QBVKqqH5RTcW?4v#A(7`aQTN|C`KJyKzAs?y?aSN zk}OgA7CHCs6Os)-R8`gZ9FOnU@4sz)TRy8#81rbLR@Ej;5#c$4f5mCGMKD`w@+Fv} z;M!&E75LKNCb{t^1JF@m5fka@YWv+hryhZ7j(hg!fYZjD60i6cYk81|>6y6)Mlr3d znt*;ox$f~#0$V-rP9f}c=|3OY$Nq?ri(%vyS9_->%JElV{ptb5rO+l-Z=ZV#@{F>- zn04~?zNcp;XON4FZ)^e=^C7px%fp4H&tJcGm!W$ug#z;YaHS|bDi%Y{B?pPmhzN;K ztZkW}72N^IJb#|-R6oowtW_JRiiR^k+p#CbMqfvr+0Pxhm)aAYO$NSGl~=ZWoyp*C zyg%A_l$n~h!BE_NtBhHVTH*<@@8zPgA%4%2HdA%W^~)O{5sC?bb4Nnu{XYB+jO6hm zA`+jpKZ!2vbA-ixKafHOJ9|8hfJY*;dN$kDgje68(4gZ`wCfFTzq*@sid3wh|~CI87G+ZoR0Fv?lv9Kn^5&?=Vg#T zFqO+}p!Vdxs4q6iANINX{Yyp;j)N()sH}h114Zzu(Q~;qorkQ8#3rsVQLiIBV5s5{ zRP+3iEDkz%6}4x0uPC@P(pkE2MXU|F9OK$;)mh6n8HFPm#H=$o@B74fo_sSUeW$fw!_I$~m4KNq z_nZCKA9Ou8={+%tmsOH1ELw4oVv~~@<5csE1sGnuScC@4Jat%|K7O;o$j|V)ru{nE z)M92{C*vbT_2jL*x5Sa!PQdxj8{|de8^3Y`vvGCVcjz1H^r#-iL-EfK14;AtP?vo5 zZ@1X!>Ypuv2E0clxs;Wac^!@sMdh`|T%dC@Rtw36GIu}xjbEC{dX+PCI(pV@s?d?V z`hEQZ*F;Hpqgs}z+1^w+qXh}=s{hxOMn}FaAmiY{0_;1Qi9j-Tv|9SkX}~vP8o~bG zZ>$ekmNr~lmUpbvlag3gg2jI3*J>5E??|My7MGT0;~v%?qRA;J*jkoP!?Hkg8--G6 zHURvfAxw2Kuy1%>h9o+IMcD_ zrfO0eNfkl&Wv57<+9Tgq*U2AUQa4ZB_RT;($!vOTgN1SgUenXJ_Bd#_wv(XN+fL8{ zGHfF;&9l;G{bzZ7;2_03_%@uNkAstkN3Zx}VCU#BtT9;FrSdW$EF9TE^;|CIelo8e z_|ZQbaIKnBVisTkEbOOUoWspPY`p~kj;00m!7OY`=wR*+U8na<%$4KK?{{}Uy6#wo zF7v(rLa2&R6@@-2$OO(}7%cV0x+#sPPiS@Nk-j66{4SccS?S4aDS{kgj1i$hoZyt= zZEnNOsx*Y@y+>{)Iwb05Sta%Xd8f%imY(T;VbrHDAB_R`dAH9A)v|fzl2ddNKp%b) z@AqHKnsU7-+>*FF{7w#B-F!}dBjEar7Q)UQ5jv8eE#T+@zk8K6I>56#|K+Uz?iC}G z5#;yr7CU2)n0mn=r23PCw{a7Pp!!!#C%=2t*mY&_QB|z43OrM^CS~-iB->)aTB9>dy;zR43-43_`aVqCGdyT zVe#|eWrXHz4W&KufQ*zby=D0ZnAf0P5_h@+a%=KM^SCX(4m{nZT-q2)1Kk30koRx6 z2YvYvgTvnt&}^OCvk`V~y7m=wz8D;J?L*eF=7v4gt9X#c#VSdA&=aVv9>23i5I={^OGxG4~S! z>!C%Mnpi$>?^#|U;ya#@dGPpq`vnR^?tc~-CDmf%lRm4D2)?ReY*x519Su7kdoJR` z(gmND{;?8@G%r#UUYa+Qq!U)c3-#n^VFn|+y#^FwNKLEd$-+?N0o9h zM8&uJ=!AVZ1lFUry5QPJ95rPDrw&g8+Ct!mr?TMLgH%nai_G)(DnNeetQM&6S%`G# zlhco;6BjSQJ=do`+3rsIQZ9+CboK|ymj{a%PVIh3Fqx(pbWA+!>- zA~7@e!%m&1|ManEy>*`k)1kjNLlnaj>;IhP8q)*q%Oqa}L_opKhL zh1Ap>Yt1EGP0U029keuqd|+%JZ;jXx%ifCS z(G*H6c_6>R>XxMqYGKOw*zyDAkw$ERT6h5&<{@80Nl`G8$AB5MW*NX?!^ts*EW=?))Q3F_@X*Q+`gX5Q>s)u*QOTn=y@G@ z3+6d29tS&4>;wZjOUlXy=LmGRMyVezSDGFufn^C2fk8nvn8}WQ<$W04zq6E-eZ@yNF^t7V6oiR`t|0^uYs2xu#~Ye zE&q2EoY@P~Qm%%L$3TvV&<6WaZ9jynL5?Kit&fxJ-Qo(6`Z+!k?x@$xu z!m3BHze3Ns7|_Bc_#Kwi&*SwDnVSTr#=rs)(Sl+4cfCsaz8%#bbgtxkBE^M*KL`)v zO&#FhoObC7De?S*CwQQRsHMP>4DJ)XY%pj7T*pFfmapH>SU|PFeANe%UP>6~Y@6}) z!DfGQ|KKx0?)a2ix!tCP`0s!xNlUWaN+xGNJLACCbu+Y9Yv+k`tBZIhUGR8SEkP8;u_RJB~+g_>do`>FgGfi=y#ZWzXKu_u4E>p`CJ-5ECJO^c&47-iiwM6E)VN(f5@F`AOgZL0X?`2_CJ^FM{ckjOPtLOPvR)uaJa}&1g zHseKMF2Mbo4i)`s^Ouulqs=lloY_L3NuF}Ol8H*O%|XhQ1)RL~Ql9;|gv=d)ABqjp z#Z4YG5k6+KIqIXuZg#&Q>3H)w?1>Mv+&V79lyzE?Y-BUA+Hmi-oWtOKbk46in6IzCFSz1W+s z9O&?0al=9TtOwfFY7_uBY7Q}xGtY|hR#WzVkyWnL?P*RRo_2|TwV{9Qh{RJ`T9@2u)PZeO;EpDE!Ff0T z++4zZ+_KM+sa@+M9($+ryT^kWiGDGU_`vQLAo`&waY^L)$7Xc=4J=FQ3ZzmfYXzsX z6pcww=gd}~uF!K?Ld8gWn>4#Lsb?S#+-f&+Ejoisb^?|@nz!5_eHmxOtqY%buJk6P zB@7-R4SM2p1R;*xhn~vKw{_$66PuehXB}pST%f75zE(uLfoZ5?`q=M9$wBbVRT-_a z3NN@tMF|rOdE z4FtG({n$({o9c@*8&zIdL}+&PhJV3IEJa8S5NO+tYVWz`1#rxNesL9dk043a*_@+) zUn=E%Dr#uS%a_))EhS2~(?tL9!7g7w=i+>8(Yb@RsDbrpx`wNHu(8T?wQEa?*XD-< z9xFHR6(o?B*Fu3DC2lQ?UQX?1!aXwOBv!l3#anPJSQ#=p3&BQHa2c~%gxxj}2=I;< zn%kaEWodtt4Gi4u5|fYooSW<*OD=_47c*+`i=4EP!wy4+L=nI%Ew5I#$QQSKvc8 z699bx}4Q^|7oLNbgg~e7V5aqeFxgUzb`R_U`%59Uk&6saf;2kU;Q0 zK}^cQ-0u&sz|h}=(!}>nzImk)w-1URA*7;h-3H)>(C>&FMOP)$ZIUa+9^zSxLqYHb z9N*21of@l@oA?Q6Zy+C@i#HqsM;bJnS2?^1EL?GJu8|^Pq^*w#l?%O=r{FT>NK^Z6 zwk<71ycpDR3p#oN8yMu4V9(<|+F9D1DO1l`!^>)oFP%86cRQU*NwjUfJ*#)O@ATYY z?oZL|Sfy=)(Gg#oa_vpYnC~Gz;oiMFFZKPLR0wv8Ce4Rdsb*-jVq&_a`iC!Xn9}CSyvB51 z9RI4Mv~2}X#g+EyBvF3aTyufGBMp^pF;O)VH$qIlW3 zPrVYnQDQyI`#ge~@O&~{sjMBocP42SssZZs=S8d$tER_#gNJiPAd=qHNzl0+zLRsE zkoK6^BQ%oIylDl8y0P3U*!Wy>4>7TS6tW|s1YAkPZ{H_x+;vS`INA zU^mCT!=3xfo%fg}7SV2|_P`<_;JH6*U|@P*wtaw`LY-9%5d?`#)_HcM=oVnhdL|wi zHhYam2qQNqxeo=vw3nX&u5ACTqCi@PXebA)wcg^IA?5~FE-E6-G4Ry^&)bPMy3Z=) zV-}8u{8op6JiN;e8(B0zpF*E-gkQEmVMM5C%XV&VwLH${fMP~NS2SYz_5<=Wofg&L9q1a5P;Y;dz7etBBAXlB3Vtvn=wV5}5 zPZc_P%e+>isyxw&J{`@l0GiyJKY(|`t6ldi1ojsjApQrbwVhN>a=YE#vL*5j3KRQr zM@)^wDFGnIGkpy8_Sr40`ucc-PH;#wMZu)W!3Af}C-+(HN}Z8HLjLOHiU@|k;oUy_ zem%i8aq}*njBK5N;M#tdFiXHbVsaR2R$Cnr7?fAZ1!KAxt#z&SKGu2{{AyK|=Khw1 zwA|giSKxuPkrY*s8ACixzI(0j9Ik}Z@BHXk5yp93n4@JuG;;T9f2Q0KvC{4+C&ttt z1rNFGr!NDIqN4gI4;OrHo@Myd*S_tIo0E*}MD`P(RXQen)qbz4Txu}i0MUh=W%U7Z zh&xrpgQrO1?@KjBgkHr&=+qM(sVXU@7D@%ei|=?*=cbv>x7$`~W?JNlHvI&F@xqC3 zt^odDqh|!ZT8v86=ru$W*MlyLNZfM#dold@4=J;r5(%yo$-I)9u${mdqyPq_;Ew2d zq9o1^RC(=O;E2-{O|S!M_sYjiWBgTcVlH z{zub(LP*(=P#BBY)(z^&tHMsRZy_V|fpA%)+tOnB)#d&(f%fCoF1aJ*yBde%#nn$* zavgpRO!0(11f)_|#U1&f%|RAoTP-Uw^P@jSX8b!~7?*b5>5~tXOqAMRx`^_H0Se#r z;PoA@42cVAWQmQQNz{xs;~hIv@%a^L?vyt>{wQ4*GUkHKFNGqU&|mHVTdhLdEIObU zty4vJ;{4GFnfcBo21e1RLYjMs&nAC~cyG5t8;c^|8BZ1X9cDL={KME|)#sj?AQh)^4G3C$tZ>+3WIgpYSt>OURq@!Iy<_PYYc!!SU!sVn;Z%a`ikt-_GOtE=R0XJ-+S z#W3>G*o1Md*LfRi++ySiK=XqqNziJJ9RA4!$52}Xn(Z?D2pO4)s|8h8R6Zxf#v&M= z#n3FbO-JQCmzMOcbO?$T*U;3Y)GSH|lE2~rL>QSQ+bYT$! zxKc`oQf&tfT2uDsdR4`{UQ^f2)>JbeSC$YgPS$mB;}P@3w#|pN_UhNNAy&LU;^GE$ z>ee0v#)@BD(-cK`@Y#>HSiL)X-~Okxa;oahbhD4c>;T?Y#|az@koP%E^OZ~x<-E6Q zM&JC!UKjDKxtlCj&YT~*u+VZ8eBDgUh=QXmwrU`^)}xq2S4P1PdXuo7PDqK98l%Z9 zT|D(niY9(2yO{rB`b)*+Vy(ieuE4~Ln_Ar(-L9u!(*8t)^0xulgKi+CvE$ULA&Z#_ zxjB3xhb~SuUri)+hX6bNKB<6}Vc;!eT86W;usOob%;xgL`00La*gyzkarZ1{D)ZaM z(r(T7Ywauvh*0i;2y(|-6ZG61N9uNLk=yr>l^7nhw;TG00-#x)DMa7ZZuOE6yhwxE z+AgxSo-k>$Eb19tq~>S%`j-x#*6atbpC}fq?^A5&lX$`!IG(EakdWKVm%;epsR^i^ zo|cjzfl-O(pSbQzey9%k;#eVgpqJ7t)0U8U;p#ZdUAdzz|3~|u{KIg|vMT~{!i-ZA ziG0bzR9gQuV>V>JKvNPukube~|7y>=TzlTz;#u(e!(E>fTlnHsIo~GN8JfbZrmAT| zs~5xg{>a~7LYe!2a{b+#h(RiT0FkhtzDJAWp2N!j_i~>n>Gf-N=%H-^86Maruk>2q$0*>W+h7%%fXX^*y!~wjy2}h;<3{aD z_=F#tfAxqOt&8gD!$x-V=AG?k?$S$(2dbkI8SF&8y<*ygz&L3B-Z#7yeqMvZHx429 zMjPwh+?{GN7N0Zeie?+gs)WDR2k6SOT>}X&XkN0Ogee6%$u^(i;>xQirGZ>BSM03? z`=QoC_7L~qjjmoH5QkVo1j>5EZ<(+Bn~y@KF$So3*^EA8)h+s&)p#9j<{V4byM!dk z9xF&@l$DRXH0F1=!MW+~4#wH1&b8>n+dN!un8h2ri-)&xA|n$4Hzb$oP(=qdZJ}Gt z&)rVTEdr5@lFyw*Ehc{v4++@)PRIj=T#4d0IqCaj*865csJtpv<8Tw^nZoEcZTwkP z+&;bb`1)Oqd3Bs-CNO{6LhZH{PDpirs7cnc@Ts3AjV+&}%agy`A*k{i5rKi!Sk~Ko_YbXreb2ml zt{Y`~8lS-+CPC(&9THNW6OUSvr8F)Q+)@}ZL^lcLrqge!TMl28#MN&cw+%qsqyg9!?jC-lqG4Y4t&haaD`MF)Y{3>U09CLj-HjS z;G@k07W#}~{g?$kMe2suN|xd_y(~X?3U6XTnKyLv{MvtiW*+a#QHU7tAlOq;?Cs&g zMUhO3an1Mkn9&Ot>r%QK@j>dJfy;qgt`F8eWi=c^3noPi%SJ?qwM@ZQU(kybf$vG3 zg<1b$(TH#!HuWm>>0-+?t+V6ecdMF==^8T{nw>K1yw-DxWn4%eyZl*VCr15-HV^8- zgZEY&bD}L^(4ep0E6n)~&tsNAzMrA_A=gz!$|~w`fYd|zFZG|M4=Smoh+7V~ob^(U zKmF+Ec-r86@0g#dq}0YAUc7Lv5kzy@JIn05wn!pLj)V3B2@#(G>g1!;KCLjU{Nzj- zcq3nI()+~GNf!NX(Cj%YB$RJ0)S6MkF-EK;8u@-YP!9WL<-kX&nslo(|28PE0m(Cs z&)=(KCyI?f50#B%ZOEEG_X8NzrtEA(-7qw0iU=bI|5W)xk_7P?By6?7Wtq&q`@*k3 z;VH=GB>Ax$aC7q!0TIz-&3hIhSv=02*VhmaqdJG!M%QVzx7L-)pUH#E9W%|gwQDu1 zh|g73R0e_vo(Z`bazo$?O-^&tQf9R}Gc^#)N(^i3n;pEoKV5B`n39~Z&_TiJb@0)+ z=bC@YeQ?IL-W8=W-vmfx=6Gct-J_UrIaGqbHDJ4x*j#IZVQ?#S#PmrU9+|Bu<6kib zwZG^gVj8Q(FnH?6#*b+R${hO)%mTAI+$nM_+c6o6ISF&XaGGR9{4$M&V>dLnh@cCM zmK+ipI_>P;=NtAq6((+So)#Z5TG3g)#fn{N{^&kdJBk9c(7wI9lKm6N2*k<@TpZjY^Qc37Um!=${Kj1w`^g4V(? zYIug3lNVrec_xZrBoFk1!Amo(U#Bz&#xM#KCFX61MJT!sod02NOt~zUAvsbv0$LiF zOp~gq`{Kn7ro)RuLg2gj6Lnokq*wK#ns$@ZW1t%*gOQCjQz}@XfwP^v9s+D~86R@= zTbbr-i3ok)op3kj=!9^`n|V-o9Hw6Oh|R~PYMGf>{Rb42j<%ip`fUO_j_>M_AMLo; zQLt67$~R%CzSQcklE&tEJ8mTwfSzlx2Lg(pH)PiznRx}>T=4l07@moUVpIbbA|9_&c|DV%3)J_o))ayBs{_b0iUnz~h&L4E?2-Sx zB?2Rk`X}|5T0gL<+h#iel!%HmD0kz<9QE{4Gr3-Fr)aaX!UIc;ug?Noj>ksl`$7f2 z)+)q1oi3wrHh<;7l4I!FMvqRG5K_s1#8VBU=V=(Yknf8cff1`ypQmsxFmBu>yi!v zI1x{6YMwPi;F-VQNZlNi;dx#1IZeAZ6Boq0dw<9Tbel_Z&c~`#^Twm_9f6cL_a%3w zgBDQd#Y>4oy&&lAK##LL&2Bz90)DqSlx^ zRCNE9g&^*Q9-b9c|^z`VC%B@U73ROsxR6Xee`%}cAEVj*V&eS)hF+q zPNd%llhK-bNEGXpj;yTL?Y_&2)ZhW*Kq@O|S63??w5rl4OIu?)WY)d{lT;DRb?zk` z4Mi`tM7ukU&2ocp)<(kE*n6Vmy~===-6#qU!-HqFW}xNjL@F^Ex6WNW#CME)6|~gC zS!e{3E0mHvBcor5jTvno+SBRdk6DHW!V{N0aY#pN zonFyO$BEvx6AjQC}r|MR+3Xhj^FA15^)mvpv|?%GN=Ba`z1)P+{3&vRUpE)_v7Oc3@RdE{eI8=mEi3102*iVL=_adrq^5uPq*Zl+ ziA4doG&_EY<=Ss5GQ-Pw?QS2BurmYiU+eRma&q??DZX7_!<>X}I8<}qZ>02OY>fdz z{qRlQoiq&H?tp_nUk6{q%XBf}DqhvD=jdSDQ=#AiF`KH71UKx)jbBLyn>U$E*&z{u z4jgtzuADI>TSox?vnfRqIv%UI&Mqg6vH(LyqD0S74erERlUS{cOlrfdoF;+|UA}si z`kz^KN(bjW$@6rW(VZi>#-dhEqVumYKX%bU4&vSh;$I0k&&(aRS+2d!;_*(9a9gRV zMm@#o_LwLeT{(41H8SSCw~^wS>N)&geZa5UOTj`Hp*!ZWvE>}K?N{lClJ3jh!Nli- zZp74V0nn!{zo9tz^YntmTvMt0VLGfPGvu=0{b8Lh8ELDJi!xnf)Z(uImY)f-Cyzm{ zOpFo>*EsZL^-j}Hh}2NQpcj^Jkmw zX9JLp%uKeTJ0Ga`Fqw#}MGT$N5D~qw_KwJSpXQ&&n$_6jTLS~v$d8Kx!Xl46nY@dX zH=^B8Cu|D_ANlnE$doamsevjWW$@%%|9JqSBax%42P5~Go7;o3Db^r5e7f&bT`fYI z!z!JFlu#x?TR|?{33tenT6c>R1cZLW8e1?a27orDR1UskG@epowiWMG)Ky@{ha{}l zYR~V)XEc`BD5gGlIEInUPfF&H${7QHrkS0$1e^1GJDvY<(MobQN#LBGIK&HUovLGf znaftu9Y{tNcx3FbnjZ~wbR0i0{4ldw-r!=AxA4siH9V{A;P63Wh7QsU^Vpx)V>76r zznZ8AjG9xOP6C;pxHNrwDkb0Mf4Dagon)J-i4b%cPCM9@e;$+5@>3Ok)=={@6mnvw`Kp6~AqX2y7(?k&04%*U_qEkTZp}*BobPyQR}?dU zQk@0#Ze=|4pKo${s`{;?ZT9i6k|R$Pa4*Gof2#hDF|}bcMr%dBxDTR`OccJakut;Qr7R{#U$v zB-iWC{sTiY!EfHY@p@B6A{g#9cRb#F6h-2<@5ga2FeYw~VYt$a8lZ8}`jYV9I7hk2 zH;xO9pC56X58=5bJeBIdPWa$o)^S;s;D!!(9F}jJ$32BR?AKnG_X+sQs8l1zG1Oka zF~f1CCO*V{{jrnCWe%N7&dpeX)ISXTJlgK^M{zIPV2Sh+oa9J_S=Hd6nKbk5V#KU3 z=$AL61Msg!&VZ^g>Q(=m&F}B;zE{$AI#mv7XD=I0gVBWzkBk?n0(RlQpWX~-98pnF zZ2DiDH_sCP`I&^v=vcr6HU`HqJbf#>6o}ysN)q0CKi!6s@IPjrbANly)VjY;sQq0l z39(DNKi=D2tlU(!rY1rnJg7mt*eIVKA~khX;j)2eKY!!}&I>`2{AR`hf5YJy-hDSS zywn9i9JcrpBhN51?iZt~K^r4gExWNWjHz-u@M2z-(IUc1Ug1 zea)Z5Eh5qjh%=q8w5f7DZ8Wlbs@U*}O3X?ny}6yAffhbQMfET}!wNZpI2{Cm&Vn;e zT&63GS)6wp8xlq4-4cp0WjK1!Sd$6EuWnP-MOybq*TmkU zYW_@Kh=bY3XvyVUOS)apd4Y)z#ab6w3Ej{$-jxg>DXmT4eq#1F0hc9Ui2HoobRM)` z6@-jJK2_I9cbt@Xp6gcjDegwrKMwC;tF*YJWDpn@?*r;Qo2fkAV;{8-l(-)2a08Bq zC3^20w_^BHKs!d!-qKNSpp+#j$R`t_VbtQ*QQho1IpOHF68Y|(&Cwzfeu1LvS@MGo zWb*W3-=h%{y;#|I;>XC|mKcA|2>Wq^;>%jK#a>#z$vD9<93e;Ze}VugkaS>@P#}u? z#f$C)DlxaB;FGOYjtzl>M%c#ag0z~%{IB5r$Lbz#+Y=ool#t@*S+yOW9QWE>A^MVL z`?H9sV5gmpy=mu=k=-tX$j*k?^&s%}1;7YasR{@Pm5S#>ArBE&exYbZ^Hwk0dQ)}~ z9%csFKeMmJNLbQ#`NT)vKT@b4?qZU4anUAD$ctI2LlE94r@H6=v_D$HrWP$*17uqj z%FA8ypKbINf*0WA)tY@62(gghiGA(EMNBZ&$_kB^9+zG7`;x^6@B*O(8Yuf`Nf8Z8 z`#uhg1`@YP4(aJqjAr72`uJNy&Hwqo0OW}RPxY>|UY7CPRI`-LJ0KngUCc0HUXjoSP4MEg>w3Sm*YEKMFI>NP3v7NKtk|qrnIB`F#{JHi^P_-) zT)4$~*UQKXyG3C+sHK?USvnb$$HBFjn6TPDiMzAFj#F+wc%>ynX?*{&AQF$f4uYj|%eC10PS?#;iQDJ;?ZXf0!< zPMzltw(%Xxhzv^&L6Oc$_S;!Z+6^^vyY6^&eWNd*+tYIeVl;PyU2+5%xdlew^^z`> z_qW7|s{CxB{OrlJkld1#LgOI*d?RrydZVOWkIdC(WMEM0mOT?%(}PN3qJ*}g zwGab~klxs6WsE>zH_%83qKVUO4nVt(KLE@93O-uAdwTp*b6{tD!{$dHjx997>?n9^ zkPcOYa-LJl;&-gzFlp|VfVr34ATM4=-fMCYUWuU#VagG7O@GY3zB$|?nZ&4?KJVSO zT~}At75fL{8JLGm;w5ql?EeuD@xCpF2C|yBX9};`+#G=XsR~v|x+vJOVp}C|k z4CGZ=`9IXXXIPWlwl=&(6j+LgD4+;fDbkT9T@etFCIV8U6zRQ}1Q7+Liu4*pihvM0 z(h?NuB|wBojnYC0MF=4zA@Dw&_w2n~`#SIb&RJ*qMEwpp{TT@U0~{Tf_Go}{u%yf1}c-iDMAZfg`0ly062UnW-<4P9P{U9 z;x=_2g@jj|$WCv9HcnXd4?LIt50v+Vl?t!i1NR+-!u*{6(O#gLWquSrld2P9Efm8p zRt1*YT`%G1@uP;AW@h=_`2Hl`Het=`>ZK`yW<9FGsOyBD@mk0?!wjGzO}atE*FZD-@3~K*=0kDzfMZD#lfKabE-Wlufb_;n zCr9@`Fj~{ht#tUve=EmR%fU2C$0hP5{M5bI3x(wCcC?%N-RUaLQ$be@`8quS#t{Qc zvG&v$eFj35O3rO=YVv(&@d?_OooLIKkyo~&T~%saFpU?}e!+BJe)1swIt8{jmD1fx z<$@hhMakLj)72%+>8MwYQB=5qy>{B`R_eA^HMzRC;!6p)3w7mdqYj*FGwV2QK}^v4 zefmHzxe0Slxt?Ucs^iF zg7)8v*^NgVZ?436Xy5;S2bu>r5y^Z}ffS768ciCuK$2SdZJ=uds`%EDW?nu`%nS4CKJ}qVlF$G9uH9-QA2%)1}YvLM8f+ zB8fq}X0~Q`H4=6QR_FB9Bk(g2s&pfT7oVZCY1$`Wryp%93(-JdBar z67eDbh-kQSZTW%YV{1}5)de7(I*MlsV*x!cni zY0_O)Rn>T~9-4{S5KOD%SjY_tnGAVMT$bi@^^R-Kw(uY)gi0?dkmO{~fZ3t)zTJ@| zr~Q5(d7pQEK&dosWU*PkIo}2K@GkS5k2cW8bHkX_T1vK}^>nTGOp~_iNhDivu0Jx! zl(LOmMLXm@DgfHJraU!rYQW9)lvMm{G;kI__?EnuQT@VX;_9*YrWBcMB(*i9@NPum z>jZ=OKnDNiruaJ9+Oj66IaX&K-qc2K^=H>GMN6-~@JK-Yw-sz$-792^bi*1?5{ zrRG$?qL{B(4lk?(<`^X$IOdK^SM70wy06`zlIWh&5o&QT-ZkttNOqkU7x3M0t;(qJ z{rdDszNsws$A|T%qatVCZpuPMl$5M?Pi#>`zg?&)FyeLf!E(#uXOKIR56AP9ekb_+ zmbyAE!ksVF`!>zkE7NW!^RT4HDul{&hR5~re&&6l*<2M1p&Lr+k2<2Y??2zXSE8m+ zVt4E1t+&5J%jx|==f={kn8faPAMKHLvjjq8L&P>^A}})(?nJ=?L#71(trs4MU9>k?!Ab>P>nxn z);i^&!7cH!mZaCFFV_sV-=f^vzHx4hYre-pDLin{(poLSLRW5uX-nultN#>)KV&ly zza01|1h>CPm62Q9%$>e^NpTA6eQvBM+~?y*xbnx3A2)mZkUc;I-P3R8V>e!XW=)Ry zNHeYzKfvo|YR`lpk${oHG&K^opCNHmlo5%U4(jzycVtNg>9gj3h{X)`;gh>rGN{!e zyob}LWhuG$&zKT@qbo2#=lPPu-osEMKE3Q&sUD!n*muC_1sWb2-OM)}Fdp!Y*Nz{i zD!;#-YLt3t0Dhg6v@oX+_ngd$jy!#0Z<#G{~l6Kc~wHATAF zM&oeM7u+q`XI{I{w18q#B!|p9kUqPJwM|!@IP$SS5ClDT&jaC22Ee(3>wD9pIN=na zYbN|K!{i0cbstIwS_M%t=e` zhrG8%CCwdL@5#PF=qD}EnK^yBF#1k6%Vea;F9slS;^qN*_oE1osN-by$OO(+AEj1@ zJ)d^zkup<#uH|JPNz_e%rah&qLObq5>AF9s!EDzSwcfoRc08$MG2_dRJH?KSGhypZ zx}~PDWhrtCFR~XGI9{06P2~-BWoh=s+0k9p-)#sdwE(rq!Me$eAF4q6md}#?s(F<= zXYsbjmm%3JsEmk!zn9|;@T{gDNwyvIJ+_ece#?*wDm||l*e$9?h?S~b2Z|KckD*i&Z?dGlw$|_^!;HblN_QnS zn*GrAzA>HUf;=ia4dy-ox3^A~q_>So<;zX3EV3=VA7Bfqz6 z_Sb~AH95;IWSGYTmH&el<~=ZVb+7d>yU&CXAvHHopZPGH5O3kV>~B(ETv+H3vc4vT z)FtV_>O)M}!k)e+k|*n28fXlLJ@>8_JQ&U=Z*yl%N4*Idul6e|NO#C{9UqbTA=(Tn zt`QMKZsIKY(SPf_vhW)HygWke-g=RO{b;GQXu(k;cz3vYJFq(e@ik9nz-H(az>$)2 zpBj2>=@^JnA}P75(N?qwZx8Bet7xb~)R9eV1M4)9SL=E0JFh&BhVcQ7+natKnWJyN zzg&p*xJh0po-~c&?*SOUR|Mo9&^_Hehfh;U#+5j|&U}3-B|7=F#c~4@s&)PGu;sh! zvN(Q_;9z!7>1okRA*W0xk9a6l8f;ya{K{i0HflCu5;EIAeq4xV%9JcIkH z6N&3L-)yF*r{CdSLVqxf*tKRMEZoZTzRzk_r>nMGo$AKG;ow#PU>bwJ14BWS!tE1T zACa4&pFiKukPfNHsqy8Z<0kmA-i>V2Vmx4!Z7BoT_!IhWj4j`T2#8qg#iZi9X&TJ< zzC9X)9l&R+cApN`VPj>zNL(IMHqH1d`}fwEpFDxm85%x!J9(h_!sjg68=T{6Juot+ zH3ys!d1WP~>A^R|nmS;JfygOtE4@V|=n7zwS8@rqFn|(U2yT`c8EgSsZ!>v~*muq| zYn#44n`PP?|Lk!7$6$c|dZg)SYtc-E{pFbGiiP{h55xFrfo;uuCzSZRMn$dfrLInb z?}dn230Pi=P_xsY&2+`y$n+MU^gqX{`mLYi&K*T(SwlHRfT^(7OcEUjw2kHN^WU-L z^FB}7GA{gBL4mK_xZ2@RGFrMA_Iow*$eua_Fd-pjzZC;=Z(QXW2gYsOmAVL_Y>EOA z@qC?WZrZnpi2W5pZoK^8EXTGRd?&dqrjKp{=EdynPRGNu$~LtCuUMH&Dvi4X2vP1L zU~ZLGzKzu*`*CTvv2v3!N7r&n-h>oWYH$XP700b))JE>zyLv%RDn!Pk910pN|er^CSW4FXTwsvftpc2 z_1??a*ptjM?@dHBL|2CN05}6GK7@jsvH!iT(2N&6&FQ6Ht!Keh(k`m(xwccJru1VT zgOX*%0Boya{G>|AL&%gDRo8pEuJy{b(n{24>Wym#z#J*3Q&tDlNm6P7QqS+qH;AWj zHn2jD5f}V9J#{Tz-7|DFz2~knJ{m`(?x05O?Y(ywT?ZE{O0>UUs-JsPuxfVn*->@v z9PifZS`@G(2e|5|?^l?PGXidUh)yR(i7@*05FIx4$I${jVcV+{r{+x!c>B+K=d6vM>j92Z zHLgumODQwdS&eo#9pvm?eK5lYm?3r>1}@cp(i3%QX#GC!@%8mlV_W;R!PVF4ud@fn z=VaB>RohN12z9?HaJyG==kU1y!$gI=+qb20=2$BxW_cgBJD1gNUHLe*vpC3+^k8vq zwf4R*bJ1<~+re0;@e3SEDEjErC(DzMWnQu9*VnxeRMAPVm*30f?2j5pv+tU{L$--ZG#DJj- zr%s-pmx87SSVg2}cIf1!;(ZM1y-&S3&eDfFz4~jG3Jk79m|wV7@M_8cR=(R3n(8WF z*~hlbasEm;Iaw(+HS?O2V98kCy~KOKGAkPwOGLwqDRlkoLIzh$UoaD67*A{{CAKGS zH#h4Y#+|epF4lbcVj0-i_L@um`m+9yp7-X`G8jJIHm9uAsj_TMG#xdPmvaHGpYW9U zoAvl-uRRECAhEd)5&|60QFnvGJNFX!bb_5TF|GOxgweNJnM#MSuR1q;Z-6u0& z2Dq*$jR&R|^gmHel0AFUK)hM}CIq(_Uik>ZhtfyqyX60!tgCfZ0Zu(3O( zXT*en!7@p!Ow_B=SJgl7@;YvIxgIrp_+%-Jg3y<^@rY0Q?v;Tg?xOHuJwYzB`xB-W zm+Q1oTSlf=q^YW4*#y1?Fyoq=oZo{*CYvo%Gt-Que!%oLUSn^+g4Q^I!zv+cA@ANm zY(^weS4XM7;iJ<1NHd*qtK?%B|MivrzCl}_Czu?6GkmMLb?2#zXL0hZ`P9?qGimi7Y9G8A8iCXn z%87K8t9k`I<@>-Ua1Z$GsD3r3h3&Dwe~p=ze~){hUX#MXFy-u^MNve^n(toPZ-?mU z8BbnNeexH72zS4B@@D7;;X7IlrNfKJvfkf)yY-O+TBMKIlLTK6ec;@^r(V*tr~AMZ z%7>qp)m0j{b6V6Yy6dAiET%geGVA64SXx?|j@Fq0Kb&B4fsXiWIWD#9_y65n{a1^c z%Tc8#=t|Q*JN4kOD-u}ta7dj}QG>kpUtRit^^iYg+4NFXO)Wwd;qEQs8}S!~`|qC+ z{7O|jA&^tRj(^LG4kL8Q~nkV?sJBR22 zomam^eHeXN!XqOiuMELLERVJRbsO_9V)=PD!+EY47#Uq2f-zW$S^XL{a=&6Q8Ar(% z`Xw8nn%Bk1xP_NU)7E7A6{jpufeH9}JySK%->8>=Y(SnSqm-1?m2imC>^aJSBfPvoMEm41o(9HN`n%v&tMVqBM$r-#}8ez$g@ zmP527%XnuaH`00$N?&fNJ7lJ0>q)@DT@6T@GkOHbMoO!6MhXQ01)DTrJFv3}to z7&^PSY(gnbO<&4P!OPMg=}RD=X4vM1XqWy_!N1dct2_?Rl#*-_lkI-GyV0qoXaup<^VR()Wb%zDBlRBjI~_e6Ok1Bd=&NcM#6qAh-9W<$ZgmNy~WrJsLgR z7i`=wTeW{UpZhmP{D1LL_+vT@SoUrn=sH`? zuaQ=s?*H{+Zr7ZCjp3rtWco5X%CzP3*e3PYY(uS}xXowJaLE6^mk_$c_=}e?Hun3k z+y%9~n|UCGWT{`0(j21GrPnyldvOT%^2OO-6shop9|Uu&UL(KAT--kb#0*C$#y7wG zl6d-wY6!hXET`xYOvzy4e_?a}jW-Q11=4!AQkbZ~GBdM%`MdN#M|9!526=ocCIj7C zY24_YhCavD^gm8~xEJ40-JIauJ1_r7+&}&O-#qSLKgu&YB9Fb19k~*o#TO2#QvDZA zo3nm6zf;RuH0JAF4c%D(fcO;rlSxxGW%3;e?3F7mt4O2$`Mv-3IsdP?EtV^MFz5vT z=E+S}L@H0)*|V7!zIjYpKGgi#XSO9+>2iSK z$nnc$7^A~aZ}^9-{y$%6=(Q?VF^Ua|`C`iZiM(0nfzpJY7)aO|MPurG?fU*41h=tV z8Y(8ymmr_DZrbWfcYG#GbynJ*TXxu`Mp()){3OLZE=J$60~v8y-nIH`amSKm_+a1( z{@jlxV!=D#yVPpL5n|D1Mt?rC;(A9eIl|A$sK~s5jGp{`4&xPU#-07g`onou^R9Oq zbsDO)J@;n(^Z))g1s3jgZRjlW`m?eD%@H?kK) z-qDuv>znp$#MRNzoS;9w)P*4t`cm7m#6w^VKc%iLfLX9!V$Y2uRpX~8#yZg1$^fVF z9MbxzUey0UDu29I9&@-v$O(seJr`ga22~ZI%vSHkS@vfm-}Zs^g%nlba#tlc6G4bF z`GZz3c!qjy>`x~2VJN#mrz$tE{#ng9Bv&L-9;s<4R;1#88LR)7M4*}%I98M% zf9;-yQI@l&l`GTFj{vS5gwrwGci*N`<@hFR!`97zb_aP5jJ|fRUlQw;=2nQW|B^mD zQKiz$Z@TKR87@XAObont)67h0I;``vy%vWs)`lqBpO=PM zdOFxpj(BU;0Nvwh-BL0x@^bwCoO1`W8+M6g-eV-&d$j@{4-*Z7eg;EDYJZM zQgpdu`e&K^58i^4pN>1IzNn~3BM&3jsC{DM_J!A1&-{EUeQ)Poj=;p%uHNCT{aG(m z^-nt@IZKq>f@d28qC)PqM>6X(GrJwr%yKOAr)MjSQ85oKotunrkPi(i2I zT)ZJWKfdD%(?Ek*7Z+!grO$v_MNIF|8&E;R3`7XT{_>g6zzv6JCqo;mDTw>Ebttaz zi^qf$N|CU8g@{8HKbT%~TA7<%hl@a3YWDO$RcnrNfibfmD8uR~QdY-h&aRjc@ zNGKh#)@)_+e3Dexd7pwCHN3WIoqe0Yg#iV~D9Fr*ytoPd#oXpN_8bHy%LA^ZW*s7e z@q#f07mh#9s_Teop{_OKP)OxIwC;_LWT)kl;&X-51hEza(JXNN_y|4QU4y}fhI`yP zNJZ3LH%RJmPUj%3buXAg!NUkfIS>jCb%jlTY6j(AGo1#4WXuE-23o9K&?V&f-8dNz ziGQ5pB_6s_5_V04Kn+}ys~<9G z|E+BjwHC4`Gayboj%)EjYF{6avQ@5#CBY2&vV2Frz(9!8>s1Xii)px4(u_`VcIYj0 z`-PNEq7@NOV^O}t8@B7!?2j2=Cr|nfoscQDP8&SeRp+Zadp&#+EqaSHtaWZsu!6YG z@>PtsEgRxnNyMZmExyd1B{m*c&RTWHF!Ua9UYVB7O^O`@H~ zn`d?&79xm!c#veQ$sP1yBDhQ>Q4*Oc;D@`sHcVa}F?qoX59NGNV`M?X!-B5S~n|;{>m8hJoVEj|G_^^d_ z2XpLl`?N!jSE*~PS(bB+C+X6+)^v9M$sut`ymHayYA8TAEx70bNr&-dZFoErJRdj& z9T{ktGCyCMT~V{0DcBj$YOSoC%4otRX=nGFH3kkwy{{RRoIp(xWJ8L}D&YRL_$*i; zxI3n#zP_G3J3OeVlCNTz&pQl_Pvx|&XrfGzAG7Hz8V0Xr@LNoEtZ%D`TlsDjlAAEA z4FMAl>zMcv_s$H>cnjMOU?AXd>3{%N7$Q$TmB+JP+Ud;^4o)jnD0!)Ku-yHNx{&OQ z9bxO68VfdLpOjHtB#nO1ii-EefJwz5SGXS>!3b#q4-J&BH7n5KGz5AX*27+r0+yYM z2HTy@S6fp4)6j>D0+uYWw5-!`6lLzSN<<~;D;tYWIJOf}FZs`#4h9%sUAtWGtM8mP zy?qxAQn{eABB9BfSU+V`bHeY9ytUjslA$=qpW;_Gsd)#(9Way9aAPNdp=jEF`UVX< zML_ZH?O;R4`M5mNde+BJnD$XqXq zpwnvIm}8K=teJVMDEHZ}I+?XNDrNwtrGs8e)a23Sa;e$uJRO+;5-U;Q+-R$FKFe`_1RxH{G^vC5{OOAV#8vl8K8cj2lAQ#F*ix z_6P6a@QS60Kv_4pDTOANk@Jtjk1XnVVXpT+&T^Y5d<5}|9gb6I>T^-1y!&|-|2-ES zzF~D?FKm~X69h~VQb`36*`UU?Ca#eY9a@WJ%i_7RVu#!y87PAP*koC%!g^D)eAe@g zX{gMDu+~sB`lB;oq|yS#*u+c_hDm$=oAQocIAcQD< zzIv-mWmg$fR0lEz`K$_*&2g@`5Zp7}n;>uB*F4;!oAhYV&9sdl*L13Eqa$GZ;;CK3 zPSDn{q{o?Fo%c;;_mqE=`u)j~pF*cCfpDbCzM@;*z&4J|aju;*2F#6^$V5k1SJ%%Z zM>XomZk&I5|IvT!7q8_v3YWXRamWk>xMQHn$`JIlpDNk=#Li9zsS9bR_j|hCRY2$er+YIM-NXI0S7S03P4R z6+=Z^Y1<0q-7}`vDSMPOmEt=mW2?<)@D2?(_Y3K;q-G$~zRS{M!wL+Axek8*zH zV0MQujQM^^j9PF50bz?`wivVrQeOGVJBV06dGt)oh_+D0tG%EV!-d^l!oKh-yvv%r z%RC-&%k2mS@V6nl6a%FME{~=gwB@wP6sqVo5SVD(v<_z&In1J*%mbNEl87Zj(zzAGX+WFRw+hgFl!$!;z5NTc+aRP!YZIv7>f5&%J-pb8l z9nn@rD9Amd5LG|vZdIYM_bdsup9_(PV(g2#NAhDtM+#_>T<_B$lE9?bOc$6AY03wb z>D?=cGIy!Sm6-`_KOO!%Yh~bf^|WMaOfTRX1c(DXlD}i&V9otX!&)n`kl%zT3Qg4{ zIJH>(r7brFtyUfNyy#q^Qwa4WdTp(FU6(W!5Ei_UVmdM#Ba)i>z^1C!dEdCVvJH(1 zyv$7@UEZ|q2SOqze0lvHha4JorHNTjNEl&BX}`%3>m7RR=NQ6shRjjK4-GAS_Tk6V z{dwET2c8Fh_mJ#Nw*N#>Lnt`bXO5p|TZLGAeZ+PjtO(+n>nVi5?W_|(5+>ZrHi61K z@|!=@2wq+i8l`3BI#K7nJ)6Egjj5KH%5kCyTki38@#G95zJ2lzYhJB33YJ$G^h0A_ zMY8ZF?rnxKV7qoV`@~SK;~xZ`;&?+=5ae`^o~!Ko2hpaA#&EbZW*g%HJ#AZ>ub|0yi(6$tq$Low9FGB6vPc?KG5FOMvFz&5a|+s3OK4 zpdzau+F{Yg3sRkttjoONG>Q6Lm%$qZF@^{3jrP4&L<^7BoW0EkMB1U~s*RWY(9DYF zN2(LHBrDWYOjH-k*-i7NZ=Yfa_#ax^8SOxvoxyJI8D2Y@npJGw8l2L#(yOf*nnk*- z%<^HYx(@}kjAp_ql(Nv4CLnrRfXYgFOpfgOAQ7*?dR}458heXb9wV=HL~~QE9%pO@ zcgl<+Pfbu<^W-`!AGOygPiL=vAXJ=&TKmh3{$m!vu<+~WGHdnt!H#A2;#HhZ)%P;k z2`$!5Z-@GQ!J>4i}H)2Pk#yKoLJE*WeJPVb$D?OS_7A1|ZKiR@`Y3!|bJ>8*_f4of?SuWew z&vLCc^m_0Qq^vDL`@+l|dtvbY>at6P&|#XMBJRu9ywT+@YcHfnpNNc*j8=l;rlb5E z#$kcbS~FA|#vR~loj{Gh>0o@D>nmZhsim z>OKJnL_KMI=?|ZJn}w{~o2(-{>VO*wRyKuDRsoo#NQb#t&YG3%>8=%2v3}$FyISlF zD2ch#rl{P@gWz(nmDfVam1tSqyVlIJO+q~W7z-)_hoLD--F0J@mpi_`7uYawnvE_S z=@Ub|jw44ELusxvr|0GZbH%3(vCMo#{#x^L&vs|J4 z!efL}p^2R(TmESe(l(>CYC!ckLlFS@3uByL#;1|YxStA+$c6dHXKQ}?4Vd61Wu{-~3Ky2KlDN%~g z_*D+On@&daWu??iugJ3_PQ_3&*Vhb-R=GzQvcY3G!OqtaydlCYjKW-YDRMBz7aoE` zu!#yK;&5D=SkunPE+GOBYrZz1gto*H-o)89*&tYJIaRnkYH#u^kz8eRR}mBD9m}B< z$L+@ULbH>5WV6c7M(nP_fOz|s?pQ#_UBFWD?svb9ciOZ+%sR;Wkym!c(=7{}Af~ZH zJkcyQZXXLaqG-x5E?w?bO^y$hF<4nykK)eNLw@3pIRz^hf;I8!%Hs+;^7&BP+gD|x zy=doL$}J!oC;MiJpwJAp{sxoIEf1;f8%@a5vmTe=oZn}UA^Z0C^4+otkzD(iN_Dlf z@ml=Q*GDbGbTfShZ;U(<-o2{KBBULPQ{Nrve+51isfxJO@t^#<9SNq-t?7(>LcJb;J%FkKnkl?BdaAifa9AT-*`V2$;b4Ku;``AJB|kxW?K_R*jx*6<5d zBBl%4J=vjD?=vX>c6YX9Inc!yFf`zmtRqrgt#Id;R9k-g@YyK4N6QMUJNV_&76`uW zChir2$6Pdl6whk#fcY6Lo-H$hwU4<*n@9_uqFP8EixTThRc~H?@NRi~L`O^(Xnzs2 z6RH=PiU!xp#JOyTMeUZmdIQ;05#W8wvlF!cuYGAvoJO~-?=jSOdVL=!sH)VhH$M@H>0L~vK={QUe%>T3px zdsKjVp69Lj>=euC(+d-LcY#v!;iG_AEzAy^Pt+s?E4COWe}xN>RK&f>5iClU!rCqs zRl#PU#~Fov!HUAI0FF@19WWunBK(4(=yI(ngtCP*s^_x0N_Q-}8nP{Jzw$%*l zQNT>ez&FW`g1=p)n-`PY&)%B4uD__FuwJV+4!J9&o(^(FETm>7oVo|H;kN_D8~4Vq5+t0f;OXp-AnKDgb!0#VO8 zNO`r=LG+@c%`1`}%ZevwQ!PA%urb;eQ0CjsjMqyd$-2_%YiRz%%yiFiGR0TB` zv$mK#BX>|gi8OqD-$PwKfT<|6F=CqIAXWp8b+)prGk7?8(PC7cyP`pw-Td;g3^DE4 zkl8+DwB!YF*(1m!P^<2O9t` z!J&I^-`M0Do-`d6X3Z&~nT{5ciahGtGJMpjm^;j>KA|^G zb~^jS4vlx@lnO|OWi%#Ab>iBFfq~*Xt7K^tkjOytk%^AO=hYh@sm>kNgu&&nFrWYW z73)&bq-f>)u@N`!kSoBu8_zJgPeK$MX-;%jMMu%zLJp!5Y%XElcXc$axKgASxYz0a z{VwNoRLC}te`Fy|dKy!MR8BLocIxo$#PQ3H?*n*K?x5mavQ*D!Hd(Wok-OQNioW+~ z;|`d^=FajH_HM-Q0C;?db&B)qE#adopL17viIMKJX(R$B2w^ zCL6f@EZnvPi*GDA9}TduE6 zzOvfXr-x%|E^idF*}Wrb!=?6~X=>q*a!&Jb;SZ;&K8geof2KIw;mCnh0&-RpQ5IUa?soXQhWK zBh61F|8lxe|jq8gMYrP*?`8i$` z{-ed0n37f)vUcu%WL2#9lisIQWG-&0cN^EAGbW$)ozx}c*D3gODw;1U6FIB{CBR!7 zT?<$iuN|O8TavqSACBA95xbk^R_{b1!s_)m z;vXsLT%)QQ`>Yl7Sp1V}Ms?T>p=o*9#pn3}G{0|C@^pSsVSTXd00c`S*|7e;GaY~_ z1olOdWh1_==8&vq&Iu|NLE}RE*IF-!iG}Qg1K49WorpSpneQF3cP(t+Fv`IoW)n)J_!i9rC!gjnq4$0U z zJV{To=L&g8xYKciZEpG?52$w7=y0EOuQ68Mr{Fybasp;9x;6D^;J(_%_jmF0=XzQy zgIqnS+yM)t5@!Q^7yN`M4u7HR2IBf3z8rpC??1{bXsa-_#vt7bN|Rf^}DGc z^t9lu&3xg8DM_*vL}~ZOw=F=xMVEZVc+AtW{658uVu5?lIY!!UMvS`mwc+#q$i5TtX3C+%?$=~vY>_vx=gFapl}1~u z)qNFro7d}g;JX{^yw_f41b(&K=-?Pg(;S*Uf~D~v)8c%M)R!UKIsN$7nb%f7(b-OB zH8Du8Lz`cQbp~mGDn4v3heCW=j-8pTbC3r>THWv5_P9bw?j@-UbUgX@sjtMAiV&ss zL_Z>K-bha<GdD#YBI?mf^lxl=cYcdXBdETxnfX)i#=w!~YA=nt(*Y%oW5cr z0D+EqD_;XFv09*Ta`@4h%&2-0nIGN+f z=|_hFtTVHI(jRYsW zzuf%&D83N56Meq*<%JJ6u3X1*gSN+a`xwlZory6gmG^d%e0Q1n7X~7kxlCljmOe)H z1sggc9S$cbN`7$6osBtjknn~=TK&*HYP)?Y7*qL?w4Gbw`L`e3*~l<#sgMOQ)h*;) zyqHOY9CsFCc$q`tePidc(}))TK!OCx(r4jj`i6Y;DHv*?W(dA>w|Mtnc#6qD#4fv4 z;G0^XZFRQqe*nO-*M0|9XK!$g|NVe%%| zyVEc-o(2<-@ggWI3Nd_{c0dU^BPX2@EjSnJkiUkT%(SfZgaZL8)) zoKyXTHzBn7BCIvlI&iOJSLeg*j2RI=-evaHhj8lqEKsn~fd{5$I1H}8oC)nKC+`~R z)5OAfr$e&_vlB?T@0?fZHZF;8to5c9c7%{-T09n8y8;l~5V7l@ zDnsn&zA#>!3Vh3q(&A4DgtXC*IBaiIb z+s}al5F25hxkMji^93$6{Iw_|U&41cf`x1SGM1~3U}_3#@b_1{{&NZXzXzO)&oCY5 zRnGST1{E|>a}}k^Pg0PL*y27hkI;8{47r2-G>?GIMvM{hbmcTPCLDCp4#jShbcl>m$v!Q<~*w^xjcbra=HKPF*H2Hgg zu8Hqv|E*&pUzd3}EL`p0g$}=y*8r0jOh*zmxh>v1OM-#&G2vD1@~1{@ZdrDYYjsa1 zeRqmb)4O}Cq}MvaGxGv5qSc-^_Lpq;MeuLSZokre#=X1oZJ*03$*a2MEqt^p3=Fn1 z53TCxeHf3eL0&PjsM{C7ZUEj#ib;!1GQ-A>@Uh<(=y8C8$Ly?t7&;UvlIw1_dM?zR zwZ$`53q4)8>Ed4P^Fc}VF zG*TOAxAzF6AvOv5jv)XF4UDl&5Q~zV+e$hp_n)o#CwS3DqC;DwcM2a?E#*b*CBt5l z)#Z=gW^>=+&J7*c4_|F!3V>Gt1hzf|?=0AGHf~t4o~sm&RsKYdt_Ca-$LO#g zCS;#hOU*@ypf!hfB?sVbA|}eT{_FNx@iTp~5})rI>6*Fok^-{QmZ@9uQ&bl?bWM&I zG-X1M*4!Vwfsf@2e+gyb&Wu;wOy_$Oo#V#?;9~M+(CxpFy9Q^f0^KKAdWx0LfS>Ll z4e&@#lAwOeG^I+PenZXqkH1y94oI7b@y06CVr!xwJ3T*>io^@STJFhz|7^5L0q`m7 zigirbLbbB%*Gk_dOv0V^C>CVeYBSOUb=v4|BDep#BAn$cT|puk2-S@Ogsz+Fts(kfuiU99uSXfv z?dJ0yR3?@IfDsOp#e|jxr%Np)$Fa10jz%i)xAaf|M5DQ9mqqD12Dzv^%0O$L-8o?u3G|%V-aRI!4Iq)ONvoFx z9u3r?g}V5t`|i+Mk~P9<^PpZ-w{K*kthYbwmN!bo_<5mb~_u~A3e^%0Z8>CrpZ z8+R^xNLibzJA#Nr_OA1i^L3j;9T+rFbV*!m#>V>sma%|Zjkb`UzY3?fNdmbh@^I}w zj8^`mZ$=Oi7SNHRi=cP)C1EOBmNONHJYH+@X?Y>A6grKS)_ zax@g7X6-><+wTrS z4QVI;&a?aOrxrPEUol1jb+j}9kp)c@xM?~xQJVZ}RVIFBS^f8rqVNsPyo+%}R0k*& zxcl!Up{}q8K#p@6KB&L2*f6T-zjl~``I>{Nx!3b*>-#oTGl!h3P%GhM3o#7#nQ6|R zx4>ZV-bo_B>EQ1`mK5g<7X&HZz9)hSCAj(3zsJ0KzIEnmyxA7O)nIYg%<2+^+39VZtPY{SS#{3`n-kzbbqSlCeY0bO1w?|$&r}h%?%xgVxq3hi zdd0Uq+3+CQz18m_WtaNu1#k-wJXE07b%-eih_ag4wk7?W-)%qI=wKHLkTKh?9LWt? zG2iQ#1ulSHYsB{R`epznyI%imKh=6qF1=_g%5t@oNicZH8P@q#tQYWUX_ubC8IQ!+ zv+kTM^ssO7pNorovw^k_0mI?f!$hiod|Fsjrf$^;54ojzyVj0G_Z1(MqeNYfo#1aIil_tVhpr-8dD)J}EqspCzd zdqA~TAgya}trfeyg;k+lH16WGkMK8{Rf4cC@?&SiE`> zWmIZ^0ApzJ<$h=qSZ$(u0ARrME3xLqOuW&Cc+aO}V(ARq%-j>4^p#_oF3FRfhZg|^ z_o|i8s^3C2<8GGyVn!eN-TUg^UL26+BGYmLM@q~bzi|UqZ%A%#$li0`^;S}f+uWNx z0MIlYG!+8o(;44rM#U=>98j5V@TM?!;StN3{EO3t8QEu!3X7C7HkYNX~F^FI~2}PfK;Xmb3<<18ngl2l;m~U zyQTJx3#NKH_E_GFY&k&uNOQ*QQySWV+JE`0`o2M8)U|TrqY|i?ng86=V`6%(!Ngt~ z4|uD}x4)_@1a^;^^;W#k7snPB0t7e2zTQn56LcMspowL)IDc0Gh}eoQDQ0$j27h4LD4UicFVYnd{bP}J$~ zgkg-$%DG3sUGEnMM0W?|*mYE5) z`|+)RH@6yB-6v`^#t+n2t09!L4)!-)cm$q52DyzMG*cJql4B+9p;f?FY_!wIo zjV>61AdU7qH3+-!+#W3(kIfz592vQqW@!znKLw4OQeIkI%&NbE_?jP+N>v83o|=aV z6e$3air?(`y(1pT41*S(j(fdaZTRZlTua-YEa-v;R!@fs*-~Vi`XzNZtOg@2_I`A! z6bF`DWj~i?ziJI7I2;lN5;gB=BqZ7!07xE#E>t?MSqjJ0*Yrzn`jqwXcwU z#kC1zz-cn-C-`APX}ZH#TC<*usiaN!#dslA5)|ME&Nl!f9WQ7z*|kRvRE}(3%Gb%H zcWbD{EMe;>_pf!d4gzG;IxXrE1;HT?U)wiYHDWE%)!zR56#}C}z;yu@4G*Sfw*V^* zlpJxdyscVbN*nV=ePn0*X199n7`t#ZcVn8_G+c=Y#Isp;uRBT89q=yS^JwF_nVm~d zastL%wLaKe*4XZE!1DW?>RnqZdpfy_7&*kWrxN0+ZLFo%Q^&-{&Y7IxGv_$xJ@0X5UR>*2-#;#9!Q{zv-@ET?Ut74> z7p@EGqAM<`pUnsYuHIPBW1*-?1_dG$As+zW#Xp|mCdXzKj;^YB52JRPCS<4b-Z5}@OQ%+3d}lMG0I5qS;WjlB;-cZN+I24VAvoVyV2;R(`uqTJ{vvR79aEiuLn3==Y`SL#CxwEuCpI-?F#C`92d`z z4dFK-)*is095A6u=41>qWvh>;HNNj?;PhB!Rq~8k$?W2VhfYNRySk<`7?>^9Fkdin z-CYi;CQfQupEe5#a(iyPULj@@e0SSc6tO<_1;rE^VRUaL->%tmN+VDsp#7JBKt=%4 zC1UL3E-ri#*B~SdCo)a0b8DN8U~D% zb=zjJA^;5+K8&C&DUIwic(E1Vb7~2qKzj}VKdk6{;r~!f59lmY84lgKUH_|2Hn1SB z9zT(T-FU63meV%*arESLiLLOYC~0e}m;c#wWbbW-hTV3I!CZ>l_tD;;0+z~v>6p~4 zER`ZN=%XILF|>Zl1cil;kQngsbp5r~~PzE|iZ*9IpGJ)A| z?A$;bhhzJZL#{!x>`Om>{#vc) zKB28Ul|f^4ciXj9J2J%$ZCufqHx-9Vnb|~;5|0iC)HB(LgIEo~)TDS3dY1@VultsE zqsF+G3*yWV{7=!Ywsfhf0{@G$ju`b_---3H3^;zM$6`U;V0*g+^*+v>=$4M1=+X5n zEQ={8?4IAi|cH=!1VZvPnTLy6aljpZ6%?GIgU=E_PB6mQ6c?HKl zwnL`?aaS}GH91+_`)b7$ChWWxgiZmi^qj_0(O@Q|5OLzAbdsj3SoP8MkO`)ZAO}$P zOa%BHwzf6Mjs!cUnf+ND?Ob}-X6!jB-skO9qm>yGQ%XFqz*hHBEm(GENBhAGC&uOx z$aqNNJ=99M|G8>%TD=6l*R$0u9v<&`^PKyby*A&f5SWlIXQ8fU=PZYD$j7fK>~!eE zP#t}By@n32f~6PxBxDl%EMg5|X|>_HMt6YkMz0rYswzX5Heyzt60BLy$L$8xg*!{w zOEeQx4+u6KDd9TyM5Fnqw2&+4jNi+O@T2=r9@Tx_W4L)EORofLU`L~}`pb;Sh^GKD z1oylrA8(1WUX>DG)CbcYpI-qWVP-&| z;N>n#|6XKT5`Wuu3g(w^QpQ5Fa0jYyGT{J@H?qjJGGZjAr0|OS)$%-buZNkSVx%$* z;N)xUjy=V4RoT>u?^O7?>+dj?M_xOKn;L*FRp5bR28_63R}}*TolU_dHR#mw zJ_HIzWX6dGbV_fXJzvi#m&Pno4`%|ckqyuqvHm-)k$*H%)r8a}cPwRN*I_R0d?T@2 zQ%FSoh!3txuzx%(DJ|tqdaIw7*j(+!+OGgz@HzOJ+Z#~4&sr?L=wPM*qFTo{popp| zVcubY-v#xdA&5A?v&FrR%4i_~CIvuL-rZ@EOU$s&n$0x^h5bed+nz$_nPvHGUztWJid6kY4>U zOo;Ths1ISr$|gD5^0Mse>Vd#XG$=eqgd}?77A4=%#8s5id0^Y>Lp9YT-RKK@=@saO z?ez%L0M)0}A60Sa{#+obUdkVii*X<5X3hZVvnUI%2#a6C>cGGo;f4;g&ZS*ot`BjA z1EBS+X4ltpuv2SqWxGTmh%jSR^1jd>;jEqjxM~==k}%H3p`y6g2RH070|4`%Yp7y& z7J?iHgV!gja2Pd!qqWZ58tOoGOhaMWtEyP~7G;69zS*K6^b7?HJc=apwX4zrDdi*Y zF^gY4l>efgD>?Rozs{h(;&1WL^krXcU<&-XvzBfg1{B(&pB)2?<8$bou4DZ6eaq`u zai9d)boY`)CN6^#V^4GxqG05u%2EpY?!FIJto~erT&Jk#| z*#lx*DNZ*~aX>tHuF2U6N;L|f0_Dp7>^$drmtQ;d1JL+^Ka8n;Z{xnZzTb81*Dj{- zBI}p>95*ysyg@HeK z8SiHw*dk3L9O>?B_V>Twi05ST88@A%{Abnq2mkx;9o=7#Nd|ogSoik>+5JUTKfpYG zIDUS)TT?C4PygPFy3RV<_(;OWoGy>%?)Hu07B6_s9s(ojx%=W%1uH$#+F2!3k46_EBGy{0HCdKL#T* z?Wg_`dq`$9d;blz{vU7XKVN6LugpJ48Sm4(`u^v?_%omKU;f5BN=CL9Gr-(yHT?bD zl$Vn(U`M0nFe$%Pc99Om7hTId?!-?)w3t^8vBswVx3S%>Q`cG;?TKkZC_%qHyxFNX1QPoF&@&4R#|v6sqe&Iot*3lB_*I% z^2L2U^ixz?y_Kvti|gdHZtF<&*mqC-cH{^dK^s*vS^HBSkef(; zH9AlR#Y8$a|2t>FzaGCAm))b5@ZLO51~rQti2ZvkSU)OVyBEq_zs~OOzJC5Eyuw{8 znkWMaNuSEJI)T*?FV}{eRSOVMr>Dr+*rb8C!q3LO`3o2Nr%p5>os#uB{Bg20i^XH& z11r^mu(?$GT;zRJtiQPLEStKzIv~^buDY7C=TU9yvHb{UAGG{qVy`rmr%x>vL%6D) zQf=PY=?Qvui4KFk8U>cEw^{7=@d_OhSTC=47soBUDXNTwy;!DaQHeHtX{o_Yk2+a;2fHeYgrogg2?Zfn{Z0NZU zN(9KOHl&o9C0@12mKPk?0P4o^KXv#&lD6;j4fSxc_{L{zD%{zyQlqO1shEhWMli#B zfoG@Qqr`qy_)XFMZ|^)UzqmNJd6CT8V#@}tX`2_VeU;fy%ZU?CV87=z*&89s6*$Cd z3V)oB%WR)66->1Ry}GDS_xu%a!+?-oA`~|~nkk?blB^Ol zj@HvLIx9llPM+>@X&0TE&lw*K`;=hiSL-5c@_d^X$zojL&V$C;gy%yeBVNmgFhgs> zm?dqNK@q2jn+nz_r;=b0$gp8hDKxoYU1B#VI-d()sk?ZLTV(N@A4`a?3G^a-xymW2 zU0^mGeQ&#xyd%pnQgmrZAW(@W^0_(~{`M>(hyfVf7PjTK!Ec z5Gi&76YTE#!XU>YaZ7ULbK-%^6;D=rWD*3S_3v!&t17VWxjZhHodCw_Vls_d2v3lh z&ZZZKa?}}GBUgPm?36NYHC1;E@J$36I#%<0TOPoM+D$ZR^Ls9T;rtvze9z}YXenIk z)>PempSM401E-qI`t}iS!~;QGQW2>IOc5C?(!b154tzs=e&YU zp{R=tmXH87+PO~bxZS7P#u@$42MU<-Cb-7 z50j}GZ^|kFmW57|kX6W?r+DL7*cxo7DZ^~D;XFbSdg{pLY(|b%`?~$mHrnu=X^nB` zHN#c6<&TiQP@73DSzl!#iGquN9cT1IQ*&p3yD|dq7i-lq%C-`>gR5~}!eEx0>7?w{ zkJ3w=%dVRAvymBY&)!kVG%2u*iOrfHK{Xy+tr8q9^IYuTx3b`59KYx@79=u(16(`M zPCk?@f$5Bz)QZeeV*ACF@rM+NR_&5w{r1+Ft^>%{kXCB>;Iq_?O zPruEKU^WR!HYZHjHBW$&YrtBYqySIZCULqm$z=dyV8F2R`Pp)jb;qt`*{%6P!2-ab zX5I?cVbFZ0aLnCs1}&p(!wj9Q=`U}MjqZQ!pNV>Ln!}0D-GvHrZR~Y-;`PS_4X_K{ zb=tXsi5h_#+ZpYRaSF^f7EiGZVifWh$UpDfDC9U)%&$a?E7ClCWt3o1B*{j6rDfHMLM|leZ3x{ z@c1Cry`csu0$-XaLKjInt0Xqr7Dvmallfe-e2FGeA>@*X`@%qxjZf$JrHO&CrjrV1 z?__i1js`?t;YM%UgkMB?_8pWB{Zb=|n`dTYW8=5O#zqO*xwjxue9x*xFECZu_vceh za1C1LhBnLGmOuc;}_$o#+yM5LS0zr zF^(i0SYGeImu+A3I<2d7)-ER`c)TDF?93k3D|?{boo&p883sezuxppj(9lF==oW@P zVai6ZU59%N`#^|unB#K!9v0dDeOi{1W*Ip$$>#uRUplJVrLBrDl;siVrl?5}mJeu? zO548UaNL_0U#2GyUi8#^s%za*sjnP;RmgF3p*>M2ny)gSvd{^gZ7+1YxkoBJQ!nqG zk=;}q)0kQb(W9(*gR87cdh@QAp!Ju#q(xYj;+VV*{w18Ej@~LZ)`{2f)+d5(4}p_2 z*M6(`GR6%jJqBjPpxs%9B0O6Ib$JcU6$&xES@~9})Er1}tYt~o^HxjRFJ)baSa-Oo z7X;PDuJ66z&!6)JZb&{-p6QJjVr9iC$H$+!}#)a6yx^jVs<8XXxex zA3)_I`c3iJH$o+lC`kTHF0I0QD8_9HnJDY0w*NSWVa&?0!5^ zqYxNK>lgA|@id3rV6nrf5`=Is)^+r-#?}}MSs8^LICZ)DR!ROKlq*?-gehAzI+qj)e$1L|$&UyJGh5U{Z&t(s+Ib1Fi<7wtf#22HI21(QDEVWU2W`Oe`KFFfk ze{8wtSddG*B$p3why=m2*IutB>Y4yyeUS;XS#Qzt&TH*K197?LxY_3NtA3pLg%LWE zC0I5pi5>JnZmv2v+>8@*YYO_FA?>dO&;PUl|Nes(hi{@7GmWMKh7=tfo2e0Dr2K(M&Y^{UJPv)^Q?>m$;dPr$@DJ|Fg&qXEW2c`Nj2nia+I)=4uT{;cDk zt21=s?nVaLE$9*GQur~{L@&y+h72lS^Q_|i2EBk~-Lv#qYAnt6bx!{WY&LHJfUQW`sz6 z8>i~6n&_2oc)`JpB$;kBa9+NwTyj=y{ArY+*Ms@qEWGuGS9{e>%p6Az5zSu>dB=%+445ZC7OyBqfk{@$lV zP*=jx%eT8N&{7-=LaqHZOuO6r+dDbD3pz)acY9-rV%6@b&-T+OKIePFUvgE5-w=*X zB^*npAHvk?C}okYJ9pLYXz+qLaY0Ug5k7j4c1fIN4Vb@TLTo8*`%Dmq|2jPNzuVs) zxdf2vbR=o`fe_d%AUO63p2@gT1_gS@;@fkblw&!F3a)DJUO8ugE|Isfsa@ke8WJsF zmGssJOsX%Ie^9Ig`fPJB~1v!DJ zAT5gGh)QDs3lfOS-{p6LxBA|e*7mYJe9@j}ku>LTkxa;l|{v8)>j-_5mCjuzvl z+EhA-^lmyl6U&XCMK68u1a#43quZFzmXF+CAWeKMq;_mI=a{@de_ZKQ$^nQBlAzG- z)mHhyv)VR~RkCtOYvcXL2et(kMi7`{vNj2U$ZwY^FR9L zf>{v!V>Pv7DmPX``A}mhm_2Oed5w#b!l~-WCj>TKi_A4jb4qZ)$Ps9rF3MZJ`kIZ> zCt@fTK#xQalU{3+DR1FrzS5kq?0U17o5W`}aj--)OTs3m#&bE^?`k~^EanT91iZBlcAn~fnT zBxA%#Se{iZ{DDEdu!DD|K@~gWLl5n<&YS0L3{6c<%T|y&WraI(&UlN+n*cG~>B9mg zrrAG-v~GUHp{OH`U~ss1h7R|rTFLf#Fp;!OCp25M2`U%Krf>=-PZ?r6Vuzh^8K*dX z*YS?2Wld^fx!c@i`5KO^8g6s8b16aa!*c&eS+mafm+;l^bMxF(r5E0B4j_!r?#A1w zC4?x|HRVr-5cmMQrdDpl{ys5_EfMWD^UGG{X>NtOlD?s#ot$*yHmbt10`C+`gvE(Z z8l^{pseA#<;LRm_Q6ru}$Dz^{=WhOnl&OmGQOd4!rM~S){Xr!qqId%}{%#ZCSCc1L zr=2jQuqOVG+5G6(f8fxD+ zh85Vv4&VFia-a(c?QFNl=$9JQ>t2v#Ls#OQ5CRcA#xzylOJOVmgdhzN78Mk3hv&qH zsZ78waZ6wO+97zBH;uJDlx%Dwo{cH@Mb40Z=ptA_%N>KocWfgnXC^mEK|5h><%L9&J<mYqG~pows=PJAe_587 z%T9S(64v-Rx6(d`Kf$wIe`q*%nFlT+WmI<6pv1PUe*y$KF_UgWw%zv輯$UoF zR<2yYWK5jSoja!ltXhMGvkc`xNG&2>d^L_M-^-Ls+K67|jbQe2VXY~4{+dm;UULNZ z#W4KzQXg04LtpVA8M*CaRwO@eZtfSC!($`fd&j%aHrgzI3ZxepOWQdbXw#K!(IwzF z-o6dkY8$9G>mfHuyQl;mw+a{ zDcU9)RjHX;SP|wU#YA%h6I8i+h&M+4O@)p*M)pAvy|^&?HPr}bOY+N+n4FyEZS_{; z)A`wwQ0!;zy>~lzzD@`GB~6VOr9w`PduX{EfpE8EK!AOpPta(WEWzL3|DN45JlpXv zARjp*slXogBA97F*V^9VU{CAhQ#NFi(F<9ST3r^X)7$UmJC0EcKeDc*Dtz~Yrt^jn zT8_t)2Qjd51Pq!h$`}E%*rttQYZIw(7o~<`hpyzIa;5>qDqwqAIW47`0Ey&@Yt9eTQ@%;BV?hk!dnWEFTZjc^)goEOW6k?n8GjCb35Ln$wyu>4uzCkG}GW8+|ett)h;8f9+%?O&9Mz{(sK$bD6!pW z+$vvww05suvfRnF-vqibWL+V@$88}QH=57nTiR1r_ucoCHBo}fhgOyhYUAf5uvN8#h&@>id6G#S{@RlO=4_^>9D+VI zg-;wfAU*dcJa0P_%C?5Pe7ai~T)5~`rORqFkAA)&NS~<{ry-!2zq)W_Z*Th7FfBEG z|I?>WwYk1HZOry~Wz+@Gq)Y%)(LjaTk*${06}`JddQex2kC2utaWwAYtJ;l*<2^?k z3zsM<=8+>@0`5B`Y-`RIi3>ruF^dk6EcXa$U`AX(Eiyx0+Yh!2sWiCF3|#|M21SK1 zIpJH&p#i*sUTd_qPH?C!Jg)tYwL0p0O91}W69)G4usCtICclI52sbV>l0LSvRi!O1 zirb`;b+Kv*IU^7oMWtj^?y7IJlC_lF9vR3aW&c^nt9qz<@n@V&AI*L?wz+hj1PBUF zF@;@B zQ^^h+#(f(#4ufsP@{p!Qi zBp5)NsXW(+wqlBjof!{P4cyxCfq+s856W>js&qh93n8k_hv-v~3?f!YGZ$TU&G_oO zRo;$^$8!kRVGDMoM7KE|8_iRvO5GRAjXcVrrX32xWzcLFGdtb-a=x_}UK$!2j{Pbl zl$6cVhK^t3p^GPXwx^^=OU*(q;et;WWFS^+K&POpVAZY7#T`6&d@2e?s#`&%Ao9l#TC6=zJX!~MmZLWK?mD=77aW`g`DoK z*%k0Z7{VMc&}#-^`^~hi9O;}38=akmcI}9KDmlH?Fn5SDy)zlOzy{=zxwJD=krJN9Ayu1g`uR|aKGEx z<0hdbR@5);Q3b3H8Mje8$rP({-=+S(4p-D)VN!_9MM0296Mrw!ORxMb@VK=)%DKY$vpfJe3~<;C3tYC?Pu7Cb216uM_y;{;x8m2ahiMIywqJa0FM%GuLA9{o-@>N<=q-JjxL-D!UnodCZi@H` z?r+z`FOc0%DU#v8YuukV9z?adeJd*CaL*=pOx zu|W7~=Q+Bae4^7eA^GMum7uZOQS2~huVe5(a4bmktkx)gF5?VYKlgBxt|#dimm3+g z_FLWlM4UxuXp^gs{tIh2c>AuGyQwdH@HV>qFX_tv_Qx{XCsM6JAu>}j6(cSn{k*w- zA=d6e&Xa#YT|nnyx;ssl%~BgS4RNdxVD_<>A+A-6zf+o0rA9_EMU(9_>D=+(%^ik3 zmKHjSnmLv>?IIE4#&%y3%xT?k4(f9ID))#5cl}5e{<;-St=`{$)bNC6!8cfVRp>Rv z6A2ls`y-9K<&3t2mUQ5w!m)YZpAw7Boey*of~dK4w1OUAtJ9(We8!v%fM7I!9tg%k zUHD9Hb6K2A&k>AOdo<%kg<${PURaS`uRLzCqE6o`o>?VExG^U$vsBb^6O5l{OvO95 z^+Os*{5uatDTd)Cml1&)XNQV_Ew_WAA*vO$rphGU3Ozf0BXtQ|<| z?N)lDN)m^&9maBN2z9g}qJ=}Hek^ba6R(9JP>!q)mugSdH3`74(cA>t*C<#s6e#Rq zkTMpw#y+L`X*INcw{-1*nr<IVK-;p`^{DdSe6Nn7(>CZz|dB2uW969z3@W|>#=}XE;DS-uX zfbfyB$&|4nRfSzrOuc(b9fuMbJ^|gBeU*JDl!~y0=S46cpg5*F7sM#yzuVwP#513P zfF%Z-8#&oZgJC&`PjjSLDK<5Fxu9d5f`TYmyst1r*C8F{+RdCMI%m!DKRztu(pBA0 z6~Vd>!l!<82eiwUmyJt|cl(w%H(TY;1@Z89$-l$*t`QXDh{` zkW;T94{AQtwV4BXw)A5!D6DFgI|6*&JKztUKayLen6azIR(|Yj6@pC!0ss$pTl`0$8&`Irg})hu;ttct6q3wT41&*{S(Zo>W5FYLjd)Ud zXLh^#0GV+CJ6&xk{N7QyEYA*|tuhzJu679>uN5ph`tpH8nU!9pxlI{XE#oY{u11(H z^a(TjTd)5eg7Yiv#_-iv_13(xqaNrbo%O0U?N|SJnBQx)+j{Q!aAYA?hDiD7MnJ8+t_Rrp%oNX`}>LjHaOF$?DB4LVaaizP_a7pOlU#{ zcUfp|%|;IE=cVk5r2qtJ>+LOUc8m7On5N7UufVpneZA4x@1JJcn~%L{X88?AstES@{C zK3`@PNQZwQXfwcyo$W~+8p%LszIY>KJ3ctuogEheLHM}7e*O9;dsrh5Y;)>^mA!j9 zG?IupdsNep(%a}$IpUDyTu#(-I*OGkdt@GB&?_(`Qh0&Zt@q-nGx6R^B_L3F`Pa zEsEK!u6!PB-|TTiYwbpE6~jo_gS)Jzer0pvx+Wnh+iS|Zz%BsFi?Vaid9Axa_m`v=6-QWGkLN> z`+cq&MryYMKk8J1VFLIWo3k$KuU1Ti&pCZ5knNhGjYa5mr)zU@?~G2NYXS2FjWpPT zBntcD0;DbIl4i=pfo)aEi6{Q{WgYw^0uvoTM|c_y?J(wn{{2c-1;z^i__+Cd!i+% zp6b^}F|n%a>2ZE>qUay|ibo zP3$OgZivIZw{yi*83IBg{k$Fcmi+@2CSdm8n;V}Aj1%ODc}w4sXc)ufo!-CZp9rrq zn6dI>uATg+ln-j%#ZzQlz|RkqcL)zRjDmt7Y`>FQe2kQqU$IJJF5l_s|K6fsm1o;bh;DuK(-BFhQo1tPxf_!Kl;EpI*t*9&waHyBswF+BwZm26!>8uIyd4(SAAC2cdUv?|6ez0% zqnq~NJO1&?kXF8|-MqB(xRzXUFMl4U*_4Sa`teAJk?$|Q3+ykSXwo>84BPKfP3*gf z^sCF|mz3D8SgGm;_S~=|ujMT{e6EIk-!a(}m;UR^7Dvl8mWOfV39cL!MQ1V=mhn{Ebc1f1;|C z9xZeIW83NJlDi$9beluXc|0+9^sol`>%(*+Hr|CcJy)t-``{XSQI`gdXI90#rfw?Q z*vyX<)wmyDj}fxEe#KIhSLWi#1`nnXYzWrHzyMtRD(-6 zDhn=#m^%H8Ix=jL{Pyi$xsJ93KF7|&b$(lPI)Hz}Zgz8C-qCYXi=s(1VWDmI$Akc{ zAU|AQS8WsC}y$ti)k|!%AO$`K{ z1~`N9qx*KpU0U8$@KK#@VFCuf2Txcu9;94v{#g232hYoQ&;WCg+6B{H8HV!%$#P;ojh!B2Wu`ekvv&;hRr{|s226KXyR8otCig3odp&NIB+k4+$=Ym~ z2+)DKD5b>g;Xs9NoI!$M3{fsp*&SU_g8ucHAjm?IO;nsmg=^eb#E51Q+2fy=k-I^gl+Ytv9ld+ zW(pnhzgd=B>+`z%s+ z*6MkvfEDkpH^N>Hjbdw)yo%_#JcTKuR2fxhZnczTg=MJhjOeyLhxyvp5LLqQm^v8 zC>74ofM{~m)6#Q(Fa^3RpoGtCY)LEMnzU`a>iol3uunXM6ZAlVd!RUTlSD;$K=luS zhPuwZG)y1zS*mj9($)Q4=j>m|fZ1XrkfC@m%zDgmBl_mAej*AtCx-p~6!U-hDCD8n z5sMPO@UoQKcaGqOsx%3TkJge~qZltjm>BJPGlO&$)Sl~b$H=cG2X*G6hGIo9@u6If z>(yYphsZ#@Ap2Y2vW$0gR}Av6h_KD}WQ6f@{qA{-pUTL|lAholD1GdHZ>{~0=l^As znOkt=wIxfYwUtllc-htHN7J2Y4zAYd%Zt$IXgvUQ1(5drB-`HfSBQ1h1;eRkMlL~X zbtkh{o56@o%?h1XqIYBT5lR7k`TpM`oV$jHU&*(Vs9Q=|a4-~V#-Vc{A|ue9$DU>_moNo+5!%^VnB&q=>=nyAEME6nx4wQodTq3* z_Xc3Vck)BrJnkMpGS@lpmfXU zL4+|DeLnF*nbnaa@3aGw@e2%#ccdp<49^5aoN1t7fdMpOPa}@)X~T}dl?cnnlw0ew zG(O($%{Yg2(gb>>?b-RZ=e^u9_52WtbJ8Zi5tH?mkw16~&q1wN5)u@v!1@S}ML(?T z|KU{rJ@)Kt+TUMVnu_&>zi8}$3`xf`2wtUHfX?)kj7`|*LW16Xvj2=J=Ol@K=A|z| zU?ktcqfb;W4vW=REOCc8pH68o97|5#2QRYi2@KEBnVRa!HZCv{HOX%yph0{EB37Ht zkxj)ev(eYl{9dz}sbJ_XvuQD|!rMv~4-~Y_)^(v<7}{%-=V+`rwA1Hevo*uP%v>Ru z8u^UKt&cSsh#)&Txt|oej0!5^IKW|ELp+59;jfe6IX>eS+F$i0SMvz#c{s_ViDOND zFONoQfAk||SSU@24|a&XqR_fmR8_1PvKw<5OCL@%1ko9Tj_%7KZsi-qU@_RvbVt?N z!7Y|twUE9H1$3%zi7LaPP2d#pUJC=o&jnN^-WjEuu<}3e=K?7Ac*ESzIdcxUDTX-@ zD%{6=%}f#70-Pd)oSgG#->O8l9LKVWE@&4!)mZLhERRP#n8Yp%tsdy-`!qfa;v#Rg zYT=&v^&*F^3uSVT32uod(Frw$9lxE(zqH`r@B6##@X!Cs{!W76peCPtXY4q$WO-5l z_=klKeyEAFuxE}A0e@vH3)H*(F~-bGypWSr9%(FK$T@ZSfn9HQ5S!9S&^rdX4o>ls z)YRNhF3ra>=f&oF!_C`?@ZDhjjm2ZUtq*;B3GEyCcf-)k>~M7~Lf!XS&oC;ASP?~X_Kq#pw`^4F)L?M1y$y^J?1 zgBmo#*{&}&h7X1PvN4X!rgw>W?;uXVVb)Jn|NeQq0+Y)GiWXb1F^R=vlzG&DIVXlK zlCcMxoC+cN+#?JrUMnld*)UXCNjJJR$yKCyKtOd!&)1*G)JEV?Uj4d@DO}w6^y!oJ z8>%`bsqiY>Gt_b!5iF$p8S_K=V_X%grl!fAQ(2H4)qd`^iJ+%=wzwEu+R4Zi&A)Yb z|HY!(3;7zogz(hn%zsie?8h$pyh%EbuxQ|PV)3=8tJA2QAGStkJDjm7_-sUW`66I{ zIT78Y%(v$?$cMl9woc#dDYcl^6C^XH^gk8k*=DgeMPp_1GF-~D~RJIE#Sv_ z@eZc)6SyvYxoJGt1rDyN&{eU93aOS^P=GLuUqMUUw zw=*SOA!ggX$?9&uxg0rKH*eMSI<2EDY2`}f?_2;b4fBih#CN_{ohs=V^0 zCZrAws+a-RkvuS*SbLp<>4dSE$L$8v0=8l-i{Gs4LH^P%@`ORemQL3gKm1_MKK%hP zGUNrEf+Z?`qYZ^Q9U>uiS5vm=bYG^7hQ=!yRO^wMy{A!8zwXl-0 ztLR5hDb1F@zRkl(L7n&(dUPQnU_6}>ZM>EUOTaiFssuu1D#vZX#Pk4?Y`|ycbIlkU zRqps$NEp4md{M2|34!x-z4aUG&I*yTroa>y(hygIVE`@WTU$Uz$F_7$m=s^$eK1ka zKDE`})n31VsA6Lf9%5UFk+gC&0u#6OK)O43Syx6UG;-=&ONeZXWn0C7pWl%m3b-9a zogWM!0~rMX`3-0p8{~Zc2O8u;P2l-z3`d)wVxx=$oxhE*z*FWAZV&A?4@v1dM&|=E;bnX*aS=T(?z%7D_!tP9#uso&Mo-b!a^A|^h3-N%ZgyY?TBP>gNV)6y9!{jy#VZ)*-Zk~E-(~Aq7+81{!6;~b0&TKZ z!wJV#?a~t+k*>KIBK0bmgp?+-i@94PBkX$8sdZr_)aWi%{A=OAExX$Xp;ONoWu7yzp~1J~ip*D2&%8H74lx3?Bf z@02gKS$8G78Q|m+(hmVDj3etAmw9WheeZPlCPrc1uPAyKC#6yX=pK0D-Z=~kuMEs3 zj%`Voim6KBH>bNQz-X<~<6DnN574CJ5@$uWajj*x+am=4s@P}SY>g-NR^DyZ{KF^B$q3;c`% zvzI3rj(WP;p_Uy`&?a&5*o?;fkf zwecBhXulg;8>fvnp>YHMMXhdsPDMujmC1XL8%shjZ!jEA3&X{S4Vkh>zf?TL>bv9> z9}Qh9OBrr&nYE1FVkG4Xm49m6CQ(dO=Y@zlgw_nUJacz&Dg$ho^kmM5llf8l*| z;o&d)51sod|ESxNYvqo_I8|QRAz8mW)+KOYW1!fEO-*tmRZ!>#PV4ZYLoWeO%y@ZQ zxtr}wd1fb9)2iYwrP`83Z|efaQ;*Fq0sqDL9Hn$&icE%)-1Eh2JS ze3--#iE{wE_c~qsazNd^SLbWw#n*LxVaG!%Ao9U<7Z`;dd+lOH5O0-91o3MR##1Y$ zx4HeW*Ny|xe#$?b?;jqaa4iDZ6?u{2 zBD;`4I;q-TZhn5nV=Pkl#DzWXbamF&3>$+oXg167z$#t82^GS<^ee{2cPI$a4r>G6 zo}RbBK)QKDuyJR(w$jQ9eQTi2BH=Ukfl*Q`F1$w!D^CfXOhyp zPy3x1zvxQG!$wV+h+wJ`d5V#dW8c1QY-_(lLLb>s&<=MQ?cls};7=3zhaade04aEx zs-W@uQJ`kgZ41c>Clv21FjhQA3Jg4o-wbPa;hsQawqIrs6B=KqVJ5{=F3-zu#tP?V z*kiJTqzLN;ymhv%g>l#1fXQU!Q?8fVEHx^BojK@t7uK8gHl-5NoyDexz0`mXsH z^4w1qB!eP}zss5Z^eoUpJz@LpTel>|F!_9sB{)65ZD65o&yBWts>lG^(`N|?s?{kZqic+mk9Xg|WQhwHr2U+2Y`WUjQsy1V z6DNM#+`JHw9OwXhYrf2MAW1no^Gns@aQWwFR526CcGMN1Q8WQ{7v_4MLc#h7QRT6P z2{w-)2KJ?(omi7sebGiUpwx*t+}^#YR8M>U#$E@tttIT{w&ymGbm6Um2t^7@X;9$4-qfif^L$T zpL_XWFjK{Q`3>9El_x8A3gq34QwCD+6f4tvEe)fS4AE`*usYl5^*Sx4N!=WiRG8$3 zi%nlbwc}J%*bxjA7l$_AT>f~9nwlG;63-5b=&vtpUv9>16P_GparbkGIw>Eczzmo1 zqfGzhgA*!-XJut&wKpcGZy-us)^Fsz*%C@uLP8?YUBH|W*k6v3OjKx`%c(LK?i$4H ztR;7+X&QD5A#kLliYiJjqDxJ_6%~G5t=5kpy6h7Xai$daWY>&yFhHfR$)nS-uAZ5j z5e3r?Zf`G7e}+VQ-zq* zqYQoSN?2IVO1o|J+Rj_iy})v`nUnnGoOeiIF{4 z+-3MSWPChNifY`erf@DrKsJFdZqNDHU+`^oZjNiBd26CytJRCJPM@cDr6x-m2w7t+cbF_p=iy z)@XS;j2-7NhE5kRB#x6psy}-~yKEV3 zA`-S9(7UwXH-x(XOUM56PYL5kjxr6ZGZY<(0M>hz3fp|-7p())4=Fix*C0rzbaxNkHSl}cy?6KS>h9j( z{q7(88JKaHdEfV(^PJ~A=e*^L9j({Pj?l)&#;|rPk2Gv@{*n5 z^F>ecDE*Obp5f=5oXu8KTDr&1(T7WS%GqXy`8fFM@cn*=Iq$KeWJVHG%X_%WF zpW5+&?5X=frVrGVojVmq!&wWX=-4tvSECDeA-E_4}G}uJg6OV=#_40o*K(# z-AJ^snC(0?ahan%S3QQPCrjwTkwt4Dvt{SY<(`bVvhwm}2HNXS7XzbXII`TjW?b92YO!{sFBbtIp0=l;cMf>mN)IW?<`D9~MN zGz23t#xbwSr7HIdmaxkojyG#wHg4MIEL>pd@fxqN%F7KW*FAmg6>w+JT0mro=RBQ*r6U?0V{m9 z$BD((&5%xZjuKP)%KH7b8EU%uPJG)rt`4SuvZBy8Zi#~L$k9>IOkShxQM$ylEu@;u z|I8i#*fWM1DhnC1NnM>NgoHm(-ObHdGYQrVTmMj4@-(d#|ra1K2xk~RZe6J6sjd_ z!E2oR&C7+;$I&X!3?IW(S#OY&`=)R49%~l}2sJG&xIR{=S1sKL|Kd+7d|t!delMqt z+vYTsCl~c}RV;3Vm5L&v>RV%DTZ6Cn3_`W@tSDYpd3CH>kwIOQ$^D3AX{s`sHIu!l z4KX!#Bh~WQpHp4W;K_ zzRs4zyw-h^CIRhtGndbjEATubV|RGzwYhwyF{Bb;zW2Pv@p|!2QY3v@TJgceg+$FG z)-ikeDwad>myh!`cWmtUm(449xVY+wo~OBQ$jJ5r$dy^bv^{#^&(noE-xjM-gEU4l zf?kzoQ9o)QX~b^1AFBa3$TEt69m>Yr&!Ff_!A)}Z+37lU;6(QbJuKr}txrd1<|`yT zaTl%;8EJhWtx)MREPV5wfUMDWu$glXVXDWmrcx?FuYTUU3Q5sA87R6+E z;Ks^Mo1Y&d>Sc1&lxLrdHl80?9?cJ?T8Mc)o7vci*w9hTxs!AvDAe=`y9)%ww3F45 z>d65`&vomK5oz*`v1&=v(GruKQd%jKnH1CAvmvJB6zjGx9M?_vM*Nu#*Y8JdcU-gI zne6f|EsenKmDO~i-P|}oJ4#6}m#>{jX_@rJMjxx8e62#NX|n-82?obnZ~?jP<#*d5 zCcV2d=^#jYrKwrGz|Ulr`>oIFt95p0f+0a~2xs?X++03Of0wCNA+&r~@{fM(!bqfE zqpon?j&FEc+N&=s+dH4s%OdwX9W(Y2b>)0V`oG?^GJLd7;;#moPmO!{Ft#(0qW8XT z=Pt(I^bKqvYEN6)p`-mEiN2OGRU<(*DlF4OO-7^yGtiN~XA7M9C>T?qgK=DJFf4#q zsWZwz7R=_EOyVO^=k-W9Slo4Fw@vZPyt&M%<3x9_CXpZ2+7-*++^gUr2s zo0Na%Q*!pIIvMryBI7APp5sCKR|&6NjcOlyuI|y%(V>lpz$U|h@wS){8Vsd+^txpB z7!(6;IWu&t+#(WcP`Om9V?a6Xx8+oL`KI+N6zDV4@kc^|aiJW=hQdwzuAB?A^ElzG z{PjQM`J5;|U0tlJyJBrYabtg8xq-y{w!gI@fd>TCFXnx~0jK zB4T6jPYVVmK=EJdecZ_4W0wahn9fNjx5K1U=DTcaW?GfH`Yr??97KoZOYj~1&)a80 zAt`#L54!&0BQLQ!YV3{G%j0961Ah6g2#wA>sx;}^}t<;{htuZZxC-7l{R#JUD{)Q5gp!! zODQbLEvG+3A=l`4*W{{p*7e&IAgZ*kTieT~T6|hdh{s1uM_s_Z!<7W*ujVv@^9(|r^)A&F#bg2f zZp3PKD^>&63kE^ziKigbr1SO`8Ie-YDlBNm)Raqg91NH-EMhc@V%JNo`7&yX2+`x4 z4r|nao5!rOX>45hfyaar z_MQ7bMRm_x51HItIF=ePZMJ&c7}o_Op=nC}5jcl+FQy^t4!`*|>KA;-b57*>*4VfD zUUk>y=edln;UDG;uKc!>{}j|>u~Je~*|RS4AF(D}n9gEOHHV++Xuy+dXJlO9+}dD# zM1fA5aD>F#ZvFD5;V@c1K*D|mJRuLe%XZO+HSUDVD3?LP;j8Np%#ML_PSW!v<1P8p zqT+<&%*+j|OR)_zaokC>G%0U`U`a0TjP3VQ;Vm_ny>#GPQicJa{DQHd5@8o8!mDkV zgmc(@-l5$@L?mJkc`hC-*3!aJX7c7-W8qQSD6mLDinr=smgZYq$IrVl1>1Ae5nQ@x z#~D(*kV%X3=%&VowhA28y@SXryND=6RTiOMeOFt!ai!G`z?{r$C)sZV zn+eFTLL}9tn;-ZFmLB>-?m712xCPS%#RlJh^eDr@%>a5}-{K5YBK`;aU~}j5#@dyQ zTsgoSA0KPz=ZrA{5J=lu{>l97r=ktSd{~@P?RH{rOVO1QQAOf zeZ8NaY-Gs>FdE$`R+WH-94dPbY5}1R)`r84m@rwfu3J+ZdLO1eM^^eJR2(Yo>^WSF zxma1nxwyts&FdYGnT$3sMR9JhDc2ap84Z=uD<(j6@42R^ckIBuWvQM$(*QE+#|LAq zeVWFdxOMw?LqX!e5z7&43`tY4_Hxj}2&0n^)oPOT#vU`2nq;~yRSY>qFptB8N>#s= zswwO7m&v7}UhXKcJ~6Qz)T|t|L&_7g8zlhbx*dDEXO*u4+ivDRAX%)k`jl)i3OAL+ z%DhfNkHbjF6=}vK?RA!6nfZ;_?L+2=4`_(Bex8hj%A{M5f2@->Chu?COY&STn7}75G*5SAPa=VZJ#Qn4&($%M9tTUc z9R0QR_53|Dz1FIXjJaygIdb2#_4%DguDQ!5nq;PLj6KztgMfwZZlaH2`)++)YiH2+ zL{0%VOu^e3%gA_&G=HR8;>Qyf9ZhRmbC9q0^yM_b-Y=xTzRw)bF8B58uEMog{KVOQ z&(G9ckC2e)9T7P>d39FZ7Pg9<()c38CCg)P#cLqkTx-Kd$x>r>jn_;mDTzVY%nW^8 zz!RnOWFD^?0@sMEsu*6$lEeLeqUne`hrR0y4DTWZG5dz%>^O8B$w?c@2uKTugViMd z{dNbvQBcWhHDu&QtcG5AbX-EG)6YyY8E^B}_MVXDK5@Sx8Oucp)ScgRy)zHmanQ)mGdU&j64GUdzyMxN^K^r3Lx7oj1J8(ywUEuF=I(Rlmlusv9 z?X09h9!K6P4$JNlhnV2YfB!4dfZBOJcyJ+&!asWQe{VLQiCX}fN?YAzxXA0*u~mny zjxxof)aEe?$pPRajT|iwQI` zGR0#}E)q%$IyA!3eZy}Xv$bUOPB%LB&oAZQu-NWXc0LQoHQrU=W;M8;c`#@^L_58B zKLteDo=PFT(IdLG_NarHI~*2jY$C5KsK_M_nH6_NF(zpJNe3*`4>rvrN}F8o(?_!o zB-%J0kP{H%rsw3w<6nz}EWi2iq%-ck(uM3JUUf&}Q5_^=Wj21?+mD@UyCS2u_& zr|e(`p8)G*m=CteQ+^D~5*Ge?TC^*329`YcMROS+K9stGw_=FMe2EtUQ=;qjmuduh z&DQ-m$8Yc|Xy~I5!pw9Mng?mkN1ufAm8$mY2cpQ(uA9*&oRz-)sKsH-NBs|;7-S7- zsOu){)QsI-RSaRz-kpZ0*f$gXQ_TEN`~UZmxL&q^>V|T*eMqS_7h|f|k~*i&PU@n8 zf$%5hR?~1iq0B!=u_XKm5~;NUi#-P{7WdP3Plq&#*;dQ1c0oc&{L zKVgfmPL>Mg5>T-OG1WlrVP^T|6G$*VT7=nF5*miQ z8Kwc?^7mIQ*=X|9@}H6XLJR=ot;TFielz?w=Swh z)L*`|bQ?K|luv*2!dC^+mRrq8ize-P3lJIBUs6*+&R&|O?o*|1V37H(0b+GLA|8EO zjT_*!=zlAv3TpbftK&W9*gI6fG!fu`-iy0Oh^z95>QJy!AP3{0POgtqZP_#e8n|moyAGD_8?>)qN(JaOtOW+ z3@y^SQ*2~s!feOmgqITXwUc3WVy3#}Ib?tO<3Id}&6rSQ3dY_|BbU7YeH?zvLH>MB ze)@zIDmw5qbSvh`p*S(6zOMGXfG$7qw-8aoKpj+jzgc4_(T?^{@AL-K&aTXtli;6T z_m`=flm+_7iSLjJ7o7p+YQdo91#EUpSFL&`xcXh=nPlM#_)2^ivMAtq51bw`F`47;sdE&E;PYen z0DcdqVgLHjDs%q{-Ns#3r3xDp)4QV4_%er3Jf0hb0*5PNT|UG;qebSI$8{$deN&AQ z3o{_KN7Uo~MR1f-LyeD*pV3eYVPX7>m;7n5{^G|$(b{Y0Oihv!B22c!zoe{Ve5e;G znJe#ED<<>=CZOKm@QrG?#JRKz3H8REw$6Dh<2gZpY8_=Vk}aa}DURclPX$HRph+l@ zcnEtPl`{_%5E@!XLg|b9aSpqFf;u6mWXFYpV6;Iyu)NvS(( zxLIs=OJ7t~`v9>EPGzt08gztsO|SFp6+{uC(6K6+ANZqB4z+VjufDZQ(gEXm_mmm2 z6F~sCBYOD#`z@-8!^hdtTjk-UrM7Ob-oDkM9yn~z5%f2}g`N=FQE-Gl2NDQ2RHW!w zR-OAld9A;TWIk#X?9{JL8*-bQbohW{OrXM~qEZVr=B(3J9CGnyHlc;dunQcM+%rf7 zX>a%~z#Peb>F7o=F5TPE$x`H`98FzB=$3nRkCQzdhA zl1u{RbOy#=HI{2RoOe$rZ%+oo33wq8fE2%1tb@F7&!(BoS!XL)zTmtTpL=i;YOe%x zf(C=)){o+&I)&zI(zo7z8*Ni1VZGLGgMu<|Jz2-YnhjC>h_lWJlKRlX=|#Y4pflhR z;^U`|J~JI@PLwRoAxo8S)9q;(UhsUFT91b#SN< zASH6CnNN}Skn&=vuCVQKbHTtPD?~qD8+R2hC4Of2p1xgD{_x~PWKy+qS&Dyeg2cj+ zcf1pn$xK<8nRlO2v(niOf@HN1p4D&o1r_t6O6JV7C<~OGDR0e!K*hh!zCJ@n*sPQ0 z4&{%Ig<66S{csIxskG{G+WsojL7v1vU8oG|Ez`XAJ-KO5&&zs6?M$sGh@X9JzaawB zR&{h$=QvQ-ze@x0+&Dxr6&uxQGx5PZ&>e5j;>o6Hyc@5ImVscS_btXmxJIYm)VL%j z_;<(VpN<>_BMKqSO?-TqWLkas`pk5rKrIJL484s7VX_~Mud`^Ba zmn=y$`ccuizl!vkamcUrx3&tD0ky>jUy*{PgL#gi&Q+_KIbwEe4z;^w8xrcN?i+nh znSkdLv$Oj^h4E!cYp>{hN>kl+sON6jvY@-8+Uj zOzS_|Sj_4oToCaj%=DrKW63DyLDh7ei%LjI9dz-l-PJ|xk6*YPvOGIby<)&Pws&x7 zZ6dE(w~Bv0`$bEhb_o4R^t1=90JC0(T1HY1^SOF9?uzc@YZ&Sk&Jt6Y2NgY$sWgg@ zY#Nd(A~*y%_esLl7&haFZHh1!ROEfE-8S#eA8X>F&)temO)N;}A}kY2-oQWaS;Wr_ zy>i27;(oMJ_@x1kTzwm8IQh8l@S0&$=lJ&4gAl)S-LSp#$zo_2aZc$knw7~tK|P-T z9TQ!0o52^B5Wy$+O|_%ZQvh!?MS`gWQ#hJ@AZw+ho_jY=2QZg1pe%-KakA>GU$9xK z)01Scm7$U<^SR4}*LDz;C+70pKs2VQ^r!gR0+AfFw5>>m9fF__sBUKS9ySLYttP)< zko2xxs=i3=0U4v+%EmI+;mZ2})C@|j1qB2}>aQd+zg;qx$$uMUG*ZR?r7M<^Hr-@% z4M~;$@;%ql5YpoKby?NHSG}GT^UL-#pP5R|76Me#(!9L5p6;9If6xA`t*x~8h_w`Z zM;66ZlE(qsm#!f%$2UDFm>!E=H(I7&xx3ceac7~zq>J>0XC~TV1Y=(n5NNdp@^l9F-~&7yS!KY;&3dYG~cr1EZHQ0#{(f73sJaOwmN6 zqdfX{9GA6%+@<+{R{%@MG zVtygz(SC2A*<3;^EZG68Lj_1}=$Q!^aI(9VlZPb0Cx%@{mKcpv>+3H&kO3)0Uh&%Z zH6rD52aojHQpzTYB}87_Q=9d2%TE9au4FRAjkIisA$DT{np)=LJt>Jym!k6%mQ^In;BzKpROJ~f5y zNnDpG2>`bf(>w;Zu9pogMWw&BWJjE&f6&ck^6a_d*~U@YE&?X8jy?JS;I8g9f*WL} zGIvcrJe}a#RJh>JuTy4A$GOh?=$xM1 zNU<-ZvFKWo#%)tAu=0Ei$yd4S@W!t%OL1^o%>`rMQcr~?Rlm2?IWtO6bi$)jB z<)(H+D{Fy8KMA|_ieLIvb&0V`YhI$QuqU=MRFdOy_9YCDEBg^S>Kr05&tO2UP!j@O zq_-Mz?3zFpy!m<`Sx+3*=s@x;n-M5Q8TMXY-6wfY7Tapbkl-Txkq>Uz`OkUik5TjY zV-E^O=ov>Jltk-fljFkuV|j&4@y-qUr5J!$0wb$T#+1M{oY;+R${^ohT+s|qZYrqT0tHn|SYZnEMT69sm>84H0flahxh1UOA{{TZE5~i`Yq+sT z#z6x!%VOJCej%VA4C1#-HW)h!FDWnsyzZ)JZ2-RdscW zjBsB3M$Crpa&6NC@=A!;amIn~3Sg+ou$pl<3L%lMHr|koADgqlgwlDeO}a|0lb)o*GO)h@hw0lM%`HjevhDVi1$AFeL_*@TPMd=0K$=v^ zg2Q6j7XPi4u_u(Tb1uSrW-d12>2y=ng%TNrhXFhjCI19C+k}H85u?TzFT88lg7Scb zdvrr=Zh(h-KCTo}EM9qDd#{>EK5;-hJg%}%dq4Jw*>&PthD>?zx5jU+CX~0kA1~Bk zKb32^^I+ug)D-CcDS_ZYUx!=hz(U}Wox1zo}DT4K1t*x z+RPA(7=uC=?#xtf=rupM0XIum7<_Iy(6!ys*L5L3$6b8>&>nSteI4yMtSZ8j@Sh6L zKVtvi7xiY?dpH~_ARut7-^|aWRvs%|N(3AA)g!Y7qq4guZ6)eScRNKt;D;+lUU21U z9L zLfA+x*3Z?|9T#6M-=g>$nM|G;za@`i38>+hcpf?LPFMCM@^eZpV5Ov_Xq1*mVxs7wnr}s1Mm{Do-O5*r zWldhE!OuIigY1PJABXp9?XFIUtauLCaA*uO^Wg3cw7>S!vJQ%lK7j_FADqgTj|?kD zT0&mGF37d10430!i~~5fp6rIR9w38)3Resj*i65^1!21y7mDalF6@J;^S^xQ?qADc zYL8qC%z19=zame~3#G#i>JlMbN)ycn*S-W5EOd#F47at(D&&r*lk1)X9-*3Z?PM4T zz4_K}&)LZq4R^X!j@-T|&ici~aL<#wIxDrF%;PG{t#Na4X#<(&E`K$7YZ!ep|IGuk z=h>j|V2W#(iRPKa1r~H^JhAKB9JQuMz}^9RX4PeFE*j^(>h?%hUd03`aex8GaBh_I zPcW7s{-+Vg7k!jv-iEw~dAc1O-rn9}5$79F!8hu+NbA=;t~8H9T|WcwRA4%ZqCcDz zwWcP$maU9Ti$C#hY7&9+aPQ@p&*6iQUfC`72Uou1lyB602ZiZcH-7Yr57LxgKHGVW zrQ-vNVCwLr7cU4?WKyp?(>|f#6C}Ck*5>#AYqcYuS}z}*gf+A66q<%0KX})d?iLSm zzRPAX_k?Vz)VXqp+#(--W#1Q48?8y*oqGtmqVRVi^Y`HS^G9YdG>a==sMAueC)vRA zh!1>FbuWbt3s0_5~r>G7|>-@yA zxV~;;=(@SdG+L9zxiALQ*`Yu*%xUEd*e{TXrK%Lu5==ofULyK}d(-Ouoq2(XrZ3U> zm(sffN1uA2N1W!#?o&pdgAZ~rnU-hsZXQBLCk@52Eto`d^Se=&Jvri6BO>sjX40kd z)6Oxa>sBL@{TOJWU2NT^Kmo;UxzBj)yuI2xn_@Aa9TR1V%K=vsZ{BB#s^yMlF zIkklqvnuBsR8MRS)r7%1$D}tpF7lO)22kA@#FW_$o_!#R=tZ9FhbCa701&UGT&kHx zb(_sOtDCp*n+^t9w1h6V>W_yE&@QXcxIIdYK}Y(N{k1_^2V!WU(O6l7=CKN^;SwJl zTvAB*yxa8r%)?@G2s99};DysGQ@FUe6tFq2yOr*-NDi0KrguHo>-s1rBNP1enLEN} zb;wu&VO+7ro=A&F>ANX(LLU9S)lNJ3BhSZJ7EgylEVuH!POJ zTBS42H|U}ru7rt+sr)#SFlQ*zIJXEUlUk52Bqvt{*ltmv5c4Kc4a1zZR1kf1{mF#T z;JNI&%v9a4toT2X1HXHuKRhzIgF^T=EI2rm@!^F)2u`|~N-wWSa0~iIH5XJO>Q0SF zR@MCZfVA1_fG}&o8(X{(?@J62%StC2@nalBOmK6E+4Dli6+Ejmf{HF08IA>o7M*1c zG!QI{6J_>ZObQrGfwHo)^GG000;;C%(zLsPxbY|X*qX^&`f<(U-?IQn=bEB+<~`xO zfR76QUY}X=s~P}x^g<0VdfUEZIeX%o2@bFA#PBi~qTL0H7LAd!TXOvAXCMBBLX;? zq25h%V&Ny}-8)qJMYE#TNw!xbqv;QF4s$zo;GswTN1E#ZbYX~=%Z{ckNS zAho$Qidc^#TTP$1l^J=yzTb|U+85T?t33PBK>lTc2i_iv_`wX@Uz=o;nmCwp6>~Hhlo|&JAA^I2jGSM*fkW!vJX4_VW!UK4| zM&l*?ef7#0-f&KPwkgW#aY^rs7Xeom0wae=%F2@Ka4m`UW*_v{Af~gZs_F(TkKq#p|XUh@0R{J#>D8Xe~4-cE^ZC)71 zag=<%04;vXSGB*Jwprz=8W~lko6B8-yzoJefx^E`*P1?B!`is5Faz}iv9Q*AGK@tf zcME{_HdNdPE@%EZJ3y**1b_T2X0!z5 z>}-3}BYDp}aJ_VCQ2vPbAh$FnaZ9DKu>nz>6{FNN#yK|7HO3BFVk{TW833EjY$pXN zR9PY2h`6Y*Sy3M5U+AiXWY81BAI)kRCfn5QYmdijJW5I8=f?QS*#f0Yo>6wE!%u#$ z8#wtxp3}oIec7M)F5lBt|5C11DlTeq8k=V_KC(Uh4R1|lZi01D;&s(S7Z>|;wn%I@ zlnTqzoH(7i=6mHB%m#8w(Bs4}2>CD0oa#K#rwxbr!3En(lz76kjX3_~5*bF>U+?pO z)N#HNKB%IW-;$N94A*L6u%B*lMbvW&;e>!I;zjpXNqY2~w!Ev8|K58>A#xSs%uk7`Q3WM=xEf zOl=!%2D02@Piz@Oz>ZuiPllRP8W6{HHEViU@r?mJ2i5djaO-q<$Ta_zW^_tFV^9E_ z(cGmImbL`lmQR!`oM6T#{c!t2!R^{eX_aa&w`M#(NZn+;HfCetW2=(r;N)h08Y)KiGmSw11w z+1!>c($^VMyrJ;PP$oAH+h7djn7I7y>|Y%Gb4%oM6<+l{Co(m~+GNc2s(e?)n5~dC zAt@#n0Xlu=qG>YK{9qEE3p@v_$=kDj_MkOH6DjpT9&}3`_!F=SbtdJAg$a>YC{89A z$D0CSht3Si5^6#G_78;{h`mgq<$;is4_R^Dq$!jas{#}_lddh`1aq%W2gCQvjur@cZ zN}G*xhPI(RbKm&I`SX)Ba8FM6voz-W?Ol!1Gqz)XT|v30-d5glG@?&`m+SqW_5J)& zZ5X=TP>{2TgvjSu>-|O0V*U^v5Nv)igg1OFgd1N{MDPLOx&XJ_JAJubbikno_g-fw zR66J$s=Ux!5QH#@fEYNcMCqkoqui&kTqgn8Hv#TozpV@Hg+;0l2Ni>!BB24Bk(n#< zlVn-?pbFDaSvkAVMNig6%V6>|gc%<^KItyISO-b}+&CK~6irLbdMBTF;b7V^ch1Ow zQvo4;&x5x631BSj934d(rYP3FyqsTctH%o{;eEVWL&CTid4zL;ey}hfGQuCLWS)T5 z`{!1~dQ}1FkI4O9SrvB->jQa?G|etPw;N^WP-l%ynon#JmO}d$aftBw~Xd&$fd!+GZvf zd;$Yssg%5S z>p>Ms`1hn=dE!RDLUuRUPU;{ZdMew(N*3@6zI|)tc)istX-O8q{%{yIDk=()4XY8K z`u|U4gXeqfe3=)DH_?1#Yk_>soH7|=&fr#VYKF4c#X;B;4w0TV+t+kCDz=@ks@UqQ zI(iD>qE(u9O5 zN~spj@_1==m*PB+GALR-;SBvRyl6Lrexef$6>yuPAr#C1+x8)b3y5ou6xwYU$U>*xhdyM~}W$w{rYqeIR$hnI%)dXfUU`kWhT_+9aOosH-w*hINiAJfrrCy+0JZW%lDyK2e=8JakcgSO%f?OMe8NPkwt^ouM*Mv9O)T&5~ZA%KY%}3Wbj>} z&m)*RPjB*tG|Gp147}^s9*;qH<)6{~!wgh^!M>1UM>h5T?Y`US^s{#>CJ#@)sS=&% zk6|KW5-Sz66yyabxn=G;&!Kot%Z-A2)1tWbYVfIS)mHj4jM1jJ8833+C!Blyx6vQX z-X)=nZ^YwCFNdG-7_MJTDw)~xn(LIVH|Cdr=5l?eQ1U#h{(OM+t391!&i6$Q+m(mO zg1D@xXAEAr(Q#a3;~nawC7?gP#MyGO1?1b>0-@Q;l@eaJC)f=l!FY%|F8ayn zTByn`>N`8W&ld*dWL!5hlS&k3KY!K?yP=n4P3C%Ta3%gfmw1YXz-)fw(OE!+_r!HI z+8^E8FFCr|jjL2?DZ&B*0|%b~hm&!Wz^UVD`zALSWdeuD-N@wQ-IIESeoW7F_m#Zd zCe-;!0td}u?q&u1WiY&U>TXV*Vb6^pxAqsM+e2BOs?-O=or3{dr139fe2u%gJ_p4+^ z-DAZntVDttsl`08-56|Tanr!%?O={Z7_B^k?E&J%gJ7j5pir;NTSW-m&+)CTt#`h- zH}4&~S~=c>MZcB3S;DrAx*sc_|Gn+h;?M_yrf}M+uBNg_Sx>0-gdv@?b$-e+$9KHB z?*Y=DdLbZRe%d87(#>^&$;~yIdN9Nxu%Y3>&U9=-zo0=(K)vxS8_MYoxgF zj8piLF&~jubz(l2Snw}3T^HoQHzWC0i*IxgnC-@m_1E#ZJlT7H5_vpc0k%}4? zx=%gM+F{N^P?c2dLzeop_SqQrRYq#|{^^FDg9qJRC?78WVClaKAE&O|l1g+r(IXE> zTH;n(rP8)b?j-{4>Z2RY?SPXEt=4{g>o1Pd-zX=4`xgm8sG!|0B}Lma8?@MclKj;0 zEEs!@6W@@lptR)1YT4ri_p|mq-u{+rrz{?4efzrDhrYg&dBaB$58Asve*G);me~y~ z5d0+}Yhf>uazT(}{5=8VM?mL%jK=Iw?HFF8Q~35TzV9D6iT||BKRkiWFr}3bc$v)) zlrtd)pLr!*lQ5)TxP%%$cyk3gf9+6~Wj||tc0^pwk20%P_+(~7G67nRaq?rT^vfRC zc2Fg}L>hf{Da0FP7{9j3a`Dx{8iVm&-MM{Wh5xq+3BRs?0tM=Ww*{yt3S{y0BId*d z@n&+i2iuYi%}9xcfVI5AdylX3|mMmJ8W}vIh)7Yq3g({ zHWd29xBq=vd}L~`?bEd~5nn|?^MSnQgU`6)DE$Pq|LlzZ^mlyt*y)$xH}V@P9SwP{ zRNMpCp0JFok8#0Dv}}AN!5>o%u0|tVRb=BF%7xerLAGEyZ&;cd)NyxYxsgb$UAjmL z*k7n3e>rn*J=8!VyX;V{^v9_#Km9O&X@GpVD1>9B$3w5xv)oT}NOG*Bvv;4ssxWz~%JbZb| z^>{frejT>Q+zU1jW|~ah1g>hhcHrv^zq7OmiGKp`IX-(k{`<=O_~?BWYLp?d(U#GNFxJlQM8Ot1Pgo=z#*kIpI)4(K%=6ZfAHMmc)l zWOimcTyq?ArwvB{=g-go;cfr@X`f>{ap*_i;c-wq+Zlj^X%M5+cK|O0l-%vtfiXMg zAnvosa5eO@>{WEOXb%eUf$qqp66ZpGWR83pL~U&T2`_6JoY&2z)$J!K!tb$uYzg)5 z-SruL4ehrwv~DgmSN_DMyAe<)oaxE~=%dbHGF-W^zfHXVyR-V6M+v*w03ITq@BoEj zhHT|W{N_dZ1mBA>46B@GN)@(i3H7I7a0Aup*b!a8G>|HRfkl=hG(goo<0n*{8RlQh zc(TDTXA%!G*I(upv1TgvtDY!;qz#}UV$k3u3U1Vac4$*^y8Hit4f0kh?a|f;BM0PK*1cSz1dE+00 zDF(RCC*vdPpuYeiWt-}8bTwkB7l=qHS+JizgrJYP?SEQB)M+{?zY%#(XiRH$g?>iPQa;=W-*U$up@ZiaKZ` zX9j~PmcOrsqrw=dspTh#d8ILi(a}O9K>PK@96O^?e42~-FhIc0oadVB)Wr42X-DH4 zo>%u*CtCC&g!jup`>46C?X?{rP-X+IYr#iX hQ)~reDU38-I!C-fb94RaNU{FC zY6q)e#W5TY8@%VB3c?1*6v_KzuTn;Jdw zakY0(GJ3um%Hh`Er0avd!--#+rZl*|pl=-s@jRZ-wtQFn73WccJ5o+sm2h2g=nd~) zmr3Df*E?DFzdzHKnCTl&?J9^TIUhngg|dki%0q*5JP7VHj@`MW_NSINzUAu=wYK_P zD>LDmg*9-AbjY&Zywaau^lxYOySuq~l!NuBDM=x}O-T}rKt-02qP)+1YB?5`U z3247v8*x@WNjJ(~lAwjhR z5>@B3fr-Bom6KsA@fMZf9<{Lx0p?G~cF0A!N;`FoeI_6_?HpQt@;)$0<>dL95kZfz z@XLts4*`jaDCjp|yb^fz)dwBl(ez*>PwlEt?tJE8fRB$mPU=Hpc?VM&^p|1RUoVLW z7i@4nXxC=@pv}*5+Ib?e&>jVDvvkr6Kk*($GLB+~>Z9Onvb=Cfy)zSWL*(-5(`HFA z!OXpTF_$J$fv~QAKjU6PqKi!)#H0D0{&nKnUeC4B2+(YRAs}$QV&%r2xW6?VSpmLD z+3QmUJ=afRrZ=wT-lj4sRSo!}C;X+@rV>l&`Kxu72)94%N~jo0L>oN=;{2t@WvZuC z&8O>`@OlIG{nXvg(%y)+tJ*z34NrgE(Xxw5*gE3An51=1^`a@rp(#V`7G1}Z6E zU0%r{w#(>^|NQwLT>QKq+jR7?x8wO|L7ca#I=)|e>aY_mhh4ARIxK1cc?0Zq)Ny5z z>8MOa+<41!k#iFR@y@tihBo>TPWiGyn)>8}v-J~b%z^i$^ND|_y$v#sLM$RT9275w zKko5tFF9Dx&0OsYNl#xzEvX{@96e?v9`p*?Q|eNMw}ys_t(Xl z#~++O6C+|&e`MZ4(uQ7LG0HzzK2fC;Gn|X!5>Nf?OOAk`Lh#%i(qeP!9@f>YrSg-q z`pjV^qrd7XE{0v7~VE zlX^Ay$6YcWCxLW6R8+w_odk=32vOAfBQSS2;ZJQNhQzZ{lh<;30J2YmdE*KPHw4Tp{D^e(_GrfOg0 z^1<6*ALQ@zcgh8-+;e4wALpz}G-JnIEjXj$G5tzVsMfRS1g+o5l+Q3~9Jq9^i;oxQ zdvE!>qX&aSPY(Py0{wq+`^eI^gZL&xO`^Cb1=cGM8f7*Y}+!Z zVp@c8K{$D(}JV3f{8UFvo%H~;IC9Ca)SzPKy%si|aPpc|ZBYff?5)|~M>wO$Jl ztn+)}#w>Jq2gOzfj-H)F8t)m%2ZHU^?8)tY9r6)#;TpD)p(o+7O5brBmh9`>lk$oh z_bGYFLlB93TFK%kY?Eh?<2Z^wgGL!|2ZJ}$51`JJLNYS1BO!KnN;yqHW)}72RkdWs zz{%O35;m%i{F{LVrX)?5t(L5|m75(^r>NOoT`9Wa-{U$@f?IbxXgyo>^PoiPhGh_w zuP!J1I$lTmlbxP5`Y*;lQPe(#ey)K2wsXd?Q6ZERZ}lMBowg z{t4FhRvM&jN0Qg*OgC54fn*`g%{7qMB4Vk$c&$3H<~k0#T7^+qQGVS9KrvWH#v>cs zvt1$cK5YyHI4yKO%+|+7><&-WqgnNrdLu5a4;K!`KBJ;~-qpKNih5fQnP2N?FTHWs ze!s(XF)g_Ptr~B^Vg}6y?3`7>95;m@yWv6aZ6+eRPD5 z6|Z?@m@patty(5+pZG}JABh>7{{G5g6a~2AVrJ2MrT`Vm<@@n?-e_k`61hv*EyW8m z@fX@fPe1uF-6qK~jQAw_;b@rXZFvg&*}a`w3d<-h$61L~F501C7!PmjO0E z{Q~Hb>&%HnnwPubt3RM2QPo<3V`X^!%0@Z^;-DWJ7(W50#l9C|ELZ;HdYJ5b=k8A+-8H*8dxJoo>y>?^Xc@q`;&bIn04eYAHOIa8E=Raf{c1cOFgfI< z`ws3-uN%$lXoE)1G(#aQPNGkd8(0?0d1hM{7nkEg&K?14{v`TE-h;yTez)ml&E*+l!LYVR`r9w~HlQ`( zl7ljLJx;kc!mb?Z2Z14q5VY5M(EfbI*R~?;p|mhM)`R&c$A1i)KNwsc>e<;Du-K=V zFW^kyTem~_49zQ%g{a6_-!AMu%8@RV#6Kl-QXfzUa+8`wZ9347m17uq>AEEcX+H2c z8k2t|`3r0O&#c{T`#uiUDplQ5J+14u0gMV zdOD{4*|L|o+HW*iLJQNqc-7`7_DBkplUIE+@By)xE}vp3GZ&bfmB@~Uo^y7mOW>v#0U zg<-bbIFh8pem34{1~zqGirgHH6V%Ie&!(p#7#?$?n1m(YPaPm;4d9$7X3gR>#(`1rA!QD%5$DVs7?5%U*zh28 zPR8kuWbo;;HN0U0xcZrh=(9Cr6*k*|@e<>-j6kGIRd0ALdw?k|q0^eJM$0EoEm^_BDG9BPl9{h_R2dXU*6d6DqsGV6syfjHNKf7{l-FoO{o` zr+ez&-}gV_k(v3t->=v6^?W^F&zIhgk=oRZ^HhFu@T-kNr75I1TGle(I9~{NXuONw)-|-Wu@9D&HAyB)10rb z00VLp;j#<&q?_y6h$03P=|T0?tMC>x!nV&+pAm=oUKsD#eMrTrTDc+n?sDTRIn0HN zOQz028ERQNj1C4i2KUlw_tV9-l3AxS2bQkJ_&ja(bVQm+yLjJBxuo^!sy`EP_3$mG@p=FKhc+TSG6-MS?6&|*_3mE{T9Dgv8cPzY{DMz z8NI##%;yG}sq0M6cKVO^+u$wD`f_2GB7W!%{Va)|Z<0*U4>GnfzEeD3fP4#D&W7$Fd4;KXpbJbZ zuMe0-bSd1{e^W>967XEM4Ani6idBF=6UW`<_TBjQ8`uX(n!0lB+3u5Us9qOC3@9#l z8l@w`HXlE}rM#3d6-2S^s{6=)=zHUsO62geb5oaPt!+;XYc{0_%>vE`nAj=55PGb9 z>l?QCMo$fbBk;tD*~JtPYA;8z3rr52+`qOgtQ}t@bsJ{cLJc*`e~UNE zv0TuLI(lb+TW(g<$%qw;9s@OFbvyrh+8L`xnj&ig(zHP=vD7x(%kCldB%{!eq4>`S zbc#kPUQE(_7;anWlY#BjP!2EL8dc$FiI&6qKKKI>`=Q~H7lDuU7d$(su|Xj*9gGoT{jk~SRqTjb9X-J zeNCKEI%K6j=*H`d4`d3s7oYd=oF7UN?`8CI?yU;J7R6=E&D}WtKG3}mn-=eTbBjvN zG>r|jtF9Y=yh4qNwHfMAkaFLS`AS1wif2gU^9|odmNnfopH?& z5p_8-9=I>F2ekVP)HCwGx=yj`&JPE}_vZ==2)K!ceftk5cB_r%*dkc3HW0r0M zk4SOJ=C|zl=k+`yl=w(<_ro?F4}*;|es5TR@%1cvqjOtkI~6s}n{R5sBGs!|*CqvICqBCezcSXUJEsC&kA_>F@V#;OUiaMT=){+E zpmKxw`dZVpGE^`)|M#c=H!p`LNBza!1}AB|&N#3tRolcwbFgyfK_KbthZM`{CjHCp zAS<_ZH{g=qD=tnfFN6$)UKzdz8@_60!? zE&KYR-yyEEvTtws1TLP!7V>-m`6d%zZTaF|#r~5AulGUIHTQ9p)0$wy?FZjUw^sms znAX{+eO-OuZ@dME_skKjBF2=Mh!G_;((O=%>(PiHOTy7uP0Hujus_1X^lGRM$2?w- zBn^*$$zhG+M_PrhmzQ3i0MKgZP|d@rovk?g67JV9fxf%@e^OuHGdmC%yqsE1PoA#3 zuk<;}0G%QwP^l91NyPtq7H%prXGavMm)8BGy$Raiwk?o){Q7A^cRy`Uta^AWchVJ* z9Bt6hFEW)AEB{M9_3sGo_hS5W+w@&k;E5Xr(*CG^iMT$`L2zVV8=%01*$_1I*c+H z0$UuC@f#}dJyVp&+KszvN0o%6-Jf9vc7It_qi)!p?$=HH2f(7PGVl5B%djMgkMp(a z6|Up9sl|~lLnp;|3nB^zRCfhLE$k;Iogk1QN(sxfj@X*&6dWo7saD+Pr=}Of6znQ# z3Cs%46r;!u9;1|X1qi6a?pxH_YiJ4I{7&&epTKRyEvKrrKk09Ex{&1YB6%i~ea;Zi z6&O32d;*)jH+(+UxQFKxfUWo;&E<&rw(BpOiG!)p4l~AC*IupFR>8gM!cOR=Zihdw zxOjZH>{)D9yK!=KRdjSg^rgiFpk}CLS-)ankZzh1n)j;a0oRy)_~xK1C) z!-Lih9#GdXSZO$rBFf?>( zw{nXD{Rc2RD;=@)JolKG+^B@X!i1VD_CYPkBs%q{D6w-nd%f%FH~CC1`1xLM8fgO? zvOJyFoem-&9;*ejp-8-#)TAG%HKi#eZh1kluz@9rg$g)4C|3sO`rrC>+x>$BBJ7Ak`HHRh5eH^#{17-yQSVlxpBjg zPgb_GLqmi5@Zr9X%=bn5TUjTjIJ$EpiZwNM0J8MFNUizE{OY=PI62^c;sRbzyapGT zSf|c^D-%GAan(atN+2&wrBD1MSQv=W&N$1DmlmKu9=B->cuv1J%_VnyolD6UObkoe zF9lu&RSa0v7N1{SbMfuX*6qg9%qbiH>3+E^%~k2?A!qvgy6$c6SlgjBQ_uF!(9GLS zn^qLh;VU{L!o{fV3Zmb@kSCr?BSj3D@vd}uiJL;+zB(NR1fG}7g3T-2*&r}pz{d#t zjr!;J<)soyrc`K2m;YGZn~GPRu6pZl+-l zb1%6d@(m;*K5;HyAT2=8*Jb?nW-zt0a)q)`-TT^-b8Z}skpA>k2uP1!hI51LSXvu! zBY&OU^J5$ikt@7-KpyBW*}q&b{tMO$e>}!O5u@7obp`P}Hb}nD{KU(@Xa;$Hr6AxH9 za=4Ei_;xyBxrFtk-^9d)Jf|RsM(HOQd@Sp2Ev8!Rky0lk9*C8u+P!z6HhlX0S&MY0 z&JNUYrJj0};~-nH`Cx~NksLLng`^`~x3Q9)C}W_&xe zdMtvZy4gs3p?+iJ?u~QG1uei|?J--oI{MM00#fehj9bN4d>CBBXmJ^ij%j5z#Xa`z z%N3K#3O#HtU(;Dt|8k_Im5>&RPRWodH-W$CfsTExh>?u)bvDu1%8p}9&ohpp)$Kgj zn@cPPc)vQQL%I@)&*sEXg^z#W2>$h<-E(4eNEoMaKBqIcGgEt`R(E~eI*{FYafs;I zq+6+AsiC1U{cW=84WV*Jsd1CjNgC;n8?T-2Z7+&n1$c%Ha$;r;*A~tlWG9M9+U8O! zTOEQAhi#`48&#>m6v5O^C)v6yiwd@<@rJrrV^6Nc_(Y}+RF{FVjW&Ng0Ensi|(<%M4umj<>6=A=0@6h_5qRf1GKp z_Rf2vo$7iyfvw5%egoN)WT~MGfdp?+{T{B>E(l5cq3GM@PEWMs?|ELE#d~>D8MO#R zj{g2PgeUOjb|p1e0n*4GT(4_0EP zxoZVw1l+W_R8M`DuVHhEZ!QQX2V9FXh^M1@Rh0;J+R`2RDr;NSbi(udHNgiXkg8P9 z*HK(`D&@=xIeEb=GVd|ceY(?vye4oDA`_wN~h5T5iRV;(Uo(wTsO6uC;#IE_! zU&y|He4DOw@YwkdeQ`aFy_8CS9G)-|TV=ciosh)t^c!#Ug0ZU7`sZB`ex0pbX;4^| z^6G;2NymPg zv%S}>g>V%{EVv_00BpGJExElf(Y8}mcv#0~Y^xw0?KW_-9H@J59Tzn_!)EzeJ8Z-= zlwlR?o4P7%49UBds3=N6XDpAUT2~~?y1F!OdGjhOTcp9}CCN*};^3jqy+2HQ%|spI zyf;9Pa)G3bZY4@Lz|so)e#EYV413{3?kA;~yE|iV(JeRr{yhHp6hg4N6Q$Z>M=S-W zHF(aP5e8iAb^(tX)U^`6e#;?xyynBynbfezoYNt?`I?CywSQz{);Wb|P>G#%@2mQU zWpX@nfb?o)Y}z%@?-}f>tFH$g+bDE!`&uNMW!YNfTw2gkr=NcC(>JU^wRg>S3|wzn zeBlw33p3mYJCOoMEsKi^%!oN3n%!fKM3aX*RSUs_QE|BuZ}Xy{96fR??R>c-ws!#` z`PFaNeANa`^pjEI)dA ze0)oWBD1Ei9ZLW1My; zfoo0mJETyQN>3a3TetF~Jxa$e9F`9}tGhku*L@Otb~;!5ZugJQav^tqJHSxHbNYg* zdvxJZR=cj(=%%Cd#v&t!p8Y3G{M+LRSZ9tgcubNISUF~QlZkkck@?j`dioh&QP!I=4dWPnp_?t6B30`OX#2xt5L8$=HgMUUc2!+qJ7JtqoG$2sJ=V^2 ziW35B`Gi=6OsYKx*fa~x;jFWAn*?`F_(#!~o*0n{(r@h*NQeDZ^CKZ#NA*Z?#3O52`i6yz2xe^p4;X%!p_9 zs%Y2H+?5tYJ$#V!KNzIL`OFyF)JG_(ke7v-s~nxr-r&=IH_DZ%aMCLRQ+^ zF{TiiI0{^+Ki?d8uz`YpV85ssxKUz^09bHpv=XxF)b5&LURlK7?cUJ%(eBhxPEhT@ zQ4S8Lcm*%KwyblcS-_fna{)1&e%p~faFxfg|7~?1e(N_@_Bk2ZC})1|;Ef6fdW#zG z#~mrea1pCg9k)|~;ejhXO1*XDM7{A5A+R!5rqXWch~TRS2-bV->EgM;%8grZZ!yE4 zy$-n{d6vXx^SZ00;m4!0A$V{0%G;BQDg4lFg$dej<48u9AmL2@K7yQ}!B5`$egN>6HdBKB%T#@xbn7m4w2oi4mk2BEGu`(AderrRN92!vd1w0bO+sLg$gIf<`+j&o z8~o|$WYA39tbH3Fyv_yIdKz{Hd-u3fqs0Fwto8e&X)ApYwyAluZ8JTlOZtyATh%_K za#bpDAO;{KtaBUtsodAF>Aa2oSrNiKhBQLiPY2E&s4}b@&zWHq8x()jZ-8zcxcF1y zth@@H;;8Zm{6X9UB~kY}auG3cp{dIwFE3AOtpYmzFhUIOLy${YZ)rJz)Vp@={OS9? z`0p&Rm$&k_%j6E04M>_-x;b8?^BM8#n)`BceA?u}xVxeKmBpcQV8S;vh^zA8HRLAG z!ArrkWR9h9G5UMt+Csm+x0M;cUXqAC0&A|iJ>`W=UDdL-PRH7WAOFFz66j9a}@NG(Wo?5-0G2NPz zR!Or0mg88{0hk>s$rR~|_jLqYq5hljTY zj|bjbs$TxB`p$cv-3k>j%Y54LBJhve@rirhpBlwTHj_#|6>p=XrZS?`;K0ypcNp3> zi&b47x~_~w+hZ2qnR6YK-&$BL)-kZg71_7)1&MpkT%ZeibNri9jA!3-Q%M;m)6!i1 z#{2(z?|*!C?DG3nKO?49WYgS1Y5wLvm#qBwdp|xtgBu{tvK@Oxt!82(YG2hA?Zp<4 z#-44m7d_Vx`W)#gw;yuMYh6fJW~?&oNbXO`t9__VYPXl|b1yCbd6a9bSIB^R;PIb8`&1C zuPnsT2D-ZA;{^v-GPLn}+0dIeGi97UcPo_b_T~i*IJ+ty5?v6g2*_`N|nZ7%m{~r7GeD+dEd9y>e z3e<8bPa$Gx!|%|(yzOK6g8u$_862mTc`ttYG(kmVJ#fBXGzsJB@WiT%M}=}S>m6(@ z<$Q0M*(8ex4-*vg@%(Ej_v3jYWNn*F>2k1G1QL9>j$@wo;>OO z&`O3kT6DLNE`{3To&erT*|l_R!c`@_>T(t#R=e z+0Idhr&hysqb9WiSHm!7H?kYI);K)F4h}VV(Vyq)h>zR~FpeM!NO{MIUV7t5AMHwXCm*``X4&gFacmRzU>8x*xm#KdWq zUM(cnJVX*~^Ri#VqB`zJTBA$74HFLj^~L=8fktb98dPx%c%>4a%E@-mw41M0h%M{3CI zj!r7~PyeW`Ryy{bI+~7GO>r_4C}Ao6ZrJrlL7#y{)z(;jr{+>RWDup+ap>Q#=Mi-t zxxK4aSE<)4#?K}W_c{JMfeF3uu<#_|s=%P{1@sih(|yGqDrPzd{`z_TS%BZ8 zU9eWm2?00y6%?p~`C!xALV7O`c6)1re>$f3e$iJuAmH*O{iMU6OiPI8=?Q9ltEZ$b z|Np!p;Q?IzoH}4q>wTgOL+6|>)fw#b@?#e(hL_By|FIw7ZAUaz&`H8BwLIggj z=!DsIC!FecIhGma^_!z(mF|cIy(=xND_hj9tP7!={_E!!^dK{n{>;FtAA`a8k8XOZ zRk{uH<1B+?iA-?}D`>wRVSMUvlUEB3&a12X+O*J(tZUOOkzdK~w+*bLFKOYFZjZ+d zz4OA0Dcqk;SFl9Y`0&YBrPL>gl(5$W`hg${ zGnk658XS;NW?I2o*R7a&Z|@Q>b6Q#-uX@|0d=MxWD~31K>EGV#cP+9wiRoV4aDKmm znx&h2P$-Zvo~y()eE3z78?wR^oj4~Jm<~bI!=KR?k#E%aD4AalCRdAFrmBAbZoW%N z+nMhx1q^IzP`%N4*C7!+Y3XhaU`$^5I2+9b%;xi2!FwQ4tv(3*uaU0F%5p((5wnW% zqULTO_(ubxk>793qgMa4pK5B^gVccnQ^LvDul>c0d$uRP&-P?^F8Q;`<4xYVTuG6n7GNls!y4}3h2aWaYIM&yun+rf?4N&*zThZ-u8d!Prr7SR|{qZ23=Ep zRcicV#nBrwIA;^|?NA)DFja46{Heu$Opb^Coi}HfS~rh(z3qQ{t^Dn+RNl0pZ8~-} z*qg!asjsBzhhwOepqu|5-Tu7A|0NWryBu)154q;_)*%6LTxrDpQ`aSy8RPSI{wv6C ziHl79Wg7o%Zl!KLIQbOp3Hv{Uzl8J;r_Ho$$4P2Kj!- z(mP|D@LfPR7fufaZLN%1da=oudfr^3W+vle#>Hugo$o`8Y;Ll zr0u$5M9sf=ak;I{x_i2cKmFuhPag1Jtl!===kvJM_1DRVAJO(tu7#$EK}NtWVCLd| znd(S3W3P0|Kw6Foe;sh~6+5liws}(1CIzWW7gEYIp?7W!bL-WNtlprMA;0;-zp;Aw zw`Y@npO%J(CbN5-mDo{|Gu8cCqw5fQ+peI%6gl8Rn(sI4S{nK|==X`;UY=NLHP?em zPJu3cA6K1TUWQ~E9%f{WF_q3~i%eBYu|}U!xu9@Tr)m0B@E1q&5`{Z;&~LU|57hZr z2MR0&46}87hQh~ua|%o!!>s`>3k5i^}7fdt5>gf!5~852E-AajZJq>alHb17mDYV5K5pe9Z6+-Sql}Z z1b86_rC-10pB+)b=l@7*ahUj`xQ(fOU+kIU*^gT#oNn)U2gDk-i)m*a%|zQe^8S&Z z6BD^vF1$BO!G{3qSAvcc82gsnlfo;ncD%}Jr zqn+wc3~Sgu6`&ScD2K>Jo>Vvk+!Nx+2amTkYDQ$<4yETWSX@BXUU|VGtFx1;mQjW9W3kew< z*TWzBayKi8Qc>Ndf}dQS5s&7Eoe)T_{E$p|Yn~IiHtP{-;p?d8wY^ouD9jd@}5R=;s74_Y@_Z148o-daEX>Xm2PU}rr4xY;7o zj_URp!Ka<0$2Gk^>=p-Vtu7fX7Hix1;VM6^IE--q>GLN?m{e;s-MJk-I__or1a_&H zhI5lE9~m8r!$F{$Akuc;XJBAhp)4b(qZGVsS7$nV>n)Xf(ow6>Gy#QBW|ArC3*ba- zhsxMJ&rUz_UhLI$tNR{cZ{>e0Ud)mo5~wgVxAIMc)J`Rh@`@P`aBKK2d_Kp8Q5+sr z8w=oftDD?-M_L|7Os`V7W59MmuA$1<;jl3w)MJECqBOsSiVEcG@|*Umc{b4~f-tQvn-Bk8bJt=-?fVdJy z!g}f1`^|}j(p%c=86WdquT!H0zEa+Jk2-oXh3i2sX1pPE@O8HDcnX2Yxn_lltzMl; z#yP{gQahY044aw1;B(x|e*^1kYFC#pAhUI+W|G~a-;Kk>kp=ehO#$_5NR7jy8W zDj{r_?S3qee+~ct@zX5965E~IWXG?}EHn1{O+Hg4RT_2U``nj>-3fqlRtkajT=zK2 z#cpp&m|yW_?;ssJ-p!-t*Omtj0i0+1VxfC9{Y%N5rN^GOKY-r9e5=lI(1G4WodJP; z)Mx2O)#dNNsFE5VN7%06?&=&F-9Q9KUuNQL3kltCTgQ3;Z)#Lz!B?|}-ns#LjlPSD zbAyC47%~1m_nx!XWry5D1aH3Ud+QU1+kP{0znSqw;P))!y0E@IjUH-Lk&OBiqT|m` z#Vz|dSR;Z`IX>9$-_%W7i(ol=oSpp~uNrkk0drPZ#%*VNU#SxjA?3T^r$@FAQ78E{nl}E+Ht?rM}Zo0msIVg_W zx^`7(#CeDqK32Jd5|Fw#5hvBi$OZDN%(10SPI~BL$*v?~ct@Iav%>k}XY{ziERT%K zp35qJ{&WNVMV8vY?dO6&DR?>AjUx=K?hseuwOm5&oMy3ch|2QXAmg8|5X9A#Zbxm7 zsBE>M7sTueFT~Clo(^(Hk&|dmNDjjli(Nszgk(jZ8n5SE*(3y;Rm@?v%@2;o2yWO( z0U*%ux+q4m?8Px;Z27DlV-IY1)eA0kIFa76)B401a$HG7T3XuB?UZugh#aOX04*zG zu>5+gz416o3}TfWa0;T#sKkx=8dQx)^I|M*RF>^7&RvwLT82Y%OfEcw%VQ}vHtWt< z$Byf*i&mJlRARu1z||KkTVAH)BL3gh*U`}7LVLHa5wg*S<2vCoBC0huIMzcAX0HO@ zmg-?7tQ}$*DJQtErVJ=%%y@*ryb9kbBlM}2*Y;f)55nuN7T^=4lK*m){-_;PUU zvd@N;I1?OM+`go?kcig>KKZ^X#q@rTJ<+O49r_eUbqmnVTsS?IXurc7&de1*9y2024L1X5+PoP!o+y}kO#$*sU`EhbRTba0qw7L!3g$JN5WE;<# z3wo5;8b9CatreJ_LHcMmfwF`$A1E|+jE_>?Lg2*=$IBd%#tDeg+te^7{tr5pU%yrc zJSNW}b4fj79355G4HuzUQz&3*?iQ~?IqWedWzq%eL*s!(UL>p~VvD*Okn^VD)xrnsKPus_J6V1>f4qYmaDj zqj;)$DQR6FoLhB<>#Mahe>1NLe0#k7ioWx-C9YYVa4V z`|tnrW3aTYBl&}j2%3Y7zi1VXbUn<>X_d0Oc0Ct^lDRii) zdWl}(z|xYEyWHLf0hgKXV!IWXni&rtj?F;?TmzdHjD z?Bcwb9znOpqprn%dSOG|e4*#gR0Umqfz$bBF&-fv113Aogl;jylVqKCTO=!Wkt2;` zDIrm}=nqw0wDKp@4ZgdZlQO!fY+p(5hoX+-G((S=m(NX z(Gc4mQc@@^cgFe7(-n?DF{v|Kt*xy_Jd@>bUf(k_GMV(lS$V~|3|Cl&F{3oM2PskB zOM&qgLH&D>kXSJ^b!opLLiKLE_gsw6i|onIQNb$fPe#14JRbIT*REW7qC<9li!=`< z*PoQVA#^jB2NEo8w1DsNF1aXL?(jLo@)T?qhF3_H_|7K0wxWl0{*npF@+)4o?SI?v zYs?}qzc44z=^M_xsC(~D*0s2^O-WiXO$dbJSOT){8^WHiWs|1HS zpjZelQV6BDyA&wv9j#b=$)#C^|w034Kt zIgVzBJXDFGQy zI=QPSz7KKQJ*O3}(}@T>HD8KjT*F#_#ApRMs%RvmW)iC8hTBfsP`f9PO3NplXihFx zXhs|#zE#~=BM#H*@Zp?BRvSJ zc{2s!{Md9}dSi-Zr<6vtDU~W^@f4+TD2n>nukPTYXLThg(NvIW)s%L55?W3;AW`yJ@M9_QAJ3~S*P$00x zy459Uw)UMnce;wmZV>2Ve{cGQAgq3qFd|^n6rX?^@X||1G+p>VoJ6n}wA-K-pkX}F za3e;zPMj4J?!$-`mEDxQ5bUd=U`g;9{wGe}rOMmq`XyXx+bThad(IO|;LN;WqeHGg zVfQzCjQ*8EUd5UtuV^+ zw6!03_L?;{fG>)tQX;Bm^uoTzQ&b#_6mOcdxD!#5$deiX((XzD;JZ4>*4k=H z?aGL1zM&RK)L_6qVl23}%xSQ(D5<3FI4GTYG;1Xl6bAEmnh}9c%PVHiN4{=TDOrBY ztJBKD?=ij*kfmquz=5V1vQ$fQ6AD;L&26WjyeepD2ZoG~0SYIk#kn7Bv z{1UBZ_e49jV^K!aHs>y+yB7X=Z~SJ*eN{+k5n7K%nD&(1;}lZOW33|&Ha3};aQXH$ za>V!j`8#U?sM%`J4uvh^*AH>~H7av(fDI1|OiWC&tE59DZ{Hg~6&Cy(z4Ig25psvM zTV2U=MRa>RhW)4ztob6-IFrnu#9IU&d78|D-Mg3e`Fm))D%?tP zG^_F#4c*_#4o3b7Jl?o81hyMWI_|B`i0WAin^)TIuiO>yI78exz3^RZ7zs3hkyk6d zy5iLdoU>K|SI>B5{HK<3j&pUJfEo z|1!*OsK#4W`%@&j%^5Au$qn0hXPhvu$!5g^K*US*_R!f3^eL~#(`%2vngYHeC0))H z_Z5%^cWN?oa-aYn-Ze3)8noZ3B6JOB0or^$8@ayfl}KPdbm*177EBNz1R=vhiH{(3 zwP))Nx{vJ!y&L&PqSa0lab54KZ@s-$7|>{6BLR@(sp{0)vZ2PN#%CY&@Z86aos}Dt zxH9H1C;VZx|F^-(C;RqWy(I93;SUUrybB6v_>S$;iaO=9nn8v2U%fvk zGU1hgaJ7ECSzSnaRomOE6Tv{#)-E4M-{(*~{Y7;+LJT!`Vd2b;14N}; zOMu_PL)OXq;WwEoeGRH|dy0ZrYNwhV#$(?9)+Vv`^I&R1mGP;d1rG(!sV9zJwWGTn zRjP!VYu%S;?Wx;zc{*h@D+?9Xgzv;Exp51zCnowL^_@XOi%ZG--sZLp>|rJs z6!~H5oMEbOEpS{F2O!baJ?Wd;@Y?!t80eLkXC<;8`20Eu%5dO73C&h~%i5eY-{|J~ zkHIRN(OarsZ$(nn%oTk)RC98W()acXJq~g`K5>(8s62O(o>^YCYPrq}+Vb?`6>6az z24K_9>KXr4HhJQ7yRo8A;jD9B$@Gx7DuyB^BFf*wC%qz@b`R1ay|icGa?qKphc zV;A2{!a&w3R)&L#=Tcw&7%v7e*{0|NhFT2*Kr32~Y*GT5>wGBvgIMdYhjCh)N1E4= z=9*{QZY2je!(GoCuc2gjb|E?D8olG9Rw95{oYcv3#);{voH^5&7yNBfASOCmQ0`F8 z0D}%Tl~c|w2GF0SzN3o%Utd(FZa>b`N!ZxkYN3KVz3u+t9!tskf|qy#74+R-?r?s8 zb~E2fce{dSd!e^_)ztSEXbI?rpD8-2l0;mDu9s-TMd7=7WwvJ=$jyR>JG;y@=9HH^ zy)bA&l>l#KK{1$Z_3_>eBKPBtIt0~1K*?s?8j~gUrCcs0Nc(ta+_!J{9EU4j4CW}E z3Yd~?_ejn(xp23bI-aaIUMKW|Q#NLozQHI{xUq}1%fYW80{W7#{eg&%n1t>ke^F(d zksV6)+q;DLpgHa?0xs7bp$sjJNuN zd=>BuMP1T63tl@f7l-|>fPgZU>|P%S=qHz&yrwlrbep+5n%6MLj?TpQU0R+Nw|@&G zS4TAPYlX`1R%Uq!ooO4ZWC5?V7}adRrW!;jg@IFS<)+hFsnGE zq(nmaepyZ3N}IEuAJhFq3=AF>2X8#hJ+|bHkoN#9+b(H?`uW+I;s37D__u=e6;lY9 zC_vgTGc&L%c$!!Yuzhp}Q`D7c;>#mZ>1ws^{-*g?u};_RYW|=Be}^~iYl#9hIRyaT zIL>ilsjpC%#eV4C|1~iR-qY)2u6S1*XC^05x3fQpm{%n8FLIItPbn!rzFjS9@}l3(!Rh*O*$=I;TZLc71^6Gu z)E4aQ$%!(O=_^_O7*sdJSmPm8-1#sqLuQjLJe7U}Ol$@OL(}}+(%|Rse|rHqOegYs zEw_%E(t$qJE1_q1D0Ty0Zk4PyqxC^bIkokAYYKYWO4rg685jRA*teHe&;>{jpny25 zDlky1t?Iq;k(N5hH0^>ClcZ=b`ON<@VQY#o7qo{rdjBRrO$&0ZQpa0UWVY0LviPDK7<#8OBngMPr(k)Cx$C)k_t9HS zreKO@Q}}hau67|o((rsk5R9xQbJvc&LebBVUT@YFKe-8MXb5Q9WjP^K;R({8kzyVu#JO}2{@?9Cl z?cM@0x?K!=Ga6?HJ0+kPKDq?Qpl~oc6r#E_uVq1bo2e%lx+eQ(yYf(dYYp7AI#(bd zjY!Nbez|`MjU$Xpa($i8r*BCpM$0rrku8y~aIeChrJ!%ywP1&zoIMV3le(im3;tfd z2LC4jeUw%3t%RDiBLUUA^j_V5yXg6$;sS_*G-qb%QKd^xKq)iq`VIvv2v1t>*+ zF$VX0UX89)x63A04&Ng9Rh64tWSIGr#KKU(U9{Ad;+uCJRRe4m@X)Z}?W-}MD&Czp z&M&T@kgLy1N%iKVGS35{oh@mJRv}<5mvzjj`BC|_&k~CzC|i%&K>`B87B->qKEb;2vnZSrl=#~(^Vi;es zYd@yY59E&*HBifFOz2e4^BcPANQF>sd}E(bQ&ml3Bl1UxK#QpEXTe==*slrB0a)XXAIU%6CWS z3-{br`taFm821{DbLjE;m#DH(2DT$BF!R@8d4p>-^;@bRm#=4ed&&RAhccy?Mw4R( ze|q|wHY=Q1f4kP91)(I-GA80j(BDMhI}}tM%b%Mmb_`~F-U)Ggw@;Hzl%pnl(iyDY z&`1Y^)^o0+zm!rWvCeMXX#peM`WJ(*AyP_i?0|9$U=aeH;ZrC>;4k>@Y0o(&<=^KtU)~cVs*U7z|9sMyz_O)@y}!QtJeH~in-){XrD=UV2nJ&A3Zy%u)sQxUq5_=piA(Ddm`5l ztzobFfsq&F`KWVptKtinGI)^}4|yGwE+b7VYjxFglx4R=TFpIu%ZI*1IU_mGn^ISY z+(|$z{2Hdb?_UY$FJGxo?)rU@Rv0{IP0|r~hgxGDiDX$bE1fEYz#$*nwwDjur_Xd3 zpBxp>HVdPBL+FofML&l#umr!H!`io%%}IB-5O7g(RaMf{fJleWbds~*O9dWG{Mr2f z&p`ek57)pUB<8>>Qeckx&`~(+ygi$-+1msFzFwa!RMDX7m8+{My}~e0wpUxes?57! z)8WxHJrF;dS8G__v}f^w8WRP3$32+|mNG!|Xft)75)twDD%OyT2exF%M2pZZPv$vV zO8I=U7uzrxlYNyU(t4GW3HFK|Jz^d7@;F@x4Vce%qoFcRXd2V59Lv3)5q7Aad>NUU zmGu;X;NFqIpZlcuD{;=L3sBtU54Pkw6z?0N3-2_Hy2@_ zjMj_fggq7mlbE!ijhG?+iM>TqsdXt)<@{oP=?#+vD0deI(IuSb6%2 z9aPwv{_{-j{!zW4y^y9Y7X~JxQWZ2*W|sP3^n)Vz-p+ub8XvHs=<(Igr2f^pRLT;S za=2x}d?|)Y$+yiI0uy24?8BgV3lF5I18aVk_ubFcZ`08f%4z;wZ~yB9uXi|P5*gnD zh8mBeO#qNm$T7}^n7w6PgZEo~VG;Vk@J|B!fUQb5hItX|?{rSTA;_*#;JZfXwr3dC zKWuC8g1dmEO!zD5y(k>V{Cz+xwhwkBiv0v(8I;o0!lU3CwK%qo%w6|^qw{#qQ9uz- z4H4X5*0Vtb_0@<8?)$k2anU7O@uHA(?o^UWk0M=2EbF(`)z}BIDhXeI{ic5P(-5p> zdKp+f>Blk#e|cKWx#vzeC9cw7*SrZR3Ie!n&-Lkp*|jo^6=6&84k!+z(PNUMOszJ; z3%U{X_0+hN?(0s3;?Plss)E@XRIoV&t-aRw| z=M08!!`912Prp8+#S8@$4t3w9E$X6}Ees%I(?2XEu1R<6hf>zI0Fxi}rS<{WfbVfpdZmt^9O7%{=@Q`2jQEKocy6PD4zHPmNxJ9c_5IZa z;~&AW0Tg-y3EK&MS;_~?S0;6^+<5(vD3^KHc74HrCA{2aWCIS`8F#sG7l2aiI>0B3 zVyeZ)g`0*moshFYgA@Pc+GKBqt8?`m;P`sz&>9CXkOO36HZ1Krwk#`Lhfi~4;)+~_ ztG7zEcR9V{dVo0K%k|t~4y_>e)vLZ8`(?d}H#J>5QECsL2_6u9qQrCgp4P~l%XiD2 zI_&OrSjj>=)}1Ntx=GoC!*-IcN&JqTV;?ddUq~h;WF3709bvn9jCF+V2;I$*$2&pH zT{hPAC#)Z^Z=~P|ilj8?QZ>GAx#K}3NvXFO;?6E#g8tz9L~?N~XqorwSXFBQ!Jj+$ ziz&lFrk7d*J8!S3@wr;~Obb@KbnlTKIJ_;ZTc04?Y>Ndlp!QO35g5ot{-2}_E0JjUJ6$~!ZG%kcYZzd?053r^H(U$H78n&<33JBCwPN+RyH3rL z)|I%Q(0_4s>^al8fK#tU9Of1Z-o|3}f?gR(u0|A3eS~j2B{`^%x5f(CPQJ-9Ix!Ak zX@I(4yLYc-5RQQGpcA(qIYg%)H#g@RuN)5&Uq-D0C?g{a4uBd@?5T}78@p5Ihi~70 zU3zEQ$)Eb7(q>4@UE3l@+h)9;8k1Brx`6WqY*DDAHbW z^``jt_Koh6*Qm+>HnC$28_4BvUsz>F1LTKQ8&6Bh4dU|eXliVIA_W+2OSptR*AFy0 zu$s>}{U*pM7a?XCrpm`#pk*moFKT^|xVmU65%80w_uh+!opa`X5mIP=ZsR)(ur6(y zQ{8b%>L7d8bZBqh5aX7*QeSy-FPvJ{xF}t0RzC2E493XKR1?>Wwj|smMXWYbpL0PA z85*GAb6gAxB3Z^TtU8a^r*2Wcl5~baE&2FRoE|8_guY~Q+!_wHr*(kWC|NOd&enG9m(U;7-w zv5=$5jbAcz7>E^9O=8;q#=hIeb#|!DR+YX-|Fh}!`_<}WuU(HG8*KfW(b3W(6XYAY zd=@kjWC;xo4J&=IQCIbrBpq=TFNX13cLt2J7xROIF1*PYN+v#du*ZKk1Zq3eA#OXc zps+GK1-VAuB-*ac{&tjW)GA5No&V)aQJvwEZUgrJN7`G*Rk?Os!wQHZE<_PfKtL(! zT6BwuG)gx}x3cJ1fC{LTbazU3!$J^g7TqD;-Thwd=j?NyXK(SGZ-4*!6U4=R&udOEQoAWBTs{ zYA)mH@ooUX)EnUy?x;ttFeLvYTE(nTjmrHOPmS!3`4yLPuDHW(_J>(vmxR})<%;GU?l99Eh83^i)tzQ|jO$Y6YcP%!?*>dduwAc_? zvJvO?j}OPz<3iOeh^gK)5|TdTeiqd*o*o>MtybFnfoIKb=(T2dn8@5>L4ZQUMHZ@< zi|mq?%DKM_>+*Q#c2il#{86X>Jjx}7(fYFddABSRG+bnQf?FJR15a7`)s&+LAfZ=r z@8oGvfmQvyyi3M7Hj?pTtNu5AzTR zM#zW{8yhX~zQ$Wh`{oSdb+w;Y@?#wCT$+&Ey$SrhYxP5Qr)KVNYXl01c~GmL=O?_R z49?%{2#ol3jd%s6j|_Wgd&w#;UGQeKUo($G%hw#WfsUsEEX7S)}thW~);b+}42R*mwVd%fSYJUl#FSY-q>U$HI{kr?i|9CW2AGEF!o zeskWRuuHREBci$h`an8)06WbV@f#4VaaxafGHr36tW_zCMK_ww$*=1C8&nJ!|57ua z=L35)LJ+*I0^^$uGxy$@GGol~k#**1{ zfOrJ`AS0h)Sn}*jj&DyEE-bR*j4UFU$z2wq`j#!?7ml$P?=o14^hrSwG(WTo*e~-H zy;?;@MQz_~ZjPGu%-3CUnVpRZ1_ym*q$H$pzT*=jE{=R>#Uhkvy=?5mtdz^L%OQLm z1!uv~RINJ+vFjlJ^yzIC1iy+S#ZK^ZUzE>KpdOiJ#1xke)Faxm;0NF2KYcba%nY6J z%@IK5c328FQvSI>`#gL$;rcq;H&;x2`jF^obqok3fBz*eZOk-JgoRSB3KgJktIpg5 z8qEck=T|>{@(VO*ulu~Bo3w@zE#RtovNT>4@&Cgy@n@_Xdh5#!Em9DYn1i|XY4y7>ZkVf_jIPX^2F zu2uAhhu8M_oc3440+iGl?M8RqqPcB`d#_((WA-m^^cxxhyAGPEQpdeD*|Y@g_S@NZ zEg?$2K}n*nM^#P8+}P?EgsYCTYLeUYR0fxMhGTx2Z0n`oF6-T9M4H4>$?Bd3Tlz+V zD4g~-?|~_o^^u!G^p6KHHZvoZr|1p)v<2voI0tU}lL>aHl+MunpZLY)j_^Db*{iBhZ~XDY_6vi?6a|HT=IEPgd$AV_kFH}8 z1>;a{k<-!17Zkc4wV5t-e(Ro!TW_gccOhR~tbF!AVnf93Wi0pc80$s8Eqd$ zPGuQ*E*)olbRU|BAOapCcnqqKsbpe@g%p`c<4?|a@NCT|VP4Q%#56MF7})=^`0Nm&*@dG+I9}NCxtJhS&4cI^f50k z?pPTLL)!%SF^{>g`9y_G@J6tU?aEazS#1+M2;7j-=z zWN=-(3JKqF-3XZAO}a-PiO)N$zflepEL-iA`-dFSgV@(8S zrDH?OHe@j@?;2IC4=ovb=)e`rw2ZX9GdL++j?x9qjEXS!dM208Xc2j!GL-{B&A|0X)UiJn~khMzgj{F%~x+U(ygATa7FL~wA})S-EKkF^LwLB zU|OuR}iDX?4TUmRpsJlkrCOMy8@ zkIWC8LDSa{KH(JfaU);TT3ebfv4i=Pss&<|vb_1`TwzE@%yicA_fyF?Kj+%j^xos5 zDI?%64kva9=0^@)FIS~H<4XJsf56X99EPf$axu0>^sZrPmc0?OAhL_$>r@()=V4#qV$HFMv-lskz zR`80&mb^rGdGu~4lYqt(Hb$mYn9ssfpmKo%v!f3tH%+kjs{Odoy6Wyd&iwfKCDqXl z`8dHJo?L+eC&g-1y-bL~0EBI(xv{Tw47d51VGJWEH5sxa0AJL>X@3oDZjn(i<-Lqp zZ8doVtZBfqUtp@#dkM3Q`O#8K1R5IJ3qTRW-AdCMkh9{7wt3bO$7A>-{hJ3x$mpmp zB@+`TXL>SaNCvW%hg!6-Fhy!vagH}+$>)8wVr|Uvo6om3wJdkNl?wjR7S6v?U$4T| zx|6EumPQY+NK(YXN2c}r*hw4I?g99yGdK3O{aOt$m3o&imAqMs6x2gzwg*dKUg)GZ z#VUz?*T$L8U>0;WNs9#`S9K*7eY4Nx59Gi%FX^B6ms zif^U=B3beO;cn5S&f9%cViZr3GKY3!E0gPZ7!D-jtEO+tXq*Q~iiZoPgAb2&S=_Oa zYh&(ZCiK8m(Xi7|+#Pq9?kp%>%d!5CtoOUy>~B{eKjoLmkZE1A9KL#A%-gt-ZEyb@ znS4R7DK)7D^R(KvLW`mSVA*$~uZ{MbpZinjs;jFjFq&BqQ~J%f{r)-qOhO@elBT~G z8pF?xIzh-T1h27cH);Kdv6mS^%SEk&q623WMymWejsFn>@i(t+Z8KsoD0$Ra|MSzp zPYwpW1T28;{Z)mFA8Iv0Km$ICO|{9k5!)bAG0>L2D0^!`$9=H#$pak~fTKB;8CLvO zCc;Fsc48t<5D|&E<@0Z``oEw_f9=Ulo|4-9fDW-w>pnQ>y=Oe0;`QLE^Rw^;urgF3 z%S#)d@To!;djs$4)6SOdcm3y2QxtrL z8Sl7UNaW`KSxD&buQe7MWLNsu*eE)%Wukl|7S@}7;;3$)&dXhfuLBQBOZK9<+o_G9 z7LE(N(@)mGiejR|+h(~obqi-M&G3b4AT`07=wFL~|9EiDDz!+Y%+m1|+I^ni{XT#H zX#XCbvUjdRHeqxnZxCf~r&s&HTH!_X?Qtu%FbZ*S)4C`GvK;yga)~-N z!GYJ*Jr3J7qF)+>$7MGbJUusCwg2sdtCIR7mYqi8@Bb4`jsJRkvbZP>s7Ec_Ui2r7 z7Nhn~KxuITJlR#7ta~>vj-3#k_kl^a8<1%c8!pc4@5oQYi3(;CdM%vfO$0;`z;pHP z4Jl3l)E0|%Sw+^p-;N_RDZa$H3Y}D$JiCSd&!25N%2mJsytWgP=EP?(1Pk&e0;z1> z{~_hu$pn$5#=3TRbm`&?2O{xS;w6XR%Md_zuA{!|BE!n(MrHO3+i zz1Nw~%TE3hI-1LXAA{hQ#ZH$%Ay`ow5I(g&3%W}w4!VZZ?h&9um7gf`{t7M3Sp?bo z_IJllP~_Upn>TOlWIiEoysSz8-M|0io_DjnLFZ&qAc|gL{-aSE+-XKiO2Vha4@WaQ zI>yLko^Wp(yH^k`rRl)AT^m{K-g-)&l8@zQ)GdoCYF*aP{E-1_mCyiUDjFY`t4{ah zpVuC<_%C9Zvrn#vSfM4rAA^^E;Zb-;C*?&xru#5se1h%890a`PV%GwELr!X)cdbl_ zWQqu4))yl|R0P;Bet$y%S)_P3@T$vXeeV3@7;Rw$GX;X$`Nc#R1}6)v0EDZNX)#h@Li1UO#Ok7MR{rMS9Q-G=y)9W%_Syy5X|8d5}3!OqOVJxl56lj zm@`~fKPK-*rhX&)&5dPW2q5`!XPf(kzxk%$gBkMT@ibrpj>;VvNcTr{LOb(~24g(O z`+g*DXJo@NeFwa`6mn}{(01mQfLo#pTGXi!4!o8WfZ#kLV+E1%LkjVm;F2vx12!Jt zb1kGIhW>GlAgF<@yf->y5|QeOj(2-E)AyU5Kh~N^xK=T566YsIOyF0M`~jne_gY%M zX?R>mYkr$X^dmU|F}tjcf?e`u_20*5COAFGHA=U?eEY|T=L*W~y-v4kGV118-i)bs zwq6;D(X!1wX=ty^#f`OUQ&V;qpP0rUBDT|zz-oYI@{E)ns(O*4QghB_0roS{bf4Ge z6@;qykP{EGEuk8?sH~8(4DQ}%NG_{4dLgl19hX!M?n~HB9m8hQL9or29IvM=GyLRW zSfJp4>W-3WiE^5O9iDT^zx?0hJl^pdvSJBjO z>ZO>yQPFxBLa?ykN1sG)^P}i-nv>a!M2tP!SBtZR9}dA1@N0YiM@-!}8+x>PwP?6C zA!I%f-;&#E!WZ?BCK<@&LPp`2u8MAmxED*rh1&E_(X=7o@)N9-!c29_;&l0z`^erL z?L1H^WdO1fs$^8s^5hthi#g5*+=%-J~K)ya+gz~->1a-k#m@?T}ErN*N+q+0H+=`E3q!DS!- zc?WJ^@Q|j9A+|ZV$zet0JtZo-{sc7X5@yGgZ0zXLK7VTn|8?+#l?3ZgT5fK^R^)_F z3;fMOzY8I`6$>>#*A5jL>LY=|IapJoS1WmvlCrFEczC$AG%+3wU`CbXZvYN&!jX{- z^@I@I`)Y{l9*A}#J}kudPt#fKy{2Y9%F660>W(-8t>lrctfT_NbvX5tCr@5!1^Av` z$7&AkeaI5;nuxK@tU)EiLsBC@)JPLi_kqWtQO;>{*Jddes4b^{mRSUcG z3ooQ~dyWNMLj#_NL!%&YEYxN%yID3I-DA|!!f4x&?2jNBiI4~s;5~HC?>Bq=Q#D?bFW@N0?xpu7 zFY5PK0bpt-2wn^|hpT1Yy(5tD{2nfZmJG?UB{8UOABh* zXCS_9Q>7VSDa8Wy+t!lMyp5b$t}Kg^KJwz5p>k=`t@wp=;Yo<_LrY_#`$qkZ=Tim` z*c`Lyl=GAevKdW!@_?~s3dX;tkWkXSe|XP)B;pKz3jNW{pUTBeYaCnG2 zq!qxtK2$kDJg1ag=uH^)>J^aTi2F{wRoHsHX=MFWE!CA@6dkfaw#zWCm+0;WW-zVU z9KHc_?eGd}@&b_$*6VnTw2IllY>yZKbMG}`5~T->jbc6L9dx_$U2IyPEJD}t?{ciA z4In|)bI~drY%Di}wzPox16rmU-vh*AMpaAq9=FZ8zRaO*-hR$A4`qoarC-t66&FkVU z_2M7Su@T|nq#QogiePC}IT`cxaS=&Yd=-%UXw_V1?FWnW66@b%txjzQUKARLAna*4 z_QRd|VI>#fcA89F0Q}UkwbuQVqD0tdaT|!H1kU(IwN=FKZ&JmE*f>QsQlHloP9N8E9Li2-%tnh8&cccWEh;7>rz)3EY!zG3b2;*^VR3sN`7Wy4 z7Y3jo_vt-q%cb1qveUrX2nE)dI&c`i;Yaj22Pd(D9}fUzVo5?deOb9cL-8f3SfwDF zg03o4?G!KwTB;l{lP%XZrB{I&=dXxnIxgSB*Un$}6CECIBy7zK@U8ZW8soAe4#YK` z7jsiTq3^`-I=ljdFB6YV7iyBK{ZzE;_;4K+INbfjU<)Tv=$)#WxsCG#e80MCzk~4Z z-R|C%5#W6&>G)GAFv4Nb%nJF2{QkCQG)3S|jG8Wh$!0 zKG2c1lddEuC6)4%>tRytnXuXB6xdesB?vhuRQtR?y;j06x?8SV)tjp|u{fgnx%BIb zt&osA7_7E@B?J)cb~e2N3dzA!nbGVFMW5W)Y@#aK>~K z{+NS4p%KUJTuvY8$(P?h_L?qt(a{jN0rbeTdSqQD4U=kQmXSUw289OPNj(EZxPtzhr4l75 zKMS%5A=Y$co{-Q%te1P!X0(<2D?uU>icL9V#}rIVf{wQ9kE?MiC0Lg|Z_pDsmb!@Q z3=Zx+T-+K!Ajp6_1MsRX9jra;|X(zqDr+9q0(-RIF4NfIpVOV_>LyskhUVATk_m*yi|i zAD9mZkPR7RfnjVQ{a2pPJ86UvLOi&I!Ex1eTZ3!;0P?1cTHO1p?X$GGxrj>2@fGVV z#qW&`kw>_h{lI`m@(F;0^F3y9M`mrJO5QrkrIYBuHTR)9f;NKjslum}6q48v-|KFM zFbO<_4af2pelM|{;=K0v2>h?al8Zf9Zd0M;lT;+MFy9QMHuh&Fk2mOz2XeB@?dHqp zwF1|(Wot8YYo4NGEoiCY@3~|uX0z$Q&4-IZ!?c{Gxouap*9;wZi(Q)}X*<`!SqYsG zI3w&it6UG14A%ne&6x%P0kZsj=D?sRT1FX%_78W?fCzv($DB!zZAbJvFmn2^S=!{X zKSlw`Le46wd~*eh9%>Gg4Tu)R_<0&H;1~AKk2=kyMp3l@is2&}zQb@A^$?Yz0AK;` zx-EcXec!a*>z$wqiX+Lf%sDJMtAFJe8wsP>O|7j#G6JW)zM*{sdUYQ#`UvopTv)fO zSr>h&NnB6zTiqvMNWMP2?@+rnbuR0LFFl;#P*Q*+ZPK(Q(2K0QmA*C{L{DI-&3-VeqxWFKf#jt}YP42mfNHbVwh+g`-A$=8M4cpzO zprexnl7`RMiHh)jmbQ@sVd~4m*;D!_2b=wn2=|7}>ep(nVS@$w-n+iagc|4`q0kqQ zLvLT-knr&P#$bnhq22$o9yq=LMbvLjS;)a@=I1xbG(m*J0f)-?hnk`sJ)2Iy}w}ZpG@9bo0dB0 z#e0GNZgnRX2S$eI=H@Qp0<##^@UuHlRN^V0{!y1c+nE)qJAo208o%|#Xrgr}8ZR|m zqFQ8`-CP^zV0wNTtI=MTl*+X5gNNO&w!eplzMfuWNXKRj7+_j}J;5l!s_0SO?wo8V zt+Lcc7v^PJmoG}^NAI4A7IQ3L?Kh0N&G#l3STX~e7Z}!u&3SKun0(aLwVL9vZE*L& zP+buO6B6=PHsD^#&oq zSS>#_J?*hSaPzGd_OIJUc|pPYZD<=%wU&Vk96mB0D)7MQjXGLu1WgE#f}0?(9=%c0 z<2ta?m0fsYKmMx3B8>kNUz-uT#jpv9!d5E%9$+OB_5Q2`*8*@b6D~X}9hhL9KO34w zoo#t3P*^jQ5`ckv(x^t#5^Xsz=D!w`Vw3rzX95)E?bF{!8pYzq`Lf*VFjLzv(s)+x z8CB_+a||!kIB{jfRaVn^mgLWZelOqNQKbIFg2*Z4RynX)oeCpS$_hdnbOdmu!k-}d z56{WzikOP>lDCQZoxiVibA>7TJrsE49hwD%n~Q{Nb&MN>i;#F9?OT0ySFZZx41;Qn zzCO#8#dVTpsBqs6+$3p^us@>}6CqNElLZVgC~Grty?P4Y1@3nt089J7W20{rUHT!G3_! zAH*5JP#s|)zVk$ZQ~&{%v0ix${toF@po!P<6*$>=zbiCA>>ndqe~QPbX;ycNew&zX za&nS*Im+*nN*@3u1%5fQFn5_WW_wb)ni7P$7;`lt<&XP)-}hZfVcXO zKcaTi6eL+F)~(=Pb7SC?nlkCyjQ{@3Oy~{4$1sp7xf^YQ33CX|*VXE0(062@k8E3& za)R=8bC_Ia=7>4WE9@9g0)qiBqcuEJR6I9UBgLhXeQ!F`G{t;G(F)|!_C;v?#@4q} z{q-8u0_R!Pp)xK7&s$4MQ?k&(4bYI@9ZcT=<`+LrX$NInwKEa%@stMDk6p7=3x%Na z%#;-|JL^%h2Kc(!rdGQl0%0rB>c)4vM$s7g4@YV5Vt2~I-!AX!6O#~h_ZBrbwQaos zjL^ebVp?acU>hrQ{MTc((^B8y1fMTpE`7*Y=Kjc!_4`X4An`sZL_by#0hSREEMV8+ zW_JT%#K8$N&46PkuG+Ci^B_1Ae63zW_0`Ug78))GT-%Ikf8U#dgL}B=Dw-bkNq_T7 z`_~&uPeMtU)DU@9?X-2Ivb~Kw6*@awBBYc=;-wGpFbfgG58#U?9&5&c)fvL?5-p&# z1enfy^K-;OlFQr1^!_JS1rFA`qR$OdfzC71THs`1Vk_<(&M-8@l@mF<43%6TcUt>m zH+~v+0$Zvy==xc!W>F)wR%80^@MLs+u;DX&e8ptttUqjr&8V|;@y6*^Wm=rew+}>E z54n|z^NF6^D5I5?{UQ?|SE*d|i>4_R>}Bf(w><$kl@Erg_93v&AFXH`LAgi#+RQiD7gAWFL&f$Agv9 zfb%;lIX{CUkc*S7HfJBPTL~T*cb+Iwnb~ZZcQve=oyun7r@ydV_HXo$`$8sKkm6Ko zZ;XdWgNe_`@yO1x141Y#8TEm?Fc1MO*tj{#dZLObou$ZqMH29{J*o+PV&r01a zoAb!Mh-kn;C60u4eK<1ajMrS2;Qpb^(Rj~upNp8#Dt~QblFYBKuO!EI{N74fNI}Bz zoMs3W4Ok(3zptsea&mryh83^wgeIvm|Au^aEg)Pd++E@T2%(WtyzW;BfRzu)Rla@5 zFSW}v-}-n7g4avq9)1wj!WV}^{f3(od1O{-4?2m$i$=8IkwcJ;rRfDj{QHNYF^2)v zt+Pr?@lp#7y_t_X2GsB@^O3z-W1ar_K_u^KS@!T^KHvj>1!Q}fZ0(x;XYUW!5bM&5 zqg>KJtJ>H_k$_Y;2T|PgmY~UQoexKU6r!sKOx_H93Js6}`vT#V#>SvfnH9h@)^bh) znewoa(3M(q)k+N^YuTc8#sE~mzI^yVe1W`#BZD;9Q}15IM>(4Pw5!o8=kbf*P8Jmf z;3lD{*ReQbhHT}0d$4H!b>cR3+=2G?;arquR@6PD!XX{-Odva=R{_f}nOm^F2AmBZ zNsX$dwg5%%SaHf-e# z^?LjCQgL&lcV=M3uH606UEQ27J!!}$fHH42tgN>s>bNPX3fYC-uIcTY6j>ULkO@F- z8C)R3%^=UR7k2oop~W zxJ+BPHTdOw3sFZtP;F{JAxmToE7~P-n4tsX)x<~ceiRpD^eeIa{h^7lE($Qu8D^oF zyM+A6&w!0LuJAOQf+}+XKTlz|2n8_isRM&JS|PfPgEDDxachGC1`{RO(Zy?vo2C4^ zQVT<4bQcyG7_Cu9{l{C?xMpeYaD7~WSKzpn!d(h>#21YDZ`<+Cfy);xHIx+CH?tHT zO|#7Yu{EG{wgUBU*=f(W5f(%= z`3oW{-eyNo{58w4R3Z8{ zWXl7&91}i$;2^M!bpI!W_dl$HCk(Qr9gj@rJ9u1mK6!5Noqo@iV4E2Sq8I zo=SSASwT@*!?E>7v(X{ z%vIi~H?+m}W8-sx@I$*0Q;ljf_fOYv>jNimd~{9|s-?79Z^m;fDT3>ff})L4^43}< zHn8Tj9$-#oQw{3k;w%lYKXnMHDk{B|7y5PGneP11tVAweOM2}spSpEy>=R$$WbxA5 zjis`s+Flc~1*2nou%Z+NX56X&QN3=Km~>&+TokVjnkw!gqSyB`YF`ooyYfD2Y%q%V z*pT}2H3TgAYu5(!PboupEI?!Cr%-I5G0z6tvtk2&$xCRV&RV3DYm_QsyVfa`i7vru zMHYSC(DS`Y^78pLjP4u_HQ4Qr39a)qIgX2!h**ccYdvdV1;=_=>ttIh4IK;D<(OP` zf0ev7>fBxpewyi(jeL!Xus2_?Ic0&@xm+y!ogL0)&J|jW7?zbF-HHhzPovmZ<-CYR zpk}iE?M+R=5&ihOY^I6_*Gx-lit`bOIIh%}f|K(Ti#&D_t6OKALp~~7fSxaQfwB}2 zXxbif!5og0UB+-a8Hr{r_A2bg{=Q+NK=aekg-{d$Kc%tuOA_@Dy}vM!slCPUi#dffTF&#gHzZTM>mEC5oU5H?$yFAR2gS zT@LUEy}2w){j)lK;Ge6CvoJqcQ?yGw#-rwLq1AHaOWiMZ(<}Q*>6>F;RD#}8bEk@n z_TIXSHX*Y*6RW=+TNSjd6bYjEPSrUx^Yan_Cmk{zNf_Z?>(74N&SLU?Hn6~^@?<*O zUvfi3#T{M(=iM!%){g>hnrpzCZSpG12=hyG@7~H`qX!Qj@z|}hUG<1zpeDGLzB=zL zci_Pat^oOWkx<({4>cQt`$n{;{pLm4cn*?71?^`3m1ixFwY1ab*5Mmp%Zc~LTq=um z-B*U??xS#;e3vyIr;~S79ngAz-Cr%?Gr^G|ZMh<8LMR@6ow-8a*8RJ8%{r3&3D%T) zzQMn;rYf{nnJ$r+{U0)wJ!fpX}a-5((FzNh*dG-j9 zxiT&9vb~{&KL*uPW@8AN%t&3;)W?1(N3PHtJFt5?4}Vc-{F$mVBn2(+Y2;}OeLeO1@S!PBr=I-rr1_q|fB~Tpf zv;;eR2K6t-aUIr13S|{0Bh8Ohe1SByb9n?4+Xqtm$) zf7P`lQOA;Cp>*tK1*Tc=i{TPu{SgZ0uGO}q+ln8x&ucI!laVFc_5OxU6_BXe3RBVM zyw>Y2<1W|rS~4wFu3G7A^{%^8ANg+jH6SODHA4%p%O<}GKiI3tP#%h`5H2Y26Sucd zs79yiI5NrM>Z5pwiP|pCV@bPg0HKd!PZQr1M1bZ_rN%1z@Noof*3Y^rk@tr?KLT}x zuSa~To;rS5%JaP_%rN$#SU1Gwv|h#_Toy>(5i$lSV(U)-aNl#ONE|TOk3D5MF?_!= zkO@Dnn{Nc{0;v&J!!^@~N4xdNGxsnc1 zEBg3Ffd4%CWU_hQJ9@ohIVV8)L4<)BiPW+Gg(t9X`D#Dm#Tp`Qw{43AvK6O)liN^Z z4ROxU^)^HSi-=dxGBM#@!~1JChCo(%)m&L9p4|Q91QYEjh0)sX4 zyYxtjIV}KII3{uwUMIb>UGTCB)3A-$71H#6^&T~hQOlx3PF!i_>7QrkFHhA+(E7OK zE*{?NvB592uJA($PF|SPN;qi2#y`|8;ztaMpVw5+wB`osbp?hf%8mT#zGk$M0iPE`I*wMTwG*2qWU^pn;U}eyoSsb3+o7bVPFuNtg7R#ihg^= zka+htWUyyLu(-2?xyxMt#GGSr-^rw5;^v)`p4MFNj+er#07}HSA+}O+UA#}IF=u?V zEA}O#5E1077(X$%{2bp{U_NTSeXsLd7y(sd3<1%>H_;xc5cG}3Lvh+O#m-oI>pXiN zwF8~PJlQn%2cfxsxnRs%zL#-lPna=(j(y#WVry|{s5{e838(6QH&hwab3-H1{4PJ# z>)qTu`w=M|MFRu9;!@X+^;68!zfvn5I{<1L>Md|O9Kwj_P5^&$>ugZxzc6aKx$qm? zv_T)yZ`fyF@cm@Gc@p5DdjiMJm=Y?*#SHcFwU66jD+Be#^Tby~7Dq_OjH=3%;jrZf;sN;3~;;wjuMU!7mk2 zL$pjZ(9_)wCMoaz6tXU3MKfI6dG01kTqdkq`Wbr6dfQOU=*34~>+@%yZdh6@nQ>r3 zP41BftsQ#c&I~-aT^pvw#5*+tbAsU2u-g;n*M1hm9Q?XzoG7eWD+!_LS~K>L2fgs( z!QpUUZ&&i2h1Yd^s>NoH2-#DWAHAn-gJ8u>bF1o>w^kUFb&fkv9S~-dBBU>-Y5;2q z1GB_u!n@F0mNQ7N!I8xlvfJa2zV-XwU&^~+KpBn=z8s&LS2}Xlah-AJY4?2y%9da$ z>aU3~gqgNh`P&r*ix_dsdk>)T{t>z8_lH~Zr>WY)cTbX@-$N%K+FR6p^9F~NV=Pz5 z%P%F1nWu!_RO3Bf@u=(mYG@&%+MzV(t-m`%bzu1+LIHg&R@w?>M{83l9d!u0DGthNC z=H^!QyhZIOXY|Q;Y_zM!#R4UMxHR{Hck+JybCLsVrotO ziJIM1W~=wO$>B~bA8_vj9cD1%jws1N!B~yy{rMUFcrkI(gRp3njU`V@~JKdq~)%W!-`v8NR?Q1D%db0zOo-3r=c zntooJJ0R1(Qz82NdFUZT4r@&DID_9%gU`~2^oZ5AGhRr6B{i1MNgRML4kUE&cK}cf zpO52KEE&{1FPR|OaWu}aj$1U<8rbE_;r`5Txnq-?%Q51VRkN_3ocE^|K)-bkH{Qsr zfC9?e| zfBl1^O11Nonr}R$@*CW7YU{&s3fSo?k>&BfJuJ#y)Q+%EkMjf+q%x+BmuZP37u50q z6=q2^>^Gtpn*|XSXZ4T4e$HLW7iLD*0rhGBTIKrO+gA*UK``X69=b}~tPZnk{c^F% zSwyh@^a%*g5wwfF67#U&!@s6VH^BxpXtV*yfCX=-pW`@BOEY$Lb#+%e+2M50N;@^O zZ_gvc00)9gF{CWVUAWMoo#yR1+km><8uNlPaDZ%&E-WYzU#UF6f((83_73WZ;fcDE zI(0mh{=cxwbTOY1yU+fd?g6V9DU>W19=M7@S_u}`J+V`_#B#ZEE5aCG0%jd7*& zn(sJdt>-SSc9=>X_fHt^lqcy#t_4S)J^T^F+*GimH+@4EIo$6 zp2zoN0{XsscfYHi$AQQv^b;;TNS=gh^vij`5T`V`16X+@lpuBfc@F;mC&7@Lf9wM0 zihC>){jFuL()M%tG)U;pnXlGFuxz79jB2G zM#ewG)4ctbmva%eJn{0#+=RE7cywO?blVL0S0bn=v}!wtWv?4<;t;FG*08X$wjZ$R zZFNg9?%LPJPb*igs^Z+>J|h8KbzD$j1lhf%Nyb;|xnM%7sjVFk^dq#jWvZ?d3Bc9i zC!3;O^DqZ*;v|Vm+ts#XGb1A-hsyLf$6F^@a+5)CNdJDl{PBWhCD3vz4T2Y@yc=-- zz=%Gf552s34cci57U@#JG(TKhAgc9(rn@|8*5wAs%0QzXtSlQvu-VyAzQKt9o?zkwQ3#|tU~_FZJr22I zRo@o^Qz+BAYNF+8bB+1q!}&NRP*H=`36|nFlTTGDtiKxN-D%)KgMKjwqo3KE+c2VX zO(how(-$FWtw8%xZ@kK3_U029QGJ52*Nit~4K`#VV=++(z9c`+gqWJ{$8O+)&4rVe zOdZn{Rs-qw2xi^q<#i`S$grp=+BlcJ2qS?IYAWeyCS)T}=Ta<-0?yFQw*^jQ_19U) zZRy!YCAFvs4wPe=1Vn#=>!e9Z%SB;wd3`V}t^YO&zxvd+x-j9g3W=h;e%Bd~?aIQ| zy;+x7phd4(bG%k5u0i(jqbH`xU`kDxQCtW$!H@mLw75vwnwFhHyLHWN{-~fJxd;nR zyuY21KO18AyVn4O=Tg~!w;MY6RcbANI#J@eK`0o|+YQTjm|lf&_2vmTJ`ImcLSMeo z3wJN~W(9rRBny=a`(>oBKYH$X?u*qdklwM3eql#FPL&4|6%I5cENnjiTee1};v6!L zk)UbDT%_Isx*!D%QB*);T-g=!jE&Ca*iZTPnc!B6j#&sjAo>Ls6&1DE>I(3akqP6` zDQi#Uw0%Z5R-h!!VVPIdjq$4K=Tm^DgLRli;&Kb_)age5R)B_22TU3ZfaKeqCk)Zv z`M&)!&N~*WL}XbN3QADs0R}$4>h1xVv7o@f47wZnRj734(je*6TiW58OeBfke!ylD z+}bdPwY$saw6`MerNJF5BP@=k?g`IvHf>XKDJNx60$ z!v*U{J6;`fswG~z*foHb`Aw_B;)Z~CHOEnSao7(IWXa=|Y%#230Cn95CX^k%S#OxT6esk}15U-N737ZZ6p z3B6(V!{>q3QZKa{M+$!h?3Aq&DF+UOJ^k+R;&Bl=Z-rVU)cBQ&+^WO`epQ0mM9tVN z6SwsO>F)A?T{*HRWC<4+7i3|huDWbF1nm_dz)PXVN2Do7wQjktmGp@mSYZ$T`eF?SjQ=5tI2*!uk ze*6{?xF_bAugd=L+8_BKe^uhVo3~L{`4_a}|B2`p+W39Zy9-L1Y{P#8jND`}PY$O2 zDbO(&zXNuHUY#kJQpL=D6;iG+Vp2rL@`)UGZ}2OL>>H=cfSiyyHk;9dUGh2f^mxB@ zZLCs)R~_{PJbisPxH?AoBy`Z3goR_!ifT6?`@O!C2 z{Y(Qm+HbilR~@pBp~>do-d&@pp@hoQGc&&g#--6mUyVF!D0jH<@7$T}^;kVj)lmj| z2jQVNhC4cgjTI^F3|-Qg zY%Q1Eo_%bM3Y%qvHnxS{pa#O+6!f$ZysET;mvLH0@YM{XCy9>6@iTz6roX$?mlN5i ztRV)r)=6df1~MJ3jx^u;XqtRuSCS-r^8C~amh-YR;BwMSZ#>`t_N=13Evv2*G2tjDU%ZLdb@x@S$OY5Ox z`C5g%i8Y6bK|`k>h=hf$^P$Sy8&7fySEv2CNk3e1e}+ryzEI7fR9iL@Kj;VHwD{B$ zv@dmf!u{59id;H+@Dq;Rd!99j&qLi>`KWOr6to-Ii7%eIT@jn$y>45m+MZP+rYd$0 z(`fC8<(hAcm}u*037pq_cREUL@QBvQGkJ$lzBmvl?R1i(L6a@EKFF)&CC7`cSmyDR zYi~YkuA(O!T-*5tRqTI4)a2g(d%1>quSBY zDtJCq=>>V)_l-F_^3Fy$-6PjtIa)968bi#&R@jvN2XFnJIq!aD;n9$NFIB~+vMkk9 z9y;RBXXhC1PnU5_dqcKsWk;Wcg!aL^?sGGtFcVLV{yl6>8j@dz-KOd(Crg%?UUM+^kr{Z1~QAo{b$U*6jK9Rt1?Pup*q zW9X!x@kvhXD4DJPsUk6ySv%{gx0{)ye6BF$_46Xg-q=?6{tj42%g4oXB6k6V4gab5TH zAi9FA;|75t>`Tw#Yuw7KSDSwCYeLM~ zZr!SE*|m_7J-I_zdNx$3hbiOW+QBoqi&h8KUsN-1ZQ#d)lblpt1oHN)wJyLagp@+11I6~tqK zEowL>4on#)iwdUU;OjmhdYbKR&ZwMqGuXJim_3{lqBaCG-0(D5u_%B!N@f%Ksih&* z2u?iHSf$gKi98NBIXO8^gBk-??$fm{<(xd9zd~M zyZ!Fgv!oa;3q{uSL#1+i@`KaH{)63A9MqNxWVp##nH)n%sDHz(tYDdu;D4%BsB3}i zLj$_^(r;;tF8&+9Oy(DRzaZd4-{=fwv=GTW&#WECGUE)EM{WrV4?97j1wET}HbqsB z>}%G9uJN0Hu$2B33!0|qFHB5=5+0bFXW1e9)a%>Eu4J9#6ugxO`qbkNB@R>d87z+O zazX4(Pf03eP;;EMzT+1lS|`7~z5RpzE>}*Nms@*V+pj#4BlQz-0Ri5T48P=8w4kx4 zSuM^=4H31TwoH?QT~Lt=!dP>t42w;mdcVjI4@|iGxw^Wl1zNcW$<3CG!!05vo+(cR zpT0zP4(bNUl5vSrS4k1K5{vo%{UI8!kT)QeVX2l0wHnOR?7@_WXKx7KK9Ozb-QC3A z!^_Rx1^+zN0ag|X4(s^Az-h!J%rz+e34XTU{}#0s8Mxr? zNgqQ-g4G39**G~n+)qIwIe2+1pxSXUbaVnBIJI?m$D$pOP*6ovV;2O!w*sHrgb?PZ z%kt8){os+tXCUtkY|7WnUT!uU9@2&aC9hv$kyCOAjc81r4^Fg@Dz`o(<3ZAc>E;M# z=4X~EHV?WIg+0!apEU~**eeG61&X@Ju>~7z0M8xW&0P}j*-@E^0QU-LHptOVgxmoU ztCuhCu&PJQ131pkBOg>{EYNIFE19)MvLH-`-7+<%vozwNP!wu-7buQ@UcH)^p5(oD z7Gb%VrEw>R@+X)}7{TSCrpzXM&G5g`x6 z+8+5qvPD~a3JW`da+K~VP@^boT<4c~%BHGdmms!*G2ngf+lq=6_>U=z>~irs>>SY^ zeyl?7Zw$-RBq>0|Fs|A6C*U8etAAXpmgWcrg%bJ@s0xAGs6X0mNAuc~;@IxdIBgvr z9ltfL=qY=kmy)H5S5#3!2%Z&UXm_~_Ib%ConrWf=tpn6QF`(2O+3o1+Dla@=&L<^h zh?Q7{y7E|Ar3b+Mrt1CbLWN+0o%xlOBkoY;7;h$U4$=mS09`v)GzN_WZMMO#LC=b9 z4(os;DPXlkFvn$N+|Z-TMqNfXpNmNku@pT^?^xb1_)wPnX5H#od58Nu?>gWjUks&H z05%H}KiF>#TcL}7?TDIcV=>7IlQ4He&Yz#s^}fH(yvq}1kr7~*D&4?d|2u)aK|B z`Ao{KGMnLU#1DYc+pf@Cn>~K~c5VQbEQYBJrzz*0zP$c(Lo4|~ra(_oAKpAttsUT| zvPhX!oS!Cn!gTPU>E}bm^vw%)8KY6u81ol|Wx& zch{2meV2s~D3&BL0_etgN=iy35AbmHmd8qGiCID5`KlPhoSd94THpPWkQWzX^~n14 zPPIDiLAeV?1>I#yZTRfjC(^0-^5qL-(DCF~Z=iExb;E+x*e?;17qhR+X$PeIiF_lc zeq$PF=VEanArTNnXwR5CWa96mzqmlVB>!fgMGXm}{S|y%^xy{5!1|DsKEwD?#M2u1 z3)kO^tAA-DEYFgW;{`*$v`YS##$T!)H$3iYWo0FKKv~+yZd;I(b0^aH2BMJCdwyX7 zj6-kVa1U4ZdZ99-LQJ^D$|@oR5%lC_W&Po_Dy;>&%C-_OyI^fb3GV@SAF$93vD5HO zbQEZ=_~K_6PLL58JK1|+85xZjYJiXxL#HwoY0-FTPQg8{Pb+S>m=tfri=Z{{)*bFY zxnn*vQXk%%A$JCyZapVqQ)-JEbipq*;=@7~zc+_$4Br%;1cp`lpYOjG(zLmHoJMqb zcJ@WDg`efs3`qdVEL^p{e7xVBD)uEzS~B2ecnalrP#kz^QPdS2#K*_qp>v&w zlGr+sCb325mdg9fWv4Ew$QTCNZ|?n?LqOZx+ih2D@(N(v-`3+7^~GEl)%rgX44B*N zK@N0Hh}QU)IHkq}X(FU-ULD)`vCx%>M!1aypqqEpmR2N~y46$-H!jo_iBQ~FE-w!_ zB9>b9v&kpZaB97gbfuT@#zung^9j)3G+nv6RB5dB+nM=S8l!&o4N(P`UF6Pa@Wb-Z7lcW6feV;ya0z5cc+T1%sDJ7C4czBfg<#}4>kL;J4aID3< zdg=e6?jcV|kltH=?qKb_%KKYV6u5dk8~l{zr!5|XkjkiXV(UhUW#mXh&`DAWqyGH) z9r9on^| z@Cg5*&~5L0<2>)=GBJ5UY)_jiSJAgjIH>BdC{fAbXG{K@pxuBbZi!e~y8lQo> zg`xg#7UmyMH~o}ts@UyM>+AJl_eLV_O5tYAz#jEO>Yi_+WQ5gp=k2_JsIPvC)_)Eo z;M5+GXJkA)h22KI)B0~Q_rG3f&r1pc>Xsrvn{*b5E>?pa-cnEZiI$cYQ(0f6WvMU% zZYF6^60rO;)ni;}t46Y!bC+GHDx9gNsAB623b;m!jF)I_(+r;rF->2uF94I2Cm6b_ zyoxa&Vf!Ku+`cwR;iLe)_Q=;ScEo-2>9uZYIp)M)Re1nqM6A4j_s(|ZW@g_~f;xSc zHxzyb>yi-Ep)h3#c;}DcZ%|xrO^l1Xjqk~5xy{L`$j8SA7T4L>{)f1kbDk78L;c`H z@`IQk-xVM1U+YCg>4MAtaCsn}mh9BS;%{{oX00YD%%jb-D;CxwT4|}0eEr}czTSb~ zw*5~weK+K;i*h7LBNarhcK!}2TC09z??JJf-WmD)y;(HC<5kGkfJIs=6ZyoQeYd!35`q>4z@)WO=MUd2STtHFgC&<1yeCtRa_ zx7u!hOikUWYKNIkGy{;M^QMT14x38Son%qBt$g0Fe-^C2S5cM+gx~2 z^&rAu?Vu8Bsg&f~w8xqj=!Wmv6n&x@Nb&ys<18A_|7?lZ$f9Nine~nHx{vsF^|zz< zQkwkKvuDpnx^E=OXdvh}a|#Lu41Wx$0;i=&pg{=bPAdS|PAT|>AH9YcnqQr$o+1 z-2C$Q5mefUY(K=N@Kb8Kbl+p0Aw zP5(W^@n8AqnRJl-YCCZASj!74;^gJ^SY6@lX)V#Xs&$!`w!>$m?zRO=tB$=PHJzlT z1l&|CK>4?Oh5|^WNJ9+Z4@Q%`OwDo!VN*)^p9Ht6N$6!{Z{@mkSon9;DCPuoq;BONkKt@F0_~?TP2wa zVKaia%CP`c&O@n)T19(%`|p%^5vWE|k<8@5l~$YVxt{_jYf5(fhO$+ew@H$?)$u9~ zQWM^w9|R?2sU&mEoHHv=6m$Fi==?MJ9}Vie74oSHvdM&lv4=?YJfGH%vQ z&A^-8>9lFq?e?Fib4!gL%gl|H++7U|!RMa;(|+h2yW`rCshrw-x}WQKGNxu+T4HMW;w8ScpiSO;m8!n$y4 z3wQ)ZRaX)j0YeNh-ux~ZPJvS>G0(oG+Cqp%cB(vB^lB_NmB6v%;yaM@bRm5s@zpCb zl266z6w**&6_uKy1te#m9!In7_a_Pc_JjY$kC1)~=5jRM#z(fCGC#Iqgfwc->5{C2 zTMR91egO8_$`6g&zYCBNY{Pe6{Rq9ajX0Yq`0P(US2LG-itCT+0%8nLNaCEs-|WP@ zxny-#XJ#AvS>AG9=)Bg}fwrL7EH7J+R))lX1uZRcYgm4MUfTfHhilJ`p07Xfzw>KI zqOxc!B0!R5BVaSVR>&h9tQZ2Kl}hp#FEUPJU5qz>_p1xj{>Dz74GQD}v9-(kLwTC{ z#r7>z4FcaVn=?(4i4n|F2Ke1IJ?_?4i|j|meM|Ad2T8?WoX0}?lUAE872H$~=sP8! zX=#m7rY${JnbB*ol|Qhoj0?A-Ez3;*K=<;o2yfau->>kP5?YQ*R+-GEl7!OGGd7V7w zjl<#Gyu7OJLvMpHxG^%OazvdQ@!`X^aQY(iogGZjM2$xWDD`|phzkn~38^>7Djb+w z*{uHDuSu(s?a(Y@5^Qf#9+;V-9F-$1Kv=qN8t79vUEPv`f_No03rLf&j+^`vCHK~@ z9Q*~CRGI<4f)eG2^i z{QPIN6vwpyU{SZGrh=}pV`y#%9(ZEmLqK#?wT3`{1(mSO>x;<}K0{8cA;mXKL0&JOJ$f|syd|n@slU-z&<*3cokr^ilH}cg^e_q z1ua1xfXL_P=a-XZuY2GBtJfXij+0$M{%f3`6(ADJM63+llaw?7VdusrHl;`s+5^1A zFarYvFujUyjJMXGO;V}P{Z$;9#6J=Y3EAK2P8rSFeVZ(EED%rA(WOhy1 z*FQBur=q_dO(HoKqXY&bX0u;*)yeqpegYUha1yXPYF^=Otuw6A0Hfxy;!+1ry$A2F z@aS^^y&=xy{+OU~V0$~&Tf4>sRMGEU{-q0!RL*@9yde352pBB)0yO7{IWS({j;Kd) zMle?#u^NK`7*im*m!a5SO6q8DxAs{sm#l}mJP2X}1`b-BF0EZ|#4Hy>m%Ny^ftfU5 ze;5fMsL)zD!x_i&3%;2w@7;~{=nfTfInppNXzS;Ye#kYxuhw(d4Zva`mEDag=7*?l z=#5{`Me8twN;qv~8~eb;ZpUwGm_9J2wtu*d%7=W}$OhbW=)8EY(B5k*H%F=y%Brdr zYgt5q10V=k-A@S#)@a_IC)wM&vQJE2ydY!bN!taYHa??o$F^O1fF{TuJ-lQ=k8XbU zAKuc}Z@X14uU1DrYsy!ID}Svs_<#ivJ8XBoUL^b!-#9!f8bE&^x%*o)^pBGM6h(@U zm4$*&x&7SJ-h1W~ef=9wK=r~4>-3YguUxkV6zszo|06uEztl%HYfb9 z3hgC>r%zc@f&b4LDJU1H*Mu9qz}!?Uy+fte7{X2?)9&fhlGm#b;k8Rq}yw)lg9(xA7IlidO8!Tc};NQlK?SuU6rJI5sc+|IW!r_k{}I?U@? z%6+FsQVIslCY@`1YPh<(`qoqf-Qq`$$k=s2>DgG%$7|{$(||g#@Jl>QM8w_tI;TJZ zCn(zhVvCqC@rxLIv>8L`H~RXnb$lEXDu=qhs>NNN&M{MWl##hy)DK@4OjlWH(sB-M zBpA>J&LG}fH78M{Ckc7r3;Yy%U-l`mgQmO~g6-cg)UN_lXB#|tFUIwZnKyuocVj?+ zI~cwq5bOwe>cOEEHx>q&7}4Sh!AC0~knH5DJON^_0x9!wzLo}`Ai7}Bh0f2`0rz+8 zTmIltK`Jg^k+4+vVko^GvS9Vv$36$OFB4MkXOELFtCFx(Y*e(iZb0;#V($Fck^`^* z5adq`D{AU!hNb^2kfLPZ#{H`o`8hvq*m>dG z@go`R>D#&aGj|>+r1&0Qc&uV?HnfIL<;D3EeALw(M{4cC_NapA z`&Ea8sDQRr43WDI?%h`JcVLD_Fq+pP(8b2luB(ye1_#@yv_OK{{FbV1B9n;oz(Drb zvO)wg9Vxjyc@mnteRS~U2rNJh_*@nXz_T=3f4TqK zY1wJK+Rf&ZlDzzM+nDd~>&u=^iXpqRYX+imFT*btmFSyPrzk#A zi3b)f13qhmqg(4}SZm9fNkCN5@iObAzf_DXbQCQ7g}J=5mPZg zQoEzA`itP}4Wl*`n*_8(GcbfyqBijM*7h>)j?P*;^m1sO*LstNAeheF@IZS^C0jHe zns?R8#c~nV7V3_w#kX)$pLc*0knF;KVCvB`;?78u`F=uvb^^ika4Ntf;=*cUcapx> z24SCV@h;qAXR6TV`V4CQsD#T9U&5t(UzKTZRJALsekYmv9p|aLBX<2TW2%R8au*hd z@1AFb|K?vEC{5u@;s2WMvfJ$U(<^#nt3lBM3U`HsgnE{=tYA|QFDf}vz2W5KJY#;p zA4B3N0Jf5LApb<3@M9#BMV29ZdnS}QM9@^ZDHVwArYq|Jf+kjE!^J6NKYq2Z2n;Lr zl?3FZe^xnh`_`>D8r0)k^BuD1P7Gd0dQ5uB8+gsrcoFw8W^Er?OD#}LKr8v7|I-bG z!I5Ksy6j2xKG6ON-QpBzO zRB>ej7zeU`)MY}IY+Z`y>}jvLFyWv5s#4|kPi+m0`=eYi-6Fege2%NrB{xP=jm1NZ z{$!>sofdTl;BMJb8^%U8aWN7%i_evjp7<;3cySiNHwIx9iYf-1hR#Etnj`$b*P0~6 z{ghl9;=$g7&(R)JvY}K;np2WGedRW^@T5hk&9)cp z7Icol2DJzsCMo-Z?|QgBOZ3y5p&g36;@lC0IoP`UjKLjt_NdfD>~a3p^8uSsxZQ?b zP6XvCFl(d;H$Uw>sHtJP@IkNB&oy7taBU)KSXufy8(WAplFcz`RPMK*t(Y7nbWSj7 zg1AEWE;=>Up{6LS9k3}nWsAtEy_pHgn_uw44xSZGbwh?jBQy{~-*l?>Ek9GsZUFiE)v`7^Sr=i;4&)iGtQxY}OMjH}w^u>R&~!o4cCSyEo9~he-8S0%;r1iqw4_d% zXYOU%xHlnqx3#`eWn6nctRv@MoR-hH7fyJ>ZpdNe7PoF$r0mHvra#`HCL+2LD|FNS zFdHZ|^60RR(;KA(mi2x0J8&=cnDW=DwtZboY!>6gyw>jYOu=0@@ZV?6TEBg?f!V_H zqdK~is}`8bKYUncdx(-a9{L&}OxlSRHiiOasG=khmq-5Cxzxu7lLlZ~IPvG~`)0IY zG~n!?*A@XbZJcLFV+-jq_`pnEbjlag_i267HvZWDL^_0!RvUQu933Dnr1U)~5H z^A>Lzn$7@6%Tr5maeidv`89FRVqXxs5C`cpy0ChD-UraX0|e0)y_W~DtWV(WzM=fQ z&mnpe5@t;`PryyZ(L2=k9y(7>5xTm%cCICe0Mb1mlqwGjge1yWbD*2C-F83T(eU~1 zIreU|M`jqCkV?R{jNxcJ zEb1^~odGKb`P8rWq(*HNFh^b+b-15nHZZ{{h53!}6+r{$C|w|Y2Dq*W;-J7~D6JMu zp)`>nWoBoe^z|E%8ne2Z5pqJ52I9haF9XlqwK{g5;l5hZt1YZAFmZ?@5)ROAZUuTk z{OkMc2W|Mu$+K6dD^;{DThpNTVMOs#Kux@qf`f%H3{qzVsYkUd(`+(kh}W70c~HN- zqJLpK0<3|cOjNe=7}W+^SBt|}uqqdnLdHqJ^D@8Tku*f@v zM^PX)B_3l#IngzhQVLr2#A_JEhp=0x#Z%t0+DxHzSmGV@jRAS?a~cQ4ru2;d)+!pL zUoiEF=e3tW3uMjr^{IOutX0f|X_FW*+>%<8g*=?BcFXtO9kmEw!x9Pt4a;=|a#S$~ zKsr2TZw|;+HpgwCfxRG+B1j`470Uy)-tEd=BYDee$+`N0k*rQZY_zImNpg05guqt^ z>|(EAh-iwqSD(IzFVw_Nc=ih)kb(dda(+I}5RqIJf?nFuMO*Hr!ZJ3lLEh=Z&BI{k zJM}6@BiX4Dy!Cq-bNX19<)-semmw*Pe5P-(%Yz-{7!kLgmrzJ%e~%7Cy)ZW?I|W9( zOwhVV82!ecqzQW}Y6zhnl-kpCgx<>8cy`&G8P-H6Gy(lh1(iRT$ zI_Tv2_LI!M(*lep8%Sz&EaH_Z6W&uH&hIMGDigTQx#7476^YTYnC-Xilv-Kk4@<1^jd(xk% zk!{{rq3Qr%AH^7yz1mL^z{UBk<$FBGY466WFp9(5Z|)cutpDiPobHQ4uw|?CSMN`l!AW7 zogc?+6Q>UkPw-h99dVd2O1O8{+D}d5{ERe3e`WNZ`V^;4y*O+c&L;Nz5AT1P6imTP z6er!l0<=seC`W+W>St@zM}Uzu1`GHqyr)E4MW%*)7^Rr^3eP5>5#|0%bkebZOElOIc83W8J6I?%F4nyBNmw((@SAZm?XeF0jE^k`L&(Uei-gNsA zqATF34Aa1;lyKsSJuSfCCWQuE3ibHh>*zT3SBSCmZfs}E>NdicJpt@BuSpEMGwx~NURU*yM%S7 zN+HLbc9TMx93Y+jp_Jwb0H}!zh^sW+6I4*03ZUy;Uh$h3$qLzCs-jisoz{e$a2JK` zV1VFTs1r?ZlY;xB+whyo%s z5Gljh?-u4(J}9zOzbM#cm0DKl-@Jr6Mf~J=baoCUWEJ$!JM}-Qu%2QHL|5`evB&jJ zII2D6!or1Xr1^;)o$Eo;NDc)N9~H1;Q!beH?~@PpX)-p39@N`KzlXX*u&G=9+0c!3 zOlYxz z1J_;)=R?mZH<)Ir#dca8bHMDi6{ez!Ow|p8t)5hWJv*t|lLl2=XFhxX_{uQ|Xe55v z0k$nq9rZqoB@O48jQmn&waV-BHAZ5Rm6z_O*;igh$l0`Dl3U5FN(BUh_r5sUYEW=z40% z6RXw;%B$9Uk;sD;342+e!UkV3j8=YnC*La7t&Z}J$m=`%H5>T%zw(Q!+kI_5ApPj9 zYe*i+^?S2tE>+K0od=e6!pA*yvt{h){IfSC0^U>VESKcxXUIUkyu31GfG#;`6+6RG zZ3ryg(@lt%{g}hA@i(VtU6?SR{r+}qtAqC-=?i7zlI(kA%TZ|uPc&#DTQHTxf)C$K zavN;KJl3&Z{_{V7KA&Q6Bc8YLE?V4&8T;24>4Cf`XdFOH2_o*j&JPRGp7fjx<8zp- zwH`iMV`piUC;5P#ZUN&Uos4nEx;%x6!0L7rzEm)U&UeHmhVBlUeEl)}>mG#X@XOjx z-JHXYBS8UkkX4J5K;#hei2VHx1Rvzh!t+oXFUfo$sY_GdjfkG zbu;9%G*bTPm%~00S8q0frZdxBov1K0@5bl3Zlv%W`C@s82z6ZrKKd8CsxxL^;O>BE z6FmwybVUwPK&pM_A!fa0kz<~!jf=_z>(+l9ffuCTH%?3nx{5rG$o^h+OpWs>$<<@KGi5|6D zX|huU5ggQI2-g{-ZE&pz^U8n|n}7ulx-}tAzB~xxx7-Nncl8*u9V#5^ZeV8|;~;=8Iv;0qA1vewSdNFZ`;UFgy?!^fGoN3sMJ94MY|eS0aBYji-)3?mg;D+6CBi)&ixDE#=BP(TFrnTDQ0IyxV-~bYu|iT%D&7kV&KBQ zYwtx7;9{xov8Kt^soGLyIqL}qv||o8<&SP_uo<#}EK}+_`ed|)_sJ4tBie2&1Jjm~UyegsRa{H=WZo{Vx>u@!Ej?z;5yA}0X zX5!hjhQ1|_hl^nQw|OTge}=xjRz;^HnZN5*;n^10nnXL0IYR4ne0~mU67=SjMSYOExqI_+Yqhlh< zJ63LUyFXi%cA`Q}5zNh*F7~9SpVP<;xW&`~1_Z$hTr3vL;R0EB?H{t}!wQ(v_;t52 zd7NGom*7i;(7TY%3GbD{toX{aKlfa@!sEot$S2BagRGTm2btM z9io9`CVxV4YgW-k8L5XnWZnO90#}vr86!oU(eC>q@6qd*B7tEQaoM$v*-_!$I?vz= z>r-p^p%|;>vpSiKv7gi3+fMa2c|dOH`AZWHqucZtPKFn>tQE0|3kx1!F{mHOLZJRe z=XibkV$Zi+;2P0J+64j_)uQE>se-}sO%9DTuGuq>NX6bx2MPrSG%A|+8N~Od46lv} zhJ*DTAdNrKf*IHm_?!!&mypX~AonJn?nwN5-7qEzT_C74{Wbezh&SR)Q)vxdwSaMB z@FSX$D|bHBOJQj-K-5uIf4T)}7~*3uI|T!z-5I_6nV6A4E*qo4krER*St=wb3)ne0 zsJ{BdAn1s>Gr{=!KAfKkr?*`#5x-)#)R*}&T4RU)iIe$A}rl zUF^4>)S6<%*v-S~^N7(tOqrC$cgdn}e{FxoO0mnC_}os#!0Hm(#GUqc0+Dp$tu>5> zx;}3q=_4r1-%1@>o2n569&T&|9DD&=l5{yZIZ14lc~Z*}0cSl2S)9@qh+ikIOY&ns zDD=VgfwfoD>n{D$HK~V-2RDXpN*%o{0~R{Eow*&GJX~9fSh7wVUg+U z>nk|0$uMpI*^yT^TlBd&scy**M2hW!4SP5$xGbhb1} z4I@bhX5+!A0&AKh6GXYMnB5O?K#`WJQEWFfj(3j+(jOgUNSM;FX3V@$Iv9t^?T%lc*q^BrR574pnur2FO-PS|t)XeI@uHZY|Aid8t z0^Zdl!Bmm0pPsTsKmr<(8&)jtXSjG1%utYAUjY4CI)Q*@8hC`9y>W$ zT(REv`)NwE>XqGc1kzL-C}a{=@^$w$1fDA$xPmFL=7r^JPjXQvR>BT`yvu^xQicfo z2@YVgTtR&4-dQ^QVu+bU9tO-}`0ZnSg41hnu>{c7K(-*w9c*$#3u zu#QVL1)HdR_=7d}sq54tWb#6=h@`fM-;@A6@!_S;T?!C#mq{V_!Xn1$A{g;A_qIIZ zebwUl2arSh(v_>?X@y|BfeSB&{3}>MJSP0peIWkC2xPH9me+a00 z)X0U_T7@;%hD7ARsbUr7XlJ}T&nTd&V@1>$#xJ~il3UC)KTlI?ade?S^@wP9N4}Q0 zkUMoNgT)>U4@7?acySvH0o|Rt`|;DKTlgLa%3f(EXi>g%Gd?8zrhIs7TlDRD>{36Q zr*cq*z+nymei!Iv$v(fQT(){X4OocGva$hjfi#5`!AeDDx|~cFYdqxk*O=Tjj|6gf>Fs*NP(Obcqz9g& zd0z1=XYosxk(Bl^qa0)Z3+>;^s4ef35ywO4>iE4;&kH&5q8_f(Yf|b|Jy%%FLIi z$mkyC&A3GA-&lKYJ)(QdpJ#CJ-T-0P2&HfiHz0*5vqKBLc%{FCr+bW1BGESaE)i@0 zGYbAIC=P^wi|Sgjv6!a3&tdEj*-X1y=h1P<;`Z4ky^5vy z(|i5OmCF_rNlOOj=CZC)0d0tabU^6iG($#X__e>~to~dy{;PaUC&bi?sP{S&{(eH@mzE$p5;|S3+OR93H=cO02 zk6|XD>Ohg`65}RV*RxO9o`SR9_K48;*|}BqqVLB#4=>8EC3tfJH|L<(a_rUi_z6$0 z+MRW>?d5h(p6wh7WTgp)$7`=Q`xfv}B<^AipXqJrqzk7=VmIfUD>vVK|M8>Ukm;}r zW8E_U`h9HMxbP&bRI*C*;~~mpz2wzd^t0UI>qsf7LkG^6u$(7^y^@=zc!;)6V6fA= z_fCIRero>sR_2OnV`WrPob&Fu$bM5Qk%jKz-u6NL#yKp#uz9@iVcSKofXM*Ug~I;v zHJyJwoPR&RWmzMj5??Wa+k!FPW$Ei298WSVAl#U{PtN!L@I)x!Xe8`kxA{>kROmYRWMID* z7{F!xw?pOgf_n#>L(bD&ZeQR=7Zx|Dd>r8Gt$Pdg*=^SYw!>t<#$yDz!19NXeF}9+ zXl*0og0QENRMkRzhqAQsQ>V9wyAcrzxn?sQw+njeq$IKNz-0AUbAFZqTb!Y&L4vRi zTPpW~zCp?XB0tw_veGN@7yUik$ivM8!%L9UzVqcCazQ7d^MafTY87rSyX7DI5as#0 zed_3rZ^!*if8+_8*ZEMK`K`?PuL~}Hl>&>4A;-VI@G1S@&*lI5quV4ZOeH^u)O{~& z{-u_Zxu8?LM}78Gu$OA+|zH{&`QhCqwB&ObewFg))#h;PxTa=OR zM^`^wr$?LLRq->AlP88AmdJ60i{6M=Ljr%x_P`*DqJ`4i4oIC8*HQAN*h#sN^Ne?Z z#f~#}(Mbd8Ctt*+Q~ku-%suXxiG1Zj)s;sP4AxgLyw4Z&X8&$A3h6wZ%700TA6$0` zY!Zc1{%t<_Ur!x)x`82gNW$=t`*sVYfb)X)iTi3MKvQClwaY-wxDxp9wyU)Oq8k=O1^|C(qeQr~}x{O!AUd~1e&1PPl79(b*ZMUgnRqJ=frOz{#&c1(oSPKJ&L zp*-4*_)67m1;GF>JlgM;VEd^OG!qNcznNd)$1CowG&?s7aA75r;c7R|e&LY-Z(Muv ztL38N2Wx$-N8ebymIf;rL;DgX1U(%lLb{xnpM5^Nm}>TFrLV@_eRZyCb~?Rj!3?-o zi|5bdZP*k$V&C%hP~mHi;sQPb3qnnu4Z>^{29r=+tLIQ}0IoB@AJ`eADHb_iK2dkcVfl*T|0sAyliaE6Otk#kJ(fc?l>T8z9qdMHst?N z@IE4f9|eTd3ssu>jf?qgQV{soW6~dk8&dGt7IC zX4v}S?7#Bp9~11KK2cA83M&Td7xT&DWg8+jX*(Q|pHrU0&=H@)Fh677Nz#3kZ+ol0 zzr#%A$;`YB`4W=IDB`RHmX)v#>w8rxB|E>(m2%lF__^L5eRZYz!3NmKH`eb)*G;SN zYZ5V8<_Y4uZ@sr)jNMASNR`h|-hhBciCVZvA$b7;C=8d3d)V3TQ^!eYS}v zWDEMqyFb_B>JHAeGQ#coG$|-voBQA&G%cTFxD(lL*RJ1Xwz8X?880G@L z&9*it&)#o8vQzwY zz>0Re#>0;c;hOMZayYldaC>`qeEoXE-({b_VqznU5uqO7&yLc3pg8=~oBLlrF+ydV zD27JV=W3dpp)9RyI*Gs>?Zo9CYB31>ivYuMNZP^5RH}fnTbzNoN>TN!y47Uu=hNl~ zEy$D@52?N9l#o@R5XyS(mn~i)VLYzTR{x6w+|`c|t;p$1sz^%&AT1pq+sE9Jk6?_G zXYy(8oZ;k0-jY3u6P|Gcdk-VE4FgnDd>2^v2T}glfBkY=_qxKs^J!A&Gan&@Gt=+j zGN_6QYxmmqG8$Zlq5N{{U?Yyhq)!c4y(sN}lpUaetk>BJgK3>d4SF>_g} zo`XKdoW9x)vfcj@>ELe{3(%{_VAq`$=Pi|>HLU{uo6)?fiz%vhJeKiOaamAqTIH*D z6x1m(W}HLMc{X&-QSH3zN6bJGJ&IWXE`iK1vs)zNft#9@*UY@I^01hB%6Y}J<_suF zx|D28YAnmpFLz)d&}T*n;V!lDNWpFlqc!bPD(p~#C_1Vojyk@Y4zr;u0@z~sWOCBC z_ggz`ieF=>Xo@R;*dBmx2W`b*#e0`ss-U>q34-f5PqNq;BK_hYiiT5KX?@FA8Eq}_ ze;U#GUtarPr)BSUPtlao5nUgt(8!SoVZVtPuN6^q37bU=)Sj+W(xO*rV&Y%&LD;u< zHU+aN8yGq6bNTt;1R6Ywq=g|e^kUxeOV#64S@~fZGTz`}pQ)W!9DWQYM7}?7@RFt6 z;fDzt!KNSdjAQbL^<>;IreixAX5WitvXVoNpyEy+${gZekezmMU&|Hh(sQVu{J?Ax zCgHz&>an7o!`M&e`_BstVN`%8p_WNbAP^j;xTWw!Qh5nKebY8(K%EEa`sy0T zFjZ21eqW}dyh%D6uyr5Wvb+W^q~+Cg%3F92z)Wu^2%q5r0QZoZ9OGOb$T&6bc7Ar< zFt->WVTavL6*dW{yZ2DkV|jXg7^cb#KO8>;Qv~HujX$B8duwTSe!9I#0j}rU= zBQw4U^^=(DKP>K{V8e^*_5$+wS+nLihl0MLb-9(FT3L8Cne++k&fB-#rd`#_nqvYr)SK?p(vHVpPvMCK&1RRnN|zyJKHEj<(ei^sgy2{rLV}E78J-Q+nNT=0dNR_1*ORuLy_R?Cf^>yj|PVGJf+-5$6=0 ze!b<`5v;rV;`RP$Oy>uCHi39oy2u{?^;zSB{s&i#u{z!Zx4)A~fU0!T$7&OhUC>DX7>VzOmESmmyD zs-Zgl2gx7$Z%?9?b5c_b$B^16roQT({Y^=f9h+f}m@kV_p9^EhA8wBHeUJjrgx)au z{|vNXnp80GX5z4RzRf!tol*XTS$jATboEG6@SVc)%d5x|1jg@<%QfwnU8ac%Hd`d@ zpX|J!3Nzrv7jsf*JvX?UsnH^Uwr^|0oahIMNni!-^?H5OZLCIk>KPJ`uW`>;h6ZYn z=sM@e4vsaq{LswL&n21AXJlmL2?A|?j{=XNyaE6z*4Xrz!h z@Z{muE73*RqoPW_gg%a?nZ{)!iHci1Nrq$gpw}|Pwz8x^zrV`GC;X0u{-a5VrvUGP z|IS~8?;qaPpQH}|^%cH(1vYlAq!p6`$nHCs=qJG-pC@!lh%>~zzFe?3N#b_n#YGI` zw6>OeGmQQAt?!BMZEcT97pX+GBNiijlDEpT0Nc50k1mqiHrHI{v~BF_PRf;p9pSz> zXf9z0jpb{Xv?BGDS=*>EoE$v&jBSeiw%4P_B!AT8X&EB-L9Y)Qiqp|G*jcBKy>M({M3*9>wdcvkLP0w>eT zk@D>#y~EKbF8Y8kG3)(EvoK@rvb!n*-&;+p>KjUED%VzZE_C)aFb%^s9I6(mH9g;- z+L*jq_%Sb(&l&>=mHjQ{;l$7sskht-iPsys(e4Q)8e@o(iRO|yxvg1FhsPh?CIhU- z1lg$7nhu-8uJM=@wwOeqqT&qv@^#auew{g<;N}-Tx=tSR_wS--ksK>#b_#3b8XCj+ zr(H4sTOhp7M;>l#zFbVxo!Ez9DOI#KohRnez)j&+!tgO< zX}`sH@q=rV*|tTIVvx=LSujy7P`Ro42f(h>vt%@<-U1U4hWh{=3E|{+F zSj3Y77t>(oxo_?h1{IKnPY4i5NkEvffX3!sduEij!l5S^NtYR;df?^_;&!ab`n zq{3=(G}!6pgkJ=M$bz7A7cUfTP-0yuICRIUP7+K*9R7kGeeCOt-l}t$Fe4-2vE83k z!Ri!R120AYLn*_!E8y%yEYXGpqJwiImC-@B@VaZn)9s-nbR&(w=k)*K?5zWu?!Wf& zTSOETi&8{Dkxofz5D+Or>6|p98)*=+P`Yb0BAug$q9EPf5(5Sd7!8BpYxn(p@b#ToZo0yYa+~^s0yqGc$ zj?8DC^-Q<)(7mZXgwoDMbk&*|_@Ypdu&sim2~;h`mPo&SGt%IN(%MOjn-UkSLfb4U zg7R|QXnm56uW0iwsDIixZ==POjX3com)$eIZ&QD$yJ`ew$@kqs!o&qe;R+7w8~@b> z_{#|b7x_vlrI#{i4N<{h-Dghwzo1jUFb&{6->Tu(T4k5}mz@o8`{YYI!#6-V0=8Y- zx4zk5>YHxvRuNae*!73FrhTlqa9rqByLjk@cyi6qME7ey#X(Low#)j5RCWQi20qu43Ahj>bBZaO|c5p(Q$)l*{8LR5wJKX1C%E%{7an;En?dB!@H zqh>BcFPdB))sR|u77w}28V)($F|&NnKck5fn(-B(3H z2D@UB=itZ1|MuOx=qZssH=Zk^aDKaqJHVebwVN(lIi)|k6ow16xAG(qPyxNATxgU_ zM?C#ov6c6oazU&nDlrJHQprglJAaP&*~}Tw?;5l}=}x?w`o9BMQy1MX(3X5s_T)*l z=h{(8PW4{e{RNTk+3f(>v5tpsGY(s(dZ0y%TWZBrK$G=5Hd9|dEcFGM*j#lkW6jWR zNoQe*xb|I69mz0UjddovB|jW=InCDivz24wc3;+C(MQYd%9H=%JpH*YEXJf>U8Ep* z{Q5r<&i@zl@c)drdO#e#%AIX#O5zz6C7S+j^?nUlYX2xF5wHT7!I)#NP^`v4RYxgb zK0kZ(_2wkfnGL9po8zsB9dsFK!wpNJSzjzbp%IBHOuEai!|UeOQNLl?<5$Xu;+F%- zot$MHQ(pm$MK<5Q96-Qw9|kx>)5hvoqi@ZppRhUD=^kF8>Xu!L-Opr^@`jEMTnE#r zFyG=Q01UDjgkGI`YZx%Muwpe~lb)V7-geC4b$AOB1{yRKq*NTdA-cBJ20x9wr^EzJ zdu13tto40wQ&LH?RX96UZ@oR>_n_E9*KZY zfth;M*ca{CXHz8Nd&fg_fiaVjxM=*QpkHw6K1#vt)>;z<4;=qOEPLCSAvLS-~gAe3y>? zW42W3aRclm`6nVhzMJq%!KtHnD$2O^8-87}68E~r^c+&+EfiQg%vs?$1ap`l6(t&v zs6EBtVXIM?H8qW79p8M~N4cm}p`!AmaxsB!sR%p9xFv z%`uKYJSi=+f*2TZWHKt_qJwL0z-M9TN4MHfS~vhE)vlg^nM3f7(9q6m=Xr($%UeIH zuUqL6^C&7>&$tPcKd>*703=Fz`x$%A7|(9nTVU<9{ph4{^`-sO!xPWx5Qe$6$r>w8 zwY~PZ((AWwsm|Wtc{9CI<@5|>2>_X>IGV*S8I6GjU!G@bUSD^-JXYQbmN@kB@2_(D zQVn7zT<`v3^;{x=VjU?)g--eq9DIEWa({LrVCeLW>K6z5A3rSNhc}t(3KUN&-IEA+ zt=iA{P9EN-z10C4eEuF}KNOWoy)B9$#%v4?g`0U~$!6#F^)FyBlU?5DmEVc+4tJ^Z z)+#Gx;O|u}%zF&(yR7wp+3wvCWME)enK1*`k-~dVRWWpW|B|$C{NV%x^IN}%<%_*l z=~H8$I$i@`^pd*X#gR3Rd+F{-wN17~Wg4RSZa1;zx?!cfo^>8TkSRCqDG4knF1vRV zS@v@wKrIl6^}6ET`zwU<<0G)A6fS{y)j2N1k8poQ7O@H=98`{k>tn z)XV;FuT`!sx1?QZb@!jo9gN*Yt83~J5dH#yQ?bH}iXy{57>MUM`#0W&({Jd193<{X zx}|ZP0@)&fY2^}iw+6wkoiQnnSm0?R&om$mR_wC{bB7DsjmKM(k~qBoljlDG{OT$D zx4M^v8aP=7tp!=C_xH_FE{0EQFDX1Ba(Lt{3z#RaR?dvFO4IyG`5=Y=9H5mY+{#sY z-t@P%*S|gB(+?tr`C{JK3$?9OnX|`b?bU*PA_+y}tm|Dll`pY+C?I8Mj}anS8@h^j zT#H1HUcs@8`MSvEbxYrQY27% zwJQ3*+?3PL!0?(DXt2&cC;+XotLx@3u?O(5c)a6h2gKLCE8nwDD?{vH!p-WpuXQD3 zKD;HoPY7(179XgPw!KSH5ylyjGR}xR)o*I~K_Xx8$$Wq3e)&sa!QamIua78^f>*$q z-^*F-NLGKZmHwJ`7YNoZ{%6l;>erCU$y+WZ>j4%wQgZ6@Z!v2$+7hDp#GsGJ_XME1Q-euNMb9OQ&xAueF3%tqS643SJR1@#MfWL*- zIB;XDK|reND_H=idFAoKzy;ST1GkxmFH+Au($souT%z_WEB%nq0GkEkXaGH*9zxL? z;=3gpC${RbdjrO%cNcNo5wKZ$=*u>wCpw_t^{|f|Bw=^D3!yN)mEX`${^FVc&%w`- zUAWiYW!tvqCvG+GMDg(0Y$6dFe;M4ftr@jiJICIHG$MgQo(_EhDZy=GbMG3TfJQ+o zjhHO)5VdlDDeXT%YVYvCnwV05iSPOJ-6J~9#q zmWY#gSFFP)lF+m&-FTB%O|s8;YZmA|5qGvqe!UAV7H;6gzJBrQ^c#C&?n%Q05cok+ zE@#6aF1{PY&1`EIRi4kJLFTtlj)tu7(>6eU{``5-9%cQR>0%^{`g;jPTJ6~-;a_;} z|J8ZWKb4R=d;5!ja1p}O_6k2K!wTm;E(LPgB3Sy%WKyykr(8k7)?h!x0v+0sw*zMg zD%SYC{hZuF#p_M8s!j5%HF_3jd@jby@n5!oGC|Dw(NKGDy>ghc=*x+Fx2zX<&_ zwa_uMIZ+0iYno}i$Cl?LRCq<~NGFXdDKw&FJzlAug?*rUu(NjO?D-uxjRBh_{@il}KS)kq^b4MV8Q0C$+*!ah zD`ViXaT8_4E@n28+9+$Xz3ftAxvf*>wNwIzB=sIm_ynotMj!Ja0I6NveT+Hbl_`!l z`7VINiqTMCSRwn#s*>*0r|0JaLc}7J5-MU{r@Sz?b5x37j`MFa03>7k?(@#h%20zjb)N#)U~h7BG8h>u^0?*>tlRmS6^?K@Fo%c)ct1h7cjO zJLnk4QN3l4a?5xd(A&zoxTRZcR329twN~d=*8j<%qd#OEY@2k&nLpg4G6ZxtCk(se zyD8cQ;w&0@OjbiSq3CR-n0F+Tk)izg?Il4m94*En;&ejf>{(qfUwYNNF&<@64uL5V zy-r9a(^$o7Xl3OKRr8^>3s$wJCid|~lBKjkG+>PHS{<|p2!OYy$tWoPkviBTmWxJ0 zyx4txkFJqCik+xtWA(wSudl~HAVW;FzCAq;_}@nnm_+>Z$CSw?oBFJ^4-F5(?@TM_ zj`Mtm#>X!)_7NPF-*AU(e`3^!IwXpiQk!g~d!V}6qPcG2f?didBI!qrFmNNK@5(EwDv8Ro1YC5&5zYWa|tn4Q}sz7d}q~jfDSR0ke4*I z$KHK+?{VE;xE&{SBrUEzc|WOky*C$#_89HI*sOVmFwpO-pAgr`H(;f+yLrdgbIXu~ zveLVm!+pz6xy5%Xp6QDcC17T_y*hbs)xErd3=doDandb#`os7?RQ5$O4L8@#%XjwC zcYJrpsjWvZ6BClwnW|HL@d=)%T%iE&%{_MG6&o>r2Cmfnu0;Fbhw_$2c)+UjilxM# zdFUy>h3H{}Lu$^^-pbP628r2)d>wuPL!SeQvzrE9GthU+57;UDk+xL@zBK!DeVitZ zO&z^mL<0(nB8&h^3o9x}GF`1EE^%EYFi)9!KNWCHW$51)Qy316*8O;dF>@Du*6Ilq zV85dAji(=jqa*ce?%pfYe=AKRVp8p_q-EZx>78QeP2>GQk|mOp^Y~c3WAo+F#-4GA zmZ48(2g6vo4P9ZdyTS4Cx6%^(oYYr;Rs zH>exLKd>3OZo6>h7XRZ;m^i0GbU`Q(ec`DyY-E6rSB90Z3T1Ty_TdiixDr#vb(s75 zVaRJqV#Smxkd!I`THWKijfFApr2yr7{5u(!sD>fDp+!$tb)cGUuGJ_$Z+#A5t0S$d zLCQCbndTvDom}G09$=lFFJjDX#j*Woea3~oJ+M{!Y=>|56r!g8lmDPaoO`d60(o?0 z6=8gdawjIi5Anff^9FDROdNP;JqE*nYacw42hL5f?)%M7xESLefIsUrdVOZ)(kZ~}|Q!Ex~xy_Km> z23EPYfO5igWK(@}C5pAgW7VTHFQ|NSW0ujxYR`4wMmghK)3^Bjp>6c4o?CP01s*Km zMG!=qCIZ&g*f{l4Gvb?=LZr#h8k*KJ8nf60jvKt65F$H^uuPruh7Y-B9xIk?I?S{U z;;IvgX0KkqHu?PQvl=sD$;%77Yab&)?Coie1g;W=Qb>Wc3=e$x)y%*t*YUp|v6%WBY(B0jW8N+>(&6?}idvypdFPhtSM(HV9gvJdf zh#6N%KU#~SSBO?0WGuT(!d*j}Z#8ng|yXJxXVJd(k=Pi^z^li9KyAcEebJv8vmlcc#O zJ}K87u*o@88Cb8#k>GeR6_SmFdFbiEFpW`-+f5vN{VP-X?HlLVidyE#xcE&PrA_oZ6xqZAL6%Dz%P+xoHECzUVOJR)9i#vL&ikUJzK zU2)wa$PZJD90t|*GV{3V!CmiIJwANY#t8Gd6Ct)IP0ns$goouWh!~hn7Oer_#jZYy zf$_<=A8%(G6$chN;^lF6IsxZZ6@;ym=()XAKOlJZj1(fkg9OOaW4Hp5s~gczL}rwhd8rS ziM)6WcyJiO_NBZ4?EH5~1K=j~3OeDsdFTJ{)4V|Xs$p<7o5+aApq%)2>FcAYS6ots zFSB_-Ce4KRMbam*MBi@M!o)dEz&YUWx(a{Vs0874i~F0la9LgW6B|{xwc5b6FOE9l z5fSrAgy@8&GI5{e8VQdrDkd7=P504}&Lu#TD3m=Bw>X}Yp2P1nsOLmOJ~%RdcyRE; z1?$uGJp5*faG~hUhcUhabJV*JXZXrx_Wm=&NF&kJ`u^P*;ym3jQ+37{ojAx(@(kg zdOvewKh*}WSImSG=QyMBlt9-aoXR@en6oAI_4iG=j+FoYcYnH(BJC6%lxrG1Lb%b! zR`77)Wk3R07GgI=c1}39<+~{Wu2sM_k?y!-oraIU7evr4C=U}8&0IK)z@@ou_1;f= zYu!~xD!j7+xmlCil3n1s`!g0bCQeaL=a_j`4LM+`nI8wP$S%1mX*%Fzw`(gBj4P_p z<5dAiQ)hQuWh1hG*rcyTd(j?m~Un4vfO_^L?LEj zlsXW*)su?{6e+arT4^c@R-9CD|sK&rQprd6uuU@@+ zy9SZ}{73VpF8tr+d@1Ya;Ft@hP z_mvl*_#Lv7^F0Uk^e1BZx&_~@J23L&6<&)wHX7!&V!2z5>L*0^0ESp@r{0?g{4Bc1q&E1gJ*N87Zh z_h##!Rak4sA*LzzkAm#le*&iL*4r8vrUHDcr?l&USjOh2!bv2|C!W5~yxp}EF-WxH zxdu~yJi=|7h&k9r*(B9aFsq84$dj`j$?&dp_eqG;Kp^Ix1q{?!lvIfi_7SdNE!7IR z^yczSCR`aae0(w;?BXK?m(& zct61tl@FKyNXhqp8qIohPbCG*RL^Wq{)G@5U=3N3wU6P`3%f7ro7J=SHw^ zX3(qG_(C*1xGgwRS^po4(s8^l5C^JwU1Orln-Omw2{`0(M4jp;BvMQ+TBJ<1B+XPk z>;_zr=h|)LuAvdF_{gxS?e^R6tM064{mGQO^+)q8yrmL1qRI#H`30 z{SXnbn;ZN6n860 zrTp`Sf4-mjG){Bf&}U8eDOfRiU*JbD`tS}-z-Rr7k?Q~3(N!a`1e zANoV)hQ-s;6e1~FumX$IW5cn{@9pj3pF2ID9(JkCV^| zB4_88^r0-%yaBe|ncT2GCz+%H2M=hbc%#9Jujhh1O2bFKiOLP4njjNmPyUKJRG zzcyy-eA+s3%7u#=85uubp1U{)NVUQ;GVT@LXaPz>GIk)Ti8@3hAj?CAXfiB|d{U)R zUC(Dp9~?E_(26E8sTbh&GF|S^acsWr_84r^W-7*U%e))diZX7(=s!wAjW$h{o@=LY6piS5v|k{{naWM@rOxneAVHRVg{A^PzU^4-<;zY)Ky- zWi&I$i?;9!wDdXjx2lywPJN(E9(aHwI%;>)Q+a1)WHu@Z0=G?CTz!4ZHne7~S^>aD zi&5CEiYFlUw198SiQ|K*D2O|@D4GJ2emHUVP+4ksX}~sHTLLQ(`hI^_o*wBA=sw!3 zuJir#xc<{&{zo(7M}R~Gt@xc`jw^n7r#hfN@aUgNG#&t);aXq4eJ}zf#5_u&u!vWL z`0w+;YMPAeP>;hYzra6@)_!M2J5I>ub2~_XnVdBN?*cvWgfT$BR41O_M(5sv-i@SM z$NBfT(=wYPZ`u)^F!S=Ntvy)IWyss87_%h-VO=?aspx=;$30yP5LQl7J_j5Mzlw|C z4SzjC;2jq%MKy4ky9E&T92FlUW35MAB$`=|dBdm=XN z66xdhH{zsm0NZX30U1Sz_;DqWM3n-1=HUjk%*=94!MAlyz8>}N9D}W0t8(8 zI(Oos!Ev>#?}I2f-;0R@+xT@wBVl;KdcvTDQ$#uiVkm+d2J(lb(GvEd5JQ_$){0v< zlNQOaDI~x7AErgYY?pgieG21gKlJ_aG$5`C1ddxWp@U81}2zrYrnHLclt$ zt<%%f*=Kk0eUA6d_g6~0#&cKZ%W(z-_Dv!IGQx?59=oA|s@3KY;#eI}V_j2giL3KmHQ^M;%KU%0Ao-Q2L3a_ZEo9PafutVR) z;zsMNDK1>zEUi37?YE7vNG_-3t?Rm=X)R`;jbuxjLmo?y|w z->(}1GEQ#u&O{@@ibMhzpeN!!6G(9n5GrSXmT}w%I>jtt04lK8E%>JA2oSeiwFw20 z;cpM&vtU&<>F_sJP!qAn?M>=uW+bI?sW`BsYlPMxu|Jrwu$;`2^k8 z5@!vI5imZh=vQyvP#iimH8r&YfxCIo13Jg85gd19$k5H{s|Wp^F4s88a5Y_L-TUuF zK(g%leJV1k|HGKCy=;maGXxJi?w@w~)N7(m2*f$sgweGT13!%f#DU~SmQsSoO4Gch z1WsE5c##?%H8v#Feg@EaV7#rVc=lzfC^Q|F!`sBwb^ia(D*VfaXs!GsBU$keOgkE{ zpK3IY1VIQQMF69iEh`Y_s<;Urla z|6m@*&i>1^4+Q+qKb=C=v-|niD6eZN$~G0@Voct-mjOp523qYgxE=@Q8u#BOw*Jlf z*QKXhqez)oTZsO=p#S#H|J)G&Ts%N@5Pn5$Z+iIyUhL-XZcIuFZO*gI_nGx(4^wdwb?+s(gQG9cI&r%-- zQo-G}7N3IJBN&8Xy5?&4oU7E-wqMVdLtH7qjS)2i!+9%{re$wV``rJJuZ>*Lt9AxR zp0$_ODL$Fh${%11t$=2o9WX<(JexfNGAZ=@{DXsHF#rUb-QnF*Y8==sy>weh&9;7j z!CLC5*B0?CQ$B6R*P{jyI?v-yHt-@vR=yEx3m{)}fZ7sXu4HFn4Y=eh#G8AA+oq-< zYlst{rHLB&i|cvXfPR-G?FGnke*j&wO+IIPpel|t0|0Nxjcto4Ikmr?L*7rX2jp+= zqq4zKV2T|~n_qDi*&00r95yd(rWSvLuF@+#NA0N6+x+O^Pjs%EyCL1O_ZW zy38O@TttA=WEh32g;&5sv`BvM|3SF*hUfp72x+hJ~E?TFV0+v|RKG6b0 z-j00^j+nY|wv&jmLBQu|Pb3gvfx)l&>o;3jq2?p}x5>!pK^jw0jwB{t1=4U}3=EUW z3iPUCz|CJ^Zs)XV#%Uk{ZtUcKK-Io#J(h(ySY{m??S1{gOnMU&Tg=nV$;H(@=&k&B z7Q%mBWR;_H6}IB)N9W_dUyvHZHz|HK@_%>~^pdoHg7x7=={M>Ae$*;d_&6vU;)^X` zl>*paB-oW<#Kklmv9q#_42q}(9hiVr+_h(;qY}YewFEnoIlt2I+ zM1Pg*H{X)|H@&t@^F|9Biy#3ef|M*j+ zGfqu%AJ7@vm{-mQ3rkC3Mc4t$`;K!I6-xYIG5r|`WmKs7%&!wb8YE^wzrb_4;YIC;GdE{lkD=iM}<%qKOl}(*J~eYcx#K$0#*7C5JBtyuq0pM~o*oWa8+JAUid+Wuo;5x*@~VWm%FwQm-$y3|s(0V3E1oB|14k9u0us$UO2feuPfB<#lp$ z27ru}=XU_?Yiv-%P$0wK$2A7X;ynhC&x-A!sb{)uNVE%TP|n%8tZlw3smka(5up0F zx78FtIkfA|w-p*Q+_^Ke{Alw5+10C|&E#6Q{{tfUw@f~z@4LIf>ZuDVB_zf_>PkSj#Ff6=>~#uJ*ms<7FIgLMj{J@& z2!$cBcipDkOH0K_0y(dO{B18O<@_&COhz9*w}~?Xq&5ckwx61`7NpQ z+uNU%+*oMDudxcdVa?8=2clY|j@nr$9}Q<~3dH1EElxLejC~s#5}4Q=9#$=J+NF-W z@9Dp&HO|~~{)%wpk>0>mJD5a zyO2Y^h_=qs=%DQ7&&bTvM`*u>h)aCd$XU^A!vFP!|Lfbnfcp{bcMO+9dI|OgJ@PQ+ z7DY5OK9{3vCul@n^{(d!eLBZyO>5c~xlvhMg&}WM;6y~*) z#aE-H7YvjTPbLEYsl-!~N`OoOs$E?GF5pPi2FdJL6;xD0qvpoA`(j$&j}9*a1?~)r zO8c3Yf(31JKVbn|>>K~o%4HhGb6RM}ftI@GQ~lK`(_+TLLqkKy)b$Gh-HBBU24iey zZ(o$(F=}IIg%q*226XAv1!3OXfdBDv`lF8}g(jF@oGuXcBHUs2k)ZFfSMtNj6`y4L zb`zhU!({PV;D_2j@|^$GRRvJkg`)~L7$GKCwI)kscMFolZoxIZ2N#c=XB}KnNSQKY zvgMKf$cTANw|4Vk8%a*($>b z_uDEz7IEA*8QYoQ_MN$21r~$2ITr5!ujiWD;2Uk@cylhMI2Rg#<>r_zHpfHPorJZ+ z5L!M*hM%`bto1`Qk_CLjc-rm0t*2h68khFjcZstexz4eBveC8Kp$U`EoZ{p_K5bOv zn8Xtk10zHW)WLwfhVd)884b5B;6fbziT2%=555_Lsa(egZuTDFgzo6~KiEd;a;`^l zcXSor1T-RP@RuAw_AlCTzLjjttj^Z+z_btmdu>1)D#^PqqMUDB8KTPj;qEM%Q4(34 zM9PheR1fSMOdAwH=@s!DmNIk8NMs<@dn$+Tm1GM z!XSJ`Yx}!AJ%3ptkZAs1nT-`_Jm%vQyf_w};4$xPWnj(V7$;RZ!=)eXBQFM5NoM*1q<;-x1*uD<0$oiGt$>d^pOr>d1e~??gJ_5Lz zn1}7Z%Pzs`H`L&d6JwmVbfmDZ&EH!3>V$;M93TyN;zwMK)*Fp-cDS~F`_`v1yD&zW zhe0%lE?A_rjRxGBr1piwiSUaS3#w2%w28wSm{3ljXJFXANH@vdDdv3uhUeIY>7;N9 zCM+IC?oDZo78E8aQ)x0miol`M$EM4DAuY3YoM7=;>QV()RF#{dYx z8CI>ct}*T4fxZ#HWK0180NzNLbu036Wdg;N&r$*XAx2PVk`XVo=UDuJO_nWM`9~8F zQ)FwH-rRRbF5E*)-8CQ{JW#rhwMC&h4^{J0wP<*>?z zhl`5~p6gL-5XYUvNa$W`M9xYY6C_0??jsU(ZNbO2#x=)o5Lq8Mo{wX^9XpE!9H)`l z65^l;IOGOVGJ;XrVB#@#7EmXSep9afE9{IZ8IOWfKivB;Ju`B99`(WBM>ZshtBu#W z>nSf2x|FkC;0j+NyCDB}q8;IT7;=ss=Mdi^gJ{hOi^<;0d4;N^)*Xo&4N6r@|a$! zPpQc9(E0YGbXn!MboNgU9X5W_Lsbw3+6$c_GmQjqC%MV%DvOOp3fQu|1eGq+2%2#$ ze0B+ey$u7|PNeLK7lPMr@Sd?#95qepvK5%h^2jp1Y2Kc65)_x28W6>@pQ$_ELnPn~ zPkbK~6X!%8&s9GrJ4p-kIZkR*PvCt*Ypj$^#+l?MC1Nlqgm0lHwEdEe#x&7Y$mBV zrj!olY^lT)zkU_U9$Pz4<74SxUk*`g8s(QSDIWu>O3p;L*|#XA6v$r1 zZTy4G31-Dx0ID>>!@l64RZ+v=iU}1UZ6=efOXZ|5219XK2KoHC#a5qa{C%{SxDb^@ zi!>;0vSyk!ZFbHN`#5$oP}C>TA`}KGyfM$V_$2MfSkyw-CTbGw5w&GVc7)X?H^Cqd z>j#hC|0lgYfa7sZwpG9aIjD=Fq7-*tR2e%|S0M)3!?p>xaK+85SD(xB1Wvv_&Ih`c zh(6RnuDN-HEnFR5aLCwOHMR%@PUgOxr*VdRWO-2WXv%HQ#`f&4{G1g%u}51L7Ccce zOvbc))U@LH)tn*iwEXj?m2+l0b?LJ5$S14PQ_V@DZpCZ|rh$quKFC@v_K{|;X?*q+ za)0Voh|-?^)Z~QeVoLo&1|jjHCpv&RtHaesS8hV6yq#YxDV*}Iz+&}eF9KbjwHBO& zXvt`Sw02>9U4YDYEFemRPEVC8AIn(ko^cRTM#-!R)8fb>E^EY2+%krh9@LI6WALix zo9?8gy19}PBl{v~b;>O)4?>HTh%q(W3x>V9va#yu@H~SW?fMgk3dKZTnd9xRQ}hi8 z%O>?+(ZThH?1D+p9Y=`_^(u^#mKsBOzr0EfbnGR_NSWj4Dhs*rw z>*d-g*I)=YFk-1)`{JGRQvaPkGXd-2d%F2oYhw&vG~Ha>ososL&V{IQQfh*M)zYKv zrPBH8WAC|gUqoaMu_lk@;Ad#X&08c19Nl)`-w&A87dWBo(lZ}zTbgbE0LrdAiS7)q zy21!cJa_FJySz2K^mDa})AID;lJziteTFA5R3DC(aif;M?@@am-Rvp0xbJ;@#2RNb zk?g+gP_@4><2YH(HOkLw&)Hecln||7LzlM^T`b0lpyan8H`$Ql9EH!t2y(w>~nEn-xF)g(tl;xLU=%NtE8^<0N$G-8DMP(XX3j-L1Av? zmaCRyWaSw+5PPg|W8M;?BIEkZsU=&2gmBF;xJ*KyI>?e31KhE zk=S*7m?_9_DHRwL6Q1Fm^A*)RKUc#4;U&ZGUH{c0Sz1m*pI~Z>Tgmtbf`d-T;}0%p zcme+#=6ikYra!NR3Zyepkj~g(KZLF1;h92&Pmwd4Jla^5czGxyC53?D()!jC4?xFF zOFMtD;Nfwn6d`(C7UyF;o@isf)Y@h$;x_kD=*d~Obnf;MZU9VROuDB1!6NABZ~ znwcPbcU)Y*=Ds-7Jh$y&CkIAHGfacbxIGu#HoqzqwjS*V&Cj-=bzr%Je5=U$=6wu> zN$+`BEJL+h+W`-%);ho?sKU<&lHuG#jaSFHga`532&@zu@c{Y~&k#P?@Xp4)i`ul4 z@&nkln*Q7gvz1mLlW5oL$Ap}jfH>oZZWDik0)dHo+n}a@AVmI0WAbXqsTQL8@NDkL>|}Vhlm`% zR7esZcS>+x=^i9{Cu|XIHJn@#QxSP0TC}#ETq;%sS%HI+r=>{ET z{b0$Vss28cET3#FwWe>`DTRxP)@U>G;p;LAt8rtJh|PHJqmW=~e5O~C4-fBiD=Vj1 z7_`2#`;Y2(5n?=TYc+=&IU4K@isnZ>6-sR%fJhKh1<>M@QQRgfkQkToICqe@du^{et8UlV*t(dLsb*V`a4!g^UJ*O|>4~~q95c^( zWy0zqmX~UMuH^xAu&j9R(7e79w3L^XQVFABQBu-Y?uvYqu2+*tlU zaLCjCRB=)ITT|OwY^4|Bwy@99t0lYK=nkb=m{_-8Ed}I-&QFpjK?K`Xx&^2yS+V`C zi#W-c?VIkLPESieCR9Au8tN=@ogmPzaSh-BJ{>LT8(h>d-=-<2r&lX-vJ%mIxEm@y zv9{ev&=w-z5xzR+)>@!{?fNK(blMeaZvAS8ywasyvF@V!5V6GP90v<%$N(E0h#t3+ z?e7i?%)Q#ad6?uj&hn8m3~2~=aIomoTQ7caDdSVHq}w0oK(eteodT-VK^n@jQaza% z)j!J%Lm9fVOdkZ8f;=6%|ORF=Z>5(#p0hKv4u5Kax^eWjS-E zKsmWA*L(C=t4#7Q8vi=~$=RMaCd&eSN^fDg)xquuw-?T@A*AX{mZ{&0v8iS~;R&(? zuG?*#e;mI>aM{d-=EgKIl6oRU}n%O7bvWr&`R&OJvUr(xNhKovu4NB z4(Wr|wzoIVF%O)9u1|_5zj*TK!wrU2sWA|qqLK{Vb+&8JzL5gW%0GCMLqi8QTjtz4 zj;MzW05|~VTCMP~71nZCFVEp3$w2_vnYQ$jg@=b5W#Q5h0Ed)R=r`xpSPj`aL7J+W z;t5VN*@*)vV280vS$j(Cn%Q1$5-I(UD9 z!<#~)tnwWyS-{eS)3jXfp^5 z*$B#}f(m#mtf4^yDFR{`n84nmc@G*+a%yUkx=A^@@Pch+Sy4>aM~0Zg{r$M@EgDi{ zik_(xP;8ghTgS&5djd3tuAftup5=e;yC0m$f@=Ui~^dk4iy}<{c8Fkh4$PtJ^Y-i z13=)icD&hL$Dm~g0JsvHX4`i{_K!jC8=NSbz|@$xF2LR;w*9zbqEL-_`%uc;!zCi? z%SXMze67^lxWY58vs1@E67hRL3bE9mn!lZFZIh#3T79(M*Hr>lI0zyXC>`}&s%lnT zoVI0sp%Mdo`z{JTg_Wkpw$T9ny*A=wG0doKl8oJ2q!TiH?&FD4_&t=T3Z-85m)9dv zvj9|=!7wa+zISvyBI{?Gpo&XNR^TH2-wb12llETql~{H>A~^=M=&-UNk$5r3tx6t? zjm2UT?)kR<=h8OPyYOh3StkYJJ(;445s082BF!NnyV*aex%q5lvPlJM06{R>vH{g<)cvkD+!kn?W*)ad{&Z{|izM_mIQ&^QOELY=r*;#+Fkfx_-Cl1zb0hvOi_<9SP&;=sdt^-x0Wyy)oK-z#Cgq z^uB)M*1TC!C8IYR6b#)h#TH}sHNY33f|287Q9w9q*_>|!%P&cSgI!vZCs%AIYpa}> z`{f==Nx4H<>8_qWi!0H9!f%aIAZ88{dohf^uzzqMbhtM*iS2|ozpB^t1!zo;ZgzAP zF=e-|>)Iq8+IziUvK72>>&K^78yB82RwZR1eBpaP3?FvN^j|wb|CI4oL5_6#adw^T$aiI!_pUto5%h zl$BYH$%E>-i7H{F9wV?cK*y$ES2ws<#%rrJHEzC}?wU_oBEFnLsAfIM=FOE-AaIEM zZnixsS{NqpLsn|VGG8zyNN2n2S7LP1{h1MB-j zODyiFAS$5eul2*5LrRBQ;!;B%V3j2L#}90YNsA+H2b*yC;ziV5bp38v9t8e0SQmK@ zx-^NUL@x7Lslgq~?wXFHjPruxqMSOFg|GFe_+w_KC5Pk?^>uk&hU(`4d0NmNYQFc;T$6LQ1dOM*0V%q9FrQQc zQpy&NN<-kVf&TgW2c>n~GVGsEYhA~`vhqP3zfJrqw(t2?8RL)P`ZJt%D$0xTywGsM zHx;G1-lR@!X7E(l46tI^6!)+9<#AA^&TLXn zXTwE3cjlm;*REYlgKL+X$psRTWw@ay7qSd@f0ZjV+&cGJ?MWRiU^a8rPHt_N3 zJoJOibj7$_$bC1j*Wty)Ncj=P#luy!?_Sl2PwDid%?9suZud$ZZ?|s-D5reYXLTMa z+Ifb4edg?3eI4=quI2L8?k<+uJ_yId;0rA`7AYuTw4gA)j=hV0&T4VrxaWC2XlC{n zc9k=jaL#U)g(UD^4v&F(imb9Bw<2@;6hBQj`c~^&YBQ#&u_NV>iARo!-pGU?P@lYc{wfpS^&$W5^)}WHCt{uGCuO*HNkR8gQfqV%+JvW zNYtyHLTkYEwUDGBUm`|RNPFte=n^M&%vjJ+emUM*nD2&q->w_uhZx*i59<7tt3U2N z*B?eN!`ZpnP5(t?50)RcfTn&aTCnnwe;tx^01d0KMLQzGg|A8Y0n3w8QdOQ7SOSZ{M$-> z|N2`07-RYCFrVj2z>9*x&N##V!eJb@`I-^4dUd2lcOncT(-T2Ml_`m>zHWW4ZuQ-V z@cV^z?D@KUrB5{8M!gk1RE$cVm^ks08S|Mw7B<<;hO}ADGRRwu4T3J8>AO7}7!~}9 z-zSy&TD`u^0H{EvoD@d?9`U57_mQUt4Q2f5TFKW9?r1KnB!JAfmXM+HNEm|U8&eKS z>`u;r9@#gwx-2VMBnx{&wh!83ApWD{)-d5xx7auQ3qq_WJR6N$RZWt)_mUODH|%_4 zb9QhLj|O{uRsy7zNc3p8lCYN}Bg*1a((CKXZU7L!5Rs+9_54Yu6>?{D_Jey#2hmo| ze$$<$&t1pvVeaGENItWvO#M%Xn7%FqPbsgTGCW4Vr%RD4HQ**Hic_<*o#@hfmm0Ei z+pGInJ(rxe@eQ$k!RORBLB9HTAie@pLa!?B`+ro=Rjc3#j-VX;MAijEJm2xIax|5( z`;|NTXY^p2#G}&zwBtN)BmgAbF*ojhao%5il8%_NUjP|U$1~$CONPXDIZ^y*JE62% z#x9+#xplfJMzW(ukYP!}nLeE&U{knHT1(5^35`P0fmMI@;C(==BBI~<`Zb~D{?r({ z<(u0i*BOrktuCm?Isk(fdyF?b$7Vq)YPNY$37>1GF>n1wXeU3!kyIAHcn-z8r>wv{ zl}n+}*DcO|{tETxgAaCx!TMnRKomMSB*tem`b`mY)_(+X9nrOfz^`yY{!mI7~P zW@b=5-nc|hRZ1Dq@xbOCmB}MZ>-Pi!R8P|Bh?|GXEdU~iyw;hDujd>9So%->Ytpoa z9Mx=-(K2Yo?sTUxnpAm8q@s=_us`KkUkJ?ef`lq!Ra8Y2G&{z|*z*W(YtocB9RgMA z7=R~@jb!NButVy{^F69^B11!I{r&x`w96mosj7wC^v0H@s}&kdjC?Tgwge^1=0-D( z0+0%D^7;Q*dkd(l+irVQ2?;4dq#Hy8M7kRUML5>L1>274x9ZDle zmvnR2e*fc~anAXF-}|0>#~ou2$BI7M_*_N1Qwa3TULgpLDgfU_8I;3s9!jc`?-NMA6%4({7sQaL-JcI5vgAJ*9Vt1Gu zp>f}khNS?(v&yS(>hw(7ABRfT|C(;(P*$ID-1%70Ry2!BRtHd7 zy18%*)&^Og+tj&gWL6iLJ}*A#DVq}N>KvhXe59KnmqSu2=((5&1eNazlw9T#TaR7y)^FzE&JC~1sN+3-vcIr%6FwUQ?SQHLKq-V$@UB^YUnOeZ zhw$&;bvIz~;=dGiJBvMCHJd!oClFJ9ua}(%4j{!I-|rH2jr#fiw;P&g;!P!H?p4aFI+6h{(Lc|JiJL^Pk3?zG3tL6e^ame$>4 z*T3a!)<~9XpO5}=UM5|&s!_?p+Zo#XxwGzQl#VDHYloRHQ@SGS(oWv(U-Lu@;SFL2 zw=Cn6z4&-lM#y<{yTJ4)$wG{qfVMw$=|7Lyi!`4=ZBW$)W^Ep2^$*U>87X=M<^ ziZsWYHCv1@8sMC8E!+jlCnFIANgM{5 zV#;wmEc(^s`PvmySYNxMo6e@qKa%G#JN&Hr$gW*}v+|Rkt2yw~UGNxmwe9WgzjO5$ zX47z2>#yGlk${PuYR<*!%w^|$V%Bx@(Rsdd>xtW;q6aY|#|xi;wN4T`W(Mmf|7AT) zD~`tVd^7a$V+7J5q_N^|Bl_fBR?uSMc^p_c5$SyoN{C!7NL^$vlxUn(Y#HT0?< zQHx-%4eIT=07)yiPUTsJ5<7Tg4;~xoyFMT!?3J(G7rl*JJhUyQo}oF^wzDvgAN!}Z zHR0x^&(~+u)s@+~gXeKdgY0=}Ba0R}8g#r8{i=1ryGS5_%*^Ce!1~-<^zxOU#m}6S zq<}dKGOp}GC^sw?J&5$O*Ve@1k49NF`7%=87JhWq+Vk8ACc$xU96wC@Tx!%&Iqj%? z$ve-sG%svJ0hNt_453nTB>BCzI+t@(l`&P?l#(0&G#-%n(vSY2^d;MTRF+qL^h7U= z32y4^(~zBRMK6>U&Hv>rWTH^%wE9Dj+Uw|Q?0tg>ti2&2t-X?&F~o&}*!iBq@$WH{ z#mwD!KHR9KB+q8D)U4e}_B!{&`@UYH?k)`Q=lEEM1Wr7jqmKP<)468}Fd*xB6= zWI8|hHAJ9a_r8HE?8Mx^1xy}?%}K$bkZZIrB@EgKZ#wPMyOKr!sWiS0UOL5x-br%M zG|CEko|Hy5yQ%GcZ~x=>yvePp0H{+{AcuJP73NgBOoRK;9+N9FK&*llxp!4m>kPAV z35ke|Jg?@|=E|Dt!O)LqH;t6QE)y`ghZ#(HK=Nm&~haeJ~xx} zpF90(#oAR+IZVFT8TQOMeQ0}=Y$JFg)x{K!+uSQUul8IR+{Q3gkcaw}II zd2&#k8_AtiCcHPjIYiI+Ne;dt!J;LF5-_aP?d62bJfN(9TL=X zp~!m(B%>+|Z)gf+r1_jC-3m{oD?TO5hN>et^E~_G#YWG62?Tjcgf{nI_m7!-;;qDhy_&^=tk;%*X{MWqke))BzEJ+De5kDGZK^(APn*~7 zKTFJ%qjZOhpnGTO`t7Ru<@B3+p&t0ictrQe$jbhtUd}@7f@(1lQ9?Z?r0k8crl`*f z!rxD8M(w{Piepz^dkKeFds46LYM-Ve%I1HJeu=6*)BUw9rB;X#+6>-U+lohyTN=#v z1Pl6H5i@sBYR!kU!(GoEOE)&_>U&!e2x0v`r|xQ+y`zzXeO^`DGRrZSPbpQrL~q)o5=$uATfS3Y-tsP8Uve!lk7eY1N=Y+-B$ZPO}Q=&zok z09`3b#G>xq$)~k9t}()(fOyP2v5+EIsHdvTHs0Xfz@}Z^jaI#~b#iv+q~iO`#Q}db z^Sj@O1MIJga$&KF6Y;{Y3MPROx@c=8Jke8-4}$S(oReM~D&?pZcPEfLB<1}obN(>I znYI-){&cU7?0n`WWb|U-5emn3J5!vH^O<&&R;?A(EP%+C)um9dD$qdoUq`MxPFHa~ z6(|;?b%XY5>1ve?j{=*C4olZga#H;;U zL6`LatC<@H&BRllc#Fl?^8)`fC;Vr{@!ylD>rHb_1_`a_htY3;9O;y$8+avMJ6Q>Y zW57-{?b;%QSg(!D{bbm?GIor#8rvEq#;v5dTx?LRM>P2d<@beHYW`%(A{`uX1 zjvwbnoe7(2exL1F{xR>o)soS9!ojrrCQrrD5gPDe^j0-I?NtN8r@{^CgvP1nrR;yQ zKllbiXmp^j`EqCJlH1qEUM=4D>P3j`&uM=1C*l+JrZrsG6>6`r7%^S2gb7~}wSNWE z=wi#UdleMs08U{McJ_1(0J0qgbF#|1{Qb4D57WhW-MAV8PhLOcc`N7N1LHn^$6ezo zfU+OO^I4~Rou4G-Jk1y))wucf8oxjAt%3UU|HzESl2yN6l=BR%m$;Ip7I_m3cI2wsHOA_42t49Z|JKv zzIP9L4gx#Tky03?viNJfOFe(Bi{MFG;Y77~neygMQ9N?Zt47uM4!hMGy?mu1*IvE} z3aaruTVBh#_UpG<^5llQ+WsCdb8f1y`!ShDrr1f%1OIuhD9{DOJP8bzbR=7=+SN!_ zKH>MdV4qbQFv|8kJy;YN^mbckb7Ql7n_BHosF5~j4+*_nCArv56gEgDM+(gh`TQTRNUiP z;tg_8`buM`NB;K4lm)r{P>)#Q#|gQ41t@@`B_#!)3ixfq z?8dq|1`xF9p}Tq|I*5GcL1sqAg|EsWFeRuP$$l#BcDTt-?(?8S9}Gv0iS)`{Hnc)P z?tn#}m)_@$D>nFqp$0WuWb=6(aj!N@a~1o~H_D50{5mGA)G>em z<2DY(VF?Y7T}%9<$B%=tRP9HYaYKi`6`$QBXI#45uUwIv;swLBUKNtPGR~TQ9rcfE zoaqg6`=sReU-+2E=;?h3d~5!rFssiR;j&+*WGfT}@{Wa0rmQg|-0^sR+oa{)=ET&( zEJ0#i%wZ!f|1%MmaT2QBYeyE@PrWYKQ%@gApE(c(r1d?mQ_a^Jsoey#c|8UDi+I{X zzC5JU`s+_V*L?b7I9m?xS!h%Ts*;qYHZ{#7LJzBLEakT?3+rxw%-i1jrR8K*bu4^a z7$0|(hR-VIn1Z>+&4uk08poc?L6_1=RbhZ|5+=4xq~(Nx`lRt;`=EY=+Kx_=sd(HPY-ZJ|CPe(Kff7U zUqbrabbZ{`W^?aB%b61uD1>gZU)874|HH1On_2OO`jb z9MgI{JZ50~WI9=eyQ?7l0Cx`w$U;$(k=Rq(g90RQ-rg!GrzVKyFed>Dl$Bn2Bn2AW zD40{!P%TD}%Am%W_9n2vn8C4k^hyqtD(;kvOXd>NqCCMbAiRfYQqNd6)Pt^5C+OH@ z@=G8ZP@5!bIU8w>^Z}W*mU`+y@p{o*xn-{Y^1_`6Z80V~+8q~bc)t5ql^3ElT82#}gi}rx}wq-|J4q1I7o|{Y@ z^Y&Ky`dPQ`>D+O%(ywy(&MDk?2$4HQW)o-&*QBMSil+*$VXj(!MgB7sA3uBm2gI?l zvpeJw+1_glyl8Tln}hdd&UKTbXPV9w!)V-N`GA4qdv>G0;dJ93InH#UzIaVMd)NU_ z*yzN2y)Sbc6*ISR!|wHF0LXUC1uh4N4X!6OZHY=?g`^;My3YOT>tarbFv<1yp=%CB z4iCjm*I&rz7{RB*Q82%DetdK z#OS-ovq?98K<6n+FC{q)EpP<~;B51lPUzaKHp0tunB$Q%WDn0e4((^kXrul2aEps; z%xhW#aX*2*)z2xXcectc3q0%c{-4+Hk~bcKn@0>SrmaW8IIj}!_~3SW?Pri9gKAU3 z7|1`jvn3{W8N2W1S{Le6JwrjcNUq!UDNKEId8n|Q7|^dEC51^4Aip(;CWH3eiuT9R z#HjPgenoZ7L2+f&h_m{buDz_L%hm8yOceS-cl<;GLQLMUD=E@PGh4H*3#O)<-HBD_ zr(R<7J)(}i?!B&=ld-J3ljg|jgC22@17!m&ydBjs%OdzC-E9pl3`y4uzt2`ka)#Hr zoA40Zz%9hpawG#zA&*=8N^Gv~&&+WWv1sT(=ppc^eLy+E-UM%%VM^)!)saX~4aba@ zH@~~0qbY1_p90XX_mRPikY`33LOcU7uM5F*(&mMGoHUd|&9O02QISY~ ziV{MSn=A`j)oM=$l3p`4$Cpe2KIjpPNIx6PvN4mR+E(6>Pri=V#N@8QZdj8}jT+}U zUf)mJepT{5X!4B}Xm$k%vrj{uhOL-LR{4+x0~bwwjqBck9Qs(<95wJp>Xb9zuJt_p zbQ|kHLBAF5<8L^E2ePY#g3^+9`iA{p_qGo?=UYAfl5hN6-OR6;eukD-d1(@M1?%r$ zX!yQ-`GzvLvoQL6&IBS9wH?oYP}I<0C8YhQ7p5$VY=#$ih1pG|tMuYByIKQpOwRn# z$ljxvF(=7 zWBV*G0hi_?&P8Sq6^nt9z?8-?@Ns8e@C%R#6+8TX)L<9zg^i#HWXy8aZ)9x2MFQnG znutr>`H8^o`~+4|uq+V8CJQCC1mSl9@qeU3%$wJ7^BG2w`2an_#OtMvmAa@!qL$ni zafD=+vDZr)q|pZi`&?VpllSN6K*WhNl7IAQknK>_;L~kI*jBX26cs}{CLXg#PwU{M zmC6skX}WrD(gBk_s{(l*eA2~!MiVwjtyBoL=t~ww&>g1hR5`?1@9gd(CGC9Y$CYQRa>QS&O!0T%i=s46h;XY1Bn*^cZT%Q^YN)c z#@~27Ew6wXQdqn5UgU7nF>@_=%53PpjDh3u9+dt|QhzZSU4r_#Z+62s~0=fNfvh(sH zU2D+sMb!ZaxUnbkH8AKQT`d=3p5#RtXbdfeGC$ggLp+THLP?~CICvioxV^1}-uGFd zULE27(Fkh^%ta^8T{Vqd^^_W;Moi}?$;hFsei6s9Fp|YNyF@+vW*#5GhvGqZ;1`2y zy@%5LDBnlo29AAw_S3XL`myJI#01~zD)e4Zm>3(&1A3qr+3a8?-7YUG3+@k}=Sk%5wBMj5ygg5FKB zv^F`ZBO4NA)U;fSYe4HT4A`EzR!f7uQmfZI%eJfEE`N++(?Mf-kTLEAN;27|fvI*) z#h>r)+e05<23w~}_cX+FO4Ls2yH`4Op8&t1_MFJoTSr#>LdvrOQ{~q2&<*s8mMywt z67^ux5fKuiIf$%_3lzX0j6JMoE~d>3&muW|87-owW~*M?5y$j;*?~&wcR`Hnz239v zHGFL-7Hnw2ZbeQj&!+lrm*IxUbyFa2FNRoBz4hnZ>h69l+xl)ph3CFf+IhLTZdyYV z@e+F46LEhE9`i3&Bp#y%mrweH2^>f}Zqhvr2pe2>D>A?It-XCm2=77>d07}|W3Mn) z0ug#gXTb2|4TcA=KObv9CVM*aC)Trzy+R&1sUluMgds1gT{c#^eNVyaDZM>e4p>S@ z4x=`+H8tYrE6SZ^1yeev6Z1735A0EV#Y}_i@ma+Nw_Ss1-Zh-b*z+nRnZyL73;dO#3nsi z87`V=7?q@58gZDSfqf{KNvAos4J~m%cU!#A*|k*Bw8oZH4KP!9l1ko&_3+j$`8Q$L z=>_tA+Owf<|BPeaRHSi@C1SwE|4t4(x;R2n5s6UGOrT}GPq2m<^j_zoB_=EZ2m`fk zO6y&AEE=?DZocP4h$r8!p~V5Fc&{iFtcA3{Nj%43xy9&Vii*H#)fKS$5a?DbF&v$g zbZ@qhSv4TLF}NR}{%PGV?n&S_Henky>$j-h@9@in{t(l!!)p=5Ga4kClx%%dW${M5 zPj~qetX+^if&7#^CSmdW>pxXuD{2I!rtk>#%57)#)CzQR+DG>ye6ddkjmZm4-}KWWG%|`1;&!NPEi*A2Xmy4rsNZ0rZetu-qE|v&qhhJr9%Z0CyW4f{ z_+&~=AV}g~P~R($(G~O%RV(+yT|c#RKpV`7NuqddCN-+=`M&5E1>Gz;>h)F0(VSNw z{XMT6(j}}VU?(_k|4dZhb*_D%(RpFH=QB|A! za!QbscUZH^(owGgpb|Tw-e)Z;s)(_*sS@Gor(w)EnMT(lHspix#m}A`&*4q(-v7s_ zkD~lVF*l|WpI(CD$LGvT|Iw@Dgb>Cd|2N!_?-QD@sQ1fHYi(=0%;f#i*7fHf5B*Vy zgk+N{_PIw8{~ovWXgUeOJzOwpPyG5!gFX;MQmaDVEMhGzEG%PB(%xAcNDIpG%=I|l zd4F`(umF;NG-)H?-oL>+hQDkp+MJReJ52r(H&0^6Qsas9Nwc1X+UgDArT*At8YCd#VN0&fW>{wXIFtQ)aBI>4_Gm4&LVWIMZ{M!e4X25? zN15h!^(S_S3b(H-lEBVoIm!ljUku{*54m$n1@Psg~_A{ybkZojarXb#e#67K*5 zNS<7ynPz+3j-;ov+|Sn%^2&Wni9N{@D~7AHQGHouJ_(qX8bTcuf^`lK5?>M+x`TT> z*}`xrI(F>DYK|A8QW4@BUV8zZ|!K1fYfNgjYRIJ{x{Ul&9Bw zIkm2avx%hz`;DPJaHFq5*WM$Z;hb}`XbUC_Jk*q(5IC=>$^N-=)|A9S z8cJ5Tw)Dcx;+4k{XAt-U$RQm$lMXkUjotsb+Wg0I^uK&TA(l>^7VSy-?ZTmA0|A2e z?(WaP%{5m-_oHq%0!d_Mm0lqMzO*z-z=4)MnDO{ZF!w)AkwTy1loB#gTU2+V4m(+q zRa1+az8j@Yi?qF+8V?iEydf)f3&S^Ft+h4aurLUG%I*?AD*1&pr+5e*MA;MKDA=DF z8&RKwOB?Q!punM&aQ}i>1+$qpU=Z6%985G4w6W|gM!rUx5{dA51G?Yie8JY;+ZzS3 z_N5D!FUcZqRa9hS`SMIdgALJJB2lbe+7~({rXOuWl0@C(qKc2^mDLsM z?FW>B5PC;7+N1h$k>SEoa1eB8k)j({0~vCr-$IlWDMr5aXt14 zcoclyP`xVpSvx>}UDo?xJyorGgDH2vOwU#Ei|iW{WJDuKK=YteXsNp*bB42vw%D7< zigZytTUBpB`g}=*o6RFI=tZ}wqQnhP_EwO@6xV~FX2ia<0Ucn3|ICX3bqp2=w}dLc z5cWL#gK+2*J#4SEpGUd9i%N7xD#a*wpPJkE)`{kMeN)FdhIljHGt0nJixmF zuaUu}6Lp9*v=haU)fRCrmQKd!b>pz;9@>-5eZO;2v@qy%>^x%NkPu;pi@Zsy#h~XF zeV6`J3A2(mcLE%hCFI9oU~JL<#W&znjDqDwo!dSkCT`C)G5KdIDkcM|vek;V8;k^hyp3gQa+ANV7Do5bipG*V|tT!f*^Z8C=u!ls-#$ zzBO`!e)qx1SvB6NuNvAjt1rCNwq3Lci-FWP>OIglv$>&Yw?7g=?`_d=aBx5?t^*oV z2Y9rkgWTv>kKna)$>N|s_k2&xD!SZKdVl9+)B@N0w!#LCw_1<8wZpN?=YdfrvsE&* z9z*9ddOf%hBCcC5ZkN3WIHNyQzlC}4hl^VZKZhRC@(m+FXayi#x#2^%4VgVu2l zS#Z|S?CJt#>nafYLdJ(sva1+3k8%gPT*v$j2kI^e@%Or9?6$t{*M;i~Rs48YaX50T z2J2+C$*KGG$sg3L7r!oUr5-}-C=b+fw3(*aX^a^r$z^Yl2nl+fRXQ{jx$VFFJ(5%Z zap!S@z|&(oG7pTd{}N^Xber}t+s?@Tx*!kH21|Nn2Aw|i z@D|zsHrzT6{HLCbwipX(z9!YsK8;>#=Djk=q-am{a^ApHq~DsEHs~urArd@7_Nyim{DKedW>)Q|EhtKB_*!V>^QlyhUBUAyX&DF65|(%1R!#HbQ= z*0_|;7veeky_Wig{8_vR3{lSXBoD<8Od$qrKVIR{h~?>Uyk@Xgb(9uKArUCpuoB)b zW+3Y9>SFyIULATP;zgQcp}Xhd;g1jk(#yRe<;`5Sx-lX=P`y8=l`1C+^91{6)lXLo zx`G3|YHxp&PO^T8#8te}GL;fnUz=5CHJROSAw#K*qT#nmD3(Y)YedDzOg|032^6{r z7!ECW<}kdI9jJ0+jk*`dKzWI`z=`@Ui6hN+rXIxtaBYb#F^rkHxoQ0Cn`1$^6q%S8 zNE2$6%*TIzZ-1T)YlYuna_RgV>c2h{|9EKr-51y~Ux^Mn%w#>Z@}S{Eqa7Lg0A_ou z`Nhv|80|Z|yGuWJjYZO7`?dCm3}YA#6Mg=@v~=o*eIs07xf5-UNX7=7_-Wtn+}{3D zuDAS-ZGScQ_iId@t(dCUe^Rx2_E=lh!`_W!d6=*EF!!I5E~shw?vk`>xu9}Mi@J`& zw7_YILLd+DxlSlK78R9yyqW#N8 z?d8j_za81?m3>Hek!I3h9&u_M{PLMRYR?5`z<6Nc|EbUaH-8>rrkg$3+`W(Wk#)i! zG5U|+Vjz2^o)P=J`Q;}e?pS2jzwNh|VbBs7x0ZKnG)F~Fy*wf*$%a=~eyjo9EG5vs zf0L6?E)C3s{6X;cJ82u*9-4exz6|Zhq3dZIsbde=$B5ANsvKnV33&>kj@H?#O$4FR zv4Oj2HrThs<^|C3}MSNCANadmbRO)8 zFnFn**cBJ>?>s5Wuf1uDjRxQ3xDfQ)p^x#wivRz6e%A zZmMt|q7-&{{3>z448IV|smLB38LN*XucRv|$wBbQfFPliWg^Cpg7m@@*=|Gy+mKro zymP1J;1j*mN~9dHjz;5sW-9 zcE$(Ou1i#MUU#k>%D3~wK;Ln;HXB{@45SZr<{h{H@%>jKH2*}nVO$;7S;n#SqCwl(47)RREXLn?%P}7&-6;fjLB>=B8rGz|tTj0wFIk*Klu!&j3)CPnn$TeNpu|j^`oRcj>zBbTI#p(zdxF zf7#OpqOc4Y0U;eCOB5fEPzX6?Bh863SKU-BfQmWIV?^=4dJg|CR{q}~|0a8-PcXVD z()VLa$dv`&*X_?)w_jv`dI}&5a*c)QBYBt3&scR+MDt?Mj?Otio$niF2D7KQUE>rp z6w^0$*<)by0-ap{W9%CfQ1>x&a&iuWoX7XcAeLmLsTrLXCMUV{XU8vYl*wYATH!|~ zCMGNh=leTNt`zel*bF(5YQX4cNSOg!L*DpR&m@V(rG*Pq#`i;%F`?K^m`k3A{qwVW z95FM(bnDqqQlum@HJ&`7C0P54;FYmM3VQ%8tAbFV+-4jd9X{LNu~u|f_3LX<@48() zF|$OR_8Y)S*P_n|zw>DfjmfU)FNoLgeIu;;p`^ht-~emImDhT=d2VmRgdOxpatk5C zoA(PyZ(Dlr=jyYh9)g8vSj|l$>gTSTWET1{aaRO9#qvpx>J13Ys3lJmSnD~b0g}^bD zlh8*CJ>U5;T@bX)J$PV979d_|-Gp9>#E za8u0_hNIP~|4OfFvEphlP#5il?0h{+UVJt%Y8(M7t zix9emW%WpS&f}RWBj8HDw9H}DO;Qc50$bi1!tMO5L2`egx__Z!|2l-vqWgl)J@$F+ z?5$D7y#AD&=-Rj}tT3WFmfZ-H>@x6Pb0KNiX(G-wK(0udr{Q@W8E&c?edT|{-wFoI6 zH!tDq<#*o_l4_GQ6t=iCq~2hM;9W&{-4B=+*b_i&iIMiiIX*t_G}{HzIkBsLcAp$o z!+^cD(|LM%#SZq*>jn0CZ7`;Djz5~8OnWu`6yy7UeR7YJM1KCcIyapU+nGX^aGj*u zvojyZ{<0^9afhl*Mde~ZsR#pu^x)8t2>_7Aj!R0R8;RN5;AE`}T4c1t!8z)Vj*h=J z0ZhN1#|0}3?9P>6C!70Y`q8lZr1=k-uKq2x;%zx#x4#*`$muj{qc)o~J31w$<~9x9 z@uxTnM`vbWXa6WA&g}dDa}(`@g`&=~$1TZ{`ju34RvSD#W_<|qPd>D8%yQ0`5&tYS-R|KHcnyEgXPl?YAykP@Q4)`BS`Tdb}Rv`MY-3hSO zlX6z$ggH{Jr6=BfD$02oukMBNq|AT~_F3J-=IRD;&hLU^u0^R=(Fq>q9|_Zi_tM(!{p5xq*?^U9CVS8ju4F|?DgJ0{ zYoqt#A93GOteZM41ZE#;$Irj<1Yj;djNSfLz=13@;w<*tQZ#?cy?K4)xUH^H^`Ic7B?<5NqHP^>OU)`c0IxtgN(@sHy(G;Jvp1&@?r)^>P0`!8UV)8 zkk>0>y7B!XhlQmX8IPVWFU3AH9_c4qPZWOD%S^k+Xra`Vl!xa9cY_O3KoM&% z(&U~8+Fhu_?wy|=RtVvYR!DvUofy(HjtrPd$N{0DS#tBmm8yBD@2rB~DxN>Q5+N+# zz{SO7_3ApOF;FOt`@cvIR@xg)949EfFq?64W7|CLjON(VORs&Ub4jbEAqIQ`6(%?#<&v`+y@s%u6X* zEPpK0#uXY1r!n+-Y&{~hd9}G1IEeHguLK-}0f39gI4~MNzX%r=78ArE@*99fRKFo5 zMFT%Y2)fd*aFwyqy2A-GboBE89M0bXaQ$te7iJ5N!rnOyLOPLqH!3&nLm@96(ra(Q zY8~5L&pSMeobwI&0q!5JqFxgir>jSZx$dN=3C0Hh6Taeu)=l`MbY!~0mU{w!4Owse z?_Ovm$b5vwP9bOa=X%!wsi+UkB24VHW>cB5c_QeK${8U0t^2No)X!s@CkvK2(&%stYGH4&Q%3Db8wg)#c zbl@<}dGWB3l!_{Uoq3fLhm85cWo8tdEw2mNJy_aM%h$qUB&rXIi6QN|H+h^BnQ$v2 zQPA;$B2~Y7JIy|d!$bK6(&-!ReSh6a?U%tY^&UE}93@iJdbBy;`2fMIAs~ohD?{Rj zV*bJch~N&23q~@2yX7OZyuPZ2dCJHm-Fw4_c51~O5K5=D(Vmr3gG3IXDnJ2&e%z&h zK@X98zeC4<#$(3w@R;${x7%;7T+D}xM*&}@1IQKULfuG9UuutS$=}uLg+^I#ydE5i zx*1`PI8bw6{B#fqyseb5Y;G2WPZI@!LOAYI$3MoeZX)xcyASv>WP3w>W0_mx{)**# zP%WY(8s_lOMq1k|Ou0K@^rkhGk6q;_lt-5@893lut=$ zoi@oy#K6k1M#Kb_#aY;T^n#oj`}bzIZnP z#~s-t%n8_w08GOIt%Db+oB8r+x>-LKAig!gTy!XW4rp<*dkdXOLXB0wp^jzx3htPX zV2J+cGlt65LM%TEOFK4X?2qlcpqw_09^iZ-H zTkA=LAl3Brl7J}QBE#Q47I%J(%WO3Vui%ft4=zt)C;JLU>8(pQ^<#ieH}R zK($ypAY)?zns6uPMgFZa_a3Vw{MhH={U3-H9J` zUr2xP_iywJn1m}bGiU^O#i#&NmiLX9#w&=U??OWn$zr%3dTS5aKN?qyQGNcnK=93G zqFj+5HRLza{n){wIN-yJ3Wy@ryP_bT*%ZoUrTx0k2V}KW*PhSu@oUzdK4tT~l8yZ( zMo>ay(%pC6F-Dk;Lo8o`er4X3fr+jafn3a$o{@pINtS@OumO^gAq#1GntBd5Xv9rm z?Hw|eYnGaaTm3Bl9$o}H^R$pIGmvv`VdnK*OOI2!<~2({=!Xcltq|~%xORF7coEgw zGCbFi--h)6aFO7NeS37}Sp#2w_ocXK?y+X_U!z1{iS({BLUOs$P~B@SVhGNE8)78{ zZnSsTEy{LupMDP=EP;)UJhHuS(C8x?ft1d&_o1EL_WlZl-5hZ3O8_~D412q8f`_@f zGG9Olof?)5>AOjYuo)sexDTdVfyh^9(Z=URe}(S3l$2lb3-KekhQuAoYKH_0Bfx5~ zB<@0ad<5D=6xirFcn6={4!?|m3E0axe|&PMAyB9xyGzn~;DYh9fi zgPJA-?3%Q4*`px=b~;e#^ZIgHv) z6evs_=0Eb^9lJLj-090d;(Fohj@IwQ+2=_10v{d~uH%79Ub zbtW0>3GbB*w(s7alV-g~)%*|@r(wWrciYXQ7g9V1KnMF>grNQeO^=WmD&{)9>T*_d z9&#K6XpN?wemPM30lEkSkAyqk?u0C_l%nQul~Zl_{BsP(!3wTted@IqG0ypa;&pShgqx|?kx~fv-`;MT z8$Ru}_H8#=?(V46NC~1Cig%trzw5!|+fV-l`cLe0Da%jCW~Jb75|NjeN0=z-Fba=@ z@b~mBBp;xJWkJOEJpg2vIhYoT&>mT1p+fONm2FX^{{fA*08FUAAouIVu_tXi`P za+AFhAyC(N%zC?RnjpCqk*oE{oo+|d>3I|jhAMju;GT5wRyDh1j<88mJqrUu$Hhbb>U%Hp1N zVh8Mnh0G;g+oF?EC&>zkth}`2vcu0}ws}>Y{G#W(QQIr+HZa1rb^HG3``_n4@lhmnodRUB43GLurg?z1)rM)|xbhlnBUg>-Pz;!AP zwp-Q96(mkW2%Ii#6uK+XPD@O2{wa6k@?uTzYw`2>O4}1 z$O#R~hAdVJVSB#@a&jk%^`)z19aVe1)}~8-K}{cb;(O*lxVbs{Kff1-UnI?g`7S{X z$=%HT;qVh`PqvCb&Zud9oS3{GELu8sZe{f7191#(=<$x(Z>H@r1XGfp_pVd=AA8u8 z()_&fC&vmZ>ei5S9%v60RoC|;)=Y_-d+ng$4Hz0-(1Dw9_VCJ>d#+l(Lv0seZsQRf z!eUK)55xm8x$@qcZQ!X+V3Hu(yeP>oiZqe{5vY zp_RrXi=uIHVdj6IdNJ8iOijF2^Jw>_DFQ`Ng79dj}Fn$Xq3(e_)|F%m*zpyPsvI+_YrFMH{WF(U*0_&%5 z(q|l3(25%dw9E?y8$lmMy>?uKvS`H^ce;|5ya1*dA^2<1e{>!zbJ#e{)Np2U;+r<@n=Bl4kQv1#O?!!W~dg9j8Bf}Fdn?XnoVl4$U#n~ zUN94*)$PXo>3JXkoAA=!?QdpKZUp>qBCky9Fur3O*GU10QFR_7Yoa*`+9sybnj&}W zcQQq~jJ<-C2b#UU|Mt9~$X;=%@2<^{s*$63bk1hPIyyV=?Qxf3)3g1zseoGEWOw}5 z(giI?!wz%CYCoO-LTpxY*zoXZvC)!^>ud^wNnE_x`=|}4MLrL;PbpSDL14-1@fRpz zPz0Zwnwq|QPtYzw`W#L?;ac}C?;@Q(WP>-Htu}&$Fwa40+YgqnpqmK9DdV(L+X@uRN6ktTB5Gu>UZ{%?Z7e`E_`w41*Ak4owP ze30=?p>nZO0J!V~?c^|9#for6(~MD+TmRtKNLhfRglYSKe9ynE61mZ6cUyj0ORPr6 z)~NnURjE~Ma?v9^I$4W-)aC8Dqb|D;#Q$o>x#nzUOD|0JLv%;AGsQw6MYVfuVo!6F zPnWYvpFDB7u|N@QU|fA6fjPz+;gh#*>hwQ(!O3k09 zPO3;k3Bi*q@p-{og0$4QgU~jwI>CyxrBtq>sWgZ zA4D*{W$#%Wc-$+ci1J{G>3&e&aC{@D$6~PK<+sKaN0P;W-K?m7{Iy#U1pvJwdAnHq z4$2fmF7X8keT{E4Gxi9oYKxDI4g{@ICnK4P6jKLotlvaO3-t>tgl2!kf9aXAshd&2 zwiR?!4lqSwHRKXT4P<Ph;Ne z>gWiEy>WWia7byxIOB2O>H_#?P+o0NcUv)TxifCGK$jJSC`iDeh0=}Hz6W!~Y@m^s z_!cG7E{L%G@f3pwfM9>6~$YTaqJu1wKF7awn)+Vc9ED==VAW z9mG%NXN;%?Yj8C$LjQco3yBeT?LIP9Sz25aiqlxrYZ}0d`A3|kk-?Ym-oR95DG~MB zn@8xXKlmYRnY6E-J|PoF{1v`X%D#y5st6-hco z_Okj&1+_kSb0S?!qYb2OqLdQHNpdgyygl!oa+NHUsb9d>tBX`B0HQP4oWax}y@vAY zp8^-EbcLmmf~Di0DoWalc%co7l?}ql{jHgbZ_0ab#4Ounx=I>6i@%+HRd72vp|Dku zl=Q7V8{9<>Fioa>*ZuF2G{4lWH;hDj?8oujX3Foq91Ui%`XD}w7I)lZ^|Mw`u~^so znTobTR>($%Zq0M1v3k$gojzqmO)VNlq{~+QY0C4w=TA2&y>fNDJ=YAYN~d)k_UqjH z^eiST!%J;Eb&Kw{1mdX$c!Amb$juW2yid&D>_GmCI67(r^9|;eRjs?v?{5X%8Ks*E zxapf)FmT~u{ARdcP(z={=Sv2l&klR$9hdgke5XMUZQLG47bRm6w&`&=^$NKYwr38} z+A0rS0ngY9F&Llf((c)Z0*$Lm>C4#lQEezTXHSnM09kV3fkMmO5Z%=>zD;O*9!}6BDiP7%D0% zI&T&HI0fqaonMhaF}cO6K9dKoL4tU&)gb4Vt4AGBSzy<;_95whOrtXKw&3Taq=I9? zH*^wr`Hk9eEWqrVK81JOyDTtx16uu;y2sh$neaRQVqFOs58}|@7mFWYHjanVoV8Yx zn;Q>w4hTzK@feG(KA|7bwmE+SzPyEt`_Z-ml$`IKHpW$tAHRG5elRacO2>OnBnH3% zZNw^eLf5lr&x}C~8>iTCexSYbvn0zTb`>&Kq>&DHPVP6jNO4@^!}z0?D0Nle5|Bx` zIlOW3Mq$N&cmaS?MnPUPF=hz}x0Wm1Gw;Oq9VA}oGf$0J&gaxZ3XEc`OWKLmg*O?! zM3sG{Wyv-BTK!@3KFKCVBIYE~{^r!gyXTpX5)QQ>ycpW=d0xtmLCu|n~^E99df*ZPI=R1pdB+5VRO1_s&^yI|_@OuX|0 z+Oz8;^1-=;U!|8S|E7?Y3X?FMR_o}Vx@$kclKH^9_4j+NZ?nuR{hKF*`=ChRh}R*k zjn?<5f3kd7s4O0BpX`}4oUdCGRqS;VtT|X{%W*su&k^08qWYvp$vUGi!AS6XfR{pa z!IRE`#ro3+kMe)SJ=z722(Go7En=+XySx5ZZ1>JXZ)O%g&xy#>s#B|v6Oz8TsCbp3 z`sljJlx%d?d`?y}NjG{*@Nw5=CrQEY;~7!*iYY#sUj52D+B(g3lanGDy$4jn#DyJ= z^u>}UZ+g9Hh0j(HTRdZn)jH2GUv|1s_f|ERP%xgM>1kP)b^iMG>!x7DXf+@p3a~Kpu>uC&761Eh=iE_1Jf^zv zQR|c>9ZYF^RRfewWo(X~1ZgArb`*yc!q2l$C?Bg zIXRz(XID8kx~{=8;b?%_m*0PRU*1%|4aReVCogK_W*{%_7;X}-@`M>KS_r&Xa z?nlyx`Umt49p5tSq7rr?eMI}s+rJ{q2ZuOSwf$)sN-9?Sbr8PIKdr>{B`g1sM5)H= z{iPEKKlxTf@~6RupujAMe^d589Vah1Jq2lg1%(z1p|}-|@>M~O%0LGs5-Vs*r)D1t zbfu;xM_4P2mU>g!cm4%<8qpP9W;^<>6Yh!ty;bY^IyH zudT}gc|$PeP@tP}@X!LIX1~6K7w#^vKm?C1i|~1@WJHUM7ClP=W9Cl$YZ?|t6`R1lThF{R zKz$gF^IvY{zvs{v@Hn3(*HGMaBuROa&oV_u~*oV;?b{UU`t4UKmRkn<{d?&^Q;lH6-Y}t5xktIE!SZ9#2|a^ z_3E$%479!un*J<~d}B>FTVpZ%vGa5!cZ{VFY>ZU&LVr_6&xo8S>>LW)Hl*xnW_hd3~baRZz5M->TaUgl(Ftc*ZoJ2<G$D3@RrorfGivhE9Y2^nq@Bm zRev21wxYaszNGkUVm*Nl~f ztL*X@os7-QFl3gqoIN*MCuwoCyJ3Y4xl^ zRNNvustT3Qng2?%L3sKXR!cjHm2KD%>!7%ek)yxUXV_qH$h@XRV<@5;lGS;!_*crl z{xjLq;NRl)e~n7t8ZTN$R+=weHVlO`jComQfSKg`Zv4DIY?lfgV$810%2+a<{|{$x z9aiPGwGRt|B8VUoB1l>^f(S^1NOw0#DJdY`D55k-h@yZ>cQ*?$=uo;rQd+teeB*KN z-+s?Id&~Qs_qzN;K^AMxXU;LlxW_&2+w7gesD5CP&0+=qxBAQ7d=4NcsDo0vR6m5E_?c0I8==`XaOFtk!QNq|06L9yWEU$ISejvSJ zwP4f0!RFyoS4{`sF|EkRL$!1zizuU@efq|iU0(rwQTb!&>eVcbc*wE}U z%~`-S(_L5c1W38qStZfXtF7h5#yml97rR$8wrt!1sp z+w;@C*9c6!xJNw-=?b|r$Qb7z$bTwVUDg!e0nj4~+o5jfLXw7o){ot=xOUrO8yW*z zhAL=DM|(ERIBT$PE%le#y_=%Xn2vh<`1(R^bTAJ_dO1}}MwenkWS4Xt< zO?y32!P{Tj7@C+adH%X{pFYIo{Ib0M)Uf``gdcWN)4`Jw@5KPZSE*lcAA7qc1){q) z!grI+r)BbR4pcFcZV4V;xL!LaDQorJey2<0lRL_DGmPWmY-{Ae^ewm!Es~fC)?Tf4 z-*DZkMn%7{0OsP<=!Bqh6AU3`;h>?;PsTytv>D2Z8ueH^2KJ~``$hNCiHV7?dFSd? z>c714%y~mkA-&LZ@61%ORe3?+wu0;0n)mk$+{%x=;^Ov5lBgehFIVkp>`W#cI_;!{ z${ZeeVvE+fInEPXn{7MSw^eiXq7FwiW1nXfPFE-#?8LRat`sK!XdEW^UMm$EUrm~U zIa!csKU^9Tfk9oBq8Hu)48F?Ax1oLB88Y8h^!DxB$&^<%AP^GMkfYb@#nPNU)bJcs zSRvJogp$?$HEf@p)mHA&7d8Y*r%iYeJk?4iS6`s_Szh7%?J{MDYV~m#BPt5SYo<9} z$N%#f_eXA!sAsw=_T;qECN^gQ{ldvNw-uJ?{VAL0#Af?8p%G`V$DU=ckh(|3aT6eG zNa&(rTC+U3b$ar?ncJh=Sl>Ux*W%Kb@d9l zDW=>$EzDH+uk9gX&_6EFh4W{^eBpu^9vN#CaCddYd{2}2I`dGy#*L@9dsGgnW2!P~ zvr4Ir9y#b785*n*e{ho7sX;m4^(cDxA z$9<{a!d#}cv&(FsQFst7Z38<}{ zG+T?M+Tg3e>UBAf{LkP0F?=Gd8$!(4jj5d))hxKVYsuDNFmhPQtW}|_#h&P7tupoO zDpf>OOl$Pd@tr&v)ZeTSC| z1Fu+Pd%qIX9W`<&)WEQPMDtulEtGCLejbR>P0K8xj=TfHl>vnO#FnQqXoN}6?^ zJu#PmV{$^dFva}vX^(C={VnZ5aqOh=ZMG|ns~^GmM6cJiqrx#TMGQ|_6c;VbvrnI) zO6>17j*44sCoHJeXC=Q##b{9Yg?G>#22LK%c6``;v_n`W+`tJ+j-Agxi_PC5IES?0 z&-z+JJN}{kyTJ1XaUARB7p~jiy*TL_z6-+@GWHG*uO-tbuYo8GonVGuWr+swV9|Yg zXgH7*?wz}>3iXaXc~GWnH#NmGIs+dcJD9DE`5dCX4@1**eWB`YoZ7B|F+1OflBer; zQeek7xwbW~-CQk&QTu@s7T2Wg&BY%iGoHGS#mtPjb1Ii^`RcN(Vy@KyZ=cwR`7yV= z1d#KS-M5x7lMHyCaMuT)J=s7L!5M}5wgNa#&A@~t-U%i5&EDGwM1~=Jc}H~n>BQOI zAS55ApV4<*=u4$V<=eB6Wc6ar#cxahYE(!Xe*g3=RDlV~%JPGU{Q0eqYbu_+07pmu z_3%x$!am9Zvo&w@yur&UdE#3vwY<8sa zJOB#P-SXF|Cy+Aiv;4}7pR(QKp)@Z(0`)t$Gx7cxK4(+ zu%k*FB&VyD!3>{6-&}kgo88K#;_s=B?G?U7OEWAcJUR1ln=ZA}*hCO1%JQUzN!GNi zXY{?18{)IxN`TwPB?YHk{q35xv0U%4ThcpKmnEWltF_Fr>V!@l)kb|x;rm8zsfa&0 z)4urjD^BzF=xdhI-$VuX)|UexKxAqyxc5_8tJLcq|H_#0>arbmc{~+M@?nT)RPyZ! zI&38+CF$4XoaRz)Zcp~tJBjYUiGPo?2~zbm)Smn4Sz6Wdp=I$3PjmG6$VvbvR^MEZ ziY*;=lWWqrW}vCR9`+??Cavo{Ph!IQk6{({9PRm4*7uED4&LGApgV4%ad2Pdsx<6| zu8fzt)Q4z+R{QKa*EQ0H%4M`%1ln`ExAgMBW$vyZ7;L(q)5NX)zeL2)tXxrrQDdSy>e>K49s<9t3ld+&a4&TF7nxpe9l;+yCImJtaxFaw=n ztF$;S?fTmK19KPwdJjZ5FvcLtO};@`fPbF7)=@dMg6| zA|5;aQRjG&gT~kE->WWCP%r_UcP@Tw;WnUy*mON0Y%w79u1HQwN-6Xt4o6kAt?22e zJO0|jk|%ypZDv9-!=!vu^7H~0=(tea-P1h#rvC@0qP1Pi5HJ~=X3)>hjf@rv7X|4i zo#!Dd25Pewki@Qmlua~17a!9NsimZ)m2*6+qB}1*DVkhG+&>b|JD7uMp#?ji!gMk=U}wM)Bd83bK*Ahrg+PX>tf|8AJGB1#&EBN z%G7pU7aMu9EV6J1AZ(=V4Q#`xy(fSHNx@(ju^n%YH3%76mEsL=mIXL#&pHFx>AKOa zF$LFj7aE&t7{gT)<0haY8;Z@9-3b5J89%7#`*jtpCtnhrLdgyCF2YnLoyvwfN7{Aq zR=V{^aLQ`Y*N+4bepO8#r-a9PuUyuS(&!yE`$&x`l%1bAI@?E_t;US-M|{KSk6|R_ zijwTpq8RZh-42VXA6mY-z|^W@Ip>rOnHTP_%qxfu%lny~T9?fq(dBoS%M&bUJYCAU z6KFEcd-zfL&cz9G_fONUI#Zj2Pe|1TpeUhhWn$jm2@7H!6~EtGxSwvV+lJe_T8pNi z8ck3LhkVF($LNDXU`Km($jBa*Kn2cYujf}39C_tK8#`#Znbclg=86VJZsRIRrpckN zm3V0H+nwTNA0>=$!dXG-^1hR2BKei=H1@pL|Q^M{7?*&byJNOi{T~+GAyvAPQ^Ln7P zRbthjG0AS#5^W@MZ19yRDz7gJC5u@X1NqjW^4N-ji{=G9s*+E~_tbB*fWmj+103aR z23VI=!ks~3PY%S@?_Yb?)ZWg`^%#&u#?=f^M`I+2n83Kt=}W-P?~@Q8zhLK{m~&A{ z6UcNery1VP`M`nIi?;UhG=k3gU8g||;@iQ5@}e|Y4DsiDt%o3?5~o2Vox=7y<2ZY~ z$>polR?Vt-oVP`>%*?e-)VbIe76bm^;z^Ps75RABPEMOpal*|R2I?1apk{e^n|*V|bP2Ks}KZ8iq53xzlLtkJSk%ONi*$fU}ujF~A^H_sizT{7`#E_dV>CTwY;ZE3u*poc` zUe6Eb!<)vvj6e@7lwi5t`=GGuV0XT0>s08~Ltfg)qqFrIzU_8=zVmUAzBWR~=JfIu zt;k15T9a1!(RR_=#h}{auYAi@^r%Dh^2N$0_0`0eeEa+RLkY-(D;?*}_}Ie8jUU5- z^w^qxIL22LCb%nkuo57|Q<6{-_A`LmD;)T1m1KinqouY6gF;P4?u4?xOT_;Ax}xN< zZvuQtCDfi8ZzJz`+FrSO+s!rS^44~-2B)=$(pBRb;@FO5HG}tN^2lYl!Us(Nhy8(6 z#?4m@l~G=_8!}ETZ{U1}FyWDMseYgyX*Y0FW!ao7zNeo{ly~;`w;{CnX8R}Qm~032c`K%z@5rB{kGSDau-2xxEV%t->g0EYHrmn_4KWkL-)i_ZajEd zxA&ZS-!y}j46k&d{OcS6`U@m#(z_egB3-M4HWbP&-p3+nzCS{FF?%1bycXRV2DyvL zi265?fG;-(czfzZzPj9~V~bjLJ6NIE*&7{+4!t~~GJTIpu*~k~v3$}JYEu5JrPc$ZXxhzGP{Cu`I~z)0Re$gd880*3<(-ZHqYjr+=8~86kN4LocQq+f$1n5|bT1~oNnOF!N@x=C40-m9 z!RZlEj%-T{-rku|%LPuJ6gw+1qNlY7L7pe;Z?rAT2kEy2v-Qmby{_Kzcm?VcyNZfR zGF(HKo2nUV@oU^h)VA!b*mM)pXDBv?-qpBuhQ;0d;38*eHk7r7=bK%b+vqxRq3hvm z>UWoLxr=kKlWH=GfAad(TKZa++b0Wi6y~Bu*_XZ5qyZn_!@6lZ!i-3^E?%{7UTI>= zy@qL0`aRKguireOF_@gw<0cjR;!yt%+db$)up*aXe_6zKdg>b@$>OS0!OMVEuoLf; z&wMT(L5A#pvNpbb{l+jRRoOhR`PLqD|4L+^wIAe-wd z-NqNGICq~eP;xfx&b|xVy*=Ak>1?~xYU?#o)@2JsPh<{a_IQ5&l|CUpE7=e^soJxc zW=p9q)KfSXS7?9J4uI2mO?0f3Ehj?m{?)*!*~9cd+IKy<=;jO1CJ3LQrCG&`L3#w% zl}fW@%!7|6kaSjJtX+X6_98_tnu6awF8+Qt?m@V9AG*hj&~_w}zKLej?Dbik!xk(P zudvV?TeT^19)HBTf4+AK$+50vd24a3RqY*WgzspP>;gU)eX^dPb+BYn@mOj~Nz9{@ z1m(J<=DJ?*?O8`9-!LEiaPKX&o|?*P{$M|&w*{)kg4OOoRhKiB8Mq0zUGg`ly4XYI zOK$2VUA776cSv<;XTtpAP;R_X3XgRE66$cG_|SIqz}@(>-h-_lWj|Mcl(E4umNv%& zVT0baak?NG zO}Z21i3*e8Y2Ba5tsqn~vSXyd@jZ=$M_+^^+^3E#z^RxBWADI_5VaUXa+OQL$2rO- zO)L)!M@Dty1)a;os4>48@`s7M|3MI!!WU-f7UmG0Tk6f;+MAyLU^HK1b!GhH%Trkc zt6b0bb#WLjo78J!UW5}vc<;)>FS7Om(F-2Cx5LDj2VjsuYOti&>sj)rCK`rWn4eVe z_k#9(3f*T40kt01g)$6#vxxnq8-1;Cb1=YbRMJeWnzy zr`36bL+yA{*I^J3T8%~Re_lIQm3AG9V6BRW>A@Gcq<6QLbN3Y=N8f-MhiKqOHG=wd z_KiYSvQe$|h5k-uig!)?X6rv(+*{JfY4zgSjr?|d@-^bwR^A;$B!*OTbo-t3CF_tj zCkALl_2o+V2KUoUw$dw3V_2&?ZDz!aq=6ts} zpcnS`?)B-UJ*?12pWe2<;YyIT-&^T~a9G-^9*%_!W7hGXZleyHvb_EP}Ze6iMbT|07#~ww-#?Fj{yj!MC zqvExHPnZ7*{4<|qksuvt#A`F2*C9$H`<8r+z|T+TI1Fo#T~)yiivyCmfLWj!cvL+e zf~i9BAWAgF-nEj~7k`ccx18AM>g|}C!0X0e8ak51Jfq*ZO3^UmyeLoj?y0J2Wg+kP z@5}QqeOJH0+Suot4YAKV@%%kUaFOn=(lkk+U)6kNHRIQO29aVtp7Vb|5r$v3U%!=J z%PPS)@svbIdXw(qR|@riQ~aNXPC4*H?Z_~+r5l?5Ib#1x{m#l60zd!5UC`rugwtUI z^A;l;@s7T#8LExOjQpq)Z|@Qq0+nD?&l=0GVPl${dJUX{b{T|H^fGo_xa;*c82m&$P7mz*cS-!~DMKP?k=-Pu$Fdz*3*yL?2Nh z=W8CnpwPeG+lM>H2)aOrM=wJocPY9>!cq{%L!&^>KfjGE`}o;AuWx^KS^ijx?7U@9CfT;55}l0-E{33m{;G$i)JT;B^*7f;|?ZxIEeT9Md)a-1n-$90RP~g~ImtAXX(F zFtsrXYS_^*PhU5`IdbE1Sw2X)}C=fb^m#N^eiop%6~gR?WNH z$Jy{`E>c3F4bER9&8MyIU`B}4wxEfZ-_aQxj4}U~Peb$K)a104+7q%SOd;nQE?o{( z32Qp_ui9KRPB;z5q+SqIqvDi@__@?+_KlBf_xYf3Tq1WxCVOExhls3|I%u``rjgL4 zM2XrK2c9Ksnb=Sw^Ms~{%f8G1@oubsO&@~FOTOZFWPA(?vi#_C1hck4{o+OdM#tVi zbYtMR`_#e;P{!`iB6<}+iHN>dyE~H$c~#NV-Qqm=gkMP}5htP>$<~4EY4&Y9>x@aT zX4V&oJCoHY$nSFaPq?l4Sl2#!xU>+DW8fbNp^s~ zKBGFU`kAf*QyFohDVMv{mzjajzz-tct1z0nmv++O{@Utli`u#!$X2-2*%OrYXyxDa zpK`i`k9Y$h_z>c;m-aFpt}cPq2Kvf-J~L8Uh)%CrEo%RP?tWG zX)itMwG*X;N%rpNn9#zjND^IB%ZR$|KiR;0@83u{I1ZRV>W)UXIn0x*fT&C`aJTdT z!mp+akBFcJII+|E)ytQRN=j979oU~p{`ifU*B5{Wbn&VkC?4{>>Fhn_zCKF}$jpW# zw@8Bb_R2UBHMOm4JmKyRU2u+L)@Co*!TDNo5WR(s8hH9^ti#lGhmf4o`rxl6t}7o- zhNuTDR+uMvszcL^tYmHC(-91wUmzSMj>*Ccy7|~@W(qHTnzA6`xP%I{>a(QXH-9Q& zeUK53*b5oG%&FIWyt+n>H0sY`ucKbL_Ng#nkDvm9`RPx++dr3=@ERu2nmZORD5DTf z+p}v3f>o;jl>`|xhXC9F!-hemWP6p+PL7OkF*wI^!r%6f-xPSZ%xxnBwD|Hh)`-mxp7ft-`N(As;6?7wN&eiMo)92 zeg>TnsSnQ|Nv#N}ce*7G<|Dj5dRPw>{S5l_ z`2pb{!yuOkyRZ;0cuja7j0Vu9%~;=n)thUC;?!34vQ@7d5Ek^oR0q*e(QrUis5BP& zxtbd7HmQ~B>+6};*1K%4<$6P&gp4eB#bJh#FNcvUP}~C+@i&->Q0T6^>j}C+po`AW zJY6Ss^d}A%E<5+s36f*Fa$cQhzh+WILu-S7@`>5B)SO?*+uJejuNiBKKk5v^=_i!O z0&XCSY2AI%c)WjGnNmUcMxWa$a=JD;IRfLu`GMRnDs;?vU(UTT}Rbff2U+R>wx``5o&~hxnF3>KQ z2tJ>rMrm(~1oQR9LGH;fi;F%9uG8d5SykHVIgkU#Q?M~?(fyBs|HQ~M7j8)AEuWxs zY1w|_2FeFhpUDh}tDYDmEIH`&X-dV18(&SU21$ix9$62GF%3-%8`rIO#j$I2#dn==6gyvwMAja+QMq6cBX zMcMiW0L@@0cy;D1Qfi-qbTC@KH|*R*5(pEvf`JN(zb5L#hbd;)%w)!^faUr3JvmRa!Vk96tV zS+;L3P@G+xy!0Q**5AYO0#TWCQi9%NtAEd|YpxtS$Nks~h!qjr+b$9nGSbqK?n~to zx11KPHM9d1^y?2jCQN8W0)c{D?We^sIv{EVv>MMX6#AZ~;;eZWHZc!`cRY%n zi!B{cIi__X5dX;=yZspEXtGiAl|LI+vLJ z5ao?uFH?JHzAQiXE~`x-R7gt_^HR7l&Z}z}Mwn@Ygb{Kg;$42vNR^awmC9Ki)3swq zSe3grW85;+4DHfSkQ6_aCca&Zk8KjcLUc(4$1eiw3VT0J|8hLpRoTtBmOc6D*E_G< z&2KH+w>h-!w3%oR{_y^1FVxyf%x<-AqPby)IQ)M#g3@M66lLyumzE}p2-`M-7POxq zW^8jhyD-UvcXa~Lx}99*x%JCW9IHgw(XkkkBuVGTAjhE7^^tlIfRbcLkyatI-D}+h z9EB~6fAuLcqgE;qLdmNPouRin0uo6M?E<}a_ZkXu#k|IRPre5VPGn4sSp(%A(rU13 znkr~!<+R5wwOr$#xEUvN92n$9gl(yB+@!(Ci7)oc_T5wv5N!TPAjBLI5m8gd-}Cr) zerw=X$clS=Pz-I=bDGS3&z!sX(0KDCM!><&ZUGaF#TssHdUy}WXKqDCapZLylRrJ; zg)puV65mcV@Ts1(BKvF2Y6-9qj#1TGTPGExNqSkCCf*JcGjmi^lk~HvPs1}Z7#FoJ zW(MG{sEl*o_`}g{h@>yi=n)K#j}9BLY$jYcz7yoxGGqh{1P+%KLqvpH?&AAo{YQtp zxrdP;FrzIhD*Dh}P07LaaoxQvaBO+hxNqQ@#rQ&aN=IMk`!38P|x_G$Fc(9oBP zovvaaqBJ8#Tmt^LN!u?kN@ZY}5OK&|J=j}rhGaG*?o(|B5_D)@rQMkyo`4RBdfoDRjmWY2KAhpW`Y}XZ>{;M{_(w9DPin-R_&sOAAy1aGw}|g z@s2%OyTohbj39vB>sJ&5kT+ZPdL%(^(a&TpW>Pr7?(d-{4{=^uu>cOsC0<@FP<5I! zN>=%3TRug43V&n7dx{roE7yaa8KjRKRa8`@g7-839Ylmia4uqnMx30m% zi!nUr@!@h0L(zCA=e|`M_S%^RW=37gWmXkx*!S=ww%jq9X1aGkAftM8T zgE8T?*V=Z@AZnj|-n5ODQPL8b+#B~NYdT5oK?9W4pF1Jz%cBMeSD73Lmsr@?+VqL#mczTIaMA|j&iA|y|K#fN`(3iHW5 z_36`@hd z_#4{udmvkLUC6JWbVlvHj*5x7#afB>fVF5ABM_J@cH}Opg~{5+D%Uj=P}dlEmoGR{ z(Np8;UJeaY)21kfZ@^)(mCKyx-*265($bOjpOgd5Q9P7xiB;UD{>G$jZb@Fi$vJ^c zL2sCEWCn$k&AbaA|MevN=T^WNC2eTawIW!5wKy1L;s_sK*az=Y^6AqLFiH@+z<*xe zW0*@gU0q$09c@|h7r5><_~LerC$z1uSeA->)siQ>LUbp()RI_X~d;5hZ+c0k%#p|C9oj3S=4 zI{-o<(`MFR&QefhV&Bty@B#Zk%Rb4!y*nZVSi3@9_?85lFi7whqHH`J#}Q zZq5Fx3}R9UrZe@H&B{h`jD*%83`2DG?0B(j_4TvfoL{bKsH-;tt;7^?8APks_{#m1 z4BUyT-MP$SpAUI?d1h|*coEPHt^%Q-=goipoNHMr|C^7*qW!HmCMXB?1a!q7PI=GowWzj{V= z-e8jQ?;8><`v9H&5y}o2Q{BFo5@mca zq)l+o3LuFzd3#nkw$q?-V_w_xkV&g-tkgd9DW^=7 z6}4}Vc!6y0+Q4Mp8A_h9xgOo6-ggoNi=Gd^ijzsfM3o+uc}eJg>-n|7bks$XW9d|g zxRosmtqv|XtU%xmxqfaSGow8b3NnK()Ya`Z_a1g(T>9T0N5i`qm<#gNE`Qzz3VLHW zumCF3nwUmjH9v3V;r_+M$cUkKSS_~PU(5Yci=y%I3Byfm&jyiSEe=jj*hCV12Oy_l z0;0J#xtiG38$UWFpvt@qk`Ym$T_puyzs$_svZy^mnYg(NB|!tQJ}z@}mwxE7Ab{dK zLWZ^cHdq^c8>?Y6P#h0o99yoZ_Kt#%ptO^d(>r%73xcm-zajuT%Tv3tTHk?rauSkm z)h(a0w$b40Y!0TT$qU1k8jxn6R7wz;Ta&Cd7{;e8)?^0EB-fKPy`6reW)b)!*Mm|R zF>!7%jWr1={A^chC9*&FPrC;L>mgBJg-r}xC%4o%o#Q^`7cM4wiM3RpQim<>b@@T_ zb9`<9%= z!NrXP?Mh368IrU^x?IR>5IICR?ZsiB>(&U`ZBL)#oFX8|^-QbH>QHnz(C|ih&N?>b z;_hi^QextJ?&&!>F)+`*=RuRSHm`oj1Nv;NWn+G~Vw;a zFHtX6{bddB z#6%Bay!%@K{S_6gX%j{B5nNmXy#urRT8ELN@tF_UH&$j+{PwyYrQ`}H9<djOv}%W5EeRDrO15t-?rVqBz*t4-~Q!4dlNpr(v`bu+R}EZBbW5iad;P;zC~SG zH(w3*UXhn3pS6^^EAZR50703^SMhn)b5lAWpGIu(YcK`20_*Z!a0mScFlFps=l|)Q zc^Le;n|2OFtBdLuhJ!8(8db!a8DD_ol9*Hbt*fPij0Z_%e*cW`MIZC^%D!t%h>26i zq^Pcb1^P5^n?DkrJ2wSNV9w=27mrK_e)Gz;TiEc_B#Y2Sg=X6acdPU27GyEeRkba| zI5ZuPg|#iz&pBhR+1m$RX6J6pIpR0e8v7cCF)1P+;ekkEMa6)>{zH)?KhW=%+;EebNqwXssE=1AZtR~(SDlkoaOD`e!yCD zY(^%gQ|oK}8Ug;aW9FDkCw8&1v3KH*4gR0DQGl@Q0%1LEyVJj})jcF2-BB>A*oCLp znH`7y`}D-eXBj80D$8(G>kJdT0dG<$teh;}|L;%lDxqAO!RubD!3r(MHeTd21rtij zv~s-7x^H`0;iaRqBZbavHlTEjyoLZ)Op4i@(vu5EY#~VKhC`G1ymo1ECo<+`vI^HB!}IvN zKNDK>&K+@f?w#{}`O*RtJ#hPt)L9&14Cmu$%`^5$=ITKI-F8{vfuj7iq0)9UcA1Lj1(edutQZY>SlSQoy3e;ZUc8TBe2 z+F4S*J}X>%h#g8T#0r{l17e=)@jP~-(lRo|Gl7A)2>1iZeUBiR;n4s}Wj}B~_5Rkr z!PATX-3@I>E^X}=ZJu)3*}S^5B~>!8nfBRJdnRS?FNXUSuK z|KbY$L;_|ercS|`>hVNO@^^3FR$V7?_+7F4kK5cuN!Y(fe2|*)Q%<(FsajtAHN5Dj z5B3fl>E2gl$0(VPSkId^ic87N=}url$h?<*%*YFWis*@>wMzukKfdChzh0OL%g@gb zXWi1DLJXp>)ELla5bZ22lvnk_KymYrP{9DOI0MU^9D#VIPzrAOFJaVdpvc6nCmgpX z`0|z)Anuo0ShCXxvny&~a^&Y0&24AHEcHx&=t?i0zV0~+lZF_^+W`B>RG01kje-=m7ec^O&~P8!>6^OtwWr;8BBE+1bi| zrabDS{O#1}lm3bD>Az9?bapcJjhaf5SH#7p>YC7$D=j0{n%~c*a67)5N6wQBa%1Vu zk==XEjJ1nBAk*gc`yIzFOLOVcV_~6>4;g}esPTx&$SjRC6TEiQNrSsdbwKzgJ1xM1 zaY#V`!J~|fjI8r1hi9PTOsd!xOZ_n*mak~PFj!+6XFVbw|7}b8^dp&+izD8~qkYQfne%gJ zFDNgTb)~dJfqQwtX2Lq*=J1W@^gcd05Kd-fv@K$CxX{U(_JN-bO6mlUh>wXO*cq9b zux%!KeSVx}kFEuVv^H|mPAGp^;bIQYQ@^VbR;7s zeQB0`P@|aH&A42(7McY^1#+bsJ&23=q8;cVG^%OnT?P=~UMJVi+$1B-Lzp+Nso?MN z|J(CDVlx#wD#qDfrM@vCMhP=O88h^@NP519W|L?f-;e}}ho!0KikNahZC zZVe;w5p=xlYOG&Q0J%KQEZa;!%?;Htpgsm-w*}xQQVu<=0sfZUn#Z{3VWOGQBrhW) z<6zN8NMk$)E9}Jn;IU&zTq*w<423n2h^jZwOQs^?^|}6IQNS%H8^#8<02!U8E$6A#=-*j zR@05JJXZlfvrREK9EOV|d>=Gf&t%C#VtvGZ`&;n;_-BcbWX|ajo>2G^0I+xkUgW0N zC8BA`y`M5kEYrzd{^+PpQ^r6@NeRg7E3=0ZG=^ABO-+-@vHFn+m7(Q=M@(EC!`7%b z3JF&!uEQfqxWy=o`SQac0exa-2F7@&*0Vv&e)SX1_&M~QE^)`t2 zbagd=$!u`E-@p-D_3sxq1~Xx&T7s~U_o-C}FD8>^{RNMv>+qa9vXG+8Z29DB>-#8Q z-zv||e}L2fiUCh>x(H{@pE8LfARu6Flcgwhw#WKci7TUxjZ;EvEu7jsMu6=oEMEmB z6v2aS;{^S8LM*I8LZb;K#(~voi5&=4SVNr{#k=V=5&;eKszX& z(?egZyYN!+fAiq52-8TOD!kBlA9{J*`}C>JjB(HDdWLpbB-n6_Eo>}YnT>nC zUi7@5iDt1DsE?=t9zqJ7aiv4ST&0QD(870a&cb!MdaH;X1qJ{r%gG1d)p*81ZRRRS z#%rQ=1ns;)k=)u-F#p9dt;e}FWc$%5XbV!gFI)#RUt8Jg&qYNytf|3aHf2P@lGFff zqS&fdL@l3ioH*h={KKb@#s1E+6tMgH8Xk#`(qm$3f^#HuGee?c8JGV!k!Ci7J*^yT zt6F@RI4)8??5LEa=gKE;dOqhnYNH5SV*k3TvoB5%u1NTDkGO~d?*eUSIq(K#KPQ0! zM*OOETE$)UgFWMHR#8z`YR}Yi5a3!{TP(XR2S}C&E(dwYwQk-s*(i#19$mjbyE+Lm z=}px2;l5sd_mFmm&T0$h^Z&)?Wls?H@SFGb3Z+4vn@YmJIj11v)%I#oIxT_oWIYaz zq5_o5X4Opbx9~2dYW{gh|6$GkIQ|dM;+#1H50p$QkY?;8W~N4N4Cowee~^DU>ep=% zeKo;D8P4g;<=Ny)P@4Z`fMR2l6KiI2A>i2bnN!9I-R@v)OC1Z(-}vgPy(5YI_7?d0 zKp9uf?=UD^>bd8H;Q9k*_GaRL3o1uMARHdw**@CVC0;_fNogQuMUExU6gjL@8i}Hj z7ev$I8OkmaNojJ;Ell&H9-|LZs;FV@{xFdu$C70U2a|VTrNyUjjkSH}h+qnbYo1^C-1T@iyDWc@^CMiy?&_X(rBOo8FZ!(0k@qAFt&V856YiY_-r zPU@zi&;^J^V}yOx0txIwC-0nVZ)AwMvh)C1ivPTq{#xM`S(|jIM zGue1G;l|;ep`j08emDh|O3n^ZUc=zb!~z~Gv4{jY>aD81R$^LO!&J>ftLj=jwkjHk zH`bmQ=YkQ#W~5hgMf3iA>^5|TC4c~^W8iZX%<%U(ivt(HALvClrHB_}i^9cTTVLYI znJQwy5nVctgR3Wl2ex&j{s&R)BAZN-GgSdXv|^5e9zCgFQP zjYj%HsG&I|bOYyZqq#bt;fNLf`_hk+&USN4sXjG;oZzfcG|@#zQ98b;AlwbSBC|p> z$xRzkH0GkCISS{-mAo5Vh56084n&gj`8==fj$#bp%rZg0@^)fE&3jd`T7FE%uWPp6 zd#{iS(ERI(to5l_gBVEkk2ChN#Kp#54I*WU)UmBr1Dc%9))jMoGMbKdO?wie-8wwB z^L)?3)Dj?NA|@f(>C52PkylfTZUHOOLb~Apu4b>5^F3#38tL4}IMpri-m@zX{|=wu zK3yFX#SmT*9wfV`;6szWM$;)O2>b6OC!2LwHl-H|D>n(xsD%DL(T6o1##Vi!k+-DA z0Be#$2x7Xqm+9$05?gZFN2q72A+oRy#Ehpc!Tuew*=&G0x~bRBBWFn--m!GYz(fao z;;XtO?+)U=H!JL)gx<`0CQD}f7iisVcfaX7ebjdP&;9DNjLYML{?&FS%JR&s0SWdR>S6kZsdvEc6{w~T^@mEIhPeCc0OwrdX zDVw@Y5{r;MQ`ptDylQj6(oC;rXM0L1gM6Brv(|o<4G+`&!_16(R++Tarri5|nPHYK97RIElH zI!y*|VWKhjhU=Ej3MbaoD!acJ1z>7}&Ecr55VA;8=&NAu7W?x#&~?OMa%~FjLz+8k zDT9oq1yc*@gvcc809qJFm zT$b|(ZYOr-;yA=vYqr0aj3@`KWwN7S=Dwt_{rMRrkO6mALAvaQy5~(@$8NQk?qDZD z5sb(Ir3C<3g2!4WY*RLVLaW#!8X4dmFjsnnaZ6tjsv=>?)QEvr0W5NKcC(>AqLjI-XHN`XYZ!Khyla{DfxUC-GC#X zjIazW+Lr=k)GsGu!Y>PF7a=oT^o6 zDS7!{C=~5uI2d-BPbyynyV!KHA!6ywJJc!c_0vZDkdTWDU{=HSLJaBg%@q@voJU+! zi!6KFrpj-D8GNs&tQLTPcvw>U;eB zd{gf@)b&T6fq(z*cB)S$!C2K0 zLXZ0GJuiES(CTe*fhyFBB4a@F`j#Z!c^TaOSlWdStH2F8`DTm4MozjC`P-b*u`v~D z1(=X{9zf+L2{@WyFJ95x86YTWUk{`;BkthrU<0x6V62K<*PYd=iry@P2axdCLwa99 zGCiX!hP{ApKim(~bzdxQi**!Yh4K=N0%rAlDX_r>*)hN0YUD*A?{DAgKYT+Bdzwx2 z8Ua6t4m8>DUk7|=!Aqk-Ree{OqX|LS7T!^V~YbArjt2NX0j zGrBv1YbVJCEXp>IcV~PFJLzSyX*Xsl|9q_v7q>VcoFwEn?S|6wwv-&w-9kLQ)%8@i zxNSyQCBnE4j%WFcf7YfZc|3EE+M`VQV5Z$WcK=;SnBDqX@{FG!h~DnUZ=JJ^Tk^P& zSI^jDyWQ9SR`kq8IqdCpc2uMRVBAjU55-zT%UvOvSUyEKJtJUgc4SgKM1te!d<+d3 zc-1dQzHi@@#cmRUNDYX2Cp_l<+5BSZ#1t3lY$|C^9VU#R*p&kv*KstUps}ST3b<51 z^k4ba&?nZ-tnc$Z4GrCV-CF!rx(1}G_2lMlCs2obDCEd*u(>}Jgtg`c!Q3jKhEjFk zx5#q~^91Y|G`OQuDz>{EH=L2--30A(LH|XgY3&rHkUnF%tHgU9D>Bf}e&~K&e3Pa! zHNjmxRC8@U7|4ZqlT8M484lUy&x=emiw9#BY9!qSJw7oi2&~<85G!(Dd*k|6gqkF0 zs~082mb^*r>N)v=Z)#nznqu9qW@Y3gb@RZ+t6~{%k9GYY{q#ATCA)%)g=+@U)q7r9 z)lS1)8ck)_Q)}o`F)?QLNAZ+Zb?FKZwta5zuMQ7gpCO2CuhC?p_FgR?x-l^~@UzAR z8WFg-K^OG2U0hx~T%uH~%)P_MWv7JQm(I@jitF7ossnE={|jHPcH!S_8O)bm{TAEX zUxmA=g5iy3^Gs}Wl!tRt1&D#|)@H@w!M%~;^OdV``$xv#z3xPmab*0HN7}L<e;vWmMV!XU^ zhZRL5Yf1!1MAH8VPx~r{=qI*|z8-ANJ&Sz9BZgX9<@<}&Yk+jj&dS^GOg^(;T5%{^ zj>_3xXWDU@B4h1t;j@a?8#V8LwB;tHY9e7Bj7t{(;KS@4YI>sfp53m)rHpPj)f(+e zC9}f~a+a3%=tcs{mUR3z%dEpTy*TX`2?My*wq>P8lZgAV(rG~T z$G}uq*cs=r`77oL(KHm?ww4^sx%s@+u5#Er7kRcF-pxbFVP~h8?5=B-37G4iqOX(h z08xFL6GKb;_&ZTh&7=m3b_*NS9naZ?)=>e+$my!i^^pwD#R4;qVL^}Q9u|3xeRkfdSPD1n$HR1F4kZz< zkVTDb2`xCAQ%aD5*ZjrH;4#>oH!e0HF-hB88rsZpyQ6x~z=4GgJ-Ju8*TK;0I6(!u zQJxR(nv9I~f$eZW?D9tPh3wYihEV-%g%QmX=@3YG|w31Jg?%< zRP9x5{*k&tL~_&l%a2s9*}a)ZOk&h}o5Jq=pV`Y^COj}z)zrZX~H zEV5KnQyXy5+G*?%+Njnf3Eo=Gv<<=~sM?seqzG0cBVtAu&qIu`T@x0vJ-NgCDD6Qd zu2w%(A!^0!Uv74-T=)Q=E2#b?~B+o{3I*XH2z8KgA1qp=A zlftbIRz+~qEru>(==K9)wPX**d}r00gZ;ZkH(;<6U&{@e!=^AC`lKtzVBHUoH5`Fl zv(zooI#danik0&@mGZhfvTH5{>coneG~kclBPnz%TU)=Otap@wzJcHx|Ij7Q2EsZRNAD4LLb^gH}O6OiE3)yzTe`wx3|l-&5y72@_4yAD^0HooJYe7toP)l9$wd!#~y9+=ZwjL>Q@#ND5@#(z9s%s4q z9@#+y?he@9)~xmW#YWb}LPkh^+v16S;j(o;k?E zJ~py3%H6oRu2;}~piLm)o>xSCsju^ZO6mXO?5*RXK-;$A6)^x2LFp0!QAtHQ6)EWw z$r0)9h5-yv>F$>99C}bzI;9(=8;OCLVc@-H@8|yBeePX(@BRK;1f^W;K@Ir8;-+>B`6imzZ?0H<-1cv7+L+ zsTbdw;(EQrYMx}}diLf?QOn;W)Vy|tCY$bm1AMYye!}9meqmvN3VR@xMTgVG_DVf1 z6@{Z&@3NIJUAMlVs0NXD%)*k_N5#bwd+u5kF)%O`%a>TvlLj4wg{8it(AHzU4b{S8 z-xNQnUj1c6$&okkx^T947F0{O18zhkc?p)r01$btRb!V9#20nE&B6NAyjHs%;_z5~ zkB(rynvug4&+W3a9~JiS{LP66tN-wwvAPF@ntgG7pxig0{$XlWrKM`Ojxe#hV^}uUJROSd%5RNJY@xoT7CURq zCO2$;C#X_xq9;08q~P!y^>8rw_@AD=Kdc&xvNSAm%(?f|BrJ8GN_}-2yVK>2 zKjojG`$29SKXbd=wnQYTgsE@ej+1oVwO8TnQR7W&z!qox% zJD~I5Kj&NUFQQoOCrL5flPAs7$|9OaC%`7GBi=M+-0CPHA;Dw^hFAt>>YI>P8v_&b zqTGsG3!v|dy-MCBzRVrSyY>`(;MtR%^-gOUI_%tJV1W_K(3Qe#oiHlFGdw#3Vw%|j z?)}|c3FJuiH)iKt(rBLp?aG3Ayx@Yyy$pPB4)YB6xUk-1i*TOxVqL$I%b6-%Hr~`TEevf?pF#Dh7Rhx6 zk3Jr)>TN77bwQN2zTDDYr`~xEipG@pN{@DKD*l!3KC!zOdxK(ES0m@Wd*2G3Ic$MK zveHFID+He@zNI?<7Em=Zf_;ADZKZ?e;OttB)a|%xBIW|UhxGj?CGeAV%0zxwdcV6i zuFn7JOpd<)kM*;-^o6e{Q*G)7P{5%)y7K7UhM`|Jt@Tvoy>haJ3RvsP-@ZXg$_&_U zbtMNNs*?RODi0#;oRbG}cg{KlBF~|g!Yu&bV)-nT{9%x{`y-YzX{n;$jS-NAX)qs% zep}a|6mqd@WStRc-2F;Gh<7jv$YPkTB4Y%nw!fz-BYU^%>$Bl)_kbmrFoWtzpCcv&&=E=iJ_>{_B6Cce(J02A`hZw z4o938SqIMQWEa_YE|J%h@~_72BnImkyN>8%A)jlNSB^2WQ{+p{Us7pdOWBn07!}5V z;S|d&moe=w)3Q`z`_Z?>R))XnWOwmyu&u~t3%@{PxdEnI?m{uL`lvm@(F6YbWdXP( z>p1~TJU99w0Il7cfv(RM9HxE|W4(J#h%#a$wcb$k-?#g3nygos{rdZraWLJxPs^lm z4@f?Iw8zBCPRBcf;IT*culM1K>o#erLi>qjCHU9tkADO*KYTb4)Wvt05DLP`CsDzu z#P8OAm&pVHqmW@3_##=IWv$9cSisaPLAyXgO>KD=ZEh*2H{Arsu0uTc-y;Ax`>Drd z(D}YASYIKN>eeF5FT3wrSWQxdw(a23DOFy^X1wE}y$1_x$p>!(i`uuYtaFcz3G z+nep;xTzCY^^MUW5NlNq1hNl?`V4+dwY^Zjx4~ycOnT}%o^>YmKF+)aE#dL=V8=bOZ4|L2~YN~-sXcTqxd{_FbnL=+K~h2 zJBBRJ3ju03vMQn#6ZN=M!|P8mG$g`|bJRGXfUpBt0sf+a29Ua#4dO)4QpP^5QJ$ys zxN3$&N*WCmHTvSW!*DY)GYQAH0qVLGsU#ZS#Zh0_fm+v8oHk#VQ#~Du!W{oxSOV(k zNCpZ2p;M}2v8@3%&yKFHLF+szjKW&A_(g&|UqQwRu<;4Hx8cx(RiA+{)nx}CO(784 zih7nd3pOq#=u>sBwRd)oe9?p-~b0uz8Z)UPxa~y$Nq< zcnU(Djl-7Yx9o?bV>{4tn(Zr=BVGQ%I#uHE%WtV_`%8A#CWgbpZcw@?PSfAk*ifEb zQa@6cn?*JvyfnTWJN$fCHc^HmuOcITrwOmEmvV*kt;Z?#aJ$aHx5Tuy@2w<>$e8FR zZq_XAIfiaeGkKmpQStMeun@uOFz1mNX!$5vMhnYU<6SiH_5YEE2!5C?(w1tAEy|j6T)aeWhamkqosGm)1-t zldG+(TeuJ*-S^;gANgC<)VR9W8-a_M3?DqkLi%Nx>o9i)&QXw!MF?3ItYSTwlm6g*(@CgW*A3s*d(x<^IFq*>1$Y=@YAD55ktv6Or zn+4R{Nh>9bAHd;kjm|A+-NeYK9grcju1^+fsH?XFLxKYI2`DM#skU_ms$hF{PJ8=* z``+emoaBr3VPww=x)_bDR567xd|xLE%5ld5Oat$ap6+OUC0{Ok#Pi9W)a z99_%N&!i_>Z2xw%?bCv@+AO1bQA2~SCkLw#k_IJrHPdC_lv6+~wQ`GWa@hVO(1H9I z8!xw>W*dB&%LSiD@Cd>2X*tUESZ`Ob&~BN|9&!=3M?k zBkm9pTiq!kQKL!Lb)2h}@#4UWAl(t987%oVG@bCig0~fF~}n-lK^f-F)5#dK7FZCad1s zxxB|e69UA=@q*}hbeqO&G-lk7B($1-aO2?-5+@cZ1Ba5^;L*2amkO4TB8n}EDH*Ye zcq>L5!L2B!fG|G0haKk*1pW zEz+MGMSkD$LVM*CikOCZp^&3{)u;Er!r^`RrZ2@ey6EafT2Ak@Wgt`RNK z#Q=cJ{KA_ugCjUqhFEP9^U$%-eoSbmv;5IY@+tJF1M|B9ha5qQR!-u-}%~7 zwW0SqgZiLD$ZB|Gw8}C_7r-G^3mPBhO(BKRF!CJPAN>s4zZtG5svzj`MJbzd1ylG{ zvKwOnB$Gi`sfP0q;VVoU0hq=~b*q`uKV#NNQn?y?*Y{l5A{!2toQvJ}-+=>W!A<_} z1D5vnBtnfXh1B5jc{M*R5*U$?`auP?R4-ppy9)RP6m^OP!}*s`3IJg!hM#(%IU`e0 z8DaH)&@W%U_!me2@Vl=JYRqKo!VksMH@0e*0Mx?-=FPAY_^CDmSiGvkOiBvudkwM9 zXINfG5S@tj#G|Q_!a{k(&g|^wgpQ-*?;nUWn&!r0*dIMoB~a=Hh=(&JVE-dH7bbpR zeKnj-=Dj=j#C;){FQINaect;PQja=!nL%G=wtmgLd{M_+~o98(kyGvzhe8 zVK4|{Y2Yo?G?^8wG25Ze;3liaNeVC$?Gs9GrloAl#Y4%R4uDab5jl&PcV_M7iKzDq zIQ1v<(y5 zdSKeedPg-j+QDBlUXRzf*WU{T0BfO|X7V#h=OKL-(z|1z0dwBoKsLT0t;wCBg-t83 z2sxS(mJJnqLJ$|&OLq{HCPP{Q9!2VoEURUT7sSL=p14mIR(N^D{;^@Fce1gjU0!)f zkPf|$mqN^?@5?3D7ktzIn}_~8{PTK7KqP#?%>w?-Q2?vHc@>yr%$~9)Z%JN~qa4SY z5`tvI2v8DKF6gbx$pe0%jRNJZTZ=Dz1R3W(i5nQCvrg--4`#_N!1D{3~K&hLYO^>!mtt|MoUsxX;*W2 zGoC6<-sxAml;4{w2662ITTP{>63Ebqx|aX`o#Mp(+S0OE9kuZpU{dPhx;eS+6W$8- z>z^hJow??^-GHI4P*sz3$fBH+yy?fQL?wf5$&ui3`sfiA9UaJXmV2;1u1AH|U#@NG z3n%_)+BMJkBCoJ8V%xrK!u8EvJ>jM=PTPg{-AG2GgWUPotoNd>BX)}FCbpaQO*HGP z$9DEQZh~HkNK`lP(%t+E>pXEs-8U6NG$6%ilMA6>ij_>JuX=IOWC9}Rs_p2BT*y4) z)mlfb$?k0|c4eiNzN{N>A>M!mC&J8QsR)<~XZddQX(*@QA9nTXZaPkeo*G*pwwz#h zCC~TDy-XV4p^)8jU!I=4#D3q9DeT^otFU0@eeVAr2L4>FK_|G%q^zN#kd~?#6ZNF| z7S4LtOW=4C3q%H#P5PwAhsO({a$s&*%r7X8$jFHCAs%*D@i>jhbJPpDsM8Ek?#nl* zb&kj}L!P?tw*Yfg9wv~$3OFVl$idW8Cag_WqD`Hwr%f?DQE!F_H@t z)cT^U;B{f(25!C2Ks5R*nXTndP_VU*2oE37C5P=O0CEZ&S>WUX#kv22KmUV3ua+Ce zzrqDyMwFlstHh(=|FfN^{AH%m}cA7iNOypLKE$&bN_wGF?g67YW&(lI3Vz z#2HUUzNLX(dEl}-r(K$+?FxK@G)J|49`X1X8bE8oBw{L+O%}7d?wJqW66X(9+HDjU z1AU>_=BD7uH^dDw(v+1zg`xtq06bz_BIo$W-piXf*<@U5aS-Kt2RsW+1|HI_&CqJh zQ7ekm!vTNRu-Nviz&S;`vdFiy3*UN@nG4J6)_DbrsXh?w8n{qrjjQ zhN2$Ux)e?|aGhS%>e;x7C7pVZZb3n9n}(lKt^ot*cDnxoi0GvgI7I0;zAyqVAbWFf ziJlu78CiDKJT9)O8OwrhyF7Xz(>Lu*LCQ8p2By|-rJX)Buw83AwH&6MGR_h^=WG1) z@%&@*^1Xu7p~e#E(XUPR;Un#x0YpGg!hnP6MbF$YD&!@yA0STo@*IUJVzY#8=nUkh7cQ@EZrblS!=nftmT+o9fNn^wIy#*pbqTe!v{YMv zD->05)B>PMk$e@O-MEK_M!+TT|49z~&x`A;g!j8nHf-EOJ?<5_Ri2t6j3HqSygEsV zHwzB)Z#)H5@JjvWC$tQ7G-4&0x9*vx_T9;3I# z#l=yX`!2^B4bJoN!3f0brzAER$r!BmRbReb9kevIUnb^v*^ILZ!~ib5(Ljb|-SA+6 zGT{AV*R^$5Y6VJwna3DXJ$3=arERE6hu#4>*tbZb`L10Z9Ru}7k%w4CD9tb_=L9Yj0NscK9SgS5PM6AF3I=1LAi( z$g5t=1~dC`k`Ee)bwgaE67s_Ysfj}P8J=u)Zs_i}%Ki_{(D1?XpFWNMJFxxxzoy9k zkV5oX^IXPCA=1;+9VV?|$OA?7-C?XH7B;+X3G1B$e3{i}Ja|2pmg%nI%>Q(|s_hr+q=?{aGGvZ)85S!+>5(SniE)(WObdy8kBC|dUJ@YlE zz`gimkBMW_`rb+6?1@yJ%T~S|`=`HLi9aI}e>vT+D#d~2$43|Z5pFN+kd-i4yR`N4 zF8bv5HKq5&`N~g86=fuT^NYCzc*?OlcfFX_$2W_z*`8WFm>3?HQm)4@@kcRV+jt%a zN!Ii|PguRn0|Y-0@D8ga%jiI78Pc4ql4%5jxypf`*pB?_JR8{NkQ~Y=C`5z!GfLni z8btB%Db|c=tv~&3!2N6dxBl$~Fic5z4+n`{K70C3sAL!r^_hUN3-qu6Qp;WVt?B*y z_v{FJm;|7$PSd_NJ8N&3nce{L((C#aWp6;b67cyO87q1Lsd&lu$bE0|MX2fRe^Ot7 zKAYi&Ez$TS5JVpjftFBCzHwKabU8M*X==B&QNRzMWfR(4@)__dW|CrRZveIBcXhO@ zyBdb|q&)kMyeFZ0SZby~2<;KgXt0~&^D+vRn1sK4D}TD#zBYjS^aTh|vSk@?<$(j> zEhZw-@0lJ31}t!=A1dKemq&+&KA=u`@-=|b6|fj{;`9N`&F6M@ zrQ6O}F8z6bzyJ7E-*B7XVeJ z`pN)=2K~-G(AHRR=3OM+BOfYm=;aYnRF8u=e3A@R9XhuhT_XklNq74Dlnp*HzQXYX zm%x3mgN2!wcLcY<8u}63weJXrHd@zqz#Y8u$K8 z^@1K;ooWv&$BP=xxtu(iIGE0^!?TP}En6$8J~2Z>>TP+TRR3#BE)}bN>%ZpV{82a4 zig49;Q&Q5gZ~moAg0KeKu4nI&m!7kB{Hs>KMspMTiIV~G62vBcH#~Pm+?WbwgKQxe*xE*#8GgJTvLU$xk$O=OlqoShRbTi9vq%N)U@W!%^25Ea&yhLA`)niK<6vt;o(u?J=F+8M##GaR+1LBxlrd)HvjTBor}bISSIm%q%zzL z?MAwsv(B$=uOG9i;pcLJYI(&@8O<`(m;S{u?JA&g1B)E-ahpuEdOCEN<<9yP0ch~Q z&~A#|q1V+|sS{%PV^#1{)78KK{~DqG&8KXphIP=wvl%4i0<*wz6fi*ffX#v=Xttbf zYE&xfiTq|YU8k|#u&<~E7v=In_TCiop_+W*2gQ1<0X8TlD5`)7FL@V`7ePl0JdSsG z=acztQ>6Fl#Gq4|KNSeC6A{_2zev>Ovk(ETT-{EaNrm}*mIv93GdjDCBG|fCg!W%P zia(Y2|0ti}hn2P17g^u5m>KRfQY|pW{Wy7zCh}+T$KG34XCq> zp#O{f@SzUQzuMpr96iQ?eL6P&Tok>@y`tk!o0F3xXJV55lC20GArXub6Q&pdP8ML{ z;>e?sP(HH-w(z8flsTqo5b?#BEa?3G9}AUt!5*Re$bI5*>}bZ<6ZIQuj$MF+Oi=3B z)cRA_55Rj9Pma>nZa-<>!37M2l-uyT`ojsIxV99P>pxAZkS6ZPrC8&s8vE^Qhigq(DQx{tlMa}; zSyJ^`0tX?@tKx9bGq=;9?q0#lp0NtxD6njTk8_DtNsz|zLQmXk&rZ?U_^3zD>*^T3 z8JTZbNqcxfu^v8w5K@w0)T4f;pkWFFfjBjy&MI74c2zW1&e~Ep(N9T8T*f2BeQ$_A zxuKQ+2A^W8)Iz1yLQh9G|5W$XA{J6m^?XA+PzO_+uB>8LBu6^nTb{=tF76_8HSWe! z#G+W=H=%euy!Z~b_;|104d=#5Aa-2wjvPx^q+ap#$WH;h%#}ca-kVgHkw6MclM}EH z!}?|1WKncFeUkE@AJX4k#XtR)W+hxHKoF)ep9lr)pwF9Vv)ow}c?l_@=x2r-S8*;` z617js+TL6qZS5MGYiga~s@JDlC%?5k*7s?px1-cE=Dapjyg3yYjHo#<$)c-HzP|oZ z(@^vlcILb+UkZ_x{fHexeysVzuDj{UyVLl!O7)Z-%Gdw+#Jc#AB_*uPufgUKw-j`q;g<$d z&BTU>8(1xWr=q3~R;~n7a616;j3=wDv4r=5{e`OTZh5RL2eY6c%58eWSxI8nrhbbT zD^CM5`%258YC6=9K+Yh$-f9#Ne5ZKs>+%9hI}HMk;y#I<=x8WBE$wz}+rR~|$}|Rp zxD90&4c4UEp;urfE@$&xDeYgdfU9m72zPYU97>#%J&K?BR2P{|s}3j&CRpNR8%*r3 z6%+nGc-8I6oS!@E)jh|zj)vAX51%W)EOLIlKh}`L=dfa=z2o@nvk2b3<4j+vPH-SY zZ9@`>fr~3xehaL9jtnYlYMQwk``s68&4n4S^;~)Gl=}{=8c6X*Xw~j@veK?Ay z_pJhyUaCnjRTdHy=H-P0pKfXfAF2bG^TvyDV0TWe9}l$q*n%qk^`sl8vKTlWbpjkF zcvpVEt{zcW4W!2XW7wD0jQk{cgj?SRp_lUt)57%@A{* zhScx&4I1EB4Y}PQGvX^QO<-070S|GR9*`Y6fc+5G6f4LY$kEEd!3g2_S+mcnRsIY> z4);xyok#4^_7#qJW_EgD%^B3=vIHgt5=4|`@_sTPaL>3UZw2qh?0+phpy}dO4y~JNm*Pot;zdjy<0pjo{ z6-)ypi>B1et~F+nw~BP`lE#SiU~s6`O?ls7B)~4tjmcMxyjq;!S=bUJy4XC>1!pW4T0fbbKBP%QW2qZrl4nE-du*vCz z3|w4UL0b(d3IBW-L@V?H)JX4YDg1pxzjyC&OUOvb$yxY7Y7;i-&L&m!Egu%b%4sDe zAaKlwXC@cqCqVgI226#=`)>L{fByW*5nFg6kARHL&YfoR!okK2bFA)b&yR-x@S}+q z-{*oC(F=di8<`~zWF9JE9Ez`~{p|^~M^e~r=EfaD>DNs63R}yEpU(#2#y?)bz0VmwZmt}a^qZ2ux{PFZheq~|j8WouB}X!VH<+1$ zK~YsLaw`V3Awn+O;rZ(p^&3g&R8=4|;OOt~2b|9mIMccW5c{leY$R)UVkdm?W|ZqX z_V8eBcym&mv-YvDEFmFb@wG1%SKXcgPLYf-v6Gg%`l3@KU>iE3D5dFk)x%O49VZd@ zIXJ3CoF~gz{h(NJGSBKN@6H8x&y`G3frytLBF%KXH|AkZg6 z087Ao%*!iSl>`RikAZ=a*dTSVir~NoJAYGScwPNIIwl6|6tTq|LcB}q2dv@h8e@Qe zWKJ8f9x52@W~D>}XQKY1jb30OabGRF###RIKTy?y0tddA ztB3o^e0g7>;69@ipQ!)P#6EKaSN8{%#kAY-9~13Y6y0TD*p5?%mrE?YLyg}#*J~TZ zGEh-H$Hp=+e3H2B`>$_ZL0LIW?`(6^igC<#q!45jirANf#Brr-U2#`y*npGI_8vvg z6=3LY0nO`iRJw#BB_*vAfbj{s<%a;Pb^$#oh?n_U)wgzK(rpfSiI5X2{sSubAKid> z7kHt_BVz{k6pCHqnzwlhgsg1tBE5ZL>sED#E z>*%ngi|Ww62P%K@e|@hh%fQ3N4%lI0yLLr^rCZpBF$>s9gEU8ZdlFD*kqpXmhNrWvfL>Qc~8!B7bm!L$^j5^q?yTj%}Xe7gdjT zW^Jw7HdfXf0gM^do-y1&sETfhu3r;5@ znZcN}B%^_%S6der#7HZ0|IS`-1UN)lZKa5+*GTWG(CwTk$hD2*N(9`4B3D3}s$1I)6|S!v&^?_!(u ziS-``n8S_HK%3JMea|hPoad**B~a$U96ro%scJ-n=NdBorEBp6LoT>LMDM39Uvzb@ zkWpM()8`{ZY(#UbdW2A{3B6bSIEwpxkLdZAJ91&E#muP|H}1U@?)CAjMO9CgZ(=X9&~!%tbU|sWc2wO z1y@>h{T93dB*$Mro0@EJcSMuhC9wdjjZnu}oxh%(bKC2=E*$fg9HfK$1sxr2#A8|N znS(ZO*CIXdZf%|++n=_@k-}a2eA+8F`kR}U;1F}Go|Y4Jaf#Dz-g_)sPMPkIW&p!X z;`7ufT|BW$ynGTJ&GY_bd}iTXYqeDwKYxD@ysdVeIFP6#%xMSu>H7~JIBYzlS|p{T z+a8KLJUmo9v}NsAx*`PZGZzPy#G*l*p#V=cV=~AfU>1nCoe+90Nxy?{HuqUb$MYf% zkGf-54Er|QHwsJOwgDDYMzGM0RbLQn;#gUrh55-%g;6+#R03z*q?zBT+#_rE%}|2Vm; zcG$5F2P1gGuKXJg9U0cjM;I_MZIYMf1L$J_Q8K61%FN6z-v`{mL=4XXCrD*s1Y)xg z8goae;O#kUKZ`CRx|;ebzJ5+_?!oCSiUqJV&6c=`ae^v6#=!`ucgFp*qvNIo5R~ub zIkE#N%aLkDEj2US=du<;TK3z# zJ*Pzdmg1=uJy#Lvwe$hUl3QOfNu--KrzRg#U(8vBrD|1)=IA_s5n+GdRWbWkw~oP# z$qvH>09%=txtRW`CJputk(1M7`=5b+U}ZjX3oHpre~S`{3}Um98; zfB2Vil;|GEy^9w@@tBxtG0PP~EMq_eHrO&eIx2J+lxd*vjXJQm(3KVfF+YM6(NIwi zyTx{5>_ygz28O^OMTip?ywWW$TJB z?;|4Ksv00MvG0!Ex^^sn=YvnLyBixv-?EuD8A=gND*?X8l@pq_o8vl6IzD3zdUZ@P z@S7fTPEP897@&6#ws%f_SPBWmd^(Di(a@+m*dA^{3Ed>>ISUvX8R?*f>69RbOjFS8M=qm6%Y^U%4dJbW z-=~7s^!>m_FA&;YR{$u09RR4D=1EdpD1^Xg@=imXMwFWn)gXDkb8o3@675#dhXL|X zghyH`wBiJ~8roLf)wBWJq?$eczF!`yzb~}Dp?GFvQ}Y=;sw$NoZ4Yjm-|yyZC0Sij zVh62_UM*GYO7Dp9lu{cV_tA4##V;?f9BHIgTJR?Aa}wKf=S9y+cQ z`Jn2FU*wWk&RX+97#lrYU5Vn}eGu!!*v7!hg z@E^~@|Mx>2y|nbECp2>1_)d5u0ph&>=lvYF*DqUtbr^rq3i(~Xh3#fP%I+75p>%ZUnWQbY zd=!44{d#f`ZSg8&d~b?o*)+s*JJ?RFizZZ&U(1O@sn4``GX99F6n1jNy3`Xm%Z)Hu zP05kRCnMDkpo@xRs~ebNP0QwHH~2VXLA4&6kibSvtN=e!(bHoDGw{PVmFjYIRq#Jw4zq|!9~XIzVQHfw~jULOfrAQ{mSCvV#PfI-Y&6J?{8Q4 z9i6(#AzD`NkOC7Bv-64SLk+Wqt?@JM}AxcuC z*7Q;oTw@AlKLeS2Q2?MFFkIlHcLS+;J)E^mx)*N(yrX07ygEputHFb1GU*MIul02)i zA0%VMEh*2>?>U`F&(GIxLPIkLj+EeViG%$olLr-wkveB9M8J)J<376((?`6Ytrs|i$?}06blWWFm=E$Zs#BI zVe>v>9EUiF_r|;UuZm1&_XX2DRBt-ov(!49zT814I0nXzU-V?+&G@T6^vwO7uOOTR z5^1t&09>#kI`9Odg~h^(-trR-ZnSN~;~op2#gF3fgaj(Bise zm?M%lk#OHyuxJVOW(Qt(Yl+isdR%<}Y$qb#%z4QRV6GXwW4)Y$g-^adrP?Y+w#Wi( zXXMd-1I4mw@gJu zE6XYOF^a3!jYo&;hcR5WJI13ajZ*g}?c{bRJ|v}+P`W>+>75wxd%L&SQa(W<4?C^L zxi4VXPq7n}n*87*D%Gxg5G{AT6HR}r>9RS+F8zQt%hDktNX)o0i0a{HTvJ;CaAQ)T zb9eHi;or^tId$a>Dc_{EUv!N!i9xL|&aL|;yIy-T)E~41?WGKF7gJ_M7L|WX6;S+W zOpEG@$DnxQ?>fsqetPI}AQL$hWrS?G7@9DxGo`7a*>%>4vR#;ACSTH?nYUy|SVHa5 zA=9l{#4Q0YTTTw10;91Yf&0=;-8$^=b*ekS+aZ|@9jhK(620`%K>@fRRr%y$KaX$rRVEKfq$&=rMM}8W2}MATT|B`MNMl;(l?^MxMA>ku1D* z%D#=34nw7;smY=wiu}xq+vfek``l>PznOx8-6$>XdX529+6o8r7_=SbNFBMZ6cf#I z%6wDTvbTyZC3@_2MJMJ^?l~o;w(iFAxB2VG=3v&<`I7O}&^CpdMf8BEsPEdrVEH4! zfk$o~KaESRy~?6cv%&=$7q z0I5+F{`m~c_?X%b2Oi6Rz|bCRS=J#%=~~-Xvru#qn|{MsvV?Zqb0sC)!^Gz!iZsW; zzD-I>m6{N54Jfh;;_=$7{^22Y4wco)M_z|Tnb-i@hp*pt8CLQ(eur;q9IWQQHaPm919stVS~?b-eGbNAeLbzTcgXwN zpsc;9Z&)FF8S4GB`P%W|MEBg60p2grMhB_qeZ<9Qg~gmj)7Lfzy*n;xykjtj)BlWQj=C+*!~K7>^}9l2|~3*5UiCYuwo?ck6y6OGsozj$#b( zQf0io{n4l4w%jbH{py>I0TBgkGh9nfMzx?Q;+>Jii@cS&bA(I`s-1N|yJ<<0lF4(r zq~zM+BYLVkt?H5m&m#FdvlWjvemS zZwa|{_y@n2k}*sb6$$=M@`F8=leY=LfJU-P-p(0U z#qbK>$ka43z-HDmR}1K9l6+2)*xX~pPaUdKpsl3?VMj4GwM*KmqTW-FuD=DrU!Zwr zpIr=&0NpW+>;O0(bk^7}812q|v7v<_Us3TNfmZ1;d~?tJ`SVZM`A0Yen&}J@ow0G< z^};XYE@HF0{q4aPSi5fPdsUU?Xy@1W(muDFv;4H(kAt{-&6cjm{=>KP_Ki#3;)1sC zQNtrwI>IMj33bMmUaoia5s<~!u6)V}Q`dnuB`ZsPb2UpPxtdg7?zukAmQ$;XsP2Bz zqDe$u3fhwO<!GML|=&@zFj2L z9Tb0RTNQEfN^o9XHWS#jdt}U8j_M)_1awsx%=7eUIgF1|yklyF><$lQYpfwOWtcZC1mwLm5OAw-WA9-Gjjw)0`A!NnA(FMizT9 zr>WO&PEfAqJo(Ufy1|qAxwgWzcIl`LRKoU~N^rBFJU>r^^z;#CQi`4(PsKAabBD6qtTl`gkK^W_7KRZv1zgtDL1)=d!=j2i=zOhAp%u8*NQa zJn_;kBtFPB{9RkL=~vH&cp3pn-zHuqU*(KHWJtrIGQpM*twz);M9Kly8OYgWh8r^N z(8V4D*NvI@u?vVz?E1EA86%V0KpD8Rh$Z?&MLotW<&2=JkLp<7v`pv_^wn~tos|Q@ zMmVTv-w(ee1n*)UQ~wb603CGVw0++iC{52KxJ3r;DkLyjEQG`)CT^60XK%;v3SAi1 zM)^d>Nb&E!J98RuM6CAxO!S;A71Miv`83|Zr$;ku-ls>$(z|N*=hvfzS=Mp8$3q20 zD+zr&eJhu2AHPSL-Ga|vii4p!lcQGn; zd{%4gOzXZtVv6@_@Riu4ON+wMSc-ONNsU!Z5Y5AGl3v(gO?F?A)=}eO6Wuc@DXJCE zBQmWLX=!On11M=s7$4z9wizFB#LMl(3(%#dfM9VkQ;W*$Gn;c;uBVJUKF6~rnv&p+ z3!6QI>x9;BcfSvt%QUDvJlsMbZP(L#Jpk{eQMatXqqH-;Uis@t`D1`Ob7? zN_Wa;`cEF#ubxnr8*jLbHy9^QIkfF$*{153TONt#73N3Oj8P15HM_}`8tt20{;2`l zF|ky4E$~J!ed^+jSYM~QKehLEXp~Pz%EPCtKE&)a*Gzc{Jor+t(gb=RCfEE5gvJdM zH#7vG?S%tTEqt6dQVMR9pf((g(~pxAFC^d}-^ZFk%BKh;YpN<&Ou*{A;o!SmIT+9o z!rMdKfRJ9UhFRN0<4~Ecfu~1g!(Bx;ut8MVdSpX8=u&FG&^n${ z=QLICYD*~wZD4~mO=a0@d%A%`=rE|j*MT{j zb14!2^Yhk%W5TZo9!0tW)s_V(r8N2ix>-@SkAVI`_`Jqc{JZH}Wakgb}+YRD8H zul8L-TSDvIk5jiW00xbE7^9GQd6<;#L1kl)JpoQNgTIH)#r3O)mKXBh%bk)eo5m>S zrrx*T6b0Mp;v~A5N=tzKvlTroUBppaiq|T{7 z+T=k%O7uDFs)jzvU4O}GJ6k5FU*2870By7E9U7b9m(?T5%0kt<%2{s_2bAPwXH$50 zbzT=Z2^zQe>3HIPgi!*1_qrUywsr2c(`bMUxo_sJNM58uA8jzk>PC5XzeFMJ+So@s zur1P;Y<8*A)Lt?0R)Rz#y1gG=fy^BwPGj1Gp`?UogSXoz>I7?dLPIIip%Y?bBsOk; zyy88&n0=q{%Dc_Zzu>r}Spx?91aHO_oC}Ot9&$Ql^i!wAU#5PP)OyGKPS-aIL zPf}WvDwg#@NIT>Vp)~MY9n{;iE0?(CvvjCUgb7}o4lpwfqOwYLt(2NHwF*_D^vqaY z{upzE-t?Nzix=AmyCs~WREPqXlE$Cahe$9|w*EvU$Ao=5^OPvRoYMtrj?NCuDGg48 z>fSHu0E5DZ%a8QW3c7-Q8)Hx|Ww;2vqk^tysd@aW_sbp*NWs3z&2S?+WIwWt+}(gr zziLR_Gc}ocgslRB_tW*ssb%hfa&)p(4VJZ!^6s< z-d#TFUGra(Hr+sCrT`Lm8uR2f5SaA}@5?VNblyB%Z!7fI;(#>i0#Xn=Fq3iipu%Jy z0C?dpmOKj>GyIqaZX#XK;`cha=9Uz@gB|-Gz^ny_;3COG$m06#2#}7W47~I2c65aJ z7y^}2;~tRmxj())pgVYpT=#aP$KfL-y@?HeuzlbN9#A2&oviNJQWHYek^(DTs{ZHy zjBSy|c&R(BF5^(T#dAtU4$#F)=cLZA?}IL@4Qs_JM5H*ysa%??43<~b*M-486fCbw zQygD$&XoW{V!?-?52Yf6?F+!?!B9_#&A<*-kB5?bYci>R{MOxU8c4^U%gB^o>!mTX zT1j!tW&`~T@)*v#SkN#$A}+RZv54kiXR@s(Qw*LQX??aosU6_owkBeo2(#k0ppJS7 z(j;6$?0ZhynldoU>CQV=!Gf_cZ9v^%y4xD)KQcTrEc-Hd0iNNW+c0%+zuAvo61J@H zmPpgPLh-4D#Kg4&Pw$_qT1VDRDqThU#bo;n%`WoJ?#DaQZ*P^en^Z zDd+V%nKCbB zHxK2hiGYXUQ;}}1s#8~QFE7rD|24|j$UrFG@|Gb26+8fphNv&Zogw>tjDUWz?ZE!% z5~09gnu1cLR)vZC`h>(RH*HI9 z-vE`ar=jt%we1^K=m^;V01PJl=Yry+Ua>OV10JGa^v(*TV$vd=qAB!n99rCm|1%gLhhgC?^3ebjpUoi=6OLoQd}*}3N-hG%Fu@6s6y z27L&O!vr9AeD)@q3}ff{?N2%~=G{#^cit*3RV=ZBX?%9ZDHss_<6)Z!D$(2vAYXR! zeqd|^E4&nUe~ky@9YYS$w;IAukL(xTv^BYU2cRB0V|ZfahLjG?`d{gJCp%v!)W1eV zRFSgbSFH3FuRfb;Qty|d>#If=Fgu%Vr?DgA`VTE7(jo~y=j3z&|FK0d=x;2Nuygu! zM%@RL(^0@ILNzvn%ok&zY>J4DUHMrBwq5#8gCiBDN`P(~c6{viF*rCHfTv*Cjs!sn zD!jHcR>;dXd2JhI$yhCSm5B338C5EfHtvBfe4X>u$YnIpZa?F*20S?K!X9{j&in^J z@huWrFWbOUT$f7vE}cT`4k&J4{AYXP8@@OuX4vkDqo_E;Jr43NH2`U>RI&e3HZ3*z z3QNk(doR`REmTNR-@Mi-ONQN|?@qmg@;@?wo*sQ~4WYabSuTpvg!stCG@`@by?itJ zT#ks+&z7p#r1~LCa2PDc+w9$!t*I(a#nnN%>eEs^fM^;z34jGug=Hcd07bP9+uzFP zYBd*q=)L6qiMk@*z2hIRF)z49x)Xa(ZfvF_23bkC>hp$}E$54;&*{d^M`^Qos=B&& zsCmigxI?*lu6I(r5-xe-?|DSp1>jXF-?@ix>yTgHskKp5`5a-Sa&Ry|*yaP-G3%-d z)++-&&|t|fAEb-&yWX9cb_#^7 z`Do3lki+Q`0It|Es z1q6!%R`(;_)2!sFHBDdMlI5lheK)%8Tc_-(T|MTK%t`pjyoqfC($}xo{^BA}B*6ew z`pKy8mZuLFBw9)N3eszy|K=?ld~%UUcki(R;L>U`J4e8cB?@MO{tIV2b`f_i+7V!9_1sb|;H#m1?()@A3Xsi4J0<|C_rhh+h zX{2fl29q>?Bk5~>0kQ1BfIDgTKv>_|D*zK@Xzb(a8vLH)@_BISablfg3!fvx!_}v}b4UH^KD}0S8#dv+g_Ww1qq?bMDp>ddITN`?nbD z-P2}q00F92#AZX~?cCfP7>vW{c)Qzr`aBr(1mbH% zp-qz%hy3?eK!}*@ObO-l-<-Py+Zi17I@_#yOeL7Tdrlz*j9^oXL~6ngYH|FTEN;nnkdN{!iTgwq>CAcUJBDsBh@v@_x0|=rFc3XWYy@1pF7%q~{|PuB#g+yLd$Yw`k#5m8vyl znx7I{16!(po`na464L1tC;Z7Erh`%)VIPbc71MGS>=B9QS0Aa1xi-O4;`gB*Nzga zc--^)X(qW)Jq6TJ3M#tzLzlsrvAIz+EXA;lkHvR;#S{^+493ur+a5|q4#Sh6IO(wH zrevhJnBVyjh~^nXbbz!Y0jM(3Z;yQiT52WOR@uW;8+cXL6Tdd>->t^j=ud`%{Lal+ zISU51OaLr;nxNRM*~{LUY2D)4CiEseBG_L^^EcS4uRkT;?w-V~KeH z>Cj6>hNnFlZ0UXN&)Myof(3i4~)a3nU>3{d#+h0)~yj^k=AR;+=<4vIjbn2#;znjt>Xa0yjI6kW0``OfA zoYLodyvdz}0!F%`&dj|0A!)WJI|Qd#i;|4JCbBcEL;^k$CmhPvX<G+ zJ2#;D*%cC{XXF}wJ6gQa_kd_vY!$$0Ewm0gj|acW2MmJ-P~sViTl3jvqZ2F##Xz92 zn5b+^uG@eLHA>lbrE79)$T<`Y{;Aig5flD1|8dCWI6VJH=i=4B7ibEVZ2$jlrumuE zG)Kttb;=!?t?OciRAi8E{Mm$nhXeW6S@d;>GJ%MeUXfQ@)JbqcL3*6F3{LUSf!L0I zhf43-ous!lnWB>#It9uf_Ur3Qi)8o)H)&fHO@Fj|tdp$RvGSv)g0{i#505s(3Pr*z zz8h^~OJS*r3OxnqRC)|T4=kEYInz?u-^{4jqymun*AA9|ePqpbu*>*44RXgtrHY#Q zV3(Ttr9D1ujD>=ZE|?OJtBv`1gR=Zgdx5PU?_&&@n!DZ+G!kP8#Jp5YOf4-q`LXjNig?5oqc5|mN{V^YjqmuHfWm^HT7=+R^5l{71?L?=sxJYQ%Ot?i zRnQw;rFs4G zL_-fs@hE5lCHS-JexeGP*)}@*zf$y^ z3$X$-o4AP}*UMXs6??aVKO9TV%;arvW4nky-QG`jk&}t902b9yeOOq;yUE-Ey z>j!@J@-$@1ZeRY=>O}oX2!uQ-)ANTPi;n{vSw;5)P!;qMS}l=MzVfS8`2Ei)L&!8+ zPyq#1E<;nh2mTM+pxT8%#Nxth$tVQT1_|0eStCG_zTfllxGcqA)%;JXKWku)e#?xr z*Uqx5q?$s3&eQ*(U4QYfHrhv^12mIjdXSRg5GDK=ugXgYplAlBoLwN-_3S_)m@gvv zi|so;&4^bg_`ZQ57(~gjX1;jo)K4)CQ?B-^hefyvIwD`v1bxtoCW=0&-c>AgBzo2cxEPEnC>lJKOea7J!J7P1Y@geAN7pa$aDEvZSil zU_m`!ri8H8GzCs?7~n-}Rg!kSQ9^pkXUKj^dZSC{tb)RbEmrjH1O}jzgcxfZXzqaUtY66dEF9{_^E`a0??PuWv)t5e1(Xv^ z%?3Zb{R*{@nL;zG9`DI4TZvavR+a}L*}BCeN(y78n!4oMQD$~Pf0#Tj98(B5e*J(f zL0GAw*VfnXcL)T;!COEPEyudS0Pw!a7Z~vMgYwCWa@+07^f=`xp`O&`k?@Gv*hTE} z7C2rE!(_XZkdVlAno!{v6nqcnb2b3o1q%SZ)_@JUV|rRxbrf4chsNIL0|xXx8<;fE z-je6e)v?=+=Q~8*Wwg&#SWc(5Je1IbP>n>QD$mW^ zoHIE&D@A6DfzuhUFET3A%`V}iwe^1(^fC>=r2|z9qbHWiryf(CK7Bf9pD5j+?T9$I zYtXx{*rv=l+lHRSqETUx1jY(CXXr92mL@C@hD*B4YUy!p;qw5({Udi?X@6l&0KFO@ z`P|jjWsC7Qo}Xz148$N`z@-D)D{S=urTKB9eSxafeOZ|7>~a9VktK_9Fle3X1;<6p3yC(Tg*@yvpmG?Z0qH|6I8L{1r!#G(!3lo?!Ar z{BcqAWR}?iBi+WoZ5+rTko{uvzx`qvIkdEBr#g^HWus;MrJSk983IOOz2gxRlK5SM z^l!75QHigtge###60Gh~${>_nT=I2jdmiTj;f0jAggnPXj~>My%qZzNNXI_;Z9)N? z0p-A`IEOw>W&k*V!M<~vaX!uQ;0&tVHv@CuW^?>Ete<{V*qh||pWpOf>j3f|P_+h= zAg8QSCI)nk0V3{rr}}eZ#Les9lih-UGzR1={B={F035pLt3)8tvGcI|0m7dSZ{w@* zO6AV4Z2YgEJ*B36_Wb$Tz5^4YXF$Mh!UxFgChj9WH-TEbfl=}DCyLtIT4BA2pWNjm z?KrXsH+cfip*y#4-8xQp{A@D{>&uaCw)d|6^Hm?Cc)5sK2X?XHDZkWB zz@xO{-grcs-pDx9-u7wa$P$!%`MW)z1}aRl%d;mk$(Q~iEM}JF3*oPC@T;`)DGy-e zb8{aCq8i>5(UP~YnsDF*itl=WiH*TZl8A#pO#k^vzgql%{LDuyKDGF3)@Q&CD|6P< z=Ec9#QZ)YQW%nQM_a+_uodQNLaMJII>(1aE4kh#OW4Q+b!tA`n1?{x=L%G?Jm z6mZ&(LaA?uDy1+y0*pkPSW3Kf?UYU|Z2Jc_VxBAvr`CqOxJOp>%PSFJW-8BX{fnyH z(*eM`JYRg_(CI4nLZ9&#buL@{>M&J)T!t;fR5Gi{j#ukfave>R_VI$zsmSu^tt zDZXGR%2_nCenhSv0I1e5skn-gd((TWdJ^uOx_lX=l`tQtuAryrpL}=ST&UAWTuK#C z@fS)^@HBGE|Ut70~<#*eMrRl2oM1b zq}TKyelBjBYd_tZtXcoO5Lq`_Vu`Iw?GvM5F6q-2XhD>VW4~LwDA18*3qUFKcUul# zc`l(-A!J8sz3Q+vMK zFRhH8<~`?yqVx-ZhPyP>$p^SYpn!#<+L`mQY{GV4RLp~JE}eLpO7A{uV$78Wwq(|_ z5bQ~da_EvomF9Coxdc*`rDkleZ=v**j3qoV%QChcIYn0eFh0>&Xdk2I9P2UuN?5+F zX0Jc~)kA}yZHFm=K|)5-K$OO9W<>6LJb53uVsmlZ0>p~|rGLJ-vUT&lxzyn<>h3b@ zGs|>3AVGBicPREDNYqVV;5@y!G_&A2d*vPEI$K}gjd+Na*N+S)c*yaeCOr?h$SL^F zekn>C+C|unFa4iEUn|!4#qNLeEfST$tkk=Dz4vWFZ{Wp?5Zd+5tKwZE-ka~ZXg51o zTOwuxOrfr($1HJm3dLVY&t?{w$CUXJf;Z8;S~FG&P;$;7l?O~+oPM~pcOQC2A(lr> zUcAyE(Bk6W-ZA}O@-_G9j)FsNP64VW8o`_#91DObzT;m7N<;%j4ShN0XV0BW9&W?_ z@xd|?SlQMQX;3d37LkxphuaixNvl-7qhO!bb4wkP@e_H0(+|wyc(h^+?u$V+VQwjI z$0Y89K(T|ex3@p;$-+T6LyQ*MOA#!{6bmRHUwE_<=dffW(*w%KY%yhZ4>|V!ddp

X`Y<`ZCVK##T=uSic5$&!YQ}uOqGDCmi9sk#> zD$t(rjMT~P8jiOhI><9J$W@zVKUX$=yAn0 z@nS1O$6#%8JwvVWmS}Qw>^puc?7d>~3cxG9ymW-xCG8Z~-bJKGh<$MAqS*uwCBvgo zC2(C2Vp-d^UsZuDATc*Lcepza*!?0jf_g9GBRkuF(oG`rD)n=j-@P%=;ISsoAq^ImJ5Mfhz1B3PBmsiZnI%Ibnep+FBk#) ziOgRHlX2B!FvbA5_7L}4x9+n0F!Ynla)b@1PVa6}JyN2_!I*&an`zi~;)_c82!Bd1 zxBi0M9`;@?ZDgO7TAF;j_MNY3Dt1dDq95_WYOxKze3+4iJ6qsij&+;X-9o(cf0JC*I);~l@eexAAF;Nhxt&43)>ifPXJy1T-!zNIr<5t9fb_wA-EXqB z@l903#sBMeAkk7%Q>%5lpCrQMGkz{s{Buf4`+=^dC_bP)`}XbIMQGfAvC8y>jhjHW zE<%;7yf^J8y&lI~^_aqj+%1K-AIFIr@|fE*AIFb3j%GI=FYi?bJ**(riE%TFju$yX zM|B(yFYH*h6n#`QbR4{O>*y`$7fUk3G%YJDr=oj)H6*qy(-bP?iWi1`IyUV--e4Cc z=aeBwY;MX0Py}gj zN0U8K1EM<9%eMRp^(EydF}Du5Q%S~D$*jmUet+Th6kp-S^2C(=4H z7-1}5M#gAPPLQ(RJf~JWD_s%@c)Hz(C~tGO_a4HD$qW+An{V@RUiX)rfFvT3D8BFi%5&jW#~ezS2StRBxAaG?^kmYqokscbQ?rPzIR#Oj9 z+!qw>4x8?v>;@}!fRxk2**CY@qQtHN08rCFebn>dn8I)PWyu@6{w>EjIr*Q99{koN zcJ2lcOd7rz9g`Eq3B9rZDdop>u+h%@bT>OH@ssgsXnwD z2Oy5YZz_3JFId#nT`gN(KO-mCTzn4#6L0srp z6}EB522!LXOcp8?6$A?anFbPD1cVTP$eEtx{b&1NzC?g5!}#0-H%H9GY2R-s`SZXg4ej(WjttjNK9d5ORK{oTN*eOx$$qYKzew9rk6m z%ax=YCj|fn%yh7%rc-dq=OpCZ9eJ>saIDV#JC)dE2~5at_4_VS<6;(ivu;pyI`LTU z8m2(yhN+oZx!g{*Ex6V!Uf@8gU%2h_@Y;)G%q6{Rmy)Zb zV}N29l2KJXn*0T7DS#&}3?KGD>c)z!KqAh~g(Z8#b9LgW9t`BZ_YHVP8~B>$+xcfS z!ea9qA=sdapil1Qt+PQB&9mLdsNET^ec6w=bBD3to>s_6|JGb(d$LfHb>7fc`65X( zEZJT=O#G(ejOVT=!g(amXQX{5KXFvS74kz|F(hsqFSm`VZ87$`Gm6SZw3fT8m*pm$ zmPDY#G)of_w+`~PmSLhUV~TaKu8CEZ>rqn9_JIhV1{75QEd}KvhEqyU_wE1ZKa`Lx z470s6kQ}PxrD1y)d%e09Q{~fCUx-Zz^f6kb5u+L+^X2n;j>sbW zHjWe{ABV&?BngFX>d|6{Y@?BOTjhg;*&BH6ePaWNp87@ip%czCiYK;+puMApVKq+rnPWbVbfQN`{1iCSL)G}W=le(NqSb9p36%5$e%@9We3ME8Ee?5Crl zw5{^IOR%wo`-JgaxqU0sTgEJ6$mkQDR;?i?_&8X+X^zXSJiUYSHmtC;UnMR+sdBrU zcu{7m;Bdx+ZqcvlB7Qighi)wMdXKQPnMGgC`%^^Tui5XG&1P-gNBZHzrNUi%AID0z zMoWua#|K?@xIZ$(w5%XG?K_!3Fnj|^xrBN7%Vj5TY`uSG8SzgbU;Jgc^m z^qawKV(02YILq|fyng?u|J>enW;o+V#J9;4nlIPZ78NVyS6{5I>T#2lg4m@$DmQK0 zGgBhIsVev=2T9L9C6s^s2ry8+EWT*3HA+z4ra=1t%q!vR;)Q zJ=Aq1E9CRHZ%5_6mqjO=px5}te!dppAGxqV9_u0P!eUpgMC;EOk=bDc{< zEOk3`o&M)O{MuT{W_EKdUngY}?l@Y!LG853mQpv_$oJJWAgG@|Xfcq4-?+bC9Tpqm zR%gvuTi{qGibi`h<_dOYiQmgKj)6r>XYCkxv>o7vNMHmZkpHUwnwx+xH=3h6W zxz8bQ;~hCsROxMHH+YYmyL`^bGZjKZZCK`J#38@=l2!Dfw+93pVCyzy5bH~SUS91K zQR=>q&T!tj?(2Eh0u9SK27o#Fy|id>&E9obb_{y?fxeEu_j=ec_O!h2we2Z?PmNEis$3?F)nBq&dS*79r7<8|ZzPXg zN@4g?cuT#dHNnNcVDL?*2-P4E11Zm(cNgwuuw6!~?oyj(YBRaQ6 zvp>(>^fp*3#*Fy1Iu)9NwEWl02<)ctZs+upwO4RfDpd9wZ1{q6I3AOx088FX!0m@Bk^lRE(V9z zFcDvlT>Zs;^Y3+P|3uY6Y8>6|KOVz#FjmFbYvaMw1|(eL)k>! zw2`X!Oy79IJr)=d!ENK3VvacAp5cfUK)Eb@xtFOL%)!-W1&8u?Ikv~cGi`W#dL3Q{ zaN%?kSI}xA(vB(k&5`?sJ{EG9h-u}XPj)xApm%*-zSF9$VUdJ&#M>U%76Xyc*RNlj z`O4@QRZ7C>yZbp%(9V-)_@I8z$WgYGSjH49B+7Tf+i53uYk_gLsM5`RMDu}_)%)n^ z`5WARRkp`i#XN5%wtab*{5349)7vN;V&0z)D@e{y*e%fVDCDHDP)8j+FZq7G(ge*o zDYevMt{e||-G%3V7bon46R&~Rka7GdbS+Eh9oR3U(-$8$ytxd|vo~_j}ri5n=UN9)^y52H2e|aV&4QDk`r@q>#3F862NnG;b z%=2{Wf{puu-sG^tX7c6z0x$I-MK`;<_X>}^94vJ;U}o zvTl}GRbd{Y@FWHA4cm+%jFea*nV%m#+Lu;YA*F3%l0dMo%K&dU@u7rv4O3*eQ3^&W z0!wph$}GBWZf;(_?C(CgZ2x_Hk>_cru!4v`{mJ8e8mvfadWWI)CyDLot7$D1hjrK_ zY_9!?;DvMXY8~2)@gfGVf~a8qwF$beLl5SA`%O}Cg@{R3z0ZMs=hIUy6vPhR4gFLI z#(Qz$^I&w+O69SMyi@3+pvA&Vbl3JUGjGaUw{C&hAgme5lMv1#WBE8lUS>ID-bvyL2x(^fcm_Io*?NV)`i8~^7O)-#HZ9elb zCgu4K`X?;6^sTLbxP;cPPSgSQT*d7l!>db}tdOgUz^lG)^Zg-kM@NSfN%$J@Nse|+ zEhzzrs?8VvG)WAiCo?pF3wl~n#Aj}nL+6IcycpF0oev${!*4Z)n-;UPyQugoW@M+; zjNu0eEyR}ys}=el<5yM@++`&=UfEb~kE&F{$U@2tfP@q|_}a^@^{t<8X%?y29*T`q z|KbA%#{|>1%I2|#6zhEAlnRj>Z{J?$Qyj3|C_ns0eqjb1M0+dew4dlXHpUwfI_M6dSsnB4TyT1w1f4aPCl=YbBfHbA^XYT0D6;yFDi?E`!q!!VrNi~yCsF0OXD#LBMGEb0+3t6L zmkyD&w3Cyz)$o}nL8Xs=tHzGF*T{Z^kv>m1jbO0pxf??Fw+)+Hda!e_ZS5f0>D2pi zeoVq%rZ-1sFv&*Q^_7|}6wEN6Hj&(d)=()UPyN8nt=)xQ+=izWvhdvwe&ghL&+^dQ z-jscn;JOlG_8qYA7= z!%mvF6;`(+S0_8~h!vOmEk+2r<~-@1PtC|^P^=AzWtja!!QUkk{+v(!)mgEWtzxpV z=6*D`p4fa^GET=gd|C@Kzz`lhEPA($`q*Tz!v(s-zYXIkMd5XI$>+~r`MvS}W}6pT zSY;B=IY38UzoTuu-wfwY36Kxvt5B$i_hVgv^vuZ%6uB(hDo30=-?A&QsmhH!rgs&saiKsUX2zf=0H^_-u8+yeo zA;yh6W=9;BDrYbX@mZ1gT=|i#E>d3;s?kZiZRDkBFGQ=eOf$?z&MW_vTVJ_mhM&|YuIY3s099lmIzw|EU8qL?kF*+&JNXGe;-*4F=a&2Bm$NYV>adtkxgu?D@ zgrZA(+|hiV|J7C5bdV754-lDGAHOBgO;<-o3=xv8+aI?mCRm-A$vrn0hm zdA5ta@!}Sm>a6PD^72g<_$C4RZTZtCV)-EE%zwT&W$9HDb7sa~G)y<~VyS#M$at`@ zaNoZ6=y4Kuq*JU6Oy{&wKf>CsNdIwAw@k=je$AweM?wO4+KP0`+MUH%^LckQBcmf} zY=%CCVwxRD{mlC%G7tlrIm``xNEy%WbSI?Yz&@R9Q*SkPXD}n@&Ye}8_PgH5#SAxt zyzKe`x)`&`m$AL~mjn-IK1igo4&mh^YiSKQH`^*0hKL4?z zhZq{DKFcy>NV?omPx&0oC1Dmy1e1O0Oar*e>)regl9x=%xAb!&Y-qXafXbro7XQPQ zu)x+=!1KLoiGegK(+_suVRwf3KzNcxnfi`@molfVD4YzR#vOsQRwuMkq{6?pE?9t-5cBc~rv0jV$i zc}je#lDq#-_g4A>=7YSKZ#W%OP6;7g82O0-EzBqRyWKmbWP&E6%udV}jlx*={o%U& z>wB$VgfAW060lEQHccNzCwFRfFl_Xvl&59rFbjW0>9D%)mCI-VSH3`UEy&BX{M&Br z!;gYev3Q8;vX%e(9Ny69a1lv&=#NDfe(#3ApJqld$2PgpR14yBdCGr11=kI^tASHUnM_fyY z|hdooxCR*qcPRQR~b%ETGl1Zj)`M+}QdBNy@?{PF{rZ|X zQbkkZ7lmSH{Ce;Z1r!c2jzbDLm?CcN?9nj6K2%P=AQvF)j3=s{bUzv< za8G7V8@^@B}qVao6R*FAC$$pZZ3h(;tlkk7}Y}r+j zjXI}&ZEU6LB59MS#A2PdLd|C5_rI;)jj%L@-P$_LNU>7~d2$;xm}=kf+K?R)7;o!7 zdM0SEbR=F3WHOX^SN~56|K)=rs^(yB#Layrn4-3w?*@*Inv?|BUGLlbp}cigNS9^> zzg!R)3bs4iLQBrlZl)gwB+`?AznA~b1FXZiE0DEk#MX)jEF!=M~tTjNeX@_94O`q5g7efmm5L%N~XgcR2CL z#s)wE?FSD2zn5YE?&xQaQAj*bFLUAIpGC25B2;Xcwh<0V?dZZ=*i%*08)Y`gXPYX` zoIT~%i5Dw-EcD<$Wu>Ed+)}YdLZI%a3uWf#&G+=?jO2bF92$E%?Zkh#cw9o+Nm*H{ zEvV~bki4kHd8k3c)43eR2KOGP6iG~idu$JwFa259*1I>cC1MZfQ*{)coSb|<>Ccmv zpUV}GqV4Lo7ZT3N{ru5mDRJhII80UE>Yn8ucdL>~F9ikB&Hj`B9*_0=m*PVYb@e#d z<%EIyK69_|W~>s%Jtry4VN|`Y;qN>6Ph*lf4@{dqiPJ~L`M+9mP^P~ZpPT!!x3vPL zQI3;M8_X?033rzM!-f3)RN_A>>AX`yS8f|;zWV(a+QWB`>B50E)&_#FI$rWFj;Eav zD-P3>H+Qq#YrDYus_W~{Wu=|zoe z)}!9_dpf*!IkpcsZtd~w;S@<^_g;GZ{^(xI@b@MB&n!V+H6HkcncH=@-T1ZiiX;lV zx)*besrEP%@VL|M@6{9YQ*PJE{r-LTd>WTzCHuuX=3!mkdxgbr-<>JTW8$#F%`bkx zN%2GqFlY!!=d~rB-Q(GQ|B{j;Q!1O`ut7@YXmc6x55+w_ra`qde0x2o*Bd1;P8rO! zURSv7_xor2{q}&UjtVTOtC?fzybT<cbo(B;E+Y3a5(ssHlzUU9(Jci}lV%h_U% z{eDNPc7@x!y3V&d!bs<`p?jIt?^a9+!k7x&dvOME1Z2l6)J`yxfCb2V_gMbyYyJA~ zve7i}5eSgWLm-u|dvqm#@0IbnRS~77<7=NU2n5b(c!erq-TS;P?a5{S-}$bccU6V< z;QVf;usCGy@q52~sgIkoa;?CzUX`@AYz{bOJ2g)--|mAOfvv_#n6QY;_k6HAac#|C87~~f;4p`wO5~&2Qt8>KKVBt#Bv6Mn z7X-EQBkba*RDwBj^wQP7xRF+Huu#21yH{vJpL*GmA=_b`JSh94UHkKC*Csx9+m6#h z@Lm{8StC+CLZPg)BBb?47Lp*y6**3vbY#$Vx7G(rfZmB z{YPU+%jVY|9UaUY-eLi@BEmxcxPn=``q~9)ES3TBF6DL*woP7s7aODaQg*3S>SxWK zpTE%{NvVola*r-D1``_S_}#?3x*8%MR~LJ%ud+GeP6~%af9bB3AupqT6->-qa=uXr zB-|?9so&z{t~>K8nQ+sVM^sqpY4~AxPfKdN6FE+<(BGEi>eoor!kg zf7Oi^!#egTsQl`%0(&pLKDJXtI>W3`cAh&Of?n$@%&Z)qXpNMXb@Z-Yop{}rcnU>s zmyWw)-^s#!AW+ZEs1!*wCugiOIHx|?LB-}B&}w-k_HxCqRt<{}6uvBQl*`%VgSh9_ zAySp{YKI!ee0wD!$K;2z=czF;R5vbwP!Or*c4^~%<0ae8^6e=Ul*Q2(d(uF!?3_}3 zxDrkMT`!apa7q~u3JSM`tD3==esfrEz2U@ar#CFzz{LeJcudKAEaZ{3+ONJ8yp;ve zR~Tn|aT#8JnBbehm?F_*B_1}LLy= zcKZ>t9D;qwtzJIIr}pzUmfjG+L#Ar2++1@(-*N~aD{Ho%dTceM2%>A()85WNS|wF7 z(doAj1@}TufVMajW@&es^lBy!#*^hc817Ux`xZwG1}C1fp@Zstx^27>Ua^Dpb!mF_`F%j3i=Y|uti(GA? zf&v18z^ASTlS+lO+nc;cHVO$)jL1ZY`~~#J?1UHIyAfC_ zZzRqw>&L|HHX9k~H9zU|p{FgmVkw9Z*}BzCw?U^r_aRt=9~s_lnnnLo&Vp3~Z}0^lSW;1K836{f0&|@NTL}ZxM9W zO@3heoo#tZy@P|Rog>ON2kQgXBBqE&uDB%qhMOdxAgjDx7T^vPk;HYv<%#@vYgoqn zPe{wVk<^GIgU6!7o-OXSDeiig6V|57)oH@jez?q)NEy1B8V(39EWMi3tR(})a*UJ< z>#mCkzJd_u-By zUw@P^-3If7K|PoHQ_>0#@m zWM|@OqG4fior@6*8QnE4&$UqFn${Z@^vS_tb;H9w+s$ac-28EGPTy}IypT$p;Vw38 zcjt~50)(3p&om82F-8KS1{6jD?IXmY9{a&HUvvFJJ$ues#3rkCXmmABM*Bf%g)eux zWJhJrhVdG>KwpXwcZ6z}bOyzjcth1g6-i^>V4ldgWA4g>kpOFOkh+(^NS)&K-u z{Ls@7ASGKI7p<429lwa-;?|>Pn3=Z90OqTqh7cVcJ&vqgFSsAJfw&c|IUs^+-h6Mp zONLk&P@2yK%dDLBV@lS%z~7F_6txtx(=zK@0~S0W%4UiN_%9yxc?Pk4{r zJ0<+fGt|BaWYmbI!$VL1k+vIQu7;q`QD100}w99|8Pa+fE|6pIBc zQa??oxMid+Q(05vU0KHbmPcLg(aD=(28f9pYBc=P z^9?mX7fp;HN#_8T;V0Z-c{$FT#HUz^ z;dFfUPBS`^ie7Tk9_mYa?z9CXiIP3%>X(=iCbbCR&^Fj=y3-Ia`2)*kS(g!63O5t@ z(h?;Wvg{h3*+5BS=AMt5ELtdN-M5;v=4ti^IHK{d&Em}r>_ZjiSBg)GRg&NVAg*j$ z+gBAc>TT2vP-wT2(y|&K9vd$3-&g^@cq&1Pe|>fA5_O@(?SQ4Erx~R}2D0lxb(CJu zmGC3Nj6V=muSVQ&FAGyeCWl>R$6O$Kb?=OPWLv%o66JA;0NvyYBh^i3?`R#>`Iu1O z9=4RP23cN4iNv`KK~{W(fn(Fws}!p*9iT4B>vxJ&-&+~(P9kG(8u_@8%eCM;d~%uz zT@EBe4dqUi0vN9oP5M35EAvq43nM;L7MGq(u6Qi0MmY^~ZcTcRHjO^Md4yXs(a5_^ zylpKvxA@1fW7}ry#M;V&_ziYhKU~sNG<_whZT!u1`qzwF9=6PdAF6Y>eeF~XeSY-U z;#@Xw4ycXd7iHHRQjA<2fai?DDQwP3(~jE~`G`O_n??%-+S|B_^G1Vqf9>2Z!R!1N z+7e_pU-tarxdZU%2V+J0Hw-Rt<5uV{O~)SqZb;=xivgKHh9eM9Pfx?QerbtH5sYTVB5E`?H@|4|-*wWQ zsuWDU2xbZWC#qS6=BC{Ein7@}|2wz-EUndK!Juh6RN48SOjPh4{qrqNB90-NzSDtk zucnW9w&?m|mF1sL}e?HaTLnwG#2$!L=)$m0*5uDJq)3-n{ny6Ra1ic4{9oppl)sp}*aXU7bP^^kPDNcJpB20pEk0s<*X0 zy_TL4z(Aj5au{>_vZ)~;*qtHcdsodQ(Tv4glNr*UF*i>X1w_eh5dv`=KrDJ~>1gJ0Ghl`qD9DwA_;^K!#I zmK9)+VRs)Ctq4?9AY9w66pnG*br@XAdV-zS8>dz*mvvlQayPChOBR~fZZ{WIn=%-! z5Th@|jj1nxQzmL(Ht}*-4V6Fbf25ylq?hm`nse)35uVF-q)vK2g%A~}&OR7<+-*y_ z=3bQ0d%O4A;RP{x$ij?_Oe4MTx{kfVTAZS{?d`^^Nk~Y(uSnFh)dz^Y*2`x*QnWf0 z_`-8@*J3wg`Ll(o@JYT_G||HE8Ey0q4G0X$I*o5{BO#~|x|5Pj4h5LY)~b;ZOdUDu zOw=l$61X=tfim9Fc7j?%D$+ajcLw$!z^j6`_LVmN50{9>X8P0F=VDYZSRXB;T^DEu z9^urF8@~+AmsoBnikxmo?FLKXkc87~1ta?W~N_@4L70k_|#6 zm%~b`A%xmO$sntal+4@VZO8`a$31CWuch&nK2&#z!rb%s&tjBh3 zUNrWyUbhubA*aKtwZOf7nyo;0X$R-HHaPP^LgJvs;#T31Q*VVQ>*z`0vd1a$QJd?y zl~0}KBOsYuPtzHX6s%hQ3HK+AZ@MGm&`SeS^?+wluyDaZ&nkj3LRX(}Awx`kqZ>;} zb_64d&8bEdbHlp#@DiVm?z1oUQg9Bpxl-EdnRZD?3_cIg*=KZt*PnjayhvoJZ)ONL z;qBhqa^Y9Ib_!P=i3p01h85!UhDIT3b;ltPw4GiGDps!rNGI2svY<9;^J5Wjqe|K z-`%e4%b%O_@MU%=D(e{8SjY+;?ha;`mWyix?l%=;YTq)5LJc#}%de#jO?IfY+8TE! zV1Y+uKEMFxNHUG?j)cB$;|skDUF(F@RV{dvQ+zHaCZPjqWFJ4cRLu8TjFdjQ?jNaO z?gk)4WERI<|BUVEw($^jMqZW*pNSfd+=}h#XFKa>p&NYMt%ofFPiAgWs)VwCm*B*N zgY$iU!E>Mtsix*=$9u*D)3dn0yTy7lpI#`af`8C^G3_or7bEC9Pbbut(O?!bg@j8{8*>{x#v zpL!evHK&VGB4lR?-`Hk`Z|=7b8OA5eKej#A`%8B`YYbYMfMYSN<{TS)p=-c7j}{X~)-z*IS)8X_&3Q zRU2y?B_v|<T(ijEwGD9wz9}VJ>cs`NJdo&QJi(Acf zJ1tyNm2hMqoX30u(Mh29u+!?~LJ967Y-5#v(tEHv63ZfIaCxy~qS}gOYT49qnoQFh zHp^h@kE^VxNcEceO;s=d4ZcSQxqXcqiNs7tAUxh>Af_`3V|Siqg|tKYH|Xd1P~47s}rVsj8+J)n&8+3{BV$vV_C zRuB@tycOi()R?hCtzn^hGHWMPY-bMl zU8db}7(d`KnKSqHnXPckvqJ_5#^xfgje+8^axnwSi$G=p9ISr>%kSy>?CdChQ>JnR z(A`Tiv|bz+<6(hrjd)P)nyALM1wDh|LiWXE8Wc_2W9AFFn_~R zNMSd48n|)obYPHZv3clg>fMzags~9s@e=?nU#xn|UU3Hp3sl#CvxVrdsK1f|D*2B!=YaP|M8PZWo@Gfm7=nieb*|<5|y2hec#ua zNkSzQ30a0ys4Qb0`-~-Imwg*!AB-^=>kQ`ia?X3H^X-(*=QF?S`t(QFT;?_R{kre_ zxjdfh?XDDr#=>_KwI^B~Zj4FrofDSXlu!OCRXhQNJ)3^{FJ>%ebM1TARtor`xXvA( zE4~(D1~?H<(R^->Bi{n_M{S>FBG6UnOhh%4oMaGV=2Lg9&6q2BiOZWA0Kp92**Evc zso+*q<3-mWudS0e1R-vt`^KIb-jX%(1C$$S5v$D0sa*zD`y(IO2%TKERnc4V$8lkOo??Du6pv>#E)DsUYATX>K_~@2=JEEcsj$(#5D)})9AU(v~WE8f? z@rgdtRSC>TGoRqv-8tDMlMrow$=5p6KI*b?)1S%e7YR2B>_C~8!4@$jBz(Ia%fcVo z>gKy7BGqN(nKUzw831hr9+$lf0?KD5@IbqeQ|(Is*1V^;L7gV4BTemTFjoR+A$q-| z2#-NN&0WmB;hWs4zJC~d!&-ht0kW>ZjXTqrw>8;hcob&WckrB*gB`q8`3x?+gA=>T zB+mwvCMnb?NAh0R($Z>56j9)k2)w{bMMa>Mo;P<~P1NE^ctOJhdjdl(mf!H5eD(~y zK4>dpH(N2~i(Y!q&D2<(s^x{okk`}uj7Zsj5IG5w+*PG#a!yM5`DeZ-5)?6X?-cOh zWvJrp#@6yLVmzQ)2?&6Dd;5)Fkr+P-bmK%u&_)3s1RNC~THC?^cH{it3U*sP+2Y1`=Q#+;M95VeY)4{OTI&;bFq(Z%c z9J0N4yEg6u5ODAlilxfZia|f-zfXifmNo^9TDly4K-+H53rP_2w%F_2vb!!SE?NtC zXli})UQAy;hYBg5ADWfx*jgUspYp^$NRZ6viSr_Ghf;0RRR#DLgxxmJ8kru#P% z(d0?`ud`_Zxs#7s)dF)BaDlGqod1g<(PmEt=+*jwdCer$+|B*;);4y}wl>o}dNKxP zwu_hE6bMb21Z0vSegx%r3R-%39)@@BEb#@=h{GJghzoQbD#>1eug(fw+St+q)CD5f zmsl5>Uu~CJl-4QR_QUP<;i=C&6gv7CfY$rlMat%tVbvZp#BE23g@T-d{A#TFCqU83 zbd~-)ujd984%I3qD*CBWm)YHNj!!e&y+4FQ*yjO)Jb+?X_HVS#vd8&)tPUp5tXSY< z`Cr3yqVV=w6)STqmA-5cN35-_#AI^cxuZEBKjv1WdUt!qH0}N_ezVd_l7ld%EeA}u zMm6fA-BiD4oBd_SzGZHh>U|)XftyMCm^)^|ft&FXV!wOu-lv!V#@?}x>EJH|>!l83_EPyIwUjucU7v1?n)f?@{+t=)ivp!QAb=kPA|s^ z+3$wwffVS^Te~g+X?Mf#f0#@3-Hn=(qKZatjoyGFG&#Nfu5Xu^_o$X8!T9T?|Ks11 z)~(pcKL%rphMv$gobX%PAIqp;PN>NF98TmQ+5e( z`*hZ+9^RpM*M3M4J0Z*OJ)>B-AGkUcut@GX2YlC%{biN*7jjgDGXGJGMA0Su=|TIy zy#!Iw{ggcg0f8fwBqRws(S1u;3+HOekP#QNmECso3GL9^GnC;3Pr5%C!NGNmGAqEd z0{4;uM?f-udxTOe_>&PF+$gt%bLS|%1Tisyjwri?0~9_5N-qKEQAR>1Q-+FwC?Y_o zq3s~ytdrkOdH9|h`6Ya;h-b0dt}rS^C-wbe$YW=7S0I?J8ukdFSa-Akvr3AeD!nBS z0A!bMGQ3fs2nL=#1Po7lj7s{8GX14({@aJ!255jDC@T_HTa+0d2Vm0!04hpA{c2Lo z&cq_{{x?;&vFS=QrIxTsrP}u*1*MR2fMP809tHz|U8!+0#dzTCxpN1m3WbJ4m48al zJKOkgxvyOR&$J)*xL@%E?hqLL(kZ@cfSl`yQBt*7 zip(%e=fAk<0x&bxP|Ww<;Gb;#H{-OG()?*6{9mV}TS>+grld>%tCUnhw#2uLjlIW` z{UII__S2Pj9rQF54}&%4T(~Bf51-XId-na4vnQTCOafn$x_XuQQe{Bg@24g-F6{z> zoCiNWIw9c#A8gaKikx+nk8F7m$zw0BTGF>76*FroPl%0em9-?*$@*c$zBz3TG*ybG za*{C!eL3$}8z23xKKPog{q^>Wiiy!JrPGwT{$hmc>tX($mlQ#CheNLUgO@>c&51jD zrN1BR`#-ng)?k^^X7{rEZXo6Rzxj_B@~0pCeORmV^p*rH8GLVpIe;v855- zsXuC<@y~Hb!J)G(A;~(W9Wo*mVFKp&TK+D&NyZ67(jDJTru;b-{+OEm+4jGRbY->m z0;f@A{9RP;d;kGCI3_%$3;_uMMnab+x|lK|!eM)KT&9RKW!Ni9F_{^Vp?cFYLKGpN z&P>G|4M2t#dbWPzVcXjM?_L0u*(?jHiSeeIHwmbx6dC`aV#0pFakPIay~EeCpE45r z%AfKsXiM$agQPooBlq(f=a0}3yQa%U>?uQ1$%?M7fWTnbOnCD@l?~q|$(cJz1`YtO zNLy{mr^qoU1p&831ATC8rtqCR+0tKrMk9@?BTeG}JQ)GkMpBrJfW{_lL>aN~lEIE3 z+z+hA&JT(o?i{2n8L6r^QExMxKlWmdpR^Q`7~MWj!e^W?36j^TbFKnjjnIXD1RI-oy1`-8{+`Bxg@ zf0_t#Lz1o(!C(IU`~NTz3d(6(CZMHO_$o2qb1VhvffEBpx(b^PE5uI-%q@k9ok+CV-L=i3nY<(zTr4dUl zEhxjrAVr{)6Iao`)F0bI|5VW}^8!+CYcBQ}Wh|Ufn*D*y0E4aZNK(f6+X?;CN`MqL zKc|eK?xvb}KvkosUbRk<@gFLdZ{LCmK)S*>3&cN{#y=nr4c|X4gO$Qc`u{2R`7SI1 znD}POwlXWVp8RfKi+@U;|JjZLRx1ZVz-78={}0?%)gYp&UE4WP6DRt!(ZAmw$zO24+p?n_8yg$YX7o#^Fl9vS z3%Xm-p|fp5J#F8-g+Gz`hS_ZC8*?t9bI0_X=ZPA^Dqp|A9ig@f%(>RvU1R+L|41<3 zPdqTSh#ooZyeIJTS;i^!3nS924_vJxdj!AjcQz^DKN~A1U(HhTvW0bZVME3d#B0Ft z)s7k-nwlfL!o1H~X9F%W`s$1SP{&U`2s`d|Tg5xwOwl}RL9Hbp|5^<6t>4{W{>%%x zJd0#Mfk+i@T%^T{uGB<^5Xlbpnj^hHDdg)p30aCO^r9rphuQUWBs;PCurK{@|Jhq9 z-XA*nc`L|b1rpq`QW6&zciDO5Pg*}N#ER)ZQ-)tP zsa2m1!L6utM~8-xyteFN4-)?Sn*QE~NpH3fk3cM}T>fXNHf}r`&FGPQh3g;g>YeWmnue5L^3x_ zOt$rQ9+o9{Z`}LF8v%GI-e5j-D=M_!c3l^j;`j#y3EYqoO7n4DCcfbVOGr%{^A+Zs z%4U_7yCWV3xWo+g9)1(q>f(L<;^hg>zqpF-3+_9-e?sHN7JI(pmFnVXB<29n6ZY$a7HRuNK=hMuh?;KJ%YmAPX%W7Ym16GT{7Y?|r@vg{-!2 z)MjL;F+KU}W=h+O4QDm_Wzy7`b@GP~QVh!>Pid7WFGcvhAlsB8#lDs(KuWC{mGYud zBf0$(!jwKq=twoyZelQSh1*ge!2h*wM4RX$btzHbtxT2{udjYNb2SMAO_NpXs?U^A z{p#;KClLSh)IM8yr#F#y6z<%bAW z@sVvs;+|%F1*ZU?O{Th1AI(zJwiIjX;QdECUr~0VO&<~*IdHmo4@1pShZoeRMNgOK zBwRgy`VzP~S!xgGJMtlPbb$3Y8d?!X_wK;q`Y~(2>jI}+(>K{}CdW{39EtQ`8I1;c zm|xUA8i+w>SsnYTE2*L!-BRcFoBC|A#K`=!cb%p7nZY}adbjgG4o?$HeF~a5T>+EY zvnD1H7&8&Qhd7aEy>HoeJ;BrFo45VVpYwo~YQCd=ia)sC26$6qO{?f*#ByH$p*qY^ zk=It{y>AGEn5&4@x?`K3mIzSC@`Q||!&fx_?Z`h|N7vr`tz}i)bjvNqwB!3bQYFqn zLOR&Gq6^HlrPf>jT?G3tVwi+0-pYf%L`T!E*GN4`2BQ+xSDM&YTl*6srRmlRU(qMf zU{_s1-Mm$8K`#%Ed5`eIH2Dz(3%o-z(xbIMlA3G4V)pk-|2!>jtZTwM^iL!mQN$ zr==oJ5RG(Y$t(NQ1HRI)K&HMA#=F7w4z#G4=P!))gE_zc3XmIe1W(BYyhA@V(VSq* zaBC`M{PFBn`EL=qA_EN|u9?vvzWVcfm0hj3-Mt5HeIvtnOeRUuK#b4j>`HqM$Ls&< z*B=toj>rBJ%QWQy?WQOD^s!Z6ulNUO{@1=rk^uZnre{|s_Z|Ody?}p;xSArVCS0th zrm7;gj;RcNmiGJV?0@#Ic}LE^t!J0k9OD6e39gqE;9%<}Ql05RxXq z@+^72;ge@0zD(jwLM?Bw5YJ~=oW!Rc>o1^u&W2-3`-8AmTLts}l=-Sgfs+A^g2gwE zie^JNCwqXK`#2|~smbNbbFY$GV48P#&Kpbdiu5b#@D?E%-y9wKnsGVgH1XgS*29z0 z^=mutNhxvT@c^)aybOg<6K}G?tvGzS7z4Ob?Sx$~``%FL1 zY@BZ$>g_%HOiSTS;tB(2C(zn4DoWsSCdg7Jqt^qH^?TtczbUn_@yAcQndwhbCEF5t=q9OvyfpIeE*2;TF~0;92HO9_FuYIo`B3OTsEkW$)dMKUHZnI@Z)vIX!#2QG$su4d8>$& zT88gD6aM}6q&LqIHnsOeXwAMtL*ICS{@-o$52N|`0mXNCKX7-EMW=o!(9T)wY;^ki z%w1Qvoem?6-{+Px`jOAfNB=rV$B|Cv2e(vzs~ncD`Db;{M*%ivTL&w1$ZDeBV*PwS z78dMJM^B%g3AfR4`*O{fC@SYuhJiv(-g1l|nvA)Cb6U$bF&VD#wMJX%-WV6D#CWNqHW)!hb!8@k)V3x)uF z8aivuW;#ENq(mF5k#5##>R6{78L%t-3;h2(-tbRkiIH?R^}=tic2qMOx>@P?E!0>@ z*QCP`EIjJ5@hd`kO&3inPhPpK-Wgm@nkzMFXLo#8XK1=mgDFbPhV^tdQ_F;ek;|7f z*QVZv_s6uF7ODQ2JpOx{ZL~lam+EGhpZ$~NhwGO;tdnuEYLgVS;l+if3np(v#qGux*2dHyC)7PxC7IryeH$*@Yf*Y+hjMZ$zd}fD{ch1(L}Pn3 z7(aid+LKAnD^=^b=f=K~nRJ*kDV$uNV}gc(#FnmtdeN{l>5X}%x_5Ob2oh8c+!ij@ zQC!-7TS&~^u=urIQ*tm^XppR^!qB&lNjM@O-FaT`?@sftypeTC=cq9i~L)0D~9LjeO?f zl+&K%+*??>u`yMjna4%bTP`-J@@nCmF1fqJZ|Nfsm4^(d>!W z`b|+1!-*b5N7v{h+6E_QTt`D<`BGv*? z)%Tt@4p&}@fL;=dxr9AOsw%fl2xa-}8T<_-p3zT&bq057sTzXN&O6T7_O}7-qS1I- zqH2P)*m1wlChNt8Lq3g8lX!4saB0F?-dOcif+yV}9@*Dn>jYyV$3s)vg3;BxndA@8 zA<30ac+hHKWx$?bRq?*FcKKg|Orl!-q!k?OfKW~lAB?C}1Z-k8*~sVIlI;}hYh!S6 zc4Lc7psEB)^6>sZClZHe&;qM*zXcKxB7YV>yDyH^^?^6|Qh)`A^y+%6eO#gp=Wxth z$YJq8ue|wwTUc6MDcPTvpoo;j7lF~B)nMPbas~d9sZ%D^4BbrnVg0B479*jbTOr+j zm>{LCWvdeK@Gepy8Q^v{m!lnr!(~?9XU}|09|szrkA8YueAj^7^#QpTn^~x47gWBo zVcH8cBdP{2orh+j-FxIr>NpD32NrrDP#@_**Vgip78yJv7i7a(2eP?b#l!9xkLRk} z?q4+0-nexz&IFrzJ?K#*sAM_*d|;97KK( zYjqLb7Bg`30MvxgEY6@HyGUyvX8qru7T;>D{~`-O6jzi93Y%1oaTtw0Ignm3jc+Jw zsr|IOK*1<3pyx|N#!R&-3LPpj6yM1$cle%;NnrMB^y>aYktL~oTOQ^z3=fdi3U*UL=DCZkuPrR6zgf>yW99$iqA+$wU~7AJ8I zh%>jK;&RXXO$qsP4zcF19b8MYx~cDVN8xe_Q}feN+G@s}$Fb`{j2vvH90OUUa}nJl z7QEXo_#Q(~5b-kFG7%)6QQrN=deabI{NR|a&skb2?RM$5ZN8*N#ODt z$$`R&p^c02iy@I!iN=H6IPi2zG-3TyTTz@NLX15zacs=GV-cq!Q2ZcH5$OfZ6|Pj3 z7&?m*3OZuZ!%D|t_TI$6p=cp>37oFez-@(3|oefeJE48~K@Rp+adgWx|iK5BU)?{Wb!awnWxF z4_9$2n_$oJLSur6s$2J6z>fC}oCEWZE+ z+wk$gSOKwn7v972oOu&~##7y^_y>b)3(@XgWe@|@VtW^(ME7k=%Vm=u17A?DBY8K0 z@9DBi^ckTyp<)koRYxLJ_%CQBp>1L6^k%EQB9M9qS;Y*D&l37jm2!P!z@LPSE9eQV zk4$?P9C8x8aJ=sz#&e|@6KD%7zQ~`mHmd76WutoE+)y_|Np|$}+x||M8e$!9;)bIp zx98QG9Cdn3yo{i6xKT8(5X8_bIdBota9!JWutbylo~pgx#PJtUaxAjs`KpBRRr$YuV!rg#$HNetkBLx2=tlTbqlB zEOAbsDd>9J8p}x0r$R>UAZ7=|dg`>k#~56Py2w}4X>G9)_Nhx;#XQD%Fm00^JT^QL z#N^lknGsTF!a5dNudUaoy<-Wye1X9uB=Di`2_wG_XW&`CF~>62zQuAp*ULS#=GZ<< z;BT`eyT$9{Yqi66#XRS1nqIS#SCIf~u7KtU_Mv$IleO>$30bJnN3vhw9u{7y@m($) zXJ~Yuo*V2)uq33v_3c3s+#iU=b$EIcI$C8rc$yrW1Z4tuuaK{AgWPtrPxq04HhTj{ zdl8!Rlf>ue z!pIgzx30V78`T@5@==X}tVV}TIqoW{c-qXI4?k4BV469kXPfoX6S>llwa-c}74y$A z;_G%PKql%KueCP{rC~_e35e|>z$`yA7hQf|0;V7(vE#8ADIE~ zz?CD_GRLK@+uxNz)+d56xGd2Yc}$sKuX;Gyd97dGH`t~4IHT0kJab6z=wjLeYjCsp zz-if)-m&%Gqh20B@5~e|w^A0X>9DS!mc5p%Yp+Wu%d|c?SO}>pzxB#E{^)Bxn-6}V zd!a{T#GOY!%~yqx>2kd0w`e(=f*p%0iPohToA9|Rf;X!O;x|d*QY*Y88_r1eE1Pr0 zt3%m!b7llkUM-iPq|o!5lalT;!MfUUt)@9gTNLoKPHmoy%^}OC3&Svo>viHGI`Rss zwx>Ed*pHWKsj+Hk)F0uwmON4#%o)!qvS;rcq@u9h!;gCr4n^_UYi~)9k`Y`heHgyv z_+EzNlEMXz@H&G0@=}Mj&PamiV3d3C(HA=F7NdUE&ug!-8peCpyr^}?Bt*7|vB+_f zI}UZ&JIkBZ&Ap-Rs%f#oBtjotf6KR;#hcj=MV4aK<+}8qu+$@s|| zh;BuUmzLkx@u^*1?FL%Xqt!UBoD|xqF8TyNS(aE6Yk?$&yj-6spbY1VF++YmI;|dc_7W+}-WOyYI$sY=4wwquS8AjgYf(0q zCr!O2Gs-;YjAUAGg(U9fgUo2H`*csKsT#r^HwN!-z8r}N5u)EDtujS#t_uPCzIg(* zF&sdq$0JA%IuBl6>n|HF?0-|Cu(h?3-F5G66=+p~xpod==`*{At>-1jA%<6LG?|cIvEY&f!*`s%hFp$!GIpX5ckOrVq3b1+=aK^ToVtL6U&ya@45+PfG z+2#lN3v1cZgWrPPuIe~d(hzX2?UM8Q0w!L#@C5+6Fb>$4s#+=FA@UnePZXTJNw`7+ ziW5BkC6;RQ592|6z%D8*w#%=_!0c)f?lpUryYdB;BiPeIb1zW`JP2r*$HoaO*m?ZE zLsi9=&;xtuk224dVCVcuGWfDMYVxL_p`)E$6N#$`DHbD)eeOuy?Di+6jX3L~sp$Bb zS2jjDt#j_rmTs=dbSNU@9E!!*4|*t59kDDJG`yW%4B+~S$^c);go-!w@C%yYcfnJ0 zgEG?O**U|(v{DTA^T)SRZfQc`;Jh;kckh5uak{sjgYp>&;>^f=H6uf#VCgNm)CK_> zK8_30ydpW)lt)5!>(&1w4d>?SV?SuC zeWCqUF6wBlgv)rz$vqS9@Qjj~^XnnjW~%q;2O5n^NZtCG%bvJZ7(6x0g>2}FI>SH+ z0Rb;~l4&UfyX`E{0k2OCbY8rtb?7LJ7qKKR$ZlVB>ELh0K1O&}Y|-dq+m%dC0DnmV zzuR;c$(i3>PFF6AF6v!^&5Dz%hinO?gLcaia}1xr&5G8uuL$2Ut?v z1l(7f;K`OiOGJ5f2#hou_vbaU#};nRcK5Z#%8#*!@L}@iq-`-~fP?9<$3W(CXalaU z#bJ(4AYTKVktKc}Z&-jymsPU77iCs5VC1ki@6=X^JO(C}=CxnBigaz^h~{z##woC> z$xUFattJ$>92k~D$Sk=KruE@tp*mK2$Ec51Z^XIYxoLb9Qn>*16?rt7)71EocWu>qt z+riumQBbnbzKV2%*XlNJ0M>5U3hOt_{1DKptGaK)lwy6`kDX3s6{P5>GWj*C2zx7OW{N%WQH@@)8!c4n7FW02771#vu9Z7kgv zB9&1zy5CxOct4-t#f%H4S9R=ilGl^Z2hf^fUMg*zK;P@rajCE2)9&y{)`{fF@c@on6b);eSlS zqLb9z+fv0O(Qj4F975tzPdqq>ASF6ghe}M4a7AM)*4YL_U$QPd`25J;$H;4;M*Nb? zLX7iM7F^vukyUZt*qn={z7o6`Y}3b0Sr%izg|goWUC)wg>;?fZOrluz#YXYEWWK#g@GFb%N~jhg&asPWQm)kRbhh?J8zCuGbv=u zw(l%#bK=00U4BZ(y=UzNYQvHI&!M>YZ7F8%Bf_rspLt&!3o;bgLaLIFxVzvA?`8=_ z&qB+euYO2N%o;olIB+2Y8LOXe7Kpjyc5fPi*Q2s0*|^(3h)PHVZ(FL+ZcP<|zDe^> z&Q}16TKAW>1}+>FhSh{z84dB))}0WUo~o@)oo`nWD(G`nvl;9^{@yety}Bsp zv+fHD=GxNk1&oLGu5AwumXSR};UWXUcPcsfiXX`i(2kO$w83fD+_pu#n<~57&Q#pOo**R7o%^GOILu{Rpbn901r_QR+EL zbu_xRw)QmrT)*&x`4^(&u;k>EI4BC{)daYJE=yttou}K(!Zwu=jWLEE4FeovqlmZg zURkCyWu!UZYL>Xd$BaV})EB_!cu)swR6iV6I@!RPKms(KqfUVY08A&nhexf`$UFjm zhJf?D!$hcT-c)iqIt^3$y#M!_iD}D3<^3YYj9fg9W<%~xf+M|VVK=J}t4l3wj|>v@ z<|^HL&@bi+w>^#Qj%8BzLS=22N0J;NA__y9g(%Kc)wtI~*yJm$N2a11t-f)-e5*_T z`<2xJ$>~pH7AhA2xR#vf?5q#>vxdn6OZvLfnU9cn(Z{fF5WZ8D(<-iG zA%13SM(RRc-JJyrWMJox0Vu}RdUY(E%$wQVP@7TGaK1j|vA%H=8_749M;Ni@0l2nW zu%x*%!dx~A4pmiGFsXVh?)o%A&Twqo6qP=Q{5wVcSLK*wv zu*>ECu#p&~?8JEXrwEnDJ&_MT+tpv@kpMJz2H&>1(1wJNm(X7T!FEthYB}F;pqdF4 zS17i#1G75to_;(oN?AQTuB&*)Uf)mI5ncvZl_sGD-L?P_w#R;Go$Ktpn@Cb;H9QXV zeLuSG33jTDwZz1khK{&2GBDMc<}`2kmhd>C+`H?sB*C>!u1MD75|2%)g97tfp7UhG@JS2DwVzM@BWL)102DJGEF2i|*t1iVX zZ@B}!9wKbfBlPZ)WllDJ_zGjAcnTBOO7b@oG@tekRS86oi+irq5 zL{?Ttb`@{+w$Up&GsTrwdMi=(i~(p_%(`?@+fN1Gt#2RYfkUDts*t?0uZPN9HeH{n<}59wR$Qqa9Ei_A-E@Qs?ZI<^I$w^gK@(%3QefbwI_Fy~?SC5z^KZiA ze}rJ}htYKFTH?gT92OoHqQFW%gGX09$-9|a7NpKIWmoO*>gl{Y$7M^m?I|+X?&tIz zlCq95HkfXHQ{l)_1Sy)H)L)FIfx0?i4NNmlCg?oJ4198HGXbxxm%}gMYUbUW&${s4 z3!HKGaOI*6SaeWk#EJ5TGeLzlCyD@Xn@g&F2!HO4qNNDB4%`JjYcUY{H(?aAddF!>RR< zNOgKk=<>iI58JhLD;C`OXq^-5JxGItZ~z|Vm%b`fE#gy&Uu9jfVrPrLvheR-0B?#2 zYHuz33*KV+qHd0KYJoW!<;G=9K0WCofZE$?I0~7xjoq*5_)Mp?Z`n*Ha=nkdu03Zc zhQWTkJK^?wodi>_(8hEXT|3^lY|`#2ZVk`v5Mp+*bPedw=+Bl!Y;ObZDzheD3nBNO#fZ$Ron# z4TJ4qi1zB1OVQG(LZE#iiibU-N2&QEqwT$c#ocE@ZER=GugYPY&_O!EQ3B2gOI}c% zUGDAfBOgEPo1KZz3#f}`Hg?*QGO2s#A*gRE(02?eBe#uByN{Tn3=KYhaE>z!)hQ^j zUVk9EGpPm?icccdP@T$=V&@wQF2#C9RR1?DTOEKdM_)VstHIG!Vp}2Let(XI|@^qUV%-Uwy$fPo%|i zar~S~pLukBh^UMVc`%VQD2c|x)Nct%&|R3F?Kgt}p)DdR5kNpk<^8-k`+NK37kn20 zPXrIyf<+BEmJr&pqvXQ-;DcUc&4tAA2{j+gn41ywC|u{@@I4?CispA+E2EWTwnL)_ z72+bHsi~9mqkIBA9g*(fY2}gyzV7^*H^tG$-e>sB=Bxe;2sR`d_sa}A*BMR|f$M`~ z5o@C8-YcP5ot+?yt^?N1da@H7g{Z^#^sH;J88bt^pnYJ{&i5WSb2tS7myh|ce(uwpFbF<{&l6uUjfKp ze6mdf+dUY0Hw%%*M-ZU4lhgZx=#L#|B+Z>PsX3y(cNI;(FGd&MKtk)}dcuwqU1qeBWc`yl3zvwbXo0_f^>15`LK&nEXImsat7@??}-ugSQs9FjFs!NA7+;8nLWdd-X zhwrBcoUOC)ftaPV4mTZU-dlY>t@}^Dn$dk_d3wJkVD$VPtAY zF%{r_{fR(xXPEKP)15GR$3)#7q8Q+J(g)9O=Y-8nfn#@^W9WAK{(RD<%bO)u=0|tF ztTs7+%@0S}N($4} zdKm#tXqMl8*DII@Tg#CvQ z{MRohefXf8g!XezGd%sDKmTujSbG0Qn?wo{(o@Cl1-PUc0?lp7(DKsXU^6$!l3TSj zbf4z$SE3A`ZI{N+p?pf0JqmFvXq*Q&t20`94){k+cZq7>Yi4q*%!t8U=n4Cq9g7K| z2;Y`?Dc4CqixvjZiaavpH>$lS9#ZH(nzJurUjltdclop*q2M&Y0xF_T4NqK4LPuTf z8RVtxREm}RynKCuTso)trN&j9>(DWhP2x@UD7GMq`ilqD{gNe4Y#rog{RVvP<&mi zi|3mTD%PfER{U)j1^?TB6R>_BMZDvp;2gjb{Q0)$;j<|z)}`=7j}8Luc9Kp{(^7KR zm=%Yg9hhG{c(M)uEY`u{FlFaTN}?_+F9V7&&)ym7r9X9Hf8!4OBFUIP+0Vx z&=97Yo}LCoI{le)is|@2S=B%p&>lvBNLN18QcmG@9e(~WJX``06j%QL5EK>`+akUF zu`7(iLWzd^MN||3mMS&c=_oAKqfQTFv3v;ab_QTo<7ZwtZM>qUA*$Se2r&w#vqwct z514;>Wgih0b=Ruya|N?v(mdU(tfQwujy9)iRA`QDRbIUOt3oD;neJVh<>&g2dd-X* zFV={}!=o=RivD~Q|3?RJsHm{wAI&@mQ&>_n7im(Lm6h#XD%IqPBVDDe95^evi;IhE zL7-@EYTr(Un?IVziRcz_TP0w$A(8(!FZyqWqoe>e~D1fooJh!cnI5~>L;ci2F zTGq2bfJa-(XGsU)>OIwVKv_-gwT4KrPjmbk!MUV&@7}#xxc6e|xtkO-I}jN1tR2N- zxhEQ<^H3?NDTed1_EY(dQhQcG#tO#gjI%O)qa@Av4W%`ycJG!AlN$TdkUP=v1PO)K zIa?}W&d3QEp5o>{efDgdJa-8KrIPf4N#O3yji#fEeBR9|S@wow>ruVCog-eqd5szQ z{aQ$jrI=`|nYBgPh0@i}CkcMk)YLloTyqsn-#tEejwzqd=~L3K#*y9y$&5SQ|9?NX z#!Y=uL}c$0iF>%1XNRn+I7B64*&G$UwfRxjiHvd?W4J=FTNMW#TL`1}cmRV(&ai=o+V?KHL4qcarz}O?<@D?>apAvhmmdBV-&h>=M zFd3)$M;Pns-c8!^ev`sp*Ot{rl-h2tgbVT;ZRIYg>`KnGH~h-p>roO9n%}s))ZrxR z4LyfuoDDqTc6~e&D3`)aE-{zK4D@c@o>{f2zh5Jyx{QThN%79(DQ3h-M6h)?hZ)BIA%#U~O%k>)UFi zTk27MD@O7fi=f^qV|ucN=xHIC3j(+~TnC+)>s5cT{^GO;ppLTyP0hyaVxae?7UIo& zvW@~%pLDLgbV-Vdbq##u#y)3y7Z32pn)CWJ=F7q3$7h|bMyhH&p6f|@41O~32M-My zEzWj?*ALq|MvOoq+^7*-_*%a+O#?#kU#WV!DQdVAWKhW8E zhrJ=q-=~MZq~9Hpcfc_7S>Ciyf|P4m+59ME7TnDCr9Ic&Rmx*F#@mRs@!65|iOOKk z=vD=i;?1b@)6z;3rc9suHU}KaZ!ZPd&!yZrpsu}YX2<=jh9%^k;`Qr1{$R*BwUhnN zHPf~<7;Zf)Y~6UX&zoNjUS~<`bS*gQ<;RqU8?ZO3;MIXxc{6zV^{ZEl7<}WTY_sT( z$qtwGaLD=iA%IZPf|7aAz7r%qRtEDpVdsy0b`DLwPhHUEo=>6Z6c8&=xi>gl`Od`E z7$kRDetk)$m|Uqek*7WsnVqc>F3ws4-&0`y9{olP`=E6QqKw`u zqmMzIOK+Ca(~GSrYP>DlDVXN(YRE9w;j-x-kZ_(PZPI>+^l_})sXlW6t`a))h134` z-_OUa7ir0_&5LX^<3wcmkOvKW*hO2<#%`QuvCAuZc8}0H?-Eycvb<)YgMB!$*p>A& zflLhF*vzpU?+8cdAUGMC)LKY4)a1E)P)>0f1_jqehg*-0nH);`km5WRRNRt7>$1`A z?MLi`^!10!`>DK%A;d=j5`_#}Ry`(X@rYwUiL30)rAz)TCVgg?Pl+)vIC`QdKbr0S zx8&Wasdjdjig>M|&p5@PSE*rbr?_FuX&1wyuhXFAMe~94+A&bZn*p2oYT@?b3iG95 zuCql?;bbym@pn*yu*o6~Ou~9mRQbk@raaWAJbznn&JBhrHjgwDJE55S1u}S_ilBl_ zogBT~++3IC5`~qA8yk&By~n?#P59Gt721b$%1wT8Se}_p5(On(bPtl<`lK+P8i$Wq zr(@~!2xj7XDWDJcjvt%l*UP^H2-|m#P|o&rOYPEfw`mv5JPf?Nu<&xgu~gXsF)jTx zG&GVNx^_X^nAH_0o~hqUSQ;7(@v*k<&wmLrEFchU_Y*$FM%KdZ`1nj4$ zky*Y-kIyHx`4XxF>7sju5y6~gb=~T5;*IWupfMsg=thCfUAyd&@%j#2GB?jHd_fO7 zXMpUtvTtFzyy&-DMvnf5Ml!f1adoDTfPzK!!1rL6=envn`%BDA)9aJ31misVE~Xf| zV+Pjd$69eCkn;KGN`N%-@%61A3zs`Bpf4V&8VCOzUraDG1Q0==WxicsNNE`Ms`yS% z?BCD%D;S&zQA8^EF&^EaFrVjTZcCD9z?EuvJAS$PWf+NmYlngx0>ZdgFqyJESVyjCAI0i=POm8-6Bp_DENEXXhwN!% z2q9t6my9;g-?#26#8xHY)V3^Mq*{&ccIgxuWPAor23-kwVv?_b|^E?4eJw?nP63WS7RcT zJ-9!sI};s~-WXEsk(U~Z^KOiW>Py7N>hjFn`%}}>HX3>knuf!4oE5P7hhv>Xvz3=t;3`d1G5hib*Pi+w1k=UcRk;8YXA?B^!a+T6mY) z&5Zc;X>4(FfU9@&WB~0AR7rtrqRY@`cc$Kr0HV8jU6^4+yx(M*eL_G8i%>z_%a;e# zq9pyndWDXV3`65mPkg;dj3(X|Q0@m091xWAb#q@HK_stwW1A&<&oeB$HoUA}@W}I9 zcX653dBiVbYZBni(%#XLz*F|iW@Mn|2@!6fYyM>^5&Hc*6B%b8P_Z7G#L%y6_Df?7 zny~rSd3GYa{2AJ<4jz!1&e-+Dp+a>J4K$NN*sG?dTj3rmulb`NKfXHMQ5yW}{N0AJ zUdKM&a+}NyVG~yd_U`D|j=K8C&IFf0u{{{~!_XuVCA|B)T zWz^gvEO%DJ)YL;ipgZ%8ikxdW+n@xb(zHjo(0;%qywJAiCZK^0m!o~h))o#e_RYg^ z=D|iXZDWgOwQAWU!xFbwNlA*+sPs|}Lc2MiY`>I@nC-pjIEUjF16FHq_ejndpg=wL zYLO~F_CDfgok?K{#VsB#+Mc_?I|Heg|3>2qi609i> z`S~tcUt(nr5bRdgSt%x-dJWNhd{7WEk(y@DO#rd!OP~$3cGHj-n#M*4Lpa+WR^EPF zH}J5aIj->L?!t!!{ROsf6p{L~>n*TT*B+UVu0hXSSSY%xr0xC@ht1G+#o3a<<@WPX z3$h^!S?IUkwfE3x@gBR?1uL?x=lOeQ9qURhTaCVGND8p}+9wnO0-+&)I`0919euYx zcG=oar^@ zrVFiFELaPS;dU$Tg$}4hz6UT+9cMAItstc`f=zzv)#Jxw9wH|yjI%f{R#4NwepP@K z@6E1EO9UHj+aS(!*RHS>bbi#WMog}%K%cryG<;4~)j!S6UEShXl|wxsd+wa_9)?+= zyC3gd+#_TDao@tm4EBI{{%xr9{;#Y#$R7W(bILBFxOZ!l3+VTdpaqfZKShPZz(wgo z2hJmgiWPcD`Xqr23^rN|h!yEr20Nd0+U1`=x^-|Y`eYwk1>#?O{5s%cSUhlpZt);g zaZBn26I0iZeN2`#f?`eh)rUX|c#2i8_Uc^1wcWG%R>C@%77qKO-iEuj@4WNMc2m>F zRLC&nzGRouNP8o#Z{Uxq8JUmhI`zgg&zp!!+Y{hXF` zdw@m9q<{yy6|MeS&~U_=|D$PO-Y##FEY)U79AfeO$cV}B3Q~=0`?T!t_6Twq2A6mg zH|!yXvMUr!|g19dKQ?jCFVh2u3dPlD%-%8UIN2X#|Z`C zKd0*gs&7Q|VROhw0RbtAu^na4_FS3KJNG2wMa)@azxB+iWzpG|@>>bg9dj#lDAe6d zvo5&L?9)2V7LoUOp!br?Os92^RB-sGQn-*iw}4o4;wWbuX6XyeSjbW{9=wi$hIyK);%gK;pYnmLl>u z2xP#rp|4=LM3Ix-+IpI^fOuSJrtMyPhsfzRdj^K%z3OvY1J&KSFzjO!pZF%mujnQ4 z*8S#WR4%_q+`hX)4|bbL{`f3`Z!651=T{bA*Yz6Yqwz(CY%q-AE zqGOR^$yNiIbtmii831y;0z5w|)9nW?f~y|*4z-;OFaRCt+%{Os)?k+ZA8p?m)l}PU zE28+KMpOhf2#5*@(t8I*q!;PENDU$MUPTZKNRi&FgqF}d1OcT(=m7!*r1ugaw7}io zbH8!QxaWMn=ic*gXCz_l9iC^cx#pT{J_|sp%+K)7d?VrjVHQjw=~)~c5?2;KQNbeG zzjbuixQ{UCOE#4Sbs7MHM4ayaeKWMn z`AErgajz4E&Saq>HXi~RtTGbBoH>jio}HMiuLv3jAVBf1$6Y`{>NLkZJ_RI_h5HYM ztT%mEuyDA`=e7MWg1GYLSY@za#S-AX7yx!0(5=q%tUJ3vdasBdF`-X@!AfD2> zfn5&=n@pnRqv4$&=qcjiX`VmaCdEzB`NO5>4nHEY@V>u($kSZVZG2TB-r$AThU=vj zgLOR*w{PVe)#n}_rkorY0X)SE(o{;QW`saybmPKrv`7*U!&W)p*!ldg$W$tmO0HKf zUL(Kry}R%4jPws2`=4ALieL6s0-D=#p$nFq!Y9z^09C!?v!SaG#N!@*xY4fYynCPg z#?`N7mXC5?e)>g6$foE$8w+yosp#$Lsc7$x{Sx!`tqZOS$($lDA5~M+>deM4;D1w) zM@;k4qZToVn6&|J(SN#Hf8YK#ociO9XBwt+l3u$xzqjW>H4xVa(ozQDY8VMCTjd(*{$7`XYy*y=~eIttdG}z>|Mr({rGa~K7Lm1 zycs*=-8CRP87>L=BR`kZXux~F0-1!xdY^Fv`ZS|YzB{h>C8E-BwX!=Vyn@6JJYQ`# zXN8shZ~)sVJaZ1`)NfD{ucPtuMdcO&X6rUSRdl4T0E?pbWj_ciV!h|=*LxY1d(xjD| z1)4kW;5L!dl&WHOq{KLmUY{Oe(R{7)5YQeLy4Yl&s-I;R-rU?Q@R5s`SFr)@Upraj z6m6l?V^5=$XBL_)V0}ez_2{lffo8s4GQ{Rdp#R;+uW0_+Qu$ZR^S`fZQZ6R_e3gM) zxN}Zv^vnt^ktpJaTpy=_qV`3{ea8gkSYtRJ2VFUc+b&VVq_XK&0A%u69$?WcC->?0 zV4fN6%3wZ1T$aZ6;mqV^Ma%Ks5of;Hn!_ZA(QrO9|EcM0)dhR12Xs42lz2gh~?3J zR+?o(cL%pR((pds>*JIA0(;;S#t&X;rmQslwx$%2{-lu0B4%!z8+Y0DZ9S6tq3g!% z@|}x#>cwk!u+>mlz$R)I(Pgp357UTW86B6&_jA?~+dF?~?v-qx&}%#%<2r0jr)~zG_k*1GOOoAoTNpkRV7c<&)f;HD%7i98?VkuY(gpJ z!WyS!oQ{bPc2p2H*pFH*-l1el##49m2OTT+dErogA7DD!-W7%7G=CI2{tX)^Wp=9{ zt>%3oZEu}_d*%p{$tygXr#4ZoKtV2(VZ-gn+zpCfb{RfBlx9q-=X znY$+pYq`ksNB5|9c-dQ%aJ@(r_mT74#?i4;_?L99pY{jK(=tF)!kH+<;19kUXTqXi z@ey=QQBE%A?%6&)wkV)!`iQ@JpHbmXJOIGEW?Nf(b18Dt$x82VdtQLj82GuZ+ z0`y6pIhVs%OJ}p!{Er-(j`$wMk_J|w1)LDsP=F5I_cXoootrg z?SHH~QBoVnp4_>Qp(s@j*r-fS2Q3d>5M>8VD!HA%Xs_&Dcq$t~7wv!|PKRuQ?u+%$ zeTAzs*N(mfqN7Xg+VRFz;RkW+i9J1}i{#-luc%3?s0RSu4aU7eSA7o>+t&{QdXomx zdxm+-BHmj>)p?-Qi~ab~(d#T-)oA&SkD>HES>Jftn6WY$4U8}e$r+DzpYPFf_UvM} z1h3IP*rvu~%O7u<<|h7vo8D_)Vr}?xeje)(5P5i*jdZU=xOs=Y``29i zXIH0m7mqKG-zDsKH?@zfl=okKAnBxjgZ@)|TrZ6xcC>e0NHIPuRJtLqdR8sg zg^`}@O%t@_V~TU4e4>b3ZclpCSV-69E0;Sb+}0Qc1p2D{*1nvN-Q->R0VO+#f1Tad zNvSHq4730&B{@qiR<4ehm_^fCXSaduG(gyTe0cIg`K(EIWM;M8@2aHiHH=Ho~b|4<(qNbjahMT0tgm>TdCI(go;|OUUzD_jEC9X5IY_#KXBYl zv>31DZ6oW4ybq}(5+pf415H5jGidRK1R3bB;cZdEV99eo402*c?2g62w$Kut%fZPE zX#geY`Eb_raD96eBmtmAhV4b0TsJFzH^<(+yO?Slf#EO`>4K;GvCOrp#u(V6`g)qZ z>y3d5WML~}a%-Rp8n43R^h;9@K%c(5D|dItvMIbD1T0NOF8)kzf3rBO;;6n0E$l}6sSrx+QL$wQZlJTy$_9(t9M7hgr;y zVl^a0*8lK~#UR*JYe`?UNm-zNq|Eo&HL9a#MfC9UvpSHc+JHBcyx5<+J6Eb{{tfU z*OyP_NI-jdj*c5EYsCy1W`0xku91ZzRT3W3R;72If$b#u($doG*PxgpCIBHsiBuNW zPk1G=6HPr|S%oZL9CBEkE^~vw)G2%fL_U|wP^9+wCZ_>vRI8or-;_oFdEmWcPXb!? z$#8R^S%=U1s|>&Z^1T|Dn$;X|SYcvuP0ttd%q1d*G$AyQ~`0X5h5O~4~@B#o;#u?3|THXu+ix4&h(-na65pk7b zD+%VE7Q8AJtr&J+^m$0Y*%uIg$o(;jcJnG~D0;JoXjQv4Evo#~fcxkGOFxf2Cz`g7 zhkzPirFk8{j_`MD$8Pwi1Tpqli?iy4mytlh>Iq44RxQ7nu&uNc)lNwZ-Wy|?sfc7A z%MhXTE1e@9h&N~NWU?f|DS6*Mk(>D(=gTgndKkOC#}MP7(Ej9u{BK&_iw7gbc(VCQ zo9SU~h}>i`i}6Qm=i0QpYri+CPS&!rGbmyOOPP~cP4Xqe{%X|sz69~zk?JP7&Pc%A#jpBPM1*QucCxT_rc#=SEZM;p z145rKZb-g!cTdtJiiGIxNp>lz9Ou2|GG6Y`)Nrs{{%dJ1**YLTn`icrh5YJXyc9n3 zL{cNM%&uC=u&$eo`7E)mSNE1wh9mh)8R~ef_h@wgufX?E(=f9CdJ_h|V0GM{F_TwR zjdr%|PI%kwVitG=BJ8a^5x!0D5HzrR((v8|8S;}cUHGx3f~<(vU1Ac@AA>;hZ{NJ> zIIz@zGf?r?@Ahl!hX}csFFjG|v_O|jLE-ZQiQAkEj0$q4Z)7Y1w#|8JzZ%;w0iq2H z3+wRuJSF+2k43%WERK&`A}4EzZyVoe)~d}dvrii{ zSq+}rI2rGUYF3VMYVu?6-%l)KKFCANx%kHgn*3uw|E^(G(UGrd;=0~7rZJ4ZcmMte zmF!bf5_(PtFI2Z0IXSEPcX5-nO^!tue_`3I^oyr+>ch@Jnt$;u12--1w|G(5Yd2=n zWeIfT|IlM9q?gC3i|tc^n#w8$0g*IKO7MK)>+AOejpM`+FJDRCeu^L0AkKJyJj(U_ zw=~{A?)U$K1JuSYE5!GSzGZ82y32B#P3E&^&sK@7AHcJcN8P4#yIViEu@U>MWBm>K z8|}rrk23;e0R9q{kc$)mBXu%;g)#n>1zHwAs#_V)mS0nbC2kg=Yj4rf#g%uNOE&GN z@%E^yUcLJ3+NRj{*gxTG{$u_Ryhznwyu;XEEG2*Lo%$^&r>i0nZ@E^L>O9q7_{}bH z5_h2(cZs&#Cmmpqzg|kBn7u(esros|p<^^F)9?7p*fD5ISkcxt332tWZM4@%zdtV< z53gMX_+lzz<{#@C{(1~rMHLD2cSN3_SSCW(Ho7o<4fqY8haclA@yEP8%xjsHT#t@Kxb;+J+Hm>|Yb@|HReR+6#gH z?|t8$eVqMfZISS>=_ilF01sreCU9?cTK+RN`&a1G&Q9z3Rx~R1FuUC@S)adP!FFzL z?lF6kK+Koq>dp{lgN>b>c?-P?i}z2S&{Z!jhSUWJ<-Gy$|znY!fcb*Gj7+2uSNG>fEVFDOEyeP^k$X{Z+Z&gfw5hHf!y{-%cq1b>#jJ z?*>YSzO9Z2M5qCAopmX5*Kgd2t8=rJd-duSvK#1cD>^zxA~Mmm1phcE`S~cyxAINEbBcW0nGv`K>&|vVR}yYH7SYJnCVVGI{w?z z*!I7nFaQ7FT!2L2-kvKEJ$#1_mgq{Gn$FWt$nJ^%5sduXaq9p4fTq92oXUl z|BLG@u#SHrHzjc5AjSmMZQUOY1=Kd}90h@^b|4aPeJ@miKB(ahHPp>@= zt?%vaAEcTTWwQTgHxm$f5)<$Lx<>l9x9oR%&d8)BCZM--`_8?G$B5od#>bB}fEmTd zzZMu}-UUrkjKh5FZ3_;Mj^w4@1|a8Dey-$LL=~}-b78jmF2KgM-@v z<~e@zI(z;@Jzksm$i)0JmPOw!Lrm3%+w{AO;)}{?d7f!ho51%mfcSdMa`bS2iGI5!dwh350Ti&31Kl^(XATy|@R%Ro(%cXCf%ga(9=i5!9|edewHT zy(cPdZNt3He(H3R)1lg}VWKTN!9dg6=!(ifW$c@_NHgQ|6MQ+wJzTW7Puwy|V&pN` z!~Rw_7U6M2)hA;`mn)q(-Nm1z-;yjp*tvM3Xh7Y)@?eog*K=-jjWum9(mjM3A^&wef)AAzrN;Mm>A(@?2mQ^I%jx^D7ITx z;m&8YC*sA5xPP}F{*&!?8g=pbJZkA2k|XJCVMz1uL(o6p;x#Ro7TFD1@pn0*fdm(0 ztM$xll32A-Z!uicDKNH@>EjSR^B~jz8Z~?TIG$QQR)K0^kp@}1Atu5lD$k^}zCnHoxB_X+nQ}E>Be4{C1za`EX0KE6R zuYW>n>mg|dagS@%Nc&Kyi`D~Ddh=B+WF*LO>)0>qIZY02{jW!G@|aCaolsc3h)C&&U;9cxolV% zoupQstL?MiBtFNaT4VkPYA4uw&QYx;)NAp&&)1hR(h7Gtt&mWvsIJ*oV+G1gXt~cr|GeG&q%8#e}3&6J4@^{t;j`X8ikb(M;i59Ornri9Hf3) zcw~Pf%gcNPS6>J3AVsqd4h<)Xpg`Bv zJuS@hrEu6c>3Zs_;_GkLp%{Hih*TgrW&oAdQ!^O+&89~ z^R0S-@>*^!PPw;{&++md|Fe+@ccp;(xe!D2a$t@0?h!^(AMU@H#%H?0ju*2nndxsP z=Dc}dcA(!^9P}Z)15jW_wt?0Z($i8?Z3q0V&<1SD0uJ$%%&PLGSu#25nqKuP!_DN= zDFQBOY~0$aV!MJYuYXN8*vQr~`QPUsxP(0Ff(cSM?Hi2=E+!J%ohYrxmam9K;Aet~+-oj|H)W*R zJ(B(T?bI;o8q??VG&KEQt^FjmXW_yyPnmzdwWMZ>nKDd96*6!pFzwpEJKK1uaWzFE z_6f5}3J-}2gl-NEFdFPw_l`{I9RV@<*2N?NwAkuE#X5vZWeytz9L>-k72*5_XCGS`C^_*~KGmp>pD&?h9`^8n*Trlm+ za>*v~wat?u9T=7i60q(yvJmqg`!2sEW`y6|s5CAw8Bwv=$p@hgXJf+qQ`QQ3Dbfj6e3edy$BY8DEt6ElT_w_;5y*B{I@+k}Ok3i;WYQ zd78LT3j`?dOX`l`M_h@u_1;P(2!2-uIfmy@MW;}1gi-% zKqpj4uktG?Ne}ocA0}7r2xe-5FMK0$@rw03nX|i>Mz#nOH1h@ixcms~>!T`<;{YdNO8hqrr}_+P zhQlyA1=`4`D$5yUH>i0T!cj~quSs{j-PdfUQlp`XjupW3c9c;;m9~w<2l^{WojzD} z4r*1&HyIl-KIQ5syKnnmzsg}~GUQG!jRr_E#i8ZGQjfu#VsQ&KdN}lCB1=!2CMlP} z1N=bPtrx=&A?bloTwWsz0>ZU$tnUc*$Ms{Moz&?;|n zrsox9-KZA46i&R21T}t&~?z zzM!h-b@(jQaT=7$V{@hE<0N6;v;+d3(U7-;h&_RD#jk0w_F#V}_U(m$2*qWQQJ;Zr zG=PCT_m&2>*HymWFP5MHI!Wc2e$$>?l3}HO%clZ)I*O;g{Ch+>X=8p}x4jycU3}iB zgYkhSA!}jCMJ3AHlwT}8kvj`^g(u)W`16E1ves5zg-kJ8A(ZJ@u{sJXX;?Na)io@89W!d z;`&CsoG5QpTBH4GLa6i$a@G#3Xt@Pq4)fPAGC9t|GlNL?%KT=Iy} zug`S|u3uzZW0{naSfHb@vgbx`c02WxB1@;mMX{!mAh+XPY&v6|Eu$XFHWdW@EHG>1 z9e`KD!Ik>8aK@?1T-xqJ(PRQJUO?^e(7l~qdI26qX%SB@AO^Wu&B64&Q}K%FXEK+S z2(op4hl&2lRyIA@i(f#_c8FMOR8Hr{kr_Zte+{p=SniaKAh~KLDhs-Q)7RYxsX!*B zDjdZ+vV!UdBcFrzcX^*%+B*K4m;c1Ypa-`5W@gvqG4QqofUNQWG^Fg;!H|7kF@&m_ zkW!w(Nh|mYt_vryg*X2ij09XJ`WE^IU|AMk~ z#i>$)e!Dw6&=3(9;40A}sAMrXE-6$sh0I*Oa%KEso7c6t@kkz6HbW>lEjQB+OqVMY zG{l$CPp&sqt5@ZWAg54@0|L2LS4?=x#-7ftA!`6f8=A$}q4*wfH1`A|Qvp;e;Hrid zA+ANF{zR(?8Wv(QWYIow) zW=mn*!s*B4)-b1hFFl09R?W=Va&0u#c^l9Z8q|kW@CJVF+vgir6HnqRupXUqqB-=+ zCka|vxz7XLeDUeiIJ2OUWQPcGyW4Zz;T<1zH`+DaX2bJbm1Jfp#-U6? z1XG>#_NNW6dn&}}1k6$MGfXF4kiY1bkyeP|kZgK)1l7^eQ6tQMV3~67*%Lq$X*kunW{mHs;v$JCVlYPVL@N`Hb_QbZ&1c)l6|i zMzTKXVMAd)CX~mch3#5a$`w_C5yI?}#9yM6eV+Z{Ys84ADzo?qN#A(C5yBnN`$?2b zwMF9jO47*8kLN_6x{JHUK5LZuZ!Yrgr@65&izM>E!r6G5BOz8jt2tZT7{jS&Xlq%_ zq&wdKw2^y|tBski7AvAGxW#^qLYn#0Vyi3A@5nY+>MJFz!J3EP#j87X&QE@ZD31z| zB!G7dEYT=k8udC%!{@}y0RaIk1C@;x{3MCT{xRjtE>)%j&WUzyh%G%4C-9<2s@F8l zaQBU?BVNZ|doT4M({p89$eY_k}hVv zgn_tzjH#*$My=Hox&;0#^t|;CXC+{UiT;>u>%RdU{smQ{H-GQtOoeHz`!Lz816pMdf<;? z2s$47-k=2)82ipn2<cWUAOz@#Iv3D+lDX>OX;BetU@h;=MIc^8R>5rP^N1psCMyUA29xEBI$^d{GaZyqNzZ z44Q>9Efz@gb?H7RSn8TEK7Pyzl8{X4nwR;xE`$|aEx?}qIfDGDf&IIklnfELDu`_8 zXz)A20Yz^aL=8=TSPdj&5#_!U{T#Ux^3}qp({0*8#L4d0ysEN2Nm|i>fau=PPp0d| zVKF=?eZGFx*1xLlu#EH+=jjdmXO2gZ;Y;H+Udi1rd-?V_JAyYBs4Vhl1L_3$-ogsW z{f4q;-9=<+dQut)J370~%qHEsls9u{Bm2rTq0d_%uMH#Z(E}#Ts;O15u2j(akciQi zpSQ7P(4eac8sjs-Up#BCQj5AUT} z=docLba~&<$fwilMx{-{k_6?YyfyhC2?IU{i;F^p1j0uxq_sR2A+SYmmdU7m(~xFJ z$A^+yce0^cseFqOqy> zmmTLvpnHpILwg^<_{=_ifu)1(@}U0XpDUR>xebr^S8QKUhbBH$p{x+p4Y~jwH*HD5 z7}Wb`hj9n+@?F5MqNZSnx#2$Z3GxRHvV8}2#es-9=HAGMl%wOt9(Pv;5ZOeU!y_HZ zE;D@fbF_*5I|cqoF4lq+aU@y|=n&h;nHTM3|JPlGe|gtY?{bf|T3OSh-7@3Y(7*2y zW*GLC><+@XUfy=3$m(76=cN8`kC=)Oc_1-cix>0nf-Z{J4Vaceco!3;%I@VmwB)_( zaROZ!e*0wOv6$F!Hu2l$4>}=>ckRA*GpS_a5I}NQ08+sp>{dND0Ww{jy^+Y+3=>Fy z$dQ9cy;{rkT{WmVMZHQXXVSUVlrooUMzhlmV+@&D_L8;Ip3}``_Dm4HpH+ z#Mxb}^@j;tym){~+D2{nt24wM9xlI@O%Dz{pea$aYV!& zUUW}l%$@vOfU;_I#n*nK%m~T19@|cpl>*IJG}#YGzhU36UBZA;11lm2;&MSG z8bgCANXDL`_{>}fqj-JypX;#zmK-Ngr+SF%6c=ylfsYfueq9y8_(`X?s#qba?8ko~ zzdWUEINJXh<-Dhx^|D@2tR8_!24>O-!1&D(jG5mQCLV(y=0DFj60MH4PsL&@W9-v( zj2vhL?0E^A%$SoeWXgR2WvDLzwIls&pQzosIBeEdbTpU^l|4aiTsOy$((*K4N&{9* z_Y6tnw+iyMp@*t|bo?)iYsu$^38&;tJt`(w_O{F(U*8wkYA?JoJ1di;f>>Qlc|7`3 z`rudZ$r$jx^^|4a41&E|{?` zw?<3QaQ!Oaq5+3%bOom`Uy0<;(kq#2-j z$E9bA*-Kz29C*Qv3Q+ve+h-s@AfZ>Wnbfw0*eqNJ=I+EmI!U4dp8&kth9cNRj*?LR zz~CO11*fsYTTEyOwauMaT0UzF8qAD zzbV2%$u$0qX1?PVp3ob7aTTWs^v)Ldx9-xa`agHuTw1C`WE!jq+LtoC14aXSsCH`{ z0#be?Hhlx{=FJVAiF(+XxAs*fxh>EwFYP4*1eyJ+;fk1vg1jo4D`4_vgP+*>D@}d| zgYoCqiAB*>a90sq_enzy2zLiv27)*s<|o#~2+;XA>xfqxWO7U~heU2uj#iYbr!m}fMQ_T2Lj z1+H^gHaZVEl#}yh&P@ssWU}=3_(X=AknZzstA$P*taNbc)p`f{(Fwq&?aw)EbZ3ms z^JLCdQn*PHciPKH6=4hGCUs$aFJA{80cl(?Kyg$d<-SAMilh%4bB-+)J#fCOM6^Sr z;G{$lcsOqh-52nzmXL_6nvM^N6(}%iKl3rht`L`Tw?McdYhLStZOlD9j{ey96~K4h z(BVG^X*8eu=oJ^Ae{lrbofWW=9;!t+h<~}nX26ujF~Ms3*bvKA ziwpNiF#kEFJ99o>f9;SJSrIWu!7cZ6GuZT}0x+GaZD{aR-R2rqh5^C7eji1(I<+xs zl)=7vds5ypUdqwq+HJXMdf6;^F4qgp zsVtyS6xi|8z1Dc=A!RC!)Wo#Vkb<9V37b`f^LF#9KE$@}0Dg0*KHih;f;S&_B$U=? zp=)G!euz^JSe5gYIwspwTE_<@g zpPc8!y4}up(uQLZ8geEnnUmlU>gZdoWaFz-Og2o7#ER^YGf30kXLu@^goumpubmG$ z!1#f2J#@2Qbj$xqcN`)TMIgkT5jXd3F<$`nvfP#rUCDmy2M`~L$j_g(O&YEORBmf8 zJAm_47~E_z3Ii#lmBU~;5(hcJq+{|dA0c+$QaIY;5;lDN`os7ACmCj%K%1eQK_}?Lm)OkKc8GBj zXkqAkt`H@YR>en;r*JYC$l+v>@IaY&FB#44O3xJqJd%S!M#%((*kuQo7*y6Y^>R-U7SEWGBX2|NL^p`^fl6E0iVWIcLw3>WSp(GOq-d)gh z4!P7ln=Q-uft+mUYg7p%sLsG*v6!SdJ;9VEwUD2SLHCnY3;4jpd|W;4Ludc-Kz955 z-hE0X?W}|i`g*6(2Rvr(aCAx(JpEkK06qsDkoqCLxMc2+M-|!iy_Rl2NJ&9KbdZ{TeV7~0v-BXwwUIe(G;2MoB{&@-H}Wk;nyEsub%<}h zU{`rzieaw~`gX2MYpqAP(QM7lKoVQE5#wnNesgiJVtJol5>f|xJbWU%berEYPLs`~ zE!h6@xWwHP*{u=c3B|;P%2TF}{_@E|zQN#oXZKaAU5{*!cH$WXW|X#YQj|$?xJxYF zaaWlPksry~hwz^xBrTE z=%K%Lf4j)s_UW$#@}czyd@uE+clN-EOvQNezxD)OTwhV+PZnQ`Vtkn@u;t5Vi|0dZ zBFvx`m(S^5)X__cr>7$OcMS@nLUdO}I|VKHRMQL(>IxAKnqqk3it}WtSo)1Lz3GpL z>w3~?9&5nSl}*x;jsct}E;HzXLE|A)4O$Ipka%(BG%u>J@2NKht(d1SYXTwC*atr5 z$8oyezhoRVfn2cN{|o?*0)zVBt(Oyo38skng|1-|KEN+8+qqxq-5_c!Q_%Kz>h$_vS1c+a9_YqGYNM73XlnhHSdHM2-CaH(-iOFUa**hUJlsPT`tY*-Mu$!PdJe$i>U$x6{ z-Rtc3Z-4C#-Auh};`yp>f0-TUPbjaj^$LyQFzTXx(P}yEzeHM3TyFjS6x9PouB&6C z!L(G|?w`uKFHs_ms*SVEsmIZPNf&!m)V_Fq{aV`6t$L^Eo&;`#R}pj$($^$Uwm#T% zMMy{z={$SVfGc<~*!fm#vy(tR> zAYDpcc>xY^5otxxyg{W^;{#E5!_}np$0DO~2vNI8t;PxdhBhJR^#o88wgwV9{3*|# zw7M(FB@El3d?NuT&36jSgU%D0LRP+{3Mo@_=$VNp^UD*(*WKPeD=F<0T6Sw(3-8+$ zJssPj6j2g4WC^feb}<_Z1ne-$2_XOe%y!Ic9ks= z(3n)%4?OuPzQ~_3-e2k(_F&P|8^NJHT;w?WuI%K+1>7x4WL~q)H|6Ddkl=hpz3s!a z5U-UjGVt5nK-0^;TfV@dlGwK`1+%es%NT+rMVuIuMVVV@TUKTm_@nltiac><5c?3c z2=kNo9^1o*{Z*oYHph5vX^MTiQMDgFJx8MWZ7~Xv(NKTuHzpy37QXHF>+*t~1GyaD zRK=tcDYr3Ln9I_Ee_U0vk6y$#ykenEf>AZchUHk^CwIGztvew76mILlA}*H^=<1}$ z1k$)%X?bD~Xw|Dw-qY(0R-)!HUM+PRvZ7pHA)b_x3DFCC8y0AFj-j2bZ>+FW(1|?C zZdWedqUUGT;~5VAdDIy>J7?)35*Yiw2amu&>d7znF5UX!&Ld&mmm-ne!rNGDk!zH? zm$c@iV6^Mqu(jtGJ9ViOl9%Q{&Wnx+x!`VxeeuYac;7X}riEtzY>+Tj>(YtgVk@ed zoXCv5PRp&5i%xQww!XY^qK69wkJfY_F7J=d^v{2<^CURdA-1eR^+UK5m83{TP$9q& z#qmheI47=o$ySGFG4xg?6g9alp~o{MJR+|>^A5*n-^G?Rt85q~`Q(2kuj+XWIBCUa zK4z|&ax(_4VZM61LB}5U0%S+myJg1ReUG5|ab|kQ6Jd0e!EC8|-XSTiY;tEM!s zn-cr+4GG(61o&p5f0|4>3+Q$K+|E5?H(e?ey+sI?weOpX^OYgopc zx2u*ZrdEf{A#gXL?+m(p_F1%8dkiD|cgL4-9avI{uf?dtA0TD0{pOV0nz^!&Hp|L* zc_GHX&Iya4{SA$Eh&_oe^CN)I4m|BB-j}%0gecazQam*iHu+g?)omDz)% zw$x6ZW^-X&6~o`L%0zj_?_(Us#uunk%?B~XNrO=p7AvfJjqX9gi5IHg$Xvx5!TS=P z$tqtk$PRJ)mP4L*mEHJ9@aN6g-o^VEu5VYFTsN6Mtc zkv*#n?#gYp_O|DT1}FD74+@w%MtiB^d^IlD7QzWzRNyeeL^6H173C8hgo34ygtsv; z4ibxRlPmtB@gnptKZ!8|lbk~+Xm{{JT~nP6S6s;El#Rc33=45dR6FP)Mbb?~9a9Ey z_T_}Pva~dqKL(mi-tY`^aXma;2=eZ$xt-})V`F{tOogF3Hh2V~-w5#bX_oDyT(!fW z{qK97gc~vGI>muzRwqja$ z;ij8|xwXs9-he0J_z@WBHPG(~F>h1l&h)sPBa6AA{_y<08Xq?4RJEb@1G8$fd0O=Q z#Uw$#c7*lT

?{B<1=Vj8_(Y#4-wfkm0T{Ya3QJi-|yKrHzm}m6V$((OWK^oo>0ttPZ5I52u`H&Vhm1 zV?4#|_P#bct;h5y3YIA-ac(?McfZ!JV_<*i!FQ1Rj-m<$aHvUbXyLn~ddT zz6vgfx=+(){c)Vp(!O$tokU$*mDY$Iq^+(0R|D&rmeKg9oSf(SqLmd~VQhA^YW53D zoeDO`)3~MYqQ4`IdIlbguV6PqLwu}7^W za2jx2@2kPG^f}J6Z8-aP$H;_-cf>BMNp0+_Ez})X`{P?;^YM^4ke;8Aw)vR`>%{&9 zvDB;R_}vtmBYi$%Ux9|Hcy-XzA2MvcG!bD2)uzpzBsUZLAJQ978^RBS7e%-rR;0u_Kk|;&<8eTul)_*#;fxKyl~_rn+yyq?~zF=V@eT~~n(9%RmrfQA~ zH*2p$G!DxtlgfgmDWXky{N=sVd>bCKAxMI!cAgWfCk>V0F^NumrpLvRmJZDd!4qft z2n~x8k-WpLALm0X_zjZKtG>&Jn;}n5;?{)Qf8DnY#e%$`@~sV0O-aIC99S*SqRU#{ zH}PCmJyhwVDb>VPZ=Z@kM1G2hgS?o)vizX!CkX{7M}vD@j89&U`@ZYbZf=;W#C9a{ z1hBZ%3lD`>9UcnaZA@&~>1dE2GOOO}j!0E}fors`+MC?K`G8M6kvp%k8@fgv#XKxi zTD9`X+4@I)^KBbl>~?U@L)E&dbJ^xwOwS|_l?~}~);2#{QVG^u|CjmcJ(+u#*PSR1 zU&}oeTl$%a7%k9)G5wUki^?m1%HuAlPHuh=S!k~aE$CI|)PHf4%Ui+rK9aw0cu)M$ zo;GAvt=WQ6ljZ&{z4%xA!x~DAbb|`2V(JsTpz1}-r(8WuEb3qUiatAkxBoTk4>3m) z-vugGP6>_%g2(GQTrx2Bww@BmT)!xecgB7 zGmN9{#Xi$4TD!R}4jX_C6}#+94%A<2d0i%9U9ebNxSWK@*3R*q`BX;_suw=SmmBG+Zo`g%JGm0uyD)Fqr^q8xG}8eJ-6p~66-l|L}xi9 zCHxf42DR2GCd$(3dl?>|%(zQ<&Pxlr-l(DsQae6?AmS^tg8VE~1kKl`v4#4XGiHbC zcRO9NT$GZVCn}x~1Cce#^mZH>1A6P~+6D-5$;D`F^ zoeM#S-2$oWfgN%lk55}!az9(y=As@DHs41XUuA>UCk#^N ztAdYYOo!52J4){D)iQ$*M>1r-OS|^IN{crqK$&&FlhELd8e{RJD!O;EDq?UAu34(T z3p8PGr-_PXe_zr26@6Vd`FfKMzG2;p!j! zZYSfbfCmxx8fZRU#8UWriEO>S0LR{a^405Tk`*s%?Mb0-!F$T9CkCTn39`q1&Q|b^ z2!XrOc{`K!-PZFJbJeyp^fvt?LPiH;QwYrlJxPfeN(soL>EmeM8tWp{;96%*ALfFE z_P05@yBT__a|~sD7~BR|O`ZGuS(M8<80@Fz@}4FvK0KP@-YHz7e08m!PY2z1NYWpB zPaERpE2Y~HraTH0^r+K;;lr>YSby-TGZ2!L+89|hGWt*eOBwh{b`=b5-c5oZ`z*?m znN1)-impsb8Rmn2gu7Lmr%LvF6iaBpBCYiz_ZxZF5bE2cxS3a~w~1g)DPqiEzM>Y2 zni7)4JB*5ytCuNcBb#hZv{bK)z}+8J=4wO_O{h=qv&?N1NxgX)H(hw%o`8=yyw<{B zi5N^0fKxR5d>V{UUg3!*y{273Gp#YB=!)gRyXPo3jN-Q3+kL4$#9%hrQ$vI2<|TT|LzN@<}k3Cx`dqm9smb0yT6>T8<94p zXOH6Kv^COKZ9c^>KCOnzL+kq%NW?_w8npGkdpy^ui6p9~0)Zn`ce*0d8>>w@b-bnH z`-o@#e8l1$RoH!6_L%HwEA9N6F6|5Rj~r7|DE!hg$o7K9)i3N-H{BK%=x!~qs;eik zkL%ZD#z4a_Z|)u!cSmMcwGyjUo+%Z=Eef>9Abt6Om5fRj@|#l_;#U08oBV#{@CTe` z{Rb=FJ2^2p);O~Ysr@VGxdGR$`5~&A*WP#P4M(ONk#qdptf3k(?}NA#B9vQ3w%a1j z(}=?KV$1G;TU1QIGd6V3Y%DP)Q}H;Ww4(%-F&pq{%RJVs@NThMdQzxao9Ef|#5R$Q zHGg%=Hb#s`N#G5rQNP|p);ZN(7jVU9v!LEP&pBQ$oqgYhg4b8uIu#O&ee72^obg63 zLX`E(MomfvG8%gZf8t-@9y5)7sf|{$gJ07zT_Hg()8U$Uh;@FC^Q~Jc z$+QojmU;ed+=TlT9Q(nW7x&Wov9f5kKa_qsT&h1rE-$>lNlRWO&Y!-^7|X8LGJQ<6 zCeMIEZOD#-A@_roWqnxUdJ^~Dx^L({tWay*dsl}`D~qXl7-7p3fw`Xs>;jzgaR>JK zHXlxB>2Eh44D1S&MKcS{dN^;s>ueA&=!h(O14W$>IDW<3O_Lc71MFyhvLmVf<{Ofk z;Xao7{oQCCRGM6)!R?<7xT&~gQJ0&SPc`qvWW*YIy}v(@H<-i>{!wtR@zDD?jFr}m ztHEp4AtY;e``}$jb2s{4HX3)bxp2|-WJDAnV( zbo!7@iI?}vpJq$%1b2HhQfRO>GCXgQP6UnJYY&!OyneD(GJupuk44RbUmq=~lCx3G zB;EnxQ4uqf&K05%4{e~mV?T78snIJnJuVdVI~q)>>}mV*><#Oy;-JfU!B%71G^f@k z@@Tj9K2%40(WfDGz-@;vSA5hGgG)s0qGX@16nxlk{ zmNN^WTDdIbh*?E8j4rsYH8{x?>lIxfF^**9S`Rj6aGqwm4x*nxy(RbXJfV{4R3CiK zxZve}{8^HRwf6uVdOuZLeh*qE}N8?{?5NG?c*fz`|gex%fY9*S-(-V2hv@|R3R zZ*$s7b5iQH>cP}Op;PS3go9l6p^|6mPv_YUIK9K^wiH|!T5C|#^G2EVhQa8-2K93$ z*m9Ln$Y<%Z_uJf~tw$xhxc77~w=ZrXgH_`(89H(bG|59YlVle@R# zZ2}Y$N@^agO0)`hG+zzFdA)_JcbRX(k^bVLiuQs9bxT}aqL%^voVPtPFdUm5#BqD| zAMez6F!2_O&_0`1I*4Sb6R3KlOpbiMW6x*U)|`9_YqfPWblGo1>xifCdKSvCv0Lr%}5`CCVWUw9E8?4 zQn=A={h?)23YWn=Q8`_T3W}3V`&Q!Zx=!D6^O9UdvaxL8D)DGpju-p8%ZNEtG0NTN zaV&_I>toV!ZthG^BVI#Tvi$f3_c+pI zc`^7UkL&^w0mRJ#0&_>6%NO3#uZ^;jlhnr9dNYnxON)dM8r;_DI2RdpDcd_+!0g~7 z_A7(FycX{%nN%hz#*1e6n{J4}*sW-I#!=t_OACB0aL=t0mA0@$i`>)U{EQ@F9leXY z{0eRJV^7DTy+u?8^?I8xx7o@XSy934(Yi03*@!tX-J6F5Wre2((Xl2QHA!8M*6dIB zd-iwI>Du+2)45u=!hUUhK7hx9d2fH{WN6MCbsnr17l6fwVDO8c>!Vhmdu5Gt1sAk! z8wOrJQ8|cS!WzkzCig8(%ey=#dC+t3?Od~Bj4)^ajLunKFG<_m>OBgfsCA*Q=A)0m zM$HZ!X2Or#N@iRdl;xD2R?**FeRovG`n*MVdg9q$GL$L?Bu%jFj8k&5xSFs0ZHsF5 zVm4-&p9`ii?Je`-Z3X>$x_Iyy2&ANpczlfY^1E4_Jg5ZZqZu-W2GR|~Cw^?d6qm{Z z-vELigZdztDPjx#1WbZ2o(-I-6%8KqTp0)vB-vrLTaa35<8}7TepehFvOiHgvjVU< z#i72yTX;W+dcj89&QgZT;#Z4;8qNNJ+qcDwL_MGH0W{vhT*7}q54hi#%E5PYh~ z8$(!UC2r-08$`(v{2B4IJ<&6Jr{6Fz8^=r%BoE za4Bc!Pf4Y5kLN*mSHZGB91p0!GDk>wtt5#sy`j0=Uy-Y@F3{W6Y+y8BdFtop+i4xW zS#e_xO2t`7(3yC6TNhx)XKO3Y|E-$s~|XyDG~0^(1rWN=PX_ zH-p#S!UHVZ1_5rShB~p&NUcKS3Smw$uI+&Jv*8TrNQ=~!=`8NX1TXW5ov{DISM2$o z;m~)B55!9CY2y6jzYpK9pPw2H$?ecf+%B_-P zFlu5HvZ!A!T?&~+Ze*x*g{)noGhm2DaA%++4aIqF6^e@P7@eMOM?wXOM)_{BTpWv; zLA1*2!aVS#nOud=GXVLV{qEQ4q=|$74H=Y>h5GaJP243I=nxn{OK9?;34X>^W{J~&9zs(&1(D+Tgw!)f^xG% zbDj`diN=#H=V#~#jTR1XDhKU$)`aR@+g2xahC&jZJRd&1p`%n|K$Z2YqH}D$iASmt zMYQhCE^k1Dh6WAl#+={He9r(QC3p6{v?{l#_F!d};_@}49A9;(R6TsBBbGCw5AU4@ zzuLYqMSXEUj#d$i641X3R*T5np!?%Z9+Kt1%2au~*=UJ$=> ztCCdIY!DY~ob-7|BX{F3Z+7$o>-C{m^s}uWdjo`XT1nss#%IXhvs#wy>Z%piZW$k& z(UMRxg8HG###pr7rx~b8A3C&3QBdw-ycxWtiKr@lzKxc2KX!G?+H5DveF`a~8u(+713w zoc2cvoE0A1aVzGa(^VZojjY=5VA8Yj{6-YSsZ9LGH-*7$Im7$TV%_^dNHXthBMfY+OF9ct-HiWpZ)Bmk*;C135 z9sZ=}53y+3z0S>py^q&aVnDlobKWMQQ@g3CZ;KOz|Nhr|GhjxeD2Yj`H9^73%y~B? zL##~mn0u)_?8JV4M2bj%w7_O6M4;6ivnlr^n7eftz^EE|Z2p<@2*h0b}Nq~hu;9iTPd*TK>X zP+AGL`Bp5rvM)YGKFP4wRIEI~=0KJl5P^=xmUR}DSg@wH*7*UAB;ppc87Dd9N_HY2 zBP!tTD#blsymX3mk<_-+P!d*pavfUE{HWNo#1YphceI#EW`)EA3Azf+sotMw_~bI* zS69p(2TU)A1ogvaaD489AX2k1rft^A2R+Z7#80SB6pyZ0cAvVnCoGB!lfWejwzGS< zmAA^7jgi^RBvE?mRd#P@%oYindO6{-@O*OSOCnIoTJ&1wUTpINAd33S-CY}+yz+Zn zfssFygw$qTpWZBie1Jo~%R9clSa6>jTa9Ojrhgp#AQos7${8Bj?Mo_#OGQ-gB2DF_ z<>|HK{dsL3Aa|)5`s4!b@jV+Brb!1F{pK-4^o<`^9(nA_AZ$g@Rl|p#=EV8`T>U}$ zL*Ym2l^cD&@;=GT&&^M);!l@JO9R8g*JBa~n8RKiOSw3)xpnZYt@n5sYpJTntZ2E^ zdLubQHL?`wX`&TC=X8|O=`Y9G^Dz5v*~q&pr3K|r!}^B!Ke~@fFmU}akEE8cDVyBj zF9;$b;-x-`mHC+*Jt!)8)f~)ABt|T<-q9QTNc>jU<}t{-N6b#qZ5W?+`|Rzxr0>f9?b$=JpAht>$@dzbYo(nN-^%-m~94Nrzb_Y?-nxL@tt@ z?5t%hpE7PS-wb&f?jATkG!67JMVhpJYYhtTOmzSSB7D%jgiva&RW4QYmrSX_!~|Vv&v*f z3vGi!AU8rE69?1L5RrSWX<5=@4#7S3Cp`0j-(Pn*Zfig&IrOUE{E%lQRgcSyM97Xy zSdyAe_-@BS@1jnVlZls5hvBa@&3TD3?gnWYcr7Odd=l_uIq&s6g#f5>Y$a_O<>6j= zcI#zd<&M0>O?cazS`iA{OETRn)J4SwNu~u*J=>U!dYS4o;ebST!72RE*8=szD`oeK zURdIdj-|MnlCHjgZlGRe5IEd zH4fu^$b+u?0mlp|0>z_iU#uF#tHq~wXnQsrU!FzKF~QSAO5lvj zAjKCGy1=ls{0WYfI=#jdEhQd5pW;{`Dw~RT6t=PLMK$Ewdd_%SX>k3+ONzfKS07L0 zJw=Yy#qm7p0Jgsut&p9PIL*QBkEzY^0&^h1l544MBxbwF zD}OENJkBaTruR}%(mS$S@~QECftNZp+cCwyW0IV`)?4$r&Fk8HNOp%YYFQr8{Z<+u zd`O)pgjSPeVf=nyZ6}PJ(I@k%H`Sv)*A7^w zr$^Q*!a)~4uQzAu>urEbm)DpgP}pI)d&d4N$+Flc*I7ftscj=rI9V0^gj3j!e6rnq z3Uz^EM`svZ6$*u$lr*{N+Xsd?o1r+zHgdvL5<_@3uN+jSp`#hejw-03D&fITL# zBPPRSanfP1!w*a6OrIt@LqWku{n%m`f{K*5UKMkUK%oHBqERwSMK(BFU?rJ-u=XR< zBBBr%t7}ym?bm*LG>fiKQbgAImUd2c@>Qjr#%Wl@w_eG6F`PX5FC8?`CkpT57 z7>%6BH0XQtek>3~lN;b3F!du5YPZjOa_8*Id5xae;phSJWjePk>dk_mui*m2E4Mm} zV-M)dViG$zv7pHXL?o}(@1Z2w&0(sHZr~%17X^8f);U2FF0Pm; z?MJp&9|GIQ^qf*bY9P^XQJ6#}nRjtPq7^2g#7%sfYcB#{qGtUx7jp%HGrXE?MWOz} z;-=sE!D-nenaJlnm$c5j9|Z5gX-eHc@+EmLx(isT%pk~72oP;Y$%lj31JhYw;!wNr zwzcb&wsmrGKp5O8jw#a5B{94RIB}LW^}VK1_o&mNR)`uncp{UPMNh3RU_g}B@-%gD zFuirM$0Ycgh7JGuPbbB&k|kvX{hb3bp$Gf zdDZ$h?$W(<6fc#xxAR1ac7EB`GtqFyFLme>oWYEu>elAg=xoj$=%LoAbhe9tOlB`o z`0);=@Tjgcn-BujK}?9tqkhMQDpufofGzD-

$`@^Kc#rN3#MSA%)CD}wmW3Zlb zU5|^fVB{U$g>_~c0Y7G(&x-;M*nVm!w8k>SHroREl%2z*-t8@TER3EZn1_d%3^Qwm zp|NowNQGE*(lBTxI-sv^3eNJ=r`WfwuF~bK2RotoC?~O%G_hH<5q`VRak@h2O*|{t zrN=Y%^b|WoU|DWriaKKfqyUkT^D$_(uOvQl)Wb(0TZiYryz`f*@A~zNr!rH-4 z|G50Rc1?Z+C_NYxc#{XUsklMme6w9+IXaL*iid@@S9}tK+5CX?b>txld$|~D3-!G= zhBtf`PlEA<9wc^h@Cxvm%MDQFn;PQLKFPn zXpHf)Ap`&GkuVsZ<$0eMSBqPF~b1G6Ldf|AY_v_B%jYTfr2!9;j6-|@ILo?9K|lecu5qc`fJ`f zryoMNN+M&_9`v9>nKOzn8ja%Qc??*8@sdhAnK0dw)*m#fQ{z=~IbYjid?iJa71)ic zgl;Xy=Q3f)2z~2I{rx;*C|uWX1nz=!MHFS4!FtIEUFht8mGa_Zm*yr1{e5?@y>c7r z4DQmr_=Q_BF`C!qrU8HQGg6@#+R0c@n4v+J9OV~3l@tU_68NGU2ctOZc?~F#fc}UZq1wdPA6JRCmB#avH0A{F0 zU;CFh?raLU=Y}{Y`HT}QYQ&n12CK#x`gxOcl}<*Ul7(gA1)4VKg|uyZtslU!H6RSm z!gwOEQQHQ8|H6buidiZjJ#B-vSN%ThRDtt{cl`Bt!h?+cs%VaWpO0zZN#02Cxo7hn zPV1wqK6q)!mz~*qa}pRcx~drYeb!XjII;~H^^Wk&Qr4hcUXHbwnue@}`-=aiv}sPQ z#O;72o7{PO(V5Hh-l2M{N4S@~4nbmNQq9v$_$Xt!l?M(2Yj5zoPNYu3Sn;0)gRVcW z+z_+DlCPxY3}NjIe&vEsk(3v`uTN*yz#Qc?eq3Jkp2lVswryOX)C|uHp3&|cBfMQO zCbc@=$l^Vbdb3kJCfBvSU>kyX^tDz{U-o5|L{@0|j?U9asrfgW%Y3vb{t@d$6K_0A zqUOY2we&BedK|VWIN`4l^WJxV^um(la)j`PYQlw&vE`E*A_{LnfazJ;xjL+e?izOv z-B&HLlxhG2v+7Xe+zn*iT{FPZ%I#;~^YdE;rS~DGZ}{+Gh_BIBK!NGa_quphTJVj>!?f-Ul=-(pZplv$Nyk6jzkEB%ygWy0qB*9C zY3nunfXU%@t)xfRXRl<@UrKHsFPnKu=lhN@n-4PD2lpw5IKCB%*AG#otU`hU=kQll zqLu4sP{9gUQHGhG88#4dbOj_r)5_mM=n3Ghn#7SMVuHsei~~5Y_k;Ek%Fx6CV#KRf z@j0Uwk-_>W-%X|PnIfd4?@G?cS4A#q(hq(2x<1^LVaG$81Z1q`>*-gn#pS>x&E?Yb zsCwU%*H)NUW?SofYd{`&kmPEy)vMbpUi9?iG;Cr+OF9gtwO379)I#y)8RZRUORd6< zP+M0ym}SzKeQsrUXR?Jj5FO_a62DlGp8JrjY=IlW1CdW-xoSH7b6EuHprcR+rl!_R zVY`Sl`}31t1LhM2FJY~4kD&7lU4jX)y+H~J$`vwLRBnl!AKvtNb^^496eiT?W5W!Z zxyMJZF9$AqA}K+^sYyCQZqKb;j(FaAw=SjuW67Z7JwDm%|;8KUW&7)Jkm>f89}VEd@}4&(p#a4>dbi%M+$EO*P|+ve!NhD zpLSf&uav^UxC!7agE+oLZ_@>kV~f1UfqQ5 zhBT2$S#{?xi@3CMQ-lnU*JM}HB-f-?`pRpI^(%i!j$WMtNuRc61jqyXgyW*gmh2h1 zGWED#_Ti;~r1gVpBanLzTlB8XHe(I6tae5JRoPsYXzJrWo>u)(%@!~6OYijq0hEzl zeThB0Ya)oG_^C!Sqd%H zHM76*lqV{CJ8Fsov9x8;Yj`qi+kwcp(5bII?bQ8vG^saq+C3!&Gc+sJ2gwgiEED^unDu&iFJ#{5E*U z^yKGZN`WuS`1oZ&JpCiM1Fclkz%+RVNASMT-h%y`NIx9B-fuc(N*rJmLvSjG9dq2b zFAkVyEQnnHJ5Wiq$C;A`8EAY7NOjI6aBO zP~GVu)X)n2#hR4>2JNgeWdvOw_3SSloAzXp4{${xJGBEKtPC zxg(dKBZq!NpX3dQ?>UDS4zq(Zw0Ez$7EWVxisJSH9bM6mU0(3#q^M>hBNTJ2RAUf_ zD%p|f@Kqhcn1nqTg^J=!BI530gI%`t(kb5N3(0TXSAif|HWvL?M3P~yJ~NoG8zV(~ z-(o4mlE$DGC=KLapw%2A%)fB#P@)y{-3@~*+DpmaL8IiHg+=dZcF{WwOf-lZfL`|` zAFsrk)9}Rzd8nlHrx)L`?y=6!Zj_3@NA-(GC|J+m3T1ha zZ4*_Ze&z$}qXxSvv>DuAm{!HieiYXj@w|DT%S4ItGdhVUivgz@<-SY{!7P|1;*%4O z?d9pV4SZE%MRtxv;QtYJmQhiLZM1%8h@l&47)nYSgdqp%22la&5RmSUA*EYEIuuZ( zB_)OiB?T#Ike2S6Gk)JWKhOHs`;#^Nm<8{%pL_3p-CuOFzz*W_FkSQ*d(wu(Z^LzRDFh;?Pb@tqZIxe8a^NKr7a3E4anbAGhR+Yuj zq#}DV`Yw?P=c-);p!4j-oFr6+X(%&-tnmk&D5yP3tw+dHhnq#GYSu~(`$^$-*fMiJ z2z1~nO+M!%PrNLN9^~OFaYs&J`upt7IkXndTuG`0A1W@)S?keN-X*NMowuNFy6GMU z1dheSsfBQ$lpFY+ru#v)aD$W#iV|{Tb+(o;@TsC)kbO_y-wP))!6Hm?yaMhmY9Nex z4G_X?I%XX_rF#C=>}5bk>DL1_pkb9`l#21^c-$F~%nU6NyUCOF@i(3I0qI!~O-;Pi zWZMXo|4VZVXM52pd#-|@b7ccw3R?~-@aUj^;)kylATaGYpDCA)uj;~sa}YHT=I9~T zpwh>=JvcJ8eX6Ett==EGA)6ZwI%aW8IXmf8E*_#85lo)`wwDosTBaJ!W}`yZ&3KG8 z&R78`OXt?ZJ#s$PP$&XpwscX?w$8<2MifBKn%g4*N-Yi;SMV&7v?M1z+;lm_MA#yeXpB;d zz(Fs}w_hj}#K5^)0Y|K>W`|KzP~Av<5X(+r$FJt6H}uV66Ean)G*S$DskFOP(jW$! z08F?nj=6mv!*ye$=H(42bm|yGhq3{@*_-#-u9WGSu^>|{5T-g@?!E;W)Rcps=u z7?#yGuz*Kft(fSc)Jgizl&@1byfP_QVByqxH9ph?;ekHvFp1F8nk}~2g;l=h zb+sE1v+%Hkv_U5wXyDcn7?kFKY6t4NwBDs`A3I^b8}`Sh4@o}_ni9U2*=2Yin;4-L znLr%PMBYzvIBG&EW$yC z1N;Q1;~2&|VJvez7Cm0E!D0bO64EL$$6>srz?@7qs?wosW@EGW=A^olstli_ z;L{8~;x4TKyIME^Cs=5oDS7@o`2LA0Us_&tymCf=JB+7bQ`@@RV%IOb*DPNNS1O-j zuDs)LXl*0gQkI(aTSQP6HuOI}Le8uQdipMx!A3XsrY5@>5qubf5NgN0#oJn+(OCOn z1i<_Jdz_V~fT0-8#34+Bgd$}Pl17K^JBtwr(&bt}yK#3j(OEOIwx zHmO_=15v!?HLc3%IjET^r|mM)^2y;t5Oz>vK-VJNn`2*kx&sZJq!^>srrfpTS|T0n zK74;9K;)^{7f;YzmDD~c7@vQGBvz)5}iW9gv8zi ziu}CQp25fif_gb@fmZ*@y?o%OP=AeAGzaekVmq0h`kJ#$?H<=lBGsu+qzPE)3FSl) z93o(P-n8?Jd;8FFDj9J}eu0StyE(EOb~{&>CYNZsZ3Ah15qB_GVIoo9gc#RrZY=Rcu3#=-sKl ze}b8ReF!i0ewFT`ITYDC@-P07f}u;3CobduL_0T8w6Fw5+su1~d7AzRhRR&+9tc?d zv`06&$Tr28ER5NEENzt_MP5bv->EVDT(6&mef7>^+QmELx$Toh%m}`omnuV>Ed52k zM=TFGY>CA^x2k^)D1gkbWOfljs|Blf=)Y(oa!A<<%aX9#q=3usnu%l1!J{{JGJelB z|9lE4W*Y5?s+h@9=u_HKy51lCKFiCyX~rnS@(iR!JWUTIsIne(7qBm466Dn;Uek_|*mUp?p++FbkGWI?8 z&yQwPX^EH8w3`Kw-_MV;{kc&76c5~2izR+u6#O^zUITn7CWZ8tv=;qX3iAJgYVpxw zhU~73n58$Zo6jAle>gWe-s{>|c2+_4=gB=f(r-)F(ExrzL~x$)im0$FaEHAl3p)>g z%Rw~tgoPP(l~crPzd8OM$y~I77msn=$9xW0LPQYJPiYt+)aEl7MaH-Xb!3pS1D7wA zBWga>`|PgEpk*MNA&Mk>HqMON8at>L?+?LO5VU>YWUh1>3`*7lA7HGEX~oDgnI5fq-D^&p5Xxbc`p|ZLhJbhqJC}>I7UG?n-nld0Vg? zP&J}iE95xe$b&mq(p3Q%^dp0JW&dUD@JiXLfto-)^>m%VdmlOkonrA&87|InvPK&*(Dq=;s5Rpv} zdp~+$QP=8^nBu(xJ-&W6VzluoAM$7N6Zj3~2@#unSg5CO&vKGiEvJ=Y46%s^qfWsO zg8=VcyU|34mD`1iB7KAfI_qv#dAhTxo4Ag*Uub@vW7B{E zbakfV_5mVLNDgtJ(2>h8Q$*%%4$PnSyqx>I_F~u2`vH>RJ6~@WrWf~Xtq)2RM;IFz zoS~3E+#lEZWBK08V#=a-&{-)~e~}K8QhI50(29x~{-Z#XGUvs(-eK|VL*w03U+ z2#Z8KJ<$5GL)QsT@HL#i*0GID(6@nlZ>(}5fq-P9>N%3{J^mLggrAyy@Y5#z0aAw8 zOy%)aqu8MBE*t?RwB6>UDIk-GK{Ddw0m5|8T_3q7%&sT?n)YQ(o{G6#(#MVg5(>@< z^HUQ1I}F^}481hR+P5*BeQ&vYN@o^yKj$)SW?*H8`tC6m8g+*CNBg@i)HnNi)BHlc zm|<@g*Jps}E^1-024AMwZ4Q#%mMa2d{^Hc+citO-)A5FAG&ZAe*+bKI9Jmb z@J^-TInNvn9tFkN?)xTpb+W)3JWnlHAUHtP zy6EqcxnGqt$b26qW%$t+|FD>2zxn+J&JCjnqA2LR)o`v(K%uSmq`&kW4_a`b^TeVl zqZ`1hmi_9uh@Ped$R5A*yG_jbFwmCx*J#02%~yei0r`=J9jTU?hDa3Ab7x%JWW4fI zE-0h>x~UAhbM_9-d9lZnE72e{W|4@sWqB=%BR`IcRtUa2xdr- z`b;xy2x5aroyyvKyI=H(y8v^l$cr4h!_HF@2L@@P`(mFUk&M)57&Jt2Tsre9k zD@Z&>^G=l?-VauYFvmI0V&k&r@5zxH;=yhS|mHt1ftgHj?Hyn=f-ugCNWZp!$#Si>Fkog zj@iySG|W>RK;eM3HJ>>%V%;JmrDrdu=4a^C3CW#+nmFGT(QactT&ciIjRO3Y3aXq3 zx!IEqLODFpIB9|2EVo9gYse~Ufxz91=#9t{2jk_cS@8X5>FsmP@^lz}E4PYlW@uX3 z_QsDX4Z^Xc2&r?L%4}UBNiCrV_eImb*@V9l(s7kMGjiL^WX9u>V>dO*nPz(qh~A&u zeE$L!$O;%Dmw=k`9`{s5LNV1Eze$&+>?ykT`7oo6QN*l39thI=66&n=luv@^{ zz%cs@n0YKXJFxg94GdS2ZM%J)g)1zg(J9*#4dOKa9{Mxyb~unw@qFAs@ZH0*0n@! zv~1?5&TaK8b@ex?rU{Pb3E-%pC!OnEKi^9il3S=}%c{r#fdyNR zGh7O`4<}Z?DfIc>(J=8RSR|W#37V2f(3Kj8VkbAf;AQgG#9AF{!8Rvh za$o|TJx|Vq=psGfstY3Ob{q_&eegYNspw7tGiFcFN(WM(pnypR zm4P{yG@`-+iU^6k#OsX+GSLtH^_Qw?4RqyX6lX^KTbk8ln_E)1VY(vPI)^waQK&t+ zC%#?nY4G%j)2hFV_7$zf=Yg66xO-dBWVM{rmCv*UvOP#JuH(T`)*Wn zIe_r^Yk&Oy=V4TH=&%wqMoi$=;a<#;Tcyvl3!!J4+W)y{{p(Br{~v31qGURCjiF65 zg#$uo znyq_qz^2Tpb{Ti_ok=^9UFHO>L@$IP(Z9&a3scII4lZw)qXzt$wNF30cMZyM8gKb) zq^?ERu>JYr;)lD(juw&oV(9$>8XVXfkJ4tu&V+izUhm!9$hL3apXIl|KGW(MBFArR z)<4IzT-;3e8SuBz{3jW|&_k2ra)jXq=mL#lGq#|B@G+wJisk5tb&c`|2S?aw3_1+F zzWe*uZR`0SvvLvyN;jHzm<5Bu`39be!leT*GjH;CG}`vV=}WOA?-2Bw_EvU_QV#o; ze|pv%Hc}Cj$w{f=sAj!W&UIM;8f@}Pizq@@x{Mx*+P))J%97ER?u#2GuBCr;>82z> z;2&tIMemU%)m`@)w^V8E^u5Om;`LqDqEr(6Ej{7A^bdB_(cH8-)-js(mrIl^8%4M+Nes0IG1 z(^a5(Y27o8Tq{>(hB78XHu@Tdd|6EK8{@d;WRq{}q}+zQKTuh)P1fI0PBgi+k3`nK z;6MG^9XCCuJSm4>VQ*ZIekx8sJp$~#J}KrFUa!T)W)KFq=3A&# zLv-p=45qDpspqr?tccOoB}y1Fm;|`1T}>mrIEA|bwlm(KAoFF6KDojNk>i*E*ANCZ z0aR3*!cjMx5Jayqmeb)^EkjWB;TG)Cqy|rh`Vj~?=RVent>W6)fFzgKatFr!q=c0U zj&L#t9>)alu<1?8$gsd!kY2Q6UmT*|qqIJyvU~o$#kN_Ij1}|_yGhkn5--8s?~&lU za#_6ezwh$n>Q_ILd(4yET2Qq4`8f~nGuLF;4WPJ6&k1qqK)Kyw0zE6@Amqm91&>?S zfN*BqWlF{DfD1;~8)8N>=qRqRlw10TH@-^Zlpv~8^WZ?@{#UsYqR$9qr^o6*r^1Ka zUdtaAubYCz)jY9haI5a#)Wx%0O7QD9vM7P$jj$91G@{1=qMy?7wp~)#O$Wn1 zZ+bhlba?_T7ks;PhiMa@l2h&z-B{0y7NkDFwnhf&0=u31Mg1PKz}Dm^6KSH2{!M@p z{1Ti3ZP32$7Cf$m<46fU3{#Ty`Fj?ESM}O;IeKIMfftVbLQzabU8Z0K*znG%+P67Y z*XYCLL&ds0&h{V`2k{*ZUY0{PYj*P>5(f*^ioEm5)W;XVkd&M$JMBYy{KL@zc^N@u zix$|&eB>!KZXTkL42|NbG}1rD(kbayPVDQvrp8BT<$W##f)WwTceKYL+JRUqW%j>f zxx&^dBukYrHw>46l^PcT$c01O%YL>Bv9dh82wVG(%(7K4#G@>cN?Sx0p!XCr&lF68 z3CMOV9ZH{zAOxSXT0h#oD(bUfaDFPuc`UY$u@+*G>roWSY7Lvl)Swt+)Bf{4J@JH7 zwHBL3WnAI}TaB!mnL_i46;nx5t~AY)d)=?2CyF+H2$dUwa8yk{niJ8pL4Fg#K@Xp& zJLVRBqHR7jq)4ogJm>c5j_?k_gxtCfI(eyI;5}4_u5*=~*FQrw81~){84??Om!n9- z$opm@m+;l@V~bgQzR1G8aTqp0NhFG@89vMzJ95SE)d!e2fFAmdW{hMA^e1R=CusWgRv}q`;-ucp^%2~G9n&7nK*{-? ztHKYlkZhKhsVx3hTV0FA1=>f7!5qubdoVco^Mo*vvlhpa={IViIBPB(C^M;b{1|qt zxq$AoJt~`3I&e|iiv*ru*8A64O`Ondu0X~Pc~iALsjZikAo2U8+c2ttu@2Nl)n6TJ ztkDXE80+Z{mm~_I(Q~@c-H(dmd~SiOdp)Lb{yv%IKt{*7%`m=bt!fkVr+W^!P#<7G zEiO4`o^{k^U@WDfbhhT2^)F0{=pc*XWjk~6P*?QsVs)?J9=ZJQKGa*8zKX*E78j58AHCP z9WKw7l5q>$Uo0h*nmq`iPilXz*FqaWvG(S$0?K-4+Ixh6ftD2k5#CjDPboYd;5e%S zvu;sZa`x)yHBpH2VzL1?6Vy`!=mA36Rhh2Tm0z7Z_-^A~eQ(DRr@#~t0Zgmf@AE*c ztNQZ9yrkolcRu4jAiQp(n?}^_$8xjMcMdbv4M9~iqD*PBk6W>cq{`?Ewz0g0ydR(Q zMO6IrDJDEXk|z-(e_v6z(^=!6mo?HH@fMW(hu|G!Ezth9FY!EUs|~tf61OX`nep{B z82W1|m{ z7tgn%IjYv-6yL?3rJ6d`fhXRI{fU~OMie*p zs@AgI){&uV_r!5L;i%DX>1|Kj>=VSNrPxe85wL~Jveeebz~$22k>&+M=rO57=n|U^ zpGmvK#zh8Go?p+U%Dy(+t+5owd4gtk!;ieUgzO%OBlE2`%#)x;X23XNEDgqyU(G@K z4S7H`@C9Elq7qYINGH1`k0 zN&d&B&`XSV%LA*#V8%rV(Y!W2bg|30b zp{=s6btx_EhLD;Uwbzh#KUFACaGcojClbD59dONREGfHt$^x$OM%YL9Zt7Q*^iGIw z7Awr>N%w4iQjqEy5Emh}o`&y7SrZek5-VR;R?CiJ1yLDM z|5v?rfle>5x~f3|Wg+?dS(`P+r#(l4{T(;MRC>4XuSdaMzL^5Aqb!V)yOZKe_m}Ot z0|4Ax#x>5~m@a;_8;`)4jQU{mD-Fw8VE)N6G8_rQ3*i#NI9%IA-Ee$+l`f6f>Pqc0 z*ZO=JLRxA-n{D&5Rl@zWEa0YXWj_z^Y>B|+f;hpCTiEqvie|eH$j5Y@znVrT# zM}BWk;~nb^7b|*rJ1UIIS^Ud3XUllBg9-p|6=d8^bQq3eRm%7U#TZ6 z*9efgAcWKVgXBCqOzz@m9}9a=PH~Mvp!XcB4#?64XxYJ@F-TfAv6WVq*WpFp$bC+m zFKiSc6ipKKpJ^^lPNf+B(EmfDz>^-+AirCJI?~acC_>s9<E{OkFKd!wRI~FiN2N^;!0{;hS)7I$YZW(0ul!Ej~<)6 z4dJ}e1)`EceSx4mQA!t9q1`^^fC>Eg_X5vrJ>E;>!+)S`uPdJz_?e0OJZx$eKdVGia#${gZTx zX3Evpw)Y06)Sp?Q(mUamKsG%vb&5XHEmVjYGS>eXUk5CW%INSL-Uxa&%0Z2@TwSUF z`-94x;%OQBeLyITe7OO)sM>Tmh$C|dD1^Y@R3sBs;cL z=NxmWwAM?em|8UcYF#r36tUcc?q$?t;DB9UTkF-}xISAyjA*1WiqL)Eb7NP%)jCCd zy=Cu3!Nq!4TXrsncq@iKPYk5SlicVmDYwk%yQ@~drO0Fg7#SxegDX7=nC`2SM$n~u zufI9J;WaaLvnNpND>STwi)*VW)VIJTo!?ApLF+*ef7%>f-c2Na4YXGK@o|6Q?~Or^ zHQ~(@mN_F>-tPI<)Jl}CMyc+eD1w_j)OyTCRYPsqS>c@3>S~_+JeOlp@q#*!N=jw& z?fCm5sNnt0il{5p70M2=(|{|puiur21j$wgn55jt**)0@o@Ax|Wd2$i6dIOL*xk=P z=vF+tcbNrLVF=(Ie&8g%M7hq`4aVbvY3=QWqDGyFQ=Ows^HhkLg->Z@m1tiUNvVw5 z&6fIm9c;}tI<3giz&g>{a)agm-g>6Ts;%pU9ae9YxmvV^D@D#uvA4Db582?k`2qF_ ztZrZ{j}uuozE(PyDS^K(o$^w|!FqZ0QtOb4h)!l?{V(!fn$Vo*=<;8UA-o543!!`L zEGmm@vSfqnNz9^3#9+DGU_!)XjQ3kmI&77e{D_@^Nwl-#L9{!&s5TN6GxAkI!jYvW z@1J37wk5B2N=K2Q9giWam53QYauq7u?>Q0OmBl$tR+Tn&Ai@ho@JdGz1mCnJX%cta zp!?YKp3{ozFM2u>&6a+#YU4$hJ~ zONV=Q6-PEDX(}8QdY&Z>&Z;md`~siE@7dSWG?5w~z?w}Ml~5CLAJbGqrSII_s*Q0N z&WgtZ?2 z?r-eNgqAFBh#6}qO4m^nwEmQ}qt+DGvKJb#N(AQ>a-g?o7yOATW!?9eJz|a*-E~D6 zC!z^QpM&?v|M2U3O1F4N|6(%!rg+Mp;sh3P2y{k{FFa}xCyd=_w5LA((7OCIAe>w&1# zPh^FzGiwt-;#cx}5)<~4=f{$vUOw)O_{;q7OX$G!ygHGNq^5_@juO#eRZM&EO9?42 zzID3drA(%0LW~R>%Z1%sQR)dI-f+-Lb}}kqsFdrHD;KiRzbhBGT@B|y%0Kq|H*V?z z*$=3?t*x@m4TE0F1c@Df&UxurRA6;9rbNG*~;_&7t#QGK;vvHosNVF#& z16dFcJkpklU(@nf-ucCYj#g?3i{|j7Q8FIpbqF%fjopcIb-Yd9(ESze$EMYGk>w_J z*G|N7mVFoy;^y|YZ!jDSJ2KihryvHA6l$NbJ2Ge|9+->8qw5@^PNTfRj;p89+OLB2xs_p&@9EWdXq zT_i|KyCRk^0S!Jp$L=%E^loI&*xq7&E|$@D-qpP_>%ymJa7nUIuiMP+lJIcGG0OBa zPI&KwP(uoC1A*rPe5kuEo){Sljj3dziShsr{Z?O6d}p*uS!V#9vL+L#3<{#Vv|^uK zIt7t*+WD}}Jeqm4&Ns*I$vcLh2ha;`hsO(NZ+4SuDW=T?Hz}e9tuPpCYytTAcShdKoJRT4F7`$X-H;VwFK0K<0FKHrn>iPH$6C zD`SGr==KK~m-BUje{YX)4wk8I4=KS+JZiygsbl{^)1oKkwGc57bNo!BAWZ5F4D8np zGpV;%^x)H*zqYnc)NLAQA_L*y`4v?$%+*&v8Tt6*Me{%UB$|`9d!5P&aAJ^o`9X%E6uX6Lv(j;waN%crM!1!_%*@XU7n*9PtC2 z1XipsdJos2^BFg?wp(vE0TOJFbJAgl4T^%i;(kpn(AJyzOt$5y1hB!*Qq`MsI*>-M z;g1%O@o;Q=y$!T4k>1)=dHQ)2wl5vTV*yQ;nDNaE@h>Q6Ueu`$+&O*Ss3Ua}(HfC| z7cmm7lo&71ZNnt(9194&n+c5E+%7~11wQNby9w{LuF)ck+HQ#EWYTHP84@Yr1vs2; zxt!E2qt+?0pSbo>=ytBiEa3pz4aohwq`L1ziscDWG{fvP9(I&jXFF=dl4M{R#hbr2 z0I4psjC6lj9X0WAygA8Hjm_GXVjibE^FyOQ*!lw<-hwoKcC7y4aJ5%q*xsqL_{Lh^2K+q-nQy*TW=M}6?7hPE6rU>4!6`< zm3~qAZ1FF}AxnWx4wWSn+YwjG(hMX8m3cz*{(=&VLjBEv8+mDSh8nRJs0?chgQ$rT zjrT*_D7-iE&3$)o^=n!=Fn&Ep2(nI}EolZyGc&B^fQ9l5^d;+wZPGj{MSz}bz%^F^ zx`bXZbW`==S`GNB5M!BTJ8P1W=tN-M#WWB^CZY*4U6CcIx`@XZa9jV$DlPF|W*q{y z>y92zdjzD;4399St|l014jytDlq(#%N>P_>DKOCX?ce4pzh_0mk(p^OE82p%zJjHefK(_WAUh>;V++ zE$_K!+-%>5)x3olF%LdG-Kw#A4P2WnDdNypCxJzT564a2ZW5()w8q&|N|d&`uu@YA z4r%YC-4ZL`vHGNYGVIHejwLlmv?+Cw)sA8$9_DQ(X=171ntYn=PgKYw9!-KqgFf4t zdj?}pCP_yK29T(=hgXuIU;3`g8}#CV>tz*Ih`pi~SnWx8VKE_RnNh}hiTuK?#;1^2 z?N_tkMX}ST+co2wG=kIzd350&;cpVDGr4U$Az;o=9At~Q#?GYG_C-SgBK8i$gRziDFpC2A9~akUBdoF0!d zABFdk&%BA}Ng1m;`aM~u+nbww+pUEu?)KpndrvDLNWX0Rk2FGtE`aSN*=D0gtD6G@ zb+b6kdeBS>jYfD?3qzMrv)jbu?H?7BB!%w>Ic~GIEOomY1)eO-sXp;HzJKb%>JiWG z!ULnrK8(1{V!R|=5{+~oz~JXE+PpPtFRdXsUtPoS=jnqU25ws^i=0Q2!ey-m8V-xW zA6PA3WkxdoBVcap zx<4^DJu%Z{w4luKzTUa~RCC?wuBBdM8f*T6Y%_A?_88T2vi-%)HM z8!=0-rJjVhqQ?h@p%^08#viG1j!2KQ0{0)@`&hmMNJ%cB4`Ye5n)t8i7?-006M2t+ zkY}hm24+)UlJBo{t^!w?l<7Y-0;A?%FzGRmxF0T)#=T7;?sZ#NO4;;N@T==7gC2jI zDl;TcsDEOL3K#XM{l1U~3z*W(mKlA^YxLbRK}IYx>w#tXP(XB!y9_I~x?EG~ug@1? zV2WuI#c2AU;Y?BeP97~?VjI*#c)W`eR<2y=tIq1 zCz#!&1BtvXQvqKDEw1}VwB)dUOr)bMiLTL>V>$h*jVUH|lcL(1GyhayxQJ-|v~^wZ zBKDeML-r(h-gyV8CTvB|9pQ|)gwOtc^dXVJ1^O6wmLL*6YkxR>6AYLa?MIYUOpaAN zCGH)L|R|R4tGFb4g?A3(h$L zUbNP@YKLMFlR-B44Q%Kr{4-yj!)}beTo`ry~*0?YchNgG2nfZ7!5 zX6r$3)*&g@m3BzbsPBOBC)4^=8M8lVqPV4%rOb%g*U7uv5Y+mM0Yhp|C!)joq+D?e zcp^nWz}0t$o5#a{XO~r4OuqBEib|*?x9WaTVa9(ZkR}-aM2LSki|s#QS%VU;U901O!0+$!VTIESMEz!m%iyv+_{C@)5ZS|z7#{anrB>nt zkNs2sGyojWTLe6grM(K{2Wy`GWViA+I1Qi)BF16IO#-;;u(`Q1J-$Ua zTDu&t{gK+5n!(?iG_C5h0lvDRi5#9~#|rFbB%e(~zw+4#y1)os$C7nO*SYvD+q&NupPjXO zb5E7}H9xR5sinkN2&&@9VNG%ZW(e$Br)lYfg|dqsnZP+@X+>45tbqQBH$C(YpghwHGya#D@ZE!T(<>tR zIb_e?@n(3t+HIl*F94%~#9{8oGlU~Z@LU1iINtgGRb9wp%qj@;83&VMMDlCJ55INT zY6VtpGye^e16TXOU$0J*XT_$q5d2}*be^j|vX?z!s*M58=egfo^09tK;;J#5jSp{` z$K`1qAH%k@5Em9=%z7!Im-UAoDww8eN7Kr{%(U6!E%NSY^x&lj=B>fj*`EHT=#bX8 zU|(N!jtU)|kj7-fy^l0qkSs}d*jP&mP6�iL`QgqhYFY(WM>U_Co@~mcJUwnLsT( zp7l;d|3Vk>n0(r%7~6~YwO174Pn#35IlTm-`M@RZ!NWoaAth@*MT$$>aafJ0bQ`xU z+c8A4>j$^v3-Fa|+QC{mJ1OaG9<5vOIR;+lOt@6SyOFDro9F{^EmxJRzk#X=v<>*!(67JJFazFFEp;UwR4Lsl*=^egA%5E)?<@vuqqmBYH;T{*rQ`8kmN5cPH=v}a@h z*RE0uzVk>aA=lEcZvNsKXdPJ9t*}?rN4(7a_emNEPEFd)ea&$XNC1(1L*X0pInyrJ zp@4C+ExA~A;eC=UI6}2u`qMbeN=+0*8tKUzBdPl)FBn&VcR=X$mV(>TkeLMQEo$*L&-rT4SZk)(ij z``nUG!Ji9Hb3^a^U*7AiQdg>66z08(uy-sY3>$#3SEU6~m`zO8n5h4_E7?zJWwC!w z_30DmxyPt81DQ76zhBf(f2nbO%lsFVw!rx7DSTaz7meFJ4puL7PBfM~{_|PC!tv}z zuVggwcmH~83b9hR{+{Wc)eh& zgfoOJyD`gtiW%Ug;x$?6i_f>OZ@5i}nqvJ!%+6n{Q<#}+r0R7s`B3MFr>_s{)4&nQi>!qcZRv!L=vd~j*Lh<1evX)nm+ zs{ADAL^2??1dZsu2>dW$4Ae=0M-0-8 zB~!HZY(OGsKd?A}q3DYSO^s^%(YcQNwd_Yg3Zz`#H-S5A07?W8gmtwpp|*!9GPa?% zM$=kOCQGI!^F{}R9vzow`2_R_=>UxLrNigdUYqOY2?a|HQJ8!KUJdOgBQD4+&^h_$ z?BISi3g@eHRQh7MewBe69SBO{==*?O0#%3!MD*N&Rzoo!zTot^8%SkOHQ7#OpQk$@ zs0V-Rhn%+Guhjb>k{zkgStf6B6ZaoFkxAkYx!6PjLYRfKBE7ycLxAg)&Sc`mn+T?O z1HAj6>i08dw;RtfphX48wRo){eEa#b%H73}xmZKuObCB;auk5TaX2r5&zCTyAT|E4 zNkY3A`f7gERz@Y7%n080odN9L@fq*enZ3{+78tAc|@3A zcbQ*ER)lu63igC?QCkArzbXwi10UtiZR_3gmR`;nAaISaw4N$BTw|MaqLwRz;%;U? zLS+<_<1#8lY;mBk5SO}5+H!XKpDrR>-g}J7f z^T~Bef6SoTj$6vv-go8{1GLKwIHs##F?2S?Bue5pcHCe)$vnTXk|A>v3hsDFEArAI zvdeXe3tpHs**gSTi+$!78Zoylqt9*85gF3lo{+C)y0j_nVtlnYX{2 zJ*uXhy&*0%JhJs7OF+W)t`SpK>&I|jEe-gg)C$0kgOqlfsxk9BdW~`W3RSq<&7Zu2 z_h91B-?IH&1pk8eQ`S7vn}=}Tp--s$ZPfcbxx(w`UTNl|R?amp{srP8jMm!y=e)dj zNBpw4@BbE46p(*F+n2cu`2Fq#KqN&;ofvqlD{nUqCLVQH`TXR~aDnnP@F-b2>4?2j zHL=6QG6Y$OlrsM2oR$!GM>(dHr;R42V=n$2)Y2wtv$}b)@$7OlXI9nyH{o*mmd22FEfPURNuUuZ3E6W8A2}ab60>H{KPqb zFNgQ-RMI>S#0&waOWYlJ5bz-_Xeb8$8?>{k^cF(2F%=z+~haGJgB}+q=qBB zd3vW3p*kZHiu`h;A%A`~KFy(njkl=>OnOo@5_j_n|K5B}eL{8#rndC> zsN)0K%G36uZ$5t~m4xiSic%wAKy=;)W$rt$b<`}aZ9)xKmQcI;HnybIiX4zj+8|N2 z0r;)nWwq)3IRDV7#j^F>D3dA`f06CK%uMYANOicF%YyU$x2LtXvYxO~l~Ma4 zYqyj_uM(&7#pW*YMSJ{B!QX^PeB%j#V4dMsJwc6x~EiI@^0YG~_8fdpVg;{CR>A z+7JP~RKq5sg3>=f-U-r)`v;y%2lN{p<@UVe1SQTWZ+=0Sm1ngn@W3C`tZ+{?ffG`v_j&0rputC_%~xs&RJ zX6%!Q-IV}K;~6_ohx@Ah+o^S_wbsrI#%7XWL8Kc;c?#Ju6X42j8gci|)beE=e;q%A zglEs)0qU+d5W<0l1|F+PA!cv~t2i@;Se0JyN6_nqj{aAD z6rBlrkJ00D_=ilni%I34aac6QcH+ZAIJNag0FD(ty$UhJvS#A*yK;?tvSvFG*S;zZ z=M{1c%X^=ZUk%Uo;&4ZGt&}Y}DT2sP*u*}*NU-0I-Y&6KSjj|&2K)%+jxE(87uFU; zegt1aIS_#y0KNp5{uH?=Bv6YHnG}3WmyJSLO_jaq71a&z&F+o7g>|6`_$AAT$Pud} zk1VHD9<|E5r1Z4>FEaweFOd#W z1{~>u_)M6(jMx?NWUt~U%PaT&kNiXp^sAt(gGv9^v;F@4w6HV{eio{tkM_)Es^J3; zf0@T>Ext<@4Dx9H`t4>Y)SOr9@G!y7p9MibXU*6Mbix>$-xy z&E4o6)I}D?`Zja7ETiDao!ZqiEZ!=<>|g7;#DWG_-7|e-tkROrPTvW01YVcSVj}WV zCZZDH($JnfxYgVlo!GYvS=yC8?JVc|voBTN71@SbxeV0z`1Av8^qeogRR0PeCL=kL zz28mxxJl(G)VJSiwWEli zxu_*@!Wu5M2iHz_2Z@MKXcyLsNQZSRbl_H}tj5}(I@THV}{jWmaGe1P`T_L5wjG)OL)&|YHPvPN z7XKlbU{QwN@$@+EEFjbkRnwbf_gQ=O&suxiD>n(>j^9)4!F}BGH}It*HPnA_ z6zc745f}jmHCdOar=OnjB%Rr2+RTVFcC3d5>`Eqy8O7||odc8-2w}Jf{&_IM{h57= znz5y@Wdh>`|Ajj%0UrYH*MIR41`^X52li>+d8GB>jOOD==0S~vQ9_oHSX-trZj*hB ztS!f1FYYV7e(t@L^PW19>0(_&ifeb`=CASX{z+W;f}Li?9Vh$X6HjN&)?kBjN>EU z)6;w^;G!G04@=hwB=2|BF*zGe^-f9mvU_&=@mH``=T)5}ud`FQhZP#LX2>+tDXZ2J z{FNgAmaCBJp0lykVC_E`jsc=vm~=d;P1KYxv9$Ea3~_0k7rJVr7%9ds77s zChpCSjG#Z7pdq$uOVKyDiMP#ry!M{0BpbDb&pi}kfbDOP? zhbZP`Ev^%-KN-g?5pVxCzI3Kd`SlIcYWC!g)=daeL&ox!U9-;a{%?LUoa{%}5@jFX zvVvT>Xf5{P=A=@}Tj5(V;bSTn%li)D=HcPovu8D>VB*hT3%5hctG2_&fQ^dFn__5u zUG0NonXx^RhUGoP*+%E%F1WoHqPkKRQlz%0LZ{orzT6k@e7z+QxyshBF>2p9?uyRn zf+v5?6L5T|Z9Fdeg8AjwyAdpwv%%uW zB8Bzkn#-aS5K|iga35Zpee>}?$>_Mkvr92so_2=Xoa_kbB*Jcd2J9OCdH&&!2ON(& zkaP$7R3)yij89fZS&Ols#`4x7@)Wb(X}dZzjXQSyQ3Tf>tzi?3?95MMZeLO4oN<}L zhjxK*&7?9mMoKLZpJTDUbSbxpj_ngVxg87QukMKISUydN`*CRx%M98+J!93FS?J{F z${jK1<+Y%Cx27@J3;RAcGQbXYni_E_dR0y6Z49$Z+<6TI0qBC`I^7{w|HS8jD59U3 z5kaunOjCDt_80Cwz2d2=g9l`6OQWMH6GkVifWL$i-RBym#5 z%%Io9kDUi4*f;cR?50#q0o$aRSD)o)lcw%0@+^b;c>Yk_ZZEeI$aEiWC+3dZ)Qp01 zi*VZaI8me8hxjM%J~g%9P`?6<0@cp+4MN%Zv-d~?{+|j$Ebi;ag3{Dv>EM_EJN{_G z)1CHmslIojcn_EC#^bmL#0+>#d_~Z19VbpNT-Z~Stx37aHAM9D{iogKLiTm%h`~`W z@0VxV(F;S$r)QP8QItS0&IMjjv^@=_$g`|uE-)b{996)HncZ27;Z<)E|Dd|?skIB- z@+0&`7g)cDz^lQu534ZxQ2bB?-Ypq<1rmL@|J;NtNRFjd;5MhgW|E^qmUXSA2qzRp z7LPA7p>B+i+X)Ncb|Hp>I7>)5XxkprcQuJXL>ug9))S-451{=0{bGjW#Iv!wG>aE_sH%I6i-yDGeBIwu$;a==#~3i6u+N zkuIgPZ09>)7X}-NAC3tQ2nxprj!bRyV7kX7QDjfCgrF0j)Znpm!ZSRW+E|_wvnr=? zLk~GIi5^k2no{;D_oxF(va#<&&+ImpE4zhTh}*^@B(L_|vTgovAGYi!>!K$h+fcgpxIdQS&Qsq`{^*3BA$Y#QF%_)RS zu`d-M$0EGav@;2obpO#J4)G8swYz((gCVhe$fIoP9+(Q7*QA}X{0{nM-Jn`~#(gRe(#Vcs5nsH3@9;O>L%{9titnke z?n=J(qVXd47CMLE!FoZ{<{NTyXkpfC_8JznFbl>*|47nc3UX?LetxM$ckfoDLuBxy zbmMma`zw{RAecb-?D%bgoCUy7DbN z`No}*AU}z9%aaiG1X5F(`J zIalU6&4EFlBTm7Wk3f!}?UUL) z2jjq9k`pf1kVb+?yZY%~9quEuvFb&ue4goEC4H=<$NK%~TO01%&i>eON}0g1YIJ5} z)mCAWoVC5iNt{t!QMK>*H$imvY^uS^gmZtPMJY?QwSDxd7xt60r0P*6*{J2|^8Q$e zeVr22rK>YxcJK1@)3Z>|dA?SyS&0$4>~``DFWMi=r)i0f@TxJ}zPby&X{i@Wv$LFy z5qZ!AQEm0n>pSfV&1PXKS!P-@ zd}yG|c0~HeU-tq~)mVz4J$?I0GFIXM%Q2}WNS`pe!Y+gGmQ3ZR8J@SV7V@&QnO*|t z34ms6buBTmE@wu3UMR7^F|Ospa97#b)47szzMo1T6gycMdn%*LO0+xgN&_Iacn9 zBF{wgJgs9t+09KxZFdu&ahRSU!$hrRh1O%4MNB3cHHf_hxaMSXEcJ!T0yPn$p;Tg@ zs5HuI-`(6%hv7Xwdh^8x2%(|@Dded#AJ_wFiXi9%wTyL0zsw7EpSYPO@-+3#n;toR zcN1HyvoE@-8pQ)Sdq*@$WGz>#wT5F^fGElVg6M}J-k%{yabl7q7_X^oL|UX-g|^+P zev=N8M1~cQj2I=nMMFmL5@OIKUj#_THJH%sOqdZ%i zjW>`lKhsKQ{y}|2M(nBv;vz@B!12tcGS!?l)lVCn4Xa0rdXdLH9~nnF!g2Qs zImvBjjZ)2Oh-0-VwHIP+DxXyKPW1cUI*)p`$L~KJ!BGrc^bllr--UiXz=7KLs-^O( zt=H_H-MbB=*Y}{PU@x%+*;P5O)-Phy7XhaH#2s`?peXeus+-IoXXnTD>6H=FglUPYX|`giQTFa*}pb}TN(AiD80XX`Ddq`C-;KvD@` z{&1qOV)V1^x;V5+q<_Tj@wAezaaDaUp|eak0?e_8f>bw!C)|)BkOLLVa`ts~r@7d> z)VU;t=HRXhh#ad#KM#;DbmEEW>@w1axnNZtfl3>H9C&$a%oH@AB%@eex}>AlETdMtL=ay8)^CqL0f!2D7iCkhudF#O}hZu zd!6xpXbNUJv_ncnC*9|^_FsE&o-^S->U-ZdOwO>!CB@ZQSRgC>rk}5>;?utJ(o~dl zLtK-H8y{4`y}H$O%7L~(6pg$meiC1_`RJWpQwq5ZGmJo1Qffci1i|gBQ1q&thbW4j zjqt={_w=Ec?GnlKGgF}D&`pXdvdA*!;>2U{SzmZcAr_%&}+}Nh`n^ z@Q(=xVaM;Awzh#C($jo=LQH#I9&Fbg8tC=ecHYTEbZq9Vm6QPOwK%}QxH%#}6yn?5 ziBE2VM|($=kkKUEVLHCkCo&~Jg;1x?QIZzeXC-aC>Qc09R+1m6AG1rDz_@o!^fh=t za$7vJAYGHd?~YKj+HAGSBiS%Ed?UMDa92V5nf{-u{!uUDfh$6F*{xl2(62u$NIqXk z>RwXl%gSzZY0GKb+6!Oklclxoavx%x5cw}#Q1c*EDLjg53dtx|Mov6-9F6AiOJ(9H z6`Tlyq7!HNf`fz`UULVhRzCD*ns}+XOe@?ONTax*qa6t@PnH_3{gkR(+1q?@91Ip{ZVAhp_ z41!WWe6}UePS$=$$*>J762h*;Ucfy}d&={qd31%N&*oO;l7#d0$}aN2##l-aZWE zw64{Z_`zt1ose>$7OFw_hqjQLm+s_kd}qxGA2+v(gx+`XzOdD`Yd~#U!fIt@!`4It z)08VY?Fu0N?n{4+EevmYhsO}~pvB_t70~2k=a;?@_x3oe+hZCecq($%GS`e68`rIS zyOWxdR^R8%XY?&CMqVEt8VPa(q}i7uH+5BQj65341xT`+Xy=n-LkSMAXKK8s?I(Ms z(@1LLsZ>hl)3m9nxkv|iK!fKRp6Ks&{5WHUGa~ImFkTgzPqA8+ZB$8W^P3XH1Sqrj z&v}%)N8Jx*@PXeh<61*vnUZqGGIhV*Ye`tE|W0NAiUTGM^axG_*^ z?%jiI=`>v^u3@GM9K-Q8m~bi`>Hd9^KWbm7dFT#(YjgbJs$Yf=bZY`p`LNa(nQ7^D zp1SGQ2eRlt-3RuMwHl~^vNK-^w%xw&)OQ`ea9>+1aWqgxCJNY1@UI;Iw+qT^P0K5* z#V)SF?QNc$R-qBH1fB2ZXhz^=*VYq$dCU!s!X~|1P{^GT4{KJ{3FZLL(kpB3+x@U3 zp@?%QkOu-bo|+!3%`LAE{?>bWOE5IE%?CBOJr_6#y(gt(b7B!s_@2pzOTA+=b|KTE zd%&tF@JXA0$excWR`ru4lE0x4g=4N!2+g!!K99Z|=nM9-u((0G{$4NC)2IlBl+h?v z_c-=Ryh&Y>c>~@ROPLe+l}tefxiEC(e{uK5%w7bC3m$P5+?<7w=`i+kEe8 zBcH_SocW8Z_qVTBwKyoMO)Yj0Fra)flF?!B^A}f3<)YrawkueZ72l`2+9n?|nc}#d z{m%XWALAcT?Qi7!^`hk#Q`}TfUCh?ludH4INqTAB+)jUGDr`?xKYR<^sZxt)mET&Kl>Gfrl7uin}3h+DlH z|E2E+_?e)60Y&#JTi?n_5Fx<`*?Sq1CZ*ES5+7yTUA*Wn&d!GHy%{zgTsSnp%T>WY z{Wb5sfW_Q(Reh}IJXx2o{&&wkbqx&*3)_2U*gBdSP06~+6a%i$x%P88{_ds|i+W7g z53w5(^Z$+lzpuyt{1>G_)5~g5-bK zOMiI}r3CnfjF%z7&@J=JztHCYJn3KFfB3|hIg_-sG$+MX+H#BY-}TbJe~%`H`^`Wp zp~OP(*6-{4_qY8vtv~;l#hv#Eg!+hkJH^D{KQaI_1&DW|fHm;yHNWtmS%Xw2>G};y zF?hcZ*Ps9Jzn7GM@>D3|g2)FO8>`BssQ)va|F_|43ZA_Tu}CzX|KD!<*X8Rka~&`} zD89K|=rZcb@lU? zt(q&~ueIKCKKr|dd>Y6Ez&Cn&$ufE|F)=?az~_<@w}~_zuN(gcd6{U^R7J{sz$hY9 zdqjSvzn|~ns<}MiIIfM)^6t}3o5M}JPOIb9PMeE&oF?nao&MM%I<-8bPqaO^^dC{c zhigzC@F{rS2h=h+MP7w?6JZjJ8{F4!|7pjhvvi<8b5qMxGI`^{@7C^PbViyS*I>}F;?^4lF#b% zVz&K_R2Ed<_R_yOEBY+Gm3JEaIB6D)w%3ZLudoP79f;=FP&Al;gu~2dw@ElzZJ?h{ zr?(NyYxt7ImVngBdRhm;rG+vEQ{ZPRAm+-+HFX4-=?#T&_ zt97&6t9E69=HH-5a;x`pG4$;h2F6i6$u|>h5420y&E##y2=q4xY^7F_`c!h^u+8h> z516o*9?PQ&xkr)YoV!Mh^z?O;QdLm%;;Veudqz+-nZ^}3KHi2_b8I`+6sejKJbK#y zouW9~iV|HKgh^7T?#d=l=cfk+1$3uj-rx#9%-Z&UrK+qosRVC(+332A78$Sz)!774 zEo8OrJEGSTowVXxvi9b9@To40Og^eYUNU0tCVn1=_}JZGT56p^Uq>N7Vr=O76&X?w zDyqc!1e)m&!h*NIU(BEmR_fUyWiH}#*++{llGoCKufZt&Vp8Gm@kbB5tP^QD;nCx>u4C)P;^Fs5OYQS5Z-y`@Cm=A&-q;_4GOV;NS(U! zE>?XhqUMX(zK1i}H(gtARNQ#=uUedmf|mGPe!Gv2X{e;6g_Du}iurpRSetyC`LL;+ zrp@%q!DSnA!SGn!Zs*D=nWD%c>xo@efbA}$Jo~#@Y4?-GJ@~U{3&CzWQKzJ3h|@GG zxgWC8UC6Gu?DM_C!BuYd;{BpU-^tNk=a}noh=ntDyHT({ndNZWCG*P12IftE5S{nv zv;?yzKb`W(mm%Gt8KA9Xd@}(M6U1)u(V>dm?(yDhTT-o470S;O=8|X$yT(*xsGR8YtdJpkg> zI-w=yvP16f9!Eww#C&}2G71+Cn;A^hfuH(A^EcJ>&p2lDbf`UC{X&c|sKnJ@G<4hn z$++&X;lJ_Gd$PP=uQlxWMMC&-{?rbmCxX7$RY~I;587^NHF zU;klO+l>eEt(rJtGU+dGW@CflgHFpzz6{LM)d$&C=Ey7F5(u!5bg*d-FnExef*Cg> z_bs@X#B#xRc0y?8_BAT}d4(YyAmO1Sl@Vk%RII~%mr1>;US<{rYucU%0)e=@`#K_( zv)58;DPa^&5T<-Omf(WE*+zs$lS%~<<|r3W%MeD>ms zG^F0{ooR{LyQGEHDp!kMR{H%Ca}(^Qz2C1w2t*a~w(C7suNE6)lcIm6wrc*t`*Uf1 z93FQPp~&T8d`b>n%Dq3Z9gJr*5ni}Tv#8T|xLjFjq7m2zBqqhJc{O%W*@pStN?q%= z6J^s0|BOaH5Beh~K3q6NoVJKUp4(cj$E`W-?UdsS3QG(~xPBv)Fibzdqwl)Yv~h7K zP$#%GSLKMBx&6Qmf!Q`nz=I53`(k}l2S?xBZc?YmXDh8NxZ>@bdd%9yl zQ}GMx6f-9YkHL?TPSn*}Jr+T4O}0y?EyAK;*f3hg?jcwY!yc|??e>-MCVV1<`WYY5 z%C7T*h24$6rZM)3+PVr4U8H%{Mn=0ey!Oy%Z-u^DI77?|)@tDJ?$pA4L6+luDQ6AR z&62=L?mt>WB{YBZ!w?syg1TLEQ!D$`#d_b7JQ}t}RdknMHm+P26ZBm?2zSmI>!bKSFuv{Qu%p}sX+9&dv=T(g+T3iR}>x3LL$@EO=MTrl$x`{{Hy z#O|m(?t_-@^X3f4K5djR)SFMidG406O=HP<+NwJ`f4KxH2Y4;#P`*aGD*cn^1^wGT zWSm_nEEeJHyxFsd+1Sw7_?qM7YN!Nq==vzH08)Z|{lZeyPCzNy(7PC?$lr3b@+$k4 zue1lG`Y;YS?N-c7D5_>27;{K|=Nic(=5Hm1HUKLIj|P*I9mX9AYF_b8+Q-KH-yvtnko z6*p;L*kP%5{E-#cLr%@m2!W>KFl4Y-bl~##R;w^gK6rH*(-+BRnvdCABjdM9RZ6AH zA4yrX4Pkt#R(RoEaQH&H-@~VdhwI4Gfph*!@2#FP2GehEZil_kQ7q_wXY(;{8}@l*O)U zvtQNck9V9AFWqA5CE5VrfDkNkesWAMM{m7_Wy65DbawY8>uk3zHMJC=7vt;t4u)qijn8##&F%EQ7UV7!K_ks8(l7UtIBxhKjpAp{HZBsUSBLRw4ro? zbeX=4c9}C`e#CGYDk(P4_>}4z=Nq1nq?b^s$MHuQq>=b@vP_x4G7^|j8mGP9539d$)3%jl1TOD>C{}K*e}zeUw8Xu>{8&0oa_&cxX(qYCd*O8c z!n3yvn`C}B{bb9Hv<+fvdeC~8z>_;*#sc&>7&4Oq9<%kP%(o{mByob6jV*n)s_|E{ zC{JGBzm#*MqK&clRZ{oajj9H-#3w%MpTyYp2thcD@#>Ecg4Ys%RhGZ_TmSGcE7qcJ z))mCoDj_#(Z!_5y(l=6u>^xqFTuPMHEA`t2pXdBcn}Nf0;J8QbCiNPU@1v04a&EnS z83LUOcBgciBJae1HEF$98Yd#Nq`Y-dGQT)u*nN~%If0$dAyQbpa#q;qdDjc%=UAu& zn5}OBZUPg}?|lN!*sw=J+)ZaLr z>Wc|R4=!g0KF)>H(fLC^!!7S7ZDgEzONMBOUU9+NEXuHmK-w7UF9`p){e3uAh8xz|0wO4*hX zJTXmPMw^XN)0>2Z{2#gD8SAa^q_*dBgt%ktfjl%NY0J7Y*Yw2*fWWx)L~B}sS2yW| zi{}d6$kPrHuj+A!>L@Jw;JUcgUUF@EmQb*_TZ6o0R*`hvrS-M+6U3GSbMb92sueVG_SZNyLuOAu#cgwz_U26?2n zVg$h1;%(Gc;nJ_2dkCB7vP;X$q@63>F+>U_OkS4dOwg7Krb~L&3hg_DEZ8e)TyxS} z0G*ZmsIvLyz)+{8piOW(eLWocmXd>_v8%p0CH17aUfqAA?Q%>B(`mO}>G|N@LX1=~ zw!O|C*Z@?8pqj(1UewD<6umuT1Vdz3-P-YR1J3@=q6D#)MLY{X{8(wF?1kRZHy2Hd z^pQLBr9-ty5^eawGvF+C3(-#7w-WUxErf;99p?j=oWr9ULf$PmFQhK(UPeN|_?e?N ze&)*S&uGTCE=b?C2Aosyn-A4Mrwjx}ZtT|Ueg*i~vdv;Yu(IG#Tk(6*k3tTxus!7u z+FoH9l0Z^i{e_DyLl#?wyQQtC6AjYt`e{YIkqZ)k6fOQTi?Ycx-Z66Z&sx2|=(*6$ z!9H|cLC>#O@eyKd7jtesuPzOtS>OjTmiO(d*n6`K(&fvG$F+|^ z0nP>jhq-o{C{W+)mIbH8aY-s`MR=K_0}; zh_|DmGjI7S;EQ&buZDko*cv|Xx9x-95MU9GN#`D$`c8|yeaGhI zRd9XzZhz2r6n=YxAVm<1oB<*HA6i@nl!#U?5H?<+%?cZRl*|e!nA-E*e(YwbZD!zz z{mAOXpec%z3d4jIoF4^14R7ys8tpmmrh&a~?VjW04_ThzNqiI%_XL8ZZR=R5WnX5gDu{dl*lM-uimWk{?&**YZ*Nikv1s{`yMrvV5I); z1)GqLi)Tgc;h+el_B9^q0|-hYF7Kzc(mBF&l?$|xL_LKQ_q{W{6NY|!pMCb)&B+$V z3J!6P>58cT)Q50^Nw;mWa;qv|==4SFB+B!; zg1+EobqYzi%ExMNGQTd{j+K2_y#>D!#GqEoe#~1~*c`28xCDsTUf>Nq5QwvV4P&gc z3`Wd|Z3Ho(Is-gn(-|+o+4s6nOa-o#2T}%DFs9~rEmIC~OcVRaN%)&~El+Yi0AD)l z%YTEA{-JIAyA^wS*A_qMfR{D3wBl2SE3G6qZx(rf*)7#OaA?!WhS32XL?h{|RnGGT zn=$TIDc0+I34>`eepWh7r;e9uftS9v4yIu?DZ?pT<^r6%KM#`#^_~oLW09#+D7B%%WIj{W9 zts+~$`BuwLtvv#!oZ;5ao520LP z7-t^;RE)HT77+@f`Bh~2-O?4$WZvPu{K!MW%-;%OcQcX(ob>YGb-xjK_vPj^EI2Sk z@!@UC3_K*s&Z@Yt|Ayt}i>!q@8c*VlC?NBAZZ@{3-!Prgf&SQOd^Q(1&-^Sd#d9ZO zX7~GxZ%()sYA6}061;d_xV!)GUh^?V13ELAP1%FtJ46oqg(Coj-+Iy3?gHGbcdd@)=Z#pj@iSLlZe>ILCk_d(kv!7x`POT1eKvK0ZWcA2TdaR zXEb(ZjJhWd_kHR*P>Fk+L@OW@l|APoHp4(o%90=Wr$+`(v^! zqLV=+SJ&22^hk2r_BXMli{|H|IYBG9UW)m0#OM_cRrBsQ`RJ<#rFrsftfEyl?#+3?$0^A=43rs`t|A+jxUs{VI%7I}zUdY;)$u@YEf{%YNIyc%GW-MA<> zvtJg-gFy3JR?QQe%f{e`Gk?4~+O5fv4_m)V1<3YocHla@jLyO2c}EeU{%$TEUP*)W zl#UpF3(nJh{r!i7=IpbiCRW}y8TPA@C7i~q1cyHDrN8*q#Pz#|?zlEU3U+Zdk-3t; zWx#7RML3&RtA;i=lR!pBB%U54fJ1KtTw=MtM+-|EB)}LbPkTniUH}E(FAJ&??knCf zna?IL>Xx38`9hC;)3tH^?nJ5b?cBpw(!uqUnSpE8@wA)Q8j)5|d*$u19Ix9Q2@b;_ zTEl?AU%gB`r?9wiDfWGY7Eb+svupB8S##IueeiKlEw;5!U4Y*-QBXPMB2Kn=knp5* zDqL_{zq6Q>L4NHuh*M`IR-Kb%-KCs7#W$TEvX@}<@n?hx;1u_si#vzo z3j#OhB3*@#m+HLal|Fv!#C0bh4-e{nmYkbkB)u-(GgAEKth$r4;hN}vN2`w$ea6^QKGRx(8Do;D@>HW*Iz){x3D`{4 z_O!fbp907|-QSH;B{*UCRjfk=yTI7PT{QN}1Uxpa=dFFZQeGw{-K?9~Qu_zBzOMPK z`=OH$sWn$6^#!t)fRnt6PLV^u^Dj*U`LOi#GKElUe_xS)8~e=uY6T*lJOzbW1piEf z+0e#o$EVT0MP21fakl}4Y&RDgTq0>VUC0~^fCbZw??T6kg=+=hsD2tC4fZl+4W3K# z$3LsflyZb4MNo}eK|#7c;BPs~?QKJgM+2FAf^$XaE zke*I_<(Qd-*xqta3~)oz`cA^`oHfc!-=2V$rV9{r&yRlijcKhycdRacz<5DvK#Aus zI%nV_6MA7^1jgFe|MT*v$;+5XNulJ9*we=5KUC;D_MXd;ddA1NB&=-$`W`rKe!AoI zeb6Bn(}>v`6(|}Qr`X`j=~*AHv(z4xxd-&&5=?z+nn&kL-d*w4RhfJC{AQG!5ro8$ z1p<9F$`hA(L?`&YJ?@=K^>Ivj&KZ_dZ85tAQr*&*Mw1So>O8~q`2*rifB!R1k;|~) zqp#fkXoVYf#l@VXu~%$0k(1Z3Vf(_z`;~oB2U7tpePPOPRvHgN(t@2_%VsZem~A9v z(Jx#1j3`L#*z0er(W-FCKb~dLu<-zRR0|cDcWNe}OJRHiNZ98bby@ORqz^50?aH`fQ}+#56mf z>bbz`4qs@IBY?!ZHuw2=Mhy;sHl6@ju_qneyzPoF$tZ0|Un#Laooqi^xG~)159WC2 zwWa72BrF^)*!XbA3OXf`;kiNl4w=1o$T&}5H?FF*1mTl<$6b6Z3cY>|!+p`T#-Ok; zHUcet$=24I$3LxeR*R{PCoA}I;}@LzwqF2-s$s^dcIz4v#u#83T%U=vg=n63n;Q37 zt*KQ2@6I%B^&e^5XMYQBcs=Zx4lbRPUBv)O@qsuyuZ@NQAgXk6h)KXoIcg9w5~tc05qTJ zP)18ECS?3X%!i_E!<>eE&lO8_Xa^FS9e;KV>K%OZl@7=Mn_H@z_=WWe|P>y=KJhMVy@o0IL9^@YG-Og>ATp)|w>&FjV zXX_hUOU^d=LbBcs8-xLR!61v)1Iwk6CnTpJD63q|rqj?M1n56wW&_}@0`bu(=1>l$ zyZi!o4o$adKn^f|LX|(Q8$M1;XzIyVln_JfCnl)uBV%say+>NoNDLYak}5=g=hC00|Ns*o$8qX3Vi#q-x{)&ErTUkb;|#e z`mYrGUlj6x{S|Cv+x4~+tnP0Xpo-Gg+CV%2vKQM^&{EC>HOIcz+)%RFlD1uK>-MsJ zqDwsX=H=#UFwtDTNT?IN)`8XQP}wi>6k0QgDL-}o~U>W&Mk)`=fT zPvfegEkKj=c{2UY`IO$nUNggz88b$BKr}CyunWkSS&24Ezq5|^>Xxp}Z`Vuu7ze%| zG~IO2sgE*7G|MXoms_``LGSxwT+y3RHhTp@@_j3UB;?0^JX33{*Pc5(b&7pT)hR9Z%n1`1lM%TVvN<3A}eAl7sx+v9u~^cSF@C zXXpUCYRW9p^zACH>^ghjgmJKSDSVDO*eD6#PGTO)TTRIfaJCNcUbA-yRKl)bAKG>I zGcd34cA{XD5t%ZGok6Sz&Wb$eYH#3T-j?dB5YKfh`wugCHS5W4=HEQdU|o^;VJJ;L zFw6Yj(chiXr_!PLA!rY10hP>;W>?$v2%xG=ryaPkZFs=5(C25I>ehfyx{TK@-~pAf z%)fs%1)Y%ii3Q+B*YD>W1#MJ2K865#-G$HM63q zI4yyA0ETCuKSafD6<=l(RF+pGd};+f(3*UL0TTaU)|rUO3JlhJ%Z8DJ*qkrT*GV{= zr$NJa)j-6EwmsDSEGx+&#BQ7Um!aKv#fL2Fp4@TscfZ##KRPiaOFF)*{jAo)8o^GV zpbi=iyb zw{G8uieHLudkLSv&&mj)8Q{|}6zg#@a^N0Oa*zyLpRGWM9bQB+6U(NDS7&zhBRZmE6fumHwp>2J} zmF8YY%-d{^3Q0Fq$JcRMG%HGekK%;Pplx9GhR4R<0BJ>y{Dt&6SG}$ha7_?UNdYdO zZmRNZ?*amI>y+i@^R5~`x{k^9qkX!l?o70il#1^~nfLod99bTK;}uf99F zzGi+cyxR}ESpFkpg`&;N3)v$uTEYjvu&mm|U!8{Frtrex1$ABV zBSH3tZ9Js0v9UM4Q$CLy@Cz2kPgMY>#HANOZ28oK%qZXcWu4OcKIdnqPc08-F+5Eu zlQ^VhymlDsAP%VrBz`Nzp+$#c+Y)FLg~x%M$|^ob@5{Y3AKU0L9rE@ zKT8Y!x6BoP^(EHz59_BZodLY>Y=5Bs+o;U}T z-jL@X!607L5&;hn2CY&r$}8@NY}fGTiCkkF4^O_71g7n(l}fU8eQs0Sd>B;0P@Dwl z)K%Al8+uU45WU?o>)ipBkbBRsh3w>HRr5Op7@GS5K>9@z!U%}5`}F#B<@BqL?0)VK zI&+*)=@Pv50%!%Do}JjvqsnL#C@Z&WR1Vl!NC7f@owmO05Zt+P0JxP6B_FnnZ| z$kV)Dm7WekFBO~qN|%4`V?Dhq62IBJtx&2Bq&U9Dl-s1OH4^9>rYeJxk^;%rq$Sg; zt=Bi882TF7m~G4usJ`liVPwh|egc+G(X`P?C2FdI%b=FVHvV#7SNf!@wjs7AX!muE za=M$Oy2J@vgu?My>pk};*`&XUCj*;!@?6psx1A`Eq=#Y2rcCjIK2?QdP06@Cth9aC2nVwy&61&)Pu&?@3<4T1_Qon4M4qr~R09f=mpg#dm@r+xuFJJYPia}Nq z;5gxu=R)D?%C+KKjT;3n&Mcjgl(78dOt1UOq-dVE^m1AT3CojsXbr}oYUKU|_JfIf zHZGt(KsP5@lM0fPU&a%QzPL56#=AAr`r;?oxw7^w6@^j&5BF|Iq&N&UcO(43p<`b= znbHRP8hgGjZ!E>{Tkqg^m+3qtX_x}krm8%2|9f|NfXtklmTDY~v5?aHy-HCvfhq1i z;b%ZYU!G-TvVnJ6V$KSFImjR%V5Cm(#@2p313qKVA6=RMj$c+$p~*5JNPmLhw3_l|97&^ss6- zlP$XW6)IfI_V3;boU~*NAe%J+cYMtuB-;mJ+O(JM9pd)E9oSS{qQ&;6VFgd;o^L;B zi80&C00pL7KR-5pp#cBMJTlt4dTNB4oZ;oGT-Qc}@#Tfy zMs+Q6^|?S{^O=%BhJY6BgMhty$yxvDW-y1Xydh)ZsI?6?BPU+FLeW-}Ay7ykJ=r;} zXp;Sn(x=-)$OOt))VIH}=YkM3BR|ueZc)eKe%l$)%s6XCgJ~Wdw$kd9)l42cw*c%S z!n-c;dFsKIE6v${R_y!aE)JO|{wiw!A2^^cPF%9E@x6GR3%^samWx1;mCiKzk4bIn z#D)jQ?9}AsThSUdJ0uYHr_i^i-1TtH*z}VncPLvfF(|m>K4-^LpipyrmGb$cH;*zI8Gz>W-FK=D;mbn&t>=Wa9Ir_?ZzP_1?PtX6~jNiU3|SH0N6 z%+I0-^<50(!BV6nmveVdQ^_NehR=YcnqBoI26^doO6t)UroxoNl8OvAf8Qm@mYnSFr@8+M2WiHx>4{K z9skDZb=5C_q(6cDEV&yR_!UkIz9*82M$97WrOW+*ev(P8W7lDBsuEibCXNg-1|*UFwcXo!{%Qn`cHS%91Odc-hxbxt>?2$?Ea(RWBivH;YVa-CLEsnNY`kC4#1)+UWoTa_H zvL)Zt<)I;X$-dG{JK=xzmwrVPDQ{X{3-Al-^aC}M7T8*#tY>(B@Md;Hgj4LHUZC`1 zTG7(dI1A){HTI!R2G@ka*rQ{96WVFt%01@`Ee|2 zwyc6b{iXfx-^QSS<*$Kipc}_(V&~<5hD*KA1O8gFy!t=Q2L0bS%Ic{0BDy-p=-(z) zzsQbeKAnx(r$7KHB=J(H@dhZfSX$WAYH7pQW|FpjRmuR_Y`CfutLf8`vX8q;c z{%y-0TEYxiOG!Wol>T!0OYI5iB$OZbO#pTL|apTDS4;=G!|Ln&D zRoc=qB$p>ow70m2Hn?313`_q!T{UHo+>;A1@kERk=y4(HD+6K>CeW>MzS7y@*gkzOM4zYKYAW{1>!~ zszK=01AIeYXI>aH=rNz=%x8-W`(ee2z8M3uxj?T|Rmtb`k)*)Xi!FD7W0!JaJH0iyF z^r}=T0i}1O_aLGo(g{6uDIz7(OMrkPNDaM1R7&WfB>_T`Z*ykOns?@VXAaK0&irAq zR`$-``^j^+>%Q)5JF0gdsI*SyV|E<-{D@4e?hMUzboIjM;fKbDQKNydG?@BoGf(d- z!$Gypt|P2E9t~g5ICtzD-kiSlH7DqX8hCzJ-AmlfJRF!?+dm*+4KHphmYD4pt2z6O z!2P38#y7M1l67LlkZ;?$j_om*%3EH)Z*oYO4c{qth@gT*;V$eZpQL8?KrclvhM2g^ zBNu<8;-;vh$EXWJkDW4j-g+ocau+jen;%)&YlIxx7Uy0uYDWJea>YwmUtblF!*N#Y zJbvl*WQWS1tBuc+SK8`lD_zf-#cGX@s6*Thi=IT}3WzjAyhKvmK5 z`bwavXW~o9zB4#TYl#t_KQKcFmwpwo*L?fOq5oYQv19*A{bo-dc%omI0SgHjgX5^k z!c`<)(ZPp}rIC1w?lE^g;J-q88QzQrjA5{j>hp}kda5K5c+IF4WJC;bLNv#BLQlH? zSg;=_)a8*5A|Ke0D@{KEjelFFb+W&SjMlw^8GF=r{PKTu_f)15neCrH`ALg@GEYRrmmu6YgqX9o!JGh+lH%FUo!M_`HgLDLFJRf3A5v8 zS|L1F&SPr7cq$!#?6~QuI*wlnC>6PU>=fbHc6qdmLojcE(hL=M*_r?N5AqXN$o4t) zM|q4jDEcq$q+`d?zwnQn*U#J8t43w;*lZx1tGx828-GGHWai9p;_oZQ<_$OeJx&8Z zPQAtJ<3rZfCz=>Aj1vcw9J`Ja=f4|D3jYLati^_=O60xCtA!Dqj*YAv1Xg|V?0=cP z{T~dv;rvpQ7&5*eUik}hl9a{7d~rKGBLR?wq&xoY zKk=aQ=j(%)i+pwc(j{!)`or2<3z+OghF z?4koKhVXldWA8>eKAK$vz#j<9?lAIpcOE7gx;Fj94$ywU#xz>$Z0e&Pe=q{tVZacC z3|>Dv{?$*1%)Z$vE>zfB9DL;3xHsT%-=fpcYb_zLR++t4`gC)n6YVT>MGmdj42 zaOmu)6#1*O{b9{HNZSti1$Dz&#U_arC4dB{K$tJ%T{0~3MpC3_< z1olCS<-$+)oNi*$FP(k=8+H5{wJUMAbJ_0Sdm*0t#t5GK{0Uw(`wiR8M;Go>(NF_# zJAJNj`PVqM`ws`(ky^b5uBbI`$We`MR80Ne0nO~{S%l!iU`5N?V zMw6jBn+;#Q6~yJN{W9@Qon;*l_k}+`J@y|qA1c#Gvnn@;n_KxsnB;?Rw|`@M{>zEu z|2ZEn=irc*mzoYa82FJyZkQ?yx^w)q|F~4F&xzA-cW7_C!gJ)9zdy73bEnUTKUW{c zB>C$Y`gBWO`;GJd(dr!g`F{z~IKi8Q;t}+^2R$f=@8=Vw<@vemUzZ3G;{)x3adU`9)^O|dBfq_yqq>7W)l0SEL{oN;=E4}_TvymRDGI5^W;~`8x_XWSr z>#_Y1la0&Ev$}Y&FbpI8-1d2+#FlnFXka(W=IpNGPp4BbfDFZh*SZNDiqB~$mBe~$^t)$gbYcaE*lRQ9wTWKOvE_}Oj)Z4 zQcJ$eldqm!fqSwxsQCa``Um5e4!XX_PxL%&2J_Xe9o8$(mnngjRqOvZT0 zpq1m;=5_uPFwM1e*=YIGSC|z7RCM2*sLMStmN;s%?pAg=8s;0YUeab1zLNP-16ocp$=dFNO z5t_eAXUdXGe9J9#nge$+XQdZg%UGRC!0ebIRV_oxcEp(QV891Aen3hlHVP)9+Ir$t zzD+Mv+mhc~z2keQZ+46-!hU-eNoA8y7=9ToVUcMCdo%huLBU!Gg zj+tVIfPpuw-2m*=oI}gEH{U&M8NnFW3~f}?Nv;1g*WWH+O8E|Z9#x)xHQ>eOBqr~W!-eUs(e+*y$=y+6{GulWh_ z7^=tD9&y^k?P;2jW(2QpFDD0w{;11u?C&MV#gG9T>#UcQpK8aF!^kinOgA4C=CTG| zP^c%9zppTj>Ed4MHfrjEv=bz}93o_!HzVq^I#oF{mT=-JZ?&o>vY#@zj-i81?$FTC z%r+PtmP>*gOnFgsbZuKyUR^d{u(*_Pj#X!iu5)^aTeitwD|T~d&ka)^xS&ALns?db@)uIun%4#Xdyz42?}5L}x#;6(Aj*Yu>~4@8Lz}r@A27#MHKsR}=vN1(_k&SeoB2Ls##UN)U%{r^ra#gZ>WsZYC)KmO_GLEYUCDL3 z$VV)94I2spmpTJ7GO}}5^4SF3p_6o>7HlK!G0UkFMEp9G7gS_fX9bZs^xIkNR%EP& zng^5CKbl8@wmkBkr$)>CA148MV^R*P`Pt*XATg~Ezb+oo7`{f5qG_IK)6}ZY`a3F& zMrW|s%dJnG2eZYlg81_ciwd*7AsJD2i0ESI8SglfaFu6T}CRa~&qE~iWmIxw(7~O!t}#(~v>s;_?8?3vx$x3j*8B8HBCp(-n|y(#w$B z2ZTyQ85(7v)*9L_@!TdgpCUf5jW!v&u%uc3e(W@|CD>Gsb0Z2>)C#CJaU*=N_;c?n zi+IhOKb6%wO~~_#A#-X=Exx=p142wCrYAA8>70~cS+wO!mA%Nd6lPskL0B1RZ@_W? zM+Dqy2hjexD_Ec%WoIy2><_*J$lJV-Os_4`$*(X(MX8Yw_ZK2iww10xOXYyz*Q9FkRc1xvUHL9_eKrW3&#kqXwBwo3aB0R|Cb+=dzR^>RX(q!_DYmq>9ki_wT%oLnnQ{eeP`S zBv$DoDMzvS%;l~rElnoT?f8I|rm5zju!Ot%gDx;p3NykpI1rzzdVX)1!9~BByl4WS z&Gqwuo%O-=W#pn644Fj4w1ut}l26kza6-OGv+_0XzOAyKQKL?qTUJJk+m4iBy)DC! zVQ(#uet!ncvv!?g6cQ@u3FtwFQ+|Buvv*R&@XlBdww2E!2b4YTqhyJZ(_R>7oqTue z@Q8>A8^Z&Z&=X9beb6L&Kf{7>7L)3Rhva>XdFu9-p6lS3WHX5V%1Ei>9IUbLCjuj| zXI0olL_{z^AKh#HqGzWppUDQt?hw1fn7NN;zc+XS;RB~RaX1OW7;lmY?%S%I6E7W^ z*dI3svKhtThh7F+c4+p05E2Ogm9OqwpkL5948K=6_WpOCG*Rdkp0tVe@8ogI6XzCVIv+Zv$RE8JMG7E|<-6Ko~ATQlDRmo(QcwFO* z=G8uT)vh*~S6@vib>u*nygBKR?)||NJFDLwo$=%%1H>MBw#IdAl-kl^Gv5q_0X=;h za$Jz?UcPHZ zbOv(3=0o?)Kw*lbQKd~3UCWR{0Ar0^<{jT1pSi8AVeR=H6fzbNb{fx9v+hoC`z-No z8=&+i_$bG09ZU}qwCZ=FrvMM%UbB355R>i`QcIdE8u|qKWr#m;^ShPg;zbU%H=x4C zPwcTf#HIVqCYw!~_}wX2$2IQO!Ys4T2OkQ#$e23CodTVD9qVht2hv8a8pPdtE#BpR zGojSsgqXt4wFwVvY;)7#$NMMiTb%&PaC0u|eRS}WU})aQdV+D4CUh#u@}h1p<-las zbG9C%QdyvxXI%ZECWiO`JEyE$&^2A3)eT5ZaQrTFKU$V7MoeG!>6@q{yDYQ%2%(WG z8`Tu?5lnNKpH>*)jk)(AIYKU;AyUtRWkt`r?oZfOHu(>MqSk#{goi(PHB1L~-|+VO z;OBh^s1;p{+3>~85GJutO`X!E@Z%2zCZ&`sF@e07HBXce0V7@j@@5?a$Ka6!p=;A0 zYhO<}pVEl$Wz1w{+TCc#etL3wqB3lzEZAv(m2ZEgcppD&e^Y>@H6lWzFhiJKwYwXD zUyJiwlzi9OvpXRJ8 z8G^vRnO8+2FEp}bhMEm`5&5bsp60>f_@H0RtUeORBUfXjcAx8&nRc3>RKKv&=9lv_g$eGzyCV`^m=NCN7__B0 zSfty*ZCNCgsWcZptjziQ$lk}vYE-nHN?aS?{#?A3iG03_1YKG<#U zi?Dsh84aXR@mH_@bTY6qj}RS7_E|@d}SF;3YTkX+lbKBZg+%KhT*X40mdf z^8y2p&+^Q1YMoJAVziGe+F(`v~X^iPu78)f@IX$QVtr*%m4(Dee`D&=E%wx>0*W_`Qu zd0~^0kynV6X=>C+K^=ggtHsBc= z@tM+y0NjaFXH;TXzzYK%nIE0Ili`~+3su`)lqQh2w6xgLy@)HMC!tizO_EB$II%TD zv;9r(;DHu-9&LJGd9twJNW*$so;t(9{uKEh#6wd@s(LV2wN+?hhKP-dKh5ILzSLmb zn|8}_tSpg8v}M;pAY5e!jND0zD7a-X@Gh@B0&dJkQb}{E@P25rseirGOhd0^LiF;; zm_kDeyWaz9*>w)wP;;qq?aoH!#yzh|Py1=HTQpfdvG*=(nquBkgJ&UAJooP>F@2lB z&LS2lWAbOrB|X79}Md=AZEunYozT_IG|N0mhKKK{6u>@y0c&=%lSV z&ezMS1DBSs3ab_da3Y#WSSN~)TFf#9vg)x)F{|@wU{NN%CeG;1F`5M$0TuI|G!3Du zvrJO#x5YD?fwz+fr34D#ZVjN74Q~cz*-@qsz|Sz}zz~6;*JF9%mcnr>59noWra&od zUdjF1!CAt~WzDc^yH6@~hX%!fUz!r3u%gox-W-6*y@#`oFU$;?Qu7Lo53!8kF@=mM zrVO|~?3b-%ec36h@P>_xB>RjP$4R)#*&Y@fXkOc#pL1XL5*_az*b4)PdaIUOd|6|E zBXOq;B@P@u_?5XN#g`t%S3DqYxwg@}d%8Lr6Uf}t6d zpoF}2lz2{l)~|TWcqS@irz6U4I!kMNB_^a_tmT@Z478I~ONigz4X@|FW@oW}Gb&^t z)DiuR-+5=zHoE&apBV|W-~nG{(bUo!PImUM59oK3SN%_Cif4=)%!zKp#PUiktUrB8 zQDS1P?bp!x!0$oMMWwZ0jqgXnw zmQRVYlzIGcP34fMiunp60Do^B9hG}Th%Wup$XAbu8E1=$>S*4XEU5@g_ovSK_^N+ zNGXcR8Jpp4jPM3O6p#&y#>q6~R*C{+rsUC>@E>^vv@@nHl+SpsJDGWf8(wQQBUmp3OxWOq5p`Jq6=Q`d6@8}S-Rt1V@A zG|~=8u7uK_baU(s;k9l^9*73uUehuAdNuV);F!MRnp`VrHg+NQ*`*NEiqg;R`B9G5$D12De{P6$dm0?5m)@2)9!r)U|{bi7r-bG2D?5wwjqXD`Rc(n*vo|I zElxVR$?(g^3DMCOAy;}~r=uWIs#gjXIZM4d4~1&vIkmmqt}^j$_rzje;JaNGs&uut zEHbLFfzUQoV!el~kN&cYg}3Ps2{?c9U8c$c{!2OhJWSAq7+Uv2k8qq&Qm?tts51a! zlQi$+o^8n+ed*ix8NN#6)7OuWDWnE*L><99SFcLj8t^;EwQrT0k%~nl{yRv@#ubv1 z(g*})!A}QJRn6;^=0@^Lw}3~x5MNw8bysi7zR~#aF-+p7GU-BQi$UU|x8I|Jdp=6C zWDl@DG%UAxr6H}J#QnY6{zCNeQ4O~BI|H?URf7elu2gI4N%QnGq1 zetWFP$MN{6e3Xo92ml#mX;9izIu6djp z;Qj0&V}|PEDX*j_!A7+%P2d?EO4fZ{*ibb9`p~{-DQ>axr1e_LBeTK#>v@$wY((3| zJr*bDeJ9NUM`XHLeFMo0cB83=?Bfji_H=8TD6_W%kjMjz8b+!We5XUbo2Al=_O3)O z+Yz2Ad~F!=X;6VyrwVVrBrv5py-_SELRj|5FojIy3wVBIBVI=y4(@o*+z9NO{$}(V z96%v%Bwp@j?B31_P5|<&uRwLxpy`geQQK*|NZi~{PaUk^u{J}L=5f02aPBY@$aVq2 zi#=q$G6ddXO7o;OCiuqYh=N|3-KW+g5O=oQHtbx|Q9A(U+HhY-M;DxYlDCpbR`h^B z(9T0m_@D!=!7HP^Dl&`MvE@PaqonEpreNE?;e$S@Lz&)j))Az$@#5f|8=wjwD$q)* zb~Nb3je&W9O7ntd!EzTSE7-mmX!znYU7a^M&wB*TxZ~F%u`eK4Oi$YHa~(~btieK^ zUUBwAGW_8@Q0GB`#%R znhm|z#=n;mxy1d-aP=g=&X~b>0fv;{t+!7ztobaLNxBjy!6%e8`;tt?mTyQ!yajQ1 zS&ze9RV^%Xk9sR_F1$0XG!637hHu;*h~!5QawH2(4$!A~FXT@xCLJJ_Bdau}aTz7p z^Nf0BNSG|8v1k1UkMPqO(H&&$9VllSIzDnfe+3I6=K5vLk78elw#2@rZgZ43F*F7b z>wHLQt6_S$-ley5!!7^OyB+YzMj;YKHu~n;gaf%DSF`$3?nvAs)}n3Lm3BF4OAJas zG}=KTGKyFpcjT&unpC^+^`_OvtFmg~`;?Cb`&nwrK{5NB52g>s3{=(B;(@|l1&By% zR)s?a5WBgDO3}XEh`@}zO)QdvAH7xNxiQ_jD#9rpo<&A9lZnk-65-e!Zhtx^S<$D5 zDcM6MkIMz@W=eaqM911If}~|{EoZyzXb&zOG+1l>NEV8A>Vzh zCw2NWy8^nKA|eJqJp5zr@RU2!DH?6lcB z-p-NAJj(%u44on!Mb`i=u4MCBRnMMePdh%JnHiL1x})p#(g|3L3be)k2$TY^ob50c z3jgi^ef|&|1v)>p)ex_*bFUVhOv`A)Zu>SSBAF6^^Kz}6RhEXc?4V>t-^yOqVaQxQ z+i3ju3XekvU_^ZWL>v79kGlBy__Ys@fGswu$ir7fOb@~vdE1yV`qn#7c~6yD4#ku? zx|hVgQ|boh)vZ3YMN&OCskMGw|Et}zgKyJWD+KcETm#}K;Oys$}d!O0VkDV^9oxTmU zTwY5D1_pjhU9r1(vtd3bt2fP=;U*+5b6i`};ggtVe~Lbhrk=qEJ=Ljd@AXROis~lN zwbUzgFY%lpZo{(lM#%$dgeK){7GIVj#eU0TK*4GvG1JgH`6w%`&kBB;l|^I?RQSXZ zD>;rawjJ;er^bN=51I(;vAfddaI+gGV?H&+a|m0RTKJCKxi3AHv&Dw=*TmhcNPR`h z0~U%+?73-rz)R8HQ_s1*Z@+rL`_=QuE;R*PurVhkT(r9M2%C}@?dXj9!SU8sLZL%_ zGJs%&w%^DozL5-n{4|*P-wa*8Af!N4112&vm8UAKEwQYCC?mAbgaKvCghF1!{gcJG zYrurJa1B};lv5}h=g`#Pl?R>@!Gm*9(;xJU7k2oXtAcR!LE3xW)}U{V`o$4eJt^he z+mt4z-7;{sfAut=CSCy{`Pa|kO-P7G%73QB|3jnkTgrv;CeHH@3K%bCo#zAEJnq_P z$#r)BwDTLq@WpO8k_2)Q(D3;#>9bK0PMP-i?yhk*=>|&92^T?G7=Uk;Tk=NVw`4zb z)1J7&H@VJ)8O&7_M3{u`^j*#ndSp3QRmVS`xGU><^I`JZ=H6U1Lq=Xd2kY=lcZo;# zb@5Q&yBU$9S>X(WDIc_wy%P+{SmA)Tr6#qL)>Y-+ym)z^K3*18EFuCsK;AfT(wMT& zcwsT`8BiDhB$L%JzBdmRcO|$)gPp&CjA7^8a*KoB>3q>AKEhL>GQt z(sTs$;7l@A_iC(}-(h)}=3st9PA>q5wA3Hry+TjNyWvzX)^;0R&vvV5jn?#j0itvE z8)&Ju#3TPukgNM#ZTMj4`04WB6ru&Uc&kNTjhMWO#sSAL*yl~mwpA=<%i4Fon z$>)0=HQ;tSjfq@>Hli{pDz%kyQ}NXjId|dO%#jMU#ID@%wSiy1s|Z$?*~rZhY8nbsc$k?{T{TS!Qiw3wEokFi%rHrUc(}q zE{w(%{(aL#_F4#|JZg2cLpx>u1K!LOO#~sx07JtJ(Tp}sE6?&*^O`F7bsOG{e_a|3 zUl#&|N@m;InsqA>46bR8e#x7&A3qCp!GTtBdvg{5a6C|ofuPk7#r9Hd z7gmb>sih@d%#)6@eXsW(^&M%|YzzU$MSyr(8yp=(?@RH{WFC9pxwSG}#3OOP0MtJ; z?@3lYXh^+EAH4S1C4DG3vVZSh6xf}HbVxF7(#nW@tms^9Qd^VU?+UzqkBr7gZ)3%(B zC+9v`Vh+xgc-O#vdcM6TfTTF0sOQfi*n*HpBpozEH# zSe^s;5q~sCBGjKRVZA@1swr0ohUvd}u`C@rEZgX1QE;MWhIAKYDTmY|;(22!X5xC5 zJ-p!s%wZIton&)}SFd+!O3LlKY&l4H3@T;9l-cT*Tg#tX03@s)*u4Jkt>=v| z{E`)jGM%O9Q#aJ@1{^)m^fLvm2S959%Q1(xM>W2LxYDtH$00xZ37U+x zg_qT}1vkuYf4b7n)#qHHN*OJsJ(QlW(7NGVAxo!(Tv%kz-&x4W^PY*s5`1WzYl#7p zy2s%Ve!F`9s-(*cpUX_N9zVi4$HQ;Im%Q`G%J{D^ng_-Wm-sbILpo;6h^>0O$Tc0l zbL$a&$oPp$jDOgGSY?UYmc^GBBF>YIMxHOg!EOv>dlMl0V$eAtD(ITSSaiSPw>o4D z-k-mYS~yq|NZZS|n=3kWvn{^)raA&d-JaF2Z5ipQGq01cHmMFEa{F-MDzjo6rLzU? z%nqh1QL*9P!dew5I?(_`nQ3!dTZR7aD5-DqDsQ_`?T@)esLpYo@Xs{joID%w3Q$)7 zTDMgp0p0J400PS$Ab-AbkZj(&!<%E)Bw;qA?`bej$4tH?I<+=kZ(gVA4kT=i{#BPX zKg`<@M}p8oG$EP6_-g?vV1#$4TwKvCa5>RQdx6ywNSUk` zdyKqU=?WTgNz6?oOb=!JG#s zejEFY&WxJBDXuO+3A6)R|F;gV)+0 zF$b@CwI#ONvI{z)vPpmwRMOGawcbvM39VUHiyG3Rb65rXa?E>0Q7ifA;vZik)c1F< zMI$MYxI+>F9q)AUI}STG<_~nimFjUdlFsHcuH-{_rREZ2=aEIUoH*My{c=ZVyCuAh97UM{px=P8R63XMR8}*NgbjdT+|0tY9rDW6j5v?Y-Yr z&AR*I1g^2HJBiFzjp|Do2^i}GgNnxKW=rPMJoQ3f;)r?x!O#_{a`&iC$$}iDYLM;J z#y9G5reV^)DeVuuGM;KJ2!lsf)#@>`WPk$Xk6+8YGf}V_JH&s04%;6}-C%@H(1 zVLltv_Q<&d8AO#XBj2^PuNPc__o{`kdvEMj_6Ag{W8^Bd=$_$E7dt-p1ac@unYUjy zLDhxKOO+uMWc@*P5c8I-{3~acXS_*ucQ0t7h?%mt1)T?~@!ECV>KNS$#(+s!0&PGG zP%r_+V-pfKjkoDdYxn>rH#*fvvdRvOj_l9fVf97VBctk(b|5jGAXPfQt78uj*X4Y5W)XVlVw<(#Tt_XyXD6d%oFK5$G@5 z>)%~{I~m6)TVeGS`T&IE3+1S5;Uew3Pv+*lu@mbVuwy;!zX#h`T_D*00j9NjGkNA$ z);QEJHpsZ^qgb{{pI&W$VZ7EFjLAaZTdM|7>@d}@eBe@KFb)E`Rbz!N>yh(@W|o%{ zA%tn3BLF+VPCg4@y{5i2woRq7VD+PU={YBCNO-&So)5X5774p|M;8s%mKb1PYY2@->9ZkT28)DXgF2J>vNX%`XrQmp2F*^@ED_-g!@8j-`4Qf$)>wje zMDiPuTtr^FPE&&ve(AyX_?-6S2EgmF%Sr@@H^~cJ22@ez;HjE=vG~t6E0w_%2;8|d zKHpnug%6p|ITt9XA8_N`!vQwbBB(q8(cD2Mr`-|c0 zJOIxmO119sCw75ARZnhXfAio{FW;>N!y{gAO=*r_!NJUwApnqBbwnebVdO`}2JKE? z%`8*YypIrauawWWQ-E%+Aj%MFS!shxq{d`$0kBt+U$fk!AZpLWRl9cGD!TzE6#T~U z?B(E#t@!oHhDGjVjA+kq=SGR10J6G}?y=InM-#$s(eSRBD6~`u@JnY2ko5*H_ZggM z*JVRf7ihix&HIFNK_279_bYX5{oK*73#p}ecNS5E7uG?rH4n_F$F?cL(yCS}VJvl| zUbs$7CFQo@e*+gF?0Y$b z9~?SO3fJ%=c5-I11F*PDLwT)a33zed=l3PKWiAE~l08dtJrtH zzDetcAI0pbr>+w%GIaP=FPs6;#qL^`270 zuX#Dw1lS0-`{P!=KIdd5Y)nnvQljpCUUIsbSSHyxuTCL!(Yo*O_>AxDV{3zJX4k0S zb*_11XL(R({rbE|*mRQbq1H`sdvgm-16Y;3@abuYi{H}-n{6fkPfb7#n`UeKe(Dl# zdmr;!g?KJQ;Uq`3-Dd6;I?z$>QnNvsdxZ(>%1`zxr=e82q60Q|Tx$fG(ft_zDeqMt zQ9l~eVlXMnb8T4sJsbj`tafG?zT(0Wk2Mz}_!IFrzH523)O4`;J!~c|BG@=>7tn5- z*@bHkLUUW#;Oqtv{px6SM5JGE`WQf2JfkD|A}`k##-0;OeJ+-GAZte$p|T;f+f4e7 z-Kd>(J}A2`=$}^wa5w;Xn&8brqNf8n`+a{!E_kz&_HF$OV`g>ucX^+$y%>qz@$aMb z3tq1!vuZB$=(K^_n1vmx)(4w|Ozs%gI2p_=JZVoEA>QkTUVrjn30nYy?Qm`nfm!`O zB5&9(J>3mhEgM2Qw@rO^a@Ti`*bRz@A!%Qoxx7u^0b0g!-gEYPw1_zX`bFj8x?toT zR_#g}(ym-DOq32Fl{5rHK~YsOL!s|kK&U1I%ogQT{vE+o3FijqQM3&yhEcxz-J-N! zjm9STZcfnSW8qIKjN^4~x({_EM9rcMnfMRs_|D}3T`?EvIy%?d(N$XXZgQ%a1Vy36 zzo*8z5)fJw-Ax)P4z3PAoEE#n{dnnvcaa-|Yx7px%l11|UT>c%#^lePy|Jn(iZ2hx zR!C_4TbRAfWuTE8UL7Gqy*QB*ng=GTJD*UFLNad-vjwCMv~4ZpkU+o1wZdBZdHcs# zNsn%YMc_v+GI2q{k@iAcZk(A9d)r6r^J3u0tpWfWI(_lL$dCLJ!$s-8*~ufv)338l zH@lUemdWc=k+j}cupcXnvde~XrKLLneEEg6;(+>sZ0q6(<4LRFvPXpV!3B5bgo4U? z8^gmO3rm5Rtx*$~1W9Zi&(KpLqp>=IvN~X+3^~>-SMP^P!l|o+?%Ah%Zd_LxT|n#G zo*`RJDi2PxZ+Td^FvLWFiiXPTwux9r4iVlRuP{dsqC!Pv1pT~k;1rdO*~B}TPs}hv zJ8RWRUfw7DD!Qr9A##!cfD&Dm4^B@_IL$OS4Cnc$-7d$@git{yy;Z~T0!z!Binfzp z`2cxZU^i7xF1zN7;xi=9Oop)bEqiXM**43oz^(!j({1=rW`R;TEpL;lTlR(t}v@Ji@_~%poA{ z?(Wc)iA8KQ&IIt1<{GOkPp3-SzRqx-s#ca@8Iz6Amw88aS4{4^2!*(s1{e@bk-7(_ zD;kUB+}8esCf9EWZHaDN7_@yV6(E$Tm9AD2`re3sp_uKkqReBoRW{+1{y@3;Vz%1N zEyTydMP@8jD^2l%3)uEb7$J>>G9|bej@zp61b`=IRvB0seJOr)%ZYX!M^;*l`ILc@ zRT?W$C(WcEw!YLr!VWTr=OdY}vy`0;-l3C(Hcb_TubJJWQ7|zZ|0F!YwxELMtlvj` zqifL|}Wy#;nKO+nhNrIRIty%nL&P21Z$+k2Mur@x$8hDg{%MI7ux zW4^HJ#)7BYL;C!H?CYpa>IdGvE>Vspk+8VQ3JFNwmb%fGC|}Osbi@B>Hm9s`W^vz| zg$Um6Q?FE9_Z|0dqZTEb3*?ug1+?Kn1( zYAyVWCbaZMSA2RpH%!zOn73muvUqWUJ|SCO@SY1m$pzq=J4~iYj2u8!E8;SF8$i7h z>h94{J?My?xyr!6@W*JGLii87ggk)&cLlhkcTC@Zyu@qz6@A?+h_E3&S_-r&?*Cf& zi1l{Fja~m;aT>x|+j8}XJ4YCBa0%tJm}`7{6z@Hh99vOJAJa^^uF}oUKSn&B##cJe zHX7lX$KGDP`*LPOtHuXwMl4xCWy$8UL&Ql(&E1)+?~KSmGYaqj7G_(du{@X>zw(M@ z^Zs0^I7L7#rnVRLRSz|M8t78HTuiPV)X`~8V2x6?1FvwdM4=TGQ9fL%-nqr_Q zsk@5dO;73Hg&V?zoh??KCr!BzZY57~r19GjWTaBc>vxjxfI&Ze-Zfj|u~V*4g0)Yd z$}DF+2@yM!a<0RhKpOUOsYAMQ8}Ei50wwf>_3Q%z9)Ujh=wy>2uerO}>u&L5Ofg2^ z3^{5VDVtQg+cTWJ$W?B0Q&luI&%~i8Y1ed3iy0x%y}>#S(Y_K34U*{1v^}w?sp;k* z#I-O8{oG+#&T;6j|K9GTxP_?vIFt{!(0IV+@pvgo%6QC5U1G>VNHMhVuAz))=V^ce z&Mxebex*0oeb^9MtLQJy^sy-X)pmv5i&hmIX>ZFem&mj?n=ctY)Nhn7LWBx&++dZtBPi81kFx1P8 zdo1ospjjo&fVSg$+6X8I-5SllO3J-v>5ctdf{Mo_+4W(gb*fY@3}~}+!~-w_g;znK ztZ@T614MyLt(3j{X7mv|$C*5NHcll(%~i-y+0Y6HrXw>0$Q(u$Rz=A@aE;VK02q=S ze2zQj%H#HMxx5oR#zN54EUm=ltiD*I%EhlSvOG12 zOgAN-BE#C~X}=EVT)~GJukXaN5{| z_6rvqN=&x*`CbqMox-nA*~Z6l#Kx|rG$Kqd9S2SV0%=RI(KpOU@MJgKxW20G%NMnh z)Vhb9e8WGI?CnMJv^`TDWbWK4s__0SGKF~@zB2`I0od8?B8M+XbCwHZ=zn6v{1QTm zJ{o%aF7)O#ZJ|8#iLgi6z=B#f4gA+{|91KCr;5`k*ebSwsf34;6L`-eBATC zRc4qn=7-SFo%kPLaoqo|3!W(FFK6GCwAlbL{!I0I+zb4}aj~{1>=!l4{k%oAUj9iS z`G=2>J?xNn`e5sB%a;B!-G^FUb zfKKbbY3=@8-uWCrc!G(BwA~NWJ&wo!7kg?8MgA z7W;1Z16QqAfA6K9MgGRl!2#{ZUae0yr9P&c`(NIY9Lt%uKeQg`o5U~wy_W)v>pUZ) z^8b}_#ipgn|KAzc_5U;DQd7J8e`Q?dt;eX+lk8_*zrESS0KJpQ|4qa{lXc*|4Vud+u27kgL)!{PofQ6&m}gGeX{(1A3Oq z6zTahe?n_Nb^h@WJ{S564e8uTi9&^c>4yLEf?@}!RF-^p(GSZ0-s{M*#hkLRP*7P) z?pR7c_m{WzFYS+SON?)#!V~x2Q3UEv{B<1~^6owxKZjAx#w-VA4b6pMAgBkLreEqb zlvBIH?IfcZ{aXD=O^#vg%u|PQcP{ch?;L9=tZ~?P-4R z-Eo?D|I`EkWCkb#OWG*5Wl6Nh5QY2d5rVFDjk{J1slxO!X0hR7Bo$ZmWmNB8y7Lse zSIR#n3nqm+?c0Wxp!bsln_TierAXIR-^^uI?i|{<$^Z3!{cnEyH)?Fc!ci|FkHQD8 z{WpjFgH^Gqu!##RUW7t9_&GKwvf{1A)(5M2Ch830dvw(IZ*t_jRS)G`3|#bXde(fX zQ}FQ7KBpTzux{58kkIP5qAJkAo|Cok?Wa(l|8!GgFHQ{(>ZmUHP@!30|Mjm9h$4c} zQ?QiV0nlE~JDU@Q>WF69ew&qR&fyiDZb;3>7$1x1OrGw(Hn@;GIR*!s-NG zQ@tZ2UM0)+-S%k=ydClqV&a31PZ*X94rVH?kZA%>JJS(fVJo46h!S(PtRW+@+ zU>|H^uHqTBK-1|sF@^TOfLvPme~(?^=%8i)Qn@N}KT}0XItZ35#uuxi4aKgjYk#fn zV4s^xwz{~*!I{se=`I8P$k$&MejucpHDPnW340mfr*EM^Nv;P1x_=b^cL`sUqJMs; z|H-}lcZVoP%jxI{010FIRIAEgMK(ahtv@dyjg4yDmv#O|>bw8wG=469X}NIsJcA{9 z>g_F0r?Y*THpcQ<*bT8$FA zGZnyS*BVa0Zt3OKN!d>JX>~#36eTsErTb9U7d$pNrQ78HBrBBJt&cFs9&n0bJC!Pc zCd4{W=1%OB6`NF9nfqs!IDZd*V!tw(shw=YI&;PK;&v*{cXlO;?OnX(>do?}lhgRe zGk0J*%_=lTTVt#hPe=}`LL26A@b3{KhYqNs=n(dBRs8MzGnW%3616JAsVc>}VSn_- z+#kuII{+z+TICXh^*vLm?SX*z!4#5Vjmr#+=da};8W*5R!2bL19$)n>bm9-|pIR1> z^VJe#Zz{f}stcc-=a(0{#5XO17@Z@%2VCPhvo z!_LX2=OhtT&)2-V?sFDiZN@JkE*<#_;u3I<7o}OAtx1uRLzyL0(zoEd(|*3g@5C*8PnqmU2+p*8m=dt^4xvE)j3}L3Eog{S@7POV=Cvg^rj43S$)T~d4%7g%a zu}}$bfu3Eu&1oIYL;N&;4>??Y$1?>H58T`pvs+o?N9IJ&5k*j9*|B-Czt`2n9({jla8(J1Ug9o7v9#uN88B zoZD}0C!W20$@c~y<)(1v@PEM!)YAh6TeV~^hX|xt-J(bq=EE<@_&|F+W1d0enzwX7 z4t>*bYD|pI$%=aG0M}^#WbE!1@jAMzbfG%O9uZBpVXSYuBUJ_Ub4dN%{5jd`)8{1L zp5F45WzQ7S;r^*IGuD-6Ar0k{eqA++q+Y~j_+t}4Qw>B$0qN@_uFjc;*|eEld_sGp z3NkK@x;^ytm2X#aTYZ5w~8l>G;>)5HZLX1~f>;aG>p6JRV1rcnRJE z=muxSwc=@FfcR1m=sCH%T;haBRxKuTSdLe#EY)?TNJkZ0b+$cWdO6(*h~?6}hzUX{ zZ$m)kG&UOc*CV_7D89&ty9&uWeAZW9?f<7?`T19_CIA~>CtCZvQi=wazr#%{K?A~9 z1ohQd()pCl6Jx5otyOlI!g!dj#=65KK)Ot?c^a^AnC?n7KCc8deWjUheR7WJB*FHi zQj95<|22re|MKCjhtk98q{IC9l2L7*WfY!&ybm699Vw9n^Zl+IQ>x2K_R*yEvhI>& z_L`HQ2F9*2E{=W}S#UKT7AdwzY0f8<;^o1Y4%0glpCX$;rz^sc71HXuevii8|tnrPy=oi0)_Hl}{^@r&_H=f+YpEa(~qNsFd6%l+_Vpgrd^CQIfQMzT(yztK`~3>kaFN z1I5mhEHX*3QJK8yuj&*8)uZ;iB-y4z2xt%5u(3Pz9LOsy|ChYtkB(nGUiH&%g`hev z@(lBTxh;pD9?8ti>HuQ?;e=G11Voo>M1IOs8)Lk6g#c6e`@u4u3fo>KoyBa_y~ASr z2+>83BX|3#nMpC|-7K$py$uJmnAOwTZ9+`iy|wkd{j4YXF-DN%C~Udyh7w%V24{vQ zLCi^g{D@=|NDIwkFQKmgDWcrWq!u28e9ST$Zw)5%DBgLZxoD7Mc!5f0fhs4w0`A6j zv5e=mtODcM9E>2TFTxR>XJL{9&C<_O{wnhYwU@UvT%w*o->az)a9A2Yw{I+0fTo{- z*!OeUwF1qCzga^gDIWG(UB=SWQxVynFHYxXKFI5vi9QDZ(RFR3iRGmgDHRJyB}Fq` zXI{)ECTQj*OFwyC0=S7Jhv)+m##`@bWk4e{F(b8PnJU$hQpeM=*Vlmdu-FZ!^Xq~x ztM6F06TD+04YUAnBevuC2I$BZMWb!HDr8ZJgf=-M!PmbOpQ*{y&KRS*nvQmgA;SVh z@#2QUDKd`nivzmRq6kyoIFb9b0Mg1n)kRA8-X0=*wK#VCy+rMcC(j->vm>fLXd-Xw z^p~{QJX|?BrIO8WUA6V`((K8*QoMpyi61VB2&-Kb5%Ii!PxVyhktO|dZPXr>PVWBF zy(9s*8n*C3Rzgq|cm(g5{FiO%a)+>)5AR+(51PR+nz%fw-hrd@m~nrA(|Q5FI~&kx zWsmE)yXX5L{r=|E>$F8uk$t&q@AFo4^;$)M0>S-<(EannOPU01Fv$Y)*DZ!>&SA?# zTcTwNPYM57$RljV0Ct~KTbDYDWn42=;0R5C6AC#XsTD=n<&&7lN{%Zt<6pK)Wne** zn@=e2rcE}kZ~P}rwI5as#%X$;eGxJ-^JL`(rUI`j_YgX zI&b|N)$41QK#Ax|ox!0z7d4}`1?=Gj?u+D?STP#USRmCok(r8=O7aPkZZa0ei{I^z*qDP>I!7t)?l>gvQqfizmq+83A&gMxNvnrfy&s5(h*(C2?kQ21 zHaCElpl$F9q}esXk`O3Lh-f-0+UHo)5JG(4ceZM|e6@qMWVUj~QyZN{-Q5ApnFJrm z9^V=8GhZED6?54(2Q5Qgn{g(QlXxCV$x-$z=VWWTM)F;TdU#iq%N^lE78xk6Hsotc zqqIRgI3Eq2@Fk@AWx#Yi$`r6uC67D%bJS0TkcNGLMqGcrdaYN@xNt9771QhQQz`i$ z^W30uadQU09CzdB>i4}D41~;<%iJDSjm*{%p=mux#kk1I(DBd39*S1WnXebTMHE&k z@>#sdav7lCmzTjQP{iR_a`WnTmHfBO=lD5r0qzo<+UX!R>UiJe8?=olGQ*Lr9NbUj zWgaal8uQLK8>%3B9{c^&E+yB0X)ajWI#y14x1VBEKQUINtF^aFw`_b$Z&rJj`;k&v zh!%%YUu-Q7lysHVkVY8EUqa^E%LbtWI^jASwLD`hIFm%Y02n3=hPemrj!h;2O`o;6 zcUzBE?G>=J4?0yhaLsiq1T3hn-Btp67_YoEK%c9b=~Ri_qje0Lp2No(n4agmdDP2( zPHBpXc~+vnF*;iZeLtNtSmH{YlZesaU&>n99Z+(_^Bq&Um%rBm9^YN9qo(_9BUIvn z-j>>-$IgoFA=|B8!(51N*sg?CKf+_Mai!;S*hb9gYP1iw_T2XPcEH8}0dudky!Q1n z(A}1e`-)xvGg5r1g6Fp&*0G(GmlGXWKuXoVk%GuVuQjnK8w!A-YkSjee8*xYY7sMo zJ^z9y{Fj{Kch@g$!GQ40ehP`uy7r&nkrA#cALH5Ja|xW09ptlofH3Us*{7;xZ}K6X zY2$P#v1~u}^g)UbZvb>21={NL4no2u90z@|K%;$uN@=3WkR`%M zM!xv54SSCHgp}P`s8P^6>N zjCvW29ATn}2L#;MJtMn2NPNiP8N(v4r}ie2gGbr#L#oH@!ovnXCrrt8*B~SV{cKht zZC!U8eG$VKp{Ol^-a0QE_caouvWLf;7EXxE;)SK92ORyj=A$-LD*Uf?D{uROg@@#O zR$uk$M#bEgZ^$d#gt@kdNc607DFqOU9mm6p0r9ykXLz$EaZ!3BOocW~j8IvzSzlHQ zEDAZEjDN!9Was^`@m1(i}EJyKrutQ* zK@-h$c^+=CHx-rSxE33u+oqfDy73%X(aC@>HnKfVy+N!mkaZupqd>r z*rgl8Wo4wRMv$Nb`&@S{?(%a-pd*2n77sdajXzeBYs~{(qZSfwF;zCm*0$_L8w;5n z_wCdnAFmzA9lRC8y;s_IyCaM|L*lqnh~Y$hx#vSk^3gXifD8=Wuev}UYJJ^Rk>}Er z`8*$EG1cz0$l1H>I%H`q1TY*tHv>!ToCl+3|DW01~6mL!1M7 zZYn^*rw zsBr7Xx7zLa&bK$5(4FKirM^+qc%}~jwT4?~<=r*Dn(77A*%s^&Q*LQQ3b3U5j2)8sxs@XNde%c*%9z89ZOHHE!kV zO^l`8)A8`AgEM3Buztvrwwz@#r{5aCY$@Q{6?c00^zYo^#qUkPPxc1Rnq4p{ckp0% zs?P0VgGL+K;O`qi7t4PbdDsNq#K)CnTD2RRGF=d0OJy%Z96#_sP<;OlOCWtvHA;$5 z#VCn%xBuI({_t(kxR`m6U%R`pK1JuYCUd)1R*k%sho{*4O`NCw*odi$_`19P_x4P~ zD=uFpH6=28U!&U@@gL)pX0puRe!Ny;N3qIGYI zWA%+if^2)j-X=(Lq5kj&8^oZ8Ni4ds1Ew(EZR=$z$<^>-r6FC4I?y zRX{7Dis1jPA)t+EF2F9~_4b#`*eW9Hv7vx4s!=7r0^?CqgYgRy8*s~q*50(US0EX$ zu33uxb^kVB80g<3)iYT;{Hs#rt>_!`zxM+8``P7<+H)viL%S1c9pX>wY*lg*O$KP*$LaM2+$uKa9gvzKwK27>o)hmI^ z6F|dmo6ySike$;9C}pMM{Sb~7gLn|FGi28%D8Nb|cfX>`=l6paw0tC04*BAXDXqhE z@YHSNMEp=)S;#eof!jb7&!V_fXhN;Wuf*Vjya+gd;kmSc=Zag~>eCyY5^Si|cY8Eo zgz0o6?c+yE+ZKLY9LcQH9Ve7-qoTKF?KLi505KF6LM~N$Hf;j!Nf(Y4nKy7m-?n~{ z-^Z8_t|{v2GPyFbBFrX6e@{?`pwJYpjhC?92i@|U_keEFbGNxhR`y;i><#8AIqPd( zoRl6!8nJV5%)B1OKpyv1-+S<&`i=Mbuf8vo|D#{|8T74s_|TBG_TeqjAn+5dU+=HE z?hz@W@5MF9T2KVXeI-?qrYI#JiX%b-G-iMMbEe$cgxN|*_G<6|@}B+Wh!OAd*LG*r zrDpO<$g!a-?};gik{=)8+hTF?1CDNRu0fci4sy(dusk6BiI;gol;wcH$wQjg2^*@0 z)RALD-iD3&-Ccyr{0PfAI1IJ>D2^T+w~M;Di(^{ z8=^&tyAGV;ni1Tm^D)S#n_$j)c_vJk?*?k4Rb?C!e2^vDR(AXw(ornYv&;F4*xh4E zVn6iHG@=trdp4GO9ofF6LNj{s$?!re_vJES#fzAXVCIs-N6Pdsie&nhN+&qK)()*+ zj9S1OR%$rb&6sr4+ziYFL(=2ol*WjAvlWd%i;;q8vMk4Eq65eV^*#;%|t!BetuFW0i~UlSyeTh zw@LM@7Cb-c{9)Wfr&=PXb(2cdhjPd3eORuRQIPy~J)!>Cez8N2Zl!m){i#+yZsSL6 zU#X9Cvwf7Q!<)-_q#p3u%Etvtn(g6nE!#t| zu|~33Y=OWlNY<1NTkl+py9CDsc;F&NyXE!J>1NPp`@@ZHU%e&x3u=qvofVne`!Z?@ zL)YW%*Ps$MSVnSBIsz3@j+Sxi0jQalX8&>6oAz`@C1LrcfIY zzRrBiE$Gv$d6!vKq$yU3ZDayIaT3p;V^r z3oyKc0UpVOL8p=Fd_Gxn5(pau_yGPv527>*qyHn%*+`)B#LmII?;KNcc(H$=L+!U^ z?oYJVgnSoi3~!*S?VZea|hvs^T#AuEtc5vk;Z)-FR;SUr>NZ?3QR!&QM$pNwC^|Sr5KL^+YXxtVb)(DVf270#8CHGuN(D|+ z!=4#d%84eqkFJhm6rNu393Zs(({*&8EX=4QWTgvS24lY8F0yQ5H!$hJ&o5qm_$Gi$ zeEquGk7T!ky57oF+trlnOe@;RbK28;-0i1dM~NeB5NJW)^{lBzxLZls+)YqPc;IeL zvM4^$Gnkr$TmiyXpgFOlcL#6G%>2vOv8W01%Q4B}k)BAW0>dJG2Ya*pO4>tNDRb3; zDuT62G&;beV8{gqE7Svk5>xMQb1Gg{{r&eUChiB!I#Th9<=F1{JMV6`4O^owu&B@y z$J|!ktJX2bYWq@>lTC+UD~3PpUeTl0HY4lwEZ)$&ZcXHo*Thy8+RYUT9@buhRff42 z9JIaiCgkAlbj1sp^nY@TRTqwkjY{fbjz4x=fSxk|V0*;9b4#ndkEom#>e#A+RIzls zXz}MB)Q)9W6x!rm37VyC{npj`RnV>b-WnH7Z&jc}tLKl<{cgS;9S6&9-PynMa_il^ zN0>k20F?j^A}t=P(2w5EfMGwPW;QmxoHXm?0R;!*rmBkEN7#e3iOWJ$V*i?n6`C;l zQI-sVl4hn=Mo3ni*R~b;NZ*Vsg3ES?3wleWzmCNm6%r?vbWgFWja!`XEm|u zajsqW!I~a%;6~YP7`FZ0<+-*UdW%gY{>pHvZHc1X+}ZKf-^kNd*;*|0i-k&&^SG`= zzJs@ibj8j%ca0DwSIG&M)6d?x&RBt8_-pwX#9fyZU=HuNWKg)kcZcwSS-MX)oJWUD(YNfq&_E)Gl&l@_g)a{m>!8jdp>!P zyUfEK&0dqh($~pEn7KxBxZOnBc;h>alrhAT$^av&3ai7Zs-$QcnH}FrKn-q>iq{n8 zzF=BA%|tMAP7fu7ly!%#%rue2%ppUP`SxOk5OA*n=k(z1N)*z$Pi=Q8^+5$sTJQan z|HuykGZC~5l9HC~T)b~@It0B>x-2t_e>C?vhJrt1kNXriGICWy7%@i@NxT2mMjK=3 zo`xokT-~?bfe_~E>aC5IP59&qmi2QE2PJIT3O`mpbD1O37T<5*YzL~gHN!Rx@7Jy|R{Ts^oq-YYmig?PujH4m|a#8QPrHSgz&e^dRZgZxuuffmslEWQ6&+{aAj2FG~5zjWJb-@)5)ytTDq z-GpTJ>4qDSHZ;cr^u?N1Fh*qHbev?V7wowJD`m32@;a+a9_#Q3LEWQ9?#&|^CwR&r z531AQa+oELF(s z1lMH~GpT(0Jf5Tbw-lml&mHJA?}?|%GJw0kjVy-`i*R8>WtQ@(->&@24Ua8Wz2Q^! z>g;8^3fM!{06`vk_clkBm2~+G{{yz4*DMf=?x_bE_LEKog?FuXK4Fen;q&T*pAW3> zKEye;8nd6WeDvPI!JVy6!zXpF&)?TTh8DhA3^4=mco>ucIiKVH5K-dDA(^I#mUsN95e|%mf z$Xn!N0FM~qW1kxoaLeZS6T*Faj*}{8q_n{lg?|#L<{vPU-YEtlxx6)HohC#$WO1FB z)VXFGx0jA1F)%;^I~d@t(;3F&=*+@hN9@*rPH1}h?&dK!3uJk>@)bqjY3B=&h_>_0 ziySiUg`Z$BAs)X%d7fi7geMJwoQSQ-jW2GHb^>VPd=FOd*F#`$FfKS8Pajx#1>lSr z`%zF^iLY7HW21r;rPObto9#(dov3yCfw_pgXJ53PojMk^5N=}W<`(>ELSLvtWs_wa zS>b;X4cL~kvZqs3Hj2!(n~dwGs_C9%z{ZOxLL7Mg*ov(g{HiW0gL|wk{Dvdz94^8L zK9}GAB*q=rte;r@@cd{3WvFAt-DC{JcxdUZYJ_T;!}EgC=32vv6AY{Nrt-x?)N_HV zUdIaqCSCEf{alV&pI3RK9OJ87P75I8Oo73o?pdlHpX)fA>eM27lNd>xaIpblj(433 zn^K${4Et}HW_W!l|6CB+`4bGb8XBmIIaYH30LYJp0P=6~8;C(`>Q_Tkz#ajbZF%sP zte@dJ&}M&e;4TGsuj-tNf~xklz380SqxoEV?lpkT`#iU)`HovO?`jb4*Md%Wr=X{G zuv879=79@&eIpgsHi`l+TrUNtdOw*+MMZunV;%7<8;r2SXjXWOO!kQJJ6*qzkqO)< zg0NpR8)BjuJ%j0E$#-7*XDDRALRovZ%js6bBXa``d31TGA=+cO?CLmVnngpeqR^3- zUd%}dqcu3Bag@|m;7nL!Gq^`rVt!V@=s6$x6%wqGH6^~U6gaym*7**I^YC0@mBp_j z%s+Uup}GBswg~lF(7WU6Km|<{+ZAvll!ZrZs^wKQMJHuuQr)`hoxoOuCTL-_)Tabt zQ&_BiT3*>_5am}`NM+z!^i(?oc%lUUv2!iv&LA9*p80iQn{bCx6V+t%@Q!+To;+S zHK_?2&t2>@VI&p44JDC_S#D$zExLeZF&r^;oG4(qkkw~f6ee$yP^uhh+kmuE<~DPH zU;7o;d|reBp;BSAkHY@_j_s=(X5$$ikJLt)=%L;vpv96kB?RnB+WG{DG(vGK3b(>v z?w&U#Y{z(Q(}&6NP9x`H4jdDe->ME3mvHVmAgX2|=dsiv=~91@d8*G@2@x>@f6I%2 zj(#WAT;llZlIBI&n3@=Q8`JX-gz{&P|3CdKBjxb?l!sad>>%_W;^KPX`lFdm11SF{ z)Y~W?0=p1wf3QuHN8u*YABz(B#1Igras6YiFFNcpFlf-&J>F1EqU-C2qd8pj+^(NK z2q#=W&)aTUY-4uo+HP|4yOT!`@N*tH-SzdCA9F~K0i2w`+}&9*3c~eCcRf!8cV}Pq z4`J{R$9X;K%6ELx%KyG~{?)@1K2^t+a%;=61LXCkWao?gac`cD`WkXc*jQ7GEY-N7 zTW`g3P39&_(#xhjazs{n2WH|{HpHK<U1&Z!_K~HYx}s{iz)W99^-EPABf5S z@n{`a%@{qj)8V(D;xRqoVB-*NwVD?>QR~|gGMAR7@|hCuQT!$!O5#zu$;g1|w`+rm z#6@pU?5Q40Qv4dSJ^UTGtUs)soL|RPNBo9{p;*7uLh+2G!~8ee`ouup{JzYA`~Dk` zq<*=F*Ox$dPA+8fZz&C37rEe)7c-2^=NeqUE-!G2t`=vbkFgOr;pK6U+BH%kpZsbe z%RjB;5{O24_0Xy9ARRf*cyhz1jJU5(HDz7z+_@PB`u8);1UHX!^CKtnIz7aqQ~Jtb z5$JaSq91nbET4Tju8L|}d2XcP02>eyyA_EOFya?0kNe@{y>PZJzg3ACPv~4bAvpJd# zmjK%8(^DDjCP{zBzMheRdp*#AsRom4oRyeIIzyJKjQ8yvp|XDlTPr5A&Oi74n>TlG{*_m6D=!!_&v7h~ zfI`zojvF=-MkncR5DTZ|xq78JDT-UCX3BeKVx~tUy z@G>uyBHgokO=$uc`zH2I>d-Ii_eLD*eN$o_=(Ku^+cvv3Kg~ie2LY4W(ZLz=tZCTWTxw6u{ zRk%E1R$E;?WHgAoI5tt?lxTl$YiN1_7cg&W@l z|LNTQ<&~A$zeH9`?-)JMO$wz`ROfPpxP&I1HPU@4Ok`*J%?lAvXHp|jfj7YilogCMZ_Et^dQ?B;QAy>W^1~_|Uw_`nm_ zkNM<^%eO`3xw(Gf3o|b7H@%*IV8+N9YT=ze*d4kER7&LEH6Wh*ok4--`|9ibR8gUu zK9m0P@y|5Xu2JOQO{;AfADpi;SGsTv2cpo}I}(`ZOPuS>Wm0uVmDDU2l2S?{mHnN{ z(eW7vh|GjOgM6jMqel438#srYgnNPl`$Tgy1F*{MdTlCa-3JHLssGHx{)@r<-7EjQ zNt@?nz~I$0VCuHP4S}h&qDQ7zV2|#W#3rcoX9W4>y;M^4{q}iX(xnmE+cU(kB+}75 zw^;_ArG#-yYG!fzWk{*NJ9*@QG%X@bXf)*E@t=nWp10~7cf|A{QMY|OL`>!=`J|Tb z)%iyIcHXv|ruBH5wthFZAMFw_Rmq`x+$@Sz2Bm=(5qXZAR-*tbL@E`Fd+IJaxP6B& zDDwIf-V0u3q%y8`d%PW2iFA2-@A>0;O;?q2$8eIj{yX>kzps+#{c~yE$LA|@ZSn?9 zuE4Mz+<9T6TjE1b)`RzB6Do#LKYzsIs`dNz7fQjU*%pYe*DdCuqeyK4XxdMiX{2pj z4S;6AL}FG>eJhqkg)aXvWp#5*t22$HPse;G5$yF~5@Hg;HVf|UsR{(G^vUzgXIlUs zrKgC5x$^$5ZTXPp7Ws>+!qm}U7J8Si2E~RhNq>IVdnQ8jn%H6) zD^TEFFuYgZk_-e@n_sVM_a?o{6yQ6XTar>cnG5^=Hl=&I#a+kx6ee`*{?kVNvl0p1 z4TW2!##AM>8F{v-jtocR?L#**)#m&uAws10LJz%>WG3^1)TWnj3u2YT9U^n6`}0!GaHL7@a|d5TylN z{Xr`wMUMdpVC78On^~rLvT@^9@uZJCflJN8JD5(2H;l(;j5rM;_y_(PM)A~n)%b&Eq<>XsBVI=C;Xum_R8mE*|%<;$->b3jU=H`Nxar%Na=yk26Lm zxMY8!0iu2actBB!2UdOFAlS>T;owFfi@pTzuy$knVoi8)jVd+-0e?%#D`5!G@%1S__f()3r}yF*1Z*wSl>yz4I^UCp`K;xh;pD?GSx*8RoE6p7zI9_gtzC$=L`mjsl10+dP>!$1|wp_d16JB&F zWqVeBUxs#vR0f1UZt~f^(2n=&!f#E62nTDCx@oyRmr_7Ge&0n)bhi7u>`>f%cwCh! z`v2~6mXcNF)6Vxe4YnEnq7gB3WRrK@RiWUf(As7;C=*KfYF{29gI{iSUKS^Uhz$NywPIa{t(Y!XZ!!- z^!&?Z&p;g6p(7dT)pJ^%W4^Y*jdc`*A$h zH8*&;Ja?2NJ|FQjG~pM=;y*<)sv>cMJrODge)^iFP9QX!*;FHmnL=hm){MTTgC?}* zQ)M6fo1oo-kU6)HEU<#Rts4-~d8kH5$s5GXRW7$Te&P&%7G?&V-v^NysF2+gy%mtX zfAG}Fs>Dyl=T>RxCQ)TC7;c;wiq_x08e=^iY^ z%F0S25GzE{8m&U+lj6u@hDO$=V*dyE;@_U=93+w#XgqOs-_ML&kdoN9Cz~V8J$>f2 zPcABfMqXN7qnPTU4s5{(3W4&h+oWGne4sKxs4wSs6>E5RXV~270}Doh=>$T}KzYc% ztIV^a2}hWxbH4yi#Sj*ur-f&v_%52(&#lH1W-@-dfj=TVZc<)N>E3R!2O zBLTq%)T|$OiFp)6sjVth5su1m42q0BcG-nW~T`P1A$zF0+yGtXa1U> zMVP8$KFAcd>UJFdX;d)OxnJxRHe|)94JaAiV7+93KCTS<)_HKVS>W+iq{J7j9cXit zkuEld<-p?P9VY|Q?$E4|;F<)`_~sAxxNh){)GNqI;iHqF7a^-NYSbf5bT#&AgDZ1` zYbw7gP4wIes`ICIw5sg7XbQ&M2s1=`=6y+#)eSwyB{Jy@jAvYt^C1oxSZz$VOCo9B zIk~wpzfjN>9_XVQ zBlho?#^3gyd3o#FTO<1dyt$h^?!)FC=8aBEN%s2e6wBh}Qo>xTNB0OR_woxS!u?Rb zUcL_|!rw>YhDTZ)BnDaRZBV)$pR@7vcd}9jl$odOZLM29!o&Yig#X(;G{>_QZc9xB z1cY2WBj>tP7amnh1%_#Lgfe@KmYtDtc(y~|m9anhJhKL%>KRpdrro=5&^~nOowT1= z?_;w`RVntEiV0u!la%HY2bWZ!BBF>>xBG4akkHoBa9_yQ=?T4C_}tpfZUw8)&rZ1Z z-%;1RcqSGYW2pg$=cPI~9@f8qUjQgeg;0R0R(1J1C z{#nnHbZ$0KItcsfo&wanpB#$HnR6-d-UY;1%111RCMUi7HsH# zkSyL$O9Hb2a;(6QZ-Ryag`_9(__!loWlot7Ps43jAYjWzN~9rH*VeQ>Q6e$r1xX2D z70uvMoT8C*3R`$~pDnq4*{gkzJ`?nI{qk*<8(BK&t7_~HH?L+WfD9AyKw%1~8t6!T zz&284oF>FB`SVm%SC52{hv_D5_-_rt0y(RMd^7Zey^8(;LJ}W^f$lC#JB8`AK}@h1V4qJGxsdc!{!oNoZr|*Vlv-vbY^PE8sw#!C&=q@+&R3 z^Z6ccGt4f|&VD~R_{ja{57T9|1MLCy0oX-T6KZ~*KWgyULbAq1exPXAVaDZ7cU>M$ zlm)xHl^1ZO{KVnAzpww&iu!`uT^D-HI-f9jyy#qAun^C^i@m)|qZL{2-{k@1whr+M z|JLwuywfL6kN(M%5ki&|Zjd%DNUg|R+TQ9$i9&!dtI!e(zly-`J^#TfWjDsDE4!?; z3LHPw_NCRj{Z&#)rW||RYQT0m&6xd=yLwRbOK_)XLCyJh>Jc~$qGk{N$)w`8pE3$K z?IrW^O_PNn(rC4ZJutLdo{eAQmuT-#{5wzs@j5i*))zGHa_;rdI>i;bF>1+tiub}5 z#8=Peu`4IIzj55>yA}0(Us!v6`h5kj$dhJqIN202Z@`k;)wO z{teTpssi3f0BvjCGNoP^mw&gjH7e0a2`mLobRJwbI)nn(8=Pv(-jt|>aEuK0b|0Wr zMXD5V^~n4rZX7aWj8Mji1$=P1_R;c_Bf8}Cl#9>w*VgxM-!^iQ-e6QjV3i~{_T=W) z7e}W*@UbMkgjAb{O&8Rbt2(B7=9+8+eEa7Bsn->Wf*>c|HbxOyodrm`0(mk5DYCsw z3K%zabL$Tw8_hKw+!a0z_*~lem)!|{-8-3I(x|2VgHEm%0gg}b$LAk2-eJ!3qZ0=O z(r$O2wNB+l(iu;QdU$x~XThF6VnBv8w}{PScPA(xfYI~fT*^<)3d}%1d7_{0$p4GI zSPQYS>+L4HVn1>E2#s$^z+|4Jm$0Z7?|au4C4C=^ZZWg_|F#}C&^g@~^E&>-efoCK zz|xrQQp4x0>)Pdu(xbpgcDBxPHxJJ-HL8A6>`;YOQyj+?|Om~}7@M1!jcVs(x z-+y{uKWW^zQeG@>(sg}A9{jq}^TtInBs0;CC1@l#qq?lr!!%&n(9v%&|LMS=uXnvV zYvDP}*-gBtyheUN%Ou~-CqDJlT^^;EohCrN{r&uN0hE~NTkipCG!f?3M4{N^6mr@QKX&f9hmAyN|Jo|*%@$+OpW*IV0?tWzJHI`175IyH>8UXD|(hsXv@ zVfZs(ICFt~*!lJEw1k=F1ZWgsH#^PxEW)_Xhw;b=U|MiWYxPYV-#ZIB3^1-~Ul1!y zNqgTri#@yK&nkG9nr;nmzAyKT6esAB$q?ie2~CVodC^F7=uzv)uinu2d5{Or>1qsl zIVLS(M9CkWi$N(W@XT88V|z&2Q}%dGLsC#<^irhw*lk*N`23Z!a3);rf3$dTZYOW$_TX?IH=X33W9m-@6 zbZ;BejE{vcTiPJ9Fg>m0Vk%aR;_7c;uLrwUV^onSMR?r0@aj9$4EghoIji8!Bm1^$ z%DV}vA?sDDKujQdlu%NXPOfszITUIt46`6U%HfX=0>1N zo>R;cpCEa#RF_dWJ`P~CyL2umdg^S`*CDRu2bgc8*K^6+FDH=J&(Q}>Y__9C%O_T- zt1NV*1I(O}91{y8jkQn&JZNhbuiJfv9t&UD#>4iKYv|qI{mu+$?h|UG&Fu}Z__~z? zqqxRb6oU^fEiU@Pq$mW|R=)kQ15tUVHa3*rd{q1dX}nUI zc1B0g{UzXjS4JMR0+X69`41Jcs!_x;dsa6!|K@#H7bEcy1{A4`R37-Wcr!{>?>vBj z9-hzgr~(r15g^%^vIw}i*Wy@Zqa{(NCs8-gxK2P^ zt-!k^DAFR%y6(Yvq6_fu!RRH0RoZ*drUEgRb*35u72kJYE8*wrz00Crx%uUgqC}bH z2R@4cR6Kw}YoCuQ&jM!ctmK68u(vX1JDDkd-^qXo(hg}+$2&Hw?dLqCrU5Eh&B zr?Bj|Ab+)Q?!IE%GSG zW@h!<-jEF+3uJQ;5?TrK{L;89HH1~$mFLUEO2|7j07#$#_ZQsAG4yZBkVq`(`;UC< z3j{ng_k_MR2?uSJm}5*cV0u)~RRAxbekNdbeggQR&qsn5N0a;=mW|Xs71!Y1so7(; z-Evg1ZD@F{ncIq-b-U8`gpk`VIktQ+ugl8t8$Q5qfxSYxKf40dnWBWqH}N9RfVDzG zos9qmD9SSk*@=fuQb?oWdmgo^fO1ljoUu>f)RC(7$)>OlfLtm8++dP|)+17LsR`%$P#*m z9vS$v*{JhEY3^#fv;6&MlON9fai6-3F8)1*&B`+U;EyyWmdblLpO$u z&g|myOlB~SHN(qZO$K|{)F|nkOhGHcJ%EIRk@{M0_RQh1+Q9BHf8)LRcM-VyuT_$d zT8^HTbxi$aTy~2M0u@u|ba@IQcILgm`8)FSKN*#bPNuEPdCe%ljz1H^JAPLt~;dfiY&A-%23ge&26ip;drVnz^OX1VqKI;Tl5zK@j7!jDLa z9;_f+zDYhNK~p}ayI?deTvEyNI?w+6qj6dhde=pWlWn*15H@(bijch3GCF(RTwiuo zXGhIQ8S%^mL<#_r!GD&2tF|)5fBJ-@2XxBG2leuSE~N&#&#gaX^(6O28Ed_cm?1NTQ?nk z-hlyDc#4;hW zD|woB8Tb|9N0eiBZf8J54!vO^mGtrycZ2*QBwKR!q)&eLfkhuUM7!Yqa?FORFh|cE z)4Gp^KU;4CXvzL;MWpgiciQ%_*orDp(_HC4@Qc`nW6bhO#7_$!clR=r99F22IATwsjWN z2nwY-e=^-}&h_#%!0`gMo71(8_u**yEgzq%RK!Y^D=?nb&U?=8tfb{LKnvw)FE{n) zF#F#&;1A!r=K$3(vkq+gzuW5h3C0|4WBrAtc&BWB+ehTOvXV!R@Q$u3>5+P~Jk z@t-_;i{IR&4L)-<58hX_VSdFVjDLxxqgzobP3182Pe8yRf8%e@jodc2fngMXT_yNZ z*0FklEvEp_58K5;+JI>4R9;Tb`V%rB90Z5Y$$NMZ^M@<41ZDd#5Rcb}y?Aj1+>&tH z`tzKq{k9^cW-VHAo8~7sJO6IF=Ne0QK@mil+yG>NCDz!u_86gdc!hS~qqPuDpL6Wg zQq=-z?Pr;vov}Zx_#b2H_hP`=yMU25{ZoHqGycf0n}Xu11v<{@vJXz>4~pnvNzVzv z<%gMbN;0Z(K}b#T^q}NQ2(@hMZaM7g5bWlXU3Fb-TwGOPEf6$a4Nz69Hsb29v$x-Y zUd({!!pE|g0}U`mjv--E7bX!5~bPgLo#8k35ZYjUeJt!W^`KA!;dT$kCm zSnl)0QxKqxnkK^T-{(o%MWdSwR&!@MSanNzgm+5NEAfE1CYDvjGu702H`}#ylbHCG z&kWJ6SGpDN_hHi zgw?=D>5b=ZDp0AtTo_)IMRBe06@abKcEa%S8vLeGx&Rsa&yMFm{w$-E31~*LJQ$Yy z?*!S5Ym5M!?QOM>hoT9B{=-l87?0k`jd7_^u83Gp=+#pK^>x~$LvIFbj*t)*czbl5 zqt2wM?f&(%86n?+62SBQYQun303KHCkq;{r{IH2Mnd&mKK`A8?kVbiO2y%J39}bc_ zxH(Iqi&EQaA=s$WR5YE+9QAR7yV%#hR;;&3+C*mL{Vmnt-&nXLThd0E z*Zy>xfSs&Y=5xkHy|ZkgZF?>tTRqS9tPU8!5-1cM*ZDUGJ0ly);N8{?-Z4VD(SuNv zZ))p;JnrTx(rEePJ=>$7K0l;DEu{pNeD7860yfXgIfHPDCPQcs=-}CN#~kHW)W{ll z4@MN^nU6^SfSGy`SJA~T_@)@L9ASC{0G z2&{WfetxuDxANU3$|r}3nj3Y*G@j~@b+$S9PtHS9wX5M>* zgU0$IYfUSm_nJtq4E{1~x`G19c4uD>8x!WXpQC$fd+V_W#*Mbjl$Y`a=JP#-fdY?H z9nBZ=O@h{;V1|q`trVir@6@Fv{@A>sVlLPStp~;#5C;1&K?_u2#h)MW|dr z^YuV7SNqc3dk;$@08RPgB0-^m{sbs89LLELi#7ghW}tSfzzz|{P5pMopD3sY zs@SQ0<@^~%EXZH$8-RUPaim|`t6iR`3?a|p9K9@Z+bfZm+M4zfCvO5BJLVshh>x?r zR(ViIT;}QclBD|saxz0U@(Ay49HpLT5w%h-=!SfeSyE~=CAXAv@V{RT>ITqAF|+C~ z%(_216!?FQ+UQdVh%ym0;b7lb27p0v&-Sc;dp*3OJN$Im@^HXD zN+)eNu+Fp+1sOI>#Q*8r!&hh_B9Ya(&+Gr2O=mz3w`&Qxy!MH%_+5kSN5zTmO6)DGKSLy`v< zVYfWIKR7(A!<3+lfY`tKjcP&9Z^P_+dJ@BXvc0mB#T*kBgZN(mmjzKQDe?1|1_KSL zvN8hXnJA!-lQ>a`*%zIZxOI#<8jzn&2n_a&>l*Wz2w=?IqqdHcV)C97$LXF`D*KNQ zy;k+GOmuji7sYqbOicaQTHSA!3Y|%df%T$Zmr+ZV!O!Ws_ngNfO&U%Q_7_BX|N|XJe5t5{G+R>?U!~-O zA5}1DS-9Bfc34f=Z_V6{{Zau22$ucE zHR(!c5_v=yE7C?MJpMo0zB~}>z572~B}t_yYa4}7_Uw{2YsnJEkQm#bWGrI_EhHC} zWQ##r2V>tEDr6aBAN!Df8H2Hp;rH=8-+P~XpWD5+p5MKHHJO>ud_M2@`<(MS=e*82 z5=ArgV;d$qJODFxIkVH}zV-~NF@H^J*Ts0cpVSaI((<<%$QJYv-b)QoO~bCndjk(^ zYFAfo-!d1os-4}U?wzE5P!BjD#2g1y_p1l&7YlS4KJ~35`saU>*R6^po^8QUye~=o zMv3dS(bt@GuQ};qe#~6+ocS$Pb2STdiSUMiX&{yJY;o-J%Dprosw?9m{wl_S`DKZXuNuZvUdMTb& z4c}qoLHmpgok@>#HsxdSnRz1-Hy5azhg(#Yu;OJUg&{|mq0QpR*v3%Kr6*jqoJ&;D zIaGnVJm>z&$WAAnx<|^Bd2U@|=FT&FM?}I^4w>!w##8>e;rx?#V?|!-KmZDl*}ah8 z=Be|KUblI&bY2esY_tSf2s)TO!8GZa-~}j3Fb1mN4^Za)S4(m}UQl6KZv@hEE!f8; z_XP!xvof83c3aR|>)YFJ3ZWv?&JN`kpi|+mi+4{8=a@vv_o2PWWjQ+KU$q2JGqW}|28`N8nrps{D-7d$OOTfn=gyuWjXawY06j-> zPEHg^cZk2IITnM(CNVCtoEwl~pFw1-M@-oxTbAlZrmqEz6JwVtSbBjt zJ3UwNM3ElWF&k5#c*l!>PQtR!6T zMC^^mC8P0%*Q^d^a&XglEc-;+QJS;1&*f%&d$^8|yxn#LirVMO%>}?>^yav4* zGu4e{x4>6`@i|n$0MMV!&VXmQ2t_6no25Ebj#{H+tao$@q(C4EUa-Q_*Y_^3^N%W( zzC&Ss^CNy0pcAn=hbD`Pu+Pm@e$o6@AxuCu!R8E2b`0kx(*M;LFRsRFL$OL&KT&WWu*QCtE6D_?hQJmQm^lN5vDF20?V%*G3-{D%q;WkL!AJ+l@FE)9{m}M(4 zZX#9ukYx<7t^RY3H-%NNgB?bzpW(}b_S>K9fAy)Z@q^!|q*KRWexB&Uj(RI+>>2Ha zR2CX{ZuwOmF3B6OxfpFNeL1os+J=BaFGeXZh?jqQ2e1sVD9hR=VgNj)H6B`I+=E-sKcAP!0$XuTptO*B4m^#dz zq_Mq>_n&`8PnTJcX{E-S7q85XFJh@1Kn}j+++%$B{68>C4PZ_%FOA^;({WLC^~jg& zSMSw7?He?vAh!hftj>wlg(|9UtWMIl^W6De437r%)uAffSTs$i+t8=>?!BE9c=RU$ zE-R^zDv5y?Yo)ZS51XF9cu^aNPL8~yt##*)qZFNns{E-_=jcyqG;lO@^$kXqz{TMa z8WG{on2>p>JV}U6^E=ndYaA+b3nlfHA;B>YeS?>AcZ=GVMZ4D$3g?7U_fpV%mnG@o zfvVV!c8fbU+=8V5~$A!qKZnpx~w3&#$OUEaT zj7>g#%+wHaJ+P`{ViMhkKr&U>NV=7ZTgag7VtV<>x~qGHYj3YU5lj^~zF23~^#EKb zljc=l2sM~3yW|vi+bWAl%_mCpc8NnlVZ#%j_ z;+@s_+h^K)Q7jW^t~O4#SrLh0L=CLpQKlH9cvyKYD1H37mX971>h@)c67lIyc%WN*DXqN8K#6%zy((N z53zPv8I~Q|YZ$lJ&DKz?1XpOD;Z0OsiZ6btr}SPHZ_&hu|0t}#>s8f7v6pYJ#uG1Y zJugxE881{ZKh zMF*F1cIT7Qcl*UNZ?HHZs$sY-59`H6c)nu_iw;+0f6BL5gMWZ|{$t?(;?0%mlp!zo`5Why||ApYc z@4tTbOo^>~{g9mvErCBfbKcB!+;5CP*9Vc7Ua+@O4xd&W<-o6)CxQZ&qEvyJ3P0~c zUSg4-E3Dsty+;pQDz-4B7^*ma#m+7nrsgFdv|kFRXK z`|}$=!dOZ&rS3+c&mX>RcW%(RFYppf8y;7Bo{u7qM1~qEV|uhmx*bOm$WZ)J%q77! zG3B{iE!=vgL`*y$^9Ylsy%*flF=azs?#a1HwG-^eD05;;u&B^-W9LjCaAT3990=JBrK*qRTFDfP9}fB=$bAj>Hltu0>D@FKtfW71G;}>8cfXI`T|r~9b`&2* zTcI%@+HIE1D;eWZM)P$Xilaqb3T^vZU{{7PjS(-id5BHK%*_o=n)LYd7CQ7dL1nyK z1CO8nyPcSwL+x^bUgmwR`-MFher`E^P|ny7&x*@S@DeDbICJ0U`l-@#37Q zaMw7_v;gA#3ZR`wk4YH-6H8W13%)c_AGI5j2J?)jrsxXndoBZ`W(LHIfiW7A&J+%k z^bFGzwF0|=+m|kBub77ZUky^o8`U#hfLXrv#W5@7^GtRcJE9O;H*3hpjP7_k7w&&q zm?hv2S0Et^x&kH1NMf3vQJ#TP!Jt84y(nIai!m)q*gA)gtL140B*_@!(ph_KUCJZ& zTF8^tucoSM?K+Ny_(JvqrI2qh_`mbH|77)C99cZH-UgGqD{D&2%3?j&z1$kkBl2Of zE3-nciDdU-_~`)FwwG$O*OrKy8i8mj&vYP9BGR|AUT#m!3a)*pbQ2`+e!aO7FD^BM z>zHOEH0);D%|JH>3{D6VS0vytWeS$oJBr3{%8IZ>-j+5q|8oX>hl4{<=*$vQ1 zbB!VMG`j#{rWJwSK>6b+E~9hx+Xnc$FgamJfw2xuDF zjy^xhB{6^GD92ovPaNWgI95iTS0Ufc(i=u1q~O}xtjTsA&#SrQ*Y1#-8rz9m3t;Wo zh2&ZgGKWj1$*}t=A1;m(!XfHu1VLRid!l_}sC1cIdMZiCY3?%$gjur4mWgP%_^*wt zd*#cD7da4~_QkPg%qEYNd)tUJpaBHF(Y+Lvb6BBn>6w-uxMQ=zX4}cNfSIT{Tc*ri z7jZ0)GA;KGuPlZoqyUPND^j$P{{m^h_3p;&=Q6We>Pu#qyF@hKk_`P0O3}=b+K$|F!3I=uTq^33+4p7gs|*xfDW`Vt!T$? zC3hjqtAR-E(TK?SN~USgd$O@Wl~Yp6p3d_rfnt>|KgD^%atle_Q}nb#XJQ(gib+bC z*Q0i$+PJBHK#V&>cs-+KTtk={&Fs47e44x-S^+CqwQx!gq&hh9Y%<(mz22hI1JFG) zl5_~Mmw3jdobNwU5!;Ja<@blwucls4P4famTH@pp6STcJUhlY+tvl`lOBI}Yp(cn zQ8fc~YS}KYp!O;4&}4*O!cK549pYtWU``=Ug7(o#v4b^%bZhEF-KG|e*nX`=zh zftXA)nG8&mV_{PGf6!9K;3r| zl|e8S-{Hh^&bakJbhc?NL zSK!#HHBbh7h#nt1`ekJKT#;Mjo4orF>$DpqR~s4|-Dv=qSAwj8zN^#z#uKm@qmsjZ zNl8gBB7IY%%ll(;cPac!x}`a?fd(rVDm*}kDgj5W;j&F$0n0FeY)^7FbH4B&u|ys{ zi41hX-j4@M42e(EZzbl~24hkR*%{2)NlqoUIIy|+z3-V03s6Dsde0oecc>sqC5 zq*R^QUWc)UP7~;3TB6`9eAwIMixXz?85vqd_QP4Axv<>4CYHkRAfhvU_+z@G(YlmE zl#BVDI~f)yPUuRXyur$KU+9R$@Ga}HhNh;}^8NqnUgyWKw;NS2^9Yk#en%rg;%G!f z+UJf!&|zVBYE3;X?S(ejuGs9A?VVdS{dk))f7)><_Au1Qh)bnvip|d5@C3+-vPYZu z&JzoNv?LChtOAM}Cx@Qzld(FUTgw30YI6UwCYVQpj(b$r zr}vuBjKE63y8&%=JSk3M#Tu5Z75hrjdpch>WJVPW)EWbX8-h71i+_8PnoC~4Bf9cQ zAw?%|2X{oI9utK#Rc1yPhxVy)`>ki;=AA#gZAJ9S@ID(E&qmW54l|Q6g-dFh*zY% zZx1op*UWP5wBS>`Kc(k_GItdKBwqV@FBGzp@~XW9w-&E=yF~JTbTdx(A1OIeVSkzO zl@89guI1ujn0;Fn1&z^D=I(%~uS*Eqb2mfOH|fo{qO(5L)wTTz!rBQQbeQ^0f7}!X zJD%z$>pk5FkBFEFHv%|Om*63sU@rrL4_Tp(R3@y=CENAoP|6gpXxu)5c~}AWbk;zW zeBL(_g+4{FazJ4VJzC;}~JgUc4Vg%Hl=7fsonOWGNiXgcDG+s?8afma^QK;6qO zsK7&rn;TB+-c;nZ&CCU2hqg*tjbe<8}6Z{7T7tEf>4T`m4>zl7>TrOVC_|{N=&@xHq~Fv z8}sUw81;1)t%KB%l%HV+bE+cCir=7$u(kfnCI$NjHw8sjRlHokWb68hS8LnNwV#esmh>`AW~J z%Kcg{9L=(iWx2|EE0vC>dkb%_wA3J?pYOFCFx@$G2INs~ z>^9r2*7!EFrRlEoG|d3rnXK&qT3OcYKtn>`xV_N4x%8Tu)vWYU32e4WKTI%K+J5vx zFt4l5&F4cn!Chok{^4?2o&C^$j+f|@;UpktUi|Y0$5ByM= zpmtZHK;xr!U8k1vb(VaW*29QGx0q75nM4t+XVgPi(=rDo=h;hQEzZ45QJp|pK&<>} zW#^`ztgS@n_g7in{Q_ff3fGvJp3TKYV5xEAa9+W3aN^hHdBt71)tBBFE!#YIKKSxK5t*L$pc3!zZ+ ztmOveL(g+Oh5;*3(DTl^8I{&}I>gw5M}N=a;=cTW@|TKU9ePEm@Ni4z%rd{h?ICr} z#R+*_kpaK=XqR(mx@Te#7w~hbu70-XIoLWR)!=~k&anRy*CVdWI3I;_OB(jL06xbB z8%79KBVWBx#R~iR9AbxYDGY6UJ+O6ZP3{tWye#1@cpuOBem9gvzoxYohllhQhU{5f zKb(LFJg8#Sw@Zb64glB%J&xTd)}^4j629me>!W`eO{v;<=JAGoqUFQ^r6Ra?GM`Jc zgMM;Z4!|i@x1=aoa8IsI&$O=qS#~eUT#|yJ&UKcq zR_+O#xLfitJXr^!uDdn!Ahx9=&DueOcvGp)2d^RL$8C^264NcNziuwZJ?|Gk$kse{Iok8 zEUqHrN)CmDz%G52v>!-M0=hbkc6knTZ*D?V9+E!yE5TP9%wv@B@oEf*2T-PP963@~ zraFLyL#zvef&wjGWcIhdT^JG5y^CGE%&=#LFyKCr9=Wdc*FfZV@tAnzzHWCHAS7Os zXV-DTR2!G_1n=cgSqhs<6%6Js;f$UTHyfwlBKI)<+730t2+Q4=rJvDOwi%&b67DYM@G2ozEP_6-_nj*NQN(XsBSA46yH3s6Vm@m zKPKplk-L+exOh7}(zo*KqC}qa^veM@gN{I?q|N0UjoNZ38b5vFMfP&Y7IqhRCFIH0 zR|E`myKf~1Qz}LW1S*eSmo?2!l!0P<9;-=TphY43`0w~nH7@PZI*2mjV=sX`F;cS8 z?8t&{h^+Qpq-y+iDk0=URf+@Uz{V0K+1q$VPlY>M7QVt$VB2a2Y=#S#-|609V2-7G zna>tGg)Y2@3c@dri9D(qi{Q-3(|C2KbI6F-0JXaty$ zhp$LAb>2!dodC+RfX3Ajl(dN~0M81f$W7jh^(h;zy2v^D^{f)Fa(US7(0DT(?$uC2 zB4;?4jOkRYcbS2xvFJB(e2+##x5t>>XXE`+rfX5&MBeR%x*4}^j895^7+Alo5W3_u zg1LUzVQceQDLJkWWIGI;76N&D{`oi#9G`;P!Z?*K?AaH&imZG%cxi)}Cq4;fm$Ajj z-U4(IURu0#9vI#t4PS2X-_;A$0Lr^f+g56d0Q#_VpcMAN&5bxq&V{y|`b)I?`$M(` z95Q8x6+=5(MZoEY)}p2|Mnq*L?OjA~+Tz?EZ8>mZL!-K|GxYgvd!LTyW1X@^IEhb|{KE5Y9|GdX_EQW23P4jDxp$eSG86apITuHpy$Y+1H4dz;aHda7d|PEsY}CN45?485@2;grbwC2YNCB5==` z0pqvo8(U8EaYuBh=pd3jhOn(XA)-VpOr> zt`JE`<%a%p#b>DjG?e4A!3eNNC?IPGnbpO4CBwVM;N%6o4zYhxarZ=qJ? z1)Zql$FmSMV_rev^CxD`Eovo^ZIVK1n9rI0OZIiTa*>PYP2R)e^lB+Uq&QfgM;qiT(a z64mN-KcrQ&k|yNc#Rgo#1i#AGLtr9W?K_oQ%}NtmoRg~?Z>EI&kow8ZF8cOd`9_9@ z$#s0&WeUkY*vk47AAyUNRfdeKtA4w%nUgITnNYm5`7z~*rbG6vir4rv zL71;JcVVm^!Dyyj3Viqh)w{NbcGPpDz2Yb^Je z)oz~gY-66&7^~4VDqf~XVs$15?=t9;V&17U_*to0Kw6zDR(sBFJR<0f9VK04cDb!% zqh0`g^PUgam+tn-qh+ks3nSwzeuTL!`(rk%*dvl{4N~#*1)e~HOvi=$y)}X^nDdU8 z)dn~W@1ALuDR3~FW_f0IEODK9c>2v3tHy#(Dt#Z1Ln1RrVxTd&B_>iNf!vke&TaAFFKys1Kk*|T>)}F9&37RoH=BV0?5zMG zS!~1@aZeJcqj6$Q;ty1vW(Vb78*|GT?c1r7u| z%D8Cn{lY0pn^GZQc({(1c3OluI6-A|0iSF6*nRLpp5jsdW5w2u5Mh}alxy?x`U}|4 zewii(E%TP@(i0@l23h{9p8ToG)k8We2#35hy5#b_>!iLSgHXP+XC@4tHc4b%`;DbF+L4Giwj;ILPTg5<1W=J+iVZ|o zPfac1<8U^deD0F!&v}sFX`4TUN<*oKpI@~C!VfEfp4wkJ(`a60ndORSLbb0+Aq+Hu zEd2WDJZ!xEb66U**RA#rJ=IAW&5*&bZhgtVp4;ERY*5qv^$RqOfr>J{zim0=0! z`F^|0Qy=S1@1n5UjYS#lZ8&}hkCZT}RM6^Z_baD2F`N^imN@1v5osVjBN*=tUNb-C zg6~?`daYN|fGf{to&l_RmJI2|L6tt|C!77nGeN>!L0wbOlccqZ)y*^_T)iAk=p?(fI~H+_P8@szrZb)-FESu&+A$g?{3s$6>8o^O{6P|7~!I&uW|Y;d*h;&>a@!MU6-z-+e0iw1oYvXnp%1w!G_N4$2>NsPIr{| zR6;tbqvm3>&I6^ad-m_qy8Gr^)f2zQz`s8VeqKTcC6C{(^zyX6)}z6sb)Cq0l=|A) z>%zQ7d%uTv7rOPb*5!CU<|A*9O!cge+e2FC>@f|y`+<#3NE4jLScP%e_ryOapj2u> zfNaE#VzZjDo%~Z;_fzuGzTVlsUjK!f8HuAkmyWtx}KG15f^UhWV>y8>lc zpN&9kf2*(1f9pt>H70++%u`YjkMz!F0a@DoDao*jDEZ~!`(+QUrt_mp$EO#<%PQ~m z?WTyDmuu~K9U7c*DL?>Es7O1@(PK!oXt03TYe_lj4YW21*tc)r@(4c&GkA7YD=I9E zoo!s?Tz7aIs=FR9?t-(qM18z;*h)GL3S^{~;Iw5sU?yrOA-VLEJQT*Rj&>mdk8Dy0;;!4 z3WRP^{5-H(Hj!wT&SLe$XN=6uW&@>(0?R}U?SV#rOTmp|H=1>&0GK`+En--nVk-ssl0esgkwMd`T7^fp z5ptvP(=t#Kv@>zgq|*Bt2N3K4rqMdIROxpDL)xF1q?Fd5U6yNg+s0noPOg5kJKX?H zBfL|#db_ne>LUef>JeHs9PnED@hUr><9>SQwBm`c5+*YC@_^}MU}I4&mADtRiTle*HZ-r1yFA zzKh?LzGe1Hn1H$C*4veDJ~A-v158=J{aJ6FiCk-PdVIWIN}Sh=-op9;=VaC@O~#%c zz4A(g&Y*L1HEeBjffyPQ9*zd$Yj^KPIR)}6P|RE`I+q&9V=6GNdHar?ot;6- zxnuj&0T5)8`=}%izNLYnwP6G&6xTZ>dy5~0`Ll6HALfgEr}wFrX(IFiFeR^igwOqR zcMgOw{{@fgdSA!9F@6+GXy4vKA=gGwQ$^U4Yoy-78+=j@D?GFfKb2ydrpSQNL;7!3 zQ2&*7JZV96UG5AL*{S{*isa}vHBSfpG51gahINT;uugln1)|ChJo!t=|2tiA zO{c1od=rqF9dwcg!$kuD(BVoAfdrcqddA z&einmzQdM2fwU)?jp`@0k?U^m-4oB+gSjr5t@cw*wWB1|Woe`Sqju%W&N~L)eI{$= z&NerUI_wenuuoLQ;LPDxV2ETsj3iGOz=FZCurUkTRKhj(_IwC=@ID+sbh)OT50{@l z$U<8;a(Imn?^#|0Zw+@L+-q)H+t`%OSCNsB#}6My8!Fu~CvTC@c3Y*3^z^VkYQ6-q zo$io*G}!Ih-`j~pYoqGQ&ss7tE4a^nNQv9RuqS}?3QMh?d19)8xu7Ds}+qoMEL9SMVKlpP7Y3PJ(Iu@phk zj$E~oHvp-(Ey5V>$2<=NM}-`+zh`toRgPfGzf(dttH^|p?ly?whrwLZT2X{jgT^SIQBedjoj_p^qeC?!hgbSa29;65l^hA=M~+Ps+CSN&G?M7%>5 zpE$Rkv2n2`;6MX8W0N=r#xs1g8%;kPgglsPN=F?`$2jR$PXl7$3)tpQOcX$EQiUz~w4Q)!^G!T|4qPdOFq2- z@7DeUN&cU;xZFK@zR&Sy{fq=`)Im%2|E11x7K*`J)yt5xK zQ3H;ByVsU+qz|aj(knfJ9e-Do?BD58U{h5Q9M7*NE_P0^jP?R1t((301Hr=0q03}u zvB=KI?p0fp(fcJWH~Ze(2ov`=_z|TQr)Y)$@8KAKh-l?j7~9(RE-9?U3A;a4rE$!| z5!1xvppB?ZsXJm6*XsbI_VdQ?8{ht+3;V-w$ayg;^0E0Lui;0&-aI5%$mr+`_E&Ln z95~|sJqqeuOZ?Y=bLroE<^3VgkeITutN)-l{A<5BfQ0{NlK{pp7TuAdMU4OYdf->;YWhkvT>)xXH4WI3mzl}2r#?QyeaH|wvNBsGQW)z zLufY6YUv+**s6t-FHtBAr@4n(Um-LMNWSXo6281T-H8FKcq;O74y|rc(Mv0Ru4a=c z{DiC3rvNsi69?s#Ulwcrb#V7TPvH0d@(EGxMV_NZ4I1BQX832DP<2aO&%`9Xj^D?O zTh{50lT((C+%V(Oqetz=o1%KNEuWNO0m{ns`UEPBb<3eWIk>HAoTim#mW+%K4SU zFI7Ijx&ANr_}d2pAl1EbbEUdg+QT2!?=Fl?%42ktL00f*k*s{4!DY#d&PviY9fKq4I6nW9Uzc@z*+B|llI zO4xH~g+(>}*y!k&35p#cUS7k`I3LvuM5M;YS21k>i~ixf(?k!HJXj$_E9emt5=z5a z&P5uZH=MD$^arEHzP-)>V4U|-0<;i3H2nKvVf;9~%scx}{=sv;I_Ib%EN;{azv_f&K?Y|-2tq8BJRIxmhz30^eeNj zienn|*=Eo#9`|yuQbBp#QSy4HM|l$38kJ{*%>)lne4W;|3b@?IWN**4`O`p@Snhlz z?W{cIr&}AH14SkCIVjz75WtWTOPzhuD6V~J{Q7KDoYFNmmBnI(<;@bw(PgjD&(#M}YJRt%br@STbR4fQ(NC#RiwEDf+P=CI zAl#hF6l-#xe5qDC5)uQFi;DFmxeHEa0*th^?2}Y}4@NJb3zKt}bt*8(MI(}UXnx{N zCrkGUC2q01=H_!BsV4ch!-7}e-|A5T%S>XReT8BznC$Ep91A1;iz}ykD-mTeF>=Wp zk{uZY@+!gco^)PYTicPKn)KrdKQ!%b$m7WTIxsMmHEfMY zyMVIpT4)T~(kVp#fb!H!P&sR-*H~v7K>vK?P`TEIF5Q9?UlGX)_b22GIdc8(6%8Om zfg!dD$`wHV6HeBPzkRN|2CM{zp~aIt^LUij`ry-zV=laV<>7UqL#pdUvkB11co0rjiuL#!*nr0qUJGb;07+Ot!zFxQaN*~D zR;@U+_t{4vTNsm4{p`CHmj$EaOJeOa^lDyqH4>I*RUytN#y!7k-B|9)a>vXpqp=d1 z<7hG9ipPFnV&RB-nR!x3lk*72v>$Qv7Q+TAF|NXEGTbQHc6pku6HT~LI{!Flx;y8| zTT#=5sJy`rD%udp4RzVzzKiBo)SqVD@QMoaR>nACNu0ST8+%R9b00KVB5Yf~CV6es z*!rbekG1Tie|4L4D1zG285){zr;<_q@tzb;+u=lk4aXT7x0x;tBP2xv2q_h|r;Fwo zYhgX-b)%KwAC>}z;@vQ`SgPLRaL2?X*^hzh0LT?!o%A0bU}c=X zZLu`jx+4(dcoYW6Xh*B;;e!sA-=%FV>#xoYfU=3*IabU4u6R3OdXC9_Gd-!PFKss~ zmn|>^rhZpjY5CQz?>+bb20!u1fQ5supCd)vU;OTQcz*I6*BMt3t#*c5(eGCnbnnzv zpGCBG;CX$Z4Uc4z%{`EFJO|2Du|{B2AvhkziiD2@_W=BN0*VjW^lVoz0}+&S8xyro zK&;viz===lT{F!}Ztl>C&u%Xl1EdDra-VOBvl%iRNb3zCZETVaqvo+CuEf?v4NW&f zY>^+y^jr?GQmiK4EDIyPd+K)iNZ??)-4r0_L(D9onzd zUHC8J8uaC`rnvI^u1pibQvGS{76~kNux0mA<)u2}xjx281JS@`Ow@%zR)MB{IGXZG z#M#%YP+(+$Lzc3PpSQ|Z>vFwyf5qlBa>7Od+MVF$J)rnr5`QcSPA*ZpM2M!X)do5d z<$LvNfdl_g?S-z&x)Gp$d zXQ}V@9Z+{Hd48=3e!d>E?D8FF%Hk9}+wEVx5qQfX7W(FE@W3zE`3+nZ)00zON zY6Oi>_v8h5tt$6C`_hwLHc+;D$Nl+^Mhp^D)OE&3CEMwncN`bAZQi}qa{&wR{s>EH z;&$Ud89l0Ax9VTOE3e*r7#qOn1q>yiX0&>(CvDrWG#M?=`fQI~o^(7xtPSQ4bDgMA z0)@-MD_@<~aUCHbCxn6O9}x8c`x{6ouhje<8ac|RSbCeXMC?p)7uSy4jNVBEzIG7g zqD+W)0Er0a<{16{bzsc&sDB)C0~;tLwEW>l*m4AR>r;>7V#||;db?9z`;d%3Mhc?X;Aj#Att>ncut+yqiy=|*6rp+4A04O6-J&TCozhRl%5 zzl^4jq$_lNndW}Ud4^Iklhq286E1&NiPLFD_j-(l3jrpyzu37LA~#lW!)q;pSZcRA zuw9nk-g7O!nGpc3ALtl%PiEvbOQ>9H*25x!>N@1g2folcrnOk0t2UPcEW>~Q@x%~b zh0=MfeAzjU9~5*B`c~Vg0LQlY!QSsiRRL!4F6{?;NEQwL?uNWgOK(bch+Zq=9M08IMs{mQLR5pFItQ0b$#0rwhpitwI&f*ky=S*!=SlPoTrgKsU2 zh`Xyh2*;{ibT4IQDc|-ZmJPJ)@+b87cLgRqNp~*ZGI7sRJ#m8Dwj0RwxNia@$foV# z;<{0)YTQ{KWF_n!$~exy#KD7zyRpmzC9R zp+cRg?fSt^JJat0GMPXNMp^k-*7sI253RAwbzi`Wi!3dQ==UFn#9k6E=>UjUFjBoZ zHf|Q(KZ$sVe>0TX-<8?#LaeL^k9zg$U2lo&HG-J1n9j;NO_`GqqR^EEN&$Elrn=iy zpJ-*PfC65L-1Im(IlJCW*!TBIVB_}tlHeP&^!5F-q!rE`kS!!{Kb>@o$1eZ zq=wYzeoh5@!g_Y8Js@Rvb!woIL~d%-oGMZXe5uCGC1=-mzd{-^h;*$?{gmbWWJ5Tj zU59%X1`z2%6>bij=Dh{b_hXI3_Qy;?VWz2yqvPIdttLi&Lz3J#Z5y9DRGy_~6e0_8 zOjN+;3rvj&-dTtFGfU);amo_2cKC?!1Fg1qRy+aKF>s9d{c7)LRcJ4EF!0J4di{~j z_lGX3a!zCezJf`CeL-0`R%u}rS(N{9Oc=2-B?#Dd8S5tUYRc?cSUI0=qGy#CFz;l8 z#=n(eWFEYSna|~3k{^(lU!nvSmBkSi=S8IL`sFTdER-&14dkd(?}Nv#0wr-$0BOzS zXWr7Ab}8viJW_aiBAhx`p^l4@ZI>o)RU$p9N?z0T*i>jtKVIRCbrYXy0ppW}`Euj) zRz@-wc>V+#Rq_Kqn`YM?L0+l6`P4Fe3q|k)sbPfa-*+DCNXn-_k6Qe2IWzhKFve?fEhJ)32TzmKU`JyHB==JxG6&#h&1| zQsr#^AnL6c+-RrfjJUmk->AVOy<28@Cw&2oQ=9+{d0{=S=z_H?B>FE1yr=;8LC83# z2qftgXR|xWO{D{%s-wF^9ymU@5jg95%ysUrQyJi?bv*-D^fS?OaLnBvsSQ4?|37p! zsZ>3|71%&way|C_=GO1inHJS?AlPJ^yOKa;fVNp>{u^cN%9LoVM*d3{4d}NZ(_Qc%+yLOYJ{!RU) zBoaRmP1)TEn5;~5$}519Q}ae3&U^Ye5TU#ADS%a*nN2I|(MtuH?)jBI zqNVcX=mEt6`U*w2wWObQTey+~@M93uqi?@MjFg&i)wTJwIa}WQ=E}i=?u!uq`FTohTqai=6Htz3^5+ zx}m?3d7#XmR5uew=L4>o6mfEzXy%oE^hFhSq1uOlT;0PZW$OzJnLNe4329^kA0L@c zC(cS1&$b1DE(~=NE6ssNXJcH_&-)jmjU&5a(ceR~ z!9cLea4qd1R=M&Wp+D`j6@*k?h}gil>wX~u z>SG5~o6I3+-zBK;o@&E@?$d9T3b2(-)$*THQUU>9$7wjeP|B{&SaxfaDv!Mx4<4g{ zAGNM;IQGGC@0OF}ycdtVzpGdk5yN)$w*#2;e}fglSKkyae!^XZU&lL@NUOY#stZ>= z$J08Pc-UI@i{4m7MyLp*6UTRM^w7(_JKXce@k}vCynhRC`r!is1#UBt1{@T6nYzNn z%$L5*HX#o{A#Rm{4*=#nvX}9I$F%Wzpn6^gtp;O|w)1v*s{k7pa-;`vf_>C}8^xi( zV{-TD$v*itnVkvRAuJI~k$O${FW6|PCL^*6yXEZ*ub)ZRm6<3}9;CSLzqVwGL{`FO z0CRe6N#5RTQJ@diX==)+-)^BmIzOP-{wXqG7kyp4>L*oAk`OU#L1`=5W-2zMT0wEK zXlW^cUo!fx%RwajQ60t0fnsIP(_~;i zb+!QHKLW5Ujvcf;@})CtQIyO5Be>&K-poapYs+MgICF{;>D*nkudKenFld=fUvdiQ zqj#PjsjD|^`(@MpnHgvxY&*-vxaAV_uiUB5y&a=U*z|y&)m^IysYji+ene3H)X%?+ zdXa28 zzDrK_SNrjEK=cox&yT-R)heVKPi$T9FaC#D(C_s5e-Qyb5~`;DaVE+JJPLZ|khqMT>KbY;Y4CA?dcz9XMeT#eqJXIN)mQ@qws$Q zpkjd)r1JjlLn0BNvei_zC+AtY^hQgekwg@~&u!~%R0TC8FR^@e&(^?4dQI|e#t%Vz z&+!UyvB0#i{}fp3^iyCow^alFO^nUG#HkXytM6NF4{J-oX3y=t&3NUC;|YTo9pTM! zwAkZ{XUlx|y_lmX*U!uN zzqs#jWR4JZDqmme&bQO=$TXGZIB#}@FzDj&ZY416>&uh0_wn)Zi_kaB2T!Q_?xLe- z-1|4ah>vDs+^DGIbeWz1bb8%Dxhn(2X|(;7t+n{pC)>_k&-)TlYZKVH8=uyi6=@@_ zXvpey`faDm2`SJ_OsIM9&ORo=n^^+9Mh63+xkdp7u+Vg91R+dGzk>fd_;y zll^Jx`GYCeW2Qpv|G*RYs!FpQF{IGk`}#PK9QmMz2*>LN#~eW$hHIc0;8*jKweM|x z)VMfP;Mw}#G)2y0+v%3EaU?6%;Ya{0HxIgT@Ta?Z6G?c~(^Xva3b*3?P&f7(;nCok zD)M~j{y^;**}Bh=xB+PF`FDT!+V5;8Jl$6n3tF;?z!)EA7t{`JYb(8Y-vul6#(8U# z@ctb4S3*G}^46U@Zw7^87>KT}cJ>Kv7@nILqmgWyvTd~h1}HI`^0>w*hgIe#J*~2sU~IL9p3=5k9c#R z+7bLg>3Esbz(%Tp8IM5EM#Ht+5lw)nGTvQmr#~iW{r4W>|9j-rt9~CJUj~{cfApE+ zZoF5^B7QAs9Cxq9w{l&G;N1OEl=BLJ@D|-}BxI*vc=6)JJx%xrON2&^#;uoE&O5oC zv1*hYyH#1@jpm5>TP5u09nk~PAMN4hG$i0w-%xENqC6Io?q2k%o_PRBUVD6Hf1b2` z_X*+LZPPL*M3%6U^I-lZ8K?eZH{gfA8eyDbXP1+&kN0j|uk8{R3whluU@BW8`1h*= z-(7z8hr7!?^Hi~`4%n02O{=4k3$1q81FcE=0mALl&|W!-u_zBj>sR4r=d8QjB1V}Z zACxWuO^y;zz|AYYt-WHYdEPbY-Q|EP6HDXOc$UlQD%Si@ENH5e-{Z&hen|4FfR^XV zx`$QI3%O!vjBQIiGJMMG(F_mMGp2>FntAsIN|)_S1@#ZPPKf_BCSrIsbPm*3DyYp> zr%cU%{(xPuF4?i+-orPLC%fu`Q9Qr_Z>=y*$#3TWXHMyHdJT#Mu8fzimwo*^p8Ki0-qkI%>u%T$XkmK9NLR`n`p9$F?77Ajl75Xe{ZU?8~={JmKc#W&Vkk&sBQWpj`mybb>rFAZ;jbNxMNz;_>D zO7XlHsNL&z{_n6ZzcSUPr~sy$3VIx0ZY1`1Jimjwl`8k{y;DIi!kKY8e_G%F)tdqL zAou_@q7(g`^fmvMZy30IS6BB~(*Wuqk+E|~B?A!`nk*lh&14ydqS^G0m-u=ZT{5Xq z;F7UB21Z2{_C}jtGA~vE#?5F_C^Erd1cL zza=MiVsbX%_W{!p0l`!Lb?Xx&5q*YM}hpOD-uX@tz8u0d@C{YzTTn8YXPu z2%YfVx|0U_pQ37i66$%Y1+1?F61vy1-rI~k(1+}t-e5P|WF3o$cFH508)qQZk_Ji15^+ISX{DTvqvZ~k z{ZqubJ(OhM#f9xbFL>;r0pAts{MpF_15-Xw$|Nnah?4K;8y1TrP#zY;A8t&|DO2tl z)3&q4TxP-x!!$%m{)wa!9q4%Z*DcI9OuG8i328@L|1Duiker9T!O5v-KZP4V4KlrW z@d8Y&RCUo}=t)42oFIKaOKO3weo)KXOWs<+$UAWpH=k!`XTN^-?3q7yAB(w812rNj z9kygSm_K4?3)!I`0GpU`D5w?n`zvLwT0sl{!2Mg{FIXVq=aYGkvMW*z>!@GzT$Zqf z;U7PK6zYTFp1I|k&WV7>6)9YwCJ=@-r=C5Nl0&<(F3EU360IA7a-;R8RV&;ga4 z*&yvmxN6K$M5BxRH0Gx|$Jw3jN3rcMxIywdmxFubjSdAY}Q>b}sMb0-$kn*%<|Wrlr6Mua+6eb2P+ zoaPl?>gk;vlS=KxC)DBvGe{z7{guC0<=LOQ;g!9I4uKuoo}%BLG2*@mwgCb~qRi`l zwP)=xdLQ7#aQ~~QZ(7^{gR7}F;Z@(MrIX(S$v`1TuC1V92{fLEjSFpn_N6#>?YlMxILV`i1xViiE zo~ciJ*l%Oh!cWHVZ}e&)(^nc^vc9p3yzhF9gQH2-CgokUj`9?B8;v#N1{{s|NfMER zdMzniOENdtO)8yXn!sdkk8~l9_GNXw24mYEEBflSM2toLjMaK5bEMVkYnr!=F*4%_ zBQgGP+P;X?dS1nd`V}3ninQ^{1>&%!PP#`{qW|?{$BtPc4)e>;Jg@rEY%*EglF}Nj zqlt+;Reyv1B+ssK>WG(;XRS?8m>DT^n(w}5cNcPGnRr|J;FHcopPmm5_3s?`#cdx( zQOq|<8z0@~Xp`ZH8YSl%5`F<$RwfxHx4639*rF3gBjU|75V%L*zlYBT>2)Hu$3;Iv z(1E%AD;-U0Y|5SqIKXax?NC@RzBpJ=s+Dkv0UiA(iHX_=IBJ&db4cMKA;uCPs~=eM zeeF86v2HlUG%sIG=TC~nFwI~!n}$u-mL4_UcgOMda{;D$zI+PaD!$3$9>%`OS1j)P z;;{Jdn+gKl^D#Wtr_gVXp3fQrv_P${YGvR`Tsl_IP7x3j#|-GJ@?yZVJz5zpcOi}w zTSn&0kD+PfDXwODi3eDh`7xA%JP7&@Itg`^G(B~eD8GF6)y*R!S1p@6s-}C}ErA>+ zC21pm<|zcAG*dr*JQGALu_073gzfFqKjm`H!EKiS6;qqbG-hm-%%WNr%ejB`DSzo%4W$sHK2L}*2XA$Rpxl1}$H2sB=Q`O3jyIJQh;+7)v8X@39J zo@{Enl)`p5f&wyVdR*Nxdr4Xd`iru53w~M2At~1t%NDKIb6HS3e$V-Ce~LVZ{ZJuq z%Wul!h1AcLea=(OI{sNWep{0xlG|HIgemTw+f*#J3bFa2`RO>P|eIU$~zxk{ifb7 zGrmdORCuC-_BXkIn~4f2McjzmnG}=J1Nu&g&7ONMgCm^H5NJ*L*Q&8w<24?=lK{TD z>J7LSdN0KpOhJ-cKE8e$`B+G%t6To`YfA*FLqr>a%F!m!UenN_j$Ejg|8- z4)I@oH&4-j0>LHz#sw@77n7mSvwE2CoM>dxr`{TmjUn|9YQ#d9^|qFlaW5=?R*DOp z2fkfoi-y)3mf5<5_$)3M)_OW^E{qGm{$heOCGR~vNys#T8a??fOJnI!V*p(d(sq-z$!SBxU zzd^!hdM}8Ggb7R+Vn4&C;@Tcqwtf%5gn+g)?ccbDm78^9kAZEpqnV01+s#8F!P*p$ z5QiOq%Mbvdu~{Hma_N23(wq_FuLRO)>s!@dfXuix3C#gttXHiqG7I1;y~1u-yJ>Jk zFyNUQzsJo)a$ESVS8Nn#o99A5_b7HavRjV_@A&21WB{P3JXP^vnSMr|5b4LGfbHzk zyPv18=}lhqf;Fm!ayeIG`Qbb5UOW^G)^sCm1)%Phg%nvSCD`bB%aQe&V!-dSoya$m zbRM&GGc<{~>^3jTY(p-APHr_&25Z&$ zB7_86q>*J9RB~1r63@!|KIfiUZkJ+=PZDK;i6HdCw5?)>4*JdyHr}Xn?!vs=WxP-5j7X`i<38S|Gz>)qm_i(xCC{;`xmK*75?= z(hxEn14Y9US{y+=#(zCBMYDkdULD;bbs-*2)cM>4i^v}5wSV*po^@F+ZczpMUp}U$ zK1^5>V)(vQJPv{!@uAH;HgBQ;!&>c^_Ng~RBdx0HYM8=$>wI69PI78?_61hFh7ccY zvnN*G%b5rK+XJSu8dkeL9&_*0T5CM2a})GK_jRMGD*OJ8jQsZtxLd#kVwBtg>^DY| zOMl$ePU zymkpvuK-g0AMd59+P#H*iP%e*f=(y^{XfIJ*Adh@%|FhFG5P>fn^~-g6&yp`w~S9Q zZoiAv4hjUoxuqRngVq>v)^%ZFVGSf@Yl%~h$K|HLih3&qWFPVrpdgEOh6IMm)!d=^ zRfD4PhTlo+-x&UyVbxP38-m?X?&BPcsOc;=EFGfIoe0*jWiMr*4*YfRnGlIVx4#^mF`=Akf$!fHX#>&pXLpF@Eu8m@A&jDoALLe?F?QAd%9 zuJ`WWUpIf5VF?PUtH~`~3{^*VF_B*~zzbO^lHgjUl7tf162zzv?m~%h!zUb#LK;X{49l z57Hdu^@d2*)g;`Xl|J|)m{m*kZ-mxS3*z&8)CeG?W52V(`k4%m_C6#gK{ z4uQQGPyvLTXcYcq*d3fq8fa$KTU34>42I3N^kzVBf^)547Nyeo3xh#!aGn<`|6`#A zTTG)#(-%g$CzZX%xe@3Y(H>duxAUj&9^C~QlOYnFujTP|64u}1IgXy!?sy41t_oHr zJp%pN#a&92^xatwUhku#nyOr;CP!>iv~JM%v-9!LC`28~P@_$$Afrk=EDtDsD@pkA z2aG6V|C0cLR_I78CNJOB$g$elb2+DHvPwtK&QF>1EWf`1n9u);ui(i15SXxD<}}uK z^vsB(?%lg@@wE>>FWJRH?!PO8!v09euV`E+0*Td1!2elTY;R!W<@&dkMS)FWF9q^^ z_VxsO;T=&wcRbgPm%oLCa?3OgyG&X3reAbfw6kg1p%H9)mY&kwZYaIom`Y0y;fHK( zY)|Z1?_mq)uOIhI^zU`CyD~Bu`r^fo2d3tmQ~*jVb+>#qYL}G}0E5<(to!o}M7bkI zioPNsV4luYQ3G2rXsB&0dE8#|A?Y&6-pToKN6nr4S8Dw){CvQ;$|+Kj)0%UUwgy8m zsA%Y*qi6?myi+n>|- zsB_Gx2XymM?`LYlq#?=jUT`kl5U39MkH24zojxJ%{jeTafx+Ew->KSqIp3dSSx;x- zOyW;bqK(CZ%(;SukNs~v-J(t!IKQUK`jqIMRSHBE9Y~pNF?C&gu@=Ma9HtB*4*gO2 zk)hA9lPcIh-j(fGU76h(zIa|0X|9MZG*bMP3Cb+6Lwx^y`yAR!E@DS|hECbkrj;H3 zPk{Kp>-}Fp39vuf3YRoVg_JMUGDPAj~SB z{6f+%H06+h_{#!|rhBeKbU_z5wyO14JKSJy>+8wM9cMc-jUTBqw@oM38-X|ETmr;g zQ0vuJh=RR5DPi5bxge4IeBoOH`cyL9_Yqn6(xum*0}rJCcm^Q8_FO)74kUA%THl2? zhHzS|Htc78)cQ6+%zgg5ZBLz%l{m**0iJs5xYe9S7=pS15hLfgh^1n$i9Kp;i^>}L zupW*i`@Bbyto_BfA64P&SJo|)lcW{piRd)9EZXF=jjo_ZN(Ey4WD0q@ID1?ef&$* z{_)~r7f0*9t(DfJf-n;vVh-;DxdMjcCp{VU1cfk5fNbniu`qT8-E#o+hiQbpIhvxr zXDq_?h^x%v8?oImiPQSVR)h)~K<>Fcw1_94-i*|wqfCZ6+urVS3w_};QAY3f&V%h_ z7g3!wSx`T|4X-{MXSvvK_eb>>H=O1+fJxjTVz8~aTAzz3gTgg1-zx;{%emkcmz?6g zo>SK4fuK7@`6+Mp_qmMB7^K4@wgi8D6|P9PD*J}}wPt2^30S2XF}K-Z;D~a|y2gB1 z9+85gdOYPnKh<;ImgYpU4J#K?*Q7>hs!LNb%4ngLD1{{;Mn+)3(0L`&n+Lr$O~7lX zg@*+Rl;Gbj%gRPDjWYIS@?3}&<@$;w7s5x4w*Od``~@CbauTH_RZV|EKJ z7>d|%Scn&?pI&#oiv3!qNOGgG%4E%?(5DZq4WA`8$M&!{aiX7GyJWcPJN9Ji^2iov zW71B&ln7;=vkwm0S=?zvf$ePj7c)5INpp=y!-GMmsoD{NSZc%+Xm?bRt>%GNe4&~e2_2Th*Qd9)n+YAQYt zsfq29DcpAEn)UiI*Qqu1)?0At_A?sXcMA#950|eYswq%tvT1?@14r_wl0Vcr3g|(6 z6SgI9yeHFbEa}f~xsbE8-*mxerxu`%7h5t;!=?l^)o*M|Lq)>n@mwcaxujp~AlB2% z@Np?84px^?lHJ?a>KBStCr!COSV zWCYYMYcn~RkC1lBum0hRgqw2I_mMigG%Lv}oMl$x+d)Obc67z`8D?+!&9|TJhB5g@ zCQ9zIK3_}i&>sL7XGOgTawI~=rZXBQQcXA=xIdHTiVz`FebyTI{pG<@J6@S_D)H)4 zVpq#ywIooo-;VbNQ{mjkd)lxV(vOH_* z%~8IYFV)dtIE$m-cwbGDOSVGWIZnt4P~{4moSfWDMxvx;1RoQn&qcqnD`~kX8{y$U z+n1u*9$vo%y@>K&>Kfe8b$;+O{PksZCcxiqz?c@h>UG3R$gs_iTxMGyI6MB{RJitC zWmf>DWv7gg^fBTz$b~2Yw)H?lhPkKHa*Hq?LG8 z7KIx^LVY`F>V$qC32JK6ioyAnM z|9IFj>$)ovE7A&nDFxw{;j%&n@nV)5DFUrmm~%D4c5Syn7mfU}$?l2y5FkD&s@P4j z(HBNa)j&xSkpRilzns_64FIO(r6-@C4NaAGB_?qBZv-J#1NXD$Zfb}`kRq<2zqUN3 zn~bF-5lm+mg=Tio`N?YPWxSjLaZ*Dxs|g_4rtP)JT&n92xcWSHuw`(=aU2)_*K_$l zzbHC?(5f;GP#wMBhK^`ec4;T@i9X(g>%25bJ{+jWjri&t!I&V~h$ zqtV>Z`f6$Y0wIk+QYP>Lky+Z|AZobPMXOas*Q3@UAI$5#?T*=??@pWplo&_)H(t=e z8Ww#yq3L52G+mE-5c(QuOx9;awNhKPMpoFpcZx{Ua=8d(fI)Jat1=_)DFLVlspc_z zCi()qI^o&koc3P87DFXk08Rwvj#LalTyF)O#&)Mm{Vn!&c*-#y1(I$V6e~h#gV%}6 zlF=MjWLzdCT)r^3Gy=2QM<@tf?(G~=Zfa@*G1ZZIViFXgsH!L?SV(RYot#bBIjrdC z9)31lL7~P2AMc6SwFwQL^9oZ1bbzi#G7+G>-d7VR0r^^)Qii5DE<6C@yQ_fkt2hcq7C>6&~~aM13qu%@xGIJ9iKZP5Ovg>zx8!r3x9H z8Ba!@-k(0;Q}UU+hIb8V0q_KAryzkkd<}Z+{Yxy2T&B}#8LoU1QA2p?_+%m>$D`z; z`$);-T?X&XHWSE1VP{McydnCRdiBVxre`mLKi=@%13gmZHKfSi{NAw&yO5Q11awG* z1CmC@Y5%RID19Sm^#bF2pl^29yURIiNq30)6n^>gQHT~1TDet{U?l?;(b==dVQ6A~ zU`;5=lp$wunCWsD1uW?Bp=c{=*bNbn&l9^F!e{Us-vh&E+oM?6l{O7cpU{o$^niKE z_!S0ZVRH_0dx?$G`hkS2CKOKzHg5D)ma&7~HubcmL*=Cu+pv>xs~VkIVF=ASgj-pR zbyI_h6!EaiMo?#$FH>7Ni{|goSHJ?bdjx{<$?h93tpfM42MOFt zT zt3gWWxZ7+;FdHvnd{!UK$QsTR$uX?6vRf=gT|uYAb_D<<@A`5s$lm+0C@flk!PMx6R0>&Drbb5{Gcgbx2ZdYCfdwYLXh4D`J;mO*?3Ba>NJ^2E+{5AY;RbZoQocNKaY7fgYvuM)i7zta4OZUa|`Yp04fA8EZP_PrMHJAZbNIMU= zO}xA|o&8P^Ub(Z8S+)YQJPG?3W|{>9eA-<4v=BO7fF!H|NO$T_AthaN&`PSC2IW)k zO1P4oP^TQ_%l491z3%` zAR5b8{kGoxz;cRb!rGUPg4&jllO~J4TZ?f}jW0|?NbK8}3rTVDc7;;_nl|0bOBcY{*j+NOOXt$BTDh!Y zKM(}^+d!*n<%w=2RMNTs3MFbm)ddU`1(ld_!}n%$U`uhS2W#JzdZ`iCs;KbLkt?5A zxn(j}+M1`VH1EeaMo*9d-^gq*^QyfKD-R=?dA|yk;3*{z`6K-?o9g8H7|XBkZThZM z(P`{Ko=%vXNpj_RR5|xy88Trd2{#l+7~7;?-e1qrE#uoUTvphnZ{dm`oTxCv#F8f4 z7h04dJ|6n;iS)P6!Sq2|^r_EajKmB^q;`4o0vLaf9(&?8=1EC<$3oGN%Qr5UE8HF= zTJAdGw>S1@1^BDet{vD?*Iw((LvTEP49%RG?gGo~Cg;%GPQFPjUlOF2%CAmlADz;G z(0!x2>z1RFH!tLr*#OYqHgmbF# z!Cc4uu&qK{KgE6Y3s#9ZXJ9(cp70!dP7O@4nvAs!3u+ocs)?GBRgJv{jk3UkdDJe& zH^e3dCIb3SB2jP(@=jKu(sO0tqeIDCi?^m6A3`jCnACce5-$r0h4eaNKsmkdX+0ol zr~+J2y>VO>Z*EdgO}YdH3{}Gl$6K4rJ?G4vO4cg%U0lF4#S6ego-fd#U-E~kbFCYQ z)?SqLF=AsNof@DBImOvu={UWDfejOn&c^eH+)zUp1IzW<~Ovu*|S=DsQJ08*tCYlX)3y*j!5$?nuGDE)UoXdUbP34@wCOpQ*6wS&c@Jv0K=-Nxc3V5q`%7_88R(naYMckv zUAVnR^GPWGVwD6NDZwcVRJCZ^D@f!Ujh#7%wKosCLJptR4znKd&`hQ}lED^1CtiTS z9p%sJF`QxqXoBD$Ab=dl3<$1kz3rus+Ik=NSYRu9QsJoiQ6F@6iXwV- zQdrDZ1-l$;T?|xWxhke4AxK7*=$zEoV%L*zSLQGzr>ZP<+SeU_gtau`Au!IrrzP`n zHr=}A@({@<^`p3ek-XLS8%J(mr$t~#V^YGUkP0bi2a#n_NO9zg&;;qG-Do0A4#2az zm3e{G6*XnLQ3wy|Hs~^nQ7vgX&m6tv^#m)~==5KShwoY2xXZNs?!ViM_ZUT5n(kVK zUusRW1U})?kA`bC5F)}Y^_3#nU(jc2uubJ7PwTT%l22H+gz6+}>1p>%RbB@ztX}MHpW^ zdh!)@FXrNJT>Z+0qy_e=luGQq$Gqwnra=QlGVa}I=M_Ch{J=ln6QF2*Dl+Hwvjx%1 z*|(E7pB6gh&IDv>CPmX~wsz9FZP~#X0dG+2+od?(uK%633$B!_$p&JlYujW-y2%tQ z?F^YHpKUy7M9O3yexK7f#b1eyq;Ywc&i5C?-rIb&ByWf|13xxZSE>`t2Ys=1?ljD6 zV&fs`QxcKG51rP}H#`Xj*oBxMa1YmkFK;hrj@8@)tt@G(%Dlu-|4TLQi@&domW6Q` z1=@9e3jxb78+~k&qQ~7$JBp8?{zma8$&hQv0?-E5-E9ZP#Uq;kMc=cVPU<=28cw4uvtWAGW zzSTEMY35#nV0fb)L-!u^S7Bn+Fupa?e9mQ%KBTrGM}et$jnrnLW->$@Bg#e9)Gh4t zMMW{SVhV}@D8o}E=%?8r)}HKikHn#kS(M>qpx-73_wh!EwZAl1zy0CI3DNK;GU6b` zC1sv!mqaMGZ&(tm+KLma8iA7?~g?_*L=$pk^x^k3;ahx~f-h}nP1x0L2XH3G>AH60YBc?@bsvVfe2e8qw37afVD`wEn0Hxh=p z;Pz0uu~0kY8=NF33q~OxS;62FpvcbaC9o1NBrPpHU7xzb@6|k3%@Q&GzF4Py)@9a4 z)e3!PLJ3{>c@KM#reNgDEfje%(fur7J^MAOxA1cSkF7;H$L$D4o&FxT+}uv#_f@d2 z-?aBkv$hbRDUsHu@}xRMcTOGp>r(%x7oP7_j_e)!=u^5`De(Zb1jrMdhCFRvTHUCO z$KBl#(7eo?<5zihVMw8tz)k@@sOIiD*abzbClI2Q{pznlzCg;7f2g)VPyWw%^Z%TW zQ28Es9B{b{=^#PlFp`Cs?cZ)lDGcXmH^_vX#7z`v@c1-Z^km-)l)NB1qDfxR34IOZ zpCmlOFKIYK3JwnbXwZdo86cwH!D({LGs2h0k8~SULjV(I5>)&xhfnXZoLMXZ{^!~; zj^p~ch-i&FcP8i0zG}Ls#>4e^1Zg+a=B%X6wC8W?gWuQ-I1;8H-d6v8;+`5`GJM>( zIfV10enG^%*OL_LP@#?jJ@zVf)k4g@_0#R^oA#sc{9S6V1(NYK`ClAgL;9LSC(0q> zkOtmZyxI9)M%)^hC^4>oiuBeNEDi0?F|nzH?Pp=c5d9gc0dkwVrzuDfwSvszZnxe% zIE9WB^p$8ZF=a`{F@z@P`P!{h=`1&HNIIfPjzN}Hk<7u}qkKnYC_MN}Or;C}c`e&| zFZtZfqk;-Y5p@L7;?=EN?=Fgl1B~A^69eIjF@xXwjb~VNw{@~7-6btP&+hSGzyH7a z0@RhQ#AgQh=VJgTr&r>^+|&M*9_3kK6(K<^zm92vJ+jbcEL0{k&km**EjDvu~#$nu4NsOMPc5OlP%rd#rY&%OOC2`#L1dNWSam z-xIKS1jHpDt7@E+YoV_Q6jgO~bug-4q!5KeirIeuY}W@iG+R!lUlaqi*J3b?z%GR_ zQqM?e_OoIE%);FjrhWUsi3}B6Qchegf`puu5K#^F6$gxh*qU9}XbSs=v?Q(1ENnfc zA5d#yTge;mV4Su2Q-`BsVPSDhU*-lNN=`)ti-v#>G0m6~=kXe9>|1PeU&54O;rHw@p; zPki;>gUj|{l+iPwrU~+1=2TJ*x7Ykg#J-_iJ>mUq%bYO~PxUg}9{*R(3ygJb{q#k8 zW~hL%M_UKTdR9V@z&vDms_7r>-sBTU$7?*_NGSUmbFEf31bQ&UcVa;F{&epDcuKV@ zrh)L+FwYp5+2j&;ZFXXS2u3sBVEih8>~ z!QF@mB-w5AP0JTy8}-{*l%;Xy#ChY#H)!UdGIEtBk<|=v z6yIfI$#6}Z3p&#!zvI*RX}2}u*7nrzUsIZ&?PJ+d_9OC|>%FUTp?=eX zzWv?)5bpv?#^ctto5jH&Q<(@ggqlG!GXn%}RKF zeCveqvYpNMImE`+%Q^%}1Myz2Kk1;J`*k{q8nY9e>+~@K81@*PH15r^?PQ>`RbXIF? zYdib|jNm&?4!r}G8ooQL_C6xw5vH!LZdnHLucns%Z~p9p-LEMT=Bx8tj~;!TcJ&dK zkx_%vHWWRUMsJCU^=P+3Dk`AZoOfx>!zMy{`KO@#{H%2Q*ocUTnK?Z2(9GGeW7 zdrIq_o2mVKXt{c!_qG=Gz@%Vlz)`=E!p4*T^cTeW@1h2AadCXlRav<&T)lAD5>6VZ zkaFt13;bF#Tx6|;%3&?qwIL(HBq!nurJ(gOJMWzmz~61*7)g2i z)|S%OClR!)oDd4ghXjR|5z|-IKRdiNppRp9J;Gm`I4j`;X^;N4NzN0s9YaQzIg;-1 zYHLNsY@k>xA5ApI*ap;i0>cHyAQ`%HkY}a=TSS)`2C#v zW3}I1VK$4j~m^WfT5WkH=v{E51|ZF`MH>q8uE0 zO~nbR`&c&i;5%n*mb>c<#wUWJieFSzI}rH*S;B7=Y?NBaN%$Il83X422)ZFuo+3Ud ziTu2+PG4SjB)yluSr9L^a{T^-2jvb#b1?3*s;sh+;rl-LKKCi}S}?CnNjKl4mKlij zf=gh$8O-uSeIF`T2Ks^3amk~dRs1yAEFx*l!YQJkrM<$U73V$wc7im7=&yO~CgrFL zv24-qCU0>MWZ&CkhS?C(Lz-)~$F$gwZpImxdZJis!Docpg9^q6pWfa+sZnND(+bBI zlk7aY-rlhysPxFf#R;wYdIZm7-ycmwRulThx@&7|gTkW9=lN5pYjH+K#&xzi$3=}Y zr5pxF6w95*uR9r6Zia|$gz(6!2FHjDJT7#-nraF_>o4g_c>0~=|O(u%SD@x8kr%hI{IwB5N12fQh|iq zVF4W@TsoOHK`0Mti{<66h_51F zR?RMO{3Jw(=zC0Tjv-KNK}LGP^k7AmuWt%gQT$+e0+h5~FqDdqL%RL1W_$g4~4*w;ht6 zR8?!AN@9-pqm{=f*u2cV>X4LOw@vMnwh|p;e&$Eps+6)@m+VTk)@i8c{gABP{XMu# z`JCJBukW|GrAKV8cx+t4J!(#vfSaWD{9N1j16dq zSqKzci*tjFLXR%nz$@A58)5O1&hrZrA6|&oZ~A^f#o5pwFMEfQ?S@?t{9Su>f7S{G zlwSD0vJ$a$sS}c)LtLS0#dV(U{Pao1$#p^iR_S(Svn>nK&mvlHzCFeBbqrTG5XbOR zrB5$}o|IfsCb}iuRhA$iE($(`HiwMl8Wum}lFmnhX}H1)3LX1f&YjOXCc72HQCx!? z<%^f_ixAY>HZrR*wGYH-#-=c%6M!4f)H<1$Jmg+U+*zIKO7>BrK1t=pYz4J%w$J~F z7jsI4pHRAa@17o5(bt)TNMwzdu_-wO@9>Q=9qZ}zz@of_Pkq7;9)L*?PhcvvghRLK z!t!%o4fVQxf}xVu9Y`+mP5CY|?kklPyg7)4^eo36T_*F6R+gKAxn^GMJ&RIHjwtOF ztgNTiDh#=}toZ_Pu)O7ftWS;WYr!biZ+_{MKDPGZRm$dGtdFyh z^^7vV|Dy(KNPE{=booXYdBFsz^MLgnkN)S$si`y#(G|y`u^Oj@74gq-up_)Oz#HJE z%6e;bttY;i2KH9OE7~N}WB{3k6;wnqM`ww2Kd2pUxh-DG@);j|-dvtu`$KsY@9VK- zyBvFXaqzP8Cp=JvilG?O-ZnxD|JCdkIyt`}0c-KO&W?cXNDCi>5{bClonqL&oyMk? zC4hb0nzaXp0+pkT8us1@^MqUe1ZMjO#))SlJZ{gZ{#{GGb^#DBPp#Kf>JNrd)g z&JlTGDa=&A<(>losyPHs;g&HNiF62B31F*`>(`$RP%2CuDPc^atN!%r^IJWy@QcuM zjo0G;oCP4NoOdTmXq0Y0@Th+(SJ(+gd#RONt@(@D=dN(=E8hX!94It%0O)|%)70EN zxt^aM$(ruB6*Z@a@|D6kf0>)`rad+hJ#k?^xsDQLFnsDd0)dFzq7YEuJe@8S(ZL2S zM-vdqj8`TN5))-NoNkXlrNbT%vi|m45oKj$L#Somn)^=W!yl6mlI3M&49>z&JZ>O_ z*jQO{$iHG%^WXeI2~I@9YNab+q;*3I3Is&8mFTP25VMuUO;Hm&$~byAXSj?GkBzkr z<=aYn=`VGcSH2<=i414euOnqHv3zq7)n2u!*pQFEQh$K|#6!e^(h8D{TgwWnACFT4 zsnA)m)30W+MgaUK!fJHUaIQ!KUP_OB8$WK8 zQBol7FnIG?Kmg8qAm3f_PcCu$M6T>ycTSrA}=vJ|lC$ zx_}KkO2t1skSOvqRu2i8<#9>^Yx>eyH42#T5!o?>kU?Q~XObMK#F;ZQzrk5kXfbGa z5%=*j^|O9X=9-HlA3mI}h)+sdah5BMt+Cek$tR1T;FiTLLjs5k!?Qpq6 z_=?nN{|_HNyif&&ud42H%17{!D{8#k#3?98AGqxYW_8J?y|ZzT%)i(N$@h1ULq~J3 zqPt7U(b50aSq75X^ox6qK zp&aFAnybfKVb`>ujFonwAHAY2CCPvwXtw%s`=C>WIm%d1$K>;!P_6+XS?3nI_OTA;$ zb8`myekU1T^8Tk9B{~HFFhNROxuq?Q_L1-^#bOU7MMoFDf8Wr8YU=9Rse-xx3oZLM z5s}K;UO}zo*^^fRs?tF{d_0+M$JLF7e$L#M(yn+ecwZDomrQ&rtjL)hp6;)t7_sBpZkT22rP$CqQbC< z;@NRn0xj%9%8n+^=F+g;7cv2?=6V>J1z$LqBsux&-XB4RyyR!ZKH>}xR1#6gFBv)_ zguQlv-ue=%(IeH))g)gqb3(VL=biMyB772Y^p~4m*Ux9`=HLAspPtF5Z)-cxtlInH z&u7c%b4#Q!foZK7{PQ-k9iMwI_F3CDt?S*nBSL;!aFV!f$(|GD_WC`;i02ok`!m6d zDdIProeNdNxGeG9q`oV>yxx@vM4~fpzyL&|d2lb{Me%H$E~l1;MyUn-#}5lG^42LI zKR>_BSjn7umCxZyeCYr#dyGIt1`ANmn;~8X_CvWAdBw$f?-LRXY*PgLMLY-WF`&X9 zLWu@vk`3t!qv5k4*=87N5JF6f5w(-W&2GGeXXVv+T`u$d91zMiI0RS~R!r-1UW<2& zG#rxdDn0<6C*SSZ+1T!zn%04(!Wqvf=B0v&e7{uY8tx^ zhG0+>JC`Jb_@JL}>Jicgb`U3RShm?OKbIks$j9qK<$gAo@0?YMRia#4Xv*{?Iw5=`Oy2} zhim7n0F9*384nBg@LfiB*$&|pU#RM&h?(s8&tWT8W)qO2{RXQbHqIpUhG?nFE-&n6 zmGLy}D?*J?Uvn}6(7{G)e0IYU69|6qCQO-nzU#yT=HGt13xWzbg3yz!bTnB8fZXJz zG+{77i(xq6Ci@GG4Zq%1XPWnZ~i}}!@vVq1Mug0_pe%q_>b`AEm0MeA#%IJ!7 z3HBQT8_4XadFKvcGw%0>39rqeNF7wR!g=?IpU{l|Fk6Z2Ox4x0>lar-`4nPLxjmIW zd$xfuS?blDZzi8$NjK_duN2sMX-|LUIk>fUacd=7nsezag9ya*6O)$jSn9CLtpn-2 zfa$)x@O}*hrx=i%*s7`|R^{gD=f56!{^o)1l_$6=nZ)#lE?JiTjP{Ip5Ub*<@rONd z{pLA2cH*C5f~G|e#pd3a`!9H4tUB3IjLXhi#Er zIqH$B#<*p_t;O=);KtmW-e!rr?A&k`Bq?c>DaodhjZm3!i-vtm19^F%N!hk58Ri+E zmF$0$HR&O0D(bj)Dpqk1uGc07k>OCdlF=@T)~%MUj+cf-gMNLh!7HErajxU#ijob? zEIdk&(gkI^9+awjTsEt?4hEC-1Em^oSSC6k>r&m1N`?iJX1mMsYjIIcLW;x5UhMH6x59Un3e3^DA9>&!90-R5S_b~M8HJtIEfyjuDP&XsBUi; zRVqkKvCySyP=vxy&Sk=D!Ay~mH(Ox_P8 zL?sRF9oV;T-^l7G3VtQ)^=nr(>|&i&zlUZ*_1yfVYqjIUhhSC0=C`6B(v4lb(?cL! z-Kwn(kC%bEZaNWazHtVGN;XJ_3U`K2-xvgZV_fJx-W1G@Od(J{D}O%3sC6d&|0KIrQ*(5Bo|?2)e@d1 z5@YsJE1_b3=`?oq$rr$D9#v6xn|ez3GKzc?nK>HsIlf}IWU{S-7k`g!ft5RkkP6r5iw~|dq&-z{aCztR) zxDFA401it;@7i^mwoC`!bWLpTDFHWP(?HOCjfoQ)85tR^#LL`L)pxm0p&zW5Ke{nD zGqceBK_DYD<6_Ajj`N1d`Cl3$3p~1gMsk?1T`~}%KELtJSFpQlyXwYK9ruPG4LP0L zH$hQ6i7=rpiTJEkT8Z*QM6O8>*4LkhXXT%anIDdFOU}r~HpRxKwghnqA2XeOR)8ES z8&WbU&pya4vfxTrtU_24E5)Rn{O9EO-MXPI$$=FGWu2svCX(g8BS(%bLysOl>|*}< zQYhtGDS=H_cIO0d>oENPq3t`Pn%uf|1yMI3SP)SW(5-X@rT2ghr7KOkh!A@3kRU2z z15`ky7p0dVE%c^`&m(oBRU1O{SNBRQ#{B%!;}5|tUL<2RBQo${5icf?a%0_3PadDJmZZ@ zDSEtJWBT-&vI&)@OqWl|KJUAWBS$&{FFmbK)~FwtMl6n8!R;8n(%X5twZjxtl$_l1 zANYw(D8m~M6k&ELF6M6XhQxH2PeRB-efhi4uK`l{)w9f!o2JXl={%#bP|^b6@q z=>aSh9Jb*0_zK1~d1eT`?p`OXC+O056x80IA!3?KQP4!FOU6>5C@4~M%&KP21|8+$ z;R!&^zSCaRuzl9AQ9ibFPWjA<`vng%;tPpa))3>jE?#U9Oa3Te;{x)BH#JcdGodI5 zeA&oN^G(f#gL|*1|Gt@nPqP0MrYYBbp0%ZHY|JZf(Sd>Q%$rkR$a=+hB(Iv3Jvev- zmhHbT^1yM?zU^Z|f@zw87j!w$Fxn7I&0thi{L4=^M-$ReJq0wl+=iYjDE-~x-eF^`~Vg9#m z()Vm>hMU3gh6a^+3|Xqw0i*UIS{O54`&Ja6m7{OPM7yiwldUYfsmE)0)x?k?Bd%0z@ z3hDBdjOX|M)vrl_J$Pg!0pJSa+Ris50x zHw;rg2<`cH-tVpOk5|qsGCn;mCrwX#@PO69dePo#s7U|FF+L$_QSzCiqM6hECN2;3 zoZ%%~lkoGyrOkWu-kl6^J$>UZ{_^8NCw{iI?ZzCSi}Y*Ux^d%1 zZ@Jq+Nr&NEN@E39Nmu2BRzFLf`(MA@J$`%vyI_w$JJACJ1H_RCCHK1BmIp3w-~H@8 z)*Sz8GvLymwoQM`Es-`Lrwuc)GL~Vo9;Cb5xrF}ZK})7W+1wnE3wD!CAJSYtpjN`D zqklLJRciX7n)jP(xmq$mdGf>-%qs!}CCH45hlfY>`}Y@!ntM!={;|B{rl+oD`zi6( zd;`NzV6whh2F(R4S3s-jDi4oKM{?a==F?XUV#Taaoj*S{=VLgwNfpikWiYi!udaix z;d{1S%lT7l?%wQY&Imvt7U=DwVvj}3?^kfLHD)4*7#MzHvFIK`!Dlx+RO+qCiKSKV znH8TIS?`1Z1?>K!NCJX>mntCT_?cy`YI}15^pnM@0!BtgD5J(hapKT$0Lw3_KQk$@ z1(UF=gd`-^0%4}4u>C}P*I=e7Ux10`W6JH`0#`8o%XR=u0KBS2+$`N3D&7|zT?D~D zeR-66FZAO_X3(&1Q5`Vv(a(>QE?bI?HHuRlU=%W~Ha)`1CosrJbr?)35UDD8E@U7e zDjIoUHcF5Gyz5wFx^anb$nQkAiwzC-z2kp+ExCVdjb?7+`2kX@y~M769xsstbj05# zY{N*a7FOK(QNocqcu)Z#1>3ep2?EN~1K^tAIbKiK)Z9GGG35>9vK-Uq2kIaZ`#CVC zcj#WFV{rfYoT{l;ZxgmdQO+V!T|B~m97`R#1q^~`=&*?yna?d zTT5icLQlAqauKWb&NMflG@Zz%e&6{f<^qS~H%xVx7;ZesG9?Q9^iR|Yfh?*VG} zQ+^x-zy8^JqldPjq9QGdr%EkaEi({3RC!TWu<7M$sqOGx&2s~y?y;be6UGJ6?7AQA zHCZ|e6g$mhR%3h$mfad=-4*%3o8j)=-d6pEQ|w0fkfZMTpg(1eS9G6xb^3~Nf!Bg` zw%z36+XX6nuZjP5UT~35Wg#+7!xGV=7Ut|idYvD6)fF((6YwL)xb=!{I`q=jw%fdD zG@3q;_=2?;0<$NSArZhPcORQ8xcjv0<7vI$!Elin^=M(kHH83gZ@6ostSfFZvM#Y& z;aBzj0Sv|j4zEr6hI_y(I91hsz~$w@d4oP#ZdzTs)_PtT?rKR5;1SCVEEyX zePyk#=FC$wGxp#%MO9Szj)DP%!$=p4RNVDo*i3>Yh+&J!ISCw*{@}qx53gD^EiDm= zZBLQa_KUaodFeov>!+uMD9R9WZAWS~sHkm$`PA??52SPTHt5y%)_X&t(7Bdmct5BV z?Z@(71IBC0`1m7oKJEu{$iy2+nmf$$MgvI0&!6?>-pTc9%g8a1Y{jqC2QzT0J?yX( zeb^ess84z2$~grcj*v+WvMI>=sdgw7RHwWF7p_ZQHEV7=|KRJt?zBBcQrB9hA0QSe z*S!_3eF$_Na-g7Ppv4xu)6vm|aCeo&#xP`NW^&j=65sAvvo;>kR!s=l&z@m6tgn9D zpIO4~GPD}KIXkIhT;*NU`2D+=UyQnf$@L>+QjQ~e_aZaqV^&W96Fbh{+yNFQh54sR zxR)mjKD#Ow#}rxLi2Cp$H6v_6_~P|@L=KUjnX8z-s)5p+b8P81@7*JH)L(2+3GtrA zRrAW!W3i-osHUc7OkHxaqT@r?6u(?oSDp7o#l>LHO`q3U6CKp#+E-x_OuX|5*xSU3 zS-)wG7S05mMtM=1Vjj2{V?8`GoRwxq5-OyUpEV_5+T6?&0z5k{8m>3x?}!G&s}qpr zt?zFBGc@nvwQZlL=i@KX17nl$Bl)67j`dY~alVNX@nt0dXmQhKko@M=9|OB+BAdVA z6a%!Pt9p)HROhMJ!kX`RJQ=~(31wyK&%3XW4Lg&6Tisw#84}Zm!Cyv>AC$d{x_>iP z%BK#ARG)c|?K*P2qXTquNl(*a+S*V}Jo^a*bPOofU@+%QfS0!^3CSt;5Lq-+(043o84Snffo3C{VCIBHHzJsK3%io|p5?`dJLml;^Sva;rrls6SElRf8O2hpuBFwr zeBu(we`e3>4oBA?2nvb5`UP|kC>y?QSgiIErsREFTl&Vq*QBSG70X3ht`-ID+svOX zsftA>eYn`;0)LT`qAWjlUh2w2_k{O#C2L2|9t(ohJu};9i6(z>hA(X1kMv=IVVOdq$PM_RIG+(uoi+MZd(Rg` zGPCc>`+z&kc8nK5-wdU8L%m}TjdYq>*qMBJJxRV+aqMZ_@I6J(XFH7wPWz-b$?zNk z4&qOg4z(r7dXxn1z`^v*?!#NLyB;16z?W1E2BgFKU_zTgzHvHWwhGJ0l#eg%b7chd z=^|xuLUUYCY~+IB7~(-1pb>l(F%wy580D&o`T4U|YY=OlG@}?m_McBTauXw!*#1(3 z5l8Pj4VLsd^P=q%6n#F3g`ao3apckzfsko`y(?#y;dlY2aOm)XxZoKIPSljo#l@ws zK!0@1x|VESb`S0+NEka3uPN{Iz6m-U+$K_`0sMafHt4bb z{TRe{q})x&qP7~0BmMgH=~Ku-I`pf3?U|%MrlzM`GryAKA|t-Dm%}CgQ z*8tQ4o{6s8GzZBLd(Z_H#@C^q_cF_J9^pOIhQw0shpIoo&#&hyZTJ=n8Rn#1=I<00 z!9N`?wJV70vs#qd-seqrkr9BL#$o3qK_lut?i;vdz`GH}9W_fJ$%)d3zkdC}PFSW{ z{PRBFbGpFzo>b?@lOsw*DK;vtMD?E@n24N!Z>3|7*)u?i$#}F*B zc1?+}Cg*_9*xCZ(`XryQpx|x5i{*FZ1YDswa(WMB;I0M&aPOdnhn3^eg+}~#@cjM$TnH)no zb!A4w?9rnXKpC=u9HM6J6_)$^BDjh$KC!lr2~0_r^);;0x_Z^(gu~Ubt(LmA<(uUB zG`UhI0JEDSS>TTrOfd#w^?m6@gQ)YR%2fkq#vTkq38A zoex2YOZMX&gS);Ls@>Obvm-8myq%GcDI4;0=+8;Lz+b&ETV&NDg1d6xId!J9^LVr{ z2Yf_aCggDP^xLSYQ(Q9db@D(BpS>u{qo2pAX4!cHcfR+1D%Ni0mYn{)=$IKxOMr|+Ar=Vh`62mAadJACvqy*2e;=lwq4&Z1*F zLbo(rqnbOAN4#t9e~&*}lxLzsDMpA+wT7!atLE%t=lk)rN~Y3Sx7%DG&waJmGAI}l zQeR8?u82N+u1Du$SD3;8G^eOp_Dc^?dU#jeDW0)2FUuzGgQu_ASmi9M8D{~EZVgd| zov%RKsL%mCtFunB9rG(-HYmWmrSGx>8JXV+4hFWagF$(12}81S?S(RInz3@aE;TfB zx0mz9Dm*!Mk>Wd4c88V6tp4~ALu)vX52LV2zuEM@`Pa%Rf6xJT^+(Vs4YdGcZ&QU4 z)uz~EJlTtRSC$69^}wrPfm80A9hk%plk(AYFtns{uGxWo_66puOrItD#DG^q<#^QviOJE?r1$ z;6;zZ>_-*QdNYz(o2*00DEQBPS}3++24#{W3fbAE;WDv8(kmIo*U03aA1hz9=9I(- zU+`3tZ3>EuizPO4Ev2HCNn^;*eA?LnF3*IE7<`P>bp%vjy)DZh$8Sdo^T#YiV5z1f z;sN_^TB?~`ke1GzI!J53Nd;WGt67t#fF`})0kfNU-iLXPY3kQB)3Zm#Wyknca|Rg zjnLSUd<0KGm;_++0UmEVSHy1LQ<y`^ z5dsn!mqq6L@-GqHVn8!qs#8>mFr*!8plq`tWe^-2n@q zFwjgxPG)E(r~lH;z~H10qw6-}oPuWNT267FwpjpzySY%Fp#Emf_~?X$v|U`QZk5T) z7TaIkpRKnmKv`M_(@W+1A#G>$3mzD`&}i(jP&IY!0b71Ow^%m&GeP4iAmQ)?gg8%q zvUAe=+v33i+-xso{M!-z*ey6XeFlUvX<>nDg`H(mE<-ttY#FvomFq%m=W>8bKI>*E z>fF~DZnVfyVHPynSC$kXk9#rQ;r49xnJ3|Cm1D{X5bP)f!}&~| zzp<@CH$~l1hhtBkJNLLw+GR|L?V4egfo8zcc2A*-Vk|m4sut#48VvuI+wbcv9uTlP z#~}%>7mN+*5j|C7cH9@|SGTcf6@As@PUy*FcKX58k@dwq$ADzUvMO?|svAJB>W(bL z;vQD}#+nB$@!}MsUk^pLD}Xk1_@oqPnJs4`ggNnPyzEi`7pn>HG*|+vMm|3%aYC4hawI5(lqBy_8^qc)Wiv13j`Q4PTgmVl- zq?3;9u}Lz1i$2r`p>*Hp1B^OzOth#*CX7$n`Tr7%Xy|65bllzFK;Hldv%yXz5R3hK zF&$gf!5Acd(GM_R?oT$eIPEOT5*5jgBjrOR5M;+ZSbu_kqR*&b6;}_HwEegCQ62n? zIJ5v)tDFD%LIoHpYYS*wTJ>h|<5&j%67-8feV`3>siWNJ$qeuN!T4pDAhw&PXP`e@ z$5c$bOgblT^J28h&skSGnTfp>kSDVID%Qn$S3ncm)lyq5fqyE6sP_g#&x^p(vZR#)T zxsACXM;f3^`Crj^&d3H90)IexQZ`_Q;Vfj*D5_~!Vgs#DJO>0(-i~ZI>>r2rxJ3VI zK$TxRw2BH-u4874$=vhRoU%bLSk-?jX!-1!T@{CXTd88e&+7L*)2rQH1EfNyT^&a( zGn>*twv{|*ClY8JFm*s%OdSRCeT>U9nnwKykft)NBV91f=2bf*K^Bmjl}&Z2^Ugmz z3BBY3s^`%3z-&j*mO98}T#w186LPM1d2fYtQG$I&t1MCxwOa@lY_3^V2CQtk@Y?7U zLuYJ}_tLKcAW`gkk2pLmyE)>P3t;R#Z6Jc^1*6Cuz7dc#@7f*;5fmqKmam+w`x*aO zM(Qd6($nVbcb|1+OtOBu8oQH8sr~hNx4!7ITKM-2t55SiI4M9<{_&D8jh^D#~};G!p;-AdpJj|6CBPPTICz{H)s>>6$lpm2(a$!$XOl-E-`-yV2UbtyR`5uIDLqZ(2hS(yo)>QX z3H`1XBh=K5lAe_MA6kqKJ&-UtAz~1(O0mGx_Zv3fxU3Mnl&B2R9Z?Aah7`pES52gf zv3LmR^Mg>`b?kfSY=^YD!GN$x@r18c^H$C-QIQ9((5YB5hz0nYcis-6!Iw_~#n7ss zrDG11PhHg%W=Z#6(ajmm32)QKj~{=VVP#>7W?YsJl+g$ENzd0`J!?Za3x~<(4$?Nb zbRKu;_NI6{5fzz9l+Dd7AO$J2`==B{HXsSe^qhq4Yk(q}BjJWqP_p#Ji#un-Zj*%( zg;tv^zB)5Lk}5Cws=HngW3iJ@c)k110g|5Gj*FXdx$A3O@vfe_{+2EP0Ss-=5jl1D zoS**#dIJT}QxEeVoc2nJ!sR`8;W$#1Z8g64_~(Eu@Fzo2>}~*PY5(TGZVZ%QCV;3^ zwkzHsVHhZ*t~ALwS%(79OfZ;kWp@h5HJ~)W!BXf)aF05^N}5CH3D)h*9tsQ$+)cFC z0x0QFKqo~6EG+Hxbf#i+Rcb2dyQjOqxX9wyNnG+yT|8FAw)R{ViFGhtnOC#8Y|1F9&yoyHTH zYqp?Z)v~J&SO!~eL>~z0`*cMg#>&{m9bO|i#OLT0JUO@pYOr06AcmL2XZ5HL8L(&X zIvC){J|K_T&yY`2y01{zkGR+6cQRbBpWVWSj*OUci*9A``s?Vn-{n$fjl^7 zo78MqQ{mrPf2=ppZW1!-(j>muzR?yVgHUNr`d})2m&rXcVj6Z{vUyByHPcdv=fr*6 zIKZs-^gz_^nm_CkWK9dUVqCrF2hFkgEtQ)I^$NPfCC)~(N^IlOi8m!Jpxsz`kh z<&#K*`VI=~k^22IsUdvr2%z?xEj6?dkO*uEHw!61{|GT^dqIgEuTHf%_7RChLWl1~ zzF{?8J1TRJS6W&d#JK)O-;ux`FXLJT1G3`s=jN@|1x8S&DuK#8ja~S$^}B;WX^?L- zvrZ%m_ckBebCCE)>b(p-xxDKB%S%bIP*y`@&&xJ`gFUOeHs%dmFSPmdw@h7NZIBI4 zIuI39q<#6*>25ruy+@G7Y&@eIFq$-6%;`(w9p2*Z#Id$J`1ih*)$ZqE=Sl~HYrAE` z?u3?K-`~G~6rldVy$IJ2 z@NO31LVau2ZmS09wbykYum)7pKc{z6ym+yz$3}>6(0L+_H)I&~BP0TWNSyikLBsmV z)(P9)iiyQQVN|lrd9Q8?rBmPnCPHq8*Wxb&RU2b zSSWxW69A>EqU7F7kbm@$>yy>$tG^CseoY>1lVv$~<~TrJFQB`JhGc~{Y@A}+rjGi{ z9#QsKJOgN+AunG3B$J=#CUIu(xdZJQ%vk<>lO%fn{!}DQ)DmvfxT{_8L(Gqr{-kJH zMdVfvFIO_MWo8W#8en*r9+w+y8V4RVbm!Tzq0MPRT%KP+!0KdK_E}Ff-9`g%`Sco&CKxq(ilVLQ{XTH}Qz;#`tG@j1eUiJ&=9LWYi z{LX&r)RXU2?wth>``)ZzZ+SZJy71(w+NF2!c$&|gdv*pmdI9)=AJ=UWy}c5eNn)eK zyv$<2cJJ#;g>h=S&D0RKRl)dB2awbn0=->X&w6zw^nd?x5zEJ$b3V( z&EcGgi`b)vPo7whc2Q4D+7BvM_*EF!_$St$6VqU14D}>x4rF`hpX2yVs2ATe1gUek z{>5f2dSWy;y2v3c6U{}!*~v7i{ZoJ7^*8+i`M>B7Zq0-w@QoLMhKg~eW5_Vl!K1x~ zuQ%T*-av{0ag$osvKIdmn!KHB-=9^Wk_<~fTNm0IO9IsJSuh@}7YI=JArMH9URHaO zINF1Yo7;xmRqDV2fUoJ#*D5$&X0vaGeoT-&j5#jn@g;T#flx2ITfij?(6n_cQIW2(;49u(!0WjMN(=TR= z3!Jv_pZfOt8Bkt;Evo=%pgIp8d~8*{C2%Eg z@hsNe+q=wL9vZm?C^gv+cq>d>UXHSxN&vaS*}1bqh9cFEib3akZoGlv_8tBEI*%Tu z))u>2lD_$%m2TgPDsBjX+Ov2(Z1;Wf;-!GXmBo@wFvv9-@R#&5G-mD4E6`fEj*J@8 zO7893KQWA88ra2m_zQQ)NJ_rOb!-KSpP%1Qo^-y%DcuW&7D4d{zaQU1wrxqBKm}Ey zLW?BuM>>Y(b*8thJTF*LDTUS~00TnrrM$D?O@Gpy?LrgPQ+gVcm&`I_$;qQ*I?P9@ zcoy{`(p~D)BP~GSKgQ4=bg+mRo|R|8zV2{sO<{0_f^7P6DPV1SSpL+!iHe}n3J!a) z&M7Jqr zIH(dQ`uYg>e-Z|$J-*kkd?46E=l@a$;KsFoeEN??+rCWSB+LCU>c&640B}AMA+ov# z8(yud5dy&r0L~Vc6*OwN*s$s~HWTQ1{fIqnD=_-=`z!z*03xr%@qs<@V|Fvr1Smb9 zDdGm@52~z*33+7&n49&zQLJHH5Ed#FRZv)bcX%Pu@utl&pypB-D%8bGTe?AiTjv1t z8!a$#bN_)&k1nQ79}wAX*fPFyYxRvIYP%#2eGGxk&?2X!G-w{){{rs<=5vc@0J2Q& z*e7@6Ki=V9|4&W-f+zwok^#BjBp79q-qX_~>9^_$Mw{N@+otS|d%rrQWc_qlUy}L5)`Qrc2q>P7j$=%+60PW@u9L9d~WLgMwjKFq19q;AK zt!>i}ZdJH~!>?Oa29OKDayokS%Fn0( z0Z6g6RU-DtU;VyUiIMbe&wzwHsWw^844Afk04mVMs7h}|?RB=4lSE1+B^)A1vo@MxqB=P+C;m$S5{W z-Y59wHbK|g#-<`(X0JH=|MKHp7#9z|f%~O&Y)w9Jw(w4%)B`GMN%!Hy&!Cu|q!Ya2 zDX3KYsU}I5stV9-Oiwf8U%h0tCx4>RWLS#Dd@XG_uBhXj0_i7h6K96>Q@HW$=GvO> zG2s!$P4R{xOxeBfc?pY{$`^cKnHtlA;;Jg~ zammRSw%EoMLJ(S}{~w?FZ-15RxkIJ}Hx4B=-bZE$mt`smL9aEoZN4#e82ZmkD$)O*;TNG0RPBS1zB*8ymZTH zu<(Aow9B`{fOLN!U?1)t9!p-xx&*}F;JM76Q0Sg(kNt-He{2bz9A!ZGAsnRbB9oYW zX+c2HgrLk)09i?X=-D&+3R4kaIG+vbkjlO}-2zkJY|$IMfAv|*)CH;h?sl39`I08I zkQ9K|3uRr}b-YZ+V=@~XZ`{@|$ZHN`^K#B)ee?RYQlgXs^IyGqlS~^Rdr;~Wy)>C3 z<)US9*Y=e^dA{H+b*&quSxzYyw{H1?mzC~_Dd=51ds zHx9ku{a$g{L)O|HLuZ|kR| z)bsB2Y~DhDXX3@x=?cDn&2q|6oTTTRD*9JHJm}Tay1F|0o%bJtEIWY%U`R-)pu`o8 zAtR%tv5Tpxt3)EvG(OT@EBRA?+`{}0HTQAam+Im2eFnOHAH{lU`jA@2wYRTd_d6gI z9I$@)kwcX`sr;ubax=yPX@_p#)+dD>(*6(4_h0jY#xEZ-JtTr<*kn((0O-pa8MBk| z^XHr0Qr(vgxA!}A`3Uo=)2HnLR7n!_n*R}?xYU{YT}@p+<)<3EzMxolZingOP-ISC z-j%A?&=95*EhW3YxU#YpZz2%9K|v7hD!-Wmvw#v_*`aU~q&ZheXo%nND8HZ}X4<{t ziPZ6{7PSdgmAzI524&*OHB3jD^g7B1A5gbGwJu?Nvg%{iop5HY#=qLzdjYj8oGKqx zN)g+40XUv_Vwp(%+hx_~MR^JzE)9qP+?Z_e2<`!-3-+zv7yr`9vYvgM!%V(Hn-1eq znGM!}9{!tH!!LJUC(!|F_LnMxpALuFATWsCPRSgDiEYf(2}^n<7gVR!;VA=&c>4g) z3MR?rxCSvx4{`YCS;j@`N(;q*qbt)1w!-O8n#~C1u2!9xfVeRE6Z3a;{Qd7_Pjb`^ zBt&dDepTAC&B`~I*$MsFQAgPE93(e6%}AOU?`ixLv!FQ?Pi#~ z>ejzl;lH>7U9X4vt?)kuHid?f>)kA9nzdIt+n!`|0g;PB6Txyr&fk2Pk_Zb581s0sOQX?Wvh#r3tfWea|Z^1t$qfaDozgNpkih}9kdJf`)b%$ui< zA0L+-iMiA=TZTCt(7a*~giS=E-K zn;xnKnLKbLehJ$QDehVGCJaTFuX=PJ*?V2HWyBy=kd%9n>NBfs-&Gmcs&Aj;?wK$z zy|h+!VpqPk_2L)Pv13T9aGK3Cd^ybqTt34K?$eFdH)y+%$0;aGduhWs2?~g0jUKg5 z7*f4uif}@H4B>ELaY~Re?19YNv5XkOUSsIPZv2J^F znk;44{ZKW68>nOiK}Y~9xXBXhHiM)l<(J!7)z1*C-oYtXa=MaZ-!(X?KWy z1R-8`TB9(Ew=uR8jl9Mc_F?wTO*wCg3O-eHYb)<9wJ`RWAOJA=FHi963l^o}tH{Y^ z`1BZTVN1}6U%V1E@GF@5mHvMGk=J~0!?x1(uKQ)QTNVN24EtU~t5VBJJ}xk%*C>KL zmpOo}lNr7gQPEL?2EGhnl67~%Xh3iI{j^G1f^)x9^p#vge!J~wO=84?hZk?)5_%pS z+$8H4ibM9D-vF==Or}`_0l0{547zKSxK0S7jf#BUg;1ggQ);*2Emys-&*^H{*;1o~ z4N=^by|X?XPu-;o77}8{oF?9VP_rGmzaHf4O#^TQ5gLtr{+t;DMyEp)vM!5D8+W0M~zWjEEw%WGYAT4o}cg>9h? za-sg^GCSeXv(19dI?kx1B+J~61PvW*1OznzNT2Jykr6-^t_=`5;C}Ve8$W3G{K%*k z7|YuMoA>gpF!kSzjgjbDnRnl=kVANMxmY?T`Oh5EOi}>8-V?!m2MF>lo6qoO>m$Vx zm`yH}N54E>XvSBNnF{f5ApA>nNW+0(4uc`k1ptj_*Gc|Yo$Z(xqNs%RFYkWsURb@1 zQgWGQ0hPHm7JT_8=tDfAdmf7o-E0YLq8Oq{CXrVsKf6UQ-JfN!54^nF}!;eJk--QgJ=p-U> zMA~ui2?i~X_`>$du;i9tJ($|MU75Q?JBX;g2l`#9fGsutZm!6SfAie66oeDEJPBh} z8O90e>Nj({y<;`3(PZKRd-Q!v;~Ewa(zDO@@Z0vrd_To$Vy0W0jDIocM67g4WGfmN zWgHU^_9No7dio9`*6gJ@Y*1*$oj2evRDq-AF2Yn)g3GW$p{z&{nc$7cFA|h0grwz` z;jX<(hFn=BpLQuN$#+Wyw!9rr+WM_jBMBe53tO8oAq~^4Z~Os9@Mes)2ef|uR!JJp zbv!U$gUZNmDHfl2r>(SJ%{7Cn!=~9`gL3C|TNVV_AL9C=7Z?tS$4*PZ_$=(A4Jxa+OJOji7TK}cU z`yc-pT>LPlu&@)<%X~kywTi}@!{QST6<~qd?V+T-94Zd4LY*A!I!{Uy<28noC%l6JPSGtA!;@%cD>!+wjT~3my|`T4xH^=0SjktM_`z`^_^jm75s03Q(IZ3q=%NO_*B_AF(`;Fh~ zh_?1=)0SxpE?EZ%ex0P4ig*-%vqtxQMo7}7o>KSBmh$p}YzUhDo#F6d`@tQhLOS?>xkof$#bdBYCyd8p4WNPy z*FX_9(z3F*)jx?CQoWr#sZP(Asy!?ecyuTHXtYYhc5b?cJ_(uMKD(md9WE6R(sBN_M3~C)OK@oh?qJ? zI2k8fMR5I{A_xbh!O{T$qm`(VV?fF2zrI*---5LVSl8twDOL`p)Vodc%~x_d_n8m^ z$MN%C5~Lxs{>2 zFo;)WzP#tG&I%sH`b@S0UH|Dm>Gk!&6{!P+CS39wpz5f26UMA?R{b|Y#iR!8NJxRJ z?!-k8DH+b>BsDu~&&VkG%y;HWpKmds`{r%Pgmun0^emzkQ;k;5v!e_2ira$+?SUzvlL<&TShPo~`1^?FGhC4$`+wEUIN(sD zE$?pbo8seI#`L)~F}N090d(XG0O0SW@*FLdHx3O6k$r1s;s6R`xxkG=5?-@Z_gw^H z+GuTVL6*4pb`I)EFp#-%Hrk9?{_LD+scxO`y9YLNsD1ytVkfX%MXGF513+j91VIsC zPMj7vR^Qg0hEE-$UNtVc1>0Qf9`R##4Cu?by~N9N{LC3!5TR4Bz-~VCtk%ylqG)x- z#P>R#$(OI^$7&pYnRu==)vS+Ec@~JGwcXPPMLhb?QS3lYZZ6|da=&Gx+V|VKXXZ&j1<1f-we5Hn6~Wvs*%p=y zSNyauwS0Np{+Ay|7?}p%EJgY@qv4Fp;D!S%*-|ev6k%}=@0={}lG>jqVh=%h@M}|FYuy0mOdyeqWK~{arH+&nOYsXWJQC@u}%r56y3dtco=}2S%}SmQP1$$CL`1-o^}d+!9?H zP+gzzzs~|y{8&MrP)(BS>Q!^90$1Q}6IOnv4Y92np|IvrZZ@slU6X`ET=uuRdKaPqf>2*9YZFSFBiq zK1h3)YLqhEZ}iYXDMRnotIjZK(=Q7M&aAby=Q*ab58!ZkS=iq7Qm8w@o0{@=yNME9 zl5K`#U6`I`DiYHisEAU6w$Gk;6E4K$=>hR2jOo$VTUE}1a1Lcbm#&gUjgdW+k?>7N zi~tKKsbXokz{!Dpm1KKkaTni84&Nxss!8;rO7OoTL|P^f71k~sW?8EoFntjcGF+LE zkYF`D!hZ1ZS}{QVx7mdaO8R#B+EtX#RyH;nEMwvqJ-nl zll;}!l*Z)CyI!1#>rR1p5!J@(niPPv^QT%G{%9!|F$&sEt*cwHfmLT68umI`3te9eB>d3;`Zqqn4!o$W5eTI3UOSYQ^L`oA3?Nq090Ls(^)Gy-N z@v@Y3(qQ>RC`-p378>>sP#rZbn6tengCe!8K(~ct?$jiTvg^B1YTq=ZQ`cox`+;$O zVT7__6Re^_A^``-SV=W}kxNh<%N0+HaDm1eZFpzh$f_SnEQ|Fa-Dl{>Tx-*Uv6f>)N3Pc{XjfWDRvK7wP2h9QRV8;sCj5e z=+I>F$%TB-E3v~FY-Jo~Ik}k5Xk}Vw`6crg!`i4DPO)-{R8Q}es{#VdElrWXAZ(}8tI zU(Q)jsC(VuDJewHv>kaFxk!GGY|kD=F9ch+;}u?XanMgLeVWv{95 z);2w;lOIeANtU`c|72rzZrn;sfY)UNO3wuZV8B(NfM0@%%nPz@OMzZp>6TzQ8YUqP z{5<*(A2`jEV*Pd|NuBNV8E%79Lbw9Q&krqNRP(PO53(Qclg@S+ASQTScayr}jEW#8 zmP*D-9VJww5=W5dJtQ2Q3aTGJHHS}YVn_pRq8|N|=Ytsa3fX1{Y61*73&=>hc9T6pK^&cm**`~I8Rs$Qck$k~R_WW51G zrf?TyJElZ-h;7*il=lHi5Au!Ko0<)f@u_2h3ugBHCExH{)T>F}9z~!BC2u|;k{JE5 z$gC&mvo*#dU|KdLg#8e`|LC}>gmYBZ^0F)E7#Ur~qoWHQ;nJE-8hTXvPA6?Y)3_Xbo2<7G#+Ej4J1wRv24^pZ}tt8|mqsNgBpEI?DlF zGL^bsGnF=p%AWGr`v|LlmCL8;f-LHOl9uE_8gesgaZwDGb`7}A5q;6yaBkQ*Pvut8+Y%^2iG_lVX+=@|d|VL?6??s?WEL1SbS$b03{lBAb5X&^@2bO=S$8**31pSt!Iu;)&1@3Sp zU3W2Hd*we%2fgl2^XH8Z^sjMWm!pv*MS+Ik-Kf)Mvx;GsUF0qK%rCJ<{^MO7ylspT^UubCgn{bHtdX1wsk7xuG8DoEDaW}*^XZG47c4|JiG zE+$Jiv_EOH2lg?>BIS~5@u~Yt8o?-n@}7G}<4E8y8=@xfs=RCQ=BXD|?40r2;Sj}e@t6Cn7o_ylFgUn{Q1Df36L^h1`q~dqakS`_<)e` z^RhXh4f8WkcKDkW0O1=?adCMyx~WOU6*iQV9LzakVm5)I)#-(Eck~9Yc{cTDIpaLi zw!u_VZ~8NBxi>;yv3Y&T|6CszR<)=f=om$xaNtf5ls!4w=oju3xoc}IrAiSljW4UH_EGPRSPr>4|??KK-$GC$b-=0#WFVtOAWq+Q# z(A@le=f}yQk=#t&VsB7n!Tno0?^tn5)Jg6iKmWL(Gjm8Nw7Xx1uy5ajC?ekci(sSE%%EkH zXz@$%h|B_{28j?Env^gNeeuFK$(=a9;5C=dAusQ`v)Xtct*N9iM7ZKfTg`PzG%H@n z)>?{-lY@m1IQF{?I&zo-m#sF?gt}8aTjakkgi0HKV~m8qWm%Jd57((8XUsR6o7Lb6 zo%r)GY3rB$E+fBtlp%=n% zG4#i}Z&RLZj*&Rtw}U@VdLktAM(;?!Tz_p$9|~ zrnS+@w@Ib|e{wG0wudP^`3!Db7)$lMdtU*YMQh2{qH`Y@-;iFCxSf;UW+-U4bl7Wd z#2l~#Z6|(Dw`lx1Ij#~r`mHS_fbftDcrydBjrDnjDFzDr{A`y-2*Z)K#h+$Hppeqy zQ@F;@PkzTJe}%$ox>se^g{Sq|jCuv9vWtog=6h|lT=t*PU3yeB6UaRay|FmopPw&u zy=!*_BX_{>ipgzyLLK=f$a8;}FJI{Q%cR@&9eet-|<;y=RP{;|mIalIapg-94h<$NjA3A|?^u=q7k;itJi(zX!0lHcM*oARQ>UnDDWeb6lQlNC((_ltE6(;Y!WDv~OOP;K5imQ6` z8WyMm58j1^Vg07*G7~QhE&Q^7J2d@T!vX~$$;qS@3p^FUup`6yZ3!@J{Fix*Fh>Sh zP=}6T7O5#TP3fM4^l*J0n87!qfBr8v$8LS9Y?;~yn&C!6L)>qwcKky9$(72%!NEzD zzxlx^rY2FCJNHz3eh_wSz9%<+fEbhi@XI|cT5ktl)A!Zw;O!{U%%5-A_4#WvG_EBx zE;#gmO)W|!Cn|V-61o*-xU?Z7f2TA@A9yNV?f5Kd(Ge$ALjK%YC#VZGep{Ar;;Z;} zua-&sT(^Hk7cA4~k?QV9qSj<}oP^z1CLjgsY`6&;)v>#md6+h2U3Hh}-pDxl_SJH& z^q*-78YWF|PH4TiIHWxp9b=J4hHUHIRH8fpo@>$G7tDg`=;lX@bAi9w6Kb@_GbZ^G zr|jKgt8^zYPoQPo)+PfmD%WSnjQVn#eVZp4{`v51d5V~!!7H94lW`8blRNuJ#NeC;q zQrd>`w;T&ZxG~Z`2ULaHSit^dKYu>2N!?ILT-c;RMMcd~$8c%5WNmF?e_tuMSfzg2 zeOE|8hdNwgvt(+Q4&WCOBO~KCPW-3-P`SN*(SP0=fr5|3i1aX7I^tqfl#}r{_prof z;N?;BWXK)x98KqcSMewN-VHk^wY(ms4ujXot$-O4O&10V%yd^)+**Hi=-zeJ$tKv~ zbCY#i;O>cVI;}yAr*%QUCd&6b^7n6_W&GXghs8Ewz_uDx@z%iSP~PD%rqm%bD@%ZC z&bR1-DRUB|0b4NuHeCa9g)BSW;tvJr7{#P6k_PvFHpMuZ{Te4`Gte57`aQH1RKVzX zF4@3aGrGpt-;z<2Xg> z1{jP=(!X`<1uK`_SJAqy2ce1UA=j^8AFd0k1Ek1Y5U_!>t=hKZr+_k=(X!Is*_?Trcb6kA>EHDYO@z&$(-WfiBf8u#zore#zK;1T|T&wc@aJKVk zWh)vz5bsi(4chZSTx+JLp#e-mc`cVVAUC-Bhk-)@PB?aq3yI8(w%zAg< zjr*_(2)I)CIz@$r+wg^)Cr|zvDfBR1tzEP>s+dn3UChs2=aYmux3 zJ9X}y{d1~@40fz0pwxfe{DtCH z*DvkoodrX_JT;m;?OSOP*z~5)e?FEYvB`^ly^*LbAS>Hc0iWZ@oS34_QE*8*V4N}h zn<&@6E`z;2CdHAF;m{$!#tl#sWV%f@3j)>;VElmnlnC5R^MF$~uy+RC8^o{pfDT+| z>P_?Yx|v3WeWvI2giAWUn+IupaA_k9l2DkOu5KuxprDZ*psPI(1Jriy9G=Aee)2`8 zTdJzLc0C!xg_h4*=Hh{2|E{_LuqQeH4{hHa)^wWhJ0hYes3W6@2sKog@-pKlqz3^y5R387JfSn47cl8V4hB z>d>GEvUgC@CBTIPU=bGBI&TA=H-Os{#K25yH?Tqguhh)j1tWF9S)&aZqpgFVh{(9v zBVFG#&hQUjVX`%>+Sf_4oYn~^re*E9==?*U;(V+18}9f!v|YSq@WO9qt=5wOmGV*t z`mKlZPIJC$2Dav^Eg2`*FlL-xT-L8$`@F91%(Lf~Y9omc9&A(#tisfBz)^y0Hm3j2?8r)M}VKXAf6iZG3f?$ z>&NNogwLOUy_kEs75Dq^zhAWg`Tp?OyRD8z-p}6J5t4`72uf3%1sBHZ&*mi4c&d57A-?x zfYY1hG8xg|J&}PS!8gUwhz)-OHUgEFfq^|8_BTT28o$ql)4qf!FAD?fhu+3>WJ?m3r>|W7}iUbRQ!$Qv2AJQ=*Pf+L~Tl4Ln9kV=H&pV zIw6+ZmWz;p;qvbQQkhVC_Sau+`m17HtG?0u+UAnt%2lhd;KdG@cy6H~EWMO_>i0{* zPiEU`3)f(1nU7eq{DsF|Ok~huV)p$umP0cwVQ4Cl) zsfAJUGQ#-|yFKRhoC!!(Uf$eWi23%j@m% zq@Hc0P+&dnm}vIfnRkTCM*XKQA-~D{1Po5y?_aYgdmNM24gb6yfR2WafAxs+Z*}MM zcPjyUZ63G^jHhYZXTNlIe#u)+y0u#CN$$OOBZYK)q~R(NxMGxYe>{ei{J2Q^d*EKF8rlE%dF1~fF;qF|qQpM)x%Jp%|^V4IW zz5(kY-Ls_Nw#Onrp!+bYk5aW?6P5W|>wR*_rModRUWV#u;j2A>hjs2;LaLF)f6)V2 z9TSGOlaqxhvzEBD;ORQxe&KOCFu$$@#ce$oYWFmY^5GGgjPdDy_>O`W0u!4H0Refz z_2)dXi~%Ab3i?=eWTu)1?>5Fqdzl7s+Zu~J!i^8Qsfw>`Ud-QI5*zvAn8h*GKo zqU~L4Y?R=A6wY7DQ4VY;mSu1g*A&cCi1lt*=`2w*S z>JzVL`$7q3Xy>Nd7^AZzTtR}922izeGoB9c;SJVNe`o z`hK8@+t8=1853TJ=F9|bOpkVJ&_`Lrj5FCn!}yqhVma{Cwp3PBzA1=zgkbZ@<*=-L zy=e%)Z4rW--qbGE^z16>)sg-j{ng&;f3$!N-z{;^K%@iaNmlmd?Nxen!23PYLfha> zNS7Rxk-%N@xaeNUWF8nNe{HyoJg>GN5!B^6_1F^@i38eg z#a2M><-&`C_Rrn}qk21f>H%KLx%2dseGU(OJkpiftJbV4sPEr-X6nYrRA%WTV2F|d z1&ZcCk|k+M7Ua|Q!9E>(_-C*RN$btDN`A33Exa2B0TE=iRwoepUz%j@o(53knGszm zLNsP34pf-~rNd{;!iG8$uVT(TcLE$ozopX;AGUeUuPK-TST%&88@q_7ogZ&qyz6qA zWRI@lX=P;;)_9F}%-@IO|CV*}Kbzdg+ar&;8vyz+P)lbrU1+TUM|Cl@)Sn&9wVHRT z+Kd&7ce%Q{+7pVqL=)qlgParS)fFt7HP9d9vLmojDr z0S}Xtxi>yr6>SZ4Bj<6>_!|$9?T;S)1rbzxh#Pk14QJ7LI^T!nRn43-3+|X&pEeDI z-`f3Ydm4t)`1y6E)sN%OewR*)*?g!f4L8|g)0*qRg8DF3phgo)+jnMp)HDrxF^dX) z3>jE}X6K2~0xG_37?AG!1J{pLCc=i(-VtQHE!3a%1^QgbVLclFepw_6tz5Zsrgg**cnAN8;&**9>?=*}1PFGpvkqUj z=p9}s1T92Dow&(Ww}r%9mL}N%FpCV9{D+3b2LU#~0sX?UV^G3=%jVrb{q!@#O!gEg z6ps}44wD3H@?6ZspN=nb8=4gB*b)Kh1DXL_bT|Vr__muAbi3T8DyI46c6tyqwfGP> z_HFy&X;_$Vt$EC|>1UaD5u%^Kc z`EjYFarC0uqc}|L)&4$`-F^^k=iD7b=A06zO&2x~iOwTZ4^M{6JE{}NsAQ;zD=C9)tXs?iNE=BV7&zcPXYu zz;?!S7m>&y_L~bwWH9VKMnF?I`tMMlGi%fbKz~qBX4|-jjBDaGJ=8IHSV7ySB&|Xgh%F1M zk~8RFLE)<3fF3(@59K|b?03(!W1D%iqE_>nB-!H!X6sj=T<->OY^yz}3kxiN-iH|=tG&2;JC-o4^ zA*%yJ3Qs1|UAYbi{l+d@4srb!{k1y|8@j6nngDR+;=NPVn!^A1^Kr&@v9Q$ z8yE$3?WACz}7CHrVA0|idmbYa@6`aU{b1e8f&{F3C4|kU~@g{$JxV7wE2NDH9c!VRghtvC0 z0Z{Tb;{+hZQ(q0$C$&rJId$h5oxPH*{5Bcnrr|VTc-JAEZs6{USa`Yp6i8%5Kv3{WkF@2yD&~l7cBnMm z7*DwLusE~bD`bnKC-w~V*fA~E2QO69Br)YZ?#s*9#&!Cj99)FeSf0@&bQtc;26Vwi zHeq+Tq(ZGbf_$Q2^%$NcD6ZG1&BWkRWE3q4z^WG;Tbqefz;eqQ4H%FHTcZ|hh-)-h zhCX$3u9j(tmY+vzZ9D(y8IwMa5m}*SIkPmdQygNX;umQM0I=c3nM|F+pH92; zskGAH9#MvSN*{bPR_nRSsyXp*AhjBj%#t4_JaY~4lRH)IUB6+&o;v#h2ZFDUtGhdQ zqW9&pk4qw#xITT9{nf?#1PcISI5khsk2-WdZO&qRXqC+iAEXyN1hgMU2c{rCH(7rC zTyp9DqnK0%@5<87BJbadcmT5VzWOW(_rYr8iD_vs9zW*6cv`ID0w$l};8%JMEJSXf z3GII0n~rFlEq=pVmN@ck7}nNV$Yry~zuZtrYI@`J(p*~r>;ON;fm?hQOvb9Y!Cmu& z>J7`bQRSVhfN^D7;RT~=k7{a( zwV$T5`$q+~z&nP6>Hh_k99KXGJXXl$Tv}LS%gtZ1bat`c;ZS9;_(KVKY>2UMSEKR_ z3D%l(F(J%yIyreuIY`!vltY4hUD9j@C3nFUYaSWH54fx2ZYrx2-~gMT6=1(45J0Fu z1Vzp!5GSJ%z$FUG@@sVxR9r`tU|{ot=Bm z0B@M-Md1^GadhA6eyt7fKp2LFUd%WVTNtgHno6lZ)+(}`BN+SXU0&gsaiY+$Cb9IZ z_pAO*3MUPWQ-a_j)f9(&A4j^FS%K1E=}#<5^)je=@odTSWOE%6FC^_SvI&SqqbWc( z8VvwPdFDl)*f{gxAO+c(faNlPPH%w$DU>E{HXICz###$VC$NXkfIR*N(1YEg6slvB z-*A0PF8WcXBS|^OuHQ3WSzl8>+oC1-Nng;iRMh1Htcp(bHVkE;MX$WduUDqUE3Y{7 z>l*}#*Hy}5%U;F*hG2G3kCq=zJHYO*X1?`gbuGC)^s%lN1m(7pJopGl)CFb^ouAD_ z5$Q2D>8Isyb=>NTL{AClwOCy)U8i*uq2YIOjWzR#^jE)~=XnxfuQ~nv;k0T191OAz zi`(%=Fj=i_14aj(6m+~S6;V|Q%Cd_v?Xc1?A&6G@6gHbL{l=CbRLv<%6mB+bUWzqm z02(P6A6yAZhK-HSjO*=lIC%bk!LAU1ru9y+-|S$h*T7zc(|lc31|}~(9#!+rLW`Q3 z-3F1UOcjm8(x=0CSn4al5dZv+ci=UOdr9bVT{;gBzT?&~e-2<;vo9C!DWX~>zq~^G z<=&Gw*6FY$Q@=79(*e9>#n!U)_O-z}HN570uxCwjJ`38SIIP?2`=0;q*5tJQB#XceEoqf{*Dw>GnV zIXHY;Eyyz zm`*D=%SB7hxRidfuXZ&sm9a;h<<-hSpkt(LM?|?rICtxi z5DCbeg>I;G5$DD92UN;HMU~?iS|Xnn+&bu2{v#N@t2-R;J)5e04OzN!P#|!> zr2+AMS@e_NMJ9f@#(PuJhoW6i--G00m;XcUc-TC$rlv+L{&;8+hDb3+JYD465sLcM zw^z$w2h>w8Iy(b;@dnDw$MY)>o&6P>o3wMa^1B~2JR_pOpkH-iW)+yn{@#if%|WYz zY49^=J{$(42Jy7Irz9>lY52y0q$bhBdtJ~tbP%ooOUB6`zW+X;3zwh;KVQfBG?*yT zErbL725@IR?UV7%IzPK|6aYm4Y^0|}BHLo$Vcjns=g7i`&=fdvSs#2o z+rYqlNehJiJE8h5dtTBWYnrd7;&2gb6YW9*$yPQM6ThFog1 zV|d#AKUd#NoweW5D7dBL=1H7B@ETpLx06^|R63l8sobO4W-C=va|@kl+-ijEUSuu! z7)%S=UqB~))8_jcs)L??Gh%C3hQg91@+nbeSKZ4V>2-zmCOYTq`dB3;o6d&9t#@`2 z?tzx|189zxF4F%1vh1SW2*styGwXi_41e*--+0A^Tx`v5+6nPzC13&!c=UkJ{KDAh z@@~DNXw^K!qrrS@48}?`Ffob9@NFE$9U-MF%%3Ss+r97dK_sN3U%#*#WB~Sj?526z z_njZY?lCED7CLJ*+_<2U6?l>)eA5(vs=q8`#6NcPY~h)9xO3EeIH*K`i7DVk116%= zaRpL{V60TXElmGBa4&iec22Bmz&{NaL~Rw4=WJQV!|n8tZkdf9lfivdBxui0qv$u! zLb@{nDv33Gp~^@6h@t66MGTMOGQ(~q`-yLbLqnedaG^&|Mn=ZF`sHW+Up#Z4be@ly zA450{u0Cg$kasU0MMkPsdDKSS!o7X<3e{EsV6)X+ezqSFoHmC<-T+|Ksg|r)-pn$D zZk><+M&3bDiP)wUl1hNE^M1V5E+3#mgw%SHYaLax-bQ_duS#uG-++}WiV`D zqh~Gx=IMvpLxgh~Nw${A05)oAVc?(__E2C94+$Xl^ASS6VrPC1d5u)mjU^0)*<>GN zsBKy6yf!~i*~Pi+N=nsn@11$6>#ObAsj%O6rUsF2g>JW}H1R*>^bh_N+&8$k`n*cj z70snP46dlGbH2aPi1B;E+fzoilwK-R!WvF7CGUB0%p>&Ttm#`xgEp1Ipwb-nD4!F+ ztu0C+^6^LMc=vgE2o4SmjNalU!9uGj+C?0#nIIh_RHGy2{64X|g_*Y>sy~&ut>|^& zOjT_<`&835agFSpxq!r(&X|=t6#2$U_~XEii#T9F}9J%)05{1A1 z5ZQd}N}iP3R--=u3R!>*;QFM;$72Ti16V%rjb`%lbzP$Ag>iV5 z-nz27)~`qE5yoSQTCO-oea$zOJ=^iV|6xc~w&JX-RU3}P9Pe_Jmfw<>=t;T-Vtf`< z9xcFPQ|X+3L%94}1KGete`(iLINOSlE&8Ibu`;ndEX;MJy9OUI10KSpNM4I3P3r1q>X5f8tuYINxpeFG=yz5sS`1q=ym%_T*Q#Rg?hSd+$Z46FY2Fw zD52L#w^j%S74#ce+ZxGv`U_l>1!*cuiY&%iz(hpmCw(bB;*vz|Q3c1i&^i3DywY;P zvfo@FmbVwU`>FQOuaHz2^aASe^5_Om16BMyU7k(Tju5#oT=H&zZ_zEHa_)*`!<@S~ znvUgEMTC*O#!@bs-7DT+u_j`4L2}c}AE1HeDlF$8T~2qxCBni3q!|%&qCOp|YyoGJ z9($fmayZzbNgej}o{`(iryRT>mcvY{ur=d6CtucVISc7?mkX_{z@~IeLNBWVaEX>_ z`2a^cS>B0cm}lKEl+z|NA(XAYlv&|i$by{d^%O356x-4!^p$#}qn2&@>zCv2FHmIj zkt<$adv;I*nHhr&Y+Ptf!Z2maNsG`48>!!dgu&!okc`<<^5r|aFcYaEI3szvrIh2m zAYVF(pUN^1iSQB*`z<(2$2mT7MV{2Eh(PWg)c<_Q{OYd#5Ker>$+*gSRF2DArsi3X z@Bi(q+w;S+4eILsJzqLXM0v8wM*i{1Pt@ zprF{G5D8s_*%fR#cWWm$ivdOtuaYUhMy*{u&8T)jGp4tgG@^{$Q z{5w{fkSc&$>Ptfl?&-)7mKT>QL`WbJ`+~dvvB1ZkAs?=0Kd2=6=!Ldhd~%+JSSh zFqB9t$|O%wZD2C_F|)am?!&@kG7H-Le)!ov?+Mb*g!KBhDFk!WpG}p7^goK1k=pa8 zKDHyJkRrFU*jVBbhkUn#5m%b@)8C2?6R4G+NbcR zx(m==@?3V}oM5HL6(qoArarQ^RI#-C%P0j_M%f(UK0Ug#}S|!053CG!*$n7fxSDC={`K+<@ zgNw$?kUh*|l3(-&-@ERs_3A8N&t70OrcPfF@yF5$5`cs_>&XQzO36Uqy|dYuzW@7e z{Ob=_4y_u{8PRR@I}~xO;l#hq1d)bEdR{+DLP>gl6n z9v-xxS{y_Ai=5gc{@%{94y#Uw^Db_(BE=L&&0ea$wbUo49fAAgkR+g*VqN8^JS(Y{Syx#xc`>cJnMAcxwSOBC z|NIFmK6!nFz(fZumGMjZbtmyUa}U(~E#|*i#$rnU{cqw=RK7}uR`m~JUtns=NR>A$ zn|!ZN<#S>Zaj80Otx3V&o@{?S8&T8Qq{RyPfHPsH@Ebw1v210 zB4suz@AyggW%H^B5B}TV=+93+a&YhdLx;owI%oCiQ$gUUl`yUK@V$Tg51E|XQqesx zo7&^)uix6hU(xPm_3`6R z?o-M=NcL#@HR|PFdht4waEx9YqptdH_T+*fgn9m?65U|NFR-se7Ev2z^`AU~B?|ht z%lcLUt!bx<`MJsnSp;p1ALIDHdIpg%%3fp?1h63Kw@KQ#J=$!f$zsist4P9}=Zzh;TCE!FUD4S| z%u6b-oo_5p6Mq^ysrQz*=^;~z>Dmrehe1?6B9_i{J|}PXQ%vg$a_+c1RC+`kKg1CvA_7677h3>G-%0QC3#dGrkxy zbySt<=94{sH=pU-)IH_~C86g-u>~fyvybn<2;?z})YJcw+5vkQrTgm46ij}j1ZW2w zCB>k)N-nNYjbtxotMI~kh<#i4LVM)gI8%r4A~s%NzApZ8gc6hz{tMf5p)EC)TMftX zCc}l&d~E+%IKKRv(m#jDuepy`o~_*b*l+CFbB-u@Z`9POf|y~- zGe)rZK$}h~cdWqeJ$@XXeqO11i2jHqZ`a zkye(~^Y!ME3UPjs%Hz>+xk_mcx{Z=#K2?VzY(`X1KMQN%Yd~py2d^p0AhjdJ+)_bf zoh`0qEm7sAZWwasXtB}u8T>Pb9K6|79ev9vkds}f`G&eM%hzC*?2 zscnK%K@DFc4sveD(8Q0tg9(vbeF{r+eV3Wb$P33m;veWL$kAkFVBrkLPUEiGKBVy{ zN<1&VTBLOcdn>M52Q!pb(tB4c&t)1^KBhV%GomFmRKzD<84S|L6a7!0N%TMRZQ1v~ z&+|&hs>cGx+L7XM%k9fSQvcID%z0MUkBcV2M)jepNr>b9N|DG? zKa$9!#F43;tc!|zPxMYKe#974kewgl%}}|@uKwE>Sjtqy4`%tpHqv5!3&-mTt6ObeuaSz)Ctdug#tj`GhD>onWa-gp z;;aO^5%ySktS)iw8#1$pc(aKizFcg>IUW78YbdP1_XE2jvC!xT{fbvrUZmMDzx0bj z*sg3eiV@6i3Re0Z)f*=6KD_}d`~AnU{EGyYH}ssi1mXKkja>M0Bm4HCDsEsXhHMY5 zO48}@VfjFjh;&H!%gh$$@TDyk6H@|0HaXEIf75N-&ht=`BF%{R1_iak*G!P!`N2B; z+L-1_+(1rdrd$X2nrczdGGs^!R+@>$Gu+*-K?{OI@feZOH9ThY<;bayp0_S2yoT3M z(sevu=w)S?rdgD`={eKqQuUalAuE?5R_VwQ3F*&mxm-Y+%PSik_PM(-coL?jBflr< z(_J&3Ex782w-m2zVXAD+ zH9d6V(f#la{R+|0X{eUpQmMgXLKr;C1z~ne!RR3G)lsjCYlRrc^G%f$lx%2A)Rv+h zk-4h3G~3eN;|@O0_3qL`FbmOcgj~8ia|=<0NN*%QQf!WmZfV_5{@rjx3=_}0K9zZD z3yg0ssx6(`#5c_k_D+ANi-eBA&~a|@J5uzQ&K`~*N}W4(?Z{65a^Wm^5li)aX$ae{ z01m%>w&jamq4OR+^AMM=Aa+=QI82lDd&s{^6n`F@{_C8|Jh$#YaE{6u{a})PeBHmO zlGN?CRE!y1z*F;~k}uuKxacvXX;z&(Fgkx>SE;55er{LMNC1D-<1o67N zOopv#x>JZ1DQEYKu&5qVmkZg_kQKl5q}$u>tIC^5QnJ;~U(6&l|^<*kt#%e6VT#9Z&p;gmE9-?+; z)8}i}*(6#*!d-D6(j`No*aV^qIj0b1)n?oqJlNKtI-J~@nQ3q7%`Ej5WRa|gB(*k_ zA=w~u`jDQ2;@OBuR8H3E_v6cEQE#M%?nK3_Zg0}>{b?}&ix=Df@X7&^#(cx==E+A$ zw?93LlwTC?4N~0fV5&tqFM^@>p=vP53X1O05SQ{`mqNCqW@zGz(2U+N=oVNhBN4Ug zkmZU##C6fBVx`g6wY2R>*WWb9A?unFC69?aW(cYZW=>FBokIT2IXei!A?%||Tf%PPGKVk8*#4HMpjio-W!EB={r@4dsMFv+;u5j%|!fLOSg%kyDdyM2#Sw zL}wBO2J$+s*zY0@;a9NABILiHIQ@&)@T_~J)M8&GE^B({$oQW=wyE~YKT1csm|xnWBg#geN&9qv@PkZwaEx)&LS`n|ZpPADT`2(xKh!=SVe zi7`xH2WAVXJ&j6>Ix@1g*co-My&B#7pb#ymHykW1xF=d%_2T%SYHg}uQY^lPMW0zB!g>@p(h8Q#tA;g`_**80{5!Tu#w zjS;V;S)Ls)$o+60p4}b$pS*nk6*3!aBBg0RN8;Q^ZgGA7>@X(!Rvdg0U}S|?sz>$u zpRP`RUi!eMG_dP3Yj18O(yD&{6+O{sU9MLFM&rg%LL+I1qTf%y>Q~q1tonkuK4ox5 zKT2qDkf6%Qk-1@uIgY7_ws?N>Q4AaHbrv~<^HE?YH5Tuv%l(jCR}?Pz$O+tad}6BB zfwifKYiIZX*<)yg(ew7#$?W{{}T ztn0EozTuM&mM;(W7WCTL+1+MfX1}!Od7|DyFCLTC_Qx|Cs?`M@T9P%4Hqm=mS?ydN z1g>ridtWNVZvE2?^7m}>??0T?yU#)HZWIg{pZK#n#H4wzJsF5 zaQ%KCT7x^Tk95G7{O{16G9gv1DmHv_*J9pAmq|`zt&s=D0~}LxEO?9Qu1Q z2&}qJ;o^7Q&r^?v^}A@K6o1$uIbZ5q)8)@_6X4U`(H8h;r8u(>5*xFy9uL(J@-%g4 ze|sIqk?e9@Rf_fym6r^Ek-6gG6)W^X_89LX^2H{1&HwB-{qtn-e?7c1jqUsGsUn-_ z9F5rr;f8;5gP&v_k&pgp^`575RG)Q=T)ld zg;D#dDzmz>9c014)`&uC^g`iu)VwdW`{WQ&oWCRed}hPl93^J!d(w6%l+g@cBj;$a z&v)Hh#(md%hd5iQKe4Ugon3bwqB5ch-1$%_%t10iRYIS<^Ljc8*O7sUXJ;rYc~>_) zUV{V;04zebEDyc#Wv9K%8A-vhZJ@$Be-G&cI9fj+&g zR`hh`jKkfR*8dy;L(`U}9X3<59yeVFYLm(*v$`(TPYUyV6M9|^KVu8GDGbt9olxql zA4K5cf(}8I7n%xWYV@CoadqyrI9GIlo#`9y7z^7uFU}9fk3VoiL))RzlEH-HO_8<& zD_Y!#oA!zIMdYsJJ8n?J11b82Q79f&e7~Tl_C1+zWN!5R`A3weX*m5wCiW4Zb)?TEP!iL;>G#l^wLuHeUROn>EM5~5+B6Hd2kDCmy|^CvIL zU;b6(qg4aN#Vcn_OJmRdbA~NL?rDVE#q3%oIqiSd*9dVCbag7N%lN>%76aiXpEo&*Aa{Q|%K> z@B96$28U0mXF@i;N$d@)4^?hS_B$@>yiZo?8VunBvkes(ar_gj4r5aEkC!!_SO2ez_h`{_`xdB4*W!8BI~+wttSIX2S{^1H#$m zqAEexRDFBM$egmo{b^Hrm+(l}^oV?p>xcf$+nzRdBdGv&RJ5GB*qi+sk1IJ-Q`Id*<3Q3*$16nj*c z@@p}w^_uvcqv1ZcVTOrLxK&X{Xa+{!!-ih(;cA}}U)-tir~2Y4@hvE$d*YN}tAgN- zBgK0s)BBIRmUQp$!7H}LMmHBO2{jt`^(L$4f(q8B9jeqZ8@??v%*vyC4p&dy)Mq<( z>nP?mRMH=b*||naM_Fy@2_1nei#3(y4x5CwnU4R-wg1PQlV-al632KbN<-`1=Ex~) zm=hGK+qAU1$C@yQ!HA;bKasj8pB%O007I&NOZmKCrAxe^R-lLH)Zw_ikWVDeWLrt^ zdVP%+bNL)Ul;cOW)Q)hrouNa>)@ROEWyz&Qb9ZRMsL6*20_I89hnRmldArpL#hA(7 z67GX6rIX?>5U3^-MlOtgUZ1$IdLr9YCpNw-JR)`B9>HRRdV0ZDU!w2ubNSU+mCR&a z#PE>eMgp9raUBBT5RQf&g20EyD2T+;-Xuq6u0C&y14)`+*O@38>@4p-)TYQyI77KT z<$7S@ZEBNV?4vklryGCNE141)@77O-)CV&*TT~EKQj_;A?DO#QGRQpr6s9z4l^Cov zI7o>@i4HSwjI;H-Y-!_>sp({>F5XGbV46LRx#sYa)c*bJGN~PDOr#KSeCwLDoM$ zOT16T2s;9;9xvQYSQ5DNM)hFhZlxO6j^<^JvGMUYxK^$!x;+|U%AayvpwGL1ez!}u z<0rzZUQMN`!OqdcmIq28TQOGO!HYxU{$eln&td&fj?_e^xMOFnNIe}_jhh5WHn$x` zKJ3i`DHT#Zt53<)_Nb2IZNDu@m|U(Sw=S2Jq#19Fj*uT5#%5VCapWaqjjCU>?k zh3C+p>KAcZn#hsMLI?7y5zjgOq_h}`AYvB`+fPS~zqs+7W`+9I z$qP*(v^l>nJm`NbcG#@9UNs-1Eu9)cjf$ zZuy(#QkEC=Qi4vDT$!8n9r3aQQ-$feh27rSq|sK$z$Fq;8cjKavR0ay=Ba-$`Cn1d(z756} zwgz)b?sz|G*j!-cvSjOa)L_fi6cWnk6T7}eUSarvFc=KxfpSA+{s6;BR0OZC8usE1 z{5(^egJ2qMxAV)7iOm(v^DG99-;5^QvYJi8=Ciq-8Xpp6m=m5%w5PiXtl8IVxvV^t zpMXe4)py&oa&^~){8>}?73cX6Nv`Jy#VOONW%H>DElm$&HQTD;VO-5x$dg0?%#Q#t zHXw)DRu?5UQptSXtyr<@nC)YK>iXtp)LvSotV@gKj8Il2i>S9wZRsftnCR(kFA!yi z3gB4x+)--RTy0{NfVxmI*%K8Xbe#Y9SkHM;hR2@lr;E%r*6`kHP{s$72QIur=XF{?jmhmmHvVTl{f7}M}SnbX#06RYg zSz7(_-)T;`w>8Hw(mU))v3}S0@P#4s$@YHIVw8-b>r>wN0-PvyBta0wq59CXGEkPp0x~Me_!8dkd$74bXZcR}%;lH=ndN5fooHPy{IuKx zYdvo6zjtVURTPR78Vbh<5%JXsyg6hs*5!HK?BXtotMb&n-|MCEbFmE$FFM_Knf6nM z(bgcVUC@TsJY1U!Aix73k0LI!@@cK}S_L{evyX#kw zhMu|1R>-Oltp3=PF#jvDuDUj$?peU=+am`fIFNFbm^KY2;ti&reQWp433{)3;%}``-dy|zf;j){LJ%}Eslpb zfJG8kWcfq-{Ir8haIhYbSke;6A_bb>p(Fm{6VfTI=^R_arWjY3w~Eubb_cY8zJea5 z(ju)saa=7+h{Lx^R*MsC=!n_hRHitIuc>Oh6{0Bzcrc2>U zBMF6KTXu$GZ)*=FSm4HafK(A`YS26LnaD6%xjR2Lo-My3Lr))nP4VQ_mI(WDXAg-* z3t6-&k1iY&KmQpcjI~YGBoMu-kztDH|M%z(Kwf(rbvey?TluCxQ{=A9DxgZ(7kNwj z4oOg|FHeU{6Xw3?gxiwG5}4KVvj{F^OvlvNQ21CZ$J8~{CyG(7m>(A-0CM}xjG$aZ^G{!`zX%+pK4t8Ztp3QY9k@bmaJ6K7QK~E~2mK@aSZ=-8*Q$HE zR+i7MPw0N1+Rw9y694X~eGc!&z9MTPzOy5S2$!QOD9h0?ZSifbsMA9Fwvs1>M`~cE zp6?yBbd+y#ulIWW>Y%l7DKgOKy+gJpCrdd~Q<1VyHI-g4(2asdHx%-IY&WNoAj2N% z=f_T@KSH|Z9KOWjA@g^*k6~?^@%1=cTV}9qJL2r+=C&sk`WLzdyE9OSg|K6q=d`(B z6h9CYlj8BZ4kZmgM$YEgeqzCpp5%o`A(fAo$F)Yl#ydj>6eDx!mg&?5RATym->*5( zzxtUc>1EC}+a9bF?X^gh=!BZ!7LM!0La4n%p<+5-Yy7=ufApp#gY(Dc49o^=b@lGZ zF_wI)C~}UU4A-K-2yGUn?w|!{X$r!Jw-?f!Wb^Gr6cW=5W)cXzw$cJNd&aP(uWuDY z$L#nY5cKycic_4hA;Tkt8$MDoN9NnPD?`G!!yjfLf+*^ zXd`sm`;#Ph3*Gc*OK=)bnM17B_r&q5w74SPvkv(+-bZ9x^-UIY&3s4u2Vd7kC@A7N zTxcj2$kK@w4yTy^%`{-`0Sgtv*A7?j>^v5 z*&WQhY+jzC zxW2BgYNw^F)Na@AJL)Mk!_2HKXZn!UdHjSYO0VEUi48=!EScFg{OERQl-@(iUoy1skuG%>0y;(7bcA z>G3B-U8ws|^ww+axsY(e64#7!S6+05e?iu&V_fG(rBZj)U^{VhSoD?;cq+fGZS|AZ z#t*$$Y)w=AhKP4n9_k(n>_3Y1SpieiOMDUJ;{jEwQyq#f4>J0IS54PcYTB2o?}RF~ zj_z#jY|@jdP;`surNpA>?!oEk-r&-Rg3OKrr4bbR0~lbz3PPy1ix{Ca>qx1QC#$M; za+@Crc*3#M{gaei{S$em?fJNiV3lIrmb+m`InIGtsqU0XZX5B+5qoCrpRvdn`Dj9WJlr2*edZxF6GD*Wbk-<&8b(I7* zVJ;d;qJv0{$IN$Ha9b{|wW}x06|3A#H%#H#sy@*z_t9v(v~=K9t%I5|^G5%mUG%h8 zdMe=pNu(3&GRP@xd$(!LtYrQ;dimp=OJ^zpbfdMbM1@B0Dd|G`>nD`@DUGyF7Fj;^ z%dBd%?;(xU2|EG@oEIhJq@abV}{6b$UnF&a3ewZ+zplBY< z>r^`#ryV<*o!xGCU4$q0HQ5z<4fgo6ihS?rUT>P4rOVe;bs8c1y7KuiS21#y zT!Z#jszcWbung0`6?TBraUxopN<*G>44k|Py<_^fGR^LZg3)K+wT_8fQ5DySM;oE3 zI&o{Rk3V@wpBEc{2Y`|{2I~`hh;H?vM_|Pf_P;Nk@%j}W%}bCwiyu0L)Fa58I@ix| zL(6wiqP6lwj?*=sg)5_uk;C;O%_I(HO?}jUYkR#XeETCo(%DAHRe$J4L+?m5mq zF-tHsNxC95)H=3(b>1CzCW);Ky5<$(}fL8p4r)V9P&YJPV z8<|it>bt^)i8GkKduvqZ6M0=51=xz#s79h*nO^$21+S=yQxHR$*DjdPFh=9^JbBC< z5lD`k`=`0xzrHVjpEdle4`t7Oyk80w1=0qyo-Hv*e7u&5+4s2T<))@4rQ#UhXU83i zeenbplUkePEK+fR6mszRe;%{` z>Cu;DbaC32MR{p?RWUrN3Blru7ap6wSDYaH49%ay!Wfm*4%olXIuCU(2Y?&Ht( zSfvMy3GnrZOJ|w#(J5F8QoQ17yF+X^qJrZ^K&0`N|c)?URsa`4GzJ(7m(M-L0_{#sKd-#1{X-N$On(l05HH z90qy!t$UGiEn#YS7$3i9M4-*ikMA)44Am*$CC8I7IV~zTCVi2z1MbK1@rOy>hP%7^ znqh1BA1f=DUl(s1=?dTrRqV~BRh?F_0CM`~2wN9GHF#zPby>H@s1`WM0`JtUP{`OvJIfIcVyMEj~ZHmlMA zNFbw4bM&pnPTS%iVu(dH<=j6VP(UaBC=1QS_%&+ao_>u-Z0y21$XmGB>t(?w6MTrV ztUU=5vz|EUj<$%1{fsgoVxO9_tYr*%UGJFf&lh7sgY0T7?%?lLct*bUZ7cEeUK{gz zz&MnHmkA(QD#bky7#z4TD7uxYRcfhZJJ;W;_9!`vXu{*8Xl5n6g8bpR_w1g;W}g(H zH|aY*$jj^AwgiE&S{C*sZ>kc0hLEQ+S*WG!_F@|;_F2Uq+g#M40>#^Sw1}yUlPB&I z7=#}XofhnkT;NS;rg#=uCLFOKq_EyFhuhv=#LTqM0vmO?$VM>|E$t#tq>?`nsE8nC z*7+Gg$Yy%cUX%3ZUzB)((K9QykZlYp6Oj<&SvlLzCb0a{B)K zj@36*Tb3*NP$K?^{)m~vGnF!F{gJU}F}#5Y7HbP-ShVc|R7NKrbg`dgqR`dnv}8Dy}d6DVsO1!!Pp|S`suGQu=b6RMk>n3a-&B zjjUU4T}h`0$IE>3qzwVqd{Vi!Zw@q6lD{pH@e(PAi(?fkPeeVD4aH z=dG0?X5dm1gVzT%bo=2Lv1{ldOWCx6ic(-9hqSWFNCWQ~PZ-HZy2J4#dvED!+=zrN z#$R~FwY)Mjvq^$1yeIF@vKHozSDrvxDsQBn%7fZOdPq6e8f9SBZ->iEnA?lD3qs8# z*~a}TuhwML(7=tHm8K(77R#A{1Q=#RA8vVoyX!*>t9$0!!N znhKyQT#Z?@GqBm#nnvcT?vI4Y1u(`u-;wtb|u9X zZ8+op14m1dd9G~aYlnVNCZ7KKYDl6r9adN>*TvcFtUQL)@Ab69%sjD&4;M#H6hHIqQ{6BPKy3>sl^4?Txdim-ry4T_!cOey$u}SkB?mOBNq7pMUa$-VLNU@m5RMKhvM;M1ZdZU`TM2!PS3;b)}1k@KOo1Nx&Y1zBKMfF zu&s1IPY!6+yD~f$D&RDI`g^xhk>$zmGex$nw~4N}@dO}oIZ0bEzCZ7&Tby-z2Dxp5 z))W|tr#~sTOc3I0hIZoY;v^UhZ7 zDbUDSXLugnd)70sx_UacqpH+;mBF!1TG=5;2l1iA*3Q2AWrVul@Wd|pX78gHiH_e| z>`kA(FxBT?&TEgLx||!lGCXMdZ1CuNq~e}3zVHZg@3wJoTOJbVKJD}hQdNS~6ovj! zt!z0iqBTJ%80?PP#*qI6tG$QGxOwk^!}+=o$lCAf_vPDykz%eFG=(kl8$mPXWR`(j2s=D1WA|FYU^+ zsyg0{OpF8=hCym?R;`_Hl$;jn@2uEE4{*oB*N;A+4>6mJBPsw{?E4xYqx*L88bgrxbeHrv!2$uQX2Hxjlp z{!>?i1XNF(H*ih!L2=WlP(I{YQ4!JR#BoRZ8|b_(f+h4Mw3Qk&*p1qbaxEM6Tk@mRX zwL;3j%JP=G)x*WAId4=LnVw1pm}Gb?WfVJlLWq84z>k!|X=86MB8_1#`1bb?aRFT? z^JospA0eMBh5G-%0MMHiT{AXzODE;pP9GCs*V+T$GuL12;T@F1Lw;YexqRiY(Kc5M zYiVW1L4yx(0kIfxuig9PW)RODWIDg30hp;a(!l4IH!B0Bgi%64mB*1~e?YhSoOm7b&h4Pm{HuBZusRc}gXYzN5kY(%9UbU` zf&;6|G4ijH#7Ad^Hyb z2gj2w&~#9w-2`D~W@ci(&{0U$cit?&`4T%jJ1r3Bzm$AJk*L(t2i1DlqZ zX*C-lhS2?i!&^OYYRi{Viag{Xa=>V!6Egc4lxM62FoG;7Y-aB*7!(S44rX!+YtG7q zt0%2frE0fZYo4en@A+*&FO~!A;{;~X`|DMFZh>}{w0yS+VBYTj z)G9yf_(uK3gPr@ktua8ao&!|??06RtRKjGDOMkILRXwoYQ+}zm9bBI&Ap4z=Hfjcx zWOb#~iTSttp{F8+Gz8rONBKr)-C(Px@m7NVq_z}qXFxg75b_X1 z{d5a?u7VutJ>6XoIn+?%tk3^j7U$wGxARZC~8t`nEqF`Z6tVfqI=u-EPH{OB*AhY-( zBSNbEFDS>08YUAs7~uX$NZ%}A@70){C~(3fH5ZdLMg)vI$8%d0>)F?<(ga&nTRo9A~=`&kPn69;%>KLEGJPVn0Nt@VEA-fM@b z$FT-*DedOa`%(e{e$N`P$z%sU$^j*K0>^?M=y z3-1(wxBFM60#agpI=e{+?k`?d(h43NT>X{T!4f43Byyl<+y2ZO`1?R^20bHK0WA>% zH3UWfA#?nXjSieB4)kjg`>M}iW~~qC+nR6kKPbfflPxVStL6d>(C7u`?c~resm@=p z6#s);Tv5%25w>G(QR4qs)$Hdrk<^AaHeLl3dLi25<)+FNNsU*G8$DOexe)yFqma0y`qmHua0oejU93i|b(-2yYB&j1QzldHAOe zBLn85tXM^aaA4M4T@lFQAh*?B=)hXA$|wPWX6@X!Z>ST5fr2W@7^Y=QOIt&(Yo)qR za-r1Pm~BbS(Hgz_mKNuHb5n4*%pj%crz*Pfanfik%GbbRfHX<~-sB(VCOc1>dg?)SR(I{+11$IKZZ0udU%=thVQ?#UR zgC7SZ0mzX_Zsq83+UQmx=9N4`fjV>rRV^o7KF>VsGvgaLd=Yjit%}A@nL0EN8EO;o zn6G)hGC;x{0cK1_2(3R^t}9b1#%`1qLZIY}lu6tGmkdzk=}}KaBtx%X)A?t*Ilo>A zad_)v3FOi7N|0})?eBl{tkq>;_mJIVymwjJi>};@H`v)9^i;cOGs6fgSH#{Z$}926<$|yQ z<|;^S@0C*h{q;fuYzb?=pMnvi zATrDfToq&<(qHNk6u5W-W3YSsT1S*n)wAU%$(yz(e+5oZB{O;wq~L+SPr!1VUbmPmVu%Y5lYhwXf38(7E5ot`fa`jz>9Q+&Ni2 zDD&`|lg$D(lMfko(_c`@U-Dt?O|eCM3SMMW8}(mA2Ap^>K7K+I=2u+(#;3J@Db;VO zY-QS4-}&LItbE)h>$ChPCzef!dTHt$ zu(e>BpLBP>#&SP803WG9gN%&MsU7pk^?cA$SH#DZ`(AZxmtQN_7#n5BosuplsAx0yk1%&K|XW1x#4 zRB|v*D#`Zd&107S^ddCH78{9RyXU8l$uvY)XD{BYWc2abdZ4PRWjvo?ik!M*-ob36 z|5vy5Z|;Z%&cGQ86}VM1)(N1FAPu(GOkswh0PDK;#Fr2-7Xrm-#7T3n07N<$RZ3?e zdcEfDX+;eUp{Vtl$+H1I3c#$qhSSBgrdBjikU>d-F>ms#KwpHXD0wMV(`U)`V|CvT zc#~Xg{k*?q`~MbTto?u(-cm=Je9&ZkP8VIJDag8`bM0Eg^IFXj6lP(0)($yTEycM~ zp=g4#n9tuqT6CItaa1F~Xb`^61P6Q4w4|oRz(sK!q zHRy%wM=E^40*|5uBQ%8qPIIyNakB)|+v+lG!vZ ztEeGFrLt3oA+R%X<46^^u;n2Lgg5E&{_6EX*&}9@h?3?9LV~V>Gcof z*1&B^sGh^?Q&H>9u`E~o-628tA61MxRZD+;NPZX&Ai$3`OP?~oR4#l9J5q2{N_!GX4a+&?4 zTy6ZC&_>GXa#KB4=clxL`nLq=o)w%TkYM4YnR;jY5su+_T?M=^3zCMI|n?# z@)M;~U*`e#u`A*X_vKspm0&mf<(g2A>mS_egKq8nN-7}rVfxa^iIRb|`>d~H zC+dM=2tnIfCIeaHHGe|@U)H~Z8301}*IuW++wwP2{)NS;+06m4H$WfUf`jZMwZDp{ zal?PIb>!nK{QQ4`9Pk%Z#w5O`?t7~ZRZjSNs{G(BU@XFhz1+8LE}MAfgxT$%djSAz z=ia-k1&7<9PT8J1l1!be{WMQ%OY?eiesli@{KNdd-FqHAh!5PkT*&zs)cx7Fs?7OX zN~;@GZfzoJ?PRe_e|OFp8%%>Wi5q#l69bfr@rP_oDIr&{j=*;cJ_f>gg};yslq@;7 zwq7c>88vfH_;$~Z+V~`k$H8TbmPft^Jlc>(sE)2)-B@Rx-HYMG|LPFD+59N?v`P@; zF29=p89~3XCue=$$QZa$eW zy<_8acson_;r@3#f392Z+3aH%pg2{A{|tSy`s|za@A*~kDrbUp>l!5Rb;cD64Fcpr z<5WcXgVmo;L!=>a@O!e}`l6og`Wnk)yd}ZQGmsKy6)x}8UFV=qO(>-_@Qrq68&X7J z3!;=-p|w+URm(#?z`RN&{Kl-7FPny+zC(WVAKgm1Tq5-6n2^?lqt+g!)ivV;A9sk_ z_fO+e6T&z&ado*kflx%M(g8ASB7%Zko^>SsuT_Aw8XPFruUA_hFqB@JNRMjJmZ>`9 z(+D1ui5djBe;X{0%WE3SZ2$ubnAXK<#b`&248MJ_n-LK*`31xC%LCSUZk#544^!H2 z?e+y-C|%s1>OWTGt6Wu4&*UO7YJf&5SsMPrk%Fp4zFKKN|K;$ZLqH->cL27|B31>h zE*TV{0;*W6%LsG?Fc%8IO~TajDjLdSykF14UVOCAyS8Z4+e6Lk-FtSh%a-Md767e- z{@CWvNA5~ig({>1(~u|&g*$E6bFnr+dlO_|nV1h4Bjy^g+*WEc-3OVGRM?Va~vP7guHKS!tER zA|kBiNuXh}u&dU8@B(&aD?4We1rnjcAOgTQP~QiSl|IEk&bKGsKhD0)fVZ)h=Ic-$lAoD$PuPRhrqWdC3+>^5R^j0N zrqY%qNe{Ps8Qyg)tYIps>9zmt$$~1ULWf@EVB!z76A%ONWD#XBs9!F&W=eY>DsJpD zU0)+tH62Z%BMhEYmzCvMH^qYT!>m|~E@&6h!{jsFK*5SRYUsd&x2LL?OY{(EP^!vd zs+i?@%)3wQ|6R)A*BnRo?8taV7_ou*sbYY*pYXcz`Nc;=29cRZKbdRU$bN3kf2*;7Z)IP`|W?kpm&Lu(+br7$}|w5c$nxnEMSndLQ}LoE)7tH0wn zRPZvp@1q3nv}J~#gCq~tgjQi@n3k(fc8UuS+z>`@IAT7g z&@3LC`_ect_GJo^uPa^2EjqX9V@ubarX9An-XqG!L1`2Zlrli3GcNeMF=0J zc|;LV zBkStVHqm{O-MQyScJ=)ufc>;ZqyXeo=1?gmf1S()oS5)6vzqU6rA;HuBsSfP6fkp4 zp^%iyMI`a^XFz`M+zI!k7O?7KKERlVPwjt;%QNSMR600-VXMXQiE~(XJ%Pufg8uTY zX_DI!)hyt6-w@{OmN!_CbM;eM3tQQ@CenxErjfBWH_LoY3{Oh$RTwRMW+E0JOKMi3 zb@XaijGasouU_;@TY3Sf}d^<$fKP zg*6>4QWUfDcL&P{jI+4vi9Lb9xb%`VY{&iLQj4LSK9sk_bgn$nSxgUt<4;=#FElx5 zqt2MiC!%J3<*sW`t5ZPzPJAhioswzmE7!ZUDWlq#w~mg|M%t_cy4y?(FY!2H`!6S0 z-d(i68t|ino1CGH5bmi+bIt8HE=3U{=V_{GZ_9AePm@J)z9v-=18YzJMCUg@HF;w8lmX0Lt~`gr<#;j{?v!!tgCAc!P<(1z;NYn?HtEmWOT}zJW5GC2vW_HP{$#LeI z=rxRWw!h$#phUI-0SG+o+OvF;5y;zdm3Fn+T^@g@82_pvhi>nF_0y{}r?~VXedxCP zr@OBi@gNSr(xRsSh;AF{17%xjMsmfxY>j)goc4Ibq&x^dzsRWaT}Kg)09)$bR%08i zchZJJQ)n`(f>|BQSzA#;Q4T_|6Ub^G!_diCjc1mj$+7QlPl8+J2uc_gR`ES^2T8Zi z!x~N_9q*XwyfR7#L#N}&H@IKrdX3Qr)h=)EOO&T8oviQ5;cs1;a87vDn6})i)E?!N z*MeYirAX|Q5jzY*tD3QU(dzUDYxZ13uGtSvcF0&^hstiQ;$OtK=MBI?d^a|9?=qjQN0 zhP@yx{mQkFf$!y0sN1VJZ~&ksgH@M$Y=M!bCG~){9eMspFf_@vTnuOy5#R?emHGuk zUw8rTWTWHebS*nY@BWUxQzLx*l^vlgTYbu9t=z<$-$hdTO*Vi?* z1I?tKVvK?tw9;=FDmF75tG`2zXe~JE3ceqFt=%XWYObtUuC0!5S1Vu6!Rg0^rT=2+()nK8~7Gj=psyJv3v8C)s11Qb#JZ4bQ!mMvl#vJ1O zIHAZ8(6>fghmq+tSe{D0?!6iu$1CU?&@oOiNM4z;1#5WvJcN>*eKCCk~QpQ4a4kvRU&=I$hIG(Ti3%bOPlzuHCmd zeQS-gcucC98t9+Z=jkW1le9A4i$vMymc^tq<+%`um>*Kg{PSMsE)>hQsw*jzQ&#QP zr?juecEpw{yA@{ojaR17?Ci|q@$yc&q_Xj*sYCcWh1IdTbm|!g2?v>Lccg>k;{DS| zX#+x5tU^s2X--9rm4=WW>dH{*+L8;}r#2@(jj!(G#jFuDxhf_~-xB0%#mx~dmhcPJ zvc~Sj^)ry3e26sN_*+egf)adoD9*gyH?nrpEfnQtBzsjw zcihIUEN$6wVGMT+8wX8n_Ncv^ne#2!_)LC+j8`k8_**ciArU$16{)P}*yWJD#8csr zB0&a4;L*e*ey{mOmlwK)Gs82Us9tZFf)7aB+95+*m9$F|nw6BPUG3s}cSa8k1Q*CcY%3M43}!qPvU}wMLU;KVA{RYhf=>LnR$uc_S56ld zgfvqWh&JSKu^K&o=>4U_sr#mMGvme_LE~enfwnDlO_nM)QAD%atPtr4=~nbBpPqi^ z6EyT96=!JI+>XN0y+)ep<@MDIA%@k$N(-i`%|(@-a|^d^rX3ves$inUjb^Fd&hl}F zxXZK2IU`MndlGQgr zT%G7H_|#!qZw^kF)ONnra<;Ehv+7wwu1%1|HMo<3Z11#NKd;{U811Y#(>ZW`8rNW` z;U@(oZc}zMr0PCC$m$@+UW++_)FWiMRYHs ze2T98{hq)kOX_ zfYGr3`BjbQxBP0p;;BK*h@RCZ^w~FL-#oJt@#49j1NgyWDIY?qpHk#4y^U{|?%8%t zAT2@&YO5zUfCoeTX}9t$;4@2ErSN`g+N|y)@yZ|SDOM^sT)*3=I=f926`+Xw~BY*dCBkh zOw2~H8dhXAR1jW5&-Egq4F;sS%OpsGF(lte#y-C!{~$=UlBO6KM960zeorB0rlcLP z%j?(MI%ynaF)$IU5_fN0yQ13iq|E1AU?#_!N%3+IjE#?rHNEGwrKicNkrMUe z6x1v7P3BArJA@eM5~+`zYO%XRKdn5iwB)=HXJhS$y0jYmU~j)l#F9C0l0j^#C;2r} z-6^1<61LBA?o>5M*_mkAcDPZ#wu@8hU)I9G#u-a!CPo zdNKw6tww<(`{yE~v2AgL-?vXvf&(7HfaCNmH?3C~>5KgMe4+kBk?_!irPxA*TuxqBT(&i;aB?(4(BqRUvt zwS_DX-}Ml*MJmk3O6>JwwN=G2^?7uXO;<~2PvuW_o8ZfAw)L;MIGb`R!Y*r`wL1>G z8eCg$jA?%l!7z*}<3edf{Nhyh$^;oG>l!FjGs#%W9(5S~wA1P_jM42So3>j_jWPM(&8g+To75 z1on4(J4hdUv+gL$3agW(>gO*{=U#vquZa{777k>Y8Ilpp7Re{-iR=+5A)c6K6PxNo zzErjpEt8Du&KJiG%Z~Q;NO)_WNN>9>c?qJNaTZiUxPz!E$J{NIdtGYANPjD=2|j&& z@R@}^E{b8RsDss$o4q9-7Z>&>17aACoKy@ZdSViDcfa!^2Sg)NL%=<%Fqy>UIqcG4(nu}FJHT0cow8Tv zf3_~-ob-sIn%bI>$n9~}-)y-*8@HcRNI%D#Knte&qaUVeoQoAl)W3E3B_~}v&*oNn z_q*zO*xE3YFT+MfgVB&0uN@qt&P*!78i_l90&0qh$9`N}LRpo~o6tW(#SFt5Jl%^j zIjnY2UyGFLK1tVxKxE`EG&mZxJfms$2?-}t5B{BOsU?XwL4f5hZQwtio$98O`DDS4h|TJ+4a zKaa09_Bf<$-wjd7wd=1tM};$I^z#A#_Jy{ynJL+7)*D%rz9N3-Ml1(HE*y&pnR51C zn=5Nr7~{xdxcLQ%i69I!*<3RSc~UIp%sTHrT^+Sl8U5Wjd3qmRnQXdNsRzNh!UCiC zdk!Zy&jwagpvL!*iMhDz+&L1!aCu`AazG{x9g-h9ARkBL(PF+zxg@g;T4U)-w?T$! zquK857gQGpfg$xnqZ#h)b+FdwGEro$-o3$A=1^G>+!B28nGNa=!*4_qC(zW=^oOgr?uO_>^xDj~jHFP#M zpCC0mwM%fn7spk;jJUIe!cGlOft3mn-FR7DB$}o~@r``?qSY!ByCktZ(USEz`9-K0 z&a*|?ZAgu*U#|4}4Hc2oVSMk)4!qh+dqq`H(sJ$Rq6GueEb=wesAGtLnR?f zSX24V?~sOwm5)K#rEIS;EKW^NMWe~$As3-YslUfpzGpxT<+L~HZc3wmq1U*wo4#Y8 zn0vg0P8WNQW^BQ(>^Y<5oNP}VL%Zcbj`(AwcoaS^(64+_an;1uxLjPX2qfxC=?iR9 zHMx-JBVc77SN0m2=(arDhLG?XZwAvclw!KQITp@M6x7y&n+tMO< zBbV$aW0?fYFI$f;sY~?k2>WmQubTejKVtCCW&S~a7^z*tn=cIgWdq*!tz`PSHLn+d z<2t(2+KCNOcux9?*UbBbg`ERvh#<{bqDjS<(1WAUH?7)1wENh#ib&*CHO*FC%n@J2oie zRLypKWn6H4kePx6<>%(;WPFN|V;PggC#QmPin;`akz=pA5ypNleu(evP?edy&3r^3 zn)G(0fvLJCR7%ioE-tN$IT9~Io-kWL3?J@KE*nU1lf5!Z8}u~oRnaYSa9+wuqsu~( zbC!eP>{AxiprKr_WGm6f%nBQOEgI!N{^27}JKUh6>a&G91lu|&-34<#|ZkRSh&JRv=rYSNR*|>hUwjaq!`#bz% zEme%5RS8a=6wSJ80jngDom?4Y8uvwE`xy z&)}O+Y(f|P*|tf`!;Mz$^KKhWLZrT1f)#O_2K&ehs#dvL?IlROEycIuip zRJvs@rUc%3ohrocgzdW=kbSy+N7Q)#bH{#z(!9gx&0mGa8*l&6?q_i9&3RUvLoVaN zqRwm}eo=5t-uvwv@HZ~;j9IWCIZtTMLZ81n@#OSEpe5cfF8-Q^RIcYZnvt@jkCvU# z_n_EnH#(Mi2g8pD9VdFlvYN}Mq>0HXL2aoCZnMR+eFs3!7JP;s99^d3nR0SU0+33G zgV+RO=d$YBWo8nL73&iLP(Tr-HGblnvHk`mDRE=YmkhrSiz0pSAn)Fo0`#0|R#Q9I zT+^UeO9=o&<*nJhlg1$xR@05>szmxF_Wrr{%Y`rca#P$MX-1rZv{fZO_Md%vm`-gX z%ya36dt;T2-#MNPQp1C#^WqE@aFv>C`Wo8$rK(m@@}t1G?(zFxUA}GddF&r!w+k=x zq4+}#foP$&a%Bcy%IK5Of|pO-J?Nl^!@}`Vii17HUbZupH>oc!c!@#OZT%5!kPM5I zikUPg9MNlxehu7@!kLa69IJ5D4aJdUD8}dt9~VJ$ps{a95rg90Y54Q z)m_ZpzTvIG!!B6QJ~XC0*Bj(jLH2{8>xJYZTl6W7E8B5+013_!d<5^ViDfPB`VfKp ze~74Gp!KIOzyoY$Z6QERvg|N+cbl{rTuoz;kFe65)_}g4)iCGH80+<2z@i$oar`G? z&sN%&$tIm{I#)=ZT<-~aUT+h@g_$lSbh(wH7psu}x|)iYovwUW0&1i$@J_W^z}$)> z`J-hQ+|ya$-w(dCvLw|BcGhD;i3ugm(b&gr^@H`smmW2ixfff4at z*)wCR_@y#WQSN;42gYx6%gsa*SH=@g^!ubpM1*^G+Kze%ztHM$!C%!X5p<%Sk)>~I zwZD@WnlF;;b1gyCKp*W`tZputJ39U2!1PP4!KXJRT_-JPM-hfKj83pEP@D)dfASHx3{St>q;a?7mGdrdVC_7dV6 z&f6!`~>InHduE*>ZxWSD07G_7>j7m3p)`xmlo_gk8`b zMN&)3;#4vuFbINdwD1APR5XER&FYQs~Pyz;Z+CUcRF0 zD1pH&M@6(Qn6G2s%Tn-!^m?pUhK#UXiUbNKYN^3oRii{%1&MRE2-N9SuiE4hN|lj) zMd(01<&@AAOnhi6W@QoX83SYuR)*aM_!S9Ntdz5fY8$DV;nN)N3EFO@w&s3T_8^GG z|ALx7#pE9)dFG1&ULC+$8uBsTwd=syteRXI{zw$7-qvHGC*ib)lG;Hzr!4K&#m3(F zG>gZESX{#cE9hwjuq+3Du$-3cx5x4Z+u#dZV@gq`saaOMS^0vDpzxn@0c0@q667hr8dPl38b-~=fToU3(nx?o$AYsslYq_jlBke)fd-ttF`ebU{e`s z#o}en=N$5QrDgqcDqw>yB+t~TN;{E9KI2n9yC&<1t1)kArYUzRef9)L<^0C5_FT1q zYOAZAgN1S?`?@2@safBNPd5upRT8cJIAqu`Khz``ow);r9^i=1E;l53zcF`L;Pgw> zsgLP%xFW_~a}sqr&gr5tYr%PRYQ)O#PO2MLg_Zm=F%;aG6BF;q5U!4FmCH_h z&|KIO3vb8eTUzi-?vH^MI+!i7cOzbUKS%oqU2Crb?P^>dqdQJBTKw{y4b-URuS+Yc zJ6uEKyOjC@mE2-8{kfv_hd!D$9b5Rm7iD3^u%jyLd9^XhCcv`-3%-Sr=rbhoS!RaU z(rMEOVrx>oYMtwKGowbKcsQ}h8hTP|;{D{9?8DB>!6%ldVz&zQ4KX--ND z@@?72>+ogwsbl`b{a`bSb3kFPUVS%SqjHQAp}%AzY-`iO-k*@6-Rh23v%cdc;KtXyeX^A+QqRq+O9oUNkL!f8n+ z*u}+L$?Eca8&P(z9F=&0>`y?JuK8d@%L~#T|MBePUn1qryzu4QW}u(aSaK}lFo5Tk zGPa$T8iE9RJBP<<&Y5P^ED*#9v1a>iM`N9|*59v1Q})AXg+0qnAC2DINN@NMhBw0! zN*8jx?V!TY?A`Hu)5Vv%C2*gtud5lJFH}tpE01M!qnmO2<~C57&!p}vfM1Q|fU{E= zO0XLS#P?|3gQdb{i37&YhF7FXjzhhWf*-w%g1Z(Hno^bA5+z72lskk&=1Y9DgcgJf zWXY|eIc2Ia4xOx#hG_#m9Y?pn!gQwiu zk!=D!Dr)Yld3`<$!Jze3-f}*!M}&j#ypns8m_B4G>M(zNejE_O8>loiHZ2=!AzdDu zs|;eDu^eCU)rg3)F(_H|0&_-_av&vyJQ*eJxk^wI!ge~SVm3LwQOPlCN!*rJZjZTp zZ%I+ev07C9MS?%_$XqMI4LAuk&c&|luQ=?l>f^P7 z^%t+KkO{_&I{+fm-+JNj+EWF0%QKX?_C|Q)2-#r>DP4TH5s63pgN`v~=H-x|Jyq`q zeP>12z|x32kGS)lwkGnsSVKfgI=-jbQtF;wj5O%X|9Gy#$NBbE(e>TtutT<9vz`&! zmNh$Jjj%dy`gSVWdqiY1TDms(vh>1X%_7o9KJu3={9*-@%zOGvUi~e0E+RYK%IS8t?k&8 z)s^@huHj;}b*|~vjk`?8fhU?~r)^JjqT_YtvhN0&%=$nzT;MCL>YW9 zRf1DAxj$9vc;3uBA4MH28Y~qdjG#MltHwp2l%1MK{G*ihcS-np`c`FHtcFoLwLPta zh8&}T!~}J`lUVAVF7_>m^R9%P@xk(^GDMy2{hqgD-8?iR5Ok5uNGI$RrCup9&;<;! zD8!Epv<@ke=2c0JvMDtBKEJ5D`5%?2<7M_1Y9JBK?K6EisaC{@&!uK=HjJtDbmU$N z8aKd0U;u_voHH?KHn^5p}t32 zZ!#5M^uAixnOaOU=|po&#UTXKg?Xf|Se z`|P0B+PEbBTOxl~pd4O6TTbjGmRLhs`3O!Bm!0i91kTTm>kfE%Z4QEuYoYn3<}n6~ zQhZbhW7Ffx_&!Q$C1hE>t1(FU-02clJmZPJm*jhET_R2mbP3*>wpZ8aP#2aqHfg5X5&Wwoa`9Q8d@$pC zG72oJb+ef!$SyAU^rB}D1=MDIc`AgWsn#3vij?%7v3>uGuD0s8cQM{4C2eJ!e{!#7CWK}=$9g}4@ zS>@;2(es$@Mn6F7)})-HR=e`9!}GIG5vrE0xYy^`S!c%WNuwDK`|1$u ztXi}@=Nwa${khh093 zk1_l}mV)v>GK5#}#H^;5&h=Ty$`$%c_74mMGHJj-@CqN-D8g!rUVWx6pVl#qC5qdM zRpGYLgy5Xm1Z3jFr8+fIjLj%RW}_2~>U8 z>)l>%%N>QSTCHWp161a9I*dgaU7>KeG>E49E7&_Yj6R%3iPbX~zK^T`%B8g_n6!)w zLHL;=p4DZcP=pm!YON5r<|8(a7|qNS8HMk!(hy`0Y1Hcp23ev_c(6E+I%i(^2208)kcXfLQQn_K@zkg2~ zb~T)>_7hMD$396Q>%}ZSFnWVpG^`Z3$ovjfe&P zgZ#-Kd71x_mZ``_doqCX{gO2FvsII?jmgV2qpTAE? ziFfBd{!jssm2rc;2}=ADD>Z1YUO_~0X$*R!gdVDEJF5J3maLMk%2E$lGWtPqMF7aT zzg#%gcdFO-Q$483q_D7%QYFMZ3)H}mWb&aTZ2OB{fI*VIoCHSOvMn(0+iqsV&@Zpg zTW|DHs32DrhSUGOfla^0KKG+@NHIk}4}N01YJF$tE#?pzD!w+0SuI?_tfj3V*f6v} z*P{B3UJfTP4EVK6)FdO?M-}SB6&!0*c_0 zRlpsP_!>wAcIda(#~2ceGu%Y9q6=6E1V($zIF}Io4Vn1$h5a_H@*+x8u3H^|1tvpt zE=mu!fVc7YFRxqjuUe^D9TG@eWf4NV9kKz`_^D94K%lO-chTh+-pIeIAQC1(pCiDc*=VTk{B6<2AFkS8y*k{E zV}j-nkO`8iBfbt!>w$vWi$MAIOxD-K5pe%}RbT1;g@0<1fEr^z`=8;Azu)}-;X9^W zKeb4(gO`YX6_DoLhTl{Uf?XoieEKRYe6Qy8E}#K`&U~@(Uq#<$o);b~1?&t>Ys}=Y z(~r?Bzd!l0vgVp=jXCN)#vF5a+uCXt9FNQ-=KApOss3+C zYv2>S)YA_+m|0bnLBHp2$oi%dMxl}2X8-s%^^MZd9rCox*a-SMn4<#oq(;?hEpgq8U+(E7iQ=C|68+vrTKM&Qs+NWsot@|#?e1+aFzcB&s$is zwA>usMrCJ4>K}28F*6+h!EtD`EJWWo)_CsEvIbZ!jPv&<=Wr-rjWWY9)w*owPrIXu zt8kkq1O$ZqSkzfWeyxT{K3?Y$HdAT=qxkiB+A~20(@MFCmj6hI8Nzje48$-ctdq9w z$Hu%1;A58&kkB&Avgl8dZk3Tw$O>IY`+Y6u>9i0(#rl0K$7A7 z{ALdLN|`Xm2C&rylM21=|%$_3l;JfnV3Io4&Ld1-^w;lC-Oqbc~)O=9_1 zkNEaH?ni}0x@jt*T*J9HDZN_DDlMcP+ z5{m$4#8;c$6v4$1GMOt^uS<&tM|>2xWD*3erBSJ8M#P;a6r8`FLx|OkYL;a9?kc3G z>%nWk#WbRGyd^|tn#$-+BJ-LQWP@X%RE|)5y>gk$A7SEzSa)~KLl<&3+M@*T3AR@r zm%7{Z>gDHCu$gprOrQXlOrP7n^m|9Du88|ujtx&tL{pq1vOo6ZoM{$n8)}1;~^AAx^yrPa*ud{Ne zjEkQlEGC|I`s%Y_+C~-kx92)VWoen`!9;9JhN12Vx|gCGndeR`%L?J1Zzr}+%Qi+V zwsw}G0u;hCA4@B?pJ6|qv~FP|dN)TVg~|Y>_C?k9g1Tfey#+=k#wB-q$cW{Mx0tFt zYch421#f9B2sbmQd(QR=rESht53K+?i=L&20YvIGQS{~a0xtIVR-gitb;5fMkLZ-i zwLY3ypR-lP79zqn+@DT7k;Zi^@K+3@b`2Sh^U!@vFX`UH9+OtN+%BU-26jatsv@z@ zI!u{+Y@vO(O439f>=yhNeCB?}4J4ifaSp$s z&C3bGx3YS4OaiH15ufJd+$Y&IQfLtnR=&Pa>LGKVb%>rL@bpWVQrqv5P8u?bHtGoQ z0^#}%)BAbj(nZcsZ}BawFzBK$tPw!HnYu|5Nojpr`LA9n$T9#6(H z_kDh1o1jpzCj9JNLt8G3C-P2cL|snh$LJDWCuZFPY~)Yu50Qjk&?!byYErAEP-dh! zUqL5VpbHUyMKe~q(3KjWL?F;yGelILU~Q|>AZy#%JPW)~%k(mihH@kv0w%&od&(OnR#(R$eQ+gc-gD7TxG6pY4lG?!h~un`LHr^X_pls;uzzbxsTrQC|;wK zvs;l*5TlM3)t+de5Q>(ei!Fa0*K~CXG3@)=AxrFZu>RVlx^G;q`Oo%vQRPZak=94m zWMT{%sp?JM_IK~|F8bYi#`6W*#J-f4{Vk-$D{pTdEO%Q(s`AK(*5u$>{>TI8aHY*K zA{fb?Npa^9T98`8ns_3{qEB%|NT$vV)UY#(j|lzX$WVtW?VXdSuQwVb%|!MwO5F9{ zYDJs2_4>?%3%p%s>{lZcB@X*x#}~fL^^wiy`V5RURlcN#ljo*!ka~9D^e;$5Ll$>Hgc5GZUYv=9Wu4PC|?y>QzQ68)^EO_nLvA z!%Wf+^_TMnYgGoXh^^d}elxH#-y^ZdE*0Qi!;&;H8n(*MDWxcZGIXAMP0e~~wfkE} z-(6LZ1g7jVk`aR2%SaTGu+TSZ^z`eX1R(ag7Qilt`u@5_lRXKQ=M8~yy-hVOnEOEJ z%@^IpKu5;F<57(dQj$q6exZfB<-keru_GDN7DHd{V6D`ll%Xu8G6z{3szF}1r@Sw| zPLgqRx$?O1IJ~1GT+g}+B_yuUKf`j z@~0aE|4y^$tumP2v$n0iaXoQOWs9uhi>xL`BsovQyoANLzL}+hc_55E!G6k@F_!;5 zD_@jxZvlCxQ*q^%XCby9QpF)KVTrgitT+;Sat4Z4%B`>+y(Nb*flPEFHZGklYb*TA zP1GG?byj{hRIGDNols3M>wPFxJfLKZ>X%*S)s2_+A_)?0-7PF1=DwR#k;EjY(;JQ^ z&f#0B(Kise_!PRU1VK@qJ7aj!L(l_(Y(bKxKr(%p!a*oqi7R8esfoZ{YX+!-j@u+* z-~3rQze@Ly{lbh``nL*}cH7*9yVyu;5qe{UcPT25_wwBc%g(|3D|p;5+RsmUGU(jU zD|2?tXwJsmHF|(oLRp(nJ(cO>!$VibT0#Dunm$iiJ-5C~!d~_1m+q-pRfcXVFY?;gb&x;;q2X#K5-RjCujN zbOpjWEACHC{c7pK>WoCGqu$PC;gwV1C`8G{f?0ChL5nxyWA1}}l#U6v zqNANv7h|&}x1q}Tk{!v$6G!(I_q>d_&n~j4qjzDS>11_wNKf$VECEFfgcJEw#;jQq z85C3D5d-ldLc~=$(kZ-q(Kl&yJr?3!&ca$JdseyGsGh-fg1H_vTXsTxIVg_<-|r34 z$SWMd(Ukg<=fihWMZKqtNZObkv2=MP=nFy9x~*DjistJycEbkU-QdecP|#KPVh_p0 z!ri8t7tz|h%WB%GMRAh?#5GeNJojOZprPVuRy(sG8{1qv!(gZ9ld9>-#mM*># z3#Dqh!By0K8|8#@EZFFG>>l-*d-U*_zRyfDLo^>RkNth2W0?!PkK~jNit}Ab#@P|{ z2K9|}Z4QP=%)YFfT#?y%jMW-lF4x+WVyuE`-ms=>LK+X%eerVteOAn=(qy0BFy>)g z3^v$N8@sPY{)h{$I5W5Z)zi^Jnd)S(l^)nl+Q!@z?c2dppPJ0AoAE?dI57D*dq1~d zS8B2?1sh&M-ZES+x7Gk4bIfZ}>V9AH{IR>=E03zjeS^<(b(o9kT3nK4S}Qp7OFk6u z%ATCKbhTE+l+@Pc9OMH*ucJ0nl^xB*0iV*`uxrs%Reo<1Ogs)BCN;R8b-h;Y?v3J5 zpLvaye6lxRl`Bn8P)d3AvNtgAwyjVM>s1xuHDBsv+vN0_m6NSQ=lGZu+{=wA*v$_E z&c%HwB&a%{p>iW>6oY$M%C4o1YoHn=iCPhrzU`AN~o$u((y8f;ZD*4{I^&C$< zg#8Gy2>Kax!K6nd>9zDQ-rH4SWvYDPRMI@fJoawQw5GS-%{9wUCiHdmKN~Zd`mV;d z`K8Xe_rQPl66Qgk+LxS;>^XzNU+sIIqio?zVepr8&?}cAt(DwJz}hF zre2Pxy^c>;%EBCp@h`+B9H6hJ86$~2V~cF!uc=1Hw{F3PjM~a8!Z5`6kn*h*N0HOO zEce0bC+ik!qwmvKCtL$tR-Ud+lyzt9Ta?Yp)lSy6LXDu_B5C_gQq6JIZvu85Pj06$ z*j)RsO)Hs!7~ZN!Xh;zE`l`hPf>P7qD$h=zomJmb|C7Rm8wu^%?)xd^X9;TQ)&0|- z(_eYFpb&E}P3Z$zDfQv?g~o%)%~!^ts&oy<`v*-8Wy>e{U`-ijQ6&wEM0JJEsJN~| z?Ce21Ce&K-QaW)fOpxeY!DckLQ0tg7+aIz9@lo7Sx!k&^xT~eDf{&_NcIDE$e^2*F z4iar|k(Ggy^w~yvmX)v~=Vzyic3Rev;s^VnI3}pDLp+_G4vVYF{tMZ(iH5*Y6@fFq zlkd^z3ehVEM(G+~I>iH|99N=yXc83GX~pDF9Yi1AbFchloy6-pF9^GXub9+Ken}YO z>DB8cy14*V?e00fe0%wq z)`7IA3hp2aAUl1lq&RJYJauHUcCW}#qTO*|>Vs#L!sUzV{6|v{>LPRelM5li-Q5ox zIjywdzy~l?_+0SBh&rv(!A@#E&RoQc&lXlBNgMc@Nk5lmV7>?McNIAc%ypW;S9-=y zpH&@2o@Dbi=V`c7pXb-9k}h4`Z}w zcxqq|GTvbPpy{4HY)7fLmYp~_$e!8ujB5a{FW<#6*5?u#;Qb=t5Ckz>sxK*GAG$99 z_Ar&GpG7YCwTstJkYk8je7i`3wmF1x{c)(^0h*8kSTWzG-;v%Eh3;IV>W^_4MFfB`M)C=H^qzvk4!o6oL8^6MKrg z&?=hc=*+~SO!+@-bpmhHt2oHUhrLlj4GzE8wUeX`btoLu_^`=WGhXXBel2;;Ga$nD zols|%p+pL#tYq!&tRy!K`I3Lrm8ZXzGcZm_NhxvSVxnsW&ISG)4|@5`?G9<(dySS(boY+I)y(( z?*?*y->#|RDN1*KGS!zjsO3%)K2CIvzIf!ICXR7{C&2rgZ1uYzVE9sxMUCDIk-nnR zY#qBzy1sz~lF>@W`WGV3g|gpLsP`&B!=y4=pPX~q<8+eU9yceaQ>Jr|Nc_Bz3}ar( z^>Ar%RtP{K=}W68mE9!iy8P$up+m9NyK zQ%;2Rp~tA-h?{=_Q3mEa{dDb3SfA{Xi(D@{6&|M@TaTYt>sfz0%<3^-tV;Ui5eJBa zUJU3N8MhT=Jw-UP)tBJ}&2=bOw}3=2#Y zBcSIqL{uLB_B$-rL%1^s(sJAJuJNYZF{uYUz!wyN>I)EK}@GzD3kZG#e6QT;= zF}J?7xOd+4mKwxT&HhUUrWEz5s+&J@&1BtWpR(@_7KqEjlId+Rl|`E`!QjLe*0YyYsRk$YCb?D`C5k^W|pnUJxS+1nv3DLx)NnCUSGwV zujk{2p~#KO{^~fH4`)YE?UL^^fZJ5VwC! z8F|OR9gpv+7CL5#xYN=1)`&6!=-$|TQS$uO6?(4nZ*RT=ww?B#h_T_g?G7H2B0AOU zY%&J+LxB*Xu#j!n#$1k^iy_g6ivZ;iTU*U=4Y(_(%u!oF3=GSjC8;(b3H?0!I`A@b zJ^l+<`9cgP#(z|1P8Owo9$vkfh4TQ{gEr$OHj55Bg@q)y=6y}b4=1cQT5|d_$iL7i z<-N@OzwxA333U`V>OIUEHxiokcRBf8>q&N%WZZ}!Qj=Dbj1n;_mSr%zHJ^hXqqC#$`kR8td5Y(AZE8h0XW zhyrO^ede#EObkgqq4QkF3O!)Y$TyjnnSb1HYi`{D zi6_4ju?-c{Za))f3iG>3H|x};nS~im+~qGyat?8HTx4?h+j7g7oGk*4&_~4x*XkRZ zSr)>68i;G;E1e1A9N7w|;uRIsgzb;Uw2Vfw3leqCwa3xh*)M~{`Rl(oOpMxYSHKVy zn4&^aamVg!Hz9q$9h1fTWZzr$`7UpvO+kjT9C>wm+g^RPot+$-P4CDbh90i@S>h?5 z3Vxk7hyt2Z7;HlG4@Jl4iW@^OjuNgZ*a2jt>9nUE&BP{NNHzD@OhA|R2p{OmX5A3Y zRLJ+YRRl4JBgs%t%2Z(Y8Zj7d({;rC8eEuM^YGH$hj zyO`Dvxw5d$*u$e5jTN>j6L*&v__mLw)h3D;)B+XW+JLC?h*QD#Xb>mMON|u=}Qq|pb zOV*XnGw+%UaQR^SGWqKfD<@M~%!m-o{#}eP(zCVyTo$nmlnMp5-JM{ppWLCJA zK!12s`chcQqdH?PCd_-LNS}iy=`hmgI^>nR zIplM#;V`neoh<~9HXJa?wFpwrR2YMh=ExiT}-cz}) z{V4NCMfc^>*ON+7>;F1xHqgaO_~i_jY*ATP5|ru%d(1e`f*KW+eUpIa)8TP1gSea! z$XcN9g7dl=sJB1ITJLj8^>W|1ZJt&dOsV9+*6(HUOP{!~{kUfPkCs|=&>>))_Gj%+ zAsz$!aSD!t51pppaSKfVIo}xxKaBZEmo4(daZ1`Dx%k7Z%3PfP>^ttM4?% z&~|ddpO=ArrEl}zLn`m^sFy(e&7wvfx3>k@RExo0yR#f`=emkL<6N+qtRDG`=q-HLD(?MJff{xEc~Z&V8`fU zV60{}H6Y~Cn^{lxaw2l_fe<>yxrX*#CyDv*k`BG7%$Us*_GqneM;n$;R>clKsn8nC z+?(Q)W;y%KGu50fCW+z`dzh(i9o>h;Ethx4>zEX8gYR)EgGOTMMaHxb#=11)U$MNf zo(nrX0BRA(4^6xn_nz}1mt76I?Vi(+5raMS4v+VIM<;j9vln!9(rCLv-{nm?$VNsU zC!FKj7r*cVqTbOmQd<$eu+YzNy)Y!BJ62+qmRTPgPU;t?z-<7QGGy2lg@D8E>V z^e4PJCbz$zn~~Dn3%S$pw4!CW!RkEGLpu!fUE^*Nhd3&J)ld(=4|}7UChc^y?eKGS zBhF7mrv=k2RF{{XBh5^Yh=ls%wSA6JXlKV)6Qo~&ruC+nyZ~o-Leg_ki07y#z=Fnb zq&5D;5O#4VJ)C1SXij+cy_u`IP<;>scP-Ij9{2J3viSRsB6rCflisn5cXv+;?2Q+4 zhL`m;;f0*yYjyFaz)7D#f>st>q9N*zn_!YFQw9x%lTbaPdCg?T_!Dwou z$lZwGUS-_%{DPrR6C+Z!C&f+*)*ZP>Q{%E}t;gmiMpYftpDRXY4M*BVaFV=ujf~*d z?PdI4%V%nARs@Q7<8p6Z7^GEygOWy2FE8~1<1t(@+j6JmpQgXDaVlco%_=C;n@nmj z&F0Q3gwI_Cmrj}MKrF^tbExAuR5KW>tCc@bEYJIn#V)<=jW=yE_dcpX-(sa?l`h$M zHKtJgaZ6-EZ?fqy)(CqrC@Skm&NoZ&vBN>Z`UP8?MsuzzL3Xvh->c=d$Uqnwr|zU{ zm`4()Y>y`V0}rd$$M@`%g{;hmEvt}QHbple8Rrc(Z(VsJW9>@11#~w239QxcE3Ed7 zC}|;u1JlR`V~3e_-&N8S^zN@h_6y!TIntL%oNmk}8(|(gqKC$YXK_qUE`GIg3DoB< z&%DLZzkIAo*`{5>yvvSH40L2wm3Yn~m|&{;)%@M3X9IhsoqaxqB{GhQ423u_Roi=2 z*H^MAF5m)Eo+DbE{=Ns;a4y;x1^6IFtF+8y0{@|}!yBoqzd_Q7Yx6wHT28Th%E731 z>|_k-XyEbY)Y1RA?qKcd|@)#Cc(6Yd7Bk}GSl3E&`?O_Drup0 z?`}|=cv_}nEFC7XXq}5^lakx-+1dQD>A=xHC?X&t3_+6r>;w^Z7-40*GB8Q;{Nz=!;~4vdqVE3W@)eGZz|pXI&;pe1m1QQd z!Nu2pDRW?jLO5{GKx+y-Fj==Rt8dd;aAT#p2&6o_+G^YPc}~8%j2(q7?_wU&QG(!L zMUHw+{YlaXLc@1B-}NN-w4NN zwtW?7AS~Kq$?uP|0`xq1p~dEW;;(3v&?BLkEPO`lDoUO*wN?B;djTtftldQA*3Jt};NeS~E8 zRD|@zye^CRECYui<94Cc>LpFPmPu)WXQ8u2?$Wq4M|&i-{pMCByzTTM44rw=CvW;@ z#sN)~5jHROvu*4ee_h>dVzW!FG`e-tP3m*`cj5mk|M*)CR6e^N*?k|Eg#7OG?Gc&5 zIG$3Zjx(^T|7Wf)H&rTAYGvZ^@t_!YUmQ7T&%g<9pWGqy3d`^tvd26dVx~x+T2X$* zH7Y0((Q%;BZGH2o!JNm4+&I&dS6op{t!fOi=g&c#VzUu3%>;y+I`sNT>t5J}qRj;u z%%k{~0!oQOpjU=b8nwp$3T-z2p$c%Hn zYUcVwRF1XuY8+RQ+ELp=OxT^I?%u%kqmvGUxtciMZp$2lz8IhJo3c{+dbd{&6V9)i zPlCo90*f-{S{F*9;$6umeWL@h4Oz_oN4yNK4Eh_!#PI^SMj<9+<~?7iE2fgRC6KLp z`7+3GPSf&3rQwGRS}>geX6ae}E(8cItu{CBYS(+Gd-AG2thWS};8I~dO169tStOia z2=bVB*=sFtJq1v@(?gXzbCxt@pOz`c%W77&_AWxGNA==;W*of{b`G8gn@NZt0Kk^) zZ5+_^c9*d#TErwdB+adlJLYU}<|X*tTYoyi-0#th`CbptO62lX`oJ5BDEi@|kz{dq z04cI^?d!%Jd}q44&ERB=!S|}P7>`J5a=&4q2X=tkv7%4?IIY>C@G~NN$*s=9ETKkq zJV2Q;pSs#lhOubK96~)%L)Ek7kLw!0&8GXwnO}V!QkXT8`#|%BlI^U$y|nhKoAZ41 z8vNdoP5=o@;tr`Cfx-5DU*$Ovdb+C6DeK3u4RU7pmAA7X+ei$QN#(o+@&3om5GnA2X)or42z0m3;Hi!yV6pHUeRP$1iL^1I(?VSQroXM z(Z-hMp)L|zg2m)p?5OPMhDO-_rNW3(F?D)8%#D;;Z^3KK{aKTWGdQl820{utar~L5kV}pNNuB z4wqM3gobCaRN7vj#bQfgyj>}@I9Om*K;jJE3-o_A*yMAR8i$HzlCtRyI!H5qF1bYh zovI8SnO=9^3M&J3HVIj`NBm~&z)CzN6Zchprdr<%7#iqk-<6LGV%tZ|QRbT;sf>+* zCCV4jdi0o=0PHVGFp`NF@C6-POGg|pUdZwVYc;aiI;q#AkTW((=NJ%i?_bcM#l!1H z;u6lgnStMKWGvXp?lSn?8VN5oDl%{~uRtN^UCu?!5%FBSa^_usu*5IPGFdvc8E}bn z{TlI4|K#aucwZK73?>Wu{QQ3Ba&COw8h7w5gi*rh!(1#g>EDUAf~nZPfDfmtv*o)i za0y0LLe8v(JoAR$FjA&psaWBlvs%WpDb}f3m<{ff8P(=4rG&nRU}Tw8dL6Erz=uIs z)r$viTEC3kP43El*#J;>WW0Kt^ZJ6MMZ)Ih;A?SVU?s54BMP+;R0i?#wT-EI`@6iR zU5ntz6qM}k0=MTlGCS%C5Dvnmsm7`q7@ODsDqc9RH?uyk|M0@$VQED0uMs~?zG!ex z=fldYRFR+pNdX7s+qeYrSskS+ z0nA*&!r9k<3rz4TnVZwRG9z%{PV(nJtohHyOzqkDxMQ^LNO*000Aa>6>u{$l^bMy= z*qLKzp*vN*Of~5ezDDZmBiYz{|4Pn(e$c=CtIVQNriVl1C_mu%Hn{N?r+fD#7~|w~ z^f42*xjtW6ly!%@;nFCex%9Hm$y6&!qHKCfyxwBs*>CZ-xQf?r4{s`m2`_l(TpGy` zr2Ltz(mvQqxi3;GJt{`_%D?C7sce}%t*XrP9lJW;U9;xZMB~!tW*8Xm4K>Yw4wjXb zeQ;zP#V@%Y@-MIbuO#}PTS~RA;uOjlO^hXLWeUC$BhaU>B51B|!8bgbQ3AL|&g~7{ zuGg}|I!g2Q#Qe{o|4$PAo=f?j+uGpWae&Lt_V!`K8D+H&*G#@@>Ks6bYq~F<1Bg9F zDF2{f`Fr&^247{W3~Cd*!&&ff9PgwuJT5sIEDY&{b$oJ)XM0|p#6SvQhSu!0iQnbbIpL8fGpQ$l^%CYu=DD=K3 zlF(m~mJpA|=!=2dfLAdEO%p7tx=jf(7#N`0dXV-6Pbj$P;4?PwN`lc<N9uXMbgjU}{wD_cJ z*?#$@&*dI`DN!cJm_FwhEr|TjdHmNT$fB6Vc?nB_zdzo*S$;EoydOXz7K|}ZZL^Pb#Mu8qf>m3W$DcyO2-nTgSE0~&W7u~CfC_lRY)C;*7+9& zf;;6HcN$>)W$(fINM^l9qjR2CEhqTp%dTBC8qM!NfjjHL#OwVe#iErsbn>v+WaDE@ zY%FYJqp-|)ojSL6Pd%K!7I1E=f;ZSmGhUMJTW;h9kd)ksPd_?3`mpzaG~)5~#OJS1 zeH3Z+{m9q?nHd;rhlkZJA^qy%ORSY|@IQO%??rij3+n-e63MG7(6n6fM0Q`We)$Pp zYJC&bcqc-K|2UIi80?2H%?K=~8p03=W;G-mrig|kFx?axfpySh1 z^XLi&Yxyg|lk8s_^`el;p87EE-d8wb61o-glig&cJYPS$>i+9?M=Am+1gB(BR4?an z%FO8c7@B+xR$_DZp5m8-tctfZD=b-&UnQvbm-aN6!NZx5nF`Vz+5f;D{Xe%XX5X=Q zaHzuWwk@=t4!O<(E>-}u8Bzf|KeA+f4t^>IEC$~!t*=LCS1mrrIrjg#&#Tw^I;fWi z=Z0KtcM;q%2*8^x)*Y}x3n50zG#sm*6}?14HOgB&SKt3u@_MTuzp*;*tOps26nAyF(caZve*f7GltPR}xtaFqknChX1dsN6x^MLuV7^b?a znrlJtP3c7pM~;H^LN`KxF&<-Zq%wQJ#okqks!QTa$;WPEvrYca@L}b$ z%Q0@}ZEq1nWrg)wG0WlK9+yS;txp_1h@Y+ch@)U%=e=`TVS&f?ru4$b3v5XDKl%0Y& z4A6-itKt9R2aCL0Dx?`T@qmEA`O8xZ;a6wxRP~DUy{gkqP3!tV>`g}*H%skCy!Gst zl3Yt`p)vdapf=7Hcf+~c)-wWjVkD52!NFHyU;S#ly}V2|EPpWn9W8VPuZB>^lvwZG zNWYgQSDKjTa4Y(4=5(rS3$T+lX9^jVvqzHjV;98} z5d6lCg=!Cn!BXAv4*?8Z2Ky~)#^`|oXEZ3Yei*JVw;HJMoAoVj;TI=FwxBw}Rp)- zVp|uhbyW6c zcHuMH>@nMRE;4`^RYvr^VPtwW9utI+YF_%rKT{VA?kDUfxBovPKwyxhd{N5J^iNm* zv0(rHTB%O(=B5MAAq}CiYci=*$b2;wv_FuvbD=&D^o9GCv|#61u*ZPQ_KVCmY}5J3 z2F8$la>$)ykZbjXMp`2Nn)Q-9X@xp;fMr`*b zHWR@LKHV+z?#vJMl~?{Fg&x;q&JP>{R@O;p%3(%jWz8GZ*J(_aBeP33=fmfWwQQOk zukE%hlJh1Y5*JQDPTQM95zp@YArleBXC~&F^H?e8_2Kgl;ROS?TUaHe;76-X&yNB8 z#h+DUNM>OC(#}%!7{p`phrG8_^nO!76+bM7q1rrX7gl#sYzeCz1u=0oj>zG&DHUU$ zD@`g*_6##a>{`!Br<#G`z-dq5xBsK(Ii zkv_;5lV+fwEZZ~QjVLpB)U&26;=d;Y|GYeIPw@#|mR=3uBR&p$;Hzaw0$mYcXnC_w z1qfM_dEhOKa;?=axUsX8DQP*^38A~U8-o9Fe$)>GbQ77a)Z6UsQB=Dey==mA%}D(k$%{y_XeBVSkAE-C33_Y zt&i(ISU(+giSfp6Fkhml=IdFC`+adn^M3Hjh$$j=;r_DltvGFl$WQ7mCh}O&0!`bS;5zFy z&cjuf@s8I<05<$Bd!A_NaRjF5viUwbnX?rDZG-KkHNIRY1;bo0IhWs*7}IOsM|J-5 z^8Am%`OmK5fC~*SD#Z=-x7O>LyLQ7F_0}9}vvy1kB7$kn(t#zQ%OwS1rt-1Ev$osB z5+y1YdyCQ%QWs4Sm-GWx{>0g`7N;l(#MNtitXNnmXo_84-5~Gr=3|4;#MJXuf)$cZ zEiisG3UaJWbi0$a6u*SOWI_Mj%h0}!VFYEZ!%W0m0%*gWuhL#Vv*MdP9jf156tI>s zcQ{T-rb}j&(|>x*@d8jWL#{udJN~S5&;Itf26^%D34_tY+65AP#gec$KVQ@kM?;Rk z?=&pu78oUnIiGUQw0qi9>1(cZ4R5l`rYsn2b(}0-Ks@+WAk<#Sl}OeHZ#@|~Gno9# zXy~-871f}?(9hC)fvpZ#l9`+Aomrmy@PC>DKqrf*dRAncJH3UruKnDFE``uS4$WT7 z^?VCypnHCpndrq^ z`bieIC&84GNAX~ z7z&u2onTg!&Sn3m)4BUZXNY$%Yvn}ni886Sdo{DC9j$r(xCTFxbH{dTVmFt|L0c8| zf=U4&wICb1gUe@c?kfmovqJVXv0hGXjCfDpvlN>H2m!-hWV!_DC$y@wlQ)$}8!kS> zMs9OoJXPtThmyj>n8vXX1ZSLUsys>bV-T*$z%141$Ey%`Yv|xYW~4I6eE*c~d@9_h zSND@N6Fh26iVfa8T6Gc==Sq+N&Z=a=-rV@&Qygb(^!(Q-jM!n z>{i?Ayr(iMDVn)guOhNw{fD0i=lq_!qUD%AaIUvQYAucQHln=+3^&mo*7_ah3Q20oY_Ov{XUu)kI3Jt);7)k)S}kCxC>L@)#b z7xML}p%HkE0*zDUZMje2^{$&SA#eR-7(s___ZUdAqfgONVqfAWTujWM`Z`;!1u5xF zuNLa&HL)tWSPx8dHnneNxmI#@QPtJU#=9LNrcG#EHn5gYH;MoS>8gzGH~ln3&AZaOc1S4ZsZ+YKq%)MT&(Y;W!wdFOf$7ZeIv z2Hi28yI*=Iih5*7Y_OC{b}pG~YHK3aF<)=S8ba%S+98_<9k7u|UN<`w$omPg&-;8J z_&>b>M(nPY;G>DiwQZz_t%eI+EG^0k4C_+f0~7UC3STx_u)-MZdDdwonlgr@V< zBZh!Sr+rnWx{SFvrCDfQnwQ!czLp9+EXVRHZRl4&L|=FwpJ*eQ;1qmCVt z(ooJ8g!O~Wb@<1-Skh4s|0x#yDeExDR@%()^s- zTKc2b{+4CQC&NOj_bF1W6DqdeiTWj$Z2MabfE;-XHlo@(=tZD+dGnyZ$ovL1QN^Jw zU*atM{<3#n5LN-`bqNI-qSuN|J$yf1abwG*vHop445aXYrjU^{knwJ1d8<_4BFb!{ zCTqNDs?9#0WBBBNI7z?Mj$Z%l7Wtn%WfVDQlX>mv>>V&47bWmKk_A;Z70s<(SPQca2tKe z%lowfWQoer)wLey`fGc%VS2l|LK2kNoPfY0fY-NUh)zB(9r9yu8h<-JW-76L`e&iC z!QJyf8fDC8C#f)-S{ilk!bJ*&P&M$@e+EDfV+XT^xSrh z5mH}C+3q?24n=r^We|ek5ljjF@+4T#gE{sUzoSO>pAhZgb+3y0n)T{14Me&z+%E4V zslOpsmX{G3h4my>qr6x71aHpMfKDMBSEx62OpHtd9tquUlRz03O=v+5WjpogD%ccU z?Padw09r3RdW=6`ljmB<-@-nA;|{pMc$Em(GBN(g?%SZ`v*o^F5}YCz78cI9JABfW z8y%}|VC+<)ya7!S^I`EdGE$nFoN>VfF9o+hyRO7X5qhB81nJ0+R_bOeuHCVUQu4bm zQndOElk-yjrP4Q~q0AY1v z53yf_Yc1r>CCLolwc9I)>vFSkQx=#W^xvXq3>?7-qwStWleDgEshn0jHon}hpLa0b z=IfiVy!j`#4kb(zKg(5BXWSp^4UaYObDWOM+j+Be$N~NsQt?T`d3~Or9s7rK?o}ED z=U^|p3G)P)ZTF6drfQZjD&MP>OP>gPJ$lGZT{k@i&wOz_^H-c9fVaZRff%gffS)%$ z^lWqKlpjXa)D80{e^}`Z$1#`as2}8I3%yHSMs&bq@9C$1STGCEF6MlUU4Fs6?Yzh_ zKBvIh@$7wqf0N+Sk>Nwh;soLCosG(=;~0&uzbwrE)^q6^;(97<$J#8^QUQqg2 z%C>+cXn~i6$%E*P>!T7q;KpEy%hP=dzL|yG-JCpNj`9Zj&NiaW;~Qv<><_JL+oylv zI=fP_9nmvNTJ+AJhN&~bW&#>jRns6@!8C}$QI2?aMpJ!*%kqFYknkVIF(_?M&T*aY zIvJ22oLK?XSXIIOMc_Nq+`#JnC0tJOrzbALN93j=Q6l?hpX@7tCsT1NHF~Hpx1J$_ zBfd4#$D~`0F=!edMPF~`3s&nJ_68$&stTO_J-++ua-pW1hM4P!VXh|5(Aqy>O*>Bd za1lJCSAetKn@|9-!D zFcr5((WkP#En|gZx+PSAZ|QWf+3jlq2o&fz8tni5#&BBA1@SiUrPl;kLNREoHFm}h zdD+!1(=Jx-9?Xhm@=(OKy5b6hS5=IiS7JtHhg&k!^O(Z_D4x%m?M~`vu1L(*kJ4zu zP?S&i5ZK0a+h@oqiSQ5e4C-1~d9@z{(BP&AN_MtDEgod`_U?tbZJ7f89~oX_bz5#% zhx5;##Nb*zJmwlY;cPIkb&oX->TFA{qQ3dpOcm{^BNyh#B&V-pPBqW6pnQ$Tv1P7@ z-ZfKszjAlK%|j&}z8MTWL5i(TKiA`;Dl_0T_y*d%lTm`CdAXIf9*O0`o$$B!{Wbr} z!l~a4ToEbGJaHvNx@z)Jug}D7{eH?JmBny+1uY6UZEz^jqjkQym_*zk?Sa=nyRPTR znc`mB!X1|sh&s#>!p-}L`Rdx-sl6u6A2y6qx8S=Rt}v6kWU4$$x;$PuzsWc~wqOiS zJ163-v^ivlHCm@$Dx~0ifjVofUh_Iq0x{nV@VKh*RG)w+v%N_*0DiyhRw{!SJaE(v z0uwg(uRu&6hOW{ReEdxaKBM5Fq@W4;o20Ox(_;1H`DxofX6uG{sV{i9XDUU|qM?6i z!K3pf4>Hh%^_ltJh=z9zWU*TsnWmQjM}T0PZY!sFamqgx5tWaEGf>TNyR72q45{S| z4$rrg#ilspGv|JYO0TxPNN`kY8MWOs*Rsf&Z2saWO~yFKmx&;y9p51PL7KzevoUdJ*4OPO_)pq? z4heVy)unz74Q|9ydl(*>@{8J5xcmtX_ltmE)ONuetoQWHrp8gbk`hOG<*XOC|GM7z z*LB?L)0DIaUZ!WJ9qpbGR*dQ7dtLh&)4Be zgv+^q13?U37tCP({||5P0n~J~ZjUO0Acz!05tJ$dBB0VcQU#RWdzB6%y@VpYtB7<$ z73oBzgx-tNYv|Qb5_$;`0`G^ObN=tWd3WwT=gr)i-#CerggtxjZ+&a6{q4OwtxK$P zmEN`fGnbK53wgqo8!%v6Va!+H(`=e0>g+Jtw7F`RnQ+Hn+nAD43+(eFW!=9$)i*%r z+Y9FMfp^Kp*P74g?_em%|#un`p#TBdvh>ud{Mr>9R-%F|@4*0(o^=iqo^e~J4S z?6TA|zi$+()tu$uZ>EBw>CncSPpS-*45%dkF-_|wz3uvbj;`!sK41)20cSLv$=-JB z-HyEDuX%|Ff5SS3BUT8qdCv+wxE4mvYd1CHUm@HaU9lZw6kx zLC*FCaCOJf*N>EI{(dz%QC|d0MfvxQpDNBQ1e3M8@dp?raXQVTDMV@|x>aucvyJ~& ztFAs=LL8(BGw-Z&d7O^-AOFbzB!yo^lWLYKL-qpR>Q|0`PN{ze_mO+LZ~ldU{hlr}PN>w!5P$pC zs#V_q^hf?qwSWEQfAy9t3s9ddz+fHzZwwY22#BixrNJr&_P+h^3>L5s%FO++;19w3 zw*&Kk7*hlcz#VZ>ojDZT4oQdqxy1bkPW?BnY@s3jc2!n((^yXV`v1?#{9jGHf6VJe z93oAlfKH-W*15k4>%VE*|1sgeip7c#17>BWJ&NW&i6<>!x^EpSP<} zc!Pg?t+lW~Rod41fw{(2Z?E36p-Z>rO8=Ekg(yow%)&Z)X(7`a#Z%JVZ$!f1IIca{ z;pX+I6la$QE*RGTV>SRO6m{L_j? z$=ZQpZk3%u{xw@;{a1PxTdl6b*U{PW60cmFmp9HgK5yE1fq<&>Q?MqbXI) z&7s=WW`e(Ap%2uoXYlh6w*%6)`>h`(WlPWX{{zs~&J3hV6o-8h$|w-g!+feid_BS zh*D{D^8#V$dy`jg$0$9KcdHTcqcb!1S5>lGGc^WEzxpnDb+_gNF2NFA$HyM@8Y>!x zVn05-ToLg=CCA3Z=mM%gzVyPtz@VL!HnWO!+OB@p3J0kBk%`cw5FlaVw z+?uZ9NJ+4!DL~95u&ShX6`@0bip?{0=+GNKzu9^3wFeSO$omuJCeFh6jh>+BPSw&S zJ=gX6ohIa(LF0l=*@SOk*8{}C&`a_1=8HNb@85~l-UkTPzAL5tl>2(WRbAYudl7=w zsC|2?vRfitvdHytT}^`9eqi*d5YhOQ`}OPBr%2gxjr6y~#V`&-Ydd4j+v95B{+T*s z&4v`Z)M9sRiM^Up(&K7`Z-4w!wzu&l%x6LfsMcwnOxe=coUFztp*ysgNOs$fDn&={ zsy5eAPNWyh@1}5i*bH7ZgA}(7jMp!=!~-i^;@t_s5T-`Ar56bC?=-!iE{;Qp_J2%O z;ak|$b98%9;(I66)xEUjRDE)|?(1!A$g^>Y;*4$iZ}D+)cO>ZT%I+LAB9`8oyqIiV z($|_CGHWW2zjw?>Hy2N^BTy$k0S*Off=yUX*1c-GCNQzvdVT!cL->PNK}k9!O1sSw zf)oWmnrt9P@XqNBxo0B8=XP!b7h^TOM~Kex3^h=1t_!OjnAe7l&*lrCjU1Vupy&~+ zPcs{==X6x-p-|{7hVbzu_WGRt1Q-t}HM@T}|7;X^po&umrCg2=;PX84`Ir9rpC^0MaRM7N#7ew`lZxnGh{==kP=0+- zktGv))-@iy%1pmU^aA3u$v&DyiErx?M|pGZ-7n7L4V8dt?w`X}z34*FmhaUpp(HGMGCj z+D7o{yjsK$vq?_(#4gVdj#ua};oMwXDAXa5a22WMNNrDj6yn{&pKmsps{P|*~DzVkWfZnp;LtT-gr&Z5ofcY zF_9u)Ge>0anmAervZ!b=A=ChXT(9}-{%B$R{xzQgUz=_J&BB7MUe;VRZLC`Ki>koG z1ju>boDZ^8fv11axnVDi{?hpZ;rwZc`=c2^M-j|fu>JZ4Y?+FBj=g-pb)EP)Fq;jH zFt&6f?qA6xZRoVrNm)WiTv#qfS3;?bD*F_}++h-DOAE&uY9=j7p>r^r5hu{&v71(v&@9aN1xREMQ zRqj*QgdHmoALniTL2ia!U!tG-Ro;L~&@OZ~(y))4zyy9WVfX&ke1U8}^EMIpX&(0T zUx^hsyKv|1zoOI0(Se9Ed3x~J0?&|pIzppgsP5)CA1cFhenY}Q;&e6PxQ}Pha+_n; zAG77L07jnzuo3JYTih{hW~}bOLVJ2-a_J61DIBDg$sQ@)0uaWCx38;c*Bnuf;2ob-j7uAYum0}iF?!j^*+#Q8`7a8B)SPL29Z>l%%}^`@|H)N zx|eIZe*NhN(LT^nQYx+=pglM!LEP`JuWK&qP_IL0;SK`LS>6CJMy&rgzTtbVewdVA~e24##OG01N(|#pO+@u<|U|Au!%taF6f0 zkJb)LoqVY`|E!LxIlB=pl12zS)M#Ur%aIL1_>-UIyTgHMNf=Owtn8XkE`U7KM7y|) z6=0H6Irsv?FocTyrQVv8AI?~=FBzAgo&M$y*eFlpi?r$N}u{0nIMHVZlT>?7w?5)=$4El0DN+q5POpmTxQ?CuwyIg zO)}>^v5>JLUOgR(fh$&H^SQyj3pzvG>BD~Id*Q30QTg7d944oPx3K%B?Efem2qpS_ zvA=Lpf0^~nX=AYYrS8&-wb%cQO#YLxl@JDLScjbpPL?CzUG_9DUaI+@gr6=6ftj>w za)I58|2KQ5;ydmS(hYfuvyUdYr)vOM9q+{l%>H0lTa&ninRw-e#wqIO;7KT6JMwKt z`!>Z<4s*CfQa-W$_&b`r$woy2`$Og0w}*_1xZlEmR*@PE`+5u+;0hLJ(k0wnZcY6P1mfS#u45#Qqy=OVLmHs?P#VH5xvp)5`PyRMs;NvN4aNEej#n!^H z`)9+|_2FFqCaq->&OV*z_UynX`;zqvcQHAH{5F!V@YwJ5aW`OtY8nnjPjHIXvQX|9gXx%TrF zL+2r6JB>h48~NH@Z}^nNHdRQT#&+v70$L8l<}*(f(-ttnxe-ZxWXKV{M*B zzb=;OFS6rHk)uh*KD|jB!a9?cz+$uYV|LATm0lG$a3jE=8ip>wzxP<_&=$kKk)LF3 zl@q&957w~0F_Z|T=x0gE$dcc=Fnw|TlJXPa5XY;Sv)LX>&#`Zjz*I^cK<4lCU}i4rwmk#Tp4c_#en{P&3BGKEV!tQw0(+h1mKu|!5xt%9?SpFaFXzit z&AVvO=R*b8{U$KxO=EeM%#+j`6b8N5-Nj0f$}GMkC!cv`0jRjNZPIGnurF_%FsbKY zkJ>i*ri_(F-*>~7A$J!}GZywH2NmP?=Y4mkt|t*F-BKUp0x!s-`Q5<97($=s+U+`| zUt94R9ChWldgG*u@KSA7Hj5`L0DEkjQV|+rZp|+a(tuXVr;hSMHm5ZqYkU&OIxPs2 zPXH;bIvK1;laIM`MLHo#pRcK)DL(h@#9yq(pH~%4+m>m6FM5NPNi^KuxxCl`KR7Ct z@inM+*gGgB7q|8ESx{Ye>~CHYd!bOkD>rBF6kQl1N`!i5BD(Etjt-AcmYr%bU2Fdn*%QWAr6{ovm=<^q*vXd4cx4l&mFrgNmx1Ur|3(CR;p7duXF9xTG#QtTk`Nvx;{at7a|g|Ex&J8 zFOQIfM*Mpi_eabdisC2|A?zs*}^P-M%=^VUE4Ci_AEc3!BozHTAj zuKrk=%tL+MJXsN7Kf$3w{ts1oqIi&e@A>C%3X!KjPF@lv|9ERm6!T-(m}oLlQzlY+ zpHBE|2Z#Q(@@IB_fFe4KMkd;*Lbc>?De`i0N{&=gK4u@z8hA~FIsiT>Tc{tAR~J>f zS6E8vWB2THSAOSfeRxr4UXd%1t5Ybe?8r*UY4@)LI^uB_9wIg2^O)vAUK4M@dbTB# zKBydTEmcHfFH+@XCDowHRMRz+($mggeMGHaA=R1>;TfOp59OAFlZT{G(w4PoZ<=uh!k7?M`d`N3x5T1NTS&Umb$2p!!JjTy29?~Z^{RS zK(hexQv>wptcmLvaz8*#DNYw4)xpOT);>n~c4gY?>_)8i+apJ1pHLf3fn_`QMSuvZ6V zpK>3Q6_xR5$xnVz`~ealMFLFh=|-J)uM$As22WD!DGXeb5aL*-FY*3|x#DJt2!Vdr z)Sb_(g;QX>&T+xdwJK=vxH1IG2iXL+OML}skiM3cPx;VMk-t#1e`HiyIbTyl`0}Q( z_F5U5plYDN0;FBMWf z__&?4DXiuC?IKgboma(fezdA^IvfyQZvd+XRyRK;T1b5*2c3;n!Ur!D)r-8h_qyqw zg$-Hs#@)Ye`>tP9Y;xE_fPo9H8yKrZC}6>c!qsJ^X-46jjgn~V#1AS8gcLeEEIul# zDRG4+b0$N+3EN5Qvq$;jhb2N8R~>idLzQp^nP=N@7Tfp4Py!S2zp=9Z-(G7_BFoU+ z+!oagpZr5Y81#4V(mkGJ^5dKx#&P4c9C`1>xp|AEYI2#5(`y8W ziPLx_hvld+oYLv>MkFQF9%?P@ACZmsnkK$0$@p5Hpv2j5yx%^ElT`hZCi>G&yQNQ* zNJHKH%8YI#N5lB>#HLPIh76*P1-;goE)j9<<)FaPAhDO_F>JC_1P z{$WFQ2V<%ZZ@FFeHw0sU!p5oQ7B9q39PkE0w^PG;n>VvV6U;8uQxKBlI#Qs{acLrf zs$_NdM7Q6cl(_bOZ#Y{IrXLZhCo-^LhwhhzTvOD|_tsb$&lv+_j!$9g(dQI8(R)W1 zYL`RLSndu`qj4~DX3~IWw`{hEK2eAkyu*bw~ z4vbaQ%@6sd^h&WoKXKXKQ8wWyD0krtxA)gHQQR*GM?41ni>ka&8U-uiz^d!Y@X5$Q z<2>`#USP<%;=xtexHggJuKS0Ro3Ni2e`*TDP&2;q(!TVeSHtWMiJo6pqUnY_v~*Ip zKbO6$t@|mY#3m0S{V8+}hvidH8^6_Tt>N~jou|&Y5?`HN!{pXx(d6&%kk}iorte=W zW?hS7W0DlY|Li)T=j?xAM}I6r_Qdg2ZSgUv{`HT0Z zFQEa)!oqqZIQBJ)zxpH87A`f>02iESS$$tgYwzITDZHRa@9-3 zk4KvK9n$dMgSftPn&^hF=b7oG@VxruhYL%%b@!1jGn)M*RIl<4%iIwc4if`T&8uq$ zVU0fr623o33wE^JddWPPYHZCkiw448-Z%(b!a9o7bfED_vY-xkXGJPZj4LpgD~VIR zXtH!nL9JvsmbiLbXDV2Tq8?U%aA%boN#l3?K3=TT?FE0moy)=m?seJlM0B0@a^#hB z^cGgcQZ>ErI$4c{E*Rn;m~GnuP5ApPJi!qafBD{jq2!XMUmI6O@;`kR?d1Y-j(-f@ z!ttT^KQW6~V&szABbLnuvE@fco+u9s$qIw^VyK_xv?OlL!gvT**h%vjBh6n&jk6QH zrm|8WlO~f`<1B$@JY%DKEkJl|8>7%Vf<-Slb2pvjyiViiL?}SXWxtl{S4H8R9YTAp zyB2HnTXBiQmX3^2~7q~X@o=)KLGYWzLDU6JN4a)u{ONa{666l8Hobn!A8tn z*G(Q02T!vt_@0H?=v~^hLo-8!Tq~<9a;C<)4+AKrxKmSC_PTYU-gNd3Zif;S^vLL{a|xLP;oXa^!94Z4?@54)gLmbfVPA z9+W$s>=s;mq9uYmmWJ;!&z)-0na~U?;(nimHs6W3$UuS&XibSrg3C#!6I`RKAV2il zX#Qql>1dqM_}0YsT>yH3hv1 zRDe0IQs{D6uTfAZ@V!&BH$()_Sv96OMH0|sY|wL_kVe2P|EOd7YN8fy<9FR2*+wJI zyycv{kjiK8Fq|XHI53he9bPdBM_JCr1rjy|%lUm6_z3d2-A1IsMeee*!MtfoS)WbpLQpkN~# ze|N6UH~NOhs;p56Ix|x(aXg`F;eS_UJNy`R2y8ZED(|biCo*`{43M3ryK-^&^;Sg_ zyf^*~N)%HIwj5~Q8xM<_i2le@J!bPtuWumx29zOJ_oLHmC~f^~6e1B@%h%aUc%a3r z*M9mwxzIvTkOyf^tcaH2)eoGd9wg{UT0Zp!ryD*wFwIEiEwciQ*^fL70fB5!JW>q# zF!NyaT*X#*yleBWdPI4fa*qG47md+@1QEc~A`pDdoAcHgnCGILSLtfv{)bPH^R=K- zgBrP|v+cS1+z;XA9)u`%&Bxj$C+?k}QMtO|IwNeU=>pEi1WIbuW5qhunFBR2GbMvi)*gl;aXTOq##hhXH^qpkAZ{R0l}w_7Q# zhcB+8z)9*_T8-PrNJSDT%X4$A*XI~z3jrVN!K-A(xWsOI5Tqql!|sb%{R9D<4PD`7 zzS}U?CGmA&M6dgF)}a zOKCziRaE;IVbLY${SJ=TX9i!}=3i0?grhd zG5BbFb;v6KaDaK3t{L9QQIEiTN)n>6E3na(ynA{$s*+1hzjPN-@aPJvO+H`a4^Q?v zJKP{!m@Lub>9~ZNl>`t~dONfu@@ZWJ-v^cm>D3%>jIzqSBxSWK=}>0vuHY2H2MhAs zR@qP9N%P8Wz&Usn(Au!kefGr<_xM5UV+R-P*%9$fS_$MH*W( zx2sA)lcNilEDM@_DrAUzS<$=E&=z?8hB+}E{we(#BSRABuLHek_B1EFOIGCK=^h|8Cc=NTIdIKXI&xKew1wQ-3%om#6ftk61BJoc zfAj;{e5K-1hD3n>s>x|w;~UN>?v|!U)hS@!YBOhVGyEFI8OoVnjt|Ucq9_3&+m4&g zUvw5{;W}|EFSx~g4kM0uNI<52fP2ga1CdV zKg7tL>)3w!SDO6~UYJg-xquu6$noU zh>9V_N$0gy2blmj!PA&Caq9nwP%2=Uw^A$PFwIeg(!AhUfT%sJfj zcu&8<%OygJksvgX0n09YDwkE|!@MJ7Pk!T8 z3_MyvO;t+U;9?Y&gJyB~@#~{Fe^qXn%d_MqS4Bc=7oH9e$^D;6>;1H#MsJpPeIU=eB6f<^3L$7c~q?dzKz+$q8g8`va zWj8LE?#>NB@+1DIP=OL@7=HMoI69rw)T%KZWqm)Sr1F5U*K^`0oX42g!F#1EmdMDW z62kY)8xMe-_O|19&0J(V@+XJClT7XyL|yYR|0VP#EWYJUg3jW!cg1ykgR%@?f4Fy- z-}zqm0ZHvK)k5I6Bb9)&QBtc=dRNt}QT+3qydmxBW#@X)?A#TQ_=f!-MEXC7aHd^% z7D+P_CO?qKRYd?H1KB|qL%7^9N#_yBPW?v$$Xz|cb+zXs8%++0?8oxPvs5FP4-2lc z&*3^*s6wy1#=7$Lp}m#v+?Ss%sPB@o5hk*QEFY~Vs5}bqfU%F{wM6EypRpcD`Gve^ zBupZA0U`QpdC%0&fwH+M(pGbE$LSxvF|WKI^J@_Uc)))m^nn)+6hD=a<4RD{Bx5RObW z`$Yod``t6mQN&o1S!KLU@mF~-F9cW7(epYG}W`YEjT z*71ks5rATb8aV;n1Cb7bn9J|6^rhjbg(!XMf>oe_It6}0xjlhKpQGo5a-#>zXUIRq zt%(qa00LAz%ok}ElH=q7kq_*ey9e3gb#SeNmRVubN_4FIlF7`K;jrsBZieg{)k%b& z!>fO&f;`gRUo7>NqFC!s9VJ) z%~PC_9f)NBtpIepBGJK`^OyKQ+5m^C1)123-KZ))Z@m56fFf++g9iNk%+82vOWzad zZJ3H*9|PDnYAKvP?ufVB^+5z~6RgL*5OBA((C2@1y7XVRJx{ev8)gLhrn5WnCACl(UD z%%%wmT@AhL9}FY~qpJ9EzV!-Cb+_y9vcL!0_6gyb$h)jzEqw2bL~Q~aq(%he_EK0+ z@oA3JkaDx}umc7vhsM+^-aAWp{awZ?MUNv>%OpU*`-J0HpowrOssTsJt3*2C=&?C= z)fILrV;ofVuI|~LWo#rV1Asx$BZ3-pAXl4?+9((Yoem3{Fb%|WJ}hs+@=wgb#ox7x zl0LG9JC{Yezf<$Z+pY&>i84XO_W>)hOx}Gug2GP*W+iz`JT?uikOc4_GVwREeeTx2 z`(1>KZJNK7P0jd2%>UB!fA`;($&8jSoCXdDh(1S!80ZBqq_s&TbdKFU``Q?axHVeyh7PsxN7(8JbOka|)? zp!&ASviB1kUGq*8<_V`%YI?5AN*A=+LM+P2;`PgHk!l)|s8~^-!*AfjVR@)Fz%p0e zkqTYr4}Jl`<@EhaC&Fxp?4FrXI+v5mz+fF^>!(m6s_7dfqNK+lH8wy5*mZs}U(mxa zorTBdL&N0yLXLR(1%<4ibG>JYz%y@_kEO8!Dxl*0dx3JQ1R;&tL3bD8siuc>CJ@=H zR3wMn!%oV|ycse?U_a>AuFW_i6LYcG4S|1P3~uKli?{HE!b)C59zazhVwj?mGIUI_ zJ*gntaB8}4Gal&5Vdn(Z7addalKftdUGv)mJOLNy708Ge&`iEbI)ya~QU){P*me2? z3v55foS;Mw96kgP4P({;fKwC^(|1&oF64ZyZ^3`cW$*OY!qUPaKrpt*7{=DBdl+9| zV%;Y!k&XOKw#i&xVKbalA<$cQ2zV#)M*ytIK)z4Dhj#%3M9nl669i@{kmSnp$NHpH z*;X5M%qO%<))Fpppt!3O{jLe&%jD@!ejj)gAGp<}ZBC_^P#M1y`BW>F2AYgB`e^+VhKI;X!Xf=S`P|? zLD74(m|hxMsMy)c-HIJUB7T0dRRHmXzpPA|=o$w#Ja@H@jTW;;xwQ|z$`Ix&TZ?4P zj1XFO7C+x@*OhSHMjiQ`d4Vbam9@{vYBx!Co_MXDAqC|7U;d{)*B^tdX#$rNKf5I& z=h)<8KM4<^=rZ_$QM$wzz0Jt`o{bQ&x=0*#n_JmX4gj47otNlUKEi$RW-#-C?A}HY zDM5B}gv-3w3NZ$|6F}do1nOcQ=@w!mumHTSoyg zo#;tj&J^WY*r5mxHu){Y?V{*6MEB^?1sjHq};&E1Nk@Ywh@_K zR(OLxdLSn_3HN}b2Wby-7&5^G%4W>$IKO8>NNa(zl$?o!wZZTn2E3zL4kAj9Aq7gWqV z$f(W@>N)S-ZS1p=PipXcw&OD58fBu6DL87KqWhzccP=OJgMM%Z(eq z7koJ#Xs_zwsF-*d-siGP5rLWNK1)6c0LUR!o5k}*X434FQ+=76m7!7xATJ1GM8 zy6=cK!qy+7&uhaY#1M6#`1luq|MmL=m{-g_$eHrGKmO-~K9b9Q=M<0FB8q0c%1MVS zfd3DkMOvA~#g7TkW*TPSU9?}AtNr)@I%nP4_yyZEVIvUq-*<4B0QPpd0hURVI4+lQ z1GTJ7gtsdE<#m;_PX4I3Yz=vV2|2H$lH=&a>|ih$zunk3xcqgIWfc(7@QB53N=_!f z2; zpzI#m^(fPgG%@FDMz{CQ3N-vwwEccjs$mr%Jew*0@Et(*MY+?N zGndek3AP>&v-xyqs*N=P&LLX|x7~fh6ZWBkmgGqTuTr*oA4n@2n^kW`z>Gl=NeTGXq6Odr>86W(6v>c@xPk;mT7L!Ysy5D7CCc+ih2ShE1;f1 z-kPX;)x>*RxcgBw;Z49Q0Jph_H}s7Rh$MR?CnO(sXCiCWl59`u-OW`BueXE;xlrJa z&xb%Gn3%pv-z0%*ml{yepe^im%8eg%15BtT>8+K?m ze~IYJP28sSo%3W;`!Mrjfo+69z{FSY3-kAbSJ1cMfU`DeQUS)0cn!TB3m`MsF14d5 zHYyHdH6^@I-DzN*sc~HREwL#`A(2c_Jl0Ni23n4-FG!2-aN4AJg1j> zbg)!+yd{ste&%x;V-RG)9R67ZWO^$W^y?y|H#qzbrvJUP$G}~ili)gcyRg?P=&mNG zg;wHV3y)3-oq=M@Seo&g04LwoJ@pf6P`T zEAcyUH_chRXHi~w-G()y-Z2f+Nu8TFUZOTVI=kCV9@4TWmLZ#5(Z&Irqr|uL2ILJHpLh#2;aJ1lrLU*s<@q%W%MAi1WjN zUU4c3|LIWYLwIEESM~g;i6M&=loz+}`Jv}P6?n}_#N#l;=qRAWvqPFiaW$`gN{{;u zywbWEgIv+>i&l)}v>z{W$|r)sOco`gD*Uo|i$9HCXU?wP zZR6dE>b|c|nenY=-EyZ=HbtfQR#^28{P(lr!eo5c@*SZDZuP*oT?a8Do?A!sg&8q> zk&Rvyd^cm-oa-UZGheL?Eqs*Ep8RoH>&{Vu2Au3B-&jRE#t&K*E6{F zb2YO}#^Hs3nar1+2x?1D|J%!+!RO(Q#+IlRt8Ru4=??P_{nh%-I+ET4`W~xL^9^=G z^l4jYwEu#g^$GPh_xLxpajZ>0^6XGW4J##_t9}|!dLf1m48VpiI z(83in4Lr(f=#Q1%Kbz&>J><7=t#o8RXs4?ju%gFd3oQ+;>>mHKYJ4J0&fwIoOKi=v;v{wta>1P8@n;);kT2e2^TSE^e zM7MC#GqPJx95~a#v!(vlh7)TisfRZVoQ}MX{*V8-d29CP&iVJjpQ$h2`%h^e8sRoA z;j(?hzFm^9_UbKQ)J`HeJ8CG7KH3=PJjksZEf}26^R$LfyQfLjMzF3hed2X^X=1-n ztrdpTsd%@bFM_EASe^1FRh>`ebF^d*J0?-PE&OifAi=8G5s{9^wcZ^&T0C5Cftldn z&wLU3DDpY$OK?^MdMi@HXvjI>TsQvx8p6K}vwaWMMt0gplWsqrN_>1#LLyBN`B39@ z->Ot$C5+#0Rkc_hw##~yr+io9-G$rf<1{f(H3HYCalR||ea?WYex2PfbUJ@UxCd*?^1J@JSbi)P#uyf*B4znaD;nW3xO@E`ts=D753O}T z>1PS7xuTz&Rx0{eX4xm*;kPuUN7J6ZzdLK`?|kNfaXZ~yU-P_M5{4<7Z>%#wb3MR@ zi=X095*RcHfWMR)HBTv@k_3_7lX_}#h;5g8wV{1s!p7@=kb!m>{o;6Gk;9|*Att#a z!t93MMgMbY)E?6U`wsX6cLcKg^In1TSfNpS7|Dh+rvY#OVf}FU1FkGy_pWs68$l!? zsiY2V_>6*yKk%Z(f!$I`wH4cH0q-)RfBOu(*L!d}!WaFyK6qi{HxgFoPh8 zgXz}x6HYx;hpr|;741W<;1cQjiF>@=MyQ>mny+x{8IP0xI9JANK@392>7F$H1oXVV z+ij%NL`(0QZ!I)AD%Cr8w0PlYjO+yK9XRfdSTR0o<;QjOJzBQ|`+5#`m^w788B}`Y zHX<)>t2NiAY+KAu6=o2lCPytY{p#bLGn(HPa_a9#M$grexGzLkcq6~`Gtn&@%io_Pi=gKbi}su8iZ$2@>DKB9?09?9aA%7!K#H-!7z{Qi*t@`99yCk=he=3<341)o>nZ+45u3y(;n#k%0gI-q zYy6HL0SJqZ8&ZaOyBC-+-IXwigzUL>v){0|Yfvj{0w!(X>op6mS+%H)|BHWrS2_Y) zO3#PltEgi=Z=K;0Vz092fA9na+{LNc7imUCGMuOVRbNwTxpti>>={6Vc8MQK4)5-m z_;#oA+SRHcHZT z$;zk?oy3b5zi_hxIRbPnFxv@E`t_vK+1MkfQQC#B<5clP<2|WwP8RjYhcT3$dgTrL zt@nt3> zV`e5{fri#q7PUT|{} zoc2thDGHoqV;}?Gd-;+jvJ77@R8NHKL~X>WdJROZZsA@|`R>WlLHRVIbf&~) zhwgYin7JL@AaNiq;=64~kj#t-%(83ZIzbZxK`*r)TBN)_-xLZZ>&`|m>tn#qG5 zr}tBcDw~~u8!qms%$gj%Gi#I%j}IAa*Wq(Igzd_xtr=GP#lB7v=IKbxY_~^}(P0{JUResFZ&2!dF{6`P$ z>!oZG`2v9A1&4u#PDUB|dBVLqqRe)m9;n9XaQ`ZeBBPG?sWgA2U@w4FxZ4O3}j4)#lJ}QIQ>~w?K(-<9QNqmi}pjo!A8OPW1qOY zAKMv&eGGcZPjPlO#Q(uwKd3BP4>sAX4P<&gn`%96TksFCXw6YM_g7Y4ovNMuKHk|6 zQ+apZp@7L=TkEmknr@sFH?Dr(VUsXBT1TAbcy6%c(^UF(Z7za-`-hnCF-AI5Th5>G zvZe70sSuiaIq0J_6L<331?q0i(Q03Wfm8nLfB<9B*__Y?5}(c9@RcS~bguXTzRD6k zd4Sx&HZv9V!)?r$g_R{^3X*d3G9%HN?sjpfvE6naYi@#%t}@r?@4J?dzcbULdsNkS zkbpg#r3gEXOsqX%<`^pgnySA=8jQ=VHnxzTL>i-M5`(UJ>#ty-c6e{rrg zhq6hYIvN(Zy|@us-madf7lr(cj|&3JI*$Ya~U;&aJ&rsO2GJc z0H92m=pl-ka~M8u88v79a( zE!g@-WHVNxHz!My*2({m1XKI$I$_{ox)8Fu!5+S|IbJqpLnW$Tu+v#rs?QtEWOa@oS`V7Yd@B*Qi0r2^{|@vjofIvJ_jT?yhsm$`L@co`*Q3GJ z{-a;|NC7A&43g;JEYdE$|6cB-NQ|q<<)^H*^Mo=iYr!9#Vr2BT#&gh#YhROdo_4Gp ziPM0;^$o)|O$j046A8vYjI%G+si`Kyh>^}5Z%Ke~7z9L;j<3r8TDIgCXJH4`gIg{c z(|nF6A1<`(Jz{lt7N!b~2wpKfd?Ed0y>d&W)OICozTCM(=n%G(`J&ooRC{J?? zn&2|aK(#M@SYJ&fdbl+wwp^g{r94XfY^|&=Y=?n==>?7G(`8^@4tvK&r_&$cTU5-iF;c>@ zL0F$K-Qf}#k=TMgaoyzF4}o+M#N4CxuIfRD_{msqa*O6?M_JhHXTqjv+g%Qq)W zSDMUgGmb>3&xj%2JT8)q0n`@QuKuM#I*)7vKjX%_DpaP~4Nh)ufey=!V6ScM!5hm& za`PgBXFuHNg%B5JE@Jg)6sP4OQsAR+$(qaJhwI>FL(#XE>x)fX532@OYW-dWud)q@ zV1r?;WpRTXtnxLyHUIj|^?)QoDlfiz+SMnb=gwP+PVCpP%yuRZrkm3Ni>fCjE3C>P zwH!HtVm&EZh4*2wxChfAFB#CeP7}4xm7TJa9A~ghKR?3`hExy=i>7UXesI-pb`FgXh%czDaQtBUrv?ROnut)iW;d zrtd`(fgu=+4XOjp{{wCR0mJ*(SAs$$m6hXgvELc41rg~@Kt!bX77|eq6afJ#O0yv-z4rvE zDouI`5J>1fv;;zuZ?U)cp0oEoXFvDs`}z1IPx7X)-nnKObFMM!hjCsmqoueZHzz5htytFVF3K4BsvVUr$ghfE6gtH%qb?aJ6r z@cCafdhYHtzPfxDC&Xfq?FX6Df5sxLRu*YzK6-I2)@Et8v2>vomn$LTDTZc8`YkhH z5m$-9_xE}1eO*wah`FkONdb;ib!<&@#(5{vdXb~O5>_>Ajpcarg6;eHb}bt+!{NzC z_o^>-I>)uwx@TF{q^Y>kb1bPope=6jQ9qCSk=VYPTkui#_s&}6Bi056e_zx^w+{pPN*p#ZZ#oWXLaN-GRk<$us76wq zvHFHPb#|ltO?;<>AH3;PoortSn&;_-SHDfLL^edzdUVe*b2!d?y*`F{H-j<}wKuWs zU{u#VR_u(k=6IC9@)(wh8v1Pd4x(uKm|9F&Z7zLmC&p{an6f9KwaQ`4ZPSCH6%)!u zGb-agc-G5*s|n$|UU#B+XIXsfW*$1eP91p~J^y`dy|^W0Vw&&(Z(2}n7yg`d;U$j*w6& z_lftv)ARac9wQMvu0?ALDndL)@MqE2IV!m2DLa1}<1}UOR#2KVbLiR*RC~_>@aHI% zM8^AqQS1HSLHf+DbQSkVG2ewTxGG;WX)q6nq$*S#7laJKRb4B`(P9Cne-web_I*y5ySADqNE4~?Xx3`W;cV%kEVk z8``pzZGGs)%iAk&r0r0F97&o!qOLd5iZN z*K@7wpQp=*j8YLLo~lxz_1A7@y1LhG7K~2`*3|AS)Ay)CSX&xook2bF9-ur_H7mo_ z3MZv=Ohkk-3{WbYI+ctZ64B@f8a~WEzm4O8<1NgmmGdn1z5R7whPwW83-2-5I!Ckd7P_qbRvY>wc|*Wy*G=6?*p4#j}p_P zIR{GzoMklf5?&Y#E7&nNtJ5&f)=1vugo_p47Ul@9=e8?xai4yyM-!tD3L?swAA4yg zg-9lN0myy6zmtWy_vXN{I-En&uC3g-LgBpEQA}r!7n_e7%$0|rcN)nzH?E;TXZx|DK{t3EMTytYzclDu}%XCAD?_S$u8b`Ap@z*2O-GooCmEhc=8 z&bHo}`hs=-n*qhy5pL3u0#fD7#1DPjp z%G&(~&!q(CQ^41ozZ>q5Isyear6Jc4>kA8*gAsVJ4<>^s6px|1^j7GWRq?**$PG6u zd99e`c$EtaACbfI<<9pt$ni&*{IeuwQU>dsF!xMmi63H<+ZItf z2p}&l2>kl(f856Zu_Kt2Iinh_d38GcZz-f~j!+nxdj-a(@7;isF8ozLd?LoR{+*dJ^0&`K0MAh>T0TNsB;Cr@m1b6N9 zkQ&x#DQUM+pMyyFsve>K>Vgt4T0flK)RpKG(V14-aLzdAC3Bh%U-qvShD}TZ79&zu ze!uYwstIOe09ColBWq7wuS--M*&Dh?~;%ZCzfZF_a|7R)V zQ7TE${ju?VMdznLpmR z&eW6RZD*7mwL!g?MBS@#rZ@bvSHYKVe*uH`ikCfq_@rVytv&sXX-ELoY2vhDUBIN# zXbPldxNR>D(t3_=$tbg$h?5??rvE-D&fk%`g`A|oCQK0ctN8CwwU@2m?bToVy>&Fi zs>-%KfK3q0I5~`4y3k*$HAqF#&iCwGm#^<*l`3+a#%rhB_+QMt z)1_(p6nk|(DUI{-&C8HM5;4M(iRevk*nQ?08KM{LV)W_8!jc`!hJ%KT2=Oat8Gv2Q zB6eI|zH4WW%5ZqJMHKVdemJ)}^q@He_}A#}?|fk+ScehxG=4hSCZtUn32$FLCEpN! zY_r7&bC^3buP8cIxl{x$-D>}Ck!4Hw?(Y)`@I!|;%!kc3?kVQbs(3GK2*YUlM~0Kq z?FCh|U&JYT2odh+D$2?_PM{-sIAwpp9`s}FMbK9{B6~ksRC_rH-M`*^SU*k9AtIJH zI^g_5G6wgEQznPQll7vdZLyYH%X94H*?s!_&ruA5KjAJdoXBOt(&_C;T#fGnQ)AWE z6r2tBY+dBK7zWA=YYfTu5qkPY+W#H%W(ZlIFY4qAVq^wJgjoSmtDU?aSUM|FvP=4T zTrQ^0-$OCyoKlkVuOnvv=?v>1uOBO*EYSJ6=0_|X@+D(g-(FjglKc{aosrEq>(d%U zxW_V0Vtz2AKU{mRHnHqCL7zMv`^}&xT`_PJicL+fqggCd@<82k9xH+_O8~oLL*ITd zlW4G@zMMyYmK{f=5%0+$j0Z?wQ#N?ZsP+VhQaDZbv807G|IOF3&gUXs+Nq_6uT48Y z@XxFtSaz&#s!hGIhLn44%Ui(hTwP#`$k<^3b1ZMmiXaQd33O>uYI(C=g5w9C77*{p zs$m>6pn`PieT3~_{=1!7Zq^P;UYhF;=i!t2m>G5H&a+T2%U3kEv>H1lNHfSwLT0=$ z-3hWFL#^F_c`znlbg;(Ao9pMA8=nwD|MjITOKyx;q<}*#7~LxnpPEaRw~rCG+`k?w z5xGnxqDYP^HqXvZw@3=!jk{dO38%$gr3+!U4Z@`RyAooo25TKFQ`&cUYSk%e`EUsG z5MRwnLo%5+|skIy^1$RVDb;|E*KBb8OvlBVZ_nfEMm+<$zbF*jXGL+xH8=Gnmj-n>T1 zk# zOGFGDmLgzE`hlmFFtzZ|gKgT7&Qnq*cwd+}0Q_1z0;eqCxN+@EBH&WjYv$3jPzD;$>mQg=w)Vk>Q=T`5!-%?aiqjpcZD`xd-}s`aR59y_Xs{Ci;)pEKC6?DZ#lZm zE>p=YjN|h2y7ScugB9-N!-QQ)SaRB#32?y44iz+inB!%B!U(jd8wYRG)3vH9TuSH3 z^DlH`4(_pCgCF6w5XVsmT$a4!AtM#3{CochOkfGrXQ~kF6fZb!y_^!z({tRgY}Onb z5)CkEQ+uU2lF56Ltf9C*nwo%q$Bv6RnezR^ROPw=&EZcLFV;M%mBT8&wcK^wdm{dA zTR2*A3P!F)Y*alP{v0q>JW!q{5U9T2kFT64FJF=|!xix4haioisQH)T>vbqG_Zwwo zQ%tSEXyqWEpQZ{rro|qXj_YC>LfX0a?1G#4>Vt;0 zJ}Nl!ep9!SO=VvU_mvZNNz<>0NM=;CVGj+`?feSScL2YqHHMDo{ zxW#gKGAgoB`1wl~0pSAfi!{#zaeQ+3z&wh?Av?9Pa?o4RD3_97A$pVj_hayO28t->tSBVP`V$33FipQ2=_f(3Sl8|ha+YB?el z@ibjet7Rg2QxNq;;^&)jCYQ4z=RE_kO>Jx6U38JEQD%@hC)l$=HAR?csX*NZ~2%=fRIW zeug*nDbK`5ofQa(OO1Ld)~mVe+MN-yQ)_~XsiM5-rD2}%)PsuR5&q@!(;P}c-RqFe zpToiQG$#C$&8ExRcX(``PEtXmv@9cr&#%plI|@K*y$0lSP2bfiZPtriLPJ(Y%gQo| z8&nn*cD^)SEcVfySI*C-c08;49B*S%=go8L9nAFOzk*`s$$hyr4guO3&-@Q zjec~hAPDcvzVX{>rd5G)rHb)QHvlf5Vr1Mkgym=nmQ55}ITQHETl5wfv<}TzW8bU( z8tr}gX>D!``_tgmg8DG6!Ke(cdNhx;Am+%G81BgoC4vy#eD!g~WwcO1;>ozBhl3w& zr;pla|7t$7@jtQ&2u5E9bRk92CkIjChDgU9R@j~MHWO3}F{4JYnfqFL_xX0K<9TzL z{7*-pbjEzj-`NSn<=x+YxRXO)X6zY<{Wui`j(|DOm1wk7S2h>ZwDm@c;?s6Cuh-qF za9LP?M$N!oc2pD#4#NuQ`R-pm89B-;7w|Jl+{P7j@0{$lj>iV;;*ahi%JKBMiKoj&<8=fo=#gd>{zE%gsv2HtF2n+^(;1`jMAH;{Y!fPW>2 zwXDKuMMG&Ix593Gy&!mUVX3C4cvR%KX|P+D z4^vua-$->p`Y-zx_uCHEJ7-huuz#g_4jFPEv*WOmqZLpZ73Rn{t$vt~#QlJ)Aox=r zBRg07&fI)$3tElk+EyLq#!2{d=tqGP=ZoE*&})zNoR%u~<&tT0)DU~HUC)$aVtbq~ zjKA-(CZB~E$FrN9cFZDrX(e@aV<{q%;v&=*DCiU9%dvMDr)e*ks*y$td3Nw*u6QIDCTH)T;r!m6`vX z?W+Ut0~5Yw37Bdh(`Z^vNNpF*z@SwJE=8<2yfCrOoJ2z$t=>Kelg_b`EsbTQIVaGi zqq46N?o4q*+e(90pdrcsax`hWulGvj7Jo-I06V7qnb(B+hka(f0tUI2z?CL5lbpRO7my!i-Q3UR4wG z6XysVA)XMtRfxDa!YTX3@g`{t8<28sPwrP%RmAinokXf*N)kS^h}q5FBF0`KHHe^( zh5hVKuYJkslC z!W+w|+HZZr)iqmKh*l1}r!S>dtq*CRmzfkzxB{AQ^sve%@0cr4$sF_Y9|E&&#m!=P zLkJHVcDdO*kbNL!4d84pK!H;TiWV?<#&|QvY!26ATsZ!qKFFtd^s^-&I(+(aAN;}< ztzU)Z-^?=pDUEFI>;^T^TH_g^dR z;^mf>FVd?$T6k*8cd=V^Ehaq$}JDWUwUi^~5aNw{X=pP4@{4q^7G1aiDs7umb zD#?<=$=vE=m9|aBgu8&&Vh!0lnncv)1;4 z^U7t)yQQHU9t>gMQ8;{Pz>^ARoHAj$&nV8YHm)l0lCdKH2jiQ_ss$;FWl~&gNGBZxjNfWf~tLPB-8|C_>WwVbP8 zt;dudeh^D)h~CU#{m9IRy~RXHnQPq1G1IB6hx)w(@E=2x8avWi}hFtqY>&thwE_ zWBDopLI=8nT~t_!Q{hI8v9*$PcFdLdxl9%JmijNbkLitGoi%uWsF=Lfl>I&@${v*= z*O>$@5!~~b0L%*J*470?Q0G>hv+nQ}i?%CVSnG~1VE>U^DP-+qDO&kHdi(JV!-_@Q z4y(l5t+BOczS?TyDUUfbUD(`QQj=9r9^neUN=n+KjbQGV$z{M@kz85eu3idF#o{59Gp~UPx6VGUQ z2^e#vT=BIoBD5;3jaQRp_r?~G@;v{ZgP$K^TICJeWqX) zMYrQC&(s$6UCN|Jhh!}mMafA&yfuU=jWZt79C6~3buE{*ykQ60T%K-rh4#F`0x{6c zsOBAbtuyn7Id?5Qg>6o(irJ|lQ&HWr_f82%WrC(JV1i8Y%$*BkGTA72@!XVj-DyhT zV1#k;nlkp~Kz^!9Hdn?ih2M6xj8IV{)vk45$YW$zDKBf{rlQ&RV~4|tU`piYXr=3n z8p_0_wWC@Ba#_WWCajr}Th0X#&-ro@?$VSAcHjoXJ_}guDXQ+jblV9`RTt$#=Dc;YrVF0I-&w3 z$C)x0$4f1O3}-jN7$iYmUb%>j#lhG;?e0hX0$c9UymTjgRyqAXhagX$k<4HqM4L{e zX6O^{jePkwl;|1ULF7Px;3G~doI-5IlJ}RG*tA_LAk|*4H`fni>!{ntSaIP=g_h3l zwJ5Z}N$H1oHY04fV^1!=D;6Tc4Qnad*tZ=bq7p^W7 zC&JH7i7JyOP*#6v6Jii@-0836`#yalN}iE%79T<0c2T?$7JTbUM(T~qt4D&&Y+~uZ zvyyhghlE(i1B|8poR2-&xqsvTelAm0B5KzmGX+Ivzccq^_1!@hhLWRT zJC9XIHJa~kWO7)5BzGtSx@aMwa-HM7RXFof2JNNj*+5tZ}c$9K~1gU#|4?ukCNQwp2Qt9IAJrJwi4FWJGc=$1U| z@lns4kwE*AT8?nqC)-tRKI8^ORAE%@q-1WBjZWz=N6r|y}w z%dNtntj7Kp8D+-esmKqE6YjcJ5cb1awEk*6velPwW+}C=1rQ7nQ`&YF7 zF@dOf>yOABTcxFu56)~oKVw@q*WVHI^j6*gNK!^&Mv&+D;(%vyG^eLT7_IvtQ>*F= zrmw?|V3C|a`P*d-+a_>J{An2jQd}9y@!9*$f@RY-FXF$ z(a!{|BYxQDQWBSuRR+XJh1KPLiLllAkm_xatt$b9M$mo z{D!`RVHvgg=39{0AQu7!Te}77S*^%qn~jt&A+-PcOF-(;KcY^oI*PGKhOm><#l7hv@hCZVOi;08@tA-P@+XTtTS@yw5zV+jE zpv33F851fanmpf>jzDR5lz6 zADc#+&fR~E#{U#cE;PN)!7FLmOKk6&+{3IFu3wMJv_a`w{GO4)kA=3owSVu7L+zb2 zhu*kT_h`L`gC}{6ce5r=QpZljuCP!r8?QN+L;8K8Yw+n3QOImrSR>(M{0G#73JG1TYvfj#M$9`Nvc*o`TYC=6ikf#N~-Xe3WSj zVYR9FCSsHR*q+eeBzYpA1E1&*9TE9-f{<&V_np`5AmfBzq}VN1wbu8S;7T2pu+8Avt|K;xn9hvhMql(_9=5IZUyB(B(qN@yV`Ggqzjpq=%Mu!f5*r3`0ncF#3H8AG|FQ`G^1Wmz zrFGy8d#Yk!36E0Hn=COBM$5VkRE8q062(j^4y1;R zE8WJI3$W>=zHI%e@w6ayV{jRq`mfY4MiraO8uQfTYs^aLXjDV zC<4mBZ#^X##35l>1n6PRKuMGjtgE>G!nH^===%5SygCccDO4vVBpAL$f*W)Ut7u-r z$gHHCENKH*1y!YW{pbNf%CL2PkZ&zuDYKVoPZF2XAOLb1+apJh6+wx6ntUYwR^0w( zH?k{TK?(`)pg!p#{=($*ZDBF9l6&u(P7_&_0U5*4_RO1VKTgG|H)Sq^F5MHY*bXXE z-Gh!O?+oRTQJutd4(#XdfXUAGR^`7u!vUnE1o{!SENiJY{_R1R5|1Y$nu zO+ez~M8?OGPrmm9rz0fz=Vjd|>QZz;XTUzCDS}a?X?%kK=mS?w5PONPV^tTs4D!vT zxs)MQz6-s=l)EQs;_A1ThL8$tb@o7QuY-nHkTe8DPy&SCgFcl6AcXwXvfCETP?CBK1-Nwypqw8GJwlxaj6?>ACo;{ZN;$?H zXkae(f3`o6(E;AI|3{KI7sWFOX^Ii{0I)aF%Y47`TBs35!w>rUmqzk_KgIEH972^V zO~9M}=O`JITzd9@bIsrOKlo8rIZw0(O|!sQ8@+(C#;T0l*n_n?qF&^dfU>M@V;IvW z=)I~%4oCxL)IG0#8{&XXxSZ9VT{nQuQf1vM($ctdfmhPXksOccK2VuB=BXIAs1?o0 zUdxP6RSNd|FCyeI6 z*{L&0mTn&9V;W6W4ymaJY+*h0#r43uhd-G3VwCFwD4hiE;{e^Y1z1J53%$|)yOlV!`MHPRYtk?Ee26&CBj10w&Y?YN*dHjs z=9(6xZ)y#?{gp=nGwvP(lG=}{UQ2G>b{{Q%qEXg+%>M;hq z%(1B&Oj|6nz^e9GT6r zs(|!XJ;&q6faSjwa43fJ^HV%F{B)xj_-G_p!F(8*^c0Uub_LY!bQe`(5Sv{JQce7` zz?6-^$6DP-ej{ifw^Qe}iTZ8v+*bKtopAeFAHa zNnu8!xP^>V9N?`s2f-9WcrE34EUvyiS+dPvV|%tcGjk!8^fk=WK7d?82D%@h;JbLIBi8#;uA>wj4ri;FRV)pyhngZqR>b%w9 z8e`QEzr$9{?5_mr9{YTxqS546r8xcSCDXO;duI|v*V3f+MG`KAQ8sZl&P~GH6mVm~ z%DBweyEfer$-@+sG)(-ej}HC*VEr8Pw|60~uCD2hwRgWh?mC1}4%ur4`p61RSgjW) znE}x$2slkxn-qtY%C9EM} za}v99AX}DbztZ7Oj3;0Zlv%mG_wm^DxjJb5qL*^l(;w?oO$xGeKj8&gOB;aV@W+)o z6~X)@kXhYvwBOyBNzX_ZtL?Z~Suhu0sOhInST4oXEEPoM7Q*FA^jB>dZUP9!Db07# z%yTl7y7iT)VNKb+q+fs3fB$vAJ+MHiy1HtJPSNvf`{`ls9dZ{jm(#v%0 zfY1~q+u~onrS5k`e){yOHF`SVkhSN}tJInd!>Q8F#)^Ol)8WAE zdZhc^?5Vs|$A{oMh{J3B7| zb|jWJLm#wbzg>lb7#UdJ+V+&bvp3P zvIm@%NoPuGRT0U(W$FK7p+fU-zRl0K0xRifupRL)F8Gse{ri=CL&eF-iGCr~6{)l{ zEEI%W<&hotF`Rx|$Nf^)6Wu)Qhjhh&5Ey+RQCkem5)Y(0Eg$cLFvSW=%8-r>rCJ{{ z(8;}bBSSGTL3FhqH}UOoz(D+wl`dc@zG}OzF+5y+WPBS&*JkfFEo0uGRmr{UX@Rq^ zJ;CB>0`t{L2a-Uq4%IzOPgWRrtsK`OgT+1tYSvgu*lxQ+;6z=ZC%BhM_aly-x=lgj zJ$#peKQ9SbUric}VXGF1n#+p*l#Jk*ZD@d`akEr`f}W)!Ao17vkxEyF~wZ!$0=wA1^LE5ekaYR-o2wO@T4DuxNLR1*xK* z+*H_s5!8{1Ym)B*4{Q|ZxLn``q`fS8$?8O}*9T5C0R7AXYKTx=Z#WXywCLsJ?k;H? zT6(|JJp1*yKdL@#YsTYifp7%F?1g$uui3Ej)WTcae%lVr(UtbbtkehsT)5+NCkACXc-|oUrvHR|b$1tP7;&Z>tRmZtI|LpDlxPpJWKY%Q{XvjLa#WsTHM6wMu z@Vs@M+{1?t1ta>>{YITG0&;P$jqUAi&(>3p%~$5qSWT>ajT{fzF!U<`onW*&-`*|S zL1#C&7*L65G92mn>Jx}Kp2*Ex1*pqenk(N0UCAk|y=`H^rT+AoXd9PefXDP^U~xP_ z+GDcew(QXNtKkFjxc0d;T{n@T&cmT?+}<}_N;_q+<7?2$u)UcJh&tsVm4%N9Xz+yp zv>`^QwAt%FyWKYD(! zrVkm^{`1{wkf+$CtpO$OGouCC;@nhYZQA3Zj2bF@0Yv`OoHN80YK z{Yh=dtgqgQc>L$=W;_-nV<%~3ol7Cb2a)46mU*=r%T?*ksd{C-T<0C?Pxt8Ho>v5g zQr}mx+LQC!dbvg2lbG{SC9Df}EM3?44LL_XSevX2eBw=-;^uEfQy}q=Jmq@9d31=NgnDx&6<~BWJ1CTw{6x)Oix5w}GxPJ7rh@D;@dgZwWQ2RfXG#{ahP>vZt&3X$6bEQ=SBg;lIb;C+&cgA={eO5kXe##8H?G8~;$_mgt#v^|k3hiPvjd>UuN&&;J*SwlIL-yQ=wn-=lA9MC zp(;t|%{bRWx)ng?z*~I3^UZ??rbdlxUJ6(G3yX_I&n4(GymPMnv$eJY$UYo0$K1-x%E~mXZ43>c?d@4RnH!GxUvYJI7Fz-5jpFy> zkV|GULuT*VZxo~=ov+WmL@vhdrN^4M%2pbzbU$Yo`*D$ri_1{e)*(G;q_C{7morZ9 zv$j=iS$#oiI^-KuwU#_vqSbLa)I>IF%Yl+CuZ&J+kulD<1I|{Ws7xK{Ez1>KmzFlpv zciVg#cU#$d`;7?@aQs)k@PAtAU0s#~Bj!x4RE(bEva9P$^07_(v%~pi)O9(kB#Y@7 z#9L_3Ihp?v-z#`S+jvvC$hdaYSzG9lqg$~;u@I{?NbfTcd5TgHcdybta*qD`gjy3J z%ggFLr_4NLMNY0--Vn2&YIMZJqijyF`f>45a~HW=hHP(RBiaihjdG3I)3|qVM7|96 zgfpur0LiP*nD3C1Cnmb`l`A#hW$8~h75I5mfJ@%(9{TjCqT-~iTlTQ;kf$fW6WY?M zW7|?zDx-)y$XZJJ34hd)I2&(1SPA9GN+~YG^V`?HACPUGJj)R#*>Q-oB7U-|cztBf z?iStgG24iX7Xy340N?eP{9zw`WobzeBMSnydfM#1_c{oNxeu?uyXX-6UAVc(1_Ae6 z@s(}nldLTPan3&Pnn1Y9HR9_Fwh(UEn8CvEcJbwv;I?%CmX7||xf9|NQ=vlIE*3Ge z+mDFv{nz%qg21<19JsejF#Hs?wl`f(?HcKIi$_PwilGg|`8j!^Q{&#4gbYRkohX_jG=al~gQUs_1VTvA~mgV>nu za>~h6YeM!?0*_aq%xm&K0%|l{>R*AFYE8wwc0AE4K+SU!1o?X-6{KX%?<-xW{M*zS zyJO}uEZC6IyzCKte(QS!^2wRk=RDeYq;!bOD6w#vm}|4UAr<;1Up}S=bL{WDPf;Pi zzU1LMT1Lb)d?qA2Cp}n8Nd1Gz#tRb0OU{5`z+83{-95H%j{#XoKwcf zu0_?Z!n4ELW>gVLNl7g8vXJ2-miZ+0pL)b^5oj?RqA}e~3nmk*5Ub_#AzsgR*FJkK zy8F3FiK2(rdUYkE*cU!Gv~h=M&`uM8cYoChk|>E#=oS9;#wdyC!NDY!$H~;3v#Riz z+pMyrnIs=Q?WD;DfX9}M`dIo7_{JSMq94>|(Ov_IaZD%LcrNgf?mVW=Wp{pfPBh2u z2EcY9@57GFZquJoWX;aRlI_4a>rB-^4YPDs=2{@`de%7d6Dn?Ttf#tKlxopxFQVNZ z8!wD~$`&*{ILPamxfxZpuWtgt05SQcnb!a%YqpKx3{z8-Ay@UZGhuyGAc!aNp&d{s zav+cCK^HZ>gJAm$&vVgv{oRg+FRh2-33xazjeG6d5I^;?SyjYCKJR&3^`S zumIFzOxRQHPhs(w39hqH>`qi@_t#OzcmC;$hCzXKpug1eM2b&u%Ez^MrJ@N_zjj6R z{+O>mgvf<@=3H3&E^KLLz4{=bQn7|Q+&~b!0`AT}@dPq}eoq&yGS%k1E+D7Bv-UaP zrhVKlAF{XgOvoB$N@s|y_a1-R543iRQ_`)s>w~j_gwCCEB~V=zilpE1dNW{QuCN4pEWK+x=GDFh(1E;ybA8;+_+&P}lx|o=vAs@;4gBeqNlEG*X+PRF3&%DI z`pR)X?SsT}C?5`2c6Evk)R&CpBTlE8u6Hy(aCeVY=&dGAXRGMiLc6ncZ?h__RH@$> z@y4;7O(Ebn?`_ZJ7Kj#Dy@@d^A9 z6dr-a@Ie)**x*t;U(Qf1i$_Jl$ZfrVHZQNByu6&U{~)4czrq4+AX6~d89m~>sPN0R zZ$b>QNj@EwnfRmtGGT%pNL7kwD_kfiw)81;tp%@r?@vGPY*%+^9rDS2t65u!4ivk>H)bRQKemOjaCZWXpln^CI@|&bU4|UZ+=I_p*tlo4nnPHknK3aSzIQ$#*#(rLvR=apen`{OWacTwfZ7jOt=4qdU2kHHk%W-?3~X%pt|+c4ttkj+K$Z6;O-@P&-JvyY7kD(# zP*#Fz-@o)0MwatfBz^A8@LcZEZUwl_9dpjgcD;*E=&+pJ{AkcMZ~g`{i_apN&nqf+ zSdPj%c8xu7vo>5D#C?$z@B|UmFp1+6f2B^=r~dlQuG;scOaOA;##>lfS<&VZ+B+*- z7iVWvE#Kn5|w7??UG6OF0W=PjA zk0z$=eAD zOU<+x44mMYGy`I_=wK=D>b$P?Yxg(l%>oq4bhXZ6^(WygMJX3CtEP4L zoXnKZgf9Xd%5raKh1D>7m4m}-i%^n=*jgNs+S^{TP}?@Ip)B+@9&Ua;$~Fw96tv%3 zkl9vE#E(!jTzd!MvGv>DuD52Y!1Wt$+TGOEev4`hr^nRUSlt@;O?OhKlW=izipIn! zeFM&W({p(tbv8a^|^r)Pma19HtuiefvJ{xKU9I3KbJ~@ zx942C-*TD_&^h%vKDIPgG|}-&G-1fB6hLG?NB2M@)=>0Dp)_xZi<@J*4Y4M8C{c8* za3+xaa0aNGxLoLv9CFrQs};F@!M=Q1Iq%rS%Ueg~J=p_wO)%G`6r zy~>N;v+7tEx-Dlt+ZU3?G0KaPa&wM|7odHR0wttl;kXQL{|Qf%&(_J0ne^pIDICaw zpnsEn|L?;X>1gOaZps(dMDi2<^SkQKQI7VR88_{3&=xvbCnOCOaQ%dh->MEhGW2wL zW)Hv;qUT+GGoqP=D#ZH`ZOPnF6N}H{5fh?RNFMJk<{p6FaHQ!l2c8ufWWED7)07{z9=hfbskK2{ayObzFf8zWL0J*;7o*kJx;mcb9ioAYu41a4^;&?|#sw^zM zTwnQ0p?BcVx2`&o=$`^l?7`5712LO4gAooZD(&5r8VO3hqY|NRtQ*Ugg1apYDg(@U zOT5eHJ<#HA!~eh9t~@NMbd9G@Q(0P;GnGrWjG0=RrI=}AS(%cWTbig?jx8FRnxY~w zRJM$nH7%C=WbO%>;(`mUTAHc3V4zarzM-NZvfYol^K_qVx|g1A{B<~-bNIgRec#`C zm)|+BCrX>0=W1MYR}WLG%SKO~VR)%gJwh;dSj}01YB)htLCxs(4^&FoW{^Aa16#la)%G- zL~IZcpKRlAlFb5r+;n76mgg1q-lOB7eM{Yb2F}>f6)7~+SNHxu0 zVQ6HO@vek#Dl6P#J3cV~2Aq^zaE_a?kvz?ArQYH=_I=QTio*7{BcnDVs@6vT(3KKJ zLo}K96_Up@;Yau*R`JY^FuHn#i?&bofL>oBL(b$ft9Zbl{(@Rb zAV8|)G?vGiL$Zp%%_zVC5JQ&!-ro2?N8;H>h!?Fi+c0x_S=#j7d04C^Hn&>O6m(37 zb|^hV38##o7s+MaVs>E~Dx2QCd1$xHWZO8%sp=obnk*XQ#tU?Q%-md~b~L<;h%LA4 zthh>tc3(Xa#LjPq!4cwKRIMQkJ$?8>#RqENT&-W{N*Tn=!q$&x;i(rbY;8eB(!bk% zX#L0Ce{F=@F6{O$l+j+2UxmUL8bPY%wrYTAz;rukP3b5r)Z+<#n<|dlUhc&5!^7K# zU##&j>%Lk6^$c?90GR0;!R^#C*I2YdyMkDCZZO|Xso>X_Z>HZiG{i_U#QWd+1m}R( zrz=f@cgwHp&K8~3^UB+*0@$hMpg`UFG~+(RB0ETiWH1L z)U^?+C2*q~aFN%`6Xm#|f=HcayHKkWCe7=b*I53TMZGEs(W}xbul)9+)fa>G^fc*H z+Z!%PbP0G1y$(R(`}d8+sTCm2gp-0&=9QHhuR)3W$i%$``q_csDsmawM60yQN>DrP z{j){>Q<1L*`IO-zX1j7Y#H{yKgjs;y8l=@K9yy#2x4#&eED}3fbk>%>I}@|L{DAf2 zPzjgj{Q2|Ky(LvnZHrY5H*`h3xda?>+1@Qj`Aw2=7q;4)fD-YROZrXvd^k7m%hw&x zu!C?U;#Y!MW*suUu|Qx2k>;-EeCJv;%xz5I+6~$oEmV z&1A3pa5qLjw(WEhOFVXeMI!~b(S{y*??IX1*~N<-*SqD(NDhmtkDX{v4b|(r1Ma2I zRGl{XFwFJU`;GltUXr9!RS5I1m9(}U{LpB*_{uzuBo|pV4fIJnNgRKL z+}+vI@_zfqXr?;I6B?X)_gjGFRPIQaaXlU@$!!MM;$uv15J@B>Y(y6?!%y-2tDUi) zXJ;g>o0}CopoB`!dF5YA*NfQxSymY0jGLt5!?i&9?v`f*)>X;Ue%H>Frz=9TQ+Iux zdo>HaK_>Z;?z#g`PRn@ugwJwnj}GcT00f}ScSYASQbAgG6@@bSFkCpK7^9CFXBRY> zqr*73VEIyhgT5H82Ao?{>d1qq?bF>*jGRHKOHrkp7pFW$Q0F#*&I*L?tblT>WnnB4T0umK%%v(oL^!R8Z|eJr=4(OBA`>3T8J-`sXms- zih*-JFdUoLw*@qzoqh)u#cdl<54VG@4_z-BS^;mCmcy?feCv# zc=c>n#uz2E!T5qq!2Xwy@u}0(R<%aCM3!gR%QaDAPISW!t|KW{AgZmI9@7?I?Fw|N zi+Wmn{jr|b@+O)5@VW|Wng*g=`-pm9yy zhE{X#Tl?qquE<^8SR=#xzaM_-XQ_E%1>kFh6s(V)QBdFV%M7P;Y#h>Z5JeAm^H$uW zwk3S*M~42}sDU@W10=&}5t4iN{iU)>!3~}JCm%4aev`g=AHqoD3 z-W>cUt9SUf_VL$Onnv!6OtXqyvL9Po$L6NyHAe+*jyJ34?uEnYAI2kMYPT~5@@MsD z$JMhX@(~N({iM`>I|w_Zu`Q0vXYm%Yr{YfDnLUCr)ROj)+R^a>C;Ll<4ZJQ-UC?ng@ScelT9{p$yuzx&qbyg&<%X>CPj0VViH45u`sxd%jJTE}Y6@ET61R4e)v$1Sc9?`SHostQS7IqTB12Ju;u z?Q@UJO9syg!()ka^42f-^lkR8WgDwnBamUK^g?t561#V#2f;RVC z8@-mo;=?Kehn#+6>}<}gwlbfHGl-mgkx#0d+4J>t_+(bzF#uPNIZ9w9LgjjOEbWNh zE6}igcKr8+J%Hl%m$m4{s_*z^LhiWEfQ+Wmz)e^vEhVKT5tdS%;p*=XH!}}(ICLxt zad_;XEbgBTredwE>eko9ayeHr{Dk^HAM=GlNq_Kz!!mfRDyQJ)Y%`Q{`v2pfPV262 zB*K5zouw)N<1A@s^(baxOUv&0ljtA~_$MO$MveH-=@uojHxquhpal5d{}$%ie*p*8 zCCBaQI;!mf%l=P`GFy<1u@*2`448t){k8ueq0SbMs&aNtj#7Wg&NZsvN6r?;vLw<^ zcx-2>+qW9~e?5FhXZjZXhzCX{*Pr|%=^_B0Dm z&twaVg8bWkUpY7_2SiqKE6m)JhA`GUs3a{sN_pvjFB@I~WLYI?*0ig!|HWj!;ioiJ zJdNi5-8D()`)ZP(zyI9tt4aR;iQiX~vYi2`jvQ1lJ8}1Ay{fn?YoyvVQ{D3R;!)?X z2qqv7-praY(!xplZg}f=!Y5E-S}@5r|MK8xL#8-iwx^&{l|9@Axcj-nl9Y*Q&M$3vhs<}b>93sJMhTUKbt*SOPo{WMgPxaC>#vVO z^A3H*ozIJ4u_`gXrr!mo={wbGCaxWth$1=n<7p)cPAf6MFcI((LI#W3HI9?0?1)-x@5H;rPJwkCsT?^Br6!qe?^~btHEbwjMcH_}y6p(iH7 zj|@z>G?kKlg(J75Hyb>~Aq_<&w;#1g1*CdCkc0=}Z{*rQTdQ>aRsGAGy1IVel%Ib% ziNOe$8Mc#p>X6kBw3z}jnh|4T9-($?=b;=TT6Nu z2V#?!nYqL74GuFnbl0Bc<$K?2RbhNxOf)a_WS%yY7o2REL_8;6+2`6GB|Y9G+DeRL zC{oshLL@lmT%t`DF~~(%ErkgOjjcc=uwbfgolLXaBg3^1*f6TFewp;3ku0l?Co*xG z1;jrzO5yNJGhRE=2?WCB);b@K&cK=qRd{eG=lIswfj*C0W|Pdmgzn<)$ndw zP!cBRGibC)Lq_%{dqKTD8;SJSwdW!O(dLcBbxlNei%k`x?+@t%$T6DoKJcz_T_clb zeLu%jh?S}FvOJK}a**XsxK&mV+{v$9sV-R&@KxRMuoE@gC_1s)Qo9T7$MK|ePHy?h zlpt&w$*fABGN=>Lh)~(=7JsmpSENmIN<+X`&36-NRq3DA{;1^tYs1^;huQ-aLpA-l zmwDDqc4SNIUd_1zmp4(XO5}(RovXsJ6V)fCN<@7{*r#>{)+>3G5&ovX$bfGIrl6mW}W9Y zQ~aK`9-x>Ry(Z=!k-oeJvGpG5uOfxuhPF`zja|_VX3Ii7=kZ%JIdp%&y0;l4O(`O$ zFYC|jCB@q=dtuMQm{W*bU+9+{P?)0MXuHg&D{l&w8buz#7M>&oVdKna+**2`y3Cv3 zdxJ6GP0cuoNIbROOQToE?i?^8AUB$Van?dsArWFpaI=y zkEbWnY`W1Bh^tjSPa(sD(g*9?9~v#a!mb|sLsorp%Sd?XDC}TYzkD?hX?XMZ&jGJ%IQljUjYbQfet&`4#UF(mHxeVCk>uu^Dmr_94Z}eooO_wg=Og5fNsX062Rw&! z+}@Kilk0ysCn(g}D}52!R%-N?UU`81L)_EWL$4WE>XG~JPS@2NTY+cKewaZPrAWV6 zUo)_=gk``N1@|Sd8O(r&UTmG7*lE#qWkC3s4jW21}jNo zzRJAdS4Kf!ebB!~?Q9 zHQ!pdyeinVbtEUU+cmU|c5uo~eaO`D$Gjo6R0ejwnoW5hm060#hj%kr$u!L^zMD(SaKii%(+~JL3-a+Akf2mWjJX*ZKCN(9p~4 zHlSQPa3SJxo)(NO9u(#A8%8OvIKA#1K5LXxE*=$?^I86^tp{1!rGI}BdrG#@R5Y<# zyi)8YJah+Y{r7MGJ_9X^xC#^Tt|H1x#lxaPa7AbzYi=uR0Z;f&l+KSE1?8y*N8$dS zzrP4k*Kh|*#lH%UQMndVXkStC6QLG2wF8%nef?Uzc00C#AR>&gOBxuwW5=g34o9Oz z6Feu88(E`(!+kZ#QZ~m`7DI7H5J+`LS;&X;s)RUD-9V4mH#b~N3`|`0^!(zuD)6=! gTcqZo4ryF0GoS-QJkJtN%mE+kJ$AbZyS&f*3n>tGZ2$lO literal 390797 zcmeFYXH-*N*Y_JhK~aho3DTrVmo6=!^se*{O0S`J2#5ko?;WIfA~n(iDAGca8Xy#r zPUs~8LOJoepXbXvJnwydKj%xvAS3L(_S$RBHUIzln;&1PE0B=_NdW)=nUbQcCIE0F z7yux7a)TKE&3X*^3IMs(M)u zWt|QVur9aavLm{>x@6zH01#ZGl>YA@iZH@E*Q7_c8w!?gFa!e#|LaFEqcq?>4Z**> z`Whkr;-}XOasTzY|G6~*<<7smvNS{XElPmW8dcm5)4v%u06&ngB>!ecqyZrwJkkK> zY%}TR*ncr0_@7V$7U}-QT>tsWXcK@S&LfCm1N7gg`p?brlkNZC-{Lz9*1^lji? zEBa?TvV|5XM~mE~h*sCx2mfwwN;ltCq#=lNN&F$NG}%eUQmYDg!MfqbKP0Dn<|TIT0n7eK{9XDx@vZWj zcIfpk*^eq6U1d(v;;tE{CX@oFB8r zDs9uZ^9`L^hNTJ8T)LRvCkwF@hm4$HP~tl&q|4fHef;Z; zAGs1Zqm~y%Juc`|5YQ6!qR35pbw-;9arUmRwT0GmdmXOY|K@}n4e1bi0O%9@93ne! z{G8S}<(GHO`hlDqE92`J>nO6IrLw8F)$UZx?w0Sj%5kR$|JeK12r^rrvY#^W< zPbj+oUp8R}IHX?eviyM*YrB-p>VS!Pj!HUz(Q>u8!=pU%3rG`xQM58W@a}XSxV_S} zO&4xdquJV&VHAKdFwz>Xy<02pMv~ zp|4I$HZtRe7|riYonQ$*YAD9l{y0<$ODhd_oCHrXbLyTm)YR1Q;Bv)04S`Z;arfCZ zpMUm(rev$R`cIx*&+FcXnQ)hM`xd_I_z}6^-FBCrp7-_Z*9q)e@-Q2O z@03a^Pv2J4t>yF6LuX0$R}AeE`t7D1M?bw2KYsjJ>#>nqYlqNf*R3oS4A>*Uf2ICf z>hi)H7J$8obz2>vZd%J}DfH;O%WluhyTLqH|e;H?I9P zuVKHh=&%F@&i~vC50gFuSJR5uCx-)P>3ow}<-pa(}fqFw(qMV-S@gxPh zN;L1HPTQOaXHddvWQww?cGB&2l;}G0>S+4b!SD`K0-vy9|9u2aT#@M&L1>tNwusZ_ za*bx*H?n*w1|!(U(-lNAUreI7hBLKLKpbDk_AYSJHXCW&T!uczCuUyOFhGda7d zFYxx3aHkgU9`z(@fwi=rToId$q^GaBo?iHRZ(TF^vUl&hEM#$gx~)Q1UjACqc17MD zT4PAHl~ErhjYU?>yoeTSZ1NN212^$D9fwJ!ib>iie{EQ%q33(^6o68g`qL;s@pQM9 ze#PU>iRH%fWRs!JrV9$G%O|wro&w&xsFF--*^w_(?!z$Qm^a=h>jfIi+kE$CcdW?1 zNgO(IPB#v|cIGvMxAH@F1pBf?FLb%Yg3jLu91oJFKidx!_1gM+t06}Zv6d6>M={HG z+Byr-`(C%PD{35#Tv%|o5&vtn9F3GV1VSc$_Ao`~@_(ZrD)NRR3CV-k7q&^rfzFLZ zjB&A4L+V<|($#Q)qGOUJ?d+>3h-DS3Vd+x3;3Q({yTfL2w|Tvj4#mBFJ)--wl=$a# zv1zU8`j`3$EpSt zQv5+zl3UzxTY70Mj zUV#p4_8eS%pW9F$ezs|}FqvgQ|af-~u|ye37?ddoI-v;t_W8vwnirQ*I6Clncs@cMyL z@$DFfXmW|3uCCslHk=#@NtH?pS9%d7R*%JfRh1n>E>8qJUmx*)pCt(a{Q~sHnD|?s z7~PB7p#(I!=~NQLbzU@IYa{H%%!RLvPe*Fjo2&QHtrd|*(~Eo*0vxz}KRd9;>E@5= z%PJ_SG$QhnuL3W!J$6TiiyH9jQVFT9M?4!y+piVO+(5`M8M3aN?3{9QX?ep>F&%^3%sxndWJME(V+olNly6C!+6hbS$(b~a!tB^OrS(9?qCIx zae*u|%dxvmIK3#`2S2m~sMV*H!45I2AArO;(|5+bvpr+=1$3OEK|PvXWDZ6wC_!4@ve zuSo@P1Fw|@>Zzp*c!!{@hZ;R^FBYW?vrZJnRZ7*eLmCGL`3~biZWv6` z2kGhwK!mQ3k41+=f>5Nt5>6&Org!T!w|}+jDsA;g(f2AEZ4V&^Rd?o>hj#fCaV!k=4+Clyu2 zQ>6(RnxSx#t=UuPh-&ak*hl=W0(g(70f?F72e0u&4pY`;`tMLRqQ+iUl`2PL1k47z~ zLu8LxsbX^l(>x3xrHiTGJy^M!wrxlr%q;Yy2P<{S>b?rGp8-u2=8dZk2}e zr1G#l3Uv~DzGAok05EdlDMc$C_36`rpQ70V>3XuI%Y&MBskOV+PCTZqPsM^Z5wCEo z8xmRq0Jno9(di~^+8=Ska%)ZfPOQ-TU))KH?0|fdV;l1^)7Kr-)8nMU`ojtp+_$O6 z*$lKgY<0rZN=xIe)z1>3R;?RQ2t-9fUctbgSA(Ay#J%>DSkvER}hYBk7({s;8;) znINuk=D5)m2h5G5Oxk!)xE;D<1LY}zlF^7s@06J!Eb7E)H7gpk2RzSI1D@e?C`4i{ zb~7m}v>msJ%OxfqLk~Mbh7-5{4@>EP{`~bxy0p7JFda+(Toq(itIDyU`MNvSA2BsP zcArNBG@>u&X^U=P&z83yP1=xWxr2V2{j%8LkSaP(G4$-X5WI{09>iI=0f^A)p(bwP zwQ&6y8Q~g&@G$fJ=;W_A#YeR9CoM52k-l4^5vMZ!dsba^^F-<6&g@tg2kXv9dAH`| zwS?149}@%tC8YSog_v-hUszaPo@`^$HO}gyoBLqfTdJ?P3dO?6*!daBAb-lwvJ4mV zRz9s|X)}$vz)|$qLgA?kx>t5P6*Q@wTAFmuF3|hDx>HtW4uHZ}ApxUpDh{WsxLm7K zJ*h`y$aU8S3XuhUQ=pWw#=)v5eMc>^^iEq#n8evDlhgG?tAoK$xq~3f{wqPT;{YOsfAZ+QC02`@^>aOU(mWxSFl`w&5f2zBW^tZc+ZUw~dtE zW$TQDMisF;HhY3B6smX5OwVmZzK4q8dNYr3+jA`%^L}fRA7ei86YqGIQ(nluJ%7)> z$`FVW=2ecg$p990WubB;z14{^Xm*3T=Js6Y1-KT-=-@-Z*))|kjacdYR#{Kce4uBc ze$5l-)Nl4$Sh&BX`IYIxir&Jb_Owc~_Rc9&lGt3|&6~dKc_hpVF+zH|YbLfiOnwVo)cgA*Ty zny^LV)>IARq-dboHn&2jWx^+?)%SEWJdAUue)mcH6?|rDtCJW@6J*h&#t%m-(;Tj; zyWirT`c7+jeJN&h!kB!;PVC8C2XMz_#~k|bE!js~&)A2{oT-nmf85-ehdASXn7%dL8IlMG{4i2L>9z8cQKjTk>96o>8jgWwopJ=)8)BC0hjUDsgh;00KW)EO!67z8fUM&- zEokQJL#iROID9sgu&N=o;WjIsOvjEh%PU2z@^!PMm@rZ z$Yul|T23?aat?}Kp{SmbVQPn(ays!qB6cfQa(x~jDwSWDS8Iq6P_8N2L`THSyRNLn zt6D`dC^{xTNhs61Fwb~jU-e27kVhK))U;d8XvNW?hfT-ga5cWSY-u?lMU|lGF2I%k ze&fsTo*oq#oN0L=y{;Pp^$bw*5PP)dw)jnsTGFe0YpMZN0@*f%DJ9D9jCoY*pH>W* z?4=I}(o8~`unXQS!B%9!%l+|lkIY8^A7Dijw>0_&AN03WHWEwQYeTvGF?2`18T>wG2Zbes=3W`FJPP1;F#m}94EmNfHaT`hjj8UebD zeo&$bJic6BC|NM;RcCc0#9m!_M5YdQ`e=6;6fNXSyo zTubl4ikS)&9vY?NM?Tr<7N|yIw?HdC^5_eu!AH!jq774E`SCZu|4;yQFp3^mJnM(% zrbGJQ64n<9s@(tH%}{+Yc5zmAML-k=3@w8{tSaTVmF9JapgqKMFo(-4!-3^_nPIWQ zLLw6z2A`;SS)=LwX9Bj{_`u4^9Mumo9bs*n5paduK^BEvmzE!UoC5?Q#e8xf-ACB9 zfI`mJL140^so0fPvsN9WgSFOBLxL^^faQutyJC3EoW%SXFwW=v<3nq28~vG^%z(Ed zFi{fR z6f+8$JUsAp+IqvR@q$qUhbn>BhOJl+rt=mo(AjJiGuBYpXgs)RvNYQYVfF8Q`qO6K zFZ!4|aJ`envU@<3CmebBSll{E0vq5U5HWV1UOWolR-tRE+_eJ!%n*0@bcf@>^CFwf z?nAN{6wXQ`?09gR)+%L{HS1BZWb=h5v3MZvV`4GT%)glj6PMzQ-TyZ2Hs={*{)q>p z4DyR5qnqksF<-CKs{CvH;upt1Ii?7QjlPUjmzYD?Qt0O)xsnefe4&LL5FdLKHQh+r zkY_U$`gbK^Le?uKdy`EMDnQN4dUjK-oa}Keyzg#*TIkn;&mLb=14g8RY<57ehRzQ% z7gOy<#oeksJ_d8$3_c+be!97afX5HFpLFk4nPGW+_d>+Fk$$xEbRuevjwt6DbV(5y zYN*6-Il#aPIXA((Wc|iSOp(oUHyV+)0G?`9>yFBGwOWXxUKui+h|(}d!%4_#`H-II zS>;a;c`O5VZwE6g=I=MSkC-c;y0KWH7R0SkQsRS1PmZKFM5d`x)KH0@NkGJLH@orI z&$Avf2GcFr&y_~)BgREUg_33toQAGl&6Nh&RMiYj9>NQzQ)c@ZjTJ&i+Y=5I*{@_S zH`y3Vg*a7x$wzItdRzsZx*@`%QN}|uoXLXr`ooUHDAD_zZrOYtkn?58fqXkpcL#O| zg6;hx!uIv(BIT1vgzh5)>>BHI-EJ_V*<26MLPm{LN#OR2dE0Je2kbcUQ0%7x-pT7Osqx&uAMvw{A1LVf8!5UGT&`}CH|FXCT(1*( zo9*>oG;aHLfsfc{fvMjPKaH@N&wVpgGbHAqAneYF4p6xD?mLee+-7*g8=)-Ee6-a6 zvH*vjmWPSQL!M_habDXkCle%9pb>Z#TAK}MUPA#uK~wAYC#wwm4~NBG-oe`#d%)tK z$6`;#(V=|_ELsOIKir}Ut+hEYZsrjenp=^XPSPD{g@UznH9=;|ao$~6MwBXiQ zqZ3=*XlUTCSvoOAJAf?hY>61qvK2BdBY2tS>$mWQnB&||2DUE(cni@uC^-wSqrlij ztq!JJYd@K8@Q+nVv)ciQEvf(M`rNcTne;0p;QP|B@+)_rZ;y2+m`Vju^m@6mk6q@GkhGc|_~$$Rco z7H~YL(cPQ@Ti{Tm2d~%ezKcx-YSpf5R`m}aIM($?Fw+>{& zoKn3PGM&}k4`i2!-Sh@g1IIbv?r~=b@fRDq@&HYJy=MidTdqFuCxl7)c}#3Pe-gdx zY2K)C6>oiGB_$J@YLgo@@N~L5GUw_OJtUEW`+>Tt(_tlFL-e79DOysS$23X=4%>x7 z4Jy3W?@N3qfjb8!%m$HPKUhf?=9Oadbz5<1nrooH2ybN~p%5n&`tj-hU9zRFA69%Y z-2R%*L1%d6;BF`_K-B9XY76A@vev5a=?_v-4)a1wC1-$a$s6BaA_%d8z$sq65F%w56FK_iEK#SC*pbqC?Ju zuBBMu_C`JN$jIw%^SZjb!MZe$_)BAJ=7EN_6a$-nWR3V5sUevqdf_TUoi>q?wR^3e z3N7Nu4`SRkuFo~B`iJy=V)^K3M!ZkarO87;B@7fTC5=n-f6e(LjH*B@7{l?pQJ6IKX)o2V^I!>U3^!e=S>SdqVcKo_y z{ouAFFHTT&5$}V023jaemAT0HF0FN*f1pR4+}zECMF*bI`=`AW8E4Rl22RM8(4lIr zGCk1K3zhu89eWo55p7RCwUK^+;--y+lHb3VwHvEWtTb$!oSHLy@MAis?OnvNsN#kI zxV?L5&F)vQsb;g~&5@1Dqxr#9HdrO@kk{_?t@xp!WcF3L5V}wYO}_dchZzoMZ@9sh)%Rdo_#2~H&}qXF{j+gnaKotGreG1cib1PA$i&?UH!j)y zJ3gE~iEd6Ty`6q~c-WMYxeUuW`Bw(PMd-$R`*T#LPK7Y7)p3UBXbaNe;8iGYa4^e4 z9%HWPHqdrm(t6m$T-&}nKt+yPYNu*hkow4J%nHEF^F+7%c#CO;X7-Lp+$#}$&5&Un zUrk-OWGKN=2t2PNN3)fbUw=5x_@DhR_=Q;7rdt6e&Ec-CR%GH zG>IZ&fYv)Ru1H=BuAC6s()u~|{hk_dB6X&ryhSp{u(Mz-__eiSfq&|x=CT{R7g@>r z5qGox@Zfy!?_qe7m6<4qMiRS@u~>cJ(Bs~bpvsd)8&Q|N2oL+Kcc_j!F*1n5yRCC? z=%QdL*k-KLk36S5>p89_u&15>x0Avt`<%1l0#A3nC}sr#ZBLcU4YF%}yanjpA?jI~ z>Z{Xy1{Us1TvFa+{)zpLKQcWSYQ2Y%%S|axgCUk0x&1KmO6uI%oD29L?NurGW3cl?uY&2{6Sve;9pTv^#|M~!SjVq)vMdn!zxJU&AR zj1Penr6{REC~Cc4Myx8LE+a(fmwAKRJWZyslW@fiea^>UNz$s{M^~;1fIEBm-!7v} zHC~6x8O|+E8gVGcJf05Jye0rhNNO_e87Y{Lqj7f09_7p;pxhoCu)D_$2|{kZT4GaA zX5SU(FrMCRw-c~NOu6bQ6V4EE5Ba~8ksJCP3||EUx;7W92xCPY$eym_3e|nBq>4Sy z9%?X(;f`d0TrG9QOW5@!&>_a565FP$H5xQU$KS!tT zke%t4j#ySFB@W%k=dF9EhD0(8n#yft2ucI-iK-C?qCBVp8>jlWe7_zhpDydjT|Glt zUF;s1hkSGMp67ITB{AXZB@5dmxZw$4c0Lt3SfGh#j9#M zqDMJili2J(zLM&73koa!;ZBfbR0FreRoitF4}S-_M7-(daYmI*TQD#a1S;kx>cki&e6I48$Gr<Q59>|kX%#mLzUT|u{?b%GDlr`tf#%=lK0z~h4CYo=(gBKuDz3^DF( z4iVo?RsDIusHF9xj+?(h#;=Zs1TZ zC1Q|l@k}vnu>X23_Zu}}A9K4&XY{M_n{PoM&*_FLV?}JYFskBa`sW*()Pg==Pakt-iOAGi4{~(+tZpNHe*1$n zca?I6z5{D(+L5SSdX3!|^Ye+@o%~h3OMSY-OKGnulS>}GT zX)eCH{YV{SXIHtla-RMM+Lf>MToQH84vyu8{{4iQApLVf(3m%%Xz7VB?N8adJ@$rv zpwN9ylwxG6f1DAohQPJo0VeHN$80@ct-hw<#g}ix5YwpRPflmk@32eu3+$GlDZNf* zeXDVPtL%FfA?hBo2_ni(K!hi0TG~EXxwXi{o8RaCKPw#)N^CQfoyepR(|1V}zPw(u zN#Y4t$5K%b#fB6_+s9liXbnd zo@>$pg11#Su-z#6V{*Kw|HtSU%<<_$J1wy*zTFOmZqm$@lJAIp=ecv|&M2;-G5?~G zmkM9KW$IDy?UV^8Yx#~JLP`~Ckli-my7boCnj;FxFoHBipCsJpHJn;%IwQ?wUQ4e9 z`(w`KrW?^;y5tpOOV82Xmsvb52x>rn%e()qNUqleG0hawBBgNF2fQF_yP4pp0n}WY@$*V z5X_c=@9MO!^@AI0$F5f_g1( zFsBj3ZBA4G$EZy{wObxB@$jfOUR=cfv1Ni}vNyeFR}N~W1tP2G#KnMVp?mKQkz*14A}1*ZZtHAwtF`O6fG{MT~GGz`2Kp)ljPO>d?B+w<8>rr z%zdNY@JA$7a!Bao5a3$i+XWHPF&wk!!WX)~3nS)#qC0Eejo|f~suvW53{QT)*BBa{ z`K)TSA#PEK;-TM}=NSg$5G%)CzNEchNOcm%0`wdIEbM-O;!%;x-MPG$ER*(;XM=(p zw4!>=veNKt(g}EDf`rUNdcB1{D47M(E)+^P&+}dqkdKQ=e`X@=eA%$zxPbZZA;i*Ii}$KP{G|{*SeaKPNwy@o=6r9g{IfcN z`^kyjwD)@9@<56b=^EC!=1CI;7+)KTxZzrM@Fv^&hvDG&vyZN3J+&I)zjuA#a{}Jd z%BneA0oIxfhNs1P(Hpap)6=1hml@MU3^qeqe8tI+MEmz0SsMy<0bL-In0av%vBtz( z`}^{#f`EGGIX`zGW8mP}=XOsqM!X^3v9>o-aG-ja8s)X6bGvfP)wUty1(9E0FRWU- z!uRW&z>Vp)NHd+}EHA?lb3`L#c}ydW1B4f!7^!^L~P1fN%X z-TG-z5>47IkUNXd>PJ6$0@Lsyl3=ca#slA@*;f3P(Q;)uhA$a|+cdV`P_NZlT~G_2 zRpoV$8%NVYx^2Im*4a;#3yl`HF}d7d_y5`+X#M}f;ne=AjI~iqoZD(m!>)p-O8oXQ zer{aZT5b2a;>;fMW?1ZO2AEvMfE>D$?Ya}kyuLK5iQr?{0}jrDhcVvbyY#V-<47*g zO@6QRm*BE!g!)pn=G#t%KSsuor|A7e;X$xJt8mp5z2XtR6Q&dP?mF{Zyw?R%DGuJc z5zI^rI9)!x>Z7_cdUG-f^-q;Jk)~Zj-=gB_kGr$9{A-bkZd<@+;3=M4!%OL6hY`x& z{#-q3f*UqPl>Qcm+yzEGsm#KYd~%WP1e9nmI3WW}yY+=>07eOljn!RR$99X$7llX@ zF_;BigmRsEG`Zfk0mu#qcJ`>OWIl+wyN{8p`0z)(r(MdGl#D2|hT=Tqw^CJ<3^?mf z$^mc5g7I|O^z6bI-x{ys+atC#t&Xi(e^vDy5Zi}Co75~ke|VHN<4r0ExJymVh#|n? zv89w&Uw6b9x2Z5mT2-iL*&RR)g-3Wfp&}j*IAcH7n`zrR&L9>C{LXTIQR3o*C&r*- zsp}o}#Iltt_+UtQlR&4n>7A+%xL!q$%s=^Bm2};12Lbgnmo!)4B!T0_yx3f1m`t&1 zfS#D=HoKvmbn5>YE!2C5#adm0;Kduc>%Yr}&-|YK$-zj)E)?-B&NEI9eIlL>F@T$| z{UZ%34t(0C`>jS->_BKR;o>VMIMkE$(cB~`@Y5lvPF>G}g0qMj@H=2Nkp?gV_uJG8 zIA^h&JeR90ANutouyCi%yJeq59PpMR(17#O_J&p07lP593FI<%L64?0!`J<>R)8pk zX9G#ko5fPM%Jr-y({K4r6=;mzfDszJKsj~iuaQoW^`A&rGFPsqV9;ireYA6&Au;|d z$i1!_icQ(otrWa0zS2b45NZBn*5&Za0LP(hf&T5zjePz)gwz+9=Vkw+4TERMC)GEe z05n-0K)&F4*}fE}OoT5O++$ z3YCEH9k-x`pzrJ|hioeY?t_HFOn~3wfIood+*wSVfXxuFdy-wYGLP6qZ=;xIxzYYX zk>cXZyQ!jeUESS}@;)N{CffSBVku}}kL`^>>+O-?`+~c1p6?aV22&@oq^f&EK;^3L| zIzA>mJy4wUcTlRy|G?rsv}OIv>Nn2aYCD%^_9gWtv9x?t4zsw|w(yo8d{Vc*_7f}! zF0>lR4up3ES-R2N-!>R0(=9oHOHZaS}D#9h2OoVSL0J>1x%t|Kokh5~9b^o4QybU7RZE6H# zC0MlPVa#SX2L6yNc;kqnIf`0DsdzZe$+~uN~ zNI*&Z`5%8!S+Repc^>qo8eNG^40FKjpm+^8WT?;{a$aU_c*d&rX<~`0$l34hnN3`Z zI_JGAEnVYgW>Ggwtf-G;_RcrdeF=Q|YF!k~+m^_xAtF(kOf#wl=%PE?m@B9dbktv1 zs=Bv+{~3n#9!5G0h8rIX!k0*?vR4P1^>d}FKmuPN8g@8kJ*L*rk@Jzm!jS&iA3;MQ z5{LK{YU{zr$65;zjVD}V?LKvb$($uB zzZ`mEvJXxYV<6{t;)Wx|db=U=&wc<_u=hRg^h!jt4xnF6Q(BKo4dI<8l%#t`kk)CqSW6g7Rj$|9N_%~9-nU&Y56fIQ# z126nTveX)vJ){iWX|+7@OwQWGg|RE51s28`%grYK^YhBLN59(u&?ol9UC%~R9ag9K6oC$2PIEI9s z0u+Y+Am;VWAHd3!vle=*&K|Qz+qzK0*Ex1Gy-v?`v7WknH!MjXIr%T*Lwm(;5P!^A zz5$bkGOb3WX$9Sd0`;40^Xt;;*^;~{Z~A0a>bHe>#YiAkf}z#A3m9pv%)JeRIpvCd zN7hto-F!~`(*L6_wbIUSjnZ#oKX;s-&HEaIQ8Og6xZ`aeGP+W9O$**@h>yg#k4Pbp zs2-4!t-sx_fCf!*3O^@l-X?f#M)WI3ta!NVmxz4-Z;g~k6*Qou;G^})X)6~Uvjx1{ zE*P|BSNC!JM(`hAd$hFR|II&Ft8H~((g4T|G| zV!gzjJafct%9r~W#XgJ{vI`8@117Wa|MY}@C}^S8ddPDUXDai=@U=7w(-?5EjXm&# zfx0*ADFNwtfFO!??Wu!JHk@7ZPX>{wjW;R(lp0YN4z1q2XWC)p{$ps#Ep(vueu;|J z&tHqHte4sZHF{UJbLB-6SC#%9USla$tK+gj(?>sHEgri<9k*W&W(ue&Cq1>M6E7NW z6~3aw`DdRCGln3Mt2SA*kRGCxM|fJ~oNefgv;SG(9?K~I;0_t{a~#bUAcF2> zg(^e&2Pv}UxYLy2he4Z+NWFTrJ7N%th#VF=wmn5{N?C3WTz4i$w4a%RE(h*Z`{uh6 zHC3!SIpgq-r~ffMi_LH@MJZu~@Ygqo!qfsmVIz&YoW2ESRI#DalR?Cs0JmSg5VyT` z_P#`>$om6m!#C_K6wb;-3_$g-?Jq21P13}CE452qLYsz=HUG;E&w8!a-_(Q$7{I)Q zqJFjvGnBb1c(R)`7mk;^ww#vv`G0;9${b33`s%HQYh zK_Q>!K5LJERbc-;FcD(XC2Gf}%I8hh^5@V}cN?|%N`twDNVrLj=0ol?ZRhs3j3izo zLys@BAeWi*bhe^EBdne67SS&ZAflmJj)ABN)45Vu&b5vi8U=4I+WD&;2?vZ{1a=v2 zfAh=MtukP%GW2$7S!gAj1z+IkeaokBtzvRsJ{?Lvn;$E8QmA_u2^`E7AKW&*X?>j% zH?BB&PaKba@Og&oJ|AIe)5T{$!&#zw^VH&<5|SD(xcrYP=BAMMMKPHjTAmr+3KXe$ znduj>fIEanADrKE8t{Y@62rgUnlC0*?h}A!lQQE4)wGP^WFky&qNe)rAwV?XBtl~E zm&Ix^rp%;rI2N?aqVh2HzzU&wEMDGp{c9!bq=gZLcq7p4Dz9g*+5qqLTaE9%po658 zEZcD6p8OSZHT?s*ZV$?EdXAT&e(Fm)Z{bz`K{ADzxXj~b9?>^sHl?!Ix^RUcvo_tC z`fba{f3OhdmRiLxPzU_hh;qVaXghgXnbNKG!Ax;=1J8q=Pd{`=%yCgX;L6y#&~y*S zvmxx{!C8`Q)P~+Ec

|FE3dtpBR&HNJqStI6K|g+3*-Z4f>kd^RpXH6mB{HZP@B? z5~5o5Tke)hs-6*$@tTRpGxz=@3ajI0vTp2Pu08WaMYC?o^Zf;O>SrfTe~w)tK&}67 z5H$U#k1or22uBBUAI$<3s!2WAAEzMo(uSZx$gU?j7>_#VV+Z$vs6#<@X^@F z`djFIx4pgB8zMgSO>HF{PjPsgK|~(TM#U>u46_|Ag^yS3%$=N-nCT$~MCobFkgXTG zc4s~^sV^XsmuWZ0td^{MJa5z!Ml_H{!YnpC1jTfs!ki>%Ih%%)-Ej~v`uH&$Ud5W1 zqAW%avB9rCZx;&!@_QOcsE>p+lJDV@B~U{Mc?Mk4FHO6->7B1V3HjqB@@)U!Mkfdj z)Q;r?o~%@QsPcgc&355=fhq`B*+^hv=Hu(kB7ORZfKn2!&OTaY1F3@my+$@jvc^Vj zljHE+D+u29OJ@vHOzj;T?DE2|m*{v$Xvd5!-L~i>o`uiod4=?KFU|-}p4_1DVA}qU z&&{KrrMcHoD2fxGlTbg;I>k++?h7V%w>!PJ+KP0(8mOy^ zvSZDPB(?=g&AcLgz+v0!ars+ry4Ei8_G5m{M)1NL=Mt^a*3ltJ+j|3mi23k|a&6%q z#z0;-?Eo>}3O#6|X&^~cmO9?bED8!#IL3wULw2SMuI@9baqropocn z=QzMKbNQOIhrh-HtNOP?iE2QVyl)?vHJ?~sT@oEkC-CB_kR~4Z{Eq0F{GTQ+FkGm6 zo9?jDOgZ-yFZ$+l;tOAz%@Z z6!=xEH&dg5SejkP{lo)Wh|>S~w{CK2u|RAi;s3G#RDY0TUe-0iXE5Dr=G|ydZFetq z0*g5)o-S8HtY!L>IoYOJ9^eElhm3o|`?4ePBFpADmiQR0v@j11zt}9A1}F}PXZC%c zs}8t3$u49&Cgy8#)lSg45*d*MEgw%vFlg1&xly`!f9pQ}T>3!}cjD7GUK9Su%~_hZ z<}xtO2Uk4VpQz|9qCuzxXls*dS8w@M5ld@-cHFp|z$ZieF}D5b2;azE#`ptljEURk zxE+-dZ7JQ)x=_^T^$br)U!fg+25KJ9XKF*eB4uUe`@^D*Eb$cS*Ln*w*L8;ej=bIe z%g~t5$ze2`$TpS!WNsEJ9^<5BsSE2c6_3D)evv-+;pd?1nfOHBMuBF$f*appl@f|) z+u3ph*@16ed3dE3v^nON4OuMrZOs0FtRk@2V}{<^e8k_b=HV)EgZ;XuA<*@q8Vj~U z>}S}(Pq~^WNToKMz0%~@=hMf#bf=bmdfiQ%35+t8e9t7mno;!y`NF@@wqSbqV2^X3 zKuyrXcB7>sNSkklb21|R$xJO0`d4&)nfRjS!WV;-i`{8SJbA!5&n&jybdG?UoJf$( z`r?wB8-R*m2pPn_&Nl{988rA+skD2DU8DV4kA?Lu#VX@D=Ruc*5`dy6HoQdoou?SZ z+NIcY6MUD+>FL^na zL>ttqhT_>YoME2$3Ny1Oy(kh@(On1wMC62DT<)*UUNrS=ZAaxk*C}q@Ed{LX<`2Ia z-Z2^IC@HzvT5XO7h5JDtK8+h*%F{d;AOQkKVto9Dl{vnwI2iKyKcHN5$LcSIudI(O z)$SGi;91+PdKX*b^65Lg0-^mj=bJFFf6QK!>#z8taRp%>@Cvh1v2>e4#IJu!_B*io z_G1q#duKHKjG#u`VFKR?Tg7aplFF~^G>w5(8aC+up|tC{HU2~93wOW%)>hbuuROxW z6NZ+m0|;k63I?tT+tmeXeHz&5Pm%*w`=xf7Rwu>fcfb4Mj+Zm|7O{6O}$DgWahI!Ro~YY0J%?_Eta!Nn*U7vI**cd3@n-2ZB( znRk1xFVNiYGa|USZRQ=hn-QnUa|*{Q;l*t&WNtvMEHOEC{Ick#^sk6FM6>;vTu`7q z9{Y7vhb=lPmfTD~?zHSnU{6GxPD!yiOSx#ii7)7hRl)Zhns7+?Y_{qmABj4C#y1UR zR#egbQ5nL{vs_Y_N0CVP-9396yUFoDQlev|GLuRQkH+ZWe0P)k+RBPB?QCl$S@P4@ zvn%IYp=)QV>w-c8QZ7{ipPg)j^JPE2HN~yiab#22wDVH)TkiSt_^C>+4TG+}O$}-3 zTg>G`ln_*?^lfILhA2rz7jX6rzmGY6DuJbc$$6U@zRO`eS7O72U911l++7*pSX(Tr zv}yfwuV?w@?$`5oG_8Q%Wb6$rAlM>1@a!IV_vYobhbdeJJb@&wi~C8(5(@1?+QejZ zZ|2wjlsIxSg>2xh7eoF^BS5s!qdX;#D)?`QeeLuoW&XS@!>v*|^Jfl_Vvm+Wt~L|M z8lSM^6f<`YIJ>Y6v?O*_Vyc15M;0#x=ke@@gc4&?{IGLNwPli(Y2*Gc6SChD{au_B z{t@SFaz$E_8ae#mOLy{;CAK2fSMnz^u-o1N<})bGVpaALIa*!lP!#-G@Ub-0|8#*r&pW`b zP5$f*gY~E-a-$ksoT?u%#^j!B@OO17;@fDVl&O-zWxpQkf7vZ15<8^gj(@-jad*(- zG;H15y2o!Z`EnXFtiGhx+1A|XO8p+m@#q#6uV)zszj#Pc^-mPq{C7R3dw_ub@nSqs z>V=&*kpT)-+F(WuB@2SuX7HX)Isfm$oAQ)h&6Y!1N;&qUuQ>EtM>uPmFAs2He;Nv$ zC$#GCD$a=s6$Q=B+`YF%mp>xkj@L!$?Y3n`l=882%~k@_tt;Tutw?ZGnH%xZ_ErsH z#Kn25r`JS=)JiA?Rm%qx!E0kRbBDF|+h+W`1;cVgoHA!#uIa^Hx&8yqgYz9(3ifWo(|Id%-aUx$Ly()D%y5%M zcq7l)qL0|_0>sQBNw`jrdBlm{(WPBt4ByveQ2P~Cy(wh1Ny2Zj`WWU3tq(K+3fVt} zdIijtGUu-exX)bc%Ux*T4*|90avQMj#-#sx8#n$753JeZN!wM>{7askA*7$#re9TM zUi*|N6;6TO11twnOv{a^ z@~@tA^Cfm#-RWan`XZC)3-qpoB_hSi4PTin_%!(cu=n2aRKNfK_#sM3q>wE$B-yfO zNRgH8D4QgN>`_+Pdn+S*ugp{SmU+x$6S5ua7~hL}z4ZRPdjDRx@9p>d{rCANPbcU3 zd|ub}xE}NVxL=QW#%}dzjhR-d3XDw|a5RVYIWKg`L*XVyLeL7W#%i9S*~5mtAHpL^ z(E>gB?pk*7dQ4QVgs4}F7XD<^TxN)bnOu-%tI4%gywKNrzY8|l8RsRN7T1$0F`ye; zjRW2Bvev}uao%50oEGe>F@Bk8oo3s(In8{-kgLym>&ZvQW3%gf+`Z%#NsHzih~c zuHc{32ya9*h(XV>6u=T1EDgZM)N+(Q8yjo_iUtx_?18&Ja%RxdhbGf?0XQUmp-kb- z#3;uYvHMWC<=b_=@eR;qlAdQ0bIC2NB|_ei#rn8-bw9Le<|CJI%h&q1A9iPgu=Zw4 zhZT91B0dyHhTIoJLhvB#PT^v+i6M@(H&8l0fsvq-heU<16C|O^t!JeNVuR#RR^OWy zd;O9%6!88^>Gv-$wdUGG`0YCN$sg>%Cw#rQ?$FWu z$e}{|7&4F$2Z0=)kf0#l17Yh%zs7=UPt1^hMqE-e;drG({jL}ltC{AA9{REE@ruo$ zxJo=$y7w~?w~6)M4A{Pu)lYRkN#76#Hz;Y^O{q}cwOnZAo$1%iD4r#qIsy==1 z8(xs`PGF+;=I3aHg;XE~$I91wA1vPhzc8)x5W8`+ItSr+fm!J?(}s{AL!ox^3nII& zXY+`pLMs!5)ZSNGrxk~7k?vGy~fLpR0k!6#(2_) zcjAOC;;i(Q!@fIuz~B}?Vduc<)XRJ?DwGwd#hm+joF*#5XrvlK2#f_VmX1g@yjoWxWUXp~aoDAyIxh;Z*R%P-WXhA*d8_m18h|uSl zTJ!nit}A|h$IFgGP7BYhx;o~!yJp*I^q8LDn#Q_w68>VYxW;rWvVyZMN>zf<39X{l zv?b%L#Q@Emlv{Ob=cxL#RKrbGEVu$bPR8#emmYN2!Z8n{IDH`K0r@d<{K=bF8ygy0 z(s{|d~+ooaahqWAVaP4!b?#%`-qFl9#~qvX5m+pAR1J^vKD zfX}oV&`rz_RG1x&>F^Hovt90f?#(jyZ>4a*o#ys3)WBTr zxajg@h~0d-HA6gPJ@HmQu#HL*`~0!sHxfueqWoPUI?78l0q!CW*S}?Q^Bs012s(~c zxc>4HnA~VBpDrt&ETojPUADys&Aul2)YdB4b)-@yFu&a6aT%yL?d>)VfZ-zg2)v0 zGXt$IA;p@nA$)@$Af%`uQ+uYKt-?2U zE}2u|-FA1~p$wfqjt>>HFOpdy`w7W3`G{?Zjcc~uNG9lsDg;eJW$f1R@k|J9vjF5QHMNf zf^uQ7o3y@)Moo%s@|hq5fH!@Y>CJcei8noP;!PXR;*A+K>@fT1#mlx4#mM$DP{=Cv z)~H!jfgw8x4Tw>!jMgqc{k{!nvfueuqwFlr?$bPMT9Rr!_gPsmAg@vUrye5^o24uz z^*cv1A*$Oed|_rP6@yXfcAmbU|CNgFme6AvC#NdSN`PPq;V=sLKpA-cs>sBwt@oLYhrBL6OGaV|gV>%>uiSTw%_Mup{CD=-N1NIUzI1UZVaST5OZ^zqycCBUS zdbtl()v5@~2qJle>Not!;KC}EesEYpJc#9vhgIJM4LR=A3FP#*kM@kbM>Xf~lpk)7oG@w7nGIwwZ2kDo{YP_yMHR${ zzF=^mlI3_xcLP$IoY$WnxPlIzR9*Lj``^Tmp{Pz0#d51uPR;c?7lJxM$ijHl`>lAk zp5b2L2pwCcIttM)IKyR5WE zWh2w*dkZhAq#7n1WY}ZnnR_pyr61Q>?IHUZ??vCdKUH_#R_4yjSI?3FBb7oX&{82W zHldZ3&=K#}@x0FbtN&$E&hnQ*0hl*jaaJ2-fnJSIlW%#GQJ;}dQZ}kL0rt>DNZ#>0yi>rJkqmg?kLwIN> zkd5!ET(0z>!2sKyQfv>xo8_kU&L^n1pxeZj=?0FgemNeig0F9e#-TW??X5#`7i&wA zKgJ-xn=`7nC&R)Usry(<0`Zl97{5AwJjM*zqir$xs^*18S{2nSVi8e@n8A1-0xnxdqi^I z>FPx@2yInb0(SsKz=bdB7irD0Uav?-KBG$=L53?7b+Ei#On^@1-im1=OyNc)dVcWo5n62l>A!wk_u9!W zEyFl@UnMk*=y@?f??Vpwp?pUgwGP3!$o|D}4Hqw9?DzfgXPUg&)BQ<@ z<@Oeyc!_G)TivbhkMPsqqz8ij^(qwvpR7ql^Ckp8T`OpN8Vw6y->qYUl8UVIk2ECz z@ojFjMrfU*EO^~KVFHmg+#-m#)SqAOw?*=x5rNS12Dq1sL1-VBQ!O{0!=r76#C{bP z;k6b2*Ka>R)p!x$t#w?P+$Jau(XRXvOa31Mk0Ip-k$y>b&fF6s{lQ9fIPe0MbPyW% z8&|iNKfM0qFaNaP22XbJDvK!42}jD1ufpx#G zHOt~h;7d((r?G8PFU{Wqd!~b)_*s%-5Bc_Q{=gT>iGv2&!sBl;(< zvN`md!Enz~m}vIpusVPh;YTvQ0dU)vZ2h$P#VikU7);0C?%e#_KX31^*Iyo^vXX6@ zQm6xPCyAk?u0hoY8gFS-KZpjU-#T;+TjxRx($$HE4DTDk(V9Gc-UWSczSV?TMK)7# z%r+JmBE_07*G5B)!c7QzABmsx(w!`Xk(j})LjTs`m!c*psm=)2@AWpvA9&eS5O(jq)* zF|nkB%AIstK;tlF@9eVA-k#R-n^o#5aPtb}S>;XfTuPDts1-1-N`7p8fG}lzU@Z8^ z#r07WQGD*74T^{~Mx3i_|6QqW57nci%naOQx3~1deg|&Tc?AJ*P%6anlz5<=GA-^9 ztPHu>g50nVim${al}Y&i-56{__B-#UaTjx4@0Ue%*}B9>1>G9iA>$f`eN;YLOS~+2 zrXN3>Vsalif8i~|htG!iv?&qsF~fU;dW~#nVUIfx-CDDLa7! zoEIPZl{b@fY5ZvpCjHw>RH8L^T3)<>Bg6yNq#hP4DDo@L&-wNg2P{FqE%(A`Y2VRm zJqRLqBu5Lnl!{G@8vOB_4RnK{FO@CxaI?6?(|;>T`LJrDyL;FVRWJRsC382^{&KVf zzr}Lnsp0u8Gra^nDJt4-b)5R6>L=I*M+Vy(syKCf$CW!iY)IMX&;8b+IIa>VCWNeL zcuiZZzDXyq18_)D-Dc=iPd~pV`o5weSTGzXS4 z=cpXX(1K!HuRlEcI`lhrl`!VfXhqkcVwzhwBQ{VkHp60hXm~EJNTsNb|DhCq{W_sR zum+}qIb1lKd&M=dzr+{F#STufVZpLpH_6wXcYS z@oH~YRmi&ar6`Hyp!dn>(oP;fMx`)=bfMRV&z9~b(cNP-#k*+|lKkjYS6wi{bHY&< z|9YDuiOtb|)CZAHk`|*z3%U#CyOMYXLoR`j zE}FwI|CA8&B_tMm?f3(yvMp>!Y^(7ZVT;L(tB2~51h>3!d84F1CT zOO)0e2CcX5S~P(bggN!Xr912QmI?8L2#>bi&IRDD z7Z62d?Jd^2AmKYgirV6dg!EUajnsaQPVtn~OQq=(Uc=?Wb-&Oh*M(E7VP--W%@ za<5o1e3VEH&DCI`bQ(kq=GkOL^i&%0l-n#tgt4fq2apTrR;Sh894UJq62_>+_u`Gm z&#?*QqQ9UJdBy~pTGr{$bp^}G((tZ|JV$%5z?w(>v$1b?<9yL4nP^42HTaxtth9KqwqI?{bxK*=w2@w93jD0XXK^K>`M{#M2@jUl?6=!1#V@59aowOE6 zIdqN6FCy%fzLUs=(m%=;RK0TfpL^@IGUlisY&f0MgW0Vn^kw#n*e)aV!my-$D+$6`S~3^`7+ip!N{A=4(c%5)Fs>ENP|Wj7&aOM0i-&UB6^mx4H_i+H*R}DoM|A31|k*ViQYk04PHk*n_JaioG4V{a$Pdb%rd7(kdvxW_}eu3rR zJ@H?j7236z97m?`TWCRUHZpxo4pETiF&{^(jdr@6$sf_ZlFN|i+m~?1sc}ezv23E= z%f<4^FoikZH7_jt=4FGoQ|tL&u}WDzP{fxc3}^gvCrwI$S(i@6-V5#Idz;={Qh_cE z2Cafo7wgAmP%*ysFJNEAy;|P-hE@{}l~}*8iV~`Z8QPCie>kt#rkZWoUNu<^9R;u< zX``VK%oCK5{nGMOqe8Y$xt7&@XKDvz$}DJn-yNsu%}e5+-pmB!#2i|^Dg<~}hvhi~qw{*10EAbVrA#`n338g~4 z9zxdMWkZ61F@hSoG{C)GcAkHWCtEbwq}T8PSUtbPEp@Rzo~J(5f6Y86e;_>!wWsc_HU#xM>)d_D6H@hKLoK( z@4F!SOT2@=v_tU6(D0BQ#}8)PWa?o%)X3-x)yJ}~>5q+-dD3<`P3hTGxMf0U70j9L zZ)49@2aeF`W^=eXaX(8>v0r3V=wg8--kUCHPpMTZ`kbMTo#?otUZ;rpx{t%t#ns5p z;yW`WN!2ii`95E}0S(RlfZ*WdMv37p$Fe)atF?f-v+7QUiB9P)pxQyh6AR`gLblG} zd9FyJiw*zC%1{k}EQ~Lg_WH{U_@MV2VYqZRF@xl>3S~en+%9gY66`?*5%kt=%(^NA&6JpzZt*P9dN zFA=%4&0BH0BUt4Vv=pn1gQb@q$p)P@Y8_u;m--Uya4@{4RyJfyj{e^ zV}w9gSPmfOM;J?W-?*b70r9T0p9LZ&=JOTq&cuSJB>Dk9H7Y1eRXx}Dgc>qXq>5FU#cCjbSu&DdB+ z5}U4KgArSqAS!pQa;yH&a0PP~ttyF1Va4ON;AxzeM4miAEONiLws!V~#9Lcdm1+mB zX|kH*qYHbc9emR@>`;V&Vv&Q2OgK|GTviu=HSuc18oQe*u>~0(N|)i6UDjki8>v7~WtrhVOOplohFO81~T<HqR$V9kHHY_(5B$6v!nf4s(m`eIDvIR!Ibn09tp)0gE=^U2{0ivU7fWGEM2m?~@E zm+=YhXa%)OM@w4+d=$-%xlWcY;p4dEgrX}iGZ};IRuRmwcmb0it7iAF_P?lW>=10# zAdN@uU0$xk*d&ZcJ&NIdlBt|&%vpBuK73qjJ#j(qx-<`Q$+j6~LpLYb9l!bZ8722-r#ZU6L-7 zZ%21+bi{B+xHvlyi{4yXe?8KD@JLpQi22uE@Og^HgG==lG$oCxs+B80PJS|Wo?<6{ zfSt0~oKBnHu8NYHi^XW(U&ms^sVk**Ax|?h^Q8IZV0W7B;&>IEqKzzJXQ*&jd}!dX zGueWmjRkqdHgn*Yg*@01z0DF&X*KThaB8U2U}<#l<_FvAvOAX-yWD|yMPn;Htx`g-hbDY>`M57Sn&IKiR z3_cl3DBRRv`s5)Vo+XIY9_yUbCFM`b6*Oc$XMeZ^Fm>W%Jo3@p;^!|P)Xzhi`y&d! zo$Gr7wcyWmT&DLYkq(|pHD4O5F$nE~xLiKoOS$(4iOV~cxK;p6NDV-s7qCI5%n5Oj zldq=U`li@cd!6^O`PMz+efX4g!1P?~BB_1(Cc)M_6AC|p*SkK->ASjXYL6aO(cM;# zZTY%CS*U(%(;o)b?Nqb`;WM&^qGc z_CYoO`MQ(+QVxoctzf*Wyr@{6v2V_T$*j^OKj#hX$c4jpb&%SmSBR$JL0HM*-P%VG z2^K+4`&u>Fi3D|t0LM`F`kvMIZ$~r>qXpHfcF1QD?a}_Yx0KbGoTmBCrypu7SDhxw z@sxi_&GSpzdbckadC$_OWUl6Ud;lJ~m6QCm8GwMwj!2e>_dDEAjfgz?E-by2|l7|lHI4wBb($!TL`z@Yx>Rm~8#3ty9 z5t59(T5k@iH_<-oCq0JDyLOb9B{StFR2^G#}`p^o&~d?5II> zYN`-c*oK$-fxIcK`1(I$Vs|O&FCDvCVBo8X-Ph*&k~@eyS0qvz&gAJ8D7l z3^CA8!Mm#z&1s*ha35Mj_k5GkWbpe}w`7}dFB>)*hS?bh4D{P6ld>Kdb;VPfI9pV+ z5pXg>bF;5AZAHvD(Ns1m*UDAcqqgHI&>~Tjp*V#`T{_DnANLKfq^86BAa-eY#%P@1 zD>`RwE~F*)4D<_u*rfm#!{oRyg^ACqGwQaIcHRc+vOs4ZG$5eoyGQEee#I@_?1OEN zU5QC`hk0gbzp(D(q8cabwGZBJ7LNh&zO`eCC*^rLd&tq=e6?+`jhl9fYN5o%@}1Rc z=~)h=R$B65=MOl_m0;mgUGE&&=tSi1)<&h?FX_+FyI@`(rwVnJyi^knt#YPOaK=`2 zp0??Nqx9Dp#03LnkMUX^1on}6!=D|HG3gd;S4h6WTMQl$|J*tr^uS@JRYMDUCiz}^ zu`i=Il_Oho(gQQ)Y2E&C+W_uJ|6x!5$He9=^}^=JteTLgby6giOO$=CsAao=6%*i{ z$8ej_PEKl8oj2^aRLOfH`AIHz!IEzd#b09arV)3gsQ<8`c~ZQDcugpge_SsD$A&U% zMZT}lMQ+8p51*9M>9z2;OpCwZR z2P9)n?vslTZG;O(L?{$7bDQ>wxE$?8O2fm2NE7;11*bD+z571h4yBi28Yz2G;o1ee zqg;bpaix%b^dwtN=UtVy8um_~OPN<`7~LOgsB5>dP7)OSl;~8VE6am7AO%;p7CD^L zE#8(q?|(9ot!S!*_n3K{#i(B>B zWrjuG_H(0%8g)L~1KPb;-`6g{VFne}OUS%W8WuZGW2N1%tGK&3XMVNh66u&I9*3G- zIt@xO)W39`J85aKm6#g>jn|cnHQ;0qm&TR4`+gxsMqQ?qyuzF996jlx&gP{!AhLUb zPG$BaCkVKOrfqb#-v@`LDO6cVd7WD&WTNhVOsCW7!zXu0AFR6Ucd00Smh`yhAn;(V z4j0gUKoy=Um1vh+NnRpgeEP#ko3CL7A?1mm*`K|9HK62<=EhJu+s05co7YH>GyhgkgZGg&!+vASgz<5{PZOg*@jWesbD7una5RVO1HdpRu(G<04g!_W z>eW`|C!Cr{=+z};b^_W~jWT?>DZZk)a29$4xd<~_v@_Um?~)XhjTbts6hQVV^_1D+ z>NSP{UND()mvjDyTXaO#W5-##)iLU<3P}>fT=4?-R(ir&@ixRHaEA6PzY=D@CBQ|3 zFiz4l6VL_UyIhh^BBlPHb(8();A4Qq3{ZYFfPEjYCYEXW*(0;@@QQjd*^h4}D`d;@~&~dE-

b7vSDEZ z8xDd2$NAuF*?%}&K6L0W8llTqq9M{j{G6qjB2~_)Y*!cpL~Rtlo2#&m%{-W7Os?I0 z=}Y^CR3a{!rHNt^i9>x|*M;uNysNoULgpc1u4&m#RG)Nm4VG~IC=`k$KyI&fzG7fe z(;&^|SQ|w+Hefzt&>453NIt4k<=8M)TUAq>EHj&ARJlm=ZM{FU*+5QY!8ARIO4J4F zoHt0&C=qJ-h-9z25WOT(NXfVSYqAuq*KqV34^$Lm36e2(nRoz~BZ5^kh2?z`An3JK zyhM0suKSbFt>u|Id<$I=RG2OrZHib)z!U!)2Gb+ zm1}%9u3Mfa(c)FeWUTMe%orrSMB+a9a;M`sT89Y<>t+2;Tv0YvCXtvfw()rQaz4ju`&G?lSy=qX5g-yJZ5 zKuZ^Q9%7CY-O-`G#vr#|Q6Ieb*%_SZB6tlS;_H8`@$%t6R0kdb8qai|E%F+~_nix5 z$JZP!2*kWHAW-_uCvN7Wi>SivNp)n+vq{IDFMDeqWR&=bXkkQqfV|QF=%Hy}`rLXU zi9{a{SB7_toceelJBj1YN@%CHJncH9#z~YnXIR zu=Ui$)N`M?&nF2m8;LZb$9bBtf^pnWD!a-oCh05u@uR(fDMigl;=L(Ee`iHdG5Lw0 z)I8Z3T98n+qj3>0$kq>GxkarWBi|_Rj1Q#Jjhz>L2HNw@XrAeC0z-B=x$joYC>VtktYb@4^DfEMM`lw5CquzP}*y=2xRSVWgVvTp2iQ zp|NCXxW;sOkqFw3mw&i8kU>Y|g|lwlWjbL-|E|W_p%ujvLpq;QgM)Gi5NPb06Mb1} z5uZsuiXr0k2*-RG!@{OBj(dn^cRFVp{VGJ^&30@Z&kf4kYDN$R!1gK^0m@e<<9sTb z($YQyu>G#ZH`HAG0WjQGT2QB76#EFrOe;XuIr? zCwtk;+p{%Gon7jZ+w00SU(mO=G*ozBBS~&7dFwkurBL5NJ+?z`OgK^4Rg~ZPL_;Iy z>wObbq}O}SYo63iRP$D>R#&vm2ZT!+-cv&H86KvOp+>9i?6>|h@ z1p3}4u}!&p&;4b69@+SEXf+EZXdKosk8X_u)H<4-J#fK~Faz%Xdnd0Vv*B9Ane2?ai4lkrwmBgSqpC7EUiRFCW*FFuG>v*nMsBdY%H|wV% zQgQ6|wGrih$?a~h4&IUFhksT~v3yR0;qw>WFjDxFbYz}ia+5HKF*34a>D zr~6mp6H=YyXs$gVfs^T#d-$MFx1=V+;@URlmhZ!OzPi^PBiCE!&gYyfkaJXGIhTAs z%vE^P`#Q5u@OIZAd*U&@aY}$>q#WmY~`9 zZ%G|9MMYPg1v`n`Y(k`Z&hR{*%`r^RENbABeUXsn_nnF~x%hy7z%8?JXE83~P7JH( zC4xRVdF^B_vwn^QhCVY;{xRx2V6@+W%}yrg2C@PvDmF=E(@_;g8g`8H7>X)bL`7=* znqrOeZB7(tgr|ngmX6j74rn?_CkuuFQDj*i$jIwx{%A2U#Csl>nEo2QTtJE$dDss3ZkBD2 z5&W*|ggKs4^*9V_(GtraSsH;#VeHih83c;uMKf2&B~#=_m!cgFneSfyjU$NRCl(H7 zP)vx9Ba3E=#l1{Xlaf33;LIC+goh`)?Wjbui?gnfTpTajhNv)f@r^^1?P|^I7v@@YL8lDYAi9R6o)k2R9V9cch1y>!{Yi~e& za-lEB%*a0LOYHD%3e!W|rHbYK+f?ONvtefN+}8H4`R28&$$r+|7v>IGs;|umi*x=& z8oJT^G6TgHJ0JC(*xrm*Igc#eGico^a;6*dlvx=e~pUo8wM)$&-dEmCrCT{C%{CzlevqU_F{GaebS$`wA{uu)SA<3!bYTNhcd=FOZlHM^cI3jc~K%IOmg>dLC&Fg1jmzDw+6L7{rH( z<5#dHJwS=z5-a=*3jk91te;#(Ywo>nrb$mGQtoo|#2&{D#9)FvONg%HD@rzHcns<~ z{C8jcxFr*ED;ON6QrA7sed!O-(E`y^o3f4%Y>Gu=1lYT?YS~3LQ5o4Bl4`I+~tY1pED?iF}()!o@YN-5=&T zR)?g9h)y`1&1ShrX4rY~z9T>Vwo=nzmXxZw?+qxz)&%nScu3>7Efta0i3?WsJCWoPTLfg$lYaV0#t9C0Vkw-Fq<0u6*$v1Cmyk67)?*{$A}-bttytZ6ZZd+uLY zt7%n(HG=|=f@ z72-P?P{d872~NOFWm(CKtOk2fSICy2K3ysAW0Mv0oahsabCz>9*&R0O7sPVR-a0OU z=tPjI*Qg@`!~#+dn$B%mMu9IBb2JFdNh~VOCnn?t&mZx-jLPxZ8qZr35j+rod%0e+{n=iI7+FE`a0OmgrktVt^~MYj&&FNUqbN?5fgD^Uuc7Pm z@@TmxpUpyUM^#d50&ssEUaeBwn88E5{9}nZw7xHW@_zgF_2na`X{6Z`-kli0>zXu5z~4Sk%qNDvEM#m_}Ykh7$dQhK*I9iWjjp zaK+kMZnH|q*zmcDui`xx6S{$n^*QjA7#V|>LV}*M@h{Te3I)&XO@^wXXF6g>UU$LQ zG4{G}f9_nWi3cZJ_aUZ;lP8-~{NOJ;*f>&YyBqut6G?DADwpmb z8taV`zRNStp)QU!=aymm#Q~PDd-R;~$&7ij`4awn(~L;6At)R%Ud*T^v@+U1O(8or z-I2&4JCHk0rPmk$Z;h^Nb7(lpR2Fmr)Qe$f40%hEeG&bzl?Ur5dCG-qN|#*)FIVp2 zX&o-303Q8~ne{^BZbf22!?@Bwz9%-Iv%F}b%66>UaVN$8{XpydGxV_#9OV3tuk6^JZN7@dMllLg1|(RnCH(hwEp~w31=gK zTnu}^Z+E=kZ`ODSR)W##{KpRS#!rqUhcyx`%jqk=@d($&`RN(N{5H^&3q5o)al8du zFc)#fG`ZRDI&%FvEB@CQ9yV8p1ipVVCaVK-gjy9&>MzDV-@Io%w|2`UUZH`6%4)yz z!*IFna>ZzwYY7;TMaBr6>En-pu9zBfDAUE~h zZujYkzUx0yC?ZskPje{4z%xsy@O>tTA(HeTO(|?lAVEK)fbCX)i`E~U?*3S|`#Q72 zKonB0IwwLRL#L#Wa6rgmi{E4)fui83dL1i>q4v+GK-{HNPc@M`FxeYiA`seUa*@rm zFh1ZUc*28NN<6rUaoPPB=7h{QozA*%gWjYk#Zoyz?Ch`4t_q;1cO5zjE}_@JKNr58 zH68u*t$@Z4R>VRR7h&m8Omm?bDqAJh3&8z_aD4fyj|Q=f0ch(iXLJG zc*=(g&C|#PUaKAPZl=ZE+f1|7IYCMp^`?e{l&^FFwI{7?#KS;ko@)^Ml#2In{zkl0 zXr9Ohh6u$-+uLid((Z!L)zH07qSg%ps6(G}(rdO1<&3H-rBB5v52H73YCg65)6@;p zpI~=Z2KAgF0MsGQuGdJmH}~bHlyeY+otz1xDi|Eg-K(&tO9U{7KPWyppWTDu#KK{@ z@m@{6j9!CDO-(Iv$f{HII>{wbOl<1wpZcNKC<#vxSWS3Y0KIhK3c#6&mrScFjS;da zs>RNVckF-c+WKgCUZKc6eMq$Q#mG&tzj|9$v)2N)7W(N1prE(vnKO~4+u0IPPtBpd zgcy|i2{FL4FQZ<$jUUDpU8tc&3;GhPNb~o-MJ6y$CFx?7FxQ_E%U@hiB{5zs`?6b~ zMW0vz<*^L5>%)Y*tx?N$PSiQWuY!0jrd+o0h&4-pX@sg*zb*fqqzL3I0LJRDwGSDla; zgOlRk`QJxgkMSz z7atDV&fy;FA7F|o-`jjhb&bIYL*g3h~L*UEJz2*!Q~^0t7Lyt$~*zFd+mekfv~rGbj`~ z^XWsRb(b^#ORv(=$muN6J_FUYj)CqEma^vCxRt5Utx!u62pcOVhsCz?$vI)!73^4U z^_eRZx@XhvgmpSWwFdvCHv@~8=tQ1X&9cD(h8#A^x1dkxEe1X!MGG42BPBa)7;$6$C7S_f zll7lhf5|3zZ65b4HewF;77USKA)`5;rZj23Sh7P9;Hri|n(Ouoc>b0Tk@lYxj?dvN z#(Xx0->=rj@lK}Pt}*aActQ5YkrsQ+MNdex>vZk>?Xy?#p!q2mFZX?(oJq^s|Ko{F zbYDNckyimdB#9NR$f^NdCi0HCh@&JF9h?~*X>b&0f|i4N%B*)j$eZ9dIIC6nw4!~3lQY}_<(UxPtu^Fu~B_Dfg zv`I5m(+owHTm}JJL?D|Ab=DD6|Mu5Ix@n5t|NM~SpDFKoGSI%U&&~qSaiOe{ta!*{ z_d(#^FahBBHRSQ8p?vslb#~08VYhzJbEq4pe6~;U{C`>p2|cODTz?z~*1`Nw<>CZ( zPx_m_NO$`@dm58Holv(|F+!kwOY2B7o(f=fUvY$=O^`&<&v)-0C070~?Ucuir!E`= zMHV_03YRQ|+gy0S@HmRoWk$Sf;A0n45`!Ek+L~a5Y1~5hXz7G7fAB?RW?&;CO8m?;v>3Gu5wf7}gucK21PFk?0`Tezc0vN_2q1O`^=NA@kc;_Y{6d$aovj zq=Xm&XpnlLe$Ts%At39!q`Y>HajfPjT3*iUnwwuE(V1s#q5o< zkAHtMRq0Q_!JHa7NR!nZf4Lbg1>cv!bAO^+M zpx5hD_YjF5SiDzHJyc3GJci+JH7|%X=ak}^Jr?=$Gc>+}C<{$ISlxI6R;G{W;-O(-*w1^=ixtz!YFVzM=%OcZVX zy3m{l6V+XleSv%Xu<7Bp^=a?sZ)nbK? z-6Yt9^2v0HOsI5XE~WIwOp5>l;3Uy+!Q%JpjLK3T#ol+YHGPEj7Mq9aRGW~1tVhs_ zj{_YDT3$3IoGCswhM&%9I})4apR?ZV>l~^7q>RRD6#>h=m*7a}SxgeCBsS%kh*_Ik z3p*~ScD~>b$mv!{8e+H{R5#{YSN3@azbbtpgD^rrrR%pxiLS)Nb)+V~rVbZ4ey%Z1 zX9i0r7Rpq;L&Iv+PIZhxsUGdrS*lk)&ANI8v>VhAjsh5&yF$~PxugC9ky%M%;=}j{ zG2AYyJ*oB@a>wgwx3xCH5A0W1m#dRJH)WSe2o{7eC_qsX1lD>W`%uA5k&BK_g*)Gb z_-%~89Psw7i#h)=tZvP-)@AxyZ5A`b2J;-QYGa7(-8kjts3ETTfH9Q8*ANv7l!42h zq{(<`M!oN~CeUHHCIZH{mu_>-o=f(=lz{160NXX;NIeFZ?$-G(low~FreF^{YnjD( zFxxew7FJmN065NGM;eSe>#$7Y&L<<-Rja*L6`6?J8Q`=R1^l-HQFQmKg>{>G@7W!B z2prB_1Lu!Q2}K55zWR1uOhn=YD&`JwxEr$)|4-?p-(8UtQ;y~KC2mD(79}`OS@CJE z&Pw`|QwBLa+2eeo3%9!5q04>ts z)f@a)GnJJ3O`V5U%X5!pVr~UrcVG^zisnfpq)A=u2)q4!L^?|AV(*j%@|1W|t1+Y>c)+SjU@g!V0gx)|JcS{*H?;mQmP1+z*# z+hc<@BXe!0Ir*n@TPvlx$gI76Z|3qdPkq&fdi3(tj` z{s4uJ@(>32lEyAIC{I!}J-gyoY%(OG(-qU8Fn+MH#7Hb;81v+bI`aEyqY>})%2;Jj z&g#o@mqRbYts6agp`~$c{-ivq)_L+JRMM$dbSYZV&w_^$H)_Odc1_>Z2NKDjN3Py( z38lAu<#b)_OXR6pmpn1+jsI6>9hdRti_IndF;!{J9b=Xi0|d zk2R4@2DAR~q6e_A$*ad&<$hsII=qV7!iQFhLZtlKj@m3dR!dK2)MYObG_w#xTdAyx zTqcof2s15Nt9hrFaZEu4Rvq_;@Jj3E3nK3*NN1{42v>Rzw>Lett7U3WGK5KoQYEi$o;A)TL-3&?UnwxeeZoF^)jiji_g{)LJp*B zO{$3cA&c za##Am9(g|X@{geg`kO{0(oli0df)XE%hfvkyGIV5JMljqYLJLhS~q5rg3!k3W)S}E zd;cHy-ZCnyt!)E+02S$w?iA@RrIC`5ZVBn`ZWTdkL|RZny1S7^8tLxtZqCGDzu(^b z{l@ryoL}esaXjN$_^h?&yyuuc=A`-s;T?Yu%`_&g8`7JIth8acp)2P0N z%Ih$*;$L)fvcqX0aAxu&9FW2p8l~#|^7h7xEneI9L4JelHo)9vMV zR0Pk_sg^Hvw8d`@`tV)X;5H9|&Ko{bV%16yZ3PXHcn%kiYfiY2ZQmc+6_ia!s1MSP zB*ek%rK?GIf2#XDI9%a@;KF=)xv1B<9Lc|p-(RkUq*sBx$n0|Fe!AuNKz+33Fw0DG zRQ0$ce3kMvUy0lz1{1)A9bcSzv50ECY6fH-qnVCD@O$c|DhpeaPqc#hgL(E3K8zKl zr)sz!5P!L=8XuoG9egCGv$z(7j#v7^txWlFPkv()S}y1PB`VX;kh9=Mjf#l;U(~3x zxQ}khaa*b#CvjmUY?X@fCkgoBN@C~y@lMI~Xc)+Hk9Gv#bsb`08RXSu;X|5EW&$>G zg+EvT(+er?-F+(nvX?(i@iL;v_+quhBo-Hmv~ZZM7I>^!Q)W52ci(HpDpU3yy#EQp z)AXaXE_FJ;+RMb!tkY^mrW9Z;#saa2aK#TCJ7*Cv@#JRFFu(V{CO?y+rYV0pg-moM z^VOqP^~vzJ%f}Mm7ut)qzdS6+JFdH0%6I3psyHfL zqjKnU{Y;tZP)H07ihUD>RAd~56a%t`tY~~5r562YRCVS>&8@E zU)U)zXxGrxUAaC}&K*th7+PdRMXPm)qC2;(QU0hd`c*pMO!VAzG%5jx@5fq(Txxa% zopKv(P%T~Xs0fPpi8_r4N+}Nriiw|Jkm+4{MPh0DL<(s74eUDqJYNrPg01ys8x(J; zIA+PSBYfinp-OubO3)1?5yO(YJJ$XqEmhzfSxb*}99y^`%$e&&a@rK2&ZVN3uP&Ce zoO{Cz`aV;|d8>by^XCt{X20w`TY_DGOUUCaZs^G;7MXX#(qD^78yR(jKmoc2W$&Z# zZFxwb^9I!l0^TAIVY9#dmtUU%DM8}kwR-op4X;j`_Udc8J>?)Hi*?o>`!7NeQx0Sg z1W*%m+!&(*vrh)KOwT=qf$@Y*6pVo(SsG@NPUkT4uD>+1b#0d3j^Cm6z&}i z+-H|I6^>n1;HxH{mR?zbGas`9Q_#}(Q>MqU z2ZH}0)5muW?Rn^^kTv0P#OA+QwPjhkFvz{k(bO(%l1Mgv7=k6ejwkZzp1=ehagoLH zaG~+&nz&zbq_)Jh`{UEi0pc;YS^#-=44HZ@`c9osWb;Rjf|<+JXfe?t*rK6Dqt3fd zULFEV3>W=++}K{M-dupQyTrs&+t(OahNMqLdAMTLhZ>+lyUD^}YLe*F*kZ=|IXy?> z5-*(J3YjVjVt{H*_cMDV4^0x>o}4x_PXOTt6-#ObhCM{WsaN>(52YeW6OmaT>;49c z2PF;?AN+2P4;&saC(~%;bbSMp{pADa{_=;^0Bmt_aUM17O2OE=;qNwLUVLV;U{Za* zjSKueQJvpJ2|0yn39ex7%jg2Lo|KOI7p&izn*3j~+;9k3Z~rFC%%rG%%bcTJ>rvip zn2Z#;_S*8Y;a`Kdi}?2G2xag}7|Xn??AM=2Ay}p7IEO)pGd@R_*dKTh&SgVJ z-^*+>rg;-A0Yb7hcfL#W!t_!4fuYZim@ZiY3F2u-%N2F{^`SOn>)V`pwA@-fYljDi z`F>@%0`7NNpl>j2CANp6a7g31gxXQa+Z_R`iA9^4>|f#xy3V@Lf%k*BI;<8>A+aHM z^}S>rz$YHvI88^cAlyhXp5^>x&kvTG^5;^&geJ)yfzdv(0b`VKxJ5;S@gBe_d8FqV zE;{eE!@_j{%5U*SQ}&=jg*2&%_lwiao>$9jO4J&qNf(ZLDPkURLc`*v<|tQaXNytV zsj^|{qA^zSV>Q*V_y^w^UsPsyMcQmn@wUhC#uXc@Yn)r{e{DcHM z%2mlK#9)Y4Io}olQ~@AJb7ygXnc{dbF9#KJl^FQZZkf>;$(!!-Wsdn&sTgenqm!e_ z*v^Z*U=SijZh5>lBlREF>Y}hv=LkGFjW#t~7{T59kw---QkaqyS^f^2F`;Pzk;G8% zaJn|~Q{VG`cP-P>Q_^d%&ZT2FBmzp)NQ@GtM;cNz)%!DcEq=8t=@6(7KYews8(%$} zXc*FVxIUcf-fU{SablCltApgM2?m%=QENBfcV;siQ@w|@Vz#kv#(}mjPd}u_Hs0!D5wHz9N;mfoYcKbXr@bT# zQzRBomlHpb`65VcO;otQ6(8V#1mfA>bPOBo5cz)@8 zQEon7_yU=bo6L!vj6x|>F`QFHhFUJETr9uEeFlKc+OA+=^~XyI_kQ&7n^~oTHh*f+ z7K1^fO41+xeAwVdQ_#SehREj8}LS5 z#uF(1Vf;1Ls)I+?><6vUN_Y?<+Q} zBEH50%D_d>P~H00c}+9IYQKP?=ZMij9DG83fcn#P#ganyP(PvizaSn4@P1L0lKAfv zE(jEK=0z>)mG%-b+!loeQ;`nuq7YYqbS&i`iayf))sT@V{z5)O{%#DHWwBgO{kO#L zDeVd+wo8;Rvn3ntjjzM(w?_EnJ;2oWaL}b?n%5datj(e?zJ1IR&F+?auyII|{c=+9 zt^ii&CrYsQJI(-WJ1Jk}=#hBnHvZg~rP6+#xE!g3)5OhRf(x$sCz|W$E4e_{&KFz-e9HmChz_p|J zK-Fss@lb&*`NPAe47ypn48)|$EppI_rcl^ zZ2)J>SzYgNrc*6`>UzAISM&9%H`72T0r0UT`zgCuJmWjr@q8p)Q%7nabi>Va&Nw*#!?#7QQ}O-G;pEDy-2>89xTzDPz`>WO?QGBx!6M4hj7{OU=WZ-*pfO?r)i zmQ1S#q-iY&R$!oZ>FU@oxo2)~J+H1^!wUOYt@`;kQGe#5+g0ZLAHa=&(l0+r?y2EF znLho)>xrpy+lw7x7ncsJa*unCh7|gBdd>KZUJTP-Yz}OX1)`eLYBGfkWGOY5=76+W zSl%!z)6hl-12la!|>j3XH?w-Sc%Z#BE!Bbw_jo2 zBIQLicH*`$EI1Vd?hy!lx>z(p17v?ZO|6?=dC(kNE!p^~SWOJ9^^Sn&w-s>)6O z!dt>_O2=_1oFU_2tiEqcxOB*ntI1sG_@Gf}=)vAE|EQLM^dmH#Ms1<{^(Bfr8fJJj zk4g1H`$vU=a3)iZ@Q+!wEK}ovzyaW`HmmBMz8@PaJC}`R%VdmV(2lIV zyl2``yb|Z>Ih6m-)T(8meJq^WlsfXpy*Og-$!B@FfP>3z8n~;Kqt2e{QH4^xsEI|V zO40Z>b%s{ zm;>lG3UET#NUlYH{D!VwzxY)Oys8?8GP;c{f2U{#%rUvV&fd~(9P^*fr_lx@%jF1Y zXItK*9=s5Fhktx!d*C>J^x|B9wm+}Lt;_<=Cbxiu`BSp26o^7M< z?^KOc&n`|#SyHr(Zo1j!{NTMiqia-=39b@Bq79^FkK(&7L2|6$stu>YjZ>)7!JLwj zCrV~qWwVUbyeeC>sD0j9@pF>gq^a%9jvTk`ff%(yVZLIHswl0VR&Mhag(6|i&lseESewbGD1E%_j>~l=DzRFz!fvV!4@1ulgRVo7lu9dc4d^@|dr2u_Z_2iUFZ@ z`1SPrNB@I=Z`B6T`;EmE84^A_>p~Qx2F2a!&b+(CH$Av_IHx)jpGPuiefHSN<5)k> z(I|-k9lY;cxN%F^I*)SV^jCJmSaj#~E%-f5LVJVaQcQ{>$IPY-apbObkcn6nze;_w zbW=K58i@KMX`szE+ z-c3#b)5j!-iE4uOr^}4|Zh)TOBXf-De!N81Sa}i~)g_m=S_H_&AxXgwm$6EF8$~FV zirLFaetL@MOP-47TO+k<@)T8x_Y8iQoPAav{KCkbo%zK6RR;cTx9ZF4KWQB6pNIe0 zJItJ3+;iC`p30gL`#SMlyw7!Yad9H!iZ$L8Alkl*T3BtR;H{EP6DIAd~`IM z=Qj+2o0o-)G#v%=ttDhbz5cG!^oM)%$NZ)~cqQ7PF=+8%b-IMC?ft`*mpL3)u^Zfw{22S%u&qWDa?!C(6+^Y zR>Z$ylw z2iPr)5MR&X^Y{$3qZ|L=X?~7Mwks?|p;cXu&S`3A6I2*%C4wwNq}l9NYw4 zt|KsWzUKUZbBdTPKatI>zwN|jIH5*# zd5Zx&@)Nv{%!ADz3UTa>mI^-aKp&e3G7%4jLRvSIVSDd!#xEvCn*L(hp~s+68DP3P zIfMID;#?v6M-!+0m)AyXvZUDTtm0s$9J(%fV;z~nkvU@k z(6&x~7!NPm3EF5?dpaxQ18ZNybG@8fo@?o_1rE+&gyM|(Po^44TP=p8t8 z<5qJm=&xRhTK!2PMdE&`hU$QcHW%#?bI;rtc(*6S>{a5s@&-XWfqA$B9G0rIJ%ISG zZ|NhgO7WsWcVgY=8d0#LUgp2CCq8}{zpy`~1*883wnIew6RXAqa=`ARJTg$BAJU#n z`n(cB+$9r%m+T|65?k}JTfPdXR!GCo%Nl(G`o>yLTz2~n`e)}E!jABnFBAaGFLL(` zh5up&Ex&jArrGBw4{Xe*o0t-Xe@$ltACL~|_guNAaDd5s)R$){{aPwM!AM`sfc0Lj z(Gmgkfj>s(@H0(~7qCkW1U@`FnsmDU(7&z7<~h`ets7S+-YAOFfNy6g9VMUo3}-RB zC{8M#Nt7m%k?LdCP=v5wi1A`JYg+oS!x+*K5Ke@!;R(- zBp8ZeKY-`>#Vm<`s1`-iHyzDpldYI>K;ryGtL!baV!7Vl8=JkQxKm2tMUC~d(opng zIq@fZV)BjP)yg5favskv^4*xOQb+*ws>%n6St_YApYFAAXAU1g+L{BRQdHYnS~_tv zuNEb-@O&Z+Xlo+?g_$`Ux5XMohHP%O)K6EloLELqV_lg(RU;}Gq`};|-Hx&c%tjP% znEf_+Cl$MhUTV>Z)fge$rlU&dR3ZiHF(($45D%DBf(h>*ZuohH#cDsUv75T(0|R}- zu($Wk4@HQECKTj996=%{S1g_CSzYMHA4Sji3rsdE^cPh757y^b7BT)O$8gq1h`-&w zG4*LV2;9<>)w{+Dt)@9+lk0YxHY)a0-9o0`p8jrN28z1k!;QAoy>}SPPLZ@dlJ(px zhTE)EYFcgt2Lq0V^EwP7L2-EfM(xOWC za^80gTJ@&`+4wh%cEuS&*k}E;G%0(I1@c6PnLFZuWoscTZ^)S-%|-d6uphEn!jiNv zmynRq!njq4Yjv(6{tb;WaBfBvGu3}26K{A*Kx0A*y6KY2xE;Pf%}~AiWPHk-D*roS zifVI%j($V?-$ou-GyKdrDnpZWcO|DT%%lJ8z`p4XXHqOuIM^EPO3Ps9(WU2iZexmJ zvMDU6D@&Cehy#>SDT4E`9U0CVcp`ZVfH`)|9Q%w8*O5>w?Wl@nBUT{GE?=c3ELMjPn&zDmAQ>>m<6l1>Y!JDakch#Gk^X+; zonMG~e{GpRDW!j;iUE5i0EBbgB=XXUq9AQ&NcgF0`^QKY+8uQ(cekd3LLVREeb1eA zD~=l2Anu5wV-iBBI@F;Tj=@@Aa!Vf>vg$2)t@OQTbsukVXHKOed4%g$AhYo84{gJ)}mVThQP_I=c z)L~ticj`L`K0g=R1l74(Pv`4*#z> zLsw0(!iK@}`=$~ffeMzWcHVvJ%dF^4=CZdSmnnHyFjuqcA)JseK7RdS6N zL1}4*xynEJQ?lwx_opXg1(|%$!WRSuDBcg=&OsXa?GL8@Q4@bFAN*-`poKzRUh0zv z*yiGVdFtCDgMjxhtpdlyH~5dVM!_n*i9|^?*FM4{p)uGetK+TH})MH z1H6J0a+vG*_0tEv5~OdmVBW~Ah=h_ULCr!#%co?_DA8%&MNpDO%_oDWd6e`> zTrPr)MC9?8W32~5ByT7}6VBaV8}VusR*hnWFY@;6dy!PJ+8KJ<*?7TMBmf0J zLKzz7<;?^LXsGe!yrD5ZLwCT36$u*)x5b=URg=vb#?JbGhd)v z+S|$273!WqynX<2DMVaHfRt*Ko8k5C8tMlLI6n=<^M?w}-d%X~x23q*Kb~snvIly* zhZWMQ_%;OZGN@ODB082|dm7*+d$ha8v^=)mpjhfW*9!VkE=Y*DHqH7&&lWP%keU_E zcOGC*z31ZcMf8w_XXpqG6r&r`KjqZkg#@ zn&J%oA@PfM{!OY?QG?7RIE>1hf$o+Gj>mnR5t*ooJ=$-`TV=AMczGsvuTq9*H#Zl1 zoi`5hymL_frZUCKkd2Rx?HVO?;t<@)N1Az zNkU0a-zb@-lzzu>2p@u?Qigb3<3V+AKCM$!UcT_lcBoHH?`N$X#E@p>7U(lnvE`#2 z*@Bnc6jYRrlZ}L66varb9%FC|j7`-s=fedXM%AF`MW?_?}`GcJ=SMB%yU z>LLD(_7z#=U<1tfx$ti{AoK?`qW3~E*R~kc?RP+AejWvHR=B4RC%)~w)d}kNzwnD1 z%+h}mnB7m^cv-eN641<_!?H$&NhuoQ`c~|fzUq(i*L+R8bNjF5a-NA4p*d|o@xL1o znK5jpm=zdCe(#Z!+nH7^-dhy@(=pk}WRG#Il`ChrM&4Xagw_FEyMbZ(S-lfhkIo}S zVn{e@yM~@p?g1BJDW<9K-w;Ay>CjTka__uSmRD7McTk3G7x*zu8LExC)_>&jhuI4&aMO~T}3 zQf)pf;U{WND?a3z?^|+Ka1LF)>rm9$%>3~NUv&zhv*eX{S-wroL#ebk4x;zk{#M)D zXc}y*^X$@iwu(4XBfcYFum(-O?CUHqoM5(Q4G{prN;++Yl$ZolC9dc=YxAR+A#fmx zJQWeq`+lB?muVP%ba;IDZDcrs6F%^w*71R-Mv=r_VG4`~F0|h_B8iB$qM42;PfjqH ztBtJu^)6d1RIk<_`$3b~7V&=Z+v#$W9Q1%aazmHK8&dG%_nKufbZ2{hc{xhzA(y6{ zKiP8+U%npA$BzY4=(5jYK2=Gmt2^ueE~q&};rNF;<+D3U`tJk|jXEN`DYn=jwsk)kG2vpA^nH*~NuBlg(PIzkjs}hG=id7Zmok^?sEGTpJsw0*h9@qVe`V zaxe{`xwP(h<}4^~%_D<|<#MuM$KFXr+iJQ3B_J}J?H~tD^R9y#?7aGjgHqVjs+7kf zB{UxgqMYXE3#|L(DIPw=pZxLT2Vq*bCes~-1+DGpt}lF*PBZaiUCOc!b3ygav8*$?|p`C+<>cqfb-1$T#dAWPx3*tveY6FzJK z#ZK=X0g4Ug?JTPTmky4mrlzq=HlC?ea?r4tE<{>!`VvCHxsALmdaK6@wY{N2H#nCF zZ*1UyD2JPm)-pZ?uvmJ_n*nO2@pjqYD=f_V$J$PUk-TuUJmvN-z_%o^X-1c^s*0pgr^q>kf z9r|86o?;(UOLK?H?o~G9z;Fm(KTeICeSs;ZE@Fl$87UU7Rp-j=BkiNBUFNeAc2imW z*Jp=pZ%CW;wl21nP=#{^FWu6U&85zjGBlyCJuFEkCME{lm~EVxZPvuf-Hx>?#q!0U zcsPsHK|ClQ#H4kqELl8veu^(= zYzDU%ROH1$0O<)Dh9X=Jm|Y<*{vv_~&EJyujJoGz9bL;{zV(~8MDpqk^xsq?U4SP&FzW`OkwCi0JsI;NctaZ{JH)$Hcq}Ba&D8D(dbjH%mJ*) z4z@z>1U~29DlsFTGw}z5R4jW~Q>V)~IFddHX5a3>k#$}jn8kBDq4^?U)epSWQ+y;; zb)Xv@MxG$rHRJV~hQ(4y=#|`w@H*8ObU6PJc<;8$Wsjmeu*k#;FAmqkb=u+{@B#Cl zt#%iElka$|S#P2VMez{T14kGk*!ZJ7MR`))5i!qu7lg?4lG-P;>=>uZ5wJB%RYP69 z*%BV?rBzi=!apeF8%+zEPgFND4fG1u$XzEU+Ylgm-??{hhW^DNI`e3;0c>Qhs@`r) zs44B{c&Y55q_Z4J5wr{;Brk`2w6nDG_usUv%;z7GD5#0C5e5%% z6icb^skjd;IV03*f6cUUF0au2-o*S!k)&=d8O0`=Xpn6CW>ud^;a=0c$70YgkE%r% zsTuo*!*N2LJTJO|#7;p;Ioth7^=WI%T!U|iYQ@=e2cCc&NLx$SIFcYN97iC*)U>r1 z_t9dP1nVFdZW?+NF^GD8vpS?{=q;P2EG*3VAyenD7Oh23 zF%8XEDAdhb`3wLCk=+<|y04P!8z(JxWVZ5|Pt=D{!*1yug9+1m4APdNV5A62WhC;u z^NW4Sy(9~s?>+}=xe24_9Qh??ye9#qf{LW5aIY7>1^~aT7(X82c469FZv3*Tc&C(q z>e71dJ8w5)1NM)T3eB1GlsyqcqAYbBcsx=O;ONEKkvDCf>>5iq-SVBT(GL65jbJ~E zmXI`_gLdEAF<-V`Sb?z;%V6LK;B+;rr_b&UGMQhPJqae@4=OLO!dkYXha}}0C%vNm zpzW8oT-O>GUuTWW$`_l~BE8Lp`;9?)U&24Nkn0u*NzPm zt|czw}(~Rknpg1z0!*se13+@F7w9>3=EGnD(^68 z)qb6lWQ33n@=hhNXb|R+d9>6X@jQz{WW#$-3}NQ=6rHwi-I8@bZiG*s*ECmx6i`6` z+#CfnMM6TtHz1C7$>R{FTdO?9@^YiMHeG>r#JCn0&}P8!(#H;o)lE%qjH(Yl+&DvW zXF8XhkQ8Tn($KOcI1&ndeV^+E~W-2Q*Fpn1DzS;qY2X z{Zl&&5Mld23lvEtOeCeIXa7OFDqsCr3!zl&l9YxlEIq6B^o7IsXkazIznGEsE~IG{Gv}6q`}EdjJgh%)^N;p;XusrHM)0DxDp*5 z?O(9nDf^MZ^j8p&ZvE~m+^y^EgjOjg+4>uFD7hsCR~ROyfRr$SZQdzDl+N`xJyUqz z%2KhaA$r6g1!d4}IpclN7gJO;0_3`%G9I*k7Vx5PomSBuGgl^X?UL3?4RAW*MzPBrT>reO)V4v(X zS*hZBaw!~tWNO4dyhoO9Es-@3EC`{bO17MZDDM*iLdln_{lv8LEKHF3mOw=)pAAHB zo+l}cYXdBN@QWbQh<@T#5Sz4$#`Fa?Sm&xCalp;T2g-Rpky~9omUW zr^$kjB2uRDfT9rNw0qgWhSn$=BrI+surg>@flm>N00qTKitsuX-l{DX#k>0CLPs&{ zC69`U-QEFrXH40B35oX15EFm>+2f9Uvu(jct!uu?-U%TCj8k(r&}BNaHR)z(*ERst z-i?y#t#DW1p^PUnFjxUM_UvLj&&X8RDUmJ`h%E_&4Fsf-Yz>HBklIbjCWT* zVn7N)b^+&B{g72`JPA#cEpS&$NlDQeo`N|s7<}AVd;k@i zzs|X{b!Y|IuE8OW9%QR@C^oapboX@&7>f$oe&C}z@ zGsFBGna5JJy80@Rr(3CcI{hHJI#?MK>=Gn~WGJxWbj7|&FR7@iB0rNsEVY<6<2n)@ zgH@u*6QXBv+I;*gMCjRZ07exIF2V&~xngr@qnHfniQ-3kyLXlU?RkunsLjb2{Z>Dj z`V43i3nDk@f&!bE%>d)m@CGq2CCCePDzop$ z66`VP^lUyas+FBDGgc?Qbk*QzSQ?1gKiMg=Qatb8)R^6su?T`D`P%9W4%bnd_IzhW z09J@uA1wNTSW@|SG{3;dy}ii$wQir~BHK zJY}nniVgT@#_Qobz6AIR3yD3Jo7^oTeA=FN{ZdNJjq<%M33oYw+Y57k#02kUd^uz_ z@qV!`w~RYbQPyR@Wcdg0!}J%=8{R|3&7o$7Rpk-PJlJ&;Vr5}0=_H#_uc<+ zUD0n`*G+6A$=iee*TpT2`&DiTA42F`cSr75J$zI`bT7){ttX~>LsxUNVPXyt9lt~` zCBZP}WWQwh(SGG~3Mwk#ZpN%d&7|fWRNy%hDj0RjwfaiMG2J`eUuF#?g$m8XVh~*U zrq`=d)Qfi$v^ErngvQ6e;?(j$253cDD~UP>{L)NQj5A4SG?;U~cfGI0tXJA3imk?> zCyA}{Vpl@U3QF(e3J1Rp^M38v-bc-UbwQguU2ZaPt79KD$tof116&t` z2VXt1k97J^ROs&shz8+!<9&+^8SnFBt8_F82;Nl3Rf6+>C)hY`ALjBdea_7@nwW5ouDdX`<+{eXcCd>ja_rJV^fnT{34``DJ+gZ$41OVJ% zBv(3ernP}kW4Arnf-B1U`5_$j-0No|9*TEEwH9gS{78G!o(x6pW9wY0OdGa`u{uhR zJR`p+z(U)0^_SFI-J}T1jzfz6MN^O*->3NcP_KFMg{qAOe*^kUIvJ@~#9i*RpH)V` zroSlG+=_93XhhapEB>glqY*}ex*a4z;&L#lEvMhfedMH2B^8^)U{EFbK-)GsIX}0R zx#NGw62w!op9MTYN~FzjF?yngrkjBijtkJQRD>~-+g}TIo|?sX}@%9!j=EaC;MYVLd)*R_sgTXt`l^(iq5z;STsFsCa=%B|9+YF6>1{< zqnK$%D|-K;RLI?Ut$Gt^k}(^)U-k;x!g4|^ZfJI}Zb;(ITK&>38?S9C- zQ+WQ-M!6LZ0YR*c=u$TInE{>pNotpyp%D!5oD`z;6#hJk&jcfQ-mPi!?$CeQx8G+& zz!4rSPKw+Q4pEsZCv&M`=}a%SXm)AB^FoguySF=j_ABRy%WEgt8iV{Swsjj50v6`L zGZ%_E{!2$ysDQv`qKY#f_tt0o>*6m_@QFutegs3J{xRgY=-|iS7#u@{rKI>W&Z9aW zWZ#wv&FXu`XAxJLa6tTI|3}W zcchZl6wvSp4HOrJ8;BoVsrot$=jkpbhs>r9ZCY6RINp(xm8EpQ-sFkfEGmMc_0~^g z0K*3U+^gay$uLnT7Ek);n_HQ_UEU20>sUye9l5sX%GK-W{ZTr$`x$Y$G0Kl4sLy)**q9u(jJ{*jxR z0q~k!hex(H|G4L^Ml-+JHvPGUZe(=yCY>^{IC6V4lH;30dw%TC z`Y+Mf@3#;A1pOcS8*rxviXhY#8$WEVX47CAUg6ESv*)_rx}$0>UG0$~qPI zMma}af0=KTAPx#O?kNZUL=ApOx!bO|q~zof4M~xTcmC-9^R#FgfUR%t}!}-8U7gkc?rsk6HfL17_X{hj@=E zh_SGOK|17%&Nt|h@+%d;mbULQV5z^l9Bc77Za)bQP$3Tu4}Zxa&U~F@teQpx9dOR= z2t!*F9{!;~|5TLXA!Ty3wj5927q!Ug*D!yM{LT)j6z%P7u&X?~-Jib;XnpvN+f}Tm zQ)$2Dy=zrxSv-{`S0=mFXo90&^7t)>#XC_<8iTcW`Hp!~NE*K+!?MiH#l<79!lR-})7k#^0TgRq z`}sXt8_s}M!H(LfBy0sb=I0ZUAb`3|JM>dz!T~Rbjz~Z^#zU2!S*2z&%`9FW0Af3@)|^(Ay+1x@`T{cFU30Z=H|rCezleO?+?a8 zGGh;dOt)*FMw_z(HB4x=;++me>k-S$AVQF^oA!FrL&75>0=J_sGcrFoySdC!XUH^=>lErw zbKn2H+f_Ha&7clCCd zW?#j6XN5bN+$6%&EzF8Re=!rnTjKYpvuTwsJ zW_mR#0`03>B%tsr_P37g-Ot_ zPPPN`grJ*znql(IN9PFCSYSxF8#?3ut{QJm8Ae+Pv*0i1;lxkQF?|#}LrqDjsj1%{fBy*gbX-gbQF|QT zJA1Sof4G4hX|p7gIDFFa=c_30Z%+yu^IyTDn|L zb>(z!@4UF=>r5^(QgpQsd3X3UHDyV>_=;Uph(cZ$9O~?N{9L6r1?WumR(vZXiTh89 zuhKOu$oMYxm4h$KKuy$TtzcgNU$REOMMA&ATLD&pEr)TLu|7mHGQ*U_R^l)?GK5X+ z^2|YwC7-MEa3xJk`?TYwCPH1X$2qc2$55RTCR#&vG6Z)&wrYV0I1B)A{g zkSxWwUwVqj(WfJRkDx=gvU(l|vj#)ZU+&DTZErq)A1LX!wfLoP=jIlz4@>S)S2`LS zautFc>q0{+llesHG?Pq_DP}Jh#mLU#q}#4)jVIO1m)n`cJiNTUWnvnQH9gw!jSpXV z!6g=3?pj%slQP5A5|QMKkmL|hX(-loQN6}E_?*TK5dT2)*-E|lrCoDGRK6&XzDw^OfF*j| zeVmwe08O$B_wK~zR8+}Bn8xj3y$>t5GL!5~gMizUsOp$lg;6O_ok)63#jm!mQ<`{# z>C@DqzlONfvsY13RL~b5h*sl|6Iz%pj*@;IFf{(xs5{hSrHF!~^38)9XQ96CFVb8o%PXtCQFfIZ z#dchNZr$~w@m&cqm0;BW!hh8atm2{RJ;6+mXsuk!T+>>#FuAoH^ybUn3=6%L^K}?1 zTr^OlBUd;7Wo5b_hK8YvTf%v@5ivpL%%77D3;(5Y|CYcd(F1l1Iz` zex^mcfS0}bkNam=tAy7t&8+VUn8WS<(hk;+P;Ow^s4qy*fi)=N|ENj)Umbd=^&2bR z{-6OOeq^4a_+#YY7|OvtKr=`Xws+<+lhd;2Q}d@ri+Ef zs%4pj-Brhl^yNvjup`rJ=@xHpHVeL?>w_Qo7!g)WP4F2|> zzcj9`{VzdFEm&-sJ$nFoyB2-sfRs^4s&aKPwKADg0{<+< ziT>JymLh^w6qaUC#%L(4O%Qb4z)pg$%0kdUhC6jB}^g^uJY@i?DzY3FzUW_q^7lhsS#4 z9Z9dD(-!Jek+kRcuni(UM( z0ql2}TD{;aw5;oicX4G&NETH*Lr)2_$c9UH#DT3I-$`)f3G{p@(cZ3FY0A3QOqCwB zC?3^HY?gUtne)9RxAy^;>zwBxS_V^prOOLUl0NNWtBHnfuPu2WlnT5-1W?t52jzuK z$~}jDQFf)02bU!d!@BW&ZfZ3Ym^a?OQTm-E{yEXDYyD+0*Fc~fM- zASqTAd5BaNT5?_K2x}?UDiB<2GMx$a?9Lhf6!!2m=Y|kKUBNfoZ}uW;X(b$4QE2>$ z#B?a?A@_;z|MxXPDZ7z?!fSBY%*j=9CWG7J%8))$EXY7FH$S!jtYLyb-3LNP5wK z?WfH_!bd7sLvb8IZduH3EY@;S{*ruasz%$S>EIDTMj_dta&gvE8-9D!ao`$gj~~rX zq%t)QpFt#B96$VtjWAF_N$7;&UsTL*!Ei1IC)OtX(g;GKhfh67?WtCSX=8J|v8I}0 zEyy!k;j8u$748{0bO>8bO``;2!8T#@n#CRJkf&p9(JZY41B!8aWoEdq3R7W%#zx1r zUs1|?G#-S{8ypcoHaIAJ!$V{>t>`N;Aje9}IZ6m&M(T~eCxADQ@qUb*W>k~*Hm=uE z14S1;-2WaZ5m|yaiPygdy3?E-g^)L(v9*Vkl(~HlGNqM}E>{A*Hc(6?HR3cw5u8v7 z;pS)o4%1$$Rkl7dOFVI-a zjF)9wJa2$KjH_X6EmTCH327l6>~DVJxW{uuz~vhe;WeC^H&8%(zy)A?d1rBN^;1~d z3I{a?&=}DPTv8l2Y+SVQFS?8sIj_Adi7GmEYRS(qKO z%8mS|m*ukoD1qLKs-E0yYWmbVdBQ|N)k>DA0@-tk@=mn!z}UA)=YyFQ@rlQ}A5!k~ z+Ak#8z8yVXE2nU9nTeSjm${GG|GCtgxHx=xY&vhiD6)7E;ZjEcZb;$xx#*k&h_?(E z@JTEuYhOo1D3(`L3I%iR?$f_|b(iIc-&3w^o8<8l!`|{fXtF^EE{l*4VsO~hGZ2Z9 zQB#X_A(@!$95ceBI5|~eF|3D^Tj*QJUp|GVD&%ux%y>vPiv`jStRI@1C@|-C_V$Xo zG=&;K>tzxlezH|Wc`f zOsh;fWG<>NoFW)C@bpAcdXxkc7Z&uZnLY1;bL7?k?OHTM;MDf|3ca*+#J^2L^>F<0 z8zLUV(yMxim;LGp9;t&FUw%ouk-t@7BJyeW?r$6&U;*POWT*!~MIO={*FeTnku^C5?P*ZZY5hisxv-6y%6ED z-6(b)ZEPe204&0(DJ|rnR+(#feF{i_wZ#3ixIcsUCj882t9$MWZ-Jq%nGshrcBY5SE}bmTUykQJH2G`{B90FDEP5RxFZNi zYlGi+ct*ad{y&uc1yq$=*fk7q5TsiW$xRDLmoyTBG)Q-Mr*ue3holHnQUW3(-6HQ(-L91&m%?>@xqg)ldlbBlq>iyjeli3b=s*2qLM6+k|ib)d({Y0<}k8d zBeR++?cei`n5V<%uJwsjh1G{pdem!zW`tynh%_E1nuz8*+P|%UQ1R{2P_;&&`Hxyu zhy zK70~-KbV>KX;i6uc9TFJ3_Y8j6>ttay7c%(fo*)KuA9)XMHhEjMl4!K1Q*Cw%oBhwlIkC2>E zfCRp_Zm?F}3s8Mj1I3M|BYdno+UWHyQWgE$2J%HLU!$UaeB1#>u^&BlVN$sr6(SPn zrciPu@x+Ipl0DQd{;WW1O#-H2W!1CU*_4M{qey4_ZiJIxt8+rzBDFIraf!2ZF!oNK zgqffzWNAdJ?}@FJANTj}9ULj(G67x+!i6wKA$K)wo^A;>py!}tU|?ibjTdCc%(hy? z3(2Ml1bbazENzr;RwhP=kOv}X8U(VM4QBflbm_12IPPSA;`doVRva3d-(G(ebYz+D z8^pN_=sc%hGrE;-2VW*ts|xNai|X0?tPxW|KY6#PoL*ck{)n_j)dAGgw$QoJLT|wM z5<2Oa%B|r#kA8N`rMi~Z&HD1d4eyZH_^sy6Y=osgmc?5Gii_bqeeD<3HH0Y}cc59i z_^@;2fu-)-)GcLnSCe0COpeU(-R@RcO$8p@XCyq%u#ksmw;ja{M1Jf-88;5S$V+pj+L(cj|if%3LH55;;Utg{|G3Z+mYpK@ z4;@$OKk2x{w{+a@TE#GcJX42zeSPQ~GXfJ0l7uJwcf!<$7gRG;f?S_TEyg~W7}cES z#-Dna=Cuis*w`fPt(tMzTE72u>`GJno`@srceKOBkL6DV3=zbr5T%88>${O0$XZFW zT9f^NODLfyqHEtCWBQ~$!8_gS2SemrK1;W^Bs(uIe38<4HL~*?>Bh}N{!fvW!8Te-uLBgCkU=J`!^i^ z!I}9EVQKok0}m4K8^3xPHltgZqJ%s@NK|z!fhWS(h zE$A0ZZI(DGsb)x}=w62tvMCnHFcy&qyHL2*IbNtp$Vj!M9BC@~R7pqm4QfWXyZ9C` z8uT0I!-l{Stukr(Um-;0lTjKCWSV<{8<6mV(bF6KT26Emg*vi-loWK`cUX@)jd63e zm_u&6^eXi-eJJ~uyJYe<`OZ^)dU3?qiCOqXBx$`51e#iQOf0|GLtUs2Lc1Yc1%CNLkY0@=n8b5j3Ef>1efQ%7+GOVL!a3T%c|vob0}OinftgLe&T* z9on7r7{GiSV}ZJVF7AkzSC7pY9UV->o2mT|YeRPu=TS6skP=4>W>`3v$)O#tU9?og zm#1hJhVl(*L0#yJEUwolK^S`oN4pu3pIEk4a~$9=PpbR?sqFb~TkA|)Yd+}$Aoy5l zpIcD47YYC(%+sR+30c`sAGsJG>h$z8->GhIG~C!2DIdOW`WxcV+ghV{V(4-i|MdgX zUbgCn-r#|3zpQ@$b+)s%` zg4Tq@U#h6b4?#Kh(r)VyAN=1_+bF`cHx_vvB3GGUjIK<71zqAdEaIYCIhf0GG8Fe4G{_ zNeMNehmfD7pY&pjaG+jQQ{wNh24G+k7b%}e&>64o>Pr4YQu?6Xr+Sv9_xV}Yhk#C- zgqt70>bUV(#7>N-8@LFKQOH*ty&K&85?NfzE~x2cB@kVG_kkDQXK2_~ywWF@@))nT z{ND*F+i5aSe5&8Mk90kK5*b8RzSrZc^Yr;^Q}gpJCc7W|99b5RCv~I@r55nruD-7{ z6n1gEzevG)Sv#2ksL0ih)CVR&55gJS{iirb2h^@bC{fLS2m<#8P(DlzVddu|sjtds zY(bQY9=HC(QSOW(1J_(X$?%~QSrZ|8FJ9jHZW7@tL121R)hFnfsn8{YOu5SBNOUkn2AX z2oiTchMKzzJ9Sd(tC(76RIll0W;R}&OWw!Uh{k9v@1E&JoBFcbGV+cDQ6;T-?z}Z72uq=FC^f#nRry zX=x`>?BK|Xz9M3KUL;8sb}}GLdF~sA_W}_J&4B)jK$#=v$q?IMiE89)td8v0_sTA+ zo8f^2=Vy1g@X=?@@IKbFemJ@PA_d-R)rWpTd3k2F{Kj9@H3ic%%|`(LYnIqbuW8 z%ZLfsF=#e5mlp0oq z3_XSu`Yw2-hvvycLmZ3c2{`fRzLIyw&(vzb9hoOdFu%%D&46S)|nb z3YtkP%EUkOcOsy)Xnpe7<=+0+c-z(Wg-`uvb}m?-DAyY33R^q4i4H*?U{I#U?|JL{e&D?$(m8c+gMr*h~5HX zN;x?BcUeuQ*>Bn0D86PWGSae7jg}cwxjkT}Ty|RG=}&r%YHyWyO7Jn=F%)`6q|^;3 zNX-=FBR?Jv(=@;^mH5zqOfuMvvOy|PBFPfxf7#lajVg$8ZqJI%XU`7VA8DpSVaP{dX(=Vhw%~$5#I! zQUK6Q`aX-j@{P=Ue&t-av=#-If2$G|9PZe9fr$jSg~T6lD{L%1KiUb!lOfD&Fm;A3 zca_^ozh&vz5||`kzH|M*NztolA{GnDFm;cL1zA|I4Cj(FV6iz0l-oP8?x2bnukCVd zE|u6FH&X$g8pNSBLMgWs4Ohr0;*-h*A$QQz$gDwKFaXoLd_5r{DancAD-rk_7JmOt zk*cn>2&ue1C4}5@Fm-wNOEbRW$jX(vW5jVUD0<3uy_=SM#DfTU=Pc;_=>UFaN*pLSI-2 zdip6uwMEsms~MNk?A|_iC|*jqFDWTyl+@L$({7r=YCI#rN z69p2Lr)Y+1C9##DnjRpO?+Qg5x*wJk3Ea>^#~>5rHZT0p@WyAIiCx z<=hweYQb578D|$z?8-S=Y}!F6fuccqU9^~>NtxNH43f{hWx(Koax`z^@AZ&d1N%^F%u8c?ljK2laBe zD+o{p1!;R=6bv*4lrlBX&2e>uEJ2~ST$#Kek|x}?ZyXaF>kt0Ie4_Fu>hmE4q2-sS zuDL!Yc{)Sym7n9Tfvv{M`WJ=z9AkII?7s-q_3z2TJ|Ox^oGz7eGW4wG%8UXzb9sTP zvOcWTNzIG10%XTdTzq-de$-2hOD`|GlO6sKIyFeVCq&F2G*KJ@b9O1>2b&V%g9@MB z;yle7p7{;`=ehm*3nvYE(16J~F7cMRlWQ#Ia|`l%v9Na@W5=E8f~5Y1N|LVLlf80j z+)+{2Nb#MPLk)%(Di5Dm!-2w~t(gB}1dDD`xx|Gz2+dnEVsotwD&BG1QE239MG$;@ zTG1EPG&O~S5S7}PNvfLnU37=6-@eqq8_e$xamAN)!0q%x4L5v#u~e{_xLydBW47&m z{0O_daS`&dEpuB{mA7K*7mlo~93Z`9wte}x2W&jM?a=G_S3>uTg_et^qS;KmLhtp} zgw6N-i!}Wj*760wx*GKB_g^PQzs7#EFoJMeE?k$g)Jw;Zgr1Fo1-!ojPusQ3oyjXO zlGN%J7ts0NP{DVtVQuZD>?W_SZl2bgK4deogHmx7HdIs~vvj8OSG(T!)FuHAB_$0P z&#EjFIg1%E%$bx$uhnXhG%I#F2sP7k`iM!zdgtj(cDeT-nZ2B@w8xpd`HYOMHKhBg zPoR!Oyd`=vDDem;T7ly3yQd$|6eLDRX$2atOJNAFCvCn2rHs5BsQHc)6iVmf&BiOn z2I83k;m-lhe+bC=17?;H9^Gfud2%!lZNYFGGK?k_1(MzZQe-!G_X5&12{#R$1o%T^ z?KfOVPk=_nF`Q070A`SdB?xdVODAp7CQ<@kA4Y^mJ`om%y`^&Z^ow7aZ^n`e%)W|v zJ|YWydG%pdZbzTzeJcIskMAfk{oN>8X@nt=AY-eTgI^>6e|i~cFr4CZ9J}j%R;}tU z$VfY* z=afgZO>=|Z;LNMR{dL9idqYcB*2>(@*A27Rt;Q=LP(obvE+kNPjY`R?Zu$&qxUP4S| zyZ!-j_k&4L-k{bX-X;#hzcuFVQAmgJcPET*)E?ZP&@37%@#a*+n zDGVws{U4;QiqyxsD-BCsxCgQC9TIFS7`J=8acFW!p(lfhW!uALC>rHvsc{u@Cpwe1 z0_*+8UpQEX`IC9BIXb}u@OXAZ>aCF@d9lHiEYfd7ythUnGjs(LcKLDR`$}P{;Yow( zJxfErp${%pL*jvHQ%)ZG*ruOD*sw~F<9kJKQFDdWR4 z+U4NGN4&#&X9q&-1g!ptF9nnh*4&)7(%uonV3BcN$MbP)oZu zP8|i?iHYuQXB7$fwu>Pej9V?p&?>vJ0pfKbugG!n`I*BnX*NC957yh z;5chF+Q)b`xO~U??Bf+cJ0Gs@zHE}a=~zQmy{f9f#!TW|_j#C&LMU+)7?!AiGAqKF z`-m(WeOqJFDv=n?D2=pN{ax3qjee58NRJ8L_t!-8?<7}P+`qAL`jm;C|6|%QWyJp2 zX{+^t=XqO&O76pWiDf?XVZFfDmv0ZRX*ReFhiX8cWcHp8Gig{a2dMFf>+j*;9gHOb z&A_hH7U!$2g$&5@WbznotHP6w6_U>8UsXB$TLN z{Ai^M4JI07pQ3^%60cOw_H;(yX@3d=h80hido}ZvO8HVa3rs&}|4u|`C12h0i%87< zGsTdXo-WH=mK!GyJ}3rScoke~hx4uonCQI_!rKl*jOF88oY~O8_-Jg5%TC#G+E#pB z6B%vH#b|3X-3zirIDHcHSqb7{$IImho);|+%EGF}KpD=-Gpu^qE^`S{bWveM`oK3) zUdPi;b@`OCUj3BK=IIP)_*9Mf{VY?n-%tnN=zH!o&&)eU+s|ijq`jin`lAvYN?1EQ zkdQV=5`@Iiyi&S+dn%B-{ITs_5ZU|t8}VfzXN@* z%=%$w{Rx7QkQ-Oxb|P}5lXbV8B~Mo_>$_+loVVd6>U5n)|04;?40NO@iIwR3 zy0k`$UIO91Nn+lGJAfenpqcuUIG9W{UBB%3=E!P(SxA=(6pTI%6NJ8BL%)X@{^_ay zJySw3rZ~5@Aug}~6N@vn<2~6DU%KnuD~uiK4Yj6+H~>-N)|3yvYKeA7U4ZD3--|Y6 zG+FNhy_ugsPufZg-hWsx0p**O9siOf&J z-XDzwAK=ozW>dNt_t|^6eB)mT|3D`WW3#-AjP;d5Ke|wa#gp~S4SH3z0vD`bJ}r7l zj^4IRuj$l@WC#P*_!mV+tBt1^fr?xGOrn9H>5187c6~-ysI=rSNQGo~{I2DwZTmtN zO-yXUU0XRh_7A#*MH=j^1-_ZO(cxq!z@ukT#VOo@L7g1Zo5C(sPKV2ODD+kBH)NUx zv;;|<3mj#J&!u;Z$`idd2Fv-q)yri$O1U6p9Sxo=H-OmWp}()m)G{^IZPqs`%<6F2 zeHc~W`j)r!#aSR(o>pnIq38a(>Df7f!#ZgFPlLxLV1L2l5(Fykc_kPpE zgb%L3{G|Z-enK%_JpFt_KiX%4#etK!=m=oXNQ@Kqn-HKv+9@I~r?+$2Rv-8C8G3G-=iE)bc4TBK;kyK&k&$bu zk>qB0lzCu?pzMspJ!(8YpZh^T?$xVT_!oVs&PviP(HbvIgqXk}f%D&v;7{ZQt55xt zJxBp)hX2u8vw&NuI;n8+!E{p}pOQYxcaSuYj0<>#Da3Qry=Dp%36`60Trk|If8Svw zfgAC4*UKR3d0ddQe3rX15x)yI=&5SwI$DUIcQm|*MOTbp>U)cSS!bAjKA_8(AGxr) z5xUw-&^%X>r?7(R1&HkvD5rbFCCcf)EH>!S{cQd*hlyu?HZ$2&iRVHLY?9b(i zbOuOG$xB8GpA%y@M=yy`E@x;P>Uxj>?IN=VK*4PX$zOanHWZzyH*{hu-5INSqmSyv zEUa@#tBB8#!r@z64@ONbF^?463|cWao8YbGy`b$XF5 z)g3c&wEafo$Ln$xwU>vP>Xo;Ddr9HLKmG@RJ-Kryl#G1;{r2%8Dh6ZtD({rh$g^A^sgeDmLU2g_pyh{1VAnE-@b zKMm9>#|ymJ~$4)H;t2m=%u{iJ^E#r~J^ea(l-Mp%kFaN98KS!ahuH+Ww4k z0)w+3M>{(;U!1(;E}#p^%|&=GcZ>C=S%m+FVK#OZn-&FUcpscU%SlKk?eADA)Zg%W zK6UtLSpcwFig#!n*9Xf*s;$C&G+tTr9_OFv5^$?MnBd{*Oyhs-e#s7O$}wF}NI0*{ zi2<8WX(pQ>n23I9bv0p!`P1yjJ;bB%ZY(i}*AW5S+5R1xB~glG7*|x=^}3&6r(CzW zY9EnhbLkSk0^S!3Q*GTNn^{j$<;73O9l14}JJL$aITgzsfgL*Y|0o9E}V*LMTyGr7~8QJ^HlN*wJ%tf5B6EzwRs8J z6sh1nV4>J}4>M8n##x!YbWtfo-eLHdS%0<*6@YxYnOEr1{3y!tV0`x(ySZAwnMCq| zznGN$ndD;vu7a27)|v!Bb6a4RbeBlwx0%!NQxa>b$Q#{AIphhTwT0xq8P3R#!px{ z_YquOF;36!HEmD1?j66LC?E)N*@~{~my?APDxM1w^{hQpcyinqv;8ny!EcBvY|87k z($fwTkAKg>Kjctfs@v9Wx$4C@ETBPJ|K+>Z>EOpo6>4;rq|UAP^cu#YVZQyUfN&qC z!jpmY5lwFPqN3Vs_c|5%SJEow59DRaGpnY$fh;rIyP|ds8CVwFwQ3PNhxovO;$00_9gtZ)#naOv7Lgl z2DS7BJ{Wy-7P^_8l+i#k1>M^Z&0YiCs^@Hg(5s(M+VFcnqmK%z!hCy?WuMAk^$Mns!lJN!^$H zKPzsBil2Uz)>Mq<2^(bJcglH3wg5m>u)S>XZ(Zrza+`_6`&1yJ0uZ08c+-XF+03zu ziamD|3vjSu2N^9%mr1$3k$=xz3ZY>+QlyZW0Qd*(gsA$Ro;u?68qI@u_P7!(l2rA@al(NkG9)@ z{|3uamYa(pCDolf%(AKvsOut+iD1gSmsB3zIM)#vti7Af)2(=~-5)U%H^T9HplvAL zXMS(+`G&I8h~5yPsy`F9MC=Bw!`BmEer5f`&5OA;ti6+irq37x;!20aEk*ux@v45< zQXPY4;s;4VhD7Q{lvn7E_PTkCV{R2%l)Q8M7t--q@VartNOo1j-NDgcGWbgP$Znay|Z6U z7`@hv_QKB2T?{VQ%Brg7m2}SJTIDa!{hfkB4kGZF9)g#njgJD+KT}8_2as?&#xsk@ zkOyLs*o)Mex_gEM{2crNk-j==#4R}I<>9Q{AD|U^R|wp*8UTW+sv#fmXW;6A`sEB& zB1CK__lDW0d#>ik($HMbdDmrE0;3;@<@qNhN}$z*3+si41q6Q9r;+%2dom?aN=^^B ze%w)3&(_{tT^lTasWAN8)#4jT0+><)!XnpJ;^|u+4;WJK^KxX(Tf$bhMew-Ag+;%X z%v6$q>z7DJmhA>F)rWXjmBMwGqPd)F->wIpa_s>b5Wrbkvx!H7XQCb}Wa8VM1eB-t z8$E7E^+aB5r|UOKMKZczltY$%NKMyqv6m_2g3{?&(hz!fCRFhF$NyF)EC>AB)dC+N zu{brxDA7)z#X=WDPlS5m{fZcc5O!Jqe~i2dXmX={C%6Y zY~6B1S6z0tn@=DjKZ76Ajv&!~h={Ex>1hK5jqZ)LNX@_97I zH!AsebpDqIM=#UTi!Mxo&u$+!1h}2icAh`4f`;e z*Rk?n5lDNV-|&C9vC|<9|LBx0>E48Nwdp{rsVww)i6?ve-8KI} zX%S&;hwKRNzLcmB2fsTBsfJK!)C$@SZ1bK> z*VWZo@%IIt7+Zt3D!Z8h9tE%QGg8R|<){B(-7`ziT3m|WWQdPN;@x_3&`X`YtFn+6 zbN&#TV?mYx3q9|GI!t$6#OYL2s(8KY(0~}N*lw1(w5T}ySl@ik0@r9-_6K{Csuk>& zS{$Wsj3;mL!BUG5Hn!ihlNa)L0`kOg_e4hZ>BT{D^jZJ^VD+ve|FjFne*kf7#F%Ko zg2JJZjV4|k2qwB*^C#4>EvnoZPyt!F zWOfrEjKDGHbzN{U!m|3f&l)~94)(3zC$i<*iNa`x^27iJqqT|GCGM?vSQ`IT>gOuS z3!A74k>D>3y{kF!yvq^4Nkk^rpWg-7W+?l|Gyp0DfHyN>rNJbx21lpmW`Y;v^kG49 zgy4kCE<9oefb8Ua5hYdc31YQfYn1vTldD1CQSzXnnVBJodGDOo>rTku%45SKJ%iTm z*z8~J1iYQ;P1wp#{O(Q4G?DDs&;Q+r<`eJ17Po*-+9yG*O;g>zmLtN!Jms>W&mHY! zzS@LB6xa{N;aYb+UA{bx1n2e6b-lpKL*XD{SW2P)^Chp2^sws2A`Au|YU~-PL)mIhwLnq>?WJ@nUUcJ4+B1kE2^^HX<^thJthaGvNW@jD zWo`}w@TU`G)v?M?%>RG1)Gmc6>CG?D3i^lx#t zm3B7AP)KZwE4|t7c3H58%znsQsw~9Njl(8LIKZO zA@kZDY{wRN*O$Pb)~2o9@S^W(zq+}-awyoo4Ur7hZJ{d0?AyCEO1;M~mf^0|>z?(o zHJG(MR^`uX+!(=p;EaRftr--MZDhXlJW4QNN1F#PDY(22vm+vqaq*}H16_1Xb~}56 z+_X=(IWvczQa=K}r2dprqr%E!OpJuk2jTe+vic)sq0$vm(zw!hPi<|d1>T!4-HpYU z2oV63zaTLw)h?Shj-f0~8epTnsL|?tS!cixYN?!qv#IknF~;++MVjnQz8B{b&2g2d zyr-@$F8S4=_?hIvI<5MtFY|==cb1cfoKqVnrGgf{_NB`_l*732k#k;6=uaC(f{*7gXb0Ob9 zx=y?DEMPJDZPxK>7ks*2+^^(AiiZ4ty{3j4JP3m;QQ|hp7QWiY) zreeD(l;dubKSL+k46pvTEDTBNc34cWazJ{%3vZoZkAnXLZ9huzqJ8z=kNK-Q`;w&3 zc#l2Ei01k(dX3U_?DPv^Lk_{6Sofu_H3I7pB605(P^PYp<>tP6Yd?ahiM}5uCmN4I zhL33gYbg>!8jvKU6!h?6)TKvE!(uDA{jb!j&HW9x3m|It3$hIvSmH|Ih)J`VTtShH zM3u1=v|AN5@uVCXw7Jf&1}YM;O6vIevqS0K?{=#eCl+?7Nj+6EP3AF21^P&7>2Ufg zwKtYUlA)c>>z_u(%Wm@2ow2;87bhcLMQ}MKD6(1(59UQb#vzD9q27tyi$^KU{#@ zp9I4FUg!nGTlSVi8S-68I4CfdeX3TngN;-b`!bF~;4Q0;_c)CP%p;9+j9ZItVQIcp zpN-Psk9J=LV^7I$T5QQsPfbVe2I#(uUVWv)zMh;M`%y^A6CX%N!irc$YvR-IUsI`m z8mJh-JUA?RzEejdnqq4n;yhL~7s~d%rB~L~Y7SZC?s2?^^D?P0K2(&WaMYTGn+gtv zyx)*UZt2@P%Gw;$Jq+}1TZ6ddz%oR>Y+!^XjqUKT}eAHE-ogiSTVQZMBktalG?8CLIg=` zR&(CJCqszV=*SzfXj`{nC!oy9ZX)BlPbXfksS?7+!BeE9-kOUlS4zOSyVY#f{FX8e*citQ$sx*xb)ruqH&h5NUb zK%}o$k>dzW&Aq)N1%hO#*w!!LOtFGv`QRMM#xaGl$W-bXJ%|07(hdUmw>vdz1rhRA6XeY}HH@C*Q zv0Q1x#l`=b(}ZB--}uH}lzfp;QiBOmN;ux!{pdJGvQ8)`5{%mV#_(xNcXyfaHXl3` z*P;gh(VwrTq<;I&yeOq&!vdn3;2a&$k z6F!^Fht14@WD8s0e@XT4g8I=(34KMtL>4O8GHz}yMDz;?pd{jP$Cj0i1ZOAEAervd zt};U}$d)pS#U%3pbg3u^@;i(DCxZXkx7a^FJ5ULHwzkJ%{QkMkj_S}{madmn!F8$g z@P^`~|Dt*jZ1m!S1k>N^NcH;*NV+hsz5Q7Qyjw;BUON=DRLVM?BNIq|ej`%e`o;gF zoVd+0R6i>U6!}10-^03HZ=fSiMidgwjGIgMB@?-;loaL<8;xA1jQaYY;=&iMfE|X4 zROlfje<%?-js`4)pX3vv++nhfRfae%3k3M)K?QBveM9WOzu~X4OxHnYDU%Of25eV71POdYXb|3|!^khB%wr%#_& zlxl1F=65%rKTtG8|BufK|M^+MCGxP*KjX_e?+5LQCtc>9^DyI8mQjZXo#LcHnBG0< z4VZ&0ZgT?zC{GxJbQ4xX&VFw^scnO#N9`}6jiN<~ZRdmt8 z`h|x}x3iKwKDsY_UaUC3o|LGMXt@{GrC>)?$HwoaSu5Y%$%L?fom3idsXWzrV`udwHE- zzt<`<8Dyf$5knwFK%`)P@Uyw0=Z~`vMdv90AWVNxKI<00M^8}?U!_D_2 z@G?yC2jCY(Hevj`)|D6ieXvExQ)PcHqr43wB_$OFH@9+R$HWBE6Tgve8Bb$k2@Mz6 zZ*(-3JOp&x-e+IkD5=b2QeQ_b8==Lb#eT2|JP`roa6lja4dV06Iu_EYn3E6hNoNbzq7-ci%;P0(?`(6m^ z=NaW@bcMwv+s8D(AUnqtj*xxJBOw?@M(0|~ajY!1tyz7%M&HYU=Np1dKE+w009TtG zP79%>{d6ex*S3&Py{#lbIC=ba`2NqhCZvu%u(~|o9)TZ+X@M}}n`JnHdDqP0Q}k=B zm)Sk|lqS={!Yb^steG)MZaA+Va77nMwRF!UH1{(|m>eGUgpGgPc|T&U*+9{=JiWtp zS2*`8EBEN;CYn5NjoOid7HqVCF~faV@zZCpSocq-abHRJNC|^?aMeON4i7ug`s4ly zNv~o2!dtCUr-*`2>GLHb`-D_d&~+B)cA=`@cDI7hXD%1!<=t+GwK1-lbfY!=aJ8QSA2!$-STxI z1Hpp~{yA`sY74 z-dDuw(3*%I>6b!Hzq+P)y6z873<2X$1RY|+sxC-HBop#a+Z2c7TrWw=JvF*=@fa$D zs8CAOR}OZMnehcJCj=Mtji}~WN_Y7^h?N+FR9Md5#wS2p(`1hGsRN)kh!$&p8om4q zxykn}IM|d#OFIy(|J@OxQ9|e2R$JHW$c$EDfwFOiBc-+sTuu+vF|2pE5YgWN^@Sk@49vF1VK$!A)Pkx);`s zpYp2Jx!~L?*6?(D2}YQW=K0sYWkjfJO}P>`e!{)Ud{W1QFL(?uW)Roxz|>P~8N%6(g$cUPX8!0+y#Jw36Z|D2Vzf=7l*@ZVh9z&tPg2V9EL1n= z93IKRVp_f$wb_Z_k*Rx#OuL7i3G@4l-6QoQq>1~uv&1G*V}0}T5>KCFVE3(woeRBI zAQxHnsrU8nV=vBKuedl+&)=BAYH7<9CNpSVRwxZNJu7PeoWHcNqR;4}y+1~`HQ}Rl z%(k@Ty0B<4iP!&vzjQSBdAn3Rck2)JxoiJDdMr*q_ZO9h8`&&)g>GBCcJ~@?stOv> z%x5x@blet@aIm^ptvx;(^inHf>~$-U48b9H0Zzby^(4&lJ4=c%l0ajL11FDc*544vq#ec}+N2knCj#%%Ic|5M&JgXxkF zsD6b}3sdjt`=ndWDjDEc$4dqa*EDvqCUzR@r;>Qq1q%;UY_{O<-!J#P9?xZ>;2u(9 z#y%e*cwDVslBs|N2Tg!{GvA4rycc-yh0NeTSOu~ObYBAYI@u1n>gn#p))CJ5G)k2B zFqQ?)K>-o`nS``#)3SM)bnBgd{v$*lS1U`_qf?;WULO<8F|@7SX9t(ySUCvL&>-x} zoWVY$&ENmwI_s%Wkf+c0sf;6u{RkyLMWT!vjm6}UP0=_+*^=wwKkt}jV^H60 zu$D#1uJQKPjs7mQPqtFZJbgNd9Tf-Oaf#R?0(a36MdW)4hBU+@-^RAlHb3+Uj1481 z{zwTKTz7ix`h(TMDJYah_(j?AoOPuqgW}@ZDaDD%y+@eBgjahfCt`0kI8drZk)3ry z22_hCD3!^#2uE?iW>2_Oy4M#dnG*Li25NyAnEBZl1s;ktbp6Fz;}Bcy*hN<}fPc)Jk+~!C35J2*LFuQN9F+VQOF0xO-x+l8BV%B+a9PRqc@rYtk4zp9 z_AW(^B$-w5Qc?ovJK*-rV1qvTSCM*80?NUN5~j-+dMJ89@3ZVWd3`;(cA+v1JJw~Z zH(em&Qw*>b{ELk;YHRt{i?1iS-biGJl_zPKs6KkWuL@5AeqwiS6=&EIG#v(Wa?Ht% z=gf9Dz2{PvhtuFx4+Ngbtt~6*OFL@TPoJQ4p3)cd3}Nvi0@quFt*z}+{z2={+nYM* za z*Ng3Tv_HEkKSeUA%{Sc!EW=MK+wTbMoE~ZA?=7OAZ(IW>m323x_h!i3?gJi01BsfzwuV?DJ2p}r>rD>APuspz)| z{51zh1&T(}tKCg_QyLm|A-3~2nt}JmY=u=Dj$KSiENRevjSBBV%1SrAy}DcF+VPGc z`L>w6yfYuG=fi@t@7f3eeS7S1NZFTK7sC6D7W<_IO#RxoQnbkmbMx4jl{%c(Q@}^T zU|=^*e*OGYaM{d#CbVv9@7$#)MGU)j4(zgrg;o0ra9qLn`{3=qf zfmiI@Q*fP51$o=v@u6>ex^s;1Go#nBcz#o^k>m_Z)EZnKGCJh++F`pvTeL&5#KB`v z#y4e*NK5lo_YPvdBOk73JG52K5=w6c9nP2!v38s;m-sk|>&d8|4V=NJldld?$DQ#D z-XQeNj*`|Zxxj?5gr`K*4P?F%OmRIBf9aCrQHNW3#{Roo@pBM@u0Or&?Y0lqTkBC+ z%Og0+3qlYuH$1sa8h`A0xXu-OwWogv2zRBVt2EmTPw!mW@A79**Q=CF`J-vNBrDHj zVqAP@y2R;_OA9os8_Kr#%AX0n&44hrGlte=o5}wPwR8M7r(K6cpl&s z-ygX3y)~A)pL;dFHAKQD?;yPCIF@Bj3)&7yfpzv;08O zl5FWQ3ijl9-4FIhiEyu{eahn@08X#1Qy8qsx$))Y=578uh-FcZY!OeF-X#T>e8QA? ziji2E!C3E>IkEy}O@WPOofT%3`%}p)`~Qj%O0T5+pWU|gLh%$(NrR5|S5x)rsVwmcZ3@U%RHFD zlTzqf?;T5v3&1nLuW(0NpGC?d@sj7U;nS@pVTGce%uG$aj~2n`sdNwFC=KMdD?-9S zC*=(UTDWdTo-ejkD-;EKh-6{j_!V(j{lX2`JF58_A>~OQigE>uPp0amJie8vierx< z`n2CZ;&uk(!}_Vu7Rch|I9gh%d*7B?>?zI@w46o9zkN_3t`n(&((@AD*i4hX;%jBL zL8GJ#kxoe+8x4lV^eArZ($50zMp1ZSI3&AP1sSwl4wu5LD1V@_ysh7@*e6}Io~YZ{ zU%&{Xu&w8s&N?f-V>(oRh>)ucjGfH6Uql8jD39_%xjOaQoW$G%D4qzhdOyYO- zTOO^rGeg7Q&kw+M&iS3M1jy;2%FE^z}+r6Y>y3yVU*i_5?!yK7o{a z0Jgiuq)Jg}BYrh#bWp$S*GiPs1OaH7(k}AvoHP8rXjjQ)5e2g8NX4TQY)+}Oi_W$+ zWyIvsT6&i(5q9<3Y7(Thr|u&#yUQSI@x3)VXpoa@Z##VpFH1V?NHzTyjekeb`v&!R z`&HTF-MEs;EJGR*kHk*2Fni;8^NFpU;TzvVpLZk9v=A2Y=Y{$AQ=AS(;$-X1rrR)t zq0PUtgb=KQ72J}qDq%>#pdwlyEd!~)wb$Fp02zmJWb=6Xii%YxnEj8A9`>G|( zHVX!qAAL^hThywpBEGd7O)gg~EUnP0Hh!dJ9Gp4>`Lx_%8)ZQ?2an}E6ubQyqTtCf z+LMYtVrjaH2PpW+*rMb92G1Z4fCYc)RI&YaiGoDPEUM3h5d_~zKuwYAm~+4KF&oOO z|Av;qj4OmrBoH~5@FCih|KuCR+H`5rSNG=KlLMcQ^|Hk5CHR#>CCL8J4T;DF=Us)! zABz=W1dD|g7`d(aX74`d?^aXzv!B~dadZf5G^`IieU9HPx(fk7ZF?fZZKQ?KO8Zk? zNi;J4LVFDED-y)~#2=J|V7a-gD!nNtDIM(Dv^}Tf)ht$;}aC3K&YQU+W zh;(qqtr(ZFIVJJFs2F0F-bz2uL4hS8pnJAexsP%zey#GZ|9;JNB;zrN2{p$hfQXxl z6uyJyio5$e@yj{mT$kH z87ZdecfLa`-3wpGk-NK==75iPnL1ylMF+yL$+HpJ zLk4+ddWd?t3md1+jJ2W+<&D27Q^3-co7=8!*mFqi4bMksn3d(_d07M2q2XaHM|$+a zQLCrIimdd$_f9oc&(Lo3pjg&4ve1_GgyOVIj@LSPUX!g=B!74D`iMVE9tnL!NAzEv zh!`2Pek3_TAJZ!2%@1#H0hd4@nsrnI16Oh$7ZmmsxSG{**58>9ak6#EZyh1 zi`>so;soy6x34ELs5yFT_+3ABKD~S7i8l99tNI~!!-VlB(==hnuipbe6WW83Dc zIRTE+ZO$Xt%8@*4XKiF51YW^T%DD@;P3Hf0Eo5(&c$88RfJD z(-)x~w<1~|KC3IQ5VeOsmN;aT0~q4v1RelO0W7y1k&^mDFfTTvOOJXL(ITEsFj@E6 zX5t>s>#w{&-xl+q#H4FXCxNOyO~caVGE zd+%T0Z-!x<0fcj&9c!<>_I}6@^&%F!V4i=av3CVr3$R$i8`7KtEuPp|j!M(#k9gb$ zh3FK;(Vm>APK8r@sA#?+n5^zZ5ml9BJ}q-|b165g@2PyedK0=}1bf_BOrHZRV-?90 zS1bye>$u8D%`W!}0+mk229(n7XKo9HwMBCjf(Z>$gJgYCQ+SKl$fFQk# zZHJ6#1w$@V3zt%EPk4!}J>{5;FRKL35^*<*ajwcu7n{Cu(g12qU+i$XGnO(y01-eb zi2yi2YZ^^O=1a(;dsKA9j9amC5ucH$!9Xe0A~1LK$DN zpF7%Fg=i6Y%I|fHjwp`a)-$8bmf`h5plI`6=&2hDZto%~Y^k?k^li?LSM}+eqB_u=RI-d&PI~YM z50)1U3E`=;jRYFSGIWsV^-@f;Q{oHLzbc)(ox`2S??_eMB!0e zZ-h3^PfeF4!A!Nwv@ZAqA0spc2-ogpS*;gA4E4P*g*`t?fe^1@Svy1oBHkL(6oQ4c z(Y=3i6L`FX1|%hx#2~kBtJ$0;pWcTspGA+CgAlv!(!_^o0M7W?`#K=kSpgAfW=IjI z@!dy%7|<^P`ncOz#c>NSx(Im47Y$6#%Ms!JTl?Y*aX|da6FU#NrP01?d)Lq`X&L<+6ABvIKm7Pjgs{>U zVmki<#G9^1I*K3c>J_fG5Y&Hb0rEdyI0n-V<1kXf7*en%j}++eMCWC<8yGCyK4!0K zE+~YOwv)gKhSl_v$G1LYoNM(2KzwoIcwTdSFaLKwk%kzzF*SVp@%UqG3)8JP=@E?S zYE6Ym-RRtS~h?mpz0NwlX(RTObPXb5s|1qrui9&>c{kRq%mm)0i z7lE8|Q)l!IOFyJhnY_(!Z;DQxF*LH>pK8KX1^^iPJKN#wkgA|4UC|@$X%x3R<3)5? zUS}w~+YeyKogePY!8PjE^r^nNEPLYs_xz?-wYuKEHSqy1b${4Z>>ev~gpP+Jyrn6G z;W0!Bt7;I{$LN`MFPX9K45DlPiLEhzv1SHpNNZP>5U!!lh*}EJz(3l%FqZzL|F{A` zRKWoGBCr7ew|XVUSN9cp_t59FzOr709S}XT+dm4;sQeQqX+q>V!>kT%HZ~UNFH4~= z=HQ^AyX$e2Be{Tm8&ZK$h8Il=4Gp-|!n8b>{9VTfRl5~Irj8F4=SbgW9pW&f-&FH{ z(~jOtIWxDMW9K7B4gSh+y(Zu~E`L(I(6g5Y#4UFZYq`>?S(#$Eaqj%LpVQnEeiC0u z|5e=`CO{3um0b?Z$e4*2HX<9WLHf2gBCW!Cf z3cS4wLk}IGO5wG}WPMx4%h4_=no&6;7b1&Et3`jiH{bX!%lqLY8c`@G{ZjkW%@6^n z+g*l{>7q@aMn2&%-@}UF#o_PnpAwV5uzzMe=HXofceqmkXVx7DLVBl`p`t4q0d=_t z(DB>GP-`j3!|zj{*w&6oCHue0dgHb&=_!@o72_oJ;5A?2cM%NDNCUtEjkrzT#M{)V z^@V+N?W=cqC>R4&N+ziQJqoD32x}x5@d=oIZn&d-&ZWxsrt1YD_eUQOni1X?lFV2Z zR1!xY4QSJyLfQRK6!St$HowAw5M4?0SNW1cCu~Mze5}Sst0OJGr(Dj9O0()Lm5{(amZ>GQ@`(oF_~X`fDB!vlF2kae@aFMXEVAPaz17D)APALe@@c+0%PxA_*1b=ORtu0y^dzh>FL}(s4tPehshFyKVWv_u}GhoghnP! zt6H250oR>iZ>j__lO9^VLToKN5jQ3wjykg*{XX!dvYxuMz_G(!Q7W>@EF zkYu0Zup{kqA>Z-yNOw0BA!8-?3&(YjwjCjcX3+XqgJGPPNY3rzIVd-+oq%4qErr1jD{suVcb>jc6 zvH~q*$B5;aS-<n1C)HPwVN0Cc{_aOeY{%*3ov>gd%}@GIA3Scn$3yNv`fD|JXIY#>LUm7W8c!@H z2md%|!@FLSmA#`7=W7UJR|Ueo+ADhY_D_Ec=6Yob>3K1R`m%r)WlnKWt0n8MCZfo< zTJ{pxSRe16OWd1>l9poAq++g(`gUw@jOybsYN+dD{~Z6j0rGuzn|`33Rxkr}DpUB4 z@g^;5HGlL8!)QDIMJd6*pG%t+eb4*pB7d>2FDVbGb5?!iBN>afUNW0!zNyJtceJS# z24iVt8k^}3+drBS z!Cvy$G>73)fy4I)jr(%>CDcfY{?-XDOsDxWH1z{&U|{LT08@>=y^DNswc`@UjkKl8 zHIk5Bv-z3B`~jXP3t>ft+eh)}Z*RZcSGyIo^oB@t`-}DK(~V9ov`%+x9+EFadOSi5 zKbUGFS9?pOgtouSyAP}A8tmt8dqnh1tEp-tha`lwkqE`EImQj4_qWKkH*H5fmH+m4 zf>QwtRm9QYxTH1cKF2@7;>7bUkDiej*?ucn<4a|Bu;hX*lUx=XK)l}HMyOg-$yTF9 zM=tw_T2y2nSC&Gu6=r`q@AUKGjsnP0Qw$Madyr6T8bY~fimQfGX_1_EvpNX0(}&ZI zd_e+?AX!<{+O4ply?2odRUXSI)sv!c{Go$#WQR;lwl9Eg{g&%;;qORBbZZ4bW(o=f zNcL0;gSVpp-G{9D<6w5a3eraGcS{+N%O*kCXFLGU)^SLw=�CLge}ZS?dyxa?EMx@74;O zh+ul6zoC!V>SP+OWayA(r~x~kFI4B#&VvTu+;RYhDDp$8uwd3jqMW(l5UVhS$k>dV9S0p?)&Oj%soErNN1sPS&d)IU zM!oYF*PhAxiod%RxHkH284P>R_A$3h7p9@9^K9pid~8X-A7S?pzw7e^UB>KGo5=&o zAJx__MZciH`nLn(K{$MB4B>QzK2;x&L5~kDMW<^4*IiMaz_@I_ z>8vRCu%{Ivc==`pt3PCTtywC(AbYkzq>v02CN6eCRE@GJb*5736#$iJtBB#nY3V@ROe;-Gx6D$g^|hc8jrGzPcBBLxNV5LYjKDi^`Dxzv4TG? zU>@f<|MDx#m0{U%o28+`H4Wb7s5vqVMhiR!)Xj!}VC@Ts_*+o@Z5Uwd?e7 z)@>Z_sAhYFNI@a8pFu*v7d*LB^4nV0RpS?=8yPsumKQ15_1xP-5M|3;59j+p`@l3G>HH(huVf-{2y+gR6*#q z(IW}@+bBr(>%4{c@3F?m zZ)eQh)^FN&+u_}w$!Q2i9+wdLYZ1$=*@H)VV+)Ph-yxdwqa1#Q`oX?X*JH3%Q;oU( zP~C>LxQGB2kH(@evX;p5-FjgxoA8S@QVD=}ay{i`48=cqAweL)#RU-JFGUqpkWhJGSFB3Qrh(|}ecFx1}-}TAf0Pq_O8d?NlXqneqqe8tQT4y zn2KwWYMbyO2?OV+mC`q~yD>7Mp^01tWpAcGQPny%BLDZ$j9w2d9>6DUa4#e<;>usn z_WE4Tuet{0=9ux2Kb*st2pC{h|Elx`vrg#4yS42#>|DqQGsrxGKLL-bcXi%|ptXrE zC|H|r?x~{!Www2ERIS%W0>u5Xf{9x|Q9TPa)(%xhE~;ub*R8e3J zTNGQcb(*|r=9j0l-Ti*Fst39u3{E(>Vj)u>Ue@YNtE8k%U#@%n?_9r@%kcH~uF|dI zv&wtB{jW7L&d=9u3XLZXw$^eP>>QW5=jx^$kMqQnz5m3PFYjpex2K}0KjEMU;CEZ* ziG%wq6nlyd{70iH`NiswjFd(RDDa#K6wyILmy4=JX^dVPTJ& z!UOF;r0Hkxds5Ug(UyD zkTf8@WnS|BzZBw>LSR*=&~|KR@}#6#<&e@JMP#H-Kg*dSe`sj_);-77TzP~(vOi_b z#JgxQaQ=oqqN7c}g8GVt{K3{7$#v#a?6yq;oE$bA6cSZI4^0^H^Kr!Vz$_nY2k4=(8nTI~5}^x+X}%jaY6oRI3I| zY6t#^S9SB>5{NM2Ke28fV1W{JDT5k;90e}g^zV2`X%Chp;LG`A*}|Fe&YcC4kgV;U z&g+kNK>0Z)ZxOBaWgB-<@+{!&?jD`Zzea}wOqu!Ov@YgqA_C@3N^8#($m zoJx4^vNH!9FFo@JIg-6Wd;L~N1fLA|Art%&$ma;bioWl^7|zQL<_J(s9L1xpgYF4f zRj5OGz9X7?KWWriGCyEUHrfVE)dEpEai~ZI%l_Iy_|?JKGjtGCKS{H}{3pQ*f*DKt z0!A62pCN;#1rnDIo|yzl+!x{R{;h(llp|~h5iL^!MfW|4BYMRj&=Aw&@A^i$b>9;= zI(tD5>t`vGj~N>^5YY^ca*NgYqLh7*wnW&ehJ5oT2zuu^f+sK}&jp=fnKhp~NY0XO zL}oamdl5W(_JSq%aN7)TRJKm@_8RfwAG0fk9>m)}9g!uDtBDJrX7-UR( zDTvaWx>%zBN&aI53n&PEK#De@C7kpiff)ko$2u0FmzYR71M%i}TY!GWQBUI}=T92} z)WgTOX+6!?KZYcwS{3%Vc0N((=ewqt?ytuqKnG_ig_70m6T3Fe#LjTnP@;PHH0HWm zC(eT!)?F~AUQcB~#}vrc?O6&=*zc%#6nc8kL~(j@Z$_j(R<1gooZ-rDtV^wavwIj~ zI@=c)$rfuRlGoG)y63$MnychB2a1R}(UU@XQC~5fsC9@DQvPGJ2c&|aA(>wWn>7_7 z2)T9XiEWqs8oWloO37j;|E527W8r^!puax+!bAjXhgxWi>CSvUBV^ zHa97LpRG@*eXS;K&Kk>t?{6v#tdie4;YfTHU}(2t+>v5+UEwNu2`hz%r7`hM0tylq z@MsGCWx{K010JXQL18~MVJD<23>}gQm>b`k9Qv&6J_01uR zuKVA>xiAD`yqdKE4+n{&7OocDD+kz*%!wV!-!l^Q)4{QTqih_M2p^^5661h4PqVX} zSPwiR_2q>R!uw&&Ag$cf@Z=1zReWX2G50|zeP@NbS2dxGg4>=q**#;H5u3C{Us0mA zzp|OAL~Va_S0iy9RV_Q6HsOQy>Fp+lq~1*lG;ay+{M>`bDosX&o;6!^-xCq`m`#%> zKRGwr2)}d3&o(a!0Z;alR!?3Q`nS;htTmoRF3W~ytPf&;UJ7-xQln;1cRx<6_@vkm zlG;@>Qb}qKP-f)6&-m3np@3I|4&HON(&Y^r5;ARvrpo{lDlaKy5d<~$$g5DDX6`n2 z7DMo#*^0s&2!pkFl;jvFc@7Gd^Xt!AVxW?}%c>@SQZhz($0?6`<;fm>#{1AZoSWhp zrW0po7=}0{dc$W$5#!MDpWIAiHBN!wOsVnS)fS)%KQE={DB)1Yl)7%Cm%nSvb3K%3 zKMK)0^xSZRCQ1Idkl3j9=*q3$zt5LEu+28d<@)8Bp5@;C^7mpjpbX((s6ouwgjypb80y+^eYBB!zpa0_z5wL*eNRNQ|Spm^1AJ=Z6e}5`Q|OGZ;IkUxZl4cOtFZ< zV~@doWfeD@Szg)IQ`g%&IgXt@KgZ~mx%SAzndeiH$#S{95_-5?hDi4&53n?EY3VW0?@;shz`eEop~*S>qZzkD>68;Ch+<1(qJ?mU#9r<)%jN2t z4KkN%F+?iDzapPtA`lBC$>y9rfa*$Dkze~x`(XeDEJnwymb-`ID-oYEI2Hxl9>i@G z#(T0x_7tdpel~#(l;|lWOinOK9NI-4IQ&cBygcrT$8co7MMMC#d|#p}|0B9ejPEF) zWw~MZq*?oZ-gaYftTA~hHfhhH0yAo+RC&HaX;xb>@mY+(R4xi`VBqVNmX~MT>dKcE zjPTaR{X;D_+-Ub&sG$j)r{n;EWzO*VA|;qIZ~Cv7z$Eha zNb;UtAk-PYrKOfHqnJ2Y&Fq86-Z% zh5rX0fq$sR18v(xqh)v!5R{_uJp!)A#?jqRqh_B%tk# zs-arF|GRDalD@wLz`%^zi`QWeP~j*oU@>L9Q!U)u2Bn~2o3vn4dGiKH_zn<2**a=6 zO84?IRTRN?=V^bow?G1>f)OUDT|xL0*1ON>sCJ(Q*jkz)d`mN!KdB;bRvSbOnF}rFV9Vv~-Ik z@#Z&s^|OmdijM62jK%9=JEL!;lFn?+R}$f-6k59eV8~(%8by)!5v9Rx@-xBJB~41( z0~@bkcthI#&ZvG2ylmMZAjuEUop^VqU6Vk$D3J7@C$&UT_>fhrmg z_YXl1%SG9#@CcWwNlgi;I2gM?#|Lwa^Qi68?f>3$YHS?0B>FJD=YWipdHvy=^~9Go zxLEJMekqC{_$d|>hbMe4b9`9BROuDTSZ75}XmqQDp1Aa0An~m#w`QKbuvS_yuWZ?L z=TONf>e!3pRvhX)X*?Q=hu{*-0Bp$3i@q&>1)jHBO|+bM)CNk!8ky`(3raT)I8T|` zkGGIkIt11x?ar12g;P-N&;p*QIQEKhx{)i4HSXTur`P~kWHwVgecMFmHF~^zXSNhM zC0IN?%%c5IOeoZW0F?Wr_eG*0#7fikekcOrn2dM0yIPT$Z_6-KHQyQ;?|&H>XdWB> zTT}FEZql%voFH=4&<&g=t9xq@6cQ4g(qPDmDz_pvzGKl3Qvzp8)zZ&2sUg=D=)RP{ zLFZrQeFUdSz6^}5Zl9FhoNtX8$apIQsWzWk1+oF79;tt%McwM@&?zBd!+%kyyFD{2 ztH|!t!*Z9uRDpW9O`*-X{_x1q4d)*4=jBT%`smfCIpexLej?aTA`-`rr% zY>2Y;Z-&?&P8Zl%?p1L;y61Wo6c2VN7>G9S#0JXUn~`h0jniIUjbclrszDbYKoKvS z?sbn1*y*Z<_N0>j6C?nyVz4puoT(iEiE)n+i-!n0IFMR) z^SKraQx6n$v;JdrUv6MHIR$x>;+_^UTnkmHi++da#cLHme58G14B`J-;v;#i26WTg zT5~8~j-n6@B5JWQ;<&qhMfxt&;Fq)T#1pm#&uq{3U)fe;hU$l=$yb^lf=6V!527?F zark9vZISM^!GlAh*>ZgZ6$HvH2ZoORiq(lZ1w(Bi0+r``yd~a2^;uC{Qz9GZmg-`L zN3`dIG($6iUESTI_}e|D^)are4Xg}boH%N{4p~Yp6#%G-TktYQ(0x^+yi{mGP|Ua6bLfkGVXA^Di!$>jqune^e2}4B~f>`y*E~eNAo%E^l!aET| z5UxrfJMyJp2nf4_?Ij^wk>1DCllr9pdu*;$on@BGZ7N0 zzlpA&TvN6ZII1)K)y1!oP zlQ@1fP1+w%1O)PIDwtf4j~*ccwesK3Etg;q`@PK*k$_sxeOCo;+bi45*L!3#c(Cx7 zLV;w2)IZo72!>iO?u)W<<{&}P zb@3WSo$qSk>*VK$%#NZS%bTZh%nbQ(8pZb{7A`$Bve0Rz_Vk|k#JNwjV@~Hh@-mkJ z;+BQZtE)+%6v?Hi(K$ZHkqSi_n@(!74@l~77S(EO(mQMImTyeXG8T4cPS3*{xyJ3sZphT{h(iPS2vpov z;!1+e|9P{5Ovnu-2(eF1+K@d$kcFgG!8as51mgoO6LG1sT(H_5=-qXrkblyV2^dW| zK~Kief;3&Pn6AF)yK4|PzQ4=SbR`QWGgdiCne&(#nM?m zDZ!Adw4R(9*EFJ#T_q{k=C;lB?fW+u?=8mJ;~SXo;YseneH)W=8ZTvEj+)K z`qSw7z%za#-3RK!#O|J#Um%F$hoH;8rKc0^R6k6ermnJHrzezx_7D-8ZmCFP$G_+v z7@AvdZtkrVhveXhNGvTsqQc2-A!9%_XF5b~sMtQtcA5wBN4nQiK4%!LOs=)A%#@G#%$J5MKE>hC7 zLYvHAV-A0Scw(k+4noLkm5O&&u-6(=^>tpZ*hl)9_;~O#dg$0OSk#{YM?uY_vh})b zCJ`n_zhm|PtURgWX^3J#Iz)!Jfq z2$O#)`AHS%U$8rUy_lOqFA>OCMH&SJia#;ZCQs*ojz0-@mf-=|=$Lk$rBXwY4-zng z`N!C;!7Ov%te2e78Nd1XCyy!(*)N7I2d{ryrm1akcnyl0BMUq@)QOYb^*!RxOSnLN z(t}$90Z+9yEJ#_b;pk7F_ z!s4tdec`#Yx4kV^ulZ(5Fk1ep26#dMd`YZ(Lb&s*V2SA4{!C(QVg8S?W4svqlruVi z${M;awuBIqE=UbmnIf~(&&!_t%2v+I@5$d{u;1ozImEHu zi@eqO>P%<^hoI2H)TCLwwgSvixVykFb`#TO9re)AfbT=MD{?Fe)Vuy5thYRS~d0$ zOrMdF1~Gt*7D88&T4DNEp+@LOjAqBEV#@HHp%r``GZ0{MtTcB2ydP?GzjG;$lgr*q z&TNyr(e~1K4GdYbs^^{a0?Z_29~hJn@4_jrlQZVB2*t(D8nXwex07Cy z&K~V3<>Ho>|MU=jOs7gO(Vr;zrdw_-T z>CNlbjm{^L{z^0REK2vEJEo&8<|Ng#y9;~HCFOC)%@@%Zn>xQ(-FoEIY z(2EO%IUhIBDz^pvQjKcZck^{!fHG98AW##iaFR>Dhu9~41<4P|ao~P&xBq?2iur;e zH!}kJVE|*Grt|Z$#q0eklRjwd4W!);Anm61IR8nzrS-T}N1~#**kfLWe92fAQr zwd|&Pp2jHNuB2`wCQ6}>yz33+S|`O#l#X0-EUQNZxZWQ6Wa?elof27;GoRWLqoem} zfBrUHzaKr%m3s#glE3Qo0~Wvcd0|gJ$Tk!r5`QGq=>fkv-hPgnFlCUM$jHDuy_G;) z*|RVU{?u9r`<2L+J_m#NHKJA|3b81VqmLs#x`6YGqQ{ zL#2#1?Z0FFi$CV}D{%oXaeeLsnz-L)HR&p*v8U`Y@l=Pyw#muAeK@Pp95q8&o8QiI zhsflqQ#}Yr`w6?TO+)R5;PXWQ*wGuk2<+kE^MQS~nWus$%*f0n1&s=qS<+K80u3qr zbhebh00_duwAd^^jNgoztc7&<%YE$3-DGa~8j1VipkyRXb!@ivm@$c7n`BNF?>elP zn&?W$$GuA2UQHzjq(?C8Wq7Fz?t`)#7;>F|5eOEv$Y0_%fMD}OC00PS){hVY+EM}R zQ8q8}`wJeLpb?awFiW{7G&I+-zj@uKi0@UWhC!%6sY$V%b zqe7Lh1*PFEDOs65e)XmzbDLG|<%ZkWgI5+8#mEh=JOlhsTzrsNYc3iH)$-lRW7SWR zw~MR(us3#HQfLeKL{q1$7t?1|7dtR`cRwl_0J?7*Ls0(;+3f8>bWR1EP$ZPtGkFQ$ z{#ek9@k;^~7@%)3?2N^V`6@+OGZ9sb-_>Dah(5CXy6a%xD62O3BrH??6gIbMaAx^2 zEPT~1cfCAwVYR3~C_R)AnCZT`Ylduii$XT{+e01(Q2hwrH3FpBS-mgHDTDSYL)|eq z2u1B%0$J~c($523y*}$JDBbr~G8kqNC6h3IKY>Y%)q@?4!V;MtVguAuPi|{4(fiEY zH*kUo5J2&_H>D!Cm7EXKLwNRsj$)1(;omU%OrG#qJ6a4S6hH`1E~zMgcxrpphB#FJ zk>Rqwf{TUT-8xaPUlszW?;a37!&J>KkuZ>uP1Q(?NkIa%ENEmO;a5AyA>Z)uOZ-c* z$UL|8nbFGf9IVGO_#%z7GZZnK?1x5{Vm9W4i6u8D&?_<8nw>n|Upd(0#1)z0*y>#q zCwu3?vR3K!7kvlEJOlmTQP(Pc#$j&RAPK|jg8OuO>k6(psQ=Z#>np}$XZLtT!|SuGlll30dz0Cqaz#kiAgh7SJzp> zhDIFxi}04{OwLH)lBQKTB|VJRw^I+u^T35N^=1}oUcx=Ke~kzK@b##)JpPEsca@Ev zXBL6ISQSY+Z|A_=B7n(X@z-eDZM_<(2tms~1B+Q%_<-Pw6PV5bgCqnp8nU%4AU+SD zyg;DJ>WkcyYMd;4XVllnnVbWDpSGEnl^UvQ$u9J5BGn#kSac`}xbaLXHz}gj%58+F z&eD1sOnf%G6*<HqB4DUe zD@{qao)dFn^8OuX(d73M?bCa^hYOG1)h0m#tuhiNWkdtGT54#$r2)ucno_@D55tQ+ z?q#F9Yk)pxnS1iW? zY4Mi_p>$`f{R-N8;$uzM-d>fU`rZnU|Ly{Jck=IH=2U*39PJV)va!&8I-Ilo0_wuuSfn*b!KvzGA0zV748<q1m2i+GdtM6e@s{{3*(<028=QaIlAo zJlDTny}W-q^S;3Cxb4xw&st{McHWO|zh3C(?vM2E1F%=Is-a7X{$($Wax@YLirbE3 z(d&>iV~Kd~wndTHV4Hvc$vpuLodX(J?mmY>z8X6)9Qd*4geWc(*`)=zb4e+jXnlPx z@@+}C~D}!DeA%q_e@L)n_e=Is$Q*m$m+5}JP&0& z55Yg$vR6HYf)gw@pNf6uRfyQAA~^)0eA&}e{0YbbzgVDXU^u~4ch{@U=J#_PMt9cw z%dQD{yHnd}np-L@hK8{-=Dv&Yc6H4Mmfd&@1&zBN9kzl-QDeEy&m#@5jAwB+|AvSz z3}32XO*%AGqW{=A25g1N#x|M9-+H=t7Aj%lO+mSyownXLWcKN&x&8rI+=59hDGnr| zvn?)SxZoF{DUW^UZpg`v>n$I?5~ciF4M~S|T+y7{6P{fgoF1)w>DsZ8Sv`DfmfSwI zU-zLqNq5};ma_l&Ea4X{(j6>h$KLLHV8^K=5a*zY;l?{Jx8QDsR0LA@+O%}@VeAw$U}gFT9x*}i|c!J zEx9E(56_yx4Vz{P@$}t89&DTjnNKh5X=R&!Hh!Gh$B8<=I7y+1hbit0q?<@b{Ka-8 z2M0$oMZXk=Ap3p1(?v%>WsGe9_*FIO$|{cS6&Sjzmy$fdfQs9Fs|$&Yo z+$eyvP&cq{eYmH0IGk-`vk~u4Ic%;P6|qaOWq)w*QYGOXV^RT7$)^8Fn zrXByH_fCqID9bjy${M(8UcXVO{QdgzzW{8)4KSBWU@3UnFJ*rXZX0<^Yyi$4V03o8oP383*g3Fr z$Uebb2C11MnWS5l2)H(EgI*#b!5!y5npdA1#l*Ogkfd9|VPTF77m&!2)j3BG3v~Ba z#~wW2oKYU6;M!cfv!%IyoRo*^d|yWou78AYmzj^9z1@*eH}lBesv z-m#k{WetuSS?Rqe#a1;~$ZuTHZd9VthCG3wwrOlOT-B$zbuzFRxjzsO9fp>R=?zNg zpw_}1oTcmju9+TRe#eiN>umF#$f6SiXFubOOl@n~~yY7$ukp{z|5WvwKtU zM=+KS-}>Rz#@}B1(`6MFuAi<2t}*+6%VksptAixa}f;U=x9tMV@B)11HLXP@#@BIvF%lW2h!JuiUFZh1`~4%M8tlkleOW{&BtUX$pFUjVM|}$(Hgiu7?3QrEN5?>%e-e5GAnE~!}GXjOi9WA zm0Tj7jO~Xi#(lO9$ro=hg8W-ADdN-tD=~P%H4jTTcew~yCb)zn`5pr)pg;PgKQB0k zSUU++G{t(xMGFgT43-yAZ!q1$=gKp9dbGIKZjYTDI)Ui`hO+5Jt|N1+HLzNB zCfGiros&e9{_WaWADvDK#LL4O9aeB7_0xs{ZsYPc12~r-g5}_;*~1qTX7D^z-v@+L zfrRVe9A>|KHIQ7Lvp_zh=Q}; zk1x_p=JWd3f1&UrQ%@60`q0pxZGp85d5sFrDqd?iLPU=XJruxbdnGzMM{1mi7RH$% zQ(L(&EY!stefq=3wm+Ke=X6H^Ecm@MhOwwJ1wINC9u`(`B_ow^ff58%TX&T*RzoR# zS^)Z)646gA8WI*y1tf3JB37`8ZQAvRPi6}Uk&CLPQnAUsC=O$!X)*BH<1!$`BQ?47 zc>$FWk;MoMO-3LeH%_t9~2!_BLc?G2FBiVHlp z>s+5tSukleN9gWDh*}leBG3YyBXJvYz0yq{ybYbZPz48ZGeTXu@&Ut@vVZP0bk)7u zeE$i>_lFpZRn`PWa5CmabdrE(bsf>yms#!HESb9K!s3^@; z@c5Y6SGM|ul+d<;NYkg!A|T3$GPkvOHw1q~?$!f5~Tu&u@35>EFsPv+AoMsn2xWev}?9=PJ^>x)Ji zPxB-${Po7~jDwNJdns#G8pZ>-s+)TB`ppB$1}I4$iuCY~r*TM88JrZ<@FWC0E2k_v zO$Xr=Bl_o?rU~ogVj#pDY2&=AUX_4Re8faU_05k5*)aY2M6{d{^aCun1Vl9PW_|zK zj{ZD2u#pOG(ptDo6kp%Vh8ROa;MYe=0c$VL*ZE$0*ibEDkJ7D^%8h z3DCZ$C=Hi~kYAzjggp)B6Udo@a4PJM;IR7Fauv$&5ycuV%+rFgFioNZAbLgYaMNK@ z(k-(SMUp`*)fd2^7vemVn}hi~JPsYpbZauzLCJJ5=9G?nxWkp@v5F6tf4h-|aW|dJ zygBd+w)Sa5pTp-|h2!Drbu7Ivp;*0N*UpGsm_KJ^Qq}zoY)R8%z`^+n>UXv7Ep$13 zJJG??Ncwu*lgP6!w#;B6PqMP=iC)~Q8Uad;7Dbm744S#Wz6_Fy*I@YWDDiI%UZ&sN zuM8NiR&KM4!EHj*5Orw*vWcYM{)tB)80Iyzi_n5{6#P7ieSmFWP01&19LFDK+VXN8 z=!;NfVOZ?)6RbrreAMQ9R0xUHdbM?N&>H30pY(aI)`wdqbo$;j+KEl*Y;0-;7+_lW z8Ggnh2a%#u9*Wd{nr*y>=}$C{nrnWh1jFYGuAF=mu4`6rb|q>xXYWh%Oj2X$xX^Y_ zX!F}G1|cUg5E2jX;FOC}iZtsjXo%g>yr(!T6B#HB#E9X96bLE?$@)0XV?^X5YRz{A zFOp(9q~DN)aMK7LpWf3hc|CO^s(+WHNA)p-&pP-UB>YJPHN+jFgbd42j&*_O#=!-F zq6%-sFJ+-&1#5(5#9s`<@4e87tQMy;{6kas7`S3V zMEA)^x><=wO^nPZZS)BvTjI4}@xo|e$7M%r1M1B;dR?U&HkQ~AqGjNfNk;Nx;wd=7 z=|YJzJ=j`+yW(}OnXjn9PnB?!$d}_)e*eCqhgY%O5{?F6i0WH;ORH6fLhBD>$p_pt znW?23FB=I9wneMcok_s_1vi5xL6yrZXI4mWO?(3WDIo=q#|__OjqIe3x#%a2i-Vu?EYG2GvSYblZa&ugbXa-9%Au0x ztG>d=o75D{8e_6J-y*ka6Nv)HIZ76qfLHr`1+}&I0^E1TjMU*U(dPur-TXO|mRdu9Ca%8r4YqO-9;+EWWF z{|4=s)GeK3vn{;KgdQpM`Xm-Gl7{Vut+u8;6oVIADnz!9HS|1UW!W(?3iR4g9#Th2 zRd`UB`*Ee7P#&P(`@>#V%U&Vpy?Q+}WxA2~wj%I?OFj<~kTTO0xDx!ZA(cSQNhx0bi%Dy*VcA+J@=_?YX2y8yvMYwNakIaaTO&s8P**( z7DI7}9TDRULQZK}3}=K7;-!J9mN9SXm)AG=)%Px=Bq4zN%qbzdKWji1M*uw#o|-ux zc7}(Hr*6sWw`K%wHLM|xl|Wb5Dw8c_a-?W70^z(J;+vB}G5c-c<2tw456OMopGqH%pe&*sl z4HmwM<%Nd<;)S?O(4Rz-M`pM2yItdPe8_BFrlcdPF)FCFk?ojY|SP2Q4!hkg5xv^Z!2E@rG{baVkeCdXzBT3SY^t{z+LjM z3G8PY4u65?D_Mx33n}VjV%z!nS7xYQ-6401Rp}(0;A{$R-NDxP z%;iq|0+Aeu@#3iP43B@RY5Tk$le}uhdP@d7w zH4GGYcXxO9qAgaSxVsiF?(XhRp}0eFcZUKkQmnYU`*#67&wI|V?-w%+Gu(G}cCxav zl3j!wJzsl3EAu_iB6H&%@F)Q;7SsLN`bY9DwR*j@q78(WqG9XPhvJwN3gx=SJqNh^ zC!Vh4_#tZ>sx=yP2pTxy0I=jh2g)wF&d4!;J7bDKwXJmZ>4DD4N#E2bZ8--N7sE72lz}xgZ&&5^-5(Qc=4M@L0!5#j3CKrO zAKT~jln?-*wt8W~UwOvB=ATh~{!^@B%PaZcK}Z<P4mXyJOe0@3 zdaX|kh?r`((d&saGlJdg==NpXRN$z}@1n~V`Y~c3U6h*r7+~UD8@qor$Muylfh_)& zMAXwu4tjN^Z_a9RSdzY~ry6$cc{~W^QZDCKR3VGEs*Z$8CtjTKcwMlj9J2QQ$D$J{o2(9RV%9>~07b}c}(wsprR2Kt0Fac+K&qbB2pwK{(BGQORaN<8@==0yP zeEZwNzbOcbn}5H+P3|XoE4d(ivDLxrR|uny6>JnE`^x9^8Zq}P>N}WQz}#;cJ&G$z z)}sW1Pbyagjwp`Git}RVR1y6F^Hb=}NngHyY{?a?CJl*>9_a9Lw!69E5oG@cvN4@p znbP4xklprO|M5>o4jH4I)-8!3321&8)~3!zt)K%IMWU}h(|0~+v(UXnI+3IppMAlG z#v1Z6nq-iV(Mn+kVudB6a&}I}- z7q!kWdjOx~!Be3v@IIEKR&IqB5$&;CJO{I0@f_6tjM?An@rXI1VuQj`uF*saz?r^z zxR09_8+OCe<5lbDI;wUXy{=xZply74MyK7-PfzbOo$)&dCSc#!m%tO3t>+aoRXG_> ztqhmtCsc3FhtH}t$(=fLqm9Gw%|;#%1kifZuOzT{@Hb6XI!kU0uMWZ(sNrPdH5{GQ z4}&4=!_%Y5XwUB1RyAyooDcR<*hBi?JB#BKqC&$U^sE}1x`4(qQ_9}^vjUD2uoAO- zNwk{?D%SJ>H}V{t662G69QR8PBNKhsbIS6F9T6yIUL)BHw&_GUipD+ z@`P*(N&-4KQOjgj0Q`-S0GM}MW6096jY(VRE^}VyZ>VoovW)GLW%T%}))zi9m=*q5 zOR_yZhsZ>g$SQMlVx5bNC;7>lVMy1bHL)u(?F1Xx>>q?ba8bdbJns6q>^F4SciT`4jM8uA|A9W zmgBS_V#X#xQYKZXZ;t&2jF6F`3SvgGiku-W&lYJV~MXp znJ?)?yp^9WP(Frv!jL~;9xJ627(*|2Io*pKW+kqCx1v8(GPan~jdcz@ojNcd4tx4u z>OD*#M3!lr-C0C~N*Rzs!vK!Nu3oibrFRADx2Y!1Tp?RYqtahbOSdkj>||!kAZF$y z7K7EZNUe{kj*+3*lo14@iP^CY2`+3iz&lj~OHk2@Uun>f1|!uvl=mC_%galWrdjyf z10Oz6`sqJnGAx8R6UDLeQ*+V5!40CWHSrXXgPpwzW>_(J;joW8;AFv&0WfLAM z0CGX0?*(cB)j<3b>B&#w@TOoI)US`Y_M1m*;-NFOQs7Wcf-qh_Ue_~CCij{BA@l(R zAjZnQ6mX`fAHj*&&X{0Ag+)BTbi9FxMlu`kfdcww%~!uDq9n%hL1#)J2l*%k)*aSW z1r$bqxLzE_w@g@XjO`QtlM54_jCduFQq@Q_hw^=x2Y9=X9~G0z{-)~Z?N_W!1CI2H zmB~09r*E6{#l0G5<)q#*+ITyiyzjmKZli2rafqobQk}-*Qrki#w|a3-LE9o*;*C-; zkDi<4D`2zMI-^eHs^Q^fc* zTS8+>Mn9WtjXF9I5!%xvgMD^&aZC5`I055vn|2YUxSS$;T=6Vgoom1dl+-kdsW1SD zQHN9QVb|mwJ;g=}ehvT?Spi<_ZS*+Q&EQ{8l!0E`(Tna!*w6J^!W|m!sj6Y#bJ0C* z>N75o$4pjoq=}AtwgiQOvU5e}IVPhTw@;Ov(}@ux+MmovfW;V%4wU99($Y;z+?*>u z*Akkcrzg*d@e7sckHq)!go<|9wB~KF0ljvsi(?3vC+?jwK8mQ$MWyTZB*!XdZkcE6 zw>6|bU#vT3&fXRCicIX*cQ+YW?$MHn0osl^GP`lP?eDu*s_o7RJrM7PGfh)Xx5lyt zll}GWYU+6H*R)tGFh-IkDk}~}DWbQ!w&D z%Httz_@~Z=Pb3%DmY7Rq>LoGw!)8*-&@a zd8OvuryM*piHi0inH(N;>sbtkJ>%AM6mP?P{@gbLIl&Ws`s+Si#lP{2$rraR?4;ht zdvPGEB~R&!Ky?BQvmnfEFMeRL=dtCZH(V8`ftL9Xi_bnnh|QaUlA7E01CGgr!Kt!m zP)7&20HV~OWgP|qlT&ucd7hHOVP-}6_=XMa!R%mI8gH+VAA|@bT}HRjJ5zE33}t`O zPC*d13IXLw8jl}SoBBrF#_BIA(twdMZ9zh7XQ}#-&L9^LlyU~9W zqAZF{4ydlFK@T-kWMg!9x?~_nFDRgl>Fe)WUXDUDHM6K@#X((1L(WbCN$L{4`68pO zJHy0Io`CjVOiY|i74cNSr@#)uRe+Zla>YBq-aV)epQpxBAbN1eOfJHRhGkp&2-;AZ zK~;2|srHr>G$gi6tr<@E$vtJ9FsJs9iZ9U)Xmjir2w4CBV`c%;EzL&_B#vPh592@+ z5m-J6POR>BYi|FNaqPgtiHLf3naH2yb+#O=DPi0d+VTrNn8~ z{1hwh!NAXQmEVzr*4J>yS5K4Cjg5P$Dn01sYav%78LkV1b3|&J=R%2|-ld+%PMBf# zyy4q|LD%AeKfgOaqwdUTl2G1Wbz&jSd|LNtV&s8!(1c3#`UsNyTQODv5`|iA7_q~u zBJF+Nbk$4n10^Mh+NLAp;9F(puFp7>>$QLK<9mcR(N(_wtu9 z%ius2x!n61n~4m9xF!I+l?1TM0r>ygARWZ}o#Iav6D>&OBwS^MyFkDS?vLh9FILb7 zqsz|dteyZ>clL7|{gV6n^ABojuh4xWW;|U#rrlL#Pu0{>c*Ww}gV4~AUQnaRlTHE|quWIq_gppX&CXIkCo`YF7u+yaBtAnMUd zdL9xfOFlYgh`?KrPmZ*>e}HwnxHyD0^%uLm|MpNuAVrhfVA0(fZ293tdZt0TFP}QL z7T5dfMCiEMbqVfiuFXzICQBhnD9Ys;tN{~#Eoz^h7d%uHG4T`t+oi^&dGM5-f@BWk zzea!&JD30a@Gp69RD^g0TKKyn%}m8YfaPq3|L-qSl{2lbpC334paIOhQu1MJZkGf^ zL0wb;sMm|tD@W(3WM~8H@-aq7rz+$$O*TYW(EiULyV8K&c1O}B$X;;RcMe~KiHX(D z;01F5nS$$;;vBdjzDL@$fpsjr)2%i&e*MAF{(dQBoMPn659HNV^-=5_$QhLqmvUW; zN-X2MP0^>l(h6DPOFr+eXZ*Ciq?b1iYB?IuPvvVE$D}`rZGth}o+r0;7)%}nKiF-S z@KoukQ#^6s?Mp7Eq$Z?(zv}kZiv?yGC4kjM#E>h98_bc=G0^0ZopJxjC*qe+Y4jdU zT>^yFu%BM5+Fc%QVC*-C zL;ar*M0XYQBl!15@d(j!Sl*|}Q2O^yfgw6MRaI3DwxZ<@{-^rJPVp(gLmmb((EGa) z^?Hqh!0Y)td<2MoFkQz6eKUfcr!CQ-qRqT_NCriA+xe>0EeDpcrXRk zRtOzU^7h=RFKj`tr+)9jPRj+l;*-S$!E9;=Q5?RjQokqwo{~Z%A_71X{aNAybC~~& zM$+2=XBY6sNLp9nO8f%c#ajx+1=75A#f8NE?d2St>*FwtaE19kbtc_EPFEf7NQMJ) ze&yu|a#`GER$Pfr>f#`0caFqbOSlDLf!oD~w#7;;%AV6D)7ule^7(F7%bxL+kyTbB z1kXW0R0~r==L8N z_*a~3x`>*tx0kv-LC+iq;mUAOrN+#g8$)$b$Qvo5Gs^1^jQ?U#lE`nyz#Chzj(fwE z$LgVOy2M&SUgeCD?B^R2*mrIZBSZ`H>8qWm%@1}WTJ#kWQf?}04$FdSo1=yH!$3E0 zLylN?_dT&U4PV3`Ee?U8T$cYj7a-TufXYtjvSos7#9hyS)rM_45nHkQ2m-c41_FbC z5IB%=%gn_lYGg$2Wi^9du2J{XovGF36xA9b?Ziu?!8#PdQWXbqZEy-rE}MX2^SzN8 ze%CYfeaL62j?yB@U>_pwkbZ-8vG4Es@Sbj3oE&*-I z?kk-JLQmW4WzWdf%iSe32UGWu;giu69z4y4!@u`gyk6LebS-8V;*c+feX%wx9jLao zuu>AU%m*KOK~Ni^KwD^9-pz?JYHI73s3crKQMLcu_>1R$y!raXV5cg#b6~ikodWdi zV-Ts<9lLCISTvWYOJnYrY9KYJVa9x!hv&)=i+hK#A2L$^W!K}~sxAkdtkleSC?_1c zE+lL;OuxoT)R13o!(cQ@-Sz3Vp~2c|hl#4VQz27RcvNM?7e8PMx^C;h*Z2sGmP!T; zx##fRS%Me1l(Jo~kMZs~#Nb6bMx@w(6B~NeV9osA%3KALMj(@_A>Zic%7}pzd-v72 zD}a&z6Cqy!tupQYRA7TLp=$C0!XBj3xS7EYJTZr*(m>Zc_e)eCYB>IcKz3hW8~H+= zcV20CwsODMc7A@G*7|CjUu$jwPRzo>VmA9NTxAW(RhS-cFir^b#Ik}OWKt43|NMLL zJ0Q2bx+*+z&Ikg)-?8fXntgb&pARJ1Jy_-Hgz#y&vtI$8?;FOrAstNCBf5c-nH>v7 zoKY-hFk)qE53X}0Cy!Gj;5Xy6QaVN-l`VJeVLQ+Mdm1>A#s`MI&wy!N);fc!Q1jEs zv#?ngHFJOQj<>r911C_RZArWvGduJUneNdyt=6fFwvu!tLX=k6#*MRa{c)` zF9StFg5-ayFC%tPU~6becp^Bln+f62AUtspx=+Bzd~W9>Kk6O;l94~DwI+QJ=c#K zI1ULBE03x(kDV7P^-w#}4l-~19b7=f@Mo1>C0V#Zgm z0y)5!YXBI5yOnT@n93rM*R=HwNw*X>wBA}jqcBaMyID$b=AJ%;cSbGd%0$--5wn| zImA_ED9#VZYa1UwJ++2AP<%a@%R&>l*!}%(W+n`Zpe%YepH6T8dVK&X#fa^Fu_A?h zt(&7#sY)PSKB>(etgs@Pn105%_DOfG=|p2wt;(NbbX*P#=_ACqu@-Jl*F9YqF|0rtkjIXVKWz5V?L+ed8~LRVxB z*QZUsXjxg%Ft@%3^R;=7;kv7P8tJwA2T_^afi2F*cGVaRirCt`j$%V`6iOAFK%TPO zjB_CvNn-E^mc@Qk3_RnV5T{PKz1U@A)M^a52Sq}`Bpg3Pq4Y4{(IM&!$C9?QS!#Rs zL8EE&xD3;DpZ&wpmEx+~PKr8ZHcXmF&uj3m2A&hpp9JtX*`Ka^-=0A%xnHhd3$^^L zm$fX@ZHY_or~%nn3uGIN?LmP;#24x83C_qS4TQ@R4R)gbtfBBnlKZ{(6+0T?;exl1 zruWtSXgU|t;@(W(a>w<0(u&o_aB4i7A&2Eu3LYsvJ$&IrmVfpNL6k##tLtQiwq~PJ z3G@V;>FL!W-v@Hk#B7ckU00!6fj-t1;Kdd!9)~UYCOMf8{esW49v-IxCvJWE{F*(Rk>%L4Zfcs)Dp|x(lBAsW`9<|gi!%sU)3}{LAENh*X zk^bu%(1#ES)r5O2%zxCkNP8HeEk?*OnryeFT@F4bJmW-NxL^D=ywv$vr=L9F*C6ot z72?Q?H>vD+u9-^Tyx?Z-=LO8Q-M}%Qjq^bU9yu7v(BZ8=%F`21$;2FNy5Cw2-~Z(9pRbw@jm{EyUt0qfc|I-Y%fN?O@2Vq+t5QGCx_2Za!!=*)#Orq;%>X zS6EdwGz@$r8(_BoHHU7c-jr6J&b7948c)jSDia$UYc^RzkR{+fersEK+#mWyr9vZq zbbI3?+Rw&sd}-`9`Sz`u3-vj6>p>43fUpIP>eJ_zs7PFn&VENrZqUSf2Yt)&8DQ(` z<&EKK4f^(Shc3}*8jongVZdcNt0$$?;h*?2A~g8wiRzz)1$BHbH`Ef5gah{m?gRJT z>WR6Klv!reatb|ajZBFU#GY=~y-}Gh%Hy)?@(F1I<-2S>kR}gXW2c?|P@owu(#q-l z=KN1j_e44#-yfPxvNusWBK!NofkhwFd&(n|)sN3&v#BwbCsixIo&=Ywyg2^UtF&QV z-iga(zQs>sZRpqd8S_;g6*u4o9^}OOtTZI2-2C;C;A8!nC0q!`h^=#{su29I8Ssa1 zvWt~=7?y{t`&mbzGTbz zK+dw6l|k#&XrYcTlb^M?&qIX-zm_nTS)t>I95E7w6HOfF{<&bNVo*}tR07^$Dk2c} zVvQ3nMUk^TRAVL+&8hwmhJQsc5&zsMa}^A^SSd_AJjq_2Ky4`Y!r~zRbZ{l8n=>(A zdc!Ub1Y9o_rrGHjf@lQ~H`(SOMInXTD?$zodGm~v2BDiZ!6j2@3`Xe!!^bQgG@xxT zo3n?k59_&GZL=FODRjLd)=<%iqJht03m*~zi26f;2*cg@kw1T9Q->36F=<6O?sHju z9b(ll)2#JFD>h>Tvl!J0Tr6~0)S&d5emi~CTE^_2gcN*s!x+{EEVU(TvhoZNv zBfLfS51*{uDfR-01)$uSx`p%)mIPw@2aMZ>j87t*REPq)Im6)Ns%vbunkL_|syB9# zg};J4Qum;j`v0IiMpl7E{FnuARse>L4R3j39^%u<&Vy;B7hcp?KL_`|k^N+Vxajl` z9lEqm5x`{$Qz6+`Y0)mH%PMUIF< zrUnRa7aJ=y73VHGRon{A|3?cz36tLarbc-Iu0SaH@a_%vc?7`;Px;6;HLccipY6 z78Jx_JTH|b{JT#jQXp&eWV?NvrHuX>@uZI ztsb|qK%o$FR~vytAKn|8-oWhLMU-oaHJ-IL-0g9HMS!7QLXkf4izYrM2Dy?oJ%kq& znl5wdn*-Nkvt#--4UzP$E`A9(@#uihlc(LPUvg0^65oUYA&&vIYI`5Dd)lFbt1Bht zT2*y@*Y6RmD*fpsBg?*;-XB&Auy~wbtbi0) zQiL>=V@{2Ot}-xB)OC49bm9|t!$z^hv+?5jU)5;)R&BFiRAtW%nl)YowDe-TT6MSQ zR8d~NcZm}>>jY31WYIYZqwD48r<*enN|`?ho%%*fBK*OLag&4LSz$oYroZfPRH6?5 z%B^WiH5#Ipd2_c{i2ohu6|lki0f?D#a)J>=-_IX0vn5QY2#$@rYTrKy9xD`e!#^xn6XHjv1U3nDk&T0H0PCrQO^ zH>X@v(y2ThHb%N5|VU@}#cYqMKg^>8z41@TYsg2QGMQik47 zYpGN&`G|YduU6A0BRB1M!nC>35oT3SapXxN2A{cZ{r$0RCnwySR(Xu@b!Soght?iA z@$jaD+CcmOqHiMb)FjXin){Q@YX{C_&uuS~VTVS!`jE%~aN#Ed!*#%Yuk134P{;y9E0s{Sm;&f-_2Le4Y7tE6GK0xJz* zL>2gwi7=M>x{4$+D2QVJ;#`PNW*&Ikma^EYy;CZ+1#IG5N&W_sI)8$Hb$u$aK7hya z2^bL5KXv_t?|z5uTb;HaUNaO?p@tEk_QNML5QB?L^yb4M*y8~hvN0%>yEy=KvCg)} z$H*=_oQW7TX{;~i!|jj5O&gPEhD8u$H~CVC$*Fhf+P&_Bu5DKI=fi&IMnLW|farH8 zY%%-^s}ZQeTIz_z4mvX)$yM4_B*pCZETBJ;XN>#?G`S-OddXbRHdYs*Alu((x*^1i%n_WeWyo3weX#=&OIt0;7wc@=)ZI zw0rGyFR+@HZBWg`q~1*HI$&^i#`>A`!XZK8Id8nB>lc0T7g|d`>*t{8)wQW2WjH5^ z&xNb4WAT!!*nC>CsScL~7Pfcd3R_#hSA|Zm9t4#L8&DDD#%Y1wej)w&B>plI#GhF3 zF0wR1dEh7njtl;k0l;SjV(G~_%FoT)QeIvhMi3lFTdaB^@3M2)s1kXIa}DQ>JDl#| zanOg^RZ}dVqTwIaj^`4L3qGwh;p720>_1R^s>&eluZTMDF4N-@f6MD|iNXr2(I7RM ziEty1nxg&CP9F!C@@K<9US-36DQK zK!Pq)6-T$=e1vN3`eC;g@E$Sc83fsEt|m2uyW`p_!)@zjkH==^8{PDo+@oP*Y1R_( z(Qp3Vc}`=v9$)rmx{%#9)aQC2RT5(*80+Jp`dRINm@UaE2?iY!sf-W)F8@}LkD{Gi z+wOi%xcyn%!J#yKGS3T*Wy+kHmGU1OL-h~scr;Oi08zn95iC6`dtim=!E0*1@c9Q7 zH^=)CpkT>=0+KBlD3pB#-po}wd7cuehhopkY5 z4biL~$_c7RKxGSvKZco9MjbJRmF4LA8~kjkWwNO?%ZJO*t~npD5pZ7r9oix9I?BrZ zpeSw(4^%~s>_#y#FzA&VAzA0cU4Iy9YMD9yE4=`uMfht~6gy-K8uHj}uH~V#1eL2X ziHfT_c|1nPzSsiMN1oIu%_)uy1qCcKjOtxQauvt%YMeh*#yMrrsJJC z@7Ml}+3S9J);>8C@$dk19_}T_!{x9I79(9XSZKC_5;{_!STDNKHOF-V-e3P9B4Uts zXuioJoj@HGzRfQ_&jn8dl6rg34o|=zV`#fOto-$OQgZ#QLZcl#lh^U5ndCpZQqKeY zYZIUt2{|n%5(gMS;TbC1zmZ6st?e0?R2D{T{9C-ZS6g9c6#7%iC#TZQpID6m;QHRB zQQ&wAP%8l{`T8#(uS@UhaT8~WgGCjalxGMtpCW3*IZWero9kiEl2v;h*T=kEI+lrH z2Zl#M4fhDwC;A4ca+S&YbTWAwNG)bZhIF6*Izmr8tHW)_hOeqsG!GX8TG|zi!l!5qnc-i71Ky+=II;d`EHhaN#+#UH1;Lqq1&h0)v-?^& zVI^aHZtpAfWCGFU1YN1^iEJdD?N1IkbP1I-a7>JDx+0a!Ysu%2cUKa55(x4&MlcyX z4v4kequT?l2_RzeA;Q0Ppb?*f+>r?X&M*i8os)1r=ZE;za-C{)0>1j~aXL5_HJoIi zPjcq@l?F6V8Zsu~0eIf#g=9nR9tg*`waL($e05tg-;r2ko5Ok|j zh^u>i9J7oc-qOUxMC&8*Ez1b;=T;Y%(aa8LJkF<~=v@{E-XM5f;xN0h=18?hGrJmr zn5ko5|KMnYUpsaW#+cF9fwhCFY?3vMUS7^W3$zsrNM-`&EfXM!hbcT1QGHx=+v7~! zHJZrL!e{p%a2Ty!4Mm9bi?MDq)QX83AZ1-zf)Ey24EvSH2aP^__~4dfW?_v82w1E$ zjbLDaiInIUe$q2VZ)?8Rw9)e((R#5pkW4a~%5YflIk{~-+)MKN50$T3Z%H-+xMnY; z2}?y?o*9sF2k*ccJ(`1WKlQ0&)jX9&8U_)-HR_4&>WX*qdsU;@EFW{Z_@F3i_707@ zbj-}e#(Xe9V3j-VZab0w*ms`%6G>t2&$(`7dwRq@1ct`;_F)#p{a<;XHEG;4xX+7i zu?S(PoJ$M$#2fC42kQk1;_+Ky?jsX|rYAp)S9AQ5{zmuy&cYu{6 zW@QaSV_?>YwJggR_7e}UK0baov}Q<^uwC!DU;;ctN8Q&nvR%NK2fJTZ3@#%D7E?TJ zdN$9Q;R!r-d_u?^d`+QE_M)=&eG1&`4hQadrQpQgy^BEmGeW8B%2M2mq zmj0xHuoQ;9HANW$?r}`{J;O;a#q6*~?#I?VdLO;_%pH=5hghLF%dPIgPw#?G@)c7u znR{d{AczY;W%uQLBfDwBv;R~&T;Dy66p0_JbQWxv)$kW7wn%~zWXQxK%w$aC)Ho@? z0L!&XUthoR$o<{z*@iCwLG3q&L-FScPESq^dnE>lNoi3}?O55(Yk81Yv(i*7 z?!ctd|H_%{d+neOavHpXNNE2EeFKBg0_#HY_Ik%>EFnSh;!E9jbuaeJGdP=bhBJYu z)_FGd>`?1%J(FB&3^x0pR;@0CZ0LLAy ziAN)&{Hbq%qhuL75kmI;f7vy7S>fdE%DsL{P@o;5xJZ;10C^U5j>XvDe2M2OB*R~2 zxy_mIn9r_O@2}q@8QQPb;Dqs~&T1_4b0UG!*d9hz{f~g~a0gaUANdr!{TZttRx2Mj z7UTg&PSJd-3N+VH**iYSxYBI8gaVOBASyPm|BQv1q)X`jI!FGSpWa%^{5htLHUr#SM=$N92TfMXg<;RMS*g2ofN>^Xs&yNNYYYeId*9p2coT3B}S8NIp#& zg6@d#ASpwU)#6P-^`FQ{zt1&$QYF!Acj?+peMhOcnh#K|)CsRqWPV49uWu}71apcl zXz=4hPFIB`st}#UNldztG~k_cWvyn9M6@;LCwjw34~7jKqlE2VwMy+;us~RJa5TPZMM<6IFpZh; zXEh%=fNdrQf$qd)jjZAf-sY(oUKrv(6uZLp z$kQdlR`b_GWq40Wa!=5}I^Y?e#s)XiVWh0U#l-zm{Op&BK+a1pC$J<=lbz>aHrV6_ zwkvrW!T$y$pzmJ6WHU*m1jyQNPvQ~`+2M?wirY5Vz##XAoRD5H&~*Xs>0b#BA7zP@ z?H&(sgt5_-aWE7$L@8rV+FgR^uDjCgVQ^f9uKfON?@?&Adx$46yq|tz2J+Q3_rLaA z*RY9Fu?}CVt2q@FzxxyaysJ%R?MttdZ=#p1BN9J;v_O5Da<18!j9*|PWGib1@Q~!^ zG;C-H;OV@fP1;IP(H6ogyOuY{jY zwN4NaWYbbAfJ6f?BlWaNimWezXm!t;-R)H}43*Dr4NPQLe?1j38YytmD-H$yH}3|z z{;#taVK_z&3mBpo|R0wTt&H!uyzuVzW6Cjw|BeI?|DW zz5EH=yA8?l0`Yw?Y@T*@8=|W{lp}f^-?Minq|SAav^`Wn1TU3xN=+4>Je!|%wu4a9 zppz0Z-nx}P_@A7y2eWhbpqyCK};47ppc9cjZ&g7vI22RU`F&dN7+V@Rwo#)vptzT(r4p1FV*ax+wa5cze?*KGYut5hDu09)$n?g}3DOotw4h`e z?ot$bS#2($*O0PxPxP=ahiPDFh@hgF@0flyv{lOgH)WEH=Ubo_@yX`CD!cg~5ksLS zA}fH!N=jtI;XmL4*c93I40V$jJ3|S39EJ@B4q&qrB8q~7d3)h+PeMNDBWNZjn?xMp zxkX0Zwjk>zcT1xhhXqV_>&2K_L-!iP?ITiU}Cp!ud*idP)h6q-r$9%<|DE zGZTHjhGIuRu3BVCzTlVM@~620vxnd7K@uIJNG;vNlNk+sPiCNmkeO(g`^v5ausjLd z6Nk%BknZ&zTT%PJ#v)g?X)44$;CsuP9_1^J**A*k#a^QRWFx&%j5xHCjRMFa6)m`; zx{(Gu!v9=Zj91zKQ4iomyA5-hAA8@s0N1slnnipVMK6BwZXRu8 z_D7Izon<%oO#ilWQi7rw827FY*K?IGOZ8+pCA-sfF^-X6;np5%HVgJkyoKiR!Gp1wb`AeA`i~Y1}U5|3OJoFi%pbdm^#$aa$7KF z`GR@fbIK&Zh%$TbkuMX`Dc9UqTG5UKRoPSb1R+WoZ%Yk5)E>}y(`%0>ZpLu+&+k8& zYqe~V0fX30<^mdZW{9cugpZJjFD(r%tR}sHPVKP1xnV-?ozI0oIxz~0u{-@l#nfk8oQon1XADI8ol zaQ)^dK2Jp|b13r`;GlpW8yqH5=9wwo{EfAuo=@ z2?d(J$?SeFW9SB^TB~X#P2~tALs7$Q+-Xdw_1d>a?=lzIcB>0}zAI`qeTDFPdJ2h= z@Hs?MsV`E@4>Oy|MbPDyR2L>+5%soO_;yx1y2YX=tcy;kDAwz5?8@VKN6&9E_K|W% z--A*Xf8r6bsz&OrO*Zlk3bGQts5SuA-|b8?DNyVZJD@aPY=W8y38psrJ;CH={{02c z0H=aB_De_)u^pUhsROS>Tx^b*QI4b$kaPuz8U-2tEn-+*c2!vc@ z3K@r|QePU--zwI|yCUVLr_XSo#6!V&fob|C1-$1$wh@hu++vcF4uxf9W$~A>Qe?;| zB;uT(KhJ4s_Wa@fc%mm08LFN_?Avz1%*N(lSC^<_SL4N+8Zjbo0DpdWx(=0_XV}QY zJQ>BgPo)cGwS@{Gy_guHm=B{}2lE++2kf)##`P#Dv0D5xN(O_hr1mQ?9|B-%0KqCE zYACsEgQ~`X`4tZ=0>XMPXN2A6@ObVh*D#K90)$vMOznjIhY!%#>QNC9etCvYYHDg` zMx-l3qd%vnMDkCh^Uzp{--^Jze~p(2>sxB#m-K<`i?y1~axsqBOSPAMN&=_Pl2(lG zK!D)x(03ljyi0d;L(~34FGP5KjXWeoK0^NuNs2Z~^fV8UuzX(3)>S)$N8*o{s{8)S zD^n5EIBj#2NeHIdk1X0GY!oj6J4!>G_k7#>&Leo>$9L9h*K2}_aMiKi5{uk*6{Y*Lj!_ zhJRxQUu2js@f77BtPZE=m3@tvsQ8hx!+5dH|xi)q^xGSv}g%kNqZ z<9qzfNu688>`qQjJ)H38kCeU%<+OXm9wS{WTMOIq_D~ZOcbmNDuE{nh#H4K*sl(Q6 zi13%D->T^04o{qBrz6}?i{aaf5%?Pe1nH@%e|sUsosd-+Z_ZAFsF#eNReg&WGrd5b^iA+Lo1piVpXEw!{NKO6#p;R{RPrSoQ!jqN2W zb_d`WQ%Rk`MiJY+k-Q%S0j>M8dZw4}slUXBU!&2*uMJ0L#SDpDUNJZ$6Ij7qk=bBk zvQ*WCO)Yp&ifGH%|B_$+bW>>dWtWi=t(5=66`0CSLm{O%uOJH{fEQ6yF@BVWEGy5R zY>TuH6VTILAKLRWm4*0ShuL7C&xgybLlb#{0{B$WeUc-{CCPqKwE8dE?gp zu^K;vUfHVK5nIr~2%K8m!{$m(2h4eP%Ng*`g))D~^Cd=O(*#TWfU%l!X-NVA6n`)T zlTIq{4NENLh^jH!Wc|96bGM*`%NGy&X5ojgZye9yrv?GDZopH%zw>=(<59JGx%m}4 zH0WotFhmQ#+Gl00D~gjx1;8_;bZ0%hlOFwzL1Vel;=!xvi4SxiH8|OwuTh)kCif}Z zJEE2Loksia22J838|FP~h5X2LVbV>V5~WswA!p0H4G;tLvJcSt8T48Qv+7$7R?zC%bCTTNup zggktjg#^Tb!queW5iDQBLf`&ZM8ZF=VoLmb74VM-e}G$q3-$c+5l!WM%4RviNNnz= zkhGipRe6sf+ISJ#Wh?d)>&G*$O|1xELdjKZo+GuQdlna?t{v>=*%pOv70Ori2ekFg z3qv+fdYWABE^~_}67F;clVla@3qG0Zf)WG1#u#bFTj>p}s87?7mt zaIyk*G_gN4Kstz!#tJ{#KnA|=L4EZoVaoqdwzmeKZ-CRs#_;_)2MvF@5H?Y*m=_lA zH!1TsV}U#+J>@J&*Uxj6h*{P_l7V6EB}!Ipm5+_B>lx;0yBa%+Dmm!*YDF=&4o#oG zKher*zmTtF_#IRFond8rc>l2R$)v?B1?FQq`F* zKYo<4Wscf@JFO@MXh>3ez-SFQXmAGRPD>-|Sz^^t+uiYnHs6Cm$XuG?7QEVyri0(;*e~jkDi%6{6L<-^52Z*=QA27)HoV9d4utu*njqPX0>cz@&g11B>H07 zrf^4JqVO?8ZKuH$I`D0nxqV}ftLJJ?F)G}kNEjJ6&s=Wd)N&0Qa?K`rJGu;+IfGeP zs)6+z*uX$h3ab}2EY|3q17|%)j!TFS=W7%lCwiTj9`ho@147>0y#g%Zo1O7yf!iT2 zIN5B#G}tS3Z2!>$_@i)Nb|Fb;XLF?p*(W@Kzs*IHN=v3(V0b)0V$;X$m`PU=xz<*N z_$DeREI*~Ugp1Si-7j`GG|-r070(ni?;$V^Mc-3AK-4c2QimDZUS;Hzs z7dp$Top&fgwBJZLxr*i-^AjKEr=GWK9Bu;C`^OZNQ0hLyONin>&l*tG^(fgPUOu?b zDl~uN^*cCIAuu#wvxPm*!EigYOg&?(0;^;h(*bbeY5pW)T1vC&|g< zN*bS~epih*5IxUK4B|kNAOapsKUr?L!EbHBcIb>`uP=up(KL^0cVh}XD;n{IN{4h! z(T#~+31q0|g&0yiEv~ez7z`w-E}qV`am04`V0a(yM)fh*Rf!c>#&b%5oSb~`pttx3K~i}syn}ejT=FX`XkgEowPl1KPsb{&6L3u$fb5_6`vtFQCEyhMhlRCcfxNI*VXrE>;jaemYAKkU`TNG zAc+sO*cSFz77IXFTN`zyO9Blr2AeEYcF>8^ib{0F`osj;<*-av$2j2fTaxp=K$z_F zRsVHSgGV-}v6tknN94`=xv7xhZ8z28X;ArZg|Ywy@54=Bjt?P`fuAQ%X$OGZC|D}( zS&Is4$>#vCvFqpIH}Od&jc6?JB_8B3`2MYA!Dcz(>=vn;c=&eEB3=sc0VI|t{Xjpk zo-gzuM7SUI#fh3f0HB&QQL5T(Qn6~35J0pV3dU>Eu^kA3<>d^fM1*L8yHtqX`(t#i zk-v{1lS73lxvXIL;QAWie&A{ig#e=@-y}T$?*hKWV^+L>wwhN-UVF(|bI=EFjyRet zci5V0=$~j|5^Bf%9e?*4>w>Ki^~GbAD()&QMurNdK#MJpjv8rUB717Yf)U79T-db2 znajg-Ix9RwRG?7pix}j6$OL+6GW^d@f!7L^bHcwEX5xiRR;DrqR~emKJ+v_r7%B(3 zQC&Rfaz*{*3ntJLr-ASLYA9S#)9coqJq6BE+3+m@Re_-V4D}gE09kBBDf>*M+<%_j zoFi3tpm7Tm9TKo|=ST?Ta}s)wSTz@&qwl87MbcezS+#2 z>{kX(PGHY&ri6zFKOnpaaC0mP??-}x>9d=F1NsfZqSw6C8jZx>kA0(f0FSxGaX)Kc1lswP$*Bu8H z+Sj6DU)jIVGpuS9(psoEtlqWWpTOuOdz@@NQZd&1-P*6unjpv%>k=l?*F|cU1`?Bz z#sosY&^Sv!fK!f}pA7&fPW6PK@%rzW32OBwtwFX5i9-OAh?p>k@4||%LHFak0IF~l zHJxHO+HK@yhW1y6>N`C4UHu8OdoLBWViFrDG@9SebXtphc=Pd|J6x9ysp8jpQ%!^o zYLhYDYp*&8uH~bx=#g#nAkNK#vjH0&NdvQv^u^Owit!?irPz+Eqs0|y?`yD4$WeJ7 zLg3!1tM8>_!2HNQfh%eFuE?xzXJsx2Tz50dlT%T2$g2mej}xR9mK+wF-3Q_r?7U45 z$0YS%Ry4DK-&o!#XcDiS34ZYJ3 zm{j<1hswRp3A05R7JT~;x9B!#Jp)zHRj+#G`^QYEKnHM2Z&Oo|$c0FDBevogwD(KAcWmhju*( zwin$h!Ur(LT^ar5SQvQCc6IOHL`K`u${T?gjO~vOuWiX9(v#UBRqjSz1t&QoDN4%u zDl1*tjiL0jPG*L4vnU7*xg@hV$$NpK!ZO$C1M%Q@D*@S7D^Crd1MM5ps`T0uvNnm9qO}&K3A4 zO?FT+^4%KMq=C%(7s5wwK;iXm&_8kvoRT6OYxNGQ{n4k7j`Q@~$SaNgD=5Z< zUn|{bPpw`9U7_6($fVn0Hyg-OYpA_GW6Ds>gfbZMCYSL7I5LMzpgTq-yeIen(8Mc% zdQ-Q`RDVY&2QG)i2ffYscMLA}xtmNjn)(?BKxS)oe_3gXeC+a3N+|JY| zy)QmW78`iBbi!a^ImPCA!unxWKB$BIb)VGFT1PAp1x_hS5-diEiOzAf8@%LE1B8Gw zalD)Dd+{r#R6tBSm#R$xU!-Bi{k=xjE{Zs_Ic3h_eHN|Ai{2TT4(6)%+j-egpPpZU=xN zZ+Tz+n5?R=Upoj?m!7j*AtaE`OJj4695dfu?zx#gCgi$S|13$OT7h32mVU*Lax?!L zx(M)4eRi50fU5HU|8OM!J`}d7om~8g6&GK{PU~cuovh+g<xfuuk@h#NZi@dDc663pCpmkme6!C|15MvCqi7^l+>Rwv zOC$9ge&>`)?a!6qJLw$DiSIV)HCKo2NP;dz@AD_6U(e-N1?}a?9(eOOHPW_3*cV=P z&vtg9*Sk*kv#^%Q&rk80E1I>>7ub;`nk-_m>IHY}%Vo2iSL5I+$4~MF*k$xLn=DJu zSkFWTe>{{ph1%fX3WyKbsQ3>AwU`wWB7P!2_LXX|`y+M+ZauG9k?CfwHy1|&@kDe> zr22u?%>A}GlX46&NaVEUrOv8NR09k5~*l30h#)z)v8Av#j zPa9h_HX?SRf_Br0RA53t<^~uWLtvUvz!?z;$KW59{zo>=3h^(s1IjJG7Z?-*9nc$) zw^GgkohXi{poA`^fxM&E2|*_HOl$wR(MJj1{;YYt3P2zf6#bri7Pk1V8I_Xcm93+- z1M(KAo7Mf&1kb2b``{CTLEaT>=&)Lw9$#bT`u7 zsUY3m-AGG!2uetINP|d7hjgcOz6bDruHW&F@w<0C;|%}Nd(Pf#uRYgXF=gXhxdvwQ z6YbN#Yy@?vCYa~?@_VI6NVVtcGFpoWT{61IV#+2Vl$=GDcP7V0K zT+es5`pAV=8C@*Cr&1NNd;U>oJBhS;cg}K+xC%oVFng=pa-(F9*ZW38v zFKi0a0{8oD?faoS3)6x|$0!A`6}@r_Pn&Cp8L<>Iu$S_d(>wfSGFn`$C#{a{I zn!x?x!IbH!p@5EjUlbIL`!z^8Pei8NP^yG#vWl=Z3X(*OOUt$K&+HpW|WbO~mpF;?T_@f6a0R&eqXx~7Qu zBtN8fMEdPnkORSTxH>Wp$8bp4_`uO-flb!xOe=aZi(AV;B|s|gkQYP?fP+t+2aUcr z>CZAKWD|R|eL;}l{lY_cQHGwK)zx% znBjl>T^>~Dd^rEo$wIyBdbkPsXp8H;N@*a&zBVv|$>@vh(AKh-Vxx*(EAOit8)vyp zD**kY0V7(82k<&?HynqexobXUtDOzlIy(MZ1?t)ZJ1~Z_Fvlqn<&(MtXMo(_?{{x} z12X8BRH=Z`CDk8r^8wG#ZXG~R!$tBGJp-*JZvd{vo#FK#>u-OYrd;u9hcnt|hUm4R z7yuE(?Q*lZ9Fht*1_lzfqGe^i&TFR9zI*?X)TQKOK~gFzwEqiq;6F~p+IFaik;9|5 z%|-a+LB2>2?4{qld~PFGcZE!6(Xi`Ou?ur<4j_3<~MI_XyL_V@+Qg^q4~m$emk}CZjY~cSG=x=KniHv z1ok^1<6?$%1i0r3wP>X@9ZAeLT!8H_9tk&1(jRqCxW)CY0)eVbF5*5ZFAH2+-MwE# za=_`vz4t?=*`B6+V^R{BsLt+u4m!7sCut&rF%(g5p5!4xqw&M5s2D|%OA>lwuq073 zvck#jPX%e<1FC)j4-iq^-&4oe;2@-}1*yRL(aB9?0X;b`U*8=kP;iE3&|Kwp8+*zN zVH21cQ3Ig`{v+GbNM00cxyvX)lZ1Qd%bws52_|8op~5Hj@DWo~8cd+1By5Way+RYt zi7)(ewU~Ew1f`3kj;E5?Q*#bG*}}@h&=lZE_nob~4(q0elNmAL3<&E}ZB_`~spuWW zD*dp7-scG;y%M~=S68b)T(7xXN|eEj_IUhvPiXzB*x`(~a@{K`zYdkdq;LW&&rfo+ z+sHFrf9{-QVrgX@hA@|wBZ+dCR~;B?yqNnFrU94cs#G-(ZnoOmZ;V{G-~+vyn%e7w z-H1dHp>RR)Wb@|}NDy7(jE7fTC6)c~FYMy8&S z03?xN*T5hImUsgZF61_SC9(XuVDOGIVQ^)J>yvs7TVY_*)3+6jjNpj)7u9N4e<8#3 zG}XVF+n?S+27`BdC>Qy@+&?VYa-Q0zkMibaVsiNcFeEx^Qy@v-<_`;C>WW{7XQ5y< zX7kgyZ9Vk3@{4ph0>kr9Ui)1wK`t-7h+#=AC@6r!ptJGaVTUVxTu<=$BA=L)6pd=L zN#r|s3-1w>G`(h+-fFIhg6}xg678Y8K$l($+r9@3O5pX@L=Jl6tq){`bU|ECE6mMK zp7tik*7T%=H@)}}%!kmeozdNWIkWu*70Sikj=D;-8LjPfpa!)5%Yh`xy-r_0%GV+< z3MXb12{m{@7LZFJ+`uqdEIcfg+x>g07Fl>fqg54T`k0edpcD)onrBzGfZ+NF+tRYk z(AWY2*TOWKW-1e9K|M4SCwR&`Hi)pulZZ&V&~Kt|Tu>x>&8DZxO!{;JxR*L=%#7V^ zjy^E$eZ)v9{A?HE6oe-ucP^}Qt8DI7WAypQ*K;vtDa>?1iC|0&hkRr;1#XsGaUyQ5Ao<|Tt}bYt3A{e+2^NJ=M6j@7 zl9EHyc%$=rkhrum)6-_wg{*OpM>eO2@9$+Vq{v=-3B(!7>LK@!_bIO5(qU$2oc71v zlh`@?x6RkE&B~wn#Z|{6MNvxq{e46wiva<-9{b3MuOgOZ0nPK190X8s->{l=-|3py zF%&BsH+wQ{h(UPo*^#`_CVW@`ah#`anx=i1Z_h}6S8x`zFJo*nuD{+=ZiIS#p4OW` zZ?ToPEqd2kAlIe3Ztlvi;vam1>|6(1T97u76A=kDLW>$ew+UGg-@=$ zPW~J>lc38r(Hebo4Tz5jyxN#KKwxbCS4E`>jF!+QBT*$yHFNbPZLpB(tJiPN*`2})0+z3lv~%Fgso>?PtSOPg^f0p8XepR%ElwA5T%DG#@OKU^8RgVwhRgZXL? z+iPcX$;P44(%%kVELPOiB$Q{Qv7;drZ9Oyr9x-?cXFdf9c6wUVXj&L4!A{;IUx@!( zXTqa9q5>b)wLG5~toItPKX%Ez(Kz&8KVJL=7tVj!E?RR`w&mKFFBuxGY5I&SOW%2OA}<~zEB)&`4l}OA>YZgd9xlTk5Y~Wg$lHy z*lf@z7h(;4N@YZ_IfPly!KE8p{Mlnccm z%t4R12e}9EU4h59(@r{6#tK>!J)M%+c?HEDKquLN0fO~~%P)m# z1c!#AB|ORO!g$&wx1DG&SlET2>|fmtovp?XU*M2`) z%##VQJE&7=sdXPJ4LQk7t=SZQX!rXCbut^q4{d0gvyIH+`9pKQ1vP5v{=FXr6x)(_ z3zHAsPLzKB6f|&vX-GNOjUm_p<8Pm-`OOSo2q1*mESPV-yjr4!|TSbMFhK_q2JtU0tNaJ*CrgbHsWD z{tkvwFt77C-c&Ny^;p4ioPO|ma_^x^Nic$e0hg}mDpKXY#l*_!=?yGO8;FNx$AIG+ zOmOkHw0BClZyYW%oS>{K`Zb_g*k=WaD9{*)E#$LNTY+5;3qw~t2Tj0`=*XLK1PDtO zXTS1LFDXMoUne`Pt5pM}lIm@`3LSS8-yuq)SI10=7RPqxrWNL8tp-$GBtotsVfVVe$M^w~(JFai(~ z@y}tdk_9TR*FxloG=E-+=%T?1+FvfQ1wShVKPyEMp*+C}m?gGH7n_~c9#W*f;=BjH zLJZyliRdaH7*$Zn+Ox`}4+$yv9qn^ppTDH+#I&PhWN_3Qf1|VlX-8q*3)qv^>EvUL zt8=LqXBu|u@Pnnv59MOrd|e>@Hx|DY-_+&Cdcj^@-`e;e9r{UVw0*`7Z<_7jEWc+% zJqTzU+YNv~?j~OY>f5!&C?hovz_mSwM<9)!r6Y*|0Y+dyxSlQwG^ZpW*2~M!pOTc7 zjcfD^#a3`z24*+;Ze0V@E=tT^rZ6`E(E1hmm%slq6X$cpmC~ej3MdfAqQY7>Ie=)b z3H!rxm<#cQ4LpB3Zz;_xQ>Oa1W4q!xzwScm>7F6xP-87$c)lx4`t*9$LclcoJUEdq zdh>Qs+^wQ`=A}1pJ5gXJ-8hywK2Xacd2j}G0w1AS-f-t|8$NE z9ZIlI4JaS7s0dq=fH!kB!!<9_i-7*V)wp7xa9`($J-8&INn)NzE*P0aa!ALAzr zv!0Fgvi9lobRkAoNk%VD;l5FlgAib`$SUS6Uct?n&3=#&UFei*>%cBNzpf$g>|%HL zMNg;K)lUslQD>bQ$WUgdKkwx+}GMPl*kxhuN8X*oYHC%RX5cb&+L0(GYj&RG-q1Pin_=1&d9 z(hn|Sco0R{=UY zHet}2m@}B77T*_2a0EZjmnwoy9q6Hff8*{Dl&5fW3(YsBq2loY=J>aowE^0*jbQ~P zL;#@V1lDgC1&L|iN0+}p$^0#p-&s^}ZkaLjj7l>NT(3NWU^5M`$c8G7g{YW0w}pl_ zd1r}1zL9o;4o|N2@W{GXISFb-?i_53vpaoR49i(W-_-ZTxiB9ah9o^shH+@CPm!_Z zx(#@K$9cERXKCDKv(3ex_xBz6R6iS`>FB7z6m{sViNIe#?%{uCws(7h##pq?A!_jV z?rc1}2s3IhW(WGm2l!UzU*FqK_2+Jfqs9bGa19k=oYAV+XT<-vRIMy4EzE?YeK(8z zLM0<{P7^X(I$d^O9}2oA@+VPRx6(Z0SC*D5=xM;M{us9{ZJ=x(QBl>Td%`Dg1r>Pc6Xz^Q&G!w91zo zo~$qZ7AllwE`|Na%MWG#@$wDfe?a5Zvm>CYT_3lE#@l1l<&G||5BoZIP*A13Fo&K| zIF&Hc=6QxiD|hxmk7u^gz|moN2|keqR(Fn|`$+!N%ID02bw0y;iC;=>P;~U{o#XDv;vzHlZvBP*Tt0txq(OBvHsS!O{0%Xk`&5f9|oHp5;@jy z+CG;l&j4!SiZk^okf$KCAFX8WZ$8O!|7~krflt0oxbV>l{I@6Qh24YYi-78Q*f^&9 zsOJpA(yzg9OgNvgLqUH1BBm?QRru5B>N7-GFfIfB3TySkaP|qs0<**PQU- zE=?A8W#s97_Lo7HaD87$a;=y1mwvr!Q2PTSYO16Y8htg$IH8!Yw|+UmU}&Y)MxOR| zm77qqkl8Cc*J zY1|U0U$f1x_wWmkJ>2)4O+VY-)Qfsa2 zqSJg6ZopykMDj>CpU10R;UGg(m{-W#2ppD8*N{Y6an)qfY^fI-az!KSJOoDXYYt7V9sy z<^s!=+C$d8)O6liu^Tgd|QU8KEgLkN_ws4|4jBGzMcb(!7DE!Kk6=U^+SWhb|19o@G+8G@8c? zf||BCuiozBiss+PDwXwhE+V~B>}$VAj1N|OS?>y_Y^G9!aJseorq1t=kxP>n+krUh zq+v=*$~EH%F3C9+<@HWP{Ng2&t5wqJb^_!HnV$>Aq+l24!ikBsZ1}$hVh;~aKBAAX zE(#v{kyZ|PzzbgdeN@DsQDvy2WCI`+PlN3BzvS)qqLwN@G)vIwz z{mw@kN;B({22SlYC2yesbRRimMIkf*I2mHo{laHAoV@u z^yG#9pHKuEw&F&DfbKn_^tSJX=(L7bKMEh>Z!y7NCSOITKW(c`&ovFS%9k|;v8Ejs zhMNwx@pBVWJ?vee5J*6E$Zu4ZrO3&VJ_A^^*sk!<#-MobfHwqh z!;C&JE8bYl*mzo!Bsp;>(L}e>;&grvE)3`mi+%GNrwWcE>HKoYBkTLM+~f6KfEWG~&qfLlhyf?lEflQDXD!EQ z!(U~R6UV=VlwF!fC*Frz~AfHojYhd7ku)>j1 z{9DB-FB<7YGxD2PT)**n1lo#GMV3M5m$ov>SM$45QkUnF+F(*xlg<)s`h0ivQ_3UO*b5u8yvLLvl?_h=r~)glmXu2R{s} zsH~3b^2XbU@NMs>c#{_}A_O$94Di>*zzS}OEhw^)I=gkWRzx+w-CWm%aldAKIic@g zCAQPI$ywe8k0k$YqF7UbAM@rE94|asIuR9$h=QIqV_gISeV5C4I@kS*$)Qm8-}48| z9DC#)sQ_o8k3c^1-#8b{Pxs=x!SQf_8xd+@EG}$h`7ENYw8u^$!4o<}Oryg;EKE~u z*Bj4SU6Ut%-NFo1+W7v=q|)n_;&-7l!H*6p6LYyJDb~!b@w{(eicu)5=fiP*-_!Yx zw>1QUoK07FA_90D&9H4MLR75Rd5G_8=~AC5n12?ViT>F%#KA+&casKip@`lxfGzx; ze#8=c%nd*hi4(7r0Mreyph4e9LOa$CH-f%E>NPcprk0-U*r>NA(xMae>8H4sRgOE2 z@@&A8B+cVE22vJD>w9tJ(gk-g#2t#(E!ytTr!N93gd*%$7pN*-k^&WjNE6W(PO^zY$Q55`ZWiEOoG78N*AV*pFZ5X-dc9J0TL<+ zBQ5UtSmzAnO6x-4p;FQ^lw?FGm#zhr(&{cG2>-e_B0ozYkpdh&1t5*LAzbh-6C(B$ z=9v3mhaD>@_lHDIS77b|7Cklt(!0JElZQ}mNDj054Mh0=Xwmb_>nLH@33M@Mma2NW zC`QHE&!3ym4jM2o_rJn(7m6Po`)9;Qc^=fYm(&wDL+W4RjcpU0+@)JwS}HlY>3UwW zPGc~n($E1EnG*E@v0o&L*}WRJBYqzCY63Iuyx8NO7gEL|Ux8vqZX>pSXoq^8BY#Sv zn#Obr5*dxN{W1gdy#}YNQ;Wv?A`f~=`?h$Hz`fm(g0GZhT(T<|@ne+d4Z7~px| zq^W*pVG}f3%BNTzxp7DXXafMjm>dN%;XPiR z^Ow$ehma5X;qt61Au9z6t-1pBHGApXju7QKT_-==q@7b;C%dxm`B<&uU$Q}F@_PmE zH{A>WO2jRxP@z(PY2#uM^C^*bOYD3{6|eSi9)5`x7?Wf(GmpyG)CQ}q9i{MbUaCF) znRTUvBHAb;0sBvs(U8!d6uWxKyr#hrm1($X3b9&RE0R2x$xZzd^82^d3Xz#iXXq>+ zL&F@Dti8)qhy$qR*gNM8HC$EC@cwc}zH3aMm&2Wu!`>nB84;e|{kOQ6CZ4Lm!Z5s? zbcRyumVaEB1Ylu8+HqgdWG@)p5ds|iqrt9`K``3rwExU{OTuvban!JZ!!qjq3xV+) zo)Bhny*BSCbPJAw6-ZoM3s25f2Ow{N{WZg4jM$d`k^_TLJB^`;pO2@jNDMW@iBT`m zxW`2X88f*Sxi}?)wNQ>=*qUe?v;m>~%*XHoS5&UnOV3Am{{N2F3LvjDb^Ilc6&u*x zgEOXJ_fBvEIyrDUL`5g8(ob)g=EkjO*3@5fC&b;QU#}y2PAw$qa~^0D=ylNyloN_W zE@M8#Fy)UjQXLduDO_zP)*UZPq&i83(P(IC7KLX)#9A^^c8 zTfzZO3RiM_M5%Xu{i#Ew<*@r2LLvRM=no{ASss<=3{N zgdN^|whR$aub}@uh4JfIu{tXL+*P*ivastF3m&ECo$X$JR`d3_{L4J)f|D@|;-Qbc zcOHQu64K>jA;_cD-)b}zdEIe>Yj$f_XCjivYSie{vRz_^TmUsGNusY$HnbK25j&(t z5`RMt)=wsA{ePe;>>qkQpUhDh$W*UeRQ|dCNiHFt< zN1T%u#Twh8T2m@7{xNQUZQ%k!R3m1Bnd%(Szyt$PJa2wd=SyXd~0zHcUXEQ;;C{1eT~f} zUAGnd>8_W0(S3djDXsP{=c{}uLQnKH7zPGL_`Y30aQkvzQH9sLle^?rM8cKk^UI7s zNjq~djcEr@K93Kln?0FM%*Fch8Scd@G@i^(1V%ij%J!9vQ+Udno0o1NrploAG0^d zhak^s4#d5CdQ}KU28al8!G`Gy)E-kQa2GGrOFtF9=IU#knt_!M@U@8n05E@+mK1B^^H%Q zz_w?tL@v2OLN9&TL$9a<)H}$3l-a#dp(>|cQSJp~N&|$fVPRpnX71j+emy<7E4p~U z`C{2)mT=@@$*`*?g;k5qCQyt0Qz57|wEq0T15!*keY8Qu0*}uQWAm0#iaFdz6~}!d z7};ieddu11YV(KP-n@gL5xdJd*|b*C!K>tigg_h2`_N58#vijq)IdR+NVsyO&&MWL zbP|$Wrh`?a_3uQp{h#)m8XAlS0zUwW#cLa61e2tvP{$J}ikgu&u@~U^|COhu0F>xc zzEKGT02L4u^PhY{Mp(-jJ}edGuYH=Up^F!7z%l(+z#@?9r2Z8vf%;hfln1ix zu{~y=0$|Eoj~O`@1kwUXjHt+BIsBlUZrZyF;=V)Zw<*HJG{#v?YjIqmMAe0uRpt?nZKj7=vmOz(8%2$dQ(BG)me=9Fnz;#e&?aGgU4(&W`;(;6S=)~ z>q}`kGKPj8INuV}0PmBqAJHP5j)IRLu-dw*boE)kh=N9)A!L>E`^xe7yRowbd}g^! z?vN;Lmq8DU26d6U#sk-*qsoa7qF#{%%rNYqRFm|2n%#q(a9xP_^$J$UCns^H0z^y< z!;j7uB1gz8rHzb800l<^Ma9uEf>FNwD0$XU20Um)d7UU?lfd1z*KOUCF7iWPEfOXTAVci{gm5 zeINM5TXq|$c%G}UqIGD2S=eWsbUM|t16K3Xid%C<@0?G*bIbwThO341f3{8d&$bC4 zu>qhk))?lLyAsO~mYIu!;H5CcHp=T?d?*}AsnK{bU2?=kwo2}EES@cDXN(GJ7U?ou zSIN`-2hEm;pKadf8GSW6*@Z{C?;(>-++`L!QdpDJ z_LQGdztp;!$DPfd`0=Xn_N$<*mGv{+Z+qmhG=jz+sdlA+&xi)miI zRY5EY`dRuuu-)Zgq1OdI4vO-#7KhLwK?cGG#W$?n(lF#o7!TAQM6n?I{#D~@2a7#T z%z*2&1Tj?q-U0Tu6`;(j+F9X&V2mm);pUTSNvJ%(JCd4Oe_N5bc(1`VX9Nl=D(!l~ zf|cl6A;v^;fHSoc7C(Jjdy6=F0t2-;G|mBD(IREfHm~QY=!z4=FAzlee5@$Fa5c;N zZ$(>&pOFf(b(cDV5Hrt+nRrba=Qf3^_Z!3t#8f0QzZKoH&@Ats{;OJshmh3385_#0X*+1209iEq|8<@ zT(~-HLstr3)lC zQi;$PH29PndS;{}mo`cNE4B0OK=%$a8}*3Kb-#g1i3?yIt17acp?s9eGViL;`wyBO+$&<6=-31U(&;Nv zO9D-yJe!#^g98)v{(2GdZBR7P(}6H_+@lDnUWlCo!s8`md**oI=yj}EfGpjNnlKK9 zpCfF-7d;rla?98QZic6zS{davcOhxq%4*e+?iJ#l!tv*v?OD`Z$kC{-o&mV8h4O+z zy=#gt!lF4CcKLWeNxqaq5m7hk7GHd7a&w(<>W#fv`nhduD9M|PZ!0Ve0bJS01n5Dr zu^!Vc7y2dRV(t*JA`)^&yL@;NrWWqdc3ymz{{2yUh2wr!eE5Ro@5 zMh`}g`r3 zq>~)Gnr+@m8pY1r0=Eb5r*Bw)r{UC3;`2)0C`d?=;V1bYKhq=B zQHl&|St_W^ zg#q{5>dE0R`&?#wyQbM-++DoO%888s*~hT}DAjeAK$WUz`RxE;#DRO8kom6W?$UxOVJ5{qEz_3B2@;T%Uxb$D z^2SCuHL7?a(C=-OJJLTGDyakas|I`9tVa5t#Jh7y)b2`LeT=r|P-wtKM6Q6F)m%J$SK5JM^FC4i=^mv$M zgcWJMwq z1(Jaw(|1$ITN6Vj1Ldn?we@TUSs>|IAILa8T#i6QV2hTKT@5VP#B*pA^<9N&Z&pbs z%BuQ6B6S$g1%c$$7|0h!=$krF%9yA9EfWA>f`FIcJ_mdrb?=B7<0;>23__aAb|}r* zE?BM#SnmGFgD25s*&IcNbZM8QmJ_$zEFo^)UL1pq*KdU889ntfOIfdmV92VtCr5O< z0RtYobwG^hrOU%%bB6$rNgw|u2A>slx9HVN)cZ!;*47E)>~7`AYn;MC(Jz|k-|Iz7&zL#PzjmDIfj2@ zPwB|{G0R6OVN$NK)F)uii@-nrd6R3)>UTzme zEEg-+Rdh@PMA*sLC=o0b$*+|SUwKZp;KZ7sTrZs`x_UB+F*AJaCJMBpTeSG0$y0xJ1e0bdCD$kS0k6A%8vN&QIs5v{tRXobnfvS`bmy zDP$BBK(jNfnp#pt)mUh#GWTM&6=(EKrZOE^7$8)hU%pAq!N9O^{JLi%)#85<_uw8x ztg3}~M{3rj40HG~eQuY;)OY-Rfsqt;OrL`{nd}Apfs*-#0oO<8=fWZ}?qk~y;Fz|j zTd?WB1(0g$MOs>AHlr`y2Sm*shca7k3J{4`Mpm#`F8N;Jo_N2t_)u~O;4?Tv&cA8z zl+Zt6jS5;L5Z3fLLkKPBV4+kH&)xk1hc)5!JKQ}N62V-s*}Zup3=`>G78Y*^HMFz_ zon7RbLu0>=6io4LOp0BJGn}wL+;}KVFQO+#aC{hn(t9Og1rWi_3~Z7Rnr{r+t7nVX zmFY@{#|R$%6V)Rv_Nu6LFCzaNWVeU1HPvV_{=7iC<&W<`&#+QmWPU!`M7c65a3V%C{{U%b0x?C9yiSsK2?J3n_WIT^zk z!NQ4&-{!wgL=5Jyg=MORd=FL_R5bfQ--ntqK)XrawcuSlLLQoLdwtJ9R(y=e4d*V660rf#u z^9~U`yUQxsWtJCvJx#Cg$LY7726GaZXXG9Bzem8kVmKfnNV|NPTB;`q`tcQxEw~A?FG!-JqZ>6?VL>ZX==wGJeAk-j z=LI8)e#TKf`w|o771Tf8mdxz{bkKCK!IBnKQq53Ij!q1u7M>vaM!&MPSU}HReJoewa*_35 z@X%pAc7?RG3nd@JExp8{BM+e|{gjfA9%cY@%hOd4ol$~Dy7jZ*^sjU|^uD~wO8!P9 zTuj{P6)H!_&rhGvD;g3b09+zYHwqE2aaaAq>7a)d4XtOWbfmZ)d?0Ban;tsS5_Ri2|pTYSW3Cf?##A$pYjQU2NJz^qF`~& zhgi-BR}#@}B6CS*TZ+&?+Z8ejN>F^!?IUyPsoV4-{JamRQqYlp`^R@^u?X%}^J#}$ zKr}qiRTM8*rf>eEe*5?D99@Tm)?|KVK+fZ;l-TDjrmyVfEiE3GJB0q5kD*^Oc-}&# zIa=+_G$FCR8xD%8!`$%VWL-F$Y48Q&oP3$NztOYipY)%mScWrzo` zoVHe}`3vTIZ#LGSlJN<_2lGuahZwh18P=m^#MfsB)<2SwvFNmF)wITeD88|IMqJ`g z*NBQjEioj;pRSS9Xp07Xd!*kOTD>WEiJlo9)B zfXlLCU19b4Rv7Da)vA2JP4KIosF!CJgBD|`zQw;mohZy4g|;1Q*0%n=C#tx%TvV?Y zUY|wTaycCM^9EDWzYy*tX$%fMAm){9pMNGsOJ{)01F~_7h+~`@3XtZz&?mqCKh$yX z^K}zRJirbtKUYS(e>UIrZz`sukp4?aK@`7C^4;atozw$7BL{^en!v!fRw47}ix2H% zO24h9b+hz4_gP2sH3Vih5iEFQxDKo^DRNv|xK4Hh1A+NUW?yz?Vj+;lOgD`{eH;)6 zZz7gkxKfcWtAML)OFjw3q>cy;)ijCDe+^PEZqeIab`96LHBG`gyce^=>t zLm)+E6lo?{pk#P*dNoD{dFC2-gG9KR<~CUH1=XSOji4U{qP?^5(b0J0=c6`TsDA+S z$2M1#XmbY)kpk&&n5zPD61kyX(1-+G2Q3dfWtjfq7uT%_5Ac5VSgr{BbJgwIy0bDC z)x9-XowSyrqfADkk=OOks~EuClz?9Oc%L?9LZe}i!`2|Ub*FB$_u!IR#&0`2GmU4{ z2@OmQ{jimL2O*FR)z>J*e_Gz%F@_lr>=WbP7^#e5W0xdy5W&<)QgPEvc?e z9uhFPypn(p`BPbRGjLi&#l>^p+*m6`zVrNAyKbTt#%X;X>?jqPL4E0i{;?rk8a%Y2 zZyab(0G96g=L>qir4)seECB1Zr}3+cW)!X8QI$i8vHKtx3|nTw2Dy$GF?gf;$qbK+ z4-6KTk=2rQy(cMZvSYL|-E-DvoDWaiOWB>zRfZLf#*k8f&c%zFTMd_<-;a4#07$>* ztq4D&kkv_!U<;@&IkaAj=clZwASj*puDO;WF3UPC zLYd2yK)<14a7GjY2&75{#C|}R?M%`V5O|Q06_W`?VudO9NsXH`@T3QaNUWHO2Aa&y z&fdF(AXoyU67RmKbfA$PcCMfIvc`5gb6AI-~3_}Vf&_#(oVBwA5r z5HWhGwZH1JvPAlYe;U~6{xDlY^Tmn^hnFIngH0$`g(ReBzm*l33&?))@AcgG;>lMf zSVtoR(JfQ%el#sL zx0Z~7S~J%*Sd79b^B8EtSHhE$l2W?wiKapK$ZCO+(9ua>)30u;`TF$@W`+R)3OWKU ztxP=z?fclet-`n}(~6Xw+pcgY+lsGU#W9Nk7R$kuOv4w1fSrmMWTo)uLaURFAKFcZvqhnaaG{22LeSmSnN zO-q6R#N{-c{oD8V{nOwNw=!c)x_00-qFlrXre=OiFjq&=ZNb5_NIaiXO#c_R9SdyOOuRIY(mKN z#b6Kq>s=qIRuf~>AXosg0&#fBq|IzCZm-t}&|ik~wJ{5fDXiIG~?X)`$w;v z0{zoVU8Aa;hUQjb%nz=+m#$bSfpJ0avG##-@H|C3Vpt$IHPW>H!>-<1ojCq=A?iPy z1;leA&$eC*+{>ktxBlz`pL=6F4h^ScFPx0n)%J2!z>NBeN|s0gi%)%h_jk>?$)AK5 zi|{m?2LK4nBu4W*psTIc$+JM6G5yNVA*_LzMAS&nE59_0V-<@aSA*rTEELb(XdxZ| z(lL3RV3qKMRE8kOdvY1`gFq@HPr^vTS<+HwnLLKG@=(*8A z^K#Hv2g3|@j|;*iQO*@A{aUnx1s^hC>hlkigFUILb`hO6dwMJx^)JbjaE6ic5ft3D zUzT2Vl(;QpB`XHT0mw*; zl9I)mLh1~18O?L+3TY-`7ZLxpHFQy)=)yXDodncFmtAhB|5bAZIQ8d>D$pnFBy)H{?wSjs0_pV}X@!p2 z9xaeq`svv?3PvOj2Xf7Psq}~U@PhAw6w}<~aDjtSxpaZ>uXPKhI+!zJQDouvSf#*< zn-QOihhNO*A2r6?5C`p1Y8o3i@H(2Yr}p-)-*-bonm$5VSu=nHGN3CIF0byg%dr;hL4pE5izB^;fwzM>cnJ@4uz!jTPiQ~GHD(6=yvV#jz?); zEllFcb+fM;-X0zb1&ryg*UKA z{ro&do`P1OybBn=v2EvAY?O3SBIOKRZFi8XuCQ0fc^UX}>6Em)L~8z+&T*)58Mp^ZlRb z^l6;J&v{KfoG#YqK^zpYJOGy&?hCI@=GPxtvO2!@Fp{%6-LUDK%Uz%?$;wzya17RU zH}#PV4k)f32Wd>1!3=P{=jJF;8GUW<4h910z2%NQU%W9iFF|p?W#&TW^y>Pt35}HS zDQ{cJ@#@%cf@W0f91}AchKHw=?G6}^vOV?#Ak(@0z5|*X5&UjNq#8*ta{sqy;2_D6 zC*oB0qb^t{3e$)Ipm~9-Z85E(-8C=(QcFtWMk2Wa%Md_%1YrOChTZ^xFqGQI2c1xj z@U`PBV7$6;QS@gZLmc7tfERSxzPLDv!Tw2IxVM&nEHna03;{$ITrz{c$ja{2SjeoE z7H2a5>7+|2Qtya%?EjvHsq)15!(%mK9AtK$~-Ssx&)%$znz3+YRjyulq{&C%VuQlT{Kl8KZ3VGt=c0#{z zI*I=5*|WoE4n$&LJqwHEw>6lUn2I$o;W*8h z9R;w&@{UXdO**L<@XbOR zKv`1qcIH|4*}Q1OaIxnO=df8PZ;sdF4Z--Sh_I@N#cX~WTQ`ExR9I|`oCS3v1_IRK z3AYIsSF2OlOh_D`b;u~WZZ>nOssjw{p|#iMPU6J1AqkF3>Qws8;+>!9%ee4tG86E z!dLS4Eo|uL%tt5$0b66fC*jF#CszRgzayV?KQH6YzwBba%m$7OP}H~osCl^t_lTeW zYZlVY7C>i8G*O=Dz{^3D|FqbI~llBixRuRfcOkr|ymu6VO^KtIWazP84s!4w9u zv9oK(F2G>fY}jPu5d)<&sSXchR5-mlcCEwm^A@ikY_DLU34gzybhr|F@%>6h7ts9# zWz*DlW7Be2kZe@Jt7W7lcJt4C@V-EJC?(b%{rOxhu_-8u4C!+SVx=;~CaR1GBZ?&T zN4o5+t(F49Uzv8T>9z^^m5Iw_cmQI2PI_i4sAvppMnhkjCa%C(p96VnIl{xf&#vjb7r>{B6Yd)v0CjO>GTnZv+Vx;k*uNfU&!Q(?;o(eeSc@q2FpXJLy^n~N?5Yo=1Yc{3<-c{od z9Vh-}l2s-hCZOL`7ero{j@%o1hb&z#Av&3k^QKC<8}r;_Y>vl^PTJKAaY3mdQDwNq zgW*EZuxs$-6S;c%@w*KVt_Lw%y3+-z+g*F3SHyElqsEluAjaj3t7fn9Bd5cLBX6OZ z;d&Esmph@AY0?)`y_U?e!$Ax+GX7%TSnSGomiUL-8sdmxXZz3%h;glj2Tjs!&f zuY*?1587=`J3r8JM%25V!)G2i6 zi425|5E$!^e5vfWbbxi*H&@41p^xJ>oepWN%4e&|I#C@XiJ(}# z0Pq*BCf~)U^+}hIOSqZpf~x3H^{a<@a)a}8v}}d%#!~O3wcftCV(eF9GYLz^(B`Io zk;)Qgg;5ezNEOQvF9il;-|{H|Q8Aq$3A+9gP*#Ss&Va6J?;gxL-_2YauuK z1DD_43H`>u1P9TgBTUo{?ms$o8iHH%&Yd&N^KgSoBpn?cgHH_&4{jepou6JdhMKRC zV0K}_3Kam-mR`>9-A{j2WgDJvWKBwU8rqxS5}R7xzQ9tPgYi19mtbTI6rd1gY>J09 z-gN=TI-ch>pHS%$KobWjOXl6y8l1{4ebo6^+&KG{3KT1OfyhSEO(EF~QDU8Nfef>> zq&7xzOl)v70ZOU_Up|k&_5(D`?)%qmTEOJ>46Slu^VExzY-?sMX$5UJcZr?`wj!N{ zo>9Ua%{+K>3k!Sepc4GKKFyTfN9X#{t_A01#YccrEXxvkap*}vCKnR8&Y(3r6-6@k z`HBM{;MQY9XtpDjGcRc(V+_Q~B`_^Cx#Mf45HNfyD!7z$!NC2YP=Vp+JzwA-Z-xb& zn8_B!B8im4q0srGjlH)rxX49yl^TN#&|A#yi(w63mgcl4oNfIctrnIWQYlCtj9#yh zbQrJT#$^FqT0i^!N=PXcTmR8;LtA?mg2H)<_2v;Q;Z)I-O-DP zhLVe%9dLWw{6ty&#>df`-BpbrRM3$wYK{v>E zxxkOl%WBpJX_tXZBo>->gu?TyeHNNrK6{6(&W$JdSz{No721IS?F~I5ceF?)M$T*| z?d+YZ6N+vnZ^oN{fILuk8$6WVwLsau8O2D^6+@|4n)f#BQv>-&A?NwW*o^Bj+LodB zXC0Lis(}-?f3kdY-#t~908H$&+77&IH5nEax8EwRsEm`L$Kb3Fh4`HhUAKqC^SCaC zatcv5gg;7e?Tpzt%0i=}t9uS1`#~wxRvlKu(G=-VKAH6-gT4LH5yj7ch7$n;*M~#K ziw33?A4ML|zLXc(T4?YTG{gwN)R|<_OQ1o{CR^?jS?SFQH}Jtuhoz zUXg4uEqNL<~Q29?m_iOC3 zHRh2GvBj5}tZi<}2s}Te&IT-oKNmQ;8pX}Nm>bXy0_yeWy#2|7GM8?L#~U1NdCJ!I z)*?|91PjW~eLGe&W@%EO1ibL0EVU+)<(`5zJPscTghi-g6XHgT=uqxEcGu!*H;(?=@Lc z;VI2(uc*__*21X|KE`1IAv-vA;4j+qh7F|x+?9$32`H3W&`k(2IT38$<6+osx4qu* zwebi9WHjfB9spaiGJx*k>KFj95~cV%TbKH;SbmIUf!$!`9DzBf4piNtfXZ8mSIpS@ zY}bS6OfZDQ6W2)L5*FX2!Kk9{Qz(HDdWC7GaLe*|ciDKoM}*-^1e>?+CnmX3jFTCz zZHZQ2JmXB|!g9J<2%YBh@3QRuML*(0VUebK({bR6Ao#YC*GAS4Ps$QpQRr7=Vuz}j zarY*x{LnT)x#7B78)Dm@K8h$eTmJNOoMqS{VD}pG=(H$2@n?gSMRSRWQMq}&agem)5N&=Gpc zXj&qriYNkqvPT|7g^3ld_r@q_RM?`UKeFy+EpQ`0{o3wp= zCnvX&aPNfg0VkY7EXP;Iu$W^>-SJ%i69a*1JOsbgcPo~TP|}}HXUH^~cW*tgc7@&j z3Z^_ePqw}}pYLPjs^q;lRmp3fnnFeu+>|Nsy5o0+h5{5Z19$c13Pk$at?(x+4lT1a z-pD+z$A0AsM1#@7i3*Bh{NWoRUuKK;qCr z+knRXrTS+k_#qOwbkB(Eh=wcg@bt-6&~4UBOaz}Hem`nrOxGeL1Oa75#awj}(JTZ= zz!&N0bP6OSbrExKY&z(dnP<%Him+nqG6-~^mXqCDnajH4K1OcKeXtsEks5EX>)o?- z-`$PB8^r`Eojwi!uracwwBdEo-c;R&cUlNsnAx3S1zfXY0a{+|pTgsI39py()7*SC zS~}Il>qkxiN%Q3~{bJv}_-u-S!JE_SN}Jtwc#JIup7Ty()l0KXRA<0^25x@;(8EJpC{{uD7*S8(!3Qxr#YC!e^W)Ylu*MLR$PXGj4FpFk0)=EK2E~-x#HW$63l-^# z8trB9)p(eKJ!c_UmiOnZ_T_EBV;Hi+ahq^aC?rMihyQE88d_u4+i(>GIbXaAfty=8 z?=EAnXLFg}SMJmy625r6I&k-G759dsn$_~q+yyo;pPo%0y$yqaqr zqj*fQ^gM(8eD$;^?LF_0NF5xJm+%bWCgdk9t)D5ob$1=MrqL`ko|VXHTY$jFl=O-T z5d#=ffy#yII;RF`$PliOOKu)OTNMCP5H{UWh5(@bKgLoR@*@Nfei) zd^s%iD#f=SUh&eEq?nYgF12LcMUIUZOD< z^iZ!pe`*@xU2?WZ@k*aU&gLL)lZ=9h!ZW;FYtbQ=2;o4oFz_3C#hGx01)n}XxiMv93RDtpyHA0@7xTQ2MmO_x4w5Lj<`dS#4=(@q#0??8IH1xiZT-3!A6=`=^}p!*RNEK#+va0)8h9c9XdLbn?cbJ6b~?cX!)fUiyNm z3d{F}$&*>GC)3q7$aanDj8_=(JYvfQ-))+Fa}4FbA5yaQ)L`7A?kB#bJsxe z|Ds!H*2T^{AH1-QdDefk$)CjIF<_}Ejz5I)1`0#L2K$yZ;%idX1ue;ndyI;1Oc9sT z@Z!*LG$bTUJXvGZFilKL)>9*hxDKsL*lFuKiG>Ddr9I6q#;9;xV~E-D{ut8&nb8Tl z((5dzLCde#F?PUJ;>@m&dmn-oT(lI{!V3-zKdqLAv4hwh7HRP_72!p|=j|*JMOnf| z~@BM)1n_b z%OJ@4p*Rzzz?_WtDB~d#0PYR{Wa#iBFT-e^1cVX&iezOG$xba|%~&4AyIQ}K7yehk z_!R}3mynEIU>1Wx5T0F1GBPi~-u$8u5%4fxu7CeraJ{JGPTq8WrE9~*sAWqJL)Js7 z-8a~9YWw1%-K(c}q!(*6HHV5+RdpJjJQBB7IIIN@W`C}N)xF8kU%*mQt7k}55?-WD zef9a1#X%qh1k_ymv4bdbGmdvJglmLeym-;p*0I<%9L;0T$y-id7z2fQkies0w0(~6 zj84cfg-wU;&73@$uKaZoxX}o_?k{_8(az_>7*uUeEU~m+QE#><>Rx5H*r@WN%508tpTow9sgR3X# zZZ5~;bon|}?cX~A%0;P4mFwb6_}R6;iWilaQZ7m>WNh!zV}>Ni+GLewa0lup#il1` zqt12o3@9uiaG&D}VqjKlZ|duQarnF`x$bcnJ=N+~?CoHN>IqH$&v)z}S?LWE^J6G- zM*rXvY%pf*xywIunO z=eP*Iw4!Py`inebwQ?LNOr;$P-B~H!=fS~DqzX4$s!}CRSty$c5m=Zz?FVe6VWe*m zHHr8S9yhA*`_43iMU1xVd>3{sZay8PQv~LSEg6%fj|>oNEOl3Q#|rkvJMS>wTsXb< zXp1Xy)=|zvL~iD78pd1fZKy5?!%cOq>RZyv10BkUoyG-F;}lnXxTIT>sFzuBSt zAv>6$c(2zV-2XrkrTi<5$NmoEa>*AslJ#7QBp7VefE8}Cp2x;3Ry>ExJ4s*=%gnbY zBcO{g-s|z+q>q*jt;Z-fFPw}froF8qMp)?6`**JAF`j7 z*c>_D&;7q0CCV(W>VUqzFl-OLzPMIA2|_YfFGA~yVP1$7RW4SqF%@*&lNH*0*Zy5>cNKEs)Ok2xZOV&8P^9ZKLctu@r##`Dxt*K z?bj>85sijiPU-mqhx!rB#y`?5b8jgrGgyzx{8fu?Cb@FE#`0@kLN2H=s3#ijnpU4P z4P1|0*5^d(7h+P};RH6&*;}Cft7KtVC9a%!uZRpXH9E zfhYInYP@z$qOFsL^epQ%SAEwZhGBH(`*lYRZIU`+z!UKg5zbH4-1SlFr%6>1OUAfi z$V^8k!l8lr;b*c2=TD>yzjTEB-RI^S@3=u-;*$;##BK}4;u}ah;IP#0kClk{*kcYI z!nff-McQk`jacqVf+?t}pIBOo>?ZL>(L@xDxP6}#QRb+&TPw^zCu=MpNM$LS0f}gI zvQB#F_j6lLzvqdAwf04LDX?2B;rwp8bxGy&%#&G#mQoOq4evPX4YooHV-x09tyy^O2Y*{(#7M@f~C z5gBm96rJGe0gnfyI40p;KEnI9_Fk{xCDWKOVT`+lGCMCmBI;on$eCY0n*QRMdPLdN zdhTc>kOCv>-R7+h?;8hWQxyux;1$MD{JfEivS z3Gu)MX`N;N+U-T!+fPzBp2w*e?*PF38wH0lrL7#PNin&6xy(RQ-p?Pxgs++*0OGfonz{ZN>+eW{7YdQy3YH#Novqv;-QRb{ zhG_EdQl(s`Ax%$L+>o(>7UdELUx|46q-6&$e2l_5Nk#bAd$R}q+I^-VDD-6Rr28N5 z)>prQJ@9oo_j~ULymqE}j1Tl8cbCM;6Q^o&D;-^xCixVfk#1XUso98*M_9s9qg)!C z1rfV5d~YYY6a)^jDs_b)pZNiC473~mBDADtfU1hBjRA&y_hXzdR<^hJAE>MR8|o(h zAo!6S;qF30d|_*Nfun4xiNNb#5jzGfDHcEBD-m2Du`Kuf(?wwI?LWdk%K8ISK1z%9 zt`&vHwSyo7p8z;IK-j!M_jhZQ5dmz{0)o)Le3mZq1qU!x65wh!3Wj`66Fd|vD+}Fe z0+R)n?Msw5B~fv7HBX^Q*b(&6{HVS$p*|JD6lgDDvy|SK`w%MzxFG{VJ=QqPO z_OtzuDm@9t=sG?O_%>4{0GbZL3bekc9&EB%I< zg`b+g{qtg7oDVsZ7GA`D*7p7fg!bZ(Inky)7wIKLhZj+fD#d`KO)G0YdE|6(ox(yi z(87ec&-zpiUIxuSlL`I9Iyp4C$a@t3^?GZx7e1Zn4_TempNk@0ti;aCYgBNxPYIie zfVsrf>$He4XDB^wQwS^$FT!b4!UkuLg?Ic~J0?F-s_KB3^>0F#dw4m(?(JtC{`=+T zxD^bxgH{sXMX{qVrsOoVNTs`B%Jmo+lskQPnXUJM-XI^UFh)fwF!b0S**MZ&Xj#e1 zt+Sf4XA%&weLcB%vx~Xep#1#gCY>ArrPbpJ(6xxydpp57V>JnuOLltyco}Wv$A_E+ zq_*|?t^b#th2ot~c6_kf)@rV!Ml|*Hm_2aI=Rthc#sh8R)5nz#l?k@DNCsQ=Mh*c(WRUL|IF#f#a zk3D4~?Ld_w3wJcRKU>Eh{mY{YLI7uSO8#FS1%^UeXJlRNdbwR|M?UjzAr8SAShBV# zw(ic(%oR+jc8H?%`*$Bu0`}8^ftmD|u=Bn1KB^-%=X1}K__$?9v0-}aLz~$f7%i;) zXQgi0g{(*R+24V{I9!BEB2GRZRIXW#EiGo&z99lZYU0(rjyq9hfVPCOJyoF)L^8A6 zuZ7nxT|Im{N1F`fa04^{Wkpz|lqO?AH5r%=QRhUtPxkD|?yhB5GC%j>r4V2GkTuq- zA8nfGFK??g0)b&%B{_{iRFujSG=EGdO~e)Xm%mB7Zj}imDUwmb)|%hJVjz~_4_Bz9 zTFQtVmawggNMlZa;B+6kDXs!P#z26=G^C|!&F+VyombRz4cpE6)KstXDftmRCB-=8J1~#w{W%nBCuj@chi^>v{Z<@K_&=()imFz zTFJUQI{T)RQw?6O>0-e5;ZaGOPPGxM6}Hw0u2Z`MTi zRjNku;+W#$Z~3T5W`<1EDc$0UUp`>tr%#!8YTy^8)%eatn{N<&St-SIXX*;sK6dAV0};`{Do5CV2V?yavW zknl0fpx{s_e|jNW7!f+ zB}Uy3cCYXLUhlQHhOS&!n>aPm5hU_lSE(Dg;>VFzw~+G#X0-L;@$3AV;!#YrgVWOw zP(*e(q50S#45)aahT3k25LSsESy&Nz75c|kgXR7o*)Q93^54EJ7V-28#cu&gBiY|` zbdxObBJ7u=+nHYf6`(Vk>p2LEw>P1P-_1K4SAm;HHpdgni)paO|!+@UDyBzv)tq_D@qtp@^g;SjzA zqRi@Gd`omu+=vHB5|EH1E8r|UI_6Jq_-#0ZnER1E3e{y$a@AFiZulK{IzOa(R@D}X zU9dZwSqnp0mR+*6MPT7$Mp-uDMn(2;YqOA0+uGX=PN)458qQOR^5uIw)_>MCT-&`x z@*d}h?l4!(mnN_0wzdA^soj6+{yG2c2b`ZDPSq-J_<@m!o5t?Ig6KPO9s|S}Jma&! z00DbQ{vn&%Pf_1T>Ktt6wRwG_;OgAcirfC_4<8~z4_JdJ4M1mp<^6QS;;>?5Fyuib z*Q|UN!S%9q52-80U8v@Q&*PRstGfONc}$g)XSwOISt1)gNQQ&hD$~0cj{Zk~#O;V# zwYwIYG+-$#K8T%Ydc6gN5e@4fxqKCSg+&~MDbn^2LS3reR|uZRGX~fi$-e2WoMBI6 z_1xB^olj*^(FOQpgMQLaWb`WbTh~zo9Uj4Oczg^)}4-Y z`E3rG%t})iC6E@so-(b(uT>VBjaljK-L~>L?WS+DI1Lcd>g2N${LJ%Z&yrQ2(NB@u zovtA&ul2J0)t{af>><6@$7p{!WXh!k{LNqlkW_akr+5 z-L)4HzN4u>HFsq_KhMT174@n}vn~S)9a zu`lF&mr(8=9;`sQ1r$j3;4x`<&>dtR7jc#!_pJjQI}*f3Ao zEDR|4dsGM`fq#1B?H$(!1cAD+2t`x?5>~eDvO}PfOahgWWg6h(CGj+7fOt~x?(@>Q z+n6UL<8AO0CdgW?gP6$e^4QuEUe3&m16Pbu4PgCzb8@b1Nk4JsGbH!KG68LQ)4bc7 z-X7F@i|O(K^0V&K|H2VcK85^m7gOjYJMjf>hkp7*QdMUy^u>dnnyFyOEzw8sks%Xw zh_9|BUF!QdP5EC1+S9hqIh%3qtuJQtD^XWUgi7riM$AD_k>%Uid!N09poLr-SRIWF zJmA-Iu+u~;(GlFx!*tv#$x*XuzZ{ypP9qb_(NU|=R6j?ROSt}OK35>?_9I6XZb>L9 z_WEpKXXuMjw6aI?;|4!`yC+?p?eRy8$QLncOWDPTxBqAX;2oCZ7w4F?E$x_D&NlAv zmVBLp@`ErTIzW71Yo%&0-l0tS66p_+$FCA*}*0wuw`y;@cUj7!)^1Ig1Tjo zjDUu>9Fd=s+DHj+TXKb;i63*hOd~+7Lo$%aXzq9e2Uk7JoG$KjFu;hal0QDu*!E}Z zE2NugBjZ0KYC97yEapu?K-X@>q>d;x87>DT&a!B)8S>JM5xsdPbr*OokI}Ii)j<&k zX^z6}1k?&QL~q_KJR4)y*=umMSGlo^k0mq(a&8n13>jb3^ZUg6zjCeubd>?+L0{pZ zJ%Qj-fWr&v_krE0i>WDyGS)AYFXU_WpUYUv9CjtZ7A+eXI4g;SiAbb^-0=m5ayQx; z7;HAp593Ks3ojj3TZFA}dPi&?W6me{iuXqXQ4$A>P^p;}IwOwDPxmv?KS_kiM`G>n z+hXtMjZ)eJ|I^aTenr;orChw#Z=SkGG(T@@IqzpO>e{?GU%)N!}iD&T#LPYEREoBzzu3bMKOSMjM@U}PDok6)bnP;`9 znZ^d^027J|b?TTIJ|q;87oCZ&1h1^zAjrBJBSZodsRqEnQpUvp}>Z_g4zfqSuri8|G*ix2qK9|q)KtI|(RyONZ zT&>`l(k@pWd#BK362aIl>W@?uV@T*au?AJ#(xC+e z>mw-x<54Q7YaP}~P-2SSNL|rQTFliv#=wXI0s_=@Na%;E;9M4x-Cg5p+VPiR;Qo}i zE6?sp%H?JNP!wVQSIUfTE~&$1Ti(Y^mUNmawhZ#lMzrQ8C5-OS4Z@BUUHpwG9FSL~ zYmwxNhKU`HXuLk^H9C?w!(c?wY!BqQZ#3p8Rz|E`R9{g$U*#}Jv;uvSss3+tX|K}; z1GyAylsx;-4&d)A8&gSWzUKAOq329*slnj&nMLX*!DX7fu+EbH{G0@v=L}Q)^80$hllGKZIgP zq*NBt3ZsWsy*u11p^KNd+W3scRU#N2=qmDHh{Q4XVu26sEBcFbyp_rO9GsdmsGe(p z5aELC*&H;oW;k^ZM>5P`&Z@B$GtRmfR0*U=Xhof6u-#@%9Iihx8V!B)SfBOnwLLyq ziNnfms{{wQm6k*J3V!Xjf!1nkGy|D{+gbTy#S)yEZ>ygYjc|rwwxUrED`E&28X+v9 zel9;D)q}*Gt`V3J!HZzP0+9N72z7o`Q&zjzH`j)WQd&J@A9ElSIw2BBg1M9NB=Gt~ z6;~#+qz9KzitG*&F^iZE2$oJB>i=oL%`a5$Nr3 z#N1P$J1~vMnus(Sm3!2q7tMk09V6xb_uZy_UAar*J)UxRBYURT9bY33Az=V1k|r?% ze@J3vgsAxqZUy(qSH}foG*`JiGz%yzii#c!5eSO~Q1r#K_eCA*3|j&BG^(7px~E>q zI=vG`V!OTe@3lT3mvPCn)uu?=pRL{~brtVHqFS|y`HZ@Pd%Zdjsd*X9EBB^xZzu{Y zp~?88R$h&10D@;I;z#O;M4M+;QlE?%K(<>0+J170PhoH?%#^=1d$MG1F7{m@C!9=h zA0A|aKJK*CBkXf(Q=D%7Hq95%eL>;RerM@&8uF`s% zt<7}1p!PbfwYL=}x+6k_By}3tA4sdJq8Pq(0yaC!#o=lRus!d!V6k*|uj*C&VWk!@ zR{WNhmN0-b_-;x{)z%B_s)ZM?NCp=frAu746s}A4leeD}QF0jTvGkrVj>n%-_eI_a zjARLFR2iF(bh$Hze{X+n+(Kk-qXKHvGLcYD#pBwpP*&0CyD}Df-=XS{%Y-AMaBGK_ z+JB|0(I{-o+NQ)z$D-swW%#{M`6|<0p2tmT63IK$-6Qd;OBzP=%H&zHpi@*nNPlo} zf}rg3=sv<3e!E|D?EhZ#M^f=`u6Dc}2xi7xYiX#ywJyW6yuxft9l=D9v6U68NAMNM z$JF1(v2)yDDo!6pKX(yEvIm3x_1A819Rt7WUU8gXsf-Gs0$frw5Xsi*71NBFQFLGG zj`3Ps1C{?4((zmw>gUJlBNjfb(0OUEg1)0&y;7}3{|u)T*6Qx!>a5o};4$vCUhQtY zpU3hUIL;QgW}%YFD*W}jwCOka9~B^i6Jge^3F!CQX*+oJ&gQPs;;|GIx{(AHzShTc z=K6-{2rLY>b^qRkXKszxWjt@c*h*|I-SzGCkz=mdFaxp#1ffu3wyxaVpz6Um8A%eT zvNt1+`RWa9D$Y_t7DXEVWvn3u71t#TEcurPWkgnDU99IT2l6MEm^d#a{pI8xmcwjG z77-HOi0cG&?Syo`(n&WBy)Y)0D&nxwb;UEDc)>=^;LUS47W4msNB0A0bg_5b0OAWk zIGzy1jo05blAe2A@an!QgRTDbVg6$z>{(lR@*vS3qAVE|s)S@Ifmxi+i?Q@kw(^%W zd0Z(%O(0z6J3YIZmFFjt?Y1|ZpIAZZA49nnfod#rR6cSfFe}}D4nYAhd_}$OD39~2 zfdYHYi65H|=vrhB{_rcHRZ7_(D2ay^*f-8t(2~gk#`Fe`7xb?w1m5pZs-8CeB+QLt09I(!Khc*{5eYl zEGG8;DJ=P_QLm;8RoF$>#~5e*>mpp1)^C(FM(t>J*6kA-ekU<6RwuNYN?T-l4#4vg zup%#2O_c(ux8a!08_<&BMA*MK&yEAc#T|FR|F0FTMQ)>NTl%^)GSV=&{r$5hrXKGz zp!112Qh5k|Ot$;RKQdEFDlxl&W7derr(KjKBgRU!w_fgxvH8pq#p2RlW@27;Hp?XE z>ns;k6mMhdB~q=w-VKrLa9t ze-EkF*&c=iPW{NQ;6L$%!J_t}C-rh@M$UO%5G-$JRNU;|7FIUoCm0=@$E|6W|rnPgmFkR-uwqKqa^x#W>zd94X_S zY~&*Vm-o{&^*ceL^%Ia12hBTpjqq<6g(ljvwb$0~J}5lMMDFXLh5sss9{G4twzAGQ zixEo>)QTs#JiIOG|$NYD6J19zAJiXj=L) z@$p%p*@z*RfFLO`Va8hpfT&f{Cq%-NoxdniQ7Svhuudp>+c^P1qK~iV6|@*#w=aGm=9L&PZ`CfW2X~W) zGv7pB+X4GDpfwy)z23Nw6sWp&VW$MrxKP&+~IqDv-CSg^8x( zs=nvDRiPOVmy70d{nHImQHo(+t)T5xoHZBPm3Y0=s)YkCFXNv5>NT)5;u2z{*7Kan z1XZ2~**i1v+Y+ou(oXiz)S3M64_UMCK7u3sR|NNMuH45$;Jv6rqkNZ2K7;jP{*A3~ zJRRcVprr}V(bH}w#Dh{X2qC7khR7H9gT9+>0wuN}|LK;Y1e_V;^6 zCzv)tOZM=`8|1{XYW8v{Z#^zi!8xK@#FJc7+1VPs!c&LOKFZu z0d+0m2@H55r2+$EeB%r}zF%@Az0<*{O!>w9aaKO8lJ(V;_4|R8EE+`$L=vWGLha8k2;CFxrEQW2}e!H<_E+ zYPIw2n?c4)rgZb}c*U>oUh*LZK>rID==z~U%cnB=qxlvz(Q>x6{n{Q`1n?(0=cQ%^ zKOu<1k*f{^7KFqIns~M-|I5P8j{jHE@PMl9o3_J6QqT638!1CPz3Fvw1ca{CT`2Sw z4A#Z!k3Ki4QZ?*Z0OR5<2#ma`n&VdgnTg`9Rp$uuXZ;8&zFue&X3ZyYTeYZE5 zK|gu5k-yT)Cm5$kv~OqmE62HAuR<>$*eG0PuL*T8u=9Kzd3t-if>hS?`RxkGMp^D| zc96W-oNl@fH)w9`HV7s#+P9a^m+iNbL-mV;nOf&Pmw%Jm-8q`DMn|6pr0iI)xoQ`F z;Ly7fY+w_|Ia;Kpc#onN2uft&4(bzTLZn-@?wLPJ&+T*`YF_^fq{TT zY-C$G@dX9FFO?c16hJ!r5iUaeI6+U%Z(x2?r6d+&Lwv*i?6u(PZVJ{;;>~9hNg&ZI z>Kh>8iKV>_X>k^6yR7<-%EqSf9vT}M<@{L*1JBi&g+iXX-^>(85y2qur-DPKOiwu2 zKaeifosQJOggD_iHRpD)#F9rmduE%u zoAYW*$)Ee357bd@j0#5#jGw>1!6D5NI_aLX70lt4!TD5C*Ag&VRM6^;pw|LBk&xr} zU5%J;#CDWMWUW8L;I5ArekRv_6=Pj&jCj}Ay23DK9v;sig_eMcwM;N_g^&@>Fu!OJ){NS7ws%SJM@2dNqw6k;&b|U4GestedNT5 zfPhvf{iU?nWIm=KI5slS2YoAe$Yd+hDJ!HoSW``S}iZq+j z-9-F#71;YQ%qhiYb!em9wbnd4Q+%_RNvHt3y#iY(A!V@GEzX03^VQU1QJC;5jy^EO zh@rW)--XrXYQRJN@`xTE8~@;^NDSS|xiN!HUq`|LhanE~uC+>`|x zr9t1@mCxa7S2TOx_);E%eQBPN8 z%QtS^)ne!@cJ$Fu#`)i_{?<89`y!IJG6FjaT&>q`uoW(--e75$O9pAu)hRa_h3)_J zL)Jkcl;=rD)LCWn)&5kE!`I7v%{=;)ok=K9PnVYm2zx7eKYM#97c0naX$o}&`7*!< z>A(PBJEd8gLZAs|WQ2u5;Ih^arGDAFcUb-DcRd`}02D76;DoLTHo=}C zK8>oy;+Px`;eJTzzz$HDfj1h;!5 zs6eRxRoGBRgkmh97mWE%cZ;IyTq4^uX%LGuIFu%KZ5$z6FC0Erjer|V^o732%}Zg0 zAArPt&p&i8byq2)OlEPQZEo zCnbVzT;+hY7~Li%R}XZrH7Vxla(xp%7}B=&cYkDw@*MDTR-nM_ zKS~d5#ixLb5CPaA=?Mrlwsi^6?!7vn8{lOoiETCV^VY;PG(vy;3R6HHU~b*9&!vGf zR#_(nIG(&~vQzdOj5=KX2BUGE(=!c2g%j|j;y}($3`V8XqxCsc;}o?Nej(l;6#e zt5NqgA8vFEmzG2IJnANZu|2`xs_Xz5;{t&xB_Q&MKY{&h?4oNRA6)kLJ>VbSgYN!4 z0{;6wwwoN#D8p~I7nOL4;Ar)p{HC>%MM*u)9;1;E8bKiyav{SVjw-_e>MwfgXX)Mx zu$P`%FtM9!+|%_ud?%u8P5-~mRIFb;tZz%rgHV$?Wc zwy1Wo5&I+AYDV~_fZ^1=&pGn{k$C3yeO?Uaw_B-2R0CTs1%*Tl2k14!0lnty&q)vE zIvJ_ijPuj_`a?bm15g_s2BBheB=kutb9mvNGVAg*58a=oPOJK*AL$2Z#$=}t|DhkL zRwr8?e=+X3RUaa?VhzNo=ROjmFp85^kt+-5e#YigH}{1tS0%CP@M7g|KVo|srO~HzX(#D5I)7<7?AA5N2X3%F9hQiCO5d6<0 zk=7p+dv*ZwUrRRp546Yp#Q0*&5I3Uh-khbN2@}Ko;_CvlWX=l&d7RC$HJ<4N5$U)P zFS3DJ#-6~j7c~cZJqxT0)LhjDy;Jxr4SFD|zchoS;VmL3E%8B04DF78Y|b0n^d0xSbpp-`?A;EDX z)n6HiFEb>GFKL_qeQ0UpFMBcpLfny=|9{z&;=H3dY|6w*4YJg-A|OX0@WBZSXdayE z{LXoJ3#V0EN}$5fxUlaCFY;r(6csL%ZvXO~gHo<3iGf0R*t_o*#Sbz`#hN#G(I7|c5g@0Ub>PfSReSM@_G6e^SbsYe)ZU>gLiI{`HaJlyZ zbqD_6uS|aU%G~=Ejr#9pt+Pt`w!YL<`>?FW7zwHk{O^%s)I5;?0XbOC3pcqr!?|e- ztL=z?pY#9ABmJQ@Tf*P8Y>fV1OO1cTNh(!9p&T3(Myn_7vnHt`ntbYy`hPkh-LI1C z2=Ko_ZP9BpAr?ZlJqDB_9tGi~~LVS)3ns^lR2yqcI6UrS%&E zy2U@fDe~w+r8WGb-U2OYpF295*KwE_RqX{$_#WtJWsTMFjXq?=2hOc7(bVwAS2JivRC3`EgP57Tj zdq0p0En~<)4(If-y1PL}X4zq%EaxEw7#e?(-^_3}GeDU>)rUdCQ%xI5Lo&YBvME?) zT>M81&^i!-_4j0tE8?%^AmWe!ft7EZoqjxmgoeHc2rV6wAt}{M)<6L;54imG{)s+V zVnzy3cO@Ji_{k}u0#e`xPd^^!f9xNK5Kn$D3`K7x@LvqDtH~4IMrx0%^=a=92?~5^ zPEUgZKx5Y%78Gv*YIdt^K;rfSjWJ?XP z9nXpmjj${T`<@$^;K>MfS!*G7?ALk z(k!piogI~*QYwVm{r!^Khp-1mB?g&{o|*v89RC>&V;4O>0|WuQ{h5{4(w zsVlRP-{${f>@9$*Y@e|4!vU1;RN_c?s-%R{-65Sy2-4Ca2uMn*q=a-zH_|OAjdX`} z*Z)4~`}%$}|M`BO<2cTs=Q+yK#U4p+pN?d#(Pa;pDw((qF1s%?L zQ?qeS|02rfXdPPIl=Iz5OQ%fLdiR)w z+Zbo+r|LCN{~vzb)pnSPkQ1bk6F!BJ*B+U4DK_>9wTDso`S@JyC4+Gf)|1uPRwFOo z0ScFPqTOHu9*}UZ zBPLj>+!D9`Y1OKUi3pRJBJ2w&%>0obiKyHc8wc2(3Ws zUSabY?XHwi^4)vri&a<~o|2VFMFCb(`k#2jY-rqJ0)E($!)FA-g6WrGg1;)(bA+_B zIp3(ckyZ=Z=QK!;EBPaVTD(W$DT2(DM0!-s%k%Zg*kx(8U)NUlzS1W&k$m@vWUKM_YT?k4w~0OI%WL4Iccj zgNXp(W(9R3HnKJP0SiT_mv4c!#$^>TMacHFurKp7s!kAVni~6}iJlI6KMj+sgDNC} zyO-NEC(yxhvDzUeCG$Vp6ke+r`PERJj~HjZ3&VxA$bN^rKW;Q)%gX0B^VX(t4Oy zqeZPXvmY5y-ia>BEX`r@B=S+dozckua=>~<2AEJ;CtNegVvAkNTzrS-m)H6{RZNht zXfU^}mq&Lr;VKbR3~~rAK9A;JwoVpN!^s7{dhJx+u}I=0_vu{wpxnDo&s!luSgT}F ze~+5T7kG6dAkUYVFo7Gng)S$2C@@kCmAb|J#T_j}FZJ;+=&J|C57w8T4M&tQ?g5G z>UD0HJ)eMp4$UN&qV|Ls%5x?|=i6iXWL&!oinv5xs<*^qM6qv)SlbFj_zYewG~K08 zz3~=rxI7>WWo?4J1(SWxBi0< z*#IpBckA)isJDTQzK;T;7K9LaM!-wx)A|h-c`(1Ks?NHjt#*0hwTXJ+@^H&w8H_B2 zJJOd_N(IuQ2OqU!72qE@q;B}NWNpme>e}R(@5{1#_L8k$b&GNq73}{{wrt4xTedu4 zU;Eq&%W#Ze!SuM{3DBY0=gp~Ttm7!Yz4F#?(0C&|P06Q4A-^{(8k&zrm233=$-RnY z&&^ih_s55Lt`|L3gHKGg#B?L@A=S>8w~l@ZhdQjV&3nmV*st{Z&bOhZ8`bkOs7}0 zQ=s!u#;G-=6xumydm!lxz0#_8#%I%QU>eoP7V!d8J<%WJsh6NFGI)xq$0oUB%{DbJ z*kc;A4d-cy0e*dViAQ#ESLlez=fdI0fDE)D)hyKScs<6;HvrVzY0|G@C+Fvnj;x}{ zP1$ciTNEe2uX0zt9~@ql3^3c1Z%2>^X9);dILPOXV&w-Y83@Qu|-z8Zf zIYor44J7Ziu!>?1+WgX-nQL8h*f~6GUIcf0ZqA4h@~5*wnj2=C(NmCZV*|OK);ID3 zo8iO1wZ@XM3SvrTYMpAJ^8rW=n6^d5Xo`4wAGkH33nd*FEV zETdZK+ zYKOb-Y*!&R<$f6FmPU})Vx5-YzdbyvU`cA}wsR-%eQ=fPcyYV zT+M1&diwgvd)5a;n-dXo&s1;mi-}_@dxGA74me)>aeZ%b|D-)jw?&KUp68ew{R<#O zka+Jr$PUTjZj9OzQ%ASU2(5~dtiNxgbQ>7s*a+rrV(;y-2IPqfi(9seis~CuvJlgi zUx+7OV1kWjxPS`<-QR(3aSAdVkDm}7TkCb z2eh>Vp6I6Sb-7dDP6yb<`Mft}0K4Gn{nq**DeE(<_{^EySVYd%*m#y$5iyuJS&s=; zTG08^`+4jurycDtH1?H&e8QJ}Ke4qTmQ@u^G9syc&ZMi+V|HoI7v!Q$)p7I*l&EiD z-X$s6Qop+nR}(=?SqdyH?|9_5C(L>`v~f+I^I141QgCpd(U;jyAN*6I>M z{cd-U=e@7g1K!-&cMA=~BfY&stp`UUMM3KDN8Qvo0HS~T+$f3I{)t1}D|v+g1W_?; zt`^>H@jgcZ*kzRk&de0W+J;Ry=Xz}#5Wg|dK76vGH@`#BspT8@NH+avQz@wciaSV6 zl*Tr#w&0hX{|a{0*lfG?k8n@%?*DoO6+cb2^;-gFbue8!09N8Fe1c&(;gowH5 z<}aTPR4ciPh4LEHF43M@e9z^Cx0v!L>wN(vMZL$MLhQHb_hKr4fVkTys2(CEbJuR> zjr?SZ@u9>T$L?zvShyjlLH9cS(b>V#(O01J&&u_nIx?MFi*>{SkzU z$%#d{j?!Rr+V|4Mrl&ft{{#MjTJGCVtdpOrysy;uDR+N?&I4Pv1guZRgj@j9{m5e# zYN1Lup_}*aHNav!DO4-`owML!N(X{HPXe44y7Q+$3 zUw1ajzTf)5ngysL(=w429_BQo%0+{tML+^8!5$$cPmJ8<47OVvjNMFE%qd*e`Q@7R z56Ty#*ypskKv~@FV%^5Q7x5>c@h=eZ)i-wL9q||z>A5A z&FQNVu<2HT(wVCmQ37`(Or2(weL+y)WQrr<>K|6R{-$0?oG=2khst{T#a^*j6w7X^ z-yPq)lkaGAnpFPIt?@cVH3ZNK#A08HatSl7MpjIX;Fq}A+-iyHSe;Y6$49^$3d>l- z2^tW8@%}`F8QU`=-dVC={F;E7kgC}7d2cm7CZ2bFsl3^CVRL-Z+fF@OiDF+U#o~~i zdH)fWVd<+;XO9}I+gD+pFv`M(l?WG|iZ<@@r1+QJtD5A9FjCgutAC2m;Yjbv@9Q%3 zB+(Nws1(fW-Nt%GSh|D*ml~a%ipU)lxv2wv5c<>tA4lDe%SBlFOVgkR^L1dx9QzC?+)<=(x-sj4NsDwT`qwq-rjo zn}>wMQ&K3cIG`gNk~q#{{F8H5$)+HfRLX?YV5R7HwOEl}zylT)>~zEmRF*tHc4iTB zY{I+1>F5&F5$MEe#@_!(3h5#eF46^j@gGj7^WZn{5VcmBfSxK6hkvqh#u+MH&filI zf)0wjk(tg3TJwAhlzSSja~a=WEATeuQcC>f?+<~JvhB>DSY}VKz*;)yARy#9!X2wgT)MJNio!T0Cy!|_Uo(5;zcR-~yS8TwZIW7eEMeEZT z2fPUOvn%3FfmbZUTGjT8J}CzJL8*!|&&u7~oX0h90-qQRLI|g#qwT6|?^J0s9ujT@ zb{?VsJ=Te*$f9B>V!Ez-Cr?Kh{3zjIfHd$}hXTJjqEe^gNqy-O=J8tq(_ZR){ZH-! zZR{VK)BlF%+-z{Yl^$_z`5Qz>LD^&TBd(To#&suuZj_uj_uA>6$EypME-pJL6DZx| zFtn6Mx^6p{5XtUXrL0%WFV8^b8dJ_6h1!J78n*uN@$`R)2i8j=OHDEmSG2A>=~!3b^MH7| z=e)Iq`=$%w+@&$?N1vXLi1>x|H?wtws|vfO{IKw-7e z4UsywA^(nBb(d}4?T>!A@4UC;7Xu=Um`$(5Us6mw5*VjX zGD~O-v)i|AZEe>CjC)PBhXV*j)Gpr_4?ekZ1CO~)A+3T&xXbVB%@Bq7?3+q&xf@~W ze0t|%InwqmZc9ZSn{y~H2vCGuw^l$k^gk4#q2eEkkRL=Ip>!`7`;qIMOmhZ5x1B1% zWKntZ&Pu#rka#6{@yix`2mv8#8G7B7HhE00<#mYq)}uWvVC-wrr-ExkC~BugJfhZ0 z82O28-p;At64;a^P0LolM8((~r5@g;q$2pO^cCXspZ?^uu;fURj}IUWCZ&!Z&m277i~85@8uYd%0&S^h7Icxrp`?r$q?C)khpF>< zUTE;D9+ex1(zY}gQffA7b5ZBP+A0)5&M8H~oL&cSlw&$1=SqnPi?}rTP{4m<*-3z9 z$K}K>zS!~dC~*%=T$3x{nqeSw1)64)(QjFB&p&tmc; z8nAM`SSUO(j6QY6dbolRXIy8tz}8Q>DqrzPVs@PowEZD|@8m|I@#gYS>$0Z0dZA|m zU-@3q!gr*Hwm*XnH1eZOFue|G)e3Z*m#eTTS`FdEkc>nLRRD*1D~yx`C!Pyt*uZBd zB_=C?`w*_>EzNTieef-7g*)dl&iwh0qJ~pk$?%k@t(cC!_lPuUPrDYSx2atE6R}uh z5h69u8+|?w7vw!-c+Fgx522!ak@vCV-rv{|&wM4SpQskY3l$O6(Ya67~Ce1nW%vIms%DvmXt* z8f1v7l3qx;4$SLK?yeP*pYR;{TI+WVP;OUPhdi^qy>ayws6>xh;q?OlUJ^aa(Z~HPeAn#h9KFnS-pc}St^TsY-mvnwb_%e*(8{N*Y zp*NkHG=UWfV{m-sgYWxX_5L*P4#i_iUD+?gR%ULgk{_=5>I}5UACr}H9kvYa937Oo z5BwwgRT5EK2AW^?$+upuyVStrF3qS4+5S>0O90UYs0>sWGA;TVh>{RWF8oB}3y$Wy z#|W!KIjl0VOyU0iV*dJ7{(#GCsqb7AvFWZ(K!nX#!)wK;0?@npKG%78cq%a#=VO$= zkMP0$^zQ#hPHf}k1QElSS{PTzR$V}CZBHn+=)to7S)$obzr-oS)II^7cI1h-!72F)>w4Ia<+a4y}1Lwqi-g2KHZxDRnV&fkOn2SXRs zA6RXFz%dgHG@t9mClJLkdw`9Lw5D3icJ{EiaQWUu!V~KGfr_tWX_lR7KPO90z9Go& zJW<1Rt#FRK=SR8xfEyCU>g`qi{9kJpx%NBEr}_SZonFqDg&l{&0sE0NeLTZ5fTbA` zA}LXr-zq(16Ow*nhO~Vhl*IL#^E$(5*Z*Auc(on&P9Q=vP8*vTm`D;y*!^{?Hx$V} zQqf1(SI-G?LQB+Vq}3l#FRjNIT<}*kOKJmF|4Q2#~FOa?vruH-oee`o$2k|LI05;E9l-2@%s) zZqrZcr!&dx4or6nY6=6Q&Z!3Xfm~=1N{5G_2?d*h9R;s3q;^RY@GmaGvmJ?z4~^UBF5~E^PIjGpoU=7Y?8fOH z=^Fzn!l!=D|KQ8AKT;MAy$TQ{b3KJ|3EfG$PEHzZDfUJ)MF$5yV8`-w#5vE4Ov?eY zvHyf#N9*M~aJ-#;rGa)PFfifhuIp_$aw3F|rWFCv?FU{$CsA>$Ch}jaI=Sd>ah_Nd zHeDTGcx!qky@L#!f+}yN0hStTGC__G^c6%@Rz5bfyj+bEA)#lW$-#-u8X5tk z3W^D#k_&l^=1w%HwxN2$;`vZ5BAjizMZZPx+Zq{-{r9pMN)$Bzl>g+3g$| z`Ag`vACA2gYnze$M24))s|i^@(UdHiYIFQReAE35j=DhhgaC**TI+m*-rwdz;d*xL zEQ`~6k%;1jVew7vmN4*Ou@?G#7(S*S3+BcCy`Lf#ptUPV8AMuNs?5zZ8fy98yG=Bw zm9fwL5wjMe5DMi-JzyQj@$9ZF<~vKW;?%moPV$w#WIa$}vc-roG6xCzcB#FXa@{PK z&!O~RP7Rz5xLW^ymK-5OnQd|O$vKCa>>jDYAIDhREu`0B1fkL68z=oYBm%jc-&t-T ziG$Vx83lzbNI|5OER9rmtiR?_g$bYv&gmc(Ay+&;^vG0Y)w%G#oF3LJnUCfk5B9f$ z{|D7ntpLGS`*}4HXmsX&4uq=U6`oB9fODM%X*+JPrz$s7&=N!!CZu< z`Dibcc@FPiCogjLTMV{};gfMa{d^rHXm5(D{(WL9=nMwWS*?~ylfjiC48;duu{@lN z1Y*Hw+=dSC5wtTe=}Z=!mDmoev!rz8QhMM5WM+Y%JzRt07Fv*4k>CnW)IYK0{LNyE z!K;1Q3I3Pd&Da-H6WeI-gA-gStqj{o0hoNZuQR>s)cdF(QRXev<@}7;8;&LnQTzA4 z_f}X^IbfnlxCFg5XjSuXYu;S1*Fe|T3$-=%2zBvM7^M1@?fdzp`n88JqOVp)zP)e) zztjWQ9B25*%+3O~FQ@bF7D2N} zQ}?-M`YT2V>W-xf1aB63cIV$8g1>x5(Q*ZY{#prCG^h~p7!09S{l8-4D=u`K((QTi zP`sd+cs)J%Icq9Kri59By8=mtl+BHALL-qL2Z+qXTgvYLT6#>Y+b;e0iO4cHPi$g< zFn%+0paAm*A?%RA|Bhhg5O3;6L_vmqjx5DPjTAw^A9G*x$Iv~NM*wYTI-dcY%fRWSth{y`k5O1sj{=z?Pc$xme2yMFEIWy`tm~h=5=`)AiFC}A665f zIQWrT0sraZ51U2G7xYnr;O#6KL%=7op*TK0s921`LKWjhpdO8I=-^u1Ab!|Yz2JBm zwDaQYTC~pqs+hQBm(Knnd7uZ#QPTXL%n1JU#i21=y389qU;x`Wulm2X69wXXuIa(l z!Of0rXo@8b^`-yDP?Cs|JE*-Lm%T}V;pI}4?4e8NS;xHN%LN4=UreJ^qk`*t6&Pm( z*Af1G3lGtox7-D9*=G4_5DX8~Z!%H+J8A~z3#B$(LI8syp*loZU~vuKHF0k=#`ZN* zR*tVzCRgA=U4`QebVvn}$>c7AYs`Kjig3rNK!kP z$vhIga~@q%WLL^2+Tb{+HCP!?3eZ%1rgA+p^y!Y!0^Pso384}H=FX6yiCi?OwIhO4 z`hPbN;6z=$Y)J2hk5Io5O*MXMciIy#e>wQz{6E&A_}-0m$bcLB zI54EqZ5{Qc0)ICYg&nFf-FT-j5!i=q zbTkoY9fU0T@7hZ>5g;&QgGu!7A9u@uFN;7`ymsN`>im5S64q}d-Q)mORI_3~*09Q& zM9>v(aC1(-P#DD?K=?un?)41H)S>RjvQ717+siK||9R%^-_MMPKl9fA!!uvzdVeXCp4;@82dH{6iXi3jx>9=D<<mECg;_6v5IdBL#Oh{4Pbe*ybPXlGDLZkog5>(>GwZOo;jo~e0%l%Jl;DaRbD~Ucm zA|KTdiR>eiF8+x_xlV?6c|{E&!DvJlPiH2&ai286~ZBb)ekJaSr=F*(RWCJk-y`IH{hxIe!MU-uLg37lxaD&G zzdUq~`Pt&!1JKqBzKxPl??SJTgQE4XhYLFoPL08CJ|4xkxqAZ(IA$-~qbABsQ6%~! z|9Z1jL*T5gEeS}GVaT;M3hB!K)4p@~PRk0%gp89Sg!{Ef^7|6;=n7lb*k8VXDfih^ zVKhQ&hCWdk)t}4P==-GXCo0ZQg2?T_;sPJU2Kt}vA16l5^y^09$8#;Jm{&~2yoW8} z;b*umnOZ2*YNw^8J$7`)NI=TR@9gZ135jQuc6JVL?dXtQTa2o^m2Yxjg${SVP=H5^ zdKMcT&_t%VjWPeTExt{_UjYOsH9H!D8wo+JqTlKM%vm~rfpAQy{Tk^)Y_@B?Qc5_! zkWzCgq|rKtxzXVG`|4&K{Ip#trh3S5lI}S)r|Oi5L`}o8G3njYS^oB6KlC`}S)9nsj~5 zgQW_EtxS9I?NLsx4+gby_lhvQ6}h;>QZOkzQ;W*1r#mg~bSNgraSF@7t8XNCJYnJI ze|k1OuFhX(D}PTalBEIeA@1GWw9Nl$v<;y%TRJo|6#BTc47?sRc+Ztf-(tu~$A4@~ zGEiArUhdjM?J(un6Q;7Wdf88dw>GYX$Yc#G0&9%r-bOVAfWMEVQ%-e01BJf`2_7ro9*J-^G z2^i)Wdw%{?8aIfYsHaB=4(#r{h2pRif1O+=@OdR0x%Kzl`XHhC{f2gE#^SuUfH|&2 zic6YiEV4;heZga`2#rG#)V|bM(>w&Dm7if5#9j-Pix%p0c^ev8ywrf>8(%2hw~e*? z7T>cT-$WHYNK~;+XDus>nWPDAO$RNsANe!!m(puLN_m7HBA%l+8bp1v^Vnvw0UnG9{uH_bOEx)7*n*X8j+3~0^iw_8TbSDm4jtJHsGve~B@*vMX8 zUEMtZ&H(M!WJL^KaGPmIVg26a``{x_fmh#Nt28QnjAi^%NC^V8Ys>qB$S^N399mBW zVjMuU@i*!L8~O(XL(65z;(@b7^Nk+u@2SsgC?4{6l5R4AvdU__6J=bBTJJtIxlsOa zH6yIA?=FaQ7ycn4IJhJi7Th_y?3_VV#tguG&B@I6F3FMJ_XWdf8mHBRD(hU?!1ic;3oY$(i!Wun1Vs0ag7jjln*^pa;{h2)D|$J2cPox+Eh1| z*3Aa6nFWJ`U%-t*(+tu)zOm_QnKK?a{?hiRF=06P?-Vw-ewP{8?E|y&Iinb~q7M z>as1G*+_*NkYOBGZ#i(-e!I5ef>teynL;4 z{eHc=jEg$!H5v;S2lO1x+RxED2zGtR$9XX_3Q-h#0^RdwR;EACSY<+YbS*|Q8XSL( zY0S^hlNl?ci|F#H!Qz00Q^BGDMGJLv^7$@~vMwKchC?wv2s(u?E-sE$`?MV;xts1+ z{IoyaBQ(35EVualLpn!aeWJ{IzSV1YNWJvB$*4NcRnKlQTm4H-S$%atVO0wqgi#|u zyYA5@a&Rzbd?Cu3K?51z(|LTfuDeA-D=~2>);x5Nbogamw?YF4sY6F74Ay=a^9Lx?YobZK@C-FP*x-t?7eCc-u`W0ygw2+GB+sP3w;yixy^IugJ=6Wb?VTeFsm!d5t#xxQ_bv=? z3A)pYVThoPl~#AUt+@2m{IkuMp)TpYJ#|sBrcdP*5_vOw5Uox{ zuBVR%mU|7TqCfWy7oZC%3Oc9U&o`Jfdhvn^(?B2u_Mmqru%4cnT@S>fwK{AP^-ne%PhA(Aq zS7*uG)x&ssdE&9-)>ZZRUl76VTj8P}C-5fY%{~Di53t#=dmQ#{LZtO;#foXcZ}CXo zy{#A%P68(blsi;E4@7J46ETNlx9C$)Wy;WY?NkcAQ+?LIUZb4KUY?EMEvXa4U8q~l zB&(V4aHr7jbxqXAr{ZyJI@I)vE47JDj~0`>8(4NrO1fv_i*)JJ+vO`N3pDBF@9^YP zcZ8>?kx5&d0V5{0Rd(UdoygK~_kn()feT0=d3fY+PP;d;$u(Qfvg z&)fS#!IbsN3S1P_Wfmkk_%*pT>~xRPgTXPu5N`RlB-!S^YB3eDwCA zQ#dICN-KMc_u*?$WiskpU0G6t=QC#fmF$Xd6PZyzKbu9nLBi|$GKxi~L;+VdwP}!s zj{m9MAwyE)HWFf1UNH=I2}agQp!a>59nv8ZH=xtuYGGM|6rcKAbAtY1c)L8Q4)8_ zjepODY2OrTa}hh!hcZ00xgk*07~|X0a%t<3mBe8_jH-$VQa9nW1G(#<#;3 zR%VSL2vpgX%2nO+Hg*kc_>uM|O+2J?M>AR3pMXKCZ5OzYu?^uf5d(|yx_5gn zC(X?EU*&aKQ+M&yOCWt{<49p>t3n5J!+Nqrl8c*r zse9N;#`0c5Dhd@*kaq9qI6HT{V!w`?i24q&d=c?YJeZ7-T};WN$N#x_vj)GN-0t?% zVi(}#W^k*L6Ik_#8#ijP##P1ePh@3ouWfW6F3e(%M&tovaaA7AD0(35b*5*s*t3q{ z#U*dV_q6sX7^LI6-C0+53`Bg~D{=sUp?z#Z6wZ${(G11zC}=%!Oi)|^N+7iOKE5b>}yxFo3C#+|Sn?Chq_{R&!l?L; zjjU$0ByA2AIF)zr+l$tss1FVc$6?rhUd481u65<-1R678$*EO#O?`8HbL=w4gH+wC zmbih*Cn8CY#kQP{tgIaNpAQv>W4t=huWh*{#1oAtep;RoOWSzurOl?_z;YXlEUxSO z3L_Ni0*yp&WQ*U8HfP)yx$~hJk+L`bhkOun{{(E0()_%!*$MN&TQNyS_cjf* zwzjSj^4g_IW&D^&hiBhbwjRF^A!hFyM<=EcVpCvJf9W`?l65`!d0LrUHLH8DlqFV8 zMc>UPk|uXbZfbXV3pL`|}ITwV$a`M&6cL=s`rY z?MBQcoSdbOr+2h#jq>)=vyxv)tq)(d#5TwJK%9oD{QAi!Wm5F@$mcome8_~{bfq^+ zoH{5#AIn^u3$U2w>A_UGt_#;RLRS$pK?dx?BpUp(qLci4hNM~U}xNVT5X;l{rc^o zR+eH)ENGM24F+VzS{5!_J=7oB$Go9KBmmpZvoUAK4#Kg}a7Tfo@wvv=Ms4@{!8Q1~=!ohp;L zXTP(^?82cR7GV-ES0Kg`kiAYs zPl9{$3JQf{ZDKt^MID_Dh=DPmQeIsMS*SIJKf>^CM~l0@nnkBC33!JXq>g|xGHW|< zt<9v#vTften3C5fP&m}H>f~S5K>k2~B!4C?nMS7mA1#1~b!I_MlU5hk%?k5pL0Y-o zW*&lB&y|9Y*0#E1nf-*XSOUcYJq;SY^!ihTZ7Z?&X{im07-MoXW$#|U zW*;M({gI=}WidqKt~EQErAW#6wCs6tK=&)OAfKZehE>m`q$Jjr{-o&dS&Gb~Li5eS z9Pf%sq~1|Q#l&RjK09IeGS7r%EsTG8wiV~PN}QJUIN*KdH#Er+S_GHhn>im&Ck&iC z%0uWQqDE#-hqWOb>kYj8U6N|AM8A!Wl+mt34C31}&HRk*;?OG?PBd$Ei8d7{TVY`0 z^WZmkrNYafiFo^W3wg@UHjmzwsz1u~m}GRPh7*g#NM5=wA`7Rdh!$k9c-U@(~us-qr^Ww^z`X{D;hIddfB{Jr-}lZYua&(D33aoXCtE4puwWW`4?@Wl!^s5h z+18&|bCo?D4re!ZTGB|Pe<_Ob3khc6&7&}4J5ktrc2rD^S*ai=SN8h+ZLOy{er9U& zJ6_2mN}V%u#fh4bkQ5z|eE|{YHi3`Uv+eIhz~m5QNhWRmtkoo9(VA7(`4aZD(uNiD z?!)^!kEqrysx=Fqs@FKK%|{OOtKu~1f45)imL5ocK-)Ot2FO9O*?H+ARDv3naM1>Ewbb_?w)SqkLezw!miwntDF@lKD) zY){u`T9220?l2Vx3w!)$>yqiMK$MC^>^rC96(#=c7+F&(lx`ITaK1{GHEPVx(W=%U z2}a@~W*#;xgjN$^B7#64Nt{6I%8BE*xZV+kPdzwpN8pF#k?Dai@_10o)y~n1QN`~o z#SD%aJFu$1P!elDGG0m+L|PL!nopH$dQWGz%kSB*2q)4UOe70?E8F!n#Sh)#$!12p z{$X(H?c{r61P|!9vQfJuh8bl%SRu;j_sVjVI3D_=w#=M~DJ1dbF+)yW=P|UaUS;Av z3;B$>sEGYDJp{vG-Sf2E1s?qT$kTgr3)`)8try9}bEj+cEw|*ZvG`I-i+<$$_awUk zh(Q`-J|z-fJPM$LUt#NH*6(0!@46wVT&pB)?#=aXJS&I3w`Erzr{5XQB z{;a-&%KosINWoVN6e@iD{+y8EW#^c_`GFkmVx-!#C)Lx_~8_ucR0$sQ32Grv)W!T&xmH~C*3C% z+(8IDp0*T~J)z1n^>#)upM}75NwRinV0(U$T zyh0UQ`YDCJpn!tM9(9+zZr{+94Rz|!gVn-S(iIP6R{+OK`*O*xLXgj^fb8l~%YxnQ zifp=Lo;>q0{jJZRTOP_81m)WQ6!Q4 z9VusMBnRA?SMS;}$6+A`BWF_Mn1R?9S`H1ReoLbj^rXF_Q-jUR_j}qHS*p``#=@yFDci zk|OrW$jp?sFLhd?8Yy}lfM)+)zMrU3NSlEtiAAqQt-^MolH&;{HAJ)?otTZ`_ReUb zp6Uc4>r*wi!}TTSMxxe4Kf6!>yt}LH7B)YfPLfmOV4%rB{M@mRrq{k_Ib~_rI9inG zMO1Bn4ac^5aDKEEt(v8pce<&4YGZ-il%sWz-?b)$8oTBi``)*cd z^@=||5BT2sycb93S%a`0a$#Tz>Zt-x*YU|PH8QcAiF^Tyq zBjx@J-5LFkBuMK+_JZuMba8|InvYJFdNdceiyDh~4WH|=2nMTfC4S=RQjw-5T*0kZ zW1Do@idAepnf~3RjW_Lm&xuuX zur;X(q~(MJyB4p%Q3OepLXhSIuP)DP2~Uw09F`Fa9vLjx<;^mx;7bH=t zUULg5hep1Xi&s^G;uJjZk^r7;eW=dWL0U$}z8VK-@x@e?vh%O0HMI_@m?sEQ9MknA zs=PpM1y9BC{(|%eBYjP2nw+HTPW;|~jfHys!QstQ=vGu-k57za4#-!U?7nZ|I^UQ< z2?s0?F;betUI46Q{H%USB6xAkAJ*@>;fV`9-y!#X$|~EHer+=gSPXo4bgf16a&umt zRLDJHQ^=)FO;!qn(pp8F!bV%qI1;g4Uc1yIEcDbhcdziW?b&Uaa;8`eomuir=9U@a zAOa=g7vU7bjBxxHRl2xk#LiDvv!Hi1IujOsm{1Wi(f9RX=jlGN+1MndEXYG%Y@G@- z|H5N<&hzXF?}MOc@)JQEMnR7my;8658sngd&~fdDg4@iXcuu;)sPTQ&gWdIz*W^g3 zwMQ3pCf>qwoeXCcmSd2~~DX(=XPm+FZNZzJX)lqdUm+Qm>Dh0?|JKXWD32U z>d~7T0%@s80rzRTt%>_CuD8l8Hn0GPUkD!3Zs9!@H?3ghTH{Fa2QV7o6ii8U)D%FllI;kX9R(JcDr?WOoy(b6XrQu^xChf}^ml0y*%F*yj$ zg)rzTg;Z-yUdmgzD>m1_0#eCKA^d2eYrATezGimHF%rYiufUyvp+5(_AK~ zy=#xv^)~9$@tuZHQI>NCg$s`z8!NWo|o0M_&zEHF6R zp&8j2ACHQUX6AFPR;g0DCu>j|uzFh&QyiUswGd%sy|;QFkCKvIY9U%Jt%`tY@oI)I zXstUoPbNhQJKZ_b?lu+{4GH=SPN9jtkd|NBgqtgHvo8*WPtAo1-=E*GNh}zYSWuiQ z!`XOg4g&8Q+~?<5^axTZLY_#B_q9A^A^rF!9pU9J-2@yXr&O^$?2Q*xhB<65Q+9z- z5?z*j_KQK_{~#l4?4B%4M85hZba-*0+IMv@R8UGfd$#UkEAY0SJ6 zT08%tNJpwVX7;> zw>0Sb*0TXPIWvoJ1B+@v9E^C=tL0?A~Z1hKO$nxHSuPl?mJ#cxPEOz;@Bm zebjhP_4D>b`U?$>xZXrQRS*~#9o)th1L0Kc^#s~F5tCZy8pkl9bgS#>o*8Wc%2jG> zd%Fynl7g2fsppPQc*hKrTeT>WZy9*sU7+O8##%~lfL6UQ3;$o*(6p$XxW z$LU@-e>&C``Y$ExTy(GS-NC>-{)#iWyFBxgCp#M~q+a&Bw4F>isWa`0>aMvrXGT+;hog?8zs< zG;kI{axlvNBBl+*ZB0xdd*=_QZ#^sez+_Vp;sPDM9UaXiXlh=AVfMexY@REQ44ewE z$YwPD?Ta0J3^<;Dnbj;ikS#n2PXAXGf4RnIkp_w{Y&@55#P?0j<&*fco3cshRznoC zl^9HivLaM+S7+AylLPv_ts(XEcUrV-J*%Ux`Fy-J_2lDYt8H$omYHfd!+IY~wGYqs z@y0o{%8^3n`%%?2f$ZBgrvNeQK|=uusd55B}8YVGW9RH59j=EQbb=f1naHbXvl}j!DH)3chk!e z>FWW%G+M!VecMs9%F!ZQJwM6TdPlncM6Y(fHV=mf<>f8v`9{ZXj@M>EtZMGYUipNb z+D{ze<}AfD%8&M|eZm6+1C*Xd^bl{j@nEK0hd`HVwoY|ru}QxO!A%Wj1chF$XqN3l z6L#6g^k?B~(lWMI%-PkkixU9i`T(-G_Wat5^}6v#S^XDXZEfL+Pn0zYhVLE9Csv53=MNCKy$?$awd6`OZw$a)t5rjh=S%YP|^*SV4oY$yyg=!3w%b zdjf1pzcE1MK0Ug1X0vSRWi`8~d8`%`0f7bh^E8#Ruw*M`1lg|-weL=@UhoIAn}B8= z2^cX4R+(q{vg6+kGc?OAMXHKb>$8@%?7TCLY)QEKzgS95q!fdH0A#e5?zp%T)HH zOwaxvX;v{5Up%#dD^Jt6vLu9Dot*KnrFJ7uW(UiPWfE`B)~CEq+X>&9w6PPl4!lcR zJf;Gx4t4PMFe!!V8dU2a2J)Isdm%r*D7Q|DXXfSXYtfUq2ah1}G~S#n>)m%Q&zm#% zb4!h1Xs?Deh{4^vc&^32qmA6S;y}|!I^nFyLsR7Rb}|;Zt*6UU1h6Hng6izD6Vqb> zz`%5E6i2DH0F6vxcxUk!KJgK&DrYY;_)R5j%M8OF3c7hw9IukMvdT`LrNIM0b-+lu zdi+2+0Vek+={__(U&531PVL3aOT25;Z#1sobRL>FHrl|P)CYtqbJhhuYF%s;@}iEG z8n2L_8KFMcr?!LajKxD9kDSGE8SrB(n))^_Pg+)WFMDg2!%@ZZ6lz}cbtG6->m~b5 z7-9-i^VtxXK1R8Oh7D~Y_Ki7qJykD10q7BC+IP!ozIqx3*?gU97_;_JGYuXR(Ot*Y z9Oct!6?l6pW7q30ZuaZkAiTLai~#C`$`d6B)aho);yaEhA#=)zJlGp^%(Z7->0aJ( z*F>J=!gYrru^8IH3i+v$WdZQb=ii*rS?l=cP$#iU;|@w7TutF}BN|Rlc;oK3BYuaZuxrt`XeQZcqah zd<)!gc4vUtIK){LHMZ6>){x`9#JIPAfXA_C@l);F3tr6kR`Yk{iQVsb0vO9t9fy)m z#$0A?q(=N*kbc1PpM~0X zZ_yE3xRN=%pm31nX=+WVBVUUf+PIdqI_vmtOhYu+$0MJuHH=1GORpHy4TJeEa<@*W zjz>y6r4`Xbv^81gw06T=BU2$c@6#{L1-wB1I-&)VDcriryQ-o2Fr=Q4#l(XE;=7n0 zW0o!bnC!fz=g>mv2x_P1?Zb`P+S);n{?by31)g-u?B_+9k$JeMI7c>tsrv)_V*{0| z7M4zy@?*bChXk#!dv^vrGE#RVT%7+1YP%obnQT1hRNpHGQ5JI%daZ6@O#Y~Yy$QO- znyK|gDrS-8R*2$9^6J@ovPQ>m3)FATh}@|8_nS;SP7e+F$T%*?4bc(~1joxFUXUxI zu-%KCyxrftQbife&0Wy$j^0kpFwP*UOiZ47BQ8i@pk`~gb}~ z{QIK#uT*y)&MI5+xe>P7M&7O?3wYzTj1G9SXCsiD|(UVNL(p&ni`WjUcRYPAA}$2d3bP$*lOZ zH+g55An)5JtD5m42df;vQ_ein^m;|o+!EL1ib_Z8H$K*|27Cb$1X%^)O>%5hLGOoq z&lma_#1ugLA?U93&V)aiEjZorXkOAZdWh|O^frNovK!@_RTqmPQs*iU#V770n@=G& zo374x+VZ*^@gS_o>vg^r<$kqjLWq3_S{5x6gTcI}RAFNJxIzp8%0-wPbdOf)2rX?aL_}i033#|Tot^;Sit0htocf|-C zA7V!b`yQZX7*lI<;Ge-k?Q1=>jtdZds2<>7YBC4qcHGnmn498dGQk(Kc{Y`=D->1uswt&v;=Iv3!F86$=^$j=2lQ_UYBk0qq+C)iM%=%>D1n(W1>=##Kv?-14_3Wose4lfEU zF_Kac@^eFSQkM%O)1u^~f6y z9cGmF6A8ccD7+lD5!S;jyOn0Uzp7{`Sh~=0vyJVUTESmBHT*Fi*zZ|HtF>oBw(BR$ z&yppYT4~r6f0>8Kvug{I1$&SEkhFrM$Q!lx z8FatS@Y#Ghx&8l#jhO@wagl#}iDXw+_bdMK@N^xsjav)MgFmRNk*Sx7ufOQ@})) zYFPLAivoFjrJX`S3Fz&V^F6pH1@?QsSr@eZQ&RvY!X z0_X|`Wh9-2_e|NIg$GOovLLVJH?}`Au{qD86onLs_(t|l4(VQ3a*g0xTs>QJ@cR%o z{ssBXIglh|i+NuBF~-{SiuZM#oazqB49|Pjlfa9onFGL3862kj;=LseR7CgBQ$s&c z9b&+c5~ma9vql?hAVCQirZj>Py}-h~Q=h;#jmR^Av(4rD6+hh$QoH-|fj?LPcMXGG z%>{%*BZ~YVS!x+CwuU)<49#)l)#4voiz>K~$dgzPJs7yX_O4`qgjAobJh+^dRXtB- zN*CGIz}MW=RBqPLd-E^Y@281YO$}kYm%3#J3;kRbytQr@RD3*t!gZHHn`Ir8XdtNO z3sHhBVJqyxy#x+yzsDGG;W;?rq6j>aC~*fK3F?0mT>=w3V}`W@^P9R3t)76@^6x?F zU#SXU%vmrb(WBgmSY!E^S?>Jyu2brW$=9Pt?a)_B6Ye|+Hl#e!US%H}qv_Tm+v+KH9V~=7| zuA0gUbH+IS&V0@Cd#cVUpQZf!MD0(Z)YC`yfEfinV3pw_&zDRRLuz9Y_(yl9rXVigE zGtFnaFV9#S2i8xnM#D%zlAe?TB=yLxJ@_=lRk1j`e}AjwCf0wr0DiArQ%Rgm`<}A# zvp)aJtV47F;c;5$Ys*bi4+a{Rn*0~{aoy$dtNT&wrL3xRi?*o$38;^+0&2H_ z2@J_`&aEamRxJPSAV1_|drsLbb2Aan>8oka-f~8(o;dTJ%RepM%d<`gN7A!1jsT!3 zgW={?KZYWz8(Hrk9!!jziW5o5->f0@(qQ;uJug!Kc+sLchC(C@j#5%mg2}VFLJ{fb zs1tmLepy|;n3PISBn;_svL7*!k!WXNw(?SKbJ3E9g6l9k@enbkjYAK%vNgAN+PiOY zw|cWyGO9_6@!+m&x&Sf!%F`Cd=8APN&kiZ1bM2c+n+;IYzG2A>a}kIR8>+97}B;AUO7V14mI< zw?-Z>X))hVthx8?kX(QaWVQN()47eailz)rJPRuAWC%!>x#m0}4p;Mm4sWuh`hX z`-- z#puz&JE0~a9%PG7S65dwxP;?w_IvB~33!t4WeM$EG?u20j z#cPWgX^;`Vov8cfe0Zh_5NIsiw>321jhky%mvB~varu{R9V|2@HB}Qd;Gf~uRqwS$ z+`&`r#zA%IXs&8)kQj`_OH#!>FAUW1GR(oVK!ZSqa%_H-oG6K zxD!4&ZFmsQ#;vd7U2NTWo-%B%Ac$^xG#-e~Mj-NNXoPAQH+ijnz+m#hQh!;dzvUwI zY5MuZ=NVkz1^3~WlFqhE#fN1_^Z$%DdeqU4?^E?Vp2D;c(?9i^-!B$i#(%A>q|5)o z@zma-Y7LY2C+8An=2<^hf}|STSQ&kAosD*M@LDy)kdlz_ z*Q#-U&fCWCaZ;Qh^hO7dMsV}drXGP;UHmnypFGheO2|2DhrT=~>+CIxYzh|DujxFm zKPShLnau_QZcoHrydh9DvPkVgWAQh|%Wr8_Id)q=pMFQkZv)Pir5lZES(MyW9-=8srd%GXO1i;5fz~H@D(8T zs`S~NxAjDcgZ-ph-WgA8G;Blho^ zPp+sb|H4lokYfO_`y~zzhSX*sX$)CWKy41i1{RG6qd}|OGr_8Vkd2#a@3b>!MLw_% zkeZkYSq6-WFU%a)S&s}mh?n~&)y|k9^<{PVlsuo)c@?XeHE79iKoJU;2|kaypu#bMSg&9!_%Zb3urwM10!eFECyG5aJ*(LRJ;&V-*zLmsJZRkseF2Gqik zM$OO~y~VHiRtCH20x%o5qixkGBYrkaT8OtsmI||3MO^oq_vYme^t|OSr=NMcV4BAeo|bQM9ajzl39$LmXpVYs#+J zzeL=A>Sgy|^Mu`htb&`a7;WlzYGWdF-|TP(V1xp5H~xDJO3EfgN53K!gZV<5rsr!Vqf{P3&C;1Psz%N_#hZqTj1|hTqKrm0 zpI`xCtGRAdIG;KVsHJ_2*`-Vit!4%DKeSI%@5WpUR2QBx*_4MYterP%e@!>8)8o7M|$Q(n5o&CmKEX)i;LZlUJ3xcHrhI&!2&HHW&fx9MmSZ!yY?bNJGxj?Z@r4 z|DsIb566L5@@&!T|KCW5=p7uCdok{vTnb$r6#x14H^RJL$c*b+Y*V+=ze>r=tBKt> zRt6|O01`rcWku=XDDwns&UY%*XoxsLxhq=G)}?GU%AAH!Jg#&&_c|2=6=cTKcy6C)fw3s5cfRMrL*k`M z2(V?8>Q>*m0?d)qO3N1!j+BdH!W?C9x@|4X&0?+12l_~Kc=w|$u{Qd^4}r?bEw!Kd zR)<{KEckdlB&PxA=W}S)8zDx8+{+$whmqg+z1>H{dIr+;?@vdpp3JXc>K)M|LSg#f z0m`SZmHxdeq=pt&_`&}nrK0J|{(fwChRBOTsW_IE|Do$*id>ZmUOqaIUv-Vw411G2 z@Sx!zA1WK}AKjt+X;?~qTM?p!bbGLQeGfP@3`W!Qq@OLv>QdI2?racq^0>E zjF}C8jfv*a)v=Zesol6$l!v&Gk@Su$_NaPtcGPOr{DM}z2@oJ-too~Dw0*|5D^{pu z10o~tLA*ah8lV>5MPl6_A7aYi=TQj@b?oUj8^LHEDa)rs6?_Qnj1{N&^yLUYF!ELCAcBB=9jq+oKXW{Prfu0G_kXF2@LxL< zYykZ=nZG72I)L~>!#__A3e!YChK2(cNt=Su`4VRErACxIk8y*FC6U%Z(1k)o|CC?$|0U(uR5CWKz z4sd8W1zLf+(SQSM(*8`rUt+77KW%<#+lc4 z6~)uT8qU?Uwa(>#^@qQl{To#pJfDD6525%UGoFwvUaZbngR-O17{GR@#`?Rm6z{mp z_qnQT-}Q*Kg?tRF$*{2fZvN{htgI=pK6wPPkc~|U`6EiLr|DvAFqgy0pOMcVd-v^z(}{KHLBkv@Vh7xL}b0s2c=PYJfFkYMl!?B54Sd-7aj3B7)<>(>WWKA-!HhO zzOmXZC^2g^>BiF5K!(^oJNw;>=Y9s#mp1dEEJeJ<2Nn}5pw(&l^N@ZlEbun~rz{PI z7e@*WBpJk`VtnkMOC>H^ChPI@yiBolcmI)1I|ubS_5P;uC(-D&7d+?Hm7@=Qk`f3W z#30^}OG9HZjSt1@p86UD*`LEh9rTFl5qp5d#XxF_w0WMVcvmFcIYMh?zj(eQ-y*rg zwskOjo=>3X{eO@HFWCQ|+k^Yk@pCkLv;0`&-TRQ3xHyw{??N4U;6HKqAshoC^VPS! zR;fZ4`h*@1PhBIbc^+mpmLq$#J)Hqa)s}*<(2TnNgix` z287+*=b?_5m1+rk%@|Fa^BLpBcaye>axH{$P{=GVy{{UD`j%F3>#n-8i$aM~eO1Up zUd=b%>LDhhQMd;R1?z_;;DEHAemF;6JWazXCX{pLM^jVhH(u&IU-8zwBI4m0~Wqc+e=HN)uT+8&cjv`?|^DS&h3(z&RSp z7%#I*_7KvjXt@jFavP4%F$VK<>G`lVx&$CIA^~-gz!j)uD@ufE4iQ?cy!N2^AWdtY ze&x-P;Y$0N6@FVoKbW<72BTGagexFnF+6SwLC|02@WvP8kM~hal4nhla_KMbn3;YP zb;t__n!W#kJ~)4UY;4{JLz;5U0^(hb)`^Gol^{yb(yM7&H9>!s%;s*$5OJx`H4aJ$ zfR_h2QRz3xo;c=;Ql;&4WM##Qq=D`!)c9Ijs>2tr9L#|(VnE&~NYwdy{Q+DZBXGvs z9gtnp?binU6ZQvCLwVXD4_qdhcAOA3P{*2^Xh~s*^iS66!PK^clHm2zDa9X1^W-+& z?wj5(-WCk(?JDtiMaUv`9Qr>oiLpt&O_itdA)9~XfS@;c28C38F~ufyL0nJpJL*bHCa9a|=Bgq8!x(d8+AnN@c@1R$Ui5 z1DQSz{CxJSNK;eOZOc1nQ^5EL?MP!y0SFR)cf18up33sI}P!uDf;3W z6JraPI&+3dNmH0Sd~_*Ap8#e0M^nMQ^U3%7sw6NubB;%=6TL!EPaSLSNSTKU zM*S;=czpbxuN~NbEM8kYs}bnRZ2zBf2!*=xnjqGD27=_tvEkzF_)4>?T!Cb(dEJM! z!Yxy$S;e`Q3G4<37aq2=V^+(068-~uE=u3`b5+$(9$3C4^#ulE;Q|!Dd{0CmP&maS z^F9HS#+RTX>fW5StabnM-F7$sqNVm`>Ui-z9%nyaKOJu=3}Eq``4G=w7&E|#haW5- zg)yZbl)cws9KO=$a+Z1|WY6(;1tGqPGR;^^{Y&>mK8I-EH`YEHuP!gn<=5^#quI2X z%V%1sTXCJ$D+@8u6m=i00bv(!@CFt@h${?c5QJk19Cf4%@bnQI)hTRLA6_2Os-&j1 zNw9;DCWe-9u|9I>F`>X*W%jcapU*V=-qEByoTIGUQ`lO~a7L+QZyt-$%)^ORZ{C3i z<3Rv7Se;#+Nvn~c`{m_E)np^ltX)Y_1jSP~h_k@QN>27XX~b+P@R@vhQ8{)Lhg_KF;IUQVy|?Hz9CMf`bz zc4!inmQd2S2zEfa^wj#GaQz$GTow-{ItPlQhoE6heJyO^R4cgf!c#}GsbRvPmJYkw z;^+m#28A)gsU>n?YWFW)O1~mw1xi1|M){Xnt{_iPb8@ou()kkyucTZ_nUm%=1wTKo zn7y9|V$9FB=)}oa=gmTR5Oe+T6xQGPO#tYj*gbCmau;3bAO`4f`iQcmL+i>e1(#H-|woV)6^L}u7C{mAcubUMHT^_vAIT|4R}-CP*0?hwzSPE=8{A>LIaS(q zw*7#}Dt)BziWi-}O$bEqfEO)GA=&v6H=yB7Dkf)RkKw>8lnhfvc7dJDP{O8G{86p% zcat01LO6QNJTS0jV`0Dai|Fw~kz5rg0?T5u52jGIl+%XQl%;i_%2suRPkuB-f5gN~ zy7ph%oY;*kvdm}LTS)pcmK87jp?PXpjogLx)~>zbJR|qZ#@kF>@D`2pQFZ>U5#udD z9VeHmby{M@fJ2*8C~LI0SlGOB+Q~9*TMu6kFp_$**pYE<8wMJrwy*PIaa!QqHPh2o zPFCXp$Pw*`v?lTL!lI-KZxQ9#3M9z?ZrI5pLhZDGzwg~>njY%i3HJ1c=xmJ#i0fTA zsBox0kh$Q|(WY6Qv92uBik*$IZJB%|;$5tJ*|+7hM~0jAPcbIo&E_#oB+( zxLy8fZBm=6+^r6?QT6uiv_nKDEtOQEe)H7Lv~=!0dzv)69FTmCX?vBt9wvmd0>#X0 z8I}39l4TaWsa_kaN4D+W@39lqkkNGlSU`a5+}GuS;bsR&Umtb?5a#oh4lzB=k2nHl zku`-Z+}@utYgdYyd#Aop2s!=h z!L1hJyku`Xy%kNT$_vqyh9TiB9U&mC`3^eJ^(m>PWK_^biz^m_>%r^B<2ga^XeJ&l z--DV;K_%=u50qvxR+f~4cVlZ-)?EdgiAmb#>v%6bRJAe~o*m&I!2@Z7@iY`^0wy$M z%P}+(SqIusH&O)7hKL@U9OWp!#!SDZ_+GYa+iZ)rBd%T4^RHghwn;>|$l^6i8W-~G zZ?FJ#ErJNNlo9-7?-Z;Zr7S**Vp)X~h_PTMXw6KWMW zZvYiJe1{-k{2TR1YYT zZ6FX(Y73o}Las<#m;YKH2%lH2GWL!MQkJW5VV2BWv9<2wLzibf(Er3~2(}pKRRrL~ z1Vk2$n*C0VKYGd+w8y_gK6TDk9dQGJ-LxP|Chkp70^N>PS1-lss6_WtqTo@bnHn-# z831c>zMcrm(s?gptYU=XoF3jAYm<;`Qo0^yGTN_ceRM#nrE*o5$jd zfw#Y>tLch6^|ObT*oZfRkGlIVUb z#BY2!98(5GOd^l94XS7+Ms5o=mUs!QZ=ECDutB&^rQ2jEki0B!@v*r43#byD0qI*ac<9X|IxqH&p!z)Zm~XhW_+k!S#EvKQ+oRSY~>xe;PW1OS0YHzH594o z%Y|Rb9uByE$mamS?-v$Y&by|Z(Rd!?D=2^ce=yFJs|Hn?%k>ZlOqfo!^Isb<-evZV zt>)H=;PbSKCuK56T(i={elV9WnjFHfEVFh+fl#G!GWvtgJ%*}(XYZ&a!d)7R znO)i}S+r$4{Z7v?MV~>~A-%QqQ;D^r!Z6k{O^-vjhAuW=Cnh05Yx%ujMx@Mf@taz2 z{Z{Z@ghj6)-p{@u4?sCl3NhL_TE-ajITp5_*Gne1kJ%7K*UmcaO#hm??+ef`m7T@6 zcImQPCrV%3-+q2B1_La^XKYx$p#P1g0DBkEdhMg6E*&<$l}${)?0UKlSYq5Rzh1ei z@)S+k^$JjDuyEg}-tfcwyZiilD!GAs21YO3{kxg}Q~sLvq85UIuNqGi__foD?3rgZ zoLYcON_a?}DL7Y`hyvT&onTzVK20l6d|=N_hvpe8oJ> z`rylotfOU3RH+Vg)U)RUIa93PSf{qR_hvK-6@cnMd8S}d(lZ;q${5P(w zeuLqgRR!XnV~74)U3?a|Rid~PGu~{iq(2LO7|{YGaDPUtE@SSm^iYIi(q4(8Dof0G zhM(AO`njKP@zlFTW9@9PJyiP2Hv}xnuKbZAG`jYGXhZQ79}!FJ5d9TD>|xtF0s|hz5=>|OfrMIu5MoJ@ z#N4^r0H05TM0v3 z9srk+sTs3Y%@?x3NGt<*jE%pUE9i6(1sQf0w(bW;w?}=)8J9>e;&$@ z$~@(zL`yeHnY?$e785}T7&HFeT@>hpB-257JuMf6|xks>z-Sh?IlkT5M>Y&s~xqLPKyTB}kD%#qlx4KV!KDw};Z$Y@OAmi}gK zvMisNS$~THks=q~U-i$(c^lX;drKh;_J{EPv>r-FaH=ZXZN4Zif46!}7 zRvZ5vnp|@F*zY0JJi$g|dG1zgnj7TGh@b2lEJR;=6xTn<%SVzXQP4NPzvW0v>sjR_ce8 z4wqE%E;64** z@A|=R11{SD_Bz^`M&9tH+B=f%BU^6Kg2~RCf~G^CLqU3|YSi_d-ndsMynE7-C3*O3 zJl(P-3mZrf2abBSmCCJsfQ*rB<=Z?*M}1@KtNDc(+ru-=47p}o!*sXNP$l8Td#Oov zK!f-SSpEgEwwH8m$mEv1R*NltTo&Gx8mfCDGQD@L^ENSB=;kzB&+}IofT2uaDUKeKM%|lwsmvKo!{_hE47?uNDd?WHnjH7 zXzk@W+FbOX;pag5ODgi?FQ>0&FGPP`Fx_#Oq}9GLP#t|Q$%NEv&e-(f*UmhF+O^WP z*|LDCiM*IWW4oUm5z>P{D=D#jqWurdCWV|xN6|h5@!T2r5QeJYZGaaKu%=jlOb^&S zb$&0jaZn-_&14+^(nCKy@2;+=V7G_e)2*3O=>tkgpcDccB6`6YtsZ4%sv;!~Q0JqS zyc+j-nS_Cjq7OQuNHwL(KHmGPo^Ih!N67DG2&iiZUKGGqjCl~(EZcoI0; zc1y*?#XE&woZpqk&cn1GH0Fq2D4rF2tTFx^|F$wbnmJd>)lhVC8^eVv zwnZA|EH^aI0#D3t8E|nZ575k#NI$*D__*vf3&LZJ5;b&QX4x;rqI!=bXT&_RQ8J8` zhW5jJz94Hx;L>-Sq5k( z&`KD#x3??SICx=|f&xNzZ=soinOT~UD1=5sfHJAO!S8SC*6^yI7j12<{Lh$bcgAvJ zNKg1#w&pnBFXz{lvZG<+y42wrMBtVLm~1lw{4kM3l)Ze-oj^@=L`bs2U)*+OmwR#e z6|oK@2QH;3Kg98lKk2I@@!5A_G&x6^5AF`C#Zos>{zvrAtjzMb!;tp|73 zYr1T^Wc;hb*}6>KFSQO4%XA4XZJYYFj5+tM1B6>R2erECPKrsiJVib0Kd z=7$^=2k8a{D`>=t-&l~VSj_%7aJU^bV_#p2{`Sv4!*pIu$$hu=h>a{%j=@?Ejc#>V z0p#Xa9s9thaz;N4v>f-SF4pao`2K_ubHEXMXB+1n(JGv;F#_4-Zo-%vbzRix`DC)q zSl=!zyxItzMqB&@iMDNsCdUF3<4qspvrV)G-NMZj8E@b@amO1D0Fv_@0!Fk~{<|wp z`Tv{Mx*vhJ>~rz~tL86}5fnP?Na;fCUn(K;1KC=l)59m|+jRJYzHTfAJP?t(n?moU zx2lwmgF}bZ4!Zl<>xUA(m;D->)Q%LB3Z__)5-j3EJP24|Nio@ni@k=^A_yCf66$Y8 zz3QAAADbAay0yTv6Aq~n5KWqaw2BZF+~=d?FE5*d3D2o?8?wz zh*C59A$tYdd~>|{j|f9)C3S?>3$vhqPTo!8a9qEJfM6i{0_%=_x7Kbg^sDRFK(4V5s(L|ERx?90ndMI`Ra`{ zu@43m=!2kiy}I4vm>7ZQhh4{wky&n$3%!%A?|)SPXd4{#1(*G%>uCCWW3A%N(BH#{ zA|d~IP;`%x$49K}WZ-?A=nKw%QJ-v|c*aVf`+kljev$P7TzWM5Q#(b-vu2+A4;=ye zt*u$0P*uB=-G-v-A6dei7&GgM-T41O#4WM6XO}A@jf6>d$M^ z&;I;EK~l$6VUoztpST-#D}mw9>V-Rh*Kk(IFl_#w_KlE03m zr(cV2pLP9t|G@a-Xdvw4<8KNjW;JGxTY$nfuv<9D%*z|!5z8!`$X6^MZ^eqyR@Uj6 zZot$N9v1dkj*Pd?-2F_yGAu0YK`R2E#mmH&w;me~CqlSfyzb$JAsbdp9(qBaNC2JHospBxqp^PR zD8xrbsa2$e*{x+i1F$=zOgDb87SpH-B{;qz-~nHYOSCJM`Knh8R|JuN>4$7d#u|A| zA>#1Fubh)U{W=sm_Z6m}JpH8~>qY->(vdQQ+_)-?^ZX@bQ5GR#Qhy(T@~X6mk9`X_ zV=g`*Vhv~AR9}VbmM6$3SKU3Yk!>AODYbtWT~UhgD)_DKhClEzxh(FRQiD%)diqMF zR1+r>Vl%9O{mYi*Y7H;LFamv@D4_@}E3Z%NZ+`!jTc0S&Y2TEMVG##o@R%84qiilk zfu29`Onvlfy9tLOEj_Z4E(mKgC|B=7R#%LR*5PnsG@`$DG|hJzCKD@FUCJQrUr55a$+|xKWNf~w?|Pk#%Y3i!8f?0eP4 z?>|iQWL4;D@|qK?1c~5|rkV>fe)aUz%{-^DoOtbWjCu9H3otQy!8rX1Zri9Z-FYXt z6wzkoVf^{_H=Jj_>~GBpu-$#oVNV;*FX#GnFx39b6NUV2oqR={M&z%v;VC+VSJn*F;s!0G-~Y~!KmxF@f=P{h!HZu# zh<8(7D2Na1br`BH5qnC(S*#nst6#teWhJ!!Je>sGHaLtwZAAjT8qX3Kf0T|IZ0`Xr zOu7dpNKKxt?yTBzP?)@|-?-kDEH^v&3<%6yVHPg3{cDY5#=0ST4Y zc&uTzU7?fDdQTQeI8%Kw$y((TGP^b3q^(XmDaRLur&)e;%J$q^U)uQ8pKeAH>0Wlm zbaFbB6X)h&A!!9>`JHTw0ydMC6~{+TTQ3zVF~KEhINwgKY`0);^7_%H+u#U1Xe{w! zCf&Y0b>H+iWAuGa&7hEs1F=7Pf?yevVMMIt|Kt~i(6wm)9!GeYgc9T3LV)SUpnr<- zpWPrO{x@1`@uNe#JaXQJ&coA$dfMesL;bF;>#3sCeN~~npl2SyNEqPfz-2KqSh!Su<)#FA=1;$lM)Pb}iH4MF_eyDz{|gD`s!CAL8U>!)GmDZk(LdRI)ROW2_s+$ytw2cHcGj{j+ze4?c4`BhvO7 z6a$_|jeZAb>CY?uJF7!?l&z>H0+i%;x`xuE*uD~|Osx8hDl`xLNXj~SnLJ&`g5Efv zX`sBnj8jJpg8J-wVXl96j`r`^G3s_iHq-Qy?H5@DUJVrbAgX(d9mxOYVE_g=wsh%1 zly$x~rT53r4_4`R#6Dea+k&kT5fS#l#3Kk?lu%W6i$&!#A%o1b{#5adUK`+YpP;XBOSb@r>3iQI zfHLiuJ8o54&qEV=?fiR^AJ1Yvpr;o*q2#Orel&nR_9w9RF(sEqUGoB)Kv-QJs_aMU z{tu?oK)I_FLvs^?j`%!xynUTG`ofhrC`nwS<_3oP#fHP0jN6M1dkp!?*D@Oy8XNwG zpU^vf?sXLVYK?lXhxa1%7pcMA?lJndCyei8AeuTmZ7>WB(UbG{v9`H7;!?aIP4%QW zFeKg#gj73;RbUrmB}u@|1ax>m8a@Yn(yxkX*Q@thC@Kkj69nAUzN*pj)f_M2o*XZR ziFexzBo|cQFNanZ;l3!EKi77dS~efN6=Q6wEMG8ki7d1D>D?5ODlDIx3^60RYKhDAfrw zP4Xj~n!K9R?I%^-g%s}hqJ#csB<0TNg)w)_yPs*aFVBs1D~LW;!DwA)%zik`?2Eps z;8)Kv2ZaJM^uAnuhkD1to4s{B6qAxfPybA7${;B0@i|lkg)+*182p84LSn;IhyeHB zVddpzhCt_t>>%b-x(lEn3v)NE3zz>CI0Io~vF)6OU+}n&UF0Lsg#pWwPv#%P9`^is0r;cT zFysizo>22DCr@~#Ou%@RAZP_vi))9n6?MKCs8#j>0cd{W|KaN`gR*Sfs8K)~B%}oC zPH7NCZn{GnDe3M|x{*#P5ka~nr3Iv=ySqa`q#M5T2H*X@-^|{7hT+HKj6Tg2289WzzW|>Qv$5MoPgJo#N@wz{Zau=xoV-LI^r;`EW)&kX>x#RUe&u0 z{NaPl)!wqf9q+3-3XO$d3@W)pK>EK|k=}r;VfU0x9|m}6cH3Ib7*g0CwfeK+%T77j z&t`+mGW|_v0C**u0|5XoHnzcFW#EKAj2Lo~iXuKVD7P2X5Ve2`WXf0QJgB&GW5VH? ztM@twuf`3%^5??M=O)fytmup^yi1LEB4G!F@9W)T#jlri7ux~0K`e+pEC!m$tt^HS zk4xZM$AxMckr9!7h1}taCay((?n6XCUOMhS&sf{uMv?nh2k0l>9|+hyga} z-RjDs&7RNtp|K5?R6%xW+y~+=&(6|5>0?#Ke^T z7Dq>)WH=l~q+P<{4B5!2eCy{o-TkXqRu?G8p&^anzC6>J0ZHLJ6B^T=Ew%R^K~UeE zw-jR>b0A_6OYJwFrRlcT0k)g!jp&}eDJ*glrcRkYEMO9;*<7m69{BA8CvOIN`Yy}2 z8^pDuC8<<*hC=P2m7YRfJuCpk6hkjGMBLN zMxD>Vn@vj5Hwbfd(^Haw_3ihNU~!3$5}1^47bCVeDnj&s0R~D`h*$e$f#>T$&K+ z`=b!MFS%sVpfQC1J}1%XreVSZrmKS4K=y5L0qMy0R5=wlpwEv(A`&_WS?n&4w?%5LZq3PxQ;j1>@y*H0<7vc^@X`p{b_jctIL72FO0#m>5Ru~=38vX({&t8W^U_aUgh!B+{oXrZ}`VYr_=e~ z$8Ip6FML~En4eKO$P7~MuXDd4OA+w$>u_aMbN$Hgc^lf{)_^%`>Lr_0l42{VTWOE% zz-*!IUsUzV=K!@o^@mtk?=aqn`{(D2%2!p?*Uaw5S7SQXe4jndFXr|Ed zyAO;P&`eSEkSTDUm*$B&sGI{vktB;&Wf{u+)!F{&SK$D9e*PK8y8(KbSlbBGf$WeF zTj&8?E&7wlK*=&?;gjvoD&s80H2;KoX71eajHSv3dR_HGN0e-*(V|cEC1mF zU^FKE2vmY-D0Ytc>;3ws^{De9zL$Wd-p7ur`Kdg3kc*(iq+){=dH)q2qBokzE5!}- z5exb0d_J)oeLgNygGftRtxcK4(^bp)HJ*Ef(KIg|3%ZKkEwcclX@&l39y z&Q*v+#Fw;@l#sLB>EM%m`;18%h}nSn2pD!Lw^M)|ql_0DLFh$&W`RJTBZHfz2)Pw1 z)OUJ*$iedV#3^k5If=H)^hoF3yh+5gA0&GCQ0*DDa9bBeBfUlmaY62UqeprZDKFK! zSwF;5NR2Te?>rBslGBj&rs*!^_+^PFhg;uLeDZ}EA}sRe)ij+vwNf~{DTuLKRShlp zHOE&8JKIakt0N6db9MPfSBeZCr{A0}0O0a&T9IKTS@AP>cFKO^$DVYp+2WV)MstgQ z4)0tXN&7QK`HY>vaX!0!6jw@B`UFSNtMdQ%F8nm^exe2J0RK?kUG9_u-#3|*&Tba0 z+QU%p1PD5;g_}^3MVx7BvF?w=L>6t+(skTY6;LY@@!Ar*Sxn^(lQ`;@8zL0zHEOY& zc_{WJv62DhV7RBJ-on!zi)+AfZ%^Pk7C8S=2y`my!B6q<#6j6#Jrm7BA_QY7TYq`T z0_|c#noco>p|w$XbKodsH0tH1DgyY%IRH}2W5T0;Lbc3ilj0JJVJAF}sb+5g4^5QM z<-Tei!Hwlh{+5B$0>lIQ^ZuLKJ4WNDN89`RlAxdK>g`ntr`g*Gz)aut`QfjS))ZqY zuYyOii=Q0MOiiG__IN+r!@v=8YqM2ye$h?6wf?aelLhK>z!NDf?{-2_{VrzEvnAPcG5aiW8gDK+B$yDk7W zU`vs~_u1FDcYn4<(UM>pJpdDav+t8AV4GL*&w*xbrrZdLMW=Si@+~6L04)r#NJWk$ z;+FY-UG;9PP>soQG&hpgcAjDqIQ$LAP>6CZgMAa}KDT^cm)m*OIwDiN8p12ptnSu+ zG>Wt;xpKIqq_!?hUqBx#+sgY26KL`pUe0vV-oMA{-Q~xiZLC5T>sZX=2__)&(jHaK zZ6SP=@3B0i+OIku{nN-o*iQAvzL*JN8oY5|Umke408XW(>2(HKh1td>?7QOvYIwIp z>K5Z6oyXKxzCQJ$?lu);3*ilszkckie*JM~xaGNKvJ&vOH29cWaq!qbarXWG=tePi z`#5ci*Oc$ApjXuCjYA+Q#7pLrm)G`uA>Q_0O^>ulz_UBCVY?q^qg9`kl>c7%I}Ib9 zEYjhNK7FQiw~zseCe8~dD3!jw_T*G&=OX zAXpP5;Y0jFg!e8qcav35>Po%b)1pwPK&OzA*t!kr@}>9Hm)i@v6e1qiw~pVvHW%U> z9M`)fToy_t<|F{_BNAG<0w?>!ZTmM>f!PXoLG+@2@8e!6Vbk!xjnS7Cx8#p|-V@ul+Y48jnQhxC|iPNg2- zRny1{tF{Y)&jNwm(GSDtcBb-L$|j}k5wz0Fd#Lmbq3!=H1r(HdF?uT9d3X=?^_!ImBM=6!!+m=;|@*BVnB6sjIj zwD;6~r=nIYoRN?CS@=`HI+Yg|7S;-~tRgE$5CPTt@r)HKSv;5|2Sc~OxI`c#O?V?! zq(g4c185ae^WVt*zo!@gZa@}ah<$&4lS}_K`Y1kw6?Kx*r}Q}ZMJVXTHfZ=8@YEo< zE$!6MGQnOHj?7CfV!<|L^7*GDikCGXmPKui+S;fBR38U+kh_z8;2|a6jJegNVTZ3l zSY|I%G(%;G(Q8^bUSEOxV{R&? zkii1BytI3iV5sU@P5#(3@qCY@>M%&$#MB|>=bHUYz=cs_)9~J2Oh|($=9aOKQe#i& z^%E&YS|(Vm@E*~`;)WN{Mn8+Q^}$67552D_jUOt?$IyyW;Gv>?qsPei!bi|%x}rmx z(i@L9ocC~3vG^-bVmn~d=d?`%&PqMN`S%uoF6P>uzYK>Fy9~a$?=3T~8d=o}N^)FfdVfEkpe& zNqR01dXuBhZIPd#&f9)H&!(y0(i;3L zdevglFKc@v$>TdU-g6ya5Vl^3zlc3;_PA@wI&O=8reZCdKrgZ06aQ6P>29Q?5lO{+ z;bBs0u)VJnYch>#1?WCw*Iu3tTdf^M46V3&RwG-&?S^;*pR_*`^E-+hwydC*yvBZ- z%%bMGke0^fF7`8C2J0{k|AYRE&JmjMk+*aMQgEnkF=%FMhKTrZfu9OiD3ItDpAGj= zP)-tQC=uSI$B1SlL^SYA*9_ccfo;z@S`*|F?5c5muIDfIBBms3_M31A;5P@P0pBU7 z&`v{2V_a+?;w-~4r^0z@aCL;c`>LZ4lCLqE|AN8h5Az%$zh$8_i+!rw5&ZDwW9{wp zZl}1Pa)g}91##j9!i_20g(I3qy$(9H&IzV{7Ye8V*n%nGM?(vFfrL*@0&(~-aeaMA zoNYH4rJ6moL#Z8HcYpK79&R2k6sttM$0}2e-B^lz?D4SiasI;Q6)5G%;B80V0hB~j zJ|CDTkJUMug`;kROE}8A=xKD~E<^Gn9A*uWRiOQRj>V@`4WKwJeEU-nk6H7zW$)_V z9?OkU8Uk<9bKOkfFEIjO++sbm-(v+()KbkGz$gWS>&M%bKvJLd9R~A0w7%a1V1(7ZK?*TjJH?Xc#v%NgslLcaq%JVPn;i-aNDTtV)*5mFO85v`h z7AoU{KtL+8Gg(SdvAI9*d7;-BNoD-akRvJLW+?!(Ym(QcTNAHDKhx=92)5T~2&H`jpryOV%n&D!6R=F9wRn+fdm`*pv6v2wBwV}nshhae>~Gy)EB`YEXNDrJOC z6F;GZJX*FSzgG7F@Ie;4@$qRU7>Q(up}P}#o5&jKZmIX?=R?ax%KHwzn~y< zgq7Op^X9TN-;bYLOCX!d_4>S_dQn^vSEu9Ik{KH->aH}9>Nhg@SdISNK2@BwBOG7m z4OpD$V?I)uz$&)o(iIH}2sC+e=FCyvINP#81T4 z@Wi4CO_?RJYN>o0vCD2hpG~`|eAia(%--X)dgAUqotXAhipQPMcpyF$?$+uRB>@?I z_nUr~j&efA*Yw34hMJNCO3!=PuNQ{+gGw(1>YRpiiY6mJbjh_My3moOYfL6LG)B}l z2wH1?CK@X?;BmQVN?_JY9uU`yO~ZTk?9eK~$1bwC_$JksAYFtkf#6@gZa)mseM#!&#CRYhAIlHz&K( zAA!JOe_hGT@}18#HN3%|SJ=Nxl1lR%#$jg|9`%WffcrrL&Sj`cmz zAaQ|pX;r-=pt{Sq94{=~tK!h9wWqL|IsU!zx}8;HHCe!o!=aZT7W>&VCNGTs(2c$e zqYMlmpI*Bu@d<+dH;Vowu>$Oqd=HUwh1esE9#o;kiu&Chi(6NpgO%aBKeD3%oaOUE z|Hx#>JsQrwFkbTl^!5S#eI zc>4iR@hfVa2 zc(d&f;L4&*|Bx+VrquUKNHMSpCns^E`LQN15A2We zbu?|Z|G*$M%;_UFzcLV(!iQ^mwzr;1>*W?Ly5=D%5} z7%P8mlcfepa~O}_CfMFO)xbO*FGgm9hAcqnA&;R_r2Wm6MQqalr712x>rhcfMy3Gy z@X%ZMrYr|0u!tO;lwJHu@n6`N8r@3)7Nm{`uw*mucdp$EH*G=3J-Dfk55UoEY6b#< zcvcmEk=Ys!%U;CJb{a%Uoghvgo+#4Jj^XhlUh~zByN@$wnomT#f{^Aia{!ltVW+o) zr1OyD8;jk%LB1`8nIW^S+rj`j%yfkp!A&|wl>%;J3BvE zCQ4dUe&Zz6(V;j|tGzG7CFe*qO? zsR#bH)=5ET(0Dw071P3i3^bJMRxowY35)LpycPzN^!o3$iJ4;BTX3i21Iaz}i{4Es z!#MtHxp0Xzes3L%TgkYd%3Z!hgZ0+D;GFls68%>osp64>;e6#d*_sHls5YV7?M7kn z+&NvC_iSUj!k0*{?*3GmwULCK%4lq0Im-8Pm{Oj91j;1Foe1Si@D)clEB^iRhQI~~h$Kc-ywPjBhM zIIea+{ykCrxv-K6*n%A3E9K?scBOSj&35ctea1P<%UVmE*Bi?PM$wfDO zq4PKtf!tE7JReWL%gC4=QNvD&>g)1^jCdF>w*05DHJxHD?gGac^JlcnOZrQR|6)V0 zEW9*`4d!w%0K7*;eScr&(ZVlW{N=Wsk-R1yTW|$a#i3Qn=Km`xqqWYg|yYg7JZcH>jQvX>5jERZxZ2zeX}$51LS%@wM*Ss< zVW^)!j{?I1Dr)}W08L30#Xbjxf84B1QYuSu_inIi{R_!1r_sgW{!O|RDSS}Bs7GB_ zxbrEEU81OYmlabNR@(4X;``bQ04OA}{h7c*=`Ds@p=P4vCVD)hVOa>d=dfczP6&I3 zud2)0=ZkhcG1u!-6P3bCg-f1!=BTF};F#aFr!F{}T6 zN!~oPFZym(t;mAMYl+xz0Op#MLzAA1@%e%*UFXdTQ2B|h#S=Gcg>_H)@74gDhxXv# znW9CHT!vi|`ZPvQTb7cTaP5Dfv3!{6A!ZfKY7L4PO zI#*=+ljkhy)icOXIj#o?MN==5&3|+S6^j|>;7E41T?be{0eBV8QJ;WIKWy5MOU&hRH4kw%zUTK0g;{Uiy!jz*m7Wn^8L`xxh@D9 z6~MqK$kykyaTqt3(KupZSkPyKfj^e`Dp3SC_BH%6z^ZZGXy0|sAO6Ciru@a4jUdrP zk#Hm=pGE$A4or40L2<$EXBy=oqx^wph@5ua>ePWsrR%ifh^H(iO4|4RW^ApCQPz=b zi4!a3EW|41VwzHG3Ic0Dv}Uiod3}iJR%-QBbV1ampI%E`#d#iczv`8_khcz|>jA8rwW!n8K7e$M}lZ?{NQO=!w{=9}I2 z$oP(OpQBP_0|MqI@l2Ci;ihhbq!I04>|t!Uu516#TS3vmCuvGSjyc_vyjg3rLkk^K zCvA|A;hZC3&fm(pbu^ie^)t}Iox<=jGD_>;#~e!2z-*6x5<$%-sGqvJg59|i)|YWK&!Bej?6!3<xv{#0Y!yeN`$vb@W|5A(p;|XxCM>~(UxkA zBS>2I`LnFU;@3~S)VbOusJC8ta8aMzvFKErJ!gL-Nu?( zZl9w$EYf~7nA#|GS7YUa`e-4qyzL4~S6o{eUUennGp(l2r#y{Eo`$?)27foz$hn{6@Sd#AYG}43nd{?0~`q zEG@Jfxl2N0S({|PD^U$Kd?Lzf$9j3S_U6)Mwj|!!&4)3O>C54JE9+?#G~NHutw&Hx z*4&72s2HXn_5FWg74W@9uh=%mGh zli*!ju|{p&2P&kutWFz!86+?DUd_FJ60M%#aNhZD3s`mngGHL&+&&Zxj9frJ)5dKf zbm|$G0LB&6m1*kZhJpAU#x)cV_iI)MUkVq57DV_=R!HtA63p3VP8}#u8}Qy4{h|Pr z6&p6K!~N>V+Q|b*)LZzgv(P5{@k&zvo#gDTUForr=qy$pjPXBGau^|GGFfo*WxeZ# zR=p*OfV7^P*z>Zf^Bsj5(t{u3h>oybiF-ekNfthH{u#@_OJG$|PBAoRH?;Mhk)ZaqritCEkU3KHYgnT`9*W?u33m3OM^2~!u>2Hup;mL*W05=)`bK`Z^)z(r6t`vNfg zzM?RIvg!E#6Gz5TiO~xPi{K2q^QhXfJ27&L)QTiPrjNh1r@;vj(QdLybY!pUi0V@6 zUdJaRQ*87&%iY>a%0WrMps{%ue_1gp@V;lfIo`>Xz2jtuwf6-h2{YwVAzP>5BN?y1 z4d8DYx;)ttm&>lp1!nIrD@ODIvk}-Yav88{sdl^`jS6~HtWin|_#UEaC-DJDm?MBo z6?mvNWBXw-Ka}w3KU{!Zwqy2hlZm{GmX6BRC;KXoxf)7CiX!R&5qY%~XWID-v`90H@=FM}6ro9a}nd4V`r z$!v}=7Z;6|!TnaAKXxVg->smJyWQzpo*LY!mOS2*ii=AdUGjdbeCz3!z4(1TDrC_D zU;(n+>HDj*)wjt}UtWm&r1LADSZZWN6HR{H=)#=r_cJ9kcvLUVVu&7qfC#y1;LB+Y zTi#4X(@4nIDYs@!0&wZs0BH7}h^ySBt=@UBy94TvSYd-WJUO%R)3F*fJXaRGdS}qG zX1}_^7%rXlmZgL5PUA)!FHnoLR4qy^c@-i2Eo)6g)m^^JtGw9=l#~Tp<=MJBgH&|p zd!07z<8o`OVAiR8l>3-k+bDp^_uHGZB4?KF;Pg^fZX4yKLNzz0aVL5=rlbclO2OMh zj_pBKoGQ!VkBvB8gGMHR1;a5J&zG}l8qgs?n7?pwNjN4!1kiAQ)Y*9 z?eXr@R1zzwPnw9JZ3yCvmP5xt+8))&dHl&MikL6^9o{t^ z*oIk%QNps`{qudEj>@N8+d5cvwGf0Hacg7*&fb;PhSVh!?Xm*oisSFmMTB4hW3Hy5QDiaSV(Q{(9!flw zGL(45SVgqJ9 z4IJP6{$I*L0bu#$(EiW6=gb27uu6bXxjp}Wk)}i>W8FSaXMIl7wT(qr44@LA0-?8C zIJSGKdDuZoRwCed@>@+-W%MRZyHgd2O{WIb5rK`Edux%`^ugDZzN4JGJ+{ z{`3g|hR0=M{ra=O>6o5}n-<2P{MSUWHUlN4NIBU>I|wlRU`^{EVo=;D z$paoSiX!Iv8bSVM7wc86O#?xrQD$o)^vPl1+$om641eU8XOg^-ZL;LdOq#+%0=Z)t zXt##IbS)>0O{TENm+-z|fw{lol2C5kTiO3KWZp-ff0tUEH{^cD*;opE3a#J{v-5*Hvb3 z3Dz1GDwnAXP`Q7>W!2LuoM;t+Y;YO0!mDMH8Fk~cXvKqZsszARlse!fO8yDxCa0W? zfua&Hum~_AU+s|6>^;dt?kjR3q4)4aE-W(Rg8g|vYO%18eVb+Bu63Y-CAZgzKo#(I zTvl2i1$unsOM3Trhw2f497>-(php$g;M)zwJm2Fchbbr6KHdo-J+DAAvb%AzA}EP( zPC%<91uXL{V5O;~um4r8WS(KN^6R(aT^u4J8E_Od5D4U>M{|yF-3(?p%ve+?4xKXK zA&sTX_Sphz!7(6h7ab1n>1!q%NQ<@YnL;OG&;q0CL9+kAmF%%(Qx`=zaRVRBX$O7n=;EM^5aii#@!{yW zTn@v3nlN_1k^S{do~)DiKW$elmr0>5%fpWjkmLcaCOI_LnLI!)(uvXG;aMfRKa}O< zB6KM~z_dS49%aegXioa_*Y6Zi7gX9|z>2mUzeh+j0w`APuz%u<3L;;){Kj?IA+?eK zB<%w0>538VW`E2QYcP6|-Sq$`rS4_6b>ZRbWMY7ZrZX0WipTgG=wBG9sRKDo`{)l= zTlV7K?JpG9o1k9lE8&NqR+wolrmOawL8;jzCu|_qR%zl+J9z6@Q2X3ohiw?e?O@%j zW!ha%Nj`x>X)B<)f`V>)uEpaL8Byt>Jbw}I>%&6^z?ejTRMU6n#G1taeR3h82X$UC zzznOeD0jhZ-@w?`3JV)s7;G;n)4m0fKKuQGnhRl#~42XA_c2L)q=RP#+U1s7y|%o$g#wAe>O+E z{(Vqz)WxEwyg zhQ3~Ls8*A=IW!TB72+^1z!Zh#i3?OI0bmx@dS?qj5)KzNWUJ0+LJ_K67YoK937mE; z3N0&R160?_aXgwp0=hW(7nwF9a|{}?azOK>cyo1D!_{y5bMusg%=?v0;ib*}RJbwK}e)u-I;2FpIMbpt){%{>ozJ4f)9)7Rif3-)bupy2cJfBctL*&cq zzm59b-6WmcPYh@2HM$?SAdyLp3lqQ6k%q}UZLWdty>}Td(qJvp^3I>{1-TPj0}hMt z_#FTX>>GXVnpBrJ!Twxjj(J+Ab2cAP#jApq51-F#az+<@?sN<5m%CcjRJ1D1DXKmW z8v>IHC7|J`vNus7YiVgwMq?x+Bl}$PX!DZ%p{y4?MTcI*T2j9~G}h5SYL~@W8}99~ z*w8?{6)f}z?o+`{HZOxmS*f?b2=zlOfB2n(4J~qQm5_zFW}mnK1%T48{x8K~+qDeX zX+4JEpD7-$4DuS3t&dTJza#?}16pJyFu@NzOPrnlYj6Mr6G1jr99>ZA;wR4FhK2^* zIsl2_!Cu&n06B;`0KRZZNLUO_$93?%|8gIn&e}08K#K4yW7)&a!GJ`}YOV-g9JcN%O30d?FQZpZHZwEp3wEpP4Vd_J<=Ryc~^!8S;j>K+-M~<0e*wP*$9uO;~7g?T`$o@NnMvNFxG5881r-syu z7X3<_kYo$__eOK!1-EpP3u~&czjfpaH}n1P3G_dlK*T6A6iBl;QQX;X4GMRrIHY{# zjw|VQ2(Pjr(4yLS`D3iszzY@Gz9|5xR;+K|I9wn=Wp@CR$=aDb8AeLMgw2!tL`lLi zV+5#2ftbeNx)<{C*p80^awnrwCOiT>eD+~_YAUntOHXrBpx8N?0dDSjU~`4`H~M9T zIxYW8z>4O#UxJYb%N9peKi@S0D(D#4nSFS0P=2AM#nRjw4R$VDINoUC;P?!Hab3nI zEa=9pOfWan#(4t%Onzn%s<8u-pwSD%;bAa2G6%_fgxh>?>C_lhL*FMJ@4Co692kim zwFqDq+7rV0e7gwtejM%m$ukD|{%C;AM-4KdDDRGkNc6t}jF%iruOP;lM-$TAD*ye< zrSg2%#Iz=%gWSvGeHIaSA>a6^D9noLY|f7U-R+f~R++xv^FVSwr;T_q27oEl@NsH9 z@g?SS3F=rYZGk1C9S&t$w-6SkvS-b3muCz%PGAs z)|1-(1#$xJo^e=DvE__L4y>Nky2Ns#gnW~kdK@W!KmBe)gJ%G(`isEk>YyZxK}N3z z^d&49O#pBJ>VC3NcOl>Qk;AE7&2FnyEYW}O&elUI61t@Y)4CE}^6FAX4dNR3&RQ0a zF+OWWJX~sA@O)E;(0I9~m!9J=jw?^CcVq0V=uiEEfSWxCApPom@?Sk;8o&$y1Pm%9 zGWdaH_O>nUO|8y#5Fi1A2|xqcn%Dz#I^auFUKoz$)jmZg_-jZ^$I!zKDbuci_~dgt$?Znd>i+Jyn7{O z5~c#kj)v&`xN!zX%Sn_j(J_=B^mO@@F*IycCtBC|CIf$pdq^ezH#-bSLZfEgt}_b^ zA-Cxhn}v!mVfZX^RIP|g<%YSKxauW(vYe(LWa}_6pGnCRaodOK2Env5RChB3$Vo}X zU>wwrw1Q%qI8GG0Mo0!OEiH{ldocl?+_P&I?5-$! zr%WQVG}P1K$37_d*gv=v_&hbVovkjWrX3n}y*w^BZZwRPY9YP&yJ-)|W4O4u+1rjF zo-MZpJ71mJtf2Nl5Ks(R8PN2oaCtE)5=diO{5Jr@AU~zJ|E7fIQH9X` zF?{a&DjjYZ3s!=249b@4Ak5lQbNCYbkHEge{TQqEBoIDGF!bsigA@P*6UcqP&p+7# z${?@fVM!isOt_e1^D5Uz=}efQ+mTdz`PBARn+-YO{F^u~Rz2~3AzETVQD&b3*7~G) z(t_zRQ`Px$7!Gsg${>IEqgsv+>gi5VC!o@wq}H?gVn3S%ngAJpBr7B|uJa!SpvhxM z2-AG=D>Dq_^n84wuGJM80p`w?!N6i94e^7cqfz5epe2B+9@Q>-l33GK#R2(WHsMvo z@xMIfwNH}?4LPsiFf(z?6*j4G@92k5;zaK+%aSSlOeB-2o$6!f@84pd|Mxrdy)OwX zota=PE*-4G!fumVHx;sK7~@qMRv#fg&U@u?XP=_Z20)PoExECn=6_H*kvrGEB~U20 zBV|-S#q!P0EnJ^Hn@}y#Kac`m(sH(S_;6Te-D(&uLm*;rzEg77~)UFF@?;aeV=IEcSM?gj0?FZQ@3- zBEgJn0E@=mRIPVTOfeNLh{MRgHAffVV!#q4rO!Mz)^H2pi_vlW3M!>SJ_qqfg2aQM zg0>`cYy;)H(ogT3Ezq^K-Zoty%36-)$4b8h2qTPNkp?iROs}?{rtBNlfBoZ~%}OCZ zEG%r8m%VH{2)QHv2xz#o*S;G-|FsXN(>M>Ef(1(I{QKx8GVdq) z58YpCj8F%nTYksa6@{mKB8bp$>)+3i|NSl5*;ac3BPu;F9OY-o?LAPvspjx)ut53UTKuwB z**E2pM$_{YE(;N$mzh|3B7M+eh)_aK!Ox5$1e%IRKS0Mj((Lz0Tq(D29~l0r%8TqR zRkHybW@Rgd#8cHOBZLpkX((uD9~o2f39m`GTz;$e#8L$lIe}ppb%{UJ_FCYicwl=p3=F%R)Kw}7Ko{^t# zDK`G}==~%j@$G*@F44WukFA9+=#AWe9e-MOKAv)5FdaT+{UG*pcOp3I#zo}P%KX>6 zv3e6HRAe??+PABX*p6UD0oHT5i4fl$(N`DCBxJP;pE$&;=v%Nj!etoMzvU|-md=6l zradL>nVj)lt%GW=9HBhn+a}LX?q`2kc0U%8pg-e@5D*ZEn5kDOLH9*K*AX`aL9~^5 z`m5W~##mEhEjh=Y;Y8($0X9N7IWdLdYY!5~TV{dP+5mrl)pFjaZ#??7n3l>JT@yM> zj&BN|!1j$i^v&=|n9!K;BC$F5O_KTDATRMVcy*-v_y1Z>zc1?d+Pcj(VVEIZ@F6inVY{XeAAf1xQvJ}iH(KrTjnJq0(WyfsyISc1*ZGEl{-I1U~{;U`aHW{8FixfeC92k zVd1cRfA&ZB_fSSa*&v{IN{>J1Fz(VHoA}~r0%OTn!GgwGTNRz2p8i)bn_Hg(6|G@R zy`n53rdQbz)GJw4R+CyOrpITE?kAZb*A-UCTNy`U1>W0_ADDZaObB(LcG(JQZe5_;>RH4*euA;`@Kvx0f4#%BQ;G8Y)O_Ep{=-n3A1dBp z89-93J2!Hj60#i0_oJP?+EOC+nr_4tm(a@$!|NGts2k-vD9XV>7OKofc`Jhw0uq$B z#y3sjB8^h@dbvWkL`IQ(M;WmaY8V5=#M4e(Iu>!bL+&wDZr7i6CczA_AwSmZ%?3#e z5JFSf^_yV|^&0DmRI+%$AmXFe;{w7t{|`3(dqqS)H>?4e5K5@?(_44S#ooS*It?(j zv8%aFo8eM`azI&3ERfNMSk?~?L3NtHbqnB+(ACJxITSG15*u8I55`0N)%U$N0UcY# zu%JwcqT>N`EFfWn`@-rs(I%_(NvkfE7gh}8zDIw!8ea+T&0O$ZYGDG!iO9I`BF=rr zt3BD1$ggxyR(oqc)MWz4esQi@cot$|m`num$>Z46RJmv}2)@F=?CfVxFR%WYH%|z= z0G*8FmDgoFfJ5_slTRp%BQJ~HaoTgkhG=C7fyfDMUQ=o|0VT5ii{pADFpCKPYci0a zyD^xq=;!CxTAhm?7Z;cPn;DpFv^v;rkRiv?I!jE#IyEs6y^1Xx4GQ6q_kFcmf{HPs#yhhnAIVhtqb)phy2?Er z&8pT7iA#k1iDN<&0@SOlq8>iWqSC3~{G9K-3U4B28P%;ADHtwv>`(IO6w{D>jNecj z7hHbKSE(9TIKI4LOo43V(f#w0xqpHo0zZgPoj64C=hxD&SdXFCxR$~1pC#5Dmq#`* zp?kQ);I}@o1ObRBt_u~+#Zj}J#HxVf?hBWlg-Kcs{{n8CiewbeZS1%jPH zI?2m-+0lZRUEjX^SSzfK#As7dmKJw)3X$4tI@GGhBKp+ZLIjKa_6O+m)dRY+rDW`~f03to1GsawNfoO3n7~VxQ;5p|p)Yz^4LjA_*H@4@4|=GbJKgC!cF% zm2&~@i4{CKbdHO0Qe_LlI zo&MgvxcF9HYukFPvn5J1P!os?jxH36v&qBuReh)oCj*Vv8LOxvz^=+4N5NXGIi-zPRs;s%QMO*q zNLRp!1aBY(Q?RZgXaZ^4vgpxPop=j?6mn1>S$2W~slc!!%u;T28u;KO0z--Xp2>d{ zC48HC@Vr{h#=td+e+&~9wW3RT8{Vo(+x4;86JIW?i3qT2>?>|$rW?R!GXaXnnDY5u zTpT{z#BTJ+;Fq|iXktDQ(90@waE}w?XO_XV4-P6$;Uiu?d<-GCXE@k^R8Y$b8zMCK zem@rAHomLK4Wra#+s5uHfE-WdT98aPn3HaYD7_0*8L58fRxwS$BU}@4q5YwW%47F5`lI35J=T*(6<1F856`?oRH!UnF(YMS4Gft zOM`a3yt1mmJ3To$`S3kJtthmsZ1P;OibF>4|AE0&Oi zf4TjBN|G9P9}rOZbzmwSPqb3lIa5VmR_6?4Y-5U#pbDA(nGwEuw=dVd{W-;@;Oy!o zkOvzMi$W)PR|sx`*wb;!(|!(!U7V2|EaAzs4dX5U!vz4}Z7vYb6y;)rkr5aes@d4} z41vQ*Et+YV0@8%~u`Ef{{>;58FMhdZxy@;Yfgk=ksu z5U*ILPB{S+KdSL;!K2XHAlv8P>H0vhDWIndJ=^;ev{w9T*eEb&DCIEA8i@CQo$Wu* zA8@u$@bKj2KYK~Q!roRI%*$;1tWy=ktfeEJZKo$AF{m7x^eS9bAfejO!;_2DvQ7KJ z+b%ZA>vXrJwAclH$D#%{Q4F@sjk?cEVOsHspz%gFk-3}}J>`W1B}kM#jAWe=<6%gZ zC52yI3_(Gp{49BE%UrGGV(1D?WpKRF(wT_A0Y8AIyIT*nor>5ky&s}b!hZ&sRTP>Q zs-fjTeTZrny^Hvxz!*V#B@>;HBl*PP^4Nk%z_o0ekJ%bHeWC{i1}1;`Rh$QE7fCS9 z(IBbW;uU4# z1=0ieFx5yAo96#MQ^~J7d-|4yryut4ea-&27)g52MXX>D_}bf}5wPZTEP5*fHC6@# zj-*POKnnwV9-gmxc{m7P!q|el!oHZR=U9Ki?7P~%4&1uoANx(RfSDURQ)~Z{KqUZ^ z0RV@xc?w@L0q&TOPx18HYW{;TX-yHT(2HMC%Ps)qWV`Q!E|>)+1lSGXUI6El3}>6& z`5zj?o<<*QMcTp4u>039$*$m{P0-fdm-JX4D?hqH>MFuO0bfRT`y6ba;$+b*6Pi-D zZ60UUj4-s_ovn%1^!@5=FPi|eSMrx8kjtc#jr;Y>rRyBGwfh+k2!ZbcSi@PRwitAA zxc;$8v9Y0n`MHHW8h*eLbbJZgMqCZJl|e}OT@>jnOLjpOoOskgRaO|$;0N7B`|@lM z4D>n*v4fC^o7E}?J;&E_OZ_Qz+uyNQT0J|^^eLgo{_n@P_kJ$(+)Wo*i1bxh7VD3* zjIJ(OWrUc-be=rmJ1#4N6#x_Hqxa1mTb}1|t9&&s9fEnC8w#;Xor|cKTv*TpW}4y) zdV0X;NjQy^v|yp6^O3U^^2?vaRV+v&Px6&>P`>~=_KNl{^Gw->{QHY~062fY{5w0Q zP+xIRMnA`zoblQkEBN?-*n8`!D73v{ct}A&Nht|20BPx*QAAKgL?xspM5IKd8A3#m zwg3SE0j0YeMM6TFp;3^|p>yWlGf3R?c+Y*m`>pjo-yi3!bIzJIz~1}UxqrLk)#nba z4Q-DR5HMpLi4-V5NF<$+!9T&29>qn%e;;U0;A6x-xYab?e71n%-YL(I=T8z=VLBZ^ zqxB@nPN=0d@jTEtc|U!JB%|6u@a1PzcSg|(QA|j2K1f3n%){W$d-hWO@`Z6h0Rfd> z!4txFB{7q7Km*;anfrbD7HSy{2oiN3PObdZt12hlRyA_t74YVs~`O}KhLLn>c^^#_NXxcO|y_a9VOtrYQDI#qB`2#X;TJfIdyc&`>EtU zP)}dTY3INU;kkhlcGWK}m#9Ba=M;KD8Mk|GOBfg$CV^z08c8MTbZ44Y zC}^iRr|L2M`AfE8ZD3L_pP_iBTltkYM_<2rTq*TeR|N)Yo1jee+a=uI9IF+3!T!r4Z?s`!Q6n?>`0m^dU^$DncJ>4v)4c+Cw`LQ+E-~XP$5L~SQ7oU z-pd1+@~=CtmM8~JSl7gAP+GN9}HPp08aalDSTh``iryd6_Zn@Y|z76ka1U1@dt=u zZG>hIa10ZPVhNh-Rdqx3K{1UaeBmA+?(a^W9y4*JE|tfLX0w+9Pq_OqUjswrZh=CS zS6f&1<7X{ja9uAqSKZ6uJ`62ri+_0WL!`5)`ktC6&q(Q^a2RL;g!Z{OQ@9@kkk(ifP% z1GgoHZD+(^_60BKawR>DJ;STs{Fdv@{qWJ7PBdhuXHnVHHTnXbyP<|k0R3}}Hyr~Sjyxs| z7|HR0_`fE1$Z@jVG{19|{l$rUyM3;^8g}9>*4Gjjdk--hOK0k^TKoPcvOMW-s8fZW z@`Gqr2*nq#ZxU=6YelIZ{OCDyG*s^vaCyy{lS_zTbiXiH?L0kBD|n^2uzu-IA8jSqO#CC$XQP?V?hSxU`QODm-_$ zTP{ad69f3(zpH1kSE;pcfXAM2FW|Fk-h6gko}v&;90gP7%y(ZizvKXM~tziONlVwYS9yZ8UGOm8@fMnqClN1*iHX4rC2YOr@RGU5 z`SN|Vj%^sB%Pp%5;b81&jC6tbw&jw4WagXMV)!_pQ?=z|Zfr zWfmnpz3FVogZs^h$uI#!4loh5j@_>v^A@v_VOXOXFSy>jy}kWxW^H~*nd;ni^6ab? zBg+?U#kOVgx!stF^tQ%HsT-1M3u!;Igw>wohf5 zmv=?cj_`dSH(!VoznhiS=M;IR^ zPAhLy%&cN~6gva>5hpIa)PD??8isNFV(_i}FiQy&37?qup;^s{MF@(Bp|2&^ng zUfxf&OW>}~S6+|3ok%1|(TAvpvvT73kaBMY+G)JLWeeGeLXQ9q@)_M8TyCv?JAiv}Y;wL1wu3 z&h=iT@Ru(!fQ7UMimxsGKt-2HdbFn`&l94e-=&`MIK%yll{h=uomDkhj+}$z=u<_V z^S(USlDZ3UJCB}#xAtn9%B66}T2!lD_S4McNSw(pWix*L^qhOPEYaP%YZn@}itI1k zqkJW~)+p5+X>z~3{nOR^-)%zX#g!$-8-r|A!{k_v@z@}*jD3Z!xkEheQ4~((_KkdS z4mqZ%#c&Gd4oe{_eH6qq(!n>!$TZTY^-*yX5CaDnpNO25zaIbAcfFM7ypUIp_lVq$ zqTE$_x8s6j7(j?>MJ;-c8m;OQC!@R7iwJ>o4_Xuq7&Pz{nBU2hO*YBI3C{U0!R5>H z2Q{G zwR2qIDH9tOS$KaVj7hKPv9Z)bCEn=P&*YT!hYDiJG-$FJ8;+;4_Cs*{jd@gn=%5&R z^Zg3lXEMH(2+-N4JxJ7^Dtuw$nA1Hqk2hpK5QVO!HZg#RaNb87MQb(h5zwAxJ0TcA zq8howH;=xr&ZtjCL0jft)>C-9_yX9}^?0*{NRB${{_A}$IpmuZj$zEkaLqH|FIK-+ zmZ2v(!R?a}<&<1{H)blX5P9!=q__aM@6zowoz^hqSLw}yZ<*ND*+~QL)!1QPX3SG- z^P<(IlbkCwOv?`7xFf}!7&gzwf$TO6l0*8u1pHbJZdY}w4}nMO3_+{ZX!v<%x7_v{l5)tpcR$NjJ`pKU-}h2M>T(QH!RNi%mO&$F z?xIY8;^@=`=715s zEHG!FEk~EQE?Th;KNDahhRDu$BDf{Oip#1-25@<$qEc1QmDRFv`$H@A=IJvq{p%z% z=;utsN^V(wVIuqvSoXw_;wOcIxLexPOGw>9BjUam1s3I*8{fZw7XuZsxb@F7pJeiT z?ne}^5BnK{AqIvw*)8g-kKb*UT55Ed_~3C|ngqcHxwT!{c?3&Cx)->djN~}MFU6`h zuY>iUcxbsUXt>O8J5KT~9|ha`Lp+Aunr~SDVwn}fbxQWb$O$+I4sP5<*3s>}ho!iz z@6wAn01uHDZ5mzzFMT8eU?L6|iBvdGaLYRsbrca0e$z1r2ECobFZ|)5T<52%qXf@_E{7#Wv1>DFGh72 z&@>6ZO*w$+v7_3kBm%`feF?->iS3Ehk54+cde;%oUACAt#mHB)~s}+$p;!exSMwaLV^sR}8=# zxaw}B1=c&p$3-em@c?qhc;IG;-M1^9+u`%&6s!@=R8s}N_ggC_@&!LeX{x3`6yQsr z-cUnKkEUGX!dJ`CWip9!yf3xfA{)Ui4BuQXoQU-^0IfSGx$p^(wk^9&CM85MSUFTN zI$)vjpx_D4#-V`Fx86=$0szrvSMm(GahI=cILfBW6M%0X%=fR@0b< z4SW2w^VmI2JMVVz0Vd0Zr-E=Y)kul86sORtfxPw}~JG=Mb7 z3{C^*F2Xc*u!gs7DksSeLtj^q+A*G>l!`@IV~K6+f@r!NILYO&ipP7;>29Ik85t{Ukr4Y^uaw!WYk)zNu~N+1sa9S3W9U@_UW)ou!dlTs%3Fk zdxb>bU^)XNNW>%BWu?G+K$N+$tNb}JIb8&91$vOS`Xzf4Q-r7JL+l@c<9bk>!Z5Wk zE8wSg9*j5%DeIHtVoYTuP#1XR*&H@NWsqsy*fn(gl=xU>efr*&m6t%MHtdZb~L8*-hVje11{&V=c{Px#2>OyH*glqs_S&4sZO8hJ77<_he0Jt)6z?M`%=XjDA z4*PNqw<+?axq$g-?IVhMo43sKI@LTMd{)Gg0ya$?Zw|wUXa{%;k17sE957lFW>$6AVT_F#^d zL+18vhSX}e;fONomolZ9dL&j|eW_UNl8Ly@h2!S z3O79ht!J$pqh~0ORM>h`NZ<~f+Y=i)Kdf?;!6?U|-^_E_0~o=t^3cszkn(XIVs8KUhUj$(P$(UJvURNJKbO?ENvsBN7YE4mISPxF5x-T~^uK^rj+~Y&-R>*Jd=z7bBjV(> zgJrK^Ek&n3U^YI2-^}*=ryiQS;-VRU6r*<8JELY%ZtRonTIq1yS_`h4oa+k z>|j&H2o^r!sYeaRnf<2uoW)K+!Nm5ARZ8HK#a5=iPpC1w5y{9W>C*SI8xG&+aaKTi zj6J%96Rg?a#B~PJCZ&b(8g^F~y0NPX#q5Q#XkH=+;dRI_CHqx@9-)u|((~9uc1VO> zcWF*sz;UWjMdnu3>3!*$#-dpbBR#MFmXY;+aF;CaQj5AQeQ@{@cvd#`TLUrq17VN% zYwsvB#I0}4toqWYbqVi)nCCZ2TBxzk`Y|GRA!Da0_4ANhL)Wfi7#DMJ50_oua9N5s z2H*M1c|?@2DD*$-@yr^2muCpBrC-;-L+l^jO(9?EY*{*{V{@gmko5UJwku)SgWD3j zlb#v)l>yu#dX1HRt|Z$vNJ7uF&tkpkWu9D7%+}EikmK zIp%!b;-lpx$$=Q&+x2^cA$6J85o3(Mwb>qMiD$9eBS|h9>*5Jr{4vLPA|%Mm@t0_` z&<8v45N->phmM|%pswwgneL?)i*S`PiGB4<h@>!UEBCce)QHnz+GRLq2QLdk;>L`71b_%QqC9DBfR>bJye=q1QMjpl_ zh_5{AGQ31>Mkbw93N+o82}#y1#5p7GBPI#ucO3WV1srfS3=bZ~tVsFy_#l1l&RWNR z(d;>pc)|P#>I|oLk`Yz*MqlFB5)S)<2z0$NcEuZD#cWDUWD&lroB_%Hf??7e%!;07 zft3;-Jf8xBJO^`SPd?f{CSW_}fKjP?qF{aryW&l-;^N=0Xhcbl{|!H*M}VE*(#83t zgNyY@?MzrvRlI)*`5fZ={E--m!T!t7e*y&!~ z`zi4Iu+i4f2wIH8=MEde$G^y6lJqHyeWA@W{{^0M_bEI0sDGBI!|4N7Wk)nCW@UruKs7hG)ezlHq0hUekEiGR@&-SZTfBLd_^sflK3L9sko z!_MWKT2?bfU$u<4731xKD1H|*v;95XD>+VJux$Vm1*Hmqzr$&TAA@KoiMisrB#g-e zu7?T!incnj&<*{eD!)FNe813>rM4sIRjKyn3-O787Z_l|Q` zH!k7?j}<1r-TQG&)-LjEdQ$>0-)SnxtfOr!00iruwj{%I(a=sOrjFCNveezS74*pL z)A?L(N|F5nUwcb;J+ECo?13f36eWaSq4=8~EyVOf=G4BbVqn{KlZcA0VT4To8IhEX zo1Ek6IvoVBkDPKU!>O_^CERA(F#e>|tK!21qX8@>Gonlf{tOOo6$eIwI(cw{??vV+ z3I7K~8RMF%*;i+z^H~x&o_DorXpb|0@?0>S;Qp+XFnAXcdTdDKeq)qSxc5WzeX+sU z#A>F8?mlbAW(WWnxce> z-zNT;Y{fnni2NC_5^<5l-AI=b?7|Migp`2c0p9a=UG+Q#Yz*ijz?wPy?t9@D;L`|n z0ms!0;e4o{ z;UFJv_0-$cw+((Tyto~Q%iPR2%Q13dJQqMy&B zYe$DrmW>f^dfZz1Ql0lJ7b^;e%B>f_&A(8eDVTRRj?jTY;(NYK?W^<$&vueL&WNd-FHos7jo+vRA#$1 z=s3xw7p)7gGZ9dC8lN;z@1s+e8mo{=Df)nK0)T5gy8LAAYpEV@;FfFAnX#eGCsG?f zdG%2*XSENu8-9<{s*aRS0RI*II=}%?Wmt!V z;c){2Y!$lTlU*@{o--CO>spnKN>}O>wHkz54_{5VOhH&Q#tx->%qW`#!|LsStE($D zC>?$c8Y34nLaR?#XE-((e4b}OcmK-zB~Do*Vf|Qsrg*3^tOTK!H3G&(^h+nmX*u^P zOccu;B#Bsqv9hgd+dv4jEZXS3{7Q*-p2Xc;duU8%DEJB$2m-HG0#|E~kP%o^oaqxX z4a0m_6I|IIl7+UcaXXd|!<>wpOkUIU*(!f19^~H8GZ&l)gy}Nm#2wI0>51P?g*5jy$rWbm^a4cMb%+?i`;m+@gW@ZqYff`g88 zj?)bV^>Ml)q7a##8Q5m^Ul{6$`^2K-lj z`*?#P2N*d;2?BLScpe3 z(b)OFx1{)*SMx;a4^%rmTTCndjYJ)=b`5mRUt{h)|d5VRw?71}_gNUNn zhJL0aTK6q&pY5R!sD_uj>5^CqkiV;cQ;36cK=v6K7Nd@hcMLkQi1KJXow@K+b?3_| zISwPajkRhLwV zWgSZE9YXTW-E^WFPVnZK66Yjg@Tbh=eZ3I#dDkWpj->3%(7yHu+@QjP@gN8U*l<~8 z-(3}TCzWe9JFv~mN3mI}RE7hqdT=VD4qB|gtqO@Rcf5VA7$=@H_540`4>GYL6aRTV z`H*z)Z>@ia1Oxg-P?^&`_qSGmUmNXx_?-(70Y@H@LH>+4otIiGT^W_eJ@?|qy@P{B z?Aj}h%ZE;UfVF?kgg?PkxUHeOpMYx7-%T@lB30%0Pkiv9G7;ThG)19|_AwHRs)t=Oo5j*0mXI_58D_Q0m=eYu?>MrgdC2NQ1wA1~!Gb|BQz zHPKcN;$#!ALyU+VboY_RZ@$ZM_aaV^{Sk`C_+1LE<41k10_=h6rd7~z02HGvq(e|ru5eK~rd!JsR3_K376{9+Jl zr7^-@FVdlnQ^0oWP2p++^yHI)CYKM4u<)c5%e|#MuI%Q<7(S*m?|rwwH~3KV6uZ3q zDx@xnMNHbVWaqosOs4Gcj@x!rH+)U!h_KtZ>(u;kJ&R6Rc@!8rSuUr8Y_fv0 zk2O{Bh4AUMW)^W;q8x^{ZanN+kQcZK{9mO4-+eNLbL>Vm!17*XGQ8vQs zA)uU5+;f#K7@~k161z{Io?UOh=hM}y{qGKa@P}c2@1K~=j?4eY+2XL- zckRqI%yG|O04F86_P2r4?yv7-k%*iFE9P|=G3WRP&_5{=*#B#N_76oVAbUC1e^~b) z8IAv4pZZ4`{iAh*e-{<^eS*CY|7cxY{J#`P4>>4UHTv6K{>QxhV_tCa{})|AP^zgz z9btZHtZ4xM(1$y0a=3D`c2SX)lWYYZuP{5F@qSB5@AL($LfVZT<4lng7=vZ^qX+!D^ba zxU6YHjGLGCfXx)gqT0t6+fwmAK;6XV$nroTO4RDwRh<7Oe}idedH3H1(~1Nzk+}&T zQ9Ui!hyCm_{co`OlusQIw~|0%HY9uhxJA3+S<(HgCHvnU`rv;V8=fIC;TinDidrx% z3$y99$5S|MIa9cXtTmYTYYvLbk6?nz%r1L`TW%rp*vh|sWp_lN_0AbO%OurK|pe}w28@?vtBopm#ari?Q zHXHsSpa@7-^j1Wn#pLihQc~GBPPbHj6;q{zAAPb%a?k*{oBtwAWc$O(h{!dtv9OoO zCtOy&!Z~*9u@z{*PJTE=L8P^vBKJ9*;E*uF_xneqgYBke#s3@(m1E#kO*1?PS!~xE zVybmnYHN#CwM27lg8pE)R<8Y`b+9saomW;-xu8S%FmPDxRn}2q(nJgciO1cga-3AP zotBiWH&>uMOsIJr@2`4gsP&L{*5GXKjxz1{q9l@I3qu-*`j!rn;&-BLI+4_!`a_T& z6s55}Y`<13I=3BNXp4+(i|PErA{UJho8ogiyPtSm+)cDBHoXqn|L)M5bdFewiDOg& zsf`=$u3Ak#$`z;p>khv)26GxE=l2kW_6Mr_0Jea{0j4J&@8_Y)*8%jEiP(h47rH#0 zU<|W4H;2>6mp#b{A$46=@`cnTx@9o1{zjGlon4N*QvHVUpuTkok5y-|71@uN?E1NO z?k2!u_YfR=zW|Hfts_vVTmO+?b7A$tm&Z)@dI3NI{0-25#%KPv0KU&8dmr9lv11f> z4w8-bkbg5$Iyz={M4OG%_(-a`4*|%X5lxKl^JLX-6`DSTv-OW$A9opJ1|HUd94+lL za2U`(x)062cH#2z61(E_vU|<;{Cs9_d3KCyWsy{_YLe}YhP>pMjHlD z4A%dj0~$~aQK;W61lYdqEBY}N^55i?G3^xB|EmP8c?Ul1%2Y8qgg!|yVdyt~J+gMY zspz%Lsvi7Nl)|y9LlLC^BfL*lXhMwYo}J%E4ILp?a_ac6`<(k9mjLxnmk#%TGKl|V5dX;_{*x;G|8=VL3LIk8 zlRY}Ro}d)b`$|zB5`Q*9E@9ut71`|;*O1wdlMa8_k7K8;&37Z=nwoI_Ykvx68BSv(;o-!i?&c>^h3ik3M(W~*Gy>7#(c7#yq-U2e zkhfjKoUx|#RL6d*tVMe_R<{|yH2bfo+YK-Md9hihmjy16U#-=C!zK3p3~N#-4eq;T z=TSSKkHjwZFGY!hi9Jv-MuB0A#o_YZ)sTpcfY|FPUf}-S6$E4ZgFPz8sbZ5M7c|v9 ztpAi(0ryNW&AzKzB9L47P!w`Ax(3>BJ-xJ9kp!tbtGA=+vJzdcD>L=6a3hY$jhbZ# zkF|Pe%NzE6tC4*qv+9^>&2~rnZAiSx+o$`W(C@Y{(z9P{-~aB=2Y)f_mY?&?A-}>% zz6V9~I&hEO2&cB{F>Dr_`siGZBRNZ{btAmA2T6S@*uH!xZMup@?sEXxdEA%04vaB) zDZQ<-EC(_ATDJCNuYZyM-0rT1k6+LU?M3g0vp=5L?x2UU#(1pFsk$`i$4g2``6K1U z7nTKrhd_o3uk5~91ux`6Wbf~$OK@bmRBSH8D6?Mok4;j5VL>Ws(Xn; zE3d@#YgwmX4K96=-M;v9Mi& zd>uZ3p6V|B9w#(KH?d|Oyo;xi*MuPD`y8wDzJZheaLyusdot+v` zzdNskN}~ejo%HD%+vP#XEk4X9PG7G55jr(2bmJXuIKjiugMwU^N31ua-B|60;0Uss zM{@}%-t_I(PE51e;#g2X#h|)_&=FX1vD5H}+7oj2muK>(R~e=3;i=^U{t3-3-sLEn3s`U0>GnA7x6HP@!sUwAVO)de^4Hks)*j;vV`ds9W33+1>#BuzL63g2 zf=uH9MzHuM-pRSgDu;EDrmX(xRGu}u$`p`g+EMWc%=gBcm$WZ5dP$vylV#)aMnSpY zk0utm4acQ9KPqL3k1m%RMaxldyTZx>oRD=R%C+mr5rge#)&j2mg^T=U4pEy+Xp;KH zU!^X#)?tIRkh_Hrce(ZQMDpJYoXsD)-w<*#?#4dV06N%D$WSTs=u+Hf4+^rle}k(+ zk4X$e+?UeR2XG#epUOu>q+{E*Haqpq5b+hfgj$P&A^LIn*lX+Vd*0^R(L1uNaDwFe zwYS)-9Ny4PWcU2&*4Jv*Znm=a9Jq^qz6WYd%4u48A+maRr04#1RJ^X?b&j2 zI#|s7YEW#qotE+o&e!beB;2$gMh9uFPU`Z?Aa36e-NJ1wcgt(pS1gA=WM;vJW?3*i z{<@JFGU?pdAUTK%5gUbsdp2Y6dv$O?nPu7+%tE;Q0f^(42X7~udA23Gv)_yh@w|IO#ir?}zTKN9ytqk5h zHuPvcd-GYKdfKGFNl4mxmaSVZ*Xa<lpb3-aWgowqhUj#ERBJJS=I zr?1HFo0@|Ul|S%B;HX}TzQ%60jcwc8(sj%bPKnMny0EqP+fibp@Oh@ljw=~cC3oZB zvY>B05$A#2Dvez`5j+<)s0GBnI4&ne5HzFue{6{2K~G<2IY1D@*_-_r3OaLN2;AE) zq(cbsN=WoJ^g(;K($PNoD?v|t3Y$^WDxcir}7aI@pDOPd#pYXUk0%rbQjHZXvSmg?wtZ+DwwTlvY zJh8np-kZLd#jjI++Q64w!QTFEu}ifL+C-z~6U9F5DcD-NPRPZ_ZRhd+Xa#mdX3n^O zJrJm4)X$*tODqu;J8@ROcC2s!-HGlVFWxVq9YQd;@)_=cDz;_^e#$L;QH)cIahNaQ zFCv5BXEx3SqeR_uH{-ZpmL; zk8A$2mT~&N>coDbY0qY0cr<{Vu4V~=8n6JDDO;0Jr-Fy)=Os7d9me~HF8r`yt)4F5 zNSps!P`>j%JCJSLdTcTgwA^TAu&c~*~jXdsi*cZNpveJjBHH{oNF%fVvHEuMx! z19mU&=H&DF(GWs9tl9xi1x29U07Ff@qY$3(YxzO=1y%Zg(fds*S4RJyBF)Q zt$258qrgqUNob`h?eU)S@}bly5S(msPbG28mCp?Y|%+TG8oTHBfS z(WI9+xFT~%?r#!2M{egymCQ~`dNDn$W!&D>vMM=UzS*gWx#E_pYGXZJOV1*~vyml` zcizh2!v}nrucd{{dpl&&9NP~S*AJy@hC59xJLvwer;_$truE~Ase|C0_D7~&`Oqy} zVquHz(|9bCqHgBbe*&wNFSZBxo|xGuH{@r#i04h z8u(`O`*;N`raBhy2Ui`JG}>umm3`X0F#LfK=F7VVy*#u&-+UZih&o**WcKR!;w{6t z&DAZ@C4Gh?nYArdEN~)V#gU^i&im|n=!4Kr{q^s9S~8F}SZ7FTGPoH*cD&86g4i+l zm(eu!Ud(v;s1WaZ7IMMa6XP1bY`B#0Cl~F3JIt_I58S%uKP#IQ`w}M@weu)U=FMHC z<{r^BXdldciVOTSuQ$!X`A3ahNBdxK12gZYvo#e`_v!gc{|BeBi)IH?IgIgpqnyVS z8|M+L%x=|`g?psLH(HEd7t*aM6>b^`U^Gy1Ja?;qJsIc#hU`#v&*MjW$Q_SBz z2{`J$d`GI?xV?z{;>*U{|M|FixMcx&@bZ}c-w#0gd!*hFgoFsusp zCb@J$IsZQ$Lf@PyRnbKXy51T=*wZoYz4?F+tfXiLI^+XD3|wirG9{d4UOlCe`b$2! zmXRd6=C7}eQv`z){v)Q{!32%=1SMY!6H9u=!EJ$cO!fpetc2PG8nwA(BQAlRSu0aW zEmiaOs$C!bZG#5W*M^JFtXoAoBn`r)TswE;8cw|w=w2_tpP2J^+?B<8Q+qk{p^}MI zj=8E-o`anDFW@wOote$=oiN$*B=Nw|O)d#w+zT3|nVVX=VK}@V={ z&;q$225~{pL@pjk8+tV;iUYOU66a^2WD?p3CA>F}oosSgr2o1FYXWSDhZVSqU;BFm z8y0G9J_qGu7JdBP=rSqr25MkVPO&8=?5c4&h?%Di(E;xtnjVhYq8HqUPob(LWO!C}zs~QX5aV?zd(9 zt9Cii8?3?S7g9EYLiu`(Yt!P&%E}7y;z^$^yLMC%T!x%cE&n_^eFP@rvaM*ZeA!;z zetQ*k*AObdnEDrt{y~XVW)d$Gz;u_tfM9g~EGwKCNcg=7pARB$7$B4A_0YLFHb{2j z%u{erPJ-&dQ}}n-eXgeuaMt;9DotF>BrGpU&ftC z8m?mD(X+3abYli?cXO8x-W%<=v_c9$R{Q3CL`#uP#ui|c4p^?f5-;Wz3B}~-*%nZ z$}T&y(tE#jqMpm`S?jvl%F0K9~X+%z1@y%_Dffp%qefRuT*ZBVTtw$}R=5rA1hITQf}W9`)>}$Qh@u>KNfljaKhI)2$moUWL;XlYei{k# z+gWwq*hC-cJZi{+YTBw1t)QXRT^=2`9Y4$GXdStTf(D94KXUPBftJ%0YxQ`mp+)cA zp0A#EwX-!ZTWK5*;97zAExwNP{CAXxcrXB$ML77%CE&T$G`FdjFE%4zD5GrCe5dhY zx^Ddu^$~PauB5``IZr0r*1xhtnMP^@{DzN|)RwMJh^=-bGOS#0LuYn2$Piz@OI9RW z(t4-$!wgOD%lopNS&J^Yf)CqVD?s;hGB+*LvWS~`Lh8VniBmTmMy#!e;A^!Xyjk*4 zA8VP`o)=Ci>T%$)MobUY-~`+6{FEHdiQagkNWdYo%JhKO&suLGDB9{pZ4a1{X^Wg& zi;}t-YB(1uZrvGFUeVLi;!Z<)+XD-~+330`GcBzPa(jG0`^{!K(>a5te`rFeHXD>|pX*EWkw-jE)JNAN^!%Fe~ca-o-?!=qcJscKsh=W~(T<|l7)4rY(< zRE>`;>8%@VEUImO-mDp+f57c|B^mjpgXIjO2*+sTe#O>%tLl_hH{*>-)Q6`a&IyXv zwKZ;x6hAFeu9JW!V~qg)taJ9qYc6KUxWH}FR++gZM8ejtaP=EKUK>C&%Cp#L2henA z#fN3Mq3WwgNA78^#C4*Ty8AUJNv^KgE5V2Iry?h4|DAq=vC0A0RW8M=A^#fW*Spb% z5q9WC4UL{nU~pG%X;*)eVV|p^6P3}h5pWvq-4qPM4THmKT;yk_zik$WV{B7 zZun^I=Bvem8oNDyrSF`pLtjsk$T69P%IwB58IcvwhKlXFcLMfvkxJ!8qxGuR6Q_>U zlIRsy#Yi(d{d(!p>EWI3w&NJR)8~MY972_Dg11&_s*k%CbQ}0xEa;q}?P5|C+*IlJ zebi5ErQ_zTI7P-Pe-afgw()E23ZnP>L}1iVJWLY;C-?hL^;X|Ig*k-_+uKO z<7_*V)n|#<6LK}BR1K@^ZaG1D0v-w1;mK~sI1Z|;8NeApCVDD#UP^a6eud?uoG z7LuLx!Pd^M#!L@gvjTDuUBMAs?MufIAocnI}nNP~m%?0%1w?kz5%%f(Od z%#~$*d?dd9!*f{JyS%vcZ0x!Qn9WWdgesg}m8{RaI8<8>MBoYM=Hs@KAyo;NogrQ= z^u)7a6}EX-gk(d@=M1-Iov~oUCbqO z#Wp7w>eXwwbhGq;ThD3Ay;H?i?X+IaXZa#p$5}^eb$!HG+QzP5;F#2cdo~nq3vFI| zXEI!?jy_{qwvz8~zbCsJMZm{Vn~6}=%l^En1iY{F4olS}ynz)vjV1{D59nEPubmaq zL2B@_fDagHT}x~wl}~z<3>2=G+x>0Om9crt@6j;PkQg=mx zXmyu0=TYbMN6w@3JG$cO8K@>@X+P5a`BB{I<+mz}MG2^-`@BFI+c&TNgz+!{;xt~sgq$>I1;`&rtI zI#ILeSC7ky)@2Ko9V zQ7d{C$Wn>1@9(J8Q47w~Rg@8CMk6c>s{}A#EqV~t(J)!e3K(D8VHCVYD$<$2R%cxw z?V9;GPxr}BXbrNKi4jlwc>-VM&293HmD+O7v8HIfu0Ck@!UsWUHp+)ZuJTxC1B2uK45YBXc}w#(vex163V>RC9t z1g(o&D4Em9?|qn(T^_q#qAVfKyp5h2I1)y!+Es%Td_jtPWm%BqzMQ}jd~G?Li;pR9 zzPe2O%H{$Dm+j)Ws|0u)=M~7Q1@1i)_VX=1e>CXZXilv!Parf&TAjrKNRdR(tg~vOnHJW-C@5b?0_9O?m>4@fHpgr%gyne@%G3 zf6#t2>h8uS*DdfqK}vK58YRylVruDCJaddkOC)r*54D)+dQaCgLOpXnpteT&4U+1d zlaAj;QEQQ+sNvR0y;>@&T18JMdo4c6_XFRZ=LZT(FF|_0^FS_`tUgI{?Q@eVRvG83 zKxtkO%sC^u6|8ML`c_Sq1sEcksqQfmlt?Kv5}krzYc^rYSJn{QOc6PXmu zG@+3wh98Mfn#hP1^`SqjhAgm~~+g9DMRW|IY)L6JwM^q-k(j zH)qGsHEGs4&%2R7Qk~JdFUEBmU!q6X;(MPVB3MTou0Ok>%IV z$)>kb&)*ZVbEez)zA5V2yLj#<(HB>;&6tAASq8U?rYvOW8)LlHz9d?!>mbsUX8MNk z7fF{lQ}`-4-k#Sn71Ao&BrD3W-GU|fs43hn*|hB`-^qwcm&0RqvmD|r7|^X6`CQNk zE4EBg=P5YTe6#@9M@?&@dlV-q^Gkef?bV%4+kjJ%s~g1b>qq0B zZAP`Seo3T|4cIV!^uf08SoY)2hZWNrA6y){gs4DW{mZy+@Db;gyc(e@?hh`OQf2yq zDtD`z?z$zInOUlS{E)%<`kcmb^epYP8P_Z1NDUp$&BljPDEIq~VLY<({zun!Gu^tx z5x14|B_rk|zTHmv_9jXBF5Jv#5@lzR8lBgs6p_!A8r{@TPGsaSiD^<(f;cQ6||6a(n|E6Ys zsl4m9wI8Cl`Msd5Wl3JR3eV}5ya~HYWt+>PUVc#pW1pr4TxT9|I%;#$OFW5}_oCdY z+Tm2b@!Ff2dDdF#VXD?ssf}Nx8TIEt=J`nEW?B zab@aMq9`@fI=#ILYQXp2q^q9mp@1bLm%78PX_f?AENNhqSK6t7Qnx zpA}5Zu^u@$Qf9%duBUVL1hk@#$moH4?S}3<8H?nOWNYs%9si7G`~vamb^ALNO0H;l z3PL)^2x;?pKvqTmXp9q2mU-JDLn5zVJf`0sg+=<-d#boc@zJ*wG9V9Q#=D~!S~ z!HdFQ4RYORAlsB z2G0v7lo(4x*_d`ClIh6Ok2crui7%_-SIT$-yz``;R#qHXO=VI$S9`72qTv4CtKhx2 zw_tRAheL2mEzqau5juK3Q(Y(}yQO}8JXVGdx}}M#8ayMNIEfVoC+%4J#MX@|H6|)% zw=YgQRotG0%WuJxdfys*Yywu+R}e$Lo>AQh{@{5;gXTo!McS<{PLFhB@W|k;tTx-O zFoycOSuROoT2&8>JvRfwHP=F&Olg8g8s5C@wHFNzh(MXWH>*%9n|G4x);huG*yAMK z0r9D5CMcLy9j1Z2lQ53$*V*DVEC$cHcyw5GG#XCLr)r(v zUZg)KTMp!@)peaz>fdl$^fOji?8rVRW0|CZXsy;$p8lm$aM93AXXSH|B}+UG=@Omj zy;y%nH}h$_C0$#I>7r&n7tQl(rP{0WLwtAddZnhR_jlc#A3x%}wp1wUl9p!)yLoTQP4{L83R^{5Qflg9FBovSaDFx|n zlm?}wJEglDq>+{qDG8CBbcX`cjdV$Ocb{jjZ>@Fqx%Ri#_Q(05*CjIN^S0qBhFg}yeQJ8(=U@Tc#bjRJ{K69YZWKBFEG)X*3Rw|99;_fHA__pYucfmTQy?gaU@y}8|XR$ahq{E zD;*&AlIu(7ny&F?Q(E8is&`nEoh)6lxi}gSTA4lLaz&f~R`SU~ZH@J;dz3lVcW-Ai zV}b|&1ZiOG^X(5*vl|LZ-nhy3>jRN1?Au5Oj*}HlV!$*U}>c2hqny;ReT54Md6wd(Q0I#=9frN zK6$bX)gt%zr6&=j{r9S@s|!y@cl;RbZz{*tnC_vy4#0t^*Iwgp5gp$4k9k5QXUopJe&JMXJLlqZEA z9*w=}ci|RX8kNh}NA#`)$b@gIQQhqiMcr;r;z@xm1dHp0<~@&!lw~TfVF>l6@oRi=yBxR5#t*lqBd>zJ);u}c zM0_2!?ZkOq2o+BH`+g1#N2c|yTX^N~DRM;ra;cKqU~}cOvZ_2hNU0C~tkx43&A?tF*nY^3Bngh#yTSip)!9dOJVX(s50Yuzb>a>ZrpTheMFxsx;mv&&-#;$JKHO zdg9qw%>gkZc-x5qcDe#Ag6_VFR1ZEFVHa9BX~GPrX8 zgG2Bi<(ms8l|HJajTL|_&b$>tAOtA!Xrlec1+xO#%VO=DI#nbr2M-hv4urK+7HiCg zo$7biCi`GjrqtWd&nKIGnzgj^V%PnJuVUsQAu3EfVE4_tCWI5eBd|V&Hr?|u&vSo4 z;&8YJ>Y8dXf7`yXa{ozyA{-SCChxq~SyhGUU8WDM{K zdB26*PUXsQlOg_=R#BZot}H{=W{}$>Iz=_s;o*p)7Z28!JM(fAJ~ZD=QE<&@jhbg! z6lz{1!6A6PXeB(gGI&`8S=^%Vy7Ln;n!C;|D(z#CT*QWys+zITF4IF4tGx}QiiGi+ zYdW(I!;vvJxy;S28b99z)**$Ts_!m;5W5-{K|rBRbl(0S`@GM{n`3 zN6VoPmy3B%im)Q)SPo^4Yb$dBrhb4Oa4Q{qxyA!ZN53&r!*|oJ=qzNsdL&f zy762eq%fPvuI&)9zEVN!pYFc+rRYxxVAaDC_>dsMrt3=!%FYs-yJmZ;tCCWIa6zL{ zE84NuQx<_$r^%MXf2{S8*u$4NXM#rFw#TP`Pc zA#H99{r8%!ry*u)zY=wQ;>&VmWEL{TR*pwxKNJ?eiVDNyJ%9L+^aHqO^`j&~hpPKT z-rG&+9FRp7I8g-gQHz?8-6bC&_`KAXQ={qZO;3L8yYN~x3h+Q)zQcYN2+wEh32f1)Q zIwSoYuP0Prarxlhzqk?PzaEi8VxOFe0x!amfYjY6{MESh#<#wcX3mR`2RHVMG+*d~n15C?-Dtjt zB_+$oft_NtH3=o+;iL&s&f6VBeIy?^EUyy5jZjp@LP_jAwFCQ57f2gvxUGs3^KP(0 z>q?V~8)n>We)D-fo`3|Iyvxqa3$USCKfqL@qG5p2_MpAnxc!DjZ%{r;n%I38go=n3 zvR3F-q|=)a_!DS>(_lS1xNz%ie{NefG*CTnoe(Pb>QuuabwCVXdz~%mmxTq%taV$H zK(Lp0Q~uBMP5MDRWe~I@uV>3r50~#`1zrP8O5=5j5m#x`WSq+R_PEtvuAJrq&DYd7cbJ3AwP;~q-+v{a z9?G1LBfw)7R5=r<|LG{JW(j8HG?njaJQTgBVH z;+hy>yea(k&ngH+xBl`K0wE#L;CyQtqr0)Hqwg9S)Ew232h}%WLHy?9f>p0YG6WF> zLYxGN@Bd71vKD0bvAh-~5Yjhb&XpXYiC8XWiIUXNNIt(jZ5BlFvboU|KS9_1?q|xs z?kL#s!10Cii12u(A7S;qpH1y0K0R~leH4QY@JNqRKED^f+1LWh-Kq-JE49$@8B_KF zX!HI92Ty;i(asV;#OVW;(5ZI!vim#py~b1t=2QWe3n@3p;|aZFLaS{GmK%Os>zpNM zmNE1>OAEzkOFrY%vl(8LcXhPu6(JpcRKdlw!)6v)*@UY>oE-bD+*#?Sk`#9QUD zHoQdhMb!9aY6F+`xxiMa9=COnYpXshlI_ulDLXS&HK>kTA2It*W{@M2kvxA{-_g{c z7R8HcRPT_}s}`LSZUO)r!60w`Gv7klJml2Bzwz#t$oVVHU}cJKQ-fW^L)zCIbn@qX z?9a-EIH0!(!LCZ;rNP|Sja+o9Oq`Nk>Wvl-@x5f`iydYn#Ab+>Z5v> zExJasZR>!#7Fa-0k9#f4@SX;Gb)iQn}$&ryR88FvPh-DXNnI+4+;an-YAEZa_GW3I8_czd$L5FL5;i-Bat|m)`+4vAg_=0m;&?6N_ zALV|*tLIC`MRg_HC-JO~6DUwO(`ms*GIp&nJciAoRKbvRHXFZi_jQG+`7LKkTso!b ztEs9)4vRT?=}JTA+1|cku|kKk+kt2X3lM@I%G)qvL5fs8HLRAJO=dVjPy)7n$MIp z#XVOaey>f!{%HS*saXwLY32oW+?rC?n44}#`^60%pB!qB_!Qnvcl#h!CUwfCE7b+; zlIEH{Jg?3h;odP@m8Jbv z!*r!ZBLCeY4lJ}fUJLe*N1s}0^eC%pn>DUl2;B6kx4zlob4)PqQB~{P#*N!v+f2T^ ze8oI%=9Imb=JDOBzwZ-A%!8fjZm`UAi6cjTykjT%Wv%LQUH!>AH4~$E*QKXsqy5KH zfh1C!hEf&x)7`BDw|t5ilhuJ3V2aeI*(diTe9m5Z3*z@#V4RiH|MW;W{l}0q3VC!L zEEr>C^^gaG!&n+b>by5+7(jTsbEn#!z)1P=V+Y-%q?^mDx0Qm0`~ZZ)0Px9YpQjGf zwGO%127|%TAW#*aAHg^qA*5x-~9#m$kv>;L@u_sTidvi4v==**!?-ru6dHKOmAN zG7rC2c$eG^K7d1nM{lS&R^FJ&`7|nDAk~{9sNB!Dr!`q_0_{x^kVs2nA9dHJe_E(n zKb7Br<%+2BPsxG5u27g8+*gZ&%r^%R9w=8?shYNq=V8kw807_iA9)#kU4-1|ozmG< zSm*dtudCx&Yi&L;XPo1pf5|)i@zpwi#N@t!nR^5fppBn(b?(nG(ugH|>JcU{hPN1N zc*d}6_0aY~k;WV)WiV#MRe}f{tu(^Fc=a%|t|*-G4OzI#`bGp#pjlM#!ZFM9Z1${O zQ3ZtHlZ_SN>04LPJA?m4U)Rj64sq z0;f|(MmGi^#e=WNikYHzW@8nlKZ}*$6gM1(W!KTry#M$26lO(#)CuW4@5t@UT*JH4 zuKx0xP%_H8tK90viwC|`M?}%Jl+kGL!4F7c3k#oj_4g;d3`EOmp|->Li~j%c{Zy&K ze(1i(yL@V6jW@-m@*EaQiC-eNh~kBg2c^l;(>0&>BtY4{n^qD&8Et1##u_M~`cnO1 zWs&+n2>6Fp$$TQ80Z;yR1#>p@SKhOSg};K|sQ8nU@Sa6CdYnmpXg|p@IqO&W9%Yn^ zDEuT(O85VG)<0N`DpA-E)z@4;ZkZG1M99x7%x$h~9J|UDi)Wsp zHkKg@i&&Y>{_>v_ zmVak5$*GahUO}?mdYsGLjxb*+-!ZFB6~ZfiZgFdO3-tu}W_eWK`gh(@R5jxpqHu9- zQ!>TH!j**x4#rtSG;*l0A?T+Q&PM+o(#I4ZTbn7gw!GZAK*@91Gv*UM zudC6dHE1}D_4hUX+l%3V9t%l>LXjpDu%U2108BajzqvXm#U4G8TEJGZ}EvRgerX-QTPzGbK`f|gFM;>G;8~c@+Il35Qd&|e=lan6@C|= zN%DU`D+E4|7M#`#HmKpy5a&|-*88==*qX}0)COU1f4@{GWT8PELbZ7IgyhL@eLM+h zXi+dxFY>zVglq|~uEMjH*@jwHW25IDpqjDWFTDZ-QMx7ZQ>4kx0BYJss7gZ z0H;)XlYfM_kf)E8=oMylxo-7tG>Ce2(ZxMe|M)RBCWetp;jPohPX#{gw=(t) z4q`t2U0pG)686i9MR$*zn*p2I=6-YgErG(Kg$YzrT6}Tg)0OVjC%Gy1Ww2};F3ON? zNb}N?92emNDuyQv0~~gc`E0h27i_9+$-Itr7GB#LcXQJK( zij6W9M(XZ)IZ4yJs7hLdm8scj`b)&0^fJAmxbSg$JQ_0{Ty%gI9!=nHaDnhEL`6Xe z&ch#wkAd*QKZk$wTWl^1qOB}@ON0Q6q_7^L$vla3JC6I+x_2CUoB|Ba!=%-S{Wb;zdXw1 z_?>g|sDLbpsepBiVb7@&e@Eto9|O9z2+Op+0hVJipPBY|n96_>9K+eKKn7NP{R}1e zTLJzH{rm!OLA(>NF8@5*j~NksyA6dv`m^(~Sd;fQiX~6<=fUNN(4afnuY9P<=-~cQl za7?LPn{c4|W_P}{ zC-`6g|6jf$fC4bV{R&ZjAO}y1(HwpYtaE~643>yb6i|FcQ3J8vq0rJ0Sw7Jc*_GQQmFv*Nr}-1B@$%m++5v z;*q@H>*>VqFU>j$5z{)cH^DAl>N&;n^s@Q%xN?OukF$N}9%^yIqb%#{>7LG)*GgIT7Acd_6Hi1jeyyElnSMpY7 zf6*zF0nn**oOXQ@X!+!@p#P>6P@n9tHP3gKoH3!8bB-t0t7_=5(|)b`!*fTg`{vO+ z5R0T+jS=?wM_~DK&>PKrqY2`FeoyoSOb|SPgGmAxosnl6@?Qi2EA!hzihpcsx$Xm! z$@H^<)3+ANI{qiiBaHlf@9tF zsHF4X5e_U`Kq$L+QO6~~Nnw!o`QPs&Y=E}BOj`Bs@u|GHbH881ejvlw&lDKd)`;&xn*CgyjQN5iF~3Pi_`Tzd7G(C-`k zjCkgQXVNewKku!*0Fb`c_CCn`!IF`HqMldOQRq#U#)z=o2>Vt3t zJULITgr|*^y`u#-o1^~ihzV9}5pPh@a1g;ytSY+D?xK$$b=1m+-%EcE&vd(c#YCsR znjUrg#wR^qr_EJc_sDc<$;G3rx~t-D4AZ=SJl!2y(O@eJ69C~t#0uW8wJby}w7ZIJ4_0|s3@2V`wi{8ai9dm^z>#J$n$rF?F9y>alP9;2(o zj1p6rsJBUx^Ier}PnJud;WIq>F}XTXi$M8TEdZZvK{RnIFr$%9Xxw0oJ6xz~G!?k@ zSfkHLUk-LiZ)8YsoTI#Zf)V^g@xTRj7PQX5lCU+ju`u|`TBKsoe`4EDkv_`uV2zkr z$3dl|my>e6+l`VTv5rl2Zlrx zC4S|CqQ0OAO{wa8yxjtQggO0zcGTGT0E5{LpF2uIs04Sz3EhB7h~diVSch4@Ncu)` z3Gmd8S{od^;3YDbq@hFDgJ8gikZw$mY@H0q=n|*CSm$^Pzp6qVTmc`XzR{ve9iC;? zYa1kiB{CpDIJd8?-^$OVYH#4|g=9uPo8LC$-j2!a(isqw4HM1SMUd@ec z$5Kf6xAq;To-g1}yA@NHA7%YYZ>(w$F74=tFxt`h5ARdSKE7B-@KolKg(nF1v9e_Z~>OyC*-Q zS9v8J_muRQ%E8{=XuNo~?C#f#XNq5=iCwfn+`bd#(vwhJ{MVKZmrRe!PR^T-s^LN@ z|C(EYHeH_`tQ)?DnF{tS!qB;g--+GHcBjvvL&r6-)HzCdvENhh4mjQA?oQ5xGUHj< z*w`X2aut>1;lYSdkg#~}X^ij~EnB8hdSUTZVnvLT_Na(po`hz8yvnIQL zpQsGTMsyc9MI<2jV#vTC1$bH1kKqp&$@hOm8n^3aZ23#ypr0&$G>!=Va7lK9Of6xA z$R4tw(AUyr9NG+NAKH;P*78VdMbSRrSdwJaj2C^o!tcRSMR$N-%q&7sWgDdMTBMqV zWq|KePIo$)o8D6LQ8is?5Vn^)`t{Xb^I=Dm&2n#9;*qT%5!C_=&0OQKy!iAj{qEZG z+R^?ao81d?19)AplZXoQ*`al)L$0&EP0w5Gt$K2of zq};ahDp0pKG_TWWK>lcC=>)x>iK$3~gR5UgPR@ly;_kt9OJ1;<*5RCBx1nH-U&gkcR8l|(vRY_T=iWSHetEb z(k0q1P|@fXu3qnqv2h?woBlo1rs+bK)MruZVtFKjbWPi3cJxqq{DI=_j6*~50;p;F zaEY;t>T2~_XJD#&tOt~Zd$@6$tI17OSyLEy$35Wwq65mYS|h67r>8Sf%e2#WE?Q(F zF+vWvGx3ebwl6X%qA}-nw>ItjPDaD`C8jxxvdxw*;qZB|34u%oDC<3lfq6NoVwWL- z;9}LDvWaH{eJ3g%>umtD9(dj1*u~#m?i!wr2-%QdmEE0AiUFfzf0rYZ?fFr&g@lG; zV8k|H+L=-VGs2ijSdlE1agT;VwR@V?rNE(QuuI!Fz{^h z6{bWsegYn+kKagE+*3Yq*1x_+eU;3ry~?C!>IiDWS3te{T3aRSi`!xvyZ#5%ki{zM z5J7&M>Eid}BGzlTI-ryBuq|LnM>lM|`HqyuJiMXGGEgq=Zbm~)JmPWNozDAVtE}`% zt0|Xw2F=43kETe@BF*lbon4Nq0vEnx9oGy^n~R<5qV}H8$TYozKA@N5XWkm$FQ;KC zT0$=}A5ZltvxckPd&4*1Z@r=Vhi#?yJC&+#6_fizw8J?TP~SRGN{rnY<>HCOWB`k~IVEX61!DMeDANjNklWs*mx_SM1y26soh4W$b=qY(iR7<~J<@2d zJFaK)Yo+se@PId``SG`8(fm4 z`LJpQcob31q+3eZBg7^j>{;{_zb@0?!nruzJ1M*QM%x}B`&?0q@u{YIvA~KoPl4l) zuX2ied3a}YHUes6aJfP}3dJ>xWnZIGHxVWf$XkPt6CL{bG|S2{>vc|1je8_(?Q_+j zJmX?yikRDH87W@7ld&FD5>1z@njiPiAJG%rw-ema4lpKdV9%&m-wJGudSnc(VT|k2 z3)H*dd3}QpsOJtOn<)FPpZr1q9Z$1Lx{*n`y0Wsxj^4jsT%0crgqIR=6w;fddwmHf zJ*xTHv?ZITae_y{a;RW|ArV3ReAK4kZQq;LpLaKViH8dv>7BjmX@0@B@Z?u#WYJ?g zygg_0cc$S(Sso^}K-4KKZa_s)SH*@y_`GVN>qmYL;|5$bdzFLrk@|WCC-FO>4G%KU zr~bj=towHxjB6=Q;_~0yownv; zbiD2nt!;T2tYmeYv z7y6VoRZIcc+DCR9yo-S6p2$iED}bs%95JoB{_1bOE(6g%53ZT?ggS8PXh|4#%>&rO zu>yKUsVn!y zG41&G-~Ws*zG=9+Mc$apO7F0^%&1cxC>AWh7Ik|0>}Rb2By%Ag#F8;CH`^mWQ4KVg zw3*K58ETr1W`4}h^-u}sPD*8n5;zTLXgKD`n*9dXxV$^%rkQMhp7ACzt=*XT@ux=D|R%%5XM5E~TvBXe&4wAj>uqe+2;2w?rJSLHJM`O7-WP3{v*2U_w3z5N6| z;%iUOiW%Ek4$?KRquIA+LuHKz^}DmYQb%7fipJOaeN?`@N~NftSLyr8zEsd6#asAm*#voLRC2YD zT`rvej6=2G+Nq3)fkzS^D|8p*b=;-+#C4|^C+O~WP_9EAoyojXQbz^B!6Txj&H#dr zsP*W}GH}cTh$#OC$nfMySESsr9%}aXQ*{qQbfkmG1o}TbVkN^b_&xSqAJH7 zDlxN|uF|QYy5r-Hy)%Z;$qpV{*XnKFI90}YN=|sv=?^uQ$~e8JRD@H5-2}y&sY#k2 zi7`x!vU8l3?}O-CtqlP+D~tt~B$@sbt2Pl24F}KE$=zO`_$<9Lf$27l=qEelGY_a^ zlYz6mm55cgj}WhATUOciiLzqBDvABU5B$fYsKNF(H_Xq+vTFAQkQ|qY&1ZF3^7ZX0&*v@jkT&vtZQMMmOrR_|0nPc2*IBROSnnN~>bl>gc znkTPTX%s6fi$r?v$m{{3io16zbaVZl-EyWo2`b1<#^V`1U>kJvxdvI_i@-&V!pS#M z(#Jdo(KB{eMLM#loA)&sD58zOo~gdDu_0s zxY{McNFME$VHA(<0+p6NF_)&sYgt;)o zuGtez$J+U&hN()6&WzheEfL~@=bkS})44}2_;A@ev)3MMkJIZ?P+naJVeBw*>^018 z;f?6M8JI&5tuC}fHb1_G^A~?SDhV17gbrIVHI23nA5Oy4=-B*Rpp+oWQDeV8=)ERr zXD_Z5gd)lUZFS*(l&}+yCD}(fYP|ld>7edW^AhlWI*s)e{}YXlc(VxeOBuKC6Mg|K z0upr$j4x({kUDn52i`v=etgF)d~& zBT*8?C>s~296rdw1BX&CMuGk7j+EAPol?i3l>+w@SaiKC?HCW%=rVMYbJht{n1!^B zVyZCb#LIBVgE?L(6|z_Vl0?U~9%g}`=IJ<16SuDPQsy*OwX z?`3c9ysv)QXy$H*%?#g^ad_UV=M#`5fT`iX!nPye^@vg-@o>8{KLW}o=2*#yH7Tt@r z2D)1fxNmOjWBB+=+;Ry;Y791wm2<9>>VA5yK~Xs})pKKc3>xe)7IfOrns0CG6=K@> zw=umc!#a8=kHqLbC!#=sQ`hv?eC4}mya{QlHMaV&2EE#>w_XLcDgr~BBtD=O@|CM+ z*vZv`$fZmKVMjiC5@uK*vU{IEol8PW3h~GDwhv=?B>hDW{P5&QUwQ)95;1GMPo**3 zG|OF~FTTmXGu89q9>8OM;Tt&A)`S#3$F|fV@Ps-Hm*btxZOfykAT%!d?3>Bfhqo=1 zdkxhu+>f_Ska&*0M)I8`E^e>Le(2h^-IB7*=U&eJG&v$9tzFMVU%uQbj-h61G-%KT z^>oB}Z|c7&d~7F8KI|agK8Yf|s%fZk&BHcOKkj}0OnsQ|I(rHDpi5sOe?A*vbRRm$ z4=T5p0PT0FQ5Q@Mvp!$dKQtg3J|O{!*^DDe#vAxI%MwuzhA?=VFclt8=I1r((_`Yp z7$bM5^*r}cvpikuuy8+vmxy=WvKC?s&S3Y0Vtr(b`ltpgt_Q@Is;6W#v}PMTu`%(h zwO$|q5lE26+=^{I9q^a}HF5LdX;u4$g#Tj=DSre%TSQp~yV6Gk{Bvxk`qn%KS0>+f zq#~<0{2vo`cfMkJ)E~#4>kIJBvtL}ovD#pG9hGJYyr4F)q}RxjWj(ZzSR?e+q+N&k z`yZ;kiLl4SMC;H(kRiK!6WW|NXXsH@;@g<^x;oc|3d(?Q$XYh5KnI4vTcwmi!y`-~ z>GD;p!d1D~1WaIRgZ>S_%WXNU@#g)dg)(H>NTH^}gXG%R0V)ki9A2>pwiEo@%9z&z zzMRurcvxPSD}ibi&7f}V!-(9#v|zg@bD>Y#@%iK0-MWGzyW_^u98I!|%>tW-RTF?* zO45$E=ej1|ieVNN4(4t7kGTPV)JDLzO7perwtnsTBDz@f@``hcZOei9DE4gKkHQ+P z-jg6Fw$RRDRoz4d%m@})va<;h#S5C-ViqkKpS8vsqdbX_F3aivz%zA8%}hihU)xVn zH(Il|E5PX5r&e8fkL(B3GDKfA9aK7ndnfQum_#cRblgue{guBVU{&ZF$CQiYklTfX zuY}TR<6~1{IiytQY`y0c>D4P7F95(KRg?|_TLp`&Jei>`^ATvk%am%5$!hOph_{I= z1wCOl!}_PMK*0vLtPD3$?x@vNuR4Q4c+)yU6yJ64Y!a4BIK0q>y1hQhHdt9Xe7Kho zMmxu_M%;1tLgu*A@l(2L3B_6Tooyh)@vlmTkjDJLtjhpR-xd_RWm4961gATETCI3h z3=;PCvv;vi2yQ+)93uiZm`bE9+*ib1V@`;z*JtY1vLRvhHo0n`B;CYj?LCd-?*T67!LG?Tb$ZmBw zE)4H9^Whxu3V_3BEj_*)i;nAH!d>f^MG$9m&BBn?Bc0a-ryDIV?^3#Q!Pq)0h z5^&v*mN;)ssV2ZerNKJ*dCbFVaq79Gbmer@=#a~9=AM4QTxazu!QQ9-szJ^BT>m}0 z+1%9mO((X0_$H$J1lgl$fBLugJ_+6_PE~C!mfi$5trjLMS{!U+=2x1(WX8ombfEOS z-VooI$O|3{1Vdk(dWB`YFITi&{QmTJ>YKifTARzx{R7}rx%q=mp zg6Hnuh61Q`jb`utS3LSpPC5{1?wMLzmfTG%p^1r6QKV6w#vQA*ru{g| zJwu9eb=BT{;X5&2z14TG!kXf}9+{qr2^n7F_(^RVvN8=ni?a8XRlz*N(__LN%&C*_ zmk6nQ)r_-+vYE;+9N(jv7(cW!o%dcjozCy-T<{OSH@oU@psSga^c^o(>IvxlRn|y} zS9{{@Fcg#M3(^cetrBGhKg_duBaQ~oWa>GK8mhF)s?kqxmfCGFeb1-yelS1`FsaSv z@l$j`Be8{1gYK7sB*O--onSD&g8>Y?m}1~_*=2o6+FzuTrhfje(kgCuZm7Ym)z>9b zK=exlu(e?d-#cp~J~W9VMf3MpfbLjCK2POKn4U<)`)V)A&y)_4DltxDbe3CO!R%yg)CkA4IbK88wOy2aZl1 z^xm|rTSxa7O&jr^bl8Po*g0Fm!boF$!&%gz!M!Q|ogkH$fx(;# zxw|Pf3WnmVPl6riZnq5^_6rv)MdM(m`hDU-ncZUT5&yw?gzb5sdAfo**AZ9l+aLJ5 zqmOTtL5D8;P!U~)qQvKy9aVE$<*N)ET(&ic`M!F{YKJYPlo9t1-$Is!s#Riw#UC6@ zRkbFD-ngfy@ar%(?0XLFu+Bs(=13DZN3P;An``Cjuvxfrl-X22+_*};Z9sxmo|}(b zna>1Qn$ImL@KDO5Ji!5GKc?B~O!=A7bkz=MIOc+u1iJ;+QTJRUp+}H$=qWc{*TN<0 zrVk|X`Ay8*_{mnNme^H|4wRcK+r<2kNg!-zdY)`yiL~Mjip-)NAL&Lp>WN&@D`eIb zYTuYYG9l3!2Q^3zONDI@LH@+mq9uF=(9G6^s_dHxnGQwsZWp~j{`yz>FJWG!fi5 zV$%PCfNd>IU>o}@yd%S0p^>e;s@XNR6zK3z@wZSh}?Wj>{UgTM_Ksk9Z z{@|JRmkOoYmAAD8Z=Hau=ol_I6FyKb?bxQDDW&w3Ip5wr>T`=%?tiW-&dNF*!3-)$ zC6jLx?Xn4k?(yQ3!H3i$^#U(LCJ=26sSddr>I148?d1wiTkx1K43>=$;ejbdl@#?y z1jTZ(`wqi4&xk|+tT{933x+6ra z>1fLQvf~85ig}efO_}Xo5&MVKREEoFR(g7wut(2gTj;xTa^CqSu-+K2(eT{V^kmyE zwB*@JX^Ef#s3^7Y0E8sk9%J8Q*R6sNtwip}J0se~jdihc0t>FsbSl0c)JwhjLNtmr z0|tt@G_;EI)Ai`;8ds$9+ZAeg>?rFbRxM=7Wy_4~z>&#c6@YGhKYJdOd!4Gkx+a6kZ6uMif3KHJvLf!iF5GnzeaCk@C|PjMQuG zBkmLOcGujigb#t{6ZIeUT781o_9*Gm!;~K_))qlN*)v9e<$4MVw$w(SR)Asn{`XE| zKy)Ssimjtv^-?^NPy|Ay81t7kunww-;#M1)DoZyJY815wno@z1UW z5n!ourB_O#KqC?VcY)J!e-^RBJ)q;9CB`^7azr0M|DV_sLcm@mNXsahCox z#;|hhd=@77wTetbs->x~rL9Av2V-2@kUi89RL?zxPZ-Cyp!^-}~rCm?xt9aa}jQS0O-z63P+Y6q-CVf2?xVXCl3 z>OqFsG!N%UqqpwX&#W;+D*%+@A6)TXdLj|!rKO|Qpk&=#lpIbh*l7V42c~G5%`d<$ zk(R68XPxH~XEwWi^-O2RgFd15C_Vn!8U)Ko&^{RPEc67U&(`1ht%^2_za;2wjIFmAj{}J{>8r@uaCwo8e4>jy zNT!1tNSzp3JQ4tLD1}|KvCcYKFO|%*nRmJP1kL5m_&ejJdb{kkzuuvd3Z9-tsN6l( zz13QBx>9+QMMgp~nm@B`H#ZKt}2pI_0#ud>TL zn;pF5muB3><#@7|<4M0q^j5qyu)8N!Ut_udUZNs}mvWlV`E7cgARcd$HCP13G`e;Fq3dS`)Q#=%~;aSyB_F z>YuF_!ny-Ko->r~2~?NKHzhWD_sJ+zJpJW|pvbSgBpZ>nR6(JvB+6us+ay zefjC9jcpVMH3p8EScVTKaWr6Voiq>c(1T=^<;N4yL}d!mJ1^yC1(~hO<4cRtuhy0X zH{XNFz`0pPg7`ws!pCe~DJCNx8bs5h>-zJ^U8H&=TOP{``u1}?CPaQQ6s=@cRXp}V zpJ(_{eGz?_Byw`pYqMSk9xZouEr~p^F%8K!OiVijnO2GHSV<*DMWDDvWfHs%VWo6q zi{bdi02kY?a5Le-TikNJ(79%0YS`R+8sn51Uev%K&!!_m{skxsgYG`P3mEW{6PAt2 z10PAUXHydduyFZd^vK`LCjbbH5i)RMjDE6JV`$JoGXCp z0K*1LL3s=%xV9O_7OVP%bnja+LQZSrV-sje>G9~e@lO#$_~OXMfpOI)3XveeNBhK9 z%nt2Fwb#S%BdX+Hr&E@{9XNAK6WBK3M0*5bfyxYMUtfC`Z2Gc6e%X|1kQfcIl?&v1 zUSF(n);7O!*?Lg}J+f&y;3eSjjE;M%Fk@~2{e^QsR`VoYuRjZDKM%d{x;>w4>Rz-* zk}i~bMU^)~&!WmxoAp}vnr-4erX9;(67)N81mq|Sb|)|_9Sm=B*mU{&wR-8iLyrFP z%DvaZLfa!AQBuKad zN3tYX;QBMQNm?>1#WF;y#Bik=lq$mf*i2XjQe3i zqkGm~Wh2aw5A}1PIzfh7slnlKgBgHDZu2!~PU}_ANO(_}tF#7f&M-IUWp2S{%{=Yu zywZqnHo1Y=MX~qpDS}?B{2y5yijy?8CUmbo)@04B_&w*0m1qV9dksg4Y`VX_pya<~ zZCVgA53xL7fB2E@jDUbYqnZU%K=8uygX8*yz^_pYvP^{v!P62*e|@HTSHb1 zV^AMC8o7_F9P<{?T4_SgLXhlqZ5&TIzT2t-m-FJ@p@BtPb}|tT;@K2fZ_>C*}50MfvHa|=*oRp_pom#r{XZgn-rH( zi~H-5!RXT!1ah>zQ9gFWGM7EUXR5o82>8E7X*uQG`5bIiF;PlHV82E)+kD+hMo2F8 z(;p(4S$zKpO&Mepz8X|S!8*cS{~z++Ix5RxT^oNX0YSPI>F$*7?(Pz#ElN5>y1S%X z8U*QX5s;P=DJ7&qKntyPSwq`+7Gg*|5KeS7%+%z-=xf@$Db(xk|;gTMHz=PLhWM|Og( zi7FGy8w!=F)OGyb5h1<`5zQQRshEmN)Z_Ud$#{$jG)*j_Iu!dSYWz4e#q<3elCF33 z6Iiv!=R|05yk+w+7YV+8>3k(K6Btf#aC=G0Lg{BjdIzBFuZOd>alR@!5{nUtU z#lCn{NG5`Ws*=T!;^n)9F><-4d}2fR&5IAjUWYF0O_p&%-N(WPWl{&(mEx7AdrQa8 z!>@=lYo-xlqxx6&4aL z9$bwL5t`$VW~JHQui_Swi29thS-X?G9p;(Q<+?8ROyRK~C+B5~9R>6UNR{J4+?y_D zBwSQ-Q292bPDSL_ZuPzK8T{}eAvbC~ZP1zYL!B8|PzIvybVgm^v}o(pm>D6%#rRi` zym3qflnqN7v_6-AdLV8a4BDSDJ8QMcSf0CNJ_QbU@u$sL7r(|k=S~0j>Blq1U*O4` z%&j`8)L=a`+o26xU@rkOmnI(&N0<6)x*Pb$&|m?JASmB!#6J=aQq(bS#avbm&;yC9 zE&tsELIBiDeuBj7bsXxvIj8v7kN@;EkcuBzv4%3kY(F_lR-WHX3%tK@;(z$rP%Nw) zbp-Ag{*5>OYc>D72QUF1SI!&4biL2?zQ})cumU-9lkH#d+9cq~S;G}UaJ%Qm%JLWG z*O><<)PVm7s!HHQ1M3owQ3C%LXIq!T1W?B>{|o9E$N|FfhQWTpzumx-D1LuQ&*-6w zL&<1+Dl5#0l#q8X5#x;O0&DYV)UclSbSf58*pu7;Hy6{IK+Z2U`~wo zK^klUcEt=FLO|xDNviHJLIe-Ion&wTcLM&u9x$T+H4`|1-Iag^+$KjlLmI&bK4^w34_>Q^qu2RdZ78GCt&13^9yTmCjFbq zriVmC$!aVMVW)fKH`&90h;l;|XMRI=H3TAZp^sP@|HB1DrBowFAV)PP8?(J^atVH9 zX{n%-qcr&bLqbG^^Prq+a&0ZQefomYRo;PVE+*^AH&A>8IdfxFfuX`F1&Jg(rnI>kkQk|(NiO|OI2S{@{Rl>lpPYG{Jl0s-dp{;I z5r0-?lLg!;N-oYZMh^!DMcqNk9+(Zb2cj})D-VVp2Mh1O^9MWg7o;B2*$^KV#Q^-} zqZYRkxUq>GwF*Uv!Up;f&9UFT243bvRLfe$Z~P7b*=;zmK95d_`iI3nf{)M>@ z;la+3_meieEe^qy|3QkOE(b5<8w-qv;=%@RB%UrdX-`+0vXQ`M-#vK^ii`XZKxoKi z#+Yt%b5jKQY^${L(NdeY#v2Wq_MLQ6h{^%_{GpAtPkziEOtsEr0EpkFZ9c&l-(!Yf zKL{7Wf-C|cdkh@(lV$C_JJ${O!UXI4Od)ybfaM$x_-+~sz1>r4>J1# z6~`o`Ks;j(1vCE=;{Jz`0i94OgGjFrfX^qgFSWKBEt*7V>NQq}d&lT_dqx$2$d^x= zt^@Z%u&Jo&=wyGM?g4~w61p9wsqai%yZ zp!~(E!;%CO)4nYtOf7@&$KqKHytZIpVS%*IyP_OoQNRCg35aAU7-rO*3x z@f-HLPpzKy%!cojc%RHY(z-_Bg_)D7jy9i68v>Mr*U!zOKIx5nX%C(~jW_}LsDXt> zr^qET*98ZSMn}uM3>}6s$!~7Js1x~O6g)XI7!w7YKNxYt{9S!CXeGQ>H)9g-`q{l7B~l1noinY&`mFUN zsZ6iB3&m$c$XR5yKbr84l#OK!*r>#-+mhclCyIuWSPb*s4punLI$(K~X7hGr|LC6b z0tk2k^S_T|%qxJlL;i=h``yfh9NZj8zT8N&pbwVEG%oV)gZH4#)7mk(wPhqja0ql_ zVt#8qnv^3M{2nxLTHC2#g1YF0K5fhuN4s)AKU}|$04~WKYbW;scMh!qr&OcW!v%oH zN~WSk(kEu1?&mIBlN?{U+z%hEx@06@KfX^ANA%!nIyS)=i$$%1eAN?G;giYzYV+rS zN=-!0B_#!&kbqbfbI3}|d_>2^1|!6Nm>*9BZ9Hu5ZYe3CVx)*Rsb#>9G)Ej}$A%6W zwv0e%EZC|<;#}yzsa_6Hbx!tD4nrA6?KO-kda0JgtZyD5IQQ;}eSq-S;n&t$(;xi; z=W{S=Yp=ks%>txB6FELf(x2@5^`7TH=AYeUwQ|8#ZZ7;h+zi- zN-yp^uJGytKhD2pxsoMea8dYez=#!#C1CI&j6~Q{bnsYW&hU|zS`;uiDf|eOTwFL5 za)Fn9oF!O(u-w}+h-0CEVVxmnL9C4;22)3(^52jGuc~BMqoer2pdYtb@Bmwvu9Gba z`R+uE?@e0_!`X6*bG7qWtEVd?Xz7>e_OSVVfnsuiTaFfNdDZgkXck+PHqyswpKERWHeSFJ|WI%F0GpAescM(fz1!r5a0YVTmaP72Xkyw~Fio zG=|iYKqCr2Gt3ldgk0KajS{fV`|Qy8tx5%f73s7MB(SI4ot`EliR^Dos$qQ}daqX$=01Bnt(mHd#fe6pji!miA2!MEtTkJd1=iq?#wH&V$iQFVx- z?T;e1=#pOfzuLp@B)yvoyD<#E8SWKrmVj|M7R21e1@mD`+F2*{5=Taikn=lbx}n5H z#G=wc=70HTasohb#oc4u>fjGuc#%TO!8n>@aQXarU*z3QK(e7c1JUanaJirk8b7YU z@w(=y^ zQ{)}+A(No5TL_61wxl9Fv)_Ju{n=6)mRK!y&YkiIy~fjHH&3-or~7>K2s%#+3R z_%UlOtsC9Yz?a77kW0kn{nL46+70ymqBV5y(uNCIm6DYW$K(jYAZ1*`*j(|YKWrjo zHOl^ZvaQ+ZxK2+&AugnMpUWy@3i~9Yl=^1ImAvS91}sRdQw8c|Rsg+_xpS8nufGE_;3(vmX0D(up!4~mr8XkgE)h8@&BA(~bT~m$ z&w1xPMbgWdsDdbWAGQk)+=__chsi9UJ+4wMq)$=BU=CTNR$Hn-w_Jay&bx2%dM&GY` zW8OfUELaDp{?;YrW(1IS(O{r+mw-96$27a{5%d@BKa-9o;*dyR9(F`>U6hlT&vDtF z4*d~HB^#9wte!s0S{cGXvZ)V)fQMFzR;b-f17hC`tMt@Jw z$7k(VGM$~BcsMweU!97gfddnEvmQSB?i*&5yLX$wi|=wgc9U4XNh^wIM|#&Equ2=e z*ZKzHEM|;c5$zf3j?Pvp< z-qy#QR~rKlJ&jvE5+PgE6bz(#e!zJ7Jf+zqUDz|}akS?$>wO{BII;W&;GGxUxdADuwu)eQ@4T>$jls81u7}#p z;Q%YjVk)JZ3{AwHGVL9hh|Lh;*c1&Iw{d1jAqyDy+@ZAd-?I-7{w-7Nf14kCA{-_5 zVvBpcN``|LJmIbSDS33hCe0eX?k zC_LKp{A9*dIyla#(J_>jhM07H<-K10Go|iOEHUnY@Q)?Xz!+5!CsM$`BH^f7N+A6j zhTF+a3kGJFs^WC7;JeJf%glC&8o{N++$e{_}_ zu#22tyEZk35=~NwaMav)eDLSBpMAkd2<`I~l|yBHCc8&sg8Xg_k2>;6TJWxjl$U3fy67 z8ij;?dV0}&CUtiBNQj7PfP3?BgdralPKtsa{YU_Oxd|H_&hwYxy9mu57SDkBA9$d~ z_@RL>ZGfRkwu18&GNb5+XhaUq5t1I!mJ77kOyH@%K#RxP(WM3!QxLv>Zz1Of-1YZ9 zQ~2)sV0`f5`Vg7|E$#mP7*!gF1qP|mF;6dRrfh+ts4~Cf+Q;Ll>z~^cR}Oobe54fQ zx~z;^#o2}1w%F-6h8{Q92nQkqcT=JdZz0-LN62!3O&u`G7f<0wR75b)!v(%yXf=5D zCphJ~WcFoi{9qiJTvCWv&^e0c(K$>9lNlwZ^!EXC*ytx=a);*d4INut6uf$D5t%3i zlw6NfP>7l8m&rF=lW#|12VET@>|0ZLXzXvqzSJ+Vs?TFAaz$uW80p(B6pOUZmZ2sx zYLDBczirem)hP_RV^Y+2XM29Q&Nznb)3e#8S4n-Wd6ScZI&3p1fh&^une%Ak{DQ121m)#agHO&PfOUOZeL80qY-z!b1}Fj7T3$R(!L z!`4CoBH{K6i%El|No;^P?FWQ+Cz~?g3JA|8h~Om;Sa&IeVw5+~?n}#&HoF6f8OA7K z2W?m@8*hPqf9dLk7V}86m{|m~te~~NVZnI5HHtiIDfPTtm4rhlSSU#GJSEGI-HRG}j@ovbA3)@>#b8f7G?hL{f(Zwh_|)fru>dS_CQ%4*Jwr$x zhb538NE8sq|M$A$kGiQu7Ia^wxcau>{qu0k)cJe#O_-P6*VCe(G)|gwjV;IK4i`&Z zx`MW!H5WZk@`jQt4J7(mGgaAIwUl=XyjU}hR#Jo>awoFr2Hh9-Q1bEN-(2p#8E^AO zw&{IeN5IMym!ttMx$0TsdObuc{9{klhUYZ0?~aY#Bwy*O=-JVpx&`f6Cfkqjlt_~4 zypJNn#ZsXwD`!y_bSmQ?^pBX0#S5h(^S&zIy)er7;M`5ue(_SG`&MXz{vnZ|6=E+P zGiW%_CU^8rdIAKqwu?WNS6pZ~lgqQ0DNd3r>rasoU@IZwxN^8d9h#D(2OUUWdaYAmAsiTwmSf z;nKC|88^38ZTZFNBgYulKh*@ZCFTWi{jL&Qi&|>_E*}}I9;L~}OnW8)shZ>04{zuR zS&+qHV{sKx)gZ=0xvOXkDeOWwY$Iu~p|t`+)zW~*&E+>|&ZY$Wma$8Uei%~i_c#dD zpb!rKA!Wi>Xop7;p%u%4SHsw`6`Y{6AX_#MACLLDP~Q4_z`3(Z!m`+(IcdpY0iH4G>OnSL7e?(FTl`@P1>}%P5yu2bfJgECyVxZ` zh;1IiNsbx_9;HXL+<*9RzEbnD06DA%-CMwKB@JJfdwNRz@_Zw|nE3d7n)Fy_=&M$N zf^=9Wzv?}N>KDqCNchY)goj^;4UY${=LeRSqUY*RbI5?s6FmK1Ai8@kevY@bU4RPmbEp=jxwG!@)JOte(|hyJvI-(6I09=ZkGt( zdi$T^F=+&R_Ik@e%6E)UD&(xUHsECHE1W{|po~qxbAavq)j`Dlo}uV3ZdY|?X~Irn zA#WbBR-Sz6G@Yb-oE;g_0s8xc;&9;~fTZFQEyBTue^ zlqHl%1nmMCJ;V3xKQz#fY3I8iJ=nNB&$0!b5{U1cb`Q3Qt|I(A6U|Zw(WQ;;2cc%6 zHOk2vpjUGgXh=)9+!!El;-vuO9|lw9xGqI(oN^}YzEZMPLgL`lufzJAw#+mI#mx%%`i<({;zTuhC znN_VpEnH$k%=fw70=h3E!i~kIO10}ecEClnMGSkR?_FTk~6@-yRI_-a%d7-IaA*Z0H1d^6jErnVu zF-^GnXylr`-L?fz?i?cT3vT@6s-J%F$J|&?whs{$n^mrN;*FU@YMSmjxrhoELCWuDt*BM%u>FHW2h3|wB0dgq>ye-x=Ig-PD} zYh|97Y^}bW+c3x71@|W38t_0G1fvH6G-_0cE4~7@|1Q5s@+vh_zkSHH2U>i)EJIFKQJjXYNTw{sONq1^9=XEXSss9T*5#D+=^D7&)^DU#1>2M zT|7G|;->P5ifQ33Q!O-?zAgAV_k8=8aT*2d0EL3J(8753>4}qq|Cn43q5lciG#Asl zEcbsJR+ddMYGQmYM76$t&eSqzEOu6Zba5vnKYqza6mQBXE73oq8Cr^u)1Amo;X8;)4UF#!eAQz= z&VhZo&qMLzcJ^P{pwQa_n)THiHb;$D6m!z93{DK zezD-}i@ZR#7Y$N5Ck1GpXtK3OQpeiGN8tm zwFj$IOB-=!2SuW^%01(0;N+E~QnjUlgH|k$TU`r9qV`=Ol~6j&Zd{7F9CBCE*jGSX zLHLj~?vv<~K3QFxQ{(L@e1*3*Mjcr%>UuGWe$1iD`2m)L<|UVHPnQ}c zGXzcvF!LlYeq{SRY~3Ns5WV4Y*_xB}@>ZDS8_V!xJ4di;Y@kHqJ72`aBjFvW@bpig zN*U|ktozcm(&;{u&L4`D{tSbxV3X^c!C{CYXI9Ex(-FRTS~d=kJO_j{UQ7QN_k8=M zHU#dK)&q=FL{~%i?O`jeci-QtoTA?Xk@4O-rih-H;EUaA#p0Et^*8o2^=}?t%}CAM zo!_n>(k*_{T(L5Ac>0nFeqf_I-gaiURVPQEcCLyy_43lupp7;8^;!5rHOTW4Zj1p> zIVkdV?-;vRwR6pH-(iEmOcfF9`kCF*erK*CDw>78PTz#4YN9g}W*wb4O#O9n@`^a@ z0LP8F6pD*WsHDXrp;!lnx$7U{5*1iSZus!3H0ZRU>L5;qfOU-Qpe&;W>uBSTFU|wf zO;S`u@#ap7YzgNlH#vYVRteLU@-+ei5^;QwqwSVI zWC+tINg>L{1!}xm9?R?R@yv)$e5h`@8_WSxf!al+Vr#hw;dl1Xzgxd#aiLodZdo|- zBh#BVxpa4!oJ>8QO?raSoSW}DlVV4s`y5^VarI87nWvG8RU#P?woI#sb2Ym9dxf-^ zRFLv+&>YkS?#$H%=J@mz!5xidj{^rv$A|r`8DaV!*k7o8e~|G>+0Q(2{)GK#tP8XF z(#eu#bN@Oi%5CNJDyU9g!b9z_Eomv<`BChSciT@p<1}6u{{kv3vRLQSU9uiy#j{rR zDl@oJhSKTBRrl`Fh&Byq`|RE(zjRmY$zIMy!!dQTZda{r{Sj6=WY2pa3L;PLpu2y6A-CwpT4`IG&;fZtqN7a=%8w zw;@9lT}HnMQZ9dk;M!V=wA9Jx>+iMafamDo4Eoe$IqHRd5bzriOsi_>$`DxVfBpS) zYqCsahEh}j;kkL79EGTYv`5GH;^teU!y%y>aF0GO5Fc+bx!}EZMC@1pOuS=Vaic1l zQ8Ze=lON6d^d0)q8b!i#YH@#@z)XEKR?g0vf zcgEP(OyyEGe(CgB)5+@|ED;II@5R_J;u7-C9VvQ$Y*6ZM?L@)4NZmf)6;}6ZUmgna zB!drOYVPQ;0J)L|KDl8UAPb|ez)lltknjlKudW>eVr+;&$8CXP9>Qe{+hia<2V!E{ zKZULSaaJf(#mT9(55-L;0nr7F;AJYB-~g8@fNf5Fy}4k1clg z(z8HeG(69=VW`hPMQ^Tl6W76X2*-RQkTJ1rcPSBr+%czr3V9at)Fp!=DR*ff&UZ=; zUUv}f;eLq{zGxScx;s;u4YI;xz9O>{6Q8r5oMbNNWeB)#GYJH8KN$}xRJzY(^39r> z*;^hyv79^icsIX-{4&$Hoi-NSYFB7eGJa}l)oB#jc`D@e!z=uAKzCfd}WfU5rINHjN0EN61mS1d0lAaGt{QYwj1^uFQkGICq6_Ndk%0VAun}!Eq*i3wWW6F$nPdHNofiftJZ8VEexzoiy zT(p$MZ$KL5TtGwQ(1P-waLl#MgcTHqqLY0TP561dwG|WVm4Rucn&(l8G#?r7iWA$f zk%tgM6-vb`0&*jHI+o!z_ z!&V%)mml9~TGKPv5`x^BGtp{tc)Lb${e)?JRAk)e2L%d=`PzdA2@jtAY)deeA1t+1 zSGw1#SI)>{EX1a%&XBiej1Bx1wuYh6$zq46<(oKi50E8c4!G%Kh2k&{1L>IPW=KgW zVjLYqKFPBcy-{2saG{*wMi0pOf8bE|4Ki+-AG?iOA?5p;Z~7{o(n3b3f*k3!Yzo$WrX}xHx9S{`+ zIaUq}x^Rbhx`;vomNXo)6DN?m#i00kzMc>2R+^IuHWYBmsoY72x4z~bjwWIsoQI?W zWlyk|oH&%Mu{o{^iWU};w5p+nlnow;&Uk=2aeu7vdo+@;<_|FZE3 zd;UC5tOGM}rc5atIPhA8Vr!s;j2y1dmAjG3IjT0dO6R<`;XuOUkxRqU2u_>3_!i3<h3M~c)EzSiv?`bzj2{T_XG1t zmTKayFr|o+SP5T$JF@swucuJ?uFfZUy2HB~lz#gjua<~yQ~PSP23LCT`Lq|SRh025 z^v@GQ!Gc)9358!VBF@8>zZDle$Opp03nKOhhf6X6PM#iEaj0y=g$Ryc5IsVi8f3*K z)QGJ9RX(nSIwv1@AV2IS_rX+GNm;+RPpfn4T-_e+iZn)Oc14EZBa(}SbF|3U`Jo!In#Z_(tKFYUD;;c*biNO}D`%ap!s z;5aKyvZe%!-3|Zt)F|t*yIa{B5uwP7Li=d7gR1#hn^nBq*wW}I1(}P2g5P~=JWowX zPTHShrS@`4$|BM**Zd^<%;sf;>00CPVlXcL!b5+Y(V&G|WP-i2%^*2)}0 z0@E<|c2mdTUCd3k_?V~ zzfX@m&vSNEe2p!+xmLfVDJO?U^1uTT01PuE=9~#+lgbQI#oQ6#%L;q{I83f@V{Yxo z(s}=sQM21Jc0feykEtMSZp*G-%`G#p#^UhaLKL_h=1@>FkY4SNz;oYs`Q9VHB}zWd zKoC_;Y5PW-FyIw(d!fFQNUbwbjDJAzNnyQUZO-L+x$lK3j@Y>1E2XNfnog&4n<%hZ z!$xk|>(cPyiSZ%ts;z9qDUxUwMHE>nljys^V!u9@4c=mF6ANw=U~WoiAuvidaj(Mw z8QByDWS@pn%zaW}Sml|Q`_}aO6T9*J*hO#tz;HMdiVou^0MH?QM95n0JQG8A_@e*a zcb|?iv@%#|L51s3NnT3pDMQ``B9p%zgvXLG!`6Y!B6nw4_AQE-q$HUKPZy|t zeMMJ-7sSN_dt&JfjJ>>+K)!f$IZsxL-8Y+WoRZ1(@@TevQm`j0{9=7T-2LclUA%G4 z;gxlr=jtgM88Wx454yMa+1)T>A=P_{x$B-m#GvnDd~~ zBCqp9D+3%K)31j|Lw1&$UZNn&p2zt^3>1?qFl#g+9pb1%ve8u=$Z;=PQYqT0T29>^Jrcjyn z@Du@wB~j$s27i6{HC^da#pnVVVhpo}9SXUAeoVt1f0)1WU!2I=AowCPvVRAz28`1m zY>bMZprw$M`MZ9w8kaI8*qYo!#o#dG!mlbp|PA z{rnGqY%_#5QG)OrwhDn#zkqvCIsZRK^It!PeRfCkKTqcQ1tfMDyofjqD(Q1Ua+X`T z1;JY;K)guz1 z6=Z?_KyRf0WvnJ4xe+Az_M7WwBI8;cbwaC$^e7wufs?u~>Z1hO8f2&QJ86iC`CYtZ z$3=98isZ-xdJ@o?(UJ@m6M*7Fgh$Ld(5WiPks>FBlm`fN)Sz=WrACSM2T)3sB$h-V z_U`elN|tw9MukzU4720DcFiNy68$`ZsnSzMp5oJz?ym2PzA>Q03y_ONdS9zy;BIt& zk5XwayV;u5<=eO6dY;pWOFV@RE-jzZ#Q!?0&%6N#hI_xGTk9`C2lXX0gC7(ip`s2- ze2J+5UNx?-kn3*Cx;?Z1hjeVq&E11T<@8A~Lh^(MHvs;^48q`E;SM;$qYT|$^aw)x&ST;cD}b?LQpuU%)>Y;sRAn0U}ls zx8Ai`D3zleqRZx_h$N#Bt(_e=sFHjvL6E!hs2mS)*wb(OO5d@@Fjl*Mv=bC327POu$?dsmmt^z!%Cz3ZExcQ?^bGz($5l}r6_}<^{llz^il)vrD zkbn)|);`Yg1lvNeZsfM>Z8&NstufbKIQWpgNdcw>2E>>$HR%O}KU?vU3b`UGIkWF` zfioXD6@XLE^_@7-i79yLe~ykD;l`)b3F0w0p(oY*hovV}(~?2*7~ z(js?RRsMLkMyphZrNpR_({d~P2ibiBseYOnySLm;F9gCyZ!NJ;z!Y< z*K)vSVsV7wGs&zEB^QA^8|G=gz1LfJEnJcV__pdkg-l?aSBOPFOhbq=Z+8oxQE-e7 zBFL<^p=@7UOLdwxSQ58B%(o{{UJzsuhyMW&f}AzBXJxnkprJpL$5?`F$OfUv4@>zE zM#*|Lh+WAV=aRQS7Z0|B>&7o6V6jnQ4z>^RK{Tw6U3fR=Onkq|Wjo;G@`gD!H8=Mp z<>M;)xb*bL4-%wf03<>Kz%*GZ7aN^|0diOolT4(RWVC-sN=8NlU`iKBw)>uJaU#Ko zu%=Xp{7*9&|Cb~37a2T*@`xDj(MXGQ?Tba3BH4C6%HjUbeSD&n(E2w(}Krn{yer{D91(%}lEHr9*2~$%C_`iB3O&HDZ^fjc? z0U7g}#1(0-u@Tl4}i}=aBx;)+{}w~>lO|fM|W~o7MXGy_uzUp z3Aq{z^)G!E(+3v92AybG8(IkMbd*94aCAu!WZblYgQ1R3=WnY7maNYY+e91Ek-ed2 zBv3Yi!z@5I5iG8@10~U4l^7?Mge_)Jw{g|s5S@?Hz5`lpr%1(el%5} zNLZp%o_2Nw?xvyV<-OX-i6Rx$h$P`LA}PJxJthNSItVfQ8%r9b{~0)rJ%S6>C7wVe z4gGiCwm^P>YlDUMDcHRZ(RZ!fA*AQt^Zt@Q5d9B_P|@!5a+LO8l&~tizAVgkA{FQ; z71_4ARgU&^)9=~vjZT`Cx?7ec08`vw{8kF)gVOS_`<8&uB_Gd|xdgz9pcZi6A7f$m zdwz;RAeQO#)7E1-kkIB2pg6pNBDl(Sf>ywBEd)z`uGUu4!NEb|2fbz?dSGxc$bHWC zJa2S9ygVA!1Q(Aph=`bseKKkF&|e{{h5<~X9{$=IRPOkW_HO`ef4Mw=xe9+V`<{q3 z5wLMlb9z!y2Mv6<{2%G344yw8AG@sC06N7EQ&w6p=1bjj1L-B-8)2X+LT+K)gTVR# z)d(=SWqLwx`+k7^rgACnU}HlM@Sr1GC$Eq(#{s>}j{g=dz`q0)$kFr!x2&qWGoTJAVF_ALQy3Z zC8c~a-^*A?`(a~a=D8s!#bM4d&W{LZ;XZ zow=a_cDO$#NJ*A_2!*`*KprnEMv29cJ1=x~X{Z+KuBw-00opC~9nR6&$nAQ8Se%he z9MiphC4GYlYq6kenYIU+KXydrVkIey6^nkDuv{0E)(?!b(Vd@vqi#>XkYk`{|GMOFoJ~59N!$x}^?ok&+T_yZ&iE*W&(`2p12JS|GFv)lq7Cw(?vHJGP2m=m6ojD~2ijBD6QvK=P65*2d(bwV9 zUYrnA_!4Zl!?jSX+fHi(;sCZ*(ko4l_0b=8V|1{;EP3!&V|SskP7j_#T#V-zv*YLa zxjJCZXoZK1k!K^p5s2yCUf(Of6eb`8W*}uw&G(kqXM^ z5?EPx+MQA|?pcQHu8Qm)=EDT$!N@IWMe^#}#HC0;sc$PEHVE16{ z^85(5o^O3=fYGFd52!>#0l(wTiC_RuHmeJ|L`m_v`pIy=v=^IQV+Mn#gxm#JTo#GP zhB7D#@gtm+VpB*tFPt-|Bh#K0~HRjxTA{l92qMq5%@O}*iL^53!e~c z5@21%V(Bg`Uv|m*_X^2eHF$Mlq@=uQhu>751+uojDAx65)UJxzxMeQbSG*noTWNj2 zFUga{uXp%`%J_`T6F`P(lPEzCdb%c0ul-JBO7Zzs-KU>h7y>YTI@I&!u;;2CB9IEc zh-fezc>SzR-s$THY)W|m9Df7ssLliTFCB0{zrP&~U_J!hr$4s1AK^ukay|;lx#3`R z!CfAqZxHJkK-7aR`*J%W$9SE$%p<)YNRN5VfwJ#w59ndndv~JzIAoM#r27!{Zdn3G zg-Wi)oflzas8yGpm{a=K9oXzLl>~>Y&^b$LuLru>hg|^9CwnBTe&3pT17?0~MhHdZ|9E&{w&fi+yMzRXj385YF)~Ln6H#v~2=#^H&}}(=K!NAjS}KI|4FB{&<0+ zAu9R8t+;5%g5&?YJ&E>6O@$vMYvsze{>TdJAPoV%Wnkl3>$UfW$;!^bTiH=JwK3du!pNpLb z9)K{+KuPJ3abHNT{@GHYPPxGt#5)6fAtyVVoJ7QnuUxO%A2>%A=Ylu1X#IN4FIX~! z+~dwR;yEn(LYAI4K3|6K?duD>Cm|t0&&Q{C=?=IMD>r8=yJUd8nxJTr@i~DI8F=!P zUd%fyO9Uw?_J1R6!NNF~GQzP(w(3enxR=ZF!p zr2z~1r*u(%ohIyPV7^vw@D3kA{s`v3;g2BwiFr>Uv(b|=f3sSNd_2Bzy18<5zYx>2 zns)f{>udJK$AkiYZtdpaW-t6FpIc^Gu?ct~ZrRE9Ono{6BcV(_s!)_*&}6yc4C5`J zT$5PxKzC-yRpZI%m7%x+HsTQ3t){9*G=SrCeSHnFHV@i~jdd%GD6Ww$!N!yR0FQLLm~)zF?RpR%K4gs1 z--{CfZxB7Z|D($FFGu)Ktgyf8;yzp!ju_}SF2-Z0Rn*bprBi#BLf96Ce%IpUMD(Ub zwm-T^?doS`qpWT};EFj1l$*T)D)Qsbd_7D5Tly4#iW`uKLp1FCUzFoee*9s5k|5p} zI#ax)^!nW4l`u4_8W|IkLkX9K4XzlDrx&3}Wz?dV4JRC_juVTz^vYB*ZdPhFd1Ea; zblC4F-n{_=oZLTgd)TKbOaS@xF3gl#Bg=2R3-Ne`QCH)gK*sXXtg`zANO0=&W+{`v zhm0nDPI!O;*OOp*G@B28{diN^ef9tKYll@xWZ8@_%jaFk0zxNj&TD$L8XcvzEvQny zA$rNc9_Hj3Mzc40>`(B;ITsOF?IzJfM*^7RP zduvYYwdkUPX3=o|`BCm0tKnqsJ@~F0kp|zJn~kw}x&$`W`|ql`A)g_$4vD()@$ih;WUaXmSob%^@B%!LV{9}>d_=sP}$zD5YfA)Jgwq&$d96Nnd? zuTjSH7|dV@*vCzlspsRCi;vp zhg7VyoqEN|capBs5r68<;nf#yLQ+&RQ3WwE1l&)LQ9xI^*SSO<=qsc27eSb`pSirA z7`6LfpHvp@Bmol_UhCCMGIx0XqIu@??x!SyT6^VDAx(qm1k#GmEN}}NvC2&4jY_F* zk0xmT(V7&ViMG_@9?pC9jVml%wZ<^%)Nn?HwD|F?b-79SZy3A2dKzfTnuFba%Wy}Z zAP6V9vL;*|pgpL3yzvSM*; zj$;U*$2P7fdk2VaGCPFG12Uk5wqr*@z7HSnSfU}q`?J) z`c?Evak^#L4~8+j{t&j#2@vn>PUFKp8W2P%HcXD93^(@tF}A@Gzi~3-Z~Nl|1Lz$3 z;!e#F-`Z5^jLpa;(N95^$XggFd7PG+)#yn*s02c1=I*&(=iitskF0kAUW38Pp=Bby zNI64HdC6wOIh_FEOhgZ|$!H1b4FQbW9wysf=^FV*vFwuVI zG|4(UE!~!fEy7svA@xjtCsUAUS>i(Scz`4gaAmxBpwv%1t-0-A_!Puboy-r_Gk{V* zJP&(x;~^2-QYK9U5!)ye9e_K*;iQz)K1aJ;?8^T<+3I&@av@vv+>ex_f7UUi#a#@S z$U2thf4imFJ+7sw>2ymrna#AW48Pe;r1e;XXLx303vB=?W)N3KbJo#v10X3eo;Ay< zQGndAhX^z`mtR75^) z&D`crK2j<60>Fi-8Iu+CcQQt2P$)%M;2`cdc zj+D1dnKEj4<`4FLW%RNxb%JgJjZKSIB-dsL@MxC(X;yf4t-9gwecRX>qC>(8Voes- zgI`vR6J65?sYlCq_C_IBkbjsy29}G%BQPcl_**DH{QvLv{hzGof8tapx>qn*(~hwv z(^(4?f0&5h=>0}#=P~gc`ys1ezPv$%tQtybB8?E2K(l?D@%*|qoH+_eB*?m#O;^mSCjEuoX z?_*psV_k1j1T2L>JGueJ%oeJ_OZPE6qxyFfC;3mMTiSJ4qwz0fedPB@=UbU>egeLe zj`0&WW^gtw?vo!y3a8F#eGjfeD>xF;)GB`i%m>)E3Cv%1GB+9g`~8>vS< z&!#Jl9 zpm)BwO&ZrI?CqZQ+^ax!lX{Qv3{*t#AwU4=cm{KWmOB>lm28~t<(upON^v@EdT?XX za2d1T`G)I?>yo49bk1{Ysxs5pcRGRmQv0T^f4*hzYbu{h8y2Idj@Z@sYhsd{FK%{; zz6RnUK@s?f=w9N87{quy`_tq47&(Cc8k?T(G!A2$`jEYwhXZ!0E0*>UsO4h{Io_Nl zh90_1&Sg4CRamI5#q(Bd*+-3ir_@IG^74~Q=aH2s5z63qI|#DA12J3K1AV+NJg4Mp zysunjv>Ifdc-0zeliPLjl#-P?U9d3dmD5$24XTW!6t8I>tYraIcY5qE=&q?o;;lgR z;jhov7ZiW9Y&621j9EKr_r1JJc3^Z*&rI#ofp|hjjgx-PWQB!>lT#EbnWZ{&)++>5 zBxK>q5BxiQCN@Uy57Bm-AVBnb*=mqa0-X+bke+J>Nv2DFrVoxg;uR~*7xc4E$4?!_V31eIfDVI72p*% z5TJqraC~bZ z%>mMSAe6Vtepl5|lU~J`S}xy!-@n-5%5Q7r3tEOMiHd^w^}edf(8hrz!DK*oGj&=0 zMY&47{$BAU*))i>dP)z%-~eW%_lV9|t`3J00#Ev8Fx99#G?%~JQZJkkK3M7CPK_l{J`?o}mOQs3RrZ6Y z^zogo_n>t*eb)HI@&F>?mC5^*_*m77R@dOWl3#!Hxqd}mZgJ!uxM}Z&ZGev={hAd3 z+|G(LO2+2veuGBUE?y#nISRmlJ54tQYBK9Qn8L(<>8KnNMxIz}g@BoBLxXs0i6Zg^ zJ_eqD(afptrw>Z`nW=B75+&nM$olQ$T#BPZi9DzKpy60SZH`7fpnZJZgJQD-ex9HDSuU1>P91a69%tRV)f)fC`>hSdSf{ ztW5h=LjtN5Rhojxc%gy^$1FVIv)2jLmXOv=;o6bKdj*A;_%kVQ2C3G+-SVcZGcksP zGGp{kc&^t4M#whiP>a`@=jV|x`m3K`-wqf~_nCE|BiOxl7=qh9nDBznd}o$boNh`E z7R*@QKNgkHN|;C7udp0@C#zl*6hSpaEfnEb>)OgHi-!S(wHq6Swr=*{i9eaIaMc6- z)wQw0sgXKkz8>3c_vRVCBHda!hgIfMPp^Hy!OSv$$F6_G+sXsHEj75H*ob@k9=0Q} zO8{qccXo$((EM?lC@9m{h6k!p$zK)&=IdZw*CG=!`jVuNZ6QUVn8IGBxEU~2gc3U& zEmbx`I5Fp|?Mu5v^dCZERZ7aB0&^cHSivV5dxHXhJ4EijCr|ed;6dgqj|(n1$&5EMXHrSip&4rj`!V zr{ZmuO1wlOyw=h%lZSAU@3TE68P#$^sou8Kj0O`p*G7+PM+%W%uOx|gE_fsp3-~K3 zHQ-{0mRU0sEGKH7U{Ie>3E7+MHS=UTMA70mO3wQDRIZsVZ78x33SGy6f&=T|H($&n zCWHYT_VQj0UOWbSzwvgb@E@MoBvg7q@*^Z*C2f?5QEh>&KbXd*rVt6D!;uC>%rR7p z4cueQlLYa@oe4|Y11y|!(=gl-2!Jh+FdO8!|HJ6~Y>28VL9G@QiIjTCMwlw~^4NpX zT$qLL(sa>cp&xl)mW6Zowb8a?6c?E=8js60oYVT`IJ@UBjUr!g*y z8jUp4j_%R=5&N+&Nl_fOPGw+SSe+~dI%Ku&J+3_I@`=>t*LSpwMkVX@t5xr;9r8SB zG2a;G67gG`EyStkpsUXc_9Su9k(LR<>gbgk500HfRt#jFWuy$aQ@TmAz<|Tqeo%%f zyG%Z|99HNzto zMWUah=PDue8 z78$7AGlK!|8%+T|`yC{K(3bb$D-2i>_ue5%J%(nwA&Sr6!GZ+BCX5yJ$^iT*z@069 z(beb7_P9x$&2JiI)K9y8*v_b5&CA@fx4$STm?RLsQIE&e-d$_N?H;u8Ljy;;G*7So zK67}oB{h8~Y5Amc@b_vA((7@V>!_H-Y#3?`r^HqorRLJZ?K}GyHD0UeP8-wOj+;nZ zJss|cm4=i%25i(8M4UF08e!2rckJ!NQEc~XN$DP1MWuQ^pJJxYGWaG#7y*x()}t$5 z%_qKG5Kjk&)~ejnlb^z=M_==~ed;9-X5>%iqtR*fek~Kv^!&)llygi8X1-2m1~sO$ znF6tgmT9-WXrB0V`nVx@!9$s#n|>cKTdhHh0sYhglWM7It1gXU@0>~ zJDDQ1S_^{HAgH#Egn*AI?A*X{IY{$7JefP0(E=(|bt46X0#z%#DO662-&t;7lJVKh z`tXW&zK7jLi{>zulSPt7?_8U&q_X6WVR{>kFhmhaB7jHCbE-jrr@G>OkCJ4c7w2a) zjdGTdwb?c?%;k2D%Zu-_8*PkrQeXAC`dEaW%dvAj-JlJY{jA#iZ^rqzjWN2M)c#nO_>>dA^V zB@8072;))F2#7Vyeu*UX-XH@Wb_s8~&6G3_Z9VJpz`n6;>-hEcMLMqi>2fwlZok6K z%a))yZ2);yc=qg_#f~;7+)VWzA2IiCJU8#!#g6=h|65MVkoyl^1%}`AuV0fVmY)XY zUC$r0C&XMhI)+6)w1Jr6Yhx4kca7jMahiX%?5DXVC`c zR+*<-`}-ONhn{Xdn=%Mdzwz{H_c(A+Pmuz_X#rERirby8?F0|wr*LH?ZjNNXdxd~I z9*k(g>|0%mzvMA7nAWrA^-&DQ&M|%8&@aw2^4UZlXoke0je3Pq*_FGN;DU_4q1-J_*tOxssOmAnZUZ^9y2YtJaj=#8aC@z~2SB^X2b#WMc)Wyk7qejEQsti0+TCEscX9isoH6X;*&Q;E* zZww!r?IP7uDzO_Z=G~H#z-T+d6wVGjddrGR>gC~-1u=A%@AOK3zPt>IJTfB~VjI3# zTvP$NTTfR9^xvh{o(v@nRE18h7Li+yQ)%(OtfutcJ;~XwKM&4w=XExdr3}msg(uLp zw=>*`+Z*{PO=)k++8OCPC<+q|Po97ZIu|{MBmk;lJ?byfb@B8A+w|Uoo!0%c<<93= z*4YBoiLq+GPCA$JFw#4|l#NRZy`iH8Lqlx`cb#^*Pe-4J5b?_REi5{yQ8ADHFe5T8 zO;i!>_m30@pb5VjFAG&f^#vg4=b!Mh1E2|Q?V?hk!(z1`>g)Qy%@F-BuoE=S`Qw?` z@*6X!D*FO;Mt{(@Tl;rBJUY%J^rNle*N_U1qd`>r9@_)S$lR~KK^Y6O`*Zv1+AyDg zQ5UVMBH~be0{Hgp_ZISQOJbY~O_nETn&yzwv%T}7J6azdC8s>&CGAa?R31ik{{kml6W_+g#FF<|D=61FcN98ybMsCa*kZ)dI4?jCoA zMZMVeHbU^7Pz1s;n%H!Gx!TDzK9{t#%Tx&jxLf%~UDzUzp6hw)NJ-3S5{>HeK59G8 zBR+dIJ+TA^1tPs{&D4$Rk{4RuHy_5m#lY#MTLC6IREiB%@Li&Q(flFaa;mrn-Qp1n zKDs^cfb*B%?b+5u4($5Vir@UnHamHck2Hd5_IL27mra3`lQ>*xPglVM0NF&r495hs zF02Ayq7euldnY6)0}+HIcZK%*7Emtvg&_dg0XoAw6(B|_hEgs3)&ACkqM10h-68a= z7~LA8&`E!UV!fVw+Ywf=>>}{8iI22NVf}0${dp(f!`~EI+KAU*m0-Z(MGVNERd%ml zD4XWFq{A*)R>B2cHrby?GcR&nKJ~t~DzrI$X7><26b?)Ra7YKq8?(0&FFDUd?KlDE zGU*OA-@u@|tN{-FbIsBg!~=8lX#`{57c-T^GBEQ+WUm9l?#`&145UaL=~pG_^`|xp z>((6O(s%8g{NgrxOnT{d3s92SzkH1lERHJl4sh%$YL^W=yZHxl2m^%K?HGID%&*=p7^!EWAl^9 zgH@j#Io%5li$ay_XZ?V&hpTJd9p@&|n^-(BN2?(WZ0d=v&jT>9Q_ZaSj%~-^uo({X zJs_{$~jBnLqY~yM)ilQ*)b49q&2%+{e+vqd8Dx>;cAE)xPx&x6`Uj>Wd4d(86M*NwE zR2eqe1@n%60fVAC4u2i@=S>DHhg~WaTDaZO%zUYQCpb^td=jEWUD08_h1b_ zPZuV4deOzS3V2LP#SK^qCuZrhGx^V3#@CA*Nwl6WdTA9HArB_|v*HN=20JAcdc&g^ z8jpciBJ(xV4tvXm(}JI(N{NWuU|W#*yFHv7-nzizNTT;mJ7MK@kAUV8gJxY)%MLzn zcl_uN*Zb-g0RD@sb(;jB!@jgVwqOClVF8;3?f5@2`u|J3e$W&OqJ%4!V1hFQy-19H z{t6#72Y#Y7*g>RWq2%}hPn{|}^5e3JY)O(%>^Fz7TXGib8R*oEWQr^2!bu%|bUPeu z??aEY?8+-^U6HRE8ZqZc9g|`4wVG)NrFrsp#StANC{kOBwLw8VES}fg=%FG@t(4(g zWU?Wz2@+HaA(=MK%<1K4TLs3MuYCGPksG7U3-fBu|b*aI!R_-Rx`RsSO6O45_yj)c5KYCY#c4D*00ju4$ zO%E=B=pq)We%wSGwn8z9uHUC6Ga=JQF2ARMGDBmI;F$e%Zv&qQF39_1NlYbpvOlFz zfAvs;vIW2co#bdo*?>YfiLBUA8dP@@7$O`&p*xbA!W=3ukHbn{xkI7513UV+W79)l#U}U6r0SPaHT$j(;>#<>nxMrKd`m^&9 zWJgdL#U+(@Z@6NBu#x%+ z)6y9ZRSiq4tCCQnTS8Tb#}t%XN_~0N8beU%a)SZ76OZ5aQ|PH6m=CSf$R`(p#55m;<#lwUZWL4aO5?(Qr6$A9@Yk!TK^xr0fWWf`(uLw04i@&!4$%uHrkMghm+W zUq#H{o#Ef#%!67X_wQnfvV!{OkRsd(66Ged#EIgClTOtwJ)TL~*#;EDViR-@h-;4$ zJVgd3p716Rrk^QZBn|Y)kd9yei=#m3vti&z$iB?TR^tS1MN3+=N}vruA@ywrIWRQ) zDUkRVIRt7D;P+~XLEttOxZnphP?HAg`9lafhL>XZbfJSM0tcQVgsYDirU+vJkzwr> zL1-QXkdq<9y8RpGjRtk{UWP8pSo}hVNI)>T&e6x#|7(T<2GucS~M&3*8f%2 zxPRl9%|K0OVjjFhUvMiJ-=8!5=6)nWEZo?;-I_pC{w-GX=3meK-%XnTPmB=$|Lgw$ z;`1IlIRf@r3xO?=w6x1S)2I7@E~_9$`WXQbgO%2p?BD!k<$5hW0@OIEjIz!bfEq{P ze;7RlDkDn&eu^q&hzL6*X?+VYhwt)+PSgD6+y0@(0R(^)-UJC?!Kil5)Ve5JSTI!B z%+3BUas$B*6|fF?g8*Q@)I9(1w7M=ZV;chF_I2RNvQR-G9-;umsp;g?_?@|0Fj9Oj z_atlV76V)XNY_B6!P5;Wt<*{yhClA(MFr5ak0|!`Kk*&@|6&mP3!(Z4g8qx=^iwmx zP8-`Bv(9>kS4LXeE(s}=EF&WW@A)FoWr~Z6dd8I?9>tWYHQIr#7Mq1}R3an~{|)CKEB62Qe4T&8$AWMa`DWe(h`3ox zgYo>+o4%nMVUQBK%g*e3V4$1eygg0dK!S}e0;ngBH`iV%f?hRin9aoeKx~V3 zDFWbrgY7OW=34@l0T#6l3+KP1zXfaDwln_dVs6~P3(Pyz5kGf5d=?q>Rth!v2%JEX{@$h1eGheMeqqn0v5#)N~9!pnBS6hX|FCd=?+pc{gR zM+nyAWuO>}&XH2Zs+PJ;uQ(f+=3sU(S$UgWX4-JTKl`TlN9l3xFX7$C*nCl>P73G2gGzYTd9ou2n5bAUHb)^MC%cw_cC zjR1%aNSHlG2N|t58c{3*B0s-)`?Z@0B(5Y%j35z+-#f{j5zhls8=E8vrvD@GqvduY zj1CY2K7yYNDM9vOYbAgjcPss!Rey~8-fr&5y$ z??O5N1J%hzK=tM3y`K$SZcfh7 zV3y=Mc&)jBcKEgFHKISvP`SBs?H7O-@Enn~vigWAddll_%@6DuCQOjRur%{g&~-?Q8%6eq<}#7=g$7{_I{CU`yA^*_~fGApwx_$O7q;8c3(|( z@%x^kvi*JaG^ZUROJK2i#?vW^TnedQe-E81yVuOMN%JI07;HUU5ugfgT!`nkw;-M( z;PD9f%xaWJMn;a0RLZ9dCKOO!zh7~62FUnc6ocRK>7QTUe|YkL!qYDTut|*`rtoEY z44^m-7pQ*t0XHv0suQ0D=umiAOMt14*U`*fqvyFNj)H-K&yEQAIT`klEl{MpqJ9WW z^Ww?ocqI7Y_xW4Eql^CGLlyOBfJrv~q7G0Kb;IIW^#y0zTZPG*;RBsf+(jUuQgHqV=Ky8RmmmFsQPgvFw&(ALA$`(J6DjB$2%%guUiT zdjB4t+5)eoQa_7>TrABNHc|mvJTTO3W62SUA zdUs9v;2kV12llh)!9M6;FAkn_6ydV{=70!)0^Db8vgAOpgT(d&8vz+16WGSd5OriW z01uX@z_bkDM4bnLMOv$}KMKG<&bo?DM*)TpA^j+8^$cTiod_^up}kh%p@jAG`MgB= ztQzpWD}klbAfSm+TMLx=5(>HxwQ5LUe#f9Z3*hyseoeR`f!Utqjt$I>Y|eKBS6zKZ zW0~670kw|54UXyf1C}FO&MdrZ@qXGJWMm-4!le_I%lC^T_DnPQ1R~IJz+UTy`m8Rb z>yrB>@hAs{BLmVOKC0{`0qM{0&K6&~u>hFv=b9@c~3puwex0=XGA zISYjQxTGYy2#@Dw?x(x+3*Yd(i=HI2Lo|mT)_}`IxUQ})$Awm80PPk!S{oFVA_i|C zJS8xB+E)uzA%z{TuvG7R5zall>!SJx3jimPKbawk7iU3nN-c(wa<4@SP6h!}Mdd*Z zd;3_ZuM#k+;$Ov}2JS)0$aJ{Erz=K4{H2eG!2oy*mGRyLqL6(`**r>=;Qv)D@@pg{TMs0GbD&ZjM*yPAR-j1xN~BDzc7_z&}8HjKQ{I zWU$u71~_p9M2Q0~Sfrh!qjzHfFHyw@}_5u~0`3;E0)eEt> z^iw{=Nu}|-_5QpQ#qCrfF;fC8IHX5@6Uerl2-l2G4LrdioF)T!3x;Q}Z3@a@;GQF2 zH2r`-t&g8GJgWy@P!nbTr>9_%%r>W&yaSQv^#tz6f>ktwdN_o%;?YANZf7~7}rfLf3bXuu1WE|cepYVBp90(5Z3d;`fM|3Lg-NK-=8bDjrx z3iTUjSupV)0cN~dapQH(GSS!JT>0UJw$Naq2Wt8{xKs=bA!)!Cq^HF*)(z-3w05-Q z6+;pMVq$)yn$_FoM?!2JSfDnsG{O8`p0b1GK%rcT`O|9ZpI_;p>hza##hZ0^AhIYa z1NBY-CoT(Y+K?FVb^X>B@#$$a<0D(}b0ydVY3{o9>?;Y0s@LGh37UtQ)D(Y)w(49KDm2sDo$ zVhU49VT=4ySNX@q(|>uAZ;1ceZTuFd!hqAR^p*pxncTL}6-6-UIJ$>zxCTu~BOYAw04q12 zp^j;HNO6P~OvkCfACMSo`}RvNQ!&i+fA9r0I3SZRsY2_zyGy>@pBzi#!BniBA?Uix zwYRxE>vJPZu34&3#Q(XCyV_IKSI9%ibr)%`u>>rgEPglp3loFh%;YcUceKr>Po*C^ zNbuJK%e9mbzPkfwF58#XdT-q9mow|!L^=D`%^SmRua2LF6IRhFC-lZ~TBIw|6Ar!~$XLru{~UJ8LD2BYQU;=5r04_2XF| zM8BBN{dh0vg*dnvxtfLB12l!;&X~7`hOR}sLY3F2b|SQnmMaB3TEA+C-&c^5Qp*jl zb>8AFyfC7qrg{IZB454gk$BzIt2Cd6f*FU}hVzt#+i34UeQJMbWlLn-ZPX~p@go5h zpGE0l_n0D%y6Yfc={-to<9KCgSOz!{*5WSsR?m(UEc00(4Nhuwu~qrxu1`HQQV?oV z!Ryx=r`N6x(<7}rnW{w39eSVcT>bHbx(`lqU*uR(mHTzPx?bisTk2aiti5u52`f?% z3wqSO#mWTV+MEco8QBtz=3lV}&IoL+M)HFUg6MQ>#Sg{+Mg?shAMEkVSH!XI!eHqk ze*M~J1L~jCI|4MvKl^C!GD7D-_Sz$KfAZs}l9R9~ej^B13tWdu-)@25<@XI>@dnwe z)n@IM`vS%))z_H!jIH<6Jxl2dwbGt|98;y`&>ge<(A1g&ROmr!#Znm{cTKQK>y`wV z^uB#F&wZKAPC5`@W0jHD+mt>km%={0y;8bG1y~F@6Qpu>8hwU4v$sadPGAy0Tg(-4 z9))d*0C&8~@+;3(mizohcSqd|X@FGf*alDHt@BSWDPfnu*1bDegae4wZG}?qjpM14 z73Rxoq=n(QY17wO!*(L~WBkj;oVrK0PlIDe8brf-qH^WWeDyrGR6jTi>DP%dYgP7q z+WC;=;7!@^sl}w>iP0#njNp0K>8I zRSO5xW{Nn=*|y8F&mz9MqNf*OOW_l-1Yi|A4>PVM--TVoLr=kH0RQ3Qs}9}Q&X zZvqWGjx$=XXMV0b3 zoB*Z+AX;(QmHTF`xN&=k&}JkfrY-&ML1*&>CY?9YVSAzW2yZ4Op!Uj&HI3@arSU&a z|2QWldi#Xd`${e>-6Ys{Yva92=~C8s(U#@K6|7g@<15~U&iGq_5np{z0)w4_duQe- zV+=Hh)jM+V2L?0<<&G0FgCA90IX3Q1B-pR?i_`k>N@umpmDeRw_othyZgmWM7cH=D zxPjOkeY97NDeQ?xG)w?hX3x#oKJ|mwx`uYQg#e;mX1KCd|Lre$@t*p5U6{A$#}f2U zROx8mKUBISx~N1tn(?HSOLg)5sFe4%|A}6x8gc8Lr3}%9wbV~EYIeE+Upi|w)Vxu$ zwAt_WYWhD0712YLVB?Jr0j!mbNVv+efAJ% z?-FgKJC^FK8Njua4PE`q+Q|FBwSn>x3+&5sFYIgIAQWtrNEu zBeb9Ek^01Ke6k45c+=DLz0~%Y6F+NJxv@VUg|z!xK@V{w>)lAPozqdIonfGI*6pK@ z&8j`>8{=uYSL_CM^FziKvzdivL!WWf&w@(b)6ci6EJse~<`>*5=vK^yvJPSfPaiY- zj<}Axzn&18Jn573S!vt)465jGG~y@F@hkXp>JNhYyWsjG^~w@Jz@bfomr` z+WdN2Liw@4=*OIoR4496kK%ju<(#q_Ef`dy=+qiyHqmGiqQYn!1(%(PbeTl&l$G8T zCIGJDBSW(|ON|F4 z282$SD$MXC$jLRu6Zu@OGp`UahNCIx28$c@aM3~p6~#VAwh~AY9bIQK)uM#SmNw{@_9vNq-TfzlgJtI|$GjVpv%7Bd2}0)p!=i zr`nGgw~lMi>t8a4mRp=fs9&*n&rC*g1<6qNM-(hHc-|dtf10isZ^|(I9SmwO;&QJp zKSz@Ja%TV~%=9U22SlhT*Ywuw^B6j;Sdk}!M>(eOD=);(3U4Gb`(?&&S^hBCKlp@; zjsUKWQNM|V89wUS9ISmIa4XO`Lpe4h_w8)FMe}1ymP0Pp*^*pB6;AP{!t=6~O{GG{ z*nM*=fub@PFgmYlDhd~-Kdp1z=Xf+*1c%5aBPEm3n%&kaS*!v?qll`Sxy(P;_)=Kd z@-5#BSS?V?09xOWiMbd8hB(anFkix?1phgzH*@0oO4<2JWm&_t_fTB&;o#)a!YR`G zA!!MN=9PiU;Z8+T?mMRKBgluvKJ^A}X{+}*tYfN?3meFbNS^hK4Vbrf?x}26q&zep z(&&E6Q?|Um)RzCyMK7l1OvC!@aJX-QM*tp^8eKA$ZD5p9Nh~75( zYc*R7aIoOc#oFQxUgRDD?83p)4@Wjx2`}${?ok6~+>ElyjXGCPkpu@+3e2!x#T{RM zc3Mr+ThO3A@;)g~FXJ9Ls6G&!Hy64p`#u{4%j&!PS@qWK@OND}9SXoVnAs8Z4J$JP zvpQ14=SeIKwX@)YN<7(WcA(OL*s^zt7`(07JyDxEP_Hd$&nERj0M@$2z}W_fa9>r& z_U2bx1*6^zLL}L^89w^?yAh=B7my#v-2RwH<&ICSgpJkQ%HXGTE;FeCJcczzebdwt zk&X~!RC=H54)ZTx=F2TzQbgJ2r#~Ouo#mB5%WcTF@pxTvY*`GIRhh)J*^+YWaI~wik`>)eoXlRJ|FPWV-XFJ%%64#^vafY9mXJ3F> zw{mE|`WzT3+wPBGm>;D$$su5x9?(ZJ-a7e#C2A}q@O18n09m`TK7hDZ9+Z3>&Nt+% zv0qj%xHz{w-0vBc*5&kHE!J;D=k)#nJJWchpTfcQSc(K(&K<>7AdHYeY-aVQ{sKd3 zK+nzqyJ(D^+WTYPQggfmfC0Ue!R>Y<@;zTmax2RP;1E```#m$>b-9z`?Ljh+8I|!B zXX`S6m@)6Np7AC zzl-r1n}Qu~N2*hyI5ARDGwET6eH?P6)BYiW#c*ZWJvH4yzs3_Wn0ZRIN#`Iu5pghU zp);P>VaSg01}a0McDDkx6Xq@IwIX~KSNVR-*$nz#*F!R6YI!3s+9L_cmxz{u&8nbN z_!eb>P~L}Ru(a2Vtu<&H@H0DgD`P#m4P#tW-R$=)vy~G`AarsduFu=>b!nmNlVUFw z^}X|FT}xkHw#bRoOc?sH7Ng< zx#D^eSB?M8qfpEjtNqC|B&6JCewb1th5%J55If(e0k%*^V8gHB)r2q;0jRrQUH!cw z!9>TT>!Jkj>BSBS^FmvloB6?%jmOBiBCQi=WWI8{^47RThzVo~!}X>dQ=hLOFN0`4 zvtgofb+dk?YL4tf*7Lit&Cxo|>}`{yvUEVQlHnm9!|ghuUL{45E2_u?ISm}U#l*-= z1(phx1(~2uq%=@||EWK#k~tRgR~R{e1SpVVv~;|WV>pU4TMULN^|>Jr*&5Y9luzP{ z1+3VD8BfxF>37t!q%-(V6?!i4n5I06aMgC3cvqJP;_llMrXNoa4t^i0s0DAETz zw+G;IQpA%DvcUe1+?&~Yc0aEfyEyQ}eO$Vzbnqj{uU>}3DZwcAkUqW7l^NZFIJ8!> zS8jfw#ux|H{7(+E?3KIQR>P>7bqtP@w(eDqilOyJu4Dl4rG$R~4KPq^T|yRdg^bNV z5&YeKC0nTR*yrjXQZlqNo*pMPJZLwsI7`lx(zSnDOws&Rn?E=>-(E)oFhwszvPk+}z=9*eu9P=iA*`UrDQR*&HHmtpUX zao)(`23^Yyf+>G+Mz=~{neR46U^1{MiIuWGfE zEdw7E@vg8Kx?T|AWFXp5gcV9@a3nS7kRpFNWrv?07#l7i@H-wsn*D;3MVo#mSi)A3 zkCHhZVvJM47=>KW!sxL`sjF4j0(^l=#@l7LsYN{oH73>w zL9HO{4QB#a@7?bUWYIOrtTas z8o`t3^81ZPYe6*c-EaG(a{JH-+|+p?+^3G>v>YGK?&4^z+5kNdVS%lV#R5jRPj4&P zIg>?1O0}MLop{p7r9Ivp^J0j|me#F|@~%C9vz$cdat?Y%!=v_SUV`7@F_)1NGsV;2 z9c?BM!VRzozNR!nOIB!k2gK`zMR4fBBaEhaiWCzBw2cY>Uia;|q@mu9a_eLlDJgM( z<$X9WF>IFLWGk-Xa`9Tcvra~q<%!_omWyN?7F+RnfwT>mmpXr;Ae{J21f$_do?dv$ zBOAl<{?W_s10b)H>xPOqw2y1qDk^h?TG6|()_LD_(ZQ1`iY_sW@>w|&*=4eB)wc#b zl0vNp$^b`d-%mz3T(;G!qiD1}rNcb7;2 zwOEglf#Vi(r3MKW=4+i)SonyJoTR)vR85gL)03ZfeUphx>cOvVD&C@jW z+pw+5_G_llAiFmKt922Y_x`x^&l|=6Zt~hAIEH+2JRGJ>E1)HoUb<{%8=lC&VL2ro zjZ==cvKEx|URHhRBM)k;K;5`S!;{wm5qLf?Y&@QX46%Sz387V6pBkEW$Cc;2d36}tn42x(izinM_knRs`QvaAi zz_H3Z^IE3Jjo?yCFQrtNXlH3-zdYSt$Gfm1G^~Wry32XnDcvd?87DUeT>RkEw8P<2 z7WK{Jl`~%);d=pEa0G%symBS$t5G8cHt+LUV<$ho{tkeBc3f}FY}BClkV4RE3`$v~ zW52&OR5m8vJQ*(rD-Rj~00UE0yu-ZWnpmyOwdwp@PFvXG>+9=ki~CQnKcLL+>|NzS|ML>vr&ATDErO zcxfkDPMh@JLuf#Pt&umJKsZ%Y(nIe`ORHg@GDXlZLKId^m)x)I!M6H4VeiDp9+Lyk z&#pb|9GGWjLgPaHl#OTY1?^%QZ618gkcq2>I%BFH((28_am8k8VPGt;|P*KH9Q_GxE)wWlw zLdi@PeSs*UV!Wu=p6TZUoEUS(eWkrm=hXy9cdWgw_rV!7SB|;XN%!+Us?*NI05+F8 z6TR-a`CxxEjQ!Du%?Q=UcvnHDk8F2{@0vQb@CaOyZg4$AdjI~aL+OR@hugLv7ipeg zsd5l?5luJ9-!vKMRKPUv`E!Qa^3EM?a^*QZk(a$};D!reENgZ2lAm_m`FTwB)3#G3 z?RiQ0tj@#cK|$3yH%(DU^xKE(Dmx1Bxy!P#t@Wo+ukTG|D)F{Z#oAKDC5U0(TUV!x z@<1&QnL%}f9`!!8iTC%{dzAU0xu*7QWQRKZ{%CGVRzS!Jw)_P_JPz~X?T;|cs>0P& zvK9DgW%qb1g^yDOo(?yDlR)%wJB;iNmB0JG!HG~QT*;WIbkU(2o%lK-fm!ZB-yo|D z$R6cZF6GhC+aLhyBoJZX$F08?<=j3B06`kT8c)q(11&s88PEb79T`)lyykcOb$GlV z&!nkCG!ZkX|Cv$p-R{#x(CF8?p49jHfihrzQHLE^GlU?t^067QhbFb=@SSpQe^AlU z##qkri@EpM)FGi8RHpr@xvi~td0p3nTxS)3Y`httUV+;0V>^|YhL>j-q~)M?UU0=- zE-f^HjO{DC6`3zNWyw-0rWBi+5!MrX8o$>0iI;;W(T|#ZzCTz11F5NQO6{ucch4z1 zf>)CUqMGauTXFo&PqrW09fsQHzeir-H1B?LZnovV_mEU^xZ#DRd)=2s$KylI`wt!C z;vE-JVf_{rNMT#-?~ty>(#x9gI&6fwZvU7#pwI&XE9e3P6bsL$X;dS^_MKHQ8xf$v^*H4W_p}#YcmH4HF}q>;XrNL1v~kR zy^F_UwQ>pd4c2{1d%P>M%sG1}OkwqkJ5HIs$zYiBTFvtN$;VP-S&z{H9|B60d$8H< zAC8FZ9i8EOds!y;DMK2&2^rL; zJ!DJxA9v3GYPMf-r6tIad37gbG;!*UF?Xi3>Sf|FPX+H0sXBa0m10&6BVhy9>eq8# zRek9%a-*{ZF?GQNhXJJD@YA(>Q?kq=Mk4@?1GO8vm$g#6Xr}kRH?@ouN(v)r<+j;3UoHyW6lZI`37BqJw?E9UboLTXq^ z*&M!qdA=7_43DYjk=>^#7@@(BE!?iO(wi);8{al)Ct#u3YTW$wizS>V>rx93GSsL} zG@NMQ%F}Nt;ytkRY?>xms8}`^a-t?mW92bNSIt+NV6R9x3HjB29h-fbd!$M?gALM&0{tlz|pNR3|gC<9@z!!#3J`Y?r;`g9*i zpuzc;G`ay=+1J21|646(>)&es4v~;Q0{BzFs0wxC_Zc<^$BWI zMY;2SQXEA&Hdl7I%pYZ==2_9JL2&R?3^trtKuBmTaCwC6L(&$1)OfX>m*>r9W&3v7 zEWrWrvwU6oo68f3};T*+zfF2ls5G{5@e2Ni0y%#4hI3cW@qZQf3 z)^@Zb{&d!YE*o(QczrJbd*6?jQYsYRQD}9N{oJ6#X*6olKGt|~;%GEiFS&6SidLzk z|Gk*^_(ctv6B*&$B)J_Pc8=TA1Laoc6!EU5Ny>O0C#2bF^$V?i4tS2GrUTn!HKXB? zBz$r$0g)vI!p#E?M?sLY#iw~gX)l#1Ef~#|QeWsa5zrG_V zr&D@5Zn;n2s2xt14QL1$YYR|OmT!zl=3bpP^yRVPm>(p(SjbCxPmg@}eoBXhR*_yQ z9d*1~v8L$}cVmM=t+Vs#{ndc9*Z5Gm=6cpMXj+F{RfbsvoP%;PGL@SK@73hh)d)*=p)dcr+hA$gboU{0|FbDSZ$&8p~( z*QB5Z*`xG)vh@f&2dEb(1f5JJPm?BJfafqR5rFOuJ=DluwhBm)6Pkbgf-eyPm=_$g zeu~&~cRVa*Ea(Io#A1rW%r8C%I=7qbx`35IA#w}T_NN|~ZAQue;169w-~-ZmLyIbK zk#>XxyuLq0WVy-SsdRO{;kxVjM2d_K0h0(;w3UnH<}6TbBDaw=XLvx}I%Mn2>T@Q| zbPf`I5)>qIta|FzK%ah<^;;$g5>^C>9`ztd^y_~T$AG2!#?Er$4uV8#i+? z)YYnDnZo=e4YFtZMp_EiEQM?iCM~Ea zUwQq7VEqpW(f@+Y{q?ql$##+9Kf+{YTc3V9S)Y44Ti&zuC-?R4j_}^ebD0Tn9$?l# z!|F@o8GlZSME3H=pb5nbvh}dxHpJV3)=3(<#4glWZ!io`u7esD9s&27pg#I(1gFV9 zMDE)mFo2(frty4ZNnIXb1=X1bVR=HZ?;Q<8nm_Ph{FlCKCtJ#thp}micIpYP5>E!JU*;%1W$0n<}hyxdxzR+%@2Q6`GVaF4Ca4&*w z;azpm5|{N|L;sBw!p20>fL;2ML3wv7ixgOJ1VA-@Oh_eh&DXBjT=VU><|_4*2Q^{& z zEW)TUqu`L#Z`NkZNFgWDCE#2s|H=B>Awf7XS1@R%f32Gsexiy1^#5rI#7Q~8pEhX! zNJb+GKIfVK-|KP&;r^yo@l#^j!Ubtvn+;WCg%b&W_joK1kD+Oqw;W84%b)$94!s2jxCiyx;PR^dQNynw z++8}3@A@B5Ga|IR%qN*%6=(5tiz^(*3WfuVAphuHUI{dklkI9e4Zi6+m-2y5F(} z5+ZOc?_ui!DGxSPj|u(vn}L4`IsvYV5mcDs(+aBsH4ca%{*+FlFa=ZnZ2nTjB&lA1 ze+EFpo4ECc9q2V~2Q)wrU`XesH0B+6Oyn3pOh_~78`8gq3i}H!|8L+n_-vSFx)E$7 zQbY$Z-fvaqqiKu8%{K5jbZ~tVW?$D++J>B&s`OM$ARw8+ht50@W?=$Vct;OF&a(iq z;wvC01lv@`v*@N2s29tDZIuI>Fv08IS4Zj#goH&!25ljVpyCwgXc+Vaz-8d+U2xi9 zJKqeX(s+6fHcF<=HyLjG@Pm0Q=?GgcEws%=?s#27sjacoP){C8@qYKuPoWj(6Wvjl z2Bmmp&ci)?aNE}uk!}J|ipQ~7TZDL#m*OM`f3W{MNFX*gBaLDM{vtD{ULh^r4ygWd zUrcpy+;4F)w->+xK9XT!R!v;5Am<**2qHV~JE3HQgM$#c=Dv`3U6d$$jRqb8yAhIq zK)?_{Jer*!u4fjXFDx2^{}BZM^iuvGa@v$`t{jhm&h=VG@z1D4{i1gnA_UE1i}~n7 zQAu_(sYe?Mo76$qe^oP8(5=d1UU@;M5LRbm*hvkKyg8$-22KxIC z%Cgprk$UdJ&eVI1vwR1ga&0P%qDwZ{-DllEuJ>s&yLecKI&g&YyW1?;yNe6hMOhNz z6bX+{P0GhAuiwY-{Qv>&EpclO2nO&MkN+Xt;=j*Tzqv2p310f*3%`A?2u3agQ);*O z(292eoD|G-r;<-;Y-MCnfDWcSAPmjc@c@UfSm5a)&8$`a4vhPgj<;uI2lx-r0BcRp zaaFK8`a!p=%m2gPTZd)2ZtJ7)i4sa9AxMLOAR;0iA}NA^AV?~LC@I~gASoavAs`_w zsFbwQNS8==H`4hVuR8add(Az6bI-l@IoCPYwdNla`QZC_pBm4I`@YB0Kms-~v(Fr@ zdFkr2?d9#&aXpiAq%RbxeVo>f=eK%BL_~e|R@YCiPqe1#fpp^rFiNzz#ZUf$pz}Wf zP@{fzHi&{Xvj`CeI*qyUaBT~(M^Dxr;9;FjL>jh~Ic`XJ;fVx#9Vf^h`izoU9joC$ zd7F9)Nm*K6isiF-ay^_)l8cKgQC3ecF<3aPj^vR9N32Skq6a+#11l@5?5+N^G#0^~ z>cZ+vakwa-s1F|MKbi&XUHcy|!|T&xLRAJsI%$B#A6Ste>FQDua9n2*KHMJfg5D4U z_A8JdiN0c*!TOFtI5GB!hYxWdQI9$@q}i#2X)dB?(4L_i=K;1_%J7CkNgT*1C zq?B7-U5)PBobAL!`M4FHe1J~?rxL~Z;_3%TD_#wmLAwL=Ni4geT$|fpxOfs=sTWnX5B!|Y5VP(Ah?JR25qXrOYH?1DV%t-*d5N>H)91P zp=n1rU!bH*ceZxS8D2A!4f3N;&8i~XFRP*Xic-E&H+$=M?*`!HqyksKki}-@xuFQ8 z4Ba0-%8ai|4&?(VNeJH-`SpMf8AFyNvq;DaxmasK{x{ zOpi73CnHCO*L;Y??H-R_HC876v!X%Zuhw{*!wJdTJN|=Vz7x$cYC)qHPhgQtxu17m;cVU?#ls+|x_JL?EY?ah zwX54C^r*Tft3`YF0ZI#~NXl!i(pswMWLS~Vu4}*fXcgB6vc)YVdiPQLn8(=J;d>Rd z&v6%liqsqK_H6P8_efaNC+PfFq<0tY4@xKekc#ZISW_HRHRi7|4k6CmS<%jQgpQ-K z@;f?C4X2Z!?ZRs)Cn*6%X9oBtmu==$2w(4RpDuS0GVQxe=f{_Um*`p!?VnYWq;NAO zmw?=P#cV(ZR7n%IhMa;PG)2`;MRtA6^C-ZyJ-=?O;m)& zY*|nUBX~{qJrT5*$)kiEK5U;vC*^}Kb`J`DAPd=E?y~1OkwD73{qhUIi96rOy-b6) zSzWKM9B1Vrj9gpq~tYI>`ak=wAh!Q=XT_Z7~GngnmZZh zR6_Q_U$gFvuWXYU@EEqdO7Qf=ST$8wC-2U>bIbW)XFA^hXj^%L5O^y8&y$7B>7kG4 z4JeEgT}3u}n9BsW=y&K%Jlz@(eu%esr$1*oOZn9Fty{Ndp}7I**`786cJL|}Q2|+@ zoPt6M@i_&b)Q?%03&(#)vWeizFWBIG8(;{8z^Mh=D@a=B8~*>;)dkZP@Po&)>UO<+ zXNppz!nI7BmfhsCQJ0U7+kuV$M1n}Aq;_vrJKM*_L`nY{kcPi~GnbEuknk!5@$ZF} z6f}>Bt*Fp32y!2su;>Nf?uqc<1IqlDY+9@237|z=FZS{D72BK#PwnMDcr`-L*Z-M6 zbM{MYL0s*96;T8*T=Vf?A#41`@A!3g?*8Iep(RRs;&25i5jBOwJRHNUY)1lQ)p0dBTX< zMg(LQ#Y<1`vI4l0wn3f#Co8ZG5*|dfn&ABw5jBX)Sn)v1wY8}87qJt8N_aJdAQ38R z7?l5GkMkc^AVm%vwH6HV1ODfPm{!Eg=C`~tgM>{wpRTDvu!=TjH4)kNA32A=1a16` zFx0U?BP$4LOj~sAyW(arK`<8ud?vG;PwFWAjWDX+D1Hm?rt|!afL* z0cQzF*_Xl9lL=+R_(94>+QBi(sRw(XL}#q$b=Pn7Mx(z|`9uhU=d0!DjGE9-uz`ql zVieq|HQc*xYe8oP6#(n(-|kdxn~;WQdMcXL-n$H7a;C$p$6ffG(2@E-jzkU4B+I1_ z9MGoB9|7)c3_xGobO(DU$Ng33JlhQ-99&!;CW*trVr~6XvBFMqC#pA6ZgUJL{6a(0 z4Xg#I#E!lpwHeB8t|gf)sBmQq`|cCMlV&tUPn8|Ldqq@p|WlaZ%``;#C+(v>3tI znhMT6-@^CrHF8~v27)ig4K6?HxKmcAg(o9Hd@dkm*Tz_r=itzr=26Ql45Y}{Jr4cO z5+Yk(M1RdTFca>BBJ$Hj>{`hFJYl58(8hWV4VlTgeDINY7+wDc^cPn_YsY0ev4+rP zMBD>dtr2b~Zy0$!CM?7@+NG2>WcLj!>e135A@i~N$X`v$eLYk#L|%o8$wg!n1PSfv zD{15lML~%GPfCDrBxa;t+p*7=rl3kKT{-H3JjhzM2}Pvp6N#zQ3)svBNVa`+JvdR; zo9w0D2(WXX}-Ux$c{dP zm#1gj>#aSk+3J2dLNTMV+o35p&KRFtwHGYcIS7j9lU)?7{zzrE8-_oV-=kyG7r6D^ zsSL9XFe4H%0Ta0S7-8+z4YF1~TW(T4gC$!miQ4BHOS4J!&f~Zg2|fq7AbXXW#@J(? z9G%u{&OeZcOy5LXI@7rs`F=;=2?gaPWeIa!iv*hT2t~lR; z5uK0iDG>7+~M@k#s5<5l-3gu6vDGP~uwJsr4by~r}oh}d1cakug1 zd52SHyW+2hvq~Nb-AKJ(=ax9jJ*AG}6T;-*x%Nhu6kYlOFy{|w{1$s}s%Sp^$s@Z# zRg_SUM|~JkY_ojdAq|KmXWEX0OWwZ!1)f~pK4<*$q*6nu+zX!dtTa6i_kdi@q;nQ? zgWf@Bjn1~We`r+?k+e9I;#-mP4w@Myb=E-pAYOHclOZLR-w zH>$onvqCBK-R%fh;<}*ZGdvl@!wh{Js?l$P;`S>0selk2@mh8l=(4i(1kZYq?8kG0 zW7|kyW*U#$%Re=vq)v@7fa!3?IMX?Uvy&%!N^t&1@2+chrIdB99FYWiiG%bc>I?3 zy0c)WB@P7C*qm9|)%n=evIF>Zr1^2Kmtj&|RvUiUCscXwbW8x??JL;Po>Ou+t!$AP zi1d$pcA?r6y{v$t!FFdcUb|#dap2SF7#BxfyM5lyzybz(wfx-&rod}P0_-IuzjT2s zZ|hIfVUEZ=p6hC>(?#q;=9t}y->?AwLQ@-vYSqoOgrEv!lF1yJ=CNUt;}p4d<4=|e zwk-~7UOv95zF3%6ePh1jV^5dTHHJfH>#j)OJcq_BjwKB->rLFJYnmMo&u{U4i|)(x+queC3?Ig>iA1~{O4}1afIlDGop#nv_igTwLGC9g zBPQ&Ew%_64guLUJZzW#RctyuiYx%MDs`ul1LLxX`dtJ_No~iPnma?i}2-?+3+pjD; zbHwnzfg+~*RH@x^d8Fa;&_T6yuzt&{J5-{pj&Gw?vLam!umg=dBTQ93-o5HL|MnSx zCd^qD=ga7&mNYYO%V+3r*^J>}%*_w%#Ix=X%B%+G;*ei=I$X#B+>izFVNr(a!_TD@ zVSs{tiSpq!el+kgVG!4WdO7qaFQHq({l@3_4Ir0GCF~fmJ$#dCx>ZPn@RgWl1WbrJDE)Px$uZTb&o;Z>|d)I0RUw1)Lo$0xVWX`x;eiU0uK{!L3}M zR56czm2`0j#|>Rh%|+cIf8B*X1~v(kzEV}HgAT3?j>)E|(6xy#k_GIMRdG2-*Y@zK zh#XqN1lp-oLqbTX@O;?hZd6dbW^kmqVQXAcv5m3+mJd=!{!W2S?1xrU zcXSHSLJw_7Hn^@9>`C0o)a(VVK2}#J=eaDINLc<6aYtSFbfh@|%G+*#- zEOf@;4;0(R9%w|{{CLTy;o46&IdP}~Srpg6V~@PRtz?bys33*)~f*Q?Pd#~eOsvMw|q{4Tz+HzYr(PXh%?*F2LJ(H>|1xu zDM@2_JwRJv8XUPoC#;+A*IgCwS{zmDda?J>6VvlVuRs{NQd7EUfS^EHAk7OyIu`Lb z>Ng2*>s3d*jqmh%G46Hwlk|8pz@W0v534KO;R{-ubZS}~Kxjqxc}y}1`A#~{e?5EI zWP;D4RCexzSD2t-%cB~p(m0ta0s|}WK1%6vI!5)Z6{XbIb3}NWzDwF1 zFdk(2iv%2jkEwhfbSMgeZ^$A z$+F4YRCA~fFxPj~UkSN9>&sira^PgM{M^WsajU$JhM^^Cu|_DA$naLf*v;aBT&c^7 zG%iU%C_woLem`_xCCY!;t6*)xeB<3nXOh}0K2-gc)TO33`EQk(p6QxrsxjVrL4QQt z9M%(&%b=sqa%*T0fwcwNMuS~w_r!kAh^Q|=VWg7)Z3(O^PyQ|#@n9Lhy#epJkcLDr zQ$I^xE~kB0&z*CVDSX2u+V4&1CR>mAaLM^z*)A$D7(Q{gWc0n1l7`X7@C?$DH>0_% zvIkXS1#MpYO*VF<0L|&8t}9bqp>XXl!tPP^lg&lVThGZd+iMzMN=gzqum(uINn90il}qrJN3SJ)G8>18{Yq_2UmJ!n@0ck32H%_SYJ7F1yrHHI64qpCUa? z7baJvl&xbmEF#PTm)?VxXhVL|YcAG!Zks~C0H>+!`HY>tgcpahCzV|5dR6rwUx_yz za(K&Gp%n}9yZ%eN{F%>GwepeT?Aza#ShEK{hY&2&iF{>x)UIryg{S6Eeub}vew3xo zD(!qHBjX!Iy$(H(VDoLe`99w-;jHqYf|}svPp#UdL?c-Bp=mbMaAxK`&1_Qse9iY4 zXZs+XQIl?2vnH-S)=1a`r?kDs|K;1w`YzV-^i5+PNgCroUpzu1|^wBn%sG$R_w~o74jbLAo51CqG}N9@&?ARvv%Z4!bkort-0&R3QjXpdE5XB^AOFtjNa&K1cwf-+1mHh zq7Kg{r;fb2ncG2MNT1?~uBNb41!v&h_s?%OC#%|9&GnqSP1RaSruNZiv3s~9$eh|6 z%0-BS`r#I@#dlq~ftD*?+;mm_`G|`C^vo{^GwD5M_DD%ip{*SDoo@>zJ>P5R z6z_UgN(X#DBJ!qxwqkL$N;-getTsBFmELXcAR%wORW_XAp1s=zd0B$GUd=95nBV zm5Ej!9*~wDx$1tQCZgY6oez+t6?q_Q%tRhEM5|>zM#X0N()3n;&y$Fqd@Ne_PKmsE zlU}lxTJ4`Op&SE^RMSfthY8loeJfl0eQtYirPl3suW6L(7fE*fA}nV3O)P^ZTm|>* z&V5ipMfu*_N9Yg3x7^V#gWHlwND>`|bb`5+jDGbY6ze4zST1uTVR?$ou_tW^OhiiY z;R77FQ*OLCfsyb6e)ak5wkAYvBa$AM8q=b8Y7FUayh{RCp464O9aY?3^Cl{^yrl#B_M&vX%IM-{*$@FM&HDt7 zJ+QW(#_IwWh#)&iqQCiSD(G8R7f8XJLA>&Yl)P)q@6xBj;Uh7Kk8ms`2&uO1C*! zJ`HTzg0bMrnWiYKb+Z`hz2^8j|91hEL|^xh`!B53y|)W6lE$6uX;(R@?A}AW`C8QH;ZLnTY9VRq&_ zA3pWId}+@P(yS+?HTt|+UojDDSduu*y3|w|wKj*baz^Om(!Q920`%ZQ*&C0wM5>(U` zhx60|X_X2o1sDT|u#NR>ti5-!X#3GVj(wrATWX^L$qe&~gE;0J(HElOM6;j>azcZW z9mcTtYy=!RSe1Qq4-y`X-$a-2jXfU)z*t<8aZ)cIr`Cg`97}L{p-+laL;lC9=7)JI z*H#IvRI;mgxNEq0TP|>*d@{GxHr`*J>xs#9y}ituF?XqjZSS#@r2Tk~rWbD#s2C|i zE52$)wH)o#DDLTwf_LKAWN=<2QK+(v3-_?9 z7pC-$u5O8eqN3(H>vx_>T7k7!tT~R{u4!vGOEfyOmx8UI$Wv}SJn&{IP;+bK;%Ak+ zjmWLAAY=hbD(R?821IhV3-`8@RH6ml=-%q&wq%^mmDhQ7{rePWUO%^1_h@?Rb)rTp zX9s%sw4Urqo-rf0NL4hYu?KV+D(R^+^>)(fayK~N>l;1^UM#n+RzJ!8=6OU}c)Pvd zyKp6&Gx@JbHkS(@&Wxbj5|O!W4sjH4y6g=q(Urqp-aKbB(-OUIbP{@DhqzKhAs0a# z+5DFLx(m0(sS^RCHVDT;?G<^`-+n=aW}#<0VZHwgM$i;Tm%uZ>Q&h`Jy8Q}YWzidhJ*xEs_#b>C{)obQjJao<-1mq0wi3?Cfvq2LK!?dZi(`p+{Me5U6^C` z(Om{7Yj)4Be!b7plA+3XMzhh`sNu6xoY_FJH(tuGv-5>y&DpDh!1fGXgb7N$e}3(x?@YAd)6dYbat{b z%8`y`TybVy^U?@W3N)}_;+R!J_q?wdXlnVAe@nG4SZM=)!{Qo+>Xp^oQtfN5a|)DL zv`cN5EHvSYP{0$n`V9^CucJYu(gg;N4hdox+Uk=czi{+k?~Q*urKD?<3Ps6VnLaEQ z3_qxx`En${3)Otyc$x)|NT%-c}$#I6zv`A$yKiYP&D_o-Meo@BCNPzF|i4BHPy^oVqC5sbA9%H{^ z|3s8W()$f{e@8qU_AeHkbChdjDs?7&_wB~2S&jM={K>yWrE%XKd2CS~WXYfLHL<0z zco0%~;sK*_{KcO4wZLEUBVjf13LQSzFKu(WTV@~~EzxTp7&J3qa@2fJ`&mwYQ3jbO zf0@x61Z#H32{!fvH}j+0*TQMq*D0(HD^T_7se7vaXo;m}o^5%IzHrD5wxVwZKCmdD z;dZR*R6cmRm-#*V)n#uuTMLiXp{jB8{R#R{saHZ4xDGI`Gaqw13o*86okyNH#MoiY zpL9~X(|c+^A4)g-RG1w&fS`?+znS4abLZgN zj=vLgk-h~AROVXfR75%$5dSvodew=IhYK_J#=c=N94CQxdp79A2p(wtN0?|k4}U1gYKFyEGyUcAk5GbQUzu3x!R`H-B;9{R?J#bNzKjMyMS zo}rc+(LKLd7q6h~T~EHM?!8Iam06dRvjfOD-dzBMra`}^G5a(9a>g6@OR3qHsuLRq zdT&X-A>XJuDyX$yX2_@=!6FwNu>V8}w(ehM?(+w2h%e(=J8hB5`#WT9YO3f>5y_is z^C+vSjl?X^#moinvbn{!@;+B%*OWPqGtr~{!~Dg}g+geNdRaF|V`y5zpxT|dhhm!nk#UVK;3 zbRk|#6XI(!!?e&?<|(Sm3RBPuvN-U9u;o@G0Sm70EvUhHP41- z9*mj;UrJR^YEf4c@tAZEbWGdYl=PRMOq{T}54h0IE>q(6D*8uy~>U#k%dd z6bYd4j(Y9fYXhDao+^TPZfuLOTwTQfVUMiJ=ZAMp`n9BytE_t?P!5{78N!isu z&DogmHFvx@&$0Jp*ih;ejm(=kHd(l-6YtmEY}>|X)*M^-$lJph%93X3rWO*=s$SV!OY;2$6VeUX!a%XAvu;LNa2zOVc3?^(kYj+ zRq;OkStLV*4zVgy{1mxnx-Fr><}q_;=P6loxkdIQbLy^Csd9Lw>ha)h;DbNEBdto? z@=I#Nq?>oD$NZc4ctPN#068qu`LgG`85FVSjgW=9IKWm-B|f z?ruz(Z8y($?z+-_=8h?jeyV4>1tyQ^?ykr?8J-q1F^B}WP%{5`znr$qv-p@_ywo>Q znd)8RU>WwQzl7iY_~E&w#i^51Ed<>c>=$~ih#xg{oL1N(Rclp`4iQU8aFC!>+p9W- z!piZ_Y-b0Fmq}x(MyIE_Js%cF=GbUjm1}$&fkBh1y5*T%6BZdppMg_K{IzBR>QqG<IH8ZiKrc_feGt-@mE&ONd$Y`2B(;t^(0L|;fuC8wJSCP<&soV8!indu- zI3*va^S=MC&uJS>N##-7^N>D;U?Hpaew>+j;3do7*MA4DYVE1(q=u9JgCIa#NEYgCm&;;O#u&97@CpNH35MQ6j}4ugWl@`kpjToEQ# z+dz@8oAfB<>R~a`hX;wEot|+HacgicHO3cN>KYbpd1ijyIp|$#6KWmqA{hy>t|5B&(H9e5$ikBSsH-Bt;LG>K z8A4&n^g<+PPaz1^;8$pB1Ebez3#6%K%d_0EX#nJyOa%X9Bx(dc!Z(b6k%I)jVldS; z1R1MG0RFL4{d61-c#fN9IoOU&D|OR8i{ya%|`>=P`KGF8AScNBzow- zK|PVn@1@VgLpWht4t?+MV**SlR0Hnz>`#n7Cr~~Zvf@5ShS>z;Z}Iz2zWBjTJzZQXtkt$S`F_ z#&||wmEg$UzfBPOvuOJFWSpvTexZ4PCx1OQ9Jca&1PBoAFBqh$PE^v%SX<{weuI_{ zbik$XfwnTHJ%?UoIz2s?T5474>#jTN-(fUoJ$!Qe-Oo1rqN*(k%f zgw4f%;-g^UdzBd1Z{AG(CEhQwBBUTLjsk4j*N)AftQ8Vg&k7N%sQ~D)sCF_P8q*YY zes#;!YK2yqJPdgk|5>U3uO;yR*plWKLo*nWx`@h6^*f95IU;KKOR|cjYLLs`W_z*C zJaF27au>?36y9Qa2R}qpy6&$*C^m!6guZS}m&1kD!>0WyZ&9`ffIGipHFcvOx=$6y&X;(xtH1kH`<&7+ z_d)ZA%$#z8?joxx=r-}ltmLATEd1#(#(J3u0C~u^G2LNC$;dtl(5JwneSx7JVnF|= zKWx4P?gEw=tq}}~$(IH_dFN`j`uj=&0RdZ}&By zJMmMzGy9RyEyQK+R{V9~!YS?yShe!Fb;)fg5sK~azSOex9eiAco8D5k@S(BTmLi>u z=jd*V<+l8)-%7~jE}-gfJS(EDLiY&9R)M#hx6#a2Bj1<|7I*JE*=TCU;GVh6GNGJ~ zi)z@TBfE=viu^9{9X+uyo-ivCij}IB8S>K-T=IaUe@>Kp*9qP2<|pL+wCu6rR({V4um!LS5wI!3L9Z*ZxGbUH7H9(0QKa=Ps_PQ1TB zrfsc6@4oGAT|y+bUz;n6sGGjslP{yR-ksce-xzJ3UOa?R zs(bKVA0yZ?bkgzHo_q}Z#4}Vf`#OP`56CzWNi5V8l8-cy7OQWIq)<8*C`s0FkR#Zs-(7L0G`$t_|1oV;Mk-kF4HGGTHKn(n)w^2q zEyZZ{QQ?$xLMY~mu(Y@0pX_d}3@dL9D;UEeoksVRCiRLV0ky%Sp}FDv2Ttb& z-P?#0h{5X?rkl%TUV*kcQEpP781BxTJdW&KXnYh*$^%$JWZ)mb5;fFvd{n}sZT7Dg zT?Zl6^PzP)O>x5gn{W)x;C>->7yVLGc)=!pT=Z~UbOG2Xg|eZ{z3_E-vG?`iM!$K5 z@Xp00^P^4kP^);yxpaxOG*aGu?=Qzsl75@dsW7XfcFHDu+t-(GY&ur$d&T%GJJd3x zkTxtS@-YwW25nw)=#~#i1yP%RpK6wC+51{p9!?@;@P%Zr$xtLzhPM2ckKEbASN+%U z_^TB}57sA?xS$KejTUIrmXTjrc+SmjCc!&I)OCA_hM4)rOlMJZlB&}KjNrZiK8C+L zfZOC?*DLEi*g9YxWb1r$e~bqW^#xuI>&(nJi=JHcn+*-2e}+#JXR#Bdlx7gVE4?b>> zr==xHRx7q92c|muHWsjG=~AzmcEcZ=!TgJR2#a>zoe1bMZ}QSk|JXUS!Ovkau9$s( zE{^udmGP#~s^_57a+x5>Smm?jb&D<~X&d3C8gr_>ac$=t8(cO{V7 z7>L>dhql0|JHu?6+PdwkZ7qeNy0NiwidD=_lj+l7SE5hZY%s!IdGlYoE6HCVx4@9& zJcs57ec3gZm!Y85QyW0hDc_NnZ9QK5{A+J-ln-6`_qwH$hzm=Bsbem!ij7yj&XPYA^l19i<-L2KoO zr1nLWOxJ272Q|9Hg%4>brON9-^EKok!poLrLu@@^_Pkj9}XIH z3HEpOjgn}-rReG+KTHaMBhix?xfsCJLEIpiKp4*pUq5lgW8;D$=y^!$TtLZ8;L;X2 z|LI4+bB5dpiU0yv@Syah&{$=Gj*RX}9Skc?Pkh>o-o5RZ9*njc($UetO9g4tJ<8}YGM)+qR{b}u| zr-lPVVe+Mbu>x@#gTPVj8CcRADkOd|WFOcwgeTe8ED6Qv&C%XZGW^*`yH7%Tk-%LH zdJw_nb0gj&;w-MapMqJBN@F2`Arrv4p(jW1iMgxKovh!GAC}E6X zRzolvE`fbQr+`Pjq@=`x3>h}nKbEXIBIr*)Is(Yfumno5daSZdFjnjk16r7MXyGTO zpO~nK3^@RX{3pBNKYuhk&5uo+2rj&GNaVja+P^p2KaR)0H`>1~+CO%~e=?T;wrKyp zI{({Or}|Yh$TjRwJqBl3-3wdg`@HUvK)NLahNy03y(YM}^b~Z>7a^i~FCTN|&d=nA zj5)dr)oJhx(#9fm*-<{uo=P0xc4d5=B=bk3r@5zcQVh+P&1|QJ-o0MB9`emUE=3;5 zaCAu|TcA)f>iitq#a#k|f{S6d6tFWddKeLiVTdPIdjdt|`G1v_`h7G2x4R-eloi8B z^ZyuB-ji6XJjwYDgp5o+)9dBJ~(=v|6^-BlGf|2bPB)EyhiTUA6{ix65Bqp2%NP1$Q(Ohi4J4ZY-CC{~~Ml z-+sR4=hfyIcGlM4tXhQ&JH@pyqWG;IynMI1Qib1t3}5J7r0Ym@f8lsp_Tf? z8P`{~eUEG*;?~e@F{OUn2YJ-42h|jRl^OU$U|k7b8<7;A%8Nj7#sw5!0XqTl%@vtp z=f2WWU4-!EWQRFw*kL+$b0N324_cv{*HKyB_;AfzG_dA4!EjmC@nGm5%Z&1NlX0F5 zSL^%wR&#N!k#qPSX7HEm`^CJ2*0<=LZbV;hXc0Zy*RLZG&3F@fur)l~BC=;v0{LX>09Nhc3r>3UtP5m9$5OaG+;S{!5{^4x=macA((WyXkm0k>2L}fNI-p;%;R` z)k8OQTNV=ta&0%d)y@T(^N$B`FHDOb6`2l|_DThi-;3X$I2S5ix~;_F{>pyL*S4Ba z+PdT`=nO5C?=9s*L->B^AYuxsI$t#9`2o<1xg#eh_uaia5}y9sLzXN|*ftvC|I)Uh zl-*#s!xp~qzK+_qL-rh#pqq;A(n=3BR^-uqclT<}aYzs!6}jwo#w*z36wPI1n*2VK z{XAXEaNwf_&D z<%f!c*^OSbZIFg$-*I9X<}e-kMj z3})-fPH+{?yk)y2857KjOyPNS{rX_K28O%Nn8BB)TjE74mT2NssQW{RZe?`tUz7bU zwSA8bE(_~s6-%`VS+a#}04eU4*m@jFk*79l@4 zx$T5nR$adH<3rrOuEiJamz@VgC#w`gyrPS@TIIzAaUbMPhjI=bE}>**WR+-s*fTL& zLAXR07M`5(g&H>1=1fvhv>YL%wetq8JLQp7(f+gUmlgYy+O8M(K}e$yW;UV}`>2wv z{I2fNZciwFc&p&D5F|toia9>)5?&gbU4aisr=(v(}X_Mn=8<>w?j5JO$cfMnV>`|%rTb< z|29|ra185!KmeT@o!C*lOHKZhd0NT4%hoe(Wk!&^y=4j+INu42Q7t-^QP_Zx0n;c|^z zrc!hPoNaCS##?hHnp$nwoymf`pPxuDMv1r-%L7cWzv!?&a&Ng}xHgC;eu32TV528h zU<;-PZ?}*T8Sh!a0*8c4+!)FPa0CvA-@DcSEY_H%?H%dbW8C<;FoPs)LGD-463&UA zgR0E_HEZfSB#s(gYVhwLDQ*0Jq_jsWnkM22A&w`*LC(t4vtlG2iBi9Y`7^aycw5VNn$0&sS&B(6;v2r(cGU#o zMc1XR@-1Pfx%5<`h9r%F6&f~eJO>!mB6PgY9}g64Spw_WHGL)M_F@zi`MAddF2c-u zzBs0ujNFHT#D-pfH?IxI2IM|vfoz+SLQaM)M)1_}SzZs2M3mAjv3)E5imx4-Zi9|B zM=rQb{b1M^vP+gefQ;lh*9V1E{nwl3p&eSF6Sg#y93v?L;jsvt5Q`_JXyW0xa`gEK{- z60PsHO6Jy{f8M8JiZ_akQ|FZrLwDU(%(ME2uPmPB7ZljK6oIc8|E=Xblr?xL=H_J4 z&^_aRbDoiGAh>N}VI7ILk-XG@aj*VJ+M%I(VZZ5*lMb-JMAHN1Dzgk6uL3}u!_Eke zbzW<@@}McwEJW&!a)rbGRE#-uiNiMEFh?~FacBQ(Ev0$nk=U%D=QfXY0J+jjt18+p zrPEln2~6U`Wsveq;Qg)i{3lNI@1OGzXO1yThT47vU9-Z~rDyz3WyXaC2qh|8yyrw9 zL=flw3%~OJUiemju}wMqC7b%5Dyb_E7VW5^gcl7Y_7aHyr3d~f!@|MX{5Bta zt$e|K4-dQt{t>Rc$MDsQ!LSnglZjb=y8mz#zT!x?c=E#nOt{yzRYC|w68H)mybiPm z^q_>FS#xwkcpLrIZZ=}{WKudEH9BxHLr83XKW~4szQ4x<{JN2TCfJ`)Li z;Fd@|K6U;Td>yTi0#FG?Fx3jV#@~E$#b1XK3l8Or*GA#s9{CgGWWq3%Wc>tw{}_J) zOZffX_(M4e`vMWp7a52^8Tg)^R)9?UzN&al;Ge)-)h52b=H)9Fm2>D*LZf6o**)?Ar zzHRyruv5M1djappx4y|+Glc;T{s$)HQ#Pz*STb~YKm+R-SMSc{d}+HGlI+zNlZIwJzG^# zF_ilt=>Xc%nz7r`bQzs<8K|hhyL!U6SWaE&hv5rDitMsPlK=hM;q9fPy?RaCy4EXS zwKh(2Gk-fe(_1m+@Cwa?9=WY#V~TdK-^~f^F>Q9zwBU!c@DHKm^bl#n6Q8IArA5OaQ_`l6}A52VmW3RZ#r}F}Qo1ZvEy3 zCOLP;!o8p8?RW>IIZ&Sydo2T-SF+;)bh+7X=X5oW-x002&NI<2Iy@LiE_$)M=+%G3 zn&04$RJNS6vB9EESF+F>fp1axK5NCW9BrrmlYiuXk~XL8yJr9WZ(@{u!T3$#AN=3n z#t0_AwcHq}Sc!m|t{=18uP1Cw!fL{iBVkDV6CK{>PEpThd9l zVjE?D-St?W@^D=&I4i4pqlKISAv(A<7+2g`a{M7T+5G$5DGAoTQRnRv!)Eh^B{kl@ zr{*RFC_3JWqnM?C@?R)zvU$NYJrqoD-PtxR+cny#ta<|m2%%1O_`YIhOu zzjOUV-FLO1bIQbCms{ z+dF{b?sqL;PeUUsKmI7U zjwiFWw7|muz|Gic_)fZGjT7FZ{O_AIU-_`KC{PqwrGVpq(BFIlaFMk^>J(U)l9e#1 z9bG~>_PVE3URJD!GAv|NNv8sHXG04w9yWzjh)*|yuB1Z-yEmFn zA9Z;0Q~d4_=fY98TSd<$?GrmCRZ@L#F!AvnSi4AJiw8R=?2Y5@JBh8;?Z*ormCYG9 z%!iBiiwac~x^2y?YG)b;F6s6cyJ&Xv>?v1y_cW+?el_hkE!mKpQc$~g=E9(H-^$^Y zJ+LG(0sgS`lS%d+Ivx>dyVw(fI3Nx0^%A-N8Pu?UxSS9`^S5#rf9lNfu6Y zNs19W&4RwEEog7T@%C$9g&XtLdp(!L@O|m>8DA(UuAIdwmhdzcNl8_IPy9kJl_!~y zL?n#gQHFSO@!{zw3$V4SbmsT04mEugu+=EO7YHra)}={tI0 z99M@;z!Cy${UR?aGY4byXsgF`vL9}dfVztHaJJtrkV@oW+KQxS!l0k~5g$VaZ7&wq zBMCO<0anzfJED$_W^M-eGl=5j3Q86QOWnH74^vAT4nDV_RNa&pPK}gcZa?2CUsedt zN!h<7wn@2KkCxsS{A2qi(~nf#(k^Pyy?O7Rw{ePnlO)@{1mi7lqh3Afdx>_BlDsk6 z@7MV(of6@*Q>!y~+td869bwyV$~!+CPdSqw9ThVGT3gIJMJCz>77FW^Cv8h_Zv^7d#P!cJ zoM$T$TEExx>`YM6cG^%-cJG%Z+@fe)bVf3f6J#=<41xp0DNQCzG)-%h6Kwb6uHn3j zO{Z}leEGfe$r1sS%)PXz zw9jCP&zy>E>_HrmK}G1RO8jwey5cDzd!SLQn;F<+Zo2a>T15Dp3ARdtqS#eFM zj)t95&%=Xb6q}XSwJ>NmEPwG7<&{(a0mlvtgXflgB8i55z8>J)QNvVI*Zj(-pP+Tv zJqUORZw#J#Z1}YgV`*<${>sK@UgP+B3MGPvai@ZnFZ>_&-aMY_y=xywl%X;eN~TPe zC_^OEjzURFMKYFo4w+{%Rfb5W3`JBjv(2+inKI8ZM49KA{aYV&?#_KW=f3afJkR&_ ze1G50Kc{Wm+h=%x)_bjMUDvgAbiX;6_1@?x=s_EI=@}-lw-zR3j4nj*&Ds{G^wpyk zr%a3MG&~JVA4(k%sKhmYc8W|l`gvZ1*d&TxXWX$9W7~0VEhwlrp1%sSsaiU&I1&B3 zXNT<+{P{fGL#j;h|D(Fx@+xqTtO>Yiw<|~zVfgVh_vKp*IFcu>xP_+!qCPf0o_^yh z|LbJ_k6hrAwWbB+X69hovqDA8BYdXBGcbDz2Dpwn{)-sCe~wNtGTd{eePhv=jC zHpGoBY>2ObeQMLh;cFeY`WaK`*AfY-&h6W%TW8V4 zY;FLuZE<5$=4q#tq*~QjVTQ%)l`0TXneIG}J`~;sr9YB>DK*ya68FH6c=uZNNfyQ3DIoH0gw0uS{ zCUU0=S{ny4t#jxA?dwNzU4c3n`>%%jkXV0SC`cUz74vL59ROfn%)#B zkg4Zmi)QePgvI3GuJrOO+^7#JTCwZ!bj)%O5q{-FUmEID5eKUk8?i;%v+D8?o&m zBpRQ{>_g`-c7CL_n=T$2yAgLa0~%vAg!Vvs62RIU#NYxI;!ezrG%}L>`mSI|+?%|Ei>4qRt`=@ZRy-wbr`BDH0 zi`N?=wIVF)v-hKx^^O&e!|7B<+|O?Hz>-ZA{8(@p*DsY-DRF_p=^2}h9870MlH&G5 za8myBcsP=CF7shU0E)-wgJGms6sP^_1KZ_(kA$?eCO}T_E_Ivv3atzUSbTQg)2W~x z-jZ;wuz02=$)SbUa8+&WYXnXu3}bqx)aA=vFW9tSc=_|tRJ?o=8tG{}ih#;tyg`gO zqu@oC;GGO@@$Kuo(|%6T$HC;A=+AoMU?%1z92W|_>6-7cI@(FjhK*KCrBE-^lOREX zUj5}8n40R;aQJr>51V@@Tm{cB(Sq*0uj7vUC zL5Z?k+E0mMx%#4=`My;~%OLcApN><>vO6u0{jO_m2XqY8)CRq88lX|ggfHqcg5e4` zMUF}EBv}>pDtgYYXwZ`5jc%L9=G7tbJ$9{{qa0LC_pT^g z)`G=z$A{beIFe7^jwK!fNAp}NHVG^*PV=5Kj80#*B);sx9O-cH8vO~^1(B}D5TEl@ z*5H2I&6N?u<~P@QZ5It}heNc2LU13#+l)>K$E`>{|_Ap~d8YtLKh)tVE}pNqjjIBv!Dw zkc6~{$Kf0@Wb6jW7nd9{OQ3!NsfS~*UCS+bX1;NF?seD3(_}I)7A$t^d+~4?b)OA8 zqyJplexc=UT{yS)exOlzxphb(p^oXiIIwp8BwaYF0K>aXrojZnXD_C&{wD!>{*yO# zU=R}WG+ak8#7pZydmuLb@aSOcr%x$j3?^iJP>omPvC<$y*X8BB@O&mCX)RW$vVVjbG;@M(A!AQhrWr z8wlnm-!A2%bRhm+BsXrb!>8Ye(^c_t)k8NaZ}t&r>C~$RZ@=?p^c8HpdbS^Tt(e$B z%~x<%GS#f&1EuNw~o#+Ymn}8PCMZErn1e$xa*~6g)b*D_5EvXLZs)g9YwxO zxqfYH2zVvT`Z<48Xp9d6{#UOCf@MUH_BsC%lo5BDM?~~j>XkNoLG8)bf?~nCaCM{#5IdZm6U~FC>assOaJ$Y6gCeVHKiv;~Y+XY`!^ID$96lvx4~Gu9 z4j_7-yB;*p?bOEU%GecBnH0)^kP()LErJks=r;T5{LTKI&h`=h)ZaSW`{_YzL|liQ zJ0icbcu&C3tQSx6W*lo^DxBo`*T)S6H!W@gvb259B9^O5x3?5bTVlLwAHs3CQkR?M z7(T-u&W(dHh#FCkdWq}YfWN$-ep47wmUN9b;9-M2fY(Iewl1i5G_x@{@emjOT)f5P zYpIZF6s~MLk#Wg+^UZURCJC=J7|MHKlC8eI4(hDs>wDqJ)D$O^Srx!)Nj;0OIe@=o z3?r{HA9Lg!%Qgx%vu}Iq=SclBHLS8dMLmr21h*JH9yaEFg`>_QMg^wDh2F!BLq%ER zu44o?6`yS~_`+bXEn(u&ZOp_2TtB~nSG=sBanMq5ai%MeA|wR3O2~=BGw?F*qCLDC zVc$GN1R5@Acu&{wUPn$HPIf;1%@mU5(nGu=+KHUA0A?P)ghr@KsjJu7)3oc+LQCCg zVK5E~?>-Vw6oVXq3zkZUS+1z^plb2xdp4&mw!R!7vJx<~FAFn=(0t+|Y)(8CeD`4= z=A|j@+l#AXNvs0yNB)=UwYt7dQah+mvZ=0IPUWryu37IwSK{}*_i@-yC0fZp-HE>w z!Tz~l{r+Ed^I^ISvgV?$Kw-k4|E?1%KI$PDKJ`92n(_F(<>~$^wC`qcAV~K+Vfc@K z5+aGSXus<*k$$ZYyUdbchWbH}vV}q$g`GpVqEYq-XwZi|nKOKC&vxm*yOW)Az%Kqf z7vP`xdOz=K+t}}a<9L4@RDW}gQl};s_lg%**YSH!F_Xd$GSQ@{q=o- zKhq|)@TL3x0*@XHjgPK0?Xf}9Sib9tZ3xcn9rH0`3{csa-V50(jIhD;_;a)+@EOZz&~nRlE+{PJ@IVP)&(45!D%N@4;GAp zwQjyu)hTx@*;yy4bVygo+zu7XlAw;_XJ3%IfOY(OFzHD=Y$g{!sq_nf{-(mwtq6T# zD|2Iq>nG>8Dc)(h3p9Ni2;nI5sGYcG?4(=bC48PZg|Jb0}$wdC4$@|rW{ndp1 z)r9@kg#8bhA-^~+KbJWF3a7uq>9275E1dp69Zs*MBpLrEPfH;WQsad@_aRjk86?33 zIZPiR3BKg_6g2Kk{!vn?z=86|J%p&Y|Ln~wuAPo@F2JL*{)@njVXK63y?3;=Fv(esI?_)`p%L=IdJQwKW!4pDvwn+O;2{0hzOzmb&jl zn|`@$3qYzrbrrN3awiHgo4jg8PBavQNo(1N9BsC9M~;^9{P}YwFo#I6g;IebR#aL5 z_}`+ce~aU4#yCS=OhZG10G$)*B$Vd?5bR(!5Zp12nYy1SbyPdTI(B1o3gghG&+$kJ z3{B7=%`qBT8`OmUg1UNzPwfLEGp_|<5O=+)x+X6JCDHuD@7^8%nltxDmLw0KKc%YO zC&b7n#`CZ6e~Yz_dIv28Q=UE3S3DT3?sKV5xxmi4t!=n2TwlHX$t8>3fH>*|2e6-W&2mu0J#_e6{OI9}1HhxtUy!q1`4U8aULCA> z7D3ym2n(z>n6nhLIkdL3Rjd<5yNJ`%>dvustdv?JV4f#5V(NGAJN)dxl&@uWzdNjG5aOOD%WvFMoCoC`?kx@1)>R3SQp;d!sZlVxe@I{}bYXsl2(Xwu>Fw z6M$36Sj-or!v93s$vr~j2{8le=far^7y7;7nkC73#6E8= z$Z;jeNPYd&se)aej%P;@ZQ3|y(%0s#FaY|h7=I~_6l$X^hL&tVr$Rss^ggi&RHqX; z%Jpqy6%8-N#w?^caGk|T?qioRb5Q2F?>*G$c|3~+cT~LSwJ0Sa80Hu@M4dO!<)Cyy zG2&+>4^6ptc6J&7Qm$WiK#3g3obfa0&gz}8clnDTsBqD6ZCEXHE`a@apy9k_Ugno) zxv-SH+1t`ry5)NX0=HA<`)CEvepSsO3}MJPC{g6bjNy;(jU=Yb#L?Q3&7h(v0Nc6q z@Pdj2xJ4bqoSq1jR{{Lm_N4U@sRfgvrxKk6tS=fS^d07wSw&X7%q=WBLDKQm&T8Bv zaxKnrHO>O`oS|E?v@&DCwLhrRWa|%P_1};QRf;DC+@1z=tr5B(e%lH=;`$Bu97n6V zrM7KscPegOh;-w!$T5;>m4%3fFtD;B^!lJ2T}U~-gxebr-J>O!lF25cmfpjXod+!B(mPb~SQ-zQU_-vJaTdf0F2u z=IeQePrIr3UUhRe$aX`m-I6@(%X3A8FV%rtMubAP7DvsOJ*r_di&&|nZ;@Eowpau0 z(g5k{gC?(OkKeQ)pONUlk9dqBaQnID)&MNTKI}5?x>k-<0z&k>lb0c9adSHCTR}X| zmShl&$x?>^legVc5Q5nn;vpqOu)NP4^Q6f5-O?hJ&YSb}2XJ7SJq8lzOD0j89lRRI zfLL!unqrkmkv4t6rH$Cmfe(+#s|GwflhtnGsK@Zw1|D3boCBgiEsf*sY5`c@tZVtX+pIZ zjW=;PM00Tm1Wo{kc!rQg=6q3M=2n{m(E8&}CYNszEHj>2pQFHZKcqp09>xoZqyHSa zZ&@36vjZ^2?QfVWSTo{+C-a87n&}S0D28B?2aHW9C4f9&ULUe9)>j>U$F9xicj&$O zB|5(D`(ml_5?{JU$Amx^Z2@$moX5ZAAP>}5nR!i1py z6DGvZF5e$EaxyulA7K2uw?oBQ(!{N86} zVlf9t%;PJ>z4YBM%^Ei7(29tVHAGZ2RYUbj5VG=G_4*onU`K9I(r6*Z52t7k7eJ8w zCcrI@1b*l_1iDAuV1cmzg*>h@WT6LU-XD*D3O@ZTsdxs~4@PPyzb8+?aFLY0aF`XGJ_4H>UrQle;j8>#o+T5K zzuAp_fu8B|6(mc=|65tAIMb=T>1`Jst=hwLVTMo~Wzsk-_gfTU@3~#*u#t1{8y}yF z!;0qGms5_qVSL7DU`MutCzt`S)cWpnIz(GT^}mRCJ|rPv(_)XMDhwc~GB=`X&XET{ z|9dBz)47qn(d}R7jo%$8eg+7W6_R#;`gFG*D%Pt+CR@yQ|!@f<)LI-vRp z&)-<=LW7f3hbysgu$}#A^V?xlkHV^g)zSC>8qxLT`8W|nG55VGbeq#2!*ulWkz;(p zNeCa(#^FkYUp(p7*X)>LmlPGy-FIl1$ogvjbsd(2wjl>fzdY)PIp1<@6nLCRWvD|MD+ z9qNrSmn?t=ZYe|&`@aL3UUa2fFQT;`B1QaP#?vA<3^Ln-*cG+F)?Rg1C#Y~Gtnd;o z+u(0Fb=lSWg&t9)^YNI1{jz!D)X7HpPf+cQ7O?1f4-<}oNbKSBzlWxa%WgY1#k^y%_A^9U zmTj+!2MTe9K2C3P8IVLZ+Uv+ zV=yVVra#wy9CS-wH71A?AOP8x$DQ^b;$pJKeF8%(hPzkhMi7mfvNK@KtrIqYDf)tJ zt!*My2_MIsKH0E~caE6Z-h&P^<%c+bfuKe|RqB}|h7R1_DqqV|thr7L#}8{^z2hl;|ybdEqv4p3xh5_hFuqUK3L?%v_pNC7Y>F z6?GU-Wl??y3`ol7dGcbLc*QnJA+Y$i@P&KOvy}BOBSn=E&VG`hJJVM+0Jdl7Fr%C* zCBNw~Dg;{&Aa>vID4B9t%3U0!!(_!zi>#N5T)`#9oUS9rBuA(2ssy&bHaJnLW?qyN z!5K!v6HH>6&Th^227fQjHXobVqJ5DzjYD_5=|2Ox)N&LDzeJW1->lY#Y#I>sSl=xK z-NygR_AeC1y;P+>AEe(J=Ct%~>3!c731D|BC(0Y+Y^oIXky|B!w@MgCTRh*kBw%(4 z%o-MAKQ4?)7vYhJDBTwQ{_EiI_89i%1(uHsJDui!SjPmckCg&JM^zG}pX}&_wwf8Z zFq<`9LKHw<{IfwHX3K-}F#Sa@v(F)S19lDR0$$xlCIQg-7=T2jXY~H1A&^RlAN9Wy zDcr*%6VW}f00Nxu$wG_+wTMHW@`FzoEq*gaOI#z44pbH}bzZ-JUz6`Cr+RtwpsCU> zoPCVfVDUI+mBR3n(i*q13q=^!F9NMuPb&A*o4ZtN9u{|!DB{`6PHBXN-IoxXx=Zrn zkWmqj5*dy;1I+dqb$R;uzy&ya%==;y_48QA@y|7BumE*l`Sxu6`g+iXEdhli{DtR; z0^xEq=!B6cv=W)DL070Ij!1|ejY?$vIQfI*tAO<~u?vUO`na};lm%v59Yi>b6^`o_ z`4o;2^}2oop!=*;lGU8^H&@3j;MwUksi4sYc^5M2Luq@gNrueuUVNUXsEaV(#d2MY zcH7`jaEbU6bQZ6Ab)JCe@fD95XEV)7ioPHk2ZT$kGN+)+JcteIUP(K$Z~(=3tO+YETBY}nJXLjbKku5v8O1+y!|iOvjOlYt9} zhz98zwkD}Y;?w>(1q2ZXfljz<5zIVUMGoXN_tR0y8xwzf<%!9SEVNnBQ_Q-5H#O_+ zjkr6uwzjiN9<(;cRzSzL$$7Wrp>X(5L|*@M)N-$dDY6Q1N<$b7Rc$gt3pdxA*sN*eZ=)p#sbDf6GH;S>J_e)*0zjAYvmuTmLghei+0^MPm}s0KQ_DH}m4|UGd}txPJJe9G}QQ&UHWwSL!^L7yS?!JM_!`-|LT{W-_`$> zc7D^CG)tCgivyayiMgzPB%VwU?VlzmoufbcIBPHAUi>Vg6P|CPa2`?nl<;xyAAK@V z@|9{g?ga@H#fQ5WP)}(z%tDe0ANskGq>}ji`Poh_t+i#_8$}k_U$qQx8tG1)j4Sjd zoqU_C2pC zkT-_d4KDuK8#^w4Jdle@nsu96QsDS?XXCntf>JBy()|~$COG)0b3QMK&?xu?qUp04 zgYb>a0yw@5D) zazq(?daRkU>zA~SVqH2~HdO%Cz`*0UWSG9q`I#I(D{M`qNa{qgOBevcfq=|p7zX|) zZ)^*$8jiq+YE3@&DBz<^N67Z-ftbvXrP$=ozdj-w=={bER%WXa!P%r^`Q8wKXG^l; zsaY`v9HcHbZQPDEiy)NTW#kgfAzoNaUL=KU(Ejy26;X2a-@3NHyXZUo6EpaOJQeJg z+6-7#;ZmpHT!L#9id&)kuaC$AoSyuA7)M;#;lefI2wt54J~TazL>-k4bcWk_djSz=}}d-@CRyUi2M{om#jdjYl%O!`-l$EIEp!Sm2K9 zk{yXN|CdM9`7f8xiLL4ZRYVTg;n#xxwV?m?f)3xX*U_oeG0BRHi%X;AC<1%E14UlU zx;Qv~{%3ROYcF8Ql1My{IfRe8Jn+?pha6k-{1F9zEqbiuUeQF2S8(a^Of)WqI%CB! z`EW>blR6zJd&;wGC!#pPBj)mO500N5|11FcyZ}j@nX(%Zn9~g2(+bh6=u)r_EPe(O zJFrwPV>Q0ZhC_0%2y9zXcC!@dqgV{PfBMEwFbM^`Cx+iBTYv~#Qdo%#{58yAvI>IB zQ?a8FTZ7@L&B>`6j@_CDl?GcfBHz{UF5F_zJwLr>|H;L4;P`ZO8ayowXzk~(vo)L@4py%L zY)^n~^enhw)ShWmQb%aTq;i%Iz~$nG0>B3Q8T6U|Xq%1mV#2qjbnZC?&p)z#}m3 z^;jS=oX~9lp7+RjSD4B2tQy>`=~t$A$stDiFz@y97XWqr?3S_F8X@|Fv;ONH5Dytk zIgqv_ie|(*BqE_lx?Ihc#DfsLR@MqJwsWz3`Bhq98!S$eIUTe0z@=9-NO3!O|IIoc zrIOmkBmImgun2;>z!R>viZ#*zR{8kxyPv9Hgo=*v{7d2x80d>hHD?LjnD!7+O3+?^ z(^ANV<0oi?7d8M(l7Zu=PuG9&*i|lPUwB+3vhhu(7KTR1r+pHq4gnyor5niia#*G? zIQ7F}ULGEe-Fx;(8yhDf;)5Dwxa(m86k?NQ2Bt)<&E`Nr3`T|#MJ$2jq7@laEQjTP zlQ&dTW4-c&>LF~&UO^Y31>}Hv|9HUa4M#P;a{>Odm{GZ$!<5G?rB(%z$*6b6$FjYK z?)b_9hvAM~d9u>GR1oxTJg8uvnHwfH&+L(_07I2* z^L_3YkxR++$4mL2T|Nl8ukaqTMp%_}!}_xjcs^~?aDGon>3#u&CojFZoa~@Y!wu7H zbdO;v0L6KN;&e5Zf9yDTP-)uO*l^)30#jN;E)rewiPL1DtY$RkD1N%D)4f{({?*gb zYtT!uW{EPaU^;mdBZCRmmbn{-uOs-H(;HnKcKR;PHF`gN95Sb`k(-+iYtTiQy@J9a z@ejWhjX=rJg`;pHKf&`nJiA{^&Vif?7EyV^W3-fGB{)> zb!pk^>F`%CQN-^gXDg7QGKm!ERFOgU-T!f2!|U9$ssTT-{hTlX#aRJ(-O6Rlqwzs z=~b7CtjqJj%X?z?zqv;g1mV}ERT#>nB>~~6IvO;K3HXYd;`10z43ThuDw5s zb=>mga)V92{PXcbhA|*#s(oe>jO{-jrpny7EQIY@aAbKg zv(V6u2_{B8>9Fjx*FS6x?T|2dzT30{qQn4qM;tKc1o5gcC~p<@3w4;#fy-Eo6^G=oc!PkUG7&2=bJSY(R4pDj839HXZ&%{V)7r=OGyc$B)Y8HF|Qe z@6m8c`F0tc^Uj-rEUjyfuU&0dwA4p`v@g!T67de*Fr+3c5AY)1G zvu1$?$g#LHW;_6XvR~c(;S(KDZ2Iq$(EA3xX8Q2{np>$zyrK4KZiJ!0sB@(u@jK1t za$xEB&BR3ZXOKE+;HSC0OBa~{g-Pu`zHT+SBo#v+;Z>cvck=n~#A7}gEPziJpUunh ziHQvJt07#kjc##hhGoPlk1$~AQYwtr!UQnC_g=E90!XFFsytfvpZ{Q|FEzBC#=O*I zgF^qw=_W#lwXVKU7&&w^Q@bjC)k#7jk)6#(NkbJuul+pg zI8+gzhj7l2VoN%|P;iNb$JjZ5sQCg^5vE!Mp)Oc4xL0Gnwr1LkO9;uFK9Od+5UtguD-k9gM`x&IVE51?p?D}2?u{&k%vw*~>yJ~s zbCHGRHI9>dU4FHE{H=>g)P~dN3aQ-}cF-66Cvf9p=+8spL+=xF2;%Pf&)<;&Rcp<+ zA(>zG1iXZ;H^OTv!U~$MgwNU(q3AP_ys`BR6~)oyuWo&zZg-;WCiT)514n95n7z4@ z*&XxIwdrq--45cK!ayBKjvklmjJOdIOJdxX{hC@;sRHUD^GniaxOp8sI&6c8?(TN( zM$$=vAhm0rMHrzOyfn2>XSBYIR;XuRxnsPC4Y%Ve3pHYk9FgSU0eK3gSS<6Z=G z;e!LR8hqDyc(rDoE)1_;Rh@#Pz-X`Q0&89R<7a_M_KR%njE5sYc#E3-M*037$?d#( z;^9qMAVRs<-M&wW3%9m!Hg9GoyCz6h0(QB;?jC(*shDoP~wjz8A%RMy>G4zi3pXBgRkg%sQoVWz<1dm zeIIgTyF}h5h#}VbcxDLxRY&vC`W9R`e0M=|tNFK%T)u+V7O%X7dd5OZ`<9QYt}yw( z`o}?B{#-7A=8RW~2(aq3AxCo>cVGzAYm(Uo-eYKJd1Iw8oU43mky=(m^{bgr9qIU! zhF@@mAAYMnWUO3lT-@UBAw6$=Fj^wf(9pA;R9L(0s(z*ryN2!kTFG1u#fFH_cNUFF zyIxt~7JBgCtS6XBjX5&$CPh1|gwJl{wD0H8TekPC9(EmE{6h7d5#74X=dSt8I9UD# zjmgRQl!J@L$6|2=ZW;BkB?X(ijzNwU`R&^zt#^f_K}$R7GCu>lWK-&(BB|4I_ys~DEB%0yx-yI;X!AbmfHl}PkM71B3mDi zL=`?tV?3f5sF;C{#9uN$v+13pzVOkkRw|xWdR*~VRIaVl#NHcEUtMD**t>s!=f{P4 zKcSZa-Pv+n&Ij4Fp&?GmOvzJjz&W@voRPc9b4!76hZ92YXN)Y}iOA+w2E@YKg&&|w zrjh+6c_$zMq;Ixn_N-S{Jh?zJnAoH%xSg2L0?ah)SY~ssi0oQw$H$(sGH3 ziN(gp>kmaBebc$yMa=*;(35MqfBnmw{+>w z3ww2kB;NZP#Uh%D<;z(osHn0_rmwyB`pt40*@TXfI7du+4JX4hIXPK?lkq5aXKSiP z9^v!rK7WXO@9ZpMdp2L&Y3Oi%k2v3>C46)NKhGQ!S7Sq-iB0nT?Fgj$&EBr*m=HoD)imv~=TL1u7 zkE4@SUs*ity44hM&0x<6&!ZVVgNw`V)~{1akE2VLWIjuIw7+|3{-rk|TV!w``}~u( z(|eUg#+$@BY1=tt3q8M)zbnAc=;23;j_~G)#4C~6<=p!cJzVb_5jwgOg;yPpUW>b_ zc^udID(UTfn~a{TW&>qjjP>ZN${{eplhb+SaUze5(3}qlMZe#R zAsCF)F5z{zpkg*J}n4?#2; zO%b;YmxA3YLh%ASFUoh^Xd0d#sIPo=abfBD?Sop3ZSS@9)%t?_N{P;svh=$JA0t=f zDKoB_dWyy+;#N2CMzf_~J48)%7t^9^nJh`UXq?rf+XO)_`qD@|n;J`+k!qT- zn7NxQdCU14dAzsX5$`e138T-0PjijuX`d`-iSv*QX1;l&HY6MUxb(cDxFZ#Ht~6TU zux~&5=G5TyM(hpo=Q#j-f(gi3+J(Ud*81rExgLSAAUR=woko3&{AL6G!R4KeDi0~IT>sG^gvh*=z-U>6a+CVsD~4( zcOKS!+g>WpFOWoq+k;1cKaQVPm5B-{A+f5$B$DGmEl6J`9zhVZQLPK^Y4xt(xw85S}i-oAefc6k;B$>Y3fpI7w9nd;vKv5^ZF zr&PuF8u5lZq=%%;2tZ1gJ}dg_OEyw>1sN5;!FT?`M$1DKQP^6e`XECgWj0A`b~QJo zHkM9(t@U`oq6_6evOaTsK}^XmIAL1eE`u4`rluw$R{S9(ZCA?OGk6qtxDMmpBl{q} zwr@A}_kc*aeW;JO4;4v>jo}*4l;5J#d!jI3!am&LR(P8FO6LcI>~Faw_9O?hp-N?H zn=H=4ch1mn3;iH9c_yh-hmQO7X)L-Q{}?cwGy%e^wHZs$2JGhZE@vf(+y44XYDy1_ zfCM|P$|9pB!0xgG`(L{WYmjh20ci~|)xx^lYX$X?CtqU8HT4?sTd#qkod_Hla@OSN z6$HqEa6Li$X>U-&dF7cLbVqPj zK|qJgxIF^9m2l~qiLvTKegEQRDDhTO{2Gvm7@=?i0iAJO;RS)be+aAr}>dASgkz+f}s}!O|3K`aNJCfBG_NWh*3I170|+ z9Ic-$Q=~G2dFD=5!^!?(@H`D+e^!7L^YMBZX1`W`-)%8FBs=$VW(5hbkq*W0uH!h~ zNiAE9$AInp@TV^y<3+~LYCf7!Y^j*!H$PEH?t}egfO7$>#XO`9h4`hii zll@_dU)KFv4MDEAO-28?ucz?n`Q;j;+>le_DH6vIefqkNTn*JewGhrWp}8mg-xj;b zudgphxz^lOGVz;6*V3@Yzw+)%tzT zBax21om_^U>D}!Q8Av=K06omASL+eSNnM1t#sw0ds<%rH2hE7KmJ~7b#(3kVVYh~jvl+c>sXDP6a@_S>UtkL zoVM8A^a4GW$gbplgTYS-&bEX5b-4k4cZSYW>k4VUmYe7qsldG!k6ESPuB@Hvo25wW zoB!6K6ntl=Wky0J4`)?=(9r^1NBn7|^bV^cuY*M7WdN6i=>^Zm1)a%_b8FY@yR#Qd zY(?g>tV;(SdG`p<9)3IvL!#r24>3qq+_^AS0X8psF>E+1U2(!r3#D>}V+3LfzXkTR> zYew#uaTQ7y)5Wp5@$q_v<@;IY`-+Jdr;0geZEO3)9pX3HWh;VHm6c;(&v|n)Jl0#5 zFuXQ)FXQqhMGbi7m>uPI5 zw&2i5(&RpEel#XC;k>-@!jiK=Vg{`X`a~&*mIc|3DX9l;XO|5Jryg2lj?TZ0r!rbl zS*+^Iu4>4XF!EXl#Bv zlXU3RjcktZ_1z(4wKLSryeGu2v}zpbR6t%cOONWY!fl_3k?KhxX$T5fb(sy|Q`PL9 zE>o>ZKbT?rW{-Ja;eyZb^YBI9wy6SDwxB^JWD|IO^z>Y|b}g$>cIzYIQ5rJW_0N9M z6R()J=kUcaPCMrs^HlViyB@S}7HCe2STC-B9q%W*746js>^9!fh1f^fWHET#qPsq< zPcL)V*h|pho%t<)Lc!|6e({C{$pIL3-JuIXvb@buIuRM(DX<|S55sKMR+h-AlP*Q1 z`SA0n9KqXKlTo6d9||P$RrD-$T{sdniQzS?+BDvRp^&ZX4asu9Oo66_Rib}!;-{IG zXyJR4!P&O5oDN$l0=9aMd%Oyl{KjXx8!2apo0CE!>CDruYs;zQPRKBPKe$;K9wq5u zKd5mChlEv0g;K6l<@GrGD8P?zBG^@OVc)5byQurguwF>pVaYd=tD@IY>K%)&zxGPm z!VLt=f?On(JZpNuIM|Tllw{fTPjHnn;mN}Yu`16kTT5ArgZ+5n2yUp|r4Np85>K3BqAewya+ySGsVLf0Li z@G|+B2kXCzEazotTudprj5a%4jESb)XOJ*+qdhj~J)7G=9d!bCW7Y{?K9O7ZG6v!k zmr35M=$s6zCP=AysC!mVDtztu@czVBU715d#s=Z)GKnv!vs)`2TMLO@XOB;oaxUFj z=l3?GF{;ds2%o(r)Qe5PDuTzl&o`Yx^T_Mb2gkq90Nu&~kC0gzE!o$Eomz=Ja>xC* zahqB2FbrHi8TSQRcg>uKLNdVk$P7eMhX_#M0;hrQG7{KgE`a#69wDY=S9iny3(|ve zoKhHVU~JK;%bM0}Gp4B_Z5t0*he|$iM--|>j z%~4SexE49O=x^cG6sO%RxV*Q1<#*YtdZ-CPr%_!WpiJ2Zt%WnlziMMH1&mL*y1Md; zd6v;qdEf|?tG5k?=Gc`oW77gZw4)?y3 zVvw?`V8+`x*nF%t#D1x#?a_q??_oNa-CS5-`cXe*B2^xEW7VEHxt)Z$L1MyiWcG?$ z-M5OcgPFa4)n&B>^U~b?EdrgXrBAt;XrF8fEh}DoU^NuO>Bv|9h&b9~lOo@zx@<$p z&SBw2e}AZrYhi`*$1$m%4Efz2 zeriLV!I!b`WtLaDD_5v)_p2+~8@qP3kUScp$27NIt9R#Ux;Oq|I>C~CZRy(hLwki& zo76q}{bq-I_0?S~zR_OE>yyxn?>v3)wsIj~R$pkp+JsckNHea*Nss0YmC7LBBRL)l zOC_($HZzPn_ofXRZ$8`3f1HC<9Xj#=oY5+INU$j656}ohvc=?$;S|g9pz0UiJ~o9N z>+vJ6Pe?J~KX_CG^Q$y6@5;INw$E6_?d?BD;z@FQH6C*{oZ-P^vjS~iL9V{J^0QPs z@S*bqxMMMc&(>s->he|WUc0X^J!xEuH%!|>>3K4w;3sg|!n=@buvU)33;%N#z`lzk$gZ5Otrijb@Fb;w9Oy#&dV z0|ZB2JlDC0k?RVfNz4~Oc8rEgICow&AAMcUekW!Kn)moMB1>~xRe_YOp*#yctiiPf z%ih0lP+b08MNFq9x3N-C)`Z@i)YO`Fc8vUevWUMo@wO4|)ewdUBO-!EHY_qGZzEE_ zuizn=An5nvTzLzuq{OoIV|4g@Ik~yDmsrC!KF|g!nR@Y$y-zE*yH3yPiAxU=D17Cs zgvgz_TrLkg;6I&tHzK9F>JOYQQzLB1jT7`wpM-4@pW&%Cj_WB7ZeqIB!LM<%=1+Q- z#UgpQudeAugt-_pLslO1@aoc=s#851d$>o^iG%y)TU#@7;*;tPHu5pN0Vn!ZH8s5Nj-fAw#6BnyksAVknQiTvZANE&|Efo?PC}> z9sKg;^5O%_uzmaaYYY~QDG$EN=fU|75<_$S023kdY(9OerL*=NI=XE}V`N9FdrhE+ z8wMTRRzlGSIt;6zwdX~Q2>HJvIk*Rn+>Iv4{%YF_7SDuD0&>8q?j~mrL$UnoxJMot zL6AsD4-hOCDJ~!&M|XX?B0Mx<;i5gjVViyHvM&AuC-}wvs9}&fQQb)^f1mZmW^Q0A zk?-S~kb=pBO)YK4yjFuSp4RwWjluoO{#bpD7rl*cXJK+Jf~Rm^d#6w295lI_KcO15 zG1;c2^NmO=zb&u#igi;z+HoQ*<)UKZrPm}n2+Af$VCs-dus1=w!v>fr z*o)(5K~CGZn$aMrU3UZ__JzV`5mz28&D&9Cx7rlROQ~Y@(i&`WsR>c(QKkrs@>^3H z&F4L@yk}mQwS2!q|I}I7+8{}t0ht}Ld3--_&(_uib9nV3cBGe|;?rits`6&*)T?yC zBdT%S9B~YV05UiHE&Mz#40OR0v8~WZ6-1Lji<$QL5;wP6; zTWqSX16yn=TJ^OeGU_fFlzseaJItHv+5)p#qPF>0dV4=&J464o-;J`Sp}{YlTJ7U2 zL0iJE3r^Yc1CR$GSN@tEL`%W}b)@{)cyp+8@!~yV!!c6`%%NiY`OA!UnL#{Oz?PJk z58}tH&v}>80AK3fQ0hmH#|N#u@0acy2I^-1CkxKFaEs7ylaqDqr&UBv#}4m(4539- z@<-_KuM`}?whKVu-C_OfAk5C;tS^(u=4*C|Wp@vdriRO@jd}9(^M`A=>(h_=A`H=! zv_RzbL#TNP!GmUzYcHT^%sh0yH9=83%_$GFF_l?}Ok|Vec{TW*K+A&8h$mAK?Y#Kh zCJjMg^fQeDxO!TBbt~BV3FnmE0cQrHJn}61OTMJ z<~x8b`Aw{d4GSP#Q~7V+fHtm@OcTO7PU^m8qYeP6Fm4_W;F4^XfxWkJ>0c9LCt;ml z8V$@nO|iY!8(I$UvR36-=(gRLN?PZclfdwQbaxUxb$uo#{Hlfj=9gl z{=gN!tTW$D{|Js>Np^a}J~$GcC5l87ct}SYMfp6l+eCAN%6GuKlW;zG1i0JK-RZoC zB)H#|NH-u_lI;1H@}t0P`FlSJ1pm}I_elxlkz8-(@(!*2!_!6b?21V zp2np&$~(4iC#CxRLH+Ts9s_SLdb}Bs-XU$DACBWM{~3z3$Ov?-1@W*YY4csAe{vo_ z`@C}I@5kwuojN{x>fr*7p`i)**MSGH=S)f00%G?%G^LIIQ%&J9NC?Zp|OB z!jBgjMGj$=2b&Y=`9fFF$<%lwW=>R$E%QOWePu@jpGK zf1I;4vbu271tVOrn0!@=S^nJ{t_`KYx4k21Ranhkq-H-mkDna^$_U}&Bq-2Uqh{ab^PmfUS zIFu$UW2zWE1QLbLM-8BPIu0E>j&jV5nnv!SlqtPk&+mOmkTO)tzXi~nd(t0dxO@_dSsW3Z7a z_wWq0ua)#%cSHV5YeDac2U7-lGvyX4r*#WByXCe%NA2rfon5BKy(CM!CKog#!)Q^v z{I0{c?6t2^xlF%B&XY{#YAw>F=A96y1H)PACs?{)u97-Ez<)p<^r_@?A!e`|Z8x zX7*@n-D%vw&1mFwQ2Z<=8G14h*T8RXYd5cuz5SfdM&X^~UawFRii`=a z3}PtqPFT6(#?c&}uLUN>(_|N|Rh+xmYJ7KNQpYfJmp`jEpSNf5Nv9lpx(LjT!kCX@B($KTack#APk)~v~yIK^C9 zC+}Odr_2);aZWXpDF)*npMjY{G$yIc$S=YRp*6Tv2y&JbP?4Z})Ze?)L1%wccs?8~ z>+tMncbA|hPcbz;=h@YBTjwg&{%P${9-1 zx}(&`mA_;>W44G)9QEUOX;CKqdPC9pG->v<{S>?_`5+^XgxF5d!$X?rkD9m*q zdw`ONy>w4glr$aOv5H(KLa1);+F~F>c(&L@3Hies@X+h-t=77BPbQ=1=|c{qSVG`C zue)xJ$Huw4gf*e0<(5;Ii&4DChrY-`a{!&ZcCQ0v=cR$#qdO1y4w%~7+}o@tc<#M% zVlej<7Xeahyf7m?Bk|AXac)tbI}7tBaV5#&+M_2TAGv}YN46Mh>=GRVckHM?9_2gCOhFkO+e=*E?D+_2!!yA_oPW3kc75NeIo-!@zFgVhZt>lPkP4 zuB=JYJ!*e6MJ3*&(go*$XO{~>tMF1}Qq>DX{02~#pvt*$v6$1*5eKt}8dhibGiFc> z!kd;wpd{b~3I$^&$XZ@sRB=Ts{{3wE5yuC~qpxJIF80JPOf*lCNPad5Y6SW5#At&S z$@{uRfuiDotMx1xM)^KKEtM}(MbRl+48{S+v_GpQ)dAz@I}_E1?O3-o%~u98M$BoXO9Ji~_~m18X`MX68NmkRtCNw+?*4il%B^6iSo9Fr7i=YoaL3 zgqn}dpiU!2C z{qgvT-~BW|%2}pZ#~|(D*tdEP)4+3c!B8=3Qk|G9n2Y0)IN<*r*sEtf5J){+e@a9) z5@4<1j_43S@7D(m#)F47qx(#DM{*|G46Z-Dxkhd4E+CXuE~2JMzfFC#Y-Zq1HGRT) z_)2jcF06D?`^bBNYWCw`n^mq>b+cYLnUd!{i-r_*Njr2+gC+Pe1I+y9&%tuAp4O z$B2De7Rko-YcrM6DVnImoupY;6Y7>&%*D#te#>w$lwy_VI&Q$50tue&R-%VvHi~!n zD?i+h%%2&(bT`_@m11((ItgX};j(o#Q%jZ<5gqz(Z4`H53=IneMV2X4iR%6OZ{w}r zJ=<=&Jn7MXcdO2+M>xaq1QoFbL)W}=1B!CPA7gb@ zG~ZsuxzjBB2$CkbN20B-YLJiDW!ZlWii=825S+&E)*sIA(IHh3b&aP#xLgA?J7mRn z32NgD1ed?gx1v<=E<{C&W1Tm)6<;=d85$wD!zipONJ@iJw+ws1ha}W$rf|H@yo0E1 zW%HaPHYqPPT;14aRE-8}C`gfF^1vxb+iVb9p-RFa}G&1iU)*&gU2e&*& zYuD)=rskg6SH0tb7vROX$-` zZ6mC=V$b%{3V04^$~~4gZv;8-&=gt1W&@4B-NYdfAic^<%n}~^@?lTFj$&S4&&N;d z^wzMm!j})v3{13xYD{03Y+2qCjXMmX?^pw6!-HII!Js7f%rM+(vVw*P447QvVRo78 z4<C5-ZHjNY9LyU*Wrr$@=Uw7XVr>NU4?u(qw+;%>ftcU6p&4oGQS zheO66bmVn=%X}5=E%lzmHOe->c0FPvz@rG{O#44T!iDVRZ;UIpccCd7U07bt)7pwE zgOx2h>cV7dQMpTIkbKvl7oJ_I$5WV4$})#g!obN!{%dp?P)in<24IgOCS(N*_px<_ zBhigw<`hT@i)6}|)5&&9c$h4EloK(&DNt1c?x20HD@zR-T~?U0xWyuIDfBw?9Z~TLrJ%$cs0(wlfGuKJ+D=$s{|^3)A0nz zBiJY_5|KT*Xjc|nrp51rb6q%#;>Zx+>Sths$ODI80UZAH^RCWFW~@Una&UDt+wri0 znH|v<*!B5!zq_VuQrY3F`??pva%1n%Cc?f*pW(A(w6@)Yep5?*?{mMIes)1XneN>X z9=yH-q2!4g-HAkKrO;T~x>iS&`DL{|;mEdnqFKSVr>;7$iQ9ovj#isq@*IJiQDZmm z*ImISC*dO;u@p(e`SkI9k)cQig)h83PqoMO4l0{BwRb-y?PVi@&x|-3hHMe4++T3% z=BQMfj#GReS23$CV(R!p8pBa%=uN@{6F*dU%#I2^CcmfO zW)6aAK5Oo|JjGRFE<%&cjUxV6!CvOCHblYLs4!zT;Wvmiy;}Q1?rKXY zm5lN&YQl?U7^CggMNvc4)9X5Z3}>|KvWpSq4B(M1-D2?HYTjZBn@Jy-KxI!J7yYlX zf@ibG3~l>6a2t`sMeAOv?dWVoVcKTXIPDkmVk4zowmNP1NMCom%j(HgkNtH#oQ?>oik9wbSI}=hA~bdkv@_z?V!OyWYwUPj@i1N zLHiovmC^3@_1#d{gxBGljgq!xnTAD8%8N-l)ZandLI%QmhP z|Gf~OQSG{}A^MZ@S?7$3qbIk{`tRiO=rW8o6(_y+0-N-niI_@SU2G zMbbZF7X+is~TusfFEqnrL zcd$M#un=ugr{GM+o_+K9$kyIVZ?&X<<0x_CX^XKEPJVOWyv+Oy2WJK=)wEd2`1vr1Aj4XEw=v_6KIA+$E$@ zfWQmNnU&&!UXSTz+ssA=%iF3(JyBWVNKNx+_z!>MAx;^~}qCiY#mtpcFc)^LhWccmx<9PyL{v>FH&ju0mpS zeU}u&lIW^rALNQjgJ3op*<9S%_6(vz@hXQ(7o8&_)1yD14EG7$qJZJ0CapwrZ{Qns zd%59fg90A3V*Be~qe`1rE`4cCf{bmJi$Z1_9UG?oFKM&OEw_-`XDbx>;Xf&KFF_xE*#AakU=M)e3sM zLbEUtWny2v>ev_}UQEkR&2JvdIQFxoOC=sgdGf?Ain48i7Y<{pzhHUZf)W$1^ysh6 zImbZ``9-xub{|4LgWL07JhFt<0bTPUvr4AkE*#*%@X2R*-4%`fjDs65RtFq8kE*+ zCa`c~aS9?Rm8j7E_4gbC0UXKC*Pjp;tp@s(k%o^R)-8#;+C;W@cqDbR-J4D1HyoW( znVLiX5eHJbz28<0KbRC>rFaBC_J=P)8~^OZ>tmZTLntUIDOFiRJMZATR~> z14P*&fN01kDmtB+Ra?s(a^I{nS;6Dl{{C#@l%9~VX^PIrp>qJbEH@e!rjVJ_z}P2b z*?G~hIsD;l5Qsv3T1}aD4B?WG@d`71&=NvCH?*m+Rb)%WUrb8sx7?VXVBV~khp{u5 z3%OrRMiTltyoy~&ZT|wK&Xq>~E7%n@0OTR>(zo%e%JFe2uWsNG7FQ*L^o%OQvGQ=Z zQ;@zyaZ-O7cg52<0WLq`5Zn$-w%IU-rE4rwqay144NVDV;@}W%51 zfSMO70RNI&z^#zr$S=w4sw<%?gHGcw!4TNyKs0a6vT}~|#r}JXNNXPMs6#tt`NPAP z4H~2M`O-PxR6N}|^kwkkyza5iGldf_na|${5x!zzRS?j*5)aFo{IH zwK%-Cqg-wQxh}Vxp4W>&o>e`)A2qMJF*y35SHzliy@(Fx#^% z@w3l0+*{yM*JeH7bPxAb;jYn^3Ui!8BGTb@T!TLDeab$5B0Tv+c=uK?9c+dDNqqR@ z5UQ}2VA3M_hKDW63zc+d%d!H}u{m;maufLCT{0CuqtQmAonJYIUpCnOs8) zFB;_gvSl1Uuyb`y!P66d8u-55hrM0eBF-)GxljQ#qOdst1i?G8dynZr(^O9^MC(v3 z^oF2l++A)E56+=(UzdJfp>wiJStNfZpXdEhtMeIWmv~S$v5B-t2@>63KE;x_%5Z0u7BJzhC!aha-0jATW&u1c7KHPEaU$%hN^=In^ zm@*3_rxUk^S7EJRI3`e$XiukNMvJp>L@QenQZfb*LWvFMhJ&M%)}CHopheVd^t4*QX5lhMhJk47l(^{%2D%F^WD{D_3s?|IT4n=?^87@Y%{ghiDCpp zB@QeAZDWgAh_VsOXkKw_H|U{vb9klx#Jpmi;4bXz4EJbNkR{HGH)s!}Oks00`yGU% zmQ>MYCVf>;)dqywyc;cV$eMiDYLDSWdH75N8yHF|?~SL3H>2p&0dN_f6lQEwiB5gK z2VOzGFJt>8V#X1X!ruQp91NBpqJGwS<6u@ZqC|`BL^-`DmQ&1UB_mD^hkbtj!*GKD z`BMSUJ{QXnF4RilOiLN;YL8LH?XX*)W+z*pF!C=-f)$;d+_qHIE5zB^A*=(JpxeT0yj&uw(Z=Gp2gQ znkl!2{Q`MVNZq^CHInAmV%`yCdD3A%<6rhej}lF;{;Bgo6^H$vj!x*U>^~W<__9zw zv`zlqD48MA%sJcSdlxpx0KJZ#&JzwHZ%-tCnIxNrdgAi`-1XaUoQ3bsuEDBi@TKg7R~MC{G5M9veJR@)~Z z8eeP90eQBxvov;Z3@*$>_}90L7ssg=I%XsY$*&{A7uCo|4UvtBVXw6qL|F|Ds;X_! zh{g(n>O(kdve|S8X3M`a_D9b@L5Y5KIeZ{)>~HIKxQdBjsy{s@ENVKhYdV`?!D_)( za^z~8P>^3yS+mUo)oh^Ih88G%b6S>D?+_kjf{;!u!!99PriO8(eZGa$tiR=CG+(Yt z$3AQ6$n#FnU;)Cxh{Y4*9C3MlQ0#6Ap&xwXFuhn6?(S0EN3t}>&|9h_^^im3m9z_G z2!@f?8bu~%C7k?9VUqcLUx&MLjF{13EV9wIVmx#8)wb9wqBV0qcEIASH3J?`z+={)zo&TQ8c z2;mW&8}RJ(+WQP%;YHX?0IV{fuQ_v=(?DIwkk?4fk#OJ6>R%?E=sS48Md&G4b{ZAo z4ZmX-6s}%oVBoB@Fu$<#uA9wdHqpG!(B4O)Z(M7UCI;DIF}uW@Ii&yKR-c8@;$>Z! z(ZU~uT0aRw{|a1*DGa*a3_J?E%`!&8FO6Yj;4BV`Im-?Uc9LEi^9J@*|_iQ zrg_uCg%&-M|3xWRI&p|XdGuYb|bp^{6}6!Nj~!`bte*QYlc zv>ndkx`Jv*C9<%F{@6#ykFz=2CjL zDxnt9+OR}phNBu@{Bi!^58ThSFroe&3p7PFZsitln6VJjo{`344^k*#c_L*E!HW?bG^D@PW}a$gcL=0O?N~&!1&XyTY{{ z648*>&&Sv+N{f&mC{3Sf&gynbPw)}Xo^9*!h|rEZ5kcn5pV(;8rJbw)5a8_JQ$2fG zSa2>y)DmXQvOWsBqjU@9{Z0%=0cs|fg4&x+VjT3=I4En59_h>v9GoE9X?ypJts0G` zVzTbM8J9F#xHau_eQ4?YKia zvwT%7{GGt?&&{@)=IsWc)vk27IB$X&wcJX#5aAyz!dimUY*m%D#eo~Cxrz~y5Z;GI zBhX@WrKU10yY7y47=!^O{AhmGV`J(xf$D_K&o9)0N+zuEY24Z)wI4AvvLz|qyF7+# zqC(9fbB<1z<{TC3@dWj~MQDGPWd_4Xse19`>L%8Od3wDbmu_A2EG*v*J$T~tKDHQR zN$L+k!vLWLAaEBir)w1u1Pavz)GH0>8h(7%!r-+ON)k1s9sA;DP&264qXF=_ZB1>B zEORuQ3%27&X>hnMM(+QpX}Yo36Od8Sv&kpKK|a1?`@sD!ZU)}ac^QJV>l``SIMLQ4 z93{J5?lWZ?uRCV(t>CQCcPGRsewmCv*dMgV$3(y_tyo8vGD@+w^NsmDuP05L=|}vG zp*ISAhW335X1-q;YYrT=bT78GjhoQjM9rIAiW-nsNym)34{V3xiU?=xj(hDZE-+lB zOTAx^AP^;C%buKKDWYDkgF9bshH6p$Nqg9uUPt`ka`&5VuEwd%B<%{ajbj>W!hloI zuq!=l&Ldc;s>n(%>+`C6wG{>@A0k^p1{f7nJorEp=7sYG)gx;S&O>!dD#njOQ^;n% z%x9;E^A`D@t*vQI2g5ue*Nl)}%mM z+d2rZR^BbIj-s;*e21K2aZv$x+ z_w)UicPFfilm!k#sqW<%b3`k=VL$KZi5hV41MT&hKGei7Tiq@5SuSS|GF1J~ph|jH zl(J2lbc@09P&?5v2XAL}_dLD$bxJ?b^xTat(kQJC>MJqpwyC&`C{^Y0`2^4vo>_8U zbi-a`E*nM$?RWopm{5u|rRQAj3&v7r&zE8`pj~RQ2)HW{ybP5*7g zj_y`9fsdAj9@8|}90NYX@QE$BJ(LZL=1sV4RUl{H0oD!Hq za!#+I1?F)jveE_O??>Naswc%Q!zLnSTQ-w^u4ijc052a-%P0NhlAAa6(|}NZS@%vr(I*l-g+209QRTaXoQv>;s!&6&M}Y&gZ4$WSiQCwGgQMN* znM%b({$1Y)-dw}DH2+~kxAl(Y?Be4zk*-4^LCK4heceDl3tC@F&{hJ)4A?Bt4zU%) z!m->RV85^`;XRVlQt-5`Ed?6alk4MBADKF(_z^{nLi(5$Kxm#%s>AIkC@8f;#R zE0I4}*zyOD-gbEm2GpNLsgJ>It)JilRUK*?=f;YDIDgE7 z7zpJ{GGEOd)ke75-Xkf?_ulH+6`Nqvpo)(hn;W9*)nwtiwY}HmWPUvN zo$Klc4V{!2e4bGocLkd2t`X6`=Vuc=JZ=3)=XgHo<%kz z4R!6-i2$|mM0BSFnGG-kwKct)bFb;_u8V9-WSz5pHbT~?^cI@j9nRQU0(2_#B_95w z^eTllloQ|V2ep-Ba3`73d%jUM^f1MH_p@ML_;sA9H*HF1MHu;n=WK%MJCyr@wE*^cfyLG}(MrXljQ3qnXCnC!aNyuk!ls$eSwqoaGAuQzo#&aKh)jPNYb88+qk94SP(RNmhlPcLwOgA{U)()6hRXyvGqhD#IH z@R+H*@Y|P4Z`cNktPp2sGupX9g`N=kL{JZah!71wb1_ zhS|q371F+N8Nu596Cj0}xAC0G{40j3!^7Iv_W-}}NNKOux^6W^`6M65NSu`uT{ZrT z>MIW0xXdMY=vySHDcSQ`Ra09spGU9fy4CN5j>`01E5F%^PbzXT)X1q*(%KFWf4pOG z_&~p|=HN$f>+=x07PIF?>*>j7Sa+8>(uN0Wsb5!50qN7dg%=fI_~~)*7(c=7pQG6QTi-eiQPjNqM7rE z&OdqYDOel6F_eY1@Nt{^<=-%aCnvjieqJR(%K&q`sn)N(ph;NT4d$lL@JJj``v&pV0ELSXUsA1XW0$hQ*h=#di1{f`j%wUgbQIhOl0 zmiL(~(aK8o6S<^w;l`1eljTE|j&IzYapPxZQmn8dzj-I6w>4`YLyR0G{1XB(v`FyyQ|)|b9OHg$f+0_b)vY;`6;yK z#M6Z>KcRl{Ogs)@AnSG%D zpfk>0nd-S!Dzgleci;>iGItl;C`xs#ornI|L>E`%?=L<+q#720A)S+8tVegmH()7; z?#h#wUr+Y;@UeD3m1RgWI63=x(UQg)NACP5e(W+pVZHQe+^kva0ccO1LB_Cq`%Ldk zbgOCQ7a}Y!1}u6av)q+E?O0AmQ6mG&3?%mh!wXj1@=#__gXGo~J0&qouW2?(GGFhu zMq$SYh|C_;tmfvm6ZZ?FFdC5wfL7BhT%7P!t!fu)=5=K6Ig?`qsQTt%G?pDPa~vO< zw{HFdv^8^l1dx{!cREXR{X|pklz9Q$t6hs#Uh>5Sc#tqeas_2k;R2085yeUL zym8$;s@NUwSicj}wOKa!K+r2ej2b(f9c8#edz^$v;-^0Is|)7yAI7U}nNcBY8TPKS znw@Szz*6iUodWBEm9wFWjwHVusSjB;SPjBxASpGvF_HzE@trd7{Et6ib|*gn`Hl=CmCEg7Ml$~|7=#XZfv(uN9D&{+?HoEqO5g8FA8qp8vV`1jkMqN7?ectY zLy8PAh`}hJ-7O~`O59e}&;BCeJYY5LA#7yy3e$*d8P^>4WX02>Slx)oa#vDseu!u) z@COjvw{6^yjd&x*H+I0ZA%F_8f*XiZ_PDo6-2w>oEO*hgYu@?m_BjEu|M6#YrF}wRQsLWCI1pa44u>Hc6h;o zWEc59fKQAS*B9pWSRyu;v^qe&>NxoX77qNC|YZ$ zKl2FFF4ixzi0b{AyA#mdq z&4PO_FEODcJFj0rp9@~Al6p94-f!mp>Y zn|;K}#%dul{aKD`Q_#`sR8!N9QXuPT4(WFRO5V;-RYCjq_fG>r{_mfoGJgz^+rOY9 zDSmZc?|Kra(#^IaDRZv!^lton_s|1|t!I(N9->w;F#d^yHYr?9d^2Is!XquYo@65e zkN|;OLAu^2XKgMUw=oVQ_YvC%ZTrnPesk^w8&LXPhg8il$zZ7@XMor%}%=He-#tj1tFXm&Pa4jD)X%s5ED3MKRtDSe#Ni(PWk zLs9H{EKP0wZ>dH<=uz%_x~3`kOZr_E|Ik2DnG%?s#d`*JBsqzfhAFh)2I_xH3g^CY zz51;i6yle|7e@k%pD_B%zH>>RtP3?2ryzLwLP!3qY7z-tZEidAjE?W3n#^V~q5-Vx z=%fi~{wTR=SCYhIP{yd9g;x0H*r26fNJDsicv@or?Nb5+(}2)>bbM8jZdD=Ra!z`} zN-QNS&6FnY{BrOm1`dzauK&;#DJkBFIu@~L5tVdoin9oZk%;XFw})5rjTve%m41vC za^gt7%1uybqY$g5ru^cSP{^c zj?<;L*Og*hf)-pW`DfUC3&s^r}KZ$fbXO60!q^KnnO>((fK4k zd)Ne%;dtNX(N~`KW`a2x==n$Dd@C6y*%Fr*tvqVp&M!;c$4U+^+^7aMKV$Lw_N(!6 ze+7cDH9%CiXr*6}ds>viI4WwLZX`15DhI=P&=m>S)M`sP7G5@`&o|BT|Lw__kU)9E zeBFBUNAp*0(M(DeLpyIXu7AZdU@(qontSq@H2+(Rd0O^4vlCl0o?aBshi9>~r(!aE zFpQ*mXX%$vLeCfXp=_gkB{V(To%a48!MvFjLC~$s5;;8O9UL7sLEbz_nkl3moSd}v ztnsqJ!oP+5O3HmNw&%v3{A>4iN8js!2K^$ZzWD{1&a%bQ;`#6RTP!#I*D;`ZhP1R` z{Mfyg_N&+N#tRf)!G$BUO*+}|a&^R-6U1|MB&AN8^`XV z>%R!^XQw-eAc4vJ2<*mC8&~ge4hy^uDwVhN*5n`qW=anqMkF*^Bv34G@tqNQD*4(s zu4pkwrr6yg#3>2Zn8G)OM5$!m(t;Q(Q;z$*wtc)yYc}>v(c(9ZHT+KQOPwFNazg_= z&pv07CC;21g57PkKtqUd(tf_N0`J07ay~p7<}hk}pv+H=&$9 z`#~O=zVE?;fqg-qD7!`QoYljI*Xd$yjow@_?Ocv%xu=C`{OT1YwuHuG_c3QpwLph| z`##V}brkt?m0Y`&*2lXrLHJ1k1^KeT+1aJc%F4<81D2E5B|aJz{uCt>5y9_GSQsG` z)RclwixIsLda73hepNLAyZ@GU_~)3@jp}a<5q*4@h>$(4IIv7vy(VY3gqa4z!HkPh znsqcH{o0aip{+E?r_XEu(>E1uvK3r5a^ggWKAh_UYXV8&AiL1 zvC2(KSy@dnvAT&xG$cN~_v0{6Hbq*4EtdXUR0c%Oxzf?H(pUaQWx=_f2V%}8PI=snQ~tUYwMGBl~4#bChD z(O&8Wb$1+B1PYoRUjnf6t$-{^fJ@50?BN7}-!AMrC5&A^p0Vqev7qM8<>Zf*rUd=- zSqBO5AqnBSbcUtws)Gi2WnfST!%=p^%binhMXA zzM?aW+6;2Boox5m2K~pw&R_s-n+jnt9x3=Un29H?4`kPh$IX-Kzs&=^8-{SeH*%TT z4>3A5u0s^qZ&>yNb&Z>9*o`6#I06?jjIXH*y3BYvR&T5{L)jjn0E!$GiP-FkVg#pv|@toM!;g z^+y$uKMV0dhsHch_~*uRUqVNR^7)P7RX(b7_83yfj3kESXfbfbrA5c3YjmZ($;g(? z!FGaQfo`bCA~!qb7-T5Xp=S=S4*ui2KJ{Rqo*y=H=~hhvQmo@f`Dl3c%6+s*^U|MO zLVdSsm*i@oh$4@I(S)L=e(eBxrSM~)-1TBGTPokJ6g-2|+fAu|*yYz+KZx9x7EIJ> zXMjXCPun=#FwBYo@;NO!Yn4vNblgH9;=x{=IoqmgsQe|Ur5bqt1~Km>hQA(;yBnQ> zfx+?O?2wE@X z)#Q3-@ecfjNi+4d6Y~{65g;_=cr^FA0|m`Awn}swH;W@VQ941j{AdBJ++#^_DaFff zy>ixPO>^tIA8H`q&Py)u57=<{(!;svvc){mO>pnEHZ1*eB67Oj;s}VCZJ@IhtPt_} zF(5(*qF8FhgAeZ3f2$$(ls{4Sf9qLK3%CVm@wZoe0K>twpOZffWed`XjvUXdvr~Ym z4n+|*t9<5~L2ZMxwiTQKt@Xiwx`uc1{a3--aD8bESQ*esnJeVTD@ww}yhoPX(~5kDF4n+JueH6{6? zELXM-1?o6MPfG&9N29_(9Sbmwj@n*uJtT&p$j%`MI)J>GPu#IJRQomu#_3V*oyL^= zuUz+o3(Ri65^6<^8eIg4)`O!Q#`i@y9ecM@7D>UbNg*#8;}VAFd(`3xzQwIjaV`>7 zm!wGtG(bLpA&;iNKS-N;-1BrEu*O*$)?Jr}y@qo&9Rd5I12rw~3oP09{J5=@@}IuS zi3W7E{ly|$+k~h zXr;6&)-0!m7^lJxSQohrYWPw8RwYkcx8-^5Mx^FD&>oS_ z2-QfY57Xc<`5evEwiJUYq2>~W`Y*(x;(%1M0Lajs4Jj;;Xf_kLE0>;KwHbkx{GR%7 z_(2u0!?e5GJYrDZ{uY6F>UXqq1?vgyj|1ST$c^iZNJn`44mWBmDSZBf^J_ zb2m0r*I@e%<*Cx;$`tTYLRjM%ZkZK8#<+ z`w)`TLF8`)gO^=Ob_+*=cZdotwr-aP%HQxK7DJ73od=Zr4Uq>m2f#aqYLI*f!dujP z@u2Bu+i#djBljq->9FCj-W|-CoaF1T3BaqLf@02#UmW*!ph(YO_BDzZ{4QO8wDp4s zQ)1?*U5NBU7>X8`Y{js`3?}{t-zuz1!>&^zj+Y;PpoaNY!(#z;(&AkvpTzE23rwY`o>$$YsPO5fHj%oY%4BoNcfrir3JVwBWF8RItwi@SxL~Y>jps-n#mx7LTpYITMIM02*$$51 zO!eq}uUri_=|G0^ck(7_t^zGBEz-5|uD9Ou-vr0i-82&&O5}k;Thlqcwe-zF??E+O z(kKL@RH8{GS6z$C(UGalopxaqwQx7X}u>DZm38_p&mm`(F z6;I!(iXoxUZy^}`mb=%SVI(vMLJ#4E+T%n>{`F;#+cDZNOFX!<0++iHxyjRDtC$!g zg*Gi2{#kISP?tvxGEjJxcO0?i3Cl%`L=j3IfwK;^9E{!+ZJ_Kx9t_qmf@UWL@asGA zkna0l3gRsp5=wU=1J_&OT6d;Ryj`L|LzEw-=Fs~HVoJY-VovXXDTr?MvXQz|a4ROz zL|k)@=yLhnet%`FR8Wx5p}C(quNZ($&oB)6;F-aarT_Wnb-y*r$OG&8hDOL#Fov z${&D%q;j!5o&}*}^^5la(k{{bYKn;!h2_zta)#>x7ot$Snly%9bMd&hFl^24T zAT2mi!-OfW24M_l=4Qn%*@Vb>Mjmhpmir}Cnv`?@?fV+=f$vMmmTI;4J(*0ilJR;6 zSR2wwU7J^+veb_EQG+m1DYvmMGJ&Byz%pY07zoVLpjy2h`a;@ZK{kKv4?d(bX+VtV zb$}_*_$aD;mNV%zT7;`v%%%b@aCp(9rndS6%wI(IdaA&l+&M|eM(;e@mP_vsGzq`W zY*&vMnXlPA;9bb8%q5|~OVhNV%+o4hn>Y{we%qvQ5@1t2cOQIshaxUWw|#bgfZ}eFfV{KV zxGlH}a1KHumAsr^D|#05zW(cNetmdsjsae@-En3s8XY?9DX@Bv1TE4-{2JA-#lnYj zKSE!)1YKDHnB60HAa+RNkvr8Kde)raSX(ZENUIbq}{h#lM`*pC96H zgFG{#^xf!PWn#$Z(q}u}WBu2;`>oE?Fnj7~-?aUm3)#Ft2ZlLvNS-rr{|X)av4j;` zOs=eR1PZHO?7TAYKp^ANup7TQ<|oNK7tP1>{) z<)6tGy;@S@K@~uIg^)7WhXbqSxPE8(J>tQ`zKMfzK;c-(FZ~kC-hF4(d5iU>xtfGo zQvhc2C^-BxX`TvKtV8KOvzNd0I0HgZ0i$Y6;b82xqmtZBQR~D;oAHtd-N|;Z4eQl$ z6E(&cfUI%qhQv=M%V-ay{qQ4e%`6((O{mQT83eTvP1A6;^E zRADmg`c>S90D2gKBeP%H;=Rr>o>jpetB`>`UH6@dD@dcwq~w4tN1+>Rmv)ch@FV6V z@z|$|l9A2_tYds4BKrC@8x@leJkQm2TJ--JgmQ2}ePTMFtEkH9^O)e4q!}^{-i53a+G2L>p zClJ&1^a|Zi*nU?#sXm$f9S!28fhFm*x>*0?!O+n87{Q(CUgRE(3fw-$(ANH5J92&S zubM>l9?JYr7XsxL2E~j^&)%Z`h@^e~YkT}8=&p$Df4%1j?9SEI6)+oH(JoVeeSNo_ z>3{iUE<^DBXtz&5*ezEJc_t8|@K!eGjr7}CX7{cjy-%kdoRhLSuq%TSYaNQ9P`IP9{vWlszpU!N zKJF#wKjd&X@cu+g7qthFVCR#HB%)=q-@@-3B71B_QzEF(7kDT4=rS^5iKs zx(7vvic-T_fBVZ4z!iCljHRCLFF7viERmL;@LEd)&ijfT$4;&%&(oMct$}o|SJmA5uTA~06Yz&6j*(+v zaYCN$7k6~n`qr2{Sg)M4o2=TL=w31{_)JOwNl@xs`|Tq*fcF*rW+OE1EP0B2m1^^e z#(Yx^l}R|?{Ovv$WM) z;(iZ~lqmK35AhmiP{X}Dzpwr<{3Wi?#$0f9D!4=*E^0CU50ms$4k-~CgY@93AvAmg2VCKHonkOaYG+`kjc|HVYXQh$;G<-3x8x+iOBsJI3d#rmCH z$G-yB!2cDwLx>jXBSPXu|GPzTVgSKT=u2rsFr+h|Nbh&<0eimyy#Fk1?~oufgjay8 z^tZ17#X$ue%m2Rzob~H|L%E2~TNx}*Jxnv$OY-@f)CJSW*`?EY2wTF;MYaz+LT=Y? z)xqxbhx93CjJWj9cbhM*q21W~eUN(mGizbN{Qr8374AZK`8C4-pTf>PD(N(h7c!~AkiD~0pHJyeO=o5LE1!#*vqX8>$4r}eVz>bVJ zzn>L4S(C(yv7QVC=rW#nzg*TUu7U&FMJHuK@8jTQQ`en58 zl>=Y;ByNJkr!EeYYkI=~5bT~tVutDgl>oYI+TooxU%U$gXavQ+6r+!m03Mu2gP^_n zTCD;<>j3vC;)JFEENBI(lAwdo<*)M zazo$}3{$0uTzFOEKn%@8&4-s0!heRprmJ1_mOeb03ei{=PgI z@Eq~FY_bPyoBD9zJ9>^bv-y&*K8tQUJjp*4%Wr;Yp+bamVfJOQ4iiUqQ&b-W?Jlr zf*E#j%q>e}m?{V2i0M ztx5HAD#?#Y&xlctjG@k?s=dbIX{%rKGdMZP_`j#E9TxI283W9ujVy@DZ-V{s&!I&8<`cYs~ivJe&3<%B>Wh}Aq0FP&-j(dAkBHmFPxM#<=km{Bp9k{7 zoL{OnR?(|ODR1k-#gzf?D|>Cp=ptc=9*%;)YWLTJr;UpDE?7T`DTiy4rb^#8snS>u z$h9{_1n1rXKO+ToCd<~!%odOz zmlPc{ZEuCGX!fWw^s$>G-^bxSYmXZ|>70;BQe}2&&VnGSUX(n8SXOZ?n7a=@de*aU zyxYC3d02~z3jMbp-tMe)VyGu4RkX!YEQQAxrh^>>kTTTetq7H;i_IbjrjHw$zarD@ zq>vCe$#A7wLVgfTEVBo{ggy7%yX={;@vbWO2Z+DP8t^y(MpK&I6=XLq_N8drr_^ywdSfH}54#+qR@ z#u5+YCBdYfUmD>Hb zvZ=5(t1q1n3+N(Ot8$G$QLK}Be)A$WVfVNk@f}#HF-vBBxE||FsV@*LbunMF6)l9o z0q_@CU0P#yQ(6mCkr_LcNke4O+<49|vWfkTS0NqlcgqT2EQKmrT%;t>s*WZs;R-^~ zjglnM#<#4Mo?6|Wwdr}yX1fu%zL-4tdLkEx@5c<%?`~aj>?WLu*OIt#id9mK?)8R- z_P!ho%=xLqe(MO3@C2|huDaM{kp;FeNbiSk0xLLg;ag*E`3EvD_)%}D+7Rr-#s^(7>E~xB?7QcP~%ltB%nAnN}5koJkTBW z4OhDQLfT*b-hMeF3bDv^>C;({@En=X(&|J#yncksjN*|k@Kwz9rlPvMgw6UmTXM}1 zxs#5-Q5LPcNZvf5nI5s#qs{okAp%6yaqiAFXa}<%I4DfJgYIqOjg^~$TYHgzd*vQM z$arjBM*~|%R$cEq{2?L~s32SQx0{S0O(Dg*KoeYnnE4eN!7os2O9Nc!W1v_^@)BNV z(3S`5JM6d}U78MIDBfI5F%GiR-F`#`OyH>91gjnjK<8%va`x01!6L<$yO2el5r&+| z@T5;1?on+FT-nMcDaPN7UTi+GPUV?E-ueI2oc~D`SYgYGLF?vn^F-C5D-iG@dLQtr I-5Z+z9~p!Apa1{> diff --git a/x-pack/metricbeat/include/list.go b/x-pack/metricbeat/include/list.go index ea6ab5697b0..6fdb2a7f7ab 100644 --- a/x-pack/metricbeat/include/list.go +++ b/x-pack/metricbeat/include/list.go @@ -12,6 +12,7 @@ import ( _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/appsearch" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/appsearch/stats" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/billing" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/cloudwatch" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/ec2" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/rds" diff --git a/x-pack/metricbeat/module/aws/_meta/config.yml b/x-pack/metricbeat/module/aws/_meta/config.yml index 34d2d9f5c55..618ed4cd854 100644 --- a/x-pack/metricbeat/module/aws/_meta/config.yml +++ b/x-pack/metricbeat/module/aws/_meta/config.yml @@ -30,11 +30,16 @@ - sns - sqs - module: aws - period: 12h + period: 24h metricsets: - billing - regions: - - us-east-1 + cost_explorer_config: + group_by_dimension_keys: + - "AZ" + - "INSTANCE_TYPE" + - "SERVICE" +# group_by_tag_keys: +# - "aws:createdBy" - module: aws period: 24h metricsets: diff --git a/x-pack/metricbeat/module/aws/_meta/kibana/7/dashboard/Metricbeat-aws-billing-overview.json b/x-pack/metricbeat/module/aws/_meta/kibana/7/dashboard/Metricbeat-aws-billing-overview.json index 2f0b054ebe7..6a601bc7471 100644 --- a/x-pack/metricbeat/module/aws/_meta/kibana/7/dashboard/Metricbeat-aws-billing-overview.json +++ b/x-pack/metricbeat/module/aws/_meta/kibana/7/dashboard/Metricbeat-aws-billing-overview.json @@ -25,62 +25,126 @@ "gridData": { "h": 5, "i": "89dccfe8-a25e-44ea-afdb-ff01ab1f05d6", - "w": 16, + "w": 9, "x": 0, "y": 0 }, "panelIndex": "89dccfe8-a25e-44ea-afdb-ff01ab1f05d6", "panelRefName": "panel_0", "title": "AWS Account Filter", - "version": "7.4.0" + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Estimated Billing Chart" + "title": "Current Total Unblended Cost" }, "gridData": { - "h": 16, - "i": "26670498-b079-4447-bbc8-e4ca8215898c", - "w": 32, - "x": 16, + "h": 18, + "i": "f1db16b5-ce0a-4f21-885f-434c16346c26", + "w": 8, + "x": 9, "y": 0 }, - "panelIndex": "26670498-b079-4447-bbc8-e4ca8215898c", + "panelIndex": "f1db16b5-ce0a-4f21-885f-434c16346c26", "panelRefName": "panel_1", - "title": "Estimated Billing Chart", - "version": "7.4.0" + "title": "Current Total Unblended Cost", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Total Estimated Charges" + "title": "Availability Zone Utilization" }, "gridData": { - "h": 11, + "h": 18, + "i": "57912f48-42ec-4d3e-ba54-bf94757d1eec", + "w": 31, + "x": 17, + "y": 0 + }, + "panelIndex": "57912f48-42ec-4d3e-ba54-bf94757d1eec", + "panelRefName": "panel_2", + "title": "Availability Zone Utilization", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Total Estimated Charges For This Month" + }, + "gridData": { + "h": 13, "i": "221aab02-2747-4d84-9dde-028ccd51bdce", - "w": 16, + "w": 9, "x": 0, "y": 5 }, "panelIndex": "221aab02-2747-4d84-9dde-028ccd51bdce", - "panelRefName": "panel_2", - "title": "Total Estimated Charges", - "version": "7.4.0" + "panelRefName": "panel_3", + "title": "Total Estimated Charges For This Month", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Top 10 Estimated Billing Per Service Name" + "title": "Cost Per Service Per User" }, "gridData": { - "h": 15, - "i": "21e91e6b-0ff0-42ba-9132-6f30c5c6bbb7", - "w": 48, + "h": 20, + "i": "376f236b-1365-4e80-8076-eec88c1a67bd", + "w": 24, "x": 0, - "y": 16 + "y": 18 }, - "panelIndex": "21e91e6b-0ff0-42ba-9132-6f30c5c6bbb7", - "panelRefName": "panel_3", - "title": "Top 10 Estimated Billing Per Service Name", - "version": "7.4.0" + "panelIndex": "376f236b-1365-4e80-8076-eec88c1a67bd", + "panelRefName": "panel_4", + "title": "Cost Per Service Per User", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "High Spenders" + }, + "gridData": { + "h": 20, + "i": "dd5220c2-dc8a-4d3e-964b-6137d1e447ad", + "w": 24, + "x": 24, + "y": 18 + }, + "panelIndex": "dd5220c2-dc8a-4d3e-964b-6137d1e447ad", + "panelRefName": "panel_5", + "title": "High Spenders", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top 10 Estimated Charges per Service Name" + }, + "gridData": { + "h": 18, + "i": "1de716e2-bad9-4fe3-ba49-0e2ea2a59bb4", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "1de716e2-bad9-4fe3-ba49-0e2ea2a59bb4", + "panelRefName": "panel_6", + "title": "Top 10 Estimated Charges per Service Name", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Daily Unblended Cost" + }, + "gridData": { + "h": 18, + "i": "60181fec-fea9-4f99-b5f9-a53ffbc2ac65", + "w": 24, + "x": 24, + "y": 38 + }, + "panelIndex": "60181fec-fea9-4f99-b5f9-a53ffbc2ac65", + "panelRefName": "panel_7", + "title": "Daily Unblended Cost", + "version": "7.9.0" } ], "timeRestore": false, @@ -91,6 +155,9 @@ "migrationVersion": { "dashboard": "7.3.0" }, + "namespaces": [ + "default" + ], "references": [ { "id": "deab0260-2981-11e9-86eb-a3a07a77f530", @@ -98,24 +165,44 @@ "type": "visualization" }, { - "id": "749cd470-1530-11ea-841c-01bf20a6c8ba", + "id": "1731c440-e649-11ea-a838-3f4a45f85600", "name": "panel_1", "type": "visualization" }, { - "id": "83f08eb0-1532-11ea-841c-01bf20a6c8ba", + "id": "a5670a20-e65a-11ea-a838-3f4a45f85600", "name": "panel_2", "type": "visualization" }, { - "id": "31a4ea90-152b-11ea-841c-01bf20a6c8ba", + "id": "83f08eb0-1532-11ea-841c-01bf20a6c8ba", "name": "panel_3", "type": "visualization" + }, + { + "id": "b3da5ac0-e6f1-11ea-a5b5-d5a0accaec95", + "name": "panel_4", + "type": "lens" + }, + { + "id": "d7b399c0-e6f1-11ea-a5b5-d5a0accaec95", + "name": "panel_5", + "type": "lens" + }, + { + "id": "cde34840-e6f2-11ea-a5b5-d5a0accaec95", + "name": "panel_6", + "type": "lens" + }, + { + "id": "3e091620-e64b-11ea-a838-3f4a45f85600", + "name": "panel_7", + "type": "visualization" } ], "type": "dashboard", - "updated_at": "2020-02-04T15:57:47.353Z", - "version": "WzY3NjQsMV0=" + "updated_at": "2020-09-14T04:08:21.260Z", + "version": "WzcyNjksOF0=" }, { "attributes": { @@ -162,8 +249,11 @@ }, "id": "deab0260-2981-11e9-86eb-a3a07a77f530", "migrationVersion": { - "visualization": "7.3.1" + "visualization": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [ { "id": "metricbeat-*", @@ -172,8 +262,8 @@ } ], "type": "visualization", - "updated_at": "2020-01-27T21:33:20.219Z", - "version": "WzQ2OTAsMV0=" + "updated_at": "2020-09-14T04:04:04.990Z", + "version": "WzY2MDYsOF0=" }, { "attributes": { @@ -181,61 +271,132 @@ "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", "query": "" } } }, - "title": "Estimated Billing Pie Chart [Metricbeat AWS]", - "uiStateJSON": { - "vis": { - "colors": { - "16": "#629E51", - "272": "#DEDAF7", - "80": "#E24D42", - "running": "#7EB26D", - "stopped": "#E24D42" + "title": "Total Unblended Cost [Metricbeat AWS]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "cf04e620-e648-11ea-bdad-df8839db1393" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "aws.billing.group_definition.key : \"AZ\"" }, - "legendOpen": true + "id": "61ca57f0-469d-11e7-af02-69e470af7417", + "index_pattern": "metricbeat-*", + "interval": "\u003e=2d", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "aws.billing.group_definition.key : \"AZ\"" + }, + "formatter": "number", + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Total Unblended Cost", + "line_width": 1, + "metrics": [ + { + "field": "aws.billing.UnblendedCost.amount", + "id": "61ca57f2-469d-11e7-af02-69e470af7417", + "type": "sum" + } + ], + "override_index_pattern": 1, + "point_size": 1, + "separate_axis": 0, + "series_drop_last_bucket": 0, + "series_index_pattern": "metricbeat-*", + "series_interval": "\u003e=2d", + "series_time_field": "@timestamp", + "split_color_mode": "kibana", + "split_mode": "filter", + "stacked": "none", + "type": "timeseries" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "last_value", + "tooltip_mode": "show_all", + "type": "metric" + }, + "title": "Total Unblended Cost [Metricbeat AWS]", + "type": "metrics" + } + }, + "id": "1731c440-e649-11ea-a838-3f4a45f85600", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NjksOF0=" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } } }, + "title": "Availability Zone Utilization [Metricbeat AWS]", + "uiStateJSON": {}, "version": 1, "visState": { "aggs": [ { "enabled": true, "id": "1", - "params": { - "customLabel": "", - "field": "aws.billing.metrics.EstimatedCharges.max" - }, + "params": {}, "schema": "metric", - "type": "sum" + "type": "count" }, { "enabled": true, "id": "2", "params": { - "customLabel": "", - "field": "aws.dimensions.ServiceName", + "exclude": "NoAZ", + "field": "aws.billing.group_by.AZ", "missingBucket": false, "missingBucketLabel": "Missing", "order": "desc", - "orderAgg": { - "enabled": true, - "id": "2-orderAgg", - "params": { - "field": "aws.billing.metrics.EstimatedCharges.max" - }, - "schema": "orderAgg", - "type": "avg" - }, - "orderBy": "custom", - "otherBucket": true, + "orderBy": "1", + "otherBucket": false, "otherBucketLabel": "Other", - "size": 10 + "size": 20 }, "schema": "segment", "type": "terms" @@ -244,32 +405,7 @@ "params": { "addLegend": true, "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } - }, - "params": {} - } - ], - "metric": { - "accessor": 1, - "aggType": "sum", - "format": { - "id": "number" - }, - "params": {} - } - }, - "isDonut": false, + "isDonut": true, "labels": { "last_level": true, "show": true, @@ -279,14 +415,17 @@ "legendPosition": "right", "type": "pie" }, - "title": "Estimated Billing Pie Chart [Metricbeat AWS]", + "title": "Availability Zone Utilization [Metricbeat AWS]", "type": "pie" } }, - "id": "749cd470-1530-11ea-841c-01bf20a6c8ba", + "id": "a5670a20-e65a-11ea-a838-3f4a45f85600", "migrationVersion": { - "visualization": "7.3.1" + "visualization": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [ { "id": "metricbeat-*", @@ -295,8 +434,8 @@ } ], "type": "visualization", - "updated_at": "2020-01-27T21:33:08.924Z", - "version": "WzQ1ODAsMV0=" + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzAsOF0=" }, { "attributes": { @@ -332,6 +471,10 @@ "default_index_pattern": "metricbeat-*", "default_timefield": "@timestamp", "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "aws.billing.EstimatedCharges : * and not (aws.billing.ServiceName : * )" + }, "gauge_color_rules": [ { "id": "e8a045e0-1531-11ea-961e-c1db9cc6166e" @@ -342,7 +485,7 @@ "gauge_width": 10, "id": "61ca57f0-469d-11e7-af02-69e470af7417", "index_pattern": "metricbeat-*", - "interval": "12h", + "interval": "\u003e=1d", "isModelInvalid": false, "series": [ { @@ -352,7 +495,7 @@ "fill": 0.5, "filter": { "language": "kuery", - "query": "not aws.dimensions.ServiceName : * " + "query": "aws.billing.EstimatedCharges : * and not (aws.billing.ServiceName : * )" }, "formatter": "number", "id": "61ca57f1-469d-11e7-af02-69e470af7417", @@ -360,16 +503,19 @@ "line_width": 1, "metrics": [ { - "field": "aws.billing.metrics.EstimatedCharges.max", + "field": "aws.billing.EstimatedCharges", "id": "61ca57f2-469d-11e7-af02-69e470af7417", "type": "sum" } ], - "override_index_pattern": 0, + "override_index_pattern": 1, "point_size": 1, "separate_axis": 0, "series_drop_last_bucket": 0, - "series_interval": "12h", + "series_index_pattern": "metricbeat-*", + "series_interval": "\u003e=1d", + "series_time_field": "@timestamp", + "split_color_mode": "gradient", "split_mode": "filter", "stacked": "none", "time_range_mode": "last_value", @@ -379,6 +525,8 @@ "show_grid": 1, "show_legend": 1, "time_field": "@timestamp", + "time_range_mode": "last_value", + "tooltip_mode": "show_all", "type": "metric" }, "title": "Total Estimated Charges [Metricbeat AWS]", @@ -387,12 +535,333 @@ }, "id": "83f08eb0-1532-11ea-841c-01bf20a6c8ba", "migrationVersion": { - "visualization": "7.3.1" + "visualization": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], "type": "visualization", - "updated_at": "2020-02-03T23:52:07.805Z", - "version": "WzY3NDUsMV0=" + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzEsOF0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true aggConfigs=\"[{\\\"id\\\":\\\"5d850e8e-f3e0-4ad2-9697-b8c00c03f753\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.group_by.SERVICE\\\",\\\"orderBy\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":5,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.group_by.aws:createdBy\\\",\\\"orderBy\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":10,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"sum\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.UnblendedCost.amount\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-5d850e8e-f3e0-4ad2-9697-b8c00c03f753\\\":{\\\"label\\\":\\\"Service Name\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"aws.billing.group_by.SERVICE\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":5,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"5d850e8e-f3e0-4ad2-9697-b8c00c03f753\\\"},\\\"col-2-a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\":{\\\"label\\\":\\\"Top values of aws.billing.group_by.aws:createdBy\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"aws.billing.group_by.aws:createdBy\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":10,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\"},\\\"col-3-75188758-7734-4fc3-af1d-297c455715f0\\\":{\\\"label\\\":\\\"Total Unblended Cost\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"sum\\\",\\\"sourceField\\\":\\\"aws.billing.UnblendedCost.amount\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\"}}\"}\n| lens_xy_chart xTitle=\"Service Name\" yTitle=\"Total Unblended Cost\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3\" hide=false xAccessor=\"5d850e8e-f3e0-4ad2-9697-b8c00c03f753\" yScaleType=\"linear\" xScaleType=\"ordinal\" isHistogram=false splitAccessor=\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\" seriesType=\"bar_stacked\" accessors=\"75188758-7734-4fc3-af1d-297c455715f0\" columnToLabel=\"{\\\"75188758-7734-4fc3-af1d-297c455715f0\\\":\\\"Total Unblended Cost\\\",\\\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\":\\\"Top values of aws.billing.group_by.aws:createdBy\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3": { + "columnOrder": [ + "5d850e8e-f3e0-4ad2-9697-b8c00c03f753", + "a1f5b3b8-41da-452b-8683-7a9ca6b6267f", + "75188758-7734-4fc3-af1d-297c455715f0" + ], + "columns": { + "5d850e8e-f3e0-4ad2-9697-b8c00c03f753": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Service Name", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "75188758-7734-4fc3-af1d-297c455715f0", + "type": "column" + }, + "orderDirection": "desc", + "size": 5 + }, + "scale": "ordinal", + "sourceField": "aws.billing.group_by.SERVICE" + }, + "75188758-7734-4fc3-af1d-297c455715f0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Unblended Cost", + "operationType": "sum", + "scale": "ratio", + "sourceField": "aws.billing.UnblendedCost.amount" + }, + "a1f5b3b8-41da-452b-8683-7a9ca6b6267f": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of aws.billing.group_by.aws:createdBy", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "75188758-7734-4fc3-af1d-297c455715f0", + "type": "column" + }, + "orderDirection": "desc", + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.billing.group_by.aws:createdBy", + "suggestedPriority": 0 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "75188758-7734-4fc3-af1d-297c455715f0" + ], + "layerId": "cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3", + "seriesType": "bar_stacked", + "splitAccessor": "a1f5b3b8-41da-452b-8683-7a9ca6b6267f", + "xAccessor": "5d850e8e-f3e0-4ad2-9697-b8c00c03f753" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked" + } + }, + "title": "Cost Per Service Per User [Metricbeat AWS]", + "visualizationType": "lnsXY" + }, + "id": "b3da5ac0-e6f1-11ea-a5b5-d5a0accaec95", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzIsOF0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true aggConfigs=\"[{\\\"id\\\":\\\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.group_by.aws:createdBy\\\",\\\"orderBy\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":10,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"sum\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.UnblendedCost.amount\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\":{\\\"label\\\":\\\"Top Users\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"aws.billing.group_by.aws:createdBy\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":10,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\\\"},\\\"col-1-75188758-7734-4fc3-af1d-297c455715f0\\\":{\\\"label\\\":\\\"Total Unblended Cost\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"sum\\\",\\\"sourceField\\\":\\\"aws.billing.UnblendedCost.amount\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"75188758-7734-4fc3-af1d-297c455715f0\\\"}}\"}\n| lens_xy_chart xTitle=\"Top Users\" yTitle=\"Total Unblended Cost\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3\" hide=false xAccessor=\"a1f5b3b8-41da-452b-8683-7a9ca6b6267f\" yScaleType=\"linear\" xScaleType=\"ordinal\" isHistogram=false seriesType=\"bar_horizontal\" accessors=\"75188758-7734-4fc3-af1d-297c455715f0\" columnToLabel=\"{\\\"75188758-7734-4fc3-af1d-297c455715f0\\\":\\\"Total Unblended Cost\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3": { + "columnOrder": [ + "a1f5b3b8-41da-452b-8683-7a9ca6b6267f", + "75188758-7734-4fc3-af1d-297c455715f0" + ], + "columns": { + "75188758-7734-4fc3-af1d-297c455715f0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Unblended Cost", + "operationType": "sum", + "scale": "ratio", + "sourceField": "aws.billing.UnblendedCost.amount" + }, + "a1f5b3b8-41da-452b-8683-7a9ca6b6267f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top Users", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "75188758-7734-4fc3-af1d-297c455715f0", + "type": "column" + }, + "orderDirection": "desc", + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.billing.group_by.aws:createdBy", + "suggestedPriority": 0 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "75188758-7734-4fc3-af1d-297c455715f0" + ], + "layerId": "cbffa0b1-50bb-40fe-bd8d-6a26d2b58fb3", + "seriesType": "bar_horizontal", + "xAccessor": "a1f5b3b8-41da-452b-8683-7a9ca6b6267f" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal" + } + }, + "title": "High Spenders [Metricbeat AWS]", + "visualizationType": "lnsXY" + }, + "id": "d7b399c0-e6f1-11ea-a5b5-d5a0accaec95", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzMsOF0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"dc597043-d867-4f94-ae90-f31ffc0c2674\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"ea87bf3d-0a35-424b-b00b-3614c431b135\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.ServiceName\\\",\\\"orderBy\\\":\\\"d54f4e58-d8dd-4404-8da9-12b667dd7910\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":10,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"faa5dba4-1fab-4f88-b67f-28bafa26a32d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1d\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"d54f4e58-d8dd-4404-8da9-12b667dd7910\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"aws.billing.EstimatedCharges\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-ea87bf3d-0a35-424b-b00b-3614c431b135\\\":{\\\"label\\\":\\\"Service Names\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"aws.billing.ServiceName\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":10,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"d54f4e58-d8dd-4404-8da9-12b667dd7910\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"ea87bf3d-0a35-424b-b00b-3614c431b135\\\"},\\\"col-2-faa5dba4-1fab-4f88-b67f-28bafa26a32d\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"1d\\\"},\\\"id\\\":\\\"faa5dba4-1fab-4f88-b67f-28bafa26a32d\\\"},\\\"col-3-d54f4e58-d8dd-4404-8da9-12b667dd7910\\\":{\\\"label\\\":\\\"Estimated Charges\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"aws.billing.EstimatedCharges\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"d54f4e58-d8dd-4404-8da9-12b667dd7910\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Estimated Charges\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"dc597043-d867-4f94-ae90-f31ffc0c2674\" hide=false xAccessor=\"faa5dba4-1fab-4f88-b67f-28bafa26a32d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"ea87bf3d-0a35-424b-b00b-3614c431b135\" seriesType=\"line\" accessors=\"d54f4e58-d8dd-4404-8da9-12b667dd7910\" columnToLabel=\"{\\\"d54f4e58-d8dd-4404-8da9-12b667dd7910\\\":\\\"Estimated Charges\\\",\\\"ea87bf3d-0a35-424b-b00b-3614c431b135\\\":\\\"Service Names\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "dc597043-d867-4f94-ae90-f31ffc0c2674": { + "columnOrder": [ + "ea87bf3d-0a35-424b-b00b-3614c431b135", + "faa5dba4-1fab-4f88-b67f-28bafa26a32d", + "d54f4e58-d8dd-4404-8da9-12b667dd7910" + ], + "columns": { + "d54f4e58-d8dd-4404-8da9-12b667dd7910": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Estimated Charges", + "operationType": "avg", + "scale": "ratio", + "sourceField": "aws.billing.EstimatedCharges" + }, + "ea87bf3d-0a35-424b-b00b-3614c431b135": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Service Names", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "d54f4e58-d8dd-4404-8da9-12b667dd7910", + "type": "column" + }, + "orderDirection": "desc", + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.billing.ServiceName", + "suggestedPriority": 0 + }, + "faa5dba4-1fab-4f88-b67f-28bafa26a32d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "d54f4e58-d8dd-4404-8da9-12b667dd7910" + ], + "layerId": "dc597043-d867-4f94-ae90-f31ffc0c2674", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ea87bf3d-0a35-424b-b00b-3614c431b135", + "xAccessor": "faa5dba4-1fab-4f88-b67f-28bafa26a32d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Top 10 Estimated Charges per Service Name [Metricbeat AWS]", + "visualizationType": "lnsXY" + }, + "id": "cde34840-e6f2-11ea-a5b5-d5a0accaec95", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzQsOF0=" }, { "attributes": { @@ -406,14 +875,13 @@ } } }, - "title": "Top 10 Billing per Service Name [Metricbeat AWS]", + "title": "Daily Unblended Cost [Metricbeat AWS]", "uiStateJSON": {}, "version": 1, "visState": { "aggs": [], "params": { "axis_formatter": "number", - "axis_min": 0, "axis_position": "left", "axis_scale": "normal", "default_index_pattern": "metricbeat-*", @@ -421,67 +889,64 @@ "drop_last_bucket": 0, "filter": { "language": "kuery", - "query": "" + "query": "aws.billing.group_definition.key : \"AZ\"" }, - "id": "729af8b0-152a-11ea-ae8f-79fec1a0d4d3", + "id": "61ca57f0-469d-11e7-af02-69e470af7417", "index_pattern": "metricbeat-*", - "interval": "12h", + "interval": "\u003e=1d", "isModelInvalid": false, "series": [ { "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, + "chart_type": "bar", + "color": "rgba(118,208,7,1)", + "fill": "1", "filter": { "language": "kuery", - "query": "" + "query": "aws.billing.group_definition.key : \"AZ\"" }, "formatter": "number", - "id": "729b1fc0-152a-11ea-ae8f-79fec1a0d4d3", - "label": "avg(aws.billing.metrics.EstimatedCharges.max)", - "line_width": 2, + "hide_in_legend": 1, + "id": "61ca57f1-469d-11e7-af02-69e470af7417", + "label": "Total Unblended Cost", + "line_width": 1, "metrics": [ { - "field": "aws.billing.metrics.EstimatedCharges.max", - "id": "729b1fc1-152a-11ea-ae8f-79fec1a0d4d3", + "field": "aws.billing.UnblendedCost.amount", + "id": "61ca57f2-469d-11e7-af02-69e470af7417", "type": "sum" } ], - "override_index_pattern": 0, - "point_size": "4", + "point_size": 1, "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", + "split_color_mode": "kibana", + "split_mode": "filter", "stacked": "none", - "steps": 0, - "terms_field": "aws.dimensions.ServiceName", - "terms_include": "", - "terms_order_by": "729b1fc1-152a-11ea-ae8f-79fec1a0d4d3", - "terms_size": "10", - "type": "timeseries", - "value_template": "${{value}}" + "type": "timeseries" } ], - "show_grid": 1, + "show_grid": 0, "show_legend": 1, "time_field": "@timestamp", + "tooltip_mode": "show_all", "type": "timeseries" }, - "title": "Top 10 Billing per Service Name [Metricbeat AWS]", + "title": "Daily Unblended Cost [Metricbeat AWS]", "type": "metrics" } }, - "id": "31a4ea90-152b-11ea-841c-01bf20a6c8ba", + "id": "3e091620-e64b-11ea-a838-3f4a45f85600", "migrationVersion": { - "visualization": "7.3.1" + "visualization": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], "type": "visualization", - "updated_at": "2020-02-04T13:56:47.812Z", - "version": "WzY3NjMsMV0=" + "updated_at": "2020-09-14T04:03:51.696Z", + "version": "WzY0NzUsOF0=" } ], - "version": "7.4.0" + "version": "7.9.0" } diff --git a/x-pack/metricbeat/module/aws/billing/_meta/data.json b/x-pack/metricbeat/module/aws/billing/_meta/data.json index df5fece2194..46b66885830 100644 --- a/x-pack/metricbeat/module/aws/billing/_meta/data.json +++ b/x-pack/metricbeat/module/aws/billing/_meta/data.json @@ -2,18 +2,35 @@ "@timestamp": "2017-10-12T08:05:34.853Z", "aws": { "billing": { - "metrics": { - "EstimatedCharges": { - "max": 0 - } - } - }, - "cloudwatch": { - "namespace": "AWS/Billing" - }, - "dimensions": { - "Currency": "USD", - "ServiceName": "AmazonSNS" + "AmortizedCost": { + "amount": 0.6949203833, + "unit": "USD" + }, + "BlendedCost": { + "amount": 0.6949203833, + "unit": "USD" + }, + "NormalizedUsageAmount": { + "amount": 12, + "unit": "N/A" + }, + "UnblendedCost": { + "amount": 0.6949203833, + "unit": "USD" + }, + "UsageQuantity": { + "amount": 312.7086043154, + "unit": "N/A" + }, + "end_date": "2020-08-24", + "group_by": { + "AZ": "eu-central-1" + }, + "group_definition": { + "key": "AZ", + "type": "DIMENSION" + }, + "start_date": "2020-08-23" } }, "cloud": { @@ -21,8 +38,7 @@ "id": "428152502467", "name": "elastic-beats" }, - "provider": "aws", - "region": "us-east-1" + "provider": "aws" }, "event": { "dataset": "aws.billing", diff --git a/x-pack/metricbeat/module/aws/billing/_meta/data_cloudwatch.json b/x-pack/metricbeat/module/aws/billing/_meta/data_cloudwatch.json new file mode 100644 index 00000000000..4ee0ef22520 --- /dev/null +++ b/x-pack/metricbeat/module/aws/billing/_meta/data_cloudwatch.json @@ -0,0 +1,29 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "aws": { + "billing": { + "Currency": "USD", + "EstimatedCharges": 0, + "ServiceName": "AmazonDynamoDB" + } + }, + "cloud": { + "account": { + "id": "428152502467", + "name": "elastic-beats" + }, + "provider": "aws" + }, + "event": { + "dataset": "aws.billing", + "duration": 115000, + "module": "aws" + }, + "metricset": { + "name": "billing", + "period": 10000 + }, + "service": { + "type": "aws" + } +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/aws/billing/_meta/data_group_by_instance_type.json b/x-pack/metricbeat/module/aws/billing/_meta/data_group_by_instance_type.json new file mode 100644 index 00000000000..a5109dd8e54 --- /dev/null +++ b/x-pack/metricbeat/module/aws/billing/_meta/data_group_by_instance_type.json @@ -0,0 +1,55 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "aws": { + "billing": { + "AmortizedCost": { + "amount": 44.64, + "unit": "USD" + }, + "BlendedCost": { + "amount": 44.64, + "unit": "USD" + }, + "NormalizedUsageAmount": { + "amount": 576, + "unit": "N/A" + }, + "UnblendedCost": { + "amount": 44.64, + "unit": "USD" + }, + "UsageQuantity": { + "amount": 144, + "unit": "N/A" + }, + "end_date": "2020-08-24", + "group_by": { + "INSTANCE_TYPE": "db.r5.large" + }, + "group_definition": { + "key": "INSTANCE_TYPE", + "type": "DIMENSION" + }, + "start_date": "2020-08-23" + } + }, + "cloud": { + "account": { + "id": "428152502467", + "name": "elastic-beats" + }, + "provider": "aws" + }, + "event": { + "dataset": "aws.billing", + "duration": 115000, + "module": "aws" + }, + "metricset": { + "name": "billing", + "period": 10000 + }, + "service": { + "type": "aws" + } +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/aws/billing/_meta/docs.asciidoc b/x-pack/metricbeat/module/aws/billing/_meta/docs.asciidoc index 0e0b4ffb624..90b8f88da87 100644 --- a/x-pack/metricbeat/module/aws/billing/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/aws/billing/_meta/docs.asciidoc @@ -1,13 +1,8 @@ -You can monitor your estimated AWS charges by using Amazon CloudWatch. When you -enable the monitoring of estimated charges for your AWS account, the estimated -charges are calculated and sent several times daily to CloudWatch as metric data. +You can monitor your estimated AWS charges by using Amazon CloudWatch and Cost +Explorer. -Billing metric data is stored in the US East (N. Virginia) Region and represents -worldwide charges. This data includes the estimated charges for every service in -AWS that you use, in addition to the estimated overall total of your AWS charges. - -This aws `billing` metricset collects these Cloudwatch metrics for monitoring -purposes. +This aws `billing` metricset collects metrics both from Cloudwatch and cost +explorer for monitoring purposes. [float] === AWS Permissions @@ -19,6 +14,7 @@ cloudwatch:ListMetrics tag:getResources sts:GetCallerIdentity iam:ListAccountAliases +ce:GetCostAndUsage ---- [float] @@ -33,18 +29,28 @@ image::./images/metricbeat-aws-billing-overview.png[] [source,yaml] ---- - module: aws - period: 12h + period: 24h metricsets: - billing - # This module uses the aws cloudwatch metricset, all - # the options for this metricset are also available here. + credential_profile_name: elastic-beats + cost_explorer_config: + group_by_dimension_keys: + - "AZ" + - "INSTANCE_TYPE" + - "SERVICE" + group_by_tag_keys: + - "aws:createdBy" ---- [float] -=== Metrics -|=== -|Metric Name|Statistic Method -|EstimatedCharges | Maximum -|=== +=== Metricset-specific configuration notes +When querying AWS Cost Explorer API, you can group AWS costs using up to two +different groups, either dimensions, tag keys, or both. Right now we support +group by type dimension and type tag with separate config parameters: + +* *group_by_dimension_keys*: A list of keys used in Cost Explorer to group by +dimensions. Valid values are AZ, INSTANCE_TYPE, LEGAL_ENTITY_NAME, +LINKED_ACCOUNT, OPERATION, PLATFORM, PURCHASE_TYPE, SERVICE, TAGS, TENANCY, and +USAGE_TYPE. -Supported dimensions for billing metrics: Currency and ServiceName. +* *group_by_tag_keys*: A list of keys used in Cost Explorer to group by tags. diff --git a/x-pack/metricbeat/module/aws/billing/_meta/fields.yml b/x-pack/metricbeat/module/aws/billing/_meta/fields.yml index 2b246415653..0452be75ab4 100644 --- a/x-pack/metricbeat/module/aws/billing/_meta/fields.yml +++ b/x-pack/metricbeat/module/aws/billing/_meta/fields.yml @@ -4,9 +4,78 @@ `billing` contains the estimated charges for your AWS account in Cloudwatch. release: beta fields: - - name: metrics + - name: EstimatedCharges + type: long + description: Maximum estimated charges for AWS acccount. + - name: Currency + type: keyword + description: Estimated charges currency unit. + - name: ServiceName + type: keyword + description: Service name for the maximum estimated charges. + - name: AmortizedCost type: group fields: - - name: EstimatedCharges.max - type: long - description: Maximum estimated charges for AWS acccount. + - name: amount + type: double + description: Amortized cost amount + - name: unit + type: keyword + description: Amortized cost unit + - name: BlendedCost + type: group + fields: + - name: amount + type: double + description: Blended cost amount + - name: unit + type: keyword + description: Blended cost unit + - name: NormalizedUsageAmount + type: group + fields: + - name: amount + type: double + description: Normalized usage amount + - name: unit + type: keyword + description: Normalized usage amount unit + - name: UnblendedCost + type: group + fields: + - name: amount + type: double + description: Unblended cost amount + - name: unit + type: keyword + description: Unblended cost unit + - name: UsageQuantity + type: group + fields: + - name: amount + type: double + description: Usage quantity amount + - name: unit + type: keyword + description: Usage quantity unit + - name: start_date + type: keyword + description: Start date for retrieving AWS costs + - name: end_date + type: keyword + description: End date for retrieving AWS costs + - name: group_definition + type: group + fields: + - name: key + type: keyword + description: The string that represents a key for a specified group + - name: type + type: keyword + description: The string that represents the type of group + - name: group_by.* + type: object + object_type: keyword + object_type_mapping_type: "*" + description: > + Cost explorer group by key values diff --git a/x-pack/metricbeat/module/aws/billing/billing.go b/x-pack/metricbeat/module/aws/billing/billing.go new file mode 100644 index 00000000000..2eb2bd2854a --- /dev/null +++ b/x-pack/metricbeat/module/aws/billing/billing.go @@ -0,0 +1,407 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package billing + +import ( + "context" + "crypto/sha256" + "encoding/hex" + "fmt" + "strconv" + "strings" + "time" + + awssdk "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/service/cloudwatch" + "github.com/aws/aws-sdk-go-v2/service/cloudwatch/cloudwatchiface" + "github.com/aws/aws-sdk-go-v2/service/costexplorer" + "github.com/aws/aws-sdk-go-v2/service/costexplorer/costexploreriface" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/metricbeat/mb" + awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" + "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" +) + +var ( + metricsetName = "billing" + regionName = "us-east-1" + labelSeparator = "|" + + // This list is from https://github.com/aws/aws-sdk-go-v2/blob/master/service/costexplorer/api_enums.go#L60-L90 + supportedDimensionKeys = []string{ + "AZ", "INSTANCE_TYPE", "LINKED_ACCOUNT", "OPERATION", "PURCHASE_TYPE", + "REGION", "SERVICE", "USAGE_TYPE", "USAGE_TYPE_GROUP", "RECORD_TYPE", + "OPERATING_SYSTEM", "TENANCY", "SCOPE", "PLATFORM", "SUBSCRIPTION_ID", + "LEGAL_ENTITY_NAME", "DEPLOYMENT_OPTION", "DATABASE_ENGINE", + "CACHE_ENGINE", "INSTANCE_TYPE_FAMILY", "BILLING_ENTITY", + "RESERVATION_ID", + } + + dateLayout = "2006-01-02" +) + +// init registers the MetricSet with the central registry as soon as the program +// starts. The New function will be called later to instantiate an instance of +// the MetricSet for each host defined in the module's configuration. After the +// MetricSet has been created then Fetch will begin to be called periodically. +func init() { + mb.Registry.MustAddMetricSet(aws.ModuleName, metricsetName, New, + mb.DefaultMetricSet(), + ) +} + +// MetricSet holds any configuration or state information. It must implement +// the mb.MetricSet interface. And this is best achieved by embedding +// mb.BaseMetricSet because it implements all of the required mb.MetricSet +// interface methods except for Fetch. +type MetricSet struct { + *aws.MetricSet + logger *logp.Logger + CostExplorerConfig CostExplorerConfig `config:"cost_explorer_config"` +} + +// Config holds a configuration specific for billing metricset. +type CostExplorerConfig struct { + GroupByDimensionKeys []string `config:"group_by_dimension_keys"` + GroupByTagKeys []string `config:"group_by_tag_keys"` +} + +// New creates a new instance of the MetricSet. New is responsible for unpacking +// any MetricSet specific configuration options if there are any. +func New(base mb.BaseMetricSet) (mb.MetricSet, error) { + logger := logp.NewLogger(metricsetName) + metricSet, err := aws.NewMetricSet(base) + if err != nil { + return nil, fmt.Errorf("error creating aws metricset: %w", err) + } + + config := struct { + CostExplorerConfig CostExplorerConfig `config:"cost_explorer_config"` + }{} + + err = base.Module().UnpackConfig(&config) + if err != nil { + return nil, fmt.Errorf("error unpack raw module config using UnpackConfig: %w", err) + } + + logger.Debugf("cost explorer config = %s", config) + + return &MetricSet{ + MetricSet: metricSet, + logger: logger, + CostExplorerConfig: config.CostExplorerConfig, + }, nil +} + +// Validate checks if given dimension keys are supported. +func (c CostExplorerConfig) Validate() error { + for _, key := range c.GroupByDimensionKeys { + supported, _ := aws.StringInSlice(key, supportedDimensionKeys) + if !supported { + return fmt.Errorf("costexplorer GetCostAndUsageRequest does not support dimension key: %s", key) + } + } + return nil +} + +// Fetch methods implements the data gathering and data conversion to the right +// format. It publishes the event which is then forwarded to the output. In case +// of an error set the Error field of mb.Event or simply call report.Error(). +func (m *MetricSet) Fetch(report mb.ReporterV2) error { + // Get startDate and endDate + startDate, endDate := getStartDateEndDate(m.Period) + + // Get startTime and endTime + startTime, endTime := aws.GetStartTimeEndTime(m.Period) + + // get cost metrics from cost explorer + awsConfig := m.MetricSet.AwsConfig.Copy() + svcCostExplorer := costexplorer.New(awscommon.EnrichAWSConfigWithEndpoint( + m.Endpoint, "monitoring", "", awsConfig)) + + awsConfig.Region = regionName + svcCloudwatch := cloudwatch.New(awscommon.EnrichAWSConfigWithEndpoint( + m.Endpoint, "monitoring", regionName, awsConfig)) + + timePeriod := costexplorer.DateInterval{ + Start: awssdk.String(startDate), + End: awssdk.String(endDate), + } + + var events []mb.Event + + // Get estimated charges from CloudWatch + eventsCW := m.getCloudWatchBillingMetrics(svcCloudwatch, startTime, endTime) + events = append(events, eventsCW...) + + // Get total cost from Cost Explorer GetCostAndUsage with group by type "DIMENSION" and "TAG" + eventsCE := m.getCostGroupBy(svcCostExplorer, m.CostExplorerConfig.GroupByDimensionKeys, m.CostExplorerConfig.GroupByTagKeys, timePeriod, startDate, endDate) + events = append(events, eventsCE...) + + // report events + for _, event := range events { + if reported := report.Event(event); !reported { + m.Logger().Debug("Fetch interrupted, failed to emit event") + return nil + } + } + return nil +} + +func (m *MetricSet) getCloudWatchBillingMetrics( + svcCloudwatch cloudwatchiface.ClientAPI, + startTime time.Time, + endTime time.Time) []mb.Event { + var events []mb.Event + namespace := "AWS/Billing" + listMetricsOutput, err := aws.GetListMetricsOutput(namespace, regionName, svcCloudwatch) + if err != nil { + m.Logger().Error(err.Error()) + return nil + } + + if listMetricsOutput == nil || len(listMetricsOutput) == 0 { + return events + } + + metricDataQueriesTotal := constructMetricQueries(listMetricsOutput, m.Period) + metricDataOutput, err := aws.GetMetricDataResults(metricDataQueriesTotal, svcCloudwatch, startTime, endTime) + if err != nil { + err = fmt.Errorf("aws GetMetricDataResults failed with %w, skipping region %s", err, regionName) + m.Logger().Error(err.Error()) + return nil + } + + // Find a timestamp for all metrics in output + timestamp := aws.FindTimestamp(metricDataOutput) + if !timestamp.IsZero() { + for _, output := range metricDataOutput { + if len(output.Values) == 0 { + continue + } + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + labels := strings.Split(*output.Label, labelSeparator) + + event := aws.InitEvent("", m.AccountName, m.AccountID) + event.MetricSetFields.Put(labels[0], output.Values[timestampIdx]) + + i := 1 + for i < len(labels)-1 { + event.MetricSetFields.Put(labels[i], labels[i+1]) + i += 2 + } + event.Timestamp = endTime + events = append(events, event) + } + } + } + return events +} + +func (m *MetricSet) getCostGroupBy(svcCostExplorer costexploreriface.ClientAPI, groupByDimKeys []string, groupByTags []string, timePeriod costexplorer.DateInterval, startDate string, endDate string) []mb.Event { + var events []mb.Event + + groupBys := getGroupBys(groupByTags, groupByDimKeys) + for _, groupBy := range groupBys { + var groupDefs []costexplorer.GroupDefinition + + if groupBy.dimension != "" { + groupDefs = append(groupDefs, costexplorer.GroupDefinition{ + Key: awssdk.String(groupBy.dimension), + Type: costexplorer.GroupDefinitionTypeDimension, + }) + } + + if groupBy.tag != "" { + groupDefs = append(groupDefs, costexplorer.GroupDefinition{ + Key: awssdk.String(groupBy.tag), + Type: costexplorer.GroupDefinitionTypeTag, + }) + } + + groupByCostInput := costexplorer.GetCostAndUsageInput{ + Granularity: costexplorer.GranularityDaily, + // no permission for "NetAmortizedCost" and "NetUnblendedCost" + Metrics: []string{"AmortizedCost", "BlendedCost", + "NormalizedUsageAmount", "UnblendedCost", "UsageQuantity"}, + TimePeriod: &timePeriod, + // Only two values for GroupBy are allowed + GroupBy: groupDefs, + } + + groupByCostReq := svcCostExplorer.GetCostAndUsageRequest(&groupByCostInput) + groupByOutput, err := groupByCostReq.Send(context.Background()) + if err != nil { + err = fmt.Errorf("costexplorer GetCostAndUsageRequest failed: %w", err) + m.Logger().Errorf(err.Error()) + return nil + } + + if len(groupByOutput.ResultsByTime) > 0 { + costResultGroups := groupByOutput.ResultsByTime[0].Groups + for _, group := range costResultGroups { + event := m.addCostMetrics(group.Metrics, groupByOutput.GroupDefinitions[0], startDate, endDate) + + // generate unique event ID for each event + eventID := startDate + endDate + *groupByOutput.GroupDefinitions[0].Key + string(groupByOutput.GroupDefinitions[0].Type) + for _, key := range group.Keys { + eventID += key + // key value like db.t2.micro or Amazon Simple Queue Service belongs to dimension + if !strings.Contains(key, "$") { + event.MetricSetFields.Put("group_by."+groupBy.dimension, key) + continue + } + + // tag key value is separated by $ + tagKey, tagValue := parseGroupKey(key) + if tagValue != "" { + event.MetricSetFields.Put("group_by."+tagKey, tagValue) + } + } + + t, err := time.Parse(dateLayout, endDate) + if err == nil { + event.Timestamp = t + } + + event.ID = generateEventID(eventID) + events = append(events, event) + } + } + } + return events +} + +func (m *MetricSet) addCostMetrics(metrics map[string]costexplorer.MetricValue, groupDefinition costexplorer.GroupDefinition, startDate string, endDate string) mb.Event { + event := aws.InitEvent("", m.AccountName, m.AccountID) + + // add group definition + event.MetricSetFields.Put("group_definition", common.MapStr{ + "key": *groupDefinition.Key, + "type": groupDefinition.Type, + }) + + for metricName, metricValues := range metrics { + cost := metricValues + costFloat, err := strconv.ParseFloat(*cost.Amount, 64) + if err != nil { + err = fmt.Errorf("strconv ParseFloat failed: %w", err) + m.Logger().Errorf(err.Error()) + continue + } + + value := common.MapStr{ + "amount": costFloat, + "unit": &cost.Unit, + } + + event.MetricSetFields.Put(metricName, value) + event.MetricSetFields.Put("start_date", startDate) + event.MetricSetFields.Put("end_date", endDate) + } + return event +} + +func constructMetricQueries(listMetricsOutput []cloudwatch.Metric, period time.Duration) []cloudwatch.MetricDataQuery { + var metricDataQueries []cloudwatch.MetricDataQuery + metricDataQueryEmpty := cloudwatch.MetricDataQuery{} + for i, listMetric := range listMetricsOutput { + metricDataQuery := createMetricDataQuery(listMetric, i, period) + if metricDataQuery == metricDataQueryEmpty { + continue + } + metricDataQueries = append(metricDataQueries, metricDataQuery) + } + return metricDataQueries +} + +func createMetricDataQuery(metric cloudwatch.Metric, index int, period time.Duration) (metricDataQuery cloudwatch.MetricDataQuery) { + statistic := "Maximum" + periodInSeconds := int64(period.Seconds()) + id := metricsetName + strconv.Itoa(index) + metricDims := metric.Dimensions + metricName := *metric.MetricName + + label := metricName + labelSeparator + for _, dim := range metricDims { + label += *dim.Name + labelSeparator + *dim.Value + labelSeparator + } + + metricDataQuery = cloudwatch.MetricDataQuery{ + Id: &id, + MetricStat: &cloudwatch.MetricStat{ + Period: &periodInSeconds, + Stat: &statistic, + Metric: &metric, + }, + Label: &label, + } + return +} + +func getStartDateEndDate(period time.Duration) (startDate string, endDate string) { + currentTime := time.Now() + startTime := currentTime.Add(period * -1) + startDate = startTime.Format(dateLayout) + endDate = currentTime.Format(dateLayout) + return +} + +func parseGroupKey(groupKey string) (tagKey string, tagValue string) { + keys := strings.Split(groupKey, "$") + if len(keys) == 2 { + tagKey = keys[0] + tagValue = keys[1] + } else if len(keys) > 2 { + tagKey = keys[0] + tagValue = keys[1] + for i := 2; i < len(keys); i++ { + tagValue = tagValue + "$" + keys[i] + } + } else { + tagKey = keys[0] + tagValue = "" + } + return +} + +type groupBy struct { + tag string + dimension string +} + +func getGroupBys(groupByTags []string, groupByDimKeys []string) []groupBy { + var groupBys []groupBy + + if len(groupByTags) == 0 { + groupByTags = []string{""} + } + if len(groupByDimKeys) == 0 { + groupByDimKeys = []string{""} + } + + for _, tagKey := range groupByTags { + for _, dimKey := range groupByDimKeys { + groupBy := groupBy{ + tag: tagKey, + dimension: dimKey, + } + groupBys = append(groupBys, groupBy) + } + } + return groupBys +} + +func generateEventID(eventID string) string { + // create eventID using hash of startDate + endDate + groupDefinitionKey + groupDefinitionType + values + // This will prevent more than one billing metric getting collected in the same day. + h := sha256.New() + h.Write([]byte(eventID)) + prefix := hex.EncodeToString(h.Sum(nil)) + return prefix[:20] +} diff --git a/x-pack/metricbeat/module/aws/billing/billing_integration_test.go b/x-pack/metricbeat/module/aws/billing/billing_integration_test.go index 3d8cbff0598..af603626ffb 100644 --- a/x-pack/metricbeat/module/aws/billing/billing_integration_test.go +++ b/x-pack/metricbeat/module/aws/billing/billing_integration_test.go @@ -8,15 +8,56 @@ package billing import ( + "fmt" + "strconv" "testing" + "github.com/elastic/beats/v7/libbeat/common" mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/mtest" ) func TestData(t *testing.T) { - config := mtest.GetConfigForTest(t, "billing", "300s") + resultTypeIs := func(resultType string) func(e common.MapStr) bool { + return func(e common.MapStr) bool { + v, err := e.GetValue("aws.billing.group_definition.key") + if err == nil { + // Check for Cost Explorer billing metrics + k, _ := e.GetValue("aws.billing.group_by." + v.(string)) + exists, _ := aws.StringInSlice(k.(string), []string{"NoAZ", "NoInstanceType"}) + if !exists { + return v == resultType + } + } + // Check for CloudWatch billing metrics + exists, err := e.HasKey("aws.billing.EstimatedCharges") + return err == nil && strconv.FormatBool(exists) == resultType + } + } - metricSet := mbtest.NewFetcher(t, config) - metricSet.WriteEvents(t, "/") + dataFiles := []struct { + resultType string + path string + }{ + {"AZ", "./_meta/data.json"}, + {"INSTANCE_TYPE", "./_meta/data_group_by_instance_type.json"}, + {"true", "./_meta/data_cloudwatch.json"}, + } + + config := mtest.GetConfigForTest(t, "billing", "24h") + config = addCostExplorerToConfig(config) + for _, df := range dataFiles { + metricSet := mbtest.NewFetcher(t, config) + t.Run(fmt.Sprintf("result type: %s", df.resultType), func(t *testing.T) { + metricSet.WriteEventsCond(t, df.path, resultTypeIs(df.resultType)) + }) + } +} + +func addCostExplorerToConfig(config map[string]interface{}) map[string]interface{} { + costExplorerConfig := map[string]interface{}{} + costExplorerConfig["group_by_dimension_keys"] = []string{"AZ", "INSTANCE_TYPE"} + config["cost_explorer_config"] = costExplorerConfig + return config } diff --git a/x-pack/metricbeat/module/aws/billing/billing_test.go b/x-pack/metricbeat/module/aws/billing/billing_test.go index 664eeea5103..2ecd511109d 100644 --- a/x-pack/metricbeat/module/aws/billing/billing_test.go +++ b/x-pack/metricbeat/module/aws/billing/billing_test.go @@ -2,20 +2,104 @@ // or more contributor license agreements. Licensed under the Elastic License; // you may not use this file except in compliance with the Elastic License. +// +build !integration + package billing import ( - "os" - - "github.com/elastic/beats/v7/metricbeat/mb" + "testing" + "time" - // Register input module and metricset - _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" - _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/cloudwatch" + "github.com/stretchr/testify/assert" ) -func init() { - // To be moved to some kind of helper - os.Setenv("BEAT_STRICT_PERMS", "false") - mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +func TestGetStartDateEndDate(t *testing.T) { + startDate, endDate := getStartDateEndDate(time.Duration(24) * time.Hour) + assert.NotEmpty(t, startDate) + assert.NotEmpty(t, endDate) +} + +func TestParseGroupKey(t *testing.T) { + cases := []struct { + title string + groupKey string + expectedTagKey string + expectedTagValue string + }{ + { + "empty tag value", + "aws:createdBy$", + "aws:createdBy", + "", + }, + { + "with a tag value of assumed role", + "aws:createdBy$AssumedRole:AROAWHL7AXDB:158385", + "aws:createdBy", + "AssumedRole:AROAWHL7AXDB:158385", + }, + { + "with a tag value of IAM user", + "aws:createdBy$IAMUser:AIDAWHL7AXDB:foo@test.com", + "aws:createdBy", + "IAMUser:AIDAWHL7AXDB:foo@test.com", + }, + { + "tag value with $", + "aws:createdBy$IAMUser:AIDAWH$L7AXDB:foo@test.com", + "aws:createdBy", + "IAMUser:AIDAWH$L7AXDB:foo@test.com", + }, + } + + for _, c := range cases { + t.Run(c.title, func(t *testing.T) { + tagKey, tagValue := parseGroupKey(c.groupKey) + assert.Equal(t, c.expectedTagKey, tagKey) + assert.Equal(t, c.expectedTagValue, tagValue) + }) + } +} + +func TestGetGroupBys(t *testing.T) { + cases := []struct { + title string + groupByTags []string + groupByDimKeys []string + expectedGroupBys []groupBy + }{ + { + "test with both tags and dimKeys", + []string{"createdBy"}, + []string{"AZ", "INSTANCE_TYPE"}, + []groupBy{ + {"createdBy", "AZ"}, + {"createdBy", "INSTANCE_TYPE"}, + }, + }, + { + "test with only dimKeys", + []string{}, + []string{"AZ", "INSTANCE_TYPE"}, + []groupBy{ + {"", "AZ"}, + {"", "INSTANCE_TYPE"}, + }, + }, + { + "test with only tags", + []string{"createdBy"}, + []string{}, + []groupBy{ + {"createdBy", ""}, + }, + }, + } + + for _, c := range cases { + t.Run(c.title, func(t *testing.T) { + groupBys := getGroupBys(c.groupByTags, c.groupByDimKeys) + assert.Equal(t, c.expectedGroupBys, groupBys) + }) + } } diff --git a/x-pack/metricbeat/module/aws/billing/manifest.yml b/x-pack/metricbeat/module/aws/billing/manifest.yml deleted file mode 100644 index cca412df649..00000000000 --- a/x-pack/metricbeat/module/aws/billing/manifest.yml +++ /dev/null @@ -1,10 +0,0 @@ -default: true -input: - module: aws - metricset: cloudwatch - defaults: - regions: - - us-east-1 - metrics: - - namespace: AWS/Billing - statistic: ["Maximum"] diff --git a/x-pack/metricbeat/module/aws/fields.go b/x-pack/metricbeat/module/aws/fields.go index 6124034a43a..12efc5c0cf9 100644 --- a/x-pack/metricbeat/module/aws/fields.go +++ b/x-pack/metricbeat/module/aws/fields.go @@ -19,5 +19,5 @@ func init() { // AssetAws returns asset data. // This is the base64 encoded gzipped contents of module/aws. func AssetAws() string { - return "eJzsfVtzGzfy73s+BWpfIqckrmPHW6fycKokUd7o/GVZEeV13rjgTJNEhAHGAIYSU/vhT6EBzI3Dy5AzlLz198PWRiSBX1/QaDQa3WfkEZa/EvqkfyDEMMPhV/K386+jv/1ASAw6Uiw1TIpfyf/9gRBC/k2f9L9JIuOMA4kk5xAZTc6/jkgiBTNSMTEjCRjFIk2mSib42SWXWfxETTQf/ECIAg5Uw69kRn8gZMqAx/pXHP2MCJpAQGP/mWVqv6hklvq/NICqDlIeyNCZHvyU/zmMJyd/QmRKf3Z/GLtPH2H5JFXc/PE4oWnKxMx/928//a30vUZs7t8DndmByYLyDEhKmfL8oU+aKNAyUxHowQoF+v1gkkWPYAb2v1coWcW6AcMtTYDIKaFk9J74UVcmjFkCQjMpXgnjPqEylWGtQP7xp4FXucFPg59+bIk6ltmEQx+gNTFzaogCkykBsZN3sRbI+d01+ZaBWq6SNGGcMzFbIaW8ErZg+Lcf498kksJQJiwcIKANS6iBmERzqmagyVQqspSZwqVKo0hmwhAmaqs2/MtX7wQMLf29vgTL1HjpVD5bR9G6scrjXQUaLh0Jg4Q+r3w5TMBlhY+NnPtEn1mSJWuY4/mCjFkVVZSz6SBpFcPUBJaUdekJFBAdKZoGfcrt61fUqac5i+bFAA1WWYMwZLIkMZtOQdn/sHTolFbsT91M7yLmfJxGQa9ahy0ssf8e5lAMS3QKEZsyiMnTHIRbOyX+E5qyBoO2FDSR8eQg6YRBjiQb+8MhTjm8eG2Lb5RFEWg9zfg9fMtAmxtqQETLAV00rbM1RnYHpod/VgfoAhSdAeFuLruL6RwHUQ6IJkbmbCN24Sb0LymKP42MAprUWeGBZCgJK9VCzQxLgKSgmIwH7RmyySodypDEW6zXyJDPgjMB1yKG5ztQEQhDZ3Cn5EyB1r2qSZpPZxkSySTlYH/j7AUlAp7IjMsJ5URDJEVM1ZIwC5QwTSZgCaZxbAmVhBJDJxzW03mn5IJZnwTir4oZuKQpjZhZfhHM9EunyJIJKEtjWmAgTxYEiTwKklkYuIF5Sgj+32b6d6LyHmj80kQqoHHnNF5KobPk2AQGo1YQ2kRc5LERuQC1fjmeNk6jpXXtSEQFMYpGj2Qun0iSRXM7Gzp9Zd6auZLZbJ5mxi6HTMOGRb6eZTpLDnLG1jNMZ8l3yqUj24dVzWq0Dd8f03rXre+JT/eQchZRS9kxfTDgNNWB8gmYJ7B7qyBZGuPRiRlICE1ToOhAMIEcy30OjT6HtdmNM0kBRDnCnEU/JVTEzsNeHZkKaeag8l/4ybz937J/N/DvGC7bfw3/HhQVmkaW7kspppxFpjcFPPfKp+BPiAKXzjgsoOTtxhlYx80UuCi3ixeh6ZzXkRRRpuzRt3GqfDjpmKFpAjidbseKnmyVNJS/VjacuyDJOpfRMM7+wvV2FENVPQ1scyIzRAexPX9bemk94LOd2OqG9WqobdzTWpM7WmoDyZVSUvW5D7c8ujrDNgMBipomLhJrWn97eLgjH96+JdpQk9kNPYYDDriXUsTMravLOUSPHynjVtUd8h6ZU/hzU5ySUGMgSR23UlBTqRK7rgM6J/oNC/YORMzErLQTXqIWHIME3I3cpufFSBUgYgPCErS6lTWOOsmM+/mcLoAIacgSDJlYE1ca7EBPgcYPcyWN4XC1ANGbkO+btB+Jg+cI0D+E9ZascciOjsiB/L7VvDUHSh4zZwkzzdEsKQjN79nIibb+N9UVlgjHgjfreYD2/XXqQdXG96kIftv7RJ/tqjj87mW7w7w5PoJcsaerCeB5yW5oVKzfz9zoTDttIbEEjUaDpilfOrNzFkOCTrPlkrZsambSJstasOnBjnJjXbRXzLBCIxypzUfZWsxUTsucJh+lWmWeKVgd0dRfmzica9xOGgcnwAPeQV2RnkxvMOFN8vjqdsdjCqTRF3vdEnGQexXJqxbEy9uST/S5dMpA/V13ruozgHHYeWrOZnPQzWfNlbFqur9Fz9swbu0Z7WU4V1fDZqaVf7Jhje7JtcAtmJR9p/aX5DDRR7wfv7oYHZau0PXF+L8kzxJcmBdLa80OP/SHoJdmf6HiAI3mbn3I1J53mRTlU6yPQqOLmBrr8i4QkrbHRBrNw7XmLTNKnk2oNXBMaENFBKfkaW7lY0oRBQWpAstyXflzQxB824HZsQaXXq+8ccvgu2SO1ZvPaRecsQbHYJSw5gfmfNEY+l2BaL9oWLJhxy7JsT+sNSEeCPb3DDK4ATEz847w1rhqN/e63uVBrCfKDGqgtC6FT0hAzTqApIf8xFukV3REW3Wjuv7757IcUlB+SyEn15/vRm9IDJwtQIGDnsvSfljZ5abufO1jeFcXI7/4BuSLXWdPzMzLeQZugNFomK9RKfhyG1vKN9K9qChNMDVyg+A1ORFSJdTt4UaSdx/+8T81x+hNcZ24WQu64c1FprS5oNzasQ64UWD6J8ZcObnLVCo1IKSTWfruzSkpFJR8Tg1LkBu/DYfkRJuf37gLqUvJw9+in99UiXH0xmCX/tTyExcVnUiM9DVpaaQgtk7nidU0C8J6QaXIUOVzbX5GCDixgoQyUbpom1iGraRHN6scXsZgcNAKbFMoaH9z6FactnrinB/K+Yo9dweXjsyLBeBCXUemamU1dUnWdcyPQdBGjC4PTUgvP7VKsXOSs0nCjCnf/ec+evTuMB89endMH/3y3WE+epRmA+T0II3qR0dHvI4oh3g85ZLWv7BDbnHVklDOZYR38FeX71DvMgPl0ABVQPydKbeHKpJpCPejwVkcrCXEGaFxpumsOUW6IcaxS350roOXd19yS5cvrDI23Ijtt7LSwXcb3onbPHpBDBRfRpSBO0aLAvOcantmVRnERDP7F2bIE9WE00yg4442nSpTT5YpE6MzlfJMj49AlJ+qShFeTuGlVGHyBMkERo5KZw1nIuzPLu++XOIIfvf2b4eYJn+BkrtSqsfuKUM9btARqUhLI8F2rQhpSEpZTGL5JCzJq/J23oAzK2aeWQMaZegt0ji/xnQkNJMswDxJ9ThgYpBSu2k3n+j3o7Ru5f0MREEEbGFVT+DO5UEQJgyoKY1Aryw9JsKDOevMNB0K11M0TkGNNUQ9WMBV2kpuPtpy63XtTOZmimRmjiik9uj3EFKJpP8WKTExmCwN7Cwi56L/Spp+tIf4cJijrTCc7SiSc3SV5NaexO2q+PKCO9qqe0HJdbXiYqYfmRzY08DxJIdSC4uMejffUpHLQxupoIiPLijjeLNg5L5yWyG0J7ldFGSVxLU3hRuJwbPbi4itnNZ0FLmVSO1VcIGwkuz2pHG7Gsq0Mx8ERVOEKerBmWMvMJlullJ7Ci/X0tbFKmsT12lUzP5EuRqROu6S61OUK7Qdvur2kaRLyR1Ec4gexy6ttSNS7yGVymh7osbUzwrSOdUkpRqTPKSZVz8MacIWk38+AURjAnT1Mx8z5lQbkjCRmd2JHLvxjkxrH4SEeV6AlGaJ7UpMvllEUtn/yVaeQjgarFs3g/p7m/ahOal8RYntO1X+KUvoDAaseU3sXVPhehhu7HB8l+xkpA+ptcFXRIAHVgYd1n64FjGLMDk8aEIMxqW9l8LOTBMQ1hatMac50FSxBTUwiIUe12rpdMBQPzoZ3o5w4sDelZPBjihZPfvEa2L9zy2gXd8tfiE0jhVoTajWMmIY68bbvL2wZhPOor4YioOv8HNHrfTQOuRiYJzHcWWNC4vI9V3+yYll8BsykZnbQPdhKS6hQSTjZm7ubYhw3DoPT10G/M//OJswQzKh2UxgJBon2Qlp93JvREpOUvdQhfyHqEwI9//0PDOGidkZRpf/QwyohAnU6f9YjwVLN4X/C/GbLRSZuXVunb9lTXVfW4GfB92tsC00XPTxwyrWAD9msZqrm+Y6NS+WjHdBo0cQ8aUUwvncHT1cq4oyyocvs1VIUyrGwpcEtKETzvTcOpv+9SU6KJLGxN9EqdzPVDBj2mBWTdDNDbnBvz083F3KGMae4vG7P/7omEp8Pffujz+IAp1KocG9nwuP7jBZ9UDQ7/sB/b5X0L/0A/qXXkF/6Af0h15AX91c9MnliDNrw8CaBgStq6hX1uiOkHvksQa1ANUJZP/GrJsHn/XESJ//WERSEG5hLRO67gUuukoLyje8RE4Z53IBqjvoq/my4f1dbtXzJ/cTiGimXTawztQMyLcM3MW8NfcbdAQoN/PlbzIw/dD3LlWmz93wxQIrrzp08rHayI7aMbKUlZNnuwC7ls0nqODcohWg3tS15eThsvxpnl8QvEIls5BmS1f4sJ7GL6JnkWSiW6F0V+alkAbmpfmaJKeEiZDJdurcQszqtV9ZdVjQATTFm33H/gZTTzJhGF8J2Cjjgg4acs/HbyBzoDGoDTtEXgH0/ObiPDJsAYWn5wTZDYuKgqAVp8/ngBGrlmU9pQjFMc5tLjqcBFd9vZy91Y/s96magdmR/JD2fHP5pat05yaqqyBrb71Obi6/vCm/mDtP84IC5Mb+8mKrbpdpuoWn48lTwNOKIMse+/GkeaekPTRAZw+I1pHsL7TDdLsLLa/QXXz10INqdagjnllL5L6642uzTevD03kF1uwSx364Gd3CTBpG8+N6H67pw82oQiQTzLCy9+wPBahxMYvxNJ+bA0KJBq2xpGgIm1YJ9sWXKE6EbvrmQ8P4I3uGeHzvt75xHzRP7RRn+e5KVyIWRbRiC9h7iJmCyPQCU/nBOwH4RfHxDUuYGV9hxQyIj4g5khmPxY+m+uirfHD4cn8TrqlyuWDyuVUt5/7YAwW3a0fZQQX5P/+z4/Hz/R9/9EJrKaTiiLZY3RkUqZaKzTD+usYY7H7g7w/+mmN/l/g/9Il/TQygU/xv3/aI/+3bHoG/6xP4ux6Bv+8T+Psegf/SJ/BfugR+fbf4R83B7sOfanCtV50EfCVuAW2G22OEzg5fhF/yTOR2EcSGY1ofLH3xA9prU5tfkKDN+nPvw5V9CGjbBVhjqLRKyhyrPLm6C8zohgI9paFfNoZdCKUV/zMOVwvKM5dc1zW4jG9XlxlbgCt758JzyppNX6jCE0MFmctswxLvIbq0V0xpU5S09jjg0IBEMcwRgxG3btJXGoj4yOVTl2G4DUGIKZdPmpxULwDerNr4bTa7Bnz8cHnXP3i7S/VGwM3oCATcjHoj4MvwCBL4MuxOAt+D7VvB3H8src59qzNzKmI9p4/BTfflif0FryiwFAXvwzHcbqUuWhYu+DY6nIUp6svVXKM+Gz1Op0ohorNTEekyLbi4e3Od16/prml6JY7yKWEi4hleDT9c3v39+m77jWIVem8CaYBfVv1NLQZQHt/Fyi5T5Ne306YN1F3ejZ3tGt+Dhi4DzKtJBxoMObkfPbypPhV3D5jyCwC5I+yrm4sXwbxv3o/F7JTpxVnt2OtY7dj+YtkzwdwVdV6k0CzGPAafxPGCiSSb0OVJJqsnIk6TSUwPOg25IY54ErrBCRtPQS/Y9fJaLPztTPeuoN1atfPyppkorlXwbcszRJlxmTlhSys1enQfu9taEZf/07ce1hk37lVePvSWS0mfKN01kaxg4P7YhkDjGzAGVGcoP0pFqF6KaK6kkFh/JgA9dU84anJy+lnpvIEJTFQQWOQbRww0PuMI1acHTjK3eW7Y4oegDRM499BVVlx+pIxnqpNkkN4ozUHvRGOmuuqJg89y8pqMPkmNmqaVpFMQce53YZtPT8T2jhd9roVaoinFIrO+0caGuwFjN36pzjup+2n1wsnTd8fwTc/zdRpqRLjOY9opiy+Zlr+zVBBJFYfTwhbWXuYH9qvcYnXO5VwDitzLInG0UARwfTw27O3Wi1ELDKX3gfqjL476dUTuYdawGh3CArzrU1s5QwRa/bdiKX70JccC+CJIEm1wZEqFRhup7daraSUhIkWlpuze9EQ7l33fhSKUHlmAwqQg+x+cUb9GXME2Od3GVhKzBYsLR75ebnYN2UW9wrYMKHsz3V5M7OLLdCjJ/CnAy1NkNTimqioh13ea87UiZNqXkWy4zqBmRg080eVh1xn5MGuceLTtl0UXfdc6MHokWKjSsuD2/IH4MawzTl0hELdb6NfmqWP85lp8VDIp+VMdK0WtRplft2U+5dfNJf9oQ5XmAvQI2foyeEP4jwmn8P+6u9yC+XNmHmTffM7LbfmKzivg/aX/7qxG2D1y2j+N2Ii2FbOLa/xz5473e5tfOP34UGsNJbvAvSpCzH0nIJSj2a0R44HyTipzzkMeZi8bSV0ZMFXUNQ3yuzmhwRFPpdrgRIeC1jLrWRm8V4b9ZLEiK5SyaXySuHu2H8oBxdz/ZcN+7sKBQyXTPtCHaGOs8O1/g8XbCq3vPWSlluzBu0gFeC/WbWfMrYybx93zXrJSFraL3aQMvVeOd76jND8x6eOVZ+l63luLejbfVmsdQKv4sBZVKj5mi6r74YEtqg4qfx+KTfoa9z9skNouxfHblo3/3zL3xy5zH1NDJ1TDuLS0eiEnTFR7SLXa7TFHNsmLxA2oEo2g9qoY5DsK3YfGvrc0gZPz+9s3qAKuX1qst4OKONXNvNoL1mXZwpTLV4WeElTEJIFEqmWR+oMYwheHF9tKmZbQsxiEYVO2UpeoCxKoFas601macgZxIfxi1oFrgln8gTBHeibYtwwsAKfv+TfssK1IdPX9uiNv5OtNOJxheyoVn2I6p3R9nc4xXu2MY0jNvBHbwaWnZWYwsGS3mOvPmpwooPHfKy1Z9ZtymzGKd4POgWH6sRl7qED5jY/dY6IxnYEw4z/lpB+L4bNGRr/fkJF7vXRuJyR2wnIZkK0lG6cKgE44jN3qOWq98yIgWxRAVVTEMglc96DWIh9rIxWdHbFq9BrYHgfR6dqadD4jf5xpiMd49nNPHMcs7lJHQuJ/aQZyPQw9U7RrmWIxDNyDbcB7yDupzUzB6PebZvCSW+997Jv9I2zNpRlzOhskkw7hczqb4Z28b0PpHnTirPln6GZKjXfdBlSCRv7r+Q0amPwo1Yo+awXGTG6tD7yn/QndLEtbPtOP7ipwbVPAdUiRGcj5FlWMg87H/rr4ELXHm2FK7i36ey+b0uZj5WT1bM5CoV/nS5T3p7JsPi1Hv9+ckk9UMTq8cP1rCnlVplnjeegnmjr/+IUMgQXg1r5LMvYtrCoU45buTjV2O8cIVW4/rHdVGPNmKss2g8uZHvuEtVVpHrIAUTFLpNijQMmU2IlbrSzcWo+/tNyO3nJtfctAsd3VZy90fo7iqmsbqBhozGX02C+sfJaQcZC7pdvwuSLmuK291Orzm28lv/88U1JV7BIWY8LJNhHiSv6zFiXwD6SjdNXBOA8tAWqam6fSZtqA8lBP7WYgseoTNeTDmfPz8oJvm8l09fBfhE63NnGZ1sjM426Hk4nuIZcR5S/sJAbtrBp7A0kqFVVL12TepRta47pNS7mcMYGV4jPVs6nyhwycsbjA2mYPii6xg0gmCWuOs3Vm7d0cbax8CWAMHNaUWO9uO8I5crvfBl3M+4U2HN6UnuW2AJb0DIwJDcroU5KlMTXgmxo6TrZC6gY6Bth9BOxfxnYKL7c7oVR6qWszNubIr5rcnmJ9dOvfuQa51gKHWw9sLxnNK81IrHX2Oyu67XZ/9da6MFx7sGDsUXXJCiYimdjz4sm9G/xNwRNFp1MWNfjp5bxwZFeUaSMTUIVDFH5sWRfipcNR/mf0QqyJL11mUOxOl5+dd+ZKkEyXbJGZmUlky4Mf/fvhi3WN+ljM9axn+uibZq06KVsxauCw5nKpM5Pj5tjH5DiD2i86N8c+6NAz7BfcSsc3FPE2jNwXim3p0XQZdfEQcAmtOD1ofBPGOfPVZjeT0caz6IsGDNbFMMWCgVIQTsUss7I6GQ5v3uR+SVvKWrgmfVG20XtpSU9LB6ZfksKSbklDK6vdAQVdGfWAv6VF70sGVaPfUgYt7X5fNFS3hpY0tNsdXqEitTxu9mZ5KyfSHYWA17M+xs4wAP1C8ZRSgFpGUZYyF/SbMEHVEkMowX1NqD2XrN41uAib2nilUCK3funV7YVXQ7y9NCGxE5Ip49Au6l6CX7826B3+QdcFpR/rgctu6zXGFTIVyvOGZ79ihv2oRTjxFpka4US81bUtUzPhMnrsrBlnMzkVMuqR/OLBm0Oy/eqhlDAST8b+oD/uIz1mz4SXECn27U4iyrmzcf4AWtwC+G9uJ1TJlSeGB9A1vCB2QE04ewTy9f764eqeSEXur86HV/enXQIHMWMCOm4deEWjeeVyV2XC897Nd+ooq1/ili5w8SG9iZoJoEjn2G8p49LtdpfrpH51rYpb66BBoQ1ewXssSO42jEgmKTVswjgzyw332xtl5UmdcTmhfBxP8o0F4nF+S9pqT91C+nXZeP0TpyVDbwzqb2Ib70sLgEXifKpYYjfa4nlt862Nb12M1qX6/R25Y82WC4BNQR2ZL4XCKIil3cXccTXAUWWOODejxpCDSC97HJhh0xXl4Wn0TqRzOnPvLXM4YhaOtJv0YUeH0lPtBx/0SKdPHjmMvsot8j7UjRP63B2F5VSvKknlhoh18M4WW5O+ej0e3IVaRH8/UpnomFQmXgOpExo94lvecTSnYgZjV6VBDyIFbrmqdafsQzM+86mJm9oXiNAEpw71Z6dsAT7f03XGxlyIbTvTWrKwTX2nHmtksmr9tnVkVZI5difgiYlYPg3cPJ2ec6ZTUGCVp6x1vuBWQYWbP+896umtf74rFXxd7O9QbQpvJ6nZBNN64TqhnIeWGZtInmLhBlcj2dU1DBOtSdpzeRE+cYhGj1k6VmCsfy/F2FdG7HLbf2ioBOHmzXM08hvM0L9dZ2kqlWNSKpkwZ0ycoROpABcHmQI1mQL0FqsXpIXS/qjDRDmBGxWhwhotaKrn0rwYLyJfthW7WnEeyAu4nJ2hDUcWTLZnMWBB8lYMiGg0h/GcmTG6ooNJZldfh7RXn2KtFg3yNV78Oyg3vUO1G2BXjGusocvl2w70PULQYDbh9mfGLMV12iKfuP2pKzc2lRdamI7uz17lbolrkp9jPTZy7D2O1J0x9Tc+3jMrumUIdVYC2MJ1vB+OyufhnH4jiTRzUERgPw5vPbZudFkaMtrGLmNw7J40vpR9sMvfveNcyszFl1wiY3lH2DGe4SXrc0o5TE1PxClIKMMDf+kRB4YxMTuvIQkxAaoz14Wznp+X2+3345gyvgzy+aGOtc3T2vpgtXe2+FkujD5f3Y7eH/bodpJFj2AGmv31UimYeHbP9dU5tS4+4bE14nbe0lhOx3LyJ0Sm+7VVepbmZmjA5lYR57mo8VnjGu3ze8KheueHKWlcaHnxmvUsbIjuhXePwsJuSvn26wq6SPSAXOx29N7L7pQomFEVc/APUZfpmn04xz7r1GOoYf7n1UMNt1WuoHtMNNGwBW+a9Yj37kvneDdcwXYCeXh1c/Vw1TXq+boMik4w/3Z1PtxJn7fpgtR9KsPnUV0b9kK5IZvjUJwFktHVzdXlA/mMQse339bQdawVjpKxjqgQR358U8+nC5usx+LuTnZmxyHUKzCZei3kBzDHoJ+zPldb9XRp5/L1FhA6UrzZe4rlk+CSxi8jGSeWAgMutt227Kc5KKg2knWpz3jnPJHxmvfoWfrS5AYEoWcuul2lfmUW+2l7ywmuNPgvz/VKRh2q2y/Pz9U2sq4+hSsMuovc3IqjRYlYYHi0fkukIj9vJOxDn4R9eH6u9pc9BmEh32zKlDZjqxwtbmMOzzpLQZ0FncPQTx4RCb2bC5XE0svl6mdNLDDSRVsqixJL92BO0QRyw7uZH+jIh9PNUVkCnKbaZdysYQ3KChdywY7Qe5OGT3SoEr9p7ebnQXFYbS8tjlnba3TbXNvrBSvf3mVY/XLE/uqiLLxVg1DVIgGt6Qw0STNfYHN9XbnRp9HINai4p6YrIMrX5Sm1vhh9GgVcJHbdElj9EWoZ1y0aus/TT56Wu5yUbgv2rfLKrgD3xtuvgdsRMTJl0Q5ob6XBdCtMcPFNIfqDXLCXLwNTw2pppsBdOk3s0BOs1S5ivHdqS9pHfLvbF11oAErY/UthIwORbdEybixnPmdd1y2tQq51010GVuNPyRRRkFRyFu2k+utoOLsWC8pZfG6MYpOsq9ZtnVBV6SEcxvmR0BwqRvCZI4Ccubpvz9Tu26eV3+a/IP9v9PnWFV6PpFIQGZfKmFCzsZT+Vi7eSm9bvhs+uhYRQpbY2ZL+e4gVW4B4kEP+rVdqESpevyXSOxsNbXb2MjsP0pPRPxVY7ln8aD3JPekYfRp9ksLMH+SQGhilIMyX0bAT0NGcqplrduDYXa1Hibmj1ovNqxn6ZPSIchAxxaeyZu4f/7iadaVduukK4NuBLt+3o7p8vx9YztVXJfP8GNNZqyvsDp7XpKmSzyzBIuNF/x4Hiwgpzly4Oc4dK3/H26CShRPrhRsDp8vukq/WLKIyoCKTwM+NaUyrhaoUUNRFliQQM2qArwmJ5LQIacYLptmqd9rNUbtqE9wGRqaczeZrYho5sqOgqrPPKAYLyovD3476YFWpX6RBX1shC+fVfqHlsdXJ0hpInlcL8tUdvK9A3OuXLZD1agHnrmUex2Ez2sBDSFKzDMUv+ikVWmPP+d11YB92tmJuhTvuEhoIWJOYBqIwt0e/0F85Pe/GY/dRt89iRr+PvM2sjFt598U6aTdUHWrvlkN+mO+u7dBR+vbUmLPeVwy9bvrrcZMb3p0x5U0qjtSaoi2w7tlVaeGwH6q8TcoFp9HjXPK+2kzk/VKK0+KSJHaRWveKTML0RMmVGs0bYN/Ke/z+EUGHnQLBE1oHnF+D6UMT33CEvQ2dlgng6eLVWrZLynkfLXr8U1KIcY+vFsSzO6/LK8OwI40iBLAWY2gA0AdOPPbmWHMx5S8w6yB9vmb4mjufTJkoTFLMEhDadW3WWkYMtza8OCuUZ1VVF6k4SFEXqdhbTf91d/v69+CHTAjgI9PdvUOpIQAQg8MP8LWe/YBFli36lLwlTMT48FST4eevt3gO/bn0xy937lcX/7zzPyl/ejV6OL+4uR79djXEX74lTBflxyjnPu0awWwI0Dnyh9TQLZvr7vTX/I9ynx6rEZ4jOyDatqu2hbTSDqkM5/8HAAD//3P8lfo=" + return "eJzsfd1zGzey73v+CtS+xE7JOo6dbN3Kw6nSlze6R5YVUV7njQvONEmsMMAYwFBmav/4W2gA8z0kh5yh5FPXD1sbkQR+/YFGd6PReEMeYf0boU/6B0IMMxx+I387+zL52w+ExKAjxVLDpPiN/PcPhBDyL/qk/0USGWccSCQ5h8hocvZlQhIpmJGKiQVJwCgWaTJXMsHPLrjM4idqouXpD4Qo4EA1/EYW9AdC5gx4rH/D0d8QQRMIaOw/s07tF5XMUv+XFlDVQcoDGbrQpz/lfw7jydm/ITKlP7s/TN2nj7B+kipu/3ia0DRlYuG/+7ef/lb6Xis29++BLuzAZEV5BiSlTHn+0CdNFGiZqQj0aYMC/f50lkWPYE7tfzcoaWLdgOGWJkDknFAyeU/8qI0JY5aA0EyKF8K4j6hMZVgNyD/+dOpV7vSn059+7Ik6ltmMwxigNTFLaogCkykBsZN3sRbI2d01+ZqBWjdJmjHOmVg0SCmvhC0Y/uXH+BeJpDCUCQsHCGjDEmogJtGSqgVoMpeKrGWmcKnSKJKZMISJ2qoN//LVOwNDS3+vL8EyNVdhzgs3ZeVLgTQuK/Q2qPtIv7EkSzoI8NgR/GkriItMKRDRunXypuo25r9qzBv5EUkmWMekE1ArFsFtde32mtcPgQMiqVaKSRcz2mGcJVIZ9hfEF1KbViB1xeoSaXlUmlhuNz4OQzYWVit5OTQSSW26xgxTWk53TtjOzG0zNoYMc51zEPFLZJkHdjSGVebrZNetVAnllq+fNV3AWRuuZ2ZcAZFkFuMxmNcxZzcfP4vZS1W8HNrRVK82YzfTLGv/yKgwzLRb+OdjGkr9q8d2FKZVZ+xkmjZUmWlMzf57kx2B2BFwZ1LW7YGVjQHsfmxFpltnBhEfNO+ViPeYFVVgGsOcCWbHGUxPHqGuc9uoaVD0sASiDYZP3mlMFWgQRhOKgYOllBKdQsTmDOJWnKXAZ522KeZQkKwLYsey0UQTSJXfs3UlkCDdbjnZHlCQHv55g6D/blBsTSyBbymXCpTDS2brIlDTDcc8yp3ig3zzYpiae56UI4cnUEB0pGgaooc8mv6CEcTTkkXLYoCWGNzKy5IUs/kclP0PS4dOaVT1FatBefi3yanPx9l3ETfFYTUuH7ak609LEC5SKvGf0JS1hK9rQRMZzw6SThjkSLKxP7zEKS/PDw21/NiDmbZJFkWg9Tzj9/A1A21uqLExzyld1aM10nNjbMqfeB2gK1B2C+NuLmtldI6DKAdEEyNzthEbAib0LymKP02MAprUWeGBZN6uldXMsARICorJ+LQ/QxL6bTSGhHDvJTLkk+BMwLWI4dsdqAiEoQu4U3KhQOtR1STNp7MMiWSScrC/cfaCEgFPZMHljHKiIZIipmpNmAVKmCYzsATT2DqXRhJKDJ1x6KbzTskV00wKiL8oZuCCpjRiZv1ZMDMunSJLZqAsjWmBgTxZECTyKNDL095LQEoI/t92+nei8h5o/NxEKqDx4DReSKGz5NgEBqNWENpGXOSxEbkC1b0cT1qn0ZKsZUYiKohRNHokS/lEkixa2tkwxVfmrVkqmS2WaWbscsg0bFjk3SzTWdLJspaUXg+G6Sz5Trl0ZPvQ1KxW2/D9MW103fqe+HQPKWcRtZQd0wcDTlMdKJ+BeQK7twqSpTHmnZmBhNA0BYoOBBPIsdzn0OhzWJvdOpMUYONKS5iz6CeEith52M2RqZBmCSr/hZ/M2/8t+3cL/47hsv2v4d+DokLTyNJ9IcWcs8iMpoBnXvkU2FDfc+kNhxWUvN04A+u4mQIX5XbxIjSd8zqSwh3UtOXVSDGcdMzQNAGcTvdjxUi2ShrKXyobztxxW5fLaBhnf+F6O4qhqkYD25zIDNFBbONvSy9tOzrcTGx1w3ox1Lbuab3Jnay1geRKKanG3Id7hq7OsC1AgGpmj90/KsjvDw935Ne3b4k21GR2Q4/hgAD3QoqYuXV1sYTo8QNl3Kq6Qz4icwp/bo5TEmoMJKnjVgpqLlVi13VA50S/YcHegYiZWJR2wgvUgmOQgLuR2/S8GKkCRGxAWIKaW1nrqLPMuJ8v6QqIkIaswZCZNXGlwQ70FGj8sFTSGA5XKxCjCfm+TfuROPgWAfqH0G3JWoccKEQO5I+t5r05UPKYOUuYac9mSUFoXlVFXmnrf1NdYYlwLHjdzQO07y9TD6o2fkxF8NveR/rNrgq90WU+zFQEh3lzfgS5YqOrGWC8ZDc0Krr3Mzc6005bSCxBo9GgacrXzuy8iSFBp9lySVs2tTNpk2Ut2PRgR7mxLtoLZlihEY7U9lC2ljOV8zKnyQepmswzBasjmupyrVKH20nj4AR4wDuoK9KT6Q0mvE0eX9zueEyBtPpiL1siDvKoInnRgnh+W/KRfitFGai/XXHVmAmMw+KpJVssoVG/5P41xqrp/hY978O4zhjteThXV8N2ppV/smGN7sm1vAZnVvad+h+Sw0wf8Xz86nxyWLnC0Afj/5Q8S3Bhnq+tNTs86A9JL83+QsUBGi3d+pCpjXeZFOUo1meh0UVMjXV5VwhJ2zCRRstwrHnLjJJvZtQaOCa0oSKCE/K0tPIxpYxCrbwn/LklCb4tYHaswaU3Km/cMvgumWP15lM6BGeswTGYJaz5gTlfNKZ+GxDtFw1LNuzYJTmOh7UmxAPB/pFBBjcgFmY5EN4aV+3mXte7PIn1RJlBDZTWpfAFCahZB5D0kEe8RXnFQLRVN6rr//pUlkMKym8p5NX1p7vJaxIDZytQ4KDnsrQfVna5uYuvfQ7v6nziF98p+WzX2RMzy3KdgRtgMrnM16gUfL2NLeUT6VFU1NdpbxC8Jq9EUd1tJHn369//p+YYvS6OEzdrwTC8Oc+UNueUWzs2ADcKTP/AnCsnd5lKpQaE9GqRvnt9QgoFJZ9SwxLkxu+Xl+SVNj+/dgdSF5KHv0U/v64S4+iNwS79ueUnLio6k5jpa9PSSEFsnc5XVtMsCILXYnIYlc+1+Rkh4MQKEspE6aBtZhnWuAzXrnJ4GIPJQSuwTamg/c2hW3Ha6olzfijnDXvuApeBzIsF4FJdR6aqsZqGJOs65scgaCNGV4cmpJefalLsnORsljBjymf/uY8evTvMR4/eHdNHv3h3mI8epdkpcvo0bRSGO+J1RDnE0zmXtP6FHWqLq5aEci4jPIO/uniHepcZKKcGqAJ/x89wG1SRTEM4Hw3OYvt9O0uIM0JTvPTTSsu2C48d9dG5Dl7cfc4tXb6wythwI7bfykqB7za8M7d5jIIYKN6DLQN3jBYF5iXVNmZVGcREM/sXZsgT1YTTTKDjjjadKlMvlikTozOV8kxPj0CUn6pKER5O4aFUYfIEyQRmjkqxhjMR9mcXd58vcAS/e/ub4kyTv0DJXSnVU3cPtJ43GIhUpKWVYLtWhDQkpSwmsXwSluSmvJ034MyKWWbWgEYZeos0zo8xHQntJAswT1I9njJxmlK7ae93mbid0rqV9zMQBRGwlVU9gTuXB0GYMKDmNALdWHpMhPYI1plpCwq7KZqmoKYaohEsYJO2kpuPttx6XTuTuZkimZkjCqk/+j2EVCLpf4uUmDidrc3ul/Kdi/4bafvRHuLDYY62wnC2o0jO0VWSW38St6vi8wvuaKvuGSU31IqLmX5k8tRGA8eTHEotLDLq3XxLRS4PbaSCIj+6oozjyYKR+8qtQehIcjsvyCqJa28KNxKDsduziK1c1nQUuZVIHVVwgbCS7PakcbsaynQwHwRFU6Qp6smZYy8wmW6WUn8KLzppG2KV9cnrtCrmeKJsZqSOu+TGFGWDtsNX3T6SdCW5p9ESosepK2sdiNR7SKUy2kbUWPpZQbqkmqRUY5GHNMvqh6FM2GLy1yeAaCyArn7mc8acakMSJjKzO5FTN96RaR2DkDDPM5DSLrFdick3i0gq+z9d7YmsW7eA+n2b/qk5qXxvsu07Vf4pS+gCTln7mti7p8L1ZTixw/FdsZORPqXWB1+RAT61Mhiw98O1iFmExeFBE2Iwruy9lHZmmoCwtqjDnOZAU8VW1MBpLPRUHNB9rSOR7EYnl7cT15fNs7cRGeyIktWrT7wm1v/cA9r13eoXQuNYgdaEai0jhrluPM3bC2s24ywai6E4eIOfO2qlhzYgFwPjPI4ra1xYRK7v8k9eWQa/JjOZuQ10H5biEjqNZNzOzb0NEY5b5+GJq4D/+e9vZsyQTGi2EJiJxkl2Qjq83FuRklepu6hC/kNUJoT7f3qZGcPE4g1ml/9DDKiECdTp/1iPBRsBhf8L8estFJmldW6dv2VN9VhbgZ8H3a2wLbQc9PHDOtYAP2azmqub9j41z1aMd06jRxDxhRTC+dwDXVyrijLKhy+zVUhTasbC1wS0oTPO9NI6m/72JTooksbEn0Sp3M9UsGDaYFVN0M0NtcG/PzzcXcgYpp7i6bs//xyYSrw99+7PP4kCnUqhwd2fC5fusFj1QNDvxwH9flTQv4wD+pdRQf86DuhfRwF9dXM+JpcjzqwNA2saELSuom6s0R0hj8hjDWoFahDI/o7ZMBc+64WRvv6xyKQg3MJaJrTrBi66SivKN9xEThnncgVqOOjNetlw/y636vmV+xlENNOuGlhnChtrgjuYt+Z+g44A5Wa5/l0Gph9636XK9KUbvlhg5VWHTj52G9lROyaWsnLx7BBgO9n8ChWcW7QC1Ou6trx6uCh/mtcXBK9QySyU2dIGH7pp/CxGFkkmhhXKcG1eCmlgXZrvSXJCmAiVbCfOLcSqXvuVpsOCDqAp7uw79reYepIJw3gjYaOMSzpoyD0fv4EsgcagNuwQeev1s5vzs8iwFRSenhPkMCwquqlXnD5fA0asWpb1lCIUxzi3uegQCTZ9vZy91Y/s96lagNmR/FD2fHPxeahy5zaqqyBrd71e3Vx8fl2+MXeW5g0FyI395flW3S7TdAtPx5OngKeGIMse+/GkeaekDRpgsAtEXST7A+0w3e5Cy/tgF189NFCtDnXEmLVE7osLX9tt2hiezguwZhc49sPN5BYW0jCah+tjuKYPN5MKkdj5u+w9+6AANS5mMUbzuTkglGjQGluKhrRplWDffIniROimbw4aph/YN4in937rm45B89xO8SbfXWkjY1FkK7aAvYeYKYjMKDCVH3wQgJ8Vn96whJnpFXbMgPiImCOZ8Vj8aKqXvsqBw+f7m3BMlcsFi8+tajn3xwYU3K4dZQcV5P/8z47h5/s//xyF1lJKxRFtsboYFKmWii0w/9phDHYP+MeD3xH2D4n/1zHxd+QABsX/9u2I+N++HRH4uzGBvxsR+Psxgb8fEfgvYwL/ZUjg13erv9cc7DH8qRbXuukk4C1xC2gz3BEzdHb4Iv2SVyL3yyC2hGljsPTZA7SXpja/IEGb9efepyvHENC2A7DWVGmVlCV2eXJ9F5jRLQ16SkM/bw67EEov/mccrlaUZ664bmhwGd+uLgu2Atf2zqXnlDWbvlGFJ4YKspTZhiU+QnZpr5zSpixp7XLAoQmJYpgjJiNu3aQvNBHxgcunIdNwG5IQcy6fNHlVPQB43bTx22x2Dfj04eJufPB2lxqNgJvJEQi4mYxGwOfLI0jg8+VwEvgebF8D8/i5tDr3rc4sqYj1kj4GN923J/YHvKLAUjS8D2G43Updtiwc8G10OAtTNJar2aE+Gz1Op0oho7NTE+kyLbi4R3Odu9f00DS9EEf5hDAR8QyPhh8u7v7r+m77iWIV+mgCaYFfVv1NTwygPL6LlV2myK9vp00bqLu4mzrbNb0HDUMmmJtFBxoMeXU/eXhdvSruLjDlBwByR9hXN+fPgnnfuh+L2SnTs7Pasdex2rH92apngrkr+rxIoVmMdQy+iOMZC0k2ocuLTJoREafJLKYHRUNuiCNGQjc4YWsU9IyvXl6LlT+dGd4VtFurdl7ePBPFsQrebfkGUWZcZU7Y0koPPbqP3WmtiMv/6R/o1Rk37lZePvSWQ0lfKD00kaxg4P7YLoHGN2AMqMFQfpCKUL0W0VJJIbH/TAB64q5w1OTk9LPy8gYWMFFBYJVvHDHQ+A1HqL48cJa5zXPDFn8J2jCBc1+6zorrD5TxTA1SDDIapTnonWjM1FBv4uC1nLwnoy9So6ZtJekURJz7XfjMpydi+4sXY66FWqEpxSaz/qGNDWcDxm78Up0N0vfT6oWTp38dwz+hna/T0CPCvTymnbL4lmn5PUsFkVRxiBa2sPYiD9ivcos1OJdzDShqL4vC0UIRwL3jsWFvt16MWmEqfQzUH3xz1C8Tcg+LltXoEBbg3Tu1lRgi0Oq/FUvxo285FsAXSZJogyNTajTaSu2wXk0vCREpKj1l96Yn2rnt+y4UofTIChQWBdn/4Iz6NeIatsn5NraSmK1YXDjy9XazHWQX/Qr7MqDszQx7MLGLLzOgJPOrAM9PkdXgmKqqhNy705x3ipBp30ay5TiDmgU18ETXhx1n5MN0OPFo2y+KV/Td04HRI8FGlZYFt2cPxI9hnXHqGoG43UK/NE8d8zfX4oOSScmfGlgpaj3K/Lot8yk/bi75Rxu6NBegJ8jW58Eb0n9MOIX/593FFsyfMvMgx+Zz3m7Ld3RugPeH/ruzGmGPyGl/NWIj2l7MLo7xz5w7Pu5pfuH040WtDkp2gXtVpJjHLkAoZ7N7I8aA8k4qc8ZDHeYoG0ldGbBU1D0a5HdzQoMjnkq1wYkODa1lNrIyeK8M35PFjqxQqqbxReLu2n5oBxRz/5cN+7lLB14qmY6BPmQbY4V3/1ss3lZoY+8hjV6yB+8iFeCjWLedMfcybh73yHtJoy3sELtJGfqoHB98R2m/YjLGLc/S8by3FvVqvq3WOoBW8WFPVKn4mE9U3V8e+ETVQe3vQ7NJ3+P+hw1S26U5ft+28f+/zf2x29zH1NAZ1TAtLa1RyAkT1S5SNV97zJHN8iZxp1SJVlB7dQzyLwrdh4d9b2kCr87ub1+jCrj30mK9HVTEqW7n1V6wLsoWpty+KrwpQUVMEkikWhelP4ghfPHyfFsr0xJ6FoMwbM4afYmGIIFasao3OktTziAuhF/MeuoewSz+QJgjPRPsawYWgNP3/Bt22F4kuv5+w5E38f0mHM6wPZWaTzGdU9rdp3OKRzvTGFKzbMV2cOtpmRlMLNkt5vqTJq8U0Pi/Kk+y6tflZ8Yong06B4bpx3bsoQPlVz51l4mmdAHCTP8tZ+NYDF81Mvnjhkzc7aUzOyGxE5bbgGxt2ThXAHTGYepWz1H7nRcJ2aIBqqIilkngugfViXyqjVR0ccSu0R2wPQ6i086edL4if5ppiKcY+7krjlMWD6kjofC/NAO5vgxvpmj3ZIrFcOoubAOeQ95JbRYKJn/ctIOX3HrvU//YP8LWXJopp4vTZDYgfE4XCzyT989QugudOGv+GbqZUuNZtwGVoJH/cnaDBiYPpXrRZ63AlMmt/YH3tD/hNcvSls/0ozsK7HwUsAspMgM536OLcdD52B8XH6L2eDJMyb1Ff+9lU9p8rJysni1ZaPTrfIny/lSWzcf15I+bE/KRKkYvz937NYW8KtN0eB76iabOP34mQ2ABuLXvioz9E1YVinFLd1GN3c4xQ5XbD+tdFca8ncqyzeByoae+YK0pzUMWICpmiRQbCpRMiZ2418rCrfX4S8vt6D3X1tcMFNtdffZC5+cojrq2gYqBxlxGj+PCymcJFQe5W7oNn2tijtvac60+v/lW6vvPMiVVxS5hMyacbBMhruU/69EC/0A6SkcdjPPwJEBNc/NS2kwbUB7qid0MJHZ9oob8+sb5eXnDt81kun74z0KnW5u4TGtk5nm3w8lE95DLiPJndhKDdlaNvYEklYqqtXtk3pUbWuO6TUu5XDCBneIzNbKp8kEGzlgcYG2zB8UrsaeRTBLWnmcbzNq7OfpY+RLAGDh0tFgfbjvCOXK73wddzMeFdnl5U7qW2wNYMjIwJjQoo09IlsbUgH/U0HGyF1I30DHA7iNgfzN2UHi53Qmt0kuvNuPDHPlRk9tTrI9u/Tv3QK61wOHUA5+XjJaVx0isdfY7K7rtdn/11rowXHuwYOpRDckKJiKZ2Hjx1b0b/HXBE0Xncxa1+OnlunBkV5RpIxNQhUMUfmxZF/Kll5P8z+iFWBNfOsyg+DpdHjvvzJUgmSHZIjOzkMiWBz/698MX6xqNsZjrVc/00T+a1XRStmLUwKHjcGkwk+Pm2MfkOIM6Ljo3xz7o0DMcF1zjxTcU8TaM3DeK7enRDJl18RBwCTWcHjS+CeOc+W6zm8no41mMRQMm62KYY8NAKQinYpFZWb26vLx5nfslfSnr4ZqMRdlG76UnPT0dmHFJCku6Jw29rPYAFAxl1AP+nhZ9LBlUjX5PGfS0+2PRUN0aetLQb3d4gYrUM9wczfJWItIdhYDHsz7HzjAB/Uz5lFKCWkZRljKX9JsxQdUaUyjBfU2ojUuaZw0uw6Y2HimUyK0feg174NWSby9NSOyEZM449Mu6l+DXjw1Gh3/QcUHpx/rUVbeNmuMKlQrlecO1X7HA96hFiHiLSo0QEW91bcvUzLiMHgd7jLOdnAoZ9Ux+ceHNIdl+9FAqGIlnUx/oT8coj9mz4CVkiv1zJxHl3Nk4H4AWpwD+m9sJVbJxxfAAui7PiR1QE84egXy5v364uidSkfurs8ur+5MhgYNYMAEDPx14RaNl5XBXZcLz3s134iirH+KWDnDxIr2J2gmgSOfUbynT0un2kOukfnStilProEHhGbyC99iQ3G0YkUxSatiMcWbWG863N8rKk7rgckb5NJ7lGwvE0/yUtNeeuoX067Lx+gdOSy69MajfiW09Ly0AFoXzqWKJ3WiL67Xtpzb+6WK0LtXv78gda7ZcAmwO6sh8KRRGQSztLubC1QBHlTni3IwaQw4ivexxYIXNUJSHq9E7kc7pwt23zOGIRQhpN+nDjg6lp9oPfjoinb545DD6KqfI+1A3Tei34Sgsl3pVSSo/iFgH72yxNenN4/HgLtQy+vuRysTApDLxEkid0egR7/JOoyUVC5i6Lg36NFLglqvqirIPrfjMpyZuat8gQhOcOvSfnbMV+HpP9zI21kJs25k6ycJn6gf1WCOTVfu3dZFVKebYnYAnJmL5dOrmGTTOmc9BgVWestb5hlsFFW7+/O1RT2/9812p4F25v0O1KdydpGYTTOuF64RyHp7M2ETyHBs3uB7Jrq9hmKijaM/VRfjCIRo9ZulUgbH+vRRT3xlxyG3/oaUThJs3r9HITzDD++06S1OpHJNSyYR5w8QbdCIV4OIgc6AmU4DeYvWAtFDaH3WYKCdwoyJUWKMFTfVSmmfjReTbtuKrVpwH8gIuZ2doS8iCxfYsBmxI3osBEY2WMF0yM0VX9HSW2dU3IO3Vq1jNpkG+x4u/B+Wmd6h2A+yacU01DLl8+4G+RwgazCbcPmbMUlynPeqJ+0ddubGp3NDCcnQfe5VfS+wofo711Mip9zhSF2Pqr3y6Z1V0zxTqogSwh+t4fzkpx8M5/UYSaZagiMD3OLz12LrRZWmoaJu6isGpu9L4XPbBLn93j3MtM5dfcoWM5R1hx3yGl6yvKeUwNyMRpyChDAP+0iUOTGNidV5LEWICVGfuFc56fV5ut99PY8r4OsjnhzrWPldr64PV7tniZ7kwxrx1O3l/2KXbWRY9gjnV7K/nKsHE2D3XV+fUuvyEx9aK23lLUzmfytm/ITLDr63StTQ3Qws2t4o4z0WN1xo7tM/vCYfqnR+mpHHhyYuXrGdhQ3Q3vEcUFr6mlG+/rqGLRA/I5W4n773sToiCBVUxB38RdZ127MM59sWgHkMN8z+uHmq4rXIF3WOijYYteNNsRLx3nwfHu+EIdhDIl1c3Vw9XQ6NedlVQDIL596uzy530eZsuSD2mMnya1LVhL5QbqjkOxVkgmVzdXF08kE8odLz7bQ3dwFrhKJnqiApx5Ms39Xq6sMl6LO7sZGd2HEK9ApOpl0J+AHMM+jkbc7VVo0s7l++3gNCR4s3eUyyfBJc0fh7JOLEUGHCx7bZlPy1BQfUhWVf6jGfOMxl33EfP0ucmNyAIb+ai21V6r8xiP+lvOcG1Bv/lW72T0YDq9su3b9VnZF1/CtcYdBe5uRVHixaxwDC0fkukIj9vJOzXMQn79du36vuyxyAs1JvNmdJmapWjx2nM4VVnKag3Qecw9ZNnRMLbzYVKYuvlcvezNhYY6bItlUWJrXuwpmgGueHdzA905EN0c1SWAKepdhU3HaxBWeFCLtgR3t6k4RMdusRvWrt5PCgO6+2lxTF7e01u23t7PWPn27sMu19O2F9DtIW3ahC6WiSgNV2AJmnmG2x295WbfJxM3AMV99QMBUT5vjylpy8mHycBF4ndawmsfgm1jOsWDd2n+UdPy11OyrAN+5q8sivA3fH2a+B2QoxMWbQD2ltpsNwKC1z8oxDjQS7Yy9eBqWG1tFPgDp1mdugZ9moXMZ479SXtA97dHYsuNAAl7P6msJGByL5oGTeWM5+yofuWViHXXtNdB1bjT8kcUZBUchbtpPpdNLy5FivKWXxmjGKzbKin2wahqvKGcBjnR0JzqJjBZ44A8sb1fftG7b59Uvlt/gvyfyefbl3j9UgqBZFxpYwJNRtb6W/l4q30tuW74aN7IkLIEjt70n8PsWIrEA/ykn8dlVqEisdvifTORsszO3uZnQfpyRifCmz3LH60nuSedEw+Tj5KYZYP8pIamKQgzOfJ5SCgoyVVC/fYgWN3tR8l1o5aLzbvZuiL0SPKQcQUr8qapb/843rWlXbptiOArwe6fF+P6vL9cWA7V9+VzPNjShe9jrAHuF6Tpkp+Ywk2GS/e73GwiJDijUs3x7lj5c94W1SycGK9cGPgdD1c8VXHIioDKioJ/NxYxtRsVKWAoi6yJIGYUQO8IyWS0yKkma6YZk3vdJhQu2oT3AZG5pwtlh05jRzZUVDV2WcUgxXlRfC3oz5YVRoXadDXXshCvDoutDy3OltbA8nzbkG+u4P3FYi7/bIFsm42cB5a5nEcNqMNPIQkNevQ/GKcVqE19pzdXQf24ctWzK1wx11CAwEdhWkgCnN79AP9RvS8G4/dR8Nei5n8MfE2szJu5d4XG+S5oepQez855If57p4dOsq7PTXmdPuK4a2b8d64yQ3vzpjyRyqO9DRFX2DDs6vyhMN+qPJnUs45jR6Xko/1zET+XkoRLa5JYhepda/ILExPlGz0aN4A+1be4/ePCDrsFAie0Drg/BhMH1r4hiPsbei0TACjixdr2S4o52M80eOvkkKMe3y1IZ7deV1dGaYdaRQhgE6M4QGAMXBi2JtjzcWU38Csg/T1muFrLj6ZM1GYpJglILR7tVlrGTHc2vDgrFCepqquUnGQoq5Ssbea/vPu9uXvwQ+ZEMAnZrhzh9KDAEAMDn+Kt/XsByyybNEn5C1hIsaLp5pcfvpyi3Hoz6U/fr5zvzr/x53/SfnTq8nD2fnN9eT3q0v85VvCdNF+jHLuy64RzIYEnSP/khq6ZXPdnf6a/1F+p8dqhOfIDoi27ap9ITWeQyrD+X8BAAD//8xXL/c=" } diff --git a/x-pack/metricbeat/modules.d/aws.yml.disabled b/x-pack/metricbeat/modules.d/aws.yml.disabled index 8ddb3333f70..d0053297885 100644 --- a/x-pack/metricbeat/modules.d/aws.yml.disabled +++ b/x-pack/metricbeat/modules.d/aws.yml.disabled @@ -33,11 +33,16 @@ - sns - sqs - module: aws - period: 12h + period: 24h metricsets: - billing - regions: - - us-east-1 + cost_explorer_config: + group_by_dimension_keys: + - "AZ" + - "INSTANCE_TYPE" + - "SERVICE" +# group_by_tag_keys: +# - "aws:createdBy" - module: aws period: 24h metricsets: From c9f7a99e1736853955c07230c78649867d4e8c40 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Mon, 14 Sep 2020 20:40:30 -0500 Subject: [PATCH 002/216] [Filebeat] Add support for Cloudtrail digest files (#21086) * Add support for Cloudtrail digest files - allow file matching with file_selectors in s3 input - update cloudtrail pipeline - update cloudtrail config to use file_selectors - add cloudtrail digest fields - add cloudtrail insight fields Closes #20943 --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 114 ++++++++++++++++ .../docs/inputs/input-aws-s3.asciidoc | 25 ++++ x-pack/filebeat/filebeat.reference.yml | 12 ++ x-pack/filebeat/input/s3/config.go | 16 +++ x-pack/filebeat/input/s3/input.go | 70 ++++++---- x-pack/filebeat/input/s3/input_test.go | 5 +- x-pack/filebeat/module/aws/_meta/config.yml | 12 ++ .../module/aws/cloudtrail/_meta/fields.yml | 67 ++++++++++ .../module/aws/cloudtrail/config/s3.yml | 15 ++- .../module/aws/cloudtrail/ingest/pipeline.yml | 97 +++++++++++++- .../module/aws/cloudtrail/manifest.yml | 6 + .../test/cloudtrail-digest-json.log | 1 + .../cloudtrail-digest-json.log-expected.json | 126 ++++++++++++++++++ .../aws/cloudtrail/test/insight-json.log | 1 + .../test/insight-json.log-expected.json | 64 +++++++++ x-pack/filebeat/module/aws/fields.go | 2 +- x-pack/filebeat/modules.d/aws.yml.disabled | 12 ++ 18 files changed, 610 insertions(+), 36 deletions(-) create mode 100644 x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log create mode 100644 x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log-expected.json create mode 100644 x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log create mode 100644 x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log-expected.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 062fae87a46..a45c3b13b84 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -263,6 +263,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Provide backwards compatibility for the `set` processor when Elasticsearch is less than 7.9.0. {pull}20908[20908] - Remove wrongly mapped `tls.client.server_name` from `fortinet/firewall` fileset. {pull}20983[20983] - Fix an error updating file size being logged when EOF is reached. {pull}21048[21048] +- Fix error when processing AWS Cloudtrail Digest logs. {pull}21086[21086] {issue}20943[20943] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index e9bd3feb16f..8ec5edb4c9d 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -1488,6 +1488,120 @@ type: flattened -- +[float] +=== digest + +Fields from Cloudtrail Digest Logs + + +*`aws.cloudtrail.digest.log_files`*:: ++ +-- +A list of Logfiles contained in the digest. + +type: nested + +-- + +*`aws.cloudtrail.digest.start_time`*:: ++ +-- +The starting UTC time range that the digest file covers, taking as a reference the time in which log files have been delivered by CloudTrail. + +type: date + +-- + +*`aws.cloudtrail.digest.end_time`*:: ++ +-- +The ending UTC time range that the digest file covers, taking as a reference the time in which log files have been delivered by CloudTrail. + +type: date + +-- + +*`aws.cloudtrail.digest.s3_bucket`*:: ++ +-- +The name of the Amazon S3 bucket to which the current digest file has been delivered. + +type: keyword + +-- + +*`aws.cloudtrail.digest.s3_object`*:: ++ +-- +The Amazon S3 object key (that is, the Amazon S3 bucket location) of the current digest file. + +type: keyword + +-- + +*`aws.cloudtrail.digest.newest_event_time`*:: ++ +-- +The UTC time of the most recent event among all of the events in the log files in the digest. + +type: date + +-- + +*`aws.cloudtrail.digest.oldest_event_time`*:: ++ +-- +The UTC time of the oldest event among all of the events in the log files in the digest. + +type: date + +-- + +*`aws.cloudtrail.digest.previous_s3_bucket`*:: ++ +-- +The Amazon S3 bucket to which the previous digest file was delivered. + +type: keyword + +-- + +*`aws.cloudtrail.digest.previous_hash_algorithm`*:: ++ +-- +The name of the hash algorithm that was used to hash the previous digest file. + +type: keyword + +-- + +*`aws.cloudtrail.digest.public_key_fingerprint`*:: ++ +-- +The hexadecimal encoded fingerprint of the public key that matches the private key used to sign this digest file. + +type: keyword + +-- + +*`aws.cloudtrail.digest.signature_algorithm`*:: ++ +-- +The algorithm used to sign the digest file. + +type: keyword + +-- + +*`aws.cloudtrail.insight_details`*:: ++ +-- +Shows information about the underlying triggers of an Insights event, such as event source, user agent, statistics, API name, and whether the event is the start or end of the Insights event. + +type: flattened + +-- + [float] === cloudwatch diff --git a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc index 1024656f082..8891e38fcc4 100644 --- a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc @@ -67,6 +67,31 @@ type will not be checked. If a file has "application/json" content-type, `expand_event_list_from_field` becomes required to read the json file. +[float] +==== `file_selectors` + +If the SQS queue will have events that correspond to files that +{beatname_uc} shouldn't process `file_selectors` can be used to limit +the files that are downloaded. This is a list of selectors which are +made up of `regex` and `expand_event_list_from_field` options. The +`regex` should match the S3 object key in the SQS message, and the +optional `expand_event_list_from_field` is the same as the global +setting. If `file_selectors` is given, then any global +`expand_event_list_from_field` value is ignored in favor of the ones +specified in the `file_selectors`. Regex syntax is the same as the Go +language. Files that don't match one of the regexes won't be +processed. + +["source", "yml"] +---- +file_selectors: + - regex: '^AWSLogs/\d+/CloudTrail/' + expand_event_list_from_field: 'Records' + - regex: '^AWSLogs/\d+/CloudTrail-Digest' +``` +---- + + [float] ==== `api_timeout` diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 4d3b8645a8d..ab22da1f2b6 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -102,6 +102,18 @@ filebeat.modules: # AWS SQS queue url #var.queue_url: https://sqs.myregion.amazonaws.com/123456/myqueue + # Process CloudTrail logs + # default is true, set to false to skip Cloudtrail logs + # var.process_cloudtrail_logs: false + + # Process CloudTrail Digest logs + # default true, set to false to skip CloudTrail Digest logs + # var.process_digest_logs: false + + # Process CloudTrail Insight logs + # default true, set to false to skip CloudTrail Insight logs + # var.process_insight_logs: false + # Filename of AWS credential file # If not set "$HOME/.aws/credentials" is used on Linux/Mac # "%UserProfile%\.aws\credentials" is used on Windows diff --git a/x-pack/filebeat/input/s3/config.go b/x-pack/filebeat/input/s3/config.go index 72960ad9ade..f9780d82277 100644 --- a/x-pack/filebeat/input/s3/config.go +++ b/x-pack/filebeat/input/s3/config.go @@ -6,6 +6,7 @@ package s3 import ( "fmt" + "regexp" "time" "github.com/elastic/beats/v7/filebeat/harvester" @@ -19,6 +20,14 @@ type config struct { AwsConfig awscommon.ConfigAWS `config:",inline"` ExpandEventListFromField string `config:"expand_event_list_from_field"` APITimeout time.Duration `config:"api_timeout"` + FileSelectors []FileSelectorCfg `config:"file_selectors"` +} + +// FileSelectorCfg defines type and configuration of FileSelectors +type FileSelectorCfg struct { + RegexString string `config:"regex"` + Regex *regexp.Regexp `config:",ignore"` + ExpandEventListFromField string `config:"expand_event_list_from_field"` } func defaultConfig() config { @@ -40,5 +49,12 @@ func (c *config) Validate() error { return fmt.Errorf("api timeout %v needs to be larger than"+ " 0s and smaller than half of the visibility timeout", c.APITimeout) } + for i := range c.FileSelectors { + r, err := regexp.Compile(c.FileSelectors[i].RegexString) + if err != nil { + return err + } + c.FileSelectors[i].Regex = r + } return nil } diff --git a/x-pack/filebeat/input/s3/input.go b/x-pack/filebeat/input/s3/input.go index 65984dace45..1085c9dccbd 100644 --- a/x-pack/filebeat/input/s3/input.go +++ b/x-pack/filebeat/input/s3/input.go @@ -74,10 +74,11 @@ type s3Input struct { } type s3Info struct { - name string - key string - region string - arn string + name string + key string + region string + arn string + expandEventListFromField string } type bucket struct { @@ -252,7 +253,7 @@ func (p *s3Input) processor(queueURL string, messages []sqs.Message, visibilityT func (p *s3Input) processMessage(svcS3 s3iface.ClientAPI, message sqs.Message, wg *sync.WaitGroup, errC chan error) { defer wg.Done() - s3Infos, err := handleSQSMessage(message) + s3Infos, err := p.handleSQSMessage(message) if err != nil { p.logger.Error(errors.Wrap(err, "handleSQSMessage failed")) return @@ -352,7 +353,7 @@ func getRegionFromQueueURL(queueURL string) (string, error) { } // handle message -func handleSQSMessage(m sqs.Message) ([]s3Info, error) { +func (p *s3Input) handleSQSMessage(m sqs.Message) ([]s3Info, error) { msg := sqsMessage{} err := json.Unmarshal([]byte(*m.Body), &msg) if err != nil { @@ -361,21 +362,40 @@ func handleSQSMessage(m sqs.Message) ([]s3Info, error) { var s3Infos []s3Info for _, record := range msg.Records { - if record.EventSource == "aws:s3" && strings.HasPrefix(record.EventName, "ObjectCreated:") { - // Unescape substrings from s3 log name. For example, convert "%3D" back to "=" - filename, err := url.QueryUnescape(record.S3.object.Key) - if err != nil { - return nil, errors.Wrapf(err, "url.QueryUnescape failed for '%s'", record.S3.object.Key) - } + if record.EventSource != "aws:s3" || !strings.HasPrefix(record.EventName, "ObjectCreated:") { + return nil, errors.New("this SQS queue should be dedicated to s3 ObjectCreated event notifications") + } + // Unescape substrings from s3 log name. For example, convert "%3D" back to "=" + filename, err := url.QueryUnescape(record.S3.object.Key) + if err != nil { + return nil, errors.Wrapf(err, "url.QueryUnescape failed for '%s'", record.S3.object.Key) + } + if len(p.config.FileSelectors) == 0 { s3Infos = append(s3Infos, s3Info{ - region: record.AwsRegion, - name: record.S3.bucket.Name, - key: filename, - arn: record.S3.bucket.Arn, + region: record.AwsRegion, + name: record.S3.bucket.Name, + key: filename, + arn: record.S3.bucket.Arn, + expandEventListFromField: p.config.ExpandEventListFromField, }) - } else { - return nil, errors.New("this SQS queue should be dedicated to s3 ObjectCreated event notifications") + continue + } + + for _, fs := range p.config.FileSelectors { + if fs.Regex == nil { + continue + } + if fs.Regex.MatchString(filename) { + s3Infos = append(s3Infos, s3Info{ + region: record.AwsRegion, + name: record.S3.bucket.Name, + key: filename, + arn: record.S3.bucket.Arn, + expandEventListFromField: fs.ExpandEventListFromField, + }) + break + } } } return s3Infos, nil @@ -456,7 +476,7 @@ func (p *s3Input) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, s3C } // Decode JSON documents when content-type is "application/json" or expand_event_list_from_field is given in config - if resp.ContentType != nil && *resp.ContentType == "application/json" || p.config.ExpandEventListFromField != "" { + if resp.ContentType != nil && *resp.ContentType == "application/json" || info.expandEventListFromField != "" { decoder := json.NewDecoder(reader) err := p.decodeJSON(decoder, objectHash, info, s3Ctx) if err != nil { @@ -537,10 +557,10 @@ func (p *s3Input) decodeJSON(decoder *json.Decoder, objectHash string, s3Info s3 func (p *s3Input) jsonFieldsType(jsonFields interface{}, offset int, objectHash string, s3Info s3Info, s3Ctx *s3Context) (int, error) { switch f := jsonFields.(type) { case map[string][]interface{}: - if p.config.ExpandEventListFromField != "" { - textValues, ok := f[p.config.ExpandEventListFromField] + if s3Info.expandEventListFromField != "" { + textValues, ok := f[s3Info.expandEventListFromField] if !ok { - err := errors.Errorf("key '%s' not found", p.config.ExpandEventListFromField) + err := errors.Errorf("key '%s' not found", s3Info.expandEventListFromField) p.logger.Error(err) return offset, err } @@ -555,10 +575,10 @@ func (p *s3Input) jsonFieldsType(jsonFields interface{}, offset int, objectHash return offset, nil } case map[string]interface{}: - if p.config.ExpandEventListFromField != "" { - textValues, ok := f[p.config.ExpandEventListFromField] + if s3Info.expandEventListFromField != "" { + textValues, ok := f[s3Info.expandEventListFromField] if !ok { - err := errors.Errorf("key '%s' not found", p.config.ExpandEventListFromField) + err := errors.Errorf("key '%s' not found", s3Info.expandEventListFromField) p.logger.Error(err) return offset, err } diff --git a/x-pack/filebeat/input/s3/input_test.go b/x-pack/filebeat/input/s3/input_test.go index c9ff86780de..d1fab05cb3c 100644 --- a/x-pack/filebeat/input/s3/input_test.go +++ b/x-pack/filebeat/input/s3/input_test.go @@ -120,9 +120,10 @@ func TestHandleMessage(t *testing.T) { }, } + p := &s3Input{context: &channelContext{}} for _, c := range casesPositive { t.Run(c.title, func(t *testing.T) { - s3Info, err := handleSQSMessage(c.message) + s3Info, err := p.handleSQSMessage(c.message) assert.NoError(t, err) assert.Equal(t, len(c.expectedS3Infos), len(s3Info)) if len(s3Info) > 0 { @@ -155,7 +156,7 @@ func TestHandleMessage(t *testing.T) { for _, c := range casesNegative { t.Run(c.title, func(t *testing.T) { - s3Info, err := handleSQSMessage(c.message) + s3Info, err := p.handleSQSMessage(c.message) assert.Error(t, err) assert.Nil(t, s3Info) }) diff --git a/x-pack/filebeat/module/aws/_meta/config.yml b/x-pack/filebeat/module/aws/_meta/config.yml index 7c9c9f0e7b0..b7e0c25b674 100644 --- a/x-pack/filebeat/module/aws/_meta/config.yml +++ b/x-pack/filebeat/module/aws/_meta/config.yml @@ -5,6 +5,18 @@ # AWS SQS queue url #var.queue_url: https://sqs.myregion.amazonaws.com/123456/myqueue + # Process CloudTrail logs + # default is true, set to false to skip Cloudtrail logs + # var.process_cloudtrail_logs: false + + # Process CloudTrail Digest logs + # default true, set to false to skip CloudTrail Digest logs + # var.process_digest_logs: false + + # Process CloudTrail Insight logs + # default true, set to false to skip CloudTrail Insight logs + # var.process_insight_logs: false + # Filename of AWS credential file # If not set "$HOME/.aws/credentials" is used on Linux/Mac # "%UserProfile%\.aws\credentials" is used on Windows diff --git a/x-pack/filebeat/module/aws/cloudtrail/_meta/fields.yml b/x-pack/filebeat/module/aws/cloudtrail/_meta/fields.yml index d4bd04b548b..155908315e9 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/_meta/fields.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/_meta/fields.yml @@ -223,3 +223,70 @@ description: >- Identifies the service event, including what triggered the event and the result. + - name: digest + type: group + description: >- + Fields from Cloudtrail Digest Logs + fields: + - name: log_files + type: nested + description: >- + A list of Logfiles contained in the digest. + - name: start_time + type: date + description: >- + The starting UTC time range that the digest file covers, + taking as a reference the time in which log files have + been delivered by CloudTrail. + - name: end_time + type: date + description: >- + The ending UTC time range that the digest file covers, + taking as a reference the time in which log files have + been delivered by CloudTrail. + - name: s3_bucket + type: keyword + description: >- + The name of the Amazon S3 bucket to which the current + digest file has been delivered. + - name: s3_object + type: keyword + description: >- + The Amazon S3 object key (that is, the Amazon S3 bucket + location) of the current digest file. + - name: newest_event_time + type: date + description: >- + The UTC time of the most recent event among all of the + events in the log files in the digest. + - name: oldest_event_time + type: date + description: >- + The UTC time of the oldest event among all of the events + in the log files in the digest. + - name: previous_s3_bucket + type: keyword + description: >- + The Amazon S3 bucket to which the previous digest file was + delivered. + - name: previous_hash_algorithm + type: keyword + description: >- + The name of the hash algorithm that was used to hash the + previous digest file. + - name: public_key_fingerprint + type: keyword + description: >- + The hexadecimal encoded fingerprint of the public key that + matches the private key used to sign this digest file. + - name: signature_algorithm + type: keyword + description: >- + The algorithm used to sign the digest file. + - name: insight_details + type: flattened + description: >- + Shows information about the underlying triggers of an Insights + event, such as event source, user agent, statistics, API name, + and whether the event is the start or end of the Insights + event. diff --git a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml index 2a6f38d1fad..2094f77c712 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml @@ -1,6 +1,19 @@ type: s3 queue_url: {{ .queue_url }} -expand_event_list_from_field: Records +file_selectors: +{{ if .process_cloudtrail_logs }} + - regex: '^AWSLogs/\d+/CloudTrail/' + expand_event_list_from_field: 'Records' +{{ end }} + +{{ if .process_digest_logs }} + - regex: '^AWSLogs/\d+/CloudTrail-Digest/' +{{ end }} + +{{ if .process_insight_logs }} + - regex: '^AWSLogs/\d+/CloudTrail-Insight/' + expand_event_list_from_field: 'Records' +{{ end }} {{ if .credential_profile_name }} credential_profile_name: {{ .credential_profile_name }} diff --git a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml index e22c986be6f..8421e12d7f0 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml @@ -4,6 +4,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' + - set: + field: event.created + value: '{{@timestamp}}' - rename: field: "message" target_field: "event.original" @@ -58,7 +61,7 @@ processors: field: "json.userIdentity.sessionContext.sessionIssuer.type" target_field: "aws.cloudtrail.user_identity.session_context.session_issuer.type" ignore_failure: true -# userIdentity.sessionIssuer.userName is only set with assumed roles. + # userIdentity.sessionIssuer.userName is only set with assumed roles. - rename: field: "json.userIdentity.sessionContext.sessionIssuer.userName" target_field: "user.name" @@ -88,6 +91,11 @@ processors: value: "{{json.eventName}}" ignore_failure: true ignore_empty_value: true + - set: + field: "event.action" + value: "{{json.eventCategory}}" + ignore_failure: true + ignore_empty_value: true - rename: field: "json.awsRegion" target_field: "cloud.region" @@ -119,9 +127,9 @@ processors: target_field: source.as.number ignore_missing: true - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true - user_agent: field: "json.userAgent" target_field: "user_agent" @@ -141,7 +149,7 @@ processors: - rename: field: json.requestParameters target_field: "aws.cloudtrail.flattened.request_parameters" - if: ctx.json.requestParameters != null + if: ctx?.json?.requestParameters != null - script: lang: painless source: | @@ -152,7 +160,7 @@ processors: - rename: field: json.responseElements target_field: "aws.cloudtrail.flattened.response_elements" - if: ctx.json.responseElements != null + if: ctx?.json?.responseElements != null - script: lang: painless source: | @@ -214,7 +222,7 @@ processors: - rename: field: json.serviceEventDetails target_field: "aws.cloudtrail.flattened.service_event_details" - if: ctx.json.serviceEventDetails != null + if: ctx?.json?.serviceEventDetails != null - script: lang: painless source: | @@ -615,6 +623,81 @@ processors: def hm = new HashMap(params.get(ctx.event.action)); hm.forEach((k, v) -> ctx.event[k] = v); + - rename: + field: "json.awsAccountId" + target_field: "cloud.account.id" + ignore_failure: true + - rename: + field: "json.previousDigestS3Object" + target_field: "file.path" + ignore_failure: true + - rename: + field: "json.previousDigestSignature" + target_field: "file.hash.sha256" + if: >- + ctx?.json?.previousDigestHashAlgorithm != null && ctx.json.previousDigestHashAlgorithm == 'SHA-256' + - append: + field: "related.hash" + value: "{{json.previousDigestSignature}}" + if: "ctx?.json?.previousDigestSignature != null" + - rename: + field: "json.logFiles" + target_field: "aws.cloudtrail.digest.log_files" + ignore_failure: true + - date: + field: "json.digestStartTime" + target_field: "aws.cloudtrail.digest.start_time" + ignore_failure: true + formats: + - ISO8601 + - date: + field: "json.digestEndTime" + target_field: "@timestamp" + ignore_failure: true + formats: + - ISO8601 + - date: + field: "json.digestEndTime" + target_field: "aws.cloudtrail.digest.end_time" + ignore_failure: true + formats: + - ISO8601 + - rename: + field: "json.digestS3Bucket" + target_field: "aws.cloudtrail.digest.s3_bucket" + ignore_failure: true + - date: + field: "json.newestEventTime" + target_field: "aws.cloudtrail.digest.newest_event_time" + ignore_failure: true + formats: + - ISO8601 + - date: + field: "json.oldestEventTime" + target_field: "aws.cloudtrail.digest.oldest_event_time" + ignore_failure: true + formats: + - ISO8601 + - rename: + field: "json.previousDigestS3Bucket" + target_field: "aws.cloudtrail.digest.previous_s3_bucket" + ignore_failure: true + - rename: + field: "json.previousDigestHashAlgorithm" + target_field: "aws.cloudtrail.digest.previous_hash_algorithm" + ignore_failure: true + - rename: + field: "json.publicKeyFingerprint" + target_field: "aws.cloudtrail.digest.public_key_fingerprint" + ignore_failure: true + - rename: + field: "json.digestSignatureAlgorithm" + target_field: "aws.cloudtrail.digest.signature_algorithm" + ignore_failure: true + - rename: + field: "json.insightDetails" + target_field: "aws.cloudtrail.insight_details" + ignore_failure: true - remove: field: - "json" diff --git a/x-pack/filebeat/module/aws/cloudtrail/manifest.yml b/x-pack/filebeat/module/aws/cloudtrail/manifest.yml index 2878c79936d..732967ff0b0 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/manifest.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/manifest.yml @@ -15,6 +15,12 @@ var: - name: role_arn - name: tags default: [forwarded] + - name: process_cloudtrail_logs + default: true + - name: process_digest_logs + default: true + - name: process_insight_logs + default: true ingest_pipeline: ingest/pipeline.yml input: config/{{.input}}.yml diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log b/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log new file mode 100644 index 00000000000..f3393babceb --- /dev/null +++ b/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log @@ -0,0 +1 @@ +{"awsAccountId":"123456789123","digestStartTime":"2020-09-11T18:36:49Z","digestEndTime":"2020-09-11T19:36:49Z","digestS3Bucket":"alice-bucket","digestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz","digestPublicKeyFingerprint":"47aaa19f7eec22e9bd0b5e58cfade8cb","digestSignatureAlgorithm":"SHA256withRSA","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T18:32:04Z","previousDigestS3Bucket":"alice-bucket","previousDigestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz","previousDigestHashValue":"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860","previousDigestHashAlgorithm":"SHA-256","previousDigestSignature":"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987","logFiles":[{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz","hashValue":"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T19:26:24Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz","hashValue":"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:11:18Z","oldestEventTime":"2020-09-11T19:11:18Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz","hashValue":"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:32:04Z","oldestEventTime":"2020-09-11T18:32:04Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz","hashValue":"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:21:28Z","oldestEventTime":"2020-09-11T19:21:28Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz","hashValue":"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:51:21Z","oldestEventTime":"2020-09-11T18:51:21Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz","hashValue":"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:46:45Z","oldestEventTime":"2020-09-11T18:46:45Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz","hashValue":"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:01:06Z","oldestEventTime":"2020-09-11T19:01:06Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz","hashValue":"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:16:12Z","oldestEventTime":"2020-09-11T19:16:12Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz","hashValue":"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:56:05Z","oldestEventTime":"2020-09-11T18:56:05Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz","hashValue":"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:06:31Z","oldestEventTime":"2020-09-11T19:06:31Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz","hashValue":"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:41:58Z","oldestEventTime":"2020-09-11T18:41:58Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz","hashValue":"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:37:10Z","oldestEventTime":"2020-09-11T18:37:10Z"}]} diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log-expected.json b/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log-expected.json new file mode 100644 index 00000000000..e4cf4e32a06 --- /dev/null +++ b/x-pack/filebeat/module/aws/cloudtrail/test/cloudtrail-digest-json.log-expected.json @@ -0,0 +1,126 @@ +[ + { + "@timestamp": "2020-09-11T19:36:49.000Z", + "aws.cloudtrail.digest.end_time": "2020-09-11T19:36:49.000Z", + "aws.cloudtrail.digest.log_files": [ + { + "hashAlgorithm": "SHA-256", + "hashValue": "420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c", + "newestEventTime": "2020-09-11T19:26:24Z", + "oldestEventTime": "2020-09-11T19:26:24Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196", + "newestEventTime": "2020-09-11T19:11:18Z", + "oldestEventTime": "2020-09-11T19:11:18Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70", + "newestEventTime": "2020-09-11T18:32:04Z", + "oldestEventTime": "2020-09-11T18:32:04Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689", + "newestEventTime": "2020-09-11T19:21:28Z", + "oldestEventTime": "2020-09-11T19:21:28Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097", + "newestEventTime": "2020-09-11T18:51:21Z", + "oldestEventTime": "2020-09-11T18:51:21Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b", + "newestEventTime": "2020-09-11T18:46:45Z", + "oldestEventTime": "2020-09-11T18:46:45Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5", + "newestEventTime": "2020-09-11T19:01:06Z", + "oldestEventTime": "2020-09-11T19:01:06Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7", + "newestEventTime": "2020-09-11T19:16:12Z", + "oldestEventTime": "2020-09-11T19:16:12Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba", + "newestEventTime": "2020-09-11T18:56:05Z", + "oldestEventTime": "2020-09-11T18:56:05Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7", + "newestEventTime": "2020-09-11T19:06:31Z", + "oldestEventTime": "2020-09-11T19:06:31Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6", + "newestEventTime": "2020-09-11T18:41:58Z", + "oldestEventTime": "2020-09-11T18:41:58Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771", + "newestEventTime": "2020-09-11T18:37:10Z", + "oldestEventTime": "2020-09-11T18:37:10Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz" + } + ], + "aws.cloudtrail.digest.newest_event_time": "2020-09-11T19:26:24.000Z", + "aws.cloudtrail.digest.oldest_event_time": "2020-09-11T18:32:04.000Z", + "aws.cloudtrail.digest.previous_hash_algorithm": "SHA-256", + "aws.cloudtrail.digest.previous_s3_bucket": "alice-bucket", + "aws.cloudtrail.digest.s3_bucket": "alice-bucket", + "aws.cloudtrail.digest.signature_algorithm": "SHA256withRSA", + "aws.cloudtrail.digest.start_time": "2020-09-11T18:36:49.000Z", + "cloud.account.id": "123456789123", + "event.dataset": "aws.cloudtrail", + "event.kind": "event", + "event.module": "aws", + "event.original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz\",\"hashValue\":\"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:21:28Z\",\"oldestEventTime\":\"2020-09-11T19:21:28Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz\",\"hashValue\":\"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:51:21Z\",\"oldestEventTime\":\"2020-09-11T18:51:21Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz\",\"hashValue\":\"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:46:45Z\",\"oldestEventTime\":\"2020-09-11T18:46:45Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz\",\"hashValue\":\"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:01:06Z\",\"oldestEventTime\":\"2020-09-11T19:01:06Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz\",\"hashValue\":\"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:16:12Z\",\"oldestEventTime\":\"2020-09-11T19:16:12Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz\",\"hashValue\":\"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:56:05Z\",\"oldestEventTime\":\"2020-09-11T18:56:05Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz\",\"hashValue\":\"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:06:31Z\",\"oldestEventTime\":\"2020-09-11T19:06:31Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz\",\"hashValue\":\"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:41:58Z\",\"oldestEventTime\":\"2020-09-11T18:41:58Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz\",\"hashValue\":\"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:37:10Z\",\"oldestEventTime\":\"2020-09-11T18:37:10Z\"}]}", + "event.type": "info", + "file.hash.sha256": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987", + "file.path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz", + "fileset.name": "cloudtrail", + "input.type": "log", + "log.offset": 0, + "service.type": "aws", + "tags": [ + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log b/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log new file mode 100644 index 00000000000..c5c536fe7a6 --- /dev/null +++ b/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log @@ -0,0 +1 @@ +{"eventVersion":"1.07","eventTime":"2020-09-09T23:00:00Z","awsRegion":"us-east-1","eventID":"41ed77ca-d659-b45a-8e9a-74e504300007","eventType":"AwsCloudTrailInsight","recipientAccountId":"123456789012","sharedEventID":"e672c2b1-e71a-4779-f96c-02da7bb30d2e","insightDetails":{"state":"End","eventSource":"iam.amazonaws.com","eventName":"AttachUserPolicy","insightType":"ApiCallRateInsight","insffightContext":{"statistics":{"baseline":{"average":0.0},"insight":{"average":2.0},"insightDuration":1,"baselineDuration":11459},"attributions":[{"attribute":"userIdentityArn","insight":[{"value":"arn:aws:iam::123456789012:user/Alice","average":2.0}],"baseline":[]},{"attribute":"userAgent","insight":[{"value":"console.amazonaws.com","average":2.0}],"baseline":[]},{"attribute":"errorCode","insight":[{"value":"null","average":2.0}],"baseline":[]}]}},"eventCategory":"Insight"} diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log-expected.json b/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log-expected.json new file mode 100644 index 00000000000..2bfe4bedd30 --- /dev/null +++ b/x-pack/filebeat/module/aws/cloudtrail/test/insight-json.log-expected.json @@ -0,0 +1,64 @@ +[ + { + "@timestamp": "2020-09-09T23:00:00.000Z", + "aws.cloudtrail.event_type": "AwsCloudTrailInsight", + "aws.cloudtrail.event_version": "1.07", + "aws.cloudtrail.insight_details.eventName": "AttachUserPolicy", + "aws.cloudtrail.insight_details.eventSource": "iam.amazonaws.com", + "aws.cloudtrail.insight_details.insffightContext.attributions": [ + { + "attribute": "userIdentityArn", + "baseline": [], + "insight": [ + { + "average": 2.0, + "value": "arn:aws:iam::123456789012:user/Alice" + } + ] + }, + { + "attribute": "userAgent", + "baseline": [], + "insight": [ + { + "average": 2.0, + "value": "console.amazonaws.com" + } + ] + }, + { + "attribute": "errorCode", + "baseline": [], + "insight": [ + { + "average": 2.0, + "value": "null" + } + ] + } + ], + "aws.cloudtrail.insight_details.insffightContext.statistics.baseline.average": 0.0, + "aws.cloudtrail.insight_details.insffightContext.statistics.baselineDuration": 11459, + "aws.cloudtrail.insight_details.insffightContext.statistics.insight.average": 2.0, + "aws.cloudtrail.insight_details.insffightContext.statistics.insightDuration": 1, + "aws.cloudtrail.insight_details.insightType": "ApiCallRateInsight", + "aws.cloudtrail.insight_details.state": "End", + "aws.cloudtrail.recipient_account_id": "123456789012", + "cloud.region": "us-east-1", + "event.action": "Insight", + "event.dataset": "aws.cloudtrail", + "event.id": "41ed77ca-d659-b45a-8e9a-74e504300007", + "event.kind": "event", + "event.module": "aws", + "event.original": "{\"eventVersion\":\"1.07\",\"eventTime\":\"2020-09-09T23:00:00Z\",\"awsRegion\":\"us-east-1\",\"eventID\":\"41ed77ca-d659-b45a-8e9a-74e504300007\",\"eventType\":\"AwsCloudTrailInsight\",\"recipientAccountId\":\"123456789012\",\"sharedEventID\":\"e672c2b1-e71a-4779-f96c-02da7bb30d2e\",\"insightDetails\":{\"state\":\"End\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"AttachUserPolicy\",\"insightType\":\"ApiCallRateInsight\",\"insffightContext\":{\"statistics\":{\"baseline\":{\"average\":0.0},\"insight\":{\"average\":2.0},\"insightDuration\":1,\"baselineDuration\":11459},\"attributions\":[{\"attribute\":\"userIdentityArn\",\"insight\":[{\"value\":\"arn:aws:iam::123456789012:user/Alice\",\"average\":2.0}],\"baseline\":[]},{\"attribute\":\"userAgent\",\"insight\":[{\"value\":\"console.amazonaws.com\",\"average\":2.0}],\"baseline\":[]},{\"attribute\":\"errorCode\",\"insight\":[{\"value\":\"null\",\"average\":2.0}],\"baseline\":[]}]}},\"eventCategory\":\"Insight\"}", + "event.outcome": "success", + "event.type": "info", + "fileset.name": "cloudtrail", + "input.type": "log", + "log.offset": 0, + "service.type": "aws", + "tags": [ + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/aws/fields.go b/x-pack/filebeat/module/aws/fields.go index 5b8a3d61898..352932f1b1c 100644 --- a/x-pack/filebeat/module/aws/fields.go +++ b/x-pack/filebeat/module/aws/fields.go @@ -19,5 +19,5 @@ func init() { // AssetAws returns asset data. // This is the base64 encoded gzipped contents of module/aws. func AssetAws() string { - return "eJzMXF9z4zZwf79PsZOX2DOSOrlkOh130hmdz9eocS6upUvaJwYCVxJqCGAA0Drdp+8sAFKkSEqyReVOD4nPpBa/Xex/LDyEJ9zeANvYNwBOOIk3MP5z+gbAoERm8Qbm6NgbgBQtNyJzQqsb+I83AAC/6TSXCAttYMVUKoVagtRLCwuj10Rm9AZgIVCm9sZ/YQiKrbFYjj5um+ENLI3Os/iblnXo88GTKSn7dUbxaXWJ6jJc6jx1hglZPmpbkT773BafFBcsly7xS9zAgkmLtcetYKuAtfF4bwnLjLDUoLfBr7KAz6hc8ozGCq1qbxScPOF2o0269+wAMPrMVlhFFOmDXoBbIQEMCxP6NXOjVmi5RZOIFJUTbtsKbV/ITWDDVmREeRIJA0pcExSulWNCWUjRMSEtsLnOncdLq4FeNGhNxr9BARDcijlYsxT9Vwz+naN1A2Aqhc1K8BVwg/5dJi1s0GCDXG4xHcFkAQ7XmTbMbBvf8e8M/AoFbrvSGwsrvaHfNmg2COg5cYnpaO/VNiWp7gbJoPHwsI40t6PlhbAjUcKesY4tr1i32dfUlyNpKkYBZbxmX7SCR7Q6NxzhI1sjXI0fP14XADMjFBcZk3t7zpmU+2KtoOYcrU2ecJuINnx94Q/rECGYvA8IN8x6xQGnwYqlqmpoN2CLlow2IcPAz64TcpsVngp4sqhi8UC9ODfCrSpmYJHnpk0loK7iZG6lYXjWM6OfRYoWhAq+htzQzrIjj610S9Fxg8xh6l2tW2mL1SVbvtplSlXhrhcsYblbERVO1FvfPq4VpwoaonY8M5kjCAvO0P+j+LV23imCNt6p+Z83xGonsVbPFEW021AmrfYyrPEatpe1i50+v30YQ4rPguO/g3YrNBthcRCiY1Nhq3L1e0VamzLXBT7I9MALLxEokfFO3ok1wmaFwbqautuUmLA2bzriOj+FEfp3zUGGuuzwJRz1YY/wepvspBfD2+nhrPgcskU4Ht6KzylmCC+QM0TtiTEmBpbDSjMAm/PVQZLMwqPWbkBG/MmiGZBBP2rZYTRVAZRBrT06XVoQQjk0ikmKWVEa1byqGsGW2K0nUNe942y35xKX5nb8+LHgMmrAFeNc5ypsnfe/fu+Mlnh9kFybeI4o0glSCWC+jirExQNneqPs5bSh4FeoZ/2EaTJv82h9JWa0VLHrVLFZNBThugoHMnZgbfkFFDnq3e1bGOdOw5QzXxzHWvBOMusEh3fIlHVMPrUXWGiMNgnX6b7nO73wa6+vqtz5RcpEI8YVgy43yvrIQM8P4VujtWzZJ8TJYTChvKoQKR1SN9RIK8mYYWt0aPb37VyR7ggPSJhMbQfRFigKWoqtIUZ3Z/brXDqRHK3zDqX6HQ+PNDGqYrKZVhaTmA/0LaWCfplvUD7KOH3HFnb2hMBXTC3RwlXI7AfNSjyjtM574BQlUoYXiFx/g0JlaSoIHJOJb6qkrNZhOleu45I85bqsUjyFFk7pkZV2pKYumkuDUGFvFNbiPn2D0iwsuRH6ztXNUHl5aYUOx0KgrdlryAij35yjUMtmO4dJiSksUaFhzn9f2EC6w4f6/l5LdnuWA63jL5o3FX0oAKYVRTHItUnbYbJMnN2EPIpz/DApO5HMWs3Frhj1zzd2nIlbJmWDkudgRnwekPWaKbb0ficYYp9GCO+0lshUhxptVkhlckXawsK+F4AKwvBWVzBjaaKVbG+6nr0VO6zCgs5IT2hHCLBfekhL7x50YQyJc3sEeU1jeAxSWO+8Stqxl4YpCLUT7Us7p5drV5Y9yvHjx2aieFIy3weMcUzYd6VbIUFK31u6Fr32lI+Ixjun0lJMsZOh8eDPom5u2MYOo98demQ3FOmG9FX/7w4N5CITZOydAj7HYB4xM0h5XfBdbCdjb/sGOYpn71+FPWTMka/gkZJ4tnE5H1um/bTcAITiMk+pNNkQamfEcokmhIV2Jxt6aUGHcvktJrF2xQymUaC97vl/fpq8r4TO+bZ6huY05Er8naPcFvpcfd4uzXig6XeGyk+qzEIqG0OIDbWD05CKxQIN/SOcz9Y/Uf9su5I9ZzxBlWZa9C2SPfX64+EWioXIlMPJWkygYkvQl9Ke7WYApO87DUz5rnK1UC0L7qK4nv7YzivXymqJidRL0Z6svCb6xNNcmyEXC8EJ5G1Y6J7Wibv50shzvDI4jLqJvD0A7EqEO2/D76lQoNrrOA+H+KjystZzIbEjSaxzMg+pUsc7J7fCmxlLjRsqebyWBWRwCFnBhNeZxOmD8Ps57Pn0eN/YgcMCXrAkt0cOoi4mWu/XYcG4o4p9d1hEnmrT0QWDeGYOaW4oxHSyWrC4kMw5VA0eX2+2d9MdUV8e+3SD5K7n/4fceQZN6OzZfB4UHZhB9b2DJ6U3irwYS5+Z4o1quFfz7uK9yeUxEz+vCwCndQJe0Fp7DY/dXdoeGm2n97v6hd5X9wte1AF7WarZH8c9Jp5wNPmsTXxtmKudw33Nia8/CcuLJr4O9dNbUuMjvqEOoiDeFBzyt19fYne3b8P8oFAV4KcKTmQJS1OD9vXlU0N8u6NPdBCp74po713QtEhTzk+X5vIysrx/9yK1a9TRZ8utep4mNUthziSF0Y4jmrN6oK0AqkNrNQBeSM9v4Z5++S7+sqN0csws0SV+90bNVtGZECsHzWGhoCa7cdrOMFamrMKSl95v4pyJy2tPpNxoaCDVWAp5d/cvM9pprveL3jNBFVTb9/Rq5VxG8dDx7PrIKaDRHK0Vapk4scaRRd6KdCE1e6G/9XqnHZNh3kgosMi1otJRKI570gsZVki2hN3JOFdOSBC1+p+BwSVtCUXJOeNPqDqa9fHhN8RmhQ16EgGCE1LWfmEdM87GRImyg87mckjbvjKHZUJX3buyoVPjsr6XXjxSdDYFd6ILfK3bQ5rUjSOol3EVDam6UwrWQkoRmR1EbgN8nfk6qsIQl9ruD3eVnlPahPyYXbEnvCwfxVjj7H4K5ZIkaK7Xmc+O9/gC3aKlK2ZhjqgArWNzKeyqi7XC/MR+PXqmh5s87CcZhRLtND10lI954AJhps3rz7navbA2rujSn4uOXPaoLDGtYy635w28tEIOhIEIN83zqvq0aaDhCxQPyX6dNuG06a9O6H+1cmytTLjIVn0H6un0HgLd0GoRiozgX/yvy03oSG0I02UiNS1fRusX4+IrbVElHI27aMYV1gFaRyz85DPEM50wulZRgtfCt2gE61m4gSaofD1Hc2FehOJ67cOrtAmT2LczodpqiSaemuuF9+B+nUpEnW/bUvjCjgNXvhkUOe4OR/RTmrQ1Es/kg2B74iF/70BgGMdzjl9al/bXP5QrI8Zf/zMcr7+o4YxWG07Sv2CFLO2qutZUYWOamFxSOiV0y9j42Wl7oLrbZJ875bIcrfQQ6tOVYkEJL70TH3fMpYQkCT8jz5uXNM4EHg/iCuLh8kAt1O2GFK8W2myYSQewEJ8xHRaRYVC7WTEaja5HMHHAmSoutIHFZzRMBvF02KHBVBjkLslNz97k0+N99NBe4nEdP4LDi+5+KYIDc6Ajg8z2fUUxDKcGysWMarkdEd+CCVlFVka3H8N0yNduxEx/9L1PNMXNr5d0ZeY5f0KXtI1pnOs2mNJKcCbDZaLdbIhfa2/6PcDoyOX8s8u1jgL94Cr2775EYyRlWDKhunokBtfaYdKRrTd+fYpryDJmQjA9uTkIzU7EP7ap5Xr+xIDB0KtnrurXvopz+sPdkz4D2Bis82eDtamK8oS/fagC2W6moB1qOZzWr3h3w3C+N5bCKlwTgxS5ZFQZMAvT38cPo/LNATzeTWejX2azh2SNbqXTUTF85ac+B/Dn3bvpZHZ36BVt4N14dvvL6P3d/d3sbvT7u/+6u521s/6EPYfv755w+131yHAXpCl2oKKiJ/Ugvxt+V3jpnahSjeHU0VFNzvzF1/IQ77Cm5Ub0y8tjIDz89DipcUSyLx1L44ykCo3KviRUez22MlS+RiN4wFGtR3fzei2nsD3eE2kvlUozvPNx+FanWN1npWOA1pznxnQ2S7YObWK7Bm5fLbFY/ZRNOL+Or+AHgJ+L40Uv0l3n+BkNpcNVNr6g0R1uxM8IJFZ8aZfsOX0rIlqGXL8OFWZeAzvbJv6bvpN2EUnWGmT7oVYoWEixXLnKxJpPa763kKGxGWWNzx0a6nKjEmZ0rtJ/DD5zFQW2GQXrSu6+1bk5HEMMLtCYviN0rQbyuvkY14ll2vFC1v/dDbY8Z4D9RGifLJrhmFY6WEPGyareK9viLsDkfdFvLCPPqcEmkpikx0LOSvec2RADn4ds/WUo0uFbf/Ov1Eb87FClu4QLJu87OnRiqZjLTddc3bmdpIJ8IacBTMXyD4+Wfvhp0LzPWc0Ya07i1XllaF8mNheNC//ntiGRE3NTTRWEhXu2RQNX0+n9ddEz3Y1F4VI7Uf4ZCVL/aRtr9KCjFVEbijvvSk973IjH2eXfbqhP4YW/PDPO3eoXb6thuqj+TrBiO4D/ztFspyH1pvf+pn8XufhVZnBIuoEppXjXr99ab1Vh0Z4bA8WMcaGWsZNJPx6ZD3bSXsaaZoYp609HgqJNi6vdV7P76XXpzSqaFhub+yeBlanthdSb0xsYl5rL+ePhFgjJi1oXF5ExIflASO710hZL+L/JtNU5KUO8G+wZj5dIwn3hQvzCwtvyC2GcewsMeG6dXnd9o0OVerhY0p54+1sA5YWS4nSz2IKuVr1Ds7hEh3nXRlDoNto87dby2MKQv59hMWyxEDyeh2uTHu7b9gtz795E2w3CiG8A49vbu4eZ/+sbd921tNTLQ7Xeq5FKvVySo42VXhRusb0D+P3XAXz8/f14NvaR+NfJA/3cte3WMXXRXS+W8KL9vinZV2jFoEjdStrC+s6jd4pbnXfMFT25xBrO0rQ9nrymlZcxyg6GEp9RwpU2YikUk9dF67N5JB/Z6UaYWvePIEypVlQhsldgFu7iIM7njF9QY/w1HrLD8o/29eo9bD5X2L/b3eEPC1ySBcezZCHZsmfPMhduzexTrOXKwKGl1BvyOLPbB/DL3sDbn6f/+3Hww7/R/4bj218HP/z8YfJx8NPPj9NZO+TLDWgGqd3A5OH5pwH99199iXf3YTx68/8BAAD//624A44=" + return "eJzcXN+T4raTf9+/oisvma0Crr6b1NXVXOWq2NnJhctkMzewyd2TI+wGdCMkR5JhyV9/1ZL8AywDM5jd1JeHXQbb0qdb/VstD+EZd7fAtuYNgOVW4C2Mf5++AdAokBm8hTla9gYgQ5Nqnluu5C38xxsAgF9UVgiEhdKwYjITXC5BqKWBhVZrGmb0BmDBUWTm1j0wBMnWWE5HH7vL8RaWWhV5+CUyD31+dMNUI7t5RuFqc4rmNKlQRWY146K6FJuRPofUlp8MF6wQNnFT3MKCCYN7l6Ngm4CVdnjvCMuMsOxBj8FvkoAblDbZoDZcyb07SkqecbdVOju4dgQYfWYrbCIK44NagF0hAfQTE/o1s6MotMKgTniG0nK7i0I7ZHIb2DCKjEaehIEBBa4JSqqkZVwayNAyLgywuSqsw0uzgVq0xpqMf4ESINgVs7BmGbpHNP5ZoLEDYDKD7YqnK0g1unuZMLBFja3hCoPZCCYLsLjOlWZ613rG3TNwM5S4zUptDazUln5tjdkaQM2JSsxGB7fGhKS5GsSD1sXjMtJejsgNfkUChx1hHUve0G59KKkvR9IWjBLKeM3+UhKe0KhCpwgf2RrhZvz08W0JMNdcpjxn4mDNUybEIVsbqNMUjUmecZfwGL6+8Pt5aCCYfPAIt8w4wQGrwPClbEpoN2CDhpQ2IcXAz7YTckwLzwU8WTSxOKCOnVtuVw01MJgWOiYSsC/ipG6VYjjSc602PEMDXHpbQ2ao1uxAY3TcinWpRmYxc6bWrpTB5pSRR7tUqcnc9YIlrLArGiWl0aN3n5aKcxkNQTo2TBQI3IDV9H9gv1LWGUVQ2hk1931LpHYOFrVMgUX1gjJhlOPhHq1+eVmc7fT55ccxZLjhKf47KLtCveUGB947tgW2yVe3ViS1GbNd4D1Pj9zwEobSMM7IW75G2K7Qa1dbdtsc48YUbUO8T0+phO5efZSgLj18CUV96CO8Xic7xwvu7Xx3Vn6O6SKcdm/l5xw1hBfwGYL0BB8THMtxoRmAKdLV0SGZgSel7ICU+JNBPSCFflKiQ2maDKicWtw7XZsRXFrUkgnyWYEbzbiq6cGW2C0nsC97p8mOxxLXpnb89LGkMkjADUtTVUi/dM7+urXTSuDbo8PF2HNCkM7gigfzdUQhTO4pU1tpricNJb1cbtQzZsk8ZtH6CsxoqnLVKWMzqMnDdSUOpOzAYvEFlDHq/d07GBdWwTRlLjkOueC9YMbyFN4jk8Yy8RxPsFBrpZNUZYeW7/zEL55fNalzk1SBRvArGm2hpXGega4fw7dGY9iyT4iT42B8etUYpDJI3VDDWEnONFujRX24bpeytB54QMxkcjcIukBe0JBv9T66O7JfF8Ly5GSedyzU77h4oojRZJPJlTSYhHigby6V41fxBsWjLKVnTKlnzwjpisklGrjxkf2gnYnnFNY5C5yhQIrw/CBv/4ZMZVnGCRwTiSuqZGyvwnQpX8fV8BTrskby5Es4lUWWypKY2qAurYFKfSO3Ftbpb8jNUpNbru9S2fSZl+OWr3AsOJo9ffURYbCbc+Ry2S7nMCEwgyVK1My657nxQ3fYUFffi0S3FxnQffxl8aYhDyXArCEoGlOlszhMlvOLi5AncY4fJ1UlkhmjUl4no+761oxzfseEaI3kKJgRnUd4vWaSLZ3d8YrYpxLCe6UEMtkhRtsVUprc4DY3cGgFoIHQ39XlzFiWKCniRdeLl6LGyg2onOSEVoQAu6mHNHV9oQujD5zjHuQ1heExCG6c8arGDrU0zIDLmrUvrZxer1xZ1SjHTx/bgeJZwXwfMMYhYK9Tt5KDFL5Hqha91pRPsMYZp0pTdLmSvvDg9qJub9nWDIPdHTpkt+TphvSo+7tDAlOec1L2TgZfojBPmGukuM7bLlbz2Om+xhT5xtlXbo4pc6DLW6Qk7G1cz8ZWYT9NNwAuU1FklJpsCbXVfLlE7d1C3Mj6WpqXoUL8HYNYs2Ias8DQXtf8Pz9NPjRc53zX3EOzCgrJ/yxQ7Ep5bl6PczNsaLqVofSTMjMfygYXYnzuYBVkfLFATX/4/dn9T5A/ExeyTZ4mKLNc8b5ZciBevz3eQTkRqbLfWQsBVCgJulTakd12gPS8VcCkqyo3E9Uq4S6T6+l3cVpTJY0SmAi15PFg5TXeJ+zmmhxTvuApgbzzEz3QPGE1X+p5TmcGx1G3kccdQJ0i3Dsd/kCJAuVep2k4RkeTlrWac4EdQeI+JXMfKnXcc3YpvB2x7FFDKY+TMo8MjiEriXAyk1h1FH4/mz2fnh5aK3CcwQuWFObERtTVWOvsOixYailjrzeLyFJtO6pgEPbMISs0uZhOUksSF4JZi7JF4+vV9n5aD+rSYxduEN/V/P8wtY5A7St7pph7QQemUX5r4VmqrSQrxrINk2krG+5Vvbtob1N5SsUvqwLAeZWAF5TWXkNjd5W2h0Lb+fWufqH3Vf2CF1XAXhZq9kdxj4EnnBV8lmRmfIkmntxf4PmdK7mrGsrgg5sFHtTypV5fqGWy4KKVGtcwJZp4x8FZ2V6VJz+opZunbJ2q82TPoiOSYpm2ieXr7vSvY3v+XF1wM9Dyf5rd+a15TVLv1aCGCEQApIqcd1wRLHumYZivTrgIOfX23I1axaBCLcFzY8U2cRGbI0rSJr5xkrgX3nfzCmV2VU6hzP4p+GS+S+ZF+hzdDrzKFl6ZJoCflkJ2T6JrVCi0bpcAw2wNlq6YOaD3KIU+qrgihTVVfirXR3YTcsVBlPDoWEL54K1qmgsMaRLfTanELbn8ULy+ovBXUh9QrpXxtZWyQgpsrUishTgW0IRcO1i/WsTPNIdKZF+HXD9xB6Xd+Rq8mtJc44arwiRfQluPa2gJZU8du1KNM7SzIm3FzCphYqk0t6v1F7JGNClUk7bbJNz1LvGNseIIocVc8NQ1si64XKLONY9aur7oXOFnlmHK10wAylRlmEFj5qot1+FyBovIjw63ZjZdhYgx13zDLLoHDrpj+ZmsoNuZLTR+kfWul7fVzNuJtu5wMXy5Ol4A7orIT+Gbug70eINtITPUYkehQYjBDa0XkzDxiNr6FiL4shznjZOv5g98Zypb+jsss9xYnpqB29sjStvBiW/Aj2yP2TJMpCQHZVbK0XFgNXv3ToFsSbDeHHL065wC+Z2wvOgUyLEem0i5/ES9YB9EOXibcZi++/ocu797588UcdkAfi7jeJ6wLNNoXr+l0mJf3Q6JFsLo9caaqzigjnBTzM/n5vI6vHx4/yKxa+2tXcy3pksUimUwZ4LJFDvati7qi4gCaB5k2QPgmLR5Bw/04/vwY8d2imV6iTZxqzdqbx9fCLHRfOon8mJSH7HrLG1VFQZuyE8cbuxeiMtJTxi5tclJyaeUmHZ3BORaWZWqw42wC0GVo8bX9GZlbU7uw6b52xOdgVqlaAyXSxfhjwymHU5YtWKXc+ROWSaqVNtgqmRmwPAyCa+556uuvgDLTc3jQlougO/tCVIqv6QlcXk4S59RdjTwhIt/IzIbZNCVABAsF2LvBxcCmFA8zbhcdjac+FLuV6awKvI2167a5N2jcn8tHXsE72wUqFnn6VrHXZpQrba0l1FV1gMaKyVhzYXggdhBoNbDV7nbW2kQlAplDhOxynIKyr9kZlbsGa9LR3nUafYwhWpKYnSq1rmrmB/QBSoipVX9B41lc8HNqou0Uv34YYH5Qgs3eTwMMkohqiXdp0SnLHCJMFf69b1vcSustC1LDJeiI5M9qradKIcozGVN8FHIfmCggdvqedO82lZQ/wD5Q9Jfq7SvrP/RCf2PKMXGiCTl+apvRz2dPoAf1yeiXJIS/Iv7uVqEjtCGMF3HU9P0lbd+Ma50pQzKJEVtrxpx+XmA5uELdxoSQp+Xz+gbQvBa+AY1Zz0z148JsljPUV+ZFi5TtXbuVZiECezbmFButUQdOmnVwllwN0/Do853sRC+1GNPldsgDhR3uyP6liWxncEL6SDYbnAfv3cg0CzFS1qyolO7I+HSVh7jj/8Zjtd/yeGMZhtOsj9ghSzryrp8ES5LdCEonOIqcpT04rDdj1ovsoudClEdt3IQ9k9c8QUFvHRPuNzRq+6DJPyMadHeRr0QeGjOKwf3B4r3XF19cOlmofSW6WwAC/4Zs2HpGQZ7p61Ho9HbEUwspEyWO7VgcIOaCc+eDj3UmHGNqU0K3bM1+fT0ECy043iYxxUO07Ljp2LBkbNhI43M9P3aEn9gzY9cnlurliPgWzAumsjqHTrfMf61CzHT71w/BOrybRAvqcr4zZIk1rp9qdlgUkmeMuHLuHW/uJvr4ESsh9ERy8W2jnosHZX7ReUmePM8fFBGEoYl47KrRqJxrSwmHdF66+dzTEOeM+2d6dnFQWhXIr7YolbzuS4iBkMnnoXcfxVE2bt7vHrSpwMbg7GuX3Cv07reLIw2WiOr+4zjUKsDK/2ytz4g42pjGaz8qyMgw1QwygyYgemv48dRdecAnu6ns9FPs9ljska7UtmoPJDhToIN4Pf799PJ7P7YLUrD+/Hs7qfRh/uH+9n96Nf3/3V/N4uT/ow9u+9vnnH3TbONsHbS5DvCJqAD+c3wm9JK16zKFPpOREs5OXNbfFVj33FJKzTvl5YnP/Dw09NkjyLifWVYWnskTWiU9iU+2+uxlCGLNWqeehzNfLQ+wxPpzOzx7Hg8VarU8N754TuVYXOdpQoOWqWuo6SrWLKzaBLTdQjv1RwL2U9VhHPzuAx+APi5bDl0LK0rxxvUFA43yfgLteowI67tJjH8rzhnL6lb0aCVy/XtPVyCk8DOsol7MtaU0g8n9wpkh66WS1gIvlzZxikWF9Z8ayBHbXKKGjcdEmoLLROmVRHvn7sKfGYbAmxyctaN2H2nCn3ch7jGOd23h97LgZxsPoV5Qpp2OpF17+Jz2+7XhvbJoB6OaaajOWQ4bdF7ZlueD558KOuNlec519mEISbZKZezUj1HNkTA5yFb/zXk2fCdextIJY342aLM6oALJh86KnRVT8tV3gpZDV/yaQBTvvzNoaUv3w/azUvNiHHPSLw6rvTly8QUvNVPd2kZElMibqoogzDwwHao4WY6fXhb1kzroxK4VJZXr5Yj8Z/GSKMLHaWIvYMylx3zj/uNsJ1dvc9t/2SOfxvluLCrn5yu+hMH+/d4LTYD+O8C9W7qQ2+670/6u4zFb3KNQ5INzCjEe/v6pXVa5SftuTBQnjssxTJUMunriTODVpjraNNMM2nc7ogXtGn5uqeb2cP0bWXNGpIWCpuHO4GNk5wLobbnFzCu1Zfz2+MdEJIXlS6uwmNC8iMheVBLU07h3tO6UwUJQ3hfkCM8HCz3ndIl+7mBd9UD/ojnDhikhbFq3fVEhyj1cNg8Hni7k8HVIfNyd7Ncgq5SvUW9uEaFuS4jSLRbpZ/ruRy2uo/XarZY8DTshyudHa/b9gvz4Cx17K0iAd8Axnd3948z90a+++5cWqjlsVzv1UiFWi7J0IZMLzC3XN4B/PrzAD7++mE8GztP/PPkkb53NpNaJq+66uUUjrXftjn7CqkYlKFbNTY3rvLojOJOFR19Rc82MTplWRb3J68p5eWMooOhwA0KuFGaL7lk4m1Z+mxvyQdyuhFmxn4RhBnlitJ79gbM0lwcxbnJ0ytKjDvaT3pYvci7V+thirnE/s1ujd9PcE0SbJonC8FaBwovJGHO7ZqZ55DLVY5DCaG2ZHFmd4/gpr2Fdz9M//fj4B//Rv8Nx3c/D/7xw4+Tj4Pvf3iazuKQr9eg6bl2C5PHzfcD+vdfXYp3/+N49Ob/AwAA//+8xDjD" } diff --git a/x-pack/filebeat/modules.d/aws.yml.disabled b/x-pack/filebeat/modules.d/aws.yml.disabled index 7a0da775c8d..0fe8465211b 100644 --- a/x-pack/filebeat/modules.d/aws.yml.disabled +++ b/x-pack/filebeat/modules.d/aws.yml.disabled @@ -8,6 +8,18 @@ # AWS SQS queue url #var.queue_url: https://sqs.myregion.amazonaws.com/123456/myqueue + # Process CloudTrail logs + # default is true, set to false to skip Cloudtrail logs + # var.process_cloudtrail_logs: false + + # Process CloudTrail Digest logs + # default true, set to false to skip CloudTrail Digest logs + # var.process_digest_logs: false + + # Process CloudTrail Insight logs + # default true, set to false to skip CloudTrail Insight logs + # var.process_insight_logs: false + # Filename of AWS credential file # If not set "$HOME/.aws/credentials" is used on Linux/Mac # "%UserProfile%\.aws\credentials" is used on Windows From bf3eace181c6755a560ede1116bfc26fff0c954f Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Tue, 15 Sep 2020 13:29:08 +0200 Subject: [PATCH 003/216] Move the `compute_vm_scalset` to a light metricset and map the cloud metadata (#21038) * mofidy doc * vm_scaleset * changelog --- CHANGELOG.next.asciidoc | 1 + .../docs/modules/azure/compute_vm.asciidoc | 1 - x-pack/metricbeat/include/list.go | 1 - .../metricbeat/module/azure/add_metadata.go | 22 ++-- x-pack/metricbeat/module/azure/client.go | 81 ++++++++---- .../metricbeat/module/azure/client_utils.go | 37 ++++-- .../module/azure/client_utils_test.go | 90 ++++++++++++-- .../module/azure/compute_vm/manifest.yml | 2 +- .../azure/compute_vm_scaleset/_meta/data.json | 106 ++++------------ .../compute_vm_scaleset/client_helper.go | 92 -------------- .../compute_vm_scaleset/client_helper_test.go | 117 ------------------ .../compute_vm_scaleset.go | 73 ----------- .../compute_vm_scaleset_integration_test.go | 3 + .../compute_vm_scaleset_test.go | 66 +--------- .../azure/compute_vm_scaleset/manifest.yml | 66 ++++++++++ x-pack/metricbeat/module/azure/data.go | 15 ++- x-pack/metricbeat/module/azure/module.yml | 1 + x-pack/metricbeat/module/azure/resources.go | 5 +- 18 files changed, 292 insertions(+), 487 deletions(-) delete mode 100644 x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper.go delete mode 100644 x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper_test.go delete mode 100644 x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset.go create mode 100644 x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index a45c3b13b84..90df1fbbd35 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -683,6 +683,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Request prometheus endpoints to be gzipped by default {pull}20766[20766] - Release all kubernetes `state` metricsets as GA {pull}20901[20901] - Add billing metricset into googlecloud module. {pull}20812[20812] {issue}20738[20738] +- Move `compute_vm_scaleset` to light metricset. {pull}21038[21038] {issue}20985[20985] - Sanitize `event.host`. {pull}21022[21022] *Packetbeat* diff --git a/metricbeat/docs/modules/azure/compute_vm.asciidoc b/metricbeat/docs/modules/azure/compute_vm.asciidoc index 8715cf5c58e..fdac6f7d06a 100644 --- a/metricbeat/docs/modules/azure/compute_vm.asciidoc +++ b/metricbeat/docs/modules/azure/compute_vm.asciidoc @@ -8,7 +8,6 @@ This file is generated! See scripts/mage/docs_collector.go include::../../../../x-pack/metricbeat/module/azure/compute_vm/_meta/docs.asciidoc[] -This is a default metricset. If the host module is unconfigured, this metricset is enabled by default. ==== Fields diff --git a/x-pack/metricbeat/include/list.go b/x-pack/metricbeat/include/list.go index 6fdb2a7f7ab..053385e2e79 100644 --- a/x-pack/metricbeat/include/list.go +++ b/x-pack/metricbeat/include/list.go @@ -22,7 +22,6 @@ import ( _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/billing" - _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/compute_vm_scaleset" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/monitor" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/storage" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/cloudfoundry" diff --git a/x-pack/metricbeat/module/azure/add_metadata.go b/x-pack/metricbeat/module/azure/add_metadata.go index c8621e77692..ba8f35c7db6 100644 --- a/x-pack/metricbeat/module/azure/add_metadata.go +++ b/x-pack/metricbeat/module/azure/add_metadata.go @@ -35,16 +35,16 @@ func addHostMetadata(event *mb.Event, metricList common.MapStr) { } } -func addCloudVMMetadata(event *mb.Event, resource Resource) { - event.RootFields.Put("cloud.instance.name", resource.Name) - event.RootFields.Put("host.name", resource.Name) - if resource.Vm != (VmResource{}) { - if resource.Vm.Id != "" { - event.RootFields.Put("cloud.instance.id", resource.Vm.Id) - event.RootFields.Put("host.id", resource.Vm.Id) - } - if resource.Vm.Size != "" { - event.RootFields.Put("cloud.machine.type", resource.Vm.Size) - } +func addCloudVMMetadata(event *mb.Event, vm VmResource) { + if vm.Name != "" { + event.RootFields.Put("cloud.instance.name", vm.Name) + event.RootFields.Put("host.name", vm.Name) + } + if vm.Id != "" { + event.RootFields.Put("cloud.instance.id", vm.Id) + event.RootFields.Put("host.id", vm.Id) + } + if vm.Size != "" { + event.RootFields.Put("cloud.machine.type", vm.Size) } } diff --git a/x-pack/metricbeat/module/azure/client.go b/x-pack/metricbeat/module/azure/client.go index 5bfbbacca67..e488fab98b6 100644 --- a/x-pack/metricbeat/module/azure/client.go +++ b/x-pack/metricbeat/module/azure/client.go @@ -185,39 +185,72 @@ func (client *Client) MapMetricByPrimaryAggregation(metrics []insights.MetricDef return clientMetrics } -// GetResourceForData will retrieve resource details for the selected metric configuration -func (client *Client) GetResourceForData(resourceId string) Resource { - for i, res := range client.Resources { - if res.Id == resourceId { - var vmSize string - var vmId string - if client.Config.AddCloudMetadata && res.Vm == (VmResource{}) { - expandedResource, err := client.AzureMonitorService.GetResourceDefinitionById(res.Id) - if err != nil { - client.Log.Error(err, "could not retrieve the resource details by resource ID %s", res.Id) - return Resource{} +// GetVMForMetaData func will retrieve the vm details in order to fill in the cloud metadata and also update the client resources +func (client *Client) GetVMForMetaData(resource *Resource, metricValues []MetricValue) VmResource { + var vm VmResource + resourceName := resource.Name + resourceId := resource.Id + // check first if this is a vm scaleset and the instance name is stored in the dimension value + if dimension, ok := getDimension("VMName", metricValues[0].dimensions); ok { + instanceId := getInstanceId(dimension.Value) + if instanceId != "" { + resourceId += fmt.Sprintf("/virtualMachines/%s", instanceId) + resourceName = dimension.Value + } + } + // if vm has been already added to the resource then it should be returned + if existingVM, ok := getVM(resourceName, resource.Vms); ok { + return existingVM + } + // an additional call is necessary in order to retrieve the vm specific details + expandedResource, err := client.AzureMonitorService.GetResourceDefinitionById(resourceId) + if err != nil { + client.Log.Error(err, "could not retrieve the resource details by resource ID %s", resourceId) + return VmResource{} + } + vm.Name = *expandedResource.Name + if expandedResource.Properties != nil { + if properties, ok := expandedResource.Properties.(map[string]interface{}); ok { + if hardware, ok := properties["hardwareProfile"]; ok { + if vmSz, ok := hardware.(map[string]interface{})["vmSize"]; ok { + vm.Size = vmSz.(string) } - if expandedResource.Properties != nil { - if properties, ok := expandedResource.Properties.(map[string]interface{}); ok { - if hardware, ok := properties["hardwareProfile"]; ok { - if vmSz, ok := hardware.(map[string]interface{})["vmSize"]; ok { - vmSize = vmSz.(string) - } - if vmID, ok := properties["vmId"]; ok { - vmId = vmID.(string) - } - } - } + if vmID, ok := properties["vmId"]; ok { + vm.Id = vmID.(string) } - client.Resources[i].Vm = VmResource{Size: vmSize, Id: vmId} - return client.Resources[i] } + } + } + if len(vm.Size) == 0 && expandedResource.Sku != nil && expandedResource.Sku.Name != nil { + vm.Size = *expandedResource.Sku.Name + } + // the client resource and selected resources are being updated in order to avoid additional calls + client.AddVmToResource(resource.Id, vm) + resource.Vms = append(resource.Vms, vm) + return vm +} + +// GetResourceForMetaData will retrieve resource details for the selected metric configuration +func (client *Client) GetResourceForMetaData(grouped Metric) Resource { + for _, res := range client.Resources { + if res.Id == grouped.ResourceId { return res } } return Resource{} } +// AddVmToResource will add the vm details to the resource +func (client *Client) AddVmToResource(resourceId string, vm VmResource) { + if len(vm.Id) > 0 && len(vm.Name) > 0 { + for i, res := range client.Resources { + if res.Id == resourceId { + client.Resources[i].Vms = append(client.Resources[i].Vms, vm) + } + } + } +} + // NewMockClient instantiates a new client with the mock azure service func NewMockClient() *Client { azureMockService := new(MockService) diff --git a/x-pack/metricbeat/module/azure/client_utils.go b/x-pack/metricbeat/module/azure/client_utils.go index c0cd02e589f..abfccfa75ec 100644 --- a/x-pack/metricbeat/module/azure/client_utils.go +++ b/x-pack/metricbeat/module/azure/client_utils.go @@ -6,6 +6,7 @@ package azure import ( "reflect" + "regexp" "strings" "time" @@ -15,6 +16,8 @@ import ( // DefaultTimeGrain is set as default timegrain for the azure metrics const DefaultTimeGrain = "PT5M" +var instanceIdRegex = regexp.MustCompile(`.*?(\d+)$`) + // mapMetricValues should map the metric values func mapMetricValues(metrics []insights.Metric, previousMetrics []MetricValue, startTime time.Time, endTime time.Time) []MetricValue { var currentMetrics []MetricValue @@ -167,21 +170,41 @@ func groupMetricsByResource(metrics []Metric) map[string][]Metric { return grouped } -// ContainsDimension will check if the dimension value is found in the list -func ContainsDimension(dimension string, dimensions []insights.LocalizableString) bool { +// getDimension will check if the dimension value is found in the list +func getDimension(dimension string, dimensions []Dimension) (Dimension, bool) { for _, dim := range dimensions { - if *dim.Value == dimension { - return true + if strings.ToLower(dim.Name) == strings.ToLower(dimension) { + return dim, true } } - return false + return Dimension{}, false } -func containsResource(resId string, resources []Resource) bool { +func containsResource(resourceId string, resources []Resource) bool { for _, res := range resources { - if res.Id == resId { + if res.Id == resourceId { return true } } return false } + +func getInstanceId(dimensionValue string) string { + matches := instanceIdRegex.FindStringSubmatch(dimensionValue) + if len(matches) == 2 { + return matches[1] + } + return "" +} + +func getVM(vmName string, vms []VmResource) (VmResource, bool) { + if len(vms) == 0 { + return VmResource{}, false + } + for _, vm := range vms { + if vm.Name == vmName { + return vm, true + } + } + return VmResource{}, false +} diff --git a/x-pack/metricbeat/module/azure/client_utils_test.go b/x-pack/metricbeat/module/azure/client_utils_test.go index ffa09d4faea..37528540f70 100644 --- a/x-pack/metricbeat/module/azure/client_utils_test.go +++ b/x-pack/metricbeat/module/azure/client_utils_test.go @@ -131,28 +131,94 @@ func TestCompareMetricValues(t *testing.T) { assert.True(t, result) } -func TestContainsDimension(t *testing.T) { +func TestGetDimension(t *testing.T) { dimension := "VMName" dim1 := "SlotID" dim2 := "VNU" dim3 := "VMName" - dimensionList := []insights.LocalizableString{ + dimensionList := []Dimension{ { - Value: &dim1, - LocalizedValue: &dim1, + Name: dim1, + Value: dim1, }, { - Value: &dim2, - LocalizedValue: &dim2, + Name: dim2, + Value: dim2, }, { - Value: &dim3, - LocalizedValue: &dim3, + Name: dim3, + Value: dim3, }, } - result := ContainsDimension(dimension, dimensionList) - assert.True(t, result) + result, ok := getDimension(dimension, dimensionList) + assert.True(t, ok) + assert.Equal(t, result.Name, dim3) + assert.Equal(t, result.Value, dim3) dimension = "VirtualMachine" - result = ContainsDimension(dimension, dimensionList) - assert.False(t, result) + result, ok = getDimension(dimension, dimensionList) + assert.False(t, ok) + assert.Equal(t, result.Name, "") + assert.Equal(t, result.Value, "") +} + +func TestContainsResource(t *testing.T) { + resourceId := "resId" + resourceList := []Resource{ + { + Name: "resource name", + Id: "resId", + }, + { + Name: "resource name1", + Id: "resId1", + }, + { + Name: "resource name2", + Id: "resId2", + }, + } + ok := containsResource(resourceId, resourceList) + assert.True(t, ok) + resourceId = "ressId" + ok = containsResource(resourceId, resourceList) + assert.False(t, ok) +} + +func TestGetVM(t *testing.T) { + vmName := "resource name1" + vmResourceList := []VmResource{ + { + Name: "resource name", + Id: "resId", + }, + { + Name: "resource name1", + Id: "resId1", + }, + { + Name: "resource name2", + Id: "resId2", + }, + } + vm, ok := getVM(vmName, vmResourceList) + assert.True(t, ok) + assert.Equal(t, vm.Name, vmName) + assert.Equal(t, vm.Id, "resId1") + vmName = "resource name3" + vm, ok = getVM(vmName, vmResourceList) + assert.False(t, ok) + assert.Equal(t, vm.Name, "") + assert.Equal(t, vm.Id, "") +} + +func TestGetInstanceId(t *testing.T) { + dimensionValue := "sfjsfjghhbsjsjskjkf" + result := getInstanceId(dimensionValue) + assert.Empty(t, result) + dimensionValue = "fjsfhfhsjhjsfs_34" + result = getInstanceId(dimensionValue) + assert.Equal(t, result, "34") + dimensionValue = "fjsfhfhsjhjsfs_34sjsjfhsfsjjsjf_242" + result = getInstanceId(dimensionValue) + assert.Equal(t, result, "242") } diff --git a/x-pack/metricbeat/module/azure/compute_vm/manifest.yml b/x-pack/metricbeat/module/azure/compute_vm/manifest.yml index 4cfcad00cc7..95421a31ef2 100644 --- a/x-pack/metricbeat/module/azure/compute_vm/manifest.yml +++ b/x-pack/metricbeat/module/azure/compute_vm/manifest.yml @@ -1,4 +1,4 @@ -default: true +default: false input: module: azure metricset: monitor diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json b/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json index 6baa47d8e8c..e8f59859d8b 100644 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json @@ -1,84 +1,46 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", "azure": { - "dimensions": { - "vmname": "obslinuxvmss_0" - }, - "metrics": { - "disk_read_bytes": { - "total": 0 - }, - "disk_read_operations_per_sec": { - "avg": 0 - }, - "disk_write_bytes": { - "total": 1032189.54 - }, - "disk_write_operations_per_sec": { - "avg": 0.254 - }, - "inbound_flows": { - "avg": 58.2 - }, - "inbound_flows_maximum_creation_rate": { - "avg": 8.4 - }, - "network_in": { - "total": 253142 - }, - "network_in_total": { - "total": 646125 - }, - "network_out": { - "total": 874827 - }, - "network_out_total": { - "total": 1140051 - }, - "os_disk_bandwidth_consumed_percentage": { - "avg": 0 - }, - "os_disk_iops_consumed_percentage": { + "compute_vm_scaleset": { + "os_per_disk_qd": { "avg": 0 }, - "os_disk_queue_depth": { + "os_per_disk_read_bytes_per_sec": { "avg": 0 }, - "os_disk_read_bytes_per_sec": { + "os_per_disk_read_operations_per_sec": { "avg": 0 }, - "os_disk_read_operations_per_sec": { - "avg": 0 - }, - "os_disk_write_bytes_per_sec": { - "avg": 3440.626 - }, - "os_disk_write_operations_per_sec": { - "avg": 0.508 - }, - "outbound_flows": { - "avg": 58.2 + "os_per_disk_write_bytes_per_sec": { + "avg": 1872.1200000000001 }, - "outbound_flows_maximum_creation_rate": { - "avg": 11.2 - }, - "percentage_cpu": { - "avg": 0.966 + "os_per_disk_write_operations_per_sec": { + "avg": 0.296 } }, "namespace": "Microsoft.Compute/virtualMachineScaleSets", "resource": { - "group": "obs-infrastructure", - "id": "/subscriptions/70bd6e64-4b1e-4835-8896-db77b8eef364/resourceGroups/obs-infrastructure/providers/Microsoft.Compute/virtualMachineScaleSets/obslinuxvmss", - "name": "obslinuxvmss", + "group": "testgroup", + "id": "/subscriptions/70bd6e23-e3er3-4835-6785-db77b8eef364/resourceGroups/testgroup/providers/Microsoft.Compute/virtualMachineScaleSets/vmscaleset", + "name": "vmscaleset", + "tags": { + "environment": "staging", + "role": "allocator" + }, "type": "Microsoft.Compute/virtualMachineScaleSets" }, - "subscription_id": "70bd6e64-4b1e-4835-8896-db77b8eef364", + "subscription_id": "70bd6e23-e3er3-4835-6785-db77b8eef364", "timegrain": "PT5M" }, "cloud": { + "instance": { + "name": "vmscaleset" + }, + "machine": { + "type": "Standard_D4s_v3" + }, "provider": "azure", - "region": "westeurope" + "region": "eastus2" }, "event": { "dataset": "azure.compute_vm_scaleset", @@ -86,27 +48,7 @@ "module": "azure" }, "host": { - "cpu": { - "pct": 0.00966 - }, - "disk": { - "read": { - "bytes": 0 - }, - "write": { - "bytes": 1032189.54 - } - }, - "network": { - "in": { - "bytes": 646125, - "packets": 253142 - }, - "out": { - "bytes": 1140051, - "packets": 874827 - } - } + "name": "vmscaleset" }, "metricset": { "name": "compute_vm_scaleset", diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper.go b/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper.go deleted file mode 100644 index ecabff74741..00000000000 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper.go +++ /dev/null @@ -1,92 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package compute_vm_scaleset - -import ( - "strings" - - "github.com/Azure/azure-sdk-for-go/services/preview/monitor/mgmt/2019-06-01/insights" - "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-03-01/resources" - "github.com/pkg/errors" - - "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" -) - -const ( - defaultVMDimension = "VMName" - customVMDimension = "VirtualMachine" - defaultSlotIDDimension = "SlotId" -) - -// mapMetrics should validate and map the metric related configuration to relevant azure monitor api parameters -func mapMetrics(client *azure.Client, resources []resources.GenericResource, resourceConfig azure.ResourceConfig) ([]azure.Metric, error) { - var metrics []azure.Metric - for _, resource := range resources { - // return resource size - for _, metric := range resourceConfig.Metrics { - metricDefinitions, err := client.AzureMonitorService.GetMetricDefinitions(*resource.ID, metric.Namespace) - if err != nil { - return nil, errors.Wrapf(err, "no metric definitions were found for resource %s and namespace %s", *resource.ID, metric.Namespace) - } - if len(*metricDefinitions.Value) == 0 && metric.Namespace != customVMNamespace { - return nil, errors.Errorf("no metric definitions were found for resource %s and namespace %s.", *resource.ID, metric.Namespace) - } - var supportedMetricNames []insights.MetricDefinition - if strings.Contains(strings.Join(metric.Name, " "), "*") { - for _, definition := range *metricDefinitions.Value { - supportedMetricNames = append(supportedMetricNames, definition) - } - } else { - // verify if configured metric names are valid, return log error event for the invalid ones, map only the valid metric names - for _, name := range metric.Name { - for _, metricDefinition := range *metricDefinitions.Value { - if name == *metricDefinition.Name.Value { - supportedMetricNames = append(supportedMetricNames, metricDefinition) - } - } - } - } - if len(supportedMetricNames) == 0 { - continue - } - groupedMetrics := make(map[string][]insights.MetricDefinition) - var vmdim string - if metric.Namespace == defaultVMScalesetNamespace { - vmdim = defaultVMDimension - } else if metric.Namespace == customVMNamespace { - vmdim = customVMDimension - } - for _, metricName := range supportedMetricNames { - if metricName.Dimensions == nil || len(*metricName.Dimensions) == 0 { - groupedMetrics[azure.NoDimension] = append(groupedMetrics[azure.NoDimension], metricName) - } else if azure.ContainsDimension(vmdim, *metricName.Dimensions) { - groupedMetrics[vmdim] = append(groupedMetrics[vmdim], metricName) - } else if azure.ContainsDimension(defaultSlotIDDimension, *metricName.Dimensions) { - groupedMetrics[defaultSlotIDDimension] = append(groupedMetrics[defaultSlotIDDimension], metricName) - } - } - for key, metricGroup := range groupedMetrics { - var metricNameList []string - for _, metricName := range metricGroup { - metricNameList = append(metricNameList, *metricName.Name.Value) - } - var dimensions []azure.Dimension - if key != azure.NoDimension { - dimensions = []azure.Dimension{{Name: key, Value: "*"}} - } - metrics = append(metrics, client.MapMetricByPrimaryAggregation(metricGroup, *resource.ID, "", metric.Namespace, dimensions, azure.DefaultTimeGrain)...) - } - } - } - return metrics, nil -} - -// mapResourceSize func will try to map if existing the resource size, for the vmss it seems that SKU is populated and resource size is mapped in the name -func mapResourceSize(resource resources.GenericResource) string { - if resource.Sku != nil && resource.Sku.Name != nil { - return *resource.Sku.Name - } - return "" -} diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper_test.go b/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper_test.go deleted file mode 100644 index 764cef2962b..00000000000 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/client_helper_test.go +++ /dev/null @@ -1,117 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package compute_vm_scaleset - -import ( - "testing" - - "github.com/Azure/azure-sdk-for-go/services/preview/monitor/mgmt/2019-06-01/insights" - "github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2019-03-01/resources" - "github.com/pkg/errors" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/mock" - - "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" -) - -func MockResource() resources.GenericResource { - id := "123" - name := "resourceName" - location := "resourceLocation" - rType := "resourceType" - skuName := "standard" - sku := resources.Sku{ - Name: &skuName, - } - return resources.GenericResource{ - ID: &id, - Name: &name, - Location: &location, - Type: &rType, - Sku: &sku, - } -} - -func MockMetricDefinitions() *[]insights.MetricDefinition { - metric1 := "TotalRequests" - metric2 := "Capacity" - metric3 := "BytesRead" - defs := []insights.MetricDefinition{ - { - Name: &insights.LocalizableString{Value: &metric1}, - PrimaryAggregationType: insights.Average, - SupportedAggregationTypes: &[]insights.AggregationType{insights.Maximum, insights.Count, insights.Total, insights.Average}, - }, - { - Name: &insights.LocalizableString{Value: &metric2}, - PrimaryAggregationType: insights.Average, - SupportedAggregationTypes: &[]insights.AggregationType{insights.Average, insights.Count, insights.Minimum}, - }, - { - Name: &insights.LocalizableString{Value: &metric3}, - PrimaryAggregationType: insights.Minimum, - SupportedAggregationTypes: &[]insights.AggregationType{insights.Average, insights.Count, insights.Minimum}, - }, - } - return &defs -} - -func TestMapMetric(t *testing.T) { - resource := MockResource() - metricDefinitions := insights.MetricDefinitionCollection{ - Value: MockMetricDefinitions(), - } - var emptyList []insights.MetricDefinition - emptyMetricDefinitions := insights.MetricDefinitionCollection{ - Value: &emptyList, - } - metricConfig := azure.MetricConfig{Name: []string{"*"}, Namespace: "namespace"} - var resourceConfig = azure.ResourceConfig{Metrics: []azure.MetricConfig{metricConfig}} - client := azure.NewMockClient() - t.Run("return error when the metric metric definition api call returns an error", func(t *testing.T) { - m := &azure.MockService{} - m.On("GetMetricDefinitions", mock.Anything, mock.Anything).Return(emptyMetricDefinitions, errors.New("invalid resource ID")) - client.AzureMonitorService = m - metric, err := mapMetrics(client, []resources.GenericResource{resource}, resourceConfig) - assert.Error(t, err) - assert.Equal(t, err.Error(), "no metric definitions were found for resource 123 and namespace namespace: invalid resource ID") - assert.Equal(t, metric, []azure.Metric(nil)) - m.AssertExpectations(t) - }) - t.Run("return error when no metric definitions were found", func(t *testing.T) { - m := &azure.MockService{} - m.On("GetMetricDefinitions", mock.Anything, mock.Anything).Return(emptyMetricDefinitions, nil) - client.AzureMonitorService = m - metric, err := mapMetrics(client, []resources.GenericResource{resource}, resourceConfig) - assert.Error(t, err) - assert.Equal(t, err.Error(), "no metric definitions were found for resource 123 and namespace namespace.") - assert.Equal(t, metric, []azure.Metric(nil)) - m.AssertExpectations(t) - }) - t.Run("return mapped metrics correctly", func(t *testing.T) { - m := &azure.MockService{} - m.On("GetMetricDefinitions", mock.Anything, mock.Anything).Return(metricDefinitions, nil) - client.AzureMonitorService = m - metrics, err := mapMetrics(client, []resources.GenericResource{resource}, resourceConfig) - assert.NoError(t, err) - assert.Equal(t, len(metrics), 2) - - assert.Equal(t, metrics[0].ResourceId, "123") - assert.Equal(t, metrics[0].Namespace, "namespace") - assert.Equal(t, metrics[1].ResourceId, "123") - assert.Equal(t, metrics[1].Namespace, "namespace") - assert.Equal(t, metrics[0].Dimensions, []azure.Dimension(nil)) - assert.Equal(t, metrics[1].Dimensions, []azure.Dimension(nil)) - - //order of elements can be different when running the test - if metrics[0].Aggregations == "Average" { - assert.Equal(t, metrics[0].Names, []string{"TotalRequests", "Capacity"}) - } else { - assert.Equal(t, metrics[0].Names, []string{"BytesRead"}) - assert.Equal(t, metrics[0].Aggregations, "Minimum") - } - m.AssertExpectations(t) - }) -} diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset.go b/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset.go deleted file mode 100644 index b2755eeabf0..00000000000 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset.go +++ /dev/null @@ -1,73 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package compute_vm_scaleset - -import ( - "fmt" - - "github.com/elastic/beats/v7/metricbeat/mb" - "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" -) - -// init registers the MetricSet with the central registry as soon as the program -// starts. The New function will be called later to instantiate an instance of -// the MetricSet for each host defined in the module's configuration. After the -// MetricSet has been created then Fetch will begin to be called periodically. -func init() { - mb.Registry.MustAddMetricSet("azure", "compute_vm_scaleset", New) -} - -// MetricSet holds any configuration or state information. It must implement -// the mb.MetricSet interface. And this is best achieved by embedding -// mb.BaseMetricSet because it implements all of the required mb.MetricSet -// interface methods except for Fetch. -type MetricSet struct { - *azure.MetricSet -} - -const ( - defaultVMScalesetNamespace = "Microsoft.Compute/virtualMachineScaleSets" - customVMNamespace = "Azure.VM.Windows.GuestMetrics" -) - -var memoryMetrics = []string{"Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"} - -// New creates a new instance of the MetricSet. New is responsible for unpacking -// any MetricSet specific configuration options if there are any. -func New(base mb.BaseMetricSet) (mb.MetricSet, error) { - ms, err := azure.NewMetricSet(base) - if err != nil { - return nil, err - } - // if no options are entered we will retrieve all the vm's from the entire subscription - if len(ms.Client.Config.Resources) == 0 { - ms.Client.Config.Resources = []azure.ResourceConfig{ - { - Query: fmt.Sprintf("resourceType eq '%s'", defaultVMScalesetNamespace), - }, - } - } - for index := range ms.Client.Config.Resources { - // add the default vm scaleset type if groups are defined - if len(ms.Client.Config.Resources[index].Group) > 0 { - ms.Client.Config.Resources[index].Type = defaultVMScalesetNamespace - } - // add the default metrics for each resource option - ms.Client.Config.Resources[index].Metrics = []azure.MetricConfig{ - { - Name: []string{"*"}, - Namespace: defaultVMScalesetNamespace, - }, - { - Name: memoryMetrics, - Namespace: customVMNamespace, - }, - } - } - ms.MapMetrics = mapMetrics - return &MetricSet{ - MetricSet: ms, - }, nil -} diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_integration_test.go b/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_integration_test.go index 7403203ad12..0a4a8df5e6b 100644 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_integration_test.go +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_integration_test.go @@ -15,6 +15,9 @@ import ( "github.com/stretchr/testify/assert" mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/monitor" ) func TestFetchMetricset(t *testing.T) { diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_test.go b/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_test.go index d82ea953140..2c5c7f04c8f 100644 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_test.go +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/compute_vm_scaleset_test.go @@ -5,69 +5,13 @@ package compute_vm_scaleset import ( - "fmt" - "testing" + "os" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" - - "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/metricbeat/mb" ) -var ( - missingResourcesConfig = common.MapStr{ - "module": "azure", - "period": "60s", - "metricsets": []string{"compute_vm_scaleset"}, - "client_secret": "unique identifier", - "client_id": "unique identifier", - "subscription_id": "unique identifier", - "tenant_id": "unique identifier", - } - - resourceConfig = common.MapStr{ - "module": "azure", - "period": "60s", - "metricsets": []string{"compute_vm_scaleset"}, - "client_secret": "unique identifier", - "client_id": "unique identifier", - "subscription_id": "unique identifier", - "tenant_id": "unique identifier", - "resources": []common.MapStr{ - { - "resource_id": "test", - "metrics": []map[string]interface{}{ - { - "name": []string{"*"}, - }}, - }}, - } -) - -func TestFetch(t *testing.T) { - c, err := common.NewConfigFrom(missingResourcesConfig) - if err != nil { - t.Fatal(err) - } - module, metricsets, err := mb.NewModule(c, mb.Registry) - assert.NotNil(t, module) - assert.NotNil(t, metricsets) - assert.NoError(t, err) - ms, ok := metricsets[0].(*MetricSet) - assert.Equal(t, len(ms.Client.Config.Resources), 1) - assert.Equal(t, ms.Client.Config.Resources[0].Query, fmt.Sprintf("resourceType eq '%s'", defaultVMScalesetNamespace)) - c, err = common.NewConfigFrom(resourceConfig) - if err != nil { - t.Fatal(err) - } - module, metricsets, err = mb.NewModule(c, mb.Registry) - if err != nil { - t.Fatal(err) - } - assert.NotNil(t, module) - assert.NotNil(t, metricsets) - ms, ok = metricsets[0].(*MetricSet) - require.True(t, ok, "metricset must be MetricSet") - assert.NotNil(t, ms) +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) } diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml b/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml new file mode 100644 index 00000000000..9369a36b79e --- /dev/null +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml @@ -0,0 +1,66 @@ +default: false +input: + module: azure + metricset: monitor + defaults: + default_resource_type: "Microsoft.Compute/virtualMachineScaleSets" + add_cloud_metadata: true + resources: + - resource_group: "" + resource_type: "Microsoft.Compute/virtualMachineScaleSets" + metrics: + - name: ["CPU Credits Remaining", "CPU Credits Consumed", "OS Per Disk Read Bytes/sec", "OS Per Disk Write Bytes/sec", "OS Per Disk Read Operations/Sec", "OS Per Disk Write Operations/Sec", "OS Per Disk QD"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + - name: ["Per Disk Read Bytes/sec", "Per Disk Write Bytes/sec", "Per Disk Read Operations/Sec", "Per Disk Write Operations/Sec", "Per Disk QD"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + dimensions: + - name: "SlotId" + value: "*" + - name: ["Network In", "Percentage CPU", "Network Out", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Network Out Total", + "Network In Total", "VM Uncached IOPS Consumed Percentange", "VM Uncached Bandwidth Consumed Percentange", "VM Cached IOPS Consumed Percentange", "VM Cached Bandwidth Consumed Percentange", "Premium OS Disk Cache Read Miss", + "Premium OS Disk Cache Read Hit", "Premium Data Disk Cache Read Miss", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage", + "Premium Data Disk Cache Read Hit", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", "OS Disk IOPS Consumed Percentage", "OS Disk Bandwidth Consumed Percentage", + "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec", "Data Disk IOPS Consumed Percentage"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + dimensions: + - name: "VMName" + value: "*" + - name: ["Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"] + namespace: "Azure.VM.Windows.GuestMetrics" + timegrain: "PT5M" + dimensions: + - name: "VirtualMachine" + value: "*" + ignore_unsupported: true + - resource_id: "" + timegrain: "PT5M" + metrics: + - name: ["CPU Credits Remaining", "CPU Credits Consumed", "OS Per Disk Read Bytes/sec", "OS Per Disk Write Bytes/sec", "OS Per Disk Read Operations/Sec", "OS Per Disk Write Operations/Sec", "OS Per Disk QD"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + - name: ["Per Disk Read Bytes/sec", "Per Disk Write Bytes/sec", "Per Disk Read Operations/Sec", "Per Disk Write Operations/Sec", "Per Disk QD"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + dimensions: + - name: "SlotId" + value: "*" + - name: ["Network In", "Percentage CPU", "Network Out", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Network Out Total", + "Network In Total", "VM Uncached IOPS Consumed Percentange", "VM Uncached Bandwidth Consumed Percentange", "VM Cached IOPS Consumed Percentange", "VM Cached Bandwidth Consumed Percentange", "Premium OS Disk Cache Read Miss", + "Premium OS Disk Cache Read Hit", "Premium Data Disk Cache Read Miss", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage", + "Premium Data Disk Cache Read Hit", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", "OS Disk IOPS Consumed Percentage", "OS Disk Bandwidth Consumed Percentage", + "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec", "Data Disk IOPS Consumed Percentage"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + timegrain: "PT5M" + dimensions: + - name: "VMName" + value: "*" + - name: ["Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"] + namespace: "Azure.VM.Windows.GuestMetrics" + timegrain: "PT5M" + dimensions: + - name: "VirtualMachine" + value: "*" + ignore_unsupported: true diff --git a/x-pack/metricbeat/module/azure/data.go b/x-pack/metricbeat/module/azure/data.go index d0ba18fdc36..bf77f657416 100644 --- a/x-pack/metricbeat/module/azure/data.go +++ b/x-pack/metricbeat/module/azure/data.go @@ -58,7 +58,7 @@ func EventsMapping(metrics []Metric, client *Client, report mb.ReporterV2) error // grouping metric values by timestamp and creating events (for each metric the REST api can retrieve multiple metric values for same aggregation but different timeframes) for _, grouped := range groupByDimensions { defaultMetric := grouped[0] - resource := client.GetResourceForData(defaultMetric.ResourceId) + resource := client.GetResourceForMetaData(defaultMetric) groupByTimeMetrics := make(map[time.Time][]MetricValue) for _, metric := range grouped { for _, m := range metric.Values { @@ -68,6 +68,7 @@ func EventsMapping(metrics []Metric, client *Client, report mb.ReporterV2) error for timestamp, groupTimeValues := range groupByTimeMetrics { var event mb.Event var metricList common.MapStr + var vm VmResource // group events by dimension values exists, validDimensions := returnAllDimensions(defaultMetric.Dimensions) if exists { @@ -79,13 +80,18 @@ func EventsMapping(metrics []Metric, client *Client, report mb.ReporterV2) error } for _, groupDimValues := range groupByDimensions { event, metricList = createEvent(timestamp, defaultMetric, resource, groupDimValues) + if client.Config.AddCloudMetadata { + vm = client.GetVMForMetaData(&resource, groupDimValues) + addCloudVMMetadata(&event, vm) + } } } } else { event, metricList = createEvent(timestamp, defaultMetric, resource, groupTimeValues) - } - if client.Config.AddCloudMetadata { - addCloudVMMetadata(&event, resource) + if client.Config.AddCloudMetadata { + vm = client.GetVMForMetaData(&resource, groupTimeValues) + addCloudVMMetadata(&event, vm) + } } if client.Config.DefaultResourceType == "" { event.ModuleFields.Put("metrics", metricList) @@ -208,6 +214,7 @@ func createEvent(timestamp time.Time, metric Metric, resource Resource, metricVa } } addHostMetadata(&event, metricList) + return event, metricList } diff --git a/x-pack/metricbeat/module/azure/module.yml b/x-pack/metricbeat/module/azure/module.yml index d7e4831e203..a51b202612b 100644 --- a/x-pack/metricbeat/module/azure/module.yml +++ b/x-pack/metricbeat/module/azure/module.yml @@ -5,3 +5,4 @@ metricsets: - container_service - database_account - compute_vm + - compute_vm_scaleset diff --git a/x-pack/metricbeat/module/azure/resources.go b/x-pack/metricbeat/module/azure/resources.go index ba2c93b4618..0a723c82bd5 100644 --- a/x-pack/metricbeat/module/azure/resources.go +++ b/x-pack/metricbeat/module/azure/resources.go @@ -18,12 +18,15 @@ type Resource struct { Tags map[string]string Subscription string Type string - Vm VmResource + // will be filled if cloud data is necessary, atm only in case of compute_vm and compute_vm_scaleset + Vms []VmResource } +// VmResource contains details specific to a vm type of resource type VmResource struct { Size string Id string + Name string } // Metric will contain the main azure metric details From d14c6a1003609261bc247b8f64791d2428e2850f Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Tue, 15 Sep 2020 12:37:49 -0500 Subject: [PATCH 004/216] [Filebeat] add panos type and sub_type (#20912) * add panos type and sub_type - add panw.panos.type - add panw.panos.sub_type --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 14 ++ x-pack/filebeat/module/panw/fields.go | 2 +- .../module/panw/panos/_meta/fields.yml | 6 + .../module/panw/panos/config/input.yml | 9 +- .../module/panw/panos/ingest/pipeline.yml | 66 +++--- .../test/pan_inc_other.log-expected.json | 68 ++++++ .../test/pan_inc_threat.log-expected.json | 200 ++++++++++++++++++ .../test/pan_inc_traffic.log-expected.json | 200 ++++++++++++++++++ .../panw/panos/test/threat.log-expected.json | 152 +++++++++++++ .../panw/panos/test/traffic.log-expected.json | 199 +++++++++++++++++ 11 files changed, 879 insertions(+), 38 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 90df1fbbd35..509722bb7e4 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -563,6 +563,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Improve Santa module with `x509` ECS mappings {pull}20976[20976] - Improve Suricata Eve module with `x509` ECS mappings {pull}20973[20973] - Added new module for Zoom webhooks {pull}20414[20414] +- Add type and sub_type to panw panos fileset {pull}20912[20912] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 8ec5edb4c9d..96c30c88871 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -96109,6 +96109,20 @@ type: keyword -- +*`panw.panos.type`*:: ++ +-- +Specifies the type of the log + +-- + +*`panw.panos.sub_type`*:: ++ +-- +Specifies the sub type of the log + +-- + [[exported-fields-postgresql]] == PostgreSQL fields diff --git a/x-pack/filebeat/module/panw/fields.go b/x-pack/filebeat/module/panw/fields.go index 313130fb135..927d5d4f226 100644 --- a/x-pack/filebeat/module/panw/fields.go +++ b/x-pack/filebeat/module/panw/fields.go @@ -19,5 +19,5 @@ func init() { // AssetPanw returns asset data. // This is the base64 encoded gzipped contents of module/panw. func AssetPanw() string { - return "eJzMmE1v4zYQhu/5FXNzC8S59ZJDgbSLAAHS1NjdoMcFTY4s1hRHOxzF1f76grQsa2060jrZILpZCvk+8/HyI3NYY3sNtfKbCwCx4rD/ZTBotrVY8tfw+wUAwF9kGodQEMNCOYIbJwQPKBvidYBfFjcP878//XoBUFh0JlynQXPwqtpPGx9pa7yGFVNTd28yYvG5TfNAwVSBlJjmgCpRXHV/NJSCAz0K+9c51eekv9MnTvKZoLcxg6NVuBqOPcIakHHjMKB8L9XhrbHdEJuDb88xAsCDqhCoSIxxcpBSCVRKdIkGpLQBAoZgyV9lgQI1rDHLc5SucZouaUKA/wl6k7CE6rnDJ3SdGNDyX9RydTA6l7Yh6Tfyh5xjuZtAHJ9PW6wo0NX7VNaGPNYLcqGOkve6UL3KD5B5ddhg8GxRJxItKMj84ebzrozKGMYQLsEWu1fxqw1QIxfEFZpjxtN1HmQ2B7gL4MTHCfzHEdwtcoD9KkKcy+MOxJFfvR5KFNvDZK1qMIj1Ks77Rn4dKL47034YsL0v5w7J3qN9h1Udenj4/mVGHrXyiJkneuhETHlXT/D1qLNfxjXB4ugNowonDH7WAeFzPBikOUHteg8EuYpYw8Jmgfz2sPNG602nduZaU2tVf7E5076CqRdKr1FAq1oaRrj7kAytQEpGdaqs8EJXT3GYpqpqvJU2H/qU8CemID5/7tRSBhxt5qUKZX9Kji3/21yaen9IP9FYhXVvdeqMUme2VAzuvH75w3rFLfTZ2XXKliagl8i7RFBeufYb5uuybFMs/1hnbi3HcfxkNebWt3yRs7lv2L1R6ht2Z2ZeK8EVcftz3Hyb+jXV4/Hjfdz+ZBYS++PH+147v43EsbuCXKYxT8jGaoG4sJa4rbDyBmzIToBWSmSYVcpZbakJs0uYrVi1G8U4uwRimC3R25WfjZnI0ebY9i/YLO7iccUrB76pkK0Ga9CLLSxy6mJUujw+wOQvlvi1Qa/xi2+qJXKWMbPRjgDe0wrQC7dDsnTltQGs14wVekHTyYtVzmXq+Ojt1wb3ITlaJaSRmLrFnvGZW/NZeY9dR7ztnCg1ZXM5gHrNNsj8s+OgEZLNf4Au/vipfH3WcmRDIKVPXqCmsMyPYG7ShCBqjb4n6D3yfwAAAP//PRbQnA==" + return "eJzMmM9u4zYQxu95irm5BeLcesmhQNpFgABpamw26DGgqbHEmuJoh6O42qcvSEu21qJtxU6C6GbJ5PebPx9JaQpLbK6hUm51ASBGLG5+Zeg1m0oMuWv4/QIA4C/KaouwIIaZsgQ3VggeUFbESw+/zG4epn8//noBsDBoM38dB03BqXI7bbikqfAacqa6au8kxMJ1G+eBBVMJUmCcA8pIcdX+qS8FO3rkt7dTqoekf9InjvKJoNcxg6XcX/XHDrB6ZFxb9Cg/S7V4S2xWxNnOs0OMAPCgSgRaRMYwOUihBEolusAMpDAePHpvyF0lgTzVrDHJM0jXcZo2aUKA/wm6LGIJVVOLL2hbMaD5v6jlamd0Km190h/kdjmP5W4Ecbge11hBoK33vqz1eYwT5IUaJO9toTYqryBzarfB4GBRRxLNyMv04eZbV0aVZYzeX4JZdLfCU+OhQl4Ql5gNGffXuZfZFGAXwJ6HI/iHEdzNUoCbVYQ4lccOxJLL3w4liG1hklbN0ItxKsz7QX7tKX46037psX0u5/bJPqN9+1Xte7h//zwjH7XyETOP9NCemNKuHuHro84+j2uExdFljMrvMfhJB4Rv4WAQ5wTV9R4Ichmw+oVNArn1YeeD1ptW7cS1ptKqejYp076BqWdKL1FAq0pqRrj7Eg2tQApGta+scKarxzhMU1nWzkiTDn1M+CNTEK4/O7WYAUuraaF8sTklh5b/bSp1tT2k72mshbEfdeoMUie2VAjutH75wzjFDWyy03XKmsajk8A7R1BO2eYHpusyb2Is/xib3RoO4/jFaEytb+kiJ3Nfs/2g1NdsT8y8VoI5cfM+br6N/Rrr8fT1Pmx/MvGR/enr/UY7vY2EsV1BLuOYF+TMaIGwsBa4rrByGRifnACNFMgwKZU12lDtJ5cwyVk1K8U4uQRimMzRmdxNjpnI0mpo+zM2i7twXHHKgqtLZKPBZOjELAxy7GJUuhgeYNIvlvi9Rqfx2dXlHDnJmNhojwDeUw7ohJs+WXzlNR6M04wlOsGslRejrE3U8cmZ7zVuQ7KUR6QjMbWLPeOBt+aT8h66jnjdOUFqzOayA/WWbZD42LHTCNHmr6ALP96Vb5O1FFkfSOm9L1BjWKYDmJs4IYhaotsQHPzmEtReKfJYoQ7ZXy9SYYLuo4+lPO2/ev58tpCv5wOx/wMAAP//TA8GjA==" } diff --git a/x-pack/filebeat/module/panw/panos/_meta/fields.yml b/x-pack/filebeat/module/panw/panos/_meta/fields.yml index 1508ec99aef..490befc3e65 100644 --- a/x-pack/filebeat/module/panw/panos/_meta/fields.yml +++ b/x-pack/filebeat/module/panw/panos/_meta/fields.yml @@ -136,3 +136,9 @@ type: keyword description: >- Action taken for the session. + - name: type + description: >- + Specifies the type of the log + - name: sub_type + description: >- + Specifies the sub type of the log diff --git a/x-pack/filebeat/module/panw/panos/config/input.yml b/x-pack/filebeat/module/panw/panos/config/input.yml index eece005ad00..ed3d089bb28 100644 --- a/x-pack/filebeat/module/panw/panos/config/input.yml +++ b/x-pack/filebeat/module/panw/panos/config/input.yml @@ -35,17 +35,18 @@ processors: - extract_array: field: csv overwrite_keys: true + omit_empty: true mappings: event.created: 1 observer.serial_number: 2 - _temp_.message_type: 3 - _temp_.message_subtype: 4 + panw.panos.type: 3 + panw.panos.sub_type: 4 _temp_.generated_time: 6 - extract_array: when: equals: - _temp_.message_type: TRAFFIC + panw.panos.type: TRAFFIC field: csv overwrite_keys: true omit_empty: true @@ -107,7 +108,7 @@ processors: - extract_array: when: equals: - _temp_.message_type: THREAT + panw.panos.type: THREAT field: csv omit_empty: true overwrite_keys: true diff --git a/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml b/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml index 6e4b7f64d61..412ddeb5c58 100644 --- a/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml +++ b/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml @@ -134,72 +134,72 @@ processors: - set: field: network.direction value: inbound - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone == "trust"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone == "trust"' - set: field: network.direction value: outbound - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "untrust"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "untrust"' - set: field: network.direction value: internal - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "trust"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "trust" && ctx?.panw?.panos?.destination?.zone == "trust"' - set: field: network.direction value: external - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone == "untrust"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.panw?.panos?.source?.zone == "untrust" && ctx?.panw?.panos?.destination?.zone == "untrust"' - set: field: network.direction value: unknown - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ((ctx?.panw?.panos?.source?.zone != "trust" && ctx?.panw?.panos?.source?.zone != "untrust") || (ctx?.panw?.panos?.destination?.zone != "trust" && ctx?.panw?.panos?.destination?.zone != "untrust"))' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ((ctx?.panw?.panos?.source?.zone != "trust" && ctx?.panw?.panos?.source?.zone != "untrust") || (ctx?.panw?.panos?.destination?.zone != "trust" && ctx?.panw?.panos?.destination?.zone != "untrust"))' # Set network.direction from threat direction (Threat logs). - set: field: network.direction value: inbound - if: 'ctx?._temp_?.message_type == "THREAT" && (ctx?._temp_?.direction == "0" || ctx?._temp_?.direction == "client-to-server")' + if: 'ctx?.panw?.panos?.type == "THREAT" && (ctx?._temp_?.direction == "0" || ctx?._temp_?.direction == "client-to-server")' - set: field: network.direction value: outbound - if: 'ctx?._temp_?.message_type == "THREAT" && (ctx?._temp_?.direction == "1" || ctx?._temp_?.direction == "server-to-client")' + if: 'ctx?.panw?.panos?.type == "THREAT" && (ctx?._temp_?.direction == "1" || ctx?._temp_?.direction == "server-to-client")' - set: field: network.direction value: unknown - if: 'ctx?._temp_?.message_type == "THREAT" && ctx?.network?.direction == null' + if: 'ctx?.panw?.panos?.type == "THREAT" && ctx?.network?.direction == null' # Set network.type for TRAFFIC. - set: field: network.type value: 'ipv4' - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.labels?.ipv6_session == null' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.labels?.ipv6_session == null' - set: field: network.type value: 'ipv6' - if: 'ctx?._temp_?.message_type == "TRAFFIC" && ctx?.labels?.ipv6_session != null' + if: 'ctx?.panw?.panos?.type == "TRAFFIC" && ctx?.labels?.ipv6_session != null' # Set event.category depending on log type. - set: field: event.kind value: event - if: 'ctx?._temp_?.message_type == "TRAFFIC"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC"' - append: field: event.category value: - network_traffic - network - if: 'ctx?._temp_?.message_type == "TRAFFIC"' + if: 'ctx?.panw?.panos?.type == "TRAFFIC"' - set: field: event.kind value: alert - if: 'ctx?._temp_?.message_type == "THREAT"' + if: 'ctx?.panw?.panos?.type == "THREAT"' - append: field: event.category value: - security_threat - intrusion_detection - network - if: 'ctx?._temp_?.message_type == "THREAT"' + if: 'ctx?.panw?.panos?.type == "THREAT"' - append: field: event.type value: allowed @@ -217,89 +217,89 @@ processors: - set: field: event.action value: flow_started - if: 'ctx?._temp_?.message_subtype == "start"' + if: 'ctx?.panw?.panos?.sub_type == "start"' - append: field: event.type value: - start - connection - if: 'ctx?._temp_?.message_subtype == "start"' + if: 'ctx?.panw?.panos?.sub_type == "start"' - set: field: event.action value: flow_terminated - if: 'ctx?._temp_?.message_subtype == "end"' + if: 'ctx?.panw?.panos?.sub_type == "end"' - append: field: event.type value: - end - connection - if: 'ctx?._temp_?.message_subtype == "end"' + if: 'ctx?.panw?.panos?.sub_type == "end"' - set: field: event.action value: flow_dropped - if: 'ctx?._temp_?.message_subtype == "drop"' + if: 'ctx?.panw?.panos?.sub_type == "drop"' - append: field: event.type value: - denied - connection - if: 'ctx?._temp_?.message_subtype == "drop"' + if: 'ctx?.panw?.panos?.sub_type == "drop"' - set: field: event.action value: flow_denied - if: 'ctx?._temp_?.message_subtype == "deny"' + if: 'ctx?.panw?.panos?.sub_type == "deny"' - append: field: event.type value: - denied - connection - if: 'ctx?._temp_?.message_subtype == "deny"' + if: 'ctx?.panw?.panos?.sub_type == "deny"' # event.action for threat logs. - set: field: event.action value: data_match - if: 'ctx?._temp_?.message_subtype == "data"' + if: 'ctx?.panw?.panos?.sub_type == "data"' - set: field: event.action value: file_match - if: 'ctx?._temp_?.message_subtype == "file"' + if: 'ctx?.panw?.panos?.sub_type == "file"' - set: field: event.action value: flood_detected - if: 'ctx?._temp_?.message_subtype == "flood"' + if: 'ctx?.panw?.panos?.sub_type == "flood"' - set: field: event.action value: packet_attack - if: 'ctx?._temp_?.message_subtype == "packet"' + if: 'ctx?.panw?.panos?.sub_type == "packet"' - set: field: event.action value: scan_detected - if: 'ctx?._temp_?.message_subtype == "scan"' + if: 'ctx?.panw?.panos?.sub_type == "scan"' - set: field: event.action value: spyware_detected - if: 'ctx?._temp_?.message_subtype == "spyware"' + if: 'ctx?.panw?.panos?.sub_type == "spyware"' - set: field: event.action value: url_filtering - if: 'ctx?._temp_?.message_subtype == "url"' + if: 'ctx?.panw?.panos?.sub_type == "url"' - set: field: event.action value: virus_detected - if: 'ctx?._temp_?.message_subtype == "virus"' + if: 'ctx?.panw?.panos?.sub_type == "virus"' - set: field: event.action value: exploit_detected - if: 'ctx?._temp_?.message_subtype == "vulnerability"' + if: 'ctx?.panw?.panos?.sub_type == "vulnerability"' - set: field: event.action value: wildfire_verdict - if: 'ctx?._temp_?.message_subtype == "wildfire"' + if: 'ctx?.panw?.panos?.sub_type == "wildfire"' - set: field: event.action value: wildfire_virus_detected - if: 'ctx?._temp_?.message_subtype == "wildfire-virus"' + if: 'ctx?.panw?.panos?.sub_type == "wildfire-virus"' # Set numeric log.level from event.severity. diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json index c4d59a09d91..96530ab70f3 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json @@ -13,6 +13,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -33,6 +35,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -53,6 +57,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -73,6 +79,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -93,6 +101,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -113,6 +123,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -133,6 +145,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -153,6 +167,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -173,6 +189,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -193,6 +211,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -213,6 +233,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -233,6 +255,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -253,6 +277,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -273,6 +299,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -293,6 +321,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "general", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -313,6 +343,8 @@ "observer.serial_number": "1606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "general", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -333,6 +365,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "general", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -353,6 +387,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -373,6 +409,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -393,6 +431,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -413,6 +453,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -433,6 +475,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -453,6 +497,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "general", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -473,6 +519,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -493,6 +541,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -513,6 +563,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "routing", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -533,6 +585,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -553,6 +607,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -573,6 +629,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -593,6 +651,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "0", + "panw.panos.type": "CONFIG", "service.type": "panw", "tags": [ "pan-os", @@ -613,6 +673,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "general", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -633,6 +695,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "ras", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -653,6 +717,8 @@ "observer.serial_number": "01606001116", "observer.type": "firewall", "observer.vendor": "Palo Alto Networks", + "panw.panos.sub_type": "vpn", + "panw.panos.type": "SYSTEM", "service.type": "panw", "tags": [ "pan-os", @@ -730,6 +796,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json index 6f61cf168de..37735ccfce0 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json @@ -62,9 +62,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lorexx.cn/loader.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -154,9 +156,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lsiu.info/evo/count.php?o=2", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -246,9 +250,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lsiu.info/evo/count.php?o=5", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -338,9 +344,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lsiu.info/evo/count.php?o=7", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -430,9 +438,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lsiu.info/evo/exploits/x18.php?o=2&t=1241403746&i=1365814122", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -522,9 +532,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lsiu.info/evo/exploits/x19.php?o=2&t=1241403746&i=1365814122", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -614,9 +626,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "liteautobestguide.cn/load.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -706,9 +720,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "liteautobestguide.cn/index.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -798,9 +814,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "litetopdetect.cn/index.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -890,9 +908,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "lkmpmlm.com/fff9999.php?aid=0&uid=6cbbc5081e7548e276611ff5059df6ed30c8f8f1&os=513", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -982,9 +1002,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "girlteenxxxfreemov.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1074,9 +1096,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "imagesrepository.com/resolution.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1166,9 +1190,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "hottestfiles.com/search/search.php?q=xxx", + "panw.panos.type": "THREAT", "panw.panos.url.category": "search-engines", "related.ip": [ "192.168.0.2", @@ -1257,9 +1283,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "infodist1.com/in.cgi?11¶meter=404", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -1349,9 +1377,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "cls-softwares.com/suc.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1441,9 +1471,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "cls-softwares.com/softwarefortubeview.40013.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1529,9 +1561,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "findmorepill.com/klik/search.php?q=xxx", + "panw.panos.type": "THREAT", "panw.panos.url.category": "online-gambling", "related.ip": [ "192.168.0.2", @@ -1621,9 +1655,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "allowedwebsurfing.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1713,9 +1749,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "antivirus-remote.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1805,9 +1843,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "bklinkov.ru/hi/start.cfg", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1897,9 +1937,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "blogsexnakedgirlxxx.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -1989,9 +2031,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "bklinkov.ru/hi/start.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -2081,9 +2125,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2173,9 +2219,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2265,9 +2313,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2357,9 +2407,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2449,9 +2501,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2541,9 +2595,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2633,9 +2689,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2725,9 +2783,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2817,9 +2877,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2909,9 +2971,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -3001,9 +3065,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "-/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -3089,9 +3155,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "wantfinest.com/tds/in.cgi?default", + "panw.panos.type": "THREAT", "panw.panos.url.category": "unknown", "related.ip": [ "192.168.0.2", @@ -3177,9 +3245,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "sameshitasiteverwas.com/traf/tds/in.cgi?2", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -3265,9 +3335,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "svarkon.ru/update.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -3356,9 +3428,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "onlinescanxpp.com/land/eurl/1.php?code=", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -3444,9 +3518,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "nolagtime.com/conn/?JKV_1RWbUUdIfRUWUaITfdIfbREdYEYdfTTRI-6XBB_1WQR-6GF5_1AU-6LC6_1Y-gW-gEUQQ-gE-tsDF6K5D_rpX51_rR-t-66FC_1Q_fQ_fQ_fQ_fQ_fQ_fQ_fQ-62BG_1Q-672V_1YOR-6N8J_1Q-6252_1WQRR-69LV_1-65GZ_1W-6", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -3532,9 +3608,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "nolagtime.com/gwc.txt", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -3623,9 +3701,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "karavan.us/bon/index.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "unknown", "related.ip": [ "192.168.0.2", @@ -3711,9 +3791,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "findnolimits.com/go.php?sid=1", + "panw.panos.type": "THREAT", "panw.panos.url.category": "dead-sites", "related.ip": [ "192.168.0.2", @@ -3799,9 +3881,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "bizoplata.ru/moun.html", + "panw.panos.type": "THREAT", "panw.panos.url.category": "parked-domains", "related.ip": [ "192.168.0.2", @@ -3887,9 +3971,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "bizoplata.ru/palast.html", + "panw.panos.type": "THREAT", "panw.panos.url.category": "parked-domains", "related.ip": [ "192.168.0.2", @@ -3966,9 +4052,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "spyware", "panw.panos.threat.id": "13024", "panw.panos.threat.name": "Bredolab.Gen Command and Control Traffic", "panw.panos.threat.resource": "controller.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "204.232.231.46", @@ -4066,9 +4154,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "www.15min.it/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4154,9 +4244,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "tubemov.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "adult-and-pornography", "related.ip": [ "192.168.0.2", @@ -4242,9 +4334,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "pagesinxt.com/?dn=teenstube.us&flrdr=yes&nxte=js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4330,9 +4424,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "movfree.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "spyware-and-adware", "related.ip": [ "192.168.0.2", @@ -4421,9 +4517,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "gometascan.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4512,9 +4610,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "antivirus-powerful-scannerv2.com/download/Install_11-1.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4603,9 +4703,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "antivirus-powerful-scannerv2.com/1/?id=11-1&back==TQzyDTyMUQNMI=N", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4694,9 +4796,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "basdzsdas.com/poker/config.bin", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4785,9 +4889,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "basdzsdas.com/poker/config.bin", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -4867,9 +4973,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "uLLGRaXP.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "173.236.179.57", @@ -4967,9 +5075,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "basdzsdas.com/poker/config.bin", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5049,9 +5159,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "FunkyEmoticons_setup.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "91.209.163.202", @@ -5140,9 +5252,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "52hxw.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "122.226.169.183", @@ -5239,9 +5353,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "softsellfast.com/test/config.bin", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5321,9 +5437,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "setup.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "109.201.131.15", @@ -5409,9 +5527,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "Live-Player_setup.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "91.209.163.202", @@ -5506,9 +5626,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "boialex.narod.ru/config.txt", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5594,9 +5716,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "edw-melon.narod.ru/config.txt", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5682,9 +5806,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "maximtushin.narod.ru/config.txt", + "panw.panos.type": "THREAT", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5764,9 +5890,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "uLLGRaXP.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "173.236.179.57", @@ -5864,9 +5992,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "marketingsoluchion.biz/fkn/config.bin", + "panw.panos.type": "THREAT", "panw.panos.url.category": "unknown", "related.ip": [ "192.168.0.2", @@ -5955,9 +6085,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "default.aspx", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.6", @@ -6037,9 +6169,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "sck.aspx", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "65.54.161.34", @@ -6128,9 +6262,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "ADSAdClient31.dll", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "65.55.5.231", @@ -6228,9 +6364,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "c.gif", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.6", @@ -6310,9 +6448,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "csi", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.239.17", @@ -6404,9 +6544,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "internal-tuner.pandora.com", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6486,9 +6628,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.198", @@ -6574,9 +6718,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "file", "panw.panos.threat.id": "52020", "panw.panos.threat.name": "Windows Executable (EXE)", "panw.panos.threat.resource": "about.exe", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "188.190.124.75", @@ -6665,9 +6811,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -6753,9 +6901,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.239.3", @@ -6841,9 +6991,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.239.3", @@ -6929,9 +7081,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -7023,9 +7177,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "__utm.gif", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7105,9 +7261,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.193", @@ -7193,9 +7351,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "nav_logo107.png", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.239.20", @@ -7281,9 +7441,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "Eadweard_Muybridge", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "208.80.154.225", @@ -7369,9 +7531,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "load.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "208.80.154.234", @@ -7457,9 +7621,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "8fe44cb728c0f40750c64ee906eb72.css", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "65.54.75.25", @@ -7548,9 +7714,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.206", @@ -7636,9 +7804,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.195", @@ -7724,9 +7894,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "appcast.xml", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "207.178.96.34", @@ -7815,9 +7987,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.195", @@ -7903,9 +8077,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "csi", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.239.20", @@ -7991,9 +8167,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "index.php", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "66.152.109.24", @@ -8082,9 +8260,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -8176,9 +8356,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "__utm.gif", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8258,9 +8440,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -8346,9 +8530,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -8440,9 +8626,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "internal-tuner.pandora.com", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8522,9 +8710,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.201", @@ -8610,9 +8800,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.201", @@ -8698,9 +8890,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -8786,9 +8980,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", @@ -8874,9 +9070,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "ga.js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.198", @@ -8962,9 +9160,11 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "data", "panw.panos.threat.id": "60000", "panw.panos.threat.name": "PII", "panw.panos.threat.resource": "js", + "panw.panos.type": "THREAT", "panw.panos.url.category": "any", "related.ip": [ "74.125.224.200", diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json index 11116597ea6..587b481636f 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json @@ -70,6 +70,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -166,6 +168,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -262,6 +266,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -361,6 +367,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -460,6 +468,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -556,6 +566,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -652,6 +664,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -751,6 +765,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -850,6 +866,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -949,6 +967,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -1048,6 +1068,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1147,6 +1169,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1246,6 +1270,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1345,6 +1371,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1444,6 +1472,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -1543,6 +1573,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -1642,6 +1674,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -1741,6 +1775,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1840,6 +1876,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -1936,6 +1974,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2032,6 +2072,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2131,6 +2173,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2227,6 +2271,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2326,6 +2372,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2425,6 +2473,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "private-ip-addresses", "related.ip": [ "192.168.0.2", @@ -2524,6 +2574,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2620,6 +2672,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2716,6 +2770,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2815,6 +2871,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -2914,6 +2972,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3010,6 +3070,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3109,6 +3171,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "search-engines", "related.ip": [ "192.168.0.2", @@ -3208,6 +3272,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3304,6 +3370,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3400,6 +3468,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3499,6 +3569,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3598,6 +3670,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3694,6 +3768,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3790,6 +3866,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -3884,6 +3962,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.100", @@ -3975,6 +4055,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "entertainment-and-arts", "related.ip": [ "192.168.0.2", @@ -4072,6 +4154,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-security", "related.ip": [ "192.168.0.100", @@ -4166,6 +4250,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4265,6 +4351,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4359,6 +4447,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.100", @@ -4453,6 +4543,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4549,6 +4641,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4648,6 +4742,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4744,6 +4840,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4840,6 +4938,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -4936,6 +5036,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5032,6 +5134,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5128,6 +5232,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.0.2", @@ -5227,6 +5333,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "search-engines", "related.ip": [ "192.168.0.2", @@ -5326,6 +5434,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "malware-sites", "related.ip": [ "192.168.0.2", @@ -5422,6 +5532,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5521,6 +5633,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5617,6 +5731,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5713,6 +5829,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5812,6 +5930,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -5911,6 +6031,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6007,6 +6129,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6103,6 +6227,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6199,6 +6325,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "entertainment-and-arts", "related.ip": [ "192.168.0.2", @@ -6295,6 +6423,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6391,6 +6521,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6487,6 +6619,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6586,6 +6720,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6682,6 +6818,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.0.2", @@ -6781,6 +6919,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6877,6 +7017,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -6973,6 +7115,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7072,6 +7216,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7168,6 +7314,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "not-resolved", "related.ip": [ "192.168.0.2", @@ -7264,6 +7412,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7360,6 +7510,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7459,6 +7611,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7549,6 +7703,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7648,6 +7804,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "search-engines", "related.ip": [ "192.168.0.2", @@ -7747,6 +7905,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "search-engines", "related.ip": [ "192.168.0.2", @@ -7837,6 +7997,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -7927,6 +8089,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8026,6 +8190,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8122,6 +8288,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8218,6 +8386,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8317,6 +8487,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8413,6 +8585,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8503,6 +8677,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8599,6 +8775,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8698,6 +8876,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8794,6 +8974,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8890,6 +9072,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -8986,6 +9170,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "entertainment-and-arts", "related.ip": [ "192.168.0.2", @@ -9085,6 +9271,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9184,6 +9372,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9283,6 +9473,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9373,6 +9565,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9472,6 +9666,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9571,6 +9767,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", @@ -9670,6 +9868,8 @@ "panw.panos.source.nat.ip": "0.0.0.0", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.0.2", diff --git a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json index 40105c59295..20c28165a42 100644 --- a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json @@ -67,9 +67,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 37679, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -163,9 +165,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 28249, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -259,9 +263,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 63898, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -355,9 +361,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 7515, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -451,9 +459,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 3225, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -547,9 +557,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 60449, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -643,9 +655,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 60559, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -739,9 +753,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 47414, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -835,9 +851,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 37673, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -931,9 +949,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 8232, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1027,9 +1047,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 32982, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1123,9 +1145,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 10473, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1219,9 +1243,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 20446, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1315,9 +1341,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 34699, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1411,9 +1439,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22820, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1507,9 +1537,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 41060, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1603,9 +1635,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 9058, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1699,9 +1733,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 54846, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1795,9 +1831,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 52731, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1891,9 +1929,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 15165, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -1987,9 +2027,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 53918, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "b.scorecardresearch.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2083,9 +2125,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 40792, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2179,9 +2223,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 54044, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2275,9 +2321,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 19544, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2371,9 +2419,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 13462, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2467,9 +2517,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 44892, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2563,9 +2615,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 16487, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2659,9 +2713,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 23952, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2755,9 +2811,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 2810, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2851,9 +2909,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 13272, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2947,9 +3007,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 8663, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3043,9 +3105,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 55738, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3139,9 +3203,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 10650, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3235,9 +3301,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 44087, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3331,9 +3399,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 15915, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "consent.cmp.oath.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3427,9 +3497,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 41165, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "cdn.taboola.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3526,9 +3598,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 54133, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "rules.quantcount.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3625,9 +3699,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 8485, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3724,9 +3800,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 12496, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3823,9 +3901,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 17029, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -3922,9 +4002,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 23696, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4021,9 +4103,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 34769, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4120,9 +4204,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22486, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4219,9 +4305,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 12894, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4318,9 +4406,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 62348, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4417,9 +4507,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 6224, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4516,9 +4608,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 44120, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4615,9 +4709,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 44228, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4714,9 +4810,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 31322, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4813,9 +4911,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 1672, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "www.googleadservices.com/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4909,9 +5009,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 20801, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5005,9 +5107,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 24533, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5101,9 +5205,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 30150, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5197,9 +5303,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 36305, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5293,9 +5401,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42682, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5389,9 +5499,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22530, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5485,9 +5597,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 43713, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5581,9 +5695,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 60608, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5677,9 +5793,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 9302, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5773,9 +5891,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 11634, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "service.maxymiser.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5872,9 +5992,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 30818, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -5971,9 +6093,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 64260, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6070,9 +6194,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 7071, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6169,9 +6295,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 4512, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6268,9 +6396,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 3422, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6367,9 +6497,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 4651, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6466,9 +6598,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 19068, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6565,9 +6699,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 5831, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6664,9 +6800,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 7084, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6763,9 +6901,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 18633, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6862,9 +7002,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 25557, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -6961,9 +7103,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 20661, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -7060,9 +7204,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 65438, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -7159,9 +7305,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 53101, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -7258,9 +7406,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 35463, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -7357,9 +7507,11 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 45769, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "url", "panw.panos.threat.id": "9999", "panw.panos.threat.name": "URL-filtering", "panw.panos.threat.resource": "segment-data.zqtk.net/", + "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", diff --git a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json index 3d742b52ee2..60e5c4a2b29 100644 --- a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json @@ -76,6 +76,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 16418, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.207", @@ -180,6 +182,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -287,6 +291,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 51990, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.207", @@ -391,6 +397,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -498,6 +506,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 15252, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.196", @@ -602,6 +612,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 40763, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", "related.ip": [ "192.168.15.224", @@ -706,6 +718,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -810,6 +824,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 52881, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -914,6 +930,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 26654, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1018,6 +1036,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 2486, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1122,6 +1142,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42021, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.207", @@ -1226,6 +1248,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 24377, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1330,6 +1354,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 48792, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1434,6 +1460,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 2987, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1538,6 +1566,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 6945, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -1642,6 +1672,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -1746,6 +1778,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42208, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -1850,6 +1884,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 14660, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", "related.ip": [ "192.168.15.224", @@ -1954,6 +1990,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 16483, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", "related.ip": [ "192.168.15.224", @@ -2058,6 +2096,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.196", @@ -2162,6 +2202,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 5570, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -2266,6 +2308,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 24430, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.207", @@ -2373,6 +2417,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 12122, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "start", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -2478,6 +2524,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 49145, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "drop", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -2582,6 +2630,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "deny", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -2683,6 +2733,7 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 33110, "panw.panos.source.zone": "trust", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.210", @@ -2784,6 +2835,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 9299, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "test", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -2888,6 +2941,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 47194, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -2995,6 +3050,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 62921, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3099,6 +3156,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3203,6 +3262,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.210", @@ -3307,6 +3368,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 41958, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", "related.ip": [ "192.168.15.224", @@ -3411,6 +3474,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 51374, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3516,6 +3581,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 25566, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3623,6 +3690,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 63757, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3730,6 +3799,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 3803, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -3834,6 +3905,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 34994, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -3938,6 +4011,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 38064, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -4045,6 +4120,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42924, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "insufficient-content", "related.ip": [ "192.168.15.224", @@ -4148,6 +4225,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 58977, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "insufficient-content", "related.ip": [ "192.168.15.224", @@ -4255,6 +4334,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 64732, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4359,6 +4440,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 58292, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -4466,6 +4549,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 32209, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -4573,6 +4658,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 38822, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -4677,6 +4764,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 16044, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -4781,6 +4870,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 56614, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -4888,6 +4979,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 53168, "panw.panos.source.zone": "untrust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -4992,6 +5085,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 28012, "panw.panos.source.zone": "xtrust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -5095,6 +5190,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 16050, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -5195,6 +5292,8 @@ "panw.panos.source.interface": "ethernet1/2", "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5299,6 +5398,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 61722, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5403,6 +5504,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 14247, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5507,6 +5610,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 33580, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5611,6 +5716,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 13498, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5715,6 +5822,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 20365, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5819,6 +5928,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 61464, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -5923,6 +6034,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42877, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.196", @@ -6027,6 +6140,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 5918, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6131,6 +6246,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 28944, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6235,6 +6352,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 13415, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6339,6 +6458,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 2489, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6443,6 +6564,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 49328, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6547,6 +6670,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 36036, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6654,6 +6779,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 33744, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6758,6 +6885,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 45809, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6862,6 +6991,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 3675, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -6966,6 +7097,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 5787, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7070,6 +7203,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 12342, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7174,6 +7309,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 18729, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7281,6 +7418,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 57858, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", "related.ip": [ "192.168.15.224", @@ -7385,6 +7524,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 2722, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7489,6 +7630,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 6674, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7596,6 +7739,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 37427, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7700,6 +7845,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22408, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7804,6 +7951,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 27899, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -7908,6 +8057,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 52939, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8012,6 +8163,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 42907, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.195", @@ -8115,6 +8268,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 19658, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.196", @@ -8218,6 +8373,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 64352, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8321,6 +8478,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 60126, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8426,6 +8585,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 59771, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -8530,6 +8691,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 35748, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8634,6 +8797,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 63701, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8738,6 +8903,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 57872, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -8845,6 +9012,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 37581, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -8952,6 +9121,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 19226, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -9059,6 +9230,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 61721, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -9163,6 +9336,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 10098, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", "related.ip": [ "192.168.15.224", @@ -9270,6 +9445,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 4564, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", "related.ip": [ "192.168.15.224", @@ -9377,6 +9554,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 32104, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -9484,6 +9663,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 14172, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -9591,6 +9772,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 10286, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -9698,6 +9881,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 30799, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -9802,6 +9987,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 13490, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -9906,6 +10093,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 0, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -10010,6 +10199,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 53751, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -10114,6 +10305,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 21643, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -10218,6 +10411,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22446, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -10322,6 +10517,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 22301, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", @@ -10426,6 +10623,8 @@ "panw.panos.source.nat.ip": "192.168.1.63", "panw.panos.source.nat.port": 58124, "panw.panos.source.zone": "trust", + "panw.panos.sub_type": "end", + "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", "related.ip": [ "192.168.15.224", From 6f29212f9345d1f1b4c2f739b01a0f4b74b5258f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Krze=C5=9Bniak?= Date: Tue, 15 Sep 2020 23:49:32 +0200 Subject: [PATCH 005/216] [docs] typo in the command line (#20799) `UUD` command like parameter should read `UUID` ``` $ lsblk -o MOUNTPOINT,UUD lsblk: unknown column: UUD imo@lake:~$ lsblk -o MOUNTPOINT,UUID MOUNTPOINT UUID /snap/core/9665 [... and more ...] ``` --- filebeat/docs/inputs/input-log.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/filebeat/docs/inputs/input-log.asciidoc b/filebeat/docs/inputs/input-log.asciidoc index 0a69a9b65c2..6ebaf38733e 100644 --- a/filebeat/docs/inputs/input-log.asciidoc +++ b/filebeat/docs/inputs/input-log.asciidoc @@ -90,7 +90,7 @@ more volatile. ["source","sh",subs="attributes"] ---- -$ lsblk -o MOUNTPOINT,UUD | grep /logs | awk '{print $2}' >> /logs/.filebeat-marker +$ lsblk -o MOUNTPOINT,UUID | grep /logs | awk '{print $2}' >> /logs/.filebeat-marker ---- To set the generated file as a marker for `file_identity` you should configure From 749e4d66769d5e4481c6ed82bf68c8f8743aea90 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Tue, 15 Sep 2020 19:20:57 -0700 Subject: [PATCH 006/216] Fix broken links to external websites (#21061) --- filebeat/docs/modules/zeek.asciidoc | 8 ++++---- libbeat/docs/communitybeats.asciidoc | 6 +++--- libbeat/docs/shared-faq.asciidoc | 4 ++-- packetbeat/docs/packetbeat-options.asciidoc | 2 +- x-pack/filebeat/module/zeek/_meta/docs.asciidoc | 8 ++++---- 5 files changed, 14 insertions(+), 14 deletions(-) diff --git a/filebeat/docs/modules/zeek.asciidoc b/filebeat/docs/modules/zeek.asciidoc index 6df419f6034..f582f9c738e 100644 --- a/filebeat/docs/modules/zeek.asciidoc +++ b/filebeat/docs/modules/zeek.asciidoc @@ -10,8 +10,8 @@ This file is generated! See scripts/docs_collector.py == Zeek (Bro) Module -This is a module for Zeek, which used to be called Bro. It parses logs that are in the -https://www.zeek.org/manual/release/logs/index.html[Zeek JSON format]. +This is a module for https://zeek.org/[Zeek], which used to be called Bro. It +parses logs that are in the Zeek JSON format. include::../include/gs-link.asciidoc[] @@ -21,8 +21,8 @@ include::../include/gs-link.asciidoc[] This module has been developed against Zeek 2.6.1, but is expected to work with other versions of Zeek. -Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, and Mac OS X. -Find out how to use Zeek here: https://www.zeek.org/ +Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, +and Mac OS X. [float] === Example dashboard diff --git a/libbeat/docs/communitybeats.asciidoc b/libbeat/docs/communitybeats.asciidoc index 58e3a99f8c0..c2ff8f5ec14 100644 --- a/libbeat/docs/communitybeats.asciidoc +++ b/libbeat/docs/communitybeats.asciidoc @@ -9,8 +9,8 @@ The open source community has been hard at work developing new Beats. You can check out some of them here. -Have a question about a community Beat? You can post questions and discuss issues in the -https://discuss.elastic.co/c/beats/community-beats[Community Beats] category of the Beats discussion forum. +Have a question about developing a community Beat? You can post questions and discuss issues in the +https://discuss.elastic.co/tags/c/elastic-stack/beats/28/beats-development[Beats discussion forum]. Have you created a Beat that's not listed? Add the name and description of your Beat to the source document for https://github.com/elastic/beats/blob/master/libbeat/docs/communitybeats.asciidoc[Community Beats] and https://help.github.com/articles/using-pull-requests[open a pull request] in the https://github.com/elastic/beats[Beats GitHub repository] to get your change merged. When you're ready, go ahead and https://discuss.elastic.co/c/announcements[announce] your new Beat in the Elastic @@ -46,7 +46,7 @@ https://github.com/gamegos/etcdbeat[etcdbeat]:: Reads stats from the Etcd v2 API https://gitlab.com/hatricker/etherbeat[etherbeat]:: Reads blocks from Ethereum compatible blockchain and indexes them into Elasticsearch. https://github.com/christiangalsterer/execbeat[execbeat]:: Periodically executes shell commands and sends the standard output and standard error to Logstash or Elasticsearch. -https://github.com/jarpy/factbeat[factbeat]:: Collects facts from https://puppetlabs.com/facter[Facter]. +https://github.com/jarpy/factbeat[factbeat]:: Collects facts from https://github.com/puppetlabs/facter[Facter]. https://github.com/ctindel/fastcombeat[fastcombeat]:: Periodically gather internet download speed from https://fast.com[fast.com]. https://github.com/cloudronics/fileoccurancebeat[fileoccurencebeat]:: Checks for file existence recurssively under a given directory, handy while handling queues/pipeline buffers. https://github.com/FStelzer/flowbeat[flowbeat]:: Collects, parses, and indexes http://www.sflow.org/index.php[sflow] samples. diff --git a/libbeat/docs/shared-faq.asciidoc b/libbeat/docs/shared-faq.asciidoc index 7610dc6f8c9..9aa8c3442c1 100644 --- a/libbeat/docs/shared-faq.asciidoc +++ b/libbeat/docs/shared-faq.asciidoc @@ -98,8 +98,8 @@ telnet 5044 + TIP: For testing purposes only, you can set `verification_mode: none` to disable hostname checking. -* Use OpenSSL to test connectivity to the {ls} server and diagnose problems. See the https://www.openssl.org/docs/manmaster/apps/s_client.html[OpenSSL documentation] for more info. -* Make sure that you have enabled SSL (set `ssl => true`) when configuring the https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html[Beats input plugin for {ls}]. +* Use OpenSSL to test connectivity to the {ls} server and diagnose problems. See the https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html[OpenSSL documentation] for more info. +* Make sure that you have enabled SSL (set `ssl => true`) when configuring the {logstash-ref}/plugins-inputs-beats.html[Beats input plugin for {ls}]. ==== Common SSL-Related Errors and Resolutions diff --git a/packetbeat/docs/packetbeat-options.asciidoc b/packetbeat/docs/packetbeat-options.asciidoc index 490e49f3ed7..32d9c473054 100644 --- a/packetbeat/docs/packetbeat-options.asciidoc +++ b/packetbeat/docs/packetbeat-options.asciidoc @@ -31,7 +31,7 @@ Currently Packetbeat has several options for traffic capturing: The `af_packet` option, also known as "memory-mapped sniffing," makes use of a Linux-specific -http://lxr.free-electrons.com/source/Documentation/networking/packet_mmap.txt[feature]. +https://www.kernel.org/doc/Documentation/networking/packet_mmap.txt[feature]. This could be the optimal sniffing mode for both the dedicated server and when Packetbeat is deployed on an existing application server. diff --git a/x-pack/filebeat/module/zeek/_meta/docs.asciidoc b/x-pack/filebeat/module/zeek/_meta/docs.asciidoc index e9b4bc6627d..7784857b260 100644 --- a/x-pack/filebeat/module/zeek/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/zeek/_meta/docs.asciidoc @@ -5,8 +5,8 @@ == Zeek (Bro) Module -This is a module for Zeek, which used to be called Bro. It parses logs that are in the -https://www.zeek.org/manual/release/logs/index.html[Zeek JSON format]. +This is a module for https://zeek.org/[Zeek], which used to be called Bro. It +parses logs that are in the Zeek JSON format. include::../include/gs-link.asciidoc[] @@ -16,8 +16,8 @@ include::../include/gs-link.asciidoc[] This module has been developed against Zeek 2.6.1, but is expected to work with other versions of Zeek. -Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, and Mac OS X. -Find out how to use Zeek here: https://www.zeek.org/ +Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, +and Mac OS X. [float] === Example dashboard From 3390aa84ce88c6c62aeca97ac1cc0b5485fdceb0 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Wed, 16 Sep 2020 12:04:22 +0200 Subject: [PATCH 007/216] Add new modules/filesets from rsa2elk for 7.10 (#20820) This the following new modules: - citrix (netscaler fileset): This existed in 7.9 but was removed by #20706. - cyberark (corepass fileset). - proofpoint (emailsecurity fileset). - snort (log fileset). - symantec (endpointprotection fileset). And the following filesets to existing modules: - barracuda/spamfirewall - cisco/meraki - f5/bigipafm - fortinet/fortimail - fortinet/fortimanager - juniper/netscreen - sophos/utm --- CHANGELOG.next.asciidoc | 12 + filebeat/docs/fields.asciidoc | 75124 +++++--- filebeat/docs/modules/barracuda.asciidoc | 47 +- filebeat/docs/modules/bluecoat.asciidoc | 2 +- filebeat/docs/modules/cisco.asciidoc | 47 +- filebeat/docs/modules/citrix.asciidoc | 12 +- filebeat/docs/modules/cyberark.asciidoc | 79 + filebeat/docs/modules/cylance.asciidoc | 2 +- filebeat/docs/modules/f5.asciidoc | 53 +- filebeat/docs/modules/fortinet.asciidoc | 100 +- filebeat/docs/modules/imperva.asciidoc | 2 +- filebeat/docs/modules/infoblox.asciidoc | 2 +- filebeat/docs/modules/juniper.asciidoc | 47 +- filebeat/docs/modules/microsoft.asciidoc | 2 +- filebeat/docs/modules/netscout.asciidoc | 2 +- filebeat/docs/modules/proofpoint.asciidoc | 79 + filebeat/docs/modules/radware.asciidoc | 2 +- filebeat/docs/modules/snort.asciidoc | 79 + filebeat/docs/modules/sonicwall.asciidoc | 2 +- filebeat/docs/modules/sophos.asciidoc | 51 +- filebeat/docs/modules/squid.asciidoc | 2 +- filebeat/docs/modules/symantec.asciidoc | 79 + filebeat/docs/modules/tomcat.asciidoc | 2 +- filebeat/docs/modules/zscaler.asciidoc | 2 +- filebeat/docs/modules_list.asciidoc | 10 + filebeat/tests/system/test_modules.py | 8 + x-pack/filebeat/filebeat.reference.yml | 238 + x-pack/filebeat/include/list.go | 5 + .../module/barracuda/_meta/config.yml | 19 + .../module/barracuda/_meta/docs.asciidoc | 47 +- x-pack/filebeat/module/barracuda/fields.go | 2 +- .../barracuda/spamfirewall/_meta/fields.yml | 2637 + .../barracuda/spamfirewall/config/input.yml | 45 + .../spamfirewall/config/liblogparser.js | 2510 + .../barracuda/spamfirewall/config/pipeline.js | 833 + .../spamfirewall/ingest/pipeline.yml | 59 + .../barracuda/spamfirewall/manifest.yml | 31 + .../barracuda/spamfirewall/test/generated.log | 100 + .../test/generated.log-expected.json | 3282 + .../module/bluecoat/_meta/docs.asciidoc | 2 +- x-pack/filebeat/module/cisco/_meta/config.yml | 19 + .../filebeat/module/cisco/_meta/docs.asciidoc | 47 +- x-pack/filebeat/module/cisco/fields.go | 2 +- .../module/cisco/meraki/_meta/fields.yml | 2637 + .../module/cisco/meraki/config/input.yml | 45 + .../cisco/meraki/config/liblogparser.js | 2510 + .../module/cisco/meraki/config/pipeline.js | 730 + .../module/cisco/meraki/ingest/pipeline.yml | 59 + .../filebeat/module/cisco/meraki/manifest.yml | 31 + .../module/cisco/meraki/test/generated.log | 100 + .../meraki/test/generated.log-expected.json | 3370 + x-pack/filebeat/module/citrix/README.md | 7 + .../filebeat/module/citrix/_meta/config.yml | 19 + .../module/citrix/_meta/docs.asciidoc | 66 + .../filebeat/module/citrix/_meta/fields.yml | 5 + x-pack/filebeat/module/citrix/fields.go | 23 + .../module/citrix/netscaler/_meta/fields.yml | 2637 + .../module/citrix/netscaler/config/input.yml | 45 + .../citrix/netscaler/config/liblogparser.js | 2510 + .../citrix/netscaler/config/pipeline.js | 3978 + .../citrix/netscaler/ingest/pipeline.yml | 59 + .../module/citrix/netscaler/manifest.yml | 31 + .../citrix/netscaler/test/generated.log | 100 + .../test/generated.log-expected.json | 3094 + x-pack/filebeat/module/cyberark/README.md | 7 + .../filebeat/module/cyberark/_meta/config.yml | 19 + .../module/cyberark/_meta/docs.asciidoc | 66 + .../filebeat/module/cyberark/_meta/fields.yml | 5 + .../module/cyberark/corepas/_meta/fields.yml | 2637 + .../module/cyberark/corepas/config/input.yml | 45 + .../cyberark/corepas/config/liblogparser.js | 2510 + .../cyberark/corepas/config/pipeline.js | 6527 + .../cyberark/corepas/ingest/pipeline.yml | 59 + .../module/cyberark/corepas/manifest.yml | 31 + .../cyberark/corepas/test/generated.log | 100 + .../corepas/test/generated.log-expected.json | 5237 + x-pack/filebeat/module/cyberark/fields.go | 23 + .../module/cylance/_meta/docs.asciidoc | 2 +- x-pack/filebeat/module/f5/_meta/config.yml | 19 + x-pack/filebeat/module/f5/_meta/docs.asciidoc | 53 +- .../module/f5/bigipafm/_meta/fields.yml | 2637 + .../module/f5/bigipafm/config/input.yml | 45 + .../module/f5/bigipafm/config/liblogparser.js | 2510 + .../module/f5/bigipafm/config/pipeline.js | 111 + .../module/f5/bigipafm/ingest/pipeline.yml | 59 + .../filebeat/module/f5/bigipafm/manifest.yml | 31 + .../module/f5/bigipafm/test/generated.log | 100 + .../bigipafm/test/generated.log-expected.json | 6460 + x-pack/filebeat/module/f5/fields.go | 2 +- .../filebeat/module/fortinet/_meta/config.yml | 38 + .../module/fortinet/_meta/docs.asciidoc | 100 +- x-pack/filebeat/module/fortinet/fields.go | 2 +- .../fortinet/fortimail/_meta/fields.yml | 2637 + .../fortinet/fortimail/config/input.yml | 45 + .../fortinet/fortimail/config/liblogparser.js | 2510 + .../fortinet/fortimail/config/pipeline.js | 1916 + .../fortinet/fortimail/ingest/pipeline.yml | 59 + .../module/fortinet/fortimail/manifest.yml | 31 + .../fortinet/fortimail/test/generated.log | 100 + .../test/generated.log-expected.json | 4057 + .../fortinet/fortimanager/_meta/fields.yml | 2637 + .../fortinet/fortimanager/config/input.yml | 45 + .../fortimanager/config/liblogparser.js | 2510 + .../fortinet/fortimanager/config/pipeline.js | 528 + .../fortinet/fortimanager/ingest/pipeline.yml | 59 + .../module/fortinet/fortimanager/manifest.yml | 31 + .../fortinet/fortimanager/test/generated.log | 100 + .../test/generated.log-expected.json | 7561 + .../module/imperva/_meta/docs.asciidoc | 2 +- .../module/infoblox/_meta/docs.asciidoc | 2 +- .../filebeat/module/juniper/_meta/config.yml | 19 + .../module/juniper/_meta/docs.asciidoc | 47 +- x-pack/filebeat/module/juniper/fields.go | 2 +- .../module/juniper/netscreen/_meta/fields.yml | 2637 + .../module/juniper/netscreen/config/input.yml | 45 + .../juniper/netscreen/config/liblogparser.js | 2510 + .../juniper/netscreen/config/pipeline.js | 26300 +++ .../juniper/netscreen/ingest/pipeline.yml | 59 + .../module/juniper/netscreen/manifest.yml | 31 + .../juniper/netscreen/test/generated.log | 100 + .../test/generated.log-expected.json | 2565 + .../module/microsoft/_meta/docs.asciidoc | 2 +- .../module/netscout/_meta/docs.asciidoc | 2 +- x-pack/filebeat/module/proofpoint/README.md | 7 + .../module/proofpoint/_meta/config.yml | 19 + .../module/proofpoint/_meta/docs.asciidoc | 66 + .../module/proofpoint/_meta/fields.yml | 5 + .../proofpoint/emailsecurity/_meta/fields.yml | 2637 + .../proofpoint/emailsecurity/config/input.yml | 45 + .../emailsecurity/config/liblogparser.js | 2510 + .../emailsecurity/config/pipeline.js | 3266 + .../emailsecurity/ingest/pipeline.yml | 59 + .../proofpoint/emailsecurity/manifest.yml | 31 + .../emailsecurity/test/generated.log | 100 + .../test/generated.log-expected.json | 2545 + x-pack/filebeat/module/proofpoint/fields.go | 23 + .../module/radware/_meta/docs.asciidoc | 2 +- x-pack/filebeat/module/snort/README.md | 7 + x-pack/filebeat/module/snort/_meta/config.yml | 19 + .../filebeat/module/snort/_meta/docs.asciidoc | 66 + x-pack/filebeat/module/snort/_meta/fields.yml | 5 + x-pack/filebeat/module/snort/fields.go | 23 + .../module/snort/log/_meta/fields.yml | 2637 + .../module/snort/log/config/input.yml | 45 + .../module/snort/log/config/liblogparser.js | 2510 + .../module/snort/log/config/pipeline.js | 137782 +++++++++++++++ .../module/snort/log/ingest/pipeline.yml | 59 + x-pack/filebeat/module/snort/log/manifest.yml | 31 + .../module/snort/log/test/generated.log | 100 + .../log/test/generated.log-expected.json | 3607 + .../module/sonicwall/_meta/docs.asciidoc | 2 +- .../filebeat/module/sophos/_meta/config.yml | 19 + .../module/sophos/_meta/docs.asciidoc | 51 +- .../filebeat/module/sophos/_meta/fields.yml | 4 - x-pack/filebeat/module/sophos/fields.go | 2 +- .../module/sophos/utm/_meta/fields.yml | 2637 + .../module/sophos/utm/config/input.yml | 45 + .../module/sophos/utm/config/liblogparser.js | 2510 + .../module/sophos/utm/config/pipeline.js | 2667 + .../module/sophos/utm/ingest/pipeline.yml | 59 + .../filebeat/module/sophos/utm/manifest.yml | 31 + .../module/sophos/utm/test/generated.log | 100 + .../utm/test/generated.log-expected.json | 3504 + .../module/sophos/xg/_meta/fields.yml | 1870 +- .../filebeat/module/squid/_meta/docs.asciidoc | 2 +- x-pack/filebeat/module/symantec/README.md | 7 + .../filebeat/module/symantec/_meta/config.yml | 19 + .../module/symantec/_meta/docs.asciidoc | 66 + .../filebeat/module/symantec/_meta/fields.yml | 5 + .../endpointprotection/_meta/fields.yml | 2637 + .../endpointprotection/config/input.yml | 45 + .../endpointprotection/config/liblogparser.js | 2510 + .../endpointprotection/config/pipeline.js | 14963 ++ .../endpointprotection/ingest/pipeline.yml | 59 + .../symantec/endpointprotection/manifest.yml | 31 + .../endpointprotection/test/generated.log | 100 + .../test/generated.log-expected.json | 3458 + x-pack/filebeat/module/symantec/fields.go | 23 + .../module/tomcat/_meta/docs.asciidoc | 2 +- .../module/zscaler/_meta/docs.asciidoc | 2 +- .../filebeat/modules.d/barracuda.yml.disabled | 19 + x-pack/filebeat/modules.d/cisco.yml.disabled | 19 + x-pack/filebeat/modules.d/citrix.yml.disabled | 22 + .../filebeat/modules.d/cyberark.yml.disabled | 22 + x-pack/filebeat/modules.d/f5.yml.disabled | 19 + .../filebeat/modules.d/fortinet.yml.disabled | 38 + .../filebeat/modules.d/juniper.yml.disabled | 19 + .../modules.d/proofpoint.yml.disabled | 22 + x-pack/filebeat/modules.d/snort.yml.disabled | 22 + x-pack/filebeat/modules.d/sophos.yml.disabled | 19 + .../filebeat/modules.d/symantec.yml.disabled | 22 + 191 files changed, 369998 insertions(+), 22248 deletions(-) create mode 100644 filebeat/docs/modules/cyberark.asciidoc create mode 100644 filebeat/docs/modules/proofpoint.asciidoc create mode 100644 filebeat/docs/modules/snort.asciidoc create mode 100644 filebeat/docs/modules/symantec.asciidoc create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/_meta/fields.yml create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/config/liblogparser.js create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/config/pipeline.js create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/manifest.yml create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log create mode 100644 x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/cisco/meraki/_meta/fields.yml create mode 100644 x-pack/filebeat/module/cisco/meraki/config/input.yml create mode 100644 x-pack/filebeat/module/cisco/meraki/config/liblogparser.js create mode 100644 x-pack/filebeat/module/cisco/meraki/config/pipeline.js create mode 100644 x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/cisco/meraki/manifest.yml create mode 100644 x-pack/filebeat/module/cisco/meraki/test/generated.log create mode 100644 x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/citrix/README.md create mode 100644 x-pack/filebeat/module/citrix/_meta/config.yml create mode 100644 x-pack/filebeat/module/citrix/_meta/docs.asciidoc create mode 100644 x-pack/filebeat/module/citrix/_meta/fields.yml create mode 100644 x-pack/filebeat/module/citrix/fields.go create mode 100644 x-pack/filebeat/module/citrix/netscaler/_meta/fields.yml create mode 100644 x-pack/filebeat/module/citrix/netscaler/config/input.yml create mode 100644 x-pack/filebeat/module/citrix/netscaler/config/liblogparser.js create mode 100644 x-pack/filebeat/module/citrix/netscaler/config/pipeline.js create mode 100644 x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/citrix/netscaler/manifest.yml create mode 100644 x-pack/filebeat/module/citrix/netscaler/test/generated.log create mode 100644 x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/cyberark/README.md create mode 100644 x-pack/filebeat/module/cyberark/_meta/config.yml create mode 100644 x-pack/filebeat/module/cyberark/_meta/docs.asciidoc create mode 100644 x-pack/filebeat/module/cyberark/_meta/fields.yml create mode 100644 x-pack/filebeat/module/cyberark/corepas/_meta/fields.yml create mode 100644 x-pack/filebeat/module/cyberark/corepas/config/input.yml create mode 100644 x-pack/filebeat/module/cyberark/corepas/config/liblogparser.js create mode 100644 x-pack/filebeat/module/cyberark/corepas/config/pipeline.js create mode 100644 x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/cyberark/corepas/manifest.yml create mode 100644 x-pack/filebeat/module/cyberark/corepas/test/generated.log create mode 100644 x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/cyberark/fields.go create mode 100644 x-pack/filebeat/module/f5/bigipafm/_meta/fields.yml create mode 100644 x-pack/filebeat/module/f5/bigipafm/config/input.yml create mode 100644 x-pack/filebeat/module/f5/bigipafm/config/liblogparser.js create mode 100644 x-pack/filebeat/module/f5/bigipafm/config/pipeline.js create mode 100644 x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/f5/bigipafm/manifest.yml create mode 100644 x-pack/filebeat/module/f5/bigipafm/test/generated.log create mode 100644 x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/fortinet/fortimail/_meta/fields.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimail/config/input.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimail/config/liblogparser.js create mode 100644 x-pack/filebeat/module/fortinet/fortimail/config/pipeline.js create mode 100644 x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimail/manifest.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimail/test/generated.log create mode 100644 x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/_meta/fields.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/config/input.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/config/liblogparser.js create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/config/pipeline.js create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/manifest.yml create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/test/generated.log create mode 100644 x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/netscreen/_meta/fields.yml create mode 100644 x-pack/filebeat/module/juniper/netscreen/config/input.yml create mode 100644 x-pack/filebeat/module/juniper/netscreen/config/liblogparser.js create mode 100644 x-pack/filebeat/module/juniper/netscreen/config/pipeline.js create mode 100644 x-pack/filebeat/module/juniper/netscreen/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/juniper/netscreen/manifest.yml create mode 100644 x-pack/filebeat/module/juniper/netscreen/test/generated.log create mode 100644 x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/proofpoint/README.md create mode 100644 x-pack/filebeat/module/proofpoint/_meta/config.yml create mode 100644 x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc create mode 100644 x-pack/filebeat/module/proofpoint/_meta/fields.yml create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/_meta/fields.yml create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/config/liblogparser.js create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/config/pipeline.js create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/manifest.yml create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log create mode 100644 x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/proofpoint/fields.go create mode 100644 x-pack/filebeat/module/snort/README.md create mode 100644 x-pack/filebeat/module/snort/_meta/config.yml create mode 100644 x-pack/filebeat/module/snort/_meta/docs.asciidoc create mode 100644 x-pack/filebeat/module/snort/_meta/fields.yml create mode 100644 x-pack/filebeat/module/snort/fields.go create mode 100644 x-pack/filebeat/module/snort/log/_meta/fields.yml create mode 100644 x-pack/filebeat/module/snort/log/config/input.yml create mode 100644 x-pack/filebeat/module/snort/log/config/liblogparser.js create mode 100644 x-pack/filebeat/module/snort/log/config/pipeline.js create mode 100644 x-pack/filebeat/module/snort/log/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/snort/log/manifest.yml create mode 100644 x-pack/filebeat/module/snort/log/test/generated.log create mode 100644 x-pack/filebeat/module/snort/log/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/sophos/utm/_meta/fields.yml create mode 100644 x-pack/filebeat/module/sophos/utm/config/input.yml create mode 100644 x-pack/filebeat/module/sophos/utm/config/liblogparser.js create mode 100644 x-pack/filebeat/module/sophos/utm/config/pipeline.js create mode 100644 x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/sophos/utm/manifest.yml create mode 100644 x-pack/filebeat/module/sophos/utm/test/generated.log create mode 100644 x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/symantec/README.md create mode 100644 x-pack/filebeat/module/symantec/_meta/config.yml create mode 100644 x-pack/filebeat/module/symantec/_meta/docs.asciidoc create mode 100644 x-pack/filebeat/module/symantec/_meta/fields.yml create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/_meta/fields.yml create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/config/input.yml create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/config/liblogparser.js create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/config/pipeline.js create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/manifest.yml create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/test/generated.log create mode 100644 x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json create mode 100644 x-pack/filebeat/module/symantec/fields.go create mode 100644 x-pack/filebeat/modules.d/citrix.yml.disabled create mode 100644 x-pack/filebeat/modules.d/cyberark.yml.disabled create mode 100644 x-pack/filebeat/modules.d/proofpoint.yml.disabled create mode 100644 x-pack/filebeat/modules.d/snort.yml.disabled create mode 100644 x-pack/filebeat/modules.d/symantec.yml.disabled diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 509722bb7e4..1f33bf618e7 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -413,6 +413,18 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add replace_fields config option in add_host_metadata for replacing host fields. {pull}20490[20490] {issue}20464[20464] - Add container ECS fields in kubernetes metadata. {pull}20984[20984] - Add ingress controller dashboards. {pull}21052[21052] +- Added experimental `citrix` module. {pull}20820[20820] +- Added experimental `cyberark` module. {pull}20820[20820] +- Added experimental `proofpoint` module. {pull}20820[20820] +- Added experimental `snort` module. {pull}20820[20820] +- Added experimental `symantec` module. {pull}20820[20820] +- Added experimental dataset `barracuda/spamfirewall`. {pull}20820[20820] +- Added experimental dataset `cisco/meraki`. {pull}20820[20820] +- Added experimental dataset `f5/bigipafm`. {pull}20820[20820] +- Added experimental dataset `fortinet/fortimail`. {pull}20820[20820] +- Added experimental dataset `fortinet/fortimanager`. {pull}20820[20820] +- Added experimental dataset `juniper/netscreen`. {pull}20820[20820] +- Added experimental dataset `sophos/utm`. {pull}20820[20820] *Auditbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 96c30c88871..b4888ec8c5e 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -25,9 +25,11 @@ grouped in the following categories: * <> * <> * <> +* <> * <> * <> * <> +* <> * <> * <> * <> @@ -67,15 +69,18 @@ grouped in the following categories: * <> * <> * <> +* <> * <> * <> * <> * <> * <> +* <> * <> * <> * <> * <> +* <> * <> * <> * <> @@ -26580,2651 +26585,1545 @@ type: keyword -- -[[exported-fields-cloud]] -== Cloud provider metadata fields +[[exported-fields-citrix]] +== Citrix NetScaler fields -Metadata from cloud providers added by the add_cloud_metadata processor. +citrix fields. -*`cloud.image.id`*:: +*`network.interface.name`*:: + -- -Image ID for the cloud instance. +Name of the network interface where the traffic has been observed. -example: ami-abcd1234 +type: keyword -- -*`meta.cloud.provider`*:: + + +*`rsa.internal.msg`*:: + -- -type: alias +This key is used to capture the raw message that comes into the Log Decoder -alias to: cloud.provider +type: keyword -- -*`meta.cloud.instance_id`*:: +*`rsa.internal.messageid`*:: + -- -type: alias - -alias to: cloud.instance.id +type: keyword -- -*`meta.cloud.instance_name`*:: +*`rsa.internal.event_desc`*:: + -- -type: alias - -alias to: cloud.instance.name +type: keyword -- -*`meta.cloud.machine_type`*:: +*`rsa.internal.message`*:: + -- -type: alias +This key captures the contents of instant messages -alias to: cloud.machine.type +type: keyword -- -*`meta.cloud.availability_zone`*:: +*`rsa.internal.time`*:: + -- -type: alias +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -alias to: cloud.availability_zone +type: date -- -*`meta.cloud.project_id`*:: +*`rsa.internal.level`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: cloud.project.id +type: long -- -*`meta.cloud.region`*:: +*`rsa.internal.msg_id`*:: + -- -type: alias +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -alias to: cloud.region +type: keyword -- -[[exported-fields-coredns]] -== Coredns fields - -Module for handling logs produced by coredns - +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: keyword -[float] -=== coredns +-- -coredns fields after normalization +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. +type: keyword +-- -*`coredns.id`*:: +*`rsa.internal.obj_server`*:: + -- -id of the DNS transaction - +Deprecated key defined only in table map. type: keyword -- -*`coredns.query.size`*:: +*`rsa.internal.obj_val`*:: + -- -size of the DNS query - - -type: integer +Deprecated key defined only in table map. -format: bytes +type: keyword -- -*`coredns.query.class`*:: +*`rsa.internal.resource`*:: + -- -DNS query class - +Deprecated key defined only in table map. type: keyword -- -*`coredns.query.name`*:: +*`rsa.internal.obj_id`*:: + -- -DNS query name - +Deprecated key defined only in table map. type: keyword -- -*`coredns.query.type`*:: +*`rsa.internal.statement`*:: + -- -DNS query type - +Deprecated key defined only in table map. type: keyword -- -*`coredns.response.code`*:: +*`rsa.internal.audit_class`*:: + -- -DNS response code - +Deprecated key defined only in table map. type: keyword -- -*`coredns.response.flags`*:: +*`rsa.internal.entry`*:: + -- -DNS response flags - +Deprecated key defined only in table map. type: keyword -- -*`coredns.response.size`*:: +*`rsa.internal.hcode`*:: + -- -size of the DNS response - - -type: integer +Deprecated key defined only in table map. -format: bytes +type: keyword -- -*`coredns.dnssec_ok`*:: +*`rsa.internal.inode`*:: + -- -dnssec flag - +Deprecated key defined only in table map. -type: boolean +type: long -- -[[exported-fields-crowdstrike]] -== Crowdstrike fields +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. -Module for collecting Crowdstrike events. +type: keyword +-- +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. -[float] -=== crowdstrike +type: long -Fields for Crowdstrike Falcon event and alert data. +-- +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: keyword -[float] -=== metadata +-- -Meta data fields for each event that include type and timestamp. +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: keyword +-- -*`crowdstrike.metadata.eventType`*:: +*`rsa.internal.cid`*:: + -- -DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent - +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.metadata.eventCreationTime`*:: +*`rsa.internal.device_class`*:: + -- -The time this event occurred on the endpoint in UTC UNIX_MS format. - +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: date +type: keyword -- -*`crowdstrike.metadata.offset`*:: +*`rsa.internal.device_group`*:: + -- -Offset number that tracks the location of the event in stream. This is used to identify unique detection events. - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`crowdstrike.metadata.customerIDString`*:: +*`rsa.internal.device_host`*:: + -- -Customer identifier - +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.metadata.version`*:: +*`rsa.internal.device_ip`*:: + -- -Schema version - +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -[float] -=== event - -Event data fields for each event and alert. +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: ip +-- -*`crowdstrike.event.ProcessStartTime`*:: +*`rsa.internal.device_type`*:: + -- -The process start time in UTC UNIX_MS format. - +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: date +type: keyword -- -*`crowdstrike.event.ProcessEndTime`*:: +*`rsa.internal.device_type_id`*:: + -- -The process termination time in UTC UNIX_MS format. - +Deprecated key defined only in table map. -type: date +type: long -- -*`crowdstrike.event.ProcessId`*:: +*`rsa.internal.did`*:: + -- -Process ID related to the detection. - +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`crowdstrike.event.ParentProcessId`*:: +*`rsa.internal.entropy_req`*:: + -- -Parent process ID related to the detection. - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: integer +type: long -- -*`crowdstrike.event.ComputerName`*:: +*`rsa.internal.entropy_res`*:: + -- -Name of the computer where the detection occurred. - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: keyword +type: long -- -*`crowdstrike.event.UserName`*:: +*`rsa.internal.event_name`*:: + -- -User name associated with the detection. - +Deprecated key defined only in table map. type: keyword -- -*`crowdstrike.event.DetectName`*:: +*`rsa.internal.feed_category`*:: + -- -Name of the detection. - +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.DetectDescription`*:: +*`rsa.internal.forward_ip`*:: + -- -Description of the detection. - +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -type: keyword +type: ip -- -*`crowdstrike.event.Severity`*:: +*`rsa.internal.forward_ipv6`*:: + -- -Severity score of the detection. - +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: ip -- -*`crowdstrike.event.SeverityName`*:: +*`rsa.internal.header_id`*:: + -- -Severity score text. - +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.FileName`*:: +*`rsa.internal.lc_cid`*:: + -- -File name of the associated process for the detection. - +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.FilePath`*:: +*`rsa.internal.lc_ctime`*:: + -- -Path of the executable associated with the detection. - +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: date -- -*`crowdstrike.event.CommandLine`*:: +*`rsa.internal.mcb_req`*:: + -- -Executable path with command line arguments. - +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most -type: keyword +type: long -- -*`crowdstrike.event.SHA1String`*:: +*`rsa.internal.mcb_res`*:: + -- -SHA1 sum of the executable associated with the detection. - +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most -type: keyword +type: long -- -*`crowdstrike.event.SHA256String`*:: +*`rsa.internal.mcbc_req`*:: + -- -SHA256 sum of the executable associated with the detection. - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: keyword +type: long -- -*`crowdstrike.event.MD5String`*:: +*`rsa.internal.mcbc_res`*:: + -- -MD5 sum of the executable associated with the detection. - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: keyword +type: long -- -*`crowdstrike.event.MachineDomain`*:: +*`rsa.internal.medium`*:: + -- -Domain for the machine associated with the detection. - +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session -type: keyword +type: long -- -*`crowdstrike.event.FalconHostLink`*:: +*`rsa.internal.node_name`*:: + -- -URL to view the detection in Falcon. - +Deprecated key defined only in table map. type: keyword -- -*`crowdstrike.event.SensorId`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -Unique ID associated with the Falcon sensor. - +This key denotes that event is endpoint related type: keyword -- -*`crowdstrike.event.DetectId`*:: +*`rsa.internal.parse_error`*:: + -- -Unique ID associated with the detection. - +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.LocalIP`*:: +*`rsa.internal.payload_req`*:: + -- -IP address of the host associated with the detection. - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: keyword +type: long -- -*`crowdstrike.event.MACAddress`*:: +*`rsa.internal.payload_res`*:: + -- -MAC address of the host associated with the detection. - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: keyword +type: long -- -*`crowdstrike.event.Tactic`*:: +*`rsa.internal.process_vid_dst`*:: + -- -MITRE tactic category of the detection. - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. type: keyword -- -*`crowdstrike.event.Technique`*:: +*`rsa.internal.process_vid_src`*:: + -- -MITRE technique category of the detection. - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. type: keyword -- -*`crowdstrike.event.Objective`*:: +*`rsa.internal.rid`*:: + -- -Method of detection. - +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: long -- -*`crowdstrike.event.PatternDispositionDescription`*:: +*`rsa.internal.session_split`*:: + -- -Action taken by Falcon. - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.PatternDispositionValue`*:: +*`rsa.internal.site`*:: + -- -Unique ID associated with action taken. - +Deprecated key defined only in table map. -type: integer +type: keyword -- -*`crowdstrike.event.PatternDispositionFlags`*:: +*`rsa.internal.size`*:: + -- -Flags indicating actions taken. - +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: object +type: long -- -*`crowdstrike.event.State`*:: +*`rsa.internal.sourcefile`*:: + -- -Whether the incident summary is open and ongoing or closed. - +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`crowdstrike.event.IncidentStartTime`*:: +*`rsa.internal.ubc_req`*:: + -- -Start time for the incident in UTC UNIX format. - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: date +type: long -- -*`crowdstrike.event.IncidentEndTime`*:: +*`rsa.internal.ubc_res`*:: + -- -End time for the incident in UTC UNIX format. - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: date +type: long -- -*`crowdstrike.event.FineScore`*:: +*`rsa.internal.word`*:: + -- -Score for incident. - +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log -type: float +type: keyword -- -*`crowdstrike.event.UserId`*:: + +*`rsa.time.event_time`*:: + -- -Email address or user ID associated with the event. - +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form -type: keyword +type: date -- -*`crowdstrike.event.UserIp`*:: +*`rsa.time.duration_time`*:: + -- -IP address associated with the user. - +This key is used to capture the normalized duration/lifetime in seconds. -type: keyword +type: double -- -*`crowdstrike.event.OperationName`*:: +*`rsa.time.event_time_str`*:: + -- -Event subtype. - +This key is used to capture the incomplete time mentioned in a session as a string type: keyword -- -*`crowdstrike.event.ServiceName`*:: +*`rsa.time.starttime`*:: + -- -Service associated with this event. - +This key is used to capture the Start time mentioned in a session in a standard form -type: keyword +type: date -- -*`crowdstrike.event.Success`*:: +*`rsa.time.month`*:: + -- -Indicator of whether or not this event was successful. +type: keyword +-- -type: boolean +*`rsa.time.day`*:: ++ +-- +type: keyword -- -*`crowdstrike.event.UTCTimestamp`*:: +*`rsa.time.endtime`*:: + -- -Timestamp associated with this event in UTC UNIX format. - +This key is used to capture the End time mentioned in a session in a standard form type: date -- -*`crowdstrike.event.AuditKeyValues`*:: +*`rsa.time.timezone`*:: + -- -Fields that were changed in this event. - +This key is used to capture the timezone of the Event Time -type: nested +type: keyword -- -*`crowdstrike.event.ExecutablesWritten`*:: +*`rsa.time.duration_str`*:: + -- -Detected executables written to disk by a process. - +A text string version of the duration -type: nested +type: keyword -- -*`crowdstrike.event.SessionId`*:: +*`rsa.time.date`*:: + -- -Session ID of the remote response session. - - type: keyword -- -*`crowdstrike.event.HostnameField`*:: +*`rsa.time.year`*:: + -- -Host name of the machine for the remote session. - - type: keyword -- -*`crowdstrike.event.StartTimestamp`*:: +*`rsa.time.recorded_time`*:: + -- -Start time for the remote session in UTC UNIX format. - +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. type: date -- -*`crowdstrike.event.EndTimestamp`*:: +*`rsa.time.datetime`*:: + -- -End time for the remote session in UTC UNIX format. +type: keyword + +-- +*`rsa.time.effective_time`*:: ++ +-- +This key is the effective time referenced by an individual event in a Standard Timestamp format type: date -- -*`crowdstrike.event.LateralMovement`*:: +*`rsa.time.expire_time`*:: + -- -Lateral movement field for incident. - +This key is the timestamp that explicitly refers to an expiration. -type: long +type: date -- -*`crowdstrike.event.ParentImageFileName`*:: +*`rsa.time.process_time`*:: + -- -Path to the parent process. - +Deprecated, use duration.time type: keyword -- -*`crowdstrike.event.ParentCommandLine`*:: +*`rsa.time.hour`*:: + -- -Parent process command line arguments. - - type: keyword -- -*`crowdstrike.event.GrandparentImageFileName`*:: +*`rsa.time.min`*:: + -- -Path to the grandparent process. - - type: keyword -- -*`crowdstrike.event.GrandparentCommandLine`*:: +*`rsa.time.timestamp`*:: + -- -Grandparent process command line arguments. - - type: keyword -- -*`crowdstrike.event.IOCType`*:: +*`rsa.time.event_queue_time`*:: + -- -CrowdStrike type for indicator of compromise. - +This key is the Time that the event was queued. -type: keyword +type: date -- -*`crowdstrike.event.IOCValue`*:: +*`rsa.time.p_time1`*:: + -- -CrowdStrike value for indicator of compromise. - - type: keyword -- -*`crowdstrike.event.CustomerId`*:: +*`rsa.time.tzone`*:: + -- -Customer identifier. - - type: keyword -- -*`crowdstrike.event.DeviceId`*:: +*`rsa.time.eventtime`*:: + -- -Device on which the event occurred. - - type: keyword -- -*`crowdstrike.event.Ipv`*:: +*`rsa.time.gmtdate`*:: + -- -Protocol for network request. - - type: keyword -- -*`crowdstrike.event.ConnectionDirection`*:: +*`rsa.time.gmttime`*:: + -- -Direction for network connection. - - type: keyword -- -*`crowdstrike.event.EventType`*:: +*`rsa.time.p_date`*:: + -- -CrowdStrike provided event type. - - type: keyword -- -*`crowdstrike.event.HostName`*:: +*`rsa.time.p_month`*:: + -- -Host name of the local machine. - - type: keyword -- -*`crowdstrike.event.ICMPCode`*:: +*`rsa.time.p_time`*:: + -- -RFC2780 ICMP Code field. - - type: keyword -- -*`crowdstrike.event.ICMPType`*:: +*`rsa.time.p_time2`*:: + -- -RFC2780 ICMP Type field. - - type: keyword -- -*`crowdstrike.event.ImageFileName`*:: +*`rsa.time.p_year`*:: + -- -File name of the associated process for the detection. - - type: keyword -- -*`crowdstrike.event.PID`*:: +*`rsa.time.expire_time_str`*:: + -- -Associated process id for the detection. - +This key is used to capture incomplete timestamp that explicitly refers to an expiration. -type: long +type: keyword -- -*`crowdstrike.event.LocalAddress`*:: +*`rsa.time.stamp`*:: + -- -IP address of local machine. - +Deprecated key defined only in table map. -type: ip +type: date -- -*`crowdstrike.event.LocalPort`*:: + +*`rsa.misc.action`*:: + -- -Port of local machine. - - -type: long +type: keyword -- -*`crowdstrike.event.RemoteAddress`*:: +*`rsa.misc.result`*:: + -- -IP address of remote machine. - +This key is used to capture the outcome/result string value of an action in a session. -type: ip +type: keyword -- -*`crowdstrike.event.RemotePort`*:: +*`rsa.misc.severity`*:: + -- -Port of remote machine. - +This key is used to capture the severity given the session -type: long +type: keyword -- -*`crowdstrike.event.RuleAction`*:: +*`rsa.misc.event_type`*:: + -- -Firewall rule action. - +This key captures the event category type as specified by the event source. type: keyword -- -*`crowdstrike.event.RuleDescription`*:: +*`rsa.misc.reference_id`*:: + -- -Firewall rule description. - +This key is used to capture an event id from the session directly type: keyword -- -*`crowdstrike.event.RuleFamilyID`*:: +*`rsa.misc.version`*:: + -- -Firewall rule family id. - +This key captures Version of the application or OS which is generating the event. type: keyword -- -*`crowdstrike.event.RuleGroupName`*:: +*`rsa.misc.disposition`*:: + -- -Firewall rule group name. - +This key captures the The end state of an action. type: keyword -- -*`crowdstrike.event.RuleName`*:: +*`rsa.misc.result_code`*:: + -- -Firewall rule name. - +This key is used to capture the outcome/result numeric value of an action in a session type: keyword -- -*`crowdstrike.event.RuleId`*:: +*`rsa.misc.category`*:: + -- -Firewall rule id. - +This key is used to capture the category of an event given by the vendor in the session type: keyword -- -*`crowdstrike.event.MatchCount`*:: +*`rsa.misc.obj_name`*:: + -- -Number of firewall rule matches. - +This is used to capture name of object -type: long +type: keyword -- -*`crowdstrike.event.MatchCountSinceLastReport`*:: +*`rsa.misc.obj_type`*:: + -- -Number of firewall rule matches since the last report. - +This is used to capture type of object -type: long +type: keyword -- -*`crowdstrike.event.Timestamp`*:: +*`rsa.misc.event_source`*:: + -- -Firewall rule triggered timestamp. - +This key captures Source of the event that’s not a hostname -type: date +type: keyword -- -*`crowdstrike.event.Flags.Audit`*:: +*`rsa.misc.log_session_id`*:: + -- -CrowdStrike audit flag. - +This key is used to capture a sessionid from the session directly -type: boolean +type: keyword -- -*`crowdstrike.event.Flags.Log`*:: +*`rsa.misc.group`*:: + -- -CrowdStrike log flag. - +This key captures the Group Name value -type: boolean +type: keyword -- -*`crowdstrike.event.Flags.Monitor`*:: +*`rsa.misc.policy_name`*:: + -- -CrowdStrike monitor flag. - +This key is used to capture the Policy Name only. -type: boolean +type: keyword -- -*`crowdstrike.event.Protocol`*:: +*`rsa.misc.rule_name`*:: + -- -CrowdStrike provided protocol. - +This key captures the Rule Name type: keyword -- -*`crowdstrike.event.NetworkProfile`*:: +*`rsa.misc.context`*:: + -- -CrowdStrike network profile. - +This key captures Information which adds additional context to the event. type: keyword -- -*`crowdstrike.event.PolicyName`*:: +*`rsa.misc.change_new`*:: + -- -CrowdStrike policy name. - +This key is used to capture the new values of the attribute that’s changing in a session type: keyword -- -*`crowdstrike.event.PolicyID`*:: +*`rsa.misc.space`*:: + -- -CrowdStrike policy id. - - type: keyword -- -*`crowdstrike.event.Status`*:: +*`rsa.misc.client`*:: + -- -CrowdStrike status. - +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. type: keyword -- -*`crowdstrike.event.TreeID`*:: +*`rsa.misc.msgIdPart1`*:: + -- -CrowdStrike tree id. - - type: keyword -- -*`crowdstrike.event.Commands`*:: +*`rsa.misc.msgIdPart2`*:: + -- -Commands run in a remote session. - - type: keyword -- -[[exported-fields-cylance]] -== CylanceProtect fields - -cylance fields. - - - -*`network.interface.name`*:: +*`rsa.misc.change_old`*:: + -- -Name of the network interface where the traffic has been observed. - +This key is used to capture the old value of the attribute that’s changing in a session type: keyword -- - - -*`rsa.internal.msg`*:: +*`rsa.misc.operation_id`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +An alert number or operation number. The values should be unique and non-repeating. type: keyword -- -*`rsa.internal.messageid`*:: +*`rsa.misc.event_state`*:: + -- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + type: keyword -- -*`rsa.internal.event_desc`*:: +*`rsa.misc.group_object`*:: + -- +This key captures a collection/grouping of entities. Specific usage + type: keyword -- -*`rsa.internal.message`*:: +*`rsa.misc.node`*:: + -- -This key captures the contents of instant messages +Common use case is the node name within a cluster. The cluster name is reflected by the host name. type: keyword -- -*`rsa.internal.time`*:: +*`rsa.misc.rule`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. +This key captures the Rule number -type: date +type: keyword -- -*`rsa.internal.level`*:: +*`rsa.misc.device_name`*:: + -- -Deprecated key defined only in table map. +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc -type: long +type: keyword -- -*`rsa.internal.msg_id`*:: +*`rsa.misc.param`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is the parameters passed as part of a command or application, etc. type: keyword -- -*`rsa.internal.msg_vid`*:: +*`rsa.misc.change_attrib`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the name of the attribute that’s changing in a session type: keyword -- -*`rsa.internal.data`*:: +*`rsa.misc.event_computer`*:: + -- -Deprecated key defined only in table map. +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. type: keyword -- -*`rsa.internal.obj_server`*:: +*`rsa.misc.reference_id1`*:: + -- -Deprecated key defined only in table map. +This key is for Linked ID to be used as an addition to "reference.id" type: keyword -- -*`rsa.internal.obj_val`*:: +*`rsa.misc.event_log`*:: + -- -Deprecated key defined only in table map. +This key captures the Name of the event log type: keyword -- -*`rsa.internal.resource`*:: +*`rsa.misc.OS`*:: + -- -Deprecated key defined only in table map. +This key captures the Name of the Operating System type: keyword -- -*`rsa.internal.obj_id`*:: +*`rsa.misc.terminal`*:: + -- -Deprecated key defined only in table map. +This key captures the Terminal Names only type: keyword -- -*`rsa.internal.statement`*:: +*`rsa.misc.msgIdPart3`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.audit_class`*:: +*`rsa.misc.filter`*:: + -- -Deprecated key defined only in table map. +This key captures Filter used to reduce result set type: keyword -- -*`rsa.internal.entry`*:: +*`rsa.misc.serial_number`*:: + -- -Deprecated key defined only in table map. +This key is the Serial number associated with a physical asset. type: keyword -- -*`rsa.internal.hcode`*:: +*`rsa.misc.checksum`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. type: keyword -- -*`rsa.internal.inode`*:: +*`rsa.misc.event_user`*:: + -- -Deprecated key defined only in table map. +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. -type: long +type: keyword -- -*`rsa.internal.resource_class`*:: +*`rsa.misc.virusname`*:: + -- -Deprecated key defined only in table map. +This key captures the name of the virus type: keyword -- -*`rsa.internal.dead`*:: +*`rsa.misc.content_type`*:: + -- -Deprecated key defined only in table map. +This key is used to capture Content Type only. -type: long +type: keyword -- -*`rsa.internal.feed_desc`*:: +*`rsa.misc.group_id`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Group ID Number (related to the group name) type: keyword -- -*`rsa.internal.feed_name`*:: +*`rsa.misc.policy_id`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise type: keyword -- -*`rsa.internal.cid`*:: +*`rsa.misc.vsys`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Virtual System Name type: keyword -- -*`rsa.internal.device_class`*:: +*`rsa.misc.connection_id`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Connection ID type: keyword -- -*`rsa.internal.device_group`*:: +*`rsa.misc.reference_id2`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. type: keyword -- -*`rsa.internal.device_host`*:: +*`rsa.misc.sensor`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Name of the sensor. Typically used in IDS/IPS based devices type: keyword -- -*`rsa.internal.device_ip`*:: +*`rsa.misc.sig_id`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures IDS/IPS Int Signature ID -type: ip +type: long -- -*`rsa.internal.device_ipv6`*:: +*`rsa.misc.port_name`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). -type: ip +type: keyword -- -*`rsa.internal.device_type`*:: +*`rsa.misc.rule_group`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Rule group name type: keyword -- -*`rsa.internal.device_type_id`*:: +*`rsa.misc.risk_num`*:: + -- -Deprecated key defined only in table map. +This key captures a Numeric Risk value -type: long +type: double -- -*`rsa.internal.did`*:: +*`rsa.misc.trigger_val`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Value of the trigger or threshold condition. type: keyword -- -*`rsa.internal.entropy_req`*:: +*`rsa.misc.log_session_id1`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +This key is used to capture a Linked (Related) Session ID from the session directly -type: long +type: keyword -- -*`rsa.internal.entropy_res`*:: +*`rsa.misc.comp_version`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +This key captures the Version level of a sub-component of a product. -type: long +type: keyword -- -*`rsa.internal.event_name`*:: +*`rsa.misc.content_version`*:: + -- -Deprecated key defined only in table map. +This key captures Version level of a signature or database content. type: keyword -- -*`rsa.internal.feed_category`*:: +*`rsa.misc.hardware_id`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture unique identifier for a device or system (NOT a Mac address) type: keyword -- -*`rsa.internal.forward_ip`*:: +*`rsa.misc.risk`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. +This key captures the non-numeric risk value -type: ip +type: keyword -- -*`rsa.internal.forward_ipv6`*:: +*`rsa.misc.event_id`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: ip +type: keyword -- -*`rsa.internal.header_id`*:: +*`rsa.misc.reason`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.lc_cid`*:: +*`rsa.misc.status`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`rsa.misc.mail_id`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the mailbox id/name -type: date +type: keyword -- -*`rsa.internal.mcb_req`*:: +*`rsa.misc.rule_uid`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +This key is the Unique Identifier for a rule. -type: long +type: keyword -- -*`rsa.internal.mcb_res`*:: +*`rsa.misc.trigger_desc`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +This key captures the Description of the trigger or threshold condition. -type: long +type: keyword -- -*`rsa.internal.mcbc_req`*:: +*`rsa.misc.inout`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - -type: long +type: keyword -- -*`rsa.internal.mcbc_res`*:: +*`rsa.misc.p_msgid`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - -type: long +type: keyword -- -*`rsa.internal.medium`*:: +*`rsa.misc.data_type`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session - -type: long +type: keyword -- -*`rsa.internal.node_name`*:: +*`rsa.misc.msgIdPart4`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.nwe_callback_id`*:: +*`rsa.misc.error`*:: + -- -This key denotes that event is endpoint related +This key captures All non successful Error codes or responses type: keyword -- -*`rsa.internal.parse_error`*:: +*`rsa.misc.index`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.payload_req`*:: +*`rsa.misc.listnum`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +This key is used to capture listname or listnumber, primarily for collecting access-list -type: long +type: keyword -- -*`rsa.internal.payload_res`*:: +*`rsa.misc.ntype`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - -type: long +type: keyword -- -*`rsa.internal.process_vid_dst`*:: +*`rsa.misc.observed_val`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. +This key captures the Value observed (from the perspective of the device generating the log). type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`rsa.misc.policy_value`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +This key captures the contents of the policy. This contains details about the policy type: keyword -- -*`rsa.internal.rid`*:: +*`rsa.misc.pool_name`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the name of a resource pool -type: long +type: keyword -- -*`rsa.internal.session_split`*:: +*`rsa.misc.rule_template`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template type: keyword -- -*`rsa.internal.site`*:: +*`rsa.misc.count`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.size`*:: +*`rsa.misc.number`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: long +type: keyword -- -*`rsa.internal.sourcefile`*:: +*`rsa.misc.sigcat`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: keyword +-- + +*`rsa.misc.type`*:: ++ +-- type: keyword -- -*`rsa.internal.ubc_req`*:: +*`rsa.misc.comments`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +Comment information provided in the log message -type: long +type: keyword -- -*`rsa.internal.ubc_res`*:: +*`rsa.misc.doc_number`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +This key captures File Identification number type: long -- -*`rsa.internal.word`*:: +*`rsa.misc.expected_val`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +This key captures the Value expected (from the perspective of the device generating the log). type: keyword -- - -*`rsa.time.event_time`*:: +*`rsa.misc.job_num`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form +This key captures the Job Number -type: date +type: keyword -- -*`rsa.time.duration_time`*:: -+ --- -This key is used to capture the normalized duration/lifetime in seconds. - -type: double - --- - -*`rsa.time.event_time_str`*:: -+ --- -This key is used to capture the incomplete time mentioned in a session as a string - -type: keyword - --- - -*`rsa.time.starttime`*:: -+ --- -This key is used to capture the Start time mentioned in a session in a standard form - -type: date - --- - -*`rsa.time.month`*:: -+ --- -type: keyword - --- - -*`rsa.time.day`*:: -+ --- -type: keyword - --- - -*`rsa.time.endtime`*:: -+ --- -This key is used to capture the End time mentioned in a session in a standard form - -type: date - --- - -*`rsa.time.timezone`*:: -+ --- -This key is used to capture the timezone of the Event Time - -type: keyword - --- - -*`rsa.time.duration_str`*:: -+ --- -A text string version of the duration - -type: keyword - --- - -*`rsa.time.date`*:: -+ --- -type: keyword - --- - -*`rsa.time.year`*:: -+ --- -type: keyword - --- - -*`rsa.time.recorded_time`*:: -+ --- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - -type: date - --- - -*`rsa.time.datetime`*:: -+ --- -type: keyword - --- - -*`rsa.time.effective_time`*:: -+ --- -This key is the effective time referenced by an individual event in a Standard Timestamp format - -type: date - --- - -*`rsa.time.expire_time`*:: -+ --- -This key is the timestamp that explicitly refers to an expiration. - -type: date - --- - -*`rsa.time.process_time`*:: -+ --- -Deprecated, use duration.time - -type: keyword - --- - -*`rsa.time.hour`*:: -+ --- -type: keyword - --- - -*`rsa.time.min`*:: -+ --- -type: keyword - --- - -*`rsa.time.timestamp`*:: -+ --- -type: keyword - --- - -*`rsa.time.event_queue_time`*:: -+ --- -This key is the Time that the event was queued. - -type: date - --- - -*`rsa.time.p_time1`*:: -+ --- -type: keyword - --- - -*`rsa.time.tzone`*:: -+ --- -type: keyword - --- - -*`rsa.time.eventtime`*:: -+ --- -type: keyword - --- - -*`rsa.time.gmtdate`*:: -+ --- -type: keyword - --- - -*`rsa.time.gmttime`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_date`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_month`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_time`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_time2`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_year`*:: -+ --- -type: keyword - --- - -*`rsa.time.expire_time_str`*:: -+ --- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. - -type: keyword - --- - -*`rsa.time.stamp`*:: -+ --- -Deprecated key defined only in table map. - -type: date - --- - - -*`rsa.misc.action`*:: -+ --- -type: keyword - --- - -*`rsa.misc.result`*:: -+ --- -This key is used to capture the outcome/result string value of an action in a session. - -type: keyword - --- - -*`rsa.misc.severity`*:: -+ --- -This key is used to capture the severity given the session - -type: keyword - --- - -*`rsa.misc.event_type`*:: -+ --- -This key captures the event category type as specified by the event source. - -type: keyword - --- - -*`rsa.misc.reference_id`*:: -+ --- -This key is used to capture an event id from the session directly - -type: keyword - --- - -*`rsa.misc.version`*:: -+ --- -This key captures Version of the application or OS which is generating the event. - -type: keyword - --- - -*`rsa.misc.disposition`*:: -+ --- -This key captures the The end state of an action. - -type: keyword - --- - -*`rsa.misc.result_code`*:: -+ --- -This key is used to capture the outcome/result numeric value of an action in a session - -type: keyword - --- - -*`rsa.misc.category`*:: -+ --- -This key is used to capture the category of an event given by the vendor in the session - -type: keyword - --- - -*`rsa.misc.obj_name`*:: -+ --- -This is used to capture name of object - -type: keyword - --- - -*`rsa.misc.obj_type`*:: -+ --- -This is used to capture type of object - -type: keyword - --- - -*`rsa.misc.event_source`*:: -+ --- -This key captures Source of the event that’s not a hostname - -type: keyword - --- - -*`rsa.misc.log_session_id`*:: -+ --- -This key is used to capture a sessionid from the session directly - -type: keyword - --- - -*`rsa.misc.group`*:: -+ --- -This key captures the Group Name value - -type: keyword - --- - -*`rsa.misc.policy_name`*:: -+ --- -This key is used to capture the Policy Name only. - -type: keyword - --- - -*`rsa.misc.rule_name`*:: -+ --- -This key captures the Rule Name - -type: keyword - --- - -*`rsa.misc.context`*:: -+ --- -This key captures Information which adds additional context to the event. - -type: keyword - --- - -*`rsa.misc.change_new`*:: -+ --- -This key is used to capture the new values of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.space`*:: -+ --- -type: keyword - --- - -*`rsa.misc.client`*:: -+ --- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - -type: keyword - --- - -*`rsa.misc.msgIdPart1`*:: -+ --- -type: keyword - --- - -*`rsa.misc.msgIdPart2`*:: -+ --- -type: keyword - --- - -*`rsa.misc.change_old`*:: -+ --- -This key is used to capture the old value of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.operation_id`*:: -+ --- -An alert number or operation number. The values should be unique and non-repeating. - -type: keyword - --- - -*`rsa.misc.event_state`*:: -+ --- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. - -type: keyword - --- - -*`rsa.misc.group_object`*:: -+ --- -This key captures a collection/grouping of entities. Specific usage - -type: keyword - --- - -*`rsa.misc.node`*:: -+ --- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. - -type: keyword - --- - -*`rsa.misc.rule`*:: -+ --- -This key captures the Rule number - -type: keyword - --- - -*`rsa.misc.device_name`*:: -+ --- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc - -type: keyword - --- - -*`rsa.misc.param`*:: -+ --- -This key is the parameters passed as part of a command or application, etc. - -type: keyword - --- - -*`rsa.misc.change_attrib`*:: -+ --- -This key is used to capture the name of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.event_computer`*:: -+ --- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - -type: keyword - --- - -*`rsa.misc.reference_id1`*:: -+ --- -This key is for Linked ID to be used as an addition to "reference.id" - -type: keyword - --- - -*`rsa.misc.event_log`*:: -+ --- -This key captures the Name of the event log - -type: keyword - --- - -*`rsa.misc.OS`*:: -+ --- -This key captures the Name of the Operating System - -type: keyword - --- - -*`rsa.misc.terminal`*:: -+ --- -This key captures the Terminal Names only - -type: keyword - --- - -*`rsa.misc.msgIdPart3`*:: -+ --- -type: keyword - --- - -*`rsa.misc.filter`*:: -+ --- -This key captures Filter used to reduce result set - -type: keyword - --- - -*`rsa.misc.serial_number`*:: -+ --- -This key is the Serial number associated with a physical asset. - -type: keyword - --- - -*`rsa.misc.checksum`*:: -+ --- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - -type: keyword - --- - -*`rsa.misc.event_user`*:: -+ --- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - -type: keyword - --- - -*`rsa.misc.virusname`*:: -+ --- -This key captures the name of the virus - -type: keyword - --- - -*`rsa.misc.content_type`*:: -+ --- -This key is used to capture Content Type only. - -type: keyword - --- - -*`rsa.misc.group_id`*:: -+ --- -This key captures Group ID Number (related to the group name) - -type: keyword - --- - -*`rsa.misc.policy_id`*:: -+ --- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - -type: keyword - --- - -*`rsa.misc.vsys`*:: -+ --- -This key captures Virtual System Name - -type: keyword - --- - -*`rsa.misc.connection_id`*:: -+ --- -This key captures the Connection ID - -type: keyword - --- - -*`rsa.misc.reference_id2`*:: -+ --- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - -type: keyword - --- - -*`rsa.misc.sensor`*:: -+ --- -This key captures Name of the sensor. Typically used in IDS/IPS based devices - -type: keyword - --- - -*`rsa.misc.sig_id`*:: -+ --- -This key captures IDS/IPS Int Signature ID - -type: long - --- - -*`rsa.misc.port_name`*:: -+ --- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). - -type: keyword - --- - -*`rsa.misc.rule_group`*:: -+ --- -This key captures the Rule group name - -type: keyword - --- - -*`rsa.misc.risk_num`*:: -+ --- -This key captures a Numeric Risk value - -type: double - --- - -*`rsa.misc.trigger_val`*:: -+ --- -This key captures the Value of the trigger or threshold condition. - -type: keyword - --- - -*`rsa.misc.log_session_id1`*:: -+ --- -This key is used to capture a Linked (Related) Session ID from the session directly - -type: keyword - --- - -*`rsa.misc.comp_version`*:: -+ --- -This key captures the Version level of a sub-component of a product. - -type: keyword - --- - -*`rsa.misc.content_version`*:: -+ --- -This key captures Version level of a signature or database content. - -type: keyword - --- - -*`rsa.misc.hardware_id`*:: -+ --- -This key is used to capture unique identifier for a device or system (NOT a Mac address) - -type: keyword - --- - -*`rsa.misc.risk`*:: -+ --- -This key captures the non-numeric risk value - -type: keyword - --- - -*`rsa.misc.event_id`*:: -+ --- -type: keyword - --- - -*`rsa.misc.reason`*:: -+ --- -type: keyword - --- - -*`rsa.misc.status`*:: -+ --- -type: keyword - --- - -*`rsa.misc.mail_id`*:: -+ --- -This key is used to capture the mailbox id/name - -type: keyword - --- - -*`rsa.misc.rule_uid`*:: -+ --- -This key is the Unique Identifier for a rule. - -type: keyword - --- - -*`rsa.misc.trigger_desc`*:: -+ --- -This key captures the Description of the trigger or threshold condition. - -type: keyword - --- - -*`rsa.misc.inout`*:: -+ --- -type: keyword - --- - -*`rsa.misc.p_msgid`*:: -+ --- -type: keyword - --- - -*`rsa.misc.data_type`*:: -+ --- -type: keyword - --- - -*`rsa.misc.msgIdPart4`*:: -+ --- -type: keyword - --- - -*`rsa.misc.error`*:: -+ --- -This key captures All non successful Error codes or responses - -type: keyword - --- - -*`rsa.misc.index`*:: -+ --- -type: keyword - --- - -*`rsa.misc.listnum`*:: -+ --- -This key is used to capture listname or listnumber, primarily for collecting access-list - -type: keyword - --- - -*`rsa.misc.ntype`*:: -+ --- -type: keyword - --- - -*`rsa.misc.observed_val`*:: -+ --- -This key captures the Value observed (from the perspective of the device generating the log). - -type: keyword - --- - -*`rsa.misc.policy_value`*:: -+ --- -This key captures the contents of the policy. This contains details about the policy - -type: keyword - --- - -*`rsa.misc.pool_name`*:: -+ --- -This key captures the name of a resource pool - -type: keyword - --- - -*`rsa.misc.rule_template`*:: -+ --- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - -type: keyword - --- - -*`rsa.misc.count`*:: -+ --- -type: keyword - --- - -*`rsa.misc.number`*:: -+ --- -type: keyword - --- - -*`rsa.misc.sigcat`*:: -+ --- -type: keyword - --- - -*`rsa.misc.type`*:: -+ --- -type: keyword - --- - -*`rsa.misc.comments`*:: -+ --- -Comment information provided in the log message - -type: keyword - --- - -*`rsa.misc.doc_number`*:: -+ --- -This key captures File Identification number - -type: long - --- - -*`rsa.misc.expected_val`*:: -+ --- -This key captures the Value expected (from the perspective of the device generating the log). - -type: keyword - --- - -*`rsa.misc.job_num`*:: -+ --- -This key captures the Job Number - -type: keyword - --- - -*`rsa.misc.spi_dst`*:: +*`rsa.misc.spi_dst`*:: + -- Destination SPI Index @@ -33120,9092 +32019,6550 @@ type: keyword -- -[[exported-fields-docker-processor]] -== Docker fields - -Docker stats collected from Docker. +[[exported-fields-cloud]] +== Cloud provider metadata fields +Metadata from cloud providers added by the add_cloud_metadata processor. -*`docker.container.id`*:: +*`cloud.image.id`*:: + -- -type: alias +Image ID for the cloud instance. -alias to: container.id + +example: ami-abcd1234 -- -*`docker.container.image`*:: +*`meta.cloud.provider`*:: + -- type: alias -alias to: container.image.name +alias to: cloud.provider -- -*`docker.container.name`*:: +*`meta.cloud.instance_id`*:: + -- type: alias -alias to: container.name +alias to: cloud.instance.id -- -*`docker.container.labels`*:: +*`meta.cloud.instance_name`*:: + -- -Image labels. - +type: alias -type: object +alias to: cloud.instance.name -- -[[exported-fields-ecs]] -== ECS fields +*`meta.cloud.machine_type`*:: ++ +-- +type: alias -ECS Fields. +alias to: cloud.machine.type +-- -*`@timestamp`*:: +*`meta.cloud.availability_zone`*:: + -- -Date/time when the event originated. -This is the date/time extracted from the event, typically representing when the event was generated by the source. -If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. -Required field for all events. - -type: date - -example: 2016-05-23T08:05:34.853Z +type: alias -required: True +alias to: cloud.availability_zone -- -*`labels`*:: +*`meta.cloud.project_id`*:: + -- -Custom key/value pairs. -Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. -Example: `docker` and `k8s` labels. - -type: object +type: alias -example: {"application": "foo-bar", "env": "production"} +alias to: cloud.project.id -- -*`message`*:: +*`meta.cloud.region`*:: + -- -For log events the message field contains the log message, optimized for viewing in a log viewer. -For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. -If multiple messages exist, they can be combined into one message. - -type: text +type: alias -example: Hello World +alias to: cloud.region -- -*`tags`*:: -+ --- -List of keywords used to tag each event. +[[exported-fields-coredns]] +== Coredns fields -type: keyword +Module for handling logs produced by coredns -example: ["production", "env2"] --- [float] -=== agent +=== coredns -The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. -Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken. +coredns fields after normalization -*`agent.build.original`*:: + +*`coredns.id`*:: + -- -Extended build information for the agent. -This field is intended to contain any build information that a data source may provide, no specific formatting is required. +id of the DNS transaction -type: keyword -example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] +type: keyword -- -*`agent.ephemeral_id`*:: +*`coredns.query.size`*:: + -- -Ephemeral identifier of this agent (if one exists). -This id normally changes across restarts, but `agent.id` does not. +size of the DNS query -type: keyword -example: 8a4f500f +type: integer + +format: bytes -- -*`agent.id`*:: +*`coredns.query.class`*:: + -- -Unique identifier of this agent (if one exists). -Example: For Beats this would be beat.id. +DNS query class -type: keyword -example: 8a4f500d +type: keyword -- -*`agent.name`*:: +*`coredns.query.name`*:: + -- -Custom name of the agent. -This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. -If no name is given, the name is often left empty. +DNS query name -type: keyword -example: foo +type: keyword -- -*`agent.type`*:: +*`coredns.query.type`*:: + -- -Type of the agent. -The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. +DNS query type -type: keyword -example: filebeat +type: keyword -- -*`agent.version`*:: +*`coredns.response.code`*:: + -- -Version of the agent. +DNS response code + type: keyword -example: 6.0.0-rc2 +-- +*`coredns.response.flags`*:: ++ -- +DNS response flags -[float] -=== as -An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet. +type: keyword +-- -*`as.number`*:: +*`coredns.response.size`*:: + -- -Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. +size of the DNS response -type: long -example: 15169 +type: integer + +format: bytes -- -*`as.organization.name`*:: +*`coredns.dnssec_ok`*:: + -- -Organization name. +dnssec flag -type: keyword -example: Google LLC +type: boolean -- -*`as.organization.name.text`*:: -+ --- -type: text +[[exported-fields-crowdstrike]] +== Crowdstrike fields + +Module for collecting Crowdstrike events. + --- [float] -=== client +=== crowdstrike -A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records. -For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events. -Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. +Fields for Crowdstrike Falcon event and alert data. -*`client.address`*:: + +[float] +=== metadata + +Meta data fields for each event that include type and timestamp. + + + +*`crowdstrike.metadata.eventType`*:: + -- -Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. -Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. +DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent + type: keyword -- -*`client.as.number`*:: +*`crowdstrike.metadata.eventCreationTime`*:: + -- -Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. +The time this event occurred on the endpoint in UTC UNIX_MS format. -type: long -example: 15169 +type: date -- -*`client.as.organization.name`*:: +*`crowdstrike.metadata.offset`*:: + -- -Organization name. +Offset number that tracks the location of the event in stream. This is used to identify unique detection events. -type: keyword -example: Google LLC +type: integer -- -*`client.as.organization.name.text`*:: +*`crowdstrike.metadata.customerIDString`*:: + -- -type: text +Customer identifier + + +type: keyword -- -*`client.bytes`*:: +*`crowdstrike.metadata.version`*:: + -- -Bytes sent from the client to the server. - -type: long +Schema version -example: 184 -format: bytes +type: keyword -- -*`client.domain`*:: +[float] +=== event + +Event data fields for each event and alert. + + + +*`crowdstrike.event.ProcessStartTime`*:: + -- -Client domain. +The process start time in UTC UNIX_MS format. -type: keyword + +type: date -- -*`client.geo.city_name`*:: +*`crowdstrike.event.ProcessEndTime`*:: + -- -City name. +The process termination time in UTC UNIX_MS format. -type: keyword -example: Montreal +type: date -- -*`client.geo.continent_name`*:: +*`crowdstrike.event.ProcessId`*:: + -- -Name of the continent. +Process ID related to the detection. -type: keyword -example: North America +type: integer -- -*`client.geo.country_iso_code`*:: +*`crowdstrike.event.ParentProcessId`*:: + -- -Country ISO code. +Parent process ID related to the detection. -type: keyword -example: CA +type: integer -- -*`client.geo.country_name`*:: +*`crowdstrike.event.ComputerName`*:: + -- -Country name. +Name of the computer where the detection occurred. -type: keyword -example: Canada +type: keyword -- -*`client.geo.location`*:: +*`crowdstrike.event.UserName`*:: + -- -Longitude and latitude. +User name associated with the detection. -type: geo_point -example: { "lon": -73.614830, "lat": 45.505918 } +type: keyword -- -*`client.geo.name`*:: +*`crowdstrike.event.DetectName`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. +Name of the detection. -type: keyword -example: boston-dc +type: keyword -- -*`client.geo.region_iso_code`*:: +*`crowdstrike.event.DetectDescription`*:: + -- -Region ISO code. +Description of the detection. -type: keyword -example: CA-QC +type: keyword -- -*`client.geo.region_name`*:: +*`crowdstrike.event.Severity`*:: + -- -Region name. +Severity score of the detection. -type: keyword -example: Quebec +type: integer -- -*`client.ip`*:: +*`crowdstrike.event.SeverityName`*:: + -- -IP address of the client (IPv4 or IPv6). +Severity score text. -type: ip + +type: keyword -- -*`client.mac`*:: +*`crowdstrike.event.FileName`*:: + -- -MAC address of the client. +File name of the associated process for the detection. + type: keyword -- -*`client.nat.ip`*:: +*`crowdstrike.event.FilePath`*:: + -- -Translated IP of source based NAT sessions (e.g. internal client to internet). -Typically connections traversing load balancers, firewalls, or routers. +Path of the executable associated with the detection. -type: ip + +type: keyword -- -*`client.nat.port`*:: +*`crowdstrike.event.CommandLine`*:: + -- -Translated port of source based NAT sessions (e.g. internal client to internet). -Typically connections traversing load balancers, firewalls, or routers. +Executable path with command line arguments. -type: long -format: string +type: keyword -- -*`client.packets`*:: +*`crowdstrike.event.SHA1String`*:: + -- -Packets sent from the client to the server. +SHA1 sum of the executable associated with the detection. -type: long -example: 12 +type: keyword -- -*`client.port`*:: +*`crowdstrike.event.SHA256String`*:: + -- -Port of the client. +SHA256 sum of the executable associated with the detection. -type: long -format: string +type: keyword -- -*`client.registered_domain`*:: +*`crowdstrike.event.MD5String`*:: + -- -The highest registered client domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +MD5 sum of the executable associated with the detection. -type: keyword -example: example.com +type: keyword -- -*`client.top_level_domain`*:: +*`crowdstrike.event.MachineDomain`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". +Domain for the machine associated with the detection. -type: keyword -example: co.uk +type: keyword -- -*`client.user.domain`*:: +*`crowdstrike.event.FalconHostLink`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. +URL to view the detection in Falcon. + type: keyword -- -*`client.user.email`*:: +*`crowdstrike.event.SensorId`*:: + -- -User email address. +Unique ID associated with the Falcon sensor. + type: keyword -- -*`client.user.full_name`*:: +*`crowdstrike.event.DetectId`*:: + -- -User's full name, if available. +Unique ID associated with the detection. -type: keyword -example: Albert Einstein +type: keyword -- -*`client.user.full_name.text`*:: +*`crowdstrike.event.LocalIP`*:: + -- -type: text +IP address of the host associated with the detection. + + +type: keyword -- -*`client.user.group.domain`*:: +*`crowdstrike.event.MACAddress`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. +MAC address of the host associated with the detection. + type: keyword -- -*`client.user.group.id`*:: +*`crowdstrike.event.Tactic`*:: + -- -Unique identifier for the group on the system/platform. +MITRE tactic category of the detection. + type: keyword -- -*`client.user.group.name`*:: +*`crowdstrike.event.Technique`*:: + -- -Name of the group. +MITRE technique category of the detection. + type: keyword -- -*`client.user.hash`*:: +*`crowdstrike.event.Objective`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. +Method of detection. + type: keyword -- -*`client.user.id`*:: +*`crowdstrike.event.PatternDispositionDescription`*:: + -- -Unique identifier of the user. +Action taken by Falcon. + type: keyword -- -*`client.user.name`*:: +*`crowdstrike.event.PatternDispositionValue`*:: + -- -Short name or login of the user. +Unique ID associated with action taken. -type: keyword -example: albert +type: integer -- -*`client.user.name.text`*:: +*`crowdstrike.event.PatternDispositionFlags`*:: + -- -type: text +Flags indicating actions taken. + + +type: object -- -*`client.user.roles`*:: +*`crowdstrike.event.State`*:: + -- -Array of user roles at the time of the event. +Whether the incident summary is open and ongoing or closed. + type: keyword -example: ["kibana_admin", "reporting_user"] +-- +*`crowdstrike.event.IncidentStartTime`*:: ++ -- +Start time for the incident in UTC UNIX format. -[float] -=== cloud -Fields related to the cloud or infrastructure the events are coming from. +type: date +-- -*`cloud.account.id`*:: +*`crowdstrike.event.IncidentEndTime`*:: + -- -The cloud account or organization id used to identify different entities in a multi-tenant environment. -Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. +End time for the incident in UTC UNIX format. -type: keyword -example: 666777888999 +type: date -- -*`cloud.account.name`*:: +*`crowdstrike.event.FineScore`*:: + -- -The cloud account name or alias used to identify different entities in a multi-tenant environment. -Examples: AWS account name, Google Cloud ORG display name. +Score for incident. -type: keyword -example: elastic-dev +type: float -- -*`cloud.availability_zone`*:: +*`crowdstrike.event.UserId`*:: + -- -Availability zone in which this host is running. +Email address or user ID associated with the event. -type: keyword -example: us-east-1c +type: keyword -- -*`cloud.instance.id`*:: +*`crowdstrike.event.UserIp`*:: + -- -Instance ID of the host machine. +IP address associated with the user. -type: keyword -example: i-1234567890abcdef0 +type: keyword -- -*`cloud.instance.name`*:: +*`crowdstrike.event.OperationName`*:: + -- -Instance name of the host machine. +Event subtype. + type: keyword -- -*`cloud.machine.type`*:: +*`crowdstrike.event.ServiceName`*:: + -- -Machine type of the host machine. +Service associated with this event. -type: keyword -example: t2.medium +type: keyword -- -*`cloud.project.id`*:: +*`crowdstrike.event.Success`*:: + -- -The cloud project identifier. -Examples: Google Cloud Project id, Azure Project id. +Indicator of whether or not this event was successful. -type: keyword -example: my-project +type: boolean -- -*`cloud.project.name`*:: +*`crowdstrike.event.UTCTimestamp`*:: + -- -The cloud project name. -Examples: Google Cloud Project name, Azure Project name. +Timestamp associated with this event in UTC UNIX format. -type: keyword -example: my project +type: date -- -*`cloud.provider`*:: +*`crowdstrike.event.AuditKeyValues`*:: + -- -Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. +Fields that were changed in this event. -type: keyword -example: aws +type: nested -- -*`cloud.region`*:: +*`crowdstrike.event.ExecutablesWritten`*:: + -- -Region in which this host is running. +Detected executables written to disk by a process. -type: keyword -example: us-east-1 +type: nested -- -[float] -=== code_signature - -These fields contain information about binary code signatures. - - -*`code_signature.exists`*:: +*`crowdstrike.event.SessionId`*:: + -- -Boolean to capture if a signature is present. +Session ID of the remote response session. -type: boolean -example: true +type: keyword -- -*`code_signature.status`*:: +*`crowdstrike.event.HostnameField`*:: + -- -Additional information about the certificate status. -This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. +Host name of the machine for the remote session. -type: keyword -example: ERROR_UNTRUSTED_ROOT +type: keyword -- -*`code_signature.subject_name`*:: +*`crowdstrike.event.StartTimestamp`*:: + -- -Subject name of the code signer +Start time for the remote session in UTC UNIX format. -type: keyword -example: Microsoft Corporation +type: date -- -*`code_signature.trusted`*:: +*`crowdstrike.event.EndTimestamp`*:: + -- -Stores the trust status of the certificate chain. -Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. +End time for the remote session in UTC UNIX format. -type: boolean -example: true +type: date -- -*`code_signature.valid`*:: +*`crowdstrike.event.LateralMovement`*:: + -- -Boolean to capture if the digital signature is verified against the binary content. -Leave unpopulated if a certificate was unchecked. +Lateral movement field for incident. -type: boolean -example: true +type: long -- -[float] -=== container - -Container fields are used for meta information about the specific container that is the source of information. -These fields help correlate data based containers from any runtime. - - -*`container.id`*:: +*`crowdstrike.event.ParentImageFileName`*:: + -- -Unique container id. +Path to the parent process. + type: keyword -- -*`container.image.name`*:: +*`crowdstrike.event.ParentCommandLine`*:: + -- -Name of the image the container was built on. +Parent process command line arguments. + type: keyword -- -*`container.image.tag`*:: +*`crowdstrike.event.GrandparentImageFileName`*:: + -- -Container image tags. +Path to the grandparent process. + type: keyword -- -*`container.labels`*:: +*`crowdstrike.event.GrandparentCommandLine`*:: + -- -Image labels. +Grandparent process command line arguments. -type: object + +type: keyword -- -*`container.name`*:: +*`crowdstrike.event.IOCType`*:: + -- -Container name. +CrowdStrike type for indicator of compromise. + type: keyword -- -*`container.runtime`*:: +*`crowdstrike.event.IOCValue`*:: + -- -Runtime managing this container. +CrowdStrike value for indicator of compromise. -type: keyword -example: docker +type: keyword -- -[float] -=== destination - -Destination fields describe details about the destination of a packet/event. -Destination fields are usually populated in conjunction with source fields. - - -*`destination.address`*:: +*`crowdstrike.event.CustomerId`*:: + -- -Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. -Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. +Customer identifier. + type: keyword -- -*`destination.as.number`*:: +*`crowdstrike.event.DeviceId`*:: + -- -Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. +Device on which the event occurred. -type: long -example: 15169 +type: keyword -- -*`destination.as.organization.name`*:: +*`crowdstrike.event.Ipv`*:: + -- -Organization name. +Protocol for network request. -type: keyword -example: Google LLC +type: keyword -- -*`destination.as.organization.name.text`*:: +*`crowdstrike.event.ConnectionDirection`*:: + -- -type: text +Direction for network connection. + + +type: keyword -- -*`destination.bytes`*:: +*`crowdstrike.event.EventType`*:: + -- -Bytes sent from the destination to the source. - -type: long +CrowdStrike provided event type. -example: 184 -format: bytes +type: keyword -- -*`destination.domain`*:: +*`crowdstrike.event.HostName`*:: + -- -Destination domain. +Host name of the local machine. + type: keyword -- -*`destination.geo.city_name`*:: +*`crowdstrike.event.ICMPCode`*:: + -- -City name. +RFC2780 ICMP Code field. -type: keyword -example: Montreal +type: keyword -- -*`destination.geo.continent_name`*:: +*`crowdstrike.event.ICMPType`*:: + -- -Name of the continent. +RFC2780 ICMP Type field. -type: keyword -example: North America +type: keyword -- -*`destination.geo.country_iso_code`*:: +*`crowdstrike.event.ImageFileName`*:: + -- -Country ISO code. +File name of the associated process for the detection. -type: keyword -example: CA +type: keyword -- -*`destination.geo.country_name`*:: +*`crowdstrike.event.PID`*:: + -- -Country name. +Associated process id for the detection. -type: keyword -example: Canada +type: long -- -*`destination.geo.location`*:: +*`crowdstrike.event.LocalAddress`*:: + -- -Longitude and latitude. +IP address of local machine. -type: geo_point -example: { "lon": -73.614830, "lat": 45.505918 } +type: ip -- -*`destination.geo.name`*:: +*`crowdstrike.event.LocalPort`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. +Port of local machine. -type: keyword -example: boston-dc +type: long -- -*`destination.geo.region_iso_code`*:: +*`crowdstrike.event.RemoteAddress`*:: + -- -Region ISO code. +IP address of remote machine. -type: keyword -example: CA-QC +type: ip -- -*`destination.geo.region_name`*:: +*`crowdstrike.event.RemotePort`*:: + -- -Region name. +Port of remote machine. -type: keyword -example: Quebec +type: long -- -*`destination.ip`*:: +*`crowdstrike.event.RuleAction`*:: + -- -IP address of the destination (IPv4 or IPv6). +Firewall rule action. -type: ip + +type: keyword -- -*`destination.mac`*:: +*`crowdstrike.event.RuleDescription`*:: + -- -MAC address of the destination. +Firewall rule description. + type: keyword -- -*`destination.nat.ip`*:: +*`crowdstrike.event.RuleFamilyID`*:: + -- -Translated ip of destination based NAT sessions (e.g. internet to private DMZ) -Typically used with load balancers, firewalls, or routers. +Firewall rule family id. -type: ip + +type: keyword -- -*`destination.nat.port`*:: +*`crowdstrike.event.RuleGroupName`*:: + -- -Port the source session is translated to by NAT Device. -Typically used with load balancers, firewalls, or routers. +Firewall rule group name. -type: long -format: string +type: keyword -- -*`destination.packets`*:: +*`crowdstrike.event.RuleName`*:: + -- -Packets sent from the destination to the source. +Firewall rule name. -type: long -example: 12 +type: keyword -- -*`destination.port`*:: +*`crowdstrike.event.RuleId`*:: + -- -Port of the destination. +Firewall rule id. -type: long -format: string +type: keyword -- -*`destination.registered_domain`*:: +*`crowdstrike.event.MatchCount`*:: + -- -The highest registered destination domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +Number of firewall rule matches. -type: keyword -example: example.com +type: long -- -*`destination.top_level_domain`*:: +*`crowdstrike.event.MatchCountSinceLastReport`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". +Number of firewall rule matches since the last report. -type: keyword -example: co.uk +type: long -- -*`destination.user.domain`*:: +*`crowdstrike.event.Timestamp`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. +Firewall rule triggered timestamp. -type: keyword + +type: date -- -*`destination.user.email`*:: +*`crowdstrike.event.Flags.Audit`*:: + -- -User email address. +CrowdStrike audit flag. -type: keyword + +type: boolean -- -*`destination.user.full_name`*:: +*`crowdstrike.event.Flags.Log`*:: + -- -User's full name, if available. +CrowdStrike log flag. -type: keyword -example: Albert Einstein +type: boolean -- -*`destination.user.full_name.text`*:: +*`crowdstrike.event.Flags.Monitor`*:: + -- -type: text +CrowdStrike monitor flag. + + +type: boolean -- -*`destination.user.group.domain`*:: +*`crowdstrike.event.Protocol`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. +CrowdStrike provided protocol. + type: keyword -- -*`destination.user.group.id`*:: +*`crowdstrike.event.NetworkProfile`*:: + -- -Unique identifier for the group on the system/platform. +CrowdStrike network profile. + type: keyword -- -*`destination.user.group.name`*:: +*`crowdstrike.event.PolicyName`*:: + -- -Name of the group. +CrowdStrike policy name. + type: keyword -- -*`destination.user.hash`*:: +*`crowdstrike.event.PolicyID`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. +CrowdStrike policy id. + type: keyword -- -*`destination.user.id`*:: +*`crowdstrike.event.Status`*:: + -- -Unique identifier of the user. +CrowdStrike status. + type: keyword -- -*`destination.user.name`*:: +*`crowdstrike.event.TreeID`*:: + -- -Short name or login of the user. +CrowdStrike tree id. -type: keyword -example: albert +type: keyword -- -*`destination.user.name.text`*:: +*`crowdstrike.event.Commands`*:: + -- -type: text - --- +Commands run in a remote session. -*`destination.user.roles`*:: -+ --- -Array of user roles at the time of the event. type: keyword -example: ["kibana_admin", "reporting_user"] - -- -[float] -=== dll +[[exported-fields-cyberark]] +== Cyber-Ark fields -These fields contain information about code libraries dynamically loaded into processes. +cyberark fields. -Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following: -* Dynamic-link library (`.dll`) commonly used on Windows -* Shared Object (`.so`) commonly used on Unix-like operating systems -* Dynamic library (`.dylib`) commonly used on macOS -*`dll.code_signature.exists`*:: +*`network.interface.name`*:: + -- -Boolean to capture if a signature is present. +Name of the network interface where the traffic has been observed. -type: boolean -example: true +type: keyword -- -*`dll.code_signature.status`*:: + + +*`rsa.internal.msg`*:: + -- -Additional information about the certificate status. -This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. +This key is used to capture the raw message that comes into the Log Decoder type: keyword -example: ERROR_UNTRUSTED_ROOT - -- -*`dll.code_signature.subject_name`*:: +*`rsa.internal.messageid`*:: + -- -Subject name of the code signer - type: keyword -example: Microsoft Corporation - -- -*`dll.code_signature.trusted`*:: +*`rsa.internal.event_desc`*:: + -- -Stores the trust status of the certificate chain. -Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - -type: boolean - -example: true +type: keyword -- -*`dll.code_signature.valid`*:: +*`rsa.internal.message`*:: + -- -Boolean to capture if the digital signature is verified against the binary content. -Leave unpopulated if a certificate was unchecked. - -type: boolean +This key captures the contents of instant messages -example: true +type: keyword -- -*`dll.hash.md5`*:: +*`rsa.internal.time`*:: + -- -MD5 hash. +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -type: keyword +type: date -- -*`dll.hash.sha1`*:: +*`rsa.internal.level`*:: + -- -SHA1 hash. +Deprecated key defined only in table map. -type: keyword +type: long -- -*`dll.hash.sha256`*:: +*`rsa.internal.msg_id`*:: + -- -SHA256 hash. +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`dll.hash.sha512`*:: +*`rsa.internal.msg_vid`*:: + -- -SHA512 hash. +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`dll.name`*:: +*`rsa.internal.data`*:: + -- -Name of the library. -This generally maps to the name of the file on disk. +Deprecated key defined only in table map. type: keyword -example: kernel32.dll - -- -*`dll.path`*:: +*`rsa.internal.obj_server`*:: + -- -Full file path of the library. +Deprecated key defined only in table map. type: keyword -example: C:\Windows\System32\kernel32.dll - -- -*`dll.pe.architecture`*:: +*`rsa.internal.obj_val`*:: + -- -CPU architecture target for the file. +Deprecated key defined only in table map. type: keyword -example: x64 - -- -*`dll.pe.company`*:: +*`rsa.internal.resource`*:: + -- -Internal company name of the file, provided at compile-time. +Deprecated key defined only in table map. type: keyword -example: Microsoft Corporation - -- -*`dll.pe.description`*:: +*`rsa.internal.obj_id`*:: + -- -Internal description of the file, provided at compile-time. +Deprecated key defined only in table map. type: keyword -example: Paint - -- -*`dll.pe.file_version`*:: +*`rsa.internal.statement`*:: + -- -Internal version of the file, provided at compile-time. +Deprecated key defined only in table map. type: keyword -example: 6.3.9600.17415 - -- -*`dll.pe.imphash`*:: +*`rsa.internal.audit_class`*:: + -- -A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. -Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. +Deprecated key defined only in table map. type: keyword -example: 0c6803c4e922103c4dca5963aad36ddf - -- -*`dll.pe.original_file_name`*:: +*`rsa.internal.entry`*:: + -- -Internal name of the file, provided at compile-time. +Deprecated key defined only in table map. type: keyword -example: MSPAINT.EXE - -- -*`dll.pe.product`*:: +*`rsa.internal.hcode`*:: + -- -Internal product name of the file, provided at compile-time. +Deprecated key defined only in table map. type: keyword -example: Microsoft® Windows® Operating System - -- -[float] -=== dns - -Fields describing DNS queries and answers. -DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`). - - -*`dns.answers`*:: +*`rsa.internal.inode`*:: + -- -An array containing an object for each answer section returned by the server. -The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. -Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. +Deprecated key defined only in table map. -type: object +type: long -- -*`dns.answers.class`*:: +*`rsa.internal.resource_class`*:: + -- -The class of DNS data contained in this resource record. +Deprecated key defined only in table map. type: keyword -example: IN - -- -*`dns.answers.data`*:: +*`rsa.internal.dead`*:: + -- -The data describing the resource. -The meaning of this data depends on the type and class of the resource record. - -type: keyword +Deprecated key defined only in table map. -example: 10.10.10.10 +type: long -- -*`dns.answers.name`*:: +*`rsa.internal.feed_desc`*:: + -- -The domain name to which this resource record pertains. -If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: www.example.com - -- -*`dns.answers.ttl`*:: +*`rsa.internal.feed_name`*:: + -- -The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. - -type: long +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -example: 180 +type: keyword -- -*`dns.answers.type`*:: +*`rsa.internal.cid`*:: + -- -The type of data contained in this resource record. +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: CNAME - -- -*`dns.header_flags`*:: +*`rsa.internal.device_class`*:: + -- -Array of 2 letter DNS header flags. -Expected values are: AA, TC, RD, RA, AD, CD, DO. +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: ['RD', 'RA'] - -- -*`dns.id`*:: +*`rsa.internal.device_group`*:: + -- -The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: 62111 - -- -*`dns.op_code`*:: +*`rsa.internal.device_host`*:: + -- -The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: QUERY - -- -*`dns.question.class`*:: +*`rsa.internal.device_ip`*:: + -- -The class of records being queried. - -type: keyword +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -example: IN +type: ip -- -*`dns.question.name`*:: +*`rsa.internal.device_ipv6`*:: + -- -The name being queried. -If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - -type: keyword +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -example: www.example.com +type: ip -- -*`dns.question.registered_domain`*:: +*`rsa.internal.device_type`*:: + -- -The highest registered domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: example.com - -- -*`dns.question.subdomain`*:: +*`rsa.internal.device_type_id`*:: + -- -The subdomain is all of the labels under the registered_domain. -If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. - -type: keyword +Deprecated key defined only in table map. -example: www +type: long -- -*`dns.question.top_level_domain`*:: +*`rsa.internal.did`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: co.uk - -- -*`dns.question.type`*:: +*`rsa.internal.entropy_req`*:: + -- -The type of record being queried. - -type: keyword +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -example: AAAA +type: long -- -*`dns.resolved_ip`*:: +*`rsa.internal.entropy_res`*:: + -- -Array containing all IPs seen in `answers.data`. -The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. - -type: ip +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -example: ['10.10.10.10', '10.10.10.11'] +type: long -- -*`dns.response_code`*:: +*`rsa.internal.event_name`*:: + -- -The DNS response code. +Deprecated key defined only in table map. type: keyword -example: NOERROR - -- -*`dns.type`*:: +*`rsa.internal.feed_category`*:: + -- -The type of DNS event captured, query or answer. -If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. -If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: answer - -- -[float] -=== ecs - -Meta-information specific to ECS. - - -*`ecs.version`*:: +*`rsa.internal.forward_ip`*:: + -- -ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. -When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - -type: keyword - -example: 1.0.0 +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -required: True +type: ip -- -[float] -=== error +*`rsa.internal.forward_ipv6`*:: ++ +-- +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -These fields can represent errors of any kind. -Use them for errors that happen while fetching events or in cases where the event itself contains an error. +type: ip +-- -*`error.code`*:: +*`rsa.internal.header_id`*:: + -- -Error code describing the error. +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`error.id`*:: +*`rsa.internal.lc_cid`*:: + -- -Unique identifier for the error. +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`error.message`*:: +*`rsa.internal.lc_ctime`*:: + -- -Error message. +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: date -- -*`error.stack_trace`*:: +*`rsa.internal.mcb_req`*:: + -- -The stack trace of this error in plain text. - -type: keyword +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most -Field is not indexed. +type: long -- -*`error.stack_trace.text`*:: +*`rsa.internal.mcb_res`*:: + -- -type: text +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`error.type`*:: +*`rsa.internal.mcbc_req`*:: + -- -The type of the error, for example the class name of the exception. - -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -example: java.lang.NullPointerException +type: long -- -[float] -=== event - -The event fields are used for context information about the log or metric event itself. -A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events. - - -*`event.action`*:: +*`rsa.internal.mcbc_res`*:: + -- -The action captured by the event. -This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -example: user-password-change +type: long -- -*`event.category`*:: +*`rsa.internal.medium`*:: + -- -This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. -`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. -This field is an array. This will allow proper categorization of some events that fall in multiple categories. - -type: keyword +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session -example: authentication +type: long -- -*`event.code`*:: +*`rsa.internal.node_name`*:: + -- -Identification code for this event, if one exists. -Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. +Deprecated key defined only in table map. type: keyword -example: 4648 - -- -*`event.created`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -event.created contains the date/time when the event was first read by an agent, or by your pipeline. -This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. -In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. -In case the two timestamps are identical, @timestamp should be used. - -type: date +This key denotes that event is endpoint related -example: 2016-05-23T08:05:34.857Z +type: keyword -- -*`event.dataset`*:: +*`rsa.internal.parse_error`*:: + -- -Name of the dataset. -If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. -It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: apache.access - -- -*`event.duration`*:: +*`rsa.internal.payload_req`*:: + -- -Duration of the event in nanoseconds. -If event.start and event.end are known this value should be the difference between the end and start time. +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep type: long -format: duration - -- -*`event.end`*:: +*`rsa.internal.payload_res`*:: + -- -event.end contains the date when the event ended or when the activity was last observed. +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: date +type: long -- -*`event.hash`*:: +*`rsa.internal.process_vid_dst`*:: + -- -Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. type: keyword -example: 123456789012345678901234567890ABCD - -- -*`event.id`*:: +*`rsa.internal.process_vid_src`*:: + -- -Unique ID to describe the event. +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. type: keyword -example: 8a4f500d - -- -*`event.ingested`*:: +*`rsa.internal.rid`*:: + -- -Timestamp when an event arrived in the central data store. -This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. -In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. - -type: date +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -example: 2016-05-23T08:05:35.101Z +type: long -- -*`event.kind`*:: +*`rsa.internal.session_split`*:: + -- -This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. -`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. -The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: alert - -- -*`event.module`*:: +*`rsa.internal.site`*:: + -- -Name of the module this data is coming from. -If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. +Deprecated key defined only in table map. type: keyword -example: apache - -- -*`event.original`*:: +*`rsa.internal.size`*:: + -- -Raw text message of entire event. Used to demonstrate log integrity. -This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. - -type: keyword - -example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -Field is not indexed. +type: long -- -*`event.outcome`*:: +*`rsa.internal.sourcefile`*:: + -- -This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. -`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. -Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. -Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. -Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: success - -- -*`event.provider`*:: +*`rsa.internal.ubc_req`*:: + -- -Source of the event. -Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). - -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -example: kernel +type: long -- -*`event.reason`*:: +*`rsa.internal.ubc_res`*:: + -- -Reason why this event happened, according to the source. -This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -example: Terminated an unexpected process +type: long -- -*`event.reference`*:: +*`rsa.internal.word`*:: + -- -Reference URL linking to additional information about this event. -This URL links to a static definition of the this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log type: keyword -example: https://system.example.com/event/#0001234 - -- -*`event.risk_score`*:: + +*`rsa.time.event_time`*:: + -- -Risk score or priority of the event (e.g. security solutions). Use your system's original value here. +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form -type: float +type: date -- -*`event.risk_score_norm`*:: +*`rsa.time.duration_time`*:: + -- -Normalized risk score or priority of the event, on a scale of 0 to 100. -This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. +This key is used to capture the normalized duration/lifetime in seconds. -type: float +type: double -- -*`event.sequence`*:: +*`rsa.time.event_time_str`*:: + -- -Sequence number of the event. -The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. - -type: long +This key is used to capture the incomplete time mentioned in a session as a string -format: string +type: keyword -- -*`event.severity`*:: +*`rsa.time.starttime`*:: + -- -The numeric severity of the event according to your event source. -What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. -The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. - -type: long - -example: 7 +This key is used to capture the Start time mentioned in a session in a standard form -format: string +type: date -- -*`event.start`*:: +*`rsa.time.month`*:: + -- -event.start contains the date when the event started or when the activity was first observed. - -type: date +type: keyword -- -*`event.timezone`*:: +*`rsa.time.day`*:: + -- -This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. -Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). - type: keyword -- -*`event.type`*:: +*`rsa.time.endtime`*:: + -- -This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. -`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. -This field is an array. This will allow proper categorization of some events that fall in multiple event types. +This key is used to capture the End time mentioned in a session in a standard form -type: keyword +type: date -- -*`event.url`*:: +*`rsa.time.timezone`*:: + -- -URL linking to an external system to continue investigation of this event. -This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. +This key is used to capture the timezone of the Event Time type: keyword -example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe - -- -[float] -=== file +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration -A file is defined as a set of information that has been created on, or has existed on a filesystem. -File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric. +type: keyword +-- -*`file.accessed`*:: +*`rsa.time.date`*:: + -- -Last time the file was accessed. -Note that not all filesystems keep track of access time. - -type: date +type: keyword -- -*`file.attributes`*:: +*`rsa.time.year`*:: + -- -Array of file attributes. -Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. - type: keyword -example: ["readonly", "system"] - -- -*`file.code_signature.exists`*:: +*`rsa.time.recorded_time`*:: + -- -Boolean to capture if a signature is present. - -type: boolean +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. -example: true +type: date -- -*`file.code_signature.status`*:: +*`rsa.time.datetime`*:: + -- -Additional information about the certificate status. -This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - type: keyword -example: ERROR_UNTRUSTED_ROOT - -- -*`file.code_signature.subject_name`*:: +*`rsa.time.effective_time`*:: + -- -Subject name of the code signer - -type: keyword +This key is the effective time referenced by an individual event in a Standard Timestamp format -example: Microsoft Corporation +type: date -- -*`file.code_signature.trusted`*:: +*`rsa.time.expire_time`*:: + -- -Stores the trust status of the certificate chain. -Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - -type: boolean +This key is the timestamp that explicitly refers to an expiration. -example: true +type: date -- -*`file.code_signature.valid`*:: +*`rsa.time.process_time`*:: + -- -Boolean to capture if the digital signature is verified against the binary content. -Leave unpopulated if a certificate was unchecked. - -type: boolean +Deprecated, use duration.time -example: true +type: keyword -- -*`file.created`*:: +*`rsa.time.hour`*:: + -- -File creation time. -Note that not all filesystems store the creation time. - -type: date +type: keyword -- -*`file.ctime`*:: +*`rsa.time.min`*:: + -- -Last time the file attributes or metadata changed. -Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. - -type: date +type: keyword -- -*`file.device`*:: +*`rsa.time.timestamp`*:: + -- -Device that is the source of the file. - type: keyword -example: sda - -- -*`file.directory`*:: +*`rsa.time.event_queue_time`*:: + -- -Directory where the file is located. It should include the drive letter, when appropriate. - -type: keyword +This key is the Time that the event was queued. -example: /home/alice +type: date -- -*`file.drive_letter`*:: +*`rsa.time.p_time1`*:: + -- -Drive letter where the file is located. This field is only relevant on Windows. -The value should be uppercase, and not include the colon. - type: keyword -example: C - -- -*`file.extension`*:: +*`rsa.time.tzone`*:: + -- -File extension. - type: keyword -example: png - -- -*`file.gid`*:: +*`rsa.time.eventtime`*:: + -- -Primary group ID (GID) of the file. - type: keyword -example: 1001 - -- -*`file.group`*:: +*`rsa.time.gmtdate`*:: + -- -Primary group name of the file. - type: keyword -example: alice - -- -*`file.hash.md5`*:: +*`rsa.time.gmttime`*:: + -- -MD5 hash. - type: keyword -- -*`file.hash.sha1`*:: +*`rsa.time.p_date`*:: + -- -SHA1 hash. - type: keyword -- -*`file.hash.sha256`*:: +*`rsa.time.p_month`*:: + -- -SHA256 hash. - type: keyword -- -*`file.hash.sha512`*:: +*`rsa.time.p_time`*:: + -- -SHA512 hash. - type: keyword -- -*`file.inode`*:: +*`rsa.time.p_time2`*:: + -- -Inode representing the file in the filesystem. - type: keyword -example: 256383 - -- -*`file.mime_type`*:: +*`rsa.time.p_year`*:: + -- -MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. - type: keyword -- -*`file.mode`*:: +*`rsa.time.expire_time_str`*:: + -- -Mode of the file in octal representation. +This key is used to capture incomplete timestamp that explicitly refers to an expiration. type: keyword -example: 0640 - -- -*`file.mtime`*:: +*`rsa.time.stamp`*:: + -- -Last time the file content was modified. +Deprecated key defined only in table map. type: date -- -*`file.name`*:: + +*`rsa.misc.action`*:: + -- -Name of the file including the extension, without the directory. - type: keyword -example: example.png - -- -*`file.owner`*:: +*`rsa.misc.result`*:: + -- -File owner's username. +This key is used to capture the outcome/result string value of an action in a session. type: keyword -example: alice - -- -*`file.path`*:: +*`rsa.misc.severity`*:: + -- -Full path to the file, including the file name. It should include the drive letter, when appropriate. +This key is used to capture the severity given the session type: keyword -example: /home/alice/example.png - -- -*`file.path.text`*:: +*`rsa.misc.event_type`*:: + -- -type: text +This key captures the event category type as specified by the event source. + +type: keyword -- -*`file.pe.architecture`*:: +*`rsa.misc.reference_id`*:: + -- -CPU architecture target for the file. +This key is used to capture an event id from the session directly type: keyword -example: x64 - -- -*`file.pe.company`*:: +*`rsa.misc.version`*:: + -- -Internal company name of the file, provided at compile-time. +This key captures Version of the application or OS which is generating the event. type: keyword -example: Microsoft Corporation - -- -*`file.pe.description`*:: +*`rsa.misc.disposition`*:: + -- -Internal description of the file, provided at compile-time. +This key captures the The end state of an action. type: keyword -example: Paint - -- -*`file.pe.file_version`*:: +*`rsa.misc.result_code`*:: + -- -Internal version of the file, provided at compile-time. +This key is used to capture the outcome/result numeric value of an action in a session type: keyword -example: 6.3.9600.17415 - -- -*`file.pe.imphash`*:: +*`rsa.misc.category`*:: + -- -A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. -Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. +This key is used to capture the category of an event given by the vendor in the session type: keyword -example: 0c6803c4e922103c4dca5963aad36ddf - -- -*`file.pe.original_file_name`*:: +*`rsa.misc.obj_name`*:: + -- -Internal name of the file, provided at compile-time. +This is used to capture name of object type: keyword -example: MSPAINT.EXE - -- -*`file.pe.product`*:: +*`rsa.misc.obj_type`*:: + -- -Internal product name of the file, provided at compile-time. +This is used to capture type of object type: keyword -example: Microsoft® Windows® Operating System - -- -*`file.size`*:: +*`rsa.misc.event_source`*:: + -- -File size in bytes. -Only relevant when `file.type` is "file". - -type: long +This key captures Source of the event that’s not a hostname -example: 16384 +type: keyword -- -*`file.target_path`*:: +*`rsa.misc.log_session_id`*:: + -- -Target path for symlinks. +This key is used to capture a sessionid from the session directly type: keyword -- -*`file.target_path.text`*:: +*`rsa.misc.group`*:: + -- -type: text +This key captures the Group Name value + +type: keyword -- -*`file.type`*:: +*`rsa.misc.policy_name`*:: + -- -File type (file, dir, or symlink). +This key is used to capture the Policy Name only. type: keyword -example: file - -- -*`file.uid`*:: +*`rsa.misc.rule_name`*:: + -- -The user ID (UID) or security identifier (SID) of the file owner. +This key captures the Rule Name type: keyword -example: 1001 - -- -*`file.x509.alternative_names`*:: +*`rsa.misc.context`*:: + -- -List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. +This key captures Information which adds additional context to the event. type: keyword -example: *.elastic.co - -- -*`file.x509.issuer.common_name`*:: +*`rsa.misc.change_new`*:: + -- -List of common name (CN) of issuing certificate authority. +This key is used to capture the new values of the attribute that’s changing in a session type: keyword -example: Example SHA2 High Assurance Server CA - -- -*`file.x509.issuer.country`*:: +*`rsa.misc.space`*:: + -- -List of country (C) codes - type: keyword -example: US - -- -*`file.x509.issuer.distinguished_name`*:: +*`rsa.misc.client`*:: + -- -Distinguished name (DN) of issuing certificate authority. +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. type: keyword -example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA - -- -*`file.x509.issuer.locality`*:: +*`rsa.misc.msgIdPart1`*:: + -- -List of locality names (L) - type: keyword -example: Mountain View - -- -*`file.x509.issuer.organization`*:: +*`rsa.misc.msgIdPart2`*:: + -- -List of organizations (O) of issuing certificate authority. - type: keyword -example: Example Inc - -- -*`file.x509.issuer.organizational_unit`*:: +*`rsa.misc.change_old`*:: + -- -List of organizational units (OU) of issuing certificate authority. +This key is used to capture the old value of the attribute that’s changing in a session type: keyword -example: www.example.com - -- -*`file.x509.issuer.state_or_province`*:: +*`rsa.misc.operation_id`*:: + -- -List of state or province names (ST, S, or P) +An alert number or operation number. The values should be unique and non-repeating. type: keyword -example: California - -- -*`file.x509.not_after`*:: +*`rsa.misc.event_state`*:: + -- -Time at which the certificate is no longer considered valid. - -type: date +This key captures the current state of the object/item referenced within the event. Describing an on-going event. -example: 2020-07-16 03:15:39+00:00 +type: keyword -- -*`file.x509.not_before`*:: +*`rsa.misc.group_object`*:: + -- -Time at which the certificate is first considered valid. - -type: date +This key captures a collection/grouping of entities. Specific usage -example: 2019-08-16 01:40:25+00:00 +type: keyword -- -*`file.x509.public_key_algorithm`*:: +*`rsa.misc.node`*:: + -- -Algorithm used to generate the public key. +Common use case is the node name within a cluster. The cluster name is reflected by the host name. type: keyword -example: RSA - -- -*`file.x509.public_key_curve`*:: +*`rsa.misc.rule`*:: + -- -The curve used by the elliptic curve public key algorithm. This is algorithm specific. +This key captures the Rule number type: keyword -example: nistp521 - -- -*`file.x509.public_key_exponent`*:: +*`rsa.misc.device_name`*:: + -- -Exponent used to derive the public key. This is algorithm specific. - -type: long - -example: 65537 +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc -Field is not indexed. +type: keyword -- -*`file.x509.public_key_size`*:: +*`rsa.misc.param`*:: + -- -The size of the public key space in bits. - -type: long +This key is the parameters passed as part of a command or application, etc. -example: 2048 +type: keyword -- -*`file.x509.serial_number`*:: +*`rsa.misc.change_attrib`*:: + -- -Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. +This key is used to capture the name of the attribute that’s changing in a session type: keyword -example: 55FBB9C7DEBF09809D12CCAA - -- -*`file.x509.signature_algorithm`*:: +*`rsa.misc.event_computer`*:: + -- -Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. type: keyword -example: SHA256-RSA - -- -*`file.x509.subject.common_name`*:: +*`rsa.misc.reference_id1`*:: + -- -List of common names (CN) of subject. +This key is for Linked ID to be used as an addition to "reference.id" type: keyword -example: shared.global.example.net - -- -*`file.x509.subject.country`*:: +*`rsa.misc.event_log`*:: + -- -List of country (C) code +This key captures the Name of the event log type: keyword -example: US - -- -*`file.x509.subject.distinguished_name`*:: +*`rsa.misc.OS`*:: + -- -Distinguished name (DN) of the certificate subject entity. +This key captures the Name of the Operating System type: keyword -example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net - -- -*`file.x509.subject.locality`*:: +*`rsa.misc.terminal`*:: + -- -List of locality names (L) +This key captures the Terminal Names only type: keyword -example: San Francisco - -- -*`file.x509.subject.organization`*:: +*`rsa.misc.msgIdPart3`*:: + -- -List of organizations (O) of subject. - type: keyword -example: Example, Inc. - -- -*`file.x509.subject.organizational_unit`*:: +*`rsa.misc.filter`*:: + -- -List of organizational units (OU) of subject. +This key captures Filter used to reduce result set type: keyword -- -*`file.x509.subject.state_or_province`*:: +*`rsa.misc.serial_number`*:: + -- -List of state or province names (ST, S, or P) +This key is the Serial number associated with a physical asset. type: keyword -example: California - -- -*`file.x509.version_number`*:: +*`rsa.misc.checksum`*:: + -- -Version of x509 format. +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. type: keyword -example: 3 - -- -[float] -=== geo - -Geo fields can carry data about a specific location related to an event. -This geolocation information can be derived from techniques such as Geo IP, or be user-supplied. - - -*`geo.city_name`*:: +*`rsa.misc.event_user`*:: + -- -City name. +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. type: keyword -example: Montreal - -- -*`geo.continent_name`*:: +*`rsa.misc.virusname`*:: + -- -Name of the continent. +This key captures the name of the virus type: keyword -example: North America - -- -*`geo.country_iso_code`*:: +*`rsa.misc.content_type`*:: + -- -Country ISO code. +This key is used to capture Content Type only. type: keyword -example: CA - -- -*`geo.country_name`*:: +*`rsa.misc.group_id`*:: + -- -Country name. +This key captures Group ID Number (related to the group name) type: keyword -example: Canada - -- -*`geo.location`*:: +*`rsa.misc.policy_id`*:: + -- -Longitude and latitude. - -type: geo_point +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise -example: { "lon": -73.614830, "lat": 45.505918 } +type: keyword -- -*`geo.name`*:: +*`rsa.misc.vsys`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. +This key captures Virtual System Name type: keyword -example: boston-dc - -- -*`geo.region_iso_code`*:: +*`rsa.misc.connection_id`*:: + -- -Region ISO code. +This key captures the Connection ID type: keyword -example: CA-QC - -- -*`geo.region_name`*:: +*`rsa.misc.reference_id2`*:: + -- -Region name. +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. type: keyword -example: Quebec - -- -[float] -=== group +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices -The group fields are meant to represent groups that are relevant to the event. +type: keyword +-- -*`group.domain`*:: +*`rsa.misc.sig_id`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. +This key captures IDS/IPS Int Signature ID -type: keyword +type: long -- -*`group.id`*:: +*`rsa.misc.port_name`*:: + -- -Unique identifier for the group on the system/platform. +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). type: keyword -- -*`group.name`*:: +*`rsa.misc.rule_group`*:: + -- -Name of the group. +This key captures the Rule group name type: keyword -- -[float] -=== hash +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value -The hash fields represent different hash algorithms and their values. -Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512). +type: double +-- -*`hash.md5`*:: +*`rsa.misc.trigger_val`*:: + -- -MD5 hash. +This key captures the Value of the trigger or threshold condition. type: keyword -- -*`hash.sha1`*:: +*`rsa.misc.log_session_id1`*:: + -- -SHA1 hash. +This key is used to capture a Linked (Related) Session ID from the session directly type: keyword -- -*`hash.sha256`*:: +*`rsa.misc.comp_version`*:: + -- -SHA256 hash. +This key captures the Version level of a sub-component of a product. type: keyword -- -*`hash.sha512`*:: +*`rsa.misc.content_version`*:: + -- -SHA512 hash. +This key captures Version level of a signature or database content. type: keyword -- -[float] -=== host +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) -A host is defined as a general computing instance. -ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. +type: keyword +-- -*`host.architecture`*:: +*`rsa.misc.risk`*:: + -- -Operating system architecture. +This key captures the non-numeric risk value type: keyword -example: x86_64 - -- -*`host.domain`*:: +*`rsa.misc.event_id`*:: + -- -Name of the domain of which the host is a member. -For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. - type: keyword -example: CONTOSO - -- -*`host.geo.city_name`*:: +*`rsa.misc.reason`*:: + -- -City name. - type: keyword -example: Montreal - -- -*`host.geo.continent_name`*:: +*`rsa.misc.status`*:: + -- -Name of the continent. - type: keyword -example: North America - -- -*`host.geo.country_iso_code`*:: +*`rsa.misc.mail_id`*:: + -- -Country ISO code. +This key is used to capture the mailbox id/name type: keyword -example: CA - -- -*`host.geo.country_name`*:: +*`rsa.misc.rule_uid`*:: + -- -Country name. +This key is the Unique Identifier for a rule. type: keyword -example: Canada - -- -*`host.geo.location`*:: +*`rsa.misc.trigger_desc`*:: + -- -Longitude and latitude. - -type: geo_point +This key captures the Description of the trigger or threshold condition. -example: { "lon": -73.614830, "lat": 45.505918 } +type: keyword -- -*`host.geo.name`*:: +*`rsa.misc.inout`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. - type: keyword -example: boston-dc - -- -*`host.geo.region_iso_code`*:: +*`rsa.misc.p_msgid`*:: + -- -Region ISO code. - type: keyword -example: CA-QC - -- -*`host.geo.region_name`*:: +*`rsa.misc.data_type`*:: + -- -Region name. - type: keyword -example: Quebec - -- -*`host.hostname`*:: +*`rsa.misc.msgIdPart4`*:: + -- -Hostname of the host. -It normally contains what the `hostname` command returns on the host machine. - type: keyword -- -*`host.id`*:: +*`rsa.misc.error`*:: + -- -Unique host id. -As hostname is not always unique, use values that are meaningful in your environment. -Example: The current usage of `beat.name`. +This key captures All non successful Error codes or responses type: keyword -- -*`host.ip`*:: +*`rsa.misc.index`*:: + -- -Host ip addresses. - -type: ip +type: keyword -- -*`host.mac`*:: +*`rsa.misc.listnum`*:: + -- -Host mac addresses. +This key is used to capture listname or listnumber, primarily for collecting access-list type: keyword -- -*`host.name`*:: +*`rsa.misc.ntype`*:: + -- -Name of the host. -It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. - type: keyword -- -*`host.os.family`*:: +*`rsa.misc.observed_val`*:: + -- -OS family (such as redhat, debian, freebsd, windows). +This key captures the Value observed (from the perspective of the device generating the log). type: keyword -example: debian - -- -*`host.os.full`*:: +*`rsa.misc.policy_value`*:: + -- -Operating system name, including the version or code name. +This key captures the contents of the policy. This contains details about the policy type: keyword -example: Mac OS Mojave - -- -*`host.os.full.text`*:: +*`rsa.misc.pool_name`*:: + -- -type: text +This key captures the name of a resource pool + +type: keyword -- -*`host.os.kernel`*:: +*`rsa.misc.rule_template`*:: + -- -Operating system kernel version as a raw string. +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template type: keyword -example: 4.4.0-112-generic - -- -*`host.os.name`*:: +*`rsa.misc.count`*:: + -- -Operating system name, without the version. - type: keyword -example: Mac OS X - -- -*`host.os.name.text`*:: +*`rsa.misc.number`*:: + -- -type: text +type: keyword -- -*`host.os.platform`*:: +*`rsa.misc.sigcat`*:: + -- -Operating system platform (such centos, ubuntu, windows). - type: keyword -example: darwin - -- -*`host.os.version`*:: +*`rsa.misc.type`*:: + -- -Operating system version as a raw string. - type: keyword -example: 10.14.1 - -- -*`host.type`*:: +*`rsa.misc.comments`*:: + -- -Type of host. -For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. +Comment information provided in the log message type: keyword -- -*`host.uptime`*:: +*`rsa.misc.doc_number`*:: + -- -Seconds the host has been up. +This key captures File Identification number type: long -example: 1325 - -- -*`host.user.domain`*:: +*`rsa.misc.expected_val`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. +This key captures the Value expected (from the perspective of the device generating the log). type: keyword -- -*`host.user.email`*:: +*`rsa.misc.job_num`*:: + -- -User email address. +This key captures the Job Number type: keyword -- -*`host.user.full_name`*:: +*`rsa.misc.spi_dst`*:: + -- -User's full name, if available. +Destination SPI Index type: keyword -example: Albert Einstein - -- -*`host.user.full_name.text`*:: +*`rsa.misc.spi_src`*:: + -- -type: text +Source SPI Index + +type: keyword -- -*`host.user.group.domain`*:: +*`rsa.misc.code`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. - type: keyword -- -*`host.user.group.id`*:: +*`rsa.misc.agent_id`*:: + -- -Unique identifier for the group on the system/platform. +This key is used to capture agent id type: keyword -- -*`host.user.group.name`*:: +*`rsa.misc.message_body`*:: + -- -Name of the group. +This key captures the The contents of the message body. type: keyword -- -*`host.user.hash`*:: +*`rsa.misc.phone`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. - type: keyword -- -*`host.user.id`*:: +*`rsa.misc.sig_id_str`*:: + -- -Unique identifier of the user. +This key captures a string object of the sigid variable. type: keyword -- -*`host.user.name`*:: +*`rsa.misc.cmd`*:: + -- -Short name or login of the user. - type: keyword -example: albert - -- -*`host.user.name.text`*:: +*`rsa.misc.misc`*:: + -- -type: text +type: keyword -- -*`host.user.roles`*:: +*`rsa.misc.name`*:: + -- -Array of user roles at the time of the event. - type: keyword -example: ["kibana_admin", "reporting_user"] - -- -[float] -=== http - -Fields related to HTTP activity. Use the `url` field set to store the url of the request. - - -*`http.request.body.bytes`*:: +*`rsa.misc.cpu`*:: + -- -Size in bytes of the request body. +This key is the CPU time used in the execution of the event being recorded. type: long -example: 887 - -format: bytes - -- -*`http.request.body.content`*:: +*`rsa.misc.event_desc`*:: + -- -The full HTTP request body. +This key is used to capture a description of an event available directly or inferred type: keyword -example: Hello world - -- -*`http.request.body.content.text`*:: +*`rsa.misc.sig_id1`*:: + -- -type: text +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long -- -*`http.request.bytes`*:: +*`rsa.misc.im_buddyid`*:: + -- -Total size in bytes of the request (body and headers). - -type: long - -example: 1437 - -format: bytes +type: keyword -- -*`http.request.method`*:: +*`rsa.misc.im_client`*:: + -- -HTTP request method. -Prior to ECS 1.6.0 the following guidance was provided: -"The field value must be normalized to lowercase for querying." -As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 - type: keyword -example: GET, POST, PUT, PoST - -- -*`http.request.referrer`*:: +*`rsa.misc.im_userid`*:: + -- -Referrer for this HTTP request. - type: keyword -example: https://blog.example.com/ - -- -*`http.response.body.bytes`*:: +*`rsa.misc.pid`*:: + -- -Size in bytes of the response body. - -type: long +type: keyword -example: 887 +-- -format: bytes +*`rsa.misc.priority`*:: ++ +-- +type: keyword -- -*`http.response.body.content`*:: +*`rsa.misc.context_subject`*:: + -- -The full HTTP response body. +This key is to be used in an audit context where the subject is the object being identified type: keyword -example: Hello world - -- -*`http.response.body.content.text`*:: +*`rsa.misc.context_target`*:: + -- -type: text +type: keyword -- -*`http.response.bytes`*:: +*`rsa.misc.cve`*:: + -- -Total size in bytes of the response (body and headers). - -type: long - -example: 1437 +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. -format: bytes +type: keyword -- -*`http.response.status_code`*:: +*`rsa.misc.fcatnum`*:: + -- -HTTP response status code. - -type: long - -example: 404 +This key captures Filter Category Number. Legacy Usage -format: string +type: keyword -- -*`http.version`*:: +*`rsa.misc.library`*:: + -- -HTTP version. +This key is used to capture library information in mainframe devices type: keyword -example: 1.1 - -- -[float] -=== interface - -The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated. - - -*`interface.alias`*:: +*`rsa.misc.parent_node`*:: + -- -Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. +This key captures the Parent Node Name. Must be related to node variable. type: keyword -example: outside - -- -*`interface.id`*:: +*`rsa.misc.risk_info`*:: + -- -Interface ID as reported by an observer (typically SNMP interface ID). +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -example: 10 - -- -*`interface.name`*:: +*`rsa.misc.tcp_flags`*:: + -- -Interface name as reported by the system. - -type: keyword +This key is captures the TCP flags set in any packet of session -example: eth0 +type: long -- -[float] -=== log +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service -Details about the event's logging mechanism or logging transport. -The log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`. -The details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields. +type: long +-- -*`log.file.path`*:: +*`rsa.misc.vm_target`*:: + -- -Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. -If the event wasn't read from a log file, do not populate this field. +VMWare Target **VMWARE** only varaible. type: keyword -example: /var/log/fun-times.log - -- -*`log.level`*:: +*`rsa.misc.workspace`*:: + -- -Original log level of the log event. -If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). -Some examples are `warn`, `err`, `i`, `informational`. +This key captures Workspace Description type: keyword -example: error - -- -*`log.logger`*:: +*`rsa.misc.command`*:: + -- -The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. - type: keyword -example: org.elasticsearch.bootstrap.Bootstrap - -- -*`log.origin.file.line`*:: +*`rsa.misc.event_category`*:: + -- -The line number of the file containing the source code which originated the log event. - -type: integer - -example: 42 +type: keyword -- -*`log.origin.file.name`*:: +*`rsa.misc.facilityname`*:: + -- -The name of the file containing the source code which originated the log event. -Note that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`. - type: keyword -example: Bootstrap.java - -- -*`log.origin.function`*:: +*`rsa.misc.forensic_info`*:: + -- -The name of the function or method which originated the log event. - type: keyword -example: init - -- -*`log.original`*:: +*`rsa.misc.jobname`*:: + -- -This is the original log message and contains the full log message before splitting it up in multiple parts. -In contrast to the `message` field which can contain an extracted part of the log message, this field contains the original, full log message. It can have already some modifications applied like encoding or new lines removed to clean up the log message. -This field is not indexed and doc_values are disabled so it can't be queried but the value can be retrieved from `_source`. - type: keyword -example: Sep 19 08:26:10 localhost My log - -Field is not indexed. - -- -*`log.syslog`*:: +*`rsa.misc.mode`*:: + -- -The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. - -type: object +type: keyword -- -*`log.syslog.facility.code`*:: +*`rsa.misc.policy`*:: + -- -The Syslog numeric facility of the log event, if available. -According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. - -type: long - -example: 23 - -format: string +type: keyword -- -*`log.syslog.facility.name`*:: +*`rsa.misc.policy_waiver`*:: + -- -The Syslog text-based facility of the log event, if available. - type: keyword -example: local7 - -- -*`log.syslog.priority`*:: +*`rsa.misc.second`*:: + -- -Syslog numeric priority of the event, if available. -According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - -type: long +type: keyword -example: 135 +-- -format: string +*`rsa.misc.space1`*:: ++ +-- +type: keyword -- -*`log.syslog.severity.code`*:: +*`rsa.misc.subcategory`*:: + -- -The Syslog numeric severity of the log event, if available. -If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. +type: keyword -type: long +-- -example: 3 +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword -- -*`log.syslog.severity.name`*:: +*`rsa.misc.alert_id`*:: + -- -The Syslog numeric severity of the log event, if available. -If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -example: Error - -- -[float] -=== network +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. -The network is defined as the communication path over which a host or network event happens. -The network.* fields should be populated with details about the network activity associated with an event. +type: keyword +-- -*`network.application`*:: +*`rsa.misc.checksum_src`*:: + -- -A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format. -The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". +This key is used to capture the checksum or hash of the source entity such as a file or process. type: keyword -example: aim - -- -*`network.bytes`*:: +*`rsa.misc.fresult`*:: + -- -Total bytes transferred in both directions. -If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. +This key captures the Filter Result type: long -example: 368 - -format: bytes - -- -*`network.community_id`*:: +*`rsa.misc.payload_dst`*:: + -- -A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. -Learn more at https://github.com/corelight/community-id-spec. +This key is used to capture destination payload type: keyword -example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= - -- -*`network.direction`*:: +*`rsa.misc.payload_src`*:: + -- -Direction of the network traffic. -Recommended values are: - * inbound - * outbound - * internal - * external - * unknown - -When mapping events from a host-based monitoring context, populate this field from the host's point of view. -When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter. +This key is used to capture source payload type: keyword -example: inbound - -- -*`network.forwarded_ip`*:: +*`rsa.misc.pool_id`*:: + -- -Host IP address when the source IP address is the proxy. - -type: ip +This key captures the identifier (typically numeric field) of a resource pool -example: 192.1.1.2 +type: keyword -- -*`network.iana_number`*:: +*`rsa.misc.process_id_val`*:: + -- -IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. +This key is a failure key for Process ID when it is not an integer value type: keyword -example: 6 - -- -*`network.inner`*:: +*`rsa.misc.risk_num_comm`*:: + -- -Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) +This key captures Risk Number Community -type: object +type: double -- -*`network.inner.vlan.id`*:: +*`rsa.misc.risk_num_next`*:: + -- -VLAN ID as reported by the observer. - -type: keyword +This key captures Risk Number NextGen -example: 10 +type: double -- -*`network.inner.vlan.name`*:: +*`rsa.misc.risk_num_sand`*:: + -- -Optional VLAN name as reported by the observer. - -type: keyword +This key captures Risk Number SandBox -example: outside +type: double -- -*`network.name`*:: +*`rsa.misc.risk_num_static`*:: + -- -Name given by operators to sections of their network. - -type: keyword +This key captures Risk Number Static -example: Guest Wifi +type: double -- -*`network.packets`*:: +*`rsa.misc.risk_suspicious`*:: + -- -Total packets transferred in both directions. -If `source.packets` and `destination.packets` are known, `network.packets` is their sum. - -type: long +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) -example: 24 +type: keyword -- -*`network.protocol`*:: +*`rsa.misc.risk_warning`*:: + -- -L7 Network protocol name. ex. http, lumberjack, transport protocol. -The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -example: http - -- -*`network.transport`*:: +*`rsa.misc.snmp_oid`*:: + -- -Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) -The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". +SNMP Object Identifier type: keyword -example: tcp - -- -*`network.type`*:: +*`rsa.misc.sql`*:: + -- -In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc -The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". +This key captures the SQL query type: keyword -example: ipv4 - -- -*`network.vlan.id`*:: +*`rsa.misc.vuln_ref`*:: + -- -VLAN ID as reported by the observer. +This key captures the Vulnerability Reference details type: keyword -example: 10 - -- -*`network.vlan.name`*:: +*`rsa.misc.acl_id`*:: + -- -Optional VLAN name as reported by the observer. - type: keyword -example: outside - -- -[float] -=== observer - -An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics. -This could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS. - - -*`observer.egress`*:: +*`rsa.misc.acl_op`*:: + -- -Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. - -type: object +type: keyword -- -*`observer.egress.interface.alias`*:: +*`rsa.misc.acl_pos`*:: + -- -Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. - type: keyword -example: outside - -- -*`observer.egress.interface.id`*:: +*`rsa.misc.acl_table`*:: + -- -Interface ID as reported by an observer (typically SNMP interface ID). - type: keyword -example: 10 - -- -*`observer.egress.interface.name`*:: +*`rsa.misc.admin`*:: + -- -Interface name as reported by the system. - type: keyword -example: eth0 - -- -*`observer.egress.vlan.id`*:: +*`rsa.misc.alarm_id`*:: + -- -VLAN ID as reported by the observer. - type: keyword -example: 10 - -- -*`observer.egress.vlan.name`*:: +*`rsa.misc.alarmname`*:: + -- -Optional VLAN name as reported by the observer. - type: keyword -example: outside - -- -*`observer.egress.zone`*:: +*`rsa.misc.app_id`*:: + -- -Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. - type: keyword -example: Public_Internet - -- -*`observer.geo.city_name`*:: +*`rsa.misc.audit`*:: + -- -City name. - type: keyword -example: Montreal - -- -*`observer.geo.continent_name`*:: +*`rsa.misc.audit_object`*:: + -- -Name of the continent. - type: keyword -example: North America - -- -*`observer.geo.country_iso_code`*:: +*`rsa.misc.auditdata`*:: + -- -Country ISO code. - type: keyword -example: CA - -- -*`observer.geo.country_name`*:: +*`rsa.misc.benchmark`*:: + -- -Country name. - type: keyword -example: Canada - -- -*`observer.geo.location`*:: +*`rsa.misc.bypass`*:: + -- -Longitude and latitude. - -type: geo_point - -example: { "lon": -73.614830, "lat": 45.505918 } +type: keyword -- -*`observer.geo.name`*:: +*`rsa.misc.cache`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. - type: keyword -example: boston-dc - -- -*`observer.geo.region_iso_code`*:: +*`rsa.misc.cache_hit`*:: + -- -Region ISO code. - type: keyword -example: CA-QC - -- -*`observer.geo.region_name`*:: +*`rsa.misc.cefversion`*:: + -- -Region name. - type: keyword -example: Quebec - -- -*`observer.hostname`*:: +*`rsa.misc.cfg_attr`*:: + -- -Hostname of the observer. - type: keyword -- -*`observer.ingress`*:: +*`rsa.misc.cfg_obj`*:: + -- -Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. - -type: object +type: keyword -- -*`observer.ingress.interface.alias`*:: +*`rsa.misc.cfg_path`*:: + -- -Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. - type: keyword -example: outside - -- -*`observer.ingress.interface.id`*:: +*`rsa.misc.changes`*:: + -- -Interface ID as reported by an observer (typically SNMP interface ID). - type: keyword -example: 10 - -- -*`observer.ingress.interface.name`*:: +*`rsa.misc.client_ip`*:: + -- -Interface name as reported by the system. - type: keyword -example: eth0 - -- -*`observer.ingress.vlan.id`*:: +*`rsa.misc.clustermembers`*:: + -- -VLAN ID as reported by the observer. - type: keyword -example: 10 - -- -*`observer.ingress.vlan.name`*:: +*`rsa.misc.cn_acttimeout`*:: + -- -Optional VLAN name as reported by the observer. - type: keyword -example: outside - -- -*`observer.ingress.zone`*:: +*`rsa.misc.cn_asn_src`*:: + -- -Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. - type: keyword -example: DMZ - -- -*`observer.ip`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- -IP addresses of the observer. - -type: ip +type: keyword -- -*`observer.mac`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -MAC addresses of the observer - type: keyword -- -*`observer.name`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -Custom name of the observer. -This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. -If no custom name is needed, the field can be left empty. - type: keyword -example: 1_proxySG - -- -*`observer.os.family`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -OS family (such as redhat, debian, freebsd, windows). - type: keyword -example: debian - -- -*`observer.os.full`*:: +*`rsa.misc.cn_engine_id`*:: + -- -Operating system name, including the version or code name. - type: keyword -example: Mac OS Mojave - -- -*`observer.os.full.text`*:: +*`rsa.misc.cn_engine_type`*:: + -- -type: text +type: keyword -- -*`observer.os.kernel`*:: +*`rsa.misc.cn_f_switch`*:: + -- -Operating system kernel version as a raw string. - type: keyword -example: 4.4.0-112-generic - -- -*`observer.os.name`*:: +*`rsa.misc.cn_flowsampid`*:: + -- -Operating system name, without the version. - type: keyword -example: Mac OS X - -- -*`observer.os.name.text`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- -type: text +type: keyword -- -*`observer.os.platform`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- -Operating system platform (such centos, ubuntu, windows). - type: keyword -example: darwin - -- -*`observer.os.version`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- -Operating system version as a raw string. - type: keyword -example: 10.14.1 - -- -*`observer.product`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- -The product name of the observer. - type: keyword -example: s200 - -- -*`observer.serial_number`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -Observer serial number. - type: keyword -- -*`observer.type`*:: +*`rsa.misc.cn_invalid`*:: + -- -The type of the observer the data is coming from. -There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. - type: keyword -example: firewall - -- -*`observer.vendor`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -Vendor name of the observer. - type: keyword -example: Symantec - -- -*`observer.version`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -Observer version. - type: keyword -- -[float] -=== organization - -The organization fields enrich data with information about the company or entity the data is associated with. -These fields help you arrange or filter data stored in an index by one or multiple organizations. - - -*`organization.id`*:: +*`rsa.misc.cn_l_switch`*:: + -- -Unique identifier for the organization. - type: keyword -- -*`organization.name`*:: +*`rsa.misc.cn_log_did`*:: + -- -Organization name. - type: keyword -- -*`organization.name.text`*:: +*`rsa.misc.cn_log_rid`*:: + -- -type: text +type: keyword -- -[float] -=== os - -The OS fields contain information about the operating system. - - -*`os.family`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -OS family (such as redhat, debian, freebsd, windows). - type: keyword -example: debian - -- -*`os.full`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -Operating system name, including the version or code name. - type: keyword -example: Mac OS Mojave - -- -*`os.full.text`*:: +*`rsa.misc.cn_min_ttl`*:: + -- -type: text +type: keyword -- -*`os.kernel`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- -Operating system kernel version as a raw string. - type: keyword -example: 4.4.0-112-generic - -- -*`os.name`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- -Operating system name, without the version. - type: keyword -example: Mac OS X - -- -*`os.name.text`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -type: text +type: keyword -- -*`os.platform`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -Operating system platform (such centos, ubuntu, windows). - type: keyword -example: darwin - -- -*`os.version`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- -Operating system version as a raw string. - type: keyword -example: 10.14.1 - -- -[float] -=== package - -These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location. - - -*`package.architecture`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -Package architecture. - type: keyword -example: x86_64 - -- -*`package.build_version`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -Additional information about the build version of the installed package. -For example use the commit SHA of a non-released package. - type: keyword -example: 36f4f7e89dd61b0988b12ee000b98966867710cd - -- -*`package.checksum`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -Checksum of the installed package for verification. - type: keyword -example: 68b329da9893e34099c7d8ad5cb9c940 - -- -*`package.description`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- -Description of the package. - type: keyword -example: Open source programming language to build simple/reliable/efficient software. - -- -*`package.install_scope`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -Indicating how the package was installed, e.g. user-local, global. - type: keyword -example: global - -- -*`package.installed`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- -Time when package was installed. - -type: date +type: keyword -- -*`package.license`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -License under which the package was released. -Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). - type: keyword -example: Apache License 2.0 - -- -*`package.name`*:: +*`rsa.misc.cn_mplstoplabip`*:: + -- -Package name - type: keyword -example: go - -- -*`package.path`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -Path where the package is installed. - type: keyword -example: /usr/local/Cellar/go/1.12.9/ - -- -*`package.reference`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -Home page or reference URL of the software in this package, if available. - type: keyword -example: https://golang.org - -- -*`package.size`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -Package size in bytes. - -type: long - -example: 62231 - -format: string +type: keyword -- -*`package.type`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -Type of package. -This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. - type: keyword -example: rpm - -- -*`package.version`*:: +*`rsa.misc.cn_sampint`*:: + -- -Package version - type: keyword -example: 1.12.9 - -- -[float] -=== pe - -These fields contain Windows Portable Executable (PE) metadata. - - -*`pe.architecture`*:: +*`rsa.misc.cn_seqctr`*:: + -- -CPU architecture target for the file. - type: keyword -example: x64 - -- -*`pe.company`*:: +*`rsa.misc.cn_spackets`*:: + -- -Internal company name of the file, provided at compile-time. - type: keyword -example: Microsoft Corporation - -- -*`pe.description`*:: +*`rsa.misc.cn_src_tos`*:: + -- -Internal description of the file, provided at compile-time. - type: keyword -example: Paint - -- -*`pe.file_version`*:: +*`rsa.misc.cn_src_vlan`*:: + -- -Internal version of the file, provided at compile-time. - type: keyword -example: 6.3.9600.17415 - -- -*`pe.imphash`*:: +*`rsa.misc.cn_sysuptime`*:: + -- -A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. -Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - type: keyword -example: 0c6803c4e922103c4dca5963aad36ddf - -- -*`pe.original_file_name`*:: +*`rsa.misc.cn_template_id`*:: + -- -Internal name of the file, provided at compile-time. - type: keyword -example: MSPAINT.EXE - -- -*`pe.product`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- -Internal product name of the file, provided at compile-time. - type: keyword -example: Microsoft® Windows® Operating System - -- -[float] -=== process - -These fields contain information about a process. -These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. - - -*`process.args`*:: +*`rsa.misc.cn_totflowexp`*:: + -- -Array of process arguments, starting with the absolute path to the executable. -May be filtered to protect sensitive information. - type: keyword -example: ['/usr/bin/ssh', '-l', 'user', '10.0.0.16'] - -- -*`process.args_count`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- -Length of the process.args array. -This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. - -type: long - -example: 4 +type: keyword -- -*`process.code_signature.exists`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- -Boolean to capture if a signature is present. - -type: boolean - -example: true +type: keyword -- -*`process.code_signature.status`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- -Additional information about the certificate status. -This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - type: keyword -example: ERROR_UNTRUSTED_ROOT - -- -*`process.code_signature.subject_name`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- -Subject name of the code signer - type: keyword -example: Microsoft Corporation - -- -*`process.code_signature.trusted`*:: +*`rsa.misc.comp_class`*:: + -- -Stores the trust status of the certificate chain. -Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - -type: boolean - -example: true +type: keyword -- -*`process.code_signature.valid`*:: +*`rsa.misc.comp_name`*:: + -- -Boolean to capture if the digital signature is verified against the binary content. -Leave unpopulated if a certificate was unchecked. - -type: boolean - -example: true +type: keyword -- -*`process.command_line`*:: +*`rsa.misc.comp_rbytes`*:: + -- -Full command line that started the process, including the absolute path to the executable, and all arguments. -Some arguments may be filtered to protect sensitive information. - type: keyword -example: /usr/bin/ssh -l user 10.0.0.16 - -- -*`process.command_line.text`*:: +*`rsa.misc.comp_sbytes`*:: + -- -type: text +type: keyword -- -*`process.entity_id`*:: +*`rsa.misc.cpu_data`*:: + -- -Unique identifier for the process. -The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. -Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - type: keyword -example: c2c455d9f99375d - -- -*`process.executable`*:: +*`rsa.misc.criticality`*:: + -- -Absolute path to the process executable. - type: keyword -example: /usr/bin/ssh - -- -*`process.executable.text`*:: +*`rsa.misc.cs_agency_dst`*:: + -- -type: text +type: keyword -- -*`process.exit_code`*:: +*`rsa.misc.cs_analyzedby`*:: + -- -The exit code of the process, if this is a termination event. -The field should be absent if there is no exit code for the event (e.g. process start). - -type: long - -example: 137 +type: keyword -- -*`process.hash.md5`*:: +*`rsa.misc.cs_av_other`*:: + -- -MD5 hash. - type: keyword -- -*`process.hash.sha1`*:: +*`rsa.misc.cs_av_primary`*:: + -- -SHA1 hash. - type: keyword -- -*`process.hash.sha256`*:: +*`rsa.misc.cs_av_secondary`*:: + -- -SHA256 hash. - type: keyword -- -*`process.hash.sha512`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- -SHA512 hash. - type: keyword -- -*`process.name`*:: +*`rsa.misc.cs_bit9status`*:: + -- -Process name. -Sometimes called program name or similar. - type: keyword -example: ssh - -- -*`process.name.text`*:: +*`rsa.misc.cs_context`*:: + -- -type: text +type: keyword -- -*`process.parent.args`*:: +*`rsa.misc.cs_control`*:: + -- -Array of process arguments, starting with the absolute path to the executable. -May be filtered to protect sensitive information. - type: keyword -example: ['/usr/bin/ssh', '-l', 'user', '10.0.0.16'] - -- -*`process.parent.args_count`*:: +*`rsa.misc.cs_data`*:: + -- -Length of the process.args array. -This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. +type: keyword -type: long +-- -example: 4 +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword -- -*`process.parent.code_signature.exists`*:: +*`rsa.misc.cs_dst_tld`*:: + -- -Boolean to capture if a signature is present. - -type: boolean - -example: true +type: keyword -- -*`process.parent.code_signature.status`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- -Additional information about the certificate status. -This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. - type: keyword -example: ERROR_UNTRUSTED_ROOT - -- -*`process.parent.code_signature.subject_name`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -Subject name of the code signer - type: keyword -example: Microsoft Corporation - -- -*`process.parent.code_signature.trusted`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -Stores the trust status of the certificate chain. -Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. - -type: boolean - -example: true +type: keyword -- -*`process.parent.code_signature.valid`*:: +*`rsa.misc.cs_filetype`*:: + -- -Boolean to capture if the digital signature is verified against the binary content. -Leave unpopulated if a certificate was unchecked. - -type: boolean - -example: true +type: keyword -- -*`process.parent.command_line`*:: +*`rsa.misc.cs_fld`*:: + -- -Full command line that started the process, including the absolute path to the executable, and all arguments. -Some arguments may be filtered to protect sensitive information. - type: keyword -example: /usr/bin/ssh -l user 10.0.0.16 - -- -*`process.parent.command_line.text`*:: +*`rsa.misc.cs_if_desc`*:: + -- -type: text +type: keyword -- -*`process.parent.entity_id`*:: +*`rsa.misc.cs_if_name`*:: + -- -Unique identifier for the process. -The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. -Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. - type: keyword -example: c2c455d9f99375d - -- -*`process.parent.executable`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -Absolute path to the process executable. - type: keyword -example: /usr/bin/ssh - -- -*`process.parent.executable.text`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- -type: text +type: keyword -- -*`process.parent.exit_code`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- -The exit code of the process, if this is a termination event. -The field should be absent if there is no exit code for the event (e.g. process start). - -type: long - -example: 137 +type: keyword -- -*`process.parent.hash.md5`*:: +*`rsa.misc.cs_lifetime`*:: + -- -MD5 hash. - type: keyword -- -*`process.parent.hash.sha1`*:: +*`rsa.misc.cs_log_medium`*:: + -- -SHA1 hash. - type: keyword -- -*`process.parent.hash.sha256`*:: +*`rsa.misc.cs_loginname`*:: + -- -SHA256 hash. - type: keyword -- -*`process.parent.hash.sha512`*:: +*`rsa.misc.cs_modulescore`*:: + -- -SHA512 hash. - type: keyword -- -*`process.parent.name`*:: +*`rsa.misc.cs_modulesign`*:: + -- -Process name. -Sometimes called program name or similar. - type: keyword -example: ssh - -- -*`process.parent.name.text`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -type: text +type: keyword -- -*`process.parent.pe.architecture`*:: +*`rsa.misc.cs_payload`*:: + -- -CPU architecture target for the file. - type: keyword -example: x64 - -- -*`process.parent.pe.company`*:: +*`rsa.misc.cs_registrant`*:: + -- -Internal company name of the file, provided at compile-time. - type: keyword -example: Microsoft Corporation - -- -*`process.parent.pe.description`*:: +*`rsa.misc.cs_registrar`*:: + -- -Internal description of the file, provided at compile-time. - type: keyword -example: Paint - -- -*`process.parent.pe.file_version`*:: +*`rsa.misc.cs_represult`*:: + -- -Internal version of the file, provided at compile-time. - type: keyword -example: 6.3.9600.17415 - -- -*`process.parent.pe.imphash`*:: +*`rsa.misc.cs_rpayload`*:: + -- -A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. -Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - type: keyword -example: 0c6803c4e922103c4dca5963aad36ddf - -- -*`process.parent.pe.original_file_name`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -Internal name of the file, provided at compile-time. - type: keyword -example: MSPAINT.EXE - -- -*`process.parent.pe.product`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -Internal product name of the file, provided at compile-time. - type: keyword -example: Microsoft® Windows® Operating System - -- -*`process.parent.pgid`*:: +*`rsa.misc.cs_streams`*:: + -- -Identifier of the group of processes the process belongs to. - -type: long - -format: string +type: keyword -- -*`process.parent.pid`*:: +*`rsa.misc.cs_targetmodule`*:: + -- -Process id. - -type: long - -example: 4242 - -format: string +type: keyword -- -*`process.parent.ppid`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -Parent process' pid. - -type: long - -example: 4241 - -format: string +type: keyword -- -*`process.parent.start`*:: +*`rsa.misc.cs_whois_server`*:: + -- -The time the process started. - -type: date - -example: 2016-05-23T08:05:34.853Z +type: keyword -- -*`process.parent.thread.id`*:: +*`rsa.misc.cs_yararesult`*:: + -- -Thread ID. - -type: long - -example: 4242 - -format: string +type: keyword -- -*`process.parent.thread.name`*:: +*`rsa.misc.description`*:: + -- -Thread name. - type: keyword -example: thread-0 - -- -*`process.parent.title`*:: +*`rsa.misc.devvendor`*:: + -- -Process title. -The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - type: keyword -- -*`process.parent.title.text`*:: +*`rsa.misc.distance`*:: + -- -type: text +type: keyword -- -*`process.parent.uptime`*:: +*`rsa.misc.dstburb`*:: + -- -Seconds the process has been up. - -type: long - -example: 1325 +type: keyword -- -*`process.parent.working_directory`*:: +*`rsa.misc.edomain`*:: + -- -The working directory of the process. - type: keyword -example: /home/alice - -- -*`process.parent.working_directory.text`*:: +*`rsa.misc.edomaub`*:: + -- -type: text +type: keyword -- -*`process.pe.architecture`*:: +*`rsa.misc.euid`*:: + -- -CPU architecture target for the file. - type: keyword -example: x64 - -- -*`process.pe.company`*:: +*`rsa.misc.facility`*:: + -- -Internal company name of the file, provided at compile-time. - type: keyword -example: Microsoft Corporation - -- -*`process.pe.description`*:: +*`rsa.misc.finterface`*:: + -- -Internal description of the file, provided at compile-time. - type: keyword -example: Paint - -- -*`process.pe.file_version`*:: +*`rsa.misc.flags`*:: + -- -Internal version of the file, provided at compile-time. - type: keyword -example: 6.3.9600.17415 - -- -*`process.pe.imphash`*:: +*`rsa.misc.gaddr`*:: + -- -A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. -Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. - type: keyword -example: 0c6803c4e922103c4dca5963aad36ddf - -- -*`process.pe.original_file_name`*:: +*`rsa.misc.id3`*:: + -- -Internal name of the file, provided at compile-time. - type: keyword -example: MSPAINT.EXE - -- -*`process.pe.product`*:: +*`rsa.misc.im_buddyname`*:: + -- -Internal product name of the file, provided at compile-time. - type: keyword -example: Microsoft® Windows® Operating System - -- -*`process.pgid`*:: +*`rsa.misc.im_croomid`*:: + -- -Identifier of the group of processes the process belongs to. - -type: long - -format: string +type: keyword -- -*`process.pid`*:: +*`rsa.misc.im_croomtype`*:: + -- -Process id. - -type: long - -example: 4242 - -format: string +type: keyword -- -*`process.ppid`*:: +*`rsa.misc.im_members`*:: + -- -Parent process' pid. - -type: long - -example: 4241 - -format: string +type: keyword -- -*`process.start`*:: +*`rsa.misc.im_username`*:: + -- -The time the process started. - -type: date - -example: 2016-05-23T08:05:34.853Z +type: keyword -- -*`process.thread.id`*:: +*`rsa.misc.ipkt`*:: + -- -Thread ID. - -type: long +type: keyword -example: 4242 +-- -format: string +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword -- -*`process.thread.name`*:: +*`rsa.misc.ipspri`*:: + -- -Thread name. - type: keyword -example: thread-0 - -- -*`process.title`*:: +*`rsa.misc.latitude`*:: + -- -Process title. -The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. - type: keyword -- -*`process.title.text`*:: +*`rsa.misc.linenum`*:: + -- -type: text +type: keyword -- -*`process.uptime`*:: +*`rsa.misc.list_name`*:: + -- -Seconds the process has been up. +type: keyword -type: long +-- -example: 1325 +*`rsa.misc.load_data`*:: ++ +-- +type: keyword -- -*`process.working_directory`*:: +*`rsa.misc.location_floor`*:: + -- -The working directory of the process. - type: keyword -example: /home/alice - -- -*`process.working_directory.text`*:: +*`rsa.misc.location_mark`*:: + -- -type: text +type: keyword -- -[float] -=== registry - -Fields related to Windows Registry operations. +*`rsa.misc.log_id`*:: ++ +-- +type: keyword +-- -*`registry.data.bytes`*:: +*`rsa.misc.log_type`*:: + -- -Original bytes written with base64 encoding. -For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. - type: keyword -example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA= - -- -*`registry.data.strings`*:: +*`rsa.misc.logid`*:: + -- -Content when writing string types. -Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). - type: keyword -example: ["C:\rta\red_ttp\bin\myapp.exe"] - -- -*`registry.data.type`*:: +*`rsa.misc.logip`*:: + -- -Standard registry type for encoding contents - type: keyword -example: REG_SZ - -- -*`registry.hive`*:: +*`rsa.misc.logname`*:: + -- -Abbreviated name for the hive. - type: keyword -example: HKLM - -- -*`registry.key`*:: +*`rsa.misc.longitude`*:: + -- -Hive-relative path of keys. - type: keyword -example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe - -- -*`registry.path`*:: +*`rsa.misc.lport`*:: + -- -Full path, including hive, key and value - type: keyword -example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger - -- -*`registry.value`*:: +*`rsa.misc.mbug_data`*:: + -- -Name of the value written. - type: keyword -example: Debugger +-- +*`rsa.misc.misc_name`*:: ++ -- +type: keyword -[float] -=== related +-- -This field set is meant to facilitate pivoting around a piece of data. -Some pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`. -A concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`. +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword +-- -*`related.hash`*:: +*`rsa.misc.msgid`*:: + -- -All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). - type: keyword -- -*`related.hosts`*:: +*`rsa.misc.netsessid`*:: + -- -All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - type: keyword -- -*`related.ip`*:: +*`rsa.misc.num`*:: + -- -All of the IPs seen on your event. - -type: ip +type: keyword -- -*`related.user`*:: +*`rsa.misc.number1`*:: + -- -All the user names seen on your event. - type: keyword -- -[float] -=== rule - -Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events. -Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc. +*`rsa.misc.number2`*:: ++ +-- +type: keyword +-- -*`rule.author`*:: +*`rsa.misc.nwwn`*:: + -- -Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. - type: keyword -example: ['Star-Lord'] - -- -*`rule.category`*:: +*`rsa.misc.object`*:: + -- -A categorization value keyword used by the entity using the rule for detection of this event. - type: keyword -example: Attempted Information Leak - -- -*`rule.description`*:: +*`rsa.misc.operation`*:: + -- -The description of the rule generating the event. - type: keyword -example: Block requests to public DNS over HTTPS / TLS protocols - -- -*`rule.id`*:: +*`rsa.misc.opkt`*:: + -- -A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. - type: keyword -example: 101 - -- -*`rule.license`*:: +*`rsa.misc.orig_from`*:: + -- -Name of the license under which the rule used to generate this event is made available. - type: keyword -example: Apache 2.0 - -- -*`rule.name`*:: +*`rsa.misc.owner_id`*:: + -- -The name of the rule or signature generating the event. - type: keyword -example: BLOCK_DNS_over_TLS - -- -*`rule.reference`*:: +*`rsa.misc.p_action`*:: + -- -Reference URL to additional information about the rule used to generate this event. -The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. - type: keyword -example: https://en.wikipedia.org/wiki/DNS_over_TLS - -- -*`rule.ruleset`*:: +*`rsa.misc.p_filter`*:: + -- -Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - type: keyword -example: Standard_Protocol_Filters - -- -*`rule.uuid`*:: +*`rsa.misc.p_group_object`*:: + -- -A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. - type: keyword -example: 1100110011 - -- -*`rule.version`*:: +*`rsa.misc.p_id`*:: + -- -The version / revision of the rule being used for analysis. - type: keyword -example: 1.1 +-- +*`rsa.misc.p_msgid1`*:: ++ -- +type: keyword -[float] -=== server +-- -A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records. -For TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events. -Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword +-- -*`server.address`*:: +*`rsa.misc.p_result1`*:: + -- -Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. -Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - type: keyword -- -*`server.as.number`*:: +*`rsa.misc.password_chg`*:: + -- -Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. +type: keyword -type: long +-- -example: 15169 +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword -- -*`server.as.organization.name`*:: +*`rsa.misc.permgranted`*:: + -- -Organization name. - type: keyword -example: Google LLC - -- -*`server.as.organization.name.text`*:: +*`rsa.misc.permwanted`*:: + -- -type: text +type: keyword -- -*`server.bytes`*:: +*`rsa.misc.pgid`*:: + -- -Bytes sent from the server to the client. - -type: long +type: keyword -example: 184 +-- -format: bytes +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword -- -*`server.domain`*:: +*`rsa.misc.prog_asp_num`*:: + -- -Server domain. - type: keyword -- -*`server.geo.city_name`*:: +*`rsa.misc.program`*:: + -- -City name. - type: keyword -example: Montreal - -- -*`server.geo.continent_name`*:: +*`rsa.misc.real_data`*:: + -- -Name of the continent. - type: keyword -example: North America - -- -*`server.geo.country_iso_code`*:: +*`rsa.misc.rec_asp_device`*:: + -- -Country ISO code. - type: keyword -example: CA - -- -*`server.geo.country_name`*:: +*`rsa.misc.rec_asp_num`*:: + -- -Country name. - type: keyword -example: Canada - -- -*`server.geo.location`*:: +*`rsa.misc.rec_library`*:: + -- -Longitude and latitude. +type: keyword -type: geo_point +-- -example: { "lon": -73.614830, "lat": 45.505918 } +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword -- -*`server.geo.name`*:: +*`rsa.misc.ruid`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. - type: keyword -example: boston-dc - -- -*`server.geo.region_iso_code`*:: +*`rsa.misc.sburb`*:: + -- -Region ISO code. - type: keyword -example: CA-QC - -- -*`server.geo.region_name`*:: +*`rsa.misc.sdomain_fld`*:: + -- -Region name. - type: keyword -example: Quebec - -- -*`server.ip`*:: +*`rsa.misc.sec`*:: + -- -IP address of the server (IPv4 or IPv6). - -type: ip +type: keyword -- -*`server.mac`*:: +*`rsa.misc.sensorname`*:: + -- -MAC address of the server. - type: keyword -- -*`server.nat.ip`*:: +*`rsa.misc.seqnum`*:: + -- -Translated ip of destination based NAT sessions (e.g. internet to private DMZ) -Typically used with load balancers, firewalls, or routers. - -type: ip +type: keyword -- -*`server.nat.port`*:: +*`rsa.misc.session`*:: + -- -Translated port of destination based NAT sessions (e.g. internet to private DMZ) -Typically used with load balancers, firewalls, or routers. +type: keyword -type: long +-- -format: string +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword -- -*`server.packets`*:: +*`rsa.misc.sigUUID`*:: + -- -Packets sent from the server to the client. +type: keyword -type: long +-- -example: 12 +*`rsa.misc.spi`*:: ++ +-- +type: keyword -- -*`server.port`*:: +*`rsa.misc.srcburb`*:: + -- -Port of the server. +type: keyword -type: long +-- -format: string +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword -- -*`server.registered_domain`*:: +*`rsa.misc.srcservice`*:: + -- -The highest registered server domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". - type: keyword -example: example.com - -- -*`server.top_level_domain`*:: +*`rsa.misc.state`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - type: keyword -example: co.uk - -- -*`server.user.domain`*:: +*`rsa.misc.status1`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. - type: keyword -- -*`server.user.email`*:: +*`rsa.misc.svcno`*:: + -- -User email address. - type: keyword -- -*`server.user.full_name`*:: +*`rsa.misc.system`*:: + -- -User's full name, if available. - type: keyword -example: Albert Einstein - -- -*`server.user.full_name.text`*:: +*`rsa.misc.tbdstr1`*:: + -- -type: text +type: keyword -- -*`server.user.group.domain`*:: +*`rsa.misc.tgtdom`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. - type: keyword -- -*`server.user.group.id`*:: +*`rsa.misc.tgtdomain`*:: + -- -Unique identifier for the group on the system/platform. - type: keyword -- -*`server.user.group.name`*:: +*`rsa.misc.threshold`*:: + -- -Name of the group. - type: keyword -- -*`server.user.hash`*:: +*`rsa.misc.type1`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. - type: keyword -- -*`server.user.id`*:: +*`rsa.misc.udb_class`*:: + -- -Unique identifier of the user. - type: keyword -- -*`server.user.name`*:: +*`rsa.misc.url_fld`*:: + -- -Short name or login of the user. - type: keyword -example: albert - -- -*`server.user.name.text`*:: +*`rsa.misc.user_div`*:: + -- -type: text +type: keyword -- -*`server.user.roles`*:: +*`rsa.misc.userid`*:: + -- -Array of user roles at the time of the event. - type: keyword -example: ["kibana_admin", "reporting_user"] +-- +*`rsa.misc.username_fld`*:: ++ -- +type: keyword -[float] -=== service +-- -The service fields describe the service for or from which the data was collected. -These fields help you find and correlate logs for a specific service and version. +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword +-- -*`service.ephemeral_id`*:: +*`rsa.misc.v_instafname`*:: + -- -Ephemeral identifier of this service (if one exists). -This id normally changes across restarts, but `service.id` does not. - type: keyword -example: 8a4f500f - -- -*`service.id`*:: +*`rsa.misc.virt_data`*:: + -- -Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. -This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. -Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. - type: keyword -example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6 - -- -*`service.name`*:: +*`rsa.misc.vpnid`*:: + -- -Name of the service data is collected from. -The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. -In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. - type: keyword -example: elasticsearch-metrics - -- -*`service.node.name`*:: +*`rsa.misc.autorun_type`*:: + -- -Name of a service node. -This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. -In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. +This is used to capture Auto Run type type: keyword -example: instance-0000000016 - -- -*`service.state`*:: +*`rsa.misc.cc_number`*:: + -- -Current state of the service. +Valid Credit Card Numbers only -type: keyword +type: long -- -*`service.type`*:: +*`rsa.misc.content`*:: + -- -The type of the service data is collected from. -The type can be used to group and correlate logs and metrics from one service type. -Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. +This key captures the content type from protocol headers type: keyword -example: elasticsearch - -- -*`service.version`*:: +*`rsa.misc.ein_number`*:: + -- -Version of the service the data was collected from. -This allows to look at a data set only for a specific version of a service. - -type: keyword +Employee Identification Numbers only -example: 3.2.4 +type: long -- -[float] -=== source +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match -Source fields describe details about the source of a packet/event. -Source fields are usually populated in conjunction with destination fields. +type: keyword +-- -*`source.address`*:: +*`rsa.misc.language`*:: + -- -Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. -Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. +This is used to capture list of languages the client support and what it prefers type: keyword -- -*`source.as.number`*:: +*`rsa.misc.lifetime`*:: + -- -Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. +This key is used to capture the session lifetime in seconds. type: long -example: 15169 - -- -*`source.as.organization.name`*:: +*`rsa.misc.link`*:: + -- -Organization name. +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: Google LLC - -- -*`source.as.organization.name.text`*:: +*`rsa.misc.match`*:: + -- -type: text +This key is for regex match name from search.ini + +type: keyword -- -*`source.bytes`*:: +*`rsa.misc.param_dst`*:: + -- -Bytes sent from the source to the destination. - -type: long - -example: 184 +This key captures the command line/launch argument of the target process or file -format: bytes +type: keyword -- -*`source.domain`*:: +*`rsa.misc.param_src`*:: + -- -Source domain. +This key captures source parameter type: keyword -- -*`source.geo.city_name`*:: +*`rsa.misc.search_text`*:: + -- -City name. +This key captures the Search Text used type: keyword -example: Montreal - -- -*`source.geo.continent_name`*:: +*`rsa.misc.sig_name`*:: + -- -Name of the continent. +This key is used to capture the Signature Name only. type: keyword -example: North America - -- -*`source.geo.country_iso_code`*:: +*`rsa.misc.snmp_value`*:: + -- -Country ISO code. +SNMP set request value type: keyword -example: CA +-- +*`rsa.misc.streams`*:: ++ -- +This key captures number of streams in session -*`source.geo.country_name`*:: +type: long + +-- + + +*`rsa.db.index`*:: + -- -Country name. +This key captures IndexID of the index. type: keyword -example: Canada - -- -*`source.geo.location`*:: +*`rsa.db.instance`*:: + -- -Longitude and latitude. - -type: geo_point +This key is used to capture the database server instance name -example: { "lon": -73.614830, "lat": 45.505918 } +type: keyword -- -*`source.geo.name`*:: +*`rsa.db.database`*:: + -- -User-defined description of a location, at the level of granularity they care about. -Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. -Not typically used in automated geolocation. +This key is used to capture the name of a database or an instance as seen in a session type: keyword -example: boston-dc - -- -*`source.geo.region_iso_code`*:: +*`rsa.db.transact_id`*:: + -- -Region ISO code. +This key captures the SQL transantion ID of the current session type: keyword -example: CA-QC - -- -*`source.geo.region_name`*:: +*`rsa.db.permissions`*:: + -- -Region name. +This key captures permission or privilege level assigned to a resource. type: keyword -example: Quebec - -- -*`source.ip`*:: +*`rsa.db.table_name`*:: + -- -IP address of the source (IPv4 or IPv6). +This key is used to capture the table name -type: ip +type: keyword -- -*`source.mac`*:: +*`rsa.db.db_id`*:: + -- -MAC address of the source. +This key is used to capture the unique identifier for a database type: keyword -- -*`source.nat.ip`*:: +*`rsa.db.db_pid`*:: + -- -Translated ip of source based NAT sessions (e.g. internal client to internet) -Typically connections traversing load balancers, firewalls, or routers. +This key captures the process id of a connection with database server -type: ip +type: long -- -*`source.nat.port`*:: +*`rsa.db.lread`*:: + -- -Translated port of source based NAT sessions. (e.g. internal client to internet) -Typically used with load balancers, firewalls, or routers. +This key is used for the number of logical reads type: long -format: string - -- -*`source.packets`*:: +*`rsa.db.lwrite`*:: + -- -Packets sent from the source to the destination. +This key is used for the number of logical writes type: long -example: 12 - -- -*`source.port`*:: +*`rsa.db.pread`*:: + -- -Port of the source. +This key is used for the number of physical writes type: long -format: string - -- -*`source.registered_domain`*:: + +*`rsa.network.alias_host`*:: + -- -The highest registered source domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. type: keyword -example: example.com - -- -*`source.top_level_domain`*:: +*`rsa.network.domain`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". - type: keyword -example: co.uk - -- -*`source.user.domain`*:: +*`rsa.network.host_dst`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. +This key should only be used when it’s a Destination Hostname type: keyword -- -*`source.user.email`*:: +*`rsa.network.network_service`*:: + -- -User email address. +This is used to capture layer 7 protocols/service names type: keyword -- -*`source.user.full_name`*:: +*`rsa.network.interface`*:: + -- -User's full name, if available. +This key should be used when the source or destination context of an interface is not clear type: keyword -example: Albert Einstein - -- -*`source.user.full_name.text`*:: +*`rsa.network.network_port`*:: + -- -type: text +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long -- -*`source.user.group.domain`*:: +*`rsa.network.eth_host`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. +Deprecated, use alias.mac type: keyword -- -*`source.user.group.id`*:: +*`rsa.network.sinterface`*:: + -- -Unique identifier for the group on the system/platform. +This key should only be used when it’s a Source Interface type: keyword -- -*`source.user.group.name`*:: +*`rsa.network.dinterface`*:: + -- -Name of the group. +This key should only be used when it’s a Destination Interface type: keyword -- -*`source.user.hash`*:: +*`rsa.network.vlan`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. +This key should only be used to capture the ID of the Virtual LAN -type: keyword +type: long -- -*`source.user.id`*:: +*`rsa.network.zone_src`*:: + -- -Unique identifier of the user. +This key should only be used when it’s a Source Zone. type: keyword -- -*`source.user.name`*:: +*`rsa.network.zone`*:: + -- -Short name or login of the user. +This key should be used when the source or destination context of a Zone is not clear type: keyword -example: albert - -- -*`source.user.name.text`*:: +*`rsa.network.zone_dst`*:: + -- -type: text +This key should only be used when it’s a Destination Zone. + +type: keyword -- -*`source.user.roles`*:: +*`rsa.network.gateway`*:: + -- -Array of user roles at the time of the event. +This key is used to capture the IP Address of the gateway type: keyword -example: ["kibana_admin", "reporting_user"] - -- -[float] -=== threat +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only -Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework. -These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service"). +type: long +-- -*`threat.framework`*:: +*`rsa.network.mask`*:: + -- -Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. +This key is used to capture the device network IPmask. type: keyword -example: MITRE ATT&CK - -- -*`threat.tactic.id`*:: +*`rsa.network.icmp_code`*:: + -- -The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/ ) - -type: keyword +This key is used to capture the ICMP code only -example: TA0040 +type: long -- -*`threat.tactic.name`*:: +*`rsa.network.protocol_detail`*:: + -- -Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/) +This key should be used to capture additional protocol information type: keyword -example: impact - -- -*`threat.tactic.reference`*:: +*`rsa.network.dmask`*:: + -- -The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/ ) +This key is used for Destionation Device network mask type: keyword -example: https://attack.mitre.org/tactics/TA0040/ +-- +*`rsa.network.port`*:: ++ -- +This key should only be used to capture a Network Port when the directionality is not clear -*`threat.technique.id`*:: +type: long + +-- + +*`rsa.network.smask`*:: + -- -The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/) +This key is used for capturing source Network Mask type: keyword -example: T1499 - -- -*`threat.technique.name`*:: +*`rsa.network.netname`*:: + -- -The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/) +This key is used to capture the network name associated with an IP range. This is configured by the end user. type: keyword -example: Endpoint Denial of Service - -- -*`threat.technique.name.text`*:: +*`rsa.network.paddr`*:: + -- -type: text +Deprecated + +type: ip -- -*`threat.technique.reference`*:: +*`rsa.network.faddr`*:: + -- -The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/ ) - type: keyword -example: https://attack.mitre.org/techniques/T1499/ +-- +*`rsa.network.lhost`*:: ++ -- +type: keyword -[float] -=== tls +-- -Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files. +*`rsa.network.origin`*:: ++ +-- +type: keyword +-- -*`tls.cipher`*:: +*`rsa.network.remote_domain_id`*:: + -- -String indicating the cipher used during the current connection. - type: keyword -example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - -- -*`tls.client.certificate`*:: +*`rsa.network.addr`*:: + -- -PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. - type: keyword -example: MII... - -- -*`tls.client.certificate_chain`*:: +*`rsa.network.dns_a_record`*:: + -- -Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. - type: keyword -example: ['MII...', 'MII...'] - -- -*`tls.client.hash.md5`*:: +*`rsa.network.dns_ptr_record`*:: + -- -Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - type: keyword -example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC - -- -*`tls.client.hash.sha1`*:: +*`rsa.network.fhost`*:: + -- -Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - type: keyword -example: 9E393D93138888D288266C2D915214D1D1CCEB2A - -- -*`tls.client.hash.sha256`*:: +*`rsa.network.fport`*:: + -- -Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. - type: keyword -example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0 - -- -*`tls.client.issuer`*:: +*`rsa.network.laddr`*:: + -- -Distinguished name of subject of the issuer of the x.509 certificate presented by the client. +type: keyword + +-- +*`rsa.network.linterface`*:: ++ +-- type: keyword -example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com +-- +*`rsa.network.phost`*:: ++ -- +type: keyword -*`tls.client.ja3`*:: +-- + +*`rsa.network.ad_computer_dst`*:: + -- -A hash that identifies clients based on how they perform an SSL/TLS handshake. +Deprecated, use host.dst type: keyword -example: d4e5b18d6b55c71272893221c96ba240 - -- -*`tls.client.not_after`*:: +*`rsa.network.eth_type`*:: + -- -Date/Time indicating when client certificate is no longer considered valid. - -type: date +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only -example: 2021-01-01T00:00:00.000Z +type: long -- -*`tls.client.not_before`*:: +*`rsa.network.ip_proto`*:: + -- -Date/Time indicating when client certificate is first considered valid. - -type: date +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI -example: 1970-01-01T00:00:00.000Z +type: long -- -*`tls.client.server_name`*:: +*`rsa.network.dns_cname_record`*:: + -- -Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. - type: keyword -example: www.elastic.co - -- -*`tls.client.subject`*:: +*`rsa.network.dns_id`*:: + -- -Distinguished name of subject of the x.509 certificate presented by the client. - type: keyword -example: CN=myclient, OU=Documentation Team, DC=example, DC=com - -- -*`tls.client.supported_ciphers`*:: +*`rsa.network.dns_opcode`*:: + -- -Array of ciphers offered by the client during the client hello. - type: keyword -example: ['TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', '...'] - -- -*`tls.client.x509.alternative_names`*:: +*`rsa.network.dns_resp`*:: + -- -List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. - type: keyword -example: *.elastic.co - -- -*`tls.client.x509.issuer.common_name`*:: +*`rsa.network.dns_type`*:: + -- -List of common name (CN) of issuing certificate authority. - type: keyword -example: Example SHA2 High Assurance Server CA - -- -*`tls.client.x509.issuer.country`*:: +*`rsa.network.domain1`*:: + -- -List of country (C) codes - type: keyword -example: US - -- -*`tls.client.x509.issuer.distinguished_name`*:: +*`rsa.network.host_type`*:: + -- -Distinguished name (DN) of issuing certificate authority. - type: keyword -example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA - -- -*`tls.client.x509.issuer.locality`*:: +*`rsa.network.packet_length`*:: + -- -List of locality names (L) - type: keyword -example: Mountain View - -- -*`tls.client.x509.issuer.organization`*:: +*`rsa.network.host_orig`*:: + -- -List of organizations (O) of issuing certificate authority. +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. type: keyword -example: Example Inc - -- -*`tls.client.x509.issuer.organizational_unit`*:: +*`rsa.network.rpayload`*:: + -- -List of organizational units (OU) of issuing certificate authority. +This key is used to capture the total number of payload bytes seen in the retransmitted packets. type: keyword -example: www.example.com - -- -*`tls.client.x509.issuer.state_or_province`*:: +*`rsa.network.vlan_name`*:: + -- -List of state or province names (ST, S, or P) +This key should only be used to capture the name of the Virtual LAN type: keyword -example: California - -- -*`tls.client.x509.not_after`*:: + +*`rsa.investigations.ec_activity`*:: + -- -Time at which the certificate is no longer considered valid. - -type: date +This key captures the particular event activity(Ex:Logoff) -example: 2020-07-16 03:15:39+00:00 +type: keyword -- -*`tls.client.x509.not_before`*:: +*`rsa.investigations.ec_theme`*:: + -- -Time at which the certificate is first considered valid. - -type: date +This key captures the Theme of a particular Event(Ex:Authentication) -example: 2019-08-16 01:40:25+00:00 +type: keyword -- -*`tls.client.x509.public_key_algorithm`*:: +*`rsa.investigations.ec_subject`*:: + -- -Algorithm used to generate the public key. +This key captures the Subject of a particular Event(Ex:User) type: keyword -example: RSA - -- -*`tls.client.x509.public_key_curve`*:: +*`rsa.investigations.ec_outcome`*:: + -- -The curve used by the elliptic curve public key algorithm. This is algorithm specific. +This key captures the outcome of a particular Event(Ex:Success) type: keyword -example: nistp521 - -- -*`tls.client.x509.public_key_exponent`*:: +*`rsa.investigations.event_cat`*:: + -- -Exponent used to derive the public key. This is algorithm specific. +This key captures the Event category number type: long -example: 65537 - -Field is not indexed. - -- -*`tls.client.x509.public_key_size`*:: +*`rsa.investigations.event_cat_name`*:: + -- -The size of the public key space in bits. - -type: long +This key captures the event category name corresponding to the event cat code -example: 2048 +type: keyword -- -*`tls.client.x509.serial_number`*:: +*`rsa.investigations.event_vcat`*:: + -- -Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. type: keyword -example: 55FBB9C7DEBF09809D12CCAA - -- -*`tls.client.x509.signature_algorithm`*:: +*`rsa.investigations.analysis_file`*:: + -- -Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file type: keyword -example: SHA256-RSA - -- -*`tls.client.x509.subject.common_name`*:: +*`rsa.investigations.analysis_service`*:: + -- -List of common names (CN) of subject. +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service type: keyword -example: shared.global.example.net - -- -*`tls.client.x509.subject.country`*:: +*`rsa.investigations.analysis_session`*:: + -- -List of country (C) code +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session type: keyword -example: US - -- -*`tls.client.x509.subject.distinguished_name`*:: +*`rsa.investigations.boc`*:: + -- -Distinguished name (DN) of the certificate subject entity. +This is used to capture behaviour of compromise type: keyword -example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net - -- -*`tls.client.x509.subject.locality`*:: +*`rsa.investigations.eoc`*:: + -- -List of locality names (L) +This is used to capture Enablers of Compromise type: keyword -example: San Francisco - -- -*`tls.client.x509.subject.organization`*:: +*`rsa.investigations.inv_category`*:: + -- -List of organizations (O) of subject. +This used to capture investigation category type: keyword -example: Example, Inc. - -- -*`tls.client.x509.subject.organizational_unit`*:: +*`rsa.investigations.inv_context`*:: + -- -List of organizational units (OU) of subject. +This used to capture investigation context type: keyword -- -*`tls.client.x509.subject.state_or_province`*:: +*`rsa.investigations.ioc`*:: + -- -List of state or province names (ST, S, or P) +This is key capture indicator of compromise type: keyword -example: California - -- -*`tls.client.x509.version_number`*:: + +*`rsa.counters.dclass_c1`*:: + -- -Version of x509 format. - -type: keyword +This is a generic counter key that should be used with the label dclass.c1.str only -example: 3 +type: long -- -*`tls.curve`*:: +*`rsa.counters.dclass_c2`*:: + -- -String indicating the curve used for the given cipher, when applicable. - -type: keyword +This is a generic counter key that should be used with the label dclass.c2.str only -example: secp256r1 +type: long -- -*`tls.established`*:: +*`rsa.counters.event_counter`*:: + -- -Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. +This is used to capture the number of times an event repeated -type: boolean +type: long -- -*`tls.next_protocol`*:: +*`rsa.counters.dclass_r1`*:: + -- -String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. +This is a generic ratio key that should be used with the label dclass.r1.str only type: keyword -example: http/1.1 - -- -*`tls.resumed`*:: +*`rsa.counters.dclass_c3`*:: + -- -Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. +This is a generic counter key that should be used with the label dclass.c3.str only -type: boolean +type: long -- -*`tls.server.certificate`*:: +*`rsa.counters.dclass_c1_str`*:: + -- -PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. +This is a generic counter string key that should be used with the label dclass.c1 only type: keyword -example: MII... - -- -*`tls.server.certificate_chain`*:: +*`rsa.counters.dclass_c2_str`*:: + -- -Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. +This is a generic counter string key that should be used with the label dclass.c2 only type: keyword -example: ['MII...', 'MII...'] - -- -*`tls.server.hash.md5`*:: +*`rsa.counters.dclass_r1_str`*:: + -- -Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. +This is a generic ratio string key that should be used with the label dclass.r1 only type: keyword -example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC - -- -*`tls.server.hash.sha1`*:: +*`rsa.counters.dclass_r2`*:: + -- -Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. +This is a generic ratio key that should be used with the label dclass.r2.str only type: keyword -example: 9E393D93138888D288266C2D915214D1D1CCEB2A - -- -*`tls.server.hash.sha256`*:: +*`rsa.counters.dclass_c3_str`*:: + -- -Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. +This is a generic counter string key that should be used with the label dclass.c3 only type: keyword -example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0 - -- -*`tls.server.issuer`*:: +*`rsa.counters.dclass_r3`*:: + -- -Subject of the issuer of the x.509 certificate presented by the server. +This is a generic ratio key that should be used with the label dclass.r3.str only type: keyword -example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com - -- -*`tls.server.ja3s`*:: +*`rsa.counters.dclass_r2_str`*:: + -- -A hash that identifies servers based on how they perform an SSL/TLS handshake. +This is a generic ratio string key that should be used with the label dclass.r2 only type: keyword -example: 394441ab65754e2207b1e1b457b3641d - -- -*`tls.server.not_after`*:: +*`rsa.counters.dclass_r3_str`*:: + -- -Timestamp indicating when server certificate is no longer considered valid. - -type: date +This is a generic ratio string key that should be used with the label dclass.r3 only -example: 2021-01-01T00:00:00.000Z +type: keyword -- -*`tls.server.not_before`*:: + +*`rsa.identity.auth_method`*:: + -- -Timestamp indicating when server certificate is first considered valid. - -type: date +This key is used to capture authentication methods used only -example: 1970-01-01T00:00:00.000Z +type: keyword -- -*`tls.server.subject`*:: +*`rsa.identity.user_role`*:: + -- -Subject of the x.509 certificate presented by the server. +This key is used to capture the Role of a user only type: keyword -example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com - -- -*`tls.server.x509.alternative_names`*:: +*`rsa.identity.dn`*:: + -- -List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. +X.500 (LDAP) Distinguished Name type: keyword -example: *.elastic.co - -- -*`tls.server.x509.issuer.common_name`*:: +*`rsa.identity.logon_type`*:: + -- -List of common name (CN) of issuing certificate authority. +This key is used to capture the type of logon method used. type: keyword -example: Example SHA2 High Assurance Server CA - -- -*`tls.server.x509.issuer.country`*:: +*`rsa.identity.profile`*:: + -- -List of country (C) codes +This key is used to capture the user profile type: keyword -example: US - -- -*`tls.server.x509.issuer.distinguished_name`*:: +*`rsa.identity.accesses`*:: + -- -Distinguished name (DN) of issuing certificate authority. +This key is used to capture actual privileges used in accessing an object type: keyword -example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA - -- -*`tls.server.x509.issuer.locality`*:: +*`rsa.identity.realm`*:: + -- -List of locality names (L) +Radius realm or similar grouping of accounts type: keyword -example: Mountain View - -- -*`tls.server.x509.issuer.organization`*:: +*`rsa.identity.user_sid_dst`*:: + -- -List of organizations (O) of issuing certificate authority. +This key captures Destination User Session ID type: keyword -example: Example Inc - -- -*`tls.server.x509.issuer.organizational_unit`*:: +*`rsa.identity.dn_src`*:: + -- -List of organizational units (OU) of issuing certificate authority. +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn type: keyword -example: www.example.com - -- -*`tls.server.x509.issuer.state_or_province`*:: +*`rsa.identity.org`*:: + -- -List of state or province names (ST, S, or P) +This key captures the User organization type: keyword -example: California - -- -*`tls.server.x509.not_after`*:: +*`rsa.identity.dn_dst`*:: + -- -Time at which the certificate is no longer considered valid. - -type: date +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn -example: 2020-07-16 03:15:39+00:00 +type: keyword -- -*`tls.server.x509.not_before`*:: +*`rsa.identity.firstname`*:: + -- -Time at which the certificate is first considered valid. - -type: date +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information -example: 2019-08-16 01:40:25+00:00 +type: keyword -- -*`tls.server.x509.public_key_algorithm`*:: +*`rsa.identity.lastname`*:: + -- -Algorithm used to generate the public key. +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -example: RSA - -- -*`tls.server.x509.public_key_curve`*:: +*`rsa.identity.user_dept`*:: + -- -The curve used by the elliptic curve public key algorithm. This is algorithm specific. +User's Department Names only type: keyword -example: nistp521 - -- -*`tls.server.x509.public_key_exponent`*:: +*`rsa.identity.user_sid_src`*:: + -- -Exponent used to derive the public key. This is algorithm specific. - -type: long - -example: 65537 +This key captures Source User Session ID -Field is not indexed. +type: keyword -- -*`tls.server.x509.public_key_size`*:: +*`rsa.identity.federated_sp`*:: + -- -The size of the public key space in bits. - -type: long +This key is the Federated Service Provider. This is the application requesting authentication. -example: 2048 +type: keyword -- -*`tls.server.x509.serial_number`*:: +*`rsa.identity.federated_idp`*:: + -- -Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. +This key is the federated Identity Provider. This is the server providing the authentication. type: keyword -example: 55FBB9C7DEBF09809D12CCAA - -- -*`tls.server.x509.signature_algorithm`*:: +*`rsa.identity.logon_type_desc`*:: + -- -Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. type: keyword -example: SHA256-RSA - -- -*`tls.server.x509.subject.common_name`*:: +*`rsa.identity.middlename`*:: + -- -List of common names (CN) of subject. +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -example: shared.global.example.net - -- -*`tls.server.x509.subject.country`*:: +*`rsa.identity.password`*:: + -- -List of country (C) code +This key is for Passwords seen in any session, plain text or encrypted type: keyword -example: US - -- -*`tls.server.x509.subject.distinguished_name`*:: +*`rsa.identity.host_role`*:: + -- -Distinguished name (DN) of the certificate subject entity. +This key should only be used to capture the role of a Host Machine type: keyword -example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net - -- -*`tls.server.x509.subject.locality`*:: +*`rsa.identity.ldap`*:: + -- -List of locality names (L) +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context type: keyword -example: San Francisco - -- -*`tls.server.x509.subject.organization`*:: +*`rsa.identity.ldap_query`*:: + -- -List of organizations (O) of subject. +This key is the Search criteria from an LDAP search type: keyword -example: Example, Inc. - -- -*`tls.server.x509.subject.organizational_unit`*:: +*`rsa.identity.ldap_response`*:: + -- -List of organizational units (OU) of subject. +This key is to capture Results from an LDAP search type: keyword -- -*`tls.server.x509.subject.state_or_province`*:: +*`rsa.identity.owner`*:: + -- -List of state or province names (ST, S, or P) +This is used to capture username the process or service is running as, the author of the task type: keyword -example: California - -- -*`tls.server.x509.version_number`*:: +*`rsa.identity.service_account`*:: + -- -Version of x509 format. +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage type: keyword -example: 3 - -- -*`tls.version`*:: + +*`rsa.email.email_dst`*:: + -- -Numeric part of the version parsed from the original string. +This key is used to capture the Destination email address only, when the destination context is not clear use email type: keyword -example: 1.2 - -- -*`tls.version_protocol`*:: +*`rsa.email.email_src`*:: + -- -Normalized lowercase protocol name parsed from original string. +This key is used to capture the source email address only, when the source context is not clear use email type: keyword -example: tls - -- -[float] -=== tracing - -Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. - - -*`tracing.span.id`*:: +*`rsa.email.subject`*:: + -- -Unique identifier of the span within the scope of its trace. -A span represents an operation within a transaction, such as a request to another service, or a database query. +This key is used to capture the subject string from an Email only. type: keyword -example: 3ff9a8981b7ccd5a - -- -*`tracing.trace.id`*:: +*`rsa.email.email`*:: + -- -Unique identifier of the trace. -A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. +This key is used to capture a generic email address where the source or destination context is not clear type: keyword -example: 4bf92f3577b34da6a3ce929d0e0e4736 - -- -*`tracing.transaction.id`*:: +*`rsa.email.trans_from`*:: + -- -Unique identifier of the transaction within the scope of its trace. -A transaction is the highest level of work measured within a service, such as a request to a server. +Deprecated key defined only in table map. type: keyword -example: 00f067aa0ba902b7 +-- +*`rsa.email.trans_to`*:: ++ -- +Deprecated key defined only in table map. -[float] -=== url +type: keyword -URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on. +-- -*`url.domain`*:: +*`rsa.file.privilege`*:: + -- -Domain of the url, such as "www.elastic.co". -In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. +Deprecated, use permissions type: keyword -example: www.elastic.co - -- -*`url.extension`*:: +*`rsa.file.attachment`*:: + -- -The field contains the file extension from the original request url. -The file extension is only set if it exists, as not every url has a file extension. -The leading period must not be included. For example, the value must be "png", not ".png". +This key captures the attachment file name type: keyword -example: png - -- -*`url.fragment`*:: +*`rsa.file.filesystem`*:: + -- -Portion of the url after the `#`, such as "top". -The `#` is not part of the fragment. - type: keyword -- -*`url.full`*:: +*`rsa.file.binary`*:: + -- -If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. +Deprecated key defined only in table map. type: keyword -example: https://www.elastic.co:443/search?q=elasticsearch#top - -- -*`url.full.text`*:: +*`rsa.file.filename_dst`*:: + -- -type: text +This is used to capture name of the file targeted by the action + +type: keyword -- -*`url.original`*:: +*`rsa.file.filename_src`*:: + -- -Unmodified original url as seen in the event source. -Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. -This field is meant to represent the URL as it was observed, complete or not. +This is used to capture name of the parent filename, the file which performed the action type: keyword -example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch - -- -*`url.original.text`*:: +*`rsa.file.filename_tmp`*:: + -- -type: text +type: keyword -- -*`url.password`*:: +*`rsa.file.directory_dst`*:: + -- -Password of the request. +This key is used to capture the directory of the target process or file type: keyword -- -*`url.path`*:: +*`rsa.file.directory_src`*:: + -- -Path of the request, such as "/search". +This key is used to capture the directory of the source process or file type: keyword -- -*`url.port`*:: +*`rsa.file.file_entropy`*:: + -- -Port of the request, such as 443. - -type: long - -example: 443 +This is used to capture entropy vale of a file -format: string +type: double -- -*`url.query`*:: +*`rsa.file.file_vendor`*:: + -- -The query field describes the query string of the request, such as "q=elasticsearch". -The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. +This is used to capture Company name of file located in version_info type: keyword -- -*`url.registered_domain`*:: +*`rsa.file.task_name`*:: + -- -The highest registered url domain, stripped of the subdomain. -For example, the registered domain for "foo.example.com" is "example.com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +This is used to capture name of the task type: keyword -example: example.com - -- -*`url.scheme`*:: + +*`rsa.web.fqdn`*:: + -- -Scheme of the request, such as "https". -Note: The `:` is not part of the scheme. +Fully Qualified Domain Names type: keyword -example: https - -- -*`url.top_level_domain`*:: +*`rsa.web.web_cookie`*:: + -- -The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". -This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". +This key is used to capture the Web cookies specifically. type: keyword -example: co.uk - -- -*`url.username`*:: +*`rsa.web.alias_host`*:: + -- -Username of the request. - type: keyword -- -[float] -=== user - -The user fields describe information about the user that is relevant to the event. -Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them. - - -*`user.domain`*:: +*`rsa.web.reputation_num`*:: + -- -Name of the directory the user is a member of. -For example, an LDAP or Active Directory domain name. +Reputation Number of an entity. Typically used for Web Domains -type: keyword +type: double -- -*`user.email`*:: +*`rsa.web.web_ref_domain`*:: + -- -User email address. +Web referer's domain type: keyword -- -*`user.full_name`*:: +*`rsa.web.web_ref_query`*:: + -- -User's full name, if available. +This key captures Web referer's query portion of the URL type: keyword -example: Albert Einstein - -- -*`user.full_name.text`*:: +*`rsa.web.remote_domain`*:: + -- -type: text +type: keyword -- -*`user.group.domain`*:: +*`rsa.web.web_ref_page`*:: + -- -Name of the directory the group is a member of. -For example, an LDAP or Active Directory domain name. +This key captures Web referer's page information type: keyword -- -*`user.group.id`*:: +*`rsa.web.web_ref_root`*:: + -- -Unique identifier for the group on the system/platform. +Web referer's root URL path type: keyword -- -*`user.group.name`*:: +*`rsa.web.cn_asn_dst`*:: + -- -Name of the group. - type: keyword -- -*`user.hash`*:: +*`rsa.web.cn_rpackets`*:: + -- -Unique user hash to correlate information for a user in anonymized form. -Useful if `user.id` or `user.name` contain confidential information and cannot be used. - type: keyword -- -*`user.id`*:: +*`rsa.web.urlpage`*:: + -- -Unique identifier of the user. - type: keyword -- -*`user.name`*:: +*`rsa.web.urlroot`*:: + -- -Short name or login of the user. - type: keyword -example: albert - -- -*`user.name.text`*:: +*`rsa.web.p_url`*:: + -- -type: text +type: keyword -- -*`user.roles`*:: +*`rsa.web.p_user_agent`*:: + -- -Array of user roles at the time of the event. - type: keyword -example: ["kibana_admin", "reporting_user"] - -- -[float] -=== user_agent - -The user_agent fields normally come from a browser request. -They often show up in web service logs coming from the parsed user agent string. - - -*`user_agent.device.name`*:: +*`rsa.web.p_web_cookie`*:: + -- -Name of the device. - type: keyword -example: iPhone - -- -*`user_agent.name`*:: +*`rsa.web.p_web_method`*:: + -- -Name of the user agent. - type: keyword -example: Safari - -- -*`user_agent.original`*:: +*`rsa.web.p_web_referer`*:: + -- -Unparsed user_agent string. - type: keyword -example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 - -- -*`user_agent.original.text`*:: +*`rsa.web.web_extension_tmp`*:: + -- -type: text +type: keyword -- -*`user_agent.os.family`*:: +*`rsa.web.web_page`*:: + -- -OS family (such as redhat, debian, freebsd, windows). - type: keyword -example: debian - -- -*`user_agent.os.full`*:: + +*`rsa.threat.threat_category`*:: + -- -Operating system name, including the version or code name. +This key captures Threat Name/Threat Category/Categorization of alert type: keyword -example: Mac OS Mojave - -- -*`user_agent.os.full.text`*:: +*`rsa.threat.threat_desc`*:: + -- -type: text +This key is used to capture the threat description from the session directly or inferred + +type: keyword -- -*`user_agent.os.kernel`*:: +*`rsa.threat.alert`*:: + -- -Operating system kernel version as a raw string. +This key is used to capture name of the alert type: keyword -example: 4.4.0-112-generic - -- -*`user_agent.os.name`*:: +*`rsa.threat.threat_source`*:: + -- -Operating system name, without the version. +This key is used to capture source of the threat type: keyword -example: Mac OS X - -- -*`user_agent.os.name.text`*:: + +*`rsa.crypto.crypto`*:: + -- -type: text +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword -- -*`user_agent.os.platform`*:: +*`rsa.crypto.cipher_src`*:: + -- -Operating system platform (such centos, ubuntu, windows). +This key is for Source (Client) Cipher type: keyword -example: darwin - -- -*`user_agent.os.version`*:: +*`rsa.crypto.cert_subject`*:: + -- -Operating system version as a raw string. +This key is used to capture the Certificate organization only type: keyword -example: 10.14.1 - -- -*`user_agent.version`*:: +*`rsa.crypto.peer`*:: + -- -Version of the user agent. +This key is for Encryption peer's IP Address type: keyword -example: 12.0 - -- -[float] -=== vlan - -The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection. -Network.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. -Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging. -Observer.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers. - - -*`vlan.id`*:: +*`rsa.crypto.cipher_size_src`*:: + -- -VLAN ID as reported by the observer. - -type: keyword +This key captures Source (Client) Cipher Size -example: 10 +type: long -- -*`vlan.name`*:: +*`rsa.crypto.ike`*:: + -- -Optional VLAN name as reported by the observer. +IKE negotiation phase. type: keyword -example: outside - -- -[float] -=== vulnerability - -The vulnerability fields describe information about a vulnerability that is relevant to an event. - - -*`vulnerability.category`*:: +*`rsa.crypto.scheme`*:: + -- -The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) -This field must be an array. +This key captures the Encryption scheme used type: keyword -example: ["Firewall"] - -- -*`vulnerability.classification`*:: +*`rsa.crypto.peer_id`*:: + -- -The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) +This key is for Encryption peer’s identity type: keyword -example: CVSS - -- -*`vulnerability.description`*:: +*`rsa.crypto.sig_type`*:: + -- -The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) +This key captures the Signature Type type: keyword -example: In macOS before 2.12.6, there is a vulnerability in the RPC... - -- -*`vulnerability.description.text`*:: +*`rsa.crypto.cert_issuer`*:: + -- -type: text +type: keyword -- -*`vulnerability.enumeration`*:: +*`rsa.crypto.cert_host_name`*:: + -- -The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) +Deprecated key defined only in table map. type: keyword -example: CVE - -- -*`vulnerability.id`*:: +*`rsa.crypto.cert_error`*:: + -- -The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] +This key captures the Certificate Error String type: keyword -example: CVE-2019-00001 - -- -*`vulnerability.reference`*:: +*`rsa.crypto.cipher_dst`*:: + -- -A resource that provides additional information, context, and mitigations for the identified vulnerability. +This key is for Destination (Server) Cipher type: keyword -example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111 - -- -*`vulnerability.report_id`*:: +*`rsa.crypto.cipher_size_dst`*:: + -- -The report or scan identification number. - -type: keyword +This key captures Destination (Server) Cipher Size -example: 20191018.0001 +type: long -- -*`vulnerability.scanner.vendor`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -The name of the vulnerability scanner vendor. +Deprecated, use version type: keyword -example: Tenable - -- -*`vulnerability.score.base`*:: +*`rsa.crypto.d_certauth`*:: + -- -Scores can range from 0.0 to 10.0, with 10.0 being the most severe. -Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) - -type: float - -example: 5.5 +type: keyword -- -*`vulnerability.score.environmental`*:: +*`rsa.crypto.s_certauth`*:: + -- -Scores can range from 0.0 to 10.0, with 10.0 being the most severe. -Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) - -type: float - -example: 5.5 +type: keyword -- -*`vulnerability.score.temporal`*:: +*`rsa.crypto.ike_cookie1`*:: + -- -Scores can range from 0.0 to 10.0, with 10.0 being the most severe. -Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) +ID of the negotiation — sent for ISAKMP Phase One -type: float +type: keyword -- -*`vulnerability.score.version`*:: +*`rsa.crypto.ike_cookie2`*:: + -- -The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. -CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) +ID of the negotiation — sent for ISAKMP Phase Two type: keyword -example: 2.0 - -- -*`vulnerability.severity`*:: +*`rsa.crypto.cert_checksum`*:: + -- -The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) - type: keyword -example: Critical - -- -[float] -=== x509 - -This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk. When only a single certificate is logged in an event, it should be nested under `file`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`). For events that contain certificate information for both sides of the connection, the x509 object could be nested under the respective side of the connection information (e.g. `tls.server.x509`). - - -*`x509.alternative_names`*:: +*`rsa.crypto.cert_host_cat`*:: + -- -List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. +This key is used for the hostname category value of a certificate type: keyword -example: *.elastic.co - -- -*`x509.issuer.common_name`*:: +*`rsa.crypto.cert_serial`*:: + -- -List of common name (CN) of issuing certificate authority. +This key is used to capture the Certificate serial number only type: keyword -example: Example SHA2 High Assurance Server CA - -- -*`x509.issuer.country`*:: +*`rsa.crypto.cert_status`*:: + -- -List of country (C) codes +This key captures Certificate validation status type: keyword -example: US - -- -*`x509.issuer.distinguished_name`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- -Distinguished name (DN) of issuing certificate authority. +Deprecated, use version type: keyword -example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA - -- -*`x509.issuer.locality`*:: +*`rsa.crypto.cert_keysize`*:: + -- -List of locality names (L) - type: keyword -example: Mountain View - --- - -*`x509.issuer.organization`*:: -+ --- -List of organizations (O) of issuing certificate authority. - -type: keyword - -example: Example Inc - --- - -*`x509.issuer.organizational_unit`*:: -+ --- -List of organizational units (OU) of issuing certificate authority. - -type: keyword - -example: www.example.com - --- - -*`x509.issuer.state_or_province`*:: -+ --- -List of state or province names (ST, S, or P) - -type: keyword - -example: California - --- - -*`x509.not_after`*:: -+ --- -Time at which the certificate is no longer considered valid. - -type: date - -example: 2020-07-16 03:15:39+00:00 - --- - -*`x509.not_before`*:: -+ --- -Time at which the certificate is first considered valid. - -type: date - -example: 2019-08-16 01:40:25+00:00 - --- - -*`x509.public_key_algorithm`*:: -+ --- -Algorithm used to generate the public key. - -type: keyword - -example: RSA - --- - -*`x509.public_key_curve`*:: -+ --- -The curve used by the elliptic curve public key algorithm. This is algorithm specific. - -type: keyword - -example: nistp521 - --- - -*`x509.public_key_exponent`*:: -+ --- -Exponent used to derive the public key. This is algorithm specific. - -type: long - -example: 65537 - -Field is not indexed. - --- - -*`x509.public_key_size`*:: -+ --- -The size of the public key space in bits. - -type: long - -example: 2048 - -- -*`x509.serial_number`*:: -+ --- -Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. - -type: keyword - -example: 55FBB9C7DEBF09809D12CCAA - --- - -*`x509.signature_algorithm`*:: -+ --- -Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. - -type: keyword - -example: SHA256-RSA - --- - -*`x509.subject.common_name`*:: -+ --- -List of common names (CN) of subject. - -type: keyword - -example: shared.global.example.net - --- - -*`x509.subject.country`*:: -+ --- -List of country (C) code - -type: keyword - -example: US - --- - -*`x509.subject.distinguished_name`*:: -+ --- -Distinguished name (DN) of the certificate subject entity. - -type: keyword - -example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net - --- - -*`x509.subject.locality`*:: -+ --- -List of locality names (L) - -type: keyword - -example: San Francisco - --- - -*`x509.subject.organization`*:: -+ --- -List of organizations (O) of subject. - -type: keyword - -example: Example, Inc. - --- - -*`x509.subject.organizational_unit`*:: -+ --- -List of organizational units (OU) of subject. - -type: keyword - --- - -*`x509.subject.state_or_province`*:: -+ --- -List of state or province names (ST, S, or P) - -type: keyword - -example: California - --- - -*`x509.version_number`*:: -+ --- -Version of x509 format. - -type: keyword - -example: 3 - --- - -[[exported-fields-elasticsearch]] -== Elasticsearch fields - -elasticsearch Module - - - -[float] -=== elasticsearch - - - - -*`elasticsearch.component`*:: -+ --- -Elasticsearch component from where the log event originated - -type: keyword - -example: o.e.c.m.MetaDataCreateIndexService - --- - -*`elasticsearch.cluster.uuid`*:: -+ --- -UUID of the cluster - -type: keyword - -example: GmvrbHlNTiSVYiPf8kxg9g - --- - -*`elasticsearch.cluster.name`*:: -+ --- -Name of the cluster - -type: keyword - -example: docker-cluster - --- - -*`elasticsearch.node.id`*:: -+ --- -ID of the node - -type: keyword - -example: DSiWcTyeThWtUXLB9J0BMw - --- - -*`elasticsearch.node.name`*:: -+ --- -Name of the node - -type: keyword - -example: vWNJsZ3 - --- - -*`elasticsearch.index.name`*:: -+ --- -Index name - -type: keyword - -example: filebeat-test-input - --- - -*`elasticsearch.index.id`*:: -+ --- -Index id - -type: keyword - -example: aOGgDwbURfCV57AScqbCgw - --- - -*`elasticsearch.shard.id`*:: -+ --- -Id of the shard - -type: keyword - -example: 0 - --- - -[float] -=== audit - - - - -*`elasticsearch.audit.layer`*:: -+ --- -The layer from which this event originated: rest, transport or ip_filter - -type: keyword - -example: rest - --- - -*`elasticsearch.audit.event_type`*:: -+ --- -The type of event that occurred: anonymous_access_denied, authentication_failed, access_denied, access_granted, connection_granted, connection_denied, tampered_request, run_as_granted, run_as_denied - -type: keyword - -example: access_granted - --- - -*`elasticsearch.audit.origin.type`*:: -+ --- -Where the request originated: rest (request originated from a REST API request), transport (request was received on the transport channel), local_node (the local node issued the request) - -type: keyword - -example: local_node - --- - -*`elasticsearch.audit.realm`*:: -+ --- -The authentication realm the authentication was validated against - -type: keyword - --- - -*`elasticsearch.audit.user.realm`*:: -+ --- -The user's authentication realm, if authenticated - -type: keyword - --- - -*`elasticsearch.audit.user.roles`*:: +*`rsa.crypto.cert_username`*:: + -- -Roles to which the principal belongs - type: keyword -example: ['kibana_admin', 'beats_admin'] - -- -*`elasticsearch.audit.action`*:: +*`rsa.crypto.https_insact`*:: + -- -The name of the action that was executed - type: keyword -example: cluster:monitor/main - -- -*`elasticsearch.audit.url.params`*:: -+ --- -REST URI parameters - -example: {username=jacknich2} - --- - -*`elasticsearch.audit.indices`*:: +*`rsa.crypto.https_valid`*:: + -- -Indices accessed by action - type: keyword -example: ['foo-2019.01.04', 'foo-2019.01.03', 'foo-2019.01.06'] - -- -*`elasticsearch.audit.request.id`*:: +*`rsa.crypto.cert_ca`*:: + -- -Unique ID of request +This key is used to capture the Certificate signing authority only type: keyword -example: WzL_kb6VSvOhAq0twPvHOQ - -- -*`elasticsearch.audit.request.name`*:: +*`rsa.crypto.cert_common`*:: + -- -The type of request that was executed +This key is used to capture the Certificate common name only type: keyword -example: ClearScrollRequest - --- - -*`elasticsearch.audit.request_body`*:: -+ -- -type: alias - -alias to: http.request.body.content - --- - -*`elasticsearch.audit.origin_address`*:: -+ --- -type: alias - -alias to: source.ip - --- - -*`elasticsearch.audit.uri`*:: -+ --- -type: alias - -alias to: url.original - --- - -*`elasticsearch.audit.principal`*:: -+ --- -type: alias - -alias to: user.name - --- - -*`elasticsearch.audit.message`*:: -+ --- -type: text - --- - -[float] -=== deprecation - - - -[float] -=== gc - -GC fileset fields. - -[float] -=== phase - -Fields specific to GC phase. - - - -*`elasticsearch.gc.phase.name`*:: +*`rsa.wireless.wlan_ssid`*:: + -- -Name of the GC collection phase. - +This key is used to capture the ssid of a Wireless Session type: keyword -- -*`elasticsearch.gc.phase.duration_sec`*:: -+ --- -Collection phase duration according to the Java virtual machine. - - -type: float - --- - -*`elasticsearch.gc.phase.scrub_symbol_table_time_sec`*:: -+ --- -Pause time in seconds cleaning up symbol tables. - - -type: float - --- - -*`elasticsearch.gc.phase.scrub_string_table_time_sec`*:: -+ --- -Pause time in seconds cleaning up string tables. - - -type: float - --- - -*`elasticsearch.gc.phase.weak_refs_processing_time_sec`*:: -+ --- -Time spent processing weak references in seconds. - - -type: float - --- - -*`elasticsearch.gc.phase.parallel_rescan_time_sec`*:: -+ --- -Time spent in seconds marking live objects while application is stopped. - - -type: float - --- - -*`elasticsearch.gc.phase.class_unload_time_sec`*:: -+ --- -Time spent unloading unused classes in seconds. - - -type: float - --- - -[float] -=== cpu_time - -Process CPU time spent performing collections. - - - -*`elasticsearch.gc.phase.cpu_time.user_sec`*:: -+ --- -CPU time spent outside the kernel. - - -type: float - --- - -*`elasticsearch.gc.phase.cpu_time.sys_sec`*:: -+ --- -CPU time spent inside the kernel. - - -type: float - --- - -*`elasticsearch.gc.phase.cpu_time.real_sec`*:: -+ --- -Total elapsed CPU time spent to complete the collection from start to finish. - - -type: float - --- - -*`elasticsearch.gc.jvm_runtime_sec`*:: -+ --- -The time from JVM start up in seconds, as a floating point number. - - -type: float - --- - -*`elasticsearch.gc.threads_total_stop_time_sec`*:: -+ --- -Garbage collection threads total stop time seconds. - - -type: float - --- - -*`elasticsearch.gc.stopping_threads_time_sec`*:: -+ --- -Time took to stop threads seconds. - - -type: float - --- - -*`elasticsearch.gc.tags`*:: +*`rsa.wireless.access_point`*:: + -- -GC logging tags. - +This key is used to capture the access point name. type: keyword -- -[float] -=== heap - -Heap allocation and total size. - - - -*`elasticsearch.gc.heap.size_kb`*:: -+ --- -Total heap size in kilobytes. - - -type: integer - --- - -*`elasticsearch.gc.heap.used_kb`*:: -+ --- -Used heap in kilobytes. - - -type: integer - --- - -[float] -=== old_gen - -Old generation occupancy and total size. - - - -*`elasticsearch.gc.old_gen.size_kb`*:: -+ --- -Total size of old generation in kilobytes. - - -type: integer - --- - -*`elasticsearch.gc.old_gen.used_kb`*:: -+ --- -Old generation occupancy in kilobytes. - - -type: integer - --- - -[float] -=== young_gen - -Young generation occupancy and total size. - - - -*`elasticsearch.gc.young_gen.size_kb`*:: -+ --- -Total size of young generation in kilobytes. - - -type: integer - --- - -*`elasticsearch.gc.young_gen.used_kb`*:: -+ --- -Young generation occupancy in kilobytes. - - -type: integer - --- - -[float] -=== server - -Server log file - - -*`elasticsearch.server.stacktrace`*:: -+ --- -Field is not indexed. - --- - -[float] -=== gc - -GC log - - -[float] -=== young - -Young GC - - -*`elasticsearch.server.gc.young.one`*:: -+ --- - - -type: long - -example: - --- - -*`elasticsearch.server.gc.young.two`*:: -+ --- - - -type: long - -example: - --- - -*`elasticsearch.server.gc.overhead_seq`*:: +*`rsa.wireless.wlan_channel`*:: + -- -Sequence number +This is used to capture the channel names type: long -example: 3449992 - --- - -*`elasticsearch.server.gc.collection_duration.ms`*:: -+ -- -Time spent in GC, in milliseconds - -type: float -example: 1600 - --- - -*`elasticsearch.server.gc.observation_duration.ms`*:: -+ --- -Total time over which collection was observed, in milliseconds - -type: float - -example: 1800 - --- - -[float] -=== slowlog - -Slowlog events from Elasticsearch - - -*`elasticsearch.slowlog.logger`*:: -+ --- -Logger name - -type: keyword - -example: index.search.slowlog.fetch - --- - -*`elasticsearch.slowlog.took`*:: -+ --- -Time it took to execute the query - -type: keyword - -example: 300ms - --- - -*`elasticsearch.slowlog.types`*:: +*`rsa.wireless.wlan_name`*:: + -- -Types +This key captures either WLAN number/name type: keyword -example: - --- - -*`elasticsearch.slowlog.stats`*:: -+ -- -Stats groups - -type: keyword -example: group1 --- - -*`elasticsearch.slowlog.search_type`*:: +*`rsa.storage.disk_volume`*:: + -- -Search type +A unique name assigned to logical units (volumes) within a physical disk type: keyword -example: QUERY_THEN_FETCH - -- -*`elasticsearch.slowlog.source_query`*:: +*`rsa.storage.lun`*:: + -- -Slow query +Logical Unit Number.This key is a very useful concept in Storage. type: keyword -example: {"query":{"match_all":{"boost":1.0}}} - -- -*`elasticsearch.slowlog.extra_source`*:: +*`rsa.storage.pwwn`*:: + -- -Extra source information +This uniquely identifies a port on a HBA. type: keyword -example: - -- -*`elasticsearch.slowlog.total_hits`*:: -+ --- -Total hits - -type: keyword - -example: 42 --- - -*`elasticsearch.slowlog.total_shards`*:: +*`rsa.physical.org_dst`*:: + -- -Total queried shards +This is used to capture the destination organization based on the GEOPIP Maxmind database. type: keyword -example: 22 - -- -*`elasticsearch.slowlog.routing`*:: +*`rsa.physical.org_src`*:: + -- -Routing +This is used to capture the source organization based on the GEOPIP Maxmind database. type: keyword -example: s01HZ2QBk9jw4gtgaFtn - -- -*`elasticsearch.slowlog.id`*:: -+ --- -Id -type: keyword - -example: - --- - -*`elasticsearch.slowlog.type`*:: +*`rsa.healthcare.patient_fname`*:: + -- -Type +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -example: doc - -- -*`elasticsearch.slowlog.source`*:: +*`rsa.healthcare.patient_id`*:: + -- -Source of document that was indexed +This key captures the unique ID for a patient type: keyword -- -[[exported-fields-envoyproxy]] -== Envoyproxy fields - -Module for handling logs produced by envoy - - - -[float] -=== envoyproxy - -Fields from envoy proxy logs after normalization - - - -*`envoyproxy.log_type`*:: +*`rsa.healthcare.patient_lname`*:: + -- -Envoy log type, normally ACCESS - +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`envoyproxy.response_flags`*:: +*`rsa.healthcare.patient_mname`*:: + -- -Response flags - +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`envoyproxy.upstream_service_time`*:: -+ --- -Upstream service time in nanoseconds - -type: long - -format: duration - --- - -*`envoyproxy.request_id`*:: +*`rsa.endpoint.host_state`*:: + -- -ID of the request - +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on type: keyword -- -*`envoyproxy.authority`*:: +*`rsa.endpoint.registry_key`*:: + -- -Envoy proxy authority field - +This key captures the path to the registry key type: keyword -- -*`envoyproxy.proxy_type`*:: +*`rsa.endpoint.registry_value`*:: + -- -Envoy proxy type, tcp or http - +This key captures values or decorators used within a registry entry type: keyword -- -[[exported-fields-f5]] -== Big-IP Access Policy Manager fields +[[exported-fields-cylance]] +== CylanceProtect fields -f5 fields. +cylance fields. @@ -47636,13017 +43993,14808 @@ type: keyword -- -[[exported-fields-fortinet]] -== Fortinet fields +[[exported-fields-docker-processor]] +== Docker fields -fortinet Module +Docker stats collected from Docker. -*`network.interface.name`*:: + +*`docker.container.id`*:: + -- -Name of the network interface where the traffic has been observed. - +type: alias -type: keyword +alias to: container.id -- - - -*`rsa.internal.msg`*:: +*`docker.container.image`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +type: alias -type: keyword +alias to: container.image.name -- -*`rsa.internal.messageid`*:: +*`docker.container.name`*:: + -- -type: keyword +type: alias + +alias to: container.name -- -*`rsa.internal.event_desc`*:: +*`docker.container.labels`*:: + -- -type: keyword +Image labels. --- -*`rsa.internal.message`*:: -+ +type: object + -- -This key captures the contents of instant messages -type: keyword +[[exported-fields-ecs]] +== ECS fields --- +ECS Fields. -*`rsa.internal.time`*:: + +*`@timestamp`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. +Date/time when the event originated. +This is the date/time extracted from the event, typically representing when the event was generated by the source. +If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. +Required field for all events. type: date --- - -*`rsa.internal.level`*:: -+ --- -Deprecated key defined only in table map. +example: 2016-05-23T08:05:34.853Z -type: long +required: True -- -*`rsa.internal.msg_id`*:: +*`labels`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Custom key/value pairs. +Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. +Example: `docker` and `k8s` labels. -type: keyword +type: object + +example: {"application": "foo-bar", "env": "production"} -- -*`rsa.internal.msg_vid`*:: +*`message`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +For log events the message field contains the log message, optimized for viewing in a log viewer. +For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. +If multiple messages exist, they can be combined into one message. -type: keyword +type: text + +example: Hello World -- -*`rsa.internal.data`*:: +*`tags`*:: + -- -Deprecated key defined only in table map. +List of keywords used to tag each event. type: keyword --- +example: ["production", "env2"] -*`rsa.internal.obj_server`*:: -+ -- -Deprecated key defined only in table map. -type: keyword +[float] +=== agent --- +The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. +Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken. -*`rsa.internal.obj_val`*:: + +*`agent.build.original`*:: + -- -Deprecated key defined only in table map. +Extended build information for the agent. +This field is intended to contain any build information that a data source may provide, no specific formatting is required. type: keyword +example: metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] + -- -*`rsa.internal.resource`*:: +*`agent.ephemeral_id`*:: + -- -Deprecated key defined only in table map. +Ephemeral identifier of this agent (if one exists). +This id normally changes across restarts, but `agent.id` does not. type: keyword +example: 8a4f500f + -- -*`rsa.internal.obj_id`*:: +*`agent.id`*:: + -- -Deprecated key defined only in table map. +Unique identifier of this agent (if one exists). +Example: For Beats this would be beat.id. type: keyword +example: 8a4f500d + -- -*`rsa.internal.statement`*:: +*`agent.name`*:: + -- -Deprecated key defined only in table map. +Custom name of the agent. +This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. +If no name is given, the name is often left empty. type: keyword +example: foo + -- -*`rsa.internal.audit_class`*:: +*`agent.type`*:: + -- -Deprecated key defined only in table map. +Type of the agent. +The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. type: keyword +example: filebeat + -- -*`rsa.internal.entry`*:: +*`agent.version`*:: + -- -Deprecated key defined only in table map. +Version of the agent. type: keyword --- +example: 6.0.0-rc2 -*`rsa.internal.hcode`*:: -+ -- -Deprecated key defined only in table map. -type: keyword +[float] +=== as --- +An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet. -*`rsa.internal.inode`*:: + +*`as.number`*:: + -- -Deprecated key defined only in table map. +Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. type: long +example: 15169 + -- -*`rsa.internal.resource_class`*:: +*`as.organization.name`*:: + -- -Deprecated key defined only in table map. +Organization name. type: keyword +example: Google LLC + -- -*`rsa.internal.dead`*:: +*`as.organization.name.text`*:: + -- -Deprecated key defined only in table map. - -type: long +type: text -- -*`rsa.internal.feed_desc`*:: -+ --- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +[float] +=== client -type: keyword +A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records. +For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events. +Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. --- -*`rsa.internal.feed_name`*:: +*`client.address`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. +Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. type: keyword -- -*`rsa.internal.cid`*:: +*`client.as.number`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. -type: keyword +type: long + +example: 15169 -- -*`rsa.internal.device_class`*:: +*`client.as.organization.name`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Organization name. type: keyword +example: Google LLC + -- -*`rsa.internal.device_group`*:: +*`client.as.organization.name.text`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: keyword +type: text -- -*`rsa.internal.device_host`*:: +*`client.bytes`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: keyword +Bytes sent from the client to the server. --- +type: long -*`rsa.internal.device_ip`*:: -+ --- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +example: 184 -type: ip +format: bytes -- -*`rsa.internal.device_ipv6`*:: +*`client.domain`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Client domain. -type: ip +type: keyword -- -*`rsa.internal.device_type`*:: +*`client.geo.city_name`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +City name. type: keyword +example: Montreal + -- -*`rsa.internal.device_type_id`*:: +*`client.geo.continent_name`*:: + -- -Deprecated key defined only in table map. +Name of the continent. -type: long +type: keyword + +example: North America -- -*`rsa.internal.did`*:: +*`client.geo.country_iso_code`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Country ISO code. type: keyword +example: CA + -- -*`rsa.internal.entropy_req`*:: +*`client.geo.country_name`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Country name. -type: long +type: keyword + +example: Canada -- -*`rsa.internal.entropy_res`*:: +*`client.geo.location`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Longitude and latitude. -type: long +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.internal.event_name`*:: +*`client.geo.name`*:: + -- -Deprecated key defined only in table map. +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. type: keyword +example: boston-dc + -- -*`rsa.internal.feed_category`*:: +*`client.geo.region_iso_code`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Region ISO code. type: keyword --- - -*`rsa.internal.forward_ip`*:: -+ --- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - -type: ip +example: CA-QC -- -*`rsa.internal.forward_ipv6`*:: +*`client.geo.region_name`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Region name. -type: ip +type: keyword + +example: Quebec -- -*`rsa.internal.header_id`*:: +*`client.ip`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +IP address of the client (IPv4 or IPv6). -type: keyword +type: ip -- -*`rsa.internal.lc_cid`*:: +*`client.mac`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +MAC address of the client. type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`client.nat.ip`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Translated IP of source based NAT sessions (e.g. internal client to internet). +Typically connections traversing load balancers, firewalls, or routers. -type: date +type: ip -- -*`rsa.internal.mcb_req`*:: +*`client.nat.port`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +Translated port of source based NAT sessions (e.g. internal client to internet). +Typically connections traversing load balancers, firewalls, or routers. type: long +format: string + -- -*`rsa.internal.mcb_res`*:: +*`client.packets`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +Packets sent from the client to the server. type: long +example: 12 + -- -*`rsa.internal.mcbc_req`*:: +*`client.port`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +Port of the client. type: long +format: string + -- -*`rsa.internal.mcbc_res`*:: +*`client.registered_domain`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +The highest registered client domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". -type: long +type: keyword + +example: example.com -- -*`rsa.internal.medium`*:: +*`client.top_level_domain`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". -type: long +type: keyword + +example: co.uk -- -*`rsa.internal.node_name`*:: +*`client.user.domain`*:: + -- -Deprecated key defined only in table map. +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.internal.nwe_callback_id`*:: +*`client.user.email`*:: + -- -This key denotes that event is endpoint related +User email address. type: keyword -- -*`rsa.internal.parse_error`*:: +*`client.user.full_name`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +User's full name, if available. type: keyword +example: Albert Einstein + -- -*`rsa.internal.payload_req`*:: +*`client.user.full_name.text`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - -type: long +type: text -- -*`rsa.internal.payload_res`*:: +*`client.user.group.domain`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. -type: long +type: keyword -- -*`rsa.internal.process_vid_dst`*:: +*`client.user.group.id`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. +Unique identifier for the group on the system/platform. type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`client.user.group.name`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +Name of the group. type: keyword -- -*`rsa.internal.rid`*:: +*`client.user.hash`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. -type: long +type: keyword -- -*`rsa.internal.session_split`*:: +*`client.user.id`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Unique identifier of the user. type: keyword -- -*`rsa.internal.site`*:: +*`client.user.name`*:: + -- -Deprecated key defined only in table map. +Short name or login of the user. type: keyword +example: albert + -- -*`rsa.internal.size`*:: +*`client.user.name.text`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: long +type: text -- -*`rsa.internal.sourcefile`*:: +*`client.user.roles`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Array of user roles at the time of the event. type: keyword --- +example: ["kibana_admin", "reporting_user"] -*`rsa.internal.ubc_req`*:: -+ -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: long +[float] +=== cloud --- +Fields related to the cloud or infrastructure the events are coming from. -*`rsa.internal.ubc_res`*:: + +*`cloud.account.id`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +The cloud account or organization id used to identify different entities in a multi-tenant environment. +Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. -type: long +type: keyword + +example: 666777888999 -- -*`rsa.internal.word`*:: +*`cloud.account.name`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +The cloud account name or alias used to identify different entities in a multi-tenant environment. +Examples: AWS account name, Google Cloud ORG display name. type: keyword --- +example: elastic-dev +-- -*`rsa.time.event_time`*:: +*`cloud.availability_zone`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form +Availability zone in which this host is running. -type: date +type: keyword + +example: us-east-1c -- -*`rsa.time.duration_time`*:: +*`cloud.instance.id`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. +Instance ID of the host machine. -type: double +type: keyword + +example: i-1234567890abcdef0 -- -*`rsa.time.event_time_str`*:: +*`cloud.instance.name`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string +Instance name of the host machine. type: keyword -- -*`rsa.time.starttime`*:: +*`cloud.machine.type`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form +Machine type of the host machine. -type: date +type: keyword + +example: t2.medium -- -*`rsa.time.month`*:: +*`cloud.project.id`*:: + -- +The cloud project identifier. +Examples: Google Cloud Project id, Azure Project id. + type: keyword +example: my-project + -- -*`rsa.time.day`*:: +*`cloud.project.name`*:: + -- +The cloud project name. +Examples: Google Cloud Project name, Azure Project name. + type: keyword +example: my project + -- -*`rsa.time.endtime`*:: +*`cloud.provider`*:: + -- -This key is used to capture the End time mentioned in a session in a standard form +Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. -type: date +type: keyword + +example: aws -- -*`rsa.time.timezone`*:: +*`cloud.region`*:: + -- -This key is used to capture the timezone of the Event Time +Region in which this host is running. type: keyword --- +example: us-east-1 -*`rsa.time.duration_str`*:: -+ -- -A text string version of the duration -type: keyword +[float] +=== code_signature --- +These fields contain information about binary code signatures. -*`rsa.time.date`*:: + +*`code_signature.exists`*:: + -- -type: keyword +Boolean to capture if a signature is present. --- +type: boolean -*`rsa.time.year`*:: -+ --- -type: keyword +example: true -- -*`rsa.time.recorded_time`*:: +*`code_signature.status`*:: + -- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. +Additional information about the certificate status. +This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. -type: date +type: keyword + +example: ERROR_UNTRUSTED_ROOT -- -*`rsa.time.datetime`*:: +*`code_signature.subject_name`*:: + -- +Subject name of the code signer + type: keyword +example: Microsoft Corporation + -- -*`rsa.time.effective_time`*:: +*`code_signature.trusted`*:: + -- -This key is the effective time referenced by an individual event in a Standard Timestamp format +Stores the trust status of the certificate chain. +Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. -type: date +type: boolean + +example: true -- -*`rsa.time.expire_time`*:: +*`code_signature.valid`*:: + -- -This key is the timestamp that explicitly refers to an expiration. +Boolean to capture if the digital signature is verified against the binary content. +Leave unpopulated if a certificate was unchecked. -type: date +type: boolean --- +example: true -*`rsa.time.process_time`*:: -+ -- -Deprecated, use duration.time -type: keyword +[float] +=== container --- +Container fields are used for meta information about the specific container that is the source of information. +These fields help correlate data based containers from any runtime. -*`rsa.time.hour`*:: + +*`container.id`*:: + -- +Unique container id. + type: keyword -- -*`rsa.time.min`*:: +*`container.image.name`*:: + -- +Name of the image the container was built on. + type: keyword -- -*`rsa.time.timestamp`*:: +*`container.image.tag`*:: + -- +Container image tags. + type: keyword -- -*`rsa.time.event_queue_time`*:: +*`container.labels`*:: + -- -This key is the Time that the event was queued. +Image labels. -type: date +type: object -- -*`rsa.time.p_time1`*:: +*`container.name`*:: + -- +Container name. + type: keyword -- -*`rsa.time.tzone`*:: +*`container.runtime`*:: + -- +Runtime managing this container. + type: keyword --- +example: docker -*`rsa.time.eventtime`*:: -+ -- -type: keyword --- +[float] +=== destination -*`rsa.time.gmtdate`*:: -+ --- -type: keyword +Destination fields describe details about the destination of a packet/event. +Destination fields are usually populated in conjunction with source fields. --- -*`rsa.time.gmttime`*:: +*`destination.address`*:: + -- +Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. +Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. + type: keyword -- -*`rsa.time.p_date`*:: +*`destination.as.number`*:: + -- -type: keyword +Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. --- +type: long -*`rsa.time.p_month`*:: -+ --- -type: keyword +example: 15169 -- -*`rsa.time.p_time`*:: +*`destination.as.organization.name`*:: + -- +Organization name. + type: keyword +example: Google LLC + -- -*`rsa.time.p_time2`*:: +*`destination.as.organization.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.time.p_year`*:: +*`destination.bytes`*:: + -- -type: keyword +Bytes sent from the destination to the source. + +type: long + +example: 184 + +format: bytes -- -*`rsa.time.expire_time_str`*:: +*`destination.domain`*:: + -- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. +Destination domain. type: keyword -- -*`rsa.time.stamp`*:: +*`destination.geo.city_name`*:: + -- -Deprecated key defined only in table map. +City name. -type: date +type: keyword --- +example: Montreal +-- -*`rsa.misc.action`*:: +*`destination.geo.continent_name`*:: + -- +Name of the continent. + type: keyword +example: North America + -- -*`rsa.misc.result`*:: +*`destination.geo.country_iso_code`*:: + -- -This key is used to capture the outcome/result string value of an action in a session. +Country ISO code. type: keyword +example: CA + -- -*`rsa.misc.severity`*:: +*`destination.geo.country_name`*:: + -- -This key is used to capture the severity given the session +Country name. type: keyword +example: Canada + -- -*`rsa.misc.event_type`*:: +*`destination.geo.location`*:: + -- -This key captures the event category type as specified by the event source. +Longitude and latitude. -type: keyword +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.misc.reference_id`*:: +*`destination.geo.name`*:: + -- -This key is used to capture an event id from the session directly +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. type: keyword +example: boston-dc + -- -*`rsa.misc.version`*:: +*`destination.geo.region_iso_code`*:: + -- -This key captures Version of the application or OS which is generating the event. +Region ISO code. type: keyword +example: CA-QC + -- -*`rsa.misc.disposition`*:: +*`destination.geo.region_name`*:: + -- -This key captures the The end state of an action. +Region name. type: keyword +example: Quebec + -- -*`rsa.misc.result_code`*:: +*`destination.ip`*:: + -- -This key is used to capture the outcome/result numeric value of an action in a session +IP address of the destination (IPv4 or IPv6). -type: keyword +type: ip -- -*`rsa.misc.category`*:: +*`destination.mac`*:: + -- -This key is used to capture the category of an event given by the vendor in the session +MAC address of the destination. type: keyword -- -*`rsa.misc.obj_name`*:: +*`destination.nat.ip`*:: + -- -This is used to capture name of object +Translated ip of destination based NAT sessions (e.g. internet to private DMZ) +Typically used with load balancers, firewalls, or routers. -type: keyword +type: ip -- -*`rsa.misc.obj_type`*:: +*`destination.nat.port`*:: + -- -This is used to capture type of object +Port the source session is translated to by NAT Device. +Typically used with load balancers, firewalls, or routers. -type: keyword +type: long + +format: string -- -*`rsa.misc.event_source`*:: +*`destination.packets`*:: + -- -This key captures Source of the event that’s not a hostname +Packets sent from the destination to the source. -type: keyword +type: long + +example: 12 -- -*`rsa.misc.log_session_id`*:: +*`destination.port`*:: + -- -This key is used to capture a sessionid from the session directly +Port of the destination. -type: keyword +type: long + +format: string -- -*`rsa.misc.group`*:: +*`destination.registered_domain`*:: + -- -This key captures the Group Name value +The highest registered destination domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". type: keyword +example: example.com + -- -*`rsa.misc.policy_name`*:: +*`destination.top_level_domain`*:: + -- -This key is used to capture the Policy Name only. +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". type: keyword +example: co.uk + -- -*`rsa.misc.rule_name`*:: +*`destination.user.domain`*:: + -- -This key captures the Rule Name +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.misc.context`*:: +*`destination.user.email`*:: + -- -This key captures Information which adds additional context to the event. +User email address. type: keyword -- -*`rsa.misc.change_new`*:: +*`destination.user.full_name`*:: + -- -This key is used to capture the new values of the attribute that’s changing in a session +User's full name, if available. type: keyword +example: Albert Einstein + -- -*`rsa.misc.space`*:: +*`destination.user.full_name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.client`*:: +*`destination.user.group.domain`*:: + -- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.misc.msgIdPart1`*:: +*`destination.user.group.id`*:: + -- +Unique identifier for the group on the system/platform. + type: keyword -- -*`rsa.misc.msgIdPart2`*:: +*`destination.user.group.name`*:: + -- +Name of the group. + type: keyword -- -*`rsa.misc.change_old`*:: +*`destination.user.hash`*:: + -- -This key is used to capture the old value of the attribute that’s changing in a session +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. type: keyword -- -*`rsa.misc.operation_id`*:: +*`destination.user.id`*:: + -- -An alert number or operation number. The values should be unique and non-repeating. +Unique identifier of the user. type: keyword -- -*`rsa.misc.event_state`*:: +*`destination.user.name`*:: + -- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. +Short name or login of the user. type: keyword +example: albert + -- -*`rsa.misc.group_object`*:: +*`destination.user.name.text`*:: + -- -This key captures a collection/grouping of entities. Specific usage - -type: keyword +type: text -- -*`rsa.misc.node`*:: +*`destination.user.roles`*:: + -- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. +Array of user roles at the time of the event. type: keyword +example: ["kibana_admin", "reporting_user"] + -- -*`rsa.misc.rule`*:: +[float] +=== dll + +These fields contain information about code libraries dynamically loaded into processes. + +Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following: +* Dynamic-link library (`.dll`) commonly used on Windows +* Shared Object (`.so`) commonly used on Unix-like operating systems +* Dynamic library (`.dylib`) commonly used on macOS + + +*`dll.code_signature.exists`*:: + -- -This key captures the Rule number +Boolean to capture if a signature is present. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.device_name`*:: +*`dll.code_signature.status`*:: + -- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc +Additional information about the certificate status. +This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. type: keyword +example: ERROR_UNTRUSTED_ROOT + -- -*`rsa.misc.param`*:: +*`dll.code_signature.subject_name`*:: + -- -This key is the parameters passed as part of a command or application, etc. +Subject name of the code signer type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.change_attrib`*:: +*`dll.code_signature.trusted`*:: + -- -This key is used to capture the name of the attribute that’s changing in a session +Stores the trust status of the certificate chain. +Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.event_computer`*:: +*`dll.code_signature.valid`*:: + -- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. +Boolean to capture if the digital signature is verified against the binary content. +Leave unpopulated if a certificate was unchecked. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.reference_id1`*:: +*`dll.hash.md5`*:: + -- -This key is for Linked ID to be used as an addition to "reference.id" +MD5 hash. type: keyword -- -*`rsa.misc.event_log`*:: +*`dll.hash.sha1`*:: + -- -This key captures the Name of the event log +SHA1 hash. type: keyword -- -*`rsa.misc.OS`*:: +*`dll.hash.sha256`*:: + -- -This key captures the Name of the Operating System +SHA256 hash. type: keyword -- -*`rsa.misc.terminal`*:: +*`dll.hash.sha512`*:: + -- -This key captures the Terminal Names only +SHA512 hash. type: keyword -- -*`rsa.misc.msgIdPart3`*:: +*`dll.name`*:: + -- +Name of the library. +This generally maps to the name of the file on disk. + type: keyword +example: kernel32.dll + -- -*`rsa.misc.filter`*:: +*`dll.path`*:: + -- -This key captures Filter used to reduce result set +Full file path of the library. type: keyword +example: C:\Windows\System32\kernel32.dll + -- -*`rsa.misc.serial_number`*:: +*`dll.pe.architecture`*:: + -- -This key is the Serial number associated with a physical asset. +CPU architecture target for the file. type: keyword +example: x64 + -- -*`rsa.misc.checksum`*:: +*`dll.pe.company`*:: + -- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. +Internal company name of the file, provided at compile-time. type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.event_user`*:: +*`dll.pe.description`*:: + -- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. +Internal description of the file, provided at compile-time. type: keyword +example: Paint + -- -*`rsa.misc.virusname`*:: +*`dll.pe.file_version`*:: + -- -This key captures the name of the virus +Internal version of the file, provided at compile-time. type: keyword +example: 6.3.9600.17415 + -- -*`rsa.misc.content_type`*:: +*`dll.pe.imphash`*:: + -- -This key is used to capture Content Type only. +A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. +Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. type: keyword +example: 0c6803c4e922103c4dca5963aad36ddf + -- -*`rsa.misc.group_id`*:: +*`dll.pe.original_file_name`*:: + -- -This key captures Group ID Number (related to the group name) +Internal name of the file, provided at compile-time. type: keyword +example: MSPAINT.EXE + -- -*`rsa.misc.policy_id`*:: +*`dll.pe.product`*:: + -- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise +Internal product name of the file, provided at compile-time. type: keyword +example: Microsoft® Windows® Operating System + -- -*`rsa.misc.vsys`*:: +[float] +=== dns + +Fields describing DNS queries and answers. +DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`). + + +*`dns.answers`*:: + -- -This key captures Virtual System Name +An array containing an object for each answer section returned by the server. +The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. +Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. -type: keyword +type: object -- -*`rsa.misc.connection_id`*:: +*`dns.answers.class`*:: + -- -This key captures the Connection ID +The class of DNS data contained in this resource record. type: keyword +example: IN + -- -*`rsa.misc.reference_id2`*:: +*`dns.answers.data`*:: + -- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. +The data describing the resource. +The meaning of this data depends on the type and class of the resource record. type: keyword +example: 10.10.10.10 + -- -*`rsa.misc.sensor`*:: +*`dns.answers.name`*:: + -- -This key captures Name of the sensor. Typically used in IDS/IPS based devices +The domain name to which this resource record pertains. +If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. type: keyword +example: www.example.com + -- -*`rsa.misc.sig_id`*:: +*`dns.answers.ttl`*:: + -- -This key captures IDS/IPS Int Signature ID +The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. type: long +example: 180 + -- -*`rsa.misc.port_name`*:: +*`dns.answers.type`*:: + -- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). +The type of data contained in this resource record. type: keyword +example: CNAME + -- -*`rsa.misc.rule_group`*:: +*`dns.header_flags`*:: + -- -This key captures the Rule group name +Array of 2 letter DNS header flags. +Expected values are: AA, TC, RD, RA, AD, CD, DO. type: keyword +example: ['RD', 'RA'] + -- -*`rsa.misc.risk_num`*:: +*`dns.id`*:: + -- -This key captures a Numeric Risk value +The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. -type: double +type: keyword + +example: 62111 -- -*`rsa.misc.trigger_val`*:: +*`dns.op_code`*:: + -- -This key captures the Value of the trigger or threshold condition. +The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. type: keyword +example: QUERY + -- -*`rsa.misc.log_session_id1`*:: +*`dns.question.class`*:: + -- -This key is used to capture a Linked (Related) Session ID from the session directly +The class of records being queried. type: keyword +example: IN + -- -*`rsa.misc.comp_version`*:: +*`dns.question.name`*:: + -- -This key captures the Version level of a sub-component of a product. +The name being queried. +If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. type: keyword +example: www.example.com + -- -*`rsa.misc.content_version`*:: +*`dns.question.registered_domain`*:: + -- -This key captures Version level of a signature or database content. +The highest registered domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". type: keyword +example: example.com + -- -*`rsa.misc.hardware_id`*:: +*`dns.question.subdomain`*:: + -- -This key is used to capture unique identifier for a device or system (NOT a Mac address) +The subdomain is all of the labels under the registered_domain. +If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. type: keyword +example: www + -- -*`rsa.misc.risk`*:: +*`dns.question.top_level_domain`*:: + -- -This key captures the non-numeric risk value +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". type: keyword +example: co.uk + -- -*`rsa.misc.event_id`*:: +*`dns.question.type`*:: + -- +The type of record being queried. + type: keyword +example: AAAA + -- -*`rsa.misc.reason`*:: +*`dns.resolved_ip`*:: + -- -type: keyword +Array containing all IPs seen in `answers.data`. +The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. --- +type: ip -*`rsa.misc.status`*:: -+ --- -type: keyword +example: ['10.10.10.10', '10.10.10.11'] -- -*`rsa.misc.mail_id`*:: +*`dns.response_code`*:: + -- -This key is used to capture the mailbox id/name +The DNS response code. type: keyword +example: NOERROR + -- -*`rsa.misc.rule_uid`*:: +*`dns.type`*:: + -- -This key is the Unique Identifier for a rule. +The type of DNS event captured, query or answer. +If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. +If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. type: keyword --- +example: answer -*`rsa.misc.trigger_desc`*:: -+ -- -This key captures the Description of the trigger or threshold condition. -type: keyword +[float] +=== ecs --- +Meta-information specific to ECS. -*`rsa.misc.inout`*:: + +*`ecs.version`*:: + -- +ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. +When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. + type: keyword --- +example: 1.0.0 -*`rsa.misc.p_msgid`*:: -+ --- -type: keyword +required: True -- -*`rsa.misc.data_type`*:: -+ --- -type: keyword +[float] +=== error --- +These fields can represent errors of any kind. +Use them for errors that happen while fetching events or in cases where the event itself contains an error. -*`rsa.misc.msgIdPart4`*:: + +*`error.code`*:: + -- +Error code describing the error. + type: keyword -- -*`rsa.misc.error`*:: +*`error.id`*:: + -- -This key captures All non successful Error codes or responses +Unique identifier for the error. type: keyword -- -*`rsa.misc.index`*:: +*`error.message`*:: + -- -type: keyword +Error message. + +type: text -- -*`rsa.misc.listnum`*:: +*`error.stack_trace`*:: + -- -This key is used to capture listname or listnumber, primarily for collecting access-list +The stack trace of this error in plain text. type: keyword +Field is not indexed. + -- -*`rsa.misc.ntype`*:: +*`error.stack_trace.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.observed_val`*:: +*`error.type`*:: + -- -This key captures the Value observed (from the perspective of the device generating the log). +The type of the error, for example the class name of the exception. type: keyword --- +example: java.lang.NullPointerException -*`rsa.misc.policy_value`*:: -+ -- -This key captures the contents of the policy. This contains details about the policy -type: keyword +[float] +=== event --- +The event fields are used for context information about the log or metric event itself. +A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events. -*`rsa.misc.pool_name`*:: + +*`event.action`*:: + -- -This key captures the name of a resource pool +The action captured by the event. +This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. type: keyword +example: user-password-change + -- -*`rsa.misc.rule_template`*:: +*`event.category`*:: + -- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template +This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. +`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. +This field is an array. This will allow proper categorization of some events that fall in multiple categories. type: keyword --- - -*`rsa.misc.count`*:: -+ --- -type: keyword +example: authentication -- -*`rsa.misc.number`*:: +*`event.code`*:: + -- +Identification code for this event, if one exists. +Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. + type: keyword +example: 4648 + -- -*`rsa.misc.sigcat`*:: +*`event.created`*:: + -- -type: keyword +event.created contains the date/time when the event was first read by an agent, or by your pipeline. +This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. +In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. +In case the two timestamps are identical, @timestamp should be used. --- +type: date -*`rsa.misc.type`*:: -+ --- -type: keyword +example: 2016-05-23T08:05:34.857Z -- -*`rsa.misc.comments`*:: +*`event.dataset`*:: + -- -Comment information provided in the log message +Name of the dataset. +If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. +It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. type: keyword +example: apache.access + -- -*`rsa.misc.doc_number`*:: +*`event.duration`*:: + -- -This key captures File Identification number +Duration of the event in nanoseconds. +If event.start and event.end are known this value should be the difference between the end and start time. type: long +format: duration + -- -*`rsa.misc.expected_val`*:: +*`event.end`*:: + -- -This key captures the Value expected (from the perspective of the device generating the log). +event.end contains the date when the event ended or when the activity was last observed. -type: keyword +type: date -- -*`rsa.misc.job_num`*:: +*`event.hash`*:: + -- -This key captures the Job Number +Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. type: keyword +example: 123456789012345678901234567890ABCD + -- -*`rsa.misc.spi_dst`*:: +*`event.id`*:: + -- -Destination SPI Index +Unique ID to describe the event. type: keyword +example: 8a4f500d + -- -*`rsa.misc.spi_src`*:: +*`event.ingested`*:: + -- -Source SPI Index +Timestamp when an event arrived in the central data store. +This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. +In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. -type: keyword +type: date + +example: 2016-05-23T08:05:35.101Z -- -*`rsa.misc.code`*:: +*`event.kind`*:: + -- +This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. +`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. +The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. + type: keyword +example: alert + -- -*`rsa.misc.agent_id`*:: +*`event.module`*:: + -- -This key is used to capture agent id +Name of the module this data is coming from. +If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. type: keyword +example: apache + -- -*`rsa.misc.message_body`*:: +*`event.original`*:: + -- -This key captures the The contents of the message body. +Raw text message of entire event. Used to demonstrate log integrity. +This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. type: keyword --- +example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 -*`rsa.misc.phone`*:: -+ --- -type: keyword +Field is not indexed. -- -*`rsa.misc.sig_id_str`*:: +*`event.outcome`*:: + -- -This key captures a string object of the sigid variable. +This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. +`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. +Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. +Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. +Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. type: keyword +example: success + -- -*`rsa.misc.cmd`*:: +*`event.provider`*:: + -- +Source of the event. +Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). + type: keyword +example: kernel + -- -*`rsa.misc.misc`*:: +*`event.reason`*:: + -- +Reason why this event happened, according to the source. +This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). + type: keyword +example: Terminated an unexpected process + -- -*`rsa.misc.name`*:: +*`event.reference`*:: + -- +Reference URL linking to additional information about this event. +This URL links to a static definition of the this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. + type: keyword +example: https://system.example.com/event/#0001234 + -- -*`rsa.misc.cpu`*:: +*`event.risk_score`*:: + -- -This key is the CPU time used in the execution of the event being recorded. +Risk score or priority of the event (e.g. security solutions). Use your system's original value here. -type: long +type: float -- -*`rsa.misc.event_desc`*:: +*`event.risk_score_norm`*:: + -- -This key is used to capture a description of an event available directly or inferred +Normalized risk score or priority of the event, on a scale of 0 to 100. +This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. -type: keyword +type: float -- -*`rsa.misc.sig_id1`*:: +*`event.sequence`*:: + -- -This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id +Sequence number of the event. +The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. type: long +format: string + -- -*`rsa.misc.im_buddyid`*:: +*`event.severity`*:: + -- -type: keyword +The numeric severity of the event according to your event source. +What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. +The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. + +type: long + +example: 7 + +format: string -- -*`rsa.misc.im_client`*:: +*`event.start`*:: + -- -type: keyword +event.start contains the date when the event started or when the activity was first observed. + +type: date -- -*`rsa.misc.im_userid`*:: +*`event.timezone`*:: + -- +This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. +Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). + type: keyword -- -*`rsa.misc.pid`*:: +*`event.type`*:: + -- +This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. +`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. +This field is an array. This will allow proper categorization of some events that fall in multiple event types. + type: keyword -- -*`rsa.misc.priority`*:: +*`event.url`*:: + -- +URL linking to an external system to continue investigation of this event. +This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. + type: keyword +example: https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe + -- -*`rsa.misc.context_subject`*:: +[float] +=== file + +A file is defined as a set of information that has been created on, or has existed on a filesystem. +File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric. + + +*`file.accessed`*:: + -- -This key is to be used in an audit context where the subject is the object being identified +Last time the file was accessed. +Note that not all filesystems keep track of access time. -type: keyword +type: date -- -*`rsa.misc.context_target`*:: +*`file.attributes`*:: + -- +Array of file attributes. +Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. + type: keyword +example: ["readonly", "system"] + -- -*`rsa.misc.cve`*:: +*`file.code_signature.exists`*:: + -- -This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. +Boolean to capture if a signature is present. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.fcatnum`*:: +*`file.code_signature.status`*:: + -- -This key captures Filter Category Number. Legacy Usage +Additional information about the certificate status. +This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. type: keyword +example: ERROR_UNTRUSTED_ROOT + -- -*`rsa.misc.library`*:: +*`file.code_signature.subject_name`*:: + -- -This key is used to capture library information in mainframe devices +Subject name of the code signer type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.parent_node`*:: +*`file.code_signature.trusted`*:: + -- -This key captures the Parent Node Name. Must be related to node variable. +Stores the trust status of the certificate chain. +Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.risk_info`*:: +*`file.code_signature.valid`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Boolean to capture if the digital signature is verified against the binary content. +Leave unpopulated if a certificate was unchecked. -type: keyword +type: boolean + +example: true -- -*`rsa.misc.tcp_flags`*:: +*`file.created`*:: + -- -This key is captures the TCP flags set in any packet of session +File creation time. +Note that not all filesystems store the creation time. -type: long +type: date -- -*`rsa.misc.tos`*:: +*`file.ctime`*:: + -- -This key describes the type of service +Last time the file attributes or metadata changed. +Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. -type: long +type: date -- -*`rsa.misc.vm_target`*:: +*`file.device`*:: + -- -VMWare Target **VMWARE** only varaible. +Device that is the source of the file. type: keyword +example: sda + -- -*`rsa.misc.workspace`*:: +*`file.directory`*:: + -- -This key captures Workspace Description +Directory where the file is located. It should include the drive letter, when appropriate. type: keyword +example: /home/alice + -- -*`rsa.misc.command`*:: +*`file.drive_letter`*:: + -- +Drive letter where the file is located. This field is only relevant on Windows. +The value should be uppercase, and not include the colon. + type: keyword +example: C + -- -*`rsa.misc.event_category`*:: +*`file.extension`*:: + -- +File extension. + type: keyword +example: png + -- -*`rsa.misc.facilityname`*:: +*`file.gid`*:: + -- +Primary group ID (GID) of the file. + type: keyword +example: 1001 + -- -*`rsa.misc.forensic_info`*:: +*`file.group`*:: + -- +Primary group name of the file. + type: keyword +example: alice + -- -*`rsa.misc.jobname`*:: +*`file.hash.md5`*:: + -- +MD5 hash. + type: keyword -- -*`rsa.misc.mode`*:: +*`file.hash.sha1`*:: + -- +SHA1 hash. + type: keyword -- -*`rsa.misc.policy`*:: +*`file.hash.sha256`*:: + -- +SHA256 hash. + type: keyword -- -*`rsa.misc.policy_waiver`*:: +*`file.hash.sha512`*:: + -- +SHA512 hash. + type: keyword -- -*`rsa.misc.second`*:: +*`file.inode`*:: + -- +Inode representing the file in the filesystem. + type: keyword +example: 256383 + -- -*`rsa.misc.space1`*:: +*`file.mime_type`*:: + -- +MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. + type: keyword -- -*`rsa.misc.subcategory`*:: +*`file.mode`*:: + -- +Mode of the file in octal representation. + type: keyword +example: 0640 + -- -*`rsa.misc.tbdstr2`*:: +*`file.mtime`*:: + -- -type: keyword +Last time the file content was modified. + +type: date -- -*`rsa.misc.alert_id`*:: +*`file.name`*:: + -- -Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Name of the file including the extension, without the directory. type: keyword +example: example.png + -- -*`rsa.misc.checksum_dst`*:: +*`file.owner`*:: + -- -This key is used to capture the checksum or hash of the the target entity such as a process or file. +File owner's username. type: keyword +example: alice + -- -*`rsa.misc.checksum_src`*:: +*`file.path`*:: + -- -This key is used to capture the checksum or hash of the source entity such as a file or process. +Full path to the file, including the file name. It should include the drive letter, when appropriate. type: keyword +example: /home/alice/example.png + -- -*`rsa.misc.fresult`*:: +*`file.path.text`*:: + -- -This key captures the Filter Result - -type: long +type: text -- -*`rsa.misc.payload_dst`*:: +*`file.pe.architecture`*:: + -- -This key is used to capture destination payload +CPU architecture target for the file. type: keyword +example: x64 + -- -*`rsa.misc.payload_src`*:: +*`file.pe.company`*:: + -- -This key is used to capture source payload +Internal company name of the file, provided at compile-time. type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.pool_id`*:: +*`file.pe.description`*:: + -- -This key captures the identifier (typically numeric field) of a resource pool +Internal description of the file, provided at compile-time. type: keyword +example: Paint + -- -*`rsa.misc.process_id_val`*:: +*`file.pe.file_version`*:: + -- -This key is a failure key for Process ID when it is not an integer value +Internal version of the file, provided at compile-time. type: keyword +example: 6.3.9600.17415 + -- -*`rsa.misc.risk_num_comm`*:: +*`file.pe.imphash`*:: + -- -This key captures Risk Number Community +A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. +Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. -type: double +type: keyword + +example: 0c6803c4e922103c4dca5963aad36ddf -- -*`rsa.misc.risk_num_next`*:: +*`file.pe.original_file_name`*:: + -- -This key captures Risk Number NextGen +Internal name of the file, provided at compile-time. -type: double +type: keyword + +example: MSPAINT.EXE -- -*`rsa.misc.risk_num_sand`*:: +*`file.pe.product`*:: + -- -This key captures Risk Number SandBox +Internal product name of the file, provided at compile-time. -type: double +type: keyword + +example: Microsoft® Windows® Operating System -- -*`rsa.misc.risk_num_static`*:: +*`file.size`*:: + -- -This key captures Risk Number Static +File size in bytes. +Only relevant when `file.type` is "file". -type: double +type: long + +example: 16384 -- -*`rsa.misc.risk_suspicious`*:: +*`file.target_path`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Target path for symlinks. type: keyword -- -*`rsa.misc.risk_warning`*:: +*`file.target_path.text`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - -type: keyword +type: text -- -*`rsa.misc.snmp_oid`*:: +*`file.type`*:: + -- -SNMP Object Identifier +File type (file, dir, or symlink). type: keyword +example: file + -- -*`rsa.misc.sql`*:: +*`file.uid`*:: + -- -This key captures the SQL query +The user ID (UID) or security identifier (SID) of the file owner. type: keyword +example: 1001 + -- -*`rsa.misc.vuln_ref`*:: +*`file.x509.alternative_names`*:: + -- -This key captures the Vulnerability Reference details +List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. type: keyword +example: *.elastic.co + -- -*`rsa.misc.acl_id`*:: +*`file.x509.issuer.common_name`*:: + -- +List of common name (CN) of issuing certificate authority. + type: keyword +example: Example SHA2 High Assurance Server CA + -- -*`rsa.misc.acl_op`*:: +*`file.x509.issuer.country`*:: + -- +List of country (C) codes + type: keyword +example: US + -- -*`rsa.misc.acl_pos`*:: +*`file.x509.issuer.distinguished_name`*:: + -- +Distinguished name (DN) of issuing certificate authority. + type: keyword +example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA + -- -*`rsa.misc.acl_table`*:: +*`file.x509.issuer.locality`*:: + -- +List of locality names (L) + type: keyword +example: Mountain View + -- -*`rsa.misc.admin`*:: +*`file.x509.issuer.organization`*:: + -- +List of organizations (O) of issuing certificate authority. + type: keyword +example: Example Inc + -- -*`rsa.misc.alarm_id`*:: +*`file.x509.issuer.organizational_unit`*:: + -- +List of organizational units (OU) of issuing certificate authority. + type: keyword +example: www.example.com + -- -*`rsa.misc.alarmname`*:: +*`file.x509.issuer.state_or_province`*:: + -- +List of state or province names (ST, S, or P) + type: keyword +example: California + -- -*`rsa.misc.app_id`*:: +*`file.x509.not_after`*:: + -- -type: keyword +Time at which the certificate is no longer considered valid. + +type: date + +example: 2020-07-16 03:15:39+00:00 -- -*`rsa.misc.audit`*:: +*`file.x509.not_before`*:: + -- -type: keyword +Time at which the certificate is first considered valid. + +type: date + +example: 2019-08-16 01:40:25+00:00 -- -*`rsa.misc.audit_object`*:: +*`file.x509.public_key_algorithm`*:: + -- +Algorithm used to generate the public key. + type: keyword +example: RSA + -- -*`rsa.misc.auditdata`*:: +*`file.x509.public_key_curve`*:: + -- +The curve used by the elliptic curve public key algorithm. This is algorithm specific. + type: keyword +example: nistp521 + -- -*`rsa.misc.benchmark`*:: +*`file.x509.public_key_exponent`*:: + -- -type: keyword +Exponent used to derive the public key. This is algorithm specific. + +type: long + +example: 65537 + +Field is not indexed. -- -*`rsa.misc.bypass`*:: +*`file.x509.public_key_size`*:: + -- -type: keyword +The size of the public key space in bits. + +type: long + +example: 2048 -- -*`rsa.misc.cache`*:: +*`file.x509.serial_number`*:: + -- +Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + type: keyword +example: 55FBB9C7DEBF09809D12CCAA + -- -*`rsa.misc.cache_hit`*:: +*`file.x509.signature_algorithm`*:: + -- +Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + type: keyword +example: SHA256-RSA + -- -*`rsa.misc.cefversion`*:: +*`file.x509.subject.common_name`*:: + -- +List of common names (CN) of subject. + type: keyword +example: shared.global.example.net + -- -*`rsa.misc.cfg_attr`*:: +*`file.x509.subject.country`*:: + -- +List of country (C) code + type: keyword +example: US + -- -*`rsa.misc.cfg_obj`*:: +*`file.x509.subject.distinguished_name`*:: + -- +Distinguished name (DN) of the certificate subject entity. + type: keyword +example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net + -- -*`rsa.misc.cfg_path`*:: +*`file.x509.subject.locality`*:: + -- +List of locality names (L) + type: keyword +example: San Francisco + -- -*`rsa.misc.changes`*:: +*`file.x509.subject.organization`*:: + -- +List of organizations (O) of subject. + type: keyword +example: Example, Inc. + -- -*`rsa.misc.client_ip`*:: +*`file.x509.subject.organizational_unit`*:: + -- +List of organizational units (OU) of subject. + type: keyword -- -*`rsa.misc.clustermembers`*:: +*`file.x509.subject.state_or_province`*:: + -- +List of state or province names (ST, S, or P) + type: keyword +example: California + -- -*`rsa.misc.cn_acttimeout`*:: +*`file.x509.version_number`*:: + -- +Version of x509 format. + type: keyword +example: 3 + -- -*`rsa.misc.cn_asn_src`*:: +[float] +=== geo + +Geo fields can carry data about a specific location related to an event. +This geolocation information can be derived from techniques such as Geo IP, or be user-supplied. + + +*`geo.city_name`*:: + -- +City name. + type: keyword +example: Montreal + -- -*`rsa.misc.cn_bgpv4nxthop`*:: +*`geo.continent_name`*:: + -- +Name of the continent. + type: keyword +example: North America + -- -*`rsa.misc.cn_ctr_dst_code`*:: +*`geo.country_iso_code`*:: + -- +Country ISO code. + type: keyword +example: CA + -- -*`rsa.misc.cn_dst_tos`*:: +*`geo.country_name`*:: + -- +Country name. + type: keyword +example: Canada + -- -*`rsa.misc.cn_dst_vlan`*:: +*`geo.location`*:: + -- -type: keyword +Longitude and latitude. + +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.misc.cn_engine_id`*:: +*`geo.name`*:: + -- +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. + type: keyword +example: boston-dc + -- -*`rsa.misc.cn_engine_type`*:: +*`geo.region_iso_code`*:: + -- +Region ISO code. + type: keyword +example: CA-QC + -- -*`rsa.misc.cn_f_switch`*:: +*`geo.region_name`*:: + -- +Region name. + type: keyword +example: Quebec + -- -*`rsa.misc.cn_flowsampid`*:: +[float] +=== group + +The group fields are meant to represent groups that are relevant to the event. + + +*`group.domain`*:: + -- +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. + type: keyword -- -*`rsa.misc.cn_flowsampintv`*:: +*`group.id`*:: + -- +Unique identifier for the group on the system/platform. + type: keyword -- -*`rsa.misc.cn_flowsampmode`*:: +*`group.name`*:: + -- +Name of the group. + type: keyword -- -*`rsa.misc.cn_inacttimeout`*:: +[float] +=== hash + +The hash fields represent different hash algorithms and their values. +Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512). + + +*`hash.md5`*:: + -- +MD5 hash. + type: keyword -- -*`rsa.misc.cn_inpermbyts`*:: +*`hash.sha1`*:: + -- +SHA1 hash. + type: keyword -- -*`rsa.misc.cn_inpermpckts`*:: +*`hash.sha256`*:: + -- +SHA256 hash. + type: keyword -- -*`rsa.misc.cn_invalid`*:: +*`hash.sha512`*:: + -- +SHA512 hash. + type: keyword -- -*`rsa.misc.cn_ip_proto_ver`*:: +[float] +=== host + +A host is defined as a general computing instance. +ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. + + +*`host.architecture`*:: + -- +Operating system architecture. + type: keyword +example: x86_64 + -- -*`rsa.misc.cn_ipv4_ident`*:: +*`host.domain`*:: + -- +Name of the domain of which the host is a member. +For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. + type: keyword +example: CONTOSO + -- -*`rsa.misc.cn_l_switch`*:: +*`host.geo.city_name`*:: + -- +City name. + type: keyword +example: Montreal + -- -*`rsa.misc.cn_log_did`*:: +*`host.geo.continent_name`*:: + -- +Name of the continent. + type: keyword +example: North America + -- -*`rsa.misc.cn_log_rid`*:: +*`host.geo.country_iso_code`*:: + -- +Country ISO code. + type: keyword +example: CA + -- -*`rsa.misc.cn_max_ttl`*:: +*`host.geo.country_name`*:: + -- +Country name. + type: keyword +example: Canada + -- -*`rsa.misc.cn_maxpcktlen`*:: +*`host.geo.location`*:: + -- -type: keyword +Longitude and latitude. + +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.misc.cn_min_ttl`*:: +*`host.geo.name`*:: + -- +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. + type: keyword +example: boston-dc + -- -*`rsa.misc.cn_minpcktlen`*:: +*`host.geo.region_iso_code`*:: + -- +Region ISO code. + type: keyword +example: CA-QC + -- -*`rsa.misc.cn_mpls_lbl_1`*:: +*`host.geo.region_name`*:: + -- +Region name. + type: keyword +example: Quebec + -- -*`rsa.misc.cn_mpls_lbl_10`*:: +*`host.hostname`*:: + -- +Hostname of the host. +It normally contains what the `hostname` command returns on the host machine. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_2`*:: +*`host.id`*:: + -- +Unique host id. +As hostname is not always unique, use values that are meaningful in your environment. +Example: The current usage of `beat.name`. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_3`*:: +*`host.ip`*:: + -- -type: keyword +Host ip addresses. + +type: ip -- -*`rsa.misc.cn_mpls_lbl_4`*:: +*`host.mac`*:: + -- +Host mac addresses. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_5`*:: +*`host.name`*:: + -- +Name of the host. +It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_6`*:: +*`host.os.family`*:: + -- +OS family (such as redhat, debian, freebsd, windows). + type: keyword +example: debian + -- -*`rsa.misc.cn_mpls_lbl_7`*:: +*`host.os.full`*:: + -- +Operating system name, including the version or code name. + type: keyword +example: Mac OS Mojave + -- -*`rsa.misc.cn_mpls_lbl_8`*:: +*`host.os.full.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cn_mpls_lbl_9`*:: +*`host.os.kernel`*:: + -- +Operating system kernel version as a raw string. + type: keyword +example: 4.4.0-112-generic + -- -*`rsa.misc.cn_mplstoplabel`*:: +*`host.os.name`*:: + -- +Operating system name, without the version. + type: keyword +example: Mac OS X + -- -*`rsa.misc.cn_mplstoplabip`*:: +*`host.os.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cn_mul_dst_byt`*:: +*`host.os.platform`*:: + -- +Operating system platform (such centos, ubuntu, windows). + type: keyword +example: darwin + -- -*`rsa.misc.cn_mul_dst_pks`*:: +*`host.os.version`*:: + -- +Operating system version as a raw string. + type: keyword +example: 10.14.1 + -- -*`rsa.misc.cn_muligmptype`*:: +*`host.type`*:: + -- +Type of host. +For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. + type: keyword -- -*`rsa.misc.cn_sampalgo`*:: +*`host.uptime`*:: + -- -type: keyword +Seconds the host has been up. + +type: long + +example: 1325 -- -*`rsa.misc.cn_sampint`*:: +*`host.user.domain`*:: + -- +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. + type: keyword -- -*`rsa.misc.cn_seqctr`*:: +*`host.user.email`*:: + -- +User email address. + type: keyword -- -*`rsa.misc.cn_spackets`*:: +*`host.user.full_name`*:: + -- +User's full name, if available. + type: keyword +example: Albert Einstein + -- -*`rsa.misc.cn_src_tos`*:: +*`host.user.full_name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cn_src_vlan`*:: +*`host.user.group.domain`*:: + -- +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. + type: keyword -- -*`rsa.misc.cn_sysuptime`*:: +*`host.user.group.id`*:: + -- +Unique identifier for the group on the system/platform. + type: keyword -- -*`rsa.misc.cn_template_id`*:: +*`host.user.group.name`*:: + -- +Name of the group. + type: keyword -- -*`rsa.misc.cn_totbytsexp`*:: +*`host.user.hash`*:: + -- +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. + type: keyword -- -*`rsa.misc.cn_totflowexp`*:: +*`host.user.id`*:: + -- +Unique identifier of the user. + type: keyword -- -*`rsa.misc.cn_totpcktsexp`*:: +*`host.user.name`*:: + -- +Short name or login of the user. + type: keyword +example: albert + -- -*`rsa.misc.cn_unixnanosecs`*:: +*`host.user.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cn_v6flowlabel`*:: +*`host.user.roles`*:: + -- +Array of user roles at the time of the event. + type: keyword +example: ["kibana_admin", "reporting_user"] + -- -*`rsa.misc.cn_v6optheaders`*:: -+ --- -type: keyword +[float] +=== http --- +Fields related to HTTP activity. Use the `url` field set to store the url of the request. -*`rsa.misc.comp_class`*:: + +*`http.request.body.bytes`*:: + -- -type: keyword +Size in bytes of the request body. --- +type: long -*`rsa.misc.comp_name`*:: -+ --- -type: keyword +example: 887 + +format: bytes -- -*`rsa.misc.comp_rbytes`*:: +*`http.request.body.content`*:: + -- +The full HTTP request body. + type: keyword +example: Hello world + -- -*`rsa.misc.comp_sbytes`*:: +*`http.request.body.content.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cpu_data`*:: +*`http.request.bytes`*:: + -- -type: keyword +Total size in bytes of the request (body and headers). + +type: long + +example: 1437 + +format: bytes -- -*`rsa.misc.criticality`*:: +*`http.request.method`*:: + -- +HTTP request method. +Prior to ECS 1.6.0 the following guidance was provided: +"The field value must be normalized to lowercase for querying." +As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 + type: keyword +example: GET, POST, PUT, PoST + -- -*`rsa.misc.cs_agency_dst`*:: +*`http.request.referrer`*:: + -- +Referrer for this HTTP request. + type: keyword +example: https://blog.example.com/ + -- -*`rsa.misc.cs_analyzedby`*:: +*`http.response.body.bytes`*:: + -- -type: keyword +Size in bytes of the response body. + +type: long + +example: 887 + +format: bytes -- -*`rsa.misc.cs_av_other`*:: +*`http.response.body.content`*:: + -- +The full HTTP response body. + type: keyword +example: Hello world + -- -*`rsa.misc.cs_av_primary`*:: +*`http.response.body.content.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.cs_av_secondary`*:: +*`http.response.bytes`*:: + -- -type: keyword +Total size in bytes of the response (body and headers). + +type: long + +example: 1437 + +format: bytes -- -*`rsa.misc.cs_bgpv6nxthop`*:: +*`http.response.status_code`*:: + -- -type: keyword +HTTP response status code. + +type: long + +example: 404 + +format: string -- -*`rsa.misc.cs_bit9status`*:: +*`http.version`*:: + -- +HTTP version. + type: keyword +example: 1.1 + -- -*`rsa.misc.cs_context`*:: +[float] +=== interface + +The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated. + + +*`interface.alias`*:: + -- +Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. + type: keyword +example: outside + -- -*`rsa.misc.cs_control`*:: +*`interface.id`*:: + -- +Interface ID as reported by an observer (typically SNMP interface ID). + type: keyword +example: 10 + -- -*`rsa.misc.cs_data`*:: +*`interface.name`*:: + -- +Interface name as reported by the system. + type: keyword +example: eth0 + -- -*`rsa.misc.cs_datecret`*:: +[float] +=== log + +Details about the event's logging mechanism or logging transport. +The log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`. +The details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields. + + +*`log.file.path`*:: + -- +Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. +If the event wasn't read from a log file, do not populate this field. + type: keyword +example: /var/log/fun-times.log + -- -*`rsa.misc.cs_dst_tld`*:: +*`log.level`*:: + -- +Original log level of the log event. +If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). +Some examples are `warn`, `err`, `i`, `informational`. + type: keyword +example: error + -- -*`rsa.misc.cs_eth_dst_ven`*:: +*`log.logger`*:: + -- +The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. + type: keyword +example: org.elasticsearch.bootstrap.Bootstrap + -- -*`rsa.misc.cs_eth_src_ven`*:: +*`log.origin.file.line`*:: + -- -type: keyword +The line number of the file containing the source code which originated the log event. + +type: integer + +example: 42 -- -*`rsa.misc.cs_event_uuid`*:: +*`log.origin.file.name`*:: + -- +The name of the file containing the source code which originated the log event. +Note that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`. + type: keyword +example: Bootstrap.java + -- -*`rsa.misc.cs_filetype`*:: +*`log.origin.function`*:: + -- +The name of the function or method which originated the log event. + type: keyword +example: init + -- -*`rsa.misc.cs_fld`*:: +*`log.original`*:: + -- +This is the original log message and contains the full log message before splitting it up in multiple parts. +In contrast to the `message` field which can contain an extracted part of the log message, this field contains the original, full log message. It can have already some modifications applied like encoding or new lines removed to clean up the log message. +This field is not indexed and doc_values are disabled so it can't be queried but the value can be retrieved from `_source`. + type: keyword +example: Sep 19 08:26:10 localhost My log + +Field is not indexed. + -- -*`rsa.misc.cs_if_desc`*:: +*`log.syslog`*:: + -- -type: keyword +The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. + +type: object -- -*`rsa.misc.cs_if_name`*:: +*`log.syslog.facility.code`*:: + -- -type: keyword +The Syslog numeric facility of the log event, if available. +According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. + +type: long + +example: 23 + +format: string -- -*`rsa.misc.cs_ip_next_hop`*:: +*`log.syslog.facility.name`*:: + -- +The Syslog text-based facility of the log event, if available. + type: keyword +example: local7 + -- -*`rsa.misc.cs_ipv4dstpre`*:: +*`log.syslog.priority`*:: + -- -type: keyword +Syslog numeric priority of the event, if available. +According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. + +type: long + +example: 135 + +format: string -- -*`rsa.misc.cs_ipv4srcpre`*:: +*`log.syslog.severity.code`*:: + -- -type: keyword +The Syslog numeric severity of the log event, if available. +If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. + +type: long + +example: 3 -- -*`rsa.misc.cs_lifetime`*:: +*`log.syslog.severity.name`*:: + -- +The Syslog numeric severity of the log event, if available. +If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. + type: keyword +example: Error + -- -*`rsa.misc.cs_log_medium`*:: +[float] +=== network + +The network is defined as the communication path over which a host or network event happens. +The network.* fields should be populated with details about the network activity associated with an event. + + +*`network.application`*:: + -- +A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format. +The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". + type: keyword +example: aim + -- -*`rsa.misc.cs_loginname`*:: +*`network.bytes`*:: + -- -type: keyword +Total bytes transferred in both directions. +If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. + +type: long + +example: 368 + +format: bytes -- -*`rsa.misc.cs_modulescore`*:: +*`network.community_id`*:: + -- +A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. +Learn more at https://github.com/corelight/community-id-spec. + type: keyword +example: 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= + -- -*`rsa.misc.cs_modulesign`*:: +*`network.direction`*:: + -- +Direction of the network traffic. +Recommended values are: + * inbound + * outbound + * internal + * external + * unknown + +When mapping events from a host-based monitoring context, populate this field from the host's point of view. +When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter. + type: keyword +example: inbound + -- -*`rsa.misc.cs_opswatresult`*:: +*`network.forwarded_ip`*:: + -- -type: keyword +Host IP address when the source IP address is the proxy. + +type: ip + +example: 192.1.1.2 -- -*`rsa.misc.cs_payload`*:: +*`network.iana_number`*:: + -- +IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. + type: keyword +example: 6 + -- -*`rsa.misc.cs_registrant`*:: +*`network.inner`*:: + -- -type: keyword +Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) + +type: object -- -*`rsa.misc.cs_registrar`*:: +*`network.inner.vlan.id`*:: + -- +VLAN ID as reported by the observer. + type: keyword +example: 10 + -- -*`rsa.misc.cs_represult`*:: +*`network.inner.vlan.name`*:: + -- +Optional VLAN name as reported by the observer. + type: keyword +example: outside + -- -*`rsa.misc.cs_rpayload`*:: +*`network.name`*:: + -- +Name given by operators to sections of their network. + type: keyword +example: Guest Wifi + -- -*`rsa.misc.cs_sampler_name`*:: +*`network.packets`*:: + -- -type: keyword +Total packets transferred in both directions. +If `source.packets` and `destination.packets` are known, `network.packets` is their sum. + +type: long + +example: 24 -- -*`rsa.misc.cs_sourcemodule`*:: +*`network.protocol`*:: + -- +L7 Network protocol name. ex. http, lumberjack, transport protocol. +The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". + type: keyword +example: http + -- -*`rsa.misc.cs_streams`*:: +*`network.transport`*:: + -- +Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) +The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". + type: keyword +example: tcp + -- -*`rsa.misc.cs_targetmodule`*:: +*`network.type`*:: + -- +In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc +The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". + type: keyword +example: ipv4 + -- -*`rsa.misc.cs_v6nxthop`*:: +*`network.vlan.id`*:: + -- +VLAN ID as reported by the observer. + type: keyword +example: 10 + -- -*`rsa.misc.cs_whois_server`*:: +*`network.vlan.name`*:: + -- +Optional VLAN name as reported by the observer. + type: keyword +example: outside + -- -*`rsa.misc.cs_yararesult`*:: +[float] +=== observer + +An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics. +This could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS. + + +*`observer.egress`*:: + -- -type: keyword +Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. + +type: object -- -*`rsa.misc.description`*:: +*`observer.egress.interface.alias`*:: + -- +Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. + type: keyword +example: outside + -- -*`rsa.misc.devvendor`*:: +*`observer.egress.interface.id`*:: + -- +Interface ID as reported by an observer (typically SNMP interface ID). + type: keyword +example: 10 + -- -*`rsa.misc.distance`*:: +*`observer.egress.interface.name`*:: + -- +Interface name as reported by the system. + type: keyword +example: eth0 + -- -*`rsa.misc.dstburb`*:: +*`observer.egress.vlan.id`*:: + -- +VLAN ID as reported by the observer. + type: keyword +example: 10 + -- -*`rsa.misc.edomain`*:: +*`observer.egress.vlan.name`*:: + -- +Optional VLAN name as reported by the observer. + type: keyword +example: outside + -- -*`rsa.misc.edomaub`*:: +*`observer.egress.zone`*:: + -- +Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. + type: keyword +example: Public_Internet + -- -*`rsa.misc.euid`*:: +*`observer.geo.city_name`*:: + -- +City name. + type: keyword +example: Montreal + -- -*`rsa.misc.facility`*:: +*`observer.geo.continent_name`*:: + -- +Name of the continent. + type: keyword +example: North America + -- -*`rsa.misc.finterface`*:: +*`observer.geo.country_iso_code`*:: + -- +Country ISO code. + type: keyword +example: CA + -- -*`rsa.misc.flags`*:: +*`observer.geo.country_name`*:: + -- +Country name. + type: keyword +example: Canada + -- -*`rsa.misc.gaddr`*:: +*`observer.geo.location`*:: + -- -type: keyword +Longitude and latitude. + +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.misc.id3`*:: +*`observer.geo.name`*:: + -- +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. + type: keyword +example: boston-dc + -- -*`rsa.misc.im_buddyname`*:: +*`observer.geo.region_iso_code`*:: + -- +Region ISO code. + type: keyword +example: CA-QC + -- -*`rsa.misc.im_croomid`*:: +*`observer.geo.region_name`*:: + -- +Region name. + type: keyword +example: Quebec + -- -*`rsa.misc.im_croomtype`*:: +*`observer.hostname`*:: + -- +Hostname of the observer. + type: keyword -- -*`rsa.misc.im_members`*:: +*`observer.ingress`*:: + -- -type: keyword +Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. + +type: object -- -*`rsa.misc.im_username`*:: +*`observer.ingress.interface.alias`*:: + -- +Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. + type: keyword +example: outside + -- -*`rsa.misc.ipkt`*:: +*`observer.ingress.interface.id`*:: + -- +Interface ID as reported by an observer (typically SNMP interface ID). + type: keyword +example: 10 + -- -*`rsa.misc.ipscat`*:: +*`observer.ingress.interface.name`*:: + -- +Interface name as reported by the system. + type: keyword +example: eth0 + -- -*`rsa.misc.ipspri`*:: +*`observer.ingress.vlan.id`*:: + -- +VLAN ID as reported by the observer. + type: keyword +example: 10 + -- -*`rsa.misc.latitude`*:: +*`observer.ingress.vlan.name`*:: + -- +Optional VLAN name as reported by the observer. + type: keyword +example: outside + -- -*`rsa.misc.linenum`*:: +*`observer.ingress.zone`*:: + -- +Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. + type: keyword +example: DMZ + -- -*`rsa.misc.list_name`*:: +*`observer.ip`*:: + -- -type: keyword +IP addresses of the observer. + +type: ip -- -*`rsa.misc.load_data`*:: +*`observer.mac`*:: + -- +MAC addresses of the observer + type: keyword -- -*`rsa.misc.location_floor`*:: +*`observer.name`*:: + -- +Custom name of the observer. +This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. +If no custom name is needed, the field can be left empty. + type: keyword +example: 1_proxySG + -- -*`rsa.misc.location_mark`*:: +*`observer.os.family`*:: + -- +OS family (such as redhat, debian, freebsd, windows). + type: keyword +example: debian + -- -*`rsa.misc.log_id`*:: +*`observer.os.full`*:: + -- +Operating system name, including the version or code name. + type: keyword +example: Mac OS Mojave + -- -*`rsa.misc.log_type`*:: +*`observer.os.full.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.logid`*:: +*`observer.os.kernel`*:: + -- +Operating system kernel version as a raw string. + type: keyword +example: 4.4.0-112-generic + -- -*`rsa.misc.logip`*:: +*`observer.os.name`*:: + -- +Operating system name, without the version. + type: keyword +example: Mac OS X + -- -*`rsa.misc.logname`*:: +*`observer.os.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.longitude`*:: +*`observer.os.platform`*:: + -- +Operating system platform (such centos, ubuntu, windows). + type: keyword +example: darwin + -- -*`rsa.misc.lport`*:: +*`observer.os.version`*:: + -- +Operating system version as a raw string. + type: keyword +example: 10.14.1 + -- -*`rsa.misc.mbug_data`*:: +*`observer.product`*:: + -- +The product name of the observer. + type: keyword +example: s200 + -- -*`rsa.misc.misc_name`*:: +*`observer.serial_number`*:: + -- +Observer serial number. + type: keyword -- -*`rsa.misc.msg_type`*:: +*`observer.type`*:: + -- +The type of the observer the data is coming from. +There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. + type: keyword +example: firewall + -- -*`rsa.misc.msgid`*:: +*`observer.vendor`*:: + -- +Vendor name of the observer. + type: keyword +example: Symantec + -- -*`rsa.misc.netsessid`*:: +*`observer.version`*:: + -- +Observer version. + type: keyword -- -*`rsa.misc.num`*:: +[float] +=== organization + +The organization fields enrich data with information about the company or entity the data is associated with. +These fields help you arrange or filter data stored in an index by one or multiple organizations. + + +*`organization.id`*:: + -- +Unique identifier for the organization. + type: keyword -- -*`rsa.misc.number1`*:: +*`organization.name`*:: + -- +Organization name. + type: keyword -- -*`rsa.misc.number2`*:: +*`organization.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.nwwn`*:: +[float] +=== os + +The OS fields contain information about the operating system. + + +*`os.family`*:: + -- +OS family (such as redhat, debian, freebsd, windows). + type: keyword +example: debian + -- -*`rsa.misc.object`*:: +*`os.full`*:: + -- +Operating system name, including the version or code name. + type: keyword +example: Mac OS Mojave + -- -*`rsa.misc.operation`*:: +*`os.full.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.opkt`*:: +*`os.kernel`*:: + -- +Operating system kernel version as a raw string. + type: keyword +example: 4.4.0-112-generic + -- -*`rsa.misc.orig_from`*:: +*`os.name`*:: + -- +Operating system name, without the version. + type: keyword +example: Mac OS X + -- -*`rsa.misc.owner_id`*:: +*`os.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.p_action`*:: +*`os.platform`*:: + -- +Operating system platform (such centos, ubuntu, windows). + type: keyword +example: darwin + -- -*`rsa.misc.p_filter`*:: +*`os.version`*:: + -- +Operating system version as a raw string. + type: keyword +example: 10.14.1 + -- -*`rsa.misc.p_group_object`*:: +[float] +=== package + +These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location. + + +*`package.architecture`*:: + -- +Package architecture. + type: keyword +example: x86_64 + -- -*`rsa.misc.p_id`*:: +*`package.build_version`*:: + -- +Additional information about the build version of the installed package. +For example use the commit SHA of a non-released package. + type: keyword +example: 36f4f7e89dd61b0988b12ee000b98966867710cd + -- -*`rsa.misc.p_msgid1`*:: +*`package.checksum`*:: + -- +Checksum of the installed package for verification. + type: keyword +example: 68b329da9893e34099c7d8ad5cb9c940 + -- -*`rsa.misc.p_msgid2`*:: +*`package.description`*:: + -- +Description of the package. + type: keyword +example: Open source programming language to build simple/reliable/efficient software. + -- -*`rsa.misc.p_result1`*:: +*`package.install_scope`*:: + -- +Indicating how the package was installed, e.g. user-local, global. + type: keyword +example: global + -- -*`rsa.misc.password_chg`*:: +*`package.installed`*:: + -- -type: keyword +Time when package was installed. + +type: date -- -*`rsa.misc.password_expire`*:: +*`package.license`*:: + -- +License under which the package was released. +Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). + type: keyword +example: Apache License 2.0 + -- -*`rsa.misc.permgranted`*:: +*`package.name`*:: + -- +Package name + type: keyword +example: go + -- -*`rsa.misc.permwanted`*:: +*`package.path`*:: + -- +Path where the package is installed. + type: keyword +example: /usr/local/Cellar/go/1.12.9/ + -- -*`rsa.misc.pgid`*:: +*`package.reference`*:: + -- +Home page or reference URL of the software in this package, if available. + type: keyword +example: https://golang.org + -- -*`rsa.misc.policyUUID`*:: +*`package.size`*:: + -- -type: keyword +Package size in bytes. + +type: long + +example: 62231 + +format: string -- -*`rsa.misc.prog_asp_num`*:: +*`package.type`*:: + -- +Type of package. +This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. + type: keyword +example: rpm + -- -*`rsa.misc.program`*:: +*`package.version`*:: + -- +Package version + type: keyword +example: 1.12.9 + -- -*`rsa.misc.real_data`*:: +[float] +=== pe + +These fields contain Windows Portable Executable (PE) metadata. + + +*`pe.architecture`*:: + -- +CPU architecture target for the file. + type: keyword +example: x64 + -- -*`rsa.misc.rec_asp_device`*:: +*`pe.company`*:: + -- +Internal company name of the file, provided at compile-time. + type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.rec_asp_num`*:: +*`pe.description`*:: + -- +Internal description of the file, provided at compile-time. + type: keyword +example: Paint + -- -*`rsa.misc.rec_library`*:: +*`pe.file_version`*:: + -- +Internal version of the file, provided at compile-time. + type: keyword +example: 6.3.9600.17415 + -- -*`rsa.misc.recordnum`*:: +*`pe.imphash`*:: + -- +A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. +Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + type: keyword +example: 0c6803c4e922103c4dca5963aad36ddf + -- -*`rsa.misc.ruid`*:: +*`pe.original_file_name`*:: + -- +Internal name of the file, provided at compile-time. + type: keyword +example: MSPAINT.EXE + -- -*`rsa.misc.sburb`*:: +*`pe.product`*:: + -- +Internal product name of the file, provided at compile-time. + type: keyword +example: Microsoft® Windows® Operating System + -- -*`rsa.misc.sdomain_fld`*:: +[float] +=== process + +These fields contain information about a process. +These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. + + +*`process.args`*:: + -- +Array of process arguments, starting with the absolute path to the executable. +May be filtered to protect sensitive information. + type: keyword +example: ['/usr/bin/ssh', '-l', 'user', '10.0.0.16'] + -- -*`rsa.misc.sec`*:: +*`process.args_count`*:: + -- -type: keyword +Length of the process.args array. +This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + +type: long + +example: 4 -- -*`rsa.misc.sensorname`*:: +*`process.code_signature.exists`*:: + -- -type: keyword +Boolean to capture if a signature is present. + +type: boolean + +example: true -- -*`rsa.misc.seqnum`*:: +*`process.code_signature.status`*:: + -- +Additional information about the certificate status. +This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + type: keyword +example: ERROR_UNTRUSTED_ROOT + -- -*`rsa.misc.session`*:: +*`process.code_signature.subject_name`*:: + -- +Subject name of the code signer + type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.sessiontype`*:: +*`process.code_signature.trusted`*:: + -- -type: keyword +Stores the trust status of the certificate chain. +Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + +type: boolean + +example: true -- -*`rsa.misc.sigUUID`*:: +*`process.code_signature.valid`*:: + -- -type: keyword +Boolean to capture if the digital signature is verified against the binary content. +Leave unpopulated if a certificate was unchecked. + +type: boolean + +example: true -- -*`rsa.misc.spi`*:: +*`process.command_line`*:: + -- +Full command line that started the process, including the absolute path to the executable, and all arguments. +Some arguments may be filtered to protect sensitive information. + type: keyword +example: /usr/bin/ssh -l user 10.0.0.16 + -- -*`rsa.misc.srcburb`*:: +*`process.command_line.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.srcdom`*:: +*`process.entity_id`*:: + -- +Unique identifier for the process. +The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. +Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + type: keyword +example: c2c455d9f99375d + -- -*`rsa.misc.srcservice`*:: +*`process.executable`*:: + -- +Absolute path to the process executable. + type: keyword +example: /usr/bin/ssh + -- -*`rsa.misc.state`*:: +*`process.executable.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.status1`*:: +*`process.exit_code`*:: + -- -type: keyword +The exit code of the process, if this is a termination event. +The field should be absent if there is no exit code for the event (e.g. process start). + +type: long + +example: 137 -- -*`rsa.misc.svcno`*:: +*`process.hash.md5`*:: + -- +MD5 hash. + type: keyword -- -*`rsa.misc.system`*:: +*`process.hash.sha1`*:: + -- +SHA1 hash. + type: keyword -- -*`rsa.misc.tbdstr1`*:: +*`process.hash.sha256`*:: + -- +SHA256 hash. + type: keyword -- -*`rsa.misc.tgtdom`*:: +*`process.hash.sha512`*:: + -- +SHA512 hash. + type: keyword -- -*`rsa.misc.tgtdomain`*:: +*`process.name`*:: + -- +Process name. +Sometimes called program name or similar. + type: keyword +example: ssh + -- -*`rsa.misc.threshold`*:: +*`process.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.type1`*:: +*`process.parent.args`*:: + -- +Array of process arguments, starting with the absolute path to the executable. +May be filtered to protect sensitive information. + type: keyword +example: ['/usr/bin/ssh', '-l', 'user', '10.0.0.16'] + -- -*`rsa.misc.udb_class`*:: +*`process.parent.args_count`*:: + -- -type: keyword +Length of the process.args array. +This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + +type: long + +example: 4 -- -*`rsa.misc.url_fld`*:: +*`process.parent.code_signature.exists`*:: + -- -type: keyword +Boolean to capture if a signature is present. + +type: boolean + +example: true -- -*`rsa.misc.user_div`*:: +*`process.parent.code_signature.status`*:: + -- +Additional information about the certificate status. +This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + type: keyword +example: ERROR_UNTRUSTED_ROOT + -- -*`rsa.misc.userid`*:: +*`process.parent.code_signature.subject_name`*:: + -- +Subject name of the code signer + type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.username_fld`*:: +*`process.parent.code_signature.trusted`*:: + -- -type: keyword +Stores the trust status of the certificate chain. +Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + +type: boolean + +example: true -- -*`rsa.misc.utcstamp`*:: +*`process.parent.code_signature.valid`*:: + -- -type: keyword +Boolean to capture if the digital signature is verified against the binary content. +Leave unpopulated if a certificate was unchecked. + +type: boolean + +example: true -- -*`rsa.misc.v_instafname`*:: +*`process.parent.command_line`*:: + -- +Full command line that started the process, including the absolute path to the executable, and all arguments. +Some arguments may be filtered to protect sensitive information. + type: keyword +example: /usr/bin/ssh -l user 10.0.0.16 + -- -*`rsa.misc.virt_data`*:: +*`process.parent.command_line.text`*:: + -- -type: keyword +type: text -- -*`rsa.misc.vpnid`*:: +*`process.parent.entity_id`*:: + -- +Unique identifier for the process. +The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. +Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + type: keyword +example: c2c455d9f99375d + -- -*`rsa.misc.autorun_type`*:: +*`process.parent.executable`*:: + -- -This is used to capture Auto Run type +Absolute path to the process executable. type: keyword +example: /usr/bin/ssh + -- -*`rsa.misc.cc_number`*:: +*`process.parent.executable.text`*:: + -- -Valid Credit Card Numbers only - -type: long +type: text -- -*`rsa.misc.content`*:: +*`process.parent.exit_code`*:: + -- -This key captures the content type from protocol headers - -type: keyword - --- - -*`rsa.misc.ein_number`*:: -+ --- -Employee Identification Numbers only +The exit code of the process, if this is a termination event. +The field should be absent if there is no exit code for the event (e.g. process start). type: long --- - -*`rsa.misc.found`*:: -+ --- -This is used to capture the results of regex match - -type: keyword +example: 137 -- -*`rsa.misc.language`*:: +*`process.parent.hash.md5`*:: + -- -This is used to capture list of languages the client support and what it prefers +MD5 hash. type: keyword -- -*`rsa.misc.lifetime`*:: +*`process.parent.hash.sha1`*:: + -- -This key is used to capture the session lifetime in seconds. +SHA1 hash. -type: long +type: keyword -- -*`rsa.misc.link`*:: +*`process.parent.hash.sha256`*:: + -- -This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +SHA256 hash. type: keyword -- -*`rsa.misc.match`*:: +*`process.parent.hash.sha512`*:: + -- -This key is for regex match name from search.ini +SHA512 hash. type: keyword -- -*`rsa.misc.param_dst`*:: +*`process.parent.name`*:: + -- -This key captures the command line/launch argument of the target process or file +Process name. +Sometimes called program name or similar. type: keyword +example: ssh + -- -*`rsa.misc.param_src`*:: +*`process.parent.name.text`*:: + -- -This key captures source parameter - -type: keyword +type: text -- -*`rsa.misc.search_text`*:: +*`process.parent.pe.architecture`*:: + -- -This key captures the Search Text used +CPU architecture target for the file. type: keyword +example: x64 + -- -*`rsa.misc.sig_name`*:: +*`process.parent.pe.company`*:: + -- -This key is used to capture the Signature Name only. +Internal company name of the file, provided at compile-time. type: keyword +example: Microsoft Corporation + -- -*`rsa.misc.snmp_value`*:: +*`process.parent.pe.description`*:: + -- -SNMP set request value +Internal description of the file, provided at compile-time. type: keyword --- - -*`rsa.misc.streams`*:: -+ --- -This key captures number of streams in session - -type: long +example: Paint -- - -*`rsa.db.index`*:: +*`process.parent.pe.file_version`*:: + -- -This key captures IndexID of the index. +Internal version of the file, provided at compile-time. type: keyword +example: 6.3.9600.17415 + -- -*`rsa.db.instance`*:: +*`process.parent.pe.imphash`*:: + -- -This key is used to capture the database server instance name +A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. +Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. type: keyword +example: 0c6803c4e922103c4dca5963aad36ddf + -- -*`rsa.db.database`*:: +*`process.parent.pe.original_file_name`*:: + -- -This key is used to capture the name of a database or an instance as seen in a session +Internal name of the file, provided at compile-time. type: keyword +example: MSPAINT.EXE + -- -*`rsa.db.transact_id`*:: +*`process.parent.pe.product`*:: + -- -This key captures the SQL transantion ID of the current session +Internal product name of the file, provided at compile-time. type: keyword +example: Microsoft® Windows® Operating System + -- -*`rsa.db.permissions`*:: +*`process.parent.pgid`*:: + -- -This key captures permission or privilege level assigned to a resource. +Identifier of the group of processes the process belongs to. -type: keyword +type: long + +format: string -- -*`rsa.db.table_name`*:: +*`process.parent.pid`*:: + -- -This key is used to capture the table name - -type: keyword +Process id. --- +type: long -*`rsa.db.db_id`*:: -+ --- -This key is used to capture the unique identifier for a database +example: 4242 -type: keyword +format: string -- -*`rsa.db.db_pid`*:: +*`process.parent.ppid`*:: + -- -This key captures the process id of a connection with database server +Parent process' pid. type: long --- - -*`rsa.db.lread`*:: -+ --- -This key is used for the number of logical reads +example: 4241 -type: long +format: string -- -*`rsa.db.lwrite`*:: +*`process.parent.start`*:: + -- -This key is used for the number of logical writes +The time the process started. -type: long +type: date + +example: 2016-05-23T08:05:34.853Z -- -*`rsa.db.pread`*:: +*`process.parent.thread.id`*:: + -- -This key is used for the number of physical writes +Thread ID. type: long --- +example: 4242 +format: string -*`rsa.network.alias_host`*:: +-- + +*`process.parent.thread.name`*:: + -- -This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. +Thread name. type: keyword +example: thread-0 + -- -*`rsa.network.domain`*:: +*`process.parent.title`*:: + -- +Process title. +The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. + type: keyword -- -*`rsa.network.host_dst`*:: +*`process.parent.title.text`*:: + -- -This key should only be used when it’s a Destination Hostname - -type: keyword +type: text -- -*`rsa.network.network_service`*:: +*`process.parent.uptime`*:: + -- -This is used to capture layer 7 protocols/service names +Seconds the process has been up. -type: keyword +type: long + +example: 1325 -- -*`rsa.network.interface`*:: +*`process.parent.working_directory`*:: + -- -This key should be used when the source or destination context of an interface is not clear +The working directory of the process. type: keyword +example: /home/alice + -- -*`rsa.network.network_port`*:: +*`process.parent.working_directory.text`*:: + -- -Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) - -type: long +type: text -- -*`rsa.network.eth_host`*:: +*`process.pe.architecture`*:: + -- -Deprecated, use alias.mac +CPU architecture target for the file. type: keyword +example: x64 + -- -*`rsa.network.sinterface`*:: +*`process.pe.company`*:: + -- -This key should only be used when it’s a Source Interface +Internal company name of the file, provided at compile-time. type: keyword +example: Microsoft Corporation + -- -*`rsa.network.dinterface`*:: +*`process.pe.description`*:: + -- -This key should only be used when it’s a Destination Interface +Internal description of the file, provided at compile-time. type: keyword --- - -*`rsa.network.vlan`*:: -+ --- -This key should only be used to capture the ID of the Virtual LAN - -type: long +example: Paint -- -*`rsa.network.zone_src`*:: +*`process.pe.file_version`*:: + -- -This key should only be used when it’s a Source Zone. +Internal version of the file, provided at compile-time. type: keyword +example: 6.3.9600.17415 + -- -*`rsa.network.zone`*:: +*`process.pe.imphash`*:: + -- -This key should be used when the source or destination context of a Zone is not clear +A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. +Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. type: keyword +example: 0c6803c4e922103c4dca5963aad36ddf + -- -*`rsa.network.zone_dst`*:: +*`process.pe.original_file_name`*:: + -- -This key should only be used when it’s a Destination Zone. +Internal name of the file, provided at compile-time. type: keyword +example: MSPAINT.EXE + -- -*`rsa.network.gateway`*:: +*`process.pe.product`*:: + -- -This key is used to capture the IP Address of the gateway +Internal product name of the file, provided at compile-time. type: keyword +example: Microsoft® Windows® Operating System + -- -*`rsa.network.icmp_type`*:: +*`process.pgid`*:: + -- -This key is used to capture the ICMP type only +Identifier of the group of processes the process belongs to. type: long +format: string + -- -*`rsa.network.mask`*:: +*`process.pid`*:: + -- -This key is used to capture the device network IPmask. +Process id. -type: keyword +type: long + +example: 4242 + +format: string -- -*`rsa.network.icmp_code`*:: +*`process.ppid`*:: + -- -This key is used to capture the ICMP code only +Parent process' pid. type: long --- - -*`rsa.network.protocol_detail`*:: -+ --- -This key should be used to capture additional protocol information +example: 4241 -type: keyword +format: string -- -*`rsa.network.dmask`*:: +*`process.start`*:: + -- -This key is used for Destionation Device network mask +The time the process started. -type: keyword +type: date + +example: 2016-05-23T08:05:34.853Z -- -*`rsa.network.port`*:: +*`process.thread.id`*:: + -- -This key should only be used to capture a Network Port when the directionality is not clear +Thread ID. type: long +example: 4242 + +format: string + -- -*`rsa.network.smask`*:: +*`process.thread.name`*:: + -- -This key is used for capturing source Network Mask +Thread name. type: keyword +example: thread-0 + -- -*`rsa.network.netname`*:: +*`process.title`*:: + -- -This key is used to capture the network name associated with an IP range. This is configured by the end user. +Process title. +The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. type: keyword -- -*`rsa.network.paddr`*:: +*`process.title.text`*:: + -- -Deprecated - -type: ip +type: text -- -*`rsa.network.faddr`*:: +*`process.uptime`*:: + -- -type: keyword +Seconds the process has been up. --- +type: long -*`rsa.network.lhost`*:: -+ --- -type: keyword +example: 1325 -- -*`rsa.network.origin`*:: +*`process.working_directory`*:: + -- +The working directory of the process. + type: keyword +example: /home/alice + -- -*`rsa.network.remote_domain_id`*:: +*`process.working_directory.text`*:: + -- -type: keyword +type: text -- -*`rsa.network.addr`*:: -+ --- -type: keyword +[float] +=== registry --- +Fields related to Windows Registry operations. -*`rsa.network.dns_a_record`*:: + +*`registry.data.bytes`*:: + -- +Original bytes written with base64 encoding. +For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. + type: keyword +example: ZQBuAC0AVQBTAAAAZQBuAAAAAAA= + -- -*`rsa.network.dns_ptr_record`*:: +*`registry.data.strings`*:: + -- +Content when writing string types. +Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). + type: keyword +example: ["C:\rta\red_ttp\bin\myapp.exe"] + -- -*`rsa.network.fhost`*:: +*`registry.data.type`*:: + -- +Standard registry type for encoding contents + type: keyword +example: REG_SZ + -- -*`rsa.network.fport`*:: +*`registry.hive`*:: + -- +Abbreviated name for the hive. + type: keyword +example: HKLM + -- -*`rsa.network.laddr`*:: +*`registry.key`*:: + -- +Hive-relative path of keys. + type: keyword +example: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe + -- -*`rsa.network.linterface`*:: +*`registry.path`*:: + -- +Full path, including hive, key and value + type: keyword +example: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger + -- -*`rsa.network.phost`*:: +*`registry.value`*:: + -- +Name of the value written. + type: keyword +example: Debugger + -- -*`rsa.network.ad_computer_dst`*:: +[float] +=== related + +This field set is meant to facilitate pivoting around a piece of data. +Some pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`. +A concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`. + + +*`related.hash`*:: + -- -Deprecated, use host.dst +All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). type: keyword -- -*`rsa.network.eth_type`*:: +*`related.hosts`*:: + -- -This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only +All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. -type: long +type: keyword -- -*`rsa.network.ip_proto`*:: +*`related.ip`*:: + -- -This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI +All of the IPs seen on your event. -type: long +type: ip -- -*`rsa.network.dns_cname_record`*:: +*`related.user`*:: + -- +All the user names seen on your event. + type: keyword -- -*`rsa.network.dns_id`*:: +[float] +=== rule + +Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events. +Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc. + + +*`rule.author`*:: + -- +Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. + type: keyword +example: ['Star-Lord'] + -- -*`rsa.network.dns_opcode`*:: +*`rule.category`*:: + -- +A categorization value keyword used by the entity using the rule for detection of this event. + type: keyword +example: Attempted Information Leak + -- -*`rsa.network.dns_resp`*:: +*`rule.description`*:: + -- +The description of the rule generating the event. + type: keyword +example: Block requests to public DNS over HTTPS / TLS protocols + -- -*`rsa.network.dns_type`*:: +*`rule.id`*:: + -- +A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. + type: keyword +example: 101 + -- -*`rsa.network.domain1`*:: +*`rule.license`*:: + -- +Name of the license under which the rule used to generate this event is made available. + type: keyword +example: Apache 2.0 + -- -*`rsa.network.host_type`*:: +*`rule.name`*:: + -- +The name of the rule or signature generating the event. + type: keyword +example: BLOCK_DNS_over_TLS + -- -*`rsa.network.packet_length`*:: +*`rule.reference`*:: + -- +Reference URL to additional information about the rule used to generate this event. +The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. + type: keyword +example: https://en.wikipedia.org/wiki/DNS_over_TLS + -- -*`rsa.network.host_orig`*:: +*`rule.ruleset`*:: + -- -This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. +Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. type: keyword +example: Standard_Protocol_Filters + -- -*`rsa.network.rpayload`*:: +*`rule.uuid`*:: + -- -This key is used to capture the total number of payload bytes seen in the retransmitted packets. +A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. type: keyword +example: 1100110011 + -- -*`rsa.network.vlan_name`*:: +*`rule.version`*:: + -- -This key should only be used to capture the name of the Virtual LAN +The version / revision of the rule being used for analysis. type: keyword +example: 1.1 + -- +[float] +=== server -*`rsa.investigations.ec_activity`*:: +A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records. +For TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events. +Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. + + +*`server.address`*:: + -- -This key captures the particular event activity(Ex:Logoff) +Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. +Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. type: keyword -- -*`rsa.investigations.ec_theme`*:: +*`server.as.number`*:: + -- -This key captures the Theme of a particular Event(Ex:Authentication) +Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. -type: keyword +type: long + +example: 15169 -- -*`rsa.investigations.ec_subject`*:: +*`server.as.organization.name`*:: + -- -This key captures the Subject of a particular Event(Ex:User) +Organization name. type: keyword +example: Google LLC + -- -*`rsa.investigations.ec_outcome`*:: +*`server.as.organization.name.text`*:: + -- -This key captures the outcome of a particular Event(Ex:Success) - -type: keyword +type: text -- -*`rsa.investigations.event_cat`*:: +*`server.bytes`*:: + -- -This key captures the Event category number +Bytes sent from the server to the client. type: long +example: 184 + +format: bytes + -- -*`rsa.investigations.event_cat_name`*:: +*`server.domain`*:: + -- -This key captures the event category name corresponding to the event cat code +Server domain. type: keyword -- -*`rsa.investigations.event_vcat`*:: +*`server.geo.city_name`*:: + -- -This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. +City name. type: keyword +example: Montreal + -- -*`rsa.investigations.analysis_file`*:: +*`server.geo.continent_name`*:: + -- -This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file +Name of the continent. type: keyword +example: North America + -- -*`rsa.investigations.analysis_service`*:: +*`server.geo.country_iso_code`*:: + -- -This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service +Country ISO code. type: keyword +example: CA + -- -*`rsa.investigations.analysis_session`*:: +*`server.geo.country_name`*:: + -- -This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session +Country name. type: keyword +example: Canada + -- -*`rsa.investigations.boc`*:: +*`server.geo.location`*:: + -- -This is used to capture behaviour of compromise +Longitude and latitude. -type: keyword +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.investigations.eoc`*:: +*`server.geo.name`*:: + -- -This is used to capture Enablers of Compromise +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. type: keyword +example: boston-dc + -- -*`rsa.investigations.inv_category`*:: +*`server.geo.region_iso_code`*:: + -- -This used to capture investigation category +Region ISO code. type: keyword +example: CA-QC + -- -*`rsa.investigations.inv_context`*:: +*`server.geo.region_name`*:: + -- -This used to capture investigation context +Region name. type: keyword +example: Quebec + -- -*`rsa.investigations.ioc`*:: +*`server.ip`*:: + -- -This is key capture indicator of compromise +IP address of the server (IPv4 or IPv6). -type: keyword +type: ip -- - -*`rsa.counters.dclass_c1`*:: +*`server.mac`*:: + -- -This is a generic counter key that should be used with the label dclass.c1.str only +MAC address of the server. -type: long +type: keyword -- -*`rsa.counters.dclass_c2`*:: +*`server.nat.ip`*:: + -- -This is a generic counter key that should be used with the label dclass.c2.str only +Translated ip of destination based NAT sessions (e.g. internet to private DMZ) +Typically used with load balancers, firewalls, or routers. -type: long +type: ip -- -*`rsa.counters.event_counter`*:: +*`server.nat.port`*:: + -- -This is used to capture the number of times an event repeated +Translated port of destination based NAT sessions (e.g. internet to private DMZ) +Typically used with load balancers, firewalls, or routers. type: long +format: string + -- -*`rsa.counters.dclass_r1`*:: +*`server.packets`*:: + -- -This is a generic ratio key that should be used with the label dclass.r1.str only +Packets sent from the server to the client. -type: keyword +type: long + +example: 12 -- -*`rsa.counters.dclass_c3`*:: +*`server.port`*:: + -- -This is a generic counter key that should be used with the label dclass.c3.str only +Port of the server. type: long +format: string + -- -*`rsa.counters.dclass_c1_str`*:: +*`server.registered_domain`*:: + -- -This is a generic counter string key that should be used with the label dclass.c1 only +The highest registered server domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". type: keyword +example: example.com + -- -*`rsa.counters.dclass_c2_str`*:: +*`server.top_level_domain`*:: + -- -This is a generic counter string key that should be used with the label dclass.c2 only +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". type: keyword +example: co.uk + -- -*`rsa.counters.dclass_r1_str`*:: +*`server.user.domain`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r1 only +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.counters.dclass_r2`*:: +*`server.user.email`*:: + -- -This is a generic ratio key that should be used with the label dclass.r2.str only +User email address. type: keyword -- -*`rsa.counters.dclass_c3_str`*:: +*`server.user.full_name`*:: + -- -This is a generic counter string key that should be used with the label dclass.c3 only +User's full name, if available. type: keyword +example: Albert Einstein + -- -*`rsa.counters.dclass_r3`*:: +*`server.user.full_name.text`*:: + -- -This is a generic ratio key that should be used with the label dclass.r3.str only - -type: keyword +type: text -- -*`rsa.counters.dclass_r2_str`*:: +*`server.user.group.domain`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r2 only +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.counters.dclass_r3_str`*:: +*`server.user.group.id`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r3 only +Unique identifier for the group on the system/platform. type: keyword -- - -*`rsa.identity.auth_method`*:: +*`server.user.group.name`*:: + -- -This key is used to capture authentication methods used only +Name of the group. type: keyword -- -*`rsa.identity.user_role`*:: +*`server.user.hash`*:: + -- -This key is used to capture the Role of a user only +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. type: keyword -- -*`rsa.identity.dn`*:: +*`server.user.id`*:: + -- -X.500 (LDAP) Distinguished Name +Unique identifier of the user. type: keyword -- -*`rsa.identity.logon_type`*:: +*`server.user.name`*:: + -- -This key is used to capture the type of logon method used. +Short name or login of the user. type: keyword +example: albert + -- -*`rsa.identity.profile`*:: +*`server.user.name.text`*:: + -- -This key is used to capture the user profile - -type: keyword +type: text -- -*`rsa.identity.accesses`*:: +*`server.user.roles`*:: + -- -This key is used to capture actual privileges used in accessing an object +Array of user roles at the time of the event. type: keyword +example: ["kibana_admin", "reporting_user"] + -- -*`rsa.identity.realm`*:: +[float] +=== service + +The service fields describe the service for or from which the data was collected. +These fields help you find and correlate logs for a specific service and version. + + +*`service.ephemeral_id`*:: + -- -Radius realm or similar grouping of accounts +Ephemeral identifier of this service (if one exists). +This id normally changes across restarts, but `service.id` does not. type: keyword +example: 8a4f500f + -- -*`rsa.identity.user_sid_dst`*:: +*`service.id`*:: + -- -This key captures Destination User Session ID +Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. +This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. +Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. type: keyword +example: d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6 + -- -*`rsa.identity.dn_src`*:: +*`service.name`*:: + -- -An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn +Name of the service data is collected from. +The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. +In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. type: keyword +example: elasticsearch-metrics + -- -*`rsa.identity.org`*:: +*`service.node.name`*:: + -- -This key captures the User organization +Name of a service node. +This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. +In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. type: keyword +example: instance-0000000016 + -- -*`rsa.identity.dn_dst`*:: +*`service.state`*:: + -- -An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn +Current state of the service. type: keyword -- -*`rsa.identity.firstname`*:: +*`service.type`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +The type of the service data is collected from. +The type can be used to group and correlate logs and metrics from one service type. +Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. type: keyword +example: elasticsearch + -- -*`rsa.identity.lastname`*:: +*`service.version`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +Version of the service the data was collected from. +This allows to look at a data set only for a specific version of a service. type: keyword +example: 3.2.4 + -- -*`rsa.identity.user_dept`*:: +[float] +=== source + +Source fields describe details about the source of a packet/event. +Source fields are usually populated in conjunction with destination fields. + + +*`source.address`*:: + -- -User's Department Names only +Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. +Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. type: keyword -- -*`rsa.identity.user_sid_src`*:: +*`source.as.number`*:: + -- -This key captures Source User Session ID +Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. -type: keyword +type: long + +example: 15169 -- -*`rsa.identity.federated_sp`*:: +*`source.as.organization.name`*:: + -- -This key is the Federated Service Provider. This is the application requesting authentication. +Organization name. type: keyword +example: Google LLC + -- -*`rsa.identity.federated_idp`*:: +*`source.as.organization.name.text`*:: + -- -This key is the federated Identity Provider. This is the server providing the authentication. - -type: keyword +type: text -- -*`rsa.identity.logon_type_desc`*:: +*`source.bytes`*:: + -- -This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. +Bytes sent from the source to the destination. -type: keyword +type: long + +example: 184 + +format: bytes -- -*`rsa.identity.middlename`*:: +*`source.domain`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +Source domain. type: keyword -- -*`rsa.identity.password`*:: +*`source.geo.city_name`*:: + -- -This key is for Passwords seen in any session, plain text or encrypted +City name. type: keyword +example: Montreal + -- -*`rsa.identity.host_role`*:: +*`source.geo.continent_name`*:: + -- -This key should only be used to capture the role of a Host Machine +Name of the continent. type: keyword +example: North America + -- -*`rsa.identity.ldap`*:: +*`source.geo.country_iso_code`*:: + -- -This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context +Country ISO code. type: keyword +example: CA + -- -*`rsa.identity.ldap_query`*:: +*`source.geo.country_name`*:: + -- -This key is the Search criteria from an LDAP search +Country name. type: keyword +example: Canada + -- -*`rsa.identity.ldap_response`*:: +*`source.geo.location`*:: + -- -This key is to capture Results from an LDAP search +Longitude and latitude. -type: keyword +type: geo_point + +example: { "lon": -73.614830, "lat": 45.505918 } -- -*`rsa.identity.owner`*:: +*`source.geo.name`*:: + -- -This is used to capture username the process or service is running as, the author of the task +User-defined description of a location, at the level of granularity they care about. +Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. +Not typically used in automated geolocation. type: keyword +example: boston-dc + -- -*`rsa.identity.service_account`*:: +*`source.geo.region_iso_code`*:: + -- -This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage +Region ISO code. type: keyword --- +example: CA-QC +-- -*`rsa.email.email_dst`*:: +*`source.geo.region_name`*:: + -- -This key is used to capture the Destination email address only, when the destination context is not clear use email +Region name. type: keyword +example: Quebec + -- -*`rsa.email.email_src`*:: +*`source.ip`*:: + -- -This key is used to capture the source email address only, when the source context is not clear use email +IP address of the source (IPv4 or IPv6). -type: keyword +type: ip -- -*`rsa.email.subject`*:: +*`source.mac`*:: + -- -This key is used to capture the subject string from an Email only. +MAC address of the source. type: keyword -- -*`rsa.email.email`*:: +*`source.nat.ip`*:: + -- -This key is used to capture a generic email address where the source or destination context is not clear +Translated ip of source based NAT sessions (e.g. internal client to internet) +Typically connections traversing load balancers, firewalls, or routers. -type: keyword +type: ip -- -*`rsa.email.trans_from`*:: +*`source.nat.port`*:: + -- -Deprecated key defined only in table map. +Translated port of source based NAT sessions. (e.g. internal client to internet) +Typically used with load balancers, firewalls, or routers. -type: keyword +type: long + +format: string -- -*`rsa.email.trans_to`*:: +*`source.packets`*:: + -- -Deprecated key defined only in table map. +Packets sent from the source to the destination. -type: keyword +type: long --- +example: 12 +-- -*`rsa.file.privilege`*:: +*`source.port`*:: + -- -Deprecated, use permissions +Port of the source. -type: keyword +type: long + +format: string -- -*`rsa.file.attachment`*:: +*`source.registered_domain`*:: + -- -This key captures the attachment file name +The highest registered source domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". type: keyword +example: example.com + -- -*`rsa.file.filesystem`*:: +*`source.top_level_domain`*:: + -- +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + type: keyword +example: co.uk + -- -*`rsa.file.binary`*:: +*`source.user.domain`*:: + -- -Deprecated key defined only in table map. +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.file.filename_dst`*:: +*`source.user.email`*:: + -- -This is used to capture name of the file targeted by the action +User email address. type: keyword -- -*`rsa.file.filename_src`*:: +*`source.user.full_name`*:: + -- -This is used to capture name of the parent filename, the file which performed the action +User's full name, if available. type: keyword +example: Albert Einstein + -- -*`rsa.file.filename_tmp`*:: +*`source.user.full_name.text`*:: + -- -type: keyword +type: text -- -*`rsa.file.directory_dst`*:: +*`source.user.group.domain`*:: + -- -This key is used to capture the directory of the target process or file +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`rsa.file.directory_src`*:: +*`source.user.group.id`*:: + -- -This key is used to capture the directory of the source process or file +Unique identifier for the group on the system/platform. type: keyword -- -*`rsa.file.file_entropy`*:: +*`source.user.group.name`*:: + -- -This is used to capture entropy vale of a file +Name of the group. -type: double +type: keyword -- -*`rsa.file.file_vendor`*:: +*`source.user.hash`*:: + -- -This is used to capture Company name of file located in version_info +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. type: keyword -- -*`rsa.file.task_name`*:: +*`source.user.id`*:: + -- -This is used to capture name of the task +Unique identifier of the user. type: keyword -- - -*`rsa.web.fqdn`*:: +*`source.user.name`*:: + -- -Fully Qualified Domain Names +Short name or login of the user. type: keyword +example: albert + -- -*`rsa.web.web_cookie`*:: +*`source.user.name.text`*:: + -- -This key is used to capture the Web cookies specifically. - -type: keyword +type: text -- -*`rsa.web.alias_host`*:: +*`source.user.roles`*:: + -- +Array of user roles at the time of the event. + type: keyword --- +example: ["kibana_admin", "reporting_user"] -*`rsa.web.reputation_num`*:: -+ -- -Reputation Number of an entity. Typically used for Web Domains -type: double +[float] +=== threat --- +Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework. +These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service"). -*`rsa.web.web_ref_domain`*:: + +*`threat.framework`*:: + -- -Web referer's domain +Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. type: keyword +example: MITRE ATT&CK + -- -*`rsa.web.web_ref_query`*:: +*`threat.tactic.id`*:: + -- -This key captures Web referer's query portion of the URL +The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/ ) type: keyword +example: TA0040 + -- -*`rsa.web.remote_domain`*:: +*`threat.tactic.name`*:: + -- +Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/) + type: keyword +example: impact + -- -*`rsa.web.web_ref_page`*:: +*`threat.tactic.reference`*:: + -- -This key captures Web referer's page information +The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0040/ ) type: keyword +example: https://attack.mitre.org/tactics/TA0040/ + -- -*`rsa.web.web_ref_root`*:: +*`threat.technique.id`*:: + -- -Web referer's root URL path +The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/) type: keyword +example: T1499 + -- -*`rsa.web.cn_asn_dst`*:: +*`threat.technique.name`*:: + -- +The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/) + type: keyword +example: Endpoint Denial of Service + -- -*`rsa.web.cn_rpackets`*:: +*`threat.technique.name.text`*:: + -- -type: keyword +type: text -- -*`rsa.web.urlpage`*:: +*`threat.technique.reference`*:: + -- +The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1499/ ) + type: keyword --- +example: https://attack.mitre.org/techniques/T1499/ -*`rsa.web.urlroot`*:: -+ -- -type: keyword --- +[float] +=== tls -*`rsa.web.p_url`*:: -+ --- -type: keyword +Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files. --- -*`rsa.web.p_user_agent`*:: +*`tls.cipher`*:: + -- +String indicating the cipher used during the current connection. + type: keyword +example: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + -- -*`rsa.web.p_web_cookie`*:: +*`tls.client.certificate`*:: + -- +PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. + type: keyword +example: MII... + -- -*`rsa.web.p_web_method`*:: +*`tls.client.certificate_chain`*:: + -- +Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. + type: keyword +example: ['MII...', 'MII...'] + -- -*`rsa.web.p_web_referer`*:: +*`tls.client.hash.md5`*:: + -- +Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + type: keyword +example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC + -- -*`rsa.web.web_extension_tmp`*:: +*`tls.client.hash.sha1`*:: + -- +Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + type: keyword +example: 9E393D93138888D288266C2D915214D1D1CCEB2A + -- -*`rsa.web.web_page`*:: +*`tls.client.hash.sha256`*:: + -- +Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + type: keyword --- +example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0 +-- -*`rsa.threat.threat_category`*:: +*`tls.client.issuer`*:: + -- -This key captures Threat Name/Threat Category/Categorization of alert +Distinguished name of subject of the issuer of the x.509 certificate presented by the client. type: keyword +example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com + -- -*`rsa.threat.threat_desc`*:: +*`tls.client.ja3`*:: + -- -This key is used to capture the threat description from the session directly or inferred +A hash that identifies clients based on how they perform an SSL/TLS handshake. type: keyword +example: d4e5b18d6b55c71272893221c96ba240 + -- -*`rsa.threat.alert`*:: +*`tls.client.not_after`*:: + -- -This key is used to capture name of the alert +Date/Time indicating when client certificate is no longer considered valid. -type: keyword +type: date + +example: 2021-01-01T00:00:00.000Z -- -*`rsa.threat.threat_source`*:: +*`tls.client.not_before`*:: + -- -This key is used to capture source of the threat +Date/Time indicating when client certificate is first considered valid. -type: keyword +type: date --- +example: 1970-01-01T00:00:00.000Z +-- -*`rsa.crypto.crypto`*:: +*`tls.client.server_name`*:: + -- -This key is used to capture the Encryption Type or Encryption Key only +Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. type: keyword +example: www.elastic.co + -- -*`rsa.crypto.cipher_src`*:: +*`tls.client.subject`*:: + -- -This key is for Source (Client) Cipher +Distinguished name of subject of the x.509 certificate presented by the client. type: keyword +example: CN=myclient, OU=Documentation Team, DC=example, DC=com + -- -*`rsa.crypto.cert_subject`*:: +*`tls.client.supported_ciphers`*:: + -- -This key is used to capture the Certificate organization only +Array of ciphers offered by the client during the client hello. type: keyword +example: ['TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', '...'] + -- -*`rsa.crypto.peer`*:: +*`tls.client.x509.alternative_names`*:: + -- -This key is for Encryption peer's IP Address +List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. type: keyword +example: *.elastic.co + -- -*`rsa.crypto.cipher_size_src`*:: +*`tls.client.x509.issuer.common_name`*:: + -- -This key captures Source (Client) Cipher Size +List of common name (CN) of issuing certificate authority. -type: long +type: keyword + +example: Example SHA2 High Assurance Server CA -- -*`rsa.crypto.ike`*:: +*`tls.client.x509.issuer.country`*:: + -- -IKE negotiation phase. +List of country (C) codes type: keyword +example: US + -- -*`rsa.crypto.scheme`*:: +*`tls.client.x509.issuer.distinguished_name`*:: + -- -This key captures the Encryption scheme used +Distinguished name (DN) of issuing certificate authority. type: keyword +example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA + -- -*`rsa.crypto.peer_id`*:: +*`tls.client.x509.issuer.locality`*:: + -- -This key is for Encryption peer’s identity +List of locality names (L) type: keyword +example: Mountain View + -- -*`rsa.crypto.sig_type`*:: +*`tls.client.x509.issuer.organization`*:: + -- -This key captures the Signature Type +List of organizations (O) of issuing certificate authority. type: keyword +example: Example Inc + -- -*`rsa.crypto.cert_issuer`*:: +*`tls.client.x509.issuer.organizational_unit`*:: + -- +List of organizational units (OU) of issuing certificate authority. + type: keyword +example: www.example.com + -- -*`rsa.crypto.cert_host_name`*:: +*`tls.client.x509.issuer.state_or_province`*:: + -- -Deprecated key defined only in table map. +List of state or province names (ST, S, or P) type: keyword +example: California + -- -*`rsa.crypto.cert_error`*:: +*`tls.client.x509.not_after`*:: + -- -This key captures the Certificate Error String +Time at which the certificate is no longer considered valid. -type: keyword +type: date + +example: 2020-07-16 03:15:39+00:00 -- -*`rsa.crypto.cipher_dst`*:: +*`tls.client.x509.not_before`*:: + -- -This key is for Destination (Server) Cipher +Time at which the certificate is first considered valid. -type: keyword +type: date + +example: 2019-08-16 01:40:25+00:00 -- -*`rsa.crypto.cipher_size_dst`*:: +*`tls.client.x509.public_key_algorithm`*:: + -- -This key captures Destination (Server) Cipher Size +Algorithm used to generate the public key. -type: long +type: keyword + +example: RSA -- -*`rsa.crypto.ssl_ver_src`*:: +*`tls.client.x509.public_key_curve`*:: + -- -Deprecated, use version +The curve used by the elliptic curve public key algorithm. This is algorithm specific. type: keyword +example: nistp521 + -- -*`rsa.crypto.d_certauth`*:: +*`tls.client.x509.public_key_exponent`*:: + -- -type: keyword +Exponent used to derive the public key. This is algorithm specific. + +type: long + +example: 65537 + +Field is not indexed. -- -*`rsa.crypto.s_certauth`*:: +*`tls.client.x509.public_key_size`*:: + -- -type: keyword +The size of the public key space in bits. + +type: long + +example: 2048 -- -*`rsa.crypto.ike_cookie1`*:: +*`tls.client.x509.serial_number`*:: + -- -ID of the negotiation — sent for ISAKMP Phase One +Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. type: keyword +example: 55FBB9C7DEBF09809D12CCAA + -- -*`rsa.crypto.ike_cookie2`*:: +*`tls.client.x509.signature_algorithm`*:: + -- -ID of the negotiation — sent for ISAKMP Phase Two +Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. type: keyword +example: SHA256-RSA + -- -*`rsa.crypto.cert_checksum`*:: +*`tls.client.x509.subject.common_name`*:: + -- +List of common names (CN) of subject. + type: keyword +example: shared.global.example.net + -- -*`rsa.crypto.cert_host_cat`*:: +*`tls.client.x509.subject.country`*:: + -- -This key is used for the hostname category value of a certificate +List of country (C) code type: keyword +example: US + -- -*`rsa.crypto.cert_serial`*:: +*`tls.client.x509.subject.distinguished_name`*:: + -- -This key is used to capture the Certificate serial number only +Distinguished name (DN) of the certificate subject entity. type: keyword +example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net + -- -*`rsa.crypto.cert_status`*:: +*`tls.client.x509.subject.locality`*:: + -- -This key captures Certificate validation status +List of locality names (L) type: keyword +example: San Francisco + -- -*`rsa.crypto.ssl_ver_dst`*:: +*`tls.client.x509.subject.organization`*:: + -- -Deprecated, use version +List of organizations (O) of subject. type: keyword +example: Example, Inc. + -- -*`rsa.crypto.cert_keysize`*:: +*`tls.client.x509.subject.organizational_unit`*:: + -- +List of organizational units (OU) of subject. + type: keyword -- -*`rsa.crypto.cert_username`*:: +*`tls.client.x509.subject.state_or_province`*:: + -- +List of state or province names (ST, S, or P) + type: keyword +example: California + -- -*`rsa.crypto.https_insact`*:: +*`tls.client.x509.version_number`*:: + -- +Version of x509 format. + type: keyword +example: 3 + -- -*`rsa.crypto.https_valid`*:: +*`tls.curve`*:: + -- +String indicating the curve used for the given cipher, when applicable. + type: keyword +example: secp256r1 + -- -*`rsa.crypto.cert_ca`*:: +*`tls.established`*:: + -- -This key is used to capture the Certificate signing authority only +Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. -type: keyword +type: boolean -- -*`rsa.crypto.cert_common`*:: +*`tls.next_protocol`*:: + -- -This key is used to capture the Certificate common name only +String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. type: keyword --- +example: http/1.1 +-- -*`rsa.wireless.wlan_ssid`*:: +*`tls.resumed`*:: + -- -This key is used to capture the ssid of a Wireless Session +Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. -type: keyword +type: boolean -- -*`rsa.wireless.access_point`*:: +*`tls.server.certificate`*:: + -- -This key is used to capture the access point name. +PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. type: keyword +example: MII... + -- -*`rsa.wireless.wlan_channel`*:: +*`tls.server.certificate_chain`*:: + -- -This is used to capture the channel names +Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. -type: long +type: keyword + +example: ['MII...', 'MII...'] -- -*`rsa.wireless.wlan_name`*:: +*`tls.server.hash.md5`*:: + -- -This key captures either WLAN number/name +Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. type: keyword --- +example: 0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC +-- -*`rsa.storage.disk_volume`*:: +*`tls.server.hash.sha1`*:: + -- -A unique name assigned to logical units (volumes) within a physical disk +Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. type: keyword +example: 9E393D93138888D288266C2D915214D1D1CCEB2A + -- -*`rsa.storage.lun`*:: +*`tls.server.hash.sha256`*:: + -- -Logical Unit Number.This key is a very useful concept in Storage. +Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. type: keyword +example: 0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0 + -- -*`rsa.storage.pwwn`*:: +*`tls.server.issuer`*:: + -- -This uniquely identifies a port on a HBA. +Subject of the issuer of the x.509 certificate presented by the server. type: keyword --- +example: CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com +-- -*`rsa.physical.org_dst`*:: +*`tls.server.ja3s`*:: + -- -This is used to capture the destination organization based on the GEOPIP Maxmind database. +A hash that identifies servers based on how they perform an SSL/TLS handshake. type: keyword +example: 394441ab65754e2207b1e1b457b3641d + -- -*`rsa.physical.org_src`*:: +*`tls.server.not_after`*:: + -- -This is used to capture the source organization based on the GEOPIP Maxmind database. +Timestamp indicating when server certificate is no longer considered valid. -type: keyword +type: date --- +example: 2021-01-01T00:00:00.000Z +-- -*`rsa.healthcare.patient_fname`*:: +*`tls.server.not_before`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +Timestamp indicating when server certificate is first considered valid. -type: keyword +type: date + +example: 1970-01-01T00:00:00.000Z -- -*`rsa.healthcare.patient_id`*:: +*`tls.server.subject`*:: + -- -This key captures the unique ID for a patient +Subject of the x.509 certificate presented by the server. type: keyword +example: CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com + -- -*`rsa.healthcare.patient_lname`*:: +*`tls.server.x509.alternative_names`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. type: keyword +example: *.elastic.co + -- -*`rsa.healthcare.patient_mname`*:: +*`tls.server.x509.issuer.common_name`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +List of common name (CN) of issuing certificate authority. type: keyword --- +example: Example SHA2 High Assurance Server CA +-- -*`rsa.endpoint.host_state`*:: +*`tls.server.x509.issuer.country`*:: + -- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on +List of country (C) codes type: keyword +example: US + -- -*`rsa.endpoint.registry_key`*:: +*`tls.server.x509.issuer.distinguished_name`*:: + -- -This key captures the path to the registry key +Distinguished name (DN) of issuing certificate authority. type: keyword +example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA + -- -*`rsa.endpoint.registry_value`*:: +*`tls.server.x509.issuer.locality`*:: + -- -This key captures values or decorators used within a registry entry +List of locality names (L) type: keyword +example: Mountain View + -- -[float] -=== fortinet +*`tls.server.x509.issuer.organization`*:: ++ +-- +List of organizations (O) of issuing certificate authority. -Fields from fortinet FortiOS +type: keyword +example: Example Inc +-- -*`fortinet.file.hash.crc32`*:: +*`tls.server.x509.issuer.organizational_unit`*:: + -- -CRC32 Hash of file - +List of organizational units (OU) of issuing certificate authority. type: keyword +example: www.example.com + -- -[float] -=== firewall +*`tls.server.x509.issuer.state_or_province`*:: ++ +-- +List of state or province names (ST, S, or P) -Module for parsing Fortinet syslog. +type: keyword +example: California +-- -*`fortinet.firewall.acct_stat`*:: +*`tls.server.x509.not_after`*:: + -- -Accounting state (RADIUS) +Time at which the certificate is no longer considered valid. +type: date -type: keyword +example: 2020-07-16 03:15:39+00:00 -- -*`fortinet.firewall.acktime`*:: +*`tls.server.x509.not_before`*:: + -- -Alarm Acknowledge Time +Time at which the certificate is first considered valid. +type: date -type: keyword +example: 2019-08-16 01:40:25+00:00 -- -*`fortinet.firewall.act`*:: +*`tls.server.x509.public_key_algorithm`*:: + -- -Action - +Algorithm used to generate the public key. type: keyword +example: RSA + -- -*`fortinet.firewall.action`*:: +*`tls.server.x509.public_key_curve`*:: + -- -Status of the session - +The curve used by the elliptic curve public key algorithm. This is algorithm specific. type: keyword +example: nistp521 + -- -*`fortinet.firewall.activity`*:: +*`tls.server.x509.public_key_exponent`*:: + -- -HA activity message +Exponent used to derive the public key. This is algorithm specific. +type: long -type: keyword +example: 65537 + +Field is not indexed. -- -*`fortinet.firewall.addr`*:: +*`tls.server.x509.public_key_size`*:: + -- -IP Address +The size of the public key space in bits. +type: long -type: ip +example: 2048 -- -*`fortinet.firewall.addr_type`*:: +*`tls.server.x509.serial_number`*:: + -- -Address Type - +Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. type: keyword +example: 55FBB9C7DEBF09809D12CCAA + -- -*`fortinet.firewall.addrgrp`*:: +*`tls.server.x509.signature_algorithm`*:: + -- -Address Group - +Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. type: keyword +example: SHA256-RSA + -- -*`fortinet.firewall.adgroup`*:: +*`tls.server.x509.subject.common_name`*:: + -- -AD Group Name - +List of common names (CN) of subject. type: keyword +example: shared.global.example.net + -- -*`fortinet.firewall.admin`*:: +*`tls.server.x509.subject.country`*:: + -- -Admin User - +List of country (C) code type: keyword +example: US + -- -*`fortinet.firewall.age`*:: +*`tls.server.x509.subject.distinguished_name`*:: + -- -Time in seconds - time passed since last seen +Distinguished name (DN) of the certificate subject entity. +type: keyword -type: integer +example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net -- -*`fortinet.firewall.agent`*:: +*`tls.server.x509.subject.locality`*:: + -- -User agent - eg. agent="Mozilla/5.0" - +List of locality names (L) type: keyword +example: San Francisco + -- -*`fortinet.firewall.alarmid`*:: +*`tls.server.x509.subject.organization`*:: + -- -Alarm ID +List of organizations (O) of subject. +type: keyword -type: integer +example: Example, Inc. -- -*`fortinet.firewall.alert`*:: +*`tls.server.x509.subject.organizational_unit`*:: + -- -Alert - +List of organizational units (OU) of subject. type: keyword -- -*`fortinet.firewall.analyticscksum`*:: +*`tls.server.x509.subject.state_or_province`*:: + -- -The checksum of the file submitted for analytics - +List of state or province names (ST, S, or P) type: keyword +example: California + -- -*`fortinet.firewall.analyticssubmit`*:: +*`tls.server.x509.version_number`*:: + -- -The flag for analytics submission - +Version of x509 format. type: keyword +example: 3 + -- -*`fortinet.firewall.ap`*:: +*`tls.version`*:: + -- -Access Point - +Numeric part of the version parsed from the original string. type: keyword +example: 1.2 + -- -*`fortinet.firewall.app-type`*:: +*`tls.version_protocol`*:: + -- -Address Type - +Normalized lowercase protocol name parsed from original string. type: keyword --- +example: tls -*`fortinet.firewall.appact`*:: -+ -- -The security action from app control +[float] +=== tracing -type: keyword +Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. --- -*`fortinet.firewall.appid`*:: +*`tracing.span.id`*:: + -- -Application ID +Unique identifier of the span within the scope of its trace. +A span represents an operation within a transaction, such as a request to another service, or a database query. +type: keyword -type: integer +example: 3ff9a8981b7ccd5a -- -*`fortinet.firewall.applist`*:: +*`tracing.trace.id`*:: + -- -Application Control profile - +Unique identifier of the trace. +A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. type: keyword +example: 4bf92f3577b34da6a3ce929d0e0e4736 + -- -*`fortinet.firewall.apprisk`*:: +*`tracing.transaction.id`*:: + -- -Application Risk Level - +Unique identifier of the transaction within the scope of its trace. +A transaction is the highest level of work measured within a service, such as a request to a server. type: keyword --- +example: 00f067aa0ba902b7 -*`fortinet.firewall.apscan`*:: -+ -- -The name of the AP, which scanned and detected the rogue AP +[float] +=== url -type: keyword +URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on. --- -*`fortinet.firewall.apsn`*:: +*`url.domain`*:: + -- -Access Point - +Domain of the url, such as "www.elastic.co". +In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. type: keyword +example: www.elastic.co + -- -*`fortinet.firewall.apstatus`*:: +*`url.extension`*:: + -- -Access Point status - +The field contains the file extension from the original request url. +The file extension is only set if it exists, as not every url has a file extension. +The leading period must not be included. For example, the value must be "png", not ".png". type: keyword +example: png + -- -*`fortinet.firewall.aptype`*:: +*`url.fragment`*:: + -- -Access Point type - +Portion of the url after the `#`, such as "top". +The `#` is not part of the fragment. type: keyword -- -*`fortinet.firewall.assigned`*:: +*`url.full`*:: + -- -Assigned IP Address +If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. +type: keyword -type: ip +example: https://www.elastic.co:443/search?q=elasticsearch#top -- -*`fortinet.firewall.assignip`*:: +*`url.full.text`*:: + -- -Assigned IP Address - - -type: ip +type: text -- -*`fortinet.firewall.attachment`*:: +*`url.original`*:: + -- -The flag for email attachement - +Unmodified original url as seen in the event source. +Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. +This field is meant to represent the URL as it was observed, complete or not. type: keyword +example: https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch + -- -*`fortinet.firewall.attack`*:: +*`url.original.text`*:: + -- -Attack Name +type: text + +-- +*`url.password`*:: ++ +-- +Password of the request. type: keyword -- -*`fortinet.firewall.attackcontext`*:: +*`url.path`*:: + -- -The trigger patterns and the packetdata with base64 encoding - +Path of the request, such as "/search". type: keyword -- -*`fortinet.firewall.attackcontextid`*:: +*`url.port`*:: + -- -Attack context id / total +Port of the request, such as 443. +type: long -type: keyword +example: 443 + +format: string -- -*`fortinet.firewall.attackid`*:: +*`url.query`*:: + -- -Attack ID - +The query field describes the query string of the request, such as "q=elasticsearch". +The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. -type: integer +type: keyword -- -*`fortinet.firewall.auditid`*:: +*`url.registered_domain`*:: + -- -Audit ID +The highest registered url domain, stripped of the subdomain. +For example, the registered domain for "foo.example.com" is "example.com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". +type: keyword -type: long +example: example.com -- -*`fortinet.firewall.auditscore`*:: +*`url.scheme`*:: + -- -The Audit Score - +Scheme of the request, such as "https". +Note: The `:` is not part of the scheme. type: keyword +example: https + -- -*`fortinet.firewall.audittime`*:: +*`url.top_level_domain`*:: + -- -The time of the audit +The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". +This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". +type: keyword -type: long +example: co.uk -- -*`fortinet.firewall.authgrp`*:: +*`url.username`*:: + -- -Authorization Group - +Username of the request. type: keyword -- -*`fortinet.firewall.authid`*:: +[float] +=== user + +The user fields describe information about the user that is relevant to the event. +Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them. + + +*`user.domain`*:: + -- -Authentication ID - +Name of the directory the user is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`fortinet.firewall.authproto`*:: +*`user.email`*:: + -- -The protocol that initiated the authentication - +User email address. type: keyword -- -*`fortinet.firewall.authserver`*:: +*`user.full_name`*:: + -- -Authentication server - +User's full name, if available. type: keyword +example: Albert Einstein + -- -*`fortinet.firewall.bandwidth`*:: +*`user.full_name.text`*:: + -- -Bandwidth +type: text +-- + +*`user.group.domain`*:: ++ +-- +Name of the directory the group is a member of. +For example, an LDAP or Active Directory domain name. type: keyword -- -*`fortinet.firewall.banned_rule`*:: +*`user.group.id`*:: + -- -NAC quarantine Banned Rule Name - +Unique identifier for the group on the system/platform. type: keyword -- -*`fortinet.firewall.banned_src`*:: +*`user.group.name`*:: + -- -NAC quarantine Banned Source IP - +Name of the group. type: keyword -- -*`fortinet.firewall.banword`*:: +*`user.hash`*:: + -- -Banned word - +Unique user hash to correlate information for a user in anonymized form. +Useful if `user.id` or `user.name` contain confidential information and cannot be used. type: keyword -- -*`fortinet.firewall.botnetdomain`*:: +*`user.id`*:: + -- -Botnet Domain Name - +Unique identifier of the user. type: keyword -- -*`fortinet.firewall.botnetip`*:: +*`user.name`*:: + -- -Botnet IP Address +Short name or login of the user. +type: keyword -type: ip +example: albert -- -*`fortinet.firewall.bssid`*:: +*`user.name.text`*:: + -- -Service Set ID - - -type: keyword +type: text -- -*`fortinet.firewall.call_id`*:: +*`user.roles`*:: + -- -Caller ID - +Array of user roles at the time of the event. type: keyword --- +example: ["kibana_admin", "reporting_user"] -*`fortinet.firewall.carrier_ep`*:: -+ -- -The FortiOS Carrier end-point identification +[float] +=== user_agent -type: keyword +The user_agent fields normally come from a browser request. +They often show up in web service logs coming from the parsed user agent string. --- -*`fortinet.firewall.cat`*:: +*`user_agent.device.name`*:: + -- -DNS category ID +Name of the device. +type: keyword -type: integer +example: iPhone -- -*`fortinet.firewall.category`*:: +*`user_agent.name`*:: + -- -Authentication category - +Name of the user agent. type: keyword +example: Safari + -- -*`fortinet.firewall.cc`*:: +*`user_agent.original`*:: + -- -CC Email Address - +Unparsed user_agent string. type: keyword +example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 + -- -*`fortinet.firewall.cdrcontent`*:: +*`user_agent.original.text`*:: + -- -Cdrcontent - - -type: keyword +type: text -- -*`fortinet.firewall.centralnatid`*:: +*`user_agent.os.family`*:: + -- -Central NAT ID +OS family (such as redhat, debian, freebsd, windows). +type: keyword -type: integer +example: debian -- -*`fortinet.firewall.cert`*:: +*`user_agent.os.full`*:: + -- -Certificate - +Operating system name, including the version or code name. type: keyword +example: Mac OS Mojave + -- -*`fortinet.firewall.cert-type`*:: +*`user_agent.os.full.text`*:: + -- -Certificate type - - -type: keyword +type: text -- -*`fortinet.firewall.certhash`*:: +*`user_agent.os.kernel`*:: + -- -Certificate hash - +Operating system kernel version as a raw string. type: keyword +example: 4.4.0-112-generic + -- -*`fortinet.firewall.cfgattr`*:: +*`user_agent.os.name`*:: + -- -Configuration attribute - +Operating system name, without the version. type: keyword +example: Mac OS X + -- -*`fortinet.firewall.cfgobj`*:: +*`user_agent.os.name.text`*:: + -- -Configuration object - - -type: keyword +type: text -- -*`fortinet.firewall.cfgpath`*:: +*`user_agent.os.platform`*:: + -- -Configuration path - +Operating system platform (such centos, ubuntu, windows). type: keyword +example: darwin + -- -*`fortinet.firewall.cfgtid`*:: +*`user_agent.os.version`*:: + -- -Configuration transaction ID - +Operating system version as a raw string. type: keyword +example: 10.14.1 + -- -*`fortinet.firewall.cfgtxpower`*:: +*`user_agent.version`*:: + -- -Configuration TX power +Version of the user agent. +type: keyword -type: integer +example: 12.0 -- -*`fortinet.firewall.channel`*:: +[float] +=== vlan + +The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection. +Network.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. +Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging. +Observer.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers. + + +*`vlan.id`*:: + -- -Wireless Channel +VLAN ID as reported by the observer. +type: keyword -type: integer +example: 10 -- -*`fortinet.firewall.channeltype`*:: +*`vlan.name`*:: + -- -SSH channel type - +Optional VLAN name as reported by the observer. type: keyword --- +example: outside -*`fortinet.firewall.chassisid`*:: -+ -- -Chassis ID +[float] +=== vulnerability -type: integer +The vulnerability fields describe information about a vulnerability that is relevant to an event. --- -*`fortinet.firewall.checksum`*:: +*`vulnerability.category`*:: + -- -The checksum of the scanned file - +The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) +This field must be an array. type: keyword +example: ["Firewall"] + -- -*`fortinet.firewall.chgheaders`*:: +*`vulnerability.classification`*:: + -- -HTTP Headers - +The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) type: keyword +example: CVSS + -- -*`fortinet.firewall.cldobjid`*:: +*`vulnerability.description`*:: + -- -Connector object ID - +The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) type: keyword +example: In macOS before 2.12.6, there is a vulnerability in the RPC... + -- -*`fortinet.firewall.client_addr`*:: +*`vulnerability.description.text`*:: + -- -Wifi client address - - -type: keyword +type: text -- -*`fortinet.firewall.cloudaction`*:: +*`vulnerability.enumeration`*:: + -- -Cloud Action - +The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) type: keyword +example: CVE + -- -*`fortinet.firewall.clouduser`*:: +*`vulnerability.id`*:: + -- -Cloud User - +The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] type: keyword +example: CVE-2019-00001 + -- -*`fortinet.firewall.column`*:: +*`vulnerability.reference`*:: + -- -VOIP Column +A resource that provides additional information, context, and mitigations for the identified vulnerability. +type: keyword -type: integer +example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111 -- -*`fortinet.firewall.command`*:: +*`vulnerability.report_id`*:: + -- -CLI Command - +The report or scan identification number. type: keyword +example: 20191018.0001 + -- -*`fortinet.firewall.community`*:: +*`vulnerability.scanner.vendor`*:: + -- -SNMP Community - +The name of the vulnerability scanner vendor. type: keyword +example: Tenable + -- -*`fortinet.firewall.configcountry`*:: +*`vulnerability.score.base`*:: + -- -Configuration country +Scores can range from 0.0 to 10.0, with 10.0 being the most severe. +Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) +type: float -type: keyword +example: 5.5 -- -*`fortinet.firewall.connection_type`*:: +*`vulnerability.score.environmental`*:: + -- -FortiClient Connection Type +Scores can range from 0.0 to 10.0, with 10.0 being the most severe. +Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) +type: float -type: keyword +example: 5.5 -- -*`fortinet.firewall.conserve`*:: +*`vulnerability.score.temporal`*:: + -- -Flag for conserve mode - +Scores can range from 0.0 to 10.0, with 10.0 being the most severe. +Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) -type: keyword +type: float -- -*`fortinet.firewall.constraint`*:: +*`vulnerability.score.version`*:: + -- -WAF http protocol restrictions - +The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. +CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) type: keyword +example: 2.0 + -- -*`fortinet.firewall.contentdisarmed`*:: +*`vulnerability.severity`*:: + -- -Email scanned content - +The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) type: keyword --- +example: Critical -*`fortinet.firewall.contenttype`*:: -+ -- -Content Type from HTTP header +[float] +=== x509 -type: keyword +This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk. When only a single certificate is logged in an event, it should be nested under `file`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`). For events that contain certificate information for both sides of the connection, the x509 object could be nested under the respective side of the connection information (e.g. `tls.server.x509`). --- -*`fortinet.firewall.cookies`*:: +*`x509.alternative_names`*:: + -- -VPN Cookie - +List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. type: keyword +example: *.elastic.co + -- -*`fortinet.firewall.count`*:: +*`x509.issuer.common_name`*:: + -- -Counts of action type +List of common name (CN) of issuing certificate authority. +type: keyword -type: integer +example: Example SHA2 High Assurance Server CA -- -*`fortinet.firewall.countapp`*:: +*`x509.issuer.country`*:: + -- -Number of App Ctrl logs associated with the session +List of country (C) codes +type: keyword -type: integer +example: US -- -*`fortinet.firewall.countav`*:: +*`x509.issuer.distinguished_name`*:: + -- -Number of AV logs associated with the session +Distinguished name (DN) of issuing certificate authority. +type: keyword -type: integer +example: C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA -- -*`fortinet.firewall.countcifs`*:: +*`x509.issuer.locality`*:: + -- -Number of CIFS logs associated with the session +List of locality names (L) +type: keyword -type: integer +example: Mountain View -- -*`fortinet.firewall.countdlp`*:: +*`x509.issuer.organization`*:: + -- -Number of DLP logs associated with the session +List of organizations (O) of issuing certificate authority. +type: keyword -type: integer +example: Example Inc -- -*`fortinet.firewall.countdns`*:: +*`x509.issuer.organizational_unit`*:: + -- -Number of DNS logs associated with the session +List of organizational units (OU) of issuing certificate authority. +type: keyword -type: integer +example: www.example.com -- -*`fortinet.firewall.countemail`*:: +*`x509.issuer.state_or_province`*:: + -- -Number of email logs associated with the session +List of state or province names (ST, S, or P) +type: keyword -type: integer +example: California -- -*`fortinet.firewall.countff`*:: +*`x509.not_after`*:: + -- -Number of ff logs associated with the session +Time at which the certificate is no longer considered valid. +type: date -type: integer +example: 2020-07-16 03:15:39+00:00 -- -*`fortinet.firewall.countips`*:: +*`x509.not_before`*:: + -- -Number of IPS logs associated with the session +Time at which the certificate is first considered valid. +type: date -type: integer +example: 2019-08-16 01:40:25+00:00 -- -*`fortinet.firewall.countssh`*:: +*`x509.public_key_algorithm`*:: + -- -Number of SSH logs associated with the session +Algorithm used to generate the public key. +type: keyword -type: integer +example: RSA -- -*`fortinet.firewall.countssl`*:: +*`x509.public_key_curve`*:: + -- -Number of SSL logs associated with the session +The curve used by the elliptic curve public key algorithm. This is algorithm specific. +type: keyword -type: integer +example: nistp521 -- -*`fortinet.firewall.countwaf`*:: +*`x509.public_key_exponent`*:: + -- -Number of WAF logs associated with the session +Exponent used to derive the public key. This is algorithm specific. + +type: long +example: 65537 -type: integer +Field is not indexed. -- -*`fortinet.firewall.countweb`*:: +*`x509.public_key_size`*:: + -- -Number of Web filter logs associated with the session +The size of the public key space in bits. +type: long -type: integer +example: 2048 -- -*`fortinet.firewall.cpu`*:: +*`x509.serial_number`*:: + -- -CPU Usage +Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. +type: keyword -type: integer +example: 55FBB9C7DEBF09809D12CCAA -- -*`fortinet.firewall.craction`*:: +*`x509.signature_algorithm`*:: + -- -Client Reputation Action +Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. +type: keyword -type: integer +example: SHA256-RSA -- -*`fortinet.firewall.criticalcount`*:: +*`x509.subject.common_name`*:: + -- -Number of critical ratings +List of common names (CN) of subject. +type: keyword -type: integer +example: shared.global.example.net -- -*`fortinet.firewall.crl`*:: +*`x509.subject.country`*:: + -- -Client Reputation Level - +List of country (C) code type: keyword +example: US + -- -*`fortinet.firewall.crlevel`*:: +*`x509.subject.distinguished_name`*:: + -- -Client Reputation Level - +Distinguished name (DN) of the certificate subject entity. type: keyword +example: C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net + -- -*`fortinet.firewall.crscore`*:: +*`x509.subject.locality`*:: + -- -Some description +List of locality names (L) +type: keyword -type: integer +example: San Francisco -- -*`fortinet.firewall.cveid`*:: +*`x509.subject.organization`*:: + -- -CVE ID - +List of organizations (O) of subject. type: keyword +example: Example, Inc. + -- -*`fortinet.firewall.daemon`*:: +*`x509.subject.organizational_unit`*:: + -- -Daemon name - +List of organizational units (OU) of subject. type: keyword -- -*`fortinet.firewall.datarange`*:: +*`x509.subject.state_or_province`*:: + -- -Data range for reports - +List of state or province names (ST, S, or P) type: keyword +example: California + -- -*`fortinet.firewall.date`*:: +*`x509.version_number`*:: + -- -Date - +Version of x509 format. type: keyword --- +example: 3 -*`fortinet.firewall.ddnsserver`*:: -+ -- -DDNS server +[[exported-fields-elasticsearch]] +== Elasticsearch fields + +elasticsearch Module -type: ip --- -*`fortinet.firewall.desc`*:: -+ --- -Description +[float] +=== elasticsearch -type: keyword --- -*`fortinet.firewall.detectionmethod`*:: +*`elasticsearch.component`*:: + -- -Detection method - +Elasticsearch component from where the log event originated type: keyword +example: o.e.c.m.MetaDataCreateIndexService + -- -*`fortinet.firewall.devcategory`*:: +*`elasticsearch.cluster.uuid`*:: + -- -Device category - +UUID of the cluster type: keyword +example: GmvrbHlNTiSVYiPf8kxg9g + -- -*`fortinet.firewall.devintfname`*:: +*`elasticsearch.cluster.name`*:: + -- -HA device Interface Name - +Name of the cluster type: keyword +example: docker-cluster + -- -*`fortinet.firewall.devtype`*:: +*`elasticsearch.node.id`*:: + -- -Device type - +ID of the node type: keyword +example: DSiWcTyeThWtUXLB9J0BMw + -- -*`fortinet.firewall.dhcp_msg`*:: +*`elasticsearch.node.name`*:: + -- -DHCP Message - +Name of the node type: keyword +example: vWNJsZ3 + -- -*`fortinet.firewall.dintf`*:: +*`elasticsearch.index.name`*:: + -- -Destination interface - +Index name type: keyword +example: filebeat-test-input + -- -*`fortinet.firewall.disk`*:: +*`elasticsearch.index.id`*:: + -- -Assosciated disk - +Index id type: keyword +example: aOGgDwbURfCV57AScqbCgw + -- -*`fortinet.firewall.disklograte`*:: +*`elasticsearch.shard.id`*:: + -- -Disk logging rate +Id of the shard +type: keyword -type: long +example: 0 -- -*`fortinet.firewall.dlpextra`*:: -+ --- -DLP extra information +[float] +=== audit -type: keyword --- -*`fortinet.firewall.docsource`*:: +*`elasticsearch.audit.layer`*:: + -- -DLP fingerprint document source - +The layer from which this event originated: rest, transport or ip_filter type: keyword +example: rest + -- -*`fortinet.firewall.domainctrlauthstate`*:: +*`elasticsearch.audit.event_type`*:: + -- -CIFS domain auth state +The type of event that occurred: anonymous_access_denied, authentication_failed, access_denied, access_granted, connection_granted, connection_denied, tampered_request, run_as_granted, run_as_denied +type: keyword -type: integer +example: access_granted -- -*`fortinet.firewall.domainctrlauthtype`*:: +*`elasticsearch.audit.origin.type`*:: + -- -CIFS domain auth type +Where the request originated: rest (request originated from a REST API request), transport (request was received on the transport channel), local_node (the local node issued the request) +type: keyword -type: integer +example: local_node -- -*`fortinet.firewall.domainctrldomain`*:: +*`elasticsearch.audit.realm`*:: + -- -CIFS domain auth domain - +The authentication realm the authentication was validated against type: keyword -- -*`fortinet.firewall.domainctrlip`*:: +*`elasticsearch.audit.user.realm`*:: + -- -CIFS Domain IP - +The user's authentication realm, if authenticated -type: ip +type: keyword -- -*`fortinet.firewall.domainctrlname`*:: +*`elasticsearch.audit.user.roles`*:: + -- -CIFS Domain name - +Roles to which the principal belongs type: keyword +example: ['kibana_admin', 'beats_admin'] + -- -*`fortinet.firewall.domainctrlprotocoltype`*:: +*`elasticsearch.audit.action`*:: + -- -CIFS Domain connection protocol +The name of the action that was executed +type: keyword -type: integer +example: cluster:monitor/main -- -*`fortinet.firewall.domainctrlusername`*:: +*`elasticsearch.audit.url.params`*:: + -- -CIFS Domain username - +REST URI parameters -type: keyword +example: {username=jacknich2} -- -*`fortinet.firewall.domainfilteridx`*:: +*`elasticsearch.audit.indices`*:: + -- -Domain filter ID +Indices accessed by action +type: keyword -type: integer +example: ['foo-2019.01.04', 'foo-2019.01.03', 'foo-2019.01.06'] -- -*`fortinet.firewall.domainfilterlist`*:: +*`elasticsearch.audit.request.id`*:: + -- -Domain filter name - +Unique ID of request type: keyword +example: WzL_kb6VSvOhAq0twPvHOQ + -- -*`fortinet.firewall.ds`*:: +*`elasticsearch.audit.request.name`*:: + -- -Direction with distribution system - +The type of request that was executed type: keyword +example: ClearScrollRequest + -- -*`fortinet.firewall.dst_int`*:: +*`elasticsearch.audit.request_body`*:: + -- -Destination interface - +type: alias -type: keyword +alias to: http.request.body.content -- -*`fortinet.firewall.dstintfrole`*:: +*`elasticsearch.audit.origin_address`*:: + -- -Destination interface role - +type: alias -type: keyword +alias to: source.ip -- -*`fortinet.firewall.dstcountry`*:: +*`elasticsearch.audit.uri`*:: + -- -Destination country - +type: alias -type: keyword +alias to: url.original -- -*`fortinet.firewall.dstdevcategory`*:: +*`elasticsearch.audit.principal`*:: + -- -Destination device category - +type: alias -type: keyword +alias to: user.name -- -*`fortinet.firewall.dstdevtype`*:: +*`elasticsearch.audit.message`*:: + -- -Destination device type +type: text +-- -type: keyword +[float] +=== deprecation --- -*`fortinet.firewall.dstfamily`*:: -+ --- -Destination OS family +[float] +=== gc -type: keyword +GC fileset fields. --- -*`fortinet.firewall.dsthwvendor`*:: -+ --- -Destination HW vendor +[float] +=== phase -type: keyword +Fields specific to GC phase. --- -*`fortinet.firewall.dsthwversion`*:: + +*`elasticsearch.gc.phase.name`*:: + -- -Destination HW version +Name of the GC collection phase. type: keyword -- -*`fortinet.firewall.dstinetsvc`*:: +*`elasticsearch.gc.phase.duration_sec`*:: + -- -Destination interface service +Collection phase duration according to the Java virtual machine. -type: keyword +type: float -- -*`fortinet.firewall.dstosname`*:: +*`elasticsearch.gc.phase.scrub_symbol_table_time_sec`*:: + -- -Destination OS name +Pause time in seconds cleaning up symbol tables. -type: keyword +type: float -- -*`fortinet.firewall.dstosversion`*:: +*`elasticsearch.gc.phase.scrub_string_table_time_sec`*:: + -- -Destination OS version +Pause time in seconds cleaning up string tables. -type: keyword +type: float -- -*`fortinet.firewall.dstserver`*:: +*`elasticsearch.gc.phase.weak_refs_processing_time_sec`*:: + -- -Destination server +Time spent processing weak references in seconds. -type: integer +type: float -- -*`fortinet.firewall.dstssid`*:: +*`elasticsearch.gc.phase.parallel_rescan_time_sec`*:: + -- -Destination SSID +Time spent in seconds marking live objects while application is stopped. -type: keyword +type: float -- -*`fortinet.firewall.dstswversion`*:: +*`elasticsearch.gc.phase.class_unload_time_sec`*:: + -- -Destination software version +Time spent unloading unused classes in seconds. -type: keyword +type: float -- -*`fortinet.firewall.dstunauthusersource`*:: +[float] +=== cpu_time + +Process CPU time spent performing collections. + + + +*`elasticsearch.gc.phase.cpu_time.user_sec`*:: + -- -Destination unauthenticated source +CPU time spent outside the kernel. -type: keyword +type: float -- -*`fortinet.firewall.dstuuid`*:: +*`elasticsearch.gc.phase.cpu_time.sys_sec`*:: + -- -UUID of the Destination IP address +CPU time spent inside the kernel. -type: keyword +type: float -- -*`fortinet.firewall.duid`*:: +*`elasticsearch.gc.phase.cpu_time.real_sec`*:: + -- -DHCP UID +Total elapsed CPU time spent to complete the collection from start to finish. -type: keyword +type: float -- -*`fortinet.firewall.eapolcnt`*:: +*`elasticsearch.gc.jvm_runtime_sec`*:: + -- -EAPOL packet count +The time from JVM start up in seconds, as a floating point number. -type: integer +type: float -- -*`fortinet.firewall.eapoltype`*:: +*`elasticsearch.gc.threads_total_stop_time_sec`*:: + -- -EAPOL packet type +Garbage collection threads total stop time seconds. -type: keyword +type: float -- -*`fortinet.firewall.encrypt`*:: +*`elasticsearch.gc.stopping_threads_time_sec`*:: + -- -Whether the packet is encrypted or not +Time took to stop threads seconds. -type: integer +type: float -- -*`fortinet.firewall.encryption`*:: +*`elasticsearch.gc.tags`*:: + -- -Encryption method +GC logging tags. type: keyword -- -*`fortinet.firewall.epoch`*:: -+ --- -Epoch used for locating file +[float] +=== heap +Heap allocation and total size. -type: integer --- -*`fortinet.firewall.espauth`*:: +*`elasticsearch.gc.heap.size_kb`*:: + -- -ESP Authentication +Total heap size in kilobytes. -type: keyword +type: integer -- -*`fortinet.firewall.esptransform`*:: +*`elasticsearch.gc.heap.used_kb`*:: + -- -ESP Transform +Used heap in kilobytes. -type: keyword +type: integer -- -*`fortinet.firewall.exch`*:: -+ --- -Mail Exchanges from DNS response answer section +[float] +=== old_gen +Old generation occupancy and total size. -type: keyword --- -*`fortinet.firewall.exchange`*:: +*`elasticsearch.gc.old_gen.size_kb`*:: + -- -Mail Exchanges from DNS response answer section +Total size of old generation in kilobytes. -type: keyword +type: integer -- -*`fortinet.firewall.expectedsignature`*:: +*`elasticsearch.gc.old_gen.used_kb`*:: + -- -Expected SSL signature +Old generation occupancy in kilobytes. -type: keyword +type: integer -- -*`fortinet.firewall.expiry`*:: -+ --- -FortiGuard override expiry timestamp +[float] +=== young_gen +Young generation occupancy and total size. -type: keyword --- -*`fortinet.firewall.fams_pause`*:: +*`elasticsearch.gc.young_gen.size_kb`*:: + -- -Fortinet Analysis and Management Service Pause +Total size of young generation in kilobytes. type: integer -- -*`fortinet.firewall.fazlograte`*:: +*`elasticsearch.gc.young_gen.used_kb`*:: + -- -FortiAnalyzer Logging Rate +Young generation occupancy in kilobytes. -type: long +type: integer -- -*`fortinet.firewall.fctemssn`*:: -+ --- -FortiClient Endpoint SSN +[float] +=== server +Server log file -type: keyword +*`elasticsearch.server.stacktrace`*:: ++ -- +Field is not indexed. -*`fortinet.firewall.fctuid`*:: -+ -- -FortiClient UID +[float] +=== gc -type: keyword +GC log --- -*`fortinet.firewall.field`*:: +[float] +=== young + +Young GC + + +*`elasticsearch.server.gc.young.one`*:: + -- -NTP status field -type: keyword +type: long + +example: -- -*`fortinet.firewall.filefilter`*:: +*`elasticsearch.server.gc.young.two`*:: + -- -The filter used to identify the affected file -type: keyword +type: long + +example: -- -*`fortinet.firewall.filehashsrc`*:: +*`elasticsearch.server.gc.overhead_seq`*:: + -- -Filehash source +Sequence number +type: long -type: keyword +example: 3449992 -- -*`fortinet.firewall.filtercat`*:: +*`elasticsearch.server.gc.collection_duration.ms`*:: + -- -DLP filter category +Time spent in GC, in milliseconds +type: float -type: keyword +example: 1600 -- -*`fortinet.firewall.filteridx`*:: +*`elasticsearch.server.gc.observation_duration.ms`*:: + -- -DLP filter ID +Total time over which collection was observed, in milliseconds +type: float -type: integer +example: 1800 -- -*`fortinet.firewall.filtername`*:: +[float] +=== slowlog + +Slowlog events from Elasticsearch + + +*`elasticsearch.slowlog.logger`*:: + -- -DLP rule name - +Logger name type: keyword +example: index.search.slowlog.fetch + -- -*`fortinet.firewall.filtertype`*:: +*`elasticsearch.slowlog.took`*:: + -- -DLP filter type - +Time it took to execute the query type: keyword +example: 300ms + -- -*`fortinet.firewall.fortiguardresp`*:: +*`elasticsearch.slowlog.types`*:: + -- -Antispam ESP value - +Types type: keyword +example: + -- -*`fortinet.firewall.forwardedfor`*:: +*`elasticsearch.slowlog.stats`*:: + -- -Email address forwarded - +Stats groups type: keyword +example: group1 + -- -*`fortinet.firewall.fqdn`*:: +*`elasticsearch.slowlog.search_type`*:: + -- -FQDN - +Search type type: keyword +example: QUERY_THEN_FETCH + -- -*`fortinet.firewall.frametype`*:: +*`elasticsearch.slowlog.source_query`*:: + -- -Wireless frametype - +Slow query type: keyword +example: {"query":{"match_all":{"boost":1.0}}} + -- -*`fortinet.firewall.freediskstorage`*:: +*`elasticsearch.slowlog.extra_source`*:: + -- -Free disk integer +Extra source information +type: keyword -type: integer +example: -- -*`fortinet.firewall.from`*:: +*`elasticsearch.slowlog.total_hits`*:: + -- -From email address - +Total hits type: keyword +example: 42 + -- -*`fortinet.firewall.from_vcluster`*:: +*`elasticsearch.slowlog.total_shards`*:: + -- -Source virtual cluster number +Total queried shards +type: keyword -type: integer +example: 22 -- -*`fortinet.firewall.fsaverdict`*:: +*`elasticsearch.slowlog.routing`*:: + -- -FSA verdict - +Routing type: keyword +example: s01HZ2QBk9jw4gtgaFtn + -- -*`fortinet.firewall.fwserver_name`*:: +*`elasticsearch.slowlog.id`*:: + -- -Web proxy server name - +Id type: keyword +example: + -- -*`fortinet.firewall.gateway`*:: +*`elasticsearch.slowlog.type`*:: + -- -Gateway ip address for PPPoE status report +Type +type: keyword -type: ip +example: doc -- -*`fortinet.firewall.green`*:: +*`elasticsearch.slowlog.source`*:: + -- -Memory status - +Source of document that was indexed type: keyword -- -*`fortinet.firewall.groupid`*:: -+ --- -User Group ID +[[exported-fields-envoyproxy]] +== Envoyproxy fields +Module for handling logs produced by envoy -type: integer --- -*`fortinet.firewall.ha-prio`*:: -+ --- -HA Priority +[float] +=== envoyproxy +Fields from envoy proxy logs after normalization -type: integer --- -*`fortinet.firewall.ha_group`*:: +*`envoyproxy.log_type`*:: + -- -HA Group +Envoy log type, normally ACCESS type: keyword -- -*`fortinet.firewall.ha_role`*:: +*`envoyproxy.response_flags`*:: + -- -HA Role +Response flags type: keyword -- -*`fortinet.firewall.handshake`*:: +*`envoyproxy.upstream_service_time`*:: + -- -SSL Handshake +Upstream service time in nanoseconds -type: keyword +type: long + +format: duration -- -*`fortinet.firewall.hash`*:: +*`envoyproxy.request_id`*:: + -- -Hash value of downloaded file +ID of the request type: keyword -- -*`fortinet.firewall.hbdn_reason`*:: +*`envoyproxy.authority`*:: + -- -Heartbeat down reason +Envoy proxy authority field type: keyword -- -*`fortinet.firewall.highcount`*:: +*`envoyproxy.proxy_type`*:: + -- -Highcount fabric summary +Envoy proxy type, tcp or http -type: integer +type: keyword -- -*`fortinet.firewall.host`*:: -+ --- -Hostname +[[exported-fields-f5]] +== Big-IP Access Policy Manager fields +f5 fields. -type: keyword --- -*`fortinet.firewall.iaid`*:: +*`network.interface.name`*:: + -- -DHCPv6 id +Name of the network interface where the traffic has been observed. type: keyword -- -*`fortinet.firewall.icmpcode`*:: + + +*`rsa.internal.msg`*:: + -- -Destination Port of the ICMP message - +This key is used to capture the raw message that comes into the Log Decoder type: keyword -- -*`fortinet.firewall.icmpid`*:: +*`rsa.internal.messageid`*:: + -- -Source port of the ICMP message +type: keyword +-- +*`rsa.internal.event_desc`*:: ++ +-- type: keyword -- -*`fortinet.firewall.icmptype`*:: +*`rsa.internal.message`*:: + -- -The type of ICMP message - +This key captures the contents of instant messages type: keyword -- -*`fortinet.firewall.identifier`*:: +*`rsa.internal.time`*:: + -- -Network traffic identifier - +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -type: integer +type: date -- -*`fortinet.firewall.in_spi`*:: +*`rsa.internal.level`*:: + -- -IPSEC inbound SPI - +Deprecated key defined only in table map. -type: keyword +type: long -- -*`fortinet.firewall.incidentserialno`*:: +*`rsa.internal.msg_id`*:: + -- -Incident serial number - +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.infected`*:: +*`rsa.internal.msg_vid`*:: + -- -Infected MMS - +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.infectedfilelevel`*:: +*`rsa.internal.data`*:: + -- -DLP infected file level - +Deprecated key defined only in table map. -type: integer +type: keyword -- -*`fortinet.firewall.informationsource`*:: +*`rsa.internal.obj_server`*:: + -- -Information source - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.init`*:: +*`rsa.internal.obj_val`*:: + -- -IPSEC init stage - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.initiator`*:: +*`rsa.internal.resource`*:: + -- -Original login user name for Fortiguard override - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.interface`*:: +*`rsa.internal.obj_id`*:: + -- -Related interface - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.intf`*:: +*`rsa.internal.statement`*:: + -- -Related interface - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.invalidmac`*:: +*`rsa.internal.audit_class`*:: + -- -The MAC address with invalid OUI - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.ip`*:: +*`rsa.internal.entry`*:: + -- -Related IP - +Deprecated key defined only in table map. -type: ip +type: keyword -- -*`fortinet.firewall.iptype`*:: +*`rsa.internal.hcode`*:: + -- -Related IP type - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.keyword`*:: +*`rsa.internal.inode`*:: + -- -Keyword used for search - +Deprecated key defined only in table map. -type: keyword +type: long -- -*`fortinet.firewall.kind`*:: +*`rsa.internal.resource_class`*:: + -- -VOIP kind - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.lanin`*:: +*`rsa.internal.dead`*:: + -- -LAN incoming traffic in bytes - +Deprecated key defined only in table map. type: long -- -*`fortinet.firewall.lanout`*:: +*`rsa.internal.feed_desc`*:: + -- -LAN outbound traffic in bytes - +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: long +type: keyword -- -*`fortinet.firewall.lease`*:: +*`rsa.internal.feed_name`*:: + -- -DHCP lease - +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.license_limit`*:: +*`rsa.internal.cid`*:: + -- -Maximum Number of FortiClients for the License - +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.limit`*:: +*`rsa.internal.device_class`*:: + -- -Virtual Domain Resource Limit - +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.line`*:: +*`rsa.internal.device_group`*:: + -- -VOIP line - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.live`*:: +*`rsa.internal.device_host`*:: + -- -Time in seconds - +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.local`*:: +*`rsa.internal.device_ip`*:: + -- -Local IP for a PPPD Connection - +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: ip -- -*`fortinet.firewall.log`*:: +*`rsa.internal.device_ipv6`*:: + -- -Log message - +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -*`fortinet.firewall.login`*:: +*`rsa.internal.device_type`*:: + -- -SSH login - +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.lowcount`*:: +*`rsa.internal.device_type_id`*:: + -- -Fabric lowcount - +Deprecated key defined only in table map. -type: integer +type: long -- -*`fortinet.firewall.mac`*:: +*`rsa.internal.did`*:: + -- -DHCP mac address - +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.malform_data`*:: +*`rsa.internal.entropy_req`*:: + -- -VOIP malformed data - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: integer +type: long -- -*`fortinet.firewall.malform_desc`*:: +*`rsa.internal.entropy_res`*:: + -- -VOIP malformed data description - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: keyword +type: long -- -*`fortinet.firewall.manuf`*:: +*`rsa.internal.event_name`*:: + -- -Manufacturer name - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.masterdstmac`*:: +*`rsa.internal.feed_category`*:: + -- -Master mac address for a host with multiple network interfaces - +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.mastersrcmac`*:: +*`rsa.internal.forward_ip`*:: + -- -The master MAC address for a host that has multiple network interfaces - +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -type: keyword +type: ip -- -*`fortinet.firewall.mediumcount`*:: +*`rsa.internal.forward_ipv6`*:: + -- -Fabric medium count - +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: ip -- -*`fortinet.firewall.mem`*:: +*`rsa.internal.header_id`*:: + -- -Memory usage system statistics - +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.meshmode`*:: +*`rsa.internal.lc_cid`*:: + -- -Wireless mesh mode - +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.message_type`*:: +*`rsa.internal.lc_ctime`*:: + -- -VOIP message type - +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: date -- -*`fortinet.firewall.method`*:: +*`rsa.internal.mcb_req`*:: + -- -HTTP method - +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most -type: keyword +type: long -- -*`fortinet.firewall.mgmtcnt`*:: +*`rsa.internal.mcb_res`*:: + -- -The number of unauthorized client flooding managemet frames - +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most -type: integer +type: long -- -*`fortinet.firewall.mode`*:: +*`rsa.internal.mcbc_req`*:: + -- -IPSEC mode - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: keyword +type: long -- -*`fortinet.firewall.module`*:: +*`rsa.internal.mcbc_res`*:: + -- -PCI-DSS module - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: keyword +type: long -- -*`fortinet.firewall.monitor-name`*:: +*`rsa.internal.medium`*:: + -- -Health Monitor Name - +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session -type: keyword +type: long -- -*`fortinet.firewall.monitor-type`*:: +*`rsa.internal.node_name`*:: + -- -Health Monitor Type - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.mpsk`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -Wireless MPSK - +This key denotes that event is endpoint related type: keyword -- -*`fortinet.firewall.msgproto`*:: +*`rsa.internal.parse_error`*:: + -- -Message Protocol Number - +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.mtu`*:: +*`rsa.internal.payload_req`*:: + -- -Max Transmission Unit Value - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: integer +type: long -- -*`fortinet.firewall.name`*:: +*`rsa.internal.payload_res`*:: + -- -Name - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: keyword +type: long -- -*`fortinet.firewall.nat`*:: +*`rsa.internal.process_vid_dst`*:: + -- -NAT IP Address - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. type: keyword -- -*`fortinet.firewall.netid`*:: +*`rsa.internal.process_vid_src`*:: + -- -Connector NetID - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. type: keyword -- -*`fortinet.firewall.new_status`*:: +*`rsa.internal.rid`*:: + -- -New status on user change +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- +*`rsa.internal.session_split`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`fortinet.firewall.new_value`*:: +*`rsa.internal.site`*:: + -- -New Virtual Domain Name - +Deprecated key defined only in table map. type: keyword -- -*`fortinet.firewall.newchannel`*:: +*`rsa.internal.size`*:: + -- -New Channel Number - +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: long -- -*`fortinet.firewall.newchassisid`*:: +*`rsa.internal.sourcefile`*:: + -- -New Chassis ID - +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: keyword -- -*`fortinet.firewall.newslot`*:: +*`rsa.internal.ubc_req`*:: + -- -New Slot Number - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: integer +type: long -- -*`fortinet.firewall.nextstat`*:: +*`rsa.internal.ubc_res`*:: + -- -Time interval in seconds for the next statistics. - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: integer +type: long -- -*`fortinet.firewall.nf_type`*:: +*`rsa.internal.word`*:: + -- -Notification Type - +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log type: keyword -- -*`fortinet.firewall.noise`*:: + +*`rsa.time.event_time`*:: + -- -Wifi Noise - +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form -type: integer +type: date -- -*`fortinet.firewall.old_status`*:: +*`rsa.time.duration_time`*:: + -- -Original Status - +This key is used to capture the normalized duration/lifetime in seconds. -type: keyword +type: double -- -*`fortinet.firewall.old_value`*:: +*`rsa.time.event_time_str`*:: + -- -Original Virtual Domain name - +This key is used to capture the incomplete time mentioned in a session as a string type: keyword -- -*`fortinet.firewall.oldchannel`*:: +*`rsa.time.starttime`*:: + -- -Original channel - +This key is used to capture the Start time mentioned in a session in a standard form -type: integer +type: date -- -*`fortinet.firewall.oldchassisid`*:: +*`rsa.time.month`*:: + -- -Original Chassis Number +type: keyword +-- -type: integer +*`rsa.time.day`*:: ++ +-- +type: keyword -- -*`fortinet.firewall.oldslot`*:: +*`rsa.time.endtime`*:: + -- -Original Slot Number - +This key is used to capture the End time mentioned in a session in a standard form -type: integer +type: date -- -*`fortinet.firewall.oldsn`*:: +*`rsa.time.timezone`*:: + -- -Old Serial number - +This key is used to capture the timezone of the Event Time type: keyword -- -*`fortinet.firewall.oldwprof`*:: +*`rsa.time.duration_str`*:: + -- -Old Web Filter Profile - +A text string version of the duration type: keyword -- -*`fortinet.firewall.onwire`*:: +*`rsa.time.date`*:: + -- -A flag to indicate if the AP is onwire or not +type: keyword +-- +*`rsa.time.year`*:: ++ +-- type: keyword -- -*`fortinet.firewall.opercountry`*:: +*`rsa.time.recorded_time`*:: + -- -Operating Country +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date +-- +*`rsa.time.datetime`*:: ++ +-- type: keyword -- -*`fortinet.firewall.opertxpower`*:: +*`rsa.time.effective_time`*:: + -- -Operating TX power - +This key is the effective time referenced by an individual event in a Standard Timestamp format -type: integer +type: date -- -*`fortinet.firewall.osname`*:: +*`rsa.time.expire_time`*:: + -- -Operating System name - +This key is the timestamp that explicitly refers to an expiration. -type: keyword +type: date -- -*`fortinet.firewall.osversion`*:: +*`rsa.time.process_time`*:: + -- -Operating System version - +Deprecated, use duration.time type: keyword -- -*`fortinet.firewall.out_spi`*:: +*`rsa.time.hour`*:: + -- -Out SPI - - type: keyword -- -*`fortinet.firewall.outintf`*:: +*`rsa.time.min`*:: + -- -Out interface +type: keyword +-- +*`rsa.time.timestamp`*:: ++ +-- type: keyword -- -*`fortinet.firewall.passedcount`*:: +*`rsa.time.event_queue_time`*:: + -- -Fabric passed count - +This key is the Time that the event was queued. -type: integer +type: date -- -*`fortinet.firewall.passwd`*:: +*`rsa.time.p_time1`*:: + -- -Changed user password information - - type: keyword -- -*`fortinet.firewall.path`*:: +*`rsa.time.tzone`*:: + -- -Path of looped configuration for security fabric - - type: keyword -- -*`fortinet.firewall.peer`*:: +*`rsa.time.eventtime`*:: + -- -WAN optimization peer - - type: keyword -- -*`fortinet.firewall.peer_notif`*:: +*`rsa.time.gmtdate`*:: + -- -VPN peer notification - - type: keyword -- -*`fortinet.firewall.phase2_name`*:: +*`rsa.time.gmttime`*:: + -- -VPN phase2 name - - type: keyword -- -*`fortinet.firewall.phone`*:: +*`rsa.time.p_date`*:: + -- -VOIP Phone - - type: keyword -- -*`fortinet.firewall.pid`*:: +*`rsa.time.p_month`*:: + -- -Process ID - - -type: integer +type: keyword -- -*`fortinet.firewall.policytype`*:: +*`rsa.time.p_time`*:: + -- -Policy Type - - type: keyword -- -*`fortinet.firewall.poolname`*:: +*`rsa.time.p_time2`*:: + -- -IP Pool name - - type: keyword -- -*`fortinet.firewall.port`*:: +*`rsa.time.p_year`*:: + -- -Log upload error port - - -type: integer +type: keyword -- -*`fortinet.firewall.portbegin`*:: +*`rsa.time.expire_time_str`*:: + -- -IP Pool port number to begin - +This key is used to capture incomplete timestamp that explicitly refers to an expiration. -type: integer +type: keyword -- -*`fortinet.firewall.portend`*:: +*`rsa.time.stamp`*:: + -- -IP Pool port number to end - +Deprecated key defined only in table map. -type: integer +type: date -- -*`fortinet.firewall.probeproto`*:: + +*`rsa.misc.action`*:: + -- -Link Monitor Probe Protocol - - type: keyword -- -*`fortinet.firewall.process`*:: +*`rsa.misc.result`*:: + -- -URL Filter process - +This key is used to capture the outcome/result string value of an action in a session. type: keyword -- -*`fortinet.firewall.processtime`*:: +*`rsa.misc.severity`*:: + -- -Process time for reports - +This key is used to capture the severity given the session -type: integer +type: keyword -- -*`fortinet.firewall.profile`*:: +*`rsa.misc.event_type`*:: + -- -Profile Name - +This key captures the event category type as specified by the event source. type: keyword -- -*`fortinet.firewall.profile_vd`*:: +*`rsa.misc.reference_id`*:: + -- -Virtual Domain Name - +This key is used to capture an event id from the session directly type: keyword -- -*`fortinet.firewall.profilegroup`*:: +*`rsa.misc.version`*:: + -- -Profile Group Name - +This key captures Version of the application or OS which is generating the event. type: keyword -- -*`fortinet.firewall.profiletype`*:: +*`rsa.misc.disposition`*:: + -- -Profile Type - +This key captures the The end state of an action. type: keyword -- -*`fortinet.firewall.qtypeval`*:: +*`rsa.misc.result_code`*:: + -- -DNS question type value - +This key is used to capture the outcome/result numeric value of an action in a session -type: integer +type: keyword -- -*`fortinet.firewall.quarskip`*:: +*`rsa.misc.category`*:: + -- -Quarantine skip explanation - +This key is used to capture the category of an event given by the vendor in the session type: keyword -- -*`fortinet.firewall.quotaexceeded`*:: +*`rsa.misc.obj_name`*:: + -- -If quota has been exceeded - +This is used to capture name of object type: keyword -- -*`fortinet.firewall.quotamax`*:: +*`rsa.misc.obj_type`*:: + -- -Maximum quota allowed - in seconds if time-based - in bytes if traffic-based - +This is used to capture type of object -type: long +type: keyword -- -*`fortinet.firewall.quotatype`*:: +*`rsa.misc.event_source`*:: + -- -Quota type - +This key captures Source of the event that’s not a hostname type: keyword -- -*`fortinet.firewall.quotaused`*:: +*`rsa.misc.log_session_id`*:: + -- -Quota used - in seconds if time-based - in bytes if trafficbased) - +This key is used to capture a sessionid from the session directly -type: long +type: keyword -- -*`fortinet.firewall.radioband`*:: +*`rsa.misc.group`*:: + -- -Radio band - +This key captures the Group Name value type: keyword -- -*`fortinet.firewall.radioid`*:: +*`rsa.misc.policy_name`*:: + -- -Radio ID - +This key is used to capture the Policy Name only. -type: integer +type: keyword -- -*`fortinet.firewall.radioidclosest`*:: +*`rsa.misc.rule_name`*:: + -- -Radio ID on the AP closest the rogue AP - +This key captures the Rule Name -type: integer +type: keyword -- -*`fortinet.firewall.radioiddetected`*:: +*`rsa.misc.context`*:: + -- -Radio ID on the AP which detected the rogue AP - +This key captures Information which adds additional context to the event. -type: integer +type: keyword -- -*`fortinet.firewall.rate`*:: +*`rsa.misc.change_new`*:: + -- -Wireless rogue rate value - +This key is used to capture the new values of the attribute that’s changing in a session type: keyword -- -*`fortinet.firewall.rawdata`*:: +*`rsa.misc.space`*:: + -- -Raw data value - - type: keyword -- -*`fortinet.firewall.rawdataid`*:: +*`rsa.misc.client`*:: + -- -Raw data ID - +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. type: keyword -- -*`fortinet.firewall.rcvddelta`*:: +*`rsa.misc.msgIdPart1`*:: + -- -Received bytes delta - - type: keyword -- -*`fortinet.firewall.reason`*:: +*`rsa.misc.msgIdPart2`*:: + -- -Alert reason - - type: keyword -- -*`fortinet.firewall.received`*:: +*`rsa.misc.change_old`*:: + -- -Server key exchange received - +This key is used to capture the old value of the attribute that’s changing in a session -type: integer +type: keyword -- -*`fortinet.firewall.receivedsignature`*:: +*`rsa.misc.operation_id`*:: + -- -Server key exchange received signature - +An alert number or operation number. The values should be unique and non-repeating. type: keyword -- -*`fortinet.firewall.red`*:: +*`rsa.misc.event_state`*:: + -- -Memory information in red - +This key captures the current state of the object/item referenced within the event. Describing an on-going event. type: keyword -- -*`fortinet.firewall.referralurl`*:: +*`rsa.misc.group_object`*:: + -- -Web filter referralurl - +This key captures a collection/grouping of entities. Specific usage type: keyword -- -*`fortinet.firewall.remote`*:: +*`rsa.misc.node`*:: + -- -Remote PPP IP address - +Common use case is the node name within a cluster. The cluster name is reflected by the host name. -type: ip +type: keyword -- -*`fortinet.firewall.remotewtptime`*:: +*`rsa.misc.rule`*:: + -- -Remote Wifi Radius authentication time - +This key captures the Rule number type: keyword -- -*`fortinet.firewall.reporttype`*:: +*`rsa.misc.device_name`*:: + -- -Report type - +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc type: keyword -- -*`fortinet.firewall.reqtype`*:: +*`rsa.misc.param`*:: + -- -Request type - +This key is the parameters passed as part of a command or application, etc. type: keyword -- -*`fortinet.firewall.request_name`*:: +*`rsa.misc.change_attrib`*:: + -- -VOIP request name - +This key is used to capture the name of the attribute that’s changing in a session type: keyword -- -*`fortinet.firewall.result`*:: +*`rsa.misc.event_computer`*:: + -- -VPN phase result - +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. type: keyword -- -*`fortinet.firewall.role`*:: +*`rsa.misc.reference_id1`*:: + -- -VPN Phase 2 role - +This key is for Linked ID to be used as an addition to "reference.id" type: keyword -- -*`fortinet.firewall.rssi`*:: +*`rsa.misc.event_log`*:: + -- -Received signal strength indicator - +This key captures the Name of the event log -type: integer +type: keyword -- -*`fortinet.firewall.rsso_key`*:: +*`rsa.misc.OS`*:: + -- -RADIUS SSO attribute value - +This key captures the Name of the Operating System type: keyword -- -*`fortinet.firewall.ruledata`*:: +*`rsa.misc.terminal`*:: + -- -Rule data - +This key captures the Terminal Names only type: keyword -- -*`fortinet.firewall.ruletype`*:: +*`rsa.misc.msgIdPart3`*:: + -- -Rule type - - type: keyword -- -*`fortinet.firewall.scanned`*:: +*`rsa.misc.filter`*:: + -- -Number of Scanned MMSs - +This key captures Filter used to reduce result set -type: integer +type: keyword -- -*`fortinet.firewall.scantime`*:: +*`rsa.misc.serial_number`*:: + -- -Scanned time - +This key is the Serial number associated with a physical asset. -type: long +type: keyword -- -*`fortinet.firewall.scope`*:: +*`rsa.misc.checksum`*:: + -- -FortiGuard Override Scope - +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. type: keyword -- -*`fortinet.firewall.security`*:: +*`rsa.misc.event_user`*:: + -- -Wireless rogue security - +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. type: keyword -- -*`fortinet.firewall.sensitivity`*:: +*`rsa.misc.virusname`*:: + -- -Sensitivity for document fingerprint - +This key captures the name of the virus type: keyword -- -*`fortinet.firewall.sensor`*:: +*`rsa.misc.content_type`*:: + -- -NAC Sensor Name - +This key is used to capture Content Type only. type: keyword -- -*`fortinet.firewall.sentdelta`*:: +*`rsa.misc.group_id`*:: + -- -Sent bytes delta - +This key captures Group ID Number (related to the group name) type: keyword -- -*`fortinet.firewall.seq`*:: +*`rsa.misc.policy_id`*:: + -- -Sequence number - +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise type: keyword -- -*`fortinet.firewall.serial`*:: +*`rsa.misc.vsys`*:: + -- -WAN optimisation serial - +This key captures Virtual System Name type: keyword -- -*`fortinet.firewall.serialno`*:: +*`rsa.misc.connection_id`*:: + -- -Serial number - +This key captures the Connection ID type: keyword -- -*`fortinet.firewall.server`*:: +*`rsa.misc.reference_id2`*:: + -- -AD server FQDN or IP - +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. type: keyword -- -*`fortinet.firewall.session_id`*:: +*`rsa.misc.sensor`*:: + -- -Session ID - +This key captures Name of the sensor. Typically used in IDS/IPS based devices type: keyword -- -*`fortinet.firewall.sessionid`*:: +*`rsa.misc.sig_id`*:: + -- -WAD Session ID - +This key captures IDS/IPS Int Signature ID -type: integer +type: long -- -*`fortinet.firewall.setuprate`*:: +*`rsa.misc.port_name`*:: + -- -Session Setup Rate - +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). -type: long +type: keyword -- -*`fortinet.firewall.severity`*:: +*`rsa.misc.rule_group`*:: + -- -Severity - +This key captures the Rule group name type: keyword -- -*`fortinet.firewall.shaperdroprcvdbyte`*:: +*`rsa.misc.risk_num`*:: + -- -Received bytes dropped by shaper - +This key captures a Numeric Risk value -type: integer +type: double -- -*`fortinet.firewall.shaperdropsentbyte`*:: +*`rsa.misc.trigger_val`*:: + -- -Sent bytes dropped by shaper - +This key captures the Value of the trigger or threshold condition. -type: integer +type: keyword -- -*`fortinet.firewall.shaperperipdropbyte`*:: +*`rsa.misc.log_session_id1`*:: + -- -Dropped bytes per IP by shaper - +This key is used to capture a Linked (Related) Session ID from the session directly -type: integer +type: keyword -- -*`fortinet.firewall.shaperperipname`*:: +*`rsa.misc.comp_version`*:: + -- -Traffic shaper name (per IP) - +This key captures the Version level of a sub-component of a product. type: keyword -- -*`fortinet.firewall.shaperrcvdname`*:: +*`rsa.misc.content_version`*:: + -- -Traffic shaper name for received traffic - +This key captures Version level of a signature or database content. type: keyword -- -*`fortinet.firewall.shapersentname`*:: +*`rsa.misc.hardware_id`*:: + -- -Traffic shaper name for sent traffic - +This key is used to capture unique identifier for a device or system (NOT a Mac address) type: keyword -- -*`fortinet.firewall.shapingpolicyid`*:: +*`rsa.misc.risk`*:: + -- -Traffic shaper policy ID - +This key captures the non-numeric risk value -type: integer +type: keyword -- -*`fortinet.firewall.signal`*:: +*`rsa.misc.event_id`*:: + -- -Wireless rogue API signal - - -type: integer +type: keyword -- -*`fortinet.firewall.size`*:: +*`rsa.misc.reason`*:: + -- -Email size in bytes - - -type: long +type: keyword -- -*`fortinet.firewall.slot`*:: +*`rsa.misc.status`*:: + -- -Slot number - - -type: integer +type: keyword -- -*`fortinet.firewall.sn`*:: +*`rsa.misc.mail_id`*:: + -- -Security fabric serial number - +This key is used to capture the mailbox id/name type: keyword -- -*`fortinet.firewall.snclosest`*:: +*`rsa.misc.rule_uid`*:: + -- -SN of the AP closest to the rogue AP - +This key is the Unique Identifier for a rule. type: keyword -- -*`fortinet.firewall.sndetected`*:: +*`rsa.misc.trigger_desc`*:: + -- -SN of the AP which detected the rogue AP - +This key captures the Description of the trigger or threshold condition. type: keyword -- -*`fortinet.firewall.snmeshparent`*:: +*`rsa.misc.inout`*:: + -- -SN of the mesh parent - - type: keyword -- -*`fortinet.firewall.spi`*:: +*`rsa.misc.p_msgid`*:: + -- -IPSEC SPI - - type: keyword -- -*`fortinet.firewall.src_int`*:: +*`rsa.misc.data_type`*:: + -- -Source interface - - type: keyword -- -*`fortinet.firewall.srcintfrole`*:: +*`rsa.misc.msgIdPart4`*:: + -- -Source interface role - - type: keyword -- -*`fortinet.firewall.srccountry`*:: +*`rsa.misc.error`*:: + -- -Source country - +This key captures All non successful Error codes or responses type: keyword -- -*`fortinet.firewall.srcfamily`*:: +*`rsa.misc.index`*:: + -- -Source family - - type: keyword -- -*`fortinet.firewall.srchwvendor`*:: +*`rsa.misc.listnum`*:: + -- -Source hardware vendor - +This key is used to capture listname or listnumber, primarily for collecting access-list type: keyword -- -*`fortinet.firewall.srchwversion`*:: +*`rsa.misc.ntype`*:: + -- -Source hardware version - - type: keyword -- -*`fortinet.firewall.srcinetsvc`*:: +*`rsa.misc.observed_val`*:: + -- -Source interface service - +This key captures the Value observed (from the perspective of the device generating the log). type: keyword -- -*`fortinet.firewall.srcname`*:: +*`rsa.misc.policy_value`*:: + -- -Source name - +This key captures the contents of the policy. This contains details about the policy type: keyword -- -*`fortinet.firewall.srcserver`*:: +*`rsa.misc.pool_name`*:: + -- -Source server - +This key captures the name of a resource pool -type: integer +type: keyword -- -*`fortinet.firewall.srcssid`*:: +*`rsa.misc.rule_template`*:: + -- -Source SSID - +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template type: keyword -- -*`fortinet.firewall.srcswversion`*:: +*`rsa.misc.count`*:: + -- -Source software version - - type: keyword -- -*`fortinet.firewall.srcuuid`*:: +*`rsa.misc.number`*:: + -- -Source UUID - - type: keyword -- -*`fortinet.firewall.sscname`*:: +*`rsa.misc.sigcat`*:: + -- -SSC name - - type: keyword -- -*`fortinet.firewall.ssid`*:: +*`rsa.misc.type`*:: + -- -Base Service Set ID - - type: keyword -- -*`fortinet.firewall.sslaction`*:: +*`rsa.misc.comments`*:: + -- -SSL Action - +Comment information provided in the log message type: keyword -- -*`fortinet.firewall.ssllocal`*:: +*`rsa.misc.doc_number`*:: + -- -WAD SSL local - +This key captures File Identification number -type: keyword +type: long -- -*`fortinet.firewall.sslremote`*:: +*`rsa.misc.expected_val`*:: + -- -WAD SSL remote - +This key captures the Value expected (from the perspective of the device generating the log). type: keyword -- -*`fortinet.firewall.stacount`*:: +*`rsa.misc.job_num`*:: + -- -Number of stations/clients - +This key captures the Job Number -type: integer +type: keyword -- -*`fortinet.firewall.stage`*:: +*`rsa.misc.spi_dst`*:: + -- -IPSEC stage - +Destination SPI Index type: keyword -- -*`fortinet.firewall.stamac`*:: +*`rsa.misc.spi_src`*:: + -- -802.1x station mac - +Source SPI Index type: keyword -- -*`fortinet.firewall.state`*:: +*`rsa.misc.code`*:: + -- -Admin login state - - type: keyword -- -*`fortinet.firewall.status`*:: +*`rsa.misc.agent_id`*:: + -- -Status - +This key is used to capture agent id type: keyword -- -*`fortinet.firewall.stitch`*:: +*`rsa.misc.message_body`*:: + -- -Automation stitch triggered - +This key captures the The contents of the message body. type: keyword -- -*`fortinet.firewall.subject`*:: +*`rsa.misc.phone`*:: + -- -Email subject - - type: keyword -- -*`fortinet.firewall.submodule`*:: +*`rsa.misc.sig_id_str`*:: + -- -Configuration Sub-Module Name - +This key captures a string object of the sigid variable. type: keyword -- -*`fortinet.firewall.subservice`*:: +*`rsa.misc.cmd`*:: + -- -AV subservice - - type: keyword -- -*`fortinet.firewall.subtype`*:: +*`rsa.misc.misc`*:: + -- -Log subtype +type: keyword +-- +*`rsa.misc.name`*:: ++ +-- type: keyword -- -*`fortinet.firewall.suspicious`*:: +*`rsa.misc.cpu`*:: + -- -Number of Suspicious MMSs - +This key is the CPU time used in the execution of the event being recorded. -type: integer +type: long -- -*`fortinet.firewall.switchproto`*:: +*`rsa.misc.event_desc`*:: + -- -Protocol change information - +This key is used to capture a description of an event available directly or inferred type: keyword -- -*`fortinet.firewall.sync_status`*:: +*`rsa.misc.sig_id1`*:: + -- -The sync status with the master - +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id -type: keyword +type: long -- -*`fortinet.firewall.sync_type`*:: +*`rsa.misc.im_buddyid`*:: + -- -The sync type with the master - - type: keyword -- -*`fortinet.firewall.sysuptime`*:: +*`rsa.misc.im_client`*:: + -- -System uptime - - type: keyword -- -*`fortinet.firewall.tamac`*:: +*`rsa.misc.im_userid`*:: + -- -the MAC address of Transmitter, if none, then Receiver - - type: keyword -- -*`fortinet.firewall.threattype`*:: +*`rsa.misc.pid`*:: + -- -WIDS threat type +type: keyword +-- +*`rsa.misc.priority`*:: ++ +-- type: keyword -- -*`fortinet.firewall.time`*:: +*`rsa.misc.context_subject`*:: + -- -Time of the event - +This key is to be used in an audit context where the subject is the object being identified type: keyword -- -*`fortinet.firewall.to`*:: +*`rsa.misc.context_target`*:: + -- -Email to field - - type: keyword -- -*`fortinet.firewall.to_vcluster`*:: +*`rsa.misc.cve`*:: + -- -destination virtual cluster number - +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. -type: integer +type: keyword -- -*`fortinet.firewall.total`*:: +*`rsa.misc.fcatnum`*:: + -- -Total memory - +This key captures Filter Category Number. Legacy Usage -type: integer +type: keyword -- -*`fortinet.firewall.totalsession`*:: +*`rsa.misc.library`*:: + -- -Total Number of Sessions - +This key is used to capture library information in mainframe devices -type: integer +type: keyword -- -*`fortinet.firewall.trace_id`*:: +*`rsa.misc.parent_node`*:: + -- -Session clash trace ID - +This key captures the Parent Node Name. Must be related to node variable. type: keyword -- -*`fortinet.firewall.trandisp`*:: +*`rsa.misc.risk_info`*:: + -- -NAT translation type - +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`fortinet.firewall.transid`*:: +*`rsa.misc.tcp_flags`*:: + -- -HTTP transaction ID - +This key is captures the TCP flags set in any packet of session -type: integer +type: long -- -*`fortinet.firewall.translationid`*:: +*`rsa.misc.tos`*:: + -- -DNS filter transaltion ID - +This key describes the type of service -type: keyword +type: long -- -*`fortinet.firewall.trigger`*:: +*`rsa.misc.vm_target`*:: + -- -Automation stitch trigger - +VMWare Target **VMWARE** only varaible. type: keyword -- -*`fortinet.firewall.trueclntip`*:: +*`rsa.misc.workspace`*:: + -- -File filter true client IP - +This key captures Workspace Description -type: ip +type: keyword -- -*`fortinet.firewall.tunnelid`*:: +*`rsa.misc.command`*:: + -- -IPSEC tunnel ID - - -type: integer +type: keyword -- -*`fortinet.firewall.tunnelip`*:: +*`rsa.misc.event_category`*:: + -- -IPSEC tunnel IP - - -type: ip +type: keyword -- -*`fortinet.firewall.tunneltype`*:: +*`rsa.misc.facilityname`*:: + -- -IPSEC tunnel type - - type: keyword -- -*`fortinet.firewall.type`*:: +*`rsa.misc.forensic_info`*:: + -- -Module type - - type: keyword -- -*`fortinet.firewall.ui`*:: +*`rsa.misc.jobname`*:: + -- -Admin authentication UI type +type: keyword +-- +*`rsa.misc.mode`*:: ++ +-- type: keyword -- -*`fortinet.firewall.unauthusersource`*:: +*`rsa.misc.policy`*:: + -- -Unauthenticated user source +type: keyword +-- +*`rsa.misc.policy_waiver`*:: ++ +-- type: keyword -- -*`fortinet.firewall.unit`*:: +*`rsa.misc.second`*:: + -- -Power supply unit +type: keyword +-- -type: integer +*`rsa.misc.space1`*:: ++ +-- +type: keyword -- -*`fortinet.firewall.urlfilteridx`*:: +*`rsa.misc.subcategory`*:: + -- -URL filter ID +type: keyword +-- -type: integer +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword -- -*`fortinet.firewall.urlfilterlist`*:: +*`rsa.misc.alert_id`*:: + -- -URL filter list - +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`fortinet.firewall.urlsource`*:: +*`rsa.misc.checksum_dst`*:: + -- -URL filter source - +This key is used to capture the checksum or hash of the the target entity such as a process or file. type: keyword -- -*`fortinet.firewall.urltype`*:: +*`rsa.misc.checksum_src`*:: + -- -URL filter type - +This key is used to capture the checksum or hash of the source entity such as a file or process. type: keyword -- -*`fortinet.firewall.used`*:: +*`rsa.misc.fresult`*:: + -- -Number of Used IPs - +This key captures the Filter Result -type: integer +type: long -- -*`fortinet.firewall.used_for_type`*:: +*`rsa.misc.payload_dst`*:: + -- -Connection for the type - +This key is used to capture destination payload -type: integer +type: keyword -- -*`fortinet.firewall.utmaction`*:: +*`rsa.misc.payload_src`*:: + -- -Security action performed by UTM - +This key is used to capture source payload type: keyword -- -*`fortinet.firewall.vap`*:: +*`rsa.misc.pool_id`*:: + -- -Virtual AP - +This key captures the identifier (typically numeric field) of a resource pool type: keyword -- -*`fortinet.firewall.vapmode`*:: +*`rsa.misc.process_id_val`*:: + -- -Virtual AP mode - +This key is a failure key for Process ID when it is not an integer value type: keyword -- -*`fortinet.firewall.vcluster`*:: +*`rsa.misc.risk_num_comm`*:: + -- -virtual cluster id - +This key captures Risk Number Community -type: integer +type: double -- -*`fortinet.firewall.vcluster_member`*:: +*`rsa.misc.risk_num_next`*:: + -- -Virtual cluster member - +This key captures Risk Number NextGen -type: integer +type: double -- -*`fortinet.firewall.vcluster_state`*:: +*`rsa.misc.risk_num_sand`*:: + -- -Virtual cluster state - +This key captures Risk Number SandBox -type: keyword +type: double -- -*`fortinet.firewall.vd`*:: +*`rsa.misc.risk_num_static`*:: + -- -Virtual Domain Name - +This key captures Risk Number Static -type: keyword +type: double -- -*`fortinet.firewall.vdname`*:: +*`rsa.misc.risk_suspicious`*:: + -- -Virtual Domain Name - +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`fortinet.firewall.vendorurl`*:: +*`rsa.misc.risk_warning`*:: + -- -Vulnerability scan vendor name - +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`fortinet.firewall.version`*:: +*`rsa.misc.snmp_oid`*:: + -- -Version - +SNMP Object Identifier type: keyword -- -*`fortinet.firewall.vip`*:: +*`rsa.misc.sql`*:: + -- -Virtual IP - +This key captures the SQL query type: keyword -- -*`fortinet.firewall.virus`*:: +*`rsa.misc.vuln_ref`*:: + -- -Virus name - +This key captures the Vulnerability Reference details type: keyword -- -*`fortinet.firewall.virusid`*:: +*`rsa.misc.acl_id`*:: + -- -Virus ID (unique virus identifier) - - -type: integer +type: keyword -- -*`fortinet.firewall.voip_proto`*:: +*`rsa.misc.acl_op`*:: + -- -VOIP protocol - - type: keyword -- -*`fortinet.firewall.vpn`*:: +*`rsa.misc.acl_pos`*:: + -- -VPN description - - type: keyword -- -*`fortinet.firewall.vpntunnel`*:: +*`rsa.misc.acl_table`*:: + -- -IPsec Vpn Tunnel Name - - type: keyword -- -*`fortinet.firewall.vpntype`*:: +*`rsa.misc.admin`*:: + -- -The type of the VPN tunnel - - type: keyword -- -*`fortinet.firewall.vrf`*:: +*`rsa.misc.alarm_id`*:: + -- -VRF number - - -type: integer +type: keyword -- -*`fortinet.firewall.vulncat`*:: +*`rsa.misc.alarmname`*:: + -- -Vulnerability Category - - type: keyword -- -*`fortinet.firewall.vulnid`*:: +*`rsa.misc.app_id`*:: + -- -Vulnerability ID - - -type: integer +type: keyword -- -*`fortinet.firewall.vulnname`*:: +*`rsa.misc.audit`*:: + -- -Vulnerability name - - type: keyword -- -*`fortinet.firewall.vwlid`*:: +*`rsa.misc.audit_object`*:: + -- -VWL ID - - -type: integer +type: keyword -- -*`fortinet.firewall.vwlquality`*:: +*`rsa.misc.auditdata`*:: + -- -VWL quality - - type: keyword -- -*`fortinet.firewall.vwlservice`*:: +*`rsa.misc.benchmark`*:: + -- -VWL service - - type: keyword -- -*`fortinet.firewall.vwpvlanid`*:: +*`rsa.misc.bypass`*:: + -- -VWP VLAN ID - - -type: integer +type: keyword -- -*`fortinet.firewall.wanin`*:: +*`rsa.misc.cache`*:: + -- -WAN incoming traffic in bytes - - -type: long +type: keyword -- -*`fortinet.firewall.wanoptapptype`*:: +*`rsa.misc.cache_hit`*:: + -- -WAN Optimization Application type - - type: keyword -- -*`fortinet.firewall.wanout`*:: +*`rsa.misc.cefversion`*:: + -- -WAN outgoing traffic in bytes - - -type: long +type: keyword -- -*`fortinet.firewall.weakwepiv`*:: +*`rsa.misc.cfg_attr`*:: + -- -Weak Wep Initiation Vector - - type: keyword -- -*`fortinet.firewall.xauthgroup`*:: +*`rsa.misc.cfg_obj`*:: + -- -XAuth Group Name - - type: keyword -- -*`fortinet.firewall.xauthuser`*:: +*`rsa.misc.cfg_path`*:: + -- -XAuth User Name - - type: keyword -- -*`fortinet.firewall.xid`*:: +*`rsa.misc.changes`*:: + -- -Wireless X ID - - -type: integer +type: keyword -- -[[exported-fields-googlecloud]] -== Google Cloud fields - -Module for handling logs from Google Cloud. - - - -[float] -=== googlecloud - -Fields from Google Cloud logs. - - - -[float] -=== destination.instance - -If the destination of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project. - - - -*`googlecloud.destination.instance.project_id`*:: +*`rsa.misc.client_ip`*:: + -- -ID of the project containing the VM. - - type: keyword -- -*`googlecloud.destination.instance.region`*:: +*`rsa.misc.clustermembers`*:: + -- -Region of the VM. - - type: keyword -- -*`googlecloud.destination.instance.zone`*:: +*`rsa.misc.cn_acttimeout`*:: + -- -Zone of the VM. - - type: keyword -- -[float] -=== destination.vpc - -If the destination of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project. - - - -*`googlecloud.destination.vpc.project_id`*:: +*`rsa.misc.cn_asn_src`*:: + -- -ID of the project containing the VM. - - type: keyword -- -*`googlecloud.destination.vpc.vpc_name`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- -VPC on which the VM is operating. - - type: keyword -- -*`googlecloud.destination.vpc.subnetwork_name`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -Subnetwork on which the VM is operating. - - type: keyword -- -[float] -=== source.instance - -If the source of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project. - - - -*`googlecloud.source.instance.project_id`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -ID of the project containing the VM. - - type: keyword -- -*`googlecloud.source.instance.region`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -Region of the VM. - - type: keyword -- -*`googlecloud.source.instance.zone`*:: +*`rsa.misc.cn_engine_id`*:: + -- -Zone of the VM. - - type: keyword -- -[float] -=== source.vpc - -If the source of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project. - - - -*`googlecloud.source.vpc.project_id`*:: +*`rsa.misc.cn_engine_type`*:: + -- -ID of the project containing the VM. - - type: keyword -- -*`googlecloud.source.vpc.vpc_name`*:: +*`rsa.misc.cn_f_switch`*:: + -- -VPC on which the VM is operating. - - type: keyword -- -*`googlecloud.source.vpc.subnetwork_name`*:: +*`rsa.misc.cn_flowsampid`*:: + -- -Subnetwork on which the VM is operating. - - type: keyword -- -[float] -=== audit - -Fields for Google Cloud audit logs. - - - -*`googlecloud.audit.type`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- -Type property. - - type: keyword -- -[float] -=== authentication_info - -Authentication information. - - - -*`googlecloud.audit.authentication_info.principal_email`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- -The email address of the authenticated user making the request. - - type: keyword -- -*`googlecloud.audit.authentication_info.authority_selector`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- -The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. - - type: keyword -- -*`googlecloud.audit.authorization_info`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- -Authorization information for the operation. - - -type: array +type: keyword -- -*`googlecloud.audit.method_name`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. - - type: keyword -- -*`googlecloud.audit.num_response_items`*:: +*`rsa.misc.cn_invalid`*:: + -- -The number of items returned from a List or Query API method, if applicable. - - -type: long +type: keyword -- -[float] -=== request - -The operation request. - - - -*`googlecloud.audit.request.proto_name`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -Type property of the request. - - type: keyword -- -*`googlecloud.audit.request.filter`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -Filter of the request. - - type: keyword -- -*`googlecloud.audit.request.name`*:: +*`rsa.misc.cn_l_switch`*:: + -- -Name of the request. - - type: keyword -- -*`googlecloud.audit.request.resource_name`*:: +*`rsa.misc.cn_log_did`*:: + -- -Name of the request resource. - - type: keyword -- -[float] -=== request_metadata - -Metadata about the request. - - - -*`googlecloud.audit.request_metadata.caller_ip`*:: +*`rsa.misc.cn_log_rid`*:: + -- -The IP address of the caller. - - -type: ip +type: keyword -- -*`googlecloud.audit.request_metadata.caller_supplied_user_agent`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -The user agent of the caller. This information is not authenticated and should be treated accordingly. - - type: keyword -- -[float] -=== response - -The operation response. - - - -*`googlecloud.audit.response.proto_name`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -Type property of the response. - - type: keyword -- -[float] -=== details - -The details of the response. - - - -*`googlecloud.audit.response.details.group`*:: +*`rsa.misc.cn_min_ttl`*:: + -- -The name of the group. - - type: keyword -- -*`googlecloud.audit.response.details.kind`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- -The kind of the response details. - - type: keyword -- -*`googlecloud.audit.response.details.name`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- -The name of the response details. - - type: keyword -- -*`googlecloud.audit.response.details.uid`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -The uid of the response details. - - type: keyword -- -*`googlecloud.audit.response.status`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -Status of the response. - - type: keyword -- -*`googlecloud.audit.resource_name`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- -The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. - - type: keyword -- -[float] -=== resource_location - -The location of the resource. - - - -*`googlecloud.audit.resource_location.current_locations`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -Current locations of the resource. - - type: keyword -- -*`googlecloud.audit.service_name`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -The name of the API service performing the operation. For example, datastore.googleapis.com. - - type: keyword -- -[float] -=== status - -The status of the overall operation. - - - -*`googlecloud.audit.status.code`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -The status code, which should be an enum value of google.rpc.Code. - - -type: integer +type: keyword -- -*`googlecloud.audit.status.message`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- -A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. - - type: keyword -- -[float] -=== firewall - -Fields for Google Cloud Firewall logs. - - - -[float] -=== rule_details - -Description of the firewall rule that matched this connection. - - - -*`googlecloud.firewall.rule_details.priority`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -The priority for the firewall rule. - -type: long +type: keyword -- -*`googlecloud.firewall.rule_details.action`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- -Action that the rule performs on match. - type: keyword -- -*`googlecloud.firewall.rule_details.direction`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -Direction of traffic that matches this rule. - type: keyword -- -*`googlecloud.firewall.rule_details.reference`*:: +*`rsa.misc.cn_mplstoplabip`*:: + -- -Reference to the firewall rule. - type: keyword -- -*`googlecloud.firewall.rule_details.source_range`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -List of source ranges that the firewall rule applies to. - type: keyword -- -*`googlecloud.firewall.rule_details.destination_range`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -List of destination ranges that the firewall applies to. - type: keyword -- -*`googlecloud.firewall.rule_details.source_tag`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -List of all the source tags that the firewall rule applies to. - - type: keyword -- -*`googlecloud.firewall.rule_details.target_tag`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -List of all the target tags that the firewall rule applies to. - - type: keyword -- -*`googlecloud.firewall.rule_details.ip_port_info`*:: +*`rsa.misc.cn_sampint`*:: + -- -List of ip protocols and applicable port ranges for rules. - - -type: array +type: keyword -- -*`googlecloud.firewall.rule_details.source_service_account`*:: +*`rsa.misc.cn_seqctr`*:: + -- -List of all the source service accounts that the firewall rule applies to. - - type: keyword -- -*`googlecloud.firewall.rule_details.target_service_account`*:: +*`rsa.misc.cn_spackets`*:: + -- -List of all the target service accounts that the firewall rule applies to. - - type: keyword -- -[float] -=== vpcflow - -Fields for Google Cloud VPC flow logs. - - - -*`googlecloud.vpcflow.reporter`*:: +*`rsa.misc.cn_src_tos`*:: + -- -The side which reported the flow. Can be either 'SRC' or 'DEST'. - - type: keyword -- -*`googlecloud.vpcflow.rtt.ms`*:: +*`rsa.misc.cn_src_vlan`*:: + -- -Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. - - -type: long +type: keyword -- -[[exported-fields-gsuite]] -== gsuite fields - -gsuite Module - - - -[float] -=== gsuite - -Gsuite specific fields. -More information about specific fields can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list - - - -*`gsuite.actor.type`*:: +*`rsa.misc.cn_sysuptime`*:: + -- -The type of actor. -Values can be: - *USER*: Another user in the same domain. - *EXTERNAL_USER*: A user outside the domain. - *KEY*: A non-human actor. - - type: keyword -- -*`gsuite.actor.key`*:: +*`rsa.misc.cn_template_id`*:: + -- -Only present when `actor.type` is `KEY`. Can be the `consumer_key` of the requestor for OAuth 2LO API requests or an identifier for robot accounts. - - type: keyword -- -*`gsuite.event.type`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- -The type of GSuite event, mapped from `items[].events[].type` in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list - - type: keyword -example: audit#activity - -- -*`gsuite.kind`*:: +*`rsa.misc.cn_totflowexp`*:: + -- -The type of API resource, mapped from `kind` in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list - - type: keyword -example: audit#activity - -- -*`gsuite.organization.domain`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- -The domain that is affected by the report's event. - - type: keyword -- - -*`gsuite.admin.application.edition`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- -The GSuite edition. - type: keyword -- -*`gsuite.admin.application.name`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- -The application's name. - type: keyword -- -*`gsuite.admin.application.enabled`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- -The enabled application. - type: keyword -- -*`gsuite.admin.application.licences_order_number`*:: +*`rsa.misc.comp_class`*:: + -- -Order number used to redeem licenses. - type: keyword -- -*`gsuite.admin.application.licences_purchased`*:: +*`rsa.misc.comp_name`*:: + -- -Number of licences purchased. - type: keyword -- -*`gsuite.admin.application.id`*:: +*`rsa.misc.comp_rbytes`*:: + -- -The application ID. - type: keyword -- -*`gsuite.admin.application.asp_id`*:: +*`rsa.misc.comp_sbytes`*:: + -- -The application specific password ID. - type: keyword -- -*`gsuite.admin.application.package_id`*:: +*`rsa.misc.cpu_data`*:: + -- -The mobile application package ID. - type: keyword -- -*`gsuite.admin.group.email`*:: +*`rsa.misc.criticality`*:: + -- -The group's primary email address. - type: keyword -- -*`gsuite.admin.new_value`*:: +*`rsa.misc.cs_agency_dst`*:: + -- -The new value for the setting. - type: keyword -- -*`gsuite.admin.old_value`*:: +*`rsa.misc.cs_analyzedby`*:: + -- -The old value for the setting. - type: keyword -- -*`gsuite.admin.org_unit.name`*:: +*`rsa.misc.cs_av_other`*:: + -- -The organizational unit name. - type: keyword -- -*`gsuite.admin.org_unit.full`*:: +*`rsa.misc.cs_av_primary`*:: + -- -The org unit full path including the root org unit name. - type: keyword -- -*`gsuite.admin.setting.name`*:: +*`rsa.misc.cs_av_secondary`*:: + -- -The setting name. - type: keyword -- -*`gsuite.admin.user_defined_setting.name`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- -The name of the user-defined setting. - type: keyword -- -*`gsuite.admin.setting.description`*:: +*`rsa.misc.cs_bit9status`*:: + -- -The setting name. - type: keyword -- -*`gsuite.admin.group.priorities`*:: +*`rsa.misc.cs_context`*:: + -- -Group priorities. - type: keyword -- -*`gsuite.admin.domain.alias`*:: +*`rsa.misc.cs_control`*:: + -- -The domain alias. - type: keyword -- -*`gsuite.admin.domain.name`*:: +*`rsa.misc.cs_data`*:: + -- -The primary domain name. - type: keyword -- -*`gsuite.admin.domain.secondary_name`*:: +*`rsa.misc.cs_datecret`*:: + -- -The secondary domain name. - type: keyword -- -*`gsuite.admin.managed_configuration`*:: +*`rsa.misc.cs_dst_tld`*:: + -- -The name of the managed configuration. - type: keyword -- -*`gsuite.admin.non_featured_services_selection`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- -Non-featured services selection. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings#FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED - - type: keyword -- -*`gsuite.admin.field`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -The name of the field. - type: keyword -- -*`gsuite.admin.resource.id`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -The name of the resource identifier. - type: keyword -- -*`gsuite.admin.user.email`*:: +*`rsa.misc.cs_filetype`*:: + -- -The user's primary email address. - type: keyword -- -*`gsuite.admin.user.nickname`*:: +*`rsa.misc.cs_fld`*:: + -- -The user's nickname. - type: keyword -- -*`gsuite.admin.user.birthdate`*:: +*`rsa.misc.cs_if_desc`*:: + -- -The user's birth date. - -type: date +type: keyword -- -*`gsuite.admin.gateway.name`*:: +*`rsa.misc.cs_if_name`*:: + -- -Gateway name. Present on some chat settings. - type: keyword -- -*`gsuite.admin.chrome_os.session_type`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -Chrome OS session type. - type: keyword -- -*`gsuite.admin.device.serial_number`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- -Device serial number. - type: keyword -- -*`gsuite.admin.device.id`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- type: keyword -- -*`gsuite.admin.device.type`*:: +*`rsa.misc.cs_lifetime`*:: + -- -Device type. - type: keyword -- -*`gsuite.admin.print_server.name`*:: +*`rsa.misc.cs_log_medium`*:: + -- -The name of the print server. - type: keyword -- -*`gsuite.admin.printer.name`*:: +*`rsa.misc.cs_loginname`*:: + -- -The name of the printer. - type: keyword -- -*`gsuite.admin.device.command_details`*:: +*`rsa.misc.cs_modulescore`*:: + -- -Command details. - type: keyword -- -*`gsuite.admin.role.id`*:: +*`rsa.misc.cs_modulesign`*:: + -- -Unique identifier for this role privilege. - type: keyword -- -*`gsuite.admin.role.name`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -The role name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings - - type: keyword -- -*`gsuite.admin.privilege.name`*:: +*`rsa.misc.cs_payload`*:: + -- -Privilege name. - type: keyword -- -*`gsuite.admin.service.name`*:: +*`rsa.misc.cs_registrant`*:: + -- -The service name. - type: keyword -- -*`gsuite.admin.url.name`*:: +*`rsa.misc.cs_registrar`*:: + -- -The website name. - type: keyword -- -*`gsuite.admin.product.name`*:: +*`rsa.misc.cs_represult`*:: + -- -The product name. - type: keyword -- -*`gsuite.admin.product.sku`*:: +*`rsa.misc.cs_rpayload`*:: + -- -The product SKU. - type: keyword -- -*`gsuite.admin.bulk_upload.failed`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -Number of failed records in bulk upload operation. - -type: long +type: keyword -- -*`gsuite.admin.bulk_upload.total`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -Number of total records in bulk upload operation. - -type: long +type: keyword -- -*`gsuite.admin.group.allowed_list`*:: +*`rsa.misc.cs_streams`*:: + -- -Names of allow-listed groups. - type: keyword -- -*`gsuite.admin.email.quarantine_name`*:: +*`rsa.misc.cs_targetmodule`*:: + -- -The name of the quarantine. - type: keyword -- -*`gsuite.admin.email.log_search_filter.message_id`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -The log search filter's email message ID. - type: keyword -- -*`gsuite.admin.email.log_search_filter.start_date`*:: +*`rsa.misc.cs_whois_server`*:: + -- -The log search filter's start date. - -type: date +type: keyword -- -*`gsuite.admin.email.log_search_filter.end_date`*:: +*`rsa.misc.cs_yararesult`*:: + -- -The log search filter's ending date. - -type: date +type: keyword -- -*`gsuite.admin.email.log_search_filter.recipient.value`*:: +*`rsa.misc.description`*:: + -- -The log search filter's email recipient. - type: keyword -- -*`gsuite.admin.email.log_search_filter.sender.value`*:: +*`rsa.misc.devvendor`*:: + -- -The log search filter's email sender. - type: keyword -- -*`gsuite.admin.email.log_search_filter.recipient.ip`*:: +*`rsa.misc.distance`*:: + -- -The log search filter's email recipient's IP address. - -type: ip +type: keyword -- -*`gsuite.admin.email.log_search_filter.sender.ip`*:: +*`rsa.misc.dstburb`*:: + -- -The log search filter's email sender's IP address. - -type: ip +type: keyword -- -*`gsuite.admin.chrome_licenses.enabled`*:: +*`rsa.misc.edomain`*:: + -- -Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings - - type: keyword -- -*`gsuite.admin.chrome_licenses.allowed`*:: +*`rsa.misc.edomaub`*:: + -- -Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings - - type: keyword -- -*`gsuite.admin.oauth2.service.name`*:: +*`rsa.misc.euid`*:: + -- -OAuth2 service name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings - - type: keyword -- -*`gsuite.admin.oauth2.application.id`*:: +*`rsa.misc.facility`*:: + -- -OAuth2 application ID. - type: keyword -- -*`gsuite.admin.oauth2.application.name`*:: +*`rsa.misc.finterface`*:: + -- -OAuth2 application name. - type: keyword -- -*`gsuite.admin.oauth2.application.type`*:: +*`rsa.misc.flags`*:: + -- -OAuth2 application type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings - - type: keyword -- -*`gsuite.admin.verification_method`*:: +*`rsa.misc.gaddr`*:: + -- -Related verification method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings and https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings - - type: keyword -- -*`gsuite.admin.alert.name`*:: +*`rsa.misc.id3`*:: + -- -The alert name. - type: keyword -- -*`gsuite.admin.rule.name`*:: +*`rsa.misc.im_buddyname`*:: + -- -The rule name. - type: keyword -- -*`gsuite.admin.api.client.name`*:: +*`rsa.misc.im_croomid`*:: + -- -The API client name. - type: keyword -- -*`gsuite.admin.api.scopes`*:: +*`rsa.misc.im_croomtype`*:: + -- -The API scopes. - type: keyword -- -*`gsuite.admin.mdm.token`*:: +*`rsa.misc.im_members`*:: + -- -The MDM vendor enrollment token. - type: keyword -- -*`gsuite.admin.mdm.vendor`*:: +*`rsa.misc.im_username`*:: + -- -The MDM vendor's name. - type: keyword -- -*`gsuite.admin.info_type`*:: +*`rsa.misc.ipkt`*:: + -- -This will be used to state what kind of information was changed. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings - - type: keyword -- -*`gsuite.admin.email_monitor.dest_email`*:: +*`rsa.misc.ipscat`*:: + -- -The destination address of the email monitor. - type: keyword -- -*`gsuite.admin.email_monitor.level.chat`*:: +*`rsa.misc.ipspri`*:: + -- -The chat email monitor level. - type: keyword -- -*`gsuite.admin.email_monitor.level.draft`*:: +*`rsa.misc.latitude`*:: + -- -The draft email monitor level. - type: keyword -- -*`gsuite.admin.email_monitor.level.incoming`*:: +*`rsa.misc.linenum`*:: + -- -The incoming email monitor level. - type: keyword -- -*`gsuite.admin.email_monitor.level.outgoing`*:: +*`rsa.misc.list_name`*:: + -- -The outgoing email monitor level. - type: keyword -- -*`gsuite.admin.email_dump.include_deleted`*:: +*`rsa.misc.load_data`*:: + -- -Indicates if deleted emails are included in the export. - -type: boolean +type: keyword -- -*`gsuite.admin.email_dump.package_content`*:: +*`rsa.misc.location_floor`*:: + -- -The contents of the mailbox package. - type: keyword -- -*`gsuite.admin.email_dump.query`*:: +*`rsa.misc.location_mark`*:: + -- -The search query used for the dump. - type: keyword -- -*`gsuite.admin.request.id`*:: +*`rsa.misc.log_id`*:: + -- -The request ID. - type: keyword -- -*`gsuite.admin.mobile.action.id`*:: +*`rsa.misc.log_type`*:: + -- -The mobile device action's ID. - type: keyword -- -*`gsuite.admin.mobile.action.type`*:: +*`rsa.misc.logid`*:: + -- -The mobile device action's type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings - - type: keyword -- -*`gsuite.admin.mobile.certificate.name`*:: +*`rsa.misc.logip`*:: + -- -The mobile certificate common name. - type: keyword -- -*`gsuite.admin.mobile.company_owned_devices`*:: +*`rsa.misc.logname`*:: + -- -The number of devices a company owns. - -type: long +type: keyword -- -*`gsuite.admin.distribution.entity.name`*:: +*`rsa.misc.longitude`*:: + -- -The distribution entity value, which can be a group name or an org-unit name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings - - type: keyword -- -*`gsuite.admin.distribution.entity.type`*:: +*`rsa.misc.lport`*:: + -- -The distribution entity type, which can be a group or an org-unit. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings - - type: keyword -- - -*`gsuite.drive.billable`*:: +*`rsa.misc.mbug_data`*:: + -- -Whether this activity is billable. - -type: boolean +type: keyword -- -*`gsuite.drive.source_folder_id`*:: +*`rsa.misc.misc_name`*:: + -- type: keyword -- -*`gsuite.drive.source_folder_title`*:: +*`rsa.misc.msg_type`*:: + -- type: keyword -- -*`gsuite.drive.destination_folder_id`*:: +*`rsa.misc.msgid`*:: + -- type: keyword -- -*`gsuite.drive.destination_folder_title`*:: +*`rsa.misc.netsessid`*:: + -- type: keyword -- -*`gsuite.drive.file.id`*:: +*`rsa.misc.num`*:: + -- type: keyword -- -*`gsuite.drive.file.type`*:: +*`rsa.misc.number1`*:: + -- -Document Drive type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.originating_app_id`*:: +*`rsa.misc.number2`*:: + -- -The Google Cloud Project ID of the application that performed the action. - - type: keyword -- -*`gsuite.drive.file.owner.email`*:: +*`rsa.misc.nwwn`*:: + -- type: keyword -- -*`gsuite.drive.file.owner.is_shared_drive`*:: +*`rsa.misc.object`*:: + -- -Boolean flag denoting whether owner is a shared drive. - - -type: boolean +type: keyword -- -*`gsuite.drive.primary_event`*:: +*`rsa.misc.operation`*:: + -- -Whether this is a primary event. A single user action in Drive may generate several events. - - -type: boolean +type: keyword -- -*`gsuite.drive.shared_drive_id`*:: +*`rsa.misc.opkt`*:: + -- -The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. - - type: keyword -- -*`gsuite.drive.visibility`*:: +*`rsa.misc.orig_from`*:: + -- -Visibility of target file. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.new_value`*:: +*`rsa.misc.owner_id`*:: + -- -When a setting or property of the file changes, the new value for it will appear here. - - type: keyword -- -*`gsuite.drive.old_value`*:: +*`rsa.misc.p_action`*:: + -- -When a setting or property of the file changes, the old value for it will appear here. - - type: keyword -- -*`gsuite.drive.sheets_import_range_recipient_doc`*:: +*`rsa.misc.p_filter`*:: + -- -Doc ID of the recipient of a sheets import range. - type: keyword -- -*`gsuite.drive.old_visibility`*:: +*`rsa.misc.p_group_object`*:: + -- -When visibility changes, this holds the old value. - - type: keyword -- -*`gsuite.drive.visibility_change`*:: +*`rsa.misc.p_id`*:: + -- -When visibility changes, this holds the new overall visibility of the file. - - type: keyword -- -*`gsuite.drive.target_domain`*:: +*`rsa.misc.p_msgid1`*:: + -- -The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. - - type: keyword -- -*`gsuite.drive.added_role`*:: +*`rsa.misc.p_msgid2`*:: + -- -Added membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.membership_change_type`*:: +*`rsa.misc.p_result1`*:: + -- -Type of change in Team Drive membership of a user/group. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.shared_drive_settings_change_type`*:: +*`rsa.misc.password_chg`*:: + -- -Type of change in Team Drive settings. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.removed_role`*:: +*`rsa.misc.password_expire`*:: + -- -Removed membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive - - type: keyword -- -*`gsuite.drive.target`*:: +*`rsa.misc.permgranted`*:: + -- -Target user or group. - type: keyword -- - -*`gsuite.groups.acl_permission`*:: +*`rsa.misc.permwanted`*:: + -- -Group permission setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - - type: keyword -- -*`gsuite.groups.email`*:: +*`rsa.misc.pgid`*:: + -- -Group email. - - type: keyword -- -*`gsuite.groups.member.email`*:: +*`rsa.misc.policyUUID`*:: + -- -Member email. - - type: keyword -- -*`gsuite.groups.member.role`*:: +*`rsa.misc.prog_asp_num`*:: + -- -Member role. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - - type: keyword -- -*`gsuite.groups.setting`*:: +*`rsa.misc.program`*:: + -- -Group setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - - type: keyword -- -*`gsuite.groups.new_value`*:: +*`rsa.misc.real_data`*:: + -- -New value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - - type: keyword -- -*`gsuite.groups.old_value`*:: +*`rsa.misc.rec_asp_device`*:: + -- -Old value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - type: keyword -- -*`gsuite.groups.value`*:: +*`rsa.misc.rec_asp_num`*:: + -- -Value of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups - - type: keyword -- -*`gsuite.groups.message.id`*:: +*`rsa.misc.rec_library`*:: + -- -SMTP message Id of an email message. Present for moderation events. - - type: keyword -- -*`gsuite.groups.message.moderation_action`*:: +*`rsa.misc.recordnum`*:: + -- -Message moderation action. Possible values are `approved` and `rejected`. - - type: keyword -- -*`gsuite.groups.status`*:: +*`rsa.misc.ruid`*:: + -- -A status describing the output of an operation. Possible values are `failed` and `succeeded`. - - type: keyword -- - -*`gsuite.login.affected_email_address`*:: +*`rsa.misc.sburb`*:: + -- type: keyword -- -*`gsuite.login.challenge_method`*:: +*`rsa.misc.sdomain_fld`*:: + -- -Login challenge method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. - - type: keyword -- -*`gsuite.login.failure_type`*:: +*`rsa.misc.sec`*:: + -- -Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. - - type: keyword -- -*`gsuite.login.type`*:: +*`rsa.misc.sensorname`*:: + -- -Login credentials type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. - - type: keyword -- -*`gsuite.login.is_second_factor`*:: +*`rsa.misc.seqnum`*:: + -- -type: boolean +type: keyword -- -*`gsuite.login.is_suspicious`*:: +*`rsa.misc.session`*:: + -- -type: boolean +type: keyword -- - -*`gsuite.saml.application_name`*:: +*`rsa.misc.sessiontype`*:: + -- -Saml SP application name. - - type: keyword -- -*`gsuite.saml.failure_type`*:: +*`rsa.misc.sigUUID`*:: + -- -Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/saml. - - type: keyword -- -*`gsuite.saml.initiated_by`*:: +*`rsa.misc.spi`*:: + -- -Requester of SAML authentication. - - type: keyword -- -*`gsuite.saml.orgunit_path`*:: +*`rsa.misc.srcburb`*:: + -- -User orgunit. - - type: keyword -- -*`gsuite.saml.status_code`*:: +*`rsa.misc.srcdom`*:: + -- -SAML status code. - - -type: long +type: keyword -- -*`gsuite.saml.second_level_status_code`*:: +*`rsa.misc.srcservice`*:: + -- -SAML second level status code. - - -type: long +type: keyword -- -[[exported-fields-haproxy]] -== HAProxy fields - -haproxy Module - - - -[float] -=== haproxy - - - - -*`haproxy.frontend_name`*:: +*`rsa.misc.state`*:: + -- -Name of the frontend (or listener) which received and processed the connection. +type: keyword -- -*`haproxy.backend_name`*:: +*`rsa.misc.status1`*:: + -- -Name of the backend (or listener) which was selected to manage the connection to the server. +type: keyword -- -*`haproxy.server_name`*:: +*`rsa.misc.svcno`*:: + -- -Name of the last server to which the connection was sent. +type: keyword -- -*`haproxy.total_waiting_time_ms`*:: +*`rsa.misc.system`*:: + -- -Total time in milliseconds spent waiting in the various queues - -type: long +type: keyword -- -*`haproxy.connection_wait_time_ms`*:: +*`rsa.misc.tbdstr1`*:: + -- -Total time in milliseconds spent waiting for the connection to establish to the final server - -type: long +type: keyword -- -*`haproxy.bytes_read`*:: +*`rsa.misc.tgtdom`*:: + -- -Total number of bytes transmitted to the client when the log is emitted. - -type: long +type: keyword -- -*`haproxy.time_queue`*:: +*`rsa.misc.tgtdomain`*:: + -- -Total time in milliseconds spent waiting in the various queues. - -type: long +type: keyword -- -*`haproxy.time_backend_connect`*:: +*`rsa.misc.threshold`*:: + -- -Total time in milliseconds spent waiting for the connection to establish to the final server, including retries. - -type: long +type: keyword -- -*`haproxy.server_queue`*:: +*`rsa.misc.type1`*:: + -- -Total number of requests which were processed before this one in the server queue. - -type: long +type: keyword -- -*`haproxy.backend_queue`*:: +*`rsa.misc.udb_class`*:: + -- -Total number of requests which were processed before this one in the backend's global queue. - -type: long +type: keyword -- -*`haproxy.bind_name`*:: +*`rsa.misc.url_fld`*:: + -- -Name of the listening address which received the connection. +type: keyword -- -*`haproxy.error_message`*:: +*`rsa.misc.user_div`*:: + -- -Error message logged by HAProxy in case of error. - -type: text +type: keyword -- -*`haproxy.source`*:: +*`rsa.misc.userid`*:: + -- -The HAProxy source of the log - type: keyword -- -*`haproxy.termination_state`*:: +*`rsa.misc.username_fld`*:: + -- -Condition the session was in when the session ended. +type: keyword -- -*`haproxy.mode`*:: +*`rsa.misc.utcstamp`*:: + -- -mode that the frontend is operating (TCP or HTTP) - type: keyword -- -[float] -=== connections - -Contains various counts of connections active in the process. - - -*`haproxy.connections.active`*:: +*`rsa.misc.v_instafname`*:: + -- -Total number of concurrent connections on the process when the session was logged. - -type: long +type: keyword -- -*`haproxy.connections.frontend`*:: +*`rsa.misc.virt_data`*:: + -- -Total number of concurrent connections on the frontend when the session was logged. - -type: long +type: keyword -- -*`haproxy.connections.backend`*:: +*`rsa.misc.vpnid`*:: + -- -Total number of concurrent connections handled by the backend when the session was logged. - -type: long +type: keyword -- -*`haproxy.connections.server`*:: +*`rsa.misc.autorun_type`*:: + -- -Total number of concurrent connections still active on the server when the session was logged. +This is used to capture Auto Run type -type: long +type: keyword -- -*`haproxy.connections.retries`*:: +*`rsa.misc.cc_number`*:: + -- -Number of connection retries experienced by this session when trying to connect to the server. +Valid Credit Card Numbers only type: long -- -[float] -=== client - -Information about the client doing the request - - -*`haproxy.client.ip`*:: +*`rsa.misc.content`*:: + -- -type: alias +This key captures the content type from protocol headers -alias to: source.address +type: keyword -- -*`haproxy.client.port`*:: +*`rsa.misc.ein_number`*:: + -- -type: alias +Employee Identification Numbers only -alias to: source.port +type: long -- -*`haproxy.process_name`*:: +*`rsa.misc.found`*:: + -- -type: alias +This is used to capture the results of regex match -alias to: process.name +type: keyword -- -*`haproxy.pid`*:: +*`rsa.misc.language`*:: + -- -type: alias +This is used to capture list of languages the client support and what it prefers -alias to: process.pid +type: keyword -- -[float] -=== destination - -Destination information - - -*`haproxy.destination.port`*:: +*`rsa.misc.lifetime`*:: + -- -type: alias +This key is used to capture the session lifetime in seconds. -alias to: destination.port +type: long -- -*`haproxy.destination.ip`*:: +*`rsa.misc.link`*:: + -- -type: alias +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -alias to: destination.ip +type: keyword -- -[float] -=== geoip - -Contains GeoIP information gathered based on the client.ip field. Only present if the GeoIP Elasticsearch plugin is available and used. - - - -*`haproxy.geoip.continent_name`*:: +*`rsa.misc.match`*:: + -- -type: alias +This key is for regex match name from search.ini -alias to: source.geo.continent_name +type: keyword -- -*`haproxy.geoip.country_iso_code`*:: +*`rsa.misc.param_dst`*:: + -- -type: alias +This key captures the command line/launch argument of the target process or file -alias to: source.geo.country_iso_code +type: keyword -- -*`haproxy.geoip.location`*:: +*`rsa.misc.param_src`*:: + -- -type: alias +This key captures source parameter -alias to: source.geo.location +type: keyword -- -*`haproxy.geoip.region_name`*:: +*`rsa.misc.search_text`*:: + -- -type: alias +This key captures the Search Text used -alias to: source.geo.region_name +type: keyword -- -*`haproxy.geoip.city_name`*:: +*`rsa.misc.sig_name`*:: + -- -type: alias +This key is used to capture the Signature Name only. -alias to: source.geo.city_name +type: keyword -- -*`haproxy.geoip.region_iso_code`*:: +*`rsa.misc.snmp_value`*:: + -- -type: alias +SNMP set request value -alias to: source.geo.region_iso_code +type: keyword -- -[float] -=== http - -Please add description - +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session -[float] -=== response +type: long -Fields related to the HTTP response +-- -*`haproxy.http.response.captured_cookie`*:: +*`rsa.db.index`*:: + -- -Optional "name=value" entry indicating that the client had this cookie in the response. +This key captures IndexID of the index. +type: keyword -- -*`haproxy.http.response.captured_headers`*:: +*`rsa.db.instance`*:: + -- -List of headers captured in the response due to the presence of the "capture response header" statement in the frontend. - +This key is used to capture the database server instance name type: keyword -- -*`haproxy.http.response.status_code`*:: +*`rsa.db.database`*:: + -- -type: alias +This key is used to capture the name of a database or an instance as seen in a session -alias to: http.response.status_code +type: keyword -- -[float] -=== request +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session -Fields related to the HTTP request +type: keyword +-- -*`haproxy.http.request.captured_cookie`*:: +*`rsa.db.permissions`*:: + -- -Optional "name=value" entry indicating that the server has returned a cookie with its request. +This key captures permission or privilege level assigned to a resource. +type: keyword -- -*`haproxy.http.request.captured_headers`*:: +*`rsa.db.table_name`*:: + -- -List of headers captured in the request due to the presence of the "capture request header" statement in the frontend. - +This key is used to capture the table name type: keyword -- -*`haproxy.http.request.raw_request_line`*:: +*`rsa.db.db_id`*:: + -- -Complete HTTP request line, including the method, request and HTTP version string. +This key is used to capture the unique identifier for a database type: keyword -- -*`haproxy.http.request.time_wait_without_data_ms`*:: +*`rsa.db.db_pid`*:: + -- -Total time in milliseconds spent waiting for the server to send a full HTTP response, not counting data. +This key captures the process id of a connection with database server type: long -- -*`haproxy.http.request.time_wait_ms`*:: +*`rsa.db.lread`*:: + -- -Total time in milliseconds spent waiting for a full HTTP request from the client (not counting body) after the first byte was received. +This key is used for the number of logical reads type: long -- -[float] -=== tcp - -TCP log format - - -*`haproxy.tcp.connection_waiting_time_ms`*:: +*`rsa.db.lwrite`*:: + -- -Total time in milliseconds elapsed between the accept and the last close +This key is used for the number of logical writes type: long -- -[[exported-fields-host-processor]] -== Host fields - -Info collected for the host machine. +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes +type: long +-- -*`host.containerized`*:: +*`rsa.network.alias_host`*:: + -- -If the host is a container. - +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. -type: boolean +type: keyword -- -*`host.os.build`*:: +*`rsa.network.domain`*:: + -- -OS build information. - - type: keyword -example: 18D109 - -- -*`host.os.codename`*:: +*`rsa.network.host_dst`*:: + -- -OS codename, if any. - +This key should only be used when it’s a Destination Hostname type: keyword -example: stretch - -- -[[exported-fields-ibmmq]] -== ibmmq fields - -ibmmq Module - - - -[float] -=== ibmmq - +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names +type: keyword +-- -[float] -=== errorlog +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear -IBM MQ error logs +type: keyword +-- -*`ibmmq.errorlog.installation`*:: +*`rsa.network.network_port`*:: + -- -This is the installation name which can be given at installation time. -Each installation of IBM MQ on UNIX, Linux, and Windows, has a unique identifier known as an installation name. The installation name is used to associate things such as queue managers and configuration files with an installation. - +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) -type: keyword +type: long -- -*`ibmmq.errorlog.qmgr`*:: +*`rsa.network.eth_host`*:: + -- -Name of the queue manager. Queue managers provide queuing services to applications, and manages the queues that belong to them. - +Deprecated, use alias.mac type: keyword -- -*`ibmmq.errorlog.arithinsert`*:: +*`rsa.network.sinterface`*:: + -- -Changing content based on error.id +This key should only be used when it’s a Source Interface type: keyword -- -*`ibmmq.errorlog.commentinsert`*:: +*`rsa.network.dinterface`*:: + -- -Changing content based on error.id +This key should only be used when it’s a Destination Interface type: keyword -- -*`ibmmq.errorlog.errordescription`*:: +*`rsa.network.vlan`*:: + -- -Please add description - -type: text +This key should only be used to capture the ID of the Virtual LAN -example: Please add example +type: long -- -*`ibmmq.errorlog.explanation`*:: +*`rsa.network.zone_src`*:: + -- -Explaines the error in more detail +This key should only be used when it’s a Source Zone. type: keyword -- -*`ibmmq.errorlog.action`*:: +*`rsa.network.zone`*:: + -- -Defines what to do when the error occurs +This key should be used when the source or destination context of a Zone is not clear type: keyword -- -*`ibmmq.errorlog.code`*:: +*`rsa.network.zone_dst`*:: + -- -Error code. +This key should only be used when it’s a Destination Zone. type: keyword -- -[[exported-fields-icinga]] -== Icinga fields - -Icinga Module - - - -[float] -=== icinga - - - - -[float] -=== debug - -Contains fields for the Icinga debug logs. - - - -*`icinga.debug.facility`*:: +*`rsa.network.gateway`*:: + -- -Specifies what component of Icinga logged the message. - +This key is used to capture the IP Address of the gateway type: keyword -- -*`icinga.debug.severity`*:: +*`rsa.network.icmp_type`*:: + -- -type: alias +This key is used to capture the ICMP type only -alias to: log.level +type: long -- -*`icinga.debug.message`*:: +*`rsa.network.mask`*:: + -- -type: alias +This key is used to capture the device network IPmask. -alias to: message +type: keyword -- -[float] -=== main - -Contains fields for the Icinga main logs. +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only +type: long +-- -*`icinga.main.facility`*:: +*`rsa.network.protocol_detail`*:: + -- -Specifies what component of Icinga logged the message. - +This key should be used to capture additional protocol information type: keyword -- -*`icinga.main.severity`*:: +*`rsa.network.dmask`*:: + -- -type: alias +This key is used for Destionation Device network mask -alias to: log.level +type: keyword -- -*`icinga.main.message`*:: +*`rsa.network.port`*:: + -- -type: alias +This key should only be used to capture a Network Port when the directionality is not clear -alias to: message +type: long -- -[float] -=== startup - -Contains fields for the Icinga startup logs. - - - -*`icinga.startup.facility`*:: +*`rsa.network.smask`*:: + -- -Specifies what component of Icinga logged the message. - +This key is used for capturing source Network Mask type: keyword -- -*`icinga.startup.severity`*:: +*`rsa.network.netname`*:: + -- -type: alias +This key is used to capture the network name associated with an IP range. This is configured by the end user. -alias to: log.level +type: keyword -- -*`icinga.startup.message`*:: +*`rsa.network.paddr`*:: + -- -type: alias +Deprecated -alias to: message +type: ip -- -[[exported-fields-iis]] -== IIS fields - -Module for parsing IIS log files. - - - -[float] -=== iis +*`rsa.network.faddr`*:: ++ +-- +type: keyword -Fields from IIS log files. +-- +*`rsa.network.lhost`*:: ++ +-- +type: keyword +-- -[float] -=== access +*`rsa.network.origin`*:: ++ +-- +type: keyword -Contains fields for IIS access logs. +-- +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword +-- -*`iis.access.sub_status`*:: +*`rsa.network.addr`*:: + -- -The HTTP substatus code. +type: keyword +-- -type: long +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword -- -*`iis.access.win32_status`*:: +*`rsa.network.dns_ptr_record`*:: + -- -The Windows status code. +type: keyword +-- -type: long +*`rsa.network.fhost`*:: ++ +-- +type: keyword -- -*`iis.access.site_name`*:: +*`rsa.network.fport`*:: + -- -The site name and instance number. +type: keyword +-- +*`rsa.network.laddr`*:: ++ +-- type: keyword -- -*`iis.access.server_name`*:: +*`rsa.network.linterface`*:: + -- -The name of the server on which the log file entry was generated. +type: keyword +-- +*`rsa.network.phost`*:: ++ +-- type: keyword -- -*`iis.access.cookie`*:: +*`rsa.network.ad_computer_dst`*:: + -- -The content of the cookie sent or received, if any. - +Deprecated, use host.dst type: keyword -- -*`iis.access.body_received.bytes`*:: +*`rsa.network.eth_type`*:: + -- -type: alias +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only -alias to: http.request.body.bytes +type: long -- -*`iis.access.body_sent.bytes`*:: +*`rsa.network.ip_proto`*:: + -- -type: alias +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI -alias to: http.response.body.bytes +type: long -- -*`iis.access.server_ip`*:: +*`rsa.network.dns_cname_record`*:: + -- -type: alias - -alias to: destination.address +type: keyword -- -*`iis.access.method`*:: +*`rsa.network.dns_id`*:: + -- -type: alias - -alias to: http.request.method +type: keyword -- -*`iis.access.url`*:: +*`rsa.network.dns_opcode`*:: + -- -type: alias - -alias to: url.path +type: keyword -- -*`iis.access.query_string`*:: +*`rsa.network.dns_resp`*:: + -- -type: alias - -alias to: url.query +type: keyword -- -*`iis.access.port`*:: +*`rsa.network.dns_type`*:: + -- -type: alias - -alias to: destination.port +type: keyword -- -*`iis.access.user_name`*:: +*`rsa.network.domain1`*:: + -- -type: alias - -alias to: user.name +type: keyword -- -*`iis.access.remote_ip`*:: +*`rsa.network.host_type`*:: + -- -type: alias - -alias to: source.address +type: keyword -- -*`iis.access.referrer`*:: +*`rsa.network.packet_length`*:: + -- -type: alias - -alias to: http.request.referrer +type: keyword -- -*`iis.access.response_code`*:: +*`rsa.network.host_orig`*:: + -- -type: alias +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. -alias to: http.response.status_code +type: keyword -- -*`iis.access.http_version`*:: +*`rsa.network.rpayload`*:: + -- -type: alias +This key is used to capture the total number of payload bytes seen in the retransmitted packets. -alias to: http.version +type: keyword -- -*`iis.access.hostname`*:: +*`rsa.network.vlan_name`*:: + -- -type: alias +This key should only be used to capture the name of the Virtual LAN -alias to: host.hostname +type: keyword -- -*`iis.access.user_agent.device`*:: +*`rsa.investigations.ec_activity`*:: + -- -type: alias +This key captures the particular event activity(Ex:Logoff) -alias to: user_agent.device.name +type: keyword -- -*`iis.access.user_agent.name`*:: +*`rsa.investigations.ec_theme`*:: + -- -type: alias +This key captures the Theme of a particular Event(Ex:Authentication) -alias to: user_agent.name +type: keyword -- -*`iis.access.user_agent.os`*:: +*`rsa.investigations.ec_subject`*:: + -- -type: alias +This key captures the Subject of a particular Event(Ex:User) -alias to: user_agent.os.full_name +type: keyword -- -*`iis.access.user_agent.os_name`*:: +*`rsa.investigations.ec_outcome`*:: + -- -type: alias +This key captures the outcome of a particular Event(Ex:Success) -alias to: user_agent.os.name +type: keyword -- -*`iis.access.user_agent.original`*:: +*`rsa.investigations.event_cat`*:: + -- -type: alias +This key captures the Event category number -alias to: user_agent.original +type: long -- - -*`iis.access.geoip.continent_name`*:: +*`rsa.investigations.event_cat_name`*:: + -- -type: alias +This key captures the event category name corresponding to the event cat code -alias to: source.geo.continent_name +type: keyword -- -*`iis.access.geoip.country_iso_code`*:: +*`rsa.investigations.event_vcat`*:: + -- -type: alias +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. -alias to: source.geo.country_iso_code +type: keyword -- -*`iis.access.geoip.location`*:: +*`rsa.investigations.analysis_file`*:: + -- -type: alias +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file -alias to: source.geo.location +type: keyword -- -*`iis.access.geoip.region_name`*:: +*`rsa.investigations.analysis_service`*:: + -- -type: alias +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service -alias to: source.geo.region_name +type: keyword -- -*`iis.access.geoip.city_name`*:: +*`rsa.investigations.analysis_session`*:: + -- -type: alias +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session -alias to: source.geo.city_name +type: keyword -- -*`iis.access.geoip.region_iso_code`*:: +*`rsa.investigations.boc`*:: + -- -type: alias +This is used to capture behaviour of compromise -alias to: source.geo.region_iso_code +type: keyword -- -[float] -=== error - -Contains fields for IIS error logs. - - - -*`iis.error.reason_phrase`*:: +*`rsa.investigations.eoc`*:: + -- -The HTTP reason phrase. - +This is used to capture Enablers of Compromise type: keyword -- -*`iis.error.queue_name`*:: +*`rsa.investigations.inv_category`*:: + -- -The IIS application pool name. - +This used to capture investigation category type: keyword -- -*`iis.error.remote_ip`*:: +*`rsa.investigations.inv_context`*:: + -- -type: alias +This used to capture investigation context -alias to: source.address +type: keyword -- -*`iis.error.remote_port`*:: +*`rsa.investigations.ioc`*:: + -- -type: alias +This is key capture indicator of compromise -alias to: source.port +type: keyword -- -*`iis.error.server_ip`*:: + +*`rsa.counters.dclass_c1`*:: + -- -type: alias +This is a generic counter key that should be used with the label dclass.c1.str only -alias to: destination.address +type: long -- -*`iis.error.server_port`*:: +*`rsa.counters.dclass_c2`*:: + -- -type: alias +This is a generic counter key that should be used with the label dclass.c2.str only -alias to: destination.port +type: long -- -*`iis.error.http_version`*:: +*`rsa.counters.event_counter`*:: + -- -type: alias +This is used to capture the number of times an event repeated -alias to: http.version +type: long -- -*`iis.error.method`*:: +*`rsa.counters.dclass_r1`*:: + -- -type: alias +This is a generic ratio key that should be used with the label dclass.r1.str only -alias to: http.request.method +type: keyword -- -*`iis.error.url`*:: +*`rsa.counters.dclass_c3`*:: + -- -type: alias +This is a generic counter key that should be used with the label dclass.c3.str only -alias to: url.original +type: long -- -*`iis.error.response_code`*:: +*`rsa.counters.dclass_c1_str`*:: + -- -type: alias +This is a generic counter string key that should be used with the label dclass.c1 only -alias to: http.response.status_code +type: keyword -- - -*`iis.error.geoip.continent_name`*:: +*`rsa.counters.dclass_c2_str`*:: + -- -type: alias +This is a generic counter string key that should be used with the label dclass.c2 only -alias to: source.geo.continent_name +type: keyword -- -*`iis.error.geoip.country_iso_code`*:: +*`rsa.counters.dclass_r1_str`*:: + -- -type: alias +This is a generic ratio string key that should be used with the label dclass.r1 only -alias to: source.geo.country_iso_code +type: keyword -- -*`iis.error.geoip.location`*:: +*`rsa.counters.dclass_r2`*:: + -- -type: alias +This is a generic ratio key that should be used with the label dclass.r2.str only -alias to: source.geo.location +type: keyword -- -*`iis.error.geoip.region_name`*:: +*`rsa.counters.dclass_c3_str`*:: + -- -type: alias +This is a generic counter string key that should be used with the label dclass.c3 only -alias to: source.geo.region_name +type: keyword -- -*`iis.error.geoip.city_name`*:: +*`rsa.counters.dclass_r3`*:: + -- -type: alias +This is a generic ratio key that should be used with the label dclass.r3.str only -alias to: source.geo.city_name +type: keyword -- -*`iis.error.geoip.region_iso_code`*:: +*`rsa.counters.dclass_r2_str`*:: + -- -type: alias +This is a generic ratio string key that should be used with the label dclass.r2 only -alias to: source.geo.region_iso_code +type: keyword -- -[[exported-fields-imperva]] -== Imperva SecureSphere fields +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only -imperva fields. +type: keyword +-- -*`network.interface.name`*:: +*`rsa.identity.auth_method`*:: + -- -Name of the network interface where the traffic has been observed. - +This key is used to capture authentication methods used only type: keyword -- - - -*`rsa.internal.msg`*:: +*`rsa.identity.user_role`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +This key is used to capture the Role of a user only type: keyword -- -*`rsa.internal.messageid`*:: +*`rsa.identity.dn`*:: + -- +X.500 (LDAP) Distinguished Name + type: keyword -- -*`rsa.internal.event_desc`*:: +*`rsa.identity.logon_type`*:: + -- +This key is used to capture the type of logon method used. + type: keyword -- -*`rsa.internal.message`*:: +*`rsa.identity.profile`*:: + -- -This key captures the contents of instant messages +This key is used to capture the user profile type: keyword -- -*`rsa.internal.time`*:: +*`rsa.identity.accesses`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. +This key is used to capture actual privileges used in accessing an object -type: date +type: keyword -- -*`rsa.internal.level`*:: +*`rsa.identity.realm`*:: + -- -Deprecated key defined only in table map. +Radius realm or similar grouping of accounts -type: long +type: keyword -- -*`rsa.internal.msg_id`*:: +*`rsa.identity.user_sid_dst`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Destination User Session ID type: keyword -- -*`rsa.internal.msg_vid`*:: +*`rsa.identity.dn_src`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn type: keyword -- -*`rsa.internal.data`*:: +*`rsa.identity.org`*:: + -- -Deprecated key defined only in table map. +This key captures the User organization type: keyword -- -*`rsa.internal.obj_server`*:: +*`rsa.identity.dn_dst`*:: + -- -Deprecated key defined only in table map. +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn type: keyword -- -*`rsa.internal.obj_val`*:: +*`rsa.identity.firstname`*:: + -- -Deprecated key defined only in table map. +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.internal.resource`*:: +*`rsa.identity.lastname`*:: + -- -Deprecated key defined only in table map. +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.internal.obj_id`*:: +*`rsa.identity.user_dept`*:: + -- -Deprecated key defined only in table map. +User's Department Names only type: keyword -- -*`rsa.internal.statement`*:: +*`rsa.identity.user_sid_src`*:: + -- -Deprecated key defined only in table map. +This key captures Source User Session ID type: keyword -- -*`rsa.internal.audit_class`*:: +*`rsa.identity.federated_sp`*:: + -- -Deprecated key defined only in table map. +This key is the Federated Service Provider. This is the application requesting authentication. type: keyword -- -*`rsa.internal.entry`*:: +*`rsa.identity.federated_idp`*:: + -- -Deprecated key defined only in table map. +This key is the federated Identity Provider. This is the server providing the authentication. type: keyword -- -*`rsa.internal.hcode`*:: +*`rsa.identity.logon_type_desc`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. type: keyword -- -*`rsa.internal.inode`*:: +*`rsa.identity.middlename`*:: + -- -Deprecated key defined only in table map. +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information -type: long +type: keyword -- -*`rsa.internal.resource_class`*:: +*`rsa.identity.password`*:: + -- -Deprecated key defined only in table map. +This key is for Passwords seen in any session, plain text or encrypted type: keyword -- -*`rsa.internal.dead`*:: +*`rsa.identity.host_role`*:: + -- -Deprecated key defined only in table map. +This key should only be used to capture the role of a Host Machine -type: long +type: keyword -- -*`rsa.internal.feed_desc`*:: +*`rsa.identity.ldap`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context type: keyword -- -*`rsa.internal.feed_name`*:: +*`rsa.identity.ldap_query`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is the Search criteria from an LDAP search type: keyword -- -*`rsa.internal.cid`*:: +*`rsa.identity.ldap_response`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is to capture Results from an LDAP search type: keyword -- -*`rsa.internal.device_class`*:: +*`rsa.identity.owner`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This is used to capture username the process or service is running as, the author of the task type: keyword -- -*`rsa.internal.device_group`*:: +*`rsa.identity.service_account`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage type: keyword -- -*`rsa.internal.device_host`*:: + +*`rsa.email.email_dst`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the Destination email address only, when the destination context is not clear use email type: keyword -- -*`rsa.internal.device_ip`*:: +*`rsa.email.email_src`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the source email address only, when the source context is not clear use email -type: ip +type: keyword -- -*`rsa.internal.device_ipv6`*:: +*`rsa.email.subject`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the subject string from an Email only. -type: ip +type: keyword -- -*`rsa.internal.device_type`*:: +*`rsa.email.email`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture a generic email address where the source or destination context is not clear type: keyword -- -*`rsa.internal.device_type_id`*:: +*`rsa.email.trans_from`*:: + -- Deprecated key defined only in table map. -type: long +type: keyword -- -*`rsa.internal.did`*:: +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + + +*`rsa.file.privilege`*:: ++ +-- +Deprecated, use permissions + +type: keyword + +-- + +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword + +-- + +*`rsa.file.filesystem`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.file.filename_dst`*:: ++ +-- +This is used to capture name of the file targeted by the action + +type: keyword + +-- + +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action + +type: keyword + +-- + +*`rsa.file.filename_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file + +type: keyword + +-- + +*`rsa.file.directory_src`*:: ++ +-- +This key is used to capture the directory of the source process or file + +type: keyword + +-- + +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double + +-- + +*`rsa.file.file_vendor`*:: ++ +-- +This is used to capture Company name of file located in version_info + +type: keyword + +-- + +*`rsa.file.task_name`*:: ++ +-- +This is used to capture name of the task + +type: keyword + +-- + + +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names + +type: keyword + +-- + +*`rsa.web.web_cookie`*:: ++ +-- +This key is used to capture the Web cookies specifically. + +type: keyword + +-- + +*`rsa.web.alias_host`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double + +-- + +*`rsa.web.web_ref_domain`*:: ++ +-- +Web referer's domain + +type: keyword + +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword + +-- + +*`rsa.web.remote_domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword + +-- + +*`rsa.web.web_ref_root`*:: ++ +-- +Web referer's root URL path + +type: keyword + +-- + +*`rsa.web.cn_asn_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlpage`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlroot`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_url`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_page`*:: ++ +-- +type: keyword + +-- + + +*`rsa.threat.threat_category`*:: ++ +-- +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: ++ +-- +This key is used to capture the threat description from the session directly or inferred + +type: keyword + +-- + +*`rsa.threat.alert`*:: ++ +-- +This key is used to capture name of the alert + +type: keyword + +-- + +*`rsa.threat.threat_source`*:: ++ +-- +This key is used to capture source of the threat + +type: keyword + +-- + + +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword + +-- + +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- + +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size + +type: long + +-- + +*`rsa.crypto.ike`*:: ++ +-- +IKE negotiation phase. + +type: keyword + +-- + +*`rsa.crypto.scheme`*:: ++ +-- +This key captures the Encryption scheme used + +type: keyword + +-- + +*`rsa.crypto.peer_id`*:: ++ +-- +This key is for Encryption peer’s identity + +type: keyword + +-- + +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type + +type: keyword + +-- + +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String + +type: keyword + +-- + +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher + +type: keyword + +-- + +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size + +type: long + +-- + +*`rsa.crypto.ssl_ver_src`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.d_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One + +type: keyword + +-- + +*`rsa.crypto.ike_cookie2`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase Two + +type: keyword + +-- + +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_cat`*:: ++ +-- +This key is used for the hostname category value of a certificate + +type: keyword + +-- + +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only + +type: keyword + +-- + +*`rsa.crypto.cert_status`*:: ++ +-- +This key captures Certificate validation status + +type: keyword + +-- + +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.cert_keysize`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_insact`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only + +type: keyword + +-- + +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword + +-- + + +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session + +type: keyword + +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword + +-- + +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names + +type: long + +-- + +*`rsa.wireless.wlan_name`*:: ++ +-- +This key captures either WLAN number/name + +type: keyword + +-- + + +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk + +type: keyword + +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. + +type: keyword + +-- + +*`rsa.storage.pwwn`*:: ++ +-- +This uniquely identifies a port on a HBA. + +type: keyword + +-- + + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + + +*`rsa.healthcare.patient_fname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient + +type: keyword + +-- + +*`rsa.healthcare.patient_lname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_mname`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: ++ +-- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + +type: keyword + +-- + +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key + +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: ++ +-- +This key captures values or decorators used within a registry entry + +type: keyword + +-- + +[[exported-fields-fortinet]] +== Fortinet fields + +fortinet Module + + + +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. + + +type: keyword + +-- + + + +*`rsa.internal.msg`*:: ++ +-- +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword + +-- + +*`rsa.internal.messageid`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.event_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.message`*:: ++ +-- +This key captures the contents of instant messages + +type: keyword + +-- + +*`rsa.internal.time`*:: ++ +-- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date + +-- + +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_server`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_val`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.statement`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.audit_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.entry`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.hcode`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.inode`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.cid`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_class`*:: ++ +-- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_group`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_host`*:: ++ +-- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_ip`*:: ++ +-- +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.did`*:: + -- This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness @@ -65795,5841 +63943,7301 @@ type: keyword -- -[[exported-fields-infoblox]] -== Infoblox NIOS fields +[float] +=== fortinet -infoblox fields. +Fields from fortinet FortiOS -*`network.interface.name`*:: +*`fortinet.file.hash.crc32`*:: + -- -Name of the network interface where the traffic has been observed. +CRC32 Hash of file type: keyword -- +[float] +=== firewall + +Module for parsing Fortinet syslog. + -*`rsa.internal.msg`*:: +*`fortinet.firewall.acct_stat`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +Accounting state (RADIUS) + type: keyword -- -*`rsa.internal.messageid`*:: +*`fortinet.firewall.acktime`*:: + -- +Alarm Acknowledge Time + + type: keyword -- -*`rsa.internal.event_desc`*:: +*`fortinet.firewall.act`*:: + -- +Action + + type: keyword -- -*`rsa.internal.message`*:: +*`fortinet.firewall.action`*:: + -- -This key captures the contents of instant messages +Status of the session + type: keyword -- -*`rsa.internal.time`*:: +*`fortinet.firewall.activity`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. +HA activity message -type: date + +type: keyword -- -*`rsa.internal.level`*:: +*`fortinet.firewall.addr`*:: + -- -Deprecated key defined only in table map. +IP Address -type: long + +type: ip -- -*`rsa.internal.msg_id`*:: +*`fortinet.firewall.addr_type`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Address Type + type: keyword -- -*`rsa.internal.msg_vid`*:: +*`fortinet.firewall.addrgrp`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Address Group + type: keyword -- -*`rsa.internal.data`*:: +*`fortinet.firewall.adgroup`*:: + -- -Deprecated key defined only in table map. +AD Group Name + type: keyword -- -*`rsa.internal.obj_server`*:: +*`fortinet.firewall.admin`*:: + -- -Deprecated key defined only in table map. +Admin User + type: keyword -- -*`rsa.internal.obj_val`*:: +*`fortinet.firewall.age`*:: + -- -Deprecated key defined only in table map. +Time in seconds - time passed since last seen -type: keyword + +type: integer -- -*`rsa.internal.resource`*:: +*`fortinet.firewall.agent`*:: + -- -Deprecated key defined only in table map. +User agent - eg. agent="Mozilla/5.0" + type: keyword -- -*`rsa.internal.obj_id`*:: +*`fortinet.firewall.alarmid`*:: + -- -Deprecated key defined only in table map. +Alarm ID -type: keyword + +type: integer -- -*`rsa.internal.statement`*:: +*`fortinet.firewall.alert`*:: + -- -Deprecated key defined only in table map. +Alert + type: keyword -- -*`rsa.internal.audit_class`*:: +*`fortinet.firewall.analyticscksum`*:: + -- -Deprecated key defined only in table map. +The checksum of the file submitted for analytics + type: keyword -- -*`rsa.internal.entry`*:: +*`fortinet.firewall.analyticssubmit`*:: + -- -Deprecated key defined only in table map. +The flag for analytics submission + type: keyword -- -*`rsa.internal.hcode`*:: +*`fortinet.firewall.ap`*:: + -- -Deprecated key defined only in table map. +Access Point + type: keyword -- -*`rsa.internal.inode`*:: +*`fortinet.firewall.app-type`*:: + -- -Deprecated key defined only in table map. +Address Type -type: long + +type: keyword -- -*`rsa.internal.resource_class`*:: +*`fortinet.firewall.appact`*:: + -- -Deprecated key defined only in table map. +The security action from app control + type: keyword -- -*`rsa.internal.dead`*:: +*`fortinet.firewall.appid`*:: + -- -Deprecated key defined only in table map. +Application ID -type: long + +type: integer -- -*`rsa.internal.feed_desc`*:: +*`fortinet.firewall.applist`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Application Control profile + type: keyword -- -*`rsa.internal.feed_name`*:: +*`fortinet.firewall.apprisk`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Application Risk Level + type: keyword -- -*`rsa.internal.cid`*:: +*`fortinet.firewall.apscan`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The name of the AP, which scanned and detected the rogue AP + type: keyword -- -*`rsa.internal.device_class`*:: +*`fortinet.firewall.apsn`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Access Point + type: keyword -- -*`rsa.internal.device_group`*:: +*`fortinet.firewall.apstatus`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Access Point status + type: keyword -- -*`rsa.internal.device_host`*:: +*`fortinet.firewall.aptype`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Access Point type + type: keyword -- -*`rsa.internal.device_ip`*:: +*`fortinet.firewall.assigned`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Assigned IP Address + type: ip -- -*`rsa.internal.device_ipv6`*:: +*`fortinet.firewall.assignip`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Assigned IP Address + type: ip -- -*`rsa.internal.device_type`*:: +*`fortinet.firewall.attachment`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The flag for email attachement + type: keyword -- -*`rsa.internal.device_type_id`*:: +*`fortinet.firewall.attack`*:: + -- -Deprecated key defined only in table map. +Attack Name -type: long + +type: keyword -- -*`rsa.internal.did`*:: +*`fortinet.firewall.attackcontext`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The trigger patterns and the packetdata with base64 encoding + type: keyword -- -*`rsa.internal.entropy_req`*:: +*`fortinet.firewall.attackcontextid`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Attack context id / total -type: long + +type: keyword -- -*`rsa.internal.entropy_res`*:: +*`fortinet.firewall.attackid`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Attack ID + + +type: integer + +-- + +*`fortinet.firewall.auditid`*:: ++ +-- +Audit ID + type: long -- -*`rsa.internal.event_name`*:: +*`fortinet.firewall.auditscore`*:: + -- -Deprecated key defined only in table map. +The Audit Score + type: keyword -- -*`rsa.internal.feed_category`*:: +*`fortinet.firewall.audittime`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The time of the audit -type: keyword + +type: long -- -*`rsa.internal.forward_ip`*:: +*`fortinet.firewall.authgrp`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. +Authorization Group -type: ip + +type: keyword -- -*`rsa.internal.forward_ipv6`*:: +*`fortinet.firewall.authid`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Authentication ID -type: ip + +type: keyword -- -*`rsa.internal.header_id`*:: +*`fortinet.firewall.authproto`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The protocol that initiated the authentication + type: keyword -- -*`rsa.internal.lc_cid`*:: +*`fortinet.firewall.authserver`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Authentication server + type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`fortinet.firewall.bandwidth`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Bandwidth -type: date + +type: keyword -- -*`rsa.internal.mcb_req`*:: +*`fortinet.firewall.banned_rule`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +NAC quarantine Banned Rule Name -type: long + +type: keyword -- -*`rsa.internal.mcb_res`*:: +*`fortinet.firewall.banned_src`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +NAC quarantine Banned Source IP -type: long + +type: keyword -- -*`rsa.internal.mcbc_req`*:: +*`fortinet.firewall.banword`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +Banned word -type: long + +type: keyword -- -*`rsa.internal.mcbc_res`*:: +*`fortinet.firewall.botnetdomain`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +Botnet Domain Name -type: long + +type: keyword -- -*`rsa.internal.medium`*:: +*`fortinet.firewall.botnetip`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +Botnet IP Address -type: long + +type: ip -- -*`rsa.internal.node_name`*:: +*`fortinet.firewall.bssid`*:: + -- -Deprecated key defined only in table map. +Service Set ID + type: keyword -- -*`rsa.internal.nwe_callback_id`*:: +*`fortinet.firewall.call_id`*:: + -- -This key denotes that event is endpoint related +Caller ID + type: keyword -- -*`rsa.internal.parse_error`*:: +*`fortinet.firewall.carrier_ep`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The FortiOS Carrier end-point identification + type: keyword -- -*`rsa.internal.payload_req`*:: +*`fortinet.firewall.cat`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +DNS category ID -type: long + +type: integer -- -*`rsa.internal.payload_res`*:: +*`fortinet.firewall.category`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +Authentication category -type: long + +type: keyword -- -*`rsa.internal.process_vid_dst`*:: +*`fortinet.firewall.cc`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. +CC Email Address + type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`fortinet.firewall.cdrcontent`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +Cdrcontent + type: keyword -- -*`rsa.internal.rid`*:: +*`fortinet.firewall.centralnatid`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Central NAT ID -type: long + +type: integer -- -*`rsa.internal.session_split`*:: +*`fortinet.firewall.cert`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Certificate + type: keyword -- -*`rsa.internal.site`*:: +*`fortinet.firewall.cert-type`*:: + -- -Deprecated key defined only in table map. +Certificate type + type: keyword -- -*`rsa.internal.size`*:: +*`fortinet.firewall.certhash`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Certificate hash -type: long + +type: keyword -- -*`rsa.internal.sourcefile`*:: +*`fortinet.firewall.cfgattr`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Configuration attribute + type: keyword -- -*`rsa.internal.ubc_req`*:: +*`fortinet.firewall.cfgobj`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +Configuration object -type: long + +type: keyword -- -*`rsa.internal.ubc_res`*:: +*`fortinet.firewall.cfgpath`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +Configuration path -type: long + +type: keyword -- -*`rsa.internal.word`*:: +*`fortinet.firewall.cfgtid`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +Configuration transaction ID + type: keyword -- - -*`rsa.time.event_time`*:: +*`fortinet.firewall.cfgtxpower`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form +Configuration TX power -type: date + +type: integer -- -*`rsa.time.duration_time`*:: +*`fortinet.firewall.channel`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. +Wireless Channel -type: double + +type: integer -- -*`rsa.time.event_time_str`*:: +*`fortinet.firewall.channeltype`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string +SSH channel type + type: keyword -- -*`rsa.time.starttime`*:: +*`fortinet.firewall.chassisid`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form +Chassis ID -type: date + +type: integer -- -*`rsa.time.month`*:: +*`fortinet.firewall.checksum`*:: + -- -type: keyword +The checksum of the scanned file --- -*`rsa.time.day`*:: -+ --- type: keyword -- -*`rsa.time.endtime`*:: +*`fortinet.firewall.chgheaders`*:: + -- -This key is used to capture the End time mentioned in a session in a standard form +HTTP Headers -type: date + +type: keyword -- -*`rsa.time.timezone`*:: +*`fortinet.firewall.cldobjid`*:: + -- -This key is used to capture the timezone of the Event Time +Connector object ID + type: keyword -- -*`rsa.time.duration_str`*:: +*`fortinet.firewall.client_addr`*:: + -- -A text string version of the duration +Wifi client address + type: keyword -- -*`rsa.time.date`*:: +*`fortinet.firewall.cloudaction`*:: + -- +Cloud Action + + type: keyword -- -*`rsa.time.year`*:: +*`fortinet.firewall.clouduser`*:: + -- +Cloud User + + type: keyword -- -*`rsa.time.recorded_time`*:: +*`fortinet.firewall.column`*:: + -- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. +VOIP Column -type: date + +type: integer -- -*`rsa.time.datetime`*:: +*`fortinet.firewall.command`*:: + -- +CLI Command + + type: keyword -- -*`rsa.time.effective_time`*:: +*`fortinet.firewall.community`*:: + -- -This key is the effective time referenced by an individual event in a Standard Timestamp format +SNMP Community -type: date + +type: keyword -- -*`rsa.time.expire_time`*:: +*`fortinet.firewall.configcountry`*:: + -- -This key is the timestamp that explicitly refers to an expiration. +Configuration country -type: date + +type: keyword -- -*`rsa.time.process_time`*:: +*`fortinet.firewall.connection_type`*:: + -- -Deprecated, use duration.time +FortiClient Connection Type + type: keyword -- -*`rsa.time.hour`*:: +*`fortinet.firewall.conserve`*:: + -- -type: keyword +Flag for conserve mode --- -*`rsa.time.min`*:: -+ --- type: keyword -- -*`rsa.time.timestamp`*:: +*`fortinet.firewall.constraint`*:: + -- +WAF http protocol restrictions + + type: keyword -- -*`rsa.time.event_queue_time`*:: +*`fortinet.firewall.contentdisarmed`*:: + -- -This key is the Time that the event was queued. +Email scanned content -type: date + +type: keyword -- -*`rsa.time.p_time1`*:: +*`fortinet.firewall.contenttype`*:: + -- +Content Type from HTTP header + + type: keyword -- -*`rsa.time.tzone`*:: +*`fortinet.firewall.cookies`*:: + -- +VPN Cookie + + type: keyword -- -*`rsa.time.eventtime`*:: +*`fortinet.firewall.count`*:: + -- -type: keyword +Counts of action type + + +type: integer -- -*`rsa.time.gmtdate`*:: +*`fortinet.firewall.countapp`*:: + -- -type: keyword +Number of App Ctrl logs associated with the session + + +type: integer -- -*`rsa.time.gmttime`*:: +*`fortinet.firewall.countav`*:: + -- -type: keyword +Number of AV logs associated with the session + + +type: integer -- -*`rsa.time.p_date`*:: +*`fortinet.firewall.countcifs`*:: + -- -type: keyword +Number of CIFS logs associated with the session + + +type: integer -- -*`rsa.time.p_month`*:: +*`fortinet.firewall.countdlp`*:: + -- -type: keyword +Number of DLP logs associated with the session + + +type: integer -- -*`rsa.time.p_time`*:: +*`fortinet.firewall.countdns`*:: + -- -type: keyword +Number of DNS logs associated with the session + + +type: integer -- -*`rsa.time.p_time2`*:: +*`fortinet.firewall.countemail`*:: + -- -type: keyword +Number of email logs associated with the session + + +type: integer -- -*`rsa.time.p_year`*:: +*`fortinet.firewall.countff`*:: + -- -type: keyword +Number of ff logs associated with the session + + +type: integer -- -*`rsa.time.expire_time_str`*:: +*`fortinet.firewall.countips`*:: + -- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. +Number of IPS logs associated with the session -type: keyword + +type: integer -- -*`rsa.time.stamp`*:: +*`fortinet.firewall.countssh`*:: + -- -Deprecated key defined only in table map. +Number of SSH logs associated with the session -type: date --- +type: integer +-- -*`rsa.misc.action`*:: +*`fortinet.firewall.countssl`*:: + -- -type: keyword +Number of SSL logs associated with the session + + +type: integer -- -*`rsa.misc.result`*:: +*`fortinet.firewall.countwaf`*:: + -- -This key is used to capture the outcome/result string value of an action in a session. +Number of WAF logs associated with the session -type: keyword + +type: integer -- -*`rsa.misc.severity`*:: +*`fortinet.firewall.countweb`*:: + -- -This key is used to capture the severity given the session +Number of Web filter logs associated with the session -type: keyword + +type: integer -- -*`rsa.misc.event_type`*:: +*`fortinet.firewall.cpu`*:: + -- -This key captures the event category type as specified by the event source. +CPU Usage -type: keyword + +type: integer -- -*`rsa.misc.reference_id`*:: +*`fortinet.firewall.craction`*:: + -- -This key is used to capture an event id from the session directly +Client Reputation Action -type: keyword + +type: integer -- -*`rsa.misc.version`*:: +*`fortinet.firewall.criticalcount`*:: + -- -This key captures Version of the application or OS which is generating the event. +Number of critical ratings -type: keyword + +type: integer -- -*`rsa.misc.disposition`*:: +*`fortinet.firewall.crl`*:: + -- -This key captures the The end state of an action. +Client Reputation Level + type: keyword -- -*`rsa.misc.result_code`*:: +*`fortinet.firewall.crlevel`*:: + -- -This key is used to capture the outcome/result numeric value of an action in a session +Client Reputation Level + type: keyword -- -*`rsa.misc.category`*:: +*`fortinet.firewall.crscore`*:: + -- -This key is used to capture the category of an event given by the vendor in the session +Some description -type: keyword + +type: integer -- -*`rsa.misc.obj_name`*:: +*`fortinet.firewall.cveid`*:: + -- -This is used to capture name of object +CVE ID + type: keyword -- -*`rsa.misc.obj_type`*:: +*`fortinet.firewall.daemon`*:: + -- -This is used to capture type of object +Daemon name + type: keyword -- -*`rsa.misc.event_source`*:: +*`fortinet.firewall.datarange`*:: + -- -This key captures Source of the event that’s not a hostname +Data range for reports + type: keyword -- -*`rsa.misc.log_session_id`*:: +*`fortinet.firewall.date`*:: + -- -This key is used to capture a sessionid from the session directly +Date + type: keyword -- -*`rsa.misc.group`*:: +*`fortinet.firewall.ddnsserver`*:: + -- -This key captures the Group Name value +DDNS server -type: keyword + +type: ip -- -*`rsa.misc.policy_name`*:: +*`fortinet.firewall.desc`*:: + -- -This key is used to capture the Policy Name only. +Description + type: keyword -- -*`rsa.misc.rule_name`*:: +*`fortinet.firewall.detectionmethod`*:: + -- -This key captures the Rule Name +Detection method + type: keyword -- -*`rsa.misc.context`*:: +*`fortinet.firewall.devcategory`*:: + -- -This key captures Information which adds additional context to the event. +Device category + type: keyword -- -*`rsa.misc.change_new`*:: +*`fortinet.firewall.devintfname`*:: + -- -This key is used to capture the new values of the attribute that’s changing in a session +HA device Interface Name + type: keyword -- -*`rsa.misc.space`*:: +*`fortinet.firewall.devtype`*:: + -- +Device type + + type: keyword -- -*`rsa.misc.client`*:: +*`fortinet.firewall.dhcp_msg`*:: + -- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. +DHCP Message + type: keyword -- -*`rsa.misc.msgIdPart1`*:: +*`fortinet.firewall.dintf`*:: + -- +Destination interface + + type: keyword -- -*`rsa.misc.msgIdPart2`*:: +*`fortinet.firewall.disk`*:: + -- +Assosciated disk + + type: keyword -- -*`rsa.misc.change_old`*:: +*`fortinet.firewall.disklograte`*:: + -- -This key is used to capture the old value of the attribute that’s changing in a session +Disk logging rate -type: keyword + +type: long -- -*`rsa.misc.operation_id`*:: +*`fortinet.firewall.dlpextra`*:: + -- -An alert number or operation number. The values should be unique and non-repeating. +DLP extra information + type: keyword -- -*`rsa.misc.event_state`*:: +*`fortinet.firewall.docsource`*:: + -- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. +DLP fingerprint document source + type: keyword -- -*`rsa.misc.group_object`*:: +*`fortinet.firewall.domainctrlauthstate`*:: + -- -This key captures a collection/grouping of entities. Specific usage +CIFS domain auth state -type: keyword + +type: integer -- -*`rsa.misc.node`*:: +*`fortinet.firewall.domainctrlauthtype`*:: + -- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. +CIFS domain auth type -type: keyword + +type: integer -- -*`rsa.misc.rule`*:: +*`fortinet.firewall.domainctrldomain`*:: + -- -This key captures the Rule number +CIFS domain auth domain + type: keyword -- -*`rsa.misc.device_name`*:: +*`fortinet.firewall.domainctrlip`*:: + -- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc +CIFS Domain IP -type: keyword + +type: ip -- -*`rsa.misc.param`*:: +*`fortinet.firewall.domainctrlname`*:: + -- -This key is the parameters passed as part of a command or application, etc. +CIFS Domain name + type: keyword -- -*`rsa.misc.change_attrib`*:: +*`fortinet.firewall.domainctrlprotocoltype`*:: + -- -This key is used to capture the name of the attribute that’s changing in a session +CIFS Domain connection protocol -type: keyword + +type: integer -- -*`rsa.misc.event_computer`*:: +*`fortinet.firewall.domainctrlusername`*:: + -- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. +CIFS Domain username + type: keyword -- -*`rsa.misc.reference_id1`*:: +*`fortinet.firewall.domainfilteridx`*:: + -- -This key is for Linked ID to be used as an addition to "reference.id" +Domain filter ID -type: keyword + +type: integer -- -*`rsa.misc.event_log`*:: +*`fortinet.firewall.domainfilterlist`*:: + -- -This key captures the Name of the event log +Domain filter name + type: keyword -- -*`rsa.misc.OS`*:: +*`fortinet.firewall.ds`*:: + -- -This key captures the Name of the Operating System +Direction with distribution system + type: keyword -- -*`rsa.misc.terminal`*:: +*`fortinet.firewall.dst_int`*:: + -- -This key captures the Terminal Names only +Destination interface + type: keyword -- -*`rsa.misc.msgIdPart3`*:: +*`fortinet.firewall.dstintfrole`*:: + -- +Destination interface role + + type: keyword -- -*`rsa.misc.filter`*:: +*`fortinet.firewall.dstcountry`*:: + -- -This key captures Filter used to reduce result set +Destination country + type: keyword -- -*`rsa.misc.serial_number`*:: +*`fortinet.firewall.dstdevcategory`*:: + -- -This key is the Serial number associated with a physical asset. +Destination device category + type: keyword -- -*`rsa.misc.checksum`*:: +*`fortinet.firewall.dstdevtype`*:: + -- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. +Destination device type + type: keyword -- -*`rsa.misc.event_user`*:: +*`fortinet.firewall.dstfamily`*:: + -- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. +Destination OS family + type: keyword -- -*`rsa.misc.virusname`*:: +*`fortinet.firewall.dsthwvendor`*:: + -- -This key captures the name of the virus +Destination HW vendor + type: keyword -- -*`rsa.misc.content_type`*:: +*`fortinet.firewall.dsthwversion`*:: + -- -This key is used to capture Content Type only. +Destination HW version + type: keyword -- -*`rsa.misc.group_id`*:: +*`fortinet.firewall.dstinetsvc`*:: + -- -This key captures Group ID Number (related to the group name) +Destination interface service + type: keyword -- -*`rsa.misc.policy_id`*:: +*`fortinet.firewall.dstosname`*:: + -- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise +Destination OS name + type: keyword -- -*`rsa.misc.vsys`*:: +*`fortinet.firewall.dstosversion`*:: + -- -This key captures Virtual System Name +Destination OS version + type: keyword -- -*`rsa.misc.connection_id`*:: +*`fortinet.firewall.dstserver`*:: + -- -This key captures the Connection ID +Destination server -type: keyword + +type: integer -- -*`rsa.misc.reference_id2`*:: +*`fortinet.firewall.dstssid`*:: + -- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. +Destination SSID + type: keyword -- -*`rsa.misc.sensor`*:: +*`fortinet.firewall.dstswversion`*:: + -- -This key captures Name of the sensor. Typically used in IDS/IPS based devices +Destination software version + type: keyword -- -*`rsa.misc.sig_id`*:: +*`fortinet.firewall.dstunauthusersource`*:: + -- -This key captures IDS/IPS Int Signature ID +Destination unauthenticated source -type: long + +type: keyword -- -*`rsa.misc.port_name`*:: +*`fortinet.firewall.dstuuid`*:: + -- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). +UUID of the Destination IP address + type: keyword -- -*`rsa.misc.rule_group`*:: +*`fortinet.firewall.duid`*:: + -- -This key captures the Rule group name +DHCP UID + type: keyword -- -*`rsa.misc.risk_num`*:: +*`fortinet.firewall.eapolcnt`*:: + -- -This key captures a Numeric Risk value +EAPOL packet count -type: double + +type: integer -- -*`rsa.misc.trigger_val`*:: +*`fortinet.firewall.eapoltype`*:: + -- -This key captures the Value of the trigger or threshold condition. +EAPOL packet type + type: keyword -- -*`rsa.misc.log_session_id1`*:: +*`fortinet.firewall.encrypt`*:: + -- -This key is used to capture a Linked (Related) Session ID from the session directly +Whether the packet is encrypted or not -type: keyword + +type: integer -- -*`rsa.misc.comp_version`*:: +*`fortinet.firewall.encryption`*:: + -- -This key captures the Version level of a sub-component of a product. +Encryption method + type: keyword -- -*`rsa.misc.content_version`*:: +*`fortinet.firewall.epoch`*:: + -- -This key captures Version level of a signature or database content. +Epoch used for locating file -type: keyword + +type: integer -- -*`rsa.misc.hardware_id`*:: +*`fortinet.firewall.espauth`*:: + -- -This key is used to capture unique identifier for a device or system (NOT a Mac address) +ESP Authentication + type: keyword -- -*`rsa.misc.risk`*:: +*`fortinet.firewall.esptransform`*:: + -- -This key captures the non-numeric risk value +ESP Transform + type: keyword -- -*`rsa.misc.event_id`*:: +*`fortinet.firewall.exch`*:: + -- +Mail Exchanges from DNS response answer section + + type: keyword -- -*`rsa.misc.reason`*:: +*`fortinet.firewall.exchange`*:: + -- +Mail Exchanges from DNS response answer section + + type: keyword -- -*`rsa.misc.status`*:: +*`fortinet.firewall.expectedsignature`*:: + -- +Expected SSL signature + + type: keyword -- -*`rsa.misc.mail_id`*:: +*`fortinet.firewall.expiry`*:: + -- -This key is used to capture the mailbox id/name +FortiGuard override expiry timestamp + type: keyword -- -*`rsa.misc.rule_uid`*:: +*`fortinet.firewall.fams_pause`*:: + -- -This key is the Unique Identifier for a rule. +Fortinet Analysis and Management Service Pause -type: keyword + +type: integer -- -*`rsa.misc.trigger_desc`*:: +*`fortinet.firewall.fazlograte`*:: + -- -This key captures the Description of the trigger or threshold condition. +FortiAnalyzer Logging Rate -type: keyword + +type: long -- -*`rsa.misc.inout`*:: +*`fortinet.firewall.fctemssn`*:: + -- +FortiClient Endpoint SSN + + type: keyword -- -*`rsa.misc.p_msgid`*:: +*`fortinet.firewall.fctuid`*:: + -- +FortiClient UID + + type: keyword -- -*`rsa.misc.data_type`*:: +*`fortinet.firewall.field`*:: + -- +NTP status field + + type: keyword -- -*`rsa.misc.msgIdPart4`*:: +*`fortinet.firewall.filefilter`*:: + -- +The filter used to identify the affected file + + type: keyword -- -*`rsa.misc.error`*:: +*`fortinet.firewall.filehashsrc`*:: + -- -This key captures All non successful Error codes or responses +Filehash source + type: keyword -- -*`rsa.misc.index`*:: +*`fortinet.firewall.filtercat`*:: + -- +DLP filter category + + type: keyword -- -*`rsa.misc.listnum`*:: +*`fortinet.firewall.filteridx`*:: + -- -This key is used to capture listname or listnumber, primarily for collecting access-list +DLP filter ID -type: keyword + +type: integer -- -*`rsa.misc.ntype`*:: +*`fortinet.firewall.filtername`*:: + -- +DLP rule name + + type: keyword -- -*`rsa.misc.observed_val`*:: +*`fortinet.firewall.filtertype`*:: + -- -This key captures the Value observed (from the perspective of the device generating the log). +DLP filter type + type: keyword -- -*`rsa.misc.policy_value`*:: +*`fortinet.firewall.fortiguardresp`*:: + -- -This key captures the contents of the policy. This contains details about the policy +Antispam ESP value + type: keyword -- -*`rsa.misc.pool_name`*:: +*`fortinet.firewall.forwardedfor`*:: + -- -This key captures the name of a resource pool +Email address forwarded + type: keyword -- -*`rsa.misc.rule_template`*:: +*`fortinet.firewall.fqdn`*:: + -- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template +FQDN + type: keyword -- -*`rsa.misc.count`*:: +*`fortinet.firewall.frametype`*:: + -- +Wireless frametype + + type: keyword -- -*`rsa.misc.number`*:: +*`fortinet.firewall.freediskstorage`*:: + -- -type: keyword +Free disk integer + + +type: integer -- -*`rsa.misc.sigcat`*:: +*`fortinet.firewall.from`*:: + -- +From email address + + type: keyword -- -*`rsa.misc.type`*:: +*`fortinet.firewall.from_vcluster`*:: + -- -type: keyword +Source virtual cluster number + + +type: integer -- -*`rsa.misc.comments`*:: +*`fortinet.firewall.fsaverdict`*:: + -- -Comment information provided in the log message +FSA verdict + type: keyword -- -*`rsa.misc.doc_number`*:: +*`fortinet.firewall.fwserver_name`*:: + -- -This key captures File Identification number +Web proxy server name -type: long + +type: keyword -- -*`rsa.misc.expected_val`*:: +*`fortinet.firewall.gateway`*:: + -- -This key captures the Value expected (from the perspective of the device generating the log). +Gateway ip address for PPPoE status report -type: keyword + +type: ip -- -*`rsa.misc.job_num`*:: +*`fortinet.firewall.green`*:: + -- -This key captures the Job Number +Memory status + type: keyword -- -*`rsa.misc.spi_dst`*:: +*`fortinet.firewall.groupid`*:: + -- -Destination SPI Index +User Group ID -type: keyword + +type: integer -- -*`rsa.misc.spi_src`*:: +*`fortinet.firewall.ha-prio`*:: + -- -Source SPI Index +HA Priority -type: keyword + +type: integer -- -*`rsa.misc.code`*:: +*`fortinet.firewall.ha_group`*:: + -- +HA Group + + type: keyword -- -*`rsa.misc.agent_id`*:: +*`fortinet.firewall.ha_role`*:: + -- -This key is used to capture agent id +HA Role + type: keyword -- -*`rsa.misc.message_body`*:: +*`fortinet.firewall.handshake`*:: + -- -This key captures the The contents of the message body. +SSL Handshake + type: keyword -- -*`rsa.misc.phone`*:: +*`fortinet.firewall.hash`*:: + -- +Hash value of downloaded file + + type: keyword -- -*`rsa.misc.sig_id_str`*:: +*`fortinet.firewall.hbdn_reason`*:: + -- -This key captures a string object of the sigid variable. +Heartbeat down reason + type: keyword -- -*`rsa.misc.cmd`*:: +*`fortinet.firewall.highcount`*:: + -- -type: keyword +Highcount fabric summary --- -*`rsa.misc.misc`*:: -+ --- -type: keyword +type: integer -- -*`rsa.misc.name`*:: +*`fortinet.firewall.host`*:: + -- +Hostname + + type: keyword -- -*`rsa.misc.cpu`*:: +*`fortinet.firewall.iaid`*:: + -- -This key is the CPU time used in the execution of the event being recorded. +DHCPv6 id -type: long + +type: keyword -- -*`rsa.misc.event_desc`*:: +*`fortinet.firewall.icmpcode`*:: + -- -This key is used to capture a description of an event available directly or inferred +Destination Port of the ICMP message + type: keyword -- -*`rsa.misc.sig_id1`*:: +*`fortinet.firewall.icmpid`*:: + -- -This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - -type: long +Source port of the ICMP message --- -*`rsa.misc.im_buddyid`*:: -+ --- type: keyword -- -*`rsa.misc.im_client`*:: +*`fortinet.firewall.icmptype`*:: + -- +The type of ICMP message + + type: keyword -- -*`rsa.misc.im_userid`*:: +*`fortinet.firewall.identifier`*:: + -- -type: keyword +Network traffic identifier + + +type: integer -- -*`rsa.misc.pid`*:: +*`fortinet.firewall.in_spi`*:: + -- +IPSEC inbound SPI + + type: keyword -- -*`rsa.misc.priority`*:: +*`fortinet.firewall.incidentserialno`*:: + -- -type: keyword +Incident serial number + + +type: integer -- -*`rsa.misc.context_subject`*:: +*`fortinet.firewall.infected`*:: + -- -This key is to be used in an audit context where the subject is the object being identified +Infected MMS -type: keyword + +type: integer -- -*`rsa.misc.context_target`*:: +*`fortinet.firewall.infectedfilelevel`*:: + -- -type: keyword +DLP infected file level + + +type: integer -- -*`rsa.misc.cve`*:: +*`fortinet.firewall.informationsource`*:: + -- -This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. +Information source + type: keyword -- -*`rsa.misc.fcatnum`*:: +*`fortinet.firewall.init`*:: + -- -This key captures Filter Category Number. Legacy Usage +IPSEC init stage + type: keyword -- -*`rsa.misc.library`*:: +*`fortinet.firewall.initiator`*:: + -- -This key is used to capture library information in mainframe devices +Original login user name for Fortiguard override + type: keyword -- -*`rsa.misc.parent_node`*:: +*`fortinet.firewall.interface`*:: + -- -This key captures the Parent Node Name. Must be related to node variable. +Related interface + type: keyword -- -*`rsa.misc.risk_info`*:: +*`fortinet.firewall.intf`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Related interface + type: keyword -- -*`rsa.misc.tcp_flags`*:: +*`fortinet.firewall.invalidmac`*:: + -- -This key is captures the TCP flags set in any packet of session +The MAC address with invalid OUI -type: long + +type: keyword -- -*`rsa.misc.tos`*:: +*`fortinet.firewall.ip`*:: + -- -This key describes the type of service +Related IP -type: long + +type: ip -- -*`rsa.misc.vm_target`*:: +*`fortinet.firewall.iptype`*:: + -- -VMWare Target **VMWARE** only varaible. +Related IP type + type: keyword -- -*`rsa.misc.workspace`*:: +*`fortinet.firewall.keyword`*:: + -- -This key captures Workspace Description +Keyword used for search + type: keyword -- -*`rsa.misc.command`*:: +*`fortinet.firewall.kind`*:: + -- -type: keyword +VOIP kind --- -*`rsa.misc.event_category`*:: -+ --- type: keyword -- -*`rsa.misc.facilityname`*:: +*`fortinet.firewall.lanin`*:: + -- -type: keyword +LAN incoming traffic in bytes --- -*`rsa.misc.forensic_info`*:: -+ --- -type: keyword +type: long -- -*`rsa.misc.jobname`*:: +*`fortinet.firewall.lanout`*:: + -- -type: keyword +LAN outbound traffic in bytes + + +type: long -- -*`rsa.misc.mode`*:: +*`fortinet.firewall.lease`*:: + -- -type: keyword +DHCP lease + + +type: integer -- -*`rsa.misc.policy`*:: +*`fortinet.firewall.license_limit`*:: + -- +Maximum Number of FortiClients for the License + + type: keyword -- -*`rsa.misc.policy_waiver`*:: +*`fortinet.firewall.limit`*:: + -- -type: keyword +Virtual Domain Resource Limit + + +type: integer -- -*`rsa.misc.second`*:: +*`fortinet.firewall.line`*:: + -- +VOIP line + + type: keyword -- -*`rsa.misc.space1`*:: +*`fortinet.firewall.live`*:: + -- -type: keyword +Time in seconds + + +type: integer -- -*`rsa.misc.subcategory`*:: +*`fortinet.firewall.local`*:: + -- -type: keyword +Local IP for a PPPD Connection + + +type: ip -- -*`rsa.misc.tbdstr2`*:: +*`fortinet.firewall.log`*:: + -- +Log message + + type: keyword -- -*`rsa.misc.alert_id`*:: +*`fortinet.firewall.login`*:: + -- -Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +SSH login + type: keyword -- -*`rsa.misc.checksum_dst`*:: +*`fortinet.firewall.lowcount`*:: + -- -This key is used to capture the checksum or hash of the the target entity such as a process or file. +Fabric lowcount -type: keyword + +type: integer -- -*`rsa.misc.checksum_src`*:: +*`fortinet.firewall.mac`*:: + -- -This key is used to capture the checksum or hash of the source entity such as a file or process. +DHCP mac address + type: keyword -- -*`rsa.misc.fresult`*:: +*`fortinet.firewall.malform_data`*:: + -- -This key captures the Filter Result +VOIP malformed data -type: long + +type: integer -- -*`rsa.misc.payload_dst`*:: +*`fortinet.firewall.malform_desc`*:: + -- -This key is used to capture destination payload +VOIP malformed data description + type: keyword -- -*`rsa.misc.payload_src`*:: +*`fortinet.firewall.manuf`*:: + -- -This key is used to capture source payload +Manufacturer name + type: keyword -- -*`rsa.misc.pool_id`*:: +*`fortinet.firewall.masterdstmac`*:: + -- -This key captures the identifier (typically numeric field) of a resource pool +Master mac address for a host with multiple network interfaces + type: keyword -- -*`rsa.misc.process_id_val`*:: +*`fortinet.firewall.mastersrcmac`*:: + -- -This key is a failure key for Process ID when it is not an integer value +The master MAC address for a host that has multiple network interfaces + type: keyword -- -*`rsa.misc.risk_num_comm`*:: +*`fortinet.firewall.mediumcount`*:: + -- -This key captures Risk Number Community +Fabric medium count -type: double + +type: integer -- -*`rsa.misc.risk_num_next`*:: +*`fortinet.firewall.mem`*:: + -- -This key captures Risk Number NextGen +Memory usage system statistics -type: double + +type: integer -- -*`rsa.misc.risk_num_sand`*:: +*`fortinet.firewall.meshmode`*:: + -- -This key captures Risk Number SandBox +Wireless mesh mode -type: double + +type: keyword -- -*`rsa.misc.risk_num_static`*:: +*`fortinet.firewall.message_type`*:: + -- -This key captures Risk Number Static +VOIP message type -type: double + +type: keyword -- -*`rsa.misc.risk_suspicious`*:: +*`fortinet.firewall.method`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +HTTP method + type: keyword -- -*`rsa.misc.risk_warning`*:: +*`fortinet.firewall.mgmtcnt`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +The number of unauthorized client flooding managemet frames -type: keyword + +type: integer -- -*`rsa.misc.snmp_oid`*:: +*`fortinet.firewall.mode`*:: + -- -SNMP Object Identifier +IPSEC mode + type: keyword -- -*`rsa.misc.sql`*:: +*`fortinet.firewall.module`*:: + -- -This key captures the SQL query +PCI-DSS module + type: keyword -- -*`rsa.misc.vuln_ref`*:: +*`fortinet.firewall.monitor-name`*:: + -- -This key captures the Vulnerability Reference details +Health Monitor Name + type: keyword -- -*`rsa.misc.acl_id`*:: +*`fortinet.firewall.monitor-type`*:: + -- +Health Monitor Type + + type: keyword -- -*`rsa.misc.acl_op`*:: +*`fortinet.firewall.mpsk`*:: + -- +Wireless MPSK + + type: keyword -- -*`rsa.misc.acl_pos`*:: +*`fortinet.firewall.msgproto`*:: + -- +Message Protocol Number + + type: keyword -- -*`rsa.misc.acl_table`*:: +*`fortinet.firewall.mtu`*:: + -- -type: keyword +Max Transmission Unit Value + + +type: integer -- -*`rsa.misc.admin`*:: +*`fortinet.firewall.name`*:: + -- +Name + + type: keyword -- -*`rsa.misc.alarm_id`*:: +*`fortinet.firewall.nat`*:: + -- +NAT IP Address + + type: keyword -- -*`rsa.misc.alarmname`*:: +*`fortinet.firewall.netid`*:: + -- +Connector NetID + + type: keyword -- -*`rsa.misc.app_id`*:: +*`fortinet.firewall.new_status`*:: + -- +New status on user change + + type: keyword -- -*`rsa.misc.audit`*:: +*`fortinet.firewall.new_value`*:: + -- +New Virtual Domain Name + + type: keyword -- -*`rsa.misc.audit_object`*:: +*`fortinet.firewall.newchannel`*:: + -- -type: keyword +New Channel Number + + +type: integer -- -*`rsa.misc.auditdata`*:: +*`fortinet.firewall.newchassisid`*:: + -- -type: keyword +New Chassis ID + + +type: integer -- -*`rsa.misc.benchmark`*:: +*`fortinet.firewall.newslot`*:: + -- -type: keyword +New Slot Number + + +type: integer -- -*`rsa.misc.bypass`*:: +*`fortinet.firewall.nextstat`*:: + -- -type: keyword +Time interval in seconds for the next statistics. + + +type: integer -- -*`rsa.misc.cache`*:: +*`fortinet.firewall.nf_type`*:: + -- +Notification Type + + type: keyword -- -*`rsa.misc.cache_hit`*:: +*`fortinet.firewall.noise`*:: + -- -type: keyword +Wifi Noise + + +type: integer -- -*`rsa.misc.cefversion`*:: +*`fortinet.firewall.old_status`*:: + -- +Original Status + + type: keyword -- -*`rsa.misc.cfg_attr`*:: +*`fortinet.firewall.old_value`*:: + -- +Original Virtual Domain name + + type: keyword -- -*`rsa.misc.cfg_obj`*:: +*`fortinet.firewall.oldchannel`*:: + -- -type: keyword +Original channel + + +type: integer -- -*`rsa.misc.cfg_path`*:: +*`fortinet.firewall.oldchassisid`*:: + -- -type: keyword +Original Chassis Number + + +type: integer -- -*`rsa.misc.changes`*:: +*`fortinet.firewall.oldslot`*:: + -- -type: keyword +Original Slot Number + + +type: integer -- -*`rsa.misc.client_ip`*:: +*`fortinet.firewall.oldsn`*:: + -- +Old Serial number + + type: keyword -- -*`rsa.misc.clustermembers`*:: +*`fortinet.firewall.oldwprof`*:: + -- +Old Web Filter Profile + + type: keyword -- -*`rsa.misc.cn_acttimeout`*:: +*`fortinet.firewall.onwire`*:: + -- +A flag to indicate if the AP is onwire or not + + type: keyword -- -*`rsa.misc.cn_asn_src`*:: +*`fortinet.firewall.opercountry`*:: + -- +Operating Country + + type: keyword -- -*`rsa.misc.cn_bgpv4nxthop`*:: +*`fortinet.firewall.opertxpower`*:: + -- -type: keyword +Operating TX power + + +type: integer -- -*`rsa.misc.cn_ctr_dst_code`*:: +*`fortinet.firewall.osname`*:: + -- +Operating System name + + type: keyword -- -*`rsa.misc.cn_dst_tos`*:: +*`fortinet.firewall.osversion`*:: + -- +Operating System version + + type: keyword -- -*`rsa.misc.cn_dst_vlan`*:: +*`fortinet.firewall.out_spi`*:: + -- +Out SPI + + type: keyword -- -*`rsa.misc.cn_engine_id`*:: +*`fortinet.firewall.outintf`*:: + -- +Out interface + + type: keyword -- -*`rsa.misc.cn_engine_type`*:: +*`fortinet.firewall.passedcount`*:: + -- -type: keyword +Fabric passed count + + +type: integer -- -*`rsa.misc.cn_f_switch`*:: +*`fortinet.firewall.passwd`*:: + -- +Changed user password information + + type: keyword -- -*`rsa.misc.cn_flowsampid`*:: +*`fortinet.firewall.path`*:: + -- +Path of looped configuration for security fabric + + type: keyword -- -*`rsa.misc.cn_flowsampintv`*:: +*`fortinet.firewall.peer`*:: + -- +WAN optimization peer + + type: keyword -- -*`rsa.misc.cn_flowsampmode`*:: +*`fortinet.firewall.peer_notif`*:: + -- +VPN peer notification + + type: keyword -- -*`rsa.misc.cn_inacttimeout`*:: +*`fortinet.firewall.phase2_name`*:: + -- +VPN phase2 name + + type: keyword -- -*`rsa.misc.cn_inpermbyts`*:: +*`fortinet.firewall.phone`*:: + -- +VOIP Phone + + type: keyword -- -*`rsa.misc.cn_inpermpckts`*:: +*`fortinet.firewall.pid`*:: + -- -type: keyword +Process ID + + +type: integer -- -*`rsa.misc.cn_invalid`*:: +*`fortinet.firewall.policytype`*:: + -- +Policy Type + + type: keyword -- -*`rsa.misc.cn_ip_proto_ver`*:: +*`fortinet.firewall.poolname`*:: + -- +IP Pool name + + type: keyword -- -*`rsa.misc.cn_ipv4_ident`*:: +*`fortinet.firewall.port`*:: + -- -type: keyword +Log upload error port + + +type: integer -- -*`rsa.misc.cn_l_switch`*:: +*`fortinet.firewall.portbegin`*:: + -- -type: keyword +IP Pool port number to begin + + +type: integer -- -*`rsa.misc.cn_log_did`*:: +*`fortinet.firewall.portend`*:: + -- -type: keyword +IP Pool port number to end + + +type: integer -- -*`rsa.misc.cn_log_rid`*:: +*`fortinet.firewall.probeproto`*:: + -- +Link Monitor Probe Protocol + + type: keyword -- -*`rsa.misc.cn_max_ttl`*:: +*`fortinet.firewall.process`*:: + -- +URL Filter process + + type: keyword -- -*`rsa.misc.cn_maxpcktlen`*:: +*`fortinet.firewall.processtime`*:: + -- -type: keyword +Process time for reports + + +type: integer -- -*`rsa.misc.cn_min_ttl`*:: +*`fortinet.firewall.profile`*:: + -- +Profile Name + + type: keyword -- -*`rsa.misc.cn_minpcktlen`*:: +*`fortinet.firewall.profile_vd`*:: + -- +Virtual Domain Name + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_1`*:: +*`fortinet.firewall.profilegroup`*:: + -- +Profile Group Name + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_10`*:: +*`fortinet.firewall.profiletype`*:: + -- +Profile Type + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_2`*:: +*`fortinet.firewall.qtypeval`*:: + -- -type: keyword +DNS question type value + + +type: integer -- -*`rsa.misc.cn_mpls_lbl_3`*:: +*`fortinet.firewall.quarskip`*:: + -- +Quarantine skip explanation + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_4`*:: +*`fortinet.firewall.quotaexceeded`*:: + -- +If quota has been exceeded + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_5`*:: +*`fortinet.firewall.quotamax`*:: + -- -type: keyword +Maximum quota allowed - in seconds if time-based - in bytes if traffic-based + + +type: long -- -*`rsa.misc.cn_mpls_lbl_6`*:: +*`fortinet.firewall.quotatype`*:: + -- +Quota type + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_7`*:: +*`fortinet.firewall.quotaused`*:: + -- -type: keyword +Quota used - in seconds if time-based - in bytes if trafficbased) + + +type: long -- -*`rsa.misc.cn_mpls_lbl_8`*:: +*`fortinet.firewall.radioband`*:: + -- +Radio band + + type: keyword -- -*`rsa.misc.cn_mpls_lbl_9`*:: +*`fortinet.firewall.radioid`*:: + -- -type: keyword +Radio ID + + +type: integer -- -*`rsa.misc.cn_mplstoplabel`*:: +*`fortinet.firewall.radioidclosest`*:: + -- -type: keyword +Radio ID on the AP closest the rogue AP + + +type: integer -- -*`rsa.misc.cn_mplstoplabip`*:: +*`fortinet.firewall.radioiddetected`*:: + -- -type: keyword +Radio ID on the AP which detected the rogue AP + + +type: integer -- -*`rsa.misc.cn_mul_dst_byt`*:: +*`fortinet.firewall.rate`*:: + -- +Wireless rogue rate value + + type: keyword -- -*`rsa.misc.cn_mul_dst_pks`*:: +*`fortinet.firewall.rawdata`*:: + -- +Raw data value + + type: keyword -- -*`rsa.misc.cn_muligmptype`*:: +*`fortinet.firewall.rawdataid`*:: + -- +Raw data ID + + type: keyword -- -*`rsa.misc.cn_sampalgo`*:: +*`fortinet.firewall.rcvddelta`*:: + -- +Received bytes delta + + type: keyword -- -*`rsa.misc.cn_sampint`*:: +*`fortinet.firewall.reason`*:: + -- +Alert reason + + type: keyword -- -*`rsa.misc.cn_seqctr`*:: +*`fortinet.firewall.received`*:: + -- -type: keyword +Server key exchange received + + +type: integer -- -*`rsa.misc.cn_spackets`*:: +*`fortinet.firewall.receivedsignature`*:: + -- +Server key exchange received signature + + type: keyword -- -*`rsa.misc.cn_src_tos`*:: +*`fortinet.firewall.red`*:: + -- +Memory information in red + + type: keyword -- -*`rsa.misc.cn_src_vlan`*:: +*`fortinet.firewall.referralurl`*:: + -- +Web filter referralurl + + type: keyword -- -*`rsa.misc.cn_sysuptime`*:: +*`fortinet.firewall.remote`*:: + -- -type: keyword +Remote PPP IP address + + +type: ip -- -*`rsa.misc.cn_template_id`*:: +*`fortinet.firewall.remotewtptime`*:: + -- +Remote Wifi Radius authentication time + + type: keyword -- -*`rsa.misc.cn_totbytsexp`*:: +*`fortinet.firewall.reporttype`*:: + -- +Report type + + type: keyword -- -*`rsa.misc.cn_totflowexp`*:: +*`fortinet.firewall.reqtype`*:: + -- +Request type + + type: keyword -- -*`rsa.misc.cn_totpcktsexp`*:: +*`fortinet.firewall.request_name`*:: + -- +VOIP request name + + type: keyword -- -*`rsa.misc.cn_unixnanosecs`*:: +*`fortinet.firewall.result`*:: + -- +VPN phase result + + type: keyword -- -*`rsa.misc.cn_v6flowlabel`*:: +*`fortinet.firewall.role`*:: + -- +VPN Phase 2 role + + type: keyword -- -*`rsa.misc.cn_v6optheaders`*:: +*`fortinet.firewall.rssi`*:: + -- -type: keyword +Received signal strength indicator + + +type: integer -- -*`rsa.misc.comp_class`*:: +*`fortinet.firewall.rsso_key`*:: + -- +RADIUS SSO attribute value + + type: keyword -- -*`rsa.misc.comp_name`*:: +*`fortinet.firewall.ruledata`*:: + -- +Rule data + + type: keyword -- -*`rsa.misc.comp_rbytes`*:: +*`fortinet.firewall.ruletype`*:: + -- +Rule type + + type: keyword -- -*`rsa.misc.comp_sbytes`*:: +*`fortinet.firewall.scanned`*:: + -- -type: keyword +Number of Scanned MMSs + + +type: integer -- -*`rsa.misc.cpu_data`*:: +*`fortinet.firewall.scantime`*:: + -- -type: keyword +Scanned time + + +type: long -- -*`rsa.misc.criticality`*:: +*`fortinet.firewall.scope`*:: + -- +FortiGuard Override Scope + + type: keyword -- -*`rsa.misc.cs_agency_dst`*:: +*`fortinet.firewall.security`*:: + -- +Wireless rogue security + + type: keyword -- -*`rsa.misc.cs_analyzedby`*:: +*`fortinet.firewall.sensitivity`*:: + -- +Sensitivity for document fingerprint + + type: keyword -- -*`rsa.misc.cs_av_other`*:: +*`fortinet.firewall.sensor`*:: + -- +NAC Sensor Name + + type: keyword -- -*`rsa.misc.cs_av_primary`*:: +*`fortinet.firewall.sentdelta`*:: + -- +Sent bytes delta + + type: keyword -- -*`rsa.misc.cs_av_secondary`*:: +*`fortinet.firewall.seq`*:: + -- +Sequence number + + type: keyword -- -*`rsa.misc.cs_bgpv6nxthop`*:: +*`fortinet.firewall.serial`*:: + -- +WAN optimisation serial + + type: keyword -- -*`rsa.misc.cs_bit9status`*:: +*`fortinet.firewall.serialno`*:: + -- +Serial number + + type: keyword -- -*`rsa.misc.cs_context`*:: +*`fortinet.firewall.server`*:: + -- +AD server FQDN or IP + + type: keyword -- -*`rsa.misc.cs_control`*:: +*`fortinet.firewall.session_id`*:: + -- +Session ID + + type: keyword -- -*`rsa.misc.cs_data`*:: +*`fortinet.firewall.sessionid`*:: + -- -type: keyword +WAD Session ID + + +type: integer -- -*`rsa.misc.cs_datecret`*:: +*`fortinet.firewall.setuprate`*:: + -- -type: keyword +Session Setup Rate + + +type: long -- -*`rsa.misc.cs_dst_tld`*:: +*`fortinet.firewall.severity`*:: + -- +Severity + + type: keyword -- -*`rsa.misc.cs_eth_dst_ven`*:: +*`fortinet.firewall.shaperdroprcvdbyte`*:: + -- -type: keyword +Received bytes dropped by shaper + + +type: integer -- -*`rsa.misc.cs_eth_src_ven`*:: +*`fortinet.firewall.shaperdropsentbyte`*:: + -- -type: keyword +Sent bytes dropped by shaper + + +type: integer -- -*`rsa.misc.cs_event_uuid`*:: +*`fortinet.firewall.shaperperipdropbyte`*:: + -- -type: keyword +Dropped bytes per IP by shaper + + +type: integer -- -*`rsa.misc.cs_filetype`*:: +*`fortinet.firewall.shaperperipname`*:: + -- +Traffic shaper name (per IP) + + type: keyword -- -*`rsa.misc.cs_fld`*:: +*`fortinet.firewall.shaperrcvdname`*:: + -- +Traffic shaper name for received traffic + + type: keyword -- -*`rsa.misc.cs_if_desc`*:: +*`fortinet.firewall.shapersentname`*:: + -- +Traffic shaper name for sent traffic + + type: keyword -- -*`rsa.misc.cs_if_name`*:: +*`fortinet.firewall.shapingpolicyid`*:: + -- -type: keyword +Traffic shaper policy ID + + +type: integer -- -*`rsa.misc.cs_ip_next_hop`*:: +*`fortinet.firewall.signal`*:: + -- -type: keyword +Wireless rogue API signal + + +type: integer -- -*`rsa.misc.cs_ipv4dstpre`*:: +*`fortinet.firewall.size`*:: + -- -type: keyword +Email size in bytes + + +type: long -- -*`rsa.misc.cs_ipv4srcpre`*:: +*`fortinet.firewall.slot`*:: + -- -type: keyword +Slot number + + +type: integer -- -*`rsa.misc.cs_lifetime`*:: +*`fortinet.firewall.sn`*:: + -- +Security fabric serial number + + type: keyword -- -*`rsa.misc.cs_log_medium`*:: +*`fortinet.firewall.snclosest`*:: + -- +SN of the AP closest to the rogue AP + + type: keyword -- -*`rsa.misc.cs_loginname`*:: +*`fortinet.firewall.sndetected`*:: + -- +SN of the AP which detected the rogue AP + + type: keyword -- -*`rsa.misc.cs_modulescore`*:: +*`fortinet.firewall.snmeshparent`*:: + -- +SN of the mesh parent + + type: keyword -- -*`rsa.misc.cs_modulesign`*:: +*`fortinet.firewall.spi`*:: + -- +IPSEC SPI + + type: keyword -- -*`rsa.misc.cs_opswatresult`*:: +*`fortinet.firewall.src_int`*:: + -- +Source interface + + type: keyword -- -*`rsa.misc.cs_payload`*:: +*`fortinet.firewall.srcintfrole`*:: + -- +Source interface role + + type: keyword -- -*`rsa.misc.cs_registrant`*:: +*`fortinet.firewall.srccountry`*:: + -- +Source country + + type: keyword -- -*`rsa.misc.cs_registrar`*:: +*`fortinet.firewall.srcfamily`*:: + -- +Source family + + type: keyword -- -*`rsa.misc.cs_represult`*:: +*`fortinet.firewall.srchwvendor`*:: + -- +Source hardware vendor + + type: keyword -- -*`rsa.misc.cs_rpayload`*:: +*`fortinet.firewall.srchwversion`*:: + -- +Source hardware version + + type: keyword -- -*`rsa.misc.cs_sampler_name`*:: +*`fortinet.firewall.srcinetsvc`*:: + -- +Source interface service + + type: keyword -- -*`rsa.misc.cs_sourcemodule`*:: +*`fortinet.firewall.srcname`*:: + -- +Source name + + type: keyword -- -*`rsa.misc.cs_streams`*:: +*`fortinet.firewall.srcserver`*:: + -- -type: keyword +Source server + + +type: integer -- -*`rsa.misc.cs_targetmodule`*:: +*`fortinet.firewall.srcssid`*:: + -- +Source SSID + + type: keyword -- -*`rsa.misc.cs_v6nxthop`*:: +*`fortinet.firewall.srcswversion`*:: + -- +Source software version + + type: keyword -- -*`rsa.misc.cs_whois_server`*:: +*`fortinet.firewall.srcuuid`*:: + -- +Source UUID + + type: keyword -- -*`rsa.misc.cs_yararesult`*:: +*`fortinet.firewall.sscname`*:: + -- +SSC name + + type: keyword -- -*`rsa.misc.description`*:: +*`fortinet.firewall.ssid`*:: + -- +Base Service Set ID + + type: keyword -- -*`rsa.misc.devvendor`*:: +*`fortinet.firewall.sslaction`*:: + -- +SSL Action + + type: keyword -- -*`rsa.misc.distance`*:: +*`fortinet.firewall.ssllocal`*:: + -- +WAD SSL local + + type: keyword -- -*`rsa.misc.dstburb`*:: +*`fortinet.firewall.sslremote`*:: + -- +WAD SSL remote + + type: keyword -- -*`rsa.misc.edomain`*:: +*`fortinet.firewall.stacount`*:: + -- -type: keyword +Number of stations/clients + + +type: integer -- -*`rsa.misc.edomaub`*:: +*`fortinet.firewall.stage`*:: + -- +IPSEC stage + + type: keyword -- -*`rsa.misc.euid`*:: +*`fortinet.firewall.stamac`*:: + -- +802.1x station mac + + type: keyword -- -*`rsa.misc.facility`*:: +*`fortinet.firewall.state`*:: + -- +Admin login state + + type: keyword -- -*`rsa.misc.finterface`*:: +*`fortinet.firewall.status`*:: + -- +Status + + type: keyword -- -*`rsa.misc.flags`*:: +*`fortinet.firewall.stitch`*:: + -- +Automation stitch triggered + + type: keyword -- -*`rsa.misc.gaddr`*:: +*`fortinet.firewall.subject`*:: + -- +Email subject + + type: keyword -- -*`rsa.misc.id3`*:: +*`fortinet.firewall.submodule`*:: + -- +Configuration Sub-Module Name + + type: keyword -- -*`rsa.misc.im_buddyname`*:: +*`fortinet.firewall.subservice`*:: + -- +AV subservice + + type: keyword -- -*`rsa.misc.im_croomid`*:: +*`fortinet.firewall.subtype`*:: + -- +Log subtype + + type: keyword -- -*`rsa.misc.im_croomtype`*:: +*`fortinet.firewall.suspicious`*:: + -- -type: keyword +Number of Suspicious MMSs + + +type: integer -- -*`rsa.misc.im_members`*:: +*`fortinet.firewall.switchproto`*:: + -- +Protocol change information + + type: keyword -- -*`rsa.misc.im_username`*:: +*`fortinet.firewall.sync_status`*:: + -- +The sync status with the master + + type: keyword -- -*`rsa.misc.ipkt`*:: +*`fortinet.firewall.sync_type`*:: + -- +The sync type with the master + + type: keyword -- -*`rsa.misc.ipscat`*:: +*`fortinet.firewall.sysuptime`*:: + -- +System uptime + + type: keyword -- -*`rsa.misc.ipspri`*:: +*`fortinet.firewall.tamac`*:: + -- +the MAC address of Transmitter, if none, then Receiver + + type: keyword -- -*`rsa.misc.latitude`*:: +*`fortinet.firewall.threattype`*:: + -- +WIDS threat type + + type: keyword -- -*`rsa.misc.linenum`*:: +*`fortinet.firewall.time`*:: + -- +Time of the event + + type: keyword -- -*`rsa.misc.list_name`*:: +*`fortinet.firewall.to`*:: + -- +Email to field + + type: keyword -- -*`rsa.misc.load_data`*:: +*`fortinet.firewall.to_vcluster`*:: + -- -type: keyword +destination virtual cluster number + + +type: integer -- -*`rsa.misc.location_floor`*:: +*`fortinet.firewall.total`*:: + -- -type: keyword +Total memory + + +type: integer -- -*`rsa.misc.location_mark`*:: +*`fortinet.firewall.totalsession`*:: + -- -type: keyword +Total Number of Sessions + + +type: integer -- -*`rsa.misc.log_id`*:: +*`fortinet.firewall.trace_id`*:: + -- +Session clash trace ID + + type: keyword -- -*`rsa.misc.log_type`*:: +*`fortinet.firewall.trandisp`*:: + -- +NAT translation type + + type: keyword -- -*`rsa.misc.logid`*:: +*`fortinet.firewall.transid`*:: + -- -type: keyword +HTTP transaction ID + + +type: integer -- -*`rsa.misc.logip`*:: +*`fortinet.firewall.translationid`*:: + -- +DNS filter transaltion ID + + type: keyword -- -*`rsa.misc.logname`*:: +*`fortinet.firewall.trigger`*:: + -- +Automation stitch trigger + + type: keyword -- -*`rsa.misc.longitude`*:: +*`fortinet.firewall.trueclntip`*:: + -- -type: keyword +File filter true client IP + + +type: ip -- -*`rsa.misc.lport`*:: +*`fortinet.firewall.tunnelid`*:: + -- -type: keyword +IPSEC tunnel ID + + +type: integer -- -*`rsa.misc.mbug_data`*:: +*`fortinet.firewall.tunnelip`*:: + -- -type: keyword +IPSEC tunnel IP + + +type: ip -- -*`rsa.misc.misc_name`*:: +*`fortinet.firewall.tunneltype`*:: + -- +IPSEC tunnel type + + type: keyword -- -*`rsa.misc.msg_type`*:: +*`fortinet.firewall.type`*:: + -- +Module type + + type: keyword -- -*`rsa.misc.msgid`*:: +*`fortinet.firewall.ui`*:: + -- +Admin authentication UI type + + type: keyword -- -*`rsa.misc.netsessid`*:: +*`fortinet.firewall.unauthusersource`*:: + -- +Unauthenticated user source + + type: keyword -- -*`rsa.misc.num`*:: +*`fortinet.firewall.unit`*:: + -- -type: keyword +Power supply unit + + +type: integer -- -*`rsa.misc.number1`*:: +*`fortinet.firewall.urlfilteridx`*:: + -- -type: keyword +URL filter ID + + +type: integer -- -*`rsa.misc.number2`*:: +*`fortinet.firewall.urlfilterlist`*:: + -- +URL filter list + + type: keyword -- -*`rsa.misc.nwwn`*:: +*`fortinet.firewall.urlsource`*:: + -- +URL filter source + + type: keyword -- -*`rsa.misc.object`*:: +*`fortinet.firewall.urltype`*:: + -- +URL filter type + + type: keyword -- -*`rsa.misc.operation`*:: +*`fortinet.firewall.used`*:: + -- -type: keyword +Number of Used IPs + + +type: integer -- -*`rsa.misc.opkt`*:: +*`fortinet.firewall.used_for_type`*:: + -- -type: keyword +Connection for the type + + +type: integer -- -*`rsa.misc.orig_from`*:: +*`fortinet.firewall.utmaction`*:: + -- +Security action performed by UTM + + type: keyword -- -*`rsa.misc.owner_id`*:: +*`fortinet.firewall.vap`*:: + -- +Virtual AP + + type: keyword -- -*`rsa.misc.p_action`*:: +*`fortinet.firewall.vapmode`*:: + -- +Virtual AP mode + + type: keyword -- -*`rsa.misc.p_filter`*:: +*`fortinet.firewall.vcluster`*:: + -- -type: keyword +virtual cluster id + + +type: integer -- -*`rsa.misc.p_group_object`*:: +*`fortinet.firewall.vcluster_member`*:: + -- -type: keyword +Virtual cluster member + + +type: integer -- -*`rsa.misc.p_id`*:: +*`fortinet.firewall.vcluster_state`*:: + -- +Virtual cluster state + + type: keyword -- -*`rsa.misc.p_msgid1`*:: +*`fortinet.firewall.vd`*:: + -- +Virtual Domain Name + + type: keyword -- -*`rsa.misc.p_msgid2`*:: +*`fortinet.firewall.vdname`*:: + -- +Virtual Domain Name + + type: keyword -- -*`rsa.misc.p_result1`*:: +*`fortinet.firewall.vendorurl`*:: + -- +Vulnerability scan vendor name + + type: keyword -- -*`rsa.misc.password_chg`*:: +*`fortinet.firewall.version`*:: + -- +Version + + type: keyword -- -*`rsa.misc.password_expire`*:: +*`fortinet.firewall.vip`*:: + -- +Virtual IP + + type: keyword -- -*`rsa.misc.permgranted`*:: +*`fortinet.firewall.virus`*:: + -- +Virus name + + type: keyword -- -*`rsa.misc.permwanted`*:: +*`fortinet.firewall.virusid`*:: + -- -type: keyword +Virus ID (unique virus identifier) + + +type: integer -- -*`rsa.misc.pgid`*:: +*`fortinet.firewall.voip_proto`*:: + -- +VOIP protocol + + type: keyword -- -*`rsa.misc.policyUUID`*:: +*`fortinet.firewall.vpn`*:: + -- +VPN description + + type: keyword -- -*`rsa.misc.prog_asp_num`*:: +*`fortinet.firewall.vpntunnel`*:: + -- +IPsec Vpn Tunnel Name + + type: keyword -- -*`rsa.misc.program`*:: +*`fortinet.firewall.vpntype`*:: + -- +The type of the VPN tunnel + + type: keyword -- -*`rsa.misc.real_data`*:: +*`fortinet.firewall.vrf`*:: + -- -type: keyword +VRF number + + +type: integer -- -*`rsa.misc.rec_asp_device`*:: +*`fortinet.firewall.vulncat`*:: + -- +Vulnerability Category + + type: keyword -- -*`rsa.misc.rec_asp_num`*:: +*`fortinet.firewall.vulnid`*:: + -- -type: keyword +Vulnerability ID + + +type: integer -- -*`rsa.misc.rec_library`*:: +*`fortinet.firewall.vulnname`*:: + -- +Vulnerability name + + type: keyword -- -*`rsa.misc.recordnum`*:: +*`fortinet.firewall.vwlid`*:: + -- -type: keyword +VWL ID + + +type: integer -- -*`rsa.misc.ruid`*:: +*`fortinet.firewall.vwlquality`*:: + -- +VWL quality + + type: keyword -- -*`rsa.misc.sburb`*:: +*`fortinet.firewall.vwlservice`*:: + -- +VWL service + + type: keyword -- -*`rsa.misc.sdomain_fld`*:: +*`fortinet.firewall.vwpvlanid`*:: + -- -type: keyword +VWP VLAN ID + + +type: integer -- -*`rsa.misc.sec`*:: +*`fortinet.firewall.wanin`*:: + -- -type: keyword +WAN incoming traffic in bytes + + +type: long -- -*`rsa.misc.sensorname`*:: +*`fortinet.firewall.wanoptapptype`*:: + -- +WAN Optimization Application type + + type: keyword -- -*`rsa.misc.seqnum`*:: +*`fortinet.firewall.wanout`*:: + -- -type: keyword +WAN outgoing traffic in bytes + + +type: long -- -*`rsa.misc.session`*:: +*`fortinet.firewall.weakwepiv`*:: + -- +Weak Wep Initiation Vector + + type: keyword -- -*`rsa.misc.sessiontype`*:: +*`fortinet.firewall.xauthgroup`*:: + -- +XAuth Group Name + + type: keyword -- -*`rsa.misc.sigUUID`*:: +*`fortinet.firewall.xauthuser`*:: + -- +XAuth User Name + + type: keyword -- -*`rsa.misc.spi`*:: +*`fortinet.firewall.xid`*:: + -- -type: keyword +Wireless X ID + + +type: integer -- -*`rsa.misc.srcburb`*:: +[[exported-fields-googlecloud]] +== Google Cloud fields + +Module for handling logs from Google Cloud. + + + +[float] +=== googlecloud + +Fields from Google Cloud logs. + + + +[float] +=== destination.instance + +If the destination of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project. + + + +*`googlecloud.destination.instance.project_id`*:: + -- +ID of the project containing the VM. + + type: keyword -- -*`rsa.misc.srcdom`*:: +*`googlecloud.destination.instance.region`*:: + -- +Region of the VM. + + type: keyword -- -*`rsa.misc.srcservice`*:: +*`googlecloud.destination.instance.zone`*:: + -- +Zone of the VM. + + type: keyword -- -*`rsa.misc.state`*:: +[float] +=== destination.vpc + +If the destination of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project. + + + +*`googlecloud.destination.vpc.project_id`*:: + -- +ID of the project containing the VM. + + type: keyword -- -*`rsa.misc.status1`*:: +*`googlecloud.destination.vpc.vpc_name`*:: + -- +VPC on which the VM is operating. + + type: keyword -- -*`rsa.misc.svcno`*:: +*`googlecloud.destination.vpc.subnetwork_name`*:: + -- +Subnetwork on which the VM is operating. + + type: keyword -- -*`rsa.misc.system`*:: +[float] +=== source.instance + +If the source of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project. + + + +*`googlecloud.source.instance.project_id`*:: + -- +ID of the project containing the VM. + + type: keyword -- -*`rsa.misc.tbdstr1`*:: +*`googlecloud.source.instance.region`*:: + -- +Region of the VM. + + type: keyword -- -*`rsa.misc.tgtdom`*:: +*`googlecloud.source.instance.zone`*:: + -- +Zone of the VM. + + type: keyword -- -*`rsa.misc.tgtdomain`*:: +[float] +=== source.vpc + +If the source of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project. + + + +*`googlecloud.source.vpc.project_id`*:: + -- +ID of the project containing the VM. + + type: keyword -- -*`rsa.misc.threshold`*:: +*`googlecloud.source.vpc.vpc_name`*:: + -- +VPC on which the VM is operating. + + type: keyword -- -*`rsa.misc.type1`*:: +*`googlecloud.source.vpc.subnetwork_name`*:: + -- +Subnetwork on which the VM is operating. + + type: keyword -- -*`rsa.misc.udb_class`*:: +[float] +=== audit + +Fields for Google Cloud audit logs. + + + +*`googlecloud.audit.type`*:: + -- +Type property. + + type: keyword -- -*`rsa.misc.url_fld`*:: +[float] +=== authentication_info + +Authentication information. + + + +*`googlecloud.audit.authentication_info.principal_email`*:: + -- +The email address of the authenticated user making the request. + + type: keyword -- -*`rsa.misc.user_div`*:: +*`googlecloud.audit.authentication_info.authority_selector`*:: + -- +The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. + + type: keyword -- -*`rsa.misc.userid`*:: +*`googlecloud.audit.authorization_info`*:: + -- -type: keyword +Authorization information for the operation. + + +type: array -- -*`rsa.misc.username_fld`*:: +*`googlecloud.audit.method_name`*:: + -- +The name of the service method or operation. For API calls, this should be the name of the API method. For example, 'google.datastore.v1.Datastore.RunQuery'. + + type: keyword -- -*`rsa.misc.utcstamp`*:: +*`googlecloud.audit.num_response_items`*:: + -- -type: keyword +The number of items returned from a List or Query API method, if applicable. + + +type: long -- -*`rsa.misc.v_instafname`*:: +[float] +=== request + +The operation request. + + + +*`googlecloud.audit.request.proto_name`*:: + -- +Type property of the request. + + type: keyword -- -*`rsa.misc.virt_data`*:: +*`googlecloud.audit.request.filter`*:: + -- +Filter of the request. + + type: keyword -- -*`rsa.misc.vpnid`*:: +*`googlecloud.audit.request.name`*:: + -- +Name of the request. + + type: keyword -- -*`rsa.misc.autorun_type`*:: +*`googlecloud.audit.request.resource_name`*:: + -- -This is used to capture Auto Run type +Name of the request resource. + type: keyword -- -*`rsa.misc.cc_number`*:: +[float] +=== request_metadata + +Metadata about the request. + + + +*`googlecloud.audit.request_metadata.caller_ip`*:: + -- -Valid Credit Card Numbers only +The IP address of the caller. -type: long + +type: ip -- -*`rsa.misc.content`*:: +*`googlecloud.audit.request_metadata.caller_supplied_user_agent`*:: + -- -This key captures the content type from protocol headers +The user agent of the caller. This information is not authenticated and should be treated accordingly. + type: keyword -- -*`rsa.misc.ein_number`*:: +[float] +=== response + +The operation response. + + + +*`googlecloud.audit.response.proto_name`*:: + -- -Employee Identification Numbers only +Type property of the response. -type: long + +type: keyword -- -*`rsa.misc.found`*:: +[float] +=== details + +The details of the response. + + + +*`googlecloud.audit.response.details.group`*:: + -- -This is used to capture the results of regex match +The name of the group. + type: keyword -- -*`rsa.misc.language`*:: +*`googlecloud.audit.response.details.kind`*:: + -- -This is used to capture list of languages the client support and what it prefers +The kind of the response details. + type: keyword -- -*`rsa.misc.lifetime`*:: +*`googlecloud.audit.response.details.name`*:: + -- -This key is used to capture the session lifetime in seconds. +The name of the response details. -type: long + +type: keyword -- -*`rsa.misc.link`*:: +*`googlecloud.audit.response.details.uid`*:: + -- -This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +The uid of the response details. + type: keyword -- -*`rsa.misc.match`*:: +*`googlecloud.audit.response.status`*:: + -- -This key is for regex match name from search.ini +Status of the response. + type: keyword -- -*`rsa.misc.param_dst`*:: +*`googlecloud.audit.resource_name`*:: + -- -This key captures the command line/launch argument of the target process or file +The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. + type: keyword -- -*`rsa.misc.param_src`*:: +[float] +=== resource_location + +The location of the resource. + + + +*`googlecloud.audit.resource_location.current_locations`*:: + -- -This key captures source parameter +Current locations of the resource. + type: keyword -- -*`rsa.misc.search_text`*:: +*`googlecloud.audit.service_name`*:: + -- -This key captures the Search Text used +The name of the API service performing the operation. For example, datastore.googleapis.com. + type: keyword -- -*`rsa.misc.sig_name`*:: +[float] +=== status + +The status of the overall operation. + + + +*`googlecloud.audit.status.code`*:: + -- -This key is used to capture the Signature Name only. +The status code, which should be an enum value of google.rpc.Code. -type: keyword + +type: integer -- -*`rsa.misc.snmp_value`*:: +*`googlecloud.audit.status.message`*:: + -- -SNMP set request value +A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. + type: keyword -- -*`rsa.misc.streams`*:: +[float] +=== firewall + +Fields for Google Cloud Firewall logs. + + + +[float] +=== rule_details + +Description of the firewall rule that matched this connection. + + + +*`googlecloud.firewall.rule_details.priority`*:: + -- -This key captures number of streams in session +The priority for the firewall rule. type: long -- - -*`rsa.db.index`*:: +*`googlecloud.firewall.rule_details.action`*:: + -- -This key captures IndexID of the index. +Action that the rule performs on match. type: keyword -- -*`rsa.db.instance`*:: +*`googlecloud.firewall.rule_details.direction`*:: + -- -This key is used to capture the database server instance name +Direction of traffic that matches this rule. type: keyword -- -*`rsa.db.database`*:: +*`googlecloud.firewall.rule_details.reference`*:: + -- -This key is used to capture the name of a database or an instance as seen in a session +Reference to the firewall rule. type: keyword -- -*`rsa.db.transact_id`*:: +*`googlecloud.firewall.rule_details.source_range`*:: + -- -This key captures the SQL transantion ID of the current session +List of source ranges that the firewall rule applies to. type: keyword -- -*`rsa.db.permissions`*:: +*`googlecloud.firewall.rule_details.destination_range`*:: + -- -This key captures permission or privilege level assigned to a resource. +List of destination ranges that the firewall applies to. type: keyword -- -*`rsa.db.table_name`*:: +*`googlecloud.firewall.rule_details.source_tag`*:: + -- -This key is used to capture the table name +List of all the source tags that the firewall rule applies to. + type: keyword -- -*`rsa.db.db_id`*:: +*`googlecloud.firewall.rule_details.target_tag`*:: + -- -This key is used to capture the unique identifier for a database +List of all the target tags that the firewall rule applies to. + type: keyword -- -*`rsa.db.db_pid`*:: +*`googlecloud.firewall.rule_details.ip_port_info`*:: + -- -This key captures the process id of a connection with database server +List of ip protocols and applicable port ranges for rules. -type: long + +type: array -- -*`rsa.db.lread`*:: +*`googlecloud.firewall.rule_details.source_service_account`*:: + -- -This key is used for the number of logical reads +List of all the source service accounts that the firewall rule applies to. -type: long + +type: keyword -- -*`rsa.db.lwrite`*:: +*`googlecloud.firewall.rule_details.target_service_account`*:: + -- -This key is used for the number of logical writes +List of all the target service accounts that the firewall rule applies to. -type: long --- +type: keyword -*`rsa.db.pread`*:: -+ -- -This key is used for the number of physical writes -type: long +[float] +=== vpcflow --- +Fields for Google Cloud VPC flow logs. -*`rsa.network.alias_host`*:: + +*`googlecloud.vpcflow.reporter`*:: + -- -This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. +The side which reported the flow. Can be either 'SRC' or 'DEST'. + type: keyword -- -*`rsa.network.domain`*:: +*`googlecloud.vpcflow.rtt.ms`*:: + -- -type: keyword +Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay. --- -*`rsa.network.host_dst`*:: -+ +type: long + -- -This key should only be used when it’s a Destination Hostname -type: keyword +[[exported-fields-gsuite]] +== gsuite fields --- +gsuite Module -*`rsa.network.network_service`*:: + + +[float] +=== gsuite + +Gsuite specific fields. +More information about specific fields can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list + + + +*`gsuite.actor.type`*:: + -- -This is used to capture layer 7 protocols/service names +The type of actor. +Values can be: + *USER*: Another user in the same domain. + *EXTERNAL_USER*: A user outside the domain. + *KEY*: A non-human actor. + type: keyword -- -*`rsa.network.interface`*:: +*`gsuite.actor.key`*:: + -- -This key should be used when the source or destination context of an interface is not clear +Only present when `actor.type` is `KEY`. Can be the `consumer_key` of the requestor for OAuth 2LO API requests or an identifier for robot accounts. + type: keyword -- -*`rsa.network.network_port`*:: +*`gsuite.event.type`*:: + -- -Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) +The type of GSuite event, mapped from `items[].events[].type` in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list -type: long + +type: keyword + +example: audit#activity -- -*`rsa.network.eth_host`*:: +*`gsuite.kind`*:: + -- -Deprecated, use alias.mac +The type of API resource, mapped from `kind` in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list + type: keyword +example: audit#activity + -- -*`rsa.network.sinterface`*:: +*`gsuite.organization.domain`*:: + -- -This key should only be used when it’s a Source Interface +The domain that is affected by the report's event. + type: keyword -- -*`rsa.network.dinterface`*:: + +*`gsuite.admin.application.edition`*:: + -- -This key should only be used when it’s a Destination Interface +The GSuite edition. type: keyword -- -*`rsa.network.vlan`*:: +*`gsuite.admin.application.name`*:: + -- -This key should only be used to capture the ID of the Virtual LAN +The application's name. -type: long +type: keyword -- -*`rsa.network.zone_src`*:: +*`gsuite.admin.application.enabled`*:: + -- -This key should only be used when it’s a Source Zone. +The enabled application. type: keyword -- -*`rsa.network.zone`*:: +*`gsuite.admin.application.licences_order_number`*:: + -- -This key should be used when the source or destination context of a Zone is not clear +Order number used to redeem licenses. type: keyword -- -*`rsa.network.zone_dst`*:: +*`gsuite.admin.application.licences_purchased`*:: + -- -This key should only be used when it’s a Destination Zone. +Number of licences purchased. type: keyword -- -*`rsa.network.gateway`*:: +*`gsuite.admin.application.id`*:: + -- -This key is used to capture the IP Address of the gateway +The application ID. type: keyword -- -*`rsa.network.icmp_type`*:: +*`gsuite.admin.application.asp_id`*:: + -- -This key is used to capture the ICMP type only +The application specific password ID. -type: long +type: keyword -- -*`rsa.network.mask`*:: +*`gsuite.admin.application.package_id`*:: + -- -This key is used to capture the device network IPmask. +The mobile application package ID. type: keyword -- -*`rsa.network.icmp_code`*:: +*`gsuite.admin.group.email`*:: + -- -This key is used to capture the ICMP code only +The group's primary email address. -type: long +type: keyword -- -*`rsa.network.protocol_detail`*:: +*`gsuite.admin.new_value`*:: + -- -This key should be used to capture additional protocol information +The new value for the setting. type: keyword -- -*`rsa.network.dmask`*:: +*`gsuite.admin.old_value`*:: + -- -This key is used for Destionation Device network mask +The old value for the setting. type: keyword -- -*`rsa.network.port`*:: +*`gsuite.admin.org_unit.name`*:: + -- -This key should only be used to capture a Network Port when the directionality is not clear +The organizational unit name. -type: long +type: keyword -- -*`rsa.network.smask`*:: +*`gsuite.admin.org_unit.full`*:: + -- -This key is used for capturing source Network Mask +The org unit full path including the root org unit name. type: keyword -- -*`rsa.network.netname`*:: +*`gsuite.admin.setting.name`*:: + -- -This key is used to capture the network name associated with an IP range. This is configured by the end user. +The setting name. type: keyword -- -*`rsa.network.paddr`*:: +*`gsuite.admin.user_defined_setting.name`*:: + -- -Deprecated +The name of the user-defined setting. -type: ip +type: keyword -- -*`rsa.network.faddr`*:: +*`gsuite.admin.setting.description`*:: + -- +The setting name. + type: keyword -- -*`rsa.network.lhost`*:: +*`gsuite.admin.group.priorities`*:: + -- +Group priorities. + type: keyword -- -*`rsa.network.origin`*:: +*`gsuite.admin.domain.alias`*:: + -- +The domain alias. + type: keyword -- -*`rsa.network.remote_domain_id`*:: +*`gsuite.admin.domain.name`*:: + -- +The primary domain name. + type: keyword -- -*`rsa.network.addr`*:: +*`gsuite.admin.domain.secondary_name`*:: + -- +The secondary domain name. + type: keyword -- -*`rsa.network.dns_a_record`*:: +*`gsuite.admin.managed_configuration`*:: + -- +The name of the managed configuration. + type: keyword -- -*`rsa.network.dns_ptr_record`*:: +*`gsuite.admin.non_featured_services_selection`*:: + -- +Non-featured services selection. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings#FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED + + type: keyword -- -*`rsa.network.fhost`*:: +*`gsuite.admin.field`*:: + -- +The name of the field. + type: keyword -- -*`rsa.network.fport`*:: +*`gsuite.admin.resource.id`*:: + -- +The name of the resource identifier. + type: keyword -- -*`rsa.network.laddr`*:: +*`gsuite.admin.user.email`*:: + -- +The user's primary email address. + type: keyword -- -*`rsa.network.linterface`*:: +*`gsuite.admin.user.nickname`*:: + -- +The user's nickname. + type: keyword -- -*`rsa.network.phost`*:: +*`gsuite.admin.user.birthdate`*:: + -- -type: keyword +The user's birth date. + +type: date -- -*`rsa.network.ad_computer_dst`*:: +*`gsuite.admin.gateway.name`*:: + -- -Deprecated, use host.dst +Gateway name. Present on some chat settings. type: keyword -- -*`rsa.network.eth_type`*:: +*`gsuite.admin.chrome_os.session_type`*:: + -- -This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only +Chrome OS session type. -type: long +type: keyword -- -*`rsa.network.ip_proto`*:: +*`gsuite.admin.device.serial_number`*:: + -- -This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI +Device serial number. -type: long +type: keyword -- -*`rsa.network.dns_cname_record`*:: +*`gsuite.admin.device.id`*:: + -- type: keyword -- -*`rsa.network.dns_id`*:: +*`gsuite.admin.device.type`*:: + -- +Device type. + type: keyword -- -*`rsa.network.dns_opcode`*:: +*`gsuite.admin.print_server.name`*:: + -- +The name of the print server. + type: keyword -- -*`rsa.network.dns_resp`*:: +*`gsuite.admin.printer.name`*:: + -- +The name of the printer. + type: keyword -- -*`rsa.network.dns_type`*:: +*`gsuite.admin.device.command_details`*:: + -- +Command details. + type: keyword -- -*`rsa.network.domain1`*:: +*`gsuite.admin.role.id`*:: + -- -type: keyword - --- +Unique identifier for this role privilege. -*`rsa.network.host_type`*:: -+ --- type: keyword -- -*`rsa.network.packet_length`*:: +*`gsuite.admin.role.name`*:: + -- -type: keyword - --- +The role name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings -*`rsa.network.host_orig`*:: -+ --- -This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. type: keyword -- -*`rsa.network.rpayload`*:: +*`gsuite.admin.privilege.name`*:: + -- -This key is used to capture the total number of payload bytes seen in the retransmitted packets. +Privilege name. type: keyword -- -*`rsa.network.vlan_name`*:: +*`gsuite.admin.service.name`*:: + -- -This key should only be used to capture the name of the Virtual LAN +The service name. type: keyword -- - -*`rsa.investigations.ec_activity`*:: +*`gsuite.admin.url.name`*:: + -- -This key captures the particular event activity(Ex:Logoff) +The website name. type: keyword -- -*`rsa.investigations.ec_theme`*:: +*`gsuite.admin.product.name`*:: + -- -This key captures the Theme of a particular Event(Ex:Authentication) +The product name. type: keyword -- -*`rsa.investigations.ec_subject`*:: +*`gsuite.admin.product.sku`*:: + -- -This key captures the Subject of a particular Event(Ex:User) +The product SKU. type: keyword -- -*`rsa.investigations.ec_outcome`*:: +*`gsuite.admin.bulk_upload.failed`*:: + -- -This key captures the outcome of a particular Event(Ex:Success) +Number of failed records in bulk upload operation. -type: keyword +type: long -- -*`rsa.investigations.event_cat`*:: +*`gsuite.admin.bulk_upload.total`*:: + -- -This key captures the Event category number +Number of total records in bulk upload operation. type: long -- -*`rsa.investigations.event_cat_name`*:: +*`gsuite.admin.group.allowed_list`*:: + -- -This key captures the event category name corresponding to the event cat code +Names of allow-listed groups. type: keyword -- -*`rsa.investigations.event_vcat`*:: +*`gsuite.admin.email.quarantine_name`*:: + -- -This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. +The name of the quarantine. type: keyword -- -*`rsa.investigations.analysis_file`*:: +*`gsuite.admin.email.log_search_filter.message_id`*:: + -- -This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file +The log search filter's email message ID. type: keyword -- -*`rsa.investigations.analysis_service`*:: +*`gsuite.admin.email.log_search_filter.start_date`*:: + -- -This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service +The log search filter's start date. -type: keyword +type: date -- -*`rsa.investigations.analysis_session`*:: +*`gsuite.admin.email.log_search_filter.end_date`*:: + -- -This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session +The log search filter's ending date. -type: keyword +type: date -- -*`rsa.investigations.boc`*:: +*`gsuite.admin.email.log_search_filter.recipient.value`*:: + -- -This is used to capture behaviour of compromise +The log search filter's email recipient. type: keyword -- -*`rsa.investigations.eoc`*:: +*`gsuite.admin.email.log_search_filter.sender.value`*:: + -- -This is used to capture Enablers of Compromise +The log search filter's email sender. type: keyword -- -*`rsa.investigations.inv_category`*:: +*`gsuite.admin.email.log_search_filter.recipient.ip`*:: + -- -This used to capture investigation category +The log search filter's email recipient's IP address. -type: keyword +type: ip -- -*`rsa.investigations.inv_context`*:: +*`gsuite.admin.email.log_search_filter.sender.ip`*:: + -- -This used to capture investigation context +The log search filter's email sender's IP address. -type: keyword +type: ip -- -*`rsa.investigations.ioc`*:: +*`gsuite.admin.chrome_licenses.enabled`*:: + -- -This is key capture indicator of compromise +Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings + type: keyword -- - -*`rsa.counters.dclass_c1`*:: +*`gsuite.admin.chrome_licenses.allowed`*:: + -- -This is a generic counter key that should be used with the label dclass.c1.str only +Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings -type: long + +type: keyword -- -*`rsa.counters.dclass_c2`*:: +*`gsuite.admin.oauth2.service.name`*:: + -- -This is a generic counter key that should be used with the label dclass.c2.str only +OAuth2 service name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings -type: long + +type: keyword -- -*`rsa.counters.event_counter`*:: +*`gsuite.admin.oauth2.application.id`*:: + -- -This is used to capture the number of times an event repeated +OAuth2 application ID. -type: long +type: keyword -- -*`rsa.counters.dclass_r1`*:: +*`gsuite.admin.oauth2.application.name`*:: + -- -This is a generic ratio key that should be used with the label dclass.r1.str only +OAuth2 application name. type: keyword -- -*`rsa.counters.dclass_c3`*:: +*`gsuite.admin.oauth2.application.type`*:: + -- -This is a generic counter key that should be used with the label dclass.c3.str only +OAuth2 application type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings -type: long + +type: keyword -- -*`rsa.counters.dclass_c1_str`*:: +*`gsuite.admin.verification_method`*:: + -- -This is a generic counter string key that should be used with the label dclass.c1 only +Related verification method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings and https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings + type: keyword -- -*`rsa.counters.dclass_c2_str`*:: +*`gsuite.admin.alert.name`*:: + -- -This is a generic counter string key that should be used with the label dclass.c2 only +The alert name. type: keyword -- -*`rsa.counters.dclass_r1_str`*:: +*`gsuite.admin.rule.name`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r1 only +The rule name. type: keyword -- -*`rsa.counters.dclass_r2`*:: +*`gsuite.admin.api.client.name`*:: + -- -This is a generic ratio key that should be used with the label dclass.r2.str only +The API client name. type: keyword -- -*`rsa.counters.dclass_c3_str`*:: +*`gsuite.admin.api.scopes`*:: + -- -This is a generic counter string key that should be used with the label dclass.c3 only +The API scopes. type: keyword -- -*`rsa.counters.dclass_r3`*:: +*`gsuite.admin.mdm.token`*:: + -- -This is a generic ratio key that should be used with the label dclass.r3.str only +The MDM vendor enrollment token. type: keyword -- -*`rsa.counters.dclass_r2_str`*:: +*`gsuite.admin.mdm.vendor`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r2 only +The MDM vendor's name. type: keyword -- -*`rsa.counters.dclass_r3_str`*:: +*`gsuite.admin.info_type`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r3 only +This will be used to state what kind of information was changed. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings + type: keyword -- - -*`rsa.identity.auth_method`*:: +*`gsuite.admin.email_monitor.dest_email`*:: + -- -This key is used to capture authentication methods used only +The destination address of the email monitor. type: keyword -- -*`rsa.identity.user_role`*:: +*`gsuite.admin.email_monitor.level.chat`*:: + -- -This key is used to capture the Role of a user only +The chat email monitor level. type: keyword -- -*`rsa.identity.dn`*:: +*`gsuite.admin.email_monitor.level.draft`*:: + -- -X.500 (LDAP) Distinguished Name +The draft email monitor level. type: keyword -- -*`rsa.identity.logon_type`*:: +*`gsuite.admin.email_monitor.level.incoming`*:: + -- -This key is used to capture the type of logon method used. +The incoming email monitor level. type: keyword -- -*`rsa.identity.profile`*:: +*`gsuite.admin.email_monitor.level.outgoing`*:: + -- -This key is used to capture the user profile +The outgoing email monitor level. type: keyword -- -*`rsa.identity.accesses`*:: +*`gsuite.admin.email_dump.include_deleted`*:: + -- -This key is used to capture actual privileges used in accessing an object +Indicates if deleted emails are included in the export. -type: keyword +type: boolean -- -*`rsa.identity.realm`*:: +*`gsuite.admin.email_dump.package_content`*:: + -- -Radius realm or similar grouping of accounts +The contents of the mailbox package. type: keyword -- -*`rsa.identity.user_sid_dst`*:: +*`gsuite.admin.email_dump.query`*:: + -- -This key captures Destination User Session ID +The search query used for the dump. type: keyword -- -*`rsa.identity.dn_src`*:: +*`gsuite.admin.request.id`*:: + -- -An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn +The request ID. type: keyword -- -*`rsa.identity.org`*:: +*`gsuite.admin.mobile.action.id`*:: + -- -This key captures the User organization +The mobile device action's ID. type: keyword -- -*`rsa.identity.dn_dst`*:: +*`gsuite.admin.mobile.action.type`*:: + -- -An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn +The mobile device action's type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings + type: keyword -- -*`rsa.identity.firstname`*:: +*`gsuite.admin.mobile.certificate.name`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +The mobile certificate common name. type: keyword -- -*`rsa.identity.lastname`*:: +*`gsuite.admin.mobile.company_owned_devices`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +The number of devices a company owns. -type: keyword +type: long -- -*`rsa.identity.user_dept`*:: +*`gsuite.admin.distribution.entity.name`*:: + -- -User's Department Names only +The distribution entity value, which can be a group name or an org-unit name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings + type: keyword -- -*`rsa.identity.user_sid_src`*:: +*`gsuite.admin.distribution.entity.type`*:: + -- -This key captures Source User Session ID +The distribution entity type, which can be a group or an org-unit. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings + type: keyword -- -*`rsa.identity.federated_sp`*:: + +*`gsuite.drive.billable`*:: + -- -This key is the Federated Service Provider. This is the application requesting authentication. +Whether this activity is billable. -type: keyword +type: boolean -- -*`rsa.identity.federated_idp`*:: +*`gsuite.drive.source_folder_id`*:: + -- -This key is the federated Identity Provider. This is the server providing the authentication. - type: keyword -- -*`rsa.identity.logon_type_desc`*:: +*`gsuite.drive.source_folder_title`*:: + -- -This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - type: keyword -- -*`rsa.identity.middlename`*:: +*`gsuite.drive.destination_folder_id`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.password`*:: +*`gsuite.drive.destination_folder_title`*:: + -- -This key is for Passwords seen in any session, plain text or encrypted - type: keyword -- -*`rsa.identity.host_role`*:: +*`gsuite.drive.file.id`*:: + -- -This key should only be used to capture the role of a Host Machine - type: keyword -- -*`rsa.identity.ldap`*:: +*`gsuite.drive.file.type`*:: + -- -This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context +Document Drive type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + type: keyword -- -*`rsa.identity.ldap_query`*:: +*`gsuite.drive.originating_app_id`*:: + -- -This key is the Search criteria from an LDAP search +The Google Cloud Project ID of the application that performed the action. + type: keyword -- -*`rsa.identity.ldap_response`*:: +*`gsuite.drive.file.owner.email`*:: + -- -This key is to capture Results from an LDAP search - type: keyword -- -*`rsa.identity.owner`*:: +*`gsuite.drive.file.owner.is_shared_drive`*:: + -- -This is used to capture username the process or service is running as, the author of the task +Boolean flag denoting whether owner is a shared drive. -type: keyword + +type: boolean -- -*`rsa.identity.service_account`*:: +*`gsuite.drive.primary_event`*:: + -- -This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage +Whether this is a primary event. A single user action in Drive may generate several events. -type: keyword --- +type: boolean +-- -*`rsa.email.email_dst`*:: +*`gsuite.drive.shared_drive_id`*:: + -- -This key is used to capture the Destination email address only, when the destination context is not clear use email +The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. + type: keyword -- -*`rsa.email.email_src`*:: +*`gsuite.drive.visibility`*:: + -- -This key is used to capture the source email address only, when the source context is not clear use email +Visibility of target file. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + type: keyword -- -*`rsa.email.subject`*:: +*`gsuite.drive.new_value`*:: + -- -This key is used to capture the subject string from an Email only. +When a setting or property of the file changes, the new value for it will appear here. + type: keyword -- -*`rsa.email.email`*:: +*`gsuite.drive.old_value`*:: + -- -This key is used to capture a generic email address where the source or destination context is not clear +When a setting or property of the file changes, the old value for it will appear here. + type: keyword -- -*`rsa.email.trans_from`*:: +*`gsuite.drive.sheets_import_range_recipient_doc`*:: + -- -Deprecated key defined only in table map. +Doc ID of the recipient of a sheets import range. type: keyword -- -*`rsa.email.trans_to`*:: +*`gsuite.drive.old_visibility`*:: + -- -Deprecated key defined only in table map. +When visibility changes, this holds the old value. + type: keyword -- - -*`rsa.file.privilege`*:: +*`gsuite.drive.visibility_change`*:: + -- -Deprecated, use permissions +When visibility changes, this holds the new overall visibility of the file. + type: keyword -- -*`rsa.file.attachment`*:: +*`gsuite.drive.target_domain`*:: + -- -This key captures the attachment file name +The domain for which the acccess scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. + type: keyword -- -*`rsa.file.filesystem`*:: +*`gsuite.drive.added_role`*:: + -- +Added membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + + type: keyword -- -*`rsa.file.binary`*:: +*`gsuite.drive.membership_change_type`*:: + -- -Deprecated key defined only in table map. +Type of change in Team Drive membership of a user/group. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + type: keyword -- -*`rsa.file.filename_dst`*:: +*`gsuite.drive.shared_drive_settings_change_type`*:: + -- -This is used to capture name of the file targeted by the action +Type of change in Team Drive settings. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + type: keyword -- -*`rsa.file.filename_src`*:: +*`gsuite.drive.removed_role`*:: + -- -This is used to capture name of the parent filename, the file which performed the action +Removed membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive + type: keyword -- -*`rsa.file.filename_tmp`*:: +*`gsuite.drive.target`*:: + -- +Target user or group. + type: keyword -- -*`rsa.file.directory_dst`*:: + +*`gsuite.groups.acl_permission`*:: + -- -This key is used to capture the directory of the target process or file +Group permission setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups + type: keyword -- -*`rsa.file.directory_src`*:: +*`gsuite.groups.email`*:: + -- -This key is used to capture the directory of the source process or file +Group email. + type: keyword -- -*`rsa.file.file_entropy`*:: +*`gsuite.groups.member.email`*:: + -- -This is used to capture entropy vale of a file +Member email. -type: double + +type: keyword -- -*`rsa.file.file_vendor`*:: +*`gsuite.groups.member.role`*:: + -- -This is used to capture Company name of file located in version_info +Member role. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups + type: keyword -- -*`rsa.file.task_name`*:: +*`gsuite.groups.setting`*:: + -- -This is used to capture name of the task +Group setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups + type: keyword -- - -*`rsa.web.fqdn`*:: +*`gsuite.groups.new_value`*:: + -- -Fully Qualified Domain Names +New value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups + type: keyword -- -*`rsa.web.web_cookie`*:: +*`gsuite.groups.old_value`*:: + -- -This key is used to capture the Web cookies specifically. +Old value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups type: keyword -- -*`rsa.web.alias_host`*:: +*`gsuite.groups.value`*:: + -- +Value of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups + + type: keyword -- -*`rsa.web.reputation_num`*:: +*`gsuite.groups.message.id`*:: + -- -Reputation Number of an entity. Typically used for Web Domains +SMTP message Id of an email message. Present for moderation events. -type: double + +type: keyword -- -*`rsa.web.web_ref_domain`*:: +*`gsuite.groups.message.moderation_action`*:: + -- -Web referer's domain +Message moderation action. Possible values are `approved` and `rejected`. + type: keyword -- -*`rsa.web.web_ref_query`*:: +*`gsuite.groups.status`*:: + -- -This key captures Web referer's query portion of the URL +A status describing the output of an operation. Possible values are `failed` and `succeeded`. + type: keyword -- -*`rsa.web.remote_domain`*:: + +*`gsuite.login.affected_email_address`*:: + -- type: keyword -- -*`rsa.web.web_ref_page`*:: +*`gsuite.login.challenge_method`*:: + -- -This key captures Web referer's page information +Login challenge method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. + type: keyword -- -*`rsa.web.web_ref_root`*:: +*`gsuite.login.failure_type`*:: + -- -Web referer's root URL path +Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. + type: keyword -- -*`rsa.web.cn_asn_dst`*:: +*`gsuite.login.type`*:: + -- +Login credentials type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. + + type: keyword -- -*`rsa.web.cn_rpackets`*:: +*`gsuite.login.is_second_factor`*:: + -- -type: keyword +type: boolean -- -*`rsa.web.urlpage`*:: +*`gsuite.login.is_suspicious`*:: + -- -type: keyword +type: boolean -- -*`rsa.web.urlroot`*:: + +*`gsuite.saml.application_name`*:: + -- +Saml SP application name. + + type: keyword -- -*`rsa.web.p_url`*:: +*`gsuite.saml.failure_type`*:: + -- +Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/saml. + + type: keyword -- -*`rsa.web.p_user_agent`*:: +*`gsuite.saml.initiated_by`*:: + -- +Requester of SAML authentication. + + type: keyword -- -*`rsa.web.p_web_cookie`*:: +*`gsuite.saml.orgunit_path`*:: + -- +User orgunit. + + type: keyword -- -*`rsa.web.p_web_method`*:: +*`gsuite.saml.status_code`*:: + -- -type: keyword +SAML status code. + + +type: long -- -*`rsa.web.p_web_referer`*:: +*`gsuite.saml.second_level_status_code`*:: + -- -type: keyword +SAML second level status code. + + +type: long -- -*`rsa.web.web_extension_tmp`*:: +[[exported-fields-haproxy]] +== HAProxy fields + +haproxy Module + + + +[float] +=== haproxy + + + + +*`haproxy.frontend_name`*:: + -- -type: keyword +Name of the frontend (or listener) which received and processed the connection. -- -*`rsa.web.web_page`*:: +*`haproxy.backend_name`*:: + -- -type: keyword +Name of the backend (or listener) which was selected to manage the connection to the server. -- - -*`rsa.threat.threat_category`*:: +*`haproxy.server_name`*:: + -- -This key captures Threat Name/Threat Category/Categorization of alert - -type: keyword +Name of the last server to which the connection was sent. -- -*`rsa.threat.threat_desc`*:: +*`haproxy.total_waiting_time_ms`*:: + -- -This key is used to capture the threat description from the session directly or inferred +Total time in milliseconds spent waiting in the various queues -type: keyword +type: long -- -*`rsa.threat.alert`*:: +*`haproxy.connection_wait_time_ms`*:: + -- -This key is used to capture name of the alert +Total time in milliseconds spent waiting for the connection to establish to the final server -type: keyword +type: long -- -*`rsa.threat.threat_source`*:: +*`haproxy.bytes_read`*:: + -- -This key is used to capture source of the threat +Total number of bytes transmitted to the client when the log is emitted. -type: keyword +type: long -- - -*`rsa.crypto.crypto`*:: +*`haproxy.time_queue`*:: + -- -This key is used to capture the Encryption Type or Encryption Key only +Total time in milliseconds spent waiting in the various queues. -type: keyword +type: long -- -*`rsa.crypto.cipher_src`*:: +*`haproxy.time_backend_connect`*:: + -- -This key is for Source (Client) Cipher +Total time in milliseconds spent waiting for the connection to establish to the final server, including retries. -type: keyword +type: long -- -*`rsa.crypto.cert_subject`*:: +*`haproxy.server_queue`*:: + -- -This key is used to capture the Certificate organization only +Total number of requests which were processed before this one in the server queue. -type: keyword +type: long -- -*`rsa.crypto.peer`*:: +*`haproxy.backend_queue`*:: + -- -This key is for Encryption peer's IP Address +Total number of requests which were processed before this one in the backend's global queue. -type: keyword +type: long -- -*`rsa.crypto.cipher_size_src`*:: +*`haproxy.bind_name`*:: + -- -This key captures Source (Client) Cipher Size - -type: long +Name of the listening address which received the connection. -- -*`rsa.crypto.ike`*:: +*`haproxy.error_message`*:: + -- -IKE negotiation phase. +Error message logged by HAProxy in case of error. -type: keyword +type: text -- -*`rsa.crypto.scheme`*:: +*`haproxy.source`*:: + -- -This key captures the Encryption scheme used +The HAProxy source of the log type: keyword -- -*`rsa.crypto.peer_id`*:: +*`haproxy.termination_state`*:: + -- -This key is for Encryption peer’s identity - -type: keyword +Condition the session was in when the session ended. -- -*`rsa.crypto.sig_type`*:: +*`haproxy.mode`*:: + -- -This key captures the Signature Type +mode that the frontend is operating (TCP or HTTP) type: keyword -- -*`rsa.crypto.cert_issuer`*:: +[float] +=== connections + +Contains various counts of connections active in the process. + + +*`haproxy.connections.active`*:: + -- -type: keyword +Total number of concurrent connections on the process when the session was logged. + +type: long -- -*`rsa.crypto.cert_host_name`*:: +*`haproxy.connections.frontend`*:: + -- -Deprecated key defined only in table map. +Total number of concurrent connections on the frontend when the session was logged. -type: keyword +type: long -- -*`rsa.crypto.cert_error`*:: +*`haproxy.connections.backend`*:: + -- -This key captures the Certificate Error String +Total number of concurrent connections handled by the backend when the session was logged. -type: keyword +type: long -- -*`rsa.crypto.cipher_dst`*:: +*`haproxy.connections.server`*:: + -- -This key is for Destination (Server) Cipher +Total number of concurrent connections still active on the server when the session was logged. -type: keyword +type: long -- -*`rsa.crypto.cipher_size_dst`*:: +*`haproxy.connections.retries`*:: + -- -This key captures Destination (Server) Cipher Size +Number of connection retries experienced by this session when trying to connect to the server. type: long -- -*`rsa.crypto.ssl_ver_src`*:: +[float] +=== client + +Information about the client doing the request + + +*`haproxy.client.ip`*:: + -- -Deprecated, use version +type: alias -type: keyword +alias to: source.address -- -*`rsa.crypto.d_certauth`*:: +*`haproxy.client.port`*:: + -- -type: keyword +type: alias + +alias to: source.port -- -*`rsa.crypto.s_certauth`*:: +*`haproxy.process_name`*:: + -- -type: keyword +type: alias + +alias to: process.name -- -*`rsa.crypto.ike_cookie1`*:: +*`haproxy.pid`*:: + -- -ID of the negotiation — sent for ISAKMP Phase One +type: alias -type: keyword +alias to: process.pid -- -*`rsa.crypto.ike_cookie2`*:: +[float] +=== destination + +Destination information + + +*`haproxy.destination.port`*:: + -- -ID of the negotiation — sent for ISAKMP Phase Two +type: alias -type: keyword +alias to: destination.port -- -*`rsa.crypto.cert_checksum`*:: +*`haproxy.destination.ip`*:: + -- -type: keyword +type: alias + +alias to: destination.ip -- -*`rsa.crypto.cert_host_cat`*:: +[float] +=== geoip + +Contains GeoIP information gathered based on the client.ip field. Only present if the GeoIP Elasticsearch plugin is available and used. + + + +*`haproxy.geoip.continent_name`*:: + -- -This key is used for the hostname category value of a certificate +type: alias -type: keyword +alias to: source.geo.continent_name -- -*`rsa.crypto.cert_serial`*:: +*`haproxy.geoip.country_iso_code`*:: + -- -This key is used to capture the Certificate serial number only +type: alias -type: keyword +alias to: source.geo.country_iso_code -- -*`rsa.crypto.cert_status`*:: +*`haproxy.geoip.location`*:: + -- -This key captures Certificate validation status +type: alias -type: keyword +alias to: source.geo.location -- -*`rsa.crypto.ssl_ver_dst`*:: +*`haproxy.geoip.region_name`*:: + -- -Deprecated, use version +type: alias -type: keyword +alias to: source.geo.region_name -- -*`rsa.crypto.cert_keysize`*:: +*`haproxy.geoip.city_name`*:: + -- -type: keyword +type: alias + +alias to: source.geo.city_name -- -*`rsa.crypto.cert_username`*:: +*`haproxy.geoip.region_iso_code`*:: + -- -type: keyword +type: alias + +alias to: source.geo.region_iso_code -- -*`rsa.crypto.https_insact`*:: +[float] +=== http + +Please add description + + +[float] +=== response + +Fields related to the HTTP response + + +*`haproxy.http.response.captured_cookie`*:: + -- -type: keyword +Optional "name=value" entry indicating that the client had this cookie in the response. + -- -*`rsa.crypto.https_valid`*:: +*`haproxy.http.response.captured_headers`*:: + -- +List of headers captured in the response due to the presence of the "capture response header" statement in the frontend. + + type: keyword -- -*`rsa.crypto.cert_ca`*:: +*`haproxy.http.response.status_code`*:: + -- -This key is used to capture the Certificate signing authority only +type: alias -type: keyword +alias to: http.response.status_code -- -*`rsa.crypto.cert_common`*:: +[float] +=== request + +Fields related to the HTTP request + + +*`haproxy.http.request.captured_cookie`*:: + -- -This key is used to capture the Certificate common name only +Optional "name=value" entry indicating that the server has returned a cookie with its request. -type: keyword -- - -*`rsa.wireless.wlan_ssid`*:: +*`haproxy.http.request.captured_headers`*:: + -- -This key is used to capture the ssid of a Wireless Session +List of headers captured in the request due to the presence of the "capture request header" statement in the frontend. + type: keyword -- -*`rsa.wireless.access_point`*:: +*`haproxy.http.request.raw_request_line`*:: + -- -This key is used to capture the access point name. +Complete HTTP request line, including the method, request and HTTP version string. type: keyword -- -*`rsa.wireless.wlan_channel`*:: +*`haproxy.http.request.time_wait_without_data_ms`*:: + -- -This is used to capture the channel names +Total time in milliseconds spent waiting for the server to send a full HTTP response, not counting data. type: long -- -*`rsa.wireless.wlan_name`*:: +*`haproxy.http.request.time_wait_ms`*:: + -- -This key captures either WLAN number/name +Total time in milliseconds spent waiting for a full HTTP request from the client (not counting body) after the first byte was received. -type: keyword +type: long -- +[float] +=== tcp + +TCP log format -*`rsa.storage.disk_volume`*:: + +*`haproxy.tcp.connection_waiting_time_ms`*:: + -- -A unique name assigned to logical units (volumes) within a physical disk +Total time in milliseconds elapsed between the accept and the last close -type: keyword +type: long -- -*`rsa.storage.lun`*:: +[[exported-fields-host-processor]] +== Host fields + +Info collected for the host machine. + + + + +*`host.containerized`*:: + -- -Logical Unit Number.This key is a very useful concept in Storage. +If the host is a container. -type: keyword + +type: boolean -- -*`rsa.storage.pwwn`*:: +*`host.os.build`*:: + -- -This uniquely identifies a port on a HBA. +OS build information. + type: keyword --- +example: 18D109 +-- -*`rsa.physical.org_dst`*:: +*`host.os.codename`*:: + -- -This is used to capture the destination organization based on the GEOPIP Maxmind database. +OS codename, if any. + type: keyword +example: stretch + -- -*`rsa.physical.org_src`*:: +[[exported-fields-ibmmq]] +== ibmmq fields + +ibmmq Module + + + +[float] +=== ibmmq + + + + +[float] +=== errorlog + +IBM MQ error logs + + +*`ibmmq.errorlog.installation`*:: + -- -This is used to capture the source organization based on the GEOPIP Maxmind database. +This is the installation name which can be given at installation time. +Each installation of IBM MQ on UNIX, Linux, and Windows, has a unique identifier known as an installation name. The installation name is used to associate things such as queue managers and configuration files with an installation. + type: keyword -- - -*`rsa.healthcare.patient_fname`*:: +*`ibmmq.errorlog.qmgr`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +Name of the queue manager. Queue managers provide queuing services to applications, and manages the queues that belong to them. + type: keyword -- -*`rsa.healthcare.patient_id`*:: +*`ibmmq.errorlog.arithinsert`*:: + -- -This key captures the unique ID for a patient +Changing content based on error.id type: keyword -- -*`rsa.healthcare.patient_lname`*:: +*`ibmmq.errorlog.commentinsert`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +Changing content based on error.id type: keyword -- -*`rsa.healthcare.patient_mname`*:: +*`ibmmq.errorlog.errordescription`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +Please add description -type: keyword +type: text --- +example: Please add example +-- -*`rsa.endpoint.host_state`*:: +*`ibmmq.errorlog.explanation`*:: + -- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on +Explaines the error in more detail type: keyword -- -*`rsa.endpoint.registry_key`*:: +*`ibmmq.errorlog.action`*:: + -- -This key captures the path to the registry key +Defines what to do when the error occurs type: keyword -- -*`rsa.endpoint.registry_value`*:: +*`ibmmq.errorlog.code`*:: + -- -This key captures values or decorators used within a registry entry +Error code. type: keyword -- -[[exported-fields-iptables]] -== iptables fields +[[exported-fields-icinga]] +== Icinga fields -Module for handling the iptables logs. +Icinga Module [float] -=== iptables +=== icinga -Fields from the iptables logs. -*`iptables.ether_type`*:: -+ --- -Value of the ethernet type field identifying the network layer protocol. +[float] +=== debug +Contains fields for the Icinga debug logs. -type: long --- -*`iptables.flow_label`*:: +*`icinga.debug.facility`*:: + -- -IPv6 flow label. +Specifies what component of Icinga logged the message. -type: integer +type: keyword -- -*`iptables.fragment_flags`*:: +*`icinga.debug.severity`*:: + -- -IP fragment flags. A combination of CE, DF and MF. - +type: alias -type: keyword +alias to: log.level -- -*`iptables.fragment_offset`*:: +*`icinga.debug.message`*:: + -- -Offset of the current IP fragment. - +type: alias -type: long +alias to: message -- [float] -=== icmp +=== main -ICMP fields. +Contains fields for the Icinga main logs. -*`iptables.icmp.code`*:: +*`icinga.main.facility`*:: + -- -ICMP code. +Specifies what component of Icinga logged the message. -type: long +type: keyword -- -*`iptables.icmp.id`*:: +*`icinga.main.severity`*:: + -- -ICMP ID. - +type: alias -type: long +alias to: log.level -- -*`iptables.icmp.parameter`*:: +*`icinga.main.message`*:: + -- -ICMP parameter. - +type: alias -type: long +alias to: message -- -*`iptables.icmp.redirect`*:: -+ --- -ICMP redirect address. +[float] +=== startup +Contains fields for the Icinga startup logs. -type: ip --- -*`iptables.icmp.seq`*:: +*`icinga.startup.facility`*:: + -- -ICMP sequence number. +Specifies what component of Icinga logged the message. -type: long +type: keyword -- -*`iptables.icmp.type`*:: +*`icinga.startup.severity`*:: + -- -ICMP type. - +type: alias -type: long +alias to: log.level -- -*`iptables.id`*:: +*`icinga.startup.message`*:: + -- -Packet identifier. - +type: alias -type: long +alias to: message -- -*`iptables.incomplete_bytes`*:: -+ --- -Number of incomplete bytes. +[[exported-fields-iis]] +== IIS fields +Module for parsing IIS log files. -type: long --- -*`iptables.input_device`*:: -+ --- -Device that received the packet. +[float] +=== iis +Fields from IIS log files. -type: keyword --- -*`iptables.precedence_bits`*:: -+ --- -IP precedence bits. +[float] +=== access +Contains fields for IIS access logs. -type: short --- -*`iptables.tos`*:: +*`iis.access.sub_status`*:: + -- -IP Type of Service field. +The HTTP substatus code. type: long -- -*`iptables.length`*:: +*`iis.access.win32_status`*:: + -- -Packet length. +The Windows status code. type: long -- -*`iptables.output_device`*:: +*`iis.access.site_name`*:: + -- -Device that output the packet. +The site name and instance number. type: keyword -- -[float] -=== tcp - -TCP fields. - - - -*`iptables.tcp.flags`*:: +*`iis.access.server_name`*:: + -- -TCP flags. +The name of the server on which the log file entry was generated. type: keyword -- -*`iptables.tcp.reserved_bits`*:: +*`iis.access.cookie`*:: + -- -TCP reserved bits. +The content of the cookie sent or received, if any. -type: short +type: keyword -- -*`iptables.tcp.seq`*:: +*`iis.access.body_received.bytes`*:: + -- -TCP sequence number. - +type: alias -type: long +alias to: http.request.body.bytes -- -*`iptables.tcp.ack`*:: +*`iis.access.body_sent.bytes`*:: + -- -TCP Acknowledgment number. - +type: alias -type: long +alias to: http.response.body.bytes -- -*`iptables.tcp.window`*:: +*`iis.access.server_ip`*:: + -- -Advertised TCP window size. - +type: alias -type: long +alias to: destination.address -- -*`iptables.ttl`*:: +*`iis.access.method`*:: + -- -Time To Live field. +type: alias +alias to: http.request.method -type: integer +-- +*`iis.access.url`*:: ++ -- +type: alias -[float] -=== udp +alias to: url.path -UDP fields. +-- +*`iis.access.query_string`*:: ++ +-- +type: alias +alias to: url.query -*`iptables.udp.length`*:: +-- + +*`iis.access.port`*:: + -- -Length of the UDP header and payload. +type: alias +alias to: destination.port -type: long +-- +*`iis.access.user_name`*:: ++ -- +type: alias -[float] -=== ubiquiti +alias to: user.name -Fields for Ubiquiti network devices. +-- +*`iis.access.remote_ip`*:: ++ +-- +type: alias + +alias to: source.address +-- -*`iptables.ubiquiti.input_zone`*:: +*`iis.access.referrer`*:: + -- -Input zone. +type: alias +alias to: http.request.referrer -type: keyword +-- +*`iis.access.response_code`*:: ++ -- +type: alias -*`iptables.ubiquiti.output_zone`*:: +alias to: http.response.status_code + +-- + +*`iis.access.http_version`*:: + -- -Output zone. +type: alias +alias to: http.version -type: keyword +-- +*`iis.access.hostname`*:: ++ -- +type: alias -*`iptables.ubiquiti.rule_number`*:: +alias to: host.hostname + +-- + + +*`iis.access.user_agent.device`*:: + -- -The rule number within the rule set. +type: alias -type: keyword +alias to: user_agent.device.name -- -*`iptables.ubiquiti.rule_set`*:: +*`iis.access.user_agent.name`*:: + -- -The rule set name. +type: alias -type: keyword +alias to: user_agent.name -- -[[exported-fields-jolokia-autodiscover]] -== Jolokia Discovery autodiscover provider fields +*`iis.access.user_agent.os`*:: ++ +-- +type: alias -Metadata from Jolokia Discovery added by the jolokia provider. +alias to: user_agent.os.full_name +-- +*`iis.access.user_agent.os_name`*:: ++ +-- +type: alias -*`jolokia.agent.version`*:: +alias to: user_agent.os.name + +-- + +*`iis.access.user_agent.original`*:: + -- -Version number of jolokia agent. +type: alias +alias to: user_agent.original -type: keyword +-- + +*`iis.access.geoip.continent_name`*:: ++ -- +type: alias -*`jolokia.agent.id`*:: +alias to: source.geo.continent_name + +-- + +*`iis.access.geoip.country_iso_code`*:: + -- -Each agent has a unique id which can be either provided during startup of the agent in form of a configuration parameter or being autodetected. If autodected, the id has several parts: The IP, the process id, hashcode of the agent and its type. +type: alias +alias to: source.geo.country_iso_code -type: keyword +-- +*`iis.access.geoip.location`*:: ++ -- +type: alias -*`jolokia.server.product`*:: +alias to: source.geo.location + +-- + +*`iis.access.geoip.region_name`*:: + -- -The container product if detected. +type: alias +alias to: source.geo.region_name -type: keyword +-- +*`iis.access.geoip.city_name`*:: ++ -- +type: alias -*`jolokia.server.version`*:: +alias to: source.geo.city_name + +-- + +*`iis.access.geoip.region_iso_code`*:: + -- -The container's version (if detected). +type: alias + +alias to: source.geo.region_iso_code + +-- + +[float] +=== error + +Contains fields for IIS error logs. + + + +*`iis.error.reason_phrase`*:: ++ +-- +The HTTP reason phrase. type: keyword -- -*`jolokia.server.vendor`*:: +*`iis.error.queue_name`*:: + -- -The vendor of the container the agent is running in. +The IIS application pool name. type: keyword -- -*`jolokia.url`*:: +*`iis.error.remote_ip`*:: + -- -The URL how this agent can be contacted. +type: alias +alias to: source.address -type: keyword +-- +*`iis.error.remote_port`*:: ++ -- +type: alias -*`jolokia.secured`*:: +alias to: source.port + +-- + +*`iis.error.server_ip`*:: + -- -Whether the agent was configured for authentication or not. +type: alias +alias to: destination.address -type: boolean +-- +*`iis.error.server_port`*:: ++ -- +type: alias -[[exported-fields-juniper]] -== Juniper JUNOS fields +alias to: destination.port -juniper fields. +-- + +*`iis.error.http_version`*:: ++ +-- +type: alias + +alias to: http.version + +-- + +*`iis.error.method`*:: ++ +-- +type: alias + +alias to: http.request.method + +-- + +*`iis.error.url`*:: ++ +-- +type: alias + +alias to: url.original + +-- + +*`iis.error.response_code`*:: ++ +-- +type: alias + +alias to: http.response.status_code + +-- + + +*`iis.error.geoip.continent_name`*:: ++ +-- +type: alias + +alias to: source.geo.continent_name + +-- + +*`iis.error.geoip.country_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.country_iso_code + +-- + +*`iis.error.geoip.location`*:: ++ +-- +type: alias + +alias to: source.geo.location + +-- + +*`iis.error.geoip.region_name`*:: ++ +-- +type: alias + +alias to: source.geo.region_name + +-- + +*`iis.error.geoip.city_name`*:: ++ +-- +type: alias + +alias to: source.geo.city_name + +-- + +*`iis.error.geoip.region_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.region_iso_code + +-- + +[[exported-fields-imperva]] +== Imperva SecureSphere fields + +imperva fields. @@ -77060,2551 +76668,1509 @@ type: keyword -- -[[exported-fields-kafka]] -== Kafka fields - -Kafka module - +[[exported-fields-infoblox]] +== Infoblox NIOS fields +infoblox fields. -[float] -=== kafka +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. -[float] -=== log +type: keyword -Kafka log lines. +-- -*`kafka.log.level`*:: +*`rsa.internal.msg`*:: + -- -type: alias +This key is used to capture the raw message that comes into the Log Decoder -alias to: log.level +type: keyword -- -*`kafka.log.message`*:: +*`rsa.internal.messageid`*:: + -- -type: alias - -alias to: message +type: keyword -- -*`kafka.log.component`*:: +*`rsa.internal.event_desc`*:: + -- -Component the log is coming from. - - type: keyword -- -*`kafka.log.class`*:: +*`rsa.internal.message`*:: + -- -Java class the log is coming from. - +This key captures the contents of instant messages type: keyword -- -*`kafka.log.thread`*:: +*`rsa.internal.time`*:: + -- -Thread name the log is coming from. - +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -type: keyword +type: date -- -[float] -=== trace - -Trace in the log line. +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. +type: long +-- -*`kafka.log.trace.class`*:: +*`rsa.internal.msg_id`*:: + -- -Java class the trace is coming from. - +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kafka.log.trace.message`*:: +*`rsa.internal.msg_vid`*:: + -- -Message part of the trace. - +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: keyword -- -[[exported-fields-kibana]] -== kibana fields - -kibana Module - - - -[float] -=== kibana - - - - -[float] -=== log - -Kafka log lines. - - - -*`kibana.log.tags`*:: +*`rsa.internal.data`*:: + -- -Kibana logging tags. - +Deprecated key defined only in table map. type: keyword -- -*`kibana.log.state`*:: +*`rsa.internal.obj_server`*:: + -- -Current state of Kibana. - +Deprecated key defined only in table map. type: keyword -- -*`kibana.log.meta`*:: +*`rsa.internal.obj_val`*:: + -- -type: object +Deprecated key defined only in table map. + +type: keyword -- -*`kibana.log.kibana.log.meta.req.headers.referer`*:: +*`rsa.internal.resource`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: http.request.referrer +type: keyword -- -*`kibana.log.kibana.log.meta.req.referer`*:: +*`rsa.internal.obj_id`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: http.request.referrer +type: keyword -- -*`kibana.log.kibana.log.meta.req.headers.user-agent`*:: +*`rsa.internal.statement`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: user_agent.original +type: keyword -- -*`kibana.log.kibana.log.meta.req.remoteAddress`*:: +*`rsa.internal.audit_class`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: source.address +type: keyword -- -*`kibana.log.kibana.log.meta.req.url`*:: +*`rsa.internal.entry`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: url.original +type: keyword -- -*`kibana.log.kibana.log.meta.statusCode`*:: +*`rsa.internal.hcode`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: http.response.status_code +type: keyword -- -*`kibana.log.kibana.log.meta.method`*:: +*`rsa.internal.inode`*:: + -- -type: alias +Deprecated key defined only in table map. -alias to: http.request.method +type: long -- -[[exported-fields-kubernetes-processor]] -== Kubernetes fields - -Kubernetes metadata added by the kubernetes processor - - - - -*`kubernetes.pod.name`*:: +*`rsa.internal.resource_class`*:: + -- -Kubernetes pod name - +Deprecated key defined only in table map. type: keyword -- -*`kubernetes.pod.uid`*:: +*`rsa.internal.dead`*:: + -- -Kubernetes Pod UID - +Deprecated key defined only in table map. -type: keyword +type: long -- -*`kubernetes.namespace`*:: +*`rsa.internal.feed_desc`*:: + -- -Kubernetes namespace - +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kubernetes.node.name`*:: +*`rsa.internal.feed_name`*:: + -- -Kubernetes node name - +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kubernetes.labels.*`*:: +*`rsa.internal.cid`*:: + -- -Kubernetes labels map - +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: object +type: keyword -- -*`kubernetes.annotations.*`*:: +*`rsa.internal.device_class`*:: + -- -Kubernetes annotations map - +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: object +type: keyword -- -*`kubernetes.replicaset.name`*:: +*`rsa.internal.device_group`*:: + -- -Kubernetes replicaset name - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kubernetes.deployment.name`*:: +*`rsa.internal.device_host`*:: + -- -Kubernetes deployment name - +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kubernetes.statefulset.name`*:: +*`rsa.internal.device_ip`*:: + -- -Kubernetes statefulset name - +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -*`kubernetes.container.name`*:: +*`rsa.internal.device_ipv6`*:: + -- -Kubernetes container name - +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -*`kubernetes.container.image`*:: +*`rsa.internal.device_type`*:: + -- -Kubernetes container image - +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -[[exported-fields-log]] -== Log file content fields - -Contains log file lines. +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. +type: long +-- -*`log.source.address`*:: +*`rsa.internal.did`*:: + -- -Source address from which the log event was read / sent from. - +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -required: False - -- -*`log.offset`*:: +*`rsa.internal.entropy_req`*:: + -- -The file offset the reported line starts at. - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration type: long -required: False - -- -*`stream`*:: +*`rsa.internal.entropy_res`*:: + -- -Log stream when reading container logs, can be 'stdout' or 'stderr' - - -type: keyword +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -required: False +type: long -- -*`input.type`*:: +*`rsa.internal.event_name`*:: + -- -The input type from which the event was generated. This field is set to the value specified for the `type` option in the input section of the Filebeat config file. - +Deprecated key defined only in table map. -required: True +type: keyword -- -*`syslog.facility`*:: +*`rsa.internal.feed_category`*:: + -- -The facility extracted from the priority. - - -type: long +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -required: False +type: keyword -- -*`syslog.priority`*:: +*`rsa.internal.forward_ip`*:: + -- -The priority of the syslog event. - - -type: long +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -required: False +type: ip -- -*`syslog.severity_label`*:: +*`rsa.internal.forward_ipv6`*:: + -- -The human readable severity. - - -type: keyword +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -required: False +type: ip -- -*`syslog.facility_label`*:: +*`rsa.internal.header_id`*:: + -- -The human readable facility. - +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -required: False - -- -*`process.program`*:: +*`rsa.internal.lc_cid`*:: + -- -The name of the program. - +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -required: False - -- -*`log.flags`*:: +*`rsa.internal.lc_ctime`*:: + -- -This field contains the flags of the event. +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: date -- -*`http.response.content_length`*:: +*`rsa.internal.mcb_req`*:: + -- -type: alias +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most -alias to: http.response.body.bytes +type: long -- - - -*`user_agent.os.full_name`*:: +*`rsa.internal.mcb_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`fileset.name`*:: +*`rsa.internal.mcbc_req`*:: + -- -The Filebeat fileset that generated this event. - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: keyword +type: long -- -*`fileset.module`*:: +*`rsa.internal.mcbc_res`*:: + -- -type: alias +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -alias to: event.module +type: long -- -*`read_timestamp`*:: +*`rsa.internal.medium`*:: + -- -type: alias +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session -alias to: event.created +type: long -- -*`docker.attrs`*:: +*`rsa.internal.node_name`*:: + -- -docker.attrs contains labels and environment variables written by docker's JSON File logging driver. These fields are only available when they are configured in the logging driver options. - +Deprecated key defined only in table map. -type: object +type: keyword -- -*`icmp.code`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -ICMP code. - +This key denotes that event is endpoint related type: keyword -- -*`icmp.type`*:: +*`rsa.internal.parse_error`*:: + -- -ICMP type. - +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`igmp.type`*:: +*`rsa.internal.payload_req`*:: + -- -IGMP type. +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +type: long -type: keyword +-- +*`rsa.internal.payload_res`*:: ++ -- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long +-- -*`azure.eventhub`*:: +*`rsa.internal.process_vid_dst`*:: + -- -Name of the eventhub. - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. type: keyword -- -*`azure.offset`*:: +*`rsa.internal.process_vid_src`*:: + -- -The offset. - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. -type: long +type: keyword -- -*`azure.enqueued_time`*:: +*`rsa.internal.rid`*:: + -- -The enqueued time. - +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: date +type: long -- -*`azure.partition_id`*:: +*`rsa.internal.session_split`*:: + -- -The partition id. - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: long +type: keyword -- -*`azure.consumer_group`*:: +*`rsa.internal.site`*:: + -- -The consumer group. - +Deprecated key defined only in table map. type: keyword -- -*`azure.sequence_number`*:: +*`rsa.internal.size`*:: + -- -The sequence number. - +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: long -- - -*`kafka.topic`*:: +*`rsa.internal.sourcefile`*:: + -- -Kafka topic - +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`kafka.partition`*:: +*`rsa.internal.ubc_req`*:: + -- -Kafka partition number - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once type: long -- -*`kafka.offset`*:: +*`rsa.internal.ubc_res`*:: + -- -Kafka offset of this message - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once type: long -- -*`kafka.key`*:: +*`rsa.internal.word`*:: + -- -Kafka key, corresponding to the Kafka value stored in the message - +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log type: keyword -- -*`kafka.block_timestamp`*:: + +*`rsa.time.event_time`*:: + -- -Kafka outer (compressed) block timestamp - +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form type: date -- -*`kafka.headers`*:: +*`rsa.time.duration_time`*:: + -- -An array of Kafka header strings for this message, in the form ": ". +This key is used to capture the normalized duration/lifetime in seconds. +type: double -type: array +-- +*`rsa.time.event_time_str`*:: ++ -- +This key is used to capture the incomplete time mentioned in a session as a string -[[exported-fields-logstash]] -== logstash fields +type: keyword -logstash Module +-- +*`rsa.time.starttime`*:: ++ +-- +This key is used to capture the Start time mentioned in a session in a standard form +type: date -[float] -=== logstash +-- +*`rsa.time.month`*:: ++ +-- +type: keyword +-- +*`rsa.time.day`*:: ++ +-- +type: keyword -[float] -=== log +-- -Fields from the Logstash logs. +*`rsa.time.endtime`*:: ++ +-- +This key is used to capture the End time mentioned in a session in a standard form +type: date +-- -*`logstash.log.module`*:: +*`rsa.time.timezone`*:: + -- -The module or class where the event originate. - +This key is used to capture the timezone of the Event Time type: keyword -- -*`logstash.log.thread`*:: +*`rsa.time.duration_str`*:: + -- -Information about the running thread where the log originate. - +A text string version of the duration type: keyword -- -*`logstash.log.thread.text`*:: +*`rsa.time.date`*:: + -- -type: text +type: keyword -- -*`logstash.log.log_event`*:: +*`rsa.time.year`*:: + -- -key and value debugging information. - - -type: object +type: keyword -- -*`logstash.log.pipeline_id`*:: +*`rsa.time.recorded_time`*:: + -- -The ID of the pipeline. - - -type: keyword +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. -example: main +type: date -- -*`logstash.log.message`*:: +*`rsa.time.datetime`*:: + -- -type: alias - -alias to: message +type: keyword -- -*`logstash.log.level`*:: +*`rsa.time.effective_time`*:: + -- -type: alias +This key is the effective time referenced by an individual event in a Standard Timestamp format -alias to: log.level +type: date -- -[float] -=== slowlog - -slowlog +*`rsa.time.expire_time`*:: ++ +-- +This key is the timestamp that explicitly refers to an expiration. +type: date +-- -*`logstash.slowlog.module`*:: +*`rsa.time.process_time`*:: + -- -The module or class where the event originate. - +Deprecated, use duration.time type: keyword -- -*`logstash.slowlog.thread`*:: +*`rsa.time.hour`*:: + -- -Information about the running thread where the log originate. - - type: keyword -- -*`logstash.slowlog.thread.text`*:: +*`rsa.time.min`*:: + -- -type: text +type: keyword -- -*`logstash.slowlog.event`*:: +*`rsa.time.timestamp`*:: + -- -Raw dump of the original event - - type: keyword -- -*`logstash.slowlog.event.text`*:: +*`rsa.time.event_queue_time`*:: + -- -type: text +This key is the Time that the event was queued. + +type: date -- -*`logstash.slowlog.plugin_name`*:: +*`rsa.time.p_time1`*:: + -- -Name of the plugin - - type: keyword -- -*`logstash.slowlog.plugin_type`*:: +*`rsa.time.tzone`*:: + -- -Type of the plugin: Inputs, Filters, Outputs or Codecs. - - type: keyword -- -*`logstash.slowlog.took_in_millis`*:: +*`rsa.time.eventtime`*:: + -- -Execution time for the plugin in milliseconds. - - -type: long +type: keyword -- -*`logstash.slowlog.plugin_params`*:: +*`rsa.time.gmtdate`*:: + -- -String value of the plugin configuration - - type: keyword -- -*`logstash.slowlog.plugin_params.text`*:: +*`rsa.time.gmttime`*:: + -- -type: text +type: keyword -- -*`logstash.slowlog.plugin_params_object`*:: +*`rsa.time.p_date`*:: + -- -key -> value of the configuration used by the plugin. - - -type: object +type: keyword -- -*`logstash.slowlog.level`*:: +*`rsa.time.p_month`*:: + -- -type: alias - -alias to: log.level +type: keyword -- -*`logstash.slowlog.took_in_nanos`*:: +*`rsa.time.p_time`*:: + -- -type: alias - -alias to: event.duration +type: keyword -- -[[exported-fields-microsoft]] -== Microsoft fields - -Microsoft Module +*`rsa.time.p_time2`*:: ++ +-- +type: keyword +-- +*`rsa.time.p_year`*:: ++ +-- +type: keyword -[float] -=== microsoft.defender_atp +-- -Module for ingesting Microsoft Defender ATP. +*`rsa.time.expire_time_str`*:: ++ +-- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. +type: keyword +-- -*`microsoft.defender_atp.lastUpdateTime`*:: +*`rsa.time.stamp`*:: + -- -The date and time (in UTC) the alert was last updated. - +Deprecated key defined only in table map. type: date -- -*`microsoft.defender_atp.resolvedTime`*:: + +*`rsa.misc.action`*:: + -- -The date and time in which the status of the alert was changed to 'Resolved'. - - -type: date +type: keyword -- -*`microsoft.defender_atp.incidentId`*:: +*`rsa.misc.result`*:: + -- -The Incident ID of the Alert. - +This key is used to capture the outcome/result string value of an action in a session. type: keyword -- -*`microsoft.defender_atp.investigationId`*:: +*`rsa.misc.severity`*:: + -- -The Investigation ID related to the Alert. - +This key is used to capture the severity given the session type: keyword -- -*`microsoft.defender_atp.investigationState`*:: +*`rsa.misc.event_type`*:: + -- -The current state of the Investigation. - +This key captures the event category type as specified by the event source. type: keyword -- -*`microsoft.defender_atp.assignedTo`*:: +*`rsa.misc.reference_id`*:: + -- -Owner of the alert. - +This key is used to capture an event id from the session directly type: keyword -- -*`microsoft.defender_atp.status`*:: +*`rsa.misc.version`*:: + -- -Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. - +This key captures Version of the application or OS which is generating the event. type: keyword -- -*`microsoft.defender_atp.classification`*:: +*`rsa.misc.disposition`*:: + -- -Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. - +This key captures the The end state of an action. type: keyword -- -*`microsoft.defender_atp.determination`*:: +*`rsa.misc.result_code`*:: + -- -Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'. - +This key is used to capture the outcome/result numeric value of an action in a session type: keyword -- -*`microsoft.defender_atp.threatFamilyName`*:: +*`rsa.misc.category`*:: + -- -Threat family. - +This key is used to capture the category of an event given by the vendor in the session type: keyword -- -*`microsoft.defender_atp.rbacGroupName`*:: +*`rsa.misc.obj_name`*:: + -- -User group related to the alert - +This is used to capture name of object type: keyword -- -*`microsoft.defender_atp.evidence.domainName`*:: +*`rsa.misc.obj_type`*:: + -- -Domain name related to the alert - +This is used to capture type of object type: keyword -- -*`microsoft.defender_atp.evidence.ipAddress`*:: +*`rsa.misc.event_source`*:: + -- -IP address involved in the alert - +This key captures Source of the event that’s not a hostname -type: ip +type: keyword -- -*`microsoft.defender_atp.evidence.aadUserId`*:: +*`rsa.misc.log_session_id`*:: + -- -ID of the user involved in the alert - +This key is used to capture a sessionid from the session directly type: keyword -- -*`microsoft.defender_atp.evidence.accountName`*:: +*`rsa.misc.group`*:: + -- -Username of the user involved in the alert - +This key captures the Group Name value type: keyword -- -*`microsoft.defender_atp.evidence.entityType`*:: +*`rsa.misc.policy_name`*:: + -- -The type of evidence - +This key is used to capture the Policy Name only. type: keyword -- -*`microsoft.defender_atp.evidence.userPrincipalName`*:: +*`rsa.misc.rule_name`*:: + -- -Principal name of the user involved in the alert - +This key captures the Rule Name type: keyword -- -*`network.interface.name`*:: +*`rsa.misc.context`*:: + -- -Name of the network interface where the traffic has been observed. - +This key captures Information which adds additional context to the event. type: keyword -- - - -*`rsa.internal.msg`*:: +*`rsa.misc.change_new`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +This key is used to capture the new values of the attribute that’s changing in a session type: keyword -- -*`rsa.internal.messageid`*:: +*`rsa.misc.space`*:: + -- type: keyword -- -*`rsa.internal.event_desc`*:: +*`rsa.misc.client`*:: + -- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + type: keyword -- -*`rsa.internal.message`*:: +*`rsa.misc.msgIdPart1`*:: + -- -This key captures the contents of instant messages - type: keyword -- -*`rsa.internal.time`*:: +*`rsa.misc.msgIdPart2`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - -type: date +type: keyword -- -*`rsa.internal.level`*:: +*`rsa.misc.change_old`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the old value of the attribute that’s changing in a session -type: long +type: keyword -- -*`rsa.internal.msg_id`*:: +*`rsa.misc.operation_id`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +An alert number or operation number. The values should be unique and non-repeating. type: keyword -- -*`rsa.internal.msg_vid`*:: +*`rsa.misc.event_state`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the current state of the object/item referenced within the event. Describing an on-going event. type: keyword -- -*`rsa.internal.data`*:: +*`rsa.misc.group_object`*:: + -- -Deprecated key defined only in table map. +This key captures a collection/grouping of entities. Specific usage type: keyword -- -*`rsa.internal.obj_server`*:: +*`rsa.misc.node`*:: + -- -Deprecated key defined only in table map. +Common use case is the node name within a cluster. The cluster name is reflected by the host name. type: keyword -- -*`rsa.internal.obj_val`*:: +*`rsa.misc.rule`*:: + -- -Deprecated key defined only in table map. +This key captures the Rule number type: keyword -- -*`rsa.internal.resource`*:: +*`rsa.misc.device_name`*:: + -- -Deprecated key defined only in table map. +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc type: keyword -- -*`rsa.internal.obj_id`*:: +*`rsa.misc.param`*:: + -- -Deprecated key defined only in table map. +This key is the parameters passed as part of a command or application, etc. type: keyword -- -*`rsa.internal.statement`*:: +*`rsa.misc.change_attrib`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the name of the attribute that’s changing in a session type: keyword -- -*`rsa.internal.audit_class`*:: +*`rsa.misc.event_computer`*:: + -- -Deprecated key defined only in table map. +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. type: keyword -- -*`rsa.internal.entry`*:: +*`rsa.misc.reference_id1`*:: + -- -Deprecated key defined only in table map. +This key is for Linked ID to be used as an addition to "reference.id" type: keyword -- -*`rsa.internal.hcode`*:: +*`rsa.misc.event_log`*:: + -- -Deprecated key defined only in table map. +This key captures the Name of the event log type: keyword -- -*`rsa.internal.inode`*:: +*`rsa.misc.OS`*:: + -- -Deprecated key defined only in table map. +This key captures the Name of the Operating System -type: long +type: keyword -- -*`rsa.internal.resource_class`*:: +*`rsa.misc.terminal`*:: + -- -Deprecated key defined only in table map. +This key captures the Terminal Names only type: keyword -- -*`rsa.internal.dead`*:: +*`rsa.misc.msgIdPart3`*:: + -- -Deprecated key defined only in table map. - -type: long +type: keyword -- -*`rsa.internal.feed_desc`*:: +*`rsa.misc.filter`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Filter used to reduce result set type: keyword -- -*`rsa.internal.feed_name`*:: +*`rsa.misc.serial_number`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is the Serial number associated with a physical asset. type: keyword -- -*`rsa.internal.cid`*:: +*`rsa.misc.checksum`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. type: keyword -- -*`rsa.internal.device_class`*:: +*`rsa.misc.event_user`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. type: keyword -- -*`rsa.internal.device_group`*:: +*`rsa.misc.virusname`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the name of the virus type: keyword -- -*`rsa.internal.device_host`*:: +*`rsa.misc.content_type`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture Content Type only. type: keyword -- -*`rsa.internal.device_ip`*:: +*`rsa.misc.group_id`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Group ID Number (related to the group name) -type: ip +type: keyword -- -*`rsa.internal.device_ipv6`*:: +*`rsa.misc.policy_id`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise -type: ip +type: keyword -- -*`rsa.internal.device_type`*:: +*`rsa.misc.vsys`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Virtual System Name type: keyword -- -*`rsa.internal.device_type_id`*:: +*`rsa.misc.connection_id`*:: + -- -Deprecated key defined only in table map. +This key captures the Connection ID -type: long +type: keyword -- -*`rsa.internal.did`*:: +*`rsa.misc.reference_id2`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. type: keyword -- -*`rsa.internal.entropy_req`*:: +*`rsa.misc.sensor`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +This key captures Name of the sensor. Typically used in IDS/IPS based devices -type: long +type: keyword -- -*`rsa.internal.entropy_res`*:: +*`rsa.misc.sig_id`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +This key captures IDS/IPS Int Signature ID type: long -- -*`rsa.internal.event_name`*:: +*`rsa.misc.port_name`*:: + -- -Deprecated key defined only in table map. +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). type: keyword -- -*`rsa.internal.feed_category`*:: +*`rsa.misc.rule_group`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Rule group name type: keyword -- -*`rsa.internal.forward_ip`*:: +*`rsa.misc.risk_num`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. +This key captures a Numeric Risk value -type: ip +type: double -- -*`rsa.internal.forward_ipv6`*:: +*`rsa.misc.trigger_val`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Value of the trigger or threshold condition. -type: ip +type: keyword -- -*`rsa.internal.header_id`*:: +*`rsa.misc.log_session_id1`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture a Linked (Related) Session ID from the session directly type: keyword -- -*`rsa.internal.lc_cid`*:: +*`rsa.misc.comp_version`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Version level of a sub-component of a product. type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`rsa.misc.content_version`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures Version level of a signature or database content. -type: date +type: keyword -- -*`rsa.internal.mcb_req`*:: +*`rsa.misc.hardware_id`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +This key is used to capture unique identifier for a device or system (NOT a Mac address) -type: long +type: keyword -- -*`rsa.internal.mcb_res`*:: +*`rsa.misc.risk`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +This key captures the non-numeric risk value -type: long +type: keyword -- -*`rsa.internal.mcbc_req`*:: +*`rsa.misc.event_id`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - -type: long +type: keyword -- -*`rsa.internal.mcbc_res`*:: +*`rsa.misc.reason`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - -type: long +type: keyword -- -*`rsa.internal.medium`*:: +*`rsa.misc.status`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session - -type: long +type: keyword -- -*`rsa.internal.node_name`*:: +*`rsa.misc.mail_id`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the mailbox id/name type: keyword -- -*`rsa.internal.nwe_callback_id`*:: +*`rsa.misc.rule_uid`*:: + -- -This key denotes that event is endpoint related +This key is the Unique Identifier for a rule. type: keyword -- -*`rsa.internal.parse_error`*:: +*`rsa.misc.trigger_desc`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Description of the trigger or threshold condition. type: keyword -- -*`rsa.internal.payload_req`*:: +*`rsa.misc.inout`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - -type: long +type: keyword -- -*`rsa.internal.payload_res`*:: +*`rsa.misc.p_msgid`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - -type: long +type: keyword -- -*`rsa.internal.process_vid_dst`*:: +*`rsa.misc.data_type`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`rsa.misc.msgIdPart4`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - type: keyword -- -*`rsa.internal.rid`*:: +*`rsa.misc.error`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures All non successful Error codes or responses -type: long +type: keyword -- -*`rsa.internal.session_split`*:: +*`rsa.misc.index`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.site`*:: +*`rsa.misc.listnum`*:: + -- -Deprecated key defined only in table map. +This key is used to capture listname or listnumber, primarily for collecting access-list type: keyword -- -*`rsa.internal.size`*:: +*`rsa.misc.ntype`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: long +type: keyword -- -*`rsa.internal.sourcefile`*:: +*`rsa.misc.observed_val`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the Value observed (from the perspective of the device generating the log). type: keyword -- -*`rsa.internal.ubc_req`*:: +*`rsa.misc.policy_value`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +This key captures the contents of the policy. This contains details about the policy -type: long +type: keyword -- -*`rsa.internal.ubc_res`*:: +*`rsa.misc.pool_name`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +This key captures the name of a resource pool -type: long +type: keyword -- -*`rsa.internal.word`*:: +*`rsa.misc.rule_template`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template type: keyword -- - -*`rsa.time.event_time`*:: +*`rsa.misc.count`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - -type: date +type: keyword -- -*`rsa.time.duration_time`*:: +*`rsa.misc.number`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. - -type: double +type: keyword -- -*`rsa.time.event_time_str`*:: +*`rsa.misc.sigcat`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string - type: keyword -- -*`rsa.time.starttime`*:: +*`rsa.misc.type`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form - -type: date +type: keyword -- -*`rsa.time.month`*:: -+ --- -type: keyword - --- - -*`rsa.time.day`*:: -+ --- -type: keyword - --- - -*`rsa.time.endtime`*:: -+ --- -This key is used to capture the End time mentioned in a session in a standard form - -type: date - --- - -*`rsa.time.timezone`*:: -+ --- -This key is used to capture the timezone of the Event Time - -type: keyword - --- - -*`rsa.time.duration_str`*:: -+ --- -A text string version of the duration - -type: keyword - --- - -*`rsa.time.date`*:: -+ --- -type: keyword - --- - -*`rsa.time.year`*:: -+ --- -type: keyword - --- - -*`rsa.time.recorded_time`*:: -+ --- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - -type: date - --- - -*`rsa.time.datetime`*:: -+ --- -type: keyword - --- - -*`rsa.time.effective_time`*:: -+ --- -This key is the effective time referenced by an individual event in a Standard Timestamp format - -type: date - --- - -*`rsa.time.expire_time`*:: -+ --- -This key is the timestamp that explicitly refers to an expiration. - -type: date - --- - -*`rsa.time.process_time`*:: -+ --- -Deprecated, use duration.time - -type: keyword - --- - -*`rsa.time.hour`*:: -+ --- -type: keyword - --- - -*`rsa.time.min`*:: -+ --- -type: keyword - --- - -*`rsa.time.timestamp`*:: -+ --- -type: keyword - --- - -*`rsa.time.event_queue_time`*:: -+ --- -This key is the Time that the event was queued. - -type: date - --- - -*`rsa.time.p_time1`*:: -+ --- -type: keyword - --- - -*`rsa.time.tzone`*:: -+ --- -type: keyword - --- - -*`rsa.time.eventtime`*:: -+ --- -type: keyword - --- - -*`rsa.time.gmtdate`*:: -+ --- -type: keyword - --- - -*`rsa.time.gmttime`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_date`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_month`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_time`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_time2`*:: -+ --- -type: keyword - --- - -*`rsa.time.p_year`*:: -+ --- -type: keyword - --- - -*`rsa.time.expire_time_str`*:: -+ --- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. - -type: keyword - --- - -*`rsa.time.stamp`*:: -+ --- -Deprecated key defined only in table map. - -type: date - --- - - -*`rsa.misc.action`*:: -+ --- -type: keyword - --- - -*`rsa.misc.result`*:: -+ --- -This key is used to capture the outcome/result string value of an action in a session. - -type: keyword - --- - -*`rsa.misc.severity`*:: -+ --- -This key is used to capture the severity given the session - -type: keyword - --- - -*`rsa.misc.event_type`*:: -+ --- -This key captures the event category type as specified by the event source. - -type: keyword - --- - -*`rsa.misc.reference_id`*:: -+ --- -This key is used to capture an event id from the session directly - -type: keyword - --- - -*`rsa.misc.version`*:: -+ --- -This key captures Version of the application or OS which is generating the event. - -type: keyword - --- - -*`rsa.misc.disposition`*:: -+ --- -This key captures the The end state of an action. - -type: keyword - --- - -*`rsa.misc.result_code`*:: -+ --- -This key is used to capture the outcome/result numeric value of an action in a session - -type: keyword - --- - -*`rsa.misc.category`*:: -+ --- -This key is used to capture the category of an event given by the vendor in the session - -type: keyword - --- - -*`rsa.misc.obj_name`*:: -+ --- -This is used to capture name of object - -type: keyword - --- - -*`rsa.misc.obj_type`*:: -+ --- -This is used to capture type of object - -type: keyword - --- - -*`rsa.misc.event_source`*:: -+ --- -This key captures Source of the event that’s not a hostname - -type: keyword - --- - -*`rsa.misc.log_session_id`*:: -+ --- -This key is used to capture a sessionid from the session directly - -type: keyword - --- - -*`rsa.misc.group`*:: -+ --- -This key captures the Group Name value - -type: keyword - --- - -*`rsa.misc.policy_name`*:: -+ --- -This key is used to capture the Policy Name only. - -type: keyword - --- - -*`rsa.misc.rule_name`*:: -+ --- -This key captures the Rule Name - -type: keyword - --- - -*`rsa.misc.context`*:: -+ --- -This key captures Information which adds additional context to the event. - -type: keyword - --- - -*`rsa.misc.change_new`*:: -+ --- -This key is used to capture the new values of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.space`*:: -+ --- -type: keyword - --- - -*`rsa.misc.client`*:: -+ --- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - -type: keyword - --- - -*`rsa.misc.msgIdPart1`*:: -+ --- -type: keyword - --- - -*`rsa.misc.msgIdPart2`*:: -+ --- -type: keyword - --- - -*`rsa.misc.change_old`*:: -+ --- -This key is used to capture the old value of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.operation_id`*:: -+ --- -An alert number or operation number. The values should be unique and non-repeating. - -type: keyword - --- - -*`rsa.misc.event_state`*:: -+ --- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. - -type: keyword - --- - -*`rsa.misc.group_object`*:: -+ --- -This key captures a collection/grouping of entities. Specific usage - -type: keyword - --- - -*`rsa.misc.node`*:: -+ --- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. - -type: keyword - --- - -*`rsa.misc.rule`*:: -+ --- -This key captures the Rule number - -type: keyword - --- - -*`rsa.misc.device_name`*:: -+ --- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc - -type: keyword - --- - -*`rsa.misc.param`*:: -+ --- -This key is the parameters passed as part of a command or application, etc. - -type: keyword - --- - -*`rsa.misc.change_attrib`*:: -+ --- -This key is used to capture the name of the attribute that’s changing in a session - -type: keyword - --- - -*`rsa.misc.event_computer`*:: -+ --- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - -type: keyword - --- - -*`rsa.misc.reference_id1`*:: -+ --- -This key is for Linked ID to be used as an addition to "reference.id" - -type: keyword - --- - -*`rsa.misc.event_log`*:: -+ --- -This key captures the Name of the event log - -type: keyword - --- - -*`rsa.misc.OS`*:: -+ --- -This key captures the Name of the Operating System - -type: keyword - --- - -*`rsa.misc.terminal`*:: -+ --- -This key captures the Terminal Names only - -type: keyword - --- - -*`rsa.misc.msgIdPart3`*:: -+ --- -type: keyword - --- - -*`rsa.misc.filter`*:: -+ --- -This key captures Filter used to reduce result set - -type: keyword - --- - -*`rsa.misc.serial_number`*:: -+ --- -This key is the Serial number associated with a physical asset. - -type: keyword - --- - -*`rsa.misc.checksum`*:: -+ --- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - -type: keyword - --- - -*`rsa.misc.event_user`*:: -+ --- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - -type: keyword - --- - -*`rsa.misc.virusname`*:: -+ --- -This key captures the name of the virus - -type: keyword - --- - -*`rsa.misc.content_type`*:: -+ --- -This key is used to capture Content Type only. - -type: keyword - --- - -*`rsa.misc.group_id`*:: -+ --- -This key captures Group ID Number (related to the group name) - -type: keyword - --- - -*`rsa.misc.policy_id`*:: -+ --- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - -type: keyword - --- - -*`rsa.misc.vsys`*:: -+ --- -This key captures Virtual System Name - -type: keyword - --- - -*`rsa.misc.connection_id`*:: -+ --- -This key captures the Connection ID - -type: keyword - --- - -*`rsa.misc.reference_id2`*:: -+ --- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - -type: keyword - --- - -*`rsa.misc.sensor`*:: -+ --- -This key captures Name of the sensor. Typically used in IDS/IPS based devices - -type: keyword - --- - -*`rsa.misc.sig_id`*:: -+ --- -This key captures IDS/IPS Int Signature ID - -type: long - --- - -*`rsa.misc.port_name`*:: -+ --- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). - -type: keyword - --- - -*`rsa.misc.rule_group`*:: -+ --- -This key captures the Rule group name - -type: keyword - --- - -*`rsa.misc.risk_num`*:: -+ --- -This key captures a Numeric Risk value - -type: double - --- - -*`rsa.misc.trigger_val`*:: -+ --- -This key captures the Value of the trigger or threshold condition. - -type: keyword - --- - -*`rsa.misc.log_session_id1`*:: -+ --- -This key is used to capture a Linked (Related) Session ID from the session directly - -type: keyword - --- - -*`rsa.misc.comp_version`*:: -+ --- -This key captures the Version level of a sub-component of a product. - -type: keyword - --- - -*`rsa.misc.content_version`*:: -+ --- -This key captures Version level of a signature or database content. - -type: keyword - --- - -*`rsa.misc.hardware_id`*:: -+ --- -This key is used to capture unique identifier for a device or system (NOT a Mac address) - -type: keyword - --- - -*`rsa.misc.risk`*:: -+ --- -This key captures the non-numeric risk value - -type: keyword - --- - -*`rsa.misc.event_id`*:: -+ --- -type: keyword - --- - -*`rsa.misc.reason`*:: -+ --- -type: keyword - --- - -*`rsa.misc.status`*:: -+ --- -type: keyword - --- - -*`rsa.misc.mail_id`*:: -+ --- -This key is used to capture the mailbox id/name - -type: keyword - --- - -*`rsa.misc.rule_uid`*:: -+ --- -This key is the Unique Identifier for a rule. - -type: keyword - --- - -*`rsa.misc.trigger_desc`*:: -+ --- -This key captures the Description of the trigger or threshold condition. - -type: keyword - --- - -*`rsa.misc.inout`*:: -+ --- -type: keyword - --- - -*`rsa.misc.p_msgid`*:: -+ --- -type: keyword - --- - -*`rsa.misc.data_type`*:: -+ --- -type: keyword - --- - -*`rsa.misc.msgIdPart4`*:: -+ --- -type: keyword - --- - -*`rsa.misc.error`*:: -+ --- -This key captures All non successful Error codes or responses - -type: keyword - --- - -*`rsa.misc.index`*:: -+ --- -type: keyword - --- - -*`rsa.misc.listnum`*:: -+ --- -This key is used to capture listname or listnumber, primarily for collecting access-list - -type: keyword - --- - -*`rsa.misc.ntype`*:: -+ --- -type: keyword - --- - -*`rsa.misc.observed_val`*:: -+ --- -This key captures the Value observed (from the perspective of the device generating the log). - -type: keyword - --- - -*`rsa.misc.policy_value`*:: -+ --- -This key captures the contents of the policy. This contains details about the policy - -type: keyword - --- - -*`rsa.misc.pool_name`*:: -+ --- -This key captures the name of a resource pool - -type: keyword - --- - -*`rsa.misc.rule_template`*:: -+ --- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - -type: keyword - --- - -*`rsa.misc.count`*:: -+ --- -type: keyword - --- - -*`rsa.misc.number`*:: -+ --- -type: keyword - --- - -*`rsa.misc.sigcat`*:: -+ --- -type: keyword - --- - -*`rsa.misc.type`*:: -+ --- -type: keyword - --- - -*`rsa.misc.comments`*:: +*`rsa.misc.comments`*:: + -- Comment information provided in the log message @@ -83536,12781 +82102,47101 @@ type: keyword -- -[[exported-fields-misp]] -== MISP fields +[[exported-fields-iptables]] +== iptables fields -Module for handling threat information from MISP. +Module for handling the iptables logs. [float] -=== misp +=== iptables -Fields from MISP threat information. +Fields from the iptables logs. -[float] -=== attack_pattern +*`iptables.ether_type`*:: ++ +-- +Value of the ethernet type field identifying the network layer protocol. -Fields provide support for specifying information about attack patterns. +type: long +-- -*`misp.attack_pattern.id`*:: +*`iptables.flow_label`*:: + -- -Identifier of the threat indicator. +IPv6 flow label. -type: keyword +type: integer -- -*`misp.attack_pattern.name`*:: +*`iptables.fragment_flags`*:: + -- -Name of the attack pattern. +IP fragment flags. A combination of CE, DF and MF. type: keyword -- -*`misp.attack_pattern.description`*:: +*`iptables.fragment_offset`*:: + -- -Description of the attack pattern. +Offset of the current IP fragment. -type: text +type: long -- -*`misp.attack_pattern.kill_chain_phases`*:: +[float] +=== icmp + +ICMP fields. + + + +*`iptables.icmp.code`*:: + -- -The kill chain phase(s) to which this attack pattern corresponds. +ICMP code. -type: keyword +type: long -- -[float] -=== campaign +*`iptables.icmp.id`*:: ++ +-- +ICMP ID. -Fields provide support for specifying information about campaigns. +type: long +-- -*`misp.campaign.id`*:: +*`iptables.icmp.parameter`*:: + -- -Identifier of the campaign. +ICMP parameter. -type: keyword +type: long -- -*`misp.campaign.name`*:: +*`iptables.icmp.redirect`*:: + -- -Name of the campaign. +ICMP redirect address. -type: keyword +type: ip -- -*`misp.campaign.description`*:: +*`iptables.icmp.seq`*:: + -- -Description of the campaign. +ICMP sequence number. -type: text +type: long -- -*`misp.campaign.aliases`*:: +*`iptables.icmp.type`*:: + -- -Alternative names used to identify this campaign. +ICMP type. -type: text +type: long -- -*`misp.campaign.first_seen`*:: +*`iptables.id`*:: + -- -The time that this Campaign was first seen, in RFC3339 format. +Packet identifier. -type: date +type: long -- -*`misp.campaign.last_seen`*:: +*`iptables.incomplete_bytes`*:: + -- -The time that this Campaign was last seen, in RFC3339 format. +Number of incomplete bytes. -type: date +type: long -- -*`misp.campaign.objective`*:: +*`iptables.input_device`*:: + -- -This field defines the Campaign's primary goal, objective, desired outcome, or intended effect. +Device that received the packet. type: keyword -- -[float] -=== course_of_action +*`iptables.precedence_bits`*:: ++ +-- +IP precedence bits. -A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress. +type: short +-- -*`misp.course_of_action.id`*:: +*`iptables.tos`*:: + -- -Identifier of the Course of Action. +IP Type of Service field. -type: keyword +type: long -- -*`misp.course_of_action.name`*:: +*`iptables.length`*:: + -- -The name used to identify the Course of Action. +Packet length. -type: keyword +type: long -- -*`misp.course_of_action.description`*:: +*`iptables.output_device`*:: + -- -Description of the Course of Action. +Device that output the packet. -type: text +type: keyword -- [float] -=== identity +=== tcp -Identity can represent actual individuals, organizations, or groups, as well as classes of individuals, organizations, or groups. +TCP fields. -*`misp.identity.id`*:: +*`iptables.tcp.flags`*:: + -- -Identifier of the Identity. +TCP flags. type: keyword -- -*`misp.identity.name`*:: +*`iptables.tcp.reserved_bits`*:: + -- -The name used to identify the Identity. +TCP reserved bits. -type: keyword +type: short -- -*`misp.identity.description`*:: +*`iptables.tcp.seq`*:: + -- -Description of the Identity. +TCP sequence number. -type: text +type: long -- -*`misp.identity.identity_class`*:: +*`iptables.tcp.ack`*:: + -- -The type of entity that this Identity describes, e.g., an individual or organization. Open Vocab - identity-class-ov +TCP Acknowledgment number. -type: keyword +type: long -- -*`misp.identity.labels`*:: +*`iptables.tcp.window`*:: + -- -The list of roles that this Identity performs. - - -type: keyword +Advertised TCP window size. -example: CEO +type: long -- -*`misp.identity.sectors`*:: +*`iptables.ttl`*:: + -- -The list of sectors that this Identity belongs to. Open Vocab - industry-sector-ov +Time To Live field. -type: keyword +type: integer -- -*`misp.identity.contact_information`*:: +[float] +=== udp + +UDP fields. + + + +*`iptables.udp.length`*:: + -- -The contact information (e-mail, phone number, etc.) for this Identity. +Length of the UDP header and payload. -type: text +type: long -- [float] -=== intrusion_set +=== ubiquiti -An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization. +Fields for Ubiquiti network devices. -*`misp.intrusion_set.id`*:: +*`iptables.ubiquiti.input_zone`*:: + -- -Identifier of the Intrusion Set. +Input zone. type: keyword -- -*`misp.intrusion_set.name`*:: +*`iptables.ubiquiti.output_zone`*:: + -- -The name used to identify the Intrusion Set. +Output zone. type: keyword -- -*`misp.intrusion_set.description`*:: +*`iptables.ubiquiti.rule_number`*:: + -- -Description of the Intrusion Set. +The rule number within the rule set. +type: keyword -type: text +-- + +*`iptables.ubiquiti.rule_set`*:: ++ +-- +The rule set name. + +type: keyword -- -*`misp.intrusion_set.aliases`*:: +[[exported-fields-jolokia-autodiscover]] +== Jolokia Discovery autodiscover provider fields + +Metadata from Jolokia Discovery added by the jolokia provider. + + + +*`jolokia.agent.version`*:: + -- -Alternative names used to identify the Intrusion Set. +Version number of jolokia agent. -type: text +type: keyword -- -*`misp.intrusion_set.first_seen`*:: +*`jolokia.agent.id`*:: + -- -The time that this Intrusion Set was first seen, in RFC3339 format. +Each agent has a unique id which can be either provided during startup of the agent in form of a configuration parameter or being autodetected. If autodected, the id has several parts: The IP, the process id, hashcode of the agent and its type. -type: date +type: keyword -- -*`misp.intrusion_set.last_seen`*:: +*`jolokia.server.product`*:: + -- -The time that this Intrusion Set was last seen, in RFC3339 format. +The container product if detected. -type: date +type: keyword -- -*`misp.intrusion_set.goals`*:: +*`jolokia.server.version`*:: + -- -The high level goals of this Intrusion Set, namely, what are they trying to do. +The container's version (if detected). -type: text +type: keyword -- -*`misp.intrusion_set.resource_level`*:: +*`jolokia.server.vendor`*:: + -- -This defines the organizational level at which this Intrusion Set typically works. Open Vocab - attack-resource-level-ov +The vendor of the container the agent is running in. -type: text +type: keyword -- -*`misp.intrusion_set.primary_motivation`*:: +*`jolokia.url`*:: + -- -The primary reason, motivation, or purpose behind this Intrusion Set. Open Vocab - attack-motivation-ov +The URL how this agent can be contacted. -type: text +type: keyword -- -*`misp.intrusion_set.secondary_motivations`*:: +*`jolokia.secured`*:: + -- -The secondary reasons, motivations, or purposes behind this Intrusion Set. Open Vocab - attack-motivation-ov +Whether the agent was configured for authentication or not. -type: text +type: boolean -- -[float] -=== malware +[[exported-fields-juniper]] +== Juniper JUNOS fields -Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim. +juniper fields. -*`misp.malware.id`*:: +*`network.interface.name`*:: + -- -Identifier of the Malware. +Name of the network interface where the traffic has been observed. type: keyword -- -*`misp.malware.name`*:: + + +*`rsa.internal.msg`*:: + -- -The name used to identify the Malware. - +This key is used to capture the raw message that comes into the Log Decoder type: keyword -- -*`misp.malware.description`*:: +*`rsa.internal.messageid`*:: + -- -Description of the Malware. - - -type: text +type: keyword -- -*`misp.malware.labels`*:: +*`rsa.internal.event_desc`*:: + -- -The type of malware being described. Open Vocab - malware-label-ov. adware,backdoor,bot,ddos,dropper,exploit-kit,keylogger,ransomware, remote-access-trojan,resource-exploitation,rogue-security-software,rootkit, screen-capture,spyware,trojan,virus,worm - - type: keyword -- -*`misp.malware.kill_chain_phases`*:: +*`rsa.internal.message`*:: + -- -The list of kill chain phases for which this Malware instance can be used. - +This key captures the contents of instant messages type: keyword -format: string +-- +*`rsa.internal.time`*:: ++ -- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -[float] -=== note +type: date -A Note is a comment or note containing informative text to help explain the context of one or more STIX Objects (SDOs or SROs) or to provide additional analysis that is not contained in the original object. +-- +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. +type: long -*`misp.note.id`*:: -+ -- -Identifier of the Note. +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`misp.note.summary`*:: +*`rsa.internal.msg_vid`*:: + -- -A brief description used as a summary of the Note. - +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`misp.note.description`*:: +*`rsa.internal.data`*:: + -- -The content of the Note. - +Deprecated key defined only in table map. -type: text +type: keyword -- -*`misp.note.authors`*:: +*`rsa.internal.obj_server`*:: + -- -The name of the author(s) of this Note. - +Deprecated key defined only in table map. type: keyword -- -*`misp.note.object_refs`*:: +*`rsa.internal.obj_val`*:: + -- -The STIX Objects (SDOs and SROs) that the note is being applied to. - +Deprecated key defined only in table map. type: keyword -- -[float] -=== threat_indicator - -Fields provide support for specifying information about threat indicators, and related matching patterns. +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. +type: keyword +-- -*`misp.threat_indicator.labels`*:: +*`rsa.internal.obj_id`*:: + -- -list of type open-vocab that specifies the type of indicator. - +Deprecated key defined only in table map. type: keyword -example: Domain Watchlist - - -- -*`misp.threat_indicator.id`*:: +*`rsa.internal.statement`*:: + -- -Identifier of the threat indicator. - +Deprecated key defined only in table map. type: keyword -- -*`misp.threat_indicator.version`*:: +*`rsa.internal.audit_class`*:: + -- -Version of the threat indicator. - +Deprecated key defined only in table map. type: keyword -- -*`misp.threat_indicator.type`*:: +*`rsa.internal.entry`*:: + -- -Type of the threat indicator. - +Deprecated key defined only in table map. type: keyword -- -*`misp.threat_indicator.description`*:: +*`rsa.internal.hcode`*:: + -- -Description of the threat indicator. - +Deprecated key defined only in table map. -type: text +type: keyword -- -*`misp.threat_indicator.feed`*:: +*`rsa.internal.inode`*:: + -- -Name of the threat feed. - +Deprecated key defined only in table map. -type: text +type: long -- -*`misp.threat_indicator.valid_from`*:: +*`rsa.internal.resource_class`*:: + -- -The time from which this Indicator should be considered valuable intelligence, in RFC3339 format. - +Deprecated key defined only in table map. -type: date +type: keyword -- -*`misp.threat_indicator.valid_until`*:: +*`rsa.internal.dead`*:: + -- -The time at which this Indicator should no longer be considered valuable intelligence. If the valid_until property is omitted, then there is no constraint on the latest time for which the indicator should be used, in RFC3339 format. - +Deprecated key defined only in table map. -type: date +type: long -- -*`misp.threat_indicator.severity`*:: +*`rsa.internal.feed_desc`*:: + -- -Threat severity to which this indicator corresponds. - +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: high - -format: string - -- -*`misp.threat_indicator.confidence`*:: +*`rsa.internal.feed_name`*:: + -- -Confidence level to which this indicator corresponds. - +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: high - -- -*`misp.threat_indicator.kill_chain_phases`*:: +*`rsa.internal.cid`*:: + -- -The kill chain phase(s) to which this indicator corresponds. - +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -format: string - -- -*`misp.threat_indicator.mitre_tactic`*:: +*`rsa.internal.device_class`*:: + -- -MITRE tactics to which this indicator corresponds. - +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: Initial Access - -format: string - -- -*`misp.threat_indicator.mitre_technique`*:: +*`rsa.internal.device_group`*:: + -- -MITRE techniques to which this indicator corresponds. - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: Drive-by Compromise - -format: string - -- -*`misp.threat_indicator.attack_pattern`*:: +*`rsa.internal.device_host`*:: + -- -The attack_pattern for this indicator is a STIX Pattern as specified in STIX Version 2.0 Part 5 - STIX Patterning. - +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -example: [destination:ip = '91.219.29.188/32'] - - -- -*`misp.threat_indicator.attack_pattern_kql`*:: +*`rsa.internal.device_ip`*:: + -- -The attack_pattern for this indicator is KQL query that matches the attack_pattern specified in the STIX Pattern format. +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: ip -type: keyword +-- -example: destination.ip: "91.219.29.188/32" +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: ip -- -*`misp.threat_indicator.negate`*:: +*`rsa.internal.device_type`*:: + -- -When set to true, it specifies the absence of the attack_pattern. - +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: boolean +type: keyword -- -*`misp.threat_indicator.intrusion_set`*:: +*`rsa.internal.device_type_id`*:: + -- -Name of the intrusion set if known. - +Deprecated key defined only in table map. -type: keyword +type: long -- -*`misp.threat_indicator.campaign`*:: +*`rsa.internal.did`*:: + -- -Name of the attack campaign if known. - +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`misp.threat_indicator.threat_actor`*:: +*`rsa.internal.entropy_req`*:: + -- -Name of the threat actor if known. - +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: keyword +type: long -- -[float] -=== observed_data - -Observed data conveys information that was observed on systems and networks, such as log data or network traffic, using the Cyber Observable specification. +*`rsa.internal.entropy_res`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +type: long +-- -*`misp.observed_data.id`*:: +*`rsa.internal.event_name`*:: + -- -Identifier of the Observed Data. - +Deprecated key defined only in table map. type: keyword -- -*`misp.observed_data.first_observed`*:: +*`rsa.internal.feed_category`*:: + -- -The beginning of the time window that the data was observed, in RFC3339 format. - +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: date +type: keyword -- -*`misp.observed_data.last_observed`*:: +*`rsa.internal.forward_ip`*:: + -- -The end of the time window that the data was observed, in RFC3339 format. - +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -type: date +type: ip -- -*`misp.observed_data.number_observed`*:: +*`rsa.internal.forward_ipv6`*:: + -- -The number of times the data represented in the objects property was observed. This MUST be an integer between 1 and 999,999,999 inclusive. - +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: integer +type: ip -- -*`misp.observed_data.objects`*:: +*`rsa.internal.header_id`*:: + -- -A dictionary of Cyber Observable Objects that describes the single fact that was observed. - +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -[float] -=== report - -Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. - - - -*`misp.report.id`*:: +*`rsa.internal.lc_cid`*:: + -- -Identifier of the Report. - +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`misp.report.labels`*:: +*`rsa.internal.lc_ctime`*:: + -- -This field is an Open Vocabulary that specifies the primary subject of this report. Open Vocab - report-label-ov. threat-report,attack-pattern,campaign,identity,indicator,malware,observed-data,threat-actor,tool,vulnerability - +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: date -- -*`misp.report.name`*:: +*`rsa.internal.mcb_req`*:: + -- -The name used to identify the Report. - +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most -type: keyword +type: long -- -*`misp.report.description`*:: +*`rsa.internal.mcb_res`*:: + -- -A description that provides more details and context about Report. - +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most -type: text +type: long -- -*`misp.report.published`*:: +*`rsa.internal.mcbc_req`*:: + -- -The date that this report object was officially published by the creator of this report, in RFC3339 format. - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: date +type: long -- -*`misp.report.object_refs`*:: +*`rsa.internal.mcbc_res`*:: + -- -Specifies the STIX Objects that are referred to by this Report. - +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams -type: text +type: long -- -[float] -=== threat_actor - -Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent. +*`rsa.internal.medium`*:: ++ +-- +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +type: long +-- -*`misp.threat_actor.id`*:: +*`rsa.internal.node_name`*:: + -- -Identifier of the Threat Actor. - +Deprecated key defined only in table map. type: keyword -- -*`misp.threat_actor.labels`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -This field specifies the type of threat actor. Open Vocab - threat-actor-label-ov. activist,competitor,crime-syndicate,criminal,hacker,insider-accidental,insider-disgruntled,nation-state,sensationalist,spy,terrorist - +This key denotes that event is endpoint related type: keyword -- -*`misp.threat_actor.name`*:: +*`rsa.internal.parse_error`*:: + -- -The name used to identify this Threat Actor or Threat Actor group. - +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`misp.threat_actor.description`*:: +*`rsa.internal.payload_req`*:: + -- -A description that provides more details and context about the Threat Actor. - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: text +type: long -- -*`misp.threat_actor.aliases`*:: +*`rsa.internal.payload_res`*:: + -- -A list of other names that this Threat Actor is believed to use. - +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep -type: text +type: long -- -*`misp.threat_actor.roles`*:: +*`rsa.internal.process_vid_dst`*:: + -- -This is a list of roles the Threat Actor plays. Open Vocab - threat-actor-role-ov. agent,director,independent,sponsor,infrastructure-operator,infrastructure-architect,malware-author - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. -type: text +type: keyword -- -*`misp.threat_actor.goals`*:: +*`rsa.internal.process_vid_src`*:: + -- -The high level goals of this Threat Actor, namely, what are they trying to do. - +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. -type: text +type: keyword -- -*`misp.threat_actor.sophistication`*:: +*`rsa.internal.rid`*:: + -- -The skill, specific knowledge, special training, or expertise a Threat Actor must have to perform the attack. Open Vocab - threat-actor-sophistication-ov. none,minimal,intermediate,advanced,strategic,expert,innovator - +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: long -- -*`misp.threat_actor.resource_level`*:: +*`rsa.internal.session_split`*:: + -- -This defines the organizational level at which this Threat Actor typically works. Open Vocab - attack-resource-level-ov. individual,club,contest,team,organization,government - +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: keyword -- -*`misp.threat_actor.primary_motivation`*:: +*`rsa.internal.site`*:: + -- -The primary reason, motivation, or purpose behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable - +Deprecated key defined only in table map. -type: text +type: keyword -- -*`misp.threat_actor.secondary_motivations`*:: +*`rsa.internal.size`*:: + -- -The secondary reasons, motivations, or purposes behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable - +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: long -- -*`misp.threat_actor.personal_motivations`*:: +*`rsa.internal.sourcefile`*:: + -- -The personal reasons, motivations, or purposes of the Threat Actor regardless of organizational goals. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable - +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: text +type: keyword -- -[float] -=== tool - -Tools are legitimate software that can be used by threat actors to perform attacks. +*`rsa.internal.ubc_req`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +type: long +-- -*`misp.tool.id`*:: +*`rsa.internal.ubc_res`*:: + -- -Identifier of the Tool. - +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once -type: keyword +type: long -- -*`misp.tool.labels`*:: +*`rsa.internal.word`*:: + -- -The kind(s) of tool(s) being described. Open Vocab - tool-label-ov. denial-of-service,exploitation,information-gathering,network-capture,credential-exploitation,remote-access,vulnerability-scanning - +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log type: keyword -- -*`misp.tool.name`*:: + +*`rsa.time.event_time`*:: + -- -The name used to identify the Tool. - +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form -type: keyword +type: date -- -*`misp.tool.description`*:: +*`rsa.time.duration_time`*:: + -- -A description that provides more details and context about the Tool. - +This key is used to capture the normalized duration/lifetime in seconds. -type: text +type: double -- -*`misp.tool.tool_version`*:: +*`rsa.time.event_time_str`*:: + -- -The version identifier associated with the Tool. - +This key is used to capture the incomplete time mentioned in a session as a string type: keyword -- -*`misp.tool.kill_chain_phases`*:: +*`rsa.time.starttime`*:: + -- -The list of kill chain phases for which this Tool instance can be used. - +This key is used to capture the Start time mentioned in a session in a standard form -type: text +type: date -- -[float] -=== vulnerability - -A Vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. - - - -*`misp.vulnerability.id`*:: +*`rsa.time.month`*:: + -- -Identifier of the Vulnerability. - - type: keyword -- -*`misp.vulnerability.name`*:: +*`rsa.time.day`*:: + -- -The name used to identify the Vulnerability. - - type: keyword -- -*`misp.vulnerability.description`*:: +*`rsa.time.endtime`*:: + -- -A description that provides more details and context about the Vulnerability. +This key is used to capture the End time mentioned in a session in a standard form +type: date -type: text +-- +*`rsa.time.timezone`*:: ++ -- +This key is used to capture the timezone of the Event Time -[[exported-fields-mongodb]] -== mongodb fields +type: keyword -Module for parsing MongoDB log files. +-- +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration +type: keyword -[float] -=== mongodb +-- -Fields from MongoDB logs. +*`rsa.time.date`*:: ++ +-- +type: keyword +-- +*`rsa.time.year`*:: ++ +-- +type: keyword -[float] -=== log +-- -Contains fields from MongoDB logs. +*`rsa.time.recorded_time`*:: ++ +-- +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. +type: date +-- -*`mongodb.log.component`*:: +*`rsa.time.datetime`*:: + -- -Functional categorization of message - - type: keyword -example: COMMAND - -- -*`mongodb.log.context`*:: +*`rsa.time.effective_time`*:: + -- -Context of message - - -type: keyword +This key is the effective time referenced by an individual event in a Standard Timestamp format -example: initandlisten +type: date -- -*`mongodb.log.severity`*:: +*`rsa.time.expire_time`*:: + -- -type: alias +This key is the timestamp that explicitly refers to an expiration. -alias to: log.level +type: date -- -*`mongodb.log.message`*:: +*`rsa.time.process_time`*:: + -- -type: alias +Deprecated, use duration.time -alias to: message +type: keyword -- -[[exported-fields-mssql]] -== mssql fields +*`rsa.time.hour`*:: ++ +-- +type: keyword -MS SQL Filebeat Module +-- +*`rsa.time.min`*:: ++ +-- +type: keyword -[float] -=== mssql +-- -Fields from the MSSQL log files +*`rsa.time.timestamp`*:: ++ +-- +type: keyword +-- -[float] -=== log +*`rsa.time.event_queue_time`*:: ++ +-- +This key is the Time that the event was queued. -Common log fields +type: date +-- -*`mssql.log.origin`*:: +*`rsa.time.p_time1`*:: + -- -Origin of the message, usually the server but it can also be a recovery process - type: keyword -- -[[exported-fields-mysql]] -== MySQL fields - -Module for parsing the MySQL log files. - +*`rsa.time.tzone`*:: ++ +-- +type: keyword +-- -[float] -=== mysql +*`rsa.time.eventtime`*:: ++ +-- +type: keyword -Fields from the MySQL log files. +-- +*`rsa.time.gmtdate`*:: ++ +-- +type: keyword +-- -*`mysql.thread_id`*:: +*`rsa.time.gmttime`*:: + -- -The connection or thread ID for the query. +type: keyword +-- -type: long +*`rsa.time.p_date`*:: ++ +-- +type: keyword -- -[float] -=== error +*`rsa.time.p_month`*:: ++ +-- +type: keyword -Contains fields from the MySQL error logs. +-- +*`rsa.time.p_time`*:: ++ +-- +type: keyword +-- -*`mysql.error.thread_id`*:: +*`rsa.time.p_time2`*:: + -- -type: alias - -alias to: mysql.thread_id +type: keyword -- -*`mysql.error.level`*:: +*`rsa.time.p_year`*:: + -- -type: alias - -alias to: log.level +type: keyword -- -*`mysql.error.message`*:: +*`rsa.time.expire_time_str`*:: + -- -type: alias +This key is used to capture incomplete timestamp that explicitly refers to an expiration. -alias to: message +type: keyword -- -[float] -=== slowlog +*`rsa.time.stamp`*:: ++ +-- +Deprecated key defined only in table map. -Contains fields from the MySQL slow logs. +type: date +-- -*`mysql.slowlog.lock_time.sec`*:: +*`rsa.misc.action`*:: + -- -The amount of time the query waited for the lock to be available. The value is in seconds, as a floating point number. - - -type: float +type: keyword -- -*`mysql.slowlog.rows_sent`*:: +*`rsa.misc.result`*:: + -- -The number of rows returned by the query. - +This key is used to capture the outcome/result string value of an action in a session. -type: long +type: keyword -- -*`mysql.slowlog.rows_examined`*:: +*`rsa.misc.severity`*:: + -- -The number of rows scanned by the query. - +This key is used to capture the severity given the session -type: long +type: keyword -- -*`mysql.slowlog.rows_affected`*:: +*`rsa.misc.event_type`*:: + -- -The number of rows modified by the query. - +This key captures the event category type as specified by the event source. -type: long +type: keyword -- -*`mysql.slowlog.bytes_sent`*:: +*`rsa.misc.reference_id`*:: + -- -The number of bytes sent to client. - - -type: long +This key is used to capture an event id from the session directly -format: bytes +type: keyword -- -*`mysql.slowlog.bytes_received`*:: +*`rsa.misc.version`*:: + -- -The number of bytes received from client. - - -type: long +This key captures Version of the application or OS which is generating the event. -format: bytes +type: keyword -- -*`mysql.slowlog.query`*:: +*`rsa.misc.disposition`*:: + -- -The slow query. +This key captures the The end state of an action. +type: keyword -- -*`mysql.slowlog.id`*:: +*`rsa.misc.result_code`*:: + -- -type: alias +This key is used to capture the outcome/result numeric value of an action in a session -alias to: mysql.thread_id +type: keyword -- -*`mysql.slowlog.schema`*:: +*`rsa.misc.category`*:: + -- -The schema where the slow query was executed. - +This key is used to capture the category of an event given by the vendor in the session type: keyword -- -*`mysql.slowlog.current_user`*:: +*`rsa.misc.obj_name`*:: + -- -Current authenticated user, used to determine access privileges. Can differ from the value for user. - +This is used to capture name of object type: keyword -- -*`mysql.slowlog.last_errno`*:: +*`rsa.misc.obj_type`*:: + -- -Last SQL error seen. - +This is used to capture type of object type: keyword -- -*`mysql.slowlog.killed`*:: +*`rsa.misc.event_source`*:: + -- -Code of the reason if the query was killed. - +This key captures Source of the event that’s not a hostname type: keyword -- -*`mysql.slowlog.query_cache_hit`*:: +*`rsa.misc.log_session_id`*:: + -- -Whether the query cache was hit. - +This key is used to capture a sessionid from the session directly -type: boolean +type: keyword -- -*`mysql.slowlog.tmp_table`*:: +*`rsa.misc.group`*:: + -- -Whether a temporary table was used to resolve the query. - +This key captures the Group Name value -type: boolean +type: keyword -- -*`mysql.slowlog.tmp_table_on_disk`*:: +*`rsa.misc.policy_name`*:: + -- -Whether the query needed temporary tables on disk. - +This key is used to capture the Policy Name only. -type: boolean +type: keyword -- -*`mysql.slowlog.tmp_tables`*:: +*`rsa.misc.rule_name`*:: + -- -Number of temporary tables created for this query - +This key captures the Rule Name -type: long +type: keyword -- -*`mysql.slowlog.tmp_disk_tables`*:: +*`rsa.misc.context`*:: + -- -Number of temporary tables created on disk for this query. - +This key captures Information which adds additional context to the event. -type: long +type: keyword -- -*`mysql.slowlog.tmp_table_sizes`*:: +*`rsa.misc.change_new`*:: + -- -Size of temporary tables created for this query. - -type: long +This key is used to capture the new values of the attribute that’s changing in a session -format: bytes +type: keyword -- -*`mysql.slowlog.filesort`*:: +*`rsa.misc.space`*:: + -- -Whether filesort optimization was used. +type: keyword +-- + +*`rsa.misc.client`*:: ++ +-- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword + +-- + +*`rsa.misc.msgIdPart1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.change_old`*:: ++ +-- +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.operation_id`*:: ++ +-- +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword + +-- + +*`rsa.misc.event_state`*:: ++ +-- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword + +-- + +*`rsa.misc.group_object`*:: ++ +-- +This key captures a collection/grouping of entities. Specific usage + +type: keyword + +-- + +*`rsa.misc.node`*:: ++ +-- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword + +-- + +*`rsa.misc.rule`*:: ++ +-- +This key captures the Rule number + +type: keyword + +-- + +*`rsa.misc.device_name`*:: ++ +-- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword + +-- + +*`rsa.misc.param`*:: ++ +-- +This key is the parameters passed as part of a command or application, etc. + +type: keyword + +-- + +*`rsa.misc.change_attrib`*:: ++ +-- +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.event_computer`*:: ++ +-- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword + +-- + +*`rsa.misc.reference_id1`*:: ++ +-- +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword + +-- + +*`rsa.misc.event_log`*:: ++ +-- +This key captures the Name of the event log + +type: keyword + +-- + +*`rsa.misc.OS`*:: ++ +-- +This key captures the Name of the Operating System + +type: keyword + +-- + +*`rsa.misc.terminal`*:: ++ +-- +This key captures the Terminal Names only + +type: keyword + +-- + +*`rsa.misc.msgIdPart3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.filter`*:: ++ +-- +This key captures Filter used to reduce result set + +type: keyword + +-- + +*`rsa.misc.serial_number`*:: ++ +-- +This key is the Serial number associated with a physical asset. + +type: keyword + +-- + +*`rsa.misc.checksum`*:: ++ +-- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword + +-- + +*`rsa.misc.event_user`*:: ++ +-- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword + +-- + +*`rsa.misc.virusname`*:: ++ +-- +This key captures the name of the virus + +type: keyword + +-- + +*`rsa.misc.content_type`*:: ++ +-- +This key is used to capture Content Type only. + +type: keyword + +-- + +*`rsa.misc.group_id`*:: ++ +-- +This key captures Group ID Number (related to the group name) + +type: keyword + +-- + +*`rsa.misc.policy_id`*:: ++ +-- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword + +-- + +*`rsa.misc.vsys`*:: ++ +-- +This key captures Virtual System Name + +type: keyword + +-- + +*`rsa.misc.connection_id`*:: ++ +-- +This key captures the Connection ID + +type: keyword + +-- + +*`rsa.misc.reference_id2`*:: ++ +-- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword + +-- + +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword + +-- + +*`rsa.misc.sig_id`*:: ++ +-- +This key captures IDS/IPS Int Signature ID + +type: long + +-- + +*`rsa.misc.port_name`*:: ++ +-- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword + +-- + +*`rsa.misc.rule_group`*:: ++ +-- +This key captures the Rule group name + +type: keyword + +-- + +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value + +type: double + +-- + +*`rsa.misc.trigger_val`*:: ++ +-- +This key captures the Value of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.log_session_id1`*:: ++ +-- +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword + +-- + +*`rsa.misc.comp_version`*:: ++ +-- +This key captures the Version level of a sub-component of a product. + +type: keyword + +-- + +*`rsa.misc.content_version`*:: ++ +-- +This key captures Version level of a signature or database content. + +type: keyword + +-- + +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword + +-- + +*`rsa.misc.risk`*:: ++ +-- +This key captures the non-numeric risk value + +type: keyword + +-- + +*`rsa.misc.event_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.reason`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mail_id`*:: ++ +-- +This key is used to capture the mailbox id/name + +type: keyword + +-- + +*`rsa.misc.rule_uid`*:: ++ +-- +This key is the Unique Identifier for a rule. + +type: keyword + +-- + +*`rsa.misc.trigger_desc`*:: ++ +-- +This key captures the Description of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.inout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.data_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.error`*:: ++ +-- +This key captures All non successful Error codes or responses + +type: keyword + +-- + +*`rsa.misc.index`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.listnum`*:: ++ +-- +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword + +-- + +*`rsa.misc.ntype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.observed_val`*:: ++ +-- +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.policy_value`*:: ++ +-- +This key captures the contents of the policy. This contains details about the policy + +type: keyword + +-- + +*`rsa.misc.pool_name`*:: ++ +-- +This key captures the name of a resource pool + +type: keyword + +-- + +*`rsa.misc.rule_template`*:: ++ +-- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword + +-- + +*`rsa.misc.count`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigcat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comments`*:: ++ +-- +Comment information provided in the log message + +type: keyword + +-- + +*`rsa.misc.doc_number`*:: ++ +-- +This key captures File Identification number + +type: long + +-- + +*`rsa.misc.expected_val`*:: ++ +-- +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.job_num`*:: ++ +-- +This key captures the Job Number + +type: keyword + +-- + +*`rsa.misc.spi_dst`*:: ++ +-- +Destination SPI Index + +type: keyword + +-- + +*`rsa.misc.spi_src`*:: ++ +-- +Source SPI Index + +type: keyword + +-- + +*`rsa.misc.code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.agent_id`*:: ++ +-- +This key is used to capture agent id + +type: keyword + +-- + +*`rsa.misc.message_body`*:: ++ +-- +This key captures the The contents of the message body. + +type: keyword + +-- + +*`rsa.misc.phone`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sig_id_str`*:: ++ +-- +This key captures a string object of the sigid variable. + +type: keyword + +-- + +*`rsa.misc.cmd`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu`*:: ++ +-- +This key is the CPU time used in the execution of the event being recorded. + +type: long + +-- + +*`rsa.misc.event_desc`*:: ++ +-- +This key is used to capture a description of an event available directly or inferred + +type: keyword + +-- + +*`rsa.misc.sig_id1`*:: ++ +-- +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long + +-- + +*`rsa.misc.im_buddyid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_client`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.priority`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.context_subject`*:: ++ +-- +This key is to be used in an audit context where the subject is the object being identified + +type: keyword + +-- + +*`rsa.misc.context_target`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cve`*:: ++ +-- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword + +-- + +*`rsa.misc.fcatnum`*:: ++ +-- +This key captures Filter Category Number. Legacy Usage + +type: keyword + +-- + +*`rsa.misc.library`*:: ++ +-- +This key is used to capture library information in mainframe devices + +type: keyword + +-- + +*`rsa.misc.parent_node`*:: ++ +-- +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword + +-- + +*`rsa.misc.risk_info`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.tcp_flags`*:: ++ +-- +This key is captures the TCP flags set in any packet of session + +type: long + +-- + +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service + +type: long + +-- + +*`rsa.misc.vm_target`*:: ++ +-- +VMWare Target **VMWARE** only varaible. + +type: keyword + +-- + +*`rsa.misc.workspace`*:: ++ +-- +This key captures Workspace Description + +type: keyword + +-- + +*`rsa.misc.command`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.event_category`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facilityname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.forensic_info`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.jobname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy_waiver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.second`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.space1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.subcategory`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alert_id`*:: ++ +-- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword + +-- + +*`rsa.misc.checksum_src`*:: ++ +-- +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword + +-- + +*`rsa.misc.fresult`*:: ++ +-- +This key captures the Filter Result + +type: long + +-- + +*`rsa.misc.payload_dst`*:: ++ +-- +This key is used to capture destination payload + +type: keyword + +-- + +*`rsa.misc.payload_src`*:: ++ +-- +This key is used to capture source payload + +type: keyword + +-- + +*`rsa.misc.pool_id`*:: ++ +-- +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword + +-- + +*`rsa.misc.process_id_val`*:: ++ +-- +This key is a failure key for Process ID when it is not an integer value + +type: keyword + +-- + +*`rsa.misc.risk_num_comm`*:: ++ +-- +This key captures Risk Number Community + +type: double + +-- + +*`rsa.misc.risk_num_next`*:: ++ +-- +This key captures Risk Number NextGen + +type: double + +-- + +*`rsa.misc.risk_num_sand`*:: ++ +-- +This key captures Risk Number SandBox + +type: double + +-- + +*`rsa.misc.risk_num_static`*:: ++ +-- +This key captures Risk Number Static + +type: double + +-- + +*`rsa.misc.risk_suspicious`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.risk_warning`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.snmp_oid`*:: ++ +-- +SNMP Object Identifier + +type: keyword + +-- + +*`rsa.misc.sql`*:: ++ +-- +This key captures the SQL query + +type: keyword + +-- + +*`rsa.misc.vuln_ref`*:: ++ +-- +This key captures the Vulnerability Reference details + +type: keyword + +-- + +*`rsa.misc.acl_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_op`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_pos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_table`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.admin`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarm_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarmname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.app_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.auditdata`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.benchmark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.bypass`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache_hit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cefversion`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_attr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_obj`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_path`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.changes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client_ip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.clustermembers`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_acttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_asn_src`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_bgpv4nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ctr_dst_code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_f_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampintv`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampmode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inacttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermbyts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermpckts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_invalid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ip_proto_ver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ipv4_ident`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_l_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_did`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_rid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_max_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_maxpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_min_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_minpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_10`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_5`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_6`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_7`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_8`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_9`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_byt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_pks`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_muligmptype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampalgo`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampint`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_seqctr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_spackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sysuptime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_template_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totbytsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totflowexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totpcktsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_unixnanosecs`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6flowlabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6optheaders`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_rbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_sbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.criticality`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_agency_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_analyzedby`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_other`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_primary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_secondary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bgpv6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bit9status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_context`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_control`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_dst_tld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_dst_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_src_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_event_uuid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_filetype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ip_next_hop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4dstpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4srcpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_lifetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_log_medium`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_loginname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulescore`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulesign`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_opswatresult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_payload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrant`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrar`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_represult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_rpayload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sampler_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sourcemodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_streams`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_targetmodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_v6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_whois_server`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_yararesult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.description`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.devvendor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.distance`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.dstburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomaub`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.euid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facility`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.finterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.flags`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.gaddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.id3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_buddyname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomtype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_members`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipspri`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.latitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.linenum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.list_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.load_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_floor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_mark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.longitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.lport`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mbug_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.netsessid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.nwwn`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.operation`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.opkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.orig_from`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.owner_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_filter`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_group_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_result1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_chg`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permgranted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permwanted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.prog_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.program`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.real_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_device`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_library`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ruid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sdomain_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sec`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sensorname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.seqnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.session`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.spi`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcservice`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.state`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.svcno`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.system`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.threshold`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.udb_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.url_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.user_div`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.username_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.v_instafname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.virt_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.vpnid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.autorun_type`*:: ++ +-- +This is used to capture Auto Run type + +type: keyword + +-- + +*`rsa.misc.cc_number`*:: ++ +-- +Valid Credit Card Numbers only + +type: long + +-- + +*`rsa.misc.content`*:: ++ +-- +This key captures the content type from protocol headers + +type: keyword + +-- + +*`rsa.misc.ein_number`*:: ++ +-- +Employee Identification Numbers only + +type: long + +-- + +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match + +type: keyword + +-- + +*`rsa.misc.language`*:: ++ +-- +This is used to capture list of languages the client support and what it prefers + +type: keyword + +-- + +*`rsa.misc.lifetime`*:: ++ +-- +This key is used to capture the session lifetime in seconds. + +type: long + +-- + +*`rsa.misc.link`*:: ++ +-- +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.misc.match`*:: ++ +-- +This key is for regex match name from search.ini + +type: keyword + +-- + +*`rsa.misc.param_dst`*:: ++ +-- +This key captures the command line/launch argument of the target process or file + +type: keyword + +-- + +*`rsa.misc.param_src`*:: ++ +-- +This key captures source parameter + +type: keyword + +-- + +*`rsa.misc.search_text`*:: ++ +-- +This key captures the Search Text used + +type: keyword + +-- + +*`rsa.misc.sig_name`*:: ++ +-- +This key is used to capture the Signature Name only. + +type: keyword + +-- + +*`rsa.misc.snmp_value`*:: ++ +-- +SNMP set request value + +type: keyword + +-- + +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session + +type: long + +-- + + +*`rsa.db.index`*:: ++ +-- +This key captures IndexID of the index. + +type: keyword + +-- + +*`rsa.db.instance`*:: ++ +-- +This key is used to capture the database server instance name + +type: keyword + +-- + +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session + +type: keyword + +-- + +*`rsa.db.permissions`*:: ++ +-- +This key captures permission or privilege level assigned to a resource. + +type: keyword + +-- + +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name + +type: keyword + +-- + +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database + +type: keyword + +-- + +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server + +type: long + +-- + +*`rsa.db.lread`*:: ++ +-- +This key is used for the number of logical reads + +type: long + +-- + +*`rsa.db.lwrite`*:: ++ +-- +This key is used for the number of logical writes + +type: long + +-- + +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes + +type: long + +-- + + +*`rsa.network.alias_host`*:: ++ +-- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword + +-- + +*`rsa.network.domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_dst`*:: ++ +-- +This key should only be used when it’s a Destination Hostname + +type: keyword + +-- + +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names + +type: keyword + +-- + +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear + +type: keyword + +-- + +*`rsa.network.network_port`*:: ++ +-- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long + +-- + +*`rsa.network.eth_host`*:: ++ +-- +Deprecated, use alias.mac + +type: keyword + +-- + +*`rsa.network.sinterface`*:: ++ +-- +This key should only be used when it’s a Source Interface + +type: keyword + +-- + +*`rsa.network.dinterface`*:: ++ +-- +This key should only be used when it’s a Destination Interface + +type: keyword + +-- + +*`rsa.network.vlan`*:: ++ +-- +This key should only be used to capture the ID of the Virtual LAN + +type: long + +-- + +*`rsa.network.zone_src`*:: ++ +-- +This key should only be used when it’s a Source Zone. + +type: keyword + +-- + +*`rsa.network.zone`*:: ++ +-- +This key should be used when the source or destination context of a Zone is not clear + +type: keyword + +-- + +*`rsa.network.zone_dst`*:: ++ +-- +This key should only be used when it’s a Destination Zone. + +type: keyword + +-- + +*`rsa.network.gateway`*:: ++ +-- +This key is used to capture the IP Address of the gateway + +type: keyword + +-- + +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only + +type: long + +-- + +*`rsa.network.mask`*:: ++ +-- +This key is used to capture the device network IPmask. + +type: keyword + +-- + +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only + +type: long + +-- + +*`rsa.network.protocol_detail`*:: ++ +-- +This key should be used to capture additional protocol information + +type: keyword + +-- + +*`rsa.network.dmask`*:: ++ +-- +This key is used for Destionation Device network mask + +type: keyword + +-- + +*`rsa.network.port`*:: ++ +-- +This key should only be used to capture a Network Port when the directionality is not clear + +type: long + +-- + +*`rsa.network.smask`*:: ++ +-- +This key is used for capturing source Network Mask + +type: keyword + +-- + +*`rsa.network.netname`*:: ++ +-- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword + +-- + +*`rsa.network.paddr`*:: ++ +-- +Deprecated + +type: ip + +-- + +*`rsa.network.faddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.lhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.origin`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.addr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_ptr_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fport`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.laddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.linterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.phost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.ad_computer_dst`*:: ++ +-- +Deprecated, use host.dst + +type: keyword + +-- + +*`rsa.network.eth_type`*:: ++ +-- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long + +-- + +*`rsa.network.ip_proto`*:: ++ +-- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long + +-- + +*`rsa.network.dns_cname_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_opcode`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_resp`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.domain1`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.packet_length`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_orig`*:: ++ +-- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword + +-- + +*`rsa.network.rpayload`*:: ++ +-- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword + +-- + +*`rsa.network.vlan_name`*:: ++ +-- +This key should only be used to capture the name of the Virtual LAN + +type: keyword + +-- + + +*`rsa.investigations.ec_activity`*:: ++ +-- +This key captures the particular event activity(Ex:Logoff) + +type: keyword + +-- + +*`rsa.investigations.ec_theme`*:: ++ +-- +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword + +-- + +*`rsa.investigations.ec_subject`*:: ++ +-- +This key captures the Subject of a particular Event(Ex:User) + +type: keyword + +-- + +*`rsa.investigations.ec_outcome`*:: ++ +-- +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword + +-- + +*`rsa.investigations.event_cat`*:: ++ +-- +This key captures the Event category number + +type: long + +-- + +*`rsa.investigations.event_cat_name`*:: ++ +-- +This key captures the event category name corresponding to the event cat code + +type: keyword + +-- + +*`rsa.investigations.event_vcat`*:: ++ +-- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword + +-- + +*`rsa.investigations.analysis_file`*:: ++ +-- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + +type: keyword + +-- + +*`rsa.investigations.analysis_service`*:: ++ +-- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword + +-- + +*`rsa.investigations.analysis_session`*:: ++ +-- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword + +-- + +*`rsa.investigations.boc`*:: ++ +-- +This is used to capture behaviour of compromise + +type: keyword + +-- + +*`rsa.investigations.eoc`*:: ++ +-- +This is used to capture Enablers of Compromise + +type: keyword + +-- + +*`rsa.investigations.inv_category`*:: ++ +-- +This used to capture investigation category + +type: keyword + +-- + +*`rsa.investigations.inv_context`*:: ++ +-- +This used to capture investigation context + +type: keyword + +-- + +*`rsa.investigations.ioc`*:: ++ +-- +This is key capture indicator of compromise + +type: keyword + +-- + + +*`rsa.counters.dclass_c1`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long + +-- + +*`rsa.counters.dclass_c2`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long + +-- + +*`rsa.counters.event_counter`*:: ++ +-- +This is used to capture the number of times an event repeated + +type: long + +-- + +*`rsa.counters.dclass_r1`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long + +-- + +*`rsa.counters.dclass_c1_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword + +-- + +*`rsa.counters.dclass_c2_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r1_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword + +-- + +*`rsa.counters.dclass_r2`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword + +-- + +*`rsa.counters.dclass_r2_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword + +-- + + +*`rsa.identity.auth_method`*:: ++ +-- +This key is used to capture authentication methods used only + +type: keyword + +-- + +*`rsa.identity.user_role`*:: ++ +-- +This key is used to capture the Role of a user only + +type: keyword + +-- + +*`rsa.identity.dn`*:: ++ +-- +X.500 (LDAP) Distinguished Name + +type: keyword + +-- + +*`rsa.identity.logon_type`*:: ++ +-- +This key is used to capture the type of logon method used. + +type: keyword + +-- + +*`rsa.identity.profile`*:: ++ +-- +This key is used to capture the user profile + +type: keyword + +-- + +*`rsa.identity.accesses`*:: ++ +-- +This key is used to capture actual privileges used in accessing an object + +type: keyword + +-- + +*`rsa.identity.realm`*:: ++ +-- +Radius realm or similar grouping of accounts + +type: keyword + +-- + +*`rsa.identity.user_sid_dst`*:: ++ +-- +This key captures Destination User Session ID + +type: keyword + +-- + +*`rsa.identity.dn_src`*:: ++ +-- +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword + +-- + +*`rsa.identity.org`*:: ++ +-- +This key captures the User organization + +type: keyword + +-- + +*`rsa.identity.dn_dst`*:: ++ +-- +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn + +type: keyword + +-- + +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.lastname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.user_dept`*:: ++ +-- +User's Department Names only + +type: keyword + +-- + +*`rsa.identity.user_sid_src`*:: ++ +-- +This key captures Source User Session ID + +type: keyword + +-- + +*`rsa.identity.federated_sp`*:: ++ +-- +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword + +-- + +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword + +-- + +*`rsa.identity.logon_type_desc`*:: ++ +-- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. + +type: keyword + +-- + +*`rsa.identity.middlename`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.password`*:: ++ +-- +This key is for Passwords seen in any session, plain text or encrypted + +type: keyword + +-- + +*`rsa.identity.host_role`*:: ++ +-- +This key should only be used to capture the role of a Host Machine + +type: keyword + +-- + +*`rsa.identity.ldap`*:: ++ +-- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + +type: keyword + +-- + +*`rsa.identity.ldap_query`*:: ++ +-- +This key is the Search criteria from an LDAP search + +type: keyword + +-- + +*`rsa.identity.ldap_response`*:: ++ +-- +This key is to capture Results from an LDAP search + +type: keyword + +-- + +*`rsa.identity.owner`*:: ++ +-- +This is used to capture username the process or service is running as, the author of the task + +type: keyword + +-- + +*`rsa.identity.service_account`*:: ++ +-- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage + +type: keyword + +-- + + +*`rsa.email.email_dst`*:: ++ +-- +This key is used to capture the Destination email address only, when the destination context is not clear use email + +type: keyword + +-- + +*`rsa.email.email_src`*:: ++ +-- +This key is used to capture the source email address only, when the source context is not clear use email + +type: keyword + +-- + +*`rsa.email.subject`*:: ++ +-- +This key is used to capture the subject string from an Email only. + +type: keyword + +-- + +*`rsa.email.email`*:: ++ +-- +This key is used to capture a generic email address where the source or destination context is not clear + +type: keyword + +-- + +*`rsa.email.trans_from`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + + +*`rsa.file.privilege`*:: ++ +-- +Deprecated, use permissions + +type: keyword + +-- + +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword + +-- + +*`rsa.file.filesystem`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.file.filename_dst`*:: ++ +-- +This is used to capture name of the file targeted by the action + +type: keyword + +-- + +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action + +type: keyword + +-- + +*`rsa.file.filename_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file + +type: keyword + +-- + +*`rsa.file.directory_src`*:: ++ +-- +This key is used to capture the directory of the source process or file + +type: keyword + +-- + +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double + +-- + +*`rsa.file.file_vendor`*:: ++ +-- +This is used to capture Company name of file located in version_info + +type: keyword + +-- + +*`rsa.file.task_name`*:: ++ +-- +This is used to capture name of the task + +type: keyword + +-- + + +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names + +type: keyword + +-- + +*`rsa.web.web_cookie`*:: ++ +-- +This key is used to capture the Web cookies specifically. + +type: keyword + +-- + +*`rsa.web.alias_host`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double + +-- + +*`rsa.web.web_ref_domain`*:: ++ +-- +Web referer's domain + +type: keyword + +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword + +-- + +*`rsa.web.remote_domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword + +-- + +*`rsa.web.web_ref_root`*:: ++ +-- +Web referer's root URL path + +type: keyword + +-- + +*`rsa.web.cn_asn_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlpage`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlroot`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_url`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_page`*:: ++ +-- +type: keyword + +-- + + +*`rsa.threat.threat_category`*:: ++ +-- +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: ++ +-- +This key is used to capture the threat description from the session directly or inferred + +type: keyword + +-- + +*`rsa.threat.alert`*:: ++ +-- +This key is used to capture name of the alert + +type: keyword + +-- + +*`rsa.threat.threat_source`*:: ++ +-- +This key is used to capture source of the threat + +type: keyword + +-- + + +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword + +-- + +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- + +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size + +type: long + +-- + +*`rsa.crypto.ike`*:: ++ +-- +IKE negotiation phase. + +type: keyword + +-- + +*`rsa.crypto.scheme`*:: ++ +-- +This key captures the Encryption scheme used + +type: keyword + +-- + +*`rsa.crypto.peer_id`*:: ++ +-- +This key is for Encryption peer’s identity + +type: keyword + +-- + +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type + +type: keyword + +-- + +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String + +type: keyword + +-- + +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher + +type: keyword + +-- + +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size + +type: long + +-- + +*`rsa.crypto.ssl_ver_src`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.d_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One + +type: keyword + +-- + +*`rsa.crypto.ike_cookie2`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase Two + +type: keyword + +-- + +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_cat`*:: ++ +-- +This key is used for the hostname category value of a certificate + +type: keyword + +-- + +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only + +type: keyword + +-- + +*`rsa.crypto.cert_status`*:: ++ +-- +This key captures Certificate validation status + +type: keyword + +-- + +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.cert_keysize`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_insact`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only + +type: keyword + +-- + +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword + +-- + + +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session + +type: keyword + +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword + +-- + +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names + +type: long + +-- + +*`rsa.wireless.wlan_name`*:: ++ +-- +This key captures either WLAN number/name + +type: keyword + +-- + + +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk + +type: keyword + +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. + +type: keyword + +-- + +*`rsa.storage.pwwn`*:: ++ +-- +This uniquely identifies a port on a HBA. + +type: keyword + +-- + + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + + +*`rsa.healthcare.patient_fname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient + +type: keyword + +-- + +*`rsa.healthcare.patient_lname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_mname`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: ++ +-- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + +type: keyword + +-- + +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key + +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: ++ +-- +This key captures values or decorators used within a registry entry + +type: keyword + +-- + +[[exported-fields-kafka]] +== Kafka fields + +Kafka module + + + +[float] +=== kafka + + + + +[float] +=== log + +Kafka log lines. + + + +*`kafka.log.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`kafka.log.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +*`kafka.log.component`*:: ++ +-- +Component the log is coming from. + + +type: keyword + +-- + +*`kafka.log.class`*:: ++ +-- +Java class the log is coming from. + + +type: keyword + +-- + +*`kafka.log.thread`*:: ++ +-- +Thread name the log is coming from. + + +type: keyword + +-- + +[float] +=== trace + +Trace in the log line. + + + +*`kafka.log.trace.class`*:: ++ +-- +Java class the trace is coming from. + + +type: keyword + +-- + +*`kafka.log.trace.message`*:: ++ +-- +Message part of the trace. + + +type: text + +-- + +[[exported-fields-kibana]] +== kibana fields + +kibana Module + + + +[float] +=== kibana + + + + +[float] +=== log + +Kafka log lines. + + + +*`kibana.log.tags`*:: ++ +-- +Kibana logging tags. + + +type: keyword + +-- + +*`kibana.log.state`*:: ++ +-- +Current state of Kibana. + + +type: keyword + +-- + +*`kibana.log.meta`*:: ++ +-- +type: object + +-- + +*`kibana.log.kibana.log.meta.req.headers.referer`*:: ++ +-- +type: alias + +alias to: http.request.referrer + +-- + +*`kibana.log.kibana.log.meta.req.referer`*:: ++ +-- +type: alias + +alias to: http.request.referrer + +-- + +*`kibana.log.kibana.log.meta.req.headers.user-agent`*:: ++ +-- +type: alias + +alias to: user_agent.original + +-- + +*`kibana.log.kibana.log.meta.req.remoteAddress`*:: ++ +-- +type: alias + +alias to: source.address + +-- + +*`kibana.log.kibana.log.meta.req.url`*:: ++ +-- +type: alias + +alias to: url.original + +-- + +*`kibana.log.kibana.log.meta.statusCode`*:: ++ +-- +type: alias + +alias to: http.response.status_code + +-- + +*`kibana.log.kibana.log.meta.method`*:: ++ +-- +type: alias + +alias to: http.request.method + +-- + +[[exported-fields-kubernetes-processor]] +== Kubernetes fields + +Kubernetes metadata added by the kubernetes processor + + + + +*`kubernetes.pod.name`*:: ++ +-- +Kubernetes pod name + + +type: keyword + +-- + +*`kubernetes.pod.uid`*:: ++ +-- +Kubernetes Pod UID + + +type: keyword + +-- + +*`kubernetes.namespace`*:: ++ +-- +Kubernetes namespace + + +type: keyword + +-- + +*`kubernetes.node.name`*:: ++ +-- +Kubernetes node name + + +type: keyword + +-- + +*`kubernetes.labels.*`*:: ++ +-- +Kubernetes labels map + + +type: object + +-- + +*`kubernetes.annotations.*`*:: ++ +-- +Kubernetes annotations map + + +type: object + +-- + +*`kubernetes.replicaset.name`*:: ++ +-- +Kubernetes replicaset name + + +type: keyword + +-- + +*`kubernetes.deployment.name`*:: ++ +-- +Kubernetes deployment name + + +type: keyword + +-- + +*`kubernetes.statefulset.name`*:: ++ +-- +Kubernetes statefulset name + + +type: keyword + +-- + +*`kubernetes.container.name`*:: ++ +-- +Kubernetes container name + + +type: keyword + +-- + +*`kubernetes.container.image`*:: ++ +-- +Kubernetes container image + + +type: keyword + +-- + +[[exported-fields-log]] +== Log file content fields + +Contains log file lines. + + + +*`log.source.address`*:: ++ +-- +Source address from which the log event was read / sent from. + + +type: keyword + +required: False + +-- + +*`log.offset`*:: ++ +-- +The file offset the reported line starts at. + + +type: long + +required: False + +-- + +*`stream`*:: ++ +-- +Log stream when reading container logs, can be 'stdout' or 'stderr' + + +type: keyword + +required: False + +-- + +*`input.type`*:: ++ +-- +The input type from which the event was generated. This field is set to the value specified for the `type` option in the input section of the Filebeat config file. + + +required: True + +-- + +*`syslog.facility`*:: ++ +-- +The facility extracted from the priority. + + +type: long + +required: False + +-- + +*`syslog.priority`*:: ++ +-- +The priority of the syslog event. + + +type: long + +required: False + +-- + +*`syslog.severity_label`*:: ++ +-- +The human readable severity. + + +type: keyword + +required: False + +-- + +*`syslog.facility_label`*:: ++ +-- +The human readable facility. + + +type: keyword + +required: False + +-- + +*`process.program`*:: ++ +-- +The name of the program. + + +type: keyword + +required: False + +-- + +*`log.flags`*:: ++ +-- +This field contains the flags of the event. + + +-- + +*`http.response.content_length`*:: ++ +-- +type: alias + +alias to: http.response.body.bytes + +-- + + + +*`user_agent.os.full_name`*:: ++ +-- +type: keyword + +-- + +*`fileset.name`*:: ++ +-- +The Filebeat fileset that generated this event. + + +type: keyword + +-- + +*`fileset.module`*:: ++ +-- +type: alias + +alias to: event.module + +-- + +*`read_timestamp`*:: ++ +-- +type: alias + +alias to: event.created + +-- + +*`docker.attrs`*:: ++ +-- +docker.attrs contains labels and environment variables written by docker's JSON File logging driver. These fields are only available when they are configured in the logging driver options. + + +type: object + +-- + +*`icmp.code`*:: ++ +-- +ICMP code. + + +type: keyword + +-- + +*`icmp.type`*:: ++ +-- +ICMP type. + + +type: keyword + +-- + +*`igmp.type`*:: ++ +-- +IGMP type. + + +type: keyword + +-- + + +*`azure.eventhub`*:: ++ +-- +Name of the eventhub. + + +type: keyword + +-- + +*`azure.offset`*:: ++ +-- +The offset. + + +type: long + +-- + +*`azure.enqueued_time`*:: ++ +-- +The enqueued time. + + +type: date + +-- + +*`azure.partition_id`*:: ++ +-- +The partition id. + + +type: long + +-- + +*`azure.consumer_group`*:: ++ +-- +The consumer group. + + +type: keyword + +-- + +*`azure.sequence_number`*:: ++ +-- +The sequence number. + + +type: long + +-- + + +*`kafka.topic`*:: ++ +-- +Kafka topic + + +type: keyword + +-- + +*`kafka.partition`*:: ++ +-- +Kafka partition number + + +type: long + +-- + +*`kafka.offset`*:: ++ +-- +Kafka offset of this message + + +type: long + +-- + +*`kafka.key`*:: ++ +-- +Kafka key, corresponding to the Kafka value stored in the message + + +type: keyword + +-- + +*`kafka.block_timestamp`*:: ++ +-- +Kafka outer (compressed) block timestamp + + +type: date + +-- + +*`kafka.headers`*:: ++ +-- +An array of Kafka header strings for this message, in the form ": ". + + +type: array + +-- + +[[exported-fields-logstash]] +== logstash fields + +logstash Module + + + +[float] +=== logstash + + + + +[float] +=== log + +Fields from the Logstash logs. + + + +*`logstash.log.module`*:: ++ +-- +The module or class where the event originate. + + +type: keyword + +-- + +*`logstash.log.thread`*:: ++ +-- +Information about the running thread where the log originate. + + +type: keyword + +-- + +*`logstash.log.thread.text`*:: ++ +-- +type: text + +-- + +*`logstash.log.log_event`*:: ++ +-- +key and value debugging information. + + +type: object + +-- + +*`logstash.log.pipeline_id`*:: ++ +-- +The ID of the pipeline. + + +type: keyword + +example: main + +-- + +*`logstash.log.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +*`logstash.log.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +[float] +=== slowlog + +slowlog + + + +*`logstash.slowlog.module`*:: ++ +-- +The module or class where the event originate. + + +type: keyword + +-- + +*`logstash.slowlog.thread`*:: ++ +-- +Information about the running thread where the log originate. + + +type: keyword + +-- + +*`logstash.slowlog.thread.text`*:: ++ +-- +type: text + +-- + +*`logstash.slowlog.event`*:: ++ +-- +Raw dump of the original event + + +type: keyword + +-- + +*`logstash.slowlog.event.text`*:: ++ +-- +type: text + +-- + +*`logstash.slowlog.plugin_name`*:: ++ +-- +Name of the plugin + + +type: keyword + +-- + +*`logstash.slowlog.plugin_type`*:: ++ +-- +Type of the plugin: Inputs, Filters, Outputs or Codecs. + + +type: keyword + +-- + +*`logstash.slowlog.took_in_millis`*:: ++ +-- +Execution time for the plugin in milliseconds. + + +type: long + +-- + +*`logstash.slowlog.plugin_params`*:: ++ +-- +String value of the plugin configuration + + +type: keyword + +-- + +*`logstash.slowlog.plugin_params.text`*:: ++ +-- +type: text + +-- + +*`logstash.slowlog.plugin_params_object`*:: ++ +-- +key -> value of the configuration used by the plugin. + + +type: object + +-- + +*`logstash.slowlog.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`logstash.slowlog.took_in_nanos`*:: ++ +-- +type: alias + +alias to: event.duration + +-- + +[[exported-fields-microsoft]] +== Microsoft fields + +Microsoft Module + + + +[float] +=== microsoft.defender_atp + +Module for ingesting Microsoft Defender ATP. + + + +*`microsoft.defender_atp.lastUpdateTime`*:: ++ +-- +The date and time (in UTC) the alert was last updated. + + +type: date + +-- + +*`microsoft.defender_atp.resolvedTime`*:: ++ +-- +The date and time in which the status of the alert was changed to 'Resolved'. + + +type: date + +-- + +*`microsoft.defender_atp.incidentId`*:: ++ +-- +The Incident ID of the Alert. + + +type: keyword + +-- + +*`microsoft.defender_atp.investigationId`*:: ++ +-- +The Investigation ID related to the Alert. + + +type: keyword + +-- + +*`microsoft.defender_atp.investigationState`*:: ++ +-- +The current state of the Investigation. + + +type: keyword + +-- + +*`microsoft.defender_atp.assignedTo`*:: ++ +-- +Owner of the alert. + + +type: keyword + +-- + +*`microsoft.defender_atp.status`*:: ++ +-- +Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. + + +type: keyword + +-- + +*`microsoft.defender_atp.classification`*:: ++ +-- +Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. + + +type: keyword + +-- + +*`microsoft.defender_atp.determination`*:: ++ +-- +Specifies the determination of the alert. Possible values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other'. + + +type: keyword + +-- + +*`microsoft.defender_atp.threatFamilyName`*:: ++ +-- +Threat family. + + +type: keyword + +-- + +*`microsoft.defender_atp.rbacGroupName`*:: ++ +-- +User group related to the alert + + +type: keyword + +-- + +*`microsoft.defender_atp.evidence.domainName`*:: ++ +-- +Domain name related to the alert + + +type: keyword + +-- + +*`microsoft.defender_atp.evidence.ipAddress`*:: ++ +-- +IP address involved in the alert + + +type: ip + +-- + +*`microsoft.defender_atp.evidence.aadUserId`*:: ++ +-- +ID of the user involved in the alert + + +type: keyword + +-- + +*`microsoft.defender_atp.evidence.accountName`*:: ++ +-- +Username of the user involved in the alert + + +type: keyword + +-- + +*`microsoft.defender_atp.evidence.entityType`*:: ++ +-- +The type of evidence + + +type: keyword + +-- + +*`microsoft.defender_atp.evidence.userPrincipalName`*:: ++ +-- +Principal name of the user involved in the alert + + +type: keyword + +-- + +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. + + +type: keyword + +-- + + + +*`rsa.internal.msg`*:: ++ +-- +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword + +-- + +*`rsa.internal.messageid`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.event_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.message`*:: ++ +-- +This key captures the contents of instant messages + +type: keyword + +-- + +*`rsa.internal.time`*:: ++ +-- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date + +-- + +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_server`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_val`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.statement`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.audit_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.entry`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.hcode`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.inode`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.cid`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_class`*:: ++ +-- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_group`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_host`*:: ++ +-- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_ip`*:: ++ +-- +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.did`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.entropy_req`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.entropy_res`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.event_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.feed_category`*:: ++ +-- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.forward_ip`*:: ++ +-- +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip + +-- + +*`rsa.internal.forward_ipv6`*:: ++ +-- +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.header_id`*:: ++ +-- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_cid`*:: ++ +-- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_ctime`*:: ++ +-- +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date + +-- + +*`rsa.internal.mcb_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcb_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcbc_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.mcbc_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.medium`*:: ++ +-- +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long + +-- + +*`rsa.internal.node_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.nwe_callback_id`*:: ++ +-- +This key denotes that event is endpoint related + +type: keyword + +-- + +*`rsa.internal.parse_error`*:: ++ +-- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.payload_req`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.payload_res`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.process_vid_dst`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + +type: keyword + +-- + +*`rsa.internal.process_vid_src`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + +type: keyword + +-- + +*`rsa.internal.rid`*:: ++ +-- +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.session_split`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.site`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.size`*:: ++ +-- +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.sourcefile`*:: ++ +-- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.ubc_req`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.ubc_res`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.word`*:: ++ +-- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + +type: keyword + +-- + + +*`rsa.time.event_time`*:: ++ +-- +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date + +-- + +*`rsa.time.duration_time`*:: ++ +-- +This key is used to capture the normalized duration/lifetime in seconds. + +type: double + +-- + +*`rsa.time.event_time_str`*:: ++ +-- +This key is used to capture the incomplete time mentioned in a session as a string + +type: keyword + +-- + +*`rsa.time.starttime`*:: ++ +-- +This key is used to capture the Start time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.day`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.endtime`*:: ++ +-- +This key is used to capture the End time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.timezone`*:: ++ +-- +This key is used to capture the timezone of the Event Time + +type: keyword + +-- + +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration + +type: keyword + +-- + +*`rsa.time.date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.recorded_time`*:: ++ +-- +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date + +-- + +*`rsa.time.datetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.effective_time`*:: ++ +-- +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date + +-- + +*`rsa.time.expire_time`*:: ++ +-- +This key is the timestamp that explicitly refers to an expiration. + +type: date + +-- + +*`rsa.time.process_time`*:: ++ +-- +Deprecated, use duration.time + +type: keyword + +-- + +*`rsa.time.hour`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.min`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.timestamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.event_queue_time`*:: ++ +-- +This key is the Time that the event was queued. + +type: date + +-- + +*`rsa.time.p_time1`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.tzone`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.eventtime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmtdate`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmttime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time2`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.expire_time_str`*:: ++ +-- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + +type: keyword + +-- + +*`rsa.time.stamp`*:: ++ +-- +Deprecated key defined only in table map. + +type: date + +-- + + +*`rsa.misc.action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.result`*:: ++ +-- +This key is used to capture the outcome/result string value of an action in a session. + +type: keyword + +-- + +*`rsa.misc.severity`*:: ++ +-- +This key is used to capture the severity given the session + +type: keyword + +-- + +*`rsa.misc.event_type`*:: ++ +-- +This key captures the event category type as specified by the event source. + +type: keyword + +-- + +*`rsa.misc.reference_id`*:: ++ +-- +This key is used to capture an event id from the session directly + +type: keyword + +-- + +*`rsa.misc.version`*:: ++ +-- +This key captures Version of the application or OS which is generating the event. + +type: keyword + +-- + +*`rsa.misc.disposition`*:: ++ +-- +This key captures the The end state of an action. + +type: keyword + +-- + +*`rsa.misc.result_code`*:: ++ +-- +This key is used to capture the outcome/result numeric value of an action in a session + +type: keyword + +-- + +*`rsa.misc.category`*:: ++ +-- +This key is used to capture the category of an event given by the vendor in the session + +type: keyword + +-- + +*`rsa.misc.obj_name`*:: ++ +-- +This is used to capture name of object + +type: keyword + +-- + +*`rsa.misc.obj_type`*:: ++ +-- +This is used to capture type of object + +type: keyword + +-- + +*`rsa.misc.event_source`*:: ++ +-- +This key captures Source of the event that’s not a hostname + +type: keyword + +-- + +*`rsa.misc.log_session_id`*:: ++ +-- +This key is used to capture a sessionid from the session directly + +type: keyword + +-- + +*`rsa.misc.group`*:: ++ +-- +This key captures the Group Name value + +type: keyword + +-- + +*`rsa.misc.policy_name`*:: ++ +-- +This key is used to capture the Policy Name only. + +type: keyword + +-- + +*`rsa.misc.rule_name`*:: ++ +-- +This key captures the Rule Name + +type: keyword + +-- + +*`rsa.misc.context`*:: ++ +-- +This key captures Information which adds additional context to the event. + +type: keyword + +-- + +*`rsa.misc.change_new`*:: ++ +-- +This key is used to capture the new values of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.space`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client`*:: ++ +-- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword + +-- + +*`rsa.misc.msgIdPart1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.change_old`*:: ++ +-- +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.operation_id`*:: ++ +-- +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword + +-- + +*`rsa.misc.event_state`*:: ++ +-- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword + +-- + +*`rsa.misc.group_object`*:: ++ +-- +This key captures a collection/grouping of entities. Specific usage + +type: keyword + +-- + +*`rsa.misc.node`*:: ++ +-- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword + +-- + +*`rsa.misc.rule`*:: ++ +-- +This key captures the Rule number + +type: keyword + +-- + +*`rsa.misc.device_name`*:: ++ +-- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword + +-- + +*`rsa.misc.param`*:: ++ +-- +This key is the parameters passed as part of a command or application, etc. + +type: keyword + +-- + +*`rsa.misc.change_attrib`*:: ++ +-- +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.event_computer`*:: ++ +-- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword + +-- + +*`rsa.misc.reference_id1`*:: ++ +-- +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword + +-- + +*`rsa.misc.event_log`*:: ++ +-- +This key captures the Name of the event log + +type: keyword + +-- + +*`rsa.misc.OS`*:: ++ +-- +This key captures the Name of the Operating System + +type: keyword + +-- + +*`rsa.misc.terminal`*:: ++ +-- +This key captures the Terminal Names only + +type: keyword + +-- + +*`rsa.misc.msgIdPart3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.filter`*:: ++ +-- +This key captures Filter used to reduce result set + +type: keyword + +-- + +*`rsa.misc.serial_number`*:: ++ +-- +This key is the Serial number associated with a physical asset. + +type: keyword + +-- + +*`rsa.misc.checksum`*:: ++ +-- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword + +-- + +*`rsa.misc.event_user`*:: ++ +-- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword + +-- + +*`rsa.misc.virusname`*:: ++ +-- +This key captures the name of the virus + +type: keyword + +-- + +*`rsa.misc.content_type`*:: ++ +-- +This key is used to capture Content Type only. + +type: keyword + +-- + +*`rsa.misc.group_id`*:: ++ +-- +This key captures Group ID Number (related to the group name) + +type: keyword + +-- + +*`rsa.misc.policy_id`*:: ++ +-- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword + +-- + +*`rsa.misc.vsys`*:: ++ +-- +This key captures Virtual System Name + +type: keyword + +-- + +*`rsa.misc.connection_id`*:: ++ +-- +This key captures the Connection ID + +type: keyword + +-- + +*`rsa.misc.reference_id2`*:: ++ +-- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword + +-- + +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword + +-- + +*`rsa.misc.sig_id`*:: ++ +-- +This key captures IDS/IPS Int Signature ID + +type: long + +-- + +*`rsa.misc.port_name`*:: ++ +-- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword + +-- + +*`rsa.misc.rule_group`*:: ++ +-- +This key captures the Rule group name + +type: keyword + +-- + +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value + +type: double + +-- + +*`rsa.misc.trigger_val`*:: ++ +-- +This key captures the Value of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.log_session_id1`*:: ++ +-- +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword + +-- + +*`rsa.misc.comp_version`*:: ++ +-- +This key captures the Version level of a sub-component of a product. + +type: keyword + +-- + +*`rsa.misc.content_version`*:: ++ +-- +This key captures Version level of a signature or database content. + +type: keyword + +-- + +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword + +-- + +*`rsa.misc.risk`*:: ++ +-- +This key captures the non-numeric risk value + +type: keyword + +-- + +*`rsa.misc.event_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.reason`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mail_id`*:: ++ +-- +This key is used to capture the mailbox id/name + +type: keyword + +-- + +*`rsa.misc.rule_uid`*:: ++ +-- +This key is the Unique Identifier for a rule. + +type: keyword + +-- + +*`rsa.misc.trigger_desc`*:: ++ +-- +This key captures the Description of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.inout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.data_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.error`*:: ++ +-- +This key captures All non successful Error codes or responses + +type: keyword + +-- + +*`rsa.misc.index`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.listnum`*:: ++ +-- +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword + +-- + +*`rsa.misc.ntype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.observed_val`*:: ++ +-- +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.policy_value`*:: ++ +-- +This key captures the contents of the policy. This contains details about the policy + +type: keyword + +-- + +*`rsa.misc.pool_name`*:: ++ +-- +This key captures the name of a resource pool + +type: keyword + +-- + +*`rsa.misc.rule_template`*:: ++ +-- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword + +-- + +*`rsa.misc.count`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigcat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comments`*:: ++ +-- +Comment information provided in the log message + +type: keyword + +-- + +*`rsa.misc.doc_number`*:: ++ +-- +This key captures File Identification number + +type: long + +-- + +*`rsa.misc.expected_val`*:: ++ +-- +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.job_num`*:: ++ +-- +This key captures the Job Number + +type: keyword + +-- + +*`rsa.misc.spi_dst`*:: ++ +-- +Destination SPI Index + +type: keyword + +-- + +*`rsa.misc.spi_src`*:: ++ +-- +Source SPI Index + +type: keyword + +-- + +*`rsa.misc.code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.agent_id`*:: ++ +-- +This key is used to capture agent id + +type: keyword + +-- + +*`rsa.misc.message_body`*:: ++ +-- +This key captures the The contents of the message body. + +type: keyword + +-- + +*`rsa.misc.phone`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sig_id_str`*:: ++ +-- +This key captures a string object of the sigid variable. + +type: keyword + +-- + +*`rsa.misc.cmd`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu`*:: ++ +-- +This key is the CPU time used in the execution of the event being recorded. + +type: long + +-- + +*`rsa.misc.event_desc`*:: ++ +-- +This key is used to capture a description of an event available directly or inferred + +type: keyword + +-- + +*`rsa.misc.sig_id1`*:: ++ +-- +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long + +-- + +*`rsa.misc.im_buddyid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_client`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.priority`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.context_subject`*:: ++ +-- +This key is to be used in an audit context where the subject is the object being identified + +type: keyword + +-- + +*`rsa.misc.context_target`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cve`*:: ++ +-- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword + +-- + +*`rsa.misc.fcatnum`*:: ++ +-- +This key captures Filter Category Number. Legacy Usage + +type: keyword + +-- + +*`rsa.misc.library`*:: ++ +-- +This key is used to capture library information in mainframe devices + +type: keyword + +-- + +*`rsa.misc.parent_node`*:: ++ +-- +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword + +-- + +*`rsa.misc.risk_info`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.tcp_flags`*:: ++ +-- +This key is captures the TCP flags set in any packet of session + +type: long + +-- + +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service + +type: long + +-- + +*`rsa.misc.vm_target`*:: ++ +-- +VMWare Target **VMWARE** only varaible. + +type: keyword + +-- + +*`rsa.misc.workspace`*:: ++ +-- +This key captures Workspace Description + +type: keyword + +-- + +*`rsa.misc.command`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.event_category`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facilityname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.forensic_info`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.jobname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy_waiver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.second`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.space1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.subcategory`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alert_id`*:: ++ +-- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword + +-- + +*`rsa.misc.checksum_src`*:: ++ +-- +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword + +-- + +*`rsa.misc.fresult`*:: ++ +-- +This key captures the Filter Result + +type: long + +-- + +*`rsa.misc.payload_dst`*:: ++ +-- +This key is used to capture destination payload + +type: keyword + +-- + +*`rsa.misc.payload_src`*:: ++ +-- +This key is used to capture source payload + +type: keyword + +-- + +*`rsa.misc.pool_id`*:: ++ +-- +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword + +-- + +*`rsa.misc.process_id_val`*:: ++ +-- +This key is a failure key for Process ID when it is not an integer value + +type: keyword + +-- + +*`rsa.misc.risk_num_comm`*:: ++ +-- +This key captures Risk Number Community + +type: double + +-- + +*`rsa.misc.risk_num_next`*:: ++ +-- +This key captures Risk Number NextGen + +type: double + +-- + +*`rsa.misc.risk_num_sand`*:: ++ +-- +This key captures Risk Number SandBox + +type: double + +-- + +*`rsa.misc.risk_num_static`*:: ++ +-- +This key captures Risk Number Static + +type: double + +-- + +*`rsa.misc.risk_suspicious`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.risk_warning`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.snmp_oid`*:: ++ +-- +SNMP Object Identifier + +type: keyword + +-- + +*`rsa.misc.sql`*:: ++ +-- +This key captures the SQL query + +type: keyword + +-- + +*`rsa.misc.vuln_ref`*:: ++ +-- +This key captures the Vulnerability Reference details + +type: keyword + +-- + +*`rsa.misc.acl_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_op`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_pos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_table`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.admin`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarm_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarmname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.app_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.auditdata`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.benchmark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.bypass`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache_hit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cefversion`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_attr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_obj`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_path`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.changes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client_ip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.clustermembers`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_acttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_asn_src`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_bgpv4nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ctr_dst_code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_f_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampintv`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampmode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inacttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermbyts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermpckts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_invalid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ip_proto_ver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ipv4_ident`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_l_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_did`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_rid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_max_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_maxpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_min_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_minpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_10`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_5`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_6`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_7`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_8`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_9`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_byt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_pks`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_muligmptype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampalgo`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampint`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_seqctr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_spackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sysuptime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_template_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totbytsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totflowexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totpcktsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_unixnanosecs`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6flowlabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6optheaders`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_rbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_sbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.criticality`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_agency_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_analyzedby`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_other`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_primary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_secondary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bgpv6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bit9status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_context`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_control`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_dst_tld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_dst_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_src_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_event_uuid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_filetype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ip_next_hop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4dstpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4srcpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_lifetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_log_medium`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_loginname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulescore`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulesign`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_opswatresult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_payload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrant`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrar`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_represult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_rpayload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sampler_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sourcemodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_streams`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_targetmodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_v6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_whois_server`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_yararesult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.description`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.devvendor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.distance`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.dstburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomaub`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.euid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facility`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.finterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.flags`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.gaddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.id3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_buddyname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomtype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_members`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipspri`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.latitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.linenum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.list_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.load_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_floor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_mark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.longitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.lport`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mbug_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.netsessid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.nwwn`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.operation`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.opkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.orig_from`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.owner_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_filter`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_group_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_result1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_chg`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permgranted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permwanted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.prog_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.program`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.real_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_device`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_library`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ruid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sdomain_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sec`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sensorname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.seqnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.session`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.spi`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcservice`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.state`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.svcno`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.system`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.threshold`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.udb_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.url_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.user_div`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.username_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.v_instafname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.virt_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.vpnid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.autorun_type`*:: ++ +-- +This is used to capture Auto Run type + +type: keyword + +-- + +*`rsa.misc.cc_number`*:: ++ +-- +Valid Credit Card Numbers only + +type: long + +-- + +*`rsa.misc.content`*:: ++ +-- +This key captures the content type from protocol headers + +type: keyword + +-- + +*`rsa.misc.ein_number`*:: ++ +-- +Employee Identification Numbers only + +type: long + +-- + +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match + +type: keyword + +-- + +*`rsa.misc.language`*:: ++ +-- +This is used to capture list of languages the client support and what it prefers + +type: keyword + +-- + +*`rsa.misc.lifetime`*:: ++ +-- +This key is used to capture the session lifetime in seconds. + +type: long + +-- + +*`rsa.misc.link`*:: ++ +-- +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.misc.match`*:: ++ +-- +This key is for regex match name from search.ini + +type: keyword + +-- + +*`rsa.misc.param_dst`*:: ++ +-- +This key captures the command line/launch argument of the target process or file + +type: keyword + +-- + +*`rsa.misc.param_src`*:: ++ +-- +This key captures source parameter + +type: keyword + +-- + +*`rsa.misc.search_text`*:: ++ +-- +This key captures the Search Text used + +type: keyword + +-- + +*`rsa.misc.sig_name`*:: ++ +-- +This key is used to capture the Signature Name only. + +type: keyword + +-- + +*`rsa.misc.snmp_value`*:: ++ +-- +SNMP set request value + +type: keyword + +-- + +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session + +type: long + +-- + + +*`rsa.db.index`*:: ++ +-- +This key captures IndexID of the index. + +type: keyword + +-- + +*`rsa.db.instance`*:: ++ +-- +This key is used to capture the database server instance name + +type: keyword + +-- + +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session + +type: keyword + +-- + +*`rsa.db.permissions`*:: ++ +-- +This key captures permission or privilege level assigned to a resource. + +type: keyword + +-- + +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name + +type: keyword + +-- + +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database + +type: keyword + +-- + +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server + +type: long + +-- + +*`rsa.db.lread`*:: ++ +-- +This key is used for the number of logical reads + +type: long + +-- + +*`rsa.db.lwrite`*:: ++ +-- +This key is used for the number of logical writes + +type: long + +-- + +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes + +type: long + +-- + + +*`rsa.network.alias_host`*:: ++ +-- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword + +-- + +*`rsa.network.domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_dst`*:: ++ +-- +This key should only be used when it’s a Destination Hostname + +type: keyword + +-- + +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names + +type: keyword + +-- + +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear + +type: keyword + +-- + +*`rsa.network.network_port`*:: ++ +-- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long + +-- + +*`rsa.network.eth_host`*:: ++ +-- +Deprecated, use alias.mac + +type: keyword + +-- + +*`rsa.network.sinterface`*:: ++ +-- +This key should only be used when it’s a Source Interface + +type: keyword + +-- + +*`rsa.network.dinterface`*:: ++ +-- +This key should only be used when it’s a Destination Interface + +type: keyword + +-- + +*`rsa.network.vlan`*:: ++ +-- +This key should only be used to capture the ID of the Virtual LAN + +type: long + +-- + +*`rsa.network.zone_src`*:: ++ +-- +This key should only be used when it’s a Source Zone. + +type: keyword + +-- + +*`rsa.network.zone`*:: ++ +-- +This key should be used when the source or destination context of a Zone is not clear + +type: keyword + +-- + +*`rsa.network.zone_dst`*:: ++ +-- +This key should only be used when it’s a Destination Zone. + +type: keyword + +-- + +*`rsa.network.gateway`*:: ++ +-- +This key is used to capture the IP Address of the gateway + +type: keyword + +-- + +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only + +type: long + +-- + +*`rsa.network.mask`*:: ++ +-- +This key is used to capture the device network IPmask. + +type: keyword + +-- + +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only + +type: long + +-- + +*`rsa.network.protocol_detail`*:: ++ +-- +This key should be used to capture additional protocol information + +type: keyword + +-- + +*`rsa.network.dmask`*:: ++ +-- +This key is used for Destionation Device network mask + +type: keyword + +-- + +*`rsa.network.port`*:: ++ +-- +This key should only be used to capture a Network Port when the directionality is not clear + +type: long + +-- + +*`rsa.network.smask`*:: ++ +-- +This key is used for capturing source Network Mask + +type: keyword + +-- + +*`rsa.network.netname`*:: ++ +-- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword + +-- + +*`rsa.network.paddr`*:: ++ +-- +Deprecated + +type: ip + +-- + +*`rsa.network.faddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.lhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.origin`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.addr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_ptr_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fport`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.laddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.linterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.phost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.ad_computer_dst`*:: ++ +-- +Deprecated, use host.dst + +type: keyword + +-- + +*`rsa.network.eth_type`*:: ++ +-- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long + +-- + +*`rsa.network.ip_proto`*:: ++ +-- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long + +-- + +*`rsa.network.dns_cname_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_opcode`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_resp`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.domain1`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.packet_length`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_orig`*:: ++ +-- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword + +-- + +*`rsa.network.rpayload`*:: ++ +-- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword + +-- + +*`rsa.network.vlan_name`*:: ++ +-- +This key should only be used to capture the name of the Virtual LAN + +type: keyword + +-- + + +*`rsa.investigations.ec_activity`*:: ++ +-- +This key captures the particular event activity(Ex:Logoff) + +type: keyword + +-- + +*`rsa.investigations.ec_theme`*:: ++ +-- +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword + +-- + +*`rsa.investigations.ec_subject`*:: ++ +-- +This key captures the Subject of a particular Event(Ex:User) + +type: keyword + +-- + +*`rsa.investigations.ec_outcome`*:: ++ +-- +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword + +-- + +*`rsa.investigations.event_cat`*:: ++ +-- +This key captures the Event category number + +type: long + +-- + +*`rsa.investigations.event_cat_name`*:: ++ +-- +This key captures the event category name corresponding to the event cat code + +type: keyword + +-- + +*`rsa.investigations.event_vcat`*:: ++ +-- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword + +-- + +*`rsa.investigations.analysis_file`*:: ++ +-- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + +type: keyword + +-- + +*`rsa.investigations.analysis_service`*:: ++ +-- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword + +-- + +*`rsa.investigations.analysis_session`*:: ++ +-- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword + +-- + +*`rsa.investigations.boc`*:: ++ +-- +This is used to capture behaviour of compromise + +type: keyword + +-- + +*`rsa.investigations.eoc`*:: ++ +-- +This is used to capture Enablers of Compromise + +type: keyword + +-- + +*`rsa.investigations.inv_category`*:: ++ +-- +This used to capture investigation category + +type: keyword + +-- + +*`rsa.investigations.inv_context`*:: ++ +-- +This used to capture investigation context + +type: keyword + +-- + +*`rsa.investigations.ioc`*:: ++ +-- +This is key capture indicator of compromise + +type: keyword + +-- + + +*`rsa.counters.dclass_c1`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long + +-- + +*`rsa.counters.dclass_c2`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long + +-- + +*`rsa.counters.event_counter`*:: ++ +-- +This is used to capture the number of times an event repeated + +type: long + +-- + +*`rsa.counters.dclass_r1`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long + +-- + +*`rsa.counters.dclass_c1_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword + +-- + +*`rsa.counters.dclass_c2_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r1_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword + +-- + +*`rsa.counters.dclass_r2`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword + +-- + +*`rsa.counters.dclass_r2_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword + +-- + + +*`rsa.identity.auth_method`*:: ++ +-- +This key is used to capture authentication methods used only + +type: keyword + +-- + +*`rsa.identity.user_role`*:: ++ +-- +This key is used to capture the Role of a user only + +type: keyword + +-- + +*`rsa.identity.dn`*:: ++ +-- +X.500 (LDAP) Distinguished Name + +type: keyword + +-- + +*`rsa.identity.logon_type`*:: ++ +-- +This key is used to capture the type of logon method used. + +type: keyword + +-- + +*`rsa.identity.profile`*:: ++ +-- +This key is used to capture the user profile + +type: keyword + +-- + +*`rsa.identity.accesses`*:: ++ +-- +This key is used to capture actual privileges used in accessing an object + +type: keyword + +-- + +*`rsa.identity.realm`*:: ++ +-- +Radius realm or similar grouping of accounts + +type: keyword + +-- + +*`rsa.identity.user_sid_dst`*:: ++ +-- +This key captures Destination User Session ID + +type: keyword + +-- + +*`rsa.identity.dn_src`*:: ++ +-- +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword + +-- + +*`rsa.identity.org`*:: ++ +-- +This key captures the User organization + +type: keyword + +-- + +*`rsa.identity.dn_dst`*:: ++ +-- +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn + +type: keyword + +-- + +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.lastname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.user_dept`*:: ++ +-- +User's Department Names only + +type: keyword + +-- + +*`rsa.identity.user_sid_src`*:: ++ +-- +This key captures Source User Session ID + +type: keyword + +-- + +*`rsa.identity.federated_sp`*:: ++ +-- +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword + +-- + +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword + +-- + +*`rsa.identity.logon_type_desc`*:: ++ +-- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. + +type: keyword + +-- + +*`rsa.identity.middlename`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.password`*:: ++ +-- +This key is for Passwords seen in any session, plain text or encrypted + +type: keyword + +-- + +*`rsa.identity.host_role`*:: ++ +-- +This key should only be used to capture the role of a Host Machine + +type: keyword + +-- + +*`rsa.identity.ldap`*:: ++ +-- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + +type: keyword + +-- + +*`rsa.identity.ldap_query`*:: ++ +-- +This key is the Search criteria from an LDAP search + +type: keyword + +-- + +*`rsa.identity.ldap_response`*:: ++ +-- +This key is to capture Results from an LDAP search + +type: keyword + +-- + +*`rsa.identity.owner`*:: ++ +-- +This is used to capture username the process or service is running as, the author of the task + +type: keyword + +-- + +*`rsa.identity.service_account`*:: ++ +-- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage + +type: keyword + +-- + + +*`rsa.email.email_dst`*:: ++ +-- +This key is used to capture the Destination email address only, when the destination context is not clear use email + +type: keyword + +-- + +*`rsa.email.email_src`*:: ++ +-- +This key is used to capture the source email address only, when the source context is not clear use email + +type: keyword + +-- + +*`rsa.email.subject`*:: ++ +-- +This key is used to capture the subject string from an Email only. + +type: keyword + +-- + +*`rsa.email.email`*:: ++ +-- +This key is used to capture a generic email address where the source or destination context is not clear + +type: keyword + +-- + +*`rsa.email.trans_from`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + + +*`rsa.file.privilege`*:: ++ +-- +Deprecated, use permissions + +type: keyword + +-- + +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword + +-- + +*`rsa.file.filesystem`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.file.filename_dst`*:: ++ +-- +This is used to capture name of the file targeted by the action + +type: keyword + +-- + +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action + +type: keyword + +-- + +*`rsa.file.filename_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file + +type: keyword + +-- + +*`rsa.file.directory_src`*:: ++ +-- +This key is used to capture the directory of the source process or file + +type: keyword + +-- + +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double + +-- + +*`rsa.file.file_vendor`*:: ++ +-- +This is used to capture Company name of file located in version_info + +type: keyword + +-- + +*`rsa.file.task_name`*:: ++ +-- +This is used to capture name of the task + +type: keyword + +-- + + +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names + +type: keyword + +-- + +*`rsa.web.web_cookie`*:: ++ +-- +This key is used to capture the Web cookies specifically. + +type: keyword + +-- + +*`rsa.web.alias_host`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double + +-- + +*`rsa.web.web_ref_domain`*:: ++ +-- +Web referer's domain + +type: keyword + +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword + +-- + +*`rsa.web.remote_domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword + +-- + +*`rsa.web.web_ref_root`*:: ++ +-- +Web referer's root URL path + +type: keyword + +-- + +*`rsa.web.cn_asn_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlpage`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlroot`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_url`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_page`*:: ++ +-- +type: keyword + +-- + + +*`rsa.threat.threat_category`*:: ++ +-- +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: ++ +-- +This key is used to capture the threat description from the session directly or inferred + +type: keyword + +-- + +*`rsa.threat.alert`*:: ++ +-- +This key is used to capture name of the alert + +type: keyword + +-- + +*`rsa.threat.threat_source`*:: ++ +-- +This key is used to capture source of the threat + +type: keyword + +-- + + +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword + +-- + +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- + +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size + +type: long + +-- + +*`rsa.crypto.ike`*:: ++ +-- +IKE negotiation phase. + +type: keyword + +-- + +*`rsa.crypto.scheme`*:: ++ +-- +This key captures the Encryption scheme used + +type: keyword + +-- + +*`rsa.crypto.peer_id`*:: ++ +-- +This key is for Encryption peer’s identity + +type: keyword + +-- + +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type + +type: keyword + +-- + +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String + +type: keyword + +-- + +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher + +type: keyword + +-- + +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size + +type: long + +-- + +*`rsa.crypto.ssl_ver_src`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.d_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One + +type: keyword + +-- + +*`rsa.crypto.ike_cookie2`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase Two + +type: keyword + +-- + +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_cat`*:: ++ +-- +This key is used for the hostname category value of a certificate + +type: keyword + +-- + +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only + +type: keyword + +-- + +*`rsa.crypto.cert_status`*:: ++ +-- +This key captures Certificate validation status + +type: keyword + +-- + +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.cert_keysize`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_insact`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only + +type: keyword + +-- + +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword + +-- + + +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session + +type: keyword + +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword + +-- + +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names + +type: long + +-- + +*`rsa.wireless.wlan_name`*:: ++ +-- +This key captures either WLAN number/name + +type: keyword + +-- + + +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk + +type: keyword + +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. + +type: keyword + +-- + +*`rsa.storage.pwwn`*:: ++ +-- +This uniquely identifies a port on a HBA. + +type: keyword + +-- + + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + + +*`rsa.healthcare.patient_fname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient + +type: keyword + +-- + +*`rsa.healthcare.patient_lname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_mname`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: ++ +-- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + +type: keyword + +-- + +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key + +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: ++ +-- +This key captures values or decorators used within a registry entry + +type: keyword + +-- + +[[exported-fields-misp]] +== MISP fields + +Module for handling threat information from MISP. + + + +[float] +=== misp + +Fields from MISP threat information. + + + +[float] +=== attack_pattern + +Fields provide support for specifying information about attack patterns. + + + +*`misp.attack_pattern.id`*:: ++ +-- +Identifier of the threat indicator. + + +type: keyword + +-- + +*`misp.attack_pattern.name`*:: ++ +-- +Name of the attack pattern. + + +type: keyword + +-- + +*`misp.attack_pattern.description`*:: ++ +-- +Description of the attack pattern. + + +type: text + +-- + +*`misp.attack_pattern.kill_chain_phases`*:: ++ +-- +The kill chain phase(s) to which this attack pattern corresponds. + + +type: keyword + +-- + +[float] +=== campaign + +Fields provide support for specifying information about campaigns. + + + +*`misp.campaign.id`*:: ++ +-- +Identifier of the campaign. + + +type: keyword + +-- + +*`misp.campaign.name`*:: ++ +-- +Name of the campaign. + + +type: keyword + +-- + +*`misp.campaign.description`*:: ++ +-- +Description of the campaign. + + +type: text + +-- + +*`misp.campaign.aliases`*:: ++ +-- +Alternative names used to identify this campaign. + + +type: text + +-- + +*`misp.campaign.first_seen`*:: ++ +-- +The time that this Campaign was first seen, in RFC3339 format. + + +type: date + +-- + +*`misp.campaign.last_seen`*:: ++ +-- +The time that this Campaign was last seen, in RFC3339 format. + + +type: date + +-- + +*`misp.campaign.objective`*:: ++ +-- +This field defines the Campaign's primary goal, objective, desired outcome, or intended effect. + + +type: keyword + +-- + +[float] +=== course_of_action + +A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress. + + + +*`misp.course_of_action.id`*:: ++ +-- +Identifier of the Course of Action. + + +type: keyword + +-- + +*`misp.course_of_action.name`*:: ++ +-- +The name used to identify the Course of Action. + + +type: keyword + +-- + +*`misp.course_of_action.description`*:: ++ +-- +Description of the Course of Action. + + +type: text + +-- + +[float] +=== identity + +Identity can represent actual individuals, organizations, or groups, as well as classes of individuals, organizations, or groups. + + + +*`misp.identity.id`*:: ++ +-- +Identifier of the Identity. + + +type: keyword + +-- + +*`misp.identity.name`*:: ++ +-- +The name used to identify the Identity. + + +type: keyword + +-- + +*`misp.identity.description`*:: ++ +-- +Description of the Identity. + + +type: text + +-- + +*`misp.identity.identity_class`*:: ++ +-- +The type of entity that this Identity describes, e.g., an individual or organization. Open Vocab - identity-class-ov + + +type: keyword + +-- + +*`misp.identity.labels`*:: ++ +-- +The list of roles that this Identity performs. + + +type: keyword + +example: CEO + + +-- + +*`misp.identity.sectors`*:: ++ +-- +The list of sectors that this Identity belongs to. Open Vocab - industry-sector-ov + + +type: keyword + +-- + +*`misp.identity.contact_information`*:: ++ +-- +The contact information (e-mail, phone number, etc.) for this Identity. + + +type: text + +-- + +[float] +=== intrusion_set + +An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization. + + + +*`misp.intrusion_set.id`*:: ++ +-- +Identifier of the Intrusion Set. + + +type: keyword + +-- + +*`misp.intrusion_set.name`*:: ++ +-- +The name used to identify the Intrusion Set. + + +type: keyword + +-- + +*`misp.intrusion_set.description`*:: ++ +-- +Description of the Intrusion Set. + + +type: text + +-- + +*`misp.intrusion_set.aliases`*:: ++ +-- +Alternative names used to identify the Intrusion Set. + + +type: text + +-- + +*`misp.intrusion_set.first_seen`*:: ++ +-- +The time that this Intrusion Set was first seen, in RFC3339 format. + + +type: date + +-- + +*`misp.intrusion_set.last_seen`*:: ++ +-- +The time that this Intrusion Set was last seen, in RFC3339 format. + + +type: date + +-- + +*`misp.intrusion_set.goals`*:: ++ +-- +The high level goals of this Intrusion Set, namely, what are they trying to do. + + +type: text + +-- + +*`misp.intrusion_set.resource_level`*:: ++ +-- +This defines the organizational level at which this Intrusion Set typically works. Open Vocab - attack-resource-level-ov + + +type: text + +-- + +*`misp.intrusion_set.primary_motivation`*:: ++ +-- +The primary reason, motivation, or purpose behind this Intrusion Set. Open Vocab - attack-motivation-ov + + +type: text + +-- + +*`misp.intrusion_set.secondary_motivations`*:: ++ +-- +The secondary reasons, motivations, or purposes behind this Intrusion Set. Open Vocab - attack-motivation-ov + + +type: text + +-- + +[float] +=== malware + +Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim. + + + +*`misp.malware.id`*:: ++ +-- +Identifier of the Malware. + + +type: keyword + +-- + +*`misp.malware.name`*:: ++ +-- +The name used to identify the Malware. + + +type: keyword + +-- + +*`misp.malware.description`*:: ++ +-- +Description of the Malware. + + +type: text + +-- + +*`misp.malware.labels`*:: ++ +-- +The type of malware being described. Open Vocab - malware-label-ov. adware,backdoor,bot,ddos,dropper,exploit-kit,keylogger,ransomware, remote-access-trojan,resource-exploitation,rogue-security-software,rootkit, screen-capture,spyware,trojan,virus,worm + + +type: keyword + +-- + +*`misp.malware.kill_chain_phases`*:: ++ +-- +The list of kill chain phases for which this Malware instance can be used. + + +type: keyword + +format: string + +-- + +[float] +=== note + +A Note is a comment or note containing informative text to help explain the context of one or more STIX Objects (SDOs or SROs) or to provide additional analysis that is not contained in the original object. + + + +*`misp.note.id`*:: ++ +-- +Identifier of the Note. + + +type: keyword + +-- + +*`misp.note.summary`*:: ++ +-- +A brief description used as a summary of the Note. + + +type: keyword + +-- + +*`misp.note.description`*:: ++ +-- +The content of the Note. + + +type: text + +-- + +*`misp.note.authors`*:: ++ +-- +The name of the author(s) of this Note. + + +type: keyword + +-- + +*`misp.note.object_refs`*:: ++ +-- +The STIX Objects (SDOs and SROs) that the note is being applied to. + + +type: keyword + +-- + +[float] +=== threat_indicator + +Fields provide support for specifying information about threat indicators, and related matching patterns. + + + +*`misp.threat_indicator.labels`*:: ++ +-- +list of type open-vocab that specifies the type of indicator. + + +type: keyword + +example: Domain Watchlist + + +-- + +*`misp.threat_indicator.id`*:: ++ +-- +Identifier of the threat indicator. + + +type: keyword + +-- + +*`misp.threat_indicator.version`*:: ++ +-- +Version of the threat indicator. + + +type: keyword + +-- + +*`misp.threat_indicator.type`*:: ++ +-- +Type of the threat indicator. + + +type: keyword + +-- + +*`misp.threat_indicator.description`*:: ++ +-- +Description of the threat indicator. + + +type: text + +-- + +*`misp.threat_indicator.feed`*:: ++ +-- +Name of the threat feed. + + +type: text + +-- + +*`misp.threat_indicator.valid_from`*:: ++ +-- +The time from which this Indicator should be considered valuable intelligence, in RFC3339 format. + + +type: date + +-- + +*`misp.threat_indicator.valid_until`*:: ++ +-- +The time at which this Indicator should no longer be considered valuable intelligence. If the valid_until property is omitted, then there is no constraint on the latest time for which the indicator should be used, in RFC3339 format. + + +type: date + +-- + +*`misp.threat_indicator.severity`*:: ++ +-- +Threat severity to which this indicator corresponds. + + +type: keyword + +example: high + +format: string + +-- + +*`misp.threat_indicator.confidence`*:: ++ +-- +Confidence level to which this indicator corresponds. + + +type: keyword + +example: high + +-- + +*`misp.threat_indicator.kill_chain_phases`*:: ++ +-- +The kill chain phase(s) to which this indicator corresponds. + + +type: keyword + +format: string + +-- + +*`misp.threat_indicator.mitre_tactic`*:: ++ +-- +MITRE tactics to which this indicator corresponds. + + +type: keyword + +example: Initial Access + +format: string + +-- + +*`misp.threat_indicator.mitre_technique`*:: ++ +-- +MITRE techniques to which this indicator corresponds. + + +type: keyword + +example: Drive-by Compromise + +format: string + +-- + +*`misp.threat_indicator.attack_pattern`*:: ++ +-- +The attack_pattern for this indicator is a STIX Pattern as specified in STIX Version 2.0 Part 5 - STIX Patterning. + + +type: keyword + +example: [destination:ip = '91.219.29.188/32'] + + +-- + +*`misp.threat_indicator.attack_pattern_kql`*:: ++ +-- +The attack_pattern for this indicator is KQL query that matches the attack_pattern specified in the STIX Pattern format. + + +type: keyword + +example: destination.ip: "91.219.29.188/32" + + +-- + +*`misp.threat_indicator.negate`*:: ++ +-- +When set to true, it specifies the absence of the attack_pattern. + + +type: boolean + +-- + +*`misp.threat_indicator.intrusion_set`*:: ++ +-- +Name of the intrusion set if known. + + +type: keyword + +-- + +*`misp.threat_indicator.campaign`*:: ++ +-- +Name of the attack campaign if known. + + +type: keyword + +-- + +*`misp.threat_indicator.threat_actor`*:: ++ +-- +Name of the threat actor if known. + + +type: keyword + +-- + +[float] +=== observed_data + +Observed data conveys information that was observed on systems and networks, such as log data or network traffic, using the Cyber Observable specification. + + + +*`misp.observed_data.id`*:: ++ +-- +Identifier of the Observed Data. + + +type: keyword + +-- + +*`misp.observed_data.first_observed`*:: ++ +-- +The beginning of the time window that the data was observed, in RFC3339 format. + + +type: date + +-- + +*`misp.observed_data.last_observed`*:: ++ +-- +The end of the time window that the data was observed, in RFC3339 format. + + +type: date + +-- + +*`misp.observed_data.number_observed`*:: ++ +-- +The number of times the data represented in the objects property was observed. This MUST be an integer between 1 and 999,999,999 inclusive. + + +type: integer + +-- + +*`misp.observed_data.objects`*:: ++ +-- +A dictionary of Cyber Observable Objects that describes the single fact that was observed. + + +type: keyword + +-- + +[float] +=== report + +Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. + + + +*`misp.report.id`*:: ++ +-- +Identifier of the Report. + + +type: keyword + +-- + +*`misp.report.labels`*:: ++ +-- +This field is an Open Vocabulary that specifies the primary subject of this report. Open Vocab - report-label-ov. threat-report,attack-pattern,campaign,identity,indicator,malware,observed-data,threat-actor,tool,vulnerability + + +type: keyword + +-- + +*`misp.report.name`*:: ++ +-- +The name used to identify the Report. + + +type: keyword + +-- + +*`misp.report.description`*:: ++ +-- +A description that provides more details and context about Report. + + +type: text + +-- + +*`misp.report.published`*:: ++ +-- +The date that this report object was officially published by the creator of this report, in RFC3339 format. + + +type: date + +-- + +*`misp.report.object_refs`*:: ++ +-- +Specifies the STIX Objects that are referred to by this Report. + + +type: text + +-- + +[float] +=== threat_actor + +Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent. + + + +*`misp.threat_actor.id`*:: ++ +-- +Identifier of the Threat Actor. + + +type: keyword + +-- + +*`misp.threat_actor.labels`*:: ++ +-- +This field specifies the type of threat actor. Open Vocab - threat-actor-label-ov. activist,competitor,crime-syndicate,criminal,hacker,insider-accidental,insider-disgruntled,nation-state,sensationalist,spy,terrorist + + +type: keyword + +-- + +*`misp.threat_actor.name`*:: ++ +-- +The name used to identify this Threat Actor or Threat Actor group. + + +type: keyword + +-- + +*`misp.threat_actor.description`*:: ++ +-- +A description that provides more details and context about the Threat Actor. + + +type: text + +-- + +*`misp.threat_actor.aliases`*:: ++ +-- +A list of other names that this Threat Actor is believed to use. + + +type: text + +-- + +*`misp.threat_actor.roles`*:: ++ +-- +This is a list of roles the Threat Actor plays. Open Vocab - threat-actor-role-ov. agent,director,independent,sponsor,infrastructure-operator,infrastructure-architect,malware-author + + +type: text + +-- + +*`misp.threat_actor.goals`*:: ++ +-- +The high level goals of this Threat Actor, namely, what are they trying to do. + + +type: text + +-- + +*`misp.threat_actor.sophistication`*:: ++ +-- +The skill, specific knowledge, special training, or expertise a Threat Actor must have to perform the attack. Open Vocab - threat-actor-sophistication-ov. none,minimal,intermediate,advanced,strategic,expert,innovator + + +type: text + +-- + +*`misp.threat_actor.resource_level`*:: ++ +-- +This defines the organizational level at which this Threat Actor typically works. Open Vocab - attack-resource-level-ov. individual,club,contest,team,organization,government + + +type: text + +-- + +*`misp.threat_actor.primary_motivation`*:: ++ +-- +The primary reason, motivation, or purpose behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable + + +type: text + +-- + +*`misp.threat_actor.secondary_motivations`*:: ++ +-- +The secondary reasons, motivations, or purposes behind this Threat Actor. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable + + +type: text + +-- + +*`misp.threat_actor.personal_motivations`*:: ++ +-- +The personal reasons, motivations, or purposes of the Threat Actor regardless of organizational goals. Open Vocab - attack-motivation-ov. accidental,coercion,dominance,ideology,notoriety,organizational-gain,personal-gain,personal-satisfaction,revenge,unpredictable + + +type: text + +-- + +[float] +=== tool + +Tools are legitimate software that can be used by threat actors to perform attacks. + + + +*`misp.tool.id`*:: ++ +-- +Identifier of the Tool. + + +type: keyword + +-- + +*`misp.tool.labels`*:: ++ +-- +The kind(s) of tool(s) being described. Open Vocab - tool-label-ov. denial-of-service,exploitation,information-gathering,network-capture,credential-exploitation,remote-access,vulnerability-scanning + + +type: keyword + +-- + +*`misp.tool.name`*:: ++ +-- +The name used to identify the Tool. + + +type: keyword + +-- + +*`misp.tool.description`*:: ++ +-- +A description that provides more details and context about the Tool. + + +type: text + +-- + +*`misp.tool.tool_version`*:: ++ +-- +The version identifier associated with the Tool. + + +type: keyword + +-- + +*`misp.tool.kill_chain_phases`*:: ++ +-- +The list of kill chain phases for which this Tool instance can be used. + + +type: text + +-- + +[float] +=== vulnerability + +A Vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network. + + + +*`misp.vulnerability.id`*:: ++ +-- +Identifier of the Vulnerability. + + +type: keyword + +-- + +*`misp.vulnerability.name`*:: ++ +-- +The name used to identify the Vulnerability. + + +type: keyword + +-- + +*`misp.vulnerability.description`*:: ++ +-- +A description that provides more details and context about the Vulnerability. + + +type: text + +-- + +[[exported-fields-mongodb]] +== mongodb fields + +Module for parsing MongoDB log files. + + + +[float] +=== mongodb + +Fields from MongoDB logs. + + + +[float] +=== log + +Contains fields from MongoDB logs. + + + +*`mongodb.log.component`*:: ++ +-- +Functional categorization of message + + +type: keyword + +example: COMMAND + +-- + +*`mongodb.log.context`*:: ++ +-- +Context of message + + +type: keyword + +example: initandlisten + +-- + +*`mongodb.log.severity`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`mongodb.log.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +[[exported-fields-mssql]] +== mssql fields + +MS SQL Filebeat Module + + +[float] +=== mssql + +Fields from the MSSQL log files + + +[float] +=== log + +Common log fields + + +*`mssql.log.origin`*:: ++ +-- +Origin of the message, usually the server but it can also be a recovery process + +type: keyword + +-- + +[[exported-fields-mysql]] +== MySQL fields + +Module for parsing the MySQL log files. + + + +[float] +=== mysql + +Fields from the MySQL log files. + + + +*`mysql.thread_id`*:: ++ +-- +The connection or thread ID for the query. + + +type: long + +-- + +[float] +=== error + +Contains fields from the MySQL error logs. + + + +*`mysql.error.thread_id`*:: ++ +-- +type: alias + +alias to: mysql.thread_id + +-- + +*`mysql.error.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`mysql.error.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +[float] +=== slowlog + +Contains fields from the MySQL slow logs. + + + +*`mysql.slowlog.lock_time.sec`*:: ++ +-- +The amount of time the query waited for the lock to be available. The value is in seconds, as a floating point number. + + +type: float + +-- + +*`mysql.slowlog.rows_sent`*:: ++ +-- +The number of rows returned by the query. + + +type: long + +-- + +*`mysql.slowlog.rows_examined`*:: ++ +-- +The number of rows scanned by the query. + + +type: long + +-- + +*`mysql.slowlog.rows_affected`*:: ++ +-- +The number of rows modified by the query. + + +type: long + +-- + +*`mysql.slowlog.bytes_sent`*:: ++ +-- +The number of bytes sent to client. + + +type: long + +format: bytes + +-- + +*`mysql.slowlog.bytes_received`*:: ++ +-- +The number of bytes received from client. + + +type: long + +format: bytes + +-- + +*`mysql.slowlog.query`*:: ++ +-- +The slow query. + + +-- + +*`mysql.slowlog.id`*:: ++ +-- +type: alias + +alias to: mysql.thread_id + +-- + +*`mysql.slowlog.schema`*:: ++ +-- +The schema where the slow query was executed. + + +type: keyword + +-- + +*`mysql.slowlog.current_user`*:: ++ +-- +Current authenticated user, used to determine access privileges. Can differ from the value for user. + + +type: keyword + +-- + +*`mysql.slowlog.last_errno`*:: ++ +-- +Last SQL error seen. + + +type: keyword + +-- + +*`mysql.slowlog.killed`*:: ++ +-- +Code of the reason if the query was killed. + + +type: keyword + +-- + +*`mysql.slowlog.query_cache_hit`*:: ++ +-- +Whether the query cache was hit. + + +type: boolean + +-- + +*`mysql.slowlog.tmp_table`*:: ++ +-- +Whether a temporary table was used to resolve the query. + + +type: boolean + +-- + +*`mysql.slowlog.tmp_table_on_disk`*:: ++ +-- +Whether the query needed temporary tables on disk. + + +type: boolean + +-- + +*`mysql.slowlog.tmp_tables`*:: ++ +-- +Number of temporary tables created for this query + + +type: long + +-- + +*`mysql.slowlog.tmp_disk_tables`*:: ++ +-- +Number of temporary tables created on disk for this query. + + +type: long + +-- + +*`mysql.slowlog.tmp_table_sizes`*:: ++ +-- +Size of temporary tables created for this query. + +type: long + +format: bytes + +-- + +*`mysql.slowlog.filesort`*:: ++ +-- +Whether filesort optimization was used. + + +type: boolean + +-- + +*`mysql.slowlog.filesort_on_disk`*:: ++ +-- +Whether filesort optimization was used and it needed temporary tables on disk. + + +type: boolean + +-- + +*`mysql.slowlog.priority_queue`*:: ++ +-- +Whether a priority queue was used for filesort. + + +type: boolean + +-- + +*`mysql.slowlog.full_scan`*:: ++ +-- +Whether a full table scan was needed for the slow query. + + +type: boolean + +-- + +*`mysql.slowlog.full_join`*:: ++ +-- +Whether a full join was needed for the slow query (no indexes were used for joins). + + +type: boolean + +-- + +*`mysql.slowlog.merge_passes`*:: ++ +-- +Number of merge passes executed for the query. + + +type: long + +-- + +*`mysql.slowlog.sort_merge_passes`*:: ++ +-- +Number of merge passes that the sort algorithm has had to do. + + +type: long + +-- + +*`mysql.slowlog.sort_range_count`*:: ++ +-- +Number of sorts that were done using ranges. + + +type: long + +-- + +*`mysql.slowlog.sort_rows`*:: ++ +-- +Number of sorted rows. + + +type: long + +-- + +*`mysql.slowlog.sort_scan_count`*:: ++ +-- +Number of sorts that were done by scanning the table. + + +type: long + +-- + +*`mysql.slowlog.log_slow_rate_type`*:: ++ +-- +Type of slow log rate limit, it can be `session` if the rate limit is applied per session, or `query` if it applies per query. + + +type: keyword + +-- + +*`mysql.slowlog.log_slow_rate_limit`*:: ++ +-- +Slow log rate limit, a value of 100 means that one in a hundred queries or sessions are being logged. + + +type: keyword + +-- + +*`mysql.slowlog.read_first`*:: ++ +-- +The number of times the first entry in an index was read. + + +type: long + +-- + +*`mysql.slowlog.read_last`*:: ++ +-- +The number of times the last key in an index was read. + + +type: long + +-- + +*`mysql.slowlog.read_key`*:: ++ +-- +The number of requests to read a row based on a key. + + +type: long + +-- + +*`mysql.slowlog.read_next`*:: ++ +-- +The number of requests to read the next row in key order. + + +type: long + +-- + +*`mysql.slowlog.read_prev`*:: ++ +-- +The number of requests to read the previous row in key order. + + +type: long + +-- + +*`mysql.slowlog.read_rnd`*:: ++ +-- +The number of requests to read a row based on a fixed position. + + +type: long + +-- + +*`mysql.slowlog.read_rnd_next`*:: ++ +-- +The number of requests to read the next row in the data file. + + +type: long + +-- + +[float] +=== innodb + +Contains fields relative to InnoDB engine + + + +*`mysql.slowlog.innodb.trx_id`*:: ++ +-- +Transaction ID + + +type: keyword + +-- + +*`mysql.slowlog.innodb.io_r_ops`*:: ++ +-- +Number of page read operations. + + +type: long + +-- + +*`mysql.slowlog.innodb.io_r_bytes`*:: ++ +-- +Bytes read during page read operations. + + +type: long + +format: bytes + +-- + +*`mysql.slowlog.innodb.io_r_wait.sec`*:: ++ +-- +How long it took to read all needed data from storage. + + +type: long + +-- + +*`mysql.slowlog.innodb.rec_lock_wait.sec`*:: ++ +-- +How long the query waited for locks. + + +type: long + +-- + +*`mysql.slowlog.innodb.queue_wait.sec`*:: ++ +-- +How long the query waited to enter the InnoDB queue and to be executed once in the queue. + + +type: long + +-- + +*`mysql.slowlog.innodb.pages_distinct`*:: ++ +-- +Approximated count of pages accessed to execute the query. + + +type: long + +-- + +*`mysql.slowlog.user`*:: ++ +-- +type: alias + +alias to: user.name + +-- + +*`mysql.slowlog.host`*:: ++ +-- +type: alias + +alias to: source.domain + +-- + +*`mysql.slowlog.ip`*:: ++ +-- +type: alias + +alias to: source.ip + +-- + +[[exported-fields-nats]] +== NATS fields + +Module for parsing NATS log files. + + + +[float] +=== nats + +Fields from NATS logs. + + + +[float] +=== log + +Nats log files + + + +[float] +=== client + +Fields from NATS logs client. + + + +*`nats.log.client.id`*:: ++ +-- +The id of the client + + +type: integer + +-- + +[float] +=== msg + +Fields from NATS logs message. + + + +*`nats.log.msg.bytes`*:: ++ +-- +Size of the payload in bytes + + +type: long + +format: bytes + +-- + +*`nats.log.msg.type`*:: ++ +-- +The protocol message type + + +type: keyword + +-- + +*`nats.log.msg.subject`*:: ++ +-- +Subject name this message was received on + + +type: keyword + +-- + +*`nats.log.msg.sid`*:: ++ +-- +The unique alphanumeric subscription ID of the subject + + +type: integer + +-- + +*`nats.log.msg.reply_to`*:: ++ +-- +The inbox subject on which the publisher is listening for responses + + +type: keyword + +-- + +*`nats.log.msg.max_messages`*:: ++ +-- +An optional number of messages to wait for before automatically unsubscribing + + +type: integer + +-- + +*`nats.log.msg.error.message`*:: ++ +-- +Details about the error occurred + + +type: text + +-- + +*`nats.log.msg.queue_group`*:: ++ +-- +The queue group which subscriber will join + + +type: text + +-- + +[[exported-fields-netflow]] +== NetFlow fields + +Fields from NetFlow and IPFIX flows. + + + +[float] +=== netflow + +Fields from NetFlow and IPFIX. + + + +*`netflow.type`*:: ++ +-- +The type of NetFlow record described by this event. + + +type: keyword + +-- + +[float] +=== exporter + +Metadata related to the exporter device that generated this record. + + + +*`netflow.exporter.address`*:: ++ +-- +Exporter's network address in IP:port format. + + +type: keyword + +-- + +*`netflow.exporter.source_id`*:: ++ +-- +Observation domain ID to which this record belongs. + + +type: long + +-- + +*`netflow.exporter.timestamp`*:: ++ +-- +Time and date of export. + + +type: date + +-- + +*`netflow.exporter.uptime_millis`*:: ++ +-- +How long the exporter process has been running, in milliseconds. + + +type: long + +-- + +*`netflow.exporter.version`*:: ++ +-- +NetFlow version used. + + +type: integer + +-- + +*`netflow.octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.delta_flow_count`*:: ++ +-- +type: long + +-- + +*`netflow.protocol_identifier`*:: ++ +-- +type: short + +-- + +*`netflow.ip_class_of_service`*:: ++ +-- +type: short + +-- + +*`netflow.tcp_control_bits`*:: ++ +-- +type: integer + +-- + +*`netflow.source_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.source_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.source_ipv4_prefix_length`*:: ++ +-- +type: short + +-- + +*`netflow.ingress_interface`*:: ++ +-- +type: long + +-- + +*`netflow.destination_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.destination_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.destination_ipv4_prefix_length`*:: ++ +-- +type: short + +-- + +*`netflow.egress_interface`*:: ++ +-- +type: long + +-- + +*`netflow.ip_next_hop_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.bgp_source_as_number`*:: ++ +-- +type: long + +-- + +*`netflow.bgp_destination_as_number`*:: ++ +-- +type: long + +-- + +*`netflow.bgp_next_hop_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.post_mcast_packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_mcast_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.flow_end_sys_up_time`*:: ++ +-- +type: long + +-- + +*`netflow.flow_start_sys_up_time`*:: ++ +-- +type: long + +-- + +*`netflow.post_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.minimum_ip_total_length`*:: ++ +-- +type: long + +-- + +*`netflow.maximum_ip_total_length`*:: ++ +-- +type: long + +-- + +*`netflow.source_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.destination_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.source_ipv6_prefix_length`*:: ++ +-- +type: short + +-- + +*`netflow.destination_ipv6_prefix_length`*:: ++ +-- +type: short + +-- + +*`netflow.flow_label_ipv6`*:: ++ +-- +type: long + +-- + +*`netflow.icmp_type_code_ipv4`*:: ++ +-- +type: integer + +-- + +*`netflow.igmp_type`*:: ++ +-- +type: short + +-- + +*`netflow.sampling_interval`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_algorithm`*:: ++ +-- +type: short + +-- + +*`netflow.flow_active_timeout`*:: ++ +-- +type: integer + +-- + +*`netflow.flow_idle_timeout`*:: ++ +-- +type: integer + +-- + +*`netflow.engine_type`*:: ++ +-- +type: short + +-- + +*`netflow.engine_id`*:: ++ +-- +type: short + +-- + +*`netflow.exported_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.exported_message_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.exported_flow_record_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ipv4_router_sc`*:: ++ +-- +type: ip + +-- + +*`netflow.source_ipv4_prefix`*:: ++ +-- +type: ip + +-- + +*`netflow.destination_ipv4_prefix`*:: ++ +-- +type: ip + +-- + +*`netflow.mpls_top_label_type`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_top_label_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.sampler_id`*:: ++ +-- +type: short + +-- + +*`netflow.sampler_mode`*:: ++ +-- +type: short + +-- + +*`netflow.sampler_random_interval`*:: ++ +-- +type: long + +-- + +*`netflow.class_id`*:: ++ +-- +type: long + +-- + +*`netflow.minimum_ttl`*:: ++ +-- +type: short + +-- + +*`netflow.maximum_ttl`*:: ++ +-- +type: short + +-- + +*`netflow.fragment_identification`*:: ++ +-- +type: long + +-- + +*`netflow.post_ip_class_of_service`*:: ++ +-- +type: short + +-- + +*`netflow.source_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.post_destination_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.post_vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.ip_version`*:: ++ +-- +type: short + +-- + +*`netflow.flow_direction`*:: ++ +-- +type: short + +-- + +*`netflow.ip_next_hop_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.bgp_next_hop_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.ipv6_extension_headers`*:: ++ +-- +type: long + +-- + +*`netflow.mpls_top_label_stack_section`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section2`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section3`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section4`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section5`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section6`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section7`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section8`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section9`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section10`*:: ++ +-- +type: short + +-- + +*`netflow.destination_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.post_source_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.interface_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.interface_description`*:: ++ +-- +type: keyword + +-- + +*`netflow.sampler_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.flags_and_sampler_id`*:: ++ +-- +type: long + +-- + +*`netflow.fragment_offset`*:: ++ +-- +type: integer + +-- + +*`netflow.forwarding_status`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_vpn_route_distinguisher`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_top_label_prefix_length`*:: ++ +-- +type: short + +-- + +*`netflow.src_traffic_index`*:: ++ +-- +type: long + +-- + +*`netflow.dst_traffic_index`*:: ++ +-- +type: long + +-- + +*`netflow.application_description`*:: ++ +-- +type: keyword + +-- + +*`netflow.application_id`*:: ++ +-- +type: short + +-- + +*`netflow.application_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.post_ip_diff_serv_code_point`*:: ++ +-- +type: short + +-- + +*`netflow.multicast_replication_factor`*:: ++ +-- +type: long + +-- + +*`netflow.class_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.classification_engine_id`*:: ++ +-- +type: short + +-- + +*`netflow.layer2packet_section_offset`*:: ++ +-- +type: integer + +-- + +*`netflow.layer2packet_section_size`*:: ++ +-- +type: integer + +-- + +*`netflow.layer2packet_section_data`*:: ++ +-- +type: short + +-- + +*`netflow.bgp_next_adjacent_as_number`*:: ++ +-- +type: long + +-- + +*`netflow.bgp_prev_adjacent_as_number`*:: ++ +-- +type: long + +-- + +*`netflow.exporter_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.exporter_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.dropped_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.dropped_packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.dropped_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.dropped_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.flow_end_reason`*:: ++ +-- +type: short + +-- + +*`netflow.common_properties_id`*:: ++ +-- +type: long + +-- + +*`netflow.observation_point_id`*:: ++ +-- +type: long + +-- + +*`netflow.icmp_type_code_ipv6`*:: ++ +-- +type: integer + +-- + +*`netflow.mpls_top_label_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.line_card_id`*:: ++ +-- +type: long + +-- + +*`netflow.port_id`*:: ++ +-- +type: long + +-- + +*`netflow.metering_process_id`*:: ++ +-- +type: long + +-- + +*`netflow.exporting_process_id`*:: ++ +-- +type: long + +-- + +*`netflow.template_id`*:: ++ +-- +type: integer + +-- + +*`netflow.wlan_channel_id`*:: ++ +-- +type: short + +-- + +*`netflow.wlan_ssid`*:: ++ +-- +type: keyword + +-- + +*`netflow.flow_id`*:: ++ +-- +type: long + +-- + +*`netflow.observation_domain_id`*:: ++ +-- +type: long + +-- + +*`netflow.flow_start_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_end_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_start_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_end_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_start_microseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_end_microseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_start_nanoseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_end_nanoseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_start_delta_microseconds`*:: ++ +-- +type: long + +-- + +*`netflow.flow_end_delta_microseconds`*:: ++ +-- +type: long + +-- + +*`netflow.system_init_time_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.flow_duration_milliseconds`*:: ++ +-- +type: long + +-- + +*`netflow.flow_duration_microseconds`*:: ++ +-- +type: long + +-- + +*`netflow.observed_flow_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ignored_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ignored_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.not_sent_flow_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.not_sent_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.not_sent_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.destination_ipv6_prefix`*:: ++ +-- +type: ip + +-- + +*`netflow.source_ipv6_prefix`*:: ++ +-- +type: ip + +-- + +*`netflow.post_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.flow_key_indicator`*:: ++ +-- +type: long + +-- + +*`netflow.post_mcast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_mcast_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.icmp_type_ipv4`*:: ++ +-- +type: short + +-- + +*`netflow.icmp_code_ipv4`*:: ++ +-- +type: short + +-- + +*`netflow.icmp_type_ipv6`*:: ++ +-- +type: short + +-- + +*`netflow.icmp_code_ipv6`*:: ++ +-- +type: short + +-- + +*`netflow.udp_source_port`*:: ++ +-- +type: integer + +-- + +*`netflow.udp_destination_port`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_source_port`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_destination_port`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_sequence_number`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_acknowledgement_number`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_window_size`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_urgent_pointer`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_header_length`*:: ++ +-- +type: short + +-- + +*`netflow.ip_header_length`*:: ++ +-- +type: short + +-- + +*`netflow.total_length_ipv4`*:: ++ +-- +type: integer + +-- + +*`netflow.payload_length_ipv6`*:: ++ +-- +type: integer + +-- + +*`netflow.ip_ttl`*:: ++ +-- +type: short + +-- + +*`netflow.next_header_ipv6`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_payload_length`*:: ++ +-- +type: long + +-- + +*`netflow.ip_diff_serv_code_point`*:: ++ +-- +type: short + +-- + +*`netflow.ip_precedence`*:: ++ +-- +type: short + +-- + +*`netflow.fragment_flags`*:: ++ +-- +type: short + +-- + +*`netflow.octet_delta_sum_of_squares`*:: ++ +-- +type: long + +-- + +*`netflow.octet_total_sum_of_squares`*:: ++ +-- +type: long + +-- + +*`netflow.mpls_top_label_ttl`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_length`*:: ++ +-- +type: long + +-- + +*`netflow.mpls_label_stack_depth`*:: ++ +-- +type: long + +-- + +*`netflow.mpls_top_label_exp`*:: ++ +-- +type: short + +-- + +*`netflow.ip_payload_length`*:: ++ +-- +type: long + +-- + +*`netflow.udp_message_length`*:: ++ +-- +type: integer + +-- + +*`netflow.is_multicast`*:: ++ +-- +type: short + +-- + +*`netflow.ipv4_ihl`*:: ++ +-- +type: short + +-- + +*`netflow.ipv4_options`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_options`*:: ++ +-- +type: long + +-- + +*`netflow.padding_octets`*:: ++ +-- +type: short + +-- + +*`netflow.collector_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.collector_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.export_interface`*:: ++ +-- +type: long + +-- + +*`netflow.export_protocol_version`*:: ++ +-- +type: short + +-- + +*`netflow.export_transport_protocol`*:: ++ +-- +type: short + +-- + +*`netflow.collector_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.exporter_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.tcp_syn_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_fin_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_rst_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_psh_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_ack_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.tcp_urg_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ip_total_length`*:: ++ +-- +type: long + +-- + +*`netflow.post_nat_source_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.post_nat_destination_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.post_napt_source_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.post_napt_destination_transport_port`*:: ++ +-- +type: integer + +-- + +*`netflow.nat_originating_address_realm`*:: ++ +-- +type: short + +-- + +*`netflow.nat_event`*:: ++ +-- +type: short + +-- + +*`netflow.initiator_octets`*:: ++ +-- +type: long + +-- + +*`netflow.responder_octets`*:: ++ +-- +type: long + +-- + +*`netflow.firewall_event`*:: ++ +-- +type: short + +-- + +*`netflow.ingress_vrfid`*:: ++ +-- +type: long + +-- + +*`netflow.egress_vrfid`*:: ++ +-- +type: long + +-- + +*`netflow.vr_fname`*:: ++ +-- +type: keyword + +-- + +*`netflow.post_mpls_top_label_exp`*:: ++ +-- +type: short + +-- + +*`netflow.tcp_window_scale`*:: ++ +-- +type: integer + +-- + +*`netflow.biflow_direction`*:: ++ +-- +type: short + +-- + +*`netflow.ethernet_header_length`*:: ++ +-- +type: short + +-- + +*`netflow.ethernet_payload_length`*:: ++ +-- +type: integer + +-- + +*`netflow.ethernet_total_length`*:: ++ +-- +type: integer + +-- + +*`netflow.dot1q_vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.dot1q_priority`*:: ++ +-- +type: short + +-- + +*`netflow.dot1q_customer_vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.dot1q_customer_priority`*:: ++ +-- +type: short + +-- + +*`netflow.metro_evc_id`*:: ++ +-- +type: keyword + +-- + +*`netflow.metro_evc_type`*:: ++ +-- +type: short + +-- + +*`netflow.pseudo_wire_id`*:: ++ +-- +type: long + +-- + +*`netflow.pseudo_wire_type`*:: ++ +-- +type: integer + +-- + +*`netflow.pseudo_wire_control_word`*:: ++ +-- +type: long + +-- + +*`netflow.ingress_physical_interface`*:: ++ +-- +type: long + +-- + +*`netflow.egress_physical_interface`*:: ++ +-- +type: long + +-- + +*`netflow.post_dot1q_vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.post_dot1q_customer_vlan_id`*:: ++ +-- +type: integer + +-- + +*`netflow.ethernet_type`*:: ++ +-- +type: integer + +-- + +*`netflow.post_ip_precedence`*:: ++ +-- +type: short + +-- + +*`netflow.collection_time_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.export_sctp_stream_id`*:: ++ +-- +type: integer + +-- + +*`netflow.max_export_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.max_flow_end_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.message_md5_checksum`*:: ++ +-- +type: short + +-- + +*`netflow.message_scope`*:: ++ +-- +type: short + +-- + +*`netflow.min_export_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.min_flow_start_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.opaque_octets`*:: ++ +-- +type: short + +-- + +*`netflow.session_scope`*:: ++ +-- +type: short + +-- + +*`netflow.max_flow_end_microseconds`*:: ++ +-- +type: date + +-- + +*`netflow.max_flow_end_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.max_flow_end_nanoseconds`*:: ++ +-- +type: date + +-- + +*`netflow.min_flow_start_microseconds`*:: ++ +-- +type: date + +-- + +*`netflow.min_flow_start_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.min_flow_start_nanoseconds`*:: ++ +-- +type: date + +-- + +*`netflow.collector_certificate`*:: ++ +-- +type: short + +-- + +*`netflow.exporter_certificate`*:: ++ +-- +type: short + +-- + +*`netflow.data_records_reliability`*:: ++ +-- +type: boolean + +-- + +*`netflow.observation_point_type`*:: ++ +-- +type: short + +-- + +*`netflow.new_connection_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.connection_sum_duration_seconds`*:: ++ +-- +type: long + +-- + +*`netflow.connection_transaction_id`*:: ++ +-- +type: long + +-- + +*`netflow.post_nat_source_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.post_nat_destination_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.nat_pool_id`*:: ++ +-- +type: long + +-- + +*`netflow.nat_pool_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.anonymization_flags`*:: ++ +-- +type: integer + +-- + +*`netflow.anonymization_technique`*:: ++ +-- +type: integer + +-- + +*`netflow.information_element_index`*:: ++ +-- +type: integer + +-- + +*`netflow.p2p_technology`*:: ++ +-- +type: keyword + +-- + +*`netflow.tunnel_technology`*:: ++ +-- +type: keyword + +-- + +*`netflow.encrypted_technology`*:: ++ +-- +type: keyword + +-- + +*`netflow.bgp_validity_state`*:: ++ +-- +type: short + +-- + +*`netflow.ip_sec_spi`*:: ++ +-- +type: long + +-- + +*`netflow.gre_key`*:: ++ +-- +type: long + +-- + +*`netflow.nat_type`*:: ++ +-- +type: short + +-- + +*`netflow.initiator_packets`*:: ++ +-- +type: long + +-- + +*`netflow.responder_packets`*:: ++ +-- +type: long + +-- + +*`netflow.observation_domain_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.selection_sequence_id`*:: ++ +-- +type: long + +-- + +*`netflow.selector_id`*:: ++ +-- +type: long + +-- + +*`netflow.information_element_id`*:: ++ +-- +type: integer + +-- + +*`netflow.selector_algorithm`*:: ++ +-- +type: integer + +-- + +*`netflow.sampling_packet_interval`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_packet_space`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_time_interval`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_time_space`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_size`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_population`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_probability`*:: ++ +-- +type: double + +-- + +*`netflow.data_link_frame_size`*:: ++ +-- +type: integer + +-- + +*`netflow.ip_header_packet_section`*:: ++ +-- +type: short + +-- + +*`netflow.ip_payload_packet_section`*:: ++ +-- +type: short + +-- + +*`netflow.data_link_frame_section`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_label_stack_section`*:: ++ +-- +type: short + +-- + +*`netflow.mpls_payload_packet_section`*:: ++ +-- +type: short + +-- + +*`netflow.selector_id_total_pkts_observed`*:: ++ +-- +type: long + +-- + +*`netflow.selector_id_total_pkts_selected`*:: ++ +-- +type: long + +-- + +*`netflow.absolute_error`*:: ++ +-- +type: double + +-- + +*`netflow.relative_error`*:: ++ +-- +type: double + +-- + +*`netflow.observation_time_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.observation_time_milliseconds`*:: ++ +-- +type: date + +-- + +*`netflow.observation_time_microseconds`*:: ++ +-- +type: date + +-- + +*`netflow.observation_time_nanoseconds`*:: ++ +-- +type: date + +-- + +*`netflow.digest_hash_value`*:: ++ +-- +type: long + +-- + +*`netflow.hash_ip_payload_offset`*:: ++ +-- +type: long + +-- + +*`netflow.hash_ip_payload_size`*:: ++ +-- +type: long + +-- + +*`netflow.hash_output_range_min`*:: ++ +-- +type: long + +-- + +*`netflow.hash_output_range_max`*:: ++ +-- +type: long + +-- + +*`netflow.hash_selected_range_min`*:: ++ +-- +type: long + +-- + +*`netflow.hash_selected_range_max`*:: ++ +-- +type: long + +-- + +*`netflow.hash_digest_output`*:: ++ +-- +type: boolean + +-- + +*`netflow.hash_initialiser_value`*:: ++ +-- +type: long + +-- + +*`netflow.selector_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.upper_ci_limit`*:: ++ +-- +type: double + +-- + +*`netflow.lower_ci_limit`*:: ++ +-- +type: double + +-- + +*`netflow.confidence_level`*:: ++ +-- +type: double + +-- + +*`netflow.information_element_data_type`*:: ++ +-- +type: short + +-- + +*`netflow.information_element_description`*:: ++ +-- +type: keyword + +-- + +*`netflow.information_element_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.information_element_range_begin`*:: ++ +-- +type: long + +-- + +*`netflow.information_element_range_end`*:: ++ +-- +type: long + +-- + +*`netflow.information_element_semantics`*:: ++ +-- +type: short + +-- + +*`netflow.information_element_units`*:: ++ +-- +type: integer + +-- + +*`netflow.private_enterprise_number`*:: ++ +-- +type: long + +-- + +*`netflow.virtual_station_interface_id`*:: ++ +-- +type: short + +-- + +*`netflow.virtual_station_interface_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.virtual_station_uuid`*:: ++ +-- +type: short + +-- + +*`netflow.virtual_station_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.layer2_segment_id`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ingress_unicast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ingress_multicast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ingress_broadcast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.egress_unicast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.egress_broadcast_packet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.monitoring_interval_start_milli_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.monitoring_interval_end_milli_seconds`*:: ++ +-- +type: date + +-- + +*`netflow.port_range_start`*:: ++ +-- +type: integer + +-- + +*`netflow.port_range_end`*:: ++ +-- +type: integer + +-- + +*`netflow.port_range_step_size`*:: ++ +-- +type: integer + +-- + +*`netflow.port_range_num_ports`*:: ++ +-- +type: integer + +-- + +*`netflow.sta_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.sta_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.wtp_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.ingress_interface_type`*:: ++ +-- +type: long + +-- + +*`netflow.egress_interface_type`*:: ++ +-- +type: long + +-- + +*`netflow.rtp_sequence_number`*:: ++ +-- +type: integer + +-- + +*`netflow.user_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.application_category_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.application_sub_category_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.application_group_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.original_flows_present`*:: ++ +-- +type: long + +-- + +*`netflow.original_flows_initiated`*:: ++ +-- +type: long + +-- + +*`netflow.original_flows_completed`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_source_ip_address`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_destination_ip_address`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_source_ipv4_address`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_destination_ipv4_address`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_source_ipv6_address`*:: ++ +-- +type: long + +-- + +*`netflow.distinct_count_of_destination_ipv6_address`*:: ++ +-- +type: long + +-- + +*`netflow.value_distribution_method`*:: ++ +-- +type: short + +-- + +*`netflow.rfc3550_jitter_milliseconds`*:: ++ +-- +type: long + +-- + +*`netflow.rfc3550_jitter_microseconds`*:: ++ +-- +type: long + +-- + +*`netflow.rfc3550_jitter_nanoseconds`*:: ++ +-- +type: long + +-- + +*`netflow.dot1q_dei`*:: ++ +-- +type: boolean + +-- + +*`netflow.dot1q_customer_dei`*:: ++ +-- +type: boolean + +-- + +*`netflow.flow_selector_algorithm`*:: ++ +-- +type: integer + +-- + +*`netflow.flow_selected_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.flow_selected_packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.flow_selected_flow_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.selector_id_total_flows_observed`*:: ++ +-- +type: long + +-- + +*`netflow.selector_id_total_flows_selected`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_flow_interval`*:: ++ +-- +type: long + +-- + +*`netflow.sampling_flow_spacing`*:: ++ +-- +type: long + +-- + +*`netflow.flow_sampling_time_interval`*:: ++ +-- +type: long + +-- + +*`netflow.flow_sampling_time_spacing`*:: ++ +-- +type: long + +-- + +*`netflow.hash_flow_domain`*:: ++ +-- +type: integer + +-- + +*`netflow.transport_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.transport_packet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.original_exporter_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.original_exporter_ipv6_address`*:: ++ +-- +type: ip + +-- + +*`netflow.original_observation_domain_id`*:: ++ +-- +type: long + +-- + +*`netflow.intermediate_process_id`*:: ++ +-- +type: long + +-- + +*`netflow.ignored_data_record_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.data_link_frame_type`*:: ++ +-- +type: integer + +-- + +*`netflow.section_offset`*:: ++ +-- +type: integer + +-- + +*`netflow.section_exported_octets`*:: ++ +-- +type: integer + +-- + +*`netflow.dot1q_service_instance_tag`*:: ++ +-- +type: short + +-- + +*`netflow.dot1q_service_instance_id`*:: ++ +-- +type: long + +-- + +*`netflow.dot1q_service_instance_priority`*:: ++ +-- +type: short + +-- + +*`netflow.dot1q_customer_source_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.dot1q_customer_destination_mac_address`*:: ++ +-- +type: keyword + +-- + +*`netflow.post_layer2_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_mcast_layer2_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.post_mcast_layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.minimum_layer2_total_length`*:: ++ +-- +type: long + +-- + +*`netflow.maximum_layer2_total_length`*:: ++ +-- +type: long + +-- + +*`netflow.dropped_layer2_octet_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.dropped_layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.ignored_layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.not_sent_layer2_octet_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_octet_delta_sum_of_squares`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_octet_total_sum_of_squares`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_frame_delta_count`*:: ++ +-- +type: long + +-- + +*`netflow.layer2_frame_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.pseudo_wire_destination_ipv4_address`*:: ++ +-- +type: ip + +-- + +*`netflow.ignored_layer2_frame_total_count`*:: ++ +-- +type: long + +-- + +*`netflow.mib_object_value_integer`*:: ++ +-- +type: integer + +-- + +*`netflow.mib_object_value_octet_string`*:: ++ +-- +type: short + +-- + +*`netflow.mib_object_value_oid`*:: ++ +-- +type: short + +-- + +*`netflow.mib_object_value_bits`*:: ++ +-- +type: short + +-- + +*`netflow.mib_object_value_ip_address`*:: ++ +-- +type: ip + +-- + +*`netflow.mib_object_value_counter`*:: ++ +-- +type: long + +-- + +*`netflow.mib_object_value_gauge`*:: ++ +-- +type: long + +-- + +*`netflow.mib_object_value_time_ticks`*:: ++ +-- +type: long + +-- + +*`netflow.mib_object_value_unsigned`*:: ++ +-- +type: long + +-- + +*`netflow.mib_object_identifier`*:: ++ +-- +type: short + +-- + +*`netflow.mib_sub_identifier`*:: ++ +-- +type: long + +-- + +*`netflow.mib_index_indicator`*:: ++ +-- +type: long + +-- + +*`netflow.mib_capture_time_semantics`*:: ++ +-- +type: short + +-- + +*`netflow.mib_context_engine_id`*:: ++ +-- +type: short + +-- + +*`netflow.mib_context_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.mib_object_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.mib_object_description`*:: ++ +-- +type: keyword + +-- + +*`netflow.mib_object_syntax`*:: ++ +-- +type: keyword + +-- + +*`netflow.mib_module_name`*:: ++ +-- +type: keyword + +-- + +*`netflow.mobile_imsi`*:: ++ +-- +type: keyword + +-- + +*`netflow.mobile_msisdn`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_status_code`*:: ++ +-- +type: integer + +-- + +*`netflow.source_transport_ports_limit`*:: ++ +-- +type: integer + +-- + +*`netflow.http_request_method`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_request_host`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_request_target`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_message_version`*:: ++ +-- +type: keyword + +-- + +*`netflow.nat_instance_id`*:: ++ +-- +type: long + +-- + +*`netflow.internal_address_realm`*:: ++ +-- +type: short + +-- + +*`netflow.external_address_realm`*:: ++ +-- +type: short + +-- + +*`netflow.nat_quota_exceeded_event`*:: ++ +-- +type: long + +-- + +*`netflow.nat_threshold_event`*:: ++ +-- +type: long + +-- + +*`netflow.http_user_agent`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_content_type`*:: ++ +-- +type: keyword + +-- + +*`netflow.http_reason_phrase`*:: ++ +-- +type: keyword + +-- + +*`netflow.max_session_entries`*:: ++ +-- +type: long + +-- + +*`netflow.max_bib_entries`*:: ++ +-- +type: long + +-- + +*`netflow.max_entries_per_user`*:: ++ +-- +type: long + +-- + +*`netflow.max_subscribers`*:: ++ +-- +type: long + +-- + +*`netflow.max_fragments_pending_reassembly`*:: ++ +-- +type: long + +-- + +*`netflow.address_pool_high_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.address_pool_low_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.address_port_mapping_high_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.address_port_mapping_low_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.address_port_mapping_per_user_high_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.global_address_mapping_high_threshold`*:: ++ +-- +type: long + +-- + +*`netflow.vpn_identifier`*:: ++ +-- +type: short + +-- + +[[exported-fields-netscout]] +== Arbor Peakflow SP fields + +netscout fields. + + + +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. + + +type: keyword + +-- + + + +*`rsa.internal.msg`*:: ++ +-- +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword + +-- + +*`rsa.internal.messageid`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.event_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.message`*:: ++ +-- +This key captures the contents of instant messages + +type: keyword + +-- + +*`rsa.internal.time`*:: ++ +-- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date + +-- + +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_server`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_val`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.statement`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.audit_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.entry`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.hcode`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.inode`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.cid`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_class`*:: ++ +-- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_group`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_host`*:: ++ +-- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_ip`*:: ++ +-- +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.did`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.entropy_req`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.entropy_res`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.event_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.feed_category`*:: ++ +-- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.forward_ip`*:: ++ +-- +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip + +-- + +*`rsa.internal.forward_ipv6`*:: ++ +-- +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.header_id`*:: ++ +-- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_cid`*:: ++ +-- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_ctime`*:: ++ +-- +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date + +-- + +*`rsa.internal.mcb_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcb_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcbc_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.mcbc_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.medium`*:: ++ +-- +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long + +-- + +*`rsa.internal.node_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.nwe_callback_id`*:: ++ +-- +This key denotes that event is endpoint related + +type: keyword + +-- + +*`rsa.internal.parse_error`*:: ++ +-- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.payload_req`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.payload_res`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.process_vid_dst`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + +type: keyword + +-- + +*`rsa.internal.process_vid_src`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + +type: keyword + +-- + +*`rsa.internal.rid`*:: ++ +-- +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.session_split`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.site`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.size`*:: ++ +-- +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.sourcefile`*:: ++ +-- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.ubc_req`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.ubc_res`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.word`*:: ++ +-- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + +type: keyword + +-- + + +*`rsa.time.event_time`*:: ++ +-- +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date + +-- + +*`rsa.time.duration_time`*:: ++ +-- +This key is used to capture the normalized duration/lifetime in seconds. + +type: double + +-- + +*`rsa.time.event_time_str`*:: ++ +-- +This key is used to capture the incomplete time mentioned in a session as a string + +type: keyword + +-- + +*`rsa.time.starttime`*:: ++ +-- +This key is used to capture the Start time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.day`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.endtime`*:: ++ +-- +This key is used to capture the End time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.timezone`*:: ++ +-- +This key is used to capture the timezone of the Event Time + +type: keyword + +-- + +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration + +type: keyword + +-- + +*`rsa.time.date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.recorded_time`*:: ++ +-- +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date + +-- + +*`rsa.time.datetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.effective_time`*:: ++ +-- +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date + +-- + +*`rsa.time.expire_time`*:: ++ +-- +This key is the timestamp that explicitly refers to an expiration. + +type: date + +-- + +*`rsa.time.process_time`*:: ++ +-- +Deprecated, use duration.time + +type: keyword + +-- + +*`rsa.time.hour`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.min`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.timestamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.event_queue_time`*:: ++ +-- +This key is the Time that the event was queued. + +type: date + +-- + +*`rsa.time.p_time1`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.tzone`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.eventtime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmtdate`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmttime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time2`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.expire_time_str`*:: ++ +-- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + +type: keyword + +-- + +*`rsa.time.stamp`*:: ++ +-- +Deprecated key defined only in table map. + +type: date + +-- + + +*`rsa.misc.action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.result`*:: ++ +-- +This key is used to capture the outcome/result string value of an action in a session. + +type: keyword + +-- + +*`rsa.misc.severity`*:: ++ +-- +This key is used to capture the severity given the session + +type: keyword + +-- + +*`rsa.misc.event_type`*:: ++ +-- +This key captures the event category type as specified by the event source. + +type: keyword + +-- + +*`rsa.misc.reference_id`*:: ++ +-- +This key is used to capture an event id from the session directly + +type: keyword + +-- + +*`rsa.misc.version`*:: ++ +-- +This key captures Version of the application or OS which is generating the event. + +type: keyword + +-- + +*`rsa.misc.disposition`*:: ++ +-- +This key captures the The end state of an action. + +type: keyword + +-- + +*`rsa.misc.result_code`*:: ++ +-- +This key is used to capture the outcome/result numeric value of an action in a session + +type: keyword + +-- + +*`rsa.misc.category`*:: ++ +-- +This key is used to capture the category of an event given by the vendor in the session + +type: keyword + +-- + +*`rsa.misc.obj_name`*:: ++ +-- +This is used to capture name of object + +type: keyword + +-- + +*`rsa.misc.obj_type`*:: ++ +-- +This is used to capture type of object + +type: keyword + +-- + +*`rsa.misc.event_source`*:: ++ +-- +This key captures Source of the event that’s not a hostname + +type: keyword + +-- + +*`rsa.misc.log_session_id`*:: ++ +-- +This key is used to capture a sessionid from the session directly + +type: keyword + +-- + +*`rsa.misc.group`*:: ++ +-- +This key captures the Group Name value + +type: keyword + +-- + +*`rsa.misc.policy_name`*:: ++ +-- +This key is used to capture the Policy Name only. + +type: keyword + +-- + +*`rsa.misc.rule_name`*:: ++ +-- +This key captures the Rule Name + +type: keyword + +-- + +*`rsa.misc.context`*:: ++ +-- +This key captures Information which adds additional context to the event. + +type: keyword + +-- + +*`rsa.misc.change_new`*:: ++ +-- +This key is used to capture the new values of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.space`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client`*:: ++ +-- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword + +-- + +*`rsa.misc.msgIdPart1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.change_old`*:: ++ +-- +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.operation_id`*:: ++ +-- +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword + +-- + +*`rsa.misc.event_state`*:: ++ +-- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword + +-- + +*`rsa.misc.group_object`*:: ++ +-- +This key captures a collection/grouping of entities. Specific usage + +type: keyword + +-- + +*`rsa.misc.node`*:: ++ +-- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword + +-- + +*`rsa.misc.rule`*:: ++ +-- +This key captures the Rule number + +type: keyword + +-- + +*`rsa.misc.device_name`*:: ++ +-- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword + +-- + +*`rsa.misc.param`*:: ++ +-- +This key is the parameters passed as part of a command or application, etc. + +type: keyword + +-- + +*`rsa.misc.change_attrib`*:: ++ +-- +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.event_computer`*:: ++ +-- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword + +-- + +*`rsa.misc.reference_id1`*:: ++ +-- +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword + +-- + +*`rsa.misc.event_log`*:: ++ +-- +This key captures the Name of the event log + +type: keyword + +-- + +*`rsa.misc.OS`*:: ++ +-- +This key captures the Name of the Operating System + +type: keyword + +-- + +*`rsa.misc.terminal`*:: ++ +-- +This key captures the Terminal Names only + +type: keyword + +-- + +*`rsa.misc.msgIdPart3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.filter`*:: ++ +-- +This key captures Filter used to reduce result set + +type: keyword + +-- + +*`rsa.misc.serial_number`*:: ++ +-- +This key is the Serial number associated with a physical asset. + +type: keyword + +-- + +*`rsa.misc.checksum`*:: ++ +-- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword + +-- + +*`rsa.misc.event_user`*:: ++ +-- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword + +-- + +*`rsa.misc.virusname`*:: ++ +-- +This key captures the name of the virus + +type: keyword + +-- + +*`rsa.misc.content_type`*:: ++ +-- +This key is used to capture Content Type only. + +type: keyword + +-- + +*`rsa.misc.group_id`*:: ++ +-- +This key captures Group ID Number (related to the group name) + +type: keyword + +-- + +*`rsa.misc.policy_id`*:: ++ +-- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword + +-- + +*`rsa.misc.vsys`*:: ++ +-- +This key captures Virtual System Name + +type: keyword + +-- + +*`rsa.misc.connection_id`*:: ++ +-- +This key captures the Connection ID + +type: keyword + +-- + +*`rsa.misc.reference_id2`*:: ++ +-- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword + +-- + +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword + +-- + +*`rsa.misc.sig_id`*:: ++ +-- +This key captures IDS/IPS Int Signature ID + +type: long + +-- + +*`rsa.misc.port_name`*:: ++ +-- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword + +-- + +*`rsa.misc.rule_group`*:: ++ +-- +This key captures the Rule group name + +type: keyword + +-- + +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value + +type: double + +-- + +*`rsa.misc.trigger_val`*:: ++ +-- +This key captures the Value of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.log_session_id1`*:: ++ +-- +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword + +-- + +*`rsa.misc.comp_version`*:: ++ +-- +This key captures the Version level of a sub-component of a product. + +type: keyword + +-- + +*`rsa.misc.content_version`*:: ++ +-- +This key captures Version level of a signature or database content. + +type: keyword + +-- + +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword + +-- + +*`rsa.misc.risk`*:: ++ +-- +This key captures the non-numeric risk value + +type: keyword + +-- + +*`rsa.misc.event_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.reason`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mail_id`*:: ++ +-- +This key is used to capture the mailbox id/name + +type: keyword + +-- + +*`rsa.misc.rule_uid`*:: ++ +-- +This key is the Unique Identifier for a rule. + +type: keyword + +-- + +*`rsa.misc.trigger_desc`*:: ++ +-- +This key captures the Description of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.inout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.data_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.error`*:: ++ +-- +This key captures All non successful Error codes or responses + +type: keyword + +-- + +*`rsa.misc.index`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.listnum`*:: ++ +-- +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword + +-- + +*`rsa.misc.ntype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.observed_val`*:: ++ +-- +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.policy_value`*:: ++ +-- +This key captures the contents of the policy. This contains details about the policy + +type: keyword + +-- + +*`rsa.misc.pool_name`*:: ++ +-- +This key captures the name of a resource pool + +type: keyword + +-- + +*`rsa.misc.rule_template`*:: ++ +-- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword + +-- + +*`rsa.misc.count`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigcat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comments`*:: ++ +-- +Comment information provided in the log message + +type: keyword + +-- + +*`rsa.misc.doc_number`*:: ++ +-- +This key captures File Identification number + +type: long + +-- + +*`rsa.misc.expected_val`*:: ++ +-- +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.job_num`*:: ++ +-- +This key captures the Job Number + +type: keyword + +-- + +*`rsa.misc.spi_dst`*:: ++ +-- +Destination SPI Index + +type: keyword + +-- + +*`rsa.misc.spi_src`*:: ++ +-- +Source SPI Index + +type: keyword + +-- + +*`rsa.misc.code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.agent_id`*:: ++ +-- +This key is used to capture agent id + +type: keyword + +-- + +*`rsa.misc.message_body`*:: ++ +-- +This key captures the The contents of the message body. + +type: keyword + +-- + +*`rsa.misc.phone`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sig_id_str`*:: ++ +-- +This key captures a string object of the sigid variable. + +type: keyword + +-- + +*`rsa.misc.cmd`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu`*:: ++ +-- +This key is the CPU time used in the execution of the event being recorded. + +type: long + +-- + +*`rsa.misc.event_desc`*:: ++ +-- +This key is used to capture a description of an event available directly or inferred + +type: keyword + +-- + +*`rsa.misc.sig_id1`*:: ++ +-- +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long + +-- + +*`rsa.misc.im_buddyid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_client`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.priority`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.context_subject`*:: ++ +-- +This key is to be used in an audit context where the subject is the object being identified + +type: keyword + +-- + +*`rsa.misc.context_target`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cve`*:: ++ +-- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword + +-- + +*`rsa.misc.fcatnum`*:: ++ +-- +This key captures Filter Category Number. Legacy Usage + +type: keyword + +-- + +*`rsa.misc.library`*:: ++ +-- +This key is used to capture library information in mainframe devices + +type: keyword + +-- + +*`rsa.misc.parent_node`*:: ++ +-- +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword + +-- + +*`rsa.misc.risk_info`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.tcp_flags`*:: ++ +-- +This key is captures the TCP flags set in any packet of session + +type: long + +-- + +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service + +type: long + +-- + +*`rsa.misc.vm_target`*:: ++ +-- +VMWare Target **VMWARE** only varaible. + +type: keyword + +-- + +*`rsa.misc.workspace`*:: ++ +-- +This key captures Workspace Description + +type: keyword + +-- + +*`rsa.misc.command`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.event_category`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facilityname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.forensic_info`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.jobname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy_waiver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.second`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.space1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.subcategory`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alert_id`*:: ++ +-- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword + +-- + +*`rsa.misc.checksum_src`*:: ++ +-- +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword + +-- + +*`rsa.misc.fresult`*:: ++ +-- +This key captures the Filter Result + +type: long + +-- + +*`rsa.misc.payload_dst`*:: ++ +-- +This key is used to capture destination payload + +type: keyword + +-- + +*`rsa.misc.payload_src`*:: ++ +-- +This key is used to capture source payload + +type: keyword + +-- + +*`rsa.misc.pool_id`*:: ++ +-- +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword + +-- + +*`rsa.misc.process_id_val`*:: ++ +-- +This key is a failure key for Process ID when it is not an integer value + +type: keyword + +-- + +*`rsa.misc.risk_num_comm`*:: ++ +-- +This key captures Risk Number Community + +type: double + +-- + +*`rsa.misc.risk_num_next`*:: ++ +-- +This key captures Risk Number NextGen + +type: double + +-- + +*`rsa.misc.risk_num_sand`*:: ++ +-- +This key captures Risk Number SandBox + +type: double + +-- + +*`rsa.misc.risk_num_static`*:: ++ +-- +This key captures Risk Number Static + +type: double + +-- + +*`rsa.misc.risk_suspicious`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.risk_warning`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.snmp_oid`*:: ++ +-- +SNMP Object Identifier + +type: keyword + +-- + +*`rsa.misc.sql`*:: ++ +-- +This key captures the SQL query + +type: keyword + +-- + +*`rsa.misc.vuln_ref`*:: ++ +-- +This key captures the Vulnerability Reference details + +type: keyword + +-- + +*`rsa.misc.acl_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_op`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_pos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_table`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.admin`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarm_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarmname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.app_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.auditdata`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.benchmark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.bypass`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache_hit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cefversion`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_attr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_obj`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_path`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.changes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client_ip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.clustermembers`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_acttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_asn_src`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_bgpv4nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ctr_dst_code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_f_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampintv`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampmode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inacttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermbyts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermpckts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_invalid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ip_proto_ver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ipv4_ident`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_l_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_did`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_rid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_max_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_maxpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_min_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_minpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_10`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_5`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_6`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_7`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_8`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_9`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_byt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_pks`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_muligmptype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampalgo`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampint`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_seqctr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_spackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sysuptime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_template_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totbytsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totflowexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totpcktsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_unixnanosecs`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6flowlabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6optheaders`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_rbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_sbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.criticality`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_agency_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_analyzedby`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_other`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_primary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_secondary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bgpv6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bit9status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_context`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_control`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_dst_tld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_dst_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_src_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_event_uuid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_filetype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ip_next_hop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4dstpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4srcpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_lifetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_log_medium`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_loginname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulescore`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulesign`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_opswatresult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_payload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrant`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrar`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_represult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_rpayload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sampler_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sourcemodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_streams`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_targetmodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_v6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_whois_server`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_yararesult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.description`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.devvendor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.distance`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.dstburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomaub`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.euid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facility`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.finterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.flags`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.gaddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.id3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_buddyname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomtype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_members`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipspri`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.latitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.linenum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.list_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.load_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_floor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_mark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.longitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.lport`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mbug_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.netsessid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.nwwn`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.operation`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.opkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.orig_from`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.owner_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_filter`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_group_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_result1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_chg`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permgranted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permwanted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.prog_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.program`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.real_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_device`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_library`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ruid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sdomain_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sec`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sensorname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.seqnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.session`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.spi`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcservice`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.state`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.svcno`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.system`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.threshold`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.udb_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.url_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.user_div`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.username_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.v_instafname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.virt_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.vpnid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.autorun_type`*:: ++ +-- +This is used to capture Auto Run type + +type: keyword + +-- + +*`rsa.misc.cc_number`*:: ++ +-- +Valid Credit Card Numbers only + +type: long + +-- + +*`rsa.misc.content`*:: ++ +-- +This key captures the content type from protocol headers + +type: keyword + +-- + +*`rsa.misc.ein_number`*:: ++ +-- +Employee Identification Numbers only + +type: long + +-- + +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match + +type: keyword + +-- + +*`rsa.misc.language`*:: ++ +-- +This is used to capture list of languages the client support and what it prefers + +type: keyword + +-- + +*`rsa.misc.lifetime`*:: ++ +-- +This key is used to capture the session lifetime in seconds. + +type: long + +-- + +*`rsa.misc.link`*:: ++ +-- +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.misc.match`*:: ++ +-- +This key is for regex match name from search.ini + +type: keyword + +-- + +*`rsa.misc.param_dst`*:: ++ +-- +This key captures the command line/launch argument of the target process or file + +type: keyword + +-- + +*`rsa.misc.param_src`*:: ++ +-- +This key captures source parameter + +type: keyword + +-- + +*`rsa.misc.search_text`*:: ++ +-- +This key captures the Search Text used + +type: keyword + +-- + +*`rsa.misc.sig_name`*:: ++ +-- +This key is used to capture the Signature Name only. + +type: keyword + +-- + +*`rsa.misc.snmp_value`*:: ++ +-- +SNMP set request value + +type: keyword + +-- + +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session + +type: long + +-- + + +*`rsa.db.index`*:: ++ +-- +This key captures IndexID of the index. + +type: keyword + +-- + +*`rsa.db.instance`*:: ++ +-- +This key is used to capture the database server instance name + +type: keyword + +-- + +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session + +type: keyword + +-- + +*`rsa.db.permissions`*:: ++ +-- +This key captures permission or privilege level assigned to a resource. + +type: keyword + +-- + +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name + +type: keyword + +-- + +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database + +type: keyword + +-- + +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server + +type: long + +-- + +*`rsa.db.lread`*:: ++ +-- +This key is used for the number of logical reads + +type: long + +-- + +*`rsa.db.lwrite`*:: ++ +-- +This key is used for the number of logical writes + +type: long + +-- + +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes + +type: long + +-- + + +*`rsa.network.alias_host`*:: ++ +-- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword + +-- + +*`rsa.network.domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_dst`*:: ++ +-- +This key should only be used when it’s a Destination Hostname + +type: keyword + +-- + +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names + +type: keyword + +-- + +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear + +type: keyword + +-- + +*`rsa.network.network_port`*:: ++ +-- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long + +-- + +*`rsa.network.eth_host`*:: ++ +-- +Deprecated, use alias.mac + +type: keyword + +-- + +*`rsa.network.sinterface`*:: ++ +-- +This key should only be used when it’s a Source Interface + +type: keyword + +-- + +*`rsa.network.dinterface`*:: ++ +-- +This key should only be used when it’s a Destination Interface + +type: keyword + +-- + +*`rsa.network.vlan`*:: ++ +-- +This key should only be used to capture the ID of the Virtual LAN + +type: long + +-- + +*`rsa.network.zone_src`*:: ++ +-- +This key should only be used when it’s a Source Zone. + +type: keyword + +-- + +*`rsa.network.zone`*:: ++ +-- +This key should be used when the source or destination context of a Zone is not clear + +type: keyword + +-- + +*`rsa.network.zone_dst`*:: ++ +-- +This key should only be used when it’s a Destination Zone. + +type: keyword + +-- + +*`rsa.network.gateway`*:: ++ +-- +This key is used to capture the IP Address of the gateway + +type: keyword + +-- + +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only + +type: long + +-- + +*`rsa.network.mask`*:: ++ +-- +This key is used to capture the device network IPmask. + +type: keyword + +-- + +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only + +type: long + +-- + +*`rsa.network.protocol_detail`*:: ++ +-- +This key should be used to capture additional protocol information + +type: keyword + +-- + +*`rsa.network.dmask`*:: ++ +-- +This key is used for Destionation Device network mask + +type: keyword + +-- + +*`rsa.network.port`*:: ++ +-- +This key should only be used to capture a Network Port when the directionality is not clear + +type: long + +-- + +*`rsa.network.smask`*:: ++ +-- +This key is used for capturing source Network Mask + +type: keyword + +-- + +*`rsa.network.netname`*:: ++ +-- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword + +-- + +*`rsa.network.paddr`*:: ++ +-- +Deprecated + +type: ip + +-- + +*`rsa.network.faddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.lhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.origin`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.addr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_ptr_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fport`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.laddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.linterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.phost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.ad_computer_dst`*:: ++ +-- +Deprecated, use host.dst + +type: keyword + +-- + +*`rsa.network.eth_type`*:: ++ +-- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long + +-- + +*`rsa.network.ip_proto`*:: ++ +-- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long + +-- + +*`rsa.network.dns_cname_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_opcode`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_resp`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.domain1`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.packet_length`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_orig`*:: ++ +-- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword + +-- + +*`rsa.network.rpayload`*:: ++ +-- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword + +-- + +*`rsa.network.vlan_name`*:: ++ +-- +This key should only be used to capture the name of the Virtual LAN + +type: keyword + +-- + + +*`rsa.investigations.ec_activity`*:: ++ +-- +This key captures the particular event activity(Ex:Logoff) + +type: keyword + +-- + +*`rsa.investigations.ec_theme`*:: ++ +-- +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword + +-- + +*`rsa.investigations.ec_subject`*:: ++ +-- +This key captures the Subject of a particular Event(Ex:User) + +type: keyword + +-- + +*`rsa.investigations.ec_outcome`*:: ++ +-- +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword + +-- + +*`rsa.investigations.event_cat`*:: ++ +-- +This key captures the Event category number + +type: long + +-- + +*`rsa.investigations.event_cat_name`*:: ++ +-- +This key captures the event category name corresponding to the event cat code + +type: keyword + +-- + +*`rsa.investigations.event_vcat`*:: ++ +-- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword + +-- + +*`rsa.investigations.analysis_file`*:: ++ +-- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + +type: keyword + +-- + +*`rsa.investigations.analysis_service`*:: ++ +-- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword + +-- + +*`rsa.investigations.analysis_session`*:: ++ +-- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword + +-- + +*`rsa.investigations.boc`*:: ++ +-- +This is used to capture behaviour of compromise + +type: keyword + +-- + +*`rsa.investigations.eoc`*:: ++ +-- +This is used to capture Enablers of Compromise + +type: keyword + +-- + +*`rsa.investigations.inv_category`*:: ++ +-- +This used to capture investigation category + +type: keyword + +-- + +*`rsa.investigations.inv_context`*:: ++ +-- +This used to capture investigation context + +type: keyword + +-- + +*`rsa.investigations.ioc`*:: ++ +-- +This is key capture indicator of compromise + +type: keyword + +-- + + +*`rsa.counters.dclass_c1`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long + +-- + +*`rsa.counters.dclass_c2`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long + +-- + +*`rsa.counters.event_counter`*:: ++ +-- +This is used to capture the number of times an event repeated + +type: long + +-- + +*`rsa.counters.dclass_r1`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long + +-- + +*`rsa.counters.dclass_c1_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword + +-- + +*`rsa.counters.dclass_c2_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r1_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword + +-- + +*`rsa.counters.dclass_r2`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword + +-- + +*`rsa.counters.dclass_r2_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword + +-- + + +*`rsa.identity.auth_method`*:: ++ +-- +This key is used to capture authentication methods used only + +type: keyword + +-- + +*`rsa.identity.user_role`*:: ++ +-- +This key is used to capture the Role of a user only + +type: keyword + +-- + +*`rsa.identity.dn`*:: ++ +-- +X.500 (LDAP) Distinguished Name + +type: keyword + +-- + +*`rsa.identity.logon_type`*:: ++ +-- +This key is used to capture the type of logon method used. + +type: keyword + +-- + +*`rsa.identity.profile`*:: ++ +-- +This key is used to capture the user profile + +type: keyword + +-- + +*`rsa.identity.accesses`*:: ++ +-- +This key is used to capture actual privileges used in accessing an object + +type: keyword + +-- + +*`rsa.identity.realm`*:: ++ +-- +Radius realm or similar grouping of accounts + +type: keyword + +-- + +*`rsa.identity.user_sid_dst`*:: ++ +-- +This key captures Destination User Session ID + +type: keyword + +-- + +*`rsa.identity.dn_src`*:: ++ +-- +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword + +-- + +*`rsa.identity.org`*:: ++ +-- +This key captures the User organization + +type: keyword + +-- + +*`rsa.identity.dn_dst`*:: ++ +-- +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn + +type: keyword + +-- + +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.lastname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.user_dept`*:: ++ +-- +User's Department Names only + +type: keyword + +-- + +*`rsa.identity.user_sid_src`*:: ++ +-- +This key captures Source User Session ID + +type: keyword + +-- + +*`rsa.identity.federated_sp`*:: ++ +-- +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword + +-- + +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword + +-- + +*`rsa.identity.logon_type_desc`*:: ++ +-- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. + +type: keyword + +-- + +*`rsa.identity.middlename`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.password`*:: ++ +-- +This key is for Passwords seen in any session, plain text or encrypted + +type: keyword + +-- + +*`rsa.identity.host_role`*:: ++ +-- +This key should only be used to capture the role of a Host Machine + +type: keyword + +-- + +*`rsa.identity.ldap`*:: ++ +-- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + +type: keyword + +-- + +*`rsa.identity.ldap_query`*:: ++ +-- +This key is the Search criteria from an LDAP search + +type: keyword + +-- + +*`rsa.identity.ldap_response`*:: ++ +-- +This key is to capture Results from an LDAP search + +type: keyword + +-- + +*`rsa.identity.owner`*:: ++ +-- +This is used to capture username the process or service is running as, the author of the task + +type: keyword + +-- + +*`rsa.identity.service_account`*:: ++ +-- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage + +type: keyword + +-- + + +*`rsa.email.email_dst`*:: ++ +-- +This key is used to capture the Destination email address only, when the destination context is not clear use email + +type: keyword + +-- + +*`rsa.email.email_src`*:: ++ +-- +This key is used to capture the source email address only, when the source context is not clear use email + +type: keyword + +-- + +*`rsa.email.subject`*:: ++ +-- +This key is used to capture the subject string from an Email only. + +type: keyword + +-- + +*`rsa.email.email`*:: ++ +-- +This key is used to capture a generic email address where the source or destination context is not clear + +type: keyword + +-- + +*`rsa.email.trans_from`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + + +*`rsa.file.privilege`*:: ++ +-- +Deprecated, use permissions + +type: keyword + +-- + +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword + +-- + +*`rsa.file.filesystem`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.file.filename_dst`*:: ++ +-- +This is used to capture name of the file targeted by the action + +type: keyword + +-- + +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action + +type: keyword + +-- + +*`rsa.file.filename_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file + +type: keyword + +-- + +*`rsa.file.directory_src`*:: ++ +-- +This key is used to capture the directory of the source process or file + +type: keyword + +-- + +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double + +-- + +*`rsa.file.file_vendor`*:: ++ +-- +This is used to capture Company name of file located in version_info + +type: keyword + +-- + +*`rsa.file.task_name`*:: ++ +-- +This is used to capture name of the task + +type: keyword + +-- + + +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names + +type: keyword + +-- + +*`rsa.web.web_cookie`*:: ++ +-- +This key is used to capture the Web cookies specifically. + +type: keyword + +-- + +*`rsa.web.alias_host`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double + +-- + +*`rsa.web.web_ref_domain`*:: ++ +-- +Web referer's domain + +type: keyword + +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword + +-- + +*`rsa.web.remote_domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword + +-- + +*`rsa.web.web_ref_root`*:: ++ +-- +Web referer's root URL path + +type: keyword + +-- + +*`rsa.web.cn_asn_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlpage`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlroot`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_url`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_page`*:: ++ +-- +type: keyword + +-- + + +*`rsa.threat.threat_category`*:: ++ +-- +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: ++ +-- +This key is used to capture the threat description from the session directly or inferred + +type: keyword + +-- + +*`rsa.threat.alert`*:: ++ +-- +This key is used to capture name of the alert + +type: keyword + +-- + +*`rsa.threat.threat_source`*:: ++ +-- +This key is used to capture source of the threat + +type: keyword + +-- + + +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword + +-- + +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- + +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size + +type: long + +-- + +*`rsa.crypto.ike`*:: ++ +-- +IKE negotiation phase. + +type: keyword + +-- + +*`rsa.crypto.scheme`*:: ++ +-- +This key captures the Encryption scheme used + +type: keyword + +-- + +*`rsa.crypto.peer_id`*:: ++ +-- +This key is for Encryption peer’s identity + +type: keyword + +-- + +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type + +type: keyword + +-- + +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String + +type: keyword + +-- + +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher + +type: keyword + +-- + +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size + +type: long + +-- + +*`rsa.crypto.ssl_ver_src`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.d_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One + +type: keyword + +-- + +*`rsa.crypto.ike_cookie2`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase Two + +type: keyword + +-- + +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_cat`*:: ++ +-- +This key is used for the hostname category value of a certificate + +type: keyword + +-- + +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only + +type: keyword + +-- + +*`rsa.crypto.cert_status`*:: ++ +-- +This key captures Certificate validation status + +type: keyword + +-- + +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.cert_keysize`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_insact`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only + +type: keyword + +-- + +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword + +-- + + +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session + +type: keyword + +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword + +-- + +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names + +type: long + +-- + +*`rsa.wireless.wlan_name`*:: ++ +-- +This key captures either WLAN number/name + +type: keyword + +-- + + +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk + +type: keyword + +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. + +type: keyword + +-- + +*`rsa.storage.pwwn`*:: ++ +-- +This uniquely identifies a port on a HBA. + +type: keyword + +-- + + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + + +*`rsa.healthcare.patient_fname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient + +type: keyword + +-- + +*`rsa.healthcare.patient_lname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_mname`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: ++ +-- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + +type: keyword + +-- + +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key + +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: ++ +-- +This key captures values or decorators used within a registry entry + +type: keyword + +-- + +[[exported-fields-nginx]] +== Nginx fields + +Module for parsing the Nginx log files. + + + +[float] +=== nginx + +Fields from the Nginx log files. + + + +[float] +=== access + +Contains fields for the Nginx access logs. + + + +*`nginx.access.remote_ip_list`*:: ++ +-- +An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like `X-Forwarded-For`. Real source IP is restored to `source.ip`. + + +type: array + +-- + +*`nginx.access.body_sent.bytes`*:: ++ +-- +type: alias + +alias to: http.response.body.bytes + +-- + +*`nginx.access.user_name`*:: ++ +-- +type: alias + +alias to: user.name + +-- + +*`nginx.access.method`*:: ++ +-- +type: alias + +alias to: http.request.method + +-- + +*`nginx.access.url`*:: ++ +-- +type: alias + +alias to: url.original + +-- + +*`nginx.access.http_version`*:: ++ +-- +type: alias + +alias to: http.version + +-- + +*`nginx.access.response_code`*:: ++ +-- +type: alias + +alias to: http.response.status_code + +-- + +*`nginx.access.referrer`*:: ++ +-- +type: alias + +alias to: http.request.referrer + +-- + +*`nginx.access.agent`*:: ++ +-- +type: alias + +alias to: user_agent.original + +-- + + +*`nginx.access.user_agent.device`*:: ++ +-- +type: alias + +alias to: user_agent.device.name + +-- + +*`nginx.access.user_agent.name`*:: ++ +-- +type: alias + +alias to: user_agent.name + +-- + +*`nginx.access.user_agent.os`*:: ++ +-- +type: alias + +alias to: user_agent.os.full_name + +-- + +*`nginx.access.user_agent.os_name`*:: ++ +-- +type: alias + +alias to: user_agent.os.name + +-- + +*`nginx.access.user_agent.original`*:: ++ +-- +type: alias + +alias to: user_agent.original + +-- + + +*`nginx.access.geoip.continent_name`*:: ++ +-- +type: alias + +alias to: source.geo.continent_name + +-- + +*`nginx.access.geoip.country_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.country_iso_code + +-- + +*`nginx.access.geoip.location`*:: ++ +-- +type: alias + +alias to: source.geo.location + +-- + +*`nginx.access.geoip.region_name`*:: ++ +-- +type: alias + +alias to: source.geo.region_name + +-- + +*`nginx.access.geoip.city_name`*:: ++ +-- +type: alias + +alias to: source.geo.city_name + +-- + +*`nginx.access.geoip.region_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.region_iso_code + +-- + +[float] +=== error + +Contains fields for the Nginx error logs. + + + +*`nginx.error.connection_id`*:: ++ +-- +Connection identifier. + + +type: long + +-- + +*`nginx.error.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`nginx.error.pid`*:: ++ +-- +type: alias + +alias to: process.pid + +-- + +*`nginx.error.tid`*:: ++ +-- +type: alias + +alias to: process.thread.id + +-- + +*`nginx.error.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +[float] +=== ingress_controller + +Contains fields for the Ingress Nginx controller access logs. + + + +*`nginx.ingress_controller.remote_ip_list`*:: ++ +-- +An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like `X-Forwarded-For`. Real source IP is restored to `source.ip`. + + +type: array + +-- + +*`nginx.ingress_controller.http.request.length`*:: ++ +-- +The request length (including request line, header, and request body) + + +type: long + +format: bytes + +-- + +*`nginx.ingress_controller.http.request.time`*:: ++ +-- +Time elapsed since the first bytes were read from the client + + +type: double + +format: duration + +-- + +*`nginx.ingress_controller.upstream.name`*:: ++ +-- +The name of the upstream. + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.alternative_name`*:: ++ +-- +The name of the alternative upstream. + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.response.length`*:: ++ +-- +The length of the response obtained from the upstream server + + +type: long + +format: bytes + +-- + +*`nginx.ingress_controller.upstream.response.time`*:: ++ +-- +The time spent on receiving the response from the upstream server as seconds with millisecond resolution + + +type: double + +format: duration + +-- + +*`nginx.ingress_controller.upstream.response.status_code`*:: ++ +-- +The status code of the response obtained from the upstream server + + +type: long + +-- + +*`nginx.ingress_controller.http.request.id`*:: ++ +-- +The randomly generated ID of the request + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.ip`*:: ++ +-- +The IP address of the upstream server. If several servers were contacted during request processing, their addresses are separated by commas. + + +type: ip + +-- + +*`nginx.ingress_controller.upstream.port`*:: ++ +-- +The port of the upstream server. + + +type: long + +-- + +*`nginx.ingress_controller.body_sent.bytes`*:: ++ +-- +type: alias + +alias to: http.response.body.bytes + +-- + +*`nginx.ingress_controller.user_name`*:: ++ +-- +type: alias + +alias to: user.name + +-- + +*`nginx.ingress_controller.method`*:: ++ +-- +type: alias + +alias to: http.request.method + +-- + +*`nginx.ingress_controller.url`*:: ++ +-- +type: alias + +alias to: url.original + +-- + +*`nginx.ingress_controller.http_version`*:: ++ +-- +type: alias + +alias to: http.version + +-- + +*`nginx.ingress_controller.response_code`*:: ++ +-- +type: alias + +alias to: http.response.status_code + +-- + +*`nginx.ingress_controller.referrer`*:: ++ +-- +type: alias + +alias to: http.request.referrer + +-- + +*`nginx.ingress_controller.agent`*:: ++ +-- +type: alias + +alias to: user_agent.original + +-- + + +*`nginx.ingress_controller.user_agent.device`*:: ++ +-- +type: alias + +alias to: user_agent.device.name + +-- + +*`nginx.ingress_controller.user_agent.name`*:: ++ +-- +type: alias + +alias to: user_agent.name + +-- + +*`nginx.ingress_controller.user_agent.os`*:: ++ +-- +type: alias + +alias to: user_agent.os.full_name + +-- + +*`nginx.ingress_controller.user_agent.os_name`*:: ++ +-- +type: alias + +alias to: user_agent.os.name + +-- + +*`nginx.ingress_controller.user_agent.original`*:: ++ +-- +type: alias + +alias to: user_agent.original + +-- + + +*`nginx.ingress_controller.geoip.continent_name`*:: ++ +-- +type: alias + +alias to: source.geo.continent_name + +-- + +*`nginx.ingress_controller.geoip.country_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.country_iso_code + +-- + +*`nginx.ingress_controller.geoip.location`*:: ++ +-- +type: alias + +alias to: source.geo.location + +-- + +*`nginx.ingress_controller.geoip.region_name`*:: ++ +-- +type: alias + +alias to: source.geo.region_name + +-- + +*`nginx.ingress_controller.geoip.city_name`*:: ++ +-- +type: alias + +alias to: source.geo.city_name + +-- + +*`nginx.ingress_controller.geoip.region_iso_code`*:: ++ +-- +type: alias + +alias to: source.geo.region_iso_code + +-- + +[[exported-fields-o365]] +== Office 365 fields + +Module for handling logs from Office 365. + + + +[float] +=== o365.audit + +Fields from Office 365 Management API audit logs. + + + +*`o365.audit.Actor`*:: ++ +-- +type: array + +-- + +*`o365.audit.ActorContextId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ActorIpAddress`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ActorUserId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ActorYammerUserId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.AlertEntityId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.AlertId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.AlertLinks`*:: ++ +-- +type: array + +-- + +*`o365.audit.AlertType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.AppId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ApplicationDisplayName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ApplicationId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.AzureActiveDirectoryEventType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ExchangeMetaData.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.Category`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ClientAppId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ClientInfoString`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ClientIP`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ClientIPAddress`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Comments`*:: ++ +-- +type: text + +-- + +*`o365.audit.CorrelationId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.CreationTime`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.CustomUniqueId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Data`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.DataType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.EntityType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.EventData`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.EventSource`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ExceptionInfo.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.ExtendedProperties.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.ExternalAccess`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.GroupName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Id`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ImplicitShare`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.IncidentId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.InternalLogonType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.InterSystemsId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.IntraSystemId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Item.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.Item.*.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.ItemName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ItemType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ListId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ListItemUniqueId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.LogonError`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.LogonType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.LogonUserSid`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.MailboxGuid`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.MailboxOwnerMasterAccountSid`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.MailboxOwnerSid`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.MailboxOwnerUPN`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Members`*:: ++ +-- +type: array + +-- + +*`o365.audit.Members.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.ModifiedProperties.*.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.Name`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ObjectId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Operation`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.OrganizationId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.OrganizationName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.OriginatingServer`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Parameters.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.PolicyDetails`*:: ++ +-- +type: array + +-- + +*`o365.audit.PolicyId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.RecordType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.ResultStatus`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SensitiveInfoDetectionIsIncluded`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SharePointMetaData.*`*:: ++ +-- +type: object + +-- + +*`o365.audit.SessionId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Severity`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Site`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SiteUrl`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Source`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SourceFileExtension`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SourceFileName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SourceRelativeUrl`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Status`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.SupportTicketId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Target`*:: ++ +-- +type: array + +-- + +*`o365.audit.TargetContextId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.TargetUserOrGroupName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.TargetUserOrGroupType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.TeamName`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.TeamGuid`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.UniqueSharingId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.UserAgent`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.UserId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.UserKey`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.UserType`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Version`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.WebId`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.Workload`*:: ++ +-- +type: keyword + +-- + +*`o365.audit.YammerNetworkId`*:: ++ +-- +type: keyword + +-- + +[[exported-fields-okta]] +== Okta fields + +Module for handling system logs from Okta. + + + +[float] +=== okta + +Fields from Okta. + + + +*`okta.uuid`*:: ++ +-- +The unique identifier of the Okta LogEvent. + + +type: keyword + +-- + +*`okta.event_type`*:: ++ +-- +The type of the LogEvent. + + +type: keyword + +-- + +*`okta.version`*:: ++ +-- +The version of the LogEvent. + + +type: keyword + +-- + +*`okta.severity`*:: ++ +-- +The severity of the LogEvent. Must be one of DEBUG, INFO, WARN, or ERROR. + + +type: keyword + +-- + +*`okta.display_message`*:: ++ +-- +The display message of the LogEvent. + + +type: keyword + +-- + +[float] +=== actor + +Fields that let you store information of the actor for the LogEvent. + + + +*`okta.actor.id`*:: ++ +-- +Identifier of the actor. + + +type: keyword + +-- + +*`okta.actor.type`*:: ++ +-- +Type of the actor. + + +type: keyword + +-- + +*`okta.actor.alternate_id`*:: ++ +-- +Alternate identifier of the actor. + + +type: keyword + +-- + +*`okta.actor.display_name`*:: ++ +-- +Display name of the actor. + + +type: keyword + +-- + +[float] +=== client + +Fields that let you store information about the client of the actor. + + + +*`okta.client.ip`*:: ++ +-- +The IP address of the client. + + +type: ip + +-- + +[float] +=== user_agent + +Fields about the user agent information of the client. + + + +*`okta.client.user_agent.raw_user_agent`*:: ++ +-- +The raw informaton of the user agent. + + +type: keyword + +-- + +*`okta.client.user_agent.os`*:: ++ +-- +The OS informaton. + + +type: keyword + +-- + +*`okta.client.user_agent.browser`*:: ++ +-- +The browser informaton of the client. + + +type: keyword + +-- + +*`okta.client.zone`*:: ++ +-- +The zone information of the client. + + +type: keyword + +-- + +*`okta.client.device`*:: ++ +-- +The information of the client device. + + +type: keyword + +-- + +*`okta.client.id`*:: ++ +-- +The identifier of the client. + + +type: keyword + +-- + +[float] +=== outcome + +Fields that let you store information about the outcome. + + + +*`okta.outcome.reason`*:: ++ +-- +The reason of the outcome. + + +type: keyword + +-- + +*`okta.outcome.result`*:: ++ +-- +The result of the outcome. Must be one of: SUCCESS, FAILURE, SKIPPED, ALLOW, DENY, CHALLENGE, UNKNOWN. + + +type: keyword + +-- + +*`okta.target`*:: ++ +-- +The list of targets. + + +type: array + +-- + +[float] +=== transaction + +Fields that let you store information about related transaction. + + + +*`okta.transaction.id`*:: ++ +-- +Identifier of the transaction. + + +type: keyword + +-- + +*`okta.transaction.type`*:: ++ +-- +The type of transaction. Must be one of "WEB", "JOB". + + +type: keyword + +-- + +[float] +=== debug_context + +Fields that let you store information about the debug context. + + + +[float] +=== debug_data + +The debug data. + + + +*`okta.debug_context.debug_data.device_fingerprint`*:: ++ +-- +The fingerprint of the device. + + +type: keyword + +-- + +*`okta.debug_context.debug_data.request_id`*:: ++ +-- +The identifier of the request. + + +type: keyword + +-- + +*`okta.debug_context.debug_data.request_uri`*:: ++ +-- +The request URI. + + +type: keyword + +-- + +*`okta.debug_context.debug_data.threat_suspected`*:: ++ +-- +Threat suspected. + + +type: keyword + +-- + +*`okta.debug_context.debug_data.url`*:: ++ +-- +The URL. + + +type: keyword + +-- + +[float] +=== authentication_context + +Fields that let you store information about authentication context. + + + +*`okta.authentication_context.authentication_provider`*:: ++ +-- +The information about the authentication provider. Must be one of OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, FACTOR_PROVIDER. + + +type: keyword + +-- + +*`okta.authentication_context.authentication_step`*:: ++ +-- +The authentication step. + + +type: integer + +-- + +*`okta.authentication_context.credential_provider`*:: ++ +-- +The information about credential provider. Must be one of OKTA_CREDENTIAL_PROVIDER, RSA, SYMANTEC, GOOGLE, DUO, YUBIKEY. + + +type: keyword + +-- + +*`okta.authentication_context.credential_type`*:: ++ +-- +The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID. + + +type: keyword + +-- + +*`okta.authentication_context.issuer`*:: ++ +-- +The information about the issuer. + + +type: array + +-- + +*`okta.authentication_context.external_session_id`*:: ++ +-- +The session identifer of the external session if any. + + +type: keyword + +-- + +*`okta.authentication_context.interface`*:: ++ +-- +The interface used. e.g., Outlook, Office365, wsTrust + + +type: keyword + +-- + +[float] +=== security_context + +Fields that let you store information about security context. + + + +[float] +=== as + +The autonomous system. + + + +*`okta.security_context.as.number`*:: ++ +-- +The AS number. + + +type: integer + +-- + +[float] +=== organization + +The organization that owns the AS number. + + + +*`okta.security_context.as.organization.name`*:: ++ +-- +The organization name. + + +type: keyword + +-- + +*`okta.security_context.isp`*:: ++ +-- +The Internet Service Provider. + + +type: keyword + +-- + +*`okta.security_context.domain`*:: ++ +-- +The domain name. + + +type: keyword + +-- + +*`okta.security_context.is_proxy`*:: ++ +-- +Whether it is a proxy or not. + + +type: boolean + +-- + +[float] +=== request + +Fields that let you store information about the request, in the form of list of ip_chain. + + + +[float] +=== ip_chain + +List of ip_chain objects. + + + +*`okta.request.ip_chain.ip`*:: ++ +-- +IP address. + + +type: ip + +-- + +*`okta.request.ip_chain.version`*:: ++ +-- +IP version. Must be one of V4, V6. + + +type: keyword + +-- + +*`okta.request.ip_chain.source`*:: ++ +-- +Source information. + + +type: keyword + +-- + +[float] +=== geographical_context + +Geographical information. + + + +*`okta.request.ip_chain.geographical_context.city`*:: ++ +-- +The city. + +type: keyword + +-- + +*`okta.request.ip_chain.geographical_context.state`*:: ++ +-- +The state. + +type: keyword + +-- + +*`okta.request.ip_chain.geographical_context.postal_code`*:: ++ +-- +The postal code. + +type: keyword + +-- + +*`okta.request.ip_chain.geographical_context.country`*:: ++ +-- +The country. + +type: keyword + +-- + +*`okta.request.ip_chain.geographical_context.geolocation`*:: ++ +-- +Geolocation information. + + +type: geo_point + +-- + +[[exported-fields-osquery]] +== Osquery fields + +Fields exported by the `osquery` module + + + +[float] +=== osquery + + + + +[float] +=== result + +Common fields exported by the result metricset. + + + +*`osquery.result.name`*:: ++ +-- +The name of the query that generated this event. + + +type: keyword + +-- + +*`osquery.result.action`*:: ++ +-- +For incremental data, marks whether the entry was added or removed. It can be one of "added", "removed", or "snapshot". + + +type: keyword + +-- + +*`osquery.result.host_identifier`*:: ++ +-- +The identifier for the host on which the osquery agent is running. Normally the hostname. + + +type: keyword + +-- + +*`osquery.result.unix_time`*:: ++ +-- +Unix timestamp of the event, in seconds since the epoch. Used for computing the `@timestamp` column. + + +type: long + +-- + +*`osquery.result.calendar_time`*:: ++ +-- +String representation of the collection time, as formatted by osquery. + + +type: keyword + +-- + +[[exported-fields-panw]] +== panw fields + +Module for Palo Alto Networks (PAN-OS) + + + +[float] +=== panw + +Fields from the panw module. + + + +[float] +=== panos + +Fields for the Palo Alto Networks PAN-OS logs. + + + +*`panw.panos.ruleset`*:: ++ +-- +Name of the rule that matched this session. + + +type: keyword + +-- + +[float] +=== source + +Fields to extend the top-level source object. + + + +*`panw.panos.source.zone`*:: ++ +-- +Source zone for this session. + + +type: keyword + +-- + +*`panw.panos.source.interface`*:: ++ +-- +Source interface for this session. + + +type: keyword + +-- + +[float] +=== nat + +Post-NAT source address, if source NAT is performed. + + + +*`panw.panos.source.nat.ip`*:: ++ +-- +Post-NAT source IP. + + +type: ip + +-- + +*`panw.panos.source.nat.port`*:: ++ +-- +Post-NAT source port. + + +type: long + +-- + +[float] +=== destination + +Fields to extend the top-level destination object. + + + +*`panw.panos.destination.zone`*:: ++ +-- +Destination zone for this session. + + +type: keyword + +-- + +*`panw.panos.destination.interface`*:: ++ +-- +Destination interface for this session. + + +type: keyword + +-- + +[float] +=== nat + +Post-NAT destination address, if destination NAT is performed. + + + +*`panw.panos.destination.nat.ip`*:: ++ +-- +Post-NAT destination IP. + + +type: ip + +-- + +*`panw.panos.destination.nat.port`*:: ++ +-- +Post-NAT destination port. + + +type: long + +-- + +*`panw.panos.endreason`*:: ++ +-- +The reason a session terminated. + + +type: keyword + +-- + +[float] +=== network + +Fields to extend the top-level network object. + + + +*`panw.panos.network.pcap_id`*:: ++ +-- +Packet capture ID for a threat. + + +type: keyword + +-- + + +*`panw.panos.network.nat.community_id`*:: ++ +-- +Community ID flow-hash for the NAT 5-tuple. + + +type: keyword + +-- + +[float] +=== file + +Fields to extend the top-level file object. + + + +*`panw.panos.file.hash`*:: ++ +-- +Binary hash for a threat file sent to be analyzed by the WildFire service. + + +type: keyword + +-- + +[float] +=== url + +Fields to extend the top-level url object. + + + +*`panw.panos.url.category`*:: ++ +-- +For threat URLs, it's the URL category. For WildFire, the verdict on the file and is either 'malicious', 'grayware', or 'benign'. + + +type: keyword + +-- + +*`panw.panos.flow_id`*:: ++ +-- +Internal numeric identifier for each session. + + +type: keyword + +-- + +*`panw.panos.sequence_number`*:: ++ +-- +Log entry identifier that is incremented sequentially. Unique for each log type. + + +type: long + +-- + +*`panw.panos.threat.resource`*:: ++ +-- +URL or file name for a threat. + + +type: keyword + +-- + +*`panw.panos.threat.id`*:: ++ +-- +Palo Alto Networks identifier for the threat. + + +type: keyword + +-- + +*`panw.panos.threat.name`*:: ++ +-- +Palo Alto Networks name for the threat. + + +type: keyword + +-- + +*`panw.panos.action`*:: ++ +-- +Action taken for the session. + +type: keyword + +-- + +*`panw.panos.type`*:: ++ +-- +Specifies the type of the log + +-- + +*`panw.panos.sub_type`*:: ++ +-- +Specifies the sub type of the log + +-- + +[[exported-fields-postgresql]] +== PostgreSQL fields + +Module for parsing the PostgreSQL log files. + + + +[float] +=== postgresql + +Fields from PostgreSQL logs. + + + +[float] +=== log + +Fields from the PostgreSQL log files. + + + +*`postgresql.log.timestamp`*:: ++ +-- + +deprecated:[7.3.0] + +The timestamp from the log line. + + +-- + +*`postgresql.log.core_id`*:: ++ +-- +Core id + + +type: long + +-- + +*`postgresql.log.database`*:: ++ +-- +Name of database + + +example: mydb + +-- + +*`postgresql.log.query`*:: ++ +-- +Query statement. + + +example: SELECT * FROM users; + +-- + +*`postgresql.log.query_step`*:: ++ +-- +Statement step when using extended query protocol (one of statement, parse, bind or execute) + + +example: parse + +-- + +*`postgresql.log.query_name`*:: ++ +-- +Name given to a query when using extended query protocol. If it is "", or not present, this field is ignored. + + +example: pdo_stmt_00000001 + +-- + +*`postgresql.log.error.code`*:: ++ +-- +Error code returned by Postgres (if any) + +type: long + +-- + +*`postgresql.log.timezone`*:: ++ +-- +type: alias + +alias to: event.timezone + +-- + +*`postgresql.log.thread_id`*:: ++ +-- +type: alias + +alias to: process.pid + +-- + +*`postgresql.log.user`*:: ++ +-- +type: alias + +alias to: user.name + +-- + +*`postgresql.log.level`*:: ++ +-- +type: alias + +alias to: log.level + +-- + +*`postgresql.log.message`*:: ++ +-- +type: alias + +alias to: message + +-- + +[[exported-fields-process]] +== Process fields + +Process metadata fields + + + + +*`process.exe`*:: ++ +-- +type: alias + +alias to: process.executable + +-- + +[[exported-fields-proofpoint]] +== Proofpoint Email Security fields + +proofpoint fields. + + + +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. + + +type: keyword + +-- + + + +*`rsa.internal.msg`*:: ++ +-- +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword + +-- + +*`rsa.internal.messageid`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.event_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.message`*:: ++ +-- +This key captures the contents of instant messages + +type: keyword + +-- + +*`rsa.internal.time`*:: ++ +-- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date + +-- + +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_server`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_val`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.statement`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.audit_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.entry`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.hcode`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.inode`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.cid`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_class`*:: ++ +-- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_group`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_host`*:: ++ +-- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_ip`*:: ++ +-- +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.did`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.entropy_req`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.entropy_res`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.event_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.feed_category`*:: ++ +-- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.forward_ip`*:: ++ +-- +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip + +-- + +*`rsa.internal.forward_ipv6`*:: ++ +-- +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.header_id`*:: ++ +-- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_cid`*:: ++ +-- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_ctime`*:: ++ +-- +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date + +-- + +*`rsa.internal.mcb_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcb_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcbc_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.mcbc_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.medium`*:: ++ +-- +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long + +-- + +*`rsa.internal.node_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.nwe_callback_id`*:: ++ +-- +This key denotes that event is endpoint related + +type: keyword + +-- + +*`rsa.internal.parse_error`*:: ++ +-- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.payload_req`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.payload_res`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.process_vid_dst`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + +type: keyword + +-- + +*`rsa.internal.process_vid_src`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + +type: keyword + +-- + +*`rsa.internal.rid`*:: ++ +-- +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.session_split`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.site`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.size`*:: ++ +-- +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.sourcefile`*:: ++ +-- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.ubc_req`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.ubc_res`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.word`*:: ++ +-- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + +type: keyword + +-- + + +*`rsa.time.event_time`*:: ++ +-- +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date + +-- + +*`rsa.time.duration_time`*:: ++ +-- +This key is used to capture the normalized duration/lifetime in seconds. + +type: double + +-- + +*`rsa.time.event_time_str`*:: ++ +-- +This key is used to capture the incomplete time mentioned in a session as a string + +type: keyword + +-- + +*`rsa.time.starttime`*:: ++ +-- +This key is used to capture the Start time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.day`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.endtime`*:: ++ +-- +This key is used to capture the End time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.timezone`*:: ++ +-- +This key is used to capture the timezone of the Event Time + +type: keyword + +-- + +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration + +type: keyword + +-- + +*`rsa.time.date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.recorded_time`*:: ++ +-- +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date + +-- + +*`rsa.time.datetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.effective_time`*:: ++ +-- +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date + +-- + +*`rsa.time.expire_time`*:: ++ +-- +This key is the timestamp that explicitly refers to an expiration. + +type: date + +-- + +*`rsa.time.process_time`*:: ++ +-- +Deprecated, use duration.time + +type: keyword + +-- + +*`rsa.time.hour`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.min`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.timestamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.event_queue_time`*:: ++ +-- +This key is the Time that the event was queued. + +type: date + +-- + +*`rsa.time.p_time1`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.tzone`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.eventtime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmtdate`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmttime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time2`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.expire_time_str`*:: ++ +-- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + +type: keyword + +-- + +*`rsa.time.stamp`*:: ++ +-- +Deprecated key defined only in table map. + +type: date + +-- + + +*`rsa.misc.action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.result`*:: ++ +-- +This key is used to capture the outcome/result string value of an action in a session. + +type: keyword + +-- + +*`rsa.misc.severity`*:: ++ +-- +This key is used to capture the severity given the session + +type: keyword + +-- + +*`rsa.misc.event_type`*:: ++ +-- +This key captures the event category type as specified by the event source. + +type: keyword + +-- + +*`rsa.misc.reference_id`*:: ++ +-- +This key is used to capture an event id from the session directly + +type: keyword + +-- + +*`rsa.misc.version`*:: ++ +-- +This key captures Version of the application or OS which is generating the event. + +type: keyword + +-- + +*`rsa.misc.disposition`*:: ++ +-- +This key captures the The end state of an action. + +type: keyword + +-- + +*`rsa.misc.result_code`*:: ++ +-- +This key is used to capture the outcome/result numeric value of an action in a session + +type: keyword + +-- + +*`rsa.misc.category`*:: ++ +-- +This key is used to capture the category of an event given by the vendor in the session + +type: keyword + +-- + +*`rsa.misc.obj_name`*:: ++ +-- +This is used to capture name of object + +type: keyword + +-- + +*`rsa.misc.obj_type`*:: ++ +-- +This is used to capture type of object + +type: keyword + +-- + +*`rsa.misc.event_source`*:: ++ +-- +This key captures Source of the event that’s not a hostname + +type: keyword + +-- + +*`rsa.misc.log_session_id`*:: ++ +-- +This key is used to capture a sessionid from the session directly + +type: keyword + +-- + +*`rsa.misc.group`*:: ++ +-- +This key captures the Group Name value + +type: keyword + +-- + +*`rsa.misc.policy_name`*:: ++ +-- +This key is used to capture the Policy Name only. + +type: keyword + +-- + +*`rsa.misc.rule_name`*:: ++ +-- +This key captures the Rule Name + +type: keyword + +-- + +*`rsa.misc.context`*:: ++ +-- +This key captures Information which adds additional context to the event. + +type: keyword + +-- + +*`rsa.misc.change_new`*:: ++ +-- +This key is used to capture the new values of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.space`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client`*:: ++ +-- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword + +-- + +*`rsa.misc.msgIdPart1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.change_old`*:: ++ +-- +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.operation_id`*:: ++ +-- +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword + +-- + +*`rsa.misc.event_state`*:: ++ +-- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword + +-- + +*`rsa.misc.group_object`*:: ++ +-- +This key captures a collection/grouping of entities. Specific usage + +type: keyword + +-- + +*`rsa.misc.node`*:: ++ +-- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword + +-- + +*`rsa.misc.rule`*:: ++ +-- +This key captures the Rule number + +type: keyword + +-- + +*`rsa.misc.device_name`*:: ++ +-- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword + +-- + +*`rsa.misc.param`*:: ++ +-- +This key is the parameters passed as part of a command or application, etc. + +type: keyword + +-- + +*`rsa.misc.change_attrib`*:: ++ +-- +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.event_computer`*:: ++ +-- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword + +-- + +*`rsa.misc.reference_id1`*:: ++ +-- +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword + +-- + +*`rsa.misc.event_log`*:: ++ +-- +This key captures the Name of the event log + +type: keyword + +-- + +*`rsa.misc.OS`*:: ++ +-- +This key captures the Name of the Operating System + +type: keyword + +-- + +*`rsa.misc.terminal`*:: ++ +-- +This key captures the Terminal Names only + +type: keyword + +-- + +*`rsa.misc.msgIdPart3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.filter`*:: ++ +-- +This key captures Filter used to reduce result set + +type: keyword + +-- + +*`rsa.misc.serial_number`*:: ++ +-- +This key is the Serial number associated with a physical asset. + +type: keyword + +-- + +*`rsa.misc.checksum`*:: ++ +-- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword + +-- + +*`rsa.misc.event_user`*:: ++ +-- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword + +-- + +*`rsa.misc.virusname`*:: ++ +-- +This key captures the name of the virus + +type: keyword + +-- + +*`rsa.misc.content_type`*:: ++ +-- +This key is used to capture Content Type only. + +type: keyword + +-- + +*`rsa.misc.group_id`*:: ++ +-- +This key captures Group ID Number (related to the group name) + +type: keyword + +-- + +*`rsa.misc.policy_id`*:: ++ +-- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword + +-- + +*`rsa.misc.vsys`*:: ++ +-- +This key captures Virtual System Name + +type: keyword + +-- + +*`rsa.misc.connection_id`*:: ++ +-- +This key captures the Connection ID + +type: keyword + +-- + +*`rsa.misc.reference_id2`*:: ++ +-- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword + +-- + +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword + +-- + +*`rsa.misc.sig_id`*:: ++ +-- +This key captures IDS/IPS Int Signature ID + +type: long + +-- + +*`rsa.misc.port_name`*:: ++ +-- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword + +-- + +*`rsa.misc.rule_group`*:: ++ +-- +This key captures the Rule group name + +type: keyword + +-- + +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value + +type: double + +-- + +*`rsa.misc.trigger_val`*:: ++ +-- +This key captures the Value of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.log_session_id1`*:: ++ +-- +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword + +-- + +*`rsa.misc.comp_version`*:: ++ +-- +This key captures the Version level of a sub-component of a product. + +type: keyword + +-- + +*`rsa.misc.content_version`*:: ++ +-- +This key captures Version level of a signature or database content. + +type: keyword + +-- + +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword + +-- + +*`rsa.misc.risk`*:: ++ +-- +This key captures the non-numeric risk value + +type: keyword + +-- + +*`rsa.misc.event_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.reason`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mail_id`*:: ++ +-- +This key is used to capture the mailbox id/name + +type: keyword + +-- + +*`rsa.misc.rule_uid`*:: ++ +-- +This key is the Unique Identifier for a rule. + +type: keyword + +-- + +*`rsa.misc.trigger_desc`*:: ++ +-- +This key captures the Description of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.inout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.data_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.error`*:: ++ +-- +This key captures All non successful Error codes or responses + +type: keyword + +-- + +*`rsa.misc.index`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.listnum`*:: ++ +-- +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword + +-- + +*`rsa.misc.ntype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.observed_val`*:: ++ +-- +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.policy_value`*:: ++ +-- +This key captures the contents of the policy. This contains details about the policy + +type: keyword + +-- + +*`rsa.misc.pool_name`*:: ++ +-- +This key captures the name of a resource pool + +type: keyword + +-- + +*`rsa.misc.rule_template`*:: ++ +-- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword + +-- + +*`rsa.misc.count`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigcat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comments`*:: ++ +-- +Comment information provided in the log message + +type: keyword + +-- + +*`rsa.misc.doc_number`*:: ++ +-- +This key captures File Identification number + +type: long + +-- + +*`rsa.misc.expected_val`*:: ++ +-- +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.job_num`*:: ++ +-- +This key captures the Job Number + +type: keyword + +-- + +*`rsa.misc.spi_dst`*:: ++ +-- +Destination SPI Index + +type: keyword + +-- + +*`rsa.misc.spi_src`*:: ++ +-- +Source SPI Index + +type: keyword + +-- + +*`rsa.misc.code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.agent_id`*:: ++ +-- +This key is used to capture agent id + +type: keyword + +-- + +*`rsa.misc.message_body`*:: ++ +-- +This key captures the The contents of the message body. + +type: keyword + +-- + +*`rsa.misc.phone`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sig_id_str`*:: ++ +-- +This key captures a string object of the sigid variable. + +type: keyword + +-- + +*`rsa.misc.cmd`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu`*:: ++ +-- +This key is the CPU time used in the execution of the event being recorded. + +type: long + +-- + +*`rsa.misc.event_desc`*:: ++ +-- +This key is used to capture a description of an event available directly or inferred + +type: keyword + +-- + +*`rsa.misc.sig_id1`*:: ++ +-- +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long + +-- + +*`rsa.misc.im_buddyid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_client`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.priority`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.context_subject`*:: ++ +-- +This key is to be used in an audit context where the subject is the object being identified + +type: keyword + +-- + +*`rsa.misc.context_target`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cve`*:: ++ +-- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword + +-- + +*`rsa.misc.fcatnum`*:: ++ +-- +This key captures Filter Category Number. Legacy Usage + +type: keyword + +-- + +*`rsa.misc.library`*:: ++ +-- +This key is used to capture library information in mainframe devices + +type: keyword + +-- + +*`rsa.misc.parent_node`*:: ++ +-- +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword + +-- + +*`rsa.misc.risk_info`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.tcp_flags`*:: ++ +-- +This key is captures the TCP flags set in any packet of session + +type: long + +-- + +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service + +type: long + +-- + +*`rsa.misc.vm_target`*:: ++ +-- +VMWare Target **VMWARE** only varaible. + +type: keyword + +-- + +*`rsa.misc.workspace`*:: ++ +-- +This key captures Workspace Description + +type: keyword + +-- + +*`rsa.misc.command`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.event_category`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facilityname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.forensic_info`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.jobname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy_waiver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.second`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.space1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.subcategory`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alert_id`*:: ++ +-- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword + +-- + +*`rsa.misc.checksum_src`*:: ++ +-- +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword + +-- + +*`rsa.misc.fresult`*:: ++ +-- +This key captures the Filter Result + +type: long + +-- + +*`rsa.misc.payload_dst`*:: ++ +-- +This key is used to capture destination payload + +type: keyword + +-- + +*`rsa.misc.payload_src`*:: ++ +-- +This key is used to capture source payload + +type: keyword + +-- + +*`rsa.misc.pool_id`*:: ++ +-- +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword + +-- + +*`rsa.misc.process_id_val`*:: ++ +-- +This key is a failure key for Process ID when it is not an integer value + +type: keyword + +-- + +*`rsa.misc.risk_num_comm`*:: ++ +-- +This key captures Risk Number Community + +type: double + +-- + +*`rsa.misc.risk_num_next`*:: ++ +-- +This key captures Risk Number NextGen + +type: double + +-- + +*`rsa.misc.risk_num_sand`*:: ++ +-- +This key captures Risk Number SandBox + +type: double + +-- + +*`rsa.misc.risk_num_static`*:: ++ +-- +This key captures Risk Number Static + +type: double + +-- + +*`rsa.misc.risk_suspicious`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.risk_warning`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.snmp_oid`*:: ++ +-- +SNMP Object Identifier + +type: keyword + +-- + +*`rsa.misc.sql`*:: ++ +-- +This key captures the SQL query + +type: keyword + +-- + +*`rsa.misc.vuln_ref`*:: ++ +-- +This key captures the Vulnerability Reference details + +type: keyword + +-- + +*`rsa.misc.acl_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_op`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_pos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_table`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.admin`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarm_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarmname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.app_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.auditdata`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.benchmark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.bypass`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache_hit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cefversion`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_attr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_obj`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_path`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.changes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client_ip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.clustermembers`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_acttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_asn_src`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_bgpv4nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ctr_dst_code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_f_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampintv`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampmode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inacttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermbyts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermpckts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_invalid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ip_proto_ver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ipv4_ident`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_l_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_did`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_rid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_max_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_maxpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_min_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_minpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_10`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_5`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_6`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_7`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_8`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_9`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_byt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_pks`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_muligmptype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampalgo`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampint`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_seqctr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_spackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sysuptime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_template_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totbytsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totflowexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totpcktsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_unixnanosecs`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6flowlabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6optheaders`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_rbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_sbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.criticality`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_agency_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_analyzedby`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_other`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_primary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_secondary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bgpv6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bit9status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_context`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_control`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_dst_tld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_dst_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_src_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_event_uuid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_filetype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ip_next_hop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4dstpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4srcpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_lifetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_log_medium`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_loginname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulescore`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulesign`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_opswatresult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_payload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrant`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrar`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_represult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_rpayload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sampler_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sourcemodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_streams`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_targetmodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_v6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_whois_server`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_yararesult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.description`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.devvendor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.distance`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.dstburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomaub`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.euid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facility`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.finterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.flags`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.gaddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.id3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_buddyname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomtype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_members`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipspri`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.latitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.linenum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.list_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.load_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_floor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_mark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.longitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.lport`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mbug_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.netsessid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.nwwn`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.operation`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.opkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.orig_from`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.owner_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_filter`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_group_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_result1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_chg`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permgranted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permwanted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.prog_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.program`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.real_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_device`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_library`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ruid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sdomain_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sec`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sensorname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.seqnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.session`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.spi`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcservice`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.state`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.svcno`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.system`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.threshold`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.udb_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.url_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.user_div`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.username_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.v_instafname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.virt_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.vpnid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.autorun_type`*:: ++ +-- +This is used to capture Auto Run type + +type: keyword + +-- + +*`rsa.misc.cc_number`*:: ++ +-- +Valid Credit Card Numbers only + +type: long + +-- + +*`rsa.misc.content`*:: ++ +-- +This key captures the content type from protocol headers + +type: keyword + +-- + +*`rsa.misc.ein_number`*:: ++ +-- +Employee Identification Numbers only + +type: long + +-- + +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match + +type: keyword + +-- + +*`rsa.misc.language`*:: ++ +-- +This is used to capture list of languages the client support and what it prefers + +type: keyword + +-- + +*`rsa.misc.lifetime`*:: ++ +-- +This key is used to capture the session lifetime in seconds. + +type: long + +-- + +*`rsa.misc.link`*:: ++ +-- +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.misc.match`*:: ++ +-- +This key is for regex match name from search.ini + +type: keyword + +-- + +*`rsa.misc.param_dst`*:: ++ +-- +This key captures the command line/launch argument of the target process or file + +type: keyword + +-- + +*`rsa.misc.param_src`*:: ++ +-- +This key captures source parameter + +type: keyword + +-- + +*`rsa.misc.search_text`*:: ++ +-- +This key captures the Search Text used + +type: keyword + +-- + +*`rsa.misc.sig_name`*:: ++ +-- +This key is used to capture the Signature Name only. + +type: keyword + +-- + +*`rsa.misc.snmp_value`*:: ++ +-- +SNMP set request value + +type: keyword + +-- + +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session + +type: long + +-- + + +*`rsa.db.index`*:: ++ +-- +This key captures IndexID of the index. + +type: keyword + +-- + +*`rsa.db.instance`*:: ++ +-- +This key is used to capture the database server instance name + +type: keyword + +-- + +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session + +type: keyword + +-- + +*`rsa.db.permissions`*:: ++ +-- +This key captures permission or privilege level assigned to a resource. + +type: keyword + +-- + +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name + +type: keyword + +-- + +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database + +type: keyword + +-- + +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server + +type: long + +-- + +*`rsa.db.lread`*:: ++ +-- +This key is used for the number of logical reads + +type: long + +-- + +*`rsa.db.lwrite`*:: ++ +-- +This key is used for the number of logical writes + +type: long + +-- + +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes + +type: long + +-- + + +*`rsa.network.alias_host`*:: ++ +-- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword + +-- + +*`rsa.network.domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_dst`*:: ++ +-- +This key should only be used when it’s a Destination Hostname + +type: keyword + +-- + +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names + +type: keyword + +-- + +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear + +type: keyword + +-- + +*`rsa.network.network_port`*:: ++ +-- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long + +-- + +*`rsa.network.eth_host`*:: ++ +-- +Deprecated, use alias.mac + +type: keyword + +-- + +*`rsa.network.sinterface`*:: ++ +-- +This key should only be used when it’s a Source Interface + +type: keyword + +-- + +*`rsa.network.dinterface`*:: ++ +-- +This key should only be used when it’s a Destination Interface + +type: keyword + +-- + +*`rsa.network.vlan`*:: ++ +-- +This key should only be used to capture the ID of the Virtual LAN + +type: long + +-- + +*`rsa.network.zone_src`*:: ++ +-- +This key should only be used when it’s a Source Zone. + +type: keyword + +-- + +*`rsa.network.zone`*:: ++ +-- +This key should be used when the source or destination context of a Zone is not clear + +type: keyword + +-- + +*`rsa.network.zone_dst`*:: ++ +-- +This key should only be used when it’s a Destination Zone. + +type: keyword + +-- + +*`rsa.network.gateway`*:: ++ +-- +This key is used to capture the IP Address of the gateway + +type: keyword + +-- + +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only + +type: long + +-- + +*`rsa.network.mask`*:: ++ +-- +This key is used to capture the device network IPmask. + +type: keyword + +-- + +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only + +type: long + +-- + +*`rsa.network.protocol_detail`*:: ++ +-- +This key should be used to capture additional protocol information + +type: keyword + +-- + +*`rsa.network.dmask`*:: ++ +-- +This key is used for Destionation Device network mask + +type: keyword + +-- + +*`rsa.network.port`*:: ++ +-- +This key should only be used to capture a Network Port when the directionality is not clear + +type: long + +-- + +*`rsa.network.smask`*:: ++ +-- +This key is used for capturing source Network Mask + +type: keyword + +-- + +*`rsa.network.netname`*:: ++ +-- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword + +-- + +*`rsa.network.paddr`*:: ++ +-- +Deprecated + +type: ip + +-- + +*`rsa.network.faddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.lhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.origin`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.addr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_ptr_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fport`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.laddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.linterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.phost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.ad_computer_dst`*:: ++ +-- +Deprecated, use host.dst + +type: keyword + +-- + +*`rsa.network.eth_type`*:: ++ +-- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long + +-- + +*`rsa.network.ip_proto`*:: ++ +-- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long + +-- + +*`rsa.network.dns_cname_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_opcode`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_resp`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.domain1`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.packet_length`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_orig`*:: ++ +-- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword + +-- + +*`rsa.network.rpayload`*:: ++ +-- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword + +-- + +*`rsa.network.vlan_name`*:: ++ +-- +This key should only be used to capture the name of the Virtual LAN + +type: keyword + +-- + + +*`rsa.investigations.ec_activity`*:: ++ +-- +This key captures the particular event activity(Ex:Logoff) + +type: keyword + +-- + +*`rsa.investigations.ec_theme`*:: ++ +-- +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword + +-- + +*`rsa.investigations.ec_subject`*:: ++ +-- +This key captures the Subject of a particular Event(Ex:User) + +type: keyword + +-- + +*`rsa.investigations.ec_outcome`*:: ++ +-- +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword + +-- + +*`rsa.investigations.event_cat`*:: ++ +-- +This key captures the Event category number + +type: long + +-- + +*`rsa.investigations.event_cat_name`*:: ++ +-- +This key captures the event category name corresponding to the event cat code + +type: keyword + +-- + +*`rsa.investigations.event_vcat`*:: ++ +-- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword + +-- + +*`rsa.investigations.analysis_file`*:: ++ +-- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + +type: keyword + +-- + +*`rsa.investigations.analysis_service`*:: ++ +-- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword + +-- + +*`rsa.investigations.analysis_session`*:: ++ +-- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword + +-- + +*`rsa.investigations.boc`*:: ++ +-- +This is used to capture behaviour of compromise + +type: keyword + +-- + +*`rsa.investigations.eoc`*:: ++ +-- +This is used to capture Enablers of Compromise + +type: keyword + +-- + +*`rsa.investigations.inv_category`*:: ++ +-- +This used to capture investigation category + +type: keyword + +-- + +*`rsa.investigations.inv_context`*:: ++ +-- +This used to capture investigation context + +type: keyword + +-- + +*`rsa.investigations.ioc`*:: ++ +-- +This is key capture indicator of compromise + +type: keyword + +-- + + +*`rsa.counters.dclass_c1`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long + +-- + +*`rsa.counters.dclass_c2`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long + +-- + +*`rsa.counters.event_counter`*:: ++ +-- +This is used to capture the number of times an event repeated + +type: long + +-- + +*`rsa.counters.dclass_r1`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long + +-- + +*`rsa.counters.dclass_c1_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword + +-- + +*`rsa.counters.dclass_c2_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r1_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword + +-- + +*`rsa.counters.dclass_r2`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword + +-- + +*`rsa.counters.dclass_r2_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword + +-- + + +*`rsa.identity.auth_method`*:: ++ +-- +This key is used to capture authentication methods used only + +type: keyword + +-- + +*`rsa.identity.user_role`*:: ++ +-- +This key is used to capture the Role of a user only + +type: keyword + +-- + +*`rsa.identity.dn`*:: ++ +-- +X.500 (LDAP) Distinguished Name + +type: keyword + +-- + +*`rsa.identity.logon_type`*:: ++ +-- +This key is used to capture the type of logon method used. + +type: keyword + +-- + +*`rsa.identity.profile`*:: ++ +-- +This key is used to capture the user profile + +type: keyword + +-- + +*`rsa.identity.accesses`*:: ++ +-- +This key is used to capture actual privileges used in accessing an object + +type: keyword + +-- + +*`rsa.identity.realm`*:: ++ +-- +Radius realm or similar grouping of accounts + +type: keyword + +-- + +*`rsa.identity.user_sid_dst`*:: ++ +-- +This key captures Destination User Session ID + +type: keyword + +-- + +*`rsa.identity.dn_src`*:: ++ +-- +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword + +-- + +*`rsa.identity.org`*:: ++ +-- +This key captures the User organization + +type: keyword + +-- + +*`rsa.identity.dn_dst`*:: ++ +-- +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn + +type: keyword + +-- + +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.lastname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.user_dept`*:: ++ +-- +User's Department Names only + +type: keyword + +-- + +*`rsa.identity.user_sid_src`*:: ++ +-- +This key captures Source User Session ID + +type: keyword + +-- + +*`rsa.identity.federated_sp`*:: ++ +-- +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword + +-- + +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword + +-- + +*`rsa.identity.logon_type_desc`*:: ++ +-- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. + +type: keyword + +-- + +*`rsa.identity.middlename`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.password`*:: ++ +-- +This key is for Passwords seen in any session, plain text or encrypted + +type: keyword + +-- + +*`rsa.identity.host_role`*:: ++ +-- +This key should only be used to capture the role of a Host Machine + +type: keyword + +-- + +*`rsa.identity.ldap`*:: ++ +-- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + +type: keyword + +-- + +*`rsa.identity.ldap_query`*:: ++ +-- +This key is the Search criteria from an LDAP search + +type: keyword + +-- + +*`rsa.identity.ldap_response`*:: ++ +-- +This key is to capture Results from an LDAP search + +type: keyword + +-- + +*`rsa.identity.owner`*:: ++ +-- +This is used to capture username the process or service is running as, the author of the task + +type: keyword + +-- + +*`rsa.identity.service_account`*:: ++ +-- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage + +type: keyword + +-- + + +*`rsa.email.email_dst`*:: ++ +-- +This key is used to capture the Destination email address only, when the destination context is not clear use email + +type: keyword + +-- + +*`rsa.email.email_src`*:: ++ +-- +This key is used to capture the source email address only, when the source context is not clear use email + +type: keyword + +-- + +*`rsa.email.subject`*:: ++ +-- +This key is used to capture the subject string from an Email only. + +type: keyword + +-- + +*`rsa.email.email`*:: ++ +-- +This key is used to capture a generic email address where the source or destination context is not clear + +type: keyword + +-- + +*`rsa.email.trans_from`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + + +*`rsa.file.privilege`*:: ++ +-- +Deprecated, use permissions + +type: keyword + +-- + +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword + +-- + +*`rsa.file.filesystem`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.file.filename_dst`*:: ++ +-- +This is used to capture name of the file targeted by the action + +type: keyword + +-- + +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action + +type: keyword + +-- + +*`rsa.file.filename_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file + +type: keyword + +-- + +*`rsa.file.directory_src`*:: ++ +-- +This key is used to capture the directory of the source process or file + +type: keyword + +-- + +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double + +-- + +*`rsa.file.file_vendor`*:: ++ +-- +This is used to capture Company name of file located in version_info + +type: keyword + +-- + +*`rsa.file.task_name`*:: ++ +-- +This is used to capture name of the task + +type: keyword + +-- + + +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names + +type: keyword + +-- + +*`rsa.web.web_cookie`*:: ++ +-- +This key is used to capture the Web cookies specifically. + +type: keyword + +-- + +*`rsa.web.alias_host`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double + +-- + +*`rsa.web.web_ref_domain`*:: ++ +-- +Web referer's domain + +type: keyword + +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword + +-- + +*`rsa.web.remote_domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword + +-- + +*`rsa.web.web_ref_root`*:: ++ +-- +Web referer's root URL path + +type: keyword + +-- + +*`rsa.web.cn_asn_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlpage`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.urlroot`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_url`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword + +-- + +*`rsa.web.web_page`*:: ++ +-- +type: keyword + +-- + + +*`rsa.threat.threat_category`*:: ++ +-- +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: ++ +-- +This key is used to capture the threat description from the session directly or inferred + +type: keyword + +-- + +*`rsa.threat.alert`*:: ++ +-- +This key is used to capture name of the alert + +type: keyword + +-- + +*`rsa.threat.threat_source`*:: ++ +-- +This key is used to capture source of the threat + +type: keyword + +-- + + +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword + +-- + +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- + +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size + +type: long + +-- + +*`rsa.crypto.ike`*:: ++ +-- +IKE negotiation phase. + +type: keyword + +-- + +*`rsa.crypto.scheme`*:: ++ +-- +This key captures the Encryption scheme used + +type: keyword + +-- + +*`rsa.crypto.peer_id`*:: ++ +-- +This key is for Encryption peer’s identity + +type: keyword + +-- + +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type + +type: keyword + +-- + +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String + +type: keyword + +-- + +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher + +type: keyword + +-- + +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size + +type: long + +-- + +*`rsa.crypto.ssl_ver_src`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.d_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One + +type: keyword + +-- + +*`rsa.crypto.ike_cookie2`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase Two + +type: keyword + +-- + +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_host_cat`*:: ++ +-- +This key is used for the hostname category value of a certificate + +type: keyword + +-- + +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only + +type: keyword + +-- + +*`rsa.crypto.cert_status`*:: ++ +-- +This key captures Certificate validation status + +type: keyword + +-- + +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version + +type: keyword + +-- + +*`rsa.crypto.cert_keysize`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_insact`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword + +-- + +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only + +type: keyword + +-- + +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword + +-- + + +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session + +type: keyword + +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword + +-- + +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names + +type: long + +-- + +*`rsa.wireless.wlan_name`*:: ++ +-- +This key captures either WLAN number/name + +type: keyword + +-- + + +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk + +type: keyword + +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. + +type: keyword + +-- + +*`rsa.storage.pwwn`*:: ++ +-- +This uniquely identifies a port on a HBA. + +type: keyword + +-- + + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword + +-- + + +*`rsa.healthcare.patient_fname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient + +type: keyword + +-- + +*`rsa.healthcare.patient_lname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.healthcare.patient_mname`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: ++ +-- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + +type: keyword + +-- + +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key + +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: ++ +-- +This key captures values or decorators used within a registry entry + +type: keyword + +-- + +[[exported-fields-rabbitmq]] +== RabbitMQ fields + +RabbitMQ Module + + + +[float] +=== rabbitmq + + + + +[float] +=== log + +RabbitMQ log files + + + +*`rabbitmq.log.pid`*:: ++ +-- +The Erlang process id + +type: keyword + +example: <0.222.0> + +-- + +[[exported-fields-radware]] +== Radware DefensePro fields + +radware fields. + + + +*`network.interface.name`*:: ++ +-- +Name of the network interface where the traffic has been observed. + + +type: keyword + +-- + + + +*`rsa.internal.msg`*:: ++ +-- +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword + +-- + +*`rsa.internal.messageid`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.event_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.internal.message`*:: ++ +-- +This key captures the contents of instant messages + +type: keyword + +-- + +*`rsa.internal.time`*:: ++ +-- +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date + +-- + +*`rsa.internal.level`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.msg_id`*:: ++ +-- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.msg_vid`*:: ++ +-- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.data`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_server`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_val`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.resource`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.obj_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.statement`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.audit_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.entry`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.hcode`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.inode`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.resource_class`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.dead`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.feed_desc`*:: ++ +-- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.feed_name`*:: ++ +-- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.cid`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_class`*:: ++ +-- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_group`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_host`*:: ++ +-- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_ip`*:: ++ +-- +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_ipv6`*:: ++ +-- +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.device_type_id`*:: ++ +-- +Deprecated key defined only in table map. + +type: long + +-- + +*`rsa.internal.did`*:: ++ +-- +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.entropy_req`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.entropy_res`*:: ++ +-- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long + +-- + +*`rsa.internal.event_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.feed_category`*:: ++ +-- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.forward_ip`*:: ++ +-- +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip + +-- + +*`rsa.internal.forward_ipv6`*:: ++ +-- +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.header_id`*:: ++ +-- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_cid`*:: ++ +-- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.lc_ctime`*:: ++ +-- +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date + +-- + +*`rsa.internal.mcb_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcb_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long + +-- + +*`rsa.internal.mcbc_req`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.mcbc_res`*:: ++ +-- +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long + +-- + +*`rsa.internal.medium`*:: ++ +-- +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long + +-- + +*`rsa.internal.node_name`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.nwe_callback_id`*:: ++ +-- +This key denotes that event is endpoint related + +type: keyword + +-- + +*`rsa.internal.parse_error`*:: ++ +-- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.payload_req`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.payload_res`*:: ++ +-- +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long + +-- + +*`rsa.internal.process_vid_dst`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + +type: keyword + +-- + +*`rsa.internal.process_vid_src`*:: ++ +-- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + +type: keyword + +-- + +*`rsa.internal.rid`*:: ++ +-- +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.session_split`*:: ++ +-- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.site`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword + +-- + +*`rsa.internal.size`*:: ++ +-- +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long + +-- + +*`rsa.internal.sourcefile`*:: ++ +-- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.internal.ubc_req`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.ubc_res`*:: ++ +-- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long + +-- + +*`rsa.internal.word`*:: ++ +-- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + +type: keyword + +-- + + +*`rsa.time.event_time`*:: ++ +-- +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date + +-- + +*`rsa.time.duration_time`*:: ++ +-- +This key is used to capture the normalized duration/lifetime in seconds. + +type: double + +-- + +*`rsa.time.event_time_str`*:: ++ +-- +This key is used to capture the incomplete time mentioned in a session as a string + +type: keyword + +-- + +*`rsa.time.starttime`*:: ++ +-- +This key is used to capture the Start time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.day`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.endtime`*:: ++ +-- +This key is used to capture the End time mentioned in a session in a standard form + +type: date + +-- + +*`rsa.time.timezone`*:: ++ +-- +This key is used to capture the timezone of the Event Time + +type: keyword + +-- + +*`rsa.time.duration_str`*:: ++ +-- +A text string version of the duration + +type: keyword + +-- + +*`rsa.time.date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.recorded_time`*:: ++ +-- +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date + +-- + +*`rsa.time.datetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.effective_time`*:: ++ +-- +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date + +-- + +*`rsa.time.expire_time`*:: ++ +-- +This key is the timestamp that explicitly refers to an expiration. + +type: date + +-- + +*`rsa.time.process_time`*:: ++ +-- +Deprecated, use duration.time + +type: keyword + +-- + +*`rsa.time.hour`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.min`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.timestamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.event_queue_time`*:: ++ +-- +This key is the Time that the event was queued. + +type: date + +-- + +*`rsa.time.p_time1`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.tzone`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.eventtime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmtdate`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.gmttime`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_date`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_month`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_time2`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.p_year`*:: ++ +-- +type: keyword + +-- + +*`rsa.time.expire_time_str`*:: ++ +-- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + +type: keyword + +-- + +*`rsa.time.stamp`*:: ++ +-- +Deprecated key defined only in table map. + +type: date + +-- + + +*`rsa.misc.action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.result`*:: ++ +-- +This key is used to capture the outcome/result string value of an action in a session. + +type: keyword + +-- + +*`rsa.misc.severity`*:: ++ +-- +This key is used to capture the severity given the session + +type: keyword + +-- + +*`rsa.misc.event_type`*:: ++ +-- +This key captures the event category type as specified by the event source. + +type: keyword + +-- + +*`rsa.misc.reference_id`*:: ++ +-- +This key is used to capture an event id from the session directly + +type: keyword + +-- + +*`rsa.misc.version`*:: ++ +-- +This key captures Version of the application or OS which is generating the event. + +type: keyword + +-- + +*`rsa.misc.disposition`*:: ++ +-- +This key captures the The end state of an action. + +type: keyword + +-- + +*`rsa.misc.result_code`*:: ++ +-- +This key is used to capture the outcome/result numeric value of an action in a session + +type: keyword + +-- + +*`rsa.misc.category`*:: ++ +-- +This key is used to capture the category of an event given by the vendor in the session + +type: keyword + +-- + +*`rsa.misc.obj_name`*:: ++ +-- +This is used to capture name of object + +type: keyword + +-- + +*`rsa.misc.obj_type`*:: ++ +-- +This is used to capture type of object + +type: keyword + +-- + +*`rsa.misc.event_source`*:: ++ +-- +This key captures Source of the event that’s not a hostname + +type: keyword + +-- + +*`rsa.misc.log_session_id`*:: ++ +-- +This key is used to capture a sessionid from the session directly + +type: keyword + +-- + +*`rsa.misc.group`*:: ++ +-- +This key captures the Group Name value + +type: keyword + +-- + +*`rsa.misc.policy_name`*:: ++ +-- +This key is used to capture the Policy Name only. + +type: keyword + +-- + +*`rsa.misc.rule_name`*:: ++ +-- +This key captures the Rule Name + +type: keyword + +-- + +*`rsa.misc.context`*:: ++ +-- +This key captures Information which adds additional context to the event. + +type: keyword + +-- + +*`rsa.misc.change_new`*:: ++ +-- +This key is used to capture the new values of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.space`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client`*:: ++ +-- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword + +-- + +*`rsa.misc.msgIdPart1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.change_old`*:: ++ +-- +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.operation_id`*:: ++ +-- +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword + +-- + +*`rsa.misc.event_state`*:: ++ +-- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword + +-- + +*`rsa.misc.group_object`*:: ++ +-- +This key captures a collection/grouping of entities. Specific usage + +type: keyword + +-- + +*`rsa.misc.node`*:: ++ +-- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword + +-- + +*`rsa.misc.rule`*:: ++ +-- +This key captures the Rule number + +type: keyword + +-- + +*`rsa.misc.device_name`*:: ++ +-- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword + +-- + +*`rsa.misc.param`*:: ++ +-- +This key is the parameters passed as part of a command or application, etc. + +type: keyword + +-- + +*`rsa.misc.change_attrib`*:: ++ +-- +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword + +-- + +*`rsa.misc.event_computer`*:: ++ +-- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword + +-- + +*`rsa.misc.reference_id1`*:: ++ +-- +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword + +-- + +*`rsa.misc.event_log`*:: ++ +-- +This key captures the Name of the event log + +type: keyword + +-- + +*`rsa.misc.OS`*:: ++ +-- +This key captures the Name of the Operating System + +type: keyword + +-- + +*`rsa.misc.terminal`*:: ++ +-- +This key captures the Terminal Names only + +type: keyword + +-- + +*`rsa.misc.msgIdPart3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.filter`*:: ++ +-- +This key captures Filter used to reduce result set + +type: keyword + +-- + +*`rsa.misc.serial_number`*:: ++ +-- +This key is the Serial number associated with a physical asset. + +type: keyword + +-- + +*`rsa.misc.checksum`*:: ++ +-- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword + +-- + +*`rsa.misc.event_user`*:: ++ +-- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword + +-- + +*`rsa.misc.virusname`*:: ++ +-- +This key captures the name of the virus + +type: keyword + +-- + +*`rsa.misc.content_type`*:: ++ +-- +This key is used to capture Content Type only. + +type: keyword + +-- + +*`rsa.misc.group_id`*:: ++ +-- +This key captures Group ID Number (related to the group name) + +type: keyword + +-- + +*`rsa.misc.policy_id`*:: ++ +-- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword + +-- + +*`rsa.misc.vsys`*:: ++ +-- +This key captures Virtual System Name + +type: keyword + +-- + +*`rsa.misc.connection_id`*:: ++ +-- +This key captures the Connection ID + +type: keyword + +-- + +*`rsa.misc.reference_id2`*:: ++ +-- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword + +-- + +*`rsa.misc.sensor`*:: ++ +-- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword + +-- + +*`rsa.misc.sig_id`*:: ++ +-- +This key captures IDS/IPS Int Signature ID + +type: long + +-- + +*`rsa.misc.port_name`*:: ++ +-- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword + +-- + +*`rsa.misc.rule_group`*:: ++ +-- +This key captures the Rule group name + +type: keyword + +-- + +*`rsa.misc.risk_num`*:: ++ +-- +This key captures a Numeric Risk value + +type: double + +-- + +*`rsa.misc.trigger_val`*:: ++ +-- +This key captures the Value of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.log_session_id1`*:: ++ +-- +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword + +-- + +*`rsa.misc.comp_version`*:: ++ +-- +This key captures the Version level of a sub-component of a product. + +type: keyword + +-- + +*`rsa.misc.content_version`*:: ++ +-- +This key captures Version level of a signature or database content. + +type: keyword + +-- + +*`rsa.misc.hardware_id`*:: ++ +-- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword + +-- + +*`rsa.misc.risk`*:: ++ +-- +This key captures the non-numeric risk value + +type: keyword + +-- + +*`rsa.misc.event_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.reason`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mail_id`*:: ++ +-- +This key is used to capture the mailbox id/name + +type: keyword + +-- + +*`rsa.misc.rule_uid`*:: ++ +-- +This key is the Unique Identifier for a rule. + +type: keyword + +-- + +*`rsa.misc.trigger_desc`*:: ++ +-- +This key captures the Description of the trigger or threshold condition. + +type: keyword + +-- + +*`rsa.misc.inout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.data_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgIdPart4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.error`*:: ++ +-- +This key captures All non successful Error codes or responses + +type: keyword + +-- + +*`rsa.misc.index`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.listnum`*:: ++ +-- +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword + +-- + +*`rsa.misc.ntype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.observed_val`*:: ++ +-- +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.policy_value`*:: ++ +-- +This key captures the contents of the policy. This contains details about the policy + +type: keyword + +-- + +*`rsa.misc.pool_name`*:: ++ +-- +This key captures the name of a resource pool + +type: keyword + +-- + +*`rsa.misc.rule_template`*:: ++ +-- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword + +-- + +*`rsa.misc.count`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigcat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comments`*:: ++ +-- +Comment information provided in the log message + +type: keyword + +-- + +*`rsa.misc.doc_number`*:: ++ +-- +This key captures File Identification number + +type: long + +-- + +*`rsa.misc.expected_val`*:: ++ +-- +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword + +-- + +*`rsa.misc.job_num`*:: ++ +-- +This key captures the Job Number + +type: keyword + +-- + +*`rsa.misc.spi_dst`*:: ++ +-- +Destination SPI Index + +type: keyword + +-- + +*`rsa.misc.spi_src`*:: ++ +-- +Source SPI Index + +type: keyword + +-- + +*`rsa.misc.code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.agent_id`*:: ++ +-- +This key is used to capture agent id + +type: keyword + +-- + +*`rsa.misc.message_body`*:: ++ +-- +This key captures the The contents of the message body. + +type: keyword + +-- + +*`rsa.misc.phone`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sig_id_str`*:: ++ +-- +This key captures a string object of the sigid variable. + +type: keyword + +-- + +*`rsa.misc.cmd`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu`*:: ++ +-- +This key is the CPU time used in the execution of the event being recorded. + +type: long + +-- + +*`rsa.misc.event_desc`*:: ++ +-- +This key is used to capture a description of an event available directly or inferred + +type: keyword + +-- + +*`rsa.misc.sig_id1`*:: ++ +-- +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long + +-- + +*`rsa.misc.im_buddyid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_client`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.priority`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.context_subject`*:: ++ +-- +This key is to be used in an audit context where the subject is the object being identified + +type: keyword + +-- + +*`rsa.misc.context_target`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cve`*:: ++ +-- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword + +-- + +*`rsa.misc.fcatnum`*:: ++ +-- +This key captures Filter Category Number. Legacy Usage + +type: keyword + +-- + +*`rsa.misc.library`*:: ++ +-- +This key is used to capture library information in mainframe devices + +type: keyword + +-- + +*`rsa.misc.parent_node`*:: ++ +-- +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword + +-- + +*`rsa.misc.risk_info`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.tcp_flags`*:: ++ +-- +This key is captures the TCP flags set in any packet of session + +type: long + +-- + +*`rsa.misc.tos`*:: ++ +-- +This key describes the type of service + +type: long + +-- + +*`rsa.misc.vm_target`*:: ++ +-- +VMWare Target **VMWARE** only varaible. + +type: keyword + +-- + +*`rsa.misc.workspace`*:: ++ +-- +This key captures Workspace Description + +type: keyword + +-- + +*`rsa.misc.command`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.event_category`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facilityname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.forensic_info`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.jobname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policy_waiver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.second`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.space1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.subcategory`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alert_id`*:: ++ +-- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.checksum_dst`*:: ++ +-- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword + +-- + +*`rsa.misc.checksum_src`*:: ++ +-- +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword + +-- + +*`rsa.misc.fresult`*:: ++ +-- +This key captures the Filter Result + +type: long + +-- + +*`rsa.misc.payload_dst`*:: ++ +-- +This key is used to capture destination payload + +type: keyword + +-- + +*`rsa.misc.payload_src`*:: ++ +-- +This key is used to capture source payload + +type: keyword + +-- + +*`rsa.misc.pool_id`*:: ++ +-- +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword + +-- + +*`rsa.misc.process_id_val`*:: ++ +-- +This key is a failure key for Process ID when it is not an integer value + +type: keyword + +-- + +*`rsa.misc.risk_num_comm`*:: ++ +-- +This key captures Risk Number Community + +type: double + +-- + +*`rsa.misc.risk_num_next`*:: ++ +-- +This key captures Risk Number NextGen + +type: double + +-- + +*`rsa.misc.risk_num_sand`*:: ++ +-- +This key captures Risk Number SandBox + +type: double + +-- + +*`rsa.misc.risk_num_static`*:: ++ +-- +This key captures Risk Number Static + +type: double + +-- + +*`rsa.misc.risk_suspicious`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.risk_warning`*:: ++ +-- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword + +-- + +*`rsa.misc.snmp_oid`*:: ++ +-- +SNMP Object Identifier + +type: keyword + +-- + +*`rsa.misc.sql`*:: ++ +-- +This key captures the SQL query + +type: keyword + +-- + +*`rsa.misc.vuln_ref`*:: ++ +-- +This key captures the Vulnerability Reference details + +type: keyword + +-- + +*`rsa.misc.acl_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_op`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_pos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.acl_table`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.admin`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarm_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.alarmname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.app_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.audit_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.auditdata`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.benchmark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.bypass`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cache_hit`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cefversion`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_attr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_obj`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cfg_path`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.changes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.client_ip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.clustermembers`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_acttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_asn_src`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_bgpv4nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ctr_dst_code`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_dst_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_engine_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_f_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampintv`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_flowsampmode`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inacttimeout`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermbyts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_inpermpckts`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_invalid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ip_proto_ver`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_ipv4_ident`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_l_switch`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_did`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_log_rid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_max_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_maxpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_min_ttl`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_minpcktlen`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_10`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_4`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_5`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_6`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_7`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_8`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mpls_lbl_9`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_byt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_mul_dst_pks`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_muligmptype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampalgo`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sampint`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_seqctr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_spackets`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_tos`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_src_vlan`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_sysuptime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_template_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totbytsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totflowexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_totpcktsexp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_unixnanosecs`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6flowlabel`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cn_v6optheaders`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_rbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.comp_sbytes`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cpu_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.criticality`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_agency_dst`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_analyzedby`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_other`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_primary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_av_secondary`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bgpv6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_bit9status`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_context`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_control`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_datecret`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_dst_tld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_dst_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_eth_src_ven`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_event_uuid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_filetype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_desc`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_if_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ip_next_hop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4dstpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_ipv4srcpre`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_lifetime`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_log_medium`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_loginname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulescore`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_modulesign`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_opswatresult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_payload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrant`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_registrar`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_represult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_rpayload`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sampler_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_sourcemodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_streams`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_targetmodule`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_v6nxthop`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_whois_server`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.cs_yararesult`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.description`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.devvendor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.distance`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.dstburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.edomaub`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.euid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.facility`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.finterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.flags`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.gaddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.id3`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_buddyname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_croomtype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_members`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.im_username`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipscat`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ipspri`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.latitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.linenum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.list_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.load_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_floor`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.location_mark`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.log_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logip`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.logname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.longitude`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.lport`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.mbug_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.misc_name`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msg_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.msgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.netsessid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.number2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.nwwn`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.operation`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.opkt`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.orig_from`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.owner_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_action`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_filter`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_group_object`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_msgid2`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.p_result1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_chg`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.password_expire`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permgranted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.permwanted`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.pgid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.policyUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.prog_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.program`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.real_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_device`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_asp_num`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.rec_library`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.recordnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.ruid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sdomain_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sec`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sensorname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.seqnum`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.session`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sessiontype`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.sigUUID`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.spi`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcburb`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.srcservice`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.state`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.status1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.svcno`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.system`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tbdstr1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdom`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.tgtdomain`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.threshold`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.type1`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.udb_class`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.url_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.user_div`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.userid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.username_fld`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.utcstamp`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.v_instafname`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.virt_data`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.vpnid`*:: ++ +-- +type: keyword + +-- + +*`rsa.misc.autorun_type`*:: ++ +-- +This is used to capture Auto Run type + +type: keyword + +-- + +*`rsa.misc.cc_number`*:: ++ +-- +Valid Credit Card Numbers only + +type: long + +-- + +*`rsa.misc.content`*:: ++ +-- +This key captures the content type from protocol headers + +type: keyword + +-- + +*`rsa.misc.ein_number`*:: ++ +-- +Employee Identification Numbers only + +type: long + +-- + +*`rsa.misc.found`*:: ++ +-- +This is used to capture the results of regex match + +type: keyword + +-- + +*`rsa.misc.language`*:: ++ +-- +This is used to capture list of languages the client support and what it prefers + +type: keyword + +-- + +*`rsa.misc.lifetime`*:: ++ +-- +This key is used to capture the session lifetime in seconds. + +type: long + +-- + +*`rsa.misc.link`*:: ++ +-- +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword + +-- + +*`rsa.misc.match`*:: ++ +-- +This key is for regex match name from search.ini + +type: keyword + +-- + +*`rsa.misc.param_dst`*:: ++ +-- +This key captures the command line/launch argument of the target process or file + +type: keyword + +-- + +*`rsa.misc.param_src`*:: ++ +-- +This key captures source parameter + +type: keyword + +-- + +*`rsa.misc.search_text`*:: ++ +-- +This key captures the Search Text used + +type: keyword + +-- + +*`rsa.misc.sig_name`*:: ++ +-- +This key is used to capture the Signature Name only. + +type: keyword + +-- + +*`rsa.misc.snmp_value`*:: ++ +-- +SNMP set request value + +type: keyword + +-- + +*`rsa.misc.streams`*:: ++ +-- +This key captures number of streams in session + +type: long + +-- + + +*`rsa.db.index`*:: ++ +-- +This key captures IndexID of the index. + +type: keyword + +-- + +*`rsa.db.instance`*:: ++ +-- +This key is used to capture the database server instance name + +type: keyword + +-- + +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: ++ +-- +This key captures the SQL transantion ID of the current session + +type: keyword + +-- + +*`rsa.db.permissions`*:: ++ +-- +This key captures permission or privilege level assigned to a resource. + +type: keyword + +-- + +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name + +type: keyword + +-- + +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database + +type: keyword + +-- + +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server + +type: long + +-- + +*`rsa.db.lread`*:: ++ +-- +This key is used for the number of logical reads + +type: long + +-- + +*`rsa.db.lwrite`*:: ++ +-- +This key is used for the number of logical writes + +type: long + +-- + +*`rsa.db.pread`*:: ++ +-- +This key is used for the number of physical writes + +type: long + +-- + + +*`rsa.network.alias_host`*:: ++ +-- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword + +-- + +*`rsa.network.domain`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_dst`*:: ++ +-- +This key should only be used when it’s a Destination Hostname + +type: keyword + +-- + +*`rsa.network.network_service`*:: ++ +-- +This is used to capture layer 7 protocols/service names + +type: keyword + +-- + +*`rsa.network.interface`*:: ++ +-- +This key should be used when the source or destination context of an interface is not clear + +type: keyword + +-- + +*`rsa.network.network_port`*:: ++ +-- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long + +-- + +*`rsa.network.eth_host`*:: ++ +-- +Deprecated, use alias.mac + +type: keyword + +-- + +*`rsa.network.sinterface`*:: ++ +-- +This key should only be used when it’s a Source Interface + +type: keyword + +-- + +*`rsa.network.dinterface`*:: ++ +-- +This key should only be used when it’s a Destination Interface + +type: keyword + +-- + +*`rsa.network.vlan`*:: ++ +-- +This key should only be used to capture the ID of the Virtual LAN + +type: long + +-- + +*`rsa.network.zone_src`*:: ++ +-- +This key should only be used when it’s a Source Zone. + +type: keyword + +-- + +*`rsa.network.zone`*:: ++ +-- +This key should be used when the source or destination context of a Zone is not clear + +type: keyword + +-- + +*`rsa.network.zone_dst`*:: ++ +-- +This key should only be used when it’s a Destination Zone. + +type: keyword + +-- + +*`rsa.network.gateway`*:: ++ +-- +This key is used to capture the IP Address of the gateway + +type: keyword + +-- + +*`rsa.network.icmp_type`*:: ++ +-- +This key is used to capture the ICMP type only + +type: long + +-- + +*`rsa.network.mask`*:: ++ +-- +This key is used to capture the device network IPmask. + +type: keyword + +-- + +*`rsa.network.icmp_code`*:: ++ +-- +This key is used to capture the ICMP code only + +type: long + +-- + +*`rsa.network.protocol_detail`*:: ++ +-- +This key should be used to capture additional protocol information + +type: keyword + +-- + +*`rsa.network.dmask`*:: ++ +-- +This key is used for Destionation Device network mask + +type: keyword + +-- + +*`rsa.network.port`*:: ++ +-- +This key should only be used to capture a Network Port when the directionality is not clear + +type: long + +-- + +*`rsa.network.smask`*:: ++ +-- +This key is used for capturing source Network Mask + +type: keyword + +-- + +*`rsa.network.netname`*:: ++ +-- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword + +-- + +*`rsa.network.paddr`*:: ++ +-- +Deprecated + +type: ip + +-- + +*`rsa.network.faddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.lhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.origin`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.remote_domain_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.addr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_a_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_ptr_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fhost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.fport`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.laddr`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.linterface`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.phost`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.ad_computer_dst`*:: ++ +-- +Deprecated, use host.dst + +type: keyword + +-- + +*`rsa.network.eth_type`*:: ++ +-- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long + +-- + +*`rsa.network.ip_proto`*:: ++ +-- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long + +-- + +*`rsa.network.dns_cname_record`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_id`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_opcode`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_resp`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.dns_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.domain1`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_type`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.packet_length`*:: ++ +-- +type: keyword + +-- + +*`rsa.network.host_orig`*:: ++ +-- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword + +-- + +*`rsa.network.rpayload`*:: ++ +-- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword + +-- + +*`rsa.network.vlan_name`*:: ++ +-- +This key should only be used to capture the name of the Virtual LAN + +type: keyword + +-- + + +*`rsa.investigations.ec_activity`*:: ++ +-- +This key captures the particular event activity(Ex:Logoff) + +type: keyword + +-- + +*`rsa.investigations.ec_theme`*:: ++ +-- +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword + +-- + +*`rsa.investigations.ec_subject`*:: ++ +-- +This key captures the Subject of a particular Event(Ex:User) + +type: keyword + +-- + +*`rsa.investigations.ec_outcome`*:: ++ +-- +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword + +-- + +*`rsa.investigations.event_cat`*:: ++ +-- +This key captures the Event category number + +type: long + +-- + +*`rsa.investigations.event_cat_name`*:: ++ +-- +This key captures the event category name corresponding to the event cat code + +type: keyword + +-- + +*`rsa.investigations.event_vcat`*:: ++ +-- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword + +-- + +*`rsa.investigations.analysis_file`*:: ++ +-- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + +type: keyword + +-- + +*`rsa.investigations.analysis_service`*:: ++ +-- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword + +-- + +*`rsa.investigations.analysis_session`*:: ++ +-- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword + +-- + +*`rsa.investigations.boc`*:: ++ +-- +This is used to capture behaviour of compromise + +type: keyword + +-- + +*`rsa.investigations.eoc`*:: ++ +-- +This is used to capture Enablers of Compromise + +type: keyword + +-- + +*`rsa.investigations.inv_category`*:: ++ +-- +This used to capture investigation category + +type: keyword + +-- + +*`rsa.investigations.inv_context`*:: ++ +-- +This used to capture investigation context + +type: keyword + +-- + +*`rsa.investigations.ioc`*:: ++ +-- +This is key capture indicator of compromise + +type: keyword + +-- + + +*`rsa.counters.dclass_c1`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long + +-- + +*`rsa.counters.dclass_c2`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long + +-- + +*`rsa.counters.event_counter`*:: ++ +-- +This is used to capture the number of times an event repeated + +type: long + +-- + +*`rsa.counters.dclass_r1`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3`*:: ++ +-- +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long + +-- + +*`rsa.counters.dclass_c1_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword + +-- + +*`rsa.counters.dclass_c2_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r1_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword + +-- + +*`rsa.counters.dclass_r2`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword + +-- + +*`rsa.counters.dclass_c3_str`*:: ++ +-- +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3`*:: ++ +-- +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword + +-- + +*`rsa.counters.dclass_r2_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword + +-- + +*`rsa.counters.dclass_r3_str`*:: ++ +-- +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword + +-- + + +*`rsa.identity.auth_method`*:: ++ +-- +This key is used to capture authentication methods used only + +type: keyword + +-- + +*`rsa.identity.user_role`*:: ++ +-- +This key is used to capture the Role of a user only + +type: keyword + +-- + +*`rsa.identity.dn`*:: ++ +-- +X.500 (LDAP) Distinguished Name + +type: keyword + +-- + +*`rsa.identity.logon_type`*:: ++ +-- +This key is used to capture the type of logon method used. + +type: keyword + +-- + +*`rsa.identity.profile`*:: ++ +-- +This key is used to capture the user profile + +type: keyword + +-- + +*`rsa.identity.accesses`*:: ++ +-- +This key is used to capture actual privileges used in accessing an object + +type: keyword + +-- + +*`rsa.identity.realm`*:: ++ +-- +Radius realm or similar grouping of accounts + +type: keyword + +-- + +*`rsa.identity.user_sid_dst`*:: ++ +-- +This key captures Destination User Session ID + +type: keyword + +-- + +*`rsa.identity.dn_src`*:: ++ +-- +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword + +-- + +*`rsa.identity.org`*:: ++ +-- +This key captures the User organization + +type: keyword + +-- + +*`rsa.identity.dn_dst`*:: ++ +-- +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn + +type: keyword + +-- + +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.lastname`*:: ++ +-- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- + +*`rsa.identity.user_dept`*:: ++ +-- +User's Department Names only + +type: keyword + +-- + +*`rsa.identity.user_sid_src`*:: ++ +-- +This key captures Source User Session ID + +type: keyword + +-- + +*`rsa.identity.federated_sp`*:: ++ +-- +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword + +-- + +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword + +-- + +*`rsa.identity.logon_type_desc`*:: ++ +-- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. -type: boolean +type: keyword -- -*`mysql.slowlog.filesort_on_disk`*:: +*`rsa.identity.middlename`*:: + -- -Whether filesort optimization was used and it needed temporary tables on disk. +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +type: keyword -type: boolean +-- +*`rsa.identity.password`*:: ++ -- +This key is for Passwords seen in any session, plain text or encrypted -*`mysql.slowlog.priority_queue`*:: +type: keyword + +-- + +*`rsa.identity.host_role`*:: + -- -Whether a priority queue was used for filesort. +This key should only be used to capture the role of a Host Machine +type: keyword -type: boolean +-- +*`rsa.identity.ldap`*:: ++ -- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context -*`mysql.slowlog.full_scan`*:: +type: keyword + +-- + +*`rsa.identity.ldap_query`*:: + -- -Whether a full table scan was needed for the slow query. +This key is the Search criteria from an LDAP search + +type: keyword +-- -type: boolean +*`rsa.identity.ldap_response`*:: ++ +-- +This key is to capture Results from an LDAP search + +type: keyword -- -*`mysql.slowlog.full_join`*:: +*`rsa.identity.owner`*:: + -- -Whether a full join was needed for the slow query (no indexes were used for joins). +This is used to capture username the process or service is running as, the author of the task +type: keyword -type: boolean +-- +*`rsa.identity.service_account`*:: ++ -- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage -*`mysql.slowlog.merge_passes`*:: +type: keyword + +-- + + +*`rsa.email.email_dst`*:: + -- -Number of merge passes executed for the query. +This key is used to capture the Destination email address only, when the destination context is not clear use email +type: keyword -type: long +-- +*`rsa.email.email_src`*:: ++ -- +This key is used to capture the source email address only, when the source context is not clear use email -*`mysql.slowlog.sort_merge_passes`*:: +type: keyword + +-- + +*`rsa.email.subject`*:: + -- -Number of merge passes that the sort algorithm has had to do. +This key is used to capture the subject string from an Email only. +type: keyword -type: long +-- +*`rsa.email.email`*:: ++ -- +This key is used to capture a generic email address where the source or destination context is not clear -*`mysql.slowlog.sort_range_count`*:: +type: keyword + +-- + +*`rsa.email.trans_from`*:: + -- -Number of sorts that were done using ranges. +Deprecated key defined only in table map. +type: keyword -type: long +-- + +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword -- -*`mysql.slowlog.sort_rows`*:: + +*`rsa.file.privilege`*:: + -- -Number of sorted rows. +Deprecated, use permissions + +type: keyword +-- -type: long +*`rsa.file.attachment`*:: ++ +-- +This key captures the attachment file name + +type: keyword -- -*`mysql.slowlog.sort_scan_count`*:: +*`rsa.file.filesystem`*:: + -- -Number of sorts that were done by scanning the table. +type: keyword +-- -type: long +*`rsa.file.binary`*:: ++ +-- +Deprecated key defined only in table map. + +type: keyword -- -*`mysql.slowlog.log_slow_rate_type`*:: +*`rsa.file.filename_dst`*:: + -- -Type of slow log rate limit, it can be `session` if the rate limit is applied per session, or `query` if it applies per query. +This is used to capture name of the file targeted by the action + +type: keyword + +-- +*`rsa.file.filename_src`*:: ++ +-- +This is used to capture name of the parent filename, the file which performed the action type: keyword -- -*`mysql.slowlog.log_slow_rate_limit`*:: +*`rsa.file.filename_tmp`*:: + -- -Slow log rate limit, a value of 100 means that one in a hundred queries or sessions are being logged. +type: keyword + +-- +*`rsa.file.directory_dst`*:: ++ +-- +This key is used to capture the directory of the target process or file type: keyword -- -*`mysql.slowlog.read_first`*:: +*`rsa.file.directory_src`*:: + -- -The number of times the first entry in an index was read. +This key is used to capture the directory of the source process or file + +type: keyword +-- -type: long +*`rsa.file.file_entropy`*:: ++ +-- +This is used to capture entropy vale of a file + +type: double -- -*`mysql.slowlog.read_last`*:: +*`rsa.file.file_vendor`*:: + -- -The number of times the last key in an index was read. +This is used to capture Company name of file located in version_info +type: keyword -type: long +-- +*`rsa.file.task_name`*:: ++ -- +This is used to capture name of the task -*`mysql.slowlog.read_key`*:: +type: keyword + +-- + + +*`rsa.web.fqdn`*:: + -- -The number of requests to read a row based on a key. +Fully Qualified Domain Names +type: keyword -type: long +-- +*`rsa.web.web_cookie`*:: ++ -- +This key is used to capture the Web cookies specifically. -*`mysql.slowlog.read_next`*:: +type: keyword + +-- + +*`rsa.web.alias_host`*:: + -- -The number of requests to read the next row in key order. +type: keyword +-- -type: long +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains + +type: double -- -*`mysql.slowlog.read_prev`*:: +*`rsa.web.web_ref_domain`*:: + -- -The number of requests to read the previous row in key order. +Web referer's domain +type: keyword -type: long +-- + +*`rsa.web.web_ref_query`*:: ++ +-- +This key captures Web referer's query portion of the URL + +type: keyword -- -*`mysql.slowlog.read_rnd`*:: +*`rsa.web.remote_domain`*:: + -- -The number of requests to read a row based on a fixed position. +type: keyword +-- -type: long +*`rsa.web.web_ref_page`*:: ++ +-- +This key captures Web referer's page information + +type: keyword -- -*`mysql.slowlog.read_rnd_next`*:: +*`rsa.web.web_ref_root`*:: + -- -The number of requests to read the next row in the data file. +Web referer's root URL path +type: keyword -type: long +-- +*`rsa.web.cn_asn_dst`*:: ++ -- +type: keyword -[float] -=== innodb +-- -Contains fields relative to InnoDB engine +*`rsa.web.cn_rpackets`*:: ++ +-- +type: keyword +-- +*`rsa.web.urlpage`*:: ++ +-- +type: keyword -*`mysql.slowlog.innodb.trx_id`*:: +-- + +*`rsa.web.urlroot`*:: + -- -Transaction ID +type: keyword +-- +*`rsa.web.p_url`*:: ++ +-- type: keyword -- -*`mysql.slowlog.innodb.io_r_ops`*:: +*`rsa.web.p_user_agent`*:: + -- -Number of page read operations. +type: keyword +-- -type: long +*`rsa.web.p_web_cookie`*:: ++ +-- +type: keyword -- -*`mysql.slowlog.innodb.io_r_bytes`*:: +*`rsa.web.p_web_method`*:: + -- -Bytes read during page read operations. +type: keyword + +-- +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword -type: long +-- -format: bytes +*`rsa.web.web_extension_tmp`*:: ++ +-- +type: keyword -- -*`mysql.slowlog.innodb.io_r_wait.sec`*:: +*`rsa.web.web_page`*:: + -- -How long it took to read all needed data from storage. +type: keyword +-- -type: long +*`rsa.threat.threat_category`*:: ++ -- +This key captures Threat Name/Threat Category/Categorization of alert -*`mysql.slowlog.innodb.rec_lock_wait.sec`*:: +type: keyword + +-- + +*`rsa.threat.threat_desc`*:: + -- -How long the query waited for locks. +This key is used to capture the threat description from the session directly or inferred +type: keyword -type: long +-- +*`rsa.threat.alert`*:: ++ -- +This key is used to capture name of the alert -*`mysql.slowlog.innodb.queue_wait.sec`*:: +type: keyword + +-- + +*`rsa.threat.threat_source`*:: + -- -How long the query waited to enter the InnoDB queue and to be executed once in the queue. +This key is used to capture source of the threat + +type: keyword + +-- -type: long +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword -- -*`mysql.slowlog.innodb.pages_distinct`*:: +*`rsa.crypto.cipher_src`*:: + -- -Approximated count of pages accessed to execute the query. +This key is for Source (Client) Cipher + +type: keyword + +-- + +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only + +type: keyword + +-- + +*`rsa.crypto.peer`*:: ++ +-- +This key is for Encryption peer's IP Address + +type: keyword + +-- +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size type: long -- -*`mysql.slowlog.user`*:: +*`rsa.crypto.ike`*:: + -- -type: alias +IKE negotiation phase. -alias to: user.name +type: keyword -- -*`mysql.slowlog.host`*:: +*`rsa.crypto.scheme`*:: + -- -type: alias +This key captures the Encryption scheme used -alias to: source.domain +type: keyword -- -*`mysql.slowlog.ip`*:: +*`rsa.crypto.peer_id`*:: + -- -type: alias +This key is for Encryption peer’s identity -alias to: source.ip +type: keyword -- -[[exported-fields-nats]] -== NATS fields +*`rsa.crypto.sig_type`*:: ++ +-- +This key captures the Signature Type -Module for parsing NATS log files. +type: keyword +-- +*`rsa.crypto.cert_issuer`*:: ++ +-- +type: keyword -[float] -=== nats +-- -Fields from NATS logs. +*`rsa.crypto.cert_host_name`*:: ++ +-- +Deprecated key defined only in table map. +type: keyword +-- -[float] -=== log +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String -Nats log files +type: keyword + +-- +*`rsa.crypto.cipher_dst`*:: ++ +-- +This key is for Destination (Server) Cipher +type: keyword -[float] -=== client +-- -Fields from NATS logs client. +*`rsa.crypto.cipher_size_dst`*:: ++ +-- +This key captures Destination (Server) Cipher Size +type: long +-- -*`nats.log.client.id`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -The id of the client +Deprecated, use version +type: keyword -type: integer +-- +*`rsa.crypto.d_certauth`*:: ++ -- +type: keyword -[float] -=== msg +-- -Fields from NATS logs message. +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword +-- + +*`rsa.crypto.ike_cookie1`*:: ++ +-- +ID of the negotiation — sent for ISAKMP Phase One +type: keyword -*`nats.log.msg.bytes`*:: +-- + +*`rsa.crypto.ike_cookie2`*:: + -- -Size of the payload in bytes +ID of the negotiation — sent for ISAKMP Phase Two +type: keyword -type: long +-- -format: bytes +*`rsa.crypto.cert_checksum`*:: ++ +-- +type: keyword -- -*`nats.log.msg.type`*:: +*`rsa.crypto.cert_host_cat`*:: + -- -The protocol message type +This key is used for the hostname category value of a certificate + +type: keyword + +-- +*`rsa.crypto.cert_serial`*:: ++ +-- +This key is used to capture the Certificate serial number only type: keyword -- -*`nats.log.msg.subject`*:: +*`rsa.crypto.cert_status`*:: + -- -Subject name this message was received on +This key captures Certificate validation status + +type: keyword + +-- +*`rsa.crypto.ssl_ver_dst`*:: ++ +-- +Deprecated, use version type: keyword -- -*`nats.log.msg.sid`*:: +*`rsa.crypto.cert_keysize`*:: + -- -The unique alphanumeric subscription ID of the subject +type: keyword +-- -type: integer +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword -- -*`nats.log.msg.reply_to`*:: +*`rsa.crypto.https_insact`*:: + -- -The inbox subject on which the publisher is listening for responses +type: keyword +-- +*`rsa.crypto.https_valid`*:: ++ +-- type: keyword -- -*`nats.log.msg.max_messages`*:: +*`rsa.crypto.cert_ca`*:: + -- -An optional number of messages to wait for before automatically unsubscribing +This key is used to capture the Certificate signing authority only + +type: keyword +-- -type: integer +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only + +type: keyword -- -*`nats.log.msg.error.message`*:: + +*`rsa.wireless.wlan_ssid`*:: + -- -Details about the error occurred +This key is used to capture the ssid of a Wireless Session +type: keyword -type: text +-- + +*`rsa.wireless.access_point`*:: ++ +-- +This key is used to capture the access point name. + +type: keyword -- -*`nats.log.msg.queue_group`*:: +*`rsa.wireless.wlan_channel`*:: + -- -The queue group which subscriber will join +This is used to capture the channel names +type: long -type: text +-- +*`rsa.wireless.wlan_name`*:: ++ -- +This key captures either WLAN number/name -[[exported-fields-netflow]] -== NetFlow fields +type: keyword -Fields from NetFlow and IPFIX flows. +-- +*`rsa.storage.disk_volume`*:: ++ +-- +A unique name assigned to logical units (volumes) within a physical disk -[float] -=== netflow +type: keyword -Fields from NetFlow and IPFIX. +-- + +*`rsa.storage.lun`*:: ++ +-- +Logical Unit Number.This key is a very useful concept in Storage. +type: keyword +-- -*`netflow.type`*:: +*`rsa.storage.pwwn`*:: + -- -The type of NetFlow record described by this event. +This uniquely identifies a port on a HBA. + +type: keyword + +-- + +*`rsa.physical.org_dst`*:: ++ +-- +This is used to capture the destination organization based on the GEOPIP Maxmind database. type: keyword -- -[float] -=== exporter +*`rsa.physical.org_src`*:: ++ +-- +This is used to capture the source organization based on the GEOPIP Maxmind database. -Metadata related to the exporter device that generated this record. +type: keyword +-- -*`netflow.exporter.address`*:: +*`rsa.healthcare.patient_fname`*:: + -- -Exporter's network address in IP:port format. +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword + +-- +*`rsa.healthcare.patient_id`*:: ++ +-- +This key captures the unique ID for a patient type: keyword -- -*`netflow.exporter.source_id`*:: +*`rsa.healthcare.patient_lname`*:: + -- -Observation domain ID to which this record belongs. +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +type: keyword -type: long +-- +*`rsa.healthcare.patient_mname`*:: ++ -- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information -*`netflow.exporter.timestamp`*:: +type: keyword + +-- + + +*`rsa.endpoint.host_state`*:: + -- -Time and date of export. +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on +type: keyword -type: date +-- +*`rsa.endpoint.registry_key`*:: ++ -- +This key captures the path to the registry key -*`netflow.exporter.uptime_millis`*:: +type: keyword + +-- + +*`rsa.endpoint.registry_value`*:: + -- -How long the exporter process has been running, in milliseconds. +This key captures values or decorators used within a registry entry +type: keyword -type: long +-- + +[[exported-fields-redis]] +== Redis fields + +Redis Module + + + +[float] +=== redis + + + + +[float] +=== log + +Redis log files + + + +*`redis.log.role`*:: ++ +-- +The role of the Redis instance. Can be one of `master`, `slave`, `child` (for RDF/AOF writing child), or `sentinel`. + + +type: keyword -- -*`netflow.exporter.version`*:: +*`redis.log.pid`*:: + -- -NetFlow version used. +type: alias +alias to: process.pid -type: integer +-- +*`redis.log.level`*:: ++ -- +type: alias -*`netflow.octet_delta_count`*:: +alias to: log.level + +-- + +*`redis.log.message`*:: + -- -type: long +type: alias + +alias to: message -- -*`netflow.packet_delta_count`*:: +[float] +=== slowlog + +Slow logs are retrieved from Redis via a network connection. + + + +*`redis.slowlog.cmd`*:: + -- -type: long +The command executed. + + +type: keyword -- -*`netflow.delta_flow_count`*:: +*`redis.slowlog.duration.us`*:: + -- +How long it took to execute the command in microseconds. + + type: long -- -*`netflow.protocol_identifier`*:: +*`redis.slowlog.id`*:: + -- -type: short +The ID of the query. + + +type: long -- -*`netflow.ip_class_of_service`*:: +*`redis.slowlog.key`*:: + -- -type: short +The key on which the command was executed. + + +type: keyword -- -*`netflow.tcp_control_bits`*:: +*`redis.slowlog.args`*:: + -- -type: integer +The arguments with which the command was called. + + +type: keyword -- -*`netflow.source_transport_port`*:: +[[exported-fields-s3]] +== s3 fields + +S3 fields from s3 input. + + + +*`bucket_name`*:: + -- -type: integer +Name of the S3 bucket that this log retrieved from. + + +type: keyword -- -*`netflow.source_ipv4_address`*:: +*`object_key`*:: + -- -type: ip +Name of the S3 object that this log retrieved from. + + +type: keyword -- -*`netflow.source_ipv4_prefix_length`*:: +[[exported-fields-santa]] +== Google Santa fields + +Santa Module + + + +[float] +=== santa + + + + +*`santa.action`*:: + -- -type: short +Action + +type: keyword + +example: EXEC -- -*`netflow.ingress_interface`*:: +*`santa.decision`*:: + -- -type: long +Decision that santad took. + +type: keyword + +example: ALLOW -- -*`netflow.destination_transport_port`*:: +*`santa.reason`*:: + -- -type: integer +Reason for the decsision. + +type: keyword + +example: CERT -- -*`netflow.destination_ipv4_address`*:: +*`santa.mode`*:: + -- -type: ip +Operating mode of Santa. + +type: keyword + +example: M -- -*`netflow.destination_ipv4_prefix_length`*:: +[float] +=== disk + +Fields for DISKAPPEAR actions. + + +*`santa.disk.volume`*:: + -- -type: short +The volume name. -- -*`netflow.egress_interface`*:: +*`santa.disk.bus`*:: + -- -type: long +The disk bus protocol. -- -*`netflow.ip_next_hop_ipv4_address`*:: +*`santa.disk.serial`*:: + -- -type: ip +The disk serial number. -- -*`netflow.bgp_source_as_number`*:: +*`santa.disk.bsdname`*:: + -- -type: long +The disk BSD name. + +example: disk1s3 -- -*`netflow.bgp_destination_as_number`*:: +*`santa.disk.model`*:: + -- -type: long +The disk model. + +example: APPLE SSD SM0512L -- -*`netflow.bgp_next_hop_ipv4_address`*:: +*`santa.disk.fs`*:: + -- -type: ip +The disk volume kind (filesystem type). + +example: apfs -- -*`netflow.post_mcast_packet_delta_count`*:: +*`santa.disk.mount`*:: + -- -type: long +The disk volume path. -- -*`netflow.post_mcast_octet_delta_count`*:: +*`santa.certificate.common_name`*:: + -- -type: long +Common name from code signing certificate. + +type: keyword -- -*`netflow.flow_end_sys_up_time`*:: +*`santa.certificate.sha256`*:: + -- -type: long +SHA256 hash of code signing certificate. + +type: keyword -- -*`netflow.flow_start_sys_up_time`*:: +[[exported-fields-snort]] +== Snort/Sourcefire fields + +snort fields. + + + +*`network.interface.name`*:: + -- -type: long +Name of the network interface where the traffic has been observed. + + +type: keyword -- -*`netflow.post_octet_delta_count`*:: + + +*`rsa.internal.msg`*:: + -- -type: long +This key is used to capture the raw message that comes into the Log Decoder + +type: keyword -- -*`netflow.post_packet_delta_count`*:: +*`rsa.internal.messageid`*:: + -- -type: long +type: keyword -- -*`netflow.minimum_ip_total_length`*:: +*`rsa.internal.event_desc`*:: + -- -type: long +type: keyword -- -*`netflow.maximum_ip_total_length`*:: +*`rsa.internal.message`*:: + -- -type: long +This key captures the contents of instant messages + +type: keyword -- -*`netflow.source_ipv6_address`*:: +*`rsa.internal.time`*:: + -- -type: ip +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date -- -*`netflow.destination_ipv6_address`*:: +*`rsa.internal.level`*:: + -- -type: ip +Deprecated key defined only in table map. + +type: long -- -*`netflow.source_ipv6_prefix_length`*:: +*`rsa.internal.msg_id`*:: + -- -type: short +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.destination_ipv6_prefix_length`*:: +*`rsa.internal.msg_vid`*:: + -- -type: short +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.flow_label_ipv6`*:: +*`rsa.internal.data`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.icmp_type_code_ipv4`*:: +*`rsa.internal.obj_server`*:: + -- -type: integer +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.igmp_type`*:: +*`rsa.internal.obj_val`*:: + -- -type: short +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.sampling_interval`*:: +*`rsa.internal.resource`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.sampling_algorithm`*:: +*`rsa.internal.obj_id`*:: + -- -type: short +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.flow_active_timeout`*:: +*`rsa.internal.statement`*:: + -- -type: integer +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.flow_idle_timeout`*:: +*`rsa.internal.audit_class`*:: + -- -type: integer +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.engine_type`*:: +*`rsa.internal.entry`*:: + -- -type: short +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.engine_id`*:: +*`rsa.internal.hcode`*:: + -- -type: short +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.exported_octet_total_count`*:: +*`rsa.internal.inode`*:: + -- +Deprecated key defined only in table map. + type: long -- -*`netflow.exported_message_total_count`*:: +*`rsa.internal.resource_class`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.exported_flow_record_total_count`*:: +*`rsa.internal.dead`*:: + -- +Deprecated key defined only in table map. + type: long -- -*`netflow.ipv4_router_sc`*:: +*`rsa.internal.feed_desc`*:: + -- -type: ip +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.source_ipv4_prefix`*:: +*`rsa.internal.feed_name`*:: + -- -type: ip +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.destination_ipv4_prefix`*:: +*`rsa.internal.cid`*:: + -- -type: ip +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.mpls_top_label_type`*:: +*`rsa.internal.device_class`*:: + -- -type: short +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.mpls_top_label_ipv4_address`*:: +*`rsa.internal.device_group`*:: + -- -type: ip +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.sampler_id`*:: +*`rsa.internal.device_host`*:: + -- -type: short +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.sampler_mode`*:: +*`rsa.internal.device_ip`*:: + -- -type: short +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`netflow.sampler_random_interval`*:: +*`rsa.internal.device_ipv6`*:: + -- -type: long +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`netflow.class_id`*:: +*`rsa.internal.device_type`*:: + -- -type: long +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.minimum_ttl`*:: +*`rsa.internal.device_type_id`*:: + -- -type: short +Deprecated key defined only in table map. + +type: long -- -*`netflow.maximum_ttl`*:: +*`rsa.internal.did`*:: + -- -type: short +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.fragment_identification`*:: +*`rsa.internal.entropy_req`*:: + -- +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + type: long -- -*`netflow.post_ip_class_of_service`*:: +*`rsa.internal.entropy_res`*:: + -- -type: short +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long -- -*`netflow.source_mac_address`*:: +*`rsa.internal.event_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`netflow.post_destination_mac_address`*:: +*`rsa.internal.feed_category`*:: + -- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`netflow.vlan_id`*:: +*`rsa.internal.forward_ip`*:: + -- -type: integer +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip -- -*`netflow.post_vlan_id`*:: +*`rsa.internal.forward_ipv6`*:: + -- -type: integer +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`netflow.ip_version`*:: +*`rsa.internal.header_id`*:: + -- -type: short +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.flow_direction`*:: +*`rsa.internal.lc_cid`*:: + -- -type: short +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.ip_next_hop_ipv6_address`*:: +*`rsa.internal.lc_ctime`*:: + -- -type: ip +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date -- -*`netflow.bgp_next_hop_ipv6_address`*:: +*`rsa.internal.mcb_req`*:: + -- -type: ip +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`netflow.ipv6_extension_headers`*:: +*`rsa.internal.mcb_res`*:: + -- +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + type: long -- -*`netflow.mpls_top_label_stack_section`*:: +*`rsa.internal.mcbc_req`*:: + -- -type: short +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`netflow.mpls_label_stack_section2`*:: +*`rsa.internal.mcbc_res`*:: + -- -type: short +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`netflow.mpls_label_stack_section3`*:: +*`rsa.internal.medium`*:: + -- -type: short +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long -- -*`netflow.mpls_label_stack_section4`*:: +*`rsa.internal.node_name`*:: + -- -type: short +Deprecated key defined only in table map. + +type: keyword -- -*`netflow.mpls_label_stack_section5`*:: +*`rsa.internal.nwe_callback_id`*:: + -- -type: short +This key denotes that event is endpoint related + +type: keyword -- -*`netflow.mpls_label_stack_section6`*:: +*`rsa.internal.parse_error`*:: + -- -type: short +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: keyword -- -*`netflow.mpls_label_stack_section7`*:: +*`rsa.internal.payload_req`*:: + -- -type: short +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`netflow.mpls_label_stack_section8`*:: +*`rsa.internal.payload_res`*:: + -- -type: short +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`netflow.mpls_label_stack_section9`*:: +*`rsa.internal.process_vid_dst`*:: + -- -type: short +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + +type: keyword -- -*`netflow.mpls_label_stack_section10`*:: +*`rsa.internal.process_vid_src`*:: + -- -type: short +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + +type: keyword -- -*`netflow.destination_mac_address`*:: +*`rsa.internal.rid`*:: + -- -type: keyword +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`netflow.post_source_mac_address`*:: +*`rsa.internal.session_split`*:: + -- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`netflow.interface_name`*:: +*`rsa.internal.site`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`netflow.interface_description`*:: +*`rsa.internal.size`*:: + -- -type: keyword +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`netflow.sampler_name`*:: +*`rsa.internal.sourcefile`*:: + -- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`netflow.octet_total_count`*:: +*`rsa.internal.ubc_req`*:: + -- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + type: long -- -*`netflow.packet_total_count`*:: +*`rsa.internal.ubc_res`*:: + -- +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + type: long -- -*`netflow.flags_and_sampler_id`*:: +*`rsa.internal.word`*:: + -- -type: long +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log --- +type: keyword -*`netflow.fragment_offset`*:: -+ -- -type: integer --- -*`netflow.forwarding_status`*:: +*`rsa.time.event_time`*:: + -- -type: short +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date -- -*`netflow.mpls_vpn_route_distinguisher`*:: +*`rsa.time.duration_time`*:: + -- -type: short +This key is used to capture the normalized duration/lifetime in seconds. + +type: double -- -*`netflow.mpls_top_label_prefix_length`*:: +*`rsa.time.event_time_str`*:: + -- -type: short +This key is used to capture the incomplete time mentioned in a session as a string + +type: keyword -- -*`netflow.src_traffic_index`*:: +*`rsa.time.starttime`*:: + -- -type: long +This key is used to capture the Start time mentioned in a session in a standard form + +type: date -- -*`netflow.dst_traffic_index`*:: +*`rsa.time.month`*:: + -- -type: long +type: keyword -- -*`netflow.application_description`*:: +*`rsa.time.day`*:: + -- type: keyword -- -*`netflow.application_id`*:: +*`rsa.time.endtime`*:: + -- -type: short +This key is used to capture the End time mentioned in a session in a standard form + +type: date -- -*`netflow.application_name`*:: +*`rsa.time.timezone`*:: + -- +This key is used to capture the timezone of the Event Time + type: keyword -- -*`netflow.post_ip_diff_serv_code_point`*:: +*`rsa.time.duration_str`*:: + -- -type: short - --- +A text string version of the duration -*`netflow.multicast_replication_factor`*:: -+ --- -type: long +type: keyword -- -*`netflow.class_name`*:: +*`rsa.time.date`*:: + -- type: keyword -- -*`netflow.classification_engine_id`*:: +*`rsa.time.year`*:: + -- -type: short +type: keyword -- -*`netflow.layer2packet_section_offset`*:: +*`rsa.time.recorded_time`*:: + -- -type: integer +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date -- -*`netflow.layer2packet_section_size`*:: +*`rsa.time.datetime`*:: + -- -type: integer +type: keyword -- -*`netflow.layer2packet_section_data`*:: +*`rsa.time.effective_time`*:: + -- -type: short +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date -- -*`netflow.bgp_next_adjacent_as_number`*:: +*`rsa.time.expire_time`*:: + -- -type: long +This key is the timestamp that explicitly refers to an expiration. + +type: date -- -*`netflow.bgp_prev_adjacent_as_number`*:: +*`rsa.time.process_time`*:: + -- -type: long +Deprecated, use duration.time + +type: keyword -- -*`netflow.exporter_ipv4_address`*:: +*`rsa.time.hour`*:: + -- -type: ip +type: keyword -- -*`netflow.exporter_ipv6_address`*:: +*`rsa.time.min`*:: + -- -type: ip +type: keyword -- -*`netflow.dropped_octet_delta_count`*:: +*`rsa.time.timestamp`*:: + -- -type: long +type: keyword -- -*`netflow.dropped_packet_delta_count`*:: +*`rsa.time.event_queue_time`*:: + -- -type: long +This key is the Time that the event was queued. + +type: date -- -*`netflow.dropped_octet_total_count`*:: +*`rsa.time.p_time1`*:: + -- -type: long +type: keyword -- -*`netflow.dropped_packet_total_count`*:: +*`rsa.time.tzone`*:: + -- -type: long +type: keyword -- -*`netflow.flow_end_reason`*:: +*`rsa.time.eventtime`*:: + -- -type: short +type: keyword -- -*`netflow.common_properties_id`*:: +*`rsa.time.gmtdate`*:: + -- -type: long +type: keyword -- -*`netflow.observation_point_id`*:: +*`rsa.time.gmttime`*:: + -- -type: long +type: keyword -- -*`netflow.icmp_type_code_ipv6`*:: +*`rsa.time.p_date`*:: + -- -type: integer +type: keyword -- -*`netflow.mpls_top_label_ipv6_address`*:: +*`rsa.time.p_month`*:: + -- -type: ip +type: keyword -- -*`netflow.line_card_id`*:: +*`rsa.time.p_time`*:: + -- -type: long +type: keyword -- -*`netflow.port_id`*:: +*`rsa.time.p_time2`*:: + -- -type: long +type: keyword -- -*`netflow.metering_process_id`*:: +*`rsa.time.p_year`*:: + -- -type: long +type: keyword -- -*`netflow.exporting_process_id`*:: +*`rsa.time.expire_time_str`*:: + -- -type: long +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + +type: keyword -- -*`netflow.template_id`*:: +*`rsa.time.stamp`*:: + -- -type: integer +Deprecated key defined only in table map. --- +type: date -*`netflow.wlan_channel_id`*:: -+ -- -type: short --- -*`netflow.wlan_ssid`*:: +*`rsa.misc.action`*:: + -- type: keyword -- -*`netflow.flow_id`*:: +*`rsa.misc.result`*:: + -- -type: long - --- +This key is used to capture the outcome/result string value of an action in a session. -*`netflow.observation_domain_id`*:: -+ --- -type: long +type: keyword -- -*`netflow.flow_start_seconds`*:: +*`rsa.misc.severity`*:: + -- -type: date +This key is used to capture the severity given the session + +type: keyword -- -*`netflow.flow_end_seconds`*:: +*`rsa.misc.event_type`*:: + -- -type: date +This key captures the event category type as specified by the event source. + +type: keyword -- -*`netflow.flow_start_milliseconds`*:: +*`rsa.misc.reference_id`*:: + -- -type: date +This key is used to capture an event id from the session directly + +type: keyword -- -*`netflow.flow_end_milliseconds`*:: +*`rsa.misc.version`*:: + -- -type: date +This key captures Version of the application or OS which is generating the event. + +type: keyword -- -*`netflow.flow_start_microseconds`*:: +*`rsa.misc.disposition`*:: + -- -type: date +This key captures the The end state of an action. + +type: keyword -- -*`netflow.flow_end_microseconds`*:: +*`rsa.misc.result_code`*:: + -- -type: date +This key is used to capture the outcome/result numeric value of an action in a session + +type: keyword -- -*`netflow.flow_start_nanoseconds`*:: +*`rsa.misc.category`*:: + -- -type: date +This key is used to capture the category of an event given by the vendor in the session + +type: keyword -- -*`netflow.flow_end_nanoseconds`*:: +*`rsa.misc.obj_name`*:: + -- -type: date +This is used to capture name of object + +type: keyword -- -*`netflow.flow_start_delta_microseconds`*:: +*`rsa.misc.obj_type`*:: + -- -type: long +This is used to capture type of object + +type: keyword -- -*`netflow.flow_end_delta_microseconds`*:: +*`rsa.misc.event_source`*:: + -- -type: long +This key captures Source of the event that’s not a hostname + +type: keyword -- -*`netflow.system_init_time_milliseconds`*:: +*`rsa.misc.log_session_id`*:: + -- -type: date +This key is used to capture a sessionid from the session directly + +type: keyword -- -*`netflow.flow_duration_milliseconds`*:: +*`rsa.misc.group`*:: + -- -type: long +This key captures the Group Name value + +type: keyword -- -*`netflow.flow_duration_microseconds`*:: +*`rsa.misc.policy_name`*:: + -- -type: long +This key is used to capture the Policy Name only. + +type: keyword -- -*`netflow.observed_flow_total_count`*:: +*`rsa.misc.rule_name`*:: + -- -type: long +This key captures the Rule Name + +type: keyword -- -*`netflow.ignored_packet_total_count`*:: +*`rsa.misc.context`*:: + -- -type: long +This key captures Information which adds additional context to the event. + +type: keyword -- -*`netflow.ignored_octet_total_count`*:: +*`rsa.misc.change_new`*:: + -- -type: long +This key is used to capture the new values of the attribute that’s changing in a session + +type: keyword -- -*`netflow.not_sent_flow_total_count`*:: +*`rsa.misc.space`*:: + -- -type: long +type: keyword -- -*`netflow.not_sent_packet_total_count`*:: +*`rsa.misc.client`*:: + -- -type: long +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + +type: keyword -- -*`netflow.not_sent_octet_total_count`*:: +*`rsa.misc.msgIdPart1`*:: + -- -type: long +type: keyword -- -*`netflow.destination_ipv6_prefix`*:: +*`rsa.misc.msgIdPart2`*:: + -- -type: ip +type: keyword -- -*`netflow.source_ipv6_prefix`*:: +*`rsa.misc.change_old`*:: + -- -type: ip +This key is used to capture the old value of the attribute that’s changing in a session + +type: keyword -- -*`netflow.post_octet_total_count`*:: +*`rsa.misc.operation_id`*:: + -- -type: long +An alert number or operation number. The values should be unique and non-repeating. + +type: keyword -- -*`netflow.post_packet_total_count`*:: +*`rsa.misc.event_state`*:: + -- -type: long +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + +type: keyword -- -*`netflow.flow_key_indicator`*:: +*`rsa.misc.group_object`*:: + -- -type: long +This key captures a collection/grouping of entities. Specific usage + +type: keyword -- -*`netflow.post_mcast_packet_total_count`*:: +*`rsa.misc.node`*:: + -- -type: long +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + +type: keyword -- -*`netflow.post_mcast_octet_total_count`*:: +*`rsa.misc.rule`*:: + -- -type: long +This key captures the Rule number + +type: keyword -- -*`netflow.icmp_type_ipv4`*:: +*`rsa.misc.device_name`*:: + -- -type: short +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + +type: keyword -- -*`netflow.icmp_code_ipv4`*:: +*`rsa.misc.param`*:: + -- -type: short +This key is the parameters passed as part of a command or application, etc. + +type: keyword -- -*`netflow.icmp_type_ipv6`*:: +*`rsa.misc.change_attrib`*:: + -- -type: short +This key is used to capture the name of the attribute that’s changing in a session + +type: keyword -- -*`netflow.icmp_code_ipv6`*:: +*`rsa.misc.event_computer`*:: + -- -type: short +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + +type: keyword -- -*`netflow.udp_source_port`*:: +*`rsa.misc.reference_id1`*:: + -- -type: integer +This key is for Linked ID to be used as an addition to "reference.id" + +type: keyword -- -*`netflow.udp_destination_port`*:: +*`rsa.misc.event_log`*:: + -- -type: integer +This key captures the Name of the event log + +type: keyword -- -*`netflow.tcp_source_port`*:: +*`rsa.misc.OS`*:: + -- -type: integer +This key captures the Name of the Operating System + +type: keyword -- -*`netflow.tcp_destination_port`*:: +*`rsa.misc.terminal`*:: + -- -type: integer +This key captures the Terminal Names only + +type: keyword -- -*`netflow.tcp_sequence_number`*:: +*`rsa.misc.msgIdPart3`*:: + -- -type: long +type: keyword -- -*`netflow.tcp_acknowledgement_number`*:: +*`rsa.misc.filter`*:: + -- -type: long +This key captures Filter used to reduce result set + +type: keyword -- -*`netflow.tcp_window_size`*:: +*`rsa.misc.serial_number`*:: + -- -type: integer +This key is the Serial number associated with a physical asset. + +type: keyword -- -*`netflow.tcp_urgent_pointer`*:: +*`rsa.misc.checksum`*:: + -- -type: integer +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + +type: keyword -- -*`netflow.tcp_header_length`*:: +*`rsa.misc.event_user`*:: + -- -type: short +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + +type: keyword -- -*`netflow.ip_header_length`*:: +*`rsa.misc.virusname`*:: + -- -type: short +This key captures the name of the virus + +type: keyword -- -*`netflow.total_length_ipv4`*:: +*`rsa.misc.content_type`*:: + -- -type: integer +This key is used to capture Content Type only. + +type: keyword -- -*`netflow.payload_length_ipv6`*:: +*`rsa.misc.group_id`*:: + -- -type: integer +This key captures Group ID Number (related to the group name) + +type: keyword -- -*`netflow.ip_ttl`*:: +*`rsa.misc.policy_id`*:: + -- -type: short +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + +type: keyword -- -*`netflow.next_header_ipv6`*:: +*`rsa.misc.vsys`*:: + -- -type: short +This key captures Virtual System Name + +type: keyword -- -*`netflow.mpls_payload_length`*:: +*`rsa.misc.connection_id`*:: + -- -type: long +This key captures the Connection ID + +type: keyword -- -*`netflow.ip_diff_serv_code_point`*:: +*`rsa.misc.reference_id2`*:: + -- -type: short +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + +type: keyword -- -*`netflow.ip_precedence`*:: +*`rsa.misc.sensor`*:: + -- -type: short +This key captures Name of the sensor. Typically used in IDS/IPS based devices + +type: keyword -- -*`netflow.fragment_flags`*:: +*`rsa.misc.sig_id`*:: + -- -type: short +This key captures IDS/IPS Int Signature ID + +type: long -- -*`netflow.octet_delta_sum_of_squares`*:: +*`rsa.misc.port_name`*:: + -- -type: long +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + +type: keyword -- -*`netflow.octet_total_sum_of_squares`*:: +*`rsa.misc.rule_group`*:: + -- -type: long +This key captures the Rule group name + +type: keyword -- -*`netflow.mpls_top_label_ttl`*:: +*`rsa.misc.risk_num`*:: + -- -type: short +This key captures a Numeric Risk value + +type: double -- -*`netflow.mpls_label_stack_length`*:: +*`rsa.misc.trigger_val`*:: + -- -type: long +This key captures the Value of the trigger or threshold condition. + +type: keyword -- -*`netflow.mpls_label_stack_depth`*:: +*`rsa.misc.log_session_id1`*:: + -- -type: long +This key is used to capture a Linked (Related) Session ID from the session directly + +type: keyword -- -*`netflow.mpls_top_label_exp`*:: +*`rsa.misc.comp_version`*:: + -- -type: short +This key captures the Version level of a sub-component of a product. + +type: keyword -- -*`netflow.ip_payload_length`*:: +*`rsa.misc.content_version`*:: + -- -type: long +This key captures Version level of a signature or database content. + +type: keyword -- -*`netflow.udp_message_length`*:: +*`rsa.misc.hardware_id`*:: + -- -type: integer +This key is used to capture unique identifier for a device or system (NOT a Mac address) + +type: keyword -- -*`netflow.is_multicast`*:: +*`rsa.misc.risk`*:: + -- -type: short +This key captures the non-numeric risk value + +type: keyword -- -*`netflow.ipv4_ihl`*:: +*`rsa.misc.event_id`*:: + -- -type: short +type: keyword -- -*`netflow.ipv4_options`*:: +*`rsa.misc.reason`*:: + -- -type: long +type: keyword -- -*`netflow.tcp_options`*:: +*`rsa.misc.status`*:: + -- -type: long +type: keyword -- -*`netflow.padding_octets`*:: +*`rsa.misc.mail_id`*:: + -- -type: short +This key is used to capture the mailbox id/name + +type: keyword -- -*`netflow.collector_ipv4_address`*:: +*`rsa.misc.rule_uid`*:: + -- -type: ip +This key is the Unique Identifier for a rule. + +type: keyword -- -*`netflow.collector_ipv6_address`*:: +*`rsa.misc.trigger_desc`*:: + -- -type: ip +This key captures the Description of the trigger or threshold condition. + +type: keyword -- -*`netflow.export_interface`*:: +*`rsa.misc.inout`*:: + -- -type: long +type: keyword -- -*`netflow.export_protocol_version`*:: +*`rsa.misc.p_msgid`*:: + -- -type: short +type: keyword -- -*`netflow.export_transport_protocol`*:: +*`rsa.misc.data_type`*:: + -- -type: short +type: keyword -- -*`netflow.collector_transport_port`*:: +*`rsa.misc.msgIdPart4`*:: + -- -type: integer +type: keyword -- -*`netflow.exporter_transport_port`*:: +*`rsa.misc.error`*:: + -- -type: integer +This key captures All non successful Error codes or responses + +type: keyword -- -*`netflow.tcp_syn_total_count`*:: +*`rsa.misc.index`*:: + -- -type: long +type: keyword -- -*`netflow.tcp_fin_total_count`*:: +*`rsa.misc.listnum`*:: + -- -type: long +This key is used to capture listname or listnumber, primarily for collecting access-list + +type: keyword -- -*`netflow.tcp_rst_total_count`*:: +*`rsa.misc.ntype`*:: + -- -type: long +type: keyword -- -*`netflow.tcp_psh_total_count`*:: +*`rsa.misc.observed_val`*:: + -- -type: long +This key captures the Value observed (from the perspective of the device generating the log). + +type: keyword -- -*`netflow.tcp_ack_total_count`*:: +*`rsa.misc.policy_value`*:: + -- -type: long +This key captures the contents of the policy. This contains details about the policy + +type: keyword -- -*`netflow.tcp_urg_total_count`*:: +*`rsa.misc.pool_name`*:: + -- -type: long +This key captures the name of a resource pool + +type: keyword -- -*`netflow.ip_total_length`*:: +*`rsa.misc.rule_template`*:: + -- -type: long +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + +type: keyword -- -*`netflow.post_nat_source_ipv4_address`*:: +*`rsa.misc.count`*:: + -- -type: ip +type: keyword -- -*`netflow.post_nat_destination_ipv4_address`*:: +*`rsa.misc.number`*:: + -- -type: ip +type: keyword -- -*`netflow.post_napt_source_transport_port`*:: +*`rsa.misc.sigcat`*:: + -- -type: integer +type: keyword -- -*`netflow.post_napt_destination_transport_port`*:: +*`rsa.misc.type`*:: + -- -type: integer +type: keyword -- -*`netflow.nat_originating_address_realm`*:: +*`rsa.misc.comments`*:: + -- -type: short +Comment information provided in the log message + +type: keyword -- -*`netflow.nat_event`*:: +*`rsa.misc.doc_number`*:: + -- -type: short +This key captures File Identification number + +type: long -- -*`netflow.initiator_octets`*:: +*`rsa.misc.expected_val`*:: + -- -type: long +This key captures the Value expected (from the perspective of the device generating the log). + +type: keyword -- -*`netflow.responder_octets`*:: +*`rsa.misc.job_num`*:: + -- -type: long +This key captures the Job Number + +type: keyword -- -*`netflow.firewall_event`*:: +*`rsa.misc.spi_dst`*:: + -- -type: short +Destination SPI Index + +type: keyword -- -*`netflow.ingress_vrfid`*:: +*`rsa.misc.spi_src`*:: + -- -type: long +Source SPI Index + +type: keyword -- -*`netflow.egress_vrfid`*:: +*`rsa.misc.code`*:: + -- -type: long +type: keyword -- -*`netflow.vr_fname`*:: +*`rsa.misc.agent_id`*:: + -- +This key is used to capture agent id + type: keyword -- -*`netflow.post_mpls_top_label_exp`*:: +*`rsa.misc.message_body`*:: + -- -type: short +This key captures the The contents of the message body. + +type: keyword -- -*`netflow.tcp_window_scale`*:: +*`rsa.misc.phone`*:: + -- -type: integer +type: keyword -- -*`netflow.biflow_direction`*:: +*`rsa.misc.sig_id_str`*:: + -- -type: short +This key captures a string object of the sigid variable. + +type: keyword -- -*`netflow.ethernet_header_length`*:: +*`rsa.misc.cmd`*:: + -- -type: short +type: keyword -- -*`netflow.ethernet_payload_length`*:: +*`rsa.misc.misc`*:: + -- -type: integer +type: keyword -- -*`netflow.ethernet_total_length`*:: +*`rsa.misc.name`*:: + -- -type: integer +type: keyword -- -*`netflow.dot1q_vlan_id`*:: +*`rsa.misc.cpu`*:: + -- -type: integer +This key is the CPU time used in the execution of the event being recorded. + +type: long -- -*`netflow.dot1q_priority`*:: +*`rsa.misc.event_desc`*:: + -- -type: short +This key is used to capture a description of an event available directly or inferred + +type: keyword -- -*`netflow.dot1q_customer_vlan_id`*:: +*`rsa.misc.sig_id1`*:: + -- -type: integer +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long -- -*`netflow.dot1q_customer_priority`*:: +*`rsa.misc.im_buddyid`*:: + -- -type: short +type: keyword -- -*`netflow.metro_evc_id`*:: +*`rsa.misc.im_client`*:: + -- type: keyword -- -*`netflow.metro_evc_type`*:: +*`rsa.misc.im_userid`*:: + -- -type: short +type: keyword -- -*`netflow.pseudo_wire_id`*:: +*`rsa.misc.pid`*:: + -- -type: long +type: keyword -- -*`netflow.pseudo_wire_type`*:: +*`rsa.misc.priority`*:: + -- -type: integer +type: keyword -- -*`netflow.pseudo_wire_control_word`*:: +*`rsa.misc.context_subject`*:: + -- -type: long +This key is to be used in an audit context where the subject is the object being identified + +type: keyword -- -*`netflow.ingress_physical_interface`*:: +*`rsa.misc.context_target`*:: + -- -type: long +type: keyword -- -*`netflow.egress_physical_interface`*:: +*`rsa.misc.cve`*:: + -- -type: long +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + +type: keyword -- -*`netflow.post_dot1q_vlan_id`*:: +*`rsa.misc.fcatnum`*:: + -- -type: integer +This key captures Filter Category Number. Legacy Usage + +type: keyword -- -*`netflow.post_dot1q_customer_vlan_id`*:: +*`rsa.misc.library`*:: + -- -type: integer +This key is used to capture library information in mainframe devices + +type: keyword -- -*`netflow.ethernet_type`*:: +*`rsa.misc.parent_node`*:: + -- -type: integer +This key captures the Parent Node Name. Must be related to node variable. + +type: keyword -- -*`netflow.post_ip_precedence`*:: +*`rsa.misc.risk_info`*:: + -- -type: short +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword -- -*`netflow.collection_time_milliseconds`*:: +*`rsa.misc.tcp_flags`*:: + -- -type: date +This key is captures the TCP flags set in any packet of session + +type: long -- -*`netflow.export_sctp_stream_id`*:: +*`rsa.misc.tos`*:: + -- -type: integer +This key describes the type of service + +type: long -- -*`netflow.max_export_seconds`*:: +*`rsa.misc.vm_target`*:: + -- -type: date +VMWare Target **VMWARE** only varaible. + +type: keyword -- -*`netflow.max_flow_end_seconds`*:: +*`rsa.misc.workspace`*:: + -- -type: date +This key captures Workspace Description + +type: keyword -- -*`netflow.message_md5_checksum`*:: +*`rsa.misc.command`*:: + -- -type: short +type: keyword -- -*`netflow.message_scope`*:: +*`rsa.misc.event_category`*:: + -- -type: short +type: keyword -- -*`netflow.min_export_seconds`*:: +*`rsa.misc.facilityname`*:: + -- -type: date +type: keyword -- -*`netflow.min_flow_start_seconds`*:: +*`rsa.misc.forensic_info`*:: + -- -type: date +type: keyword -- -*`netflow.opaque_octets`*:: +*`rsa.misc.jobname`*:: + -- -type: short +type: keyword -- -*`netflow.session_scope`*:: +*`rsa.misc.mode`*:: + -- -type: short +type: keyword -- -*`netflow.max_flow_end_microseconds`*:: +*`rsa.misc.policy`*:: + -- -type: date +type: keyword -- -*`netflow.max_flow_end_milliseconds`*:: +*`rsa.misc.policy_waiver`*:: + -- -type: date +type: keyword -- -*`netflow.max_flow_end_nanoseconds`*:: +*`rsa.misc.second`*:: + -- -type: date +type: keyword -- -*`netflow.min_flow_start_microseconds`*:: +*`rsa.misc.space1`*:: + -- -type: date +type: keyword -- -*`netflow.min_flow_start_milliseconds`*:: +*`rsa.misc.subcategory`*:: + -- -type: date +type: keyword -- -*`netflow.min_flow_start_nanoseconds`*:: +*`rsa.misc.tbdstr2`*:: + -- -type: date +type: keyword -- -*`netflow.collector_certificate`*:: +*`rsa.misc.alert_id`*:: + -- -type: short +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword -- -*`netflow.exporter_certificate`*:: +*`rsa.misc.checksum_dst`*:: + -- -type: short +This key is used to capture the checksum or hash of the the target entity such as a process or file. + +type: keyword -- -*`netflow.data_records_reliability`*:: +*`rsa.misc.checksum_src`*:: + -- -type: boolean +This key is used to capture the checksum or hash of the source entity such as a file or process. + +type: keyword -- -*`netflow.observation_point_type`*:: +*`rsa.misc.fresult`*:: + -- -type: short +This key captures the Filter Result + +type: long -- -*`netflow.new_connection_delta_count`*:: +*`rsa.misc.payload_dst`*:: + -- -type: long +This key is used to capture destination payload + +type: keyword -- -*`netflow.connection_sum_duration_seconds`*:: +*`rsa.misc.payload_src`*:: + -- -type: long +This key is used to capture source payload + +type: keyword -- -*`netflow.connection_transaction_id`*:: +*`rsa.misc.pool_id`*:: + -- -type: long +This key captures the identifier (typically numeric field) of a resource pool + +type: keyword -- -*`netflow.post_nat_source_ipv6_address`*:: +*`rsa.misc.process_id_val`*:: + -- -type: ip +This key is a failure key for Process ID when it is not an integer value + +type: keyword -- -*`netflow.post_nat_destination_ipv6_address`*:: +*`rsa.misc.risk_num_comm`*:: + -- -type: ip +This key captures Risk Number Community + +type: double -- -*`netflow.nat_pool_id`*:: +*`rsa.misc.risk_num_next`*:: + -- -type: long +This key captures Risk Number NextGen + +type: double -- -*`netflow.nat_pool_name`*:: +*`rsa.misc.risk_num_sand`*:: + -- -type: keyword +This key captures Risk Number SandBox + +type: double -- -*`netflow.anonymization_flags`*:: +*`rsa.misc.risk_num_static`*:: + -- -type: integer +This key captures Risk Number Static + +type: double -- -*`netflow.anonymization_technique`*:: +*`rsa.misc.risk_suspicious`*:: + -- -type: integer +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword -- -*`netflow.information_element_index`*:: +*`rsa.misc.risk_warning`*:: + -- -type: integer +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + +type: keyword -- -*`netflow.p2p_technology`*:: +*`rsa.misc.snmp_oid`*:: + -- +SNMP Object Identifier + type: keyword -- -*`netflow.tunnel_technology`*:: +*`rsa.misc.sql`*:: + -- +This key captures the SQL query + type: keyword -- -*`netflow.encrypted_technology`*:: +*`rsa.misc.vuln_ref`*:: + -- +This key captures the Vulnerability Reference details + type: keyword -- -*`netflow.bgp_validity_state`*:: +*`rsa.misc.acl_id`*:: + -- -type: short +type: keyword -- -*`netflow.ip_sec_spi`*:: +*`rsa.misc.acl_op`*:: + -- -type: long +type: keyword -- -*`netflow.gre_key`*:: +*`rsa.misc.acl_pos`*:: + -- -type: long +type: keyword -- -*`netflow.nat_type`*:: +*`rsa.misc.acl_table`*:: + -- -type: short +type: keyword -- -*`netflow.initiator_packets`*:: +*`rsa.misc.admin`*:: + -- -type: long +type: keyword -- -*`netflow.responder_packets`*:: +*`rsa.misc.alarm_id`*:: + -- -type: long +type: keyword -- -*`netflow.observation_domain_name`*:: +*`rsa.misc.alarmname`*:: + -- type: keyword -- -*`netflow.selection_sequence_id`*:: +*`rsa.misc.app_id`*:: + -- -type: long +type: keyword -- -*`netflow.selector_id`*:: +*`rsa.misc.audit`*:: + -- -type: long +type: keyword -- -*`netflow.information_element_id`*:: +*`rsa.misc.audit_object`*:: + -- -type: integer +type: keyword -- -*`netflow.selector_algorithm`*:: +*`rsa.misc.auditdata`*:: + -- -type: integer +type: keyword -- -*`netflow.sampling_packet_interval`*:: +*`rsa.misc.benchmark`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_packet_space`*:: +*`rsa.misc.bypass`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_time_interval`*:: +*`rsa.misc.cache`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_time_space`*:: +*`rsa.misc.cache_hit`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_size`*:: +*`rsa.misc.cefversion`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_population`*:: +*`rsa.misc.cfg_attr`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_probability`*:: +*`rsa.misc.cfg_obj`*:: + -- -type: double +type: keyword -- -*`netflow.data_link_frame_size`*:: +*`rsa.misc.cfg_path`*:: + -- -type: integer +type: keyword -- -*`netflow.ip_header_packet_section`*:: +*`rsa.misc.changes`*:: + -- -type: short +type: keyword -- -*`netflow.ip_payload_packet_section`*:: +*`rsa.misc.client_ip`*:: + -- -type: short +type: keyword -- -*`netflow.data_link_frame_section`*:: +*`rsa.misc.clustermembers`*:: + -- -type: short +type: keyword -- -*`netflow.mpls_label_stack_section`*:: +*`rsa.misc.cn_acttimeout`*:: + -- -type: short +type: keyword -- -*`netflow.mpls_payload_packet_section`*:: +*`rsa.misc.cn_asn_src`*:: + -- -type: short +type: keyword -- -*`netflow.selector_id_total_pkts_observed`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- -type: long +type: keyword -- -*`netflow.selector_id_total_pkts_selected`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -type: long +type: keyword -- -*`netflow.absolute_error`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -type: double +type: keyword -- -*`netflow.relative_error`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -type: double +type: keyword -- -*`netflow.observation_time_seconds`*:: +*`rsa.misc.cn_engine_id`*:: + -- -type: date +type: keyword -- -*`netflow.observation_time_milliseconds`*:: +*`rsa.misc.cn_engine_type`*:: + -- -type: date +type: keyword -- -*`netflow.observation_time_microseconds`*:: +*`rsa.misc.cn_f_switch`*:: + -- -type: date +type: keyword -- -*`netflow.observation_time_nanoseconds`*:: +*`rsa.misc.cn_flowsampid`*:: + -- -type: date +type: keyword -- -*`netflow.digest_hash_value`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- -type: long +type: keyword -- -*`netflow.hash_ip_payload_offset`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- -type: long +type: keyword -- -*`netflow.hash_ip_payload_size`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- -type: long +type: keyword -- -*`netflow.hash_output_range_min`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- -type: long +type: keyword -- -*`netflow.hash_output_range_max`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -type: long +type: keyword -- -*`netflow.hash_selected_range_min`*:: +*`rsa.misc.cn_invalid`*:: + -- -type: long +type: keyword -- -*`netflow.hash_selected_range_max`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -type: long +type: keyword -- -*`netflow.hash_digest_output`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -type: boolean +type: keyword -- -*`netflow.hash_initialiser_value`*:: +*`rsa.misc.cn_l_switch`*:: + -- -type: long +type: keyword -- -*`netflow.selector_name`*:: +*`rsa.misc.cn_log_did`*:: + -- type: keyword -- -*`netflow.upper_ci_limit`*:: +*`rsa.misc.cn_log_rid`*:: + -- -type: double +type: keyword -- -*`netflow.lower_ci_limit`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -type: double +type: keyword -- -*`netflow.confidence_level`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -type: double +type: keyword -- -*`netflow.information_element_data_type`*:: +*`rsa.misc.cn_min_ttl`*:: + -- -type: short +type: keyword -- -*`netflow.information_element_description`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- type: keyword -- -*`netflow.information_element_name`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- type: keyword -- -*`netflow.information_element_range_begin`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -type: long +type: keyword -- -*`netflow.information_element_range_end`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -type: long +type: keyword -- -*`netflow.information_element_semantics`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- -type: short +type: keyword -- -*`netflow.information_element_units`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -type: integer +type: keyword -- -*`netflow.private_enterprise_number`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -type: long +type: keyword -- -*`netflow.virtual_station_interface_id`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -type: short +type: keyword -- -*`netflow.virtual_station_interface_name`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- type: keyword -- -*`netflow.virtual_station_uuid`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -type: short +type: keyword -- -*`netflow.virtual_station_name`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- type: keyword -- -*`netflow.layer2_segment_id`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_octet_delta_count`*:: +*`rsa.misc.cn_mplstoplabip`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_octet_total_count`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -type: long +type: keyword -- -*`netflow.ingress_unicast_packet_total_count`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -type: long +type: keyword -- -*`netflow.ingress_multicast_packet_total_count`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -type: long +type: keyword -- -*`netflow.ingress_broadcast_packet_total_count`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -type: long +type: keyword -- -*`netflow.egress_unicast_packet_total_count`*:: +*`rsa.misc.cn_sampint`*:: + -- -type: long +type: keyword -- -*`netflow.egress_broadcast_packet_total_count`*:: +*`rsa.misc.cn_seqctr`*:: + -- -type: long +type: keyword -- -*`netflow.monitoring_interval_start_milli_seconds`*:: +*`rsa.misc.cn_spackets`*:: + -- -type: date +type: keyword -- -*`netflow.monitoring_interval_end_milli_seconds`*:: +*`rsa.misc.cn_src_tos`*:: + -- -type: date +type: keyword -- -*`netflow.port_range_start`*:: +*`rsa.misc.cn_src_vlan`*:: + -- -type: integer +type: keyword -- -*`netflow.port_range_end`*:: +*`rsa.misc.cn_sysuptime`*:: + -- -type: integer +type: keyword -- -*`netflow.port_range_step_size`*:: +*`rsa.misc.cn_template_id`*:: + -- -type: integer +type: keyword -- -*`netflow.port_range_num_ports`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- -type: integer +type: keyword -- -*`netflow.sta_mac_address`*:: +*`rsa.misc.cn_totflowexp`*:: + -- type: keyword -- -*`netflow.sta_ipv4_address`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- -type: ip +type: keyword -- -*`netflow.wtp_mac_address`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- type: keyword -- -*`netflow.ingress_interface_type`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- -type: long +type: keyword -- -*`netflow.egress_interface_type`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- -type: long +type: keyword -- -*`netflow.rtp_sequence_number`*:: +*`rsa.misc.comp_class`*:: + -- -type: integer +type: keyword -- -*`netflow.user_name`*:: +*`rsa.misc.comp_name`*:: + -- type: keyword -- -*`netflow.application_category_name`*:: +*`rsa.misc.comp_rbytes`*:: + -- type: keyword -- -*`netflow.application_sub_category_name`*:: +*`rsa.misc.comp_sbytes`*:: + -- type: keyword -- -*`netflow.application_group_name`*:: +*`rsa.misc.cpu_data`*:: + -- type: keyword -- -*`netflow.original_flows_present`*:: +*`rsa.misc.criticality`*:: + -- -type: long +type: keyword -- -*`netflow.original_flows_initiated`*:: +*`rsa.misc.cs_agency_dst`*:: + -- -type: long +type: keyword -- -*`netflow.original_flows_completed`*:: +*`rsa.misc.cs_analyzedby`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_source_ip_address`*:: +*`rsa.misc.cs_av_other`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_destination_ip_address`*:: +*`rsa.misc.cs_av_primary`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_source_ipv4_address`*:: +*`rsa.misc.cs_av_secondary`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_destination_ipv4_address`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_source_ipv6_address`*:: +*`rsa.misc.cs_bit9status`*:: + -- -type: long +type: keyword -- -*`netflow.distinct_count_of_destination_ipv6_address`*:: +*`rsa.misc.cs_context`*:: + -- -type: long +type: keyword -- -*`netflow.value_distribution_method`*:: +*`rsa.misc.cs_control`*:: + -- -type: short +type: keyword -- -*`netflow.rfc3550_jitter_milliseconds`*:: +*`rsa.misc.cs_data`*:: + -- -type: long +type: keyword -- -*`netflow.rfc3550_jitter_microseconds`*:: +*`rsa.misc.cs_datecret`*:: + -- -type: long +type: keyword -- -*`netflow.rfc3550_jitter_nanoseconds`*:: +*`rsa.misc.cs_dst_tld`*:: + -- -type: long +type: keyword -- -*`netflow.dot1q_dei`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- -type: boolean +type: keyword -- -*`netflow.dot1q_customer_dei`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -type: boolean +type: keyword -- -*`netflow.flow_selector_algorithm`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -type: integer +type: keyword -- -*`netflow.flow_selected_octet_delta_count`*:: +*`rsa.misc.cs_filetype`*:: + -- -type: long +type: keyword -- -*`netflow.flow_selected_packet_delta_count`*:: +*`rsa.misc.cs_fld`*:: + -- -type: long +type: keyword -- -*`netflow.flow_selected_flow_delta_count`*:: +*`rsa.misc.cs_if_desc`*:: + -- -type: long +type: keyword -- -*`netflow.selector_id_total_flows_observed`*:: +*`rsa.misc.cs_if_name`*:: + -- -type: long +type: keyword -- -*`netflow.selector_id_total_flows_selected`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_flow_interval`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- -type: long +type: keyword -- -*`netflow.sampling_flow_spacing`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- -type: long +type: keyword -- -*`netflow.flow_sampling_time_interval`*:: +*`rsa.misc.cs_lifetime`*:: + -- -type: long +type: keyword -- -*`netflow.flow_sampling_time_spacing`*:: +*`rsa.misc.cs_log_medium`*:: + -- -type: long +type: keyword -- -*`netflow.hash_flow_domain`*:: +*`rsa.misc.cs_loginname`*:: + -- -type: integer +type: keyword -- -*`netflow.transport_octet_delta_count`*:: +*`rsa.misc.cs_modulescore`*:: + -- -type: long +type: keyword -- -*`netflow.transport_packet_delta_count`*:: +*`rsa.misc.cs_modulesign`*:: + -- -type: long +type: keyword -- -*`netflow.original_exporter_ipv4_address`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -type: ip +type: keyword -- -*`netflow.original_exporter_ipv6_address`*:: +*`rsa.misc.cs_payload`*:: + -- -type: ip +type: keyword -- -*`netflow.original_observation_domain_id`*:: +*`rsa.misc.cs_registrant`*:: + -- -type: long +type: keyword -- -*`netflow.intermediate_process_id`*:: +*`rsa.misc.cs_registrar`*:: + -- -type: long +type: keyword -- -*`netflow.ignored_data_record_total_count`*:: +*`rsa.misc.cs_represult`*:: + -- -type: long +type: keyword -- -*`netflow.data_link_frame_type`*:: +*`rsa.misc.cs_rpayload`*:: + -- -type: integer +type: keyword -- -*`netflow.section_offset`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -type: integer +type: keyword -- -*`netflow.section_exported_octets`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -type: integer +type: keyword -- -*`netflow.dot1q_service_instance_tag`*:: +*`rsa.misc.cs_streams`*:: + -- -type: short +type: keyword -- -*`netflow.dot1q_service_instance_id`*:: +*`rsa.misc.cs_targetmodule`*:: + -- -type: long +type: keyword -- -*`netflow.dot1q_service_instance_priority`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -type: short +type: keyword -- -*`netflow.dot1q_customer_source_mac_address`*:: +*`rsa.misc.cs_whois_server`*:: + -- type: keyword -- -*`netflow.dot1q_customer_destination_mac_address`*:: +*`rsa.misc.cs_yararesult`*:: + -- type: keyword -- -*`netflow.post_layer2_octet_delta_count`*:: +*`rsa.misc.description`*:: + -- -type: long +type: keyword -- -*`netflow.post_mcast_layer2_octet_delta_count`*:: +*`rsa.misc.devvendor`*:: + -- -type: long +type: keyword -- -*`netflow.post_layer2_octet_total_count`*:: +*`rsa.misc.distance`*:: + -- -type: long +type: keyword -- -*`netflow.post_mcast_layer2_octet_total_count`*:: +*`rsa.misc.dstburb`*:: + -- -type: long +type: keyword -- -*`netflow.minimum_layer2_total_length`*:: +*`rsa.misc.edomain`*:: + -- -type: long +type: keyword -- -*`netflow.maximum_layer2_total_length`*:: +*`rsa.misc.edomaub`*:: + -- -type: long +type: keyword -- -*`netflow.dropped_layer2_octet_delta_count`*:: +*`rsa.misc.euid`*:: + -- -type: long +type: keyword -- -*`netflow.dropped_layer2_octet_total_count`*:: +*`rsa.misc.facility`*:: + -- -type: long +type: keyword -- -*`netflow.ignored_layer2_octet_total_count`*:: +*`rsa.misc.finterface`*:: + -- -type: long +type: keyword -- -*`netflow.not_sent_layer2_octet_total_count`*:: +*`rsa.misc.flags`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_octet_delta_sum_of_squares`*:: +*`rsa.misc.gaddr`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_octet_total_sum_of_squares`*:: +*`rsa.misc.id3`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_frame_delta_count`*:: +*`rsa.misc.im_buddyname`*:: + -- -type: long +type: keyword -- -*`netflow.layer2_frame_total_count`*:: +*`rsa.misc.im_croomid`*:: + -- -type: long +type: keyword -- -*`netflow.pseudo_wire_destination_ipv4_address`*:: +*`rsa.misc.im_croomtype`*:: + -- -type: ip +type: keyword -- -*`netflow.ignored_layer2_frame_total_count`*:: +*`rsa.misc.im_members`*:: + -- -type: long +type: keyword -- -*`netflow.mib_object_value_integer`*:: +*`rsa.misc.im_username`*:: + -- -type: integer +type: keyword -- -*`netflow.mib_object_value_octet_string`*:: +*`rsa.misc.ipkt`*:: + -- -type: short +type: keyword -- -*`netflow.mib_object_value_oid`*:: +*`rsa.misc.ipscat`*:: + -- -type: short +type: keyword -- -*`netflow.mib_object_value_bits`*:: +*`rsa.misc.ipspri`*:: + -- -type: short +type: keyword -- -*`netflow.mib_object_value_ip_address`*:: +*`rsa.misc.latitude`*:: + -- -type: ip +type: keyword -- -*`netflow.mib_object_value_counter`*:: +*`rsa.misc.linenum`*:: + -- -type: long +type: keyword -- -*`netflow.mib_object_value_gauge`*:: +*`rsa.misc.list_name`*:: + -- -type: long +type: keyword -- -*`netflow.mib_object_value_time_ticks`*:: +*`rsa.misc.load_data`*:: + -- -type: long +type: keyword -- -*`netflow.mib_object_value_unsigned`*:: +*`rsa.misc.location_floor`*:: + -- -type: long +type: keyword -- -*`netflow.mib_object_identifier`*:: +*`rsa.misc.location_mark`*:: + -- -type: short +type: keyword -- -*`netflow.mib_sub_identifier`*:: +*`rsa.misc.log_id`*:: + -- -type: long +type: keyword -- -*`netflow.mib_index_indicator`*:: +*`rsa.misc.log_type`*:: + -- -type: long +type: keyword -- -*`netflow.mib_capture_time_semantics`*:: +*`rsa.misc.logid`*:: + -- -type: short +type: keyword -- -*`netflow.mib_context_engine_id`*:: +*`rsa.misc.logip`*:: + -- -type: short +type: keyword -- -*`netflow.mib_context_name`*:: +*`rsa.misc.logname`*:: + -- type: keyword -- -*`netflow.mib_object_name`*:: +*`rsa.misc.longitude`*:: + -- type: keyword -- -*`netflow.mib_object_description`*:: +*`rsa.misc.lport`*:: + -- type: keyword -- -*`netflow.mib_object_syntax`*:: +*`rsa.misc.mbug_data`*:: + -- type: keyword -- -*`netflow.mib_module_name`*:: +*`rsa.misc.misc_name`*:: + -- type: keyword -- -*`netflow.mobile_imsi`*:: +*`rsa.misc.msg_type`*:: + -- type: keyword -- -*`netflow.mobile_msisdn`*:: +*`rsa.misc.msgid`*:: + -- type: keyword -- -*`netflow.http_status_code`*:: +*`rsa.misc.netsessid`*:: + -- -type: integer +type: keyword -- -*`netflow.source_transport_ports_limit`*:: +*`rsa.misc.num`*:: + -- -type: integer +type: keyword -- -*`netflow.http_request_method`*:: +*`rsa.misc.number1`*:: + -- type: keyword -- -*`netflow.http_request_host`*:: +*`rsa.misc.number2`*:: + -- type: keyword -- -*`netflow.http_request_target`*:: +*`rsa.misc.nwwn`*:: + -- type: keyword -- -*`netflow.http_message_version`*:: +*`rsa.misc.object`*:: + -- type: keyword -- -*`netflow.nat_instance_id`*:: +*`rsa.misc.operation`*:: + -- -type: long +type: keyword -- -*`netflow.internal_address_realm`*:: +*`rsa.misc.opkt`*:: + -- -type: short +type: keyword -- -*`netflow.external_address_realm`*:: +*`rsa.misc.orig_from`*:: + -- -type: short +type: keyword -- -*`netflow.nat_quota_exceeded_event`*:: +*`rsa.misc.owner_id`*:: + -- -type: long +type: keyword -- -*`netflow.nat_threshold_event`*:: +*`rsa.misc.p_action`*:: + -- -type: long +type: keyword -- -*`netflow.http_user_agent`*:: +*`rsa.misc.p_filter`*:: + -- type: keyword -- -*`netflow.http_content_type`*:: +*`rsa.misc.p_group_object`*:: + -- type: keyword -- -*`netflow.http_reason_phrase`*:: +*`rsa.misc.p_id`*:: + -- type: keyword -- -*`netflow.max_session_entries`*:: +*`rsa.misc.p_msgid1`*:: + -- -type: long +type: keyword -- -*`netflow.max_bib_entries`*:: +*`rsa.misc.p_msgid2`*:: + -- -type: long +type: keyword -- -*`netflow.max_entries_per_user`*:: +*`rsa.misc.p_result1`*:: + -- -type: long +type: keyword -- -*`netflow.max_subscribers`*:: +*`rsa.misc.password_chg`*:: + -- -type: long +type: keyword -- -*`netflow.max_fragments_pending_reassembly`*:: +*`rsa.misc.password_expire`*:: + -- -type: long +type: keyword -- -*`netflow.address_pool_high_threshold`*:: +*`rsa.misc.permgranted`*:: + -- -type: long +type: keyword -- -*`netflow.address_pool_low_threshold`*:: +*`rsa.misc.permwanted`*:: + -- -type: long +type: keyword -- -*`netflow.address_port_mapping_high_threshold`*:: +*`rsa.misc.pgid`*:: + -- -type: long +type: keyword -- -*`netflow.address_port_mapping_low_threshold`*:: +*`rsa.misc.policyUUID`*:: + -- -type: long +type: keyword -- -*`netflow.address_port_mapping_per_user_high_threshold`*:: +*`rsa.misc.prog_asp_num`*:: + -- -type: long +type: keyword -- -*`netflow.global_address_mapping_high_threshold`*:: +*`rsa.misc.program`*:: + -- -type: long +type: keyword -- -*`netflow.vpn_identifier`*:: +*`rsa.misc.real_data`*:: + -- -type: short +type: keyword -- -[[exported-fields-netscout]] -== Arbor Peakflow SP fields - -netscout fields. - - - -*`network.interface.name`*:: +*`rsa.misc.rec_asp_device`*:: + -- -Name of the network interface where the traffic has been observed. - - type: keyword -- - - -*`rsa.internal.msg`*:: +*`rsa.misc.rec_asp_num`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder - type: keyword -- -*`rsa.internal.messageid`*:: +*`rsa.misc.rec_library`*:: + -- type: keyword -- -*`rsa.internal.event_desc`*:: +*`rsa.misc.recordnum`*:: + -- type: keyword -- -*`rsa.internal.message`*:: +*`rsa.misc.ruid`*:: + -- -This key captures the contents of instant messages - type: keyword -- -*`rsa.internal.time`*:: +*`rsa.misc.sburb`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - -type: date +type: keyword -- -*`rsa.internal.level`*:: +*`rsa.misc.sdomain_fld`*:: + -- -Deprecated key defined only in table map. - -type: long +type: keyword -- -*`rsa.internal.msg_id`*:: +*`rsa.misc.sec`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.msg_vid`*:: +*`rsa.misc.sensorname`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.data`*:: +*`rsa.misc.seqnum`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.obj_server`*:: +*`rsa.misc.session`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.obj_val`*:: +*`rsa.misc.sessiontype`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.resource`*:: +*`rsa.misc.sigUUID`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.obj_id`*:: +*`rsa.misc.spi`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.statement`*:: +*`rsa.misc.srcburb`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.audit_class`*:: +*`rsa.misc.srcdom`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.entry`*:: +*`rsa.misc.srcservice`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.hcode`*:: +*`rsa.misc.state`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.inode`*:: +*`rsa.misc.status1`*:: + -- -Deprecated key defined only in table map. - -type: long +type: keyword -- -*`rsa.internal.resource_class`*:: +*`rsa.misc.svcno`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.dead`*:: +*`rsa.misc.system`*:: + -- -Deprecated key defined only in table map. - -type: long +type: keyword -- -*`rsa.internal.feed_desc`*:: +*`rsa.misc.tbdstr1`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.feed_name`*:: +*`rsa.misc.tgtdom`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.cid`*:: +*`rsa.misc.tgtdomain`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_class`*:: +*`rsa.misc.threshold`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_group`*:: +*`rsa.misc.type1`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_host`*:: +*`rsa.misc.udb_class`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_ip`*:: +*`rsa.misc.url_fld`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: ip +type: keyword -- -*`rsa.internal.device_ipv6`*:: +*`rsa.misc.user_div`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: ip +type: keyword -- -*`rsa.internal.device_type`*:: +*`rsa.misc.userid`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_type_id`*:: +*`rsa.misc.username_fld`*:: + -- -Deprecated key defined only in table map. - -type: long +type: keyword -- -*`rsa.internal.did`*:: +*`rsa.misc.utcstamp`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.entropy_req`*:: +*`rsa.misc.v_instafname`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - -type: long +type: keyword -- -*`rsa.internal.entropy_res`*:: +*`rsa.misc.virt_data`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - -type: long +type: keyword -- -*`rsa.internal.event_name`*:: +*`rsa.misc.vpnid`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.feed_category`*:: +*`rsa.misc.autorun_type`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This is used to capture Auto Run type type: keyword -- -*`rsa.internal.forward_ip`*:: +*`rsa.misc.cc_number`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. +Valid Credit Card Numbers only -type: ip +type: long -- -*`rsa.internal.forward_ipv6`*:: +*`rsa.misc.content`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the content type from protocol headers -type: ip +type: keyword -- -*`rsa.internal.header_id`*:: +*`rsa.misc.ein_number`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Employee Identification Numbers only -type: keyword +type: long -- -*`rsa.internal.lc_cid`*:: +*`rsa.misc.found`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This is used to capture the results of regex match type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`rsa.misc.language`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This is used to capture list of languages the client support and what it prefers -type: date +type: keyword -- -*`rsa.internal.mcb_req`*:: +*`rsa.misc.lifetime`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +This key is used to capture the session lifetime in seconds. type: long -- -*`rsa.internal.mcb_res`*:: +*`rsa.misc.link`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: long +type: keyword -- -*`rsa.internal.mcbc_req`*:: +*`rsa.misc.match`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +This key is for regex match name from search.ini -type: long +type: keyword -- -*`rsa.internal.mcbc_res`*:: +*`rsa.misc.param_dst`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +This key captures the command line/launch argument of the target process or file -type: long +type: keyword -- -*`rsa.internal.medium`*:: +*`rsa.misc.param_src`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +This key captures source parameter -type: long +type: keyword -- -*`rsa.internal.node_name`*:: +*`rsa.misc.search_text`*:: + -- -Deprecated key defined only in table map. +This key captures the Search Text used type: keyword -- -*`rsa.internal.nwe_callback_id`*:: +*`rsa.misc.sig_name`*:: + -- -This key denotes that event is endpoint related +This key is used to capture the Signature Name only. type: keyword -- -*`rsa.internal.parse_error`*:: +*`rsa.misc.snmp_value`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +SNMP set request value type: keyword -- -*`rsa.internal.payload_req`*:: +*`rsa.misc.streams`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +This key captures number of streams in session type: long -- -*`rsa.internal.payload_res`*:: + +*`rsa.db.index`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +This key captures IndexID of the index. -type: long +type: keyword -- -*`rsa.internal.process_vid_dst`*:: +*`rsa.db.instance`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. +This key is used to capture the database server instance name type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session + +type: keyword + +-- + +*`rsa.db.transact_id`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +This key captures the SQL transantion ID of the current session type: keyword -- -*`rsa.internal.rid`*:: +*`rsa.db.permissions`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures permission or privilege level assigned to a resource. -type: long +type: keyword -- -*`rsa.internal.session_split`*:: +*`rsa.db.table_name`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used to capture the table name type: keyword -- -*`rsa.internal.site`*:: +*`rsa.db.db_id`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the unique identifier for a database type: keyword -- -*`rsa.internal.size`*:: +*`rsa.db.db_pid`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the process id of a connection with database server type: long -- -*`rsa.internal.sourcefile`*:: +*`rsa.db.lread`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is used for the number of logical reads -type: keyword +type: long -- -*`rsa.internal.ubc_req`*:: +*`rsa.db.lwrite`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +This key is used for the number of logical writes type: long -- -*`rsa.internal.ubc_res`*:: +*`rsa.db.pread`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +This key is used for the number of physical writes type: long -- -*`rsa.internal.word`*:: + +*`rsa.network.alias_host`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. type: keyword -- - -*`rsa.time.event_time`*:: +*`rsa.network.domain`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - -type: date +type: keyword -- -*`rsa.time.duration_time`*:: +*`rsa.network.host_dst`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. +This key should only be used when it’s a Destination Hostname -type: double +type: keyword -- -*`rsa.time.event_time_str`*:: +*`rsa.network.network_service`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string +This is used to capture layer 7 protocols/service names type: keyword -- -*`rsa.time.starttime`*:: +*`rsa.network.interface`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form +This key should be used when the source or destination context of an interface is not clear -type: date +type: keyword -- -*`rsa.time.month`*:: +*`rsa.network.network_port`*:: + -- -type: keyword +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long -- -*`rsa.time.day`*:: +*`rsa.network.eth_host`*:: + -- +Deprecated, use alias.mac + type: keyword -- -*`rsa.time.endtime`*:: +*`rsa.network.sinterface`*:: + -- -This key is used to capture the End time mentioned in a session in a standard form +This key should only be used when it’s a Source Interface -type: date +type: keyword -- -*`rsa.time.timezone`*:: +*`rsa.network.dinterface`*:: + -- -This key is used to capture the timezone of the Event Time +This key should only be used when it’s a Destination Interface type: keyword -- -*`rsa.time.duration_str`*:: +*`rsa.network.vlan`*:: + -- -A text string version of the duration +This key should only be used to capture the ID of the Virtual LAN -type: keyword +type: long -- -*`rsa.time.date`*:: +*`rsa.network.zone_src`*:: + -- +This key should only be used when it’s a Source Zone. + type: keyword -- -*`rsa.time.year`*:: +*`rsa.network.zone`*:: + -- +This key should be used when the source or destination context of a Zone is not clear + type: keyword -- -*`rsa.time.recorded_time`*:: +*`rsa.network.zone_dst`*:: + -- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. +This key should only be used when it’s a Destination Zone. -type: date +type: keyword -- -*`rsa.time.datetime`*:: +*`rsa.network.gateway`*:: + -- +This key is used to capture the IP Address of the gateway + type: keyword -- -*`rsa.time.effective_time`*:: +*`rsa.network.icmp_type`*:: + -- -This key is the effective time referenced by an individual event in a Standard Timestamp format +This key is used to capture the ICMP type only -type: date +type: long -- -*`rsa.time.expire_time`*:: +*`rsa.network.mask`*:: + -- -This key is the timestamp that explicitly refers to an expiration. +This key is used to capture the device network IPmask. -type: date +type: keyword -- -*`rsa.time.process_time`*:: +*`rsa.network.icmp_code`*:: + -- -Deprecated, use duration.time +This key is used to capture the ICMP code only -type: keyword +type: long -- -*`rsa.time.hour`*:: +*`rsa.network.protocol_detail`*:: + -- +This key should be used to capture additional protocol information + type: keyword -- -*`rsa.time.min`*:: +*`rsa.network.dmask`*:: + -- +This key is used for Destionation Device network mask + type: keyword -- -*`rsa.time.timestamp`*:: +*`rsa.network.port`*:: + -- -type: keyword +This key should only be used to capture a Network Port when the directionality is not clear + +type: long -- -*`rsa.time.event_queue_time`*:: +*`rsa.network.smask`*:: + -- -This key is the Time that the event was queued. +This key is used for capturing source Network Mask -type: date +type: keyword -- -*`rsa.time.p_time1`*:: +*`rsa.network.netname`*:: + -- +This key is used to capture the network name associated with an IP range. This is configured by the end user. + type: keyword -- -*`rsa.time.tzone`*:: +*`rsa.network.paddr`*:: + -- -type: keyword +Deprecated + +type: ip -- -*`rsa.time.eventtime`*:: +*`rsa.network.faddr`*:: + -- type: keyword -- -*`rsa.time.gmtdate`*:: +*`rsa.network.lhost`*:: + -- type: keyword -- -*`rsa.time.gmttime`*:: +*`rsa.network.origin`*:: + -- type: keyword -- -*`rsa.time.p_date`*:: +*`rsa.network.remote_domain_id`*:: + -- type: keyword -- -*`rsa.time.p_month`*:: +*`rsa.network.addr`*:: + -- type: keyword -- -*`rsa.time.p_time`*:: +*`rsa.network.dns_a_record`*:: + -- type: keyword -- -*`rsa.time.p_time2`*:: +*`rsa.network.dns_ptr_record`*:: + -- type: keyword -- -*`rsa.time.p_year`*:: +*`rsa.network.fhost`*:: + -- type: keyword -- -*`rsa.time.expire_time_str`*:: +*`rsa.network.fport`*:: + -- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. - type: keyword -- -*`rsa.time.stamp`*:: +*`rsa.network.laddr`*:: + -- -Deprecated key defined only in table map. - -type: date +type: keyword -- - -*`rsa.misc.action`*:: +*`rsa.network.linterface`*:: + -- type: keyword -- -*`rsa.misc.result`*:: +*`rsa.network.phost`*:: + -- -This key is used to capture the outcome/result string value of an action in a session. - type: keyword -- -*`rsa.misc.severity`*:: +*`rsa.network.ad_computer_dst`*:: + -- -This key is used to capture the severity given the session +Deprecated, use host.dst type: keyword -- -*`rsa.misc.event_type`*:: +*`rsa.network.eth_type`*:: + -- -This key captures the event category type as specified by the event source. +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only -type: keyword +type: long -- -*`rsa.misc.reference_id`*:: +*`rsa.network.ip_proto`*:: + -- -This key is used to capture an event id from the session directly +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI -type: keyword +type: long -- -*`rsa.misc.version`*:: +*`rsa.network.dns_cname_record`*:: + -- -This key captures Version of the application or OS which is generating the event. - type: keyword -- -*`rsa.misc.disposition`*:: +*`rsa.network.dns_id`*:: + -- -This key captures the The end state of an action. - type: keyword -- -*`rsa.misc.result_code`*:: +*`rsa.network.dns_opcode`*:: + -- -This key is used to capture the outcome/result numeric value of an action in a session - type: keyword -- -*`rsa.misc.category`*:: +*`rsa.network.dns_resp`*:: + -- -This key is used to capture the category of an event given by the vendor in the session - type: keyword -- -*`rsa.misc.obj_name`*:: +*`rsa.network.dns_type`*:: + -- -This is used to capture name of object - type: keyword -- -*`rsa.misc.obj_type`*:: +*`rsa.network.domain1`*:: + -- -This is used to capture type of object - type: keyword -- -*`rsa.misc.event_source`*:: +*`rsa.network.host_type`*:: + -- -This key captures Source of the event that’s not a hostname - type: keyword -- -*`rsa.misc.log_session_id`*:: +*`rsa.network.packet_length`*:: + -- -This key is used to capture a sessionid from the session directly - type: keyword -- -*`rsa.misc.group`*:: +*`rsa.network.host_orig`*:: + -- -This key captures the Group Name value +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. type: keyword -- -*`rsa.misc.policy_name`*:: +*`rsa.network.rpayload`*:: + -- -This key is used to capture the Policy Name only. +This key is used to capture the total number of payload bytes seen in the retransmitted packets. type: keyword -- -*`rsa.misc.rule_name`*:: +*`rsa.network.vlan_name`*:: + -- -This key captures the Rule Name +This key should only be used to capture the name of the Virtual LAN type: keyword -- -*`rsa.misc.context`*:: + +*`rsa.investigations.ec_activity`*:: + -- -This key captures Information which adds additional context to the event. +This key captures the particular event activity(Ex:Logoff) type: keyword -- -*`rsa.misc.change_new`*:: +*`rsa.investigations.ec_theme`*:: + -- -This key is used to capture the new values of the attribute that’s changing in a session +This key captures the Theme of a particular Event(Ex:Authentication) type: keyword -- -*`rsa.misc.space`*:: +*`rsa.investigations.ec_subject`*:: + -- +This key captures the Subject of a particular Event(Ex:User) + type: keyword -- -*`rsa.misc.client`*:: +*`rsa.investigations.ec_outcome`*:: + -- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. +This key captures the outcome of a particular Event(Ex:Success) type: keyword -- -*`rsa.misc.msgIdPart1`*:: +*`rsa.investigations.event_cat`*:: + -- -type: keyword +This key captures the Event category number + +type: long -- -*`rsa.misc.msgIdPart2`*:: +*`rsa.investigations.event_cat_name`*:: + -- +This key captures the event category name corresponding to the event cat code + type: keyword -- -*`rsa.misc.change_old`*:: +*`rsa.investigations.event_vcat`*:: + -- -This key is used to capture the old value of the attribute that’s changing in a session +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. type: keyword -- -*`rsa.misc.operation_id`*:: +*`rsa.investigations.analysis_file`*:: + -- -An alert number or operation number. The values should be unique and non-repeating. +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file type: keyword -- -*`rsa.misc.event_state`*:: +*`rsa.investigations.analysis_service`*:: + -- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service type: keyword -- -*`rsa.misc.group_object`*:: +*`rsa.investigations.analysis_session`*:: + -- -This key captures a collection/grouping of entities. Specific usage +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session type: keyword -- -*`rsa.misc.node`*:: +*`rsa.investigations.boc`*:: + -- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. +This is used to capture behaviour of compromise type: keyword -- -*`rsa.misc.rule`*:: +*`rsa.investigations.eoc`*:: + -- -This key captures the Rule number +This is used to capture Enablers of Compromise type: keyword -- -*`rsa.misc.device_name`*:: +*`rsa.investigations.inv_category`*:: + -- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc +This used to capture investigation category type: keyword -- -*`rsa.misc.param`*:: +*`rsa.investigations.inv_context`*:: + -- -This key is the parameters passed as part of a command or application, etc. +This used to capture investigation context type: keyword -- -*`rsa.misc.change_attrib`*:: +*`rsa.investigations.ioc`*:: + -- -This key is used to capture the name of the attribute that’s changing in a session +This is key capture indicator of compromise type: keyword -- -*`rsa.misc.event_computer`*:: + +*`rsa.counters.dclass_c1`*:: + -- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. +This is a generic counter key that should be used with the label dclass.c1.str only -type: keyword +type: long -- -*`rsa.misc.reference_id1`*:: +*`rsa.counters.dclass_c2`*:: + -- -This key is for Linked ID to be used as an addition to "reference.id" +This is a generic counter key that should be used with the label dclass.c2.str only -type: keyword +type: long -- -*`rsa.misc.event_log`*:: +*`rsa.counters.event_counter`*:: + -- -This key captures the Name of the event log +This is used to capture the number of times an event repeated -type: keyword +type: long -- -*`rsa.misc.OS`*:: +*`rsa.counters.dclass_r1`*:: + -- -This key captures the Name of the Operating System +This is a generic ratio key that should be used with the label dclass.r1.str only type: keyword -- -*`rsa.misc.terminal`*:: +*`rsa.counters.dclass_c3`*:: + -- -This key captures the Terminal Names only +This is a generic counter key that should be used with the label dclass.c3.str only -type: keyword +type: long -- -*`rsa.misc.msgIdPart3`*:: +*`rsa.counters.dclass_c1_str`*:: + -- +This is a generic counter string key that should be used with the label dclass.c1 only + type: keyword -- -*`rsa.misc.filter`*:: +*`rsa.counters.dclass_c2_str`*:: + -- -This key captures Filter used to reduce result set +This is a generic counter string key that should be used with the label dclass.c2 only type: keyword -- -*`rsa.misc.serial_number`*:: +*`rsa.counters.dclass_r1_str`*:: + -- -This key is the Serial number associated with a physical asset. +This is a generic ratio string key that should be used with the label dclass.r1 only type: keyword -- -*`rsa.misc.checksum`*:: +*`rsa.counters.dclass_r2`*:: + -- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. +This is a generic ratio key that should be used with the label dclass.r2.str only type: keyword -- -*`rsa.misc.event_user`*:: +*`rsa.counters.dclass_c3_str`*:: + -- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. +This is a generic counter string key that should be used with the label dclass.c3 only type: keyword -- -*`rsa.misc.virusname`*:: +*`rsa.counters.dclass_r3`*:: + -- -This key captures the name of the virus +This is a generic ratio key that should be used with the label dclass.r3.str only type: keyword -- -*`rsa.misc.content_type`*:: +*`rsa.counters.dclass_r2_str`*:: + -- -This key is used to capture Content Type only. +This is a generic ratio string key that should be used with the label dclass.r2 only type: keyword -- -*`rsa.misc.group_id`*:: +*`rsa.counters.dclass_r3_str`*:: + -- -This key captures Group ID Number (related to the group name) +This is a generic ratio string key that should be used with the label dclass.r3 only type: keyword -- -*`rsa.misc.policy_id`*:: + +*`rsa.identity.auth_method`*:: + -- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise +This key is used to capture authentication methods used only type: keyword -- -*`rsa.misc.vsys`*:: +*`rsa.identity.user_role`*:: + -- -This key captures Virtual System Name +This key is used to capture the Role of a user only type: keyword -- -*`rsa.misc.connection_id`*:: +*`rsa.identity.dn`*:: + -- -This key captures the Connection ID +X.500 (LDAP) Distinguished Name type: keyword -- -*`rsa.misc.reference_id2`*:: +*`rsa.identity.logon_type`*:: + -- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. +This key is used to capture the type of logon method used. type: keyword -- -*`rsa.misc.sensor`*:: +*`rsa.identity.profile`*:: + -- -This key captures Name of the sensor. Typically used in IDS/IPS based devices +This key is used to capture the user profile type: keyword -- -*`rsa.misc.sig_id`*:: +*`rsa.identity.accesses`*:: + -- -This key captures IDS/IPS Int Signature ID +This key is used to capture actual privileges used in accessing an object -type: long +type: keyword -- -*`rsa.misc.port_name`*:: +*`rsa.identity.realm`*:: + -- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). +Radius realm or similar grouping of accounts type: keyword -- -*`rsa.misc.rule_group`*:: +*`rsa.identity.user_sid_dst`*:: + -- -This key captures the Rule group name +This key captures Destination User Session ID type: keyword -- -*`rsa.misc.risk_num`*:: +*`rsa.identity.dn_src`*:: + -- -This key captures a Numeric Risk value +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn -type: double +type: keyword -- -*`rsa.misc.trigger_val`*:: +*`rsa.identity.org`*:: + -- -This key captures the Value of the trigger or threshold condition. +This key captures the User organization type: keyword -- -*`rsa.misc.log_session_id1`*:: +*`rsa.identity.dn_dst`*:: + -- -This key is used to capture a Linked (Related) Session ID from the session directly +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn type: keyword -- -*`rsa.misc.comp_version`*:: +*`rsa.identity.firstname`*:: + -- -This key captures the Version level of a sub-component of a product. +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.misc.content_version`*:: +*`rsa.identity.lastname`*:: + -- -This key captures Version level of a signature or database content. +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.misc.hardware_id`*:: +*`rsa.identity.user_dept`*:: + -- -This key is used to capture unique identifier for a device or system (NOT a Mac address) +User's Department Names only type: keyword -- -*`rsa.misc.risk`*:: +*`rsa.identity.user_sid_src`*:: + -- -This key captures the non-numeric risk value +This key captures Source User Session ID type: keyword -- -*`rsa.misc.event_id`*:: +*`rsa.identity.federated_sp`*:: + -- +This key is the Federated Service Provider. This is the application requesting authentication. + type: keyword -- -*`rsa.misc.reason`*:: +*`rsa.identity.federated_idp`*:: + -- +This key is the federated Identity Provider. This is the server providing the authentication. + type: keyword -- -*`rsa.misc.status`*:: +*`rsa.identity.logon_type_desc`*:: + -- +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. + type: keyword -- -*`rsa.misc.mail_id`*:: +*`rsa.identity.middlename`*:: + -- -This key is used to capture the mailbox id/name +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.misc.rule_uid`*:: +*`rsa.identity.password`*:: + -- -This key is the Unique Identifier for a rule. +This key is for Passwords seen in any session, plain text or encrypted type: keyword -- -*`rsa.misc.trigger_desc`*:: +*`rsa.identity.host_role`*:: + -- -This key captures the Description of the trigger or threshold condition. +This key should only be used to capture the role of a Host Machine type: keyword -- -*`rsa.misc.inout`*:: +*`rsa.identity.ldap`*:: + -- +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + type: keyword -- -*`rsa.misc.p_msgid`*:: +*`rsa.identity.ldap_query`*:: + -- +This key is the Search criteria from an LDAP search + type: keyword -- -*`rsa.misc.data_type`*:: +*`rsa.identity.ldap_response`*:: + -- +This key is to capture Results from an LDAP search + type: keyword -- -*`rsa.misc.msgIdPart4`*:: +*`rsa.identity.owner`*:: + -- +This is used to capture username the process or service is running as, the author of the task + type: keyword -- -*`rsa.misc.error`*:: +*`rsa.identity.service_account`*:: + -- -This key captures All non successful Error codes or responses +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage type: keyword -- -*`rsa.misc.index`*:: + +*`rsa.email.email_dst`*:: + -- +This key is used to capture the Destination email address only, when the destination context is not clear use email + type: keyword -- -*`rsa.misc.listnum`*:: +*`rsa.email.email_src`*:: + -- -This key is used to capture listname or listnumber, primarily for collecting access-list +This key is used to capture the source email address only, when the source context is not clear use email type: keyword -- -*`rsa.misc.ntype`*:: +*`rsa.email.subject`*:: + -- +This key is used to capture the subject string from an Email only. + type: keyword -- -*`rsa.misc.observed_val`*:: +*`rsa.email.email`*:: + -- -This key captures the Value observed (from the perspective of the device generating the log). +This key is used to capture a generic email address where the source or destination context is not clear type: keyword -- -*`rsa.misc.policy_value`*:: +*`rsa.email.trans_from`*:: + -- -This key captures the contents of the policy. This contains details about the policy +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.pool_name`*:: +*`rsa.email.trans_to`*:: + -- -This key captures the name of a resource pool +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.rule_template`*:: + +*`rsa.file.privilege`*:: + -- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template +Deprecated, use permissions type: keyword -- -*`rsa.misc.count`*:: +*`rsa.file.attachment`*:: + -- +This key captures the attachment file name + type: keyword -- -*`rsa.misc.number`*:: +*`rsa.file.filesystem`*:: + -- type: keyword -- -*`rsa.misc.sigcat`*:: +*`rsa.file.binary`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.type`*:: +*`rsa.file.filename_dst`*:: + -- +This is used to capture name of the file targeted by the action + type: keyword -- -*`rsa.misc.comments`*:: +*`rsa.file.filename_src`*:: + -- -Comment information provided in the log message +This is used to capture name of the parent filename, the file which performed the action type: keyword -- -*`rsa.misc.doc_number`*:: +*`rsa.file.filename_tmp`*:: + -- -This key captures File Identification number - -type: long +type: keyword -- -*`rsa.misc.expected_val`*:: +*`rsa.file.directory_dst`*:: + -- -This key captures the Value expected (from the perspective of the device generating the log). +This key is used to capture the directory of the target process or file type: keyword -- -*`rsa.misc.job_num`*:: +*`rsa.file.directory_src`*:: + -- -This key captures the Job Number +This key is used to capture the directory of the source process or file type: keyword -- -*`rsa.misc.spi_dst`*:: +*`rsa.file.file_entropy`*:: + -- -Destination SPI Index +This is used to capture entropy vale of a file -type: keyword +type: double -- -*`rsa.misc.spi_src`*:: +*`rsa.file.file_vendor`*:: + -- -Source SPI Index +This is used to capture Company name of file located in version_info type: keyword -- -*`rsa.misc.code`*:: +*`rsa.file.task_name`*:: + -- +This is used to capture name of the task + type: keyword -- -*`rsa.misc.agent_id`*:: + +*`rsa.web.fqdn`*:: + -- -This key is used to capture agent id +Fully Qualified Domain Names type: keyword -- -*`rsa.misc.message_body`*:: +*`rsa.web.web_cookie`*:: + -- -This key captures the The contents of the message body. +This key is used to capture the Web cookies specifically. type: keyword -- -*`rsa.misc.phone`*:: +*`rsa.web.alias_host`*:: + -- type: keyword -- -*`rsa.misc.sig_id_str`*:: +*`rsa.web.reputation_num`*:: + -- -This key captures a string object of the sigid variable. +Reputation Number of an entity. Typically used for Web Domains -type: keyword +type: double -- -*`rsa.misc.cmd`*:: +*`rsa.web.web_ref_domain`*:: + -- +Web referer's domain + type: keyword -- -*`rsa.misc.misc`*:: +*`rsa.web.web_ref_query`*:: + -- +This key captures Web referer's query portion of the URL + type: keyword -- -*`rsa.misc.name`*:: +*`rsa.web.remote_domain`*:: + -- type: keyword -- -*`rsa.misc.cpu`*:: +*`rsa.web.web_ref_page`*:: + -- -This key is the CPU time used in the execution of the event being recorded. +This key captures Web referer's page information -type: long +type: keyword -- -*`rsa.misc.event_desc`*:: +*`rsa.web.web_ref_root`*:: + -- -This key is used to capture a description of an event available directly or inferred +Web referer's root URL path type: keyword -- -*`rsa.misc.sig_id1`*:: +*`rsa.web.cn_asn_dst`*:: + -- -This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - -type: long +type: keyword -- -*`rsa.misc.im_buddyid`*:: +*`rsa.web.cn_rpackets`*:: + -- type: keyword -- -*`rsa.misc.im_client`*:: +*`rsa.web.urlpage`*:: + -- type: keyword -- -*`rsa.misc.im_userid`*:: +*`rsa.web.urlroot`*:: + -- type: keyword -- -*`rsa.misc.pid`*:: +*`rsa.web.p_url`*:: + -- type: keyword -- -*`rsa.misc.priority`*:: +*`rsa.web.p_user_agent`*:: + -- type: keyword -- -*`rsa.misc.context_subject`*:: +*`rsa.web.p_web_cookie`*:: + -- -This key is to be used in an audit context where the subject is the object being identified - type: keyword -- -*`rsa.misc.context_target`*:: +*`rsa.web.p_web_method`*:: + -- type: keyword -- -*`rsa.misc.cve`*:: +*`rsa.web.p_web_referer`*:: + -- -This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - type: keyword -- -*`rsa.misc.fcatnum`*:: +*`rsa.web.web_extension_tmp`*:: + -- -This key captures Filter Category Number. Legacy Usage - type: keyword -- -*`rsa.misc.library`*:: +*`rsa.web.web_page`*:: + -- -This key is used to capture library information in mainframe devices - type: keyword -- -*`rsa.misc.parent_node`*:: + +*`rsa.threat.threat_category`*:: + -- -This key captures the Parent Node Name. Must be related to node variable. +This key captures Threat Name/Threat Category/Categorization of alert type: keyword -- -*`rsa.misc.risk_info`*:: +*`rsa.threat.threat_desc`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This key is used to capture the threat description from the session directly or inferred type: keyword -- -*`rsa.misc.tcp_flags`*:: +*`rsa.threat.alert`*:: + -- -This key is captures the TCP flags set in any packet of session +This key is used to capture name of the alert -type: long +type: keyword -- -*`rsa.misc.tos`*:: +*`rsa.threat.threat_source`*:: + -- -This key describes the type of service +This key is used to capture source of the threat -type: long +type: keyword -- -*`rsa.misc.vm_target`*:: + +*`rsa.crypto.crypto`*:: + -- -VMWare Target **VMWARE** only varaible. +This key is used to capture the Encryption Type or Encryption Key only type: keyword -- -*`rsa.misc.workspace`*:: +*`rsa.crypto.cipher_src`*:: + -- -This key captures Workspace Description +This key is for Source (Client) Cipher type: keyword -- -*`rsa.misc.command`*:: +*`rsa.crypto.cert_subject`*:: + -- -type: keyword - --- +This key is used to capture the Certificate organization only -*`rsa.misc.event_category`*:: -+ --- type: keyword -- -*`rsa.misc.facilityname`*:: +*`rsa.crypto.peer`*:: + -- -type: keyword - --- +This key is for Encryption peer's IP Address -*`rsa.misc.forensic_info`*:: -+ --- type: keyword -- -*`rsa.misc.jobname`*:: +*`rsa.crypto.cipher_size_src`*:: + -- -type: keyword - --- +This key captures Source (Client) Cipher Size -*`rsa.misc.mode`*:: -+ --- -type: keyword +type: long -- -*`rsa.misc.policy`*:: +*`rsa.crypto.ike`*:: + -- -type: keyword - --- +IKE negotiation phase. -*`rsa.misc.policy_waiver`*:: -+ --- type: keyword -- -*`rsa.misc.second`*:: +*`rsa.crypto.scheme`*:: + -- +This key captures the Encryption scheme used + type: keyword -- -*`rsa.misc.space1`*:: +*`rsa.crypto.peer_id`*:: + -- +This key is for Encryption peer’s identity + type: keyword -- -*`rsa.misc.subcategory`*:: +*`rsa.crypto.sig_type`*:: + -- +This key captures the Signature Type + type: keyword -- -*`rsa.misc.tbdstr2`*:: +*`rsa.crypto.cert_issuer`*:: + -- type: keyword -- -*`rsa.misc.alert_id`*:: +*`rsa.crypto.cert_host_name`*:: + -- -Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.checksum_dst`*:: +*`rsa.crypto.cert_error`*:: + -- -This key is used to capture the checksum or hash of the the target entity such as a process or file. +This key captures the Certificate Error String type: keyword -- -*`rsa.misc.checksum_src`*:: +*`rsa.crypto.cipher_dst`*:: + -- -This key is used to capture the checksum or hash of the source entity such as a file or process. +This key is for Destination (Server) Cipher type: keyword -- -*`rsa.misc.fresult`*:: +*`rsa.crypto.cipher_size_dst`*:: + -- -This key captures the Filter Result +This key captures Destination (Server) Cipher Size type: long -- -*`rsa.misc.payload_dst`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -This key is used to capture destination payload +Deprecated, use version type: keyword -- -*`rsa.misc.payload_src`*:: +*`rsa.crypto.d_certauth`*:: + -- -This key is used to capture source payload - type: keyword -- -*`rsa.misc.pool_id`*:: +*`rsa.crypto.s_certauth`*:: + -- -This key captures the identifier (typically numeric field) of a resource pool - type: keyword -- -*`rsa.misc.process_id_val`*:: +*`rsa.crypto.ike_cookie1`*:: + -- -This key is a failure key for Process ID when it is not an integer value +ID of the negotiation — sent for ISAKMP Phase One type: keyword -- -*`rsa.misc.risk_num_comm`*:: +*`rsa.crypto.ike_cookie2`*:: + -- -This key captures Risk Number Community +ID of the negotiation — sent for ISAKMP Phase Two -type: double +type: keyword -- -*`rsa.misc.risk_num_next`*:: +*`rsa.crypto.cert_checksum`*:: + -- -This key captures Risk Number NextGen - -type: double +type: keyword -- -*`rsa.misc.risk_num_sand`*:: +*`rsa.crypto.cert_host_cat`*:: + -- -This key captures Risk Number SandBox +This key is used for the hostname category value of a certificate -type: double +type: keyword -- -*`rsa.misc.risk_num_static`*:: +*`rsa.crypto.cert_serial`*:: + -- -This key captures Risk Number Static +This key is used to capture the Certificate serial number only -type: double +type: keyword -- -*`rsa.misc.risk_suspicious`*:: +*`rsa.crypto.cert_status`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This key captures Certificate validation status type: keyword -- -*`rsa.misc.risk_warning`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Deprecated, use version type: keyword -- -*`rsa.misc.snmp_oid`*:: +*`rsa.crypto.cert_keysize`*:: + -- -SNMP Object Identifier - type: keyword -- -*`rsa.misc.sql`*:: +*`rsa.crypto.cert_username`*:: + -- -This key captures the SQL query - type: keyword -- -*`rsa.misc.vuln_ref`*:: +*`rsa.crypto.https_insact`*:: + -- -This key captures the Vulnerability Reference details - type: keyword -- -*`rsa.misc.acl_id`*:: +*`rsa.crypto.https_valid`*:: + -- type: keyword -- -*`rsa.misc.acl_op`*:: +*`rsa.crypto.cert_ca`*:: + -- +This key is used to capture the Certificate signing authority only + type: keyword -- -*`rsa.misc.acl_pos`*:: +*`rsa.crypto.cert_common`*:: + -- +This key is used to capture the Certificate common name only + type: keyword -- -*`rsa.misc.acl_table`*:: + +*`rsa.wireless.wlan_ssid`*:: + -- +This key is used to capture the ssid of a Wireless Session + type: keyword -- -*`rsa.misc.admin`*:: +*`rsa.wireless.access_point`*:: + -- +This key is used to capture the access point name. + type: keyword -- -*`rsa.misc.alarm_id`*:: +*`rsa.wireless.wlan_channel`*:: + -- -type: keyword +This is used to capture the channel names + +type: long -- -*`rsa.misc.alarmname`*:: +*`rsa.wireless.wlan_name`*:: + -- +This key captures either WLAN number/name + type: keyword -- -*`rsa.misc.app_id`*:: + +*`rsa.storage.disk_volume`*:: + -- +A unique name assigned to logical units (volumes) within a physical disk + type: keyword -- -*`rsa.misc.audit`*:: +*`rsa.storage.lun`*:: + -- +Logical Unit Number.This key is a very useful concept in Storage. + type: keyword -- -*`rsa.misc.audit_object`*:: +*`rsa.storage.pwwn`*:: + -- +This uniquely identifies a port on a HBA. + type: keyword -- -*`rsa.misc.auditdata`*:: + +*`rsa.physical.org_dst`*:: + -- +This is used to capture the destination organization based on the GEOPIP Maxmind database. + type: keyword -- -*`rsa.misc.benchmark`*:: +*`rsa.physical.org_src`*:: + -- +This is used to capture the source organization based on the GEOPIP Maxmind database. + type: keyword -- -*`rsa.misc.bypass`*:: + +*`rsa.healthcare.patient_fname`*:: + -- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + type: keyword -- -*`rsa.misc.cache`*:: +*`rsa.healthcare.patient_id`*:: + -- +This key captures the unique ID for a patient + type: keyword -- -*`rsa.misc.cache_hit`*:: +*`rsa.healthcare.patient_lname`*:: + -- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + type: keyword -- -*`rsa.misc.cefversion`*:: +*`rsa.healthcare.patient_mname`*:: + -- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + type: keyword -- -*`rsa.misc.cfg_attr`*:: + +*`rsa.endpoint.host_state`*:: + -- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + type: keyword -- -*`rsa.misc.cfg_obj`*:: +*`rsa.endpoint.registry_key`*:: + -- +This key captures the path to the registry key + type: keyword -- -*`rsa.misc.cfg_path`*:: +*`rsa.endpoint.registry_value`*:: + -- +This key captures values or decorators used within a registry entry + type: keyword -- -*`rsa.misc.changes`*:: -+ --- -type: keyword +[[exported-fields-sonicwall]] +== Sonicwall-FW fields --- +sonicwall fields. -*`rsa.misc.client_ip`*:: + + +*`network.interface.name`*:: + -- +Name of the network interface where the traffic has been observed. + + type: keyword -- -*`rsa.misc.clustermembers`*:: + + +*`rsa.internal.msg`*:: + -- +This key is used to capture the raw message that comes into the Log Decoder + type: keyword -- -*`rsa.misc.cn_acttimeout`*:: +*`rsa.internal.messageid`*:: + -- type: keyword -- -*`rsa.misc.cn_asn_src`*:: +*`rsa.internal.event_desc`*:: + -- type: keyword -- -*`rsa.misc.cn_bgpv4nxthop`*:: +*`rsa.internal.message`*:: + -- +This key captures the contents of instant messages + type: keyword -- -*`rsa.misc.cn_ctr_dst_code`*:: +*`rsa.internal.time`*:: + -- -type: keyword +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date -- -*`rsa.misc.cn_dst_tos`*:: +*`rsa.internal.level`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.cn_dst_vlan`*:: +*`rsa.internal.msg_id`*:: + -- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_engine_id`*:: +*`rsa.internal.msg_vid`*:: + -- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_engine_type`*:: +*`rsa.internal.data`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_f_switch`*:: +*`rsa.internal.obj_server`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_flowsampid`*:: +*`rsa.internal.obj_val`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_flowsampintv`*:: +*`rsa.internal.resource`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_flowsampmode`*:: +*`rsa.internal.obj_id`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_inacttimeout`*:: +*`rsa.internal.statement`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_inpermbyts`*:: +*`rsa.internal.audit_class`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_inpermpckts`*:: +*`rsa.internal.entry`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_invalid`*:: +*`rsa.internal.hcode`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_ip_proto_ver`*:: +*`rsa.internal.inode`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.cn_ipv4_ident`*:: +*`rsa.internal.resource_class`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_l_switch`*:: +*`rsa.internal.dead`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.cn_log_did`*:: +*`rsa.internal.feed_desc`*:: + -- +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_log_rid`*:: +*`rsa.internal.feed_name`*:: + -- +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_max_ttl`*:: +*`rsa.internal.cid`*:: + -- +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_maxpcktlen`*:: +*`rsa.internal.device_class`*:: + -- +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_min_ttl`*:: +*`rsa.internal.device_group`*:: + -- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_minpcktlen`*:: +*`rsa.internal.device_host`*:: + -- +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mpls_lbl_1`*:: +*`rsa.internal.device_ip`*:: + -- -type: keyword +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`rsa.misc.cn_mpls_lbl_10`*:: +*`rsa.internal.device_ipv6`*:: + -- -type: keyword +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`rsa.misc.cn_mpls_lbl_2`*:: +*`rsa.internal.device_type`*:: + -- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mpls_lbl_3`*:: +*`rsa.internal.device_type_id`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.cn_mpls_lbl_4`*:: +*`rsa.internal.did`*:: + -- +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mpls_lbl_5`*:: +*`rsa.internal.entropy_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long -- -*`rsa.misc.cn_mpls_lbl_6`*:: +*`rsa.internal.entropy_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration + +type: long -- -*`rsa.misc.cn_mpls_lbl_7`*:: +*`rsa.internal.event_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_8`*:: +*`rsa.internal.feed_category`*:: + -- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mpls_lbl_9`*:: +*`rsa.internal.forward_ip`*:: + -- -type: keyword +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip -- -*`rsa.misc.cn_mplstoplabel`*:: +*`rsa.internal.forward_ipv6`*:: + -- -type: keyword +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`rsa.misc.cn_mplstoplabip`*:: +*`rsa.internal.header_id`*:: + -- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mul_dst_byt`*:: +*`rsa.internal.lc_cid`*:: + -- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_mul_dst_pks`*:: +*`rsa.internal.lc_ctime`*:: + -- -type: keyword +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date -- -*`rsa.misc.cn_muligmptype`*:: +*`rsa.internal.mcb_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.cn_sampalgo`*:: +*`rsa.internal.mcb_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.cn_sampint`*:: +*`rsa.internal.mcbc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.cn_seqctr`*:: +*`rsa.internal.mcbc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.cn_spackets`*:: +*`rsa.internal.medium`*:: + -- -type: keyword +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long -- -*`rsa.misc.cn_src_tos`*:: +*`rsa.internal.node_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_src_vlan`*:: +*`rsa.internal.nwe_callback_id`*:: + -- +This key denotes that event is endpoint related + type: keyword -- -*`rsa.misc.cn_sysuptime`*:: +*`rsa.internal.parse_error`*:: + -- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_template_id`*:: +*`rsa.internal.payload_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.cn_totbytsexp`*:: +*`rsa.internal.payload_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.cn_totflowexp`*:: +*`rsa.internal.process_vid_dst`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + type: keyword -- -*`rsa.misc.cn_totpcktsexp`*:: +*`rsa.internal.process_vid_src`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + type: keyword -- -*`rsa.misc.cn_unixnanosecs`*:: +*`rsa.internal.rid`*:: + -- -type: keyword +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.cn_v6flowlabel`*:: +*`rsa.internal.session_split`*:: + -- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_v6optheaders`*:: +*`rsa.internal.site`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.comp_class`*:: +*`rsa.internal.size`*:: + -- -type: keyword +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.comp_name`*:: +*`rsa.internal.sourcefile`*:: + -- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.comp_rbytes`*:: +*`rsa.internal.ubc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.comp_sbytes`*:: +*`rsa.internal.ubc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.cpu_data`*:: +*`rsa.internal.word`*:: + -- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + type: keyword -- -*`rsa.misc.criticality`*:: + +*`rsa.time.event_time`*:: + -- -type: keyword +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date -- -*`rsa.misc.cs_agency_dst`*:: +*`rsa.time.duration_time`*:: + -- -type: keyword +This key is used to capture the normalized duration/lifetime in seconds. + +type: double -- -*`rsa.misc.cs_analyzedby`*:: +*`rsa.time.event_time_str`*:: + -- +This key is used to capture the incomplete time mentioned in a session as a string + type: keyword -- -*`rsa.misc.cs_av_other`*:: +*`rsa.time.starttime`*:: + -- -type: keyword +This key is used to capture the Start time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cs_av_primary`*:: +*`rsa.time.month`*:: + -- type: keyword -- -*`rsa.misc.cs_av_secondary`*:: +*`rsa.time.day`*:: + -- type: keyword -- -*`rsa.misc.cs_bgpv6nxthop`*:: +*`rsa.time.endtime`*:: + -- -type: keyword +This key is used to capture the End time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cs_bit9status`*:: +*`rsa.time.timezone`*:: + -- +This key is used to capture the timezone of the Event Time + type: keyword -- -*`rsa.misc.cs_context`*:: +*`rsa.time.duration_str`*:: + -- +A text string version of the duration + type: keyword -- -*`rsa.misc.cs_control`*:: +*`rsa.time.date`*:: + -- type: keyword -- -*`rsa.misc.cs_data`*:: +*`rsa.time.year`*:: + -- type: keyword -- -*`rsa.misc.cs_datecret`*:: +*`rsa.time.recorded_time`*:: + -- -type: keyword +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date -- -*`rsa.misc.cs_dst_tld`*:: +*`rsa.time.datetime`*:: + -- type: keyword -- -*`rsa.misc.cs_eth_dst_ven`*:: +*`rsa.time.effective_time`*:: + -- -type: keyword +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date -- -*`rsa.misc.cs_eth_src_ven`*:: +*`rsa.time.expire_time`*:: + -- -type: keyword +This key is the timestamp that explicitly refers to an expiration. + +type: date -- -*`rsa.misc.cs_event_uuid`*:: +*`rsa.time.process_time`*:: + -- +Deprecated, use duration.time + type: keyword -- -*`rsa.misc.cs_filetype`*:: +*`rsa.time.hour`*:: + -- type: keyword -- -*`rsa.misc.cs_fld`*:: +*`rsa.time.min`*:: + -- type: keyword -- -*`rsa.misc.cs_if_desc`*:: +*`rsa.time.timestamp`*:: + -- type: keyword -- -*`rsa.misc.cs_if_name`*:: +*`rsa.time.event_queue_time`*:: + -- -type: keyword +This key is the Time that the event was queued. + +type: date -- -*`rsa.misc.cs_ip_next_hop`*:: +*`rsa.time.p_time1`*:: + -- type: keyword -- -*`rsa.misc.cs_ipv4dstpre`*:: +*`rsa.time.tzone`*:: + -- type: keyword -- -*`rsa.misc.cs_ipv4srcpre`*:: +*`rsa.time.eventtime`*:: + -- type: keyword -- -*`rsa.misc.cs_lifetime`*:: +*`rsa.time.gmtdate`*:: + -- type: keyword -- -*`rsa.misc.cs_log_medium`*:: +*`rsa.time.gmttime`*:: + -- type: keyword -- -*`rsa.misc.cs_loginname`*:: +*`rsa.time.p_date`*:: + -- type: keyword -- -*`rsa.misc.cs_modulescore`*:: +*`rsa.time.p_month`*:: + -- type: keyword -- -*`rsa.misc.cs_modulesign`*:: +*`rsa.time.p_time`*:: + -- type: keyword -- -*`rsa.misc.cs_opswatresult`*:: +*`rsa.time.p_time2`*:: + -- type: keyword -- -*`rsa.misc.cs_payload`*:: +*`rsa.time.p_year`*:: + -- type: keyword -- -*`rsa.misc.cs_registrant`*:: +*`rsa.time.expire_time_str`*:: + -- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + type: keyword -- -*`rsa.misc.cs_registrar`*:: +*`rsa.time.stamp`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: date -- -*`rsa.misc.cs_represult`*:: + +*`rsa.misc.action`*:: + -- type: keyword -- -*`rsa.misc.cs_rpayload`*:: +*`rsa.misc.result`*:: + -- +This key is used to capture the outcome/result string value of an action in a session. + type: keyword -- -*`rsa.misc.cs_sampler_name`*:: +*`rsa.misc.severity`*:: + -- +This key is used to capture the severity given the session + type: keyword -- -*`rsa.misc.cs_sourcemodule`*:: +*`rsa.misc.event_type`*:: + -- +This key captures the event category type as specified by the event source. + type: keyword -- -*`rsa.misc.cs_streams`*:: +*`rsa.misc.reference_id`*:: + -- +This key is used to capture an event id from the session directly + type: keyword -- -*`rsa.misc.cs_targetmodule`*:: +*`rsa.misc.version`*:: + -- +This key captures Version of the application or OS which is generating the event. + type: keyword -- -*`rsa.misc.cs_v6nxthop`*:: +*`rsa.misc.disposition`*:: + -- +This key captures the The end state of an action. + type: keyword -- -*`rsa.misc.cs_whois_server`*:: +*`rsa.misc.result_code`*:: + -- +This key is used to capture the outcome/result numeric value of an action in a session + type: keyword -- -*`rsa.misc.cs_yararesult`*:: +*`rsa.misc.category`*:: + -- +This key is used to capture the category of an event given by the vendor in the session + type: keyword -- -*`rsa.misc.description`*:: +*`rsa.misc.obj_name`*:: + -- +This is used to capture name of object + type: keyword -- -*`rsa.misc.devvendor`*:: +*`rsa.misc.obj_type`*:: + -- +This is used to capture type of object + type: keyword -- -*`rsa.misc.distance`*:: +*`rsa.misc.event_source`*:: + -- +This key captures Source of the event that’s not a hostname + type: keyword -- -*`rsa.misc.dstburb`*:: +*`rsa.misc.log_session_id`*:: + -- +This key is used to capture a sessionid from the session directly + type: keyword -- -*`rsa.misc.edomain`*:: +*`rsa.misc.group`*:: + -- +This key captures the Group Name value + type: keyword -- -*`rsa.misc.edomaub`*:: +*`rsa.misc.policy_name`*:: + -- +This key is used to capture the Policy Name only. + type: keyword -- -*`rsa.misc.euid`*:: +*`rsa.misc.rule_name`*:: + -- +This key captures the Rule Name + type: keyword -- -*`rsa.misc.facility`*:: +*`rsa.misc.context`*:: + -- +This key captures Information which adds additional context to the event. + type: keyword -- -*`rsa.misc.finterface`*:: +*`rsa.misc.change_new`*:: + -- +This key is used to capture the new values of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.flags`*:: +*`rsa.misc.space`*:: + -- type: keyword -- -*`rsa.misc.gaddr`*:: +*`rsa.misc.client`*:: + -- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + type: keyword -- -*`rsa.misc.id3`*:: +*`rsa.misc.msgIdPart1`*:: + -- type: keyword -- -*`rsa.misc.im_buddyname`*:: +*`rsa.misc.msgIdPart2`*:: + -- type: keyword -- -*`rsa.misc.im_croomid`*:: +*`rsa.misc.change_old`*:: + -- +This key is used to capture the old value of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.im_croomtype`*:: +*`rsa.misc.operation_id`*:: + -- +An alert number or operation number. The values should be unique and non-repeating. + type: keyword -- -*`rsa.misc.im_members`*:: +*`rsa.misc.event_state`*:: + -- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + type: keyword -- -*`rsa.misc.im_username`*:: +*`rsa.misc.group_object`*:: + -- +This key captures a collection/grouping of entities. Specific usage + type: keyword -- -*`rsa.misc.ipkt`*:: +*`rsa.misc.node`*:: + -- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + type: keyword -- -*`rsa.misc.ipscat`*:: +*`rsa.misc.rule`*:: + -- +This key captures the Rule number + type: keyword -- -*`rsa.misc.ipspri`*:: +*`rsa.misc.device_name`*:: + -- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + type: keyword -- -*`rsa.misc.latitude`*:: +*`rsa.misc.param`*:: + -- +This key is the parameters passed as part of a command or application, etc. + type: keyword -- -*`rsa.misc.linenum`*:: +*`rsa.misc.change_attrib`*:: + -- +This key is used to capture the name of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.list_name`*:: +*`rsa.misc.event_computer`*:: + -- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + type: keyword -- -*`rsa.misc.load_data`*:: +*`rsa.misc.reference_id1`*:: + -- +This key is for Linked ID to be used as an addition to "reference.id" + type: keyword -- -*`rsa.misc.location_floor`*:: +*`rsa.misc.event_log`*:: + -- +This key captures the Name of the event log + type: keyword -- -*`rsa.misc.location_mark`*:: +*`rsa.misc.OS`*:: + -- +This key captures the Name of the Operating System + type: keyword -- -*`rsa.misc.log_id`*:: +*`rsa.misc.terminal`*:: + -- +This key captures the Terminal Names only + type: keyword -- -*`rsa.misc.log_type`*:: +*`rsa.misc.msgIdPart3`*:: + -- type: keyword -- -*`rsa.misc.logid`*:: +*`rsa.misc.filter`*:: + -- +This key captures Filter used to reduce result set + type: keyword -- -*`rsa.misc.logip`*:: +*`rsa.misc.serial_number`*:: + -- +This key is the Serial number associated with a physical asset. + type: keyword -- -*`rsa.misc.logname`*:: +*`rsa.misc.checksum`*:: + -- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + type: keyword -- -*`rsa.misc.longitude`*:: +*`rsa.misc.event_user`*:: + -- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + type: keyword -- -*`rsa.misc.lport`*:: +*`rsa.misc.virusname`*:: + -- +This key captures the name of the virus + type: keyword -- -*`rsa.misc.mbug_data`*:: +*`rsa.misc.content_type`*:: + -- +This key is used to capture Content Type only. + type: keyword -- -*`rsa.misc.misc_name`*:: +*`rsa.misc.group_id`*:: + -- +This key captures Group ID Number (related to the group name) + type: keyword -- -*`rsa.misc.msg_type`*:: +*`rsa.misc.policy_id`*:: + -- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + type: keyword -- -*`rsa.misc.msgid`*:: +*`rsa.misc.vsys`*:: + -- +This key captures Virtual System Name + type: keyword -- -*`rsa.misc.netsessid`*:: +*`rsa.misc.connection_id`*:: + -- +This key captures the Connection ID + type: keyword -- -*`rsa.misc.num`*:: +*`rsa.misc.reference_id2`*:: + -- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + type: keyword -- -*`rsa.misc.number1`*:: +*`rsa.misc.sensor`*:: + -- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + type: keyword -- -*`rsa.misc.number2`*:: +*`rsa.misc.sig_id`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID + +type: long -- -*`rsa.misc.nwwn`*:: +*`rsa.misc.port_name`*:: + -- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + type: keyword -- -*`rsa.misc.object`*:: +*`rsa.misc.rule_group`*:: + -- +This key captures the Rule group name + type: keyword -- -*`rsa.misc.operation`*:: +*`rsa.misc.risk_num`*:: + -- -type: keyword +This key captures a Numeric Risk value + +type: double -- -*`rsa.misc.opkt`*:: +*`rsa.misc.trigger_val`*:: + -- +This key captures the Value of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.orig_from`*:: +*`rsa.misc.log_session_id1`*:: + -- +This key is used to capture a Linked (Related) Session ID from the session directly + type: keyword -- -*`rsa.misc.owner_id`*:: +*`rsa.misc.comp_version`*:: + -- +This key captures the Version level of a sub-component of a product. + type: keyword -- -*`rsa.misc.p_action`*:: +*`rsa.misc.content_version`*:: + -- +This key captures Version level of a signature or database content. + type: keyword -- -*`rsa.misc.p_filter`*:: +*`rsa.misc.hardware_id`*:: + -- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + type: keyword -- -*`rsa.misc.p_group_object`*:: +*`rsa.misc.risk`*:: + -- +This key captures the non-numeric risk value + type: keyword -- -*`rsa.misc.p_id`*:: +*`rsa.misc.event_id`*:: + -- type: keyword -- -*`rsa.misc.p_msgid1`*:: +*`rsa.misc.reason`*:: + -- type: keyword -- -*`rsa.misc.p_msgid2`*:: +*`rsa.misc.status`*:: + -- type: keyword -- -*`rsa.misc.p_result1`*:: +*`rsa.misc.mail_id`*:: + -- +This key is used to capture the mailbox id/name + type: keyword -- -*`rsa.misc.password_chg`*:: +*`rsa.misc.rule_uid`*:: + -- +This key is the Unique Identifier for a rule. + type: keyword -- -*`rsa.misc.password_expire`*:: +*`rsa.misc.trigger_desc`*:: + -- +This key captures the Description of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.permgranted`*:: +*`rsa.misc.inout`*:: + -- type: keyword -- -*`rsa.misc.permwanted`*:: +*`rsa.misc.p_msgid`*:: + -- type: keyword -- -*`rsa.misc.pgid`*:: +*`rsa.misc.data_type`*:: + -- type: keyword -- -*`rsa.misc.policyUUID`*:: +*`rsa.misc.msgIdPart4`*:: + -- type: keyword -- -*`rsa.misc.prog_asp_num`*:: +*`rsa.misc.error`*:: + -- +This key captures All non successful Error codes or responses + type: keyword -- -*`rsa.misc.program`*:: +*`rsa.misc.index`*:: + -- type: keyword -- -*`rsa.misc.real_data`*:: +*`rsa.misc.listnum`*:: + -- +This key is used to capture listname or listnumber, primarily for collecting access-list + type: keyword -- -*`rsa.misc.rec_asp_device`*:: +*`rsa.misc.ntype`*:: + -- type: keyword -- -*`rsa.misc.rec_asp_num`*:: +*`rsa.misc.observed_val`*:: + -- +This key captures the Value observed (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.rec_library`*:: +*`rsa.misc.policy_value`*:: + -- +This key captures the contents of the policy. This contains details about the policy + type: keyword -- -*`rsa.misc.recordnum`*:: +*`rsa.misc.pool_name`*:: + -- +This key captures the name of a resource pool + type: keyword -- -*`rsa.misc.ruid`*:: +*`rsa.misc.rule_template`*:: + -- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + type: keyword -- -*`rsa.misc.sburb`*:: +*`rsa.misc.count`*:: + -- type: keyword -- -*`rsa.misc.sdomain_fld`*:: +*`rsa.misc.number`*:: + -- type: keyword -- -*`rsa.misc.sec`*:: +*`rsa.misc.sigcat`*:: + -- type: keyword -- -*`rsa.misc.sensorname`*:: +*`rsa.misc.type`*:: + -- type: keyword -- -*`rsa.misc.seqnum`*:: +*`rsa.misc.comments`*:: + -- +Comment information provided in the log message + type: keyword -- -*`rsa.misc.session`*:: +*`rsa.misc.doc_number`*:: + -- -type: keyword +This key captures File Identification number + +type: long -- -*`rsa.misc.sessiontype`*:: +*`rsa.misc.expected_val`*:: + -- +This key captures the Value expected (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.sigUUID`*:: +*`rsa.misc.job_num`*:: + -- +This key captures the Job Number + type: keyword -- -*`rsa.misc.spi`*:: +*`rsa.misc.spi_dst`*:: + -- +Destination SPI Index + type: keyword -- -*`rsa.misc.srcburb`*:: +*`rsa.misc.spi_src`*:: + -- +Source SPI Index + type: keyword -- -*`rsa.misc.srcdom`*:: +*`rsa.misc.code`*:: + -- type: keyword -- -*`rsa.misc.srcservice`*:: +*`rsa.misc.agent_id`*:: + -- +This key is used to capture agent id + type: keyword -- -*`rsa.misc.state`*:: +*`rsa.misc.message_body`*:: + -- +This key captures the The contents of the message body. + type: keyword -- -*`rsa.misc.status1`*:: +*`rsa.misc.phone`*:: + -- type: keyword -- -*`rsa.misc.svcno`*:: +*`rsa.misc.sig_id_str`*:: + -- +This key captures a string object of the sigid variable. + type: keyword -- -*`rsa.misc.system`*:: +*`rsa.misc.cmd`*:: + -- type: keyword -- -*`rsa.misc.tbdstr1`*:: +*`rsa.misc.misc`*:: + -- type: keyword -- -*`rsa.misc.tgtdom`*:: +*`rsa.misc.name`*:: + -- type: keyword -- -*`rsa.misc.tgtdomain`*:: +*`rsa.misc.cpu`*:: + -- -type: keyword +This key is the CPU time used in the execution of the event being recorded. + +type: long -- -*`rsa.misc.threshold`*:: +*`rsa.misc.event_desc`*:: + -- +This key is used to capture a description of an event available directly or inferred + type: keyword -- -*`rsa.misc.type1`*:: +*`rsa.misc.sig_id1`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long -- -*`rsa.misc.udb_class`*:: +*`rsa.misc.im_buddyid`*:: + -- type: keyword -- -*`rsa.misc.url_fld`*:: +*`rsa.misc.im_client`*:: + -- type: keyword -- -*`rsa.misc.user_div`*:: +*`rsa.misc.im_userid`*:: + -- type: keyword -- -*`rsa.misc.userid`*:: +*`rsa.misc.pid`*:: + -- type: keyword -- -*`rsa.misc.username_fld`*:: +*`rsa.misc.priority`*:: + -- type: keyword -- -*`rsa.misc.utcstamp`*:: +*`rsa.misc.context_subject`*:: + -- +This key is to be used in an audit context where the subject is the object being identified + type: keyword -- -*`rsa.misc.v_instafname`*:: +*`rsa.misc.context_target`*:: + -- type: keyword -- -*`rsa.misc.virt_data`*:: +*`rsa.misc.cve`*:: + -- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + type: keyword -- -*`rsa.misc.vpnid`*:: +*`rsa.misc.fcatnum`*:: + -- +This key captures Filter Category Number. Legacy Usage + type: keyword -- -*`rsa.misc.autorun_type`*:: +*`rsa.misc.library`*:: + -- -This is used to capture Auto Run type +This key is used to capture library information in mainframe devices type: keyword -- -*`rsa.misc.cc_number`*:: +*`rsa.misc.parent_node`*:: + -- -Valid Credit Card Numbers only +This key captures the Parent Node Name. Must be related to node variable. -type: long +type: keyword -- -*`rsa.misc.content`*:: +*`rsa.misc.risk_info`*:: + -- -This key captures the content type from protocol headers +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`rsa.misc.ein_number`*:: +*`rsa.misc.tcp_flags`*:: + -- -Employee Identification Numbers only +This key is captures the TCP flags set in any packet of session type: long -- -*`rsa.misc.found`*:: +*`rsa.misc.tos`*:: + -- -This is used to capture the results of regex match +This key describes the type of service -type: keyword +type: long -- -*`rsa.misc.language`*:: +*`rsa.misc.vm_target`*:: + -- -This is used to capture list of languages the client support and what it prefers +VMWare Target **VMWARE** only varaible. type: keyword -- -*`rsa.misc.lifetime`*:: +*`rsa.misc.workspace`*:: + -- -This key is used to capture the session lifetime in seconds. +This key captures Workspace Description -type: long +type: keyword -- -*`rsa.misc.link`*:: +*`rsa.misc.command`*:: + -- -This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.misc.match`*:: +*`rsa.misc.event_category`*:: + -- -This key is for regex match name from search.ini - type: keyword -- -*`rsa.misc.param_dst`*:: +*`rsa.misc.facilityname`*:: + -- -This key captures the command line/launch argument of the target process or file - type: keyword -- -*`rsa.misc.param_src`*:: +*`rsa.misc.forensic_info`*:: + -- -This key captures source parameter - type: keyword -- -*`rsa.misc.search_text`*:: +*`rsa.misc.jobname`*:: + -- -This key captures the Search Text used - type: keyword -- -*`rsa.misc.sig_name`*:: +*`rsa.misc.mode`*:: + -- -This key is used to capture the Signature Name only. - type: keyword -- -*`rsa.misc.snmp_value`*:: +*`rsa.misc.policy`*:: + -- -SNMP set request value - type: keyword -- -*`rsa.misc.streams`*:: +*`rsa.misc.policy_waiver`*:: + -- -This key captures number of streams in session - -type: long +type: keyword -- - -*`rsa.db.index`*:: +*`rsa.misc.second`*:: + -- -This key captures IndexID of the index. - type: keyword -- -*`rsa.db.instance`*:: +*`rsa.misc.space1`*:: + -- -This key is used to capture the database server instance name - type: keyword -- -*`rsa.db.database`*:: +*`rsa.misc.subcategory`*:: + -- -This key is used to capture the name of a database or an instance as seen in a session - type: keyword -- -*`rsa.db.transact_id`*:: +*`rsa.misc.tbdstr2`*:: + -- -This key captures the SQL transantion ID of the current session - type: keyword -- -*`rsa.db.permissions`*:: +*`rsa.misc.alert_id`*:: + -- -This key captures permission or privilege level assigned to a resource. +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`rsa.db.table_name`*:: +*`rsa.misc.checksum_dst`*:: + -- -This key is used to capture the table name +This key is used to capture the checksum or hash of the the target entity such as a process or file. type: keyword -- -*`rsa.db.db_id`*:: +*`rsa.misc.checksum_src`*:: + -- -This key is used to capture the unique identifier for a database +This key is used to capture the checksum or hash of the source entity such as a file or process. type: keyword -- -*`rsa.db.db_pid`*:: +*`rsa.misc.fresult`*:: + -- -This key captures the process id of a connection with database server +This key captures the Filter Result type: long -- -*`rsa.db.lread`*:: +*`rsa.misc.payload_dst`*:: + -- -This key is used for the number of logical reads +This key is used to capture destination payload -type: long +type: keyword -- -*`rsa.db.lwrite`*:: +*`rsa.misc.payload_src`*:: + -- -This key is used for the number of logical writes +This key is used to capture source payload -type: long +type: keyword -- -*`rsa.db.pread`*:: +*`rsa.misc.pool_id`*:: + -- -This key is used for the number of physical writes +This key captures the identifier (typically numeric field) of a resource pool -type: long +type: keyword -- - -*`rsa.network.alias_host`*:: +*`rsa.misc.process_id_val`*:: + -- -This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. +This key is a failure key for Process ID when it is not an integer value type: keyword -- -*`rsa.network.domain`*:: +*`rsa.misc.risk_num_comm`*:: + -- -type: keyword +This key captures Risk Number Community + +type: double -- -*`rsa.network.host_dst`*:: +*`rsa.misc.risk_num_next`*:: + -- -This key should only be used when it’s a Destination Hostname +This key captures Risk Number NextGen -type: keyword +type: double -- -*`rsa.network.network_service`*:: +*`rsa.misc.risk_num_sand`*:: + -- -This is used to capture layer 7 protocols/service names +This key captures Risk Number SandBox -type: keyword +type: double -- -*`rsa.network.interface`*:: +*`rsa.misc.risk_num_static`*:: + -- -This key should be used when the source or destination context of an interface is not clear +This key captures Risk Number Static -type: keyword +type: double -- -*`rsa.network.network_port`*:: +*`rsa.misc.risk_suspicious`*:: + -- -Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) -type: long +type: keyword -- -*`rsa.network.eth_host`*:: +*`rsa.misc.risk_warning`*:: + -- -Deprecated, use alias.mac +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) type: keyword -- -*`rsa.network.sinterface`*:: +*`rsa.misc.snmp_oid`*:: + -- -This key should only be used when it’s a Source Interface +SNMP Object Identifier type: keyword -- -*`rsa.network.dinterface`*:: +*`rsa.misc.sql`*:: + -- -This key should only be used when it’s a Destination Interface +This key captures the SQL query type: keyword -- -*`rsa.network.vlan`*:: +*`rsa.misc.vuln_ref`*:: + -- -This key should only be used to capture the ID of the Virtual LAN +This key captures the Vulnerability Reference details -type: long +type: keyword -- -*`rsa.network.zone_src`*:: +*`rsa.misc.acl_id`*:: + -- -This key should only be used when it’s a Source Zone. - type: keyword -- -*`rsa.network.zone`*:: +*`rsa.misc.acl_op`*:: + -- -This key should be used when the source or destination context of a Zone is not clear - type: keyword -- -*`rsa.network.zone_dst`*:: +*`rsa.misc.acl_pos`*:: + -- -This key should only be used when it’s a Destination Zone. - type: keyword -- -*`rsa.network.gateway`*:: +*`rsa.misc.acl_table`*:: + -- -This key is used to capture the IP Address of the gateway - type: keyword -- -*`rsa.network.icmp_type`*:: +*`rsa.misc.admin`*:: + -- -This key is used to capture the ICMP type only - -type: long +type: keyword -- -*`rsa.network.mask`*:: +*`rsa.misc.alarm_id`*:: + -- -This key is used to capture the device network IPmask. - type: keyword -- -*`rsa.network.icmp_code`*:: +*`rsa.misc.alarmname`*:: + -- -This key is used to capture the ICMP code only - -type: long +type: keyword -- -*`rsa.network.protocol_detail`*:: +*`rsa.misc.app_id`*:: + -- -This key should be used to capture additional protocol information - type: keyword -- -*`rsa.network.dmask`*:: +*`rsa.misc.audit`*:: + -- -This key is used for Destionation Device network mask - type: keyword -- -*`rsa.network.port`*:: +*`rsa.misc.audit_object`*:: + -- -This key should only be used to capture a Network Port when the directionality is not clear - -type: long +type: keyword -- -*`rsa.network.smask`*:: +*`rsa.misc.auditdata`*:: + -- -This key is used for capturing source Network Mask - type: keyword -- -*`rsa.network.netname`*:: +*`rsa.misc.benchmark`*:: + -- -This key is used to capture the network name associated with an IP range. This is configured by the end user. - type: keyword -- -*`rsa.network.paddr`*:: +*`rsa.misc.bypass`*:: + -- -Deprecated - -type: ip +type: keyword -- -*`rsa.network.faddr`*:: +*`rsa.misc.cache`*:: + -- type: keyword -- -*`rsa.network.lhost`*:: +*`rsa.misc.cache_hit`*:: + -- type: keyword -- -*`rsa.network.origin`*:: +*`rsa.misc.cefversion`*:: + -- type: keyword -- -*`rsa.network.remote_domain_id`*:: +*`rsa.misc.cfg_attr`*:: + -- type: keyword -- -*`rsa.network.addr`*:: +*`rsa.misc.cfg_obj`*:: + -- type: keyword -- -*`rsa.network.dns_a_record`*:: +*`rsa.misc.cfg_path`*:: + -- type: keyword -- -*`rsa.network.dns_ptr_record`*:: +*`rsa.misc.changes`*:: + -- type: keyword -- -*`rsa.network.fhost`*:: +*`rsa.misc.client_ip`*:: + -- type: keyword -- -*`rsa.network.fport`*:: +*`rsa.misc.clustermembers`*:: + -- type: keyword -- -*`rsa.network.laddr`*:: +*`rsa.misc.cn_acttimeout`*:: + -- type: keyword -- -*`rsa.network.linterface`*:: +*`rsa.misc.cn_asn_src`*:: + -- type: keyword -- -*`rsa.network.phost`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- type: keyword -- -*`rsa.network.ad_computer_dst`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -Deprecated, use host.dst - type: keyword -- -*`rsa.network.eth_type`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - -type: long +type: keyword -- -*`rsa.network.ip_proto`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - -type: long +type: keyword -- -*`rsa.network.dns_cname_record`*:: +*`rsa.misc.cn_engine_id`*:: + -- type: keyword -- -*`rsa.network.dns_id`*:: +*`rsa.misc.cn_engine_type`*:: + -- type: keyword -- -*`rsa.network.dns_opcode`*:: +*`rsa.misc.cn_f_switch`*:: + -- type: keyword -- -*`rsa.network.dns_resp`*:: +*`rsa.misc.cn_flowsampid`*:: + -- type: keyword -- -*`rsa.network.dns_type`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- type: keyword -- -*`rsa.network.domain1`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- type: keyword -- -*`rsa.network.host_type`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- type: keyword -- -*`rsa.network.packet_length`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- type: keyword -- -*`rsa.network.host_orig`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - type: keyword -- -*`rsa.network.rpayload`*:: +*`rsa.misc.cn_invalid`*:: + -- -This key is used to capture the total number of payload bytes seen in the retransmitted packets. - type: keyword -- -*`rsa.network.vlan_name`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -This key should only be used to capture the name of the Virtual LAN - type: keyword -- - -*`rsa.investigations.ec_activity`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -This key captures the particular event activity(Ex:Logoff) - type: keyword -- -*`rsa.investigations.ec_theme`*:: +*`rsa.misc.cn_l_switch`*:: + -- -This key captures the Theme of a particular Event(Ex:Authentication) - type: keyword -- -*`rsa.investigations.ec_subject`*:: +*`rsa.misc.cn_log_did`*:: + -- -This key captures the Subject of a particular Event(Ex:User) - type: keyword -- -*`rsa.investigations.ec_outcome`*:: +*`rsa.misc.cn_log_rid`*:: + -- -This key captures the outcome of a particular Event(Ex:Success) - type: keyword -- -*`rsa.investigations.event_cat`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -This key captures the Event category number - -type: long +type: keyword -- -*`rsa.investigations.event_cat_name`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -This key captures the event category name corresponding to the event cat code - type: keyword -- -*`rsa.investigations.event_vcat`*:: +*`rsa.misc.cn_min_ttl`*:: + -- -This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - type: keyword -- -*`rsa.investigations.analysis_file`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- -This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - type: keyword -- -*`rsa.investigations.analysis_service`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- -This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - type: keyword -- -*`rsa.investigations.analysis_session`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - type: keyword -- -*`rsa.investigations.boc`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -This is used to capture behaviour of compromise - type: keyword -- -*`rsa.investigations.eoc`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- -This is used to capture Enablers of Compromise - type: keyword -- -*`rsa.investigations.inv_category`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -This used to capture investigation category - type: keyword -- -*`rsa.investigations.inv_context`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -This used to capture investigation context - type: keyword -- -*`rsa.investigations.ioc`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -This is key capture indicator of compromise - type: keyword -- - -*`rsa.counters.dclass_c1`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- -This is a generic counter key that should be used with the label dclass.c1.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c2`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -This is a generic counter key that should be used with the label dclass.c2.str only - -type: long +type: keyword -- -*`rsa.counters.event_counter`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- -This is used to capture the number of times an event repeated - -type: long +type: keyword -- -*`rsa.counters.dclass_r1`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -This is a generic ratio key that should be used with the label dclass.r1.str only +type: keyword + +-- +*`rsa.misc.cn_mplstoplabip`*:: ++ +-- type: keyword -- -*`rsa.counters.dclass_c3`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -This is a generic counter key that should be used with the label dclass.c3.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c1_str`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -This is a generic counter string key that should be used with the label dclass.c1 only - type: keyword -- -*`rsa.counters.dclass_c2_str`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -This is a generic counter string key that should be used with the label dclass.c2 only - type: keyword -- -*`rsa.counters.dclass_r1_str`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r1 only - type: keyword -- -*`rsa.counters.dclass_r2`*:: +*`rsa.misc.cn_sampint`*:: + -- -This is a generic ratio key that should be used with the label dclass.r2.str only - type: keyword -- -*`rsa.counters.dclass_c3_str`*:: +*`rsa.misc.cn_seqctr`*:: + -- -This is a generic counter string key that should be used with the label dclass.c3 only - type: keyword -- -*`rsa.counters.dclass_r3`*:: +*`rsa.misc.cn_spackets`*:: + -- -This is a generic ratio key that should be used with the label dclass.r3.str only - type: keyword -- -*`rsa.counters.dclass_r2_str`*:: +*`rsa.misc.cn_src_tos`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r2 only - type: keyword -- -*`rsa.counters.dclass_r3_str`*:: +*`rsa.misc.cn_src_vlan`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r3 only - type: keyword -- - -*`rsa.identity.auth_method`*:: +*`rsa.misc.cn_sysuptime`*:: + -- -This key is used to capture authentication methods used only - type: keyword -- -*`rsa.identity.user_role`*:: +*`rsa.misc.cn_template_id`*:: + -- -This key is used to capture the Role of a user only - type: keyword -- -*`rsa.identity.dn`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- -X.500 (LDAP) Distinguished Name - type: keyword -- -*`rsa.identity.logon_type`*:: +*`rsa.misc.cn_totflowexp`*:: + -- -This key is used to capture the type of logon method used. - type: keyword -- -*`rsa.identity.profile`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- -This key is used to capture the user profile - type: keyword -- -*`rsa.identity.accesses`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- -This key is used to capture actual privileges used in accessing an object - type: keyword -- -*`rsa.identity.realm`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- -Radius realm or similar grouping of accounts - type: keyword -- -*`rsa.identity.user_sid_dst`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- -This key captures Destination User Session ID - type: keyword -- -*`rsa.identity.dn_src`*:: +*`rsa.misc.comp_class`*:: + -- -An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - type: keyword -- -*`rsa.identity.org`*:: +*`rsa.misc.comp_name`*:: + -- -This key captures the User organization - type: keyword -- -*`rsa.identity.dn_dst`*:: +*`rsa.misc.comp_rbytes`*:: + -- -An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - type: keyword -- -*`rsa.identity.firstname`*:: +*`rsa.misc.comp_sbytes`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.lastname`*:: +*`rsa.misc.cpu_data`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.user_dept`*:: +*`rsa.misc.criticality`*:: + -- -User's Department Names only - type: keyword -- -*`rsa.identity.user_sid_src`*:: +*`rsa.misc.cs_agency_dst`*:: + -- -This key captures Source User Session ID - type: keyword -- -*`rsa.identity.federated_sp`*:: +*`rsa.misc.cs_analyzedby`*:: + -- -This key is the Federated Service Provider. This is the application requesting authentication. - type: keyword -- -*`rsa.identity.federated_idp`*:: +*`rsa.misc.cs_av_other`*:: + -- -This key is the federated Identity Provider. This is the server providing the authentication. - type: keyword -- -*`rsa.identity.logon_type_desc`*:: +*`rsa.misc.cs_av_primary`*:: + -- -This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - type: keyword -- -*`rsa.identity.middlename`*:: +*`rsa.misc.cs_av_secondary`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.password`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- -This key is for Passwords seen in any session, plain text or encrypted - type: keyword -- -*`rsa.identity.host_role`*:: +*`rsa.misc.cs_bit9status`*:: + -- -This key should only be used to capture the role of a Host Machine - type: keyword -- -*`rsa.identity.ldap`*:: +*`rsa.misc.cs_context`*:: + -- -This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context - type: keyword -- -*`rsa.identity.ldap_query`*:: +*`rsa.misc.cs_control`*:: + -- -This key is the Search criteria from an LDAP search - type: keyword -- -*`rsa.identity.ldap_response`*:: +*`rsa.misc.cs_data`*:: + -- -This key is to capture Results from an LDAP search - type: keyword -- -*`rsa.identity.owner`*:: +*`rsa.misc.cs_datecret`*:: + -- -This is used to capture username the process or service is running as, the author of the task - type: keyword -- -*`rsa.identity.service_account`*:: +*`rsa.misc.cs_dst_tld`*:: + -- -This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - type: keyword -- - -*`rsa.email.email_dst`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- -This key is used to capture the Destination email address only, when the destination context is not clear use email - type: keyword -- -*`rsa.email.email_src`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -This key is used to capture the source email address only, when the source context is not clear use email - type: keyword -- -*`rsa.email.subject`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -This key is used to capture the subject string from an Email only. - type: keyword -- -*`rsa.email.email`*:: +*`rsa.misc.cs_filetype`*:: + -- -This key is used to capture a generic email address where the source or destination context is not clear - type: keyword -- -*`rsa.email.trans_from`*:: +*`rsa.misc.cs_fld`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.email.trans_to`*:: +*`rsa.misc.cs_if_desc`*:: + -- -Deprecated key defined only in table map. - type: keyword -- - -*`rsa.file.privilege`*:: +*`rsa.misc.cs_if_name`*:: + -- -Deprecated, use permissions - type: keyword -- -*`rsa.file.attachment`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -This key captures the attachment file name - type: keyword -- -*`rsa.file.filesystem`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- type: keyword -- -*`rsa.file.binary`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.file.filename_dst`*:: +*`rsa.misc.cs_lifetime`*:: + -- -This is used to capture name of the file targeted by the action - type: keyword -- -*`rsa.file.filename_src`*:: +*`rsa.misc.cs_log_medium`*:: + -- -This is used to capture name of the parent filename, the file which performed the action - type: keyword -- -*`rsa.file.filename_tmp`*:: +*`rsa.misc.cs_loginname`*:: + -- type: keyword -- -*`rsa.file.directory_dst`*:: +*`rsa.misc.cs_modulescore`*:: + -- -This key is used to capture the directory of the target process or file - type: keyword -- -*`rsa.file.directory_src`*:: +*`rsa.misc.cs_modulesign`*:: + -- -This key is used to capture the directory of the source process or file - type: keyword -- -*`rsa.file.file_entropy`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -This is used to capture entropy vale of a file - -type: double +type: keyword -- -*`rsa.file.file_vendor`*:: +*`rsa.misc.cs_payload`*:: + -- -This is used to capture Company name of file located in version_info - type: keyword -- -*`rsa.file.task_name`*:: +*`rsa.misc.cs_registrant`*:: + -- -This is used to capture name of the task - type: keyword -- - -*`rsa.web.fqdn`*:: +*`rsa.misc.cs_registrar`*:: + -- -Fully Qualified Domain Names - type: keyword -- -*`rsa.web.web_cookie`*:: +*`rsa.misc.cs_represult`*:: + -- -This key is used to capture the Web cookies specifically. - type: keyword -- -*`rsa.web.alias_host`*:: +*`rsa.misc.cs_rpayload`*:: + -- type: keyword -- -*`rsa.web.reputation_num`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -Reputation Number of an entity. Typically used for Web Domains - -type: double +type: keyword -- -*`rsa.web.web_ref_domain`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -Web referer's domain - type: keyword -- -*`rsa.web.web_ref_query`*:: +*`rsa.misc.cs_streams`*:: + -- -This key captures Web referer's query portion of the URL - type: keyword -- -*`rsa.web.remote_domain`*:: +*`rsa.misc.cs_targetmodule`*:: + -- type: keyword -- -*`rsa.web.web_ref_page`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -This key captures Web referer's page information - type: keyword -- -*`rsa.web.web_ref_root`*:: +*`rsa.misc.cs_whois_server`*:: + -- -Web referer's root URL path - type: keyword -- -*`rsa.web.cn_asn_dst`*:: +*`rsa.misc.cs_yararesult`*:: + -- type: keyword -- -*`rsa.web.cn_rpackets`*:: +*`rsa.misc.description`*:: + -- type: keyword -- -*`rsa.web.urlpage`*:: +*`rsa.misc.devvendor`*:: + -- type: keyword -- -*`rsa.web.urlroot`*:: +*`rsa.misc.distance`*:: + -- type: keyword -- -*`rsa.web.p_url`*:: +*`rsa.misc.dstburb`*:: + -- type: keyword -- -*`rsa.web.p_user_agent`*:: +*`rsa.misc.edomain`*:: + -- type: keyword -- -*`rsa.web.p_web_cookie`*:: +*`rsa.misc.edomaub`*:: + -- type: keyword -- -*`rsa.web.p_web_method`*:: +*`rsa.misc.euid`*:: + -- type: keyword -- -*`rsa.web.p_web_referer`*:: +*`rsa.misc.facility`*:: + -- type: keyword -- -*`rsa.web.web_extension_tmp`*:: +*`rsa.misc.finterface`*:: + -- type: keyword -- -*`rsa.web.web_page`*:: +*`rsa.misc.flags`*:: + -- type: keyword -- - -*`rsa.threat.threat_category`*:: +*`rsa.misc.gaddr`*:: + -- -This key captures Threat Name/Threat Category/Categorization of alert - type: keyword -- -*`rsa.threat.threat_desc`*:: +*`rsa.misc.id3`*:: + -- -This key is used to capture the threat description from the session directly or inferred - type: keyword -- -*`rsa.threat.alert`*:: +*`rsa.misc.im_buddyname`*:: + -- -This key is used to capture name of the alert - type: keyword -- -*`rsa.threat.threat_source`*:: +*`rsa.misc.im_croomid`*:: + -- -This key is used to capture source of the threat - type: keyword -- - -*`rsa.crypto.crypto`*:: +*`rsa.misc.im_croomtype`*:: + -- -This key is used to capture the Encryption Type or Encryption Key only - type: keyword -- -*`rsa.crypto.cipher_src`*:: +*`rsa.misc.im_members`*:: + -- -This key is for Source (Client) Cipher - type: keyword -- -*`rsa.crypto.cert_subject`*:: +*`rsa.misc.im_username`*:: + -- -This key is used to capture the Certificate organization only - type: keyword -- -*`rsa.crypto.peer`*:: +*`rsa.misc.ipkt`*:: + -- -This key is for Encryption peer's IP Address - type: keyword -- -*`rsa.crypto.cipher_size_src`*:: +*`rsa.misc.ipscat`*:: + -- -This key captures Source (Client) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ike`*:: +*`rsa.misc.ipspri`*:: + -- -IKE negotiation phase. - type: keyword -- -*`rsa.crypto.scheme`*:: +*`rsa.misc.latitude`*:: + -- -This key captures the Encryption scheme used - type: keyword -- -*`rsa.crypto.peer_id`*:: +*`rsa.misc.linenum`*:: + -- -This key is for Encryption peer’s identity - type: keyword -- -*`rsa.crypto.sig_type`*:: +*`rsa.misc.list_name`*:: + -- -This key captures the Signature Type - type: keyword -- -*`rsa.crypto.cert_issuer`*:: +*`rsa.misc.load_data`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_name`*:: +*`rsa.misc.location_floor`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.crypto.cert_error`*:: +*`rsa.misc.location_mark`*:: + -- -This key captures the Certificate Error String - type: keyword -- -*`rsa.crypto.cipher_dst`*:: +*`rsa.misc.log_id`*:: + -- -This key is for Destination (Server) Cipher - type: keyword -- -*`rsa.crypto.cipher_size_dst`*:: +*`rsa.misc.log_type`*:: + -- -This key captures Destination (Server) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ssl_ver_src`*:: +*`rsa.misc.logid`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.d_certauth`*:: +*`rsa.misc.logip`*:: + -- type: keyword -- -*`rsa.crypto.s_certauth`*:: +*`rsa.misc.logname`*:: + -- type: keyword -- -*`rsa.crypto.ike_cookie1`*:: +*`rsa.misc.longitude`*:: + -- -ID of the negotiation — sent for ISAKMP Phase One - type: keyword -- -*`rsa.crypto.ike_cookie2`*:: +*`rsa.misc.lport`*:: + -- -ID of the negotiation — sent for ISAKMP Phase Two - type: keyword -- -*`rsa.crypto.cert_checksum`*:: +*`rsa.misc.mbug_data`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_cat`*:: +*`rsa.misc.misc_name`*:: + -- -This key is used for the hostname category value of a certificate - type: keyword -- -*`rsa.crypto.cert_serial`*:: +*`rsa.misc.msg_type`*:: + -- -This key is used to capture the Certificate serial number only - type: keyword -- -*`rsa.crypto.cert_status`*:: +*`rsa.misc.msgid`*:: + -- -This key captures Certificate validation status - type: keyword -- -*`rsa.crypto.ssl_ver_dst`*:: +*`rsa.misc.netsessid`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.cert_keysize`*:: +*`rsa.misc.num`*:: + -- type: keyword -- -*`rsa.crypto.cert_username`*:: +*`rsa.misc.number1`*:: + -- type: keyword -- -*`rsa.crypto.https_insact`*:: +*`rsa.misc.number2`*:: + -- type: keyword -- -*`rsa.crypto.https_valid`*:: +*`rsa.misc.nwwn`*:: + -- type: keyword -- -*`rsa.crypto.cert_ca`*:: +*`rsa.misc.object`*:: + -- -This key is used to capture the Certificate signing authority only - type: keyword -- -*`rsa.crypto.cert_common`*:: +*`rsa.misc.operation`*:: + -- -This key is used to capture the Certificate common name only - type: keyword -- - -*`rsa.wireless.wlan_ssid`*:: +*`rsa.misc.opkt`*:: + -- -This key is used to capture the ssid of a Wireless Session - type: keyword -- -*`rsa.wireless.access_point`*:: +*`rsa.misc.orig_from`*:: + -- -This key is used to capture the access point name. - type: keyword -- -*`rsa.wireless.wlan_channel`*:: +*`rsa.misc.owner_id`*:: + -- -This is used to capture the channel names - -type: long +type: keyword -- -*`rsa.wireless.wlan_name`*:: +*`rsa.misc.p_action`*:: + -- -This key captures either WLAN number/name - type: keyword -- - -*`rsa.storage.disk_volume`*:: +*`rsa.misc.p_filter`*:: + -- -A unique name assigned to logical units (volumes) within a physical disk - type: keyword -- -*`rsa.storage.lun`*:: +*`rsa.misc.p_group_object`*:: + -- -Logical Unit Number.This key is a very useful concept in Storage. - type: keyword -- -*`rsa.storage.pwwn`*:: +*`rsa.misc.p_id`*:: + -- -This uniquely identifies a port on a HBA. - type: keyword -- - -*`rsa.physical.org_dst`*:: +*`rsa.misc.p_msgid1`*:: + -- -This is used to capture the destination organization based on the GEOPIP Maxmind database. - type: keyword -- -*`rsa.physical.org_src`*:: +*`rsa.misc.p_msgid2`*:: + -- -This is used to capture the source organization based on the GEOPIP Maxmind database. - type: keyword -- - -*`rsa.healthcare.patient_fname`*:: +*`rsa.misc.p_result1`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.healthcare.patient_id`*:: +*`rsa.misc.password_chg`*:: + -- -This key captures the unique ID for a patient - type: keyword -- -*`rsa.healthcare.patient_lname`*:: +*`rsa.misc.password_expire`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.healthcare.patient_mname`*:: +*`rsa.misc.permgranted`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- - -*`rsa.endpoint.host_state`*:: +*`rsa.misc.permwanted`*:: + -- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - type: keyword -- -*`rsa.endpoint.registry_key`*:: +*`rsa.misc.pgid`*:: + -- -This key captures the path to the registry key - type: keyword -- -*`rsa.endpoint.registry_value`*:: +*`rsa.misc.policyUUID`*:: + -- -This key captures values or decorators used within a registry entry - type: keyword -- -[[exported-fields-nginx]] -== Nginx fields - -Module for parsing the Nginx log files. - - - -[float] -=== nginx - -Fields from the Nginx log files. - - - -[float] -=== access - -Contains fields for the Nginx access logs. - - - -*`nginx.access.remote_ip_list`*:: +*`rsa.misc.prog_asp_num`*:: + -- -An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like `X-Forwarded-For`. Real source IP is restored to `source.ip`. - - -type: array +type: keyword -- -*`nginx.access.body_sent.bytes`*:: +*`rsa.misc.program`*:: + -- -type: alias - -alias to: http.response.body.bytes +type: keyword -- -*`nginx.access.user_name`*:: +*`rsa.misc.real_data`*:: + -- -type: alias - -alias to: user.name +type: keyword -- -*`nginx.access.method`*:: +*`rsa.misc.rec_asp_device`*:: + -- -type: alias - -alias to: http.request.method +type: keyword -- -*`nginx.access.url`*:: +*`rsa.misc.rec_asp_num`*:: + -- -type: alias - -alias to: url.original +type: keyword -- -*`nginx.access.http_version`*:: +*`rsa.misc.rec_library`*:: + -- -type: alias - -alias to: http.version +type: keyword -- -*`nginx.access.response_code`*:: +*`rsa.misc.recordnum`*:: + -- -type: alias - -alias to: http.response.status_code +type: keyword -- -*`nginx.access.referrer`*:: +*`rsa.misc.ruid`*:: + -- -type: alias - -alias to: http.request.referrer +type: keyword -- -*`nginx.access.agent`*:: +*`rsa.misc.sburb`*:: + -- -type: alias - -alias to: user_agent.original +type: keyword -- - -*`nginx.access.user_agent.device`*:: +*`rsa.misc.sdomain_fld`*:: + -- -type: alias - -alias to: user_agent.device.name +type: keyword -- -*`nginx.access.user_agent.name`*:: +*`rsa.misc.sec`*:: + -- -type: alias - -alias to: user_agent.name +type: keyword -- -*`nginx.access.user_agent.os`*:: +*`rsa.misc.sensorname`*:: + -- -type: alias - -alias to: user_agent.os.full_name +type: keyword -- -*`nginx.access.user_agent.os_name`*:: +*`rsa.misc.seqnum`*:: + -- -type: alias - -alias to: user_agent.os.name +type: keyword -- -*`nginx.access.user_agent.original`*:: +*`rsa.misc.session`*:: + -- -type: alias - -alias to: user_agent.original +type: keyword -- - -*`nginx.access.geoip.continent_name`*:: +*`rsa.misc.sessiontype`*:: + -- -type: alias - -alias to: source.geo.continent_name +type: keyword -- -*`nginx.access.geoip.country_iso_code`*:: +*`rsa.misc.sigUUID`*:: + -- -type: alias - -alias to: source.geo.country_iso_code +type: keyword -- -*`nginx.access.geoip.location`*:: +*`rsa.misc.spi`*:: + -- -type: alias - -alias to: source.geo.location +type: keyword -- -*`nginx.access.geoip.region_name`*:: +*`rsa.misc.srcburb`*:: + -- -type: alias - -alias to: source.geo.region_name +type: keyword -- -*`nginx.access.geoip.city_name`*:: +*`rsa.misc.srcdom`*:: + -- -type: alias - -alias to: source.geo.city_name +type: keyword -- -*`nginx.access.geoip.region_iso_code`*:: +*`rsa.misc.srcservice`*:: + -- -type: alias - -alias to: source.geo.region_iso_code +type: keyword -- -[float] -=== error - -Contains fields for the Nginx error logs. - - - -*`nginx.error.connection_id`*:: +*`rsa.misc.state`*:: + -- -Connection identifier. - - -type: long +type: keyword -- -*`nginx.error.level`*:: +*`rsa.misc.status1`*:: + -- -type: alias - -alias to: log.level +type: keyword -- -*`nginx.error.pid`*:: +*`rsa.misc.svcno`*:: + -- -type: alias - -alias to: process.pid +type: keyword -- -*`nginx.error.tid`*:: +*`rsa.misc.system`*:: + -- -type: alias - -alias to: process.thread.id +type: keyword -- -*`nginx.error.message`*:: +*`rsa.misc.tbdstr1`*:: + -- -type: alias - -alias to: message +type: keyword -- -[float] -=== ingress_controller - -Contains fields for the Ingress Nginx controller access logs. - - - -*`nginx.ingress_controller.remote_ip_list`*:: +*`rsa.misc.tgtdom`*:: + -- -An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like `X-Forwarded-For`. Real source IP is restored to `source.ip`. - - -type: array +type: keyword -- -*`nginx.ingress_controller.http.request.length`*:: +*`rsa.misc.tgtdomain`*:: + -- -The request length (including request line, header, and request body) - - -type: long - -format: bytes +type: keyword -- -*`nginx.ingress_controller.http.request.time`*:: +*`rsa.misc.threshold`*:: + -- -Time elapsed since the first bytes were read from the client - - -type: double - -format: duration +type: keyword -- -*`nginx.ingress_controller.upstream.name`*:: +*`rsa.misc.type1`*:: + -- -The name of the upstream. - - type: keyword -- -*`nginx.ingress_controller.upstream.alternative_name`*:: +*`rsa.misc.udb_class`*:: + -- -The name of the alternative upstream. - - type: keyword -- -*`nginx.ingress_controller.upstream.response.length`*:: +*`rsa.misc.url_fld`*:: + -- -The length of the response obtained from the upstream server - - -type: long - -format: bytes +type: keyword -- -*`nginx.ingress_controller.upstream.response.time`*:: +*`rsa.misc.user_div`*:: + -- -The time spent on receiving the response from the upstream server as seconds with millisecond resolution - - -type: double - -format: duration +type: keyword -- -*`nginx.ingress_controller.upstream.response.status_code`*:: +*`rsa.misc.userid`*:: + -- -The status code of the response obtained from the upstream server - - -type: long +type: keyword -- -*`nginx.ingress_controller.http.request.id`*:: +*`rsa.misc.username_fld`*:: + -- -The randomly generated ID of the request - - type: keyword -- -*`nginx.ingress_controller.upstream.ip`*:: +*`rsa.misc.utcstamp`*:: + -- -The IP address of the upstream server. If several servers were contacted during request processing, their addresses are separated by commas. - - -type: ip +type: keyword -- -*`nginx.ingress_controller.upstream.port`*:: +*`rsa.misc.v_instafname`*:: + -- -The port of the upstream server. - - -type: long +type: keyword -- -*`nginx.ingress_controller.body_sent.bytes`*:: +*`rsa.misc.virt_data`*:: + -- -type: alias - -alias to: http.response.body.bytes +type: keyword -- -*`nginx.ingress_controller.user_name`*:: +*`rsa.misc.vpnid`*:: + -- -type: alias - -alias to: user.name +type: keyword -- -*`nginx.ingress_controller.method`*:: +*`rsa.misc.autorun_type`*:: + -- -type: alias +This is used to capture Auto Run type -alias to: http.request.method +type: keyword -- -*`nginx.ingress_controller.url`*:: +*`rsa.misc.cc_number`*:: + -- -type: alias +Valid Credit Card Numbers only -alias to: url.original +type: long -- -*`nginx.ingress_controller.http_version`*:: +*`rsa.misc.content`*:: + -- -type: alias +This key captures the content type from protocol headers -alias to: http.version +type: keyword -- -*`nginx.ingress_controller.response_code`*:: +*`rsa.misc.ein_number`*:: + -- -type: alias +Employee Identification Numbers only -alias to: http.response.status_code +type: long -- -*`nginx.ingress_controller.referrer`*:: +*`rsa.misc.found`*:: + -- -type: alias +This is used to capture the results of regex match -alias to: http.request.referrer +type: keyword -- -*`nginx.ingress_controller.agent`*:: +*`rsa.misc.language`*:: + -- -type: alias +This is used to capture list of languages the client support and what it prefers -alias to: user_agent.original +type: keyword -- - -*`nginx.ingress_controller.user_agent.device`*:: +*`rsa.misc.lifetime`*:: + -- -type: alias +This key is used to capture the session lifetime in seconds. -alias to: user_agent.device.name +type: long -- -*`nginx.ingress_controller.user_agent.name`*:: +*`rsa.misc.link`*:: + -- -type: alias +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -alias to: user_agent.name +type: keyword -- -*`nginx.ingress_controller.user_agent.os`*:: +*`rsa.misc.match`*:: + -- -type: alias +This key is for regex match name from search.ini -alias to: user_agent.os.full_name +type: keyword -- -*`nginx.ingress_controller.user_agent.os_name`*:: +*`rsa.misc.param_dst`*:: + -- -type: alias +This key captures the command line/launch argument of the target process or file -alias to: user_agent.os.name +type: keyword -- -*`nginx.ingress_controller.user_agent.original`*:: +*`rsa.misc.param_src`*:: + -- -type: alias +This key captures source parameter -alias to: user_agent.original +type: keyword -- - -*`nginx.ingress_controller.geoip.continent_name`*:: +*`rsa.misc.search_text`*:: + -- -type: alias +This key captures the Search Text used -alias to: source.geo.continent_name +type: keyword -- -*`nginx.ingress_controller.geoip.country_iso_code`*:: +*`rsa.misc.sig_name`*:: + -- -type: alias +This key is used to capture the Signature Name only. -alias to: source.geo.country_iso_code +type: keyword -- -*`nginx.ingress_controller.geoip.location`*:: +*`rsa.misc.snmp_value`*:: + -- -type: alias +SNMP set request value -alias to: source.geo.location +type: keyword -- -*`nginx.ingress_controller.geoip.region_name`*:: +*`rsa.misc.streams`*:: + -- -type: alias +This key captures number of streams in session -alias to: source.geo.region_name +type: long -- -*`nginx.ingress_controller.geoip.city_name`*:: + +*`rsa.db.index`*:: + -- -type: alias +This key captures IndexID of the index. -alias to: source.geo.city_name +type: keyword -- -*`nginx.ingress_controller.geoip.region_iso_code`*:: +*`rsa.db.instance`*:: + -- -type: alias +This key is used to capture the database server instance name -alias to: source.geo.region_iso_code +type: keyword -- -[[exported-fields-o365]] -== Office 365 fields - -Module for handling logs from Office 365. - - - -[float] -=== o365.audit - -Fields from Office 365 Management API audit logs. +*`rsa.db.database`*:: ++ +-- +This key is used to capture the name of a database or an instance as seen in a session +type: keyword +-- -*`o365.audit.Actor`*:: +*`rsa.db.transact_id`*:: + -- -type: array +This key captures the SQL transantion ID of the current session + +type: keyword -- -*`o365.audit.ActorContextId`*:: +*`rsa.db.permissions`*:: + -- +This key captures permission or privilege level assigned to a resource. + type: keyword -- -*`o365.audit.ActorIpAddress`*:: +*`rsa.db.table_name`*:: + -- +This key is used to capture the table name + type: keyword -- -*`o365.audit.ActorUserId`*:: +*`rsa.db.db_id`*:: + -- +This key is used to capture the unique identifier for a database + type: keyword -- -*`o365.audit.ActorYammerUserId`*:: +*`rsa.db.db_pid`*:: + -- -type: keyword +This key captures the process id of a connection with database server + +type: long -- -*`o365.audit.AlertEntityId`*:: +*`rsa.db.lread`*:: + -- -type: keyword +This key is used for the number of logical reads + +type: long -- -*`o365.audit.AlertId`*:: +*`rsa.db.lwrite`*:: + -- -type: keyword +This key is used for the number of logical writes + +type: long -- -*`o365.audit.AlertLinks`*:: +*`rsa.db.pread`*:: + -- -type: array +This key is used for the number of physical writes + +type: long -- -*`o365.audit.AlertType`*:: + +*`rsa.network.alias_host`*:: + -- +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + type: keyword -- -*`o365.audit.AppId`*:: +*`rsa.network.domain`*:: + -- type: keyword -- -*`o365.audit.ApplicationDisplayName`*:: +*`rsa.network.host_dst`*:: + -- +This key should only be used when it’s a Destination Hostname + type: keyword -- -*`o365.audit.ApplicationId`*:: +*`rsa.network.network_service`*:: + -- +This is used to capture layer 7 protocols/service names + type: keyword -- -*`o365.audit.AzureActiveDirectoryEventType`*:: +*`rsa.network.interface`*:: + -- +This key should be used when the source or destination context of an interface is not clear + type: keyword -- -*`o365.audit.ExchangeMetaData.*`*:: +*`rsa.network.network_port`*:: + -- -type: object +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + +type: long -- -*`o365.audit.Category`*:: +*`rsa.network.eth_host`*:: + -- +Deprecated, use alias.mac + type: keyword -- -*`o365.audit.ClientAppId`*:: +*`rsa.network.sinterface`*:: + -- +This key should only be used when it’s a Source Interface + type: keyword -- -*`o365.audit.ClientInfoString`*:: +*`rsa.network.dinterface`*:: + -- +This key should only be used when it’s a Destination Interface + type: keyword -- -*`o365.audit.ClientIP`*:: +*`rsa.network.vlan`*:: + -- -type: keyword +This key should only be used to capture the ID of the Virtual LAN + +type: long -- -*`o365.audit.ClientIPAddress`*:: +*`rsa.network.zone_src`*:: + -- +This key should only be used when it’s a Source Zone. + type: keyword -- -*`o365.audit.Comments`*:: +*`rsa.network.zone`*:: + -- -type: text +This key should be used when the source or destination context of a Zone is not clear + +type: keyword -- -*`o365.audit.CorrelationId`*:: +*`rsa.network.zone_dst`*:: + -- +This key should only be used when it’s a Destination Zone. + type: keyword -- -*`o365.audit.CreationTime`*:: +*`rsa.network.gateway`*:: + -- +This key is used to capture the IP Address of the gateway + type: keyword -- -*`o365.audit.CustomUniqueId`*:: +*`rsa.network.icmp_type`*:: + -- -type: keyword +This key is used to capture the ICMP type only + +type: long -- -*`o365.audit.Data`*:: +*`rsa.network.mask`*:: + -- +This key is used to capture the device network IPmask. + type: keyword -- -*`o365.audit.DataType`*:: +*`rsa.network.icmp_code`*:: + -- -type: keyword +This key is used to capture the ICMP code only + +type: long -- -*`o365.audit.EntityType`*:: +*`rsa.network.protocol_detail`*:: + -- +This key should be used to capture additional protocol information + type: keyword -- -*`o365.audit.EventData`*:: +*`rsa.network.dmask`*:: + -- +This key is used for Destionation Device network mask + type: keyword -- -*`o365.audit.EventSource`*:: +*`rsa.network.port`*:: + -- -type: keyword +This key should only be used to capture a Network Port when the directionality is not clear + +type: long -- -*`o365.audit.ExceptionInfo.*`*:: +*`rsa.network.smask`*:: + -- -type: object +This key is used for capturing source Network Mask + +type: keyword -- -*`o365.audit.ExtendedProperties.*`*:: +*`rsa.network.netname`*:: + -- -type: object +This key is used to capture the network name associated with an IP range. This is configured by the end user. + +type: keyword -- -*`o365.audit.ExternalAccess`*:: +*`rsa.network.paddr`*:: + -- -type: keyword +Deprecated + +type: ip -- -*`o365.audit.GroupName`*:: +*`rsa.network.faddr`*:: + -- type: keyword -- -*`o365.audit.Id`*:: +*`rsa.network.lhost`*:: + -- type: keyword -- -*`o365.audit.ImplicitShare`*:: +*`rsa.network.origin`*:: + -- type: keyword -- -*`o365.audit.IncidentId`*:: +*`rsa.network.remote_domain_id`*:: + -- type: keyword -- -*`o365.audit.InternalLogonType`*:: +*`rsa.network.addr`*:: + -- type: keyword -- -*`o365.audit.InterSystemsId`*:: +*`rsa.network.dns_a_record`*:: + -- type: keyword -- -*`o365.audit.IntraSystemId`*:: +*`rsa.network.dns_ptr_record`*:: + -- type: keyword -- -*`o365.audit.Item.*`*:: +*`rsa.network.fhost`*:: + -- -type: object +type: keyword -- -*`o365.audit.Item.*.*`*:: +*`rsa.network.fport`*:: + -- -type: object +type: keyword -- -*`o365.audit.ItemName`*:: +*`rsa.network.laddr`*:: + -- type: keyword -- -*`o365.audit.ItemType`*:: +*`rsa.network.linterface`*:: + -- type: keyword -- -*`o365.audit.ListId`*:: +*`rsa.network.phost`*:: + -- type: keyword -- -*`o365.audit.ListItemUniqueId`*:: +*`rsa.network.ad_computer_dst`*:: + -- +Deprecated, use host.dst + type: keyword -- -*`o365.audit.LogonError`*:: +*`rsa.network.eth_type`*:: + -- -type: keyword +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + +type: long -- -*`o365.audit.LogonType`*:: +*`rsa.network.ip_proto`*:: + -- -type: keyword +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + +type: long -- -*`o365.audit.LogonUserSid`*:: +*`rsa.network.dns_cname_record`*:: + -- type: keyword -- -*`o365.audit.MailboxGuid`*:: +*`rsa.network.dns_id`*:: + -- type: keyword -- -*`o365.audit.MailboxOwnerMasterAccountSid`*:: +*`rsa.network.dns_opcode`*:: + -- type: keyword -- -*`o365.audit.MailboxOwnerSid`*:: +*`rsa.network.dns_resp`*:: + -- type: keyword -- -*`o365.audit.MailboxOwnerUPN`*:: +*`rsa.network.dns_type`*:: + -- type: keyword -- -*`o365.audit.Members`*:: +*`rsa.network.domain1`*:: + -- -type: array +type: keyword -- -*`o365.audit.Members.*`*:: +*`rsa.network.host_type`*:: + -- -type: object +type: keyword -- -*`o365.audit.ModifiedProperties.*.*`*:: +*`rsa.network.packet_length`*:: + -- -type: object +type: keyword -- -*`o365.audit.Name`*:: +*`rsa.network.host_orig`*:: + -- +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + type: keyword -- -*`o365.audit.ObjectId`*:: +*`rsa.network.rpayload`*:: + -- +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + type: keyword -- -*`o365.audit.Operation`*:: +*`rsa.network.vlan_name`*:: + -- +This key should only be used to capture the name of the Virtual LAN + type: keyword -- -*`o365.audit.OrganizationId`*:: + +*`rsa.investigations.ec_activity`*:: + -- +This key captures the particular event activity(Ex:Logoff) + type: keyword -- -*`o365.audit.OrganizationName`*:: +*`rsa.investigations.ec_theme`*:: + -- +This key captures the Theme of a particular Event(Ex:Authentication) + type: keyword -- -*`o365.audit.OriginatingServer`*:: +*`rsa.investigations.ec_subject`*:: + -- +This key captures the Subject of a particular Event(Ex:User) + type: keyword -- -*`o365.audit.Parameters.*`*:: +*`rsa.investigations.ec_outcome`*:: + -- -type: object +This key captures the outcome of a particular Event(Ex:Success) + +type: keyword -- -*`o365.audit.PolicyDetails`*:: +*`rsa.investigations.event_cat`*:: + -- -type: array +This key captures the Event category number + +type: long -- -*`o365.audit.PolicyId`*:: +*`rsa.investigations.event_cat_name`*:: + -- +This key captures the event category name corresponding to the event cat code + type: keyword -- -*`o365.audit.RecordType`*:: +*`rsa.investigations.event_vcat`*:: + -- +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + type: keyword -- -*`o365.audit.ResultStatus`*:: +*`rsa.investigations.analysis_file`*:: + -- +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file + type: keyword -- -*`o365.audit.SensitiveInfoDetectionIsIncluded`*:: +*`rsa.investigations.analysis_service`*:: + -- +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + type: keyword -- -*`o365.audit.SharePointMetaData.*`*:: +*`rsa.investigations.analysis_session`*:: + -- -type: object - --- +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session -*`o365.audit.SessionId`*:: -+ --- type: keyword -- -*`o365.audit.Severity`*:: +*`rsa.investigations.boc`*:: + -- +This is used to capture behaviour of compromise + type: keyword -- -*`o365.audit.Site`*:: +*`rsa.investigations.eoc`*:: + -- +This is used to capture Enablers of Compromise + type: keyword -- -*`o365.audit.SiteUrl`*:: +*`rsa.investigations.inv_category`*:: + -- +This used to capture investigation category + type: keyword -- -*`o365.audit.Source`*:: +*`rsa.investigations.inv_context`*:: + -- +This used to capture investigation context + type: keyword -- -*`o365.audit.SourceFileExtension`*:: +*`rsa.investigations.ioc`*:: + -- +This is key capture indicator of compromise + type: keyword -- -*`o365.audit.SourceFileName`*:: + +*`rsa.counters.dclass_c1`*:: + -- -type: keyword +This is a generic counter key that should be used with the label dclass.c1.str only + +type: long -- -*`o365.audit.SourceRelativeUrl`*:: +*`rsa.counters.dclass_c2`*:: + -- -type: keyword +This is a generic counter key that should be used with the label dclass.c2.str only + +type: long -- -*`o365.audit.Status`*:: +*`rsa.counters.event_counter`*:: + -- -type: keyword +This is used to capture the number of times an event repeated + +type: long -- -*`o365.audit.SupportTicketId`*:: +*`rsa.counters.dclass_r1`*:: + -- +This is a generic ratio key that should be used with the label dclass.r1.str only + type: keyword -- -*`o365.audit.Target`*:: +*`rsa.counters.dclass_c3`*:: + -- -type: array +This is a generic counter key that should be used with the label dclass.c3.str only + +type: long -- -*`o365.audit.TargetContextId`*:: +*`rsa.counters.dclass_c1_str`*:: + -- +This is a generic counter string key that should be used with the label dclass.c1 only + type: keyword -- -*`o365.audit.TargetUserOrGroupName`*:: +*`rsa.counters.dclass_c2_str`*:: + -- +This is a generic counter string key that should be used with the label dclass.c2 only + type: keyword -- -*`o365.audit.TargetUserOrGroupType`*:: +*`rsa.counters.dclass_r1_str`*:: + -- +This is a generic ratio string key that should be used with the label dclass.r1 only + type: keyword -- -*`o365.audit.TeamName`*:: +*`rsa.counters.dclass_r2`*:: + -- +This is a generic ratio key that should be used with the label dclass.r2.str only + type: keyword -- -*`o365.audit.TeamGuid`*:: +*`rsa.counters.dclass_c3_str`*:: + -- +This is a generic counter string key that should be used with the label dclass.c3 only + type: keyword -- -*`o365.audit.UniqueSharingId`*:: +*`rsa.counters.dclass_r3`*:: + -- +This is a generic ratio key that should be used with the label dclass.r3.str only + type: keyword -- -*`o365.audit.UserAgent`*:: +*`rsa.counters.dclass_r2_str`*:: + -- +This is a generic ratio string key that should be used with the label dclass.r2 only + type: keyword -- -*`o365.audit.UserId`*:: +*`rsa.counters.dclass_r3_str`*:: + -- +This is a generic ratio string key that should be used with the label dclass.r3 only + type: keyword -- -*`o365.audit.UserKey`*:: + +*`rsa.identity.auth_method`*:: + -- +This key is used to capture authentication methods used only + type: keyword -- -*`o365.audit.UserType`*:: +*`rsa.identity.user_role`*:: + -- +This key is used to capture the Role of a user only + type: keyword -- -*`o365.audit.Version`*:: +*`rsa.identity.dn`*:: + -- +X.500 (LDAP) Distinguished Name + type: keyword -- -*`o365.audit.WebId`*:: +*`rsa.identity.logon_type`*:: + -- +This key is used to capture the type of logon method used. + type: keyword -- -*`o365.audit.Workload`*:: +*`rsa.identity.profile`*:: + -- +This key is used to capture the user profile + type: keyword -- -*`o365.audit.YammerNetworkId`*:: +*`rsa.identity.accesses`*:: + -- +This key is used to capture actual privileges used in accessing an object + type: keyword -- -[[exported-fields-okta]] -== Okta fields - -Module for handling system logs from Okta. - - - -[float] -=== okta - -Fields from Okta. - - - -*`okta.uuid`*:: +*`rsa.identity.realm`*:: + -- -The unique identifier of the Okta LogEvent. - +Radius realm or similar grouping of accounts type: keyword -- -*`okta.event_type`*:: +*`rsa.identity.user_sid_dst`*:: + -- -The type of the LogEvent. - +This key captures Destination User Session ID type: keyword -- -*`okta.version`*:: +*`rsa.identity.dn_src`*:: + -- -The version of the LogEvent. - +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn type: keyword -- -*`okta.severity`*:: +*`rsa.identity.org`*:: + -- -The severity of the LogEvent. Must be one of DEBUG, INFO, WARN, or ERROR. - +This key captures the User organization type: keyword -- -*`okta.display_message`*:: +*`rsa.identity.dn_dst`*:: + -- -The display message of the LogEvent. - +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn type: keyword -- -[float] -=== actor - -Fields that let you store information of the actor for the LogEvent. +*`rsa.identity.firstname`*:: ++ +-- +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +type: keyword +-- -*`okta.actor.id`*:: +*`rsa.identity.lastname`*:: + -- -Identifier of the actor. - +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`okta.actor.type`*:: +*`rsa.identity.user_dept`*:: + -- -Type of the actor. - +User's Department Names only type: keyword -- -*`okta.actor.alternate_id`*:: +*`rsa.identity.user_sid_src`*:: + -- -Alternate identifier of the actor. - +This key captures Source User Session ID type: keyword -- -*`okta.actor.display_name`*:: +*`rsa.identity.federated_sp`*:: + -- -Display name of the actor. - +This key is the Federated Service Provider. This is the application requesting authentication. type: keyword -- -[float] -=== client - -Fields that let you store information about the client of the actor. +*`rsa.identity.federated_idp`*:: ++ +-- +This key is the federated Identity Provider. This is the server providing the authentication. +type: keyword +-- -*`okta.client.ip`*:: +*`rsa.identity.logon_type_desc`*:: + -- -The IP address of the client. - +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. -type: ip +type: keyword -- -[float] -=== user_agent - -Fields about the user agent information of the client. +*`rsa.identity.middlename`*:: ++ +-- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +type: keyword +-- -*`okta.client.user_agent.raw_user_agent`*:: +*`rsa.identity.password`*:: + -- -The raw informaton of the user agent. - +This key is for Passwords seen in any session, plain text or encrypted type: keyword -- -*`okta.client.user_agent.os`*:: +*`rsa.identity.host_role`*:: + -- -The OS informaton. - +This key should only be used to capture the role of a Host Machine type: keyword -- -*`okta.client.user_agent.browser`*:: +*`rsa.identity.ldap`*:: + -- -The browser informaton of the client. - +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context type: keyword -- -*`okta.client.zone`*:: +*`rsa.identity.ldap_query`*:: + -- -The zone information of the client. - +This key is the Search criteria from an LDAP search type: keyword -- -*`okta.client.device`*:: +*`rsa.identity.ldap_response`*:: + -- -The information of the client device. - +This key is to capture Results from an LDAP search type: keyword -- -*`okta.client.id`*:: +*`rsa.identity.owner`*:: + -- -The identifier of the client. - +This is used to capture username the process or service is running as, the author of the task type: keyword -- -[float] -=== outcome +*`rsa.identity.service_account`*:: ++ +-- +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage -Fields that let you store information about the outcome. +type: keyword +-- -*`okta.outcome.reason`*:: +*`rsa.email.email_dst`*:: + -- -The reason of the outcome. - +This key is used to capture the Destination email address only, when the destination context is not clear use email type: keyword -- -*`okta.outcome.result`*:: +*`rsa.email.email_src`*:: + -- -The result of the outcome. Must be one of: SUCCESS, FAILURE, SKIPPED, ALLOW, DENY, CHALLENGE, UNKNOWN. - +This key is used to capture the source email address only, when the source context is not clear use email type: keyword -- -*`okta.target`*:: +*`rsa.email.subject`*:: + -- -The list of targets. - +This key is used to capture the subject string from an Email only. -type: array +type: keyword -- -[float] -=== transaction - -Fields that let you store information about related transaction. - - - -*`okta.transaction.id`*:: +*`rsa.email.email`*:: + -- -Identifier of the transaction. - +This key is used to capture a generic email address where the source or destination context is not clear type: keyword -- -*`okta.transaction.type`*:: +*`rsa.email.trans_from`*:: + -- -The type of transaction. Must be one of "WEB", "JOB". - +Deprecated key defined only in table map. type: keyword -- -[float] -=== debug_context - -Fields that let you store information about the debug context. - - - -[float] -=== debug_data +*`rsa.email.trans_to`*:: ++ +-- +Deprecated key defined only in table map. -The debug data. +type: keyword +-- -*`okta.debug_context.debug_data.device_fingerprint`*:: +*`rsa.file.privilege`*:: + -- -The fingerprint of the device. - +Deprecated, use permissions type: keyword -- -*`okta.debug_context.debug_data.request_id`*:: +*`rsa.file.attachment`*:: + -- -The identifier of the request. - +This key captures the attachment file name type: keyword -- -*`okta.debug_context.debug_data.request_uri`*:: +*`rsa.file.filesystem`*:: + -- -The request URI. - - type: keyword -- -*`okta.debug_context.debug_data.threat_suspected`*:: +*`rsa.file.binary`*:: + -- -Threat suspected. - +Deprecated key defined only in table map. type: keyword -- -*`okta.debug_context.debug_data.url`*:: +*`rsa.file.filename_dst`*:: + -- -The URL. - +This is used to capture name of the file targeted by the action type: keyword -- -[float] -=== authentication_context - -Fields that let you store information about authentication context. - - - -*`okta.authentication_context.authentication_provider`*:: +*`rsa.file.filename_src`*:: + -- -The information about the authentication provider. Must be one of OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, FACTOR_PROVIDER. - +This is used to capture name of the parent filename, the file which performed the action type: keyword -- -*`okta.authentication_context.authentication_step`*:: +*`rsa.file.filename_tmp`*:: + -- -The authentication step. - - -type: integer +type: keyword -- -*`okta.authentication_context.credential_provider`*:: +*`rsa.file.directory_dst`*:: + -- -The information about credential provider. Must be one of OKTA_CREDENTIAL_PROVIDER, RSA, SYMANTEC, GOOGLE, DUO, YUBIKEY. - +This key is used to capture the directory of the target process or file type: keyword -- -*`okta.authentication_context.credential_type`*:: +*`rsa.file.directory_src`*:: + -- -The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID. - +This key is used to capture the directory of the source process or file type: keyword -- -*`okta.authentication_context.issuer`*:: +*`rsa.file.file_entropy`*:: + -- -The information about the issuer. - +This is used to capture entropy vale of a file -type: array +type: double -- -*`okta.authentication_context.external_session_id`*:: +*`rsa.file.file_vendor`*:: + -- -The session identifer of the external session if any. - +This is used to capture Company name of file located in version_info type: keyword -- -*`okta.authentication_context.interface`*:: +*`rsa.file.task_name`*:: + -- -The interface used. e.g., Outlook, Office365, wsTrust - +This is used to capture name of the task type: keyword -- -[float] -=== security_context - -Fields that let you store information about security context. - - - -[float] -=== as -The autonomous system. +*`rsa.web.fqdn`*:: ++ +-- +Fully Qualified Domain Names +type: keyword +-- -*`okta.security_context.as.number`*:: +*`rsa.web.web_cookie`*:: + -- -The AS number. +This key is used to capture the Web cookies specifically. +type: keyword -type: integer +-- +*`rsa.web.alias_host`*:: ++ -- +type: keyword -[float] -=== organization +-- -The organization that owns the AS number. +*`rsa.web.reputation_num`*:: ++ +-- +Reputation Number of an entity. Typically used for Web Domains +type: double +-- -*`okta.security_context.as.organization.name`*:: +*`rsa.web.web_ref_domain`*:: + -- -The organization name. - +Web referer's domain type: keyword -- -*`okta.security_context.isp`*:: +*`rsa.web.web_ref_query`*:: + -- -The Internet Service Provider. - +This key captures Web referer's query portion of the URL type: keyword -- -*`okta.security_context.domain`*:: +*`rsa.web.remote_domain`*:: + -- -The domain name. - - type: keyword -- -*`okta.security_context.is_proxy`*:: +*`rsa.web.web_ref_page`*:: + -- -Whether it is a proxy or not. - +This key captures Web referer's page information -type: boolean +type: keyword -- -[float] -=== request - -Fields that let you store information about the request, in the form of list of ip_chain. - - - -[float] -=== ip_chain - -List of ip_chain objects. - - - -*`okta.request.ip_chain.ip`*:: +*`rsa.web.web_ref_root`*:: + -- -IP address. - +Web referer's root URL path -type: ip +type: keyword -- -*`okta.request.ip_chain.version`*:: +*`rsa.web.cn_asn_dst`*:: + -- -IP version. Must be one of V4, V6. - - type: keyword -- -*`okta.request.ip_chain.source`*:: +*`rsa.web.cn_rpackets`*:: + -- -Source information. - - type: keyword -- -[float] -=== geographical_context - -Geographical information. - - - -*`okta.request.ip_chain.geographical_context.city`*:: +*`rsa.web.urlpage`*:: + -- -The city. - type: keyword -- -*`okta.request.ip_chain.geographical_context.state`*:: +*`rsa.web.urlroot`*:: + -- -The state. - type: keyword -- -*`okta.request.ip_chain.geographical_context.postal_code`*:: +*`rsa.web.p_url`*:: + -- -The postal code. - type: keyword -- -*`okta.request.ip_chain.geographical_context.country`*:: +*`rsa.web.p_user_agent`*:: + -- -The country. - type: keyword -- -*`okta.request.ip_chain.geographical_context.geolocation`*:: +*`rsa.web.p_web_cookie`*:: + -- -Geolocation information. - - -type: geo_point +type: keyword -- -[[exported-fields-osquery]] -== Osquery fields - -Fields exported by the `osquery` module - - - -[float] -=== osquery - - - - -[float] -=== result +*`rsa.web.p_web_method`*:: ++ +-- +type: keyword -Common fields exported by the result metricset. +-- +*`rsa.web.p_web_referer`*:: ++ +-- +type: keyword +-- -*`osquery.result.name`*:: +*`rsa.web.web_extension_tmp`*:: + -- -The name of the query that generated this event. +type: keyword +-- +*`rsa.web.web_page`*:: ++ +-- type: keyword -- -*`osquery.result.action`*:: + +*`rsa.threat.threat_category`*:: + -- -For incremental data, marks whether the entry was added or removed. It can be one of "added", "removed", or "snapshot". - +This key captures Threat Name/Threat Category/Categorization of alert type: keyword -- -*`osquery.result.host_identifier`*:: +*`rsa.threat.threat_desc`*:: + -- -The identifier for the host on which the osquery agent is running. Normally the hostname. - +This key is used to capture the threat description from the session directly or inferred type: keyword -- -*`osquery.result.unix_time`*:: +*`rsa.threat.alert`*:: + -- -Unix timestamp of the event, in seconds since the epoch. Used for computing the `@timestamp` column. - +This key is used to capture name of the alert -type: long +type: keyword -- -*`osquery.result.calendar_time`*:: +*`rsa.threat.threat_source`*:: + -- -String representation of the collection time, as formatted by osquery. - +This key is used to capture source of the threat type: keyword -- -[[exported-fields-panw]] -== panw fields - -Module for Palo Alto Networks (PAN-OS) - +*`rsa.crypto.crypto`*:: ++ +-- +This key is used to capture the Encryption Type or Encryption Key only -[float] -=== panw +type: keyword -Fields from the panw module. +-- +*`rsa.crypto.cipher_src`*:: ++ +-- +This key is for Source (Client) Cipher +type: keyword -[float] -=== panos +-- -Fields for the Palo Alto Networks PAN-OS logs. +*`rsa.crypto.cert_subject`*:: ++ +-- +This key is used to capture the Certificate organization only +type: keyword +-- -*`panw.panos.ruleset`*:: +*`rsa.crypto.peer`*:: + -- -Name of the rule that matched this session. - +This key is for Encryption peer's IP Address type: keyword -- -[float] -=== source - -Fields to extend the top-level source object. +*`rsa.crypto.cipher_size_src`*:: ++ +-- +This key captures Source (Client) Cipher Size +type: long +-- -*`panw.panos.source.zone`*:: +*`rsa.crypto.ike`*:: + -- -Source zone for this session. - +IKE negotiation phase. type: keyword -- -*`panw.panos.source.interface`*:: +*`rsa.crypto.scheme`*:: + -- -Source interface for this session. - +This key captures the Encryption scheme used type: keyword -- -[float] -=== nat - -Post-NAT source address, if source NAT is performed. - - - -*`panw.panos.source.nat.ip`*:: +*`rsa.crypto.peer_id`*:: + -- -Post-NAT source IP. - +This key is for Encryption peer’s identity -type: ip +type: keyword -- -*`panw.panos.source.nat.port`*:: +*`rsa.crypto.sig_type`*:: + -- -Post-NAT source port. - +This key captures the Signature Type -type: long +type: keyword -- -[float] -=== destination - -Fields to extend the top-level destination object. - - - -*`panw.panos.destination.zone`*:: +*`rsa.crypto.cert_issuer`*:: + -- -Destination zone for this session. - - type: keyword -- -*`panw.panos.destination.interface`*:: +*`rsa.crypto.cert_host_name`*:: + -- -Destination interface for this session. - +Deprecated key defined only in table map. type: keyword -- -[float] -=== nat - -Post-NAT destination address, if destination NAT is performed. +*`rsa.crypto.cert_error`*:: ++ +-- +This key captures the Certificate Error String +type: keyword +-- -*`panw.panos.destination.nat.ip`*:: +*`rsa.crypto.cipher_dst`*:: + -- -Post-NAT destination IP. - +This key is for Destination (Server) Cipher -type: ip +type: keyword -- -*`panw.panos.destination.nat.port`*:: +*`rsa.crypto.cipher_size_dst`*:: + -- -Post-NAT destination port. - +This key captures Destination (Server) Cipher Size type: long -- -*`panw.panos.endreason`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -The reason a session terminated. - +Deprecated, use version type: keyword -- -[float] -=== network - -Fields to extend the top-level network object. - - - -*`panw.panos.network.pcap_id`*:: +*`rsa.crypto.d_certauth`*:: + -- -Packet capture ID for a threat. - - type: keyword -- - -*`panw.panos.network.nat.community_id`*:: +*`rsa.crypto.s_certauth`*:: + -- -Community ID flow-hash for the NAT 5-tuple. - - type: keyword -- -[float] -=== file - -Fields to extend the top-level file object. - - - -*`panw.panos.file.hash`*:: +*`rsa.crypto.ike_cookie1`*:: + -- -Binary hash for a threat file sent to be analyzed by the WildFire service. - +ID of the negotiation — sent for ISAKMP Phase One type: keyword -- -[float] -=== url - -Fields to extend the top-level url object. - - - -*`panw.panos.url.category`*:: +*`rsa.crypto.ike_cookie2`*:: + -- -For threat URLs, it's the URL category. For WildFire, the verdict on the file and is either 'malicious', 'grayware', or 'benign'. - +ID of the negotiation — sent for ISAKMP Phase Two type: keyword -- -*`panw.panos.flow_id`*:: +*`rsa.crypto.cert_checksum`*:: + -- -Internal numeric identifier for each session. - - type: keyword -- -*`panw.panos.sequence_number`*:: +*`rsa.crypto.cert_host_cat`*:: + -- -Log entry identifier that is incremented sequentially. Unique for each log type. - +This key is used for the hostname category value of a certificate -type: long +type: keyword -- -*`panw.panos.threat.resource`*:: +*`rsa.crypto.cert_serial`*:: + -- -URL or file name for a threat. - +This key is used to capture the Certificate serial number only type: keyword -- -*`panw.panos.threat.id`*:: +*`rsa.crypto.cert_status`*:: + -- -Palo Alto Networks identifier for the threat. - +This key captures Certificate validation status type: keyword -- -*`panw.panos.threat.name`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- -Palo Alto Networks name for the threat. - +Deprecated, use version type: keyword -- -*`panw.panos.action`*:: +*`rsa.crypto.cert_keysize`*:: + -- -Action taken for the session. - type: keyword -- -*`panw.panos.type`*:: +*`rsa.crypto.cert_username`*:: + -- -Specifies the type of the log +type: keyword -- -*`panw.panos.sub_type`*:: +*`rsa.crypto.https_insact`*:: + -- -Specifies the sub type of the log +type: keyword -- -[[exported-fields-postgresql]] -== PostgreSQL fields +*`rsa.crypto.https_valid`*:: ++ +-- +type: keyword -Module for parsing the PostgreSQL log files. +-- +*`rsa.crypto.cert_ca`*:: ++ +-- +This key is used to capture the Certificate signing authority only +type: keyword -[float] -=== postgresql +-- -Fields from PostgreSQL logs. +*`rsa.crypto.cert_common`*:: ++ +-- +This key is used to capture the Certificate common name only +type: keyword +-- -[float] -=== log -Fields from the PostgreSQL log files. +*`rsa.wireless.wlan_ssid`*:: ++ +-- +This key is used to capture the ssid of a Wireless Session +type: keyword +-- -*`postgresql.log.timestamp`*:: +*`rsa.wireless.access_point`*:: + -- +This key is used to capture the access point name. -deprecated:[7.3.0] - -The timestamp from the log line. - +type: keyword -- -*`postgresql.log.core_id`*:: +*`rsa.wireless.wlan_channel`*:: + -- -Core id - +This is used to capture the channel names type: long -- -*`postgresql.log.database`*:: +*`rsa.wireless.wlan_name`*:: + -- -Name of database - +This key captures either WLAN number/name -example: mydb +type: keyword -- -*`postgresql.log.query`*:: + +*`rsa.storage.disk_volume`*:: + -- -Query statement. - +A unique name assigned to logical units (volumes) within a physical disk -example: SELECT * FROM users; +type: keyword -- -*`postgresql.log.query_step`*:: +*`rsa.storage.lun`*:: + -- -Statement step when using extended query protocol (one of statement, parse, bind or execute) - +Logical Unit Number.This key is a very useful concept in Storage. -example: parse +type: keyword -- -*`postgresql.log.query_name`*:: +*`rsa.storage.pwwn`*:: + -- -Name given to a query when using extended query protocol. If it is "", or not present, this field is ignored. - +This uniquely identifies a port on a HBA. -example: pdo_stmt_00000001 +type: keyword -- -*`postgresql.log.error.code`*:: + +*`rsa.physical.org_dst`*:: + -- -Error code returned by Postgres (if any) +This is used to capture the destination organization based on the GEOPIP Maxmind database. -type: long +type: keyword -- -*`postgresql.log.timezone`*:: +*`rsa.physical.org_src`*:: + -- -type: alias +This is used to capture the source organization based on the GEOPIP Maxmind database. -alias to: event.timezone +type: keyword -- -*`postgresql.log.thread_id`*:: + +*`rsa.healthcare.patient_fname`*:: + -- -type: alias +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information -alias to: process.pid +type: keyword -- -*`postgresql.log.user`*:: +*`rsa.healthcare.patient_id`*:: + -- -type: alias +This key captures the unique ID for a patient -alias to: user.name +type: keyword -- -*`postgresql.log.level`*:: +*`rsa.healthcare.patient_lname`*:: + -- -type: alias +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information -alias to: log.level +type: keyword -- -*`postgresql.log.message`*:: +*`rsa.healthcare.patient_mname`*:: + -- -type: alias +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information -alias to: message +type: keyword -- -[[exported-fields-process]] -== Process fields - -Process metadata fields - - - -*`process.exe`*:: +*`rsa.endpoint.host_state`*:: + -- -type: alias +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on -alias to: process.executable +type: keyword -- -[[exported-fields-rabbitmq]] -== RabbitMQ fields - -RabbitMQ Module - - - -[float] -=== rabbitmq - - - - -[float] -=== log - -RabbitMQ log files +*`rsa.endpoint.registry_key`*:: ++ +-- +This key captures the path to the registry key +type: keyword +-- -*`rabbitmq.log.pid`*:: +*`rsa.endpoint.registry_value`*:: + -- -The Erlang process id +This key captures values or decorators used within a registry entry type: keyword -example: <0.222.0> - -- -[[exported-fields-radware]] -== Radware DefensePro fields +[[exported-fields-sophos]] +== sophos fields -radware fields. +sophos Module @@ -101533,14791 +134419,14507 @@ type: keyword -- This key captures Certificate validation status -type: keyword - --- - -*`rsa.crypto.ssl_ver_dst`*:: -+ --- -Deprecated, use version - -type: keyword - --- - -*`rsa.crypto.cert_keysize`*:: -+ --- -type: keyword - --- - -*`rsa.crypto.cert_username`*:: -+ --- -type: keyword - --- - -*`rsa.crypto.https_insact`*:: -+ --- -type: keyword - --- - -*`rsa.crypto.https_valid`*:: -+ --- -type: keyword - --- - -*`rsa.crypto.cert_ca`*:: -+ --- -This key is used to capture the Certificate signing authority only - -type: keyword - --- - -*`rsa.crypto.cert_common`*:: -+ --- -This key is used to capture the Certificate common name only - -type: keyword - --- - - -*`rsa.wireless.wlan_ssid`*:: -+ --- -This key is used to capture the ssid of a Wireless Session - -type: keyword - --- - -*`rsa.wireless.access_point`*:: -+ --- -This key is used to capture the access point name. - -type: keyword - --- - -*`rsa.wireless.wlan_channel`*:: -+ --- -This is used to capture the channel names - -type: long - --- - -*`rsa.wireless.wlan_name`*:: -+ --- -This key captures either WLAN number/name - -type: keyword - --- - - -*`rsa.storage.disk_volume`*:: -+ --- -A unique name assigned to logical units (volumes) within a physical disk - -type: keyword - --- - -*`rsa.storage.lun`*:: -+ --- -Logical Unit Number.This key is a very useful concept in Storage. - -type: keyword - --- - -*`rsa.storage.pwwn`*:: -+ --- -This uniquely identifies a port on a HBA. - -type: keyword - --- - - -*`rsa.physical.org_dst`*:: -+ --- -This is used to capture the destination organization based on the GEOPIP Maxmind database. - -type: keyword - --- - -*`rsa.physical.org_src`*:: -+ --- -This is used to capture the source organization based on the GEOPIP Maxmind database. - -type: keyword - --- - - -*`rsa.healthcare.patient_fname`*:: -+ --- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - -type: keyword - --- - -*`rsa.healthcare.patient_id`*:: -+ --- -This key captures the unique ID for a patient - -type: keyword - --- - -*`rsa.healthcare.patient_lname`*:: -+ --- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - -type: keyword - --- - -*`rsa.healthcare.patient_mname`*:: -+ --- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - -type: keyword - --- - - -*`rsa.endpoint.host_state`*:: -+ --- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - -type: keyword - --- - -*`rsa.endpoint.registry_key`*:: -+ --- -This key captures the path to the registry key - -type: keyword - --- - -*`rsa.endpoint.registry_value`*:: -+ --- -This key captures values or decorators used within a registry entry - -type: keyword - --- - -[[exported-fields-redis]] -== Redis fields - -Redis Module - - - -[float] -=== redis - - - - -[float] -=== log - -Redis log files - - - -*`redis.log.role`*:: -+ --- -The role of the Redis instance. Can be one of `master`, `slave`, `child` (for RDF/AOF writing child), or `sentinel`. - - -type: keyword - --- - -*`redis.log.pid`*:: -+ --- -type: alias - -alias to: process.pid - --- - -*`redis.log.level`*:: -+ --- -type: alias - -alias to: log.level - --- - -*`redis.log.message`*:: -+ --- -type: alias - -alias to: message - --- - -[float] -=== slowlog - -Slow logs are retrieved from Redis via a network connection. - - - -*`redis.slowlog.cmd`*:: -+ --- -The command executed. - - -type: keyword - --- - -*`redis.slowlog.duration.us`*:: -+ --- -How long it took to execute the command in microseconds. - - -type: long - --- - -*`redis.slowlog.id`*:: -+ --- -The ID of the query. - - -type: long - --- - -*`redis.slowlog.key`*:: -+ --- -The key on which the command was executed. - - -type: keyword - --- - -*`redis.slowlog.args`*:: -+ --- -The arguments with which the command was called. - - -type: keyword - --- - -[[exported-fields-s3]] -== s3 fields - -S3 fields from s3 input. - - - -*`bucket_name`*:: -+ --- -Name of the S3 bucket that this log retrieved from. - - -type: keyword - --- - -*`object_key`*:: -+ --- -Name of the S3 object that this log retrieved from. - - -type: keyword - --- - -[[exported-fields-santa]] -== Google Santa fields - -Santa Module - - - -[float] -=== santa - - - - -*`santa.action`*:: -+ --- -Action - -type: keyword - -example: EXEC - --- - -*`santa.decision`*:: -+ --- -Decision that santad took. - -type: keyword - -example: ALLOW - --- - -*`santa.reason`*:: -+ --- -Reason for the decsision. - -type: keyword - -example: CERT - --- - -*`santa.mode`*:: -+ --- -Operating mode of Santa. - -type: keyword - -example: M - --- - -[float] -=== disk - -Fields for DISKAPPEAR actions. +type: keyword +-- -*`santa.disk.volume`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- -The volume name. +Deprecated, use version + +type: keyword -- -*`santa.disk.bus`*:: +*`rsa.crypto.cert_keysize`*:: + -- -The disk bus protocol. +type: keyword -- -*`santa.disk.serial`*:: +*`rsa.crypto.cert_username`*:: + -- -The disk serial number. +type: keyword -- -*`santa.disk.bsdname`*:: +*`rsa.crypto.https_insact`*:: + -- -The disk BSD name. - -example: disk1s3 +type: keyword -- -*`santa.disk.model`*:: +*`rsa.crypto.https_valid`*:: + -- -The disk model. - -example: APPLE SSD SM0512L +type: keyword -- -*`santa.disk.fs`*:: +*`rsa.crypto.cert_ca`*:: + -- -The disk volume kind (filesystem type). +This key is used to capture the Certificate signing authority only -example: apfs +type: keyword -- -*`santa.disk.mount`*:: +*`rsa.crypto.cert_common`*:: + -- -The disk volume path. +This key is used to capture the Certificate common name only + +type: keyword -- -*`santa.certificate.common_name`*:: + +*`rsa.wireless.wlan_ssid`*:: + -- -Common name from code signing certificate. +This key is used to capture the ssid of a Wireless Session type: keyword -- -*`santa.certificate.sha256`*:: +*`rsa.wireless.access_point`*:: + -- -SHA256 hash of code signing certificate. +This key is used to capture the access point name. type: keyword -- -[[exported-fields-sonicwall]] -== Sonicwall-FW fields - -sonicwall fields. +*`rsa.wireless.wlan_channel`*:: ++ +-- +This is used to capture the channel names +type: long +-- -*`network.interface.name`*:: +*`rsa.wireless.wlan_name`*:: + -- -Name of the network interface where the traffic has been observed. - +This key captures either WLAN number/name type: keyword -- - -*`rsa.internal.msg`*:: +*`rsa.storage.disk_volume`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder +A unique name assigned to logical units (volumes) within a physical disk type: keyword -- -*`rsa.internal.messageid`*:: +*`rsa.storage.lun`*:: + -- +Logical Unit Number.This key is a very useful concept in Storage. + type: keyword -- -*`rsa.internal.event_desc`*:: +*`rsa.storage.pwwn`*:: + -- +This uniquely identifies a port on a HBA. + type: keyword -- -*`rsa.internal.message`*:: + +*`rsa.physical.org_dst`*:: + -- -This key captures the contents of instant messages +This is used to capture the destination organization based on the GEOPIP Maxmind database. type: keyword -- -*`rsa.internal.time`*:: +*`rsa.physical.org_src`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. +This is used to capture the source organization based on the GEOPIP Maxmind database. -type: date +type: keyword -- -*`rsa.internal.level`*:: + +*`rsa.healthcare.patient_fname`*:: + -- -Deprecated key defined only in table map. +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information -type: long +type: keyword -- -*`rsa.internal.msg_id`*:: +*`rsa.healthcare.patient_id`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key captures the unique ID for a patient type: keyword -- -*`rsa.internal.msg_vid`*:: +*`rsa.healthcare.patient_lname`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.internal.data`*:: +*`rsa.healthcare.patient_mname`*:: + -- -Deprecated key defined only in table map. +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`rsa.internal.obj_server`*:: + +*`rsa.endpoint.host_state`*:: + -- -Deprecated key defined only in table map. +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on type: keyword -- -*`rsa.internal.obj_val`*:: +*`rsa.endpoint.registry_key`*:: + -- -Deprecated key defined only in table map. +This key captures the path to the registry key type: keyword -- -*`rsa.internal.resource`*:: +*`rsa.endpoint.registry_value`*:: + -- -Deprecated key defined only in table map. +This key captures values or decorators used within a registry entry type: keyword -- -*`rsa.internal.obj_id`*:: +[float] +=== sophos + + + + +[float] +=== xg + +Module for parsing sophosxg syslog. + + + +*`sophos.xg.device`*:: + -- -Deprecated key defined only in table map. +device + type: keyword -- -*`rsa.internal.statement`*:: +*`sophos.xg.date`*:: + -- -Deprecated key defined only in table map. +Date (yyyy-mm-dd) when the event occurred -type: keyword + +type: date -- -*`rsa.internal.audit_class`*:: +*`sophos.xg.timezone`*:: + -- -Deprecated key defined only in table map. +Time (hh:mm:ss) when the event occurred + type: keyword -- -*`rsa.internal.entry`*:: +*`sophos.xg.device_name`*:: + -- -Deprecated key defined only in table map. +Model number of the device + type: keyword -- -*`rsa.internal.hcode`*:: +*`sophos.xg.device_id`*:: + -- -Deprecated key defined only in table map. +Serial number of the device + type: keyword -- -*`rsa.internal.inode`*:: +*`sophos.xg.log_id`*:: + -- -Deprecated key defined only in table map. +Unique 12 characters code (0101011) -type: long + +type: keyword -- -*`rsa.internal.resource_class`*:: +*`sophos.xg.log_type`*:: + -- -Deprecated key defined only in table map. +Type of event e.g. firewall event + type: keyword -- -*`rsa.internal.dead`*:: +*`sophos.xg.log_component`*:: + -- -Deprecated key defined only in table map. +Component responsible for logging e.g. Firewall rule -type: long + +type: keyword -- -*`rsa.internal.feed_desc`*:: +*`sophos.xg.log_subtype`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Sub type of event + type: keyword -- -*`rsa.internal.feed_name`*:: +*`sophos.xg.hb_health`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Heartbeat status + type: keyword -- -*`rsa.internal.cid`*:: +*`sophos.xg.priority`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Severity level of traffic + type: keyword -- -*`rsa.internal.device_class`*:: +*`sophos.xg.status`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Ultimate status of traffic – Allowed or Denied + type: keyword -- -*`rsa.internal.device_group`*:: +*`sophos.xg.duration`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Durability of traffic (seconds) -type: keyword + +type: long -- -*`rsa.internal.device_host`*:: +*`sophos.xg.fw_rule_id`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Firewall Rule ID which is applied on the traffic -type: keyword + +type: integer -- -*`rsa.internal.device_ip`*:: +*`sophos.xg.user_name`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +user_name -type: ip + +type: keyword -- -*`rsa.internal.device_ipv6`*:: +*`sophos.xg.user_group`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Group name to which the user belongs -type: ip + +type: keyword -- -*`rsa.internal.device_type`*:: +*`sophos.xg.iap`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Internet Access policy ID applied on the traffic + type: keyword -- -*`rsa.internal.device_type_id`*:: +*`sophos.xg.ips_policy_id`*:: + -- -Deprecated key defined only in table map. +IPS policy ID applied on the traffic -type: long + +type: integer -- -*`rsa.internal.did`*:: +*`sophos.xg.policy_type`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Policy type applied to the traffic + type: keyword -- -*`rsa.internal.entropy_req`*:: +*`sophos.xg.appfilter_policy_id`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Application Filter policy applied on the traffic -type: long + +type: integer -- -*`rsa.internal.entropy_res`*:: +*`sophos.xg.application_filter_policy`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +Application Filter policy applied on the traffic -type: long + +type: integer -- -*`rsa.internal.event_name`*:: +*`sophos.xg.application`*:: + -- -Deprecated key defined only in table map. +Application name + type: keyword -- -*`rsa.internal.feed_category`*:: +*`sophos.xg.application_name`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Application name + type: keyword -- -*`rsa.internal.forward_ip`*:: +*`sophos.xg.application_risk`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. +Risk level assigned to the application -type: ip + +type: keyword -- -*`rsa.internal.forward_ipv6`*:: +*`sophos.xg.application_technology`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Technology of the application -type: ip + +type: keyword -- -*`rsa.internal.header_id`*:: +*`sophos.xg.application_category`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Application is resolved by signature or synchronized application + type: keyword -- -*`rsa.internal.lc_cid`*:: +*`sophos.xg.appresolvedby`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Technology of the application + type: keyword -- -*`rsa.internal.lc_ctime`*:: +*`sophos.xg.app_is_cloud`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Application is Cloud -type: date + +type: keyword -- -*`rsa.internal.mcb_req`*:: +*`sophos.xg.in_interface`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +Interface for incoming traffic, e.g., Port A -type: long + +type: keyword -- -*`rsa.internal.mcb_res`*:: +*`sophos.xg.out_interface`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +Interface for outgoing traffic, e.g., Port B -type: long + +type: keyword -- -*`rsa.internal.mcbc_req`*:: +*`sophos.xg.src_ip`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +Original source IP address of traffic -type: long + +type: ip -- -*`rsa.internal.mcbc_res`*:: +*`sophos.xg.src_mac`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +Original source MAC address of traffic -type: long + +type: keyword -- -*`rsa.internal.medium`*:: +*`sophos.xg.src_country_code`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +Code of the country to which the source IP belongs -type: long + +type: keyword -- -*`rsa.internal.node_name`*:: +*`sophos.xg.dst_ip`*:: + -- -Deprecated key defined only in table map. +Original destination IP address of traffic -type: keyword + +type: ip -- -*`rsa.internal.nwe_callback_id`*:: +*`sophos.xg.dst_country_code`*:: + -- -This key denotes that event is endpoint related +Code of the country to which the destination IP belongs + type: keyword -- -*`rsa.internal.parse_error`*:: +*`sophos.xg.protocol`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Protocol number of traffic + type: keyword -- -*`rsa.internal.payload_req`*:: +*`sophos.xg.src_port`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +Original source port of TCP and UDP traffic -type: long + +type: integer -- -*`rsa.internal.payload_res`*:: +*`sophos.xg.dst_port`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep +Original destination port of TCP and UDP traffic -type: long + +type: integer -- -*`rsa.internal.process_vid_dst`*:: +*`sophos.xg.icmp_type`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. +ICMP type of ICMP traffic + type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`sophos.xg.icmp_code`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +ICMP code of ICMP traffic + type: keyword -- -*`rsa.internal.rid`*:: +*`sophos.xg.sent_pkts`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Total number of packets sent + type: long -- -*`rsa.internal.session_split`*:: +*`sophos.xg.received_pkts`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Total number of packets received -type: keyword + +type: long -- -*`rsa.internal.site`*:: +*`sophos.xg.sent_bytes`*:: + -- -Deprecated key defined only in table map. +Total number of bytes sent -type: keyword + +type: long -- -*`rsa.internal.size`*:: +*`sophos.xg.recv_bytes`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Total number of bytes received + type: long -- -*`rsa.internal.sourcefile`*:: +*`sophos.xg.trans_src_ ip`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +Translated source IP address for outgoing traffic -type: keyword + +type: ip -- -*`rsa.internal.ubc_req`*:: +*`sophos.xg.trans_src_port`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +Translated source port for outgoing traffic -type: long + +type: integer -- -*`rsa.internal.ubc_res`*:: +*`sophos.xg.trans_dst_ip`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once +Translated destination IP address for outgoing traffic -type: long + +type: ip -- -*`rsa.internal.word`*:: +*`sophos.xg.trans_dst_port`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +Translated destination port for outgoing traffic -type: keyword --- +type: integer +-- -*`rsa.time.event_time`*:: +*`sophos.xg.srczonetype`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form +Type of source zone, e.g., LAN -type: date + +type: keyword -- -*`rsa.time.duration_time`*:: +*`sophos.xg.srczone`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. +Name of source zone -type: double + +type: keyword -- -*`rsa.time.event_time_str`*:: +*`sophos.xg.dstzonetype`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string +Type of destination zone, e.g., WAN + type: keyword -- -*`rsa.time.starttime`*:: +*`sophos.xg.dstzone`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form +Name of destination zone -type: date + +type: keyword -- -*`rsa.time.month`*:: +*`sophos.xg.dir_disp`*:: + -- +TPacket direction. Possible values:“org”, “reply”, “” + + type: keyword -- -*`rsa.time.day`*:: +*`sophos.xg.connevent`*:: + -- +Event on which this log is generated + + type: keyword -- -*`rsa.time.endtime`*:: +*`sophos.xg.conn_id`*:: + -- -This key is used to capture the End time mentioned in a session in a standard form +Unique identifier of connection -type: date + +type: integer -- -*`rsa.time.timezone`*:: +*`sophos.xg.vconn_id`*:: + -- -This key is used to capture the timezone of the Event Time +Connection ID of the master connection -type: keyword + +type: integer -- -*`rsa.time.duration_str`*:: +*`sophos.xg.idp_policy_id`*:: + -- -A text string version of the duration +IPS policy ID which is applied on the traffic + + +type: integer + +-- + +*`sophos.xg.idp_policy_name`*:: ++ +-- +IPS policy name i.e. IPS policy name which is applied on the traffic + type: keyword -- -*`rsa.time.date`*:: +*`sophos.xg.signature_id`*:: + -- +Signature ID + + type: keyword -- -*`rsa.time.year`*:: +*`sophos.xg.signature_msg`*:: + -- +Signature messsage + + type: keyword -- -*`rsa.time.recorded_time`*:: +*`sophos.xg.classification`*:: + -- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. +Signature classification -type: date + +type: keyword -- -*`rsa.time.datetime`*:: +*`sophos.xg.rule_priority`*:: + -- +Priority of IPS policy + + type: keyword -- -*`rsa.time.effective_time`*:: +*`sophos.xg.platform`*:: + -- -This key is the effective time referenced by an individual event in a Standard Timestamp format +Platform of the traffic. -type: date + +type: keyword -- -*`rsa.time.expire_time`*:: +*`sophos.xg.category`*:: + -- -This key is the timestamp that explicitly refers to an expiration. +IPS signature category. -type: date + +type: keyword -- -*`rsa.time.process_time`*:: +*`sophos.xg.target`*:: + -- -Deprecated, use duration.time +Platform of the traffic. + type: keyword -- -*`rsa.time.hour`*:: +*`sophos.xg.eventid`*:: + -- +ATP Evenet ID + + type: keyword -- -*`rsa.time.min`*:: +*`sophos.xg.ep_uuid`*:: + -- +Endpoint UUID + + type: keyword -- -*`rsa.time.timestamp`*:: +*`sophos.xg.threatname`*:: + -- +ATP threatname + + type: keyword -- -*`rsa.time.event_queue_time`*:: +*`sophos.xg.sourceip`*:: + -- -This key is the Time that the event was queued. +Original source IP address of traffic -type: date + +type: ip -- -*`rsa.time.p_time1`*:: +*`sophos.xg.destinationip`*:: + -- -type: keyword +Original destination IP address of traffic + + +type: ip -- -*`rsa.time.tzone`*:: +*`sophos.xg.login_user`*:: + -- +ATP login user + + type: keyword -- -*`rsa.time.eventtime`*:: +*`sophos.xg.eventtype`*:: + -- +ATP event type + + type: keyword -- -*`rsa.time.gmtdate`*:: +*`sophos.xg.execution_path`*:: + -- +ATP execution path + + type: keyword -- -*`rsa.time.gmttime`*:: +*`sophos.xg.av_policy_name`*:: + -- +Malware scanning policy name which is applied on the traffic + + type: keyword -- -*`rsa.time.p_date`*:: +*`sophos.xg.from_email_address`*:: + -- +Sender email address + + type: keyword -- -*`rsa.time.p_month`*:: +*`sophos.xg.to_email_address`*:: + -- +Receipeint email address + + type: keyword -- -*`rsa.time.p_time`*:: +*`sophos.xg.subject`*:: + -- +Email subject + + type: keyword -- -*`rsa.time.p_time2`*:: +*`sophos.xg.mailsize`*:: + -- -type: keyword +mailsize + + +type: integer -- -*`rsa.time.p_year`*:: +*`sophos.xg.virus`*:: + -- +virus name + + type: keyword -- -*`rsa.time.expire_time_str`*:: +*`sophos.xg.FTP_url`*:: + -- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. +FTP URL from which virus was downloaded + type: keyword -- -*`rsa.time.stamp`*:: +*`sophos.xg.FTP_direction`*:: + -- -Deprecated key defined only in table map. +Direction of FTP transfer: Upload or Download -type: date --- +type: keyword +-- -*`rsa.misc.action`*:: +*`sophos.xg.filesize`*:: + -- -type: keyword +Size of the file that contained virus + + +type: integer -- -*`rsa.misc.result`*:: +*`sophos.xg.filepath`*:: + -- -This key is used to capture the outcome/result string value of an action in a session. +Path of the file containing virus + type: keyword -- -*`rsa.misc.severity`*:: +*`sophos.xg.filename`*:: + -- -This key is used to capture the severity given the session +File name associated with the event + type: keyword -- -*`rsa.misc.event_type`*:: +*`sophos.xg.ftpcommand`*:: + -- -This key captures the event category type as specified by the event source. +FTP command used when virus was found + type: keyword -- -*`rsa.misc.reference_id`*:: +*`sophos.xg.url`*:: + -- -This key is used to capture an event id from the session directly +URL from which virus was downloaded + type: keyword -- -*`rsa.misc.version`*:: +*`sophos.xg.domainname`*:: + -- -This key captures Version of the application or OS which is generating the event. +Domain from which virus was downloaded + type: keyword -- -*`rsa.misc.disposition`*:: +*`sophos.xg.quarantine`*:: + -- -This key captures the The end state of an action. +Path and filename of the file quarantined + type: keyword -- -*`rsa.misc.result_code`*:: +*`sophos.xg.src_domainname`*:: + -- -This key is used to capture the outcome/result numeric value of an action in a session +Sender domain name + type: keyword -- -*`rsa.misc.category`*:: +*`sophos.xg.dst_domainname`*:: + -- -This key is used to capture the category of an event given by the vendor in the session +Receiver domain name + type: keyword -- -*`rsa.misc.obj_name`*:: +*`sophos.xg.reason`*:: + -- -This is used to capture name of object +Reason why the record was detected as spam/malicious + type: keyword -- -*`rsa.misc.obj_type`*:: +*`sophos.xg.referer`*:: + -- -This is used to capture type of object +Referer + type: keyword -- -*`rsa.misc.event_source`*:: +*`sophos.xg.spamaction`*:: + -- -This key captures Source of the event that’s not a hostname +Spam Action + type: keyword -- -*`rsa.misc.log_session_id`*:: +*`sophos.xg.mailid`*:: + -- -This key is used to capture a sessionid from the session directly +mailid + type: keyword -- -*`rsa.misc.group`*:: +*`sophos.xg.quarantine_reason`*:: + -- -This key captures the Group Name value +Quarantine reason + type: keyword -- -*`rsa.misc.policy_name`*:: +*`sophos.xg.status_code`*:: + -- -This key is used to capture the Policy Name only. +Status code + type: keyword -- -*`rsa.misc.rule_name`*:: +*`sophos.xg.override_token`*:: + -- -This key captures the Rule Name +Override token + type: keyword -- -*`rsa.misc.context`*:: +*`sophos.xg.con_id`*:: + -- -This key captures Information which adds additional context to the event. +Unique identifier of connection -type: keyword + +type: integer -- -*`rsa.misc.change_new`*:: +*`sophos.xg.override_authorizer`*:: + -- -This key is used to capture the new values of the attribute that’s changing in a session +Override authorizer + type: keyword -- -*`rsa.misc.space`*:: +*`sophos.xg.transactionid`*:: + -- +Transaction ID of the AV scan. + + type: keyword -- -*`rsa.misc.client`*:: +*`sophos.xg.upload_file_type`*:: + -- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. +Upload file type + type: keyword -- -*`rsa.misc.msgIdPart1`*:: +*`sophos.xg.upload_file_name`*:: + -- +Upload file name + + type: keyword -- -*`rsa.misc.msgIdPart2`*:: +*`sophos.xg.httpresponsecode`*:: + -- -type: keyword +code of HTTP response + + +type: long -- -*`rsa.misc.change_old`*:: +*`sophos.xg.user_gp`*:: + -- -This key is used to capture the old value of the attribute that’s changing in a session +Group name to which the user belongs. + type: keyword -- -*`rsa.misc.operation_id`*:: +*`sophos.xg.category_type`*:: + -- -An alert number or operation number. The values should be unique and non-repeating. +Type of category under which website falls + type: keyword -- -*`rsa.misc.event_state`*:: +*`sophos.xg.download_file_type`*:: + -- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. +Download file type + type: keyword -- -*`rsa.misc.group_object`*:: +*`sophos.xg.exceptions`*:: + -- -This key captures a collection/grouping of entities. Specific usage +List of the checks excluded by web exceptions. + type: keyword -- -*`rsa.misc.node`*:: +*`sophos.xg.contenttype`*:: + -- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. +Type of the content + type: keyword -- -*`rsa.misc.rule`*:: +*`sophos.xg.override_name`*:: + -- -This key captures the Rule number +Override name + type: keyword -- -*`rsa.misc.device_name`*:: +*`sophos.xg.activityname`*:: + -- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc +Web policy activity that matched and caused the policy result. + type: keyword -- -*`rsa.misc.param`*:: +*`sophos.xg.download_file_name`*:: + -- -This key is the parameters passed as part of a command or application, etc. +Download file name + type: keyword -- -*`rsa.misc.change_attrib`*:: +*`sophos.xg.sha1sum`*:: + -- -This key is used to capture the name of the attribute that’s changing in a session +SHA1 checksum of the item being analyzed + type: keyword -- -*`rsa.misc.event_computer`*:: +*`sophos.xg.message_id`*:: + -- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. +Message ID + type: keyword -- -*`rsa.misc.reference_id1`*:: +*`sophos.xg.connid`*:: + -- -This key is for Linked ID to be used as an addition to "reference.id" +Connection ID + type: keyword -- -*`rsa.misc.event_log`*:: +*`sophos.xg.message`*:: + -- -This key captures the Name of the event log +Message + type: keyword -- -*`rsa.misc.OS`*:: +*`sophos.xg.email_subject`*:: + -- -This key captures the Name of the Operating System +Email Subject + type: keyword -- -*`rsa.misc.terminal`*:: +*`sophos.xg.file_path`*:: + -- -This key captures the Terminal Names only +File path + type: keyword -- -*`rsa.misc.msgIdPart3`*:: +*`sophos.xg.dstdomain`*:: + -- +Destination Domain + + type: keyword -- -*`rsa.misc.filter`*:: +*`sophos.xg.file_size`*:: + -- -This key captures Filter used to reduce result set +File Size -type: keyword + +type: integer -- -*`rsa.misc.serial_number`*:: +*`sophos.xg.transaction_id`*:: + -- -This key is the Serial number associated with a physical asset. +Transaction ID + type: keyword -- -*`rsa.misc.checksum`*:: +*`sophos.xg.website`*:: + -- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. +Website + type: keyword -- -*`rsa.misc.event_user`*:: +*`sophos.xg.file_name`*:: + -- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. +Filename + type: keyword -- -*`rsa.misc.virusname`*:: +*`sophos.xg.context_prefix`*:: + -- -This key captures the name of the virus +Content Prefix + type: keyword -- -*`rsa.misc.content_type`*:: +*`sophos.xg.site_category`*:: + -- -This key is used to capture Content Type only. +Site Category + type: keyword -- -*`rsa.misc.group_id`*:: +*`sophos.xg.context_suffix`*:: + -- -This key captures Group ID Number (related to the group name) +Context Suffix + type: keyword -- -*`rsa.misc.policy_id`*:: +*`sophos.xg.dictionary_name`*:: + -- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise +Dictionary Name + type: keyword -- -*`rsa.misc.vsys`*:: +*`sophos.xg.action`*:: + -- -This key captures Virtual System Name +Event Action + type: keyword -- -*`rsa.misc.connection_id`*:: +*`sophos.xg.user`*:: + -- -This key captures the Connection ID +User + type: keyword -- -*`rsa.misc.reference_id2`*:: +*`sophos.xg.context_match`*:: + -- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. +Context Match + type: keyword -- -*`rsa.misc.sensor`*:: +*`sophos.xg.direction`*:: + -- -This key captures Name of the sensor. Typically used in IDS/IPS based devices +Direction + type: keyword -- -*`rsa.misc.sig_id`*:: +*`sophos.xg.auth_client`*:: + -- -This key captures IDS/IPS Int Signature ID +Auth Client -type: long + +type: keyword -- -*`rsa.misc.port_name`*:: +*`sophos.xg.auth_mechanism`*:: + -- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). +Auth mechanism + type: keyword -- -*`rsa.misc.rule_group`*:: +*`sophos.xg.connectionname`*:: + -- -This key captures the Rule group name +Connectionname + type: keyword -- -*`rsa.misc.risk_num`*:: +*`sophos.xg.remotenetwork`*:: + -- -This key captures a Numeric Risk value +remotenetwork -type: double + +type: keyword -- -*`rsa.misc.trigger_val`*:: +*`sophos.xg.localgateway`*:: + -- -This key captures the Value of the trigger or threshold condition. +Localgateway + type: keyword -- -*`rsa.misc.log_session_id1`*:: +*`sophos.xg.localnetwork`*:: + -- -This key is used to capture a Linked (Related) Session ID from the session directly +Localnetwork + type: keyword -- -*`rsa.misc.comp_version`*:: +*`sophos.xg.connectiontype`*:: + -- -This key captures the Version level of a sub-component of a product. +Connectiontype + type: keyword -- -*`rsa.misc.content_version`*:: +*`sophos.xg.oldversion`*:: + -- -This key captures Version level of a signature or database content. +Oldversion + type: keyword -- -*`rsa.misc.hardware_id`*:: +*`sophos.xg.newversion`*:: + -- -This key is used to capture unique identifier for a device or system (NOT a Mac address) +Newversion + type: keyword -- -*`rsa.misc.risk`*:: +*`sophos.xg.ipaddress`*:: + -- -This key captures the non-numeric risk value +Ipaddress + type: keyword -- -*`rsa.misc.event_id`*:: +*`sophos.xg.client_physical_address`*:: + -- +Client physical address + + type: keyword -- -*`rsa.misc.reason`*:: +*`sophos.xg.client_host_name`*:: + -- +Client host name + + type: keyword -- -*`rsa.misc.status`*:: +*`sophos.xg.raw_data`*:: + -- +Raw data + + type: keyword -- -*`rsa.misc.mail_id`*:: +*`sophos.xg.Mode`*:: + -- -This key is used to capture the mailbox id/name +Mode + type: keyword -- -*`rsa.misc.rule_uid`*:: +*`sophos.xg.sessionid`*:: + -- -This key is the Unique Identifier for a rule. +Sessionid + type: keyword -- -*`rsa.misc.trigger_desc`*:: +*`sophos.xg.starttime`*:: + -- -This key captures the Description of the trigger or threshold condition. +Starttime -type: keyword + +type: date -- -*`rsa.misc.inout`*:: +*`sophos.xg.remote_ip`*:: + -- -type: keyword +Remote IP + + +type: ip -- -*`rsa.misc.p_msgid`*:: +*`sophos.xg.timestamp`*:: + -- -type: keyword +timestamp + + +type: date -- -*`rsa.misc.data_type`*:: +*`sophos.xg.SysLog_SERVER_NAME`*:: + -- +SysLog SERVER NAME + + type: keyword -- -*`rsa.misc.msgIdPart4`*:: +*`sophos.xg.backup_mode`*:: + -- +Backup mode + + type: keyword -- -*`rsa.misc.error`*:: +*`sophos.xg.source`*:: + -- -This key captures All non successful Error codes or responses +Source + type: keyword -- -*`rsa.misc.index`*:: +*`sophos.xg.server`*:: + -- +Server + + type: keyword -- -*`rsa.misc.listnum`*:: +*`sophos.xg.host`*:: + -- -This key is used to capture listname or listnumber, primarily for collecting access-list +Host + type: keyword -- -*`rsa.misc.ntype`*:: +*`sophos.xg.responsetime`*:: + -- -type: keyword +Responsetime + + +type: long -- -*`rsa.misc.observed_val`*:: +*`sophos.xg.cookie`*:: + -- -This key captures the Value observed (from the perspective of the device generating the log). +cookie + type: keyword -- -*`rsa.misc.policy_value`*:: +*`sophos.xg.querystring`*:: + -- -This key captures the contents of the policy. This contains details about the policy +querystring + type: keyword -- -*`rsa.misc.pool_name`*:: +*`sophos.xg.extra`*:: + -- -This key captures the name of a resource pool +extra + type: keyword -- -*`rsa.misc.rule_template`*:: +*`sophos.xg.PHPSESSID`*:: + -- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template +PHPSESSID + type: keyword -- -*`rsa.misc.count`*:: +*`sophos.xg.start_time`*:: + -- -type: keyword +Start time + + +type: date -- -*`rsa.misc.number`*:: +*`sophos.xg.eventtime`*:: + -- -type: keyword +Event time + + +type: date -- -*`rsa.misc.sigcat`*:: +*`sophos.xg.red_id`*:: + -- +RED ID + + type: keyword -- -*`rsa.misc.type`*:: +*`sophos.xg.branch_name`*:: + -- +Branch Name + + type: keyword -- -*`rsa.misc.comments`*:: +*`sophos.xg.updatedip`*:: + -- -Comment information provided in the log message +updatedip -type: keyword + +type: ip -- -*`rsa.misc.doc_number`*:: +*`sophos.xg.idle_cpu`*:: + -- -This key captures File Identification number +idle ## -type: long + +type: float -- -*`rsa.misc.expected_val`*:: +*`sophos.xg.system_cpu`*:: + -- -This key captures the Value expected (from the perspective of the device generating the log). +system -type: keyword + +type: float -- -*`rsa.misc.job_num`*:: +*`sophos.xg.user_cpu`*:: + -- -This key captures the Job Number +system -type: keyword + +type: float -- -*`rsa.misc.spi_dst`*:: +*`sophos.xg.used`*:: + -- -Destination SPI Index +used -type: keyword + +type: integer -- -*`rsa.misc.spi_src`*:: +*`sophos.xg.unit`*:: + -- -Source SPI Index +unit + type: keyword -- -*`rsa.misc.code`*:: +*`sophos.xg.total_memory`*:: + -- -type: keyword +Total Memory + + +type: integer -- -*`rsa.misc.agent_id`*:: +*`sophos.xg.free`*:: + -- -This key is used to capture agent id +free -type: keyword + +type: integer -- -*`rsa.misc.message_body`*:: +*`sophos.xg.transmittederrors`*:: + -- -This key captures the The contents of the message body. +transmitted errors + type: keyword -- -*`rsa.misc.phone`*:: +*`sophos.xg.receivederrors`*:: + -- +received errors + + type: keyword -- -*`rsa.misc.sig_id_str`*:: +*`sophos.xg.receivedkbits`*:: + -- -This key captures a string object of the sigid variable. +received kbits -type: keyword + +type: long -- -*`rsa.misc.cmd`*:: +*`sophos.xg.transmittedkbits`*:: + -- -type: keyword +transmitted kbits + + +type: long -- -*`rsa.misc.misc`*:: +*`sophos.xg.transmitteddrops`*:: + -- -type: keyword +transmitted drops + + +type: long -- -*`rsa.misc.name`*:: +*`sophos.xg.receiveddrops`*:: + -- -type: keyword +received drops + + +type: long -- -*`rsa.misc.cpu`*:: +*`sophos.xg.collisions`*:: + -- -This key is the CPU time used in the execution of the event being recorded. +collisions + type: long -- -*`rsa.misc.event_desc`*:: +*`sophos.xg.interface`*:: + -- -This key is used to capture a description of an event available directly or inferred +interface + type: keyword -- -*`rsa.misc.sig_id1`*:: +*`sophos.xg.Configuration`*:: + -- -This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id +Configuration -type: long + +type: float -- -*`rsa.misc.im_buddyid`*:: +*`sophos.xg.Reports`*:: + -- -type: keyword +Reports + + +type: float -- -*`rsa.misc.im_client`*:: +*`sophos.xg.Signature`*:: + -- -type: keyword +Signature + + +type: float -- -*`rsa.misc.im_userid`*:: +*`sophos.xg.Temp`*:: + -- -type: keyword +Temp + + +type: float -- -*`rsa.misc.pid`*:: +*`sophos.xg.users`*:: + -- +users + + type: keyword -- -*`rsa.misc.priority`*:: +*`sophos.xg.ssid`*:: + -- +ssid + + type: keyword -- -*`rsa.misc.context_subject`*:: +*`sophos.xg.ap`*:: + -- -This key is to be used in an audit context where the subject is the object being identified +ap + type: keyword -- -*`rsa.misc.context_target`*:: +*`sophos.xg.clients_conn_ssid`*:: + -- +clients connection ssid + + type: keyword -- -*`rsa.misc.cve`*:: +[[exported-fields-squid]] +== Squid fields + +squid fields. + + + +*`network.interface.name`*:: + -- -This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. +Name of the network interface where the traffic has been observed. + type: keyword -- -*`rsa.misc.fcatnum`*:: + + +*`rsa.internal.msg`*:: + -- -This key captures Filter Category Number. Legacy Usage +This key is used to capture the raw message that comes into the Log Decoder type: keyword -- -*`rsa.misc.library`*:: +*`rsa.internal.messageid`*:: + -- -This key is used to capture library information in mainframe devices - type: keyword -- -*`rsa.misc.parent_node`*:: +*`rsa.internal.event_desc`*:: + -- -This key captures the Parent Node Name. Must be related to node variable. - type: keyword -- -*`rsa.misc.risk_info`*:: +*`rsa.internal.message`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This key captures the contents of instant messages type: keyword -- -*`rsa.misc.tcp_flags`*:: +*`rsa.internal.time`*:: + -- -This key is captures the TCP flags set in any packet of session +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. -type: long +type: date -- -*`rsa.misc.tos`*:: +*`rsa.internal.level`*:: + -- -This key describes the type of service +Deprecated key defined only in table map. type: long -- -*`rsa.misc.vm_target`*:: +*`rsa.internal.msg_id`*:: + -- -VMWare Target **VMWARE** only varaible. +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.workspace`*:: +*`rsa.internal.msg_vid`*:: + -- -This key captures Workspace Description +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.command`*:: +*`rsa.internal.data`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.event_category`*:: +*`rsa.internal.obj_server`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.facilityname`*:: +*`rsa.internal.obj_val`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.forensic_info`*:: +*`rsa.internal.resource`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.jobname`*:: +*`rsa.internal.obj_id`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.mode`*:: +*`rsa.internal.statement`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.policy`*:: +*`rsa.internal.audit_class`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.policy_waiver`*:: +*`rsa.internal.entry`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.second`*:: +*`rsa.internal.hcode`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.space1`*:: +*`rsa.internal.inode`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.subcategory`*:: +*`rsa.internal.resource_class`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.tbdstr2`*:: +*`rsa.internal.dead`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.alert_id`*:: +*`rsa.internal.feed_desc`*:: + -- -Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.checksum_dst`*:: +*`rsa.internal.feed_name`*:: + -- -This key is used to capture the checksum or hash of the the target entity such as a process or file. +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.checksum_src`*:: +*`rsa.internal.cid`*:: + -- -This key is used to capture the checksum or hash of the source entity such as a file or process. +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.fresult`*:: +*`rsa.internal.device_class`*:: + -- -This key captures the Filter Result +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: long +type: keyword -- -*`rsa.misc.payload_dst`*:: +*`rsa.internal.device_group`*:: + -- -This key is used to capture destination payload +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.payload_src`*:: +*`rsa.internal.device_host`*:: + -- -This key is used to capture source payload +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.pool_id`*:: +*`rsa.internal.device_ip`*:: + -- -This key captures the identifier (typically numeric field) of a resource pool +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -*`rsa.misc.process_id_val`*:: +*`rsa.internal.device_ipv6`*:: + -- -This key is a failure key for Process ID when it is not an integer value +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip + +-- + +*`rsa.internal.device_type`*:: ++ +-- +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.risk_num_comm`*:: +*`rsa.internal.device_type_id`*:: + -- -This key captures Risk Number Community +Deprecated key defined only in table map. -type: double +type: long -- -*`rsa.misc.risk_num_next`*:: +*`rsa.internal.did`*:: + -- -This key captures Risk Number NextGen +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: double +type: keyword -- -*`rsa.misc.risk_num_sand`*:: +*`rsa.internal.entropy_req`*:: + -- -This key captures Risk Number SandBox +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: double +type: long -- -*`rsa.misc.risk_num_static`*:: +*`rsa.internal.entropy_res`*:: + -- -This key captures Risk Number Static +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: double +type: long -- -*`rsa.misc.risk_suspicious`*:: +*`rsa.internal.event_name`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.risk_warning`*:: +*`rsa.internal.feed_category`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.snmp_oid`*:: +*`rsa.internal.forward_ip`*:: + -- -SNMP Object Identifier +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. -type: keyword +type: ip -- -*`rsa.misc.sql`*:: +*`rsa.internal.forward_ipv6`*:: + -- -This key captures the SQL query +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: keyword +type: ip -- -*`rsa.misc.vuln_ref`*:: +*`rsa.internal.header_id`*:: + -- -This key captures the Vulnerability Reference details +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.acl_id`*:: +*`rsa.internal.lc_cid`*:: + -- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.acl_op`*:: +*`rsa.internal.lc_ctime`*:: + -- -type: keyword +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date -- -*`rsa.misc.acl_pos`*:: +*`rsa.internal.mcb_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.acl_table`*:: +*`rsa.internal.mcb_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.admin`*:: +*`rsa.internal.mcbc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.alarm_id`*:: +*`rsa.internal.mcbc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.alarmname`*:: +*`rsa.internal.medium`*:: + -- -type: keyword +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long -- -*`rsa.misc.app_id`*:: +*`rsa.internal.node_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.audit`*:: +*`rsa.internal.nwe_callback_id`*:: + -- +This key denotes that event is endpoint related + type: keyword -- -*`rsa.misc.audit_object`*:: +*`rsa.internal.parse_error`*:: + -- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.auditdata`*:: +*`rsa.internal.payload_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.benchmark`*:: +*`rsa.internal.payload_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.bypass`*:: +*`rsa.internal.process_vid_dst`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + type: keyword -- -*`rsa.misc.cache`*:: +*`rsa.internal.process_vid_src`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + type: keyword -- -*`rsa.misc.cache_hit`*:: +*`rsa.internal.rid`*:: + -- -type: keyword +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.cefversion`*:: +*`rsa.internal.session_split`*:: + -- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cfg_attr`*:: +*`rsa.internal.site`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cfg_obj`*:: +*`rsa.internal.size`*:: + -- -type: keyword +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.cfg_path`*:: +*`rsa.internal.sourcefile`*:: + -- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.changes`*:: +*`rsa.internal.ubc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.client_ip`*:: +*`rsa.internal.ubc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.clustermembers`*:: +*`rsa.internal.word`*:: + -- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + type: keyword -- -*`rsa.misc.cn_acttimeout`*:: + +*`rsa.time.event_time`*:: + -- -type: keyword +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date -- -*`rsa.misc.cn_asn_src`*:: +*`rsa.time.duration_time`*:: + -- -type: keyword +This key is used to capture the normalized duration/lifetime in seconds. + +type: double -- -*`rsa.misc.cn_bgpv4nxthop`*:: +*`rsa.time.event_time_str`*:: + -- +This key is used to capture the incomplete time mentioned in a session as a string + type: keyword -- -*`rsa.misc.cn_ctr_dst_code`*:: +*`rsa.time.starttime`*:: + -- -type: keyword +This key is used to capture the Start time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cn_dst_tos`*:: +*`rsa.time.month`*:: + -- type: keyword -- -*`rsa.misc.cn_dst_vlan`*:: +*`rsa.time.day`*:: + -- type: keyword -- -*`rsa.misc.cn_engine_id`*:: +*`rsa.time.endtime`*:: + -- -type: keyword +This key is used to capture the End time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cn_engine_type`*:: +*`rsa.time.timezone`*:: + -- +This key is used to capture the timezone of the Event Time + type: keyword -- -*`rsa.misc.cn_f_switch`*:: +*`rsa.time.duration_str`*:: + -- +A text string version of the duration + type: keyword -- -*`rsa.misc.cn_flowsampid`*:: +*`rsa.time.date`*:: + -- type: keyword -- -*`rsa.misc.cn_flowsampintv`*:: +*`rsa.time.year`*:: + -- type: keyword -- -*`rsa.misc.cn_flowsampmode`*:: +*`rsa.time.recorded_time`*:: + -- -type: keyword +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date -- -*`rsa.misc.cn_inacttimeout`*:: +*`rsa.time.datetime`*:: + -- type: keyword -- -*`rsa.misc.cn_inpermbyts`*:: +*`rsa.time.effective_time`*:: + -- -type: keyword +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date -- -*`rsa.misc.cn_inpermpckts`*:: +*`rsa.time.expire_time`*:: + -- -type: keyword +This key is the timestamp that explicitly refers to an expiration. + +type: date -- -*`rsa.misc.cn_invalid`*:: +*`rsa.time.process_time`*:: + -- +Deprecated, use duration.time + type: keyword -- -*`rsa.misc.cn_ip_proto_ver`*:: +*`rsa.time.hour`*:: + -- type: keyword -- -*`rsa.misc.cn_ipv4_ident`*:: +*`rsa.time.min`*:: + -- type: keyword -- -*`rsa.misc.cn_l_switch`*:: +*`rsa.time.timestamp`*:: + -- type: keyword -- -*`rsa.misc.cn_log_did`*:: +*`rsa.time.event_queue_time`*:: + -- -type: keyword +This key is the Time that the event was queued. + +type: date -- -*`rsa.misc.cn_log_rid`*:: +*`rsa.time.p_time1`*:: + -- type: keyword -- -*`rsa.misc.cn_max_ttl`*:: +*`rsa.time.tzone`*:: + -- type: keyword -- -*`rsa.misc.cn_maxpcktlen`*:: +*`rsa.time.eventtime`*:: + -- type: keyword -- -*`rsa.misc.cn_min_ttl`*:: +*`rsa.time.gmtdate`*:: + -- type: keyword -- -*`rsa.misc.cn_minpcktlen`*:: +*`rsa.time.gmttime`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_1`*:: +*`rsa.time.p_date`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_10`*:: +*`rsa.time.p_month`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_2`*:: +*`rsa.time.p_time`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_3`*:: +*`rsa.time.p_time2`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_4`*:: +*`rsa.time.p_year`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_5`*:: +*`rsa.time.expire_time_str`*:: + -- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_6`*:: +*`rsa.time.stamp`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: date -- -*`rsa.misc.cn_mpls_lbl_7`*:: + +*`rsa.misc.action`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_8`*:: +*`rsa.misc.result`*:: + -- +This key is used to capture the outcome/result string value of an action in a session. + type: keyword -- -*`rsa.misc.cn_mpls_lbl_9`*:: +*`rsa.misc.severity`*:: + -- +This key is used to capture the severity given the session + type: keyword -- -*`rsa.misc.cn_mplstoplabel`*:: +*`rsa.misc.event_type`*:: + -- +This key captures the event category type as specified by the event source. + type: keyword -- -*`rsa.misc.cn_mplstoplabip`*:: +*`rsa.misc.reference_id`*:: + -- +This key is used to capture an event id from the session directly + type: keyword -- -*`rsa.misc.cn_mul_dst_byt`*:: +*`rsa.misc.version`*:: + -- +This key captures Version of the application or OS which is generating the event. + type: keyword -- -*`rsa.misc.cn_mul_dst_pks`*:: +*`rsa.misc.disposition`*:: + -- +This key captures the The end state of an action. + type: keyword -- -*`rsa.misc.cn_muligmptype`*:: +*`rsa.misc.result_code`*:: + -- +This key is used to capture the outcome/result numeric value of an action in a session + type: keyword -- -*`rsa.misc.cn_sampalgo`*:: +*`rsa.misc.category`*:: + -- +This key is used to capture the category of an event given by the vendor in the session + type: keyword -- -*`rsa.misc.cn_sampint`*:: +*`rsa.misc.obj_name`*:: + -- +This is used to capture name of object + type: keyword -- -*`rsa.misc.cn_seqctr`*:: +*`rsa.misc.obj_type`*:: + -- +This is used to capture type of object + type: keyword -- -*`rsa.misc.cn_spackets`*:: +*`rsa.misc.event_source`*:: + -- +This key captures Source of the event that’s not a hostname + type: keyword -- -*`rsa.misc.cn_src_tos`*:: +*`rsa.misc.log_session_id`*:: + -- +This key is used to capture a sessionid from the session directly + type: keyword -- -*`rsa.misc.cn_src_vlan`*:: +*`rsa.misc.group`*:: + -- +This key captures the Group Name value + type: keyword -- -*`rsa.misc.cn_sysuptime`*:: +*`rsa.misc.policy_name`*:: + -- +This key is used to capture the Policy Name only. + type: keyword -- -*`rsa.misc.cn_template_id`*:: +*`rsa.misc.rule_name`*:: + -- +This key captures the Rule Name + type: keyword -- -*`rsa.misc.cn_totbytsexp`*:: +*`rsa.misc.context`*:: + -- +This key captures Information which adds additional context to the event. + type: keyword -- -*`rsa.misc.cn_totflowexp`*:: +*`rsa.misc.change_new`*:: + -- +This key is used to capture the new values of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.cn_totpcktsexp`*:: +*`rsa.misc.space`*:: + -- type: keyword -- -*`rsa.misc.cn_unixnanosecs`*:: +*`rsa.misc.client`*:: + -- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + type: keyword -- -*`rsa.misc.cn_v6flowlabel`*:: +*`rsa.misc.msgIdPart1`*:: + -- type: keyword -- -*`rsa.misc.cn_v6optheaders`*:: +*`rsa.misc.msgIdPart2`*:: + -- type: keyword -- -*`rsa.misc.comp_class`*:: +*`rsa.misc.change_old`*:: + -- +This key is used to capture the old value of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.comp_name`*:: +*`rsa.misc.operation_id`*:: + -- +An alert number or operation number. The values should be unique and non-repeating. + type: keyword -- -*`rsa.misc.comp_rbytes`*:: +*`rsa.misc.event_state`*:: + -- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + type: keyword -- -*`rsa.misc.comp_sbytes`*:: +*`rsa.misc.group_object`*:: + -- +This key captures a collection/grouping of entities. Specific usage + type: keyword -- -*`rsa.misc.cpu_data`*:: +*`rsa.misc.node`*:: + -- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + type: keyword -- -*`rsa.misc.criticality`*:: +*`rsa.misc.rule`*:: + -- +This key captures the Rule number + type: keyword -- -*`rsa.misc.cs_agency_dst`*:: +*`rsa.misc.device_name`*:: + -- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + type: keyword -- -*`rsa.misc.cs_analyzedby`*:: +*`rsa.misc.param`*:: + -- +This key is the parameters passed as part of a command or application, etc. + type: keyword -- -*`rsa.misc.cs_av_other`*:: +*`rsa.misc.change_attrib`*:: + -- +This key is used to capture the name of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.cs_av_primary`*:: +*`rsa.misc.event_computer`*:: + -- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + type: keyword -- -*`rsa.misc.cs_av_secondary`*:: +*`rsa.misc.reference_id1`*:: + -- +This key is for Linked ID to be used as an addition to "reference.id" + type: keyword -- -*`rsa.misc.cs_bgpv6nxthop`*:: +*`rsa.misc.event_log`*:: + -- +This key captures the Name of the event log + type: keyword -- -*`rsa.misc.cs_bit9status`*:: +*`rsa.misc.OS`*:: + -- +This key captures the Name of the Operating System + type: keyword -- -*`rsa.misc.cs_context`*:: +*`rsa.misc.terminal`*:: + -- +This key captures the Terminal Names only + type: keyword -- -*`rsa.misc.cs_control`*:: +*`rsa.misc.msgIdPart3`*:: + -- type: keyword -- -*`rsa.misc.cs_data`*:: +*`rsa.misc.filter`*:: + -- +This key captures Filter used to reduce result set + type: keyword -- -*`rsa.misc.cs_datecret`*:: +*`rsa.misc.serial_number`*:: + -- +This key is the Serial number associated with a physical asset. + type: keyword -- -*`rsa.misc.cs_dst_tld`*:: +*`rsa.misc.checksum`*:: + -- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + type: keyword -- -*`rsa.misc.cs_eth_dst_ven`*:: +*`rsa.misc.event_user`*:: + -- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + type: keyword -- -*`rsa.misc.cs_eth_src_ven`*:: +*`rsa.misc.virusname`*:: + -- +This key captures the name of the virus + type: keyword -- -*`rsa.misc.cs_event_uuid`*:: +*`rsa.misc.content_type`*:: + -- +This key is used to capture Content Type only. + type: keyword -- -*`rsa.misc.cs_filetype`*:: +*`rsa.misc.group_id`*:: + -- +This key captures Group ID Number (related to the group name) + type: keyword -- -*`rsa.misc.cs_fld`*:: +*`rsa.misc.policy_id`*:: + -- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + type: keyword -- -*`rsa.misc.cs_if_desc`*:: +*`rsa.misc.vsys`*:: + -- +This key captures Virtual System Name + type: keyword -- -*`rsa.misc.cs_if_name`*:: +*`rsa.misc.connection_id`*:: + -- +This key captures the Connection ID + type: keyword -- -*`rsa.misc.cs_ip_next_hop`*:: +*`rsa.misc.reference_id2`*:: + -- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + type: keyword -- -*`rsa.misc.cs_ipv4dstpre`*:: +*`rsa.misc.sensor`*:: + -- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + type: keyword -- -*`rsa.misc.cs_ipv4srcpre`*:: +*`rsa.misc.sig_id`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID + +type: long -- -*`rsa.misc.cs_lifetime`*:: +*`rsa.misc.port_name`*:: + -- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + type: keyword -- -*`rsa.misc.cs_log_medium`*:: +*`rsa.misc.rule_group`*:: + -- +This key captures the Rule group name + type: keyword -- -*`rsa.misc.cs_loginname`*:: +*`rsa.misc.risk_num`*:: + -- -type: keyword +This key captures a Numeric Risk value + +type: double -- -*`rsa.misc.cs_modulescore`*:: +*`rsa.misc.trigger_val`*:: + -- +This key captures the Value of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.cs_modulesign`*:: +*`rsa.misc.log_session_id1`*:: + -- +This key is used to capture a Linked (Related) Session ID from the session directly + type: keyword -- -*`rsa.misc.cs_opswatresult`*:: +*`rsa.misc.comp_version`*:: + -- +This key captures the Version level of a sub-component of a product. + type: keyword -- -*`rsa.misc.cs_payload`*:: +*`rsa.misc.content_version`*:: + -- +This key captures Version level of a signature or database content. + type: keyword -- -*`rsa.misc.cs_registrant`*:: +*`rsa.misc.hardware_id`*:: + -- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + type: keyword -- -*`rsa.misc.cs_registrar`*:: +*`rsa.misc.risk`*:: + -- +This key captures the non-numeric risk value + type: keyword -- -*`rsa.misc.cs_represult`*:: +*`rsa.misc.event_id`*:: + -- type: keyword -- -*`rsa.misc.cs_rpayload`*:: +*`rsa.misc.reason`*:: + -- type: keyword -- -*`rsa.misc.cs_sampler_name`*:: +*`rsa.misc.status`*:: + -- type: keyword -- -*`rsa.misc.cs_sourcemodule`*:: +*`rsa.misc.mail_id`*:: + -- +This key is used to capture the mailbox id/name + type: keyword -- -*`rsa.misc.cs_streams`*:: +*`rsa.misc.rule_uid`*:: + -- +This key is the Unique Identifier for a rule. + type: keyword -- -*`rsa.misc.cs_targetmodule`*:: +*`rsa.misc.trigger_desc`*:: + -- +This key captures the Description of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.cs_v6nxthop`*:: +*`rsa.misc.inout`*:: + -- type: keyword -- -*`rsa.misc.cs_whois_server`*:: +*`rsa.misc.p_msgid`*:: + -- type: keyword -- -*`rsa.misc.cs_yararesult`*:: +*`rsa.misc.data_type`*:: + -- type: keyword -- -*`rsa.misc.description`*:: +*`rsa.misc.msgIdPart4`*:: + -- type: keyword -- -*`rsa.misc.devvendor`*:: +*`rsa.misc.error`*:: + -- +This key captures All non successful Error codes or responses + type: keyword -- -*`rsa.misc.distance`*:: +*`rsa.misc.index`*:: + -- type: keyword -- -*`rsa.misc.dstburb`*:: +*`rsa.misc.listnum`*:: + -- +This key is used to capture listname or listnumber, primarily for collecting access-list + type: keyword -- -*`rsa.misc.edomain`*:: +*`rsa.misc.ntype`*:: + -- type: keyword -- -*`rsa.misc.edomaub`*:: +*`rsa.misc.observed_val`*:: + -- +This key captures the Value observed (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.euid`*:: +*`rsa.misc.policy_value`*:: + -- +This key captures the contents of the policy. This contains details about the policy + type: keyword -- -*`rsa.misc.facility`*:: +*`rsa.misc.pool_name`*:: + -- +This key captures the name of a resource pool + type: keyword -- -*`rsa.misc.finterface`*:: +*`rsa.misc.rule_template`*:: + -- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + type: keyword -- -*`rsa.misc.flags`*:: +*`rsa.misc.count`*:: + -- type: keyword -- -*`rsa.misc.gaddr`*:: +*`rsa.misc.number`*:: + -- type: keyword -- -*`rsa.misc.id3`*:: +*`rsa.misc.sigcat`*:: + -- type: keyword -- -*`rsa.misc.im_buddyname`*:: +*`rsa.misc.type`*:: + -- type: keyword -- -*`rsa.misc.im_croomid`*:: +*`rsa.misc.comments`*:: + -- +Comment information provided in the log message + type: keyword -- -*`rsa.misc.im_croomtype`*:: +*`rsa.misc.doc_number`*:: + -- -type: keyword +This key captures File Identification number + +type: long -- -*`rsa.misc.im_members`*:: +*`rsa.misc.expected_val`*:: + -- +This key captures the Value expected (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.im_username`*:: +*`rsa.misc.job_num`*:: + -- +This key captures the Job Number + type: keyword -- -*`rsa.misc.ipkt`*:: +*`rsa.misc.spi_dst`*:: + -- +Destination SPI Index + type: keyword -- -*`rsa.misc.ipscat`*:: +*`rsa.misc.spi_src`*:: + -- +Source SPI Index + type: keyword -- -*`rsa.misc.ipspri`*:: +*`rsa.misc.code`*:: + -- type: keyword -- -*`rsa.misc.latitude`*:: +*`rsa.misc.agent_id`*:: + -- +This key is used to capture agent id + type: keyword -- -*`rsa.misc.linenum`*:: +*`rsa.misc.message_body`*:: + -- +This key captures the The contents of the message body. + type: keyword -- -*`rsa.misc.list_name`*:: +*`rsa.misc.phone`*:: + -- type: keyword -- -*`rsa.misc.load_data`*:: +*`rsa.misc.sig_id_str`*:: + -- +This key captures a string object of the sigid variable. + type: keyword -- -*`rsa.misc.location_floor`*:: +*`rsa.misc.cmd`*:: + -- type: keyword -- -*`rsa.misc.location_mark`*:: +*`rsa.misc.misc`*:: + -- type: keyword -- -*`rsa.misc.log_id`*:: +*`rsa.misc.name`*:: + -- type: keyword -- -*`rsa.misc.log_type`*:: +*`rsa.misc.cpu`*:: + -- -type: keyword +This key is the CPU time used in the execution of the event being recorded. + +type: long -- -*`rsa.misc.logid`*:: +*`rsa.misc.event_desc`*:: + -- +This key is used to capture a description of an event available directly or inferred + type: keyword -- -*`rsa.misc.logip`*:: +*`rsa.misc.sig_id1`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long -- -*`rsa.misc.logname`*:: +*`rsa.misc.im_buddyid`*:: + -- type: keyword -- -*`rsa.misc.longitude`*:: +*`rsa.misc.im_client`*:: + -- type: keyword -- -*`rsa.misc.lport`*:: +*`rsa.misc.im_userid`*:: + -- type: keyword -- -*`rsa.misc.mbug_data`*:: +*`rsa.misc.pid`*:: + -- type: keyword -- -*`rsa.misc.misc_name`*:: +*`rsa.misc.priority`*:: + -- type: keyword -- -*`rsa.misc.msg_type`*:: +*`rsa.misc.context_subject`*:: + -- +This key is to be used in an audit context where the subject is the object being identified + type: keyword -- -*`rsa.misc.msgid`*:: +*`rsa.misc.context_target`*:: + -- type: keyword -- -*`rsa.misc.netsessid`*:: +*`rsa.misc.cve`*:: + -- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + type: keyword -- -*`rsa.misc.num`*:: +*`rsa.misc.fcatnum`*:: + -- +This key captures Filter Category Number. Legacy Usage + type: keyword -- -*`rsa.misc.number1`*:: +*`rsa.misc.library`*:: + -- +This key is used to capture library information in mainframe devices + type: keyword -- -*`rsa.misc.number2`*:: +*`rsa.misc.parent_node`*:: + -- +This key captures the Parent Node Name. Must be related to node variable. + type: keyword -- -*`rsa.misc.nwwn`*:: +*`rsa.misc.risk_info`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.object`*:: +*`rsa.misc.tcp_flags`*:: + -- -type: keyword +This key is captures the TCP flags set in any packet of session + +type: long -- -*`rsa.misc.operation`*:: +*`rsa.misc.tos`*:: + -- -type: keyword +This key describes the type of service + +type: long -- -*`rsa.misc.opkt`*:: +*`rsa.misc.vm_target`*:: + -- +VMWare Target **VMWARE** only varaible. + type: keyword -- -*`rsa.misc.orig_from`*:: +*`rsa.misc.workspace`*:: + -- +This key captures Workspace Description + type: keyword -- -*`rsa.misc.owner_id`*:: +*`rsa.misc.command`*:: + -- type: keyword -- -*`rsa.misc.p_action`*:: +*`rsa.misc.event_category`*:: + -- type: keyword -- -*`rsa.misc.p_filter`*:: +*`rsa.misc.facilityname`*:: + -- type: keyword -- -*`rsa.misc.p_group_object`*:: +*`rsa.misc.forensic_info`*:: + -- type: keyword -- -*`rsa.misc.p_id`*:: +*`rsa.misc.jobname`*:: + -- type: keyword -- -*`rsa.misc.p_msgid1`*:: +*`rsa.misc.mode`*:: + -- type: keyword -- -*`rsa.misc.p_msgid2`*:: +*`rsa.misc.policy`*:: + -- type: keyword -- -*`rsa.misc.p_result1`*:: +*`rsa.misc.policy_waiver`*:: + -- type: keyword -- -*`rsa.misc.password_chg`*:: +*`rsa.misc.second`*:: + -- type: keyword -- -*`rsa.misc.password_expire`*:: +*`rsa.misc.space1`*:: + -- type: keyword -- -*`rsa.misc.permgranted`*:: +*`rsa.misc.subcategory`*:: + -- type: keyword -- -*`rsa.misc.permwanted`*:: +*`rsa.misc.tbdstr2`*:: + -- type: keyword -- -*`rsa.misc.pgid`*:: +*`rsa.misc.alert_id`*:: + -- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.policyUUID`*:: +*`rsa.misc.checksum_dst`*:: + -- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + type: keyword -- -*`rsa.misc.prog_asp_num`*:: +*`rsa.misc.checksum_src`*:: + -- +This key is used to capture the checksum or hash of the source entity such as a file or process. + type: keyword -- -*`rsa.misc.program`*:: +*`rsa.misc.fresult`*:: + -- -type: keyword +This key captures the Filter Result + +type: long -- -*`rsa.misc.real_data`*:: +*`rsa.misc.payload_dst`*:: + -- +This key is used to capture destination payload + type: keyword -- -*`rsa.misc.rec_asp_device`*:: +*`rsa.misc.payload_src`*:: + -- +This key is used to capture source payload + type: keyword -- -*`rsa.misc.rec_asp_num`*:: +*`rsa.misc.pool_id`*:: + -- +This key captures the identifier (typically numeric field) of a resource pool + type: keyword -- -*`rsa.misc.rec_library`*:: +*`rsa.misc.process_id_val`*:: + -- +This key is a failure key for Process ID when it is not an integer value + type: keyword -- -*`rsa.misc.recordnum`*:: +*`rsa.misc.risk_num_comm`*:: + -- -type: keyword +This key captures Risk Number Community + +type: double -- -*`rsa.misc.ruid`*:: +*`rsa.misc.risk_num_next`*:: + -- -type: keyword +This key captures Risk Number NextGen + +type: double -- -*`rsa.misc.sburb`*:: +*`rsa.misc.risk_num_sand`*:: + -- -type: keyword +This key captures Risk Number SandBox + +type: double -- -*`rsa.misc.sdomain_fld`*:: +*`rsa.misc.risk_num_static`*:: + -- -type: keyword +This key captures Risk Number Static + +type: double -- -*`rsa.misc.sec`*:: +*`rsa.misc.risk_suspicious`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.sensorname`*:: +*`rsa.misc.risk_warning`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.seqnum`*:: +*`rsa.misc.snmp_oid`*:: + -- +SNMP Object Identifier + type: keyword -- -*`rsa.misc.session`*:: +*`rsa.misc.sql`*:: + -- +This key captures the SQL query + type: keyword -- -*`rsa.misc.sessiontype`*:: +*`rsa.misc.vuln_ref`*:: + -- +This key captures the Vulnerability Reference details + type: keyword -- -*`rsa.misc.sigUUID`*:: +*`rsa.misc.acl_id`*:: + -- type: keyword -- -*`rsa.misc.spi`*:: +*`rsa.misc.acl_op`*:: + -- type: keyword -- -*`rsa.misc.srcburb`*:: +*`rsa.misc.acl_pos`*:: + -- type: keyword -- -*`rsa.misc.srcdom`*:: +*`rsa.misc.acl_table`*:: + -- type: keyword -- -*`rsa.misc.srcservice`*:: +*`rsa.misc.admin`*:: + -- type: keyword -- -*`rsa.misc.state`*:: +*`rsa.misc.alarm_id`*:: + -- type: keyword -- -*`rsa.misc.status1`*:: +*`rsa.misc.alarmname`*:: + -- type: keyword -- -*`rsa.misc.svcno`*:: +*`rsa.misc.app_id`*:: + -- type: keyword -- -*`rsa.misc.system`*:: +*`rsa.misc.audit`*:: + -- type: keyword -- -*`rsa.misc.tbdstr1`*:: +*`rsa.misc.audit_object`*:: + -- type: keyword -- -*`rsa.misc.tgtdom`*:: +*`rsa.misc.auditdata`*:: + -- type: keyword -- -*`rsa.misc.tgtdomain`*:: +*`rsa.misc.benchmark`*:: + -- type: keyword -- -*`rsa.misc.threshold`*:: +*`rsa.misc.bypass`*:: + -- type: keyword -- -*`rsa.misc.type1`*:: +*`rsa.misc.cache`*:: + -- type: keyword -- -*`rsa.misc.udb_class`*:: +*`rsa.misc.cache_hit`*:: + -- type: keyword -- -*`rsa.misc.url_fld`*:: +*`rsa.misc.cefversion`*:: + -- type: keyword -- -*`rsa.misc.user_div`*:: +*`rsa.misc.cfg_attr`*:: + -- type: keyword -- -*`rsa.misc.userid`*:: +*`rsa.misc.cfg_obj`*:: + -- type: keyword -- -*`rsa.misc.username_fld`*:: +*`rsa.misc.cfg_path`*:: + -- type: keyword -- -*`rsa.misc.utcstamp`*:: +*`rsa.misc.changes`*:: + -- type: keyword -- -*`rsa.misc.v_instafname`*:: +*`rsa.misc.client_ip`*:: + -- type: keyword -- -*`rsa.misc.virt_data`*:: +*`rsa.misc.clustermembers`*:: + -- type: keyword -- -*`rsa.misc.vpnid`*:: +*`rsa.misc.cn_acttimeout`*:: + -- type: keyword -- -*`rsa.misc.autorun_type`*:: +*`rsa.misc.cn_asn_src`*:: + -- -This is used to capture Auto Run type - type: keyword -- -*`rsa.misc.cc_number`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- -Valid Credit Card Numbers only - -type: long +type: keyword -- -*`rsa.misc.content`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -This key captures the content type from protocol headers - type: keyword -- -*`rsa.misc.ein_number`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -Employee Identification Numbers only - -type: long +type: keyword -- -*`rsa.misc.found`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -This is used to capture the results of regex match - type: keyword -- -*`rsa.misc.language`*:: +*`rsa.misc.cn_engine_id`*:: + -- -This is used to capture list of languages the client support and what it prefers - type: keyword -- -*`rsa.misc.lifetime`*:: +*`rsa.misc.cn_engine_type`*:: + -- -This key is used to capture the session lifetime in seconds. - -type: long +type: keyword -- -*`rsa.misc.link`*:: +*`rsa.misc.cn_f_switch`*:: + -- -This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.misc.match`*:: +*`rsa.misc.cn_flowsampid`*:: + -- -This key is for regex match name from search.ini - type: keyword -- -*`rsa.misc.param_dst`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- -This key captures the command line/launch argument of the target process or file - type: keyword -- -*`rsa.misc.param_src`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- -This key captures source parameter - type: keyword -- -*`rsa.misc.search_text`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- -This key captures the Search Text used - type: keyword -- -*`rsa.misc.sig_name`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- -This key is used to capture the Signature Name only. - type: keyword -- -*`rsa.misc.snmp_value`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -SNMP set request value - type: keyword -- -*`rsa.misc.streams`*:: +*`rsa.misc.cn_invalid`*:: + -- -This key captures number of streams in session - -type: long +type: keyword -- - -*`rsa.db.index`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -This key captures IndexID of the index. - type: keyword -- -*`rsa.db.instance`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -This key is used to capture the database server instance name - type: keyword -- -*`rsa.db.database`*:: +*`rsa.misc.cn_l_switch`*:: + -- -This key is used to capture the name of a database or an instance as seen in a session - type: keyword -- -*`rsa.db.transact_id`*:: +*`rsa.misc.cn_log_did`*:: + -- -This key captures the SQL transantion ID of the current session - type: keyword -- -*`rsa.db.permissions`*:: +*`rsa.misc.cn_log_rid`*:: + -- -This key captures permission or privilege level assigned to a resource. - type: keyword -- -*`rsa.db.table_name`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -This key is used to capture the table name - type: keyword -- -*`rsa.db.db_id`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -This key is used to capture the unique identifier for a database - type: keyword -- -*`rsa.db.db_pid`*:: +*`rsa.misc.cn_min_ttl`*:: + -- -This key captures the process id of a connection with database server - -type: long +type: keyword -- -*`rsa.db.lread`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- -This key is used for the number of logical reads - -type: long +type: keyword -- -*`rsa.db.lwrite`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- -This key is used for the number of logical writes - -type: long +type: keyword -- -*`rsa.db.pread`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -This key is used for the number of physical writes - -type: long +type: keyword -- - -*`rsa.network.alias_host`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - type: keyword -- -*`rsa.network.domain`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- type: keyword -- -*`rsa.network.host_dst`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -This key should only be used when it’s a Destination Hostname - type: keyword -- -*`rsa.network.network_service`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -This is used to capture layer 7 protocols/service names - type: keyword -- -*`rsa.network.interface`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -This key should be used when the source or destination context of an interface is not clear - type: keyword -- -*`rsa.network.network_port`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- -Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) - -type: long +type: keyword -- -*`rsa.network.eth_host`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -Deprecated, use alias.mac - type: keyword -- -*`rsa.network.sinterface`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- -This key should only be used when it’s a Source Interface - type: keyword -- -*`rsa.network.dinterface`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -This key should only be used when it’s a Destination Interface - type: keyword -- -*`rsa.network.vlan`*:: +*`rsa.misc.cn_mplstoplabip`*:: + -- -This key should only be used to capture the ID of the Virtual LAN - -type: long +type: keyword -- -*`rsa.network.zone_src`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -This key should only be used when it’s a Source Zone. - type: keyword -- -*`rsa.network.zone`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -This key should be used when the source or destination context of a Zone is not clear - type: keyword -- -*`rsa.network.zone_dst`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -This key should only be used when it’s a Destination Zone. - type: keyword -- -*`rsa.network.gateway`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -This key is used to capture the IP Address of the gateway - type: keyword -- -*`rsa.network.icmp_type`*:: +*`rsa.misc.cn_sampint`*:: + -- -This key is used to capture the ICMP type only - -type: long +type: keyword -- -*`rsa.network.mask`*:: +*`rsa.misc.cn_seqctr`*:: + -- -This key is used to capture the device network IPmask. - type: keyword -- -*`rsa.network.icmp_code`*:: +*`rsa.misc.cn_spackets`*:: + -- -This key is used to capture the ICMP code only - -type: long +type: keyword -- -*`rsa.network.protocol_detail`*:: +*`rsa.misc.cn_src_tos`*:: + -- -This key should be used to capture additional protocol information - type: keyword -- -*`rsa.network.dmask`*:: +*`rsa.misc.cn_src_vlan`*:: + -- -This key is used for Destionation Device network mask - type: keyword -- -*`rsa.network.port`*:: +*`rsa.misc.cn_sysuptime`*:: + -- -This key should only be used to capture a Network Port when the directionality is not clear - -type: long +type: keyword -- -*`rsa.network.smask`*:: +*`rsa.misc.cn_template_id`*:: + -- -This key is used for capturing source Network Mask - type: keyword -- -*`rsa.network.netname`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- -This key is used to capture the network name associated with an IP range. This is configured by the end user. - type: keyword -- -*`rsa.network.paddr`*:: +*`rsa.misc.cn_totflowexp`*:: + -- -Deprecated - -type: ip +type: keyword -- -*`rsa.network.faddr`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- type: keyword -- -*`rsa.network.lhost`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- type: keyword -- -*`rsa.network.origin`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- type: keyword -- -*`rsa.network.remote_domain_id`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- type: keyword -- -*`rsa.network.addr`*:: +*`rsa.misc.comp_class`*:: + -- type: keyword -- -*`rsa.network.dns_a_record`*:: +*`rsa.misc.comp_name`*:: + -- type: keyword -- -*`rsa.network.dns_ptr_record`*:: +*`rsa.misc.comp_rbytes`*:: + -- type: keyword -- -*`rsa.network.fhost`*:: +*`rsa.misc.comp_sbytes`*:: + -- type: keyword -- -*`rsa.network.fport`*:: +*`rsa.misc.cpu_data`*:: + -- type: keyword -- -*`rsa.network.laddr`*:: +*`rsa.misc.criticality`*:: + -- type: keyword -- -*`rsa.network.linterface`*:: +*`rsa.misc.cs_agency_dst`*:: + -- type: keyword -- -*`rsa.network.phost`*:: +*`rsa.misc.cs_analyzedby`*:: + -- type: keyword -- -*`rsa.network.ad_computer_dst`*:: +*`rsa.misc.cs_av_other`*:: + -- -Deprecated, use host.dst - type: keyword -- -*`rsa.network.eth_type`*:: +*`rsa.misc.cs_av_primary`*:: + -- -This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - -type: long +type: keyword -- -*`rsa.network.ip_proto`*:: +*`rsa.misc.cs_av_secondary`*:: + -- -This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - -type: long +type: keyword -- -*`rsa.network.dns_cname_record`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- type: keyword -- -*`rsa.network.dns_id`*:: +*`rsa.misc.cs_bit9status`*:: + -- type: keyword -- -*`rsa.network.dns_opcode`*:: +*`rsa.misc.cs_context`*:: + -- type: keyword -- -*`rsa.network.dns_resp`*:: +*`rsa.misc.cs_control`*:: + -- type: keyword -- -*`rsa.network.dns_type`*:: +*`rsa.misc.cs_data`*:: + -- type: keyword -- -*`rsa.network.domain1`*:: +*`rsa.misc.cs_datecret`*:: + -- type: keyword -- -*`rsa.network.host_type`*:: +*`rsa.misc.cs_dst_tld`*:: + -- type: keyword -- -*`rsa.network.packet_length`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- type: keyword -- -*`rsa.network.host_orig`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - type: keyword -- -*`rsa.network.rpayload`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -This key is used to capture the total number of payload bytes seen in the retransmitted packets. - type: keyword -- -*`rsa.network.vlan_name`*:: +*`rsa.misc.cs_filetype`*:: + -- -This key should only be used to capture the name of the Virtual LAN - type: keyword -- - -*`rsa.investigations.ec_activity`*:: +*`rsa.misc.cs_fld`*:: + -- -This key captures the particular event activity(Ex:Logoff) - type: keyword -- -*`rsa.investigations.ec_theme`*:: +*`rsa.misc.cs_if_desc`*:: + -- -This key captures the Theme of a particular Event(Ex:Authentication) - type: keyword -- -*`rsa.investigations.ec_subject`*:: +*`rsa.misc.cs_if_name`*:: + -- -This key captures the Subject of a particular Event(Ex:User) - type: keyword -- -*`rsa.investigations.ec_outcome`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -This key captures the outcome of a particular Event(Ex:Success) - type: keyword -- -*`rsa.investigations.event_cat`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- -This key captures the Event category number - -type: long +type: keyword -- -*`rsa.investigations.event_cat_name`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- -This key captures the event category name corresponding to the event cat code - type: keyword -- -*`rsa.investigations.event_vcat`*:: +*`rsa.misc.cs_lifetime`*:: + -- -This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - type: keyword -- -*`rsa.investigations.analysis_file`*:: +*`rsa.misc.cs_log_medium`*:: + -- -This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - type: keyword -- -*`rsa.investigations.analysis_service`*:: +*`rsa.misc.cs_loginname`*:: + -- -This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - type: keyword -- -*`rsa.investigations.analysis_session`*:: +*`rsa.misc.cs_modulescore`*:: + -- -This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - type: keyword -- -*`rsa.investigations.boc`*:: +*`rsa.misc.cs_modulesign`*:: + -- -This is used to capture behaviour of compromise - type: keyword -- -*`rsa.investigations.eoc`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -This is used to capture Enablers of Compromise - type: keyword -- -*`rsa.investigations.inv_category`*:: +*`rsa.misc.cs_payload`*:: + -- -This used to capture investigation category - type: keyword -- -*`rsa.investigations.inv_context`*:: +*`rsa.misc.cs_registrant`*:: + -- -This used to capture investigation context - type: keyword -- -*`rsa.investigations.ioc`*:: +*`rsa.misc.cs_registrar`*:: + -- -This is key capture indicator of compromise - type: keyword -- - -*`rsa.counters.dclass_c1`*:: +*`rsa.misc.cs_represult`*:: + -- -This is a generic counter key that should be used with the label dclass.c1.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c2`*:: +*`rsa.misc.cs_rpayload`*:: + -- -This is a generic counter key that should be used with the label dclass.c2.str only - -type: long +type: keyword -- -*`rsa.counters.event_counter`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -This is used to capture the number of times an event repeated - -type: long +type: keyword -- -*`rsa.counters.dclass_r1`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -This is a generic ratio key that should be used with the label dclass.r1.str only - type: keyword -- -*`rsa.counters.dclass_c3`*:: +*`rsa.misc.cs_streams`*:: + -- -This is a generic counter key that should be used with the label dclass.c3.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c1_str`*:: +*`rsa.misc.cs_targetmodule`*:: + -- -This is a generic counter string key that should be used with the label dclass.c1 only - type: keyword -- -*`rsa.counters.dclass_c2_str`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -This is a generic counter string key that should be used with the label dclass.c2 only - type: keyword -- -*`rsa.counters.dclass_r1_str`*:: +*`rsa.misc.cs_whois_server`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r1 only - type: keyword -- -*`rsa.counters.dclass_r2`*:: +*`rsa.misc.cs_yararesult`*:: + -- -This is a generic ratio key that should be used with the label dclass.r2.str only - type: keyword -- -*`rsa.counters.dclass_c3_str`*:: +*`rsa.misc.description`*:: + -- -This is a generic counter string key that should be used with the label dclass.c3 only - type: keyword -- -*`rsa.counters.dclass_r3`*:: +*`rsa.misc.devvendor`*:: + -- -This is a generic ratio key that should be used with the label dclass.r3.str only - type: keyword -- -*`rsa.counters.dclass_r2_str`*:: +*`rsa.misc.distance`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r2 only - type: keyword -- -*`rsa.counters.dclass_r3_str`*:: +*`rsa.misc.dstburb`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r3 only - type: keyword -- - -*`rsa.identity.auth_method`*:: +*`rsa.misc.edomain`*:: + -- -This key is used to capture authentication methods used only - type: keyword -- -*`rsa.identity.user_role`*:: +*`rsa.misc.edomaub`*:: + -- -This key is used to capture the Role of a user only - type: keyword -- -*`rsa.identity.dn`*:: +*`rsa.misc.euid`*:: + -- -X.500 (LDAP) Distinguished Name - type: keyword -- -*`rsa.identity.logon_type`*:: +*`rsa.misc.facility`*:: + -- -This key is used to capture the type of logon method used. - type: keyword -- -*`rsa.identity.profile`*:: +*`rsa.misc.finterface`*:: + -- -This key is used to capture the user profile - type: keyword -- -*`rsa.identity.accesses`*:: +*`rsa.misc.flags`*:: + -- -This key is used to capture actual privileges used in accessing an object - type: keyword -- -*`rsa.identity.realm`*:: +*`rsa.misc.gaddr`*:: + -- -Radius realm or similar grouping of accounts - type: keyword -- -*`rsa.identity.user_sid_dst`*:: +*`rsa.misc.id3`*:: + -- -This key captures Destination User Session ID - type: keyword -- -*`rsa.identity.dn_src`*:: +*`rsa.misc.im_buddyname`*:: + -- -An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - type: keyword -- -*`rsa.identity.org`*:: +*`rsa.misc.im_croomid`*:: + -- -This key captures the User organization - type: keyword -- -*`rsa.identity.dn_dst`*:: +*`rsa.misc.im_croomtype`*:: + -- -An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - type: keyword -- -*`rsa.identity.firstname`*:: +*`rsa.misc.im_members`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.lastname`*:: +*`rsa.misc.im_username`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.user_dept`*:: +*`rsa.misc.ipkt`*:: + -- -User's Department Names only - type: keyword -- -*`rsa.identity.user_sid_src`*:: +*`rsa.misc.ipscat`*:: + -- -This key captures Source User Session ID - type: keyword -- -*`rsa.identity.federated_sp`*:: +*`rsa.misc.ipspri`*:: + -- -This key is the Federated Service Provider. This is the application requesting authentication. - type: keyword -- -*`rsa.identity.federated_idp`*:: +*`rsa.misc.latitude`*:: + -- -This key is the federated Identity Provider. This is the server providing the authentication. - type: keyword -- -*`rsa.identity.logon_type_desc`*:: +*`rsa.misc.linenum`*:: + -- -This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - type: keyword -- -*`rsa.identity.middlename`*:: +*`rsa.misc.list_name`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.password`*:: +*`rsa.misc.load_data`*:: + -- -This key is for Passwords seen in any session, plain text or encrypted - type: keyword -- -*`rsa.identity.host_role`*:: +*`rsa.misc.location_floor`*:: + -- -This key should only be used to capture the role of a Host Machine - type: keyword -- -*`rsa.identity.ldap`*:: +*`rsa.misc.location_mark`*:: + -- -This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context - type: keyword -- -*`rsa.identity.ldap_query`*:: +*`rsa.misc.log_id`*:: + -- -This key is the Search criteria from an LDAP search - type: keyword -- -*`rsa.identity.ldap_response`*:: +*`rsa.misc.log_type`*:: + -- -This key is to capture Results from an LDAP search - type: keyword -- -*`rsa.identity.owner`*:: +*`rsa.misc.logid`*:: + -- -This is used to capture username the process or service is running as, the author of the task - type: keyword -- -*`rsa.identity.service_account`*:: +*`rsa.misc.logip`*:: + -- -This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - type: keyword -- - -*`rsa.email.email_dst`*:: +*`rsa.misc.logname`*:: + -- -This key is used to capture the Destination email address only, when the destination context is not clear use email - type: keyword -- -*`rsa.email.email_src`*:: +*`rsa.misc.longitude`*:: + -- -This key is used to capture the source email address only, when the source context is not clear use email - type: keyword -- -*`rsa.email.subject`*:: +*`rsa.misc.lport`*:: + -- -This key is used to capture the subject string from an Email only. - type: keyword -- -*`rsa.email.email`*:: +*`rsa.misc.mbug_data`*:: + -- -This key is used to capture a generic email address where the source or destination context is not clear - type: keyword -- -*`rsa.email.trans_from`*:: +*`rsa.misc.misc_name`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.email.trans_to`*:: +*`rsa.misc.msg_type`*:: + -- -Deprecated key defined only in table map. - type: keyword -- - -*`rsa.file.privilege`*:: +*`rsa.misc.msgid`*:: + -- -Deprecated, use permissions - type: keyword -- -*`rsa.file.attachment`*:: +*`rsa.misc.netsessid`*:: + -- -This key captures the attachment file name - type: keyword -- -*`rsa.file.filesystem`*:: +*`rsa.misc.num`*:: + -- type: keyword -- -*`rsa.file.binary`*:: +*`rsa.misc.number1`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.file.filename_dst`*:: +*`rsa.misc.number2`*:: + -- -This is used to capture name of the file targeted by the action - type: keyword -- -*`rsa.file.filename_src`*:: +*`rsa.misc.nwwn`*:: + -- -This is used to capture name of the parent filename, the file which performed the action - type: keyword -- -*`rsa.file.filename_tmp`*:: +*`rsa.misc.object`*:: + -- type: keyword -- -*`rsa.file.directory_dst`*:: +*`rsa.misc.operation`*:: + -- -This key is used to capture the directory of the target process or file - type: keyword -- -*`rsa.file.directory_src`*:: +*`rsa.misc.opkt`*:: + -- -This key is used to capture the directory of the source process or file - type: keyword -- -*`rsa.file.file_entropy`*:: +*`rsa.misc.orig_from`*:: + -- -This is used to capture entropy vale of a file - -type: double +type: keyword -- -*`rsa.file.file_vendor`*:: +*`rsa.misc.owner_id`*:: + -- -This is used to capture Company name of file located in version_info - type: keyword -- -*`rsa.file.task_name`*:: +*`rsa.misc.p_action`*:: + -- -This is used to capture name of the task - type: keyword -- - -*`rsa.web.fqdn`*:: +*`rsa.misc.p_filter`*:: + -- -Fully Qualified Domain Names - type: keyword -- -*`rsa.web.web_cookie`*:: +*`rsa.misc.p_group_object`*:: + -- -This key is used to capture the Web cookies specifically. - type: keyword -- -*`rsa.web.alias_host`*:: +*`rsa.misc.p_id`*:: + -- type: keyword -- -*`rsa.web.reputation_num`*:: +*`rsa.misc.p_msgid1`*:: + -- -Reputation Number of an entity. Typically used for Web Domains - -type: double +type: keyword -- -*`rsa.web.web_ref_domain`*:: +*`rsa.misc.p_msgid2`*:: + -- -Web referer's domain - type: keyword -- -*`rsa.web.web_ref_query`*:: +*`rsa.misc.p_result1`*:: + -- -This key captures Web referer's query portion of the URL - type: keyword -- -*`rsa.web.remote_domain`*:: +*`rsa.misc.password_chg`*:: + -- type: keyword -- -*`rsa.web.web_ref_page`*:: +*`rsa.misc.password_expire`*:: + -- -This key captures Web referer's page information - type: keyword -- -*`rsa.web.web_ref_root`*:: +*`rsa.misc.permgranted`*:: + -- -Web referer's root URL path - type: keyword -- -*`rsa.web.cn_asn_dst`*:: +*`rsa.misc.permwanted`*:: + -- type: keyword -- -*`rsa.web.cn_rpackets`*:: +*`rsa.misc.pgid`*:: + -- type: keyword -- -*`rsa.web.urlpage`*:: +*`rsa.misc.policyUUID`*:: + -- type: keyword -- -*`rsa.web.urlroot`*:: +*`rsa.misc.prog_asp_num`*:: + -- type: keyword -- -*`rsa.web.p_url`*:: +*`rsa.misc.program`*:: + -- type: keyword -- -*`rsa.web.p_user_agent`*:: +*`rsa.misc.real_data`*:: + -- type: keyword -- -*`rsa.web.p_web_cookie`*:: +*`rsa.misc.rec_asp_device`*:: + -- type: keyword -- -*`rsa.web.p_web_method`*:: +*`rsa.misc.rec_asp_num`*:: + -- type: keyword -- -*`rsa.web.p_web_referer`*:: +*`rsa.misc.rec_library`*:: + -- type: keyword -- -*`rsa.web.web_extension_tmp`*:: +*`rsa.misc.recordnum`*:: + -- type: keyword -- -*`rsa.web.web_page`*:: +*`rsa.misc.ruid`*:: + -- type: keyword -- - -*`rsa.threat.threat_category`*:: +*`rsa.misc.sburb`*:: + -- -This key captures Threat Name/Threat Category/Categorization of alert - type: keyword -- -*`rsa.threat.threat_desc`*:: +*`rsa.misc.sdomain_fld`*:: + -- -This key is used to capture the threat description from the session directly or inferred - type: keyword -- -*`rsa.threat.alert`*:: +*`rsa.misc.sec`*:: + -- -This key is used to capture name of the alert - type: keyword -- -*`rsa.threat.threat_source`*:: +*`rsa.misc.sensorname`*:: + -- -This key is used to capture source of the threat - type: keyword -- - -*`rsa.crypto.crypto`*:: +*`rsa.misc.seqnum`*:: + -- -This key is used to capture the Encryption Type or Encryption Key only - type: keyword -- -*`rsa.crypto.cipher_src`*:: +*`rsa.misc.session`*:: + -- -This key is for Source (Client) Cipher - type: keyword -- -*`rsa.crypto.cert_subject`*:: +*`rsa.misc.sessiontype`*:: + -- -This key is used to capture the Certificate organization only - type: keyword -- -*`rsa.crypto.peer`*:: +*`rsa.misc.sigUUID`*:: + -- -This key is for Encryption peer's IP Address - type: keyword -- -*`rsa.crypto.cipher_size_src`*:: +*`rsa.misc.spi`*:: + -- -This key captures Source (Client) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ike`*:: +*`rsa.misc.srcburb`*:: + -- -IKE negotiation phase. - type: keyword -- -*`rsa.crypto.scheme`*:: +*`rsa.misc.srcdom`*:: + -- -This key captures the Encryption scheme used - type: keyword -- -*`rsa.crypto.peer_id`*:: +*`rsa.misc.srcservice`*:: + -- -This key is for Encryption peer’s identity - type: keyword -- -*`rsa.crypto.sig_type`*:: +*`rsa.misc.state`*:: + -- -This key captures the Signature Type - type: keyword -- -*`rsa.crypto.cert_issuer`*:: +*`rsa.misc.status1`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_name`*:: +*`rsa.misc.svcno`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.crypto.cert_error`*:: +*`rsa.misc.system`*:: + -- -This key captures the Certificate Error String - type: keyword -- -*`rsa.crypto.cipher_dst`*:: +*`rsa.misc.tbdstr1`*:: + -- -This key is for Destination (Server) Cipher - type: keyword -- -*`rsa.crypto.cipher_size_dst`*:: +*`rsa.misc.tgtdom`*:: + -- -This key captures Destination (Server) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ssl_ver_src`*:: +*`rsa.misc.tgtdomain`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.d_certauth`*:: +*`rsa.misc.threshold`*:: + -- type: keyword -- -*`rsa.crypto.s_certauth`*:: +*`rsa.misc.type1`*:: + -- type: keyword -- -*`rsa.crypto.ike_cookie1`*:: +*`rsa.misc.udb_class`*:: + -- -ID of the negotiation — sent for ISAKMP Phase One - type: keyword -- -*`rsa.crypto.ike_cookie2`*:: +*`rsa.misc.url_fld`*:: + -- -ID of the negotiation — sent for ISAKMP Phase Two - type: keyword -- -*`rsa.crypto.cert_checksum`*:: +*`rsa.misc.user_div`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_cat`*:: +*`rsa.misc.userid`*:: + -- -This key is used for the hostname category value of a certificate - type: keyword -- -*`rsa.crypto.cert_serial`*:: +*`rsa.misc.username_fld`*:: + -- -This key is used to capture the Certificate serial number only - type: keyword -- -*`rsa.crypto.cert_status`*:: +*`rsa.misc.utcstamp`*:: + -- -This key captures Certificate validation status - type: keyword -- -*`rsa.crypto.ssl_ver_dst`*:: +*`rsa.misc.v_instafname`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.cert_keysize`*:: +*`rsa.misc.virt_data`*:: + -- type: keyword -- -*`rsa.crypto.cert_username`*:: +*`rsa.misc.vpnid`*:: + -- type: keyword -- -*`rsa.crypto.https_insact`*:: +*`rsa.misc.autorun_type`*:: + -- +This is used to capture Auto Run type + type: keyword -- -*`rsa.crypto.https_valid`*:: +*`rsa.misc.cc_number`*:: + -- -type: keyword +Valid Credit Card Numbers only + +type: long -- -*`rsa.crypto.cert_ca`*:: +*`rsa.misc.content`*:: + -- -This key is used to capture the Certificate signing authority only +This key captures the content type from protocol headers type: keyword -- -*`rsa.crypto.cert_common`*:: +*`rsa.misc.ein_number`*:: + -- -This key is used to capture the Certificate common name only +Employee Identification Numbers only -type: keyword +type: long -- - -*`rsa.wireless.wlan_ssid`*:: +*`rsa.misc.found`*:: + -- -This key is used to capture the ssid of a Wireless Session +This is used to capture the results of regex match type: keyword -- -*`rsa.wireless.access_point`*:: +*`rsa.misc.language`*:: + -- -This key is used to capture the access point name. +This is used to capture list of languages the client support and what it prefers type: keyword -- -*`rsa.wireless.wlan_channel`*:: +*`rsa.misc.lifetime`*:: + -- -This is used to capture the channel names +This key is used to capture the session lifetime in seconds. type: long -- -*`rsa.wireless.wlan_name`*:: +*`rsa.misc.link`*:: + -- -This key captures either WLAN number/name +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- - -*`rsa.storage.disk_volume`*:: +*`rsa.misc.match`*:: + -- -A unique name assigned to logical units (volumes) within a physical disk +This key is for regex match name from search.ini type: keyword -- -*`rsa.storage.lun`*:: +*`rsa.misc.param_dst`*:: + -- -Logical Unit Number.This key is a very useful concept in Storage. +This key captures the command line/launch argument of the target process or file type: keyword -- -*`rsa.storage.pwwn`*:: +*`rsa.misc.param_src`*:: + -- -This uniquely identifies a port on a HBA. +This key captures source parameter type: keyword -- - -*`rsa.physical.org_dst`*:: +*`rsa.misc.search_text`*:: + -- -This is used to capture the destination organization based on the GEOPIP Maxmind database. +This key captures the Search Text used type: keyword -- -*`rsa.physical.org_src`*:: +*`rsa.misc.sig_name`*:: + -- -This is used to capture the source organization based on the GEOPIP Maxmind database. +This key is used to capture the Signature Name only. type: keyword -- - -*`rsa.healthcare.patient_fname`*:: +*`rsa.misc.snmp_value`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +SNMP set request value type: keyword -- -*`rsa.healthcare.patient_id`*:: +*`rsa.misc.streams`*:: + -- -This key captures the unique ID for a patient +This key captures number of streams in session -type: keyword +type: long -- -*`rsa.healthcare.patient_lname`*:: + +*`rsa.db.index`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +This key captures IndexID of the index. type: keyword -- -*`rsa.healthcare.patient_mname`*:: +*`rsa.db.instance`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +This key is used to capture the database server instance name type: keyword -- - -*`rsa.endpoint.host_state`*:: +*`rsa.db.database`*:: + -- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on +This key is used to capture the name of a database or an instance as seen in a session type: keyword -- -*`rsa.endpoint.registry_key`*:: +*`rsa.db.transact_id`*:: + -- -This key captures the path to the registry key +This key captures the SQL transantion ID of the current session type: keyword -- -*`rsa.endpoint.registry_value`*:: +*`rsa.db.permissions`*:: + -- -This key captures values or decorators used within a registry entry +This key captures permission or privilege level assigned to a resource. type: keyword -- -[[exported-fields-sophos]] -== sophos fields - -sophos Module - - +*`rsa.db.table_name`*:: ++ +-- +This key is used to capture the table name -[float] -=== sophos +type: keyword +-- +*`rsa.db.db_id`*:: ++ +-- +This key is used to capture the unique identifier for a database +type: keyword -[float] -=== xg +-- -Module for parsing sophosxg syslog. +*`rsa.db.db_pid`*:: ++ +-- +This key captures the process id of a connection with database server +type: long +-- -*`sophos.xg.device`*:: +*`rsa.db.lread`*:: + -- -device - +This key is used for the number of logical reads -type: keyword +type: long -- -*`sophos.xg.date`*:: +*`rsa.db.lwrite`*:: + -- -Date (yyyy-mm-dd) when the event occurred - +This key is used for the number of logical writes -type: date +type: long -- -*`sophos.xg.timezone`*:: +*`rsa.db.pread`*:: + -- -Time (hh:mm:ss) when the event occurred - +This key is used for the number of physical writes -type: keyword +type: long -- -*`sophos.xg.device_name`*:: + +*`rsa.network.alias_host`*:: + -- -Model number of the device - +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. type: keyword -- -*`sophos.xg.device_id`*:: +*`rsa.network.domain`*:: + -- -Serial number of the device - - type: keyword -- -*`sophos.xg.log_id`*:: +*`rsa.network.host_dst`*:: + -- -Unique 12 characters code (0101011) - +This key should only be used when it’s a Destination Hostname type: keyword -- -*`sophos.xg.log_type`*:: +*`rsa.network.network_service`*:: + -- -Type of event e.g. firewall event - +This is used to capture layer 7 protocols/service names type: keyword -- -*`sophos.xg.log_component`*:: +*`rsa.network.interface`*:: + -- -Component responsible for logging e.g. Firewall rule - +This key should be used when the source or destination context of an interface is not clear type: keyword -- -*`sophos.xg.log_subtype`*:: +*`rsa.network.network_port`*:: + -- -Sub type of event - +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) -type: keyword +type: long -- -*`sophos.xg.hb_health`*:: +*`rsa.network.eth_host`*:: + -- -Heartbeat status - +Deprecated, use alias.mac type: keyword -- -*`sophos.xg.priority`*:: +*`rsa.network.sinterface`*:: + -- -Severity level of traffic - +This key should only be used when it’s a Source Interface type: keyword -- -*`sophos.xg.status`*:: +*`rsa.network.dinterface`*:: + -- -Ultimate status of traffic – Allowed or Denied - +This key should only be used when it’s a Destination Interface type: keyword -- -*`sophos.xg.duration`*:: +*`rsa.network.vlan`*:: + -- -Durability of traffic (seconds) - +This key should only be used to capture the ID of the Virtual LAN type: long -- -*`sophos.xg.fw_rule_id`*:: +*`rsa.network.zone_src`*:: + -- -Firewall Rule ID which is applied on the traffic - +This key should only be used when it’s a Source Zone. -type: integer +type: keyword -- -*`sophos.xg.user_name`*:: +*`rsa.network.zone`*:: + -- -user_name - +This key should be used when the source or destination context of a Zone is not clear type: keyword -- -*`sophos.xg.user_group`*:: +*`rsa.network.zone_dst`*:: + -- -Group name to which the user belongs - +This key should only be used when it’s a Destination Zone. type: keyword -- -*`sophos.xg.iap`*:: +*`rsa.network.gateway`*:: + -- -Internet Access policy ID applied on the traffic - +This key is used to capture the IP Address of the gateway type: keyword -- -*`sophos.xg.ips_policy_id`*:: +*`rsa.network.icmp_type`*:: + -- -IPS policy ID applied on the traffic - +This key is used to capture the ICMP type only -type: integer +type: long -- -*`sophos.xg.policy_type`*:: +*`rsa.network.mask`*:: + -- -Policy type applied to the traffic - +This key is used to capture the device network IPmask. type: keyword -- -*`sophos.xg.appfilter_policy_id`*:: +*`rsa.network.icmp_code`*:: + -- -Application Filter policy applied on the traffic - +This key is used to capture the ICMP code only -type: integer +type: long -- -*`sophos.xg.application_filter_policy`*:: +*`rsa.network.protocol_detail`*:: + -- -Application Filter policy applied on the traffic - +This key should be used to capture additional protocol information -type: integer +type: keyword -- -*`sophos.xg.application`*:: +*`rsa.network.dmask`*:: + -- -Application name - +This key is used for Destionation Device network mask type: keyword -- -*`sophos.xg.application_name`*:: +*`rsa.network.port`*:: + -- -Application name - +This key should only be used to capture a Network Port when the directionality is not clear -type: keyword +type: long -- -*`sophos.xg.application_risk`*:: +*`rsa.network.smask`*:: + -- -Risk level assigned to the application - +This key is used for capturing source Network Mask type: keyword -- -*`sophos.xg.application_technology`*:: +*`rsa.network.netname`*:: + -- -Technology of the application - +This key is used to capture the network name associated with an IP range. This is configured by the end user. type: keyword -- -*`sophos.xg.application_category`*:: +*`rsa.network.paddr`*:: + -- -Application is resolved by signature or synchronized application - +Deprecated -type: keyword +type: ip -- -*`sophos.xg.appresolvedby`*:: +*`rsa.network.faddr`*:: + -- -Technology of the application - - type: keyword -- -*`sophos.xg.app_is_cloud`*:: +*`rsa.network.lhost`*:: + -- -Application is Cloud - - type: keyword -- -*`sophos.xg.in_interface`*:: +*`rsa.network.origin`*:: + -- -Interface for incoming traffic, e.g., Port A - - type: keyword -- -*`sophos.xg.out_interface`*:: +*`rsa.network.remote_domain_id`*:: + -- -Interface for outgoing traffic, e.g., Port B - - type: keyword -- -*`sophos.xg.src_ip`*:: +*`rsa.network.addr`*:: + -- -Original source IP address of traffic - - -type: ip +type: keyword -- -*`sophos.xg.src_mac`*:: +*`rsa.network.dns_a_record`*:: + -- -Original source MAC address of traffic - - type: keyword -- -*`sophos.xg.src_country_code`*:: +*`rsa.network.dns_ptr_record`*:: + -- -Code of the country to which the source IP belongs - - type: keyword -- -*`sophos.xg.dst_ip`*:: +*`rsa.network.fhost`*:: + -- -Original destination IP address of traffic - - -type: ip +type: keyword -- -*`sophos.xg.dst_country_code`*:: +*`rsa.network.fport`*:: + -- -Code of the country to which the destination IP belongs - - type: keyword -- -*`sophos.xg.protocol`*:: +*`rsa.network.laddr`*:: + -- -Protocol number of traffic - - type: keyword -- -*`sophos.xg.src_port`*:: +*`rsa.network.linterface`*:: + -- -Original source port of TCP and UDP traffic - - -type: integer +type: keyword -- -*`sophos.xg.dst_port`*:: +*`rsa.network.phost`*:: + -- -Original destination port of TCP and UDP traffic - - -type: integer +type: keyword -- -*`sophos.xg.icmp_type`*:: +*`rsa.network.ad_computer_dst`*:: + -- -ICMP type of ICMP traffic - +Deprecated, use host.dst type: keyword -- -*`sophos.xg.icmp_code`*:: +*`rsa.network.eth_type`*:: + -- -ICMP code of ICMP traffic - +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only -type: keyword +type: long -- -*`sophos.xg.sent_pkts`*:: +*`rsa.network.ip_proto`*:: + -- -Total number of packets sent - +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI type: long -- -*`sophos.xg.received_pkts`*:: +*`rsa.network.dns_cname_record`*:: + -- -Total number of packets received - - -type: long +type: keyword -- -*`sophos.xg.sent_bytes`*:: +*`rsa.network.dns_id`*:: + -- -Total number of bytes sent - - -type: long +type: keyword -- -*`sophos.xg.recv_bytes`*:: +*`rsa.network.dns_opcode`*:: + -- -Total number of bytes received - - -type: long +type: keyword -- -*`sophos.xg.trans_src_ ip`*:: +*`rsa.network.dns_resp`*:: + -- -Translated source IP address for outgoing traffic - - -type: ip +type: keyword -- -*`sophos.xg.trans_src_port`*:: +*`rsa.network.dns_type`*:: + -- -Translated source port for outgoing traffic - - -type: integer +type: keyword -- -*`sophos.xg.trans_dst_ip`*:: +*`rsa.network.domain1`*:: + -- -Translated destination IP address for outgoing traffic - - -type: ip +type: keyword -- -*`sophos.xg.trans_dst_port`*:: +*`rsa.network.host_type`*:: + -- -Translated destination port for outgoing traffic - - -type: integer +type: keyword -- -*`sophos.xg.srczonetype`*:: +*`rsa.network.packet_length`*:: + -- -Type of source zone, e.g., LAN - - type: keyword -- -*`sophos.xg.srczone`*:: +*`rsa.network.host_orig`*:: + -- -Name of source zone - +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. type: keyword -- -*`sophos.xg.dstzonetype`*:: +*`rsa.network.rpayload`*:: + -- -Type of destination zone, e.g., WAN - +This key is used to capture the total number of payload bytes seen in the retransmitted packets. type: keyword -- -*`sophos.xg.dstzone`*:: +*`rsa.network.vlan_name`*:: + -- -Name of destination zone - +This key should only be used to capture the name of the Virtual LAN type: keyword -- -*`sophos.xg.dir_disp`*:: + +*`rsa.investigations.ec_activity`*:: + -- -TPacket direction. Possible values:“org”, “reply”, “” - +This key captures the particular event activity(Ex:Logoff) type: keyword -- -*`sophos.xg.connevent`*:: +*`rsa.investigations.ec_theme`*:: + -- -Event on which this log is generated - +This key captures the Theme of a particular Event(Ex:Authentication) type: keyword -- -*`sophos.xg.conn_id`*:: +*`rsa.investigations.ec_subject`*:: + -- -Unique identifier of connection - +This key captures the Subject of a particular Event(Ex:User) -type: integer +type: keyword -- -*`sophos.xg.vconn_id`*:: +*`rsa.investigations.ec_outcome`*:: + -- -Connection ID of the master connection - +This key captures the outcome of a particular Event(Ex:Success) -type: integer +type: keyword -- -*`sophos.xg.idp_policy_id`*:: +*`rsa.investigations.event_cat`*:: + -- -IPS policy ID which is applied on the traffic - +This key captures the Event category number -type: integer +type: long -- -*`sophos.xg.idp_policy_name`*:: +*`rsa.investigations.event_cat_name`*:: + -- -IPS policy name i.e. IPS policy name which is applied on the traffic - +This key captures the event category name corresponding to the event cat code type: keyword -- -*`sophos.xg.signature_id`*:: +*`rsa.investigations.event_vcat`*:: + -- -Signature ID - +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. type: keyword -- -*`sophos.xg.signature_msg`*:: +*`rsa.investigations.analysis_file`*:: + -- -Signature messsage - +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file type: keyword -- -*`sophos.xg.classification`*:: +*`rsa.investigations.analysis_service`*:: + -- -Signature classification - +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service type: keyword -- -*`sophos.xg.rule_priority`*:: +*`rsa.investigations.analysis_session`*:: + -- -Priority of IPS policy - +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session type: keyword -- -*`sophos.xg.platform`*:: +*`rsa.investigations.boc`*:: + -- -Platform of the traffic. - +This is used to capture behaviour of compromise type: keyword -- -*`sophos.xg.category`*:: +*`rsa.investigations.eoc`*:: + -- -IPS signature category. - +This is used to capture Enablers of Compromise type: keyword -- -*`sophos.xg.target`*:: +*`rsa.investigations.inv_category`*:: + -- -Platform of the traffic. - +This used to capture investigation category type: keyword -- -*`sophos.xg.eventid`*:: +*`rsa.investigations.inv_context`*:: + -- -ATP Evenet ID - +This used to capture investigation context type: keyword -- -*`sophos.xg.ep_uuid`*:: +*`rsa.investigations.ioc`*:: + -- -Endpoint UUID - +This is key capture indicator of compromise type: keyword -- -*`sophos.xg.threatname`*:: + +*`rsa.counters.dclass_c1`*:: + -- -ATP threatname - +This is a generic counter key that should be used with the label dclass.c1.str only -type: keyword +type: long -- -*`sophos.xg.sourceip`*:: +*`rsa.counters.dclass_c2`*:: + -- -Original source IP address of traffic - +This is a generic counter key that should be used with the label dclass.c2.str only -type: ip +type: long -- -*`sophos.xg.destinationip`*:: +*`rsa.counters.event_counter`*:: + -- -Original destination IP address of traffic - +This is used to capture the number of times an event repeated -type: ip +type: long -- -*`sophos.xg.login_user`*:: +*`rsa.counters.dclass_r1`*:: + -- -ATP login user - +This is a generic ratio key that should be used with the label dclass.r1.str only type: keyword -- -*`sophos.xg.eventtype`*:: +*`rsa.counters.dclass_c3`*:: + -- -ATP event type - +This is a generic counter key that should be used with the label dclass.c3.str only -type: keyword +type: long -- -*`sophos.xg.execution_path`*:: +*`rsa.counters.dclass_c1_str`*:: + -- -ATP execution path - +This is a generic counter string key that should be used with the label dclass.c1 only type: keyword -- -*`sophos.xg.av_policy_name`*:: +*`rsa.counters.dclass_c2_str`*:: + -- -Malware scanning policy name which is applied on the traffic - +This is a generic counter string key that should be used with the label dclass.c2 only type: keyword -- -*`sophos.xg.from_email_address`*:: +*`rsa.counters.dclass_r1_str`*:: + -- -Sender email address - +This is a generic ratio string key that should be used with the label dclass.r1 only type: keyword -- -*`sophos.xg.to_email_address`*:: +*`rsa.counters.dclass_r2`*:: + -- -Receipeint email address - +This is a generic ratio key that should be used with the label dclass.r2.str only type: keyword -- -*`sophos.xg.subject`*:: +*`rsa.counters.dclass_c3_str`*:: + -- -Email subject - +This is a generic counter string key that should be used with the label dclass.c3 only type: keyword -- -*`sophos.xg.mailsize`*:: +*`rsa.counters.dclass_r3`*:: + -- -mailsize - +This is a generic ratio key that should be used with the label dclass.r3.str only -type: integer +type: keyword -- -*`sophos.xg.virus`*:: +*`rsa.counters.dclass_r2_str`*:: + -- -virus name - +This is a generic ratio string key that should be used with the label dclass.r2 only type: keyword -- -*`sophos.xg.FTP_url`*:: +*`rsa.counters.dclass_r3_str`*:: + -- -FTP URL from which virus was downloaded - +This is a generic ratio string key that should be used with the label dclass.r3 only type: keyword -- -*`sophos.xg.FTP_direction`*:: + +*`rsa.identity.auth_method`*:: + -- -Direction of FTP transfer: Upload or Download - +This key is used to capture authentication methods used only type: keyword -- -*`sophos.xg.filesize`*:: +*`rsa.identity.user_role`*:: + -- -Size of the file that contained virus - +This key is used to capture the Role of a user only -type: integer +type: keyword -- -*`sophos.xg.filepath`*:: +*`rsa.identity.dn`*:: + -- -Path of the file containing virus - +X.500 (LDAP) Distinguished Name type: keyword -- -*`sophos.xg.filename`*:: +*`rsa.identity.logon_type`*:: + -- -File name associated with the event - +This key is used to capture the type of logon method used. type: keyword -- -*`sophos.xg.ftpcommand`*:: +*`rsa.identity.profile`*:: + -- -FTP command used when virus was found - +This key is used to capture the user profile type: keyword -- -*`sophos.xg.url`*:: +*`rsa.identity.accesses`*:: + -- -URL from which virus was downloaded - +This key is used to capture actual privileges used in accessing an object type: keyword -- -*`sophos.xg.domainname`*:: +*`rsa.identity.realm`*:: + -- -Domain from which virus was downloaded - +Radius realm or similar grouping of accounts type: keyword -- -*`sophos.xg.quarantine`*:: +*`rsa.identity.user_sid_dst`*:: + -- -Path and filename of the file quarantined - +This key captures Destination User Session ID type: keyword -- -*`sophos.xg.src_domainname`*:: +*`rsa.identity.dn_src`*:: + -- -Sender domain name - +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn type: keyword -- -*`sophos.xg.dst_domainname`*:: +*`rsa.identity.org`*:: + -- -Receiver domain name - +This key captures the User organization type: keyword -- -*`sophos.xg.reason`*:: +*`rsa.identity.dn_dst`*:: + -- -Reason why the record was detected as spam/malicious - +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn type: keyword -- -*`sophos.xg.referer`*:: +*`rsa.identity.firstname`*:: + -- -Referer - +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`sophos.xg.spamaction`*:: +*`rsa.identity.lastname`*:: + -- -Spam Action - +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`sophos.xg.mailid`*:: +*`rsa.identity.user_dept`*:: + -- -mailid - +User's Department Names only type: keyword -- -*`sophos.xg.quarantine_reason`*:: +*`rsa.identity.user_sid_src`*:: + -- -Quarantine reason - +This key captures Source User Session ID type: keyword -- -*`sophos.xg.status_code`*:: +*`rsa.identity.federated_sp`*:: + -- -Status code - +This key is the Federated Service Provider. This is the application requesting authentication. type: keyword -- -*`sophos.xg.override_token`*:: +*`rsa.identity.federated_idp`*:: + -- -Override token - +This key is the federated Identity Provider. This is the server providing the authentication. type: keyword -- -*`sophos.xg.con_id`*:: +*`rsa.identity.logon_type_desc`*:: + -- -Unique identifier of connection - +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. -type: integer +type: keyword -- -*`sophos.xg.override_authorizer`*:: +*`rsa.identity.middlename`*:: + -- -Override authorizer - +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`sophos.xg.transactionid`*:: +*`rsa.identity.password`*:: + -- -Transaction ID of the AV scan. - +This key is for Passwords seen in any session, plain text or encrypted type: keyword -- -*`sophos.xg.upload_file_type`*:: +*`rsa.identity.host_role`*:: + -- -Upload file type - +This key should only be used to capture the role of a Host Machine type: keyword -- -*`sophos.xg.upload_file_name`*:: +*`rsa.identity.ldap`*:: + -- -Upload file name - +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context type: keyword -- -*`sophos.xg.httpresponsecode`*:: +*`rsa.identity.ldap_query`*:: + -- -code of HTTP response - +This key is the Search criteria from an LDAP search -type: long +type: keyword -- -*`sophos.xg.user_gp`*:: +*`rsa.identity.ldap_response`*:: + -- -Group name to which the user belongs. - +This key is to capture Results from an LDAP search type: keyword -- -*`sophos.xg.category_type`*:: +*`rsa.identity.owner`*:: + -- -Type of category under which website falls - +This is used to capture username the process or service is running as, the author of the task type: keyword -- -*`sophos.xg.download_file_type`*:: +*`rsa.identity.service_account`*:: + -- -Download file type - +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage type: keyword -- -*`sophos.xg.exceptions`*:: + +*`rsa.email.email_dst`*:: + -- -List of the checks excluded by web exceptions. - +This key is used to capture the Destination email address only, when the destination context is not clear use email type: keyword -- -*`sophos.xg.contenttype`*:: +*`rsa.email.email_src`*:: + -- -Type of the content - +This key is used to capture the source email address only, when the source context is not clear use email type: keyword -- -*`sophos.xg.override_name`*:: +*`rsa.email.subject`*:: + -- -Override name - +This key is used to capture the subject string from an Email only. type: keyword -- -*`sophos.xg.activityname`*:: +*`rsa.email.email`*:: + -- -Web policy activity that matched and caused the policy result. - +This key is used to capture a generic email address where the source or destination context is not clear type: keyword -- -*`sophos.xg.download_file_name`*:: +*`rsa.email.trans_from`*:: + -- -Download file name - +Deprecated key defined only in table map. type: keyword -- -*`sophos.xg.sha1sum`*:: +*`rsa.email.trans_to`*:: + -- -SHA1 checksum of the item being analyzed - +Deprecated key defined only in table map. type: keyword -- -*`sophos.xg.message_id`*:: + +*`rsa.file.privilege`*:: + -- -Message ID - +Deprecated, use permissions type: keyword -- -*`sophos.xg.connid`*:: +*`rsa.file.attachment`*:: + -- -Connection ID - +This key captures the attachment file name type: keyword -- -*`sophos.xg.message`*:: +*`rsa.file.filesystem`*:: + -- -Message - - type: keyword -- -*`sophos.xg.email_subject`*:: +*`rsa.file.binary`*:: + -- -Email Subject - +Deprecated key defined only in table map. type: keyword -- -*`sophos.xg.file_path`*:: +*`rsa.file.filename_dst`*:: + -- -File path - +This is used to capture name of the file targeted by the action type: keyword -- -*`sophos.xg.dstdomain`*:: +*`rsa.file.filename_src`*:: + -- -Destination Domain - +This is used to capture name of the parent filename, the file which performed the action type: keyword -- -*`sophos.xg.file_size`*:: +*`rsa.file.filename_tmp`*:: + -- -File Size - - -type: integer +type: keyword -- -*`sophos.xg.transaction_id`*:: +*`rsa.file.directory_dst`*:: + -- -Transaction ID - +This key is used to capture the directory of the target process or file type: keyword -- -*`sophos.xg.website`*:: +*`rsa.file.directory_src`*:: + -- -Website - +This key is used to capture the directory of the source process or file type: keyword -- -*`sophos.xg.file_name`*:: +*`rsa.file.file_entropy`*:: + -- -Filename - +This is used to capture entropy vale of a file -type: keyword +type: double -- -*`sophos.xg.context_prefix`*:: +*`rsa.file.file_vendor`*:: + -- -Content Prefix - +This is used to capture Company name of file located in version_info type: keyword -- -*`sophos.xg.site_category`*:: +*`rsa.file.task_name`*:: + -- -Site Category - +This is used to capture name of the task type: keyword -- -*`sophos.xg.context_suffix`*:: + +*`rsa.web.fqdn`*:: + -- -Context Suffix - +Fully Qualified Domain Names type: keyword -- -*`sophos.xg.dictionary_name`*:: +*`rsa.web.web_cookie`*:: + -- -Dictionary Name - +This key is used to capture the Web cookies specifically. type: keyword -- -*`sophos.xg.action`*:: +*`rsa.web.alias_host`*:: + -- -Event Action - - type: keyword -- -*`sophos.xg.user`*:: +*`rsa.web.reputation_num`*:: + -- -User - +Reputation Number of an entity. Typically used for Web Domains -type: keyword +type: double -- -*`sophos.xg.context_match`*:: +*`rsa.web.web_ref_domain`*:: + -- -Context Match - +Web referer's domain type: keyword -- -*`sophos.xg.direction`*:: +*`rsa.web.web_ref_query`*:: + -- -Direction - +This key captures Web referer's query portion of the URL type: keyword -- -*`sophos.xg.auth_client`*:: +*`rsa.web.remote_domain`*:: + -- -Auth Client - - type: keyword -- -*`sophos.xg.auth_mechanism`*:: +*`rsa.web.web_ref_page`*:: + -- -Auth mechanism - +This key captures Web referer's page information type: keyword -- -*`sophos.xg.connectionname`*:: +*`rsa.web.web_ref_root`*:: + -- -Connectionname - +Web referer's root URL path type: keyword -- -*`sophos.xg.remotenetwork`*:: +*`rsa.web.cn_asn_dst`*:: + -- -remotenetwork - - type: keyword -- -*`sophos.xg.localgateway`*:: +*`rsa.web.cn_rpackets`*:: + -- -Localgateway +type: keyword +-- +*`rsa.web.urlpage`*:: ++ +-- type: keyword -- -*`sophos.xg.localnetwork`*:: +*`rsa.web.urlroot`*:: + -- -Localnetwork +type: keyword +-- +*`rsa.web.p_url`*:: ++ +-- type: keyword -- -*`sophos.xg.connectiontype`*:: +*`rsa.web.p_user_agent`*:: + -- -Connectiontype +type: keyword +-- +*`rsa.web.p_web_cookie`*:: ++ +-- type: keyword -- -*`sophos.xg.oldversion`*:: +*`rsa.web.p_web_method`*:: + -- -Oldversion +type: keyword +-- +*`rsa.web.p_web_referer`*:: ++ +-- type: keyword -- -*`sophos.xg.newversion`*:: +*`rsa.web.web_extension_tmp`*:: + -- -Newversion +type: keyword +-- +*`rsa.web.web_page`*:: ++ +-- type: keyword -- -*`sophos.xg.ipaddress`*:: + +*`rsa.threat.threat_category`*:: + -- -Ipaddress - +This key captures Threat Name/Threat Category/Categorization of alert type: keyword -- -*`sophos.xg.client_physical_address`*:: +*`rsa.threat.threat_desc`*:: + -- -Client physical address - +This key is used to capture the threat description from the session directly or inferred type: keyword -- -*`sophos.xg.client_host_name`*:: +*`rsa.threat.alert`*:: + -- -Client host name - +This key is used to capture name of the alert type: keyword -- -*`sophos.xg.raw_data`*:: +*`rsa.threat.threat_source`*:: + -- -Raw data - +This key is used to capture source of the threat type: keyword -- -*`sophos.xg.Mode`*:: + +*`rsa.crypto.crypto`*:: + -- -Mode - +This key is used to capture the Encryption Type or Encryption Key only type: keyword -- -*`sophos.xg.sessionid`*:: +*`rsa.crypto.cipher_src`*:: + -- -Sessionid - +This key is for Source (Client) Cipher type: keyword -- -*`sophos.xg.starttime`*:: +*`rsa.crypto.cert_subject`*:: + -- -Starttime - +This key is used to capture the Certificate organization only -type: date +type: keyword -- -*`sophos.xg.remote_ip`*:: +*`rsa.crypto.peer`*:: + -- -Remote IP - +This key is for Encryption peer's IP Address -type: ip +type: keyword -- -*`sophos.xg.timestamp`*:: +*`rsa.crypto.cipher_size_src`*:: + -- -timestamp - +This key captures Source (Client) Cipher Size -type: date +type: long -- -*`sophos.xg.SysLog_SERVER_NAME`*:: +*`rsa.crypto.ike`*:: + -- -SysLog SERVER NAME - +IKE negotiation phase. type: keyword -- -*`sophos.xg.backup_mode`*:: +*`rsa.crypto.scheme`*:: + -- -Backup mode - +This key captures the Encryption scheme used type: keyword -- -*`sophos.xg.source`*:: +*`rsa.crypto.peer_id`*:: + -- -Source - +This key is for Encryption peer’s identity type: keyword -- -*`sophos.xg.server`*:: +*`rsa.crypto.sig_type`*:: + -- -Server - +This key captures the Signature Type type: keyword -- -*`sophos.xg.host`*:: +*`rsa.crypto.cert_issuer`*:: + -- -Host - - type: keyword -- -*`sophos.xg.responsetime`*:: +*`rsa.crypto.cert_host_name`*:: + -- -Responsetime - +Deprecated key defined only in table map. -type: long +type: keyword -- -*`sophos.xg.cookie`*:: +*`rsa.crypto.cert_error`*:: + -- -cookie - +This key captures the Certificate Error String type: keyword -- -*`sophos.xg.querystring`*:: +*`rsa.crypto.cipher_dst`*:: + -- -querystring - +This key is for Destination (Server) Cipher type: keyword -- -*`sophos.xg.extra`*:: +*`rsa.crypto.cipher_size_dst`*:: + -- -extra - +This key captures Destination (Server) Cipher Size -type: keyword +type: long -- -*`sophos.xg.PHPSESSID`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -PHPSESSID - +Deprecated, use version type: keyword -- -*`sophos.xg.start_time`*:: +*`rsa.crypto.d_certauth`*:: + -- -Start time +type: keyword +-- -type: date +*`rsa.crypto.s_certauth`*:: ++ +-- +type: keyword -- -*`sophos.xg.eventtime`*:: +*`rsa.crypto.ike_cookie1`*:: + -- -Event time - +ID of the negotiation — sent for ISAKMP Phase One -type: date +type: keyword -- -*`sophos.xg.red_id`*:: +*`rsa.crypto.ike_cookie2`*:: + -- -RED ID - +ID of the negotiation — sent for ISAKMP Phase Two type: keyword -- -*`sophos.xg.branch_name`*:: +*`rsa.crypto.cert_checksum`*:: + -- -Branch Name - - type: keyword -- -*`sophos.xg.updatedip`*:: +*`rsa.crypto.cert_host_cat`*:: + -- -updatedip - +This key is used for the hostname category value of a certificate -type: ip +type: keyword -- -*`sophos.xg.idle_cpu`*:: +*`rsa.crypto.cert_serial`*:: + -- -idle ## - +This key is used to capture the Certificate serial number only -type: float +type: keyword -- -*`sophos.xg.system_cpu`*:: +*`rsa.crypto.cert_status`*:: + -- -system - +This key captures Certificate validation status -type: float +type: keyword -- -*`sophos.xg.user_cpu`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- -system - +Deprecated, use version -type: float +type: keyword -- -*`sophos.xg.used`*:: +*`rsa.crypto.cert_keysize`*:: + -- -used +type: keyword +-- -type: integer +*`rsa.crypto.cert_username`*:: ++ +-- +type: keyword -- -*`sophos.xg.unit`*:: +*`rsa.crypto.https_insact`*:: + -- -unit +type: keyword +-- +*`rsa.crypto.https_valid`*:: ++ +-- type: keyword -- -*`sophos.xg.total_memory`*:: +*`rsa.crypto.cert_ca`*:: + -- -Total Memory - +This key is used to capture the Certificate signing authority only -type: integer +type: keyword -- -*`sophos.xg.free`*:: +*`rsa.crypto.cert_common`*:: + -- -free - +This key is used to capture the Certificate common name only -type: integer +type: keyword -- -*`sophos.xg.transmittederrors`*:: + +*`rsa.wireless.wlan_ssid`*:: + -- -transmitted errors - +This key is used to capture the ssid of a Wireless Session type: keyword -- -*`sophos.xg.receivederrors`*:: +*`rsa.wireless.access_point`*:: + -- -received errors - +This key is used to capture the access point name. type: keyword -- -*`sophos.xg.receivedkbits`*:: +*`rsa.wireless.wlan_channel`*:: + -- -received kbits - +This is used to capture the channel names type: long -- -*`sophos.xg.transmittedkbits`*:: +*`rsa.wireless.wlan_name`*:: + -- -transmitted kbits - +This key captures either WLAN number/name -type: long +type: keyword -- -*`sophos.xg.transmitteddrops`*:: + +*`rsa.storage.disk_volume`*:: + -- -transmitted drops - +A unique name assigned to logical units (volumes) within a physical disk -type: long +type: keyword -- -*`sophos.xg.receiveddrops`*:: +*`rsa.storage.lun`*:: + -- -received drops - +Logical Unit Number.This key is a very useful concept in Storage. -type: long +type: keyword -- -*`sophos.xg.collisions`*:: +*`rsa.storage.pwwn`*:: + -- -collisions - +This uniquely identifies a port on a HBA. -type: long +type: keyword -- -*`sophos.xg.interface`*:: + +*`rsa.physical.org_dst`*:: + -- -interface - +This is used to capture the destination organization based on the GEOPIP Maxmind database. type: keyword -- -*`sophos.xg.Configuration`*:: +*`rsa.physical.org_src`*:: + -- -Configuration - +This is used to capture the source organization based on the GEOPIP Maxmind database. -type: float +type: keyword -- -*`sophos.xg.Reports`*:: + +*`rsa.healthcare.patient_fname`*:: + -- -Reports - +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information -type: float +type: keyword -- -*`sophos.xg.Signature`*:: +*`rsa.healthcare.patient_id`*:: + -- -Signature - +This key captures the unique ID for a patient -type: float +type: keyword -- -*`sophos.xg.Temp`*:: +*`rsa.healthcare.patient_lname`*:: + -- -Temp - +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information -type: float +type: keyword -- -*`sophos.xg.users`*:: +*`rsa.healthcare.patient_mname`*:: + -- -users - +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information type: keyword -- -*`sophos.xg.ssid`*:: + +*`rsa.endpoint.host_state`*:: + -- -ssid - +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on type: keyword -- -*`sophos.xg.ap`*:: +*`rsa.endpoint.registry_key`*:: + -- -ap - +This key captures the path to the registry key type: keyword -- -*`sophos.xg.clients_conn_ssid`*:: +*`rsa.endpoint.registry_value`*:: + -- -clients connection ssid - +This key captures values or decorators used within a registry entry type: keyword -- -[[exported-fields-squid]] -== Squid fields +[[exported-fields-suricata]] +== Suricata fields -squid fields. +Module for handling the EVE JSON logs produced by Suricata. -*`network.interface.name`*:: -+ --- -Name of the network interface where the traffic has been observed. +[float] +=== suricata +Fields from the Suricata EVE log file. -type: keyword --- +[float] +=== eve +Fields exported by the EVE JSON logs -*`rsa.internal.msg`*:: + + +*`suricata.eve.event_type`*:: + -- -This key is used to capture the raw message that comes into the Log Decoder - type: keyword -- -*`rsa.internal.messageid`*:: +*`suricata.eve.app_proto_orig`*:: + -- type: keyword -- -*`rsa.internal.event_desc`*:: + +*`suricata.eve.tcp.tcp_flags`*:: + -- type: keyword -- -*`rsa.internal.message`*:: +*`suricata.eve.tcp.psh`*:: + -- -This key captures the contents of instant messages +type: boolean + +-- +*`suricata.eve.tcp.tcp_flags_tc`*:: ++ +-- type: keyword -- -*`rsa.internal.time`*:: +*`suricata.eve.tcp.ack`*:: + -- -This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - -type: date +type: boolean -- -*`rsa.internal.level`*:: +*`suricata.eve.tcp.syn`*:: + -- -Deprecated key defined only in table map. - -type: long +type: boolean -- -*`rsa.internal.msg_id`*:: +*`suricata.eve.tcp.state`*:: + -- -This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.msg_vid`*:: +*`suricata.eve.tcp.tcp_flags_ts`*:: + -- -This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.data`*:: +*`suricata.eve.tcp.rst`*:: + -- -Deprecated key defined only in table map. - -type: keyword +type: boolean -- -*`rsa.internal.obj_server`*:: +*`suricata.eve.tcp.fin`*:: + -- -Deprecated key defined only in table map. - -type: keyword +type: boolean -- -*`rsa.internal.obj_val`*:: + +*`suricata.eve.fileinfo.sha1`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.resource`*:: +*`suricata.eve.fileinfo.filename`*:: + -- -Deprecated key defined only in table map. +type: alias -type: keyword +alias to: file.path -- -*`rsa.internal.obj_id`*:: +*`suricata.eve.fileinfo.tx_id`*:: + -- -Deprecated key defined only in table map. +type: long + +-- +*`suricata.eve.fileinfo.state`*:: ++ +-- type: keyword -- -*`rsa.internal.statement`*:: +*`suricata.eve.fileinfo.stored`*:: + -- -Deprecated key defined only in table map. - -type: keyword +type: boolean -- -*`rsa.internal.audit_class`*:: +*`suricata.eve.fileinfo.gaps`*:: + -- -Deprecated key defined only in table map. +type: boolean + +-- +*`suricata.eve.fileinfo.sha256`*:: ++ +-- type: keyword -- -*`rsa.internal.entry`*:: +*`suricata.eve.fileinfo.md5`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.hcode`*:: +*`suricata.eve.fileinfo.size`*:: + -- -Deprecated key defined only in table map. +type: alias -type: keyword +alias to: file.size -- -*`rsa.internal.inode`*:: +*`suricata.eve.icmp_type`*:: + -- -Deprecated key defined only in table map. - type: long -- -*`rsa.internal.resource_class`*:: +*`suricata.eve.dest_port`*:: + -- -Deprecated key defined only in table map. +type: alias -type: keyword +alias to: destination.port -- -*`rsa.internal.dead`*:: +*`suricata.eve.src_port`*:: + -- -Deprecated key defined only in table map. +type: alias -type: long +alias to: source.port -- -*`rsa.internal.feed_desc`*:: +*`suricata.eve.proto`*:: + -- -This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: keyword +alias to: network.transport -- -*`rsa.internal.feed_name`*:: +*`suricata.eve.pcap_cnt`*:: + -- -This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: keyword +type: long -- -*`rsa.internal.cid`*:: +*`suricata.eve.src_ip`*:: + -- -This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: keyword +alias to: source.ip -- -*`rsa.internal.device_class`*:: + +*`suricata.eve.dns.type`*:: + -- -This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_group`*:: +*`suricata.eve.dns.rrtype`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_host`*:: +*`suricata.eve.dns.rrname`*:: + -- -This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.device_ip`*:: +*`suricata.eve.dns.rdata`*:: + -- -This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: ip +type: keyword -- -*`rsa.internal.device_ipv6`*:: +*`suricata.eve.dns.tx_id`*:: + -- -This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: ip +type: long -- -*`rsa.internal.device_type`*:: +*`suricata.eve.dns.ttl`*:: + -- -This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: long + +-- +*`suricata.eve.dns.rcode`*:: ++ +-- type: keyword -- -*`rsa.internal.device_type_id`*:: +*`suricata.eve.dns.id`*:: + -- -Deprecated key defined only in table map. - type: long -- -*`rsa.internal.did`*:: +*`suricata.eve.flow_id`*:: + -- -This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.entropy_req`*:: + +*`suricata.eve.email.status`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - -type: long +type: keyword -- -*`rsa.internal.entropy_res`*:: +*`suricata.eve.dest_ip`*:: + -- -This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration +type: alias -type: long +alias to: destination.ip -- -*`rsa.internal.event_name`*:: +*`suricata.eve.icmp_code`*:: + -- -Deprecated key defined only in table map. - -type: keyword +type: long -- -*`rsa.internal.feed_category`*:: + +*`suricata.eve.http.status`*:: + -- -This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: keyword +alias to: http.response.status_code -- -*`rsa.internal.forward_ip`*:: +*`suricata.eve.http.redirect`*:: + -- -This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - -type: ip +type: keyword -- -*`rsa.internal.forward_ipv6`*:: +*`suricata.eve.http.http_user_agent`*:: + -- -This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: ip +alias to: user_agent.original -- -*`rsa.internal.header_id`*:: +*`suricata.eve.http.protocol`*:: + -- -This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.lc_cid`*:: +*`suricata.eve.http.http_refer`*:: + -- -This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: keyword +alias to: http.request.referrer -- -*`rsa.internal.lc_ctime`*:: +*`suricata.eve.http.url`*:: + -- -This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: date +alias to: url.original -- -*`rsa.internal.mcb_req`*:: +*`suricata.eve.http.hostname`*:: + -- -This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most +type: alias -type: long +alias to: url.domain -- -*`rsa.internal.mcb_res`*:: +*`suricata.eve.http.length`*:: + -- -This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most +type: alias -type: long +alias to: http.response.body.bytes -- -*`rsa.internal.mcbc_req`*:: +*`suricata.eve.http.http_method`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams +type: alias -type: long +alias to: http.request.method -- -*`rsa.internal.mcbc_res`*:: +*`suricata.eve.http.http_content_type`*:: + -- -This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - -type: long +type: keyword -- -*`rsa.internal.medium`*:: +*`suricata.eve.timestamp`*:: + -- -This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session +type: alias -type: long +alias to: @timestamp -- -*`rsa.internal.node_name`*:: +*`suricata.eve.in_iface`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.nwe_callback_id`*:: + +*`suricata.eve.alert.category`*:: + -- -This key denotes that event is endpoint related - type: keyword -- -*`rsa.internal.parse_error`*:: +*`suricata.eve.alert.severity`*:: + -- -This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness +type: alias -type: keyword +alias to: event.severity -- -*`rsa.internal.payload_req`*:: +*`suricata.eve.alert.rev`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - type: long -- -*`rsa.internal.payload_res`*:: +*`suricata.eve.alert.gid`*:: + -- -This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - type: long -- -*`rsa.internal.process_vid_dst`*:: +*`suricata.eve.alert.signature`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - type: keyword -- -*`rsa.internal.process_vid_src`*:: +*`suricata.eve.alert.action`*:: + -- -Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. +type: alias -type: keyword +alias to: event.outcome -- -*`rsa.internal.rid`*:: +*`suricata.eve.alert.signature_id`*:: + -- -This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: long -- -*`rsa.internal.session_split`*:: + + +*`suricata.eve.ssh.client.proto_version`*:: + -- -This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.site`*:: +*`suricata.eve.ssh.client.software_version`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.internal.size`*:: + +*`suricata.eve.ssh.server.proto_version`*:: + -- -This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - -type: long +type: keyword -- -*`rsa.internal.sourcefile`*:: +*`suricata.eve.ssh.server.software_version`*:: + -- -This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.internal.ubc_req`*:: + + +*`suricata.eve.stats.capture.kernel_packets`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - type: long -- -*`rsa.internal.ubc_res`*:: +*`suricata.eve.stats.capture.kernel_drops`*:: + -- -This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - type: long -- -*`rsa.internal.word`*:: +*`suricata.eve.stats.capture.kernel_ifdrops`*:: + -- -This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log +type: long -type: keyword +-- + +*`suricata.eve.stats.uptime`*:: ++ +-- +type: long -- -*`rsa.time.event_time`*:: +*`suricata.eve.stats.detect.alert`*:: + -- -This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - -type: date +type: long -- -*`rsa.time.duration_time`*:: + +*`suricata.eve.stats.http.memcap`*:: + -- -This key is used to capture the normalized duration/lifetime in seconds. - -type: double +type: long -- -*`rsa.time.event_time_str`*:: +*`suricata.eve.stats.http.memuse`*:: + -- -This key is used to capture the incomplete time mentioned in a session as a string - -type: keyword +type: long -- -*`rsa.time.starttime`*:: + +*`suricata.eve.stats.file_store.open_files`*:: + -- -This key is used to capture the Start time mentioned in a session in a standard form - -type: date +type: long -- -*`rsa.time.month`*:: + +*`suricata.eve.stats.defrag.max_frag_hits`*:: + -- -type: keyword +type: long -- -*`rsa.time.day`*:: + +*`suricata.eve.stats.defrag.ipv4.timeouts`*:: + -- -type: keyword +type: long -- -*`rsa.time.endtime`*:: +*`suricata.eve.stats.defrag.ipv4.fragments`*:: + -- -This key is used to capture the End time mentioned in a session in a standard form - -type: date +type: long -- -*`rsa.time.timezone`*:: +*`suricata.eve.stats.defrag.ipv4.reassembled`*:: + -- -This key is used to capture the timezone of the Event Time - -type: keyword +type: long -- -*`rsa.time.duration_str`*:: + +*`suricata.eve.stats.defrag.ipv6.timeouts`*:: + -- -A text string version of the duration - -type: keyword +type: long -- -*`rsa.time.date`*:: +*`suricata.eve.stats.defrag.ipv6.fragments`*:: + -- -type: keyword +type: long -- -*`rsa.time.year`*:: +*`suricata.eve.stats.defrag.ipv6.reassembled`*:: + -- -type: keyword +type: long -- -*`rsa.time.recorded_time`*:: + +*`suricata.eve.stats.flow.tcp_reuse`*:: + -- -The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - -type: date +type: long -- -*`rsa.time.datetime`*:: +*`suricata.eve.stats.flow.udp`*:: + -- -type: keyword +type: long -- -*`rsa.time.effective_time`*:: +*`suricata.eve.stats.flow.memcap`*:: + -- -This key is the effective time referenced by an individual event in a Standard Timestamp format - -type: date +type: long -- -*`rsa.time.expire_time`*:: +*`suricata.eve.stats.flow.emerg_mode_entered`*:: + -- -This key is the timestamp that explicitly refers to an expiration. - -type: date +type: long -- -*`rsa.time.process_time`*:: +*`suricata.eve.stats.flow.emerg_mode_over`*:: + -- -Deprecated, use duration.time - -type: keyword +type: long -- -*`rsa.time.hour`*:: +*`suricata.eve.stats.flow.tcp`*:: + -- -type: keyword +type: long -- -*`rsa.time.min`*:: +*`suricata.eve.stats.flow.icmpv6`*:: + -- -type: keyword +type: long -- -*`rsa.time.timestamp`*:: +*`suricata.eve.stats.flow.icmpv4`*:: + -- -type: keyword +type: long -- -*`rsa.time.event_queue_time`*:: +*`suricata.eve.stats.flow.spare`*:: + -- -This key is the Time that the event was queued. - -type: date +type: long -- -*`rsa.time.p_time1`*:: +*`suricata.eve.stats.flow.memuse`*:: + -- -type: keyword +type: long -- -*`rsa.time.tzone`*:: + +*`suricata.eve.stats.tcp.pseudo_failed`*:: + -- -type: keyword +type: long -- -*`rsa.time.eventtime`*:: +*`suricata.eve.stats.tcp.ssn_memcap_drop`*:: + -- -type: keyword +type: long -- -*`rsa.time.gmtdate`*:: +*`suricata.eve.stats.tcp.insert_data_overlap_fail`*:: + -- -type: keyword +type: long -- -*`rsa.time.gmttime`*:: +*`suricata.eve.stats.tcp.sessions`*:: + -- -type: keyword +type: long -- -*`rsa.time.p_date`*:: +*`suricata.eve.stats.tcp.pseudo`*:: + -- -type: keyword +type: long -- -*`rsa.time.p_month`*:: +*`suricata.eve.stats.tcp.synack`*:: + -- -type: keyword +type: long -- -*`rsa.time.p_time`*:: +*`suricata.eve.stats.tcp.insert_data_normal_fail`*:: + -- -type: keyword +type: long -- -*`rsa.time.p_time2`*:: +*`suricata.eve.stats.tcp.syn`*:: + -- -type: keyword +type: long -- -*`rsa.time.p_year`*:: +*`suricata.eve.stats.tcp.memuse`*:: + -- -type: keyword +type: long -- -*`rsa.time.expire_time_str`*:: +*`suricata.eve.stats.tcp.invalid_checksum`*:: + -- -This key is used to capture incomplete timestamp that explicitly refers to an expiration. - -type: keyword +type: long -- -*`rsa.time.stamp`*:: +*`suricata.eve.stats.tcp.segment_memcap_drop`*:: + -- -Deprecated key defined only in table map. +type: long -type: date +-- +*`suricata.eve.stats.tcp.overlap`*:: ++ -- +type: long +-- -*`rsa.misc.action`*:: +*`suricata.eve.stats.tcp.insert_list_fail`*:: + -- -type: keyword +type: long -- -*`rsa.misc.result`*:: +*`suricata.eve.stats.tcp.rst`*:: + -- -This key is used to capture the outcome/result string value of an action in a session. - -type: keyword +type: long -- -*`rsa.misc.severity`*:: +*`suricata.eve.stats.tcp.stream_depth_reached`*:: + -- -This key is used to capture the severity given the session - -type: keyword +type: long -- -*`rsa.misc.event_type`*:: +*`suricata.eve.stats.tcp.reassembly_memuse`*:: + -- -This key captures the event category type as specified by the event source. - -type: keyword +type: long -- -*`rsa.misc.reference_id`*:: +*`suricata.eve.stats.tcp.reassembly_gap`*:: + -- -This key is used to capture an event id from the session directly - -type: keyword +type: long -- -*`rsa.misc.version`*:: +*`suricata.eve.stats.tcp.overlap_diff_data`*:: + -- -This key captures Version of the application or OS which is generating the event. - -type: keyword +type: long -- -*`rsa.misc.disposition`*:: +*`suricata.eve.stats.tcp.no_flow`*:: + -- -This key captures the The end state of an action. - -type: keyword +type: long -- -*`rsa.misc.result_code`*:: + +*`suricata.eve.stats.decoder.avg_pkt_size`*:: + -- -This key is used to capture the outcome/result numeric value of an action in a session - -type: keyword +type: long -- -*`rsa.misc.category`*:: +*`suricata.eve.stats.decoder.bytes`*:: + -- -This key is used to capture the category of an event given by the vendor in the session - -type: keyword +type: long -- -*`rsa.misc.obj_name`*:: +*`suricata.eve.stats.decoder.tcp`*:: + -- -This is used to capture name of object - -type: keyword +type: long -- -*`rsa.misc.obj_type`*:: +*`suricata.eve.stats.decoder.raw`*:: + -- -This is used to capture type of object - -type: keyword +type: long -- -*`rsa.misc.event_source`*:: +*`suricata.eve.stats.decoder.ppp`*:: + -- -This key captures Source of the event that’s not a hostname - -type: keyword +type: long -- -*`rsa.misc.log_session_id`*:: +*`suricata.eve.stats.decoder.vlan_qinq`*:: + -- -This key is used to capture a sessionid from the session directly - -type: keyword +type: long -- -*`rsa.misc.group`*:: +*`suricata.eve.stats.decoder.null`*:: + -- -This key captures the Group Name value - -type: keyword +type: long -- -*`rsa.misc.policy_name`*:: + +*`suricata.eve.stats.decoder.ltnull.unsupported_type`*:: + -- -This key is used to capture the Policy Name only. - -type: keyword +type: long -- -*`rsa.misc.rule_name`*:: +*`suricata.eve.stats.decoder.ltnull.pkt_too_small`*:: + -- -This key captures the Rule Name - -type: keyword +type: long -- -*`rsa.misc.context`*:: +*`suricata.eve.stats.decoder.invalid`*:: + -- -This key captures Information which adds additional context to the event. - -type: keyword +type: long -- -*`rsa.misc.change_new`*:: +*`suricata.eve.stats.decoder.gre`*:: + -- -This key is used to capture the new values of the attribute that’s changing in a session - -type: keyword +type: long -- -*`rsa.misc.space`*:: +*`suricata.eve.stats.decoder.ipv4`*:: + -- -type: keyword +type: long -- -*`rsa.misc.client`*:: +*`suricata.eve.stats.decoder.ipv6`*:: + -- -This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - -type: keyword +type: long -- -*`rsa.misc.msgIdPart1`*:: +*`suricata.eve.stats.decoder.pkts`*:: + -- -type: keyword +type: long -- -*`rsa.misc.msgIdPart2`*:: +*`suricata.eve.stats.decoder.ipv6_in_ipv6`*:: + -- -type: keyword +type: long -- -*`rsa.misc.change_old`*:: + +*`suricata.eve.stats.decoder.ipraw.invalid_ip_version`*:: + -- -This key is used to capture the old value of the attribute that’s changing in a session - -type: keyword +type: long -- -*`rsa.misc.operation_id`*:: +*`suricata.eve.stats.decoder.pppoe`*:: + -- -An alert number or operation number. The values should be unique and non-repeating. - -type: keyword +type: long -- -*`rsa.misc.event_state`*:: +*`suricata.eve.stats.decoder.udp`*:: + -- -This key captures the current state of the object/item referenced within the event. Describing an on-going event. - -type: keyword +type: long -- -*`rsa.misc.group_object`*:: + +*`suricata.eve.stats.decoder.dce.pkt_too_small`*:: + -- -This key captures a collection/grouping of entities. Specific usage - -type: keyword +type: long -- -*`rsa.misc.node`*:: +*`suricata.eve.stats.decoder.vlan`*:: + -- -Common use case is the node name within a cluster. The cluster name is reflected by the host name. - -type: keyword +type: long -- -*`rsa.misc.rule`*:: +*`suricata.eve.stats.decoder.sctp`*:: + -- -This key captures the Rule number - -type: keyword +type: long -- -*`rsa.misc.device_name`*:: +*`suricata.eve.stats.decoder.max_pkt_size`*:: + -- -This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc - -type: keyword +type: long -- -*`rsa.misc.param`*:: +*`suricata.eve.stats.decoder.teredo`*:: + -- -This key is the parameters passed as part of a command or application, etc. - -type: keyword +type: long -- -*`rsa.misc.change_attrib`*:: +*`suricata.eve.stats.decoder.mpls`*:: + -- -This key is used to capture the name of the attribute that’s changing in a session - -type: keyword +type: long -- -*`rsa.misc.event_computer`*:: +*`suricata.eve.stats.decoder.sll`*:: + -- -This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - -type: keyword +type: long -- -*`rsa.misc.reference_id1`*:: +*`suricata.eve.stats.decoder.icmpv6`*:: + -- -This key is for Linked ID to be used as an addition to "reference.id" - -type: keyword +type: long -- -*`rsa.misc.event_log`*:: +*`suricata.eve.stats.decoder.icmpv4`*:: + -- -This key captures the Name of the event log - -type: keyword +type: long -- -*`rsa.misc.OS`*:: +*`suricata.eve.stats.decoder.erspan`*:: + -- -This key captures the Name of the Operating System - -type: keyword +type: long -- -*`rsa.misc.terminal`*:: +*`suricata.eve.stats.decoder.ethernet`*:: + -- -This key captures the Terminal Names only - -type: keyword +type: long -- -*`rsa.misc.msgIdPart3`*:: +*`suricata.eve.stats.decoder.ipv4_in_ipv6`*:: + -- -type: keyword +type: long -- -*`rsa.misc.filter`*:: +*`suricata.eve.stats.decoder.ieee8021ah`*:: + -- -This key captures Filter used to reduce result set - -type: keyword +type: long -- -*`rsa.misc.serial_number`*:: + +*`suricata.eve.stats.dns.memcap_global`*:: + -- -This key is the Serial number associated with a physical asset. - -type: keyword +type: long -- -*`rsa.misc.checksum`*:: +*`suricata.eve.stats.dns.memcap_state`*:: + -- -This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - -type: keyword +type: long -- -*`rsa.misc.event_user`*:: +*`suricata.eve.stats.dns.memuse`*:: + -- -This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - -type: keyword +type: long -- -*`rsa.misc.virusname`*:: + +*`suricata.eve.stats.flow_mgr.rows_busy`*:: + -- -This key captures the name of the virus - -type: keyword +type: long -- -*`rsa.misc.content_type`*:: +*`suricata.eve.stats.flow_mgr.flows_timeout`*:: + -- -This key is used to capture Content Type only. - -type: keyword +type: long -- -*`rsa.misc.group_id`*:: +*`suricata.eve.stats.flow_mgr.flows_notimeout`*:: + -- -This key captures Group ID Number (related to the group name) - -type: keyword +type: long -- -*`rsa.misc.policy_id`*:: +*`suricata.eve.stats.flow_mgr.rows_skipped`*:: + -- -This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - -type: keyword +type: long -- -*`rsa.misc.vsys`*:: +*`suricata.eve.stats.flow_mgr.closed_pruned`*:: + -- -This key captures Virtual System Name - -type: keyword +type: long -- -*`rsa.misc.connection_id`*:: +*`suricata.eve.stats.flow_mgr.new_pruned`*:: + -- -This key captures the Connection ID - -type: keyword +type: long -- -*`rsa.misc.reference_id2`*:: +*`suricata.eve.stats.flow_mgr.flows_removed`*:: + -- -This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - -type: keyword +type: long -- -*`rsa.misc.sensor`*:: +*`suricata.eve.stats.flow_mgr.bypassed_pruned`*:: + -- -This key captures Name of the sensor. Typically used in IDS/IPS based devices - -type: keyword +type: long -- -*`rsa.misc.sig_id`*:: +*`suricata.eve.stats.flow_mgr.est_pruned`*:: + -- -This key captures IDS/IPS Int Signature ID - type: long -- -*`rsa.misc.port_name`*:: +*`suricata.eve.stats.flow_mgr.flows_timeout_inuse`*:: + -- -This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). - -type: keyword +type: long -- -*`rsa.misc.rule_group`*:: +*`suricata.eve.stats.flow_mgr.flows_checked`*:: + -- -This key captures the Rule group name - -type: keyword +type: long -- -*`rsa.misc.risk_num`*:: +*`suricata.eve.stats.flow_mgr.rows_maxlen`*:: + -- -This key captures a Numeric Risk value - -type: double +type: long -- -*`rsa.misc.trigger_val`*:: +*`suricata.eve.stats.flow_mgr.rows_checked`*:: + -- -This key captures the Value of the trigger or threshold condition. - -type: keyword +type: long -- -*`rsa.misc.log_session_id1`*:: +*`suricata.eve.stats.flow_mgr.rows_empty`*:: + -- -This key is used to capture a Linked (Related) Session ID from the session directly - -type: keyword +type: long -- -*`rsa.misc.comp_version`*:: + + +*`suricata.eve.stats.app_layer.flow.tls`*:: + -- -This key captures the Version level of a sub-component of a product. - -type: keyword +type: long -- -*`rsa.misc.content_version`*:: +*`suricata.eve.stats.app_layer.flow.ftp`*:: + -- -This key captures Version level of a signature or database content. - -type: keyword +type: long -- -*`rsa.misc.hardware_id`*:: +*`suricata.eve.stats.app_layer.flow.http`*:: + -- -This key is used to capture unique identifier for a device or system (NOT a Mac address) - -type: keyword +type: long -- -*`rsa.misc.risk`*:: +*`suricata.eve.stats.app_layer.flow.failed_udp`*:: + -- -This key captures the non-numeric risk value - -type: keyword +type: long -- -*`rsa.misc.event_id`*:: +*`suricata.eve.stats.app_layer.flow.dns_udp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.reason`*:: +*`suricata.eve.stats.app_layer.flow.dns_tcp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.status`*:: +*`suricata.eve.stats.app_layer.flow.smtp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.mail_id`*:: +*`suricata.eve.stats.app_layer.flow.failed_tcp`*:: + -- -This key is used to capture the mailbox id/name - -type: keyword +type: long -- -*`rsa.misc.rule_uid`*:: +*`suricata.eve.stats.app_layer.flow.msn`*:: + -- -This key is the Unique Identifier for a rule. - -type: keyword +type: long -- -*`rsa.misc.trigger_desc`*:: +*`suricata.eve.stats.app_layer.flow.ssh`*:: + -- -This key captures the Description of the trigger or threshold condition. - -type: keyword +type: long -- -*`rsa.misc.inout`*:: +*`suricata.eve.stats.app_layer.flow.imap`*:: + -- -type: keyword +type: long -- -*`rsa.misc.p_msgid`*:: +*`suricata.eve.stats.app_layer.flow.dcerpc_udp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.data_type`*:: +*`suricata.eve.stats.app_layer.flow.dcerpc_tcp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.msgIdPart4`*:: +*`suricata.eve.stats.app_layer.flow.smb`*:: + -- -type: keyword +type: long -- -*`rsa.misc.error`*:: + +*`suricata.eve.stats.app_layer.tx.tls`*:: + -- -This key captures All non successful Error codes or responses - -type: keyword +type: long -- -*`rsa.misc.index`*:: +*`suricata.eve.stats.app_layer.tx.ftp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.listnum`*:: +*`suricata.eve.stats.app_layer.tx.http`*:: + -- -This key is used to capture listname or listnumber, primarily for collecting access-list - -type: keyword +type: long -- -*`rsa.misc.ntype`*:: +*`suricata.eve.stats.app_layer.tx.dns_udp`*:: + -- -type: keyword +type: long -- -*`rsa.misc.observed_val`*:: +*`suricata.eve.stats.app_layer.tx.dns_tcp`*:: + -- -This key captures the Value observed (from the perspective of the device generating the log). - -type: keyword +type: long -- -*`rsa.misc.policy_value`*:: +*`suricata.eve.stats.app_layer.tx.smtp`*:: + -- -This key captures the contents of the policy. This contains details about the policy - -type: keyword +type: long -- -*`rsa.misc.pool_name`*:: +*`suricata.eve.stats.app_layer.tx.ssh`*:: + -- -This key captures the name of a resource pool - -type: keyword +type: long -- -*`rsa.misc.rule_template`*:: +*`suricata.eve.stats.app_layer.tx.dcerpc_udp`*:: + -- -A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template +type: long -type: keyword +-- + +*`suricata.eve.stats.app_layer.tx.dcerpc_tcp`*:: ++ +-- +type: long -- -*`rsa.misc.count`*:: +*`suricata.eve.stats.app_layer.tx.smb`*:: + -- -type: keyword +type: long -- -*`rsa.misc.number`*:: + +*`suricata.eve.tls.notbefore`*:: + -- -type: keyword +type: date -- -*`rsa.misc.sigcat`*:: +*`suricata.eve.tls.issuerdn`*:: + -- type: keyword -- -*`rsa.misc.type`*:: +*`suricata.eve.tls.sni`*:: + -- type: keyword -- -*`rsa.misc.comments`*:: +*`suricata.eve.tls.version`*:: + -- -Comment information provided in the log message - type: keyword -- -*`rsa.misc.doc_number`*:: +*`suricata.eve.tls.session_resumed`*:: + -- -This key captures File Identification number - -type: long +type: boolean -- -*`rsa.misc.expected_val`*:: +*`suricata.eve.tls.fingerprint`*:: + -- -This key captures the Value expected (from the perspective of the device generating the log). - type: keyword -- -*`rsa.misc.job_num`*:: +*`suricata.eve.tls.serial`*:: + -- -This key captures the Job Number - type: keyword -- -*`rsa.misc.spi_dst`*:: +*`suricata.eve.tls.notafter`*:: + -- -Destination SPI Index - -type: keyword +type: date -- -*`rsa.misc.spi_src`*:: +*`suricata.eve.tls.subject`*:: + -- -Source SPI Index - type: keyword -- -*`rsa.misc.code`*:: + +*`suricata.eve.tls.ja3s.string`*:: + -- type: keyword -- -*`rsa.misc.agent_id`*:: +*`suricata.eve.tls.ja3s.hash`*:: + -- -This key is used to capture agent id - type: keyword -- -*`rsa.misc.message_body`*:: + +*`suricata.eve.tls.ja3.string`*:: + -- -This key captures the The contents of the message body. - type: keyword -- -*`rsa.misc.phone`*:: +*`suricata.eve.tls.ja3.hash`*:: + -- type: keyword -- -*`rsa.misc.sig_id_str`*:: +*`suricata.eve.app_proto_ts`*:: + -- -This key captures a string object of the sigid variable. - type: keyword -- -*`rsa.misc.cmd`*:: + +*`suricata.eve.flow.bytes_toclient`*:: + -- -type: keyword +type: alias + +alias to: destination.bytes -- -*`rsa.misc.misc`*:: +*`suricata.eve.flow.start`*:: + -- -type: keyword +type: alias + +alias to: event.start -- -*`rsa.misc.name`*:: +*`suricata.eve.flow.pkts_toclient`*:: + -- -type: keyword +type: alias + +alias to: destination.packets -- -*`rsa.misc.cpu`*:: +*`suricata.eve.flow.age`*:: + -- -This key is the CPU time used in the execution of the event being recorded. - type: long -- -*`rsa.misc.event_desc`*:: +*`suricata.eve.flow.state`*:: + -- -This key is used to capture a description of an event available directly or inferred - type: keyword -- -*`rsa.misc.sig_id1`*:: +*`suricata.eve.flow.bytes_toserver`*:: + -- -This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id +type: alias -type: long +alias to: source.bytes -- -*`rsa.misc.im_buddyid`*:: +*`suricata.eve.flow.reason`*:: + -- type: keyword -- -*`rsa.misc.im_client`*:: +*`suricata.eve.flow.pkts_toserver`*:: + -- -type: keyword +type: alias + +alias to: source.packets -- -*`rsa.misc.im_userid`*:: +*`suricata.eve.flow.end`*:: + -- -type: keyword +type: date -- -*`rsa.misc.pid`*:: +*`suricata.eve.flow.alerted`*:: + -- -type: keyword +type: boolean -- -*`rsa.misc.priority`*:: +*`suricata.eve.app_proto`*:: + -- -type: keyword +type: alias + +alias to: network.protocol -- -*`rsa.misc.context_subject`*:: +*`suricata.eve.tx_id`*:: + -- -This key is to be used in an audit context where the subject is the object being identified - -type: keyword +type: long -- -*`rsa.misc.context_target`*:: +*`suricata.eve.app_proto_tc`*:: + -- type: keyword -- -*`rsa.misc.cve`*:: + +*`suricata.eve.smtp.rcpt_to`*:: + -- -This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - type: keyword -- -*`rsa.misc.fcatnum`*:: +*`suricata.eve.smtp.mail_from`*:: + -- -This key captures Filter Category Number. Legacy Usage - type: keyword -- -*`rsa.misc.library`*:: +*`suricata.eve.smtp.helo`*:: + -- -This key is used to capture library information in mainframe devices - type: keyword -- -*`rsa.misc.parent_node`*:: +*`suricata.eve.app_proto_expected`*:: + -- -This key captures the Parent Node Name. Must be related to node variable. - type: keyword -- -*`rsa.misc.risk_info`*:: +[[exported-fields-symantec]] +== Symantec AntiVirus/Endpoint Protection fields + +symantec fields. + + + +*`network.interface.name`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Name of the network interface where the traffic has been observed. + type: keyword -- -*`rsa.misc.tcp_flags`*:: + + +*`rsa.internal.msg`*:: + -- -This key is captures the TCP flags set in any packet of session +This key is used to capture the raw message that comes into the Log Decoder -type: long +type: keyword -- -*`rsa.misc.tos`*:: +*`rsa.internal.messageid`*:: + -- -This key describes the type of service - -type: long +type: keyword -- -*`rsa.misc.vm_target`*:: +*`rsa.internal.event_desc`*:: + -- -VMWare Target **VMWARE** only varaible. - type: keyword -- -*`rsa.misc.workspace`*:: +*`rsa.internal.message`*:: + -- -This key captures Workspace Description +This key captures the contents of instant messages type: keyword -- -*`rsa.misc.command`*:: +*`rsa.internal.time`*:: + -- -type: keyword +This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. + +type: date -- -*`rsa.misc.event_category`*:: +*`rsa.internal.level`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: long -- -*`rsa.misc.facilityname`*:: +*`rsa.internal.msg_id`*:: + -- +This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.forensic_info`*:: +*`rsa.internal.msg_vid`*:: + -- +This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.jobname`*:: +*`rsa.internal.data`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.mode`*:: +*`rsa.internal.obj_server`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.policy`*:: +*`rsa.internal.obj_val`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.policy_waiver`*:: +*`rsa.internal.resource`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.second`*:: +*`rsa.internal.obj_id`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.space1`*:: +*`rsa.internal.statement`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.subcategory`*:: +*`rsa.internal.audit_class`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.tbdstr2`*:: +*`rsa.internal.entry`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.alert_id`*:: +*`rsa.internal.hcode`*:: + -- -Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.checksum_dst`*:: +*`rsa.internal.inode`*:: + -- -This key is used to capture the checksum or hash of the the target entity such as a process or file. +Deprecated key defined only in table map. -type: keyword +type: long -- -*`rsa.misc.checksum_src`*:: +*`rsa.internal.resource_class`*:: + -- -This key is used to capture the checksum or hash of the source entity such as a file or process. +Deprecated key defined only in table map. type: keyword -- -*`rsa.misc.fresult`*:: +*`rsa.internal.dead`*:: + -- -This key captures the Filter Result +Deprecated key defined only in table map. type: long -- -*`rsa.misc.payload_dst`*:: +*`rsa.internal.feed_desc`*:: + -- -This key is used to capture destination payload +This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.payload_src`*:: +*`rsa.internal.feed_name`*:: + -- -This key is used to capture source payload +This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.pool_id`*:: +*`rsa.internal.cid`*:: + -- -This key captures the identifier (typically numeric field) of a resource pool +This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.process_id_val`*:: +*`rsa.internal.device_class`*:: + -- -This key is a failure key for Process ID when it is not an integer value +This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.risk_num_comm`*:: +*`rsa.internal.device_group`*:: + -- -This key captures Risk Number Community +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: double +type: keyword -- -*`rsa.misc.risk_num_next`*:: +*`rsa.internal.device_host`*:: + -- -This key captures Risk Number NextGen +This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: double +type: keyword -- -*`rsa.misc.risk_num_sand`*:: +*`rsa.internal.device_ip`*:: + -- -This key captures Risk Number SandBox +This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: double +type: ip -- -*`rsa.misc.risk_num_static`*:: +*`rsa.internal.device_ipv6`*:: + -- -This key captures Risk Number Static +This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness -type: double +type: ip -- -*`rsa.misc.risk_suspicious`*:: +*`rsa.internal.device_type`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.risk_warning`*:: +*`rsa.internal.device_type_id`*:: + -- -Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) +Deprecated key defined only in table map. -type: keyword +type: long -- -*`rsa.misc.snmp_oid`*:: +*`rsa.internal.did`*:: + -- -SNMP Object Identifier +This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- -*`rsa.misc.sql`*:: +*`rsa.internal.entropy_req`*:: + -- -This key captures the SQL query +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: keyword +type: long -- -*`rsa.misc.vuln_ref`*:: +*`rsa.internal.entropy_res`*:: + -- -This key captures the Vulnerability Reference details +This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration -type: keyword +type: long -- -*`rsa.misc.acl_id`*:: +*`rsa.internal.event_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.acl_op`*:: +*`rsa.internal.feed_category`*:: + -- +This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.acl_pos`*:: +*`rsa.internal.forward_ip`*:: + -- -type: keyword +This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. + +type: ip -- -*`rsa.misc.acl_table`*:: +*`rsa.internal.forward_ipv6`*:: + -- -type: keyword +This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: ip -- -*`rsa.misc.admin`*:: +*`rsa.internal.header_id`*:: + -- +This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.alarm_id`*:: +*`rsa.internal.lc_cid`*:: + -- +This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.alarmname`*:: +*`rsa.internal.lc_ctime`*:: + -- -type: keyword +This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: date -- -*`rsa.misc.app_id`*:: +*`rsa.internal.mcb_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.audit`*:: +*`rsa.internal.mcb_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most + +type: long -- -*`rsa.misc.audit_object`*:: +*`rsa.internal.mcbc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.auditdata`*:: +*`rsa.internal.mcbc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams + +type: long -- -*`rsa.misc.benchmark`*:: +*`rsa.internal.medium`*:: + -- -type: keyword +This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session + +type: long -- -*`rsa.misc.bypass`*:: +*`rsa.internal.node_name`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cache`*:: +*`rsa.internal.nwe_callback_id`*:: + -- +This key denotes that event is endpoint related + type: keyword -- -*`rsa.misc.cache_hit`*:: +*`rsa.internal.parse_error`*:: + -- +This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cefversion`*:: +*`rsa.internal.payload_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.cfg_attr`*:: +*`rsa.internal.payload_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep + +type: long -- -*`rsa.misc.cfg_obj`*:: +*`rsa.internal.process_vid_dst`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. + type: keyword -- -*`rsa.misc.cfg_path`*:: +*`rsa.internal.process_vid_src`*:: + -- +Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. + type: keyword -- -*`rsa.misc.changes`*:: +*`rsa.internal.rid`*:: + -- -type: keyword +This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.client_ip`*:: +*`rsa.internal.session_split`*:: + -- +This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.clustermembers`*:: +*`rsa.internal.site`*:: + -- +Deprecated key defined only in table map. + type: keyword -- -*`rsa.misc.cn_acttimeout`*:: +*`rsa.internal.size`*:: + -- -type: keyword +This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + +type: long -- -*`rsa.misc.cn_asn_src`*:: +*`rsa.internal.sourcefile`*:: + -- +This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness + type: keyword -- -*`rsa.misc.cn_bgpv4nxthop`*:: +*`rsa.internal.ubc_req`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.cn_ctr_dst_code`*:: +*`rsa.internal.ubc_res`*:: + -- -type: keyword +This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once + +type: long -- -*`rsa.misc.cn_dst_tos`*:: +*`rsa.internal.word`*:: + -- +This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log + type: keyword -- -*`rsa.misc.cn_dst_vlan`*:: + +*`rsa.time.event_time`*:: + -- -type: keyword +This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form + +type: date -- -*`rsa.misc.cn_engine_id`*:: +*`rsa.time.duration_time`*:: + -- -type: keyword +This key is used to capture the normalized duration/lifetime in seconds. + +type: double -- -*`rsa.misc.cn_engine_type`*:: +*`rsa.time.event_time_str`*:: + -- +This key is used to capture the incomplete time mentioned in a session as a string + type: keyword -- -*`rsa.misc.cn_f_switch`*:: +*`rsa.time.starttime`*:: + -- -type: keyword +This key is used to capture the Start time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cn_flowsampid`*:: +*`rsa.time.month`*:: + -- type: keyword -- -*`rsa.misc.cn_flowsampintv`*:: +*`rsa.time.day`*:: + -- type: keyword -- -*`rsa.misc.cn_flowsampmode`*:: +*`rsa.time.endtime`*:: + -- -type: keyword +This key is used to capture the End time mentioned in a session in a standard form + +type: date -- -*`rsa.misc.cn_inacttimeout`*:: +*`rsa.time.timezone`*:: + -- +This key is used to capture the timezone of the Event Time + type: keyword -- -*`rsa.misc.cn_inpermbyts`*:: +*`rsa.time.duration_str`*:: + -- +A text string version of the duration + type: keyword -- -*`rsa.misc.cn_inpermpckts`*:: +*`rsa.time.date`*:: + -- type: keyword -- -*`rsa.misc.cn_invalid`*:: +*`rsa.time.year`*:: + -- type: keyword -- -*`rsa.misc.cn_ip_proto_ver`*:: +*`rsa.time.recorded_time`*:: + -- -type: keyword +The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. + +type: date -- -*`rsa.misc.cn_ipv4_ident`*:: +*`rsa.time.datetime`*:: + -- type: keyword -- -*`rsa.misc.cn_l_switch`*:: +*`rsa.time.effective_time`*:: + -- -type: keyword +This key is the effective time referenced by an individual event in a Standard Timestamp format + +type: date -- -*`rsa.misc.cn_log_did`*:: +*`rsa.time.expire_time`*:: + -- -type: keyword +This key is the timestamp that explicitly refers to an expiration. + +type: date -- -*`rsa.misc.cn_log_rid`*:: +*`rsa.time.process_time`*:: + -- +Deprecated, use duration.time + type: keyword -- -*`rsa.misc.cn_max_ttl`*:: +*`rsa.time.hour`*:: + -- type: keyword -- -*`rsa.misc.cn_maxpcktlen`*:: +*`rsa.time.min`*:: + -- type: keyword -- -*`rsa.misc.cn_min_ttl`*:: +*`rsa.time.timestamp`*:: + -- type: keyword -- -*`rsa.misc.cn_minpcktlen`*:: +*`rsa.time.event_queue_time`*:: + -- -type: keyword +This key is the Time that the event was queued. + +type: date -- -*`rsa.misc.cn_mpls_lbl_1`*:: +*`rsa.time.p_time1`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_10`*:: +*`rsa.time.tzone`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_2`*:: +*`rsa.time.eventtime`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_3`*:: +*`rsa.time.gmtdate`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_4`*:: +*`rsa.time.gmttime`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_5`*:: +*`rsa.time.p_date`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_6`*:: +*`rsa.time.p_month`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_7`*:: +*`rsa.time.p_time`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_8`*:: +*`rsa.time.p_time2`*:: + -- type: keyword -- -*`rsa.misc.cn_mpls_lbl_9`*:: +*`rsa.time.p_year`*:: + -- type: keyword -- -*`rsa.misc.cn_mplstoplabel`*:: +*`rsa.time.expire_time_str`*:: + -- +This key is used to capture incomplete timestamp that explicitly refers to an expiration. + type: keyword -- -*`rsa.misc.cn_mplstoplabip`*:: +*`rsa.time.stamp`*:: + -- -type: keyword +Deprecated key defined only in table map. + +type: date -- -*`rsa.misc.cn_mul_dst_byt`*:: + +*`rsa.misc.action`*:: + -- type: keyword -- -*`rsa.misc.cn_mul_dst_pks`*:: +*`rsa.misc.result`*:: + -- +This key is used to capture the outcome/result string value of an action in a session. + type: keyword -- -*`rsa.misc.cn_muligmptype`*:: +*`rsa.misc.severity`*:: + -- +This key is used to capture the severity given the session + type: keyword -- -*`rsa.misc.cn_sampalgo`*:: +*`rsa.misc.event_type`*:: + -- +This key captures the event category type as specified by the event source. + type: keyword -- -*`rsa.misc.cn_sampint`*:: +*`rsa.misc.reference_id`*:: + -- +This key is used to capture an event id from the session directly + type: keyword -- -*`rsa.misc.cn_seqctr`*:: +*`rsa.misc.version`*:: + -- +This key captures Version of the application or OS which is generating the event. + type: keyword -- -*`rsa.misc.cn_spackets`*:: +*`rsa.misc.disposition`*:: + -- +This key captures the The end state of an action. + type: keyword -- -*`rsa.misc.cn_src_tos`*:: +*`rsa.misc.result_code`*:: + -- +This key is used to capture the outcome/result numeric value of an action in a session + type: keyword -- -*`rsa.misc.cn_src_vlan`*:: +*`rsa.misc.category`*:: + -- +This key is used to capture the category of an event given by the vendor in the session + type: keyword -- -*`rsa.misc.cn_sysuptime`*:: +*`rsa.misc.obj_name`*:: + -- +This is used to capture name of object + type: keyword -- -*`rsa.misc.cn_template_id`*:: +*`rsa.misc.obj_type`*:: + -- +This is used to capture type of object + type: keyword -- -*`rsa.misc.cn_totbytsexp`*:: +*`rsa.misc.event_source`*:: + -- +This key captures Source of the event that’s not a hostname + type: keyword -- -*`rsa.misc.cn_totflowexp`*:: +*`rsa.misc.log_session_id`*:: + -- +This key is used to capture a sessionid from the session directly + type: keyword -- -*`rsa.misc.cn_totpcktsexp`*:: +*`rsa.misc.group`*:: + -- +This key captures the Group Name value + type: keyword -- -*`rsa.misc.cn_unixnanosecs`*:: +*`rsa.misc.policy_name`*:: + -- +This key is used to capture the Policy Name only. + type: keyword -- -*`rsa.misc.cn_v6flowlabel`*:: +*`rsa.misc.rule_name`*:: + -- +This key captures the Rule Name + type: keyword -- -*`rsa.misc.cn_v6optheaders`*:: +*`rsa.misc.context`*:: + -- +This key captures Information which adds additional context to the event. + type: keyword -- -*`rsa.misc.comp_class`*:: +*`rsa.misc.change_new`*:: + -- +This key is used to capture the new values of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.comp_name`*:: +*`rsa.misc.space`*:: + -- type: keyword -- -*`rsa.misc.comp_rbytes`*:: +*`rsa.misc.client`*:: + -- +This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. + type: keyword -- -*`rsa.misc.comp_sbytes`*:: +*`rsa.misc.msgIdPart1`*:: + -- type: keyword -- -*`rsa.misc.cpu_data`*:: +*`rsa.misc.msgIdPart2`*:: + -- type: keyword -- -*`rsa.misc.criticality`*:: +*`rsa.misc.change_old`*:: + -- +This key is used to capture the old value of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.cs_agency_dst`*:: +*`rsa.misc.operation_id`*:: + -- +An alert number or operation number. The values should be unique and non-repeating. + type: keyword -- -*`rsa.misc.cs_analyzedby`*:: +*`rsa.misc.event_state`*:: + -- +This key captures the current state of the object/item referenced within the event. Describing an on-going event. + type: keyword -- -*`rsa.misc.cs_av_other`*:: +*`rsa.misc.group_object`*:: + -- +This key captures a collection/grouping of entities. Specific usage + type: keyword -- -*`rsa.misc.cs_av_primary`*:: +*`rsa.misc.node`*:: + -- +Common use case is the node name within a cluster. The cluster name is reflected by the host name. + type: keyword -- -*`rsa.misc.cs_av_secondary`*:: +*`rsa.misc.rule`*:: + -- +This key captures the Rule number + type: keyword -- -*`rsa.misc.cs_bgpv6nxthop`*:: +*`rsa.misc.device_name`*:: + -- +This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc + type: keyword -- -*`rsa.misc.cs_bit9status`*:: +*`rsa.misc.param`*:: + -- +This key is the parameters passed as part of a command or application, etc. + type: keyword -- -*`rsa.misc.cs_context`*:: +*`rsa.misc.change_attrib`*:: + -- +This key is used to capture the name of the attribute that’s changing in a session + type: keyword -- -*`rsa.misc.cs_control`*:: +*`rsa.misc.event_computer`*:: + -- +This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. + type: keyword -- -*`rsa.misc.cs_data`*:: +*`rsa.misc.reference_id1`*:: + -- +This key is for Linked ID to be used as an addition to "reference.id" + type: keyword -- -*`rsa.misc.cs_datecret`*:: +*`rsa.misc.event_log`*:: + -- +This key captures the Name of the event log + type: keyword -- -*`rsa.misc.cs_dst_tld`*:: +*`rsa.misc.OS`*:: + -- +This key captures the Name of the Operating System + type: keyword -- -*`rsa.misc.cs_eth_dst_ven`*:: +*`rsa.misc.terminal`*:: + -- +This key captures the Terminal Names only + type: keyword -- -*`rsa.misc.cs_eth_src_ven`*:: +*`rsa.misc.msgIdPart3`*:: + -- type: keyword -- -*`rsa.misc.cs_event_uuid`*:: +*`rsa.misc.filter`*:: + -- +This key captures Filter used to reduce result set + type: keyword -- -*`rsa.misc.cs_filetype`*:: +*`rsa.misc.serial_number`*:: + -- +This key is the Serial number associated with a physical asset. + type: keyword -- -*`rsa.misc.cs_fld`*:: +*`rsa.misc.checksum`*:: + -- +This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. + type: keyword -- -*`rsa.misc.cs_if_desc`*:: +*`rsa.misc.event_user`*:: + -- +This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. + type: keyword -- -*`rsa.misc.cs_if_name`*:: +*`rsa.misc.virusname`*:: + -- +This key captures the name of the virus + type: keyword -- -*`rsa.misc.cs_ip_next_hop`*:: +*`rsa.misc.content_type`*:: + -- +This key is used to capture Content Type only. + type: keyword -- -*`rsa.misc.cs_ipv4dstpre`*:: +*`rsa.misc.group_id`*:: + -- +This key captures Group ID Number (related to the group name) + type: keyword -- -*`rsa.misc.cs_ipv4srcpre`*:: +*`rsa.misc.policy_id`*:: + -- +This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise + type: keyword -- -*`rsa.misc.cs_lifetime`*:: +*`rsa.misc.vsys`*:: + -- +This key captures Virtual System Name + type: keyword -- -*`rsa.misc.cs_log_medium`*:: +*`rsa.misc.connection_id`*:: + -- +This key captures the Connection ID + type: keyword -- -*`rsa.misc.cs_loginname`*:: +*`rsa.misc.reference_id2`*:: + -- +This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. + type: keyword -- -*`rsa.misc.cs_modulescore`*:: +*`rsa.misc.sensor`*:: + -- +This key captures Name of the sensor. Typically used in IDS/IPS based devices + type: keyword -- -*`rsa.misc.cs_modulesign`*:: +*`rsa.misc.sig_id`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID + +type: long -- -*`rsa.misc.cs_opswatresult`*:: +*`rsa.misc.port_name`*:: + -- +This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). + type: keyword -- -*`rsa.misc.cs_payload`*:: +*`rsa.misc.rule_group`*:: + -- +This key captures the Rule group name + type: keyword -- -*`rsa.misc.cs_registrant`*:: +*`rsa.misc.risk_num`*:: + -- -type: keyword +This key captures a Numeric Risk value + +type: double -- -*`rsa.misc.cs_registrar`*:: +*`rsa.misc.trigger_val`*:: + -- +This key captures the Value of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.cs_represult`*:: +*`rsa.misc.log_session_id1`*:: + -- +This key is used to capture a Linked (Related) Session ID from the session directly + type: keyword -- -*`rsa.misc.cs_rpayload`*:: +*`rsa.misc.comp_version`*:: + -- +This key captures the Version level of a sub-component of a product. + type: keyword -- -*`rsa.misc.cs_sampler_name`*:: +*`rsa.misc.content_version`*:: + -- +This key captures Version level of a signature or database content. + type: keyword -- -*`rsa.misc.cs_sourcemodule`*:: +*`rsa.misc.hardware_id`*:: + -- +This key is used to capture unique identifier for a device or system (NOT a Mac address) + type: keyword -- -*`rsa.misc.cs_streams`*:: +*`rsa.misc.risk`*:: + -- +This key captures the non-numeric risk value + type: keyword -- -*`rsa.misc.cs_targetmodule`*:: +*`rsa.misc.event_id`*:: + -- type: keyword -- -*`rsa.misc.cs_v6nxthop`*:: +*`rsa.misc.reason`*:: + -- type: keyword -- -*`rsa.misc.cs_whois_server`*:: +*`rsa.misc.status`*:: + -- type: keyword -- -*`rsa.misc.cs_yararesult`*:: +*`rsa.misc.mail_id`*:: + -- +This key is used to capture the mailbox id/name + type: keyword -- -*`rsa.misc.description`*:: +*`rsa.misc.rule_uid`*:: + -- +This key is the Unique Identifier for a rule. + type: keyword -- -*`rsa.misc.devvendor`*:: +*`rsa.misc.trigger_desc`*:: + -- +This key captures the Description of the trigger or threshold condition. + type: keyword -- -*`rsa.misc.distance`*:: +*`rsa.misc.inout`*:: + -- type: keyword -- -*`rsa.misc.dstburb`*:: +*`rsa.misc.p_msgid`*:: + -- type: keyword -- -*`rsa.misc.edomain`*:: +*`rsa.misc.data_type`*:: + -- type: keyword -- -*`rsa.misc.edomaub`*:: +*`rsa.misc.msgIdPart4`*:: + -- type: keyword -- -*`rsa.misc.euid`*:: +*`rsa.misc.error`*:: + -- +This key captures All non successful Error codes or responses + type: keyword -- -*`rsa.misc.facility`*:: +*`rsa.misc.index`*:: + -- type: keyword -- -*`rsa.misc.finterface`*:: +*`rsa.misc.listnum`*:: + -- +This key is used to capture listname or listnumber, primarily for collecting access-list + type: keyword -- -*`rsa.misc.flags`*:: +*`rsa.misc.ntype`*:: + -- type: keyword -- -*`rsa.misc.gaddr`*:: +*`rsa.misc.observed_val`*:: + -- +This key captures the Value observed (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.id3`*:: +*`rsa.misc.policy_value`*:: + -- +This key captures the contents of the policy. This contains details about the policy + type: keyword -- -*`rsa.misc.im_buddyname`*:: +*`rsa.misc.pool_name`*:: + -- +This key captures the name of a resource pool + type: keyword -- -*`rsa.misc.im_croomid`*:: +*`rsa.misc.rule_template`*:: + -- +A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template + type: keyword -- -*`rsa.misc.im_croomtype`*:: +*`rsa.misc.count`*:: + -- type: keyword -- -*`rsa.misc.im_members`*:: +*`rsa.misc.number`*:: + -- type: keyword -- -*`rsa.misc.im_username`*:: +*`rsa.misc.sigcat`*:: + -- type: keyword -- -*`rsa.misc.ipkt`*:: +*`rsa.misc.type`*:: + -- type: keyword -- -*`rsa.misc.ipscat`*:: +*`rsa.misc.comments`*:: + -- +Comment information provided in the log message + type: keyword -- -*`rsa.misc.ipspri`*:: +*`rsa.misc.doc_number`*:: + -- -type: keyword +This key captures File Identification number + +type: long -- -*`rsa.misc.latitude`*:: +*`rsa.misc.expected_val`*:: + -- +This key captures the Value expected (from the perspective of the device generating the log). + type: keyword -- -*`rsa.misc.linenum`*:: +*`rsa.misc.job_num`*:: + -- +This key captures the Job Number + type: keyword -- -*`rsa.misc.list_name`*:: +*`rsa.misc.spi_dst`*:: + -- +Destination SPI Index + type: keyword -- -*`rsa.misc.load_data`*:: +*`rsa.misc.spi_src`*:: + -- +Source SPI Index + type: keyword -- -*`rsa.misc.location_floor`*:: +*`rsa.misc.code`*:: + -- type: keyword -- -*`rsa.misc.location_mark`*:: +*`rsa.misc.agent_id`*:: + -- +This key is used to capture agent id + type: keyword -- -*`rsa.misc.log_id`*:: +*`rsa.misc.message_body`*:: + -- +This key captures the The contents of the message body. + type: keyword -- -*`rsa.misc.log_type`*:: +*`rsa.misc.phone`*:: + -- type: keyword -- -*`rsa.misc.logid`*:: +*`rsa.misc.sig_id_str`*:: + -- +This key captures a string object of the sigid variable. + type: keyword -- -*`rsa.misc.logip`*:: +*`rsa.misc.cmd`*:: + -- type: keyword -- -*`rsa.misc.logname`*:: +*`rsa.misc.misc`*:: + -- type: keyword -- -*`rsa.misc.longitude`*:: +*`rsa.misc.name`*:: + -- type: keyword -- -*`rsa.misc.lport`*:: +*`rsa.misc.cpu`*:: + -- -type: keyword +This key is the CPU time used in the execution of the event being recorded. + +type: long -- -*`rsa.misc.mbug_data`*:: +*`rsa.misc.event_desc`*:: + -- +This key is used to capture a description of an event available directly or inferred + type: keyword -- -*`rsa.misc.misc_name`*:: +*`rsa.misc.sig_id1`*:: + -- -type: keyword +This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id + +type: long -- -*`rsa.misc.msg_type`*:: +*`rsa.misc.im_buddyid`*:: + -- type: keyword -- -*`rsa.misc.msgid`*:: +*`rsa.misc.im_client`*:: + -- type: keyword -- -*`rsa.misc.netsessid`*:: +*`rsa.misc.im_userid`*:: + -- type: keyword -- -*`rsa.misc.num`*:: +*`rsa.misc.pid`*:: + -- type: keyword -- -*`rsa.misc.number1`*:: +*`rsa.misc.priority`*:: + -- type: keyword -- -*`rsa.misc.number2`*:: +*`rsa.misc.context_subject`*:: + -- +This key is to be used in an audit context where the subject is the object being identified + type: keyword -- -*`rsa.misc.nwwn`*:: +*`rsa.misc.context_target`*:: + -- type: keyword -- -*`rsa.misc.object`*:: +*`rsa.misc.cve`*:: + -- +This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. + type: keyword -- -*`rsa.misc.operation`*:: +*`rsa.misc.fcatnum`*:: + -- +This key captures Filter Category Number. Legacy Usage + type: keyword -- -*`rsa.misc.opkt`*:: +*`rsa.misc.library`*:: + -- +This key is used to capture library information in mainframe devices + type: keyword -- -*`rsa.misc.orig_from`*:: +*`rsa.misc.parent_node`*:: + -- +This key captures the Parent Node Name. Must be related to node variable. + type: keyword -- -*`rsa.misc.owner_id`*:: +*`rsa.misc.risk_info`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.p_action`*:: +*`rsa.misc.tcp_flags`*:: + -- -type: keyword +This key is captures the TCP flags set in any packet of session + +type: long -- -*`rsa.misc.p_filter`*:: +*`rsa.misc.tos`*:: + -- -type: keyword +This key describes the type of service + +type: long -- -*`rsa.misc.p_group_object`*:: +*`rsa.misc.vm_target`*:: + -- +VMWare Target **VMWARE** only varaible. + type: keyword -- -*`rsa.misc.p_id`*:: +*`rsa.misc.workspace`*:: + -- +This key captures Workspace Description + type: keyword -- -*`rsa.misc.p_msgid1`*:: +*`rsa.misc.command`*:: + -- type: keyword -- -*`rsa.misc.p_msgid2`*:: +*`rsa.misc.event_category`*:: + -- type: keyword -- -*`rsa.misc.p_result1`*:: +*`rsa.misc.facilityname`*:: + -- type: keyword -- -*`rsa.misc.password_chg`*:: +*`rsa.misc.forensic_info`*:: + -- type: keyword -- -*`rsa.misc.password_expire`*:: +*`rsa.misc.jobname`*:: + -- type: keyword -- -*`rsa.misc.permgranted`*:: +*`rsa.misc.mode`*:: + -- type: keyword -- -*`rsa.misc.permwanted`*:: +*`rsa.misc.policy`*:: + -- type: keyword -- -*`rsa.misc.pgid`*:: +*`rsa.misc.policy_waiver`*:: + -- type: keyword -- -*`rsa.misc.policyUUID`*:: +*`rsa.misc.second`*:: + -- type: keyword -- -*`rsa.misc.prog_asp_num`*:: +*`rsa.misc.space1`*:: + -- type: keyword -- -*`rsa.misc.program`*:: +*`rsa.misc.subcategory`*:: + -- type: keyword -- -*`rsa.misc.real_data`*:: +*`rsa.misc.tbdstr2`*:: + -- type: keyword -- -*`rsa.misc.rec_asp_device`*:: +*`rsa.misc.alert_id`*:: + -- +Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.rec_asp_num`*:: +*`rsa.misc.checksum_dst`*:: + -- +This key is used to capture the checksum or hash of the the target entity such as a process or file. + type: keyword -- -*`rsa.misc.rec_library`*:: +*`rsa.misc.checksum_src`*:: + -- +This key is used to capture the checksum or hash of the source entity such as a file or process. + type: keyword -- -*`rsa.misc.recordnum`*:: +*`rsa.misc.fresult`*:: + -- -type: keyword +This key captures the Filter Result + +type: long -- -*`rsa.misc.ruid`*:: +*`rsa.misc.payload_dst`*:: + -- +This key is used to capture destination payload + type: keyword -- -*`rsa.misc.sburb`*:: +*`rsa.misc.payload_src`*:: + -- +This key is used to capture source payload + type: keyword -- -*`rsa.misc.sdomain_fld`*:: +*`rsa.misc.pool_id`*:: + -- +This key captures the identifier (typically numeric field) of a resource pool + type: keyword -- -*`rsa.misc.sec`*:: +*`rsa.misc.process_id_val`*:: + -- +This key is a failure key for Process ID when it is not an integer value + type: keyword -- -*`rsa.misc.sensorname`*:: +*`rsa.misc.risk_num_comm`*:: + -- -type: keyword +This key captures Risk Number Community + +type: double -- -*`rsa.misc.seqnum`*:: +*`rsa.misc.risk_num_next`*:: + -- -type: keyword +This key captures Risk Number NextGen + +type: double -- -*`rsa.misc.session`*:: +*`rsa.misc.risk_num_sand`*:: + -- -type: keyword +This key captures Risk Number SandBox + +type: double -- -*`rsa.misc.sessiontype`*:: +*`rsa.misc.risk_num_static`*:: + -- -type: keyword +This key captures Risk Number Static + +type: double -- -*`rsa.misc.sigUUID`*:: +*`rsa.misc.risk_suspicious`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.spi`*:: +*`rsa.misc.risk_warning`*:: + -- +Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + type: keyword -- -*`rsa.misc.srcburb`*:: +*`rsa.misc.snmp_oid`*:: + -- +SNMP Object Identifier + type: keyword -- -*`rsa.misc.srcdom`*:: +*`rsa.misc.sql`*:: + -- +This key captures the SQL query + type: keyword -- -*`rsa.misc.srcservice`*:: +*`rsa.misc.vuln_ref`*:: + -- +This key captures the Vulnerability Reference details + type: keyword -- -*`rsa.misc.state`*:: +*`rsa.misc.acl_id`*:: + -- type: keyword -- -*`rsa.misc.status1`*:: +*`rsa.misc.acl_op`*:: + -- type: keyword -- -*`rsa.misc.svcno`*:: +*`rsa.misc.acl_pos`*:: + -- type: keyword -- -*`rsa.misc.system`*:: +*`rsa.misc.acl_table`*:: + -- type: keyword -- -*`rsa.misc.tbdstr1`*:: +*`rsa.misc.admin`*:: + -- type: keyword -- -*`rsa.misc.tgtdom`*:: +*`rsa.misc.alarm_id`*:: + -- type: keyword -- -*`rsa.misc.tgtdomain`*:: +*`rsa.misc.alarmname`*:: + -- type: keyword -- -*`rsa.misc.threshold`*:: +*`rsa.misc.app_id`*:: + -- type: keyword -- -*`rsa.misc.type1`*:: +*`rsa.misc.audit`*:: + -- type: keyword -- -*`rsa.misc.udb_class`*:: +*`rsa.misc.audit_object`*:: + -- type: keyword -- -*`rsa.misc.url_fld`*:: +*`rsa.misc.auditdata`*:: + -- type: keyword -- -*`rsa.misc.user_div`*:: +*`rsa.misc.benchmark`*:: + -- type: keyword -- -*`rsa.misc.userid`*:: +*`rsa.misc.bypass`*:: + -- type: keyword -- -*`rsa.misc.username_fld`*:: +*`rsa.misc.cache`*:: + -- type: keyword -- -*`rsa.misc.utcstamp`*:: +*`rsa.misc.cache_hit`*:: + -- type: keyword -- -*`rsa.misc.v_instafname`*:: +*`rsa.misc.cefversion`*:: + -- type: keyword -- -*`rsa.misc.virt_data`*:: +*`rsa.misc.cfg_attr`*:: + -- type: keyword -- -*`rsa.misc.vpnid`*:: +*`rsa.misc.cfg_obj`*:: + -- type: keyword -- -*`rsa.misc.autorun_type`*:: +*`rsa.misc.cfg_path`*:: + -- -This is used to capture Auto Run type - type: keyword -- -*`rsa.misc.cc_number`*:: +*`rsa.misc.changes`*:: + -- -Valid Credit Card Numbers only - -type: long +type: keyword -- -*`rsa.misc.content`*:: +*`rsa.misc.client_ip`*:: + -- -This key captures the content type from protocol headers - type: keyword -- -*`rsa.misc.ein_number`*:: +*`rsa.misc.clustermembers`*:: + -- -Employee Identification Numbers only - -type: long +type: keyword -- -*`rsa.misc.found`*:: +*`rsa.misc.cn_acttimeout`*:: + -- -This is used to capture the results of regex match - type: keyword -- -*`rsa.misc.language`*:: +*`rsa.misc.cn_asn_src`*:: + -- -This is used to capture list of languages the client support and what it prefers - type: keyword -- -*`rsa.misc.lifetime`*:: +*`rsa.misc.cn_bgpv4nxthop`*:: + -- -This key is used to capture the session lifetime in seconds. - -type: long +type: keyword -- -*`rsa.misc.link`*:: +*`rsa.misc.cn_ctr_dst_code`*:: + -- -This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - type: keyword -- -*`rsa.misc.match`*:: +*`rsa.misc.cn_dst_tos`*:: + -- -This key is for regex match name from search.ini - type: keyword -- -*`rsa.misc.param_dst`*:: +*`rsa.misc.cn_dst_vlan`*:: + -- -This key captures the command line/launch argument of the target process or file - type: keyword -- -*`rsa.misc.param_src`*:: +*`rsa.misc.cn_engine_id`*:: + -- -This key captures source parameter - type: keyword -- -*`rsa.misc.search_text`*:: +*`rsa.misc.cn_engine_type`*:: + -- -This key captures the Search Text used - type: keyword -- -*`rsa.misc.sig_name`*:: +*`rsa.misc.cn_f_switch`*:: + -- -This key is used to capture the Signature Name only. - type: keyword -- -*`rsa.misc.snmp_value`*:: +*`rsa.misc.cn_flowsampid`*:: + -- -SNMP set request value - type: keyword -- -*`rsa.misc.streams`*:: +*`rsa.misc.cn_flowsampintv`*:: + -- -This key captures number of streams in session - -type: long +type: keyword -- - -*`rsa.db.index`*:: +*`rsa.misc.cn_flowsampmode`*:: + -- -This key captures IndexID of the index. - type: keyword -- -*`rsa.db.instance`*:: +*`rsa.misc.cn_inacttimeout`*:: + -- -This key is used to capture the database server instance name - type: keyword -- -*`rsa.db.database`*:: +*`rsa.misc.cn_inpermbyts`*:: + -- -This key is used to capture the name of a database or an instance as seen in a session - type: keyword -- -*`rsa.db.transact_id`*:: +*`rsa.misc.cn_inpermpckts`*:: + -- -This key captures the SQL transantion ID of the current session - type: keyword -- -*`rsa.db.permissions`*:: +*`rsa.misc.cn_invalid`*:: + -- -This key captures permission or privilege level assigned to a resource. - type: keyword -- -*`rsa.db.table_name`*:: +*`rsa.misc.cn_ip_proto_ver`*:: + -- -This key is used to capture the table name - type: keyword -- -*`rsa.db.db_id`*:: +*`rsa.misc.cn_ipv4_ident`*:: + -- -This key is used to capture the unique identifier for a database - type: keyword -- -*`rsa.db.db_pid`*:: +*`rsa.misc.cn_l_switch`*:: + -- -This key captures the process id of a connection with database server - -type: long +type: keyword -- -*`rsa.db.lread`*:: +*`rsa.misc.cn_log_did`*:: + -- -This key is used for the number of logical reads - -type: long +type: keyword -- -*`rsa.db.lwrite`*:: +*`rsa.misc.cn_log_rid`*:: + -- -This key is used for the number of logical writes - -type: long +type: keyword -- -*`rsa.db.pread`*:: +*`rsa.misc.cn_max_ttl`*:: + -- -This key is used for the number of physical writes - -type: long +type: keyword -- - -*`rsa.network.alias_host`*:: +*`rsa.misc.cn_maxpcktlen`*:: + -- -This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - type: keyword -- -*`rsa.network.domain`*:: +*`rsa.misc.cn_min_ttl`*:: + -- type: keyword -- -*`rsa.network.host_dst`*:: +*`rsa.misc.cn_minpcktlen`*:: + -- -This key should only be used when it’s a Destination Hostname - type: keyword -- -*`rsa.network.network_service`*:: +*`rsa.misc.cn_mpls_lbl_1`*:: + -- -This is used to capture layer 7 protocols/service names - type: keyword -- -*`rsa.network.interface`*:: +*`rsa.misc.cn_mpls_lbl_10`*:: + -- -This key should be used when the source or destination context of an interface is not clear - type: keyword -- -*`rsa.network.network_port`*:: +*`rsa.misc.cn_mpls_lbl_2`*:: + -- -Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) - -type: long +type: keyword -- -*`rsa.network.eth_host`*:: +*`rsa.misc.cn_mpls_lbl_3`*:: + -- -Deprecated, use alias.mac - type: keyword -- -*`rsa.network.sinterface`*:: +*`rsa.misc.cn_mpls_lbl_4`*:: + -- -This key should only be used when it’s a Source Interface - type: keyword -- -*`rsa.network.dinterface`*:: +*`rsa.misc.cn_mpls_lbl_5`*:: + -- -This key should only be used when it’s a Destination Interface - type: keyword -- -*`rsa.network.vlan`*:: +*`rsa.misc.cn_mpls_lbl_6`*:: + -- -This key should only be used to capture the ID of the Virtual LAN - -type: long +type: keyword -- -*`rsa.network.zone_src`*:: +*`rsa.misc.cn_mpls_lbl_7`*:: + -- -This key should only be used when it’s a Source Zone. - type: keyword -- -*`rsa.network.zone`*:: +*`rsa.misc.cn_mpls_lbl_8`*:: + -- -This key should be used when the source or destination context of a Zone is not clear - type: keyword -- -*`rsa.network.zone_dst`*:: +*`rsa.misc.cn_mpls_lbl_9`*:: + -- -This key should only be used when it’s a Destination Zone. - type: keyword -- -*`rsa.network.gateway`*:: +*`rsa.misc.cn_mplstoplabel`*:: + -- -This key is used to capture the IP Address of the gateway - type: keyword -- -*`rsa.network.icmp_type`*:: +*`rsa.misc.cn_mplstoplabip`*:: + -- -This key is used to capture the ICMP type only - -type: long +type: keyword -- -*`rsa.network.mask`*:: +*`rsa.misc.cn_mul_dst_byt`*:: + -- -This key is used to capture the device network IPmask. - type: keyword -- -*`rsa.network.icmp_code`*:: +*`rsa.misc.cn_mul_dst_pks`*:: + -- -This key is used to capture the ICMP code only - -type: long +type: keyword -- -*`rsa.network.protocol_detail`*:: +*`rsa.misc.cn_muligmptype`*:: + -- -This key should be used to capture additional protocol information - type: keyword -- -*`rsa.network.dmask`*:: +*`rsa.misc.cn_sampalgo`*:: + -- -This key is used for Destionation Device network mask - type: keyword -- -*`rsa.network.port`*:: +*`rsa.misc.cn_sampint`*:: + -- -This key should only be used to capture a Network Port when the directionality is not clear - -type: long +type: keyword -- -*`rsa.network.smask`*:: +*`rsa.misc.cn_seqctr`*:: + -- -This key is used for capturing source Network Mask - type: keyword -- -*`rsa.network.netname`*:: +*`rsa.misc.cn_spackets`*:: + -- -This key is used to capture the network name associated with an IP range. This is configured by the end user. - type: keyword -- -*`rsa.network.paddr`*:: +*`rsa.misc.cn_src_tos`*:: + -- -Deprecated - -type: ip +type: keyword -- -*`rsa.network.faddr`*:: +*`rsa.misc.cn_src_vlan`*:: + -- type: keyword -- -*`rsa.network.lhost`*:: +*`rsa.misc.cn_sysuptime`*:: + -- type: keyword -- -*`rsa.network.origin`*:: +*`rsa.misc.cn_template_id`*:: + -- type: keyword -- -*`rsa.network.remote_domain_id`*:: +*`rsa.misc.cn_totbytsexp`*:: + -- type: keyword -- -*`rsa.network.addr`*:: +*`rsa.misc.cn_totflowexp`*:: + -- type: keyword -- -*`rsa.network.dns_a_record`*:: +*`rsa.misc.cn_totpcktsexp`*:: + -- type: keyword -- -*`rsa.network.dns_ptr_record`*:: +*`rsa.misc.cn_unixnanosecs`*:: + -- type: keyword -- -*`rsa.network.fhost`*:: +*`rsa.misc.cn_v6flowlabel`*:: + -- type: keyword -- -*`rsa.network.fport`*:: +*`rsa.misc.cn_v6optheaders`*:: + -- type: keyword -- -*`rsa.network.laddr`*:: +*`rsa.misc.comp_class`*:: + -- type: keyword -- -*`rsa.network.linterface`*:: +*`rsa.misc.comp_name`*:: + -- type: keyword -- -*`rsa.network.phost`*:: +*`rsa.misc.comp_rbytes`*:: + -- type: keyword -- -*`rsa.network.ad_computer_dst`*:: +*`rsa.misc.comp_sbytes`*:: + -- -Deprecated, use host.dst - type: keyword -- -*`rsa.network.eth_type`*:: +*`rsa.misc.cpu_data`*:: + -- -This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - -type: long +type: keyword -- -*`rsa.network.ip_proto`*:: +*`rsa.misc.criticality`*:: + -- -This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - -type: long +type: keyword -- -*`rsa.network.dns_cname_record`*:: +*`rsa.misc.cs_agency_dst`*:: + -- type: keyword -- -*`rsa.network.dns_id`*:: +*`rsa.misc.cs_analyzedby`*:: + -- type: keyword -- -*`rsa.network.dns_opcode`*:: +*`rsa.misc.cs_av_other`*:: + -- type: keyword -- -*`rsa.network.dns_resp`*:: +*`rsa.misc.cs_av_primary`*:: + -- type: keyword -- -*`rsa.network.dns_type`*:: +*`rsa.misc.cs_av_secondary`*:: + -- type: keyword -- -*`rsa.network.domain1`*:: +*`rsa.misc.cs_bgpv6nxthop`*:: + -- type: keyword -- -*`rsa.network.host_type`*:: +*`rsa.misc.cs_bit9status`*:: + -- type: keyword -- -*`rsa.network.packet_length`*:: +*`rsa.misc.cs_context`*:: + -- type: keyword -- -*`rsa.network.host_orig`*:: +*`rsa.misc.cs_control`*:: + -- -This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - type: keyword -- -*`rsa.network.rpayload`*:: +*`rsa.misc.cs_data`*:: + -- -This key is used to capture the total number of payload bytes seen in the retransmitted packets. - type: keyword -- -*`rsa.network.vlan_name`*:: +*`rsa.misc.cs_datecret`*:: + -- -This key should only be used to capture the name of the Virtual LAN - type: keyword -- - -*`rsa.investigations.ec_activity`*:: +*`rsa.misc.cs_dst_tld`*:: + -- -This key captures the particular event activity(Ex:Logoff) - type: keyword -- -*`rsa.investigations.ec_theme`*:: +*`rsa.misc.cs_eth_dst_ven`*:: + -- -This key captures the Theme of a particular Event(Ex:Authentication) - type: keyword -- -*`rsa.investigations.ec_subject`*:: +*`rsa.misc.cs_eth_src_ven`*:: + -- -This key captures the Subject of a particular Event(Ex:User) - type: keyword -- -*`rsa.investigations.ec_outcome`*:: +*`rsa.misc.cs_event_uuid`*:: + -- -This key captures the outcome of a particular Event(Ex:Success) - type: keyword -- -*`rsa.investigations.event_cat`*:: +*`rsa.misc.cs_filetype`*:: + -- -This key captures the Event category number - -type: long +type: keyword -- -*`rsa.investigations.event_cat_name`*:: +*`rsa.misc.cs_fld`*:: + -- -This key captures the event category name corresponding to the event cat code - type: keyword -- -*`rsa.investigations.event_vcat`*:: +*`rsa.misc.cs_if_desc`*:: + -- -This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - type: keyword -- -*`rsa.investigations.analysis_file`*:: +*`rsa.misc.cs_if_name`*:: + -- -This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - type: keyword -- -*`rsa.investigations.analysis_service`*:: +*`rsa.misc.cs_ip_next_hop`*:: + -- -This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - type: keyword -- -*`rsa.investigations.analysis_session`*:: +*`rsa.misc.cs_ipv4dstpre`*:: + -- -This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - type: keyword -- -*`rsa.investigations.boc`*:: +*`rsa.misc.cs_ipv4srcpre`*:: + -- -This is used to capture behaviour of compromise - type: keyword -- -*`rsa.investigations.eoc`*:: +*`rsa.misc.cs_lifetime`*:: + -- -This is used to capture Enablers of Compromise - type: keyword -- -*`rsa.investigations.inv_category`*:: +*`rsa.misc.cs_log_medium`*:: + -- -This used to capture investigation category - type: keyword -- -*`rsa.investigations.inv_context`*:: +*`rsa.misc.cs_loginname`*:: + -- -This used to capture investigation context - type: keyword -- -*`rsa.investigations.ioc`*:: +*`rsa.misc.cs_modulescore`*:: + -- -This is key capture indicator of compromise - type: keyword -- - -*`rsa.counters.dclass_c1`*:: +*`rsa.misc.cs_modulesign`*:: + -- -This is a generic counter key that should be used with the label dclass.c1.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c2`*:: +*`rsa.misc.cs_opswatresult`*:: + -- -This is a generic counter key that should be used with the label dclass.c2.str only - -type: long +type: keyword -- -*`rsa.counters.event_counter`*:: +*`rsa.misc.cs_payload`*:: + -- -This is used to capture the number of times an event repeated - -type: long +type: keyword -- -*`rsa.counters.dclass_r1`*:: +*`rsa.misc.cs_registrant`*:: + -- -This is a generic ratio key that should be used with the label dclass.r1.str only - type: keyword -- -*`rsa.counters.dclass_c3`*:: +*`rsa.misc.cs_registrar`*:: + -- -This is a generic counter key that should be used with the label dclass.c3.str only - -type: long +type: keyword -- -*`rsa.counters.dclass_c1_str`*:: +*`rsa.misc.cs_represult`*:: + -- -This is a generic counter string key that should be used with the label dclass.c1 only - type: keyword -- -*`rsa.counters.dclass_c2_str`*:: +*`rsa.misc.cs_rpayload`*:: + -- -This is a generic counter string key that should be used with the label dclass.c2 only - type: keyword -- -*`rsa.counters.dclass_r1_str`*:: +*`rsa.misc.cs_sampler_name`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r1 only - type: keyword -- -*`rsa.counters.dclass_r2`*:: +*`rsa.misc.cs_sourcemodule`*:: + -- -This is a generic ratio key that should be used with the label dclass.r2.str only - type: keyword -- -*`rsa.counters.dclass_c3_str`*:: +*`rsa.misc.cs_streams`*:: + -- -This is a generic counter string key that should be used with the label dclass.c3 only - type: keyword -- -*`rsa.counters.dclass_r3`*:: +*`rsa.misc.cs_targetmodule`*:: + -- -This is a generic ratio key that should be used with the label dclass.r3.str only - type: keyword -- -*`rsa.counters.dclass_r2_str`*:: +*`rsa.misc.cs_v6nxthop`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r2 only - type: keyword -- -*`rsa.counters.dclass_r3_str`*:: +*`rsa.misc.cs_whois_server`*:: + -- -This is a generic ratio string key that should be used with the label dclass.r3 only - type: keyword -- - -*`rsa.identity.auth_method`*:: +*`rsa.misc.cs_yararesult`*:: + -- -This key is used to capture authentication methods used only - type: keyword -- -*`rsa.identity.user_role`*:: +*`rsa.misc.description`*:: + -- -This key is used to capture the Role of a user only - type: keyword -- -*`rsa.identity.dn`*:: +*`rsa.misc.devvendor`*:: + -- -X.500 (LDAP) Distinguished Name - type: keyword -- -*`rsa.identity.logon_type`*:: +*`rsa.misc.distance`*:: + -- -This key is used to capture the type of logon method used. - type: keyword -- -*`rsa.identity.profile`*:: +*`rsa.misc.dstburb`*:: + -- -This key is used to capture the user profile - type: keyword -- -*`rsa.identity.accesses`*:: +*`rsa.misc.edomain`*:: + -- -This key is used to capture actual privileges used in accessing an object - type: keyword -- -*`rsa.identity.realm`*:: +*`rsa.misc.edomaub`*:: + -- -Radius realm or similar grouping of accounts - type: keyword -- -*`rsa.identity.user_sid_dst`*:: +*`rsa.misc.euid`*:: + -- -This key captures Destination User Session ID - type: keyword -- -*`rsa.identity.dn_src`*:: +*`rsa.misc.facility`*:: + -- -An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - type: keyword -- -*`rsa.identity.org`*:: +*`rsa.misc.finterface`*:: + -- -This key captures the User organization - type: keyword -- -*`rsa.identity.dn_dst`*:: +*`rsa.misc.flags`*:: + -- -An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - type: keyword -- -*`rsa.identity.firstname`*:: +*`rsa.misc.gaddr`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.lastname`*:: +*`rsa.misc.id3`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.user_dept`*:: +*`rsa.misc.im_buddyname`*:: + -- -User's Department Names only - type: keyword -- -*`rsa.identity.user_sid_src`*:: +*`rsa.misc.im_croomid`*:: + -- -This key captures Source User Session ID - type: keyword -- -*`rsa.identity.federated_sp`*:: +*`rsa.misc.im_croomtype`*:: + -- -This key is the Federated Service Provider. This is the application requesting authentication. - type: keyword -- -*`rsa.identity.federated_idp`*:: +*`rsa.misc.im_members`*:: + -- -This key is the federated Identity Provider. This is the server providing the authentication. - type: keyword -- -*`rsa.identity.logon_type_desc`*:: +*`rsa.misc.im_username`*:: + -- -This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - type: keyword -- -*`rsa.identity.middlename`*:: +*`rsa.misc.ipkt`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - type: keyword -- -*`rsa.identity.password`*:: +*`rsa.misc.ipscat`*:: + -- -This key is for Passwords seen in any session, plain text or encrypted - type: keyword -- -*`rsa.identity.host_role`*:: +*`rsa.misc.ipspri`*:: + -- -This key should only be used to capture the role of a Host Machine - type: keyword -- -*`rsa.identity.ldap`*:: +*`rsa.misc.latitude`*:: + -- -This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context - type: keyword -- -*`rsa.identity.ldap_query`*:: +*`rsa.misc.linenum`*:: + -- -This key is the Search criteria from an LDAP search - type: keyword -- -*`rsa.identity.ldap_response`*:: +*`rsa.misc.list_name`*:: + -- -This key is to capture Results from an LDAP search - type: keyword -- -*`rsa.identity.owner`*:: +*`rsa.misc.load_data`*:: + -- -This is used to capture username the process or service is running as, the author of the task - type: keyword -- -*`rsa.identity.service_account`*:: +*`rsa.misc.location_floor`*:: + -- -This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - type: keyword -- - -*`rsa.email.email_dst`*:: +*`rsa.misc.location_mark`*:: + -- -This key is used to capture the Destination email address only, when the destination context is not clear use email - type: keyword -- -*`rsa.email.email_src`*:: +*`rsa.misc.log_id`*:: + -- -This key is used to capture the source email address only, when the source context is not clear use email - type: keyword -- -*`rsa.email.subject`*:: +*`rsa.misc.log_type`*:: + -- -This key is used to capture the subject string from an Email only. - type: keyword -- -*`rsa.email.email`*:: +*`rsa.misc.logid`*:: + -- -This key is used to capture a generic email address where the source or destination context is not clear - type: keyword -- -*`rsa.email.trans_from`*:: +*`rsa.misc.logip`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.email.trans_to`*:: +*`rsa.misc.logname`*:: + -- -Deprecated key defined only in table map. - type: keyword -- - -*`rsa.file.privilege`*:: +*`rsa.misc.longitude`*:: + -- -Deprecated, use permissions - type: keyword -- -*`rsa.file.attachment`*:: +*`rsa.misc.lport`*:: + -- -This key captures the attachment file name - type: keyword -- -*`rsa.file.filesystem`*:: +*`rsa.misc.mbug_data`*:: + -- type: keyword -- -*`rsa.file.binary`*:: +*`rsa.misc.misc_name`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.file.filename_dst`*:: +*`rsa.misc.msg_type`*:: + -- -This is used to capture name of the file targeted by the action - type: keyword -- -*`rsa.file.filename_src`*:: +*`rsa.misc.msgid`*:: + -- -This is used to capture name of the parent filename, the file which performed the action - type: keyword -- -*`rsa.file.filename_tmp`*:: +*`rsa.misc.netsessid`*:: + -- type: keyword -- -*`rsa.file.directory_dst`*:: +*`rsa.misc.num`*:: + -- -This key is used to capture the directory of the target process or file - type: keyword -- -*`rsa.file.directory_src`*:: +*`rsa.misc.number1`*:: + -- -This key is used to capture the directory of the source process or file - type: keyword -- -*`rsa.file.file_entropy`*:: +*`rsa.misc.number2`*:: + -- -This is used to capture entropy vale of a file - -type: double +type: keyword -- -*`rsa.file.file_vendor`*:: +*`rsa.misc.nwwn`*:: + -- -This is used to capture Company name of file located in version_info - type: keyword -- -*`rsa.file.task_name`*:: +*`rsa.misc.object`*:: + -- -This is used to capture name of the task - type: keyword -- - -*`rsa.web.fqdn`*:: +*`rsa.misc.operation`*:: + -- -Fully Qualified Domain Names - type: keyword -- -*`rsa.web.web_cookie`*:: +*`rsa.misc.opkt`*:: + -- -This key is used to capture the Web cookies specifically. - type: keyword -- -*`rsa.web.alias_host`*:: +*`rsa.misc.orig_from`*:: + -- type: keyword -- -*`rsa.web.reputation_num`*:: +*`rsa.misc.owner_id`*:: + -- -Reputation Number of an entity. Typically used for Web Domains - -type: double +type: keyword -- -*`rsa.web.web_ref_domain`*:: +*`rsa.misc.p_action`*:: + -- -Web referer's domain - type: keyword -- -*`rsa.web.web_ref_query`*:: +*`rsa.misc.p_filter`*:: + -- -This key captures Web referer's query portion of the URL - type: keyword -- -*`rsa.web.remote_domain`*:: +*`rsa.misc.p_group_object`*:: + -- type: keyword -- -*`rsa.web.web_ref_page`*:: +*`rsa.misc.p_id`*:: + -- -This key captures Web referer's page information - type: keyword -- -*`rsa.web.web_ref_root`*:: +*`rsa.misc.p_msgid1`*:: + -- -Web referer's root URL path - type: keyword -- -*`rsa.web.cn_asn_dst`*:: +*`rsa.misc.p_msgid2`*:: + -- type: keyword -- -*`rsa.web.cn_rpackets`*:: +*`rsa.misc.p_result1`*:: + -- type: keyword -- -*`rsa.web.urlpage`*:: +*`rsa.misc.password_chg`*:: + -- type: keyword -- -*`rsa.web.urlroot`*:: +*`rsa.misc.password_expire`*:: + -- type: keyword -- -*`rsa.web.p_url`*:: +*`rsa.misc.permgranted`*:: + -- type: keyword -- -*`rsa.web.p_user_agent`*:: +*`rsa.misc.permwanted`*:: + -- type: keyword -- -*`rsa.web.p_web_cookie`*:: +*`rsa.misc.pgid`*:: + -- type: keyword -- -*`rsa.web.p_web_method`*:: +*`rsa.misc.policyUUID`*:: + -- type: keyword -- -*`rsa.web.p_web_referer`*:: +*`rsa.misc.prog_asp_num`*:: + -- type: keyword -- -*`rsa.web.web_extension_tmp`*:: +*`rsa.misc.program`*:: + -- type: keyword -- -*`rsa.web.web_page`*:: +*`rsa.misc.real_data`*:: + -- type: keyword -- - -*`rsa.threat.threat_category`*:: +*`rsa.misc.rec_asp_device`*:: + -- -This key captures Threat Name/Threat Category/Categorization of alert - type: keyword -- -*`rsa.threat.threat_desc`*:: +*`rsa.misc.rec_asp_num`*:: + -- -This key is used to capture the threat description from the session directly or inferred - type: keyword -- -*`rsa.threat.alert`*:: +*`rsa.misc.rec_library`*:: + -- -This key is used to capture name of the alert - type: keyword -- -*`rsa.threat.threat_source`*:: +*`rsa.misc.recordnum`*:: + -- -This key is used to capture source of the threat - type: keyword -- - -*`rsa.crypto.crypto`*:: +*`rsa.misc.ruid`*:: + -- -This key is used to capture the Encryption Type or Encryption Key only - type: keyword -- -*`rsa.crypto.cipher_src`*:: +*`rsa.misc.sburb`*:: + -- -This key is for Source (Client) Cipher - type: keyword -- -*`rsa.crypto.cert_subject`*:: +*`rsa.misc.sdomain_fld`*:: + -- -This key is used to capture the Certificate organization only - type: keyword -- -*`rsa.crypto.peer`*:: +*`rsa.misc.sec`*:: + -- -This key is for Encryption peer's IP Address - type: keyword -- -*`rsa.crypto.cipher_size_src`*:: +*`rsa.misc.sensorname`*:: + -- -This key captures Source (Client) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ike`*:: +*`rsa.misc.seqnum`*:: + -- -IKE negotiation phase. - type: keyword -- -*`rsa.crypto.scheme`*:: +*`rsa.misc.session`*:: + -- -This key captures the Encryption scheme used - type: keyword -- -*`rsa.crypto.peer_id`*:: +*`rsa.misc.sessiontype`*:: + -- -This key is for Encryption peer’s identity - type: keyword -- -*`rsa.crypto.sig_type`*:: +*`rsa.misc.sigUUID`*:: + -- -This key captures the Signature Type - type: keyword -- -*`rsa.crypto.cert_issuer`*:: +*`rsa.misc.spi`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_name`*:: +*`rsa.misc.srcburb`*:: + -- -Deprecated key defined only in table map. - type: keyword -- -*`rsa.crypto.cert_error`*:: +*`rsa.misc.srcdom`*:: + -- -This key captures the Certificate Error String - type: keyword -- -*`rsa.crypto.cipher_dst`*:: +*`rsa.misc.srcservice`*:: + -- -This key is for Destination (Server) Cipher - type: keyword -- -*`rsa.crypto.cipher_size_dst`*:: +*`rsa.misc.state`*:: + -- -This key captures Destination (Server) Cipher Size - -type: long +type: keyword -- -*`rsa.crypto.ssl_ver_src`*:: +*`rsa.misc.status1`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.d_certauth`*:: +*`rsa.misc.svcno`*:: + -- type: keyword -- -*`rsa.crypto.s_certauth`*:: +*`rsa.misc.system`*:: + -- type: keyword -- -*`rsa.crypto.ike_cookie1`*:: +*`rsa.misc.tbdstr1`*:: + -- -ID of the negotiation — sent for ISAKMP Phase One - type: keyword -- -*`rsa.crypto.ike_cookie2`*:: +*`rsa.misc.tgtdom`*:: + -- -ID of the negotiation — sent for ISAKMP Phase Two - type: keyword -- -*`rsa.crypto.cert_checksum`*:: +*`rsa.misc.tgtdomain`*:: + -- type: keyword -- -*`rsa.crypto.cert_host_cat`*:: +*`rsa.misc.threshold`*:: + -- -This key is used for the hostname category value of a certificate - type: keyword -- -*`rsa.crypto.cert_serial`*:: +*`rsa.misc.type1`*:: + -- -This key is used to capture the Certificate serial number only - type: keyword -- -*`rsa.crypto.cert_status`*:: +*`rsa.misc.udb_class`*:: + -- -This key captures Certificate validation status - type: keyword -- -*`rsa.crypto.ssl_ver_dst`*:: +*`rsa.misc.url_fld`*:: + -- -Deprecated, use version - type: keyword -- -*`rsa.crypto.cert_keysize`*:: +*`rsa.misc.user_div`*:: + -- type: keyword -- -*`rsa.crypto.cert_username`*:: +*`rsa.misc.userid`*:: + -- type: keyword -- -*`rsa.crypto.https_insact`*:: +*`rsa.misc.username_fld`*:: + -- type: keyword -- -*`rsa.crypto.https_valid`*:: +*`rsa.misc.utcstamp`*:: + -- type: keyword -- -*`rsa.crypto.cert_ca`*:: +*`rsa.misc.v_instafname`*:: + -- -This key is used to capture the Certificate signing authority only - type: keyword -- -*`rsa.crypto.cert_common`*:: +*`rsa.misc.virt_data`*:: + -- -This key is used to capture the Certificate common name only - type: keyword -- - -*`rsa.wireless.wlan_ssid`*:: +*`rsa.misc.vpnid`*:: + -- -This key is used to capture the ssid of a Wireless Session - type: keyword -- -*`rsa.wireless.access_point`*:: +*`rsa.misc.autorun_type`*:: + -- -This key is used to capture the access point name. +This is used to capture Auto Run type type: keyword -- -*`rsa.wireless.wlan_channel`*:: +*`rsa.misc.cc_number`*:: + -- -This is used to capture the channel names +Valid Credit Card Numbers only type: long -- -*`rsa.wireless.wlan_name`*:: +*`rsa.misc.content`*:: + -- -This key captures either WLAN number/name +This key captures the content type from protocol headers type: keyword -- - -*`rsa.storage.disk_volume`*:: +*`rsa.misc.ein_number`*:: + -- -A unique name assigned to logical units (volumes) within a physical disk +Employee Identification Numbers only -type: keyword +type: long -- -*`rsa.storage.lun`*:: +*`rsa.misc.found`*:: + -- -Logical Unit Number.This key is a very useful concept in Storage. +This is used to capture the results of regex match type: keyword -- -*`rsa.storage.pwwn`*:: +*`rsa.misc.language`*:: + -- -This uniquely identifies a port on a HBA. +This is used to capture list of languages the client support and what it prefers type: keyword -- - -*`rsa.physical.org_dst`*:: +*`rsa.misc.lifetime`*:: + -- -This is used to capture the destination organization based on the GEOPIP Maxmind database. +This key is used to capture the session lifetime in seconds. -type: keyword +type: long -- -*`rsa.physical.org_src`*:: +*`rsa.misc.link`*:: + -- -This is used to capture the source organization based on the GEOPIP Maxmind database. +This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness type: keyword -- - -*`rsa.healthcare.patient_fname`*:: +*`rsa.misc.match`*:: + -- -This key is for First Names only, this is used for Healthcare predominantly to capture Patients information +This key is for regex match name from search.ini type: keyword -- -*`rsa.healthcare.patient_id`*:: +*`rsa.misc.param_dst`*:: + -- -This key captures the unique ID for a patient +This key captures the command line/launch argument of the target process or file type: keyword -- -*`rsa.healthcare.patient_lname`*:: +*`rsa.misc.param_src`*:: + -- -This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information +This key captures source parameter type: keyword -- -*`rsa.healthcare.patient_mname`*:: +*`rsa.misc.search_text`*:: + -- -This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information +This key captures the Search Text used type: keyword -- - -*`rsa.endpoint.host_state`*:: +*`rsa.misc.sig_name`*:: + -- -This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on +This key is used to capture the Signature Name only. type: keyword -- -*`rsa.endpoint.registry_key`*:: +*`rsa.misc.snmp_value`*:: + -- -This key captures the path to the registry key +SNMP set request value type: keyword -- -*`rsa.endpoint.registry_value`*:: +*`rsa.misc.streams`*:: + -- -This key captures values or decorators used within a registry entry +This key captures number of streams in session -type: keyword +type: long -- -[[exported-fields-suricata]] -== Suricata fields - -Module for handling the EVE JSON logs produced by Suricata. - - - -[float] -=== suricata - -Fields from the Suricata EVE log file. - - - -[float] -=== eve - -Fields exported by the EVE JSON logs - - -*`suricata.eve.event_type`*:: +*`rsa.db.index`*:: + -- +This key captures IndexID of the index. + type: keyword -- -*`suricata.eve.app_proto_orig`*:: +*`rsa.db.instance`*:: + -- +This key is used to capture the database server instance name + type: keyword -- - -*`suricata.eve.tcp.tcp_flags`*:: +*`rsa.db.database`*:: + -- +This key is used to capture the name of a database or an instance as seen in a session + type: keyword -- -*`suricata.eve.tcp.psh`*:: +*`rsa.db.transact_id`*:: + -- -type: boolean - --- +This key captures the SQL transantion ID of the current session -*`suricata.eve.tcp.tcp_flags_tc`*:: -+ --- type: keyword -- -*`suricata.eve.tcp.ack`*:: +*`rsa.db.permissions`*:: + -- -type: boolean - --- +This key captures permission or privilege level assigned to a resource. -*`suricata.eve.tcp.syn`*:: -+ --- -type: boolean +type: keyword -- -*`suricata.eve.tcp.state`*:: +*`rsa.db.table_name`*:: + -- +This key is used to capture the table name + type: keyword -- -*`suricata.eve.tcp.tcp_flags_ts`*:: +*`rsa.db.db_id`*:: + -- +This key is used to capture the unique identifier for a database + type: keyword -- -*`suricata.eve.tcp.rst`*:: +*`rsa.db.db_pid`*:: + -- -type: boolean - --- +This key captures the process id of a connection with database server -*`suricata.eve.tcp.fin`*:: -+ --- -type: boolean +type: long -- - -*`suricata.eve.fileinfo.sha1`*:: +*`rsa.db.lread`*:: + -- -type: keyword +This key is used for the number of logical reads + +type: long -- -*`suricata.eve.fileinfo.filename`*:: +*`rsa.db.lwrite`*:: + -- -type: alias +This key is used for the number of logical writes -alias to: file.path +type: long -- -*`suricata.eve.fileinfo.tx_id`*:: +*`rsa.db.pread`*:: + -- -type: long +This key is used for the number of physical writes --- +type: long -*`suricata.eve.fileinfo.state`*:: -+ -- -type: keyword --- -*`suricata.eve.fileinfo.stored`*:: +*`rsa.network.alias_host`*:: + -- -type: boolean +This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. + +type: keyword -- -*`suricata.eve.fileinfo.gaps`*:: +*`rsa.network.domain`*:: + -- -type: boolean +type: keyword -- -*`suricata.eve.fileinfo.sha256`*:: +*`rsa.network.host_dst`*:: + -- +This key should only be used when it’s a Destination Hostname + type: keyword -- -*`suricata.eve.fileinfo.md5`*:: +*`rsa.network.network_service`*:: + -- +This is used to capture layer 7 protocols/service names + type: keyword -- -*`suricata.eve.fileinfo.size`*:: +*`rsa.network.interface`*:: + -- -type: alias +This key should be used when the source or destination context of an interface is not clear -alias to: file.size +type: keyword -- -*`suricata.eve.icmp_type`*:: +*`rsa.network.network_port`*:: + -- +Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) + type: long -- -*`suricata.eve.dest_port`*:: +*`rsa.network.eth_host`*:: + -- -type: alias +Deprecated, use alias.mac -alias to: destination.port +type: keyword -- -*`suricata.eve.src_port`*:: +*`rsa.network.sinterface`*:: + -- -type: alias +This key should only be used when it’s a Source Interface -alias to: source.port +type: keyword -- -*`suricata.eve.proto`*:: +*`rsa.network.dinterface`*:: + -- -type: alias +This key should only be used when it’s a Destination Interface -alias to: network.transport +type: keyword -- -*`suricata.eve.pcap_cnt`*:: +*`rsa.network.vlan`*:: + -- +This key should only be used to capture the ID of the Virtual LAN + type: long -- -*`suricata.eve.src_ip`*:: +*`rsa.network.zone_src`*:: + -- -type: alias +This key should only be used when it’s a Source Zone. -alias to: source.ip +type: keyword -- - -*`suricata.eve.dns.type`*:: +*`rsa.network.zone`*:: + -- +This key should be used when the source or destination context of a Zone is not clear + type: keyword -- -*`suricata.eve.dns.rrtype`*:: +*`rsa.network.zone_dst`*:: + -- +This key should only be used when it’s a Destination Zone. + type: keyword -- -*`suricata.eve.dns.rrname`*:: +*`rsa.network.gateway`*:: + -- +This key is used to capture the IP Address of the gateway + type: keyword -- -*`suricata.eve.dns.rdata`*:: +*`rsa.network.icmp_type`*:: + -- -type: keyword +This key is used to capture the ICMP type only + +type: long -- -*`suricata.eve.dns.tx_id`*:: +*`rsa.network.mask`*:: + -- -type: long +This key is used to capture the device network IPmask. + +type: keyword -- -*`suricata.eve.dns.ttl`*:: +*`rsa.network.icmp_code`*:: + -- +This key is used to capture the ICMP code only + type: long -- -*`suricata.eve.dns.rcode`*:: +*`rsa.network.protocol_detail`*:: + -- +This key should be used to capture additional protocol information + type: keyword -- -*`suricata.eve.dns.id`*:: +*`rsa.network.dmask`*:: + -- -type: long - --- +This key is used for Destionation Device network mask -*`suricata.eve.flow_id`*:: -+ --- type: keyword -- - -*`suricata.eve.email.status`*:: +*`rsa.network.port`*:: + -- -type: keyword +This key should only be used to capture a Network Port when the directionality is not clear + +type: long -- -*`suricata.eve.dest_ip`*:: +*`rsa.network.smask`*:: + -- -type: alias +This key is used for capturing source Network Mask -alias to: destination.ip +type: keyword -- -*`suricata.eve.icmp_code`*:: +*`rsa.network.netname`*:: + -- -type: long +This key is used to capture the network name associated with an IP range. This is configured by the end user. --- +type: keyword +-- -*`suricata.eve.http.status`*:: +*`rsa.network.paddr`*:: + -- -type: alias +Deprecated -alias to: http.response.status_code +type: ip -- -*`suricata.eve.http.redirect`*:: +*`rsa.network.faddr`*:: + -- type: keyword -- -*`suricata.eve.http.http_user_agent`*:: +*`rsa.network.lhost`*:: + -- -type: alias - -alias to: user_agent.original +type: keyword -- -*`suricata.eve.http.protocol`*:: +*`rsa.network.origin`*:: + -- type: keyword -- -*`suricata.eve.http.http_refer`*:: +*`rsa.network.remote_domain_id`*:: + -- -type: alias - -alias to: http.request.referrer +type: keyword -- -*`suricata.eve.http.url`*:: +*`rsa.network.addr`*:: + -- -type: alias - -alias to: url.original +type: keyword -- -*`suricata.eve.http.hostname`*:: +*`rsa.network.dns_a_record`*:: + -- -type: alias - -alias to: url.domain +type: keyword -- -*`suricata.eve.http.length`*:: +*`rsa.network.dns_ptr_record`*:: + -- -type: alias - -alias to: http.response.body.bytes +type: keyword -- -*`suricata.eve.http.http_method`*:: +*`rsa.network.fhost`*:: + -- -type: alias - -alias to: http.request.method +type: keyword -- -*`suricata.eve.http.http_content_type`*:: +*`rsa.network.fport`*:: + -- type: keyword -- -*`suricata.eve.timestamp`*:: +*`rsa.network.laddr`*:: + -- -type: alias - -alias to: @timestamp +type: keyword -- -*`suricata.eve.in_iface`*:: +*`rsa.network.linterface`*:: + -- type: keyword -- - -*`suricata.eve.alert.category`*:: +*`rsa.network.phost`*:: + -- type: keyword -- -*`suricata.eve.alert.severity`*:: +*`rsa.network.ad_computer_dst`*:: + -- -type: alias +Deprecated, use host.dst -alias to: event.severity +type: keyword -- -*`suricata.eve.alert.rev`*:: +*`rsa.network.eth_type`*:: + -- +This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only + type: long -- -*`suricata.eve.alert.gid`*:: +*`rsa.network.ip_proto`*:: + -- +This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI + type: long -- -*`suricata.eve.alert.signature`*:: +*`rsa.network.dns_cname_record`*:: + -- type: keyword -- -*`suricata.eve.alert.action`*:: +*`rsa.network.dns_id`*:: + -- -type: alias - -alias to: event.outcome +type: keyword -- -*`suricata.eve.alert.signature_id`*:: +*`rsa.network.dns_opcode`*:: + -- -type: long +type: keyword -- - - -*`suricata.eve.ssh.client.proto_version`*:: +*`rsa.network.dns_resp`*:: + -- type: keyword -- -*`suricata.eve.ssh.client.software_version`*:: +*`rsa.network.dns_type`*:: + -- type: keyword -- - -*`suricata.eve.ssh.server.proto_version`*:: +*`rsa.network.domain1`*:: + -- type: keyword -- -*`suricata.eve.ssh.server.software_version`*:: +*`rsa.network.host_type`*:: + -- type: keyword -- - - -*`suricata.eve.stats.capture.kernel_packets`*:: +*`rsa.network.packet_length`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.capture.kernel_drops`*:: +*`rsa.network.host_orig`*:: + -- -type: long +This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. + +type: keyword -- -*`suricata.eve.stats.capture.kernel_ifdrops`*:: +*`rsa.network.rpayload`*:: + -- -type: long +This key is used to capture the total number of payload bytes seen in the retransmitted packets. + +type: keyword -- -*`suricata.eve.stats.uptime`*:: +*`rsa.network.vlan_name`*:: + -- -type: long +This key should only be used to capture the name of the Virtual LAN + +type: keyword -- -*`suricata.eve.stats.detect.alert`*:: +*`rsa.investigations.ec_activity`*:: + -- -type: long +This key captures the particular event activity(Ex:Logoff) --- +type: keyword +-- -*`suricata.eve.stats.http.memcap`*:: +*`rsa.investigations.ec_theme`*:: + -- -type: long +This key captures the Theme of a particular Event(Ex:Authentication) + +type: keyword -- -*`suricata.eve.stats.http.memuse`*:: +*`rsa.investigations.ec_subject`*:: + -- -type: long +This key captures the Subject of a particular Event(Ex:User) --- +type: keyword +-- -*`suricata.eve.stats.file_store.open_files`*:: +*`rsa.investigations.ec_outcome`*:: + -- -type: long +This key captures the outcome of a particular Event(Ex:Success) --- +type: keyword +-- -*`suricata.eve.stats.defrag.max_frag_hits`*:: +*`rsa.investigations.event_cat`*:: + -- +This key captures the Event category number + type: long -- - -*`suricata.eve.stats.defrag.ipv4.timeouts`*:: +*`rsa.investigations.event_cat_name`*:: + -- -type: long +This key captures the event category name corresponding to the event cat code + +type: keyword -- -*`suricata.eve.stats.defrag.ipv4.fragments`*:: +*`rsa.investigations.event_vcat`*:: + -- -type: long +This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. + +type: keyword -- -*`suricata.eve.stats.defrag.ipv4.reassembled`*:: +*`rsa.investigations.analysis_file`*:: + -- -type: long +This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file --- +type: keyword +-- -*`suricata.eve.stats.defrag.ipv6.timeouts`*:: +*`rsa.investigations.analysis_service`*:: + -- -type: long +This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service + +type: keyword -- -*`suricata.eve.stats.defrag.ipv6.fragments`*:: +*`rsa.investigations.analysis_session`*:: + -- -type: long +This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session + +type: keyword -- -*`suricata.eve.stats.defrag.ipv6.reassembled`*:: +*`rsa.investigations.boc`*:: + -- -type: long +This is used to capture behaviour of compromise --- +type: keyword +-- -*`suricata.eve.stats.flow.tcp_reuse`*:: +*`rsa.investigations.eoc`*:: + -- -type: long +This is used to capture Enablers of Compromise + +type: keyword -- -*`suricata.eve.stats.flow.udp`*:: +*`rsa.investigations.inv_category`*:: + -- -type: long +This used to capture investigation category + +type: keyword -- -*`suricata.eve.stats.flow.memcap`*:: +*`rsa.investigations.inv_context`*:: + -- -type: long +This used to capture investigation context + +type: keyword -- -*`suricata.eve.stats.flow.emerg_mode_entered`*:: +*`rsa.investigations.ioc`*:: + -- -type: long +This is key capture indicator of compromise --- +type: keyword -*`suricata.eve.stats.flow.emerg_mode_over`*:: -+ -- -type: long --- -*`suricata.eve.stats.flow.tcp`*:: +*`rsa.counters.dclass_c1`*:: + -- +This is a generic counter key that should be used with the label dclass.c1.str only + type: long -- -*`suricata.eve.stats.flow.icmpv6`*:: +*`rsa.counters.dclass_c2`*:: + -- +This is a generic counter key that should be used with the label dclass.c2.str only + type: long -- -*`suricata.eve.stats.flow.icmpv4`*:: +*`rsa.counters.event_counter`*:: + -- +This is used to capture the number of times an event repeated + type: long -- -*`suricata.eve.stats.flow.spare`*:: +*`rsa.counters.dclass_r1`*:: + -- -type: long +This is a generic ratio key that should be used with the label dclass.r1.str only + +type: keyword -- -*`suricata.eve.stats.flow.memuse`*:: +*`rsa.counters.dclass_c3`*:: + -- +This is a generic counter key that should be used with the label dclass.c3.str only + type: long -- - -*`suricata.eve.stats.tcp.pseudo_failed`*:: +*`rsa.counters.dclass_c1_str`*:: + -- -type: long +This is a generic counter string key that should be used with the label dclass.c1 only + +type: keyword -- -*`suricata.eve.stats.tcp.ssn_memcap_drop`*:: +*`rsa.counters.dclass_c2_str`*:: + -- -type: long +This is a generic counter string key that should be used with the label dclass.c2 only + +type: keyword -- -*`suricata.eve.stats.tcp.insert_data_overlap_fail`*:: +*`rsa.counters.dclass_r1_str`*:: + -- -type: long +This is a generic ratio string key that should be used with the label dclass.r1 only + +type: keyword -- -*`suricata.eve.stats.tcp.sessions`*:: +*`rsa.counters.dclass_r2`*:: + -- -type: long +This is a generic ratio key that should be used with the label dclass.r2.str only + +type: keyword -- -*`suricata.eve.stats.tcp.pseudo`*:: +*`rsa.counters.dclass_c3_str`*:: + -- -type: long +This is a generic counter string key that should be used with the label dclass.c3 only + +type: keyword -- -*`suricata.eve.stats.tcp.synack`*:: +*`rsa.counters.dclass_r3`*:: + -- -type: long +This is a generic ratio key that should be used with the label dclass.r3.str only + +type: keyword -- -*`suricata.eve.stats.tcp.insert_data_normal_fail`*:: +*`rsa.counters.dclass_r2_str`*:: + -- -type: long +This is a generic ratio string key that should be used with the label dclass.r2 only + +type: keyword -- -*`suricata.eve.stats.tcp.syn`*:: +*`rsa.counters.dclass_r3_str`*:: + -- -type: long +This is a generic ratio string key that should be used with the label dclass.r3 only + +type: keyword -- -*`suricata.eve.stats.tcp.memuse`*:: + +*`rsa.identity.auth_method`*:: + -- -type: long +This key is used to capture authentication methods used only + +type: keyword -- -*`suricata.eve.stats.tcp.invalid_checksum`*:: +*`rsa.identity.user_role`*:: + -- -type: long +This key is used to capture the Role of a user only + +type: keyword -- -*`suricata.eve.stats.tcp.segment_memcap_drop`*:: +*`rsa.identity.dn`*:: + -- -type: long +X.500 (LDAP) Distinguished Name + +type: keyword -- -*`suricata.eve.stats.tcp.overlap`*:: +*`rsa.identity.logon_type`*:: + -- -type: long +This key is used to capture the type of logon method used. + +type: keyword -- -*`suricata.eve.stats.tcp.insert_list_fail`*:: +*`rsa.identity.profile`*:: + -- -type: long +This key is used to capture the user profile + +type: keyword -- -*`suricata.eve.stats.tcp.rst`*:: +*`rsa.identity.accesses`*:: + -- -type: long +This key is used to capture actual privileges used in accessing an object + +type: keyword -- -*`suricata.eve.stats.tcp.stream_depth_reached`*:: +*`rsa.identity.realm`*:: + -- -type: long +Radius realm or similar grouping of accounts + +type: keyword -- -*`suricata.eve.stats.tcp.reassembly_memuse`*:: +*`rsa.identity.user_sid_dst`*:: + -- -type: long +This key captures Destination User Session ID + +type: keyword -- -*`suricata.eve.stats.tcp.reassembly_gap`*:: +*`rsa.identity.dn_src`*:: + -- -type: long +An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn + +type: keyword -- -*`suricata.eve.stats.tcp.overlap_diff_data`*:: +*`rsa.identity.org`*:: + -- -type: long +This key captures the User organization + +type: keyword -- -*`suricata.eve.stats.tcp.no_flow`*:: +*`rsa.identity.dn_dst`*:: + -- -type: long +An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn --- +type: keyword +-- -*`suricata.eve.stats.decoder.avg_pkt_size`*:: +*`rsa.identity.firstname`*:: + -- -type: long +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword -- -*`suricata.eve.stats.decoder.bytes`*:: +*`rsa.identity.lastname`*:: + -- -type: long +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword -- -*`suricata.eve.stats.decoder.tcp`*:: +*`rsa.identity.user_dept`*:: + -- -type: long +User's Department Names only + +type: keyword -- -*`suricata.eve.stats.decoder.raw`*:: +*`rsa.identity.user_sid_src`*:: + -- -type: long +This key captures Source User Session ID + +type: keyword -- -*`suricata.eve.stats.decoder.ppp`*:: +*`rsa.identity.federated_sp`*:: + -- -type: long +This key is the Federated Service Provider. This is the application requesting authentication. + +type: keyword -- -*`suricata.eve.stats.decoder.vlan_qinq`*:: +*`rsa.identity.federated_idp`*:: + -- -type: long +This key is the federated Identity Provider. This is the server providing the authentication. + +type: keyword -- -*`suricata.eve.stats.decoder.null`*:: +*`rsa.identity.logon_type_desc`*:: + -- -type: long +This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. --- +type: keyword +-- -*`suricata.eve.stats.decoder.ltnull.unsupported_type`*:: +*`rsa.identity.middlename`*:: + -- -type: long +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + +type: keyword -- -*`suricata.eve.stats.decoder.ltnull.pkt_too_small`*:: +*`rsa.identity.password`*:: + -- -type: long +This key is for Passwords seen in any session, plain text or encrypted + +type: keyword -- -*`suricata.eve.stats.decoder.invalid`*:: +*`rsa.identity.host_role`*:: + -- -type: long +This key should only be used to capture the role of a Host Machine + +type: keyword -- -*`suricata.eve.stats.decoder.gre`*:: +*`rsa.identity.ldap`*:: + -- -type: long +This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context + +type: keyword -- -*`suricata.eve.stats.decoder.ipv4`*:: +*`rsa.identity.ldap_query`*:: + -- -type: long +This key is the Search criteria from an LDAP search + +type: keyword -- -*`suricata.eve.stats.decoder.ipv6`*:: +*`rsa.identity.ldap_response`*:: + -- -type: long +This key is to capture Results from an LDAP search + +type: keyword -- -*`suricata.eve.stats.decoder.pkts`*:: +*`rsa.identity.owner`*:: + -- -type: long +This is used to capture username the process or service is running as, the author of the task + +type: keyword -- -*`suricata.eve.stats.decoder.ipv6_in_ipv6`*:: +*`rsa.identity.service_account`*:: + -- -type: long +This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage + +type: keyword -- -*`suricata.eve.stats.decoder.ipraw.invalid_ip_version`*:: +*`rsa.email.email_dst`*:: + -- -type: long +This key is used to capture the Destination email address only, when the destination context is not clear use email + +type: keyword -- -*`suricata.eve.stats.decoder.pppoe`*:: +*`rsa.email.email_src`*:: + -- -type: long +This key is used to capture the source email address only, when the source context is not clear use email + +type: keyword -- -*`suricata.eve.stats.decoder.udp`*:: +*`rsa.email.subject`*:: + -- -type: long +This key is used to capture the subject string from an Email only. --- +type: keyword +-- -*`suricata.eve.stats.decoder.dce.pkt_too_small`*:: +*`rsa.email.email`*:: + -- -type: long +This key is used to capture a generic email address where the source or destination context is not clear + +type: keyword -- -*`suricata.eve.stats.decoder.vlan`*:: +*`rsa.email.trans_from`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`suricata.eve.stats.decoder.sctp`*:: +*`rsa.email.trans_to`*:: + -- -type: long +Deprecated key defined only in table map. --- +type: keyword -*`suricata.eve.stats.decoder.max_pkt_size`*:: -+ -- -type: long --- -*`suricata.eve.stats.decoder.teredo`*:: +*`rsa.file.privilege`*:: + -- -type: long +Deprecated, use permissions + +type: keyword -- -*`suricata.eve.stats.decoder.mpls`*:: +*`rsa.file.attachment`*:: + -- -type: long +This key captures the attachment file name + +type: keyword -- -*`suricata.eve.stats.decoder.sll`*:: +*`rsa.file.filesystem`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.decoder.icmpv6`*:: +*`rsa.file.binary`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`suricata.eve.stats.decoder.icmpv4`*:: +*`rsa.file.filename_dst`*:: + -- -type: long +This is used to capture name of the file targeted by the action + +type: keyword -- -*`suricata.eve.stats.decoder.erspan`*:: +*`rsa.file.filename_src`*:: + -- -type: long +This is used to capture name of the parent filename, the file which performed the action + +type: keyword -- -*`suricata.eve.stats.decoder.ethernet`*:: +*`rsa.file.filename_tmp`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.decoder.ipv4_in_ipv6`*:: +*`rsa.file.directory_dst`*:: + -- -type: long +This key is used to capture the directory of the target process or file + +type: keyword -- -*`suricata.eve.stats.decoder.ieee8021ah`*:: +*`rsa.file.directory_src`*:: + -- -type: long +This key is used to capture the directory of the source process or file --- +type: keyword +-- -*`suricata.eve.stats.dns.memcap_global`*:: +*`rsa.file.file_entropy`*:: + -- -type: long +This is used to capture entropy vale of a file + +type: double -- -*`suricata.eve.stats.dns.memcap_state`*:: +*`rsa.file.file_vendor`*:: + -- -type: long +This is used to capture Company name of file located in version_info + +type: keyword -- -*`suricata.eve.stats.dns.memuse`*:: +*`rsa.file.task_name`*:: + -- -type: long +This is used to capture name of the task + +type: keyword -- -*`suricata.eve.stats.flow_mgr.rows_busy`*:: +*`rsa.web.fqdn`*:: + -- -type: long +Fully Qualified Domain Names + +type: keyword -- -*`suricata.eve.stats.flow_mgr.flows_timeout`*:: +*`rsa.web.web_cookie`*:: + -- -type: long +This key is used to capture the Web cookies specifically. + +type: keyword -- -*`suricata.eve.stats.flow_mgr.flows_notimeout`*:: +*`rsa.web.alias_host`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.rows_skipped`*:: +*`rsa.web.reputation_num`*:: + -- -type: long +Reputation Number of an entity. Typically used for Web Domains + +type: double -- -*`suricata.eve.stats.flow_mgr.closed_pruned`*:: +*`rsa.web.web_ref_domain`*:: + -- -type: long +Web referer's domain + +type: keyword -- -*`suricata.eve.stats.flow_mgr.new_pruned`*:: +*`rsa.web.web_ref_query`*:: + -- -type: long +This key captures Web referer's query portion of the URL + +type: keyword -- -*`suricata.eve.stats.flow_mgr.flows_removed`*:: +*`rsa.web.remote_domain`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.bypassed_pruned`*:: +*`rsa.web.web_ref_page`*:: + -- -type: long +This key captures Web referer's page information + +type: keyword -- -*`suricata.eve.stats.flow_mgr.est_pruned`*:: +*`rsa.web.web_ref_root`*:: + -- -type: long +Web referer's root URL path + +type: keyword -- -*`suricata.eve.stats.flow_mgr.flows_timeout_inuse`*:: +*`rsa.web.cn_asn_dst`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.flows_checked`*:: +*`rsa.web.cn_rpackets`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.rows_maxlen`*:: +*`rsa.web.urlpage`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.rows_checked`*:: +*`rsa.web.urlroot`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.flow_mgr.rows_empty`*:: +*`rsa.web.p_url`*:: + -- -type: long +type: keyword -- +*`rsa.web.p_user_agent`*:: ++ +-- +type: keyword +-- -*`suricata.eve.stats.app_layer.flow.tls`*:: +*`rsa.web.p_web_cookie`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.flow.ftp`*:: +*`rsa.web.p_web_method`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.flow.http`*:: +*`rsa.web.p_web_referer`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.flow.failed_udp`*:: +*`rsa.web.web_extension_tmp`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.flow.dns_udp`*:: +*`rsa.web.web_page`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.flow.dns_tcp`*:: + +*`rsa.threat.threat_category`*:: + -- -type: long +This key captures Threat Name/Threat Category/Categorization of alert + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.smtp`*:: +*`rsa.threat.threat_desc`*:: + -- -type: long +This key is used to capture the threat description from the session directly or inferred + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.failed_tcp`*:: +*`rsa.threat.alert`*:: + -- -type: long +This key is used to capture name of the alert + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.msn`*:: +*`rsa.threat.threat_source`*:: + -- -type: long +This key is used to capture source of the threat + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.ssh`*:: + +*`rsa.crypto.crypto`*:: + -- -type: long +This key is used to capture the Encryption Type or Encryption Key only + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.imap`*:: +*`rsa.crypto.cipher_src`*:: + -- -type: long +This key is for Source (Client) Cipher + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.dcerpc_udp`*:: +*`rsa.crypto.cert_subject`*:: + -- -type: long +This key is used to capture the Certificate organization only + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.dcerpc_tcp`*:: +*`rsa.crypto.peer`*:: + -- -type: long +This key is for Encryption peer's IP Address + +type: keyword -- -*`suricata.eve.stats.app_layer.flow.smb`*:: +*`rsa.crypto.cipher_size_src`*:: + -- +This key captures Source (Client) Cipher Size + type: long -- - -*`suricata.eve.stats.app_layer.tx.tls`*:: +*`rsa.crypto.ike`*:: + -- -type: long +IKE negotiation phase. + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.ftp`*:: +*`rsa.crypto.scheme`*:: + -- -type: long +This key captures the Encryption scheme used + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.http`*:: +*`rsa.crypto.peer_id`*:: + -- -type: long +This key is for Encryption peer’s identity + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.dns_udp`*:: +*`rsa.crypto.sig_type`*:: + -- -type: long +This key captures the Signature Type + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.dns_tcp`*:: +*`rsa.crypto.cert_issuer`*:: + -- -type: long +type: keyword -- -*`suricata.eve.stats.app_layer.tx.smtp`*:: +*`rsa.crypto.cert_host_name`*:: + -- -type: long +Deprecated key defined only in table map. + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.ssh`*:: +*`rsa.crypto.cert_error`*:: + -- -type: long +This key captures the Certificate Error String + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.dcerpc_udp`*:: +*`rsa.crypto.cipher_dst`*:: + -- -type: long +This key is for Destination (Server) Cipher + +type: keyword -- -*`suricata.eve.stats.app_layer.tx.dcerpc_tcp`*:: +*`rsa.crypto.cipher_size_dst`*:: + -- +This key captures Destination (Server) Cipher Size + type: long -- -*`suricata.eve.stats.app_layer.tx.smb`*:: +*`rsa.crypto.ssl_ver_src`*:: + -- -type: long +Deprecated, use version --- +type: keyword +-- -*`suricata.eve.tls.notbefore`*:: +*`rsa.crypto.d_certauth`*:: + -- -type: date +type: keyword -- -*`suricata.eve.tls.issuerdn`*:: +*`rsa.crypto.s_certauth`*:: + -- type: keyword -- -*`suricata.eve.tls.sni`*:: +*`rsa.crypto.ike_cookie1`*:: + -- +ID of the negotiation — sent for ISAKMP Phase One + type: keyword -- -*`suricata.eve.tls.version`*:: +*`rsa.crypto.ike_cookie2`*:: + -- +ID of the negotiation — sent for ISAKMP Phase Two + type: keyword -- -*`suricata.eve.tls.session_resumed`*:: +*`rsa.crypto.cert_checksum`*:: + -- -type: boolean +type: keyword -- -*`suricata.eve.tls.fingerprint`*:: +*`rsa.crypto.cert_host_cat`*:: + -- +This key is used for the hostname category value of a certificate + type: keyword -- -*`suricata.eve.tls.serial`*:: +*`rsa.crypto.cert_serial`*:: + -- +This key is used to capture the Certificate serial number only + type: keyword -- -*`suricata.eve.tls.notafter`*:: +*`rsa.crypto.cert_status`*:: + -- -type: date +This key captures Certificate validation status + +type: keyword -- -*`suricata.eve.tls.subject`*:: +*`rsa.crypto.ssl_ver_dst`*:: + -- +Deprecated, use version + type: keyword -- - -*`suricata.eve.tls.ja3s.string`*:: +*`rsa.crypto.cert_keysize`*:: + -- type: keyword -- -*`suricata.eve.tls.ja3s.hash`*:: +*`rsa.crypto.cert_username`*:: + -- type: keyword -- - -*`suricata.eve.tls.ja3.string`*:: +*`rsa.crypto.https_insact`*:: + -- type: keyword -- -*`suricata.eve.tls.ja3.hash`*:: +*`rsa.crypto.https_valid`*:: + -- type: keyword -- -*`suricata.eve.app_proto_ts`*:: +*`rsa.crypto.cert_ca`*:: + -- +This key is used to capture the Certificate signing authority only + type: keyword -- - -*`suricata.eve.flow.bytes_toclient`*:: +*`rsa.crypto.cert_common`*:: + -- -type: alias +This key is used to capture the Certificate common name only -alias to: destination.bytes +type: keyword -- -*`suricata.eve.flow.start`*:: + +*`rsa.wireless.wlan_ssid`*:: + -- -type: alias +This key is used to capture the ssid of a Wireless Session -alias to: event.start +type: keyword -- -*`suricata.eve.flow.pkts_toclient`*:: +*`rsa.wireless.access_point`*:: + -- -type: alias +This key is used to capture the access point name. -alias to: destination.packets +type: keyword -- -*`suricata.eve.flow.age`*:: +*`rsa.wireless.wlan_channel`*:: + -- +This is used to capture the channel names + type: long -- -*`suricata.eve.flow.state`*:: +*`rsa.wireless.wlan_name`*:: + -- +This key captures either WLAN number/name + type: keyword -- -*`suricata.eve.flow.bytes_toserver`*:: + +*`rsa.storage.disk_volume`*:: + -- -type: alias +A unique name assigned to logical units (volumes) within a physical disk -alias to: source.bytes +type: keyword -- -*`suricata.eve.flow.reason`*:: +*`rsa.storage.lun`*:: + -- +Logical Unit Number.This key is a very useful concept in Storage. + type: keyword -- -*`suricata.eve.flow.pkts_toserver`*:: +*`rsa.storage.pwwn`*:: + -- -type: alias +This uniquely identifies a port on a HBA. -alias to: source.packets +type: keyword -- -*`suricata.eve.flow.end`*:: + +*`rsa.physical.org_dst`*:: + -- -type: date +This is used to capture the destination organization based on the GEOPIP Maxmind database. + +type: keyword -- -*`suricata.eve.flow.alerted`*:: +*`rsa.physical.org_src`*:: + -- -type: boolean +This is used to capture the source organization based on the GEOPIP Maxmind database. + +type: keyword -- -*`suricata.eve.app_proto`*:: + +*`rsa.healthcare.patient_fname`*:: + -- -type: alias +This key is for First Names only, this is used for Healthcare predominantly to capture Patients information -alias to: network.protocol +type: keyword -- -*`suricata.eve.tx_id`*:: +*`rsa.healthcare.patient_id`*:: + -- -type: long +This key captures the unique ID for a patient + +type: keyword -- -*`suricata.eve.app_proto_tc`*:: +*`rsa.healthcare.patient_lname`*:: + -- +This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information + type: keyword -- - -*`suricata.eve.smtp.rcpt_to`*:: +*`rsa.healthcare.patient_mname`*:: + -- +This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information + type: keyword -- -*`suricata.eve.smtp.mail_from`*:: + +*`rsa.endpoint.host_state`*:: + -- +This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on + type: keyword -- -*`suricata.eve.smtp.helo`*:: +*`rsa.endpoint.registry_key`*:: + -- +This key captures the path to the registry key + type: keyword -- -*`suricata.eve.app_proto_expected`*:: +*`rsa.endpoint.registry_value`*:: + -- +This key captures values or decorators used within a registry entry + type: keyword -- diff --git a/filebeat/docs/modules/barracuda.asciidoc b/filebeat/docs/modules/barracuda.asciidoc index 5929c50d7d4..4ec568d507c 100644 --- a/filebeat/docs/modules/barracuda.asciidoc +++ b/filebeat/docs/modules/barracuda.asciidoc @@ -56,7 +56,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `spamfirewall` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "barracudasf" device revision 125. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9524` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/bluecoat.asciidoc b/filebeat/docs/modules/bluecoat.asciidoc index 753db835b54..519d0a75885 100644 --- a/filebeat/docs/modules/bluecoat.asciidoc +++ b/filebeat/docs/modules/bluecoat.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/cisco.asciidoc b/filebeat/docs/modules/cisco.asciidoc index f98af64ebe9..c12f818caca 100644 --- a/filebeat/docs/modules/cisco.asciidoc +++ b/filebeat/docs/modules/cisco.asciidoc @@ -323,7 +323,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `meraki` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "ciscomeraki" device revision 118. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9525` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/citrix.asciidoc b/filebeat/docs/modules/citrix.asciidoc index ab0ade1561d..f5844cea3fe 100644 --- a/filebeat/docs/modules/citrix.asciidoc +++ b/filebeat/docs/modules/citrix.asciidoc @@ -12,22 +12,22 @@ This file is generated! See scripts/docs_collector.py experimental[] -This is a module for receiving Citrix XenApp logs over Syslog or a file. +This is a module for receiving Citrix NetScaler logs over Syslog or a file. include::../include/gs-link.asciidoc[] include::../include/configuring-intro.asciidoc[] -:fileset_ex: virtualapps +:fileset_ex: netscaler include::../include/config-option-intro.asciidoc[] [float] -==== `virtualapps` fileset settings +==== `netscaler` fileset settings experimental[] -NOTE: This was converted from RSA NetWitness log parser XML "citrixxa" device revision 79. +NOTE: This was converted from RSA NetWitness log parser XML "citrixns" device revision 134. *`var.input`*:: @@ -41,7 +41,7 @@ Set to `0.0.0.0` to bind to all available interfaces. *`var.syslog_port`*:: -The port to listen for syslog traffic. Defaults to `9507` +The port to listen for syslog traffic. Defaults to `9526` NOTE: Ports below 1024 require Filebeat to run as root. @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/cyberark.asciidoc b/filebeat/docs/modules/cyberark.asciidoc new file mode 100644 index 00000000000..9f423f97625 --- /dev/null +++ b/filebeat/docs/modules/cyberark.asciidoc @@ -0,0 +1,79 @@ +//// +This file is generated! See scripts/docs_collector.py +//// + +[[filebeat-module-cyberark]] +[role="xpack"] + +:modulename: cyberark +:has-dashboards: false + +== Cyberark module + +experimental[] + +This is a module for receiving Cyber-Ark logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: corepas + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `corepas` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9527` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + + + +[float] +=== Fields + +For a description of each field in the module, see the +<> section. + diff --git a/filebeat/docs/modules/cylance.asciidoc b/filebeat/docs/modules/cylance.asciidoc index 1e27640f8df..2eafc21f913 100644 --- a/filebeat/docs/modules/cylance.asciidoc +++ b/filebeat/docs/modules/cylance.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/f5.asciidoc b/filebeat/docs/modules/f5.asciidoc index 8ebfd8f94a7..ed3aa87ede6 100644 --- a/filebeat/docs/modules/f5.asciidoc +++ b/filebeat/docs/modules/f5.asciidoc @@ -12,7 +12,11 @@ This file is generated! See scripts/docs_collector.py experimental[] -This is a module for receiving Big-IP Access Policy Manager logs over Syslog or a file. +This is a module for F5 network device's logs. It includes the following +filesets for receiving logs over syslog or read from a file: + +- `bigipapm` fileset: supports F5 Big-IP Access Policy Manager. +- `bigipafm` fileset: supports F5 Big-IP Advanced Firewall Manager. include::../include/gs-link.asciidoc[] @@ -56,7 +60,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `bigipafm` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "bigipafm" device revision 121. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9528` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/fortinet.asciidoc b/filebeat/docs/modules/fortinet.asciidoc index cef820bd0bb..78c8825bdd1 100644 --- a/filebeat/docs/modules/fortinet.asciidoc +++ b/filebeat/docs/modules/fortinet.asciidoc @@ -10,7 +10,13 @@ This file is generated! See scripts/docs_collector.py == Fortinet module -This is a module for Fortinet FortiOS logs sent in the syslog format. +This is a module for Fortinet logs sent in the syslog format. It supports the +following devices: + +- `firewall` fileset: Supports FortiOS Firewall logs. +- `clientendpoint` fileset: Supports FortiClient Endpoint Protection logs. +- `fortimail` fileset: Supports FortiMail logs. +- `fortimanager` fileset: Supports FortiManager logs. To configure a remote syslog destination, please reference the https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/260508/log-syslogd-syslogd2-syslogd3-syslogd4-setting[Fortigate/FortiOS Documentation]. @@ -100,7 +106,97 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `fortimail` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "fortinetfortimail" device revision 131. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9529` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `fortimanager` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "fortinetmgr" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9530` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/imperva.asciidoc b/filebeat/docs/modules/imperva.asciidoc index 7aa882cca43..f4a994f45fd 100644 --- a/filebeat/docs/modules/imperva.asciidoc +++ b/filebeat/docs/modules/imperva.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/infoblox.asciidoc b/filebeat/docs/modules/infoblox.asciidoc index 17a789383c3..ec404e8b00b 100644 --- a/filebeat/docs/modules/infoblox.asciidoc +++ b/filebeat/docs/modules/infoblox.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/juniper.asciidoc b/filebeat/docs/modules/juniper.asciidoc index 68d0fb7d52f..047e847bc5a 100644 --- a/filebeat/docs/modules/juniper.asciidoc +++ b/filebeat/docs/modules/juniper.asciidoc @@ -56,7 +56,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `netscreen` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "netscreen" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9523` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/microsoft.asciidoc b/filebeat/docs/modules/microsoft.asciidoc index 8c9c6e2302c..513ca155be6 100644 --- a/filebeat/docs/modules/microsoft.asciidoc +++ b/filebeat/docs/modules/microsoft.asciidoc @@ -166,7 +166,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/netscout.asciidoc b/filebeat/docs/modules/netscout.asciidoc index d53fec8c56e..a1d4d3dcdd5 100644 --- a/filebeat/docs/modules/netscout.asciidoc +++ b/filebeat/docs/modules/netscout.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/proofpoint.asciidoc b/filebeat/docs/modules/proofpoint.asciidoc new file mode 100644 index 00000000000..0fad171b32d --- /dev/null +++ b/filebeat/docs/modules/proofpoint.asciidoc @@ -0,0 +1,79 @@ +//// +This file is generated! See scripts/docs_collector.py +//// + +[[filebeat-module-proofpoint]] +[role="xpack"] + +:modulename: proofpoint +:has-dashboards: false + +== Proofpoint module + +experimental[] + +This is a module for receiving Proofpoint Email Security logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: emailsecurity + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `emailsecurity` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "proofpoint" device revision 131. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9531` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + + + +[float] +=== Fields + +For a description of each field in the module, see the +<> section. + diff --git a/filebeat/docs/modules/radware.asciidoc b/filebeat/docs/modules/radware.asciidoc index 4531c23d470..c036143860f 100644 --- a/filebeat/docs/modules/radware.asciidoc +++ b/filebeat/docs/modules/radware.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/snort.asciidoc b/filebeat/docs/modules/snort.asciidoc new file mode 100644 index 00000000000..ff9d5809ae8 --- /dev/null +++ b/filebeat/docs/modules/snort.asciidoc @@ -0,0 +1,79 @@ +//// +This file is generated! See scripts/docs_collector.py +//// + +[[filebeat-module-snort]] +[role="xpack"] + +:modulename: snort +:has-dashboards: false + +== Snort module + +experimental[] + +This is a module for receiving Snort/Sourcefire logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: log + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `log` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "snort" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9532` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + + + +[float] +=== Fields + +For a description of each field in the module, see the +<> section. + diff --git a/filebeat/docs/modules/sonicwall.asciidoc b/filebeat/docs/modules/sonicwall.asciidoc index d1a8f65838c..3994e7d36e4 100644 --- a/filebeat/docs/modules/sonicwall.asciidoc +++ b/filebeat/docs/modules/sonicwall.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/sophos.asciidoc b/filebeat/docs/modules/sophos.asciidoc index a8628bfb43c..510afde1f65 100644 --- a/filebeat/docs/modules/sophos.asciidoc +++ b/filebeat/docs/modules/sophos.asciidoc @@ -10,7 +10,11 @@ This file is generated! See scripts/docs_collector.py == Sophos module -This is a module for Sophos Products, currently it supports XG SFOS logs sent in the syslog format. +This is a module for Sophos Products, currently it accepts +logs in syslog format or from a file for the following devices: + +- `xg` fileset: supports Sophos XG SFOS logs. +- `utm` fileset: supports Sophos UTM logs. To configure a remote syslog destination, please reference the https://community.sophos.com/kb/en-us/123184[SophosXG/SFOS Documentation]. @@ -141,6 +145,51 @@ This is a list of SophosXG fields that are mapped to ECS. :fileset_ex!: +[float] +==== `utm` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "astarosg" device revision 123. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9533` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + :modulename!: diff --git a/filebeat/docs/modules/squid.asciidoc b/filebeat/docs/modules/squid.asciidoc index 187eed663b2..efcd537cd65 100644 --- a/filebeat/docs/modules/squid.asciidoc +++ b/filebeat/docs/modules/squid.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/symantec.asciidoc b/filebeat/docs/modules/symantec.asciidoc new file mode 100644 index 00000000000..0020888ff9a --- /dev/null +++ b/filebeat/docs/modules/symantec.asciidoc @@ -0,0 +1,79 @@ +//// +This file is generated! See scripts/docs_collector.py +//// + +[[filebeat-module-symantec]] +[role="xpack"] + +:modulename: symantec +:has-dashboards: false + +== Symantec module + +experimental[] + +This is a module for receiving Symantec AntiVirus/Endpoint Protection logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: endpointprotection + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `endpointprotection` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "symantecav" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9534` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + + + +[float] +=== Fields + +For a description of each field in the module, see the +<> section. + diff --git a/filebeat/docs/modules/tomcat.asciidoc b/filebeat/docs/modules/tomcat.asciidoc index 7a46670144d..6806a47d557 100644 --- a/filebeat/docs/modules/tomcat.asciidoc +++ b/filebeat/docs/modules/tomcat.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules/zscaler.asciidoc b/filebeat/docs/modules/zscaler.asciidoc index f969982851e..671e3aa9f31 100644 --- a/filebeat/docs/modules/zscaler.asciidoc +++ b/filebeat/docs/modules/zscaler.asciidoc @@ -56,7 +56,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/filebeat/docs/modules_list.asciidoc b/filebeat/docs/modules_list.asciidoc index c69ac708b9f..cd466617a94 100644 --- a/filebeat/docs/modules_list.asciidoc +++ b/filebeat/docs/modules_list.asciidoc @@ -13,8 +13,10 @@ This file is generated! See scripts/docs_collector.py * <> * <> * <> + * <> * <> * <> + * <> * <> * <> * <> @@ -47,14 +49,17 @@ This file is generated! See scripts/docs_collector.py * <> * <> * <> + * <> * <> * <> * <> * <> + * <> * <> * <> * <> * <> + * <> * <> * <> * <> @@ -76,8 +81,10 @@ include::modules/bluecoat.asciidoc[] include::modules/cef.asciidoc[] include::modules/checkpoint.asciidoc[] include::modules/cisco.asciidoc[] +include::modules/citrix.asciidoc[] include::modules/coredns.asciidoc[] include::modules/crowdstrike.asciidoc[] +include::modules/cyberark.asciidoc[] include::modules/cylance.asciidoc[] include::modules/elasticsearch.asciidoc[] include::modules/envoyproxy.asciidoc[] @@ -110,14 +117,17 @@ include::modules/okta.asciidoc[] include::modules/osquery.asciidoc[] include::modules/panw.asciidoc[] include::modules/postgresql.asciidoc[] +include::modules/proofpoint.asciidoc[] include::modules/rabbitmq.asciidoc[] include::modules/radware.asciidoc[] include::modules/redis.asciidoc[] include::modules/santa.asciidoc[] +include::modules/snort.asciidoc[] include::modules/sonicwall.asciidoc[] include::modules/sophos.asciidoc[] include::modules/squid.asciidoc[] include::modules/suricata.asciidoc[] +include::modules/symantec.asciidoc[] include::modules/system.asciidoc[] include::modules/tomcat.asciidoc[] include::modules/traefik.asciidoc[] diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py index 20d997d1b19..d449258c40f 100644 --- a/filebeat/tests/system/test_modules.py +++ b/filebeat/tests/system/test_modules.py @@ -226,20 +226,28 @@ def clean_keys(obj): # datasets for which @timestamp is removed due to date missing remove_timestamp = { "activemq.audit", + "barracuda.spamfirewall", "barracuda.waf", "bluecoat.director", "cef.log", "cisco.asa", "cisco.ios", + "citrix.netscaler", + "cyberark.corepas", "cylance.protect", + "f5.bigipafm", "fortinet.clientendpoint", "haproxy.log", "icinga.startup", "imperva.securesphere", "infoblox.nios", "iptables.log", + "juniper.netscreen", "netscout.sightline", + "proofpoint.emailsecurity", "redis.log", + "snort.log", + "symantec.endpointprotection", "system.auth", "system.syslog", "microsoft.defender_atp", diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index ab22da1f2b6..89beee34729 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -367,6 +367,25 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + spamfirewall: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9524 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #-------------------------- Blue Coat Director Module -------------------------- - module: bluecoat director: @@ -485,6 +504,46 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + meraki: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9525 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + +#--------------------------- Citrix NetScaler Module --------------------------- +- module: citrix + netscaler: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9526 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #------------------------------- Coredns Module ------------------------------- - module: coredns # Fileset for native deployment @@ -505,6 +564,27 @@ filebeat.modules: # Filebeat will choose the paths depending on your OS. #var.paths: +#------------------------------ Cyber-Ark Module ------------------------------ +- module: cyberark + corepas: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9527 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #---------------------------- CylanceProtect Module ---------------------------- - module: cylance protect: @@ -591,6 +671,25 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + bigipafm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9528 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #------------------------------- Fortinet Module ------------------------------- - module: fortinet firewall: @@ -625,6 +724,44 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + fortimail: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9529 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + + fortimanager: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9530 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #----------------------------- Google Cloud Module ----------------------------- - module: googlecloud vpcflow: @@ -894,6 +1031,25 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + netscreen: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9523 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #-------------------------------- Kafka Module -------------------------------- - module: kafka # All logs @@ -1209,6 +1365,27 @@ filebeat.modules: # can be added under this section. #input: +#---------------------- Proofpoint Email Security Module ---------------------- +- module: proofpoint + emailsecurity: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9531 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #------------------------------- RabbitMQ Module ------------------------------- - module: rabbitmq # All logs @@ -1268,6 +1445,27 @@ filebeat.modules: # Filebeat will choose the the default path. #var.paths: +#--------------------------- Snort/Sourcefire Module --------------------------- +- module: snort + log: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9532 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #----------------------------- Sonicwall-FW Module ----------------------------- - module: sonicwall firewall: @@ -1315,6 +1513,25 @@ filebeat.modules: # hostname: "b.host.local" + utm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9533 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #-------------------------------- Squid Module -------------------------------- - module: squid log: @@ -1346,6 +1563,27 @@ filebeat.modules: # Filebeat will choose the paths depending on your OS. #var.paths: +#---------------- Symantec AntiVirus/Endpoint Protection Module ---------------- +- module: symantec + endpointprotection: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9534 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + #---------------------------- Apache Tomcat Module ---------------------------- - module: tomcat log: diff --git a/x-pack/filebeat/include/list.go b/x-pack/filebeat/include/list.go index 7a17ab869d6..fe3dd04ad7d 100644 --- a/x-pack/filebeat/include/list.go +++ b/x-pack/filebeat/include/list.go @@ -21,8 +21,10 @@ import ( _ "github.com/elastic/beats/v7/x-pack/filebeat/module/cef" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/checkpoint" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/cisco" + _ "github.com/elastic/beats/v7/x-pack/filebeat/module/citrix" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/coredns" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/crowdstrike" + _ "github.com/elastic/beats/v7/x-pack/filebeat/module/cyberark" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/cylance" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/envoyproxy" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/f5" @@ -42,12 +44,15 @@ import ( _ "github.com/elastic/beats/v7/x-pack/filebeat/module/o365" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/okta" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/panw" + _ "github.com/elastic/beats/v7/x-pack/filebeat/module/proofpoint" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/rabbitmq" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/radware" + _ "github.com/elastic/beats/v7/x-pack/filebeat/module/snort" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/sonicwall" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/sophos" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/squid" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/suricata" + _ "github.com/elastic/beats/v7/x-pack/filebeat/module/symantec" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/tomcat" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/zeek" _ "github.com/elastic/beats/v7/x-pack/filebeat/module/zoom" diff --git a/x-pack/filebeat/module/barracuda/_meta/config.yml b/x-pack/filebeat/module/barracuda/_meta/config.yml index 12971cecc2a..36ecc93be83 100644 --- a/x-pack/filebeat/module/barracuda/_meta/config.yml +++ b/x-pack/filebeat/module/barracuda/_meta/config.yml @@ -17,3 +17,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + spamfirewall: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9524 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc b/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc index 5ebc34fa334..d0adf72682d 100644 --- a/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/barracuda/_meta/docs.asciidoc @@ -51,7 +51,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `spamfirewall` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "barracudasf" device revision 125. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9524` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/barracuda/fields.go b/x-pack/filebeat/module/barracuda/fields.go index e01b040a745..f405ad135dd 100644 --- a/x-pack/filebeat/module/barracuda/fields.go +++ b/x-pack/filebeat/module/barracuda/fields.go @@ -19,5 +19,5 @@ func init() { // AssetBarracuda returns asset data. // This is the base64 encoded gzipped contents of module/barracuda. func AssetBarracuda() string { - return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb99eeSVlo1vb0bNs59XVVk2BmCaJFQYYAxhSzF9/hQZmOORgKIkCKPnd7YetWCQb3Q2g0b/7O3IF69dkSrWmrCnpnwix3Ap4Tf7W/on8DlPypq4FZ9RyJckvXMOKCvEnQkowTPPa/fk1+eufCCEbUGTGQZRm8icS/us1fu7+9x2RtILXRIJdKX014dKCnlEGE/f37muEqCXoleYWXhOrm/4ndl3Da4f8Sumy9/cSZrQRtsAlX5MZFQa2Ph4g3P7vPa2AqBmxC2gRIx1iZLUADfiZ1XQ244wsqCFTAEnU1IBeQjkZ0KcNvQMxc62a+vak7DJ1syxiLanYIm989bH1Y0tsFqnMfOvv+1cY37DBrnxccOO+R7ghjYGSWEUYrW0T+K/pilRgDJ27f1NLmKrAOKKV+3wHNCFv1ZycAlMl6DghHhbfRepQclq4sARpC0daYsAB4czcDyw3yHOmpAVpjbsfXBpLpW3RMFEcLa8OQbCkdveDIXbc4+SWINSS1YKzBaHEgDFOPC24NYSS92B/51aCMe3uTwZHoyPWLFQjSiJhCZpMoTt3NdUGyDuw1KFGyUyrqrfU07dqbl5cUHYF1jwbgD/lGpgV6+fEBrwp+QBeWPgTLntoTqKMFLAEcQAnhZK793OLk6dQa2DUBkxKmHEJJVFSIFqWTgWQitZxrCozL5JdmD17/C7c8/PTH8iSiibceF6CtHzGw+mEa8osEWru90sPNgKp4/h4+dOC33PbUVNtOWsE1fj7sLGT0ZMxAH3QSYmdjAHk8ZMyuiXL4+7Jy/+/J/v3xK2aZ0Pud33V9F8FErK7LY8GuyU9ROhlR02DUY1mmd7e+7Mt1/2/H2bGUgsVSPsYkaNNyW3BBN25w48EPZBWrx8jYgunUz1GxLg8DLG8GlMrOR7vSSuBHiI98rJtBlCmtKFG9JqYndn7YusWcNgM9JCBknA/K2JHDxlAv8GKGOfijmvlSFyUPa9KlH2eXQMyE7GPRDh4Z/axY6jVjeRfGtio0bqjP/xpvW3UnijJ3ONArXrslu2IuFnyvOKwz90TtwyftS7McCDfqjk5W4K05BKFM2lkCdqZIBqCoBqQPuPXUBID1gHZ+vH2GmbcYGk3YQD73gZLtwkD0HfalKEnML1/6bCDOaDrDjy5Gw8WymTSV/vn8ldlbF9Eit0TaUCWXM7bD03s2PR8SF8Pf/khB2zwo1HGnl8sfyK0LLWTlWPXfZe5A+qt+lqZu3yVm72v/t9lr+NWftmwKxe8I63vLSsJJXO+BNk5yb5eRcCx6DD/RV4LpHyMyt/XEdEYdWioel1o+JJhr/vBQ9xgpHu6Ri6f+aXJBV6k58GbbSn5uK6BMDqUIFMgwO0CNPl0Lu0Pr4jS5BehqP3xJZlSg6eoDZDN+LzRqPrdQPch6u5XTDeGQfMZnwn8C+7Xc5XLzbbPOm5X/uodDEqvqC6zKXU9idYju8/J84vPW/oeJRoE3d1SQszaWKjCIxrQdtAW4E+q8cxz/1aaz7mkov3NtrZyAx9y6V97EiPOLz6/irAgoD/gxP1Z0GE05HKK12dzUIeK46GvzwJoCfoosetfcSlyfnqfKKnHtx8sRTCHxUoftZNNsCK7n422itb5RtHCi+JMlxMlBDCr9NcogB33HiDnxp05bgjzrIPSYbqlqL5Vu2oL2cPoR2jxVWz6WFTVShlMdquUJNP1YNMI0fClAWMdQMOrWqzDPrkvO0FPgLIFMbwE8vR7Yhe6IS9//vkZWVFDDIDsVtnDiUehvN6CE6ZW0kA+VrCv5lQw1Ujb+RSaauqFnrvKJgqBPKVTtYQeM7iMZla24s1YDbQavT/sqzk2D8wqKHmzq6elYNQ3Mc2xcyzwGeH2n83L73/4s/Ei/UWNArRF+p8Dav7p7MG3dA2avCRnktHaNMJHVpxJeSe5HoN+z+BHJLcytsqPL8m/O3Kfkx9/JP9OmNJOX0YqwqLPyX8X9n+6L3JDtpnyTXQLpSrh0dq6cgUFo0JMKbvKqwF75KSyeG2o9XaFYyLIslZcWjRNLMQTnPFwFKC1ypSfttEHTQ2MU4EYI6bGKu00a7n2Wof7YEkFL/3BiCFFyEw1snQvjABEnst5UI5uTF7cvhEDyCligeE67AkbjezCWihaPpZ3LqBDDP8DSAVWcxaxOoIp3P8y2sL+uW+FsHv2qd1otGrWbtuE/KpWbmuGNieXRGlnjFlFrgDqG5j2KF68r4RpWjEwpljysihzRV3PWskzBwmaWrzkpeNgzy5ccm0bKpzRvuV7lxEXB6+4M7sxVo7M8FSEq35+SrST1gYdKsg0qudgu6/dyAmjMyU9PTgnfCbcfk7oLKGgoeA/P219rx+gUhbIZTjvTAM+tNP1mKB0/2sDMV9B4CWsVJha8JyZDY/anDd8oPY/Ct3MydyM5x1vnXsDwllvT11rtYQn5L9GhNGLlxkXDxCjd6s64+ji5M1F0H0ZlY49vKqV3tV4CT6RX10aRPM43B+f/FOFhjia7jFX6rYp32x+sjHYvZ6DlvmEvPz5FVkh3yugklAh4r4CdOqjmrTxH5EVaPBgqSUCqLFEyZ1ykW0mPria+HUzMXJXc4RtA+9+V7pExmFWE7CFVELN17uBuBnXAy2WkJ8JW1BNmfVMdJd6jfij01ySRoacHrHlMx+tqE1d0O0D9TmDCHtil2hRVE7JVLINI2i6GpVpKFl31ErKUGP1MQoZfA6KsUa3EI2lsqS6JFLpigr+Ryy/V+kqyp8yZDkczCLVTAdP0p2YtMG6Q+aF4DNAiiMGvgGmZDmiYG+2uzA2p59lD0FcMlXVAmz0AIw6USkq8FbzHTHYqzfT9oEO8qVbO3qcx47y9skcPX6VknaRaJs29ampcl42WU7lAzH+TJY52O5A/qFk7m4Le8SiW71VMX167cddDg9EVLYb/YZYuLbh8pElaNMrpyj35YFF9ve+h20NNBWZmzI9pnQJZb53MCTZhGfKdCu2OkabadN9sR9fH75WWlUThNpgUb5hIKnmyqv1VSMs/85y0IT2GvhsetlUVNJ5rDSXEIHhndZe9Eh5XA3h9okhaiV9ZMzSqt71DAaM3WoOxeHts4awBXfWjSrBTMi7xlg0k/pA3a2kdiQvl1o4cJP2CrDZzOG9hGNoQrjJ7YKedxpmoEEyfyCoU61LvuSl02zwPMQF2WUryD7uMC9O5HXN9dEo3OynjwVdu5PIrVh7Yo0Tek5fc0jhAd3vG0246aMunOdOGnfybDJYsksnU01qCVQNFLn7Quz4n/qqoAb5pYHmaEfJnW5/ijbycUUNQSTKkXODyP2QmqkJlYIthmaQafPKZnh951UOXOsiA6p1kUN7rlOKom2gL5NDzaAr9V6RhzEhd8zH6BszeC7v9OYcKjZvkmuHBAs2D8RON4TUjiDKBkp8CsXaNCJ32GnEilKNZaqCFx6HznjBrGw1G5wQKgMLtgzIkQMCS9Dc5iwd2UNYu3ooAuxFdva5fPIWLw56B/pXuqt0cdAw7lQD4zO+MXzi2q0P5oz1VAm6cv5spsgGdC5GXm4KJloXVRmCLFG8g9l8rE34vG2l9y1BpclvlyE1lps2IWDXr4brtzs0ViVpamV4QsFxq7OF5rQsfYcpTOVv7+5oF55G2CJf66I7iiLZVKA5u6ssitJ2hCq2PYT1K9m6m+HFkr/fA9KWIEulQ8LsXsrU9F8P0L2mDe2q6b+Axe1oh1j+WvABu50E3Y+Yl/Q5e9V9M7yQoeo/iJng5VrQLrdYKksoWYSOF/EEWqHmRZuo8iBCvT2Idxbqx+iZsiX7/o7pVti1GsVHXPFXgrN17tuzRy5cIAKhubYU6xG53IicedNxBn5oBCBicXGqpIXr3Bprh9C59P66TT9UWpbG/R8+qlS0CMUawNzwOLMFlXMoJKxyy4KxwCWseqF+VEKs1XzaWOhJiGGOvvGoO229//zFRYepaTJh13FO8GxtK/cxDQ3B3fwij0xff4sYt1gB5hjWNhw0m5wvvQQ9IZfgN6UxoCd0DtjKO2S6z5RucRjAbsF4vZ3h74n/fa9vhdJkqtXKfdb+Neia3uwa7Sd9Xl5QbVO76TrAqT0q4U6pQXXose6UEmWnNua6UqqGEFDM9Ra/kYQK0LbLLtKbRcPffHgriI9eEwBMQooozCWRSn6noQa0ZPZlP6DZcMwnhzVauwvT2Su4k6jHveA+wtaGfwaUrbhdBGXZy3pyigtOsdpEEiW/myv333teAlRSiojimJFu2gsGvkAEHJJqRpx0sBzMhFxuZMruYIN+ZVUejE98OV9jnBHjS0Z9sk0ZxG9gPCVMNMa2BzL8Y7BN+BNu3E6Gmujg33CKL346rgIdXfvxNyxu0fu2TPmUsic3GV4Oy1PEglBjFOPoL3W7EbUnccPe8it4TSipF2vDGRWk5ObqOak1zkR5TsCyJ3FFmWp6SO3lHR96X2ejaQUWtCE1NdjFy2AjB9+LgKmqclJMbQXth6U1YNledc+/Bw+l8fX2MMPD5MU3U1XdDO9ghm2jZMVlqVYhn5YpyaC2z7tMilFmDMicNUKsyZeGCu/8LFVFuQxSQ/YWEmrk6ep7PVOpS3tIdyrhWy6voAy1QG0iOjXonQoGivvkmw61CS/3bZwYdIXIKur6k528W2IXgRa93y4fCq/f6uB5JZfDdj1d0Bl0xXcHO+V2sYY1EVt//vdr2j8m1rRnXOS/4x3Jv+Bq3TXWUDYMSBs5gri7zYDmVBSR1zTbI3KJS7Zq8+772HsA3Qsz6hcAdmUOajmQwmMcVncP3YKaRXdDnVoYqTJs2MJn/rY1Nl2Z4UkLaadFmCOkW2ZiNHO/6v49rDQlTp5LwjHnrpFMANXuT9gIb4NaKCAM3k7dFnbeHH3wwq8Z9nl61C8WU9WUy65vdv/BCmWj+g6v15Lrxhzb09fXRhCBcY/fcQKkkStx4lf3PRnHPaXegsvuGu/Y573M56fkvZc0T0PjBuKn7YWiX4fbs7he7R3QD+HL77mfz0+RpaHkrRMTQ+/BdkTOpwF6Eib+EDlZsOImbqQuzTpnL/vtqG4o0Pbqwl4/tvTG9xFPjWP9SbcwOT+9UZNN5Z+7QZN1iL2U5UajnZATX58Z+p0K/8F+bRYR1Nvf+OGb4I6bNrar3FS2e4waKcB4zij/oKwUWVLN6VQMqgB9UwYuSS3oiCAwIE3W/ihbG9pXVf3KEyepnIbR1hdyt8+XL84vdnVoElrGeo/CWF32gQMFb10LuYm0eCTJubTkks8lRWExckRrpXM2r30ykF/ukF60upvCro74nw6R3l3GU1aqyMF5/9tHwiUTTQlOnIVBtu7nE/L07JpWtYDX5MI7RDxYlN6TuF8EI3NHj22ic2rztMQx4+bKqdwH4HWHUryeG/N9eBo+cHO1J+RqNZ/PQecbYRdn2ed+LCDggNrpQoNZKFG60+Nt9ZFJo1uh9yN4Foax9yCVn37wOsazrhnH+Wm8jOTW0Xmmqro4ct4V7krIvcIxrt6/Z5rpdw4dJbE+dYbjZlTZsDErLailD5Q11se8k5ZKY+cBJ9db/EamxFFdrqh+mAy9YVd9J11peIgcESOtkZ86IUrJO8rafspx5daJoKPaMUp+1yqoer8U8rZm8qHWGqhJnhtsLLVNKsW580dRLh7M7HCLT9U14eWL8ffLvazNMTB0GH0aND72d8FhEb+67TuWefre4JCfDufuHfKccamaVDHOXh2JmSe/U06SpnQ6DDyyPyUGnLsz49aReCOEk3vENIyBMbNGkDO3PmGqBOOORNvsN25ZcFnCdWIGCG7sYZrnPWULLoymmG6RmILG+GZFNReYwRPx4Pn4u5wTikz8zv02SpnMcA7V1DcXeiCNOKxOnnb5nDVoU4eiWy9hBiwLKsImIb7t8PRspMjQu7mG73HuhBKvfHVJXsFX5b/tPqRcGlKCpVxEnAxT1dje70ZIU+LouZmtx5Z2eWyIx/hDaqGqRbZsnjekhBkNIaDQ+bKN4YdsTacVL0ELusZCLqvC40qeRm6k+wCt7vBrmLVV4N5Xbyy3DTZmJFHCNrbBsGHTfa9r0ihWz7/DaGpMM8gqpqrK3ac8x+jEQye8l+xba7XkpfeftV3kKjCjiVClYocHGu/uLfuFi43WyPp5eXHV4LrGpKeHkfXt6nll/b/U9EC/08Hk/W81DQGY+O2qeb7GuaeYUOx3/vLinJwPFKo+Gtm61obqkv0YJCzs6qph50kN6bv4w0JudVy59yKimKoyd8XXoOJuV+kIuBCHy4h6tEjfLcGHDI5Qed5zAYfSYZ9A28VD+JyXXShnxIlXpbYaB2XgCV7+dEpeR3fd5Hym2uneF59895w2EIXJGtfAmr4Xwad+TSFW3tp2YdqXuHEER0jUK15uO0S66kq6pFzQYSCDdK5wgvWVM9B6ZNKCv0OH+PrTxd2CsVKFBlA+ADsgKaQbGD6fjEhEXhXTpizXyf0zvCqS1gH14DYGDmt0vtdLlR6i5iphl4OdErvCNMcoSOCmn73qe67SpuS2q6zb9EULGMUG220qNrwo2YQX9hPps8RSc3B5NKv85PMZeRpqJT43wunKUy6wgAPzwM6ua2XcN5+R74aOBrkbhbmSaiW3DCEDrMFmFstt6COTNhk9ggtuNy30pK1yfx9Kk97CnLI1+TRqrgk+1fQhivLDwlss5pJUlMuZphXsTceoqcapvfn7JGwplxe4LHmvSp8cvWkL2Ms6iyBFbtC+MFXAMSKXhbTdN+49rMivjURT8p0qQZCnXC4n3z4nXLHnZOr+D9z/UUnF2nAz+TYeX7SsLmaCDibnp9ahtjX8kwuCi6KvC+Xkuh1+pWZ7GzVYlRVT/9dpwLNtg2BAu4McRWhZpZW7O5h9fvc71UA++gTgb7/9/O73Nx/Ovv3W59wuqaZ89EyulL5KWbJ84wX7vV2wH2EbdYJRmVqJCDU7abuUdM8BZe65WGcwYWZKgzScpRQgPVdSBoyr9F6QSHwgFdBiRflwOPG9vQPY+zw1UHd9Upeom2aa6VLYaWmsTl35jvXa2Rxi/bc02Tva1nzkc5IeWuyyGQw2UGlCscmm7iXUuzgQMz7qaGpJzeaIPZTUaDeiCJm75T1xoXxwP8G7Oy4c8kH//zBcdaMy+8l/D3LEyp6PPiCyF8kHORxtHHcffkodIWlra2d7dulT22W0t1l22CfzGbrdBif35sh027KaHyMehkVfM8qF43XbzOUiyIzz035tG3bicuaghXmkhcF4VmGbc104FfEAeg5JvMZ061B9dKKqqpG7nqgBdvKwxk33xe49XNu/Q1yn7nAzh2nW98XtksrybyoeNdvgZqnlh0iGe2M3XHgLOdOYmjOukmWJHsuCR+xXVMth0OGxo25kVRcqlzC+fP/ugvzm/aibpNQ4Il+Omkpw+R9vyZcG9Ejv1kbIQsNup868yQ09h+iafGiLzqJpXZ2WzhI+pH2gKvUYAQe0PshxdBNUGwmO3RtumX5AAxVUVxl2y4HN4F6gdcIC5A5oUyabSrsFM223qy3QJbW7WuF94U5BskVFdaqykg7uuqaD8cX3jj5RNkinSgKzWCQ/CwxmaQuoOsCzObZaygBWTf+VAWpNk0/C8B2nkh8vDLoXPPWDEzq3VeBUz+RIy4IyHIySvvzEwTYyofHeAzyd18uf5LVdJH/fmSyY1UVpkvZd70F3kA+LPN0C8FLQ5BJDFiDnXCYsihyCzpEbLYtZYVbcsuTyQxYzoVaGVulzV/qwpV3mg54h6sJkwWVOccJlDbqarpMlvA9g1+wqD/AlFTnOCq+LWiurivQhKYS+/KlAj2N62CLb3RRqXpQ5mO0Ap89/Y7Ko6HVhbSq3wTZgd6IFZHgUKi4zIc1lPqRrYQoxFUXqsOgW7O8zAk/eGbwHO3UvxD7s1FW9fdg/Z4T9KiPsf8sI+39khP3nPLCtqgWdQg6R0kFPb57JomoEKt/TdYZ3sgVeX2XQS6pG8HlV59G+nZZJxTx1ElKAzHMoJQa+sPS+EVkYn5CYYQeNZnmsSQc4jzVp1qapM8wiZbIrq85iqlplnekB1xlEiFXWGWa5YKNZkwV4I/m1pFIZYBkO4fKV40qmR2H5StV2AbTM4FZTVV0wkcGH7QBnCJIgXD1d2/RuUQfZZIFcN0WGmAbT3HJGRYYCIlPQOUi2Tph11YctqVj/AeU0B97LAtuAZoHs28Hkwdon1maBPp3Xy1d5fNCmmHL75yyNxpgp0s6K2wGsVXJRbbJcc4QKTKevcjPex59s1lYPMNiF9/Ond4544Kj2ZQHuu8mn6yDXgz3jAnLYMKaY5dhEPktZnL0NOIduYApeY5JikUXU8Xr5U2lsPWjmnwi20SwLbMFnkMOMMehorqDkyQpGt2FzmeeUVKpsBBimcnA7AOfzDLJJ1WZFbdKZ/z3osQzyJIA1zLmxmqb3hGxgZ9D4NNS5WK2z8dpgJ3KdSb76zHx/xDNAtxpolUGR9KVAudDOp1yvFoqbwk+YTQ99TTXNcsDLkULYFJCXfr59arjcWCqTzzkujZ02OtWwwBYq+FlBOaA2yXFNr0e3NcmpweLkhln6YdeHdhrYB3NOyzL1HeBl6rBq2zoow1vEq4JppaosXYkc4AxmGq+KPMmRoeNRDjbXV8nbM9UmfctSXpta88RABbXcNsmzzwSXkK7FzgaqSTpRp4OLxbfp3VpC+a6nxUyo5M95BzxDyr+zeZNLHQc0g8RxNnQGVJPnJgg1z3J05TzLBa6VTi3Aqmkzz3HNKm5YDrFQmSwHNsccCAkWmyslh5tchvsG0Kkz/jzU1Ol4crVKbYFkqShTfgB0cktUpdeMlObzIjKP695wVxJ0+jerLvxQ3uRgk06m3oD1I16zHLIMhZthJk5qYRDAppYGdeEdScnRpca4Dwu2SFXnPwAN1zVPHgioQVdzTaUd9NxNAXmVBXD6p9d3Ivv0aWcKaALAWs0LauqEAwP6oDVNDVUDFTn0Ow0M+eC7jmYCnp7JDnLaFq49yEqXGTBO78g0GXzDxvuGM+QDGEidCOAHHmcwTgx8SX8AYg1ak0HNYEoZPs8geE2d2stmNMtxDzQrkyvSRrNYV9wEgG26EVt9mI1J3lVzyWTqQonotNj7AvVNOlOTb+c2/bHyQNNH9LqZnqnhruvk3VqbcpolD73RIsNb2BjQRclTV71nGVvRRoZysMEyY2mV2hu8LLg0ls4yaAZLrm0ONXxZywytm6zSjUzpZo21RYt0FH3TWEU+NJIMlu6yRzIOy/tMBS/JiYaSW3JCdRm6GRps/x5Hx0/OysilsQmhCAaH6BPsb8CUILFSnS4fgst8nDuraqHWMBgseCP/ZqpJ1tT7lmfM8dD7jHDemYY5XJOK7jZa2MRi5bzZHQaSHUnBDQ5naFcPW48NlIhp6lppS4aNRwlZLagl3JJaw2zsKNwjLfcuQyhijA9WR4cC4TJ0dh/pCy24zD2Rv4eqW62PpyFWzcEuQE823zcL1QxeNEIkLEF344isIjXVBsg7sBQngvu7SjsWPH2r5ubFhS97fUZOw4iv58QuIlOKsBnwBwijjxFtSd6D/Z1bCSa+z8NDnYV5MxzZ3d0iXNwTa4BqtphwyaP44czdI/TX3hGfOAsDkyFeCNpInPU7b3COa9vEPd7Afadf+x6a8rfj7mjqmnCH+cUjxr7biCJhTdPtOq/isuQjXFu8FWPugmNMox4RSJvBde9xQrUUIxMvsXtuxnHg2D/XgCUavjRg7J6m3YdnK9+9V75XGXAsj1/VS+xdj1SXd7rtTtmHk8cIY2Nbf8cO7eZ1lPKUs/9vnm/oFjs/bYUCrh0/G2g1pEviveMRdo/LlBogPl27w4YMblW3S+EXD4Ov7EbBd5gr7dvXR9lICDXEAOC4M7p/XpWm0lB2hPG+gw7TfmmJau/m0LBG4wS0fUjXoCvu1Y1jIb1Z0g/m4EsuYA5EwBIEocbwufQbt5nXHz/62JL5AeU3rr/npE8fZNKzw6yR/EsDu2MSafzy9fA9rGPiYVNQWo2Gl/5CMiUlYG4FWXG7GBMUhEQqQzqNXcNB5UV3Ni0cO1GedE+UUHPOqCAOgxHTB7F4WOxwqZExjQ/Hu3qxNnH0eulsK7WT1Zr6gaeCU1MsVHabwBtxnbmGs1Q2Q42cVOyP4In3AyD+0jhs8U0Lg1iYAKonb4RRzhDfum+nGCwnv4ZfTMgbue7+NYBu0ZY30hJaTpiq6saCjovhLG58R1g+8+yb3b3AGYtbG8LtP5uX3//wZ2f7nva2o+XYN1G0wzkt0kbMbuu4oWvQ5N86n5x5EdBA5OK3PnX9T/4zLzc4b536vftxYPLyTbLtye7AFLfOhLz/7eOZox00eOcJ+ktLbpiGmkq2dlplUM/Ebi4IQQ49Jx/fvSbn0v748jk5f3969p+vyadzaV/9RJ6uFmsigdsFaMIWyoRRaUprYBa/9cOr//Xfnj2JcgTsIqOM2+UHytRJRePjeEzm03fHa37pz+J5i1T8ipePC+m+bLoB8wMbxt36gY/hu6OYbqyTz1zbhgry9s37KLJ/KAn5fFmHnYz/oyRM4rx16H41IhQJuVl44hY8xjd4zz7MqYUVfYAR6Xi6L8ibstTop/WnPIZO9/Syqj40znnfWMj5ybsL/yqNhscqao4Y/dhyKnlNNbzd5PzCoTLi/XI8PHASRBIeurXHedhqYoWfrnVcAdFDl5Yld1+mYhOw7c3yj79zRzwAziTEC67CDT/dPgIDVDa51ln0uts+aZS8DxheKG07kTwQuiUG2HADuF3fLHnNkXnv6eFy3j4mLVnvxhgvIWY3HsuLG7BDy5caoxh3Kqf3Gw10HOLksqZyDpPOdGJKzvi80VCS6RphgiwxayguZ+oDWw8MikZHtOXoorMM/Q5EQt2/X8KV3AGgoVIWipDZnT7PKD1rS2kKWvhU/Ayga6vzAJ9lOBKzDNXCIsd1yNX/pM7AVFoWrScun1q+a8E7Oia7q/WdCQ+gwZ7ZBWgJlnxc1/CcfGqfsbfoAPuRXLQOsMFL8NuYptaO6jmCMjFiGrdIB7/4c0KFiCoT9eaLmOBGNSbmLUG7N5BLq4ix+JhzST6djwoUhgmy2eRVcpHtgKo6w9g3B1iDSZ3R68BmKHHxL2LqVHT0t2fA1o9WKATIefJJkYizUz4yaqEjGqhXeajoBWAkYZhOMCOU/KL0iupyOKebkDdzTPbShLobf425dFOwKwAZVz0Td028a4xbWSr6oTqPDMGW8ZgZMaCQy5DnimkJFbdOLIURG3ESl4LKY8Txb+GgbBNEei7KAYHbLstNJGXpLNg5GrDbL0/qSCUw7EKwTNcP7nYRe6otZ42gmmC/aNIi8fTs+vVbNVezWXz6O7DCLiD79m4h+9Et6G9jD+8zh7dD901jFyBtSBYfRds0KTsn3C6hxy85jvonA3oUYdVYpo7L6bDkOMKXDWNgzAjO2Hn8sOZohyWeIF7EqbhzpdckUpgwwO0YwmkLR9jB0UklDPCZWkn3rji5FVMOux+SgaK0TdUyXT+6kXeTEt+1FGsGBIeyoyf4YXb0YS6J4baJyE+CxQUQRHSAuqCG0FLV7nWxC+CaqJXcbJlnnKXXSqpqJK8WZ3IY7lvUH1eJcMo9l6WTP0qbjgGU/MIFkDcBscmADbdx9sqOMH8nRxPGO/ofJF1hlAWXIWshLRdiNEYYkbLe/R6M8Pl6l6FeIzUnxhNCpypn9UCE+Cks6JKrBrVLpqpaq4qPZCjCsZE7k3QqsIhsRk7248blshM7GZHcxXBL6yRRBLYwTDpc5gAEI+t3+OXe3d4ru7lvo8duU2bZSLtbzpZaoy+xDLxgh5j1t9KC8D2egwTNWUsSMgQT/XZTC7hd4FMbm+1GArIT9sPEWD0e/GxpOqTt1oPR9HI/TUG98GtlpCtqmnZGuOUVGCfXvbanoYbRIFLYhWRNIW7cCGw8eM9t0Lc8Wof07n6wo/Xj7Wj6oTDJhpzemrTgML6JwgFtSPFGINxCGHy91L28kTp91L3zFy0JbfrmnUvWS/U4AuQGOd4JkK/3OP5485alGm1wnC27nXzUR5UgKe/YLeTHUY9jStoGh7FT6rEEbcdPnbxyp7GLogK7UA8QJaFbnmTi0QhfG91w7KWkVVav056ozgclgr/WIbLnXGbyhPzn5OfvvydP356+uXhGTrmxXM4bbhZQYil8FBeh5ip7X6B9kTDMlp15PMI24xdHMsa0yuxV3Ff/6XY1hkF3Y9Ajn2zo812uC8O0/67ut+f4Q5xiMVMqY23SN5liVKTqTrdDyAda8sb4FYjSxPCKC6q9eHJi090hhu96vLwK77nh5TE7jfQz5T+5g9B6EXf6Ym4ueb46izdy313HsEaoNOz5f4OTCD8ZnIXguIFeWUYZd2UqnTMxYBCyQVYrPaeS/7Enq1rmOwq3ZfYBnO6fqRF2z7iO1pJm6vrzi1sOXwvf4sv3LtrKav4VqLALRjWQWkOpKi5ptOCuJ54uqOUgrbkxPV7QY1L7lj4osb71I9SZDq67Ok+c4KqpttgMaUPqfrF6xGZHQdjcRqLOoARNLZRFsqSyPefDCZ9f2hW74NmFVkteds3DwvdoXYugqQ4ORmj+4561bZ02ruBsiOTlkajslgy9/ux6hMzo8FDMnFxyHz1f7CruIy3gOqUz5VDwu2qecI06U+9HvUroeYRQr6OixkoNMVZpL/EdtAosxdWe4Lcm7ltP4tRXvCwFHE/KvcP1bivnItvbk3sHybl2PMZxyL0Iq/U6DMl1G519TmpB3Za591lpApLpdT3m5cdUyCPYk7fIoNOdbfmrMpa8o2zB5YhJV9JMkuObXV5/kpjpX2tw4sPpR77JmZmQtyWtyWf8h9ePSiV93ek/h48nWdAlOM1JANXkSwN6TbAHoamVNNBqVPHiVEdvgb85jrwMPfCYg6x52wVSevJ9X75xPFuSjoDq5gB9CM1Rb4spTnnK6zDbPeNta+mtJkbONgwPLzdEN1JG7VjzvHt5fOTZt5EaqbELEItgYebfCEpWXJZqZYipgfEZZ+6T57E6wZAnO7wgjjyP7ybnhjzFjrAg2eYZwtDlsx63SCPxHX8Lc8rW5JPZbnzbRWCr3ULa5Nm1boUjGOwjr33f1EJUsFYND5l7EQcc7/oARKr/typNsZxnyL5tsvMr1GPdeb16HaEYKYwetPCbA4g9Tl7vGKkhwze43ltZd4akj3cBHVJzHIddFzDY3ptNQqbfhsEOxRtS3Fz8jGUDKUcCjla4IcklzLgMvnoUTtjVr6L1SNNBxO6gQrFMuG0cMDvqX2rB2Plsc9MeeimN9KbsfNjWUraojtwCf7MqMpwMrKP+dmQZ8jLlMt0EsaR3w5GMRYV5H8+IkOqX7eC2+Dbam/L+yNTOAdZ5374bsK6pbs+U+/PzDSmrBR+0Uifudjhb1ie/34o8m3xmiW9rofQ634b/xdRU/vXGjjEtIttd1Fv1PPY0Obb85QVCv4G2B1OJBlS1/db3UzV6CgqQVqv6ENFRqmY6cC7c6oyHNZ21DTeUIyCOvrrjuPfwRFU1levuPuK1w3H63l5ZgnbPUMHlTMWVAmquctcI3SA/dqzIFrMV5O2KPvuSK0fgl0aINfmPhgo+41CSU6x79s7BKCormBZMqSv+QEH332FK/Pob+5mKMW0+ebfZTTi8biyq3AeOML35rn/olghTdoI72vvkJ+TjuvakbzwHjjl+B8c3T8OsSNpMdgdth4N3ROgnJta2dheZY7jqOuVyGzvvWayVbr39GGL+8HZky3u9chIfp5YXdd45RHtY4Va+0XPfoqmVyqSJbCPl1nH7QWpq465JJgtqUkb7e4B1KKdPDLnRIuE296Am3JXOGC0ancob0oNpQBd0ns6m3IBO/jxtg06a/rgNOpz6DIIFri1IVK3SGycOfrLT3Cl6Cw07qTKpNSq/xDFqCbdk7kdcFtWrF+G/TwIKL8J/hLymmNufCtDx7LxAzgNGzz0x/eA5elx7o9YG5JRhIJozqbicgdYjcdch3Uehq6/438j6qHv2CEi2fYlnvW2IXCkMa6usVyqyxNGO35mP27tj9xEziHX/T/+AYYLW+MBPXi9AH8cf4XT2kPH09ARHPz4jJ7h+HDXQ9kjNUkb4fAI6DP+ErSzMPc15IWvouMfI3oa7RZ+YXqfovTvN/zjUK3n31ijx3SaX/I+4t4ZfZZIp5/84IxLmynK/gfWCmpEJUIYdu61Qbyv94uPDBd1WZ5sANUhw2TljbeP0tv4mnpBi+PwYFRXb/Y26qYcfRwctO2nCjWmSK50IGZOl8nnr7hdDQQxB66w+0MGm9KXnmVucXGJwep90OkqGRNcZPESRn15iauf+x6gnPQ9D8u7Scw+O4yLUGFEsc77ouyHV4MiOIlMW7ujRJnmbRpMLML+CYFFnam7wzWZcSf9BQtn6EzEYr1OanF+++ce7C3Lh3inymxyZvrLBNlMl9SHYflypOLYohtgC2JU5yIl8OyGctwdZbOhc16+zaxGGaaBhBOFGCu7RckHzQVPIB1ByPR5dV5BRowFxttQ2R5vw2cdySQUv/UGMILErCI/W1XqfIESOXcHa7IrtRCe/TSBNDHthbW0KjjNos4DGrczBEEYfwW3ic9lWvijN7fqGG8VUVWXtE3dLvD0ewSEUL8FfcQ1i19JM7WJZCSoLYx5q4K1b2cvw3wO1bY1WFFtfalzUih8jrTqGsMeAIAaIVNwaQLayBZVy0Dgjd7upsCoiMhKzPVLb5u5hCTMPf3/75n14917sLN89KFbpXd9/8p5t3FwVSyWaXAx4085xlmHOTTcZux3n20huDXnqkTDPsFsHFva2E3V3wBNEOkqNaDJJs7cB10+S25AuMNkuOliCxkyBWSMIU5JBbZ2hfOn3cKS9wmqVU/p6xjuDvR2h7RCtlbZEOf7++rc3sRTcKNtTnzul58dPsNwtMNhysU6pb3YSbRTz97PfLs4vyDt6XXFZdmO949vqaDt6GubWEMURsgIZA+r2kdWpT/GSxeTp2b7KsZgdr2DzoYvwW5Kzqx1bzrIglc9PQ5fegMVeDMXxNuWBewW0FFf/5euGu8IcWQ41ydS3G/0lzoR+oOzGMK4arfguqFv54t7nxDSRFHVqyF+M1UrO/zoVlF0JbiyUf3kR/va8+5TLGbD4RzOuYUVFVJGhU9H7DaGyJEaRkWOpYc6N1Wtn2R9TWNTULkKz/g4HsovDAEl0Sh0LTV8I7eu1mNK9LuSdPtlhDtLq9Z/+bwAAAP//MzrDOQ==" + return "eJzsff9zGzey5+/7V+Dyw9lOOXTiJH63vn175ZWUjW5tR8+ynVdXWzUFYkASKwwwBjCkmL/+Cg3MF85gSIkChvK72x+2YpFsNBpAo7vR/env0A3dvkZzrBQmVY7/hJBhhtPX6G/1n9DvdI7elCVnBBsmBfqFKbrBnP8JoZxqolhp//wa/fVPCKGWFFowynM9+xPy//UaPrf/+w4JXNDXSFCzkepmxoShaoEJndm/N19DSK6p2ihm6GtkVNX9xGxL+toyv5Eq7/w9pwtccZPBkK/RAnNNdz4eMFz/7z0uKJILZFa0Zgw1jKHNiioKnxmFFwtG0AprNKdUIDnXVK1pPhvMT2l8j8kslazKu0+lL9R2WOBaYL4zvfHRx8YPDdEOUujlzt/3jzC+YINV+bhi2n4PMY0qTXNkJCK4NJWXv8IbVFCt8dL+GxtEZEG1nbS0n/dII/RWLtE5JTKnKjwRR4v1mTp2OjVduqbCZHZqkQl7hhNL34tcg8yJFIYKo+35YEIbLEzNhg7yaFhxDIM5Nv0Phtwxx5MdAmGDNitGVggjTbW26mnFjEYYvafmd2YE1bpe/dlgazST1StZ8RwJuqYKzWmz70qsNEXvqMGWNYwWShadoZ6+lUv94gqTG2r0swH5c6YoMXz7HBnPN0YfqFMWboeLDpuzoCA5XVN+hCS5FP3zuSPJc1oqSrDxnOR0wQTNkRQc2DJ4zikqcBnmqtDLLNqB2bPG7/w5vzz/Aa0xr/yJZzkVhi2Y3530FhODuFy69VKDhYDZMbi83G6B79nlKLEyjFQcK/i9X9jZ6M4YkD5qp4R2xoDy+E4ZXZL1tGvy8v+vyf41saOmWZCHHV85/1cGE+kvy6Phbo2PUXrJWVNUy0qRRHfvw8WW6vw/jDNtsKEFFeYxMoernJmMcNw7w4+EPSqM2j5GxlbWpnqMjDFxHGNpLaZaczzenZZTfIz2SCu2BaV5TB9qxK4J+ZmdL9ZhAcvNwA4ZGAkP8yJ6dsiA+gEvYlyKvdDKRFIUnahKUHxOXINpRhIfCkjw3uIjU5jVlWBfKtqa0aqZv//TdtepPZOC2MsBG/nYPdsRdbNmadVhV7pndhi2qEOYfkO+lUt0sabCoGtQzqgSOVXWBVHUK6rB1BfsluZIU2OJ7Px4dww97rDUizCg/WCHpVmEAel7LcowEhg/vnTcxhzM6x4yuZ8MVlInsle7+/JXqU1XRfL+jtRU5Ews6w91aNt0Ykhfj3zZMRts8KNRwV5erX9COM+V1ZVjx70v3MHsjfxahbt+lVq8r/7fFa+VVnrd0NcLLpDWjZblCKMlW1PRBMm+XkPAiui4+EVaDyR/jMbf1/GiMRrQkOU2U/RLgrXuPh7CAsO851uQ8oUbGl3BQXruo9kGo4/bkiKChxpkThFlZkUV+nQpzA+vkFToFy6x+fElmmMNu6h+IFuwZaXA9Dsw72PM3a943vAMms75jBBfsL9eylRhtn3ecT3yVx9gkGqDVZ7MqOtotM60u5K8vPq8Y+9hpCjH/SVFSG+1oYW/RD3bltqKup2qnfDsv6ViSyYwr3+za60ckEMq+2tPYsTl1edXARF49geSeLgIGo6GUo5x+7QbdWg4Hnv7rCjOqZrk7fpXGApdnj/kldTx230sBTLHvZU+6iAbJ1nyOBuuDa3L1tCCg2JdlzPJOSVGqq9RAVvpnSDnxu45phFxoqO55XTHUH0r+2YL2iPoR+jxFWT+WEzVQmpIdiukQPPtYNEQUvRLRbWxBDUrSr7162S/bBU9opiskGY5RU+/R2alKvTy55+foQ3WSFMqmlH2SOJRGK93kIQupdA0nSjIV7MriKyEaWIKVTF3Ss8eZR2kgJ7iuVzTjjCYCGZW1upNG0VxMXp+yFezbU4sKpqzqm+nxRDUNyHLsQkssAVi5p/Vy+9/+LN2Kv1FCQq0Zvqfg9n80/qDb/GWKvQSXQiCS11x97JiXcp76fUQ9Qc+fgRyK0Oj/PgS/bud7nP044/o3xGRytrLMAs/6HP037n5n/aLTKNdoXwTXEIhc/pofV2xoRnBnM8xuUlrATvmhDRwbLBxfoUVIhV5KZkw4JoYGk5whs2RUaVkovy01h7UJSUMc+AYONVGKmtZi62zOuwHa8xZ7jZGiCmEFrISub1hOAXmmVh64+hg8uLuiRhQjvEW6I/DnmejkVXYconzx3LPeXaQZn9QVFCjGAl4Hd4V7n4ZfGF33ddK2F772LQWrVzUyzZDv8qNXZqhz8kEkso6Y0aiG0rLA0J7FDfeVyI0JQnVOluzPMtTvbpe1JpnSQVV2MAhz60EO37hmilTYW6d9p3YuwiEOFjBrNsNb+UgDDcLf9Qvz5Gy2lpDQAWEhtWSmuZrByWhVaKkp5NLwmXC7ZeESvIUNFT8l+d17PUDLaSh6Nrvd6IoXLTz7ZiitP+rH2K+gocXP1KmS85SZjY8andes4HZ/yhsM6tzE+53OHX2DvB7vd51tdfir5D/Gi+MTr0sGD/BG70d1TpHV2dvrrztS7Cw4mFFKVXf4kVwRX51aRDV4wh/fHJXFTji4LqHQqm7rnzV/qR12J2dA575DL38+RXagNwLigXCnIdjBRDUBzOpjR+hDVXUkcUGcYq1QVL0ykV2hXhyM/HrFmLgrKZ4tvWy+12qHAQHWU2UrITkcrntP8QtmBpYsQj9jMgKK0yME6I91FvgH4LmAlXC5/TwnZj5aEVt7IJu91Cf8hFhz9sleBSFNTKlqJ8RFN6M6jTQrD2zEhOwWN0bhfAxB0lIpWqK2mCRY5UjIVWBOfsjlN8rVRGUT+6zHI4WkazmgyvpXkJquW6YecHZgsKMAw6+pkSKfMTAbpc70yZlnGXPhJggsig5NcENMBpExWDAG8V6arBTb6bMiTbytR07uJ3HtvLuzhzdfoUUZhVpmdr61Fg5L22WU34iwV+IPIXYLck/pEiNtrBHLdrRaxPTpdd+7Et4oKKSneg3yNBb4w8fWlOlO+UU+b48sMD6PnSzbSmONc22TI9IldM83T3ok2z8NaWbEWsbo860ab7YfV8f3lZKFjOgWkFRviZUYMWkM+uLihv2nWFUIdwB8GmxbAos8DJUmosQh+ed2l90TDleNWLmiUZyI9zLmMFF2Y8Meo7taJbF4ekzGpEVs96NzKmeoXeVNuAmdYnaU4nNSF4uNvTIRdqrwBYLy/eaTmEJwSLXAzrZKbqgigriNgS2pnXO1iy3lg3sh7Aiu64V2cee8MKTvC2ZmmyG7Xq6t6BbuxOZ4Vs3WW2VnrXXLFOwQffHRiMu+mgI57nVxo0+mw2GbNLJZBVbAxUDQ+6hFBv5xz4qYEF+qWg12Vayu9vtolY/brBGwEQ+sm+AuR9iCzWiUbAj0AQ6bVmYBLfvskjBa5klYLXMUljPZUxVtEv0ZXSqCWylzi1yGhey5z4G75jBdXmvO+dYtXlIrx3zWNBeED00hNiBIEwGRnwMw1pXPPWz04gXJStDZEFfOB4a5wWysuVisEOw8CLYcSBHNghdU8VMytKRPROrR/dFgJ2XnX0hn7TFiwPsQHdLN5Uulhq8O5WUsAVrHZ+wdesec8YwVbytnD6bKbAATYiR5W3BRB2iyv0jS5Bv7zZPtQifd730ricoFfrt2qfGMl0nBPTjajB+vUJjVZK6lJpFVBx32lvgTovcIUxBKn99dkdReCpusnTQRfdURaIqqGLkvrooOLcJqtj2TKxbydacDKeW3PkeTG1NRS6VT5jdOzM5/9cJ0Gvqp105/xclYT/aMpa+FnwgbqtB9zPmNH1KrLpvhgfSV/17NeOjXCvc5BYLaRBGK494EU6g5XKZ1YkqJ1Hq9Ua8t1KfAjNlR/f9HdKtALUa1EfY8JeckW3q07NHL1wBAx5cW/DtiF6ueMq86bAAP1ScAmNhdSqFobepLdaGoUvh4nUtHirOc23/Dy5VzGuGQgAwBy5nssJiSTNBN6l1wdjDJd10nvrBCDFGsXllaEdDDHP0tWPdWuvd6y+sOnSJoym7RnKcJYOt3Cc0cAT7+UWOma79FnBuoQLMCqwGHNRtzpdaUzVD19QtSqWpmuElBShvn+m+kKrmYUC7JuPsdgK/R+73HdwKqdBcyY39rP6rtzWd2zWKJ32ZX2FlYofpGsKxIyr+TMlBdehUZ0ryvDEbUx0pWVL/oJjqLn4jEOZUmSa7SLWD+r+55y2vPjogAJCEFDCYcySk+E7RkoInsy/7AdyGKa8cUillD0zjr8BKgh33grkXtvr5ZzCzDTMrbyw7XY/OYcA5VJsIJMV3S2n/e89NAEZKFjAcE84bdx4DXwADlkm5QFY7GEb1DF23OqXf2KBbWZWG4zNXzldp68S4klGXbJN79esFjxHhlTb1hvT/GCwT/IRpu5K+JtrHN6zhC5+Om0CTWz/uhIU9egfLlM4oe3LI8bJcngMXCGstCYN4qV2NoD8JC/aW3dDXCKNytdWMYI5ypm+eo1JBT5TniBryJGwoY4WPqb2850Xv6mwULqihSqMSa0Dx0gDk4LAIiCwKq8XkzqP9sLSGGrLX3HP3waksvs4aJriYnPomsiir4RlMsGwYbZjI5cbn0xIpCC3N8yaTYlQYg2kuKs636EuFuQt+5rLATHitIToDcTlydXWjnrHMpT1TtybhWyZuaO5rgepEdKwhOuUdFPvJNw1rM5bvWzg+QIVIquq6nZ1cWKLPQM3eb9en4uu30kde0fUQrqd5dKaqYP3GTqlDrH5M4Nbt//2W9o+RLe0F4+nPeDPlX2C05hgrmleEovrliIbDbZoqhnkWuE2TXSLXMGRtNvfvx84FaG+Y0bgAJTf6KMiBGBFjP7q96FZYr5oTas3CQJVhRVYu87eusWnKDM9qSj2IMDuRZpiZVsT+qvn3sNIUWX0uEIOcu0oQTrGyfwIgvJY1X0Doo52qLuw8/PrglF81xHl61DcWkcWciQY3u3th+bJRdY/ba81UpaeO9HWtEWBgPOI3zQNp4EicudEdJuN4pNR5cMlD4434XJT58hy9d5rmqQduQK7bni/6tbw9C9vVLgB9ilh+J/x8eQ4i9SVvjZoYRg92X+RcGqCbwsxtIqsLNkyHndS13qbEst991fUF2s5c2BvHFs75nnDXWNGfNQOjy/ODlmys+NwBS9Yy9lLkrUU7Q2euPtPjnXL3wX5rFhhUu9/44RsfjptXpqnclKa5jCrBqXaSke5C2Ui0xorhOR9UATpQBiZQyfGIItBU6KT4KDsL2jVV3cgzq6mshVHXFzK7ztcvLq/6NjTykLEuojBWl31kQ8E710K2Ly2OSXQpDLpmS4FBWYxs0VKqlOC1Twb6y27Sq9p2k4DqCP9pGemcZdhluQxsnPe/fURMEF7l1Koz38jW/nyGnl7c4qLk9DW6cgERRxa09ywcF4GXucnfNiE41V4tYc6YvrEm9xF83aMUrxPGfO+vhg9M3+x5cjWKLZdUpWthFxbZ5+5bgOcBrNOVonoleW53j/PVRzqN7jy9TxBZGL69e6389IOzMZ41YByX5+Eykju/zhNZlNnEeVewKj73Ctq4uvierubfWXakgPrUBbSbkXlFxrw0b5aeKGusy3mjLaUC5AGr12v+RrrEYZVvsDpNht4QVd9qV+wvIjuJEWjkp1aJYvQOkxpPOWzcWhU0qR8jxXe1gar2ayHna0Zvaq0o1tFzg7XBpoplODfxKMz4ydwOO/hc3iKWvxi/v+zNWk3BoeXo0wD42J0Fy0X46Nb3WOLue4NNfj7su3fMdcaErGK9cXbqSPQy+pmymjRm0GEQkf0pMuHUyIw7W+IN51bvIV0RQrVeVBxd2PERkTnVdkvUYL9hz4KJnN5GFgBn2hxneT5Qt8DA4Iqpmok5VfC+WWDFOGTwBCJ47v1dLBEGIX5nfxucmUiwD+XcgQudyCL2o6OnTT5nSZUufdGt0zADkXkToU2IrxGeno0UGbow1/A+Tp1Q4oyvJsnLx6rct+2HmAmNcmow44Egw1xWpvO7kalJPnluZh2xxU0eG/AxfpEaWpQ8WTbPG5TTBfZPQB75sn7D99ma1ipeU8XxFgq5jPSXK3oaOJH2A/C6/a/poq4Cd7F6bZipAJgRBSfW+gZDwKaHHteor1id+A7BsTlNoKuILAp7ntJsozNHHbFOsm+p5JrlLn5Wo8gVVI8mQuWSHP/QeP9o2S+Mt1Yj6eblhU2D2xKSnk6j6+vR0+r6f8n5kXGno6f3v+XcP8CET1fJ0gHnnkNCsVv566tLdDkwqLpsJEOt9dUl+zmIWNjVVMMuozrS94mH+dzqsHHvVEQ2l3nqiq9BxV3f6PC8IMvLiHm0io+W4J4MJqg874SAfemwS6Bt3kPYkuXNU85IEK+I7TUOysAj3PzxjLxm3mWV8pqqu3tffXLoOfVDFCRr3FJSdaMILvVrTkPlrTUK077EjQkCIcGoeL4bEGmqK/EaM46HDxmoCYUjqK9cUKVGOi24M3RMrD/eu5t3VgoPAOUeYAdT8ukGmi1nIxqRFdm8yvNt9PgMK7KodUAdupWmxwGd741SxaeomIyIctArsct0NUVBAtPd7FWHuYqrnJmmsq7FRfMchRrbtRUbTpW0zwv7J+myxGJLcD2ZV372+QI99bUSnytubeU541DAAXlgF7el1Pabz9B3w0CD6L/C3Ai5ETuOkKakAjCL9S71kU6bBE8QguunhZ7VVe7vfWnSW7rEZIs+jbprnM0VPkVRvh94R8RMoAIzsVC4oHvTMUqsoGtvepyEHePyCoZF72XukqNbWMBO1lmAKXTA+oJUASuIVB7SLm7ce7pBv1YCXMl3MqccPWViPfv2OWKSPEdz+3/U/h8WmG8107Nvw++LhpTZguNB5/zYNtSuhX92hWBQiHWBntzWza/kYi9Qg5FJOXV/nXs+axgETZXdyEGG1kVcvdvj7PO737Gi6KNLAP7228/vfn/z4eLbb13O7RorzEb35Eaqm5glywcP2O/1gN0XttEgGBaxjQhfsxMXpaS5DjCx18U2gQuzkIoKzUhMBdIJJSXguIgfBQm8D8Qimm0wGzYnfnB0ALDPYxO1xyd2ibqu5okOhZnn2qjYle9Qr50sINa9S6Pdo3XNR7og6bHFLm1jsIFJ44tN2roXX+9iSSzYaKCpnmqyQOyxUw2iEQWm2S/vCSvlo/EE7x+4sMx7+//DcNTWZHad/06yxfJOjN4zspfJk2yO+h13H39STpC0tbOyHb/0qWky2ussO8DJfAZht8HOPfwyXUNWsynew6Doa4EZt7KuwVyuvM64PO/WtgESl3UHDV0GIAzGswrrnOvMmohHzOeYxGtIt/bVR2eyKCrRj0QNuBPHATc9lLv39Nb8nYZt6oY3fZxl/VDerrHI/ybDr2YtbwYbdoxmeDB3w4F3mNOVLhlhMlqW6FQePHC/wUoMHx0eO+taFGUmUynj6/fvrtBvLo7aJqWGGfkyaSrB9X+8RV8qqkawWysuMkX7SJ1pkxs6AdEt+lAXnQXTuhornUS8SLtEZew2ApZoeVTg6BBVE3gcezDdPH6DBsyxKhKsliWbILyAy4gFyA3RKo/WlXaHZly0qx3SOTZ9q/ChdOdUkFWBVayykobutsSD9sUPfn3CZJBOFYVmtoq+FwhdxC2gaggvlgC1lICsnP8rAdUSR++E4RCnom8veHTPWOwLxyO3FdSantGZFhkm0BglfvmJpa1FROe9Q3i+LNc/iVuzin6/E5ERo7JcR8Vd71C3lI97eboD4TXH0TWGyKhYMhGxKHJIOkVutMgWmd4wQ6LrD5EtuNxoXMTPXenSFmadjnqCVxciMiZSqhMmSqqK+TZawvuAdklu0hBfY55ir7AyK5U0Mov/JAXU1z9lEHGMT5snO5tcLrM8hbAt4fj5b0RkBb7NjIkVNtglbHc0pwkuhYKJREwzkY7pkuuMz3kW+1l0h/b3CYlHRwbv0I6NhdilHbuqt0v754S0XyWk/W8Jaf+PhLT/nIa2kSXHc5pCpTTU47tnIisqDsb3fJvgnqyJlzcJ7JKi4mxZlGmsb2tlYr6MnYTkKbMURommX0j82IjItEtITLCCWpE03qQlnMab1FtdlQl6kRLRlFUncVWNNNb1oLcJVIiRxjpmqWiDW5OEeCXYrcBCakoSbML1KyuVRJfC+pUszYriPEFYTRZlRniCGLYlnOCRBOiq+dbED4tayjoJ5bLKErxpEMUMI5gnKCDSGV5SQbYRs666tAXm2z9oPk/B9zoDGNAklB0cTBquXWJtEurzZbl+lSYGrbM5M39OAjRGdBa3V1yPsJLRVbVOcsyBKiUqfpWbdjH+aL22OoSpWbk4f/zgiCMOZl8S4g5NPh6CXIf2gnGawofR2SLFIrJFzOLsXcIpbAOdsRKSFLMkqo6V659ybcoBmH8k2lqRJLQ5W9AUboyGQHNBcxatYHSXNhNpdkkh84pTTWQKaXvibJlAN8lSb7CJ2vO/Qz2UQR6FsKJLpo3C8SMhLe0EFp+iZSpRq2Sy1oBErhLpV5eZ77Z4AupGUVwkMCRdKVAqttMZ15uVZDpzHWbjU99ihZNs8HykEDYG5bXrbx+bLtMGi+h9jnNt5pWK1Sywpkpdr6AUVKvovMa3o+ua5NhkoXPDIn6z62ORBvbRXOI8j30GWB77WbWGDkpwF7EiI0rKIgkqkSWcwE1jRZYmOdIjHqUQc3kTHZ6p1PEhS1mpS8UiE+XYMFNFzz7jTNB4EDstVR21o05DF4pv44e1uHSop9mCy+jXeUM8Qcq/9Xmjax1LNIHGsT50Alaj5yZwuUyydcUyyQEupYqtwIp5tUxxzAqmSQq1UOgkGzZFHwhBDYArRacbXYc7AOjYGX+Oaux0PLHZxPZAklSUSdcAOronKuNbRlKxZRbox/VguhtBVfw7q8xcU97oZKN2pm7JuhavSTZZgsJN3xMntjLwZGNrgzJzgaTo7GKt7YcZWcWq8x+Qprcli/4QUFJVLBUWZoC5G4PyJgnh+FevQyL79KnXBTQCYSWXGdZlxIYBXdIKx6aqKOYp7DtFCcjBoY4mIh5fyJZyXAjXDmWp8gQcxw9k6gSxYe1iwwnyATSNnQjgGh4ncE40/RJ/A4QAWqNRTeBKabZMoHh1GTvKphVJcQ4UyaMb0lqRECpuBMImXoutLs1KR0fVXBMRu1Ai2C32oUQdSGfs6Zulib+tHNH4L3pNT8/YdLdldLTWKp8nyUOvFE9wF1aaqixnsavek7StqF+GUojBEG1wETsavM6Y0AYvElgGa6ZMCjN8XYoE0E1GqkrEDLOGYNECiKJvKiPRh0qgwdBN9kjCZnmfMWc5OlM0ZwadYZV7NEMN8O9hdlznrIRSGusQCmSgiT4CfAMiOQqV6jT5EEykk9xFUXK5pYPGggflt5BVNFDvO+4xK0MXM4J+Z4ou6S0qcB9ooX2LFcuq3wwkOZOcaWjOUI/ulx4AlJCuylIqg4bAowhtVtggZlCp6GJsKzwgLfc+TShCgvdeR8MCYsIju4/gQnMmUnfk77BqR+vyqZGRS2pWVM3a7+uVrAY3GkKCrqlq2hEZiUqsNEXvqMHQEdydVdyI4OlbudQvrlzZ6zN07lt8PUdmFehSBGDAH6hvfQxsC/Semt+ZEVSH13m4qZMIbwEtu5tTBIO7yWqKFVnNmGBB/qDn7gT42j31Cb0wIBniBceVgF6/ywr6uNYg7mEA9x5e+545pYfjbubUgHD7/sUjzr5diCxiTdPdkFdhWPSR3ho4FWPhgim6UY8opLZx3XvoUC34SMdLQM9N2A4c8HM1NUjRLxXVZg9o9/HZyvfHyncmA7TlcaM6jd2PSDV5p7vhlH08OY7gbWzn74DQrl8HZx6z9//h/oZ2sMvzWinA2OG9AV5DvCTee25he7nMsabIpWs33KDBqWpWyf/iNPyKphV8w7lUDr4+KEaEsEaaUmh3hvf3q1JYaEwmaO87QJh2Qwswe9tNQyoFHdD2MV1SVTBnbkzFdDuka8zB1ozTJUWcrilHWGu2FG7h2n794a0PkMwn1N8w/p6dPj9Jp2fLWSXYl4r22yTi8OHr8HscYuJxXVBqi4bl7kASKQSF3Aq0YWY1pigQClSGNBa7okeVF93btbDiBH3SXFFcLhnBHFkORlwf4OK03MFQI20aTye7crXVYfY66Wwb2ctqjX3BY86wzlYyuU/gnLjGXYNeKm1TI6sVuy14wngAyB0ayy3cab4RC+EUq9kbrqV1xHfO2zk8lqNf/S9m6I3YNv8aUDfgy2thEM5nRBZlZagKq+EkYXw7sXTu2Tf9tYAeizsLwsw/q5ff//Bn6/ued5ajltg3Qbb9Ps3ivpjdNXCDt1Shf2ticvqFZwOYC5/62PU/6fe8aHne2fV71+PI5OVDuu1Jv2GKHWeG3v/28cLOnSrqgicQL82ZJoqWWJCttSq9ecb7uSAIJPQcfXz3Gl0K8+PL5+jy/fnFf75Gny6FefUTerpZbZGgzKyoQmQltW+VJpWixMC3fnj1v/7bsydBiVCzSqjj+vIAnTorcLgdj068++55zK/dXrysmQof8fxxMd3VTQc4PxIw7s4XfIjfnmHaeiefmTIV5ujtm/dBZv+QgqaLZR23M/6PFHQWlq1l96tRoTCRw8oTluAx3sF71mGJDd3gE7RIh919hd7kuYI4rdvlIXaaq5cU5bHvnA99C7k8e3flbqXR57EC6wlfP3aCSs5S9Xc3uryyrIxEv6wMj+wEEUWGduxxGdaWWOa6a02rIDrs4jxn9suYtw+2nV7+4Xtuwg1gXUI44NKf8PPdLTBgpc21TmLX3fVKw+i95/BKKtOo5IHSzeGBDRaAme1hzasnlr2bDxPL+jKpp/VuTPCChvzGqaK4njvwfLHWkjBrcrq40cDGQVYvKyyWdNa4TkSKBVtWiuZovgWaVOSQNRTWM+WR0AODotERazk46CIB3gGPaPt3S7iiBwAULaShmc/sjp9nFF+0udAZzlwqfgLSpVFpiC8SbIlFgmphnuI4pMI/KRMIFedZHYlLZ5b3PXg7j1l/tG4w4QQW7IVZUSWoQR+3JX2OPtXX2FsIgP2IruoA2OAm+G3MUqtb9UxgTIy4xjXTPi7+HGHOg8ZE2X4REtywgsS8NVX2DmTCSKQNXOZMoE+XowqFQIJsMn0VXWVborJM0PbNElZUx87otWQTlLi4GzF2KjrE2xNw61orZJyKZfROkcCzNT4SWqEjFqgzeTDvPMAIRCCdYIEw+kWqDVb5sE83Qm+WkOylELYn/hZy6ebUbCgVYdMzMmrifd+4pcG8+1TnmEEAGQ+ZEYMZMuHzXCEtoWDGqiXfYiM8xTXHYop3/DsEKOsEkU6IcjDB3ZBl+5Kyth7sEhzY3Zsn9kslJYBCsI6HB3e3F3usDCMVxwoBXjSqmXh6cfv6rVzKxSLc/Z2SzKxo8uXdYfajHdCdxg7fF5Zvy+6byqyoMD5ZfJRtXcVETrhbQo8bcpz1T5qqUYZlZYicVtJ+yHGGrytCqNYjPAPy+HHgaMclngBfyJq4S6m2KFCYMOBtCuW0wyPt8Wi1Ejzw6VIKe69YvRUyDpsfooGhtDurdTw8upF7EyOHWgo1A5zRvJmPj8P07GEmkGamCuhPBMUF1KtoT3WFNcK5LO3tYlaUKSQ3ol0yJziDb6WQxUheLfTk0MxB1E9rRFjjnonc6h+pdCMAjH5hnKI3nrHZQAx3CfaKZmLuTI4mjDfzP0m6wqgIrn3WQlwphOYYEETMevcHCMLl6137eo3YkhhPCJ3LlNUDgcnP6QqvmazAuiSyKJUs2EiGIp2auQuB5xyKyBbobD9vTKwbtZOQyT6HO1YnCjKww2HU5jJHMBgYv+Ev9ep2btn2vI1uu7bMshKmX84W26LPoQw8I8e49XeyguA+XlJBFSP1lEAgkOjXTy1gZgVXbai3G/LMzsgPM23U+ONnPadjYLdONqeX++fkzQs3VsJ5BV3Txgk3rKDa6nVn7Sla0tFHJL8K0UAhDi4EAA8+cBnUHbfWMdjdJ9taP95tTj9kOlqT0ztPzQeMD81wMDeYcasQ7qAMvt7ZvTw4OzXp2rmDFmVu6vDKRcNSnUaBHNDjjQL5erfjj4eXLFZrg2mW7G76UU2qQWKesTvoj0m3Y8y5DTZjY9RDCVovTh29cqcyq6ygZiVP8EqCdyLJyLHhvza64IClpGTSqNOeV50Pkvt4rWVkz75MFAn5z9nP33+Pnr49f3P1DJ0zbZhYVkyvaA6l8EFeuFzK5LhA+17CIFt24fjwywxfHMkYUzJxVHFf/add1RAHzYmBiHy0ps/3OS4E0v6but9O4A94Cr2ZYhGCSW8zxTCPhU7Xm8gHnLNKuxGQVEizgnGsnHqyatOeIQL3eri8Cs65ZvmUSCPdTPlPdiPUUcQeLmZ7yNPVWbwR+846PGv4SsNO/NcHieCTwV7wgRvaKcvIw6FMqVImBgyebEDUUi2xYH/syaoW6bbCXYV9hKS7e2pE3AumgrWkiVB/frHDwW3hIL4cdtFOVvOvFHOzIlhRVCqay4IJHCy466inK2wYFUYfTI/neMrZvsUnnayDfqRloo1rj84Tq7hKrAyAIbVT3a9WJwQ78srmLhp1QXOqsKF5Fi2pbM/+sMrnl3rE5vHsSsk1yxvwMP89XJbcW6qDjeHBf+y1tmvThg2cdpIsn2iWzZAe689sR6YZbB4KmZNr5l7PV33DfQQCrjE6YzYFv6/lSW/BZur8qFMJvQxM1NmoYLFijbSRyml8S62gBsNoT+BbM/utJ+HZFyzPOZ1Oy72D8e6q5wLL29F7R+m5uj3GNNO98qN1EIbEtn6dfY5Kju2S2ftZKkQFUdtyLMoPqZAT+JN3yKBTjW/5q9QGvcNkxcSIS5fjRJrjm76sPwnI9C8VterD2kcO5EzP0Nscl+gz/MPZR7kUru70n8PLE63wmlrLiVOs0JeKqi0CDEJdSqFpbVGFi1PtfDP4zTT60mPgEUtZsRoFUrjpO1y+cT7rKU3AaruBPnhw1LtyCl2e0gbM+nu8hpbeATGyvqG/eJlGqhIi6Mfq583N416eHYzUSI2dp5h5DzP9QmC0YSKXG410SQlbMGI/eR6qE/R5ssMDYqfn+G1zbtBTQISlgrTXEDxdPutIC1UC7vG3dInJFn3Su8C3zQts0S+kjZ5da0eYwGEfue27rhawArVqsMnsjTiQeIMDEKj+36k0hXKeofh2p53eoB5D53XmdWDGMMPgRvO/OWKy0+T1jk3VZ/j60Hut6y5g6uMooMPZTBOwax4MdtemTch0yzBYoTAgxeHiZygbiNkScLTCDaac0wUTPlYPyglQ/QpcjoAOAndHFYol4q0NwPTMv9iKsYnZpp67x1IawaZsYtjGYLIqJobAb0cFgaOBd9RdjiRNXuZMxOsgFvVs2ClDUWHayzOgpLplO7AsDka7Le8PdO0ccJ327jvAdYlVvafsn5+3U9ms2ABKHdnTYX1Zl/x+p+mZ6D1LHKyFVNt0C/4XXWLx14OIMTUjuyjqtXkeupqsWP7yAqgfmNvJTKLBrGq89f2zGt0FGRVGyfIY1ZHLaj4ILtxpj/sxrbdND5QjAI+uumPac3gmixKLbXMe4dhBO33nr6ypstdQxsRCho0CrG9S1wgd0B89L7LmbEPToqIvvqTKEfil4nyL/qPCnC0YzdE51D274GCQlQ2dZ0TKG3aiR/ff6Ry58Vv/GfMxaz462mz7HF5WBkzuI1uYHj7rH5ohfJcdH452MfkZ+rgt3dTbyIEVjlvB8cVTdJFFBZPtsW15cIEI9USHYGv7zEwRqmuMy13uXGSxlKqO9sMT84e3I0vewcqJvJ1qWZRp+xDtEYUd+WDkvmZTSZnIEtllyo5j1wOV2IRDk0RkWMd87e8QVr6cPjLlSvGIy9yhGnFVGmc0q1SsaEiHpqYqw8t4PmVLOvr1tEs6avrjLmm/6xMoFnprqADTKr5zYulH282NobdStJcqE9uickNMUUu4o3M/wrBgXr3w/33mWXjh/8PnNYXC/phTFc7O89M54eu5m0z38Rwirp1Wa4Pp5L4hmnWpmFhQpUbeXYfznmReXcP/oOiD4dkJmKxxiRedZQgcKXjWlkmPVGCIybbfhXu3t9vuI2QQq+6f/kGHCVrjDT9ZuaJqmniEtdl9xtPTM2j9+Aydwfhh1qgyE4GljMj5jCrf/JPuZGHuAeelSZ+OO4LsLLgd9InuIEXvXWn2x7FRyftDo4RXG12zP8LRGnaTSKdc/uMCCbqUhrkFLFdYj3SA0mRqWKHOUrrBx5sL2qVO1gFqkODS22M1cHpdfxNOSNFsOUVFxS6+UdP18ONoo2WrTZjWVXSjEyhDslS6aN3D3lCAQ6pU0hjoYFG62vPCDo6u4XF6n3aaJEOiQQb3r8hPryG1c/9l1NGexzF5f+25h8dxFao1z9Ypb/T+k6oPZAeZyTO79XAVHaZRpyLMbqj3qBOBG3zTtivpXkigW39CGt7rpEKX12/+8e4KXdl7Cv0mRrqvtNwmqqQ+htuPGxnmFtQQWVFyo48KIt9NCafFIAs1nWvwOhuIMEgD9S0IWy24x8qlig1AIU9g5Do+GlSQUacBeDbYVJN1+Oxyucac5W4jBpjoK8LJUK33KUKQ2A3d6r7ajrTz6wTSyLRXxpQ6Y9CDNglpWMoUAiH4EZwmthR15YtUzGwPnCgiiyIpTtwd+XZ8+IBQuAR/wxTlfU8zdohlw7HItD5Vw1s7stPhv/vZ1jVaQW5dqXFWSjZFWnWIYccBAg6AqbA3AGIlKyzEADgjNdyUHxUYGXmznQi2ublYfM/D39++ee/vvRe94ZsLxUjVj/1Hx2xj+iZbS16lEsCbuo+z8H1ums7YdTvfSjCj0VPHhH4GaB1Q2Ft31O2RR8B0cDa8SqTN3npePwlmfLrAbLfoYE0VZAosKo6IFISWxjrK124NR+AVNpuU2tcJ3jrsdQtty2gplUHSyvfXv70JpeAGxR5730m1nD7Bsl9gsBNinWMHdhIEivn7xW9Xl1foHb4tmMibtt7hZbVzmzwNc6eJ4si0/DQGs9s3rcZ8CpcsRk/PdlWO2WK6gs1TF+HXU05uduwEy7xWvjz3KL2ei70c8ukW5cRYAfWMi//ydcNNYY7Ih5Zk7NMN8RLrQp8ou9G3qwYvvnnULVxx73Okq0CKOtboL9ooKZZ/nXNMbjjThuZ/eeH/9rz5lIkFJeGPFkzRDeZBQwbPeec3CIscaYlGtqWiS6aN2lrPfkplUWKz8mD9DQ+oz8OASQhKTcWmK4R29VpEqg4KeWNPNpxTYTo5KTXfviHjrOmmNusd/nHex/jO6QJX3GRwJl6jBeY7pcg7U9rN4H/fSY6oO0W2LePbsjWj8GLBCDQSmFMqkJwDbkQH0KtZF43vMZn+wT4wleGpb0LGlmuR2JwsdGqYpBGNovAGFVRrvPS4RERa/Q0NzEKG5Fu5ROeUyHzk2cfTih6jcpjPEROYegxPqY2gCNPeaHKBmNAGC1OzEfbxDTvqEs+H91TQFIdzyKx3a1ydU9ueAK2sbwsddn9nRlCt69U/3AVB0DVVXYCKEitN0TtqMFjqvua2GerpW7nUL65cUu2zAflznw7WmhUYfaBOWbgdLjpsjiDJ0HWSEM7DXpsLvUxrPPs1fufP+eX5D/7BxcG+td41YALcYmIQl0u3XkNcG5gddLL2uwW+p3f7Dtnf+4Wdje6MAemjdkpoZwwoj++U0SVZT7smL///muxfEztqmgV52PGV839lQayrR8PdOtVT6cNYUzRlVuzDxZbq/D+MM/D90hXcP4w5XOXMZIBH/RjZ23WcHhFjq4gddaMyxsRxjKW1mGrN8Xh3Wk6PahabVmwLSvPURSDjzxZd2EQHJEnzgR0yMBIe5kX07JAB9QNexLgUp68z7zfGDYrPiWswzUjiQwEJ3lt8ZAqz2r8ONGa0aubv/7TddWrPpCD2csBGPnbPdkTdAEhdQnXYle6ZHcYlv3TO81u59G1dfRUDYMlZF0RRr6gGU1+wW5ojTaHT7s6Pd8fQ4w5LvQgD2g92WJpFGJC+16IMI4Hx40vHbczBvO4hk/vJICLEwp59+WudV+p3JO/vSE1FgzzM5VKHtk0nhvT1yJcds8EGPxoV7OXV+qcWD3DkuPeFO5i9kV+rcNevUov31f+74k1c++Rl3NcLLpDWjZblCKMlW1PRBMm+XkPAiui4+EVaDyR/jMbf1/GiMRrQkOU2U/RLgrXuPh7CAsO8PZjfhccUu4KD9NxHsw12FdYEDzXInNbJo58uhfnhFZIK/cIlNj++3E3zIlIs2LJS4/kt7byPMXe/4nnDM+hjLZsEz3gCzIyx7Ji6muhrDzBItcEqT2bU7e9U7wySzzv2HkaKcjxMTXPQqv4S9Wx7MEzYqbpF+ZCKLZnAvP7NrrVyQA6p7K89iRGXV59fBUSAgmiyKIIIGo6GUo5x+7QbdWg4Hnv7rCjOE5bX77h2MBS6PH/IK6njt/tYCmSOeyt91EE2TrLkcTbc5OC2hhYcFOu6nEnOATf1a1TAVnonyLmxe45pRJzo6vZwHUP1rRy2sxgX9CP0+AoyfyymaiG1qQv35tvBojWduCxBzYqSb/062S9DMjPFZIU0yyl6+j0yK1Whlz///AxtsG8lVI+yRxKPwni9gyR8X51koiBfza5wTVXqmEKDu2qPsg5SQE/xXK5pRxgsXKJTqzdtFMXF6PkhX822ObGoaM6OAk04JKhvQpZjE1hgC8RMjfsDKv2FgwmtmR62s/ongnqRLVXoJboQBJe64rgBK7uXXg9Rf+DjRyC3MjTKjy/Rv9vpPkc//oj+HRGprL3sMAfqZmr/nZv/ab/INNoVShj+QsicPlpfV2xoRjDnc0xu0pc+5VRIU7dGA7/CCrGueQHXZKwrHWyO5GBGsGUAcBtz4Nj1sTdSWctabJ3VYT/ogFGEmEJoISuR2xuGQ0MGDYgAd0te3D0RA8ox3gL9cdjzbDSyClsucf5Y7jnPDtLsD2hGqRgJeB3eFe5+GXxhd93XSthe+9i0Fq1c1Ms2Q7/KjV2aoc/JBJLKOmNGohtKywNCexQ33lciNNeYIlunbHh+UWseaEvl+lML6MTf8QvXTEHL1Mvz3di7CIQ4uj3dQRhuFv6oX54jZbW1hoDKsLfIaPf/RhLJ6plPLondfiQj+XJJnoKGir8Fv/oAaPhNj2aiKPaNgEYUpf1f/RDzFTy8+JEyXXKWGr3k0brzmqUqhH1givRxoFF33e9w6uwdUHcE8ruu9lr8FfJf44XRqZdBu6BJ3uihBZBU6OrszZW3fQkWVjysKKXqW7wIrsivLg2iehzhj0/uqgJHPNTqFg1d+ar9SeuwOzsHPPMZevnzK7QBuRcUC4Q5D8cK6urnBWrjR2hDFXVksUGcYm2QFL1ykV0hntxM/LqFGDirKZ5tvex+lyoHwUFWEyUrIblcbvsPcQumBlYsQj8jssIKE+OESAG+yHLhOrijSvicHr4TMx+tqI1d0O0e6lM+IuzrtmA9isIamVLUzwgKb0Z1GmjWnlmJCVis7o1C+JiDJKRSNUVtsMixypGQqsCc/RHK75WqCMon91kOR4vobr3w9gip5bph5gVnCwozDjj4mhIp8hEDu13uTJsJAO1DE2KCyKLk1AQ3wGgQFYMBPw40rQ1W5kQb+dqOHdzOY1t5d2eObr9CiuhIyPkgQeLBoAciP5HgL0SeQuyW5B9SnAg9px69NjFdeu3HvoQHKirZiX6DoBm3b0Hu4XBr7vJ9eWCB9X3oZtv2W4E/nKSiRKqc5unuQZ9k468p3YxY2xh1pk3zxe77+vC2UrKYAdUKivI1oQIrJp1ZX1TcsO8MowrhsuR19UuLZVNggZeh0lyEODzv1P6iY8rxqhEzTzSSG+Fexgwuyn5k0HNcd00anj6jEVkx693InOoZeldpA25Sl6hDzxrJy8WGHrlIexXYYmH5XtMpLCFY5HpAJzvXNE0QtyGwNa1ztma5tWxgP4QV2XWtyD72hBee5G3J1GQzbNfTvQXd2p3IDN+6yWqr9Ky9ZpmCDbo/Nhpx0Q+gfdf6bDYYskVXq2JroCJ6K85G/rGPCliQXypaTbaV7O52u6jVjxsMbU+rLgBXl80SmIvV6qERakSjYEegCXTasjAJbt9lkYLXMkvAapmlsJ7LmKpol2isVh8t1QS2UucWOY0L2XMfg3fM4Lq8151zrNo8pNeOeSxoL4geGkLsQBAmAyM+hmGtK34i0HxZGSIL+sLx0DgvvoHLYIdg4UWw40CObBC6poqZ1NCgY+jTfnRfBDjWmrQX8pm4cZu7pZtKF0sN3p1cq/vW8Qlbt+4xZwxTxdvK6bOZAgvQhBhZPugM23SCDfId6iKTcBE+73rpXU9QKvTbtU+NZbpOCOjH1WD8eoXGqiR1KTWLqDjutLfAnRZ5iy7cnN1RFJ6KmywddNE9VZGoCqoYua8uCs5tos7Pd6hka06GU0vufA+mtqYihz7JB/WWnP/rBOg19dOuHHan7TKWvhZ8IG7oB7yXMafpU2LVfTPaCdarGR/lWuEmt1hIg3DTSS2cQMvlMqsTVU6i1OuNeG+lPgVmyo7u+zukWwFq9RD2uzH8JWdkO0W3nRG9cAUMeHBtwbcjerniKfOmwwL8UHnw/7A6lcLQ29QWa8PQZdsqoK6uynNt/w8uVcxrhkIAMAcuZ7LCYkkzQTepdcHYwyXddJ76wQgxRrF5ZWhHQwxz9LVj3Vrr3etvpClxiaMpu0ZyfNChY5KTA45gP7/IMdO13wLOLVSAWYHVgIO6zflSa6pm6Jq6Rak0VTO8pADl7TPdF1LVPAxo12Sc3U7g98j9voNbIRWaK7mxn9V/JXUfR+t2jeJJX+ZXWJnYYbqGcOyIij9TclAdOtWZkjxve5AmOlKypP5BMdVd/EYgzKkyTXaRagf1f3PPW159dEAAIAkpYDDnSEjxnaIlBU9mX/bDFH1RdnH0Q91QnB33grkXtvr5ZzAz31Sj1fXoHAacQ7WJQFJ8t5T2v/fcBGCkZAHDMeG8cecx8AUwYJmUCwQd5hnVM3Td6pR+Y4NuZVUajs9cOV+lrRPjSkZdsk3u1W/TzYTwSpt6Q/p/DJYJfsK0XUlfE+3jG9bwhU/HTaDJrR93wsIevYNlSmeUPTnkeFkuz4ELhLWWhEG81K5G0J+EBXvLbujrTiNDaFz4HJUKeqI8R9SQJ2FDGSscq2H1gUcsGIoaqjQqsQYULw1ADr6btCwKq8XkzqP9sLSGGrLX3HP3waksvs4aJriYnPomsiir4RlMsGwYbZjI5cbn0/puk8+bTIpRYQymuag436IvFeYu+JnLAjPfiBfmXQ/E5cjV1Y16JmpgP2gNx8QNzX0tUJ2IjjVEp7yDYj/5pmFtxvJ9C8cHqBBJVV23s5MLS/QZqNn77fpUfP1W+sgruh7C9TSPzlQVrN/YKXWI1Y/ZaZO339L+MbKlvWA8/RlvpvwLjNYcY0XzilBUvxzRcLjN9dTPArdpskvkeqeNf/9+7FyA9oYZjQtQcqOPghyIETH2o9uLboX1qjmh1iwMVBlWZOUyf+sam6bM8Kym1IMIsxNphplpReyvmn8PK02R1ecCMci5qwThFCv7JwDCa1nzBYR159e6sPPw64NTftUQ5+lR31hEFvOmfe9i58LyZaPqHrfXmqlKTx3p61ojwMB4xG+aB9LAkThzoztMxvFIqfPgpmtc66LMl+e+BTd66oEb6t6UrujX8vYsbFe7APSpGvz78PPlebe/a6MmhtGD3Rc5lwbopjBzm8jqgg3TYSd1rbcpsex3X3V9gbYzF/bGsYVzvidud3zWDIwuzw9asrHicwcsWcvYS5G3Fu0Mnbn6TI93yt0H+61ZYFDtfuOHb3w4bl6ZpnJTmuYyqgSn2klGugtlI9EaK4bnfFAF6EAZmEAlxyOKQFOhk+Kj7Cxo11R1I8+sprIWRl1fyOw6X7+4vOrb0MhDxrqIwlhd9pENBe9cC9m+tDgm0aUw6JotBQZlMbJFS6lSgtc+Gegvu0mvattNAqoj/KdlpHOWYZflMrBx3v/2ETFBeJVTq858I1v78xl6enGLi5LT1+jKBUQcWdDes3BcBF7mJn/bhOBUe7WEOWP6xprcR/B1j1K8Thjzvb8aPjB9s+fJ1Si2XFKVroVdWGSfu28BngewTleK6pXkud09zlcf6TS68/Q+QWRh+PbutfLTD87GeNaAcVyeh8tI7vw6T2RRZhPnXcGq+NwraOPq4nu6mn9n2ZEC6lMX0G5G5hUZ89K8WXqirLEu5422lAqQB6xer/kb6RKHVb7B6jQZekNUfatdsb+I7CRGoJGfWiWK0TtMajzlsHFrVdCkfowU39UGqtqvhZyvGb2ptaJYR88N1gabKpbh3MSjMOMnczvs4HN5i1j+Yvz+sjdrNQWHlqNPA+BjdxYsF+GjW99jibvvDTb5+bDv3jHXGROyivXG2akj0cvoZ8pq0phBh0FE9qfIhFMjM+5siTecW72HdEUI1XpRcXRhx0dE5lTbLVGD/YY9CyZyehtZAJxpc5zl+UDdAgODK6ZqJuZUwftmgRXjkMETiOC593exRBiE+J39bXBmIsE+lHMHLnQii9iPjp42+ZwlVbr0RbdOwwxE5k2ENiG+Rnh6NlJk6MJcw/s4dUKJM76aJC8fq3Lfth9iJjTKqcGMB4IMc1mZzu9Gpib55LmZdcQWN3lswMf4RWpoUfJk2TxvUE4X2D8BeeTL+g3fZ2taq3hNFcdbKOQy0l+u6GngRNoPwOv2v6aLugrcxeq1YaYCYEYUnFjrGwwBmx56XKO+YnXiOwTH5jSBriKyKOx5SrONzhx1xDrJvqWSa5a7+FmNIldQPZoIlUty/EPj/aNlvzDeWo2km5cXNg1uS0h6Oo2ur0dPq+v/JedHxp2Ont7/lnP/ABM+XSVLB5x7DgnFbuWvry7R5cCg6rKRDLXWV5fs5yBiYVdTDbuM6kjfJx7mc6vDxr1TEdlc5qkrvgYVd32jw/OCLC8j5tEqPlqCezKYoPK8EwL2pcMugbZ5D2FLljdPOSNBvCK21zgoA49w88cz8pp5l1XKa6ru7n31yaHn1A9RkKxxS0nVjSK41K85DZW31ihM+xI3JgiEBKPi+W5ApKmuxGvMOB4+ZKAmFI6gvnJBlRrptODO0DGx/njvbt5ZKTwAlHuAHUzJpxtotpyNaERWZPMqz7fR4zOsyKLWAXXoVpoeB3S+N0oVn6JiMiLKQa/ELtPVFAUJTHezVx3mKq5yZprKuhYXzXMUamzXVmw4VdI+L+yfpMsSiy3B9WRe+dnnC/TU10p8rri1leeMQwEH5IFd3JZS228+Q98NAw2i/wpzI+RG7DhCmpIKwCzWu9RHOm0SPEEIrp8WelZXub/3pUlv6RKTLfo06q5xNlf4FEX5fuAdETOBCszEQuGC7k3HKLGCrr3pcRJ2jMsrGBa9l7lLjm5hATtZZwGm0AHrC1IFrCBSeUi7uHHv6Qb9WglwJd/JnHL0lIn17NvniEnyHM3t/1H7f1hgvtVMz74Nvy8aUmYLjged82PbULsW/tkVgkEh1gV6cls3v5KLvUANRibl1P117vmsYRA0VXYjBxlaF3H1bo+zz+9+x4qijy4B+NtvP7/7/c2Hi2+/dTm3a6wwG92TG6luYpYsHzxgv9cDdl/YRoNgWMQ2InzNTlyUkuY6wMReF9sELsxCKio0IzEVSCeUlIDjIn4UJPA+EItotsFs2Jz4wdEBwD6PTdQen9gl6rqaJzoUZp5ro2JXvkO9drKAWPcujXaP1jUf6YKkxxa7tI3BBiaNLzZp6158vYslsWCjgaZ6qskCscdONYhGFJhmv7wnrJSPxhO8f+DCMu/t/w/DUVuT2XX+O8kWyzsxes/IXiZPsjnqd9x9/Ek5QdLWzsp2/NKnpslor7PsACfzGYTdBjv38Mt0DVnNpngPg6KvBWbcyroGc7nyOuPyvFvbBkhc1h00dBmAMBjPKqxzrjNrIh4xn2MSryHd2lcfncmiqEQ/EjXgThwH3PRQ7t7TW/N3GrapG970cZb1Q3m7xiL/mwy/mrW8GWzYMZrhwdwNB95hTle6ZITJaFmiU3nwwP0GKzF8dHjsrGtRlJlMpYyv37+7Qr+5OGqblBpm5MukqQTX//EWfamoGsFurbjIFO0jdaZNbugERLfoQ110Fkzraqx0EvEi7RKVsdsIWKLlUYGjQ1RN4HHswXTz+A0aMMeqSLBalmyC8AIuIxYgN0SrPFpX2h2acdGudkjn2PStwofSnVNBVgVWscpKGrrbEg/aFz/49QmTQTpVFJrZKvpeIHQRt4CqIbxYAtRSArJy/q8EVEscvROGQ5yKvr3g0T1jsS8cj9xWUGt6RmdaZJhAY5T45SeWthYRnfcO4fmyXP8kbs0q+v1OREaMynIdFXe9Q91SPu7l6Q6E1xxH1xgio2LJRMSiyCHpFLnRIltkesMMia4/RLbgcqNxET93pUtbmHU66gleXYjImEipTpgoqSrm22gJ7wPaJblJQ3yNeYq9wsqsVNLILP6TFFBf/5RBxDE+bZ7sbHK5zPIUwraE4+e/EZEV+DYzJlbYYJew3dGcJrgUCiYSMc1EOqZLrjM+51nsZ9Ed2t8nJB4dGbxDOzYWYpd27KreLu2fE9J+lZD2vyWk/T8S0v5zGtpGlhzPaQqV0lCP756JrKg4GN/zbYJ7siZe3iSwS4qKs2VRprG+rZWJ+TJ2EpKnzFIYJZp+IfFjIyLTLiExwQpqRdJ4k5ZwGm9Sb3VVJuhFSkRTVp3EVTXSWNeD3iZQIUYa65ilog1uTRLilWC3AgupKUmwCdevrFQSXQrrV7I0K4rzBGE1WZQZ4Qli2JZwgkcSoKvmWxM/LGop6ySUyypL8KZBFDOMYJ6ggEhneEkF2UbMuurSFphv/6D5PAXf6wxgQJNQdnAwabh2ibVJqM+X5fpVmhi0zubM/DkJ0BjRWdxecT3CSkZX1TrJMQeqlKj4VW7axfij9drqEKZm5eL88YMjjjiYfUmIOzT5eAhyHdoLxmkKH0ZnixSLyBYxi7N3CaewDXTGSkhSzJKoOlauf8q1KQdg/pFoa0WS0OZsQVO4MRoCzQXNWbSC0V3aTKTZJYXMK041kSmk7YmzZQLdJEu9wSZqz/8O9VAGeRTCii6ZNgrHj4S0tBNYfIqWqUStkslaAxK5SqRfXWa+2+IJqBtFcZHAkHSlQKnYTmdcb1aS6cx1mI1PfYsVTrLB85FC2BiU166/fWy6TBssovc5zrWZVypWs8CaKnW9glJQraLzGt+OrmuSY5OFzg2L+M2uj0Ua2EdzifM89hlgeexn1Ro6KMFdxIqMKCmLJKhElnACN40VWZrkSI94lELM5U10eKZSx4csZaUuFYtMlGPDTBU9+4wzQeNB7LRUddSOOg1dKL6NH9bi0qGeZgsuo1/nDfEEKf/W542udSzRBBrH+tAJWI2em8DlMsnWFcskB7iUKrYCK+bVMsUxK5gmKdRCoZNs2BR9IAQ1AK4UnW50He4AoGNn/DmqsdPxxGYT2wNJUlEmXQPo6J6ojG8ZScWWWaAf14PpbgRV8e+sMnNNeaOTjdqZuiXrWrwm2WQJCjd9T5zYysCTja0NyswFkqKzi7W2H2ZkFavOf0Ca3pYs+kNASVWxVFiYAeZuDMqbJITjX70OiezTp14X0AiElVxmWJcRGwZ0SSscm6qimKew7xQlIAeHOpqIeHwhW8pxIVw7lKXKE3AcP5CpE8SGtYsNJ8gH0DR2IoBreJzAOdH0S/wNEAJojUY1gSul2TKB4tVl7CibViTFOVAkj25Ia0VCqLgRCJt4Lba6NCsdHVVzTUTsQolgt9iHEnUgnbGnb5Ym/rZyROO/6DU9PWPT3ZbR0VqrfJ4kD71SPMFdWGmqspzFrnpP0raifhlKIQZDtMFF7GjwOmNCG7xIYBmsmTIpzPB1KRJANxmpKhEzzBqCRQsgir6pjEQfKoEGQzfZIwmb5X3GnOXoTNGcGXSGVe7RDDXAv4fZcZ2zEkpprEMokIEm+gjwDYjkKFSq0+RDMJFOchdFyeWWDhoLHpTfQlbRQL3vuMesDF3MCPqdKbqkt6jAfaCF9i1WLKt+M5DkTHKmoTlDPbpfegBQQroqS6kMGgKPIrRZYYOYQaWii7Gt8IC03Ps0oQgJ3nsdDQuICY/sPoILzZlI3ZG/w6odrcunRkYuqVlRNWu/r1eyGtxoCAm6pqppR2QkKrHSFL2jBkNHcHdWcSOCp2/lUr+4cmWvz9C5b/H1HJlVoEsRgAF/oL71MbAt0HtqfmdGUB1e5+GmTiK8BbTsbk4RDO4mqylWZDVjggX5g567E+Br99Qn9MKAZIgXHFcCev0uK+jjWoO4hwHce3jte+aUHo67mVMDwu37F484+3Yhsog1TXdDXoVh0Ud6a+BUjIULpuhGPaKQ2sZ176FDteAjHS8BPTdhO3DAz9XUIEW/VFSbPaDdx2cr3x8r35kM0JbHjeo0dj8i1eSd7oZT9vHkOIK3sZ2/A0K7fh2cecze/4f7G9rBLs9rpQBjh/cGeA3xknjvuYXt5TLHmiKXrt1wgwanqlkl/4vT8CuaVvAN51I5+PqgGBHCGmlKod0Z3t+vSmGhMZmgve8AYdoNLcDsbTcNqRR0QNvHdElVwZy5MRXT7ZCuMQdbM06XFHG6phxhrdlSuIVr+/WHtz5AMp9Qf8P4e3b6/CSdni1nlWBfKtpvk4jDh6/D73GIicd1QaktGpa7A0mkEBRyK9CGmdWYokAoUBnSWOyKHlVedG/XwooT9ElzRXG5ZARzZDkYcX2Ai9NyB0ONtGk8nezK1VaH2euks21kL6s19gWPOcM6W8nkPoFz4hp3DXqptE2NrFbstuAJ4wEgd2gst3Cn+UYshFOsZm+4ltYR3zlv5/BYjn71v5ihN2Lb/GtA3YAvr4VBOJ8RWZSVoSqshpOE8e3E0rln3/TXAnos7iwIM/+sXn7/w5+t73veWY5aYt8E2fb7NIv7YnbXwA3eUoX+rYnJ6ReeDWAufOpj1/+k3/Oi5Xln1+9djyOTlw/ptif9hil2nBl6/9vHCzt3qqgLnkC8NGeaKFpiQbbWqvTmGe/ngiCQ0HP08d1rdCnMjy+fo8v35xf/+Rp9uhTm1U/o6Wa1RYIys6IKkZXUvlWaVIoSA9/64dX/+m/PngQlQs0qoY7rywN06qzA4XY8OvHuu+cxv3Z78bJmKnzE88fFdFc3HeD8SMC4O1/wIX57hmnrnXxmylSYo7dv3geZ/UMKmi6WddzO+D9S0FlYtpbdr0aFwkQOK09Ygsd4B+9ZhyU2dINP0CIddvcVepPnCuK0bpeH2GmuXlKUx75zPvQt5PLs3ZW7lUafxwqsJ3z92AkqOUvV393o8sqyMhL9sjI8shNEFBnascdlWFtimeuuNa2C6LCL85zZL2PePth2evmH77kJN4B1CeGAS3/Cz3e3wICVNtc6iV131ysNo/eewyupTKOSB0o3hwc2WABmtoc1r55Y9m4+TCzry6Se1rsxwQsa8huniuJ67sDzxVpLwqzJ6eJGAxsHWb2ssFjSWeM6ESkWbFkpmqP5FmhSkUPWUFjPlEdCDwyKRkes5eCgiwR4Bzyi7d8t4YoeAFC0kIZmPrM7fp5RfNHmQmc4c6n4CUiXRqUhvkiwJRYJqoV5iuOQCv+kTCBUnGd1JC6dWd734O08Zv3RusGEE1iwF2ZFlaAGfdyW9Dn6VF9jbyEA9iO6qgNgg5vgtzFLrW7VM4ExMeIa10z7uPhzhDkPGhNl+0VIcMMKEvPWVNk7kAkjkTZwmTOBPl2OKhQCCbLJ9FV0lW2JyjJB2zdLWFEdO6PXkk1Q4uJuxNip6BBvT8Cta62QcSqW0TtFAs/W+EhohY5YoM7kwbzzACMQgXSCBcLoF6k2WOXDPt0IvVlCspdC2J74W8ilm1OzoVSETc/IqIn3feOWBvPuU51jBgFkPGRGDGbIhM9zhbSEghmrlnyLjfAU1xyLKd7x7xCgrBNEOiHKwQR3Q5btS8raerBLcGB3b57YL5WUAArBOh4e3N1e7LEyjFQcKwR40ahm4unF7eu3cikXi3D3d0oys6LJl3eH2Y92QHcaO3xfWL4tu28qs6LC+GTxUbZ1FRM54W4JPW7IcdY/aapGGZaVIXJaSfshxxm+rgihWo/wDMjjx4GjHZd4Anwha+IupdqiQGHCgLcplNMOj7THo9VK8MCnSynsvWL1Vsg4bH6IBobS7qzW8fDoRu5NjBxqKdQMcEbzZj4+DtOzh5lAmpkqoD8RFBdQr6I91RXWCOeytLeLWVGmkNyIdsmc4Ay+lUIWI3m10JNDMwdRP60RYY17JnKrf6TSjQAw+oVxit54xmYDMdwl2CuaibkzOZow3sz/JOkKoyK49lkLcaUQmmNAEDHr3R8gCJevd+3rNWJLYjwhdC5TVg8EJj+nK7xmsgLrksiiVLJgIxmKdGrmLgSecygiW6Cz/bwxsW7UTkIm+xzuWJ0oyMAOh1GbyxzBYGD8hr/Uq9u5ZdvzNrrt2jLLSph+OVtsiz6HMvCMHOPW38kKgvt4SQVVjNRTAoFAol8/tYCZFVy1od5uyDM7Iz/MtFHjj5/1nI6B3TrZnF7un5M3L9xYCecVdE0bJ9ywgmqr1521p2hJRx+R/CpEA4U4uBAAPPjAZVB33FrHYHefbGv9eLc5/ZDpaE1O7zw1HzA+NMPB3GDGrUK4gzL4emf38uDs1KRr5w5alLmpwysXDUt1GgVyQI83CuTr3Y4/Hl6yWK0Nplmyu+lHNakGiXnG7qA/Jt2OMec22IyNUQ8laL04dfTKncqssoKalTzBKwneiSQjx4b/2uiCA5aSkkmjTntedT5I7uO1lpE9+zJRJOQ/Zz9//z16+vb8zdUzdM60YWJZMb2iOZTCB3nhcimT4wLtewmDbNmF48MvM3xxJGNMycRRxX31n3ZVQxw0JwYi8tGaPt/nuBBI+2/qfjuBP+Ap9GaKRQgmvc0UwzwWOl1vIh9wzirtRkBSIc0KxrFy6smqTXuGCNzr4fIqOOea5VMijXQz5T/ZjVBHEXu4mO0hT1dn8UbsO+vwrOErDTvxXx8kgk8Ge8EHbminLCMPhzKlSpkYMHiyAVFLtcSC/bEnq1qk2wp3FfYRku7uqRFxL5gK1pImQv35xQ4Ht4WD+HLYRTtZzb9SzM2KYEVRqWguCyZwsOCuo56usGFUGH0wPZ7jKWf7Fp90sg76kZaJNq49Ok+s4iqxMgCG1E51v1qdEOzIK5u7aNQFzanChuZZtKSyPfvDKp9f6hGbx7MrJdcsb8DD/PdwWXJvqQ42hgf/sdfark0bNnDaSbJ8olk2Q3qsP7MdmWaweShkTq6Zez1f9Q33EQi4xuiM2RT8vpYnvQWbqfOjTiX0MjBRZ6OCxYo10kYqp/EttYIaDKM9gW/N7LeehGdfsDzndDot9w7Gu6ueCyxvR+8dpefq9hjTTPfKj9ZBGBLb+nX2OSo5tktm72epEBVEbcuxKD+kQk7gT94hg041vuWvUhv0DpMVEyMuXY4TaY5v+rL+JCDTv1TUqg9rHzmQMz1Db3Ncos/wD2cf5VK4utN/Di9PtMJrai0nTrFCXyqqtggwCHUphaa1RRUuTrXzzeA30+hLj4FHLGXFahRI4abvcPnG+aynNAGr7Qb64MFR78opdHlKGzDr7/EaWnoHxMj6hv7iZRqpSoigH6ufNzePe3l2MFIjNXaeYuY9zPQLgdGGiVxuNNIlJWzBiP3keahO0OfJDg+InZ7jt825QU8BEZYK0l5D8HT5rCMtVAm4x9/SJSZb9EnvAt82L7BFv5A2enatHWECh33ktu+6WsAK1KrBJrM34kDiDQ5AoPp/p9IUynmG4tuddnqDegyd15nXgRnDDIMbzf/miMlOk9c7NlWf4etD77Wuu4Cpj6OADmczTcCueTDYXZs2IdMtw2CFwoAUh4ufoWwgZkvA0Qo3mHJOF0z4WD0oJ0D1K3A5AjoI3B1VKJaItzYA0zP/YivGJmabeu4eS2kEm7KJYRuDyaqYGAK/HRUEjgbeUXc5kjR5mTMRr4NY1LNhpwxFhWkvz4CS6pbtwLI4GO22vD/QtXPAddq77wDXJVb1nrJ/ft5OZbNiAyh1ZE+H9WVd8vudpmei9yxxsBZSbdMt+F90icVfDyLG1IzsoqjX5nnoarJi+csLoH5gbicziQazqvHW989qdBdkVBgly2NURy6r+SC4cKc97se03jY9UI4APLrqjmnP4ZksSiy2zXmEYwft9J2/sqbKXkMZEwsZNgqwvkldI3RAf/S8yJqzDU2Lir74kipH4JeK8y36jwpztmA0R+dQ9+yCg0FWNnSeESlv2Ike3X+nc+TGb/1nzMes+ehos+1zeFkZMLmPbGF6+Kx/aIbwXXZ8ONrF5Gfo47Z0U28jB1Y4bgXHF0/RRRYVTLbHtuXBBSLUEx2Cre0zM0WorjEud7lzkcVSqjraD0/MH96OLHkHKyfydqplUabtQ7RHFHbkg5H7mk0lZSJLZJcpO45dD1RiEw5NEpFhHfO1v0NY+XL6yJQrxSMuc4dqxFVpnNGsUrGiIR2amqoML+P5lC3p6NfTLumo6Y+7pP2uT6BY6K2hAkyr+M6JpR9tNzeG3krRXqpMbIvKDTFFLeGOzv0Iw4J59cL/95ln4YX/D5/XFAr7Y05VODvPT+eEr+duMt3Hc4i4dlqtDaaT+4Zo1qViYkGVGnl3Hc57knl1Df+Dog+GZydgssYlXnSWIXCk4FlbJj1SgSEm234X7t3ebruPkEGsun/6Bx0maI03/GTliqpp4hHWZvcZT0/PoPXjM3QG44dZo8pMBJYyIuczqnzzT7qThbkHnJcmfTruCLKz4HbQJ7qDFL13pdkfx0Yl7w+NEl5tdM3+CEdr2E0inXL5jwsk6FIa5hawXGE90gFKk6lhhTpL6QYfby5olzpZB6hBgktvj9XA6XX9TTghRbPlFBUVu/hGTdfDj6ONlq02YVpX0Y1OoAzJUumidQ97QwEOqVJJY6CDRelqzws7OLqGx+l92mmSDIkGGdy/Ij+9htTO/ZdRR3sex+T9teceHsdVqNY8W6e80ftPqj6QHWQmz+zWw1V0mEadijC7od6jTgRu8E3brqR7IYFu/QlpeK+TCl1ev/nHuyt0Ze8p9JsY6b7ScpuokvoYbj9uZJhbUENkRcmNPiqIfDclnBaDLNR0rsHrbCDCIA3UtyBsteAeK5cqNgCFPIGR6/hoUEFGnQbg2WBTTdbhs8vlGnOWu40YYKKvCCdDtd6nCEFiN3Sr+2o70s6vE0gj014ZU+qMQQ/aJKRhKVMIhOBHcJrYUtSVL1Ixsz1woogsiqQ4cXfk2/HhA0LhEvwNU5T3Pc3YIZYNxyLT+lQNb+3ITof/7mdb12gFuXWlxlkp2RRp1SGGHQcIOACmwt4AiJWssBAD4IzUcFN+VGBk5M12Itjm5mLxPQ9/f/vmvb/3XvSGby4UI1U/9h8ds43pm2wteZVKAG/qPs7C97lpOmPX7XwrwYxGTx0T+hmgdUBhb91Rt0ceAdPB2fAqkTZ763n9JJjx6QKz3aKDNVWQKbCoOCJSEFoa6yhfuzUcgVfYbFJqXyd467DXLbQto6VUBkkr31//9iaUghsUe+x9J9Vy+gTLfoHBToh1jh3YSRAo5u8Xv11dXqF3+LZgIm/aeoeX1c5t8jTMnSaKI9Py0xjMbt+0GvMpXLIYPT3bVTlmi+kKNk9dhF9PObnZsRMs81r58tyj9Hou9nLIp1uUE2MF1DMu/svXDTeFOSIfWpKxTzfES6wLfaLsRt+uGrz45lG3cMW9z5GuAinqWKO/aKOkWP51zjG54Uwbmv/lhf/b8+ZTJhaUhD9aMEU3mAcNGTznnd8gLHKkJRrZlooumTZqaz37KZVFic3Kg/U3PKA+DwMmISg1FZuuENrVaxGpOijkjT3ZcE6FUds//d8AAAD//7FxYfk=" } diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/_meta/fields.yml b/x-pack/filebeat/module/barracuda/spamfirewall/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml b/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml new file mode 100644 index 00000000000..c93494c2dbb --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Barracuda" + product: "Spam" + type: "Anti-Virus" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/barracuda/spamfirewall/config/liblogparser.js + - ${path.home}/module/barracuda/spamfirewall/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/config/liblogparser.js b/x-pack/filebeat/module/barracuda/spamfirewall/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{resultcode->} %{info}"); + +var dup2 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); + +var dup3 = setc("eventcategory","1207010201"); + +var dup4 = setf("msg","$MSG"); + +var dup5 = setc("direction","inbound"); + +var dup6 = date_time({ + dest: "starttime", + args: ["fld1"], + fmts: [ + [dX], + ], +}); + +var dup7 = date_time({ + dest: "endtime", + args: ["fld2"], + fmts: [ + [dX], + ], +}); + +var dup8 = field("fld3"); + +var dup9 = field("resultcode"); + +var dup10 = field("disposition"); + +var dup11 = field("event_cat"); + +var dup12 = setc("action"," RECV"); + +var dup13 = setc("eventcategory","1207010000"); + +var dup14 = setc("direction","outbound"); + +var dup15 = // "Pattern{Constant('SZ:'), Field(fld9,true), Constant(' SUBJ:'), Field(subject,false)}" +match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); + +var dup16 = setc("eventcategory","1207040000"); + +var dup17 = setc("eventcategory","1701020000"); + +var dup18 = setc("ec_subject","User"); + +var dup19 = setc("ec_activity","Logon"); + +var dup20 = setc("ec_theme","Authentication"); + +var dup21 = constant("Deferred Message"); + +var dup22 = constant("1207010100"); + +var dup23 = constant("1207040200"); + +var dup24 = constant("1207040100"); + +var dup25 = constant("1207010000"); + +var dup26 = constant("1207000000"); + +var dup27 = linear_select([ + dup1, + dup2, +]); + +var dup28 = lookup({ + dest: "nwparser.disposition", + map: map_getActionName, + key: dup8, +}); + +var dup29 = lookup({ + dest: "nwparser.result", + map: map_getReasonName, + key: dup9, +}); + +var dup30 = lookup({ + dest: "nwparser.event_cat", + map: map_getEventLegacyCategory, + key: dup10, +}); + +var dup31 = lookup({ + dest: "nwparser.event_cat_name", + map: map_getEventLegacyCategoryName, + key: dup11, +}); + +var dup32 = lookup({ + dest: "nwparser.disposition", + map: map_getActionNameForSend, + key: dup8, +}); + +var dup33 = linear_select([ + dup15, + dup2, +]); + +var hdr1 = // "Pattern{Field(messageid,false), Constant('['), Field(hfld14,false), Constant(']: '), Field(p0,false)}" +match("HEADER#0:0001", "message", "%{messageid}[%{hfld14}]: %{p0}", processor_chain([ + setc("header_id","0001"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant("["), + field("hfld14"), + constant("]: "), + field("p0"), + ], + }), +])); + +var hdr2 = // "Pattern{Field(hfld1,false), Constant('/'), Field(messageid,false), Constant('['), Field(hfld14,false), Constant(']: '), Field(p0,false)}" +match("HEADER#1:0002", "message", "%{hfld1}/%{messageid}[%{hfld14}]: %{p0}", processor_chain([ + setc("header_id","0002"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld1"), + constant("/"), + field("messageid"), + constant("["), + field("hfld14"), + constant("]: "), + field("p0"), + ], + }), +])); + +var hdr3 = // "Pattern{Field(messageid,false), Constant(': '), Field(p0,false)}" +match("HEADER#2:0003", "message", "%{messageid}: %{p0}", processor_chain([ + setc("header_id","0003"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(": "), + field("p0"), + ], + }), +])); + +var select1 = linear_select([ + hdr1, + hdr2, + hdr3, +]); + +var part1 = // "Pattern{Constant('inbound/pass1['), Field(fld14,false), Constant(']: '), Field(username,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' RECV '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:000001/0", "nwparser.payload", "inbound/pass1[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); + +var all1 = all_match({ + processors: [ + part1, + dup27, + ], + on_success: processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup28, + dup29, + dup30, + dup31, + dup12, + ]), +}); + +var msg1 = msg("000001", all1); + +var part2 = // "Pattern{Constant('inbound/pass1: '), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' SCAN '), Field(fld4,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1:inbound/pass1/0", "nwparser.payload", "inbound/pass1: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} SCAN %{fld4->} %{from->} %{to->} %{fld5->} %{fld3->} %{resultcode->} %{p0}"); + +var part3 = // "Pattern{Field(fld6,true), Constant(' SZ:'), Field(fld8,true), Constant(' SUBJ:'), Field(subject,false)}" +match("MESSAGE#1:inbound/pass1/1_0", "nwparser.p0", "%{fld6->} SZ:%{fld8->} SUBJ:%{subject}"); + +var part4 = // "Pattern{Field(domain,true), Constant(' '), Field(info,false)}" +match("MESSAGE#1:inbound/pass1/1_1", "nwparser.p0", "%{domain->} %{info}"); + +var select2 = linear_select([ + part3, + part4, +]); + +var all2 = all_match({ + processors: [ + part2, + select2, + ], + on_success: processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup28, + dup29, + dup30, + dup31, + setc("action"," SCAN"), + ]), +}); + +var msg2 = msg("inbound/pass1", all2); + +var part5 = // "Pattern{Constant('inbound/pass1:'), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' RECV '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#2:inbound/pass1:01/0", "nwparser.payload", "inbound/pass1:%{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); + +var all3 = all_match({ + processors: [ + part5, + dup27, + ], + on_success: processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup28, + dup29, + dup30, + dup31, + dup12, + ]), +}); + +var msg3 = msg("inbound/pass1:01", all3); + +var select3 = linear_select([ + msg1, + msg2, + msg3, +]); + +var part6 = // "Pattern{Constant('outbound/smtp['), Field(fld14,false), Constant(']: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#3:000002/0", "nwparser.payload", "outbound/smtp[%{fld14}]: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{p0}"); + +var part7 = // "Pattern{Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(info,false)}" +match("MESSAGE#3:000002/1_0", "nwparser.p0", "%{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{info}"); + +var select4 = linear_select([ + part7, + dup2, +]); + +var all4 = all_match({ + processors: [ + part6, + select4, + ], + on_success: processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, + ]), +}); + +var msg4 = msg("000002", all4); + +var part8 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#4:outbound/smtp/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{fld5->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); + +var part9 = // "Pattern{Field(fld8,true), Constant(' <<'), Field(from,false), Constant('> '), Field(p0,false)}" +match("MESSAGE#4:outbound/smtp/1_0", "nwparser.p0", "%{fld8->} \u003c\u003c%{from}> %{p0}"); + +var part10 = // "Pattern{Constant('<<'), Field(from,false), Constant('>'), Field(p0,false)}" +match("MESSAGE#4:outbound/smtp/1_1", "nwparser.p0", "\u003c\u003c%{from}>%{p0}"); + +var select5 = linear_select([ + part9, + part10, +]); + +var part11 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#4:outbound/smtp/2", "nwparser.p0", "%{} %{p0}"); + +var part12 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant(', Hostname='), Field(hostname,false), Constant('] '), Field(event_description,true), Constant(' #to#'), Field(ddomain,false)}" +match("MESSAGE#4:outbound/smtp/3_0", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{event_description->} #to#%{ddomain}"); + +var part13 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant('] '), Field(event_description,true), Constant(' #to#'), Field(daddr,false)}" +match("MESSAGE#4:outbound/smtp/3_1", "nwparser.p0", "[InternalId=%{id}] %{event_description->} #to#%{daddr}"); + +var part14 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant(', Hostname='), Field(hostname,false), Constant('] '), Field(info,false)}" +match("MESSAGE#4:outbound/smtp/3_2", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{info}"); + +var part15 = // "Pattern{Field(event_description,true), Constant(' #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" +match("MESSAGE#4:outbound/smtp/3_3", "nwparser.p0", "%{event_description->} #to#%{ddomain}[%{daddr}]:%{dport}"); + +var part16 = // "Pattern{Field(event_description,true), Constant(' #to#'), Field(ddomain,false)}" +match("MESSAGE#4:outbound/smtp/3_4", "nwparser.p0", "%{event_description->} #to#%{ddomain}"); + +var select6 = linear_select([ + part12, + part13, + part14, + part15, + part16, +]); + +var all5 = all_match({ + processors: [ + part8, + select5, + part11, + select6, + ], + on_success: processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, + ]), +}); + +var msg5 = msg("outbound/smtp", all5); + +var part17 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#5:000009/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); + +var part18 = // "Pattern{Field(fld8,true), Constant(' ok'), Field(p0,false)}" +match("MESSAGE#5:000009/1_0", "nwparser.p0", "%{fld8->} ok%{p0}"); + +var part19 = // "Pattern{Constant('ok'), Field(p0,false)}" +match("MESSAGE#5:000009/1_1", "nwparser.p0", "ok%{p0}"); + +var select7 = linear_select([ + part18, + part19, +]); + +var part20 = // "Pattern{Field(fld9,true), Constant(' Message '), Field(fld10,true), Constant(' accepted #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" +match("MESSAGE#5:000009/2", "nwparser.p0", "%{fld9->} Message %{fld10->} accepted #to#%{ddomain}[%{daddr}]:%{dport}"); + +var all6 = all_match({ + processors: [ + part17, + select7, + part20, + ], + on_success: processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, + ]), +}); + +var msg6 = msg("000009", all6); + +var part21 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' Message accepted for delivery #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" +match("MESSAGE#6:outbound/smtp:01", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} Message accepted for delivery #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ + dup13, + dup4, + dup14, + setc("result"," Message accepted for delivery"), + dup32, + dup30, + dup31, +])); + +var msg7 = msg("outbound/smtp:01", part21); + +var part22 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' conversation with '), Field(fld5,false), Constant('['), Field(fld6,false), Constant('] timed out while sending '), Field(fld7,true), Constant(' #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" +match("MESSAGE#7:outbound/smtp:02", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} conversation with %{fld5}[%{fld6}] timed out while sending %{fld7->} #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, +])); + +var msg8 = msg("outbound/smtp:02", part22); + +var part23 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#8:000010/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} %{p0}"); + +var part24 = // "Pattern{Constant('Ok '), Field(fld9,true), Constant(' '), Field(fld10,true), Constant(' - gsmtp #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_0", "nwparser.p0", "Ok %{fld9->} %{fld10->} - gsmtp #to#%{p0}"); + +var part25 = // "Pattern{Constant('Ok: queued as '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_1", "nwparser.p0", "Ok: queued as %{fld9->} #to#%{p0}"); + +var part26 = // "Pattern{Constant('ok '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_2", "nwparser.p0", "ok %{fld9->} #to#%{p0}"); + +var part27 = // "Pattern{Constant('Ok ('), Field(fld9,false), Constant(') #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_3", "nwparser.p0", "Ok (%{fld9}) #to#%{p0}"); + +var part28 = // "Pattern{Constant('OK '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_4", "nwparser.p0", "OK %{fld9->} #to#%{p0}"); + +var part29 = // "Pattern{Field(fld9,true), Constant(' #to#'), Field(p0,false)}" +match("MESSAGE#8:000010/1_5", "nwparser.p0", "%{fld9->} #to#%{p0}"); + +var select8 = linear_select([ + part24, + part25, + part26, + part27, + part28, + part29, +]); + +var part30 = // "Pattern{Field(daddr,false)}" +match_copy("MESSAGE#8:000010/2", "nwparser.p0", "daddr"); + +var all7 = all_match({ + processors: [ + part23, + select8, + part30, + ], + on_success: processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, + ]), +}); + +var msg9 = msg("000010", all7); + +var part31 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' connect to '), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']: '), Field(event_description,false)}" +match("MESSAGE#9:000011", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} connect to %{ddomain}[%{daddr}]: %{event_description}", processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, +])); + +var msg10 = msg("000011", part31); + +var part32 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(fld7,true), Constant(' ['), Field(ddomain,false), Constant(']: '), Field(event_description,false)}" +match("MESSAGE#10:000012", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} [%{ddomain}]: %{event_description}", processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, +])); + +var msg11 = msg("000012", part32); + +var part33 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' <<'), Field(from,false), Constant('>: '), Field(event_description,false)}" +match("MESSAGE#11:000013", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld7->} \u003c\u003c%{from}>: %{event_description}", processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, +])); + +var msg12 = msg("000013", part33); + +var part34 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld8,true), Constant(' '), Field(event_description,false)}" +match("MESSAGE#12:000014", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld8->} %{event_description}", processor_chain([ + dup13, + dup4, + dup14, + dup32, + dup30, + dup31, +])); + +var msg13 = msg("000014", part34); + +var select9 = linear_select([ + msg4, + msg5, + msg6, + msg7, + msg8, + msg9, + msg10, + msg11, + msg12, + msg13, +]); + +var part35 = // "Pattern{Constant('scan['), Field(fld14,false), Constant(']: '), Field(username,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld8,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#13:000003/0", "nwparser.payload", "scan[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); + +var all8 = all_match({ + processors: [ + part35, + dup33, + ], + on_success: processor_chain([ + dup16, + dup4, + dup6, + dup7, + dup28, + dup29, + dup30, + dup31, + ]), +}); + +var msg14 = msg("000003", all8); + +var part36 = // "Pattern{Constant('scan: '), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld8,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#14:scan/0", "nwparser.payload", "scan: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); + +var all9 = all_match({ + processors: [ + part36, + dup33, + ], + on_success: processor_chain([ + dup16, + dup4, + dup6, + dup7, + dup28, + dup29, + dup30, + dup31, + ]), +}); + +var msg15 = msg("scan", all9); + +var select10 = linear_select([ + msg14, + msg15, +]); + +var part37 = // "Pattern{Constant('web: Ret Policy Summary (Del:'), Field(fld1,true), Constant(' Kept:'), Field(fld2,false), Constant(')')}" +match("MESSAGE#15:000004", "nwparser.payload", "web: Ret Policy Summary (Del:%{fld1->} Kept:%{fld2})", processor_chain([ + dup17, + dup4, +])); + +var msg16 = msg("000004", part37); + +var part38 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] FAILED_LOGIN ('), Field(username,false), Constant(')')}" +match("MESSAGE#16:000005", "nwparser.payload", "web: [%{saddr}] FAILED_LOGIN (%{username})", processor_chain([ + setc("eventcategory","1401030000"), + dup18, + dup19, + dup20, + setc("ec_outcome","Failure"), + dup4, + setc("action","FAILED_LOGIN"), +])); + +var msg17 = msg("000005", part38); + +var part39 = // "Pattern{Constant('web: Retention violating accounts: '), Field(fld1,true), Constant(' total')}" +match("MESSAGE#17:000006", "nwparser.payload", "web: Retention violating accounts: %{fld1->} total", processor_chain([ + setc("eventcategory","1605000000"), + dup4, +])); + +var msg18 = msg("000006", part39); + +var part40 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] global CHANGE '), Field(category,true), Constant(' ('), Field(info,false), Constant(')')}" +match("MESSAGE#18:000007", "nwparser.payload", "web: [%{saddr}] global CHANGE %{category->} (%{info})", processor_chain([ + dup17, + dup4, + setc("action","CHANGE"), +])); + +var msg19 = msg("000007", part40); + +var part41 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] LOGOUT ('), Field(username,false), Constant(')')}" +match("MESSAGE#19:000029", "nwparser.payload", "web: [%{saddr}] LOGOUT (%{username})", processor_chain([ + setc("eventcategory","1401070000"), + dup18, + setc("ec_activity","Logoff"), + dup20, + dup4, + setc("action","LOGOUT"), +])); + +var msg20 = msg("000029", part41); + +var part42 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] LOGIN ('), Field(username,false), Constant(')')}" +match("MESSAGE#20:000030", "nwparser.payload", "web: [%{saddr}] LOGIN (%{username})", processor_chain([ + setc("eventcategory","1401060000"), + dup18, + dup19, + dup20, + dup4, + setc("action","LOGIN"), +])); + +var msg21 = msg("000030", part42); + +var select11 = linear_select([ + msg16, + msg17, + msg18, + msg19, + msg20, + msg21, +]); + +var part43 = // "Pattern{Constant('notify/smtp['), Field(fld14,false), Constant(']: '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(bytes,true), Constant(' '), Field(version,true), Constant(' '), Field(from,true), Constant(' '), Field(info,false)}" +match("MESSAGE#21:000008", "nwparser.payload", "notify/smtp[%{fld14}]: %{saddr->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{bytes->} %{version->} %{from->} %{info}", processor_chain([ + dup13, + dup4, + dup32, + dup30, + dup31, +])); + +var msg22 = msg("000008", part43); + +var part44 = // "Pattern{Constant('reports: REPORTS ('), Field(process,false), Constant(') queued as '), Field(fld1,false)}" +match("MESSAGE#22:reports", "nwparser.payload", "reports: REPORTS (%{process}) queued as %{fld1}", processor_chain([ + dup16, + dup4, + setc("event_description","report queued"), +])); + +var msg23 = msg("reports", part44); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "inbound/pass1": select3, + "notify/smtp": msg22, + "outbound/smtp": select9, + "reports": msg23, + "scan": select10, + "web": select11, + }), +]); + +var part45 = // "Pattern{Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(info,false)}" +match("MESSAGE#0:000001/1_0", "nwparser.p0", "%{fld3->} %{resultcode->} %{info}"); + +var part46 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); + +var part47 = // "Pattern{Constant('SZ:'), Field(fld9,true), Constant(' SUBJ:'), Field(subject,false)}" +match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); + +var select12 = linear_select([ + dup1, + dup2, +]); + +var select13 = linear_select([ + dup15, + dup2, +]); diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml b/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml new file mode 100644 index 00000000000..67018925f0f --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Barracuda Spam Firewall + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/manifest.yml b/x-pack/filebeat/module/barracuda/spamfirewall/manifest.yml new file mode 100644 index 00000000000..9ffc06e93aa --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["barracuda.spamfirewall", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9524 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log new file mode 100644 index 00000000000..ce95de02d11 --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log @@ -0,0 +1,100 @@ +notify/smtp[avolupt]: 10.224.15.48 nto sse accept tur 3 illumqui 1090 1.2364 ivelitse ritin +inbound/pass1: etdo[10.173.228.223] ntsunti 1455282753 1455282753 SCAN nseq itinvol psa umq 0 31 psaq SZ:cer SUBJ:reveri +outbound/smtp: 10.104.162.169 eosquir orsi nulapari allow vol 4 uidolor nibus mipsumq <: enatus +notify/smtp[iatu]: 10.57.70.73 dolo meumfug deny roinBCS 2 com 1060 1.2548 byC tinculp +outbound/smtp: 10.236.42.236 tconsec nsequat taev block untutl 1 llu uptassi tamremap tur +reports: REPORTS (enatuse.exe) queued as magn +inbound/pass1[sit]: avol[10.162.151.94] laboreet 1461457525 1461457525 RECV aquaeabi giatq quid +inbound/pass1: tempor[10.138.137.28] eip 1462692479 1462692479 SCAN lupta iusmodt doloreeu pori 7 8 ect SZ:reetdolo SUBJ:nrepreh +scan: ari[10.108.180.105] nsequat 1463927433 1463927433 block llam llamcorp ari eataevit 4 38 uovol dmi +inbound/pass1: [10.206.159.177] ididu 1465162388 1465162388 RECV ciunt turQuisa 10 74 lit +inbound/pass1[umdo]: sed[10.206.224.241] reetdolo 1466397342 1466397342 RECV olupta turveli 4 40 tatno +inbound/pass1: aveniam[10.82.201.113] essequ 1467632296 1467632296 SCAN taevi ender snulapar aedic 5 13 iumto SZ:aboreetd SUBJ:sun +reports: REPORTS (tem.exe) queued as ons +outbound/smtp: 10.110.109.5 ittenbyC aperi lor accept ipi 4 paqu eseru remeum #to#10.18.165.35 +scan: dolore[10.195.109.134] eddoei 1471337159 1471337159 deny etM nimadmin ditautfu piscing 6 74 ostr rudexerc +scan[colabor]: iusmodt[10.21.92.218] lorumw 1472572113 1472572113 accept llitani inima tlabo suntexp 4 45 stiae SZ:nofdeF SUBJ:sunt +reports: REPORTS (tat.exe) queued as tion +reports: REPORTS (emp.exe) queued as aperia +web: Ret Policy Summary (Del:eritquii Kept:dexeac) +web: [10.45.25.68] LOGOUT (rehender) +web: Ret Policy Summary (Del:hil Kept:atquovo) +notify/smtp[tatn]: 10.18.109.121 ents pida allow idolor 1 emoeni 269 1.2857 utlabore ecillu +web: [10.19.194.101] global CHANGE orinrepr (conse) +reports: REPORTS (lumqui.exe) queued as itinvo +reports: REPORTS (usmodt.exe) queued as siar +notify/smtp[sci]: 10.116.193.182 snostrud nama allow data 1 ationul 2530 1.5361 commod adol +inbound/pass1: hitect[10.198.6.166] modocon 1486156610 1486156610 SCAN que atevel nsecte itame 0 38 lit5929.test quamnih +outbound/smtp: 10.198.19.111 aquaeabi lita adeseru accept amc 4 amest corp modtemp <: iae +inbound/pass1: equat[10.77.137.72] ione 1488626519 1488626519 SCAN ihilmole eriamea amre rsita 8 56 uptat3156.www5.test tmo +inbound/pass1: vitaedi[10.128.114.77] temqu 1489861473 1489861473 SCAN edol colab ommodico quatD 4 59 neav6028.internal.domain agnid +outbound/smtp: 10.181.80.139 hitecto ents liquide allow tenatu 1 boN eprehend aevit aboN +inbound/pass1[ris]: uamqu[10.138.252.123] quioffi 1492331381 1492331381 RECV uptate ncidid quaturve +reports: REPORTS (aera.exe) queued as ate +inbound/pass1: [10.153.108.27] uir 1494801290 1494801290 RECV dol essecil citation +outbound/smtp: 10.120.167.239 gnido ratvolu olup deny nsecte 3 eveli eroi dtemp aliquide +inbound/pass1[ris]: nisi[10.105.88.20] ecte 1497271198 1497271198 RECV tinvolu iurer iciadese +scan: olupta[10.98.92.244] idolor 1498506153 1498506153 deny uta llumdolo nre ercitat 7 38 riosamn SZ:ept SUBJ:iumtotam +scan[sperna]: sintocc[10.185.107.75] tDuisaut 1499741107 1499741107 allow tate imvenia spi stquido 8 62 ptas SZ:pta SUBJ:tetu +reports: REPORTS (nevo.exe) queued as ide +notify/smtp[etcons]: 10.80.214.206 ate uiac accept officiad 4 quinesc 6218 1.5651 tur roi +notify/smtp[nof]: 10.48.34.226 ccaec ten allow isc 2 ntN 6179 1.2364 tateve itinvol +reports: REPORTS (etconsec.exe) queued as ios +inbound/pass1: tquov[10.211.93.62] mod 1505915878 1505915878 SCAN hilm ataevi com tnulapa 5 57 tiumt SZ:reetdolo SUBJ:norum +reports: REPORTS (uidol.exe) queued as mporin +scan: qui[10.199.182.123] entor 1508385787 1508385787 accept Sedutp utp ema rsitv 0 69 ntiumt iquipe +reports: REPORTS (tvolupt.exe) queued as eufugi +scan[pid]: illoin[10.130.38.118] uamni 1510855695 1510855695 block gnamal metMalo ntexplic archite 1 56 untu asi +inbound/pass1: [10.153.152.219] eumiu 1512090649 1512090649 RECV orumSe boree intoc +web: Retention violating accounts: rnatur total +reports: REPORTS (isisten.exe) queued as cusant +reports: REPORTS (naal.exe) queued as borios +outbound/smtp: 10.167.227.44 tali lillum cusant deny ender 2 oles edic seq tutlab +notify/smtp[atevelit]: 10.56.136.27 aperia ccaeca deny ttenby 1 amc 5163 1.375 orumSe ratv +web: [10.194.90.130] FAILED_LOGIN (siut) +inbound/pass1: [10.103.69.44] velitess 1520735329 1520735329 RECV naali uunturm temUte +inbound/pass1: aveni[10.29.155.171] uptatema 1521970284 1521970284 SCAN oeni tdol sit tiaec 6 23 oremagna3521.mail.home asiar +inbound/pass1: [10.145.193.93] nonp 1523205238 1523205238 RECV labo ulapar aboreetd +inbound/pass1[ama]: uatur[10.143.79.226] exeacom 1524440192 1524440192 RECV roidents tem dol +web: [10.30.25.84] FAILED_LOGIN (utlab) +inbound/pass1: [10.141.225.182] bor 1526910101 1526910101 RECV rauto ationev 8 57 uaUten +reports: REPORTS (dun.exe) queued as reprehe +web: [10.90.9.88] global CHANGE umexerc (oremipsu) +reports: REPORTS (amco.exe) queued as ssecillu +reports: REPORTS (olo.exe) queued as psumqu +notify/smtp[rationev]: 10.226.20.199 tatem untutlab allow eveli 2 lillum 7809 1.2000 uisaute imide +web: [10.134.140.191] global CHANGE nte (mvel) +outbound/smtp[conse]: 10.252.40.172 nimadmin isiu licabo cancel etdolor 3 dic cola amcor +scan[xea]: ites[10.126.26.131] nisiut 1536789735 1536789735 accept teturad perspici itation sequatD 5 24 isciv rroqu +scan[rExc]: iusmo[10.187.210.173] reetd 1538024689 1538024689 accept ulpa sitam rad loi 2 15 Nequepor SZ:eirure SUBJ:deserun +reports: REPORTS (orroq.exe) queued as vitaedic +reports: REPORTS (orem.exe) queued as rcit +scan[untincul]: ssecil[10.180.147.129] atise 1541729552 1541729552 allow umetMalo oluptas emvele isnost 2 5 ido emqu +notify/smtp[exeaco]: 10.99.17.210 olorsit tore cancel illu 4 turadip 688 1.7484 boreetdo undeom +notify/smtp[uov]: 10.230.46.162 sBono loremqu accept quunt 3 siuta 1107 1.2607 dquia temporin +scan[nimveni]: idi[10.96.135.47] rum 1545434414 1545434414 accept eporroq ulla iqu oin 1 55 cingel modocon +reports: REPORTS (atv.exe) queued as onu +scan: obeataev[10.139.127.232] nsec 1547904323 1547904323 cancel maperi agnaaliq tlaboree norumet 7 48 tin SZ:fugitse SUBJ:imad +inbound/pass1: inv[10.163.209.70] atu 1549139277 1549139277 SCAN lloin remipsum tempor citatio 0 57 mveniamq SZ:taedict SUBJ:edquian +reports: REPORTS (mipsamvo.exe) queued as eiusmod +scan[avolu]: Except[10.191.7.121] umetMal 1551609186 1551609186 accept sciun metcons itasper uae 2 21 uia iciad +inbound/pass1: [10.157.196.101] gnaa 1552844140 1552844140 RECV mod doei cipitl +web: [10.171.72.5] global CHANGE eprehend (asnu) +scan: eritatis[10.209.184.60] mquisn 1555314049 1555314049 cancel uto emUte molestia quir 4 18 emip SZ:ver SUBJ:erc +inbound/pass1[dolorsit]: archite[10.143.228.97] isqua 1556549003 1556549003 RECV uta emo itq +reports: REPORTS (ntexpl.exe) queued as dunt +scan: plic[10.17.87.79] tetur 1559018911 1559018911 block amali ate idolor ratvolu 7 64 onse olorem +web: [10.163.18.29] FAILED_LOGIN (nim) +web: Retention violating accounts: erspi total +reports: REPORTS (billoi.exe) queued as moles +scan: taedi[10.17.98.243] etconsec 1563958728 1563958728 cancel ill mporinc onsectet idolo 8 55 docon SZ:mdolore SUBJ:eosquira +reports: REPORTS (apariatu.exe) queued as lorsita +reports: REPORTS (ever.exe) queued as tali +inbound/pass1[mipsumqu]: tatio[10.181.247.224] onnu 1567663591 1567663591 RECV olorema aquiof ende +scan[ugitse]: quiineav[10.235.116.121] ventore 1568898545 1568898545 deny obea emp agnaaliq est 0 73 aev SZ:inrepr SUBJ:mol +outbound/smtp: 10.178.30.158 llit tenimad sitametc allow onproide 2 cillumd riosa Ok: queued as tNe #to#10.1.6.115 +notify/smtp[rautod]: 10.124.32.120 lapar ritati accept qui 3 mullam 4965 1.4254 meaque uid +reports: REPORTS (ataevita.exe) queued as oremqu +reports: REPORTS (velitsed.exe) queued as magnaali +inbound/pass1: der[10.77.182.191] enbyCi 1575073317 1575073317 SCAN quameiu diduntu eiusmod itation 8 79 piciatis2460.api.host iusmodt +scan: iame[10.193.110.71] tiumd 1576308271 1576308271 accept loinve tanimid isnostru nofdeFi 3 5 saqu remips diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json new file mode 100644 index 00000000000..247344bdbfe --- /dev/null +++ b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json @@ -0,0 +1,3282 @@ +[ + { + "event.action": "accept", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[avolupt]: 10.224.15.48 nto sse accept tur 3 illumqui 1090 1.2364 ivelitse ritin", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 0, + "network.bytes": 1090, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2364", + "related.ip": [ + "10.224.15.48" + ], + "rsa.db.index": "ritin", + "rsa.email.email_src": "ivelitse", + "rsa.internal.messageid": "notify/smtp", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.log_session_id": "illumqui", + "rsa.misc.version": "1.2364", + "service.type": "barracuda", + "source.ip": [ + "10.224.15.48" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " SCAN", + "event.code": "ntsunti", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: etdo[10.173.228.223] ntsunti 1455282753 1455282753 SCAN nseq itinvol psa umq 0 31 psaq SZ:cer SUBJ:reveri", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 92, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.173.228.223" + ], + "rsa.email.email_dst": "psa", + "rsa.email.email_src": "itinvol", + "rsa.email.subject": "reveri", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Allowed Message", + "rsa.misc.reference_id": "ntsunti", + "rsa.misc.result": "Score", + "rsa.misc.result_code": "31", + "rsa.time.endtime": "2016-02-12T13:12:33.000Z", + "rsa.time.starttime": "2016-02-12T13:12:33.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.173.228.223" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "etdo" + }, + { + "event.action": "allow", + "event.code": "eosquir", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.104.162.169 eosquir orsi nulapari allow vol 4 uidolor nibus mipsumq <: enatus", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 213, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.104.162.169" + ], + "rsa.email.email_src": "gnaali", + "rsa.internal.event_desc": "enatus", + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Expired Message", + "rsa.misc.log_session_id": "uidolor", + "rsa.misc.reference_id": "eosquir", + "rsa.misc.result_code": "nibus", + "service.type": "barracuda", + "source.ip": [ + "10.104.162.169" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[iatu]: 10.57.70.73 dolo meumfug deny roinBCS 2 com 1060 1.2548 byC tinculp", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 317, + "network.bytes": 1060, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2548", + "related.ip": [ + "10.57.70.73" + ], + "rsa.db.index": "tinculp", + "rsa.email.email_src": "byC", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Rejected Message", + "rsa.misc.log_session_id": "com", + "rsa.misc.version": "1.2548", + "service.type": "barracuda", + "source.ip": [ + "10.57.70.73" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "tconsec", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.236.42.236 tconsec nsequat taev block untutl 1 llu uptassi tamremap tur", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 404, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.236.42.236" + ], + "rsa.internal.event_desc": "tur", + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.disposition": "Delivered Message", + "rsa.misc.log_session_id": "llu", + "rsa.misc.reference_id": "tconsec", + "rsa.misc.result_code": "uptassi", + "service.type": "barracuda", + "source.ip": [ + "10.236.42.236" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (enatuse.exe) queued as magn", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 494, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "enatuse.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " RECV", + "event.code": "laboreet", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[sit]: avol[10.162.151.94] laboreet 1461457525 1461457525 RECV aquaeabi giatq quid", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 540, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.162.151.94" + ], + "related.user": [ + "avol" + ], + "rsa.db.index": "quid", + "rsa.email.email_dst": "giatq", + "rsa.email.email_src": "aquaeabi", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "laboreet", + "rsa.time.endtime": "2016-04-24T00:25:25.000Z", + "rsa.time.starttime": "2016-04-24T00:25:25.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.162.151.94" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "avol" + }, + { + "event.action": " SCAN", + "event.code": "eip", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: tempor[10.138.137.28] eip 1462692479 1462692479 SCAN lupta iusmodt doloreeu pori 7 8 ect SZ:reetdolo SUBJ:nrepreh", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 636, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.138.137.28" + ], + "rsa.email.email_dst": "doloreeu", + "rsa.email.email_src": "iusmodt", + "rsa.email.subject": "nrepreh", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Whitelisted Message", + "rsa.misc.reference_id": "eip", + "rsa.misc.result": "No Such User", + "rsa.misc.result_code": "8", + "rsa.time.endtime": "2016-05-08T07:27:59.000Z", + "rsa.time.starttime": "2016-05-08T07:27:59.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.138.137.28" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "tempor" + }, + { + "event.action": "block", + "event.code": "nsequat", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: ari[10.108.180.105] nsequat 1463927433 1463927433 block llam llamcorp ari eataevit 4 38 uovol dmi", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 765, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.108.180.105" + ], + "rsa.db.index": "dmi", + "rsa.email.email_dst": "ari", + "rsa.email.email_src": "llamcorp", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.disposition": "Tagged Message", + "rsa.misc.reference_id": "nsequat", + "rsa.misc.result": "Message Size Bypass", + "rsa.misc.result_code": "38", + "rsa.time.endtime": "2016-05-22T14:30:33.000Z", + "rsa.time.starttime": "2016-05-22T14:30:33.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.108.180.105" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "ari" + }, + { + "event.action": " RECV", + "event.code": "ididu", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.206.159.177] ididu 1465162388 1465162388 RECV ciunt turQuisa 10 74 lit", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 869, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.206.159.177" + ], + "rsa.db.index": "lit", + "rsa.email.email_dst": "turQuisa", + "rsa.email.email_src": "ciunt", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.disposition": "Attachments Stubbed", + "rsa.misc.reference_id": "ididu", + "rsa.misc.result": "BRTS Intent", + "rsa.misc.result_code": "74", + "rsa.time.endtime": "2016-06-05T21:33:08.000Z", + "rsa.time.starttime": "2016-06-05T21:33:08.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.206.159.177" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.action": " RECV", + "event.code": "reetdolo", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[umdo]: sed[10.206.224.241] reetdolo 1466397342 1466397342 RECV olupta turveli 4 40 tatno", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 959, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.206.224.241" + ], + "related.user": [ + "sed" + ], + "rsa.db.index": "tatno", + "rsa.email.email_dst": "turveli", + "rsa.email.email_src": "olupta", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.disposition": "Tagged Message", + "rsa.misc.reference_id": "reetdolo", + "rsa.misc.result": "SPF/Caller-ID", + "rsa.misc.result_code": "40", + "rsa.time.endtime": "2016-06-20T04:35:42.000Z", + "rsa.time.starttime": "2016-06-20T04:35:42.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.206.224.241" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "sed" + }, + { + "event.action": " SCAN", + "event.code": "essequ", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: aveniam[10.82.201.113] essequ 1467632296 1467632296 SCAN taevi ender snulapar aedic 5 13 iumto SZ:aboreetd SUBJ:sun", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1062, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.82.201.113" + ], + "rsa.email.email_dst": "snulapar", + "rsa.email.email_src": "ender", + "rsa.email.subject": "sun", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.reference_id": "essequ", + "rsa.misc.result": "No Valid Recipients", + "rsa.misc.result_code": "13", + "rsa.time.endtime": "2016-07-04T11:38:16.000Z", + "rsa.time.starttime": "2016-07-04T11:38:16.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.82.201.113" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "aveniam" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (tem.exe) queued as ons", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1193, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "tem.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.18.165.35" + ], + "event.action": "accept", + "event.code": "ittenbyC", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.110.109.5 ittenbyC aperi lor accept ipi 4 paqu eseru remeum #to#10.18.165.35", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1234, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.110.109.5", + "10.18.165.35" + ], + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Expired Message", + "rsa.misc.log_session_id": "paqu", + "rsa.misc.reference_id": "ittenbyC", + "rsa.misc.result_code": "eseru", + "service.type": "barracuda", + "source.ip": [ + "10.110.109.5" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "eddoei", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: dolore[10.195.109.134] eddoei 1471337159 1471337159 deny etM nimadmin ditautfu piscing 6 74 ostr rudexerc", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1329, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.195.109.134" + ], + "rsa.db.index": "rudexerc", + "rsa.email.email_dst": "ditautfu", + "rsa.email.email_src": "nimadmin", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Per-User Quarantined Message", + "rsa.misc.reference_id": "eddoei", + "rsa.misc.result": "BRTS Intent", + "rsa.misc.result_code": "74", + "rsa.time.endtime": "2016-08-16T08:45:59.000Z", + "rsa.time.starttime": "2016-08-16T08:45:59.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.195.109.134" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "dolore" + }, + { + "event.action": "accept", + "event.code": "lorumw", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[colabor]: iusmodt[10.21.92.218] lorumw 1472572113 1472572113 accept llitani inima tlabo suntexp 4 45 stiae SZ:nofdeF SUBJ:sunt", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1441, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.21.92.218" + ], + "related.user": [ + "iusmodt" + ], + "rsa.email.email_dst": "tlabo", + "rsa.email.email_src": "inima", + "rsa.email.subject": "sunt", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Tagged Message", + "rsa.misc.reference_id": "lorumw", + "rsa.misc.result": "Allowed Message Size Exceeded", + "rsa.misc.result_code": "45", + "rsa.time.endtime": "2016-08-30T15:48:33.000Z", + "rsa.time.starttime": "2016-08-30T15:48:33.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.21.92.218" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "iusmodt" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (tat.exe) queued as tion", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1573, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "tat.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (emp.exe) queued as aperia", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1615, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "emp.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: Ret Policy Summary (Del:eritquii Kept:dexeac)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1659, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "rsa.internal.messageid": "web", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "LOGOUT", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.45.25.68] LOGOUT (rehender)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1710, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.45.25.68" + ], + "related.user": [ + "rehender" + ], + "rsa.internal.messageid": "web", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "LOGOUT" + ], + "service.type": "barracuda", + "source.ip": [ + "10.45.25.68" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "rehender" + }, + { + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: Ret Policy Summary (Del:hil Kept:atquovo)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1747, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "rsa.internal.messageid": "web", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[tatn]: 10.18.109.121 ents pida allow idolor 1 emoeni 269 1.2857 utlabore ecillu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1794, + "network.bytes": 269, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2857", + "related.ip": [ + "10.18.109.121" + ], + "rsa.db.index": "ecillu", + "rsa.email.email_src": "utlabore", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Delivered Message", + "rsa.misc.log_session_id": "emoeni", + "rsa.misc.version": "1.2857", + "service.type": "barracuda", + "source.ip": [ + "10.18.109.121" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "CHANGE", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.19.194.101] global CHANGE orinrepr (conse)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1886, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.19.194.101" + ], + "rsa.db.index": "conse", + "rsa.internal.messageid": "web", + "rsa.misc.action": [ + "CHANGE" + ], + "rsa.misc.category": "orinrepr", + "service.type": "barracuda", + "source.ip": [ + "10.19.194.101" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (lumqui.exe) queued as itinvo", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1938, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "lumqui.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (usmodt.exe) queued as siar", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 1985, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "usmodt.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[sci]: 10.116.193.182 snostrud nama allow data 1 ationul 2530 1.5361 commod adol", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2030, + "network.bytes": 2530, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.5361", + "related.ip": [ + "10.116.193.182" + ], + "rsa.db.index": "adol", + "rsa.email.email_src": "commod", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Delivered Message", + "rsa.misc.log_session_id": "ationul", + "rsa.misc.version": "1.5361", + "service.type": "barracuda", + "source.ip": [ + "10.116.193.182" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " SCAN", + "event.code": "modocon", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: hitect[10.198.6.166] modocon 1486156610 1486156610 SCAN que atevel nsecte itame 0 38 lit5929.test quamnih", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2122, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.198.6.166" + ], + "rsa.db.index": "quamnih", + "rsa.email.email_dst": "nsecte", + "rsa.email.email_src": "atevel", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Allowed Message", + "rsa.misc.reference_id": "modocon", + "rsa.misc.result": "Message Size Bypass", + "rsa.misc.result_code": "38", + "rsa.network.domain": "lit5929.test", + "rsa.time.endtime": "2017-02-03T21:16:50.000Z", + "rsa.time.starttime": "2017-02-03T21:16:50.000Z", + "server.domain": "lit5929.test", + "service.type": "barracuda", + "source.ip": [ + "10.198.6.166" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "hitect" + }, + { + "event.action": "accept", + "event.code": "aquaeabi", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.198.19.111 aquaeabi lita adeseru accept amc 4 amest corp modtemp <: iae", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2243, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.198.19.111" + ], + "rsa.email.email_src": "rehender", + "rsa.internal.event_desc": "iae", + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Expired Message", + "rsa.misc.log_session_id": "amest", + "rsa.misc.reference_id": "aquaeabi", + "rsa.misc.result_code": "corp", + "service.type": "barracuda", + "source.ip": [ + "10.198.19.111" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " SCAN", + "event.code": "ione", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: equat[10.77.137.72] ione 1488626519 1488626519 SCAN ihilmole eriamea amre rsita 8 56 uptat3156.www5.test tmo", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2343, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.77.137.72" + ], + "rsa.db.index": "tmo", + "rsa.email.email_dst": "amre", + "rsa.email.email_src": "eriamea", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Encrypted Message", + "rsa.misc.reference_id": "ione", + "rsa.misc.result": "STARTTLS Syntax Error", + "rsa.misc.result_code": "56", + "rsa.network.domain": "uptat3156.www5.test", + "rsa.time.endtime": "2017-03-04T11:21:59.000Z", + "rsa.time.starttime": "2017-03-04T11:21:59.000Z", + "server.domain": "uptat3156.www5.test", + "service.type": "barracuda", + "source.ip": [ + "10.77.137.72" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "equat" + }, + { + "event.action": " SCAN", + "event.code": "temqu", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: vitaedi[10.128.114.77] temqu 1489861473 1489861473 SCAN edol colab ommodico quatD 4 59 neav6028.internal.domain agnid", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2467, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.128.114.77" + ], + "rsa.db.index": "agnid", + "rsa.email.email_dst": "ommodico", + "rsa.email.email_src": "colab", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Tagged Message", + "rsa.misc.reference_id": "temqu", + "rsa.misc.result": "Need STARTTLS First", + "rsa.misc.result_code": "59", + "rsa.network.domain": "neav6028.internal.domain", + "rsa.time.endtime": "2017-03-18T18:24:33.000Z", + "rsa.time.starttime": "2017-03-18T18:24:33.000Z", + "server.domain": "neav6028.internal.domain", + "service.type": "barracuda", + "source.ip": [ + "10.128.114.77" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "vitaedi" + }, + { + "event.action": "allow", + "event.code": "hitecto", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.181.80.139 hitecto ents liquide allow tenatu 1 boN eprehend aevit aboN", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2600, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.181.80.139" + ], + "rsa.internal.event_desc": "aboN", + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Delivered Message", + "rsa.misc.log_session_id": "boN", + "rsa.misc.reference_id": "hitecto", + "rsa.misc.result_code": "eprehend", + "service.type": "barracuda", + "source.ip": [ + "10.181.80.139" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " RECV", + "event.code": "quioffi", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[ris]: uamqu[10.138.252.123] quioffi 1492331381 1492331381 RECV uptate ncidid quaturve", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2689, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.138.252.123" + ], + "related.user": [ + "uamqu" + ], + "rsa.db.index": "quaturve", + "rsa.email.email_dst": "ncidid", + "rsa.email.email_src": "uptate", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "quioffi", + "rsa.time.endtime": "2017-04-16T08:29:41.000Z", + "rsa.time.starttime": "2017-04-16T08:29:41.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.138.252.123" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "uamqu" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (aera.exe) queued as ate", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2789, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "aera.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " RECV", + "event.code": "uir", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.153.108.27] uir 1494801290 1494801290 RECV dol essecil citation", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2831, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.153.108.27" + ], + "rsa.db.index": "citation", + "rsa.email.email_dst": "essecil", + "rsa.email.email_src": "dol", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "uir", + "rsa.time.endtime": "2017-05-14T22:34:50.000Z", + "rsa.time.starttime": "2017-05-14T22:34:50.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.153.108.27" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.action": "deny", + "event.code": "gnido", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.120.167.239 gnido ratvolu olup deny nsecte 3 eveli eroi dtemp aliquide", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 2914, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.120.167.239" + ], + "rsa.internal.event_desc": "aliquide", + "rsa.internal.messageid": "outbound/smtp", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.log_session_id": "eveli", + "rsa.misc.reference_id": "gnido", + "rsa.misc.result_code": "eroi", + "service.type": "barracuda", + "source.ip": [ + "10.120.167.239" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " RECV", + "event.code": "ecte", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[ris]: nisi[10.105.88.20] ecte 1497271198 1497271198 RECV tinvolu iurer iciadese", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3003, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.105.88.20" + ], + "related.user": [ + "nisi" + ], + "rsa.db.index": "iciadese", + "rsa.email.email_dst": "iurer", + "rsa.email.email_src": "tinvolu", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "ecte", + "rsa.time.endtime": "2017-06-12T12:39:58.000Z", + "rsa.time.starttime": "2017-06-12T12:39:58.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.105.88.20" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "nisi" + }, + { + "event.action": "deny", + "event.code": "idolor", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: olupta[10.98.92.244] idolor 1498506153 1498506153 deny uta llumdolo nre ercitat 7 38 riosamn SZ:ept SUBJ:iumtotam", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3097, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.98.92.244" + ], + "rsa.email.email_dst": "nre", + "rsa.email.email_src": "llumdolo", + "rsa.email.subject": "iumtotam", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Whitelisted Message", + "rsa.misc.reference_id": "idolor", + "rsa.misc.result": "Message Size Bypass", + "rsa.misc.result_code": "38", + "rsa.time.endtime": "2017-06-26T19:42:33.000Z", + "rsa.time.starttime": "2017-06-26T19:42:33.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.98.92.244" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "olupta" + }, + { + "event.action": "allow", + "event.code": "tDuisaut", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[sperna]: sintocc[10.185.107.75] tDuisaut 1499741107 1499741107 allow tate imvenia spi stquido 8 62 ptas SZ:pta SUBJ:tetu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3217, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.185.107.75" + ], + "related.user": [ + "sintocc" + ], + "rsa.email.email_dst": "spi", + "rsa.email.email_src": "imvenia", + "rsa.email.subject": "tetu", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Encrypted Message", + "rsa.misc.reference_id": "tDuisaut", + "rsa.misc.result": "Barracuda Reputation Blocklist", + "rsa.misc.result_code": "62", + "rsa.time.endtime": "2017-07-11T02:45:07.000Z", + "rsa.time.starttime": "2017-07-11T02:45:07.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.185.107.75" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "sintocc" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (nevo.exe) queued as ide", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3343, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "nevo.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[etcons]: 10.80.214.206 ate uiac accept officiad 4 quinesc 6218 1.5651 tur roi", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3385, + "network.bytes": 6218, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.5651", + "related.ip": [ + "10.80.214.206" + ], + "rsa.db.index": "roi", + "rsa.email.email_src": "tur", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Expired Message", + "rsa.misc.log_session_id": "quinesc", + "rsa.misc.version": "1.5651", + "service.type": "barracuda", + "source.ip": [ + "10.80.214.206" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[nof]: 10.48.34.226 ccaec ten allow isc 2 ntN 6179 1.2364 tateve itinvol", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3475, + "network.bytes": 6179, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2364", + "related.ip": [ + "10.48.34.226" + ], + "rsa.db.index": "itinvol", + "rsa.email.email_src": "tateve", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Rejected Message", + "rsa.misc.log_session_id": "ntN", + "rsa.misc.version": "1.2364", + "service.type": "barracuda", + "source.ip": [ + "10.48.34.226" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (etconsec.exe) queued as ios", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3559, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "etconsec.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " SCAN", + "event.code": "mod", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: tquov[10.211.93.62] mod 1505915878 1505915878 SCAN hilm ataevi com tnulapa 5 57 tiumt SZ:reetdolo SUBJ:norum", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3605, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.211.93.62" + ], + "rsa.email.email_dst": "com", + "rsa.email.email_src": "ataevi", + "rsa.email.subject": "norum", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.reference_id": "mod", + "rsa.misc.result": "TLS Already Active", + "rsa.misc.result_code": "57", + "rsa.time.endtime": "2017-09-20T13:57:58.000Z", + "rsa.time.starttime": "2017-09-20T13:57:58.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.211.93.62" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "tquov" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (uidol.exe) queued as mporin", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3729, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "uidol.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "entor", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: qui[10.199.182.123] entor 1508385787 1508385787 accept Sedutp utp ema rsitv 0 69 ntiumt iquipe", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3775, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.199.182.123" + ], + "rsa.db.index": "iquipe", + "rsa.email.email_dst": "ema", + "rsa.email.email_src": "utp", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Allowed Message", + "rsa.misc.reference_id": "entor", + "rsa.misc.result": "Intent - Adult", + "rsa.misc.result_code": "69", + "rsa.time.endtime": "2017-10-19T04:03:07.000Z", + "rsa.time.starttime": "2017-10-19T04:03:07.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.199.182.123" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "qui" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (tvolupt.exe) queued as eufugi", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3876, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "tvolupt.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "uamni", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[pid]: illoin[10.130.38.118] uamni 1510855695 1510855695 block gnamal metMalo ntexplic archite 1 56 untu asi", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 3924, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.130.38.118" + ], + "related.user": [ + "illoin" + ], + "rsa.db.index": "asi", + "rsa.email.email_dst": "ntexplic", + "rsa.email.email_src": "metMalo", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.disposition": "Aborted Message", + "rsa.misc.reference_id": "uamni", + "rsa.misc.result": "STARTTLS Syntax Error", + "rsa.misc.result_code": "56", + "rsa.time.endtime": "2017-11-16T18:08:15.000Z", + "rsa.time.starttime": "2017-11-16T18:08:15.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.130.38.118" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "illoin" + }, + { + "event.action": " RECV", + "event.code": "eumiu", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.153.152.219] eumiu 1512090649 1512090649 RECV orumSe boree intoc", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4037, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.153.152.219" + ], + "rsa.db.index": "intoc", + "rsa.email.email_dst": "boree", + "rsa.email.email_src": "orumSe", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "eumiu", + "rsa.time.endtime": "2017-12-01T01:10:49.000Z", + "rsa.time.starttime": "2017-12-01T01:10:49.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.153.152.219" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: Retention violating accounts: rnatur total", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4121, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "rsa.internal.messageid": "web", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (isisten.exe) queued as cusant", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4169, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "isisten.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (naal.exe) queued as borios", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4217, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "naal.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "tali", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.167.227.44 tali lillum cusant deny ender 2 oles edic seq tutlab", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4262, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.167.227.44" + ], + "rsa.internal.event_desc": "tutlab", + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Rejected Message", + "rsa.misc.log_session_id": "oles", + "rsa.misc.reference_id": "tali", + "rsa.misc.result_code": "edic", + "service.type": "barracuda", + "source.ip": [ + "10.167.227.44" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[atevelit]: 10.56.136.27 aperia ccaeca deny ttenby 1 amc 5163 1.375 orumSe ratv", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4344, + "network.bytes": 5163, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.375", + "related.ip": [ + "10.56.136.27" + ], + "rsa.db.index": "ratv", + "rsa.email.email_src": "orumSe", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Delivered Message", + "rsa.misc.log_session_id": "amc", + "rsa.misc.version": "1.375", + "service.type": "barracuda", + "source.ip": [ + "10.56.136.27" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "FAILED_LOGIN", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.194.90.130] FAILED_LOGIN (siut)", + "event.outcome": "failure", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4435, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.194.90.130" + ], + "related.user": [ + "siut" + ], + "rsa.internal.messageid": "web", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "FAILED_LOGIN" + ], + "service.type": "barracuda", + "source.ip": [ + "10.194.90.130" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "siut" + }, + { + "event.action": " RECV", + "event.code": "velitess", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.103.69.44] velitess 1520735329 1520735329 RECV naali uunturm temUte", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4476, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.103.69.44" + ], + "rsa.db.index": "temUte", + "rsa.email.email_dst": "uunturm", + "rsa.email.email_src": "naali", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "velitess", + "rsa.time.endtime": "2018-03-11T02:28:49.000Z", + "rsa.time.starttime": "2018-03-11T02:28:49.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.103.69.44" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.action": " SCAN", + "event.code": "uptatema", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: aveni[10.29.155.171] uptatema 1521970284 1521970284 SCAN oeni tdol sit tiaec 6 23 oremagna3521.mail.home asiar", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4563, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.29.155.171" + ], + "rsa.db.index": "asiar", + "rsa.email.email_dst": "sit", + "rsa.email.email_src": "tdol", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Per-User Quarantined Message", + "rsa.misc.reference_id": "uptatema", + "rsa.misc.result": "Send EHLO/HELO First", + "rsa.misc.result_code": "23", + "rsa.network.domain": "oremagna3521.mail.home", + "rsa.time.endtime": "2018-03-25T09:31:24.000Z", + "rsa.time.starttime": "2018-03-25T09:31:24.000Z", + "server.domain": "oremagna3521.mail.home", + "service.type": "barracuda", + "source.ip": [ + "10.29.155.171" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "aveni" + }, + { + "event.action": " RECV", + "event.code": "nonp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.145.193.93] nonp 1523205238 1523205238 RECV labo ulapar aboreetd", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4689, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.145.193.93" + ], + "rsa.db.index": "aboreetd", + "rsa.email.email_dst": "ulapar", + "rsa.email.email_src": "labo", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "nonp", + "rsa.time.endtime": "2018-04-08T16:33:58.000Z", + "rsa.time.starttime": "2018-04-08T16:33:58.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.145.193.93" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.action": " RECV", + "event.code": "exeacom", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[ama]: uatur[10.143.79.226] exeacom 1524440192 1524440192 RECV roidents tem dol", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4773, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.143.79.226" + ], + "related.user": [ + "uatur" + ], + "rsa.db.index": "dol", + "rsa.email.email_dst": "tem", + "rsa.email.email_src": "roidents", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "exeacom", + "rsa.time.endtime": "2018-04-22T23:36:32.000Z", + "rsa.time.starttime": "2018-04-22T23:36:32.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.143.79.226" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "uatur" + }, + { + "event.action": "FAILED_LOGIN", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.30.25.84] FAILED_LOGIN (utlab)", + "event.outcome": "failure", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4866, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.30.25.84" + ], + "related.user": [ + "utlab" + ], + "rsa.internal.messageid": "web", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "FAILED_LOGIN" + ], + "service.type": "barracuda", + "source.ip": [ + "10.30.25.84" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "utlab" + }, + { + "event.action": " RECV", + "event.code": "bor", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.141.225.182] bor 1526910101 1526910101 RECV rauto ationev 8 57 uaUten", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4906, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.141.225.182" + ], + "rsa.db.index": "uaUten", + "rsa.email.email_dst": "ationev", + "rsa.email.email_src": "rauto", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.disposition": "Encrypted Message", + "rsa.misc.reference_id": "bor", + "rsa.misc.result": "TLS Already Active", + "rsa.misc.result_code": "57", + "rsa.time.endtime": "2018-05-21T13:41:41.000Z", + "rsa.time.starttime": "2018-05-21T13:41:41.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.141.225.182" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (dun.exe) queued as reprehe", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 4995, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "dun.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "CHANGE", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.90.9.88] global CHANGE umexerc (oremipsu)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5040, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.90.9.88" + ], + "rsa.db.index": "oremipsu", + "rsa.internal.messageid": "web", + "rsa.misc.action": [ + "CHANGE" + ], + "rsa.misc.category": "umexerc", + "service.type": "barracuda", + "source.ip": [ + "10.90.9.88" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (amco.exe) queued as ssecillu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5091, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "amco.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (olo.exe) queued as psumqu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5138, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "olo.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[rationev]: 10.226.20.199 tatem untutlab allow eveli 2 lillum 7809 1.2000 uisaute imide", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5182, + "network.bytes": 7809, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2000", + "related.ip": [ + "10.226.20.199" + ], + "rsa.db.index": "imide", + "rsa.email.email_src": "uisaute", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Rejected Message", + "rsa.misc.log_session_id": "lillum", + "rsa.misc.version": "1.2000", + "service.type": "barracuda", + "source.ip": [ + "10.226.20.199" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "CHANGE", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.134.140.191] global CHANGE nte (mvel)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5281, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.134.140.191" + ], + "rsa.db.index": "mvel", + "rsa.internal.messageid": "web", + "rsa.misc.action": [ + "CHANGE" + ], + "rsa.misc.category": "nte", + "service.type": "barracuda", + "source.ip": [ + "10.134.140.191" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "nimadmin", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp[conse]: 10.252.40.172 nimadmin isiu licabo cancel etdolor 3 dic cola amcor", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5328, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.252.40.172" + ], + "rsa.db.index": "amcor", + "rsa.internal.messageid": "outbound/smtp", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.log_session_id": "dic", + "rsa.misc.reference_id": "nimadmin", + "rsa.misc.result_code": "cola", + "service.type": "barracuda", + "source.ip": [ + "10.252.40.172" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "nisiut", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[xea]: ites[10.126.26.131] nisiut 1536789735 1536789735 accept teturad perspici itation sequatD 5 24 isciv rroqu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5417, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.126.26.131" + ], + "related.user": [ + "ites" + ], + "rsa.db.index": "rroqu", + "rsa.email.email_dst": "itation", + "rsa.email.email_src": "perspici", + "rsa.internal.messageid": "scan", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.reference_id": "nisiut", + "rsa.misc.result": "Need MAIL Command", + "rsa.misc.result_code": "24", + "rsa.time.endtime": "2018-09-12T22:02:15.000Z", + "rsa.time.starttime": "2018-09-12T22:02:15.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.126.26.131" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "ites" + }, + { + "event.action": "accept", + "event.code": "reetd", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[rExc]: iusmo[10.187.210.173] reetd 1538024689 1538024689 accept ulpa sitam rad loi 2 15 Nequepor SZ:eirure SUBJ:deserun", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5534, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.187.210.173" + ], + "related.user": [ + "iusmo" + ], + "rsa.email.email_dst": "rad", + "rsa.email.email_src": "sitam", + "rsa.email.subject": "deserun", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Blocked Message", + "rsa.misc.reference_id": "reetd", + "rsa.misc.result": "Sender Address", + "rsa.misc.result_code": "15", + "rsa.time.endtime": "2018-09-27T05:04:49.000Z", + "rsa.time.starttime": "2018-09-27T05:04:49.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.187.210.173" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "iusmo" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (orroq.exe) queued as vitaedic", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5659, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "orroq.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (orem.exe) queued as rcit", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5707, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "orem.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "atise", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[untincul]: ssecil[10.180.147.129] atise 1541729552 1541729552 allow umetMalo oluptas emvele isnost 2 5 ido emqu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5750, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.180.147.129" + ], + "related.user": [ + "ssecil" + ], + "rsa.db.index": "emqu", + "rsa.email.email_dst": "emvele", + "rsa.email.email_src": "oluptas", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Blocked Message", + "rsa.misc.reference_id": "atise", + "rsa.misc.result": "Too Many Message In Session", + "rsa.misc.result_code": "5", + "rsa.time.endtime": "2018-11-09T02:12:32.000Z", + "rsa.time.starttime": "2018-11-09T02:12:32.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.180.147.129" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "ssecil" + }, + { + "event.action": "cancel", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[exeaco]: 10.99.17.210 olorsit tore cancel illu 4 turadip 688 1.7484 boreetdo undeom", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5867, + "network.bytes": 688, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.7484", + "related.ip": [ + "10.99.17.210" + ], + "rsa.db.index": "undeom", + "rsa.email.email_src": "boreetdo", + "rsa.internal.messageid": "notify/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.disposition": "Expired Message", + "rsa.misc.log_session_id": "turadip", + "rsa.misc.version": "1.7484", + "service.type": "barracuda", + "source.ip": [ + "10.99.17.210" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[uov]: 10.230.46.162 sBono loremqu accept quunt 3 siuta 1107 1.2607 dquia temporin", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 5963, + "network.bytes": 1107, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.2607", + "related.ip": [ + "10.230.46.162" + ], + "rsa.db.index": "temporin", + "rsa.email.email_src": "dquia", + "rsa.internal.messageid": "notify/smtp", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.log_session_id": "siuta", + "rsa.misc.version": "1.2607", + "service.type": "barracuda", + "source.ip": [ + "10.230.46.162" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "rum", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[nimveni]: idi[10.96.135.47] rum 1545434414 1545434414 accept eporroq ulla iqu oin 1 55 cingel modocon", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6057, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.96.135.47" + ], + "related.user": [ + "idi" + ], + "rsa.db.index": "modocon", + "rsa.email.email_dst": "iqu", + "rsa.email.email_src": "ulla", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Aborted Message", + "rsa.misc.reference_id": "rum", + "rsa.misc.result": "Invalid Parameter Syntax", + "rsa.misc.result_code": "55", + "rsa.time.endtime": "2018-12-21T23:20:14.000Z", + "rsa.time.starttime": "2018-12-21T23:20:14.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.96.135.47" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "idi" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (atv.exe) queued as onu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6164, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "atv.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "nsec", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: obeataev[10.139.127.232] nsec 1547904323 1547904323 cancel maperi agnaaliq tlaboree norumet 7 48 tin SZ:fugitse SUBJ:imad", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6205, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.139.127.232" + ], + "rsa.email.email_dst": "tlaboree", + "rsa.email.email_src": "agnaaliq", + "rsa.email.subject": "imad", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.disposition": "Whitelisted Message", + "rsa.misc.reference_id": "nsec", + "rsa.misc.result": "DATA Syntax Error", + "rsa.misc.result_code": "48", + "rsa.time.endtime": "2019-01-19T13:25:23.000Z", + "rsa.time.starttime": "2019-01-19T13:25:23.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.139.127.232" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "obeataev" + }, + { + "event.action": " SCAN", + "event.code": "atu", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: inv[10.163.209.70] atu 1549139277 1549139277 SCAN lloin remipsum tempor citatio 0 57 mveniamq SZ:taedict SUBJ:edquian", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6333, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.163.209.70" + ], + "rsa.email.email_dst": "tempor", + "rsa.email.email_src": "remipsum", + "rsa.email.subject": "edquian", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Allowed Message", + "rsa.misc.reference_id": "atu", + "rsa.misc.result": "TLS Already Active", + "rsa.misc.result_code": "57", + "rsa.time.endtime": "2019-02-02T20:27:57.000Z", + "rsa.time.starttime": "2019-02-02T20:27:57.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.163.209.70" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "inv" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (mipsamvo.exe) queued as eiusmod", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6466, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "mipsamvo.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "umetMal", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[avolu]: Except[10.191.7.121] umetMal 1551609186 1551609186 accept sciun metcons itasper uae 2 21 uia iciad", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6516, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.191.7.121" + ], + "related.user": [ + "Except" + ], + "rsa.db.index": "iciad", + "rsa.email.email_dst": "itasper", + "rsa.email.email_src": "metcons", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Blocked Message", + "rsa.misc.reference_id": "umetMal", + "rsa.misc.result": "Bad Address Syntax", + "rsa.misc.result_code": "21", + "rsa.time.endtime": "2019-03-03T10:33:06.000Z", + "rsa.time.starttime": "2019-03-03T10:33:06.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.191.7.121" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "Except" + }, + { + "event.action": " RECV", + "event.code": "gnaa", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: [10.157.196.101] gnaa 1552844140 1552844140 RECV mod doei cipitl", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6628, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.157.196.101" + ], + "rsa.db.index": "cipitl", + "rsa.email.email_dst": "doei", + "rsa.email.email_src": "mod", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "gnaa", + "rsa.time.endtime": "2019-03-17T17:35:40.000Z", + "rsa.time.starttime": "2019-03-17T17:35:40.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.157.196.101" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "" + }, + { + "event.action": "CHANGE", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.171.72.5] global CHANGE eprehend (asnu)", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6708, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.171.72.5" + ], + "rsa.db.index": "asnu", + "rsa.internal.messageid": "web", + "rsa.misc.action": [ + "CHANGE" + ], + "rsa.misc.category": "eprehend", + "service.type": "barracuda", + "source.ip": [ + "10.171.72.5" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "mquisn", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: eritatis[10.209.184.60] mquisn 1555314049 1555314049 cancel uto emUte molestia quir 4 18 emip SZ:ver SUBJ:erc", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6757, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.209.184.60" + ], + "rsa.email.email_dst": "molestia", + "rsa.email.email_src": "emUte", + "rsa.email.subject": "erc", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.disposition": "Tagged Message", + "rsa.misc.reference_id": "mquisn", + "rsa.misc.result": "Need Fully Qualified Sender", + "rsa.misc.result_code": "18", + "rsa.time.endtime": "2019-04-15T07:40:49.000Z", + "rsa.time.starttime": "2019-04-15T07:40:49.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.209.184.60" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "eritatis" + }, + { + "event.action": " RECV", + "event.code": "isqua", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[dolorsit]: archite[10.143.228.97] isqua 1556549003 1556549003 RECV uta emo itq", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6873, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.143.228.97" + ], + "related.user": [ + "archite" + ], + "rsa.db.index": "itq", + "rsa.email.email_dst": "emo", + "rsa.email.email_src": "uta", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "isqua", + "rsa.time.endtime": "2019-04-29T14:43:23.000Z", + "rsa.time.starttime": "2019-04-29T14:43:23.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.143.228.97" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "archite" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (ntexpl.exe) queued as dunt", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 6966, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "ntexpl.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "tetur", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: plic[10.17.87.79] tetur 1559018911 1559018911 block amali ate idolor ratvolu 7 64 onse olorem", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7011, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.17.87.79" + ], + "rsa.db.index": "olorem", + "rsa.email.email_dst": "idolor", + "rsa.email.email_src": "ate", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.disposition": "Whitelisted Message", + "rsa.misc.reference_id": "tetur", + "rsa.misc.result": "Recipient Verification Unavailable", + "rsa.misc.result_code": "64", + "rsa.time.endtime": "2019-05-28T04:48:31.000Z", + "rsa.time.starttime": "2019-05-28T04:48:31.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.17.87.79" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "plic" + }, + { + "event.action": "FAILED_LOGIN", + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: [10.163.18.29] FAILED_LOGIN (nim)", + "event.outcome": "failure", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7111, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.163.18.29" + ], + "related.user": [ + "nim" + ], + "rsa.internal.messageid": "web", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "FAILED_LOGIN" + ], + "service.type": "barracuda", + "source.ip": [ + "10.163.18.29" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "nim" + }, + { + "event.code": "web", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "web: Retention violating accounts: erspi total", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7150, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "rsa.internal.messageid": "web", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (billoi.exe) queued as moles", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7197, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "billoi.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "etconsec", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: taedi[10.17.98.243] etconsec 1563958728 1563958728 cancel ill mporinc onsectet idolo 8 55 docon SZ:mdolore SUBJ:eosquira", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7243, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.17.98.243" + ], + "rsa.email.email_dst": "onsectet", + "rsa.email.email_src": "mporinc", + "rsa.email.subject": "eosquira", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.disposition": "Encrypted Message", + "rsa.misc.reference_id": "etconsec", + "rsa.misc.result": "Invalid Parameter Syntax", + "rsa.misc.result_code": "55", + "rsa.time.endtime": "2019-07-24T08:58:48.000Z", + "rsa.time.starttime": "2019-07-24T08:58:48.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.17.98.243" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "taedi" + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (apariatu.exe) queued as lorsita", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7370, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "apariatu.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (ever.exe) queued as tali", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7420, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "ever.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " RECV", + "event.code": "onnu", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1[mipsumqu]: tatio[10.181.247.224] onnu 1567663591 1567663591 RECV olorema aquiof ende", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7463, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.181.247.224" + ], + "related.user": [ + "tatio" + ], + "rsa.db.index": "ende", + "rsa.email.email_dst": "aquiof", + "rsa.email.email_src": "olorema", + "rsa.internal.messageid": "inbound/pass1", + "rsa.misc.action": [ + " RECV" + ], + "rsa.misc.reference_id": "onnu", + "rsa.time.endtime": "2019-09-05T06:06:31.000Z", + "rsa.time.starttime": "2019-09-05T06:06:31.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.181.247.224" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "tatio" + }, + { + "event.action": "deny", + "event.code": "ventore", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan[ugitse]: quiineav[10.235.116.121] ventore 1568898545 1568898545 deny obea emp agnaaliq est 0 73 aev SZ:inrepr SUBJ:mol", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7562, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.235.116.121" + ], + "related.user": [ + "quiineav" + ], + "rsa.email.email_dst": "agnaaliq", + "rsa.email.email_src": "emp", + "rsa.email.subject": "mol", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "Allowed Message", + "rsa.misc.reference_id": "ventore", + "rsa.misc.result": "System Busy", + "rsa.misc.result_code": "73", + "rsa.time.endtime": "2019-09-19T13:09:05.000Z", + "rsa.time.starttime": "2019-09-19T13:09:05.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.235.116.121" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "user.name": "quiineav" + }, + { + "destination.ip": [ + "10.1.6.115" + ], + "event.action": "allow", + "event.code": "llit", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "outbound/smtp: 10.178.30.158 llit tenimad sitametc allow onproide 2 cillumd riosa Ok: queued as tNe #to#10.1.6.115", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7686, + "network.direction": "outbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.1.6.115", + "10.178.30.158" + ], + "rsa.internal.messageid": "outbound/smtp", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "Rejected Message", + "rsa.misc.log_session_id": "cillumd", + "rsa.misc.reference_id": "llit", + "rsa.misc.result_code": "riosa", + "service.type": "barracuda", + "source.ip": [ + "10.178.30.158" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "notify/smtp", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "notify/smtp[rautod]: 10.124.32.120 lapar ritati accept qui 3 mullam 4965 1.4254 meaque uid", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7801, + "network.bytes": 4965, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "observer.version": "1.4254", + "related.ip": [ + "10.124.32.120" + ], + "rsa.db.index": "uid", + "rsa.email.email_src": "meaque", + "rsa.internal.messageid": "notify/smtp", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.log_session_id": "mullam", + "rsa.misc.version": "1.4254", + "service.type": "barracuda", + "source.ip": [ + "10.124.32.120" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (ataevita.exe) queued as oremqu", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7892, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "ataevita.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.code": "reports", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "reports: REPORTS (velitsed.exe) queued as magnaali", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7941, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "process.name": "velitsed.exe", + "rsa.internal.event_desc": "report queued", + "rsa.internal.messageid": "reports", + "service.type": "barracuda", + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ] + }, + { + "event.action": " SCAN", + "event.code": "enbyCi", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "inbound/pass1: der[10.77.182.191] enbyCi 1575073317 1575073317 SCAN quameiu diduntu eiusmod itation 8 79 piciatis2460.api.host iusmodt", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 7992, + "network.direction": "inbound", + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.77.182.191" + ], + "rsa.db.index": "iusmodt", + "rsa.email.email_dst": "eiusmod", + "rsa.email.email_src": "diduntu", + "rsa.internal.messageid": "inbound/pass1", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + " SCAN" + ], + "rsa.misc.disposition": "Encrypted Message", + "rsa.misc.reference_id": "enbyCi", + "rsa.misc.result": "Attachment Content", + "rsa.misc.result_code": "79", + "rsa.network.domain": "piciatis2460.api.host", + "rsa.time.endtime": "2019-11-30T00:21:57.000Z", + "rsa.time.starttime": "2019-11-30T00:21:57.000Z", + "server.domain": "piciatis2460.api.host", + "service.type": "barracuda", + "source.ip": [ + "10.77.182.191" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "der" + }, + { + "event.action": "accept", + "event.code": "tiumd", + "event.dataset": "barracuda.spamfirewall", + "event.module": "barracuda", + "event.original": "scan: iame[10.193.110.71] tiumd 1576308271 1576308271 accept loinve tanimid isnostru nofdeFi 3 5 saqu remips", + "fileset.name": "spamfirewall", + "input.type": "log", + "log.offset": 8127, + "observer.product": "Spam", + "observer.type": "Anti-Virus", + "observer.vendor": "Barracuda", + "related.ip": [ + "10.193.110.71" + ], + "rsa.db.index": "remips", + "rsa.email.email_dst": "isnostru", + "rsa.email.email_src": "tanimid", + "rsa.internal.messageid": "scan", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "Quarantined Message", + "rsa.misc.reference_id": "tiumd", + "rsa.misc.result": "Too Many Message In Session", + "rsa.misc.result_code": "5", + "rsa.time.endtime": "2019-12-14T07:24:31.000Z", + "rsa.time.starttime": "2019-12-14T07:24:31.000Z", + "service.type": "barracuda", + "source.ip": [ + "10.193.110.71" + ], + "tags": [ + "barracuda.spamfirewall", + "forwarded" + ], + "url.domain": "iame" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc b/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc index e2c798214dd..1e9765b19ac 100644 --- a/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/bluecoat/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/cisco/_meta/config.yml b/x-pack/filebeat/module/cisco/_meta/config.yml index 056512d4769..79f755c2c1f 100644 --- a/x-pack/filebeat/module/cisco/_meta/config.yml +++ b/x-pack/filebeat/module/cisco/_meta/config.yml @@ -70,3 +70,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + meraki: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9525 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc index fb180ea8aa6..08dc160fab0 100644 --- a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc @@ -318,7 +318,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `meraki` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "ciscomeraki" device revision 118. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9525` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/cisco/fields.go b/x-pack/filebeat/module/cisco/fields.go index 79f0ee61a35..fac83c30f27 100644 --- a/x-pack/filebeat/module/cisco/fields.go +++ b/x-pack/filebeat/module/cisco/fields.go @@ -19,5 +19,5 @@ func init() { // AssetCisco returns asset data. // This is the base64 encoded gzipped contents of module/cisco. func AssetCisco() string { - return "eJzsvW1zIzeSJ/5+PgX+jvifux0y224/7I1vdi+0knqsm37QtrrbexcTUQFWJUlYKKAaQJGiP/0FEqhisQpFShRAqffsFw5bJBM/JIBEZiIfviU3sP6F5Ezn8i+EGGY4/ELO/P8WoHPFKsOk+IX8218IIeSNLGoOZCYVWVBRcCbm7utEgFlJdUMKWLIcCJdzPfkLITMGvNC//AV/bf/5lghagh9zQjVtPyHErCv4hcyVrKvOXwMwmn9eIXWE41CcXp+SV0zBinI+6Xy1gbH5S4OjBK3pHDJWbFF2UG5gvZJq+5MdcAj5sIAOEk+bsAKEYTMGaoMpAEXXsxm7vSMMuKVlZVdLg9ZMirtjfId/p9yPR+jMgCL/vwV8V6CyVjlkTBhQM5pDDM5dI03S0sRFNQsgMy5XRCoCSxBmJ6wCtGGCWvpxsZ1vCD8IoKo5ZPY/Y4B6S0sgcoYQTvMctCZnUhglOXnNtMHBiFlQQ0pq8gUUxCyYvgNKv7q1BpUCq6XrcDGNf3DjeXbeCWF3oY8GszPofbCWtKqgyJojUwVw9v64V8AYRYXm1EDR8O7yitCiUKD1PbAspDZ35tqM1txkKEZ/ITPKNTwUsx3+HmgrqUJouRTzhyKxpO+CZEu+RF7I7u6632p2UT3WknbR33Vdu7hTLG4X094VNgsF1GQclsDj6AGWHkF6KC1KyldUAXlBptIIMBbpbMbyCXknUOYsQa2/5XJ1Quy/euRKWYCiBk7Igs0X9rLBr9v/ucu0cmpgLtU6xszOPK32+huf2St7KTZqypKpWp/47/TnZ5T8nYoTAibfOZ9cCgG5O4BR9LWPgn2uuwoaTovinb4TCcvLKrODBlDoRX8778RwefbmCn+5f8BcFrEGtKTuyuuReaYRK5+u3nbGJltjh3QBWmUKcqkKfT8gD9DwqdZsLqAg56dXpD94kJVlSUWRcSYgo2pelyDM8eD64YkdnrTDWxNtDgWZrvEYc5lTTmhdMGM/2TWdZvr9S/COc7jvLbm5DjeMN5JQt1M4A2GIrlEDntWcr9vdI3bOolJsyTjMYSL5PffwgWvx2wIEoahZ6s3wVr/MF1TMGw3d65uSF2RJeb1z928mIWD1BCchYLV/EtNaaTOR098h70uxdIdCgVMT3LAo9hEHWVElmJjvPNAOMTvOtumitUoAuTw/CG5eKwXCZJbG8WSPG9SDRfgaQNwBrRQzNq8VFI8DeDN+B/t+2HQ5fxy8dAmKzuFBjH408B1mB+ZBOZcrKO6yw8uaU8OWkOWyFscTJkYaygmOaXX5DvYFM5poJnJwQt1JmxXVJLequRVAiuQcqOpMcNtHOjNdNA/3kb5iCiq5AtVYKecwA6HhiThOX304/7Icpxbwn47TPx2nfzpOv2jHKfmogVycXfuPJoKaCav+9Kce6E8NsfMJO1pbuJ3P77EF/nTC7se0vS36fP7TRfuni/ZPF+3WgHtdtBryWjET2jRBb8pmwN5w7+nKa/rI3GtPl1zYW3r3K9QX7iZOCXGnm3jbxmNSR7XxLt9dtyE4zT/jphxFLTjj7B4X1x21QXvFOh3bUt+5k2Y0Zzy8m3facdcXZ/dbl2YgYiRZLVi+cELS25wKZqA0eTbbiMYTcv32zdUJuf7f1yeECqvo9MjOpDKL5xNyuiGeU0GmQChZUFWg+HWhUSeEkkpJI3PJTwiKstJFVclZX+ZaJX+tDZREy5mxRCbk0pAChDSwZQR4SZ/TWre8dz/t31NumpPBRvQBXJPWTpv0rAO5BLVSzNhLS9Uw2K/DRdpzhHYsVHcLNZFlGwNytQDl/Cn+IiMLqskUQBA51aCWUAznp7ZCzfZNZnj4dk5l/GwhakG3VZbx0cfGDw3R0eb0vLfMu0bYdap6q/LB2mo3sLa2XK3dw0tOK1N7/iu6ag8O2ny5LEHbSUv7eY80Ia/lnJyDvdhUeCKOFuuDOnQ6DV00N622m0cm7AEn5r5nuTvxuRQGH/DkjDChDRWmgaGDGA0rDwFY9D3BIXTexrdDEGq8OKWNb825Pyl5C+Y3ZoS9BvzqTwZbo52sXsiaF0TAEpSVoM2+q6jSQN6AoRYaJTMly85Qz17LuX5xRfMbMPr5gPw5U5Abvj5p36coeQ9OWLgdLjowJ0FGDm2Pu3FyYEL1OHkOlYIcDSaLpIAZs2qDFBxhGTrlVomvwqhKPe+r2nF3oF/jN/6cX55/7970vJenUczdt+CW5viC7NZLDRYCZ8dQaXO7Bb9nl6OiyrC85lTh7/3CTkZ3xoD0QTsltDMGlMd3yuiSLI+7Ji//XJPda2JHTbMgDzu+cvp7hhPpL8uTQbekhwi95NAUON33KWKzbEt1/h+GTBtqoITe4+gTAYfhR1nOae8MPxF4IEzPQ/dEgC0GXqcnAoyJw4Cl1ZgayfF0d1oB9BDpkZZtM3AvBrFsqBG9JmRndr7YuAUsmoEeMlASHmZF9PSQAfU9VsQ4FwcPr0fhouh4VYLsc+waTDMS+0iAg/dmX34MtboevDk08/d/Wm8btWdS5PZyoEY+dct2RNwsWVpx2OXumR2GzVhOu+f5tZy794YmoqUWBSh0loIXVIOpz9gtFEQDRl1t/Xh7DD1usDSLMKD9YIOlXYQB6XstytATGN+/dNjGHMzrHjy5Hw8GT+pJ9uWvUpuuiOT9HalBFEzMmw91aNt0fEhfDn/ZIRts8KNRxl5eLX9sY/jHjnufuYPZG/mlMnf5c2r2/vz/LnsHr85JZENfLjhHWtdbVhBK5mwJonWSfbmKgGXRYf6LtBZI8RSVvy/jRWPUoSGrdabgc4K17j4e4gLjvH2+2YUbmlzhQTrx3mxDyYd1BSSnQwkyBQLMLECRj5fCfP8zkYq84pKaH16SKdW4i5oHMswmQNVvz7wPUXe/4HnjM2g64zOCfyEYCHcU67gZ+Yt3MEi1omqQnRlN6+hItM60u5y8vPq0pe9RzF/rLylpYlvcJephY7g9uJ2qHfMwcUaxOcPcC/ebbW1lDx9S6V87AiMurz79HGBBOCaHRGBBi2jI5Ri3z2ajDhXHQ2+fBdAC1FHern/Focjl+UNeSR3e7mMpkjnsrfRJO9l4niX3s9FG0brcKFp4UKzpciY5h9xI9SUKYMu9R4i5sXuOaZI71kFhkW4pqq9lX20hOxj9BC2+Mp8+FVW1lBqD3UopyHQ9WDRCFHyuQWMSlGZlxdd+neyXMVAXaL4gmhVAnn1HzELV5OVPPz3H1FANINpRdnDiSSivd+CErqTQkI4V+RezK1yKcONTqMupE3r2KOsgBfKMTuUSOsxgIhhZ2Yg3bRTQcvT85F/MtnlkVkHB6r6eFoNRX4U0x9axwGaEmX/WL7/7/q/aifQXFQrQBvQ/B7P5p7UHX9M1KPKSXIicVhqT4KVAk/Jecj1E/YGPH4HYytAoP7wk/2qne0J++IH8K8mlwpIXuExu0BPy37j5H/aLTJNtpnwVXEIhi0DS8BOxdcUKspxyPqX5TVoN2IFrEgaocXaFZSKIopJMmKa6SBAobo4MlJKJ4tM2+qCuIGeUI2JEqo1UVrMWa6d12A+WlLPCbYwQKEJmshaFvWE4IHgm5l452hu8uH0iBpRjvAX647Dj2WhkFdZc0uKp3HMeDtHsDyAlGMXygNXhTeHul9EWdtd9I4TttU/NRqOVs2bZJuRXubJLM7Q5mSBSWWPMSHIDUO1h2pO48b4QpimJyWBLVmRFqlfXi0byzEFg1qzGtKra2dHeLlwyZWrKrdG+5XsXARcHK5k1u/GtHJnhZuGP+uU5UVZaa3SoINOomoNpv7aXE1olCnp6dE40Ofu7OKGSPAUNBf/leeN7fQ+lNECu/X5vauVM12OCkmC1EfcQ8wU8vPiRMl1xljKy4Umb85oN1P4noZtZmZtwv+Ops3dAk6bpd11jtfgr5L/GC6MTLzPGH+GN3o5qjaOrs9Mrr/v6pFxWVlL1NV6CV+QXFwZRPw33hy/TgIb4sPgaca7UbVO+3vxkY7A7PQct8wl5+dPPZIV8L4EKQjkP+wrQqY9q0sZ/RFagXA08gmU+qDZEil66yDYTH11N/LKZGDirKZ5tPe9+k6pAxmFUE+QLIbmcr/sPcTOmBlosIT+RfEEVzY1joj3Ua8SPTnNBauFjeviWz3w0ozZ2Qrd7qE/5iLDj7RItitIqmVI0zwiKrkZlGkrWnlpJc9RY3RuF8D4HmedY4xEpakNFQVVBhFQl5eyPUHyvVGWQP4WPcjiYRbKeDq6kezFpg7oF84KzGeCMAwa+hlyKYkTB3ix3pk1KP8uOCTGRy7LiYIIbYNSJSlGBN4r1xGAn30yZR9rI13bs4HYe28rbO3N0+5VSmEWkZdrkp8aKedlEORWPxPgLUaRguyX5hxSpqy3sEIt29EbFdOG1H/ocHoioZCf6lBi4Nf7wkSUo3UmnKHbFgQXW96GbbQ001jQ3aXq5VAUU6e5BH2TjryndjtjoGE2kTfvF7vv68LZSspwg1RqT8nUOgiomnVpf1tywbw0DRWhV8Sb7ZVPLpqSCzkOpuYRwfN7ZKuvTFJQizHytiVwJ9zJmaFn1PYMeMdbfVHIYfMSMJvmCWetGFqAn5E2tDZpJXaL2VFIzEpdLDRy4SDsF2GxmcS/hGJoQLnIzoOMdloICkbsNQa1qXbAlK6xmg/shLMiuG0H2oce88CRvK6aONsPNerq3oFu7E5nh66bulZGor1lQrjjjTt9oxEUfdeGcWGncyrPJYMg2nEzWsSVQOVDkHkqx5X/so4Ia5Oca6qNtJbu73S7ayMcV1QRBFCP7BsF9H5upEZWCLYYmkGnz0iS4fedlCqxVlgBqlaXQnquYomib6MvoVBPoSp1b5HFMyJ75GLxjBtflve6cQ8XmPrl2yGPB5oLoVUOI7Qii+UCJj6FY65qnfnYasaJkbXJZwguHoTVeMCp7UACT2H3hWLBlQI5sEFjCoBzu0SbWjO6TADsvO7tcPmmTFwe1A90t3Wa6WGr47lRBzmZsY/iEtVtfyn1kT3ldOX00U2ABWhcjKzYJE42LqvCPLEHc3mw+1iJ82rbSu5agVOTdtQ+NZboJCOj71YivC9troEC2siR1JTWLKDjutLfQnBaFqzCFofzN2R2twlNzMyyY/ViiSNQlKJbfVxYF53aELLYdE+tmsrUnw4kld74HU1uCKKTyAbM7Zyanvz9C9ZrmaTdQ1rwLLH0u+IDdVoLuBuYkfcpadV8ND6TP+vdixnu5FrSNLRbSEIptIizIcAAtl/OsCVR5FKHebMR7C/Vj1EzZkn1/x3ArrFq93e6wi6qSnOXr1Kdnh1y4QgC+uLbg6xG5HGy2lJiB72sOCCwsTqUwcJtaY20BXQrnr9vUQ6VFoe2/8FLFVm8IKFQAZs/l7LpkZv12nQlkwdjDZdOSs60VQo1RbFob6EiIYYy+b/BptfXu9RcWHbrqdxB7uNXiWr0e/+SgIdiPL/J9Zzv6W8C4xQwwy7Cm4KDexHypJagJuQa3KLUGNaFzwFLePtJ9JlWDYUC7IeP09tw13XK/79StkIpMlVzZz5q/el3TmV2j9aQviyuqTGw3XUs4tkfFn6l+H9/jnam2V2/CIyUr8A+Kqe7iU0EoB2Xa6CK1GdT/zT1vefHRKQKAQUgBhbkgQopvFVSAlsyu6Ac0G4555TTNR1t7xbQNOl8w98LWPP8MZrZiZuGVZSfryTkOOMVsE0Gk+HYu7X/vuAlQSckCimPCedPOY+ALBGBByhmx0sEw0BNyvZEp/cYG3cyqNIjPXDpfra0R41JGXbBN4cWvZzwlOa+1aTak/5/BMuFPmLYr6XOivX/DKr746bgKdHTtx52wsEXvyjKlU8q+3md4WZTniIJQrWXO0F9qVyNoT+KCvWY38AuhpFqsNcspJwXTNyekUtgTBVuJfR1WlKmih+Re3vOid3k2ipZgsJk51VjFS2MhB1eLoGmdL7ce7YepNVtd0cjwanL3wWNpfJ01THAxOfGdy7Kqh2cwwbJRsmKikCsfT5tLkUNlTtpIilFmDKY5qzlfk8815c75WciSMuGlhugMxOXI1dX1esZSl3ZM3aqEr5m4gcLnAjWB6FSjd8obKPaTr1poE1bsWjg+qAqRVNR1Ozs5t0QfQAPv3fVj4XpXec8ruR6W62kfnUGVrN/YKbWL1Y+JaN3+361p/xBZ054xnv6Mt1N+haO1x1hBUedAmpcjCLvbNChGeRa4TZNdItc4ZKM29+/HzgVob5hRvwDkN/qgkgMxPMZ+dHvRLahetCfUqoWBLMM6X7jI3ybHpk0zPGso9UqE2Ym0w0y0yrHxffP/w0xTYuW5IAxj7mqBLfLtn7AQ3gaaTyDcNMFziZ37Xx+c8KuHdZ6e9I2Vy3La9NOVs60Ly6eNqnvcXtjw9dievq42ggDGPX7HeSANHIkzN7qryTjuKXUWXHLXeMs+52W+PCdvnaR55gs3ENdtzyf9WmzPw3q1c0A/hi+/436+PEeW+pS3VkwMvQfbL3IuDNBNYeI2kZUFK6bDRupSr1PWst9+1fUJ2k5d2OnHHmmOnPjQnW065V6e79VkY/nn9miyFthLUWw02gk5c/mZvt4pdx/s1mYRoNr+xvdfeXfctDZt5qY07WVUCw7acUa6C2UlyZIqRqd8kAXoijIwQSpORwSBBqGT1kfZWtCuqupGnlhJZTWMJr+Q2XW+fnF51dehiS8Z6zwKY3nZBzYUvHMu5OalxYEkl8KQazYXFIXFyBatpEpZvPbrgfyym/Sq0d0kVnXE/7RAus2n7S4rZGDjvH33gTCR87oAK858I1vXCP/ZRdPA+Mo5RBxZlN6TsF8EX+aO/raJzqnN1RJGxvSNVbkPwHWPVLyOG/OtvxreM32z48nVKDafg0rXwi7Msk/dtwCPwbVoVqAXkhd29zhbfaTT6NbT+xE8C8O3dy+Vn713OsbzthjH5Xk4jeTOr/O5LKvsyHFXuCo+9grbuDr/nq6n31o4UmB+6sz15i7qfMxK82rpI0WNdZG30lIqrDxg5XqDb6RLnG9E/igK4LCq/gx7n7uLyE5ipDTyMytEKXlD86aecli5tSLoqHaMFN82CqraLYWcrRm9qbUCqqPHBmtDTR1LcW79UZTxRzM77OBTeUtY8WL8/rI3a30MhBbRx0HhY3cWLIrw0W3uscTd9wab/HzYd++Q64wJWcd64+zkkeh59DNlJWlMp8PAI/tjZMKpKzNubYlTzq3cI7rOc9B6VnNyYccnuSxA2y3RFPsNWxZMFHAbmQGcaXOY5vlA2YIDoymmGhBTUPi+WVLFOEbwBDx47v1dzAlFJn5rfxucmUiwD+XUFRd6JI3Yj06etfGcFShd+aRbJ2EGLPMqwiYgvqnw9HwkydC5uYb3ceqAEqd8tUFe3lflvm0/pExoUoChjAecDFNZm87vRqYm+dFjMxuPLW3j2BDH+EVqoKx4smieU1LAjPonIF/5snnD99GaViteguJ0jYlcRvrLlTwLnEj7AVrd/tcwa7LAna9eG2ZqLMxIghPb2AbDgk0PPa5RX7E6/p2cxkaaQFblsizteUqzjc4cdcI6wb6VkktWOP9ZU0WuBD0aCFXI/PCHxvt7y14xvtEa825cXlg1uK0w6OlxZH0zelpZ/7ucHuh3Onh6/0tO/QNM+HRVLF3h3HMMKHYrf311SS4HClUXRrKqtT67ZDeCiIldbTbsPKohfR9/mI+tDiv3TkRkU1mkzvgaZNz1lQ6PhVgsI+rRIn61BPdkcITM844L2KcOuwDa9j2EzVnRPuWMOPHK2FbjIA08ws0fT8lr513VKa+pprv31UdXPad5iMJgjVvI664XwYV+TSGU3tpUYdoVuHEER0jQK15sO0Ta7Eq6pIzT4UMGaV3hBPMrZ6DUSKcFd4YO8fXHe3fzxkrpC0C5B9jBlHy4gWbzyYhEZGU2rYtiHd0/w8osah5Qh26t4bBC5zu9VPEpKiYjVjnopdhluj5GQgLT3ehVV3OV1gUzbWbdpi6aRxRqbLfJ2HCiZPO8sHuSLkosNgeXR7PKzz5dkGc+V+JTza2uPGUcEzgwDuzitpLafvM5+XboaBD9V5gbIVdiyxDSkNdYzGK5TX2k02ZOj+CC64eFnjVZ7m99atJrmNN8TT6OmmucTRV9jKR8P/AWi5kgJWVipmgJO8MxKqqwa2/6OglbyuUVDkveysIFR2/KAnaizgKgyB7tC0MFLCNSWUjbdePewor8Wgs0Jd/IAjh5xsRy8s0JYTI/IVP7L7D/ooLytWZ68k34fdHkVTbjdNA5P7YOta3hn10RHBR9XSgn103zKznbWajByKRI3V+nHmdTBkGDshs5CGhZxpW7PWSf3vxGFZAPLgD4m28+vfnt9P3FN9+4mNslVZSN7smVVDcxU5b3HrDfmgG7L2yjTjAqYisRPmcnbpWS9jqgub0u1glMmJlUIDTLYwqQjispAeIyvhck8D4Qi2i2omzYnPjB3gGsfR6bqD0+sVPUdT1NdCjMtNBGxc58x3ztZA6x7l0a7R5tcj7SOUkPTXbZNAYbqDQ+2WST9+LzXSyJGRt1NDVTTeaIPXSqwWpEgWn203vCQvngeoL3d1xY8F7/fz8cdaMyu85/j7LFio6P3gPZCfJRNkfzjrsLn5RHCNraWtmOXfrMtBHtTZQd1sl8jm63wc7d/zLdlKxmx3gPw6SvGWXc8rop5nLlZcbleTe3DStxWXPQwDxQwmA8qrCJuc6sinjAfA4JvMZwa599dCbLshZ9T9QAnTiscNND0b2FW/N3COvULTZ9mGb9UGzXVBT/LsOvZhtshhp2iGR4MLrhwFvgdK0rljMZLUr0WBY8ol9RJYaPDk8duhZllclUwvj67Zsr8s75UTdBqWEgn48aSnD9H6/J5xrUSO3WmotMQb9SZ9rgho5DdE3eN0lnwbCuVkvPI16kXaIydhsBS7Q6yHG0j6oJPI49mG4Rv0ED5VSVCVbLkk3gXqBVxATklmhdROtKu0UzbrWrLdIFNX2t8KF0pyDyRUlVrLSSlu66ooP2xQ9+faL5IJwqCs1sEX0v5DCLm0DVEp7NsdRSArJy+nsCqhWN3gnDVZyKvr3w0T1jsS8cX7mtBKt6RgctMppjY5T46SeWthYRjfcO4em8Wv4obs0i+v2eiyw3Kit01LrrHeqW8mEvT3cgvOQ0usQQGYg5ExGTIoekU8RGi2yW6RUzeXT5IbIZlytNy/ixK13awizTUU/w6pKLjImU4oSJClQ5XUcLeB/QrvKbNMSXlKfYK6zKKiWNzOI/SSH15Y8Zehzj0+bJziaX86xIwWxLOH78Wy6ykt5mxsRyG2wTtjuaQ4JLoWQiEWgm0oGuuM74lGexn0W3aH+XkHj0yuAd2rFrIXZpx87q7dL+KSHtnxPS/peEtP97Qtp/TUPbyIrTKaQQKS31+OaZyMqao/I9XSe4Jxvi1U0CvaSsOZuXVRrt22qZlM9jByF5yiyFUqLhcx7fNyIy7QISE6ygVnkaa9ISTmNN6rWuqwS9SHPRplUnMVWNNNb0gNsEIsRIYw2zVLTRrElCvBbsVlAhNeQJNuHyZ8uVRJfC8mdZmQXQIoFbTZZVlvMEPmxLOMEjCdJV07WJ7xa1lHUSylWdJXjTyBUzLKc8QQKRzugcRL6OGHXVpS0oX/8BxTQF7mWGZUCTUHblYNKgdoG1SahP59Xy5zQ+aJ1NmflrkkJjuc7i9orrEVYyuqjWSY45UoVcxc9y087HH63XVocwmIXz88d3jjjiqPYlIe6qycerINehPWMcUtgwOpulWEQ2i5mcvU04hW6gM1ZhkGKWRNSxavljoU01KOYfibZWeRLanM0ghRmj0dFcQsGiJYxu02YizS4pZVFz0LlMwW1PnM0TyCZZ6RU1UXv+d6iHIsijEFYwZ9ooGt8TsqGdQONTUKVitUrGa42VyFUi+eoi890WT0DdKKBlAkXSpQKlgp1OuV4tJNOZ6zAbn/qaKppkgxcjibAxKC9df/vYdJk2VETvc1xoM61VrGaBDVVwvYJSUK2jY42vRzc5ybHJYueGWfxm14dWGthFc06LIvYZYEXsZ9WmdFCCu4iVWa6kLJNUJbKEE5hprMzSBEf6ikcp2FzdRC/PVOn4JUtZpSvFIhPl1DBTR48+40xAvBI7G6o6akedli4m38Z3a3Hpqp5mMy6jX+ct8QQh/9bmjS51LNEEEsfa0AmgRo9N4HKeZOuKeZIDXEkVW4CV03qe4piVTOcpxEKpk2zYFH0gBBgsrhSdbnQZ7gpAx474c1Rjh+OJ1Sq2BZIko0y6BtDRLVEZXzOSis2zQD+uB9NdCVDx76wqc015o5ON2pl6Q9a1eE2yyRIkbvqeOLGFgScbWxpUmXMkRYdLtbYfZvkiVp7/gDTcViz6Q0AFqpwrKsyg5m4MyqskhONfva4S2cePvS6gEQgrOc+oriI2DOiSVjQ2VQWUp9DvFOTIB1d1NBHx+Ey2lOOWcO1QlqpIgDi+I1Mn8A1r5xtOEA+gIXYggGt4nMA40fA5/gYIFWiNRjWBKaXZPIHg1VVsL5tWeYpzoPIiuiKtVR6qihuBsInXYqtLs9bRq2oucxE7USLYLfahRF2RztjTN3MTf1s5ovFf9NqenrHprqvo1VrrYpokDr1WPMFdWGtQWcFiZ70naVvRvAylYIPJtaFlbG/wMmNCGzpLoBksmTIp1PBlJRKUbjJS1SKmmzVUFi1QUfS0NpK8rwUZDN1GjyRslveJclaQMwUFM+SMqsJXM9RY/j0Mx3XOSsilsQ6hSAab6BOsb5BLTkKpOm08BBPpOHdRVlyuYdBYcC//ZrKOVtT7jnvM8tD5jLDfmYI53JKS9gstbN5ixbzuNwNJDpIzjc0ZmtH90mMBJaLrqpLKkGHhUUJWC2oIM6RSMBvbCg8Iy71PE4oQ473V0UIgTPjK7iN1oTkTqTvyd6Da0bo4NTFyDmYBarL5vl7IenCjESJgCaptR2QkqajSQN6AodgR3J1V2rLg2Ws51y+uXNrrc3LuW3ydELMIdCnCYsDvwbc+RtiCvAXzGzMCdHidh5s6CfNm2LK7PUU4uJusBqryxYQJFsSHPXePUF+7Jz6xFwYGQ7zgtBbY63deYx/Xpoh7uIB7r177jjmlL8fdzqktwu37F48Y+3Yhsog5TXervIrDkg9wa/BUjLkLjtGNekQgbRrXvcUO1YKPdLzE6rkJ24Fj/VwNhij4XIM2O4p2Hx6tfP9a+U5lwLY8blQnsfseqTbudNudsguTQ4RvY1t/xwrt+pfgzGP2/t/f39AOdnneCAUcO7w30GqIF8R7zy1sL5cp1UBcuHaLhgxOVbtK/hePg1e0reBb5FK58vVBNhJCNdEA2O6M7u5XpajQND9Ce99BhWk3tEC1d7Np8lphB7RdoCtQJXPqxrFAb4Z0jTnYknGYA+GwBE6o1mwu3MJt+vWHtz6WZH5E+Y3j79jp00fp9GyR1YJ9rqHfJpGGD18H72EVEw/rgtJoNKxwBzKXQgDGVpAVM4sxQUFIIDOk1dgVHJRedG/TwrIT5Ul7RXE5ZznlxCIYMX0QxeOiw6FG2jQ+Hu+qxVqH4XXC2VayF9Ua+4KnnFGdLWRym8AZca25hr1UNk2NrFTstuAJ1wMg7tBYtHin+UYsOQeqJqdcS2uIb523c3wsJ7/6X0zIqVi3/zegbtCW18IQWkxyWVa1ARUWw0nc+HZi6cyzr/prgT0WtxaEmX/WL7/7/q/W9j3vLEfDsa+CsP0+zeK+mN3VcUPXoMi/tD45/cLDQHDhUx87/yf9nhcbzFu7fud6HBi8vE+2fd1vmGLHmZC37z5c2LmDAuc8QX9pwXSuoKIiX1ut0qtnvB8LQpBDJ+TDm1/IpTA/vDwhl2/PL/7zF/LxUpiffyTPVos1EcDMAhTJF1L7VmlSKcgNfuv7n//n//f86yBHwCwSyrg+P1CmTkoabsejE+++ex7za7cXLxtQ4SNePC3QXdm0B/mBBePufMGH8PYU04118okpU1NOXp++DYL9QwpI58s6bGf8HylgEuathfvFiFCcyH7hiUvwFO/gHeswpwZW9BFapOPuviKnRaHQT+t2eQhOe/XmZXXoO+dD30Iuz95cuVtp9HmspPqIrx9bTiWnqfq7m1xeWSgj3i/LwwM7QUThoR17nIeNJpa57lrHFRAduLQomP0y5ZsH204v//A9d8QNYE1CPODSn/Dz7S0wgLKJtU6i1931SqPkrUd4JZVpRfJA6Bb4wIYLwMx6v+TVR+a9mw8T8+Yyaab1ZozxAkJ247G8uB4dWr5Ua5kzq3I6v9FAxyFWLisq5jBpTadcihmb1woKMl0jTRAFRg2F5Ux1YOmBQdLoiLYcHHSWoN4Bj6j7d1O4ojsAFJTSQOYju+PHGcVnbSF0RjMXip+AdGVUGuKzBFtiliBbmKc4Dqnqn1QJmEqLrPHEpVPL+xa8ncekP1rXmfAIGuyFWYASYMiHdQUn5GNzjb1GB9gP5KpxgA1ugndjmlrTqucIysSIadyA9n7xE0I5DyoT1eaLGOBGFQbmLUHZO5AJI4k2eJkzQT5ejgqUHANkk8mr6CLbEpVVgrZvlrACHTui15JNkOLibsTYoejob0+A1rVWyDiIefROkYjZKh8JtdARDdSpPJR3HmAEyTGcYEYoeSXViqpi2KebkNM5BnspQu2Jv8VYuimYFYAIq56Rqybe941bGsq7T3UODMGS8RgZMZghEz7OFcMSSmasWPItNsJTXHIqjvGOfwcHZRMg0nFRDia47bLcvKQsrQU7RwN2++aJ/VIJOVYhWMarB3e3F3uqDMtrThXBetGkAfHs4vaX13IuZ7Nw93fIM7OA5Mu7BfaDHdCdxg7uC4vbwj2tzQKE8cHio7B1HbNywt0CetyQ49A/alCjgGVtcnlcTvshxwFf13kOWo9gxsrjhxVHOyzwBHERq+LOpVqTQGLCANsxhNMWRuhhtFIJH/h0JYW9V6zcCimH7Q/JQFHantUyXj26kXuTEle1FHMGOIOinY/3w/T0YSaIZqYOyE+CyQXgRbSnuqCa0EJW9nYxC2CKyJXYLJljnKG3UshyJK4We3Jo5krUH1eJsMo9E4WVP1LplgGUvGIcyKkHNhmw4S7OXtFOzJ3J0YDxdv6PEq4wyoJrH7UQlwuhOQYYETPf/QGMcPF61z5fIzYnxgNCpzJl9kBg8lNY0CWTNWqXuSwrJUs2EqEIxwZ3IeiUYxLZjJztxsbEshU7CUH2EW5pnSQIYAth1OYyBwAMjN/iS726nVt2c95Gt90mzbIWpp/OFlujLzANPMsPMevvpAXhfTwHAYrlzZSQIRjo1w8tYGaBV22otxvxYCf59xNt1PjjZzOnQ8puPdqcXu6ek1cv3FgJ5xU0TVsj3LAStJXrTttTUMHoI5JfhWhFIfYuBBYefOAyqDturUNqdz/a1vrhbnP6PtPRmpzeeWreYbxvhoO54Yw3AuEOwuDLnd3LvbNTR107d9CizE3tX7lotVSPI0D2yPFWgHy52/GH/UsWq7XBcZbsbvJRHVWCxDxjd5AfR92OMec22IytUo8paD0/dfTMndosshLMQj7CKwnd8iQTB8N/bXTBsZaSkkm9Tjtedd5L7v21FsiOfZnIE/Kfk5+++448e31+evWcnDNtmJjXTC+gwFT4IBYu5zJ5XaBdL2EYLTtzOPwy4xdHIsaUTOxV3JX/aVc1hKA9MeiRj9b0+T7HJcew/zbvt+P4Q0yhN1MqQmXSN5FilMeqTtebyHtasFq7EYhURLOScaqceLJi056hHO/1cHoVnnPNimNWGulGyn+0G6HxIvbqYm4Oebo8i1Ox66zjs4bPNOz4f72TCD8Z7AXvuIFOWkYRdmVKlTIwYPBkg6yWak4F+2NHVLVItxXuyuwDON3dUyPsnjEVzCVNVPXnlR0ObwtX4svVLtqKav4VKDeLnCoglYJClkzQYMJdRzxdUcNAGL03PJ7TY872NX3UybrSj1Al2rj26HxtBVdFlcFiSJup7harRyx25IXNXSTqDApQ1ECRRQsq27E/rPB51YzYPp5dKblkRVs8zH+PVhX3mupgY/jiP/Za29ZpwwrOZpKsONIs2yF9rT+zHplmsHkoRk4umXs9X/QV95EScK3SGbMp+H01T7hFnanzo04m9DwwUaejosZKNdFGKifxLbUSDMXRvsZvTey3vg7PvmRFweF4Uu4NjndXORdY3o7cO0jONe0xjjPdKz9ap8KQWDevsyek4tQumb2fpSIgcrWuxrz8GAp5BHvyDhF0qrUtf5XakDc0XzAxYtIVNJHk+KrP648CI/0rBVZ8WP3IFTnTE/K6oBX5hP/j9KNCCpd3+s/h5UkWdAlWc+JAFflcg1oTrEGoKyk0NBpVODnVzjfD3xxHXvoaeLmlrFhTBVK46bu6fOM4mykdAepmA733xVHvihS7PKV1mPX3eFNaequIkbUN/cXLNFG1EEE7Vp+0N497eXZlpEZy7DzFzFuY6ReCkhUThVxpoivI2Yzl9pOTUJ6gj5MdHhA7PYd3E3NDnmFFWBD55hrCp8vnHW6RWuA9/hrmNF+Tj3q78G37Alv2E2mjR9faEY5gsI/c9l1TC6FgrhpuMnsjDjje1gEIZP9vZZpiOs+QfdvTTq9Qj1Xndep1YMY4w+BG8785YLLHiesdm6qP8PWu90bWXeDUx6uADmdzHIdd+2CwvTabgEy3DIMVChek2J/8jGkDMVsCjma44ZQLmDHhffUonLCqX0mrkaKDiO6gRLFE2DYOmJ76F1swtj7b1HP3tZRGalO2PmxjaL4oj1wCfzMqMpwMrKPuciRp8jJlIl4Hsahnw04ZkwrTXp4BIdVN28FlcWW0N+n9ga6dA9Rp7749qCuqmj1l/3yymcpqwQal1Ik9HdaWdcHvd5qeid6zxJW1kGqdbsH/pisq/m1vxZgGyHYV9UY9D11Nli1/e4HU98zt0VSiwayaeuu7ZzW6CzIQRsnqENFRyHo6cC7caY/7Ma21DXvSERCjy+447jk8k2VFxbo9j3jssJ2+s1eWoOw1lDExk2GlgOqb1DlCe+RHz4pskK0gbVX02edUMQKvas7X5D9qytmMQUHOMe/ZOQeDUFYwzXIpb9gjPbr/BlPixt/Yz5SPafPRq81unsOr2qDKfWAL0/1n/X07hO+y493Rzic/IR/WlZv6xnNgmeNWcHzxFMyyqMVke7AtBueIUF/rUNnaPphjuOpa5XIbnfMsVlI13n58Yn7/emTJO7VyIm+nhhdV2j5EO1hhR97ruW9gKikTaSLboOw4dj1IRU3YNZmLjOqYr/0dwsqn00emXCsecZk7VCOuSmuMZrWK5Q3p0NSgMjqPZ1NuSEe/nrZJRw1/3Cbtd30CwQK3BgSqVvGNE0s/2m5uFb2Fgl6oTGyNyg1xjFzCLZn7AYdF9eqF/+8zD+GF/w8f1xRy+1MOKhyd56fziK/nbjLdx3P0uHZarQ2mU/iGaNakYmIGSo28uw7nfZR5dRX/vawPumePALKpSzzrLEPgSOGztkx6pAJDHG37Xbh3e7vtPmAEser+6R8wDNAab/jJqgWo4/gjrM7uI56enWHrx+fkDMcPQwNljlQsZYTPZ6B880/YisLcUZwXkj4ddxjZWXA76Ne6Uyl650qzPw71St6/NEp4tck1+yPsrWE3iWTK5T8uiIC5NMwtYLWgeqQDlM6PXVaos5Ru8PHmgnapk3WAGgS49PZYUzi9yb8JB6RoNj9GRsV2faO26+GH0UbLVpowrevoSidSxmCpdN66h72hIEJQKqkPdLAoXel5YQcn1/g4vUs6HSVCoq0M7l+Rn11jaOfuy6gjPQ8DeX/puQPjuAjVmmfLlDd6/0nVO7KDYIrMbj1aRy/TqFMRZjfgLepExQ2+2rQr6V5IKFt/JBrf66Qil9en/3hzRa7sPUXeiZHuKxu0iTKpD0H7YSXDaFEM5QvIb/RBTuS7CeG0NchCTefaep1tiTAMA/UtCDdScIeWC4oNikI+gpLrcLRVQUaNBsRsqKmP1uGzi3JJOSvcRgyA6AvCo1W13iUIkWM3sNZ9sR1p5zcBpJFpL4ypdMawB20S0riUKRiS0ydwmthcNJkvUjGz3nOiclmWSevE3RG3w+EdQuEU/BVTwPuWZmwXy4pTkWn9WA1v7chOhv/mZ9vkaAXRulTjrJLsGGHVIcAOAUEECCpsDSBb8wUVYlA4I3W5KT8qAhl5sz1S2eb2YvE9D397ffrW33svesO3F4qRqu/7j16zjembbCl5nYoBp00fZ+H73LSdsZt2vrVgRpNnDoR+jtU6MLG36ajbI08QdHA2vE4kzV57rB8FMz5cYLKddLAEhZECs5qTXIocKmMN5Wu3hiPlFVarlNLXMd4a7E0LbQu0ksoQafn767+fhkJwg2yPve+kmh8/wLKfYLDlYp1SV+wkWCjm7xfvri6vyBt6WzJRtG29w8tq53b0MMytJooj0/LTGMxu17Ra9Smcshg9PNtlOWaz4yVsPnYSfjPl5GrHlrPMS+XLc1+l16PYiZAfb1EeuVZAM+Pyv3zecJuYI4qhJhn7dKO/xJrQjxTd6NtVoxXfPuqWLrn3hOg6EKJONfmbNkqK+b9NOc1vONMGir+98H87aT9lYgZ5+KMZU7CiPKjI0Cnv/IZQURAtyci2VDBn2qi1teyPKSwqaha+WH+LgfQxDECiU+pYMF0itMvXyqXqVCFv9ckWOQij1n/5vwEAAP//HijnmA==" + return "eJzsvW1zIzeSIPx9fwXOEc+52yGzx+2XvfHN7oVWkte66W5rW93tfS4mogJEgSRGKKAaQJGif/0FEqgXVqFIiQKK6r3xB4ctkolEIpHI9/wW3dHtz4gwTeQ/IWSY4fRndOH/N6eaKFYaJsXP6F//CSGE3sq84hQtpEIrLHLOxNJ9HQlqNlLdoZyuGaGIy6We/RNCC0Z5rn/+J/i1/edbJHBB/ZozrHHzCUJmW9Kf0VLJquz8NYBG/c8vAB3QcVic356jX5iiG8z5rPPVGo32LzUeBdUaL2nG8h3IDpU7ut1ItfvJHnQQ+rCiHUw8bMRyKgxbMKpanAKo6GqxYPcPRIPe46K0p6Wp1kyKh+P4G/wdc78ewgtDFfr/LMIPRVRWitCMCUPVAhMag3K3ABM1MOFQzYqiBZcbJBWiayrMXrRyqg0T2MKPi9tlC/hJCKqK08z+Zwyk3uGCIrkAFM4JoVqjCymMkhy9YdrAYsissEEFNmRFc2RWTD8AS3+6laYqBa4WrsOLafiDW8+T80EYdg96MjQ7iz4G1wKXJc2z+sqUATx7fzwoYIzCQnNsaF7T7voG4TxXVOtH4LKS2jyYagtccZOBGP0ZLTDX9Kk42+UfgW0pVQhbLsXyqZhY0A/BZEe+RD7ILnc97jS7WJ3qSLvYP/Rcu3inONwuTgdP2KwUxSbjdE15HD3AwkMAD6RFgfkGK4peobk0ghqL6WLByAz9JkDmrKnafsvl5gzZf/XAFTKnCht6hlZsubKPDXzd/s9DtkWwoUuptjF2duFhNc/f+M5+sY9iraasmar0mf9Of39Gyb9jcYaoIXv3Q6QQlLgLGEVf+yjY56qroMG2MLzpezFhpCgzu2gAC73qs/NeHK4v3t7ALw8vSGQea0EL6qG0HtlnGrHy6eZdZ220s3ZIF8BlpiiRKtePQ+QJGj7Wmi0FzdHl+Q3qLx4kZVFgkWecCZphtawKKsx06PrlkV0eNctbE21JczTfwjXmkmCOcJUzYz/Zt516+/1H8IF7eOwr2T6HLeGNRNhxCmdUGKQr0IAXFefbhnvE3l2Uiq0Zp0s6k/yRPHzkWfy+ogJh0Cx1u7zVL8kKi2WtoXt9U/IcrTGv9nJ/uwlBN89wE4JuDm9iXiltZnL+d0r6UizdpVDUqQluWRD7gAfaYCWYWO690A5jNg3bdLG1SgC6vjwKXVIpRYXJLIzpZI9b1CML6GtKxQOwlWLBlpWi+WkQbtfv4H4YbbxengZfvKYKL+mTCH0y5DvEDuwDcy43NH8IhxcVx4ataUZkJaYTJkYazBGsaXX5Du4rZjTSTBDqhLqTNhusEbGquRVAChFOsepscNdHujBdbJ7uI/2FKVrKDVW1lXJJF1Ro+kwcp798uPyyHKcW4X84Tv/hOP2H4/SLdpyij5qiq4tb/9FMYDNj5T/8qUf6U0PkfMaO1gbdzuePYIF/OGEP47TLFn06/8NF+w8X7T9ctDsLHnTRakoqxUyIaYLelHbB3nLv8cZr+kDcWw8XXdlXen8U6gt3E6dEca+beNfGY1JHtfGuf7ttUnDqf8ZNOQxacMbZIx6uB2qD9ol1OraFvpeTFpgwHubmvXbc7dXF486lXggZiTYrRlZOSHqbU9EFVRq9WLSi8Qzdvnt7c4Zu///bM4SFVXR6YBdSmdXLGTpvgRMs0JwijFZY5SB+XWrUGcKoVNJIIvkZAlFWuKwquejLXKvkb7WhBdJyYSyQGbo2KKdCGrpjBHhJT3ClG9q7n/bfKbfN2YARfQLXrLHTZj3rQK6p2ihm7KOlKjrg1+EhHbhCew6qy0J1ZllrQG5WVDl/in/I0AprNKdUIDnXVK1pPtyf2kk1O7SZ4eXbu5XxuwVYC7yrsoyvPrZ+aImONqeXvWPet8K+W9U7lQ/WVrujW2vLVdoFXgguTeXpr/CmuThg8xFZUG03Le3nPdAIvZFLdEntw6bCG3GwWB+pY7dTwwVz02q7JDJgj3Bi6nuSuxtPpDAQwJMLxIQ2WJgaDR3E0bDiGATzvic4hJ238e0SCBsvTnHtW3PuT4zeUfM7M8I+A/70ZwPWaDarV7LiORJ0TZWVoDXflVhpit5Sgy1qGC2ULDpLvXgjl/rVDSZ31OiXA/CXTFFi+PasiU9h9J46YeE4XHTQnAUJObQ9HkbJgQnVo+QlLRUlYDBZTHK6YFZtkIIDWgbPuVXiyzBWhV72Ve24HOjP+K2/59eX37mYnvfy1Iq5+xa9xwQiyO681OAgYHcMlDbHLfA9exwlVoaRimMFv/cHOxvljAHoozglxBkDyOOcMnok62nP5PU/zmT/mdhV0xzI066vnP89g430j+XZYLfGxwi95Kgp6nTf54ibJVuq+/80zLTBhha0Fxx9JshB+lFGOO7d4WeCHhWm56F7JoitBl6nZ4IYE8chllZjqiXH8+W0nOJjpEdasi2oixjEsqFG9JqQndn5Yu0WsNgM9JCBkvA0K6KnhwygH7Aixqk4CLxOQkXR8aoEyefINdhmJPKhAAUfTT4yhVpdDWIO9f79n7a7Ru2FFMQ+DtjI527ZjoibNUsrDrvUvbDLsAUjuHuf38ilizfUGS2VyKkCZyn1gmqw9QW7pznSFLKudn68u4YeN1jqQxjAfrLB0hzCAPSjDmXoCYzvXzqOMQf7egRNHkeDQUg9CV/+KrXpikje50hNRc7Esv5Qh9im40P6cujLjmGwwY9GCXt9s/6hyeEfu+594g52b+SXStz1T6nJ+9P/u+QdRJ2TyIa+XHCOtK63LEcYLdmaisZJ9uUqApZEx/kv0log+XNU/r6MiMaoQ0OW20zRzwnOuhs8hAOGfft6syu3NLqBi3TmvdkGow/bkiKChxJkThFlZkUV+ngtzHc/IanQL1xi8/1rNMcauKgOkEE1Aah+B/Z9jLr7Be8bwqDpjM8I/oVgItwk1nG98hfvYJBqg9WgOjOa1tGRaJ1tdyl5ffNpR9/DUL/WP1JU57a4R9SjDen21HGqdsSDwhnFlgxqL9xvdrWVA3RIpX/tSYy4vvn0U4AE4ZwcFIEEDUZDKsd4fVpGHSqOx74+K4pzqiaJXf8KS6Hry6dESR2+3WApgDkuVvqsnWycZMn9bLhWtK5bRQsuijVdLiTnlBipvkQBbKl3gpwby3NMI+JIR3OL6Y6i+kb21Ra0h9DP0OIryPy5qKqF1JDsVkiB5tvBoSGk6OeKaiiC0qwo+dafk/0yJOpSTFZIs5yiF39CZqUq9PrHH19CaaimVDSr7KHEs1BeH0AJXUqhaTpSkC+GK1yJcO1TqIq5E3r2KusgBPQCz+WadojBRDCzshZv2iiKi9H7Q74YtjkxqWjOqr6eFoNQX4U0x8axwBaImb9Vr//03Z+1E+mvShCgNdJ/G+zmb9YefIO3VKHX6EoQXGoogpcCTMpHyfUQ9CcGPwK5laFVvn+N/sVu9wx9/z36F0SkgpYXcExu0TP037n5n/aLTKNdonwVPEIh80DR8DOxdcWGZgRzPsfkLq0G7JCrCwawcXaFJSIVeSmZMHV3kSCiwBwZVUomyk9r9UFdUsIwB4wBU22kspq12Dqtw36wxpzljjFCSCG0kJXI7QvDKSDPxNIrRweTF3dvxAByjFigvw57wkYjp7DlEufP5Z3z6CDN/qCooEYxErA6vCnc/TLYwu65r4WwffaxaTVauaiPbYZ+lRt7NEObkwkklTXGjER3lJYHiPYsXrwvhGhKQjHYmuVZnirqelVLniUVUDWroayqcna0twvXTJkKc2u07/jeRcDFwQpmzW6IlQMx3C78Vb++RMpKaw0OFSAaVktqmq8dpIRWiZKeTk6JumZ/HyVUklDQUPBfX9a+1/e0kIaiW8/vda+c+XZMUCLoNuICMV9A4MWvlOmSs5SZDc/anNdsoPY/C93MytyE/A63zr4BdZmm57raavFPyH+NCKMTLwvGTxCjt6ta4+jm4vzG676+KJcVpVR9jRfBE/nFpUFUz8P94ds0gCE+bL6GnCt115Sv2p+0BrvTc8Ayn6HXP/6ENkD3gmKBMOdhXwE49UFNav1HaEOV64GHoM0H1gZJ0SsX2SXiydXEL5uIgbuaImzrafe7VDkQDrKaKFkJyeVy2w/ELZgaaLEI/YjICitMjCOivdRbwB+c5gJVwuf08B2f+WhFbeyCbheoTxlE2BO7BIuisEqmFHUYQeHNqEwDydpTKzEBjdXFKIT3OUhCoMcjQNQGixyrHAmpCszZH6H8XqmKIH1yn+VwNIlkNR88SY8iUot1g8wrzhYUdhww8DUlUuQjCnZ73Jk2Kf0sezbEBJFFyakJMsCoExWDAm8U64nBTr2ZMidi5Fu7dpCdx1h5lzNH2a+QwqwiHVNbnxor56XNcspPRPgrkacguwX5hxSpuy3sEYt29VrFdOm1H/oUHoioZDf6HBl6b/zlQ2uqdKecIt+XBxY436cy25biWNtsy/SIVDnN072DPsnGP1O6WbHWMepMm+aL3fj68LVSspgB1AqK8jWhAismnVpfVNywbw2jCuGy5HX1S9vLpsACL0OluQhxCO/stPWpG0ohZr7WSG6Ei4wZXJR9z6DHGPpvKjlMPmJGI7Ji1rqROdUz9LbSBsykLlB7K7EZycvFhh55SHsF2GJh8V7TKTQhOOR6QUc7aAVFBXEMga1qnbM1y61mA/wQFmS3tSD70CNeeJP3JVOT7bA9TxcLurecyAzf1n2vjAR9zSLlmjPu9Y1GPPRRF86ZlcaNPJsNlmzSyWQVWwIVA0XuqRAb+se+KqBBfq5oNRkrWe52XNTKxw3WCJDIR/gGkPsuNlEjKgU7BE0g05aFSfD6LosUuJZZAlTLLIX2XMYURbtAX0eHmkBX6rwipzEhe+Zj8I0ZPJePenOOFZuH5NoxwYL2geh1Q4jtCMJkoMTHUKx1xVOHnUasKFkZIgv6yuHQGC+QlT1ogIksXzgS7BiQIwxC13TQDneyjdWr+yLATmRnn8snbfHioHege6WbShcLDeJOJSVswVrDJ6zd+lbuIzzldeX02UyBA2hcjCxvCyZqF1XugyxBvL3ZPNUhfNq10ruWoFTot1ufGst0nRDQ96sh3xe2N0AB7VRJ6lJqFlFwPIi3wJwWueswBan89d0d7cJTcTNsmH0qUSSqgipGHiuLgnuboIptz8a6lWzNzXBiyd3vwdbWVORS+YTZvTuT87+foHtNHdoNtDXvIpa+FnxAbitB9yPmJH3KXnVfDS+kr/r3YsZ7uVa4yS0W0iAMYyIskuEEWi6XWZ2ochKhXjPio4X6FD1TdmTfv0O6FXSt3h132MWqlJyRberbs0cu3AACvrm24NsRuRwctpSYgO8rTgGxsDiVwtD71Bprg9C1cP66th8qznNt/wWPKox6A4RCDWAOPM5uSmbWH9eZQBaMBS7rkZxNrxBsjGLzytCOhBjm6PsBn1Zb7z5/YdGhy/4EsadbLW7U6/Q3BwzBfn6Rnzvb0d8Cxi1UgFmC1Q0HdZvzpdZUzdAtdYdSaapmeEmhlbfPdF9IVeMwgF2DcXo7cUO33O87fSukQnMlN/az+q9e13Rm12g/6ev8BisT203XAI7tUfF3qj/Hd7o71czqTXilZEl9QDHVW3wuEOZUmSa7SLWL+r+58JYXH50mAJCEFFCYcySk+FbRkoIlsy/7AcyGKZ+cevhoY6+YZkDnK+YibHX4Z7CzDTMrryw7WY8uYcE5VJsIJMW3S2n/e89LAEpKFlAcE+4bd4KBrwABi6RcICsdDKN6hm5bmdIfbNCtrEqD8YUr56u0NWJcyahLtsm9+PWEx4jwSpuaIf3/DI4JfsK0PUlfE+39G1bxhU/HVaDJtR93w8IWvWvLlE4p+/qQ4WWxvAQsENZaEgb+UnsaQXsSDuwNu6M/I4zK1VYzgjnKmb47Q6WCmSgwSuzrsKKMFT6m9vKRD72rs1G4oAaGmWMNXbw0NHJwvQjq0flyJ2g/LK3ZmYqGhk+Tew9OpfF1zjDBw+TEN5FFWQ3vYIJjw2jDRC43Pp+WSEFoac6aTIpRYgy2uag436LPFebO+ZnLAjPhpYboLMTlyNPV9XrGUpf2bN2qhG+YuKO5rwWqE9GxBu+UN1DsJ181qM1Yvu/g+KArRFJR153s5NwSfQRq9H67PRVev5Xe84puh+16mqAzVQXrD3ZK7WL1awK2jv/3a9rfR9a0F4ynv+PNln+B1ZprrGheEYrqyBENu9s0VQzzLPCaJntEbmHJWm3uv4+dB9C+MKN+AUru9FEtB2J4jP3q9qFbYb1qbqhVCwNVhhVZuczfusamKTO8qCH1WoTZjTTLzLQiMPi+/v9hpSmy8lwgBjl3lYAR+fZP0AivRc0XELZD8Fxh5+HogxN+1bDP07N+sYgs5vU8XbnYebB82ah6xOsFA1+n9vR1tRFAYNzjN02ANHAlLtzqrifjuKfUWXDJXeMN+ZyX+foSvXOS5oVv3IDctD1f9GtxexnWq50D+hS+/I77+foSSOpL3hoxMfQe7EbkXBqg28LMMZGVBRumw0bqWm9T9rLfjer6Am2nLuz1Y48MR0586S7aSbnXlwc12Vj+uQOarEXstchbjXaGLlx9pu93yt0H+7VZQFDtfuO7r7w7bl6ZpnJTmuYxqgSn2lFGugdlI9EaK4bnfFAF6JoyMIFKjkcEgaZCJ+2PsnOgXVXVrTyzkspqGHV9IbPnfPvq+qavQyPfMtZ5FMbqso8cKPjgWsg20uKQRNfCoFu2FBiExQiLllKlbF779UB+WSa9qXU3CV0d4T8tIt3h05bLchlgnHe/fUBMEF7l1IozP8jWDcJ/cVUPML5xDhEHFqT3LOwXgcjc5LFNcE61T0sYM6bvrMp9BF6PKMXruDHf+afhPdN3e0KuRrHlkqp0I+zCJPvUjQV4HNyIZkX1SvLcco+z1Ucmje6E3ifwLAxj714qv3jvdIyXTTOO68twGcmDo/NEFmU2cd4VnIrPvYIxrs6/p6v5txYdKaA+deFmc+cVGbPSvFp6oqyxLuaNtJQKOg9YuV7jNzIlzg8iP4kCOOyqv4DZ5+4hspsYaY38wgpRjN5iUvdTDiu3VgRNasdI8W2toKr9UsjZmtGHWiuKdfTcYG2wqWIpzo0/CjN+MrPDLj6X94jlr8bfL/uyVlNgaDH6OGh87O6CxSJ8det3LPH0vQGTXw7n7h3znDEhq1gxzk4diV5Gv1NWksZ0Ogw8sj9EBpy6M+MOS5xzbuUe0hUhVOtFxdGVXR8RmVNtWaJu9hu2LJjI6X1kAnCmzXGa5xNlCywMppiqkZhTBfHNAivGIYMn4MFz8XexRBiI+K39bXBnIgEfyrlrLnQijdivjl40+ZwlVbr0RbdOwgxI5lWENiG+7vD0cqTI0Lm5hu9x6oQSp3w1SV7eV+W+bT/ETGiUU4MZDzgZ5rIynd+NbE3yyXMza48tbvLYAI/xh9TQouTJsnnOUU4X2IeAfOfLOobvszWtVrymiuMtFHIZ6R9X9CJwI+0HYHX7X9NFXQXufPXaMFNBY0YU3FhrGwwbNj31ukaNYnX8OwTHxjSBrCKyKOx9SsNGFw46Yp1k31LJNcud/6zuIldQPZoIlUtyfKDx8d6yXxhvtUbSzcsLqwb3JSQ9nUbW16unlfV/l/Mj/U5Hb+9/y7kPwIRvV8nSNc69hIRid/K3N9foeqBQddFI1rXWV5fsxyBiYVdTDbuMakg/xh/mc6vDyr0TEdlc5qkrvgYVd32lw+OCLC4j6tEqfrcEFzKYoPK84wL2pcMugbaJh7Aly5tQzogTr4htNQ7KwCO8/PGUvGbfZZXymaqne998dN1z6kAUJGvcU1J1vQgu9WtOQ+WtdRemfYkbEzhCgl7xfNch0lRX4jVmHA8DGahxhSOor1xQpUYmLbg7dIyvP17czRsrhW8A5QKwgy35dAPNlrMRiciKbF7l+Ta6f4YVWdQ6oA7cStPjGp3v9VLFh6iYjNjloFdil+lqioIEprvZq67nKq5yZprKurYvmscoNNiurdhwoqQNL+zfpMsSi03B9WRW+cWnK/TC10p8qrjVleeMQwEH5IFd3ZdS22++RN8OHQ2iH4W5E3IjdgwhTUkFzSzWu9BHJm0SPIELrp8WelFXub/zpUlv6BKTLfo4aq5xNlf4FEX5fuEdEjOBCszEQuGC7k3HKLGCqb3p+yTsKJc3sCx6J3OXHN22BexknQWQQge0L0gVsIRIZSHt9o17Rzfo10qAKflW5pSjF0ysZ9+cISbJGZrbf1H7Lyww32qmZ9+E44uGlNmC48Hk/Ng61K6Gf3GDYFHwdYGc3NbDr+Rib6MGI5Ni6v4693jWbRA0VZaRgwiti7hyt4fZp7e/Y0XRB5cA/M03n97+fv7+6ptvXM7tGivMRnlyI9VdzJLlgxfs93rBboRt1AmGRWwlwtfsxO1S0jwHmNjnYpvAhFlIRYVmJKYA6biSEmBcxPeCBOIDsYBmG8yGw4mf7B2A3uexgdrrE7tEXVfzRJfCzHNtVOzKd6jXTuYQ676l0d7RuuYjnZP02GKXdjDYQKXxxSZt3Yuvd7EgFmzU0VRvNZkj9titBrsRBbbZL+8JC+Wj+wk+3nFhkff6//vhqq3K7Cb/nYTF8o6P3iOyF8mTMEcdx92Hn5QTJG3tnGzHLn1hmoz2OssO+mS+BLfbgHMPR6brltVsingYFH0tMOOW1nUzlxsvM64vu7Vt0InLmoOGLgMtDMazCuuc68yqiEfs55jEa0i39tVHF7IoKtH3RA2wE8c1bnoqdu/ovfl3GtapG9z0cZr1U3G7xSL/NxmOmrW4GWzYMZLhydgNF95BTle6ZITJaFmiU1nwgP0GKzEMOjx31LUoykymEsa3797eoN+cH7VNSg0j8nnSVILb/3iDPldUjfRurbjIFO136kyb3NBxiG7R+7roLJjW1WjpJOJD2gUqY48RsEDLoxxHh6CaQHDsyXDz+AMaMMeqSHBaFmwC9wIuIxYgN0CrPNpU2h2Ycbtd7YDOselrhU+FO6eCrAqsYpWVNHC3JR6ML35y9AmTQTpVFJjZKjovELqIW0DVAF4sodVSArBy/vcEUEscfRKG6zgVnb0g6J6x2A+O79xWUKt6RkdaZJjAYJT45ScWthYRjfcO4PmyXP8g7s0q+vtOREaMynIdte96B7qFfFzk6QGA1xxHlxgio2LJRMSiyCHoFLnRIltkesMMiS4/RLbgcqNxET93pQtbmHU66AmiLkRkTKQUJ0yUVBXzbbSE9wHsktylAb7GPAWvsDIrlTQyix+SAujrHzLwOMaHzZPdTS6XWZ6C2BZw/Pw3IrIC32fGxHIb7AK2HM1pgkehYCIR0kykQ7rkOuNznsUOi+7A/lNC4NE7g3dgx+6F2IUdu6q3C/vHhLB/Sgj7nxPC/h8JYf85DWwjS47nNIVIaaDHN89EVlQclO/5NsE7WQMv7xLoJUXF2bIo02jfVsvEfBk7CclDZimUEk0/k/i+EZFpl5CY4AS1ImmsSQs4jTWpt7oqE8wiJaIpq05iqhpprOlB7xOIECONNcxSwQazJgnwSrB7gYXUlCRgwvVPliqJHoX1T7I0K4rzBG41WZQZ4Ql82BZwgiAJwFXzrYnvFrWQdRLIZZUliGkQxQwjmCcoINIZXlJBthGzrrqwBebbP2g+T4H3OoM2oEkgu3YwabB2ibVJoM+X5fqnND5onc2Z+XOSRmNEZ3FnxfUAKxldVOsk1xygUqLiV7lp5+OPNmurA5ialfPzx3eOOOCg9iUB7rrJx+sg14G9YJymsGF0tkhxiGwRszh7F3AK3UBnrIQkxSyJqGPl+odcm3LQzD8SbK1IEticLWgKM0aDo7mgOYtWMLoLm4k0XFLIvOJUE5mC2h44WyaQTbLUG2yizvzvQA9lkEcBrOiSaaNwfE9ICzuBxqdomYrUKhmtNXQiV4nkq8vMdyyeALpRFBcJFElXCpQK7XTK9WYlmc7chNn40LdY4SQMno8UwsaAvHbz7WPDZdpgEX3Oca7NvFKxhgXWUKmbFZQCahUd1/h6dF2THBssTG5YxB92fWyngX0wlzjPY98BlscOq9atgxK8RazIiJKySNKVyAJOYKaxIkuTHOk7HqUgc3kXvT1TqeO3LGWlLhWLDJRjw0wVPfuMM0HjtdhpoeqoE3UauFB8G9+txaXrepotuIz+nDfAE6T8W5s3utSxQBNIHGtDJ0A1em4Cl8skrCuWSS5wKVVsAVbMq2WKa1YwTVKIhUInYdgUcyAENdBcKTrc6DLcNYCOnfHnoMZOxxObTWwLJElFmXQDoKNbojK+ZiQVW2aBeVxPhrsRVMV/s8rMDeWNDjbqZOoWrBvxmoTJEhRu+pk4sYWBBxtbGpSZcyRFRxdrbT/MyCpWnf8ANL0vWfRAQElVsVRYmEHP3RiQN0kAx396XSeyjx97U0AjAFZymWFdRhwY0AWtcGyoimKeQr9TlAAdXNfRRMDjE9lCjtvCtQNZqjwBxvEdmTqBb1g733CCfABNYycCuIHHCYwTTT/HZ4BQg9ZoUBOYUpotEwheXcb2smlFUtwDRfLoirRWJNQVNwJgE2/EVhdmpaN31VwTEbtQIjgt9qlAXZPO2Ns3SxOfrRzQ+BG9ZqZnbLjbMnq31iqfJ8lDrxRP8BZWmqosZ7Gr3pOMragjQynIYIg2uIjtDV5nTGiDFwk0gzVTJoUavi5FgtZNRqpKxHSzhtqiBTqKnldGoveVQIOlm+yRhMPyPmHOcnShaM4MusAq990MNbR/D6PjJmclpNLYhFAAA0P0EfQ3IJKjUKlOkw/BRDrKXRUll1s6GCx4kH4LWUVr6v1AHrM0dD4jmHem6JLeowL3Gy20sVixrPrDQJIjyZmG4Qz16v7ooYES0lVZSmXQsPEoQpsVNogZVCq6GGOFJ6TlPmYIRYjw3upoUEBM+M7uI32hOROpJ/J3ULWrdfHUyMglNSuqZu339UpWgxcNIUHXVDXjiIxEJVaaorfUYJgI7u4qbkjw4o1c6lc3ruz1Jbr0I77OkFkFphRBM+D31I8+BrQFekfN78wIqsPnPGTqJMRbwMju5hbB4m6zmmJFVjMmWBA/mLk7QX/tnviEWRiQDPGK40rArN9lBXNc6ybu4QbuvX7te/aUvh13s6emCbefXzxi7NuDyCLWND2s8yosiz7QewO3YsxdMMU06hGB1A6uewcTqgUfmXgJ3XMTjgOH/rmaGqTo54pqs6dp9/HZyo/vle9UBhjL41Z1ErvvkWryTnfdKftwchhBbGzn79ChXf8c3HnM2f+H5xvaxa4va6EAa4d5A6yGeEm8j2Rh+7jMsabIpWs32KDBrWpOyf/iNPiKZhR8g7lUrn19kIwIYY00pTDuDO+fV6Ww0JhMMN530GHaLS1A7W2ZhlQKJqDtQ7qkqmBO3ZgK6XZJN5iDrRmnS4o4XVOOsNZsKdzBtfP6w6wPLZlPKL9h/T2cPj/JpGeLWSXY54r2xyTi8OXr4Htcx8TjpqDUGg3L3YUkUggKuRVow8xqTFAgFKgMaTR2RY8qL3q0aWHJCfKkeaK4XDKCObIYjJg+gMVpsYOlRsY0no525Wqrw+h10tk2spfVGvuBx5xhna1kcpvAGXGNuQazVNqhRlYqdkfwhPsBIHdpLLbwpvlBLIRTrGbnXEtriO/ct0sIlqNf/S9m6Fxsm/8bQDdgy2thEM5nRBZlZagKi+Ekbny7sXTm2Vf9s4AZizsHwszfqtd/+u7P1va97BxHTbGvgmh7Ps3iRswe6rjBW6rQPzc+Of3KowHIhW997Pqf9DwvWpx3uH7veRyZvHxItn3dH5hi15mhd799uLJ7p4o65wn4S3OmiaIlFmRrtUqvnvF+LggCCp2hD29/RtfCfP/6DF2/u7z6z5/Rx2thfvoBvdistkhQZlZUIbKS2o9Kk0pRYuBb3/30v/7by6+DFKFmlVDG9ekBMnVW4PA4Hp2Y+x55zW8dL17XSIWveP68kO7KpgOYH9kw7sEPfAjfnmLaWiefmDIV5ujN+bsgsn9IQdP5so7jjP8jBZ2FaWvR/WJEKGzksPCEI3iOb/Cec1hiQzf4BCPSgbtv0HmeK/DTOi4PodM8vaQoj41zPjUWcn3x9sa9SqPhsQLrCaMfO04lp6n6txtd31hURrxfloZHToKIQkO79jgNa00sc9O1phUQHXRxnjP7ZczbgG1nln/4nZuQAaxJCBdc+ht+ucsCA1TaXOsket1DnzSM3nkMb6QyjUgeCN0cAmxwAMxsD0tePTHt3X6YWNaPSb2tt2OEFzRkN07lxfXYgeWLtZaEWZXT+Y0GOg6ycllhsaSzxnQiUizYslI0R/MtwKQih6yhsJwpj2w9MCgaHdGWg4suEvQ74BF1/24JV3QHgKKFNDTzmd3x84zikzYXOsOZS8VPALo0Kg3wRQKWWCSoFuYprkOq/idlAqLiPKs9cenU8r4Fb/cx66/WdSacQIO9MiuqBDXow7akZ+hj/Yy9AQfY9+imdoANXoLfxjS1elTPBMrEiGlcI+394mcIcx5UJsr2i5DghhUk5q2psm8gE0YibeAxZwJ9vB4VKAQSZJPJq+gi2wKVZYKxbxawojp2Rq8Fm6DExb2IsVPRwd+eAFs3WiHjVCyjT4oEnK3ykVALHdFAncqDeScAIxCBdIIFwugXqTZY5cM53QidLyHZSyFsb/w95NLNqdlQKsKqZ+SuiY+NcUuDeTdU55BB0DIeMiMGO2TC57lCWkLBjBVLfsRGeItrjsUUcfwHOCjrBJGOi3KwwV2XZRtJWVsLdgkG7O7LEztSSQl0IVjH6wf3sIg9VoaRimOFoF80qpF4cXX/8xu5lItFePo7JZlZ0eTHu4PsB7ugu40dvK8s3hbd88qsqDA+WXwUbV3F7JzwsIQet+Q46h81VaMIy8oQOS2l/ZLjCN9WhFCtR3CGzuPHNUc7LvEE8EJWxV1KtUWBwoQBblMIpx0caQ9HK5UgwKdLKey7YuVWSDlsfogGitLurtbx+tGNvJsYua6lUDPAGc2b/Xg/TE8fZgJpZqqA/ERQXEC9iPZQV1gjnMvSvi5mRZlCciPaI3OEM/heClmM5NXCTA7NXIv6aZUIq9wzkVv5I5VuCIDRL4xTdO4Rmw3I8BBnr2g25u7kaMJ4s/+TpCuMkuDWZy3EpUJojwFCxKx3fwIhXL7era/XiE2J8YTQuUxZPRDY/Jyu8JrJCrRLIotSyYKNZCjSqZG7EnjOoYhsgS7248bEuhE7CZHsY7ijdaIgAjsYRh0ucwSCgfUb/FKfbueVbe/bKNu1ZZaVMP1yttgafQ5l4Bk5xqx/kBYE7/GSCqoYqbcEBIFEv35qATMreGpDs92QR3ZGvptpo8aDn/Wejmm7dbI9vd6/J69euLUS7itomjZGuGEF1VauO21P0ZKOBpH8KURrCnHwIKDx4BOPQT2QtY7p3X0y1vr+YXv6LtPRhpw+eGveYXxoh4O9wY5bgfAAYfDl7u71wd2pSc/OXbQoe1OHTy5aL9VpBMgBOd4IkC+XHb8/fGSxRhtMc2QPk49qUgkS8449QH5Myo4x9zZgxkaphxK0np86euVOZVZZQc1KniBKgnc8ycih4b82euDQS0nJpF6nPVGd95J7f61FZA9fJvKE/Ofsxz/9Cb14c3l+8xJdMm2YWFZMr2gOpfBBXLhcyuR9gfZFwiBbduHw8McMXxzJGFMysVdxX/2nPdUQBs2NAY98tKHPj7kuBNL+m7rfjuMPcArFTLEItUlvM8Uwj9WdrreR9zhnlXYrIKmQZgXjWDnxZMWmvUME3vVweRXcc83yKTuNdDPlP1pGqL2Ivb6Y7SVPV2dxLvbddQhr+ErDjv/XO4ngkwEveMcN7ZRl5GFXplQpEwMGIRsgtVRLLNgfe7KqRTpWeCixj6B0l6dGyL1gKlhLmqjrzy92OXgtXIsv17toJ6v5V4q5WRGsKCoVzWXBBA4W3HXE0w02jAqjD6bHczzlbt/gk27WtX6kZSLGtVfnayu4SqwMNENqt7pfrE7Y7MgLm4dI1AXNqcKG5lm0pLI9/GGFzy/1ik3w7EbJNcub5mH+e7gsuddUB4zhm//YZ21Xpw0rOO0mWT7RLpslfa8/sx3ZZnB4KGROrpmLnq/6ivtIC7hG6Yw5FPyxmie9B52p86NOJfQysFGno4LGijXSRion8S20ghoMq30N35rZb30d3n3B8pzT6aTcW1jvoXIucLwduXeUnKvHY0yz3Ru/WqfDkNjW0dkzVHJsj8y+z1IhKojalmNefkiFnMCefEAGnWpsy1+lNugtJismRky6HCeSHF/1af1RQKZ/qagVH1Y/ck3O9Ay9yXGJPsH/OP0ol8LVnf5t+HiiFV5TqzlxihX6XFG1RdCDUJdSaFprVOHiVLvfDH4zjbz0PfCIhaxY3QVSuO27vnzjeNZbmgDVloHe++aoD8UUpjyldZj1ebxuLb3TxMjahv7hZRqpSoigHavPmpfHRZ5dG6mRGjsPMfMWZvqDwGjDRC43GumSErZgxH5yFqoT9Hmywwtit+fwbXNu0AvoCEsFaZ8hCF2+7FALVQLe8Td0ickWfdS7jW+bCGzRL6SNnl1rV5jAYB957bumFqACtWrAZPZFHFC86QMQqP7fqTSFcp4h+Xa3nV6hHuvO69TrwI5hh0FG8785YrPT5PWObdVn+HrXey3rrmDr411Ah7uZxmHXBAx2z6ZNyHTHMDihcEOKw8XPUDYQcyTgaIUbbDmnCya8rx6EE3T1K3A50nQQsDuqUCwRbq0Dpqf+xRaMjc829d59L6WR3pSND9sYTFbFxC3w21WB4GhgHXWPI8mQlzkT8SaIRb0bdstQVJj28QwIqW7ZDhyLa6PdlvcHpnYOsE779h3AusSq5in757N2K5sVG7RSR/Z2WFvWJb8/aHsm+swS19ZCqm26A/+LLrH414MdY2pEdruo1+p56GmyZPnLK4B+YG8nU4kGu6r7re/f1SgXZFQYJctjREcuq/nAufAgHvdrWmubHihHABxddce09/BCFiUW2+Y+wrWDcfrOXllTZZ+hjImFDCsFWN+lrhE6ID96VmSN2Yam7Yq++JwqR+CXivMt+o8Kc7ZgNEeXUPfsnINBVDZ0nhEp79iJgu6/0zly67f2M+Zj2nz0brNtOLysDKjcR44wPXzX3zdL+Ck73h3tfPIz9GFbuq23ngNLHHeC44en6CKL2ky2h7bFwTki1Nc61La2j8wUrrpGudzFznkWS6lqbz+EmN+/GTnyTq+cyOxU06JMO4doDynsygc99zWaSspEmsguUnYdex6oxCbsmiQiwzpmtL8DWPly+siQK8UjHnMHasRTaYzRrFKxvCEdmJqqDC/j2ZQt6OjP0y7oqOmPu6A91ycQLPTeUAGqVXzjxMKPxs2NordStJcqE1ujcktMUUu4I3M/wLKgXr3y/33hUXjl/8PnNYXc/phTFc7O89s5YfTcbaYbPAePa2fU2mA7uR+IZk0qJhZUqZG463Dfk+yrq/gfJH3QPTsBknVf4kXnGAJXCsLaMumVCiwxGftdubi9ZbsPkEGsun/6Kx0maI0P/GTliqpp/BFWZ/cZTy8uYPTjS3QB64dRo8pM1CxlhM4XVPnhn3QnC3NPc16aNHTcIWTnwO2iX+tOp+i9J83+ONYr+fjWKOHTRrfsj7C3ht0lkinXf71Cgi6lYe4AyxXWIxOgNJm6rVDnKN3i48MF7VEnmwA1SHDp8VjdOL2uvwknpGi2nKKiYre/UTP18MPooGUrTZjWVXSlEyBDslQ6b93TYiiAIVUqqQ90cChd6XllF0e3EJzeJ50myZBoOoP7KPKLW0jt3P8YdaTncUg+XnruwXFchGrNs3XKF70fUvWO7CAyeWZZD1fR2zTqVIDZHfUWdaLmBl+140q6DxLI1h+QhnidVOj69vyvb2/QjX2n0G9iZPpKi22iSupjsP2wkWFsQQyRFSV3+ign8sOEcNoeZKGhc02/zqZFGKSB+hGErRTco+VSxQZNIU+g5Do8mq4go0YD4GywqSab8NnFco05yx0jBpDoC8LJulrvE4RAsTu61X2xHYnz6wTSyLBXxpQ6YzCDNgloOMoUBCH4GdwmthR15YtUzGwP3CgiiyJpn7gH4u3w8A6hcAn+hinK+5ZmbBfLhmORaX2qgbd2ZSfDf/e7rWu0gti6UuOslGyKtOoQwg4DBBgAUmFrAMhKVliIQeOM1O2m/KqAyEjMdqK2zc3D4mce/v7m/J1/9171lm8eFCNV3/cfvWcb03fZWvIqFQHO6znOws+5aSZj1+N8K8GMRi8cEvoldOuAwt56om4PPAKkg7vhVSJp9sbj+lEw49MFZrtFB2uqIFNgUXFEpCC0NNZQvnVnONJeYbNJKX0d4a3BXo/QtoiWUhkkLX1//bfzUApukOyx+U6q5fQJlv0Cgx0X6xy7ZifBRjH/fvXbzfUNeovvCybyZqx3+Fjt3iZPw9wZojiyLb+Nwe72batRn8Ili9HTs12VY7aYrmDz1EX49ZaTqx07zjIvla8vfZdej8VeDPl0h3LiXgH1jov/8nXDTWGOyIeaZOzbDf4Sa0KfKLvRj6sGK74J6hauuPcM6SqQoo41+os2Sorlv845JnecaUPzv7zyfztrPmViQUn4owVTdIN5UJHBc975DcIiR1qiEbZUdMm0UVtr2U8pLEpsVr5Zf4MD6uMwQBKcUlOh6QqhXb0WkarThbzRJxvMqTCdnJQabz+QcdZMU5v1Lv847mN453SBK24yuBM/owXmO6XIO1vazeB/10mOqCdFtiPj27I1o/BiwQgMEphTKpCcQ9+ITkOv5lw0fsRm+hf7wFaGt75xGVusRWJ1stCp2ySNSBSFN6igWuOl70tEpJXfMMAspEi+kUt0SYnMR8I+HlZ0H5Xr+RwxgamH8JTSCIow7YsmF4gJbbAwNRphG9+wox7xfPhOBVVxuIfMWrfG1Tm14wnQytq2MGH3d2YE1bo+/cNTEARdU9VtUFFipSl6Sw0GTd3X3DZLvXgjl/rVjUuqfTkAf+nTwVq1AqP31AkLx+Gig+ZIJxm6TuLCeVq0udDLtMqzP+O3/p5fX37nAy6u7VtrXUNPgHtMDOJy6c5r2NcGdgeTrD23wPf07twh+3t/sLNRzhiAPopTQpwxgDzOKaNHsp72TF7/40z2n4ldNc2BPO36yvnfs2Cvq2eD3TpVqPRpqCmaMiv26WRLdf+fhhnYfukK7p+GHK5yZjLoR/0c0ds1nJ4RYquIE3WjIsbEcYil1ZhqyfF8OS2nRw2LTUu2BaV56iKQ8bBFt22iayRJ84EeMlASnmZF9PSQAfQDVsQ4FaevM+8Pxg2Sz5FrsM1I5EMBCj6afGQKtdpHBxo1WjX793/a7hq1F1IQ+zhgI5+7ZTsibqBJXUJx2KXuhV3GJb907vMbufRjXX0VA/SSsyaIol5QDba+YPc0R5rCpN2dH++uoccNlvoQBrCfbLA0hzAA/ahDGXoC4/uXjmPMwb4eQZPH0SBii4U9fPlrnVfqOZL3OVJT0XQe5nKpQ2zT8SF9OfRlxzDY4EejhL2+Wf/Q9gMcue594g52b+SXStz1T6nJ+9P/u+RNXPvkadyXC86R1vWW5QijJVtT0TjJvlxFwJLoOP9FWgskf47K35cR0Rh1aMhymyn6OcFZd4OHcMCwb9/M78r3FLuBi3TmvdkGuwprgocSZE7r5NGP18J89xOSCv3CJTbfv95N8yJSLNiyUuP5Le2+j1F3v+B9Qxj0uZZNgmU8Qc+MseyYuproS3cwSLXBKk+m1O2fVO8Ukk87+h5GinI8TE1zrVX9I+rR9s0wgVN12+VDKrZkAvP6N7vaygE6pNK/9iRGXN98+ilAAhTsJosikKDBaEjlGK9Py6hDxfHY12dFcZ6wvH7HtIOl0PXlU6KkDt9usBTAHBcrfdZONk6y5H423OTgtooWXBRrulxIzqFv6pcogC31TpBzY3mOaUQc6erxcB1F9Y0cjrMYJ/QztPgKMn8uqmohtakL9+bbwaE1k7gsQM2Kkm/9OdkvQzIzxWSFNMspevEnZFaqQq9//PEl2mA/SqheZQ8lnoXy+gBK+Lk6yUhBvhiucENVap9C03fVXmUdhIBe4Llc0w4xWLhEpxZv2iiKi9H7Q74YtjkxqWjOjmqacIhQX4U0x8axwBaImbrvD4j0V65NaI30cJzV3xDUi2ypQq/RlSC41BXHTbOyR8n1EPQnBj8CuZWhVb5/jf7FbvcMff89+hdEpLL6sus5UA9T++/c/E/7RabRLlHC7S+EzOmztXXFhmYEcz7H5C596VNOhTT1aDSwKywR65oXME3GptIBcyRvZgQsAw23MQeM3Rx7I5XVrMXWaR32g04zihBSCC1kJXL7wnAYyKChI8DDkhd3b8QAcoxYoL8Oe8JGI6ew5RLnz+Wd8+ggzf6AYZSKkYDV4U3h7pfBFnbPfS2E7bOPTavRykV9bDP0q9zYoxnanEwgqawxZiS6o7Q8QLRn8eJ9IURzgymydcqB51e15IGxVG4+tYBJ/B27cM0UjEy9vtz1vYuAi6M70x2I4Xbhr/r1JVJWWmtwqAxni4xO/28okaye+eSU2J1HMpIvlyQUNBT8bfOr99ANv5nRTBTFfhDQiKC0/9SBmC8g8OJXynTJWeruJc/WnNcsVSHsE1Okj2sa9VB+h1tn34B6IpDnutpq8U/If40IoxMvg3FBk8ToYQSQVOjm4vzG674EC0seVpRS9TVeBE/kF5cGUT0P98dH91SBIR4adYuGpnzV/qQ12J2eA5b5DL3+8Se0AboXFAuEOQ/7Curq5wVq/UdoQxV1YLFBnGJtkBS9cpFdIp5cTfyyiRi4qynCtp52v0uVA+Egq4mSlZBcLrf9QNyCqYEWi9CPiKywwsQ4IlJoX2SxcBPcUSV8Tg/f8ZmPVtTGLuh2gfqUQYR90xasRVFYJVOKOoyg8GZUpoFk7amVmIDG6mIUwvscJCGVqiFqg0WOVY6EVAXm7I9Qfq9URZA+uc9yOJpED5uFt4dILdYNMq84W1DYccDA15RIkY8o2O1xZ9pM0NA+tCEmiCxKTk2QAUadqBgU+PFG09pgZU7EyLd27SA7j7HyLmeOsl8hRfROyPkgQeLJTQ9EfiLCX4k8BdktyD+kOFH3nHr1WsV06bUf+hQeiKhkN/ocwTBuP4Lct8Otscv35YEFzvepzLbtjwJ/OkhFiVQ5zdO9gz7Jxj9Tulmx1jHqTJvmi934+vC1UrKYAdQKivI1oQIrJp1aX1TcsG8NowrhsuR19Uvby6bAAi9DpbkIcQjv1PaiQ8rhqhEzX2skN8JFxgwuyr5n0GNcT00a3j6jEVkxa93InOoZeltpA2ZSF6jrnjWSl4sNPfKQ9gqwxcLivaZTaEJwyPWCjnZuaJogjiGwVa1ztma51WyAH8KC7LYWZB96xAtv8r5karIdtufpYkH3lhOZ4Vu3WW2FntXXLFLAoPt9oxEP/UC371qezQZLtt3VqtgSqIg+irOhf+yrAhrk54pWk7GS5W7HRa183GAYe1p1G3B10SwBuVijHhqiRlQKdgiaQKYtC5Pg9V0WKXAtswSollkK7bmMKYp2gcYa9dFCTaArdV6R05iQPfMx+MYMnstHvTnHis1Dcu2YYEH7QPS6IcR2BGEyUOJjKNa64idqmi8rQ2RBXzkcGuPFD3AZcAgWngQ7BuQIg9A1Vcykbg061n3ar+6LAMdGk/ZcPhMPbnOvdFPpYqFB3MmNum8Nn7B264I5Yz1VvK6cPpspcACNi5Hlg8mwzSTYIN6hKTIJD+HTrpXetQSlQr/d+tRYpuuEgL5fDdavT2isSlKXUrOIguNBvAXmtMjb7sLN3R3twlNxk6VrXfRIUSSqgipGHiuLgnubaPLzAyrZmpvhxJK734OtranIYU7yQbkl538/QfeaOrQrh9Npu4ilrwUfkBvmAe9FzEn6lL3qvhqdBOvFjPdyrXCTWyykQbiZpBZOoOVymdWJKicR6jUjPlqoT9EzZUf2/TukW0HX6mHb70bxl5yR7RTTdkbkwg0g4JtrC74dkcsVT5k3HSbg+8o3/w+LUykMvU+tsTYIXbejAurqqjzX9l/wqGJeIxRqAHPgcSYrLJY0E3STWhaMBS7pphPqByXEGMXmlaEdCTHM0dcOdautd5+/kaHEJY4m7BrK8cGEjkluDhiC/fwih0xXfwsYt1ABZglWNxzUbc6XWlM1Q7fUHUqlqZrhJYVW3j7TfSFVjcMAdg3G6e0Efo/c7zt9K6RCcyU39rP6r6Se42jNrtF+0tf5DVYmtpuuARzbo+LvlBxUh051pyTP2xmkia6ULKkPKKZ6i88Fwpwq02QXqXZR/zcX3vLio9MEAJKQAgpzjoQU3ypaUrBk9mU/TDEXZbePfmgaitPjXjEXYavDP4Od+aEaraxHl7DgHKpNBJLi26W0/73nJQAlJQsojgn3jTvBwFeAgEVSLhBMmGdUz9BtK1P6gw26lVVpML5w5XyVtkaMKxl1yTa5F7/NNBPCK21qhvT/Mzgm+AnT9iR9TbT3b1jFFz4dV4Em137cDQtb9K4tUzql7OtDhpfF8hKwQFhrSRj4S+1pBO1JOLA37I7+3BlkCIMLz1CpYCbKGaKGfB1WlLHCsQZWHwhiwVLUUKVRiTV08dLQyMFPk5ZFYaWY3AnaD0trqCF71T33HpxK4+ucYYKHyYlvIouyGt7BBMeG0YaJXG58Pq2fNnnWZFKMEmOwzUXF+RZ9rjB3zs9cFpj5Qbyw73ohLkeerq7XM9EA+8FoOCbuaO5rgepEdKzBO+UNFPvJVw1qM5bvOzg+6AqRVNR1Jzs5t0QfgRq9325Phddvpfe8otthu54m6ExVwfqDnVK7WP2anTF5+zXt7yNr2gvG09/xZsu/wGrNNVY0rwhFdeSIht1tbqZ+FnhNkz0itztj/PvvY+cBtC/MqF+Akjt9VMuBGB5jv7p96FZYr5obatXCQJVhRVYu87eusWnKDC9qSL0WYXYjzTIzrYj9VfP/w0pTZOW5QAxy7ipBOMXK/gka4bWo+QLCevJrXdh5OPrghF817PP0rF8sIot5M753sfNg+bJR9YjXa81Upaf29HW1EUBg3OM3TYA0cCUu3OquJ+O4p9RZcNMNrnVe5utLP4IbvfCNG+rZlK7o1+L2MqxXOwf0qQb8e/fz9WV3vmsjJobeg92InEsDdFuYOSaysmDDdNhIXettyl72u1FdX6Dt1IW9fmzhjO+Jxx1fNAuj68uDmmws/9wBTdYi9lrkrUY7QxeuPtP3O+Xug/3aLCCodr/x3VfeHTevTFO5KU3zGFWCU+0oI92DspFojRXDcz6oAnRNGZhAJccjgkBToZP2R9k50K6q6laeWUllNYy6vpDZc759dX3T16GRbxnrPApjddlHDhR8cC1kG2lxSKJrYdAtWwoMwmKERUupUjav/XogvyyT3tS6m4SujvCfFpHOXQYuy2WAcd799gExQXiVUyvO/CBb+/MZenF1j4uS05/RjXOIOLAgvWdhvwhE5iaPbYJzqn1awpgxfWdV7iPwekQpXseN+c4/De+ZvtsTcjWKLZdUpRthFybZp24swOMA2ulKUb2SPLfc42z1kUmjO6H3CTwLw9i7l8ov3jsd42XTjOP6MlxG8uDoPJFFmU2cdwWn4nOvYIyr8+/pav6tRUcKqE9dwLgZmVdkzErzaumJssa6mDfSUiroPGDleo3fyJQ4rPINVqfJ0Bt21bfSFfuHyG5ipDXyCytEMXqLSd1POazcWhE0qR0jxbe1gqr2SyFna0Yfaq0o1tFzg7XBpoqlODf+KMz4ycwOu/hc3iOWvxp/v+zLWk2BocXo46DxsbsLFovw1a3fscTT9wZMfjmcu3fMc8aErGLFODt1JHoZ/U5ZSRrT6TDwyP4QGXDqzow7LHHOuZV7SFeEUK0XFUdXdn1EZE61ZYm62W/YsmAip/eRCcCZNsdpnk+ULbAwmGKqRmJOFcQ3C6wYhwyegAfPxd/FEmEg4rf2t8GdiQR8KOeuudCJNGK/OnrR5HOWVOnSF906CTMgmVcR2oT4usPTy5EiQ+fmGr7HqRNKnPLVJHl5X5X7tv0QM6FRTg1mPOBkmMvKdH43sjXJJ8/NrD22uMljAzzGH1JDi5Iny+Y5RzldYB8C8p0v6xi+z9a0WvGaKo63UMhlpH9c0YvAjbQfgNXtf00XdRW489Vrw0wFjRlRcGOtbTBs2PTU6xo1itXx7xAcG9MEsorIorD3KQ0bXTjoiHWSfUsl1yx3/rO6i1xB9WgiVC7J8YHGx3vLfmG81RpJNy8vrBrcl5D0dBpZX6+eVtb/Xc6P9Dsdvb3/Lec+ABO+XSVL1zj3EhKK3cnf3lyj64FC1UUjWddaX12yH4OIhV1NNewyqiH9GH+Yz60OK/dORGRzmaeu+BpU3PWVDo8LsriMqEer+N0SXMhggsrzjgvYlw67BNomHsKWLG9COSNOvCK21TgoA4/w8sdT8pp9l1XKZ6qe7n3z0XXPqQNRkKxxT0nV9SK41K85DZW31l2Y9iVuTOAICXrF812HSFNdideYcTwMZKDGFY6gvnJBlRqZtODu0DG+/nhxN2+sFL4BlAvADrbk0w00W85GJCIrsnmV59vo/hlWZFHrgDpwK02Pa3S+10sVH6JiMmKXg16JXaarKQoSmO5mr7qeq7jKmWkq69q+aB6j0GC7tmLDiZI2vLB/ky5LLDYF15NZ5RefrtALXyvxqeJWV54zDgUckAd2dV9Kbb/5En07dDSIfhTmTsiN2DGENCUVNLNY70IfmbRJ8AQuuH5a6EVd5f7Olya9oUtMtujjqLnG2VzhUxTl+4V3SMwEKjATC4ULujcdo8QKpvam75Owo1zewLLoncxdcnTbFrCTdRZACh3QviBVwBIilYW02zfuHd2gXysBpuRbmVOOXjCxnn1zhpgkZ2hu/0Xtv7DAfKuZnn0Tji8aUmYLjgeT82PrULsa/sUNgkXB1wVyclsPv5KLvY0ajEyKqfvr3ONZt0HQVFlGDiK0LuLK3R5mn97+jhVFH1wC8DfffHr7+/n7q2++cTm3a6wwG+XJjVR3MUuWD16w3+sFuxG2UScYFrGVCF+zE7dLSfMcYGKfi20CE2YhFRWakZgCpONKSoBxEd8LEogPxAKabTAbDid+sncAep/HBmqvT+wSdV3NE10KM8+1UbEr36FeO5lDrPuWRntH65qPdE7SY4td2sFgA5XGF5u0dS++3sWCWLBRR1O91WSO2GO3GuxGFNhmv7wnLJSP7if4eMeFRd7r/++Hq7Yqs5v8dxIWyzs+eo/IXiRPwhx1HHcfflJOkLS1c7Idu/SFaTLa6yw76JP5EtxuA849HJmuW1azKeJhUPS1wIxbWtfNXG68zLi+7Na2QScuaw4augy0MBjPKqxzrjOrIh6xn2MSryHd2lcfXciiqETfEzXAThzXuOmp2L2j9+bfaVinbnDTx2nWT8XtFov832Q4atbiZrBhx0iGJ2M3XHgHOV3pkhEmo2WJTmXBA/YbrMQw6PDcUdeiKDOZShjfvnt7g35zftQ2KTWMyOdJUwlu/+MN+lxRNdK7teIiU7TfqTNtckPHIbpF7+uis2BaV6Olk4gPaReojD1GwAItj3IcHYJqAsGxJ8PN4w9owByrIsFpWbAJ3Au4jFiA3ACt8mhTaXdgxu12tQM6x6avFT4V7pwKsiqwilVW0sDdlngwvvjJ0SdMBulUUWBmq+i8QOgibgFVA3ixhFZLCcDK+d8TQC1x9EkYruNUdPaCoHvGYj84vnNbQa3qGR1pkWECg1Hil59Y2FpENN47gOfLcv2DuDer6O87ERkxKst11L7rHegW8nGRpwcAXnMcXWKIjIolExGLIoegU+RGi2yR6Q0zJLr8ENmCy43GRfzclS5sYdbpoCeIuhCRMZFSnDBRUlXMt9ES3gewS3KXBvga8xS8wsqsVNLILH5ICqCvf8jA4xgfNk92N7lcZnkKYlvA8fPfiMgKfJ8ZE8ttsAvYcjSnCR6FgolESDORDumS64zPeRY7LLoD+08JgUfvDN6BHbsXYhd27KreLuwfE8L+KSHsf04I+38khP3nNLCNLDme0xQipYEe3zwTWVFxUL7n2wTvZA28vEuglxQVZ8uiTKN9Wy0T82XsJCQPmaVQSjT9TOL7RkSmXUJighPUiqSxJi3gNNak3uqqTDCLlIimrDqJqWqksaYHvU8gQow01jBLBRvMmiTAK8HuBRZSU5KACdc/WaokehTWP8nSrCjOE7jVZFFmhCfwYVvACYIkAFfNtya+W9RC1kkgl1WWIKZBFDOMYJ6ggEhneEkF2UbMuurCFphv/6D5PAXe6wzagCaB7NrBpMHaJdYmgT5fluuf0vigdTZn5s9JGo0RncWdFdcDrGR0Ua2TXHOASomKX+WmnY8/2qytDmBqVs7PH9854oCD2pcEuOsmH6+DXAf2gnGawobR2SLFIbJFzOLsXcApdAOdsRKSFLMkoo6V6x9ybcpBM/9IsLUiSWBztqApzBgNjuaC5ixawegubCbScEkh84pTTWQKanvgbJlANslSb7CJOvO/Az2UQR4FsKJLpo3C8T0hLewEGp+iZSpSq2S01tCJXCWSry4z37F4AuhGUVwkUCRdKVAqtNMp15uVZDpzE2bjQ99ihZMweD5SCBsD8trNt48Nl2mDRfQ5x7k280rFGhZYQ6VuVlAKqFV0XOPr0XVNcmywMLlhEX/Y9bGdBvbBXOI8j30HWB47rFq3DkrwFrEiI0rKIklXIgs4gZnGiixNcqTveJSCzOVd9PZMpY7fspSVulQsMlCODTNV9OwzzgSN12KnhaqjTtRp4ELxbXy3Fpeu62m24DL6c94AT5Dyb23e6FLHAk0gcawNnQDV6LkJXC6TsK5YJrnApVSxBVgxr5YprlnBNEkhFgqdhGFTzIEQ1EBzpehwo8tw1wA6dsafgxo7HU9sNrEtkCQVZdINgI5uicr4mpFUbJkF5nE9Ge5GUBX/zSozN5Q3Otiok6lbsG7EaxImS1C46WfixBYGHmxsaVBmzpEUHV2stf0wI6tYdf4D0PS+ZNEDASVVxVJhYQY9d2NA3iQBHP/pdZ3IPn7sTQGNAFjJZYZ1GXFgQBe0wrGhKop5Cv1OUQJ0cF1HEwGPT2QLOW4L1w5kqfIEGMd3ZOoEvmHtfMMJ8gE0jZ0I4AYeJzBONP0cnwFCDVqjQU1gSmm2TCB4dRnby6YVSXEPFMmjK9JakVBX3AiATbwRW12YlY7eVXNNROxCieC02KcCdU06Y2/fLE18tnJA40f0mpmeseFuy+jdWqt8niQPvVI8wVtYaaqynMWuek8ytqKODKUggyHa4CK2N3idMaENXiTQDNZMmRRq+LoUCVo3GakqEdPNGmqLFugoel4Zid5XAg2WbrJHEg7L+4Q5y9GFojkz6AKr3Hcz1ND+PYyOm5yVkEpjE0IBDAzRR9DfgEiOQqU6TT4EE+kod1WUXG7pYLDgQfotZBWtqfcDeczS0PmMYN6Zokt6jwrcb7TQxmLFsuoPA0mOJGcahjPUq/ujhwZKSFdlKZVBw8ajCG1W2CBmUKnoYowVnpCW+5ghFCHCe6ujQQEx4Tu7j/SF5kyknsjfQdWu1sVTIyOX1KyomrXf1ytZDV40hARdU9WMIzISlVhpit5Sg2EiuLuruCHBizdyqV/duLLXl+jSj/g6Q2YVmFIEzYDfUz/6GNAW6B01vzMjqA6f85CpkxBvASO7m1sEi7vNaooVWc2YYEH8YObuBP21e+ITZmFAMsQrjisBs36XFcxxrZu4hxu49/q179lT+nbczZ6aJtx+fvGIsW8PIotY0/SwzquwLPpA7w3cijF3wRTTqEcEUju47h1MqBZ8ZOIldM9NOA4c+udqapCinyuqzZ6m3cdnKz++V75TGWAsj1vVSey+R6rJO911p+zDyWEEsbGdv0OHdv1zcOcxZ/8fnm9oF7u+rIUCrB3mDbAa4iXxPpKF7eMyx5oil67dYIMGt6o5Jf+L0+ArmlHwDeZSufb1QTIihDXSlMK4M7x/XpXCQmMywXjfQYdpt7QAtbdlGlIpmIC2D+mSqoI5dWMqpNsl3WAOtmacLinidE05wlqzpXAH187rD7M+tGQ+ofyG9fdw+vwkk54tZpVgnyvaH5OIw5evg+9xHROPm4JSazQsdxeSSCEo5FagDTOrMUGBUKAypNHYFT2qvOjRpoUlJ8iT5onicskI5shiMGL6ABanxQ6WGhnTeDralautDqPXSWfbyF5Wa+wHHnOGdbaSyW0CZ8Q15hrMUmmHGlmp2B3BE+4HgNylsdjCm+YHsRBOsZqdcy2tIb5z3y4hWI5+9b+YoXOxbf5vAN2ALa+FQTifEVmUlaEqLIaTuPHtxtKZZ1/1zwJmLO4cCDN/q17/6bs/W9v3snMcNcW+CqLt+TSLGzF7qOMGb6lC/9z45PQrjwYgF771set/0vO8aHHe4fq953Fk8vIh2fZ1f2CKXWeG3v324crunSrqnCfgL82ZJoqWWJCt1Sq9esb7uSAIKHSGPrz9GV0L8/3rM3T97vLqP39GH6+F+ekH9GKz2iJBmVlRhchKaj8qTSpFiYFvfffT//pvL78OUoSaVUIZ16cHyNRZgcPjeHRi7nvkNb91vHhdIxW+4vnzQrormw5gfmTDuAc/8CF8e4ppa518YspUmKM35++CyP4hBU3nyzqOM/6PFHQWpq1F94sRobCRw8ITjuA5vsF7zmGJDd3gE4xIB+6+Qed5rsBP67g8hE7z9JKiPDbO+dRYyPXF2xv3Ko2GxwqsJ4x+7DiVnKbq3250fWNRGfF+WRoeOQkiCg3t2uM0rDWxzE3XmlZAdNDFec7slzFvA7adWf7hd25CBrAmIVxw6W/45S4LDFBpc62T6HUPfdIweucxvJHKNCJ5IHRzCLDBATCzPSx59cS0d/thYlk/JvW23o4RXtCQ3TiVF9djB5Yv1loSZlVO5zca6DjIymWFxZLOGtOJSLFgy0rRHM23AJOKHLKGwnKmPLL1wKBodERbDi66SNDvgEfU/bslXNEdAIoW0tDMZ3bHzzOKT9pc6AxnLhU/AejSqDTAFwlYYpGgWpinuA6p+p+UCYiK86z2xKVTy/sWvN3HrL9a15lwAg32yqyoEtSgD9uSnqGP9TP2Bhxg36Ob2gE2eAl+G9PU6lE9EygTI6ZxjbT3i58hzHlQmSjbL0KCG1aQmLemyr6BTBiJtIHHnAn08XpUoBBIkE0mr6KLbAtUlgnGvlnAiurYGb0WbIISF/cixk5FB397AmzdaIWMU7GMPikScLbKR0ItdEQDdSoP5p0AjEAE0gkWCKNfpNpglQ/ndCN0voRkL4WwvfH3kEs3p2ZDqQirnpG7Jj42xi0N5t1QnUMGQct4yIwY7JAJn+cKaQkFM1Ys+REb4S2uORZTxPEf4KCsE0Q6LsrBBnddlm0kZW0t2CUYsLsvT+xIJSXQhWAdrx/cwyL2WBlGKo4Vgn7RqEbixdX9z2/kUi4W4envlGRmRZMf7w6yH+yC7jZ28L6yeFt0zyuzosL4ZPFRtHUVs3PCwxJ63JLjqH/UVI0iLCtD5LSU9kuOI3xbEUK1HsEZOo8f1xztuMQTwAtZFXcp1RYFChMGuE0hnHZwpD0crVSCAJ8upbDvipVbIeWw+SEaKEq7u1rH60c38m5i5LqWQs0AZzRv9uP9MD19mAmkmakC8hNBcQH1ItpDXWGNcC5L+7qYFWUKyY1oj8wRzuB7KWQxklcLMzk0cy3qp1UirHLPRG7lj1S6IQBGvzBO0blHbDYgw0OcvaLZmLuTownjzf5Pkq4wSoJbn7UQlwqhPQYIEbPe/QmEcPl6t75eIzYlxhNC5zJl9UBg83O6wmsmK9AuiSxKJQs2kqFIp0buSuA5hyKyBbrYjxsT60bsJESyj+GO1omCCOxgGHW4zBEIBtZv8Et9up1Xtr1vo2zXlllWwvTL2WJr9DmUgWfkGLP+QVoQvMdLKqhipN4SEAQS/fqpBcys4KkNzXZDHtkZ+W6mjRoPftZ7Oqbt1sn29Hr/nrx64dZKuK+gadoY4YYVVFu57rQ9RUs6GkTypxCtKcTBg4DGg088BvVA1jqmd/fJWOv7h+3pu0xHG3L64K15h/GhHQ72BjtuBcIDhMGXu7vXB3enJj07d9Gi7E0dPrlovVSnESAH5HgjQL5cdvz+8JHFGm0wzZE9TD6qSSVIzDv2APkxKTvG3NuAGRulHkrQen7q6JU7lVllBTUreYIoCd7xJCOHhv/a6IFDLyUlk3qd9kR13kvu/bUWkT18mcgT8p+zH//0J/TizeX5zUt0ybRhYlkxvaI5lMIHceFyKZP3BdoXCYNs2YXDwx8zfHEkY0zJxF7FffWf9lRDGDQ3Bjzy0YY+P+a6EEj7b+p+O44/wCkUM8Ui1Ca9zRTDPFZ3ut5G3uOcVdqtgKRCmhWMY+XEkxWb9g4ReNfD5VVwzzXLp+w00s2U/2gZofYi9vpitpc8XZ3Fudh31yGs4SsNO/5f7ySCTwa84B03tFOWkYddmVKlTAwYhGyA1FItsWB/7MmqFulY4aHEPoLSXZ4aIfeCqWAtaaKuP7/Y5eC1cC2+XO+inazmXynmZkWwoqhUNJcFEzhYcNcRTzfYMCqMPpgez/GUu32DT7pZ1/qRlokY116dr63gKrEy0Ayp3ep+sTphsyMvbB4iURc0pwobmmfRksr28IcVPr/UKzbBsxsl1yxvmof57+Gy5F5THTCGb/5jn7VdnTas4LSbZPlEu2yW9L3+zHZkm8HhoZA5uWYuer7qK+4jLeAapTPmUPDHap70HnSmzo86ldDLwEadjgoaK9ZIG6mcxLfQCmowrPY1fGtmv/V1ePcFy3NOp5Nyb2G9h8q5wPF25N5Rcq4ejzHNdm/8ap0OQ2JbR2fPUMmxPTL7PkuFqCBqW455+SEVcgJ78gEZdKqxLX+V2qC3mKyYGDHpcpxIcnzVp/VHAZn+paJWfFj9yDU50zP0Jscl+gT/4/SjXApXd/q34eOJVnhNrebEKVboc0XVFkEPQl1KoWmtUYWLU+1+M/jNNPLS98AjFrJidRdI4bbv+vKN41lvaQJUWwZ675ujPhRTmPKU1mHW5/G6tfROEyNrG/qHl2mkKiGCdqw+a14eF3l2baRGauw8xMxbmOkPAqMNE7ncaKRLStiCEfvJWahO0OfJDi+I3Z7Dt825QS+gIywVpH2GIHT5skMtVAl4x9/QJSZb9FHvNr5tIrBFv5A2enatXWECg33kte+aWoAK1KoBk9kXcUDxpg9AoPp/p9IUynmG5NvddnqFeqw7r1OvAzuGHQYZzf/miM1Ok9c7tlWf4etd77Wsu4Ktj3cBHe5mGoddEzDYPZs2IdMdw+CEwg0pDhc/Q9lAzJGAoxVusOWcLpjwvnoQTtDVr8DlSNNBwO6oQrFEuLUOmJ76F1swNj7b1Hv3vZRGelM2PmxjMFkVE7fAb1cFgqOBddQ9jiRDXuZMxJsgFvVu2C1DUWHaxzMgpLplO3Asro12W94fmNo5wDrt23cA6xKrmqfsn8/arWxWbNBKHdnbYW1Zl/z+oO2Z6DNLXFsLqbbpDvwvusTiXw92jKkR2e2iXqvnoafJkuUvrwD6gb2dTCUa7Krut75/V6NckFFhlCyPER25rOYD58KDeNyvaa1teqAcAXB01R3T3sMLWZRYbJv7CNcOxuk7e2VNlX2GMiYWMqwUYH2XukbogPzoWZE1Zhuativ64nOqHIFfKs636D8qzNmC0RxdQt2zcw4GUdnQeUakvGMnCrr/TufIrd/az5iPafPRu8224fCyMqByHznC9PBdf98s4afseHe088nP0Idt6bbeeg4scdwJjh+eoossajPZHtoWB+eIUF/rUNvaPjJTuOoa5XIXO+dZLKWqvf0QYn7/ZuTIO71yIrNTTYsy7RyiPaSwKx/03NdoKikTaSK7SNl17HmgEpuwa5KIDOuY0f4OYOXL6SNDrhSPeMwdqBFPpTFGs0rF8oZ0YGqqMryMZ1O2oKM/T7ugo6Y/7oL2XJ9AsNB7QwWoVvGNEws/Gjc3it5K0V6qTGyNyi0xRS3hjsz9AMuCevXK//eFR+GV/w+f1xRy+2NOVTg7z2/nhNFzt5lu8Bw8rp1Ra4Pt5H4gmjWpmFhQpUbirsN9T7KvruJ/kPRB9+wESNZ9iRedYwhcKQhry6RXKrDEZOx35eL2lu0+QAax6v7pr3SYoDU+8JOVK6qm8UdYnd1nPL24gNGPL9EFrB9GjSozUbOUETpfUOWHf9KdLMw9zXlp0tBxh5CdA7eLfq07naL3njT741iv5ONbo4RPG92yP8LeGnaXSKZc//UKCbqUhrkDLFdYj0yA0mTqtkKdo3SLjw8XtEedbALUIMGlx2N14/S6/iackKLZcoqKit3+Rs3Uww+jg5atNGFaV9GVToAMyVLpvHVPi6EAhlSppD7QwaF0peeVXRzdQnB6n3SaJEOi6Qzuo8gvbiG1c/9j1JGexyH5eOm5B8dxEao1z9YpX/R+SNU7soPI5JllPVxFb9OoUwFmd9Rb1ImaG3zVjivpPkggW39AGuJ1UqHr2/O/vr1BN/adQr+JkekrLbaJKqmPwfbDRoaxBTFEVpTc6aOcyA8Twml7kIWGzjX9OpsWYZAG6kcQtlJwj5ZLFRs0hTyBkuvwaLqCjBoNgLPBpppswmcXyzXmLHeMGECiLwgn62q9TxACxe7oVvfFdiTOrxNII8NeGVPqjMEM2iSg4ShTEITgZ3Cb2FLUlS9SMbM9cKOILIqkfeIeiLfDwzuEwiX4G6Yo71uasV0sG45FpvWpBt7alZ0M/93vtq7RCmLrSo2zUrIp0qpDCDsMEGAASIWtASArWWEhBo0zUreb8qsCIiMx24naNjcPi595+Pub83f+3XvVW755UIxUfd9/9J5tTN9la8mrVAQ4r+c4Cz/nppmMXY/zrQQzGr1wSOiX0K0DCnvribo98AiQDu6GV4mk2RuP60fBjE8XmO0WHaypgkyBRcURkYLQ0lhD+dad4Uh7hc0mpfR1hLcGez1C2yJaSmWQtPT99d/OQym4QbLH5jupltMnWPYLDHZcrHPsmp0EG8X8+9VvN9c36C2+L5jIm7He4WO1e5s8DXNniOLItvw2Brvbt61GfQqXLEZPz3ZVjtliuoLNUxfh11tOrnbsOMu8VL6+9F16PRZ7MeTTHcqJewXUOy7+y9cNN4U5Ih9qkrFvN/hLrAl9ouxGP64arPgmqFu44t4zpKtAijrW6C/aKCmW/zrnmNxxpg3N//LK/+2s+ZSJBSXhjxZM0Q3mQUUGz3nnNwiLHGmJRthS0SXTRm2tZT+lsCixWflm/Q0OqI/DAElwSk2FpiuEdvVaRKpOF/JGn2wwp8Ko7T/93wAAAP//Gm+GWA==" } diff --git a/x-pack/filebeat/module/cisco/meraki/_meta/fields.yml b/x-pack/filebeat/module/cisco/meraki/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/cisco/meraki/config/input.yml b/x-pack/filebeat/module/cisco/meraki/config/input.yml new file mode 100644 index 00000000000..ccc2cd1a6af --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Cisco" + product: "Meraki" + type: "Wireless" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/cisco/meraki/config/liblogparser.js + - ${path.home}/module/cisco/meraki/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/cisco/meraki/config/liblogparser.js b/x-pack/filebeat/module/cisco/meraki/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{hfld2}.%{hfld3->} %{p0}"); + +var dup2 = call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld4"), + constant("_appliance "), + field("p0"), + ], +}); + +var dup3 = call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld4"), + constant(" "), + field("p0"), + ], +}); + +var dup4 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); + +var dup5 = setc("eventcategory","1605020000"); + +var dup6 = setf("msg","$MSG"); + +var dup7 = setc("event_source","appliance"); + +var dup8 = setf("sensor","node"); + +var dup9 = date_time({ + dest: "event_time", + args: ["hfld2"], + fmts: [ + [dX], + ], +}); + +var dup10 = // "Pattern{}" +match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); + +var dup11 = // "Pattern{Constant('dhost='), Field(dmacaddr,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); + +var dup12 = // "Pattern{Constant('shost='), Field(smacaddr,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); + +var dup13 = // "Pattern{Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); + +var dup14 = // "Pattern{Field(signame,false)}" +match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); + +var dup15 = setc("eventcategory","1607000000"); + +var dup16 = setc("event_type","ids-alerts"); + +var dup17 = date_time({ + dest: "event_time", + args: ["fld3"], + fmts: [ + [dX], + ], +}); + +var dup18 = setc("event_type","security_event"); + +var dup19 = constant("Allow"); + +var dup20 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" +match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ + dup2, +])); + +var dup21 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" +match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ + dup3, +])); + +var dup22 = linear_select([ + dup11, + dup12, +]); + +var dup23 = linear_select([ + dup20, + dup21, +]); + +var part1 = // "Pattern{Constant('urls '), Field(p0,false)}" +match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); + +var all1 = all_match({ + processors: [ + dup1, + dup23, + part1, + ], + on_success: processor_chain([ + setc("header_id","0003"), + setc("messageid","urls"), + ]), +}); + +var part2 = // "Pattern{Field(node,false), Constant('_appliance events '), Field(p0,false)}" +match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); + +var part3 = // "Pattern{Field(node,true), Constant(' events '), Field(p0,false)}" +match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); + +var select1 = linear_select([ + part2, + part3, +]); + +var part4 = // "Pattern{Field(payload,false)}" +match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); + +var all2 = all_match({ + processors: [ + dup1, + select1, + part4, + ], + on_success: processor_chain([ + setc("header_id","0002"), + setc("messageid","events"), + ]), +}); + +var part5 = // "Pattern{Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); + +var all3 = all_match({ + processors: [ + dup1, + dup23, + part5, + ], + on_success: processor_chain([ + setc("header_id","0001"), + ]), +}); + +var part6 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" +match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); + +var part7 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" +match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); + +var select2 = linear_select([ + part6, + part7, +]); + +var part8 = // "Pattern{Field(,true), Constant(' '), Field(hfld5,true), Constant(' '), Field(hfld6,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld6"), + constant(" "), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var all4 = all_match({ + processors: [ + dup1, + select2, + part8, + ], + on_success: processor_chain([ + setc("header_id","0005"), + ]), +}); + +var hdr1 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,false), Constant('.'), Field(hfld3,true), Constant(' '), Field(hfld4,false), Constant('_'), Field(space,true), Constant(' '), Field(messageid,true), Constant(' '), Field(payload,false)}" +match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ + setc("header_id","0004"), +])); + +var select3 = linear_select([ + all1, + all2, + all3, + all4, + hdr1, +]); + +var part9 = // "Pattern{Field(node,false), Constant('_appliance '), Field(p0,false)}" +match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); + +var part10 = // "Pattern{Field(node,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); + +var select4 = linear_select([ + part9, + part10, +]); + +var part11 = // "Pattern{Constant('flows src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); + +var part12 = // "Pattern{Constant('mac='), Field(dmacaddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); + +var select5 = linear_select([ + part12, + dup4, +]); + +var part13 = // "Pattern{Constant('protocol='), Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); + +var part14 = // "Pattern{Constant('sport='), Field(sport,true), Constant(' dport='), Field(dport,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); + +var part15 = // "Pattern{Constant('type='), Field(event_type,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); + +var select6 = linear_select([ + part14, + part15, + dup4, +]); + +var part16 = // "Pattern{Constant('pattern: '), Field(fld21,true), Constant(' '), Field(info,false)}" +match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); + +var all5 = all_match({ + processors: [ + select4, + part11, + select5, + part13, + select6, + part16, + ], + on_success: processor_chain([ + dup5, + dup6, + lookup({ + dest: "nwparser.action", + map: map_actionType, + key: field("fld21"), + }), + dup7, + dup8, + dup9, + ]), +}); + +var msg1 = msg("flows", all5); + +var part17 = // "Pattern{Field(node,true), Constant(' flows '), Field(action,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' mac='), Field(smacaddr,true), Constant(' protocol='), Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); + +var part18 = // "Pattern{Constant('sport='), Field(sport,true), Constant(' dport='), Field(dport,true), Constant(' ')}" +match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); + +var part19 = // "Pattern{Constant('type='), Field(event_type,true), Constant(' ')}" +match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); + +var select7 = linear_select([ + part18, + part19, + dup10, +]); + +var all6 = all_match({ + processors: [ + part17, + select7, + ], + on_success: processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + ]), +}); + +var msg2 = msg("flows:01", all6); + +var part20 = // "Pattern{Field(node,true), Constant(' flows '), Field(action,false)}" +match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, +])); + +var msg3 = msg("flows:02", part20); + +var select8 = linear_select([ + msg1, + msg2, + msg3, +]); + +var part21 = // "Pattern{Field(node,false), Constant('_appliance urls src='), Field(p0,false)}" +match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); + +var part22 = // "Pattern{Field(node,true), Constant(' urls src='), Field(p0,false)}" +match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); + +var part23 = // "Pattern{Constant('src='), Field(p0,false)}" +match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); + +var select9 = linear_select([ + part21, + part22, + part23, +]); + +var part24 = // "Pattern{Field(sport,false), Constant(':'), Field(saddr,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' mac='), Field(macaddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); + +var part25 = // "Pattern{Constant('agent=''), Field(user_agent,false), Constant('' request: '), Field(p0,false)}" +match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); + +var part26 = // "Pattern{Constant('agent='), Field(user_agent,true), Constant(' request: '), Field(p0,false)}" +match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); + +var part27 = // "Pattern{Constant('request: '), Field(p0,false)}" +match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); + +var select10 = linear_select([ + part25, + part26, + part27, +]); + +var part28 = // "Pattern{Field(,true), Constant(' '), Field(web_method,false), Constant(''), Field(url,false)}" +match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); + +var all7 = all_match({ + processors: [ + select9, + part24, + select10, + part28, + ], + on_success: processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + ]), +}); + +var msg4 = msg("urls", all7); + +var part29 = // "Pattern{Constant('dhcp lease of ip '), Field(saddr,true), Constant(' from server mac '), Field(smacaddr,true), Constant(' for client mac '), Field(p0,false)}" +match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); + +var part30 = // "Pattern{Field(dmacaddr,true), Constant(' with hostname '), Field(hostname,true), Constant(' from router '), Field(p0,false)}" +match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); + +var part31 = // "Pattern{Field(dmacaddr,true), Constant(' from router '), Field(p0,false)}" +match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); + +var select11 = linear_select([ + part30, + part31, +]); + +var part32 = // "Pattern{Field(hostip,true), Constant(' on subnet '), Field(mask,true), Constant(' with dns '), Field(dns_a_record,false)}" +match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); + +var all8 = all_match({ + processors: [ + part29, + select11, + part32, + ], + on_success: processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + ]), +}); + +var msg5 = msg("events", all8); + +var part33 = // "Pattern{Constant('content_filtering_block url=''), Field(url,false), Constant('' category0=''), Field(category,false), Constant('' server=''), Field(daddr,false), Constant(':'), Field(dport,false), Constant('''), Field(p0,false)}" +match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); + +var part34 = // "Pattern{Constant(' client_mac=''), Field(dmacaddr,false), Constant(''')}" +match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); + +var select12 = linear_select([ + part34, + dup10, +]); + +var all9 = all_match({ + processors: [ + part33, + select12, + ], + on_success: processor_chain([ + dup5, + dup6, + setc("event_description","content_filtering_block"), + dup8, + dup9, + ]), +}); + +var msg6 = msg("events:02", all9); + +var part35 = tagval("MESSAGE#6:events:01", "nwparser.payload", tvm, { + "aid": "fld1", + "arp_resp": "fld2", + "arp_src": "fld3", + "auth_neg_dur": "fld4", + "auth_neg_failed": "fld5", + "category0": "category", + "channel": "fld6", + "client_ip": "daddr", + "client_mac": "dmacaddr", + "connectivity": "fld28", + "dhcp_ip": "fld23", + "dhcp_lease_completed": "fld22", + "dhcp_resp": "fld26", + "dhcp_server": "fld24", + "dhcp_server_mac": "fld25", + "dns_req_rtt": "fld7", + "dns_resp": "fld8", + "dns_server": "fld9", + "duration": "duration", + "full_conn": "fld11", + "http_resp": "fld21", + "identity": "fld12", + "instigator": "fld20", + "ip_resp": "fld13", + "ip_src": "saddr", + "is_8021x": "fld15", + "is_wpa": "fld16", + "last_auth_ago": "fld17", + "radio": "fld18", + "reason": "fld19", + "rssi": "dclass_ratio1", + "server": "daddr", + "type": "event_type", + "url": "url", + "vap": "fld22", + "vpn_type": "fld27", +}, processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, +])); + +var msg7 = msg("events:01", part35); + +var part36 = // "Pattern{Constant('IDS: '), Field(info,false)}" +match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ + dup5, + dup6, + setc("event_description","events IDS"), + dup8, + dup9, +])); + +var msg8 = msg("events:03", part36); + +var part37 = // "Pattern{Constant('dhcp '), Field(p0,false)}" +match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); + +var part38 = // "Pattern{Constant('no offers'), Field(p0,false)}" +match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); + +var part39 = // "Pattern{Constant('release'), Field(p0,false)}" +match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); + +var select13 = linear_select([ + part38, + part39, +]); + +var part40 = // "Pattern{Field(,false), Constant('for mac '), Field(macaddr,false)}" +match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); + +var all10 = all_match({ + processors: [ + part37, + select13, + part40, + ], + on_success: processor_chain([ + dup5, + dup6, + setc("event_description","events DHCP"), + dup8, + dup9, + ]), +}); + +var msg9 = msg("events:04", all10); + +var part41 = // "Pattern{Constant('MAC '), Field(macaddr,true), Constant(' and MAC '), Field(macaddr,true), Constant(' both claim IP: '), Field(saddr,false)}" +match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ + dup5, + dup6, + setc("event_description"," events MAC"), + dup8, + dup9, +])); + +var msg10 = msg("events:05", part41); + +var select14 = linear_select([ + msg5, + msg6, + msg7, + msg8, + msg9, + msg10, +]); + +var part42 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); + +var part43 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' message: '), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); + +var part44 = // "Pattern{Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' message: '), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); + +var select15 = linear_select([ + part43, + part44, +]); + +var all11 = all_match({ + processors: [ + part42, + dup22, + dup13, + select15, + dup14, + ], + on_success: processor_chain([ + dup15, + dup6, + dup16, + dup8, + dup17, + ]), +}); + +var msg11 = msg("ids-alerts:01", all11); + +var part45 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,false), Constant('direction='), Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ + dup15, + dup6, + dup16, + dup8, + dup17, +])); + +var msg12 = msg("ids-alerts:03", part45); + +var part46 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,false), Constant('protocol='), Field(protocol,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,false), Constant('message: '), Field(signame,false)}" +match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ + dup15, + dup6, + dup16, + dup8, + dup17, +])); + +var msg13 = msg("ids-alerts:02", part46); + +var select16 = linear_select([ + msg11, + msg12, + msg13, +]); + +var part47 = // "Pattern{Field(node,false), Constant('security_event '), Field(event_description,true), Constant(' url='), Field(url,true), Constant(' src='), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' mac='), Field(smacaddr,true), Constant(' name='), Field(fld10,true), Constant(' sha256='), Field(fld11,true), Constant(' disposition='), Field(disposition,true), Constant(' action='), Field(action,false)}" +match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ + dup5, + dup6, + dup18, + dup8, + dup9, +])); + +var msg14 = msg("security_event", part47); + +var part48 = // "Pattern{Field(node,true), Constant(' security_event '), Field(event_description,true), Constant(' signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); + +var part49 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' message:'), Field(p0,false)}" +match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); + +var part50 = // "Pattern{Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' message:'), Field(p0,false)}" +match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); + +var select17 = linear_select([ + part49, + part50, +]); + +var all12 = all_match({ + processors: [ + part48, + dup22, + dup13, + select17, + dup14, + ], + on_success: processor_chain([ + dup15, + dup6, + dup18, + dup8, + dup17, + ]), +}); + +var msg15 = msg("security_event:01", all12); + +var select18 = linear_select([ + msg14, + msg15, +]); + +var chain1 = processor_chain([ + select3, + msgid_select({ + "events": select14, + "flows": select8, + "ids-alerts": select16, + "security_event": select18, + "urls": msg4, + }), +]); + +var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,false), Constant('.'), Field(hfld3,true), Constant(' '), Field(p0,false)}" +match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); + +var part51 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); + +var part52 = // "Pattern{}" +match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); + +var part53 = // "Pattern{Constant('dhost='), Field(dmacaddr,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); + +var part54 = // "Pattern{Constant('shost='), Field(smacaddr,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); + +var part55 = // "Pattern{Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(p0,false)}" +match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); + +var part56 = // "Pattern{Field(signame,false)}" +match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); + +var part57 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" +match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ + dup2, +])); + +var part58 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" +match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ + dup3, +])); + +var select19 = linear_select([ + dup11, + dup12, +]); + +var select20 = linear_select([ + dup20, + dup21, +]); diff --git a/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml b/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml new file mode 100644 index 00000000000..6172ce75db7 --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Cisco Meraki + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/cisco/meraki/manifest.yml b/x-pack/filebeat/module/cisco/meraki/manifest.yml new file mode 100644 index 00000000000..a86afb8f019 --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["cisco.meraki", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9525 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/cisco/meraki/test/generated.log b/x-pack/filebeat/module/cisco/meraki/test/generated.log new file mode 100644 index 00000000000..05501480e40 --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/test/generated.log @@ -0,0 +1,100 @@ +modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny +umdo 1455282753.itessequ vol_ events dhcp lease of ip 10.102.218.31 from server mac 01:00:5e:9c:c2:9c for client mac 01:00:5e:0f:87:e3 from router 10.15.16.212 on subnet ameaqu with dns aqu +uipexea 1456517708.tatio minim_ flows ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe +mipsu 1457752662.consec taliquip_ flows radip flows block src=10.155.236.240 dst=10.112.46.169 mac=01:00:5e:7a:74:89 protocol=ipv6 type=roidents +obeataev 1458987616.lor uidexea_appliance events MAC 01:00:5e:e1:89:ac and MAC 01:00:5e:a3:d9:ac both claim IP: 10.14.107.140 +iutal 1460222571.dexe urerep events content_filtering_block url='https://api.example.org/liqu/lorem.gif?ueipsaqu=uidolore#niamqu' category0='ari' server='10.108.180.105:5098' client_mac='01:00:5e:40:9b:83' +ipit 1461457525.idexea riat_appliance events MAC 01:00:5e:25:4f:e4 and MAC 01:00:5e:3f:49:e4 both claim IP: 10.149.88.198 +ntsuntin 1462692479.aecatcup animi events dhcp release for mac 01:00:5e:e3:10:34 +orsitame 1463927433.quiratio ite events MAC 01:00:5e:48:62:22 and MAC 01:00:5e:9f:b6:a6 both claim IP: 10.243.206.225 +olupta turveli.toccae tatno_ ids-alerts taliqu ids-alerts signature=temUten priority=ccusan timestamp=1465162388.iqudirection=outbound protocol=icmp src=10.131.82.116:7307 +uaera 1466397342.sitas ehenderi_ security_event atquovosecurity_event iumto url=https://www5.example.net/sun/essecill.html?saute=vel#quu src=10.210.213.18:7616 dst=10.134.0.141:2703 mac=01:00:5e:aa:42:fa name=idolores sha256=llumquid disposition=tation action=accept +omn ipsumq.atcu oremagna_ security_event remipsum security_event liq signature=ist priority=tnon timestamp=1467632296.ionul shost=01:00:5e:c8:9c:2f direction=outbound protocol=udp src=10.163.72.17 dst=10.74.237.180 message:nsequu +omm 1468867250.idestla Nemoeni_appliance events MAC 01:00:5e:c4:69:7f and MAC 01:00:5e:e2:67:d2 both claim IP: 10.72.31.26 +agna tionemu.eomnisis mqui ids-alerts signature=civeli priority=errorsi timestamp=1470102205.desdirection=internal protocol=tcp src=10.70.95.74:4290 +olupt 1471337159.dit sumquiad events MAC 01:00:5e:ea:e8:7a and MAC 01:00:5e:9c:d2:4a both claim IP: 10.17.21.125 +amqu 1472572113.uines nsec events dhcp lease of ip 10.85.10.165 from server mac 01:00:5e:63:93:48 for client mac 01:00:5e:46:17:35 from router 10.53.150.119 on subnet uiineavo with dns tisetq +giatquov eritquii.dexeac iscinge ids-alerts signature=atvol priority=umiur timestamp=1473807067.imadprotocol=igmp src=10.88.231.224 dst=10.187.77.245message: iadese +agnaali 1475042022.gnam tat events content_filtering_block url='https://internal.example.com/quae/maccusa.htm?rQuisau=idex#xerci' category0='aqu' server='10.186.58.115:7238' client_mac='01:00:5e:8f:16:6d' +apariat 1476276976.tlabore untmolli_ events dhcp lease of ip 10.219.84.37 from server mac 01:00:5e:e8:bf:69 for client mac 01:00:5e:87:e1:a0 from router 10.205.47.51 on subnet uovolup with dns samvolu +ento 1477511930.pic evita events MAC 01:00:5e:ce:61:db and MAC 01:00:5e:ec:f8:cc both claim IP: 10.3.134.237 +tmo 1478746884.fficiade uscipit events aid=vitaedi arp_resp=fugitse arp_src=veniamq auth_neg_dur=one auth_neg_failed=etMalor channel=ipi dns_req_rtt=reseos dns_resp=pariatu dns_server=tin duration=48.123000 full_conn=oquisqu identity=sperna ip_resp=eabilloi ip_src=10.182.178.217 is_8021x=tlab is_wpa=volupt last_auth_ago=osqui radio=xerc reason=iutali rssi=fdeFi type=texp vap=tasuntex client_mac=01:00:5e:e3:b1:24 client_ip=10.194.114.58 instigator=ectio http_resp=dutper dhcp_lease_completed=lamcolab dhcp_ip=ati dhcp_server=tlabo dhcp_server_mac=uames dhcp_resp=iduntu url=https://internal.example.net/ris/uamqu.txt?liqui=quioffi#uptate category0=ncidid server=10.63.194.87 vpn_type=quisno connectivity=sin +emvel 1479981839.tmollita fde events aid=nsecte arp_resp=inculpa arp_src=abo auth_neg_dur=veniamqu auth_neg_failed=nse channel=non dns_req_rtt=paquioff dns_resp=mquisnos dns_server=maven duration=71.798000 full_conn=atcu identity=labor ip_resp=didunt ip_src=10.153.0.77 is_8021x=udan is_wpa=orema last_auth_ago=invento radio=qua reason=aturQui rssi=utlabor type=rau vap=idex client_mac=01:00:5e:9e:7b:a4 client_ip=10.105.88.20 instigator=ecte http_resp=tinvolu dhcp_lease_completed=iurer dhcp_ip=iciadese dhcp_server=quidolor dhcp_server_mac=tessec dhcp_resp=olupta url=https://mail.example.com/icabo/itatio.jpg?eleum=sintoc#volupt category0=siste server=10.163.154.210 vpn_type=ept connectivity=iumtotam +ionevo 1481216793.ugiatnu ciati_appliance events MAC 01:00:5e:b8:7a:96 and MAC 01:00:5e:b9:6b:a8 both claim IP: 10.73.69.176 +spi 1482451747.stquido ommodico_ flows ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp +smo etcons.iusmodi uamest_ security_event uiac security_event epte signature=idolo priority=quinesc timestamp=1483686701.madmi shost=01:00:5e:1c:4c:64 direction=internal protocol=icmp src=10.31.77.157 dst=10.12.182.70 message:tev +nisiuta 1484921656.roid inibusB flows cancel +str 1486156610.idolore pid_ flows cteturad flows deny src=10.93.68.231 dst=10.135.217.12 mac=01:00:5e:4a:69:5b protocol=ipv6 type=archite +amnih 1487391564.ium esciuntN_ events dhcp release for mac 01:00:5e:8b:99:98 +isnost 1488626519.queips ncidi_ flows iscinge flows src=10.247.30.212 dst=10.66.89.5 mac=01:00:5e:7f:65:da protocol=igmp pattern: 1 borios +oin 1489861473.mvenia madminim events IDS: fugitsed +dmin fugi.quia iduntu security_event idestlab signature=rnatur priority=ofdeFin timestamp=1491096427.essequam dhost=01:00:5e:c1:53:b1 direction=inbound protocol=tcp src=10.221.102.245 dst=10.173.136.186 message:naal +umqu tinv.adipisc uscipitl_ ids-alerts ritatise ids-alerts signature=uamei priority=siut timestamp=1492331381.ciad dhost=01:00:5e:1f:c6:29 direction=external protocol=udp src=10.58.64.108 dst=10.54.37.86 message: entorev +velitess 1493566336.naali uunturm_ flows veli flows block src=10.147.76.202 dst=10.163.93.20 mac=01:00:5e:1d:85:ec protocol=ipv6 sport=1085 dport=3141 +iumdol tpersp.stla uptatema_ security_event uradi security_event tot signature=llamco priority=nea timestamp=1494801290.psum dhost=01:00:5e:35:71:1e direction=internal protocol=icmp src=10.0.200.27:5905 dst=10.183.44.198:1702 message:asiarc +tiaec 1496036244.rumwrit icabo_ events dhcp lease of ip 10.148.124.84 from server mac 01:00:5e:0b:2c:22 for client mac 01:00:5e:06:12:98 from router 10.28.144.180 on subnet ritin with dns temporin +ica 1497271198.lillum remips_appliance events aid=uisaute arp_resp=imide arp_src=poriss auth_neg_dur=tvolup auth_neg_failed=itesseq channel=dictasun dns_req_rtt=veniamqu dns_resp=rum dns_server=quaea duration=165.611000 full_conn=mvel identity=nof ip_resp=usmodi ip_src=10.204.230.166 is_8021x=dat is_wpa=aincidu last_auth_ago=nimadmin radio=isiu reason=licabo rssi=enimadmi type=utaliqu vap=dic client_mac=01:00:5e:bb:60:a6 client_ip=10.62.71.118 instigator=ineavol http_resp=iosa dhcp_lease_completed=boNemoe dhcp_ip=onsequ dhcp_server=equinesc dhcp_server_mac=cab dhcp_resp=atisund url=https://example.net/ites/isetq.gif?nisiut=tur#avolupt category0=ariatur server=10.98.194.212 vpn_type=nimave connectivity=isciv +dipisci 1498506153.spernatu admi events content_filtering_block url='https://www.example.org/ueipsa/tae.html?eriti=atcupi#corpori' category0='borisnis' server='10.197.13.39:5912' +itsedd 1499741107.leumiur eratvol events dhcp release for mac 01:00:5e:fd:84:bb +leumiu tla.item nimid ids-alerts signature=dat priority=periam timestamp=1500976061.dquprotocol=icmp src=10.242.77.170 dst=10.150.245.88message: orisn +sitam rad.loi isc_ ids-alerts volupt ids-alerts signature=rem priority=idid timestamp=1502211015.tesse shost=01:00:5e:9d:eb:fb direction=external protocol=tcp src=10.247.139.239 dst=10.180.195.43 message: tenatuse +tore 1503445970.elits consequa events dhcp release for mac 01:00:5e:50:48:c4 +undeom uamnihi.risnis uov_ ids-alerts isn ids-alerts signature=sBono priority=loremqu timestamp=1504680924.teturprotocol=rdp src=10.94.6.140 dst=10.147.15.213message: uptat +itasper 1505915878.uae mve_ flows obeata flows block src=10.230.6.127 dst=10.111.157.56 mac=01:00:5e:39:a7:fc protocol=icmp type=aliquamq +archite 1507150832.remq veniamq events aid=occ arp_resp=oloreseo arp_src=iruredol auth_neg_dur=veniamqu auth_neg_failed=licaboN channel=atquo dns_req_rtt=cupi dns_resp=strude dns_server=eritin duration=85.513000 full_conn=litsedq identity=nderiti ip_resp=ntNe ip_src=10.179.40.170 is_8021x=olorema is_wpa=mollita last_auth_ago=tatem radio=iae reason=quido rssi=emip type=inBC vap=mol client_mac=01:00:5e:58:2d:1c client_ip=10.153.81.206 instigator=rsita http_resp=nsequun dhcp_lease_completed=eetd dhcp_ip=illu dhcp_server=iatqu dhcp_server_mac=lorsi dhcp_resp=repreh url=https://www.example.net/irured/illumqui.txt?tionula=ritqu#ecatcupi category0=uamei server=10.193.219.34 vpn_type=onse connectivity=olorem +umwritte 1508385787.vol oremquel_appliance events MAC 01:00:5e:16:5e:b1 and MAC 01:00:5e:ee:e8:77 both claim IP: 10.255.199.16 +unte 1509620741.uamnihil llam_appliance events MAC 01:00:5e:ee:1d:77 and MAC 01:00:5e:f1:21:bd both claim IP: 10.94.88.5 +esci 1510855695.uov quaeab_ events IDS: moles +accusa 1512090649.natu liquid events IDS: enim +dquiaco nibus.vitaed ser security_event etconsec signature=elillum priority=upt timestamp=1513325604.rnat dhost=01:00:5e:01:60:e0 direction=internal protocol=ipv6 src=10.90.99.245 dst=10.124.63.4 message:pta +tetura 1514560558.imadmini moe_appliance events content_filtering_block url='https://mail.example.net/uat/lupta.html?uptassit=ncidi#tlabori' category0='laudan' server='10.249.7.146:2010' +lapar 1515795512.ritati edquia_appliance events IDS: itesse +amvolu mip.tion tobeatae_ security_event Utenima security_event iqua signature=luptat priority=deriti timestamp=1517030466.sintocc dhost=01:00:5e:c9:b7:22 direction=inbound protocol=icmp src=10.196.96.162 dst=10.81.234.34 message:equuntur +uide 1518265421.scivel henderi_appliance events IDS: iusmodt +tiumd 1519500375.ntmoll mexer events dhcp lease of ip 10.40.101.224 from server mac 01:00:5e:0a:df:72 for client mac 01:00:5e:7c:01:ab with hostname remips188.api.invalid from router 10.78.199.43 on subnet ehender with dns ilmole +runtmo 1520735329.ore isund_appliance events MAC 01:00:5e:17:87:3e and MAC 01:00:5e:5f:c1:3e both claim IP: 10.244.29.119 +tutlabor 1521970284.reseosq gna_ flows pteurs flows deny src=10.83.131.245 dst=10.39.172.93 mac=01:00:5e:c4:12:c7 protocol=udp type=uido +osquira 1523205238.umd sciveli_ events dhcp lease of ip 10.86.188.179 from server mac 01:00:5e:48:4b:78 for client mac 01:00:5e:7e:cd:15 from router 10.201.168.116 on subnet umiure with dns laborum +umdolors 1524440192.lumdo acom_ security_event umexercisecurity_event duntut url=https://mail.example.com/prehend/eufug.htm?eufug=est#civelits src=10.148.211.222:2053 dst=10.122.204.151:3903 mac=01:00:5e:c3:a0:dc name=ine sha256=urerepre disposition=asnulap action=deny +atnul 1525675146.umfugi stquidol_ flows luptatem flows accept +essequam ueporro.aliqu upt ids-alerts signature=orum priority=Bonoru timestamp=1526910101.madminimprotocol=ipv6-icmp src=10.97.46.16 dst=10.120.4.9message: teni +lorsitam tanimid.onpr litseddo_ ids-alerts oremqu ids-alerts signature=idex priority=radip timestamp=1528145055.uptaprotocol=ipv6-icmp src=10.171.206.139 dst=10.165.173.162message: lestia +inibusB 1529380009.nostrud cteturad events dhcp lease of ip 10.150.163.151 from server mac 01:00:5e:72:b7:79 for client mac 01:00:5e:f2:d3:12 with hostname uames4985.mail.localdomain from router 10.144.57.239 on subnet oinBCSed with dns orem +eritq rehen.ipsamvol elillum_ ids-alerts tco ids-alerts signature=tvol priority=oluptate timestamp=1530614963.lit shost=01:00:5e:ac:6d:d3 direction=unknown protocol=igmp src=10.52.202.158 dst=10.54.44.231 message: Ute +runtm 1531849918.eturadip olorsi_ events MAC 01:00:5e:67:1d:0f and MAC 01:00:5e:f0:a9:cd both claim IP: 10.101.183.86 +inesciu 1533084872.quid atcupid_ flows orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi +lamco 1534319826.cit siar events MAC 01:00:5e:80:cd:ca and MAC 01:00:5e:45:aa:51 both claim IP: 10.83.130.95 +hite 1535554780.ianonnum nofdeFi events aid=henderit arp_resp=remq arp_src=unt auth_neg_dur=tla auth_neg_failed=arch channel=lite dns_req_rtt=ugia dns_resp=meum dns_server=borumSec duration=91.439000 full_conn=nvolupta identity=tev ip_resp=nre ip_src=10.2.110.73 is_8021x=eturadip is_wpa=ent last_auth_ago=rumSecti radio=Utenima reason=olore rssi=orumS type=olor vap=radip client_mac=01:00:5e:59:bf:36 client_ip=10.230.98.81 instigator=aaliquaU http_resp=olu dhcp_lease_completed=iameaque dhcp_ip=identsun dhcp_server=ender dhcp_server_mac=inc dhcp_resp=tect url=https://www.example.net/doconse/eni.html?mSec=smoditem#tatisetq category0=uidolo server=10.103.49.129 vpn_type=oquisq connectivity=abori +dunt 1536789735.ames amni events aid=tatio arp_resp=amquisno arp_src=modoc auth_neg_dur=magnam auth_neg_failed=uinesc channel=cid dns_req_rtt=emi dns_resp=Bonorum dns_server=lesti duration=59.289000 full_conn=iosamni identity=idu ip_resp=sis ip_src=10.158.61.228 is_8021x=tsedquia is_wpa=its last_auth_ago=umdolor radio=isiu reason=assi rssi=eserun type=rvelill vap=lupta client_mac=01:00:5e:e6:a6:a2 client_ip=10.186.16.20 instigator=tisu http_resp=remagnam dhcp_lease_completed=nvolupt dhcp_ip=meiusm dhcp_server=nidolo dhcp_server_mac=atquovol dhcp_resp=quunt url=https://www.example.com/seq/moll.htm?sunt=dquianon#urExc category0=tDuis server=10.132.176.96 vpn_type=aria connectivity=inim +oremeumf 1538024689.lesti sintocca events dhcp lease of ip 10.105.136.146 from server mac 01:00:5e:bb:aa:f6 for client mac 01:00:5e:69:92:4a with hostname lors2232.api.example from router 10.46.217.155 on subnet amnihil with dns orissus +nimadmin 1539259643.lumqui quiavolu flows src=10.245.199.23 dst=10.123.62.215 mac=01:00:5e:1f:7f:1d protocol=udp pattern: 0 iusmodt +rep 1540494597.remap deri flows cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6 +idexeac 1541729552.nimadmin midest_appliance events aid=modt arp_resp=iduntutl arp_src=rsitam auth_neg_dur=xercit auth_neg_failed=ulpaquio channel=itqu dns_req_rtt=minimav dns_resp=smodtem dns_server=roquisqu duration=116.294000 full_conn=iquid identity=evo ip_resp=mcorpori ip_src=10.196.176.243 is_8021x=itesse is_wpa=expl last_auth_ago=essecill radio=totamre reason=rpo rssi=velites type=nonpro vap=nula client_mac=01:00:5e:99:a6:b4 client_ip=10.90.50.149 instigator=nemulla http_resp=asp dhcp_lease_completed=dexercit dhcp_ip=amn dhcp_server=itessequ dhcp_server_mac=porissu dhcp_resp=umd url=https://www.example.net/sectetur/edquian.html?turQuis=taevi#uames category0=tconsec server=10.16.230.121 vpn_type=laboree connectivity=udantiu +ttenb olor.quiav gna security_event Nem signature=tdolorem priority=eacomm timestamp=1542964506.upidata dhost=01:00:5e:6a:c8:f8 direction=unknown protocol=ipv6 src=10.246.152.72:4293 dst=10.34.62.190:1641 message:eve +quisn 1544199460.rem ulamcola events dhcp no offers for mac 01:00:5e:67:fc:cb +eruntmo 1545434414.nimve usanti_ events dhcp release for mac 01:00:5e:7d:de:f7 +uatu 1546669369.olupta consequu_ events dhcp release for mac 01:00:5e:6b:96:f2 +sitam inibusBo.illoin emUtenim ids-alerts signature=ende priority=dexea timestamp=1547904323.acoprotocol=ipv6 src=10.244.32.189 dst=10.121.9.5message: uptas +edol 1549139277.sequuntu quameius_ events content_filtering_block url='https://www.example.com/totamrem/aliqu.htm?sBonorum=moenimi#lor' category0='auto' server='10.41.124.15:333' +antium 1550374232.remaper eseosq events dhcp no offers for mac 01:00:5e:c3:77:27 +oditau 1551609186.onsec dit events MAC 01:00:5e:19:86:21 and MAC 01:00:5e:ed:ed:79 both claim IP: 10.43.235.230 +asper dictasun.psa lorese_ ids-alerts ctobeat ids-alerts signature=onsec priority=idestl timestamp=1552844140.litani shost=01:00:5e:a0:b2:c9 direction=unknown protocol=icmp src=10.199.19.205:5823 dst=10.103.91.159:7116 message: ntut +estiaec 1554079094.pitlabo tas_appliance flows src=10.17.111.91 dst=10.65.0.157 mac=01:00:5e:49:c4:17 protocol=udp pattern: 1 nostrum +ercitati 1555314049.atem serro flows cancel +amquaera 1556549003.rsitamet leumiur events MAC 01:00:5e:fd:79:9e and MAC 01:00:5e:4d:c0:dd both claim IP: 10.20.130.88 +abill ametcon.ofdeFini tasnu_ ids-alerts tionev ids-alerts signature=uasiarch priority=velites timestamp=1557783957.uredolorprotocol=ipv6 src=10.177.64.152 dst=10.140.242.86message: temporin +lor nvolupt.dquia ora_ security_event dipi security_event ecatc signature=quovolu priority=ite timestamp=1559018911.itse shost=01:00:5e:b8:73:c8 direction=external protocol=icmp src=10.199.103.185:2449 dst=10.51.121.223:24 message:stenat +saq 1560253866.asiarch ssuscipi events MAC 01:00:5e:93:48:61 and MAC 01:00:5e:21:c2:55 both claim IP: 10.126.242.58 +tlab 1561488820.vel ionevo events dhcp release for mac 01:00:5e:8a:1a:f9 +aeab 1562723774.uradipis aerat_ flows uira flows deny src=10.121.37.244 dst=10.113.152.241 mac=01:00:5e:9c:86:62 protocol=udp type=utaliqui +nesciu 1563958728.mali roinBCSe_appliance events aid=eetdolor arp_resp=tpersp arp_src=assi auth_neg_dur=rch auth_neg_failed=psa channel=nreprehe dns_req_rtt=pidatatn dns_resp=isno dns_server=luptatev duration=39.622000 full_conn=lla identity=urau ip_resp=aeca ip_src=10.247.118.132 is_8021x=atcupi is_wpa=enima last_auth_ago=uptateve radio=fugitsed reason=lumqui rssi=ectet type=ionu vap=eratv client_mac=01:00:5e:10:8b:c3 client_ip=10.153.33.99 instigator=liq http_resp=xerc dhcp_lease_completed=atisetqu dhcp_ip=squir dhcp_server=gnaaliq dhcp_server_mac=quam dhcp_resp=deriti url=https://www5.example.org/eturadi/umS.txt?mSecti=henderi#taevitae category0=tevel server=10.254.96.130 vpn_type=ita connectivity=iquipexe +tot 1565193683.reme emeumfu events aid=inBCSedu arp_resp=ita arp_src=ade auth_neg_dur=nihilmol auth_neg_failed=nder channel=ano dns_req_rtt=rumexer dns_resp=eab dns_server=iaconseq duration=18.963000 full_conn=eli identity=rissusci ip_resp=ectetur ip_src=10.101.13.122 is_8021x=oconsequ is_wpa=roqui last_auth_ago=oluptate radio=ntut reason=mremaper rssi=uteirur type=ntium vap=ide client_mac=01:00:5e:95:ae:d0 client_ip=10.78.143.52 instigator=ntiumdol http_resp=conse dhcp_lease_completed=aturve dhcp_ip=edqui dhcp_server=tvolu dhcp_server_mac=psu dhcp_resp=strud url=https://internal.example.org/fdeFi/ratv.htm?sequatu=tiumtot#tate category0=udanti server=10.200.98.243 vpn_type=cteturad connectivity=umq +oinvento 1566428637.mporin orissusc_appliance events content_filtering_block url='https://www5.example.net/uov/pariat.htm?litsed=lumd#tiaec' category0='lorem' server='10.247.205.185:7676' client_mac='01:00:5e:6f:21:c8' +metMa emoen.ptate mipsumqu_ ids-alerts ccusa ids-alerts signature=billo priority=doloremi timestamp=1567663591.ectetura dhost=01:00:5e:0a:88:bb direction=inbound protocol=ipv6 src=10.195.90.73:3914 dst=10.147.165.30:7662 message: idents +veniamqu 1568898545.iconsequ ueporr_appliance events IDS: empor +atDuisa mipsa.uas iat ids-alerts signature=hite priority=adipis timestamp=1570133500.abo dhost=01:00:5e:dd:cb:5b direction=inbound protocol=udp src=10.137.166.97 dst=10.162.202.14 message: ipsaqua +deom 1571368454.tiumdo rautod_appliance events content_filtering_block url='https://www5.example.com/illoinve/etcon.htm?nevolup=erspici#itinvolu' category0='adeserun' server='10.227.135.142:6598' +orese 1572603408.umdolore umqui_appliance events MAC 01:00:5e:f1:b8:3a and MAC 01:00:5e:37:9c:af both claim IP: 10.199.29.19 +explicab 1573838362.samvolu teiru_appliance events dhcp no offers for mac 01:00:5e:b8:06:92 +rissusci 1575073317.uaturQ iusmod_ events aid=mips arp_resp=iduntutl arp_src=mipsumd auth_neg_dur=eiusmo auth_neg_failed=quelauda channel=rcit dns_req_rtt=dolo dns_resp=ulamc dns_server=doe duration=10.574000 full_conn=remquela identity=toreve ip_resp=squirat ip_src=10.85.59.172 is_8021x=mto is_wpa=iae last_auth_ago=dent radio=Uten reason=tatiset rssi=sequat type=modoco vap=beataevi client_mac=01:00:5e:92:d8:95 client_ip=10.158.215.216 instigator=deritin http_resp=ptate dhcp_lease_completed=lloi dhcp_ip=nseq dhcp_server=equunt dhcp_server_mac=tutla dhcp_resp=usmod url=https://example.com/qui/itse.gif?orsitame=tasn#exeaco category0=upta server=10.75.122.111 vpn_type=reprehe connectivity=deFinib +orr 1576308271.pre aute events IDS: rchite diff --git a/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json new file mode 100644 index 00000000000..f8677343c20 --- /dev/null +++ b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json @@ -0,0 +1,3370 @@ +[ + { + "@timestamp": "2016-01-29T06:09:59.000Z", + "destination.ip": [ + "10.193.124.51" + ], + "destination.port": 5293, + "event.action": "deny", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "modtempo 1454047799.olab nto_ security_event olaborissecurity_event tur url=https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac src=10.15.44.253:5078 dst=10.193.124.51:5293 mac=01:00:5e:28:ae:7d name=psa sha256=umq disposition=ntium action=deny", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 0, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.15.44.253", + "10.193.124.51" + ], + "rsa.internal.event_desc": "olaborissecurity_event tur", + "rsa.internal.messageid": "security_event", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "ntium", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "nto_", + "rsa.misc.sensor": "nto_", + "rsa.time.event_time": "2016-01-29T06:09:59.000Z", + "service.type": "cisco", + "source.ip": [ + "10.15.44.253" + ], + "source.mac": "01:00:5e:28:ae:7d", + "source.port": 5078, + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://example.org/odoco/ria.jpg?ritin=uredolor#tatemac" + }, + { + "@timestamp": "2016-02-12T13:12:33.000Z", + "destination.mac": "01:00:5e:0f:87:e3", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "umdo 1455282753.itessequ vol_ events dhcp lease of ip 10.102.218.31 from server mac 01:00:5e:9c:c2:9c for client mac 01:00:5e:0f:87:e3 from router 10.15.16.212 on subnet ameaqu with dns aqu", + "fileset.name": "meraki", + "host.ip": "10.15.16.212", + "input.type": "log", + "log.offset": 250, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.15.16.212", + "10.102.218.31" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "vol_", + "rsa.misc.sensor": "vol_", + "rsa.network.dns_a_record": "aqu", + "rsa.network.mask": "ameaqu", + "rsa.time.event_time": "2016-02-12T13:12:33.000Z", + "service.type": "cisco", + "source.ip": [ + "10.102.218.31" + ], + "source.mac": "01:00:5e:9c:c2:9c", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-26T20:15:08.000Z", + "event.action": "ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "uipexea 1456517708.tatio minim_ flows ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 440, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "ceroinBC flows src=10.179.60.216 dst=10.69.53.104 protocol=udp pattern: 0 reprehe" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "minim_", + "rsa.misc.sensor": "minim_", + "rsa.time.event_time": "2016-02-26T20:15:08.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-03-12T03:17:42.000Z", + "destination.ip": [ + "10.112.46.169" + ], + "event.action": "radip flows block", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "mipsu 1457752662.consec taliquip_ flows radip flows block src=10.155.236.240 dst=10.112.46.169 mac=01:00:5e:7a:74:89 protocol=ipv6 type=roidents ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 560, + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.155.236.240", + "10.112.46.169" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "radip flows block" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "taliquip_", + "rsa.misc.sensor": "taliquip_", + "rsa.time.event_time": "2016-03-12T03:17:42.000Z", + "service.type": "cisco", + "source.ip": [ + "10.155.236.240" + ], + "source.mac": "01:00:5e:7a:74:89", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-03-26T10:20:16.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "obeataev 1458987616.lor uidexea_appliance events MAC 01:00:5e:e1:89:ac and MAC 01:00:5e:a3:d9:ac both claim IP: 10.14.107.140", + "fileset.name": "meraki", + "host.mac": "01:00:5e:a3:d9:ac", + "input.type": "log", + "log.offset": 706, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.14.107.140" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "uidexea", + "rsa.misc.sensor": "uidexea", + "rsa.network.eth_host": "01:00:5e:a3:d9:ac", + "rsa.time.event_time": "2016-03-26T10:20:16.000Z", + "service.type": "cisco", + "source.ip": [ + "10.14.107.140" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-04-09T17:22:51.000Z", + "destination.ip": [ + "10.108.180.105" + ], + "destination.mac": "01:00:5e:40:9b:83", + "destination.port": 5098, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "iutal 1460222571.dexe urerep events content_filtering_block url='https://api.example.org/liqu/lorem.gif?ueipsaqu=uidolore#niamqu' category0='ari' server='10.108.180.105:5098' client_mac='01:00:5e:40:9b:83'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 832, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.108.180.105" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "ari", + "rsa.misc.node": "urerep", + "rsa.misc.sensor": "urerep", + "rsa.time.event_time": "2016-04-09T17:22:51.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://api.example.org/liqu/lorem.gif?ueipsaqu=uidolore#niamqu" + }, + { + "@timestamp": "2016-04-24T00:25:25.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ipit 1461457525.idexea riat_appliance events MAC 01:00:5e:25:4f:e4 and MAC 01:00:5e:3f:49:e4 both claim IP: 10.149.88.198", + "fileset.name": "meraki", + "host.mac": "01:00:5e:3f:49:e4", + "input.type": "log", + "log.offset": 1038, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.149.88.198" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "riat", + "rsa.misc.sensor": "riat", + "rsa.network.eth_host": "01:00:5e:3f:49:e4", + "rsa.time.event_time": "2016-04-24T00:25:25.000Z", + "service.type": "cisco", + "source.ip": [ + "10.149.88.198" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-05-08T07:27:59.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ntsuntin 1462692479.aecatcup animi events dhcp release for mac 01:00:5e:e3:10:34", + "fileset.name": "meraki", + "host.mac": "01:00:5e:e3:10:34", + "input.type": "log", + "log.offset": 1160, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "animi", + "rsa.misc.sensor": "animi", + "rsa.network.eth_host": "01:00:5e:e3:10:34", + "rsa.time.event_time": "2016-05-08T07:27:59.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-05-22T14:30:33.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "orsitame 1463927433.quiratio ite events MAC 01:00:5e:48:62:22 and MAC 01:00:5e:9f:b6:a6 both claim IP: 10.243.206.225", + "fileset.name": "meraki", + "host.mac": "01:00:5e:9f:b6:a6", + "input.type": "log", + "log.offset": 1241, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.243.206.225" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ite", + "rsa.misc.sensor": "ite", + "rsa.network.eth_host": "01:00:5e:9f:b6:a6", + "rsa.time.event_time": "2016-05-22T14:30:33.000Z", + "service.type": "cisco", + "source.ip": [ + "10.243.206.225" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-06-05T21:33:08.000Z", + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "olupta turveli.toccae tatno_ ids-alerts taliqu ids-alerts signature=temUten priority=ccusan timestamp=1465162388.iqudirection=outbound protocol=icmp src=10.131.82.116:7307", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 1359, + "network.direction": "outbound", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.131.82.116" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "tatno_ ids-alerts taliqu", + "rsa.misc.sensor": "tatno_ ids-alerts taliqu", + "rsa.time.event_time": "2016-06-05T21:33:08.000Z", + "service.type": "cisco", + "source.ip": [ + "10.131.82.116" + ], + "source.port": 7307, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-06-20T04:35:42.000Z", + "destination.ip": [ + "10.134.0.141" + ], + "destination.port": 2703, + "event.action": "accept", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "uaera 1466397342.sitas ehenderi_ security_event atquovosecurity_event iumto url=https://www5.example.net/sun/essecill.html?saute=vel#quu src=10.210.213.18:7616 dst=10.134.0.141:2703 mac=01:00:5e:aa:42:fa name=idolores sha256=llumquid disposition=tation action=accept", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 1531, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.134.0.141", + "10.210.213.18" + ], + "rsa.internal.event_desc": "atquovosecurity_event iumto", + "rsa.internal.messageid": "security_event", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "tation", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "ehenderi_", + "rsa.misc.sensor": "ehenderi_", + "rsa.time.event_time": "2016-06-20T04:35:42.000Z", + "service.type": "cisco", + "source.ip": [ + "10.210.213.18" + ], + "source.mac": "01:00:5e:aa:42:fa", + "source.port": 7616, + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www5.example.net/sun/essecill.html?saute=vel#quu" + }, + { + "@timestamp": "2016-07-04T11:38:16.000Z", + "destination.ip": [ + "10.74.237.180" + ], + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "omn ipsumq.atcu oremagna_ security_event remipsum security_event liq signature=ist priority=tnon timestamp=1467632296.ionul shost=01:00:5e:c8:9c:2f direction=outbound protocol=udp src=10.163.72.17 dst=10.74.237.180 message:nsequu", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 1798, + "network.direction": "outbound", + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.163.72.17", + "10.74.237.180" + ], + "rsa.internal.event_desc": "remipsum security_event liq", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "oremagna_", + "rsa.misc.policy_name": "nsequu", + "rsa.misc.sensor": "oremagna_", + "rsa.time.event_time": "2016-07-04T11:38:16.000Z", + "service.type": "cisco", + "source.ip": [ + "10.163.72.17" + ], + "source.mac": "01:00:5e:c8:9c:2f", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-07-18T18:40:50.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "omm 1468867250.idestla Nemoeni_appliance events MAC 01:00:5e:c4:69:7f and MAC 01:00:5e:e2:67:d2 both claim IP: 10.72.31.26", + "fileset.name": "meraki", + "host.mac": "01:00:5e:e2:67:d2", + "input.type": "log", + "log.offset": 2028, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.72.31.26" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "Nemoeni", + "rsa.misc.sensor": "Nemoeni", + "rsa.network.eth_host": "01:00:5e:e2:67:d2", + "rsa.time.event_time": "2016-07-18T18:40:50.000Z", + "service.type": "cisco", + "source.ip": [ + "10.72.31.26" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-02T01:43:25.000Z", + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "agna tionemu.eomnisis mqui ids-alerts signature=civeli priority=errorsi timestamp=1470102205.desdirection=internal protocol=tcp src=10.70.95.74:4290", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 2151, + "network.direction": "internal", + "network.protocol": "tcp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.70.95.74" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "mqui", + "rsa.misc.sensor": "mqui", + "rsa.time.event_time": "2016-08-02T01:43:25.000Z", + "service.type": "cisco", + "source.ip": [ + "10.70.95.74" + ], + "source.port": 4290, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-16T08:45:59.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "olupt 1471337159.dit sumquiad events MAC 01:00:5e:ea:e8:7a and MAC 01:00:5e:9c:d2:4a both claim IP: 10.17.21.125", + "fileset.name": "meraki", + "host.mac": "01:00:5e:9c:d2:4a", + "input.type": "log", + "log.offset": 2300, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.17.21.125" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "sumquiad", + "rsa.misc.sensor": "sumquiad", + "rsa.network.eth_host": "01:00:5e:9c:d2:4a", + "rsa.time.event_time": "2016-08-16T08:45:59.000Z", + "service.type": "cisco", + "source.ip": [ + "10.17.21.125" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-30T15:48:33.000Z", + "destination.mac": "01:00:5e:46:17:35", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "amqu 1472572113.uines nsec events dhcp lease of ip 10.85.10.165 from server mac 01:00:5e:63:93:48 for client mac 01:00:5e:46:17:35 from router 10.53.150.119 on subnet uiineavo with dns tisetq", + "fileset.name": "meraki", + "host.ip": "10.53.150.119", + "input.type": "log", + "log.offset": 2413, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.53.150.119", + "10.85.10.165" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "nsec", + "rsa.misc.sensor": "nsec", + "rsa.network.dns_a_record": "tisetq", + "rsa.network.mask": "uiineavo", + "rsa.time.event_time": "2016-08-30T15:48:33.000Z", + "service.type": "cisco", + "source.ip": [ + "10.85.10.165" + ], + "source.mac": "01:00:5e:63:93:48", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-13T22:51:07.000Z", + "destination.ip": [ + "10.187.77.245" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "giatquov eritquii.dexeac iscinge ids-alerts signature=atvol priority=umiur timestamp=1473807067.imadprotocol=igmp src=10.88.231.224 dst=10.187.77.245message: iadese", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 2605, + "network.protocol": "igmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.187.77.245", + "10.88.231.224" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "iscinge", + "rsa.misc.policy_name": "iadese", + "rsa.misc.sensor": "iscinge", + "rsa.time.event_time": "2016-09-13T22:51:07.000Z", + "service.type": "cisco", + "source.ip": [ + "10.88.231.224" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-28T05:53:42.000Z", + "destination.ip": [ + "10.186.58.115" + ], + "destination.mac": "01:00:5e:8f:16:6d", + "destination.port": 7238, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "agnaali 1475042022.gnam tat events content_filtering_block url='https://internal.example.com/quae/maccusa.htm?rQuisau=idex#xerci' category0='aqu' server='10.186.58.115:7238' client_mac='01:00:5e:8f:16:6d'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 2770, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.186.58.115" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "aqu", + "rsa.misc.node": "tat", + "rsa.misc.sensor": "tat", + "rsa.time.event_time": "2016-09-28T05:53:42.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://internal.example.com/quae/maccusa.htm?rQuisau=idex#xerci" + }, + { + "@timestamp": "2016-10-12T12:56:16.000Z", + "destination.mac": "01:00:5e:87:e1:a0", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "apariat 1476276976.tlabore untmolli_ events dhcp lease of ip 10.219.84.37 from server mac 01:00:5e:e8:bf:69 for client mac 01:00:5e:87:e1:a0 from router 10.205.47.51 on subnet uovolup with dns samvolu", + "fileset.name": "meraki", + "host.ip": "10.205.47.51", + "input.type": "log", + "log.offset": 2975, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.205.47.51", + "10.219.84.37" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "untmolli_", + "rsa.misc.sensor": "untmolli_", + "rsa.network.dns_a_record": "samvolu", + "rsa.network.mask": "uovolup", + "rsa.time.event_time": "2016-10-12T12:56:16.000Z", + "service.type": "cisco", + "source.ip": [ + "10.219.84.37" + ], + "source.mac": "01:00:5e:e8:bf:69", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-10-26T19:58:50.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ento 1477511930.pic evita events MAC 01:00:5e:ce:61:db and MAC 01:00:5e:ec:f8:cc both claim IP: 10.3.134.237", + "fileset.name": "meraki", + "host.mac": "01:00:5e:ec:f8:cc", + "input.type": "log", + "log.offset": 3176, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.3.134.237" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "evita", + "rsa.misc.sensor": "evita", + "rsa.network.eth_host": "01:00:5e:ec:f8:cc", + "rsa.time.event_time": "2016-10-26T19:58:50.000Z", + "service.type": "cisco", + "source.ip": [ + "10.3.134.237" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-11-10T03:01:24.000Z", + "destination.ip": [ + "10.63.194.87" + ], + "destination.mac": "01:00:5e:e3:b1:24", + "event.action": "texp", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tmo 1478746884.fficiade uscipit events aid=vitaedi arp_resp=fugitse arp_src=veniamq auth_neg_dur=one auth_neg_failed=etMalor channel=ipi dns_req_rtt=reseos dns_resp=pariatu dns_server=tin duration=48.123000 full_conn=oquisqu identity=sperna ip_resp=eabilloi ip_src=10.182.178.217 is_8021x=tlab is_wpa=volupt last_auth_ago=osqui radio=xerc reason=iutali rssi=fdeFi type=texp vap=tasuntex client_mac=01:00:5e:e3:b1:24 client_ip=10.194.114.58 instigator=ectio http_resp=dutper dhcp_lease_completed=lamcolab dhcp_ip=ati dhcp_server=tlabo dhcp_server_mac=uames dhcp_resp=iduntu url=https://internal.example.net/ris/uamqu.txt?liqui=quioffi#uptate category0=ncidid server=10.63.194.87 vpn_type=quisno connectivity=sin", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 3285, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.182.178.217", + "10.63.194.87" + ], + "rsa.counters.dclass_r1": "fdeFi", + "rsa.internal.messageid": "events", + "rsa.misc.category": "ncidid", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "texp", + "rsa.misc.node": "uscipit", + "rsa.misc.sensor": "uscipit", + "rsa.time.duration_time": 48.123, + "rsa.time.event_time": "2016-11-10T03:01:24.000Z", + "service.type": "cisco", + "source.ip": [ + "10.182.178.217" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://internal.example.net/ris/uamqu.txt?liqui=quioffi#uptate" + }, + { + "@timestamp": "2016-11-24T10:03:59.000Z", + "destination.ip": [ + "10.163.154.210" + ], + "destination.mac": "01:00:5e:9e:7b:a4", + "event.action": "rau", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "emvel 1479981839.tmollita fde events aid=nsecte arp_resp=inculpa arp_src=abo auth_neg_dur=veniamqu auth_neg_failed=nse channel=non dns_req_rtt=paquioff dns_resp=mquisnos dns_server=maven duration=71.798000 full_conn=atcu identity=labor ip_resp=didunt ip_src=10.153.0.77 is_8021x=udan is_wpa=orema last_auth_ago=invento radio=qua reason=aturQui rssi=utlabor type=rau vap=idex client_mac=01:00:5e:9e:7b:a4 client_ip=10.105.88.20 instigator=ecte http_resp=tinvolu dhcp_lease_completed=iurer dhcp_ip=iciadese dhcp_server=quidolor dhcp_server_mac=tessec dhcp_resp=olupta url=https://mail.example.com/icabo/itatio.jpg?eleum=sintoc#volupt category0=siste server=10.163.154.210 vpn_type=ept connectivity=iumtotam", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 3996, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.153.0.77", + "10.163.154.210" + ], + "rsa.counters.dclass_r1": "utlabor", + "rsa.internal.messageid": "events", + "rsa.misc.category": "siste", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "rau", + "rsa.misc.node": "fde", + "rsa.misc.sensor": "fde", + "rsa.time.duration_time": 71.798, + "rsa.time.event_time": "2016-11-24T10:03:59.000Z", + "service.type": "cisco", + "source.ip": [ + "10.153.0.77" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://mail.example.com/icabo/itatio.jpg?eleum=sintoc#volupt" + }, + { + "@timestamp": "2016-12-08T17:06:33.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ionevo 1481216793.ugiatnu ciati_appliance events MAC 01:00:5e:b8:7a:96 and MAC 01:00:5e:b9:6b:a8 both claim IP: 10.73.69.176", + "fileset.name": "meraki", + "host.mac": "01:00:5e:b9:6b:a8", + "input.type": "log", + "log.offset": 4701, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.73.69.176" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ciati", + "rsa.misc.sensor": "ciati", + "rsa.network.eth_host": "01:00:5e:b9:6b:a8", + "rsa.time.event_time": "2016-12-08T17:06:33.000Z", + "service.type": "cisco", + "source.ip": [ + "10.73.69.176" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2016-12-23T00:09:07.000Z", + "event.action": "ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "spi 1482451747.stquido ommodico_ flows ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 4826, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "ese flows allow src=10.145.248.111 dst=10.57.6.252 mac=01:00:5e:94:6a:cf protocol=udp" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "ommodico_", + "rsa.misc.sensor": "ommodico_", + "rsa.time.event_time": "2016-12-23T00:09:07.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-01-06T07:11:41.000Z", + "destination.ip": [ + "10.12.182.70" + ], + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "smo etcons.iusmodi uamest_ security_event uiac security_event epte signature=idolo priority=quinesc timestamp=1483686701.madmi shost=01:00:5e:1c:4c:64 direction=internal protocol=icmp src=10.31.77.157 dst=10.12.182.70 message:tev", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 4952, + "network.direction": "internal", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.12.182.70", + "10.31.77.157" + ], + "rsa.internal.event_desc": "uiac security_event epte", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "uamest_", + "rsa.misc.policy_name": "tev", + "rsa.misc.sensor": "uamest_", + "rsa.time.event_time": "2017-01-06T07:11:41.000Z", + "service.type": "cisco", + "source.ip": [ + "10.31.77.157" + ], + "source.mac": "01:00:5e:1c:4c:64", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-01-20T14:14:16.000Z", + "event.action": "cancel", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "nisiuta 1484921656.roid inibusB flows cancel", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5182, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "inibusB", + "rsa.misc.sensor": "inibusB", + "rsa.time.event_time": "2017-01-20T14:14:16.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-02-03T21:16:50.000Z", + "destination.ip": [ + "10.135.217.12" + ], + "event.action": "cteturad flows deny", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "str 1486156610.idolore pid_ flows cteturad flows deny src=10.93.68.231 dst=10.135.217.12 mac=01:00:5e:4a:69:5b protocol=ipv6 type=archite ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5227, + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.93.68.231", + "10.135.217.12" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "cteturad flows deny" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "pid_", + "rsa.misc.sensor": "pid_", + "rsa.time.event_time": "2017-02-03T21:16:50.000Z", + "service.type": "cisco", + "source.ip": [ + "10.93.68.231" + ], + "source.mac": "01:00:5e:4a:69:5b", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-02-18T04:19:24.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "amnih 1487391564.ium esciuntN_ events dhcp release for mac 01:00:5e:8b:99:98", + "fileset.name": "meraki", + "host.mac": "01:00:5e:8b:99:98", + "input.type": "log", + "log.offset": 5366, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "esciuntN_", + "rsa.misc.sensor": "esciuntN_", + "rsa.network.eth_host": "01:00:5e:8b:99:98", + "rsa.time.event_time": "2017-02-18T04:19:24.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-03-04T11:21:59.000Z", + "destination.ip": [ + "10.66.89.5" + ], + "event.action": "iscinge flows", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "isnost 1488626519.queips ncidi_ flows iscinge flows src=10.247.30.212 dst=10.66.89.5 mac=01:00:5e:7f:65:da protocol=igmp pattern: 1 borios", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5443, + "network.protocol": "igmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.247.30.212", + "10.66.89.5" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "iscinge flows" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "ncidi_", + "rsa.misc.sensor": "ncidi_", + "rsa.time.event_time": "2017-03-04T11:21:59.000Z", + "service.type": "cisco", + "source.ip": [ + "10.247.30.212" + ], + "source.mac": "01:00:5e:7f:65:da", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-03-18T18:24:33.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "oin 1489861473.mvenia madminim events IDS: fugitsed", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5582, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "fugitsed", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "madminim", + "rsa.misc.sensor": "madminim", + "rsa.time.event_time": "2017-03-18T18:24:33.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-02T01:27:07.000Z", + "destination.ip": [ + "10.173.136.186" + ], + "destination.mac": "01:00:5e:c1:53:b1", + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "dmin fugi.quia iduntu security_event idestlab signature=rnatur priority=ofdeFin timestamp=1491096427.essequam dhost=01:00:5e:c1:53:b1 direction=inbound protocol=tcp src=10.221.102.245 dst=10.173.136.186 message:naal", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5634, + "network.direction": "inbound", + "network.protocol": "tcp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.173.136.186", + "10.221.102.245" + ], + "rsa.internal.event_desc": "idestlab", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "iduntu", + "rsa.misc.policy_name": "naal", + "rsa.misc.sensor": "iduntu", + "rsa.time.event_time": "2017-04-02T01:27:07.000Z", + "service.type": "cisco", + "source.ip": [ + "10.221.102.245" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-16T08:29:41.000Z", + "destination.ip": [ + "10.54.37.86" + ], + "destination.mac": "01:00:5e:1f:c6:29", + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "umqu tinv.adipisc uscipitl_ ids-alerts ritatise ids-alerts signature=uamei priority=siut timestamp=1492331381.ciad dhost=01:00:5e:1f:c6:29 direction=external protocol=udp src=10.58.64.108 dst=10.54.37.86 message: entorev", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 5850, + "network.direction": "external", + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.58.64.108", + "10.54.37.86" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "uscipitl_ ids-alerts ritatise", + "rsa.misc.policy_name": "entorev", + "rsa.misc.sensor": "uscipitl_ ids-alerts ritatise", + "rsa.time.event_time": "2017-04-16T08:29:41.000Z", + "service.type": "cisco", + "source.ip": [ + "10.58.64.108" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-30T15:32:16.000Z", + "destination.ip": [ + "10.163.93.20" + ], + "event.action": "veli flows block", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "velitess 1493566336.naali uunturm_ flows veli flows block src=10.147.76.202 dst=10.163.93.20 mac=01:00:5e:1d:85:ec protocol=ipv6 sport=1085 dport=3141 ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 6071, + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.163.93.20", + "10.147.76.202" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "veli flows block" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "uunturm_", + "rsa.misc.sensor": "uunturm_", + "rsa.time.event_time": "2017-04-30T15:32:16.000Z", + "service.type": "cisco", + "source.ip": [ + "10.147.76.202" + ], + "source.mac": "01:00:5e:1d:85:ec", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-05-14T22:34:50.000Z", + "destination.ip": [ + "10.183.44.198" + ], + "destination.mac": "01:00:5e:35:71:1e", + "destination.port": 1702, + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "iumdol tpersp.stla uptatema_ security_event uradi security_event tot signature=llamco priority=nea timestamp=1494801290.psum dhost=01:00:5e:35:71:1e direction=internal protocol=icmp src=10.0.200.27:5905 dst=10.183.44.198:1702 message:asiarc", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 6223, + "network.direction": "internal", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.0.200.27", + "10.183.44.198" + ], + "rsa.internal.event_desc": "uradi security_event tot", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "uptatema_", + "rsa.misc.policy_name": "asiarc", + "rsa.misc.sensor": "uptatema_", + "rsa.time.event_time": "2017-05-14T22:34:50.000Z", + "service.type": "cisco", + "source.ip": [ + "10.0.200.27" + ], + "source.port": 5905, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-05-29T05:37:24.000Z", + "destination.mac": "01:00:5e:06:12:98", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tiaec 1496036244.rumwrit icabo_ events dhcp lease of ip 10.148.124.84 from server mac 01:00:5e:0b:2c:22 for client mac 01:00:5e:06:12:98 from router 10.28.144.180 on subnet ritin with dns temporin", + "fileset.name": "meraki", + "host.ip": "10.28.144.180", + "input.type": "log", + "log.offset": 6464, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.148.124.84", + "10.28.144.180" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "icabo_", + "rsa.misc.sensor": "icabo_", + "rsa.network.dns_a_record": "temporin", + "rsa.network.mask": "ritin", + "rsa.time.event_time": "2017-05-29T05:37:24.000Z", + "service.type": "cisco", + "source.ip": [ + "10.148.124.84" + ], + "source.mac": "01:00:5e:0b:2c:22", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-06-12T12:39:58.000Z", + "destination.ip": [ + "10.98.194.212" + ], + "destination.mac": "01:00:5e:bb:60:a6", + "event.action": "utaliqu", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ica 1497271198.lillum remips_appliance events aid=uisaute arp_resp=imide arp_src=poriss auth_neg_dur=tvolup auth_neg_failed=itesseq channel=dictasun dns_req_rtt=veniamqu dns_resp=rum dns_server=quaea duration=165.611000 full_conn=mvel identity=nof ip_resp=usmodi ip_src=10.204.230.166 is_8021x=dat is_wpa=aincidu last_auth_ago=nimadmin radio=isiu reason=licabo rssi=enimadmi type=utaliqu vap=dic client_mac=01:00:5e:bb:60:a6 client_ip=10.62.71.118 instigator=ineavol http_resp=iosa dhcp_lease_completed=boNemoe dhcp_ip=onsequ dhcp_server=equinesc dhcp_server_mac=cab dhcp_resp=atisund url=https://example.net/ites/isetq.gif?nisiut=tur#avolupt category0=ariatur server=10.98.194.212 vpn_type=nimave connectivity=isciv", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 6661, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.98.194.212", + "10.204.230.166" + ], + "rsa.counters.dclass_r1": "enimadmi", + "rsa.internal.messageid": "events", + "rsa.misc.category": "ariatur", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "utaliqu", + "rsa.misc.node": "remips", + "rsa.misc.sensor": "remips", + "rsa.time.duration_time": 165.611, + "rsa.time.event_time": "2017-06-12T12:39:58.000Z", + "service.type": "cisco", + "source.ip": [ + "10.204.230.166" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://example.net/ites/isetq.gif?nisiut=tur#avolupt" + }, + { + "@timestamp": "2017-06-26T19:42:33.000Z", + "destination.ip": [ + "10.197.13.39" + ], + "destination.port": 5912, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "dipisci 1498506153.spernatu admi events content_filtering_block url='https://www.example.org/ueipsa/tae.html?eriti=atcupi#corpori' category0='borisnis' server='10.197.13.39:5912'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 7378, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.197.13.39" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "borisnis", + "rsa.misc.node": "admi", + "rsa.misc.sensor": "admi", + "rsa.time.event_time": "2017-06-26T19:42:33.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.org/ueipsa/tae.html?eriti=atcupi#corpori" + }, + { + "@timestamp": "2017-07-11T02:45:07.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "itsedd 1499741107.leumiur eratvol events dhcp release for mac 01:00:5e:fd:84:bb", + "fileset.name": "meraki", + "host.mac": "01:00:5e:fd:84:bb", + "input.type": "log", + "log.offset": 7557, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "eratvol", + "rsa.misc.sensor": "eratvol", + "rsa.network.eth_host": "01:00:5e:fd:84:bb", + "rsa.time.event_time": "2017-07-11T02:45:07.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-07-25T09:47:41.000Z", + "destination.ip": [ + "10.150.245.88" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "leumiu tla.item nimid ids-alerts signature=dat priority=periam timestamp=1500976061.dquprotocol=icmp src=10.242.77.170 dst=10.150.245.88message: orisn", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 7637, + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.242.77.170", + "10.150.245.88" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "nimid", + "rsa.misc.policy_name": "orisn", + "rsa.misc.sensor": "nimid", + "rsa.time.event_time": "2017-07-25T09:47:41.000Z", + "service.type": "cisco", + "source.ip": [ + "10.242.77.170" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-08-08T16:50:15.000Z", + "destination.ip": [ + "10.180.195.43" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "sitam rad.loi isc_ ids-alerts volupt ids-alerts signature=rem priority=idid timestamp=1502211015.tesse shost=01:00:5e:9d:eb:fb direction=external protocol=tcp src=10.247.139.239 dst=10.180.195.43 message: tenatuse", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 7788, + "network.direction": "external", + "network.protocol": "tcp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.247.139.239", + "10.180.195.43" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "isc_ ids-alerts volupt", + "rsa.misc.policy_name": "tenatuse", + "rsa.misc.sensor": "isc_ ids-alerts volupt", + "rsa.time.event_time": "2017-08-08T16:50:15.000Z", + "service.type": "cisco", + "source.ip": [ + "10.247.139.239" + ], + "source.mac": "01:00:5e:9d:eb:fb", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-08-22T23:52:50.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tore 1503445970.elits consequa events dhcp release for mac 01:00:5e:50:48:c4", + "fileset.name": "meraki", + "host.mac": "01:00:5e:50:48:c4", + "input.type": "log", + "log.offset": 8002, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "consequa", + "rsa.misc.sensor": "consequa", + "rsa.network.eth_host": "01:00:5e:50:48:c4", + "rsa.time.event_time": "2017-08-22T23:52:50.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-09-06T06:55:24.000Z", + "destination.ip": [ + "10.147.15.213" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "undeom uamnihi.risnis uov_ ids-alerts isn ids-alerts signature=sBono priority=loremqu timestamp=1504680924.teturprotocol=rdp src=10.94.6.140 dst=10.147.15.213message: uptat", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 8079, + "network.protocol": "rdp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.147.15.213", + "10.94.6.140" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "uov_ ids-alerts isn", + "rsa.misc.policy_name": "uptat", + "rsa.misc.sensor": "uov_ ids-alerts isn", + "rsa.time.event_time": "2017-09-06T06:55:24.000Z", + "service.type": "cisco", + "source.ip": [ + "10.94.6.140" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-09-20T13:57:58.000Z", + "destination.ip": [ + "10.111.157.56" + ], + "event.action": "obeata flows block", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "itasper 1505915878.uae mve_ flows obeata flows block src=10.230.6.127 dst=10.111.157.56 mac=01:00:5e:39:a7:fc protocol=icmp type=aliquamq ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 8252, + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.230.6.127", + "10.111.157.56" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "obeata flows block" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "mve_", + "rsa.misc.sensor": "mve_", + "rsa.time.event_time": "2017-09-20T13:57:58.000Z", + "service.type": "cisco", + "source.ip": [ + "10.230.6.127" + ], + "source.mac": "01:00:5e:39:a7:fc", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-10-04T21:00:32.000Z", + "destination.ip": [ + "10.193.219.34" + ], + "destination.mac": "01:00:5e:58:2d:1c", + "event.action": "inBC", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "archite 1507150832.remq veniamq events aid=occ arp_resp=oloreseo arp_src=iruredol auth_neg_dur=veniamqu auth_neg_failed=licaboN channel=atquo dns_req_rtt=cupi dns_resp=strude dns_server=eritin duration=85.513000 full_conn=litsedq identity=nderiti ip_resp=ntNe ip_src=10.179.40.170 is_8021x=olorema is_wpa=mollita last_auth_ago=tatem radio=iae reason=quido rssi=emip type=inBC vap=mol client_mac=01:00:5e:58:2d:1c client_ip=10.153.81.206 instigator=rsita http_resp=nsequun dhcp_lease_completed=eetd dhcp_ip=illu dhcp_server=iatqu dhcp_server_mac=lorsi dhcp_resp=repreh url=https://www.example.net/irured/illumqui.txt?tionula=ritqu#ecatcupi category0=uamei server=10.193.219.34 vpn_type=onse connectivity=olorem", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 8391, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.193.219.34", + "10.179.40.170" + ], + "rsa.counters.dclass_r1": "emip", + "rsa.internal.messageid": "events", + "rsa.misc.category": "uamei", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "inBC", + "rsa.misc.node": "veniamq", + "rsa.misc.sensor": "veniamq", + "rsa.time.duration_time": 85.513, + "rsa.time.event_time": "2017-10-04T21:00:32.000Z", + "service.type": "cisco", + "source.ip": [ + "10.179.40.170" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.net/irured/illumqui.txt?tionula=ritqu#ecatcupi" + }, + { + "@timestamp": "2017-10-19T04:03:07.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "umwritte 1508385787.vol oremquel_appliance events MAC 01:00:5e:16:5e:b1 and MAC 01:00:5e:ee:e8:77 both claim IP: 10.255.199.16", + "fileset.name": "meraki", + "host.mac": "01:00:5e:ee:e8:77", + "input.type": "log", + "log.offset": 9101, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.255.199.16" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "oremquel", + "rsa.misc.sensor": "oremquel", + "rsa.network.eth_host": "01:00:5e:ee:e8:77", + "rsa.time.event_time": "2017-10-19T04:03:07.000Z", + "service.type": "cisco", + "source.ip": [ + "10.255.199.16" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-11-02T11:05:41.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "unte 1509620741.uamnihil llam_appliance events MAC 01:00:5e:ee:1d:77 and MAC 01:00:5e:f1:21:bd both claim IP: 10.94.88.5", + "fileset.name": "meraki", + "host.mac": "01:00:5e:f1:21:bd", + "input.type": "log", + "log.offset": 9228, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.94.88.5" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "llam", + "rsa.misc.sensor": "llam", + "rsa.network.eth_host": "01:00:5e:f1:21:bd", + "rsa.time.event_time": "2017-11-02T11:05:41.000Z", + "service.type": "cisco", + "source.ip": [ + "10.94.88.5" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-11-16T18:08:15.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "esci 1510855695.uov quaeab_ events IDS: moles", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9349, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "moles", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "quaeab_", + "rsa.misc.sensor": "quaeab_", + "rsa.time.event_time": "2017-11-16T18:08:15.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-01T01:10:49.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "accusa 1512090649.natu liquid events IDS: enim", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9395, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "enim", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "liquid", + "rsa.misc.sensor": "liquid", + "rsa.time.event_time": "2017-12-01T01:10:49.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-15T08:13:24.000Z", + "destination.ip": [ + "10.124.63.4" + ], + "destination.mac": "01:00:5e:01:60:e0", + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "dquiaco nibus.vitaed ser security_event etconsec signature=elillum priority=upt timestamp=1513325604.rnat dhost=01:00:5e:01:60:e0 direction=internal protocol=ipv6 src=10.90.99.245 dst=10.124.63.4 message:pta", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9442, + "network.direction": "internal", + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.90.99.245", + "10.124.63.4" + ], + "rsa.internal.event_desc": "etconsec", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "ser", + "rsa.misc.policy_name": "pta", + "rsa.misc.sensor": "ser", + "rsa.time.event_time": "2017-12-15T08:13:24.000Z", + "service.type": "cisco", + "source.ip": [ + "10.90.99.245" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-29T15:15:58.000Z", + "destination.ip": [ + "10.249.7.146" + ], + "destination.port": 2010, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tetura 1514560558.imadmini moe_appliance events content_filtering_block url='https://mail.example.net/uat/lupta.html?uptassit=ncidi#tlabori' category0='laudan' server='10.249.7.146:2010'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9650, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.249.7.146" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "laudan", + "rsa.misc.node": "moe", + "rsa.misc.sensor": "moe", + "rsa.time.event_time": "2017-12-29T15:15:58.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://mail.example.net/uat/lupta.html?uptassit=ncidi#tlabori" + }, + { + "@timestamp": "2018-01-12T22:18:32.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "lapar 1515795512.ritati edquia_appliance events IDS: itesse", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9837, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "itesse", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "edquia", + "rsa.misc.sensor": "edquia", + "rsa.time.event_time": "2018-01-12T22:18:32.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-01-27T05:21:06.000Z", + "destination.ip": [ + "10.81.234.34" + ], + "destination.mac": "01:00:5e:c9:b7:22", + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "amvolu mip.tion tobeatae_ security_event Utenima security_event iqua signature=luptat priority=deriti timestamp=1517030466.sintocc dhost=01:00:5e:c9:b7:22 direction=inbound protocol=icmp src=10.196.96.162 dst=10.81.234.34 message:equuntur", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 9897, + "network.direction": "inbound", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.196.96.162", + "10.81.234.34" + ], + "rsa.internal.event_desc": "Utenima security_event iqua", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "tobeatae_", + "rsa.misc.policy_name": "equuntur", + "rsa.misc.sensor": "tobeatae_", + "rsa.time.event_time": "2018-01-27T05:21:06.000Z", + "service.type": "cisco", + "source.ip": [ + "10.196.96.162" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-02-10T12:23:41.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "uide 1518265421.scivel henderi_appliance events IDS: iusmodt", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 10136, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "iusmodt", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "henderi", + "rsa.misc.sensor": "henderi", + "rsa.time.event_time": "2018-02-10T12:23:41.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-02-24T19:26:15.000Z", + "destination.mac": "01:00:5e:7c:01:ab", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tiumd 1519500375.ntmoll mexer events dhcp lease of ip 10.40.101.224 from server mac 01:00:5e:0a:df:72 for client mac 01:00:5e:7c:01:ab with hostname remips188.api.invalid from router 10.78.199.43 on subnet ehender with dns ilmole", + "fileset.name": "meraki", + "host.ip": "10.78.199.43", + "host.name": "remips188.api.invalid", + "input.type": "log", + "log.offset": 10197, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.40.101.224", + "10.78.199.43" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "mexer", + "rsa.misc.sensor": "mexer", + "rsa.network.alias_host": [ + "remips188.api.invalid" + ], + "rsa.network.dns_a_record": "ilmole", + "rsa.network.mask": "ehender", + "rsa.time.event_time": "2018-02-24T19:26:15.000Z", + "service.type": "cisco", + "source.ip": [ + "10.40.101.224" + ], + "source.mac": "01:00:5e:0a:df:72", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-03-11T02:28:49.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "runtmo 1520735329.ore isund_appliance events MAC 01:00:5e:17:87:3e and MAC 01:00:5e:5f:c1:3e both claim IP: 10.244.29.119", + "fileset.name": "meraki", + "host.mac": "01:00:5e:5f:c1:3e", + "input.type": "log", + "log.offset": 10427, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.244.29.119" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "isund", + "rsa.misc.sensor": "isund", + "rsa.network.eth_host": "01:00:5e:5f:c1:3e", + "rsa.time.event_time": "2018-03-11T02:28:49.000Z", + "service.type": "cisco", + "source.ip": [ + "10.244.29.119" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-03-25T09:31:24.000Z", + "destination.ip": [ + "10.39.172.93" + ], + "event.action": "pteurs flows deny", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tutlabor 1521970284.reseosq gna_ flows pteurs flows deny src=10.83.131.245 dst=10.39.172.93 mac=01:00:5e:c4:12:c7 protocol=udp type=uido ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 10549, + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.39.172.93", + "10.83.131.245" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "pteurs flows deny" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "gna_", + "rsa.misc.sensor": "gna_", + "rsa.time.event_time": "2018-03-25T09:31:24.000Z", + "service.type": "cisco", + "source.ip": [ + "10.83.131.245" + ], + "source.mac": "01:00:5e:c4:12:c7", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-04-08T16:33:58.000Z", + "destination.mac": "01:00:5e:7e:cd:15", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "osquira 1523205238.umd sciveli_ events dhcp lease of ip 10.86.188.179 from server mac 01:00:5e:48:4b:78 for client mac 01:00:5e:7e:cd:15 from router 10.201.168.116 on subnet umiure with dns laborum", + "fileset.name": "meraki", + "host.ip": "10.201.168.116", + "input.type": "log", + "log.offset": 10687, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.86.188.179", + "10.201.168.116" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "sciveli_", + "rsa.misc.sensor": "sciveli_", + "rsa.network.dns_a_record": "laborum", + "rsa.network.mask": "umiure", + "rsa.time.event_time": "2018-04-08T16:33:58.000Z", + "service.type": "cisco", + "source.ip": [ + "10.86.188.179" + ], + "source.mac": "01:00:5e:48:4b:78", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-04-22T23:36:32.000Z", + "destination.ip": [ + "10.122.204.151" + ], + "destination.port": 3903, + "event.action": "deny", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "umdolors 1524440192.lumdo acom_ security_event umexercisecurity_event duntut url=https://mail.example.com/prehend/eufug.htm?eufug=est#civelits src=10.148.211.222:2053 dst=10.122.204.151:3903 mac=01:00:5e:c3:a0:dc name=ine sha256=urerepre disposition=asnulap action=deny", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 10885, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.122.204.151", + "10.148.211.222" + ], + "rsa.internal.event_desc": "umexercisecurity_event duntut", + "rsa.internal.messageid": "security_event", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "asnulap", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "acom_", + "rsa.misc.sensor": "acom_", + "rsa.time.event_time": "2018-04-22T23:36:32.000Z", + "service.type": "cisco", + "source.ip": [ + "10.148.211.222" + ], + "source.mac": "01:00:5e:c3:a0:dc", + "source.port": 2053, + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://mail.example.com/prehend/eufug.htm?eufug=est#civelits" + }, + { + "@timestamp": "2018-05-07T06:39:06.000Z", + "event.action": "luptatem flows accept", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "atnul 1525675146.umfugi stquidol_ flows luptatem flows accept", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 11155, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "luptatem flows accept" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "stquidol_", + "rsa.misc.sensor": "stquidol_", + "rsa.time.event_time": "2018-05-07T06:39:06.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-05-21T13:41:41.000Z", + "destination.ip": [ + "10.120.4.9" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "essequam ueporro.aliqu upt ids-alerts signature=orum priority=Bonoru timestamp=1526910101.madminimprotocol=ipv6-icmp src=10.97.46.16 dst=10.120.4.9message: teni", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 11217, + "network.protocol": "ipv6-icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.97.46.16", + "10.120.4.9" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "upt", + "rsa.misc.policy_name": "teni", + "rsa.misc.sensor": "upt", + "rsa.time.event_time": "2018-05-21T13:41:41.000Z", + "service.type": "cisco", + "source.ip": [ + "10.97.46.16" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-06-04T20:44:15.000Z", + "destination.ip": [ + "10.165.173.162" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "lorsitam tanimid.onpr litseddo_ ids-alerts oremqu ids-alerts signature=idex priority=radip timestamp=1528145055.uptaprotocol=ipv6-icmp src=10.171.206.139 dst=10.165.173.162message: lestia", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 11378, + "network.protocol": "ipv6-icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.171.206.139", + "10.165.173.162" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "litseddo_ ids-alerts oremqu", + "rsa.misc.policy_name": "lestia", + "rsa.misc.sensor": "litseddo_ ids-alerts oremqu", + "rsa.time.event_time": "2018-06-04T20:44:15.000Z", + "service.type": "cisco", + "source.ip": [ + "10.171.206.139" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-06-19T03:46:49.000Z", + "destination.mac": "01:00:5e:f2:d3:12", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "inibusB 1529380009.nostrud cteturad events dhcp lease of ip 10.150.163.151 from server mac 01:00:5e:72:b7:79 for client mac 01:00:5e:f2:d3:12 with hostname uames4985.mail.localdomain from router 10.144.57.239 on subnet oinBCSed with dns orem", + "fileset.name": "meraki", + "host.ip": "10.144.57.239", + "host.name": "uames4985.mail.localdomain", + "input.type": "log", + "log.offset": 11566, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.144.57.239", + "10.150.163.151" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "cteturad", + "rsa.misc.sensor": "cteturad", + "rsa.network.alias_host": [ + "uames4985.mail.localdomain" + ], + "rsa.network.dns_a_record": "orem", + "rsa.network.mask": "oinBCSed", + "rsa.time.event_time": "2018-06-19T03:46:49.000Z", + "service.type": "cisco", + "source.ip": [ + "10.150.163.151" + ], + "source.mac": "01:00:5e:72:b7:79", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-03T10:49:23.000Z", + "destination.ip": [ + "10.54.44.231" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "eritq rehen.ipsamvol elillum_ ids-alerts tco ids-alerts signature=tvol priority=oluptate timestamp=1530614963.lit shost=01:00:5e:ac:6d:d3 direction=unknown protocol=igmp src=10.52.202.158 dst=10.54.44.231 message: Ute", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 11808, + "network.direction": "unknown", + "network.protocol": "igmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.54.44.231", + "10.52.202.158" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "elillum_ ids-alerts tco", + "rsa.misc.policy_name": "Ute", + "rsa.misc.sensor": "elillum_ ids-alerts tco", + "rsa.time.event_time": "2018-07-03T10:49:23.000Z", + "service.type": "cisco", + "source.ip": [ + "10.52.202.158" + ], + "source.mac": "01:00:5e:ac:6d:d3", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-17T17:51:58.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "runtm 1531849918.eturadip olorsi_ events MAC 01:00:5e:67:1d:0f and MAC 01:00:5e:f0:a9:cd both claim IP: 10.101.183.86", + "fileset.name": "meraki", + "host.mac": "01:00:5e:f0:a9:cd", + "input.type": "log", + "log.offset": 12026, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.101.183.86" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "olorsi_", + "rsa.misc.sensor": "olorsi_", + "rsa.network.eth_host": "01:00:5e:f0:a9:cd", + "rsa.time.event_time": "2018-07-17T17:51:58.000Z", + "service.type": "cisco", + "source.ip": [ + "10.101.183.86" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-01T00:54:32.000Z", + "event.action": "orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "inesciu 1533084872.quid atcupid_ flows orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 12144, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "orem flows src=10.71.22.225 dst=10.4.76.100 protocol=ggp pattern: allow serrorsi" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "atcupid_", + "rsa.misc.sensor": "atcupid_", + "rsa.time.event_time": "2018-08-01T00:54:32.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-15T07:57:06.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "lamco 1534319826.cit siar events MAC 01:00:5e:80:cd:ca and MAC 01:00:5e:45:aa:51 both claim IP: 10.83.130.95", + "fileset.name": "meraki", + "host.mac": "01:00:5e:45:aa:51", + "input.type": "log", + "log.offset": 12264, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.83.130.95" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "siar", + "rsa.misc.sensor": "siar", + "rsa.network.eth_host": "01:00:5e:45:aa:51", + "rsa.time.event_time": "2018-08-15T07:57:06.000Z", + "service.type": "cisco", + "source.ip": [ + "10.83.130.95" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-29T14:59:40.000Z", + "destination.ip": [ + "10.103.49.129" + ], + "destination.mac": "01:00:5e:59:bf:36", + "event.action": "olor", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "hite 1535554780.ianonnum nofdeFi events aid=henderit arp_resp=remq arp_src=unt auth_neg_dur=tla auth_neg_failed=arch channel=lite dns_req_rtt=ugia dns_resp=meum dns_server=borumSec duration=91.439000 full_conn=nvolupta identity=tev ip_resp=nre ip_src=10.2.110.73 is_8021x=eturadip is_wpa=ent last_auth_ago=rumSecti radio=Utenima reason=olore rssi=orumS type=olor vap=radip client_mac=01:00:5e:59:bf:36 client_ip=10.230.98.81 instigator=aaliquaU http_resp=olu dhcp_lease_completed=iameaque dhcp_ip=identsun dhcp_server=ender dhcp_server_mac=inc dhcp_resp=tect url=https://www.example.net/doconse/eni.html?mSec=smoditem#tatisetq category0=uidolo server=10.103.49.129 vpn_type=oquisq connectivity=abori", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 12373, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.103.49.129", + "10.2.110.73" + ], + "rsa.counters.dclass_r1": "orumS", + "rsa.internal.messageid": "events", + "rsa.misc.category": "uidolo", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "olor", + "rsa.misc.node": "nofdeFi", + "rsa.misc.sensor": "nofdeFi", + "rsa.time.duration_time": 91.439, + "rsa.time.event_time": "2018-08-29T14:59:40.000Z", + "service.type": "cisco", + "source.ip": [ + "10.2.110.73" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.net/doconse/eni.html?mSec=smoditem#tatisetq" + }, + { + "@timestamp": "2018-09-12T22:02:15.000Z", + "destination.ip": [ + "10.132.176.96" + ], + "destination.mac": "01:00:5e:e6:a6:a2", + "event.action": "rvelill", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "dunt 1536789735.ames amni events aid=tatio arp_resp=amquisno arp_src=modoc auth_neg_dur=magnam auth_neg_failed=uinesc channel=cid dns_req_rtt=emi dns_resp=Bonorum dns_server=lesti duration=59.289000 full_conn=iosamni identity=idu ip_resp=sis ip_src=10.158.61.228 is_8021x=tsedquia is_wpa=its last_auth_ago=umdolor radio=isiu reason=assi rssi=eserun type=rvelill vap=lupta client_mac=01:00:5e:e6:a6:a2 client_ip=10.186.16.20 instigator=tisu http_resp=remagnam dhcp_lease_completed=nvolupt dhcp_ip=meiusm dhcp_server=nidolo dhcp_server_mac=atquovol dhcp_resp=quunt url=https://www.example.com/seq/moll.htm?sunt=dquianon#urExc category0=tDuis server=10.132.176.96 vpn_type=aria connectivity=inim", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 13073, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.132.176.96", + "10.158.61.228" + ], + "rsa.counters.dclass_r1": "eserun", + "rsa.internal.messageid": "events", + "rsa.misc.category": "tDuis", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "rvelill", + "rsa.misc.node": "amni", + "rsa.misc.sensor": "amni", + "rsa.time.duration_time": 59.289, + "rsa.time.event_time": "2018-09-12T22:02:15.000Z", + "service.type": "cisco", + "source.ip": [ + "10.158.61.228" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.com/seq/moll.htm?sunt=dquianon#urExc" + }, + { + "@timestamp": "2018-09-27T05:04:49.000Z", + "destination.mac": "01:00:5e:69:92:4a", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "oremeumf 1538024689.lesti sintocca events dhcp lease of ip 10.105.136.146 from server mac 01:00:5e:bb:aa:f6 for client mac 01:00:5e:69:92:4a with hostname lors2232.api.example from router 10.46.217.155 on subnet amnihil with dns orissus", + "fileset.name": "meraki", + "host.ip": "10.46.217.155", + "host.name": "lors2232.api.example", + "input.type": "log", + "log.offset": 13766, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.105.136.146", + "10.46.217.155" + ], + "rsa.internal.messageid": "events", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "sintocca", + "rsa.misc.sensor": "sintocca", + "rsa.network.alias_host": [ + "lors2232.api.example" + ], + "rsa.network.dns_a_record": "orissus", + "rsa.network.mask": "amnihil", + "rsa.time.event_time": "2018-09-27T05:04:49.000Z", + "service.type": "cisco", + "source.ip": [ + "10.105.136.146" + ], + "source.mac": "01:00:5e:bb:aa:f6", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-11T12:07:23.000Z", + "destination.ip": [ + "10.123.62.215" + ], + "destination.mac": "01:00:5e:1f:7f:1d", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "nimadmin 1539259643.lumqui quiavolu flows src=10.245.199.23 dst=10.123.62.215 mac=01:00:5e:1f:7f:1d protocol=udp pattern: 0 iusmodt", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 14003, + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.123.62.215", + "10.245.199.23" + ], + "rsa.db.index": "iusmodt", + "rsa.internal.messageid": "flows", + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "quiavolu", + "rsa.misc.sensor": "quiavolu", + "rsa.time.event_time": "2018-10-11T12:07:23.000Z", + "service.type": "cisco", + "source.ip": [ + "10.245.199.23" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-25T19:09:57.000Z", + "event.action": "cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "rep 1540494597.remap deri flows cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6 ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 14135, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "cancel src=10.239.105.121 dst=10.70.7.23 mac=01:00:5e:8e:82:f0 protocol=ipv6" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "deri", + "rsa.misc.sensor": "deri", + "rsa.time.event_time": "2018-10-25T19:09:57.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-11-09T02:12:32.000Z", + "destination.ip": [ + "10.16.230.121" + ], + "destination.mac": "01:00:5e:99:a6:b4", + "event.action": "nonpro", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "idexeac 1541729552.nimadmin midest_appliance events aid=modt arp_resp=iduntutl arp_src=rsitam auth_neg_dur=xercit auth_neg_failed=ulpaquio channel=itqu dns_req_rtt=minimav dns_resp=smodtem dns_server=roquisqu duration=116.294000 full_conn=iquid identity=evo ip_resp=mcorpori ip_src=10.196.176.243 is_8021x=itesse is_wpa=expl last_auth_ago=essecill radio=totamre reason=rpo rssi=velites type=nonpro vap=nula client_mac=01:00:5e:99:a6:b4 client_ip=10.90.50.149 instigator=nemulla http_resp=asp dhcp_lease_completed=dexercit dhcp_ip=amn dhcp_server=itessequ dhcp_server_mac=porissu dhcp_resp=umd url=https://www.example.net/sectetur/edquian.html?turQuis=taevi#uames category0=tconsec server=10.16.230.121 vpn_type=laboree connectivity=udantiu", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 14245, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.16.230.121", + "10.196.176.243" + ], + "rsa.counters.dclass_r1": "velites", + "rsa.internal.messageid": "events", + "rsa.misc.category": "tconsec", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "nonpro", + "rsa.misc.node": "midest", + "rsa.misc.sensor": "midest", + "rsa.time.duration_time": 116.294, + "rsa.time.event_time": "2018-11-09T02:12:32.000Z", + "service.type": "cisco", + "source.ip": [ + "10.196.176.243" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.net/sectetur/edquian.html?turQuis=taevi#uames" + }, + { + "@timestamp": "2018-11-23T09:15:06.000Z", + "destination.ip": [ + "10.34.62.190" + ], + "destination.mac": "01:00:5e:6a:c8:f8", + "destination.port": 1641, + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ttenb olor.quiav gna security_event Nem signature=tdolorem priority=eacomm timestamp=1542964506.upidata dhost=01:00:5e:6a:c8:f8 direction=unknown protocol=ipv6 src=10.246.152.72:4293 dst=10.34.62.190:1641 message:eve", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 14985, + "network.direction": "unknown", + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.34.62.190", + "10.246.152.72" + ], + "rsa.internal.event_desc": "Nem", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "gna", + "rsa.misc.policy_name": "eve", + "rsa.misc.sensor": "gna", + "rsa.time.event_time": "2018-11-23T09:15:06.000Z", + "service.type": "cisco", + "source.ip": [ + "10.246.152.72" + ], + "source.port": 4293, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-12-07T16:17:40.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "quisn 1544199460.rem ulamcola events dhcp no offers for mac 01:00:5e:67:fc:cb", + "fileset.name": "meraki", + "host.mac": "01:00:5e:67:fc:cb", + "input.type": "log", + "log.offset": 15202, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ulamcola", + "rsa.misc.sensor": "ulamcola", + "rsa.network.eth_host": "01:00:5e:67:fc:cb", + "rsa.time.event_time": "2018-12-07T16:17:40.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2018-12-21T23:20:14.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "eruntmo 1545434414.nimve usanti_ events dhcp release for mac 01:00:5e:7d:de:f7", + "fileset.name": "meraki", + "host.mac": "01:00:5e:7d:de:f7", + "input.type": "log", + "log.offset": 15280, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "usanti_", + "rsa.misc.sensor": "usanti_", + "rsa.network.eth_host": "01:00:5e:7d:de:f7", + "rsa.time.event_time": "2018-12-21T23:20:14.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-05T06:22:49.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "uatu 1546669369.olupta consequu_ events dhcp release for mac 01:00:5e:6b:96:f2", + "fileset.name": "meraki", + "host.mac": "01:00:5e:6b:96:f2", + "input.type": "log", + "log.offset": 15359, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "consequu_", + "rsa.misc.sensor": "consequu_", + "rsa.network.eth_host": "01:00:5e:6b:96:f2", + "rsa.time.event_time": "2019-01-05T06:22:49.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-19T13:25:23.000Z", + "destination.ip": [ + "10.121.9.5" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "sitam inibusBo.illoin emUtenim ids-alerts signature=ende priority=dexea timestamp=1547904323.acoprotocol=ipv6 src=10.244.32.189 dst=10.121.9.5message: uptas", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 15438, + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.121.9.5", + "10.244.32.189" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "emUtenim", + "rsa.misc.policy_name": "uptas", + "rsa.misc.sensor": "emUtenim", + "rsa.time.event_time": "2019-01-19T13:25:23.000Z", + "service.type": "cisco", + "source.ip": [ + "10.244.32.189" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-02-02T20:27:57.000Z", + "destination.ip": [ + "10.41.124.15" + ], + "destination.port": 333, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "edol 1549139277.sequuntu quameius_ events content_filtering_block url='https://www.example.com/totamrem/aliqu.htm?sBonorum=moenimi#lor' category0='auto' server='10.41.124.15:333'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 15595, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.41.124.15" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "auto", + "rsa.misc.node": "quameius_", + "rsa.misc.sensor": "quameius_", + "rsa.time.event_time": "2019-02-02T20:27:57.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www.example.com/totamrem/aliqu.htm?sBonorum=moenimi#lor" + }, + { + "@timestamp": "2019-02-17T03:30:32.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "antium 1550374232.remaper eseosq events dhcp no offers for mac 01:00:5e:c3:77:27", + "fileset.name": "meraki", + "host.mac": "01:00:5e:c3:77:27", + "input.type": "log", + "log.offset": 15774, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "eseosq", + "rsa.misc.sensor": "eseosq", + "rsa.network.eth_host": "01:00:5e:c3:77:27", + "rsa.time.event_time": "2019-02-17T03:30:32.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-03T10:33:06.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "oditau 1551609186.onsec dit events MAC 01:00:5e:19:86:21 and MAC 01:00:5e:ed:ed:79 both claim IP: 10.43.235.230", + "fileset.name": "meraki", + "host.mac": "01:00:5e:ed:ed:79", + "input.type": "log", + "log.offset": 15855, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.43.235.230" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "dit", + "rsa.misc.sensor": "dit", + "rsa.network.eth_host": "01:00:5e:ed:ed:79", + "rsa.time.event_time": "2019-03-03T10:33:06.000Z", + "service.type": "cisco", + "source.ip": [ + "10.43.235.230" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-17T17:35:40.000Z", + "destination.ip": [ + "10.103.91.159" + ], + "destination.port": 7116, + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "asper dictasun.psa lorese_ ids-alerts ctobeat ids-alerts signature=onsec priority=idestl timestamp=1552844140.litani shost=01:00:5e:a0:b2:c9 direction=unknown protocol=icmp src=10.199.19.205:5823 dst=10.103.91.159:7116 message: ntut", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 15967, + "network.direction": "unknown", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.103.91.159", + "10.199.19.205" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "lorese_ ids-alerts ctobeat", + "rsa.misc.policy_name": "ntut", + "rsa.misc.sensor": "lorese_ ids-alerts ctobeat", + "rsa.time.event_time": "2019-03-17T17:35:40.000Z", + "service.type": "cisco", + "source.ip": [ + "10.199.19.205" + ], + "source.mac": "01:00:5e:a0:b2:c9", + "source.port": 5823, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-01T00:38:14.000Z", + "destination.ip": [ + "10.65.0.157" + ], + "destination.mac": "01:00:5e:49:c4:17", + "event.action": "Deny", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "estiaec 1554079094.pitlabo tas_appliance flows src=10.17.111.91 dst=10.65.0.157 mac=01:00:5e:49:c4:17 protocol=udp pattern: 1 nostrum", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 16200, + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.17.111.91", + "10.65.0.157" + ], + "rsa.db.index": "nostrum", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "Deny" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "tas", + "rsa.misc.sensor": "tas", + "rsa.time.event_time": "2019-04-01T00:38:14.000Z", + "service.type": "cisco", + "source.ip": [ + "10.17.111.91" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-15T07:40:49.000Z", + "event.action": "cancel", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "ercitati 1555314049.atem serro flows cancel", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 16334, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "serro", + "rsa.misc.sensor": "serro", + "rsa.time.event_time": "2019-04-15T07:40:49.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-29T14:43:23.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "amquaera 1556549003.rsitamet leumiur events MAC 01:00:5e:fd:79:9e and MAC 01:00:5e:4d:c0:dd both claim IP: 10.20.130.88", + "fileset.name": "meraki", + "host.mac": "01:00:5e:4d:c0:dd", + "input.type": "log", + "log.offset": 16378, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.20.130.88" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "leumiur", + "rsa.misc.sensor": "leumiur", + "rsa.network.eth_host": "01:00:5e:4d:c0:dd", + "rsa.time.event_time": "2019-04-29T14:43:23.000Z", + "service.type": "cisco", + "source.ip": [ + "10.20.130.88" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-05-13T21:45:57.000Z", + "destination.ip": [ + "10.140.242.86" + ], + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "abill ametcon.ofdeFini tasnu_ ids-alerts tionev ids-alerts signature=uasiarch priority=velites timestamp=1557783957.uredolorprotocol=ipv6 src=10.177.64.152 dst=10.140.242.86message: temporin", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 16498, + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.140.242.86", + "10.177.64.152" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "tasnu_ ids-alerts tionev", + "rsa.misc.policy_name": "temporin", + "rsa.misc.sensor": "tasnu_ ids-alerts tionev", + "rsa.time.event_time": "2019-05-13T21:45:57.000Z", + "service.type": "cisco", + "source.ip": [ + "10.177.64.152" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-05-28T04:48:31.000Z", + "destination.ip": [ + "10.51.121.223" + ], + "destination.port": 24, + "event.action": "security_event", + "event.code": "security_event", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "lor nvolupt.dquia ora_ security_event dipi security_event ecatc signature=quovolu priority=ite timestamp=1559018911.itse shost=01:00:5e:b8:73:c8 direction=external protocol=icmp src=10.199.103.185:2449 dst=10.51.121.223:24 message:stenat", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 16689, + "network.direction": "external", + "network.protocol": "icmp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.199.103.185", + "10.51.121.223" + ], + "rsa.internal.event_desc": "dipi security_event ecatc", + "rsa.internal.messageid": "security_event", + "rsa.misc.event_type": "security_event", + "rsa.misc.node": "ora_", + "rsa.misc.policy_name": "stenat", + "rsa.misc.sensor": "ora_", + "rsa.time.event_time": "2019-05-28T04:48:31.000Z", + "service.type": "cisco", + "source.ip": [ + "10.199.103.185" + ], + "source.mac": "01:00:5e:b8:73:c8", + "source.port": 2449, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-11T11:51:06.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "saq 1560253866.asiarch ssuscipi events MAC 01:00:5e:93:48:61 and MAC 01:00:5e:21:c2:55 both claim IP: 10.126.242.58", + "fileset.name": "meraki", + "host.mac": "01:00:5e:21:c2:55", + "input.type": "log", + "log.offset": 16927, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.126.242.58" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ssuscipi", + "rsa.misc.sensor": "ssuscipi", + "rsa.network.eth_host": "01:00:5e:21:c2:55", + "rsa.time.event_time": "2019-06-11T11:51:06.000Z", + "service.type": "cisco", + "source.ip": [ + "10.126.242.58" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-25T18:53:40.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tlab 1561488820.vel ionevo events dhcp release for mac 01:00:5e:8a:1a:f9", + "fileset.name": "meraki", + "host.mac": "01:00:5e:8a:1a:f9", + "input.type": "log", + "log.offset": 17043, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ionevo", + "rsa.misc.sensor": "ionevo", + "rsa.network.eth_host": "01:00:5e:8a:1a:f9", + "rsa.time.event_time": "2019-06-25T18:53:40.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-10T01:56:14.000Z", + "destination.ip": [ + "10.113.152.241" + ], + "event.action": "uira flows deny", + "event.code": "flows", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "aeab 1562723774.uradipis aerat_ flows uira flows deny src=10.121.37.244 dst=10.113.152.241 mac=01:00:5e:9c:86:62 protocol=udp type=utaliqui ", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 17116, + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.113.152.241", + "10.121.37.244" + ], + "rsa.internal.messageid": "flows", + "rsa.misc.action": [ + "uira flows deny" + ], + "rsa.misc.event_source": "appliance", + "rsa.misc.node": "aerat_", + "rsa.misc.sensor": "aerat_", + "rsa.time.event_time": "2019-07-10T01:56:14.000Z", + "service.type": "cisco", + "source.ip": [ + "10.121.37.244" + ], + "source.mac": "01:00:5e:9c:86:62", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-24T08:58:48.000Z", + "destination.ip": [ + "10.254.96.130" + ], + "destination.mac": "01:00:5e:10:8b:c3", + "event.action": "ionu", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "nesciu 1563958728.mali roinBCSe_appliance events aid=eetdolor arp_resp=tpersp arp_src=assi auth_neg_dur=rch auth_neg_failed=psa channel=nreprehe dns_req_rtt=pidatatn dns_resp=isno dns_server=luptatev duration=39.622000 full_conn=lla identity=urau ip_resp=aeca ip_src=10.247.118.132 is_8021x=atcupi is_wpa=enima last_auth_ago=uptateve radio=fugitsed reason=lumqui rssi=ectet type=ionu vap=eratv client_mac=01:00:5e:10:8b:c3 client_ip=10.153.33.99 instigator=liq http_resp=xerc dhcp_lease_completed=atisetqu dhcp_ip=squir dhcp_server=gnaaliq dhcp_server_mac=quam dhcp_resp=deriti url=https://www5.example.org/eturadi/umS.txt?mSecti=henderi#taevitae category0=tevel server=10.254.96.130 vpn_type=ita connectivity=iquipexe", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 17257, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.254.96.130", + "10.247.118.132" + ], + "rsa.counters.dclass_r1": "ectet", + "rsa.internal.messageid": "events", + "rsa.misc.category": "tevel", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "ionu", + "rsa.misc.node": "roinBCSe", + "rsa.misc.sensor": "roinBCSe", + "rsa.time.duration_time": 39.622, + "rsa.time.event_time": "2019-07-24T08:58:48.000Z", + "service.type": "cisco", + "source.ip": [ + "10.247.118.132" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www5.example.org/eturadi/umS.txt?mSecti=henderi#taevitae" + }, + { + "@timestamp": "2019-08-07T16:01:23.000Z", + "destination.ip": [ + "10.200.98.243" + ], + "destination.mac": "01:00:5e:95:ae:d0", + "event.action": "ntium", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "tot 1565193683.reme emeumfu events aid=inBCSedu arp_resp=ita arp_src=ade auth_neg_dur=nihilmol auth_neg_failed=nder channel=ano dns_req_rtt=rumexer dns_resp=eab dns_server=iaconseq duration=18.963000 full_conn=eli identity=rissusci ip_resp=ectetur ip_src=10.101.13.122 is_8021x=oconsequ is_wpa=roqui last_auth_ago=oluptate radio=ntut reason=mremaper rssi=uteirur type=ntium vap=ide client_mac=01:00:5e:95:ae:d0 client_ip=10.78.143.52 instigator=ntiumdol http_resp=conse dhcp_lease_completed=aturve dhcp_ip=edqui dhcp_server=tvolu dhcp_server_mac=psu dhcp_resp=strud url=https://internal.example.org/fdeFi/ratv.htm?sequatu=tiumtot#tate category0=udanti server=10.200.98.243 vpn_type=cteturad connectivity=umq", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 17976, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.101.13.122", + "10.200.98.243" + ], + "rsa.counters.dclass_r1": "uteirur", + "rsa.internal.messageid": "events", + "rsa.misc.category": "udanti", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "ntium", + "rsa.misc.node": "emeumfu", + "rsa.misc.sensor": "emeumfu", + "rsa.time.duration_time": 18.963, + "rsa.time.event_time": "2019-08-07T16:01:23.000Z", + "service.type": "cisco", + "source.ip": [ + "10.101.13.122" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://internal.example.org/fdeFi/ratv.htm?sequatu=tiumtot#tate" + }, + { + "@timestamp": "2019-08-21T23:03:57.000Z", + "destination.ip": [ + "10.247.205.185" + ], + "destination.mac": "01:00:5e:6f:21:c8", + "destination.port": 7676, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "oinvento 1566428637.mporin orissusc_appliance events content_filtering_block url='https://www5.example.net/uov/pariat.htm?litsed=lumd#tiaec' category0='lorem' server='10.247.205.185:7676' client_mac='01:00:5e:6f:21:c8'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 18684, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.247.205.185" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "lorem", + "rsa.misc.node": "orissusc", + "rsa.misc.sensor": "orissusc", + "rsa.time.event_time": "2019-08-21T23:03:57.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www5.example.net/uov/pariat.htm?litsed=lumd#tiaec" + }, + { + "@timestamp": "2019-09-05T06:06:31.000Z", + "destination.ip": [ + "10.147.165.30" + ], + "destination.mac": "01:00:5e:0a:88:bb", + "destination.port": 7662, + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "metMa emoen.ptate mipsumqu_ ids-alerts ccusa ids-alerts signature=billo priority=doloremi timestamp=1567663591.ectetura dhost=01:00:5e:0a:88:bb direction=inbound protocol=ipv6 src=10.195.90.73:3914 dst=10.147.165.30:7662 message: idents", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 18903, + "network.direction": "inbound", + "network.protocol": "ipv6", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.147.165.30", + "10.195.90.73" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "mipsumqu_ ids-alerts ccusa", + "rsa.misc.policy_name": "idents", + "rsa.misc.sensor": "mipsumqu_ ids-alerts ccusa", + "rsa.time.event_time": "2019-09-05T06:06:31.000Z", + "service.type": "cisco", + "source.ip": [ + "10.195.90.73" + ], + "source.port": 3914, + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-09-19T13:09:05.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "veniamqu 1568898545.iconsequ ueporr_appliance events IDS: empor", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 19140, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "empor", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "ueporr", + "rsa.misc.sensor": "ueporr", + "rsa.time.event_time": "2019-09-19T13:09:05.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-03T20:11:40.000Z", + "destination.ip": [ + "10.162.202.14" + ], + "destination.mac": "01:00:5e:dd:cb:5b", + "event.action": "ids-alerts", + "event.code": "ids-alerts", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "atDuisa mipsa.uas iat ids-alerts signature=hite priority=adipis timestamp=1570133500.abo dhost=01:00:5e:dd:cb:5b direction=inbound protocol=udp src=10.137.166.97 dst=10.162.202.14 message: ipsaqua", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 19204, + "network.direction": "inbound", + "network.protocol": "udp", + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.162.202.14", + "10.137.166.97" + ], + "rsa.internal.messageid": "ids-alerts", + "rsa.misc.event_type": "ids-alerts", + "rsa.misc.node": "iat", + "rsa.misc.policy_name": "ipsaqua", + "rsa.misc.sensor": "iat", + "rsa.time.event_time": "2019-10-03T20:11:40.000Z", + "service.type": "cisco", + "source.ip": [ + "10.137.166.97" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-18T03:14:14.000Z", + "destination.ip": [ + "10.227.135.142" + ], + "destination.port": 6598, + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "deom 1571368454.tiumdo rautod_appliance events content_filtering_block url='https://www5.example.com/illoinve/etcon.htm?nevolup=erspici#itinvolu' category0='adeserun' server='10.227.135.142:6598'", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 19401, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.227.135.142" + ], + "rsa.internal.event_desc": "content_filtering_block", + "rsa.internal.messageid": "events", + "rsa.misc.category": "adeserun", + "rsa.misc.node": "rautod", + "rsa.misc.sensor": "rautod", + "rsa.time.event_time": "2019-10-18T03:14:14.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://www5.example.com/illoinve/etcon.htm?nevolup=erspici#itinvolu" + }, + { + "@timestamp": "2019-11-01T10:16:48.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "orese 1572603408.umdolore umqui_appliance events MAC 01:00:5e:f1:b8:3a and MAC 01:00:5e:37:9c:af both claim IP: 10.199.29.19", + "fileset.name": "meraki", + "host.mac": "01:00:5e:37:9c:af", + "input.type": "log", + "log.offset": 19597, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.199.29.19" + ], + "rsa.internal.event_desc": " events MAC", + "rsa.internal.messageid": "events", + "rsa.misc.node": "umqui", + "rsa.misc.sensor": "umqui", + "rsa.network.eth_host": "01:00:5e:37:9c:af", + "rsa.time.event_time": "2019-11-01T10:16:48.000Z", + "service.type": "cisco", + "source.ip": [ + "10.199.29.19" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-15T17:19:22.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "explicab 1573838362.samvolu teiru_appliance events dhcp no offers for mac 01:00:5e:b8:06:92", + "fileset.name": "meraki", + "host.mac": "01:00:5e:b8:06:92", + "input.type": "log", + "log.offset": 19722, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.internal.event_desc": "events DHCP", + "rsa.internal.messageid": "events", + "rsa.misc.node": "teiru", + "rsa.misc.sensor": "teiru", + "rsa.network.eth_host": "01:00:5e:b8:06:92", + "rsa.time.event_time": "2019-11-15T17:19:22.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-30T00:21:57.000Z", + "destination.ip": [ + "10.75.122.111" + ], + "destination.mac": "01:00:5e:92:d8:95", + "event.action": "modoco", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "rissusci 1575073317.uaturQ iusmod_ events aid=mips arp_resp=iduntutl arp_src=mipsumd auth_neg_dur=eiusmo auth_neg_failed=quelauda channel=rcit dns_req_rtt=dolo dns_resp=ulamc dns_server=doe duration=10.574000 full_conn=remquela identity=toreve ip_resp=squirat ip_src=10.85.59.172 is_8021x=mto is_wpa=iae last_auth_ago=dent radio=Uten reason=tatiset rssi=sequat type=modoco vap=beataevi client_mac=01:00:5e:92:d8:95 client_ip=10.158.215.216 instigator=deritin http_resp=ptate dhcp_lease_completed=lloi dhcp_ip=nseq dhcp_server=equunt dhcp_server_mac=tutla dhcp_resp=usmod url=https://example.com/qui/itse.gif?orsitame=tasn#exeaco category0=upta server=10.75.122.111 vpn_type=reprehe connectivity=deFinib", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 19814, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "related.ip": [ + "10.85.59.172", + "10.75.122.111" + ], + "rsa.counters.dclass_r1": "sequat", + "rsa.internal.messageid": "events", + "rsa.misc.category": "upta", + "rsa.misc.event_source": "appliance", + "rsa.misc.event_type": "modoco", + "rsa.misc.node": "iusmod_", + "rsa.misc.sensor": "iusmod_", + "rsa.time.duration_time": 10.574, + "rsa.time.event_time": "2019-11-30T00:21:57.000Z", + "service.type": "cisco", + "source.ip": [ + "10.85.59.172" + ], + "tags": [ + "cisco.meraki", + "forwarded" + ], + "url.original": "https://example.com/qui/itse.gif?orsitame=tasn#exeaco" + }, + { + "@timestamp": "2019-12-14T07:24:31.000Z", + "event.code": "events", + "event.dataset": "cisco.meraki", + "event.module": "cisco", + "event.original": "orr 1576308271.pre aute events IDS: rchite", + "fileset.name": "meraki", + "input.type": "log", + "log.offset": 20517, + "observer.product": "Meraki", + "observer.type": "Wireless", + "observer.vendor": "Cisco", + "rsa.db.index": "rchite", + "rsa.internal.event_desc": "events IDS", + "rsa.internal.messageid": "events", + "rsa.misc.node": "aute", + "rsa.misc.sensor": "aute", + "rsa.time.event_time": "2019-12-14T07:24:31.000Z", + "service.type": "cisco", + "tags": [ + "cisco.meraki", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/citrix/README.md b/x-pack/filebeat/module/citrix/README.md new file mode 100644 index 00000000000..f79bbf66178 --- /dev/null +++ b/x-pack/filebeat/module/citrix/README.md @@ -0,0 +1,7 @@ +# citrix module + +This is a module for Citrix NetScaler logs. + +Autogenerated from RSA NetWitness log parser 2.0 XML citrixns version 134 +at 2020-09-01 14:17:45.397 +0000 UTC. + diff --git a/x-pack/filebeat/module/citrix/_meta/config.yml b/x-pack/filebeat/module/citrix/_meta/config.yml new file mode 100644 index 00000000000..65405894f02 --- /dev/null +++ b/x-pack/filebeat/module/citrix/_meta/config.yml @@ -0,0 +1,19 @@ +- module: citrix + netscaler: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9526 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/citrix/_meta/docs.asciidoc b/x-pack/filebeat/module/citrix/_meta/docs.asciidoc new file mode 100644 index 00000000000..3487483b3a2 --- /dev/null +++ b/x-pack/filebeat/module/citrix/_meta/docs.asciidoc @@ -0,0 +1,66 @@ +[role="xpack"] + +:modulename: citrix +:has-dashboards: false + +== Citrix module + +experimental[] + +This is a module for receiving Citrix NetScaler logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: netscaler + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `netscaler` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "citrixns" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9526` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + diff --git a/x-pack/filebeat/module/citrix/_meta/fields.yml b/x-pack/filebeat/module/citrix/_meta/fields.yml new file mode 100644 index 00000000000..8b2c16a1216 --- /dev/null +++ b/x-pack/filebeat/module/citrix/_meta/fields.yml @@ -0,0 +1,5 @@ +- key: citrix + title: Citrix NetScaler + description: > + citrix fields. + fields: diff --git a/x-pack/filebeat/module/citrix/fields.go b/x-pack/filebeat/module/citrix/fields.go new file mode 100644 index 00000000000..922f14975d6 --- /dev/null +++ b/x-pack/filebeat/module/citrix/fields.go @@ -0,0 +1,23 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package citrix + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("filebeat", "citrix", asset.ModuleFieldsPri, AssetCitrix); err != nil { + panic(err) + } +} + +// AssetCitrix returns asset data. +// This is the base64 encoded gzipped contents of module/citrix. +func AssetCitrix() string { + return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb9+78pOUjW5tR8+ynVdXWzUFYpokIgwwBjCkmL/+Cg3McMjBUBIFUPK72w9bsUg2uhtAo3/3d+QK1q8J41bz678QYrkV8Jqc4L/Je7CXjArQfyGkBMM0ry1X8jX5t78QQsKvyIyDKM3kLyT812v80P3vOyJpBa+JBLtS+mrCpQU9owwm7u/d1whRS9ArzS28JlY3/U/suobXDsmV0mXv7yXMaCNsgUu+JjMqDGx9PMC2/d97WgFRM2IX0CJGOsTIagEa8DOr6WzGGVlQQ6YAkqipAb2EcjKgTxt6B2LmWjX17UnZZepmWcRaUrFF3vjqY+vHltgsUpn51t/3rzC+YYNd+bjgxn2PcEMaAyWxijBa2ybwX9MVqcAYOnf/ppYwVYFxRCv3+Q5oQt6qOTkFpko8rhFCPCy+i9Sh5LRwYQnSFo60xIADwpm5H1hukOdMSQvSGnc/uDSWStuiYaI4Wl4dgmBJ7e4HQ+y4x8ktQaglqwVnC0KJAWO4kmTBrSHUyajfuZVgTLv7k8HR6Ig1C9WIkkhYgiZT6M5dTbUB8g4sdahRMtOq6i319K2amxcXlF2BNc8G4E+5BmbF+jmxAW9KPoAXFv6Eyx6akygjBSxBHMBJoeTu/dzi5CnUGhi1AZMSZlxCSZQUiJalUwGkonUcq8rMi2QXZs8evwv3/Pz0B7Kkogk3npcgLZ/xcDrhmjJLhJr7/dKDjUDquAMfTgt+z21HTbXlrBFU4+/Dxk5GT8YA9EEnJXYyBpDHT8roliyPuycv//+e7N8Tt2qeDbnf9VXTPwokZHdbHg12S3qI0MuOmgajGs0yvb33Z1uu+38/zIylFiqQ9jEiR5uS24IJunOHHwl6IK1eP0bEFk6neoyIcXkYYnk1plZyPN6TVgI9RHrkZdsMoExpQ43oNTE7s/fF1i3gsBnoIQMl4X5WxI4eMoB+gxUxzsUd18qRuCh7XpUo+zy7BmQmYh+JcPDO7GPHUKsbyb80sFGjdUd/+NN626g9UZK5x4Fa9dgt2xFxs+R5xWGfuyduGT7jjPbv81s1J2dLkJZconAmjSxBOxNEQxBUA9Jn/BpKYsA6IFs/3l7DjBss7SYMYN/bYOk2YQD6Tpsy9ASm9y8ddjAHdN2BJ3fjwUKZTPpq/1z+qozti0ixeyINyJLLefuhiR2bng/p6+EvP+SADX40ytjzi+VPhJaldrJy7LrvMndAvVVfK3OXr3Kz99X/u+x13MovG3blgnek9b1lJaFkzpcgOyfZ16sIOBYd5r/Ia4GUj1H5+zoiGqMODVWvCw1fMux1P3iIG4x0T9fI5TO/NLnAi/Q8eLMtJR/XNRBGhxJkCgS4XYAmn86l/eEVUZr8IhS1P74kU2rwFLUBshmfNxpVvxvoPkTd/YrpxjBoPuMzgX/B/XqucrnZ9lnH7cpfvYNB6RXVZTalrifRemT3OXl+8XlL36NEg6C7W0qIWRsLVXhEA9oO2gL8STWeee7fSvM5l1S0v9nWVm7gQy79a09ixPnF51cRFgT0B5y4Pws6jIZcTvH6bA7qUHE89PVZAC1BHyV2/SsuRc5P7xMl9fj2g6UI5rBY6aN2sglWZPez0VbROt8oWnhRnOlyooQAZpX+GgWw494D5Ny4M8cNYZ51UDpMtxTVt2pXbSF7GP0ILb6KTR+Lqlopg8lulZJkuh5sGiEavjRgrANoeFWLddgn92Un6AlQtiCGl0Cefk/sQjfk5c8/PyMraogBkN0qezjxKJTXW3DC1EoayMcK9tWcCqYaaTufQlNNvdBzV9lEIZCndKqW0GMGl9HMyla8GauBVqP3h301x+aBWQUlb3b1tBSM+iamOXaOBT4j3P6zefn9D381XqS/qFGAtkj/c0DNP509+JauQZOX5EwyWptG+MiKMynvJNdj0O8Z/IjkVsZW+fEl+VdH7nPy44/kXwlT2unLSEVY9Dn578L+T/dFbsg2U76JbqFUJTxaW1euoGBUiCllV3k1YI+cVBavDbXernBMBFnWikuLpomFeIIzHo4CtFaZ8tM2+qCpgXEqEGPE1FilnWYt117rcB8sqeClPxgxpAiZqUaW7oURgMhzOQ/K0Y3Ji9s3YgA5RSwwXIc9YaORXVgLRcvH8s4FdIjhfwKpwGrOIlZHMIX7X0Zb2D/3rRB2zz61G41Wzdptm5Bf1cptzdDm5JIo7Ywxq8gVQH0D0x7Fi/eVME0rBsYUS14WZa6o61kreeYgQVOLl7x0HOzZhUuubUOFM9q3fO8y4uLgFXdmN8bKkRmeinDVz0+JdtLaoEMFmUb1HGz3tRs5YXSmpKcH54TPhNvPCZ0lFDQU/Oenre/1A1TKArkM551pwId2uh4TlO5/bSDmKwi8hJUKUwueM7PhUZvzhg/U/kehmzmZm/G8461zb0A46+2pa62W8IT814gwevEy4+IBYvRuVWccXZy8uQi6L6PSsYdXtdK7Gi/BJ/KrS4NoHof745N/qtAQR9M95krdNuWbzU82BrvXc9Ayn5CXP78iK+R7BVQSKkTcV4BOfVSTNv4jsgINHiy1RAA1lii5Uy6yzcQHVxO/biZG7mqOsG3g3e9Kl8g4zGoCtpBKqPl6NxA343qgxRLyM2ELqimznonuUq8Rf3SaS9LIkNMjtnzmoxW1qQu6faA+ZxBhT+wSLYrKKZlKtmEETVejMg0l645aSRlqrD5GIYPPQTHW6BaisVSWVJdEKl1Rwf+M5fcqXUX5U4Ysh4NZpJrp4Em6E5M2WHfIvBB8BkhxxMA3wJQsRxTszXYXxub0s+whiEumqlqAjR6AUScqRQXear4jBnv1Zto+0EG+dGtHj/PYUd4+maPHr1LSLhJt06Y+NVXOyybLqXwgxp/JMgfbHcg/lczdbWGPWHSrtyqmT6/9uMvhgYjKdqPfEAvXNlw+sgRteuUU5b48sMj+3vewrYGmInNTpseULqHM9w6GJJvwTJluxVbHaDNtui/24+vD10qraoJQGyzKNwwk1Vx5tb5qhOXfWQ6a0LoWbfXLppdNRSWdx0pzCREY3mntRY+Ux9UQbp8YolbSR8Ysrepdz2DA2K3mUBzePmsIW3Bn3agSzIS8a4xFM6kP1N1KakfycqmFAzdprwCbzRzeSziGJoSb3C7oeadhBhok8weCOtW65EteOs0Gz0NckF22guzjDvPiRF7XXB+Nws1++ljQtTuJ3Iq1J9Y4oef0NYcUHtD9vtGEmz7qwnnupHEnzyaDJbt0MtWklkDVQJG7L8SO/6mvCmqQXxpojnaU3On2p2gjH1fUEESiHDk3iNwPqZmaUCnYYmgGmTavbIbXd17lwLUuMqBaFzm05zqlKNoG+jI51Ay6Uu8VeRgTcsd8jL4xg+fyTm/OoWLzJrl2SLBg80DsdENI7QiibKDEp1CsTSNyh51GrCjVWKYqeOFx6IwXzMpWs8EJoTKwYMuAHDkgsATNbc7SkT2EtauHIsBeZGefyydv8eKgd6B/pbtKFwcN4041MD7jG8Mnrt36YM5YT5WgK+fPZopsQOdi5OWmYKJ1UZUhyBLFO5jNx9qEz9tWet8SVJr8dhlSY7lpEwJ2/Wq4frtDY1WSplaGJxQctzpbaE7L0neYwlT+9u6OduFphC3ytS66oyiSTQWas7vKoihtR6hi20NYv5KtuxleLPn7PSBtCbJUOiTM7qVMTf94gO41bWhXTf8AFrejHWL5a8EH7HYSdD9iXtLn7FX3zfBChqr/IGaCl2tBu9xiqSyhZBE6XsQTaIWaF22iyoMI9fYg3lmoH6Nnypbs+zumW2HXahQfccVfCc7WuW/PHrlwgQiE5tpSrEfkciNy5k3HGfihEYCIxcWpkhauc2usHULn0vvrNv1QaVka93/4qFLRIhRrAHPD48wWVM6hkLDKLQvGApew6oX6UQmxVvNpY6EnIYY5+saj7rT1/vMXFx2mpsmEXcc5wbO1rdzHNDQEd/OLPDJ9/S1i3GIFmGNY23DQbHK+9BL0hFyC35TGgJ7QOWAr75DpPlO6xWEAuwXj9XaGvyf+972+FUqTqVYr91n716BrerNrtJ/0eXlBtU3tpusAp/aohDulBtWhx7pTSpSd2pjrSqkaQkAx11v8RhIqQNsuu0hvFg1/8+GtID56TQAwCSmiMJdEKvmdhhrQktmX/YBmwzGfHNZo7S5MZ6/gTqIe94L7CFsb/hlQtuJ2EZRlL+vJKS44xWoTSZT8bq7cf+95CVBJKSKKY0a6aS8Y+AIRcEiqGXHSwXIwE3K5kSm7gw36lVV5MD7x5XyNcUaMLxn1yTZlEL+B8ZQw0RjbHsjwj8E24U+4cTsZaqKDf8MpvvjpuAp0dO3H37C4Re/bMuVTyp7cZHg5LE8RC0KNUYyjv9TtRtSexA17y6/gNaGkXqwNZ1SQkpur56TWOBPlOQHLnsQVZarpIbWXd3zofZ2NphVY0IbU1GAXL4ONHHwvAqaqykkxtRW0H5bWgGV71T3/HjyUxtfbwwwPkxffTFV1M7yDGbaNkhWXpVqFfFqmJIPaPu8yKUaZMSBz1gixJl8aKrzzs1QV5TJIDdlbSKiRp6vv9UylLu0h3amEb7m8gjLUArWJ6NSgdyoYKO6TbzrUJrzct3Fi0BUiq6jrT3byboldBFr0frt8KLx+q4PnlVwO2/V0QWfQFd8d7JTbxRrWRGz9+d+vaf+YWNOecZH/jnck/4KrdddYQ9kwIG3kCOLuNgOaU1FEXtNsj8glLtmqzbvvY+8BdC/MqF8A2JU5qOVACo9xWN09dAtqFt0NdWphpMqwYQuf+dvW2HRlhictpJ0WYY6QbpmJ0cz9qvv3sNKUOHkuCcecu0YyAVS7P2EjvA1qoYAweDt1W9h5c/TBC79m2OfpUb9YTFVTLru+2f0HK5SN6ju8XkuuG3NsT19fG0EExj1+xwmQRq7EiV/d92Qc95R6Cy67a7xjn/cyn5+S917SPA2NG4iftheKfh1uz+J6tXdAP4Qvv+d+Pj9FloaSt05MDL0H2xE5nwboSZj4Q+RkwYqbuJG6NOucvey3o7qhQNurC3v92NIb30c8NY71J93C5Pz0Rk02lX/uBk3WIfZSlhuNdkJOfH1m6Hcq/Af7tVlEUG9/44dvgjtu2tiuclPZ7jFqpADjOaP8g7JSZEk1p1MxqAL0TRm4JLWgI4LAgDRZ+6NsbWhfVfUrT5ykchpGW1/I3T5fvji/2NWhSWgZ6z0KY3XZBw4UvHUt5CbS4pEk59KSSz6XFIXFyBGtlc7ZvPbJQH65Q3rR6m4KuzrifzpEencZT1mpIgfn/W8fCZdMNCU4cRYG2bqfT8jTs2ta1QJekwvvEPFgUXpP4n4RjMwdPbaJzqnN0xLHjJsrp3IfgNcdSvF6bsz34Wn4wM3VnpCr1Xw+B51vhF2cZZ/7sYCAA2qnCw1moUTpTo+31UcmjW6F3o/gWRjG3oNUfvrB6xjPumYc56fxMpJbR+eZquriyHlXuCsh9wrHuHr/nmmm3zl0lMT61BmOm1Flw8astKCWPlDWWB/zTloqjZ0HnFxv8RuZEkd1uaL6YTL0hl31nXSl4SFyRIy0Rn7qhCgl7yhr+ynHlVsngo5qxyj5Xaug6v1SyNuayYdaa6AmeW6wsdQ2qRTnzh9FuXgws8MtPlXXhJcvxt8v97I2x8DQYfRp0PjY3wWHRfzqtu9Y5ul7g0N+Opy7d8hzxqVqUsU4e3UkZp78TjlJmtLpMPDI/pQYcO7OjFtH4o0QTu4R0zAGxswaQc7c+oSpEow7Em2z37hlwWUJ14kZILixh2me95QtuDCaYrpFYgoa45sV1VxgBk/Eg+fj73JOKDLxO/fbKGUywzlUU99c6IE04rA6edrlc9agTR2Kbr2EGbAsqAibhPi2w9OzkSJD7+Yavse5E0q88tUleQVflf+2+5ByaUgJlnIRcTJMVWN7vxshTYmj52a2Hlva5bEhHuMPqYWqFtmyed6QEmY0hIBC58s2hh+yNZ1WvAQt6BoLuawKjyt5GrmR7gO0usOvYdZWgXtfvbHcNtiYkUQJ29gGw4ZN972uSaNYPf8Oo6kxzSCrmKoqd5/yHKMTD53wXrJvrdWSl95/1naRq8CMJkKVih0eaLy7t+wXLjZaI+vn5cVVg+sak54eRta3q+eV9X+o6YF+p4PJ+99qGgIw8dtV83yNc08xodjv/OXFOTkfKFR9NLJ1rQ3VJfsxSFjY1VXDzpMa0nfxh4Xc6rhy70VEMVVl7oqvQcXdrtIRcCEOlxH1aJG+W4IPGRyh8rznAg6lwz6BtouH8Dkvu1DOiBOvSm01DsrAE7z86ZS8ju66yflMtdO9Lz757jltIAqTNa6BNX0vgk/9mkKsvLXtwrQvceMIjpCoV7zcdoh01ZV0Sbmgw0AG6VzhBOsrZ6D1yKQFf4cO8fWni7sFY6UKDaB8AHZAUkg3MHw+GZGIvCqmTVmuk/tneFUkrQPqwW0MHNbofK+XKj1EzVXCLgc7JXaFaY5RkMBNP3vV91ylTcltV1m36YsWMIoNtttUbHhRsgkv7CfSZ4ml5uDyaFb5yecz8jTUSnxuhNOVp1xgAQfmgZ1d18q4bz4j3w0dDXI3CnMl1UpuGUIGWIPNLJbb0EcmbTJ6BBfcblroSVvl/j6UJr2FOWVr8mnUXBN8qulDFOWHhbdYzCWpKJczTSvYm45RU41Te/P3SdhSLi9wWfJelT45etMWsJd1FkGK3KB9YaqAY0QuC2m7b9x7WJFfG4mm5DtVgiBPuVxOvn1OuGLPydT9H7j/o5KKteFm8m08vmhZXcwEHUzOT61DbWv4JxcEF0VfF8rJdTv8Ss32NmqwKium/q/TgGfbBsGAdgc5itCySit3dzD7/O53qoF89AnA3377+d3vbz6cffutz7ldUk356JlcKX2VsmT5xgv2e7tgP8I26gSjMrUSEWp20nYp6Z4Dytxzsc5gwsyUBmk4SylAeq6kDBhX6b0gkfhAKqDFivLhcOJ7ewew93lqoO76pC5RN80006Ww09JYnbryHeu1sznE+m9psne0rfnI5yQ9tNhlMxhsoNKEYpNN3Uuod3EgZnzU0dSSms0Reyip0W5EETJ3y3viQvngfoJ3d1w45IP+/2G46kZl9pP/HuSIlT0ffUBkL5IPcjjaOO4+/JQ6QtLW1s727NKntstob7PssE/mM3S7DU7uzZHptmU1P0Y8DIu+ZpQLx+u2mctFkBnnp/3aNuzE5cxBC/NIC4PxrMI257pwKuIB9BySeI3p1qH66ERVVSN3PVED7ORhjZvui917uLZ/h7hO3eFmDtOs74vbJZXlv6t41GyDm6WWHyIZ7o3dcOEt5Exjas64SpYleiwLHrFfUS2HQYfHjrqRVV2oXML48v27C/Kb96NuklLjiHw5airB5X+8JV8a0CO9WxshCw27nTrzJjf0HKJr8qEtOoumdXVaOkv4kPaBqtRjBBzQ+iDH0U1QbSQ4dm+4ZfoBDVRQXWXYLQc2g3uB1gkLkDugTZlsKu0WzLTdrrZAl9TuaoX3hTsFyRYV1anKSjq465oOxhffO/pE2SCdKgnMYpH8LDCYpS2g6gDP5thqKQNYNf0jA9SaJp+E4TtOJT9eGHQveOoHJ3Ruq8CpnsmRlgVlOBglffmJg21kQuO9B3g6r5c/yWu7SP6+M1kwq4vSJO273oPuIB8WeboF4KWgySWGLEDOuUxYFDkEnSM3Whazwqy4ZcnlhyxmQq0MrdLnrvRhS7vMBz1D1IXJgsuc4oTLGnQ1XSdLeB/ArtlVHuBLKnKcFV4XtVZWFelDUgh9+VOBHsf0sEW2uynUvChzMNsBTp//xmRR0evC2lRug23A7kQLyPAoVFxmQprLfEjXwhRiKorUYdEt2N9nBJ68M3gPdupeiH3Yqat6+7B/zgj7VUbY/5IR9v/ICPuveWBbVQs6hRwipYOe3jyTRdUIVL6n6wzvZAu8vsqgl1SN4POqzqN9Oy2TinnqJKQAmedQSgx8Yel9I7IwPiExww4azfJYkw5wHmvSrE1TZ5hFymRXVp3FVLXKOtMDrjOIEKusM8xywUazJgvwRvJrSaUywDIcwuUrx5VMj8LylartAmiZwa2mqrpgIoMP2wHOECRBuHq6tundog6yyQK5booMMQ2mueWMigwFRKagc5BsnTDrqg9bUrH+E8ppDryXBbYBzQLZt4PJg7VPrM0CfTqvl6/y+KBNMeX2r1kajTFTpJ0VtwNYq+Si2mS55ggVmE5f5Wa8jz/ZrK0eYLAL7+dP7xzxwFHtywLcd5NP10GuB3vGBeSwYUwxy7GJfJayOHsbcA7dwBS8xiTFIouo4/Xyp9LYetDMPxFso1kW2ILPIIcZY9DRXEHJkxWMbsPmMs8pqVTZCDBM5eB2AM7nGWSTqs2K2qQz/3vQYxnkSQBrmHNjNU3vCdnAzqDxaahzsVpn47XBTuQ6k3z1mfn+iGeAbjXQKoMi6UuBcqGdT7leLRQ3hZ8wmx76mmqa5YCXI4WwKSAv/Xz71HC5sVQmn3NcGjttdKphgS1U8LOCckBtkuOaXo9ua5JTg8XJDbP0w64P7TSwD+aclmXqO8DL1GHVtnVQhreIVwXTSlVZuhI5wBnMNF4VeZIjQ8ejHGyur5K3Z6pN+palvDa15omBCmq5bZJnnwkuIV2LnQ1Uk3SiTgcXi2/Tu7WE8l1Pi5lQyZ/zDniGlH9n8yaXOg5oBonjbOgMqCbPTRBqnuXoynmWC1wrnVqAVdNmnuOaVdywHGKhMlkObI45EBIsNldKDje5DPcNoFNn/HmoqdPx5GqV2gLJUlGm/ADo5JaoSq8ZKc3nRWQe173hriTo9G9WXfihvMnBJp1MvQHrR7xmOWQZCjfDTJzUwiCATS0N6sI7kpKjS41xHxZskarOfwAarmuePBBQg67mmko76LmbAvIqC+D0T6/vRPbp084U0ASAtZoX1NQJBwb0QWuaGqoGKnLodxoY8sF3Hc0EPD2THeS0LVx7kJUuM2Cc3pFpMviGjfcNZ8gHMJA6EcAPPM5gnBj4kv4AxBq0JoOawZQyfJ5B8Jo6tZfNaJbjHmhWJlekjWaxrrgJANt0I7b6MBuTvKvmksnUhRLRabH3BeqbdKYm385t+mPlgaaP6HUzPVPDXdfJu7U25TRLHnqjRYa3sDGgi5KnrnrPMraijQzlYINlxtIqtTd4WXBpLJ1l0AyWXNscaviylhlaN1mlG5nSzRprixbpKPqmsYp8aCQZLN1lj2QclveZCl6SEw0lt+SE6jJ0MzTY/j2Ojp+clZFLYxNCEQwO0SfY34ApQWKlOl0+BJf5OHdW1UKtYTBY8Eb+zVSTrKn3Lc+Y46H3GeG8Mw1zuCYV3W20sInFynmzOwwkO5KCGxzO0K4eth4bKBHT1LXSlgwbjxKyWlBLuCW1htnYUbhHWu5dhlDEGB+sjg4FwmXo7D7SF1pwmXsifw9Vt1ofT0OsmoNdgJ5svm8Wqhm8aIRIWILuxhFZRWqqDZB3YClOBPd3lXYsePpWzc2LC1/2+oychhFfz4ldRKYUYTPgDxBGHyPakrwH+zu3Ekx8n4eHOgvzZjiyu7tFuLgn1gDVbDHhkkfxw5m7R+ivvSM+cRYGJkO8ELSROOt33uAc17aJe7yB+06/9j005W/H3dHUNeEO84tHjH23EUXCmqbbdV7FZclHuLZ4K8bcBceYRj0ikDaD697jhGopRiZeYvfcjOPAsX+uAUs0fGnA2D1Nuw/PVr57r3yvMuBYHr+ql9i7Hqku73TbnbIPJ48Rxsa2/o4d2s3rKOUpZ//fPN/QLXZ+2goFXDt+NtBqSJfEe8cj7B6XKTVAfLp2hw0Z3Kpul8IvHgZf2Y2C7zBX2revj7KREGqIAcBxZ3T/vCpNpaHsCON9Bx2m/dIS1d7NoWGNxglo+5CuQVfcqxvHQnqzpB/MwZdcwByIgCUIQo3hc+k3bjOvP370sSXzA8pvXH/PSZ8+yKRnh1kj+ZcGdsck0vjl6+F7WMfEw6agtBoNL/2FZEpKwNwKsuJ2MSYoCIlUhnQau4aDyovubFo4dqI86Z4ooeacUUEcBiOmD2LxsNjhUiNjGh+Od/VibeLo9dLZVmonqzX1A08Fp6ZYqOw2gTfiOnMNZ6lshho5qdgfwRPvB0D8pXHY4psWBrEwAVRP3gijnCG+dd9OMVhOfg2/mJA3ct39awDdoi1vpCW0nDBV1Y0FHRfDWdz4jrB85tk3u3uBMxa3NoTbfzYvv//hr872Pe1tR8uxb6Joh3NapI2Y3dZxQ9egyb90PjnzIqCByMVvfer6n/xnXm5w3jr1e/fjwOTlm2Tbk92BKW6dCXn/28czRzto8M4T9JeW3DANNZVs7bTKoJ6J3VwQghx6Tj6+e03Opf3x5XNy/v707D9fk0/n0r76iTxdLdZEArcL0IQtlAmj0pTWwCx+64dX/+u/PXsS5QjYRUYZt8sPlKmTisbH8ZjMp++O1/zSn8XzFqn4FS8fF9J92XQD5gc2jLv1Ax/Dd0cx3Vgnn7m2DRXk7Zv3UWT/VBLy+bIOOxn/R0mYxHnr0P1qRCgScrPwxC14jG/wnn2YUwsr+gAj0vF0X5A3ZanRT+tPeQyd7ullVX1onPO+sZDzk3cX/lUaDY9V1Bwx+rHlVPKaani7yfmFQ2XE++V4eOAkiCQ8dGuP87DVxAo/Xeu4AqKHLi1L7r5MxSZg25vlH3/njngAnEmIF1yFG366fQQGqGxyrbPodbd90ih5HzC8UNp2InkgdEsMsOEGcLu+WfKaI/Pe08PlvH1MWrLejTFeQsxuPJYXN2CHli81RjHuVE7vNxroOMTJZU3lHCad6cSUnPF5o6Ek0zXCBFli1lBcztQHth4YFI2OaMvRRWcZ+h2IhLp/v4QruQNAQ6UsFCGzO32eUXrWltIUtPCp+BlA11bnAT7LcCRmGaqFRY7rkKv/SZ2BqbQsWk9cPrV814J3dEx2V+s7Ex5Agz2zC9ASLPm4ruE5+dQ+Y2/RAfYjuWgdYIOX4LcxTa0d1XMEZWLENG6RDn7x54QKEVUm6s0XMcGNakzMW4J2byCXVhFj8THnknw6HxUoDBNks8mr5CLbAVV1hrFvDrAGkzqj14HNUOLiX8TUqejob8+ArR+tUAiQ8+STIhFnp3xk1EJHNFCv8lDRC8BIwjCdYEYo+UXpFdXlcE43IW/mmOylCXU3/hpz6aZgVwAyrnom7pp41xi3slT0Q3UeGYIt4zEzYkAhlyHPFdMSKm6dWAojNuIkLgWVx4jj38JB2SaI9FyUAwK3XZabSMrSWbBzNGC3X57UkUpg2IVgma4f3O0i9lRbzhpBNcF+0aRF4unZ9eu3aq5ms/j0d2CFXUD27d1C9qNb0N/GHt5nDm+H7pvGLkDakCw+irZpUnZOuF1Cj19yHPVPBvQowqqxTB2X02HJcYQvG8bAmBGcsfP4Yc3RDks8QbyIU3HnSq9JpDBhgNsxhNMWjrCDo5NKGOAztZLuXXFyK6Ycdj8kA0Vpm6plun50I+8mJb5rKdYMCA5lR0/ww+zow1wSw20TkZ8EiwsgiOgAdUENoaWq3etiF8A1USu52TLPOEuvlVTVSF4tzuQw3LeoP64S4ZR7Lksnf5Q2HQMo+YULIG8CYpMBG27j7JUdYf5OjiaMd/Q/SLrCKAsuQ9ZCWi7EaIwwImW9+z0Y4fP1LkO9RmpOjCeETlXO6oEI8VNY0CVXDWqXTFW1VhUfyVCEYyN3JulUYBHZjJzsx43LZSd2MiK5i+GW1kmiCGxhmHS4zAEIRtbv8Mu9u71XdnPfRo/dpsyykXa3nC21Rl9iGXjBDjHrb6UF4Xs8Bwmas5YkZAgm+u2mFnC7wKc2NtuNBGQn7IeJsXo8+NnSdEjbrQej6eV+moJ64dfKSFfUNO2McMsrME6ue21PQw2jQaSwC8maQty4Edh48J7boG95tA7p3f1gR+vH29H0Q2GSDTm9NWnBYXwThQPakOKNQLiFMPh6qXt5I3X6qHvnL1oS2vTNO5esl+pxBMgNcrwTIF/vcfzx5i1LNdrgOFt2O/mojypBUt6xW8iPox7HlLQNDmOn1GMJ2o6fOnnlTmMXRQV2oR4gSkK3PMnEoxG+Nrrh2EtJq6xepz1RnQ9KBH+tQ2TPuczkCfnPyc/ff0+evj19c/GMnHJjuZw33CygxFL4KC5CzVX2vkD7ImGYLTvzeIRtxi+OZIxpldmruK/+0+1qDIPuxqBHPtnQ57tcF4Zp/13db8/xhzjFYqZUxtqkbzLFqEjVnW6HkA+05I3xKxClieEVF1R78eTEprtDDN/1eHkV3nPDy2N2Gulnyn9yB6H1Iu70xdxc8nx1Fm/kvruOYY1Qadjz/wYnEX4yOAvBcQO9sowy7spUOmdiwCBkg6xWek4l/3NPVrXMdxRuy+wDON0/UyPsnnEdrSXN1PXnF7ccvha+xZfvXbSV1fwrUGEXjGogtYZSVVzSaMFdTzxdUMtBWnNjerygx6T2LX1QYn3rR6gzHVx3dZ44wVVTbbEZ0obU/WL1iM2OgrC5jUSdQQmaWiiLZElle86HEz6/tCt2wbMLrZa87JqHhe/RuhZBUx0cjND8xz1r2zptXMHZEMnLI1HZLRl6/dn1CJnR4aGYObnkPnq+2FXcR1rAdUpnyqHgd9U84Rp1pt6PepXQ8wihXkdFjZUaYqzSXuI7aBVYiqs9wW9N3LeexKmveFkKOJ6Ue4fr3VbORba3J/cOknPteIzjkHsRVut1GJLrNjr7nNSCui1z77PSBCTT63rMy4+pkEewJ2+RQac72/JXZSx5R9mCyxGTrqSZJMc3u7z+JDHTv9bgxIfTj3yTMzMhb0tak8/4D68flUr6utN/Dh9PsqBLcJqTAKrJlwb0mmAPQlMraaDVqOLFqY7eAn9zHHkZeuAxB1nztguk9OT7vnzjeLYkHQHVzQH6EJqj3hZTnPKU12G2e8bb1tJbTYycbRgeXm6IbqSM2rHmeffy+MizbyM1UmMXIBbBwsy/EZSsuCzVyhBTA+Mzztwnz2N1giFPdnhBHHke303ODXmKHWFBss0zhKHLZz1ukUbiO/4W5pStySez3fi2i8BWu4W0ybNr3QpHMNhHXvu+qYWoYK0aHjL3Ig443vUBiFT/b1WaYjnPkH3bZOdXqMe683r1OkIxUhg9aOE3BxB7nLzeMVJDhm9wvbey7gxJH+8COqTmOA67LmCwvTebhEy/DYMdijekuLn4GcsGUo4EHK1wQ5JLmHEZfPUonLCrX0XrkaaDiN1BhWKZcNs4YHbUv9SCsfPZ5qY99FIa6U3Z+bCtpWxRHbkF/mZVZDgZWEf97cgy5GXKZboJYknvhiMZiwrzPp4RIdUv28Ft8W20N+X9kamdA6zzvn03YF1T3Z4p9+fnG1JWCz5opU7c7XC2rE9+vxV5NvnMEt/WQul1vg3/m6mp/LcbO8a0iGx3UW/V89jT5NjytxcI/QbaHkwlGlDV9lvfT9XoKShAWq3qQ0RHqZrpwLlwqzMe1nTWNtxQjoA4+uqO497DE1XVVK67+4jXDsfpe3tlCdo9QwWXMxVXCqi5yl0jdIP82LEiW8xWkLcr+uxLrhyBXxoh1uQ/Gir4jENJTrHu2TsHo6isYFowpa74AwXdf4cp8etv7GcqxrT55N1mN+HwurGoch84wvTmu/6hWyJM2QnuaO+Tn5CP69qTvvEcOOb4HRzfPA2zImkz2R20HQ7eEaGfmFjb2l1kjuGq65TLbey8Z7FWuvX2Y4j5w9uRLe/1ykl8nFpe1HnnEO1hhVv5Rs99i6ZWKpMmso2UW8ftB6mpjbsmmSyoSRnt7wHWoZw+MeRGi4Tb3IOacFc6Y7RodCpvSA+mAV3QeTqbcgM6+fO0DTpp+uM26HDqMwgWuLYgUbVKb5w4+MlOc6foLTTspMqk1qj8EseoJdySuR9xWVSvXoT/PgkovAj/EfKaYm5/KkDHs/MCOQ8YPffE9IPn6HHtjVobkFOGgWjOpOJyBlqPxF2HdB+Frr7ifyPro+7ZIyDZ9iWe9bYhcqUwrK2yXqnIEkc7fmc+bu+O3UfMINb9P/0Dhgla4wM/eb0AfRx/hNPZQ8bT0xMc/fiMnOD6cdRA2yM1Sxnh8wnoMPwTtrIw9zTnhayh4x4jexvuFn1iep2i9+40//NQr+TdW6PEd5tc8j/j3hp+lUmmnP/jjEiYK8v9BtYLakYmQBl27LZCva30i48PF3RbnW0C1CDBZeeMtY3T2/qbeEKK4fNjVFRs9zfqph5+HB207KQJN6ZJrnQiZEyWyuetu18MBTEErbP6QAeb0peeZ25xconB6X3S6SgZEl1n8BBFfnqJqZ37H6Oe9DwMybtLzz04jotQY0SxzPmi74ZUgyM7ikxZuKNHm+RtGk0uwPwKgkWdqbnBN5txJf0HCWXrT8RgvE5pcn755h/vLsiFe6fIb3Jk+soG20yV1Idg+3Gl4tiiGGILYFfmICfy7YRw3h5ksaFzXb/OrkUYpoGGEYQbKbhHywXNB00hH0DJ9Xh0XUFGjQbE2VLbHG3CZx/LJRW89AcxgsSuIDxaV+t9ghA5dgVrsyu2E538NoE0MeyFtbUpOM6gzQIatzIHQxh9BLeJz2Vb+aI0t+sbbhRTVZW1T9wt8fZ4BIdQvAR/xTWIXUsztYtlJagsjHmogbduZS/Dfw/UtjVaUWx9qXFRK36MtOoYwh4DghggUnFrANnKFlTKQeOM3O2mwqqIyEjM9khtm7uHJcw8/P3tm/fh3Xuxs3z3oFild33/yXu2cXNVLJVocjHgTTvHWYY5N91k7HacbyO5NeSpR8I8w24dWNjbTtTdAU8Q6Sg1oskkzd4GXD9JbkO6wGS76GAJGjMFZo0gTEkGtXWG8qXfw5H2CqtVTunrGe8M9naEtkO0VtoS5fj767+/iaXgRtme+twpPT9+guVugcGWi3VKfbOTaKOYv5/9dnF+Qd7R64rLshvrHd9WR9vR0zC3hiiOkBXIGFC3j6xOfYqXLCZPz/ZVjsXseAWbD12E35KcXe3YcpYFqXx+Grr0Biz2YiiOtykP3Cugpbj6L1833BXmyHKoSaa+3egvcSb0A2U3hnHVaMV3Qd3KF/c+J6aJpKhTQ/5mrFZy/m9TQdmV4MZC+bcX4W/Pu0+5nAGLfzTjGlZURBUZOhW93xAqS2IUGTmWGubcWL12lv0xhUVN7SI06+9wILs4DJBEp9Sx0PSF0L5eiynd60Le6ZMd5iCtXv/l/wYAAP//TiG6fA==" +} diff --git a/x-pack/filebeat/module/citrix/netscaler/_meta/fields.yml b/x-pack/filebeat/module/citrix/netscaler/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/citrix/netscaler/config/input.yml b/x-pack/filebeat/module/citrix/netscaler/config/input.yml new file mode 100644 index 00000000000..1226056cf17 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Citrix" + product: "Netscaler" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/citrix/netscaler/config/liblogparser.js + - ${path.home}/module/citrix/netscaler/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/citrix/netscaler/config/liblogparser.js b/x-pack/filebeat/module/citrix/netscaler/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{p0}"); + +var dup15 = // "Pattern{Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); + +var dup16 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); + +var dup17 = setc("event_description","AppFw SQL Injection violation"); + +var dup18 = setc("event_description","AppFw Request error. Generated 400 Response"); + +var dup19 = setc("severity","Warning"); + +var dup20 = // "Pattern{Constant('"'), Field(p0,false)}" +match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); + +var dup21 = // "Pattern{Constant('HASTATE '), Field(p0,false)}" +match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); + +var dup22 = // "Pattern{Field(network_service,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); + +var dup23 = // "Pattern{Field(info,false), Constant('"')}" +match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); + +var dup24 = setc("event_description","Routing details"); + +var dup25 = // "Pattern{Constant('for '), Field(dclass_counter1,false)}" +match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); + +var dup26 = // "Pattern{Field(space,false)}" +match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); + +var dup27 = setc("ec_subject","Configuration"); + +var dup28 = setc("ec_activity","Stop"); + +var dup29 = setc("ec_theme","Configuration"); + +var dup30 = setc("ec_activity","Start"); + +var dup31 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); + +var dup32 = // "Pattern{Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); + +var dup33 = // "Pattern{}" +match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); + +var dup34 = setc("ec_subject","Service"); + +var dup35 = date_time({ + dest: "event_time", + args: ["hdatetime"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + [dW,dc("/"),dG,dc("/"),dF,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup36 = // "Pattern{Field(obj_type,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); + +var dup37 = // "Pattern{Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); + +var dup38 = // "Pattern{Constant(''), Field(obj_name,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); + +var dup39 = setc("event_description","The monitor bound to the service is up"); + +var dup40 = setc("ec_subject","NetworkComm"); + +var dup41 = setc("severity","Debug"); + +var dup42 = // "Pattern{Constant('" '), Field(p0,false)}" +match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); + +var dup43 = // "Pattern{Constant(''), Field(info,false), Constant('"')}" +match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); + +var dup44 = date_time({ + dest: "starttime", + args: ["fld10"], + fmts: [ + [dB,dF,dH,dc(":"),dU,dc(":"),dO,dW], + ], +}); + +var dup45 = setc("event_description","Process"); + +var dup46 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); + +var dup47 = setc("event_description","SNMP TRAP SENT"); + +var dup48 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); + +var dup49 = // "Pattern{Constant('ClientIP '), Field(p0,false)}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); + +var dup50 = date_time({ + dest: "event_time", + args: ["hdatetime"], + fmts: [ + [dM,dc("/"),dD,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + [dD,dc("/"),dM,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup51 = setc("ec_activity","Request"); + +var dup52 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); + +var dup53 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); + +var dup54 = // "Pattern{Field(fld10,true), Constant(' - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); + +var dup55 = // "Pattern{Constant('" '), Field(fld11,true), Constant(' GMT" - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); + +var dup56 = // "Pattern{Constant('" '), Field(fld11,false), Constant('" - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); + +var dup57 = // "Pattern{Field(fld11,true), Constant(' - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); + +var dup58 = setc("event_description","ICA connection related information for a connection belonging to a SSLVPN session"); + +var dup59 = setc("dclass_ratio1_string"," Compression_ratio_send"); + +var dup60 = setc("dclass_ratio2_string"," Compression_ratio_recv"); + +var dup61 = date_time({ + dest: "endtime", + args: ["fld11"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup62 = date_time({ + dest: "starttime", + args: ["fld10"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup63 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); + +var dup64 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); + +var dup65 = // "Pattern{Constant('User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); + +var dup66 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); + +var dup67 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); + +var dup68 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); + +var dup69 = setc("eventcategory","1401060000"); + +var dup70 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start_time '), Field(p0,false)}" +match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); + +var dup71 = setc("eventcategory","1401070000"); + +var dup72 = setc("ec_activity","Logoff"); + +var dup73 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(username,true), Constant(' - Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); + +var dup74 = // "Pattern{Field(,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); + +var dup75 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); + +var dup76 = // "Pattern{Field(fld11,true), Constant(' GMT - Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); + +var dup77 = // "Pattern{Field(fld11,true), Constant(' - Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); + +var dup78 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); + +var dup79 = setc("event_description","A Server side and a Client side TCP connection is delinked"); + +var dup80 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); + +var dup81 = // "Pattern{Field(fld10,true), Constant(' GMT - End Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); + +var dup82 = // "Pattern{Field(fld10,true), Constant(' - End Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); + +var dup83 = setc("event_description","TCP connection terminated"); + +var dup84 = setc("event_description","UI command executed in NetScaler"); + +var dup85 = setc("disposition","Success"); + +var dup86 = call({ + dest: "nwparser.action", + fn: STRCAT, + args: [ + field("login"), + field("fld11"), + ], +}); + +var dup87 = call({ + dest: "nwparser.action", + fn: STRCAT, + args: [ + field("logout"), + field("fld11"), + ], +}); + +var dup88 = setc("eventcategory","1401040000"); + +var dup89 = setc("event_description","CLI or GUI command executed in NetScaler"); + +var dup90 = // "Pattern{Field(info,true), Constant(' "')}" +match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); + +var dup91 = setf("msg","$MSG"); + +var dup92 = setc("event_description","GUI command executed in NetScaler"); + +var dup93 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); + +var dup94 = // "Pattern{Constant('Sessionid '), Field(sessionid,true), Constant(' - User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); + +var dup95 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); + +var dup96 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); + +var dup97 = // "Pattern{Field(daddr,true), Constant(' - Errmsg " '), Field(event_description,true), Constant(' "')}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); + +var dup98 = linear_select([ + dup21, + dup22, +]); + +var dup99 = linear_select([ + dup25, + dup26, +]); + +var dup100 = linear_select([ + dup32, + dup33, +]); + +var dup101 = // "Pattern{Field(fld1,false), Constant(':UserLogin:'), Field(username,true), Constant(' - '), Field(event_description,true), Constant(' from client IP Address '), Field(saddr,false)}" +match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ + dup5, + dup4, +])); + +var dup102 = linear_select([ + dup52, + dup53, + dup54, +]); + +var dup103 = linear_select([ + dup55, + dup56, + dup57, +]); + +var dup104 = linear_select([ + dup63, + dup64, + dup65, +]); + +var dup105 = linear_select([ + dup67, + dup68, +]); + +var dup106 = linear_select([ + dup76, + dup77, +]); + +var dup107 = linear_select([ + dup81, + dup82, +]); + +var dup108 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" +match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ + dup88, + dup89, + dup3, + dup4, +])); + +var dup109 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" +match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ + dup9, + dup91, +])); + +var dup110 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" +match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ + dup11, + dup91, +])); + +var dup111 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ + dup9, + dup4, +])); + +var dup112 = linear_select([ + dup95, + dup96, +]); + +var dup113 = all_match({ + processors: [ + dup20, + dup98, + dup23, + ], + on_success: processor_chain([ + dup2, + dup24, + dup3, + dup4, + ]), +}); + +var dup114 = all_match({ + processors: [ + dup94, + dup112, + dup97, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var hdr1 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(hfld2,false), Constant(':'), Field(payload,false)}" +match("HEADER#0:0001", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} %{hfld2}:%{payload}", processor_chain([ + setc("header_id","0001"), + dup1, +])); + +var hdr2 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' :'), Field(payload,false)}" +match("HEADER#1:0005", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} :%{payload}", processor_chain([ + setc("header_id","0005"), + dup1, +])); + +var hdr3 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(hfld2,true), Constant(' '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#2:0002/0", "message", "%{hdatetime->} %{hfld1->} : %{hfld2->} %{msgIdPart1->} %{msgIdPart2->} %{p0}"); + +var part1 = // "Pattern{Field(hfld3,true), Constant(' '), Field(p0,false)}" +match("HEADER#2:0002/1_0", "nwparser.p0", "%{hfld3->} %{p0}"); + +var part2 = // "Pattern{Field(p0,false)}" +match_copy("HEADER#2:0002/1_1", "nwparser.p0", "p0"); + +var select1 = linear_select([ + part1, + part2, +]); + +var part3 = // "Pattern{Constant(':'), Field(payload,false)}" +match("HEADER#2:0002/2", "nwparser.p0", ":%{payload}"); + +var all1 = all_match({ + processors: [ + hdr3, + select1, + part3, + ], + on_success: processor_chain([ + setc("header_id","0002"), + dup1, + ]), +}); + +var hdr4 = // "Pattern{Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#3:0003", "message", "%{messageid->} %{p0}", processor_chain([ + setc("header_id","0003"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr5 = // "Pattern{Constant('CEF:0|Citrix|'), Field(fld1,false), Constant('|'), Field(fld2,false), Constant('|'), Field(fld3,false), Constant('|'), Field(messageid,false), Constant('| '), Field(p0,false)}" +match("HEADER#4:0004", "message", "CEF:0|Citrix|%{fld1}|%{fld2}|%{fld3}|%{messageid}| %{p0}", processor_chain([ + setc("header_id","0004"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("fld1"), + constant("|"), + field("fld2"), + constant("|"), + field("fld3"), + constant("|"), + field("messageid"), + constant("| "), + field("p0"), + ], + }), +])); + +var hdr6 = // "Pattern{Constant('CEF:0|Citrix|'), Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(hfld1,false), Constant('|'), Field(severity,false), Constant('| '), Field(payload,false)}" +match("HEADER#5:0006", "message", "CEF:0|Citrix|%{product}|%{version}|%{rule}|%{hfld1}|%{severity}| %{payload}", processor_chain([ + setc("header_id","0006"), + setc("messageid","CITRIX_TVM"), +])); + +var select2 = linear_select([ + hdr1, + hdr2, + all1, + hdr4, + hdr5, + hdr6, +]); + +var part4 = // "Pattern{Constant('Extracted_groups "'), Field(group,false), Constant('" ')}" +match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_0", "nwparser.payload", "Extracted_groups \"%{group}\" "); + +var part5 = // "Pattern{Constant(' Extracted_groups "'), Field(group,false)}" +match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_1", "nwparser.payload", " Extracted_groups \"%{group}"); + +var select3 = linear_select([ + part4, + part5, +]); + +var all2 = all_match({ + processors: [ + select3, + ], + on_success: processor_chain([ + dup2, + setc("event_description","The groups extracted after user logs in"), + dup3, + dup4, + ]), +}); + +var msg1 = msg("AAA_EXTRACTED_GROUPS", all2); + +var part6 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Failure_reason "'), Field(result,false), Constant('"')}" +match("MESSAGE#1:AAA_LOGIN_FAILED", "nwparser.payload", "User %{username->} - Client_ip %{saddr->} - Failure_reason \"%{result}\"", processor_chain([ + dup5, + setc("ec_subject","User"), + dup6, + dup7, + dup8, + setc("event_description","The aaa module failed to login the user"), + setc("severity","Alert"), + dup4, +])); + +var msg2 = msg("AAA_LOGIN_FAILED", part6); + +var part7 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' --> Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Protocol '), Field(protocol,true), Constant(' - TimeStamp '), Field(info,true), Constant(' - Hitcount '), Field(dclass_counter1,true), Constant(' - Hit Rule '), Field(rulename,true), Constant(' - Data '), Field(message_body,false)}" +match("MESSAGE#2:ACL_ACL_PKT_LOG", "nwparser.payload", "Source %{saddr}:%{sport->} --> Destination %{daddr}:%{dport->} - Protocol %{protocol->} - TimeStamp %{info->} - Hitcount %{dclass_counter1->} - Hit Rule %{rulename->} - Data %{message_body}", processor_chain([ + dup9, + setc("event_description","ACL_PKT_LOG"), + dup10, + dup4, +])); + +var msg3 = msg("ACL_ACL_PKT_LOG", part7); + +var part8 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#3:APPFW_APPFW_BUFFEROVERFLOW_COOKIE", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ + dup11, + setc("event_description","AppFw Buffer Overflow violation in Cookie"), + dup3, + dup4, +])); + +var msg4 = msg("APPFW_APPFW_BUFFEROVERFLOW_COOKIE", part8); + +var part9 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#4:APPFW_APPFW_BUFFEROVERFLOW_HDR", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ + dup11, + setc("event_description","AppFw Buffer Overflow violation in HTTP Headers"), + dup3, + dup4, +])); + +var msg5 = msg("APPFW_APPFW_BUFFEROVERFLOW_HDR", part9); + +var part10 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#5:APPFW_APPFW_BUFFEROVERFLOW_URL", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ + dup12, + dup13, + dup3, + dup4, +])); + +var msg6 = msg("APPFW_APPFW_BUFFEROVERFLOW_URL", part10); + +var part11 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(info,false), Constant(': '), Field(url,false)}" +match("MESSAGE#137:APPFW_APPFW_BUFFEROVERFLOW_URL:01", "nwparser.payload", "%{saddr->} %{fld2->} %{info}: %{url}", processor_chain([ + dup12, + dup13, + dup3, + dup4, +])); + +var msg7 = msg("APPFW_APPFW_BUFFEROVERFLOW_URL:01", part11); + +var select4 = linear_select([ + msg6, + msg7, +]); + +var part12 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" +match("MESSAGE#6:APPFW_APPFW_COOKIE/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Cookie%{p0}"); + +var part13 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" +match("MESSAGE#6:APPFW_APPFW_COOKIE/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Cookie%{p0}"); + +var part14 = // "Pattern{Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" +match("MESSAGE#6:APPFW_APPFW_COOKIE/1_2", "nwparser.p0", "%{rule_group->} Cookie%{p0}"); + +var select5 = linear_select([ + part12, + part13, + part14, +]); + +var part15 = // "Pattern{Field(url,true), Constant(' validation failed for '), Field(fld3,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#6:APPFW_APPFW_COOKIE/2", "nwparser.p0", "%{url->} validation failed for %{fld3->} \u003c\u003c%{disposition}>"); + +var all3 = all_match({ + processors: [ + dup14, + select5, + part15, + ], + on_success: processor_chain([ + dup11, + setc("event_description","AppFw Cookie violation"), + dup3, + dup4, + ]), +}); + +var msg8 = msg("APPFW_APPFW_COOKIE", all3); + +var part16 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Deny URL: '), Field(p0,false)}" +match("MESSAGE#7:APPFW_APPFW_DENYURL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Deny URL: %{p0}"); + +var part17 = // "Pattern{Field(rule_group,true), Constant(' Disallow Deny URL: '), Field(p0,false)}" +match("MESSAGE#7:APPFW_APPFW_DENYURL/1_1", "nwparser.p0", "%{rule_group->} Disallow Deny URL: %{p0}"); + +var select6 = linear_select([ + part16, + part17, +]); + +var all4 = all_match({ + processors: [ + dup14, + select6, + dup15, + ], + on_success: processor_chain([ + dup12, + setc("ec_activity","Deny"), + setc("ec_theme","Policy"), + setc("event_description","AppFw DenyURL violation"), + dup3, + dup4, + ]), +}); + +var msg9 = msg("APPFW_APPFW_DENYURL", all4); + +var part18 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" +match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_0", "nwparser.p0", "%{fld1->} %{fld2->} %{rule_group->} Field consistency%{p0}"); + +var part19 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" +match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Field consistency%{p0}"); + +var part20 = // "Pattern{Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" +match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_2", "nwparser.p0", "%{rule_group->} Field consistency%{p0}"); + +var select7 = linear_select([ + part18, + part19, + part20, +]); + +var all5 = all_match({ + processors: [ + dup14, + select7, + dup16, + ], + on_success: processor_chain([ + dup11, + setc("event_description","AppFw Field Consistency violation"), + dup3, + dup4, + ]), +}); + +var msg10 = msg("APPFW_APPFW_FIELDCONSISTENCY", all5); + +var part21 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field'), Field(p0,false)}" +match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Field%{p0}"); + +var part22 = // "Pattern{Field(rule_group,true), Constant(' Field'), Field(p0,false)}" +match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_1", "nwparser.p0", "%{rule_group->} Field%{p0}"); + +var select8 = linear_select([ + part21, + part22, +]); + +var part23 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' ="'), Field(fld4,false), Constant('" <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/2", "nwparser.p0", "%{url->} %{info->} =\"%{fld4}\" \u003c\u003c%{disposition}>"); + +var all6 = all_match({ + processors: [ + dup14, + select8, + part23, + ], + on_success: processor_chain([ + dup11, + setc("event_description","AppFw Field Format violation"), + dup3, + dup4, + ]), +}); + +var msg11 = msg("APPFW_APPFW_FIELDFORMAT", all6); + +var part24 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' SQL'), Field(p0,false)}" +match("MESSAGE#10:APPFW_APPFW_SQL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} SQL%{p0}"); + +var part25 = // "Pattern{Field(rule_group,true), Constant(' SQL'), Field(p0,false)}" +match("MESSAGE#10:APPFW_APPFW_SQL/1_1", "nwparser.p0", "%{rule_group->} SQL%{p0}"); + +var select9 = linear_select([ + part24, + part25, +]); + +var all7 = all_match({ + processors: [ + dup14, + select9, + dup16, + ], + on_success: processor_chain([ + dup11, + dup17, + dup3, + dup4, + ]), +}); + +var msg12 = msg("APPFW_APPFW_SQL", all7); + +var part26 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#11:APPFW_APPFW_SQL_1/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{p0}"); + +var part27 = // "Pattern{Field(rule_group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#11:APPFW_APPFW_SQL_1/1_1", "nwparser.p0", "%{rule_group->} %{p0}"); + +var select10 = linear_select([ + part26, + part27, +]); + +var all8 = all_match({ + processors: [ + dup14, + select10, + dup16, + ], + on_success: processor_chain([ + dup11, + dup17, + dup3, + dup4, + ]), +}); + +var msg13 = msg("APPFW_APPFW_SQL_1", all8); + +var select11 = linear_select([ + msg12, + msg13, +]); + +var part28 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Maximum no. '), Field(p0,false)}" +match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Maximum no. %{p0}"); + +var part29 = // "Pattern{Field(rule_group,true), Constant(' Maximum no. '), Field(p0,false)}" +match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_1", "nwparser.p0", "%{rule_group->} Maximum no. %{p0}"); + +var select12 = linear_select([ + part28, + part29, +]); + +var part30 = // "Pattern{Field(url,true), Constant(' of potential credit card numbers seen <<'), Field(info,false), Constant('>')}" +match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/2", "nwparser.p0", "%{url->} of potential credit card numbers seen \u003c\u003c%{info}>"); + +var all9 = all_match({ + processors: [ + dup14, + select12, + part30, + ], + on_success: processor_chain([ + dup9, + setc("event_description","AppFw SafeCommerce credit cards seen"), + dup3, + dup4, + ]), +}); + +var msg14 = msg("APPFW_APPFW_SAFECOMMERCE", all9); + +var part31 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Transformed ('), Field(info,false), Constant(') Maximum no. '), Field(p0,false)}" +match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{url->} Transformed (%{info}) Maximum no. %{p0}"); + +var part32 = // "Pattern{Field(rule_group,true), Constant(' '), Field(url,true), Constant(' ('), Field(info,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_1", "nwparser.p0", "%{rule_group->} %{url->} (%{info}) %{p0}"); + +var select13 = linear_select([ + part31, + part32, +]); + +var part33 = // "Pattern{Constant('potential credit card numbers seen in server response'), Field(,false)}" +match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/2", "nwparser.p0", "potential credit card numbers seen in server response%{}"); + +var all10 = all_match({ + processors: [ + dup14, + select13, + part33, + ], + on_success: processor_chain([ + dup9, + setc("event_description","AppFw SafeCommerce Transformed for credit cards seen in server repsonse"), + dup3, + dup4, + ]), +}); + +var msg15 = msg("APPFW_APPFW_SAFECOMMERCE_XFORM", all10); + +var part34 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" +match("MESSAGE#14:APPFW_APPFW_STARTURL/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Disallow Illegal URL: %{p0}"); + +var part35 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" +match("MESSAGE#14:APPFW_APPFW_STARTURL/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Illegal URL: %{p0}"); + +var part36 = // "Pattern{Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" +match("MESSAGE#14:APPFW_APPFW_STARTURL/1_2", "nwparser.p0", "%{rule_group->} Disallow Illegal URL: %{p0}"); + +var select14 = linear_select([ + part34, + part35, + part36, +]); + +var all11 = all_match({ + processors: [ + dup14, + select14, + dup15, + ], + on_success: processor_chain([ + dup12, + setc("event_description","AppFw StartURL violation"), + dup3, + dup4, + ]), +}); + +var msg16 = msg("APPFW_APPFW_STARTURL", all11); + +var part37 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Cross-site'), Field(p0,false)}" +match("MESSAGE#15:APPFW_APPFW_XSS/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Cross-site%{p0}"); + +var part38 = // "Pattern{Field(rule_group,true), Constant(' Cross-site'), Field(p0,false)}" +match("MESSAGE#15:APPFW_APPFW_XSS/1_1", "nwparser.p0", "%{rule_group->} Cross-site%{p0}"); + +var select15 = linear_select([ + part37, + part38, +]); + +var part39 = // "Pattern{Field(url,true), Constant(' script '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#15:APPFW_APPFW_XSS/2", "nwparser.p0", "%{url->} script %{info->} \u003c\u003c%{disposition}>"); + +var all12 = all_match({ + processors: [ + dup14, + select15, + part39, + ], + on_success: processor_chain([ + dup12, + setc("event_description","AppFw XSS violation"), + dup3, + dup4, + ]), +}); + +var msg17 = msg("APPFW_APPFW_XSS", all12); + +var part40 = // "Pattern{Field(saddr,true), Constant(' "'), Field(info,false), Constant('"')}" +match("MESSAGE#16:APPFW_AF_400_RESP", "nwparser.payload", "%{saddr->} \"%{info}\"", processor_chain([ + dup11, + dup18, + dup3, + dup4, +])); + +var msg18 = msg("APPFW_AF_400_RESP", part40); + +var part41 = // "Pattern{Field(saddr,true), Constant(' '), Field(info,false)}" +match("MESSAGE#138:APPFW_AF_400_RESP:01", "nwparser.payload", "%{saddr->} %{info}", processor_chain([ + dup11, + dup18, + dup3, + dup4, +])); + +var msg19 = msg("APPFW_AF_400_RESP:01", part41); + +var select16 = linear_select([ + msg18, + msg19, +]); + +var part42 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld10,true), Constant(' Match found with Safe Object: '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#17:APPFW_APPFW_SAFEOBJECT", "nwparser.payload", "%{saddr->} %{fld10->} Match found with Safe Object: %{info->} \u003c\u003c%{disposition}>", processor_chain([ + dup11, + setc("event_description","AppFw Safe Object"), + dup3, + dup4, +])); + +var msg20 = msg("APPFW_APPFW_SAFEOBJECT", part42); + +var part43 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld10,true), Constant(' CSRF Tag validation failed: <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#18:APPFW_APPFW_CSRF_TAG", "nwparser.payload", "%{saddr->} %{fld10->} CSRF Tag validation failed: \u003c\u003c%{disposition}>", processor_chain([ + dup11, + setc("event_description","AppFw CSRF Tag Validation Failed"), + dup3, + dup4, +])); + +var msg21 = msg("APPFW_APPFW_CSRF_TAG", part43); + +var part44 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(url,false)}" +match("MESSAGE#135:APPFW_APPFW_CSRF_TAG:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url}", processor_chain([ + dup9, + dup3, + dup4, +])); + +var msg22 = msg("APPFW_APPFW_CSRF_TAG:01", part44); + +var select17 = linear_select([ + msg21, + msg22, +]); + +var part45 = // "Pattern{Constant('Memory allocation request for '), Field(bytes,true), Constant(' bytes failed. Call stack PCs: '), Field(fld1,false)}" +match("MESSAGE#19:APPFW_AF_MEMORY_ERR", "nwparser.payload", "Memory allocation request for %{bytes->} bytes failed. Call stack PCs: %{fld1}", processor_chain([ + dup11, + setc("event_description","Memory allocation request for some bytes failed"), + dup19, + dup4, +])); + +var msg23 = msg("APPFW_AF_MEMORY_ERR", part45); + +var part46 = // "Pattern{Constant('Invalid rule id '), Field(p0,false)}" +match("MESSAGE#20:APPFW_Message/1_0", "nwparser.p0", "Invalid rule id %{p0}"); + +var part47 = // "Pattern{Constant('Duplicate rule id '), Field(p0,false)}" +match("MESSAGE#20:APPFW_Message/1_1", "nwparser.p0", "Duplicate rule id %{p0}"); + +var select18 = linear_select([ + part46, + part47, +]); + +var part48 = // "Pattern{Field(fld1,false), Constant('"')}" +match("MESSAGE#20:APPFW_Message/2", "nwparser.p0", "%{fld1}\""); + +var all13 = all_match({ + processors: [ + dup20, + select18, + part48, + ], + on_success: processor_chain([ + dup11, + setc("event_description","Invalid/Duplicate Rule id"), + dup19, + dup4, + ]), +}); + +var msg24 = msg("APPFW_Message", all13); + +var part49 = // "Pattern{Constant('"Setting default custom settings for profile '), Field(fld1,true), Constant(' ('), Field(fld2,false), Constant(')"')}" +match("MESSAGE#21:APPFW_Message:01", "nwparser.payload", "\"Setting default custom settings for profile %{fld1->} (%{fld2})\"", processor_chain([ + dup9, + setc("event_description","Setting default custom settings for profile"), + dup19, + dup4, +])); + +var msg25 = msg("APPFW_Message:01", part49); + +var part50 = // "Pattern{Constant('"Setting same CustomSettings( ) to profile. '), Field(fld2,false), Constant('"')}" +match("MESSAGE#22:APPFW_Message:02", "nwparser.payload", "\"Setting same CustomSettings( ) to profile. %{fld2}\"", processor_chain([ + dup9, + setc("event_description","Setting same CustomSettings( ) to profile."), + dup4, +])); + +var msg26 = msg("APPFW_Message:02", part50); + +var select19 = linear_select([ + msg24, + msg25, + msg26, +]); + +var msg27 = msg("DR_HA_Message", dup113); + +var part51 = // "Pattern{Field(process,true), Constant(' ended '), Field(p0,false)}" +match("MESSAGE#24:EVENT_ALERTENDED/0", "nwparser.payload", "%{process->} ended %{p0}"); + +var all14 = all_match({ + processors: [ + part51, + dup99, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Alert process ended"), + dup3, + dup4, + ]), +}); + +var msg28 = msg("EVENT_ALERTENDED", all14); + +var part52 = // "Pattern{Field(process,true), Constant(' started '), Field(p0,false)}" +match("MESSAGE#25:EVENT_ALERTSTARTED/0", "nwparser.payload", "%{process->} started %{p0}"); + +var all15 = all_match({ + processors: [ + part52, + dup99, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Alert process started"), + dup3, + dup4, + ]), +}); + +var msg29 = msg("EVENT_ALERTSTARTED", all15); + +var part53 = // "Pattern{Constant('CONFIG '), Field(info,false)}" +match("MESSAGE#26:EVENT_CONFIGEND", "nwparser.payload", "CONFIG %{info}", processor_chain([ + dup2, + dup27, + dup28, + dup29, + setc("event_description","Configuration read completed from ns.conf file during boot-up"), + dup3, + dup4, +])); + +var msg30 = msg("EVENT_CONFIGEND", part53); + +var part54 = // "Pattern{Constant('CONFIG '), Field(info,false)}" +match("MESSAGE#27:EVENT_CONFIGSTART", "nwparser.payload", "CONFIG %{info}", processor_chain([ + dup2, + dup27, + dup30, + dup29, + setc("event_description","Configuration read started from ns.conf file during boot-up"), + dup3, + dup4, +])); + +var msg31 = msg("EVENT_CONFIGSTART", part54); + +var all16 = all_match({ + processors: [ + dup31, + dup100, + ], + on_success: processor_chain([ + dup11, + dup34, + dup28, + setc("event_description","Device Down"), + dup10, + dup35, + ]), +}); + +var msg32 = msg("EVENT_DEVICEDOWN", all16); + +var part55 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" +match("MESSAGE#29:EVENT_DEVICEOFS", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ + dup11, + dup34, + dup28, + setc("event_description","Device Out Of Service"), + dup10, + dup4, +])); + +var msg33 = msg("EVENT_DEVICEOFS", part55); + +var all17 = all_match({ + processors: [ + dup31, + dup100, + ], + on_success: processor_chain([ + dup2, + dup34, + dup30, + setc("event_description","Device UP"), + dup10, + dup35, + ]), +}); + +var msg34 = msg("EVENT_DEVICEUP", all17); + +var part56 = // "Pattern{Constant('"'), Field(obj_name,false), Constant('"')}" +match("MESSAGE#31:EVENT_MONITORDOWN/1_1", "nwparser.p0", "\"%{obj_name}\""); + +var select20 = linear_select([ + dup37, + part56, + dup38, +]); + +var all18 = all_match({ + processors: [ + dup36, + select20, + ], + on_success: processor_chain([ + dup11, + setc("event_description","The monitor bound to the service is down"), + dup3, + dup4, + ]), +}); + +var msg35 = msg("EVENT_MONITORDOWN", all18); + +var select21 = linear_select([ + dup37, + dup38, +]); + +var all19 = all_match({ + processors: [ + dup36, + select21, + ], + on_success: processor_chain([ + dup2, + dup39, + dup3, + dup4, + ]), +}); + +var msg36 = msg("EVENT_MONITORUP", all19); + +var part57 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" +match("MESSAGE#33:EVENT_NICRESET", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ + dup2, + dup39, + dup3, + dup4, +])); + +var msg37 = msg("EVENT_NICRESET", part57); + +var part58 = // "Pattern{Field(obj_type,true), Constant(' '), Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#34:EVENT_ROUTEDOWN", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ + dup11, + dup40, + dup28, + setc("event_description","Route is Down"), + dup3, + dup4, +])); + +var msg38 = msg("EVENT_ROUTEDOWN", part58); + +var part59 = // "Pattern{Field(obj_type,true), Constant(' '), Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#35:EVENT_ROUTEUP", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ + dup2, + dup40, + dup30, + setc("event_description","Route is UP"), + dup41, + dup4, +])); + +var msg39 = msg("EVENT_ROUTEUP", part59); + +var part60 = // "Pattern{Constant('CPU_started '), Field(info,false)}" +match("MESSAGE#36:EVENT_STARTCPU", "nwparser.payload", "CPU_started %{info}", processor_chain([ + dup2, + setc("event_description","CPU Started"), + dup3, + dup4, +])); + +var msg40 = msg("EVENT_STARTCPU", part60); + +var part61 = // "Pattern{Constant('SAVECONFIG '), Field(info,false)}" +match("MESSAGE#37:EVENT_STARTSAVECONFIG", "nwparser.payload", "SAVECONFIG %{info}", processor_chain([ + dup2, + setc("event_description","Save configuration started"), + dup3, + dup4, +])); + +var msg41 = msg("EVENT_STARTSAVECONFIG", part61); + +var part62 = // "Pattern{Constant('System started - '), Field(info,false)}" +match("MESSAGE#38:EVENT_STARTSYS", "nwparser.payload", "System started - %{info}", processor_chain([ + dup2, + dup34, + dup30, + setc("event_description","Netscaler Started"), + dup3, + dup4, +])); + +var msg42 = msg("EVENT_STARTSYS", part62); + +var part63 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" +match("MESSAGE#39:EVENT_STATECHANGE", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ + dup2, + dup34, + dup30, + setc("event_description","HA State has changed"), + dup3, + dup4, +])); + +var msg43 = msg("EVENT_STATECHANGE", part63); + +var part64 = // "Pattern{Field(obj_type,true), Constant(' ('), Field(obj_name,false), Constant(') - '), Field(event_state,true), Constant(' '), Field(info,false)}" +match("MESSAGE#40:EVENT_STATECHANGE_HEARTBEAT", "nwparser.payload", "%{obj_type->} (%{obj_name}) - %{event_state->} %{info}", processor_chain([ + dup2, + setc("event_description","Heartbeat State report"), + dup3, + dup4, +])); + +var msg44 = msg("EVENT_STATECHANGE_HEARTBEAT", part64); + +var part65 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - '), Field(event_state,true), Constant(' '), Field(info,false)}" +match("MESSAGE#41:EVENT_STATECHANGE:01", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - %{event_state->} %{info}", processor_chain([ + dup2, + dup4, +])); + +var msg45 = msg("EVENT_STATECHANGE:01", part65); + +var select22 = linear_select([ + msg43, + msg44, + msg45, +]); + +var part66 = // "Pattern{Constant('SAVECONFIG'), Field(info,false)}" +match("MESSAGE#42:EVENT_STOPSAVECONFIG", "nwparser.payload", "SAVECONFIG%{info}", processor_chain([ + dup2, + dup27, + dup28, + setc("event_description","Save configuration stopped"), + dup3, + dup4, +])); + +var msg46 = msg("EVENT_STOPSAVECONFIG", part66); + +var part67 = // "Pattern{Constant('System stopped - '), Field(info,false)}" +match("MESSAGE#43:EVENT_STOPSYS", "nwparser.payload", "System stopped - %{info}", processor_chain([ + dup2, + dup34, + dup28, + setc("event_description","Netscaler Stopped"), + dup3, + dup4, +])); + +var msg47 = msg("EVENT_STOPSYS", part67); + +var part68 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#44:EVENT_UNKNOWN", "nwparser.payload", "info", processor_chain([ + dup11, + setc("event_description","Unknown Event"), + dup3, + dup4, +])); + +var msg48 = msg("EVENT_UNKNOWN", part68); + +var part69 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' Adding '), Field(p0,false)}" +match("MESSAGE#45:PITBOSS_Message1/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Adding %{p0}"); + +var part70 = // "Pattern{Constant('Adding '), Field(p0,false)}" +match("MESSAGE#45:PITBOSS_Message1/1_1", "nwparser.p0", "Adding %{p0}"); + +var select23 = linear_select([ + part69, + part70, +]); + +var all20 = all_match({ + processors: [ + dup42, + select23, + dup43, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Pitboss watch is added"), + dup3, + dup4, + ]), +}); + +var msg49 = msg("PITBOSS_Message1", all20); + +var part71 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' Deleting '), Field(p0,false)}" +match("MESSAGE#46:PITBOSS_Message2/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Deleting %{p0}"); + +var part72 = // "Pattern{Constant('Deleting '), Field(p0,false)}" +match("MESSAGE#46:PITBOSS_Message2/1_1", "nwparser.p0", "Deleting %{p0}"); + +var select24 = linear_select([ + part71, + part72, +]); + +var all21 = all_match({ + processors: [ + dup42, + select24, + dup23, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Pitboss watch is deleted"), + dup3, + dup4, + ]), +}); + +var msg50 = msg("PITBOSS_Message2", all21); + +var part73 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#47:PITBOSS_Message3/0", "nwparser.payload", "\"%{fld1->} %{fld10->} %{p0}"); + +var part74 = // "Pattern{Constant('Pitboss policy is'), Field(p0,false)}" +match("MESSAGE#47:PITBOSS_Message3/1_0", "nwparser.p0", "Pitboss policy is%{p0}"); + +var part75 = // "Pattern{Constant('PB_OP_CHANGE_POLICY new policy'), Field(p0,false)}" +match("MESSAGE#47:PITBOSS_Message3/1_1", "nwparser.p0", "PB_OP_CHANGE_POLICY new policy%{p0}"); + +var part76 = // "Pattern{Constant('pb_op_longer_hb'), Field(p0,false)}" +match("MESSAGE#47:PITBOSS_Message3/1_2", "nwparser.p0", "pb_op_longer_hb%{p0}"); + +var select25 = linear_select([ + part74, + part75, + part76, +]); + +var part77 = // "Pattern{Field(,true), Constant(' '), Field(info,false), Constant('"')}" +match("MESSAGE#47:PITBOSS_Message3/2", "nwparser.p0", "%{} %{info}\""); + +var all22 = all_match({ + processors: [ + part73, + select25, + part77, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Pitboss policy"), + dup3, + dup4, + dup44, + ]), +}); + +var msg51 = msg("PITBOSS_Message3", all22); + +var part78 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' process '), Field(p0,false)}" +match("MESSAGE#48:PITBOSS_Message4/1_0", "nwparser.p0", "%{fld1->} %{fld10->} process %{p0}"); + +var part79 = // "Pattern{Constant('process '), Field(p0,false)}" +match("MESSAGE#48:PITBOSS_Message4/1_1", "nwparser.p0", "process %{p0}"); + +var select26 = linear_select([ + part78, + part79, +]); + +var all23 = all_match({ + processors: [ + dup42, + select26, + dup43, + ], + on_success: processor_chain([ + dup2, + dup45, + dup3, + dup4, + dup44, + ]), +}); + +var msg52 = msg("PITBOSS_Message4", all23); + +var part80 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' New '), Field(p0,false)}" +match("MESSAGE#49:PITBOSS_Message5/1_0", "nwparser.p0", "%{fld1->} %{fld10->} New %{p0}"); + +var part81 = // "Pattern{Constant('New '), Field(p0,false)}" +match("MESSAGE#49:PITBOSS_Message5/1_1", "nwparser.p0", "New %{p0}"); + +var select27 = linear_select([ + part80, + part81, +]); + +var all24 = all_match({ + processors: [ + dup42, + select27, + dup43, + ], + on_success: processor_chain([ + dup2, + dup45, + dup3, + dup4, + dup44, + ]), +}); + +var msg53 = msg("PITBOSS_Message5", all24); + +var select28 = linear_select([ + msg49, + msg50, + msg51, + msg52, + msg53, +]); + +var part82 = // "Pattern{Constant('"IMI: '), Field(event_description,true), Constant(' : nodeID('), Field(fld1,false), Constant(') IP('), Field(saddr,false), Constant(') instance('), Field(fld2,false), Constant(') Configuration Coordinator('), Field(fld3,false), Constant(') Nodeset('), Field(fld4,false), Constant(')"')}" +match("MESSAGE#50:ROUTING_Message", "nwparser.payload", "\"IMI: %{event_description->} : nodeID(%{fld1}) IP(%{saddr}) instance(%{fld2}) Configuration Coordinator(%{fld3}) Nodeset(%{fld4})\"", processor_chain([ + dup9, + dup4, +])); + +var msg54 = msg("ROUTING_Message", part82); + +var msg55 = msg("ROUTING_Message:01", dup113); + +var part83 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' started"')}" +match("MESSAGE#52:ROUTING_Message:02", "nwparser.payload", "\"%{fld1->} started\"", processor_chain([ + dup9, + dup4, +])); + +var msg56 = msg("ROUTING_Message:02", part83); + +var select29 = linear_select([ + msg54, + msg55, + msg56, +]); + +var part84 = // "Pattern{Field(obj_type,true), Constant(' Command "'), Field(action,false), Constant('" '), Field(info,false)}" +match("MESSAGE#53:ROUTING_ZEBOS_CMD_EXECUTED", "nwparser.payload", "%{obj_type->} Command \"%{action}\" %{info}", processor_chain([ + dup2, + setc("event_description","User has executed a command in ZebOS(vtysh)"), + dup3, + dup4, +])); + +var msg57 = msg("ROUTING_ZEBOS_CMD_EXECUTED", part84); + +var part85 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,false), Constant('entityName = "'), Field(p0,false)}" +match("MESSAGE#54:SNMP_TRAP_SENT7/0", "nwparser.payload", "%{obj_type->} ( %{space}entityName = \"%{p0}"); + +var part86 = // "Pattern{Field(obj_name,false), Constant('('), Field(info,false), Constant('...",'), Field(p0,false)}" +match("MESSAGE#54:SNMP_TRAP_SENT7/1_0", "nwparser.p0", "%{obj_name}(%{info}...\",%{p0}"); + +var part87 = // "Pattern{Field(obj_name,false), Constant('...",'), Field(p0,false)}" +match("MESSAGE#54:SNMP_TRAP_SENT7/1_1", "nwparser.p0", "%{obj_name}...\",%{p0}"); + +var select30 = linear_select([ + part86, + part87, +]); + +var part88 = // "Pattern{Field(,false), Constant('alarmEntityCurState = '), Field(event_state,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#54:SNMP_TRAP_SENT7/2", "nwparser.p0", "%{}alarmEntityCurState = %{event_state}, %{p0}"); + +var part89 = // "Pattern{Constant('svcServiceFullName.'), Field(fld2,true), Constant(' = "'), Field(service,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" +match("MESSAGE#54:SNMP_TRAP_SENT7/3_0", "nwparser.p0", "svcServiceFullName.%{fld2->} = \"%{service}\", nsPartitionName = %{fld4})"); + +var part90 = // "Pattern{Constant('vsvrFullName.'), Field(fld3,true), Constant(' = "'), Field(obj_server,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" +match("MESSAGE#54:SNMP_TRAP_SENT7/3_1", "nwparser.p0", "vsvrFullName.%{fld3->} = \"%{obj_server}\", nsPartitionName = %{fld4})"); + +var part91 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(fld6,true), Constant(' = "'), Field(fld7,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" +match("MESSAGE#54:SNMP_TRAP_SENT7/3_2", "nwparser.p0", "svcGrpMemberFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld4})"); + +var select31 = linear_select([ + part89, + part90, + part91, + dup46, +]); + +var all25 = all_match({ + processors: [ + part85, + select30, + part88, + select31, + ], + on_success: processor_chain([ + dup11, + dup47, + dup10, + dup4, + ]), +}); + +var msg58 = msg("SNMP_TRAP_SENT7", all25); + +var part92 = // "Pattern{Field(obj_type,true), Constant(' ( entityName = "'), Field(obj_name,false), Constant('...", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#55:SNMP_TRAP_SENT8", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name}...\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg59 = msg("SNMP_TRAP_SENT8", part92); + +var part93 = // "Pattern{Field(obj_type,true), Constant(' ( haNicsMonitorFailed = '), Field(obj_name,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#56:SNMP_TRAP_SENT9", "nwparser.payload", "%{obj_type->} ( haNicsMonitorFailed = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg60 = msg("SNMP_TRAP_SENT9", part93); + +var part94 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,false), Constant('haPeerSystemState = "'), Field(event_state,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#57:SNMP_TRAP_SENT10", "nwparser.payload", "%{obj_type->} ( %{space}haPeerSystemState = \"%{event_state}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg61 = msg("SNMP_TRAP_SENT10", part94); + +var part95 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthDiskName = "'), Field(obj_name,false), Constant('", sysHealthDiskPerusage = '), Field(fld2,false), Constant(', alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#58:SNMP_TRAP_SENT11", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{obj_name}\", sysHealthDiskPerusage = %{fld2}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg62 = msg("SNMP_TRAP_SENT11", part95); + +var part96 = // "Pattern{Field(obj_type,true), Constant(' ( vsvrName = "'), Field(dclass_counter1_string,false), Constant('", vsvrRequestRate = "'), Field(dclass_counter1,false), Constant('", alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', vsvrFullName = "'), Field(fld1,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#59:SNMP_TRAP_SENT12", "nwparser.payload", "%{obj_type->} ( vsvrName = \"%{dclass_counter1_string}\", vsvrRequestRate = \"%{dclass_counter1}\", alarmHighThreshold = %{dclass_counter2}, vsvrFullName = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg63 = msg("SNMP_TRAP_SENT12", part96); + +var part97 = // "Pattern{Field(obj_type,true), Constant(' ( monServiceName = "'), Field(fld1,false), Constant('", monitorName = "'), Field(dclass_counter1_string,false), Constant('", responseTimeoutThreshold = '), Field(dclass_counter1,false), Constant(', alarmMonrespto = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#60:SNMP_TRAP_SENT13", "nwparser.payload", "%{obj_type->} ( monServiceName = \"%{fld1}\", monitorName = \"%{dclass_counter1_string}\", responseTimeoutThreshold = %{dclass_counter1}, alarmMonrespto = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg64 = msg("SNMP_TRAP_SENT13", part97); + +var part98 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmNormalThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#61:SNMP_TRAP_SENT14", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg65 = msg("SNMP_TRAP_SENT14", part98); + +var part99 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmLowThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#62:SNMP_TRAP_SENT15", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmLowThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg66 = msg("SNMP_TRAP_SENT15", part99); + +var part100 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#63:SNMP_TRAP_SENT16", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg67 = msg("SNMP_TRAP_SENT16", part100); + +var part101 = // "Pattern{Field(obj_type,true), Constant(' ( alarmRateLmtThresholdExceeded = "'), Field(obj_name,false), Constant(': "'), Field(info,false), Constant('...", ipAddressGathered = "'), Field(fld1,false), Constant('", stringComputed = "'), Field(fld2,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#64:SNMP_TRAP_SENT17", "nwparser.payload", "%{obj_type->} ( alarmRateLmtThresholdExceeded = \"%{obj_name}: \"%{info}...\", ipAddressGathered = \"%{fld1}\", stringComputed = \"%{fld2}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg68 = msg("SNMP_TRAP_SENT17", part101); + +var part102 = // "Pattern{Field(obj_type,true), Constant(' ( entityName = "'), Field(obj_name,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#65:SNMP_TRAP_SENT/0", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name->} (%{p0}"); + +var part103 = // "Pattern{Field(info,false), Constant('..." '), Field(p0,false)}" +match("MESSAGE#65:SNMP_TRAP_SENT/1_0", "nwparser.p0", "%{info}...\" %{p0}"); + +var part104 = // "Pattern{Field(info,false), Constant('" '), Field(p0,false)}" +match("MESSAGE#65:SNMP_TRAP_SENT/1_1", "nwparser.p0", "%{info}\" %{p0}"); + +var select32 = linear_select([ + part103, + part104, +]); + +var part105 = // "Pattern{Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#65:SNMP_TRAP_SENT/2", "nwparser.p0", ", sysIpAddress = %{hostip})"); + +var all26 = all_match({ + processors: [ + part102, + select32, + part105, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg69 = msg("SNMP_TRAP_SENT", all26); + +var part106 = // "Pattern{Field(obj_type,true), Constant(' ( appfwLogMsg = '), Field(obj_name,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#66:SNMP_TRAP_SENT6", "nwparser.payload", "%{obj_type->} ( appfwLogMsg = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg70 = msg("SNMP_TRAP_SENT6", part106); + +var part107 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#67:SNMP_TRAP_SENT5/0", "nwparser.payload", "%{obj_type->} ( %{space->} %{p0}"); + +var part108 = // "Pattern{Constant('partition id = '), Field(fld12,false), Constant(', nsUserName = "'), Field(p0,false)}" +match("MESSAGE#67:SNMP_TRAP_SENT5/1_0", "nwparser.p0", "partition id = %{fld12}, nsUserName = \"%{p0}"); + +var part109 = // "Pattern{Constant('nsUserName = "'), Field(p0,false)}" +match("MESSAGE#67:SNMP_TRAP_SENT5/1_1", "nwparser.p0", "nsUserName = \"%{p0}"); + +var select33 = linear_select([ + part108, + part109, +]); + +var part110 = // "Pattern{Constant('",'), Field(username,true), Constant(' configurationCmd = "'), Field(action,false), Constant('", authorizationStatus = '), Field(event_state,false), Constant(', commandExecutionStatus = '), Field(disposition,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#67:SNMP_TRAP_SENT5/2", "nwparser.p0", "\",%{username->} configurationCmd = \"%{action}\", authorizationStatus = %{event_state}, commandExecutionStatus = %{disposition}, %{p0}"); + +var part111 = // "Pattern{Constant('commandFailureReason = "'), Field(result,false), Constant('", nsClientIPAddr = '), Field(saddr,false), Constant(', sysIpAddress ='), Field(hostip,false), Constant(')')}" +match("MESSAGE#67:SNMP_TRAP_SENT5/3_0", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip})"); + +var part112 = // "Pattern{Constant('commandFailureReason = "'), Field(result,false), Constant('", nsClientIPAddr = '), Field(saddr,false), Constant(', nsPartitionName = '), Field(fld1,false), Constant(')')}" +match("MESSAGE#67:SNMP_TRAP_SENT5/3_1", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); + +var part113 = // "Pattern{Constant('nsClientIPAddr = '), Field(saddr,false), Constant(', nsPartitionName = '), Field(fld1,false), Constant(')')}" +match("MESSAGE#67:SNMP_TRAP_SENT5/3_2", "nwparser.p0", "nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); + +var part114 = // "Pattern{Constant('nsClientIPAddr = '), Field(saddr,false), Constant(', sysIpAddress ='), Field(hostip,true), Constant(' )')}" +match("MESSAGE#67:SNMP_TRAP_SENT5/3_3", "nwparser.p0", "nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip->} )"); + +var part115 = // "Pattern{Constant('sysIpAddress ='), Field(hostip,false), Constant(')')}" +match("MESSAGE#67:SNMP_TRAP_SENT5/3_4", "nwparser.p0", "sysIpAddress =%{hostip})"); + +var select34 = linear_select([ + part111, + part112, + part113, + part114, + part115, +]); + +var all27 = all_match({ + processors: [ + part107, + select33, + part110, + select34, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg71 = msg("SNMP_TRAP_SENT5", all27); + +var part116 = // "Pattern{Field(obj_type,true), Constant(' ( nsUserName = "'), Field(username,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#68:SNMP_TRAP_SENT1", "nwparser.payload", "%{obj_type->} ( nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + setf("obj_name","username"), + dup10, + dup4, +])); + +var msg72 = msg("SNMP_TRAP_SENT1", part116); + +var part117 = // "Pattern{Field(obj_type,true), Constant(' ( nsCPUusage = '), Field(dclass_counter1,false), Constant(', alarm '), Field(trigger_val,true), Constant(' = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#69:SNMP_TRAP_SENT2", "nwparser.payload", "%{obj_type->} ( nsCPUusage = %{dclass_counter1}, alarm %{trigger_val->} = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg73 = msg("SNMP_TRAP_SENT2", part117); + +var part118 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthDiskName = "'), Field(filename,false), Constant('", sysHealthDiskPerusage = '), Field(dclass_counter1,false), Constant(', alarmNormalThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#70:SNMP_TRAP_SENT3", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{filename}\", sysHealthDiskPerusage = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg74 = msg("SNMP_TRAP_SENT3", part118); + +var part119 = // "Pattern{Field(obj_type,true), Constant(' ( sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#71:SNMP_TRAP_SENT4", "nwparser.payload", "%{obj_type->} ( sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg75 = msg("SNMP_TRAP_SENT4", part119); + +var part120 = // "Pattern{Field(obj_type,true), Constant(' (entityName = "'), Field(obj_name,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#72:SNMP_TRAP_SENT18", "nwparser.payload", "%{obj_type->} (entityName = \"%{obj_name}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg76 = msg("SNMP_TRAP_SENT18", part120); + +var part121 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,true), Constant(' nsUserName = "'), Field(username,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#73:SNMP_TRAP_SENT19", "nwparser.payload", "%{obj_type->} ( %{space->} nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg77 = msg("SNMP_TRAP_SENT19", part121); + +var part122 = // "Pattern{Field(obj_type,true), Constant(' (partition id = '), Field(fld12,false), Constant(', entityName = "'), Field(p0,false)}" +match("MESSAGE#74:SNMP_TRAP_SENT21/0", "nwparser.payload", "%{obj_type->} (partition id = %{fld12}, entityName = \"%{p0}"); + +var part123 = // "Pattern{Field(obj_name,false), Constant('('), Field(fld4,false), Constant('...", '), Field(p0,false)}" +match("MESSAGE#74:SNMP_TRAP_SENT21/1_0", "nwparser.p0", "%{obj_name}(%{fld4}...\", %{p0}"); + +var part124 = // "Pattern{Field(obj_name,false), Constant('...", '), Field(p0,false)}" +match("MESSAGE#74:SNMP_TRAP_SENT21/1_1", "nwparser.p0", "%{obj_name}...\", %{p0}"); + +var select35 = linear_select([ + part123, + part124, +]); + +var part125 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,true), Constant(' )')}" +match("MESSAGE#74:SNMP_TRAP_SENT21/2_0", "nwparser.p0", "svcGrpMemberFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); + +var part126 = // "Pattern{Constant('vsvrFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,true), Constant(' )')}" +match("MESSAGE#74:SNMP_TRAP_SENT21/2_1", "nwparser.p0", "vsvrFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); + +var part127 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,true), Constant(' )')}" +match("MESSAGE#74:SNMP_TRAP_SENT21/2_2", "nwparser.p0", "sysIpAddress = %{hostip->} )"); + +var select36 = linear_select([ + part125, + part126, + part127, +]); + +var all28 = all_match({ + processors: [ + part122, + select35, + select36, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg78 = msg("SNMP_TRAP_SENT21", all28); + +var part128 = // "Pattern{Field(obj_type,true), Constant(' (entityName = "'), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/0", "nwparser.payload", "%{obj_type->} (entityName = \"%{p0}"); + +var part129 = // "Pattern{Field(obj_name,false), Constant('..." '), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/1_0", "nwparser.p0", "%{obj_name}...\" %{p0}"); + +var part130 = // "Pattern{Field(obj_name,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/1_1", "nwparser.p0", "%{obj_name}\"%{p0}"); + +var select37 = linear_select([ + part129, + part130, +]); + +var part131 = // "Pattern{Constant(', '), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/2", "nwparser.p0", ", %{p0}"); + +var part132 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/3_0", "nwparser.p0", "svcGrpMemberFullName.%{p0}"); + +var part133 = // "Pattern{Constant('vsvrFullName.'), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/3_1", "nwparser.p0", "vsvrFullName.%{p0}"); + +var part134 = // "Pattern{Constant('svcServiceFullName.'), Field(p0,false)}" +match("MESSAGE#75:SNMP_TRAP_SENT22/3_2", "nwparser.p0", "svcServiceFullName.%{p0}"); + +var select38 = linear_select([ + part132, + part133, + part134, +]); + +var part135 = // "Pattern{Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", nsPartitionName = '), Field(fld1,false), Constant(')')}" +match("MESSAGE#75:SNMP_TRAP_SENT22/4", "nwparser.p0", "%{fld2->} = \"%{fld3}\", nsPartitionName = %{fld1})"); + +var all29 = all_match({ + processors: [ + part128, + select37, + part131, + select38, + part135, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg79 = msg("SNMP_TRAP_SENT22", all29); + +var part136 = // "Pattern{Field(obj_type,true), Constant(' (platformRateLimitPacketDropCount = '), Field(dclass_counter1,false), Constant(', platformLicensedThroughput = '), Field(fld2,false), Constant(', nsPartitionName = '), Field(fld3,false), Constant(')')}" +match("MESSAGE#76:SNMP_TRAP_SENT23", "nwparser.payload", "%{obj_type->} (platformRateLimitPacketDropCount = %{dclass_counter1}, platformLicensedThroughput = %{fld2}, nsPartitionName = %{fld3})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg80 = msg("SNMP_TRAP_SENT23", part136); + +var part137 = // "Pattern{Field(obj_type,true), Constant(' (vsvrName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", vsvrCurSoValue = '), Field(fld4,false), Constant(', vsvrSoMethod = "'), Field(fld5,false), Constant('", vsvrSoThresh = "'), Field(info,false), Constant('", vsvrFullName.'), Field(fld6,true), Constant(' = "'), Field(fld7,false), Constant('", nsPartitionName = '), Field(fld8,false), Constant(')')}" +match("MESSAGE#77:SNMP_TRAP_SENT24", "nwparser.payload", "%{obj_type->} (vsvrName.%{fld2->} = \"%{fld3}\", vsvrCurSoValue = %{fld4}, vsvrSoMethod = \"%{fld5}\", vsvrSoThresh = \"%{info}\", vsvrFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld8})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg81 = msg("SNMP_TRAP_SENT24", part137); + +var part138 = // "Pattern{Field(obj_type,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#78:SNMP_TRAP_SENT25/0", "nwparser.payload", "%{obj_type->} (%{p0}"); + +var part139 = // "Pattern{Constant('partition id = '), Field(fld12,false), Constant(', sslCertKeyName.'), Field(p0,false)}" +match("MESSAGE#78:SNMP_TRAP_SENT25/1_0", "nwparser.p0", "partition id = %{fld12}, sslCertKeyName.%{p0}"); + +var part140 = // "Pattern{Constant(' sslCertKeyName.'), Field(p0,false)}" +match("MESSAGE#78:SNMP_TRAP_SENT25/1_1", "nwparser.p0", " sslCertKeyName.%{p0}"); + +var select39 = linear_select([ + part139, + part140, +]); + +var part141 = // "Pattern{Constant('",'), Field(fld2,true), Constant(' = "'), Field(fld1,true), Constant(' sslDaysToExpire.'), Field(fld3,true), Constant(' = '), Field(dclass_counter1,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#78:SNMP_TRAP_SENT25/2", "nwparser.p0", "\",%{fld2->} = \"%{fld1->} sslDaysToExpire.%{fld3->} = %{dclass_counter1}, %{p0}"); + +var part142 = // "Pattern{Constant('nsPartitionName = '), Field(fld4,false), Constant(')')}" +match("MESSAGE#78:SNMP_TRAP_SENT25/3_0", "nwparser.p0", "nsPartitionName = %{fld4})"); + +var select40 = linear_select([ + part142, + dup46, +]); + +var all30 = all_match({ + processors: [ + part138, + select39, + part141, + select40, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg82 = msg("SNMP_TRAP_SENT25", all30); + +var part143 = // "Pattern{Field(obj_type,true), Constant(' (nsUserName = "'), Field(username,false), Constant('", nsPartitionName = '), Field(fld1,false), Constant(')')}" +match("MESSAGE#79:SNMP_TRAP_SENT26", "nwparser.payload", "%{obj_type->} (nsUserName = \"%{username}\", nsPartitionName = %{fld1})", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg83 = msg("SNMP_TRAP_SENT26", part143); + +var part144 = // "Pattern{Field(info,true), Constant(' (sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#80:SNMP_TRAP_SENT20", "nwparser.payload", "%{info->} (sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg84 = msg("SNMP_TRAP_SENT20", part144); + +var part145 = // "Pattern{Field(obj_type,false), Constant('(lldpRemLocalPortNum.'), Field(fld1,false), Constant('= "'), Field(fld5,false), Constant('", lldpRemChassisId.'), Field(fld2,false), Constant('= "'), Field(dmacaddr,false), Constant('", lldpRemPortId.'), Field(fld3,false), Constant('= "'), Field(dinterface,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" +match("MESSAGE#81:SNMP_TRAP_SENT28", "nwparser.payload", "%{obj_type}(lldpRemLocalPortNum.%{fld1}= \"%{fld5}\", lldpRemChassisId.%{fld2}= \"%{dmacaddr}\", lldpRemPortId.%{fld3}= \"%{dinterface}\", sysIpAddress =%{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg85 = msg("SNMP_TRAP_SENT28", part145); + +var part146 = // "Pattern{Field(obj_type,false), Constant('(haNicMonitorSucceeded = "'), Field(fld1,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" +match("MESSAGE#82:SNMP_TRAP_SENT29", "nwparser.payload", "%{obj_type}(haNicMonitorSucceeded = \"%{fld1}\", sysIpAddress =%{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg86 = msg("SNMP_TRAP_SENT29", part146); + +var part147 = // "Pattern{Field(fld1,false), Constant(':StatusPoll:'), Field(fld2,true), Constant(' - Device State changed to '), Field(disposition,true), Constant(' for '), Field(saddr,false)}" +match("MESSAGE#83:SNMP_TRAP_SENT:04", "nwparser.payload", "%{fld1}:StatusPoll:%{fld2->} - Device State changed to %{disposition->} for %{saddr}", processor_chain([ + dup9, + dup4, + setc("event_description","Device State changed"), +])); + +var msg87 = msg("SNMP_TRAP_SENT:04", part147); + +var msg88 = msg("SNMP_TRAP_SENT:05", dup101); + +var part148 = // "Pattern{Field(obj_type,true), Constant(' (appfwLogMsg = "'), Field(obj_name,true), Constant(' '), Field(info,false), Constant('",'), Field(p0,false)}" +match("MESSAGE#136:SNMP_TRAP_SENT:01/0", "nwparser.payload", "%{obj_type->} (appfwLogMsg = \"%{obj_name->} %{info}\",%{p0}"); + +var part149 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false)}" +match("MESSAGE#136:SNMP_TRAP_SENT:01/1_0", "nwparser.p0", "sysIpAddress = %{hostip}"); + +var part150 = // "Pattern{Constant('nsPartitionName ='), Field(fld1,false)}" +match("MESSAGE#136:SNMP_TRAP_SENT:01/1_1", "nwparser.p0", "nsPartitionName =%{fld1}"); + +var select41 = linear_select([ + part149, + part150, +]); + +var all31 = all_match({ + processors: [ + part148, + select41, + ], + on_success: processor_chain([ + dup9, + dup47, + dup10, + dup4, + ]), +}); + +var msg89 = msg("SNMP_TRAP_SENT:01", all31); + +var part151 = // "Pattern{Field(obj_type,true), Constant(' (haNicsMonitorFailed = "'), Field(fld1,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#143:SNMP_TRAP_SENT:02", "nwparser.payload", "%{obj_type->} (haNicsMonitorFailed = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg90 = msg("SNMP_TRAP_SENT:02", part151); + +var part152 = // "Pattern{Field(obj_type,true), Constant(' (partition id = '), Field(fld1,false), Constant(', entityName = "'), Field(obj_name,false), Constant('('), Field(fld31,false), Constant('", svcServiceFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#178:SNMP_TRAP_SENT27", "nwparser.payload", "%{obj_type->} (partition id = %{fld1}, entityName = \"%{obj_name}(%{fld31}\", svcServiceFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip})", processor_chain([ + dup9, + dup47, + dup10, + dup4, +])); + +var msg91 = msg("SNMP_TRAP_SENT27", part152); + +var part153 = // "Pattern{Field(obj_type,false), Constant('(sysHealthCounterName.PowerSupply1Status = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue.PowerSupply1Status = '), Field(dclass_counter1,false), Constant(', sysHealthPowerSupplyStatus = "'), Field(result,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" +match("MESSAGE#179:SNMP_TRAP_SENT:03", "nwparser.payload", "%{obj_type}(sysHealthCounterName.PowerSupply1Status = \"%{dclass_counter1_string}\", sysHealthCounterValue.PowerSupply1Status = %{dclass_counter1}, sysHealthPowerSupplyStatus = \"%{result}\", sysIpAddress =%{hostip})", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg92 = msg("SNMP_TRAP_SENT:03", part153); + +var select42 = linear_select([ + msg58, + msg59, + msg60, + msg61, + msg62, + msg63, + msg64, + msg65, + msg66, + msg67, + msg68, + msg69, + msg70, + msg71, + msg72, + msg73, + msg74, + msg75, + msg76, + msg77, + msg78, + msg79, + msg80, + msg81, + msg82, + msg83, + msg84, + msg85, + msg86, + msg87, + msg88, + msg89, + msg90, + msg91, + msg92, +]); + +var part154 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Client IP '), Field(hostip,true), Constant(' - Vserver '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Client_security_expression "CLIENT.REG(''), Field(info,false), Constant('').VALUE == '), Field(trigger_val,true), Constant(' || '), Field(change_new,true), Constant(' - '), Field(result,false)}" +match("MESSAGE#85:SSLVPN_CLISEC_CHECK", "nwparser.payload", "User %{username->} - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client_security_expression \"CLIENT.REG('%{info}').VALUE == %{trigger_val->} || %{change_new->} - %{result}", processor_chain([ + dup9, + dup47, + dup4, +])); + +var msg93 = msg("SSLVPN_CLISEC_CHECK", part154); + +var part155 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - ClientIP '), Field(p0,false)}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_1", "nwparser.p0", "SPCBId %{sessionid->} - ClientIP %{p0}"); + +var select43 = linear_select([ + dup49, + part155, +]); + +var part156 = // "Pattern{Field(,true), Constant(' '), Field(saddr,false), Constant('- ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - Reason "'), Field(result,false), Constant('"')}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/2", "nwparser.p0", "%{} %{saddr}- ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Reason \"%{result}\""); + +var all32 = all_match({ + processors: [ + dup48, + select43, + part156, + ], + on_success: processor_chain([ + dup11, + dup40, + dup8, + setc("event_description","SSL Handshake failed"), + dup41, + dup4, + ]), +}); + +var msg94 = msg("SSLLOG_SSL_HANDSHAKE_FAILURE", all32); + +var part157 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' ClientIP '), Field(p0,false)}" +match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/1_0", "nwparser.p0", "SPCBId %{sessionid->} ClientIP %{p0}"); + +var select44 = linear_select([ + part157, + dup49, +]); + +var part158 = // "Pattern{Constant(''), Field(saddr,true), Constant(' - ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - Session '), Field(info,false)}" +match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/2", "nwparser.p0", "%{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Session %{info}"); + +var all33 = all_match({ + processors: [ + dup48, + select44, + part158, + ], + on_success: processor_chain([ + dup2, + dup40, + setc("ec_outcome","Success"), + setc("event_description","SSL Handshake succeeded"), + dup41, + dup4, + ]), +}); + +var msg95 = msg("SSLLOG_SSL_HANDSHAKE_SUCCESS", all33); + +var part159 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - SubjectName "'), Field(cert_subject,false), Constant('"')}" +match("MESSAGE#88:SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", "nwparser.payload", "SPCBId %{sessionid->} - SubjectName \"%{cert_subject}\"", processor_chain([ + dup9, + dup41, + dup50, +])); + +var msg96 = msg("SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", part159); + +var part160 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - IssuerName "'), Field(fld1,false), Constant('"')}" +match("MESSAGE#89:SSLLOG_SSL_HANDSHAKE_ISSUERNAME", "nwparser.payload", "SPCBId %{sessionid->} - IssuerName \"%{fld1}\"", processor_chain([ + dup9, + dup41, + dup50, +])); + +var msg97 = msg("SSLLOG_SSL_HANDSHAKE_ISSUERNAME", part160); + +var part161 = // "Pattern{Constant('Extracted_groups "'), Field(group,false), Constant('"')}" +match("MESSAGE#90:SSLVPN_AAAEXTRACTED_GROUPS", "nwparser.payload", "Extracted_groups \"%{group}\"", processor_chain([ + dup2, + setc("event_description","The groups extracted after user logs into SSLVPN"), + dup3, + dup4, +])); + +var msg98 = msg("SSLVPN_AAAEXTRACTED_GROUPS", part161); + +var part162 = // "Pattern{Constant('User '), Field(username,true), Constant(' : - Client IP '), Field(hostip,true), Constant(' - Vserver '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Client security expression CLIENT.REG(''), Field(info,false), Constant('') '), Field(p0,false)}" +match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/0", "nwparser.payload", "User %{username->} : - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client security expression CLIENT.REG('%{info}') %{p0}"); + +var part163 = // "Pattern{Constant('EXISTS '), Field(p0,false)}" +match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_0", "nwparser.p0", "EXISTS %{p0}"); + +var part164 = // "Pattern{Constant('.VALUE == '), Field(trigger_val,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_1", "nwparser.p0", ".VALUE == %{trigger_val->} %{p0}"); + +var select45 = linear_select([ + part163, + part164, +]); + +var part165 = // "Pattern{Constant('evaluated to '), Field(change_new,false), Constant('('), Field(ntype,false), Constant(')')}" +match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/2", "nwparser.p0", "evaluated to %{change_new}(%{ntype})"); + +var all34 = all_match({ + processors: [ + part162, + select45, + part165, + ], + on_success: processor_chain([ + dup2, + setc("event_description","SSLVPN session Client Security expression EXISTS and evaluated"), + dup3, + dup4, + ]), +}); + +var msg99 = msg("SSLVPN_CLISEC_EXP_EVAL", all34); + +var part166 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - %{p0}"); + +var part167 = // "Pattern{Constant('SessionId: '), Field(sessionid,true), Constant(' User '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_0", "nwparser.p0", "SessionId: %{sessionid->} User %{p0}"); + +var part168 = // "Pattern{Field(fld5,true), Constant(' User '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_1", "nwparser.p0", "%{fld5->} User %{p0}"); + +var select46 = linear_select([ + part167, + part168, +]); + +var part169 = // "Pattern{Field(username,true), Constant(' : Group(s) '), Field(group,true), Constant(' : '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/2", "nwparser.p0", "%{username->} : Group(s) %{group->} : %{p0}"); + +var part170 = // "Pattern{Constant('Vserver '), Field(hostip,true), Constant(' - '), Field(fld6,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_0", "nwparser.p0", "Vserver %{hostip->} - %{fld6->} %{p0}"); + +var part171 = // "Pattern{Constant('- '), Field(fld7,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_1", "nwparser.p0", "- %{fld7->} %{p0}"); + +var select47 = linear_select([ + part170, + part171, +]); + +var part172 = // "Pattern{Constant('GMT '), Field(web_method,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_0", "nwparser.p0", "GMT %{web_method->} %{p0}"); + +var part173 = // "Pattern{Field(web_method,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_1", "nwparser.p0", "%{web_method->} %{p0}"); + +var select48 = linear_select([ + part172, + part173, +]); + +var part174 = // "Pattern{Field(url,true), Constant(' '), Field(fld8,false)}" +match("MESSAGE#92:SSLVPN_HTTPREQUEST/5", "nwparser.p0", "%{url->} %{fld8}"); + +var all35 = all_match({ + processors: [ + part166, + select46, + part169, + select47, + select48, + part174, + ], + on_success: processor_chain([ + dup2, + dup51, + setc("event_description","SSLVPN session receives a HTTP request"), + dup3, + dup4, + ]), +}); + +var msg100 = msg("SSLVPN_HTTPREQUEST", all35); + +var part175 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); + +var part176 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2}"); + +var all36 = all_match({ + processors: [ + part175, + dup102, + dup103, + part176, + ], + on_success: processor_chain([ + dup9, + dup58, + dup59, + dup60, + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg101 = msg("SSLVPN_ICAEND_CONNSTAT", all36); + +var part177 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - username:domainname '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - startTime '), Field(p0,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - startTime %{p0}"); + +var part178 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - endTime '), Field(p0,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - endTime %{p0}"); + +var part179 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - endTime '), Field(p0,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_1", "nwparser.p0", "\" %{fld10}\" - endTime %{p0}"); + +var part180 = // "Pattern{Field(fld10,true), Constant(' - endTime '), Field(p0,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_2", "nwparser.p0", "%{fld10->} - endTime %{p0}"); + +var select49 = linear_select([ + part178, + part179, + part180, +]); + +var part181 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} %{p0}"); + +var part182 = // "Pattern{Constant('- connectionId '), Field(connectionid,false)}" +match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_0", "nwparser.p0", "- connectionId %{connectionid}"); + +var part183 = // "Pattern{Field(fld2,false)}" +match_copy("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_1", "nwparser.p0", "fld2"); + +var select50 = linear_select([ + part182, + part183, +]); + +var all37 = all_match({ + processors: [ + part177, + select49, + dup103, + part181, + select50, + ], + on_success: processor_chain([ + dup9, + dup58, + dup59, + dup60, + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg102 = msg("SSLVPN_ICAEND_CONNSTAT:01", all37); + +var select51 = linear_select([ + msg101, + msg102, +]); + +var part184 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Browser_type '), Field(fld2,true), Constant(' - SSLVPN_client_type '), Field(info,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#94:SSLVPN_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{fld2->} - SSLVPN_client_type %{info->} - Group(s) \"%{group}\""); + +var all38 = all_match({ + processors: [ + dup48, + dup104, + dup66, + dup105, + part184, + ], + on_success: processor_chain([ + dup69, + dup6, + dup7, + setc("event_description","SSLVPN login succeeds"), + dup3, + dup4, + ]), +}); + +var msg103 = msg("SSLVPN_LOGIN", all38); + +var part185 = // "Pattern{Field(duration_string,true), Constant(' - Http_resources_accessed '), Field(fld3,true), Constant(' - NonHttp_services_accessed '), Field(fld4,true), Constant(' - Total_TCP_connections '), Field(fld5,true), Constant(' - Total_UDP_flows '), Field(fld6,true), Constant(' - Total_policies_allowed '), Field(fld7,true), Constant(' - Total_policies_denied '), Field(fld8,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - LogoutMethod "'), Field(result,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#95:SSLVPN_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - NonHttp_services_accessed %{fld4->} - Total_TCP_connections %{fld5->} - Total_UDP_flows %{fld6->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); + +var all39 = all_match({ + processors: [ + dup48, + dup104, + dup66, + dup105, + dup70, + dup102, + dup103, + part185, + ], + on_success: processor_chain([ + dup71, + dup72, + dup7, + setc("event_description","SSLVPN session logs out"), + dup59, + dup60, + setc("event_description"," Default Event"), + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg104 = msg("SSLVPN_LOGOUT", all39); + +var part186 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Last_contact '), Field(fld2,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#96:SSLVPN_TCPCONN_TIMEDOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Last_contact %{fld2->} - Group(s) \"%{group}\""); + +var all40 = all_match({ + processors: [ + dup48, + dup104, + dup66, + dup105, + part186, + ], + on_success: processor_chain([ + setc("eventcategory","1801030100"), + dup72, + dup7, + setc("event_description","SSLVPN TCP Connection Timed Out"), + dup3, + dup4, + ]), +}); + +var msg105 = msg("SSLVPN_TCPCONN_TIMEDOUT", all40); + +var part187 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" +match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); + +var part188 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Access '), Field(disposition,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Access %{disposition->} - Group(s) \"%{group}\""); + +var all41 = all_match({ + processors: [ + dup73, + dup105, + part187, + dup102, + dup103, + part188, + ], + on_success: processor_chain([ + dup69, + setc("event_description","SSLVPN UDP Flow Statistics"), + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg106 = msg("SSLVPN_UDPFLOWSTAT", all41); + +var part189 = // "Pattern{Constant('Server port = '), Field(dport,true), Constant(' - Server server ip = '), Field(daddr,true), Constant(' - username:domain_name = '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - application name = '), Field(application,false)}" +match("MESSAGE#98:SSLVPN_ICASTART", "nwparser.payload", "Server port = %{dport->} - Server server ip = %{daddr->} - username:domain_name = %{username}:%{ddomain->} - application name = %{application}", processor_chain([ + dup69, + setc("event_description","ICA started"), + dup3, + dup4, +])); + +var msg107 = msg("SSLVPN_ICASTART", part189); + +var part190 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - username:domainname '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - applicationName '), Field(application,true), Constant(' - startTime '), Field(p0,false)}" +match("MESSAGE#99:SSLVPN_ICASTART:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - applicationName %{application->} - startTime %{p0}"); + +var part191 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - connectionId '), Field(p0,false)}" +match("MESSAGE#99:SSLVPN_ICASTART:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - connectionId %{p0}"); + +var part192 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - connectionId '), Field(p0,false)}" +match("MESSAGE#99:SSLVPN_ICASTART:01/1_1", "nwparser.p0", "\" %{fld10}\" - connectionId %{p0}"); + +var part193 = // "Pattern{Field(fld10,true), Constant(' - connectionId '), Field(p0,false)}" +match("MESSAGE#99:SSLVPN_ICASTART:01/1_2", "nwparser.p0", "%{fld10->} - connectionId %{p0}"); + +var select52 = linear_select([ + part191, + part192, + part193, +]); + +var part194 = // "Pattern{Field(fld5,false)}" +match_copy("MESSAGE#99:SSLVPN_ICASTART:01/2", "nwparser.p0", "fld5"); + +var all42 = all_match({ + processors: [ + part190, + select52, + part194, + ], + on_success: processor_chain([ + dup9, + dup62, + dup4, + ]), +}); + +var msg108 = msg("SSLVPN_ICASTART:01", all42); + +var select53 = linear_select([ + msg107, + msg108, +]); + +var part195 = // "Pattern{Field(action,false), Constant(': '), Field(fld1,true), Constant(' "')}" +match("MESSAGE#100:SSLVPN_Message/1_0", "nwparser.p0", "%{action}: %{fld1->} \""); + +var part196 = // "Pattern{Field(action,true), Constant(' '), Field(fld1,false), Constant('"')}" +match("MESSAGE#100:SSLVPN_Message/1_1", "nwparser.p0", "%{action->} %{fld1}\""); + +var part197 = // "Pattern{Field(action,false), Constant(': '), Field(fld1,false)}" +match("MESSAGE#100:SSLVPN_Message/1_2", "nwparser.p0", "%{action}: %{fld1}"); + +var select54 = linear_select([ + part195, + part196, + part197, +]); + +var all43 = all_match({ + processors: [ + dup74, + select54, + ], + on_success: processor_chain([ + dup2, + setc("event_description","Message"), + dup10, + dup4, + ]), +}); + +var msg109 = msg("SSLVPN_Message", all43); + +var part198 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(stransaddr,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" +match("MESSAGE#101:SSLVPN_TCPCONNSTAT/2", "nwparser.p0", "%{} %{username}- Client_ip %{hostip->} - Nat_ip %{stransaddr->} - Vserver %{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); + +var part199 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - Access '), Field(disposition,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#101:SSLVPN_TCPCONNSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - Access %{disposition->} - Group(s) \"%{group}\""); + +var all44 = all_match({ + processors: [ + dup48, + dup104, + part198, + dup102, + dup103, + part199, + ], + on_success: processor_chain([ + dup9, + setc("event_description","TCP connection related information for a connection belonging to a SSLVPN session"), + dup59, + dup60, + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg110 = msg("SSLVPN_TCPCONNSTAT", all44); + +var all45 = all_match({ + processors: [ + dup75, + dup106, + dup78, + ], + on_success: processor_chain([ + dup2, + dup40, + dup30, + dup79, + dup3, + dup61, + dup4, + ]), +}); + +var msg111 = msg("TCP_CONN_DELINK", all45); + +var all46 = all_match({ + processors: [ + dup80, + dup107, + dup106, + dup78, + ], + on_success: processor_chain([ + dup2, + dup40, + dup28, + dup83, + dup3, + dup61, + dup62, + dup4, + ]), +}); + +var msg112 = msg("TCP_CONN_TERMINATE", all46); + +var part200 = // "Pattern{Constant('Source '), Field(saddr,false), Constant('Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" +match("MESSAGE#140:TCP_CONN_TERMINATE:01", "nwparser.payload", "Source %{saddr}Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes}", processor_chain([ + dup2, + dup40, + dup28, + dup83, + dup3, + dup4, +])); + +var msg113 = msg("TCP_CONN_TERMINATE:01", part200); + +var select55 = linear_select([ + msg112, + msg113, +]); + +var part201 = // "Pattern{Field(fld11,true), Constant(' GMT Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT Total_bytes_send %{p0}"); + +var part202 = // "Pattern{Field(fld11,true), Constant(' Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld11->} Total_bytes_send %{p0}"); + +var select56 = linear_select([ + part201, + part202, +]); + +var all47 = all_match({ + processors: [ + dup75, + select56, + dup78, + ], + on_success: processor_chain([ + dup2, + dup40, + dup30, + setc("event_description","A Server side and a Client side TCP connection is delinked. This is not tracked by Netscaler"), + dup3, + dup61, + dup4, + ]), +}); + +var msg114 = msg("TCP_OTHERCONN_DELINK", all47); + +var part203 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start Time '), Field(p0,false)}" +match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Start Time %{p0}"); + +var part204 = // "Pattern{Field(fld10,true), Constant(' GMT - Delink Time '), Field(p0,false)}" +match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld10->} GMT - Delink Time %{p0}"); + +var part205 = // "Pattern{Field(fld10,true), Constant(' - Delink Time '), Field(p0,false)}" +match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld10->} - Delink Time %{p0}"); + +var select57 = linear_select([ + part204, + part205, +]); + +var part206 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - '), Field(info,false)}" +match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/3", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes->} - %{info}"); + +var all48 = all_match({ + processors: [ + part203, + select57, + dup106, + part206, + ], + on_success: processor_chain([ + dup2, + dup40, + setc("event_description","A server side and a client side TCP connection for RNAT are delinked"), + dup3, + dup61, + dup4, + dup62, + ]), +}); + +var msg115 = msg("TCP_NAT_OTHERCONN_DELINK", all48); + +var part207 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" +match("MESSAGE#106:UI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ + dup69, + dup84, + dup3, + dup4, + dup85, + dup6, + dup86, +])); + +var msg116 = msg("UI_CMD_EXECUTED:Login", part207); + +var part208 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "ERROR:'), Field(info,false), Constant('"')}" +match("MESSAGE#107:UI_CMD_EXECUTED:LoginFail", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"ERROR:%{info}\"", processor_chain([ + dup5, + dup84, + dup3, + dup4, + setc("disposition","Error"), + dup6, + dup86, +])); + +var msg117 = msg("UI_CMD_EXECUTED:LoginFail", part208); + +var part209 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" +match("MESSAGE#108:UI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ + dup71, + dup84, + dup3, + dup4, + dup85, + dup72, + dup87, +])); + +var msg118 = msg("UI_CMD_EXECUTED:Logout", part209); + +var msg119 = msg("UI_CMD_EXECUTED", dup108); + +var part210 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('"')}" +match("MESSAGE#144:UI_CMD_EXECUTED:01_Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\"", processor_chain([ + dup69, + dup84, + dup3, + dup4, + dup6, + dup86, +])); + +var msg120 = msg("UI_CMD_EXECUTED:01_Login", part210); + +var part211 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('"')}" +match("MESSAGE#145:UI_CMD_EXECUTED:01_Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\"", processor_chain([ + dup71, + dup84, + dup3, + dup4, + dup72, + dup87, +])); + +var msg121 = msg("UI_CMD_EXECUTED:01_Logout", part211); + +var part212 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('"')}" +match("MESSAGE#146:UI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\"", processor_chain([ + dup88, + dup89, + dup3, + dup4, +])); + +var msg122 = msg("UI_CMD_EXECUTED:01", part212); + +var select58 = linear_select([ + msg116, + msg117, + msg118, + msg119, + msg120, + msg121, + msg122, +]); + +var part213 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Total_bytes_send '), Field(comp_sbytes,true), Constant(' - Total_bytes_recv '), Field(comp_rbytes,true), Constant(' - Denied_by_policy "'), Field(fld2,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#110:SSLVPN_NONHTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Total_bytes_send %{comp_sbytes->} - Total_bytes_recv %{comp_rbytes->} - Denied_by_policy \"%{fld2}\" - Group(s) \"%{group}\""); + +var all49 = all_match({ + processors: [ + dup73, + dup105, + part213, + ], + on_success: processor_chain([ + dup11, + dup51, + dup8, + dup4, + ]), +}); + +var msg123 = msg("SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", all49); + +var part214 = // "Pattern{Field(fld1,true), Constant(' - State Init')}" +match("MESSAGE#111:EVENT_VRIDINIT", "nwparser.payload", "%{fld1->} - State Init", processor_chain([ + dup9, + dup4, +])); + +var msg124 = msg("EVENT_VRIDINIT", part214); + +var part215 = // "Pattern{Constant('"REC: status '), Field(info,true), Constant(' from client '), Field(fld1,true), Constant(' for ID '), Field(id,false), Constant('"')}" +match("MESSAGE#112:CLUSTERD_Message:01", "nwparser.payload", "\"REC: status %{info->} from client %{fld1->} for ID %{id}\"", processor_chain([ + dup9, + dup4, +])); + +var msg125 = msg("CLUSTERD_Message:01", part215); + +var part216 = // "Pattern{Field(info,false), Constant('('), Field(saddr,false), Constant(') port('), Field(sport,false), Constant(') msglen('), Field(fld1,false), Constant(') rcv('), Field(packets,false), Constant(') R('), Field(result,false), Constant(') " ')}" +match("MESSAGE#113:CLUSTERD_Message:02/1_0", "nwparser.p0", "%{info}(%{saddr}) port(%{sport}) msglen(%{fld1}) rcv(%{packets}) R(%{result}) \" "); + +var select59 = linear_select([ + part216, + dup90, +]); + +var all50 = all_match({ + processors: [ + dup74, + select59, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var msg126 = msg("CLUSTERD_Message:02", all50); + +var select60 = linear_select([ + msg125, + msg126, +]); + +var part217 = // "Pattern{Constant('"crypto: driver '), Field(fld1,true), Constant(' registers alg '), Field(fld2,true), Constant(' flags '), Field(fld3,true), Constant(' maxoplen '), Field(fld4,true), Constant(' "')}" +match("MESSAGE#114:IPSEC_Message/0_0", "nwparser.payload", "\"crypto: driver %{fld1->} registers alg %{fld2->} flags %{fld3->} maxoplen %{fld4->} \""); + +var part218 = // "Pattern{Constant(' "'), Field(info,true), Constant(' "')}" +match("MESSAGE#114:IPSEC_Message/0_1", "nwparser.payload", " \"%{info->} \""); + +var select61 = linear_select([ + part217, + part218, +]); + +var all51 = all_match({ + processors: [ + select61, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var msg127 = msg("IPSEC_Message", all51); + +var part219 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(info,true), Constant(' "')}" +match("MESSAGE#115:NSNETSVC_Message", "nwparser.payload", "\"%{event_type}: %{info->} \"", processor_chain([ + dup9, + dup4, +])); + +var msg128 = msg("NSNETSVC_Message", part219); + +var part220 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Remote_host '), Field(hostname,true), Constant(' - Denied_url '), Field(url,true), Constant(' - Denied_by_policy '), Field(policyname,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#116:SSLVPN_HTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{} %{username}- Vserver %{daddr}:%{dport->} - Total_bytes_send %{sbytes->} - Remote_host %{hostname->} - Denied_url %{url->} - Denied_by_policy %{policyname->} - Group(s) \"%{group}\""); + +var all52 = all_match({ + processors: [ + dup48, + dup104, + part220, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var msg129 = msg("SSLVPN_HTTP_RESOURCEACCESS_DENIED", all52); + +var part221 = // "Pattern{Constant('Client '), Field(saddr,true), Constant(' - Profile '), Field(p0,false)}" +match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/0", "nwparser.payload", "Client %{saddr->} - Profile %{p0}"); + +var part222 = // "Pattern{Field(info,false), Constant(', '), Field(event_description,true), Constant(' - URL')}" +match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_0", "nwparser.p0", "%{info}, %{event_description->} - URL"); + +var part223 = // "Pattern{Field(info,true), Constant(' - '), Field(event_description,true), Constant(' - URL')}" +match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_1", "nwparser.p0", "%{info->} - %{event_description->} - URL"); + +var select62 = linear_select([ + part222, + part223, +]); + +var all53 = all_match({ + processors: [ + part221, + select62, + ], + on_success: processor_chain([ + dup2, + dup4, + ]), +}); + +var msg130 = msg("NSNETSVC_REQ_PARSE_ERROR", all53); + +var part224 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(fld11,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#118:Source:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{fld11->} %{p0}"); + +var part225 = // "Pattern{Constant('GMT - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" +match("MESSAGE#118:Source:01/1_0", "nwparser.p0", "GMT - Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); + +var part226 = // "Pattern{Constant('- Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" +match("MESSAGE#118:Source:01/1_1", "nwparser.p0", "- Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); + +var part227 = // "Pattern{Constant('GMT Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" +match("MESSAGE#118:Source:01/1_2", "nwparser.p0", "GMT Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); + +var part228 = // "Pattern{Constant('Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" +match("MESSAGE#118:Source:01/1_3", "nwparser.p0", "Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); + +var select63 = linear_select([ + part225, + part226, + part227, + part228, +]); + +var part229 = // "Pattern{Field(rbytes,false)}" +match_copy("MESSAGE#118:Source:01/2", "nwparser.p0", "rbytes"); + +var all54 = all_match({ + processors: [ + part224, + select63, + part229, + ], + on_success: processor_chain([ + dup2, + dup79, + ]), +}); + +var msg131 = msg("Source:01", all54); + +var all55 = all_match({ + processors: [ + dup80, + dup107, + dup106, + dup78, + ], + on_success: processor_chain([ + dup2, + dup61, + dup62, + ]), +}); + +var msg132 = msg("Source:02", all55); + +var select64 = linear_select([ + msg131, + msg132, +]); + +var part230 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(fld1,false), Constant('" - Status "'), Field(result,false), Constant('"')}" +match("MESSAGE#120:User", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{fld1}\" - Status \"%{result}\"", processor_chain([ + dup2, +])); + +var msg133 = msg("User", part230); + +var part231 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - ClientIP '), Field(saddr,true), Constant(' - ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - '), Field(result,false)}" +match("MESSAGE#121:SPCBId", "nwparser.payload", "SPCBId %{sessionid->} - ClientIP %{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - %{result}", processor_chain([ + dup11, + dup40, + dup8, + dup41, +])); + +var msg134 = msg("SPCBId", part231); + +var msg135 = msg("APPFW_COOKIE", dup109); + +var msg136 = msg("APPFW_CSRF_TAG", dup109); + +var msg137 = msg("APPFW_STARTURL", dup109); + +var msg138 = msg("APPFW_FIELDCONSISTENCY", dup109); + +var msg139 = msg("APPFW_REFERER_HEADER", dup109); + +var part232 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' cs6='), Field(fld9,true), Constant(' act='), Field(action,false)}" +match("MESSAGE#127:APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} cs6=%{fld9->} act=%{action}", processor_chain([ + dup9, + dup91, +])); + +var msg140 = msg("APPFW_SIGNATURE_MATCH", part232); + +var msg141 = msg("AF_400_RESP", dup110); + +var msg142 = msg("AF_MALFORMED_REQ_ERR", dup110); + +var part233 = tagval("MESSAGE#130:CITRIX_TVM", "nwparser.payload", tvm, { + "act": "action", + "cn1": "fld2", + "cn2": "fld3", + "cs1": "policyname", + "cs2": "fld5", + "cs4": "severity", + "cs5": "fld8", + "method": "web_method", + "msg": "info", + "request": "url", + "spt": "sport", + "src": "saddr", +}, processor_chain([ + dup11, + dup91, + setf("vid","hfld1"), + setf("msg_id","hfld1"), + lookup({ + dest: "nwparser.event_cat", + map: map_getEventLegacyCategory, + key: field("action"), + }), + lookup({ + dest: "nwparser.event_cat_name", + map: map_getEventLegacyCategoryName, + key: field("event_cat"), + }), +])); + +var msg143 = msg("CITRIX_TVM", part233); + +var part234 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(url,true), Constant(' '), Field(event_description,false)}" +match("MESSAGE#131:APPFW_APPFW_POLICY_HIT", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url->} %{event_description}", processor_chain([ + dup9, + dup40, + dup3, + dup4, +])); + +var msg144 = msg("APPFW_APPFW_POLICY_HIT", part234); + +var part235 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Unknown content-type header value='), Field(fld4,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#132:APPFW_APPFW_CONTENT_TYPE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Unknown content-type header value=%{fld4->} %{info->} \u003c\u003c%{disposition}>", processor_chain([ + dup9, + dup91, + dup4, +])); + +var msg145 = msg("APPFW_APPFW_CONTENT_TYPE", part235); + +var part236 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' WSI check failed: '), Field(fld4,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#133:APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} WSI check failed: %{fld4}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ + dup9, + dup91, + dup4, +])); + +var msg146 = msg("APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", part236); + +var part237 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Referer header check failed: referer header URL ''), Field(web_referer,false), Constant('' not in Start URL or closure list <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#134:APPFW_APPFW_REFERER_HEADER", "nwparser.payload", "%{saddr->} %{fld2->} %{fld3->} %{rule_group->} %{url->} Referer header check failed: referer header URL '%{web_referer}' not in Start URL or closure list \u003c\u003c%{disposition}>", processor_chain([ + dup9, + dup40, + dup3, + dup4, + setc("event_description","referer header URL not in Start URL or closure list"), +])); + +var msg147 = msg("APPFW_APPFW_REFERER_HEADER", part237); + +var part238 = // "Pattern{Constant('"URL'), Field(url,false), Constant('Client IP'), Field(hostip,false), Constant('Client Dest'), Field(fld1,false)}" +match("MESSAGE#141:RESPONDER_Message", "nwparser.payload", "\"URL%{url}Client IP%{hostip}Client Dest%{fld1}", processor_chain([ + dup9, + dup3, + dup4, +])); + +var msg148 = msg("RESPONDER_Message", part238); + +var part239 = // "Pattern{Constant('"NSRateLimit='), Field(filter,false), Constant(', ClientIP='), Field(saddr,false), Constant('"')}" +match("MESSAGE#142:RESPONDER_Message:01", "nwparser.payload", "\"NSRateLimit=%{filter}, ClientIP=%{saddr}\"", processor_chain([ + dup9, + dup3, + dup4, +])); + +var msg149 = msg("RESPONDER_Message:01", part239); + +var select65 = linear_select([ + msg148, + msg149, +]); + +var part240 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' - '), Field(fld2,true), Constant(' - '), Field(event_description,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#147:APPFW_AF_MALFORMED_REQ_ERR", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{event_description->} \u003c\u003c%{disposition}>", processor_chain([ + dup11, + dup3, + dup4, +])); + +var msg150 = msg("APPFW_AF_MALFORMED_REQ_ERR", part240); + +var part241 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' - '), Field(fld2,true), Constant(' - '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' '), Field(event_description,true), Constant(' rule ID '), Field(rule_uid,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#148:APPFW_APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{rule_group->} %{url->} %{event_description->} rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ + dup9, + domain("web_domain","url"), + root("web_root","url"), + page("webpage","url"), + setf("filename","webpage"), + dup3, + dup4, +])); + +var msg151 = msg("APPFW_APPFW_SIGNATURE_MATCH", part241); + +var part242 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Signature violation rule ID '), Field(rule_uid,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#149:APPFW_APPFW_SIGNATURE_MATCH:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Signature violation rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ + dup9, + dup91, + dup4, + setc("event_description","Signature violation"), +])); + +var msg152 = msg("APPFW_APPFW_SIGNATURE_MATCH:01", part242); + +var select66 = linear_select([ + msg151, + msg152, +]); + +var part243 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" -serverIP '), Field(daddr,true), Constant(' -serverPort '), Field(dport,true), Constant(' -logLevel '), Field(fld1,true), Constant(' -dateFormat '), Field(fld2,true), Constant(' -logFacility '), Field(fld3,true), Constant(' -tcp '), Field(fld4,true), Constant(' -acl '), Field(fld5,true), Constant(' -timeZone '), Field(fld6,true), Constant(' -userDefinedAuditlog '), Field(fld7,true), Constant(' -appflowExport '), Field(fld8,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" +match("MESSAGE#150:GUI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" -serverIP %{daddr->} -serverPort %{dport->} -logLevel %{fld1->} -dateFormat %{fld2->} -logFacility %{fld3->} -tcp %{fld4->} -acl %{fld5->} -timeZone %{fld6->} -userDefinedAuditlog %{fld7->} -appflowExport %{fld8}\" - Status \"%{disposition}\"", processor_chain([ + dup88, + dup89, + dup3, + dup4, +])); + +var msg153 = msg("GUI_CMD_EXECUTED:01", part243); + +var part244 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,true), Constant(' -priority '), Field(fld1,true), Constant(' -devno '), Field(fld2,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" +match("MESSAGE#151:GUI_CMD_EXECUTED:02", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} -priority %{fld1->} -devno %{fld2}\" - Status \"%{disposition}\"", processor_chain([ + dup88, + dup89, + dup3, + dup4, +])); + +var msg154 = msg("GUI_CMD_EXECUTED:02", part244); + +var part245 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" +match("MESSAGE#152:GUI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ + dup69, + dup92, + dup3, + dup4, + dup85, + dup6, + dup86, +])); + +var msg155 = msg("GUI_CMD_EXECUTED:Login", part245); + +var part246 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" +match("MESSAGE#153:GUI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ + dup71, + dup92, + dup3, + dup4, + dup85, + dup72, + dup87, +])); + +var msg156 = msg("GUI_CMD_EXECUTED:Logout", part246); + +var msg157 = msg("GUI_CMD_EXECUTED", dup108); + +var part247 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,true), Constant(' - Status "'), Field(disposition,false), Constant('" - Message "'), Field(info,false), Constant('"')}" +match("MESSAGE#155:GUI_CMD_EXECUTED:03", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} - Status \"%{disposition}\" - Message \"%{info}\"", processor_chain([ + dup88, + dup89, + dup4, +])); + +var msg158 = msg("GUI_CMD_EXECUTED:03", part247); + +var select67 = linear_select([ + msg153, + msg154, + msg155, + msg156, + msg157, + msg158, +]); + +var msg159 = msg("CLI_CMD_EXECUTED", dup108); + +var part248 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" +match("MESSAGE#157:API_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ + dup88, + setc("event_description","API command executed in NetScaler"), + dup3, + dup4, +])); + +var msg160 = msg("API_CMD_EXECUTED", part248); + +var part249 = // "Pattern{Field(result,true), Constant(' for user '), Field(username,true), Constant(' = '), Field(fld1,true), Constant(' "')}" +match("MESSAGE#158:AAA_Message/1_0", "nwparser.p0", "%{result->} for user %{username->} = %{fld1->} \""); + +var part250 = // "Pattern{Constant(''), Field(info,true), Constant(' "')}" +match("MESSAGE#158:AAA_Message/1_1", "nwparser.p0", "%{info->} \""); + +var select68 = linear_select([ + part249, + part250, +]); + +var all56 = all_match({ + processors: [ + dup93, + select68, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var msg161 = msg("AAA_Message", all56); + +var part251 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': created session for <<'), Field(domain,false), Constant('> with cookie: <<'), Field(web_cookie,false), Constant('>"')}" +match("MESSAGE#159:AAATM_Message:04", "nwparser.payload", "\"%{event_type}: created session for \u003c\u003c%{domain}> with cookie: \u003c\u003c%{web_cookie}>\"", processor_chain([ + dup9, + dup91, + dup4, +])); + +var msg162 = msg("AAATM_Message:04", part251); + +var part252 = // "Pattern{Field(fld1,true), Constant(' for user '), Field(username,true), Constant(' "')}" +match("MESSAGE#160:AAATM_Message/1_0", "nwparser.p0", "%{fld1->} for user %{username->} \""); + +var select69 = linear_select([ + part252, + dup90, +]); + +var all57 = all_match({ + processors: [ + dup93, + select69, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); + +var msg163 = msg("AAATM_Message", all57); + +var part253 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' creating session '), Field(info,false), Constant('"')}" +match("MESSAGE#161:AAATM_Message:01", "nwparser.payload", "\"%{fld1->} creating session %{info}\"", processor_chain([ + dup9, + dup4, + setc("event_type","creating session"), +])); + +var msg164 = msg("AAATM_Message:01", part253); + +var part254 = // "Pattern{Constant('"cookie idx is '), Field(fld1,false), Constant(', '), Field(info,false), Constant('"')}" +match("MESSAGE#162:AAATM_Message:02", "nwparser.payload", "\"cookie idx is %{fld1}, %{info}\"", processor_chain([ + dup9, + dup4, + setc("event_type","cookie idx"), +])); + +var msg165 = msg("AAATM_Message:02", part254); + +var part255 = // "Pattern{Constant('"sent request to '), Field(fld1,true), Constant(' for authentication, user <<'), Field(domain,false), Constant('\'), Field(username,false), Constant('>, client ip '), Field(saddr,false), Constant('"')}" +match("MESSAGE#163:AAATM_Message:03", "nwparser.payload", "\"sent request to %{fld1->} for authentication, user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}\"", processor_chain([ + setc("eventcategory","1304000000"), + dup4, + setc("event_type","sent request"), +])); + +var msg166 = msg("AAATM_Message:03", part255); + +var part256 = // "Pattern{Constant('"authentication succeeded for user <<'), Field(domain,false), Constant('\'), Field(username,false), Constant('>, client ip '), Field(saddr,false), Constant(', setting up session"')}" +match("MESSAGE#164:AAATM_Message:05", "nwparser.payload", "\"authentication succeeded for user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}, setting up session\"", processor_chain([ + setc("eventcategory","1302000000"), + dup4, + setc("event_type","setting up session"), +])); + +var msg167 = msg("AAATM_Message:05", part256); + +var msg168 = msg("AAATM_Message:06", dup111); + +var select70 = linear_select([ + msg162, + msg163, + msg164, + msg165, + msg166, + msg167, + msg168, +]); + +var part257 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- '), Field(event_computer,true), Constant(' User '), Field(username,true), Constant(' : Group(s) '), Field(group,true), Constant(' : Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#166:AAATM_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- %{event_computer->} User %{username->} : Group(s) %{group->} : Vserver %{daddr}:%{dport->} - %{fld2->} %{p0}"); + +var part258 = // "Pattern{Field(timezone,false), Constant(': SSO is '), Field(fld3,true), Constant(' : '), Field(p0,false)}" +match("MESSAGE#166:AAATM_HTTPREQUEST/1_0", "nwparser.p0", "%{timezone}: SSO is %{fld3->} : %{p0}"); + +var part259 = // "Pattern{Field(timezone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#166:AAATM_HTTPREQUEST/1_1", "nwparser.p0", "%{timezone->} %{p0}"); + +var select71 = linear_select([ + part258, + part259, +]); + +var part260 = // "Pattern{Field(web_method,true), Constant(' '), Field(url,true), Constant(' '), Field(fld4,false)}" +match("MESSAGE#166:AAATM_HTTPREQUEST/2", "nwparser.p0", "%{web_method->} %{url->} %{fld4}"); + +var all58 = all_match({ + processors: [ + part257, + select71, + part260, + ], + on_success: processor_chain([ + dup9, + dup4, + date_time({ + dest: "effective_time", + args: ["fld2"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + setc("event_description","AAATM HTTP Request"), + ]), +}); + +var msg169 = msg("AAATM_HTTPREQUEST", all58); + +var msg170 = msg("SSLVPN_REMOVE_SESSION_ERR", dup114); + +var msg171 = msg("SSLVPN_REMOVE_SESSION", dup114); + +var msg172 = msg("SSLVPN_REMOVE_SESSION_INFO", dup114); + +var part261 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - ica_rtt '), Field(fld5,true), Constant(' - clientside_rxbytes '), Field(rbytes,false), Constant('- clientside_txbytes '), Field(sbytes,true), Constant(' - clientside_packet_retransmits '), Field(fld6,true), Constant(' - serverside_packet_retransmits '), Field(fld7,true), Constant(' - clientside_rtt '), Field(fld8,true), Constant(' - serverside_rtt '), Field(fld9,true), Constant(' - clientside_jitter '), Field(fld10,true), Constant(' - serverside_jitter '), Field(fld11,false)}" +match("MESSAGE#170:ICA_NETWORK_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - ica_rtt %{fld5->} - clientside_rxbytes %{rbytes}- clientside_txbytes %{sbytes->} - clientside_packet_retransmits %{fld6->} - serverside_packet_retransmits %{fld7->} - clientside_rtt %{fld8->} - serverside_rtt %{fld9->} - clientside_jitter %{fld10->} - serverside_jitter %{fld11}", processor_chain([ + dup9, + dup4, +])); + +var msg173 = msg("ICA_NETWORK_UPDATE", part261); + +var part262 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - channel_update_begin '), Field(fld5,true), Constant(' - channel_update_end '), Field(fld6,true), Constant(' - channel_id_1 '), Field(fld7,true), Constant(' - channel_id_1_val '), Field(fld8,true), Constant(' - channel_id_2 '), Field(fld9,true), Constant(' - channel_id_2_val '), Field(fld10,true), Constant(' -channel_id_3 '), Field(fld11,true), Constant(' - channel_id_3_val '), Field(fld12,true), Constant(' - channel_id_4 '), Field(fld13,true), Constant(' - channel_id_4_val '), Field(fld14,true), Constant(' -channel_id_5 '), Field(fld15,true), Constant(' - channel_id_5_val '), Field(fld16,false)}" +match("MESSAGE#171:ICA_CHANNEL_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - channel_update_begin %{fld5->} - channel_update_end %{fld6->} - channel_id_1 %{fld7->} - channel_id_1_val %{fld8->} - channel_id_2 %{fld9->} - channel_id_2_val %{fld10->} -channel_id_3 %{fld11->} - channel_id_3_val %{fld12->} - channel_id_4 %{fld13->} - channel_id_4_val %{fld14->} -channel_id_5 %{fld15->} - channel_id_5_val %{fld16}", processor_chain([ + dup9, + date_time({ + dest: "starttime", + args: ["fld5"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + date_time({ + dest: "endtime", + args: ["fld6"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + dup4, +])); + +var msg174 = msg("ICA_CHANNEL_UPDATE", part262); + +var part263 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - nsica_session_status '), Field(fld5,true), Constant(' - nsica_session_client_ip '), Field(saddr,true), Constant(' - nsica_session_client_port '), Field(sport,true), Constant(' - nsica_session_server_ip '), Field(daddr,true), Constant(' - nsica_session_server_port '), Field(dport,true), Constant(' - nsica_session_reconnect_count '), Field(fld6,true), Constant(' - nsica_session_acr_count '), Field(fld7,true), Constant(' - connection_priority '), Field(fld8,true), Constant(' - timestamp '), Field(fld9,false)}" +match("MESSAGE#172:ICA_SESSION_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - nsica_session_status %{fld5->} - nsica_session_client_ip %{saddr->} - nsica_session_client_port %{sport->} - nsica_session_server_ip %{daddr->} - nsica_session_server_port %{dport->} - nsica_session_reconnect_count %{fld6->} - nsica_session_acr_count %{fld7->} - connection_priority %{fld8->} - timestamp %{fld9}", processor_chain([ + dup9, + dup4, +])); + +var msg175 = msg("ICA_SESSION_UPDATE", part263); + +var msg176 = msg("ICA_Message", dup111); + +var part264 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - session_setup_time '), Field(fld5,true), Constant(' - client_ip '), Field(saddr,true), Constant(' - client_type '), Field(fld6,true), Constant(' - client_launcher '), Field(fld7,true), Constant(' - client_version '), Field(version,true), Constant(' - client_hostname '), Field(shost,true), Constant(' - domain_name '), Field(domain,true), Constant(' - server_name '), Field(dhost,true), Constant(' - connection_priority '), Field(fld8,false)}" +match("MESSAGE#174:ICA_SESSION_SETUP", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_setup_time %{fld5->} - client_ip %{saddr->} - client_type %{fld6->} - client_launcher %{fld7->} - client_version %{version->} - client_hostname %{shost->} - domain_name %{domain->} - server_name %{dhost->} - connection_priority %{fld8}", processor_chain([ + dup9, + dup4, +])); + +var msg177 = msg("ICA_SESSION_SETUP", part264); + +var part265 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - launch_mechanism '), Field(fld5,true), Constant(' - app_launch_time '), Field(fld6,true), Constant(' - app_process_id '), Field(fld7,true), Constant(' - app_name '), Field(fld8,true), Constant(' - module_path '), Field(filename,false)}" +match("MESSAGE#175:ICA_APPLICATION_LAUNCH", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - launch_mechanism %{fld5->} - app_launch_time %{fld6->} - app_process_id %{fld7->} - app_name %{fld8->} - module_path %{filename}", processor_chain([ + dup9, + date_time({ + dest: "starttime", + args: ["fld6"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + dup4, +])); + +var msg178 = msg("ICA_APPLICATION_LAUNCH", part265); + +var part266 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - session_end_time '), Field(fld5,false)}" +match("MESSAGE#176:ICA_SESSION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_end_time %{fld5}", processor_chain([ + dup9, + date_time({ + dest: "endtime", + args: ["fld5"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + dup4, +])); + +var msg179 = msg("ICA_SESSION_TERMINATE", part266); + +var part267 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - app_termination_type '), Field(fld5,true), Constant(' - app_process_id '), Field(fld6,true), Constant(' - app_termination_time '), Field(fld7,false)}" +match("MESSAGE#177:ICA_APPLICATION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - app_termination_type %{fld5->} - app_process_id %{fld6->} - app_termination_time %{fld7}", processor_chain([ + dup9, + date_time({ + dest: "endtime", + args: ["fld7"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dc(":"),dH,dc(":"),dU,dc(":"),dO], + ], + }), + dup4, +])); + +var msg180 = msg("ICA_APPLICATION_TERMINATE", part267); + +var all59 = all_match({ + processors: [ + dup94, + dup112, + dup97, + ], + on_success: processor_chain([ + setc("eventcategory","1801010100"), + dup4, + ]), +}); + +var msg181 = msg("SSLVPN_REMOVE_SESSION_DEBUG", all59); + +var part268 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Browser_type '), Field(user_agent,false), Constant('- Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#181:AAATM_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{user_agent}- Group(s) \"%{group}\""); + +var all60 = all_match({ + processors: [ + dup48, + dup104, + dup66, + dup105, + part268, + ], + on_success: processor_chain([ + dup69, + dup6, + dup7, + dup4, + ]), +}); + +var msg182 = msg("AAATM_LOGIN", all60); + +var part269 = // "Pattern{Field(duration_string,true), Constant(' - Http_resources_accessed '), Field(fld3,true), Constant(' - Total_TCP_connections '), Field(fld5,true), Constant(' - Total_policies_allowed '), Field(fld7,true), Constant(' - Total_policies_denied '), Field(fld8,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(fld12,true), Constant(' - Total_compressedbytes_recv '), Field(fld13,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - LogoutMethod "'), Field(result,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" +match("MESSAGE#182:AAATM_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - Total_TCP_connections %{fld5->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{fld12->} - Total_compressedbytes_recv %{fld13->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); + +var all61 = all_match({ + processors: [ + dup48, + dup104, + dup66, + dup105, + dup70, + dup102, + dup103, + part269, + ], + on_success: processor_chain([ + dup71, + dup72, + dup7, + dup4, + dup59, + dup60, + dup61, + dup62, + ]), +}); + +var msg183 = msg("AAATM_LOGOUT", all61); + +var msg184 = msg("EVENT_LOGINFAILURE", dup101); + +var chain1 = processor_chain([ + select2, + msgid_select({ + "AAATM_HTTPREQUEST": msg169, + "AAATM_LOGIN": msg182, + "AAATM_LOGOUT": msg183, + "AAATM_Message": select70, + "AAA_EXTRACTED_GROUPS": msg1, + "AAA_LOGIN_FAILED": msg2, + "AAA_Message": msg161, + "ACL_ACL_PKT_LOG": msg3, + "AF_400_RESP": msg141, + "AF_MALFORMED_REQ_ERR": msg142, + "API_CMD_EXECUTED": msg160, + "APPFW_AF_400_RESP": select16, + "APPFW_AF_MALFORMED_REQ_ERR": msg150, + "APPFW_AF_MEMORY_ERR": msg23, + "APPFW_APPFW_BUFFEROVERFLOW_COOKIE": msg4, + "APPFW_APPFW_BUFFEROVERFLOW_HDR": msg5, + "APPFW_APPFW_BUFFEROVERFLOW_URL": select4, + "APPFW_APPFW_CONTENT_TYPE": msg145, + "APPFW_APPFW_COOKIE": msg8, + "APPFW_APPFW_CSRF_TAG": select17, + "APPFW_APPFW_DENYURL": msg9, + "APPFW_APPFW_FIELDCONSISTENCY": msg10, + "APPFW_APPFW_FIELDFORMAT": msg11, + "APPFW_APPFW_POLICY_HIT": msg144, + "APPFW_APPFW_REFERER_HEADER": msg147, + "APPFW_APPFW_SAFECOMMERCE": msg14, + "APPFW_APPFW_SAFECOMMERCE_XFORM": msg15, + "APPFW_APPFW_SAFEOBJECT": msg20, + "APPFW_APPFW_SIGNATURE_MATCH": select66, + "APPFW_APPFW_SQL": select11, + "APPFW_APPFW_STARTURL": msg16, + "APPFW_APPFW_XSS": msg17, + "APPFW_COOKIE": msg135, + "APPFW_CSRF_TAG": msg136, + "APPFW_FIELDCONSISTENCY": msg138, + "APPFW_Message": select19, + "APPFW_REFERER_HEADER": msg139, + "APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE": msg146, + "APPFW_SIGNATURE_MATCH": msg140, + "APPFW_STARTURL": msg137, + "CITRIX_TVM": msg143, + "CLI_CMD_EXECUTED": msg159, + "CLUSTERD_Message": select60, + "DR_HA_Message": msg27, + "EVENT_ALERTENDED": msg28, + "EVENT_ALERTSTARTED": msg29, + "EVENT_CONFIGEND": msg30, + "EVENT_CONFIGSTART": msg31, + "EVENT_DEVICEDOWN": msg32, + "EVENT_DEVICEOFS": msg33, + "EVENT_DEVICEUP": msg34, + "EVENT_LOGINFAILURE": msg184, + "EVENT_MONITORDOWN": msg35, + "EVENT_MONITORUP": msg36, + "EVENT_NICRESET": msg37, + "EVENT_ROUTEDOWN": msg38, + "EVENT_ROUTEUP": msg39, + "EVENT_STARTCPU": msg40, + "EVENT_STARTSAVECONFIG": msg41, + "EVENT_STARTSYS": msg42, + "EVENT_STATECHANGE": select22, + "EVENT_STOPSAVECONFIG": msg46, + "EVENT_STOPSYS": msg47, + "EVENT_UNKNOWN": msg48, + "EVENT_VRIDINIT": msg124, + "GUI_CMD_EXECUTED": select67, + "ICA_APPLICATION_LAUNCH": msg178, + "ICA_APPLICATION_TERMINATE": msg180, + "ICA_CHANNEL_UPDATE": msg174, + "ICA_Message": msg176, + "ICA_NETWORK_UPDATE": msg173, + "ICA_SESSION_SETUP": msg177, + "ICA_SESSION_TERMINATE": msg179, + "ICA_SESSION_UPDATE": msg175, + "IPSEC_Message": msg127, + "NSNETSVC_Message": msg128, + "NSNETSVC_REQ_PARSE_ERROR": msg130, + "PITBOSS_Message": select28, + "RESPONDER_Message": select65, + "ROUTING_Message": select29, + "ROUTING_ZEBOS_CMD_EXECUTED": msg57, + "SNMP_TRAP_SENT": select42, + "SPCBId": msg134, + "SSLLOG_SSL_HANDSHAKE_FAILURE": msg94, + "SSLLOG_SSL_HANDSHAKE_ISSUERNAME": msg97, + "SSLLOG_SSL_HANDSHAKE_SUBJECTNAME": msg96, + "SSLLOG_SSL_HANDSHAKE_SUCCESS": msg95, + "SSLVPN_AAAEXTRACTED_GROUPS": msg98, + "SSLVPN_CLISEC_CHECK": msg93, + "SSLVPN_CLISEC_EXP_EVAL": msg99, + "SSLVPN_HTTPREQUEST": msg100, + "SSLVPN_HTTP_RESOURCEACCESS_DENIED": msg129, + "SSLVPN_ICAEND_CONNSTAT": select51, + "SSLVPN_ICASTART": select53, + "SSLVPN_LOGIN": msg103, + "SSLVPN_LOGOUT": msg104, + "SSLVPN_Message": msg109, + "SSLVPN_NONHTTP_RESOURCEACCESS_DENIED": msg123, + "SSLVPN_REMOVE_SESSION": msg171, + "SSLVPN_REMOVE_SESSION_DEBUG": msg181, + "SSLVPN_REMOVE_SESSION_ERR": msg170, + "SSLVPN_REMOVE_SESSION_INFO": msg172, + "SSLVPN_TCPCONNSTAT": msg110, + "SSLVPN_TCPCONN_TIMEDOUT": msg105, + "SSLVPN_UDPFLOWSTAT": msg106, + "Source": select64, + "TCP_CONN_DELINK": msg111, + "TCP_CONN_TERMINATE": select55, + "TCP_NAT_OTHERCONN_DELINK": msg115, + "TCP_OTHERCONN_DELINK": msg114, + "UI_CMD_EXECUTED": select58, + "User": msg133, + }), +]); + +var part270 = // "Pattern{Field(saddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#6:APPFW_APPFW_COOKIE/0", "nwparser.payload", "%{saddr->} %{p0}"); + +var part271 = // "Pattern{Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); + +var part272 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" +match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); + +var part273 = // "Pattern{Constant('"'), Field(p0,false)}" +match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); + +var part274 = // "Pattern{Constant('HASTATE '), Field(p0,false)}" +match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); + +var part275 = // "Pattern{Field(network_service,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); + +var part276 = // "Pattern{Field(info,false), Constant('"')}" +match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); + +var part277 = // "Pattern{Constant('for '), Field(dclass_counter1,false)}" +match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); + +var part278 = // "Pattern{Field(space,false)}" +match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); + +var part279 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); + +var part280 = // "Pattern{Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); + +var part281 = // "Pattern{}" +match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); + +var part282 = // "Pattern{Field(obj_type,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); + +var part283 = // "Pattern{Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); + +var part284 = // "Pattern{Constant(''), Field(obj_name,false)}" +match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); + +var part285 = // "Pattern{Constant('" '), Field(p0,false)}" +match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); + +var part286 = // "Pattern{Constant(''), Field(info,false), Constant('"')}" +match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); + +var part287 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false), Constant(')')}" +match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); + +var part288 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); + +var part289 = // "Pattern{Constant('ClientIP '), Field(p0,false)}" +match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); + +var part290 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); + +var part291 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); + +var part292 = // "Pattern{Field(fld10,true), Constant(' - End_time '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); + +var part293 = // "Pattern{Constant('" '), Field(fld11,true), Constant(' GMT" - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); + +var part294 = // "Pattern{Constant('" '), Field(fld11,false), Constant('" - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); + +var part295 = // "Pattern{Field(fld11,true), Constant(' - Duration '), Field(p0,false)}" +match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); + +var part296 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); + +var part297 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); + +var part298 = // "Pattern{Constant('User '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); + +var part299 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); + +var part300 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); + +var part301 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver '), Field(p0,false)}" +match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); + +var part302 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start_time '), Field(p0,false)}" +match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); + +var part303 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(username,true), Constant(' - Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); + +var part304 = // "Pattern{Field(,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); + +var part305 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); + +var part306 = // "Pattern{Field(fld11,true), Constant(' GMT - Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); + +var part307 = // "Pattern{Field(fld11,true), Constant(' - Total_bytes_send '), Field(p0,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); + +var part308 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" +match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); + +var part309 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); + +var part310 = // "Pattern{Field(fld10,true), Constant(' GMT - End Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); + +var part311 = // "Pattern{Field(fld10,true), Constant(' - End Time '), Field(p0,false)}" +match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); + +var part312 = // "Pattern{Field(info,true), Constant(' "')}" +match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); + +var part313 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); + +var part314 = // "Pattern{Constant('Sessionid '), Field(sessionid,true), Constant(' - User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); + +var part315 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); + +var part316 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver_ip '), Field(p0,false)}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); + +var part317 = // "Pattern{Field(daddr,true), Constant(' - Errmsg " '), Field(event_description,true), Constant(' "')}" +match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); + +var select72 = linear_select([ + dup21, + dup22, +]); + +var select73 = linear_select([ + dup25, + dup26, +]); + +var select74 = linear_select([ + dup32, + dup33, +]); + +var part318 = // "Pattern{Field(fld1,false), Constant(':UserLogin:'), Field(username,true), Constant(' - '), Field(event_description,true), Constant(' from client IP Address '), Field(saddr,false)}" +match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ + dup5, + dup4, +])); + +var select75 = linear_select([ + dup52, + dup53, + dup54, +]); + +var select76 = linear_select([ + dup55, + dup56, + dup57, +]); + +var select77 = linear_select([ + dup63, + dup64, + dup65, +]); + +var select78 = linear_select([ + dup67, + dup68, +]); + +var select79 = linear_select([ + dup76, + dup77, +]); + +var select80 = linear_select([ + dup81, + dup82, +]); + +var part319 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" +match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ + dup88, + dup89, + dup3, + dup4, +])); + +var part320 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" +match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ + dup9, + dup91, +])); + +var part321 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" +match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ + dup11, + dup91, +])); + +var part322 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ + dup9, + dup4, +])); + +var select81 = linear_select([ + dup95, + dup96, +]); + +var all62 = all_match({ + processors: [ + dup20, + dup98, + dup23, + ], + on_success: processor_chain([ + dup2, + dup24, + dup3, + dup4, + ]), +}); + +var all63 = all_match({ + processors: [ + dup94, + dup112, + dup97, + ], + on_success: processor_chain([ + dup9, + dup4, + ]), +}); diff --git a/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml b/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml new file mode 100644 index 00000000000..51c9ebaf329 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Citrix NetScaler + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/citrix/netscaler/manifest.yml b/x-pack/filebeat/module/citrix/netscaler/manifest.yml new file mode 100644 index 00000000000..4f7831e1936 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["citrix.netscaler", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9526 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/citrix/netscaler/test/generated.log b/x-pack/filebeat/module/citrix/netscaler/test/generated.log new file mode 100644 index 00000000000..33bb1d4e168 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/test/generated.log @@ -0,0 +1,100 @@ +1/29/2016:06:09:59 avolupt : ICA APPLICATION_LAUNCH nnumqua:session_guid eacommod - device_serial_number rci - client_cookie olaboris - flags tur - launch_mechanism itv - app_launch_time 1/29/2016:06:09:59 - app_process_id odoco - app_name ria - module_path min +2/12/2016:13:12:33 nulapari : GUI CMD_EXECUTED mwritten:User ctetur - Remote_ip 10.102.218.31 - Command "deny -priority mipsumq -devno gnaali" - Status "enatus" +02/26/2016:20:15:08 com : SSLLOG SSL_HANDSHAKE_SUBJECTNAME eataevi:SPCBId byC - SubjectName "tinculp" +3/12/2016:03:17:42 maveniam : ACL ACL_PKT_LOG uian:Source 10.72.11.247:4780 --> Destination 10.134.175.248:4496 - Protocol udp - TimeStamp antium - Hitcount 1279 - Hit Rule lupta - Data iusmodt +APPFW_COOKIE |1.3626|uaera|sitas|medium|src=10.12.182.150 spt=7788 method=iumto request=https://www5.example.net/sun/essecill.html?saute=vel#quu msg=undeo cn1=loremip cn2=rnatura cs1=isqu cs2=uis cs3=idolore cs4=very-high cs5=llumquid act=cancel +4/9/2016:17:22:51 rehe : SSLVPN UDPFLOWSTAT :Context ume - SessionId: incidi- User picia - Client_ip 10.109.68.21 - Nat_ip 10.96.119.12 - Vserver 10.83.234.60:6178 - Source 10.156.210.168:6317 - Destination 10.21.92.218:4125 - Start_time " 4/9/2016:17:22:51 GMT" - End_time " 4/9/2016:17:22:51" - Duration agnaali - Total_bytes_send 4138 - Total_bytes_recv 3671 - Access inima - Group(s) "tlabo" +4/24/2016:00:25:25 iineavo : ICA SESSION_TERMINATE equatD:session_guid isno - device_serial_number taliq - client_cookie intoccae - flags ents - session_end_time 4/24/2016:00:25:25 +5/8/2016:07:27:59 sinto : APPFW Message :"Duplicate rule id emoeni" +5/22/2016:14:30:33 inesci : APPFW APPFW_REFERER_HEADER :10.109.157.63 mqu apariat tlabore https://www5.example.org/remi/saute.txt?ionevo=remagn#run Referer header check failed: referer header URL 'https://www.example.net/uovolup/samvolu.html?licab=eirure#conseq' not in Start URL or closure list < +6/5/2016:21:33:08 ern : SSLVPN REMOVE_SESSION_ERR :Sessionid psaquae - User ationemu - Client_ip 10.92.161.8 - Nat_ip 10.103.118.137 - Vserver_ip 10.116.193.182 - Errmsg " snostrud " +6/20/2016:04:35:42 quisnos : EVENT STARTSAVECONFIG :SAVECONFIG ite +7/4/2016:11:38:16 acc : SNMP TRAP_SENT :amc ( haPeerSystemState = "amest", sysIpAddress = 10.37.226.87) +7/18/2016:18:40:50 gel : SSLVPN ICAEND_CONNSTAT :Source 10.235.101.253:4467 - Destination 10.245.10.170:3314 - username:domainname ulapa:liqui - startTime " 7/18/2016:18:40:50 GMT" - endTime " 7/18/2016:18:40:50" - Duration quioffi - Total_bytes_send 1359 - Total_bytes_recv 1287 - Total_compressedbytes_send ncidid - Total_compressedbytes_recv quaturve - Compression_ratio_send sequa - Compression_ratio_recv aera - connectionId ate +8/2/2016:01:43:25 nsecte : EVENT ALERTENDED :inculpa.exe ended +8/16/2016:08:45:59 nisi : AAATM HTTPREQUEST :Context dant - SessionId: rroquis- aeabi User eiu : Group(s) ntiumdo : Vserver 10.162.161.83:5025 - 8/16/2016:08:45:59 PST: SSO is olupta : litse https://mail.example.com/itatio/uta.htm?sintoc=volupt#siste uiinea +8/30/2016:15:48:33 idolo : ICA APPLICATION_LAUNCH :session_guid quinesc - device_serial_number madmi - client_cookie tur - flags roi - launch_mechanism niamqui - app_launch_time 8/30/2016:15:48:33 - app_process_id orem - app_name sno - module_path atno +9/13/2016:22:51:07 ntocca : APPFW APPFW_XSS :10.26.55.33 quiavol Cross-sitehttps://internal.example.com/temquiav/equatu.txt?cons=sBon#orro script tae < +9/28/2016:05:53:42 isc : AAATM Message ullamcor:"sent request to tobea for authentication, user <, client ip 10.206.87.219" +10/12/2016:12:56:16 litessec : SNMP TRAP_SENT :itas ( entityName = "edquia (sequatu" , sysIpAddress = 10.27.58.92) +10/26/2016:19:58:50 qui : NSNETSVC Message :"tasn: Nemoenim " +11/10/2016:03:01:24 str : EVENT STOPSYS :System stopped - idolore +11/24/2016:10:03:59 illoin : APPFW APPFW_SAFEOBJECT tanimid:10.93.68.231 ctet Match found with Safe Object: ati < +12/8/2016:17:06:33 niamqui : APPFW APPFW_POLICY_HIT :10.236.120.18 adeser oin mvenia https://www5.example.org/fugitsed/quam.html?luptate=persp#entsunt ihilm +12/23/2016:00:09:07 meius : RESPONDER Message :"NSRateLimit=billo, ClientIP=10.103.127.155" +1/6/2017:07:11:41 nonp : EVENT ALERTSTARTED :labo.exe started for 267 +APPFW_COOKIE |1.2352|rQu|mco|medium|src=10.206.81.23 spt=6280 method=tincu request=https://internal.example.com/itse/umexerc.gif?intocc=amcorp#ntsunt msg=uidol cn1=litani cn2=utodita cs1=aec cs2=fdeF cs3=iquidexe cs4=low cs5=niamq act=cancel +2/3/2017:21:16:50 ipsamvo : ROUTING ZEBOS_CMD_EXECUTED onula:miu Command "accept" upt +2/18/2017:04:19:24 snost : EVENT NICRESET tpersp:llamc "nte" - State mvel +3/4/2017:11:21:59 eratvol : APPFW APPFW_SAFECOMMERCE :10.253.132.145 est uptatemU Maximum no. https://internal.example.com/tla/item.jpg?isa=niamqui#atcupid of potential credit card numbers seen < +3/18/2017:18:24:33 naaliq : AAA LOGIN_FAILED :User nte - Client_ip 10.5.67.143 - Failure_reason "unknown" +4/2/2017:01:27:07 loi : ICA SESSION_TERMINATE isc:session_guid Nequepor - device_serial_number eirure - client_cookie deserun - flags esseq - session_end_time 4/2/2017:01:27:07 +4/16/2017:08:29:41 iquamqua : SSLVPN ICASTART :Source 10.248.165.185:3436 - Destination 10.32.39.220:3589 - username:domainname exeaco:teni - applicationName dquiac - startTime " 4/16/2017:08:29:41" - connectionId itaedict +4/30/2017:15:32:16 mUten : SSLVPN REMOVE_SESSION_ERR emq:Sessionid maperi - User agnaaliq - Client_ip 10.197.6.245 - Nat_ip 10.81.45.174 - Vserver_ip 10.82.28.220 - Errmsg " mve " +5/14/2017:22:34:50 cipitl : EVENT STARTSAVECONFIG :SAVECONFIG caboNemo +5/29/2017:05:37:24 uto : SSLVPN ICASTART iuntNequ:Server port = 7202 - Server server ip = 10.18.25.125 - username:domain_name = quatD:isqua - application name = uta +6/12/2017:12:39:58 tsed : ICA CHANNEL_UPDATE :session_guid eturad - device_serial_number tiumdolo - client_cookie atuse - flags ueipsa - channel_update_begin 6/12/2017:12:39:58 - channel_update_end 6/12/2017:12:39:58 - channel_id_1 scipitl - channel_id_1_val eumi - channel_id_2 quasiarc - channel_id_2_val olli -channel_id_3 rever - channel_id_3_val ore - channel_id_4 offici - channel_id_4_val ection -channel_id_5 roquisqu - channel_id_5_val edolorin +6/26/2017:19:42:33 aspe : CLUSTERD Message imadmi: "isnis(10.230.93.243) port(1625) msglen(iatqu) rcv(6203) R(unknown) " +7/11/2017:02:45:07 liquid : APPFW APPFW_BUFFEROVERFLOW_HDR :10.13.181.73 ate mporainc xea: https://www.example.org/umdolo/ntiu.jpg?dquiaco=nibus#vitaed < +7/25/2017:09:47:41 isi : APPFW APPFW_COOKIE culpaq:10.162.97.197 ende abor Cookiehttps://internal.example.org/adol/iutal.gif?niam=pernat#rerepre validation failed for nculpaq < +User nisiu - Remote_ip 10.101.178.146 - Command "ptatem" - Status "unknown" +8/22/2017:23:52:50 onproide : APPFW APPFW_REFERER_HEADER ntmo:10.143.88.119 tNe pisc urEx https://www.example.com/tquidol/ercitat.txt?atcupi=atem#qui Referer header check failed: referer header URL 'https://mail.example.com/nim/ame.jpg?uid=equaturv#lamc' not in Start URL or closure list < +9/6/2017:06:55:24 equatDu : ROUTING ZEBOS_CMD_EXECUTED :pta Command "allow" prehe +9/20/2017:13:57:58 illoi : SSLVPN NONHTTP_RESOURCEACCESS_DENIED :Context reetdolo - SessionId: rationev- User ehender - Client_ip 10.117.94.131 - Nat_ip 10.180.83.140 - Vserver 10.45.114.111:357 - Source 10.243.226.122:3512 - Destination 10.3.23.172:7332 - Total_bytes_send emullamc - Total_bytes_recv tec - Denied_by_policy "Nemo" - Group(s) "tutlabo" +10/4/2017:21:00:32 iame : EVENT DEVICEUP laudanti:umiurer "rere" +10/19/2017:04:03:07 ori : APPFW APPFW_COOKIE uamqu:10.76.92.223 quiac sunt Cookiehttps://www5.example.org/emUte/iusmodi.htm?tura=osquirat#equat validation failed for aliquid < +11/2/2017:11:05:41 sun : AAATM Message urau:"etur: rsitvol " +11/16/2017:18:08:15 eque : SSLVPN CLISEC_CHECK eufug:User est - Client IP 10.101.172.233 - Vserver 10.211.163.7:940 - Client_security_expression "CLIENT.REG('iatnu').VALUE == writte || sitvo - failure +12/1/2017:01:10:49 llumq : DR HA_Message :"HASTATE tenim" +12/15/2017:08:13:24 itseddo : APPFW Message bore:"Setting same CustomSettings( ) to profile. ptate" +12/29/2017:15:15:58 mvenia : SSLVPN ICASTART :Source 10.29.207.55:7061 - Destination 10.61.175.217:2631 - username:domainname scip:Finibus - applicationName Utenimad - startTime 12/29/2017:15:15:58 - connectionId olupta +1/12/2018:22:18:32 fficia : SSLVPN AAAEXTRACTED_GROUPS est:Extracted_groups "ali" +1/27/2018:05:21:06 ceroi : APPFW APPFW_BUFFEROVERFLOW_URL :10.55.203.193 idunt edqu cte: https://internal.example.org/CSe/exerci.htm?eserun=pta#emu < +2/10/2018:12:23:41 orp : EVENT STATECHANGE :ender (dico) - uptatem upt +2/24/2018:19:26:15 idolo : EVENT STARTSYS reet:System started - lorem +3/11/2018:02:28:49 tmo : APPFW APPFW_SAFECOMMERCE_XFORM onofdeF:10.189.13.237 its https://www5.example.org/aliqui/datatnon.gif?nse=miurere#evit (uatu) potential credit card numbers seen in server response +3/25/2018:09:31:24 uamestqu : EVENT DEVICEUP mpor:orem "eniamqui" - State ven +4/8/2018:16:33:58 tdolorem : EVENT CONFIGEND :CONFIG qui +4/22/2018:23:36:32 deritinv : EVENT STARTSYS evelite:System started - cupidata +5/7/2018:06:39:06 emeu : ICA SESSION_TERMINATE :session_guid tatemac - device_serial_number quisn - client_cookie rem - flags ulamcola - session_end_time 5/7/2018:06:39:06 +5/21/2018:13:41:41 uisaut : APPFW APPFW_CSRF_TAG :10.23.202.99 tuser CSRF Tag validation failed: < +6/4/2018:20:44:15 sitame : EVENT ROUTEUP :oinven natu - State edqu +APPFW_FIELDCONSISTENCY |1.1396|ntutlab|rumSecti|medium|src=10.72.114.116 spt=2840 method=tesse request=https://internal.example.org/isno/oluptas.html?aeco=rinrepr#dutp msg=orem cn1=giatqu cn2=rsint cs1=rsi cs2=paq cs3=uianon cs4=high cs5=uisautem act=allow +7/3/2018:10:49:23 reprehen : ROUTING ZEBOS_CMD_EXECUTED tvol:ptat Command "allow" tdolo +7/17/2018:17:51:58 porissus : EVENT STARTCPU :CPU_started imip +8/1/2018:00:54:32 eumfu : ICA Message :docons +08/15/2018:07:57:06 turvelil : SSLLOG SSL_HANDSHAKE_SUBJECTNAME urExc:SPCBId doconse - SubjectName "audant" +8/29/2018:14:59:40 teturad : SNMP TRAP_SENT :ese (entityName = "eddoei", sysIpAddress = 10.161.68.13) +9/12/2018:22:02:15 tdolo : AAA LOGIN_FAILED :User ident - Client_ip 10.213.165.165 - Failure_reason "success" +9/27/2018:05:04:49 tetura : SSLVPN REMOVE_SESSION_ERR autemv:Sessionid sciveli - User picia - Client_ip 10.225.146.5 - Nat_ip 10.80.5.101 - Vserver_ip 10.41.65.89 - Errmsg " lapari " +10/11/2018:12:07:23 tMal : APPFW APPFW_REFERER_HEADER porin:10.241.143.145 quid aUten Duis https://www.example.org/quid/accus.html?edutpers=ctobeat#upta Referer header check failed: referer header URL 'https://mail.example.com/dictasun/psa.txt?secte=ctobeat#onsec' not in Start URL or closure list < +10/25/2018:19:09:57 ree : ROUTING Message :"itten started" +11/9/2018:02:12:32 temaccu : APPFW APPFW_SAFECOMMERCE_XFORM uamqua:10.106.34.244 eumiu https://example.com/pteurs/ercitati.html?ptat=mipsu#velillu (ecatcupi) potential credit card numbers seen in server response +11/23/2018:09:15:06 iquipex : SSLVPN REMOVE_SESSION_INFO mqu:Sessionid onorume - User abill - Client_ip 10.22.34.206 - Nat_ip "10.183.26.222" - Vserver_ip 10.33.231.173 - Errmsg " uasiarch " +12/7/2018:16:17:40 stenat : EVENT DEVICEDOWN :uianonnu "tatiset" - State quira +12/21/2018:23:20:14 samvol : EVENT MONITORUP :equa apari - State tsunt +1/5/2019:06:22:49 llo : SNMP TRAP_SENT :uames ( alarmRateLmtThresholdExceeded = "tla: "iaconseq...", ipAddressGathered = "sed", stringComputed = "sedd", sysIpAddress = 10.53.113.79) +1/19/2019:13:25:23 luptatev : EVENT ROUTEDOWN :occaeca dan - State pta +02/02/2019:20:27:57 equamni : SSLLOG SSL_HANDSHAKE_ISSUERNAME atcupi:SPCBId enima - IssuerName "uptateve" +2/17/2019:03:30:32 uiac : ICA APPLICATION_TERMINATE :session_guid tquii - device_serial_number tesse - client_cookie iamea - flags loremi - app_termination_type queporro - app_process_id tur - app_termination_time 2/17/2019:03:30:32 +3/3/2019:10:33:06 tamrema : APPFW APPFW_SAFECOMMERCE isautem:10.219.65.172 conse Maximum no. https://internal.example.net/edqui/tvolu.txt?ore=lors#saute of potential credit card numbers seen < +3/17/2019:17:35:40 dtempo : AAATM HTTPREQUEST lumqu:Context moen - SessionId: oinvento- mporin User orissusc : Group(s) utaliqui : Vserver 10.86.207.236:207 - 3/17/2019:17:35:40 CT litsed https://www.example.com/tiaec/lorem.jpg?totamr=seddo#aper entor +4/1/2019:00:38:14 ihil : ICA SESSION_UPDATE oremip:session_guid fdeFi - device_serial_number periam - client_cookie ccusa - flags billo - nsica_session_status doloremi - nsica_session_client_ip 10.197.128.162 - nsica_session_client_port 2052 - nsica_session_server_ip 10.187.86.64 - nsica_session_server_port 3325 - nsica_session_reconnect_count atatn - nsica_session_acr_count ipisc - connection_priority iatnulap - timestamp roi +4/15/2019:07:40:49 loreeu : APPFW APPFW_SIGNATURE_MATCH eprehe:10.163.217.101 empor - uptatemU - rem https://www5.example.com/iscivel/rinci.txt?atcupi=eriti#uptateve namaliqu rule ID riame: datatn < +4/29/2019:14:43:23 isu : ICA SESSION_UPDATE :session_guid moll - device_serial_number roinBCS - client_cookie odit - flags vol - nsica_session_status epteurs - nsica_session_client_ip 10.43.239.97 - nsica_session_client_port 6985 - nsica_session_server_ip 10.204.20.8 - nsica_session_server_port 2652 - nsica_session_reconnect_count ntoccae - nsica_session_acr_count iscive - connection_priority amni - timestamp etconse +5/13/2019:21:45:57 amquisn : SSLVPN NONHTTP_RESOURCEACCESS_DENIED Finibus:Context nsequat - SessionId: mvol- User asiar - Client_ip 10.8.82.22 - Nat_ip "10.148.244.55" - Vserver 10.133.153.174:7022 - Source 10.113.135.78:1646 - Destination 10.76.129.136:5259 - Total_bytes_send epteur - Total_bytes_recv onproi - Denied_by_policy "usmodit" - Group(s) "orese" +5/28/2019:04:48:31 atemacc : EVENT DEVICEOFS labore:iqua "ciunt" - State exea +APPFW_REFERER_HEADER |1.1103|citation|emquel|very-high|src=10.20.230.37 spt=5308 method=remip request=https://mail.example.com/aturExc/antiumto.htm?obe=niamqu#ull msg=aturE cn1=aaliqu cn2=tev cs1=oNemoeni cs2=luptatem cs3=pers cs4=low cs5=luptatem act=cancel +AF_MALFORMED_REQ_ERR |1.3141|etd|omnisi|high|src=10.186.166.215 spt=553 method=ati request=https://mail.example.org/tsuntinc/nis.gif?iin=uteiru#xer msg=iat cn1=orain cn2=equaturQ cs1=llu cs2=quaUt cs4=low cs5=nim act=block +7/10/2019:01:56:14 olorin : SSLVPN REMOVE_SESSION_INFO :Sessionid orisnisi - User emquiav - Client_ip 10.215.229.78 - Nat_ip 10.67.233.159 - Vserver_ip 10.213.112.186 - Errmsg " ectetur " +7/24/2019:08:58:48 sitasper : EVENT MONITORUP ncidunt:uiac squ - State litess +8/7/2019:16:01:23 scingeli : EVENT ALERTENDED :emq.exe ended for 2514 +8/21/2019:23:03:57 bor : ICA APPLICATION_LAUNCH magnido:session_guid lupta - device_serial_number utla - client_cookie nse - flags Dui - launch_mechanism gitsed - app_launch_time 8/21/2019:23:03:57 - app_process_id estla - app_name ione - module_path ecillum +9/5/2019:06:06:31 oreseos : ICA SESSION_UPDATE :session_guid agna - device_serial_number dmini - client_cookie tquid - flags giatquo - nsica_session_status iatisun - nsica_session_client_ip 10.96.104.212 - nsica_session_client_port 2372 - nsica_session_server_ip 10.73.45.19 - nsica_session_server_port 3791 - nsica_session_reconnect_count oeiusm - nsica_session_acr_count aUtenim - connection_priority ntincul - timestamp nnumquam +9/19/2019:13:09:05 inculpa : APPFW APPFW_SQL nvo:10.238.144.31 stiae icta https://mail.example.com/nvent/uepor.jpg?odiconse=nevolupt#tDui untutl < +10/3/2019:20:11:40 doei : NSNETSVC Message :"acomm: veleumi " +10/18/2019:03:14:14 sumquiad : TCP OTHERCONN_DELINK stl:Source 10.161.218.47:6184 - Vserver 10.29.202.248:4069 - NatIP 10.206.5.50:1064 - Destination 10.247.251.223:6658 - Delink Time 10/18/2019:03:14:14 GMT Total_bytes_send 6764 - Total_bytes_recv 7865 +11/1/2019:10:16:48 tate : DR HA_Message :"tutlabo: nto" +11/15/2019:17:19:22 tlabo : APPFW APPFW_BUFFEROVERFLOW_COOKIE :10.134.238.8 emu Malor amn: https://example.net/sintoc/rinci.txt?ali=Nequepor#aUten < +11/30/2019:00:21:57 adeseru : ICA SESSION_SETUP sitas:session_guid eni - device_serial_number cte - client_cookie ariatu - flags ess - session_setup_time ria - client_ip 10.111.22.134 - client_type datatno - client_launcher equepor - client_version 1.897 - client_hostname orisnis403.www.localhost - domain_name hend1170.www5.lan - server_name ptateve165.mail.corp - connection_priority ommodoco +SPCBId rita - ClientIP 10.148.72.78 - ClientPort 7584 - VserverServiceIP 10.37.99.189 - VserverServicePort 3275 - ClientVersion ugitsed - CipherSuite "ritatis" - success diff --git a/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json new file mode 100644 index 00000000000..861edae9b88 --- /dev/null +++ b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json @@ -0,0 +1,3094 @@ +[ + { + "event.code": "ICA_APPLICATION_LAUNCH", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/29/2016:06:09:59 avolupt : ICA APPLICATION_LAUNCH nnumqua:session_guid eacommod - device_serial_number rci - client_cookie olaboris - flags tur - launch_mechanism itv - app_launch_time 1/29/2016:06:09:59 - app_process_id odoco - app_name ria - module_path min", + "file.name": "min", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 0, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_APPLICATION_LAUNCH", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "APPLICATION_LAUNCH", + "rsa.time.starttime": "2016-01-29T08:09:59.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "GUI_CMD_EXECUTED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/12/2016:13:12:33 nulapari : GUI CMD_EXECUTED mwritten:User ctetur - Remote_ip 10.102.218.31 - Command \"deny -priority mipsumq -devno gnaali\" - Status \"enatus\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 262, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.102.218.31" + ], + "related.user": [ + "ctetur" + ], + "rsa.internal.event_desc": "CLI or GUI command executed in NetScaler", + "rsa.internal.messageid": "GUI_CMD_EXECUTED", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.disposition": "enatus", + "rsa.misc.msgIdPart1": "GUI", + "rsa.misc.msgIdPart2": "CMD_EXECUTED", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.102.218.31" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "ctetur" + }, + { + "event.code": "SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "02/26/2016:20:15:08 com : SSLLOG SSL_HANDSHAKE_SUBJECTNAME eataevi:SPCBId byC - SubjectName \"tinculp\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Debug", + "log.offset": 423, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.crypto.cert_subject": "tinculp", + "rsa.internal.messageid": "SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", + "rsa.misc.log_session_id": "byC", + "rsa.misc.msgIdPart1": "SSLLOG", + "rsa.misc.msgIdPart2": "SSL_HANDSHAKE_SUBJECTNAME", + "rsa.misc.severity": "Debug", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.134.175.248" + ], + "destination.port": 4496, + "event.code": "ACL_ACL_PKT_LOG", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/12/2016:03:17:42 maveniam : ACL ACL_PKT_LOG uian:Source 10.72.11.247:4780 --> Destination 10.134.175.248:4496 - Protocol udp - TimeStamp antium - Hitcount 1279 - Hit Rule lupta - Data iusmodt", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Notice", + "log.offset": 525, + "network.protocol": "udp", + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.72.11.247", + "10.134.175.248" + ], + "rsa.counters.dclass_c1": 1279, + "rsa.db.index": "antium", + "rsa.internal.event_desc": "ACL_PKT_LOG", + "rsa.internal.messageid": "ACL_ACL_PKT_LOG", + "rsa.misc.message_body": "iusmodt", + "rsa.misc.msgIdPart1": "ACL", + "rsa.misc.msgIdPart2": "ACL_PKT_LOG", + "rsa.misc.rule_name": "lupta", + "rsa.misc.severity": "Notice", + "rule.name": "lupta", + "service.type": "citrix", + "source.ip": [ + "10.72.11.247" + ], + "source.port": 4780, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "APPFW_COOKIE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "APPFW_COOKIE |1.3626|uaera|sitas|medium|src=10.12.182.150 spt=7788 method=iumto request=https://www5.example.net/sun/essecill.html?saute=vel#quu msg=undeo cn1=loremip cn2=rnatura cs1=isqu cs2=uis cs3=idolore cs4=very-high cs5=llumquid act=cancel", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "very-high", + "log.offset": 719, + "observer.product": "APPFW_COOKIE", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.3626", + "related.ip": [ + "10.12.182.150" + ], + "rsa.db.index": "undeo", + "rsa.internal.messageid": "APPFW_COOKIE", + "rsa.misc.action": [ + "cancel", + "iumto" + ], + "rsa.misc.policy_name": "isqu", + "rsa.misc.rule": "uaera", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3626", + "service.type": "citrix", + "source.ip": [ + "10.12.182.150" + ], + "source.port": 7788, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www5.example.net/sun/essecill.html?saute=vel#quu" + }, + { + "destination.bytes": 3671, + "destination.ip": [ + "10.83.234.60" + ], + "destination.nat.ip": "10.21.92.218", + "destination.nat.port": 4125, + "destination.port": 6178, + "event.code": "SSLVPN_UDPFLOWSTAT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/9/2016:17:22:51 rehe : SSLVPN UDPFLOWSTAT :Context ume - SessionId: incidi- User picia - Client_ip 10.109.68.21 - Nat_ip 10.96.119.12 - Vserver 10.83.234.60:6178 - Source 10.156.210.168:6317 - Destination 10.21.92.218:4125 - Start_time \" 4/9/2016:17:22:51 GMT\" - End_time \" 4/9/2016:17:22:51\" - Duration agnaali - Total_bytes_send 4138 - Total_bytes_recv 3671 - Access inima - Group(s) \"tlabo\"", + "fileset.name": "netscaler", + "group.name": "tlabo", + "host.ip": "10.109.68.21", + "input.type": "log", + "log.level": "Informational", + "log.offset": 965, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.96.119.12", + "10.21.92.218", + "10.109.68.21", + "10.83.234.60", + "10.156.210.168" + ], + "related.user": [ + "picia" + ], + "rsa.internal.event_desc": "SSLVPN UDP Flow Statistics", + "rsa.internal.messageid": "SSLVPN_UDPFLOWSTAT", + "rsa.misc.disposition": "inima", + "rsa.misc.group": "tlabo", + "rsa.misc.log_session_id": "incidi", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "UDPFLOWSTAT", + "rsa.misc.severity": "Informational", + "rsa.time.duration_str": "agnaali", + "rsa.time.endtime": "2016-04-09T19:22:51.000Z", + "rsa.time.starttime": "2016-04-09T19:22:51.000Z", + "service.type": "citrix", + "source.bytes": 4138, + "source.ip": [ + "10.156.210.168" + ], + "source.nat.ip": "10.96.119.12", + "source.port": 6317, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "picia" + }, + { + "event.code": "ICA_SESSION_TERMINATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/24/2016:00:25:25 iineavo : ICA SESSION_TERMINATE equatD:session_guid isno - device_serial_number taliq - client_cookie intoccae - flags ents - session_end_time 4/24/2016:00:25:25", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 1361, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_SESSION_TERMINATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_TERMINATE", + "rsa.time.endtime": "2016-04-24T02:25:25.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/8/2016:07:27:59 sinto : APPFW Message :\"Duplicate rule id emoeni\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Warning", + "log.offset": 1542, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Invalid/Duplicate Rule id", + "rsa.internal.messageid": "APPFW_Message", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "Message", + "rsa.misc.severity": "Warning", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_REFERER_HEADER", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/22/2016:14:30:33 inesci : APPFW APPFW_REFERER_HEADER :10.109.157.63 mqu apariat tlabore https://www5.example.org/remi/saute.txt?ionevo=remagn#run Referer header check failed: referer header URL 'https://www.example.net/uovolup/samvolu.html?licab=eirure#conseq' not in Start URL or closure list <", + "fileset.name": "netscaler", + "http.request.referrer": "https://www.example.net/uovolup/samvolu.html?licab=eirure#conseq", + "input.type": "log", + "log.level": "Informational", + "log.offset": 1610, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.109.157.63" + ], + "rsa.internal.event_desc": "referer header URL not in Start URL or closure list", + "rsa.internal.messageid": "APPFW_APPFW_REFERER_HEADER", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.disposition": "oidentsu", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_REFERER_HEADER", + "rsa.misc.rule_group": "tlabore", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.109.157.63" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www5.example.org/remi/saute.txt?ionevo=remagn#run" + }, + { + "destination.ip": [ + "10.116.193.182" + ], + "event.code": "SSLVPN_REMOVE_SESSION_ERR", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "6/5/2016:21:33:08 ern : SSLVPN REMOVE_SESSION_ERR :Sessionid psaquae - User ationemu - Client_ip 10.92.161.8 - Nat_ip 10.103.118.137 - Vserver_ip 10.116.193.182 - Errmsg \" snostrud \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 1918, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.92.161.8", + "10.103.118.137", + "10.116.193.182" + ], + "related.user": [ + "ationemu" + ], + "rsa.internal.event_desc": "snostrud", + "rsa.internal.messageid": "SSLVPN_REMOVE_SESSION_ERR", + "rsa.misc.log_session_id": "psaquae", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "REMOVE_SESSION_ERR", + "service.type": "citrix", + "source.ip": [ + "10.92.161.8" + ], + "source.nat.ip": "10.103.118.137", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "ationemu" + }, + { + "event.code": "EVENT_STARTSAVECONFIG", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "6/20/2016:04:35:42 quisnos : EVENT STARTSAVECONFIG :SAVECONFIG ite", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 2101, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "ite", + "rsa.internal.event_desc": "Save configuration started", + "rsa.internal.messageid": "EVENT_STARTSAVECONFIG", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STARTSAVECONFIG", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SNMP_TRAP_SENT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/4/2016:11:38:16 acc : SNMP TRAP_SENT :amc ( haPeerSystemState = \"amest\", sysIpAddress = 10.37.226.87)", + "fileset.name": "netscaler", + "host.ip": "10.37.226.87", + "input.type": "log", + "log.level": "Notice", + "log.offset": 2168, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.37.226.87" + ], + "rsa.internal.event_desc": "SNMP TRAP SENT", + "rsa.internal.messageid": "SNMP_TRAP_SENT", + "rsa.misc.event_state": "amest", + "rsa.misc.msgIdPart1": "SNMP", + "rsa.misc.msgIdPart2": "TRAP_SENT", + "rsa.misc.obj_type": "amc", + "rsa.misc.severity": "Notice", + "rsa.misc.space": "", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.bytes": 1287, + "destination.domain": "liqui", + "destination.nat.ip": "10.245.10.170", + "destination.nat.port": 3314, + "event.code": "SSLVPN_ICAEND_CONNSTAT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/18/2016:18:40:50 gel : SSLVPN ICAEND_CONNSTAT :Source 10.235.101.253:4467 - Destination 10.245.10.170:3314 - username:domainname ulapa:liqui - startTime \" 7/18/2016:18:40:50 GMT\" - endTime \" 7/18/2016:18:40:50\" - Duration quioffi - Total_bytes_send 1359 - Total_bytes_recv 1287 - Total_compressedbytes_send ncidid - Total_compressedbytes_recv quaturve - Compression_ratio_send sequa - Compression_ratio_recv aera - connectionId ate", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 2272, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.235.101.253", + "10.245.10.170" + ], + "related.user": [ + "ulapa" + ], + "rsa.counters.dclass_r1": "sequa", + "rsa.counters.dclass_r1_str": " Compression_ratio_send", + "rsa.counters.dclass_r2": "aera", + "rsa.counters.dclass_r2_str": " Compression_ratio_recv", + "rsa.internal.event_desc": "ICA connection related information for a connection belonging to a SSLVPN session", + "rsa.internal.messageid": "SSLVPN_ICAEND_CONNSTAT", + "rsa.misc.comp_rbytes": "quaturve", + "rsa.misc.comp_sbytes": "ncidid", + "rsa.misc.connection_id": "ate", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "ICAEND_CONNSTAT", + "rsa.misc.severity": "Informational", + "rsa.time.duration_str": "quioffi", + "rsa.time.endtime": "2016-07-18T20:40:50.000Z", + "rsa.time.starttime": "2016-07-18T20:40:50.000Z", + "service.type": "citrix", + "source.bytes": 1359, + "source.ip": [ + "10.235.101.253" + ], + "source.port": 4467, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "ulapa" + }, + { + "event.code": "EVENT_ALERTENDED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/2/2016:01:43:25 nsecte : EVENT ALERTENDED :inculpa.exe ended ", + "fileset.name": "netscaler", + "input.type": "log", + "log.flags": [ + "dissect_parsing_error" + ], + "log.offset": 2706, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "EVENT_ALERTENDED", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "ALERTENDED", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.162.161.83" + ], + "destination.port": 5025, + "event.code": "AAATM_HTTPREQUEST", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/16/2016:08:45:59 nisi : AAATM HTTPREQUEST :Context dant - SessionId: rroquis- aeabi User eiu : Group(s) ntiumdo : Vserver 10.162.161.83:5025 - 8/16/2016:08:45:59 PST: SSO is olupta : litse https://mail.example.com/itatio/uta.htm?sintoc=volupt#siste uiinea", + "event.timezone": "PST", + "fileset.name": "netscaler", + "group.name": "ntiumdo", + "input.type": "log", + "log.offset": 2770, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.162.161.83" + ], + "related.user": [ + "eiu" + ], + "rsa.internal.event_desc": "AAATM HTTP Request", + "rsa.internal.messageid": "AAATM_HTTPREQUEST", + "rsa.misc.action": [ + "litse" + ], + "rsa.misc.event_computer": "aeabi", + "rsa.misc.group": "ntiumdo", + "rsa.misc.log_session_id": "rroquis", + "rsa.misc.msgIdPart1": "AAATM", + "rsa.misc.msgIdPart2": "HTTPREQUEST", + "rsa.time.effective_time": "2016-08-16T10:45:59.000Z", + "rsa.time.timezone": "PST", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://mail.example.com/itatio/uta.htm?sintoc=volupt#siste", + "user.name": "eiu" + }, + { + "event.code": "ICA_APPLICATION_LAUNCH", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/30/2016:15:48:33 idolo : ICA APPLICATION_LAUNCH :session_guid quinesc - device_serial_number madmi - client_cookie tur - flags roi - launch_mechanism niamqui - app_launch_time 8/30/2016:15:48:33 - app_process_id orem - app_name sno - module_path atno", + "file.name": "atno", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 3028, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_APPLICATION_LAUNCH", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "APPLICATION_LAUNCH", + "rsa.time.starttime": "2016-08-30T17:48:33.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_XSS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/13/2016:22:51:07 ntocca : APPFW APPFW_XSS :10.26.55.33 quiavol Cross-sitehttps://internal.example.com/temquiav/equatu.txt?cons=sBon#orro script tae <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 3281, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.26.55.33" + ], + "rsa.db.index": "tae", + "rsa.internal.event_desc": "AppFw XSS violation", + "rsa.internal.messageid": "APPFW_APPFW_XSS", + "rsa.misc.disposition": "ccaec", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_XSS", + "rsa.misc.rule_group": "quiavol", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.26.55.33" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.com/temquiav/equatu.txt?cons=sBon#orro" + }, + { + "event.action": "sent request", + "event.code": "AAATM_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/28/2016:05:53:42 isc : AAATM Message ullamcor:\"sent request to tobea for authentication, user <, client ip 10.206.87.219\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 3440, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.206.87.219" + ], + "related.user": [ + "eavolup" + ], + "rsa.internal.messageid": "AAATM_Message", + "rsa.misc.event_type": "sent request", + "rsa.misc.msgIdPart1": "AAATM", + "rsa.misc.msgIdPart2": "Message", + "rsa.network.domain": "tor4410.api.localhost", + "server.domain": "tor4410.api.localhost", + "service.type": "citrix", + "source.ip": [ + "10.206.87.219" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "eavolup" + }, + { + "event.code": "SNMP_TRAP_SENT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/12/2016:12:56:16 litessec : SNMP TRAP_SENT :itas ( entityName = \"edquia (sequatu\" , sysIpAddress = 10.27.58.92)", + "fileset.name": "netscaler", + "host.ip": "10.27.58.92", + "input.type": "log", + "log.level": "Notice", + "log.offset": 3595, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.27.58.92" + ], + "rsa.db.index": "sequatu", + "rsa.internal.event_desc": "SNMP TRAP SENT", + "rsa.internal.messageid": "SNMP_TRAP_SENT", + "rsa.misc.msgIdPart1": "SNMP", + "rsa.misc.msgIdPart2": "TRAP_SENT", + "rsa.misc.obj_name": "edquia", + "rsa.misc.obj_type": "itas", + "rsa.misc.severity": "Notice", + "rsa.misc.space": "", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "tasn", + "event.code": "NSNETSVC_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/26/2016:19:58:50 qui : NSNETSVC Message :\"tasn: Nemoenim \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 3710, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "Nemoenim", + "rsa.internal.messageid": "NSNETSVC_Message", + "rsa.misc.event_type": "tasn", + "rsa.misc.msgIdPart1": "NSNETSVC", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_STOPSYS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/10/2016:03:01:24 str : EVENT STOPSYS :System stopped - idolore", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 3772, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "idolore", + "rsa.internal.event_desc": "Netscaler Stopped", + "rsa.internal.messageid": "EVENT_STOPSYS", + "rsa.investigations.ec_activity": "Stop", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STOPSYS", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SAFEOBJECT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/24/2016:10:03:59 illoin : APPFW APPFW_SAFEOBJECT tanimid:10.93.68.231 ctet Match found with Safe Object: ati <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 3838, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.93.68.231" + ], + "rsa.db.index": "ati", + "rsa.internal.event_desc": "AppFw Safe Object", + "rsa.internal.messageid": "APPFW_APPFW_SAFEOBJECT", + "rsa.misc.disposition": "uine", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SAFEOBJECT", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.93.68.231" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_POLICY_HIT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/8/2016:17:06:33 niamqui : APPFW APPFW_POLICY_HIT :10.236.120.18 adeser oin mvenia https://www5.example.org/fugitsed/quam.html?luptate=persp#entsunt ihilm", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 3958, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.236.120.18" + ], + "rsa.internal.event_desc": "ihilm", + "rsa.internal.messageid": "APPFW_APPFW_POLICY_HIT", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_POLICY_HIT", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.236.120.18" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www5.example.org/fugitsed/quam.html?luptate=persp#entsunt" + }, + { + "event.code": "RESPONDER_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/23/2016:00:09:07 meius : RESPONDER Message :\"NSRateLimit=billo, ClientIP=10.103.127.155\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 4115, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.103.127.155" + ], + "rsa.internal.messageid": "RESPONDER_Message", + "rsa.misc.filter": "billo", + "rsa.misc.msgIdPart1": "RESPONDER", + "rsa.misc.msgIdPart2": "Message", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.103.127.155" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_ALERTSTARTED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/6/2017:07:11:41 nonp : EVENT ALERTSTARTED :labo.exe started for 267", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 4207, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "process.name": "labo.exe", + "rsa.counters.dclass_c1": 267, + "rsa.internal.event_desc": "Alert process started", + "rsa.internal.messageid": "EVENT_ALERTSTARTED", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "ALERTSTARTED", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "APPFW_COOKIE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "APPFW_COOKIE |1.2352|rQu|mco|medium|src=10.206.81.23 spt=6280 method=tincu request=https://internal.example.com/itse/umexerc.gif?intocc=amcorp#ntsunt msg=uidol cn1=litani cn2=utodita cs1=aec cs2=fdeF cs3=iquidexe cs4=low cs5=niamq act=cancel", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "low", + "log.offset": 4277, + "observer.product": "APPFW_COOKIE", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.2352", + "related.ip": [ + "10.206.81.23" + ], + "rsa.db.index": "uidol", + "rsa.internal.messageid": "APPFW_COOKIE", + "rsa.misc.action": [ + "cancel", + "tincu" + ], + "rsa.misc.policy_name": "aec", + "rsa.misc.rule": "rQu", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2352", + "service.type": "citrix", + "source.ip": [ + "10.206.81.23" + ], + "source.port": 6280, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.com/itse/umexerc.gif?intocc=amcorp#ntsunt" + }, + { + "event.action": "accept", + "event.code": "ROUTING_ZEBOS_CMD_EXECUTED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/3/2017:21:16:50 ipsamvo : ROUTING ZEBOS_CMD_EXECUTED onula:miu Command \"accept\" upt", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 4519, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "upt", + "rsa.internal.event_desc": "User has executed a command in ZebOS(vtysh)", + "rsa.internal.messageid": "ROUTING_ZEBOS_CMD_EXECUTED", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.msgIdPart1": "ROUTING", + "rsa.misc.msgIdPart2": "ZEBOS_CMD_EXECUTED", + "rsa.misc.obj_type": "miu", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_NICRESET", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/18/2017:04:19:24 snost : EVENT NICRESET tpersp:llamc \"nte\" - State mvel", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 4605, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "The monitor bound to the service is up", + "rsa.internal.messageid": "EVENT_NICRESET", + "rsa.misc.event_state": "mvel", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "NICRESET", + "rsa.misc.obj_name": "nte", + "rsa.misc.obj_type": "llamc", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SAFECOMMERCE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/4/2017:11:21:59 eratvol : APPFW APPFW_SAFECOMMERCE :10.253.132.145 est uptatemU Maximum no. https://internal.example.com/tla/item.jpg?isa=niamqui#atcupid of potential credit card numbers seen <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 4679, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.253.132.145" + ], + "rsa.db.index": "quamnih", + "rsa.internal.event_desc": "AppFw SafeCommerce credit cards seen", + "rsa.internal.messageid": "APPFW_APPFW_SAFECOMMERCE", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SAFECOMMERCE", + "rsa.misc.rule_group": "uptatemU", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.253.132.145" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.com/tla/item.jpg?isa=niamqui#atcupid" + }, + { + "event.code": "AAA_LOGIN_FAILED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/18/2017:18:24:33 naaliq : AAA LOGIN_FAILED :User nte - Client_ip 10.5.67.143 - Failure_reason \"unknown\"", + "event.outcome": "failure", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Alert", + "log.offset": 4884, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.5.67.143" + ], + "related.user": [ + "nte" + ], + "rsa.internal.event_desc": "The aaa module failed to login the user", + "rsa.internal.messageid": "AAA_LOGIN_FAILED", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.msgIdPart1": "AAA", + "rsa.misc.msgIdPart2": "LOGIN_FAILED", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "Alert", + "service.type": "citrix", + "source.ip": [ + "10.5.67.143" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "nte" + }, + { + "event.code": "ICA_SESSION_TERMINATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/2/2017:01:27:07 loi : ICA SESSION_TERMINATE isc:session_guid Nequepor - device_serial_number eirure - client_cookie deserun - flags esseq - session_end_time 4/2/2017:01:27:07", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 4990, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_SESSION_TERMINATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_TERMINATE", + "rsa.time.endtime": "2017-04-02T03:27:07.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.domain": "teni", + "destination.nat.ip": "10.32.39.220", + "destination.nat.port": 3589, + "event.code": "SSLVPN_ICASTART", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/16/2017:08:29:41 iquamqua : SSLVPN ICASTART :Source 10.248.165.185:3436 - Destination 10.32.39.220:3589 - username:domainname exeaco:teni - applicationName dquiac - startTime \" 4/16/2017:08:29:41\" - connectionId itaedict", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 5167, + "network.application": "dquiac", + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.248.165.185", + "10.32.39.220" + ], + "related.user": [ + "exeaco" + ], + "rsa.internal.messageid": "SSLVPN_ICASTART", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "ICASTART", + "rsa.time.starttime": "2017-04-16T10:29:41.000Z", + "service.type": "citrix", + "source.ip": [ + "10.248.165.185" + ], + "source.port": 3436, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "exeaco" + }, + { + "destination.ip": [ + "10.82.28.220" + ], + "event.code": "SSLVPN_REMOVE_SESSION_ERR", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/30/2017:15:32:16 mUten : SSLVPN REMOVE_SESSION_ERR emq:Sessionid maperi - User agnaaliq - Client_ip 10.197.6.245 - Nat_ip 10.81.45.174 - Vserver_ip 10.82.28.220 - Errmsg \" mve \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 5390, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.197.6.245", + "10.81.45.174", + "10.82.28.220" + ], + "related.user": [ + "agnaaliq" + ], + "rsa.internal.event_desc": "mve", + "rsa.internal.messageid": "SSLVPN_REMOVE_SESSION_ERR", + "rsa.misc.log_session_id": "maperi", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "REMOVE_SESSION_ERR", + "service.type": "citrix", + "source.ip": [ + "10.197.6.245" + ], + "source.nat.ip": "10.81.45.174", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "agnaaliq" + }, + { + "event.code": "EVENT_STARTSAVECONFIG", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/14/2017:22:34:50 cipitl : EVENT STARTSAVECONFIG :SAVECONFIG caboNemo", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 5570, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "caboNemo", + "rsa.internal.event_desc": "Save configuration started", + "rsa.internal.messageid": "EVENT_STARTSAVECONFIG", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STARTSAVECONFIG", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.domain": "isqua", + "destination.ip": [ + "10.18.25.125" + ], + "destination.port": 7202, + "event.code": "SSLVPN_ICASTART", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/29/2017:05:37:24 uto : SSLVPN ICASTART iuntNequ:Server port = 7202 - Server server ip = 10.18.25.125 - username:domain_name = quatD:isqua - application name = uta", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 5641, + "network.application": "uta", + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.18.25.125" + ], + "related.user": [ + "quatD" + ], + "rsa.internal.event_desc": "ICA started", + "rsa.internal.messageid": "SSLVPN_ICASTART", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "ICASTART", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "quatD" + }, + { + "event.code": "ICA_CHANNEL_UPDATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "6/12/2017:12:39:58 tsed : ICA CHANNEL_UPDATE :session_guid eturad - device_serial_number tiumdolo - client_cookie atuse - flags ueipsa - channel_update_begin 6/12/2017:12:39:58 - channel_update_end 6/12/2017:12:39:58 - channel_id_1 scipitl - channel_id_1_val eumi - channel_id_2 quasiarc - channel_id_2_val olli -channel_id_3 rever - channel_id_3_val ore - channel_id_4 offici - channel_id_4_val ection -channel_id_5 roquisqu - channel_id_5_val edolorin", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 5806, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_CHANNEL_UPDATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "CHANNEL_UPDATE", + "rsa.time.endtime": "2017-06-12T14:39:58.000Z", + "rsa.time.starttime": "2017-06-12T14:39:58.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "CLUSTERD_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "6/26/2017:19:42:33 aspe : CLUSTERD Message imadmi: \"isnis(10.230.93.243) port(1625) msglen(iatqu) rcv(6203) R(unknown) \" ", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 6260, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "isnis(10.230.93.243) port(1625) msglen(iatqu) rcv(6203) R(unknown)", + "rsa.internal.messageid": "CLUSTERD_Message", + "rsa.misc.msgIdPart1": "CLUSTERD", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_BUFFEROVERFLOW_HDR", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/11/2017:02:45:07 liquid : APPFW APPFW_BUFFEROVERFLOW_HDR :10.13.181.73 ate mporainc xea: https://www.example.org/umdolo/ntiu.jpg?dquiaco=nibus#vitaed <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 6382, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.13.181.73" + ], + "rsa.db.index": "xea", + "rsa.internal.event_desc": "AppFw Buffer Overflow violation in HTTP Headers", + "rsa.internal.messageid": "APPFW_APPFW_BUFFEROVERFLOW_HDR", + "rsa.misc.disposition": "ser", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_BUFFEROVERFLOW_HDR", + "rsa.misc.rule_group": "mporainc", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.13.181.73" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www.example.org/umdolo/ntiu.jpg?dquiaco=nibus#vitaed" + }, + { + "event.code": "APPFW_APPFW_COOKIE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/25/2017:09:47:41 isi : APPFW APPFW_COOKIE culpaq:10.162.97.197 ende abor Cookiehttps://internal.example.org/adol/iutal.gif?niam=pernat#rerepre validation failed for nculpaq <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 6541, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.162.97.197" + ], + "rsa.internal.event_desc": "AppFw Cookie violation", + "rsa.internal.messageid": "APPFW_APPFW_COOKIE", + "rsa.misc.disposition": "culpaqui", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_COOKIE", + "rsa.misc.rule_group": "abor", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.162.97.197" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.org/adol/iutal.gif?niam=pernat#rerepre" + }, + { + "event.code": "User", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "User nisiu - Remote_ip 10.101.178.146 - Command \"ptatem\" - Status \"unknown\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 6728, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.101.178.146" + ], + "related.user": [ + "nisiu" + ], + "rsa.internal.messageid": "User", + "rsa.misc.result": "unknown", + "service.type": "citrix", + "source.ip": [ + "10.101.178.146" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "nisiu" + }, + { + "event.code": "APPFW_APPFW_REFERER_HEADER", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/22/2017:23:52:50 onproide : APPFW APPFW_REFERER_HEADER ntmo:10.143.88.119 tNe pisc urEx https://www.example.com/tquidol/ercitat.txt?atcupi=atem#qui Referer header check failed: referer header URL 'https://mail.example.com/nim/ame.jpg?uid=equaturv#lamc' not in Start URL or closure list <", + "fileset.name": "netscaler", + "http.request.referrer": "https://mail.example.com/nim/ame.jpg?uid=equaturv#lamc", + "input.type": "log", + "log.level": "Informational", + "log.offset": 6804, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.143.88.119" + ], + "rsa.internal.event_desc": "referer header URL not in Start URL or closure list", + "rsa.internal.messageid": "APPFW_APPFW_REFERER_HEADER", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.disposition": "mvolupta", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_REFERER_HEADER", + "rsa.misc.rule_group": "urEx", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.143.88.119" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www.example.com/tquidol/ercitat.txt?atcupi=atem#qui" + }, + { + "event.action": "allow", + "event.code": "ROUTING_ZEBOS_CMD_EXECUTED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/6/2017:06:55:24 equatDu : ROUTING ZEBOS_CMD_EXECUTED :pta Command \"allow\" prehe", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 7104, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "prehe", + "rsa.internal.event_desc": "User has executed a command in ZebOS(vtysh)", + "rsa.internal.messageid": "ROUTING_ZEBOS_CMD_EXECUTED", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.msgIdPart1": "ROUTING", + "rsa.misc.msgIdPart2": "ZEBOS_CMD_EXECUTED", + "rsa.misc.obj_type": "pta", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.45.114.111" + ], + "destination.nat.ip": "10.3.23.172", + "destination.nat.port": 7332, + "destination.port": 357, + "event.code": "SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/20/2017:13:57:58 illoi : SSLVPN NONHTTP_RESOURCEACCESS_DENIED :Context reetdolo - SessionId: rationev- User ehender - Client_ip 10.117.94.131 - Nat_ip 10.180.83.140 - Vserver 10.45.114.111:357 - Source 10.243.226.122:3512 - Destination 10.3.23.172:7332 - Total_bytes_send emullamc - Total_bytes_recv tec - Denied_by_policy \"Nemo\" - Group(s) \"tutlabo\"", + "event.outcome": "failure", + "fileset.name": "netscaler", + "group.name": "tutlabo", + "host.ip": "10.117.94.131", + "input.type": "log", + "log.offset": 7186, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.45.114.111", + "10.180.83.140", + "10.243.226.122", + "10.117.94.131", + "10.3.23.172" + ], + "related.user": [ + "ehender" + ], + "rsa.internal.messageid": "SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", + "rsa.investigations.ec_activity": "Request", + "rsa.investigations.ec_outcome": "Failure", + "rsa.misc.comp_rbytes": "tec", + "rsa.misc.comp_sbytes": "emullamc", + "rsa.misc.group": "tutlabo", + "rsa.misc.log_session_id": "rationev", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "NONHTTP_RESOURCEACCESS_DENIED", + "service.type": "citrix", + "source.ip": [ + "10.243.226.122" + ], + "source.nat.ip": "10.180.83.140", + "source.port": 3512, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "ehender" + }, + { + "event.code": "EVENT_DEVICEUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/4/2017:21:00:32 iame : EVENT DEVICEUP laudanti:umiurer \"rere\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Notice", + "log.offset": 7539, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Device UP", + "rsa.internal.messageid": "EVENT_DEVICEUP", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "DEVICEUP", + "rsa.misc.obj_name": "rere", + "rsa.misc.obj_type": "umiurer", + "rsa.misc.severity": "Notice", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_COOKIE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/19/2017:04:03:07 ori : APPFW APPFW_COOKIE uamqu:10.76.92.223 quiac sunt Cookiehttps://www5.example.org/emUte/iusmodi.htm?tura=osquirat#equat validation failed for aliquid <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 7604, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.76.92.223" + ], + "rsa.internal.event_desc": "AppFw Cookie violation", + "rsa.internal.messageid": "APPFW_APPFW_COOKIE", + "rsa.misc.disposition": "usantiu", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_COOKIE", + "rsa.misc.rule_group": "sunt", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.76.92.223" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www5.example.org/emUte/iusmodi.htm?tura=osquirat#equat" + }, + { + "event.action": "etur", + "event.code": "AAATM_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/2/2017:11:05:41 sun : AAATM Message urau:\"etur: rsitvol \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 7789, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "rsitvol", + "rsa.internal.messageid": "AAATM_Message", + "rsa.misc.event_type": "etur", + "rsa.misc.msgIdPart1": "AAATM", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SSLVPN_CLISEC_CHECK", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/16/2017:18:08:15 eque : SSLVPN CLISEC_CHECK eufug:User est - Client IP 10.101.172.233 - Vserver 10.211.163.7:940 - Client_security_expression \"CLIENT.REG('iatnu').VALUE == writte || sitvo - failure", + "fileset.name": "netscaler", + "host.ip": "10.101.172.233", + "input.type": "log", + "log.offset": 7850, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.101.172.233", + "10.211.163.7" + ], + "related.user": [ + "est" + ], + "rsa.db.index": "iatnu", + "rsa.internal.event_desc": "SNMP TRAP SENT", + "rsa.internal.messageid": "SSLVPN_CLISEC_CHECK", + "rsa.misc.change_new": "sitvo", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "CLISEC_CHECK", + "rsa.misc.result": "failure", + "rsa.misc.trigger_val": "writte", + "service.type": "citrix", + "source.ip": [ + "10.211.163.7" + ], + "source.port": 940, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "est" + }, + { + "event.code": "DR_HA_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/1/2017:01:10:49 llumq : DR HA_Message :\"HASTATE tenim\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8051, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "tenim", + "rsa.internal.event_desc": "Routing details", + "rsa.internal.messageid": "DR_HA_Message", + "rsa.misc.msgIdPart1": "DR", + "rsa.misc.msgIdPart2": "HA_Message", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/15/2017:08:13:24 itseddo : APPFW Message bore:\"Setting same CustomSettings( ) to profile. ptate\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 8109, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Setting same CustomSettings( ) to profile.", + "rsa.internal.messageid": "APPFW_Message", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.domain": "Finibus", + "destination.nat.ip": "10.61.175.217", + "destination.nat.port": 2631, + "event.code": "SSLVPN_ICASTART", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/29/2017:15:15:58 mvenia : SSLVPN ICASTART :Source 10.29.207.55:7061 - Destination 10.61.175.217:2631 - username:domainname scip:Finibus - applicationName Utenimad - startTime 12/29/2017:15:15:58 - connectionId olupta", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 8209, + "network.application": "Utenimad", + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.29.207.55", + "10.61.175.217" + ], + "related.user": [ + "scip" + ], + "rsa.internal.messageid": "SSLVPN_ICASTART", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "ICASTART", + "rsa.time.starttime": "2017-12-29T17:15:58.000Z", + "service.type": "citrix", + "source.ip": [ + "10.29.207.55" + ], + "source.port": 7061, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "scip" + }, + { + "event.code": "SSLVPN_AAAEXTRACTED_GROUPS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/12/2018:22:18:32 fficia : SSLVPN AAAEXTRACTED_GROUPS est:Extracted_groups \"ali\"", + "fileset.name": "netscaler", + "group.name": "ali", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8429, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "The groups extracted after user logs into SSLVPN", + "rsa.internal.messageid": "SSLVPN_AAAEXTRACTED_GROUPS", + "rsa.misc.group": "ali", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "AAAEXTRACTED_GROUPS", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_BUFFEROVERFLOW_URL", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/27/2018:05:21:06 ceroi : APPFW APPFW_BUFFEROVERFLOW_URL :10.55.203.193 idunt edqu cte: https://internal.example.org/CSe/exerci.htm?eserun=pta#emu <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8511, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.55.203.193" + ], + "rsa.db.index": "cte", + "rsa.internal.event_desc": "AppFw Buffer Overflow violation in URL", + "rsa.internal.messageid": "APPFW_APPFW_BUFFEROVERFLOW_URL", + "rsa.misc.disposition": "orem", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_BUFFEROVERFLOW_URL", + "rsa.misc.rule_group": "edqu", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.55.203.193" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.org/CSe/exerci.htm?eserun=pta#emu" + }, + { + "event.code": "EVENT_STATECHANGE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/10/2018:12:23:41 orp : EVENT STATECHANGE :ender (dico) - uptatem upt", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8667, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "upt", + "rsa.internal.event_desc": "Heartbeat State report", + "rsa.internal.messageid": "EVENT_STATECHANGE", + "rsa.misc.event_state": "uptatem", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STATECHANGE", + "rsa.misc.obj_name": "dico", + "rsa.misc.obj_type": "ender", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_STARTSYS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/24/2018:19:26:15 idolo : EVENT STARTSYS reet:System started - lorem", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8738, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "lorem", + "rsa.internal.event_desc": "Netscaler Started", + "rsa.internal.messageid": "EVENT_STARTSYS", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STARTSYS", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SAFECOMMERCE_XFORM", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/11/2018:02:28:49 tmo : APPFW APPFW_SAFECOMMERCE_XFORM onofdeF:10.189.13.237 its https://www5.example.org/aliqui/datatnon.gif?nse=miurere#evit (uatu) potential credit card numbers seen in server response", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 8808, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.189.13.237" + ], + "rsa.db.index": "uatu", + "rsa.internal.event_desc": "AppFw SafeCommerce Transformed for credit cards seen in server repsonse", + "rsa.internal.messageid": "APPFW_APPFW_SAFECOMMERCE_XFORM", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SAFECOMMERCE_XFORM", + "rsa.misc.rule_group": "its", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.189.13.237" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www5.example.org/aliqui/datatnon.gif?nse=miurere#evit" + }, + { + "event.code": "EVENT_DEVICEUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/25/2018:09:31:24 uamestqu : EVENT DEVICEUP mpor:orem \"eniamqui\" - State ven", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Notice", + "log.offset": 9013, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Device UP", + "rsa.internal.messageid": "EVENT_DEVICEUP", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.event_state": "ven", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "DEVICEUP", + "rsa.misc.obj_name": "eniamqui", + "rsa.misc.obj_type": "orem", + "rsa.misc.severity": "Notice", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_CONFIGEND", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/8/2018:16:33:58 tdolorem : EVENT CONFIGEND :CONFIG qui", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 9091, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "qui", + "rsa.internal.event_desc": "Configuration read completed from ns.conf file during boot-up", + "rsa.internal.messageid": "EVENT_CONFIGEND", + "rsa.investigations.ec_activity": "Stop", + "rsa.investigations.ec_subject": "Configuration", + "rsa.investigations.ec_theme": "Configuration", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "CONFIGEND", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_STARTSYS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/22/2018:23:36:32 deritinv : EVENT STARTSYS evelite:System started - cupidata", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 9148, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "cupidata", + "rsa.internal.event_desc": "Netscaler Started", + "rsa.internal.messageid": "EVENT_STARTSYS", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STARTSYS", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "ICA_SESSION_TERMINATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/7/2018:06:39:06 emeu : ICA SESSION_TERMINATE :session_guid tatemac - device_serial_number quisn - client_cookie rem - flags ulamcola - session_end_time 5/7/2018:06:39:06", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 9227, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_SESSION_TERMINATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_TERMINATE", + "rsa.time.endtime": "2018-05-07T08:39:06.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_CSRF_TAG", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/21/2018:13:41:41 uisaut : APPFW APPFW_CSRF_TAG :10.23.202.99 tuser CSRF Tag validation failed: <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 9399, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.23.202.99" + ], + "rsa.internal.event_desc": "AppFw CSRF Tag Validation Failed", + "rsa.internal.messageid": "APPFW_APPFW_CSRF_TAG", + "rsa.misc.disposition": "ctasu", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_CSRF_TAG", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.23.202.99" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_ROUTEUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "6/4/2018:20:44:15 sitame : EVENT ROUTEUP :oinven natu - State edqu", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Debug", + "log.offset": 9505, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Route is UP", + "rsa.internal.messageid": "EVENT_ROUTEUP", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.event_state": "edqu", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "ROUTEUP", + "rsa.misc.obj_name": "natu", + "rsa.misc.obj_type": "oinven", + "rsa.misc.severity": "Debug", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "APPFW_FIELDCONSISTENCY", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "APPFW_FIELDCONSISTENCY |1.1396|ntutlab|rumSecti|medium|src=10.72.114.116 spt=2840 method=tesse request=https://internal.example.org/isno/oluptas.html?aeco=rinrepr#dutp msg=orem cn1=giatqu cn2=rsint cs1=rsi cs2=paq cs3=uianon cs4=high cs5=uisautem act=allow", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "high", + "log.offset": 9572, + "observer.product": "APPFW_FIELDCONSISTENCY", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.1396", + "related.ip": [ + "10.72.114.116" + ], + "rsa.db.index": "orem", + "rsa.internal.messageid": "APPFW_FIELDCONSISTENCY", + "rsa.misc.action": [ + "tesse", + "allow" + ], + "rsa.misc.policy_name": "rsi", + "rsa.misc.rule": "ntutlab", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1396", + "service.type": "citrix", + "source.ip": [ + "10.72.114.116" + ], + "source.port": 2840, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.org/isno/oluptas.html?aeco=rinrepr#dutp" + }, + { + "event.action": "allow", + "event.code": "ROUTING_ZEBOS_CMD_EXECUTED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/3/2018:10:49:23 reprehen : ROUTING ZEBOS_CMD_EXECUTED tvol:ptat Command \"allow\" tdolo", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 9829, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "tdolo", + "rsa.internal.event_desc": "User has executed a command in ZebOS(vtysh)", + "rsa.internal.messageid": "ROUTING_ZEBOS_CMD_EXECUTED", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.msgIdPart1": "ROUTING", + "rsa.misc.msgIdPart2": "ZEBOS_CMD_EXECUTED", + "rsa.misc.obj_type": "ptat", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_STARTCPU", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/17/2018:17:51:58 porissus : EVENT STARTCPU :CPU_started imip", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 9917, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "imip", + "rsa.internal.event_desc": "CPU Started", + "rsa.internal.messageid": "EVENT_STARTCPU", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "STARTCPU", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "ICA_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/1/2018:00:54:32 eumfu : ICA Message :docons", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 9980, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "docons", + "rsa.internal.messageid": "ICA_Message", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "08/15/2018:07:57:06 turvelil : SSLLOG SSL_HANDSHAKE_SUBJECTNAME urExc:SPCBId doconse - SubjectName \"audant\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Debug", + "log.offset": 10026, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.crypto.cert_subject": "audant", + "rsa.internal.messageid": "SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", + "rsa.misc.log_session_id": "doconse", + "rsa.misc.msgIdPart1": "SSLLOG", + "rsa.misc.msgIdPart2": "SSL_HANDSHAKE_SUBJECTNAME", + "rsa.misc.severity": "Debug", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SNMP_TRAP_SENT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/29/2018:14:59:40 teturad : SNMP TRAP_SENT :ese (entityName = \"eddoei\", sysIpAddress = 10.161.68.13)", + "fileset.name": "netscaler", + "host.ip": "10.161.68.13", + "input.type": "log", + "log.offset": 10134, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.161.68.13" + ], + "rsa.internal.event_desc": "SNMP TRAP SENT", + "rsa.internal.messageid": "SNMP_TRAP_SENT", + "rsa.misc.msgIdPart1": "SNMP", + "rsa.misc.msgIdPart2": "TRAP_SENT", + "rsa.misc.obj_name": "eddoei", + "rsa.misc.obj_type": "ese", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "AAA_LOGIN_FAILED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/12/2018:22:02:15 tdolo : AAA LOGIN_FAILED :User ident - Client_ip 10.213.165.165 - Failure_reason \"success\"", + "event.outcome": "failure", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Alert", + "log.offset": 10236, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.213.165.165" + ], + "related.user": [ + "ident" + ], + "rsa.internal.event_desc": "The aaa module failed to login the user", + "rsa.internal.messageid": "AAA_LOGIN_FAILED", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.msgIdPart1": "AAA", + "rsa.misc.msgIdPart2": "LOGIN_FAILED", + "rsa.misc.result": "success", + "rsa.misc.severity": "Alert", + "service.type": "citrix", + "source.ip": [ + "10.213.165.165" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "ident" + }, + { + "destination.ip": [ + "10.41.65.89" + ], + "event.code": "SSLVPN_REMOVE_SESSION_ERR", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/27/2018:05:04:49 tetura : SSLVPN REMOVE_SESSION_ERR autemv:Sessionid sciveli - User picia - Client_ip 10.225.146.5 - Nat_ip 10.80.5.101 - Vserver_ip 10.41.65.89 - Errmsg \" lapari \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 10346, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.80.5.101", + "10.41.65.89", + "10.225.146.5" + ], + "related.user": [ + "picia" + ], + "rsa.internal.event_desc": "lapari", + "rsa.internal.messageid": "SSLVPN_REMOVE_SESSION_ERR", + "rsa.misc.log_session_id": "sciveli", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "REMOVE_SESSION_ERR", + "service.type": "citrix", + "source.ip": [ + "10.225.146.5" + ], + "source.nat.ip": "10.80.5.101", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "picia" + }, + { + "event.code": "APPFW_APPFW_REFERER_HEADER", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/11/2018:12:07:23 tMal : APPFW APPFW_REFERER_HEADER porin:10.241.143.145 quid aUten Duis https://www.example.org/quid/accus.html?edutpers=ctobeat#upta Referer header check failed: referer header URL 'https://mail.example.com/dictasun/psa.txt?secte=ctobeat#onsec' not in Start URL or closure list <", + "fileset.name": "netscaler", + "http.request.referrer": "https://mail.example.com/dictasun/psa.txt?secte=ctobeat#onsec", + "input.type": "log", + "log.level": "Informational", + "log.offset": 10529, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.241.143.145" + ], + "rsa.internal.event_desc": "referer header URL not in Start URL or closure list", + "rsa.internal.messageid": "APPFW_APPFW_REFERER_HEADER", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.disposition": "idestl", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_REFERER_HEADER", + "rsa.misc.rule_group": "Duis", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.241.143.145" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www.example.org/quid/accus.html?edutpers=ctobeat#upta" + }, + { + "event.code": "ROUTING_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/25/2018:19:09:57 ree : ROUTING Message :\"itten started\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 10837, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ROUTING_Message", + "rsa.misc.msgIdPart1": "ROUTING", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SAFECOMMERCE_XFORM", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/9/2018:02:12:32 temaccu : APPFW APPFW_SAFECOMMERCE_XFORM uamqua:10.106.34.244 eumiu https://example.com/pteurs/ercitati.html?ptat=mipsu#velillu (ecatcupi) potential credit card numbers seen in server response", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 10896, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.106.34.244" + ], + "rsa.db.index": "ecatcupi", + "rsa.internal.event_desc": "AppFw SafeCommerce Transformed for credit cards seen in server repsonse", + "rsa.internal.messageid": "APPFW_APPFW_SAFECOMMERCE_XFORM", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SAFECOMMERCE_XFORM", + "rsa.misc.rule_group": "eumiu", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.106.34.244" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://example.com/pteurs/ercitati.html?ptat=mipsu#velillu" + }, + { + "destination.ip": [ + "10.33.231.173" + ], + "event.code": "SSLVPN_REMOVE_SESSION_INFO", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/23/2018:09:15:06 iquipex : SSLVPN REMOVE_SESSION_INFO mqu:Sessionid onorume - User abill - Client_ip 10.22.34.206 - Nat_ip \"10.183.26.222\" - Vserver_ip 10.33.231.173 - Errmsg \" uasiarch \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 11108, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.33.231.173", + "10.183.26.222", + "10.22.34.206" + ], + "related.user": [ + "abill" + ], + "rsa.internal.event_desc": "uasiarch", + "rsa.internal.messageid": "SSLVPN_REMOVE_SESSION_INFO", + "rsa.misc.log_session_id": "onorume", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "REMOVE_SESSION_INFO", + "service.type": "citrix", + "source.ip": [ + "10.22.34.206" + ], + "source.nat.ip": "10.183.26.222", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "abill" + }, + { + "event.code": "EVENT_DEVICEDOWN", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/7/2018:16:17:40 stenat : EVENT DEVICEDOWN :uianonnu \"tatiset\" - State quira", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Notice", + "log.offset": 11299, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Device Down", + "rsa.internal.messageid": "EVENT_DEVICEDOWN", + "rsa.investigations.ec_activity": "Stop", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.event_state": "quira", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "DEVICEDOWN", + "rsa.misc.obj_name": "tatiset", + "rsa.misc.obj_type": "uianonnu", + "rsa.misc.severity": "Notice", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_MONITORUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "12/21/2018:23:20:14 samvol : EVENT MONITORUP :equa apari - State tsunt", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 11378, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "The monitor bound to the service is up", + "rsa.internal.messageid": "EVENT_MONITORUP", + "rsa.misc.event_state": "tsunt", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "MONITORUP", + "rsa.misc.obj_name": "apari", + "rsa.misc.obj_type": "equa", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SNMP_TRAP_SENT", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/5/2019:06:22:49 llo : SNMP TRAP_SENT :uames ( alarmRateLmtThresholdExceeded = \"tla: \"iaconseq...\", ipAddressGathered = \"sed\", stringComputed = \"sedd\", sysIpAddress = 10.53.113.79)", + "fileset.name": "netscaler", + "host.ip": "10.53.113.79", + "input.type": "log", + "log.level": "Notice", + "log.offset": 11449, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.53.113.79" + ], + "rsa.db.index": "iaconseq", + "rsa.internal.event_desc": "SNMP TRAP SENT", + "rsa.internal.messageid": "SNMP_TRAP_SENT", + "rsa.misc.msgIdPart1": "SNMP", + "rsa.misc.msgIdPart2": "TRAP_SENT", + "rsa.misc.obj_name": "tla", + "rsa.misc.obj_type": "uames", + "rsa.misc.severity": "Notice", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_ROUTEDOWN", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "1/19/2019:13:25:23 luptatev : EVENT ROUTEDOWN :occaeca dan - State pta", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 11631, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Route is Down", + "rsa.internal.messageid": "EVENT_ROUTEDOWN", + "rsa.investigations.ec_activity": "Stop", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.event_state": "pta", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "ROUTEDOWN", + "rsa.misc.obj_name": "dan", + "rsa.misc.obj_type": "occaeca", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "SSLLOG_SSL_HANDSHAKE_ISSUERNAME", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "02/02/2019:20:27:57 equamni : SSLLOG SSL_HANDSHAKE_ISSUERNAME atcupi:SPCBId enima - IssuerName \"uptateve\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Debug", + "log.offset": 11702, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "SSLLOG_SSL_HANDSHAKE_ISSUERNAME", + "rsa.misc.log_session_id": "enima", + "rsa.misc.msgIdPart1": "SSLLOG", + "rsa.misc.msgIdPart2": "SSL_HANDSHAKE_ISSUERNAME", + "rsa.misc.severity": "Debug", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "ICA_APPLICATION_TERMINATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "2/17/2019:03:30:32 uiac : ICA APPLICATION_TERMINATE :session_guid tquii - device_serial_number tesse - client_cookie iamea - flags loremi - app_termination_type queporro - app_process_id tur - app_termination_time 2/17/2019:03:30:32", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 11808, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_APPLICATION_TERMINATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "APPLICATION_TERMINATE", + "rsa.time.endtime": "2019-02-17T05:30:32.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SAFECOMMERCE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/3/2019:10:33:06 tamrema : APPFW APPFW_SAFECOMMERCE isautem:10.219.65.172 conse Maximum no. https://internal.example.net/edqui/tvolu.txt?ore=lors#saute of potential credit card numbers seen <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 12041, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.219.65.172" + ], + "rsa.db.index": "ecillumd", + "rsa.internal.event_desc": "AppFw SafeCommerce credit cards seen", + "rsa.internal.messageid": "APPFW_APPFW_SAFECOMMERCE", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SAFECOMMERCE", + "rsa.misc.rule_group": "conse", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.219.65.172" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://internal.example.net/edqui/tvolu.txt?ore=lors#saute" + }, + { + "destination.ip": [ + "10.86.207.236" + ], + "destination.port": 207, + "event.code": "AAATM_HTTPREQUEST", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "3/17/2019:17:35:40 dtempo : AAATM HTTPREQUEST lumqu:Context moen - SessionId: oinvento- mporin User orissusc : Group(s) utaliqui : Vserver 10.86.207.236:207 - 3/17/2019:17:35:40 CT litsed https://www.example.com/tiaec/lorem.jpg?totamr=seddo#aper entor", + "event.timezone": "CT", + "fileset.name": "netscaler", + "group.name": "utaliqui", + "input.type": "log", + "log.offset": 12244, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.86.207.236" + ], + "related.user": [ + "orissusc" + ], + "rsa.internal.event_desc": "AAATM HTTP Request", + "rsa.internal.messageid": "AAATM_HTTPREQUEST", + "rsa.misc.action": [ + "litsed" + ], + "rsa.misc.event_computer": "mporin", + "rsa.misc.group": "utaliqui", + "rsa.misc.log_session_id": "oinvento", + "rsa.misc.msgIdPart1": "AAATM", + "rsa.misc.msgIdPart2": "HTTPREQUEST", + "rsa.time.effective_time": "2019-03-17T19:35:40.000Z", + "rsa.time.timezone": "CT", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://www.example.com/tiaec/lorem.jpg?totamr=seddo#aper", + "user.name": "orissusc" + }, + { + "destination.ip": [ + "10.187.86.64" + ], + "destination.port": 3325, + "event.code": "ICA_SESSION_UPDATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/1/2019:00:38:14 ihil : ICA SESSION_UPDATE oremip:session_guid fdeFi - device_serial_number periam - client_cookie ccusa - flags billo - nsica_session_status doloremi - nsica_session_client_ip 10.197.128.162 - nsica_session_client_port 2052 - nsica_session_server_ip 10.187.86.64 - nsica_session_server_port 3325 - nsica_session_reconnect_count atatn - nsica_session_acr_count ipisc - connection_priority iatnulap - timestamp roi", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 12496, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.187.86.64", + "10.197.128.162" + ], + "rsa.internal.messageid": "ICA_SESSION_UPDATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_UPDATE", + "service.type": "citrix", + "source.ip": [ + "10.197.128.162" + ], + "source.port": 2052, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SIGNATURE_MATCH", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/15/2019:07:40:49 loreeu : APPFW APPFW_SIGNATURE_MATCH eprehe:10.163.217.101 empor - uptatemU - rem https://www5.example.com/iscivel/rinci.txt?atcupi=eriti#uptateve namaliqu rule ID riame: datatn <", + "file.name": "rinci.txt", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 12927, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.163.217.101" + ], + "rsa.db.index": "datatn", + "rsa.internal.event_desc": "namaliqu", + "rsa.internal.messageid": "APPFW_APPFW_SIGNATURE_MATCH", + "rsa.misc.disposition": "seq", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SIGNATURE_MATCH", + "rsa.misc.rule_group": "rem", + "rsa.misc.rule_uid": "riame", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.163.217.101" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.domain": "www5.example.com", + "url.original": "https://www5.example.com/iscivel/rinci.txt?atcupi=eriti#uptateve", + "url.path": "https://www5.example.com" + }, + { + "destination.ip": [ + "10.204.20.8" + ], + "destination.port": 2652, + "event.code": "ICA_SESSION_UPDATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "4/29/2019:14:43:23 isu : ICA SESSION_UPDATE :session_guid moll - device_serial_number roinBCS - client_cookie odit - flags vol - nsica_session_status epteurs - nsica_session_client_ip 10.43.239.97 - nsica_session_client_port 6985 - nsica_session_server_ip 10.204.20.8 - nsica_session_server_port 2652 - nsica_session_reconnect_count ntoccae - nsica_session_acr_count iscive - connection_priority amni - timestamp etconse", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 13131, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.204.20.8", + "10.43.239.97" + ], + "rsa.internal.messageid": "ICA_SESSION_UPDATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_UPDATE", + "service.type": "citrix", + "source.ip": [ + "10.43.239.97" + ], + "source.port": 6985, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.133.153.174" + ], + "destination.nat.ip": "10.76.129.136", + "destination.nat.port": 5259, + "destination.port": 7022, + "event.code": "SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/13/2019:21:45:57 amquisn : SSLVPN NONHTTP_RESOURCEACCESS_DENIED Finibus:Context nsequat - SessionId: mvol- User asiar - Client_ip 10.8.82.22 - Nat_ip \"10.148.244.55\" - Vserver 10.133.153.174:7022 - Source 10.113.135.78:1646 - Destination 10.76.129.136:5259 - Total_bytes_send epteur - Total_bytes_recv onproi - Denied_by_policy \"usmodit\" - Group(s) \"orese\"", + "event.outcome": "failure", + "fileset.name": "netscaler", + "group.name": "orese", + "host.ip": "10.8.82.22", + "input.type": "log", + "log.offset": 13552, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.8.82.22", + "10.133.153.174", + "10.76.129.136", + "10.113.135.78", + "10.148.244.55" + ], + "related.user": [ + "asiar" + ], + "rsa.internal.messageid": "SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", + "rsa.investigations.ec_activity": "Request", + "rsa.investigations.ec_outcome": "Failure", + "rsa.misc.comp_rbytes": "onproi", + "rsa.misc.comp_sbytes": "epteur", + "rsa.misc.group": "orese", + "rsa.misc.log_session_id": "mvol", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "NONHTTP_RESOURCEACCESS_DENIED", + "service.type": "citrix", + "source.ip": [ + "10.113.135.78" + ], + "source.nat.ip": "10.148.244.55", + "source.port": 1646, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "asiar" + }, + { + "event.code": "EVENT_DEVICEOFS", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "5/28/2019:04:48:31 atemacc : EVENT DEVICEOFS labore:iqua \"ciunt\" - State exea", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Notice", + "log.offset": 13911, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "Device Out Of Service", + "rsa.internal.messageid": "EVENT_DEVICEOFS", + "rsa.investigations.ec_activity": "Stop", + "rsa.investigations.ec_subject": "Service", + "rsa.misc.event_state": "exea", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "DEVICEOFS", + "rsa.misc.obj_name": "ciunt", + "rsa.misc.obj_type": "iqua", + "rsa.misc.severity": "Notice", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "APPFW_REFERER_HEADER", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "APPFW_REFERER_HEADER |1.1103|citation|emquel|very-high|src=10.20.230.37 spt=5308 method=remip request=https://mail.example.com/aturExc/antiumto.htm?obe=niamqu#ull msg=aturE cn1=aaliqu cn2=tev cs1=oNemoeni cs2=luptatem cs3=pers cs4=low cs5=luptatem act=cancel", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "low", + "log.offset": 13989, + "observer.product": "APPFW_REFERER_HEADER", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.1103", + "related.ip": [ + "10.20.230.37" + ], + "rsa.db.index": "aturE", + "rsa.internal.messageid": "APPFW_REFERER_HEADER", + "rsa.misc.action": [ + "remip", + "cancel" + ], + "rsa.misc.policy_name": "oNemoeni", + "rsa.misc.rule": "citation", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.1103", + "service.type": "citrix", + "source.ip": [ + "10.20.230.37" + ], + "source.port": 5308, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://mail.example.com/aturExc/antiumto.htm?obe=niamqu#ull" + }, + { + "event.action": "block", + "event.code": "AF_MALFORMED_REQ_ERR", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "AF_MALFORMED_REQ_ERR |1.3141|etd|omnisi|high|src=10.186.166.215 spt=553 method=ati request=https://mail.example.org/tsuntinc/nis.gif?iin=uteiru#xer msg=iat cn1=orain cn2=equaturQ cs1=llu cs2=quaUt cs4=low cs5=nim act=block", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "low", + "log.offset": 14248, + "observer.product": "AF_MALFORMED_REQ_ERR", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.3141", + "related.ip": [ + "10.186.166.215" + ], + "rsa.db.index": "iat", + "rsa.internal.messageid": "AF_MALFORMED_REQ_ERR", + "rsa.misc.action": [ + "ati", + "block" + ], + "rsa.misc.policy_name": "llu", + "rsa.misc.rule": "etd", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3141", + "service.type": "citrix", + "source.ip": [ + "10.186.166.215" + ], + "source.port": 553, + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://mail.example.org/tsuntinc/nis.gif?iin=uteiru#xer" + }, + { + "destination.ip": [ + "10.213.112.186" + ], + "event.code": "SSLVPN_REMOVE_SESSION_INFO", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/10/2019:01:56:14 olorin : SSLVPN REMOVE_SESSION_INFO :Sessionid orisnisi - User emquiav - Client_ip 10.215.229.78 - Nat_ip 10.67.233.159 - Vserver_ip 10.213.112.186 - Errmsg \" ectetur \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 14471, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.213.112.186", + "10.215.229.78", + "10.67.233.159" + ], + "related.user": [ + "emquiav" + ], + "rsa.internal.event_desc": "ectetur", + "rsa.internal.messageid": "SSLVPN_REMOVE_SESSION_INFO", + "rsa.misc.log_session_id": "orisnisi", + "rsa.misc.msgIdPart1": "SSLVPN", + "rsa.misc.msgIdPart2": "REMOVE_SESSION_INFO", + "service.type": "citrix", + "source.ip": [ + "10.215.229.78" + ], + "source.nat.ip": "10.67.233.159", + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "user.name": "emquiav" + }, + { + "event.code": "EVENT_MONITORUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "7/24/2019:08:58:48 sitasper : EVENT MONITORUP ncidunt:uiac squ - State litess", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 14659, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.event_desc": "The monitor bound to the service is up", + "rsa.internal.messageid": "EVENT_MONITORUP", + "rsa.misc.event_state": "litess", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "MONITORUP", + "rsa.misc.obj_name": "squ", + "rsa.misc.obj_type": "uiac", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "EVENT_ALERTENDED", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/7/2019:16:01:23 scingeli : EVENT ALERTENDED :emq.exe ended for 2514", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 14737, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "process.name": "emq.exe", + "rsa.counters.dclass_c1": 2514, + "rsa.internal.event_desc": "Alert process ended", + "rsa.internal.messageid": "EVENT_ALERTENDED", + "rsa.misc.msgIdPart1": "EVENT", + "rsa.misc.msgIdPart2": "ALERTENDED", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "ICA_APPLICATION_LAUNCH", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "8/21/2019:23:03:57 bor : ICA APPLICATION_LAUNCH magnido:session_guid lupta - device_serial_number utla - client_cookie nse - flags Dui - launch_mechanism gitsed - app_launch_time 8/21/2019:23:03:57 - app_process_id estla - app_name ione - module_path ecillum", + "file.name": "ecillum", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 14807, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.internal.messageid": "ICA_APPLICATION_LAUNCH", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "APPLICATION_LAUNCH", + "rsa.time.starttime": "2019-08-22T01:03:57.000Z", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.73.45.19" + ], + "destination.port": 3791, + "event.code": "ICA_SESSION_UPDATE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/5/2019:06:06:31 oreseos : ICA SESSION_UPDATE :session_guid agna - device_serial_number dmini - client_cookie tquid - flags giatquo - nsica_session_status iatisun - nsica_session_client_ip 10.96.104.212 - nsica_session_client_port 2372 - nsica_session_server_ip 10.73.45.19 - nsica_session_server_port 3791 - nsica_session_reconnect_count oeiusm - nsica_session_acr_count aUtenim - connection_priority ntincul - timestamp nnumquam", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 15066, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.96.104.212", + "10.73.45.19" + ], + "rsa.internal.messageid": "ICA_SESSION_UPDATE", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_UPDATE", + "service.type": "citrix", + "source.ip": [ + "10.96.104.212" + ], + "source.port": 2372, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_SQL", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "9/19/2019:13:09:05 inculpa : APPFW APPFW_SQL nvo:10.238.144.31 stiae icta https://mail.example.com/nvent/uepor.jpg?odiconse=nevolupt#tDui untutl <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 15498, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.238.144.31" + ], + "rsa.db.index": "untutl", + "rsa.internal.event_desc": "AppFw SQL Injection violation", + "rsa.internal.messageid": "APPFW_APPFW_SQL", + "rsa.misc.disposition": "ugiatnul", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_SQL", + "rsa.misc.rule_group": "icta", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.238.144.31" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://mail.example.com/nvent/uepor.jpg?odiconse=nevolupt#tDui" + }, + { + "event.action": "acomm", + "event.code": "NSNETSVC_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/3/2019:20:11:40 doei : NSNETSVC Message :\"acomm: veleumi \"", + "fileset.name": "netscaler", + "input.type": "log", + "log.offset": 15655, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "veleumi", + "rsa.internal.messageid": "NSNETSVC_Message", + "rsa.misc.event_type": "acomm", + "rsa.misc.msgIdPart1": "NSNETSVC", + "rsa.misc.msgIdPart2": "Message", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.bytes": 7865, + "destination.ip": [ + "10.29.202.248" + ], + "destination.nat.ip": "10.247.251.223", + "destination.nat.port": 6658, + "destination.port": 4069, + "event.code": "TCP_OTHERCONN_DELINK", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "10/18/2019:03:14:14 sumquiad : TCP OTHERCONN_DELINK stl:Source 10.161.218.47:6184 - Vserver 10.29.202.248:4069 - NatIP 10.206.5.50:1064 - Destination 10.247.251.223:6658 - Delink Time 10/18/2019:03:14:14 GMT Total_bytes_send 6764 - Total_bytes_recv 7865", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 15717, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.29.202.248", + "10.161.218.47", + "10.247.251.223", + "10.206.5.50" + ], + "rsa.internal.event_desc": "A Server side and a Client side TCP connection is delinked. This is not tracked by Netscaler", + "rsa.internal.messageid": "TCP_OTHERCONN_DELINK", + "rsa.investigations.ec_activity": "Start", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.msgIdPart1": "TCP", + "rsa.misc.msgIdPart2": "OTHERCONN_DELINK", + "rsa.misc.severity": "Informational", + "rsa.time.endtime": "2019-10-18T05:14:14.000Z", + "service.type": "citrix", + "source.bytes": 6764, + "source.ip": [ + "10.161.218.47" + ], + "source.nat.ip": "10.206.5.50", + "source.nat.port": 1064, + "source.port": 6184, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "DR_HA_Message", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/1/2019:10:16:48 tate : DR HA_Message :\"tutlabo: nto\"", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 15971, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "rsa.db.index": "nto", + "rsa.internal.event_desc": "Routing details", + "rsa.internal.messageid": "DR_HA_Message", + "rsa.misc.msgIdPart1": "DR", + "rsa.misc.msgIdPart2": "HA_Message", + "rsa.misc.severity": "Informational", + "rsa.network.network_service": "tutlabo", + "service.type": "citrix", + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "event.code": "APPFW_APPFW_BUFFEROVERFLOW_COOKIE", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/15/2019:17:19:22 tlabo : APPFW APPFW_BUFFEROVERFLOW_COOKIE :10.134.238.8 emu Malor amn: https://example.net/sintoc/rinci.txt?ali=Nequepor#aUten <", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Informational", + "log.offset": 16027, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.134.238.8" + ], + "rsa.db.index": "amn", + "rsa.internal.event_desc": "AppFw Buffer Overflow violation in Cookie", + "rsa.internal.messageid": "APPFW_APPFW_BUFFEROVERFLOW_COOKIE", + "rsa.misc.disposition": "edutpers", + "rsa.misc.msgIdPart1": "APPFW", + "rsa.misc.msgIdPart2": "APPFW_BUFFEROVERFLOW_COOKIE", + "rsa.misc.rule_group": "Malor", + "rsa.misc.severity": "Informational", + "service.type": "citrix", + "source.ip": [ + "10.134.238.8" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ], + "url.original": "https://example.net/sintoc/rinci.txt?ali=Nequepor#aUten" + }, + { + "destination.address": "ptateve165.mail.corp", + "event.code": "ICA_SESSION_SETUP", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "11/30/2019:00:21:57 adeseru : ICA SESSION_SETUP sitas:session_guid eni - device_serial_number cte - client_cookie ariatu - flags ess - session_setup_time ria - client_ip 10.111.22.134 - client_type datatno - client_launcher equepor - client_version 1.897 - client_hostname orisnis403.www.localhost - domain_name hend1170.www5.lan - server_name ptateve165.mail.corp - connection_priority ommodoco", + "fileset.name": "netscaler", + "host.hostname": "orisnis403.www.localhost", + "input.type": "log", + "log.offset": 16186, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "observer.version": "1.897", + "related.ip": [ + "10.111.22.134" + ], + "rsa.internal.messageid": "ICA_SESSION_SETUP", + "rsa.misc.msgIdPart1": "ICA", + "rsa.misc.msgIdPart2": "SESSION_SETUP", + "rsa.misc.version": "1.897", + "rsa.network.domain": "hend1170.www5.lan", + "rsa.network.host_dst": "ptateve165.mail.corp", + "server.domain": "hend1170.www5.lan", + "service.type": "citrix", + "source.address": "orisnis403.www.localhost", + "source.ip": [ + "10.111.22.134" + ], + "tags": [ + "citrix.netscaler", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.37.99.189" + ], + "destination.port": 3275, + "event.code": "SPCBId", + "event.dataset": "citrix.netscaler", + "event.module": "citrix", + "event.original": "SPCBId rita - ClientIP 10.148.72.78 - ClientPort 7584 - VserverServiceIP 10.37.99.189 - VserverServicePort 3275 - ClientVersion ugitsed - CipherSuite \"ritatis\" - success", + "event.outcome": "failure", + "fileset.name": "netscaler", + "input.type": "log", + "log.level": "Debug", + "log.offset": 16582, + "observer.product": "Netscaler", + "observer.type": "Firewall", + "observer.vendor": "Citrix", + "related.ip": [ + "10.148.72.78", + "10.37.99.189" + ], + "rsa.crypto.cipher_src": "ritatis", + "rsa.crypto.ssl_ver_src": "ugitsed", + "rsa.internal.messageid": "SPCBId", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.misc.log_session_id": "rita", + "rsa.misc.result": "success", + "rsa.misc.severity": "Debug", + "service.type": "citrix", + "source.ip": [ + "10.148.72.78" + ], + "source.port": 7584, + "tags": [ + "citrix.netscaler", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/cyberark/README.md b/x-pack/filebeat/module/cyberark/README.md new file mode 100644 index 00000000000..80bba69debc --- /dev/null +++ b/x-pack/filebeat/module/cyberark/README.md @@ -0,0 +1,7 @@ +# cyberark module + +This is a module for Cyber-Ark logs. + +Autogenerated from RSA NetWitness log parser 2.0 XML cyberark version 124 +at 2020-09-01 14:17:46.365057 +0000 UTC. + diff --git a/x-pack/filebeat/module/cyberark/_meta/config.yml b/x-pack/filebeat/module/cyberark/_meta/config.yml new file mode 100644 index 00000000000..fa8edd7046a --- /dev/null +++ b/x-pack/filebeat/module/cyberark/_meta/config.yml @@ -0,0 +1,19 @@ +- module: cyberark + corepas: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9527 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc new file mode 100644 index 00000000000..d4beae518e8 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc @@ -0,0 +1,66 @@ +[role="xpack"] + +:modulename: cyberark +:has-dashboards: false + +== Cyberark module + +experimental[] + +This is a module for receiving Cyber-Ark logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: corepas + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `corepas` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9527` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + diff --git a/x-pack/filebeat/module/cyberark/_meta/fields.yml b/x-pack/filebeat/module/cyberark/_meta/fields.yml new file mode 100644 index 00000000000..ab0db4113c7 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/_meta/fields.yml @@ -0,0 +1,5 @@ +- key: cyberark + title: Cyber-Ark + description: > + cyberark fields. + fields: diff --git a/x-pack/filebeat/module/cyberark/corepas/_meta/fields.yml b/x-pack/filebeat/module/cyberark/corepas/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/cyberark/corepas/config/input.yml b/x-pack/filebeat/module/cyberark/corepas/config/input.yml new file mode 100644 index 00000000000..4a0d6359c63 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Cyberark" + product: "Core" + type: "Access" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/cyberark/corepas/config/liblogparser.js + - ${path.home}/module/cyberark/corepas/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/cyberark/corepas/config/liblogparser.js b/x-pack/filebeat/module/cyberark/corepas/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup1, + dup2, +])); + +var dup153 = tagval("MESSAGE#2:2:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup4, + dup2, + dup3, +])); + +var dup154 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup4, + dup2, +])); + +var dup155 = tagval("MESSAGE#6:4:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + dup2, + dup3, +])); + +var dup156 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + dup2, +])); + +var dup157 = tagval("MESSAGE#20:13:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup16, + dup17, + dup9, + dup2, + dup3, +])); + +var dup158 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup16, + dup17, + dup9, + dup2, +])); + +var dup159 = tagval("MESSAGE#26:16:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup19, + dup2, + dup3, +])); + +var dup160 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup19, + dup2, +])); + +var dup161 = tagval("MESSAGE#30:18:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup2, + dup3, +])); + +var dup162 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup2, +])); + +var dup163 = tagval("MESSAGE#38:22:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup21, + dup2, + dup3, +])); + +var dup164 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup21, + dup2, +])); + +var dup165 = tagval("MESSAGE#70:38:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup23, + dup2, + dup3, +])); + +var dup166 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup23, + dup2, +])); + +var dup167 = tagval("MESSAGE#116:61:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup20, + dup2, + dup3, +])); + +var dup168 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup20, + dup2, +])); + +var dup169 = tagval("MESSAGE#126:66:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup26, + dup2, + dup3, +])); + +var dup170 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup26, + dup2, +])); + +var dup171 = tagval("MESSAGE#190:98:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup26, + dup2, + dup3, + dup24, + dup25, +])); + +var dup172 = linear_select([ + dup32, + dup33, +]); + +var dup173 = linear_select([ + dup34, + dup35, +]); + +var dup174 = linear_select([ + dup36, + dup37, +]); + +var dup175 = linear_select([ + dup38, + dup39, +]); + +var dup176 = linear_select([ + dup40, + dup41, +]); + +var dup177 = linear_select([ + dup42, + dup43, +]); + +var dup178 = linear_select([ + dup44, + dup45, +]); + +var dup179 = linear_select([ + dup46, + dup47, +]); + +var dup180 = linear_select([ + dup48, + dup49, +]); + +var dup181 = linear_select([ + dup50, + dup51, +]); + +var dup182 = linear_select([ + dup52, + dup53, +]); + +var dup183 = linear_select([ + dup54, + dup55, +]); + +var dup184 = linear_select([ + dup56, + dup57, +]); + +var dup185 = linear_select([ + dup58, + dup59, +]); + +var dup186 = linear_select([ + dup60, + dup61, +]); + +var dup187 = linear_select([ + dup62, + dup63, +]); + +var dup188 = linear_select([ + dup64, + dup65, +]); + +var dup189 = linear_select([ + dup66, + dup67, +]); + +var dup190 = linear_select([ + dup68, + dup69, +]); + +var dup191 = linear_select([ + dup70, + dup71, +]); + +var dup192 = linear_select([ + dup72, + dup73, +]); + +var dup193 = linear_select([ + dup74, + dup75, +]); + +var dup194 = linear_select([ + dup76, + dup77, +]); + +var dup195 = tagval("MESSAGE#591:317:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup79, + dup80, + dup81, + dup2, + dup3, +])); + +var dup196 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup79, + dup80, + dup81, + dup2, +])); + +var dup197 = tagval("MESSAGE#595:355:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup82, + dup2, + dup3, +])); + +var dup198 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup82, + dup2, +])); + +var dup199 = tagval("MESSAGE#599:357:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup83, + dup2, + dup3, +])); + +var dup200 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup83, + dup2, +])); + +var dup201 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location='), Field(directory,false), Constant(';Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false), Constant(';')}" +match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ + dup4, + dup2, + dup3, +])); + +var dup202 = linear_select([ + dup85, + dup86, +]); + +var dup203 = linear_select([ + dup88, + dup89, +]); + +var dup204 = linear_select([ + dup91, + dup92, +]); + +var dup205 = linear_select([ + dup94, + dup95, +]); + +var dup206 = linear_select([ + dup97, + dup98, +]); + +var dup207 = linear_select([ + dup100, + dup101, +]); + +var dup208 = linear_select([ + dup103, + dup104, +]); + +var dup209 = linear_select([ + dup106, + dup107, +]); + +var dup210 = linear_select([ + dup109, + dup110, +]); + +var dup211 = linear_select([ + dup112, + dup113, +]); + +var dup212 = linear_select([ + dup115, + dup116, + dup117, + dup118, +]); + +var dup213 = linear_select([ + dup120, + dup121, +]); + +var dup214 = linear_select([ + dup123, + dup124, +]); + +var dup215 = linear_select([ + dup126, + dup127, +]); + +var dup216 = linear_select([ + dup129, + dup130, +]); + +var dup217 = linear_select([ + dup132, + dup133, +]); + +var dup218 = linear_select([ + dup135, + dup136, +]); + +var dup219 = linear_select([ + dup138, + dup139, +]); + +var dup220 = linear_select([ + dup141, + dup142, +]); + +var dup221 = linear_select([ + dup144, + dup145, +]); + +var dup222 = linear_select([ + dup147, + dup148, +]); + +var hdr1 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hproduct,true), Constant(' ProductName="'), Field(hdevice,false), Constant('",ProductAccount="'), Field(hfld1,false), Constant('",ProductProcess="'), Field(process,false), Constant('",EventId="'), Field(messageid,false), Constant('", '), Field(p0,false)}" +match("HEADER#0:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld1}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ + setc("header_id","0001"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hdevice"), + constant("\",ProductAccount=\""), + field("hfld1"), + constant("\",ProductProcess=\""), + field("process"), + constant("\",EventId=\""), + field("messageid"), + constant("\", "), + field("p0"), + ], + }), +])); + +var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hdatetime,true), Constant(' '), Field(hproduct,true), Constant(' ProductName="'), Field(hdevice,false), Constant('",ProductAccount="'), Field(hfld4,false), Constant('",ProductProcess="'), Field(process,false), Constant('",EventId="'), Field(messageid,false), Constant('", '), Field(p0,false)}" +match("HEADER#1:0005", "message", "%{hfld1->} %{hdatetime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld4}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ + setc("header_id","0005"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hdevice"), + constant("\",ProductAccount=\""), + field("hfld4"), + constant("\",ProductProcess=\""), + field("process"), + constant("\",EventId=\""), + field("messageid"), + constant("\", "), + field("p0"), + ], + }), +])); + +var hdr3 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hproduct,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" +match("HEADER#2:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ + setc("header_id","0002"), +])); + +var hdr4 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hdatetime,true), Constant(' '), Field(hostname,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" +match("HEADER#3:0003", "message", "%{hfld1->} %{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ + setc("header_id","0003"), +])); + +var hdr5 = // "Pattern{Constant('%CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" +match("HEADER#4:0004", "message", "%CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ + setc("header_id","0004"), +])); + +var hdr6 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hostname,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" +match("HEADER#5:0006", "message", "%{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ + setc("header_id","0006"), +])); + +var select1 = linear_select([ + hdr1, + hdr2, + hdr3, + hdr4, + hdr5, + hdr6, +]); + +var msg1 = msg("1:01", dup151); + +var msg2 = msg("1", dup152); + +var select2 = linear_select([ + msg1, + msg2, +]); + +var msg3 = msg("2:01", dup153); + +var msg4 = msg("2", dup154); + +var select3 = linear_select([ + msg3, + msg4, +]); + +var msg5 = msg("3:01", dup151); + +var msg6 = msg("3", dup152); + +var select4 = linear_select([ + msg5, + msg6, +]); + +var msg7 = msg("4:01", dup155); + +var msg8 = msg("4", dup156); + +var select5 = linear_select([ + msg7, + msg8, +]); + +var part1 = tagval("MESSAGE#8:7:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup10, + dup6, + dup7, + dup8, + dup11, + dup2, + dup3, +])); + +var msg9 = msg("7:01", part1); + +var part2 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#9:7", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup10, + dup6, + dup7, + dup8, + dup11, + dup2, +])); + +var msg10 = msg("7", part2); + +var select6 = linear_select([ + msg9, + msg10, +]); + +var part3 = tagval("MESSAGE#10:8:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup12, + dup6, + dup13, + dup8, + dup11, + dup2, + dup3, +])); + +var msg11 = msg("8:01", part3); + +var part4 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#11:8", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup12, + dup6, + dup13, + dup8, + dup11, + dup2, +])); + +var msg12 = msg("8", part4); + +var select7 = linear_select([ + msg11, + msg12, +]); + +var part5 = tagval("MESSAGE#12:9:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup1, + dup14, + dup9, + dup2, + dup3, +])); + +var msg13 = msg("9:01", part5); + +var part6 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#13:9", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup1, + dup14, + dup9, + dup2, +])); + +var msg14 = msg("9", part6); + +var select8 = linear_select([ + msg13, + msg14, +]); + +var msg15 = msg("10:01", dup151); + +var msg16 = msg("10", dup152); + +var select9 = linear_select([ + msg15, + msg16, +]); + +var msg17 = msg("11:01", dup151); + +var msg18 = msg("11", dup152); + +var select10 = linear_select([ + msg17, + msg18, +]); + +var msg19 = msg("12:01", dup151); + +var msg20 = msg("12", dup152); + +var select11 = linear_select([ + msg19, + msg20, +]); + +var msg21 = msg("13:01", dup157); + +var msg22 = msg("13", dup158); + +var select12 = linear_select([ + msg21, + msg22, +]); + +var msg23 = msg("14:01", dup157); + +var msg24 = msg("14", dup158); + +var select13 = linear_select([ + msg23, + msg24, +]); + +var part7 = tagval("MESSAGE#24:15:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup18, + dup9, + dup2, + dup3, +])); + +var msg25 = msg("15:01", part7); + +var part8 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#25:15", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup18, + dup9, + dup2, +])); + +var msg26 = msg("15", part8); + +var select14 = linear_select([ + msg25, + msg26, +]); + +var msg27 = msg("16:01", dup159); + +var msg28 = msg("16", dup160); + +var select15 = linear_select([ + msg27, + msg28, +]); + +var msg29 = msg("17:01", dup151); + +var msg30 = msg("17", dup152); + +var select16 = linear_select([ + msg29, + msg30, +]); + +var msg31 = msg("18:01", dup161); + +var msg32 = msg("18", dup162); + +var select17 = linear_select([ + msg31, + msg32, +]); + +var part9 = tagval("MESSAGE#32:19:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup20, + dup16, + dup11, + dup2, + dup3, +])); + +var msg33 = msg("19:01", part9); + +var part10 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#33:19", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup20, + dup16, + dup11, + dup2, +])); + +var msg34 = msg("19", part10); + +var select18 = linear_select([ + msg33, + msg34, +]); + +var part11 = tagval("MESSAGE#34:20:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup19, + dup16, + dup2, + dup3, +])); + +var msg35 = msg("20:01", part11); + +var part12 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#35:20", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup19, + dup16, + dup2, +])); + +var msg36 = msg("20", part12); + +var select19 = linear_select([ + msg35, + msg36, +]); + +var part13 = tagval("MESSAGE#36:21:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup16, + dup9, + dup2, + dup3, +])); + +var msg37 = msg("21:01", part13); + +var part14 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#37:21", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup16, + dup9, + dup2, +])); + +var msg38 = msg("21", part14); + +var select20 = linear_select([ + msg37, + msg38, +]); + +var msg39 = msg("22:01", dup163); + +var msg40 = msg("22", dup164); + +var select21 = linear_select([ + msg39, + msg40, +]); + +var part15 = tagval("MESSAGE#40:23:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup22, + dup2, + dup3, +])); + +var msg41 = msg("23:01", part15); + +var part16 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#41:23", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup22, + dup2, +])); + +var msg42 = msg("23", part16); + +var select22 = linear_select([ + msg41, + msg42, +]); + +var msg43 = msg("24:01", dup163); + +var msg44 = msg("24", dup164); + +var select23 = linear_select([ + msg43, + msg44, +]); + +var msg45 = msg("25:01", dup151); + +var msg46 = msg("25", dup152); + +var select24 = linear_select([ + msg45, + msg46, +]); + +var msg47 = msg("26:01", dup151); + +var msg48 = msg("26", dup152); + +var select25 = linear_select([ + msg47, + msg48, +]); + +var msg49 = msg("27:01", dup151); + +var msg50 = msg("27", dup152); + +var select26 = linear_select([ + msg49, + msg50, +]); + +var msg51 = msg("28:01", dup163); + +var msg52 = msg("28", dup164); + +var select27 = linear_select([ + msg51, + msg52, +]); + +var msg53 = msg("29:01", dup151); + +var msg54 = msg("29", dup152); + +var select28 = linear_select([ + msg53, + msg54, +]); + +var msg55 = msg("30:01", dup151); + +var msg56 = msg("30", dup152); + +var select29 = linear_select([ + msg55, + msg56, +]); + +var msg57 = msg("31:01", dup163); + +var msg58 = msg("31", dup164); + +var select30 = linear_select([ + msg57, + msg58, +]); + +var msg59 = msg("32:01", dup163); + +var msg60 = msg("32", dup164); + +var select31 = linear_select([ + msg59, + msg60, +]); + +var msg61 = msg("33:01", dup163); + +var msg62 = msg("33", dup164); + +var select32 = linear_select([ + msg61, + msg62, +]); + +var msg63 = msg("34:01", dup151); + +var msg64 = msg("34", dup152); + +var select33 = linear_select([ + msg63, + msg64, +]); + +var msg65 = msg("35:01", dup151); + +var msg66 = msg("35", dup152); + +var select34 = linear_select([ + msg65, + msg66, +]); + +var msg67 = msg("36:01", dup163); + +var msg68 = msg("36", dup164); + +var select35 = linear_select([ + msg67, + msg68, +]); + +var msg69 = msg("37:01", dup163); + +var msg70 = msg("37", dup164); + +var select36 = linear_select([ + msg69, + msg70, +]); + +var msg71 = msg("38:01", dup165); + +var msg72 = msg("38", dup166); + +var select37 = linear_select([ + msg71, + msg72, +]); + +var msg73 = msg("39:01", dup163); + +var msg74 = msg("39", dup164); + +var select38 = linear_select([ + msg73, + msg74, +]); + +var msg75 = msg("40:01", dup151); + +var msg76 = msg("40", dup152); + +var select39 = linear_select([ + msg75, + msg76, +]); + +var msg77 = msg("41:01", dup151); + +var msg78 = msg("41", dup152); + +var select40 = linear_select([ + msg77, + msg78, +]); + +var msg79 = msg("42:01", dup151); + +var msg80 = msg("42", dup152); + +var select41 = linear_select([ + msg79, + msg80, +]); + +var msg81 = msg("43:01", dup151); + +var msg82 = msg("43", dup152); + +var select42 = linear_select([ + msg81, + msg82, +]); + +var msg83 = msg("44:01", dup151); + +var msg84 = msg("44", dup152); + +var select43 = linear_select([ + msg83, + msg84, +]); + +var msg85 = msg("45:01", dup151); + +var msg86 = msg("45", dup152); + +var select44 = linear_select([ + msg85, + msg86, +]); + +var msg87 = msg("46:01", dup151); + +var msg88 = msg("46", dup152); + +var select45 = linear_select([ + msg87, + msg88, +]); + +var msg89 = msg("47:01", dup151); + +var msg90 = msg("47", dup152); + +var select46 = linear_select([ + msg89, + msg90, +]); + +var msg91 = msg("48:01", dup151); + +var msg92 = msg("48", dup152); + +var select47 = linear_select([ + msg91, + msg92, +]); + +var msg93 = msg("49:01", dup151); + +var msg94 = msg("49", dup152); + +var select48 = linear_select([ + msg93, + msg94, +]); + +var part17 = tagval("MESSAGE#94:50:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup21, + dup2, + dup3, + dup24, + dup25, +])); + +var msg95 = msg("50:01", part17); + +var msg96 = msg("50", dup164); + +var select49 = linear_select([ + msg95, + msg96, +]); + +var msg97 = msg("51:01", dup163); + +var msg98 = msg("51", dup164); + +var select50 = linear_select([ + msg97, + msg98, +]); + +var msg99 = msg("52:01", dup163); + +var msg100 = msg("52", dup164); + +var select51 = linear_select([ + msg99, + msg100, +]); + +var msg101 = msg("53:01", dup151); + +var msg102 = msg("53", dup152); + +var select52 = linear_select([ + msg101, + msg102, +]); + +var msg103 = msg("54:01", dup151); + +var msg104 = msg("54", dup152); + +var select53 = linear_select([ + msg103, + msg104, +]); + +var msg105 = msg("55:01", dup151); + +var msg106 = msg("55", dup152); + +var select54 = linear_select([ + msg105, + msg106, +]); + +var msg107 = msg("56:01", dup151); + +var msg108 = msg("56", dup152); + +var select55 = linear_select([ + msg107, + msg108, +]); + +var msg109 = msg("57:01", dup165); + +var msg110 = msg("57", dup166); + +var select56 = linear_select([ + msg109, + msg110, +]); + +var msg111 = msg("58:01", dup163); + +var msg112 = msg("58", dup164); + +var select57 = linear_select([ + msg111, + msg112, +]); + +var msg113 = msg("59:01", dup163); + +var msg114 = msg("59", dup164); + +var select58 = linear_select([ + msg113, + msg114, +]); + +var msg115 = msg("60:01", dup165); + +var msg116 = msg("60", dup166); + +var select59 = linear_select([ + msg115, + msg116, +]); + +var msg117 = msg("61:01", dup167); + +var msg118 = msg("61", dup168); + +var select60 = linear_select([ + msg117, + msg118, +]); + +var msg119 = msg("62:01", dup163); + +var msg120 = msg("62", dup164); + +var select61 = linear_select([ + msg119, + msg120, +]); + +var msg121 = msg("63:01", dup151); + +var msg122 = msg("63", dup152); + +var select62 = linear_select([ + msg121, + msg122, +]); + +var msg123 = msg("64:01", dup167); + +var msg124 = msg("64", dup168); + +var select63 = linear_select([ + msg123, + msg124, +]); + +var msg125 = msg("65:01", dup151); + +var msg126 = msg("65", dup152); + +var select64 = linear_select([ + msg125, + msg126, +]); + +var msg127 = msg("66:01", dup169); + +var msg128 = msg("66", dup170); + +var select65 = linear_select([ + msg127, + msg128, +]); + +var msg129 = msg("67:01", dup169); + +var msg130 = msg("67", dup170); + +var select66 = linear_select([ + msg129, + msg130, +]); + +var msg131 = msg("68:01", dup169); + +var msg132 = msg("68", dup170); + +var select67 = linear_select([ + msg131, + msg132, +]); + +var msg133 = msg("69:01", dup169); + +var msg134 = msg("69", dup170); + +var select68 = linear_select([ + msg133, + msg134, +]); + +var msg135 = msg("70:01", dup151); + +var msg136 = msg("70", dup152); + +var select69 = linear_select([ + msg135, + msg136, +]); + +var msg137 = msg("71:01", dup169); + +var msg138 = msg("71", dup170); + +var select70 = linear_select([ + msg137, + msg138, +]); + +var msg139 = msg("72:01", dup151); + +var msg140 = msg("72", dup152); + +var select71 = linear_select([ + msg139, + msg140, +]); + +var msg141 = msg("73:01", dup169); + +var msg142 = msg("73", dup170); + +var select72 = linear_select([ + msg141, + msg142, +]); + +var msg143 = msg("74:01", dup151); + +var msg144 = msg("74", dup152); + +var select73 = linear_select([ + msg143, + msg144, +]); + +var msg145 = msg("75:01", dup169); + +var msg146 = msg("75", dup170); + +var select74 = linear_select([ + msg145, + msg146, +]); + +var msg147 = msg("76:01", dup151); + +var msg148 = msg("76", dup152); + +var select75 = linear_select([ + msg147, + msg148, +]); + +var msg149 = msg("77:01", dup151); + +var msg150 = msg("77", dup152); + +var select76 = linear_select([ + msg149, + msg150, +]); + +var msg151 = msg("78:01", dup151); + +var msg152 = msg("78", dup152); + +var select77 = linear_select([ + msg151, + msg152, +]); + +var msg153 = msg("79:01", dup169); + +var msg154 = msg("79", dup170); + +var select78 = linear_select([ + msg153, + msg154, +]); + +var msg155 = msg("80:01", dup169); + +var msg156 = msg("80", dup170); + +var select79 = linear_select([ + msg155, + msg156, +]); + +var msg157 = msg("81:01", dup167); + +var msg158 = msg("81", dup168); + +var select80 = linear_select([ + msg157, + msg158, +]); + +var msg159 = msg("82:01", dup151); + +var msg160 = msg("82", dup152); + +var select81 = linear_select([ + msg159, + msg160, +]); + +var msg161 = msg("83:01", dup169); + +var msg162 = msg("83", dup170); + +var select82 = linear_select([ + msg161, + msg162, +]); + +var msg163 = msg("84:01", dup169); + +var msg164 = msg("84", dup170); + +var select83 = linear_select([ + msg163, + msg164, +]); + +var msg165 = msg("85:01", dup151); + +var msg166 = msg("85", dup152); + +var select84 = linear_select([ + msg165, + msg166, +]); + +var msg167 = msg("86:01", dup159); + +var msg168 = msg("86", dup160); + +var select85 = linear_select([ + msg167, + msg168, +]); + +var msg169 = msg("87:01", dup151); + +var msg170 = msg("87", dup152); + +var select86 = linear_select([ + msg169, + msg170, +]); + +var msg171 = msg("88:01", dup169); + +var msg172 = msg("88", dup170); + +var select87 = linear_select([ + msg171, + msg172, +]); + +var msg173 = msg("89:01", dup151); + +var msg174 = msg("89", dup152); + +var select88 = linear_select([ + msg173, + msg174, +]); + +var msg175 = msg("90:01", dup151); + +var msg176 = msg("90", dup152); + +var select89 = linear_select([ + msg175, + msg176, +]); + +var msg177 = msg("91:01", dup151); + +var msg178 = msg("91", dup152); + +var select90 = linear_select([ + msg177, + msg178, +]); + +var msg179 = msg("92:01", dup151); + +var msg180 = msg("92", dup152); + +var select91 = linear_select([ + msg179, + msg180, +]); + +var msg181 = msg("93:01", dup151); + +var msg182 = msg("93", dup152); + +var select92 = linear_select([ + msg181, + msg182, +]); + +var msg183 = msg("94:01", dup169); + +var msg184 = msg("94", dup170); + +var select93 = linear_select([ + msg183, + msg184, +]); + +var msg185 = msg("95:01", dup169); + +var msg186 = msg("95", dup170); + +var select94 = linear_select([ + msg185, + msg186, +]); + +var msg187 = msg("96:01", dup151); + +var msg188 = msg("96", dup152); + +var select95 = linear_select([ + msg187, + msg188, +]); + +var msg189 = msg("97:01", dup151); + +var msg190 = msg("97", dup152); + +var select96 = linear_select([ + msg189, + msg190, +]); + +var msg191 = msg("98:01", dup171); + +var msg192 = msg("98", dup170); + +var select97 = linear_select([ + msg191, + msg192, +]); + +var msg193 = msg("99:01", dup171); + +var msg194 = msg("99", dup170); + +var select98 = linear_select([ + msg193, + msg194, +]); + +var msg195 = msg("100:01", dup151); + +var msg196 = msg("100", dup152); + +var select99 = linear_select([ + msg195, + msg196, +]); + +var msg197 = msg("101:01", dup151); + +var msg198 = msg("101", dup152); + +var select100 = linear_select([ + msg197, + msg198, +]); + +var msg199 = msg("102:01", dup155); + +var msg200 = msg("102", dup156); + +var select101 = linear_select([ + msg199, + msg200, +]); + +var part18 = tagval("MESSAGE#200:103:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup27, + dup6, + dup7, + dup8, + dup28, + dup2, + dup3, +])); + +var msg201 = msg("103:01", part18); + +var part19 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#201:103", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup27, + dup6, + dup7, + dup8, + dup28, + dup2, +])); + +var msg202 = msg("103", part19); + +var select102 = linear_select([ + msg201, + msg202, +]); + +var part20 = tagval("MESSAGE#202:104:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup27, + dup6, + dup29, + dup2, + dup3, +])); + +var msg203 = msg("104:01", part20); + +var part21 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#203:104", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup27, + dup6, + dup29, + dup2, +])); + +var msg204 = msg("104", part21); + +var select103 = linear_select([ + msg203, + msg204, +]); + +var msg205 = msg("105:01", dup169); + +var msg206 = msg("105", dup170); + +var select104 = linear_select([ + msg205, + msg206, +]); + +var msg207 = msg("106:01", dup169); + +var msg208 = msg("106", dup170); + +var select105 = linear_select([ + msg207, + msg208, +]); + +var msg209 = msg("107:01", dup169); + +var msg210 = msg("107", dup170); + +var select106 = linear_select([ + msg209, + msg210, +]); + +var msg211 = msg("108:01", dup169); + +var msg212 = msg("108", dup170); + +var select107 = linear_select([ + msg211, + msg212, +]); + +var msg213 = msg("109:01", dup169); + +var msg214 = msg("109", dup170); + +var select108 = linear_select([ + msg213, + msg214, +]); + +var msg215 = msg("110:01", dup151); + +var msg216 = msg("110", dup152); + +var select109 = linear_select([ + msg215, + msg216, +]); + +var msg217 = msg("111:01", dup169); + +var msg218 = msg("111", dup170); + +var select110 = linear_select([ + msg217, + msg218, +]); + +var msg219 = msg("112:01", dup169); + +var msg220 = msg("112", dup170); + +var select111 = linear_select([ + msg219, + msg220, +]); + +var msg221 = msg("114:01", dup169); + +var msg222 = msg("114", dup170); + +var select112 = linear_select([ + msg221, + msg222, +]); + +var msg223 = msg("115:01", dup169); + +var msg224 = msg("115", dup170); + +var select113 = linear_select([ + msg223, + msg224, +]); + +var msg225 = msg("116:01", dup151); + +var msg226 = msg("116", dup152); + +var select114 = linear_select([ + msg225, + msg226, +]); + +var msg227 = msg("117:01", dup151); + +var msg228 = msg("117", dup152); + +var select115 = linear_select([ + msg227, + msg228, +]); + +var msg229 = msg("118:01", dup169); + +var msg230 = msg("118", dup170); + +var select116 = linear_select([ + msg229, + msg230, +]); + +var msg231 = msg("119:01", dup169); + +var msg232 = msg("119", dup170); + +var select117 = linear_select([ + msg231, + msg232, +]); + +var msg233 = msg("120:01", dup169); + +var msg234 = msg("120", dup170); + +var select118 = linear_select([ + msg233, + msg234, +]); + +var msg235 = msg("121:01", dup169); + +var msg236 = msg("121", dup170); + +var select119 = linear_select([ + msg235, + msg236, +]); + +var msg237 = msg("122:01", dup169); + +var msg238 = msg("122", dup170); + +var select120 = linear_select([ + msg237, + msg238, +]); + +var msg239 = msg("123:01", dup169); + +var msg240 = msg("123", dup170); + +var select121 = linear_select([ + msg239, + msg240, +]); + +var msg241 = msg("124:01", dup169); + +var msg242 = msg("124", dup170); + +var select122 = linear_select([ + msg241, + msg242, +]); + +var msg243 = msg("125:01", dup169); + +var msg244 = msg("125", dup170); + +var select123 = linear_select([ + msg243, + msg244, +]); + +var msg245 = msg("126:01", dup169); + +var msg246 = msg("126", dup170); + +var select124 = linear_select([ + msg245, + msg246, +]); + +var msg247 = msg("127:01", dup169); + +var msg248 = msg("127", dup170); + +var select125 = linear_select([ + msg247, + msg248, +]); + +var msg249 = msg("128:01", dup169); + +var msg250 = msg("128", dup170); + +var select126 = linear_select([ + msg249, + msg250, +]); + +var msg251 = msg("129:01", dup169); + +var msg252 = msg("129", dup170); + +var select127 = linear_select([ + msg251, + msg252, +]); + +var msg253 = msg("130:01", dup169); + +var msg254 = msg("130", dup170); + +var select128 = linear_select([ + msg253, + msg254, +]); + +var msg255 = msg("131:01", dup151); + +var msg256 = msg("131", dup152); + +var select129 = linear_select([ + msg255, + msg256, +]); + +var msg257 = msg("132:01", dup151); + +var msg258 = msg("132", dup152); + +var select130 = linear_select([ + msg257, + msg258, +]); + +var msg259 = msg("133:01", dup151); + +var msg260 = msg("133", dup152); + +var select131 = linear_select([ + msg259, + msg260, +]); + +var part22 = tagval("MESSAGE#260:134:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup30, + dup2, + dup3, +])); + +var msg261 = msg("134:01", part22); + +var part23 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#261:134", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup30, + dup2, +])); + +var msg262 = msg("134", part23); + +var select132 = linear_select([ + msg261, + msg262, +]); + +var msg263 = msg("135:01", dup151); + +var msg264 = msg("135", dup152); + +var select133 = linear_select([ + msg263, + msg264, +]); + +var msg265 = msg("136:01", dup169); + +var msg266 = msg("136", dup170); + +var select134 = linear_select([ + msg265, + msg266, +]); + +var msg267 = msg("137:01", dup169); + +var msg268 = msg("137", dup170); + +var select135 = linear_select([ + msg267, + msg268, +]); + +var msg269 = msg("138:01", dup169); + +var msg270 = msg("138", dup170); + +var select136 = linear_select([ + msg269, + msg270, +]); + +var msg271 = msg("139:01", dup169); + +var msg272 = msg("139", dup170); + +var select137 = linear_select([ + msg271, + msg272, +]); + +var msg273 = msg("140:01", dup169); + +var msg274 = msg("140", dup170); + +var select138 = linear_select([ + msg273, + msg274, +]); + +var msg275 = msg("141:01", dup169); + +var msg276 = msg("141", dup170); + +var select139 = linear_select([ + msg275, + msg276, +]); + +var msg277 = msg("142:01", dup169); + +var msg278 = msg("142", dup170); + +var select140 = linear_select([ + msg277, + msg278, +]); + +var msg279 = msg("143:01", dup169); + +var msg280 = msg("143", dup170); + +var select141 = linear_select([ + msg279, + msg280, +]); + +var msg281 = msg("144:01", dup169); + +var msg282 = msg("144", dup170); + +var select142 = linear_select([ + msg281, + msg282, +]); + +var msg283 = msg("145:01", dup169); + +var msg284 = msg("145", dup170); + +var select143 = linear_select([ + msg283, + msg284, +]); + +var msg285 = msg("146:01", dup151); + +var msg286 = msg("146", dup152); + +var select144 = linear_select([ + msg285, + msg286, +]); + +var msg287 = msg("147:01", dup151); + +var msg288 = msg("147", dup152); + +var select145 = linear_select([ + msg287, + msg288, +]); + +var msg289 = msg("148:01", dup151); + +var msg290 = msg("148", dup152); + +var select146 = linear_select([ + msg289, + msg290, +]); + +var msg291 = msg("149:01", dup151); + +var msg292 = msg("149", dup152); + +var select147 = linear_select([ + msg291, + msg292, +]); + +var msg293 = msg("150:01", dup151); + +var msg294 = msg("150", dup152); + +var select148 = linear_select([ + msg293, + msg294, +]); + +var msg295 = msg("152:01", dup151); + +var msg296 = msg("152", dup152); + +var select149 = linear_select([ + msg295, + msg296, +]); + +var msg297 = msg("153:01", dup151); + +var msg298 = msg("153", dup152); + +var select150 = linear_select([ + msg297, + msg298, +]); + +var msg299 = msg("154:01", dup151); + +var msg300 = msg("154", dup152); + +var select151 = linear_select([ + msg299, + msg300, +]); + +var msg301 = msg("155:01", dup151); + +var msg302 = msg("155", dup152); + +var select152 = linear_select([ + msg301, + msg302, +]); + +var msg303 = msg("156:01", dup151); + +var msg304 = msg("156", dup152); + +var select153 = linear_select([ + msg303, + msg304, +]); + +var msg305 = msg("157:01", dup151); + +var msg306 = msg("157", dup152); + +var select154 = linear_select([ + msg305, + msg306, +]); + +var msg307 = msg("158:01", dup151); + +var msg308 = msg("158", dup152); + +var select155 = linear_select([ + msg307, + msg308, +]); + +var msg309 = msg("159:01", dup151); + +var msg310 = msg("159", dup152); + +var select156 = linear_select([ + msg309, + msg310, +]); + +var msg311 = msg("160:01", dup151); + +var msg312 = msg("160", dup152); + +var select157 = linear_select([ + msg311, + msg312, +]); + +var msg313 = msg("161:01", dup151); + +var msg314 = msg("161", dup152); + +var select158 = linear_select([ + msg313, + msg314, +]); + +var msg315 = msg("162:01", dup151); + +var msg316 = msg("162", dup152); + +var select159 = linear_select([ + msg315, + msg316, +]); + +var msg317 = msg("163:01", dup151); + +var msg318 = msg("163", dup152); + +var select160 = linear_select([ + msg317, + msg318, +]); + +var msg319 = msg("164:01", dup151); + +var msg320 = msg("164", dup152); + +var select161 = linear_select([ + msg319, + msg320, +]); + +var msg321 = msg("165:01", dup151); + +var msg322 = msg("165", dup152); + +var select162 = linear_select([ + msg321, + msg322, +]); + +var msg323 = msg("166:01", dup151); + +var msg324 = msg("166", dup152); + +var select163 = linear_select([ + msg323, + msg324, +]); + +var msg325 = msg("167:01", dup151); + +var msg326 = msg("167", dup152); + +var select164 = linear_select([ + msg325, + msg326, +]); + +var msg327 = msg("168:01", dup151); + +var msg328 = msg("168", dup152); + +var select165 = linear_select([ + msg327, + msg328, +]); + +var msg329 = msg("169:01", dup151); + +var msg330 = msg("169", dup152); + +var select166 = linear_select([ + msg329, + msg330, +]); + +var msg331 = msg("170:01", dup169); + +var msg332 = msg("170", dup170); + +var select167 = linear_select([ + msg331, + msg332, +]); + +var msg333 = msg("171:01", dup151); + +var msg334 = msg("171", dup152); + +var select168 = linear_select([ + msg333, + msg334, +]); + +var msg335 = msg("172:01", dup169); + +var msg336 = msg("172", dup170); + +var select169 = linear_select([ + msg335, + msg336, +]); + +var msg337 = msg("173:01", dup151); + +var msg338 = msg("173", dup152); + +var select170 = linear_select([ + msg337, + msg338, +]); + +var msg339 = msg("174:01", dup151); + +var msg340 = msg("174", dup152); + +var select171 = linear_select([ + msg339, + msg340, +]); + +var msg341 = msg("175:01", dup151); + +var msg342 = msg("175", dup152); + +var select172 = linear_select([ + msg341, + msg342, +]); + +var msg343 = msg("176:01", dup151); + +var msg344 = msg("176", dup152); + +var select173 = linear_select([ + msg343, + msg344, +]); + +var msg345 = msg("177:01", dup151); + +var msg346 = msg("177", dup152); + +var select174 = linear_select([ + msg345, + msg346, +]); + +var msg347 = msg("178:01", dup151); + +var msg348 = msg("178", dup152); + +var select175 = linear_select([ + msg347, + msg348, +]); + +var msg349 = msg("179:01", dup169); + +var msg350 = msg("179", dup170); + +var select176 = linear_select([ + msg349, + msg350, +]); + +var msg351 = msg("180:01", dup169); + +var msg352 = msg("180", dup170); + +var select177 = linear_select([ + msg351, + msg352, +]); + +var msg353 = msg("181:01", dup169); + +var msg354 = msg("181", dup170); + +var select178 = linear_select([ + msg353, + msg354, +]); + +var msg355 = msg("182:01", dup169); + +var msg356 = msg("182", dup170); + +var select179 = linear_select([ + msg355, + msg356, +]); + +var msg357 = msg("183:01", dup169); + +var msg358 = msg("183", dup170); + +var select180 = linear_select([ + msg357, + msg358, +]); + +var msg359 = msg("184:01", dup169); + +var msg360 = msg("184", dup170); + +var select181 = linear_select([ + msg359, + msg360, +]); + +var msg361 = msg("185:01", dup169); + +var msg362 = msg("185", dup170); + +var select182 = linear_select([ + msg361, + msg362, +]); + +var msg363 = msg("186:01", dup151); + +var msg364 = msg("186", dup152); + +var select183 = linear_select([ + msg363, + msg364, +]); + +var msg365 = msg("187:01", dup169); + +var msg366 = msg("187", dup170); + +var select184 = linear_select([ + msg365, + msg366, +]); + +var msg367 = msg("188:01", dup169); + +var msg368 = msg("188", dup170); + +var select185 = linear_select([ + msg367, + msg368, +]); + +var msg369 = msg("189:01", dup169); + +var msg370 = msg("189", dup170); + +var select186 = linear_select([ + msg369, + msg370, +]); + +var msg371 = msg("191:01", dup151); + +var msg372 = msg("191", dup152); + +var select187 = linear_select([ + msg371, + msg372, +]); + +var msg373 = msg("192:01", dup169); + +var msg374 = msg("192", dup170); + +var select188 = linear_select([ + msg373, + msg374, +]); + +var msg375 = msg("193:01", dup151); + +var msg376 = msg("193", dup152); + +var select189 = linear_select([ + msg375, + msg376, +]); + +var msg377 = msg("194:01", dup169); + +var msg378 = msg("194", dup170); + +var select190 = linear_select([ + msg377, + msg378, +]); + +var msg379 = msg("195:01", dup169); + +var msg380 = msg("195", dup170); + +var select191 = linear_select([ + msg379, + msg380, +]); + +var msg381 = msg("196:01", dup151); + +var msg382 = msg("196", dup152); + +var select192 = linear_select([ + msg381, + msg382, +]); + +var msg383 = msg("197:01", dup151); + +var msg384 = msg("197", dup152); + +var select193 = linear_select([ + msg383, + msg384, +]); + +var msg385 = msg("198:01", dup169); + +var msg386 = msg("198", dup170); + +var select194 = linear_select([ + msg385, + msg386, +]); + +var msg387 = msg("199:01", dup169); + +var msg388 = msg("199", dup170); + +var select195 = linear_select([ + msg387, + msg388, +]); + +var msg389 = msg("200:01", dup169); + +var msg390 = msg("200", dup170); + +var select196 = linear_select([ + msg389, + msg390, +]); + +var msg391 = msg("201:01", dup169); + +var msg392 = msg("201", dup170); + +var select197 = linear_select([ + msg391, + msg392, +]); + +var msg393 = msg("202:01", dup169); + +var msg394 = msg("202", dup170); + +var select198 = linear_select([ + msg393, + msg394, +]); + +var msg395 = msg("203:01", dup169); + +var msg396 = msg("203", dup170); + +var select199 = linear_select([ + msg395, + msg396, +]); + +var msg397 = msg("204:01", dup151); + +var msg398 = msg("204", dup152); + +var select200 = linear_select([ + msg397, + msg398, +]); + +var msg399 = msg("205:01", dup151); + +var msg400 = msg("205", dup152); + +var select201 = linear_select([ + msg399, + msg400, +]); + +var msg401 = msg("206:01", dup151); + +var msg402 = msg("206", dup152); + +var select202 = linear_select([ + msg401, + msg402, +]); + +var msg403 = msg("207:01", dup151); + +var msg404 = msg("207", dup152); + +var select203 = linear_select([ + msg403, + msg404, +]); + +var msg405 = msg("208:01", dup151); + +var msg406 = msg("208", dup152); + +var select204 = linear_select([ + msg405, + msg406, +]); + +var msg407 = msg("209:01", dup169); + +var msg408 = msg("209", dup170); + +var select205 = linear_select([ + msg407, + msg408, +]); + +var msg409 = msg("211:01", dup169); + +var msg410 = msg("211", dup170); + +var select206 = linear_select([ + msg409, + msg410, +]); + +var msg411 = msg("212:01", dup169); + +var msg412 = msg("212", dup170); + +var select207 = linear_select([ + msg411, + msg412, +]); + +var msg413 = msg("213:01", dup169); + +var msg414 = msg("213", dup170); + +var select208 = linear_select([ + msg413, + msg414, +]); + +var msg415 = msg("214:01", dup151); + +var msg416 = msg("214", dup152); + +var select209 = linear_select([ + msg415, + msg416, +]); + +var msg417 = msg("215:01", dup151); + +var msg418 = msg("215", dup152); + +var select210 = linear_select([ + msg417, + msg418, +]); + +var msg419 = msg("216:01", dup151); + +var msg420 = msg("216", dup152); + +var select211 = linear_select([ + msg419, + msg420, +]); + +var msg421 = msg("217:01", dup169); + +var msg422 = msg("217", dup170); + +var select212 = linear_select([ + msg421, + msg422, +]); + +var msg423 = msg("218:01", dup169); + +var msg424 = msg("218", dup170); + +var select213 = linear_select([ + msg423, + msg424, +]); + +var msg425 = msg("219:01", dup169); + +var msg426 = msg("219", dup170); + +var select214 = linear_select([ + msg425, + msg426, +]); + +var msg427 = msg("220:01", dup169); + +var msg428 = msg("220", dup170); + +var select215 = linear_select([ + msg427, + msg428, +]); + +var msg429 = msg("221:01", dup169); + +var msg430 = msg("221", dup170); + +var select216 = linear_select([ + msg429, + msg430, +]); + +var msg431 = msg("222:01", dup151); + +var msg432 = msg("222", dup152); + +var select217 = linear_select([ + msg431, + msg432, +]); + +var msg433 = msg("223:01", dup169); + +var msg434 = msg("223", dup170); + +var select218 = linear_select([ + msg433, + msg434, +]); + +var msg435 = msg("224:01", dup169); + +var msg436 = msg("224", dup170); + +var select219 = linear_select([ + msg435, + msg436, +]); + +var msg437 = msg("229:01", dup169); + +var msg438 = msg("229", dup170); + +var select220 = linear_select([ + msg437, + msg438, +]); + +var msg439 = msg("230:01", dup151); + +var msg440 = msg("230", dup152); + +var select221 = linear_select([ + msg439, + msg440, +]); + +var msg441 = msg("231:01", dup151); + +var msg442 = msg("231", dup152); + +var select222 = linear_select([ + msg441, + msg442, +]); + +var msg443 = msg("232:01", dup151); + +var msg444 = msg("232", dup152); + +var select223 = linear_select([ + msg443, + msg444, +]); + +var msg445 = msg("233:01", dup151); + +var msg446 = msg("233", dup152); + +var select224 = linear_select([ + msg445, + msg446, +]); + +var msg447 = msg("236:01", dup153); + +var msg448 = msg("236", dup154); + +var select225 = linear_select([ + msg447, + msg448, +]); + +var msg449 = msg("237:01", dup169); + +var msg450 = msg("237", dup170); + +var select226 = linear_select([ + msg449, + msg450, +]); + +var msg451 = msg("238:01", dup151); + +var msg452 = msg("238", dup152); + +var select227 = linear_select([ + msg451, + msg452, +]); + +var msg453 = msg("239:01", dup169); + +var msg454 = msg("239", dup170); + +var select228 = linear_select([ + msg453, + msg454, +]); + +var msg455 = msg("240:01", dup169); + +var msg456 = msg("240", dup170); + +var select229 = linear_select([ + msg455, + msg456, +]); + +var msg457 = msg("241:01", dup169); + +var msg458 = msg("241", dup170); + +var select230 = linear_select([ + msg457, + msg458, +]); + +var msg459 = msg("243:01", dup151); + +var msg460 = msg("243", dup152); + +var select231 = linear_select([ + msg459, + msg460, +]); + +var msg461 = msg("244:01", dup151); + +var msg462 = msg("244", dup152); + +var select232 = linear_select([ + msg461, + msg462, +]); + +var msg463 = msg("246:01", dup169); + +var msg464 = msg("246", dup170); + +var select233 = linear_select([ + msg463, + msg464, +]); + +var msg465 = msg("247:01", dup169); + +var msg466 = msg("247", dup170); + +var select234 = linear_select([ + msg465, + msg466, +]); + +var msg467 = msg("248:01", dup151); + +var msg468 = msg("248", dup152); + +var select235 = linear_select([ + msg467, + msg468, +]); + +var msg469 = msg("249:01", dup151); + +var msg470 = msg("249", dup152); + +var select236 = linear_select([ + msg469, + msg470, +]); + +var msg471 = msg("250:01", dup151); + +var msg472 = msg("250", dup152); + +var select237 = linear_select([ + msg471, + msg472, +]); + +var msg473 = msg("251:01", dup169); + +var msg474 = msg("251", dup170); + +var select238 = linear_select([ + msg473, + msg474, +]); + +var msg475 = msg("252:01", dup169); + +var msg476 = msg("252", dup170); + +var select239 = linear_select([ + msg475, + msg476, +]); + +var msg477 = msg("253:01", dup151); + +var msg478 = msg("253", dup152); + +var select240 = linear_select([ + msg477, + msg478, +]); + +var msg479 = msg("254:01", dup169); + +var msg480 = msg("254", dup170); + +var select241 = linear_select([ + msg479, + msg480, +]); + +var msg481 = msg("255:01", dup151); + +var msg482 = msg("255", dup152); + +var select242 = linear_select([ + msg481, + msg482, +]); + +var msg483 = msg("256:01", dup169); + +var msg484 = msg("256", dup170); + +var select243 = linear_select([ + msg483, + msg484, +]); + +var msg485 = msg("257:01", dup169); + +var msg486 = msg("257", dup170); + +var select244 = linear_select([ + msg485, + msg486, +]); + +var msg487 = msg("259:01", dup169); + +var msg488 = msg("259", dup170); + +var select245 = linear_select([ + msg487, + msg488, +]); + +var msg489 = msg("260:01", dup151); + +var msg490 = msg("260", dup152); + +var select246 = linear_select([ + msg489, + msg490, +]); + +var msg491 = msg("261:01", dup151); + +var msg492 = msg("261", dup152); + +var select247 = linear_select([ + msg491, + msg492, +]); + +var msg493 = msg("262:01", dup151); + +var msg494 = msg("262", dup152); + +var select248 = linear_select([ + msg493, + msg494, +]); + +var msg495 = msg("263:01", dup151); + +var msg496 = msg("263", dup152); + +var select249 = linear_select([ + msg495, + msg496, +]); + +var msg497 = msg("264:01", dup169); + +var msg498 = msg("264", dup170); + +var select250 = linear_select([ + msg497, + msg498, +]); + +var msg499 = msg("265:01", dup169); + +var msg500 = msg("265", dup170); + +var select251 = linear_select([ + msg499, + msg500, +]); + +var msg501 = msg("266:01", dup169); + +var msg502 = msg("266", dup170); + +var select252 = linear_select([ + msg501, + msg502, +]); + +var msg503 = msg("267:01", dup169); + +var msg504 = msg("267", dup170); + +var select253 = linear_select([ + msg503, + msg504, +]); + +var msg505 = msg("268:01", dup169); + +var msg506 = msg("268", dup170); + +var select254 = linear_select([ + msg505, + msg506, +]); + +var msg507 = msg("269:01", dup151); + +var msg508 = msg("269", dup152); + +var select255 = linear_select([ + msg507, + msg508, +]); + +var msg509 = msg("270:01", dup169); + +var msg510 = msg("270", dup170); + +var select256 = linear_select([ + msg509, + msg510, +]); + +var msg511 = msg("271:01", dup151); + +var msg512 = msg("271", dup152); + +var select257 = linear_select([ + msg511, + msg512, +]); + +var msg513 = msg("272:01", dup169); + +var msg514 = msg("272", dup170); + +var select258 = linear_select([ + msg513, + msg514, +]); + +var msg515 = msg("273:01", dup169); + +var msg516 = msg("273", dup170); + +var select259 = linear_select([ + msg515, + msg516, +]); + +var msg517 = msg("274:01", dup169); + +var msg518 = msg("274", dup170); + +var select260 = linear_select([ + msg517, + msg518, +]); + +var msg519 = msg("275:01", dup169); + +var msg520 = msg("275", dup170); + +var select261 = linear_select([ + msg519, + msg520, +]); + +var msg521 = msg("276:01", dup169); + +var msg522 = msg("276", dup170); + +var select262 = linear_select([ + msg521, + msg522, +]); + +var msg523 = msg("277:01", dup169); + +var msg524 = msg("277", dup170); + +var select263 = linear_select([ + msg523, + msg524, +]); + +var msg525 = msg("278:01", dup169); + +var msg526 = msg("278", dup170); + +var select264 = linear_select([ + msg525, + msg526, +]); + +var msg527 = msg("279:01", dup169); + +var msg528 = msg("279", dup170); + +var select265 = linear_select([ + msg527, + msg528, +]); + +var msg529 = msg("280:01", dup151); + +var msg530 = msg("280", dup152); + +var select266 = linear_select([ + msg529, + msg530, +]); + +var msg531 = msg("281:01", dup151); + +var msg532 = msg("281", dup152); + +var select267 = linear_select([ + msg531, + msg532, +]); + +var msg533 = msg("282:01", dup169); + +var msg534 = msg("282", dup170); + +var select268 = linear_select([ + msg533, + msg534, +]); + +var msg535 = msg("283:01", dup169); + +var msg536 = msg("283", dup170); + +var select269 = linear_select([ + msg535, + msg536, +]); + +var msg537 = msg("284:01", dup151); + +var msg538 = msg("284", dup152); + +var select270 = linear_select([ + msg537, + msg538, +]); + +var msg539 = msg("285:01", dup159); + +var msg540 = msg("285", dup160); + +var select271 = linear_select([ + msg539, + msg540, +]); + +var msg541 = msg("286:01", dup169); + +var msg542 = msg("286", dup170); + +var select272 = linear_select([ + msg541, + msg542, +]); + +var msg543 = msg("287:01", dup169); + +var msg544 = msg("287", dup170); + +var select273 = linear_select([ + msg543, + msg544, +]); + +var msg545 = msg("288:01", dup169); + +var msg546 = msg("288", dup170); + +var select274 = linear_select([ + msg545, + msg546, +]); + +var msg547 = msg("289:01", dup169); + +var msg548 = msg("289", dup170); + +var select275 = linear_select([ + msg547, + msg548, +]); + +var msg549 = msg("290:01", dup169); + +var msg550 = msg("290", dup170); + +var select276 = linear_select([ + msg549, + msg550, +]); + +var msg551 = msg("291:01", dup169); + +var msg552 = msg("291", dup170); + +var select277 = linear_select([ + msg551, + msg552, +]); + +var msg553 = msg("292:01", dup169); + +var msg554 = msg("292", dup170); + +var select278 = linear_select([ + msg553, + msg554, +]); + +var msg555 = msg("293:01", dup169); + +var msg556 = msg("293", dup170); + +var select279 = linear_select([ + msg555, + msg556, +]); + +var msg557 = msg("294:01", dup169); + +var msg558 = msg("294", dup170); + +var select280 = linear_select([ + msg557, + msg558, +]); + +var msg559 = msg("295:01", dup169); + +var msg560 = msg("295", dup170); + +var select281 = linear_select([ + msg559, + msg560, +]); + +var msg561 = msg("296:01", dup169); + +var msg562 = msg("296", dup170); + +var select282 = linear_select([ + msg561, + msg562, +]); + +var msg563 = msg("297:01", dup151); + +var msg564 = msg("297", dup152); + +var select283 = linear_select([ + msg563, + msg564, +]); + +var msg565 = msg("298:01", dup151); + +var msg566 = msg("298", dup152); + +var select284 = linear_select([ + msg565, + msg566, +]); + +var msg567 = msg("299:01", dup169); + +var msg568 = msg("299", dup170); + +var select285 = linear_select([ + msg567, + msg568, +]); + +var part24 = // "Pattern{Field(application,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld10,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" +match("MESSAGE#568:300:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); + +var all1 = all_match({ + processors: [ + dup31, + dup172, + dup173, + dup174, + dup175, + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, + dup185, + dup186, + dup187, + dup188, + dup189, + dup190, + dup191, + dup192, + dup193, + dup194, + part24, + ], + on_success: processor_chain([ + dup4, + dup2, + dup3, + dup24, + ]), +}); + +var msg569 = msg("300:02", all1); + +var part25 = tagval("MESSAGE#569:300:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup4, + dup2, + dup3, + dup24, +])); + +var msg570 = msg("300:01", part25); + +var msg571 = msg("300", dup154); + +var select286 = linear_select([ + msg569, + msg570, + msg571, +]); + +var msg572 = msg("301:01", dup163); + +var msg573 = msg("301", dup164); + +var select287 = linear_select([ + msg572, + msg573, +]); + +var part26 = // "Pattern{Field(application,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld12,false), Constant(';SessionDuration='), Field(duration_string,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" +match("MESSAGE#573:302:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld12};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); + +var all2 = all_match({ + processors: [ + dup31, + dup172, + dup173, + dup174, + dup175, + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, + dup185, + dup186, + dup187, + dup188, + dup189, + dup190, + dup191, + dup192, + dup193, + dup194, + part26, + ], + on_success: processor_chain([ + dup21, + dup2, + dup3, + dup24, + ]), +}); + +var msg574 = msg("302:02", all2); + +var msg575 = msg("302:01", dup163); + +var msg576 = msg("302", dup164); + +var select288 = linear_select([ + msg574, + msg575, + msg576, +]); + +var msg577 = msg("303:01", dup163); + +var msg578 = msg("303", dup164); + +var select289 = linear_select([ + msg577, + msg578, +]); + +var part27 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="DstHost='), Field(p0,false)}" +match("MESSAGE#578:304:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"DstHost=%{p0}"); + +var part28 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="DstHost='), Field(p0,false)}" +match("MESSAGE#578:304:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"DstHost=%{p0}"); + +var select290 = linear_select([ + part27, + part28, +]); + +var part29 = // "Pattern{Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld10,false), Constant(';SessionDuration='), Field(duration_string,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" +match("MESSAGE#578:304:02/24", "nwparser.p0", "%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); + +var all3 = all_match({ + processors: [ + dup31, + dup172, + dup173, + dup174, + dup175, + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, + dup185, + dup186, + dup187, + dup188, + dup189, + dup190, + dup191, + dup192, + dup193, + select290, + part29, + ], + on_success: processor_chain([ + dup26, + dup2, + dup3, + dup24, + ]), +}); + +var msg579 = msg("304:02", all3); + +var msg580 = msg("304:01", dup169); + +var msg581 = msg("304", dup170); + +var select291 = linear_select([ + msg579, + msg580, + msg581, +]); + +var msg582 = msg("305:01", dup169); + +var msg583 = msg("305", dup170); + +var select292 = linear_select([ + msg582, + msg583, +]); + +var msg584 = msg("306:01", dup151); + +var msg585 = msg("306", dup152); + +var select293 = linear_select([ + msg584, + msg585, +]); + +var msg586 = msg("307:01", dup151); + +var msg587 = msg("307", dup152); + +var select294 = linear_select([ + msg586, + msg587, +]); + +var part30 = tagval("MESSAGE#587:308:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup78, + dup2, + dup3, +])); + +var msg588 = msg("308:01", part30); + +var part31 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#588:308", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup78, + dup2, +])); + +var msg589 = msg("308", part31); + +var select295 = linear_select([ + msg588, + msg589, +]); + +var part32 = tagval("MESSAGE#589:309:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup10, + dup6, + dup7, + dup8, + dup9, + dup2, + dup3, +])); + +var msg590 = msg("309:01", part32); + +var part33 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#590:309", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup10, + dup6, + dup7, + dup8, + dup9, + dup2, +])); + +var msg591 = msg("309", part33); + +var select296 = linear_select([ + msg590, + msg591, +]); + +var msg592 = msg("317:01", dup195); + +var msg593 = msg("317", dup196); + +var select297 = linear_select([ + msg592, + msg593, +]); + +var msg594 = msg("316:01", dup195); + +var msg595 = msg("316", dup196); + +var select298 = linear_select([ + msg594, + msg595, +]); + +var msg596 = msg("355:01", dup197); + +var msg597 = msg("355", dup198); + +var select299 = linear_select([ + msg596, + msg597, +]); + +var msg598 = msg("356:01", dup197); + +var msg599 = msg("356", dup198); + +var select300 = linear_select([ + msg598, + msg599, +]); + +var msg600 = msg("357:01", dup199); + +var msg601 = msg("357", dup200); + +var select301 = linear_select([ + msg600, + msg601, +]); + +var msg602 = msg("358:01", dup199); + +var msg603 = msg("358", dup200); + +var select302 = linear_select([ + msg602, + msg603, +]); + +var part34 = tagval("MESSAGE#603:190:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup84, + dup2, + dup3, +])); + +var msg604 = msg("190:01", part34); + +var part35 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#604:190", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup84, + dup2, +])); + +var msg605 = msg("190", part35); + +var select303 = linear_select([ + msg604, + msg605, +]); + +var msg606 = msg("5:01", dup161); + +var msg607 = msg("5", dup162); + +var select304 = linear_select([ + msg606, + msg607, +]); + +var msg608 = msg("310:01", dup153); + +var msg609 = msg("310", dup154); + +var select305 = linear_select([ + msg608, + msg609, +]); + +var msg610 = msg("311:01", dup153); + +var msg611 = msg("311", dup154); + +var select306 = linear_select([ + msg610, + msg611, +]); + +var msg612 = msg("312:01", dup153); + +var msg613 = msg("312", dup154); + +var select307 = linear_select([ + msg612, + msg613, +]); + +var msg614 = msg("313:01", dup153); + +var msg615 = msg("313", dup154); + +var select308 = linear_select([ + msg614, + msg615, +]); + +var msg616 = msg("359:01", dup153); + +var msg617 = msg("359", dup154); + +var select309 = linear_select([ + msg616, + msg617, +]); + +var msg618 = msg("372", dup201); + +var msg619 = msg("374", dup201); + +var msg620 = msg("376", dup201); + +var part36 = // "Pattern{Constant('"'), Field(fld89,false), Constant('";LogonDomain='), Field(p0,false)}" +match("MESSAGE#620:411:01/17_0", "nwparser.p0", "\"%{fld89}\";LogonDomain=%{p0}"); + +var part37 = // "Pattern{Field(fld89,false), Constant(';LogonDomain='), Field(p0,false)}" +match("MESSAGE#620:411:01/17_1", "nwparser.p0", "%{fld89};LogonDomain=%{p0}"); + +var select310 = linear_select([ + part36, + part37, +]); + +var part38 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="Command='), Field(p0,false)}" +match("MESSAGE#620:411:01/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"Command=%{p0}"); + +var part39 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="Command='), Field(p0,false)}" +match("MESSAGE#620:411:01/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"Command=%{p0}"); + +var select311 = linear_select([ + part38, + part39, +]); + +var part40 = // "Pattern{Field(param,false), Constant(';ConnectionComponentId='), Field(fld67,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld11,false), Constant(';RDPOffset='), Field(fld12,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';VIDOffset='), Field(fld13,false), Constant(';')}" +match("MESSAGE#620:411:01/24", "nwparser.p0", "%{param};ConnectionComponentId=%{fld67};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld11};RDPOffset=%{fld12};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};VIDOffset=%{fld13};"); + +var all4 = all_match({ + processors: [ + dup31, + dup172, + dup173, + dup174, + dup175, + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, + dup185, + dup186, + dup187, + select310, + dup189, + dup190, + dup191, + dup192, + dup193, + select311, + part40, + ], + on_success: processor_chain([ + dup4, + dup2, + dup3, + dup24, + ]), +}); + +var msg621 = msg("411:01", all4); + +var part41 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';ProcessId='), Field(process_id,false), Constant(';ProcessName='), Field(process,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';RDPOffset='), Field(fld4,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" +match("MESSAGE#621:411/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};ProcessId=%{process_id};ProcessName=%{process};Protocol=%{protocol};PSMID=%{fld3};RDPOffset=%{fld4};SessionID=%{sessionid};SrcHost=%{shost};User=%{fld5};VIDOffset=%{fld6};\""); + +var select312 = linear_select([ + part41, + dup150, +]); + +var all5 = all_match({ + processors: [ + dup31, + dup202, + dup87, + dup203, + dup90, + dup204, + dup93, + dup205, + dup96, + dup206, + dup99, + dup207, + dup102, + dup208, + dup105, + dup209, + dup108, + dup210, + dup111, + dup211, + dup114, + dup212, + dup119, + dup213, + dup122, + dup214, + dup125, + dup215, + dup128, + dup216, + dup131, + dup217, + dup134, + dup218, + dup137, + dup219, + dup140, + dup220, + dup143, + dup221, + dup146, + dup222, + dup149, + select312, + ], + on_success: processor_chain([ + dup4, + dup2, + dup3, + ]), +}); + +var msg622 = msg("411", all5); + +var select313 = linear_select([ + msg621, + msg622, +]); + +var part42 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location="'), Field(directory,false), Constant('";Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false)}" +match("MESSAGE#622:385", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=\"%{directory}\";Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info}", processor_chain([ + dup4, + dup2, + dup3, +])); + +var msg623 = msg("385", part42); + +var part43 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';SSHOffset='), Field(fld4,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" +match("MESSAGE#623:361/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};SSHOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); + +var select314 = linear_select([ + part43, + dup150, +]); + +var all6 = all_match({ + processors: [ + dup31, + dup202, + dup87, + dup203, + dup90, + dup204, + dup93, + dup205, + dup96, + dup206, + dup99, + dup207, + dup102, + dup208, + dup105, + dup209, + dup108, + dup210, + dup111, + dup211, + dup114, + dup212, + dup119, + dup213, + dup122, + dup214, + dup125, + dup215, + dup128, + dup216, + dup131, + dup217, + dup134, + dup218, + dup137, + dup219, + dup140, + dup220, + dup143, + dup221, + dup146, + dup222, + dup149, + select314, + ], + on_success: processor_chain([ + dup4, + dup2, + dup3, + ]), +}); + +var msg624 = msg("361", all6); + +var part44 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';TXTOffset='), Field(fld4,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" +match("MESSAGE#624:412/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};TXTOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); + +var select315 = linear_select([ + part44, + dup150, +]); + +var all7 = all_match({ + processors: [ + dup31, + dup202, + dup87, + dup203, + dup90, + dup204, + dup93, + dup205, + dup96, + dup206, + dup99, + dup207, + dup102, + dup208, + dup105, + dup209, + dup108, + dup210, + dup111, + dup211, + dup114, + dup212, + dup119, + dup213, + dup122, + dup214, + dup125, + dup215, + dup128, + dup216, + dup131, + dup217, + dup134, + dup218, + dup137, + dup219, + dup140, + dup220, + dup143, + dup221, + dup146, + dup222, + dup149, + select315, + ], + on_success: processor_chain([ + dup4, + dup2, + dup3, + ]), +}); + +var msg625 = msg("412", all7); + +var msg626 = msg("378", dup153); + +var msg627 = msg("321", dup153); + +var msg628 = msg("322", dup153); + +var msg629 = msg("323", dup153); + +var msg630 = msg("318", dup153); + +var msg631 = msg("380", dup153); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "1": select2, + "10": select9, + "100": select99, + "101": select100, + "102": select101, + "103": select102, + "104": select103, + "105": select104, + "106": select105, + "107": select106, + "108": select107, + "109": select108, + "11": select10, + "110": select109, + "111": select110, + "112": select111, + "114": select112, + "115": select113, + "116": select114, + "117": select115, + "118": select116, + "119": select117, + "12": select11, + "120": select118, + "121": select119, + "122": select120, + "123": select121, + "124": select122, + "125": select123, + "126": select124, + "127": select125, + "128": select126, + "129": select127, + "13": select12, + "130": select128, + "131": select129, + "132": select130, + "133": select131, + "134": select132, + "135": select133, + "136": select134, + "137": select135, + "138": select136, + "139": select137, + "14": select13, + "140": select138, + "141": select139, + "142": select140, + "143": select141, + "144": select142, + "145": select143, + "146": select144, + "147": select145, + "148": select146, + "149": select147, + "15": select14, + "150": select148, + "152": select149, + "153": select150, + "154": select151, + "155": select152, + "156": select153, + "157": select154, + "158": select155, + "159": select156, + "16": select15, + "160": select157, + "161": select158, + "162": select159, + "163": select160, + "164": select161, + "165": select162, + "166": select163, + "167": select164, + "168": select165, + "169": select166, + "17": select16, + "170": select167, + "171": select168, + "172": select169, + "173": select170, + "174": select171, + "175": select172, + "176": select173, + "177": select174, + "178": select175, + "179": select176, + "18": select17, + "180": select177, + "181": select178, + "182": select179, + "183": select180, + "184": select181, + "185": select182, + "186": select183, + "187": select184, + "188": select185, + "189": select186, + "19": select18, + "190": select303, + "191": select187, + "192": select188, + "193": select189, + "194": select190, + "195": select191, + "196": select192, + "197": select193, + "198": select194, + "199": select195, + "2": select3, + "20": select19, + "200": select196, + "201": select197, + "202": select198, + "203": select199, + "204": select200, + "205": select201, + "206": select202, + "207": select203, + "208": select204, + "209": select205, + "21": select20, + "211": select206, + "212": select207, + "213": select208, + "214": select209, + "215": select210, + "216": select211, + "217": select212, + "218": select213, + "219": select214, + "22": select21, + "220": select215, + "221": select216, + "222": select217, + "223": select218, + "224": select219, + "229": select220, + "23": select22, + "230": select221, + "231": select222, + "232": select223, + "233": select224, + "236": select225, + "237": select226, + "238": select227, + "239": select228, + "24": select23, + "240": select229, + "241": select230, + "243": select231, + "244": select232, + "246": select233, + "247": select234, + "248": select235, + "249": select236, + "25": select24, + "250": select237, + "251": select238, + "252": select239, + "253": select240, + "254": select241, + "255": select242, + "256": select243, + "257": select244, + "259": select245, + "26": select25, + "260": select246, + "261": select247, + "262": select248, + "263": select249, + "264": select250, + "265": select251, + "266": select252, + "267": select253, + "268": select254, + "269": select255, + "27": select26, + "270": select256, + "271": select257, + "272": select258, + "273": select259, + "274": select260, + "275": select261, + "276": select262, + "277": select263, + "278": select264, + "279": select265, + "28": select27, + "280": select266, + "281": select267, + "282": select268, + "283": select269, + "284": select270, + "285": select271, + "286": select272, + "287": select273, + "288": select274, + "289": select275, + "29": select28, + "290": select276, + "291": select277, + "292": select278, + "293": select279, + "294": select280, + "295": select281, + "296": select282, + "297": select283, + "298": select284, + "299": select285, + "3": select4, + "30": select29, + "300": select286, + "301": select287, + "302": select288, + "303": select289, + "304": select291, + "305": select292, + "306": select293, + "307": select294, + "308": select295, + "309": select296, + "31": select30, + "310": select305, + "311": select306, + "312": select307, + "313": select308, + "316": select298, + "317": select297, + "318": msg630, + "32": select31, + "321": msg627, + "322": msg628, + "323": msg629, + "33": select32, + "34": select33, + "35": select34, + "355": select299, + "356": select300, + "357": select301, + "358": select302, + "359": select309, + "36": select35, + "361": msg624, + "37": select36, + "372": msg618, + "374": msg619, + "376": msg620, + "378": msg626, + "38": select37, + "380": msg631, + "385": msg623, + "39": select38, + "4": select5, + "40": select39, + "41": select40, + "411": select313, + "412": msg625, + "42": select41, + "43": select42, + "44": select43, + "45": select44, + "46": select45, + "47": select46, + "48": select47, + "49": select48, + "5": select304, + "50": select49, + "51": select50, + "52": select51, + "53": select52, + "54": select53, + "55": select54, + "56": select55, + "57": select56, + "58": select57, + "59": select58, + "60": select59, + "61": select60, + "62": select61, + "63": select62, + "64": select63, + "65": select64, + "66": select65, + "67": select66, + "68": select67, + "69": select68, + "7": select6, + "70": select69, + "71": select70, + "72": select71, + "73": select72, + "74": select73, + "75": select74, + "76": select75, + "77": select76, + "78": select77, + "79": select78, + "8": select7, + "80": select79, + "81": select80, + "82": select81, + "83": select82, + "84": select83, + "85": select84, + "86": select85, + "87": select86, + "88": select87, + "89": select88, + "9": select8, + "90": select89, + "91": select90, + "92": select91, + "93": select92, + "94": select93, + "95": select94, + "96": select95, + "97": select96, + "98": select97, + "99": select98, + }), +]); + +var part45 = // "Pattern{Constant('Version='), Field(p0,false)}" +match("MESSAGE#568:300:02/0", "nwparser.payload", "Version=%{p0}"); + +var part46 = // "Pattern{Constant('"'), Field(version,false), Constant('";Message='), Field(p0,false)}" +match("MESSAGE#568:300:02/1_0", "nwparser.p0", "\"%{version}\";Message=%{p0}"); + +var part47 = // "Pattern{Field(version,false), Constant(';Message='), Field(p0,false)}" +match("MESSAGE#568:300:02/1_1", "nwparser.p0", "%{version};Message=%{p0}"); + +var part48 = // "Pattern{Constant('"'), Field(action,false), Constant('";Issuer='), Field(p0,false)}" +match("MESSAGE#568:300:02/2_0", "nwparser.p0", "\"%{action}\";Issuer=%{p0}"); + +var part49 = // "Pattern{Field(action,false), Constant(';Issuer='), Field(p0,false)}" +match("MESSAGE#568:300:02/2_1", "nwparser.p0", "%{action};Issuer=%{p0}"); + +var part50 = // "Pattern{Constant('"'), Field(username,false), Constant('";Station='), Field(p0,false)}" +match("MESSAGE#568:300:02/3_0", "nwparser.p0", "\"%{username}\";Station=%{p0}"); + +var part51 = // "Pattern{Field(username,false), Constant(';Station='), Field(p0,false)}" +match("MESSAGE#568:300:02/3_1", "nwparser.p0", "%{username};Station=%{p0}"); + +var part52 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";File='), Field(p0,false)}" +match("MESSAGE#568:300:02/4_0", "nwparser.p0", "\"%{hostip}\";File=%{p0}"); + +var part53 = // "Pattern{Field(hostip,false), Constant(';File='), Field(p0,false)}" +match("MESSAGE#568:300:02/4_1", "nwparser.p0", "%{hostip};File=%{p0}"); + +var part54 = // "Pattern{Constant('"'), Field(filename,false), Constant('";Safe='), Field(p0,false)}" +match("MESSAGE#568:300:02/5_0", "nwparser.p0", "\"%{filename}\";Safe=%{p0}"); + +var part55 = // "Pattern{Field(filename,false), Constant(';Safe='), Field(p0,false)}" +match("MESSAGE#568:300:02/5_1", "nwparser.p0", "%{filename};Safe=%{p0}"); + +var part56 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";Location='), Field(p0,false)}" +match("MESSAGE#568:300:02/6_0", "nwparser.p0", "\"%{group_object}\";Location=%{p0}"); + +var part57 = // "Pattern{Field(group_object,false), Constant(';Location='), Field(p0,false)}" +match("MESSAGE#568:300:02/6_1", "nwparser.p0", "%{group_object};Location=%{p0}"); + +var part58 = // "Pattern{Constant('"'), Field(directory,false), Constant('";Category='), Field(p0,false)}" +match("MESSAGE#568:300:02/7_0", "nwparser.p0", "\"%{directory}\";Category=%{p0}"); + +var part59 = // "Pattern{Field(directory,false), Constant(';Category='), Field(p0,false)}" +match("MESSAGE#568:300:02/7_1", "nwparser.p0", "%{directory};Category=%{p0}"); + +var part60 = // "Pattern{Constant('"'), Field(category,false), Constant('";RequestId='), Field(p0,false)}" +match("MESSAGE#568:300:02/8_0", "nwparser.p0", "\"%{category}\";RequestId=%{p0}"); + +var part61 = // "Pattern{Field(category,false), Constant(';RequestId='), Field(p0,false)}" +match("MESSAGE#568:300:02/8_1", "nwparser.p0", "%{category};RequestId=%{p0}"); + +var part62 = // "Pattern{Constant('"'), Field(id1,false), Constant('";Reason='), Field(p0,false)}" +match("MESSAGE#568:300:02/9_0", "nwparser.p0", "\"%{id1}\";Reason=%{p0}"); + +var part63 = // "Pattern{Field(id1,false), Constant(';Reason='), Field(p0,false)}" +match("MESSAGE#568:300:02/9_1", "nwparser.p0", "%{id1};Reason=%{p0}"); + +var part64 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";Severity='), Field(p0,false)}" +match("MESSAGE#568:300:02/10_0", "nwparser.p0", "\"%{event_description}\";Severity=%{p0}"); + +var part65 = // "Pattern{Field(event_description,false), Constant(';Severity='), Field(p0,false)}" +match("MESSAGE#568:300:02/10_1", "nwparser.p0", "%{event_description};Severity=%{p0}"); + +var part66 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser='), Field(p0,false)}" +match("MESSAGE#568:300:02/11_0", "nwparser.p0", "\"%{severity}\";SourceUser=%{p0}"); + +var part67 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(p0,false)}" +match("MESSAGE#568:300:02/11_1", "nwparser.p0", "%{severity};SourceUser=%{p0}"); + +var part68 = // "Pattern{Constant('"'), Field(group,false), Constant('";TargetUser='), Field(p0,false)}" +match("MESSAGE#568:300:02/12_0", "nwparser.p0", "\"%{group}\";TargetUser=%{p0}"); + +var part69 = // "Pattern{Field(group,false), Constant(';TargetUser='), Field(p0,false)}" +match("MESSAGE#568:300:02/12_1", "nwparser.p0", "%{group};TargetUser=%{p0}"); + +var part70 = // "Pattern{Constant('"'), Field(uid,false), Constant('";GatewayStation='), Field(p0,false)}" +match("MESSAGE#568:300:02/13_0", "nwparser.p0", "\"%{uid}\";GatewayStation=%{p0}"); + +var part71 = // "Pattern{Field(uid,false), Constant(';GatewayStation='), Field(p0,false)}" +match("MESSAGE#568:300:02/13_1", "nwparser.p0", "%{uid};GatewayStation=%{p0}"); + +var part72 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";TicketID='), Field(p0,false)}" +match("MESSAGE#568:300:02/14_0", "nwparser.p0", "\"%{saddr}\";TicketID=%{p0}"); + +var part73 = // "Pattern{Field(saddr,false), Constant(';TicketID='), Field(p0,false)}" +match("MESSAGE#568:300:02/14_1", "nwparser.p0", "%{saddr};TicketID=%{p0}"); + +var part74 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";PolicyID='), Field(p0,false)}" +match("MESSAGE#568:300:02/15_0", "nwparser.p0", "\"%{operation_id}\";PolicyID=%{p0}"); + +var part75 = // "Pattern{Field(operation_id,false), Constant(';PolicyID='), Field(p0,false)}" +match("MESSAGE#568:300:02/15_1", "nwparser.p0", "%{operation_id};PolicyID=%{p0}"); + +var part76 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";UserName='), Field(p0,false)}" +match("MESSAGE#568:300:02/16_0", "nwparser.p0", "\"%{policyname}\";UserName=%{p0}"); + +var part77 = // "Pattern{Field(policyname,false), Constant(';UserName='), Field(p0,false)}" +match("MESSAGE#568:300:02/16_1", "nwparser.p0", "%{policyname};UserName=%{p0}"); + +var part78 = // "Pattern{Constant('"'), Field(fld11,false), Constant('";LogonDomain='), Field(p0,false)}" +match("MESSAGE#568:300:02/17_0", "nwparser.p0", "\"%{fld11}\";LogonDomain=%{p0}"); + +var part79 = // "Pattern{Field(fld11,false), Constant(';LogonDomain='), Field(p0,false)}" +match("MESSAGE#568:300:02/17_1", "nwparser.p0", "%{fld11};LogonDomain=%{p0}"); + +var part80 = // "Pattern{Constant('"'), Field(domain,false), Constant('";Address='), Field(p0,false)}" +match("MESSAGE#568:300:02/18_0", "nwparser.p0", "\"%{domain}\";Address=%{p0}"); + +var part81 = // "Pattern{Field(domain,false), Constant(';Address='), Field(p0,false)}" +match("MESSAGE#568:300:02/18_1", "nwparser.p0", "%{domain};Address=%{p0}"); + +var part82 = // "Pattern{Constant('"'), Field(fld14,false), Constant('";CPMStatus='), Field(p0,false)}" +match("MESSAGE#568:300:02/19_0", "nwparser.p0", "\"%{fld14}\";CPMStatus=%{p0}"); + +var part83 = // "Pattern{Field(fld14,false), Constant(';CPMStatus='), Field(p0,false)}" +match("MESSAGE#568:300:02/19_1", "nwparser.p0", "%{fld14};CPMStatus=%{p0}"); + +var part84 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";Port='), Field(p0,false)}" +match("MESSAGE#568:300:02/20_0", "nwparser.p0", "\"%{disposition}\";Port=%{p0}"); + +var part85 = // "Pattern{Field(disposition,false), Constant(';Port='), Field(p0,false)}" +match("MESSAGE#568:300:02/20_1", "nwparser.p0", "%{disposition};Port=%{p0}"); + +var part86 = // "Pattern{Constant('"'), Field(dport,false), Constant('";Database='), Field(p0,false)}" +match("MESSAGE#568:300:02/21_0", "nwparser.p0", "\"%{dport}\";Database=%{p0}"); + +var part87 = // "Pattern{Field(dport,false), Constant(';Database='), Field(p0,false)}" +match("MESSAGE#568:300:02/21_1", "nwparser.p0", "%{dport};Database=%{p0}"); + +var part88 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";DeviceType='), Field(p0,false)}" +match("MESSAGE#568:300:02/22_0", "nwparser.p0", "\"%{db_name}\";DeviceType=%{p0}"); + +var part89 = // "Pattern{Field(db_name,false), Constant(';DeviceType='), Field(p0,false)}" +match("MESSAGE#568:300:02/22_1", "nwparser.p0", "%{db_name};DeviceType=%{p0}"); + +var part90 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="ApplicationType='), Field(p0,false)}" +match("MESSAGE#568:300:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"ApplicationType=%{p0}"); + +var part91 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="ApplicationType='), Field(p0,false)}" +match("MESSAGE#568:300:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"ApplicationType=%{p0}"); + +var part92 = // "Pattern{Constant('"'), Field(version,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/1_0", "nwparser.p0", "\"%{version}\";%{p0}"); + +var part93 = // "Pattern{Field(version,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/1_1", "nwparser.p0", "%{version};%{p0}"); + +var part94 = // "Pattern{Constant('Message='), Field(p0,false)}" +match("MESSAGE#621:411/2", "nwparser.p0", "Message=%{p0}"); + +var part95 = // "Pattern{Constant('"'), Field(action,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/3_0", "nwparser.p0", "\"%{action}\";%{p0}"); + +var part96 = // "Pattern{Field(action,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/3_1", "nwparser.p0", "%{action};%{p0}"); + +var part97 = // "Pattern{Constant('Issuer='), Field(p0,false)}" +match("MESSAGE#621:411/4", "nwparser.p0", "Issuer=%{p0}"); + +var part98 = // "Pattern{Constant('"'), Field(username,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/5_0", "nwparser.p0", "\"%{username}\";%{p0}"); + +var part99 = // "Pattern{Field(username,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/5_1", "nwparser.p0", "%{username};%{p0}"); + +var part100 = // "Pattern{Constant('Station='), Field(p0,false)}" +match("MESSAGE#621:411/6", "nwparser.p0", "Station=%{p0}"); + +var part101 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/7_0", "nwparser.p0", "\"%{hostip}\";%{p0}"); + +var part102 = // "Pattern{Field(hostip,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/7_1", "nwparser.p0", "%{hostip};%{p0}"); + +var part103 = // "Pattern{Constant('File='), Field(p0,false)}" +match("MESSAGE#621:411/8", "nwparser.p0", "File=%{p0}"); + +var part104 = // "Pattern{Constant('"'), Field(filename,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/9_0", "nwparser.p0", "\"%{filename}\";%{p0}"); + +var part105 = // "Pattern{Field(filename,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/9_1", "nwparser.p0", "%{filename};%{p0}"); + +var part106 = // "Pattern{Constant('Safe='), Field(p0,false)}" +match("MESSAGE#621:411/10", "nwparser.p0", "Safe=%{p0}"); + +var part107 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/11_0", "nwparser.p0", "\"%{group_object}\";%{p0}"); + +var part108 = // "Pattern{Field(group_object,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/11_1", "nwparser.p0", "%{group_object};%{p0}"); + +var part109 = // "Pattern{Constant('Location='), Field(p0,false)}" +match("MESSAGE#621:411/12", "nwparser.p0", "Location=%{p0}"); + +var part110 = // "Pattern{Constant('"'), Field(directory,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/13_0", "nwparser.p0", "\"%{directory}\";%{p0}"); + +var part111 = // "Pattern{Field(directory,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/13_1", "nwparser.p0", "%{directory};%{p0}"); + +var part112 = // "Pattern{Constant('Category='), Field(p0,false)}" +match("MESSAGE#621:411/14", "nwparser.p0", "Category=%{p0}"); + +var part113 = // "Pattern{Constant('"'), Field(category,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/15_0", "nwparser.p0", "\"%{category}\";%{p0}"); + +var part114 = // "Pattern{Field(category,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/15_1", "nwparser.p0", "%{category};%{p0}"); + +var part115 = // "Pattern{Constant('RequestId='), Field(p0,false)}" +match("MESSAGE#621:411/16", "nwparser.p0", "RequestId=%{p0}"); + +var part116 = // "Pattern{Constant('"'), Field(id1,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/17_0", "nwparser.p0", "\"%{id1}\";%{p0}"); + +var part117 = // "Pattern{Field(id1,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/17_1", "nwparser.p0", "%{id1};%{p0}"); + +var part118 = // "Pattern{Constant('Reason='), Field(p0,false)}" +match("MESSAGE#621:411/18", "nwparser.p0", "Reason=%{p0}"); + +var part119 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/19_0", "nwparser.p0", "\"%{event_description}\";%{p0}"); + +var part120 = // "Pattern{Field(event_description,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/19_1", "nwparser.p0", "%{event_description};%{p0}"); + +var part121 = // "Pattern{Constant('Severity='), Field(p0,false)}" +match("MESSAGE#621:411/20", "nwparser.p0", "Severity=%{p0}"); + +var part122 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser="'), Field(group,false), Constant('";TargetUser="'), Field(uid,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/21_0", "nwparser.p0", "\"%{severity}\";SourceUser=\"%{group}\";TargetUser=\"%{uid}\";%{p0}"); + +var part123 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(group,false), Constant(';TargetUser='), Field(uid,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/21_1", "nwparser.p0", "%{severity};SourceUser=%{group};TargetUser=%{uid};%{p0}"); + +var part124 = // "Pattern{Constant('"'), Field(severity,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/21_2", "nwparser.p0", "\"%{severity}\";%{p0}"); + +var part125 = // "Pattern{Field(severity,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/21_3", "nwparser.p0", "%{severity};%{p0}"); + +var part126 = // "Pattern{Constant('GatewayStation='), Field(p0,false)}" +match("MESSAGE#621:411/22", "nwparser.p0", "GatewayStation=%{p0}"); + +var part127 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/23_0", "nwparser.p0", "\"%{saddr}\";%{p0}"); + +var part128 = // "Pattern{Field(saddr,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/23_1", "nwparser.p0", "%{saddr};%{p0}"); + +var part129 = // "Pattern{Constant('TicketID='), Field(p0,false)}" +match("MESSAGE#621:411/24", "nwparser.p0", "TicketID=%{p0}"); + +var part130 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/25_0", "nwparser.p0", "\"%{operation_id}\";%{p0}"); + +var part131 = // "Pattern{Field(operation_id,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/25_1", "nwparser.p0", "%{operation_id};%{p0}"); + +var part132 = // "Pattern{Constant('PolicyID='), Field(p0,false)}" +match("MESSAGE#621:411/26", "nwparser.p0", "PolicyID=%{p0}"); + +var part133 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/27_0", "nwparser.p0", "\"%{policyname}\";%{p0}"); + +var part134 = // "Pattern{Field(policyname,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/27_1", "nwparser.p0", "%{policyname};%{p0}"); + +var part135 = // "Pattern{Constant('UserName='), Field(p0,false)}" +match("MESSAGE#621:411/28", "nwparser.p0", "UserName=%{p0}"); + +var part136 = // "Pattern{Constant('"'), Field(c_username,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/29_0", "nwparser.p0", "\"%{c_username}\";%{p0}"); + +var part137 = // "Pattern{Field(c_username,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/29_1", "nwparser.p0", "%{c_username};%{p0}"); + +var part138 = // "Pattern{Constant('LogonDomain='), Field(p0,false)}" +match("MESSAGE#621:411/30", "nwparser.p0", "LogonDomain=%{p0}"); + +var part139 = // "Pattern{Constant('"'), Field(domain,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/31_0", "nwparser.p0", "\"%{domain}\";%{p0}"); + +var part140 = // "Pattern{Field(domain,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/31_1", "nwparser.p0", "%{domain};%{p0}"); + +var part141 = // "Pattern{Constant('Address='), Field(p0,false)}" +match("MESSAGE#621:411/32", "nwparser.p0", "Address=%{p0}"); + +var part142 = // "Pattern{Constant('"'), Field(dhost,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/33_0", "nwparser.p0", "\"%{dhost}\";%{p0}"); + +var part143 = // "Pattern{Field(dhost,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/33_1", "nwparser.p0", "%{dhost};%{p0}"); + +var part144 = // "Pattern{Constant('CPMStatus='), Field(p0,false)}" +match("MESSAGE#621:411/34", "nwparser.p0", "CPMStatus=%{p0}"); + +var part145 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/35_0", "nwparser.p0", "\"%{disposition}\";%{p0}"); + +var part146 = // "Pattern{Field(disposition,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/35_1", "nwparser.p0", "%{disposition};%{p0}"); + +var part147 = // "Pattern{Constant('Port='), Field(p0,false)}" +match("MESSAGE#621:411/36", "nwparser.p0", "Port=%{p0}"); + +var part148 = // "Pattern{Constant('"'), Field(dport,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/37_0", "nwparser.p0", "\"%{dport}\";%{p0}"); + +var part149 = // "Pattern{Field(dport,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/37_1", "nwparser.p0", "%{dport};%{p0}"); + +var part150 = // "Pattern{Constant('Database='), Field(p0,false)}" +match("MESSAGE#621:411/38", "nwparser.p0", "Database=%{p0}"); + +var part151 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/39_0", "nwparser.p0", "\"%{db_name}\";%{p0}"); + +var part152 = // "Pattern{Field(db_name,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/39_1", "nwparser.p0", "%{db_name};%{p0}"); + +var part153 = // "Pattern{Constant('DeviceType='), Field(p0,false)}" +match("MESSAGE#621:411/40", "nwparser.p0", "DeviceType=%{p0}"); + +var part154 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";'), Field(p0,false)}" +match("MESSAGE#621:411/41_0", "nwparser.p0", "\"%{obj_type}\";%{p0}"); + +var part155 = // "Pattern{Field(obj_type,false), Constant(';'), Field(p0,false)}" +match("MESSAGE#621:411/41_1", "nwparser.p0", "%{obj_type};%{p0}"); + +var part156 = // "Pattern{Constant('ExtraDetails='), Field(p0,false)}" +match("MESSAGE#621:411/42", "nwparser.p0", "ExtraDetails=%{p0}"); + +var part157 = // "Pattern{Field(info,false), Constant(';')}" +match("MESSAGE#621:411/43_1", "nwparser.p0", "%{info};"); + +var part158 = tagval("MESSAGE#0:1:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup1, + dup2, + dup3, +])); + +var part159 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#1:1", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup1, + dup2, +])); + +var part160 = tagval("MESSAGE#2:2:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup4, + dup2, + dup3, +])); + +var part161 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup4, + dup2, +])); + +var part162 = tagval("MESSAGE#6:4:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + dup2, + dup3, +])); + +var part163 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup5, + dup6, + dup7, + dup8, + dup9, + dup2, +])); + +var part164 = tagval("MESSAGE#20:13:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup16, + dup17, + dup9, + dup2, + dup3, +])); + +var part165 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup16, + dup17, + dup9, + dup2, +])); + +var part166 = tagval("MESSAGE#26:16:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup19, + dup2, + dup3, +])); + +var part167 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup19, + dup2, +])); + +var part168 = tagval("MESSAGE#30:18:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup15, + dup2, + dup3, +])); + +var part169 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup15, + dup2, +])); + +var part170 = tagval("MESSAGE#38:22:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup21, + dup2, + dup3, +])); + +var part171 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup21, + dup2, +])); + +var part172 = tagval("MESSAGE#70:38:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup23, + dup2, + dup3, +])); + +var part173 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup23, + dup2, +])); + +var part174 = tagval("MESSAGE#116:61:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup20, + dup2, + dup3, +])); + +var part175 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup20, + dup2, +])); + +var part176 = tagval("MESSAGE#126:66:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup26, + dup2, + dup3, +])); + +var part177 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup26, + dup2, +])); + +var part178 = tagval("MESSAGE#190:98:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup26, + dup2, + dup3, + dup24, + dup25, +])); + +var select316 = linear_select([ + dup32, + dup33, +]); + +var select317 = linear_select([ + dup34, + dup35, +]); + +var select318 = linear_select([ + dup36, + dup37, +]); + +var select319 = linear_select([ + dup38, + dup39, +]); + +var select320 = linear_select([ + dup40, + dup41, +]); + +var select321 = linear_select([ + dup42, + dup43, +]); + +var select322 = linear_select([ + dup44, + dup45, +]); + +var select323 = linear_select([ + dup46, + dup47, +]); + +var select324 = linear_select([ + dup48, + dup49, +]); + +var select325 = linear_select([ + dup50, + dup51, +]); + +var select326 = linear_select([ + dup52, + dup53, +]); + +var select327 = linear_select([ + dup54, + dup55, +]); + +var select328 = linear_select([ + dup56, + dup57, +]); + +var select329 = linear_select([ + dup58, + dup59, +]); + +var select330 = linear_select([ + dup60, + dup61, +]); + +var select331 = linear_select([ + dup62, + dup63, +]); + +var select332 = linear_select([ + dup64, + dup65, +]); + +var select333 = linear_select([ + dup66, + dup67, +]); + +var select334 = linear_select([ + dup68, + dup69, +]); + +var select335 = linear_select([ + dup70, + dup71, +]); + +var select336 = linear_select([ + dup72, + dup73, +]); + +var select337 = linear_select([ + dup74, + dup75, +]); + +var select338 = linear_select([ + dup76, + dup77, +]); + +var part179 = tagval("MESSAGE#591:317:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup79, + dup80, + dup81, + dup2, + dup3, +])); + +var part180 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup79, + dup80, + dup81, + dup2, +])); + +var part181 = tagval("MESSAGE#595:355:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup82, + dup2, + dup3, +])); + +var part182 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup82, + dup2, +])); + +var part183 = tagval("MESSAGE#599:357:01", "nwparser.payload", tvm, { + "Address": "dhost", + "CPMStatus": "disposition", + "Category": "category", + "Database": "db_name", + "DeviceType": "obj_type", + "ExtraDetails": "info", + "File": "filename", + "GatewayStation": "saddr", + "Issuer": "username", + "Location": "directory", + "LogonDomain": "domain", + "Message": "action", + "PolicyID": "policyname", + "Port": "dport", + "Reason": "event_description", + "RequestId": "id1", + "Safe": "group_object", + "Severity": "severity", + "SourceUser": "group", + "Station": "hostip", + "TargetUser": "uid", + "TicketID": "operation_id", + "UserName": "c_username", + "Version": "version", +}, processor_chain([ + dup83, + dup2, + dup3, +])); + +var part184 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" +match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ + dup83, + dup2, +])); + +var part185 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location='), Field(directory,false), Constant(';Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false), Constant(';')}" +match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ + dup4, + dup2, + dup3, +])); + +var select339 = linear_select([ + dup85, + dup86, +]); + +var select340 = linear_select([ + dup88, + dup89, +]); + +var select341 = linear_select([ + dup91, + dup92, +]); + +var select342 = linear_select([ + dup94, + dup95, +]); + +var select343 = linear_select([ + dup97, + dup98, +]); + +var select344 = linear_select([ + dup100, + dup101, +]); + +var select345 = linear_select([ + dup103, + dup104, +]); + +var select346 = linear_select([ + dup106, + dup107, +]); + +var select347 = linear_select([ + dup109, + dup110, +]); + +var select348 = linear_select([ + dup112, + dup113, +]); + +var select349 = linear_select([ + dup115, + dup116, + dup117, + dup118, +]); + +var select350 = linear_select([ + dup120, + dup121, +]); + +var select351 = linear_select([ + dup123, + dup124, +]); + +var select352 = linear_select([ + dup126, + dup127, +]); + +var select353 = linear_select([ + dup129, + dup130, +]); + +var select354 = linear_select([ + dup132, + dup133, +]); + +var select355 = linear_select([ + dup135, + dup136, +]); + +var select356 = linear_select([ + dup138, + dup139, +]); + +var select357 = linear_select([ + dup141, + dup142, +]); + +var select358 = linear_select([ + dup144, + dup145, +]); + +var select359 = linear_select([ + dup147, + dup148, +]); diff --git a/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml new file mode 100644 index 00000000000..dafb265af35 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Cyber-Ark + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/cyberark/corepas/manifest.yml b/x-pack/filebeat/module/cyberark/corepas/manifest.yml new file mode 100644 index 00000000000..76d15f7b9d3 --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["cyberark.corepas", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9527 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/cyberark/corepas/test/generated.log b/x-pack/filebeat/module/cyberark/corepas/test/generated.log new file mode 100644 index 00000000000..29dd49e5dab --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/test/generated.log @@ -0,0 +1,100 @@ +2016-01-29 06:09:59.732538723 +0000 UTC eacommod1428.lan %CYBERARK: MessageID="188";exercita 1.1332",ProductAccount="itv",ProductProcess="odoco",EventId="ria",EventClass="min",EventSeverity="low",EventMessage="allow",ActingUserName="utl",ActingAddress="10.208.15.216",ActionSourceUser="tation",ActionTargetUser="quasiarc",ActionObject="liqua",ActionSafe="ciade",ActionLocation="turadipi",ActionCategory="aeca",ActionRequestId="idi",ActionReason="pexe",ActionExtraDetails="nes" +%CYBERARK: MessageID="168";Version=1.259;Message=block;Issuer=dolore;Station=10.92.136.230;File=ritquiin;Safe=umqui;Location=reeufugi;Category=mdolo;RequestId=mqui;Reason=nci;Severity=very-high;SourceUser=litesse;TargetUser=orev;GatewayStation=10.175.75.18;TicketID=deF;PolicyID=sist;UserName=nnumqu;LogonDomain=iatnu3810.mail.localdomain;Address=volup208.invalid;CPMStatus=eosquir;Port=5191;Database=umdo;DeviceType=itessequ;ExtraDetails=vol; +nibus 2016-02-26 20:15:08.252538723 +0000 UTC mipsumq3879.internal.localdomain %CYBERARK: MessageID="26";Version=1.7269;Message=accept;Issuer=incid;Station=10.51.132.10;File=utper;Safe=squame;Location=ntex;Category=eius;RequestId=luptat;Reason=emape;Severity=low;SourceUser=incidi;TargetUser=nse;GatewayStation=10.46.185.46;TicketID=temvel;PolicyID=iatu;UserName=serror;LogonDomain=anti4454.api.example;Address=tetu5280.www5.invalid;CPMStatus=tionulam;Port=2548;Database=byC;DeviceType=tinculp;ExtraDetails=tur; +2016-03-12 03:17:42.512538723 +0000 UTC minim7868.www5.localdomain %CYBERARK: MessageID="184";Version=1.6713;Message=deny;Issuer=psumquia;Station=10.53.192.140;File=con;Safe=uia;Location=quiavo;Category=issusci;RequestId=mol;Reason=taspe;Severity=high;SourceUser=psumq;TargetUser=atcup;GatewayStation=10.155.236.240;TicketID=tatno;PolicyID=dquiac;UserName=ptass;LogonDomain=uam6303.api.lan;Address=llu4762.mail.localdomain;CPMStatus=scivel;Port=5695;Database=aperi;DeviceType=iveli;ExtraDetails=llumd; +%CYBERARK: MessageID="161";emaper 1.2638",ProductAccount="eos",ProductProcess="enimad",EventId="rmagni",EventClass="sit",EventSeverity="medium",EventMessage="cancel",ActingUserName="oremips",ActingAddress="10.81.199.122",ActionSourceUser="aquaeabi",ActionTargetUser="giatq",ActionObject="quid",ActionSafe="fug",ActionLocation="uatDuis",ActionCategory="ude",ActionRequestId="maveniam",ActionReason="uian",ActionExtraDetails="tempo" +eetd 2016-04-09 17:22:51.032538723 +0000 UTC eip1448.internal.local %CYBERARK: MessageID="139";Version=1.3491;Message=deny;Issuer=tcupida;Station=10.139.186.201;File=ect;Safe=reetdolo;Location=nrepreh;Category=obeataev;RequestId=lor;Reason=uidexea;Severity=medium;SourceUser=natura;TargetUser=aboris;GatewayStation=10.172.14.142;TicketID=ssitaspe;PolicyID=gitsedqu;UserName=uam;LogonDomain=temq1198.internal.example;Address=aquaeab2275.www5.domain;CPMStatus=ehend;Port=4091;Database=isiu;DeviceType=nimadmi;ExtraDetails=iatisu; +%CYBERARK: MessageID="106";Version=1.6875;Message=accept;Issuer=ipis;Station=10.47.76.251;File=eataevit;Safe=uptatev;Location=uovol;Category=dmi;RequestId=olab;Reason=mquisnos;Severity=medium;SourceUser=ore;TargetUser=etconsec;GatewayStation=10.104.111.129;TicketID=mUt;PolicyID=usmodte;UserName=ele;LogonDomain=tenbyCic5882.api.home;Address=amquisno3338.www5.lan;CPMStatus=nonnu;Port=776;Database=riat;DeviceType=luptatem;ExtraDetails=umdolor; +inB 2016-05-08 07:27:59.552538723 +0000 UTC deomni124.www.example %CYBERARK: MessageID="74";tae 1.1382",ProductAccount="animi",ProductProcess="oluptate",EventId="ofdeF",EventClass="tion",EventSeverity="very-high",EventMessage="deny",ActingUserName="quiratio",ActingAddress="10.116.120.216",ActionSourceUser="qua",ActionTargetUser="umdo",ActionObject="sed",ActionSafe="apariat",ActionLocation="mol",ActionCategory="pteursi",ActionRequestId="onse",ActionReason="rumet",ActionExtraDetails="oll" +Ciceroi 2016-05-22 14:30:33.812538723 +0000 UTC aveniam1436.www.test %CYBERARK: MessageID="144";Version=1.5529;Message=cancel;Issuer=taevi;Station=10.62.54.220;File=ehenderi;Safe=pidatat;Location=gni;Category=tquiinea;RequestId=mquaera;Reason=dun;Severity=medium;SourceUser=Duisau;TargetUser=psum;GatewayStation=10.57.40.29;TicketID=undeo;PolicyID=loremip;UserName=rnatura;LogonDomain=isqu7224.localdomain;Address=idolores3839.localdomain;CPMStatus=metcon;Port=2424;Database=emeumfug;DeviceType=upta;ExtraDetails=omn; +ons 2016-06-05 21:33:08.072538723 +0000 UTC tessec3539.home %CYBERARK: MessageID="240";nsect 1.6476",ProductAccount="tnon",ProductProcess="ionul",EventId="nibus",EventClass="edquiano",EventSeverity="medium",EventMessage="cancel",ActingUserName="ema",ActingAddress="10.74.237.180",ActionSourceUser="nsequu",ActionTargetUser="cup",ActionObject="boNemoen",ActionSafe="uid",ActionLocation="rors",ActionCategory="onofd",ActionRequestId="taed",ActionReason="lup",ActionExtraDetails="remeumf" +2016-06-20 04:35:42.332538723 +0000 UTC sectetur3333.mail.example %CYBERARK: MessageID="61";edqui 1.7780",ProductAccount="lor",ProductProcess="fugit",EventId="ido",EventClass="paqu",EventSeverity="high",EventMessage="allow",ActingUserName="remeum",ActingAddress="10.18.165.35",ActionSourceUser="admi",ActionTargetUser="modocons",ActionObject="elaudant",ActionSafe="tinvol",ActionLocation="dolore",ActionCategory="abor",ActionRequestId="iqui",ActionReason="etc",ActionExtraDetails="etM" +2016-07-04 11:38:16.592538723 +0000 UTC xercitat4824.local %CYBERARK: MessageID="90";ostr 1.4979",ProductAccount="onproide",ProductProcess="luptat",EventId="itaut",EventClass="imaven",EventSeverity="high",EventMessage="deny",ActingUserName="tema",ActingAddress="10.74.253.127",ActionSourceUser="tfug",ActionTargetUser="icab",ActionObject="mwr",ActionSafe="fugi",ActionLocation="inculpaq",ActionCategory="agna",ActionRequestId="tionemu",ActionReason="eomnisis",ActionExtraDetails="mqui" +errorsi 2016-07-18 18:40:50.852538723 +0000 UTC des5377.lan %CYBERARK: MessageID="385";Version=1.1697;Message=block;Issuer=ono;Station=10.189.109.245;File=emaperi;Safe=tame;Location="tinvol";Category=tectobe;RequestId=colabor;Reason=iusmodt;Severity=medium;GatewayStation=10.92.8.15;TicketID=agnaali;PolicyID=llitani;UserName=inima;LogonDomain=tlabo6088.www.localdomain;Address=Lor5841.internal.example;CPMStatus=sunt;Port="3075";Database=uines;DeviceType=nsec;ExtraDetails=onse +August 2 01:43:25 tat %CYBERARK: MessageID="190";tion 1.1761",ProductAccount="upt",ProductProcess="uiineavo",EventId="tisetq",EventClass="irati",EventSeverity="low",EventMessage="accept",ActingUserName="giatquov",ActingAddress="10.21.78.128",ActionSourceUser="riat",ActionTargetUser="taut",ActionObject="oreseos",ActionSafe="uames",ActionLocation="tati",ActionCategory="utaliqu",ActionRequestId="oriosamn",ActionReason="deFinibu",ActionExtraDetails="iadese" +%CYBERARK: MessageID="256";eporroqu 1.4200",ProductAccount="hil",ProductProcess="atquovo",EventId="suntinc",EventClass="xeac",EventSeverity="medium",EventMessage="deny",ActingUserName="tatn",ActingAddress="10.18.109.121",ActionSourceUser="ents",ActionTargetUser="pida",ActionObject="nse",ActionSafe="sinto",ActionLocation="emoeni",ActionCategory="oenimips",ActionRequestId="utlabore",ActionReason="ecillu",ActionExtraDetails="quip" +%CYBERARK: MessageID="105";Version=1.3727;Message=cancel;Issuer=iunt;Station=10.63.37.192;File=tio;Safe=orinrepr;Location=conse;Category=rumetM;RequestId=equi;Reason=agnaali;Severity=medium;SourceUser=sitvolup;TargetUser=reetd;GatewayStation=10.225.115.13;TicketID=maccusa;PolicyID=uptat;UserName=equep;LogonDomain=iavolu5352.localhost;Address=rpo79.mail.example;CPMStatus=siarchi;Port=2289;Database=aliqu;DeviceType=olupta;ExtraDetails=mipsumd; +remi 2016-09-13 22:51:07.892538723 +0000 UTC saute7154.internal.lan %CYBERARK: MessageID="105";Version=1.3219;Message=deny;Issuer=run;Station=10.47.202.102;File=quirat;Safe=llu;Location=licab;Category=eirure;RequestId=conseq;Reason=oidentsu;Severity=medium;SourceUser=aaliquaU;TargetUser=ntor;GatewayStation=10.95.64.124;TicketID=psaquae;PolicyID=ationemu;UserName=ice;LogonDomain=estiae3750.api.corp;Address=tionof7613.domain;CPMStatus=lapari;Port=2335;Database=ite;DeviceType=ationul;ExtraDetails=iquipex; +adol 2016-09-28 05:53:42.152538723 +0000 UTC doloremi7402.www.test %CYBERARK: MessageID="376";Version=1.6371;Message=block;Issuer=itquiin;Station=10.106.239.55;File=taevit;Safe=rinrepre;Location=etconse;Category=tincu;RequestId=ari;Reason=exercit;Severity=low;GatewayStation=10.244.114.61;TicketID=oluptate;PolicyID=onseq;UserName=serunt;LogonDomain=aquaeabi7735.internal.lan;Address=acc7692.home;CPMStatus=amest;Port="4147";Database=itame;DeviceType=intoc;ExtraDetails=oluptas; +2016-10-12 12:56:16.412538723 +0000 UTC luptasn2126.mail.home %CYBERARK: MessageID="24";Version=1.821;Message=allow;Issuer=ione;Station=10.125.160.129;File=suntexp;Safe=duntut;Location=magni;Category=pisciv;RequestId=iquidex;Reason=radipisc;Severity=low;SourceUser=nti;TargetUser=abi;GatewayStation=10.53.168.235;TicketID=fugitse;PolicyID=veniamq;UserName=one;LogonDomain=etMalor4236.www5.host;Address=quatD4191.local;CPMStatus=tenima;Port=5685;Database=sperna;DeviceType=eabilloi;ExtraDetails=estia; +orem 2016-10-26 19:58:50.672538723 +0000 UTC beata6448.mail.test %CYBERARK: MessageID="197";Version=1.1123;Message=allow;Issuer=tasuntex;Station=10.227.177.121;File=boN;Safe=eprehend;Location=aevit;Category=aboN;RequestId=ihilmo;Reason=radi;Severity=low;SourceUser=uames;TargetUser=iduntu;GatewayStation=10.33.245.220;TicketID=giatnu;PolicyID=ulapa;UserName=liqui;LogonDomain=quioffi1359.internal.lan;Address=eturadi6608.mail.host;CPMStatus=aera;Port=3366;Database=rvel;DeviceType=uid;ExtraDetails=onsecte; +November 10 03:01:24 edo %CYBERARK: MessageID="411";Version=1.5071;Message=allow;Issuer=econs;Station="10.98.182.220";File="untex";Safe="quiratio";Location="boree";Category="eco";RequestId=Utenimad;Reason=orpor;Severity="low";GatewayStation="10.167.85.181";TicketID=emvel;PolicyID="tmollita";UserName=fde;LogonDomain="nsecte3304.mail.corp";Address="eroi176.example";CPMStatus="non";Port="3341";Database=equat;DeviceType=derit;ExtraDetails="Command=dexea;ConnectionComponentId=atcu;DstHost=labor;ProcessId=6501;ProcessName=laboree.exe;Protocol=tcp;PSMID=intocc;RDPOffset=liqu;SessionID=eporr;SrcHost=xeacomm6855.api.corp;User=utlabor;VIDOffset=rau;" +November 24 10:03:59 aeabi %CYBERARK: MessageID="111";eiu 1.4456",ProductAccount="iciadese",ProductProcess="quidolor",EventId="tessec",EventClass="olupta",EventSeverity="high",EventMessage="block",ActingUserName="icabo",ActingAddress="10.89.208.95",ActionSourceUser="eleum",ActionTargetUser="sintoc",ActionObject="volupt",ActionSafe="siste",ActionLocation="uiinea",ActionCategory="Utenima",ActionRequestId="volupta",ActionReason="rcitati",ActionExtraDetails="eni" +Ute 2016-12-08 17:06:33.452538723 +0000 UTC sperna5368.mail.invalid %CYBERARK: MessageID="81";Version=1.509;Message=accept;Issuer=tDuisaut;Station=10.214.191.180;File=imvenia;Safe=spi;Location=stquido;Category=ommodico;RequestId=ptas;Reason=pta;Severity=medium;SourceUser=ptatemq;TargetUser=luptatev;GatewayStation=10.72.148.32;TicketID=ipsumd;PolicyID=ntocc;UserName=uteirure;LogonDomain=nevo4284.internal.local;Address=reetdolo6852.www.test;CPMStatus=nnum;Port=5428;Database=uamest;DeviceType=tco;ExtraDetails=uae; +%CYBERARK: MessageID="168";Version=1.3599;Message=block;Issuer=ipsumd;Station=10.136.190.236;File=evolu;Safe=ersp;Location=tquov;Category=diconseq;RequestId=inven;Reason=osquira;Severity=low;SourceUser=ataevi;TargetUser=com;GatewayStation=10.252.124.150;TicketID=trud;PolicyID=eriti;UserName=litessec;LogonDomain=itas981.mail.domain;Address=mporin6932.api.localdomain;CPMStatus=roid;Port=6604;Database=tasn;DeviceType=Nemoenim;ExtraDetails=squirati; +nbyCic 2017-01-06 07:11:41.972538723 +0000 UTC utlabor6305.internal.corp %CYBERARK: MessageID="90";Version=1.5649;Message=accept;Issuer=iquipe;Station=10.192.34.76;File=modtemp;Safe=quovol;Location=nve;Category=remag;RequestId=uredol;Reason=ccaecat;Severity=medium;SourceUser=onsequ;TargetUser=temqu;GatewayStation=10.213.144.249;TicketID=udexerci;PolicyID=naal;UserName=lore;LogonDomain=tnonpro7635.localdomain;Address=illoin2914.mail.lan;CPMStatus=uamni;Port=6895;Database=gnamal;DeviceType=metMalo;ExtraDetails=ntexplic; +%CYBERARK: MessageID="376";Version=1.2217;Message=accept;Issuer=untu;Station=10.154.4.197;File=con;Safe=nisist;Location=usmodte;Category=msequi;RequestId=tau;Reason=exercita;Severity=low;GatewayStation=10.216.84.30;TicketID=orumSe;PolicyID=boree;UserName=intoc;LogonDomain=rQuisau5300.www5.example;Address=evit5780.www.corp;CPMStatus=onev;Port="725";Database=oditem;DeviceType=gitsedqu;ExtraDetails=borios; +2017-02-03 21:16:50.492538723 +0000 UTC temUt631.www5.example %CYBERARK: MessageID="3";npr 1.4414",ProductAccount="niamqui",ProductProcess="boNem",EventId="ess",EventClass="ipisci",EventSeverity="medium",EventMessage="deny",ActingUserName="tqu",ActingAddress="10.143.193.199",ActionSourceUser="quam",ActionTargetUser="quid",ActionObject="fugiat",ActionSafe="atisun",ActionLocation="esci",ActionCategory="epre",ActionRequestId="tobeata",ActionReason="eroinBCS",ActionExtraDetails="inci" +February 18 04:19:24 rnatur %CYBERARK: MessageID="140";Version=1.5632;Message=deny;Issuer=essequam;Station=10.193.83.81;File=isisten;Safe=cusant;Location=atemq;Category=rinre;RequestId=naal;Reason=borios;Severity=high;SourceUser=isnostr;TargetUser=umqu;GatewayStation=10.65.175.9;TicketID=inesci;PolicyID=isnisi;UserName=ritatise;LogonDomain=uamei2389.internal.example;Address=uisa5736.internal.local;CPMStatus=cusant;Port=302;Database=ender;DeviceType=riamea;ExtraDetails=entorev; +%CYBERARK: MessageID="87";tutlab 1.792",ProductAccount="tatn",ProductProcess="dolorsit",EventId="sau",EventClass="aperia",EventSeverity="very-high",EventMessage="accept",ActingUserName="umdolo",ActingAddress="10.205.72.243",ActionSourceUser="stenatu",ActionTargetUser="isiuta",ActionObject="orsitam",ActionSafe="siutaliq",ActionLocation="dutp",ActionCategory="psaquaea",ActionRequestId="taevita",ActionReason="ameiusm",ActionExtraDetails="proide" +2017-03-18 18:24:33.272538723 +0000 UTC velitess7586.mail.example %CYBERARK: MessageID="45";nre 1.7231",ProductAccount="sit",ProductProcess="olab",EventId="eumiure",EventClass="ersp",EventSeverity="medium",EventMessage="allow",ActingUserName="mquisno",ActingAddress="10.107.9.163",ActionSourceUser="uptate",ActionTargetUser="mac",ActionObject="iumdol",ActionSafe="tpersp",ActionLocation="stla",ActionCategory="uptatema",ActionRequestId="oeni",ActionReason="tdol",ActionExtraDetails="sit" +April 2 01:27:07 psum %CYBERARK: MessageID="132";tasnulap 1.7220",ProductAccount="umSe",ProductProcess="xeacomm",EventId="cinge",EventClass="itla",EventSeverity="high",EventMessage="deny",ActingUserName="asiarc",ActingAddress="10.80.101.72",ActionSourceUser="uptate",ActionTargetUser="quidexea",ActionObject="ect",ActionSafe="modocons",ActionLocation="gitsed",ActionCategory="fugia",ActionRequestId="oditautf",ActionReason="quatu",ActionExtraDetails="veli" +April 16 08:29:41 labo %CYBERARK: MessageID="200";Version=1.267;Message=accept;Issuer=aboreetd;Station=10.235.136.109;File=lorin;Safe=pitl;Location=por;Category=quidexea;RequestId=nimid;Reason=runtmol;Severity=very-high;SourceUser=odi;TargetUser=ptass;GatewayStation=10.39.10.155;TicketID=dol;PolicyID=proiden;UserName=urExcept;LogonDomain=miurerep1152.internal.domain;Address=utlab3706.api.host;CPMStatus=dantium;Port=246;Database=teirured;DeviceType=onemulla;ExtraDetails=dolorem; +April 30 15:32:16 ationev %CYBERARK: MessageID="233";umdolor 1.4389",ProductAccount="itation",ProductProcess="paquioff",EventId="nci",EventClass="isau",EventSeverity="low",EventMessage="cancel",ActingUserName="ibusBon",ActingAddress="10.96.224.19",ActionSourceUser="nsequat",ActionTargetUser="doloreme",ActionObject="dun",ActionSafe="reprehe",ActionLocation="tincu",ActionCategory="suntin",ActionRequestId="itse",ActionReason="umexerc",ActionExtraDetails="oremipsu" +2017-05-14 22:34:50.312538723 +0000 UTC ntsunt4826.mail.corp %CYBERARK: MessageID="170";olo 1.237",ProductAccount="aec",ProductProcess="fdeF",EventId="iquidexe",EventClass="diconse",EventSeverity="medium",EventMessage="cancel",ActingUserName="reseo",ActingAddress="10.71.238.250",ActionSourceUser="consequa",ActionTargetUser="moenimi",ActionObject="olupt",ActionSafe="oconsequ",ActionLocation="edquiac",ActionCategory="urerepr",ActionRequestId="eseru",ActionReason="quamest",ActionExtraDetails="mac" +%CYBERARK: MessageID="294";Version=1.3804;Message=deny;Issuer=rationev;Station=10.226.20.199;File=tatem;Safe=untutlab;Location=amcor;Category=ica;RequestId=lillum;Reason=remips;Severity=low;SourceUser=taedicta;TargetUser=ritt;GatewayStation=10.226.101.180;TicketID=itesseq;PolicyID=dictasun;UserName=veniamqu;LogonDomain=rum5798.home;Address=mvel1188.internal.localdomain;CPMStatus=tetur;Port=2694;Database=conse;DeviceType=ipi;ExtraDetails=imveniam; +June 12 12:39:58 licabo %CYBERARK: MessageID="13";Version=1.1493;Message=cancel;Issuer=utaliqu;Station=10.86.22.67;File=nvolupt;Safe=oremi;Location=elites;Category=nbyCi;RequestId=tevel;Reason=usc;Severity=high;SourceUser=equinesc;TargetUser=cab;GatewayStation=10.134.65.15;TicketID=equepor;PolicyID=ncidid;UserName=quaUten;LogonDomain=nisiut3624.api.example;Address=perspici5680.domain;CPMStatus=iconseq;Port=2039;Database=isciv;DeviceType=rroqu;ExtraDetails=nofd; +%CYBERARK: MessageID="358";ilmol 1.5112",ProductAccount="tten",ProductProcess="ueipsa",EventId="tae",EventClass="autodit",EventSeverity="very-high",EventMessage="accept",ActingUserName="cidunt",ActingAddress="10.70.147.120",ActionSourceUser="exeaco",ActionTargetUser="emqu",ActionObject="nderi",ActionSafe="acommod",ActionLocation="itsedd",ActionCategory="leumiur",ActionRequestId="eratvol",ActionReason="quidol",ActionExtraDetails="eaqu" +luptatem 2017-07-11 02:45:07.352538723 +0000 UTC uaeratv3432.invalid %CYBERARK: MessageID="160";Version=1.6255;Message=cancel;Issuer=dqu;Station=10.178.242.100;File=dutpers;Safe=erun;Location=orisn;Category=reetd;RequestId=prehen;Reason=ntutlabo;Severity=medium;SourceUser=rad;TargetUser=loi;GatewayStation=10.24.111.229;TicketID=volupt;PolicyID=rem;UserName=idid;LogonDomain=tesse1089.www.host;Address=ptateve6909.www5.lan;CPMStatus=toccaec;Port=7645;Database=tenatuse;DeviceType=psaqua;ExtraDetails=ullamcor; +2017-07-25 09:47:41.612538723 +0000 UTC cupi1867.www5.test %CYBERARK: MessageID="67";orroq 1.6677",ProductAccount="ritati",ProductProcess="orisni",EventId="ons",EventClass="remagn",EventSeverity="very-high",EventMessage="deny",ActingUserName="mmodoc",ActingAddress="10.211.179.168",ActionSourceUser="atu",ActionTargetUser="untincul",ActionObject="ssecil",ActionSafe="commodi",ActionLocation="emporain",ActionCategory="ntiumto",ActionRequestId="umetMalo",ActionReason="oluptas",ActionExtraDetails="emvele" +Sedut 2017-08-08 16:50:15.872538723 +0000 UTC yCiceroi2786.www.test %CYBERARK: MessageID="141";iquamqua 1.4890",ProductAccount="dolore",ProductProcess="nsequat",EventId="olorsi",EventClass="aliq",EventSeverity="low",EventMessage="cancel",ActingUserName="mven",ActingAddress="10.30.243.163",ActionSourceUser="oremag",ActionTargetUser="illu",ActionObject="ruredo",ActionSafe="mac",ActionLocation="temUt",ActionCategory="ptassita",ActionRequestId="its",ActionReason="lore",ActionExtraDetails="idol" +2017-08-22 23:52:50.132538723 +0000 UTC urmag7650.api.invalid %CYBERARK: MessageID="26";Version=1.1844;Message=cancel;Issuer=amvo;Station=10.6.79.159;File=ommodo;Safe=uptat;Location=idex;Category=ptateve;RequestId=cons;Reason=olorese;Severity=high;SourceUser=ore;TargetUser=quid;GatewayStation=10.212.214.4;TicketID=ddoeius;PolicyID=ugiatn;UserName=midestl;LogonDomain=dictasun3878.internal.localhost;Address=modocon5089.mail.example;CPMStatus=lupta;Port=5112;Database=urExce;DeviceType=asi;ExtraDetails=ectiono; +onu 2017-09-06 06:55:24.392538723 +0000 UTC liquaUte6729.api.localhost %CYBERARK: MessageID="150";Version=1.3546;Message=deny;Issuer=atDu;Station=10.237.170.202;File=maperi;Safe=agnaaliq;Location=tlaboree;Category=norumet;RequestId=dtempo;Reason=tin;Severity=low;SourceUser=mve;TargetUser=liquide;GatewayStation=10.70.147.46;TicketID=inv;PolicyID=rroq;UserName=rcit;LogonDomain=aecatcup2241.www5.test;Address=tempor1282.www5.localhost;CPMStatus=incidid;Port=7699;Database=taedict;DeviceType=edquian;ExtraDetails=loremeu; +dmi 2017-09-20 13:57:58.652538723 +0000 UTC untexpl2847.www5.local %CYBERARK: MessageID="292";Version=1.4282;Message=allow;Issuer=emoe;Station=10.179.50.138;File=ehende;Safe=eaqueip;Location=eum;Category=lamc;RequestId=umetMal;Reason=asper;Severity=high;SourceUser=metcons;TargetUser=itasper;GatewayStation=10.228.118.81;TicketID=temquiav;PolicyID=obeata;UserName=tatemU;LogonDomain=mad5185.www5.localhost;Address=mipsum2964.invalid;CPMStatus=doei;Port=6825;Database=toditaut;DeviceType=voluptat;ExtraDetails=ugit; +October 4 21:00:32 asnu %CYBERARK: MessageID="38";Version=1.3806;Message=cancel;Issuer=henderit;Station=10.49.71.118;File=ationul;Safe=mquisn;Location=queips;Category=midest;RequestId=dex;Reason=ccae;Severity=medium;SourceUser=eavolup;TargetUser=emip;GatewayStation=10.234.165.130;TicketID=ntexplic;PolicyID=uto;UserName=iuntNequ;LogonDomain=esseq7889.www.invalid;Address=veniamq1236.invalid;CPMStatus=emo;Port=1458;Database=veniamqu;DeviceType=licaboN;ExtraDetails=atquo; +udan 2017-10-19 04:03:07.172538723 +0000 UTC yCic5749.www.localhost %CYBERARK: MessageID="119";itanim 1.4024",ProductAccount="olorema",ProductProcess="mollita",EventId="tatem",EventClass="iae",EventSeverity="low",EventMessage="allow",ActingUserName="emip",ActingAddress="10.199.5.49",ActionSourceUser="stquid",ActionTargetUser="turadipi",ActionObject="usmodi",ActionSafe="ree",ActionLocation="saquaea",ActionCategory="ation",ActionRequestId="luptas",ActionReason="minim",ActionExtraDetails="ataevi" +%CYBERARK: MessageID="156";plic 1.7053",ProductAccount="utlabo",ProductProcess="tetur",EventId="tionula",EventClass="ritqu",EventSeverity="very-high",EventMessage="allow",ActingUserName="uamei",ActingAddress="10.193.219.34",ActionSourceUser="onse",ActionTargetUser="olorem",ActionObject="turvel",ActionSafe="eratv",ActionLocation="ipsa",ActionCategory="asuntexp",ActionRequestId="adminim",ActionReason="orisni",ActionExtraDetails="nse" +November 16 18:08:15 nderi %CYBERARK: MessageID="202";Version=1.7083;Message=allow;Issuer=animid;Station=10.120.167.217;File=atuse;Safe=ueipsa;Location=scipitl;Category=eumi;RequestId=quasiarc;Reason=olli;Severity=low;SourceUser=tetura;TargetUser=rsp;GatewayStation=10.174.185.109;TicketID=roquisqu;PolicyID=edolorin;UserName=dolorem;LogonDomain=tem6815.home;Address=taliqui5348.mail.localdomain;CPMStatus=loremag;Port=6816;Database=tsuntinc;DeviceType=inrepreh;ExtraDetails=quovo; +%CYBERARK: MessageID="133";Version=1.1432;Message=cancel;Issuer=atev;Station=10.117.137.159;File=acommodi;Safe=essecill;Location=billoi;Category=moles;RequestId=dipiscin;Reason=olup;Severity=high;SourceUser=undeomni;TargetUser=accusa;GatewayStation=10.141.213.219;TicketID=itat;PolicyID=stlaboru;UserName=ate;LogonDomain=mporainc2064.home;Address=atnulapa3548.www.domain;CPMStatus=radipisc;Port=5347;Database=nibus;DeviceType=vitaed;ExtraDetails=ser; +2017-12-15 08:13:24.212538723 +0000 UTC ill6772.www.invalid %CYBERARK: MessageID="104";Version=1.4043;Message=cancel;Issuer=rem;Station=10.166.90.130;File=mdolore;Safe=eosquira;Location=pta;Category=snos;RequestId=orsi;Reason=tetura;Severity=very-high;SourceUser=lorsita;TargetUser=eavol;GatewayStation=10.94.224.229;TicketID=lupta;PolicyID=npr;UserName=etconsec;LogonDomain=caboNem1043.internal.home;Address=litesseq6785.host;CPMStatus=tob;Port=7390;Database=oditempo;DeviceType=doeiu;ExtraDetails=deF; +rcitat 2017-12-29 15:15:58.472538723 +0000 UTC dolorema2984.www.home %CYBERARK: MessageID="316";Version=1.2456;Message=deny;Issuer=tiumto;Station=10.38.28.151;File=nrepreh;Safe=ratv;Location=alorum;Category=mquisn;RequestId=atq;Reason=erspi;Severity=low;SourceUser=ugiatquo;TargetUser=incidid;GatewayStation=10.201.81.46;TicketID=sBonor;PolicyID=fugits;UserName=mipsumqu;LogonDomain=tatio6513.www.invalid;Address=onnu2272.mail.corp;CPMStatus=atatnon;Port=6064;Database=abor;DeviceType=magnid;ExtraDetails=adol; +January 12 22:18:32 niam %CYBERARK: MessageID="266";Version=1.2721;Message=deny;Issuer=rerepre;Station=10.214.245.95;File=quiineav;Safe=billoinv;Location=sci;Category=col;RequestId=obea;Reason=emp;Severity=medium;SourceUser=luptas;TargetUser=uptatem;GatewayStation=10.255.28.56;TicketID=inrepr;PolicyID=mol;UserName=umdolors;LogonDomain=dolori6232.api.invalid;Address=llit958.www.domain;CPMStatus=tat;Port=2957;Database=odt;DeviceType=cillumd;ExtraDetails=riosa; +January 27 05:21:06 lapar %CYBERARK: MessageID="311";ritati 1.3219",ProductAccount="qui",ProductProcess="otamr",EventId="nim",EventClass="ame",EventSeverity="very-high",EventMessage="cancel",ActingUserName="mip",ActingAddress="10.45.35.180",ActionSourceUser="mvolupta",ActionTargetUser="Utenima",ActionObject="iqua",ActionSafe="luptat",ActionLocation="deriti",ActionCategory="sintocc",ActionRequestId="cididu",ActionReason="uteir",ActionExtraDetails="boree" +February 10 12:23:41 diduntu %CYBERARK: MessageID="285";eiusmod 1.7546",ProductAccount="ess",ProductProcess="uide",EventId="scivel",EventClass="henderi",EventSeverity="low",EventMessage="accept",ActingUserName="enim",ActingAddress="10.141.200.133",ActionSourceUser="ersp",ActionTargetUser="iame",ActionObject="orroquis",ActionSafe="aquio",ActionLocation="riatu",ActionCategory="loinve",ActionRequestId="tanimid",ActionReason="isnostru",ActionExtraDetails="nofdeFi" +%CYBERARK: MessageID="155";ulap 1.3765",ProductAccount="illoi",ProductProcess="reetdolo",EventId="rationev",EventClass="ehender",EventSeverity="medium",EventMessage="accept",ActingUserName="ugi",ActingAddress="10.83.238.145",ActionSourceUser="ptatems",ActionTargetUser="runtmo",ActionObject="ore",ActionSafe="isund",ActionLocation="exerci",ActionCategory="tas",ActionRequestId="oraincid",ActionReason="quaer",ActionExtraDetails="eetdo" +2018-03-11 02:28:49.772538723 +0000 UTC aali6869.api.localdomain %CYBERARK: MessageID="48";Version=1.3147;Message=block;Issuer=sedquiac;Station=10.39.143.155;File=ipsaqu;Safe=nisiut;Location=rumwri;Category=velill;RequestId=ore;Reason=tation;Severity=very-high;SourceUser=porincid;TargetUser=tperspic;GatewayStation=10.41.89.217;TicketID=ict;PolicyID=squirati;UserName=tem;LogonDomain=mestq2106.api.host;Address=llamc6724.www.lan;CPMStatus=tesseci;Port=4020;Database=radipis;DeviceType=cive;ExtraDetails=nse; +isnisiu 2018-03-25 09:31:24.032538723 +0000 UTC suntincu2940.www5.domain %CYBERARK: MessageID="378";Version=1.6382;Message=accept;Issuer=minim;Station=10.5.5.1;File=reseosq;Safe=gna;Location=isiutali;Category=lumqu;RequestId=onulamco;Reason=ons;Severity=low;SourceUser=uptat;TargetUser=unt;GatewayStation=10.153.123.20;TicketID=tla;PolicyID=mquiad;UserName=CSe;LogonDomain=lors7553.api.local;Address=reseosqu1629.mail.lan;CPMStatus=utemvel;Port=5325;Database=atu;DeviceType=iusm;ExtraDetails=roi; +2018-04-08 16:33:58.292538723 +0000 UTC rere5274.mail.domain %CYBERARK: MessageID="269";Version=1.3193;Message=deny;Issuer=iamea;Station=10.210.61.109;File=tiumto;Safe=cor;Location=odoco;Category=oin;RequestId=itseddoe;Reason=elites;Severity=low;SourceUser=uamei;TargetUser=eursinto;GatewayStation=10.168.132.175;TicketID=licaboNe;PolicyID=tautfug;UserName=giatquov;LogonDomain=olu5333.www.domain;Address=orumSe4514.www.corp;CPMStatus=umquam;Port=80;Database=ici;DeviceType=nisiuta;ExtraDetails=iquaUt; +%CYBERARK: MessageID="176";atnula 1.5038",ProductAccount="lmo",ProductProcess="iquidex",EventId="olup",EventClass="remipsu",EventSeverity="low",EventMessage="accept",ActingUserName="quiac",ActingAddress="10.123.154.17",ActionSourceUser="etdol",ActionTargetUser="dolorsi",ActionObject="nturmag",ActionSafe="tura",ActionLocation="osquirat",ActionCategory="equat",ActionRequestId="aliquid",ActionReason="usantiu",ActionExtraDetails="idunt" +%CYBERARK: MessageID="4";min 1.136",ProductAccount="xplic",ProductProcess="eseruntm",EventId="lpaquiof",EventClass="oloreeu",EventSeverity="very-high",EventMessage="deny",ActingUserName="etquasia",ActingAddress="10.169.123.103",ActionSourceUser="riatur",ActionTargetUser="oeni",ActionObject="dol",ActionSafe="dol",ActionLocation="atur",ActionCategory="issu",ActionRequestId="identsu",ActionReason="piscivel",ActionExtraDetails="hend" +%CYBERARK: MessageID="276";aer 1.7744",ProductAccount="iati",ProductProcess="minim",EventId="scipi",EventClass="tur",EventSeverity="very-high",EventMessage="cancel",ActingUserName="Nemoenim",ActingAddress="10.126.205.76",ActionSourceUser="etur",ActionTargetUser="rsitvol",ActionObject="utali",ActionSafe="sed",ActionLocation="xeac",ActionCategory="umdolors",ActionRequestId="lumdo",ActionReason="acom",ActionExtraDetails="eFini" +June 4 20:44:15 uovol %CYBERARK: MessageID="38";Version=1.3184;Message=accept;Issuer=eufug;Station=10.164.66.154;File=est;Safe=civelits;Location=ici;Category=snulap;RequestId=enimadm;Reason=stenatu;Severity=very-high;SourceUser=sitvo;TargetUser=ine;GatewayStation=10.169.101.161;TicketID=itessequ;PolicyID=iusmodit;UserName=orissu;LogonDomain=fic5107.home;Address=mmodoco2581.www5.host;CPMStatus=isiutali;Port=3575;Database=stquidol;DeviceType=Nemoenim;ExtraDetails=imadmini; +amvo 2018-06-19 03:46:49.592538723 +0000 UTC tnul6235.www5.lan %CYBERARK: MessageID="79";isau 1.1480",ProductAccount="ihilmole",ProductProcess="saquaea",EventId="ons",EventClass="orsitam",EventSeverity="medium",EventMessage="block",ActingUserName="metco",ActingAddress="10.70.83.200",ActionSourceUser="riame",ActionTargetUser="riat",ActionObject="sseq",ActionSafe="eriam",ActionLocation="pernat",ActionCategory="udan",ActionRequestId="archi",ActionReason="iutaliq",ActionExtraDetails="urQuis" +July 3 10:49:23 orum %CYBERARK: MessageID="53";Version=1.4887;Message=block;Issuer=madminim;Station=10.207.97.192;File=quio;Safe=eom;Location=teni;Category=ipiscive;RequestId=dant;Reason=etdolor;Severity=high;SourceUser=paria;TargetUser=mmod;GatewayStation=10.134.55.11;TicketID=amqu;PolicyID=lorsitam;UserName=tanimid;LogonDomain=onpr47.api.home;Address=oremqu7663.local;CPMStatus=llumq;Port=5816;Database=tetura;DeviceType=rumet;ExtraDetails=uptasnul; +2018-07-17 17:51:58.112538723 +0000 UTC nde2358.mail.corp %CYBERARK: MessageID="75";Version=1.3601;Message=cancel;Issuer=texplica;Station=10.52.150.104;File=esse;Safe=veniam;Location=edquian;Category=sus;RequestId=imavenia;Reason=expli;Severity=low;SourceUser=orum;TargetUser=oinBCSed;GatewayStation=10.31.187.19;TicketID=ilm;PolicyID=mvel;UserName=eritq;LogonDomain=rehen4859.api.host;Address=eve234.www5.local;CPMStatus=nula;Port=2783;Database=lit;DeviceType=santi;ExtraDetails=ritati; +dip 2018-08-01 00:54:32.372538723 +0000 UTC idolo5292.local %CYBERARK: MessageID="89";Version=1.3175;Message=allow;Issuer=runtm;Station=10.41.232.147;File=psumd;Safe=oloree;Location=seos;Category=rios;RequestId=labo;Reason=lpaquiof;Severity=high;SourceUser=mcorpo;TargetUser=ntexpl;GatewayStation=10.61.175.217;TicketID=enbyCi;PolicyID=reetdo;UserName=tat;LogonDomain=eufugia4481.corp;Address=fficia2304.www5.home;CPMStatus=vel;Port=2396;Database=rere;DeviceType=pta;ExtraDetails=nonn; +August 15 07:57:06 volup %CYBERARK: MessageID="261";ptate 1.3830",ProductAccount="uisnos",ProductProcess="quamqua",EventId="ntut",EventClass="mag",EventSeverity="very-high",EventMessage="deny",ActingUserName="mini",ActingAddress="10.150.30.95",ActionSourceUser="tur",ActionTargetUser="atnonpr",ActionObject="ita",ActionSafe="amquaer",ActionLocation="aqui",ActionCategory="enby",ActionRequestId="lpa",ActionReason="isn",ActionExtraDetails="smod" +August 29 14:59:40 siuta %CYBERARK: MessageID="66";atev 1.6626",ProductAccount="CSe",ProductProcess="exerci",EventId="inesciu",EventClass="quid",EventSeverity="high",EventMessage="deny",ActingUserName="onse",ActingAddress="10.98.71.45",ActionSourceUser="destla",ActionTargetUser="fugitse",ActionObject="minimve",ActionSafe="serrorsi",ActionLocation="tametco",ActionCategory="mquisnos",ActionRequestId="lore",ActionReason="isci",ActionExtraDetails="Dui" +lup 2018-09-12 22:02:15.152538723 +0000 UTC iumtotam1010.www5.corp %CYBERARK: MessageID="168";userror 1.5986",ProductAccount="nonn",ProductProcess="hite",EventId="ianonnum",EventClass="nofdeFi",EventSeverity="medium",EventMessage="deny",ActingUserName="remq",ActingAddress="10.252.251.143",ActionSourceUser="velill",ActionTargetUser="rspic",ActionObject="orinrepr",ActionSafe="ror",ActionLocation="onsecte",ActionCategory="doei",ActionRequestId="nvolupta",ActionReason="tev",ActionExtraDetails="nre" +%CYBERARK: MessageID="274";lumdolor 1.4706",ProductAccount="eserun",ProductProcess="rvelill",EventId="lupta",EventClass="byC",EventSeverity="high",EventMessage="accept",ActingUserName="uta",ActingAddress="10.197.203.167",ActionSourceUser="ulapa",ActionTargetUser="iumdo",ActionObject="iusmodit",ActionSafe="aturv",ActionLocation="ectetura",ActionCategory="obeataev",ActionRequestId="umf",ActionReason="olesti",ActionExtraDetails="smo" +tDuis 2018-10-11 12:07:23.672538723 +0000 UTC iqu1643.www.host %CYBERARK: MessageID="96";inim 1.6806",ProductAccount="ibusBo",ProductProcess="untincu",EventId="tten",EventClass="etur",EventSeverity="low",EventMessage="accept",ActingUserName="enima",ActingAddress="10.187.170.23",ActionSourceUser="sequ",ActionTargetUser="sectetu",ActionObject="evi",ActionSafe="tionula",ActionLocation="accus",ActionCategory="uatu",ActionRequestId="mquis",ActionReason="lab",ActionExtraDetails="uido" +2018-10-25 19:09:57.932538723 +0000 UTC nimadmin5577.corp %CYBERARK: MessageID="61";Version=1.3824;Message=allow;Issuer=tinculpa;Station=10.123.62.215;File=rumSecti;Safe=riamea;Location=eca;Category=oluptate;RequestId=Duisa;Reason=consequa;Severity=low;SourceUser=iaecon;TargetUser=aevitaed;GatewayStation=10.250.248.215;TicketID=remap;PolicyID=deri;UserName=quaeratv;LogonDomain=involu1450.www.localhost;Address=udexerc2708.api.test;CPMStatus=odic;Port=505;Database=lica;DeviceType=secil;ExtraDetails=uisnos; +scipit 2018-11-09 02:12:32.192538723 +0000 UTC lloinve551.internal.local %CYBERARK: MessageID="372";Version=1.3759;Message=block;Issuer=isiutali;Station=10.146.57.23;File=evit;Safe=tno;Location=iss;Category=taspe;RequestId=lum;Reason=xerc;Severity=high;GatewayStation=10.147.154.118;TicketID=nvol;PolicyID=enimadmi;UserName=tateveli;LogonDomain=osa3211.www5.example;Address=temvele5776.www.test;CPMStatus=inimve;Port="864";Database=cin;DeviceType=tmo;ExtraDetails=onofdeF; +its 2018-11-23 09:15:06.452538723 +0000 UTC uptasnul2751.www5.corp %CYBERARK: MessageID="232";ostrudex 1.4542",ProductAccount="niamqui",ProductProcess="usmodite",EventId="tlabo",EventClass="tatemse",EventSeverity="very-high",EventMessage="cancel",ActingUserName="uamestqu",ActingAddress="10.193.33.201",ActionSourceUser="hender",ActionTargetUser="ptatemU",ActionObject="seq",ActionSafe="rumSe",ActionLocation="tatnonp",ActionCategory="ommo",ActionRequestId="adeser",ActionReason="uasiarc",ActionExtraDetails="doeiu" +2018-12-07 16:17:40.712538723 +0000 UTC atuserro6791.internal.host %CYBERARK: MessageID="24";upta 1.313",ProductAccount="onnumqua",ProductProcess="quioff",EventId="iuntN",EventClass="ipis",EventSeverity="low",EventMessage="block",ActingUserName="nesci",ActingAddress="10.154.172.82",ActionSourceUser="lorsi",ActionTargetUser="tetura",ActionObject="eeufug",ActionSafe="edutper",ActionLocation="tevelite",ActionCategory="tocca",ActionRequestId="orsitvol",ActionReason="ntor",ActionExtraDetails="oinBCSed" +%CYBERARK: MessageID="79";obeatae 1.1886",ProductAccount="midestl",ProductProcess="quatu",EventId="avolu",EventClass="teturad",EventSeverity="very-high",EventMessage="allow",ActingUserName="expl",ActingAddress="10.47.63.70",ActionSourceUser="lup",ActionTargetUser="tpers",ActionObject="orsitv",ActionSafe="temseq",ActionLocation="uisaute",ActionCategory="uun",ActionRequestId="end",ActionReason="odocons",ActionExtraDetails="olu" +January 5 06:22:49 amn %CYBERARK: MessageID="312";itessequ 1.5170",ProductAccount="fdeFinib",ProductProcess="uip",EventId="ectobea",EventClass="dat",EventSeverity="very-high",EventMessage="block",ActingUserName="turQuis",ActingAddress="10.178.160.245",ActionSourceUser="deomnisi",ActionTargetUser="olupta",ActionObject="oll",ActionSafe="laboree",ActionLocation="udantiu",ActionCategory="itametco",ActionRequestId="iav",ActionReason="odico",ActionExtraDetails="rsint" +January 19 13:25:23 quiav %CYBERARK: MessageID="77";Version=1.6648;Message=block;Issuer=Nem;Station=10.85.13.237;File=oluptat;Safe=enimad;Location=tis;Category=qua;RequestId=con;Reason=tore;Severity=high;SourceUser=quelaud;TargetUser=luptat;GatewayStation=10.89.154.115;TicketID=oeiusmo;PolicyID=nimv;UserName=emeu;LogonDomain=tatemac5192.www5.test;Address=teursint1321.www5.example;CPMStatus=lamcolab;Port=7024;Database=nturmag;DeviceType=uredol;ExtraDetails=maliqua; +2019-02-02 20:27:57.752538723 +0000 UTC omnisi5530.mail.example %CYBERARK: MessageID="308";Version=1.3387;Message=allow;Issuer=itame;Station=10.222.32.183;File=yCiceroi;Safe=nostrum;Location=orroquis;Category=eumi;RequestId=tvo;Reason=aea;Severity=low;SourceUser=mmo;TargetUser=eve;GatewayStation=10.65.207.234;TicketID=ciad;PolicyID=ugiatqu;UserName=eruntmo;LogonDomain=nimve2787.mail.test;Address=boreet2051.internal.localdomain;CPMStatus=iavo;Port=1644;Database=udexerc;DeviceType=ovolupta;ExtraDetails=volup; +rro 2019-02-17 03:30:32.012538723 +0000 UTC tuser6944.local %CYBERARK: MessageID="54";iarchite 1.1612",ProductAccount="oinven",ProductProcess="natu",EventId="edqu",EventClass="tationu",EventSeverity="high",EventMessage="cancel",ActingUserName="olore",ActingAddress="10.16.181.60",ActionSourceUser="ameaquei",ActionTargetUser="gnama",ActionObject="esciun",ActionSafe="tesse",ActionLocation="olupta",ActionCategory="isno",ActionRequestId="oluptas",ActionReason="nderiti",ActionExtraDetails="uatu" +orem 2019-03-03 10:33:06.272538723 +0000 UTC giatqu1484.internal.corp %CYBERARK: MessageID="208";oreseosq 1.2275",ProductAccount="uianon",ProductProcess="nul",EventId="onse",EventClass="sitam",EventSeverity="very-high",EventMessage="deny",ActingUserName="illoin",ActingAddress="10.91.213.82",ActionSourceUser="uid",ActionTargetUser="amnis",ActionObject="rvelil",ActionSafe="adese",ActionLocation="olorsi",ActionCategory="caboNemo",ActionRequestId="uptas",ActionReason="temaccus",ActionExtraDetails="ons" +2019-03-17 17:35:40.532538723 +0000 UTC oreeu3666.invalid %CYBERARK: MessageID="48";tis 1.6724",ProductAccount="eprehe",ProductProcess="tinvolup",EventId="iaeconse",EventClass="uisa",EventSeverity="medium",EventMessage="allow",ActingUserName="tdolo",ActingAddress="10.204.214.98",ActionSourceUser="iumt",ActionTargetUser="porissus",ActionObject="imip",ActionSafe="tsunt",ActionLocation="rnat",ActionCategory="oremi",ActionRequestId="ectobeat",ActionReason="ecte",ActionExtraDetails="abo" +%CYBERARK: MessageID="219";snos 1.5910",ProductAccount="moenimip",ProductProcess="uames",EventId="tium",EventClass="ianonn",EventSeverity="very-high",EventMessage="accept",ActingUserName="etc",ActingAddress="10.223.178.192",ActionSourceUser="atquovol",ActionTargetUser="evel",ActionObject="edol",ActionSafe="sequuntu",ActionLocation="quameius",ActionCategory="litse",ActionRequestId="san",ActionReason="apari",ActionExtraDetails="iarchit" +2019-04-15 07:40:49.052538723 +0000 UTC nsequat6724.www.invalid %CYBERARK: MessageID="183";Version=1.801;Message=cancel;Issuer=ati;Station=10.26.137.126;File=dolor;Safe=Mal;Location=ametcons;Category=tconse;RequestId=eumf;Reason=roquisq;Severity=medium;SourceUser=doconse;TargetUser=audant;GatewayStation=10.26.33.181;TicketID=remeum;PolicyID=mmod;UserName=taevit;LogonDomain=ama6820.mail.example;Address=umto3015.mail.lan;CPMStatus=sitv;Port=4667;Database=com;DeviceType=rep;ExtraDetails=mveni; +April 29 14:43:23 num %CYBERARK: MessageID="41";Version=1.10;Message=accept;Issuer=quaerat;Station=10.148.195.208;File=amnih;Safe=tper;Location=pisciv;Category=tconsect;RequestId=pariat;Reason=iutal;Severity=low;SourceUser=ctobeat;TargetUser=isi;GatewayStation=10.142.161.116;TicketID=eca;PolicyID=ctionofd;UserName=mpori;LogonDomain=olupt966.www5.corp;Address=etquasia1800.www.host;CPMStatus=nimip;Port=7612;Database=squamest;DeviceType=quisn;ExtraDetails=pteu; +velillum 2019-05-13 21:45:57.572538723 +0000 UTC ntNequ7639.internal.localdomain %CYBERARK: MessageID="270";Version=1.1026;Message=block;Issuer=itinvo;Station=10.107.24.54;File=emipsumq;Safe=culpaq;Location=quamq;Category=usan;RequestId=tdolo;Reason=ident;Severity=medium;SourceUser=itaedi;TargetUser=hend;GatewayStation=10.10.174.253;TicketID=esciun;PolicyID=tasnul;UserName=uptasn;LogonDomain=lit4112.www.localhost;Address=quisquam2153.mail.host;CPMStatus=dit;Port=2717;Database=lup;DeviceType=aeca;ExtraDetails=isau; +May 28 04:48:31 boreetd %CYBERARK: MessageID="309";tNe 1.2566",ProductAccount="eeufug",ProductProcess="ntin",EventId="iades",EventClass="radipis",EventSeverity="very-high",EventMessage="deny",ActingUserName="luptate",ActingAddress="10.87.92.17",ActionSourceUser="utlabore",ActionTargetUser="tamr",ActionObject="serr",ActionSafe="usci",ActionLocation="unturmag",ActionCategory="dexeaco",ActionRequestId="lupta",ActionReason="ura",ActionExtraDetails="oreeufug" +June 11 11:51:06 dolo %CYBERARK: MessageID="295";Version=1.5649;Message=deny;Issuer=Finibus;Station=10.161.51.135;File=porin;Safe=metMal;Location=ciati;Category=ecillum;RequestId=olor;Reason=amei;Severity=medium;SourceUser=quid;TargetUser=accus;GatewayStation=10.231.51.136;TicketID=ctobeat;PolicyID=upta;UserName=asper;LogonDomain=dictasun3408.internal.invalid;Address=secte1774.localhost;CPMStatus=iqui;Port=5200;Database=litani;DeviceType=emp;ExtraDetails=arch; +June 25 18:53:40 dipisciv %CYBERARK: MessageID="148";uam 1.2575",ProductAccount="llum",ProductProcess="mwr",EventId="cia",EventClass="idolo",EventSeverity="low",EventMessage="allow",ActingUserName="mquido",ActingAddress="10.51.17.32",ActionSourceUser="ree",ActionTargetUser="itten",ActionObject="quipexea",ActionSafe="orsitv",ActionLocation="dunt",ActionCategory="int",ActionRequestId="ionevo",ActionReason="llitani",ActionExtraDetails="uscipit" +etco 2019-07-10 01:56:14.612538723 +0000 UTC iuntN4077.www.invalid %CYBERARK: MessageID="260";isnostru 1.270",ProductAccount="mmodicon",ProductProcess="eetdo",EventId="mquisno",EventClass="atvolup",EventSeverity="medium",EventMessage="deny",ActingUserName="ollita",ActingAddress="10.108.123.148",ActionSourceUser="cto",ActionTargetUser="cusa",ActionObject="nderi",ActionSafe="tem",ActionLocation="tcu",ActionCategory="eumiu",ActionRequestId="nim",ActionReason="pteurs",ActionExtraDetails="ercitati" +July 24 08:58:48 eturadip %CYBERARK: MessageID="8";Version=1.425;Message=accept;Issuer=rsitamet;Station=10.114.0.148;File=utod;Safe=olesti;Location=edquia;Category=ihi;RequestId=undeomn;Reason=ape;Severity=medium;SourceUser=amco;TargetUser=ons;GatewayStation=10.198.187.144;TicketID=atquo;PolicyID=borio;UserName=equatD;LogonDomain=uidol6868.mail.localdomain;Address=uido2773.www5.test;CPMStatus=acons;Port=3820;Database=periam;DeviceType=ain;ExtraDetails=umiurer; +onorume 2019-08-07 16:01:23.132538723 +0000 UTC abill5290.lan %CYBERARK: MessageID="89";mini 1.7224",ProductAccount="loru",ProductProcess="iadeser",EventId="litess",EventClass="qui",EventSeverity="low",EventMessage="allow",ActingUserName="equa",ActingAddress="10.61.140.120",ActionSourceUser="olorsit",ActionTargetUser="naaliq",ActionObject="plica",ActionSafe="asiarc",ActionLocation="lor",ActionCategory="nvolupt",ActionRequestId="dquia",ActionReason="ora",ActionExtraDetails="umfugiat" +%CYBERARK: MessageID="36";Version=1.6988;Message=deny;Issuer=ite;Station=10.93.24.151;File=Duis;Safe=lupt;Location=quatur;Category=dminim;RequestId=ptatevel;Reason=aperiame;Severity=very-high;SourceUser=eirured;TargetUser=sequamn;GatewayStation=10.149.238.108;TicketID=ciatisun;PolicyID=duntutl;UserName=nven;LogonDomain=ptat4878.lan;Address=quame1852.www.test;CPMStatus=deomni;Port=4512;Database=fugi;DeviceType=nse;ExtraDetails=nesciu; +September 5 06:06:31 inrepreh %CYBERARK: MessageID="39";rit 1.6107",ProductAccount="cipitla",ProductProcess="tlab",EventId="vel",EventClass="ionevo",EventSeverity="high",EventMessage="accept",ActingUserName="uinesc",ActingAddress="10.101.45.225",ActionSourceUser="utla",ActionTargetUser="emi",ActionObject="uaerat",ActionSafe="iduntu",ActionLocation="samvol",ActionCategory="equa",ActionRequestId="apari",ActionReason="tsunt",ActionExtraDetails="caecat" +qui 2019-09-19 13:09:05.912538723 +0000 UTC caboN3124.mail.home %CYBERARK: MessageID="8";catcupid 1.3167",ProductAccount="quela",ProductProcess="uamquaer",EventId="texplica",EventClass="enimi",EventSeverity="low",EventMessage="cancel",ActingUserName="ore",ActingAddress="10.2.204.161",ActionSourceUser="iquamqu",ActionTargetUser="eumfugia",ActionObject="reeufugi",ActionSafe="sequines",ActionLocation="minimve",ActionCategory="texplica",ActionRequestId="entorev",ActionReason="quuntur",ActionExtraDetails="olup" +les 2019-10-03 20:11:40.172538723 +0000 UTC norumet2571.internal.example %CYBERARK: MessageID="89";temp 1.6971",ProductAccount="aliqu",ProductProcess="sequine",EventId="utaliqui",EventClass="isciv",EventSeverity="very-high",EventMessage="cancel",ActingUserName="ptatemse",ActingAddress="10.33.112.100",ActionSourceUser="catcup",ActionTargetUser="enimad",ActionObject="magnaali",ActionSafe="velillum",ActionLocation="ionev",ActionCategory="vitaedi",ActionRequestId="rna",ActionReason="cons",ActionExtraDetails="Except" +%CYBERARK: MessageID="95";Version=1.3175;Message=block;Issuer=neavol;Station=10.94.152.238;File=rporiss;Safe=billoinv;Location=etconse;Category=nesciu;RequestId=mali;Reason=roinBCSe;Severity=very-high;SourceUser=uames;TargetUser=tla;GatewayStation=10.151.110.250;TicketID=psa;PolicyID=nreprehe;UserName=pidatatn;LogonDomain=isno4595.local;Address=lla5407.lan;CPMStatus=upt;Port=4762;Database=itaedict;DeviceType=eroi;ExtraDetails=onemull; +mporain 2019-11-01 10:16:48.692538723 +0000 UTC eratvo7756.localdomain %CYBERARK: MessageID="179";Version=1.4965;Message=allow;Issuer=alorumwr;Station=10.146.61.5;File=tvolu;Safe=imve;Location=ollitan;Category=temseq;RequestId=vol;Reason=loremips;Severity=high;SourceUser=eturadi;TargetUser=umS;GatewayStation=10.77.9.17;TicketID=henderi;PolicyID=taevitae;UserName=tevel;LogonDomain=tatemse5403.home;Address=iquipexe4708.api.localhost;CPMStatus=quuntur;Port=5473;Database=amremap;DeviceType=oremagna;ExtraDetails=aqu; +%CYBERARK: MessageID="83";tvolu 1.2244",ProductAccount="ore",ProductProcess="lors",EventId="saute",EventClass="ecillumd",EventSeverity="high",EventMessage="allow",ActingUserName="sequatu",ActingAddress="10.128.102.130",ActionSourceUser="mdoloree",ActionTargetUser="que",ActionObject="inBCSed",ActionSafe="cteturad",ActionLocation="umq",ActionCategory="ita",ActionRequestId="ipsaquae",ActionReason="olu",ActionExtraDetails="exerci" +2019-11-30 00:21:57.212538723 +0000 UTC moen6809.internal.example %CYBERARK: MessageID="150";Version=1.7701;Message=cancel;Issuer=reseo;Station=10.31.86.83;File=pariat;Safe=icaboNe;Location=boreetd;Category=uir;RequestId=rumex;Reason=ectobea;Severity=medium;SourceUser=tamrem;TargetUser=doloremi;GatewayStation=10.200.162.248;TicketID=uptate;PolicyID=giatquo;UserName=onnu;LogonDomain=reprehe650.www.corp;Address=oremip4070.www5.invalid;CPMStatus=turad;Port=1704;Database=billo;DeviceType=doloremi;ExtraDetails=ectetura; +%CYBERARK: MessageID="166";cul 1.3325",ProductAccount="atatn",ProductProcess="ipisc",EventId="iatnulap",EventClass="roi",EventSeverity="high",EventMessage="allow",ActingUserName="volup",ActingAddress="10.103.215.159",ActionSourceUser="ddoeiusm",ActionTargetUser="apa",ActionObject="archite",ActionSafe="tur",ActionLocation="ddo",ActionCategory="emp",ActionRequestId="inBC",ActionReason="did",ActionExtraDetails="atcupi" diff --git a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json new file mode 100644 index 00000000000..2df25e0b1fe --- /dev/null +++ b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json @@ -0,0 +1,5237 @@ +[ + { + "event.action": "allow", + "event.code": "ria", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2016-01-29 06:09:59.732538723 +0000 UTC eacommod1428.lan %CYBERARK: MessageID=\"188\";exercita 1.1332\",ProductAccount=\"itv\",ProductProcess=\"odoco\",EventId=\"ria\",EventClass=\"min\",EventSeverity=\"low\",EventMessage=\"allow\",ActingUserName=\"utl\",ActingAddress=\"10.208.15.216\",ActionSourceUser=\"tation\",ActionTargetUser=\"quasiarc\",ActionObject=\"liqua\",ActionSafe=\"ciade\",ActionLocation=\"turadipi\",ActionCategory=\"aeca\",ActionRequestId=\"idi\",ActionReason=\"pexe\",ActionExtraDetails=\"nes\"", + "file.directory": "turadipi", + "file.name": "liqua", + "fileset.name": "corepas", + "host.ip": "10.208.15.216", + "input.type": "log", + "log.level": "low", + "log.offset": 0, + "observer.product": "exercita", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1332", + "related.ip": [ + "10.208.15.216" + ], + "related.user": [ + "itv", + "quasiarc", + "utl" + ], + "rsa.db.index": "nes", + "rsa.internal.event_desc": "pexe", + "rsa.internal.messageid": "188", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "aeca", + "rsa.misc.group_object": "ciade", + "rsa.misc.reference_id": "ria", + "rsa.misc.reference_id1": "idi", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.1332", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "utl" + }, + { + "destination.address": "volup208.invalid", + "destination.port": 5191, + "event.action": "block", + "event.code": "168", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"168\";Version=1.259;Message=block;Issuer=dolore;Station=10.92.136.230;File=ritquiin;Safe=umqui;Location=reeufugi;Category=mdolo;RequestId=mqui;Reason=nci;Severity=very-high;SourceUser=litesse;TargetUser=orev;GatewayStation=10.175.75.18;TicketID=deF;PolicyID=sist;UserName=nnumqu;LogonDomain=iatnu3810.mail.localdomain;Address=volup208.invalid;CPMStatus=eosquir;Port=5191;Database=umdo;DeviceType=itessequ;ExtraDetails=vol;", + "file.directory": "reeufugi", + "file.name": "ritquiin", + "fileset.name": "corepas", + "group.name": "litesse", + "host.ip": "10.92.136.230", + "input.type": "log", + "log.level": "very-high", + "log.offset": 477, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.259", + "related.ip": [ + "10.175.75.18", + "10.92.136.230" + ], + "related.user": [ + "nnumqu", + "orev", + "dolore" + ], + "rsa.db.database": "umdo", + "rsa.db.index": "vol", + "rsa.internal.event_desc": "nci", + "rsa.internal.messageid": "168", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "mdolo", + "rsa.misc.disposition": "eosquir", + "rsa.misc.group": "litesse", + "rsa.misc.group_object": "umqui", + "rsa.misc.obj_type": "itessequ", + "rsa.misc.operation_id": "deF", + "rsa.misc.policy_name": "sist", + "rsa.misc.reference_id": "168", + "rsa.misc.reference_id1": "mqui", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.259", + "rsa.network.domain": "iatnu3810.mail.localdomain", + "rsa.network.host_dst": "volup208.invalid", + "server.domain": "iatnu3810.mail.localdomain", + "service.type": "cyberark", + "source.ip": [ + "10.175.75.18" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "dolore" + }, + { + "destination.address": "tetu5280.www5.invalid", + "destination.port": 2548, + "event.action": "accept", + "event.code": "26", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "nibus 2016-02-26 20:15:08.252538723 +0000 UTC mipsumq3879.internal.localdomain %CYBERARK: MessageID=\"26\";Version=1.7269;Message=accept;Issuer=incid;Station=10.51.132.10;File=utper;Safe=squame;Location=ntex;Category=eius;RequestId=luptat;Reason=emape;Severity=low;SourceUser=incidi;TargetUser=nse;GatewayStation=10.46.185.46;TicketID=temvel;PolicyID=iatu;UserName=serror;LogonDomain=anti4454.api.example;Address=tetu5280.www5.invalid;CPMStatus=tionulam;Port=2548;Database=byC;DeviceType=tinculp;ExtraDetails=tur;", + "file.directory": "ntex", + "file.name": "utper", + "fileset.name": "corepas", + "group.name": "incidi", + "host.ip": "10.51.132.10", + "input.type": "log", + "log.level": "low", + "log.offset": 921, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7269", + "related.ip": [ + "10.51.132.10", + "10.46.185.46" + ], + "related.user": [ + "nse", + "incid", + "serror" + ], + "rsa.db.database": "byC", + "rsa.db.index": "tur", + "rsa.internal.event_desc": "emape", + "rsa.internal.messageid": "26", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "eius", + "rsa.misc.disposition": "tionulam", + "rsa.misc.group": "incidi", + "rsa.misc.group_object": "squame", + "rsa.misc.obj_type": "tinculp", + "rsa.misc.operation_id": "temvel", + "rsa.misc.policy_name": "iatu", + "rsa.misc.reference_id": "26", + "rsa.misc.reference_id1": "luptat", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7269", + "rsa.network.domain": "anti4454.api.example", + "rsa.network.host_dst": "tetu5280.www5.invalid", + "server.domain": "anti4454.api.example", + "service.type": "cyberark", + "source.ip": [ + "10.46.185.46" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "incid" + }, + { + "destination.address": "llu4762.mail.localdomain", + "destination.port": 5695, + "event.action": "deny", + "event.code": "184", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2016-03-12 03:17:42.512538723 +0000 UTC minim7868.www5.localdomain %CYBERARK: MessageID=\"184\";Version=1.6713;Message=deny;Issuer=psumquia;Station=10.53.192.140;File=con;Safe=uia;Location=quiavo;Category=issusci;RequestId=mol;Reason=taspe;Severity=high;SourceUser=psumq;TargetUser=atcup;GatewayStation=10.155.236.240;TicketID=tatno;PolicyID=dquiac;UserName=ptass;LogonDomain=uam6303.api.lan;Address=llu4762.mail.localdomain;CPMStatus=scivel;Port=5695;Database=aperi;DeviceType=iveli;ExtraDetails=llumd;", + "file.directory": "quiavo", + "file.name": "con", + "fileset.name": "corepas", + "group.name": "psumq", + "host.ip": "10.53.192.140", + "input.type": "log", + "log.level": "high", + "log.offset": 1433, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6713", + "related.ip": [ + "10.155.236.240", + "10.53.192.140" + ], + "related.user": [ + "atcup", + "psumquia", + "ptass" + ], + "rsa.db.database": "aperi", + "rsa.db.index": "llumd", + "rsa.internal.event_desc": "taspe", + "rsa.internal.messageid": "184", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "issusci", + "rsa.misc.disposition": "scivel", + "rsa.misc.group": "psumq", + "rsa.misc.group_object": "uia", + "rsa.misc.obj_type": "iveli", + "rsa.misc.operation_id": "tatno", + "rsa.misc.policy_name": "dquiac", + "rsa.misc.reference_id": "184", + "rsa.misc.reference_id1": "mol", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.6713", + "rsa.network.domain": "uam6303.api.lan", + "rsa.network.host_dst": "llu4762.mail.localdomain", + "server.domain": "uam6303.api.lan", + "service.type": "cyberark", + "source.ip": [ + "10.155.236.240" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "psumquia" + }, + { + "event.action": "cancel", + "event.code": "rmagni", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"161\";emaper 1.2638\",ProductAccount=\"eos\",ProductProcess=\"enimad\",EventId=\"rmagni\",EventClass=\"sit\",EventSeverity=\"medium\",EventMessage=\"cancel\",ActingUserName=\"oremips\",ActingAddress=\"10.81.199.122\",ActionSourceUser=\"aquaeabi\",ActionTargetUser=\"giatq\",ActionObject=\"quid\",ActionSafe=\"fug\",ActionLocation=\"uatDuis\",ActionCategory=\"ude\",ActionRequestId=\"maveniam\",ActionReason=\"uian\",ActionExtraDetails=\"tempo\"", + "file.directory": "uatDuis", + "file.name": "quid", + "fileset.name": "corepas", + "host.ip": "10.81.199.122", + "input.type": "log", + "log.level": "medium", + "log.offset": 1935, + "observer.product": "emaper", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2638", + "related.ip": [ + "10.81.199.122" + ], + "related.user": [ + "eos", + "oremips", + "giatq" + ], + "rsa.db.index": "tempo", + "rsa.internal.event_desc": "uian", + "rsa.internal.messageid": "161", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "ude", + "rsa.misc.group_object": "fug", + "rsa.misc.reference_id": "rmagni", + "rsa.misc.reference_id1": "maveniam", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.2638", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "oremips" + }, + { + "destination.address": "aquaeab2275.www5.domain", + "destination.port": 4091, + "event.action": "deny", + "event.code": "139", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "eetd 2016-04-09 17:22:51.032538723 +0000 UTC eip1448.internal.local %CYBERARK: MessageID=\"139\";Version=1.3491;Message=deny;Issuer=tcupida;Station=10.139.186.201;File=ect;Safe=reetdolo;Location=nrepreh;Category=obeataev;RequestId=lor;Reason=uidexea;Severity=medium;SourceUser=natura;TargetUser=aboris;GatewayStation=10.172.14.142;TicketID=ssitaspe;PolicyID=gitsedqu;UserName=uam;LogonDomain=temq1198.internal.example;Address=aquaeab2275.www5.domain;CPMStatus=ehend;Port=4091;Database=isiu;DeviceType=nimadmi;ExtraDetails=iatisu;", + "file.directory": "nrepreh", + "file.name": "ect", + "fileset.name": "corepas", + "group.name": "natura", + "host.ip": "10.139.186.201", + "input.type": "log", + "log.level": "medium", + "log.offset": 2366, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3491", + "related.ip": [ + "10.139.186.201", + "10.172.14.142" + ], + "related.user": [ + "tcupida", + "aboris", + "uam" + ], + "rsa.db.database": "isiu", + "rsa.db.index": "iatisu", + "rsa.internal.event_desc": "uidexea", + "rsa.internal.messageid": "139", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "obeataev", + "rsa.misc.disposition": "ehend", + "rsa.misc.group": "natura", + "rsa.misc.group_object": "reetdolo", + "rsa.misc.obj_type": "nimadmi", + "rsa.misc.operation_id": "ssitaspe", + "rsa.misc.policy_name": "gitsedqu", + "rsa.misc.reference_id": "139", + "rsa.misc.reference_id1": "lor", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3491", + "rsa.network.domain": "temq1198.internal.example", + "rsa.network.host_dst": "aquaeab2275.www5.domain", + "server.domain": "temq1198.internal.example", + "service.type": "cyberark", + "source.ip": [ + "10.172.14.142" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tcupida" + }, + { + "destination.address": "amquisno3338.www5.lan", + "destination.port": 776, + "event.action": "accept", + "event.code": "106", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"106\";Version=1.6875;Message=accept;Issuer=ipis;Station=10.47.76.251;File=eataevit;Safe=uptatev;Location=uovol;Category=dmi;RequestId=olab;Reason=mquisnos;Severity=medium;SourceUser=ore;TargetUser=etconsec;GatewayStation=10.104.111.129;TicketID=mUt;PolicyID=usmodte;UserName=ele;LogonDomain=tenbyCic5882.api.home;Address=amquisno3338.www5.lan;CPMStatus=nonnu;Port=776;Database=riat;DeviceType=luptatem;ExtraDetails=umdolor;", + "file.directory": "uovol", + "file.name": "eataevit", + "fileset.name": "corepas", + "group.name": "ore", + "host.ip": "10.47.76.251", + "input.type": "log", + "log.level": "medium", + "log.offset": 2894, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6875", + "related.ip": [ + "10.47.76.251", + "10.104.111.129" + ], + "related.user": [ + "ele", + "etconsec", + "ipis" + ], + "rsa.db.database": "riat", + "rsa.db.index": "umdolor", + "rsa.internal.event_desc": "mquisnos", + "rsa.internal.messageid": "106", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "dmi", + "rsa.misc.disposition": "nonnu", + "rsa.misc.group": "ore", + "rsa.misc.group_object": "uptatev", + "rsa.misc.obj_type": "luptatem", + "rsa.misc.operation_id": "mUt", + "rsa.misc.policy_name": "usmodte", + "rsa.misc.reference_id": "106", + "rsa.misc.reference_id1": "olab", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6875", + "rsa.network.domain": "tenbyCic5882.api.home", + "rsa.network.host_dst": "amquisno3338.www5.lan", + "server.domain": "tenbyCic5882.api.home", + "service.type": "cyberark", + "source.ip": [ + "10.104.111.129" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ipis" + }, + { + "event.action": "deny", + "event.code": "ofdeF", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "inB 2016-05-08 07:27:59.552538723 +0000 UTC deomni124.www.example %CYBERARK: MessageID=\"74\";tae 1.1382\",ProductAccount=\"animi\",ProductProcess=\"oluptate\",EventId=\"ofdeF\",EventClass=\"tion\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"quiratio\",ActingAddress=\"10.116.120.216\",ActionSourceUser=\"qua\",ActionTargetUser=\"umdo\",ActionObject=\"sed\",ActionSafe=\"apariat\",ActionLocation=\"mol\",ActionCategory=\"pteursi\",ActionRequestId=\"onse\",ActionReason=\"rumet\",ActionExtraDetails=\"oll\"", + "file.directory": "mol", + "file.name": "sed", + "fileset.name": "corepas", + "host.ip": "10.116.120.216", + "input.type": "log", + "log.level": "very-high", + "log.offset": 3339, + "observer.product": "tae", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1382", + "related.ip": [ + "10.116.120.216" + ], + "related.user": [ + "umdo", + "quiratio", + "animi" + ], + "rsa.db.index": "oll", + "rsa.internal.event_desc": "rumet", + "rsa.internal.messageid": "74", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "pteursi", + "rsa.misc.group_object": "apariat", + "rsa.misc.reference_id": "ofdeF", + "rsa.misc.reference_id1": "onse", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1382", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "quiratio" + }, + { + "destination.address": "idolores3839.localdomain", + "destination.port": 2424, + "event.action": "cancel", + "event.code": "144", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "Ciceroi 2016-05-22 14:30:33.812538723 +0000 UTC aveniam1436.www.test %CYBERARK: MessageID=\"144\";Version=1.5529;Message=cancel;Issuer=taevi;Station=10.62.54.220;File=ehenderi;Safe=pidatat;Location=gni;Category=tquiinea;RequestId=mquaera;Reason=dun;Severity=medium;SourceUser=Duisau;TargetUser=psum;GatewayStation=10.57.40.29;TicketID=undeo;PolicyID=loremip;UserName=rnatura;LogonDomain=isqu7224.localdomain;Address=idolores3839.localdomain;CPMStatus=metcon;Port=2424;Database=emeumfug;DeviceType=upta;ExtraDetails=omn;", + "file.directory": "gni", + "file.name": "ehenderi", + "fileset.name": "corepas", + "group.name": "Duisau", + "host.ip": "10.62.54.220", + "input.type": "log", + "log.level": "medium", + "log.offset": 3831, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5529", + "related.ip": [ + "10.57.40.29", + "10.62.54.220" + ], + "related.user": [ + "rnatura", + "taevi", + "psum" + ], + "rsa.db.database": "emeumfug", + "rsa.db.index": "omn", + "rsa.internal.event_desc": "dun", + "rsa.internal.messageid": "144", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "tquiinea", + "rsa.misc.disposition": "metcon", + "rsa.misc.group": "Duisau", + "rsa.misc.group_object": "pidatat", + "rsa.misc.obj_type": "upta", + "rsa.misc.operation_id": "undeo", + "rsa.misc.policy_name": "loremip", + "rsa.misc.reference_id": "144", + "rsa.misc.reference_id1": "mquaera", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5529", + "rsa.network.domain": "isqu7224.localdomain", + "rsa.network.host_dst": "idolores3839.localdomain", + "server.domain": "isqu7224.localdomain", + "service.type": "cyberark", + "source.ip": [ + "10.57.40.29" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "taevi" + }, + { + "event.action": "cancel", + "event.code": "nibus", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "ons 2016-06-05 21:33:08.072538723 +0000 UTC tessec3539.home %CYBERARK: MessageID=\"240\";nsect 1.6476\",ProductAccount=\"tnon\",ProductProcess=\"ionul\",EventId=\"nibus\",EventClass=\"edquiano\",EventSeverity=\"medium\",EventMessage=\"cancel\",ActingUserName=\"ema\",ActingAddress=\"10.74.237.180\",ActionSourceUser=\"nsequu\",ActionTargetUser=\"cup\",ActionObject=\"boNemoen\",ActionSafe=\"uid\",ActionLocation=\"rors\",ActionCategory=\"onofd\",ActionRequestId=\"taed\",ActionReason=\"lup\",ActionExtraDetails=\"remeumf\"", + "file.directory": "rors", + "file.name": "boNemoen", + "fileset.name": "corepas", + "host.ip": "10.74.237.180", + "input.type": "log", + "log.level": "medium", + "log.offset": 4349, + "observer.product": "nsect", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6476", + "related.ip": [ + "10.74.237.180" + ], + "related.user": [ + "ema", + "cup", + "tnon" + ], + "rsa.db.index": "remeumf", + "rsa.internal.event_desc": "lup", + "rsa.internal.messageid": "240", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "onofd", + "rsa.misc.group_object": "uid", + "rsa.misc.reference_id": "nibus", + "rsa.misc.reference_id1": "taed", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6476", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ema" + }, + { + "event.action": "allow", + "event.code": "ido", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2016-06-20 04:35:42.332538723 +0000 UTC sectetur3333.mail.example %CYBERARK: MessageID=\"61\";edqui 1.7780\",ProductAccount=\"lor\",ProductProcess=\"fugit\",EventId=\"ido\",EventClass=\"paqu\",EventSeverity=\"high\",EventMessage=\"allow\",ActingUserName=\"remeum\",ActingAddress=\"10.18.165.35\",ActionSourceUser=\"admi\",ActionTargetUser=\"modocons\",ActionObject=\"elaudant\",ActionSafe=\"tinvol\",ActionLocation=\"dolore\",ActionCategory=\"abor\",ActionRequestId=\"iqui\",ActionReason=\"etc\",ActionExtraDetails=\"etM\"", + "file.directory": "dolore", + "file.name": "elaudant", + "fileset.name": "corepas", + "host.ip": "10.18.165.35", + "input.type": "log", + "log.level": "high", + "log.offset": 4835, + "observer.product": "edqui", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7780", + "related.ip": [ + "10.18.165.35" + ], + "related.user": [ + "lor", + "modocons", + "remeum" + ], + "rsa.db.index": "etM", + "rsa.internal.event_desc": "etc", + "rsa.internal.messageid": "61", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "abor", + "rsa.misc.group_object": "tinvol", + "rsa.misc.reference_id": "ido", + "rsa.misc.reference_id1": "iqui", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.7780", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "remeum" + }, + { + "event.action": "deny", + "event.code": "itaut", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2016-07-04 11:38:16.592538723 +0000 UTC xercitat4824.local %CYBERARK: MessageID=\"90\";ostr 1.4979\",ProductAccount=\"onproide\",ProductProcess=\"luptat\",EventId=\"itaut\",EventClass=\"imaven\",EventSeverity=\"high\",EventMessage=\"deny\",ActingUserName=\"tema\",ActingAddress=\"10.74.253.127\",ActionSourceUser=\"tfug\",ActionTargetUser=\"icab\",ActionObject=\"mwr\",ActionSafe=\"fugi\",ActionLocation=\"inculpaq\",ActionCategory=\"agna\",ActionRequestId=\"tionemu\",ActionReason=\"eomnisis\",ActionExtraDetails=\"mqui\"", + "file.directory": "inculpaq", + "file.name": "mwr", + "fileset.name": "corepas", + "host.ip": "10.74.253.127", + "input.type": "log", + "log.level": "high", + "log.offset": 5321, + "observer.product": "ostr", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4979", + "related.ip": [ + "10.74.253.127" + ], + "related.user": [ + "tema", + "onproide", + "icab" + ], + "rsa.db.index": "mqui", + "rsa.internal.event_desc": "eomnisis", + "rsa.internal.messageid": "90", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "agna", + "rsa.misc.group_object": "fugi", + "rsa.misc.reference_id": "itaut", + "rsa.misc.reference_id1": "tionemu", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4979", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tema" + }, + { + "destination.address": "Lor5841.internal.example", + "destination.port": 3075, + "event.action": "block", + "event.code": "385", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "errorsi 2016-07-18 18:40:50.852538723 +0000 UTC des5377.lan %CYBERARK: MessageID=\"385\";Version=1.1697;Message=block;Issuer=ono;Station=10.189.109.245;File=emaperi;Safe=tame;Location=\"tinvol\";Category=tectobe;RequestId=colabor;Reason=iusmodt;Severity=medium;GatewayStation=10.92.8.15;TicketID=agnaali;PolicyID=llitani;UserName=inima;LogonDomain=tlabo6088.www.localdomain;Address=Lor5841.internal.example;CPMStatus=sunt;Port=\"3075\";Database=uines;DeviceType=nsec;ExtraDetails=onse", + "file.directory": "tinvol", + "file.name": "emaperi", + "fileset.name": "corepas", + "host.ip": "10.189.109.245", + "input.type": "log", + "log.level": "medium", + "log.offset": 5807, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1697", + "related.ip": [ + "10.189.109.245", + "10.92.8.15" + ], + "related.user": [ + "inima", + "ono" + ], + "rsa.db.database": "uines", + "rsa.db.index": "onse", + "rsa.internal.event_desc": "iusmodt", + "rsa.internal.messageid": "385", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "tectobe", + "rsa.misc.disposition": "sunt", + "rsa.misc.group_object": "tame", + "rsa.misc.obj_type": "nsec", + "rsa.misc.operation_id": "agnaali", + "rsa.misc.policy_name": "llitani", + "rsa.misc.reference_id": "385", + "rsa.misc.reference_id1": "colabor", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.1697", + "rsa.network.domain": "tlabo6088.www.localdomain", + "rsa.network.host_dst": "Lor5841.internal.example", + "server.domain": "tlabo6088.www.localdomain", + "service.type": "cyberark", + "source.ip": [ + "10.92.8.15" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ono" + }, + { + "event.action": "accept", + "event.code": "tisetq", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "August 2 01:43:25 tat %CYBERARK: MessageID=\"190\";tion 1.1761\",ProductAccount=\"upt\",ProductProcess=\"uiineavo\",EventId=\"tisetq\",EventClass=\"irati\",EventSeverity=\"low\",EventMessage=\"accept\",ActingUserName=\"giatquov\",ActingAddress=\"10.21.78.128\",ActionSourceUser=\"riat\",ActionTargetUser=\"taut\",ActionObject=\"oreseos\",ActionSafe=\"uames\",ActionLocation=\"tati\",ActionCategory=\"utaliqu\",ActionRequestId=\"oriosamn\",ActionReason=\"deFinibu\",ActionExtraDetails=\"iadese\"", + "file.directory": "tati", + "file.name": "oreseos", + "fileset.name": "corepas", + "host.ip": "10.21.78.128", + "input.type": "log", + "log.level": "low", + "log.offset": 6286, + "observer.product": "tion", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1761", + "related.ip": [ + "10.21.78.128" + ], + "related.user": [ + "taut", + "upt", + "giatquov" + ], + "rsa.db.index": "iadese", + "rsa.internal.event_desc": "deFinibu", + "rsa.internal.messageid": "190", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "utaliqu", + "rsa.misc.group_object": "uames", + "rsa.misc.reference_id": "tisetq", + "rsa.misc.reference_id1": "oriosamn", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.1761", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "giatquov" + }, + { + "event.action": "deny", + "event.code": "suntinc", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"256\";eporroqu 1.4200\",ProductAccount=\"hil\",ProductProcess=\"atquovo\",EventId=\"suntinc\",EventClass=\"xeac\",EventSeverity=\"medium\",EventMessage=\"deny\",ActingUserName=\"tatn\",ActingAddress=\"10.18.109.121\",ActionSourceUser=\"ents\",ActionTargetUser=\"pida\",ActionObject=\"nse\",ActionSafe=\"sinto\",ActionLocation=\"emoeni\",ActionCategory=\"oenimips\",ActionRequestId=\"utlabore\",ActionReason=\"ecillu\",ActionExtraDetails=\"quip\"", + "file.directory": "emoeni", + "file.name": "nse", + "fileset.name": "corepas", + "host.ip": "10.18.109.121", + "input.type": "log", + "log.level": "medium", + "log.offset": 6744, + "observer.product": "eporroqu", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4200", + "related.ip": [ + "10.18.109.121" + ], + "related.user": [ + "pida", + "tatn", + "hil" + ], + "rsa.db.index": "quip", + "rsa.internal.event_desc": "ecillu", + "rsa.internal.messageid": "256", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "oenimips", + "rsa.misc.group_object": "sinto", + "rsa.misc.reference_id": "suntinc", + "rsa.misc.reference_id1": "utlabore", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.4200", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tatn" + }, + { + "destination.address": "rpo79.mail.example", + "destination.port": 2289, + "event.action": "cancel", + "event.code": "105", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"105\";Version=1.3727;Message=cancel;Issuer=iunt;Station=10.63.37.192;File=tio;Safe=orinrepr;Location=conse;Category=rumetM;RequestId=equi;Reason=agnaali;Severity=medium;SourceUser=sitvolup;TargetUser=reetd;GatewayStation=10.225.115.13;TicketID=maccusa;PolicyID=uptat;UserName=equep;LogonDomain=iavolu5352.localhost;Address=rpo79.mail.example;CPMStatus=siarchi;Port=2289;Database=aliqu;DeviceType=olupta;ExtraDetails=mipsumd;", + "file.directory": "conse", + "file.name": "tio", + "fileset.name": "corepas", + "group.name": "sitvolup", + "host.ip": "10.63.37.192", + "input.type": "log", + "log.level": "medium", + "log.offset": 7176, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3727", + "related.ip": [ + "10.63.37.192", + "10.225.115.13" + ], + "related.user": [ + "reetd", + "iunt", + "equep" + ], + "rsa.db.database": "aliqu", + "rsa.db.index": "mipsumd", + "rsa.internal.event_desc": "agnaali", + "rsa.internal.messageid": "105", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "rumetM", + "rsa.misc.disposition": "siarchi", + "rsa.misc.group": "sitvolup", + "rsa.misc.group_object": "orinrepr", + "rsa.misc.obj_type": "olupta", + "rsa.misc.operation_id": "maccusa", + "rsa.misc.policy_name": "uptat", + "rsa.misc.reference_id": "105", + "rsa.misc.reference_id1": "equi", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3727", + "rsa.network.domain": "iavolu5352.localhost", + "rsa.network.host_dst": "rpo79.mail.example", + "server.domain": "iavolu5352.localhost", + "service.type": "cyberark", + "source.ip": [ + "10.225.115.13" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "iunt" + }, + { + "destination.address": "tionof7613.domain", + "destination.port": 2335, + "event.action": "deny", + "event.code": "105", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "remi 2016-09-13 22:51:07.892538723 +0000 UTC saute7154.internal.lan %CYBERARK: MessageID=\"105\";Version=1.3219;Message=deny;Issuer=run;Station=10.47.202.102;File=quirat;Safe=llu;Location=licab;Category=eirure;RequestId=conseq;Reason=oidentsu;Severity=medium;SourceUser=aaliquaU;TargetUser=ntor;GatewayStation=10.95.64.124;TicketID=psaquae;PolicyID=ationemu;UserName=ice;LogonDomain=estiae3750.api.corp;Address=tionof7613.domain;CPMStatus=lapari;Port=2335;Database=ite;DeviceType=ationul;ExtraDetails=iquipex;", + "file.directory": "licab", + "file.name": "quirat", + "fileset.name": "corepas", + "group.name": "aaliquaU", + "host.ip": "10.47.202.102", + "input.type": "log", + "log.level": "medium", + "log.offset": 7622, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3219", + "related.ip": [ + "10.95.64.124", + "10.47.202.102" + ], + "related.user": [ + "run", + "ice", + "ntor" + ], + "rsa.db.database": "ite", + "rsa.db.index": "iquipex", + "rsa.internal.event_desc": "oidentsu", + "rsa.internal.messageid": "105", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "eirure", + "rsa.misc.disposition": "lapari", + "rsa.misc.group": "aaliquaU", + "rsa.misc.group_object": "llu", + "rsa.misc.obj_type": "ationul", + "rsa.misc.operation_id": "psaquae", + "rsa.misc.policy_name": "ationemu", + "rsa.misc.reference_id": "105", + "rsa.misc.reference_id1": "conseq", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3219", + "rsa.network.domain": "estiae3750.api.corp", + "rsa.network.host_dst": "tionof7613.domain", + "server.domain": "estiae3750.api.corp", + "service.type": "cyberark", + "source.ip": [ + "10.95.64.124" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "run" + }, + { + "destination.address": "acc7692.home", + "destination.port": 4147, + "event.action": "block", + "event.code": "376", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "adol 2016-09-28 05:53:42.152538723 +0000 UTC doloremi7402.www.test %CYBERARK: MessageID=\"376\";Version=1.6371;Message=block;Issuer=itquiin;Station=10.106.239.55;File=taevit;Safe=rinrepre;Location=etconse;Category=tincu;RequestId=ari;Reason=exercit;Severity=low;GatewayStation=10.244.114.61;TicketID=oluptate;PolicyID=onseq;UserName=serunt;LogonDomain=aquaeabi7735.internal.lan;Address=acc7692.home;CPMStatus=amest;Port=\"4147\";Database=itame;DeviceType=intoc;ExtraDetails=oluptas;", + "file.directory": "etconse", + "file.name": "taevit", + "fileset.name": "corepas", + "host.ip": "10.106.239.55", + "input.type": "log", + "log.level": "low", + "log.offset": 8130, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6371", + "related.ip": [ + "10.244.114.61", + "10.106.239.55" + ], + "related.user": [ + "serunt", + "itquiin" + ], + "rsa.db.database": "itame", + "rsa.db.index": "oluptas", + "rsa.internal.event_desc": "exercit", + "rsa.internal.messageid": "376", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "tincu", + "rsa.misc.disposition": "amest", + "rsa.misc.group_object": "rinrepre", + "rsa.misc.obj_type": "intoc", + "rsa.misc.operation_id": "oluptate", + "rsa.misc.policy_name": "onseq", + "rsa.misc.reference_id": "376", + "rsa.misc.reference_id1": "ari", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.6371", + "rsa.network.domain": "aquaeabi7735.internal.lan", + "rsa.network.host_dst": "acc7692.home", + "server.domain": "aquaeabi7735.internal.lan", + "service.type": "cyberark", + "source.ip": [ + "10.244.114.61" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "itquiin" + }, + { + "destination.address": "quatD4191.local", + "destination.port": 5685, + "event.action": "allow", + "event.code": "24", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2016-10-12 12:56:16.412538723 +0000 UTC luptasn2126.mail.home %CYBERARK: MessageID=\"24\";Version=1.821;Message=allow;Issuer=ione;Station=10.125.160.129;File=suntexp;Safe=duntut;Location=magni;Category=pisciv;RequestId=iquidex;Reason=radipisc;Severity=low;SourceUser=nti;TargetUser=abi;GatewayStation=10.53.168.235;TicketID=fugitse;PolicyID=veniamq;UserName=one;LogonDomain=etMalor4236.www5.host;Address=quatD4191.local;CPMStatus=tenima;Port=5685;Database=sperna;DeviceType=eabilloi;ExtraDetails=estia;", + "file.directory": "magni", + "file.name": "suntexp", + "fileset.name": "corepas", + "group.name": "nti", + "host.ip": "10.125.160.129", + "input.type": "log", + "log.level": "low", + "log.offset": 8609, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.821", + "related.ip": [ + "10.125.160.129", + "10.53.168.235" + ], + "related.user": [ + "one", + "abi", + "ione" + ], + "rsa.db.database": "sperna", + "rsa.db.index": "estia", + "rsa.internal.event_desc": "radipisc", + "rsa.internal.messageid": "24", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "pisciv", + "rsa.misc.disposition": "tenima", + "rsa.misc.group": "nti", + "rsa.misc.group_object": "duntut", + "rsa.misc.obj_type": "eabilloi", + "rsa.misc.operation_id": "fugitse", + "rsa.misc.policy_name": "veniamq", + "rsa.misc.reference_id": "24", + "rsa.misc.reference_id1": "iquidex", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.821", + "rsa.network.domain": "etMalor4236.www5.host", + "rsa.network.host_dst": "quatD4191.local", + "server.domain": "etMalor4236.www5.host", + "service.type": "cyberark", + "source.ip": [ + "10.53.168.235" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ione" + }, + { + "destination.address": "eturadi6608.mail.host", + "destination.port": 3366, + "event.action": "allow", + "event.code": "197", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "orem 2016-10-26 19:58:50.672538723 +0000 UTC beata6448.mail.test %CYBERARK: MessageID=\"197\";Version=1.1123;Message=allow;Issuer=tasuntex;Station=10.227.177.121;File=boN;Safe=eprehend;Location=aevit;Category=aboN;RequestId=ihilmo;Reason=radi;Severity=low;SourceUser=uames;TargetUser=iduntu;GatewayStation=10.33.245.220;TicketID=giatnu;PolicyID=ulapa;UserName=liqui;LogonDomain=quioffi1359.internal.lan;Address=eturadi6608.mail.host;CPMStatus=aera;Port=3366;Database=rvel;DeviceType=uid;ExtraDetails=onsecte;", + "file.directory": "aevit", + "file.name": "boN", + "fileset.name": "corepas", + "group.name": "uames", + "host.ip": "10.227.177.121", + "input.type": "log", + "log.level": "low", + "log.offset": 9110, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1123", + "related.ip": [ + "10.227.177.121", + "10.33.245.220" + ], + "related.user": [ + "liqui", + "tasuntex", + "iduntu" + ], + "rsa.db.database": "rvel", + "rsa.db.index": "onsecte", + "rsa.internal.event_desc": "radi", + "rsa.internal.messageid": "197", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "aboN", + "rsa.misc.disposition": "aera", + "rsa.misc.group": "uames", + "rsa.misc.group_object": "eprehend", + "rsa.misc.obj_type": "uid", + "rsa.misc.operation_id": "giatnu", + "rsa.misc.policy_name": "ulapa", + "rsa.misc.reference_id": "197", + "rsa.misc.reference_id1": "ihilmo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.1123", + "rsa.network.domain": "quioffi1359.internal.lan", + "rsa.network.host_dst": "eturadi6608.mail.host", + "server.domain": "quioffi1359.internal.lan", + "service.type": "cyberark", + "source.ip": [ + "10.33.245.220" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tasuntex" + }, + { + "destination.address": "eroi176.example", + "destination.port": 3341, + "event.action": "allow", + "event.code": "411", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "November 10 03:01:24 edo %CYBERARK: MessageID=\"411\";Version=1.5071;Message=allow;Issuer=econs;Station=\"10.98.182.220\";File=\"untex\";Safe=\"quiratio\";Location=\"boree\";Category=\"eco\";RequestId=Utenimad;Reason=orpor;Severity=\"low\";GatewayStation=\"10.167.85.181\";TicketID=emvel;PolicyID=\"tmollita\";UserName=fde;LogonDomain=\"nsecte3304.mail.corp\";Address=\"eroi176.example\";CPMStatus=\"non\";Port=\"3341\";Database=equat;DeviceType=derit;ExtraDetails=\"Command=dexea;ConnectionComponentId=atcu;DstHost=labor;ProcessId=6501;ProcessName=laboree.exe;Protocol=tcp;PSMID=intocc;RDPOffset=liqu;SessionID=eporr;SrcHost=xeacomm6855.api.corp;User=utlabor;VIDOffset=rau;\"", + "file.directory": "boree", + "file.name": "untex", + "fileset.name": "corepas", + "host.hostname": "xeacomm6855.api.corp", + "host.ip": "10.98.182.220", + "input.type": "log", + "log.level": "low", + "log.offset": 9617, + "network.protocol": "tcp", + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5071", + "process.name": "laboree.exe", + "process.pid": 6501, + "related.ip": [ + "10.167.85.181", + "10.98.182.220" + ], + "related.user": [ + "econs", + "fde" + ], + "rsa.db.database": "equat", + "rsa.internal.event_desc": "orpor", + "rsa.internal.messageid": "411", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "eco", + "rsa.misc.disposition": "non", + "rsa.misc.group_object": "quiratio", + "rsa.misc.log_session_id": "eporr", + "rsa.misc.obj_type": "derit", + "rsa.misc.operation_id": "emvel", + "rsa.misc.param": "dexea", + "rsa.misc.policy_name": "tmollita", + "rsa.misc.reference_id": "411", + "rsa.misc.reference_id1": "Utenimad", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.5071", + "rsa.network.domain": "nsecte3304.mail.corp", + "rsa.network.host_dst": "eroi176.example", + "server.domain": "nsecte3304.mail.corp", + "service.type": "cyberark", + "source.address": "xeacomm6855.api.corp", + "source.ip": [ + "10.167.85.181" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "econs" + }, + { + "event.action": "block", + "event.code": "tessec", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "November 24 10:03:59 aeabi %CYBERARK: MessageID=\"111\";eiu 1.4456\",ProductAccount=\"iciadese\",ProductProcess=\"quidolor\",EventId=\"tessec\",EventClass=\"olupta\",EventSeverity=\"high\",EventMessage=\"block\",ActingUserName=\"icabo\",ActingAddress=\"10.89.208.95\",ActionSourceUser=\"eleum\",ActionTargetUser=\"sintoc\",ActionObject=\"volupt\",ActionSafe=\"siste\",ActionLocation=\"uiinea\",ActionCategory=\"Utenima\",ActionRequestId=\"volupta\",ActionReason=\"rcitati\",ActionExtraDetails=\"eni\"", + "file.directory": "uiinea", + "file.name": "volupt", + "fileset.name": "corepas", + "host.ip": "10.89.208.95", + "input.type": "log", + "log.level": "high", + "log.offset": 10266, + "observer.product": "eiu", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4456", + "related.ip": [ + "10.89.208.95" + ], + "related.user": [ + "iciadese", + "icabo", + "sintoc" + ], + "rsa.db.index": "eni", + "rsa.internal.event_desc": "rcitati", + "rsa.internal.messageid": "111", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "Utenima", + "rsa.misc.group_object": "siste", + "rsa.misc.reference_id": "tessec", + "rsa.misc.reference_id1": "volupta", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4456", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "icabo" + }, + { + "destination.address": "reetdolo6852.www.test", + "destination.port": 5428, + "event.action": "accept", + "event.code": "81", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "Ute 2016-12-08 17:06:33.452538723 +0000 UTC sperna5368.mail.invalid %CYBERARK: MessageID=\"81\";Version=1.509;Message=accept;Issuer=tDuisaut;Station=10.214.191.180;File=imvenia;Safe=spi;Location=stquido;Category=ommodico;RequestId=ptas;Reason=pta;Severity=medium;SourceUser=ptatemq;TargetUser=luptatev;GatewayStation=10.72.148.32;TicketID=ipsumd;PolicyID=ntocc;UserName=uteirure;LogonDomain=nevo4284.internal.local;Address=reetdolo6852.www.test;CPMStatus=nnum;Port=5428;Database=uamest;DeviceType=tco;ExtraDetails=uae;", + "file.directory": "stquido", + "file.name": "imvenia", + "fileset.name": "corepas", + "group.name": "ptatemq", + "host.ip": "10.214.191.180", + "input.type": "log", + "log.level": "medium", + "log.offset": 10730, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.509", + "related.ip": [ + "10.72.148.32", + "10.214.191.180" + ], + "related.user": [ + "tDuisaut", + "luptatev", + "uteirure" + ], + "rsa.db.database": "uamest", + "rsa.db.index": "uae", + "rsa.internal.event_desc": "pta", + "rsa.internal.messageid": "81", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "ommodico", + "rsa.misc.disposition": "nnum", + "rsa.misc.group": "ptatemq", + "rsa.misc.group_object": "spi", + "rsa.misc.obj_type": "tco", + "rsa.misc.operation_id": "ipsumd", + "rsa.misc.policy_name": "ntocc", + "rsa.misc.reference_id": "81", + "rsa.misc.reference_id1": "ptas", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.509", + "rsa.network.domain": "nevo4284.internal.local", + "rsa.network.host_dst": "reetdolo6852.www.test", + "server.domain": "nevo4284.internal.local", + "service.type": "cyberark", + "source.ip": [ + "10.72.148.32" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tDuisaut" + }, + { + "destination.address": "mporin6932.api.localdomain", + "destination.port": 6604, + "event.action": "block", + "event.code": "168", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"168\";Version=1.3599;Message=block;Issuer=ipsumd;Station=10.136.190.236;File=evolu;Safe=ersp;Location=tquov;Category=diconseq;RequestId=inven;Reason=osquira;Severity=low;SourceUser=ataevi;TargetUser=com;GatewayStation=10.252.124.150;TicketID=trud;PolicyID=eriti;UserName=litessec;LogonDomain=itas981.mail.domain;Address=mporin6932.api.localdomain;CPMStatus=roid;Port=6604;Database=tasn;DeviceType=Nemoenim;ExtraDetails=squirati;", + "file.directory": "tquov", + "file.name": "evolu", + "fileset.name": "corepas", + "group.name": "ataevi", + "host.ip": "10.136.190.236", + "input.type": "log", + "log.level": "low", + "log.offset": 11247, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3599", + "related.ip": [ + "10.136.190.236", + "10.252.124.150" + ], + "related.user": [ + "ipsumd", + "litessec", + "com" + ], + "rsa.db.database": "tasn", + "rsa.db.index": "squirati", + "rsa.internal.event_desc": "osquira", + "rsa.internal.messageid": "168", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "diconseq", + "rsa.misc.disposition": "roid", + "rsa.misc.group": "ataevi", + "rsa.misc.group_object": "ersp", + "rsa.misc.obj_type": "Nemoenim", + "rsa.misc.operation_id": "trud", + "rsa.misc.policy_name": "eriti", + "rsa.misc.reference_id": "168", + "rsa.misc.reference_id1": "inven", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3599", + "rsa.network.domain": "itas981.mail.domain", + "rsa.network.host_dst": "mporin6932.api.localdomain", + "server.domain": "itas981.mail.domain", + "service.type": "cyberark", + "source.ip": [ + "10.252.124.150" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ipsumd" + }, + { + "destination.address": "illoin2914.mail.lan", + "destination.port": 6895, + "event.action": "accept", + "event.code": "90", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "nbyCic 2017-01-06 07:11:41.972538723 +0000 UTC utlabor6305.internal.corp %CYBERARK: MessageID=\"90\";Version=1.5649;Message=accept;Issuer=iquipe;Station=10.192.34.76;File=modtemp;Safe=quovol;Location=nve;Category=remag;RequestId=uredol;Reason=ccaecat;Severity=medium;SourceUser=onsequ;TargetUser=temqu;GatewayStation=10.213.144.249;TicketID=udexerci;PolicyID=naal;UserName=lore;LogonDomain=tnonpro7635.localdomain;Address=illoin2914.mail.lan;CPMStatus=uamni;Port=6895;Database=gnamal;DeviceType=metMalo;ExtraDetails=ntexplic;", + "file.directory": "nve", + "file.name": "modtemp", + "fileset.name": "corepas", + "group.name": "onsequ", + "host.ip": "10.192.34.76", + "input.type": "log", + "log.level": "medium", + "log.offset": 11697, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5649", + "related.ip": [ + "10.213.144.249", + "10.192.34.76" + ], + "related.user": [ + "iquipe", + "temqu", + "lore" + ], + "rsa.db.database": "gnamal", + "rsa.db.index": "ntexplic", + "rsa.internal.event_desc": "ccaecat", + "rsa.internal.messageid": "90", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "remag", + "rsa.misc.disposition": "uamni", + "rsa.misc.group": "onsequ", + "rsa.misc.group_object": "quovol", + "rsa.misc.obj_type": "metMalo", + "rsa.misc.operation_id": "udexerci", + "rsa.misc.policy_name": "naal", + "rsa.misc.reference_id": "90", + "rsa.misc.reference_id1": "uredol", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5649", + "rsa.network.domain": "tnonpro7635.localdomain", + "rsa.network.host_dst": "illoin2914.mail.lan", + "server.domain": "tnonpro7635.localdomain", + "service.type": "cyberark", + "source.ip": [ + "10.213.144.249" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "iquipe" + }, + { + "destination.address": "evit5780.www.corp", + "destination.port": 725, + "event.action": "accept", + "event.code": "376", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"376\";Version=1.2217;Message=accept;Issuer=untu;Station=10.154.4.197;File=con;Safe=nisist;Location=usmodte;Category=msequi;RequestId=tau;Reason=exercita;Severity=low;GatewayStation=10.216.84.30;TicketID=orumSe;PolicyID=boree;UserName=intoc;LogonDomain=rQuisau5300.www5.example;Address=evit5780.www.corp;CPMStatus=onev;Port=\"725\";Database=oditem;DeviceType=gitsedqu;ExtraDetails=borios;", + "file.directory": "usmodte", + "file.name": "con", + "fileset.name": "corepas", + "host.ip": "10.154.4.197", + "input.type": "log", + "log.level": "low", + "log.offset": 12221, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2217", + "related.ip": [ + "10.216.84.30", + "10.154.4.197" + ], + "related.user": [ + "untu", + "intoc" + ], + "rsa.db.database": "oditem", + "rsa.db.index": "borios", + "rsa.internal.event_desc": "exercita", + "rsa.internal.messageid": "376", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "msequi", + "rsa.misc.disposition": "onev", + "rsa.misc.group_object": "nisist", + "rsa.misc.obj_type": "gitsedqu", + "rsa.misc.operation_id": "orumSe", + "rsa.misc.policy_name": "boree", + "rsa.misc.reference_id": "376", + "rsa.misc.reference_id1": "tau", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2217", + "rsa.network.domain": "rQuisau5300.www5.example", + "rsa.network.host_dst": "evit5780.www.corp", + "server.domain": "rQuisau5300.www5.example", + "service.type": "cyberark", + "source.ip": [ + "10.216.84.30" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "untu" + }, + { + "event.action": "deny", + "event.code": "ess", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-02-03 21:16:50.492538723 +0000 UTC temUt631.www5.example %CYBERARK: MessageID=\"3\";npr 1.4414\",ProductAccount=\"niamqui\",ProductProcess=\"boNem\",EventId=\"ess\",EventClass=\"ipisci\",EventSeverity=\"medium\",EventMessage=\"deny\",ActingUserName=\"tqu\",ActingAddress=\"10.143.193.199\",ActionSourceUser=\"quam\",ActionTargetUser=\"quid\",ActionObject=\"fugiat\",ActionSafe=\"atisun\",ActionLocation=\"esci\",ActionCategory=\"epre\",ActionRequestId=\"tobeata\",ActionReason=\"eroinBCS\",ActionExtraDetails=\"inci\"", + "file.directory": "esci", + "file.name": "fugiat", + "fileset.name": "corepas", + "host.ip": "10.143.193.199", + "input.type": "log", + "log.level": "medium", + "log.offset": 12628, + "observer.product": "npr", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4414", + "related.ip": [ + "10.143.193.199" + ], + "related.user": [ + "tqu", + "niamqui", + "quid" + ], + "rsa.db.index": "inci", + "rsa.internal.event_desc": "eroinBCS", + "rsa.internal.messageid": "3", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "epre", + "rsa.misc.group_object": "atisun", + "rsa.misc.reference_id": "ess", + "rsa.misc.reference_id1": "tobeata", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.4414", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tqu" + }, + { + "destination.address": "uisa5736.internal.local", + "destination.port": 302, + "event.action": "deny", + "event.code": "140", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "February 18 04:19:24 rnatur %CYBERARK: MessageID=\"140\";Version=1.5632;Message=deny;Issuer=essequam;Station=10.193.83.81;File=isisten;Safe=cusant;Location=atemq;Category=rinre;RequestId=naal;Reason=borios;Severity=high;SourceUser=isnostr;TargetUser=umqu;GatewayStation=10.65.175.9;TicketID=inesci;PolicyID=isnisi;UserName=ritatise;LogonDomain=uamei2389.internal.example;Address=uisa5736.internal.local;CPMStatus=cusant;Port=302;Database=ender;DeviceType=riamea;ExtraDetails=entorev;", + "file.directory": "atemq", + "file.name": "isisten", + "fileset.name": "corepas", + "group.name": "isnostr", + "host.ip": "10.193.83.81", + "input.type": "log", + "log.level": "high", + "log.offset": 13114, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5632", + "related.ip": [ + "10.193.83.81", + "10.65.175.9" + ], + "related.user": [ + "ritatise", + "essequam", + "umqu" + ], + "rsa.db.database": "ender", + "rsa.db.index": "entorev", + "rsa.internal.event_desc": "borios", + "rsa.internal.messageid": "140", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "rinre", + "rsa.misc.disposition": "cusant", + "rsa.misc.group": "isnostr", + "rsa.misc.group_object": "cusant", + "rsa.misc.obj_type": "riamea", + "rsa.misc.operation_id": "inesci", + "rsa.misc.policy_name": "isnisi", + "rsa.misc.reference_id": "140", + "rsa.misc.reference_id1": "naal", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5632", + "rsa.network.domain": "uamei2389.internal.example", + "rsa.network.host_dst": "uisa5736.internal.local", + "server.domain": "uamei2389.internal.example", + "service.type": "cyberark", + "source.ip": [ + "10.65.175.9" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "essequam" + }, + { + "event.action": "accept", + "event.code": "sau", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"87\";tutlab 1.792\",ProductAccount=\"tatn\",ProductProcess=\"dolorsit\",EventId=\"sau\",EventClass=\"aperia\",EventSeverity=\"very-high\",EventMessage=\"accept\",ActingUserName=\"umdolo\",ActingAddress=\"10.205.72.243\",ActionSourceUser=\"stenatu\",ActionTargetUser=\"isiuta\",ActionObject=\"orsitam\",ActionSafe=\"siutaliq\",ActionLocation=\"dutp\",ActionCategory=\"psaquaea\",ActionRequestId=\"taevita\",ActionReason=\"ameiusm\",ActionExtraDetails=\"proide\"", + "file.directory": "dutp", + "file.name": "orsitam", + "fileset.name": "corepas", + "host.ip": "10.205.72.243", + "input.type": "log", + "log.level": "very-high", + "log.offset": 13596, + "observer.product": "tutlab", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.792", + "related.ip": [ + "10.205.72.243" + ], + "related.user": [ + "isiuta", + "umdolo", + "tatn" + ], + "rsa.db.index": "proide", + "rsa.internal.event_desc": "ameiusm", + "rsa.internal.messageid": "87", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "psaquaea", + "rsa.misc.group_object": "siutaliq", + "rsa.misc.reference_id": "sau", + "rsa.misc.reference_id1": "taevita", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.792", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "umdolo" + }, + { + "event.action": "allow", + "event.code": "eumiure", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-03-18 18:24:33.272538723 +0000 UTC velitess7586.mail.example %CYBERARK: MessageID=\"45\";nre 1.7231\",ProductAccount=\"sit\",ProductProcess=\"olab\",EventId=\"eumiure\",EventClass=\"ersp\",EventSeverity=\"medium\",EventMessage=\"allow\",ActingUserName=\"mquisno\",ActingAddress=\"10.107.9.163\",ActionSourceUser=\"uptate\",ActionTargetUser=\"mac\",ActionObject=\"iumdol\",ActionSafe=\"tpersp\",ActionLocation=\"stla\",ActionCategory=\"uptatema\",ActionRequestId=\"oeni\",ActionReason=\"tdol\",ActionExtraDetails=\"sit\"", + "file.directory": "stla", + "file.name": "iumdol", + "fileset.name": "corepas", + "host.ip": "10.107.9.163", + "input.type": "log", + "log.level": "medium", + "log.offset": 14043, + "observer.product": "nre", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7231", + "related.ip": [ + "10.107.9.163" + ], + "related.user": [ + "mac", + "sit", + "mquisno" + ], + "rsa.db.index": "sit", + "rsa.internal.event_desc": "tdol", + "rsa.internal.messageid": "45", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "uptatema", + "rsa.misc.group_object": "tpersp", + "rsa.misc.reference_id": "eumiure", + "rsa.misc.reference_id1": "oeni", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7231", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mquisno" + }, + { + "event.action": "deny", + "event.code": "cinge", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "April 2 01:27:07 psum %CYBERARK: MessageID=\"132\";tasnulap 1.7220\",ProductAccount=\"umSe\",ProductProcess=\"xeacomm\",EventId=\"cinge\",EventClass=\"itla\",EventSeverity=\"high\",EventMessage=\"deny\",ActingUserName=\"asiarc\",ActingAddress=\"10.80.101.72\",ActionSourceUser=\"uptate\",ActionTargetUser=\"quidexea\",ActionObject=\"ect\",ActionSafe=\"modocons\",ActionLocation=\"gitsed\",ActionCategory=\"fugia\",ActionRequestId=\"oditautf\",ActionReason=\"quatu\",ActionExtraDetails=\"veli\"", + "file.directory": "gitsed", + "file.name": "ect", + "fileset.name": "corepas", + "host.ip": "10.80.101.72", + "input.type": "log", + "log.level": "high", + "log.offset": 14531, + "observer.product": "tasnulap", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7220", + "related.ip": [ + "10.80.101.72" + ], + "related.user": [ + "asiarc", + "umSe", + "quidexea" + ], + "rsa.db.index": "veli", + "rsa.internal.event_desc": "quatu", + "rsa.internal.messageid": "132", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "fugia", + "rsa.misc.group_object": "modocons", + "rsa.misc.reference_id": "cinge", + "rsa.misc.reference_id1": "oditautf", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.7220", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "asiarc" + }, + { + "destination.address": "utlab3706.api.host", + "destination.port": 246, + "event.action": "accept", + "event.code": "200", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "April 16 08:29:41 labo %CYBERARK: MessageID=\"200\";Version=1.267;Message=accept;Issuer=aboreetd;Station=10.235.136.109;File=lorin;Safe=pitl;Location=por;Category=quidexea;RequestId=nimid;Reason=runtmol;Severity=very-high;SourceUser=odi;TargetUser=ptass;GatewayStation=10.39.10.155;TicketID=dol;PolicyID=proiden;UserName=urExcept;LogonDomain=miurerep1152.internal.domain;Address=utlab3706.api.host;CPMStatus=dantium;Port=246;Database=teirured;DeviceType=onemulla;ExtraDetails=dolorem;", + "file.directory": "por", + "file.name": "lorin", + "fileset.name": "corepas", + "group.name": "odi", + "host.ip": "10.235.136.109", + "input.type": "log", + "log.level": "very-high", + "log.offset": 14988, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.267", + "related.ip": [ + "10.39.10.155", + "10.235.136.109" + ], + "related.user": [ + "urExcept", + "ptass", + "aboreetd" + ], + "rsa.db.database": "teirured", + "rsa.db.index": "dolorem", + "rsa.internal.event_desc": "runtmol", + "rsa.internal.messageid": "200", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "quidexea", + "rsa.misc.disposition": "dantium", + "rsa.misc.group": "odi", + "rsa.misc.group_object": "pitl", + "rsa.misc.obj_type": "onemulla", + "rsa.misc.operation_id": "dol", + "rsa.misc.policy_name": "proiden", + "rsa.misc.reference_id": "200", + "rsa.misc.reference_id1": "nimid", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.267", + "rsa.network.domain": "miurerep1152.internal.domain", + "rsa.network.host_dst": "utlab3706.api.host", + "server.domain": "miurerep1152.internal.domain", + "service.type": "cyberark", + "source.ip": [ + "10.39.10.155" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "aboreetd" + }, + { + "event.action": "cancel", + "event.code": "nci", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "April 30 15:32:16 ationev %CYBERARK: MessageID=\"233\";umdolor 1.4389\",ProductAccount=\"itation\",ProductProcess=\"paquioff\",EventId=\"nci\",EventClass=\"isau\",EventSeverity=\"low\",EventMessage=\"cancel\",ActingUserName=\"ibusBon\",ActingAddress=\"10.96.224.19\",ActionSourceUser=\"nsequat\",ActionTargetUser=\"doloreme\",ActionObject=\"dun\",ActionSafe=\"reprehe\",ActionLocation=\"tincu\",ActionCategory=\"suntin\",ActionRequestId=\"itse\",ActionReason=\"umexerc\",ActionExtraDetails=\"oremipsu\"", + "file.directory": "tincu", + "file.name": "dun", + "fileset.name": "corepas", + "host.ip": "10.96.224.19", + "input.type": "log", + "log.level": "low", + "log.offset": 15471, + "observer.product": "umdolor", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4389", + "related.ip": [ + "10.96.224.19" + ], + "related.user": [ + "itation", + "ibusBon", + "doloreme" + ], + "rsa.db.index": "oremipsu", + "rsa.internal.event_desc": "umexerc", + "rsa.internal.messageid": "233", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "suntin", + "rsa.misc.group_object": "reprehe", + "rsa.misc.reference_id": "nci", + "rsa.misc.reference_id1": "itse", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4389", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ibusBon" + }, + { + "event.action": "cancel", + "event.code": "iquidexe", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-05-14 22:34:50.312538723 +0000 UTC ntsunt4826.mail.corp %CYBERARK: MessageID=\"170\";olo 1.237\",ProductAccount=\"aec\",ProductProcess=\"fdeF\",EventId=\"iquidexe\",EventClass=\"diconse\",EventSeverity=\"medium\",EventMessage=\"cancel\",ActingUserName=\"reseo\",ActingAddress=\"10.71.238.250\",ActionSourceUser=\"consequa\",ActionTargetUser=\"moenimi\",ActionObject=\"olupt\",ActionSafe=\"oconsequ\",ActionLocation=\"edquiac\",ActionCategory=\"urerepr\",ActionRequestId=\"eseru\",ActionReason=\"quamest\",ActionExtraDetails=\"mac\"", + "file.directory": "edquiac", + "file.name": "olupt", + "fileset.name": "corepas", + "host.ip": "10.71.238.250", + "input.type": "log", + "log.level": "medium", + "log.offset": 15937, + "observer.product": "olo", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.237", + "related.ip": [ + "10.71.238.250" + ], + "related.user": [ + "reseo", + "moenimi", + "aec" + ], + "rsa.db.index": "mac", + "rsa.internal.event_desc": "quamest", + "rsa.internal.messageid": "170", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "urerepr", + "rsa.misc.group_object": "oconsequ", + "rsa.misc.reference_id": "iquidexe", + "rsa.misc.reference_id1": "eseru", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.237", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "reseo" + }, + { + "destination.address": "mvel1188.internal.localdomain", + "destination.port": 2694, + "event.action": "deny", + "event.code": "294", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"294\";Version=1.3804;Message=deny;Issuer=rationev;Station=10.226.20.199;File=tatem;Safe=untutlab;Location=amcor;Category=ica;RequestId=lillum;Reason=remips;Severity=low;SourceUser=taedicta;TargetUser=ritt;GatewayStation=10.226.101.180;TicketID=itesseq;PolicyID=dictasun;UserName=veniamqu;LogonDomain=rum5798.home;Address=mvel1188.internal.localdomain;CPMStatus=tetur;Port=2694;Database=conse;DeviceType=ipi;ExtraDetails=imveniam;", + "file.directory": "amcor", + "file.name": "tatem", + "fileset.name": "corepas", + "group.name": "taedicta", + "host.ip": "10.226.20.199", + "input.type": "log", + "log.level": "low", + "log.offset": 16437, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3804", + "related.ip": [ + "10.226.101.180", + "10.226.20.199" + ], + "related.user": [ + "rationev", + "veniamqu", + "ritt" + ], + "rsa.db.database": "conse", + "rsa.db.index": "imveniam", + "rsa.internal.event_desc": "remips", + "rsa.internal.messageid": "294", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "ica", + "rsa.misc.disposition": "tetur", + "rsa.misc.group": "taedicta", + "rsa.misc.group_object": "untutlab", + "rsa.misc.obj_type": "ipi", + "rsa.misc.operation_id": "itesseq", + "rsa.misc.policy_name": "dictasun", + "rsa.misc.reference_id": "294", + "rsa.misc.reference_id1": "lillum", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3804", + "rsa.network.domain": "rum5798.home", + "rsa.network.host_dst": "mvel1188.internal.localdomain", + "server.domain": "rum5798.home", + "service.type": "cyberark", + "source.ip": [ + "10.226.101.180" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "rationev" + }, + { + "destination.address": "perspici5680.domain", + "destination.port": 2039, + "event.action": "cancel", + "event.code": "13", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "June 12 12:39:58 licabo %CYBERARK: MessageID=\"13\";Version=1.1493;Message=cancel;Issuer=utaliqu;Station=10.86.22.67;File=nvolupt;Safe=oremi;Location=elites;Category=nbyCi;RequestId=tevel;Reason=usc;Severity=high;SourceUser=equinesc;TargetUser=cab;GatewayStation=10.134.65.15;TicketID=equepor;PolicyID=ncidid;UserName=quaUten;LogonDomain=nisiut3624.api.example;Address=perspici5680.domain;CPMStatus=iconseq;Port=2039;Database=isciv;DeviceType=rroqu;ExtraDetails=nofd;", + "event.outcome": "failure", + "file.directory": "elites", + "file.name": "nvolupt", + "fileset.name": "corepas", + "group.name": "equinesc", + "host.ip": "10.86.22.67", + "input.type": "log", + "log.level": "high", + "log.offset": 16888, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1493", + "related.ip": [ + "10.134.65.15", + "10.86.22.67" + ], + "related.user": [ + "utaliqu", + "quaUten", + "cab" + ], + "rsa.db.database": "isciv", + "rsa.db.index": "nofd", + "rsa.internal.event_desc": "usc", + "rsa.internal.messageid": "13", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "nbyCi", + "rsa.misc.disposition": "iconseq", + "rsa.misc.group": "equinesc", + "rsa.misc.group_object": "oremi", + "rsa.misc.obj_type": "rroqu", + "rsa.misc.operation_id": "equepor", + "rsa.misc.policy_name": "ncidid", + "rsa.misc.reference_id": "13", + "rsa.misc.reference_id1": "tevel", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1493", + "rsa.network.domain": "nisiut3624.api.example", + "rsa.network.host_dst": "perspici5680.domain", + "server.domain": "nisiut3624.api.example", + "service.type": "cyberark", + "source.ip": [ + "10.134.65.15" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "utaliqu" + }, + { + "event.action": "accept", + "event.code": "tae", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"358\";ilmol 1.5112\",ProductAccount=\"tten\",ProductProcess=\"ueipsa\",EventId=\"tae\",EventClass=\"autodit\",EventSeverity=\"very-high\",EventMessage=\"accept\",ActingUserName=\"cidunt\",ActingAddress=\"10.70.147.120\",ActionSourceUser=\"exeaco\",ActionTargetUser=\"emqu\",ActionObject=\"nderi\",ActionSafe=\"acommod\",ActionLocation=\"itsedd\",ActionCategory=\"leumiur\",ActionRequestId=\"eratvol\",ActionReason=\"quidol\",ActionExtraDetails=\"eaqu\"", + "file.directory": "itsedd", + "file.name": "nderi", + "fileset.name": "corepas", + "host.ip": "10.70.147.120", + "input.type": "log", + "log.level": "very-high", + "log.offset": 17354, + "observer.product": "ilmol", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5112", + "related.ip": [ + "10.70.147.120" + ], + "related.user": [ + "tten", + "emqu", + "cidunt" + ], + "rsa.db.index": "eaqu", + "rsa.internal.event_desc": "quidol", + "rsa.internal.messageid": "358", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "leumiur", + "rsa.misc.group_object": "acommod", + "rsa.misc.reference_id": "tae", + "rsa.misc.reference_id1": "eratvol", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.5112", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "cidunt" + }, + { + "destination.address": "ptateve6909.www5.lan", + "destination.port": 7645, + "event.action": "cancel", + "event.code": "160", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "luptatem 2017-07-11 02:45:07.352538723 +0000 UTC uaeratv3432.invalid %CYBERARK: MessageID=\"160\";Version=1.6255;Message=cancel;Issuer=dqu;Station=10.178.242.100;File=dutpers;Safe=erun;Location=orisn;Category=reetd;RequestId=prehen;Reason=ntutlabo;Severity=medium;SourceUser=rad;TargetUser=loi;GatewayStation=10.24.111.229;TicketID=volupt;PolicyID=rem;UserName=idid;LogonDomain=tesse1089.www.host;Address=ptateve6909.www5.lan;CPMStatus=toccaec;Port=7645;Database=tenatuse;DeviceType=psaqua;ExtraDetails=ullamcor;", + "file.directory": "orisn", + "file.name": "dutpers", + "fileset.name": "corepas", + "group.name": "rad", + "host.ip": "10.178.242.100", + "input.type": "log", + "log.level": "medium", + "log.offset": 17793, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6255", + "related.ip": [ + "10.24.111.229", + "10.178.242.100" + ], + "related.user": [ + "dqu", + "idid", + "loi" + ], + "rsa.db.database": "tenatuse", + "rsa.db.index": "ullamcor", + "rsa.internal.event_desc": "ntutlabo", + "rsa.internal.messageid": "160", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "reetd", + "rsa.misc.disposition": "toccaec", + "rsa.misc.group": "rad", + "rsa.misc.group_object": "erun", + "rsa.misc.obj_type": "psaqua", + "rsa.misc.operation_id": "volupt", + "rsa.misc.policy_name": "rem", + "rsa.misc.reference_id": "160", + "rsa.misc.reference_id1": "prehen", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6255", + "rsa.network.domain": "tesse1089.www.host", + "rsa.network.host_dst": "ptateve6909.www5.lan", + "server.domain": "tesse1089.www.host", + "service.type": "cyberark", + "source.ip": [ + "10.24.111.229" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "dqu" + }, + { + "event.action": "deny", + "event.code": "ons", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-07-25 09:47:41.612538723 +0000 UTC cupi1867.www5.test %CYBERARK: MessageID=\"67\";orroq 1.6677\",ProductAccount=\"ritati\",ProductProcess=\"orisni\",EventId=\"ons\",EventClass=\"remagn\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"mmodoc\",ActingAddress=\"10.211.179.168\",ActionSourceUser=\"atu\",ActionTargetUser=\"untincul\",ActionObject=\"ssecil\",ActionSafe=\"commodi\",ActionLocation=\"emporain\",ActionCategory=\"ntiumto\",ActionRequestId=\"umetMalo\",ActionReason=\"oluptas\",ActionExtraDetails=\"emvele\"", + "file.directory": "emporain", + "file.name": "ssecil", + "fileset.name": "corepas", + "host.ip": "10.211.179.168", + "input.type": "log", + "log.level": "very-high", + "log.offset": 18304, + "observer.product": "orroq", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6677", + "related.ip": [ + "10.211.179.168" + ], + "related.user": [ + "ritati", + "mmodoc", + "untincul" + ], + "rsa.db.index": "emvele", + "rsa.internal.event_desc": "oluptas", + "rsa.internal.messageid": "67", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "ntiumto", + "rsa.misc.group_object": "commodi", + "rsa.misc.reference_id": "ons", + "rsa.misc.reference_id1": "umetMalo", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6677", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mmodoc" + }, + { + "event.action": "cancel", + "event.code": "olorsi", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "Sedut 2017-08-08 16:50:15.872538723 +0000 UTC yCiceroi2786.www.test %CYBERARK: MessageID=\"141\";iquamqua 1.4890\",ProductAccount=\"dolore\",ProductProcess=\"nsequat\",EventId=\"olorsi\",EventClass=\"aliq\",EventSeverity=\"low\",EventMessage=\"cancel\",ActingUserName=\"mven\",ActingAddress=\"10.30.243.163\",ActionSourceUser=\"oremag\",ActionTargetUser=\"illu\",ActionObject=\"ruredo\",ActionSafe=\"mac\",ActionLocation=\"temUt\",ActionCategory=\"ptassita\",ActionRequestId=\"its\",ActionReason=\"lore\",ActionExtraDetails=\"idol\"", + "file.directory": "temUt", + "file.name": "ruredo", + "fileset.name": "corepas", + "host.ip": "10.30.243.163", + "input.type": "log", + "log.level": "low", + "log.offset": 18809, + "observer.product": "iquamqua", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4890", + "related.ip": [ + "10.30.243.163" + ], + "related.user": [ + "mven", + "dolore", + "illu" + ], + "rsa.db.index": "idol", + "rsa.internal.event_desc": "lore", + "rsa.internal.messageid": "141", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "ptassita", + "rsa.misc.group_object": "mac", + "rsa.misc.reference_id": "olorsi", + "rsa.misc.reference_id1": "its", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4890", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mven" + }, + { + "destination.address": "modocon5089.mail.example", + "destination.port": 5112, + "event.action": "cancel", + "event.code": "26", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-08-22 23:52:50.132538723 +0000 UTC urmag7650.api.invalid %CYBERARK: MessageID=\"26\";Version=1.1844;Message=cancel;Issuer=amvo;Station=10.6.79.159;File=ommodo;Safe=uptat;Location=idex;Category=ptateve;RequestId=cons;Reason=olorese;Severity=high;SourceUser=ore;TargetUser=quid;GatewayStation=10.212.214.4;TicketID=ddoeius;PolicyID=ugiatn;UserName=midestl;LogonDomain=dictasun3878.internal.localhost;Address=modocon5089.mail.example;CPMStatus=lupta;Port=5112;Database=urExce;DeviceType=asi;ExtraDetails=ectiono;", + "file.directory": "idex", + "file.name": "ommodo", + "fileset.name": "corepas", + "group.name": "ore", + "host.ip": "10.6.79.159", + "input.type": "log", + "log.level": "high", + "log.offset": 19305, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1844", + "related.ip": [ + "10.212.214.4", + "10.6.79.159" + ], + "related.user": [ + "quid", + "amvo", + "midestl" + ], + "rsa.db.database": "urExce", + "rsa.db.index": "ectiono", + "rsa.internal.event_desc": "olorese", + "rsa.internal.messageid": "26", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "ptateve", + "rsa.misc.disposition": "lupta", + "rsa.misc.group": "ore", + "rsa.misc.group_object": "uptat", + "rsa.misc.obj_type": "asi", + "rsa.misc.operation_id": "ddoeius", + "rsa.misc.policy_name": "ugiatn", + "rsa.misc.reference_id": "26", + "rsa.misc.reference_id1": "cons", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1844", + "rsa.network.domain": "dictasun3878.internal.localhost", + "rsa.network.host_dst": "modocon5089.mail.example", + "server.domain": "dictasun3878.internal.localhost", + "service.type": "cyberark", + "source.ip": [ + "10.212.214.4" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "amvo" + }, + { + "destination.address": "tempor1282.www5.localhost", + "destination.port": 7699, + "event.action": "deny", + "event.code": "150", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "onu 2017-09-06 06:55:24.392538723 +0000 UTC liquaUte6729.api.localhost %CYBERARK: MessageID=\"150\";Version=1.3546;Message=deny;Issuer=atDu;Station=10.237.170.202;File=maperi;Safe=agnaaliq;Location=tlaboree;Category=norumet;RequestId=dtempo;Reason=tin;Severity=low;SourceUser=mve;TargetUser=liquide;GatewayStation=10.70.147.46;TicketID=inv;PolicyID=rroq;UserName=rcit;LogonDomain=aecatcup2241.www5.test;Address=tempor1282.www5.localhost;CPMStatus=incidid;Port=7699;Database=taedict;DeviceType=edquian;ExtraDetails=loremeu;", + "file.directory": "tlaboree", + "file.name": "maperi", + "fileset.name": "corepas", + "group.name": "mve", + "host.ip": "10.237.170.202", + "input.type": "log", + "log.level": "low", + "log.offset": 19818, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3546", + "related.ip": [ + "10.70.147.46", + "10.237.170.202" + ], + "related.user": [ + "liquide", + "atDu", + "rcit" + ], + "rsa.db.database": "taedict", + "rsa.db.index": "loremeu", + "rsa.internal.event_desc": "tin", + "rsa.internal.messageid": "150", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "norumet", + "rsa.misc.disposition": "incidid", + "rsa.misc.group": "mve", + "rsa.misc.group_object": "agnaaliq", + "rsa.misc.obj_type": "edquian", + "rsa.misc.operation_id": "inv", + "rsa.misc.policy_name": "rroq", + "rsa.misc.reference_id": "150", + "rsa.misc.reference_id1": "dtempo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3546", + "rsa.network.domain": "aecatcup2241.www5.test", + "rsa.network.host_dst": "tempor1282.www5.localhost", + "server.domain": "aecatcup2241.www5.test", + "service.type": "cyberark", + "source.ip": [ + "10.70.147.46" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "atDu" + }, + { + "destination.address": "mipsum2964.invalid", + "destination.port": 6825, + "event.action": "allow", + "event.code": "292", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "dmi 2017-09-20 13:57:58.652538723 +0000 UTC untexpl2847.www5.local %CYBERARK: MessageID=\"292\";Version=1.4282;Message=allow;Issuer=emoe;Station=10.179.50.138;File=ehende;Safe=eaqueip;Location=eum;Category=lamc;RequestId=umetMal;Reason=asper;Severity=high;SourceUser=metcons;TargetUser=itasper;GatewayStation=10.228.118.81;TicketID=temquiav;PolicyID=obeata;UserName=tatemU;LogonDomain=mad5185.www5.localhost;Address=mipsum2964.invalid;CPMStatus=doei;Port=6825;Database=toditaut;DeviceType=voluptat;ExtraDetails=ugit;", + "file.directory": "eum", + "file.name": "ehende", + "fileset.name": "corepas", + "group.name": "metcons", + "host.ip": "10.179.50.138", + "input.type": "log", + "log.level": "high", + "log.offset": 20339, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4282", + "related.ip": [ + "10.179.50.138", + "10.228.118.81" + ], + "related.user": [ + "itasper", + "emoe", + "tatemU" + ], + "rsa.db.database": "toditaut", + "rsa.db.index": "ugit", + "rsa.internal.event_desc": "asper", + "rsa.internal.messageid": "292", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "lamc", + "rsa.misc.disposition": "doei", + "rsa.misc.group": "metcons", + "rsa.misc.group_object": "eaqueip", + "rsa.misc.obj_type": "voluptat", + "rsa.misc.operation_id": "temquiav", + "rsa.misc.policy_name": "obeata", + "rsa.misc.reference_id": "292", + "rsa.misc.reference_id1": "umetMal", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4282", + "rsa.network.domain": "mad5185.www5.localhost", + "rsa.network.host_dst": "mipsum2964.invalid", + "server.domain": "mad5185.www5.localhost", + "service.type": "cyberark", + "source.ip": [ + "10.228.118.81" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "emoe" + }, + { + "destination.address": "veniamq1236.invalid", + "destination.port": 1458, + "event.action": "cancel", + "event.code": "38", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "October 4 21:00:32 asnu %CYBERARK: MessageID=\"38\";Version=1.3806;Message=cancel;Issuer=henderit;Station=10.49.71.118;File=ationul;Safe=mquisn;Location=queips;Category=midest;RequestId=dex;Reason=ccae;Severity=medium;SourceUser=eavolup;TargetUser=emip;GatewayStation=10.234.165.130;TicketID=ntexplic;PolicyID=uto;UserName=iuntNequ;LogonDomain=esseq7889.www.invalid;Address=veniamq1236.invalid;CPMStatus=emo;Port=1458;Database=veniamqu;DeviceType=licaboN;ExtraDetails=atquo;", + "file.directory": "queips", + "file.name": "ationul", + "fileset.name": "corepas", + "group.name": "eavolup", + "host.ip": "10.49.71.118", + "input.type": "log", + "log.level": "medium", + "log.offset": 20854, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3806", + "related.ip": [ + "10.49.71.118", + "10.234.165.130" + ], + "related.user": [ + "emip", + "henderit", + "iuntNequ" + ], + "rsa.db.database": "veniamqu", + "rsa.db.index": "atquo", + "rsa.internal.event_desc": "ccae", + "rsa.internal.messageid": "38", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "midest", + "rsa.misc.disposition": "emo", + "rsa.misc.group": "eavolup", + "rsa.misc.group_object": "mquisn", + "rsa.misc.obj_type": "licaboN", + "rsa.misc.operation_id": "ntexplic", + "rsa.misc.policy_name": "uto", + "rsa.misc.reference_id": "38", + "rsa.misc.reference_id1": "dex", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3806", + "rsa.network.domain": "esseq7889.www.invalid", + "rsa.network.host_dst": "veniamq1236.invalid", + "server.domain": "esseq7889.www.invalid", + "service.type": "cyberark", + "source.ip": [ + "10.234.165.130" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "henderit" + }, + { + "event.action": "allow", + "event.code": "tatem", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "udan 2017-10-19 04:03:07.172538723 +0000 UTC yCic5749.www.localhost %CYBERARK: MessageID=\"119\";itanim 1.4024\",ProductAccount=\"olorema\",ProductProcess=\"mollita\",EventId=\"tatem\",EventClass=\"iae\",EventSeverity=\"low\",EventMessage=\"allow\",ActingUserName=\"emip\",ActingAddress=\"10.199.5.49\",ActionSourceUser=\"stquid\",ActionTargetUser=\"turadipi\",ActionObject=\"usmodi\",ActionSafe=\"ree\",ActionLocation=\"saquaea\",ActionCategory=\"ation\",ActionRequestId=\"luptas\",ActionReason=\"minim\",ActionExtraDetails=\"ataevi\"", + "file.directory": "saquaea", + "file.name": "usmodi", + "fileset.name": "corepas", + "host.ip": "10.199.5.49", + "input.type": "log", + "log.level": "low", + "log.offset": 21327, + "observer.product": "itanim", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4024", + "related.ip": [ + "10.199.5.49" + ], + "related.user": [ + "turadipi", + "emip", + "olorema" + ], + "rsa.db.index": "ataevi", + "rsa.internal.event_desc": "minim", + "rsa.internal.messageid": "119", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ation", + "rsa.misc.group_object": "ree", + "rsa.misc.reference_id": "tatem", + "rsa.misc.reference_id1": "luptas", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4024", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "emip" + }, + { + "event.action": "allow", + "event.code": "tionula", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"156\";plic 1.7053\",ProductAccount=\"utlabo\",ProductProcess=\"tetur\",EventId=\"tionula\",EventClass=\"ritqu\",EventSeverity=\"very-high\",EventMessage=\"allow\",ActingUserName=\"uamei\",ActingAddress=\"10.193.219.34\",ActionSourceUser=\"onse\",ActionTargetUser=\"olorem\",ActionObject=\"turvel\",ActionSafe=\"eratv\",ActionLocation=\"ipsa\",ActionCategory=\"asuntexp\",ActionRequestId=\"adminim\",ActionReason=\"orisni\",ActionExtraDetails=\"nse\"", + "file.directory": "ipsa", + "file.name": "turvel", + "fileset.name": "corepas", + "host.ip": "10.193.219.34", + "input.type": "log", + "log.level": "very-high", + "log.offset": 21826, + "observer.product": "plic", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7053", + "related.ip": [ + "10.193.219.34" + ], + "related.user": [ + "uamei", + "utlabo", + "olorem" + ], + "rsa.db.index": "nse", + "rsa.internal.event_desc": "orisni", + "rsa.internal.messageid": "156", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "asuntexp", + "rsa.misc.group_object": "eratv", + "rsa.misc.reference_id": "tionula", + "rsa.misc.reference_id1": "adminim", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.7053", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "uamei" + }, + { + "destination.address": "taliqui5348.mail.localdomain", + "destination.port": 6816, + "event.action": "allow", + "event.code": "202", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "November 16 18:08:15 nderi %CYBERARK: MessageID=\"202\";Version=1.7083;Message=allow;Issuer=animid;Station=10.120.167.217;File=atuse;Safe=ueipsa;Location=scipitl;Category=eumi;RequestId=quasiarc;Reason=olli;Severity=low;SourceUser=tetura;TargetUser=rsp;GatewayStation=10.174.185.109;TicketID=roquisqu;PolicyID=edolorin;UserName=dolorem;LogonDomain=tem6815.home;Address=taliqui5348.mail.localdomain;CPMStatus=loremag;Port=6816;Database=tsuntinc;DeviceType=inrepreh;ExtraDetails=quovo;", + "file.directory": "scipitl", + "file.name": "atuse", + "fileset.name": "corepas", + "group.name": "tetura", + "host.ip": "10.120.167.217", + "input.type": "log", + "log.level": "low", + "log.offset": 22262, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7083", + "related.ip": [ + "10.174.185.109", + "10.120.167.217" + ], + "related.user": [ + "animid", + "rsp", + "dolorem" + ], + "rsa.db.database": "tsuntinc", + "rsa.db.index": "quovo", + "rsa.internal.event_desc": "olli", + "rsa.internal.messageid": "202", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "eumi", + "rsa.misc.disposition": "loremag", + "rsa.misc.group": "tetura", + "rsa.misc.group_object": "ueipsa", + "rsa.misc.obj_type": "inrepreh", + "rsa.misc.operation_id": "roquisqu", + "rsa.misc.policy_name": "edolorin", + "rsa.misc.reference_id": "202", + "rsa.misc.reference_id1": "quasiarc", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7083", + "rsa.network.domain": "tem6815.home", + "rsa.network.host_dst": "taliqui5348.mail.localdomain", + "server.domain": "tem6815.home", + "service.type": "cyberark", + "source.ip": [ + "10.174.185.109" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "animid" + }, + { + "destination.address": "atnulapa3548.www.domain", + "destination.port": 5347, + "event.action": "cancel", + "event.code": "133", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"133\";Version=1.1432;Message=cancel;Issuer=atev;Station=10.117.137.159;File=acommodi;Safe=essecill;Location=billoi;Category=moles;RequestId=dipiscin;Reason=olup;Severity=high;SourceUser=undeomni;TargetUser=accusa;GatewayStation=10.141.213.219;TicketID=itat;PolicyID=stlaboru;UserName=ate;LogonDomain=mporainc2064.home;Address=atnulapa3548.www.domain;CPMStatus=radipisc;Port=5347;Database=nibus;DeviceType=vitaed;ExtraDetails=ser;", + "file.directory": "billoi", + "file.name": "acommodi", + "fileset.name": "corepas", + "group.name": "undeomni", + "host.ip": "10.117.137.159", + "input.type": "log", + "log.level": "high", + "log.offset": 22744, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1432", + "related.ip": [ + "10.117.137.159", + "10.141.213.219" + ], + "related.user": [ + "atev", + "accusa", + "ate" + ], + "rsa.db.database": "nibus", + "rsa.db.index": "ser", + "rsa.internal.event_desc": "olup", + "rsa.internal.messageid": "133", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "moles", + "rsa.misc.disposition": "radipisc", + "rsa.misc.group": "undeomni", + "rsa.misc.group_object": "essecill", + "rsa.misc.obj_type": "vitaed", + "rsa.misc.operation_id": "itat", + "rsa.misc.policy_name": "stlaboru", + "rsa.misc.reference_id": "133", + "rsa.misc.reference_id1": "dipiscin", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1432", + "rsa.network.domain": "mporainc2064.home", + "rsa.network.host_dst": "atnulapa3548.www.domain", + "server.domain": "mporainc2064.home", + "service.type": "cyberark", + "source.ip": [ + "10.141.213.219" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "atev" + }, + { + "destination.address": "litesseq6785.host", + "destination.port": 7390, + "event.action": "cancel", + "event.code": "104", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2017-12-15 08:13:24.212538723 +0000 UTC ill6772.www.invalid %CYBERARK: MessageID=\"104\";Version=1.4043;Message=cancel;Issuer=rem;Station=10.166.90.130;File=mdolore;Safe=eosquira;Location=pta;Category=snos;RequestId=orsi;Reason=tetura;Severity=very-high;SourceUser=lorsita;TargetUser=eavol;GatewayStation=10.94.224.229;TicketID=lupta;PolicyID=npr;UserName=etconsec;LogonDomain=caboNem1043.internal.home;Address=litesseq6785.host;CPMStatus=tob;Port=7390;Database=oditempo;DeviceType=doeiu;ExtraDetails=deF;", + "file.directory": "pta", + "file.name": "mdolore", + "fileset.name": "corepas", + "group.name": "lorsita", + "host.ip": "10.166.90.130", + "input.type": "log", + "log.level": "very-high", + "log.offset": 23195, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4043", + "related.ip": [ + "10.166.90.130", + "10.94.224.229" + ], + "related.user": [ + "rem", + "eavol", + "etconsec" + ], + "rsa.db.database": "oditempo", + "rsa.db.index": "deF", + "rsa.internal.event_desc": "tetura", + "rsa.internal.messageid": "104", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "User", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "snos", + "rsa.misc.disposition": "tob", + "rsa.misc.group": "lorsita", + "rsa.misc.group_object": "eosquira", + "rsa.misc.obj_type": "doeiu", + "rsa.misc.operation_id": "lupta", + "rsa.misc.policy_name": "npr", + "rsa.misc.reference_id": "104", + "rsa.misc.reference_id1": "orsi", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4043", + "rsa.network.domain": "caboNem1043.internal.home", + "rsa.network.host_dst": "litesseq6785.host", + "server.domain": "caboNem1043.internal.home", + "service.type": "cyberark", + "source.ip": [ + "10.94.224.229" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "rem" + }, + { + "destination.address": "onnu2272.mail.corp", + "destination.port": 6064, + "event.action": "deny", + "event.code": "316", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "rcitat 2017-12-29 15:15:58.472538723 +0000 UTC dolorema2984.www.home %CYBERARK: MessageID=\"316\";Version=1.2456;Message=deny;Issuer=tiumto;Station=10.38.28.151;File=nrepreh;Safe=ratv;Location=alorum;Category=mquisn;RequestId=atq;Reason=erspi;Severity=low;SourceUser=ugiatquo;TargetUser=incidid;GatewayStation=10.201.81.46;TicketID=sBonor;PolicyID=fugits;UserName=mipsumqu;LogonDomain=tatio6513.www.invalid;Address=onnu2272.mail.corp;CPMStatus=atatnon;Port=6064;Database=abor;DeviceType=magnid;ExtraDetails=adol;", + "file.directory": "alorum", + "file.name": "nrepreh", + "fileset.name": "corepas", + "group.name": "ugiatquo", + "host.ip": "10.38.28.151", + "input.type": "log", + "log.level": "low", + "log.offset": 23699, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2456", + "related.ip": [ + "10.38.28.151", + "10.201.81.46" + ], + "related.user": [ + "incidid", + "mipsumqu", + "tiumto" + ], + "rsa.db.database": "abor", + "rsa.db.index": "adol", + "rsa.internal.event_desc": "erspi", + "rsa.internal.messageid": "316", + "rsa.investigations.ec_activity": "Modify", + "rsa.investigations.ec_theme": "Password", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "mquisn", + "rsa.misc.disposition": "atatnon", + "rsa.misc.group": "ugiatquo", + "rsa.misc.group_object": "ratv", + "rsa.misc.obj_type": "magnid", + "rsa.misc.operation_id": "sBonor", + "rsa.misc.policy_name": "fugits", + "rsa.misc.reference_id": "316", + "rsa.misc.reference_id1": "atq", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2456", + "rsa.network.domain": "tatio6513.www.invalid", + "rsa.network.host_dst": "onnu2272.mail.corp", + "server.domain": "tatio6513.www.invalid", + "service.type": "cyberark", + "source.ip": [ + "10.201.81.46" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tiumto" + }, + { + "destination.address": "llit958.www.domain", + "destination.port": 2957, + "event.action": "deny", + "event.code": "266", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "January 12 22:18:32 niam %CYBERARK: MessageID=\"266\";Version=1.2721;Message=deny;Issuer=rerepre;Station=10.214.245.95;File=quiineav;Safe=billoinv;Location=sci;Category=col;RequestId=obea;Reason=emp;Severity=medium;SourceUser=luptas;TargetUser=uptatem;GatewayStation=10.255.28.56;TicketID=inrepr;PolicyID=mol;UserName=umdolors;LogonDomain=dolori6232.api.invalid;Address=llit958.www.domain;CPMStatus=tat;Port=2957;Database=odt;DeviceType=cillumd;ExtraDetails=riosa;", + "file.directory": "sci", + "file.name": "quiineav", + "fileset.name": "corepas", + "group.name": "luptas", + "host.ip": "10.214.245.95", + "input.type": "log", + "log.level": "medium", + "log.offset": 24210, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2721", + "related.ip": [ + "10.255.28.56", + "10.214.245.95" + ], + "related.user": [ + "rerepre", + "uptatem", + "umdolors" + ], + "rsa.db.database": "odt", + "rsa.db.index": "riosa", + "rsa.internal.event_desc": "emp", + "rsa.internal.messageid": "266", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "col", + "rsa.misc.disposition": "tat", + "rsa.misc.group": "luptas", + "rsa.misc.group_object": "billoinv", + "rsa.misc.obj_type": "cillumd", + "rsa.misc.operation_id": "inrepr", + "rsa.misc.policy_name": "mol", + "rsa.misc.reference_id": "266", + "rsa.misc.reference_id1": "obea", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.2721", + "rsa.network.domain": "dolori6232.api.invalid", + "rsa.network.host_dst": "llit958.www.domain", + "server.domain": "dolori6232.api.invalid", + "service.type": "cyberark", + "source.ip": [ + "10.255.28.56" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "rerepre" + }, + { + "event.action": "cancel", + "event.code": "nim", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "January 27 05:21:06 lapar %CYBERARK: MessageID=\"311\";ritati 1.3219\",ProductAccount=\"qui\",ProductProcess=\"otamr\",EventId=\"nim\",EventClass=\"ame\",EventSeverity=\"very-high\",EventMessage=\"cancel\",ActingUserName=\"mip\",ActingAddress=\"10.45.35.180\",ActionSourceUser=\"mvolupta\",ActionTargetUser=\"Utenima\",ActionObject=\"iqua\",ActionSafe=\"luptat\",ActionLocation=\"deriti\",ActionCategory=\"sintocc\",ActionRequestId=\"cididu\",ActionReason=\"uteir\",ActionExtraDetails=\"boree\"", + "file.directory": "deriti", + "file.name": "iqua", + "fileset.name": "corepas", + "host.ip": "10.45.35.180", + "input.type": "log", + "log.level": "very-high", + "log.offset": 24673, + "observer.product": "ritati", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3219", + "related.ip": [ + "10.45.35.180" + ], + "related.user": [ + "mip", + "qui", + "Utenima" + ], + "rsa.db.index": "boree", + "rsa.internal.event_desc": "uteir", + "rsa.internal.messageid": "311", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "sintocc", + "rsa.misc.group_object": "luptat", + "rsa.misc.reference_id": "nim", + "rsa.misc.reference_id1": "cididu", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3219", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mip" + }, + { + "event.action": "accept", + "event.code": "scivel", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "February 10 12:23:41 diduntu %CYBERARK: MessageID=\"285\";eiusmod 1.7546\",ProductAccount=\"ess\",ProductProcess=\"uide\",EventId=\"scivel\",EventClass=\"henderi\",EventSeverity=\"low\",EventMessage=\"accept\",ActingUserName=\"enim\",ActingAddress=\"10.141.200.133\",ActionSourceUser=\"ersp\",ActionTargetUser=\"iame\",ActionObject=\"orroquis\",ActionSafe=\"aquio\",ActionLocation=\"riatu\",ActionCategory=\"loinve\",ActionRequestId=\"tanimid\",ActionReason=\"isnostru\",ActionExtraDetails=\"nofdeFi\"", + "file.directory": "riatu", + "file.name": "orroquis", + "fileset.name": "corepas", + "host.ip": "10.141.200.133", + "input.type": "log", + "log.level": "low", + "log.offset": 25131, + "observer.product": "eiusmod", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7546", + "related.ip": [ + "10.141.200.133" + ], + "related.user": [ + "enim", + "ess", + "iame" + ], + "rsa.db.index": "nofdeFi", + "rsa.internal.event_desc": "isnostru", + "rsa.internal.messageid": "285", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "loinve", + "rsa.misc.group_object": "aquio", + "rsa.misc.reference_id": "scivel", + "rsa.misc.reference_id1": "tanimid", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7546", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "enim" + }, + { + "event.action": "accept", + "event.code": "rationev", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"155\";ulap 1.3765\",ProductAccount=\"illoi\",ProductProcess=\"reetdolo\",EventId=\"rationev\",EventClass=\"ehender\",EventSeverity=\"medium\",EventMessage=\"accept\",ActingUserName=\"ugi\",ActingAddress=\"10.83.238.145\",ActionSourceUser=\"ptatems\",ActionTargetUser=\"runtmo\",ActionObject=\"ore\",ActionSafe=\"isund\",ActionLocation=\"exerci\",ActionCategory=\"tas\",ActionRequestId=\"oraincid\",ActionReason=\"quaer\",ActionExtraDetails=\"eetdo\"", + "file.directory": "exerci", + "file.name": "ore", + "fileset.name": "corepas", + "host.ip": "10.83.238.145", + "input.type": "log", + "log.level": "medium", + "log.offset": 25596, + "observer.product": "ulap", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3765", + "related.ip": [ + "10.83.238.145" + ], + "related.user": [ + "ugi", + "illoi", + "runtmo" + ], + "rsa.db.index": "eetdo", + "rsa.internal.event_desc": "quaer", + "rsa.internal.messageid": "155", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "tas", + "rsa.misc.group_object": "isund", + "rsa.misc.reference_id": "rationev", + "rsa.misc.reference_id1": "oraincid", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3765", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ugi" + }, + { + "destination.address": "llamc6724.www.lan", + "destination.port": 4020, + "event.action": "block", + "event.code": "48", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2018-03-11 02:28:49.772538723 +0000 UTC aali6869.api.localdomain %CYBERARK: MessageID=\"48\";Version=1.3147;Message=block;Issuer=sedquiac;Station=10.39.143.155;File=ipsaqu;Safe=nisiut;Location=rumwri;Category=velill;RequestId=ore;Reason=tation;Severity=very-high;SourceUser=porincid;TargetUser=tperspic;GatewayStation=10.41.89.217;TicketID=ict;PolicyID=squirati;UserName=tem;LogonDomain=mestq2106.api.host;Address=llamc6724.www.lan;CPMStatus=tesseci;Port=4020;Database=radipis;DeviceType=cive;ExtraDetails=nse;", + "file.directory": "rumwri", + "file.name": "ipsaqu", + "fileset.name": "corepas", + "group.name": "porincid", + "host.ip": "10.39.143.155", + "input.type": "log", + "log.level": "very-high", + "log.offset": 26032, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3147", + "related.ip": [ + "10.39.143.155", + "10.41.89.217" + ], + "related.user": [ + "tperspic", + "sedquiac", + "tem" + ], + "rsa.db.database": "radipis", + "rsa.db.index": "nse", + "rsa.internal.event_desc": "tation", + "rsa.internal.messageid": "48", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "velill", + "rsa.misc.disposition": "tesseci", + "rsa.misc.group": "porincid", + "rsa.misc.group_object": "nisiut", + "rsa.misc.obj_type": "cive", + "rsa.misc.operation_id": "ict", + "rsa.misc.policy_name": "squirati", + "rsa.misc.reference_id": "48", + "rsa.misc.reference_id1": "ore", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3147", + "rsa.network.domain": "mestq2106.api.host", + "rsa.network.host_dst": "llamc6724.www.lan", + "server.domain": "mestq2106.api.host", + "service.type": "cyberark", + "source.ip": [ + "10.41.89.217" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "sedquiac" + }, + { + "destination.address": "reseosqu1629.mail.lan", + "destination.port": 5325, + "event.action": "accept", + "event.code": "378", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "isnisiu 2018-03-25 09:31:24.032538723 +0000 UTC suntincu2940.www5.domain %CYBERARK: MessageID=\"378\";Version=1.6382;Message=accept;Issuer=minim;Station=10.5.5.1;File=reseosq;Safe=gna;Location=isiutali;Category=lumqu;RequestId=onulamco;Reason=ons;Severity=low;SourceUser=uptat;TargetUser=unt;GatewayStation=10.153.123.20;TicketID=tla;PolicyID=mquiad;UserName=CSe;LogonDomain=lors7553.api.local;Address=reseosqu1629.mail.lan;CPMStatus=utemvel;Port=5325;Database=atu;DeviceType=iusm;ExtraDetails=roi;", + "file.directory": "isiutali", + "file.name": "reseosq", + "fileset.name": "corepas", + "group.name": "uptat", + "host.ip": "10.5.5.1", + "input.type": "log", + "log.level": "low", + "log.offset": 26541, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6382", + "related.ip": [ + "10.153.123.20", + "10.5.5.1" + ], + "related.user": [ + "unt", + "CSe", + "minim" + ], + "rsa.db.database": "atu", + "rsa.db.index": "roi", + "rsa.internal.event_desc": "ons", + "rsa.internal.messageid": "378", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "lumqu", + "rsa.misc.disposition": "utemvel", + "rsa.misc.group": "uptat", + "rsa.misc.group_object": "gna", + "rsa.misc.obj_type": "iusm", + "rsa.misc.operation_id": "tla", + "rsa.misc.policy_name": "mquiad", + "rsa.misc.reference_id": "378", + "rsa.misc.reference_id1": "onulamco", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.6382", + "rsa.network.domain": "lors7553.api.local", + "rsa.network.host_dst": "reseosqu1629.mail.lan", + "server.domain": "lors7553.api.local", + "service.type": "cyberark", + "source.ip": [ + "10.153.123.20" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "minim" + }, + { + "destination.address": "orumSe4514.www.corp", + "destination.port": 80, + "event.action": "deny", + "event.code": "269", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2018-04-08 16:33:58.292538723 +0000 UTC rere5274.mail.domain %CYBERARK: MessageID=\"269\";Version=1.3193;Message=deny;Issuer=iamea;Station=10.210.61.109;File=tiumto;Safe=cor;Location=odoco;Category=oin;RequestId=itseddoe;Reason=elites;Severity=low;SourceUser=uamei;TargetUser=eursinto;GatewayStation=10.168.132.175;TicketID=licaboNe;PolicyID=tautfug;UserName=giatquov;LogonDomain=olu5333.www.domain;Address=orumSe4514.www.corp;CPMStatus=umquam;Port=80;Database=ici;DeviceType=nisiuta;ExtraDetails=iquaUt;", + "file.directory": "odoco", + "file.name": "tiumto", + "fileset.name": "corepas", + "group.name": "uamei", + "host.ip": "10.210.61.109", + "input.type": "log", + "log.level": "low", + "log.offset": 27038, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3193", + "related.ip": [ + "10.210.61.109", + "10.168.132.175" + ], + "related.user": [ + "iamea", + "giatquov", + "eursinto" + ], + "rsa.db.database": "ici", + "rsa.db.index": "iquaUt", + "rsa.internal.event_desc": "elites", + "rsa.internal.messageid": "269", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "oin", + "rsa.misc.disposition": "umquam", + "rsa.misc.group": "uamei", + "rsa.misc.group_object": "cor", + "rsa.misc.obj_type": "nisiuta", + "rsa.misc.operation_id": "licaboNe", + "rsa.misc.policy_name": "tautfug", + "rsa.misc.reference_id": "269", + "rsa.misc.reference_id1": "itseddoe", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3193", + "rsa.network.domain": "olu5333.www.domain", + "rsa.network.host_dst": "orumSe4514.www.corp", + "server.domain": "olu5333.www.domain", + "service.type": "cyberark", + "source.ip": [ + "10.168.132.175" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "iamea" + }, + { + "event.action": "accept", + "event.code": "olup", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"176\";atnula 1.5038\",ProductAccount=\"lmo\",ProductProcess=\"iquidex\",EventId=\"olup\",EventClass=\"remipsu\",EventSeverity=\"low\",EventMessage=\"accept\",ActingUserName=\"quiac\",ActingAddress=\"10.123.154.17\",ActionSourceUser=\"etdol\",ActionTargetUser=\"dolorsi\",ActionObject=\"nturmag\",ActionSafe=\"tura\",ActionLocation=\"osquirat\",ActionCategory=\"equat\",ActionRequestId=\"aliquid\",ActionReason=\"usantiu\",ActionExtraDetails=\"idunt\"", + "file.directory": "osquirat", + "file.name": "nturmag", + "fileset.name": "corepas", + "host.ip": "10.123.154.17", + "input.type": "log", + "log.level": "low", + "log.offset": 27541, + "observer.product": "atnula", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5038", + "related.ip": [ + "10.123.154.17" + ], + "related.user": [ + "quiac", + "lmo", + "dolorsi" + ], + "rsa.db.index": "idunt", + "rsa.internal.event_desc": "usantiu", + "rsa.internal.messageid": "176", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "equat", + "rsa.misc.group_object": "tura", + "rsa.misc.reference_id": "olup", + "rsa.misc.reference_id1": "aliquid", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.5038", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "quiac" + }, + { + "event.action": "deny", + "event.code": "lpaquiof", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"4\";min 1.136\",ProductAccount=\"xplic\",ProductProcess=\"eseruntm\",EventId=\"lpaquiof\",EventClass=\"oloreeu\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"etquasia\",ActingAddress=\"10.169.123.103\",ActionSourceUser=\"riatur\",ActionTargetUser=\"oeni\",ActionObject=\"dol\",ActionSafe=\"dol\",ActionLocation=\"atur\",ActionCategory=\"issu\",ActionRequestId=\"identsu\",ActionReason=\"piscivel\",ActionExtraDetails=\"hend\"", + "event.outcome": "failure", + "file.directory": "atur", + "file.name": "dol", + "fileset.name": "corepas", + "host.ip": "10.169.123.103", + "input.type": "log", + "log.level": "very-high", + "log.offset": 27978, + "observer.product": "min", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.136", + "related.ip": [ + "10.169.123.103" + ], + "related.user": [ + "oeni", + "etquasia", + "xplic" + ], + "rsa.db.index": "hend", + "rsa.internal.event_desc": "piscivel", + "rsa.internal.messageid": "4", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "issu", + "rsa.misc.group_object": "dol", + "rsa.misc.reference_id": "lpaquiof", + "rsa.misc.reference_id1": "identsu", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.136", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "etquasia" + }, + { + "event.action": "cancel", + "event.code": "scipi", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"276\";aer 1.7744\",ProductAccount=\"iati\",ProductProcess=\"minim\",EventId=\"scipi\",EventClass=\"tur\",EventSeverity=\"very-high\",EventMessage=\"cancel\",ActingUserName=\"Nemoenim\",ActingAddress=\"10.126.205.76\",ActionSourceUser=\"etur\",ActionTargetUser=\"rsitvol\",ActionObject=\"utali\",ActionSafe=\"sed\",ActionLocation=\"xeac\",ActionCategory=\"umdolors\",ActionRequestId=\"lumdo\",ActionReason=\"acom\",ActionExtraDetails=\"eFini\"", + "file.directory": "xeac", + "file.name": "utali", + "fileset.name": "corepas", + "host.ip": "10.126.205.76", + "input.type": "log", + "log.level": "very-high", + "log.offset": 28412, + "observer.product": "aer", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7744", + "related.ip": [ + "10.126.205.76" + ], + "related.user": [ + "rsitvol", + "Nemoenim", + "iati" + ], + "rsa.db.index": "eFini", + "rsa.internal.event_desc": "acom", + "rsa.internal.messageid": "276", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "umdolors", + "rsa.misc.group_object": "sed", + "rsa.misc.reference_id": "scipi", + "rsa.misc.reference_id1": "lumdo", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.7744", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "Nemoenim" + }, + { + "destination.address": "mmodoco2581.www5.host", + "destination.port": 3575, + "event.action": "accept", + "event.code": "38", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "June 4 20:44:15 uovol %CYBERARK: MessageID=\"38\";Version=1.3184;Message=accept;Issuer=eufug;Station=10.164.66.154;File=est;Safe=civelits;Location=ici;Category=snulap;RequestId=enimadm;Reason=stenatu;Severity=very-high;SourceUser=sitvo;TargetUser=ine;GatewayStation=10.169.101.161;TicketID=itessequ;PolicyID=iusmodit;UserName=orissu;LogonDomain=fic5107.home;Address=mmodoco2581.www5.host;CPMStatus=isiutali;Port=3575;Database=stquidol;DeviceType=Nemoenim;ExtraDetails=imadmini;", + "file.directory": "ici", + "file.name": "est", + "fileset.name": "corepas", + "group.name": "sitvo", + "host.ip": "10.164.66.154", + "input.type": "log", + "log.level": "very-high", + "log.offset": 28841, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3184", + "related.ip": [ + "10.169.101.161", + "10.164.66.154" + ], + "related.user": [ + "eufug", + "orissu", + "ine" + ], + "rsa.db.database": "stquidol", + "rsa.db.index": "imadmini", + "rsa.internal.event_desc": "stenatu", + "rsa.internal.messageid": "38", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "snulap", + "rsa.misc.disposition": "isiutali", + "rsa.misc.group": "sitvo", + "rsa.misc.group_object": "civelits", + "rsa.misc.obj_type": "Nemoenim", + "rsa.misc.operation_id": "itessequ", + "rsa.misc.policy_name": "iusmodit", + "rsa.misc.reference_id": "38", + "rsa.misc.reference_id1": "enimadm", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3184", + "rsa.network.domain": "fic5107.home", + "rsa.network.host_dst": "mmodoco2581.www5.host", + "server.domain": "fic5107.home", + "service.type": "cyberark", + "source.ip": [ + "10.169.101.161" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "eufug" + }, + { + "event.action": "block", + "event.code": "ons", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "amvo 2018-06-19 03:46:49.592538723 +0000 UTC tnul6235.www5.lan %CYBERARK: MessageID=\"79\";isau 1.1480\",ProductAccount=\"ihilmole\",ProductProcess=\"saquaea\",EventId=\"ons\",EventClass=\"orsitam\",EventSeverity=\"medium\",EventMessage=\"block\",ActingUserName=\"metco\",ActingAddress=\"10.70.83.200\",ActionSourceUser=\"riame\",ActionTargetUser=\"riat\",ActionObject=\"sseq\",ActionSafe=\"eriam\",ActionLocation=\"pernat\",ActionCategory=\"udan\",ActionRequestId=\"archi\",ActionReason=\"iutaliq\",ActionExtraDetails=\"urQuis\"", + "file.directory": "pernat", + "file.name": "sseq", + "fileset.name": "corepas", + "host.ip": "10.70.83.200", + "input.type": "log", + "log.level": "medium", + "log.offset": 29317, + "observer.product": "isau", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1480", + "related.ip": [ + "10.70.83.200" + ], + "related.user": [ + "ihilmole", + "riat", + "metco" + ], + "rsa.db.index": "urQuis", + "rsa.internal.event_desc": "iutaliq", + "rsa.internal.messageid": "79", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "udan", + "rsa.misc.group_object": "eriam", + "rsa.misc.reference_id": "ons", + "rsa.misc.reference_id1": "archi", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.1480", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "metco" + }, + { + "destination.address": "oremqu7663.local", + "destination.port": 5816, + "event.action": "block", + "event.code": "53", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "July 3 10:49:23 orum %CYBERARK: MessageID=\"53\";Version=1.4887;Message=block;Issuer=madminim;Station=10.207.97.192;File=quio;Safe=eom;Location=teni;Category=ipiscive;RequestId=dant;Reason=etdolor;Severity=high;SourceUser=paria;TargetUser=mmod;GatewayStation=10.134.55.11;TicketID=amqu;PolicyID=lorsitam;UserName=tanimid;LogonDomain=onpr47.api.home;Address=oremqu7663.local;CPMStatus=llumq;Port=5816;Database=tetura;DeviceType=rumet;ExtraDetails=uptasnul;", + "file.directory": "teni", + "file.name": "quio", + "fileset.name": "corepas", + "group.name": "paria", + "host.ip": "10.207.97.192", + "input.type": "log", + "log.level": "high", + "log.offset": 29810, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4887", + "related.ip": [ + "10.207.97.192", + "10.134.55.11" + ], + "related.user": [ + "madminim", + "tanimid", + "mmod" + ], + "rsa.db.database": "tetura", + "rsa.db.index": "uptasnul", + "rsa.internal.event_desc": "etdolor", + "rsa.internal.messageid": "53", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "ipiscive", + "rsa.misc.disposition": "llumq", + "rsa.misc.group": "paria", + "rsa.misc.group_object": "eom", + "rsa.misc.obj_type": "rumet", + "rsa.misc.operation_id": "amqu", + "rsa.misc.policy_name": "lorsitam", + "rsa.misc.reference_id": "53", + "rsa.misc.reference_id1": "dant", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4887", + "rsa.network.domain": "onpr47.api.home", + "rsa.network.host_dst": "oremqu7663.local", + "server.domain": "onpr47.api.home", + "service.type": "cyberark", + "source.ip": [ + "10.134.55.11" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "madminim" + }, + { + "destination.address": "eve234.www5.local", + "destination.port": 2783, + "event.action": "cancel", + "event.code": "75", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2018-07-17 17:51:58.112538723 +0000 UTC nde2358.mail.corp %CYBERARK: MessageID=\"75\";Version=1.3601;Message=cancel;Issuer=texplica;Station=10.52.150.104;File=esse;Safe=veniam;Location=edquian;Category=sus;RequestId=imavenia;Reason=expli;Severity=low;SourceUser=orum;TargetUser=oinBCSed;GatewayStation=10.31.187.19;TicketID=ilm;PolicyID=mvel;UserName=eritq;LogonDomain=rehen4859.api.host;Address=eve234.www5.local;CPMStatus=nula;Port=2783;Database=lit;DeviceType=santi;ExtraDetails=ritati;", + "file.directory": "edquian", + "file.name": "esse", + "fileset.name": "corepas", + "group.name": "orum", + "host.ip": "10.52.150.104", + "input.type": "log", + "log.level": "low", + "log.offset": 30264, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3601", + "related.ip": [ + "10.31.187.19", + "10.52.150.104" + ], + "related.user": [ + "eritq", + "oinBCSed", + "texplica" + ], + "rsa.db.database": "lit", + "rsa.db.index": "ritati", + "rsa.internal.event_desc": "expli", + "rsa.internal.messageid": "75", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "sus", + "rsa.misc.disposition": "nula", + "rsa.misc.group": "orum", + "rsa.misc.group_object": "veniam", + "rsa.misc.obj_type": "santi", + "rsa.misc.operation_id": "ilm", + "rsa.misc.policy_name": "mvel", + "rsa.misc.reference_id": "75", + "rsa.misc.reference_id1": "imavenia", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3601", + "rsa.network.domain": "rehen4859.api.host", + "rsa.network.host_dst": "eve234.www5.local", + "server.domain": "rehen4859.api.host", + "service.type": "cyberark", + "source.ip": [ + "10.31.187.19" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "texplica" + }, + { + "destination.address": "fficia2304.www5.home", + "destination.port": 2396, + "event.action": "allow", + "event.code": "89", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "dip 2018-08-01 00:54:32.372538723 +0000 UTC idolo5292.local %CYBERARK: MessageID=\"89\";Version=1.3175;Message=allow;Issuer=runtm;Station=10.41.232.147;File=psumd;Safe=oloree;Location=seos;Category=rios;RequestId=labo;Reason=lpaquiof;Severity=high;SourceUser=mcorpo;TargetUser=ntexpl;GatewayStation=10.61.175.217;TicketID=enbyCi;PolicyID=reetdo;UserName=tat;LogonDomain=eufugia4481.corp;Address=fficia2304.www5.home;CPMStatus=vel;Port=2396;Database=rere;DeviceType=pta;ExtraDetails=nonn;", + "file.directory": "seos", + "file.name": "psumd", + "fileset.name": "corepas", + "group.name": "mcorpo", + "host.ip": "10.41.232.147", + "input.type": "log", + "log.level": "high", + "log.offset": 30752, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3175", + "related.ip": [ + "10.61.175.217", + "10.41.232.147" + ], + "related.user": [ + "tat", + "ntexpl", + "runtm" + ], + "rsa.db.database": "rere", + "rsa.db.index": "nonn", + "rsa.internal.event_desc": "lpaquiof", + "rsa.internal.messageid": "89", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "rios", + "rsa.misc.disposition": "vel", + "rsa.misc.group": "mcorpo", + "rsa.misc.group_object": "oloree", + "rsa.misc.obj_type": "pta", + "rsa.misc.operation_id": "enbyCi", + "rsa.misc.policy_name": "reetdo", + "rsa.misc.reference_id": "89", + "rsa.misc.reference_id1": "labo", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3175", + "rsa.network.domain": "eufugia4481.corp", + "rsa.network.host_dst": "fficia2304.www5.home", + "server.domain": "eufugia4481.corp", + "service.type": "cyberark", + "source.ip": [ + "10.61.175.217" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "runtm" + }, + { + "event.action": "deny", + "event.code": "ntut", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "August 15 07:57:06 volup %CYBERARK: MessageID=\"261\";ptate 1.3830\",ProductAccount=\"uisnos\",ProductProcess=\"quamqua\",EventId=\"ntut\",EventClass=\"mag\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"mini\",ActingAddress=\"10.150.30.95\",ActionSourceUser=\"tur\",ActionTargetUser=\"atnonpr\",ActionObject=\"ita\",ActionSafe=\"amquaer\",ActionLocation=\"aqui\",ActionCategory=\"enby\",ActionRequestId=\"lpa\",ActionReason=\"isn\",ActionExtraDetails=\"smod\"", + "file.directory": "aqui", + "file.name": "ita", + "fileset.name": "corepas", + "host.ip": "10.150.30.95", + "input.type": "log", + "log.level": "very-high", + "log.offset": 31238, + "observer.product": "ptate", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3830", + "related.ip": [ + "10.150.30.95" + ], + "related.user": [ + "mini", + "uisnos", + "atnonpr" + ], + "rsa.db.index": "smod", + "rsa.internal.event_desc": "isn", + "rsa.internal.messageid": "261", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "enby", + "rsa.misc.group_object": "amquaer", + "rsa.misc.reference_id": "ntut", + "rsa.misc.reference_id1": "lpa", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3830", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mini" + }, + { + "event.action": "deny", + "event.code": "inesciu", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "August 29 14:59:40 siuta %CYBERARK: MessageID=\"66\";atev 1.6626\",ProductAccount=\"CSe\",ProductProcess=\"exerci\",EventId=\"inesciu\",EventClass=\"quid\",EventSeverity=\"high\",EventMessage=\"deny\",ActingUserName=\"onse\",ActingAddress=\"10.98.71.45\",ActionSourceUser=\"destla\",ActionTargetUser=\"fugitse\",ActionObject=\"minimve\",ActionSafe=\"serrorsi\",ActionLocation=\"tametco\",ActionCategory=\"mquisnos\",ActionRequestId=\"lore\",ActionReason=\"isci\",ActionExtraDetails=\"Dui\"", + "file.directory": "tametco", + "file.name": "minimve", + "fileset.name": "corepas", + "host.ip": "10.98.71.45", + "input.type": "log", + "log.level": "high", + "log.offset": 31683, + "observer.product": "atev", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6626", + "related.ip": [ + "10.98.71.45" + ], + "related.user": [ + "CSe", + "fugitse", + "onse" + ], + "rsa.db.index": "Dui", + "rsa.internal.event_desc": "isci", + "rsa.internal.messageid": "66", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "mquisnos", + "rsa.misc.group_object": "serrorsi", + "rsa.misc.reference_id": "inesciu", + "rsa.misc.reference_id1": "lore", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.6626", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "onse" + }, + { + "event.action": "deny", + "event.code": "ianonnum", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "lup 2018-09-12 22:02:15.152538723 +0000 UTC iumtotam1010.www5.corp %CYBERARK: MessageID=\"168\";userror 1.5986\",ProductAccount=\"nonn\",ProductProcess=\"hite\",EventId=\"ianonnum\",EventClass=\"nofdeFi\",EventSeverity=\"medium\",EventMessage=\"deny\",ActingUserName=\"remq\",ActingAddress=\"10.252.251.143\",ActionSourceUser=\"velill\",ActionTargetUser=\"rspic\",ActionObject=\"orinrepr\",ActionSafe=\"ror\",ActionLocation=\"onsecte\",ActionCategory=\"doei\",ActionRequestId=\"nvolupta\",ActionReason=\"tev\",ActionExtraDetails=\"nre\"", + "file.directory": "onsecte", + "file.name": "orinrepr", + "fileset.name": "corepas", + "host.ip": "10.252.251.143", + "input.type": "log", + "log.level": "medium", + "log.offset": 32136, + "observer.product": "userror", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5986", + "related.ip": [ + "10.252.251.143" + ], + "related.user": [ + "remq", + "rspic", + "nonn" + ], + "rsa.db.index": "nre", + "rsa.internal.event_desc": "tev", + "rsa.internal.messageid": "168", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "doei", + "rsa.misc.group_object": "ror", + "rsa.misc.reference_id": "ianonnum", + "rsa.misc.reference_id1": "nvolupta", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5986", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "remq" + }, + { + "event.action": "accept", + "event.code": "lupta", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"274\";lumdolor 1.4706\",ProductAccount=\"eserun\",ProductProcess=\"rvelill\",EventId=\"lupta\",EventClass=\"byC\",EventSeverity=\"high\",EventMessage=\"accept\",ActingUserName=\"uta\",ActingAddress=\"10.197.203.167\",ActionSourceUser=\"ulapa\",ActionTargetUser=\"iumdo\",ActionObject=\"iusmodit\",ActionSafe=\"aturv\",ActionLocation=\"ectetura\",ActionCategory=\"obeataev\",ActionRequestId=\"umf\",ActionReason=\"olesti\",ActionExtraDetails=\"smo\"", + "file.directory": "ectetura", + "file.name": "iusmodit", + "fileset.name": "corepas", + "host.ip": "10.197.203.167", + "input.type": "log", + "log.level": "high", + "log.offset": 32636, + "observer.product": "lumdolor", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4706", + "related.ip": [ + "10.197.203.167" + ], + "related.user": [ + "eserun", + "iumdo", + "uta" + ], + "rsa.db.index": "smo", + "rsa.internal.event_desc": "olesti", + "rsa.internal.messageid": "274", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "obeataev", + "rsa.misc.group_object": "aturv", + "rsa.misc.reference_id": "lupta", + "rsa.misc.reference_id1": "umf", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4706", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "uta" + }, + { + "event.action": "accept", + "event.code": "tten", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "tDuis 2018-10-11 12:07:23.672538723 +0000 UTC iqu1643.www.host %CYBERARK: MessageID=\"96\";inim 1.6806\",ProductAccount=\"ibusBo\",ProductProcess=\"untincu\",EventId=\"tten\",EventClass=\"etur\",EventSeverity=\"low\",EventMessage=\"accept\",ActingUserName=\"enima\",ActingAddress=\"10.187.170.23\",ActionSourceUser=\"sequ\",ActionTargetUser=\"sectetu\",ActionObject=\"evi\",ActionSafe=\"tionula\",ActionLocation=\"accus\",ActionCategory=\"uatu\",ActionRequestId=\"mquis\",ActionReason=\"lab\",ActionExtraDetails=\"uido\"", + "file.directory": "accus", + "file.name": "evi", + "fileset.name": "corepas", + "host.ip": "10.187.170.23", + "input.type": "log", + "log.level": "low", + "log.offset": 33071, + "observer.product": "inim", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6806", + "related.ip": [ + "10.187.170.23" + ], + "related.user": [ + "sectetu", + "ibusBo", + "enima" + ], + "rsa.db.index": "uido", + "rsa.internal.event_desc": "lab", + "rsa.internal.messageid": "96", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "uatu", + "rsa.misc.group_object": "tionula", + "rsa.misc.reference_id": "tten", + "rsa.misc.reference_id1": "mquis", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.6806", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "enima" + }, + { + "destination.address": "udexerc2708.api.test", + "destination.port": 505, + "event.action": "allow", + "event.code": "61", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2018-10-25 19:09:57.932538723 +0000 UTC nimadmin5577.corp %CYBERARK: MessageID=\"61\";Version=1.3824;Message=allow;Issuer=tinculpa;Station=10.123.62.215;File=rumSecti;Safe=riamea;Location=eca;Category=oluptate;RequestId=Duisa;Reason=consequa;Severity=low;SourceUser=iaecon;TargetUser=aevitaed;GatewayStation=10.250.248.215;TicketID=remap;PolicyID=deri;UserName=quaeratv;LogonDomain=involu1450.www.localhost;Address=udexerc2708.api.test;CPMStatus=odic;Port=505;Database=lica;DeviceType=secil;ExtraDetails=uisnos;", + "file.directory": "eca", + "file.name": "rumSecti", + "fileset.name": "corepas", + "group.name": "iaecon", + "host.ip": "10.123.62.215", + "input.type": "log", + "log.level": "low", + "log.offset": 33555, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3824", + "related.ip": [ + "10.123.62.215", + "10.250.248.215" + ], + "related.user": [ + "aevitaed", + "quaeratv", + "tinculpa" + ], + "rsa.db.database": "lica", + "rsa.db.index": "uisnos", + "rsa.internal.event_desc": "consequa", + "rsa.internal.messageid": "61", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "oluptate", + "rsa.misc.disposition": "odic", + "rsa.misc.group": "iaecon", + "rsa.misc.group_object": "riamea", + "rsa.misc.obj_type": "secil", + "rsa.misc.operation_id": "remap", + "rsa.misc.policy_name": "deri", + "rsa.misc.reference_id": "61", + "rsa.misc.reference_id1": "Duisa", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3824", + "rsa.network.domain": "involu1450.www.localhost", + "rsa.network.host_dst": "udexerc2708.api.test", + "server.domain": "involu1450.www.localhost", + "service.type": "cyberark", + "source.ip": [ + "10.250.248.215" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tinculpa" + }, + { + "destination.address": "temvele5776.www.test", + "destination.port": 864, + "event.action": "block", + "event.code": "372", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "scipit 2018-11-09 02:12:32.192538723 +0000 UTC lloinve551.internal.local %CYBERARK: MessageID=\"372\";Version=1.3759;Message=block;Issuer=isiutali;Station=10.146.57.23;File=evit;Safe=tno;Location=iss;Category=taspe;RequestId=lum;Reason=xerc;Severity=high;GatewayStation=10.147.154.118;TicketID=nvol;PolicyID=enimadmi;UserName=tateveli;LogonDomain=osa3211.www5.example;Address=temvele5776.www.test;CPMStatus=inimve;Port=\"864\";Database=cin;DeviceType=tmo;ExtraDetails=onofdeF;", + "file.directory": "iss", + "file.name": "evit", + "fileset.name": "corepas", + "host.ip": "10.146.57.23", + "input.type": "log", + "log.level": "high", + "log.offset": 34065, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3759", + "related.ip": [ + "10.147.154.118", + "10.146.57.23" + ], + "related.user": [ + "tateveli", + "isiutali" + ], + "rsa.db.database": "cin", + "rsa.db.index": "onofdeF", + "rsa.internal.event_desc": "xerc", + "rsa.internal.messageid": "372", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "taspe", + "rsa.misc.disposition": "inimve", + "rsa.misc.group_object": "tno", + "rsa.misc.obj_type": "tmo", + "rsa.misc.operation_id": "nvol", + "rsa.misc.policy_name": "enimadmi", + "rsa.misc.reference_id": "372", + "rsa.misc.reference_id1": "lum", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3759", + "rsa.network.domain": "osa3211.www5.example", + "rsa.network.host_dst": "temvele5776.www.test", + "server.domain": "osa3211.www5.example", + "service.type": "cyberark", + "source.ip": [ + "10.147.154.118" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "isiutali" + }, + { + "event.action": "cancel", + "event.code": "tlabo", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "its 2018-11-23 09:15:06.452538723 +0000 UTC uptasnul2751.www5.corp %CYBERARK: MessageID=\"232\";ostrudex 1.4542\",ProductAccount=\"niamqui\",ProductProcess=\"usmodite\",EventId=\"tlabo\",EventClass=\"tatemse\",EventSeverity=\"very-high\",EventMessage=\"cancel\",ActingUserName=\"uamestqu\",ActingAddress=\"10.193.33.201\",ActionSourceUser=\"hender\",ActionTargetUser=\"ptatemU\",ActionObject=\"seq\",ActionSafe=\"rumSe\",ActionLocation=\"tatnonp\",ActionCategory=\"ommo\",ActionRequestId=\"adeser\",ActionReason=\"uasiarc\",ActionExtraDetails=\"doeiu\"", + "file.directory": "tatnonp", + "file.name": "seq", + "fileset.name": "corepas", + "host.ip": "10.193.33.201", + "input.type": "log", + "log.level": "very-high", + "log.offset": 34538, + "observer.product": "ostrudex", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4542", + "related.ip": [ + "10.193.33.201" + ], + "related.user": [ + "niamqui", + "ptatemU", + "uamestqu" + ], + "rsa.db.index": "doeiu", + "rsa.internal.event_desc": "uasiarc", + "rsa.internal.messageid": "232", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "ommo", + "rsa.misc.group_object": "rumSe", + "rsa.misc.reference_id": "tlabo", + "rsa.misc.reference_id1": "adeser", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4542", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "uamestqu" + }, + { + "event.action": "block", + "event.code": "iuntN", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2018-12-07 16:17:40.712538723 +0000 UTC atuserro6791.internal.host %CYBERARK: MessageID=\"24\";upta 1.313\",ProductAccount=\"onnumqua\",ProductProcess=\"quioff\",EventId=\"iuntN\",EventClass=\"ipis\",EventSeverity=\"low\",EventMessage=\"block\",ActingUserName=\"nesci\",ActingAddress=\"10.154.172.82\",ActionSourceUser=\"lorsi\",ActionTargetUser=\"tetura\",ActionObject=\"eeufug\",ActionSafe=\"edutper\",ActionLocation=\"tevelite\",ActionCategory=\"tocca\",ActionRequestId=\"orsitvol\",ActionReason=\"ntor\",ActionExtraDetails=\"oinBCSed\"", + "file.directory": "tevelite", + "file.name": "eeufug", + "fileset.name": "corepas", + "host.ip": "10.154.172.82", + "input.type": "log", + "log.level": "low", + "log.offset": 35054, + "observer.product": "upta", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.313", + "related.ip": [ + "10.154.172.82" + ], + "related.user": [ + "nesci", + "onnumqua", + "tetura" + ], + "rsa.db.index": "oinBCSed", + "rsa.internal.event_desc": "ntor", + "rsa.internal.messageid": "24", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "tocca", + "rsa.misc.group_object": "edutper", + "rsa.misc.reference_id": "iuntN", + "rsa.misc.reference_id1": "orsitvol", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.313", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "nesci" + }, + { + "event.action": "allow", + "event.code": "avolu", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"79\";obeatae 1.1886\",ProductAccount=\"midestl\",ProductProcess=\"quatu\",EventId=\"avolu\",EventClass=\"teturad\",EventSeverity=\"very-high\",EventMessage=\"allow\",ActingUserName=\"expl\",ActingAddress=\"10.47.63.70\",ActionSourceUser=\"lup\",ActionTargetUser=\"tpers\",ActionObject=\"orsitv\",ActionSafe=\"temseq\",ActionLocation=\"uisaute\",ActionCategory=\"uun\",ActionRequestId=\"end\",ActionReason=\"odocons\",ActionExtraDetails=\"olu\"", + "file.directory": "uisaute", + "file.name": "orsitv", + "fileset.name": "corepas", + "host.ip": "10.47.63.70", + "input.type": "log", + "log.level": "very-high", + "log.offset": 35557, + "observer.product": "obeatae", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1886", + "related.ip": [ + "10.47.63.70" + ], + "related.user": [ + "midestl", + "tpers", + "expl" + ], + "rsa.db.index": "olu", + "rsa.internal.event_desc": "odocons", + "rsa.internal.messageid": "79", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "uun", + "rsa.misc.group_object": "temseq", + "rsa.misc.reference_id": "avolu", + "rsa.misc.reference_id1": "end", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1886", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "expl" + }, + { + "event.action": "block", + "event.code": "ectobea", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "January 5 06:22:49 amn %CYBERARK: MessageID=\"312\";itessequ 1.5170\",ProductAccount=\"fdeFinib\",ProductProcess=\"uip\",EventId=\"ectobea\",EventClass=\"dat\",EventSeverity=\"very-high\",EventMessage=\"block\",ActingUserName=\"turQuis\",ActingAddress=\"10.178.160.245\",ActionSourceUser=\"deomnisi\",ActionTargetUser=\"olupta\",ActionObject=\"oll\",ActionSafe=\"laboree\",ActionLocation=\"udantiu\",ActionCategory=\"itametco\",ActionRequestId=\"iav\",ActionReason=\"odico\",ActionExtraDetails=\"rsint\"", + "file.directory": "udantiu", + "file.name": "oll", + "fileset.name": "corepas", + "host.ip": "10.178.160.245", + "input.type": "log", + "log.level": "very-high", + "log.offset": 35987, + "observer.product": "itessequ", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5170", + "related.ip": [ + "10.178.160.245" + ], + "related.user": [ + "turQuis", + "olupta", + "fdeFinib" + ], + "rsa.db.index": "rsint", + "rsa.internal.event_desc": "odico", + "rsa.internal.messageid": "312", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "itametco", + "rsa.misc.group_object": "laboree", + "rsa.misc.reference_id": "ectobea", + "rsa.misc.reference_id1": "iav", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.5170", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "turQuis" + }, + { + "destination.address": "teursint1321.www5.example", + "destination.port": 7024, + "event.action": "block", + "event.code": "77", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "January 19 13:25:23 quiav %CYBERARK: MessageID=\"77\";Version=1.6648;Message=block;Issuer=Nem;Station=10.85.13.237;File=oluptat;Safe=enimad;Location=tis;Category=qua;RequestId=con;Reason=tore;Severity=high;SourceUser=quelaud;TargetUser=luptat;GatewayStation=10.89.154.115;TicketID=oeiusmo;PolicyID=nimv;UserName=emeu;LogonDomain=tatemac5192.www5.test;Address=teursint1321.www5.example;CPMStatus=lamcolab;Port=7024;Database=nturmag;DeviceType=uredol;ExtraDetails=maliqua;", + "file.directory": "tis", + "file.name": "oluptat", + "fileset.name": "corepas", + "group.name": "quelaud", + "host.ip": "10.85.13.237", + "input.type": "log", + "log.level": "high", + "log.offset": 36454, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6648", + "related.ip": [ + "10.89.154.115", + "10.85.13.237" + ], + "related.user": [ + "emeu", + "luptat", + "Nem" + ], + "rsa.db.database": "nturmag", + "rsa.db.index": "maliqua", + "rsa.internal.event_desc": "tore", + "rsa.internal.messageid": "77", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "qua", + "rsa.misc.disposition": "lamcolab", + "rsa.misc.group": "quelaud", + "rsa.misc.group_object": "enimad", + "rsa.misc.obj_type": "uredol", + "rsa.misc.operation_id": "oeiusmo", + "rsa.misc.policy_name": "nimv", + "rsa.misc.reference_id": "77", + "rsa.misc.reference_id1": "con", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.6648", + "rsa.network.domain": "tatemac5192.www5.test", + "rsa.network.host_dst": "teursint1321.www5.example", + "server.domain": "tatemac5192.www5.test", + "service.type": "cyberark", + "source.ip": [ + "10.89.154.115" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "Nem" + }, + { + "destination.address": "boreet2051.internal.localdomain", + "destination.port": 1644, + "event.action": "allow", + "event.code": "308", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2019-02-02 20:27:57.752538723 +0000 UTC omnisi5530.mail.example %CYBERARK: MessageID=\"308\";Version=1.3387;Message=allow;Issuer=itame;Station=10.222.32.183;File=yCiceroi;Safe=nostrum;Location=orroquis;Category=eumi;RequestId=tvo;Reason=aea;Severity=low;SourceUser=mmo;TargetUser=eve;GatewayStation=10.65.207.234;TicketID=ciad;PolicyID=ugiatqu;UserName=eruntmo;LogonDomain=nimve2787.mail.test;Address=boreet2051.internal.localdomain;CPMStatus=iavo;Port=1644;Database=udexerc;DeviceType=ovolupta;ExtraDetails=volup;", + "file.directory": "orroquis", + "file.name": "yCiceroi", + "fileset.name": "corepas", + "group.name": "mmo", + "host.ip": "10.222.32.183", + "input.type": "log", + "log.level": "low", + "log.offset": 36923, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3387", + "related.ip": [ + "10.65.207.234", + "10.222.32.183" + ], + "related.user": [ + "eruntmo", + "itame", + "eve" + ], + "rsa.db.database": "udexerc", + "rsa.db.index": "volup", + "rsa.internal.event_desc": "aea", + "rsa.internal.messageid": "308", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "eumi", + "rsa.misc.disposition": "iavo", + "rsa.misc.group": "mmo", + "rsa.misc.group_object": "nostrum", + "rsa.misc.obj_type": "ovolupta", + "rsa.misc.operation_id": "ciad", + "rsa.misc.policy_name": "ugiatqu", + "rsa.misc.reference_id": "308", + "rsa.misc.reference_id1": "tvo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3387", + "rsa.network.domain": "nimve2787.mail.test", + "rsa.network.host_dst": "boreet2051.internal.localdomain", + "server.domain": "nimve2787.mail.test", + "service.type": "cyberark", + "source.ip": [ + "10.65.207.234" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "itame" + }, + { + "event.action": "cancel", + "event.code": "edqu", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "rro 2019-02-17 03:30:32.012538723 +0000 UTC tuser6944.local %CYBERARK: MessageID=\"54\";iarchite 1.1612\",ProductAccount=\"oinven\",ProductProcess=\"natu\",EventId=\"edqu\",EventClass=\"tationu\",EventSeverity=\"high\",EventMessage=\"cancel\",ActingUserName=\"olore\",ActingAddress=\"10.16.181.60\",ActionSourceUser=\"ameaquei\",ActionTargetUser=\"gnama\",ActionObject=\"esciun\",ActionSafe=\"tesse\",ActionLocation=\"olupta\",ActionCategory=\"isno\",ActionRequestId=\"oluptas\",ActionReason=\"nderiti\",ActionExtraDetails=\"uatu\"", + "file.directory": "olupta", + "file.name": "esciun", + "fileset.name": "corepas", + "host.ip": "10.16.181.60", + "input.type": "log", + "log.level": "high", + "log.offset": 37436, + "observer.product": "iarchite", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1612", + "related.ip": [ + "10.16.181.60" + ], + "related.user": [ + "gnama", + "oinven", + "olore" + ], + "rsa.db.index": "uatu", + "rsa.internal.event_desc": "nderiti", + "rsa.internal.messageid": "54", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "isno", + "rsa.misc.group_object": "tesse", + "rsa.misc.reference_id": "edqu", + "rsa.misc.reference_id1": "oluptas", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1612", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "olore" + }, + { + "event.action": "deny", + "event.code": "onse", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "orem 2019-03-03 10:33:06.272538723 +0000 UTC giatqu1484.internal.corp %CYBERARK: MessageID=\"208\";oreseosq 1.2275\",ProductAccount=\"uianon\",ProductProcess=\"nul\",EventId=\"onse\",EventClass=\"sitam\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"illoin\",ActingAddress=\"10.91.213.82\",ActionSourceUser=\"uid\",ActionTargetUser=\"amnis\",ActionObject=\"rvelil\",ActionSafe=\"adese\",ActionLocation=\"olorsi\",ActionCategory=\"caboNemo\",ActionRequestId=\"uptas\",ActionReason=\"temaccus\",ActionExtraDetails=\"ons\"", + "file.directory": "olorsi", + "file.name": "rvelil", + "fileset.name": "corepas", + "host.ip": "10.91.213.82", + "input.type": "log", + "log.level": "very-high", + "log.offset": 37931, + "observer.product": "oreseosq", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2275", + "related.ip": [ + "10.91.213.82" + ], + "related.user": [ + "illoin", + "uianon", + "amnis" + ], + "rsa.db.index": "ons", + "rsa.internal.event_desc": "temaccus", + "rsa.internal.messageid": "208", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "caboNemo", + "rsa.misc.group_object": "adese", + "rsa.misc.reference_id": "onse", + "rsa.misc.reference_id1": "uptas", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2275", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "illoin" + }, + { + "event.action": "allow", + "event.code": "iaeconse", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2019-03-17 17:35:40.532538723 +0000 UTC oreeu3666.invalid %CYBERARK: MessageID=\"48\";tis 1.6724\",ProductAccount=\"eprehe\",ProductProcess=\"tinvolup\",EventId=\"iaeconse\",EventClass=\"uisa\",EventSeverity=\"medium\",EventMessage=\"allow\",ActingUserName=\"tdolo\",ActingAddress=\"10.204.214.98\",ActionSourceUser=\"iumt\",ActionTargetUser=\"porissus\",ActionObject=\"imip\",ActionSafe=\"tsunt\",ActionLocation=\"rnat\",ActionCategory=\"oremi\",ActionRequestId=\"ectobeat\",ActionReason=\"ecte\",ActionExtraDetails=\"abo\"", + "file.directory": "rnat", + "file.name": "imip", + "fileset.name": "corepas", + "host.ip": "10.204.214.98", + "input.type": "log", + "log.level": "medium", + "log.offset": 38435, + "observer.product": "tis", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6724", + "related.ip": [ + "10.204.214.98" + ], + "related.user": [ + "eprehe", + "porissus", + "tdolo" + ], + "rsa.db.index": "abo", + "rsa.internal.event_desc": "ecte", + "rsa.internal.messageid": "48", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "oremi", + "rsa.misc.group_object": "tsunt", + "rsa.misc.reference_id": "iaeconse", + "rsa.misc.reference_id1": "ectobeat", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6724", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "tdolo" + }, + { + "event.action": "accept", + "event.code": "tium", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"219\";snos 1.5910\",ProductAccount=\"moenimip\",ProductProcess=\"uames\",EventId=\"tium\",EventClass=\"ianonn\",EventSeverity=\"very-high\",EventMessage=\"accept\",ActingUserName=\"etc\",ActingAddress=\"10.223.178.192\",ActionSourceUser=\"atquovol\",ActionTargetUser=\"evel\",ActionObject=\"edol\",ActionSafe=\"sequuntu\",ActionLocation=\"quameius\",ActionCategory=\"litse\",ActionRequestId=\"san\",ActionReason=\"apari\",ActionExtraDetails=\"iarchit\"", + "file.directory": "quameius", + "file.name": "edol", + "fileset.name": "corepas", + "host.ip": "10.223.178.192", + "input.type": "log", + "log.level": "very-high", + "log.offset": 38923, + "observer.product": "snos", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5910", + "related.ip": [ + "10.223.178.192" + ], + "related.user": [ + "moenimip", + "evel", + "etc" + ], + "rsa.db.index": "iarchit", + "rsa.internal.event_desc": "apari", + "rsa.internal.messageid": "219", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "litse", + "rsa.misc.group_object": "sequuntu", + "rsa.misc.reference_id": "tium", + "rsa.misc.reference_id1": "san", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.5910", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "etc" + }, + { + "destination.address": "umto3015.mail.lan", + "destination.port": 4667, + "event.action": "cancel", + "event.code": "183", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2019-04-15 07:40:49.052538723 +0000 UTC nsequat6724.www.invalid %CYBERARK: MessageID=\"183\";Version=1.801;Message=cancel;Issuer=ati;Station=10.26.137.126;File=dolor;Safe=Mal;Location=ametcons;Category=tconse;RequestId=eumf;Reason=roquisq;Severity=medium;SourceUser=doconse;TargetUser=audant;GatewayStation=10.26.33.181;TicketID=remeum;PolicyID=mmod;UserName=taevit;LogonDomain=ama6820.mail.example;Address=umto3015.mail.lan;CPMStatus=sitv;Port=4667;Database=com;DeviceType=rep;ExtraDetails=mveni;", + "file.directory": "ametcons", + "file.name": "dolor", + "fileset.name": "corepas", + "group.name": "doconse", + "host.ip": "10.26.137.126", + "input.type": "log", + "log.level": "medium", + "log.offset": 39362, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.801", + "related.ip": [ + "10.26.137.126", + "10.26.33.181" + ], + "related.user": [ + "ati", + "audant", + "taevit" + ], + "rsa.db.database": "com", + "rsa.db.index": "mveni", + "rsa.internal.event_desc": "roquisq", + "rsa.internal.messageid": "183", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "tconse", + "rsa.misc.disposition": "sitv", + "rsa.misc.group": "doconse", + "rsa.misc.group_object": "Mal", + "rsa.misc.obj_type": "rep", + "rsa.misc.operation_id": "remeum", + "rsa.misc.policy_name": "mmod", + "rsa.misc.reference_id": "183", + "rsa.misc.reference_id1": "eumf", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.801", + "rsa.network.domain": "ama6820.mail.example", + "rsa.network.host_dst": "umto3015.mail.lan", + "server.domain": "ama6820.mail.example", + "service.type": "cyberark", + "source.ip": [ + "10.26.33.181" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ati" + }, + { + "destination.address": "etquasia1800.www.host", + "destination.port": 7612, + "event.action": "accept", + "event.code": "41", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "April 29 14:43:23 num %CYBERARK: MessageID=\"41\";Version=1.10;Message=accept;Issuer=quaerat;Station=10.148.195.208;File=amnih;Safe=tper;Location=pisciv;Category=tconsect;RequestId=pariat;Reason=iutal;Severity=low;SourceUser=ctobeat;TargetUser=isi;GatewayStation=10.142.161.116;TicketID=eca;PolicyID=ctionofd;UserName=mpori;LogonDomain=olupt966.www5.corp;Address=etquasia1800.www.host;CPMStatus=nimip;Port=7612;Database=squamest;DeviceType=quisn;ExtraDetails=pteu;", + "file.directory": "pisciv", + "file.name": "amnih", + "fileset.name": "corepas", + "group.name": "ctobeat", + "host.ip": "10.148.195.208", + "input.type": "log", + "log.level": "low", + "log.offset": 39858, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.10", + "related.ip": [ + "10.148.195.208", + "10.142.161.116" + ], + "related.user": [ + "quaerat", + "isi", + "mpori" + ], + "rsa.db.database": "squamest", + "rsa.db.index": "pteu", + "rsa.internal.event_desc": "iutal", + "rsa.internal.messageid": "41", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "tconsect", + "rsa.misc.disposition": "nimip", + "rsa.misc.group": "ctobeat", + "rsa.misc.group_object": "tper", + "rsa.misc.obj_type": "quisn", + "rsa.misc.operation_id": "eca", + "rsa.misc.policy_name": "ctionofd", + "rsa.misc.reference_id": "41", + "rsa.misc.reference_id1": "pariat", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.10", + "rsa.network.domain": "olupt966.www5.corp", + "rsa.network.host_dst": "etquasia1800.www.host", + "server.domain": "olupt966.www5.corp", + "service.type": "cyberark", + "source.ip": [ + "10.142.161.116" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "quaerat" + }, + { + "destination.address": "quisquam2153.mail.host", + "destination.port": 2717, + "event.action": "block", + "event.code": "270", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "velillum 2019-05-13 21:45:57.572538723 +0000 UTC ntNequ7639.internal.localdomain %CYBERARK: MessageID=\"270\";Version=1.1026;Message=block;Issuer=itinvo;Station=10.107.24.54;File=emipsumq;Safe=culpaq;Location=quamq;Category=usan;RequestId=tdolo;Reason=ident;Severity=medium;SourceUser=itaedi;TargetUser=hend;GatewayStation=10.10.174.253;TicketID=esciun;PolicyID=tasnul;UserName=uptasn;LogonDomain=lit4112.www.localhost;Address=quisquam2153.mail.host;CPMStatus=dit;Port=2717;Database=lup;DeviceType=aeca;ExtraDetails=isau;", + "file.directory": "quamq", + "file.name": "emipsumq", + "fileset.name": "corepas", + "group.name": "itaedi", + "host.ip": "10.107.24.54", + "input.type": "log", + "log.level": "medium", + "log.offset": 40321, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.1026", + "related.ip": [ + "10.10.174.253", + "10.107.24.54" + ], + "related.user": [ + "hend", + "itinvo", + "uptasn" + ], + "rsa.db.database": "lup", + "rsa.db.index": "isau", + "rsa.internal.event_desc": "ident", + "rsa.internal.messageid": "270", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "usan", + "rsa.misc.disposition": "dit", + "rsa.misc.group": "itaedi", + "rsa.misc.group_object": "culpaq", + "rsa.misc.obj_type": "aeca", + "rsa.misc.operation_id": "esciun", + "rsa.misc.policy_name": "tasnul", + "rsa.misc.reference_id": "270", + "rsa.misc.reference_id1": "tdolo", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.1026", + "rsa.network.domain": "lit4112.www.localhost", + "rsa.network.host_dst": "quisquam2153.mail.host", + "server.domain": "lit4112.www.localhost", + "service.type": "cyberark", + "source.ip": [ + "10.10.174.253" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "itinvo" + }, + { + "event.action": "deny", + "event.code": "iades", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "May 28 04:48:31 boreetd %CYBERARK: MessageID=\"309\";tNe 1.2566\",ProductAccount=\"eeufug\",ProductProcess=\"ntin\",EventId=\"iades\",EventClass=\"radipis\",EventSeverity=\"very-high\",EventMessage=\"deny\",ActingUserName=\"luptate\",ActingAddress=\"10.87.92.17\",ActionSourceUser=\"utlabore\",ActionTargetUser=\"tamr\",ActionObject=\"serr\",ActionSafe=\"usci\",ActionLocation=\"unturmag\",ActionCategory=\"dexeaco\",ActionRequestId=\"lupta\",ActionReason=\"ura\",ActionExtraDetails=\"oreeufug\"", + "event.outcome": "failure", + "file.directory": "unturmag", + "file.name": "serr", + "fileset.name": "corepas", + "host.ip": "10.87.92.17", + "input.type": "log", + "log.level": "very-high", + "log.offset": 40841, + "observer.product": "tNe", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2566", + "related.ip": [ + "10.87.92.17" + ], + "related.user": [ + "luptate", + "eeufug", + "tamr" + ], + "rsa.db.index": "oreeufug", + "rsa.internal.event_desc": "ura", + "rsa.internal.messageid": "309", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "dexeaco", + "rsa.misc.group_object": "usci", + "rsa.misc.reference_id": "iades", + "rsa.misc.reference_id1": "lupta", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2566", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "luptate" + }, + { + "destination.address": "secte1774.localhost", + "destination.port": 5200, + "event.action": "deny", + "event.code": "295", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "June 11 11:51:06 dolo %CYBERARK: MessageID=\"295\";Version=1.5649;Message=deny;Issuer=Finibus;Station=10.161.51.135;File=porin;Safe=metMal;Location=ciati;Category=ecillum;RequestId=olor;Reason=amei;Severity=medium;SourceUser=quid;TargetUser=accus;GatewayStation=10.231.51.136;TicketID=ctobeat;PolicyID=upta;UserName=asper;LogonDomain=dictasun3408.internal.invalid;Address=secte1774.localhost;CPMStatus=iqui;Port=5200;Database=litani;DeviceType=emp;ExtraDetails=arch;", + "file.directory": "ciati", + "file.name": "porin", + "fileset.name": "corepas", + "group.name": "quid", + "host.ip": "10.161.51.135", + "input.type": "log", + "log.level": "medium", + "log.offset": 41300, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.5649", + "related.ip": [ + "10.161.51.135", + "10.231.51.136" + ], + "related.user": [ + "asper", + "Finibus", + "accus" + ], + "rsa.db.database": "litani", + "rsa.db.index": "arch", + "rsa.internal.event_desc": "amei", + "rsa.internal.messageid": "295", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "ecillum", + "rsa.misc.disposition": "iqui", + "rsa.misc.group": "quid", + "rsa.misc.group_object": "metMal", + "rsa.misc.obj_type": "emp", + "rsa.misc.operation_id": "ctobeat", + "rsa.misc.policy_name": "upta", + "rsa.misc.reference_id": "295", + "rsa.misc.reference_id1": "olor", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5649", + "rsa.network.domain": "dictasun3408.internal.invalid", + "rsa.network.host_dst": "secte1774.localhost", + "server.domain": "dictasun3408.internal.invalid", + "service.type": "cyberark", + "source.ip": [ + "10.231.51.136" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "Finibus" + }, + { + "event.action": "allow", + "event.code": "cia", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "June 25 18:53:40 dipisciv %CYBERARK: MessageID=\"148\";uam 1.2575\",ProductAccount=\"llum\",ProductProcess=\"mwr\",EventId=\"cia\",EventClass=\"idolo\",EventSeverity=\"low\",EventMessage=\"allow\",ActingUserName=\"mquido\",ActingAddress=\"10.51.17.32\",ActionSourceUser=\"ree\",ActionTargetUser=\"itten\",ActionObject=\"quipexea\",ActionSafe=\"orsitv\",ActionLocation=\"dunt\",ActionCategory=\"int\",ActionRequestId=\"ionevo\",ActionReason=\"llitani\",ActionExtraDetails=\"uscipit\"", + "file.directory": "dunt", + "file.name": "quipexea", + "fileset.name": "corepas", + "host.ip": "10.51.17.32", + "input.type": "log", + "log.level": "low", + "log.offset": 41765, + "observer.product": "uam", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2575", + "related.ip": [ + "10.51.17.32" + ], + "related.user": [ + "itten", + "mquido", + "llum" + ], + "rsa.db.index": "uscipit", + "rsa.internal.event_desc": "llitani", + "rsa.internal.messageid": "148", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "int", + "rsa.misc.group_object": "orsitv", + "rsa.misc.reference_id": "cia", + "rsa.misc.reference_id1": "ionevo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2575", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "mquido" + }, + { + "event.action": "deny", + "event.code": "mquisno", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "etco 2019-07-10 01:56:14.612538723 +0000 UTC iuntN4077.www.invalid %CYBERARK: MessageID=\"260\";isnostru 1.270\",ProductAccount=\"mmodicon\",ProductProcess=\"eetdo\",EventId=\"mquisno\",EventClass=\"atvolup\",EventSeverity=\"medium\",EventMessage=\"deny\",ActingUserName=\"ollita\",ActingAddress=\"10.108.123.148\",ActionSourceUser=\"cto\",ActionTargetUser=\"cusa\",ActionObject=\"nderi\",ActionSafe=\"tem\",ActionLocation=\"tcu\",ActionCategory=\"eumiu\",ActionRequestId=\"nim\",ActionReason=\"pteurs\",ActionExtraDetails=\"ercitati\"", + "file.directory": "tcu", + "file.name": "nderi", + "fileset.name": "corepas", + "host.ip": "10.108.123.148", + "input.type": "log", + "log.level": "medium", + "log.offset": 42211, + "observer.product": "isnostru", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.270", + "related.ip": [ + "10.108.123.148" + ], + "related.user": [ + "mmodicon", + "cusa", + "ollita" + ], + "rsa.db.index": "ercitati", + "rsa.internal.event_desc": "pteurs", + "rsa.internal.messageid": "260", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "eumiu", + "rsa.misc.group_object": "tem", + "rsa.misc.reference_id": "mquisno", + "rsa.misc.reference_id1": "nim", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.270", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ollita" + }, + { + "destination.address": "uido2773.www5.test", + "destination.port": 3820, + "event.action": "accept", + "event.code": "8", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "July 24 08:58:48 eturadip %CYBERARK: MessageID=\"8\";Version=1.425;Message=accept;Issuer=rsitamet;Station=10.114.0.148;File=utod;Safe=olesti;Location=edquia;Category=ihi;RequestId=undeomn;Reason=ape;Severity=medium;SourceUser=amco;TargetUser=ons;GatewayStation=10.198.187.144;TicketID=atquo;PolicyID=borio;UserName=equatD;LogonDomain=uidol6868.mail.localdomain;Address=uido2773.www5.test;CPMStatus=acons;Port=3820;Database=periam;DeviceType=ain;ExtraDetails=umiurer;", + "event.outcome": "success", + "file.directory": "edquia", + "file.name": "utod", + "fileset.name": "corepas", + "group.name": "amco", + "host.ip": "10.114.0.148", + "input.type": "log", + "log.level": "medium", + "log.offset": 42710, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.425", + "related.ip": [ + "10.198.187.144", + "10.114.0.148" + ], + "related.user": [ + "equatD", + "rsitamet", + "ons" + ], + "rsa.db.database": "periam", + "rsa.db.index": "umiurer", + "rsa.internal.event_desc": "ape", + "rsa.internal.messageid": "8", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "ihi", + "rsa.misc.disposition": "acons", + "rsa.misc.group": "amco", + "rsa.misc.group_object": "olesti", + "rsa.misc.obj_type": "ain", + "rsa.misc.operation_id": "atquo", + "rsa.misc.policy_name": "borio", + "rsa.misc.reference_id": "8", + "rsa.misc.reference_id1": "undeomn", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.425", + "rsa.network.domain": "uidol6868.mail.localdomain", + "rsa.network.host_dst": "uido2773.www5.test", + "server.domain": "uidol6868.mail.localdomain", + "service.type": "cyberark", + "source.ip": [ + "10.198.187.144" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "rsitamet" + }, + { + "event.action": "allow", + "event.code": "litess", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "onorume 2019-08-07 16:01:23.132538723 +0000 UTC abill5290.lan %CYBERARK: MessageID=\"89\";mini 1.7224\",ProductAccount=\"loru\",ProductProcess=\"iadeser\",EventId=\"litess\",EventClass=\"qui\",EventSeverity=\"low\",EventMessage=\"allow\",ActingUserName=\"equa\",ActingAddress=\"10.61.140.120\",ActionSourceUser=\"olorsit\",ActionTargetUser=\"naaliq\",ActionObject=\"plica\",ActionSafe=\"asiarc\",ActionLocation=\"lor\",ActionCategory=\"nvolupt\",ActionRequestId=\"dquia\",ActionReason=\"ora\",ActionExtraDetails=\"umfugiat\"", + "file.directory": "lor", + "file.name": "plica", + "fileset.name": "corepas", + "host.ip": "10.61.140.120", + "input.type": "log", + "log.level": "low", + "log.offset": 43175, + "observer.product": "mini", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7224", + "related.ip": [ + "10.61.140.120" + ], + "related.user": [ + "loru", + "naaliq", + "equa" + ], + "rsa.db.index": "umfugiat", + "rsa.internal.event_desc": "ora", + "rsa.internal.messageid": "89", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "nvolupt", + "rsa.misc.group_object": "asiarc", + "rsa.misc.reference_id": "litess", + "rsa.misc.reference_id1": "dquia", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7224", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "equa" + }, + { + "destination.address": "quame1852.www.test", + "destination.port": 4512, + "event.action": "deny", + "event.code": "36", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"36\";Version=1.6988;Message=deny;Issuer=ite;Station=10.93.24.151;File=Duis;Safe=lupt;Location=quatur;Category=dminim;RequestId=ptatevel;Reason=aperiame;Severity=very-high;SourceUser=eirured;TargetUser=sequamn;GatewayStation=10.149.238.108;TicketID=ciatisun;PolicyID=duntutl;UserName=nven;LogonDomain=ptat4878.lan;Address=quame1852.www.test;CPMStatus=deomni;Port=4512;Database=fugi;DeviceType=nse;ExtraDetails=nesciu;", + "file.directory": "quatur", + "file.name": "Duis", + "fileset.name": "corepas", + "group.name": "eirured", + "host.ip": "10.93.24.151", + "input.type": "log", + "log.level": "very-high", + "log.offset": 43663, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6988", + "related.ip": [ + "10.93.24.151", + "10.149.238.108" + ], + "related.user": [ + "nven", + "ite", + "sequamn" + ], + "rsa.db.database": "fugi", + "rsa.db.index": "nesciu", + "rsa.internal.event_desc": "aperiame", + "rsa.internal.messageid": "36", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "dminim", + "rsa.misc.disposition": "deomni", + "rsa.misc.group": "eirured", + "rsa.misc.group_object": "lupt", + "rsa.misc.obj_type": "nse", + "rsa.misc.operation_id": "ciatisun", + "rsa.misc.policy_name": "duntutl", + "rsa.misc.reference_id": "36", + "rsa.misc.reference_id1": "ptatevel", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6988", + "rsa.network.domain": "ptat4878.lan", + "rsa.network.host_dst": "quame1852.www.test", + "server.domain": "ptat4878.lan", + "service.type": "cyberark", + "source.ip": [ + "10.149.238.108" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ite" + }, + { + "event.action": "accept", + "event.code": "vel", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "September 5 06:06:31 inrepreh %CYBERARK: MessageID=\"39\";rit 1.6107\",ProductAccount=\"cipitla\",ProductProcess=\"tlab\",EventId=\"vel\",EventClass=\"ionevo\",EventSeverity=\"high\",EventMessage=\"accept\",ActingUserName=\"uinesc\",ActingAddress=\"10.101.45.225\",ActionSourceUser=\"utla\",ActionTargetUser=\"emi\",ActionObject=\"uaerat\",ActionSafe=\"iduntu\",ActionLocation=\"samvol\",ActionCategory=\"equa\",ActionRequestId=\"apari\",ActionReason=\"tsunt\",ActionExtraDetails=\"caecat\"", + "file.directory": "samvol", + "file.name": "uaerat", + "fileset.name": "corepas", + "host.ip": "10.101.45.225", + "input.type": "log", + "log.level": "high", + "log.offset": 44101, + "observer.product": "rit", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6107", + "related.ip": [ + "10.101.45.225" + ], + "related.user": [ + "cipitla", + "emi", + "uinesc" + ], + "rsa.db.index": "caecat", + "rsa.internal.event_desc": "tsunt", + "rsa.internal.messageid": "39", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "equa", + "rsa.misc.group_object": "iduntu", + "rsa.misc.reference_id": "vel", + "rsa.misc.reference_id1": "apari", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.6107", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "uinesc" + }, + { + "event.action": "cancel", + "event.code": "texplica", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "qui 2019-09-19 13:09:05.912538723 +0000 UTC caboN3124.mail.home %CYBERARK: MessageID=\"8\";catcupid 1.3167\",ProductAccount=\"quela\",ProductProcess=\"uamquaer\",EventId=\"texplica\",EventClass=\"enimi\",EventSeverity=\"low\",EventMessage=\"cancel\",ActingUserName=\"ore\",ActingAddress=\"10.2.204.161\",ActionSourceUser=\"iquamqu\",ActionTargetUser=\"eumfugia\",ActionObject=\"reeufugi\",ActionSafe=\"sequines\",ActionLocation=\"minimve\",ActionCategory=\"texplica\",ActionRequestId=\"entorev\",ActionReason=\"quuntur\",ActionExtraDetails=\"olup\"", + "event.outcome": "success", + "file.directory": "minimve", + "file.name": "reeufugi", + "fileset.name": "corepas", + "host.ip": "10.2.204.161", + "input.type": "log", + "log.level": "low", + "log.offset": 44555, + "observer.product": "catcupid", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3167", + "related.ip": [ + "10.2.204.161" + ], + "related.user": [ + "ore", + "quela", + "eumfugia" + ], + "rsa.db.index": "olup", + "rsa.internal.event_desc": "quuntur", + "rsa.internal.messageid": "8", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "texplica", + "rsa.misc.group_object": "sequines", + "rsa.misc.reference_id": "texplica", + "rsa.misc.reference_id1": "entorev", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3167", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ore" + }, + { + "event.action": "cancel", + "event.code": "utaliqui", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "les 2019-10-03 20:11:40.172538723 +0000 UTC norumet2571.internal.example %CYBERARK: MessageID=\"89\";temp 1.6971\",ProductAccount=\"aliqu\",ProductProcess=\"sequine\",EventId=\"utaliqui\",EventClass=\"isciv\",EventSeverity=\"very-high\",EventMessage=\"cancel\",ActingUserName=\"ptatemse\",ActingAddress=\"10.33.112.100\",ActionSourceUser=\"catcup\",ActionTargetUser=\"enimad\",ActionObject=\"magnaali\",ActionSafe=\"velillum\",ActionLocation=\"ionev\",ActionCategory=\"vitaedi\",ActionRequestId=\"rna\",ActionReason=\"cons\",ActionExtraDetails=\"Except\"", + "file.directory": "ionev", + "file.name": "magnaali", + "fileset.name": "corepas", + "host.ip": "10.33.112.100", + "input.type": "log", + "log.level": "very-high", + "log.offset": 45067, + "observer.product": "temp", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.6971", + "related.ip": [ + "10.33.112.100" + ], + "related.user": [ + "ptatemse", + "enimad", + "aliqu" + ], + "rsa.db.index": "Except", + "rsa.internal.event_desc": "cons", + "rsa.internal.messageid": "89", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "vitaedi", + "rsa.misc.group_object": "velillum", + "rsa.misc.reference_id": "utaliqui", + "rsa.misc.reference_id1": "rna", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6971", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "ptatemse" + }, + { + "destination.address": "lla5407.lan", + "destination.port": 4762, + "event.action": "block", + "event.code": "95", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"95\";Version=1.3175;Message=block;Issuer=neavol;Station=10.94.152.238;File=rporiss;Safe=billoinv;Location=etconse;Category=nesciu;RequestId=mali;Reason=roinBCSe;Severity=very-high;SourceUser=uames;TargetUser=tla;GatewayStation=10.151.110.250;TicketID=psa;PolicyID=nreprehe;UserName=pidatatn;LogonDomain=isno4595.local;Address=lla5407.lan;CPMStatus=upt;Port=4762;Database=itaedict;DeviceType=eroi;ExtraDetails=onemull;", + "file.directory": "etconse", + "file.name": "rporiss", + "fileset.name": "corepas", + "group.name": "uames", + "host.ip": "10.94.152.238", + "input.type": "log", + "log.level": "very-high", + "log.offset": 45585, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3175", + "related.ip": [ + "10.94.152.238", + "10.151.110.250" + ], + "related.user": [ + "neavol", + "pidatatn", + "tla" + ], + "rsa.db.database": "itaedict", + "rsa.db.index": "onemull", + "rsa.internal.event_desc": "roinBCSe", + "rsa.internal.messageid": "95", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "nesciu", + "rsa.misc.disposition": "upt", + "rsa.misc.group": "uames", + "rsa.misc.group_object": "billoinv", + "rsa.misc.obj_type": "eroi", + "rsa.misc.operation_id": "psa", + "rsa.misc.policy_name": "nreprehe", + "rsa.misc.reference_id": "95", + "rsa.misc.reference_id1": "mali", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3175", + "rsa.network.domain": "isno4595.local", + "rsa.network.host_dst": "lla5407.lan", + "server.domain": "isno4595.local", + "service.type": "cyberark", + "source.ip": [ + "10.151.110.250" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "neavol" + }, + { + "destination.address": "iquipexe4708.api.localhost", + "destination.port": 5473, + "event.action": "allow", + "event.code": "179", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "mporain 2019-11-01 10:16:48.692538723 +0000 UTC eratvo7756.localdomain %CYBERARK: MessageID=\"179\";Version=1.4965;Message=allow;Issuer=alorumwr;Station=10.146.61.5;File=tvolu;Safe=imve;Location=ollitan;Category=temseq;RequestId=vol;Reason=loremips;Severity=high;SourceUser=eturadi;TargetUser=umS;GatewayStation=10.77.9.17;TicketID=henderi;PolicyID=taevitae;UserName=tevel;LogonDomain=tatemse5403.home;Address=iquipexe4708.api.localhost;CPMStatus=quuntur;Port=5473;Database=amremap;DeviceType=oremagna;ExtraDetails=aqu;", + "file.directory": "ollitan", + "file.name": "tvolu", + "fileset.name": "corepas", + "group.name": "eturadi", + "host.ip": "10.146.61.5", + "input.type": "log", + "log.level": "high", + "log.offset": 46024, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.4965", + "related.ip": [ + "10.77.9.17", + "10.146.61.5" + ], + "related.user": [ + "umS", + "tevel", + "alorumwr" + ], + "rsa.db.database": "amremap", + "rsa.db.index": "aqu", + "rsa.internal.event_desc": "loremips", + "rsa.internal.messageid": "179", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "temseq", + "rsa.misc.disposition": "quuntur", + "rsa.misc.group": "eturadi", + "rsa.misc.group_object": "imve", + "rsa.misc.obj_type": "oremagna", + "rsa.misc.operation_id": "henderi", + "rsa.misc.policy_name": "taevitae", + "rsa.misc.reference_id": "179", + "rsa.misc.reference_id1": "vol", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4965", + "rsa.network.domain": "tatemse5403.home", + "rsa.network.host_dst": "iquipexe4708.api.localhost", + "server.domain": "tatemse5403.home", + "service.type": "cyberark", + "source.ip": [ + "10.77.9.17" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "alorumwr" + }, + { + "event.action": "allow", + "event.code": "saute", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"83\";tvolu 1.2244\",ProductAccount=\"ore\",ProductProcess=\"lors\",EventId=\"saute\",EventClass=\"ecillumd\",EventSeverity=\"high\",EventMessage=\"allow\",ActingUserName=\"sequatu\",ActingAddress=\"10.128.102.130\",ActionSourceUser=\"mdoloree\",ActionTargetUser=\"que\",ActionObject=\"inBCSed\",ActionSafe=\"cteturad\",ActionLocation=\"umq\",ActionCategory=\"ita\",ActionRequestId=\"ipsaquae\",ActionReason=\"olu\",ActionExtraDetails=\"exerci\"", + "file.directory": "umq", + "file.name": "inBCSed", + "fileset.name": "corepas", + "host.ip": "10.128.102.130", + "input.type": "log", + "log.level": "high", + "log.offset": 46542, + "observer.product": "tvolu", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.2244", + "related.ip": [ + "10.128.102.130" + ], + "related.user": [ + "ore", + "que", + "sequatu" + ], + "rsa.db.index": "exerci", + "rsa.internal.event_desc": "olu", + "rsa.internal.messageid": "83", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ita", + "rsa.misc.group_object": "cteturad", + "rsa.misc.reference_id": "saute", + "rsa.misc.reference_id1": "ipsaquae", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2244", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "sequatu" + }, + { + "destination.address": "oremip4070.www5.invalid", + "destination.port": 1704, + "event.action": "cancel", + "event.code": "150", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "2019-11-30 00:21:57.212538723 +0000 UTC moen6809.internal.example %CYBERARK: MessageID=\"150\";Version=1.7701;Message=cancel;Issuer=reseo;Station=10.31.86.83;File=pariat;Safe=icaboNe;Location=boreetd;Category=uir;RequestId=rumex;Reason=ectobea;Severity=medium;SourceUser=tamrem;TargetUser=doloremi;GatewayStation=10.200.162.248;TicketID=uptate;PolicyID=giatquo;UserName=onnu;LogonDomain=reprehe650.www.corp;Address=oremip4070.www5.invalid;CPMStatus=turad;Port=1704;Database=billo;DeviceType=doloremi;ExtraDetails=ectetura;", + "file.directory": "boreetd", + "file.name": "pariat", + "fileset.name": "corepas", + "group.name": "tamrem", + "host.ip": "10.31.86.83", + "input.type": "log", + "log.level": "medium", + "log.offset": 46973, + "observer.product": "Core", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.7701", + "related.ip": [ + "10.31.86.83", + "10.200.162.248" + ], + "related.user": [ + "reseo", + "onnu", + "doloremi" + ], + "rsa.db.database": "billo", + "rsa.db.index": "ectetura", + "rsa.internal.event_desc": "ectobea", + "rsa.internal.messageid": "150", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "uir", + "rsa.misc.disposition": "turad", + "rsa.misc.group": "tamrem", + "rsa.misc.group_object": "icaboNe", + "rsa.misc.obj_type": "doloremi", + "rsa.misc.operation_id": "uptate", + "rsa.misc.policy_name": "giatquo", + "rsa.misc.reference_id": "150", + "rsa.misc.reference_id1": "rumex", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7701", + "rsa.network.domain": "reprehe650.www.corp", + "rsa.network.host_dst": "oremip4070.www5.invalid", + "server.domain": "reprehe650.www.corp", + "service.type": "cyberark", + "source.ip": [ + "10.200.162.248" + ], + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "reseo" + }, + { + "event.action": "allow", + "event.code": "iatnulap", + "event.dataset": "cyberark.corepas", + "event.module": "cyberark", + "event.original": "%CYBERARK: MessageID=\"166\";cul 1.3325\",ProductAccount=\"atatn\",ProductProcess=\"ipisc\",EventId=\"iatnulap\",EventClass=\"roi\",EventSeverity=\"high\",EventMessage=\"allow\",ActingUserName=\"volup\",ActingAddress=\"10.103.215.159\",ActionSourceUser=\"ddoeiusm\",ActionTargetUser=\"apa\",ActionObject=\"archite\",ActionSafe=\"tur\",ActionLocation=\"ddo\",ActionCategory=\"emp\",ActionRequestId=\"inBC\",ActionReason=\"did\",ActionExtraDetails=\"atcupi\"", + "file.directory": "ddo", + "file.name": "archite", + "fileset.name": "corepas", + "host.ip": "10.103.215.159", + "input.type": "log", + "log.level": "high", + "log.offset": 47494, + "observer.product": "cul", + "observer.type": "Access", + "observer.vendor": "Cyberark", + "observer.version": "1.3325", + "related.ip": [ + "10.103.215.159" + ], + "related.user": [ + "apa", + "atatn", + "volup" + ], + "rsa.db.index": "atcupi", + "rsa.internal.event_desc": "did", + "rsa.internal.messageid": "166", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "emp", + "rsa.misc.group_object": "tur", + "rsa.misc.reference_id": "iatnulap", + "rsa.misc.reference_id1": "inBC", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3325", + "service.type": "cyberark", + "tags": [ + "cyberark.corepas", + "forwarded" + ], + "user.name": "volup" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/cyberark/fields.go b/x-pack/filebeat/module/cyberark/fields.go new file mode 100644 index 00000000000..4175ce8751b --- /dev/null +++ b/x-pack/filebeat/module/cyberark/fields.go @@ -0,0 +1,23 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package cyberark + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("filebeat", "cyberark", asset.ModuleFieldsPri, AssetCyberark); err != nil { + panic(err) + } +} + +// AssetCyberark returns asset data. +// This is the base64 encoded gzipped contents of module/cyberark. +func AssetCyberark() string { + return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb9+78pOUjW5tR8+ynVdXWzUFYpokIgwwBjCkmL/+Cg3McMjBUBIFUPK72w9bsUg2uhtAo3/3d+QK1q8JW09BU331F0IstwJekxP3l+/e4J9KMEzz2nIlX5N/+wshpPsBmXEQpZn8hYT/eo0fu/99RySt4DWRYFdKX024tKBnlMHE/b37GiFqCXqluYXXxOqm/4ld1/DaYbhSuuz9vYQZbYQtcMnXZEaFga2PB/i2/3tPKyBqRuwCWsRIhxhZLUADfmY1nc04IwtqyBRAEjU1oJdQTgb0aUPvQMxcq6a+PSm7TN0si1hLKrbIG199bP3YEptFKjPf+vv+FcY3bLArHxfcuO8RbkhjoCRWEUZr2wT+a7oiFRhD5+7f1BKmKjCOaOU+3wFNyFs1J6fAVAk6ToiHxXeROpScFi4sQdrCkZYYcEA4M/cDyw3ynClpQVrj7geXxlJpWzRMFEfLq0MQLKnd/WCIHfc4uSUItWS14GxBKDFgDFeSLLg1hJL3YH/nVoIx7e5PBkejI9YsVCNKImEJmkyhO3c11QbIO7DUoUbJTKuqt9TTt2puXlxQdgXWPBuAP+UamBXr58QGvCn5AF5Y+BMue2hOoowUsARxACeFkrv3c4uTp1BrYNQGTEqYcQklUVIgWpZOBZCK1nGsKjMvkl2YPXv8Ltzz89MfyJKKJtx4XoK0fMbD6YRryiwRau73Sw82AqnjDnw4Lfg9tx011ZazRlCNvw8bOxk9GQPQB52U2MkYQB4/KaNbsjzunrz8/3uyf0/cqnk25H7XV03/KJCQ3W15NNgt6SFCLztqGoxqNMv09t6fbbnu//0wM5ZaqEDax4gcbUpuCybozh1+JOiBtHr9GBFbOJ3qMSLG5WGI5dWYWsnxeE9aCfQQ6ZGXbTOAMqUNNaLXxOzM3hdbt4DDZqCHDJSE+1kRO3rIAPoNVsQ4F3dcK0fioux5VaLs8+wakJmIfSTCwTuzjx1DrW4k/9LARo3WHf3hT+tto/ZESeYeB2rVY7dsR8TNkucVh33unrhl+Iwz2r/Pb9WcnC1BWnKJwpk0sgTtTBANQVANSJ/xayiJAeuAbP14ew0zbrC0mzCAfW+DpduEAeg7bcrQE5jev3TYwRzQdQee3I0HC2Uy6av9c/mrMrYvIsXuiTQgSy7n7Ycmdmx6PqSvh7/8kAM2+NEoY88vlj8RWpbaycqx677L3AH1Vn2tzF2+ys3eV//vstdxK79s2JUL3pHW95aVhJI5X4LsnGRfryLgWHSY/yKvBVI+RuXv64hojDo0VL0uNHzJsNf94CFuMNI9XSOXz/zS5AIv0vPgzbaUfFzXQBgdSpApEOB2AZp8Opf2h1dEafKLUNT++JJMqcFT1AbIZnzeaFT9bqD7EHX3K6Ybw6D5jM8E/gX367nK5WbbZx23K3/1DgalV1SX2ZS6nkTrkd3n5PnF5y19jxINgu5uKSFmbSxU4RENaDtoC/An1XjmuX8rzedcUtH+ZltbuYEPufSvPYkR5xefX0VYENAfcOL+LOgwGnI5xeuzOahDxfHQ12cBtAR9lNj1r7gUOT+9T5TU49sPliKYw2Klj9rJJliR3c9GW0XrfKNo4UVxpsuJEgKYVfprFMCOew+Qc+POHDeEedZB6TDdUlTfql21hexh9CO0+Co2fSyqaqUMJrtVSpLperBphGj40oCxDqDhVS3WYZ/cl52gJ0DZghheAnn6PbEL3ZCXP//8jKyoIQZAdqvs4cSjUF5vwQlTK2kgHyvYV3MqmGqk7XwKTTX1Qs9dZROFQJ7SqVpCjxlcRjMrW/FmrAZajd4f9tUcmwdmFZS82dXTUjDqm5jm2DkW+Ixw+8/m5fc//NV4kf6iRgHaIv3PATX/dPbgW7oGTV6SM8lobRrhIyvOpLyTXI9Bv2fwI5JbGVvlx5fkXx25z8mPP5J/JUxppy8jFWHR5+S/C/s/3Re5IdtM+Sa6hVKV8GhtXbmCglEhppRd5dWAPXJSWbw21Hq7wjERZFkrLi2aJhbiCc54OArQWmXKT9vog6YGxqlAjBFTY5V2mrVce63DfbCkgpf+YMSQImSmGlm6F0YAIs/lPChHNyYvbt+IAeQUscBwHfaEjUZ2YS0ULR/LOxfQIYb/CaQCqzmLWB3BFO5/GW1h/9y3Qtg9+9RuNFo1a7dtQn5VK7c1Q5uTS6K0M8asIlcA9Q1MexQv3lfCNK0YGFMseVmUuaKuZ63kmYMETS1e8tJxsGcXLrm2DRXOaN/yvcuIi4NX3JndGCtHZngqwlU/PyXaSWuDDhVkGtVzsN3XbuSE0ZmSnh6cEz4Tbj8ndJZQ0FDwn5+2vtcPUCkL5DKcd6YBH9rpekxQuv+1gZivIPASVipMLXjOzIZHbc4bPlD7H4Vu5mRuxvOOt869AeGst6eutVrCE/JfI8LoxcuMiweI0btVnXF0cfLmIui+jErHHl7VSu9qvASfyK8uDaJ5HO6PT/6pQkMcTfeYK3XblG82P9kY7F7PQct8Ql7+/IqskO8VUEmoEHFfATr1UU3a+I/ICjR4sNQSAdRYouROucg2Ex9cTfy6mRi5qznCtoF3vytdIuMwqwnYQiqh5uvdQNyM64EWS8jPhC2opsx6JrpLvUb80WkuSSNDTo/Y8pmPVtSmLuj2gfqcQYQ9sUu0KCqnZCrZhhE0XY3KNJSsO2olZaix+hiFDD4HxVijW4jGUllSXRKpdEUF/zOW36t0FeVPGbIcDmaRaqaDJ+lOTNpg3SHzQvAZIMURA98AU7IcUbA3210Ym9PPsocgLpmqagE2egBGnagUFXir+Y4Y7NWbaftAB/nSrR09zmNHeftkjh6/Skm7SLRNm/rUVDkvmyyn8oEYfybLHGx3IP9UMne3hT1i0a3eqpg+vfbjLocHIirbjX5DLFzbcPnIErTplVOU+/LAIvt738O2BpqKzE2ZHlO6hDLfOxiSbMIzZboVWx2jzbTpvtiPrw9fK62qCUJtsCjfMJBUc+XV+qoRln9nOWhC61q01S+bXjYVlXQeK80lRGB4p7UXPVIeV0O4fWKIWkkfGbO0qnc9gwFjt5pDcXj7rCFswZ11o0owE/KuMRbNpD5QdyupHcnLpRYO3KS9Amw2c3gv4RiaEG5yu6DnnYYZaJDMHwjqVOuSL3npNBs8D3FBdtkKso87zIsTeV1zfTQKN/vpY0HX7iRyK9aeWOOEntPXHFJ4QPf7RhNu+qgL57mTxp08mwyW7NLJVJNaAlUDRe6+EDv+p74qqEF+aaA52lFyp9ufoo18XFFDEIly5Nwgcj+kZmpCpWCLoRlk2ryyGV7feZUD17rIgGpd5NCe65SiaBvoy+RQM+hKvVfkYUzIHfMx+sYMnss7vTmHis2b5NohwYLNA7HTDSG1I4iygRKfQrE2jcgddhqxolRjmarghcehM14wK1vNBieEysCCLQNy5IDAEjS3OUtH9hDWrh6KAHuRnX0un7zFi4Pegf6V7ipdHDSMO9XA+IxvDJ+4duuDOWM9VYKunD+bKbIBnYuRl5uCidZFVYYgSxTvYDYfaxM+b1vpfUtQafLbZUiN5aZNCNj1q+H67Q6NVUmaWhmeUHDc6myhOS1L32EKU/nbuzvahacRtsjXuuiOokg2FWjO7iqLorQdoYptD2H9SrbuZnix5O/3gLQlyFLpkDC7lzI1/eMBute0oV01/QNY3I52iOWvBR+w20nQ/Yh5SZ+zV903wwsZqv6DmAlergXtcoulsoSSReh4EU+gFWpetIkqDyLU24N4Z6F+jJ4pW7Lv75huhV2rUXzEFX8lOFvnvj175MIFIhCaa0uxHpHLjciZNx1n4IdGACIWF6dKWrjOrbF2CJ1L76/b9EOlZWnc/+GjSkWLUKwBzA2PM1tQOYdCwiq3LBgLXMKqF+pHJcRazaeNhZ6EGOboG4+609b7z19cdJiaJhN2HecEz9a2ch/T0BDczS/yyPT1t4hxixVgjmFtw0GzyfnSS9ATcgl+UxoDekLngK28Q6b7TOkWhwHsFozX2xn+nvjf9/pWKE2mWq3cZ+1fg67pza7RftLn5QXVNrWbrgOc2qMS7pQaVIce604pUXZqY64rpWoIAcVcb/EbSagAbbvsIr1ZNPzNh7eC+Og1AcAkpIjCXBKp5HcaakBLZl/2A5oNx3xyWKO1uzCdvYI7iXrcC+4jbG34Z0DZittFUJa9rCenuOAUq00kUfK7uXL/veclQCWliCiOGemmvWDgC0TAIalmxEkHy8FMyOVGpuwONuhXVuXB+MSX8zXGGTG+ZNQn25RB/AbGU8JEY2x7IMM/BtuEP+HG7WSoiQ7+Daf44qfjKtDRtR9/w+IWvW/LlE8pe3KT4eWwPEUsCDVGMY7+UrcbUXsSN+wtv4LXhJJ6sTacUUFKbq6ek1rjTJTnBCx7EleUqaaH1F7e8aH3dTaaVmBBG1JTg128DDZy8L0ImKoqJ8XUVtB+WFoDlu1V9/x78FAaX28PMzxMXnwzVdXN8A5m2DZKVlyWahXyaZmSDGr7vMukGGXGgMxZI8SafGmo8M7PUlWUyyA1ZG8hoUaerr7XM5W6tId0pxK+5fIKylAL1CaiU4PeqWCguE++6VCb8HLfxolBV4isoq4/2cm7JXYRaNH77fKh8PqtDp5Xcjls19MFnUFXfHewU24Xa1gTsfXnf7+m/WNiTXvGRf473pH8C67WXWMNZcOAtJEjiLvbDGhORRF5TbM9Ipe4ZKs2776PvQfQvTCjfgFgV+aglgMpPMZhdffQLahZdDfUqYWRKsOGLXzmb1tj05UZnrSQdlqEOUK6ZSZGM/er7t/DSlPi5LkkHHPuGskEUO3+hI3wNqiFAsLg7dRtYefN0Qcv/Jphn6dH/WIxVU257Ppm9x+sUDaq7/B6LbluzLE9fX1tBBEY9/gdJ0AauRInfnXfk3HcU+otuOyu8Y593st8fkree0nzNDRuIH7aXij6dbg9i+vV3gH9EL78nvv5/BRZGkreOjEx9B5sR+R8GqAnYeIPkZMFK27iRurSrHP2st+O6oYCba8u7PVjS298H/HUONafdAuT89MbNdlU/rkbNFmH2EtZbjTaCTnx9Zmh36nwH+zXZhFBvf2NH74J7rhpY7vKTWW7x6iRAoznjPIPykqRJdWcTsWgCtA3ZeCS1IKOCAID0mTtj7K1oX1V1a88cZLKaRhtfSF3+3z54vxiV4cmoWWs9yiM1WUfOFDw1rWQm0iLR5KcS0su+VxSFBYjR7RWOmfz2icD+eUO6UWruyns6oj/6RDp3WU8ZaWKHJz3v30kXDLRlODEWRhk634+IU/PrmlVC3hNLrxDxINF6T2J+0UwMnf02CY6pzZPSxwzbq6cyn0AXncoxeu5Md+Hp+EDN1d7Qq5W8/kcdL4RdnGWfe7HAgIOqJ0uNJiFEqU7Pd5WH5k0uhV6P4JnYRh7D1L56QevYzzrmnGcn8bLSG4dnWeqqosj513hroTcKxzj6v17ppl+59BREutTZzhuRpUNG7PSglr6QFljfcw7aak0dh5wcr3Fb2RKHNXliuqHydAbdtV30pWGh8gRMdIa+akTopS8o6ztpxxXbp0IOqodo+R3rYKq90shb2smH2qtgZrkucHGUtukUpw7fxTl4sHMDrf4VF0TXr4Yf7/cy9ocA0OH0adB42N/FxwW8avbvmOZp+8NDvnpcO7eIc8Zl6pJFePs1ZGYefI75SRpSqfDwCP7U2LAuTszbh2JN0I4uUdMwxgYM2sEOXPrE6ZKMO5ItM1+45YFlyVcJ2aA4MYepnneU7bgwmiK6RaJKWiMb1ZUc4EZPBEPno+/yzmhyMTv3G+jlMkM51BNfXOhB9KIw+rkaZfPWYM2dSi69RJmwLKgImwS4tsOT89Gigy9m2v4HudOKPHKV5fkFXxV/tvuQ8qlISVYykXEyTBVje39boQ0JY6em9l6bGmXx4Z4jD+kFqpaZMvmeUNKmNEQAgqdL9sYfsjWdFrxErSgayzksio8ruRp5Ea6D9DqDr+GWVsF7n31xnLbYGNGEiVsYxsMGzbd97omjWL1/DuMpsY0g6xiqqrcfcpzjE48dMJ7yb61Vkteev9Z20WuAjOaCFUqdnig8e7esl+42GiNrJ+XF1cNrmtMenoYWd+unlfW/6GmB/qdDibvf6tpCMDEb1fN8zXOPcWEYr/zlxfn5HygUPXRyNa1NlSX7McgYWFXVw07T2pI38UfFnKr48q9FxHFVJW5K74GFXe7SkfAhThcRtSjRfpuCT5kcITK854LOJQO+wTaLh7C57zsQjkjTrwqtdU4KANP8PKnU/I6uusm5zPVTve++OS757SBKEzWuAbW9L0IPvVrCrHy1rYL077EjSM4QqJe8XLbIdJVV9Il5YIOAxmkc4UTrK+cgdYjkxb8HTrE158u7haMlSo0gPIB2AFJId3A8PlkRCLyqpg2ZblO7p/hVZG0DqgHtzFwWKPzvV6q9BA1Vwm7HOyU2BWmOUZBAjf97FXfc5U2JbddZd2mL1rAKDbYblOx4UXJJrywn0ifJZaag8ujWeUnn8/I01Ar8bkRTleecoEFHJgHdnZdK+O++Yx8N3Q0yN0ozJVUK7llCBlgDTazWG5DH5m0yegRXHC7aaEnbZX7+1Ca9BbmlK3Jp1FzTfCppg9RlB8W3mIxl6SiXM40rWBvOkZNNU7tzd8nYUu5vMBlyXtV+uToTVvAXtZZBClyg/aFqQKOEbkspO2+ce9hRX5tJJqS71QJgjzlcjn59jnhij0nU/d/4P6PSirWhpvJt/H4omV1MRN0MDk/tQ61reGfXBBcFH1dKCfX7fArNdvbqMGqrJj6v04Dnm0bBAPaHeQoQssqrdzdwezzu9+pBvLRJwB/++3nd7+/+XD27bc+53ZJNeWjZ3Kl9FXKkuUbL9jv7YL9CNuoE4zK1EpEqNlJ26Wkew4oc8/FOoMJM1MapOEspQDpuZIyYFyl94JE4gOpgBYryofDie/tHcDe56mBuuuTukTdNNNMl8JOS2N16sp3rNfO5hDrv6XJ3tG25iOfk/TQYpfNYLCBShOKTTZ1L6HexYGY8VFHU0tqNkfsoaRGuxFFyNwt74kL5YP7Cd7dceGQD/r/h+GqG5XZT/57kCNW9nz0AZG9SD7I4WjjuPvwU+oISVtbO9uzS5/aLqO9zbLDPpnP0O02OLk3R6bbltX8GPEwLPqaUS4cr9tmLhdBZpyf9mvbsBOXMwctzCMtDMazCtuc68KpiAfQc0jiNaZbh+qjE1VVjdz1RA2wk4c1brovdu/h2v4d4jp1h5s5TLO+L26XVJb/ruJRsw1ullp+iGS4N3bDhbeQM42pOeMqWZbosSx4xH5FtRwGHR476kZWdaFyCePL9+8uyG/ej7pJSo0j8uWoqQSX//GWfGlAj/RubYQsNOx26syb3NBziK7Jh7boLJrW1WnpLOFD2geqUo8RcEDrgxxHN0G1keDYveGW6Qc0UEF1lWG3HNgM7gVaJyxA7oA2ZbKptFsw03a72gJdUrurFd4X7hQkW1RUpyor6eCuazoYX3zv6BNlg3SqJDCLRfKzwGCWtoCqAzybY6ulDGDV9I8MUGuafBKG7ziV/Hhh0L3gqR+c0LmtAqd6JkdaFpThYJT05ScOtpEJjfce4Om8Xv4kr+0i+fvOZMGsLkqTtO96D7qDfFjk6RaAl4ImlxiyADnnMmFR5BB0jtxoWcwKs+KWJZcfspgJtTK0Sp+70oct7TIf9AxRFyYLLnOKEy5r0NV0nSzhfQC7Zld5gC+pyHFWeF3UWllVpA9JIfTlTwV6HNPDFtnuplDzoszBbAc4ff4bk0VFrwtrU7kNtgG7Ey0gw6NQcZkJaS7zIV0LU4ipKFKHRbdgf58RePLO4D3YqXsh9mGnrurtw/45I+xXGWH/S0bY/yMj7L/mgW1VLegUcoiUDnp680wWVSNQ+Z6uM7yTLfD6KoNeUjWCz6s6j/bttEwq5qmTkAJknkMpMfCFpfeNyML4hMQMO2g0y2NNOsB5rEmzNk2dYRYpk11ZdRZT1SrrTA+4ziBCrLLOMMsFG82aLMAbya8llcoAy3AIl68cVzI9CstXqrYLoGUGt5qq6oKJDD5sBzhDkATh6unapneLOsgmC+S6KTLENJjmljMqMhQQmYLOQbJ1wqyrPmxJxfpPKKc58F4W2AY0C2TfDiYP1j6xNgv06bxevsrjgzbFlNu/Zmk0xkyRdlbcDmCtkotqk+WaI1RgOn2Vm/E+/mSztnqAwS68nz+9c8QDR7UvC3DfTT5dB7ke7BkXkMOGMcUsxybyWcri7G3AOXQDU/AakxSLLKKO18ufSmPrQTP/RLCNZllgCz6DHGaMQUdzBSVPVjC6DZvLPKekUmUjwDCVg9sBOJ9nkE2qNitqk87870GPZZAnAaxhzo3VNL0nZAM7g8anoc7Fap2N1wY7ketM8tVn5vsjngG61UCrDIqkLwXKhXY+5Xq1UNwUfsJseuhrqmmWA16OFMKmgLz08+1Tw+XGUpl8znFp7LTRqYYFtlDBzwrKAbVJjmt6PbqtSU4NFic3zNIPuz6008A+mHNalqnvAC9Th1Xb1kEZ3iJeFUwrVWXpSuQAZzDTeFXkSY4MHY9ysLm+St6eqTbpW5by2tSaJwYqqOW2SZ59JriEdC12NlBN0ok6HVwsvk3v1hLKdz0tZkIlf8474BlS/p3Nm1zqOKAZJI6zoTOgmjw3Qah5lqMr51kucK10agFWTZt5jmtWccNyiIXKZDmwOeZASLDYXCk53OQy3DeATp3x56GmTseTq1VqCyRLRZnyA6CTW6IqvWakNJ8XkXlc94a7kqDTv1l14YfyJgebdDL1Bqwf8ZrlkGUo3AwzcVILgwA2tTSoC+9ISo4uNcZ9WLBFqjr/AWi4rnnyQEANupprKu2g524KyKssgNM/vb4T2adPO1NAEwDWal5QUyccGNAHrWlqqBqoyKHfaWDIB991NBPw9Ex2kNO2cO1BVrrMgHF6R6bJ4Bs23jecIR/AQOpEAD/wOINxYuBL+gMQa9CaDGoGU8rweQbBa+rUXjajWY57oFmZXJE2msW64iYAbNON2OrDbEzyrppLJlMXSkSnxd4XqG/SmZp8O7fpj5UHmj6i1830TA13XSfv1tqU0yx56I0WGd7CxoAuSp666j3L2Io2MpSDDZYZS6vU3uBlwaWxdJZBM1hybXOo4ctaZmjdZJVuZEo3a6wtWqSj6JvGKvKhkWSwdJc9knFY3mcqeElONJTckhOqy9DN0GD79zg6fnJWRi6NTQhFMDhEn2B/A6YEiZXqdPkQXObj3FlVC7WGwWDBG/k3U02ypt63PGOOh95nhPPONMzhmlR0t9HCJhYr583uMJDsSApucDhDu3rYemygRExT10pbMmw8SshqQS3hltQaZmNH4R5puXcZQhFjfLA6OhQIl6Gz+0hfaMFl7on8PVTdan08DbFqDnYBerL5vlmoZvCiESJhCbobR2QVqak2QN6BpTgR3N9V2rHg6Vs1Ny8ufNnrM3IaRnw9J3YRmVKEzYA/QBh9jGhL8h7s79xKMPF9Hh7qLMyb4cju7hbh4p5YA1SzxYRLHsUPZ+4eob/2jvjEWRiYDPFC0EbirN95g3Nc2ybu8QbuO/3a99CUvx13R1PXhDvMLx4x9t1GFAlrmm7XeRWXJR/h2uKtGHMXHGMa9YhA2gyue48TqqUYmXiJ3XMzjgPH/rkGLNHwpQFj9zTtPjxb+e698r3KgGN5/KpeYu96pLq80213yj6cPEYYG9v6O3ZoN6+jlKec/X/zfEO32PlpKxRw7fjZQKshXRLvHY+we1ym1ADx6dodNmRwq7pdCr94GHxlNwq+w1xp374+ykZCqCEGAMed0f3zqjSVhrIjjPcddJj2S0tUezeHhjUaJ6DtQ7oGXXGvbhwL6c2SfjAHX3IBcyACliAINYbPpd+4zbz++NHHlswPKL9x/T0nffogk54dZo3kXxrYHZNI45evh+9hHRMPm4LSajS89BeSKSkBcyvIitvFmKAgJFIZ0mnsGg4qL7qzaeHYifKke6KEmnNGBXEYjJg+iMXDYodLjYxpfDje1Yu1iaPXS2dbqZ2s1tQPPBWcmmKhstsE3ojrzDWcpbIZauSkYn8ET7wfAPGXxmGLb1oYxMIEUD15I4xyhvjWfTvFYDn5NfxiQt7IdfevAXSLtryRltBywlRVNxZ0XAxnceM7wvKZZ9/s7gXOWNzaEG7/2bz8/oe/Otv3tLcdLce+iaIdzmmRNmJ2W8cNXYMm/9L55MyLgAYiF7/1qet/8p95ucF569Tv3Y8Dk5dvkm1PdgemuHUm5P1vH88c7aDBO0/QX1pywzTUVLK10yqDeiZ2c0EIcug5+fjuNTmX9seXz8n5+9Oz/3xNPp1L++on8nS1WBMJ3C5AE7ZQJoxKU1oDs/itH179r//27EmUI2AXGWXcLj9Qpk4qGh/HYzKfvjte80t/Fs9bpOJXvHxcSPdl0w2YH9gw7tYPfAzfHcV0Y5185to2VJC3b95Hkf1TScjnyzrsZPwfJWES561D96sRoUjIzcITt+AxvsF79mFOLazoA4xIx9N9Qd6UpUY/rT/lMXS6p5dV9aFxzvvGQs5P3l34V2k0PFZRc8Tox5ZTyWuq4e0m5xcOlRHvl+PhgZMgkvDQrT3Ow1YTK/x0reMKiB66tCy5+zIVm4Btb5Z//J074gFwJiFecBVu+On2ERigssm1zqLX3fZJo+R9wPBCaduJ5IHQLTHAhhvA7fpmyWuOzHtPD5fz9jFpyXo3xngJMbvxWF7cgB1avtQYxbhTOb3faKDjECeXNZVzmHSmE1NyxueNhpJM1wgTZIlZQ3E5Ux/YemBQNDqiLUcXnWXodyAS6v79Eq7kDgANlbJQhMzu9HlG6VlbSlPQwqfiZwBdW50H+CzDkZhlqBYWOa5Drv4ndQam0rJoPXH51PJdC97RMdldre9MeAAN9swuQEuw5OO6hufkU/uMvUUH2I/konWADV6C38Y0tXZUzxGUiRHTuEU6+MWfEypEVJmoN1/EBDeqMTFvCdq9gVxaRYzFx5xL8ul8VKAwTJDNJq+Si2wHVNUZxr45wBpM6oxeBzZDiYt/EVOnoqO/PQO2frRCIUDOk0+KRJyd8pFRCx3RQL3KQ0UvACMJw3SCGaHkF6VXVJfDOd2EvJljspcm1N34a8ylm4JdAci46pm4a+JdY9zKUtEP1XlkCLaMx8yIAYVchjxXTEuouHViKYzYiJO4FFQeI45/CwdlmyDSc1EOCNx2WW4iKUtnwc7RgN1+eVJHKoFhF4Jlun5wt4vYU205awTVBPtFkxaJp2fXr9+quZrN4tPfgRV2Adm3dwvZj25Bfxt7eJ85vB26bxq7AGlDsvgo2qZJ2Tnhdgk9fslx1D8Z0KMIq8YydVxOhyXHEb5sGANjRnDGzuOHNUc7LPEE8SJOxZ0rvSaRwoQBbscQTls4wg6OTiphgM/USrp3xcmtmHLY/ZAMFKVtqpbp+tGNvJuU+K6lWDMgOJQdPcEPs6MPc0kMt01EfhIsLoAgogPUBTWElqp2r4tdANdEreRmyzzjLL1WUlUjebU4k8Nw36L+uEqEU+65LJ38Udp0DKDkFy6AvAmITQZsuI2zV3aE+Ts5mjDe0f8g6QqjLLgMWQtpuRCjMcKIlPXu92CEz9e7DPUaqTkxnhA6VTmrByLET2FBl1w1qF0yVdVaVXwkQxGOjdyZpFOBRWQzcrIfNy6XndjJiOQuhltaJ4kisIVh0uEyByAYWb/DL/fu9l7ZzX0bPXabMstG2t1yttQafYll4AU7xKy/lRaE7/EcJGjOWpKQIZjot5tawO0Cn9rYbDcSkJ2wHybG6vHgZ0vTIW23Hoyml/tpCuqFXysjXVHTtDPCLa/AOLnutT0NNYwGkcIuJGsKceNGYOPBe26DvuXROqR394MdrR9vR9MPhUk25PTWpAWH8U0UDmhDijcC4RbC4Oul7uWN1Omj7p2/aElo0zfvXLJeqscRIDfI8U6AfL3H8cebtyzVaIPjbNnt5KM+qgRJecduIT+OehxT0jY4jJ1SjyVoO37q5JU7jV0UFdiFeoAoCd3yJBOPRvja6IZjLyWtsnqd9kR1PigR/LUOkT3nMpMn5D8nP3//PXn69vTNxTNyyo3lct5ws4ASS+GjuAg1V9n7Au2LhGG27MzjEbYZvziSMaZVZq/ivvpPt6sxDLobgx75ZEOf73JdGKb9d3W/Pccf4hSLmVIZa5O+yRSjIlV3uh1CPtCSN8avQJQmhldcUO3FkxOb7g4xfNfj5VV4zw0vj9lppJ8p/8kdhNaLuNMXc3PJ89VZvJH77jqGNUKlYc//G5xE+MngLATHDfTKMsq4K1PpnIkBg5ANslrpOZX8zz1Z1TLfUbgtsw/gdP9MjbB7xnW0ljRT159f3HL4WvgWX7530VZW869AhV0wqoHUGkpVcUmjBXc98XRBLQdpzY3p8YIek9q39EGJ9a0foc50cN3VeeIEV021xWZIG1L3i9UjNjsKwuY2EnUGJWhqoSySJZXtOR9O+PzSrtgFzy60WvKyax4WvkfrWgRNdXAwQvMf96xt67RxBWdDJC+PRGW3ZOj1Z9cjZEaHh2Lm5JL76PliV3EfaQHXKZ0ph4LfVfOEa9SZej/qVULPI4R6HRU1VmqIsUp7ie+gVWAprvYEvzVx33oSp77iZSngeFLuHa53WzkX2d6e3DtIzrXjMY5D7kVYrddhSK7b6OxzUgvqtsy9z0oTkEyv6zEvP6ZCHsGevEUGne5sy1+VseQdZQsuR0y6kmaSHN/s8vqTxEz/WoMTH04/8k3OzIS8LWlNPuM/vH5UKunrTv85fDzJgi7BaU4CqCZfGtBrgj0ITa2kgVajihenOnoL/M1x5GXogcccZM3bLpDSk+/78o3j2ZJ0BFQ3B+hDaI56W0xxylNeh9nuGW9bS281MXK2YXh4uSG6kTJqx5rn3cvjI8++jdRIjV2AWAQLM/9GULLislQrQ0wNjM84c588j9UJhjzZ4QVx5Hl8Nzk35Cl2hAXJNs8Qhi6f9bhFGonv+FuYU7Ymn8x249suAlvtFtImz651KxzBYB957fumFqKCtWp4yNyLOOB41wcgUv2/VWmK5TxD9m2TnV+hHuvO69XrCMVIYfSghd8cQOxx8nrHSA0ZvsH13sq6MyR9vAvokJrjOOy6gMH23mwSMv02DHYo3pDi5uJnLBtIORJwtMINSS5hxmXw1aNwwq5+Fa1Hmg4idgcVimXCbeOA2VH/UgvGzmebm/bQS2mkN2Xnw7aWskV15Bb4m1WR4WRgHfW3I8uQlymX6SaIJb0bjmQsKsz7eEaEVL9sB7fFt9HelPdHpnYOsM779t2AdU11e6bcn59vSFkt+KCVOnG3w9myPvn9VuTZ5DNLfFsLpdf5Nvxvpqby327sGNMist1FvVXPY0+TY8vfXiD0G2h7MJVoQFXbb30/VaOnoABptaoPER2laqYD58KtznhY01nbcEM5AuLoqzuOew9PVFVTue7uI147HKfv7ZUlaPcMFVzOVFwpoOYqd43QDfJjx4psMVtB3q7osy+5cgR+aYRYk/9oqOAzDiU5xbpn7xyMorKCacGUuuIPFHT/HabEr7+xn6kY0+aTd5vdhMPrxqLKfeAI05vv+oduiTBlJ7ijvU9+Qj6ua0/6xnPgmON3cHzzNMyKpM1kd9B2OHhHhH5iYm1rd5E5hquuUy63sfOexVrp1tuPIeYPb0e2vNcrJ/FxanlR551DtIcVbuUbPfctmlqpTJrINlJuHbcfpKY27ppksqAmZbS/B1iHcvrEkBstEm5zD2rCXemM0aLRqbwhPZgGdEHn6WzKDejkz9M26KTpj9ugw6nPIFjg2oJE1Sq9ceLgJzvNnaK30LCTKpNao/JLHKOWcEvmfsRlUb16Ef77JKDwIvxHyGuKuf2pAB3PzgvkPGD03BPTD56jx7U3am1AThkGojmTissZaD0Sdx3SfRS6+or/jayPumePgGTbl3jW24bIlcKwtsp6pSJLHO34nfm4vTt2HzGDWPf/9A8YJmiND/zk9QL0cfwRTmcPGU9PT3D04zNyguvHUQNtj9QsZYTPJ6DD8E/YysLc05wXsoaOe4zsbbhb9InpdYreu9P8z0O9kndvjRLfbXLJ/4x7a/hVJply/o8zImGuLPcbWC+oGZkAZdix2wr1ttIvPj5c0G11tglQgwSXnTPWNk5v62/iCSmGz49RUbHd36ibevhxdNCykybcmCa50omQMVkqn7fufjEUxBC0zuoDHWxKX3qeucXJJQan90mno2RIdJ3BQxT56SWmdu5/jHrS8zAk7y499+A4LkKNEcUy54u+G1INjuwoMmXhjh5tkrdpNLkA8ysIFnWm5gbfbMaV9B8klK0/EYPxOqXJ+eWbf7y7IBfunSK/yZHpKxtsM1VSH4Ltx5WKY4tiiC2AXZmDnMi3E8J5e5DFhs51/Tq7FmGYBhpGEG6k4B4tFzQfNIV8ACXX49F1BRk1GhBnS21ztAmffSyXVPDSH8QIEruC8GhdrfcJQuTYFazNrthOdPLbBNLEsBfW1qbgOIM2C2jcyhwMYfQR3CY+l23li9Lcrm+4UUxVVdY+cbfE2+MRHELxEvwV1yB2Lc3ULpaVoLIw5qEG3rqVvQz/PVDb1mhFsfWlxkWt+DHSqmMIewwIYoBIxa0BZCtbUCkHjTNyt5sKqyIiIzHbI7Vt7h6WMPPw97dv3od378XO8t2DYpXe9f0n79nGzVWxVKLJxYA37RxnGebcdJOx23G+jeTWkKceCfMMu3VgYW87UXcHPEGko9SIJpM0extw/SS5DekCk+2igyVozBSYNYIwJRnU1hnKl34PR9orrFY5pa9nvDPY2xHaDtFaaUuU4++v//4mloIbZXvqc6f0/PgJlrsFBlsu1in1zU6ijWL+fvbbxfkFeUevKy7Lbqx3fFsdbUdPw9waojhCViBjQN0+sjr1KV6ymDw921c5FrPjFWw+dBF+S3J2tWPLWRak8vlp6NIbsNiLoTjepjxwr4CW4uq/fN1wV5gjy6Emmfp2o7/EmdAPlN0YxlWjFd8FdStf3PucmCaSok4N+ZuxWsn5v00FZVeCGwvl316Evz3vPuVyBiz+0YxrWFERVWToVPR+Q6gsiVFk5FhqmHNj9dpZ9scUFjW1i9Csv8OB7OIwQBKdUsdC0xdC+3otpnSvC3mnT3aYg7R6/Zf/GwAA//+GnLko" +} diff --git a/x-pack/filebeat/module/cylance/_meta/docs.asciidoc b/x-pack/filebeat/module/cylance/_meta/docs.asciidoc index ffb6b412573..4724e1231e4 100644 --- a/x-pack/filebeat/module/cylance/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/cylance/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/f5/_meta/config.yml b/x-pack/filebeat/module/f5/_meta/config.yml index 11ba78ad098..a939fc021f8 100644 --- a/x-pack/filebeat/module/f5/_meta/config.yml +++ b/x-pack/filebeat/module/f5/_meta/config.yml @@ -17,3 +17,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + bigipafm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9528 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/f5/_meta/docs.asciidoc b/x-pack/filebeat/module/f5/_meta/docs.asciidoc index 3b44e5fe63b..a3cdd1c2523 100644 --- a/x-pack/filebeat/module/f5/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/f5/_meta/docs.asciidoc @@ -7,7 +7,11 @@ experimental[] -This is a module for receiving Big-IP Access Policy Manager logs over Syslog or a file. +This is a module for F5 network device's logs. It includes the following +filesets for receiving logs over syslog or read from a file: + +- `bigipapm` fileset: supports F5 Big-IP Access Policy Manager. +- `bigipafm` fileset: supports F5 Big-IP Advanced Firewall Manager. include::../include/gs-link.asciidoc[] @@ -51,7 +55,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `bigipafm` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "bigipafm" device revision 121. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9528` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/f5/bigipafm/_meta/fields.yml b/x-pack/filebeat/module/f5/bigipafm/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/f5/bigipafm/config/input.yml b/x-pack/filebeat/module/f5/bigipafm/config/input.yml new file mode 100644 index 00000000000..e17540ff041 --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "F5" + product: "Big-IP" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/f5/bigipafm/config/liblogparser.js + - ${path.home}/module/f5/bigipafm/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/f5/bigipafm/config/liblogparser.js b/x-pack/filebeat/module/f5/bigipafm/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{hfld2->} %{hhostname->} %{hfld3->} %{hfld4->} %{hfld5->} [F5@%{hfld6->} %{payload}", processor_chain([ + setc("header_id","0001"), + setc("messageid","BIGIP_AFM"), +])); + +var select1 = linear_select([ + hdr1, +]); + +var part1 = tagval("MESSAGE#0:BIGIP_AFM", "nwparser.payload", tvm, { + "acl_policy_name": "policyname", + "acl_policy_type": "fld1", + "acl_rule_name": "rulename", + "action": "action", + "bigip_mgmt_ip": "hostip", + "context_name": "context", + "context_type": "fld2", + "date_time": "event_time_string", + "dest_ip": "daddr", + "dest_port": "dport", + "device_product": "product", + "device_vendor": "fld3", + "device_version": "version", + "drop_reason": "fld4", + "dst_geo": "location_dst", + "errdefs_msg_name": "event_type", + "errdefs_msgno": "id", + "flow_id": "fld5", + "hostname": "hostname", + "ip_protocol": "protocol", + "partition_name": "fld6", + "route_domain": "fld7", + "sa_translation_pool": "fld8", + "sa_translation_type": "fld9", + "severity": "severity", + "source_ip": "saddr", + "source_port": "sport", + "source_user": "username", + "src_geo": "location_src", + "translated_dest_ip": "dtransaddr", + "translated_dest_port": "dtransport", + "translated_ip_protocol": "fld10", + "translated_route_domain": "fld11", + "translated_source_ip": "stransaddr", + "translated_source_port": "stransport", + "translated_vlan": "fld12", + "vlan": "vlan", +}, processor_chain([ + setc("eventcategory","1801000000"), + setf("msg","$MSG"), + date_time({ + dest: "event_time", + args: ["event_time_string"], + fmts: [ + [dB,dD,dW,dZ], + ], + }), + setc("ec_subject","NetworkComm"), + setc("ec_theme","Communication"), + lookup({ + dest: "nwparser.ec_activity", + map: map_getEventCategoryActivity, + key: field("action"), + }), + setf("obj_name","hfld6"), +])); + +var msg1 = msg("BIGIP_AFM", part1); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "BIGIP_AFM": msg1, + }), +]); diff --git a/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml b/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml new file mode 100644 index 00000000000..5df41d6ec6f --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Big-IP Advanced Firewall Manager + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/f5/bigipafm/manifest.yml b/x-pack/filebeat/module/f5/bigipafm/manifest.yml new file mode 100644 index 00000000000..5c8ad517aa4 --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["f5.bigipafm", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9528 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/f5/bigipafm/test/generated.log b/x-pack/filebeat/module/f5/bigipafm/test/generated.log new file mode 100644 index 00000000000..6bf7146dfe9 --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/test/generated.log @@ -0,0 +1,100 @@ +iusm modtempo olab6078.home olaboris tur itv [F5@odoco acl_policy_name=ria acl_policy_type=min acl_rule_name=ite action=Closed hostname=tatemac3541.api.corp bigip_mgmt_ip=10.228.193.207 context_name=liqua context_type=ciade date_time=Jan 29 2016 06:09:59 dest_ip=10.125.114.51 dst_geo=umq dest_port=2288 device_product=pexe device_vendor=nes device_version=1.2262 drop_reason=reveri errdefs_msgno=boNemoe errdefs_msg_name=equepor flow_id=eni ip_protocol=ipv6 severity=low partition_name=ehend route_domain=ritquiin sa_translation_pool=umqui sa_translation_type=reeufugi source_ip=10.208.121.85 src_geo=sperna source_port=884 source_user=billoi translated_dest_ip=10.165.201.71 translated_dest_port=6153 translated_ip_protocol=tatemU translated_route_domain=deF translated_source_ip=10.11.196.142 translated_source_port=5222 translated_vlan=iatnu vlan=3810 +eporr quipexe alo4540.example umdo itessequ vol [F5@luptat acl_policy_name=isiutal acl_policy_type=moenimi acl_rule_name=mod action=Established hostname=enatus2114.mail.home bigip_mgmt_ip=10.51.132.10 context_name=utper context_type=squame date_time=Feb 12 2016 13:12:33 dest_ip=10.173.116.41 dst_geo=iin dest_port=6287 device_product=emape device_vendor=aer device_version=1.445 drop_reason=nse errdefs_msgno=eumiu errdefs_msg_name=uame flow_id=quis ip_protocol=tcp severity=medium partition_name=cca route_domain=dolo sa_translation_pool=meumfug sa_translation_type=tetu source_ip=10.162.9.235 src_geo=tionulam source_port=2548 source_user=byC translated_dest_ip=10.94.67.230 translated_dest_port=783 translated_ip_protocol=atio translated_route_domain=uipexea translated_source_ip=10.92.202.200 translated_source_port=6772 translated_vlan=eFini vlan=859 +exe iatu ionofde2424.api.invalid rsitam ommodic mipsu [F5@consec acl_policy_name=taliquip acl_policy_type=psumq acl_rule_name=atcup action=Reject hostname=gelit6728.api.invalid bigip_mgmt_ip=10.122.116.161 context_name=uam context_type=untutl date_time=Feb 26 2016 20:15:08 dest_ip=10.40.68.117 dst_geo=uptassi dest_port=3179 device_product=scivel device_vendor=aqui device_version=1.4726 drop_reason=iveli errdefs_msgno=llumd errdefs_msg_name=enatuse flow_id=magn ip_protocol=icmp severity=low partition_name=eos route_domain=enimad sa_translation_pool=rmagni sa_translation_type=sit source_ip=10.209.155.149 src_geo=tenima source_port=1073 source_user=seq translated_dest_ip=10.82.56.117 translated_dest_port=2935 translated_ip_protocol=veleumi translated_route_domain=tia translated_source_ip=10.191.68.244 translated_source_port=6905 translated_vlan=veri vlan=5990 +siutaliq exercit tempor4496.www.localdomain eip lupta iusmodt [F5@doloreeu acl_policy_name=pori acl_policy_type=occ acl_rule_name=ect action=Accept hostname=uid545.www5.localhost bigip_mgmt_ip=10.12.44.169 context_name=autfu context_type=natura date_time=Mar 12 2016 03:17:42 dest_ip=10.163.217.10 dst_geo=untNequ dest_port=5075 device_product=nimadmin device_vendor=erep device_version=1.2696 drop_reason=temq errdefs_msgno=ugiatqu errdefs_msg_name=eacomm flow_id=Utenimad ip_protocol=igmp severity=high partition_name=ehend route_domain=ueipsaqu sa_translation_pool=uidolore sa_translation_type=niamqu source_ip=10.202.66.28 src_geo=tevelit source_port=5098 source_user=elits translated_dest_ip=10.131.233.27 translated_dest_port=5037 translated_ip_protocol=ari translated_route_domain=eataevit translated_source_ip=10.50.112.141 translated_source_port=7303 translated_vlan=dmi vlan=499 +mquisnos loremagn iciade3433.example enimad incididu eci [F5@aali acl_policy_name=ametcons acl_policy_type=porainc acl_rule_name=amquisno action=Established hostname=emquiavo452.internal.localhost bigip_mgmt_ip=10.151.111.38 context_name=tvol context_type=moll date_time=Mar 26 2016 10:20:16 dest_ip=10.228.149.225 dst_geo=ema dest_port=5969 device_product=tquovol device_vendor=ntsuntin device_version=1.3341 drop_reason=tatno errdefs_msgno=imav errdefs_msg_name=ididu flow_id=ciunt ip_protocol=ipv6-icmp severity=very-high partition_name=emqu route_domain=lit sa_translation_pool=iam sa_translation_type=qua source_ip=10.159.182.171 src_geo=umdolore source_port=6680 source_user=mol translated_dest_ip=10.96.35.212 translated_dest_port=3982 translated_ip_protocol=rumet translated_route_domain=oll translated_source_ip=10.206.197.113 translated_source_port=4075 translated_vlan=temUten vlan=4125 +iqu ollit usan6343.www5.domain olo uaera sitas [F5@ehenderi acl_policy_name=pidatat acl_policy_type=gni acl_rule_name=tquiinea action=Drop hostname=sun1403.www.invalid bigip_mgmt_ip=10.126.177.162 context_name=eriame context_type=lorema date_time=Apr 09 2016 17:22:51 dest_ip=10.213.82.64 dst_geo=rnatura dest_port=3007 device_product=ddoeiu device_vendor=enb device_version=1.6179 drop_reason=onse errdefs_msgno=liq errdefs_msg_name=metcon flow_id=smo ip_protocol=igmp severity=medium partition_name=emporinc route_domain=untutlab sa_translation_pool=tem sa_translation_type=ons source_ip=10.213.113.28 src_geo=ali source_port=6446 source_user=ist translated_dest_ip=10.169.144.147 translated_dest_port=2399 translated_ip_protocol=nibus translated_route_domain=edquiano translated_source_ip=10.89.163.114 translated_source_port=5166 translated_vlan=par vlan=686 +rveli rsint omm4276.www.example onofd taed lup [F5@remeumf acl_policy_name=antiumto acl_policy_type=strude acl_rule_name=ctetura action=Closed hostname=ittenbyC7838.api.localdomain bigip_mgmt_ip=10.18.124.28 context_name=ido context_type=paqu date_time=Apr 24 2016 00:25:25 dest_ip=10.158.194.3 dst_geo=qua dest_port=2945 device_product=quip device_vendor=oin device_version=1.6316 drop_reason=elaudant errdefs_msgno=tinvol errdefs_msg_name=dolore flow_id=abor ip_protocol=udp severity=medium partition_name=etc route_domain=etM sa_translation_pool=nimadmin sa_translation_type=ditautfu source_ip=10.146.88.52 src_geo=entsu source_port=5364 source_user=rudexerc translated_dest_ip=10.101.223.43 translated_dest_port=6494 translated_ip_protocol=quam translated_route_domain=adm translated_source_ip=10.103.107.47 translated_source_port=6094 translated_vlan=Nemoen vlan=2827 +icab mwr fugi4637.www.lan imadmini ntutla equa [F5@mexercit acl_policy_name=dtem acl_policy_type=tasuntex acl_rule_name=sunt action=Reject hostname=ume465.corp bigip_mgmt_ip=10.189.109.245 context_name=emaperi context_type=tame date_time=May 08 2016 07:27:59 dest_ip=10.83.234.60 dst_geo=ivelits dest_port=712 device_product=iusmodt device_vendor=etdolo device_version=1.3768 drop_reason=lorumw errdefs_msgno=ommod errdefs_msg_name=sequatur flow_id=uidolo ip_protocol=ipv6-icmp severity=high partition_name=nihi route_domain=Lor sa_translation_pool=itecto sa_translation_type=erc source_ip=10.69.57.206 src_geo=olupt source_port=5979 source_user=onse translated_dest_ip=10.110.99.17 translated_dest_port=6888 translated_ip_protocol=ostrume translated_route_domain=molest translated_source_ip=10.150.220.75 translated_source_port=1298 translated_vlan=tisetq vlan=5372 +ici giatquov eritquii3561.www.example taut oreseos uames [F5@tati acl_policy_name=utaliqu acl_policy_type=oriosamn acl_rule_name=deFinibu action=Drop hostname=iciatisu1463.www5.localdomain bigip_mgmt_ip=10.153.136.222 context_name=tem context_type=est date_time=May 22 2016 14:30:33 dest_ip=10.176.205.96 dst_geo=nidolo dest_port=3409 device_product=taliq device_vendor=intoccae device_version=1.2299 drop_reason=dolo errdefs_msgno=Loremip errdefs_msg_name=idolor flow_id=emeumfu ip_protocol=ipv6-icmp severity=very-high partition_name=lupt route_domain=psaquae sa_translation_pool=oinBCSe sa_translation_type=mnisist source_ip=10.199.34.241 src_geo=amvolup source_port=7700 source_user=temveleu translated_dest_ip=10.19.194.101 translated_dest_port=3605 translated_ip_protocol=numqu translated_route_domain=qui translated_source_ip=10.121.219.204 translated_source_port=3496 translated_vlan=utali vlan=3611 +reetd lumqui itinvo7084.mail.corp equep iavolu den [F5@tutla acl_policy_name=olorema acl_policy_type=iades acl_rule_name=siarchi action=Reject hostname=aliqu6801.api.localdomain bigip_mgmt_ip=10.46.27.57 context_name=ihilm context_type=atDu date_time=Jun 05 2016 21:33:08 dest_ip=10.128.232.208 dst_geo=usmodt dest_port=1837 device_product=run device_vendor=mque device_version=1.4138 drop_reason=quirat errdefs_msgno=llu errdefs_msg_name=licab flow_id=eirure ip_protocol=rdp severity=medium partition_name=oidentsu route_domain=atiset sa_translation_pool=atu sa_translation_type=umexerci source_ip=10.64.141.105 src_geo=iadese source_port=2374 source_user=ice translated_dest_ip=10.57.103.192 translated_dest_port=2716 translated_ip_protocol=oei translated_route_domain=tlabori translated_source_ip=10.182.199.231 translated_source_port=1426 translated_vlan=data vlan=4478 +nnum eritqu uradip7152.www5.home luptasn hitect dol [F5@leumiu acl_policy_name=namali acl_policy_type=taevit acl_rule_name=rinrepre action=Closed hostname=itame189.domain bigip_mgmt_ip=10.32.67.231 context_name=estia context_type=eaq date_time=Jun 20 2016 04:35:42 dest_ip=10.66.80.221 dst_geo=serunt dest_port=7865 device_product=texp device_vendor=tMalor device_version=1.7410 drop_reason=emoe errdefs_msgno=eaq errdefs_msg_name=amest flow_id=corp ip_protocol=tcp severity=low partition_name=rehender route_domain=iae sa_translation_pool=dantiumt sa_translation_type=luptasn source_ip=10.164.6.207 src_geo=olestiae source_port=5485 source_user=pic translated_dest_ip=10.160.210.31 translated_dest_port=7741 translated_ip_protocol=duntut translated_route_domain=magni translated_source_ip=10.3.134.237 translated_source_port=3156 translated_vlan=radipisc vlan=7020 +fficiade uscipit vitaedi1318.corp temqu edol colab [F5@ommodico acl_policy_name=quatD acl_policy_type=mcolab acl_rule_name=neav action=Established hostname=tsedqu2456.www5.invalid bigip_mgmt_ip=10.182.178.217 context_name=tlab context_type=volupt date_time=Jul 04 2016 11:38:16 dest_ip=10.188.169.107 dst_geo=beata dest_port=6448 device_product=fdeFi device_vendor=texp device_version=1.3545 drop_reason=etdol errdefs_msgno=uela errdefs_msg_name=boN flow_id=eprehend ip_protocol=tcp severity=medium partition_name=aboN route_domain=ihilmo sa_translation_pool=radi sa_translation_type=gel source_ip=10.235.101.253 src_geo=veniam source_port=2400 source_user=giatnu translated_dest_ip=10.42.138.192 translated_dest_port=3403 translated_ip_protocol=quioffi translated_route_domain=uptate translated_source_ip=10.201.6.10 translated_source_port=6608 translated_vlan=sequa vlan=2851 +ate aliquam nimid893.mail.corp umwr oluptate issus [F5@osamn acl_policy_name=isnisiu acl_policy_type=bore acl_rule_name=tsu action=Closed hostname=stlabo1228.mail.host bigip_mgmt_ip=10.151.161.70 context_name=edo context_type=asia date_time=Jul 18 2016 18:40:50 dest_ip=10.108.167.93 dst_geo=enderit dest_port=5858 device_product=essecil device_vendor=citation device_version=1.3795 drop_reason=eco errdefs_msgno=Utenimad errdefs_msg_name=orpor flow_id=tlabo ip_protocol=rdp severity=low partition_name=emvel route_domain=tmollita sa_translation_pool=fde sa_translation_type=nsecte source_ip=10.22.102.198 src_geo=eroi source_port=176 source_user=nse translated_dest_ip=10.194.247.171 translated_dest_port=4940 translated_ip_protocol=mquisnos translated_route_domain=maven translated_source_ip=10.86.101.235 translated_source_port=3266 translated_vlan=lapar vlan=1024 +tfu udan orema6040.api.corp mveleu nofdeFin sequam [F5@temvel acl_policy_name=ris acl_policy_type=nisi acl_rule_name=dant action=Reject hostname=ecte4762.local bigip_mgmt_ip=10.204.35.15 context_name=quidolor context_type=tessec date_time=Aug 02 2016 01:43:25 dest_ip=10.135.160.125 dst_geo=mve dest_port=513 device_product=itatio device_vendor=uta device_version=1.4901 drop_reason=sintoc errdefs_msgno=volupt errdefs_msg_name=siste flow_id=uiinea ip_protocol=icmp severity=low partition_name=volupta route_domain=rcitati sa_translation_pool=eni sa_translation_type=ionevo source_ip=10.174.252.105 src_geo=sperna source_port=5368 source_user=mnisi translated_dest_ip=10.107.168.60 translated_dest_port=2227 translated_ip_protocol=oinBC translated_route_domain=quameius translated_source_ip=10.167.172.155 translated_source_port=3544 translated_vlan=etdo vlan=706 +ese isaute ptatemq95.api.host Nequepo ipsumd ntocc [F5@uteirure acl_policy_name=nevo acl_policy_type=ide acl_rule_name=aali action=Drop hostname=smo7167.www.test bigip_mgmt_ip=10.214.249.164 context_name=tco context_type=uae date_time=Aug 16 2016 08:45:59 dest_ip=10.187.20.98 dst_geo=quinesc dest_port=6218 device_product=santiumd device_vendor=turadip device_version=1.3427 drop_reason=niamqui errdefs_msgno=orem errdefs_msg_name=sno flow_id=atno ip_protocol=ipv6-icmp severity=high partition_name=volu route_domain=nonn sa_translation_pool=inventor sa_translation_type=quiavol source_ip=10.99.249.210 src_geo=iatisu source_port=6684 source_user=upta translated_dest_ip=10.182.191.174 translated_dest_port=1759 translated_ip_protocol=adm translated_route_domain=leumiur translated_source_ip=10.81.26.208 translated_source_port=7651 translated_vlan=isc vlan=5933 +tobea tor qui4499.api.local fugiatn docon etconsec [F5@ios acl_policy_name=evolu acl_policy_type=ersp acl_rule_name=tquov action=Drop hostname=sauteiru4554.api.domain bigip_mgmt_ip=10.220.5.143 context_name=com context_type=tnulapa date_time=Aug 30 2016 15:48:33 dest_ip=10.108.85.148 dst_geo=eriti dest_port=2201 device_product=norum device_vendor=madmi device_version=1.1766 drop_reason=sequatu errdefs_msgno=quameius errdefs_msg_name=nisiuta flow_id=roid ip_protocol=icmp severity=very-high partition_name=eprehen route_domain=entor sa_translation_pool=xeacomm sa_translation_type=nihil source_ip=10.101.226.128 src_geo=rsitv source_port=3087 source_user=porro translated_dest_ip=10.88.101.53 translated_dest_port=2458 translated_ip_protocol=tatemUt translated_route_domain=modtemp translated_source_ip=10.201.238.90 translated_source_port=2715 translated_vlan=remag vlan=3759 +ccaecat tquiin tse4198.www.localdomain ptasn taedicta itam [F5@str acl_policy_name=idolore acl_policy_type=pid acl_rule_name=illoin action=Reject hostname=untut4046.internal.domain bigip_mgmt_ip=10.217.150.196 context_name=uine context_type=udant date_time=Sep 13 2016 22:51:07 dest_ip=10.183.59.41 dst_geo=untu dest_port=5676 device_product=ven device_vendor=con device_version=1.7491 drop_reason=amnih errdefs_msgno=ium errdefs_msg_name=esciuntN flow_id=idunt ip_protocol=udp severity=low partition_name=rQu route_domain=oremeu sa_translation_pool=laudant sa_translation_type=isnost source_ip=10.157.18.252 src_geo=itess source_port=52 source_user=evit translated_dest_ip=10.30.133.66 translated_dest_port=1921 translated_ip_protocol=velitse translated_route_domain=oditem translated_source_ip=10.243.218.215 translated_source_port=662 translated_vlan=rsitvolu vlan=3751 +sumdolor meaqueip npr4414.api.localdomain boNem ess ipisci [F5@gitsed acl_policy_name=tqu acl_policy_type=reprehen acl_rule_name=trumexer action=Accept hostname=quid3147.mail.home bigip_mgmt_ip=10.66.181.6 context_name=epre context_type=tobeata date_time=Sep 28 2016 05:53:42 dest_ip=10.181.53.249 dst_geo=iduntu dest_port=1655 device_product=temUt device_vendor=avol device_version=1.752 drop_reason=essequam errdefs_msgno=acommo errdefs_msg_name=nturma flow_id=str ip_protocol=ipv6 severity=high partition_name=etur route_domain=itecto sa_translation_pool=reetdol sa_translation_type=totamre source_ip=10.148.161.250 src_geo=ciadeser source_port=6135 source_user=adipisc translated_dest_ip=10.181.133.187 translated_dest_port=1079 translated_ip_protocol=aquioffi translated_route_domain=tamet translated_source_ip=10.167.227.44 translated_source_port=6595 translated_vlan=eFi vlan=6733 +its ender riamea1540.www.host seq tutlab sau [F5@atevelit acl_policy_name=meius acl_policy_type=billo acl_rule_name=labo action=Reject hostname=umdolo1029.mail.localhost bigip_mgmt_ip=10.54.17.32 context_name=orumSe context_type=ratv date_time=Oct 12 2016 12:56:16 dest_ip=10.119.81.180 dst_geo=psaquaea dest_port=1348 device_product=nts device_vendor=siut device_version=1.5663 drop_reason=ano errdefs_msgno=piscinge errdefs_msg_name=tvol flow_id=velitess ip_protocol=ipv6 severity=high partition_name=uunturm route_domain=temUte sa_translation_pool=sit sa_translation_type=olab source_ip=10.84.163.178 src_geo=ima source_port=2031 source_user=mquisno translated_dest_ip=10.107.9.163 translated_dest_port=5433 translated_ip_protocol=eacommod translated_route_domain=ctetura translated_source_ip=10.74.11.43 translated_source_port=55 translated_vlan=seosqui vlan=6797 +uradi tot llamco7206.www.home oremagna ncididun umSe [F5@xeacomm acl_policy_name=cinge acl_policy_type=itla acl_rule_name=iamquis action=Accept hostname=lorsita2019.internal.home bigip_mgmt_ip=10.192.229.221 context_name=ect context_type=modocons date_time=Oct 26 2016 19:58:50 dest_ip=10.199.194.188 dst_geo=odoconse dest_port=228 device_product=quatu device_vendor=veli device_version=1.5726 drop_reason=nonp errdefs_msgno=labo errdefs_msg_name=ulapar flow_id=aboreetd ip_protocol=igmp severity=low partition_name=llitanim route_domain=invo sa_translation_pool=hit sa_translation_type=urv source_ip=10.112.32.213 src_geo=runtmol source_port=1749 source_user=odi translated_dest_ip=10.184.73.211 translated_dest_port=6540 translated_ip_protocol=esseci translated_route_domain=tametcon translated_source_ip=10.230.129.252 translated_source_port=3947 translated_vlan=isis vlan=4917 +utlab emUteni rum959.host velillu cteturad bor [F5@rauto acl_policy_name=ationev acl_policy_type=umdolor acl_rule_name=uaUten action=Reject hostname=paquioff624.mail.invalid bigip_mgmt_ip=10.161.148.64 context_name=ibusBon context_type=ven date_time=Nov 10 2016 03:01:24 dest_ip=10.162.114.217 dst_geo=doloreme dest_port=60 device_product=onemulla device_vendor=evitaed device_version=1.1721 drop_reason=suntin errdefs_msgno=itse errdefs_msg_name=umexerc flow_id=oremipsu ip_protocol=ipv6-icmp severity=medium partition_name=amco route_domain=ssecillu sa_translation_pool=liqua sa_translation_type=olo source_ip=10.199.216.143 src_geo=fdeF source_port=593 source_user=ccaeca translated_dest_ip=10.198.213.189 translated_dest_port=5024 translated_ip_protocol=remagn translated_route_domain=mquae translated_source_ip=10.7.200.140 translated_source_port=3298 translated_vlan=olupt vlan=2189 +edquiac urerepr eseru4234.mail.example qua rsita ate [F5@ipsamvo acl_policy_name=onula acl_policy_type=miu acl_rule_name=rationev action=Reject hostname=mex2054.mail.corp bigip_mgmt_ip=10.65.232.27 context_name=ica context_type=lillum date_time=Nov 24 2016 10:03:59 dest_ip=10.199.40.38 dst_geo=taedicta dest_port=3409 device_product=poriss device_vendor=tvolup device_version=1.1000 drop_reason=siu errdefs_msgno=snost errdefs_msg_name=tpersp flow_id=llamc ip_protocol=tcp severity=very-high partition_name=mvel route_domain=nof sa_translation_pool=usmodi sa_translation_type=mvolu source_ip=10.206.96.56 src_geo=aincidu source_port=2687 source_user=uaeab translated_dest_ip=10.128.157.27 translated_dest_port=1493 translated_ip_protocol=etdolor translated_route_domain=lupta translated_source_ip=10.22.187.69 translated_source_port=3590 translated_vlan=oremi vlan=1485 +nbyCi tevel usc5760.www5.localdomain cab atisund xea [F5@ites acl_policy_name=isetq acl_policy_type=iutali acl_rule_name=velite action=Closed hostname=avolupt7576.api.corp bigip_mgmt_ip=10.194.210.62 context_name=porincid context_type=atisetqu date_time=Dec 08 2016 17:06:33 dest_ip=10.51.213.42 dst_geo=dipisci dest_port=3449 device_product=ilmol device_vendor=eri device_version=1.3104 drop_reason=ueipsa errdefs_msgno=tae errdefs_msg_name=autodit flow_id=elit ip_protocol=udp severity=high partition_name=plica route_domain=ore sa_translation_pool=quidolor sa_translation_type=inven source_ip=10.71.114.14 src_geo=itsedd source_port=3010 source_user=admin translated_dest_ip=10.68.253.120 translated_dest_port=481 translated_ip_protocol=est translated_route_domain=uptatemU translated_source_ip=10.183.130.225 translated_source_port=5693 translated_vlan=item vlan=2738 +dat periam dqu6144.api.localhost dutpers erun orisn [F5@reetd acl_policy_name=prehen acl_policy_type=ntutlabo acl_rule_name=iusmodte action=Established hostname=loi7596.www5.home bigip_mgmt_ip=10.31.177.226 context_name=deserun context_type=esseq date_time=Dec 23 2016 00:09:07 dest_ip=10.209.157.8 dst_geo=giatquov dest_port=1918 device_product=enderi device_vendor=ptatem device_version=1.341 drop_reason=fugi errdefs_msgno=labo errdefs_msg_name=nostrud flow_id=gnaal ip_protocol=ggp severity=medium partition_name=cupi route_domain=tame sa_translation_pool=atione sa_translation_type=lores source_ip=10.45.253.103 src_geo=uii source_port=5923 source_user=remagn translated_dest_ip=10.47.255.237 translated_dest_port=2311 translated_ip_protocol=uuntur translated_route_domain=enderit translated_source_ip=10.107.45.175 translated_source_port=4185 translated_vlan=rumSecti vlan=4593 +atise tate onevo4326.internal.local isnost olorem ido [F5@emqu acl_policy_name=riss acl_policy_type=iquamqua acl_rule_name=sit action=Reject hostname=nsequat1971.internal.invalid bigip_mgmt_ip=10.225.212.189 context_name=mven context_type=olorsit date_time=Jan 06 2017 07:11:41 dest_ip=10.121.239.183 dst_geo=illu dest_port=4875 device_product=turadip device_vendor=tatevel device_version=1.1607 drop_reason=ptassita errdefs_msgno=its errdefs_msg_name=lore flow_id=idol ip_protocol=igmp severity=high partition_name=isn route_domain=sBono sa_translation_pool=loremqu sa_translation_type=tetur source_ip=10.213.94.135 src_geo=tMal source_port=2607 source_user=dquia translated_dest_ip=10.55.105.113 translated_dest_port=3214 translated_ip_protocol=tatione translated_route_domain=nimveni translated_source_ip=10.44.58.106 translated_source_port=1241 translated_vlan=quid vlan=4814 +eporroq ulla iqu4614.www5.example abore squ uiadol [F5@Duisa acl_policy_name=lupta acl_policy_type=aUt acl_rule_name=boNem action=Reject hostname=ectiono2241.lan bigip_mgmt_ip=10.2.114.9 context_name=rehende context_type=velillu date_time=Jan 20 2017 14:14:16 dest_ip=10.94.139.127 dst_geo=mUten dest_port=1812 device_product=quidolor device_vendor=oqu device_version=1.51 drop_reason=tlaboree errdefs_msgno=norumet errdefs_msg_name=dtempo flow_id=tin ip_protocol=tcp severity=high partition_name=imad route_domain=tinvolup sa_translation_pool=tsed sa_translation_type=inv source_ip=10.163.209.70 src_geo=atu source_port=4718 source_user=olabor translated_dest_ip=10.69.161.78 translated_dest_port=1282 translated_ip_protocol=iruredol translated_route_domain=incidid translated_source_ip=10.255.74.136 translated_source_port=5902 translated_vlan=eaqueips vlan=6396 +volupta dmi untexpl2847.www5.local eiusmod emoe uiinea [F5@mnisiut acl_policy_name=avolu acl_policy_type=Except acl_rule_name=olup action=Closed hostname=umetMal1664.mail.lan bigip_mgmt_ip=10.46.115.216 context_name=equun context_type=sitvo date_time=Feb 03 2017 21:16:50 dest_ip=10.223.198.146 dst_geo=iciad dest_port=7874 device_product=mad device_vendor=onse device_version=1.380 drop_reason=mipsum errdefs_msgno=lmo errdefs_msg_name=aliquamq flow_id=dtempori ip_protocol=rdp severity=medium partition_name=voluptat route_domain=ugit sa_translation_pool=tatem sa_translation_type=metcons source_ip=10.252.102.110 src_geo=henderit source_port=7829 source_user=perspici translated_dest_ip=10.184.59.148 translated_dest_port=6933 translated_ip_protocol=queips translated_route_domain=midest translated_source_ip=10.12.129.137 translated_source_port=721 translated_vlan=orroqu vlan=472 +labore uela ntexplic4824.internal.localhost dolorsit archite remq [F5@veniamq acl_policy_name=occ acl_policy_type=oloreseo acl_rule_name=iruredol action=Established hostname=derit5270.mail.local bigip_mgmt_ip=10.105.52.140 context_name=ntexpl context_type=dunt date_time=Feb 18 2017 04:19:24 dest_ip=10.20.55.199 dst_geo=nder dest_port=3238 device_product=itanim device_vendor=nesciun device_version=1.1729 drop_reason=mollita errdefs_msgno=tatem errdefs_msg_name=iae flow_id=quido ip_protocol=ipv6-icmp severity=very-high partition_name=inBC route_domain=mol sa_translation_pool=tur sa_translation_type=ictas source_ip=10.81.184.7 src_geo=saquaea source_port=6344 source_user=eetd translated_dest_ip=10.155.204.243 translated_dest_port=459 translated_ip_protocol=lorsi translated_route_domain=repreh translated_source_ip=10.199.194.79 translated_source_port=7713 translated_vlan=illumqui vlan=3414 +amali ate idolor3916.www5.home tas autfugi tasun [F5@duntutla acl_policy_name=ntium acl_policy_type=iration acl_rule_name=umwritte action=Closed hostname=orisni5238.mail.lan bigip_mgmt_ip=10.177.238.45 context_name=iumt context_type=tsed date_time=Mar 04 2017 11:21:59 dest_ip=10.249.120.78 dst_geo=unte dest_port=893 device_product=ueipsa device_vendor=scipitl device_version=1.1453 drop_reason=aparia errdefs_msgno=tatnon errdefs_msg_name=leumiur flow_id=tetura ip_protocol=ggp severity=very-high partition_name=oluptat route_domain=metco sa_translation_pool=acom sa_translation_type=ceroinB source_ip=10.110.2.166 src_geo=exeacomm source_port=79 source_user=taliqui translated_dest_ip=10.18.226.72 translated_dest_port=5140 translated_ip_protocol=olupta translated_route_domain=tsuntinc translated_source_ip=10.251.231.142 translated_source_port=872 translated_vlan=urExcep vlan=102 +suntex iacons occaec7487.corp quaeab fici imve [F5@quide acl_policy_name=quaU acl_policy_type=undeomni acl_rule_name=accusa action=Established hostname=iutali7297.www.domain bigip_mgmt_ip=10.190.122.27 context_name=mporainc context_type=xea date_time=Mar 18 2017 18:24:33 dest_ip=10.123.113.152 dst_geo=billo dest_port=2618 device_product=radipisc device_vendor=Cice device_version=1.6332 drop_reason=vitaed errdefs_msgno=ser errdefs_msg_name=etconsec flow_id=elillum ip_protocol=tcp severity=high partition_name=rnat route_domain=eprehend sa_translation_pool=rem sa_translation_type=edolo source_ip=10.99.202.229 src_geo=eosquira source_port=4392 source_user=lloinven translated_dest_ip=10.100.199.226 translated_dest_port=7617 translated_ip_protocol=apariatu translated_route_domain=lorsita translated_source_ip=10.192.98.247 translated_source_port=4308 translated_vlan=temaccu vlan=5302 +uptassit ncidi tlabori4803.www5.local oconse mag tob [F5@dolores acl_policy_name=equamnih acl_policy_type=taliqui acl_rule_name=eiu action=Drop hostname=orumw5960.www5.home bigip_mgmt_ip=10.248.111.207 context_name=dolor context_type=tiumto date_time=Apr 02 2017 01:27:07 dest_ip=10.38.28.151 dst_geo=nrepreh dest_port=5251 device_product=equep device_vendor=ever device_version=1.6463 drop_reason=atq errdefs_msgno=erspi errdefs_msg_name=iqu flow_id=niamqu ip_protocol=rdp severity=medium partition_name=icab route_domain=sBonor sa_translation_pool=fugits sa_translation_type=mipsumqu source_ip=10.172.154.97 src_geo=admi source_port=7165 source_user=culpaq translated_dest_ip=10.162.97.197 translated_dest_port=4357 translated_ip_protocol=tcupida translated_route_domain=isa translated_source_ip=10.37.193.70 translated_source_port=170 translated_vlan=tesseq vlan=7693 +pernat rerepre nculpaq3821.www5.invalid billoinv sci col [F5@obea acl_policy_name=emp acl_policy_type=agnaaliq acl_rule_name=est action=Reject hostname=oinv5493.internal.domain bigip_mgmt_ip=10.36.63.31 context_name=nisiu context_type=imad date_time=Apr 16 2017 08:29:41 dest_ip=10.30.101.79 dst_geo=itasp dest_port=4927 device_product=sitametc device_vendor=onsequa device_version=1.3912 drop_reason=ntmo errdefs_msgno=loreeu errdefs_msg_name=temse flow_id=aspernat ip_protocol=ipv6 severity=very-high partition_name=caecat route_domain=rautod sa_translation_pool=olest sa_translation_type=eataev source_ip=10.171.221.230 src_geo=edquia source_port=1977 source_user=otamr translated_dest_ip=10.222.165.250 translated_dest_port=2757 translated_ip_protocol=amvolu translated_route_domain=mip translated_source_ip=10.45.35.180 translated_source_port=653 translated_vlan=maccusa vlan=7248 +nimad ataevita oremqu542.internal.localhost uteir boree isn [F5@ulla acl_policy_name=equatDu acl_policy_type=pta acl_rule_name=enbyCi action=Reject hostname=tnonproi195.api.home bigip_mgmt_ip=10.238.4.219 context_name=uide context_type=scivel date_time=Apr 30 2017 15:32:16 dest_ip=10.150.9.246 dst_geo=meumfugi dest_port=7010 device_product=emaperia device_vendor=Section device_version=1.4329 drop_reason=iame errdefs_msgno=orroquis errdefs_msg_name=aquio flow_id=riatu ip_protocol=udp severity=low partition_name=tanimid route_domain=isnostru sa_translation_pool=nofdeFi sa_translation_type=aquioff source_ip=10.1.171.61 src_geo=amnisi source_port=7258 source_user=reetdolo translated_dest_ip=10.199.127.211 translated_dest_port=3598 translated_ip_protocol=ilmole translated_route_domain=ugi translated_source_ip=10.83.238.145 translated_source_port=5392 translated_vlan=emveleum vlan=3661 +nde abillo undeom845.www5.example quaer eetdo tlab [F5@spernatu acl_policy_name=exercita acl_policy_type=sBonorum acl_rule_name=atems action=Drop hostname=edictasu5362.internal.localhost bigip_mgmt_ip=10.65.141.244 context_name=turmag context_type=ipsaqu date_time=May 14 2017 22:34:50 dest_ip=10.203.69.36 dst_geo=quira dest_port=3091 device_product=ore device_vendor=tation device_version=1.3789 drop_reason=porincid errdefs_msgno=tperspic errdefs_msg_name=equu flow_id=sintoc ip_protocol=rdp severity=very-high partition_name=tetura route_domain=riosamni sa_translation_pool=icta sa_translation_type=luptate source_ip=10.170.252.219 src_geo=iqui source_port=1978 source_user=Nequepo translated_dest_ip=10.44.226.104 translated_dest_port=7020 translated_ip_protocol=nse translated_route_domain=veniam translated_source_ip=10.74.213.42 translated_source_port=5922 translated_vlan=sse vlan=2498 +inBCSe otamrem tutlabor4180.internal.host consecte pteurs catcupi [F5@autf acl_policy_name=saqu acl_policy_type=uptat acl_rule_name=unt action=Reject hostname=uido492.www5.home bigip_mgmt_ip=10.180.48.221 context_name=lors context_type=aconsequ date_time=May 29 2017 05:37:24 dest_ip=10.33.195.166 dst_geo=sequat dest_port=4596 device_product=utemvel device_vendor=epteur device_version=1.2965 drop_reason=iusm errdefs_msgno=roi errdefs_msg_name=busBonor flow_id=stquido ip_protocol=igmp severity=high partition_name=mnisi route_domain=usmo sa_translation_pool=iamea sa_translation_type=imaveni source_ip=10.183.223.149 src_geo=cor source_port=2648 source_user=nihil translated_dest_ip=10.225.255.211 translated_dest_port=5595 translated_ip_protocol=citati translated_route_domain=uamei translated_source_ip=10.225.141.172 translated_source_port=956 translated_vlan=fugiatn vlan=3309 +aaliq nat uovolupt307.internal.host serror onse umquam [F5@emagn acl_policy_name=emulla acl_policy_type=mips acl_rule_name=itae action=Established hostname=redo6311.api.invalid bigip_mgmt_ip=10.176.64.28 context_name=olup context_type=remipsu date_time=Jun 12 2017 12:39:58 dest_ip=10.92.6.176 dst_geo=mcorpor dest_port=7420 device_product=autfugit device_vendor=emUte device_version=1.7612 drop_reason=nturmag errdefs_msgno=tura errdefs_msg_name=osquirat flow_id=equat ip_protocol=tcp severity=high partition_name=usantiu route_domain=idunt sa_translation_pool=atqu sa_translation_type=naturau source_ip=10.97.138.181 src_geo=oluptat source_port=7128 source_user=eseruntm translated_dest_ip=10.205.174.181 translated_dest_port=766 translated_ip_protocol=olor translated_route_domain=etquasia translated_source_ip=10.169.123.103 translated_source_port=519 translated_vlan=uisa vlan=6863 +Cicero evolupta teturadi4718.api.local piscivel hend eacommo [F5@ueip acl_policy_name=maliqu acl_policy_type=iati acl_rule_name=minim action=Established hostname=dolorem1698.www.domain bigip_mgmt_ip=10.75.120.11 context_name=urau context_type=etur date_time=Jun 26 2017 19:42:33 dest_ip=10.20.73.247 dst_geo=laborum dest_port=5749 device_product=xeac device_vendor=umdolors device_version=1.4226 drop_reason=uiadolo errdefs_msgno=empor errdefs_msg_name=umexerci flow_id=duntut ip_protocol=ggp severity=very-high partition_name=prehend route_domain=eufug sa_translation_pool=roquisq sa_translation_type=temporai source_ip=10.53.101.131 src_geo=ici source_port=5097 source_user=tquo translated_dest_ip=10.204.4.40 translated_dest_port=271 translated_ip_protocol=sitvo translated_route_domain=ine translated_source_ip=10.169.101.161 translated_source_port=4577 translated_vlan=ipi vlan=4211 +exerci idata ese4384.mail.domain rumexerc isiutali iquidexe [F5@illumq acl_policy_name=luptatem acl_policy_type=ite acl_rule_name=tasnul action=Reject hostname=evitae7333.www.lan bigip_mgmt_ip=10.28.51.219 context_name=ess context_type=quiad date_time=Jul 11 2017 02:45:07 dest_ip=10.43.210.236 dst_geo=litanim dest_port=2135 device_product=orsitam device_vendor=modico device_version=1.2990 drop_reason=itatio errdefs_msgno=porinc errdefs_msg_name=riame flow_id=riat ip_protocol=udp severity=very-high partition_name=eriam route_domain=pernat sa_translation_pool=udan sa_translation_type=archi source_ip=10.6.222.112 src_geo=aliqu source_port=780 source_user=onsequu translated_dest_ip=10.156.117.169 translated_dest_port=2939 translated_ip_protocol=agnamal translated_route_domain=quei translated_source_ip=10.87.120.87 translated_source_port=1636 translated_vlan=teni vlan=4967 +dant etdolor uat7787.www.host iti nimadm nculp [F5@asp acl_policy_name=eacom acl_policy_type=mag acl_rule_name=gelitse action=Drop hostname=arc2412.mail.lan bigip_mgmt_ip=10.247.44.59 context_name=eiusmo context_type=ainc date_time=Jul 25 2017 09:47:41 dest_ip=10.173.129.72 dst_geo=ecill dest_port=6831 device_product=snu device_vendor=inibusB device_version=1.388 drop_reason=texplica errdefs_msgno=oco errdefs_msg_name=aboree flow_id=ainci ip_protocol=udp severity=high partition_name=pariatur route_domain=uames sa_translation_pool=umtotamr sa_translation_type=mquido source_ip=10.57.89.155 src_geo=rur source_port=3553 source_user=ntorever translated_dest_ip=10.253.167.17 translated_dest_port=2990 translated_ip_protocol=seos translated_route_domain=exercita translated_source_ip=10.4.126.103 translated_source_port=892 translated_vlan=tco vlan=3607 +oluptate lit santi837.api.domain turadip dip idolo [F5@Ute acl_policy_name=ptassita acl_policy_type=caecatcu acl_rule_name=inBC action=Established hostname=olorsi2746.internal.localhost bigip_mgmt_ip=10.15.240.220 context_name=teir context_type=quep date_time=Aug 08 2017 16:50:15 dest_ip=10.63.78.66 dst_geo=xeac dest_port=7061 device_product=abor device_vendor=oreverit device_version=1.6451 drop_reason=reetdo errdefs_msgno=tat errdefs_msg_name=eufugia flow_id=ncididun ip_protocol=tcp severity=medium partition_name=periamea route_domain=itametco sa_translation_pool=vel sa_translation_type=quunt source_ip=10.248.206.210 src_geo=nonn source_port=4478 source_user=met translated_dest_ip=10.36.69.125 translated_dest_port=7157 translated_ip_protocol=entsu translated_route_domain=conse translated_source_ip=10.143.183.208 translated_source_port=5214 translated_vlan=umwri vlan=4057 +atura tur tur5914.internal.invalid tassita colabori imidestl [F5@piscing acl_policy_name=ceroi acl_policy_type=iconsequ acl_rule_name=iat action=Established hostname=edqu2208.www.localhost bigip_mgmt_ip=10.6.32.7 context_name=exerci context_type=inesciu date_time=Aug 22 2017 23:52:50 dest_ip=10.141.216.14 dst_geo=emu dest_port=5311 device_product=psa device_vendor=ate device_version=1.4386 drop_reason=fugitse errdefs_msgno=minimve errdefs_msg_name=serrorsi flow_id=tametco ip_protocol=ipv6-icmp severity=high partition_name=lore route_domain=isci sa_translation_pool=Dui sa_translation_type=reetdo source_ip=10.69.170.107 src_geo=iumtotam source_port=1010 source_user=ipitlabo translated_dest_ip=10.34.133.2 translated_dest_port=4807 translated_ip_protocol=nderi translated_route_domain=liqua translated_source_ip=10.142.186.43 translated_source_port=4691 translated_vlan=sautei vlan=2363 +voluptas velill rspic5453.www.local meum borumSec aecatcup [F5@snisiut acl_policy_name=siar acl_policy_type=quas acl_rule_name=occaeca action=Closed hostname=ender5647.www5.example bigip_mgmt_ip=10.142.22.24 context_name=ulamc context_type=cept date_time=Sep 06 2017 06:55:24 dest_ip=10.93.88.228 dst_geo=rchitect dest_port=3402 device_product=gna device_vendor=ici device_version=1.2026 drop_reason=olu errdefs_msgno=iameaque errdefs_msg_name=identsun flow_id=ender ip_protocol=ipv6 severity=low partition_name=tect route_domain=uiad sa_translation_pool=doconse sa_translation_type=eni source_ip=10.121.153.197 src_geo=smoditem source_port=6593 source_user=borumSec translated_dest_ip=10.59.103.10 translated_dest_port=768 translated_ip_protocol=oquisq translated_route_domain=abori translated_source_ip=10.170.165.164 translated_source_port=505 translated_vlan=uiineavo vlan=5554 +uidexeac sequa ntsunti2313.internal.invalid uinesc cid emi [F5@Bonorum acl_policy_name=lesti acl_policy_type=oreseo acl_rule_name=reprehen action=Established hostname=sis3986.internal.lan bigip_mgmt_ip=10.133.10.122 context_name=texplic context_type=edutp date_time=Sep 20 2017 13:57:58 dest_ip=10.93.59.189 dst_geo=eserun dest_port=3034 device_product=eniamqu device_vendor=inimav device_version=1.1576 drop_reason=imadm errdefs_msgno=uta errdefs_msg_name=tisu flow_id=remagnam ip_protocol=icmp severity=low partition_name=meiusm route_domain=nidolo sa_translation_pool=atquovol sa_translation_type=quunt source_ip=10.247.114.30 src_geo=olesti source_port=7584 source_user=quaeabil translated_dest_ip=10.19.99.129 translated_dest_port=956 translated_ip_protocol=itesse translated_route_domain=iamqui translated_source_ip=10.176.83.7 translated_source_port=5908 translated_vlan=inim vlan=6806 +Sed oremeumf lesti5921.api.localhost enima tnulapar ico [F5@giatquo acl_policy_name=lors acl_policy_type=its acl_rule_name=dolor action=Drop hostname=uatu2894.api.lan bigip_mgmt_ip=10.64.139.17 context_name=pro context_type=ice date_time=Oct 04 2017 21:00:32 dest_ip=10.87.238.169 dst_geo=conse dest_port=5351 device_product=mcol device_vendor=lup device_version=1.3824 drop_reason=upta errdefs_msgno=sedquian errdefs_msg_name=cti flow_id=rumSecti ip_protocol=rdp severity=medium partition_name=eca route_domain=oluptate sa_translation_pool=Duisa sa_translation_type=consequa source_ip=10.40.177.138 src_geo=aevitaed source_port=1082 source_user=rep translated_dest_ip=10.8.29.219 translated_dest_port=6890 translated_ip_protocol=quaeratv translated_route_domain=involu translated_source_ip=10.70.7.23 translated_source_port=2758 translated_vlan=amcolab vlan=4306 +odic iuta liquaUte209.internal.test olores scipit lloinve [F5@borisnis acl_policy_name=onorumet acl_policy_type=ptatema acl_rule_name=eavolup action=Closed hostname=rmagnido5483.local bigip_mgmt_ip=10.180.62.222 context_name=ptatev context_type=atu date_time=Oct 19 2017 04:03:07 dest_ip=10.234.26.132 dst_geo=msequ dest_port=2383 device_product=mwritten device_vendor=tat device_version=1.6066 drop_reason=osa errdefs_msgno=mini errdefs_msg_name=rors flow_id=ssusci ip_protocol=udp severity=medium partition_name=inimve route_domain=uio sa_translation_pool=mexercit sa_translation_type=byC source_ip=10.2.189.20 src_geo=orin source_port=535 source_user=uptasnul translated_dest_ip=10.67.221.220 translated_dest_port=239 translated_ip_protocol=aedict translated_route_domain=niamqui translated_source_ip=10.67.173.228 translated_source_port=5767 translated_vlan=tatemse vlan=4493 +uamestqu mpor orem6479.api.host seq rumSe tatnonp [F5@ommo acl_policy_name=adeser acl_policy_type=uasiarc acl_rule_name=doeiu action=Reject hostname=uian521.www.example bigip_mgmt_ip=10.209.52.47 context_name=imven context_type=onnumqua date_time=Nov 02 2017 11:05:41 dest_ip=10.141.201.173 dst_geo=upt dest_port=6017 device_product=itautfu device_vendor=nesci device_version=1.5040 drop_reason=mquis errdefs_msgno=lorsi errdefs_msg_name=tetura flow_id=eeufug ip_protocol=ipv6 severity=medium partition_name=tevelite route_domain=tocca sa_translation_pool=orsitvol sa_translation_type=ntor source_ip=10.147.127.181 src_geo=minimav source_port=6994 source_user=tasu translated_dest_ip=10.56.134.118 translated_dest_port=358 translated_ip_protocol=evo translated_route_domain=mcorpori translated_source_ip=10.196.176.243 translated_source_port=3465 translated_vlan=orsitam vlan=4991 +prehende lup tpers2217.internal.lan nula tdolorem qui [F5@olupt acl_policy_name=nemulla acl_policy_type=asp acl_rule_name=dexercit action=Closed hostname=taliq5213.api.corp bigip_mgmt_ip=10.226.24.84 context_name=ectobea context_type=dat date_time=Nov 16 2017 18:08:15 dest_ip=10.91.18.221 dst_geo=aut dest_port=5596 device_product=uames device_vendor=tconsec device_version=1.7604 drop_reason=oll errdefs_msgno=laboree errdefs_msg_name=udantiu flow_id=itametco ip_protocol=ipv6 severity=very-high partition_name=odico route_domain=rsint sa_translation_pool=itl sa_translation_type=ttenb source_ip=10.231.18.90 src_geo=lapa source_port=4860 source_user=Nem translated_dest_ip=10.85.13.237 translated_dest_port=4072 translated_ip_protocol=upidata translated_route_domain=ici translated_source_ip=10.248.140.59 translated_source_port=5760 translated_vlan=ident vlan=4293 +quelaud luptat rinrep6482.api.lan nimv emeu tatemac [F5@quisn acl_policy_name=rem acl_policy_type=ulamcola acl_rule_name=remagnaa action=Accept hostname=ntsunt4894.mail.domain bigip_mgmt_ip=10.203.46.215 context_name=mcorpori context_type=orisn date_time=Dec 01 2017 01:10:49 dest_ip=10.88.194.242 dst_geo=mco dest_port=6246 device_product=itame device_vendor=tenat device_version=1.5407 drop_reason=yCiceroi errdefs_msgno=nostrum errdefs_msg_name=orroquis flow_id=eumi ip_protocol=icmp severity=low partition_name=aea route_domain=tvolu sa_translation_pool=dutper sa_translation_type=tlaboru source_ip=10.207.183.204 src_geo=equuntu source_port=2673 source_user=eruntmo translated_dest_ip=10.8.224.72 translated_dest_port=6506 translated_ip_protocol=ion translated_route_domain=rured translated_source_ip=10.59.215.207 translated_source_port=6195 translated_vlan=ore vlan=5842 +xerc Nequep ametcon7485.www.test rro tuser ctasu [F5@irat acl_policy_name=sitame acl_policy_type=oinven acl_rule_name=natu action=Drop hostname=mexer3864.api.corp bigip_mgmt_ip=10.98.154.146 context_name=nula context_type=ameaquei date_time=Dec 15 2017 08:13:24 dest_ip=10.72.114.116 dst_geo=mquis dest_port=7760 device_product=olupta device_vendor=isno device_version=1.6814 drop_reason=ine errdefs_msgno=aeco errdefs_msg_name=rinrepr flow_id=dutp ip_protocol=ipv6-icmp severity=very-high partition_name=giatqu route_domain=rsint sa_translation_pool=rsi sa_translation_type=paq source_ip=10.73.84.95 src_geo=uisautem source_port=6701 source_user=sitam translated_dest_ip=10.255.145.22 translated_dest_port=6949 translated_ip_protocol=emUtenim translated_route_domain=ende translated_source_ip=10.230.38.148 translated_source_port=3213 translated_vlan=sse vlan=368 +incidi aedictas rumetMa2554.domain unt liq abore [F5@iumdo acl_policy_name=oreeu acl_policy_type=mea acl_rule_name=ssec action=Accept hostname=oluptat6960.www5.test bigip_mgmt_ip=10.211.29.187 context_name=ptat context_type=meaquei date_time=Dec 29 2017 15:15:58 dest_ip=10.228.204.249 dst_geo=eleumi dest_port=4584 device_product=porissus device_vendor=imip device_version=1.7160 drop_reason=ddoe errdefs_msgno=uptateve errdefs_msg_name=ured flow_id=ctetu ip_protocol=tcp severity=low partition_name=uasiarch route_domain=Malor sa_translation_pool=boriosa sa_translation_type=cillumdo source_ip=10.166.142.198 src_geo=oremipsu source_port=465 source_user=tium translated_dest_ip=10.105.120.162 translated_dest_port=2984 translated_ip_protocol=etc translated_route_domain=eturadip translated_source_ip=10.175.181.138 translated_source_port=3787 translated_vlan=tassitas vlan=1495 +velite maccus nima5813.mail.example iarchit sBonorum moenimi [F5@lor acl_policy_name=auto acl_policy_type=rsinto acl_rule_name=ati action=Established hostname=fugiatnu2498.www.localhost bigip_mgmt_ip=10.182.213.195 context_name=tconse context_type=eumf date_time=Jan 12 2018 22:18:32 dest_ip=10.200.94.145 dst_geo=doconse dest_port=5211 device_product=uis device_vendor=lill device_version=1.6057 drop_reason=imi errdefs_msgno=animi errdefs_msg_name=edutpers flow_id=pisci ip_protocol=tcp severity=very-high partition_name=umto route_domain=xercit sa_translation_pool=lam sa_translation_type=asnu source_ip=10.122.133.162 src_geo=eriam source_port=4838 source_user=aquae translated_dest_ip=10.220.202.102 translated_dest_port=10 translated_ip_protocol=iaturE translated_route_domain=epor translated_source_ip=10.195.139.25 translated_source_port=5566 translated_vlan=tper vlan=4341 +tconsect pariat iutal3376.api.corp isi idexeac ntu [F5@tdolo acl_policy_name=nimve acl_policy_type=duntut acl_rule_name=emporin action=Reject hostname=ptat3230.domain bigip_mgmt_ip=10.156.208.5 context_name=tlaboru context_type=tec date_time=Jan 27 2018 05:21:06 dest_ip=10.9.69.13 dst_geo=uatD dest_port=6508 device_product=antium device_vendor=remaper device_version=1.3297 drop_reason=ntNequ errdefs_msgno=anim errdefs_msg_name=uae flow_id=ata ip_protocol=tcp severity=very-high partition_name=paq route_domain=emipsumq sa_translation_pool=culpaq sa_translation_type=quamq source_ip=10.53.72.161 src_geo=pta source_port=4723 source_user=scip translated_dest_ip=10.33.143.163 translated_dest_port=5404 translated_ip_protocol=iusmodi translated_route_domain=esciun translated_source_ip=10.247.144.9 translated_source_port=2494 translated_vlan=lit vlan=4112 +oidentsu oditau onsec1632.internal.lan lup aeca isau [F5@giat acl_policy_name=ttenb acl_policy_type=eirure acl_rule_name=boreetd action=Closed hostname=exer447.internal.localhost bigip_mgmt_ip=10.35.190.164 context_name=radipis context_type=lore date_time=Feb 10 2018 12:23:41 dest_ip=10.76.99.144 dst_geo=eufugia dest_port=2345 device_product=pariat device_vendor=nimip device_version=1.2476 drop_reason=usci errdefs_msgno=unturmag errdefs_msg_name=dexeaco flow_id=lupta ip_protocol=ggp severity=very-high partition_name=oreeufug route_domain=Quisa sa_translation_pool=quiav sa_translation_type=ctionofd source_ip=10.21.58.162 src_geo=uisautei source_port=7881 source_user=porin translated_dest_ip=10.241.143.145 translated_dest_port=6151 translated_ip_protocol=ecillum translated_route_domain=olor translated_source_ip=10.113.65.192 translated_source_port=7807 translated_vlan=conseq vlan=6079 +edutpers ctobeat upta4358.home orem inibus secte [F5@ctobeat acl_policy_name=onsec acl_policy_type=idestl acl_rule_name=litani action=Closed hostname=itanimi1934.home bigip_mgmt_ip=10.19.154.103 context_name=ittenb context_type=tobeatae date_time=Feb 24 2018 19:26:15 dest_ip=10.235.51.61 dst_geo=exe dest_port=1872 device_product=cia device_vendor=idolo device_version=1.768 drop_reason=pitlabo errdefs_msgno=tas errdefs_msg_name=rcitat flow_id=ree ip_protocol=tcp severity=very-high partition_name=quipexea route_domain=orsitv sa_translation_pool=dunt sa_translation_type=int source_ip=10.53.27.253 src_geo=temveleu source_port=3599 source_user=luptat translated_dest_ip=10.75.113.240 translated_dest_port=1874 translated_ip_protocol=ionulam translated_route_domain=auto translated_source_ip=10.129.16.166 translated_source_port=5141 translated_vlan=ntocca vlan=5439 +tvol lup mipsamv161.local ionula pexeaco temaccu [F5@uamqua acl_policy_name=Neq acl_policy_type=runt acl_rule_name=xcep action=Established hostname=pteurs1031.mail.corp bigip_mgmt_ip=10.125.150.220 context_name=lumquid context_type=eturadip date_time=Mar 11 2018 02:28:49 dest_ip=10.241.228.95 dst_geo=equ dest_port=7256 device_product=ssequamn device_vendor=ave device_version=1.5812 drop_reason=edquia errdefs_msgno=ihi errdefs_msg_name=undeomn flow_id=ape ip_protocol=rdp severity=medium partition_name=ari route_domain=umtot sa_translation_pool=onemulla sa_translation_type=atquo source_ip=10.120.50.13 src_geo=issu source_port=4426 source_user=inculpa translated_dest_ip=10.150.153.61 translated_dest_port=2773 translated_ip_protocol=loremagn translated_route_domain=acons translated_source_ip=10.22.213.196 translated_source_port=7230 translated_vlan=emoenimi vlan=1864 +mqu onorume abill5290.lan mini mve tionev [F5@uasiarch acl_policy_name=velites acl_policy_type=uredolor acl_rule_name=epreh action=Accept hostname=edquiaco6562.api.lan bigip_mgmt_ip=10.113.2.13 context_name=rudexerc context_type=nturm date_time=Mar 25 2018 09:31:24 dest_ip=10.182.134.109 dst_geo=dquia dest_port=5334 device_product=bori device_vendor=dipi device_version=1.7232 drop_reason=utf errdefs_msgno=dolor errdefs_msg_name=dexe flow_id=nemul ip_protocol=igmp severity=low partition_name=lupt route_domain=quatur sa_translation_pool=dminim sa_translation_type=ptatevel source_ip=10.85.52.249 src_geo=eirured source_port=3772 source_user=tatiset translated_dest_ip=10.238.171.184 translated_dest_port=2574 translated_ip_protocol=duntutl translated_route_domain=nven translated_source_ip=10.229.155.171 translated_source_port=6978 translated_vlan=asiarch vlan=7121 +utla deomni tse7542.test nesciu todit utaliqui [F5@emse acl_policy_name=emqui acl_policy_type=cipitla acl_rule_name=tlab action=Accept hostname=tatis7315.mail.home bigip_mgmt_ip=10.249.174.35 context_name=umfu context_type=utla date_time=Apr 08 2018 16:33:58 dest_ip=10.136.53.201 dst_geo=dolo dest_port=6418 device_product=samvol device_vendor=equa device_version=1.536 drop_reason=strumex errdefs_msgno=tessecil errdefs_msg_name=ugia flow_id=reprehe ip_protocol=udp severity=medium partition_name=umq route_domain=sistena sa_translation_pool=qui sa_translation_type=caboN source_ip=10.198.150.185 src_geo=catcupid source_port=3167 source_user=quela translated_dest_ip=10.51.245.225 translated_dest_port=3991 translated_ip_protocol=enimi translated_route_domain=illum translated_source_ip=10.220.1.249 translated_source_port=4200 translated_vlan=Sedut vlan=7832 +audant obeata uredol2348.www5.host entorev quuntur olup [F5@aeab acl_policy_name=uradipis acl_policy_type=aerat acl_rule_name=les action=Drop hostname=eosqui3723.api.localdomain bigip_mgmt_ip=10.152.157.32 context_name=ali context_type=udexerci date_time=Apr 22 2018 23:36:32 dest_ip=10.76.232.245 dst_geo=osqu dest_port=4859 device_product=aborio device_vendor=rve device_version=1.219 drop_reason=nbyCi errdefs_msgno=runtmoll errdefs_msg_name=busBon flow_id=norumetM ip_protocol=udp severity=low partition_name=usBono route_domain=ameaq sa_translation_pool=Quis sa_translation_type=lupta source_ip=10.251.82.195 src_geo=umiure source_port=5186 source_user=olorese translated_dest_ip=10.190.96.181 translated_dest_port=2153 translated_ip_protocol=culp translated_route_domain=deomn translated_source_ip=10.38.185.31 translated_source_port=1085 translated_vlan=llo vlan=1106 +tla iaconseq sed3235.www5.localhost pidatatn isno luptatev [F5@occaeca acl_policy_name=dan acl_policy_type=pta acl_rule_name=upt action=Drop hostname=itaedict199.mail.corp bigip_mgmt_ip=10.103.102.242 context_name=labore context_type=lorem date_time=May 07 2018 06:39:06 dest_ip=10.68.159.207 dst_geo=eratv dest_port=7206 device_product=estq device_vendor=quasiarc device_version=1.6526 drop_reason=liq errdefs_msgno=xerc errdefs_msg_name=atisetqu flow_id=squir ip_protocol=icmp severity=very-high partition_name=quam route_domain=deriti sa_translation_pool=edictasu sa_translation_type=eturadi source_ip=10.190.247.194 src_geo=mSecti source_port=4210 source_user=tDuisaut translated_dest_ip=10.230.112.179 translated_dest_port=5926 translated_ip_protocol=vol translated_route_domain=ita translated_source_ip=10.211.198.50 translated_source_port=7510 translated_vlan=nibusB vlan=5555 +amremap oremagna aqu4475.mail.invalid serrorsi tsedquia rsit [F5@quis acl_policy_name=upidatat acl_policy_type=mod acl_rule_name=niamqui action=Closed hostname=xeaco7887.www.localdomain bigip_mgmt_ip=10.47.223.155 context_name=ugitsed context_type=dminimve date_time=May 21 2018 13:41:41 dest_ip=10.111.137.84 dst_geo=uiac dest_port=7838 device_product=tot device_vendor=reme device_version=1.7750 drop_reason=loremi errdefs_msgno=queporro errdefs_msg_name=tur flow_id=eFi ip_protocol=ipv6-icmp severity=medium partition_name=ulapari route_domain=eporroq sa_translation_pool=uunturm sa_translation_type=iatn source_ip=10.219.83.199 src_geo=diduntut source_port=1321 source_user=ectetur translated_dest_ip=10.101.13.122 translated_dest_port=6737 translated_ip_protocol=nibusBo translated_route_domain=volup translated_source_ip=10.251.101.61 translated_source_port=5153 translated_vlan=scipit vlan=6495 +tore isni tamrema736.www5.lan ntiumdol conse aturve [F5@edqui acl_policy_name=tvolu acl_policy_type=psu acl_rule_name=strud action=Closed hostname=saute7421.www.invalid bigip_mgmt_ip=10.21.80.157 context_name=tiumtot context_type=tate date_time=Jun 04 2018 20:44:15 dest_ip=10.13.222.177 dst_geo=inBCSed dest_port=6353 device_product=Loremip device_vendor=taliqui device_version=1.5568 drop_reason=ipsaquae errdefs_msgno=olu errdefs_msg_name=exerci flow_id=isnostru ip_protocol=tcp severity=very-high partition_name=ngelits route_domain=volupt sa_translation_pool=billoi sa_translation_type=reseo source_ip=10.31.86.83 src_geo=pariat source_port=6646 source_user=litsed translated_dest_ip=10.21.30.43 translated_dest_port=4754 translated_ip_protocol=lorem translated_route_domain=iamquisn translated_source_ip=10.83.136.233 translated_source_port=6643 translated_vlan=imadm vlan=3187 +lumdol edutper utemve6966.mail.local emoen ptate mipsumqu [F5@turad acl_policy_name=dol acl_policy_type=ntutla acl_rule_name=des action=Accept hostname=oluptas1637.home bigip_mgmt_ip=10.195.90.73 context_name=ipisc context_type=iatnulap date_time=Jun 19 2018 03:46:49 dest_ip=10.170.155.137 dst_geo=uine dest_port=1815 device_product=veniamqu device_vendor=iconsequ device_version=1.5445 drop_reason=apa errdefs_msgno=archite errdefs_msg_name=tur flow_id=ddo ip_protocol=ipv6 severity=high partition_name=inBC route_domain=did sa_translation_pool=atcupi sa_translation_type=eriti source_ip=10.45.152.205 src_geo=rema source_port=5107 source_user=datatn translated_dest_ip=10.194.197.107 translated_dest_port=2524 translated_ip_protocol=tur translated_route_domain=itation translated_source_ip=10.27.181.27 translated_source_port=5509 translated_vlan=uredo vlan=2155 +use catcu quame922.internal.host eursi liquid ulapari [F5@ibus acl_policy_name=isu acl_policy_type=moll acl_rule_name=roinBCS action=Drop hostname=ididu5505.api.localdomain bigip_mgmt_ip=10.43.239.97 context_name=modi context_type=cip date_time=Jul 03 2018 10:49:23 dest_ip=10.60.60.164 dst_geo=iscive dest_port=5527 device_product=incididu device_vendor=yCice device_version=1.508 drop_reason=ionem errdefs_msgno=taevitae errdefs_msg_name=dminimv flow_id=quam ip_protocol=tcp severity=low partition_name=umdol route_domain=rerepr sa_translation_pool=ipiscin sa_translation_type=trudexe source_ip=10.222.2.132 src_geo=umdo source_port=6187 source_user=aedicta translated_dest_ip=10.129.161.18 translated_dest_port=782 translated_ip_protocol=umquiad translated_route_domain=porinc translated_source_ip=10.183.90.25 translated_source_port=5038 translated_vlan=conse vlan=2563 +dolo reeufu umexe5208.local suntex uptatema uteiru [F5@rcitati acl_policy_name=siutali acl_policy_type=uiratio acl_rule_name=ficia action=Closed hostname=mqui1099.api.corp bigip_mgmt_ip=10.231.167.171 context_name=onorumet context_type=illoinve date_time=Jul 17 2018 17:51:58 dest_ip=10.188.254.168 dst_geo=nevolup dest_port=3706 device_product=lor device_vendor=ica device_version=1.4479 drop_reason=sumd errdefs_msgno=elitse errdefs_msg_name=olu flow_id=temqu ip_protocol=rdp severity=very-high partition_name=nesci route_domain=meaquei sa_translation_pool=snisiu sa_translation_type=atem source_ip=10.189.162.131 src_geo=litsed source_port=6019 source_user=sedquia translated_dest_ip=10.67.129.100 translated_dest_port=7106 translated_ip_protocol=mmodicon translated_route_domain=eosquir translated_source_ip=10.248.156.138 translated_source_port=2125 translated_vlan=smodit vlan=3090 +dun xce dol5403.www.localhost asiar eiu maliquam [F5@gnama acl_policy_name=ursintoc acl_policy_type=minimve acl_rule_name=eprehe action=Reject hostname=siuta2155.lan bigip_mgmt_ip=10.63.103.30 context_name=ill context_type=imveniam date_time=Aug 01 2018 00:54:32 dest_ip=10.36.29.127 dst_geo=umqui dest_port=1757 device_product=sci device_vendor=isquames device_version=1.2927 drop_reason=tlabor errdefs_msgno=itecto errdefs_msg_name=loreeuf flow_id=orainci ip_protocol=icmp severity=low partition_name=aev route_domain=uelaudan sa_translation_pool=lab sa_translation_type=sequa source_ip=10.6.146.184 src_geo=rrorsi source_port=7247 source_user=sequu translated_dest_ip=10.185.107.27 translated_dest_port=2257 translated_ip_protocol=mips translated_route_domain=iduntutl translated_source_ip=10.142.106.66 translated_source_port=3790 translated_vlan=quelauda vlan=289 +dolo ulamc doe344.www5.local toreve squirat llum [F5@dol acl_policy_name=niam acl_policy_type=atio acl_rule_name=sno action=Established hostname=tatiset4191.localdomain bigip_mgmt_ip=10.214.93.200 context_name=dtempor context_type=rroquisq date_time=Aug 15 2018 07:57:06 dest_ip=10.215.63.248 dst_geo=uidex dest_port=1203 device_product=lloi device_vendor=nseq device_version=1.4023 drop_reason=isetqua errdefs_msgno=ianonn errdefs_msg_name=oluptas flow_id=doe ip_protocol=udp severity=very-high partition_name=rchitect route_domain=orsitame sa_translation_pool=tasn sa_translation_type=exeaco source_ip=10.93.39.237 src_geo=aincidu source_port=232 source_user=tionofd translated_dest_ip=10.0.202.9 translated_dest_port=7451 translated_ip_protocol=nvolup translated_route_domain=ommodic translated_source_ip=10.119.179.182 translated_source_port=7255 translated_vlan=undeo vlan=7696 +uiinea uianonn eavolupt784.www5.example liquam sinto edi [F5@eumiure acl_policy_name=ore acl_policy_type=adeser acl_rule_name=mSe action=Drop hostname=aute2433.mail.lan bigip_mgmt_ip=10.252.204.162 context_name=tiae context_type=giat date_time=Aug 29 2018 14:59:40 dest_ip=10.115.77.51 dst_geo=mcorpor dest_port=2433 device_product=ostru device_vendor=mea device_version=1.5939 drop_reason=iquipex errdefs_msgno=byCice errdefs_msg_name=deritq flow_id=boreetdo ip_protocol=ipv6-icmp severity=medium partition_name=iin route_domain=nostr sa_translation_pool=luptatem sa_translation_type=tNequepo source_ip=10.28.145.163 src_geo=sper source_port=72 source_user=imadmin translated_dest_ip=10.123.154.140 translated_dest_port=2551 translated_ip_protocol=mSect translated_route_domain=iure translated_source_ip=10.30.189.166 translated_source_port=2749 translated_vlan=aer vlan=3422 +roquis mremape ude2977.www.corp rmagnido exeaco dqu [F5@ccaec acl_policy_name=repreh acl_policy_type=imven acl_rule_name=usan action=Accept hostname=idolo6535.internal.example bigip_mgmt_ip=10.46.162.198 context_name=snulap context_type=onsequat date_time=Sep 12 2018 22:02:15 dest_ip=10.166.128.248 dst_geo=pariatur dest_port=7435 device_product=tura device_vendor=equuntur device_version=1.6564 drop_reason=uaera errdefs_msgno=mqua errdefs_msg_name=xer flow_id=utlabore ip_protocol=ipv6-icmp severity=very-high partition_name=beataevi route_domain=amquisn sa_translation_pool=itquii sa_translation_type=imaven source_ip=10.145.128.250 src_geo=nder source_port=5641 source_user=eni translated_dest_ip=10.79.49.3 translated_dest_port=7794 translated_ip_protocol=psamvolu translated_route_domain=teturad translated_source_ip=10.29.122.183 translated_source_port=6166 translated_vlan=tla vlan=6146 +modtempo edict nost3250.internal.localdomain nibu quatur isiutali [F5@mdolo acl_policy_name=nof acl_policy_type=usantiu acl_rule_name=periam action=Closed hostname=one7728.api.localdomain bigip_mgmt_ip=10.177.232.136 context_name=obe context_type=niamqu date_time=Sep 27 2018 05:04:49 dest_ip=10.140.59.161 dst_geo=smoditem dest_port=575 device_product=tev device_vendor=oNemoeni device_version=1.3341 drop_reason=elillumq errdefs_msgno=loremeum errdefs_msg_name=luptatem flow_id=ing ip_protocol=tcp severity=very-high partition_name=riameaqu route_domain=etd sa_translation_pool=omnisi sa_translation_type=dolor source_ip=10.166.169.167 src_geo=ati source_port=1544 source_user=olors translated_dest_ip=10.65.174.196 translated_dest_port=472 translated_ip_protocol=iin translated_route_domain=uteiru translated_source_ip=10.142.235.217 translated_source_port=5846 translated_vlan=orain vlan=2663 +llu quaUt labor7147.internal.host ten vitae tse [F5@gni acl_policy_name=per acl_policy_type=tione acl_rule_name=nibus action=Established hostname=uptatem4446.internal.localhost bigip_mgmt_ip=10.29.217.44 context_name=eacommod context_type=tali date_time=Oct 11 2018 12:07:23 dest_ip=10.131.223.198 dst_geo=orisnisi dest_port=4342 device_product=eritquii device_vendor=atevelit device_version=1.325 drop_reason=enat errdefs_msgno=ionula errdefs_msg_name=itaed flow_id=invol ip_protocol=rdp severity=low partition_name=cidun route_domain=tassitas sa_translation_pool=nimadmi sa_translation_type=dipisci source_ip=10.215.184.154 src_geo=nor source_port=3306 source_user=iarc translated_dest_ip=10.191.78.86 translated_dest_port=6355 translated_ip_protocol=uiac translated_route_domain=squ translated_source_ip=10.53.188.140 translated_source_port=6455 translated_vlan=ten vlan=2937 +isciveli ntutlab sitamet452.domain nsequ ing ollita [F5@dipisci acl_policy_name=amnisiu acl_policy_type=ptat acl_rule_name=epr action=Drop hostname=emq2514.api.localhost bigip_mgmt_ip=10.135.77.156 context_name=uraut context_type=non date_time=Oct 25 2018 19:09:57 dest_ip=10.248.182.188 dst_geo=turad dest_port=2537 device_product=nBCSe device_vendor=ollita device_version=1.3567 drop_reason=eni errdefs_msgno=quipe errdefs_msg_name=oluptat flow_id=stenatus ip_protocol=ggp severity=very-high partition_name=iaecon route_domain=ect sa_translation_pool=tquid sa_translation_type=seru source_ip=10.76.148.147 src_geo=remagna source_port=1121 source_user=urve translated_dest_ip=10.46.222.149 translated_dest_port=3304 translated_ip_protocol=squ translated_route_domain=emagnaal translated_source_ip=10.74.74.129 translated_source_port=5904 translated_vlan=itati vlan=3497 +rinc tno meumf4052.invalid pitlabo riamea Malorumw [F5@consect acl_policy_name=issu acl_policy_type=tconsect acl_rule_name=tationem action=Drop hostname=agna5654.www.corp bigip_mgmt_ip=10.96.200.223 context_name=iatisun context_type=cto date_time=Nov 09 2018 02:12:32 dest_ip=10.3.228.220 dst_geo=imadmini dest_port=3791 device_product=oeiusm device_vendor=aUtenim device_version=1.1186 drop_reason=isu errdefs_msgno=ute errdefs_msg_name=tdolore flow_id=madminim ip_protocol=igmp severity=very-high partition_name=prehen route_domain=ate sa_translation_pool=ull sa_translation_type=enimipsa source_ip=10.130.203.37 src_geo=quisnos source_port=2132 source_user=mvele translated_dest_ip=10.11.146.253 translated_dest_port=3581 translated_ip_protocol=remeum translated_route_domain=temseq translated_source_ip=10.145.49.29 translated_source_port=2464 translated_vlan=sedquia vlan=4912 +ntmo aliqu iqu4429.www5.lan doconse volupta ptat [F5@oreverit acl_policy_name=nimides acl_policy_type=remipsum acl_rule_name=elit action=Drop hostname=ipi4827.mail.lan bigip_mgmt_ip=10.162.78.48 context_name=lab context_type=sedqui date_time=Nov 23 2018 09:15:06 dest_ip=10.243.157.94 dst_geo=epteu dest_port=5744 device_product=tura device_vendor=mquiavol device_version=1.6845 drop_reason=eabil errdefs_msgno=ibusB errdefs_msg_name=rporis flow_id=etco ip_protocol=ipv6 severity=very-high partition_name=ereprehe route_domain=olu sa_translation_pool=nofdeF sa_translation_type=riaturEx source_ip=10.24.23.209 src_geo=itautfu source_port=1503 source_user=rumwr translated_dest_ip=10.162.2.180 translated_dest_port=3889 translated_ip_protocol=mporain translated_route_domain=ectetur translated_source_ip=10.48.75.140 translated_source_port=1837 translated_vlan=ineavol vlan=5182 +onproid sitv equam3114.test mcorp uelaud aperiam [F5@ngelit acl_policy_name=quiano acl_policy_type=sund acl_rule_name=iaconse action=Drop hostname=sequatD163.internal.example bigip_mgmt_ip=10.151.206.38 context_name=oloremi context_type=luptate date_time=Dec 07 2018 16:17:40 dest_ip=10.38.57.217 dst_geo=rur dest_port=5543 device_product=imidest device_vendor=oeiusmod device_version=1.419 drop_reason=psumqui errdefs_msgno=eddoeiu errdefs_msg_name=oinvento flow_id=mips ip_protocol=udp severity=medium partition_name=corpor route_domain=amvolu sa_translation_pool=ent sa_translation_type=ionemu source_ip=10.66.92.83 src_geo=orinrep source_port=2549 source_user=nproide translated_dest_ip=10.119.12.186 translated_dest_port=5674 translated_ip_protocol=qui translated_route_domain=nemullam translated_source_ip=10.97.105.115 translated_source_port=3576 translated_vlan=squir vlan=3987 +umqu umet psaquaea5284.internal.example upt giatquo toccaec [F5@nihilmo acl_policy_name=atquo acl_policy_type=umetMa acl_rule_name=ngelitse action=Accept hostname=itamet1303.invalid bigip_mgmt_ip=10.12.148.73 context_name=eius context_type=evo date_time=Dec 21 2018 23:20:14 dest_ip=10.10.44.34 dst_geo=volupt dest_port=61 device_product=eosqu device_vendor=reetdolo device_version=1.7551 drop_reason=sten errdefs_msgno=enderi errdefs_msg_name=labore flow_id=uasiarch ip_protocol=igmp severity=very-high partition_name=magnama route_domain=reprehe sa_translation_pool=citatio sa_translation_type=dolo source_ip=10.201.132.114 src_geo=eetd source_port=6058 source_user=borisnis translated_dest_ip=10.64.76.142 translated_dest_port=7083 translated_ip_protocol=temse translated_route_domain=samvo translated_source_ip=10.169.139.250 translated_source_port=1374 translated_vlan=nostrume vlan=5035 +tatevel itin tam942.api.host iut leumiur deser [F5@boris acl_policy_name=ris acl_policy_type=nisiuta acl_rule_name=utper action=Drop hostname=epr3512.internal.domain bigip_mgmt_ip=10.9.236.18 context_name=iumdo context_type=exe date_time=Jan 05 2019 06:22:49 dest_ip=10.152.7.48 dst_geo=giatnula dest_port=71 device_product=enimadmi device_vendor=qui device_version=1.5292 drop_reason=aecon errdefs_msgno=sedq errdefs_msg_name=olo flow_id=sperna ip_protocol=udp severity=very-high partition_name=conseq route_domain=upta sa_translation_pool=eturadi sa_translation_type=cinge source_ip=10.111.128.11 src_geo=niamq source_port=5336 source_user=umfug translated_dest_ip=10.35.38.185 translated_dest_port=7077 translated_ip_protocol=labor translated_route_domain=Sec translated_source_ip=10.200.116.191 translated_source_port=3068 translated_vlan=nsecte vlan=5790 +uianonnu por nve894.lan turadip ataev eFinib [F5@atione acl_policy_name=xcepte acl_policy_type=gnaa acl_rule_name=tio action=Reject hostname=uredol2174.home bigip_mgmt_ip=10.191.27.182 context_name=tMalo context_type=urautod date_time=Jan 19 2019 13:25:23 dest_ip=10.114.60.159 dst_geo=rese dest_port=5302 device_product=rissusci device_vendor=quaturve device_version=1.5991 drop_reason=tisunde errdefs_msgno=ende errdefs_msg_name=quidolor flow_id=lloin ip_protocol=igmp severity=high partition_name=proiden route_domain=moenimip sa_translation_pool=tat sa_translation_type=tate source_ip=10.236.67.227 src_geo=ern source_port=881 source_user=tlabo translated_dest_ip=10.134.238.8 translated_dest_port=2976 translated_ip_protocol=aqua translated_route_domain=edquiac translated_source_ip=10.240.62.238 translated_source_port=1251 translated_vlan=olo vlan=5926 +ali Nequepor aUten4127.internal.lan apariatu mnisis onsequa [F5@sunt acl_policy_name=orumSe acl_policy_type=olupta acl_rule_name=emveleum action=Drop hostname=ididunt7607.mail.localhost bigip_mgmt_ip=10.165.66.92 context_name=isq context_type=eacommo date_time=Feb 02 2019 20:27:57 dest_ip=10.244.171.198 dst_geo=nimad dest_port=7814 device_product=asi device_vendor=tobe device_version=1.6837 drop_reason=Lore errdefs_msgno=oin errdefs_msg_name=eritquii flow_id=taliqui ip_protocol=ipv6-icmp severity=very-high partition_name=entoreve route_domain=ion sa_translation_pool=exeaco sa_translation_type=tate source_ip=10.109.14.142 src_geo=sitas source_port=6036 source_user=perna translated_dest_ip=10.65.35.64 translated_dest_port=2748 translated_ip_protocol=irur translated_route_domain=risnisiu translated_source_ip=10.22.231.91 translated_source_port=2652 translated_vlan=equepor vlan=897 +ugiatn utpe hend1170.www5.lan ptateve aliqua officiad [F5@nimadmin acl_policy_name=iavol acl_policy_type=roq acl_rule_name=iumtota action=Reject hostname=inimav5557.www5.test bigip_mgmt_ip=10.71.112.86 context_name=olor context_type=emoenim date_time=Feb 17 2019 03:30:32 dest_ip=10.57.64.102 dst_geo=rume dest_port=7667 device_product=inibusBo device_vendor=tqui device_version=1.99 drop_reason=citat errdefs_msgno=prehende errdefs_msg_name=vitaedic flow_id=remip ip_protocol=ggp severity=high partition_name=rehe route_domain=aper sa_translation_pool=gnaa sa_translation_type=tam source_ip=10.64.161.215 src_geo=modi source_port=4869 source_user=rnatur translated_dest_ip=10.29.230.203 translated_dest_port=6579 translated_ip_protocol=abi translated_route_domain=inimaven translated_source_ip=10.89.221.90 translated_source_port=5835 translated_vlan=entoreve vlan=4612 +roqu dquia ommod142.www.home ptate oloreeu imipsa [F5@iscinge acl_policy_name=ora acl_policy_type=meumfug acl_rule_name=inimve action=Closed hostname=nonn1650.www.test bigip_mgmt_ip=10.88.226.76 context_name=ptas context_type=iadolo date_time=Mar 03 2019 10:33:06 dest_ip=10.217.197.29 dst_geo=aliquide dest_port=7187 device_product=tinv device_vendor=iar device_version=1.5232 drop_reason=mquela errdefs_msgno=urm errdefs_msg_name=con flow_id=aeabil ip_protocol=udp severity=low partition_name=edicta route_domain=itaspern sa_translation_pool=tau sa_translation_type=rcit source_ip=10.79.208.135 src_geo=rehende source_port=3688 source_user=erspic translated_dest_ip=10.221.199.137 translated_dest_port=6430 translated_ip_protocol=quipe translated_route_domain=evita translated_source_ip=10.140.118.182 translated_source_port=4566 translated_vlan=nia vlan=7548 +npro boriosa sundeo3076.internal.test Nequepor turQ tod [F5@rsitame acl_policy_name=nsectetu acl_policy_type=untexpli acl_rule_name=smo action=Reject hostname=acons3940.api.lan bigip_mgmt_ip=10.133.48.55 context_name=lab context_type=ela date_time=Mar 17 2019 17:35:40 dest_ip=10.134.141.37 dst_geo=oreve dest_port=2538 device_product=tali device_vendor=quamnih device_version=1.2492 drop_reason=reprehen errdefs_msgno=Exce errdefs_msg_name=tocca flow_id=tinvolu ip_protocol=ipv6 severity=low partition_name=iumt route_domain=mad sa_translation_pool=mpor sa_translation_type=eddoei source_ip=10.35.73.208 src_geo=dolo source_port=6552 source_user=tia translated_dest_ip=10.126.61.230 translated_dest_port=2068 translated_ip_protocol=dolor translated_route_domain=emUteni translated_source_ip=10.189.244.22 translated_source_port=734 translated_vlan=rinre vlan=6425 +ident uatur dquiaco2756.home uiine mve dolorema [F5@ditautf acl_policy_name=uisnostr acl_policy_type=oditautf acl_rule_name=nula action=Established hostname=suscipit587.www.localhost bigip_mgmt_ip=10.81.154.115 context_name=ita context_type=aeratvol date_time=Apr 01 2019 00:38:14 dest_ip=10.194.94.1 dst_geo=ostr dest_port=575 device_product=boreetd device_vendor=ueporro device_version=1.4044 drop_reason=oluptat errdefs_msgno=olors errdefs_msg_name=mSecti flow_id=ius ip_protocol=icmp severity=very-high partition_name=xerci route_domain=qua sa_translation_pool=iaecons sa_translation_type=pteurs source_ip=10.35.65.72 src_geo=veni source_port=3387 source_user=reseo translated_dest_ip=10.239.194.105 translated_dest_port=3629 translated_ip_protocol=isnos translated_route_domain=ntin translated_source_ip=10.240.94.109 translated_source_port=5437 translated_vlan=ono vlan=573 +consequ ine hend3901.www.localdomain nsecte miurere tat [F5@pitlabor acl_policy_name=upi acl_policy_type=olupta acl_rule_name=ape action=Established hostname=mnisiut6146.internal.local bigip_mgmt_ip=10.52.70.192 context_name=empor context_type=ate date_time=Apr 15 2019 07:40:49 dest_ip=10.234.254.96 dst_geo=obeatae dest_port=2042 device_product=orem device_vendor=dquian device_version=1.2307 drop_reason=uis errdefs_msgno=emagnaal errdefs_msg_name=uunturm flow_id=nonnumq ip_protocol=ggp severity=very-high partition_name=ntocca route_domain=emquelau sa_translation_pool=adolorsi sa_translation_type=lupt source_ip=10.38.253.213 src_geo=ncidu source_port=3369 source_user=ionem translated_dest_ip=10.248.72.104 translated_dest_port=7485 translated_ip_protocol=cusan translated_route_domain=ivelit translated_source_ip=10.150.56.227 translated_source_port=4686 translated_vlan=isnost vlan=4697 +urQu idol fici312.api.host eri pitlab riosamn [F5@Malo acl_policy_name=onse acl_policy_type=enatuse acl_rule_name=veritat action=Reject hostname=borios1067.www5.home bigip_mgmt_ip=10.218.15.164 context_name=ntNeque context_type=magnidol date_time=Apr 29 2019 14:43:23 dest_ip=10.56.60.3 dst_geo=aaliq dest_port=2143 device_product=gel device_vendor=modt device_version=1.2031 drop_reason=mvolu errdefs_msgno=agn errdefs_msg_name=eritinvo flow_id=aliq ip_protocol=rdp severity=very-high partition_name=uisautei route_domain=labor sa_translation_pool=ihilmol sa_translation_type=scinge source_ip=10.62.218.239 src_geo=yCiceroi source_port=166 source_user=reh translated_dest_ip=10.73.172.186 translated_dest_port=3510 translated_ip_protocol=itte translated_route_domain=niamquis translated_source_ip=10.203.193.134 translated_source_port=6251 translated_vlan=riosa vlan=7445 +ore ptatema poriss2289.localdomain luptat ficiad saquaea [F5@archi acl_policy_name=caboNe acl_policy_type=ptate acl_rule_name=enimips action=Established hostname=msequ323.www.example bigip_mgmt_ip=10.60.20.76 context_name=seq context_type=uae date_time=May 13 2019 21:45:57 dest_ip=10.244.241.67 dst_geo=quaeabi dest_port=5701 device_product=ost device_vendor=mave device_version=1.2555 drop_reason=aev errdefs_msgno=uovolup errdefs_msg_name=tMaloru flow_id=rum ip_protocol=ipv6-icmp severity=very-high partition_name=ptassita route_domain=ionemul sa_translation_pool=orema sa_translation_type=its source_ip=10.10.46.43 src_geo=stiaec source_port=7346 source_user=nev translated_dest_ip=10.136.211.234 translated_dest_port=4126 translated_ip_protocol=lamcor translated_route_domain=rorsitv translated_source_ip=10.131.127.113 translated_source_port=853 translated_vlan=iamqu vlan=1324 +mwrit dminimve madminim5473.mail.example reeuf orinrepr tinvo [F5@oru acl_policy_name=ainc acl_policy_type=aeab acl_rule_name=iat action=Closed hostname=tdolorem813.internal.host bigip_mgmt_ip=10.50.177.151 context_name=rsitam context_type=aliqui date_time=May 28 2019 04:48:31 dest_ip=10.206.65.159 dst_geo=fdeFini dest_port=1295 device_product=eetdolo device_vendor=issuscip device_version=1.3291 drop_reason=tqu errdefs_msgno=rinc errdefs_msg_name=hender flow_id=sBonor ip_protocol=rdp severity=high partition_name=ercitati route_domain=lapa sa_translation_pool=enia sa_translation_type=atis source_ip=10.233.181.250 src_geo=isiuta source_port=2868 source_user=ugiatq translated_dest_ip=10.187.237.220 translated_dest_port=7744 translated_ip_protocol=eumfu translated_route_domain=remap translated_source_ip=10.248.0.74 translated_source_port=6349 translated_vlan=tru vlan=2520 +isautem eiusm assit1598.www5.invalid archite eruntm iades [F5@mremape acl_policy_name=nimad acl_policy_type=ionemu acl_rule_name=nul action=Established hostname=volupt4626.internal.test bigip_mgmt_ip=10.189.43.11 context_name=asper context_type=eeu date_time=Jun 11 2019 11:51:06 dest_ip=10.193.169.102 dst_geo=olab dest_port=629 device_product=olore device_vendor=mSecti device_version=1.2859 drop_reason=idid errdefs_msgno=ela errdefs_msg_name=fugits flow_id=litseddo ip_protocol=igmp severity=medium partition_name=ptasn route_domain=amrem sa_translation_pool=umdolor sa_translation_type=iamq source_ip=10.248.248.120 src_geo=ationemu source_port=1282 source_user=iatn translated_dest_ip=10.96.223.46 translated_dest_port=3654 translated_ip_protocol=pern translated_route_domain=ptasn translated_source_ip=10.80.129.81 translated_source_port=4827 translated_vlan=tat vlan=5084 +eruntmo lumdolo urmagnid2749.api.host imip taspe siutaliq [F5@turadipi acl_policy_name=tMalo acl_policy_type=veni acl_rule_name=rspi action=Closed hostname=ntium5103.www5.localhost bigip_mgmt_ip=10.66.106.186 context_name=uatD context_type=reh date_time=Jun 25 2019 18:53:40 dest_ip=10.36.14.238 dst_geo=metco dest_port=4740 device_product=ilmoles device_vendor=xeaco device_version=1.1910 drop_reason=ccaecat errdefs_msgno=radip errdefs_msg_name=secil flow_id=totamr ip_protocol=udp severity=very-high partition_name=iciat route_domain=uira sa_translation_pool=orio sa_translation_type=mseq source_ip=10.102.109.199 src_geo=iono source_port=2061 source_user=tNequ translated_dest_ip=10.173.114.63 translated_dest_port=5877 translated_ip_protocol=tatisetq translated_route_domain=eabilloi translated_source_ip=10.91.115.139 translated_source_port=412 translated_vlan=eroi vlan=2077 +riatur amrema illum2978.internal.home rumetMa entor urere [F5@involu acl_policy_name=qui acl_policy_type=aliqu acl_rule_name=sita action=Drop hostname=orpori3334.www.local bigip_mgmt_ip=10.198.157.122 context_name=ncu context_type=quatu date_time=Jul 10 2019 01:56:14 dest_ip=10.239.90.72 dst_geo=iratio dest_port=7700 device_product=its device_vendor=agn device_version=1.3690 drop_reason=ntmo errdefs_msgno=iur errdefs_msg_name=aboNemo flow_id=tsedquia ip_protocol=udp severity=very-high partition_name=tatiset route_domain=enim sa_translation_pool=gnido sa_translation_type=iamq source_ip=10.159.155.88 src_geo=uisa source_port=7034 source_user=iquipex translated_dest_ip=10.0.175.17 translated_dest_port=5236 translated_ip_protocol=tempori translated_route_domain=sedquian translated_source_ip=10.221.223.127 translated_source_port=2687 translated_vlan=ira vlan=3007 +idolor umdo sequatu7142.internal.corp ipsaqu asun rsitam [F5@magn acl_policy_name=amcola acl_policy_type=eumiurer acl_rule_name=umf action=Established hostname=equu7361.www5.localdomain bigip_mgmt_ip=10.30.20.187 context_name=rsinto context_type=nonnumqu date_time=Jul 24 2019 08:58:48 dest_ip=10.103.47.100 dst_geo=chitect dest_port=5316 device_product=fug device_vendor=ulpaq device_version=1.6302 drop_reason=piscivel errdefs_msgno=ueporr errdefs_msg_name=udex flow_id=ipexeac ip_protocol=tcp severity=low partition_name=isci route_domain=archi sa_translation_pool=rsitame sa_translation_type=qui source_ip=10.7.212.201 src_geo=ion source_port=949 source_user=ugiat translated_dest_ip=10.252.136.130 translated_dest_port=5601 translated_ip_protocol=expl translated_route_domain=animi translated_source_ip=10.189.70.237 translated_source_port=1457 translated_vlan=tnul vlan=24 +radip amremap dolorsit64.www.local uredo uamni nisi [F5@onsecte acl_policy_name=iono acl_policy_type=secillum acl_rule_name=sequatD action=Established hostname=tse2979.internal.localhost bigip_mgmt_ip=10.242.121.165 context_name=aut context_type=eriti date_time=Aug 07 2019 16:01:23 dest_ip=10.88.229.78 dst_geo=imadmi dest_port=2642 device_product=tevelite device_vendor=cto device_version=1.2037 drop_reason=mquiado errdefs_msgno=agn errdefs_msg_name=dip flow_id=urmag ip_protocol=tcp severity=high partition_name=laboreet route_domain=tutlabo sa_translation_pool=incid sa_translation_type=der source_ip=10.83.105.69 src_geo=usm source_port=2153 source_user=mni translated_dest_ip=10.102.109.194 translated_dest_port=2324 translated_ip_protocol=nor translated_route_domain=saut translated_source_ip=10.60.224.93 translated_source_port=1508 translated_vlan=deomnis vlan=354 +tla nimve edutpe1255.internal.lan nimadm cepte paquioff [F5@ictasun acl_policy_name=iumto acl_policy_type=ciun acl_rule_name=prehe action=Accept hostname=uisnostr2390.mail.domain bigip_mgmt_ip=10.251.167.219 context_name=eaco context_type=oremeu date_time=Aug 21 2019 23:03:57 dest_ip=10.14.251.18 dst_geo=tenbyCi dest_port=4371 device_product=citation device_vendor=spernatu device_version=1.7314 drop_reason=giatq errdefs_msgno=tion errdefs_msg_name=tNeque flow_id=uidolore ip_protocol=rdp severity=medium partition_name=usB route_domain=magnaali sa_translation_pool=istenatu sa_translation_type=roqui source_ip=10.17.20.93 src_geo=eritqu source_port=4368 source_user=Uteni translated_dest_ip=10.181.134.69 translated_dest_port=551 translated_ip_protocol=norum translated_route_domain=emUten translated_source_ip=10.219.174.45 translated_source_port=4055 translated_vlan=idolo vlan=968 +mmodicon nisis edquia4523.www.host remap ntium veniamqu [F5@equat acl_policy_name=reeu acl_policy_type=atemacc acl_rule_name=rsitvolu action=Accept hostname=luptate4811.mail.example bigip_mgmt_ip=10.30.117.82 context_name=destlabo context_type=fficia date_time=Sep 05 2019 06:06:31 dest_ip=10.245.75.229 dst_geo=elaud dest_port=4916 device_product=eaqueip device_vendor=emUten device_version=1.596 drop_reason=itseddoe errdefs_msgno=iti errdefs_msg_name=evitaedi flow_id=ionulamc ip_protocol=tcp severity=high partition_name=culp route_domain=Ciceroin sa_translation_pool=aeco sa_translation_type=olores source_ip=10.223.99.90 src_geo=adminim source_port=4324 source_user=numqua translated_dest_ip=10.28.233.253 translated_dest_port=1159 translated_ip_protocol=mUten translated_route_domain=eursint translated_source_ip=10.37.14.20 translated_source_port=6531 translated_vlan=teurs vlan=4919 +aaliq nos uaUteni562.www.test deF dutpe tseddoei [F5@byCi acl_policy_name=odic acl_policy_type=chitecto acl_rule_name=nimadm action=Closed hostname=lites1614.www.corp bigip_mgmt_ip=10.125.20.22 context_name=olu context_type=ectet date_time=Sep 19 2019 13:09:05 dest_ip=10.121.189.113 dst_geo=tess dest_port=4686 device_product=xeacom device_vendor=adminim device_version=1.95 drop_reason=henderi errdefs_msgno=rainc errdefs_msg_name=dminim flow_id=sse ip_protocol=tcp severity=high partition_name=umexe route_domain=Sedu sa_translation_pool=tetur sa_translation_type=ern source_ip=10.50.61.114 src_geo=nvento source_port=649 source_user=qua translated_dest_ip=10.57.85.113 translated_dest_port=1024 translated_ip_protocol=itquii translated_route_domain=psu translated_source_ip=10.8.32.17 translated_source_port=3788 translated_vlan=nem vlan=5883 +sitasper agni ivelit1640.internal.lan iscive prehende volup [F5@nimi acl_policy_name=niamqu acl_policy_type=uioffi acl_rule_name=suntin action=Closed hostname=lorinrep7686.mail.corp bigip_mgmt_ip=10.200.28.55 context_name=ineavol context_type=abor date_time=Oct 03 2019 20:11:40 dest_ip=10.232.122.152 dst_geo=voluptat dest_port=1549 device_product=ipi device_vendor=lamcor device_version=1.3064 drop_reason=litesse errdefs_msgno=tam errdefs_msg_name=uovo flow_id=scivelit ip_protocol=icmp severity=low partition_name=empo route_domain=apa sa_translation_pool=colab sa_translation_type=sistenat source_ip=10.215.224.27 src_geo=Sedutper source_port=6726 source_user=ficiade translated_dest_ip=10.113.78.101 translated_dest_port=2707 translated_ip_protocol=amqua translated_route_domain=nsequatu translated_source_ip=10.181.63.82 translated_source_port=168 translated_vlan=tse vlan=4029 +ueip amvo dolorsi306.www5.local tten erit asiarch [F5@tob acl_policy_name=tiae acl_policy_type=imipsamv acl_rule_name=doeiu action=Established hostname=nderit6272.mail.example bigip_mgmt_ip=10.177.14.106 context_name=natuser context_type=olupt date_time=Oct 18 2019 03:14:14 dest_ip=10.239.142.115 dst_geo=nsec dest_port=6720 device_product=siarchi device_vendor=etq device_version=1.4522 drop_reason=archit errdefs_msgno=nde errdefs_msg_name=tNequepo flow_id=byCicer ip_protocol=ipv6 severity=medium partition_name=ipit route_domain=tdolorem sa_translation_pool=nderitin sa_translation_type=mquiado source_ip=10.169.95.128 src_geo=reeufugi source_port=7737 source_user=ofd translated_dest_ip=10.139.20.223 translated_dest_port=114 translated_ip_protocol=porincid translated_route_domain=tisetqu translated_source_ip=10.243.43.168 translated_source_port=2110 translated_vlan=ehenderi vlan=2215 +ipsu iden oreseo1541.mail.domain boriosam lites col [F5@litsedd acl_policy_name=mnis acl_policy_type=ainci acl_rule_name=aturve action=Established hostname=ntu1279.mail.lan bigip_mgmt_ip=10.92.168.198 context_name=rume context_type=uptate date_time=Nov 01 2019 10:16:48 dest_ip=10.115.225.57 dst_geo=orsit dest_port=3315 device_product=mnis device_vendor=tametco device_version=1.7456 drop_reason=inc errdefs_msgno=rroqui errdefs_msg_name=amr flow_id=mfug ip_protocol=tcp severity=low partition_name=mid route_domain=henderi sa_translation_pool=consec sa_translation_type=dquia source_ip=10.90.93.4 src_geo=rehe source_port=3382 source_user=adminima translated_dest_ip=10.39.100.88 translated_dest_port=5195 translated_ip_protocol=lup translated_route_domain=rsi translated_source_ip=10.18.176.44 translated_source_port=7284 translated_vlan=Utenimad vlan=4305 +Bon amquisno mullam6505.www.localhost siarch oloremi ididu [F5@uov acl_policy_name=ncidid acl_policy_type=audantiu acl_rule_name=lmolest action=Reject hostname=essequam1161.domain bigip_mgmt_ip=10.49.68.8 context_name=temUte context_type=idest date_time=Nov 15 2019 17:19:22 dest_ip=10.8.247.249 dst_geo=enimip dest_port=3957 device_product=ataevit device_vendor=ficiad device_version=1.2909 drop_reason=taspe errdefs_msgno=empori errdefs_msg_name=mipsum flow_id=tium ip_protocol=tcp severity=very-high partition_name=ota route_domain=boriosa sa_translation_pool=eprehen sa_translation_type=rehen source_ip=10.163.203.191 src_geo=exeacom source_port=2599 source_user=tlab translated_dest_ip=10.193.43.135 translated_dest_port=4650 translated_ip_protocol=iaeconse translated_route_domain=onevol translated_source_ip=10.173.13.179 translated_source_port=1211 translated_vlan=ptasn vlan=3791 +ctetur amqui itatise2264.invalid lup cipitla niam [F5@mullamc acl_policy_name=umtota acl_policy_type=ssecil acl_rule_name=xplic action=Closed hostname=cipitl2184.localdomain bigip_mgmt_ip=10.240.47.113 context_name=uisnost context_type=snul date_time=Nov 30 2019 00:21:57 dest_ip=10.191.241.249 dst_geo=Loremips dest_port=4361 device_product=tiset device_vendor=ciade device_version=1.7726 drop_reason=equ errdefs_msgno=rror errdefs_msg_name=Exce flow_id=uae ip_protocol=ggp severity=high partition_name=umdol route_domain=nseq sa_translation_pool=autodita sa_translation_type=loreme source_ip=10.84.64.28 src_geo=par source_port=3938 source_user=ull translated_dest_ip=10.209.226.7 translated_dest_port=7745 translated_ip_protocol=aeabi translated_route_domain=ore translated_source_ip=10.31.147.51 translated_source_port=7780 translated_vlan=ptate vlan=3154 +fugit dantiu ntutla1447.invalid strude rautodi Loremips [F5@mestqui acl_policy_name=tect acl_policy_type=odtem acl_rule_name=ite action=Closed hostname=item3647.home bigip_mgmt_ip=10.32.20.4 context_name=olupta context_type=dents date_time=Dec 14 2019 07:24:31 dest_ip=10.166.40.137 dst_geo=oremipsu dest_port=5644 device_product=idolor device_vendor=tionem device_version=1.292 drop_reason=oinB errdefs_msgno=tateve errdefs_msg_name=rsitvo flow_id=enatuser ip_protocol=tcp severity=high partition_name=sistena route_domain=reetdolo sa_translation_pool=psam sa_translation_type=litseddo source_ip=10.225.189.229 src_geo=odtem source_port=2287 source_user=odtemp translated_dest_ip=10.86.1.244 translated_dest_port=7101 translated_ip_protocol=rinci translated_route_domain=uamestqu translated_source_ip=10.52.13.192 translated_source_port=4714 translated_vlan=remagna vlan=439 diff --git a/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json new file mode 100644 index 00000000000..a366e228e25 --- /dev/null +++ b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json @@ -0,0 +1,6460 @@ +[ + { + "destination.geo.country_name": "umq", + "destination.nat.ip": "10.165.201.71", + "destination.nat.port": 6153, + "destination.port": 2288, + "event.action": "Closed", + "event.code": "boNemoe", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "iusm modtempo olab6078.home olaboris tur itv [F5@odoco acl_policy_name=ria acl_policy_type=min acl_rule_name=ite action=Closed hostname=tatemac3541.api.corp bigip_mgmt_ip=10.228.193.207 context_name=liqua context_type=ciade date_time=Jan 29 2016 06:09:59 dest_ip=10.125.114.51 dst_geo=umq dest_port=2288 device_product=pexe device_vendor=nes device_version=1.2262 drop_reason=reveri errdefs_msgno=boNemoe errdefs_msg_name=equepor flow_id=eni ip_protocol=ipv6 severity=low partition_name=ehend route_domain=ritquiin sa_translation_pool=umqui sa_translation_type=reeufugi source_ip=10.208.121.85 src_geo=sperna source_port=884 source_user=billoi translated_dest_ip=10.165.201.71 translated_dest_port=6153 translated_ip_protocol=tatemU translated_route_domain=deF translated_source_ip=10.11.196.142 translated_source_port=5222 translated_vlan=iatnu vlan=3810", + "fileset.name": "bigipafm", + "host.ip": "10.228.193.207", + "host.name": "tatemac3541.api.corp", + "input.type": "log", + "log.level": "low", + "log.offset": 0, + "network.protocol": "ipv6", + "observer.product": "pexe", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2262", + "related.ip": [ + "10.11.196.142", + "10.208.121.85", + "10.165.201.71", + "10.228.193.207" + ], + "related.user": [ + "billoi" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "liqua", + "rsa.misc.event_type": "equepor", + "rsa.misc.obj_name": "odoco", + "rsa.misc.policy_name": "ria", + "rsa.misc.reference_id": "boNemoe", + "rsa.misc.rule_name": "ite", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2262", + "rsa.network.alias_host": [ + "tatemac3541.api.corp" + ], + "rsa.network.vlan": 3810, + "rsa.time.event_time_str": "Jan", + "rule.name": "ite", + "service.type": "f5", + "source.geo.country_name": "sperna", + "source.ip": [ + "10.208.121.85" + ], + "source.nat.ip": "10.11.196.142", + "source.nat.port": 5222, + "source.port": 884, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "billoi" + }, + { + "destination.geo.country_name": "iin", + "destination.nat.ip": "10.94.67.230", + "destination.nat.port": 783, + "destination.port": 6287, + "event.action": "Established", + "event.code": "eumiu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "eporr quipexe alo4540.example umdo itessequ vol [F5@luptat acl_policy_name=isiutal acl_policy_type=moenimi acl_rule_name=mod action=Established hostname=enatus2114.mail.home bigip_mgmt_ip=10.51.132.10 context_name=utper context_type=squame date_time=Feb 12 2016 13:12:33 dest_ip=10.173.116.41 dst_geo=iin dest_port=6287 device_product=emape device_vendor=aer device_version=1.445 drop_reason=nse errdefs_msgno=eumiu errdefs_msg_name=uame flow_id=quis ip_protocol=tcp severity=medium partition_name=cca route_domain=dolo sa_translation_pool=meumfug sa_translation_type=tetu source_ip=10.162.9.235 src_geo=tionulam source_port=2548 source_user=byC translated_dest_ip=10.94.67.230 translated_dest_port=783 translated_ip_protocol=atio translated_route_domain=uipexea translated_source_ip=10.92.202.200 translated_source_port=6772 translated_vlan=eFini vlan=859", + "fileset.name": "bigipafm", + "host.ip": "10.51.132.10", + "host.name": "enatus2114.mail.home", + "input.type": "log", + "log.level": "medium", + "log.offset": 856, + "network.protocol": "tcp", + "observer.product": "emape", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.445", + "related.ip": [ + "10.92.202.200", + "10.162.9.235", + "10.51.132.10", + "10.94.67.230" + ], + "related.user": [ + "byC" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "utper", + "rsa.misc.event_type": "uame", + "rsa.misc.obj_name": "luptat", + "rsa.misc.policy_name": "isiutal", + "rsa.misc.reference_id": "eumiu", + "rsa.misc.rule_name": "mod", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.445", + "rsa.network.alias_host": [ + "enatus2114.mail.home" + ], + "rsa.network.vlan": 859, + "rsa.time.event_time_str": "Feb", + "rule.name": "mod", + "service.type": "f5", + "source.geo.country_name": "tionulam", + "source.ip": [ + "10.162.9.235" + ], + "source.nat.ip": "10.92.202.200", + "source.nat.port": 6772, + "source.port": 2548, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "byC" + }, + { + "destination.geo.country_name": "uptassi", + "destination.nat.ip": "10.82.56.117", + "destination.nat.port": 2935, + "destination.port": 3179, + "event.action": "Reject", + "event.code": "llumd", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "exe iatu ionofde2424.api.invalid rsitam ommodic mipsu [F5@consec acl_policy_name=taliquip acl_policy_type=psumq acl_rule_name=atcup action=Reject hostname=gelit6728.api.invalid bigip_mgmt_ip=10.122.116.161 context_name=uam context_type=untutl date_time=Feb 26 2016 20:15:08 dest_ip=10.40.68.117 dst_geo=uptassi dest_port=3179 device_product=scivel device_vendor=aqui device_version=1.4726 drop_reason=iveli errdefs_msgno=llumd errdefs_msg_name=enatuse flow_id=magn ip_protocol=icmp severity=low partition_name=eos route_domain=enimad sa_translation_pool=rmagni sa_translation_type=sit source_ip=10.209.155.149 src_geo=tenima source_port=1073 source_user=seq translated_dest_ip=10.82.56.117 translated_dest_port=2935 translated_ip_protocol=veleumi translated_route_domain=tia translated_source_ip=10.191.68.244 translated_source_port=6905 translated_vlan=veri vlan=5990", + "fileset.name": "bigipafm", + "host.ip": "10.122.116.161", + "host.name": "gelit6728.api.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 1713, + "network.protocol": "icmp", + "observer.product": "scivel", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4726", + "related.ip": [ + "10.122.116.161", + "10.209.155.149", + "10.82.56.117", + "10.191.68.244" + ], + "related.user": [ + "seq" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "uam", + "rsa.misc.event_type": "enatuse", + "rsa.misc.obj_name": "consec", + "rsa.misc.policy_name": "taliquip", + "rsa.misc.reference_id": "llumd", + "rsa.misc.rule_name": "atcup", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4726", + "rsa.network.alias_host": [ + "gelit6728.api.invalid" + ], + "rsa.network.vlan": 5990, + "rsa.time.event_time_str": "Feb", + "rule.name": "atcup", + "service.type": "f5", + "source.geo.country_name": "tenima", + "source.ip": [ + "10.209.155.149" + ], + "source.nat.ip": "10.191.68.244", + "source.nat.port": 6905, + "source.port": 1073, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "seq" + }, + { + "destination.geo.country_name": "untNequ", + "destination.nat.ip": "10.131.233.27", + "destination.nat.port": 5037, + "destination.port": 5075, + "event.action": "Accept", + "event.code": "ugiatqu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "siutaliq exercit tempor4496.www.localdomain eip lupta iusmodt [F5@doloreeu acl_policy_name=pori acl_policy_type=occ acl_rule_name=ect action=Accept hostname=uid545.www5.localhost bigip_mgmt_ip=10.12.44.169 context_name=autfu context_type=natura date_time=Mar 12 2016 03:17:42 dest_ip=10.163.217.10 dst_geo=untNequ dest_port=5075 device_product=nimadmin device_vendor=erep device_version=1.2696 drop_reason=temq errdefs_msgno=ugiatqu errdefs_msg_name=eacomm flow_id=Utenimad ip_protocol=igmp severity=high partition_name=ehend route_domain=ueipsaqu sa_translation_pool=uidolore sa_translation_type=niamqu source_ip=10.202.66.28 src_geo=tevelit source_port=5098 source_user=elits translated_dest_ip=10.131.233.27 translated_dest_port=5037 translated_ip_protocol=ari translated_route_domain=eataevit translated_source_ip=10.50.112.141 translated_source_port=7303 translated_vlan=dmi vlan=499", + "fileset.name": "bigipafm", + "host.ip": "10.12.44.169", + "host.name": "uid545.www5.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 2582, + "network.protocol": "igmp", + "observer.product": "nimadmin", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2696", + "related.ip": [ + "10.12.44.169", + "10.50.112.141", + "10.131.233.27", + "10.202.66.28" + ], + "related.user": [ + "elits" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "autfu", + "rsa.misc.event_type": "eacomm", + "rsa.misc.obj_name": "doloreeu", + "rsa.misc.policy_name": "pori", + "rsa.misc.reference_id": "ugiatqu", + "rsa.misc.rule_name": "ect", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2696", + "rsa.network.alias_host": [ + "uid545.www5.localhost" + ], + "rsa.network.vlan": 499, + "rsa.time.event_time_str": "Mar", + "rule.name": "ect", + "service.type": "f5", + "source.geo.country_name": "tevelit", + "source.ip": [ + "10.202.66.28" + ], + "source.nat.ip": "10.50.112.141", + "source.nat.port": 7303, + "source.port": 5098, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "elits" + }, + { + "destination.geo.country_name": "ema", + "destination.nat.ip": "10.96.35.212", + "destination.nat.port": 3982, + "destination.port": 5969, + "event.action": "Established", + "event.code": "imav", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "mquisnos loremagn iciade3433.example enimad incididu eci [F5@aali acl_policy_name=ametcons acl_policy_type=porainc acl_rule_name=amquisno action=Established hostname=emquiavo452.internal.localhost bigip_mgmt_ip=10.151.111.38 context_name=tvol context_type=moll date_time=Mar 26 2016 10:20:16 dest_ip=10.228.149.225 dst_geo=ema dest_port=5969 device_product=tquovol device_vendor=ntsuntin device_version=1.3341 drop_reason=tatno errdefs_msgno=imav errdefs_msg_name=ididu flow_id=ciunt ip_protocol=ipv6-icmp severity=very-high partition_name=emqu route_domain=lit sa_translation_pool=iam sa_translation_type=qua source_ip=10.159.182.171 src_geo=umdolore source_port=6680 source_user=mol translated_dest_ip=10.96.35.212 translated_dest_port=3982 translated_ip_protocol=rumet translated_route_domain=oll translated_source_ip=10.206.197.113 translated_source_port=4075 translated_vlan=temUten vlan=4125", + "fileset.name": "bigipafm", + "host.ip": "10.151.111.38", + "host.name": "emquiavo452.internal.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 3471, + "network.protocol": "ipv6-icmp", + "observer.product": "tquovol", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3341", + "related.ip": [ + "10.151.111.38", + "10.206.197.113", + "10.96.35.212", + "10.159.182.171" + ], + "related.user": [ + "mol" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "tvol", + "rsa.misc.event_type": "ididu", + "rsa.misc.obj_name": "aali", + "rsa.misc.policy_name": "ametcons", + "rsa.misc.reference_id": "imav", + "rsa.misc.rule_name": "amquisno", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3341", + "rsa.network.alias_host": [ + "emquiavo452.internal.localhost" + ], + "rsa.network.vlan": 4125, + "rsa.time.event_time_str": "Mar", + "rule.name": "amquisno", + "service.type": "f5", + "source.geo.country_name": "umdolore", + "source.ip": [ + "10.159.182.171" + ], + "source.nat.ip": "10.206.197.113", + "source.nat.port": 4075, + "source.port": 6680, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "mol" + }, + { + "destination.geo.country_name": "rnatura", + "destination.nat.ip": "10.169.144.147", + "destination.nat.port": 2399, + "destination.port": 3007, + "event.action": "Drop", + "event.code": "liq", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "iqu ollit usan6343.www5.domain olo uaera sitas [F5@ehenderi acl_policy_name=pidatat acl_policy_type=gni acl_rule_name=tquiinea action=Drop hostname=sun1403.www.invalid bigip_mgmt_ip=10.126.177.162 context_name=eriame context_type=lorema date_time=Apr 09 2016 17:22:51 dest_ip=10.213.82.64 dst_geo=rnatura dest_port=3007 device_product=ddoeiu device_vendor=enb device_version=1.6179 drop_reason=onse errdefs_msgno=liq errdefs_msg_name=metcon flow_id=smo ip_protocol=igmp severity=medium partition_name=emporinc route_domain=untutlab sa_translation_pool=tem sa_translation_type=ons source_ip=10.213.113.28 src_geo=ali source_port=6446 source_user=ist translated_dest_ip=10.169.144.147 translated_dest_port=2399 translated_ip_protocol=nibus translated_route_domain=edquiano translated_source_ip=10.89.163.114 translated_source_port=5166 translated_vlan=par vlan=686", + "fileset.name": "bigipafm", + "host.ip": "10.126.177.162", + "host.name": "sun1403.www.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 4369, + "network.protocol": "igmp", + "observer.product": "ddoeiu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6179", + "related.ip": [ + "10.169.144.147", + "10.89.163.114", + "10.213.113.28", + "10.126.177.162" + ], + "related.user": [ + "ist" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "eriame", + "rsa.misc.event_type": "metcon", + "rsa.misc.obj_name": "ehenderi", + "rsa.misc.policy_name": "pidatat", + "rsa.misc.reference_id": "liq", + "rsa.misc.rule_name": "tquiinea", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6179", + "rsa.network.alias_host": [ + "sun1403.www.invalid" + ], + "rsa.network.vlan": 686, + "rsa.time.event_time_str": "Apr", + "rule.name": "tquiinea", + "service.type": "f5", + "source.geo.country_name": "ali", + "source.ip": [ + "10.213.113.28" + ], + "source.nat.ip": "10.89.163.114", + "source.nat.port": 5166, + "source.port": 6446, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ist" + }, + { + "destination.geo.country_name": "qua", + "destination.nat.ip": "10.101.223.43", + "destination.nat.port": 6494, + "destination.port": 2945, + "event.action": "Closed", + "event.code": "tinvol", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "rveli rsint omm4276.www.example onofd taed lup [F5@remeumf acl_policy_name=antiumto acl_policy_type=strude acl_rule_name=ctetura action=Closed hostname=ittenbyC7838.api.localdomain bigip_mgmt_ip=10.18.124.28 context_name=ido context_type=paqu date_time=Apr 24 2016 00:25:25 dest_ip=10.158.194.3 dst_geo=qua dest_port=2945 device_product=quip device_vendor=oin device_version=1.6316 drop_reason=elaudant errdefs_msgno=tinvol errdefs_msg_name=dolore flow_id=abor ip_protocol=udp severity=medium partition_name=etc route_domain=etM sa_translation_pool=nimadmin sa_translation_type=ditautfu source_ip=10.146.88.52 src_geo=entsu source_port=5364 source_user=rudexerc translated_dest_ip=10.101.223.43 translated_dest_port=6494 translated_ip_protocol=quam translated_route_domain=adm translated_source_ip=10.103.107.47 translated_source_port=6094 translated_vlan=Nemoen vlan=2827", + "fileset.name": "bigipafm", + "host.ip": "10.18.124.28", + "host.name": "ittenbyC7838.api.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 5232, + "network.protocol": "udp", + "observer.product": "quip", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6316", + "related.ip": [ + "10.101.223.43", + "10.146.88.52", + "10.103.107.47", + "10.18.124.28" + ], + "related.user": [ + "rudexerc" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ido", + "rsa.misc.event_type": "dolore", + "rsa.misc.obj_name": "remeumf", + "rsa.misc.policy_name": "antiumto", + "rsa.misc.reference_id": "tinvol", + "rsa.misc.rule_name": "ctetura", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6316", + "rsa.network.alias_host": [ + "ittenbyC7838.api.localdomain" + ], + "rsa.network.vlan": 2827, + "rsa.time.event_time_str": "Apr", + "rule.name": "ctetura", + "service.type": "f5", + "source.geo.country_name": "entsu", + "source.ip": [ + "10.146.88.52" + ], + "source.nat.ip": "10.103.107.47", + "source.nat.port": 6094, + "source.port": 5364, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "rudexerc" + }, + { + "destination.geo.country_name": "ivelits", + "destination.nat.ip": "10.110.99.17", + "destination.nat.port": 6888, + "destination.port": 712, + "event.action": "Reject", + "event.code": "ommod", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "icab mwr fugi4637.www.lan imadmini ntutla equa [F5@mexercit acl_policy_name=dtem acl_policy_type=tasuntex acl_rule_name=sunt action=Reject hostname=ume465.corp bigip_mgmt_ip=10.189.109.245 context_name=emaperi context_type=tame date_time=May 08 2016 07:27:59 dest_ip=10.83.234.60 dst_geo=ivelits dest_port=712 device_product=iusmodt device_vendor=etdolo device_version=1.3768 drop_reason=lorumw errdefs_msgno=ommod errdefs_msg_name=sequatur flow_id=uidolo ip_protocol=ipv6-icmp severity=high partition_name=nihi route_domain=Lor sa_translation_pool=itecto sa_translation_type=erc source_ip=10.69.57.206 src_geo=olupt source_port=5979 source_user=onse translated_dest_ip=10.110.99.17 translated_dest_port=6888 translated_ip_protocol=ostrume translated_route_domain=molest translated_source_ip=10.150.220.75 translated_source_port=1298 translated_vlan=tisetq vlan=5372", + "fileset.name": "bigipafm", + "host.ip": "10.189.109.245", + "host.name": "ume465.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 6105, + "network.protocol": "ipv6-icmp", + "observer.product": "iusmodt", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3768", + "related.ip": [ + "10.189.109.245", + "10.150.220.75", + "10.69.57.206", + "10.110.99.17" + ], + "related.user": [ + "onse" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "emaperi", + "rsa.misc.event_type": "sequatur", + "rsa.misc.obj_name": "mexercit", + "rsa.misc.policy_name": "dtem", + "rsa.misc.reference_id": "ommod", + "rsa.misc.rule_name": "sunt", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3768", + "rsa.network.alias_host": [ + "ume465.corp" + ], + "rsa.network.vlan": 5372, + "rsa.time.event_time_str": "May", + "rule.name": "sunt", + "service.type": "f5", + "source.geo.country_name": "olupt", + "source.ip": [ + "10.69.57.206" + ], + "source.nat.ip": "10.150.220.75", + "source.nat.port": 1298, + "source.port": 5979, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "onse" + }, + { + "destination.geo.country_name": "nidolo", + "destination.nat.ip": "10.19.194.101", + "destination.nat.port": 3605, + "destination.port": 3409, + "event.action": "Drop", + "event.code": "Loremip", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ici giatquov eritquii3561.www.example taut oreseos uames [F5@tati acl_policy_name=utaliqu acl_policy_type=oriosamn acl_rule_name=deFinibu action=Drop hostname=iciatisu1463.www5.localdomain bigip_mgmt_ip=10.153.136.222 context_name=tem context_type=est date_time=May 22 2016 14:30:33 dest_ip=10.176.205.96 dst_geo=nidolo dest_port=3409 device_product=taliq device_vendor=intoccae device_version=1.2299 drop_reason=dolo errdefs_msgno=Loremip errdefs_msg_name=idolor flow_id=emeumfu ip_protocol=ipv6-icmp severity=very-high partition_name=lupt route_domain=psaquae sa_translation_pool=oinBCSe sa_translation_type=mnisist source_ip=10.199.34.241 src_geo=amvolup source_port=7700 source_user=temveleu translated_dest_ip=10.19.194.101 translated_dest_port=3605 translated_ip_protocol=numqu translated_route_domain=qui translated_source_ip=10.121.219.204 translated_source_port=3496 translated_vlan=utali vlan=3611", + "fileset.name": "bigipafm", + "host.ip": "10.153.136.222", + "host.name": "iciatisu1463.www5.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6972, + "network.protocol": "ipv6-icmp", + "observer.product": "taliq", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2299", + "related.ip": [ + "10.19.194.101", + "10.153.136.222", + "10.199.34.241", + "10.121.219.204" + ], + "related.user": [ + "temveleu" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "tem", + "rsa.misc.event_type": "idolor", + "rsa.misc.obj_name": "tati", + "rsa.misc.policy_name": "utaliqu", + "rsa.misc.reference_id": "Loremip", + "rsa.misc.rule_name": "deFinibu", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2299", + "rsa.network.alias_host": [ + "iciatisu1463.www5.localdomain" + ], + "rsa.network.vlan": 3611, + "rsa.time.event_time_str": "May", + "rule.name": "deFinibu", + "service.type": "f5", + "source.geo.country_name": "amvolup", + "source.ip": [ + "10.199.34.241" + ], + "source.nat.ip": "10.121.219.204", + "source.nat.port": 3496, + "source.port": 7700, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "temveleu" + }, + { + "destination.geo.country_name": "usmodt", + "destination.nat.ip": "10.57.103.192", + "destination.nat.port": 2716, + "destination.port": 1837, + "event.action": "Reject", + "event.code": "llu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "reetd lumqui itinvo7084.mail.corp equep iavolu den [F5@tutla acl_policy_name=olorema acl_policy_type=iades acl_rule_name=siarchi action=Reject hostname=aliqu6801.api.localdomain bigip_mgmt_ip=10.46.27.57 context_name=ihilm context_type=atDu date_time=Jun 05 2016 21:33:08 dest_ip=10.128.232.208 dst_geo=usmodt dest_port=1837 device_product=run device_vendor=mque device_version=1.4138 drop_reason=quirat errdefs_msgno=llu errdefs_msg_name=licab flow_id=eirure ip_protocol=rdp severity=medium partition_name=oidentsu route_domain=atiset sa_translation_pool=atu sa_translation_type=umexerci source_ip=10.64.141.105 src_geo=iadese source_port=2374 source_user=ice translated_dest_ip=10.57.103.192 translated_dest_port=2716 translated_ip_protocol=oei translated_route_domain=tlabori translated_source_ip=10.182.199.231 translated_source_port=1426 translated_vlan=data vlan=4478", + "fileset.name": "bigipafm", + "host.ip": "10.46.27.57", + "host.name": "aliqu6801.api.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 7880, + "network.protocol": "rdp", + "observer.product": "run", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4138", + "related.ip": [ + "10.64.141.105", + "10.46.27.57", + "10.57.103.192", + "10.182.199.231" + ], + "related.user": [ + "ice" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ihilm", + "rsa.misc.event_type": "licab", + "rsa.misc.obj_name": "tutla", + "rsa.misc.policy_name": "olorema", + "rsa.misc.reference_id": "llu", + "rsa.misc.rule_name": "siarchi", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.4138", + "rsa.network.alias_host": [ + "aliqu6801.api.localdomain" + ], + "rsa.network.vlan": 4478, + "rsa.time.event_time_str": "Jun", + "rule.name": "siarchi", + "service.type": "f5", + "source.geo.country_name": "iadese", + "source.ip": [ + "10.64.141.105" + ], + "source.nat.ip": "10.182.199.231", + "source.nat.port": 1426, + "source.port": 2374, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ice" + }, + { + "destination.geo.country_name": "serunt", + "destination.nat.ip": "10.160.210.31", + "destination.nat.port": 7741, + "destination.port": 7865, + "event.action": "Closed", + "event.code": "eaq", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "nnum eritqu uradip7152.www5.home luptasn hitect dol [F5@leumiu acl_policy_name=namali acl_policy_type=taevit acl_rule_name=rinrepre action=Closed hostname=itame189.domain bigip_mgmt_ip=10.32.67.231 context_name=estia context_type=eaq date_time=Jun 20 2016 04:35:42 dest_ip=10.66.80.221 dst_geo=serunt dest_port=7865 device_product=texp device_vendor=tMalor device_version=1.7410 drop_reason=emoe errdefs_msgno=eaq errdefs_msg_name=amest flow_id=corp ip_protocol=tcp severity=low partition_name=rehender route_domain=iae sa_translation_pool=dantiumt sa_translation_type=luptasn source_ip=10.164.6.207 src_geo=olestiae source_port=5485 source_user=pic translated_dest_ip=10.160.210.31 translated_dest_port=7741 translated_ip_protocol=duntut translated_route_domain=magni translated_source_ip=10.3.134.237 translated_source_port=3156 translated_vlan=radipisc vlan=7020", + "fileset.name": "bigipafm", + "host.ip": "10.32.67.231", + "host.name": "itame189.domain", + "input.type": "log", + "log.level": "low", + "log.offset": 8754, + "network.protocol": "tcp", + "observer.product": "texp", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7410", + "related.ip": [ + "10.32.67.231", + "10.164.6.207", + "10.3.134.237", + "10.160.210.31" + ], + "related.user": [ + "pic" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "estia", + "rsa.misc.event_type": "amest", + "rsa.misc.obj_name": "leumiu", + "rsa.misc.policy_name": "namali", + "rsa.misc.reference_id": "eaq", + "rsa.misc.rule_name": "rinrepre", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7410", + "rsa.network.alias_host": [ + "itame189.domain" + ], + "rsa.network.vlan": 7020, + "rsa.time.event_time_str": "Jun", + "rule.name": "rinrepre", + "service.type": "f5", + "source.geo.country_name": "olestiae", + "source.ip": [ + "10.164.6.207" + ], + "source.nat.ip": "10.3.134.237", + "source.nat.port": 3156, + "source.port": 5485, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "pic" + }, + { + "destination.geo.country_name": "beata", + "destination.nat.ip": "10.42.138.192", + "destination.nat.port": 3403, + "destination.port": 6448, + "event.action": "Established", + "event.code": "uela", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "fficiade uscipit vitaedi1318.corp temqu edol colab [F5@ommodico acl_policy_name=quatD acl_policy_type=mcolab acl_rule_name=neav action=Established hostname=tsedqu2456.www5.invalid bigip_mgmt_ip=10.182.178.217 context_name=tlab context_type=volupt date_time=Jul 04 2016 11:38:16 dest_ip=10.188.169.107 dst_geo=beata dest_port=6448 device_product=fdeFi device_vendor=texp device_version=1.3545 drop_reason=etdol errdefs_msgno=uela errdefs_msg_name=boN flow_id=eprehend ip_protocol=tcp severity=medium partition_name=aboN route_domain=ihilmo sa_translation_pool=radi sa_translation_type=gel source_ip=10.235.101.253 src_geo=veniam source_port=2400 source_user=giatnu translated_dest_ip=10.42.138.192 translated_dest_port=3403 translated_ip_protocol=quioffi translated_route_domain=uptate translated_source_ip=10.201.6.10 translated_source_port=6608 translated_vlan=sequa vlan=2851", + "fileset.name": "bigipafm", + "host.ip": "10.182.178.217", + "host.name": "tsedqu2456.www5.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 9620, + "network.protocol": "tcp", + "observer.product": "fdeFi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3545", + "related.ip": [ + "10.42.138.192", + "10.235.101.253", + "10.182.178.217", + "10.201.6.10" + ], + "related.user": [ + "giatnu" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "tlab", + "rsa.misc.event_type": "boN", + "rsa.misc.obj_name": "ommodico", + "rsa.misc.policy_name": "quatD", + "rsa.misc.reference_id": "uela", + "rsa.misc.rule_name": "neav", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3545", + "rsa.network.alias_host": [ + "tsedqu2456.www5.invalid" + ], + "rsa.network.vlan": 2851, + "rsa.time.event_time_str": "Jul", + "rule.name": "neav", + "service.type": "f5", + "source.geo.country_name": "veniam", + "source.ip": [ + "10.235.101.253" + ], + "source.nat.ip": "10.201.6.10", + "source.nat.port": 6608, + "source.port": 2400, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "giatnu" + }, + { + "destination.geo.country_name": "enderit", + "destination.nat.ip": "10.194.247.171", + "destination.nat.port": 4940, + "destination.port": 5858, + "event.action": "Closed", + "event.code": "Utenimad", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ate aliquam nimid893.mail.corp umwr oluptate issus [F5@osamn acl_policy_name=isnisiu acl_policy_type=bore acl_rule_name=tsu action=Closed hostname=stlabo1228.mail.host bigip_mgmt_ip=10.151.161.70 context_name=edo context_type=asia date_time=Jul 18 2016 18:40:50 dest_ip=10.108.167.93 dst_geo=enderit dest_port=5858 device_product=essecil device_vendor=citation device_version=1.3795 drop_reason=eco errdefs_msgno=Utenimad errdefs_msg_name=orpor flow_id=tlabo ip_protocol=rdp severity=low partition_name=emvel route_domain=tmollita sa_translation_pool=fde sa_translation_type=nsecte source_ip=10.22.102.198 src_geo=eroi source_port=176 source_user=nse translated_dest_ip=10.194.247.171 translated_dest_port=4940 translated_ip_protocol=mquisnos translated_route_domain=maven translated_source_ip=10.86.101.235 translated_source_port=3266 translated_vlan=lapar vlan=1024", + "fileset.name": "bigipafm", + "host.ip": "10.151.161.70", + "host.name": "stlabo1228.mail.host", + "input.type": "log", + "log.level": "low", + "log.offset": 10498, + "network.protocol": "rdp", + "observer.product": "essecil", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3795", + "related.ip": [ + "10.151.161.70", + "10.86.101.235", + "10.22.102.198", + "10.194.247.171" + ], + "related.user": [ + "nse" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "edo", + "rsa.misc.event_type": "orpor", + "rsa.misc.obj_name": "osamn", + "rsa.misc.policy_name": "isnisiu", + "rsa.misc.reference_id": "Utenimad", + "rsa.misc.rule_name": "tsu", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3795", + "rsa.network.alias_host": [ + "stlabo1228.mail.host" + ], + "rsa.network.vlan": 1024, + "rsa.time.event_time_str": "Jul", + "rule.name": "tsu", + "service.type": "f5", + "source.geo.country_name": "eroi", + "source.ip": [ + "10.22.102.198" + ], + "source.nat.ip": "10.86.101.235", + "source.nat.port": 3266, + "source.port": 176, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "nse" + }, + { + "destination.geo.country_name": "mve", + "destination.nat.ip": "10.107.168.60", + "destination.nat.port": 2227, + "destination.port": 513, + "event.action": "Reject", + "event.code": "volupt", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tfu udan orema6040.api.corp mveleu nofdeFin sequam [F5@temvel acl_policy_name=ris acl_policy_type=nisi acl_rule_name=dant action=Reject hostname=ecte4762.local bigip_mgmt_ip=10.204.35.15 context_name=quidolor context_type=tessec date_time=Aug 02 2016 01:43:25 dest_ip=10.135.160.125 dst_geo=mve dest_port=513 device_product=itatio device_vendor=uta device_version=1.4901 drop_reason=sintoc errdefs_msgno=volupt errdefs_msg_name=siste flow_id=uiinea ip_protocol=icmp severity=low partition_name=volupta route_domain=rcitati sa_translation_pool=eni sa_translation_type=ionevo source_ip=10.174.252.105 src_geo=sperna source_port=5368 source_user=mnisi translated_dest_ip=10.107.168.60 translated_dest_port=2227 translated_ip_protocol=oinBC translated_route_domain=quameius translated_source_ip=10.167.172.155 translated_source_port=3544 translated_vlan=etdo vlan=706", + "fileset.name": "bigipafm", + "host.ip": "10.204.35.15", + "host.name": "ecte4762.local", + "input.type": "log", + "log.level": "low", + "log.offset": 11366, + "network.protocol": "icmp", + "observer.product": "itatio", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4901", + "related.ip": [ + "10.167.172.155", + "10.174.252.105", + "10.107.168.60", + "10.204.35.15" + ], + "related.user": [ + "mnisi" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "quidolor", + "rsa.misc.event_type": "siste", + "rsa.misc.obj_name": "temvel", + "rsa.misc.policy_name": "ris", + "rsa.misc.reference_id": "volupt", + "rsa.misc.rule_name": "dant", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4901", + "rsa.network.alias_host": [ + "ecte4762.local" + ], + "rsa.network.vlan": 706, + "rsa.time.event_time_str": "Aug", + "rule.name": "dant", + "service.type": "f5", + "source.geo.country_name": "sperna", + "source.ip": [ + "10.174.252.105" + ], + "source.nat.ip": "10.167.172.155", + "source.nat.port": 3544, + "source.port": 5368, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "mnisi" + }, + { + "destination.geo.country_name": "quinesc", + "destination.nat.ip": "10.182.191.174", + "destination.nat.port": 1759, + "destination.port": 6218, + "event.action": "Drop", + "event.code": "orem", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ese isaute ptatemq95.api.host Nequepo ipsumd ntocc [F5@uteirure acl_policy_name=nevo acl_policy_type=ide acl_rule_name=aali action=Drop hostname=smo7167.www.test bigip_mgmt_ip=10.214.249.164 context_name=tco context_type=uae date_time=Aug 16 2016 08:45:59 dest_ip=10.187.20.98 dst_geo=quinesc dest_port=6218 device_product=santiumd device_vendor=turadip device_version=1.3427 drop_reason=niamqui errdefs_msgno=orem errdefs_msg_name=sno flow_id=atno ip_protocol=ipv6-icmp severity=high partition_name=volu route_domain=nonn sa_translation_pool=inventor sa_translation_type=quiavol source_ip=10.99.249.210 src_geo=iatisu source_port=6684 source_user=upta translated_dest_ip=10.182.191.174 translated_dest_port=1759 translated_ip_protocol=adm translated_route_domain=leumiur translated_source_ip=10.81.26.208 translated_source_port=7651 translated_vlan=isc vlan=5933", + "fileset.name": "bigipafm", + "host.ip": "10.214.249.164", + "host.name": "smo7167.www.test", + "input.type": "log", + "log.level": "high", + "log.offset": 12230, + "network.protocol": "ipv6-icmp", + "observer.product": "santiumd", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3427", + "related.ip": [ + "10.182.191.174", + "10.214.249.164", + "10.81.26.208", + "10.99.249.210" + ], + "related.user": [ + "upta" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "tco", + "rsa.misc.event_type": "sno", + "rsa.misc.obj_name": "uteirure", + "rsa.misc.policy_name": "nevo", + "rsa.misc.reference_id": "orem", + "rsa.misc.rule_name": "aali", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3427", + "rsa.network.alias_host": [ + "smo7167.www.test" + ], + "rsa.network.vlan": 5933, + "rsa.time.event_time_str": "Aug", + "rule.name": "aali", + "service.type": "f5", + "source.geo.country_name": "iatisu", + "source.ip": [ + "10.99.249.210" + ], + "source.nat.ip": "10.81.26.208", + "source.nat.port": 7651, + "source.port": 6684, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "upta" + }, + { + "destination.geo.country_name": "eriti", + "destination.nat.ip": "10.88.101.53", + "destination.nat.port": 2458, + "destination.port": 2201, + "event.action": "Drop", + "event.code": "quameius", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tobea tor qui4499.api.local fugiatn docon etconsec [F5@ios acl_policy_name=evolu acl_policy_type=ersp acl_rule_name=tquov action=Drop hostname=sauteiru4554.api.domain bigip_mgmt_ip=10.220.5.143 context_name=com context_type=tnulapa date_time=Aug 30 2016 15:48:33 dest_ip=10.108.85.148 dst_geo=eriti dest_port=2201 device_product=norum device_vendor=madmi device_version=1.1766 drop_reason=sequatu errdefs_msgno=quameius errdefs_msg_name=nisiuta flow_id=roid ip_protocol=icmp severity=very-high partition_name=eprehen route_domain=entor sa_translation_pool=xeacomm sa_translation_type=nihil source_ip=10.101.226.128 src_geo=rsitv source_port=3087 source_user=porro translated_dest_ip=10.88.101.53 translated_dest_port=2458 translated_ip_protocol=tatemUt translated_route_domain=modtemp translated_source_ip=10.201.238.90 translated_source_port=2715 translated_vlan=remag vlan=3759", + "fileset.name": "bigipafm", + "host.ip": "10.220.5.143", + "host.name": "sauteiru4554.api.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 13094, + "network.protocol": "icmp", + "observer.product": "norum", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1766", + "related.ip": [ + "10.101.226.128", + "10.88.101.53", + "10.201.238.90", + "10.220.5.143" + ], + "related.user": [ + "porro" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "com", + "rsa.misc.event_type": "nisiuta", + "rsa.misc.obj_name": "ios", + "rsa.misc.policy_name": "evolu", + "rsa.misc.reference_id": "quameius", + "rsa.misc.rule_name": "tquov", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1766", + "rsa.network.alias_host": [ + "sauteiru4554.api.domain" + ], + "rsa.network.vlan": 3759, + "rsa.time.event_time_str": "Aug", + "rule.name": "tquov", + "service.type": "f5", + "source.geo.country_name": "rsitv", + "source.ip": [ + "10.101.226.128" + ], + "source.nat.ip": "10.201.238.90", + "source.nat.port": 2715, + "source.port": 3087, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "porro" + }, + { + "destination.geo.country_name": "untu", + "destination.nat.ip": "10.30.133.66", + "destination.nat.port": 1921, + "destination.port": 5676, + "event.action": "Reject", + "event.code": "ium", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ccaecat tquiin tse4198.www.localdomain ptasn taedicta itam [F5@str acl_policy_name=idolore acl_policy_type=pid acl_rule_name=illoin action=Reject hostname=untut4046.internal.domain bigip_mgmt_ip=10.217.150.196 context_name=uine context_type=udant date_time=Sep 13 2016 22:51:07 dest_ip=10.183.59.41 dst_geo=untu dest_port=5676 device_product=ven device_vendor=con device_version=1.7491 drop_reason=amnih errdefs_msgno=ium errdefs_msg_name=esciuntN flow_id=idunt ip_protocol=udp severity=low partition_name=rQu route_domain=oremeu sa_translation_pool=laudant sa_translation_type=isnost source_ip=10.157.18.252 src_geo=itess source_port=52 source_user=evit translated_dest_ip=10.30.133.66 translated_dest_port=1921 translated_ip_protocol=velitse translated_route_domain=oditem translated_source_ip=10.243.218.215 translated_source_port=662 translated_vlan=rsitvolu vlan=3751", + "fileset.name": "bigipafm", + "host.ip": "10.217.150.196", + "host.name": "untut4046.internal.domain", + "input.type": "log", + "log.level": "low", + "log.offset": 13974, + "network.protocol": "udp", + "observer.product": "ven", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7491", + "related.ip": [ + "10.30.133.66", + "10.157.18.252", + "10.243.218.215", + "10.217.150.196" + ], + "related.user": [ + "evit" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "uine", + "rsa.misc.event_type": "esciuntN", + "rsa.misc.obj_name": "str", + "rsa.misc.policy_name": "idolore", + "rsa.misc.reference_id": "ium", + "rsa.misc.rule_name": "illoin", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7491", + "rsa.network.alias_host": [ + "untut4046.internal.domain" + ], + "rsa.network.vlan": 3751, + "rsa.time.event_time_str": "Sep", + "rule.name": "illoin", + "service.type": "f5", + "source.geo.country_name": "itess", + "source.ip": [ + "10.157.18.252" + ], + "source.nat.ip": "10.243.218.215", + "source.nat.port": 662, + "source.port": 52, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "evit" + }, + { + "destination.geo.country_name": "iduntu", + "destination.nat.ip": "10.181.133.187", + "destination.nat.port": 1079, + "destination.port": 1655, + "event.action": "Accept", + "event.code": "acommo", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "sumdolor meaqueip npr4414.api.localdomain boNem ess ipisci [F5@gitsed acl_policy_name=tqu acl_policy_type=reprehen acl_rule_name=trumexer action=Accept hostname=quid3147.mail.home bigip_mgmt_ip=10.66.181.6 context_name=epre context_type=tobeata date_time=Sep 28 2016 05:53:42 dest_ip=10.181.53.249 dst_geo=iduntu dest_port=1655 device_product=temUt device_vendor=avol device_version=1.752 drop_reason=essequam errdefs_msgno=acommo errdefs_msg_name=nturma flow_id=str ip_protocol=ipv6 severity=high partition_name=etur route_domain=itecto sa_translation_pool=reetdol sa_translation_type=totamre source_ip=10.148.161.250 src_geo=ciadeser source_port=6135 source_user=adipisc translated_dest_ip=10.181.133.187 translated_dest_port=1079 translated_ip_protocol=aquioffi translated_route_domain=tamet translated_source_ip=10.167.227.44 translated_source_port=6595 translated_vlan=eFi vlan=6733", + "fileset.name": "bigipafm", + "host.ip": "10.66.181.6", + "host.name": "quid3147.mail.home", + "input.type": "log", + "log.level": "high", + "log.offset": 14847, + "network.protocol": "ipv6", + "observer.product": "temUt", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.752", + "related.ip": [ + "10.181.133.187", + "10.148.161.250", + "10.167.227.44", + "10.66.181.6" + ], + "related.user": [ + "adipisc" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "epre", + "rsa.misc.event_type": "nturma", + "rsa.misc.obj_name": "gitsed", + "rsa.misc.policy_name": "tqu", + "rsa.misc.reference_id": "acommo", + "rsa.misc.rule_name": "trumexer", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.752", + "rsa.network.alias_host": [ + "quid3147.mail.home" + ], + "rsa.network.vlan": 6733, + "rsa.time.event_time_str": "Sep", + "rule.name": "trumexer", + "service.type": "f5", + "source.geo.country_name": "ciadeser", + "source.ip": [ + "10.148.161.250" + ], + "source.nat.ip": "10.167.227.44", + "source.nat.port": 6595, + "source.port": 6135, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "adipisc" + }, + { + "destination.geo.country_name": "psaquaea", + "destination.nat.ip": "10.107.9.163", + "destination.nat.port": 5433, + "destination.port": 1348, + "event.action": "Reject", + "event.code": "piscinge", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "its ender riamea1540.www.host seq tutlab sau [F5@atevelit acl_policy_name=meius acl_policy_type=billo acl_rule_name=labo action=Reject hostname=umdolo1029.mail.localhost bigip_mgmt_ip=10.54.17.32 context_name=orumSe context_type=ratv date_time=Oct 12 2016 12:56:16 dest_ip=10.119.81.180 dst_geo=psaquaea dest_port=1348 device_product=nts device_vendor=siut device_version=1.5663 drop_reason=ano errdefs_msgno=piscinge errdefs_msg_name=tvol flow_id=velitess ip_protocol=ipv6 severity=high partition_name=uunturm route_domain=temUte sa_translation_pool=sit sa_translation_type=olab source_ip=10.84.163.178 src_geo=ima source_port=2031 source_user=mquisno translated_dest_ip=10.107.9.163 translated_dest_port=5433 translated_ip_protocol=eacommod translated_route_domain=ctetura translated_source_ip=10.74.11.43 translated_source_port=55 translated_vlan=seosqui vlan=6797", + "fileset.name": "bigipafm", + "host.ip": "10.54.17.32", + "host.name": "umdolo1029.mail.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 15735, + "network.protocol": "ipv6", + "observer.product": "nts", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5663", + "related.ip": [ + "10.54.17.32", + "10.74.11.43", + "10.84.163.178", + "10.107.9.163" + ], + "related.user": [ + "mquisno" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "orumSe", + "rsa.misc.event_type": "tvol", + "rsa.misc.obj_name": "atevelit", + "rsa.misc.policy_name": "meius", + "rsa.misc.reference_id": "piscinge", + "rsa.misc.rule_name": "labo", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5663", + "rsa.network.alias_host": [ + "umdolo1029.mail.localhost" + ], + "rsa.network.vlan": 6797, + "rsa.time.event_time_str": "Oct", + "rule.name": "labo", + "service.type": "f5", + "source.geo.country_name": "ima", + "source.ip": [ + "10.84.163.178" + ], + "source.nat.ip": "10.74.11.43", + "source.nat.port": 55, + "source.port": 2031, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "mquisno" + }, + { + "destination.geo.country_name": "odoconse", + "destination.nat.ip": "10.184.73.211", + "destination.nat.port": 6540, + "destination.port": 228, + "event.action": "Accept", + "event.code": "labo", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uradi tot llamco7206.www.home oremagna ncididun umSe [F5@xeacomm acl_policy_name=cinge acl_policy_type=itla acl_rule_name=iamquis action=Accept hostname=lorsita2019.internal.home bigip_mgmt_ip=10.192.229.221 context_name=ect context_type=modocons date_time=Oct 26 2016 19:58:50 dest_ip=10.199.194.188 dst_geo=odoconse dest_port=228 device_product=quatu device_vendor=veli device_version=1.5726 drop_reason=nonp errdefs_msgno=labo errdefs_msg_name=ulapar flow_id=aboreetd ip_protocol=igmp severity=low partition_name=llitanim route_domain=invo sa_translation_pool=hit sa_translation_type=urv source_ip=10.112.32.213 src_geo=runtmol source_port=1749 source_user=odi translated_dest_ip=10.184.73.211 translated_dest_port=6540 translated_ip_protocol=esseci translated_route_domain=tametcon translated_source_ip=10.230.129.252 translated_source_port=3947 translated_vlan=isis vlan=4917", + "fileset.name": "bigipafm", + "host.ip": "10.192.229.221", + "host.name": "lorsita2019.internal.home", + "input.type": "log", + "log.level": "low", + "log.offset": 16603, + "network.protocol": "igmp", + "observer.product": "quatu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5726", + "related.ip": [ + "10.230.129.252", + "10.112.32.213", + "10.184.73.211", + "10.192.229.221" + ], + "related.user": [ + "odi" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "ect", + "rsa.misc.event_type": "ulapar", + "rsa.misc.obj_name": "xeacomm", + "rsa.misc.policy_name": "cinge", + "rsa.misc.reference_id": "labo", + "rsa.misc.rule_name": "iamquis", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.5726", + "rsa.network.alias_host": [ + "lorsita2019.internal.home" + ], + "rsa.network.vlan": 4917, + "rsa.time.event_time_str": "Oct", + "rule.name": "iamquis", + "service.type": "f5", + "source.geo.country_name": "runtmol", + "source.ip": [ + "10.112.32.213" + ], + "source.nat.ip": "10.230.129.252", + "source.nat.port": 3947, + "source.port": 1749, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "odi" + }, + { + "destination.geo.country_name": "doloreme", + "destination.nat.ip": "10.198.213.189", + "destination.nat.port": 5024, + "destination.port": 60, + "event.action": "Reject", + "event.code": "itse", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "utlab emUteni rum959.host velillu cteturad bor [F5@rauto acl_policy_name=ationev acl_policy_type=umdolor acl_rule_name=uaUten action=Reject hostname=paquioff624.mail.invalid bigip_mgmt_ip=10.161.148.64 context_name=ibusBon context_type=ven date_time=Nov 10 2016 03:01:24 dest_ip=10.162.114.217 dst_geo=doloreme dest_port=60 device_product=onemulla device_vendor=evitaed device_version=1.1721 drop_reason=suntin errdefs_msgno=itse errdefs_msg_name=umexerc flow_id=oremipsu ip_protocol=ipv6-icmp severity=medium partition_name=amco route_domain=ssecillu sa_translation_pool=liqua sa_translation_type=olo source_ip=10.199.216.143 src_geo=fdeF source_port=593 source_user=ccaeca translated_dest_ip=10.198.213.189 translated_dest_port=5024 translated_ip_protocol=remagn translated_route_domain=mquae translated_source_ip=10.7.200.140 translated_source_port=3298 translated_vlan=olupt vlan=2189", + "fileset.name": "bigipafm", + "host.ip": "10.161.148.64", + "host.name": "paquioff624.mail.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 17484, + "network.protocol": "ipv6-icmp", + "observer.product": "onemulla", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1721", + "related.ip": [ + "10.161.148.64", + "10.198.213.189", + "10.7.200.140", + "10.199.216.143" + ], + "related.user": [ + "ccaeca" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ibusBon", + "rsa.misc.event_type": "umexerc", + "rsa.misc.obj_name": "rauto", + "rsa.misc.policy_name": "ationev", + "rsa.misc.reference_id": "itse", + "rsa.misc.rule_name": "uaUten", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.1721", + "rsa.network.alias_host": [ + "paquioff624.mail.invalid" + ], + "rsa.network.vlan": 2189, + "rsa.time.event_time_str": "Nov", + "rule.name": "uaUten", + "service.type": "f5", + "source.geo.country_name": "fdeF", + "source.ip": [ + "10.199.216.143" + ], + "source.nat.ip": "10.7.200.140", + "source.nat.port": 3298, + "source.port": 593, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ccaeca" + }, + { + "destination.geo.country_name": "taedicta", + "destination.nat.ip": "10.128.157.27", + "destination.nat.port": 1493, + "destination.port": 3409, + "event.action": "Reject", + "event.code": "snost", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "edquiac urerepr eseru4234.mail.example qua rsita ate [F5@ipsamvo acl_policy_name=onula acl_policy_type=miu acl_rule_name=rationev action=Reject hostname=mex2054.mail.corp bigip_mgmt_ip=10.65.232.27 context_name=ica context_type=lillum date_time=Nov 24 2016 10:03:59 dest_ip=10.199.40.38 dst_geo=taedicta dest_port=3409 device_product=poriss device_vendor=tvolup device_version=1.1000 drop_reason=siu errdefs_msgno=snost errdefs_msg_name=tpersp flow_id=llamc ip_protocol=tcp severity=very-high partition_name=mvel route_domain=nof sa_translation_pool=usmodi sa_translation_type=mvolu source_ip=10.206.96.56 src_geo=aincidu source_port=2687 source_user=uaeab translated_dest_ip=10.128.157.27 translated_dest_port=1493 translated_ip_protocol=etdolor translated_route_domain=lupta translated_source_ip=10.22.187.69 translated_source_port=3590 translated_vlan=oremi vlan=1485", + "fileset.name": "bigipafm", + "host.ip": "10.65.232.27", + "host.name": "mex2054.mail.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 18373, + "network.protocol": "tcp", + "observer.product": "poriss", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1000", + "related.ip": [ + "10.128.157.27", + "10.65.232.27", + "10.206.96.56", + "10.22.187.69" + ], + "related.user": [ + "uaeab" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ica", + "rsa.misc.event_type": "tpersp", + "rsa.misc.obj_name": "ipsamvo", + "rsa.misc.policy_name": "onula", + "rsa.misc.reference_id": "snost", + "rsa.misc.rule_name": "rationev", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1000", + "rsa.network.alias_host": [ + "mex2054.mail.corp" + ], + "rsa.network.vlan": 1485, + "rsa.time.event_time_str": "Nov", + "rule.name": "rationev", + "service.type": "f5", + "source.geo.country_name": "aincidu", + "source.ip": [ + "10.206.96.56" + ], + "source.nat.ip": "10.22.187.69", + "source.nat.port": 3590, + "source.port": 2687, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "uaeab" + }, + { + "destination.geo.country_name": "dipisci", + "destination.nat.ip": "10.68.253.120", + "destination.nat.port": 481, + "destination.port": 3449, + "event.action": "Closed", + "event.code": "tae", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "nbyCi tevel usc5760.www5.localdomain cab atisund xea [F5@ites acl_policy_name=isetq acl_policy_type=iutali acl_rule_name=velite action=Closed hostname=avolupt7576.api.corp bigip_mgmt_ip=10.194.210.62 context_name=porincid context_type=atisetqu date_time=Dec 08 2016 17:06:33 dest_ip=10.51.213.42 dst_geo=dipisci dest_port=3449 device_product=ilmol device_vendor=eri device_version=1.3104 drop_reason=ueipsa errdefs_msgno=tae errdefs_msg_name=autodit flow_id=elit ip_protocol=udp severity=high partition_name=plica route_domain=ore sa_translation_pool=quidolor sa_translation_type=inven source_ip=10.71.114.14 src_geo=itsedd source_port=3010 source_user=admin translated_dest_ip=10.68.253.120 translated_dest_port=481 translated_ip_protocol=est translated_route_domain=uptatemU translated_source_ip=10.183.130.225 translated_source_port=5693 translated_vlan=item vlan=2738", + "fileset.name": "bigipafm", + "host.ip": "10.194.210.62", + "host.name": "avolupt7576.api.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 19244, + "network.protocol": "udp", + "observer.product": "ilmol", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3104", + "related.ip": [ + "10.71.114.14", + "10.194.210.62", + "10.68.253.120", + "10.183.130.225" + ], + "related.user": [ + "admin" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "porincid", + "rsa.misc.event_type": "autodit", + "rsa.misc.obj_name": "ites", + "rsa.misc.policy_name": "isetq", + "rsa.misc.reference_id": "tae", + "rsa.misc.rule_name": "velite", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3104", + "rsa.network.alias_host": [ + "avolupt7576.api.corp" + ], + "rsa.network.vlan": 2738, + "rsa.time.event_time_str": "Dec", + "rule.name": "velite", + "service.type": "f5", + "source.geo.country_name": "itsedd", + "source.ip": [ + "10.71.114.14" + ], + "source.nat.ip": "10.183.130.225", + "source.nat.port": 5693, + "source.port": 3010, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "admin" + }, + { + "destination.geo.country_name": "giatquov", + "destination.nat.ip": "10.47.255.237", + "destination.nat.port": 2311, + "destination.port": 1918, + "event.action": "Established", + "event.code": "labo", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "dat periam dqu6144.api.localhost dutpers erun orisn [F5@reetd acl_policy_name=prehen acl_policy_type=ntutlabo acl_rule_name=iusmodte action=Established hostname=loi7596.www5.home bigip_mgmt_ip=10.31.177.226 context_name=deserun context_type=esseq date_time=Dec 23 2016 00:09:07 dest_ip=10.209.157.8 dst_geo=giatquov dest_port=1918 device_product=enderi device_vendor=ptatem device_version=1.341 drop_reason=fugi errdefs_msgno=labo errdefs_msg_name=nostrud flow_id=gnaal ip_protocol=ggp severity=medium partition_name=cupi route_domain=tame sa_translation_pool=atione sa_translation_type=lores source_ip=10.45.253.103 src_geo=uii source_port=5923 source_user=remagn translated_dest_ip=10.47.255.237 translated_dest_port=2311 translated_ip_protocol=uuntur translated_route_domain=enderit translated_source_ip=10.107.45.175 translated_source_port=4185 translated_vlan=rumSecti vlan=4593", + "fileset.name": "bigipafm", + "host.ip": "10.31.177.226", + "host.name": "loi7596.www5.home", + "input.type": "log", + "log.level": "medium", + "log.offset": 20116, + "network.protocol": "ggp", + "observer.product": "enderi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.341", + "related.ip": [ + "10.107.45.175", + "10.45.253.103", + "10.31.177.226", + "10.47.255.237" + ], + "related.user": [ + "remagn" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "deserun", + "rsa.misc.event_type": "nostrud", + "rsa.misc.obj_name": "reetd", + "rsa.misc.policy_name": "prehen", + "rsa.misc.reference_id": "labo", + "rsa.misc.rule_name": "iusmodte", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.341", + "rsa.network.alias_host": [ + "loi7596.www5.home" + ], + "rsa.network.vlan": 4593, + "rsa.time.event_time_str": "Dec", + "rule.name": "iusmodte", + "service.type": "f5", + "source.geo.country_name": "uii", + "source.ip": [ + "10.45.253.103" + ], + "source.nat.ip": "10.107.45.175", + "source.nat.port": 4185, + "source.port": 5923, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "remagn" + }, + { + "destination.geo.country_name": "illu", + "destination.nat.ip": "10.55.105.113", + "destination.nat.port": 3214, + "destination.port": 4875, + "event.action": "Reject", + "event.code": "its", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "atise tate onevo4326.internal.local isnost olorem ido [F5@emqu acl_policy_name=riss acl_policy_type=iquamqua acl_rule_name=sit action=Reject hostname=nsequat1971.internal.invalid bigip_mgmt_ip=10.225.212.189 context_name=mven context_type=olorsit date_time=Jan 06 2017 07:11:41 dest_ip=10.121.239.183 dst_geo=illu dest_port=4875 device_product=turadip device_vendor=tatevel device_version=1.1607 drop_reason=ptassita errdefs_msgno=its errdefs_msg_name=lore flow_id=idol ip_protocol=igmp severity=high partition_name=isn route_domain=sBono sa_translation_pool=loremqu sa_translation_type=tetur source_ip=10.213.94.135 src_geo=tMal source_port=2607 source_user=dquia translated_dest_ip=10.55.105.113 translated_dest_port=3214 translated_ip_protocol=tatione translated_route_domain=nimveni translated_source_ip=10.44.58.106 translated_source_port=1241 translated_vlan=quid vlan=4814", + "fileset.name": "bigipafm", + "host.ip": "10.225.212.189", + "host.name": "nsequat1971.internal.invalid", + "input.type": "log", + "log.level": "high", + "log.offset": 21000, + "network.protocol": "igmp", + "observer.product": "turadip", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1607", + "related.ip": [ + "10.225.212.189", + "10.44.58.106", + "10.55.105.113", + "10.213.94.135" + ], + "related.user": [ + "dquia" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "mven", + "rsa.misc.event_type": "lore", + "rsa.misc.obj_name": "emqu", + "rsa.misc.policy_name": "riss", + "rsa.misc.reference_id": "its", + "rsa.misc.rule_name": "sit", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.1607", + "rsa.network.alias_host": [ + "nsequat1971.internal.invalid" + ], + "rsa.network.vlan": 4814, + "rsa.time.event_time_str": "Jan", + "rule.name": "sit", + "service.type": "f5", + "source.geo.country_name": "tMal", + "source.ip": [ + "10.213.94.135" + ], + "source.nat.ip": "10.44.58.106", + "source.nat.port": 1241, + "source.port": 2607, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "dquia" + }, + { + "destination.geo.country_name": "mUten", + "destination.nat.ip": "10.69.161.78", + "destination.nat.port": 1282, + "destination.port": 1812, + "event.action": "Reject", + "event.code": "norumet", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "eporroq ulla iqu4614.www5.example abore squ uiadol [F5@Duisa acl_policy_name=lupta acl_policy_type=aUt acl_rule_name=boNem action=Reject hostname=ectiono2241.lan bigip_mgmt_ip=10.2.114.9 context_name=rehende context_type=velillu date_time=Jan 20 2017 14:14:16 dest_ip=10.94.139.127 dst_geo=mUten dest_port=1812 device_product=quidolor device_vendor=oqu device_version=1.51 drop_reason=tlaboree errdefs_msgno=norumet errdefs_msg_name=dtempo flow_id=tin ip_protocol=tcp severity=high partition_name=imad route_domain=tinvolup sa_translation_pool=tsed sa_translation_type=inv source_ip=10.163.209.70 src_geo=atu source_port=4718 source_user=olabor translated_dest_ip=10.69.161.78 translated_dest_port=1282 translated_ip_protocol=iruredol translated_route_domain=incidid translated_source_ip=10.255.74.136 translated_source_port=5902 translated_vlan=eaqueips vlan=6396", + "fileset.name": "bigipafm", + "host.ip": "10.2.114.9", + "host.name": "ectiono2241.lan", + "input.type": "log", + "log.level": "high", + "log.offset": 21880, + "network.protocol": "tcp", + "observer.product": "quidolor", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.51", + "related.ip": [ + "10.163.209.70", + "10.2.114.9", + "10.255.74.136", + "10.69.161.78" + ], + "related.user": [ + "olabor" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "rehende", + "rsa.misc.event_type": "dtempo", + "rsa.misc.obj_name": "Duisa", + "rsa.misc.policy_name": "lupta", + "rsa.misc.reference_id": "norumet", + "rsa.misc.rule_name": "boNem", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.51", + "rsa.network.alias_host": [ + "ectiono2241.lan" + ], + "rsa.network.vlan": 6396, + "rsa.time.event_time_str": "Jan", + "rule.name": "boNem", + "service.type": "f5", + "source.geo.country_name": "atu", + "source.ip": [ + "10.163.209.70" + ], + "source.nat.ip": "10.255.74.136", + "source.nat.port": 5902, + "source.port": 4718, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "olabor" + }, + { + "destination.geo.country_name": "iciad", + "destination.nat.ip": "10.184.59.148", + "destination.nat.port": 6933, + "destination.port": 7874, + "event.action": "Closed", + "event.code": "lmo", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "volupta dmi untexpl2847.www5.local eiusmod emoe uiinea [F5@mnisiut acl_policy_name=avolu acl_policy_type=Except acl_rule_name=olup action=Closed hostname=umetMal1664.mail.lan bigip_mgmt_ip=10.46.115.216 context_name=equun context_type=sitvo date_time=Feb 03 2017 21:16:50 dest_ip=10.223.198.146 dst_geo=iciad dest_port=7874 device_product=mad device_vendor=onse device_version=1.380 drop_reason=mipsum errdefs_msgno=lmo errdefs_msg_name=aliquamq flow_id=dtempori ip_protocol=rdp severity=medium partition_name=voluptat route_domain=ugit sa_translation_pool=tatem sa_translation_type=metcons source_ip=10.252.102.110 src_geo=henderit source_port=7829 source_user=perspici translated_dest_ip=10.184.59.148 translated_dest_port=6933 translated_ip_protocol=queips translated_route_domain=midest translated_source_ip=10.12.129.137 translated_source_port=721 translated_vlan=orroqu vlan=472", + "fileset.name": "bigipafm", + "host.ip": "10.46.115.216", + "host.name": "umetMal1664.mail.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 22745, + "network.protocol": "rdp", + "observer.product": "mad", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.380", + "related.ip": [ + "10.252.102.110", + "10.46.115.216", + "10.12.129.137", + "10.184.59.148" + ], + "related.user": [ + "perspici" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "equun", + "rsa.misc.event_type": "aliquamq", + "rsa.misc.obj_name": "mnisiut", + "rsa.misc.policy_name": "avolu", + "rsa.misc.reference_id": "lmo", + "rsa.misc.rule_name": "olup", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.380", + "rsa.network.alias_host": [ + "umetMal1664.mail.lan" + ], + "rsa.network.vlan": 472, + "rsa.time.event_time_str": "Feb", + "rule.name": "olup", + "service.type": "f5", + "source.geo.country_name": "henderit", + "source.ip": [ + "10.252.102.110" + ], + "source.nat.ip": "10.12.129.137", + "source.nat.port": 721, + "source.port": 7829, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "perspici" + }, + { + "destination.geo.country_name": "nder", + "destination.nat.ip": "10.155.204.243", + "destination.nat.port": 459, + "destination.port": 3238, + "event.action": "Established", + "event.code": "tatem", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "labore uela ntexplic4824.internal.localhost dolorsit archite remq [F5@veniamq acl_policy_name=occ acl_policy_type=oloreseo acl_rule_name=iruredol action=Established hostname=derit5270.mail.local bigip_mgmt_ip=10.105.52.140 context_name=ntexpl context_type=dunt date_time=Feb 18 2017 04:19:24 dest_ip=10.20.55.199 dst_geo=nder dest_port=3238 device_product=itanim device_vendor=nesciun device_version=1.1729 drop_reason=mollita errdefs_msgno=tatem errdefs_msg_name=iae flow_id=quido ip_protocol=ipv6-icmp severity=very-high partition_name=inBC route_domain=mol sa_translation_pool=tur sa_translation_type=ictas source_ip=10.81.184.7 src_geo=saquaea source_port=6344 source_user=eetd translated_dest_ip=10.155.204.243 translated_dest_port=459 translated_ip_protocol=lorsi translated_route_domain=repreh translated_source_ip=10.199.194.79 translated_source_port=7713 translated_vlan=illumqui vlan=3414", + "fileset.name": "bigipafm", + "host.ip": "10.105.52.140", + "host.name": "derit5270.mail.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 23630, + "network.protocol": "ipv6-icmp", + "observer.product": "itanim", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1729", + "related.ip": [ + "10.105.52.140", + "10.199.194.79", + "10.81.184.7", + "10.155.204.243" + ], + "related.user": [ + "eetd" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "ntexpl", + "rsa.misc.event_type": "iae", + "rsa.misc.obj_name": "veniamq", + "rsa.misc.policy_name": "occ", + "rsa.misc.reference_id": "tatem", + "rsa.misc.rule_name": "iruredol", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1729", + "rsa.network.alias_host": [ + "derit5270.mail.local" + ], + "rsa.network.vlan": 3414, + "rsa.time.event_time_str": "Feb", + "rule.name": "iruredol", + "service.type": "f5", + "source.geo.country_name": "saquaea", + "source.ip": [ + "10.81.184.7" + ], + "source.nat.ip": "10.199.194.79", + "source.nat.port": 7713, + "source.port": 6344, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "eetd" + }, + { + "destination.geo.country_name": "unte", + "destination.nat.ip": "10.18.226.72", + "destination.nat.port": 5140, + "destination.port": 893, + "event.action": "Closed", + "event.code": "tatnon", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "amali ate idolor3916.www5.home tas autfugi tasun [F5@duntutla acl_policy_name=ntium acl_policy_type=iration acl_rule_name=umwritte action=Closed hostname=orisni5238.mail.lan bigip_mgmt_ip=10.177.238.45 context_name=iumt context_type=tsed date_time=Mar 04 2017 11:21:59 dest_ip=10.249.120.78 dst_geo=unte dest_port=893 device_product=ueipsa device_vendor=scipitl device_version=1.1453 drop_reason=aparia errdefs_msgno=tatnon errdefs_msg_name=leumiur flow_id=tetura ip_protocol=ggp severity=very-high partition_name=oluptat route_domain=metco sa_translation_pool=acom sa_translation_type=ceroinB source_ip=10.110.2.166 src_geo=exeacomm source_port=79 source_user=taliqui translated_dest_ip=10.18.226.72 translated_dest_port=5140 translated_ip_protocol=olupta translated_route_domain=tsuntinc translated_source_ip=10.251.231.142 translated_source_port=872 translated_vlan=urExcep vlan=102", + "fileset.name": "bigipafm", + "host.ip": "10.177.238.45", + "host.name": "orisni5238.mail.lan", + "input.type": "log", + "log.level": "very-high", + "log.offset": 24529, + "network.protocol": "ggp", + "observer.product": "ueipsa", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1453", + "related.ip": [ + "10.177.238.45", + "10.251.231.142", + "10.110.2.166", + "10.18.226.72" + ], + "related.user": [ + "taliqui" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "iumt", + "rsa.misc.event_type": "leumiur", + "rsa.misc.obj_name": "duntutla", + "rsa.misc.policy_name": "ntium", + "rsa.misc.reference_id": "tatnon", + "rsa.misc.rule_name": "umwritte", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1453", + "rsa.network.alias_host": [ + "orisni5238.mail.lan" + ], + "rsa.network.vlan": 102, + "rsa.time.event_time_str": "Mar", + "rule.name": "umwritte", + "service.type": "f5", + "source.geo.country_name": "exeacomm", + "source.ip": [ + "10.110.2.166" + ], + "source.nat.ip": "10.251.231.142", + "source.nat.port": 872, + "source.port": 79, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "taliqui" + }, + { + "destination.geo.country_name": "billo", + "destination.nat.ip": "10.100.199.226", + "destination.nat.port": 7617, + "destination.port": 2618, + "event.action": "Established", + "event.code": "ser", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "suntex iacons occaec7487.corp quaeab fici imve [F5@quide acl_policy_name=quaU acl_policy_type=undeomni acl_rule_name=accusa action=Established hostname=iutali7297.www.domain bigip_mgmt_ip=10.190.122.27 context_name=mporainc context_type=xea date_time=Mar 18 2017 18:24:33 dest_ip=10.123.113.152 dst_geo=billo dest_port=2618 device_product=radipisc device_vendor=Cice device_version=1.6332 drop_reason=vitaed errdefs_msgno=ser errdefs_msg_name=etconsec flow_id=elillum ip_protocol=tcp severity=high partition_name=rnat route_domain=eprehend sa_translation_pool=rem sa_translation_type=edolo source_ip=10.99.202.229 src_geo=eosquira source_port=4392 source_user=lloinven translated_dest_ip=10.100.199.226 translated_dest_port=7617 translated_ip_protocol=apariatu translated_route_domain=lorsita translated_source_ip=10.192.98.247 translated_source_port=4308 translated_vlan=temaccu vlan=5302", + "fileset.name": "bigipafm", + "host.ip": "10.190.122.27", + "host.name": "iutali7297.www.domain", + "input.type": "log", + "log.level": "high", + "log.offset": 25415, + "network.protocol": "tcp", + "observer.product": "radipisc", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6332", + "related.ip": [ + "10.99.202.229", + "10.100.199.226", + "10.190.122.27", + "10.192.98.247" + ], + "related.user": [ + "lloinven" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "mporainc", + "rsa.misc.event_type": "etconsec", + "rsa.misc.obj_name": "quide", + "rsa.misc.policy_name": "quaU", + "rsa.misc.reference_id": "ser", + "rsa.misc.rule_name": "accusa", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.6332", + "rsa.network.alias_host": [ + "iutali7297.www.domain" + ], + "rsa.network.vlan": 5302, + "rsa.time.event_time_str": "Mar", + "rule.name": "accusa", + "service.type": "f5", + "source.geo.country_name": "eosquira", + "source.ip": [ + "10.99.202.229" + ], + "source.nat.ip": "10.192.98.247", + "source.nat.port": 4308, + "source.port": 4392, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "lloinven" + }, + { + "destination.geo.country_name": "nrepreh", + "destination.nat.ip": "10.162.97.197", + "destination.nat.port": 4357, + "destination.port": 5251, + "event.action": "Drop", + "event.code": "erspi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uptassit ncidi tlabori4803.www5.local oconse mag tob [F5@dolores acl_policy_name=equamnih acl_policy_type=taliqui acl_rule_name=eiu action=Drop hostname=orumw5960.www5.home bigip_mgmt_ip=10.248.111.207 context_name=dolor context_type=tiumto date_time=Apr 02 2017 01:27:07 dest_ip=10.38.28.151 dst_geo=nrepreh dest_port=5251 device_product=equep device_vendor=ever device_version=1.6463 drop_reason=atq errdefs_msgno=erspi errdefs_msg_name=iqu flow_id=niamqu ip_protocol=rdp severity=medium partition_name=icab route_domain=sBonor sa_translation_pool=fugits sa_translation_type=mipsumqu source_ip=10.172.154.97 src_geo=admi source_port=7165 source_user=culpaq translated_dest_ip=10.162.97.197 translated_dest_port=4357 translated_ip_protocol=tcupida translated_route_domain=isa translated_source_ip=10.37.193.70 translated_source_port=170 translated_vlan=tesseq vlan=7693", + "fileset.name": "bigipafm", + "host.ip": "10.248.111.207", + "host.name": "orumw5960.www5.home", + "input.type": "log", + "log.level": "medium", + "log.offset": 26305, + "network.protocol": "rdp", + "observer.product": "equep", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6463", + "related.ip": [ + "10.248.111.207", + "10.172.154.97", + "10.37.193.70", + "10.162.97.197" + ], + "related.user": [ + "culpaq" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "dolor", + "rsa.misc.event_type": "iqu", + "rsa.misc.obj_name": "dolores", + "rsa.misc.policy_name": "equamnih", + "rsa.misc.reference_id": "erspi", + "rsa.misc.rule_name": "eiu", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6463", + "rsa.network.alias_host": [ + "orumw5960.www5.home" + ], + "rsa.network.vlan": 7693, + "rsa.time.event_time_str": "Apr", + "rule.name": "eiu", + "service.type": "f5", + "source.geo.country_name": "admi", + "source.ip": [ + "10.172.154.97" + ], + "source.nat.ip": "10.37.193.70", + "source.nat.port": 170, + "source.port": 7165, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "culpaq" + }, + { + "destination.geo.country_name": "itasp", + "destination.nat.ip": "10.222.165.250", + "destination.nat.port": 2757, + "destination.port": 4927, + "event.action": "Reject", + "event.code": "loreeu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "pernat rerepre nculpaq3821.www5.invalid billoinv sci col [F5@obea acl_policy_name=emp acl_policy_type=agnaaliq acl_rule_name=est action=Reject hostname=oinv5493.internal.domain bigip_mgmt_ip=10.36.63.31 context_name=nisiu context_type=imad date_time=Apr 16 2017 08:29:41 dest_ip=10.30.101.79 dst_geo=itasp dest_port=4927 device_product=sitametc device_vendor=onsequa device_version=1.3912 drop_reason=ntmo errdefs_msgno=loreeu errdefs_msg_name=temse flow_id=aspernat ip_protocol=ipv6 severity=very-high partition_name=caecat route_domain=rautod sa_translation_pool=olest sa_translation_type=eataev source_ip=10.171.221.230 src_geo=edquia source_port=1977 source_user=otamr translated_dest_ip=10.222.165.250 translated_dest_port=2757 translated_ip_protocol=amvolu translated_route_domain=mip translated_source_ip=10.45.35.180 translated_source_port=653 translated_vlan=maccusa vlan=7248", + "fileset.name": "bigipafm", + "host.ip": "10.36.63.31", + "host.name": "oinv5493.internal.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 27176, + "network.protocol": "ipv6", + "observer.product": "sitametc", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3912", + "related.ip": [ + "10.171.221.230", + "10.222.165.250", + "10.36.63.31", + "10.45.35.180" + ], + "related.user": [ + "otamr" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "nisiu", + "rsa.misc.event_type": "temse", + "rsa.misc.obj_name": "obea", + "rsa.misc.policy_name": "emp", + "rsa.misc.reference_id": "loreeu", + "rsa.misc.rule_name": "est", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3912", + "rsa.network.alias_host": [ + "oinv5493.internal.domain" + ], + "rsa.network.vlan": 7248, + "rsa.time.event_time_str": "Apr", + "rule.name": "est", + "service.type": "f5", + "source.geo.country_name": "edquia", + "source.ip": [ + "10.171.221.230" + ], + "source.nat.ip": "10.45.35.180", + "source.nat.port": 653, + "source.port": 1977, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "otamr" + }, + { + "destination.geo.country_name": "meumfugi", + "destination.nat.ip": "10.199.127.211", + "destination.nat.port": 3598, + "destination.port": 7010, + "event.action": "Reject", + "event.code": "orroquis", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "nimad ataevita oremqu542.internal.localhost uteir boree isn [F5@ulla acl_policy_name=equatDu acl_policy_type=pta acl_rule_name=enbyCi action=Reject hostname=tnonproi195.api.home bigip_mgmt_ip=10.238.4.219 context_name=uide context_type=scivel date_time=Apr 30 2017 15:32:16 dest_ip=10.150.9.246 dst_geo=meumfugi dest_port=7010 device_product=emaperia device_vendor=Section device_version=1.4329 drop_reason=iame errdefs_msgno=orroquis errdefs_msg_name=aquio flow_id=riatu ip_protocol=udp severity=low partition_name=tanimid route_domain=isnostru sa_translation_pool=nofdeFi sa_translation_type=aquioff source_ip=10.1.171.61 src_geo=amnisi source_port=7258 source_user=reetdolo translated_dest_ip=10.199.127.211 translated_dest_port=3598 translated_ip_protocol=ilmole translated_route_domain=ugi translated_source_ip=10.83.238.145 translated_source_port=5392 translated_vlan=emveleum vlan=3661", + "fileset.name": "bigipafm", + "host.ip": "10.238.4.219", + "host.name": "tnonproi195.api.home", + "input.type": "log", + "log.level": "low", + "log.offset": 28062, + "network.protocol": "udp", + "observer.product": "emaperia", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4329", + "related.ip": [ + "10.238.4.219", + "10.83.238.145", + "10.199.127.211", + "10.1.171.61" + ], + "related.user": [ + "reetdolo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "uide", + "rsa.misc.event_type": "aquio", + "rsa.misc.obj_name": "ulla", + "rsa.misc.policy_name": "equatDu", + "rsa.misc.reference_id": "orroquis", + "rsa.misc.rule_name": "enbyCi", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4329", + "rsa.network.alias_host": [ + "tnonproi195.api.home" + ], + "rsa.network.vlan": 3661, + "rsa.time.event_time_str": "Apr", + "rule.name": "enbyCi", + "service.type": "f5", + "source.geo.country_name": "amnisi", + "source.ip": [ + "10.1.171.61" + ], + "source.nat.ip": "10.83.238.145", + "source.nat.port": 5392, + "source.port": 7258, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "reetdolo" + }, + { + "destination.geo.country_name": "quira", + "destination.nat.ip": "10.44.226.104", + "destination.nat.port": 7020, + "destination.port": 3091, + "event.action": "Drop", + "event.code": "tperspic", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "nde abillo undeom845.www5.example quaer eetdo tlab [F5@spernatu acl_policy_name=exercita acl_policy_type=sBonorum acl_rule_name=atems action=Drop hostname=edictasu5362.internal.localhost bigip_mgmt_ip=10.65.141.244 context_name=turmag context_type=ipsaqu date_time=May 14 2017 22:34:50 dest_ip=10.203.69.36 dst_geo=quira dest_port=3091 device_product=ore device_vendor=tation device_version=1.3789 drop_reason=porincid errdefs_msgno=tperspic errdefs_msg_name=equu flow_id=sintoc ip_protocol=rdp severity=very-high partition_name=tetura route_domain=riosamni sa_translation_pool=icta sa_translation_type=luptate source_ip=10.170.252.219 src_geo=iqui source_port=1978 source_user=Nequepo translated_dest_ip=10.44.226.104 translated_dest_port=7020 translated_ip_protocol=nse translated_route_domain=veniam translated_source_ip=10.74.213.42 translated_source_port=5922 translated_vlan=sse vlan=2498", + "fileset.name": "bigipafm", + "host.ip": "10.65.141.244", + "host.name": "edictasu5362.internal.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 28955, + "network.protocol": "rdp", + "observer.product": "ore", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3789", + "related.ip": [ + "10.170.252.219", + "10.74.213.42", + "10.44.226.104", + "10.65.141.244" + ], + "related.user": [ + "Nequepo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "turmag", + "rsa.misc.event_type": "equu", + "rsa.misc.obj_name": "spernatu", + "rsa.misc.policy_name": "exercita", + "rsa.misc.reference_id": "tperspic", + "rsa.misc.rule_name": "atems", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3789", + "rsa.network.alias_host": [ + "edictasu5362.internal.localhost" + ], + "rsa.network.vlan": 2498, + "rsa.time.event_time_str": "May", + "rule.name": "atems", + "service.type": "f5", + "source.geo.country_name": "iqui", + "source.ip": [ + "10.170.252.219" + ], + "source.nat.ip": "10.74.213.42", + "source.nat.port": 5922, + "source.port": 1978, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "Nequepo" + }, + { + "destination.geo.country_name": "sequat", + "destination.nat.ip": "10.225.255.211", + "destination.nat.port": 5595, + "destination.port": 4596, + "event.action": "Reject", + "event.code": "roi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "inBCSe otamrem tutlabor4180.internal.host consecte pteurs catcupi [F5@autf acl_policy_name=saqu acl_policy_type=uptat acl_rule_name=unt action=Reject hostname=uido492.www5.home bigip_mgmt_ip=10.180.48.221 context_name=lors context_type=aconsequ date_time=May 29 2017 05:37:24 dest_ip=10.33.195.166 dst_geo=sequat dest_port=4596 device_product=utemvel device_vendor=epteur device_version=1.2965 drop_reason=iusm errdefs_msgno=roi errdefs_msg_name=busBonor flow_id=stquido ip_protocol=igmp severity=high partition_name=mnisi route_domain=usmo sa_translation_pool=iamea sa_translation_type=imaveni source_ip=10.183.223.149 src_geo=cor source_port=2648 source_user=nihil translated_dest_ip=10.225.255.211 translated_dest_port=5595 translated_ip_protocol=citati translated_route_domain=uamei translated_source_ip=10.225.141.172 translated_source_port=956 translated_vlan=fugiatn vlan=3309", + "fileset.name": "bigipafm", + "host.ip": "10.180.48.221", + "host.name": "uido492.www5.home", + "input.type": "log", + "log.level": "high", + "log.offset": 29850, + "network.protocol": "igmp", + "observer.product": "utemvel", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2965", + "related.ip": [ + "10.180.48.221", + "10.225.141.172", + "10.183.223.149", + "10.225.255.211" + ], + "related.user": [ + "nihil" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "lors", + "rsa.misc.event_type": "busBonor", + "rsa.misc.obj_name": "autf", + "rsa.misc.policy_name": "saqu", + "rsa.misc.reference_id": "roi", + "rsa.misc.rule_name": "unt", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2965", + "rsa.network.alias_host": [ + "uido492.www5.home" + ], + "rsa.network.vlan": 3309, + "rsa.time.event_time_str": "May", + "rule.name": "unt", + "service.type": "f5", + "source.geo.country_name": "cor", + "source.ip": [ + "10.183.223.149" + ], + "source.nat.ip": "10.225.141.172", + "source.nat.port": 956, + "source.port": 2648, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "nihil" + }, + { + "destination.geo.country_name": "mcorpor", + "destination.nat.ip": "10.205.174.181", + "destination.nat.port": 766, + "destination.port": 7420, + "event.action": "Established", + "event.code": "tura", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "aaliq nat uovolupt307.internal.host serror onse umquam [F5@emagn acl_policy_name=emulla acl_policy_type=mips acl_rule_name=itae action=Established hostname=redo6311.api.invalid bigip_mgmt_ip=10.176.64.28 context_name=olup context_type=remipsu date_time=Jun 12 2017 12:39:58 dest_ip=10.92.6.176 dst_geo=mcorpor dest_port=7420 device_product=autfugit device_vendor=emUte device_version=1.7612 drop_reason=nturmag errdefs_msgno=tura errdefs_msg_name=osquirat flow_id=equat ip_protocol=tcp severity=high partition_name=usantiu route_domain=idunt sa_translation_pool=atqu sa_translation_type=naturau source_ip=10.97.138.181 src_geo=oluptat source_port=7128 source_user=eseruntm translated_dest_ip=10.205.174.181 translated_dest_port=766 translated_ip_protocol=olor translated_route_domain=etquasia translated_source_ip=10.169.123.103 translated_source_port=519 translated_vlan=uisa vlan=6863", + "fileset.name": "bigipafm", + "host.ip": "10.176.64.28", + "host.name": "redo6311.api.invalid", + "input.type": "log", + "log.level": "high", + "log.offset": 30734, + "network.protocol": "tcp", + "observer.product": "autfugit", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7612", + "related.ip": [ + "10.176.64.28", + "10.97.138.181", + "10.169.123.103", + "10.205.174.181" + ], + "related.user": [ + "eseruntm" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "olup", + "rsa.misc.event_type": "osquirat", + "rsa.misc.obj_name": "emagn", + "rsa.misc.policy_name": "emulla", + "rsa.misc.reference_id": "tura", + "rsa.misc.rule_name": "itae", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.7612", + "rsa.network.alias_host": [ + "redo6311.api.invalid" + ], + "rsa.network.vlan": 6863, + "rsa.time.event_time_str": "Jun", + "rule.name": "itae", + "service.type": "f5", + "source.geo.country_name": "oluptat", + "source.ip": [ + "10.97.138.181" + ], + "source.nat.ip": "10.169.123.103", + "source.nat.port": 519, + "source.port": 7128, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "eseruntm" + }, + { + "destination.geo.country_name": "laborum", + "destination.nat.ip": "10.204.4.40", + "destination.nat.port": 271, + "destination.port": 5749, + "event.action": "Established", + "event.code": "empor", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "Cicero evolupta teturadi4718.api.local piscivel hend eacommo [F5@ueip acl_policy_name=maliqu acl_policy_type=iati acl_rule_name=minim action=Established hostname=dolorem1698.www.domain bigip_mgmt_ip=10.75.120.11 context_name=urau context_type=etur date_time=Jun 26 2017 19:42:33 dest_ip=10.20.73.247 dst_geo=laborum dest_port=5749 device_product=xeac device_vendor=umdolors device_version=1.4226 drop_reason=uiadolo errdefs_msgno=empor errdefs_msg_name=umexerci flow_id=duntut ip_protocol=ggp severity=very-high partition_name=prehend route_domain=eufug sa_translation_pool=roquisq sa_translation_type=temporai source_ip=10.53.101.131 src_geo=ici source_port=5097 source_user=tquo translated_dest_ip=10.204.4.40 translated_dest_port=271 translated_ip_protocol=sitvo translated_route_domain=ine translated_source_ip=10.169.101.161 translated_source_port=4577 translated_vlan=ipi vlan=4211", + "fileset.name": "bigipafm", + "host.ip": "10.75.120.11", + "host.name": "dolorem1698.www.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 31621, + "network.protocol": "ggp", + "observer.product": "xeac", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4226", + "related.ip": [ + "10.75.120.11", + "10.53.101.131", + "10.204.4.40", + "10.169.101.161" + ], + "related.user": [ + "tquo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "urau", + "rsa.misc.event_type": "umexerci", + "rsa.misc.obj_name": "ueip", + "rsa.misc.policy_name": "maliqu", + "rsa.misc.reference_id": "empor", + "rsa.misc.rule_name": "minim", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4226", + "rsa.network.alias_host": [ + "dolorem1698.www.domain" + ], + "rsa.network.vlan": 4211, + "rsa.time.event_time_str": "Jun", + "rule.name": "minim", + "service.type": "f5", + "source.geo.country_name": "ici", + "source.ip": [ + "10.53.101.131" + ], + "source.nat.ip": "10.169.101.161", + "source.nat.port": 4577, + "source.port": 5097, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tquo" + }, + { + "destination.geo.country_name": "litanim", + "destination.nat.ip": "10.156.117.169", + "destination.nat.port": 2939, + "destination.port": 2135, + "event.action": "Reject", + "event.code": "porinc", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "exerci idata ese4384.mail.domain rumexerc isiutali iquidexe [F5@illumq acl_policy_name=luptatem acl_policy_type=ite acl_rule_name=tasnul action=Reject hostname=evitae7333.www.lan bigip_mgmt_ip=10.28.51.219 context_name=ess context_type=quiad date_time=Jul 11 2017 02:45:07 dest_ip=10.43.210.236 dst_geo=litanim dest_port=2135 device_product=orsitam device_vendor=modico device_version=1.2990 drop_reason=itatio errdefs_msgno=porinc errdefs_msg_name=riame flow_id=riat ip_protocol=udp severity=very-high partition_name=eriam route_domain=pernat sa_translation_pool=udan sa_translation_type=archi source_ip=10.6.222.112 src_geo=aliqu source_port=780 source_user=onsequu translated_dest_ip=10.156.117.169 translated_dest_port=2939 translated_ip_protocol=agnamal translated_route_domain=quei translated_source_ip=10.87.120.87 translated_source_port=1636 translated_vlan=teni vlan=4967", + "fileset.name": "bigipafm", + "host.ip": "10.28.51.219", + "host.name": "evitae7333.www.lan", + "input.type": "log", + "log.level": "very-high", + "log.offset": 32509, + "network.protocol": "udp", + "observer.product": "orsitam", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2990", + "related.ip": [ + "10.156.117.169", + "10.6.222.112", + "10.87.120.87", + "10.28.51.219" + ], + "related.user": [ + "onsequu" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ess", + "rsa.misc.event_type": "riame", + "rsa.misc.obj_name": "illumq", + "rsa.misc.policy_name": "luptatem", + "rsa.misc.reference_id": "porinc", + "rsa.misc.rule_name": "tasnul", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2990", + "rsa.network.alias_host": [ + "evitae7333.www.lan" + ], + "rsa.network.vlan": 4967, + "rsa.time.event_time_str": "Jul", + "rule.name": "tasnul", + "service.type": "f5", + "source.geo.country_name": "aliqu", + "source.ip": [ + "10.6.222.112" + ], + "source.nat.ip": "10.87.120.87", + "source.nat.port": 1636, + "source.port": 780, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "onsequu" + }, + { + "destination.geo.country_name": "ecill", + "destination.nat.ip": "10.253.167.17", + "destination.nat.port": 2990, + "destination.port": 6831, + "event.action": "Drop", + "event.code": "oco", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "dant etdolor uat7787.www.host iti nimadm nculp [F5@asp acl_policy_name=eacom acl_policy_type=mag acl_rule_name=gelitse action=Drop hostname=arc2412.mail.lan bigip_mgmt_ip=10.247.44.59 context_name=eiusmo context_type=ainc date_time=Jul 25 2017 09:47:41 dest_ip=10.173.129.72 dst_geo=ecill dest_port=6831 device_product=snu device_vendor=inibusB device_version=1.388 drop_reason=texplica errdefs_msgno=oco errdefs_msg_name=aboree flow_id=ainci ip_protocol=udp severity=high partition_name=pariatur route_domain=uames sa_translation_pool=umtotamr sa_translation_type=mquido source_ip=10.57.89.155 src_geo=rur source_port=3553 source_user=ntorever translated_dest_ip=10.253.167.17 translated_dest_port=2990 translated_ip_protocol=seos translated_route_domain=exercita translated_source_ip=10.4.126.103 translated_source_port=892 translated_vlan=tco vlan=3607", + "fileset.name": "bigipafm", + "host.ip": "10.247.44.59", + "host.name": "arc2412.mail.lan", + "input.type": "log", + "log.level": "high", + "log.offset": 33390, + "network.protocol": "udp", + "observer.product": "snu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.388", + "related.ip": [ + "10.4.126.103", + "10.253.167.17", + "10.247.44.59", + "10.57.89.155" + ], + "related.user": [ + "ntorever" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "eiusmo", + "rsa.misc.event_type": "aboree", + "rsa.misc.obj_name": "asp", + "rsa.misc.policy_name": "eacom", + "rsa.misc.reference_id": "oco", + "rsa.misc.rule_name": "gelitse", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.388", + "rsa.network.alias_host": [ + "arc2412.mail.lan" + ], + "rsa.network.vlan": 3607, + "rsa.time.event_time_str": "Jul", + "rule.name": "gelitse", + "service.type": "f5", + "source.geo.country_name": "rur", + "source.ip": [ + "10.57.89.155" + ], + "source.nat.ip": "10.4.126.103", + "source.nat.port": 892, + "source.port": 3553, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ntorever" + }, + { + "destination.geo.country_name": "xeac", + "destination.nat.ip": "10.36.69.125", + "destination.nat.port": 7157, + "destination.port": 7061, + "event.action": "Established", + "event.code": "tat", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "oluptate lit santi837.api.domain turadip dip idolo [F5@Ute acl_policy_name=ptassita acl_policy_type=caecatcu acl_rule_name=inBC action=Established hostname=olorsi2746.internal.localhost bigip_mgmt_ip=10.15.240.220 context_name=teir context_type=quep date_time=Aug 08 2017 16:50:15 dest_ip=10.63.78.66 dst_geo=xeac dest_port=7061 device_product=abor device_vendor=oreverit device_version=1.6451 drop_reason=reetdo errdefs_msgno=tat errdefs_msg_name=eufugia flow_id=ncididun ip_protocol=tcp severity=medium partition_name=periamea route_domain=itametco sa_translation_pool=vel sa_translation_type=quunt source_ip=10.248.206.210 src_geo=nonn source_port=4478 source_user=met translated_dest_ip=10.36.69.125 translated_dest_port=7157 translated_ip_protocol=entsu translated_route_domain=conse translated_source_ip=10.143.183.208 translated_source_port=5214 translated_vlan=umwri vlan=4057", + "fileset.name": "bigipafm", + "host.ip": "10.15.240.220", + "host.name": "olorsi2746.internal.localhost", + "input.type": "log", + "log.level": "medium", + "log.offset": 34246, + "network.protocol": "tcp", + "observer.product": "abor", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6451", + "related.ip": [ + "10.15.240.220", + "10.36.69.125", + "10.143.183.208", + "10.248.206.210" + ], + "related.user": [ + "met" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "teir", + "rsa.misc.event_type": "eufugia", + "rsa.misc.obj_name": "Ute", + "rsa.misc.policy_name": "ptassita", + "rsa.misc.reference_id": "tat", + "rsa.misc.rule_name": "inBC", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6451", + "rsa.network.alias_host": [ + "olorsi2746.internal.localhost" + ], + "rsa.network.vlan": 4057, + "rsa.time.event_time_str": "Aug", + "rule.name": "inBC", + "service.type": "f5", + "source.geo.country_name": "nonn", + "source.ip": [ + "10.248.206.210" + ], + "source.nat.ip": "10.143.183.208", + "source.nat.port": 5214, + "source.port": 4478, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "met" + }, + { + "destination.geo.country_name": "emu", + "destination.nat.ip": "10.34.133.2", + "destination.nat.port": 4807, + "destination.port": 5311, + "event.action": "Established", + "event.code": "minimve", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "atura tur tur5914.internal.invalid tassita colabori imidestl [F5@piscing acl_policy_name=ceroi acl_policy_type=iconsequ acl_rule_name=iat action=Established hostname=edqu2208.www.localhost bigip_mgmt_ip=10.6.32.7 context_name=exerci context_type=inesciu date_time=Aug 22 2017 23:52:50 dest_ip=10.141.216.14 dst_geo=emu dest_port=5311 device_product=psa device_vendor=ate device_version=1.4386 drop_reason=fugitse errdefs_msgno=minimve errdefs_msg_name=serrorsi flow_id=tametco ip_protocol=ipv6-icmp severity=high partition_name=lore route_domain=isci sa_translation_pool=Dui sa_translation_type=reetdo source_ip=10.69.170.107 src_geo=iumtotam source_port=1010 source_user=ipitlabo translated_dest_ip=10.34.133.2 translated_dest_port=4807 translated_ip_protocol=nderi translated_route_domain=liqua translated_source_ip=10.142.186.43 translated_source_port=4691 translated_vlan=sautei vlan=2363", + "fileset.name": "bigipafm", + "host.ip": "10.6.32.7", + "host.name": "edqu2208.www.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 35131, + "network.protocol": "ipv6-icmp", + "observer.product": "psa", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4386", + "related.ip": [ + "10.69.170.107", + "10.6.32.7", + "10.142.186.43", + "10.34.133.2" + ], + "related.user": [ + "ipitlabo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "exerci", + "rsa.misc.event_type": "serrorsi", + "rsa.misc.obj_name": "piscing", + "rsa.misc.policy_name": "ceroi", + "rsa.misc.reference_id": "minimve", + "rsa.misc.rule_name": "iat", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.4386", + "rsa.network.alias_host": [ + "edqu2208.www.localhost" + ], + "rsa.network.vlan": 2363, + "rsa.time.event_time_str": "Aug", + "rule.name": "iat", + "service.type": "f5", + "source.geo.country_name": "iumtotam", + "source.ip": [ + "10.69.170.107" + ], + "source.nat.ip": "10.142.186.43", + "source.nat.port": 4691, + "source.port": 1010, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ipitlabo" + }, + { + "destination.geo.country_name": "rchitect", + "destination.nat.ip": "10.59.103.10", + "destination.nat.port": 768, + "destination.port": 3402, + "event.action": "Closed", + "event.code": "iameaque", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "voluptas velill rspic5453.www.local meum borumSec aecatcup [F5@snisiut acl_policy_name=siar acl_policy_type=quas acl_rule_name=occaeca action=Closed hostname=ender5647.www5.example bigip_mgmt_ip=10.142.22.24 context_name=ulamc context_type=cept date_time=Sep 06 2017 06:55:24 dest_ip=10.93.88.228 dst_geo=rchitect dest_port=3402 device_product=gna device_vendor=ici device_version=1.2026 drop_reason=olu errdefs_msgno=iameaque errdefs_msg_name=identsun flow_id=ender ip_protocol=ipv6 severity=low partition_name=tect route_domain=uiad sa_translation_pool=doconse sa_translation_type=eni source_ip=10.121.153.197 src_geo=smoditem source_port=6593 source_user=borumSec translated_dest_ip=10.59.103.10 translated_dest_port=768 translated_ip_protocol=oquisq translated_route_domain=abori translated_source_ip=10.170.165.164 translated_source_port=505 translated_vlan=uiineavo vlan=5554", + "fileset.name": "bigipafm", + "host.ip": "10.142.22.24", + "host.name": "ender5647.www5.example", + "input.type": "log", + "log.level": "low", + "log.offset": 36024, + "network.protocol": "ipv6", + "observer.product": "gna", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2026", + "related.ip": [ + "10.59.103.10", + "10.142.22.24", + "10.121.153.197", + "10.170.165.164" + ], + "related.user": [ + "borumSec" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ulamc", + "rsa.misc.event_type": "identsun", + "rsa.misc.obj_name": "snisiut", + "rsa.misc.policy_name": "siar", + "rsa.misc.reference_id": "iameaque", + "rsa.misc.rule_name": "occaeca", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2026", + "rsa.network.alias_host": [ + "ender5647.www5.example" + ], + "rsa.network.vlan": 5554, + "rsa.time.event_time_str": "Sep", + "rule.name": "occaeca", + "service.type": "f5", + "source.geo.country_name": "smoditem", + "source.ip": [ + "10.121.153.197" + ], + "source.nat.ip": "10.170.165.164", + "source.nat.port": 505, + "source.port": 6593, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "borumSec" + }, + { + "destination.geo.country_name": "eserun", + "destination.nat.ip": "10.19.99.129", + "destination.nat.port": 956, + "destination.port": 3034, + "event.action": "Established", + "event.code": "uta", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uidexeac sequa ntsunti2313.internal.invalid uinesc cid emi [F5@Bonorum acl_policy_name=lesti acl_policy_type=oreseo acl_rule_name=reprehen action=Established hostname=sis3986.internal.lan bigip_mgmt_ip=10.133.10.122 context_name=texplic context_type=edutp date_time=Sep 20 2017 13:57:58 dest_ip=10.93.59.189 dst_geo=eserun dest_port=3034 device_product=eniamqu device_vendor=inimav device_version=1.1576 drop_reason=imadm errdefs_msgno=uta errdefs_msg_name=tisu flow_id=remagnam ip_protocol=icmp severity=low partition_name=meiusm route_domain=nidolo sa_translation_pool=atquovol sa_translation_type=quunt source_ip=10.247.114.30 src_geo=olesti source_port=7584 source_user=quaeabil translated_dest_ip=10.19.99.129 translated_dest_port=956 translated_ip_protocol=itesse translated_route_domain=iamqui translated_source_ip=10.176.83.7 translated_source_port=5908 translated_vlan=inim vlan=6806", + "fileset.name": "bigipafm", + "host.ip": "10.133.10.122", + "host.name": "sis3986.internal.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 36906, + "network.protocol": "icmp", + "observer.product": "eniamqu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1576", + "related.ip": [ + "10.19.99.129", + "10.247.114.30", + "10.176.83.7", + "10.133.10.122" + ], + "related.user": [ + "quaeabil" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "texplic", + "rsa.misc.event_type": "tisu", + "rsa.misc.obj_name": "Bonorum", + "rsa.misc.policy_name": "lesti", + "rsa.misc.reference_id": "uta", + "rsa.misc.rule_name": "reprehen", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.1576", + "rsa.network.alias_host": [ + "sis3986.internal.lan" + ], + "rsa.network.vlan": 6806, + "rsa.time.event_time_str": "Sep", + "rule.name": "reprehen", + "service.type": "f5", + "source.geo.country_name": "olesti", + "source.ip": [ + "10.247.114.30" + ], + "source.nat.ip": "10.176.83.7", + "source.nat.port": 5908, + "source.port": 7584, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "quaeabil" + }, + { + "destination.geo.country_name": "conse", + "destination.nat.ip": "10.8.29.219", + "destination.nat.port": 6890, + "destination.port": 5351, + "event.action": "Drop", + "event.code": "sedquian", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "Sed oremeumf lesti5921.api.localhost enima tnulapar ico [F5@giatquo acl_policy_name=lors acl_policy_type=its acl_rule_name=dolor action=Drop hostname=uatu2894.api.lan bigip_mgmt_ip=10.64.139.17 context_name=pro context_type=ice date_time=Oct 04 2017 21:00:32 dest_ip=10.87.238.169 dst_geo=conse dest_port=5351 device_product=mcol device_vendor=lup device_version=1.3824 drop_reason=upta errdefs_msgno=sedquian errdefs_msg_name=cti flow_id=rumSecti ip_protocol=rdp severity=medium partition_name=eca route_domain=oluptate sa_translation_pool=Duisa sa_translation_type=consequa source_ip=10.40.177.138 src_geo=aevitaed source_port=1082 source_user=rep translated_dest_ip=10.8.29.219 translated_dest_port=6890 translated_ip_protocol=quaeratv translated_route_domain=involu translated_source_ip=10.70.7.23 translated_source_port=2758 translated_vlan=amcolab vlan=4306", + "fileset.name": "bigipafm", + "host.ip": "10.64.139.17", + "host.name": "uatu2894.api.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 37799, + "network.protocol": "rdp", + "observer.product": "mcol", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3824", + "related.ip": [ + "10.64.139.17", + "10.70.7.23", + "10.8.29.219", + "10.40.177.138" + ], + "related.user": [ + "rep" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "pro", + "rsa.misc.event_type": "cti", + "rsa.misc.obj_name": "giatquo", + "rsa.misc.policy_name": "lors", + "rsa.misc.reference_id": "sedquian", + "rsa.misc.rule_name": "dolor", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3824", + "rsa.network.alias_host": [ + "uatu2894.api.lan" + ], + "rsa.network.vlan": 4306, + "rsa.time.event_time_str": "Oct", + "rule.name": "dolor", + "service.type": "f5", + "source.geo.country_name": "aevitaed", + "source.ip": [ + "10.40.177.138" + ], + "source.nat.ip": "10.70.7.23", + "source.nat.port": 2758, + "source.port": 1082, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "rep" + }, + { + "destination.geo.country_name": "msequ", + "destination.nat.ip": "10.67.221.220", + "destination.nat.port": 239, + "destination.port": 2383, + "event.action": "Closed", + "event.code": "mini", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "odic iuta liquaUte209.internal.test olores scipit lloinve [F5@borisnis acl_policy_name=onorumet acl_policy_type=ptatema acl_rule_name=eavolup action=Closed hostname=rmagnido5483.local bigip_mgmt_ip=10.180.62.222 context_name=ptatev context_type=atu date_time=Oct 19 2017 04:03:07 dest_ip=10.234.26.132 dst_geo=msequ dest_port=2383 device_product=mwritten device_vendor=tat device_version=1.6066 drop_reason=osa errdefs_msgno=mini errdefs_msg_name=rors flow_id=ssusci ip_protocol=udp severity=medium partition_name=inimve route_domain=uio sa_translation_pool=mexercit sa_translation_type=byC source_ip=10.2.189.20 src_geo=orin source_port=535 source_user=uptasnul translated_dest_ip=10.67.221.220 translated_dest_port=239 translated_ip_protocol=aedict translated_route_domain=niamqui translated_source_ip=10.67.173.228 translated_source_port=5767 translated_vlan=tatemse vlan=4493", + "fileset.name": "bigipafm", + "host.ip": "10.180.62.222", + "host.name": "rmagnido5483.local", + "input.type": "log", + "log.level": "medium", + "log.offset": 38663, + "network.protocol": "udp", + "observer.product": "mwritten", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6066", + "related.ip": [ + "10.2.189.20", + "10.67.173.228", + "10.67.221.220", + "10.180.62.222" + ], + "related.user": [ + "uptasnul" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ptatev", + "rsa.misc.event_type": "rors", + "rsa.misc.obj_name": "borisnis", + "rsa.misc.policy_name": "onorumet", + "rsa.misc.reference_id": "mini", + "rsa.misc.rule_name": "eavolup", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.6066", + "rsa.network.alias_host": [ + "rmagnido5483.local" + ], + "rsa.network.vlan": 4493, + "rsa.time.event_time_str": "Oct", + "rule.name": "eavolup", + "service.type": "f5", + "source.geo.country_name": "orin", + "source.ip": [ + "10.2.189.20" + ], + "source.nat.ip": "10.67.173.228", + "source.nat.port": 5767, + "source.port": 535, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "uptasnul" + }, + { + "destination.geo.country_name": "upt", + "destination.nat.ip": "10.56.134.118", + "destination.nat.port": 358, + "destination.port": 6017, + "event.action": "Reject", + "event.code": "lorsi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uamestqu mpor orem6479.api.host seq rumSe tatnonp [F5@ommo acl_policy_name=adeser acl_policy_type=uasiarc acl_rule_name=doeiu action=Reject hostname=uian521.www.example bigip_mgmt_ip=10.209.52.47 context_name=imven context_type=onnumqua date_time=Nov 02 2017 11:05:41 dest_ip=10.141.201.173 dst_geo=upt dest_port=6017 device_product=itautfu device_vendor=nesci device_version=1.5040 drop_reason=mquis errdefs_msgno=lorsi errdefs_msg_name=tetura flow_id=eeufug ip_protocol=ipv6 severity=medium partition_name=tevelite route_domain=tocca sa_translation_pool=orsitvol sa_translation_type=ntor source_ip=10.147.127.181 src_geo=minimav source_port=6994 source_user=tasu translated_dest_ip=10.56.134.118 translated_dest_port=358 translated_ip_protocol=evo translated_route_domain=mcorpori translated_source_ip=10.196.176.243 translated_source_port=3465 translated_vlan=orsitam vlan=4991", + "fileset.name": "bigipafm", + "host.ip": "10.209.52.47", + "host.name": "uian521.www.example", + "input.type": "log", + "log.level": "medium", + "log.offset": 39543, + "network.protocol": "ipv6", + "observer.product": "itautfu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5040", + "related.ip": [ + "10.147.127.181", + "10.209.52.47", + "10.56.134.118", + "10.196.176.243" + ], + "related.user": [ + "tasu" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "imven", + "rsa.misc.event_type": "tetura", + "rsa.misc.obj_name": "ommo", + "rsa.misc.policy_name": "adeser", + "rsa.misc.reference_id": "lorsi", + "rsa.misc.rule_name": "doeiu", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5040", + "rsa.network.alias_host": [ + "uian521.www.example" + ], + "rsa.network.vlan": 4991, + "rsa.time.event_time_str": "Nov", + "rule.name": "doeiu", + "service.type": "f5", + "source.geo.country_name": "minimav", + "source.ip": [ + "10.147.127.181" + ], + "source.nat.ip": "10.196.176.243", + "source.nat.port": 3465, + "source.port": 6994, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tasu" + }, + { + "destination.geo.country_name": "aut", + "destination.nat.ip": "10.85.13.237", + "destination.nat.port": 4072, + "destination.port": 5596, + "event.action": "Closed", + "event.code": "laboree", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "prehende lup tpers2217.internal.lan nula tdolorem qui [F5@olupt acl_policy_name=nemulla acl_policy_type=asp acl_rule_name=dexercit action=Closed hostname=taliq5213.api.corp bigip_mgmt_ip=10.226.24.84 context_name=ectobea context_type=dat date_time=Nov 16 2017 18:08:15 dest_ip=10.91.18.221 dst_geo=aut dest_port=5596 device_product=uames device_vendor=tconsec device_version=1.7604 drop_reason=oll errdefs_msgno=laboree errdefs_msg_name=udantiu flow_id=itametco ip_protocol=ipv6 severity=very-high partition_name=odico route_domain=rsint sa_translation_pool=itl sa_translation_type=ttenb source_ip=10.231.18.90 src_geo=lapa source_port=4860 source_user=Nem translated_dest_ip=10.85.13.237 translated_dest_port=4072 translated_ip_protocol=upidata translated_route_domain=ici translated_source_ip=10.248.140.59 translated_source_port=5760 translated_vlan=ident vlan=4293", + "fileset.name": "bigipafm", + "host.ip": "10.226.24.84", + "host.name": "taliq5213.api.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 40424, + "network.protocol": "ipv6", + "observer.product": "uames", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7604", + "related.ip": [ + "10.231.18.90", + "10.248.140.59", + "10.226.24.84", + "10.85.13.237" + ], + "related.user": [ + "Nem" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ectobea", + "rsa.misc.event_type": "udantiu", + "rsa.misc.obj_name": "olupt", + "rsa.misc.policy_name": "nemulla", + "rsa.misc.reference_id": "laboree", + "rsa.misc.rule_name": "dexercit", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.7604", + "rsa.network.alias_host": [ + "taliq5213.api.corp" + ], + "rsa.network.vlan": 4293, + "rsa.time.event_time_str": "Nov", + "rule.name": "dexercit", + "service.type": "f5", + "source.geo.country_name": "lapa", + "source.ip": [ + "10.231.18.90" + ], + "source.nat.ip": "10.248.140.59", + "source.nat.port": 5760, + "source.port": 4860, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "Nem" + }, + { + "destination.geo.country_name": "mco", + "destination.nat.ip": "10.8.224.72", + "destination.nat.port": 6506, + "destination.port": 6246, + "event.action": "Accept", + "event.code": "nostrum", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "quelaud luptat rinrep6482.api.lan nimv emeu tatemac [F5@quisn acl_policy_name=rem acl_policy_type=ulamcola acl_rule_name=remagnaa action=Accept hostname=ntsunt4894.mail.domain bigip_mgmt_ip=10.203.46.215 context_name=mcorpori context_type=orisn date_time=Dec 01 2017 01:10:49 dest_ip=10.88.194.242 dst_geo=mco dest_port=6246 device_product=itame device_vendor=tenat device_version=1.5407 drop_reason=yCiceroi errdefs_msgno=nostrum errdefs_msg_name=orroquis flow_id=eumi ip_protocol=icmp severity=low partition_name=aea route_domain=tvolu sa_translation_pool=dutper sa_translation_type=tlaboru source_ip=10.207.183.204 src_geo=equuntu source_port=2673 source_user=eruntmo translated_dest_ip=10.8.224.72 translated_dest_port=6506 translated_ip_protocol=ion translated_route_domain=rured translated_source_ip=10.59.215.207 translated_source_port=6195 translated_vlan=ore vlan=5842", + "fileset.name": "bigipafm", + "host.ip": "10.203.46.215", + "host.name": "ntsunt4894.mail.domain", + "input.type": "log", + "log.level": "low", + "log.offset": 41293, + "network.protocol": "icmp", + "observer.product": "itame", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5407", + "related.ip": [ + "10.203.46.215", + "10.207.183.204", + "10.8.224.72", + "10.59.215.207" + ], + "related.user": [ + "eruntmo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "mcorpori", + "rsa.misc.event_type": "orroquis", + "rsa.misc.obj_name": "quisn", + "rsa.misc.policy_name": "rem", + "rsa.misc.reference_id": "nostrum", + "rsa.misc.rule_name": "remagnaa", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.5407", + "rsa.network.alias_host": [ + "ntsunt4894.mail.domain" + ], + "rsa.network.vlan": 5842, + "rsa.time.event_time_str": "Dec", + "rule.name": "remagnaa", + "service.type": "f5", + "source.geo.country_name": "equuntu", + "source.ip": [ + "10.207.183.204" + ], + "source.nat.ip": "10.59.215.207", + "source.nat.port": 6195, + "source.port": 2673, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "eruntmo" + }, + { + "destination.geo.country_name": "mquis", + "destination.nat.ip": "10.255.145.22", + "destination.nat.port": 6949, + "destination.port": 7760, + "event.action": "Drop", + "event.code": "aeco", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "xerc Nequep ametcon7485.www.test rro tuser ctasu [F5@irat acl_policy_name=sitame acl_policy_type=oinven acl_rule_name=natu action=Drop hostname=mexer3864.api.corp bigip_mgmt_ip=10.98.154.146 context_name=nula context_type=ameaquei date_time=Dec 15 2017 08:13:24 dest_ip=10.72.114.116 dst_geo=mquis dest_port=7760 device_product=olupta device_vendor=isno device_version=1.6814 drop_reason=ine errdefs_msgno=aeco errdefs_msg_name=rinrepr flow_id=dutp ip_protocol=ipv6-icmp severity=very-high partition_name=giatqu route_domain=rsint sa_translation_pool=rsi sa_translation_type=paq source_ip=10.73.84.95 src_geo=uisautem source_port=6701 source_user=sitam translated_dest_ip=10.255.145.22 translated_dest_port=6949 translated_ip_protocol=emUtenim translated_route_domain=ende translated_source_ip=10.230.38.148 translated_source_port=3213 translated_vlan=sse vlan=368", + "fileset.name": "bigipafm", + "host.ip": "10.98.154.146", + "host.name": "mexer3864.api.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 42171, + "network.protocol": "ipv6-icmp", + "observer.product": "olupta", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6814", + "related.ip": [ + "10.73.84.95", + "10.230.38.148", + "10.255.145.22", + "10.98.154.146" + ], + "related.user": [ + "sitam" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "nula", + "rsa.misc.event_type": "rinrepr", + "rsa.misc.obj_name": "irat", + "rsa.misc.policy_name": "sitame", + "rsa.misc.reference_id": "aeco", + "rsa.misc.rule_name": "natu", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6814", + "rsa.network.alias_host": [ + "mexer3864.api.corp" + ], + "rsa.network.vlan": 368, + "rsa.time.event_time_str": "Dec", + "rule.name": "natu", + "service.type": "f5", + "source.geo.country_name": "uisautem", + "source.ip": [ + "10.73.84.95" + ], + "source.nat.ip": "10.230.38.148", + "source.nat.port": 3213, + "source.port": 6701, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "sitam" + }, + { + "destination.geo.country_name": "eleumi", + "destination.nat.ip": "10.105.120.162", + "destination.nat.port": 2984, + "destination.port": 4584, + "event.action": "Accept", + "event.code": "uptateve", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "incidi aedictas rumetMa2554.domain unt liq abore [F5@iumdo acl_policy_name=oreeu acl_policy_type=mea acl_rule_name=ssec action=Accept hostname=oluptat6960.www5.test bigip_mgmt_ip=10.211.29.187 context_name=ptat context_type=meaquei date_time=Dec 29 2017 15:15:58 dest_ip=10.228.204.249 dst_geo=eleumi dest_port=4584 device_product=porissus device_vendor=imip device_version=1.7160 drop_reason=ddoe errdefs_msgno=uptateve errdefs_msg_name=ured flow_id=ctetu ip_protocol=tcp severity=low partition_name=uasiarch route_domain=Malor sa_translation_pool=boriosa sa_translation_type=cillumdo source_ip=10.166.142.198 src_geo=oremipsu source_port=465 source_user=tium translated_dest_ip=10.105.120.162 translated_dest_port=2984 translated_ip_protocol=etc translated_route_domain=eturadip translated_source_ip=10.175.181.138 translated_source_port=3787 translated_vlan=tassitas vlan=1495", + "fileset.name": "bigipafm", + "host.ip": "10.211.29.187", + "host.name": "oluptat6960.www5.test", + "input.type": "log", + "log.level": "low", + "log.offset": 43036, + "network.protocol": "tcp", + "observer.product": "porissus", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7160", + "related.ip": [ + "10.105.120.162", + "10.166.142.198", + "10.211.29.187", + "10.175.181.138" + ], + "related.user": [ + "tium" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "ptat", + "rsa.misc.event_type": "ured", + "rsa.misc.obj_name": "iumdo", + "rsa.misc.policy_name": "oreeu", + "rsa.misc.reference_id": "uptateve", + "rsa.misc.rule_name": "ssec", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7160", + "rsa.network.alias_host": [ + "oluptat6960.www5.test" + ], + "rsa.network.vlan": 1495, + "rsa.time.event_time_str": "Dec", + "rule.name": "ssec", + "service.type": "f5", + "source.geo.country_name": "oremipsu", + "source.ip": [ + "10.166.142.198" + ], + "source.nat.ip": "10.175.181.138", + "source.nat.port": 3787, + "source.port": 465, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tium" + }, + { + "destination.geo.country_name": "doconse", + "destination.nat.ip": "10.220.202.102", + "destination.nat.port": 10, + "destination.port": 5211, + "event.action": "Established", + "event.code": "animi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "velite maccus nima5813.mail.example iarchit sBonorum moenimi [F5@lor acl_policy_name=auto acl_policy_type=rsinto acl_rule_name=ati action=Established hostname=fugiatnu2498.www.localhost bigip_mgmt_ip=10.182.213.195 context_name=tconse context_type=eumf date_time=Jan 12 2018 22:18:32 dest_ip=10.200.94.145 dst_geo=doconse dest_port=5211 device_product=uis device_vendor=lill device_version=1.6057 drop_reason=imi errdefs_msgno=animi errdefs_msg_name=edutpers flow_id=pisci ip_protocol=tcp severity=very-high partition_name=umto route_domain=xercit sa_translation_pool=lam sa_translation_type=asnu source_ip=10.122.133.162 src_geo=eriam source_port=4838 source_user=aquae translated_dest_ip=10.220.202.102 translated_dest_port=10 translated_ip_protocol=iaturE translated_route_domain=epor translated_source_ip=10.195.139.25 translated_source_port=5566 translated_vlan=tper vlan=4341", + "fileset.name": "bigipafm", + "host.ip": "10.182.213.195", + "host.name": "fugiatnu2498.www.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 43916, + "network.protocol": "tcp", + "observer.product": "uis", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6057", + "related.ip": [ + "10.220.202.102", + "10.182.213.195", + "10.195.139.25", + "10.122.133.162" + ], + "related.user": [ + "aquae" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "tconse", + "rsa.misc.event_type": "edutpers", + "rsa.misc.obj_name": "lor", + "rsa.misc.policy_name": "auto", + "rsa.misc.reference_id": "animi", + "rsa.misc.rule_name": "ati", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6057", + "rsa.network.alias_host": [ + "fugiatnu2498.www.localhost" + ], + "rsa.network.vlan": 4341, + "rsa.time.event_time_str": "Jan", + "rule.name": "ati", + "service.type": "f5", + "source.geo.country_name": "eriam", + "source.ip": [ + "10.122.133.162" + ], + "source.nat.ip": "10.195.139.25", + "source.nat.port": 5566, + "source.port": 4838, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "aquae" + }, + { + "destination.geo.country_name": "uatD", + "destination.nat.ip": "10.33.143.163", + "destination.nat.port": 5404, + "destination.port": 6508, + "event.action": "Reject", + "event.code": "anim", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tconsect pariat iutal3376.api.corp isi idexeac ntu [F5@tdolo acl_policy_name=nimve acl_policy_type=duntut acl_rule_name=emporin action=Reject hostname=ptat3230.domain bigip_mgmt_ip=10.156.208.5 context_name=tlaboru context_type=tec date_time=Jan 27 2018 05:21:06 dest_ip=10.9.69.13 dst_geo=uatD dest_port=6508 device_product=antium device_vendor=remaper device_version=1.3297 drop_reason=ntNequ errdefs_msgno=anim errdefs_msg_name=uae flow_id=ata ip_protocol=tcp severity=very-high partition_name=paq route_domain=emipsumq sa_translation_pool=culpaq sa_translation_type=quamq source_ip=10.53.72.161 src_geo=pta source_port=4723 source_user=scip translated_dest_ip=10.33.143.163 translated_dest_port=5404 translated_ip_protocol=iusmodi translated_route_domain=esciun translated_source_ip=10.247.144.9 translated_source_port=2494 translated_vlan=lit vlan=4112", + "fileset.name": "bigipafm", + "host.ip": "10.156.208.5", + "host.name": "ptat3230.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 44798, + "network.protocol": "tcp", + "observer.product": "antium", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3297", + "related.ip": [ + "10.156.208.5", + "10.53.72.161", + "10.247.144.9", + "10.33.143.163" + ], + "related.user": [ + "scip" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "tlaboru", + "rsa.misc.event_type": "uae", + "rsa.misc.obj_name": "tdolo", + "rsa.misc.policy_name": "nimve", + "rsa.misc.reference_id": "anim", + "rsa.misc.rule_name": "emporin", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3297", + "rsa.network.alias_host": [ + "ptat3230.domain" + ], + "rsa.network.vlan": 4112, + "rsa.time.event_time_str": "Jan", + "rule.name": "emporin", + "service.type": "f5", + "source.geo.country_name": "pta", + "source.ip": [ + "10.53.72.161" + ], + "source.nat.ip": "10.247.144.9", + "source.nat.port": 2494, + "source.port": 4723, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "scip" + }, + { + "destination.geo.country_name": "eufugia", + "destination.nat.ip": "10.241.143.145", + "destination.nat.port": 6151, + "destination.port": 2345, + "event.action": "Closed", + "event.code": "unturmag", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "oidentsu oditau onsec1632.internal.lan lup aeca isau [F5@giat acl_policy_name=ttenb acl_policy_type=eirure acl_rule_name=boreetd action=Closed hostname=exer447.internal.localhost bigip_mgmt_ip=10.35.190.164 context_name=radipis context_type=lore date_time=Feb 10 2018 12:23:41 dest_ip=10.76.99.144 dst_geo=eufugia dest_port=2345 device_product=pariat device_vendor=nimip device_version=1.2476 drop_reason=usci errdefs_msgno=unturmag errdefs_msg_name=dexeaco flow_id=lupta ip_protocol=ggp severity=very-high partition_name=oreeufug route_domain=Quisa sa_translation_pool=quiav sa_translation_type=ctionofd source_ip=10.21.58.162 src_geo=uisautei source_port=7881 source_user=porin translated_dest_ip=10.241.143.145 translated_dest_port=6151 translated_ip_protocol=ecillum translated_route_domain=olor translated_source_ip=10.113.65.192 translated_source_port=7807 translated_vlan=conseq vlan=6079", + "fileset.name": "bigipafm", + "host.ip": "10.35.190.164", + "host.name": "exer447.internal.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 45656, + "network.protocol": "ggp", + "observer.product": "pariat", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2476", + "related.ip": [ + "10.35.190.164", + "10.21.58.162", + "10.113.65.192", + "10.241.143.145" + ], + "related.user": [ + "porin" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "radipis", + "rsa.misc.event_type": "dexeaco", + "rsa.misc.obj_name": "giat", + "rsa.misc.policy_name": "ttenb", + "rsa.misc.reference_id": "unturmag", + "rsa.misc.rule_name": "boreetd", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2476", + "rsa.network.alias_host": [ + "exer447.internal.localhost" + ], + "rsa.network.vlan": 6079, + "rsa.time.event_time_str": "Feb", + "rule.name": "boreetd", + "service.type": "f5", + "source.geo.country_name": "uisautei", + "source.ip": [ + "10.21.58.162" + ], + "source.nat.ip": "10.113.65.192", + "source.nat.port": 7807, + "source.port": 7881, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "porin" + }, + { + "destination.geo.country_name": "exe", + "destination.nat.ip": "10.75.113.240", + "destination.nat.port": 1874, + "destination.port": 1872, + "event.action": "Closed", + "event.code": "tas", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "edutpers ctobeat upta4358.home orem inibus secte [F5@ctobeat acl_policy_name=onsec acl_policy_type=idestl acl_rule_name=litani action=Closed hostname=itanimi1934.home bigip_mgmt_ip=10.19.154.103 context_name=ittenb context_type=tobeatae date_time=Feb 24 2018 19:26:15 dest_ip=10.235.51.61 dst_geo=exe dest_port=1872 device_product=cia device_vendor=idolo device_version=1.768 drop_reason=pitlabo errdefs_msgno=tas errdefs_msg_name=rcitat flow_id=ree ip_protocol=tcp severity=very-high partition_name=quipexea route_domain=orsitv sa_translation_pool=dunt sa_translation_type=int source_ip=10.53.27.253 src_geo=temveleu source_port=3599 source_user=luptat translated_dest_ip=10.75.113.240 translated_dest_port=1874 translated_ip_protocol=ionulam translated_route_domain=auto translated_source_ip=10.129.16.166 translated_source_port=5141 translated_vlan=ntocca vlan=5439", + "fileset.name": "bigipafm", + "host.ip": "10.19.154.103", + "host.name": "itanimi1934.home", + "input.type": "log", + "log.level": "very-high", + "log.offset": 46552, + "network.protocol": "tcp", + "observer.product": "cia", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.768", + "related.ip": [ + "10.19.154.103", + "10.53.27.253", + "10.75.113.240", + "10.129.16.166" + ], + "related.user": [ + "luptat" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ittenb", + "rsa.misc.event_type": "rcitat", + "rsa.misc.obj_name": "ctobeat", + "rsa.misc.policy_name": "onsec", + "rsa.misc.reference_id": "tas", + "rsa.misc.rule_name": "litani", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.768", + "rsa.network.alias_host": [ + "itanimi1934.home" + ], + "rsa.network.vlan": 5439, + "rsa.time.event_time_str": "Feb", + "rule.name": "litani", + "service.type": "f5", + "source.geo.country_name": "temveleu", + "source.ip": [ + "10.53.27.253" + ], + "source.nat.ip": "10.129.16.166", + "source.nat.port": 5141, + "source.port": 3599, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "luptat" + }, + { + "destination.geo.country_name": "equ", + "destination.nat.ip": "10.150.153.61", + "destination.nat.port": 2773, + "destination.port": 7256, + "event.action": "Established", + "event.code": "ihi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tvol lup mipsamv161.local ionula pexeaco temaccu [F5@uamqua acl_policy_name=Neq acl_policy_type=runt acl_rule_name=xcep action=Established hostname=pteurs1031.mail.corp bigip_mgmt_ip=10.125.150.220 context_name=lumquid context_type=eturadip date_time=Mar 11 2018 02:28:49 dest_ip=10.241.228.95 dst_geo=equ dest_port=7256 device_product=ssequamn device_vendor=ave device_version=1.5812 drop_reason=edquia errdefs_msgno=ihi errdefs_msg_name=undeomn flow_id=ape ip_protocol=rdp severity=medium partition_name=ari route_domain=umtot sa_translation_pool=onemulla sa_translation_type=atquo source_ip=10.120.50.13 src_geo=issu source_port=4426 source_user=inculpa translated_dest_ip=10.150.153.61 translated_dest_port=2773 translated_ip_protocol=loremagn translated_route_domain=acons translated_source_ip=10.22.213.196 translated_source_port=7230 translated_vlan=emoenimi vlan=1864", + "fileset.name": "bigipafm", + "host.ip": "10.125.150.220", + "host.name": "pteurs1031.mail.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 47421, + "network.protocol": "rdp", + "observer.product": "ssequamn", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5812", + "related.ip": [ + "10.150.153.61", + "10.22.213.196", + "10.120.50.13", + "10.125.150.220" + ], + "related.user": [ + "inculpa" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "lumquid", + "rsa.misc.event_type": "undeomn", + "rsa.misc.obj_name": "uamqua", + "rsa.misc.policy_name": "Neq", + "rsa.misc.reference_id": "ihi", + "rsa.misc.rule_name": "xcep", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5812", + "rsa.network.alias_host": [ + "pteurs1031.mail.corp" + ], + "rsa.network.vlan": 1864, + "rsa.time.event_time_str": "Mar", + "rule.name": "xcep", + "service.type": "f5", + "source.geo.country_name": "issu", + "source.ip": [ + "10.120.50.13" + ], + "source.nat.ip": "10.22.213.196", + "source.nat.port": 7230, + "source.port": 4426, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "inculpa" + }, + { + "destination.geo.country_name": "dquia", + "destination.nat.ip": "10.238.171.184", + "destination.nat.port": 2574, + "destination.port": 5334, + "event.action": "Accept", + "event.code": "dolor", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "mqu onorume abill5290.lan mini mve tionev [F5@uasiarch acl_policy_name=velites acl_policy_type=uredolor acl_rule_name=epreh action=Accept hostname=edquiaco6562.api.lan bigip_mgmt_ip=10.113.2.13 context_name=rudexerc context_type=nturm date_time=Mar 25 2018 09:31:24 dest_ip=10.182.134.109 dst_geo=dquia dest_port=5334 device_product=bori device_vendor=dipi device_version=1.7232 drop_reason=utf errdefs_msgno=dolor errdefs_msg_name=dexe flow_id=nemul ip_protocol=igmp severity=low partition_name=lupt route_domain=quatur sa_translation_pool=dminim sa_translation_type=ptatevel source_ip=10.85.52.249 src_geo=eirured source_port=3772 source_user=tatiset translated_dest_ip=10.238.171.184 translated_dest_port=2574 translated_ip_protocol=duntutl translated_route_domain=nven translated_source_ip=10.229.155.171 translated_source_port=6978 translated_vlan=asiarch vlan=7121", + "fileset.name": "bigipafm", + "host.ip": "10.113.2.13", + "host.name": "edquiaco6562.api.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 48297, + "network.protocol": "igmp", + "observer.product": "bori", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7232", + "related.ip": [ + "10.85.52.249", + "10.238.171.184", + "10.229.155.171", + "10.113.2.13" + ], + "related.user": [ + "tatiset" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "rudexerc", + "rsa.misc.event_type": "dexe", + "rsa.misc.obj_name": "uasiarch", + "rsa.misc.policy_name": "velites", + "rsa.misc.reference_id": "dolor", + "rsa.misc.rule_name": "epreh", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7232", + "rsa.network.alias_host": [ + "edquiaco6562.api.lan" + ], + "rsa.network.vlan": 7121, + "rsa.time.event_time_str": "Mar", + "rule.name": "epreh", + "service.type": "f5", + "source.geo.country_name": "eirured", + "source.ip": [ + "10.85.52.249" + ], + "source.nat.ip": "10.229.155.171", + "source.nat.port": 6978, + "source.port": 3772, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tatiset" + }, + { + "destination.geo.country_name": "dolo", + "destination.nat.ip": "10.51.245.225", + "destination.nat.port": 3991, + "destination.port": 6418, + "event.action": "Accept", + "event.code": "tessecil", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "utla deomni tse7542.test nesciu todit utaliqui [F5@emse acl_policy_name=emqui acl_policy_type=cipitla acl_rule_name=tlab action=Accept hostname=tatis7315.mail.home bigip_mgmt_ip=10.249.174.35 context_name=umfu context_type=utla date_time=Apr 08 2018 16:33:58 dest_ip=10.136.53.201 dst_geo=dolo dest_port=6418 device_product=samvol device_vendor=equa device_version=1.536 drop_reason=strumex errdefs_msgno=tessecil errdefs_msg_name=ugia flow_id=reprehe ip_protocol=udp severity=medium partition_name=umq route_domain=sistena sa_translation_pool=qui sa_translation_type=caboN source_ip=10.198.150.185 src_geo=catcupid source_port=3167 source_user=quela translated_dest_ip=10.51.245.225 translated_dest_port=3991 translated_ip_protocol=enimi translated_route_domain=illum translated_source_ip=10.220.1.249 translated_source_port=4200 translated_vlan=Sedut vlan=7832", + "fileset.name": "bigipafm", + "host.ip": "10.249.174.35", + "host.name": "tatis7315.mail.home", + "input.type": "log", + "log.level": "medium", + "log.offset": 49168, + "network.protocol": "udp", + "observer.product": "samvol", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.536", + "related.ip": [ + "10.249.174.35", + "10.198.150.185", + "10.51.245.225", + "10.220.1.249" + ], + "related.user": [ + "quela" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "umfu", + "rsa.misc.event_type": "ugia", + "rsa.misc.obj_name": "emse", + "rsa.misc.policy_name": "emqui", + "rsa.misc.reference_id": "tessecil", + "rsa.misc.rule_name": "tlab", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.536", + "rsa.network.alias_host": [ + "tatis7315.mail.home" + ], + "rsa.network.vlan": 7832, + "rsa.time.event_time_str": "Apr", + "rule.name": "tlab", + "service.type": "f5", + "source.geo.country_name": "catcupid", + "source.ip": [ + "10.198.150.185" + ], + "source.nat.ip": "10.220.1.249", + "source.nat.port": 4200, + "source.port": 3167, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "quela" + }, + { + "destination.geo.country_name": "osqu", + "destination.nat.ip": "10.190.96.181", + "destination.nat.port": 2153, + "destination.port": 4859, + "event.action": "Drop", + "event.code": "runtmoll", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "audant obeata uredol2348.www5.host entorev quuntur olup [F5@aeab acl_policy_name=uradipis acl_policy_type=aerat acl_rule_name=les action=Drop hostname=eosqui3723.api.localdomain bigip_mgmt_ip=10.152.157.32 context_name=ali context_type=udexerci date_time=Apr 22 2018 23:36:32 dest_ip=10.76.232.245 dst_geo=osqu dest_port=4859 device_product=aborio device_vendor=rve device_version=1.219 drop_reason=nbyCi errdefs_msgno=runtmoll errdefs_msg_name=busBon flow_id=norumetM ip_protocol=udp severity=low partition_name=usBono route_domain=ameaq sa_translation_pool=Quis sa_translation_type=lupta source_ip=10.251.82.195 src_geo=umiure source_port=5186 source_user=olorese translated_dest_ip=10.190.96.181 translated_dest_port=2153 translated_ip_protocol=culp translated_route_domain=deomn translated_source_ip=10.38.185.31 translated_source_port=1085 translated_vlan=llo vlan=1106", + "fileset.name": "bigipafm", + "host.ip": "10.152.157.32", + "host.name": "eosqui3723.api.localdomain", + "input.type": "log", + "log.level": "low", + "log.offset": 50031, + "network.protocol": "udp", + "observer.product": "aborio", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.219", + "related.ip": [ + "10.190.96.181", + "10.38.185.31", + "10.251.82.195", + "10.152.157.32" + ], + "related.user": [ + "olorese" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "ali", + "rsa.misc.event_type": "busBon", + "rsa.misc.obj_name": "aeab", + "rsa.misc.policy_name": "uradipis", + "rsa.misc.reference_id": "runtmoll", + "rsa.misc.rule_name": "les", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.219", + "rsa.network.alias_host": [ + "eosqui3723.api.localdomain" + ], + "rsa.network.vlan": 1106, + "rsa.time.event_time_str": "Apr", + "rule.name": "les", + "service.type": "f5", + "source.geo.country_name": "umiure", + "source.ip": [ + "10.251.82.195" + ], + "source.nat.ip": "10.38.185.31", + "source.nat.port": 1085, + "source.port": 5186, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "olorese" + }, + { + "destination.geo.country_name": "eratv", + "destination.nat.ip": "10.230.112.179", + "destination.nat.port": 5926, + "destination.port": 7206, + "event.action": "Drop", + "event.code": "xerc", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tla iaconseq sed3235.www5.localhost pidatatn isno luptatev [F5@occaeca acl_policy_name=dan acl_policy_type=pta acl_rule_name=upt action=Drop hostname=itaedict199.mail.corp bigip_mgmt_ip=10.103.102.242 context_name=labore context_type=lorem date_time=May 07 2018 06:39:06 dest_ip=10.68.159.207 dst_geo=eratv dest_port=7206 device_product=estq device_vendor=quasiarc device_version=1.6526 drop_reason=liq errdefs_msgno=xerc errdefs_msg_name=atisetqu flow_id=squir ip_protocol=icmp severity=very-high partition_name=quam route_domain=deriti sa_translation_pool=edictasu sa_translation_type=eturadi source_ip=10.190.247.194 src_geo=mSecti source_port=4210 source_user=tDuisaut translated_dest_ip=10.230.112.179 translated_dest_port=5926 translated_ip_protocol=vol translated_route_domain=ita translated_source_ip=10.211.198.50 translated_source_port=7510 translated_vlan=nibusB vlan=5555", + "fileset.name": "bigipafm", + "host.ip": "10.103.102.242", + "host.name": "itaedict199.mail.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 50906, + "network.protocol": "icmp", + "observer.product": "estq", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6526", + "related.ip": [ + "10.190.247.194", + "10.103.102.242", + "10.211.198.50", + "10.230.112.179" + ], + "related.user": [ + "tDuisaut" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "labore", + "rsa.misc.event_type": "atisetqu", + "rsa.misc.obj_name": "occaeca", + "rsa.misc.policy_name": "dan", + "rsa.misc.reference_id": "xerc", + "rsa.misc.rule_name": "upt", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6526", + "rsa.network.alias_host": [ + "itaedict199.mail.corp" + ], + "rsa.network.vlan": 5555, + "rsa.time.event_time_str": "May", + "rule.name": "upt", + "service.type": "f5", + "source.geo.country_name": "mSecti", + "source.ip": [ + "10.190.247.194" + ], + "source.nat.ip": "10.211.198.50", + "source.nat.port": 7510, + "source.port": 4210, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tDuisaut" + }, + { + "destination.geo.country_name": "uiac", + "destination.nat.ip": "10.101.13.122", + "destination.nat.port": 6737, + "destination.port": 7838, + "event.action": "Closed", + "event.code": "queporro", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "amremap oremagna aqu4475.mail.invalid serrorsi tsedquia rsit [F5@quis acl_policy_name=upidatat acl_policy_type=mod acl_rule_name=niamqui action=Closed hostname=xeaco7887.www.localdomain bigip_mgmt_ip=10.47.223.155 context_name=ugitsed context_type=dminimve date_time=May 21 2018 13:41:41 dest_ip=10.111.137.84 dst_geo=uiac dest_port=7838 device_product=tot device_vendor=reme device_version=1.7750 drop_reason=loremi errdefs_msgno=queporro errdefs_msg_name=tur flow_id=eFi ip_protocol=ipv6-icmp severity=medium partition_name=ulapari route_domain=eporroq sa_translation_pool=uunturm sa_translation_type=iatn source_ip=10.219.83.199 src_geo=diduntut source_port=1321 source_user=ectetur translated_dest_ip=10.101.13.122 translated_dest_port=6737 translated_ip_protocol=nibusBo translated_route_domain=volup translated_source_ip=10.251.101.61 translated_source_port=5153 translated_vlan=scipit vlan=6495", + "fileset.name": "bigipafm", + "host.ip": "10.47.223.155", + "host.name": "xeaco7887.www.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 51790, + "network.protocol": "ipv6-icmp", + "observer.product": "tot", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7750", + "related.ip": [ + "10.219.83.199", + "10.47.223.155", + "10.251.101.61", + "10.101.13.122" + ], + "related.user": [ + "ectetur" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ugitsed", + "rsa.misc.event_type": "tur", + "rsa.misc.obj_name": "quis", + "rsa.misc.policy_name": "upidatat", + "rsa.misc.reference_id": "queporro", + "rsa.misc.rule_name": "niamqui", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7750", + "rsa.network.alias_host": [ + "xeaco7887.www.localdomain" + ], + "rsa.network.vlan": 6495, + "rsa.time.event_time_str": "May", + "rule.name": "niamqui", + "service.type": "f5", + "source.geo.country_name": "diduntut", + "source.ip": [ + "10.219.83.199" + ], + "source.nat.ip": "10.251.101.61", + "source.nat.port": 5153, + "source.port": 1321, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ectetur" + }, + { + "destination.geo.country_name": "inBCSed", + "destination.nat.ip": "10.21.30.43", + "destination.nat.port": 4754, + "destination.port": 6353, + "event.action": "Closed", + "event.code": "olu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tore isni tamrema736.www5.lan ntiumdol conse aturve [F5@edqui acl_policy_name=tvolu acl_policy_type=psu acl_rule_name=strud action=Closed hostname=saute7421.www.invalid bigip_mgmt_ip=10.21.80.157 context_name=tiumtot context_type=tate date_time=Jun 04 2018 20:44:15 dest_ip=10.13.222.177 dst_geo=inBCSed dest_port=6353 device_product=Loremip device_vendor=taliqui device_version=1.5568 drop_reason=ipsaquae errdefs_msgno=olu errdefs_msg_name=exerci flow_id=isnostru ip_protocol=tcp severity=very-high partition_name=ngelits route_domain=volupt sa_translation_pool=billoi sa_translation_type=reseo source_ip=10.31.86.83 src_geo=pariat source_port=6646 source_user=litsed translated_dest_ip=10.21.30.43 translated_dest_port=4754 translated_ip_protocol=lorem translated_route_domain=iamquisn translated_source_ip=10.83.136.233 translated_source_port=6643 translated_vlan=imadm vlan=3187", + "fileset.name": "bigipafm", + "host.ip": "10.21.80.157", + "host.name": "saute7421.www.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 52692, + "network.protocol": "tcp", + "observer.product": "Loremip", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5568", + "related.ip": [ + "10.21.30.43", + "10.83.136.233", + "10.21.80.157", + "10.31.86.83" + ], + "related.user": [ + "litsed" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "tiumtot", + "rsa.misc.event_type": "exerci", + "rsa.misc.obj_name": "edqui", + "rsa.misc.policy_name": "tvolu", + "rsa.misc.reference_id": "olu", + "rsa.misc.rule_name": "strud", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.5568", + "rsa.network.alias_host": [ + "saute7421.www.invalid" + ], + "rsa.network.vlan": 3187, + "rsa.time.event_time_str": "Jun", + "rule.name": "strud", + "service.type": "f5", + "source.geo.country_name": "pariat", + "source.ip": [ + "10.31.86.83" + ], + "source.nat.ip": "10.83.136.233", + "source.nat.port": 6643, + "source.port": 6646, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "litsed" + }, + { + "destination.geo.country_name": "uine", + "destination.nat.ip": "10.194.197.107", + "destination.nat.port": 2524, + "destination.port": 1815, + "event.action": "Accept", + "event.code": "archite", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "lumdol edutper utemve6966.mail.local emoen ptate mipsumqu [F5@turad acl_policy_name=dol acl_policy_type=ntutla acl_rule_name=des action=Accept hostname=oluptas1637.home bigip_mgmt_ip=10.195.90.73 context_name=ipisc context_type=iatnulap date_time=Jun 19 2018 03:46:49 dest_ip=10.170.155.137 dst_geo=uine dest_port=1815 device_product=veniamqu device_vendor=iconsequ device_version=1.5445 drop_reason=apa errdefs_msgno=archite errdefs_msg_name=tur flow_id=ddo ip_protocol=ipv6 severity=high partition_name=inBC route_domain=did sa_translation_pool=atcupi sa_translation_type=eriti source_ip=10.45.152.205 src_geo=rema source_port=5107 source_user=datatn translated_dest_ip=10.194.197.107 translated_dest_port=2524 translated_ip_protocol=tur translated_route_domain=itation translated_source_ip=10.27.181.27 translated_source_port=5509 translated_vlan=uredo vlan=2155", + "fileset.name": "bigipafm", + "host.ip": "10.195.90.73", + "host.name": "oluptas1637.home", + "input.type": "log", + "log.level": "high", + "log.offset": 53576, + "network.protocol": "ipv6", + "observer.product": "veniamqu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5445", + "related.ip": [ + "10.195.90.73", + "10.45.152.205", + "10.194.197.107", + "10.27.181.27" + ], + "related.user": [ + "datatn" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "ipisc", + "rsa.misc.event_type": "tur", + "rsa.misc.obj_name": "turad", + "rsa.misc.policy_name": "dol", + "rsa.misc.reference_id": "archite", + "rsa.misc.rule_name": "des", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5445", + "rsa.network.alias_host": [ + "oluptas1637.home" + ], + "rsa.network.vlan": 2155, + "rsa.time.event_time_str": "Jun", + "rule.name": "des", + "service.type": "f5", + "source.geo.country_name": "rema", + "source.ip": [ + "10.45.152.205" + ], + "source.nat.ip": "10.27.181.27", + "source.nat.port": 5509, + "source.port": 5107, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "datatn" + }, + { + "destination.geo.country_name": "iscive", + "destination.nat.ip": "10.129.161.18", + "destination.nat.port": 782, + "destination.port": 5527, + "event.action": "Drop", + "event.code": "taevitae", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "use catcu quame922.internal.host eursi liquid ulapari [F5@ibus acl_policy_name=isu acl_policy_type=moll acl_rule_name=roinBCS action=Drop hostname=ididu5505.api.localdomain bigip_mgmt_ip=10.43.239.97 context_name=modi context_type=cip date_time=Jul 03 2018 10:49:23 dest_ip=10.60.60.164 dst_geo=iscive dest_port=5527 device_product=incididu device_vendor=yCice device_version=1.508 drop_reason=ionem errdefs_msgno=taevitae errdefs_msg_name=dminimv flow_id=quam ip_protocol=tcp severity=low partition_name=umdol route_domain=rerepr sa_translation_pool=ipiscin sa_translation_type=trudexe source_ip=10.222.2.132 src_geo=umdo source_port=6187 source_user=aedicta translated_dest_ip=10.129.161.18 translated_dest_port=782 translated_ip_protocol=umquiad translated_route_domain=porinc translated_source_ip=10.183.90.25 translated_source_port=5038 translated_vlan=conse vlan=2563", + "fileset.name": "bigipafm", + "host.ip": "10.43.239.97", + "host.name": "ididu5505.api.localdomain", + "input.type": "log", + "log.level": "low", + "log.offset": 54442, + "network.protocol": "tcp", + "observer.product": "incididu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.508", + "related.ip": [ + "10.222.2.132", + "10.43.239.97", + "10.129.161.18", + "10.183.90.25" + ], + "related.user": [ + "aedicta" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "modi", + "rsa.misc.event_type": "dminimv", + "rsa.misc.obj_name": "ibus", + "rsa.misc.policy_name": "isu", + "rsa.misc.reference_id": "taevitae", + "rsa.misc.rule_name": "roinBCS", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.508", + "rsa.network.alias_host": [ + "ididu5505.api.localdomain" + ], + "rsa.network.vlan": 2563, + "rsa.time.event_time_str": "Jul", + "rule.name": "roinBCS", + "service.type": "f5", + "source.geo.country_name": "umdo", + "source.ip": [ + "10.222.2.132" + ], + "source.nat.ip": "10.183.90.25", + "source.nat.port": 5038, + "source.port": 6187, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "aedicta" + }, + { + "destination.geo.country_name": "nevolup", + "destination.nat.ip": "10.67.129.100", + "destination.nat.port": 7106, + "destination.port": 3706, + "event.action": "Closed", + "event.code": "elitse", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "dolo reeufu umexe5208.local suntex uptatema uteiru [F5@rcitati acl_policy_name=siutali acl_policy_type=uiratio acl_rule_name=ficia action=Closed hostname=mqui1099.api.corp bigip_mgmt_ip=10.231.167.171 context_name=onorumet context_type=illoinve date_time=Jul 17 2018 17:51:58 dest_ip=10.188.254.168 dst_geo=nevolup dest_port=3706 device_product=lor device_vendor=ica device_version=1.4479 drop_reason=sumd errdefs_msgno=elitse errdefs_msg_name=olu flow_id=temqu ip_protocol=rdp severity=very-high partition_name=nesci route_domain=meaquei sa_translation_pool=snisiu sa_translation_type=atem source_ip=10.189.162.131 src_geo=litsed source_port=6019 source_user=sedquia translated_dest_ip=10.67.129.100 translated_dest_port=7106 translated_ip_protocol=mmodicon translated_route_domain=eosquir translated_source_ip=10.248.156.138 translated_source_port=2125 translated_vlan=smodit vlan=3090", + "fileset.name": "bigipafm", + "host.ip": "10.231.167.171", + "host.name": "mqui1099.api.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 55316, + "network.protocol": "rdp", + "observer.product": "lor", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4479", + "related.ip": [ + "10.231.167.171", + "10.248.156.138", + "10.189.162.131", + "10.67.129.100" + ], + "related.user": [ + "sedquia" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "onorumet", + "rsa.misc.event_type": "olu", + "rsa.misc.obj_name": "rcitati", + "rsa.misc.policy_name": "siutali", + "rsa.misc.reference_id": "elitse", + "rsa.misc.rule_name": "ficia", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4479", + "rsa.network.alias_host": [ + "mqui1099.api.corp" + ], + "rsa.network.vlan": 3090, + "rsa.time.event_time_str": "Jul", + "rule.name": "ficia", + "service.type": "f5", + "source.geo.country_name": "litsed", + "source.ip": [ + "10.189.162.131" + ], + "source.nat.ip": "10.248.156.138", + "source.nat.port": 2125, + "source.port": 6019, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "sedquia" + }, + { + "destination.geo.country_name": "umqui", + "destination.nat.ip": "10.185.107.27", + "destination.nat.port": 2257, + "destination.port": 1757, + "event.action": "Reject", + "event.code": "itecto", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "dun xce dol5403.www.localhost asiar eiu maliquam [F5@gnama acl_policy_name=ursintoc acl_policy_type=minimve acl_rule_name=eprehe action=Reject hostname=siuta2155.lan bigip_mgmt_ip=10.63.103.30 context_name=ill context_type=imveniam date_time=Aug 01 2018 00:54:32 dest_ip=10.36.29.127 dst_geo=umqui dest_port=1757 device_product=sci device_vendor=isquames device_version=1.2927 drop_reason=tlabor errdefs_msgno=itecto errdefs_msg_name=loreeuf flow_id=orainci ip_protocol=icmp severity=low partition_name=aev route_domain=uelaudan sa_translation_pool=lab sa_translation_type=sequa source_ip=10.6.146.184 src_geo=rrorsi source_port=7247 source_user=sequu translated_dest_ip=10.185.107.27 translated_dest_port=2257 translated_ip_protocol=mips translated_route_domain=iduntutl translated_source_ip=10.142.106.66 translated_source_port=3790 translated_vlan=quelauda vlan=289", + "fileset.name": "bigipafm", + "host.ip": "10.63.103.30", + "host.name": "siuta2155.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 56204, + "network.protocol": "icmp", + "observer.product": "sci", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2927", + "related.ip": [ + "10.63.103.30", + "10.142.106.66", + "10.6.146.184", + "10.185.107.27" + ], + "related.user": [ + "sequu" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ill", + "rsa.misc.event_type": "loreeuf", + "rsa.misc.obj_name": "gnama", + "rsa.misc.policy_name": "ursintoc", + "rsa.misc.reference_id": "itecto", + "rsa.misc.rule_name": "eprehe", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2927", + "rsa.network.alias_host": [ + "siuta2155.lan" + ], + "rsa.network.vlan": 289, + "rsa.time.event_time_str": "Aug", + "rule.name": "eprehe", + "service.type": "f5", + "source.geo.country_name": "rrorsi", + "source.ip": [ + "10.6.146.184" + ], + "source.nat.ip": "10.142.106.66", + "source.nat.port": 3790, + "source.port": 7247, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "sequu" + }, + { + "destination.geo.country_name": "uidex", + "destination.nat.ip": "10.0.202.9", + "destination.nat.port": 7451, + "destination.port": 1203, + "event.action": "Established", + "event.code": "ianonn", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "dolo ulamc doe344.www5.local toreve squirat llum [F5@dol acl_policy_name=niam acl_policy_type=atio acl_rule_name=sno action=Established hostname=tatiset4191.localdomain bigip_mgmt_ip=10.214.93.200 context_name=dtempor context_type=rroquisq date_time=Aug 15 2018 07:57:06 dest_ip=10.215.63.248 dst_geo=uidex dest_port=1203 device_product=lloi device_vendor=nseq device_version=1.4023 drop_reason=isetqua errdefs_msgno=ianonn errdefs_msg_name=oluptas flow_id=doe ip_protocol=udp severity=very-high partition_name=rchitect route_domain=orsitame sa_translation_pool=tasn sa_translation_type=exeaco source_ip=10.93.39.237 src_geo=aincidu source_port=232 source_user=tionofd translated_dest_ip=10.0.202.9 translated_dest_port=7451 translated_ip_protocol=nvolup translated_route_domain=ommodic translated_source_ip=10.119.179.182 translated_source_port=7255 translated_vlan=undeo vlan=7696", + "fileset.name": "bigipafm", + "host.ip": "10.214.93.200", + "host.name": "tatiset4191.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 57073, + "network.protocol": "udp", + "observer.product": "lloi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4023", + "related.ip": [ + "10.93.39.237", + "10.119.179.182", + "10.214.93.200", + "10.0.202.9" + ], + "related.user": [ + "tionofd" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "dtempor", + "rsa.misc.event_type": "oluptas", + "rsa.misc.obj_name": "dol", + "rsa.misc.policy_name": "niam", + "rsa.misc.reference_id": "ianonn", + "rsa.misc.rule_name": "sno", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4023", + "rsa.network.alias_host": [ + "tatiset4191.localdomain" + ], + "rsa.network.vlan": 7696, + "rsa.time.event_time_str": "Aug", + "rule.name": "sno", + "service.type": "f5", + "source.geo.country_name": "aincidu", + "source.ip": [ + "10.93.39.237" + ], + "source.nat.ip": "10.119.179.182", + "source.nat.port": 7255, + "source.port": 232, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tionofd" + }, + { + "destination.geo.country_name": "mcorpor", + "destination.nat.ip": "10.123.154.140", + "destination.nat.port": 2551, + "destination.port": 2433, + "event.action": "Drop", + "event.code": "byCice", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uiinea uianonn eavolupt784.www5.example liquam sinto edi [F5@eumiure acl_policy_name=ore acl_policy_type=adeser acl_rule_name=mSe action=Drop hostname=aute2433.mail.lan bigip_mgmt_ip=10.252.204.162 context_name=tiae context_type=giat date_time=Aug 29 2018 14:59:40 dest_ip=10.115.77.51 dst_geo=mcorpor dest_port=2433 device_product=ostru device_vendor=mea device_version=1.5939 drop_reason=iquipex errdefs_msgno=byCice errdefs_msg_name=deritq flow_id=boreetdo ip_protocol=ipv6-icmp severity=medium partition_name=iin route_domain=nostr sa_translation_pool=luptatem sa_translation_type=tNequepo source_ip=10.28.145.163 src_geo=sper source_port=72 source_user=imadmin translated_dest_ip=10.123.154.140 translated_dest_port=2551 translated_ip_protocol=mSect translated_route_domain=iure translated_source_ip=10.30.189.166 translated_source_port=2749 translated_vlan=aer vlan=3422", + "fileset.name": "bigipafm", + "host.ip": "10.252.204.162", + "host.name": "aute2433.mail.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 57956, + "network.protocol": "ipv6-icmp", + "observer.product": "ostru", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5939", + "related.ip": [ + "10.252.204.162", + "10.28.145.163", + "10.123.154.140", + "10.30.189.166" + ], + "related.user": [ + "imadmin" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "tiae", + "rsa.misc.event_type": "deritq", + "rsa.misc.obj_name": "eumiure", + "rsa.misc.policy_name": "ore", + "rsa.misc.reference_id": "byCice", + "rsa.misc.rule_name": "mSe", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5939", + "rsa.network.alias_host": [ + "aute2433.mail.lan" + ], + "rsa.network.vlan": 3422, + "rsa.time.event_time_str": "Aug", + "rule.name": "mSe", + "service.type": "f5", + "source.geo.country_name": "sper", + "source.ip": [ + "10.28.145.163" + ], + "source.nat.ip": "10.30.189.166", + "source.nat.port": 2749, + "source.port": 72, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "imadmin" + }, + { + "destination.geo.country_name": "pariatur", + "destination.nat.ip": "10.79.49.3", + "destination.nat.port": 7794, + "destination.port": 7435, + "event.action": "Accept", + "event.code": "mqua", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "roquis mremape ude2977.www.corp rmagnido exeaco dqu [F5@ccaec acl_policy_name=repreh acl_policy_type=imven acl_rule_name=usan action=Accept hostname=idolo6535.internal.example bigip_mgmt_ip=10.46.162.198 context_name=snulap context_type=onsequat date_time=Sep 12 2018 22:02:15 dest_ip=10.166.128.248 dst_geo=pariatur dest_port=7435 device_product=tura device_vendor=equuntur device_version=1.6564 drop_reason=uaera errdefs_msgno=mqua errdefs_msg_name=xer flow_id=utlabore ip_protocol=ipv6-icmp severity=very-high partition_name=beataevi route_domain=amquisn sa_translation_pool=itquii sa_translation_type=imaven source_ip=10.145.128.250 src_geo=nder source_port=5641 source_user=eni translated_dest_ip=10.79.49.3 translated_dest_port=7794 translated_ip_protocol=psamvolu translated_route_domain=teturad translated_source_ip=10.29.122.183 translated_source_port=6166 translated_vlan=tla vlan=6146", + "fileset.name": "bigipafm", + "host.ip": "10.46.162.198", + "host.name": "idolo6535.internal.example", + "input.type": "log", + "log.level": "very-high", + "log.offset": 58833, + "network.protocol": "ipv6-icmp", + "observer.product": "tura", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6564", + "related.ip": [ + "10.79.49.3", + "10.46.162.198", + "10.145.128.250", + "10.29.122.183" + ], + "related.user": [ + "eni" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "snulap", + "rsa.misc.event_type": "xer", + "rsa.misc.obj_name": "ccaec", + "rsa.misc.policy_name": "repreh", + "rsa.misc.reference_id": "mqua", + "rsa.misc.rule_name": "usan", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6564", + "rsa.network.alias_host": [ + "idolo6535.internal.example" + ], + "rsa.network.vlan": 6146, + "rsa.time.event_time_str": "Sep", + "rule.name": "usan", + "service.type": "f5", + "source.geo.country_name": "nder", + "source.ip": [ + "10.145.128.250" + ], + "source.nat.ip": "10.29.122.183", + "source.nat.port": 6166, + "source.port": 5641, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "eni" + }, + { + "destination.geo.country_name": "smoditem", + "destination.nat.ip": "10.65.174.196", + "destination.nat.port": 472, + "destination.port": 575, + "event.action": "Closed", + "event.code": "loremeum", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "modtempo edict nost3250.internal.localdomain nibu quatur isiutali [F5@mdolo acl_policy_name=nof acl_policy_type=usantiu acl_rule_name=periam action=Closed hostname=one7728.api.localdomain bigip_mgmt_ip=10.177.232.136 context_name=obe context_type=niamqu date_time=Sep 27 2018 05:04:49 dest_ip=10.140.59.161 dst_geo=smoditem dest_port=575 device_product=tev device_vendor=oNemoeni device_version=1.3341 drop_reason=elillumq errdefs_msgno=loremeum errdefs_msg_name=luptatem flow_id=ing ip_protocol=tcp severity=very-high partition_name=riameaqu route_domain=etd sa_translation_pool=omnisi sa_translation_type=dolor source_ip=10.166.169.167 src_geo=ati source_port=1544 source_user=olors translated_dest_ip=10.65.174.196 translated_dest_port=472 translated_ip_protocol=iin translated_route_domain=uteiru translated_source_ip=10.142.235.217 translated_source_port=5846 translated_vlan=orain vlan=2663", + "fileset.name": "bigipafm", + "host.ip": "10.177.232.136", + "host.name": "one7728.api.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 59729, + "network.protocol": "tcp", + "observer.product": "tev", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3341", + "related.ip": [ + "10.65.174.196", + "10.177.232.136", + "10.166.169.167", + "10.142.235.217" + ], + "related.user": [ + "olors" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "obe", + "rsa.misc.event_type": "luptatem", + "rsa.misc.obj_name": "mdolo", + "rsa.misc.policy_name": "nof", + "rsa.misc.reference_id": "loremeum", + "rsa.misc.rule_name": "periam", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3341", + "rsa.network.alias_host": [ + "one7728.api.localdomain" + ], + "rsa.network.vlan": 2663, + "rsa.time.event_time_str": "Sep", + "rule.name": "periam", + "service.type": "f5", + "source.geo.country_name": "ati", + "source.ip": [ + "10.166.169.167" + ], + "source.nat.ip": "10.142.235.217", + "source.nat.port": 5846, + "source.port": 1544, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "olors" + }, + { + "destination.geo.country_name": "orisnisi", + "destination.nat.ip": "10.191.78.86", + "destination.nat.port": 6355, + "destination.port": 4342, + "event.action": "Established", + "event.code": "ionula", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "llu quaUt labor7147.internal.host ten vitae tse [F5@gni acl_policy_name=per acl_policy_type=tione acl_rule_name=nibus action=Established hostname=uptatem4446.internal.localhost bigip_mgmt_ip=10.29.217.44 context_name=eacommod context_type=tali date_time=Oct 11 2018 12:07:23 dest_ip=10.131.223.198 dst_geo=orisnisi dest_port=4342 device_product=eritquii device_vendor=atevelit device_version=1.325 drop_reason=enat errdefs_msgno=ionula errdefs_msg_name=itaed flow_id=invol ip_protocol=rdp severity=low partition_name=cidun route_domain=tassitas sa_translation_pool=nimadmi sa_translation_type=dipisci source_ip=10.215.184.154 src_geo=nor source_port=3306 source_user=iarc translated_dest_ip=10.191.78.86 translated_dest_port=6355 translated_ip_protocol=uiac translated_route_domain=squ translated_source_ip=10.53.188.140 translated_source_port=6455 translated_vlan=ten vlan=2937", + "fileset.name": "bigipafm", + "host.ip": "10.29.217.44", + "host.name": "uptatem4446.internal.localhost", + "input.type": "log", + "log.level": "low", + "log.offset": 60626, + "network.protocol": "rdp", + "observer.product": "eritquii", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.325", + "related.ip": [ + "10.29.217.44", + "10.191.78.86", + "10.215.184.154", + "10.53.188.140" + ], + "related.user": [ + "iarc" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "eacommod", + "rsa.misc.event_type": "itaed", + "rsa.misc.obj_name": "gni", + "rsa.misc.policy_name": "per", + "rsa.misc.reference_id": "ionula", + "rsa.misc.rule_name": "nibus", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.325", + "rsa.network.alias_host": [ + "uptatem4446.internal.localhost" + ], + "rsa.network.vlan": 2937, + "rsa.time.event_time_str": "Oct", + "rule.name": "nibus", + "service.type": "f5", + "source.geo.country_name": "nor", + "source.ip": [ + "10.215.184.154" + ], + "source.nat.ip": "10.53.188.140", + "source.nat.port": 6455, + "source.port": 3306, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "iarc" + }, + { + "destination.geo.country_name": "turad", + "destination.nat.ip": "10.46.222.149", + "destination.nat.port": 3304, + "destination.port": 2537, + "event.action": "Drop", + "event.code": "quipe", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "isciveli ntutlab sitamet452.domain nsequ ing ollita [F5@dipisci acl_policy_name=amnisiu acl_policy_type=ptat acl_rule_name=epr action=Drop hostname=emq2514.api.localhost bigip_mgmt_ip=10.135.77.156 context_name=uraut context_type=non date_time=Oct 25 2018 19:09:57 dest_ip=10.248.182.188 dst_geo=turad dest_port=2537 device_product=nBCSe device_vendor=ollita device_version=1.3567 drop_reason=eni errdefs_msgno=quipe errdefs_msg_name=oluptat flow_id=stenatus ip_protocol=ggp severity=very-high partition_name=iaecon route_domain=ect sa_translation_pool=tquid sa_translation_type=seru source_ip=10.76.148.147 src_geo=remagna source_port=1121 source_user=urve translated_dest_ip=10.46.222.149 translated_dest_port=3304 translated_ip_protocol=squ translated_route_domain=emagnaal translated_source_ip=10.74.74.129 translated_source_port=5904 translated_vlan=itati vlan=3497", + "fileset.name": "bigipafm", + "host.ip": "10.135.77.156", + "host.name": "emq2514.api.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 61505, + "network.protocol": "ggp", + "observer.product": "nBCSe", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3567", + "related.ip": [ + "10.135.77.156", + "10.74.74.129", + "10.76.148.147", + "10.46.222.149" + ], + "related.user": [ + "urve" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "uraut", + "rsa.misc.event_type": "oluptat", + "rsa.misc.obj_name": "dipisci", + "rsa.misc.policy_name": "amnisiu", + "rsa.misc.reference_id": "quipe", + "rsa.misc.rule_name": "epr", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3567", + "rsa.network.alias_host": [ + "emq2514.api.localhost" + ], + "rsa.network.vlan": 3497, + "rsa.time.event_time_str": "Oct", + "rule.name": "epr", + "service.type": "f5", + "source.geo.country_name": "remagna", + "source.ip": [ + "10.76.148.147" + ], + "source.nat.ip": "10.74.74.129", + "source.nat.port": 5904, + "source.port": 1121, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "urve" + }, + { + "destination.geo.country_name": "imadmini", + "destination.nat.ip": "10.11.146.253", + "destination.nat.port": 3581, + "destination.port": 3791, + "event.action": "Drop", + "event.code": "ute", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "rinc tno meumf4052.invalid pitlabo riamea Malorumw [F5@consect acl_policy_name=issu acl_policy_type=tconsect acl_rule_name=tationem action=Drop hostname=agna5654.www.corp bigip_mgmt_ip=10.96.200.223 context_name=iatisun context_type=cto date_time=Nov 09 2018 02:12:32 dest_ip=10.3.228.220 dst_geo=imadmini dest_port=3791 device_product=oeiusm device_vendor=aUtenim device_version=1.1186 drop_reason=isu errdefs_msgno=ute errdefs_msg_name=tdolore flow_id=madminim ip_protocol=igmp severity=very-high partition_name=prehen route_domain=ate sa_translation_pool=ull sa_translation_type=enimipsa source_ip=10.130.203.37 src_geo=quisnos source_port=2132 source_user=mvele translated_dest_ip=10.11.146.253 translated_dest_port=3581 translated_ip_protocol=remeum translated_route_domain=temseq translated_source_ip=10.145.49.29 translated_source_port=2464 translated_vlan=sedquia vlan=4912", + "fileset.name": "bigipafm", + "host.ip": "10.96.200.223", + "host.name": "agna5654.www.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 62376, + "network.protocol": "igmp", + "observer.product": "oeiusm", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1186", + "related.ip": [ + "10.130.203.37", + "10.145.49.29", + "10.11.146.253", + "10.96.200.223" + ], + "related.user": [ + "mvele" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "iatisun", + "rsa.misc.event_type": "tdolore", + "rsa.misc.obj_name": "consect", + "rsa.misc.policy_name": "issu", + "rsa.misc.reference_id": "ute", + "rsa.misc.rule_name": "tationem", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1186", + "rsa.network.alias_host": [ + "agna5654.www.corp" + ], + "rsa.network.vlan": 4912, + "rsa.time.event_time_str": "Nov", + "rule.name": "tationem", + "service.type": "f5", + "source.geo.country_name": "quisnos", + "source.ip": [ + "10.130.203.37" + ], + "source.nat.ip": "10.145.49.29", + "source.nat.port": 2464, + "source.port": 2132, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "mvele" + }, + { + "destination.geo.country_name": "epteu", + "destination.nat.ip": "10.162.2.180", + "destination.nat.port": 3889, + "destination.port": 5744, + "event.action": "Drop", + "event.code": "ibusB", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ntmo aliqu iqu4429.www5.lan doconse volupta ptat [F5@oreverit acl_policy_name=nimides acl_policy_type=remipsum acl_rule_name=elit action=Drop hostname=ipi4827.mail.lan bigip_mgmt_ip=10.162.78.48 context_name=lab context_type=sedqui date_time=Nov 23 2018 09:15:06 dest_ip=10.243.157.94 dst_geo=epteu dest_port=5744 device_product=tura device_vendor=mquiavol device_version=1.6845 drop_reason=eabil errdefs_msgno=ibusB errdefs_msg_name=rporis flow_id=etco ip_protocol=ipv6 severity=very-high partition_name=ereprehe route_domain=olu sa_translation_pool=nofdeF sa_translation_type=riaturEx source_ip=10.24.23.209 src_geo=itautfu source_port=1503 source_user=rumwr translated_dest_ip=10.162.2.180 translated_dest_port=3889 translated_ip_protocol=mporain translated_route_domain=ectetur translated_source_ip=10.48.75.140 translated_source_port=1837 translated_vlan=ineavol vlan=5182", + "fileset.name": "bigipafm", + "host.ip": "10.162.78.48", + "host.name": "ipi4827.mail.lan", + "input.type": "log", + "log.level": "very-high", + "log.offset": 63258, + "network.protocol": "ipv6", + "observer.product": "tura", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6845", + "related.ip": [ + "10.48.75.140", + "10.162.78.48", + "10.24.23.209", + "10.162.2.180" + ], + "related.user": [ + "rumwr" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "lab", + "rsa.misc.event_type": "rporis", + "rsa.misc.obj_name": "oreverit", + "rsa.misc.policy_name": "nimides", + "rsa.misc.reference_id": "ibusB", + "rsa.misc.rule_name": "elit", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6845", + "rsa.network.alias_host": [ + "ipi4827.mail.lan" + ], + "rsa.network.vlan": 5182, + "rsa.time.event_time_str": "Nov", + "rule.name": "elit", + "service.type": "f5", + "source.geo.country_name": "itautfu", + "source.ip": [ + "10.24.23.209" + ], + "source.nat.ip": "10.48.75.140", + "source.nat.port": 1837, + "source.port": 1503, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "rumwr" + }, + { + "destination.geo.country_name": "rur", + "destination.nat.ip": "10.119.12.186", + "destination.nat.port": 5674, + "destination.port": 5543, + "event.action": "Drop", + "event.code": "eddoeiu", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "onproid sitv equam3114.test mcorp uelaud aperiam [F5@ngelit acl_policy_name=quiano acl_policy_type=sund acl_rule_name=iaconse action=Drop hostname=sequatD163.internal.example bigip_mgmt_ip=10.151.206.38 context_name=oloremi context_type=luptate date_time=Dec 07 2018 16:17:40 dest_ip=10.38.57.217 dst_geo=rur dest_port=5543 device_product=imidest device_vendor=oeiusmod device_version=1.419 drop_reason=psumqui errdefs_msgno=eddoeiu errdefs_msg_name=oinvento flow_id=mips ip_protocol=udp severity=medium partition_name=corpor route_domain=amvolu sa_translation_pool=ent sa_translation_type=ionemu source_ip=10.66.92.83 src_geo=orinrep source_port=2549 source_user=nproide translated_dest_ip=10.119.12.186 translated_dest_port=5674 translated_ip_protocol=qui translated_route_domain=nemullam translated_source_ip=10.97.105.115 translated_source_port=3576 translated_vlan=squir vlan=3987", + "fileset.name": "bigipafm", + "host.ip": "10.151.206.38", + "host.name": "sequatD163.internal.example", + "input.type": "log", + "log.level": "medium", + "log.offset": 64136, + "network.protocol": "udp", + "observer.product": "imidest", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.419", + "related.ip": [ + "10.66.92.83", + "10.151.206.38", + "10.119.12.186", + "10.97.105.115" + ], + "related.user": [ + "nproide" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "oloremi", + "rsa.misc.event_type": "oinvento", + "rsa.misc.obj_name": "ngelit", + "rsa.misc.policy_name": "quiano", + "rsa.misc.reference_id": "eddoeiu", + "rsa.misc.rule_name": "iaconse", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.419", + "rsa.network.alias_host": [ + "sequatD163.internal.example" + ], + "rsa.network.vlan": 3987, + "rsa.time.event_time_str": "Dec", + "rule.name": "iaconse", + "service.type": "f5", + "source.geo.country_name": "orinrep", + "source.ip": [ + "10.66.92.83" + ], + "source.nat.ip": "10.97.105.115", + "source.nat.port": 3576, + "source.port": 2549, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "nproide" + }, + { + "destination.geo.country_name": "volupt", + "destination.nat.ip": "10.64.76.142", + "destination.nat.port": 7083, + "destination.port": 61, + "event.action": "Accept", + "event.code": "enderi", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "umqu umet psaquaea5284.internal.example upt giatquo toccaec [F5@nihilmo acl_policy_name=atquo acl_policy_type=umetMa acl_rule_name=ngelitse action=Accept hostname=itamet1303.invalid bigip_mgmt_ip=10.12.148.73 context_name=eius context_type=evo date_time=Dec 21 2018 23:20:14 dest_ip=10.10.44.34 dst_geo=volupt dest_port=61 device_product=eosqu device_vendor=reetdolo device_version=1.7551 drop_reason=sten errdefs_msgno=enderi errdefs_msg_name=labore flow_id=uasiarch ip_protocol=igmp severity=very-high partition_name=magnama route_domain=reprehe sa_translation_pool=citatio sa_translation_type=dolo source_ip=10.201.132.114 src_geo=eetd source_port=6058 source_user=borisnis translated_dest_ip=10.64.76.142 translated_dest_port=7083 translated_ip_protocol=temse translated_route_domain=samvo translated_source_ip=10.169.139.250 translated_source_port=1374 translated_vlan=nostrume vlan=5035", + "fileset.name": "bigipafm", + "host.ip": "10.12.148.73", + "host.name": "itamet1303.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 65022, + "network.protocol": "igmp", + "observer.product": "eosqu", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7551", + "related.ip": [ + "10.12.148.73", + "10.201.132.114", + "10.169.139.250", + "10.64.76.142" + ], + "related.user": [ + "borisnis" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "eius", + "rsa.misc.event_type": "labore", + "rsa.misc.obj_name": "nihilmo", + "rsa.misc.policy_name": "atquo", + "rsa.misc.reference_id": "enderi", + "rsa.misc.rule_name": "ngelitse", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.7551", + "rsa.network.alias_host": [ + "itamet1303.invalid" + ], + "rsa.network.vlan": 5035, + "rsa.time.event_time_str": "Dec", + "rule.name": "ngelitse", + "service.type": "f5", + "source.geo.country_name": "eetd", + "source.ip": [ + "10.201.132.114" + ], + "source.nat.ip": "10.169.139.250", + "source.nat.port": 1374, + "source.port": 6058, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "borisnis" + }, + { + "destination.geo.country_name": "giatnula", + "destination.nat.ip": "10.35.38.185", + "destination.nat.port": 7077, + "destination.port": 71, + "event.action": "Drop", + "event.code": "sedq", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tatevel itin tam942.api.host iut leumiur deser [F5@boris acl_policy_name=ris acl_policy_type=nisiuta acl_rule_name=utper action=Drop hostname=epr3512.internal.domain bigip_mgmt_ip=10.9.236.18 context_name=iumdo context_type=exe date_time=Jan 05 2019 06:22:49 dest_ip=10.152.7.48 dst_geo=giatnula dest_port=71 device_product=enimadmi device_vendor=qui device_version=1.5292 drop_reason=aecon errdefs_msgno=sedq errdefs_msg_name=olo flow_id=sperna ip_protocol=udp severity=very-high partition_name=conseq route_domain=upta sa_translation_pool=eturadi sa_translation_type=cinge source_ip=10.111.128.11 src_geo=niamq source_port=5336 source_user=umfug translated_dest_ip=10.35.38.185 translated_dest_port=7077 translated_ip_protocol=labor translated_route_domain=Sec translated_source_ip=10.200.116.191 translated_source_port=3068 translated_vlan=nsecte vlan=5790", + "fileset.name": "bigipafm", + "host.ip": "10.9.236.18", + "host.name": "epr3512.internal.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 65915, + "network.protocol": "udp", + "observer.product": "enimadmi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5292", + "related.ip": [ + "10.35.38.185", + "10.9.236.18", + "10.111.128.11", + "10.200.116.191" + ], + "related.user": [ + "umfug" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "iumdo", + "rsa.misc.event_type": "olo", + "rsa.misc.obj_name": "boris", + "rsa.misc.policy_name": "ris", + "rsa.misc.reference_id": "sedq", + "rsa.misc.rule_name": "utper", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.5292", + "rsa.network.alias_host": [ + "epr3512.internal.domain" + ], + "rsa.network.vlan": 5790, + "rsa.time.event_time_str": "Jan", + "rule.name": "utper", + "service.type": "f5", + "source.geo.country_name": "niamq", + "source.ip": [ + "10.111.128.11" + ], + "source.nat.ip": "10.200.116.191", + "source.nat.port": 3068, + "source.port": 5336, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "umfug" + }, + { + "destination.geo.country_name": "rese", + "destination.nat.ip": "10.134.238.8", + "destination.nat.port": 2976, + "destination.port": 5302, + "event.action": "Reject", + "event.code": "ende", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "uianonnu por nve894.lan turadip ataev eFinib [F5@atione acl_policy_name=xcepte acl_policy_type=gnaa acl_rule_name=tio action=Reject hostname=uredol2174.home bigip_mgmt_ip=10.191.27.182 context_name=tMalo context_type=urautod date_time=Jan 19 2019 13:25:23 dest_ip=10.114.60.159 dst_geo=rese dest_port=5302 device_product=rissusci device_vendor=quaturve device_version=1.5991 drop_reason=tisunde errdefs_msgno=ende errdefs_msg_name=quidolor flow_id=lloin ip_protocol=igmp severity=high partition_name=proiden route_domain=moenimip sa_translation_pool=tat sa_translation_type=tate source_ip=10.236.67.227 src_geo=ern source_port=881 source_user=tlabo translated_dest_ip=10.134.238.8 translated_dest_port=2976 translated_ip_protocol=aqua translated_route_domain=edquiac translated_source_ip=10.240.62.238 translated_source_port=1251 translated_vlan=olo vlan=5926", + "fileset.name": "bigipafm", + "host.ip": "10.191.27.182", + "host.name": "uredol2174.home", + "input.type": "log", + "log.level": "high", + "log.offset": 66775, + "network.protocol": "igmp", + "observer.product": "rissusci", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5991", + "related.ip": [ + "10.236.67.227", + "10.134.238.8", + "10.240.62.238", + "10.191.27.182" + ], + "related.user": [ + "tlabo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "tMalo", + "rsa.misc.event_type": "quidolor", + "rsa.misc.obj_name": "atione", + "rsa.misc.policy_name": "xcepte", + "rsa.misc.reference_id": "ende", + "rsa.misc.rule_name": "tio", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5991", + "rsa.network.alias_host": [ + "uredol2174.home" + ], + "rsa.network.vlan": 5926, + "rsa.time.event_time_str": "Jan", + "rule.name": "tio", + "service.type": "f5", + "source.geo.country_name": "ern", + "source.ip": [ + "10.236.67.227" + ], + "source.nat.ip": "10.240.62.238", + "source.nat.port": 1251, + "source.port": 881, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tlabo" + }, + { + "destination.geo.country_name": "nimad", + "destination.nat.ip": "10.65.35.64", + "destination.nat.port": 2748, + "destination.port": 7814, + "event.action": "Drop", + "event.code": "oin", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ali Nequepor aUten4127.internal.lan apariatu mnisis onsequa [F5@sunt acl_policy_name=orumSe acl_policy_type=olupta acl_rule_name=emveleum action=Drop hostname=ididunt7607.mail.localhost bigip_mgmt_ip=10.165.66.92 context_name=isq context_type=eacommo date_time=Feb 02 2019 20:27:57 dest_ip=10.244.171.198 dst_geo=nimad dest_port=7814 device_product=asi device_vendor=tobe device_version=1.6837 drop_reason=Lore errdefs_msgno=oin errdefs_msg_name=eritquii flow_id=taliqui ip_protocol=ipv6-icmp severity=very-high partition_name=entoreve route_domain=ion sa_translation_pool=exeaco sa_translation_type=tate source_ip=10.109.14.142 src_geo=sitas source_port=6036 source_user=perna translated_dest_ip=10.65.35.64 translated_dest_port=2748 translated_ip_protocol=irur translated_route_domain=risnisiu translated_source_ip=10.22.231.91 translated_source_port=2652 translated_vlan=equepor vlan=897", + "fileset.name": "bigipafm", + "host.ip": "10.165.66.92", + "host.name": "ididunt7607.mail.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 67635, + "network.protocol": "ipv6-icmp", + "observer.product": "asi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6837", + "related.ip": [ + "10.109.14.142", + "10.65.35.64", + "10.165.66.92", + "10.22.231.91" + ], + "related.user": [ + "perna" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "isq", + "rsa.misc.event_type": "eritquii", + "rsa.misc.obj_name": "sunt", + "rsa.misc.policy_name": "orumSe", + "rsa.misc.reference_id": "oin", + "rsa.misc.rule_name": "emveleum", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.6837", + "rsa.network.alias_host": [ + "ididunt7607.mail.localhost" + ], + "rsa.network.vlan": 897, + "rsa.time.event_time_str": "Feb", + "rule.name": "emveleum", + "service.type": "f5", + "source.geo.country_name": "sitas", + "source.ip": [ + "10.109.14.142" + ], + "source.nat.ip": "10.22.231.91", + "source.nat.port": 2652, + "source.port": 6036, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "perna" + }, + { + "destination.geo.country_name": "rume", + "destination.nat.ip": "10.29.230.203", + "destination.nat.port": 6579, + "destination.port": 7667, + "event.action": "Reject", + "event.code": "prehende", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ugiatn utpe hend1170.www5.lan ptateve aliqua officiad [F5@nimadmin acl_policy_name=iavol acl_policy_type=roq acl_rule_name=iumtota action=Reject hostname=inimav5557.www5.test bigip_mgmt_ip=10.71.112.86 context_name=olor context_type=emoenim date_time=Feb 17 2019 03:30:32 dest_ip=10.57.64.102 dst_geo=rume dest_port=7667 device_product=inibusBo device_vendor=tqui device_version=1.99 drop_reason=citat errdefs_msgno=prehende errdefs_msg_name=vitaedic flow_id=remip ip_protocol=ggp severity=high partition_name=rehe route_domain=aper sa_translation_pool=gnaa sa_translation_type=tam source_ip=10.64.161.215 src_geo=modi source_port=4869 source_user=rnatur translated_dest_ip=10.29.230.203 translated_dest_port=6579 translated_ip_protocol=abi translated_route_domain=inimaven translated_source_ip=10.89.221.90 translated_source_port=5835 translated_vlan=entoreve vlan=4612", + "fileset.name": "bigipafm", + "host.ip": "10.71.112.86", + "host.name": "inimav5557.www5.test", + "input.type": "log", + "log.level": "high", + "log.offset": 68526, + "network.protocol": "ggp", + "observer.product": "inibusBo", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.99", + "related.ip": [ + "10.29.230.203", + "10.89.221.90", + "10.71.112.86", + "10.64.161.215" + ], + "related.user": [ + "rnatur" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "olor", + "rsa.misc.event_type": "vitaedic", + "rsa.misc.obj_name": "nimadmin", + "rsa.misc.policy_name": "iavol", + "rsa.misc.reference_id": "prehende", + "rsa.misc.rule_name": "iumtota", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.99", + "rsa.network.alias_host": [ + "inimav5557.www5.test" + ], + "rsa.network.vlan": 4612, + "rsa.time.event_time_str": "Feb", + "rule.name": "iumtota", + "service.type": "f5", + "source.geo.country_name": "modi", + "source.ip": [ + "10.64.161.215" + ], + "source.nat.ip": "10.89.221.90", + "source.nat.port": 5835, + "source.port": 4869, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "rnatur" + }, + { + "destination.geo.country_name": "aliquide", + "destination.nat.ip": "10.221.199.137", + "destination.nat.port": 6430, + "destination.port": 7187, + "event.action": "Closed", + "event.code": "urm", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "roqu dquia ommod142.www.home ptate oloreeu imipsa [F5@iscinge acl_policy_name=ora acl_policy_type=meumfug acl_rule_name=inimve action=Closed hostname=nonn1650.www.test bigip_mgmt_ip=10.88.226.76 context_name=ptas context_type=iadolo date_time=Mar 03 2019 10:33:06 dest_ip=10.217.197.29 dst_geo=aliquide dest_port=7187 device_product=tinv device_vendor=iar device_version=1.5232 drop_reason=mquela errdefs_msgno=urm errdefs_msg_name=con flow_id=aeabil ip_protocol=udp severity=low partition_name=edicta route_domain=itaspern sa_translation_pool=tau sa_translation_type=rcit source_ip=10.79.208.135 src_geo=rehende source_port=3688 source_user=erspic translated_dest_ip=10.221.199.137 translated_dest_port=6430 translated_ip_protocol=quipe translated_route_domain=evita translated_source_ip=10.140.118.182 translated_source_port=4566 translated_vlan=nia vlan=7548", + "fileset.name": "bigipafm", + "host.ip": "10.88.226.76", + "host.name": "nonn1650.www.test", + "input.type": "log", + "log.level": "low", + "log.offset": 69397, + "network.protocol": "udp", + "observer.product": "tinv", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.5232", + "related.ip": [ + "10.140.118.182", + "10.88.226.76", + "10.221.199.137", + "10.79.208.135" + ], + "related.user": [ + "erspic" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ptas", + "rsa.misc.event_type": "con", + "rsa.misc.obj_name": "iscinge", + "rsa.misc.policy_name": "ora", + "rsa.misc.reference_id": "urm", + "rsa.misc.rule_name": "inimve", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.5232", + "rsa.network.alias_host": [ + "nonn1650.www.test" + ], + "rsa.network.vlan": 7548, + "rsa.time.event_time_str": "Mar", + "rule.name": "inimve", + "service.type": "f5", + "source.geo.country_name": "rehende", + "source.ip": [ + "10.79.208.135" + ], + "source.nat.ip": "10.140.118.182", + "source.nat.port": 4566, + "source.port": 3688, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "erspic" + }, + { + "destination.geo.country_name": "oreve", + "destination.nat.ip": "10.126.61.230", + "destination.nat.port": 2068, + "destination.port": 2538, + "event.action": "Reject", + "event.code": "Exce", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "npro boriosa sundeo3076.internal.test Nequepor turQ tod [F5@rsitame acl_policy_name=nsectetu acl_policy_type=untexpli acl_rule_name=smo action=Reject hostname=acons3940.api.lan bigip_mgmt_ip=10.133.48.55 context_name=lab context_type=ela date_time=Mar 17 2019 17:35:40 dest_ip=10.134.141.37 dst_geo=oreve dest_port=2538 device_product=tali device_vendor=quamnih device_version=1.2492 drop_reason=reprehen errdefs_msgno=Exce errdefs_msg_name=tocca flow_id=tinvolu ip_protocol=ipv6 severity=low partition_name=iumt route_domain=mad sa_translation_pool=mpor sa_translation_type=eddoei source_ip=10.35.73.208 src_geo=dolo source_port=6552 source_user=tia translated_dest_ip=10.126.61.230 translated_dest_port=2068 translated_ip_protocol=dolor translated_route_domain=emUteni translated_source_ip=10.189.244.22 translated_source_port=734 translated_vlan=rinre vlan=6425", + "fileset.name": "bigipafm", + "host.ip": "10.133.48.55", + "host.name": "acons3940.api.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 70259, + "network.protocol": "ipv6", + "observer.product": "tali", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2492", + "related.ip": [ + "10.133.48.55", + "10.126.61.230", + "10.35.73.208", + "10.189.244.22" + ], + "related.user": [ + "tia" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "lab", + "rsa.misc.event_type": "tocca", + "rsa.misc.obj_name": "rsitame", + "rsa.misc.policy_name": "nsectetu", + "rsa.misc.reference_id": "Exce", + "rsa.misc.rule_name": "smo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.2492", + "rsa.network.alias_host": [ + "acons3940.api.lan" + ], + "rsa.network.vlan": 6425, + "rsa.time.event_time_str": "Mar", + "rule.name": "smo", + "service.type": "f5", + "source.geo.country_name": "dolo", + "source.ip": [ + "10.35.73.208" + ], + "source.nat.ip": "10.189.244.22", + "source.nat.port": 734, + "source.port": 6552, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tia" + }, + { + "destination.geo.country_name": "ostr", + "destination.nat.ip": "10.239.194.105", + "destination.nat.port": 3629, + "destination.port": 575, + "event.action": "Established", + "event.code": "olors", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ident uatur dquiaco2756.home uiine mve dolorema [F5@ditautf acl_policy_name=uisnostr acl_policy_type=oditautf acl_rule_name=nula action=Established hostname=suscipit587.www.localhost bigip_mgmt_ip=10.81.154.115 context_name=ita context_type=aeratvol date_time=Apr 01 2019 00:38:14 dest_ip=10.194.94.1 dst_geo=ostr dest_port=575 device_product=boreetd device_vendor=ueporro device_version=1.4044 drop_reason=oluptat errdefs_msgno=olors errdefs_msg_name=mSecti flow_id=ius ip_protocol=icmp severity=very-high partition_name=xerci route_domain=qua sa_translation_pool=iaecons sa_translation_type=pteurs source_ip=10.35.65.72 src_geo=veni source_port=3387 source_user=reseo translated_dest_ip=10.239.194.105 translated_dest_port=3629 translated_ip_protocol=isnos translated_route_domain=ntin translated_source_ip=10.240.94.109 translated_source_port=5437 translated_vlan=ono vlan=573", + "fileset.name": "bigipafm", + "host.ip": "10.81.154.115", + "host.name": "suscipit587.www.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 71124, + "network.protocol": "icmp", + "observer.product": "boreetd", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4044", + "related.ip": [ + "10.81.154.115", + "10.240.94.109", + "10.239.194.105", + "10.35.65.72" + ], + "related.user": [ + "reseo" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "ita", + "rsa.misc.event_type": "mSecti", + "rsa.misc.obj_name": "ditautf", + "rsa.misc.policy_name": "uisnostr", + "rsa.misc.reference_id": "olors", + "rsa.misc.rule_name": "nula", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.4044", + "rsa.network.alias_host": [ + "suscipit587.www.localhost" + ], + "rsa.network.vlan": 573, + "rsa.time.event_time_str": "Apr", + "rule.name": "nula", + "service.type": "f5", + "source.geo.country_name": "veni", + "source.ip": [ + "10.35.65.72" + ], + "source.nat.ip": "10.240.94.109", + "source.nat.port": 5437, + "source.port": 3387, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "reseo" + }, + { + "destination.geo.country_name": "obeatae", + "destination.nat.ip": "10.248.72.104", + "destination.nat.port": 7485, + "destination.port": 2042, + "event.action": "Established", + "event.code": "emagnaal", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "consequ ine hend3901.www.localdomain nsecte miurere tat [F5@pitlabor acl_policy_name=upi acl_policy_type=olupta acl_rule_name=ape action=Established hostname=mnisiut6146.internal.local bigip_mgmt_ip=10.52.70.192 context_name=empor context_type=ate date_time=Apr 15 2019 07:40:49 dest_ip=10.234.254.96 dst_geo=obeatae dest_port=2042 device_product=orem device_vendor=dquian device_version=1.2307 drop_reason=uis errdefs_msgno=emagnaal errdefs_msg_name=uunturm flow_id=nonnumq ip_protocol=ggp severity=very-high partition_name=ntocca route_domain=emquelau sa_translation_pool=adolorsi sa_translation_type=lupt source_ip=10.38.253.213 src_geo=ncidu source_port=3369 source_user=ionem translated_dest_ip=10.248.72.104 translated_dest_port=7485 translated_ip_protocol=cusan translated_route_domain=ivelit translated_source_ip=10.150.56.227 translated_source_port=4686 translated_vlan=isnost vlan=4697", + "fileset.name": "bigipafm", + "host.ip": "10.52.70.192", + "host.name": "mnisiut6146.internal.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 72004, + "network.protocol": "ggp", + "observer.product": "orem", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2307", + "related.ip": [ + "10.150.56.227", + "10.38.253.213", + "10.248.72.104", + "10.52.70.192" + ], + "related.user": [ + "ionem" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "empor", + "rsa.misc.event_type": "uunturm", + "rsa.misc.obj_name": "pitlabor", + "rsa.misc.policy_name": "upi", + "rsa.misc.reference_id": "emagnaal", + "rsa.misc.rule_name": "ape", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2307", + "rsa.network.alias_host": [ + "mnisiut6146.internal.local" + ], + "rsa.network.vlan": 4697, + "rsa.time.event_time_str": "Apr", + "rule.name": "ape", + "service.type": "f5", + "source.geo.country_name": "ncidu", + "source.ip": [ + "10.38.253.213" + ], + "source.nat.ip": "10.150.56.227", + "source.nat.port": 4686, + "source.port": 3369, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ionem" + }, + { + "destination.geo.country_name": "aaliq", + "destination.nat.ip": "10.73.172.186", + "destination.nat.port": 3510, + "destination.port": 2143, + "event.action": "Reject", + "event.code": "agn", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "urQu idol fici312.api.host eri pitlab riosamn [F5@Malo acl_policy_name=onse acl_policy_type=enatuse acl_rule_name=veritat action=Reject hostname=borios1067.www5.home bigip_mgmt_ip=10.218.15.164 context_name=ntNeque context_type=magnidol date_time=Apr 29 2019 14:43:23 dest_ip=10.56.60.3 dst_geo=aaliq dest_port=2143 device_product=gel device_vendor=modt device_version=1.2031 drop_reason=mvolu errdefs_msgno=agn errdefs_msg_name=eritinvo flow_id=aliq ip_protocol=rdp severity=very-high partition_name=uisautei route_domain=labor sa_translation_pool=ihilmol sa_translation_type=scinge source_ip=10.62.218.239 src_geo=yCiceroi source_port=166 source_user=reh translated_dest_ip=10.73.172.186 translated_dest_port=3510 translated_ip_protocol=itte translated_route_domain=niamquis translated_source_ip=10.203.193.134 translated_source_port=6251 translated_vlan=riosa vlan=7445", + "fileset.name": "bigipafm", + "host.ip": "10.218.15.164", + "host.name": "borios1067.www5.home", + "input.type": "log", + "log.level": "very-high", + "log.offset": 72900, + "network.protocol": "rdp", + "observer.product": "gel", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2031", + "related.ip": [ + "10.73.172.186", + "10.218.15.164", + "10.62.218.239", + "10.203.193.134" + ], + "related.user": [ + "reh" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "ntNeque", + "rsa.misc.event_type": "eritinvo", + "rsa.misc.obj_name": "Malo", + "rsa.misc.policy_name": "onse", + "rsa.misc.reference_id": "agn", + "rsa.misc.rule_name": "veritat", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2031", + "rsa.network.alias_host": [ + "borios1067.www5.home" + ], + "rsa.network.vlan": 7445, + "rsa.time.event_time_str": "Apr", + "rule.name": "veritat", + "service.type": "f5", + "source.geo.country_name": "yCiceroi", + "source.ip": [ + "10.62.218.239" + ], + "source.nat.ip": "10.203.193.134", + "source.nat.port": 6251, + "source.port": 166, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "reh" + }, + { + "destination.geo.country_name": "quaeabi", + "destination.nat.ip": "10.136.211.234", + "destination.nat.port": 4126, + "destination.port": 5701, + "event.action": "Established", + "event.code": "uovolup", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ore ptatema poriss2289.localdomain luptat ficiad saquaea [F5@archi acl_policy_name=caboNe acl_policy_type=ptate acl_rule_name=enimips action=Established hostname=msequ323.www.example bigip_mgmt_ip=10.60.20.76 context_name=seq context_type=uae date_time=May 13 2019 21:45:57 dest_ip=10.244.241.67 dst_geo=quaeabi dest_port=5701 device_product=ost device_vendor=mave device_version=1.2555 drop_reason=aev errdefs_msgno=uovolup errdefs_msg_name=tMaloru flow_id=rum ip_protocol=ipv6-icmp severity=very-high partition_name=ptassita route_domain=ionemul sa_translation_pool=orema sa_translation_type=its source_ip=10.10.46.43 src_geo=stiaec source_port=7346 source_user=nev translated_dest_ip=10.136.211.234 translated_dest_port=4126 translated_ip_protocol=lamcor translated_route_domain=rorsitv translated_source_ip=10.131.127.113 translated_source_port=853 translated_vlan=iamqu vlan=1324", + "fileset.name": "bigipafm", + "host.ip": "10.60.20.76", + "host.name": "msequ323.www.example", + "input.type": "log", + "log.level": "very-high", + "log.offset": 73773, + "network.protocol": "ipv6-icmp", + "observer.product": "ost", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2555", + "related.ip": [ + "10.60.20.76", + "10.10.46.43", + "10.136.211.234", + "10.131.127.113" + ], + "related.user": [ + "nev" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "seq", + "rsa.misc.event_type": "tMaloru", + "rsa.misc.obj_name": "archi", + "rsa.misc.policy_name": "caboNe", + "rsa.misc.reference_id": "uovolup", + "rsa.misc.rule_name": "enimips", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2555", + "rsa.network.alias_host": [ + "msequ323.www.example" + ], + "rsa.network.vlan": 1324, + "rsa.time.event_time_str": "May", + "rule.name": "enimips", + "service.type": "f5", + "source.geo.country_name": "stiaec", + "source.ip": [ + "10.10.46.43" + ], + "source.nat.ip": "10.131.127.113", + "source.nat.port": 853, + "source.port": 7346, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "nev" + }, + { + "destination.geo.country_name": "fdeFini", + "destination.nat.ip": "10.187.237.220", + "destination.nat.port": 7744, + "destination.port": 1295, + "event.action": "Closed", + "event.code": "rinc", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "mwrit dminimve madminim5473.mail.example reeuf orinrepr tinvo [F5@oru acl_policy_name=ainc acl_policy_type=aeab acl_rule_name=iat action=Closed hostname=tdolorem813.internal.host bigip_mgmt_ip=10.50.177.151 context_name=rsitam context_type=aliqui date_time=May 28 2019 04:48:31 dest_ip=10.206.65.159 dst_geo=fdeFini dest_port=1295 device_product=eetdolo device_vendor=issuscip device_version=1.3291 drop_reason=tqu errdefs_msgno=rinc errdefs_msg_name=hender flow_id=sBonor ip_protocol=rdp severity=high partition_name=ercitati route_domain=lapa sa_translation_pool=enia sa_translation_type=atis source_ip=10.233.181.250 src_geo=isiuta source_port=2868 source_user=ugiatq translated_dest_ip=10.187.237.220 translated_dest_port=7744 translated_ip_protocol=eumfu translated_route_domain=remap translated_source_ip=10.248.0.74 translated_source_port=6349 translated_vlan=tru vlan=2520", + "fileset.name": "bigipafm", + "host.ip": "10.50.177.151", + "host.name": "tdolorem813.internal.host", + "input.type": "log", + "log.level": "high", + "log.offset": 74658, + "network.protocol": "rdp", + "observer.product": "eetdolo", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3291", + "related.ip": [ + "10.233.181.250", + "10.248.0.74", + "10.50.177.151", + "10.187.237.220" + ], + "related.user": [ + "ugiatq" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "rsitam", + "rsa.misc.event_type": "hender", + "rsa.misc.obj_name": "oru", + "rsa.misc.policy_name": "ainc", + "rsa.misc.reference_id": "rinc", + "rsa.misc.rule_name": "iat", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.3291", + "rsa.network.alias_host": [ + "tdolorem813.internal.host" + ], + "rsa.network.vlan": 2520, + "rsa.time.event_time_str": "May", + "rule.name": "iat", + "service.type": "f5", + "source.geo.country_name": "isiuta", + "source.ip": [ + "10.233.181.250" + ], + "source.nat.ip": "10.248.0.74", + "source.nat.port": 6349, + "source.port": 2868, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ugiatq" + }, + { + "destination.geo.country_name": "olab", + "destination.nat.ip": "10.96.223.46", + "destination.nat.port": 3654, + "destination.port": 629, + "event.action": "Established", + "event.code": "ela", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "isautem eiusm assit1598.www5.invalid archite eruntm iades [F5@mremape acl_policy_name=nimad acl_policy_type=ionemu acl_rule_name=nul action=Established hostname=volupt4626.internal.test bigip_mgmt_ip=10.189.43.11 context_name=asper context_type=eeu date_time=Jun 11 2019 11:51:06 dest_ip=10.193.169.102 dst_geo=olab dest_port=629 device_product=olore device_vendor=mSecti device_version=1.2859 drop_reason=idid errdefs_msgno=ela errdefs_msg_name=fugits flow_id=litseddo ip_protocol=igmp severity=medium partition_name=ptasn route_domain=amrem sa_translation_pool=umdolor sa_translation_type=iamq source_ip=10.248.248.120 src_geo=ationemu source_port=1282 source_user=iatn translated_dest_ip=10.96.223.46 translated_dest_port=3654 translated_ip_protocol=pern translated_route_domain=ptasn translated_source_ip=10.80.129.81 translated_source_port=4827 translated_vlan=tat vlan=5084", + "fileset.name": "bigipafm", + "host.ip": "10.189.43.11", + "host.name": "volupt4626.internal.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 75539, + "network.protocol": "igmp", + "observer.product": "olore", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2859", + "related.ip": [ + "10.248.248.120", + "10.96.223.46", + "10.189.43.11", + "10.80.129.81" + ], + "related.user": [ + "iatn" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "asper", + "rsa.misc.event_type": "fugits", + "rsa.misc.obj_name": "mremape", + "rsa.misc.policy_name": "nimad", + "rsa.misc.reference_id": "ela", + "rsa.misc.rule_name": "nul", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.2859", + "rsa.network.alias_host": [ + "volupt4626.internal.test" + ], + "rsa.network.vlan": 5084, + "rsa.time.event_time_str": "Jun", + "rule.name": "nul", + "service.type": "f5", + "source.geo.country_name": "ationemu", + "source.ip": [ + "10.248.248.120" + ], + "source.nat.ip": "10.80.129.81", + "source.nat.port": 4827, + "source.port": 1282, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "iatn" + }, + { + "destination.geo.country_name": "metco", + "destination.nat.ip": "10.173.114.63", + "destination.nat.port": 5877, + "destination.port": 4740, + "event.action": "Closed", + "event.code": "radip", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "eruntmo lumdolo urmagnid2749.api.host imip taspe siutaliq [F5@turadipi acl_policy_name=tMalo acl_policy_type=veni acl_rule_name=rspi action=Closed hostname=ntium5103.www5.localhost bigip_mgmt_ip=10.66.106.186 context_name=uatD context_type=reh date_time=Jun 25 2019 18:53:40 dest_ip=10.36.14.238 dst_geo=metco dest_port=4740 device_product=ilmoles device_vendor=xeaco device_version=1.1910 drop_reason=ccaecat errdefs_msgno=radip errdefs_msg_name=secil flow_id=totamr ip_protocol=udp severity=very-high partition_name=iciat route_domain=uira sa_translation_pool=orio sa_translation_type=mseq source_ip=10.102.109.199 src_geo=iono source_port=2061 source_user=tNequ translated_dest_ip=10.173.114.63 translated_dest_port=5877 translated_ip_protocol=tatisetq translated_route_domain=eabilloi translated_source_ip=10.91.115.139 translated_source_port=412 translated_vlan=eroi vlan=2077", + "fileset.name": "bigipafm", + "host.ip": "10.66.106.186", + "host.name": "ntium5103.www5.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 76419, + "network.protocol": "udp", + "observer.product": "ilmoles", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.1910", + "related.ip": [ + "10.173.114.63", + "10.102.109.199", + "10.91.115.139", + "10.66.106.186" + ], + "related.user": [ + "tNequ" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "uatD", + "rsa.misc.event_type": "secil", + "rsa.misc.obj_name": "turadipi", + "rsa.misc.policy_name": "tMalo", + "rsa.misc.reference_id": "radip", + "rsa.misc.rule_name": "rspi", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.1910", + "rsa.network.alias_host": [ + "ntium5103.www5.localhost" + ], + "rsa.network.vlan": 2077, + "rsa.time.event_time_str": "Jun", + "rule.name": "rspi", + "service.type": "f5", + "source.geo.country_name": "iono", + "source.ip": [ + "10.102.109.199" + ], + "source.nat.ip": "10.91.115.139", + "source.nat.port": 412, + "source.port": 2061, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tNequ" + }, + { + "destination.geo.country_name": "iratio", + "destination.nat.ip": "10.0.175.17", + "destination.nat.port": 5236, + "destination.port": 7700, + "event.action": "Drop", + "event.code": "iur", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "riatur amrema illum2978.internal.home rumetMa entor urere [F5@involu acl_policy_name=qui acl_policy_type=aliqu acl_rule_name=sita action=Drop hostname=orpori3334.www.local bigip_mgmt_ip=10.198.157.122 context_name=ncu context_type=quatu date_time=Jul 10 2019 01:56:14 dest_ip=10.239.90.72 dst_geo=iratio dest_port=7700 device_product=its device_vendor=agn device_version=1.3690 drop_reason=ntmo errdefs_msgno=iur errdefs_msg_name=aboNemo flow_id=tsedquia ip_protocol=udp severity=very-high partition_name=tatiset route_domain=enim sa_translation_pool=gnido sa_translation_type=iamq source_ip=10.159.155.88 src_geo=uisa source_port=7034 source_user=iquipex translated_dest_ip=10.0.175.17 translated_dest_port=5236 translated_ip_protocol=tempori translated_route_domain=sedquian translated_source_ip=10.221.223.127 translated_source_port=2687 translated_vlan=ira vlan=3007", + "fileset.name": "bigipafm", + "host.ip": "10.198.157.122", + "host.name": "orpori3334.www.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 77301, + "network.protocol": "udp", + "observer.product": "its", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3690", + "related.ip": [ + "10.159.155.88", + "10.0.175.17", + "10.198.157.122", + "10.221.223.127" + ], + "related.user": [ + "iquipex" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Drop" + ], + "rsa.misc.context": "ncu", + "rsa.misc.event_type": "aboNemo", + "rsa.misc.obj_name": "involu", + "rsa.misc.policy_name": "qui", + "rsa.misc.reference_id": "iur", + "rsa.misc.rule_name": "sita", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3690", + "rsa.network.alias_host": [ + "orpori3334.www.local" + ], + "rsa.network.vlan": 3007, + "rsa.time.event_time_str": "Jul", + "rule.name": "sita", + "service.type": "f5", + "source.geo.country_name": "uisa", + "source.ip": [ + "10.159.155.88" + ], + "source.nat.ip": "10.221.223.127", + "source.nat.port": 2687, + "source.port": 7034, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "iquipex" + }, + { + "destination.geo.country_name": "chitect", + "destination.nat.ip": "10.252.136.130", + "destination.nat.port": 5601, + "destination.port": 5316, + "event.action": "Established", + "event.code": "ueporr", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "idolor umdo sequatu7142.internal.corp ipsaqu asun rsitam [F5@magn acl_policy_name=amcola acl_policy_type=eumiurer acl_rule_name=umf action=Established hostname=equu7361.www5.localdomain bigip_mgmt_ip=10.30.20.187 context_name=rsinto context_type=nonnumqu date_time=Jul 24 2019 08:58:48 dest_ip=10.103.47.100 dst_geo=chitect dest_port=5316 device_product=fug device_vendor=ulpaq device_version=1.6302 drop_reason=piscivel errdefs_msgno=ueporr errdefs_msg_name=udex flow_id=ipexeac ip_protocol=tcp severity=low partition_name=isci route_domain=archi sa_translation_pool=rsitame sa_translation_type=qui source_ip=10.7.212.201 src_geo=ion source_port=949 source_user=ugiat translated_dest_ip=10.252.136.130 translated_dest_port=5601 translated_ip_protocol=expl translated_route_domain=animi translated_source_ip=10.189.70.237 translated_source_port=1457 translated_vlan=tnul vlan=24", + "fileset.name": "bigipafm", + "host.ip": "10.30.20.187", + "host.name": "equu7361.www5.localdomain", + "input.type": "log", + "log.level": "low", + "log.offset": 78172, + "network.protocol": "tcp", + "observer.product": "fug", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.6302", + "related.ip": [ + "10.252.136.130", + "10.189.70.237", + "10.30.20.187", + "10.7.212.201" + ], + "related.user": [ + "ugiat" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "rsinto", + "rsa.misc.event_type": "udex", + "rsa.misc.obj_name": "magn", + "rsa.misc.policy_name": "amcola", + "rsa.misc.reference_id": "ueporr", + "rsa.misc.rule_name": "umf", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.6302", + "rsa.network.alias_host": [ + "equu7361.www5.localdomain" + ], + "rsa.network.vlan": 24, + "rsa.time.event_time_str": "Jul", + "rule.name": "umf", + "service.type": "f5", + "source.geo.country_name": "ion", + "source.ip": [ + "10.7.212.201" + ], + "source.nat.ip": "10.189.70.237", + "source.nat.port": 1457, + "source.port": 949, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ugiat" + }, + { + "destination.geo.country_name": "imadmi", + "destination.nat.ip": "10.102.109.194", + "destination.nat.port": 2324, + "destination.port": 2642, + "event.action": "Established", + "event.code": "agn", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "radip amremap dolorsit64.www.local uredo uamni nisi [F5@onsecte acl_policy_name=iono acl_policy_type=secillum acl_rule_name=sequatD action=Established hostname=tse2979.internal.localhost bigip_mgmt_ip=10.242.121.165 context_name=aut context_type=eriti date_time=Aug 07 2019 16:01:23 dest_ip=10.88.229.78 dst_geo=imadmi dest_port=2642 device_product=tevelite device_vendor=cto device_version=1.2037 drop_reason=mquiado errdefs_msgno=agn errdefs_msg_name=dip flow_id=urmag ip_protocol=tcp severity=high partition_name=laboreet route_domain=tutlabo sa_translation_pool=incid sa_translation_type=der source_ip=10.83.105.69 src_geo=usm source_port=2153 source_user=mni translated_dest_ip=10.102.109.194 translated_dest_port=2324 translated_ip_protocol=nor translated_route_domain=saut translated_source_ip=10.60.224.93 translated_source_port=1508 translated_vlan=deomnis vlan=354", + "fileset.name": "bigipafm", + "host.ip": "10.242.121.165", + "host.name": "tse2979.internal.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 79051, + "network.protocol": "tcp", + "observer.product": "tevelite", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2037", + "related.ip": [ + "10.102.109.194", + "10.60.224.93", + "10.242.121.165", + "10.83.105.69" + ], + "related.user": [ + "mni" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "aut", + "rsa.misc.event_type": "dip", + "rsa.misc.obj_name": "onsecte", + "rsa.misc.policy_name": "iono", + "rsa.misc.reference_id": "agn", + "rsa.misc.rule_name": "sequatD", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2037", + "rsa.network.alias_host": [ + "tse2979.internal.localhost" + ], + "rsa.network.vlan": 354, + "rsa.time.event_time_str": "Aug", + "rule.name": "sequatD", + "service.type": "f5", + "source.geo.country_name": "usm", + "source.ip": [ + "10.83.105.69" + ], + "source.nat.ip": "10.60.224.93", + "source.nat.port": 1508, + "source.port": 2153, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "mni" + }, + { + "destination.geo.country_name": "tenbyCi", + "destination.nat.ip": "10.181.134.69", + "destination.nat.port": 551, + "destination.port": 4371, + "event.action": "Accept", + "event.code": "tion", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "tla nimve edutpe1255.internal.lan nimadm cepte paquioff [F5@ictasun acl_policy_name=iumto acl_policy_type=ciun acl_rule_name=prehe action=Accept hostname=uisnostr2390.mail.domain bigip_mgmt_ip=10.251.167.219 context_name=eaco context_type=oremeu date_time=Aug 21 2019 23:03:57 dest_ip=10.14.251.18 dst_geo=tenbyCi dest_port=4371 device_product=citation device_vendor=spernatu device_version=1.7314 drop_reason=giatq errdefs_msgno=tion errdefs_msg_name=tNeque flow_id=uidolore ip_protocol=rdp severity=medium partition_name=usB route_domain=magnaali sa_translation_pool=istenatu sa_translation_type=roqui source_ip=10.17.20.93 src_geo=eritqu source_port=4368 source_user=Uteni translated_dest_ip=10.181.134.69 translated_dest_port=551 translated_ip_protocol=norum translated_route_domain=emUten translated_source_ip=10.219.174.45 translated_source_port=4055 translated_vlan=idolo vlan=968", + "fileset.name": "bigipafm", + "host.ip": "10.251.167.219", + "host.name": "uisnostr2390.mail.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 79926, + "network.protocol": "rdp", + "observer.product": "citation", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7314", + "related.ip": [ + "10.251.167.219", + "10.219.174.45", + "10.181.134.69", + "10.17.20.93" + ], + "related.user": [ + "Uteni" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "eaco", + "rsa.misc.event_type": "tNeque", + "rsa.misc.obj_name": "ictasun", + "rsa.misc.policy_name": "iumto", + "rsa.misc.reference_id": "tion", + "rsa.misc.rule_name": "prehe", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7314", + "rsa.network.alias_host": [ + "uisnostr2390.mail.domain" + ], + "rsa.network.vlan": 968, + "rsa.time.event_time_str": "Aug", + "rule.name": "prehe", + "service.type": "f5", + "source.geo.country_name": "eritqu", + "source.ip": [ + "10.17.20.93" + ], + "source.nat.ip": "10.219.174.45", + "source.nat.port": 4055, + "source.port": 4368, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "Uteni" + }, + { + "destination.geo.country_name": "elaud", + "destination.nat.ip": "10.28.233.253", + "destination.nat.port": 1159, + "destination.port": 4916, + "event.action": "Accept", + "event.code": "iti", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "mmodicon nisis edquia4523.www.host remap ntium veniamqu [F5@equat acl_policy_name=reeu acl_policy_type=atemacc acl_rule_name=rsitvolu action=Accept hostname=luptate4811.mail.example bigip_mgmt_ip=10.30.117.82 context_name=destlabo context_type=fficia date_time=Sep 05 2019 06:06:31 dest_ip=10.245.75.229 dst_geo=elaud dest_port=4916 device_product=eaqueip device_vendor=emUten device_version=1.596 drop_reason=itseddoe errdefs_msgno=iti errdefs_msg_name=evitaedi flow_id=ionulamc ip_protocol=tcp severity=high partition_name=culp route_domain=Ciceroin sa_translation_pool=aeco sa_translation_type=olores source_ip=10.223.99.90 src_geo=adminim source_port=4324 source_user=numqua translated_dest_ip=10.28.233.253 translated_dest_port=1159 translated_ip_protocol=mUten translated_route_domain=eursint translated_source_ip=10.37.14.20 translated_source_port=6531 translated_vlan=teurs vlan=4919", + "fileset.name": "bigipafm", + "host.ip": "10.30.117.82", + "host.name": "luptate4811.mail.example", + "input.type": "log", + "log.level": "high", + "log.offset": 80814, + "network.protocol": "tcp", + "observer.product": "eaqueip", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.596", + "related.ip": [ + "10.30.117.82", + "10.28.233.253", + "10.223.99.90", + "10.37.14.20" + ], + "related.user": [ + "numqua" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Permit", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Accept" + ], + "rsa.misc.context": "destlabo", + "rsa.misc.event_type": "evitaedi", + "rsa.misc.obj_name": "equat", + "rsa.misc.policy_name": "reeu", + "rsa.misc.reference_id": "iti", + "rsa.misc.rule_name": "rsitvolu", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.596", + "rsa.network.alias_host": [ + "luptate4811.mail.example" + ], + "rsa.network.vlan": 4919, + "rsa.time.event_time_str": "Sep", + "rule.name": "rsitvolu", + "service.type": "f5", + "source.geo.country_name": "adminim", + "source.ip": [ + "10.223.99.90" + ], + "source.nat.ip": "10.37.14.20", + "source.nat.port": 6531, + "source.port": 4324, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "numqua" + }, + { + "destination.geo.country_name": "tess", + "destination.nat.ip": "10.57.85.113", + "destination.nat.port": 1024, + "destination.port": 4686, + "event.action": "Closed", + "event.code": "rainc", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "aaliq nos uaUteni562.www.test deF dutpe tseddoei [F5@byCi acl_policy_name=odic acl_policy_type=chitecto acl_rule_name=nimadm action=Closed hostname=lites1614.www.corp bigip_mgmt_ip=10.125.20.22 context_name=olu context_type=ectet date_time=Sep 19 2019 13:09:05 dest_ip=10.121.189.113 dst_geo=tess dest_port=4686 device_product=xeacom device_vendor=adminim device_version=1.95 drop_reason=henderi errdefs_msgno=rainc errdefs_msg_name=dminim flow_id=sse ip_protocol=tcp severity=high partition_name=umexe route_domain=Sedu sa_translation_pool=tetur sa_translation_type=ern source_ip=10.50.61.114 src_geo=nvento source_port=649 source_user=qua translated_dest_ip=10.57.85.113 translated_dest_port=1024 translated_ip_protocol=itquii translated_route_domain=psu translated_source_ip=10.8.32.17 translated_source_port=3788 translated_vlan=nem vlan=5883", + "fileset.name": "bigipafm", + "host.ip": "10.125.20.22", + "host.name": "lites1614.www.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 81706, + "network.protocol": "tcp", + "observer.product": "xeacom", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.95", + "related.ip": [ + "10.50.61.114", + "10.125.20.22", + "10.57.85.113", + "10.8.32.17" + ], + "related.user": [ + "qua" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "olu", + "rsa.misc.event_type": "dminim", + "rsa.misc.obj_name": "byCi", + "rsa.misc.policy_name": "odic", + "rsa.misc.reference_id": "rainc", + "rsa.misc.rule_name": "nimadm", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.95", + "rsa.network.alias_host": [ + "lites1614.www.corp" + ], + "rsa.network.vlan": 5883, + "rsa.time.event_time_str": "Sep", + "rule.name": "nimadm", + "service.type": "f5", + "source.geo.country_name": "nvento", + "source.ip": [ + "10.50.61.114" + ], + "source.nat.ip": "10.8.32.17", + "source.nat.port": 3788, + "source.port": 649, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "qua" + }, + { + "destination.geo.country_name": "voluptat", + "destination.nat.ip": "10.113.78.101", + "destination.nat.port": 2707, + "destination.port": 1549, + "event.action": "Closed", + "event.code": "tam", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "sitasper agni ivelit1640.internal.lan iscive prehende volup [F5@nimi acl_policy_name=niamqu acl_policy_type=uioffi acl_rule_name=suntin action=Closed hostname=lorinrep7686.mail.corp bigip_mgmt_ip=10.200.28.55 context_name=ineavol context_type=abor date_time=Oct 03 2019 20:11:40 dest_ip=10.232.122.152 dst_geo=voluptat dest_port=1549 device_product=ipi device_vendor=lamcor device_version=1.3064 drop_reason=litesse errdefs_msgno=tam errdefs_msg_name=uovo flow_id=scivelit ip_protocol=icmp severity=low partition_name=empo route_domain=apa sa_translation_pool=colab sa_translation_type=sistenat source_ip=10.215.224.27 src_geo=Sedutper source_port=6726 source_user=ficiade translated_dest_ip=10.113.78.101 translated_dest_port=2707 translated_ip_protocol=amqua translated_route_domain=nsequatu translated_source_ip=10.181.63.82 translated_source_port=168 translated_vlan=tse vlan=4029", + "fileset.name": "bigipafm", + "host.ip": "10.200.28.55", + "host.name": "lorinrep7686.mail.corp", + "input.type": "log", + "log.level": "low", + "log.offset": 82553, + "network.protocol": "icmp", + "observer.product": "ipi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.3064", + "related.ip": [ + "10.113.78.101", + "10.200.28.55", + "10.215.224.27", + "10.181.63.82" + ], + "related.user": [ + "ficiade" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "ineavol", + "rsa.misc.event_type": "uovo", + "rsa.misc.obj_name": "nimi", + "rsa.misc.policy_name": "niamqu", + "rsa.misc.reference_id": "tam", + "rsa.misc.rule_name": "suntin", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3064", + "rsa.network.alias_host": [ + "lorinrep7686.mail.corp" + ], + "rsa.network.vlan": 4029, + "rsa.time.event_time_str": "Oct", + "rule.name": "suntin", + "service.type": "f5", + "source.geo.country_name": "Sedutper", + "source.ip": [ + "10.215.224.27" + ], + "source.nat.ip": "10.181.63.82", + "source.nat.port": 168, + "source.port": 6726, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ficiade" + }, + { + "destination.geo.country_name": "nsec", + "destination.nat.ip": "10.139.20.223", + "destination.nat.port": 114, + "destination.port": 6720, + "event.action": "Established", + "event.code": "nde", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ueip amvo dolorsi306.www5.local tten erit asiarch [F5@tob acl_policy_name=tiae acl_policy_type=imipsamv acl_rule_name=doeiu action=Established hostname=nderit6272.mail.example bigip_mgmt_ip=10.177.14.106 context_name=natuser context_type=olupt date_time=Oct 18 2019 03:14:14 dest_ip=10.239.142.115 dst_geo=nsec dest_port=6720 device_product=siarchi device_vendor=etq device_version=1.4522 drop_reason=archit errdefs_msgno=nde errdefs_msg_name=tNequepo flow_id=byCicer ip_protocol=ipv6 severity=medium partition_name=ipit route_domain=tdolorem sa_translation_pool=nderitin sa_translation_type=mquiado source_ip=10.169.95.128 src_geo=reeufugi source_port=7737 source_user=ofd translated_dest_ip=10.139.20.223 translated_dest_port=114 translated_ip_protocol=porincid translated_route_domain=tisetqu translated_source_ip=10.243.43.168 translated_source_port=2110 translated_vlan=ehenderi vlan=2215", + "fileset.name": "bigipafm", + "host.ip": "10.177.14.106", + "host.name": "nderit6272.mail.example", + "input.type": "log", + "log.level": "medium", + "log.offset": 83438, + "network.protocol": "ipv6", + "observer.product": "siarchi", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.4522", + "related.ip": [ + "10.139.20.223", + "10.177.14.106", + "10.243.43.168", + "10.169.95.128" + ], + "related.user": [ + "ofd" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "natuser", + "rsa.misc.event_type": "tNequepo", + "rsa.misc.obj_name": "tob", + "rsa.misc.policy_name": "tiae", + "rsa.misc.reference_id": "nde", + "rsa.misc.rule_name": "doeiu", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.4522", + "rsa.network.alias_host": [ + "nderit6272.mail.example" + ], + "rsa.network.vlan": 2215, + "rsa.time.event_time_str": "Oct", + "rule.name": "doeiu", + "service.type": "f5", + "source.geo.country_name": "reeufugi", + "source.ip": [ + "10.169.95.128" + ], + "source.nat.ip": "10.243.43.168", + "source.nat.port": 2110, + "source.port": 7737, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ofd" + }, + { + "destination.geo.country_name": "orsit", + "destination.nat.ip": "10.39.100.88", + "destination.nat.port": 5195, + "destination.port": 3315, + "event.action": "Established", + "event.code": "rroqui", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ipsu iden oreseo1541.mail.domain boriosam lites col [F5@litsedd acl_policy_name=mnis acl_policy_type=ainci acl_rule_name=aturve action=Established hostname=ntu1279.mail.lan bigip_mgmt_ip=10.92.168.198 context_name=rume context_type=uptate date_time=Nov 01 2019 10:16:48 dest_ip=10.115.225.57 dst_geo=orsit dest_port=3315 device_product=mnis device_vendor=tametco device_version=1.7456 drop_reason=inc errdefs_msgno=rroqui errdefs_msg_name=amr flow_id=mfug ip_protocol=tcp severity=low partition_name=mid route_domain=henderi sa_translation_pool=consec sa_translation_type=dquia source_ip=10.90.93.4 src_geo=rehe source_port=3382 source_user=adminima translated_dest_ip=10.39.100.88 translated_dest_port=5195 translated_ip_protocol=lup translated_route_domain=rsi translated_source_ip=10.18.176.44 translated_source_port=7284 translated_vlan=Utenimad vlan=4305", + "fileset.name": "bigipafm", + "host.ip": "10.92.168.198", + "host.name": "ntu1279.mail.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 84332, + "network.protocol": "tcp", + "observer.product": "mnis", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7456", + "related.ip": [ + "10.92.168.198", + "10.90.93.4", + "10.18.176.44", + "10.39.100.88" + ], + "related.user": [ + "adminima" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Enable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Established" + ], + "rsa.misc.context": "rume", + "rsa.misc.event_type": "amr", + "rsa.misc.obj_name": "litsedd", + "rsa.misc.policy_name": "mnis", + "rsa.misc.reference_id": "rroqui", + "rsa.misc.rule_name": "aturve", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7456", + "rsa.network.alias_host": [ + "ntu1279.mail.lan" + ], + "rsa.network.vlan": 4305, + "rsa.time.event_time_str": "Nov", + "rule.name": "aturve", + "service.type": "f5", + "source.geo.country_name": "rehe", + "source.ip": [ + "10.90.93.4" + ], + "source.nat.ip": "10.18.176.44", + "source.nat.port": 7284, + "source.port": 3382, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "adminima" + }, + { + "destination.geo.country_name": "enimip", + "destination.nat.ip": "10.193.43.135", + "destination.nat.port": 4650, + "destination.port": 3957, + "event.action": "Reject", + "event.code": "empori", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "Bon amquisno mullam6505.www.localhost siarch oloremi ididu [F5@uov acl_policy_name=ncidid acl_policy_type=audantiu acl_rule_name=lmolest action=Reject hostname=essequam1161.domain bigip_mgmt_ip=10.49.68.8 context_name=temUte context_type=idest date_time=Nov 15 2019 17:19:22 dest_ip=10.8.247.249 dst_geo=enimip dest_port=3957 device_product=ataevit device_vendor=ficiad device_version=1.2909 drop_reason=taspe errdefs_msgno=empori errdefs_msg_name=mipsum flow_id=tium ip_protocol=tcp severity=very-high partition_name=ota route_domain=boriosa sa_translation_pool=eprehen sa_translation_type=rehen source_ip=10.163.203.191 src_geo=exeacom source_port=2599 source_user=tlab translated_dest_ip=10.193.43.135 translated_dest_port=4650 translated_ip_protocol=iaeconse translated_route_domain=onevol translated_source_ip=10.173.13.179 translated_source_port=1211 translated_vlan=ptasn vlan=3791", + "fileset.name": "bigipafm", + "host.ip": "10.49.68.8", + "host.name": "essequam1161.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 85192, + "network.protocol": "tcp", + "observer.product": "ataevit", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.2909", + "related.ip": [ + "10.49.68.8", + "10.163.203.191", + "10.193.43.135", + "10.173.13.179" + ], + "related.user": [ + "tlab" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Reject" + ], + "rsa.misc.context": "temUte", + "rsa.misc.event_type": "mipsum", + "rsa.misc.obj_name": "uov", + "rsa.misc.policy_name": "ncidid", + "rsa.misc.reference_id": "empori", + "rsa.misc.rule_name": "lmolest", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.2909", + "rsa.network.alias_host": [ + "essequam1161.domain" + ], + "rsa.network.vlan": 3791, + "rsa.time.event_time_str": "Nov", + "rule.name": "lmolest", + "service.type": "f5", + "source.geo.country_name": "exeacom", + "source.ip": [ + "10.163.203.191" + ], + "source.nat.ip": "10.173.13.179", + "source.nat.port": 1211, + "source.port": 2599, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "tlab" + }, + { + "destination.geo.country_name": "Loremips", + "destination.nat.ip": "10.209.226.7", + "destination.nat.port": 7745, + "destination.port": 4361, + "event.action": "Closed", + "event.code": "rror", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "ctetur amqui itatise2264.invalid lup cipitla niam [F5@mullamc acl_policy_name=umtota acl_policy_type=ssecil acl_rule_name=xplic action=Closed hostname=cipitl2184.localdomain bigip_mgmt_ip=10.240.47.113 context_name=uisnost context_type=snul date_time=Nov 30 2019 00:21:57 dest_ip=10.191.241.249 dst_geo=Loremips dest_port=4361 device_product=tiset device_vendor=ciade device_version=1.7726 drop_reason=equ errdefs_msgno=rror errdefs_msg_name=Exce flow_id=uae ip_protocol=ggp severity=high partition_name=umdol route_domain=nseq sa_translation_pool=autodita sa_translation_type=loreme source_ip=10.84.64.28 src_geo=par source_port=3938 source_user=ull translated_dest_ip=10.209.226.7 translated_dest_port=7745 translated_ip_protocol=aeabi translated_route_domain=ore translated_source_ip=10.31.147.51 translated_source_port=7780 translated_vlan=ptate vlan=3154", + "fileset.name": "bigipafm", + "host.ip": "10.240.47.113", + "host.name": "cipitl2184.localdomain", + "input.type": "log", + "log.level": "high", + "log.offset": 86081, + "network.protocol": "ggp", + "observer.product": "tiset", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.7726", + "related.ip": [ + "10.31.147.51", + "10.84.64.28", + "10.240.47.113", + "10.209.226.7" + ], + "related.user": [ + "ull" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "uisnost", + "rsa.misc.event_type": "Exce", + "rsa.misc.obj_name": "mullamc", + "rsa.misc.policy_name": "umtota", + "rsa.misc.reference_id": "rror", + "rsa.misc.rule_name": "xplic", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.7726", + "rsa.network.alias_host": [ + "cipitl2184.localdomain" + ], + "rsa.network.vlan": 3154, + "rsa.time.event_time_str": "Nov", + "rule.name": "xplic", + "service.type": "f5", + "source.geo.country_name": "par", + "source.ip": [ + "10.84.64.28" + ], + "source.nat.ip": "10.31.147.51", + "source.nat.port": 7780, + "source.port": 3938, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "ull" + }, + { + "destination.geo.country_name": "oremipsu", + "destination.nat.ip": "10.86.1.244", + "destination.nat.port": 7101, + "destination.port": 5644, + "event.action": "Closed", + "event.code": "tateve", + "event.dataset": "f5.bigipafm", + "event.module": "f5", + "event.original": "fugit dantiu ntutla1447.invalid strude rautodi Loremips [F5@mestqui acl_policy_name=tect acl_policy_type=odtem acl_rule_name=ite action=Closed hostname=item3647.home bigip_mgmt_ip=10.32.20.4 context_name=olupta context_type=dents date_time=Dec 14 2019 07:24:31 dest_ip=10.166.40.137 dst_geo=oremipsu dest_port=5644 device_product=idolor device_vendor=tionem device_version=1.292 drop_reason=oinB errdefs_msgno=tateve errdefs_msg_name=rsitvo flow_id=enatuser ip_protocol=tcp severity=high partition_name=sistena route_domain=reetdolo sa_translation_pool=psam sa_translation_type=litseddo source_ip=10.225.189.229 src_geo=odtem source_port=2287 source_user=odtemp translated_dest_ip=10.86.1.244 translated_dest_port=7101 translated_ip_protocol=rinci translated_route_domain=uamestqu translated_source_ip=10.52.13.192 translated_source_port=4714 translated_vlan=remagna vlan=439", + "fileset.name": "bigipafm", + "host.ip": "10.32.20.4", + "host.name": "item3647.home", + "input.type": "log", + "log.level": "high", + "log.offset": 86941, + "network.protocol": "tcp", + "observer.product": "idolor", + "observer.type": "Firewall", + "observer.vendor": "F5", + "observer.version": "1.292", + "related.ip": [ + "10.32.20.4", + "10.86.1.244", + "10.52.13.192", + "10.225.189.229" + ], + "related.user": [ + "odtemp" + ], + "rsa.internal.messageid": "BIGIP_AFM", + "rsa.investigations.ec_activity": "Disable", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.action": [ + "Closed" + ], + "rsa.misc.context": "olupta", + "rsa.misc.event_type": "rsitvo", + "rsa.misc.obj_name": "mestqui", + "rsa.misc.policy_name": "tect", + "rsa.misc.reference_id": "tateve", + "rsa.misc.rule_name": "ite", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.292", + "rsa.network.alias_host": [ + "item3647.home" + ], + "rsa.network.vlan": 439, + "rsa.time.event_time_str": "Dec", + "rule.name": "ite", + "service.type": "f5", + "source.geo.country_name": "odtem", + "source.ip": [ + "10.225.189.229" + ], + "source.nat.ip": "10.52.13.192", + "source.nat.port": 4714, + "source.port": 2287, + "tags": [ + "f5.bigipafm", + "forwarded" + ], + "user.name": "odtemp" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/f5/fields.go b/x-pack/filebeat/module/f5/fields.go index 6adc122ebd7..c54966f5028 100644 --- a/x-pack/filebeat/module/f5/fields.go +++ b/x-pack/filebeat/module/f5/fields.go @@ -19,5 +19,5 @@ func init() { // AssetF5 returns asset data. // This is the base64 encoded gzipped contents of module/f5. func AssetF5() string { - return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb99eeSVlo1vb0bNs59XVVk2BmCaJFQYYAxhSzF9/hQZmOORgKIkCKPnd7YetWCQb3Q2g0b/7O3IF69dk9vOfCLHcCnhN/sbn351fkDeMgTHkQgnO1uQdlXQO+k+ElGCY5rXlSr4mf/0TIYTMfiYzDqI0kz+R8F+v8QP3v++IpBW8JhLsSumrCZcW9IwymLi/d18jRC1BrzS38JpY3fQ/sesaXjtEV0qXvb+XMKONsAUu+ZrMqDCw9fEA0/Z/72kFRM2IXUCLGOkQI6sFaMDPrKazGWdkQQ2ZAkiipgb0EsrJgD5t6B2ImWvV1LcnZZepm2URa0nFFnnjq4+tH1tis0hl5lt/37/C+IYNduXjghv3PcINaQyUxCrCaG2bwH9NV6QCY+jc/ZtawlQFxhGt3Oc7oAl5q+bkFJgq8ahGCPGw+C5Sh5LTwoUlSFs40hIDDghn5n5guUGeMyUtSGvc/eDSWCpti4aJ4mh5dQiCJbW7Hwyx4x4ntwShlqwWnC0IJQaM4UqSBbeGUPIe7O/cSievwu5PBkejI9YsVCNKImEJmkyhO3c11QbIO7DUoUbJTKuqt9TTt2puXlxQdgXWPBuAP+UamBXr58QGvCn5AF5Y+BMue2hOoowUsARxACeFkrv3c4uTp1BrYNQGTEqYcQklUVIgWpZOBZCK1nGsKjMvkl2YPXv8Ltzz89MfyJKKJtx4XoK0fMbD6YRryiwRau73Sw82AqnjDnw4Lfg9tx011ZazRlCNvw8bOxk9GQPQB52U2MkYQB4/KaNbsjzunrz8/3uyf0/cqnk25H7XV03/VSAhu9vyaLBb0kOEXnbUNBjVaJbp7b0/23Ld//thZiy1UIG0jxE52pTcFkzQnTv8SNADafX6MSK2cDrVY0SMy8MQy6sxtZLj8Z60Eugh0iMv22YAZUobakSvidmZvS+2bgGHzUAPGSgJ97MidvSQAfQbrIhxLu64Vo7ERdnzqkTZ59k1IDMR+0iEg3dmHzuGWt1I/qWBjRqtO/rDn9bbRu2Jksw9DtSqx27ZjoibJc8rDvvcPXHL8BlntH+f36o5OVuCtOQShTNpZAnamSAagqAakD7j11ASA9YB2frx9hpm3GBpN2EA+94GS7cJA9B32pShJzC9f+mwgzmg6w48uRsPFspk0lf75/JXZWxfRIrdE2lAllzO2w9N7Nj0fEhfD3/5IQds8KNRxp5fLH8itCy1k5Vj132XuQPqrfpambt8lZu9r/7fZa/jVn7ZsCsXvCOt7y0rCSVzvgTZOcm+XkXAsegw/0VeC6R8jMrf1xHRGHVoqHpdaPiSYa/7wUPcYKR7ukYun/mlyQVepOfBm20p+biugTA6lCBTIMDtAjT5dC7tD6+I0uQXoaj98SWZUoOnqA2Qzfi80aj63UD3IeruV0w3hkHzGZ8J/Avu13OVy822zzpuV/7qHQxKr6gusyl1PYnWI7vPyfOLz1v6HiUaBN3dUkLM2liowiMa0HbQFuBPqvHMc/9Wms+5pKL9zba2cgMfculfexIjzi8+v4qwIKA/4MT9WdBhNORyitdnc1CHiuOhr88CaAn6KLHrX3Epcn56nyipx7cfLEUwh8VKH7WTTbAiu5+NtorW+UbRwoviTJcTJQQwq/TXKIAd9x4g58adOW4I86yD0mG6pai+VbtqC9nD6Edo8VVs+lhU1UoZTHarlCTT9WDTCNHwpQFjHUDDq1qswz65LztBT4CyBTG8BPL0e2IXuiEvf/75GVlRQwyA7FbZw4lHobzeghOmVtJAPlawr+ZUMNVI2/kUmmrqhZ67yiYKgTylU7WEHjO4jGZWtuLNWA20Gr0/7Ks5Ng/MKih5s6unpWDUNzHNsXMs8Bnh9p/Ny+9/+LPxIv1FjQK0RfqfA2r+6ezBt3QNmrwkZ5LR2jTCR1acSXknuR6Dfs/gRyS3MrbKjy/Jvztyn5MffyT/TpjSTl9GKsKiz8l/F/Z/ui9yQ7aZ8k10C6Uq4dHaunIFBaNCTCm7yqsBe+SksnhtqPV2hWMiyLJWXFo0TSzEE5zxcBSgtcqUn7bRB00NjFOBGCOmxirtNGu59lqH+2BJBS/9wYghRchMNbJ0L4wARJ7LeVCObkxe3L4RA8gpYoHhOuwJG43swlooWj6Wdy6gQwz/A0gFVnMWsTqCKdz/MtrC/rlvhbB79qndaLRq1m7bhPyqVm5rhjYnl0RpZ4xZRa4A6huY9ihevK+EaVoxMKZY8rIoc0Vdz1rJMwcJmlq85KXjYM8uXHJtGyqc0b7le5cRFwevuDO7MVaOzPBUhKt+fkq0k9YGHSrINKrnYLuv3cgJozMlPT04J3wm3H5O6CyhoKHgPz9tfa8foFIWyGU470wDPrTT9ZigdP9rAzFfQeAlrFSYWvCcmQ2P2pw3fKD2PwrdzMncjOcdb517A8JZb09da7WEJ+S/RoTRi5cZFw8Qo3erOuPo4uTNRdB9GZWOPbyqld7VeAk+kV9dGkTzONwfn/xThYY4mu4xV+q2Kd9sfrIx2L2eg5b5hLz8+RVZId8roJJQIeK+AnTqo5q08R+RFWjwYKklAqixRMmdcpFtJj64mvh1MzFyV3OEbQPvfle6RMZhVhOwhVRCzde7gbgZ1wMtlpCfCVtQTZn1THSXeo34o9NckkaGnB6x5TMfrahNXdDtA/U5gwh7YpdoUVROyVSyDSNouhqVaShZd9RKylBj9TEKGXwOirFGtxCNpbKkuiRS6YoK/kcsv1fpKsqfMmQ5HMwi1UwHT9KdmLTBukPmheAzQIojBr4BpmQ5omBvtrswNqefZQ9BXDJV1QJs9ACMOlEpKvBW8x0x2Ks30/aBDvKlWzt6nMeO8vbJHD1+lZJ2kWibNvWpqXJeNllO5QMx/kyWOdjuQP6hZO5uC3vEolu9VTF9eu3HXQ4PRFS2G/2GWLi24fKRJWjTK6co9+WBRfb3vodtDTQVmZsyPaZ0CWW+dzAk2YRnynQrtjpGm2nTfbEfXx++VlpVE4TaYFG+YSCp5sqr9VUjLP/OctCE1rVoq182vWwqbOETKc0lRGB4p7UXPVIeV0O4fWKIWkkfGbO0qnc9gwFjt5pDcXj7rCFswZ11o0owE/KuMRbNpD5QdyupHcnLpRYO3KS9Amw2c3gv4RiaEG5yu6DnnYYZaJDMHwjqVOuSL3npNBs8D3FBdtkKso87zIsTeV1zfTQKN/vpY0HX7iRyK9aeWOOEntPXHFJ4QPf7RhNu+qgL57mTxp08mwyW7NLJVJNaAlUDRe6+EDv+p74qqEF+aaA52lFyp9ufoo18XFFDEIly5Nwgcj+kZmpCpWCLoRlk2ryyGV7feZUD17rIgGpd5NCe65SiaBvoy+RQM+hKvVfkYUzIHfMx+sYMnss7vTmHis2b5NohwYLNA7HTDSG1I4iygRKfQrE2jcgddhqxolRjmarghcehM14wK1vNBieEysCCLQNy5IDAEjS3OUtH9hDWrh6KAHuRnX0un7zFi4Pegf6V7ipdHDSMO9XA+IxvDJ+4duuDOWM9VYKunD+bKbIBnYuRl5uCidZFVYYgSxTvYDYfaxM+b1vpfUtQafLbZUiN5aZNCNj1q+H67Q6NVUmaWhmeUHDc6myhOS1L32EKU/nbuzvahacRtsjXuuiOokg2FWjO7iqLorQdoYptD2H9SrbuZnix5O/3gLQlyFLpkDC7lzI1/dcDdK9pQ7tq+i9gcTvaIZa/FnzAbidB9yPmJX3OXnXfDC9kqPoPYiZ4uRa0yy2WyhJKFqHjRTyBVqh50SaqPIhQbw/inYX6MXqmbMm+v2O6FXatRvERV/yxVXfu27NHLoRe4b65thTrEbnciJx503EGfmgEIGJxcaqkhevcGmuH0Ln0/rpNP1Ralsb9Hz6qVLQIxRrA3PA4swWVcygkrHLLgrHAJax6oX5UQqzVfNpY6EmIYY6+8ag7bb3//MVFh6lpMmHXcU7wbG0r9zENDcHd/CKPTF9/ixi3WAHmGNY2HDSbnC+9BD0hl+A3pTGgJ3QO2Mo7ZLrPlG5xGMBuwXi9neHvif99r2+F0mSq1cp91v416Jre7BrtJ31eXlBtU7vpOsCpPSrhTqlBdeix7pQSZac25rpSqoYQUMz1Fr+RhArQtssu0ptFw998eCuIj14TAExCiijMJZFKfqehBrRk9mU/oNlwzCeHNVq7C9PZK7iTqMe94D7C1oZ/BpStuF0EZdnLenKKC06x2kQSJb+bK/ffe14CVFKKiOKYkW7aCwa+QAQckmpGnHSwHMyEXG5kyu5gg35lVR6MT3w5X2OcEeNLRn2yTRnEb2A8JUw0xrYHMvxjsE34E27cToaa6ODfcIovfjquAh1d+/E3LG7R+7ZM+ZSyJzcZXg7LU8SCUGMU4+gvdbsRtSdxw97yK3hNKKkXa8MZFaTk5uo5qTXORHlOwLIncUWZanpI7eUdH3pfZ6NpBRa0ITU12MXLYCMH34uAqapyUkxtBe2HpTVg2V51z78HD6Xx9fYww8PkxTdTVd0M72CGbaNkxWWpViGflinJoLbPu0yKUWYMyJw1QqzJl4YK7/wsVUW5DFJD9hYSauTp6ns9U6lLe0h3KuFbLq+gDLVAbSI6NeidCgaK++SbDrUJL/dtnBh0hcgq6vqTnbxbYheBFr3fLh8Kr9/q4Hkll8N2PV3QGXTFdwc75XaxhjURW3/+92vaPybWtGdc5L/jHcm/4GrdNdZQNgxIGzmCuLvNgOZUFJHXNNsjcolLtmrz7vvYewDdCzPqFwB2ZQ5qOZDCYxxWdw/dgppFd0OdWhipMmzYwmf+tjU2XZnhSQtpp0WYI6RbZmI0c7/q/j2sNCVOnkvCMeeukUwA1e5P2Ahvg1ooIAzeTt0Wdt4cffDCrxn2eXrULxZT1ZTLrm92/8EKZaP6Dq/XkuvGHNvT19dGEIFxj99xAqSRK3HiV/c9Gcc9pd6Cy+4a79jnvcznp+S9lzRPQ+MG4qfthaJfh9uzuF7tHdAP4cvvuZ/PT5GloeStExND78F2RM6nAXoSJv4QOVmw4iZupC7NOmcv++2obijQ9urCXj+29Mb3EU+NY/1JtzA5P71Rk03ln7tBk3WIvZTlRqOdkBNfnxn6nQr/wX5tFhHU29/44Zvgjps2tqvcVLZ7jBopwHjOKP+grBRZUs3pVAyqAH1TBi5JLeiIIDAgTdb+KFsb2ldV/coTJ6mchtHWF3K3z5cvzi92dWgSWsZ6j8JYXfaBAwVvXQu5ibR4JMm5tOSSzyVFYTFyRGulczavfTKQX+6QXrS6m8KujvifDpHeXcZTVqrIwXn/20fCJRNNCU6chUG27ucT8vTsmla1gNfkwjtEPFiU3pO4XwQjc0ePbaJzavO0xDHj5sqp3AfgdYdSvJ4b8314Gj5wc7Un5Go1n89B5xthF2fZ534sIOCA2ulCg1koUbrT4231kUmjW6H3I3gWhrH3IJWffvA6xrOuGcf5abyM5NbReaaqujhy3hXuSsi9wjGu3r9nmul3Dh0lsT51huNmVNmwMSstqKUPlDXWx7yTlkpj5wEn11v8RqbEUV2uqH6YDL1hV30nXWl4iBwRI62RnzohSsk7ytp+ynHl1omgo9oxSn7XKqh6vxTytmbyodYaqEmeG2wstU0qxbnzR1EuHszscItP1TXh5Yvx98u9rM0xMHQYfRo0PvZ3wWERv7rtO5Z5+t7gkJ8O5+4d8pxxqZpUMc5eHYmZJ79TTpKmdDoMPLI/JQacuzPj1pF4I4STe8Q0jIExs0aQM7c+YaoE445E2+w3bllwWcJ1YgYIbuxhmuc9ZQsujKaYbpGYgsb4ZkU1F5jBE/Hg+fi7nBOKTPzO/TZKmcxwDtXUNxd6II04rE6edvmcNWhTh6JbL2EGLAsqwiYhvu3w9GykyNC7uYbvce6EEq98dUlewVflv+0+pFwaUoKlXEScDFPV2N7vRkhT4ui5ma3HlnZ5bIjH+ENqoapFtmyeN6SEGQ0hoND5so3hh2xNpxUvQQu6xkIuq8LjSp5GbqT7AK3u8GuYtVXg3ldvLLcNNmYkUcI2tsGwYdN9r2vSKFbPv8NoakwzyCqmqsrdpzzH6MRDJ7yX7FtrteSl95+1XeQqMKOJUKVihwca7+4t+4WLjdbI+nl5cdXgusakp4eR9e3qeWX9v9T0QL/TweT9bzUNAZj47ap5vsa5p5hQ7Hf+8uKcnA8Uqj4a2brWhuqS/RgkLOzqqmHnSQ3pu/jDQm51XLn3IqKYqjJ3xdeg4m5X6Qi4EIfLiHq0SN8twYcMjlB53nMBh9Jhn0DbxUP4nJddKGfEiVelthoHZeAJXv50Sl5Hd93kfKba6d4Xn3z3nDYQhcka18CavhfBp35NIVbe2nZh2pe4cQRHSNQrXm47RLrqSrqkXNBhIIN0rnCC9ZUz0Hpk0oK/Q4f4+tPF3YKxUoUGUD4AOyAppBsYPp+MSEReFdOmLNfJ/TO8KpLWAfXgNgYOa3S+10uVHqLmKmGXg50Su8I0xyhI4Kafvep7rtKm5LarrNv0RQsYxQbbbSo2vCjZhBf2E+mzxFJzcHk0q/zk8xl5GmolPjfC6cpTLrCAA/PAzq5rZdw3n5Hvho4GuRuFuZJqJbcMIQOswWYWy23oI5M2GT2CC243LfSkrXJ/H0qT3sKcsjX5NGquCT7V9CGK8sPCWyzmklSUy5mmFexNx6ipxqm9+fskbCmXF7gsea9Knxy9aQvYyzqLIEVu0L4wVcAxIpeFtN037j2syK+NRFPynSpBkKdcLiffPidcsedk6v4P3P9RScXacDP5Nh5ftKwuZoIOJuen1qG2NfyTC4KLoq8L5eS6HX6lZnsbNViVFVP/12nAs22DYEC7gxxFaFmllbs7mH1+9zvVQD76BOBvv/387vc3H86+/dbn3C6ppnz0TK6UvkpZsnzjBfu9XbAfYRt1glGZWokINTtpu5R0zwFl7rlYZzBhZkqDNJylFCA9V1IGjKv0XpBIfCAV0GJF+XA48b29A9j7PDVQd31Sl6ibZprpUthpaaxOXfmO9drZHGL9tzTZO9rWfORzkh5a7LIZDDZQaUKxyabuJdS7OBAzPupoaknN5og9lNRoN6IImbvlPXGhfHA/wbs7LhzyQf//MFx1ozL7yX8PcsTKno8+ILIXyQc5HG0cdx9+Sh0haWtrZ3t26VPbZbS3WXbYJ/MZut0GJ/fmyHTbspofIx6GRV8zyoXjddvM5SLIjPPTfm0bduJy5qCFeaSFwXhWYZtzXTgV8QB6Dkm8xnTrUH10oqqqkbueqAF28rDGTffF7j1c279DXKfucDOHadb3xe2SyvJvKh412+BmqeWHSIZ7YzdceAs505iaM66SZYkey4JH7FdUy2HQ4bGjbmRVFyqXML58/+6C/Ob9qJuk1DgiX46aSnD5H2/Jlwb0SO/WRshCw26nzrzJDT2H6Jp8aIvOomldnZbOEj6kfaAq9RgBB7Q+yHF0E1QbCY7dG26ZfkADFVRXGXbLgc3gXqB1wgLkDmhTJptKuwUzbberLdAltbta4X3hTkGyRUV1qrKSDu66poPxxfeOPlE2SKdKArNYJD8LDGZpC6g6wLM5tlrKAFZN/5UBak2TT8LwHaeSHy8Muhc89YMTOrdV4FTP5EjLgjIcjJK+/MTBNjKh8d4DPJ3Xy5/ktV0kf9+ZLJjVRWmS9l3vQXeQD4s83QLwUtDkEkMWIOdcJiyKHILOkRsti1lhVtyy5PJDFjOhVoZW6XNX+rClXeaDniHqwmTBZU5xwmUNupqukyW8D2DX7CoP8CUVOc4Kr4taK6uK9CEphL78qUCPY3rYItvdFGpelDmY7QCnz39jsqjodWFtKrfBNmB3ogVkeBQqLjMhzWU+pGthCjEVReqw6Bbs7zMCT94ZvAc7dS/EPuzUVb192D9nhP0qI+x/ywj7f2SE/ec8sK2qBZ1CDpHSQU9vnsmiagQq39N1hneyBV5fZdBLqkbweVXn0b6dlknFPHUSUoDMcyglBr6w9L4RWRifkJhhB41meaxJBziPNWnWpqkzzCJlsiurzmKqWmWd6QHXGUSIVdYZZrlgo1mTBXgj+bWkUhlgGQ7h8pXjSqZHYflK1XYBtMzgVlNVXTCRwYftAGcIkiBcPV3b9G5RB9lkgVw3RYaYBtPcckZFhgIiU9A5SLZOmHXVhy2pWP8B5TQH3ssC24BmgezbweTB2ifWZoE+ndfLV3l80KaYcvvnLI3GmCnSzorbAaxVclFtslxzhApMp69yM97Hn2zWVg8w2IX386d3jnjgqPZlAe67yafrINeDPeMCctgwppjl2EQ+S1mcvQ04h25gCl5jkmKRRdTxevlTaWw9aOafCLbRLAtswWeQw4wx6GiuoOTJCka3YXOZ55RUqmwEGKZycDsA5/MMsknVZkVt0pn/PeixDPIkgDXMubGapveEbGBn0Pg01LlYrbPx2mAncp1JvvrMfH/EM0C3GmiVQZH0pUC50M6nXK8WipvCT5hND31NNc1ywMuRQtgUkJd+vn1quNxYKpPPOS6NnTY61bDAFir4WUE5oDbJcU2vR7c1yanB4uSGWfph14d2GtgHc07LMvUd4GXqsGrbOijDW8SrgmmlqixdiRzgDGYar4o8yZGh41EONtdXydsz1SZ9y1Jem1rzxEAFtdw2ybPPBJeQrsXOBqpJOlGng4vFt+ndWkL5rqfFTKjkz3kHPEPKv7N5k0sdBzSDxHE2dAZUk+cmCDXPcnTlPMsFrpVOLcCqaTPPcc0qblgOsVCZLAc2xxwICRabKyWHm1yG+wbQqTP+PNTU6XhytUptgWSpKFN+AHRyS1Sl14yU5vMiMo/r3nBXEnT6N6su/FDe5GCTTqbegPUjXrMcsgyFm2EmTmphEMCmlgZ14R1JydGlxrgPC7ZIVec/AA3XNU8eCKhBV3NNpR303E0BeZUFcPqn13ci+/RpZwpoAsBazQtq6oQDA/qgNU0NVQMVOfQ7DQz54LuOZgKenskOctoWrj3ISpcZME7vyDQZfMPG+4Yz5AMYSJ0I4AceZzBODHxJfwBiDVqTQc1gShk+zyB4TZ3ay2Y0y3EPNCuTK9JGs1hX3ASAbboRW32YjUneVXPJZOpCiei02PsC9U06U5Nv5zb9sfJA00f0upmeqeGu6+TdWptymiUPvdEiw1vYGNBFyVNXvWcZW9FGhnKwwTJjaZXaG7wsuDSWzjJoBkuubQ41fFnLDK2brNKNTOlmjbVFi3QUfdNYRT40kgyW7rJHMg7L+0wFL8mJhpJbckJ1GboZGmz/HkfHT87KyKWxCaEIBofoE+xvwJQgsVKdLh+Cy3ycO6tqodYwGCx4I/9mqknW1PuWZ8zx0PuMcN6Zhjlck4ruNlrYxGLlvNkdBpIdScENDmdoVw9bjw2UiGnqWmlLho1HCVktqCXcklrDbOwo3CMt9y5DKGKMD1ZHhwLhMnR2H+kLLbjMPZG/h6pbrY+nIVbNwS5ATzbfNwvVDF40QiQsQXfjiKwiNdUGyDuwFCeC+7tKOxY8favm5sWFL3t9Rk7DiK/nxC4iU4qwGfAHCKOPEW1J3oP9nVsJJr7Pw0OdhXkzHNnd3SJc3BNrgGq2mHDJo/jhzN0j9NfeEZ84CwOTIV4I2kic9TtvcI5r28Q93sB9p1/7Hpryt+PuaOqacIf5xSPGvtuIImFN0+06r+Ky5CNcW7wVY+6CY0yjHhFIm8F173FCtRQjEy+xe27GceDYP9eAJRq+NGDsnqbdh2cr371XvlcZcCyPX9VL7F2PVJd3uu1O2YeTxwhjY1t/xw7t5nWU8pSz/2+eb+gWOz9thQKuHT8baDWkS+K94xF2j8uUGiA+XbvDhgxuVbdL4RcPg6/sRsF3mCvt29dH2UgINcQA4Lgzun9elabSUHaE8b6DDtN+aYlq7+bQsEbjBLR9SNegK+7VjWMhvVnSD+bgSy5gDkTAEgShxvC59Bu3mdcfP/rYkvkB5Teuv+ekTx9k0rPDrJH8SwO7YxJp/PL18D2sY+JhU1BajYaX/kIyJSVgbgVZcbsYExSERCpDOo1dw0HlRXc2LRw7UZ50T5RQc86oIA6DEdMHsXhY7HCpkTGND8e7erE2cfR66WwrtZPVmvqBp4JTUyxUdpvAG3GduYazVDZDjZxU7I/gifcDIP7SOGzxTQuDWJgAqidvhFHOEN+6b6cYLCe/hl9MyBu57v41gG7RljfSElpOmKrqxoKOi+EsbnxHWD7z7JvdvcAZi1sbwu0/m5ff//BnZ/ue9raj5dg3UbTDOS3SRsxu67iha9Dk3zqfnHkR0EDk4rc+df1P/jMvNzhvnfq9+3Fg8vJNsu3J7sAUt86EvP/t45mjHTR45wn6S0tumIaaSrZ2WmVQz8RuLghBDj0nH9+9JufS/vjyOTl/f3r2n6/Jp3NpX/1Enq4WayKB2wVowhbKhFFpSmtgFr/1w6v/9d+ePYlyBOwio4zb5QfK1ElF4+N4TObTd8drfunP4nmLVPyKl48L6b5sugHzAxvG3fqBj+G7o5hurJPPXNuGCvL2zfsosn8oCfl8WYedjP+jJEzivHXofjUiFAm5WXjiFjzGN3jPPsyphRV9gBHpeLovyJuy1Oin9ac8hk739LKqPjTOed9YyPnJuwv/Ko2Gxypqjhj92HIqeU01vN3k/MKhMuL9cjw8cBJEEh66tcd52GpihZ+udVwB0UOXliV3X6ZiE7DtzfKPv3NHPADOJMQLrsINP90+AgNUNrnWWfS62z5plLwPGF4obTuRPBC6JQbYcAO4Xd8sec2Ree/p4XLePiYtWe/GGC8hZjcey4sbsEPLlxqjGHcqp/cbDXQc4uSypnIOk850YkrO+LzRUJLpGmGCLDFrKC5n6gNbDwyKRke05eiiswz9DkRC3b9fwpXcAaChUhaKkNmdPs8oPWtLaQpa+FT8DKBrq/MAn2U4ErMM1cIix3XI1f+kzsBUWhatJy6fWr5rwTs6Jrur9Z0JD6DBntkFaAmWfFzX8Jx8ap+xt+gA+5FctA6wwUvw25im1o7qOYIyMWIat0gHv/hzQoWIKhP15ouY4EY1JuYtQbs3kEuriLH4mHNJPp2PChSGCbLZ5FVyke2AqjrD2DcHWINJndHrwGYocfEvYupUdPS3Z8DWj1YoBMh58kmRiLNTPjJqoSMaqFd5qOgFYCRhmE4wI5T8ovSK6nI4p5uQN3NM9tKEuht/jbl0U7ArABlXPRN3TbxrjFtZKvqhOo8MwZbxmBkxoJDLkOeKaQkVt04shREbcRKXgspjxPFv4aBsE0R6LsoBgdsuy00kZeks2DkasNsvT+pIJTDsQrBM1w/udhF7qi1njaCaYL9o0iLx9Oz69Vs1V7NZfPo7sMIuIPv2biH70S3ob2MP7zOHt0P3TWMXIG1IFh9F2zQpOyfcLqHHLzmO+icDehRh1VimjsvpsOQ4wpcNY2DMCM7Yefyw5miHJZ4gXsSpuHOl1yRSmDDA7RjCaQtH2MHRSSUM8JlaSfeuOLkVUw67H5KBorRN1TJdP7qRd5MS37UUawYEh7KjJ/hhdvRhLonhtonIT4LFBRBEdIC6oIbQUtXudbEL4JqoldxsmWecpddKqmokrxZnchjuW9QfV4lwyj2XpZM/SpuOAZT8wgWQNwGxyYANt3H2yo4wfydHE8Y7+h8kXWGUBZchayEtF2I0RhiRst79Hozw+XqXoV4jNSfGE0KnKmf1QIT4KSzokqsGtUumqlqrio9kKMKxkTuTdCqwiGxGTvbjxuWyEzsZkdzFcEvrJFEEtjBMOlzmAAQj63f45d7d3iu7uW+jx25TZtlIu1vOllqjL7EMvGCHmPW30oLwPZ6DBM1ZSxIyBBP9dlMLuF3gUxub7UYCshP2w8RYPR78bGk6pO3Wg9H0cj9NQb3wa2WkK2qadka45RUYJ9e9tqehhtEgUtiFZE0hbtwIbDx4z23Qtzxah/TufrCj9ePtaPqhMMmGnN6atOAwvonCAW1I8UYg3EIYfL3UvbyROn3UvfMXLQlt+uadS9ZL9TgC5AY53gmQr/c4/njzlqUabXCcLbudfNRHlSAp79gt5MdRj2NK2gaHsVPqsQRtx0+dvHKnsYuiArtQDxAloVueZOLRCF8b3XDspaRVVq/TnqjOByWCv9YhsudcZvKE/Ofk5++/J0/fnr65eEZOubFczhtuFlBiKXwUF6HmKntfoH2RMMyWnXk8wjbjF0cyxrTK7FXcV//pdjWGQXdj0COfbOjzXa4Lw7T/ru635/hDnGIxUypjbdI3mWJUpOpOt0PIB1ryxvgViNLE8IoLqr14cmLT3SGG73q8vArvueHlMTuN9DPlP7mD0HoRd/pibi55vjqLN3LfXcewRqg07Pl/g5MIPxmcheC4gV5ZRhl3ZSqdMzFgELJBVis9p5L/sSerWuY7Crdl9gGc7p+pEXbPuI7Wkmbq+vOLWw5fC9/iy/cu2spq/hWosAtGNZBaQ6kqLmm04K4nni6o5SCtuTE9XtBjUvuWPiixvvUj1JkOrrs6T5zgqqm22AxpQ+p+sXrEZkdB2NxGos6gBE0tlEWypLI958MJn1/aFbvg2YVWS152zcPC92hdi6CpDg5GaP7jnrVtnTau4GyI5OWRqOyWDL3+7HqEzOjwUMycXHIfPV/sKu4jLeA6pTPlUPC7ap5wjTpT70e9Suh5hFCvo6LGSg0xVmkv8R20CizF1Z7gtybuW0/i1Fe8LAUcT8q9w/VuK+ci29uTewfJuXY8xnHIvQir9ToMyXUbnX1OakHdlrn3WWkCkul1Peblx1TII9iTt8ig051t+asylryjbMHliElX0kyS45tdXn+SmOlfa3Diw+lHvsmZmZC3Ja3JZ/yH149KJX3d6T+HjydZ0CU4zUkA1eRLA3pNsAehqZU00GpU8eJUR2+BvzmOvAw98JiDrHnbBVJ68n1fvnE8W5KOgOrmAH0IzVFviylOecrrMNs9421r6a0mRs42DA8vN0Q3UkbtWPO8e3l85Nm3kRqpsQsQi2Bh5t8ISlZclmpliKmB8Rln7pPnsTrBkCc7vCCOPI/vJueGPMWOsCDZ5hnC0OWzHrdII/Edfwtzytbkk9lufNtFYKvdQtrk2bVuhSMY7COvfd/UQlSwVg0PmXsRBxzv+gBEqv+3Kk2xnGfIvm2y8yvUY915vXodoRgpjB608JsDiD1OXu8YqSHDN7jeW1l3hqSPdwEdUnMch10XMNjem01Cpt+GwQ7FG1LcXPyMZQMpRwKOVrghySXMuAy+ehRO2NWvovVI00HE7qBCsUy4bRwwO+pfasHY+Wxz0x56KY30pux82NZStqiO3AJ/syoynAyso/52ZBnyMuUy3QSxpHfDkYxFhXkfz4iQ6pft4Lb4Ntqb8v7I1M4B1nnfvhuwrqluz5T78/MNKasFH7RSJ+52OFvWJ7/fijybfGaJb2uh9Drfhv/F1FT+9caOMS0i213UW/U89jQ5tvzlBUK/gbYHU4kGVLX91vdTNXoKCpBWq/oQ0VGqZjpwLtzqjIc1nbUNN5QjII6+uuO49/BEVTWV6+4+4rXDcfreXlmCds9QweVMxZUCaq5y1wjdID92rMgWsxXk7Yo++5IrR+CXRog1+Y+GCj7jUJJTrHv2zsEoKiuYFkypK/5AQfffYUr8+hv7mYoxbT55t9lNOLxuLKrcB44wvfmuf+iWCFN2gjva++Qn5OO69qRvPAeOOX4HxzdPw6xI2kx2B22Hg3dE6Ccm1rZ2F5ljuOo65XIbO+9ZrJVuvf0YYv7wdmTLe71yEh+nlhd13jlEe1jhVr7Rc9+iqZXKpIlsI+XWcftBamrjrkkmC2pSRvt7gHUop08MudEi4Tb3oCbclc4YLRqdyhvSg2lAF3SezqbcgE7+PG2DTpr+uA06nPoMggWuLUhUrdIbJw5+stPcKXoLDTupMqk1Kr/EMWoJt2TuR1wW1asX4b9PAgovwn+EvKaY258K0PHsvEDOA0bPPTH94Dl6XHuj1gbklGEgmjOpuJyB1iNx1yHdR6Grr/jfyPqoe/YISLZ9iWe9bYhcKQxrq6xXKrLE0Y7fmY/bu2P3ETOIdf9P/4Bhgtb4wE9eL0Afxx/hdPaQ8fT0BEc/PiMnuH4cNdD2SM1SRvh8AjoM/4StLMw9zXkha+i4x8jehrtFn5hep+i9O83/ONQreffWKPHdJpf8j7i3hl9lkinn/zgjEubKcr+B9YKakQlQhh27rVBvK/3i48MF3VZnmwA1SHDZOWNt4/S2/iaekGL4/BgVFdv9jbqphx9HBy07acKNaZIrnQgZk6XyeevuF0NBDEHrrD7Qwab0peeZW5xcYnB6n3Q6SoZE1xk8RJGfXmJq5/7HqCc9D0Py7tJzD47jItQYUSxzvui7IdXgyI4iUxbu6NEmeZtGkwswv4JgUWdqbvDNZlxJ/0FC2foTMRivU5qcX775x7sLcuHeKfKbHJm+ssE2UyX1Idh+XKk4tiiG2ALYlTnIiXw7IZy3B1ls6FzXr7NrEYZpoGEE4UYK7tFyQfNBU8gHUHI9Hl1XkFGjAXG21DZHm/DZx3JJBS/9QYwgsSsIj9bVep8gRI5dwdrsiu1EJ79NIE0Me2FtbQqOM2izgMatzMEQRh/BbeJz2Va+KM3t+oYbxVRVZe0Td0u8PR7BIRQvwV9xDWLX0kztYlkJKgtjHmrgrVvZy/DfA7VtjVYUW19qXNSKHyOtOoawx4AgBohU3BpAtrIFlXLQOCN3u6mwKiIyErM9Utvm7mEJMw9/f/vmfXj3Xuws3z0oVuld33/ynm3cXBVLJZpcDHjTznGWYc5NNxm7HefbSG4NeeqRMM+wWwcW9rYTdXfAE0Q6So1oMkmztwHXT5LbkC4w2S46WILGTIFZIwhTkkFtnaF86fdwpL3CapVT+nrGO4O9HaHtEK2VtkQ5/v76tzexFNwo21OfO6Xnx0+w3C0w2HKxTqlvdhJtFPP3s98uzi/IO3pdcVl2Y73j2+poO3oa5tYQxRGyAhkD6vaR1alP8ZLF5OnZvsqxmB2vYPOhi/BbkrOrHVvOsiCVz09Dl96AxV4MxfE25YF7BbQUV//l64a7whxZDjXJ1Lcb/SXOhH6g7MYwrhqt+C6oW/ni3ufENJEUdWrIX4zVSs7/OhWUXQluLJR/eRH+9rz7lMsZsPhHM65hRUVUkaFT0fsNobIkRpGRY6lhzo3Va2fZH1NY1NQuQrP+Dgeyi8MASXRKHQtNXwjt67WY0r0u5J0+2WEO0ur1n/5vAAAA//9X1Lot" + return "eJzsff9zGzey5+/7V+Dyw9lOOXTiJH63vn175ZWUjW5tR8+ynVdXWzUFYkASKwwwBjCkmL/+Cg3MF85gSIkChvK72x+2YpFsNBpAo7vR/env0A3dvkaLn/+EkGGG09fob2z53eUVekMI1RpdSc7IFr3DAi+p+hNCOdVEsdIwKV6jv/4JIYQWP6MFozzXsz8h/1+v4QP7v++QwAV9jQQ1G6luZkwYqhaY0Jn9e/M1hOSaqo1ihr5GRlXdT8y2pK8toxup8s7fc7rAFTcZDPkaLTDXdOfjAaf1/97jgiK5QGZFa8ZQwxjarKii8JlReLFgBK2wRnNKBZJzTdWa5rPB/JTG95jMUsmqvPtU+kJthwWuBeY70xsffWz80BDtIIVe7vx9/wjjCzZYlY8rpu33ENOo0jRHRiKCS1N5+Su8QQXVGi/tv7FBRBZU20lL+3mPNEJv5RKdUyJz2KqBiTharM/UsdOp6dI1FSazU4tM2DOcWPpe5BpkTqQwVBhtzwcT2mBhajZ0kEfDimMYzLHpfzDkjjme7BAIG7RZMbJCGGmqNZMCrZjRCKP31PzOjLD6yq/+bLA1msnqlax4jgRdU4XmtNl3JVaaonfUYMsaRgsli85QT9/KpX5xhckNNfrZgPw5U5QYvn2OjOcbow/UKQu3w0WHzVlQkJyuKT9CklyK/vnckeQ5LRUl2HhOcrpgguZICg5sGTznFBW4DHNV6GUW7cDsWeN3/pxfnv+A1phX/sSznArDFszvTnqLiUFcLt16qcFCwOyYJe93C3zPLkeJlWGk4ljB7/3CzkZ3xoD0UTsltDMGlMd3yuiSrKddk5f/f032r4kdNc2CPOz4yvm/MphIf1keDXdrfIzSS86aolpWiiS6ex8utlTn/2GcaYMNLagwj5E5XOXMZITj3hl+JOxRYdT2MTK2sjbVY2SMieMYS2sx1Zrj8e60nOJjtEdasS0ozWP6UCN2TcjP7HyxDgtYbgZ2yMBIeJgX0bNDBtQPeBHjUuyFViaSouhEVYLic+IaTDOS+FBAgvcWH5nCrK4E+1LR1oxWzfz9n7a7Tu2ZFMReDtjIx+7ZjqibNUurDrvSPbPDsAUjuHue38olulhTYdA1KGdUiZwq64Io6hXVYOoLdktzpKmxRHZ+vDuGHndY6kUY0H6ww9IswoD0vRZlGAmMH186bmMO5nUPmdxPBiupE9mr3X35q9SmqyJ5f0dqKnImlvWHOrRtOjGkr0e+7JgNNvjRqGAvr9Y/IZznyurKsePeF+5g9kZ+rcJdv0ot3lf/74rXSiu9bujrBRdI60bLcoTRkq2paIJkX68hYEV0XPwirQeSP0bj7+t40RgNaMhymyn6JcFadx8PYYFh3vMtSPnCDY2u4CA999Fsg9HHbUkRwUMNMqeIMrOiCn26FOaHV0gq9AuX2Pz4Es2xhl1UP5At2LJSYPodmPcx5u5XPG94Bk3nfEaIL9hfL2WqMNs+77ge+asPMEi1wSpPZtR1NFpn2l1JXl593rH3MFKU4/6SIqS32tDCX6KebUttRd1O1U549t9SsSUTmNe/2bVWDsghlf21JzHi8urzq4AIPPsDSTxcBA1HQynHuH3ajTo0HI+9fVYU51RN8nb9KwyFLs8f8krq+O0+lgKZ495KH3WQjZMseZwN14bWZWtowUGxrsuZ5JwSI9XXqICt9E6Qc2P3HNOIONHR3HK6Y6i+lX2zBe0R9CP0+AoyfyymaiE1JLsVUqD5drBoCCn6paLaWIKaFSXf+nWyX7aKHlFMVkiznKKn3yOzUhV6+fPPz9AGa6QpFc0oeyTxKIzXO0hCl1Jomk4U5KvZFURWwjQxhaqYO6Vnj7IOUkBP8VyuaUcYTAQzK2v1po2iuBg9P+Sr2TYnFhXNWdW302II6puQ5dgEFtgCMfPP6uX3P/xZO5X+ogQFWjP9z8Fs/mn9wbd4SxV6iS4EwaWuuHtZsS7lvfR6iPoDHz8CuZWhUX58if7dTvc5+vFH9O+ISGXtZZiFH/Q5+u/c/E/7RabRrlC+CS6hkDl9tL6u2NCMYM7nmNyktYAdc0IaODbYOL/CCpGKvJRMGHBNDA0nOMPmyKhSMlF+WmsP6pIShjlwDJxqI5W1rMXWWR32gzXmLHcbI8QUQgtZidzeMJwC80wsvXF0MHlx90QMKMd4C/THYc+z0cgqbLnE+WO55zw7SLM/KCqoUYwEvA7vCne/DL6wu+5rJWyvfWxai1Yu6mWboV/lxi7N0OdkAkllnTEj0Q2l5QGhPYob7ysRmpKEap2tWZ7lqV5dL2rNs6SCKmzgkOdWgh2/cM2UqTC3TvtO7F0EQhysYNbthrdyEIabhT/ql+dIWW2tIaACQsNqSU3ztYOS0CpR0tPJJeEy4fZLQiV5Choq/svzOvb6gRbSUHTt9ztRFC7a+XZMUdr/1Q8xX8HDix8p0yVnKTMbHrU7r9nA7H8UtpnVuQn3O5w6ewf4vV7vutpr8VfIf40XRqdeFoyf4I3ejmqdo6uzN1fe9iVYWPGwopSqb/EiuCK/ujSI6nGEPz65qwoccXDdQ6HUXVe+an/SOuzOzgHPfIZe/vwKbUDuBcUCYc7DsQII6oOZ1MaP0IYq6shigzjF2iApeuUiu0I8uZn4dQsxcFZTPNt62f0uVQ6Cg6wmSlZCcrnc9h/iFkwNrFiEfkZkhRUmxgnRHuot8A9Bc4Eq4XN6+E7MfLSiNnZBt3uoT/mIsOftEjyKwhqZUtTPCApvRnUaaNaeWYkJWKzujUL4mIMkpFI1RW2wyLHKkZCqwJz9EcrvlaoIyif3WQ5Hi0hW88GVdC8htVw3zLzgbEFhxgEHX1MiRT5iYLfLnWmTMs6yZ0JMEFmUnJrgBhgNomIw4I1iPTXYqTdT5kQb+dqOHdzOY1t5d2eObr9CCrOKtExtfWqsnJc2yyk/keAvRJ5C7JbkH1KkRlvYoxbt6LWJ6dJrP/YlPFBRyU70G2TorfGHD62p0p1yinxfHlhgfR+62bYUx5pmW6ZHpMppnu4e9Ek2/prSzYi1jVFn2jRf7L6vD28rJYsZUK2gKF8TKrBi0pn1RcUN+84wqhAuS15Xv7RYNgVA+ARKcxHi8LxT+4uOKcerRsw80UhuhHsZM7go+5FBz7EdzbI4PH1GI7Ji1ruROdUz9K7SBtykLlF7KrEZycvFhh65SHsV2GJh+V7TKSwhWOR6QCc7RRdUUUHchsDWtM7ZmuXWsoH9EFZk17Ui+9gTXniStyVTk82wXU/3FnRrdyIzfOsmq63Ss/aaZQo26P7YaMRFHw3hPLfauNFns8GQTTqZrGJroGJgyD2UYiP/2EcFLMgvFa0m20p2d7td1OrHDdYImMhH9g0w90NsoUY0CnYEmkCnLQuT4PZdFil4LbMErJZZCuu5jKmKdom+jE41ga3UuUVO40L23MfgHTO4Lu915xyrNg/ptWMeC9oLooeGEDsQhMnAiI9hWOuKp352GvGiZGWILOgLx0PjvEBWtlwMdggWXgQ7DuTIBqFrqphJWTqyZ2L16L4IsPOysy/kk7Z4cYAd6G7pptLFUoN3p5IStmCt4xO2bt1jzhimireV02czBRagCTGyvC2YqENUuX9kCfLt3eapFuHzrpfe9QSlQr9d+9RYpuuEgH5cDcavV2isSlKXUrOIiuNOewvcaZE7hClI5a/P7igKT8VNlg666J6qSFQFVYzcVxcF5zZBFdueiXUr2ZqT4dSSO9+Dqa2pyKXyCbN7Zybn/zoBek39tCvn/6Ik7EdbxtLXgg/EbTXofsacpk+JVffN8ED6qn+vZnyUa4Wb3GIhDcJo5REvwgm0XC6zOlHlJEq93oj3VupTYKbs6L6/Q7oVoFaD+ggb/gDVnfr07NELHivcgWsLvh3RyxVPmTcdFuCHilNgLKxOpTD0NrXF2jB0KVy8rsVDxXmu7f/BpYp5zVAIAObA5UxWWCxpJugmtS4Ye7ikm85TPxghxig2rwztaIhhjr52rFtrvXv9hVWHLnE0ZddIjrNksJX7hAaOYD+/yDHTtd8Czi1UgFmB1YCDus35UmuqZuiaukWpNFUzvKQA5e0z3RdS1TwMaNdknN1O4PfI/b6DWyEVmiu5sZ/Vf/W2pnO7RvGkL/MrrEzsMF1DOHZExZ8pOagOnepMSZ43ZmOqIyVL6h8UU93FbwTCnCrTZBepdlD/N/e85dVHBwQAkpACBnOOhBTfKVpS8GT2ZT+A2zDllUMqpeyBafwVWEmw414w98JWP/8MZrZhZuWNZafr0TkMOIdqE4Gk+G4p7X/vuQnASMkChmPCeePOY+ALYMAyKRfIagfDqJ6h61an9BsbdCur0nB85sr5Km2dGFcy6pJtcq9+veAxIrzSpt6Q/h+DZYKfMG1X0tdE+/iGNXzh03ETaHLrx52wsEfvYJnSGWVPDjlelstz4AJhrSVhEC+1qxH0J2HB3rIb+hphVK62mhHMUc70zXNUKuiJ8hxRQ56EDWWs8DG1l/e86F2djcIFNVRpVGINKF4agBwcFgGRRWG1mNx5tB+W1lBD9pp77j44lcXXWcMEF5NT30QWZTU8gwmWDaMNE7nc+HxaIgWhpXneZFKMCmMwzUXF+RZ9qTB3wc9cFpgJrzVEZyAuR66ubtQzlrm0Z+rWJHzLxA3NfS1QnYiONUSnvINiP/mmYW3G8n0LxweoEElVXbezkwtL9Bmo2fvt+lR8/Vb6yCu6HsL1NI/OVBWs39gpdYjVjwncuv2/39L+MbKlvWA8/RlvpvwLjNYcY0XzilBUvxzRcLhNU8UwzwK3abJL5BqGrM3m/v3YuQDtDTMaF6DkRh8FORAjYuxHtxfdCutVc0KtWRioMqzIymX+1jU2TZnhWU2pBxFmJ9IMM9OK2F81/x5WmiKrzwVikHNXCcIpVvZPAITXsuYLCH20U9WFnYdfH5zyq4Y4T4/6xiKymDPR4GZ3LyxfNqrucXutmar01JG+rjUCDIxH/KZ5IA0ciTM3usNkHI+UOg8ueWi8EZ+LMl+eo/dO0zz1wA3IddvzRb+Wt2dhu9oFoE8Ry++Eny/PQaS+5K1RE8Powe6LnEsDdFOYuU1kdcGG6bCTutbblFj2u6+6vkDbmQt749jCOd8T7hor+rNmYHR5ftCSjRWfO2DJWsZeiry1aGfozNVnerxT7j7Yb80Cg2r3Gz9848Nx88o0lZvSNJdRJTjVTjLSXSgbidZYMTzngypAB8rABCo5HlEEmgqdFB9lZ0G7pqobeWY1lbUw6vpCZtf5+sXlVd+GRh4y1kUUxuqyj2woeOdayPalxTGJLoVB12wpMCiLkS1aSpUSvPbJQH/ZTXpV224SUB3hPy0jnbMMuyyXgY3z/rePiAnCq5xadeYb2dqfz9DTi1tclJy+RlcuIOLIgvaeheMi8DI3+dsmBKfaqyXMGdM31uQ+gq97lOJ1wpjv/dXwgembPU+uRrHlkqp0LezCIvvcfQvwPIB1ulJUryTP7e5xvvpIp9Gdp/cJIgvDt3evlZ9+cDbGswaM4/I8XEZy59d5IosymzjvClbF515BG1cX39PV/DvLjhRQn7qAdjMyr8iYl+bN0hNljXU5b7SlVIA8YPV6zd9Ilzis8g1Wp8nQG6LqW+2K/UVkJzECjfzUKlGM3mFS4ymHjVurgib1Y6T4rjZQ1X4t5HzN6E2tFcU6em6wNthUsQznJh6FGT+Z22EHn8tbxPIX4/eXvVmrKTi0HH0aAB+7s2C5CB/d+h5L3H1vsMnPh333jrnOmJBVrDfOTh2JXkY/U1aTxgw6DCKyP0UmnBqZcWdLvOHc6j2kK0Ko1ouKows7PiIyp9puiRrsN+xZMJHT28gC4Eyb4yzPB+oWGBhcMVUzMacK3jcLrBiHDJ5ABM+9v4slwiDE7+xvgzMTCfahnDtwoRNZxH509LTJ5yyp0qUvunUaZiAybyK0CfE1wtOzkSJDF+Ya3sepE0qc8dUkeflYlfu2/RAzoVFODWY8EGSYy8p0fjcyNcknz82sI7a4yWMDPsYvUkOLkifL5nmDcrrA/gnII1/Wb/g+W9NaxWuqON5CIZeR/nJFTwMn0n4AXrf/NV3UVeAuVq8NMxUAM6LgxFrfYAjY9NDjGvUVqxPfITg2pwl0FZFFYc9Tmm105qgj1kn2LZVcs9zFz2oUuYLq0USoXJLjHxrvHy37hfHWaiTdvLywaXBbQtLTaXR9PXpaXf8vOT8y7nT09P63nPsHmPDpKlk64NxzSCh2K399dYkuBwZVl41kqLW+umQ/BxELu5pq2GVUR/o+8TCfWx027p2KyOYyT13xNai46xsdnhdkeRkxj1bx0RLck8EEleedELAvHXYJtM17CFuyvHnKGQniFbG9xkEZeISbP56R18y7rFJeU3V376tPDj2nfoiCZI1bSqpuFMGlfs1pqLy1RmHal7gxQSAkGBXPdwMiTXUlXmPG8fAhAzWhcAT1lQuq1EinBXeGjon1x3t3885K4QGg3APsYEo+3UCz5WxEI7Iim1d5vo0en2FFFrUOqEO30vQ4oPO9Uar4FBWTEVEOeiV2ma6mKEhgupu96jBXcZUz01TWtbhonqNQY7u2YsOpkvZ5Yf8kXZZYbAmuJ/PKzz5foKe+VuJzxa2tPGccCjggD+zitpTafvMZ+m4YaBD9V5gbITdixxHSlFQAZrHepT7SaZPgCUJw/bTQs7rK/b0vTXpLl5hs0adRd42zucKnKMr3A++ImAlUYCYWChd0bzpGiRV07U2Pk7BjXF7BsOi9zF1ydAsL2Mk6CzCFDlhfkCpgBZHKQ9rFjXtPN+jXSoAr+U7mlKOnTKxn3z5HTJLnaG7/j9r/wwLzrWZ69m34fdGQMltwPOicH9uG2rXwz64QDAqxLtCT27r5lVzsBWowMimn7q9zz2cNg6Cpshs5yNC6iKt3e5x9fvc7VhR9dAnA3377+d3vbz5cfPuty7ldY4XZ6J7cSHUTs2T54AH7vR6w+8I2GgTDIrYR4Wt24qKUNNcBJva62CZwYRZSUaEZialAOqGkBBwX8aMggfeBWESzDWbD5sQPjg4A9nlsovb4xC5R19U80aEw81wbFbvyHeq1kwXEundptHu0rvlIFyQ9ttilbQw2MGl8sUlb9+LrXSyJBRsNNNVTTRaIPXaqQTSiwDT75T1hpXw0nuD9AxeWeW//fxiO2prMrvPfSbZY3onRe0b2MnmSzVG/4+7jT8oJkrZ2Vrbjlz41TUZ7nWUHOJnPIOw22LmHX6ZryGo2xXsYFH0tMONW1jWYy5XXGZfn3do2QOKy7qChywCEwXhWYZ1znVkT8Yj5HJN4DenWvvroTBZFJfqRqAF34jjgpody957emr/TsE3d8KaPs6wfyts1FvnfZPjVrOXNYMOO0QwP5m448A5zutIlI0xGyxKdyoMH7jdYieGjw2NnXYuizGQqZXz9/t0V+s3FUduk1DAjXyZNJbj+j7foS0XVCHZrxUWmaB+pM21yQycgukUf6qKzYFpXY6WTiBdpl6iM3UbAEi2PChwdomoCj2MPppvHb9CAOVZFgtWyZBOEF3AZsQC5IVrl0brS7tCMi3a1QzrHpm8VPpTunAqyKrCKVVbS0N2WeNC++MGvT5gM0qmi0MxW0fcCoYu4BVQN4cUSoJYSkJXzfyWgWuLonTAc4lT07QWP7hmLfeF45LaCWtMzOtMiwwQao8QvP7G0tYjovHcIz5fl+idxa1bR73ciMmJUluuouOsd6pbycS9PdyC85ji6xhAZFUsmIhZFDkmnyI0W2SLTG2ZIdP0hsgWXG42L+LkrXdrCrNNRT/DqQkTGREp1wkRJVTHfRkt4H9AuyU0a4mvMU+wVVmalkkZm8Z+kgPr6pwwijvFp82Rnk8tllqcQtiUcP/+NiKzAt5kxscIGu4TtjuY0waVQMJGIaSbSMV1ynfE5z2I/i+7Q/j4h8ejI4B3asbEQu7RjV/V2af+ckParhLT/LSHt/5GQ9p/T0Day5HhOU6iUhnp890xkRcXB+J5vE9yTNfHyJoFdUlScLYsyjfVtrUzMl7GTkDxllsIo0fQLiR8bEZl2CYkJVlArksabtITTeJN6q6syQS9SIpqy6iSuqpHGuh70NoEKMdJYxywVbXBrkhCvBLsVWEhNSYJNuH5lpZLoUli/kqVZUZwnCKvJoswITxDDtoQTPJIAXTXfmvhhUUtZJ6FcVlmCNw2imGEE8wQFRDrDSyrINmLWVZe2wHz7B83nKfheZwADmoSyg4NJw7VLrE1Cfb4s16/SxKB1Nmfmz0mAxojO4vaK6xFWMrqq1kmOOVClRMWvctMuxh+t11aHMDUrF+ePHxxxxMHsS0LcocnHQ5Dr0F4wTlP4MDpbpFhEtohZnL1LOIVtoDNWQpJilkTVsXL9U65NOQDzj0RbK5KENmcLmsKN0RBoLmjOohWM7tJmIs0uKWRecaqJTCFtT5wtE+gmWeoNNlF7/neohzLIoxBWdMm0UTh+JKSlncDiU7RMJWqVTNYakMhVIv3qMvPdFk9A3SiKiwSGpCsFSsV2OuN6s5JMZ67DbHzqW6xwkg2ejxTCxqC8dv3tY9Nl2mARvc9xrs28UrGaBdZUqesVlIJqFZ3X+HZ0XZMcmyx0bljEb3Z9LNLAPppLnOexzwDLYz+r1tBBCe4iVmRESVkkQSWyhBO4aazI0iRHesSjFGIub6LDM5U6PmQpK3WpWGSiHBtmqujZZ5wJGg9ip6Wqo3bUaehC8W38sBaXDvU0W3AZ/TpviCdI+bc+b3StY4km0DjWh07AavTcBC6XSbauWCY5wKVUsRVYMa+WKY5ZwTRJoRYKnWTDpugDIagBcKXodKPrcAcAHTvjz1GNnY4nNpvYHkiSijLpGkBH90RlfMtIKrbMAv24Hkx3I6iKf2eVmWvKG51s1M7ULVnX4jXJJktQuOl74sRWBp5sbG1QZi6QFJ1drLX9MCOrWHX+A9L0tmTRHwJKqoqlwsIMMHdjUN4kIRz/6nVIZJ8+9bqARiCs5DLDuozYMKBLWuHYVBXFPIV9pygBOTjU0UTE4wvZUo4L4dqhLFWegOP4gUydIDasXWw4QT6AprETAVzD4wTOiaZf4m+AEEBrNKoJXCnNlgkUry5jR9m0IinOgSJ5dENaKxJCxY1A2MRrsdWlWenoqJprImIXSgS7xT6UqAPpjD19szTxt5UjGv9Fr+npGZvutoyO1lrl8yR56JXiCe7CSlOV5Sx21XuSthX1y1AKMRiiDS5iR4PXGRPa4EUCy2DNlElhhq9LkQC6yUhViZhh1hAsWgBR9E1lJPpQCTQYuskeSdgs7zPmLEdniubMoDOsco9mqAH+PcyO65yVUEpjHUKBDDTRR4BvQCRHoVKdJh+CiXSSuyhKLrd00FjwoPwWsooG6n3HPWZl6GJG0O9M0SW9RQXuAy20b7FiWfWbgSRnkjMNzRnq0f3SA4AS0lVZSmXQEHgUoc0KG8QMKhVdjG2FB6Tl3qcJRUjw3utoWEBMeGT3EVxozkTqjvwdVu1oXT41MnJJzYqqWft9vZLV4EZDSNA1VU07IiNRiZWm6B01GDqCu7OKGxE8fSuX+sWVK3t9hs59i6/nyKwCXYoADPgD9a2PgW2B3lPzOzOC6vA6Dzd1EuEtoGV3c4pgcDdZTbEiqxkTLMgf9NydAF+7pz6hFwYkQ7zguBLQ63dZQR/XGsQ9DODew2vfM6f0cNzNnBoQbt+/eMTZtwuRRaxpuhvyKgyLPtJbA6diLFwwRTfqEYXUNq57Dx2qBR/peAnouQnbgQN+rqYGKfqlotrsAe0+Plv5/lj5zmSAtjxuVKex+xGpJu90N5yyjyfHEbyN7fwdENr16+DMY/b+P9zf0A52eV4rBRg7vDfAa4iXxHvPLWwvlznWFLl07YYbNDhVzSr5X5yGX9G0gm84l8rB1wfFiBDWSFMK7c7w/n5VCguNyQTtfQcI025oAWZvu2lIpaAD2j6mS6oK5syNqZhuh3SNOdiacbqkiNM15QhrzZbCLVzbrz+89QGS+YT6G8bfs9PnJ+n0bDmrBPtS0X6bRBw+fB1+j0NMPK4LSm3RsNwdSCKFoJBbgTbMrMYUBUKBypDGYlf0qPKie7sWVpygT5orisslI5gjy8GI6wNcnJY7GGqkTePpZFeutjrMXiedbSN7Wa2xL3jMGdbZSib3CZwT17hr0EulbWpktWK3BU8YDwC5Q2O5hTvNN2IhnGI1e8O1tI74znk7h8dy9Kv/xQy9EdvmXwPqBnx5LQzC+YzIoqwMVWE1nCSMbyeWzj37pr8W0GNxZ0GY+Wf18vsf/mx93/POctQS+ybItt+nWdwXs7sGbvCWKvRvTUxOv/BsAHPhUx+7/if9nhctzzu7fu96HJm8fEi3Pek3TLHjzND73z5e2LlTRV3wBOKlOdNE0RILsrVWpTfPeD8XBIGEnqOP716jS2F+fPkcXb4/v/jP1+jTpTCvfkJPN6stEpSZFVWIrKT2rdKkUpQY+NYPr/7Xf3v2JCgRalYJdVxfHqBTZwUOt+PRiXffPY/5tduLlzVT4SOePy6mu7rpAOdHAsbd+YIP8dszTFvv5DNTpsIcvX3zPsjsH1LQdLGs43bG/5GCzsKytex+NSoUJnJYecISPMY7eM86LLGhG3yCFumwu6/QmzxXEKd1uzzETnP1kqI89p3zoW8hl2fvrtytNPo8VmA94evHTlDJWar+7kaXV5aVkeiXleGRnSCiyNCOPS7D2hLLXHetaRVEh12c58x+GfP2wbbTyz98z024AaxLCAdc+hN+vrsFBqy0udZJ7Lq7XmkYvfccXkllGpU8ULo5PLDBAjCzPax59cSyd/NhYllfJvW03o0JXtCQ3zhVFNdzB54v1loSZk1OFzca2DjI6mWFxZLOGteJSLFgy0rRHM23QJOKHLKGwnqmPBJ6YFA0OmItBwddJMA74BFt/24JV/QAgKKFNDTzmd3x84ziizYXOsOZS8VPQLo0Kg3xRYItsUhQLcxTHIdU+CdlAqHiPKsjcenM8r4Hb+cx64/WDSacwIK9MCuqBDXo47akz9Gn+hp7CwGwH9FVHQAb3AS/jVlqdaueCYyJEde4ZtrHxZ8jzHnQmCjbL0KCG1aQmLemyt6BTBiJtIHLnAn06XJUoRBIkE2mr6KrbEtUlgnavlnCiurYGb2WbIISF3cjxk5Fh3h7Am5da4WMU7GM3ikSeLbGR0IrdMQCdSYP5p0HGIEIpBMsEEa/SLXBKh/26UbozRKSvRTC9sTfQi7dnJoNpSJsekZGTbzvG7c0mHef6hwzCCDjITNiMEMmfJ4rpCUUzFi15FtshKe45lhM8Y5/hwBlnSDSCVEOJrgbsmxfUtbWg12CA7t788R+qaQEUAjW8fDg7vZij5VhpOJYIcCLRjUTTy9uX7+VS7lYhLu/U5KZFU2+vDvMfrQDutPY4fvC8m3ZfVOZFRXGJ4uPsq2rmMgJd0vocUOOs/5JUzXKsKwMkdNK2g85zvB1RQjVeoRnQB4/DhztuMQT4AtZE3cp1RYFChMGvE2hnHZ4pD0erVaCBz5dSmHvFau3QsZh80M0MJR2Z7WOh0c3cm9i5FBLoWaAM5o38/FxmJ49zATSzFQB/YmguIB6Fe2prrBGOJelvV3MijKF5Ea0S+YEZ/CtFLIYyauFnhyaOYj6aY0Ia9wzkVv9I5VuBIDRL4xT9MYzNhuI4S7BXtFMzJ3J0YTxZv4nSVcYFcG1z1qIK4XQHAOCiFnv/gBBuHy9a1+vEVsS4wmhc5myeiAw+Tld4TWTFViXRBalkgUbyVCkUzN3IfCcQxHZAp3t542JdaN2EjLZ53DH6kRBBnY4jNpc5ggGA+M3/KVe3c4t25630W3XlllWwvTL2WJb9DmUgWfkGLf+TlYQ3MdLKqhipJ4SCAQS/fqpBcys4KoN9XZDntkZ+WGmjRp//KzndAzs1snm9HL/nLx54cZKOK+ga9o44YYVVFu97qw9RUs6+ojkVyEaKMTBhQDgwQcug7rj1joGu/tkW+vHu83ph0xHa3J656n5gPGhGQ7mBjNuFcIdlMHXO7uXB2enJl07d9CizE0dXrloWKrTKJADerxRIF/vdvzx8JLFam0wzZLdTT+qSTVIzDN2B/0x6XaMObfBZmyMeihB68Wpo1fuVGaVFdSs5AleSfBOJBk5NvzXRhccsJSUTBp12vOq80FyH6+1jOzZl4kiIf85+/n779HTt+dvrp6hc6YNE8uK6RXNoRQ+yAuXS5kcF2jfSxhkyy4cH36Z4YsjGWNKJo4q7qv/tKsa4qA5MRCRj9b0+T7HhUDaf1P32wn8AU+hN1MsQjDpbaYY5rHQ6XoT+YBzVmk3ApIKaVYwjpVTT1Zt2jNE4F4Pl1fBOdcsnxJppJsp/8luhDqK2MPFbA95ujqLN2LfWYdnDV9p2In/+iARfDLYCz5wQztlGXk4lClVysSAwZMNiFqqJRbsjz1Z1SLdVrirsI+QdHdPjYh7wVSwljQR6s8vdji4LRzEl8Mu2slq/pViblYEK4pKRXNZMIGDBXcd9XSFDaPC6IPp8RxPOdu3+KSTddCPtEy0ce3ReWIVV4mVATCkdqr71eqEYEde2dxFoy5oThU2NM+iJZXt2R9W+fxSj9g8nl0puWZ5Ax7mv4fLkntLdbAxPPiPvdZ2bdqwgdNOkuUTzbIZ0mP9me3INIPNQyFzcs3c6/mqb7iPQMA1RmfMpuD3tTzpLdhMnR91KqGXgYk6GxUsVqyRNlI5jW+pFdRgGO0JfGtmv/UkPPuC5Tmn02m5dzDeXfVcYHk7eu8oPVe3x5hmuld+tA7CkNjWr7PPUcmxXTJ7P0uFqCBqW45F+SEVcgJ/8g4ZdKrxLX+V2qB3mKyYGHHpcpxIc3zTl/UnAZn+paJWfVj7yIGc6Rl6m+MSfYZ/OPsol8LVnf5zeHmiFV5TazlxihX6UlG1RYBBqEspNK0tqnBxqp1vBr+ZRl96DDxiKStWo0AKN32HyzfOZz2lCVhtN9AHD456V06hy1PagFl/j9fQ0jsgRtY39Bcv00hVQgT9WP28uXncy7ODkRqpsfMUM+9hpl8IjDZM5HKjkS4pYQtG7CfPQ3WCPk92eEDs9By/bc4NegqIsFSQ9hqCp8tnHWmhSsA9/pYuMdmiT3oX+LZ5gS36hbTRs2vtCBM47CO3fdfVAlagVg02mb0RBxJvcAAC1f87laZQzjMU3+600xvUY+i8zrwOzBhmGNxo/jdHTHaavN6xqfoMXx96r3XdBUx9HAV0OJtpAnbNg8Hu2rQJmW4ZBisUBqQ4XPwMZQMxWwKOVrjBlHO6YMLH6kE5AapfgcsR0EHg7qhCsUS8tQGYnvkXWzE2MdvUc/dYSiPYlE0M2xhMVsXEEPjtqCBwNPCOusuRpMnLnIl4HcSing07ZSgqTHt5BpRUt2wHlsXBaLfl/YGunQOu0959B7gusar3lP3z83YqmxUbQKkjezqsL+uS3+80PRO9Z4mDtZBqm27B/6JLLP56EDGmZmQXRb02z0NXkxXLX14A9QNzO5lJNJhVjbe+f1ajuyCjwihZHqM6clnNB8GFO+1xP6b1tumBcgTg0VV3THsOz2RRYrFtziMcO2in7/yVNVX2GsqYWMiwUYD1TeoaoQP6o+dF1pxtaFpU9MWXVDkCv1Scb9F/VJizBaM5Ooe6ZxccDLKyofOMSHnDTvTo/judIzd+6z9jPmbNR0ebbZ/Dy8qAyX1kC9PDZ/1DM4TvsuPD0S4mP0Mft6Wbehs5sMJxKzi+eIousqhgsj22LQ8uEKGe6BBsbZ+ZKUJ1jXG5y52LLJZS1dF+eGL+8HZkyTtYOZG3Uy2LMm0foj2isCMfjNzXbCopE1kiu0zZcex6oBKbcGiSiAzrmK/9HcLKl9NHplwpHnGZO1QjrkrjjGaVihUN6dDUVGV4Gc+nbElHv552SUdNf9wl7Xd9AsVCbw0VYFrFd04s/Wi7uTH0Vor2UmViW1RuiClqCXd07kcYFsyrF/6/zzwLL/x/+LymUNgfc6rC2Xl+Oid8PXeT6T6eQ8S102ptMJ3cN0SzLhUTC6rUyLvrcN6TzKtr+B8UfTA8OwGTNS7xorMMgSMFz9oy6ZEKDDHZ9rtw7/Z2232EDGLV/dM/6DBBa7zhJytXVE0Tj7A2u894enoGrR+foTMYP8waVWYisJQROZ9R5Zt/0p0szD3gvDTp03FHkJ0Ft4M+0R2k6L0rzf44Nip5f2iU8Gqja/ZHOFrDbhLplMt/XCBBl9Iwt4DlCuuRDlCaTA0r1FlKN/h4c0G71Mk6QA0SXHp7rAZOr+tvwgkpmi2nqKjYxTdquh5+HG20bLUJ07qKbnQCZUiWShete9gbCnBIlUoaAx0sSld7XtjB0TU8Tu/TTpNkSDTI4P4V+ek1pHbuv4w62vM4Ju+vPffwOK5CtebZOuWN3n9S9YHsIDN5ZrcerqLDNOpUhNkN9R51InCDb9p2Jd0LCXTrT0jDe51U6PL6zT/eXaEre0+h38RI95WW20SV1Mdw+3Ejw9yCGiIrSm70UUHkuynhtBhkoaZzDV5nAxEGaaC+BWGrBfdYuVSxASjkCYxcx0eDCjLqNADPBptqsg6fXS7XmLPcbcQAE31FOBmq9T5FCBK7oVvdV9uRdn6dQBqZ9sqYUmcMetAmIQ1LmUIgBD+C08SWoq58kYqZ7YETRWRRJMWJuyPfjg8fEAqX4G+YorzvacYOsWw4FpnWp2p4a0d2Ovx3P9u6RivIrSs1zkrJpkirDjHsOEDAATAV9gZArGSFhRgAZ6SGm/KjAiMjb7YTwTY3F4vvefj72zfv/b33ojd8c6EYqfqx/+iYbUzfZGvJq1QCeFP3cRa+z03TGbtu51sJZjR66pjQzwCtAwp76466PfIImA7OhleJtNlbz+snwYxPF5jtFh2sqYJMgUXFEZGC0NJYR/nareEIvMJmk1L7OsFbh71uoW0ZLaUySFr5/vq3N6EU3KDYY+87qZbTJ1j2Cwx2Qqxz7MBOgkAxf7/47eryCr3DtwUTedPWO7ysdm6Tp2HuNFEcmZafxmB2+6bVmE/hksXo6dmuyjFbTFeweeoi/HrKyc2OnWCZ18qX5x6l13Oxl0M+3aKcGCugnnHxX75uuCnMEfnQkox9uiFeYl3oE2U3+nbV4MU3j7qFK+59jnQVSFHHGv1FGyXF8q9zjskNZ9rQ/C8v/N+eN58ysaAk/NGCKbrBPGjI4Dnv/AZhkSMt0ci2VHTJtFFb69lPqSxKbFYerL/hAfV5GDAJQamp2HSF0K5ei0jVQSFv7MmGcypMJyel5ts3ZJw13dRmvcM/zvsY3zld4IqbDM7Ea7TAfKcUeWdKuxn87zvJEXWnyLZlfFu2ZhReLBiBRgJzSgWSc8CN6AB6Neui8T0m0z/YB6YyPPVNyNhyLRKbk4VODZM0olEU3qCCao2XHpeISKu/oYFZyJB8K5fonBKZjzz7eFrRY1QO8zliAlOP4Sm1ERRh2htNLhAT2mBhajbCPr5hR13i+fCeCpricA6Z9W6Nq3Nq2xOglfVtocPu78wIqnW9+oe7IAi6pqoLUFFipSl6Rw0GS93X3DZDPX0rl/rFlUuqfTYgf+7TwVqzAqMP1CkLt8NFh80RJBm6ThLCedhrc6GXaY1nv8bv/Dm/PP/BP7g42LfWuwZMgFtMDOJy6dZriGsDs4NO1n63wPf0bt8h+3u/sLPRnTEgfdROCe2MAeXxnTK6JOtp1+Tl/1+T/WtiR02zIA87vnL+ryyIdfVouFuneip9GGuKpsyKfbjYUp3/h3EGvl+6gvuHMYernJkM8KgfI3u7jtMjYmwVsaNuVMaYOI6xtBZTrTke707L6VHNYtOKbUFpnroIZPzZogub6IAkaT6wQwZGwsO8iJ4dMqB+wIsYl+L0deb9xrhB8TlxDaYZSXwoIMF7i49MYVb714HGjFbN/P2ftrtO7ZkUxF4O2MjH7tmOqBsAqUuoDrvSPbPDuOSXznl+K5e+rauvYgAsOeuCKOoV1WDqC3ZLc6QpdNrd+fHuGHrcYakXYUD7wQ5LswgD0vdalGEkMH586biNOZjXPWRyPxlEhFjYsy9/rfNK/Y7k/R2pqWiQh7lc6tC26cSQvh75smM22OBHo4K9vFr/1OIBjhz3vnAHszfyaxXu+lVq8b76f1e8iWufvIz7esEF0rrRshxhtGRrKpog2ddrCFgRHRe/SOuB5I/R+Ps6XjRGAxqy3GaKfkmw1t3HQ1hgmLcH87vwmGJXcJCe+2i2wa7CmuChBpnTOnn006UwP7xCUqFfuMTmx5e7aV5EigVbVmo8v6Wd9zHm7lc8b3gGfaxlk+AZT4CZMZYdU1cTfe0BBqk2WOXJjLr9neqdQfJ5x97DSFGOh6lpDlrVX6KebQ+GCTtVtygfUrElE5jXv9m1Vg7IIZX9tScx4vLq86uACFAQTRZFEEHD0VDKMW6fdqMODcdjb58VxXnC8vod1w6GQpfnD3kldfx2H0uBzHFvpY86yMZJljzOhpsc3NbQgoNiXZczyTngpn6NCthK7wQ5N3bPMY2IE13dHq5jqL6Vw3YW44J+hB5fQeaPxVQtpDZ14d58O1i0phOXJahZUfKtXyf7ZUhmppiskGY5RU+/R2alKvTy55+foQ32rYTqUfZI4lEYr3eQhO+rk0wU5KvZFa6pSh1TaHBX7VHWQQroKZ7LNe0Ig4VLdGr1po2iuBg9P+Sr2TYnFhXN2VGgCYcE9U3IcmwCC2yBmKlxf0Clv3AwoTXTw3ZW/0RQL7KlCr1EF4LgUlccN2Bl99LrIeoPfPwI5FaGRvnxJfp3O93n6Mcf0b8jIpW1lx3mQN1M7b9z8z/tF5lGu0IJw18ImdNH6+uKDc0I5nyOyU360qecCmnq1mjgV1gh1jUv4JqMdaWDzZEczAi2DABuYw4cuz72RiprWYutszrsBx0wihBTCC1kJXJ7w3BoyKABEeBuyYu7J2JAOcZboD8Oe56NRlZhyyXOH8s959lBmv0BzSgVIwGvw7vC3S+DL+yu+1oJ22sfm9ailYt62WboV7mxSzP0OZlAUllnzEh0Q2l5QGiP4sb7SoTmGlNk65QNzy9qzQNtqVx/agGd+Dt+4ZopaJl6eb4bexeBEEe3pzsIw83CH/XLc6SsttYQUBn2Fhnt/t9IIlk988klsduPZCRfLslT0FDxt+BXHwANv+nRTBTFvhHQiKK0/6sfYr6Chxc/UqZLzlKjlzxad16zVIWwD0yRPg406q77HU6dvQPqjkB+19Vei79C/mu8MDr1MmgXNMkbPbQAkgpdnb258rYvwcKKhxWlVH2LF8EV+dWlQVSPI/zxyV1V4IiHWt2ioStftT9pHXZn54BnPkMvf36FNiD3gmKBMOfhWEFd/bxAbfwIbaiijiw2iFOsDZKiVy6yK8STm4lftxADZzXFs62X3e9S5SA4yGqiZCUkl8tt/yFuwdTAikXoZ0RWWGFinBApwBdZLlwHd1QJn9PDd2LmoxW1sQu63UN9ykeEfd0WrEdRWCNTivoZQeHNqE4DzdozKzEBi9W9UQgfc5CEVKqmqA0WOVY5ElIVmLM/Qvm9UhVB+eQ+y+FoEd2tF94eIbVcN8y84GxBYcYBB19TIkU+YmC3y51pMwGgfWhCTBBZlJya4AYYDaJiMODHgaa1wcqcaCNf27GD23lsK+/uzNHtV0gRHQk5HyRIPBj0QOQnEvyFyFOI3ZL8Q4oToefUo9cmpkuv/diX8EBFJTvRbxA04/YtyD0cbs1dvi8PLLC+D91s234r8IeTVJRIldM83T3ok2z8NaWbEWsbo860ab7YfV8f3lZKFjOgWkFRviZUYMWkM+uLihv2nWFUIVyWvK5+abFsCizwMlSaixCH553aX3RMOV41YuaJRnIj3MuYwUXZjwx6juuuScPTZzQiK2a9G5lTPUPvKm3ATeoSdehZI3m52NAjF2mvAlssLN9rOoUlBItcD+hk55qmCeI2BLamdc7WLLeWDeyHsCK7rhXZx57wwpO8LZmabIbterq3oFu7E5nhWzdZbZWetdcsU7BB98dGIy76AbTvWp/NBkO26GpVbA1URG/F2cg/9lEBC/JLRavJtpLd3W4Xtfpxg6HtadUF4OqyWQJzsVo9NEKNaBTsCDSBTlsWJsHtuyxS8FpmCVgtsxTWcxlTFe0SjdXqo6WawFbq3CKncSF77mPwjhlcl/e6c45Vm4f02jGPBe0F0UNDiB0IwmRgxMcwrHXFTwSaLytDZEFfOB4a58U3cBnsECy8CHYcyJENQtdUMZMaGnQMfdqP7osAx1qT9kI+Ezduc7d0U+liqcG7k2t13zo+YevWPeaMYap4Wzl9NlNgAZoQI8sHnWGbTrBBvkNdZBIuwuddL73rCUqFfrv2qbFM1wkB/bgajF+v0FiVpC6lZhEVx532FrjTIm/RhZuzO4rCU3GTpYMuuqcqElVBFSP31UXBuU3U+fkOlWzNyXBqyZ3vwdTWVOTQJ/mg3pLzf50AvaZ+2pXD7rRdxtLXgg/EDf2A9zLmNH1KrLpvRjvBejXjo1wr3OQWC2kQbjqphRNouVxmdaLKSZR6vRHvrdSnwEzZ0X1/h3QrQK0ewn43hr/kjGyn6LYzoheugAEPri34dkQvVzxl3nRYgB8qD/4fVqdSGHqb2mJtGLpsWwXU1VV5ru3/waWKec1QCADmwOVMVlgsaSboJrUuGHu4pJvOUz8YIcYoNq8M7WiIYY6+dqxba717/Y00JS5xNGXXSI4POnRMcnLAEeznFzlmuvZbwLmFCjArsBpwULc5X2pN1QxdU7colaZqhpcUoLx9pvtCqpqHAe2ajLPbCfweud93cCukQnMlN/az+q+k7uNo3a5RPOnL/AorEztM1xCOHVHxZ0oOqkOnOlOS520P0kRHSpbUPyimuovfCIQ5VabJLlLtoP5v7nnLq48OCAAkIQUM5hwJKb5TtKTgyezLfpiiL8oujn6oG4qz414w98JWP/8MZuabarS6Hp3DgHOoNhFIiu+W0v73npsAjJQsYDgmnDfuPAa+AAYsk3KBoMM8o3qGrlud0m9s0K2sSsPxmSvnq7R1YlzJqEu2yb36bbqZEF5pU29I/4/BMsFPmLYr6WuifXzDGr7w6bgJNLn1405Y2KN3sEzpjLInhxwvy+U5cIGw1pIwiJfa1Qj6k7Bgb9kNfd1pZAiNC5+jUkFPlOeIGvIkbChjhWM1rD7wiAVDUUOVRiXWgOKlAcjBd5OWRWG1mNx5tB+W1lBD9pp77j44lcXXWcMEF5NT30QWZTU8gwmWDaMNE7nc+Hxa323yeZNJMSqMwTQXFedb9KXC3AU/c1lg5hvxwrzrgbgcubq6Uc9EDewHreGYuKG5rwWqE9GxhuiUd1DsJ980rM1Yvm/h+AAVIqmq63Z2cmGJPgM1e79dn4qv30ofeUXXQ7ie5tGZqoL1GzulDrH6MTtt8vZb2j9GtrQXjKc/482Uf4HRmmOsaF4RiuqXIxoOt7me+lngNk12iVzvtPHv34+dC9DeMKNxAUpu9FGQAzEixn50e9GtsF41J9SahYEqw4qsXOZvXWPTlBme1ZR6EGF2Is0wM62I/VXz72GlKbL6XCAGOXeVIJxiZf8EQHgta76AsO78Whd2Hn59cMqvGuI8Peobi8hi3rTvXexcWL5sVN3j9lozVempI31dawQYGI/4TfNAGjgSZ250h8k4Hil1Htx0jWtdlPny3LfgRk89cEPdm9IV/VrenoXtaheAPlWDfx9+vjzv9ndt1MQwerD7IufSAN0UZm4TWV2wYTrspK71NiWW/e6rri/QdubC3ji2cM73xO2Oz5qB0eX5QUs2VnzugCVrGXsp8tainaEzV5/p8U65+2C/NQsMqt1v/PCND8fNK9NUbkrTXEaV4FQ7yUh3oWwkWmPF8JwPqgAdKAMTqOR4RBFoKnRSfJSdBe2aqm7kmdVU1sKo6wuZXefrF5dXfRsaechYF1EYq8s+sqHgnWsh25cWxyS6FAZds6XAoCxGtmgpVUrw2icD/WU36VVtu0lAdYT/tIx0zjLsslwGNs773z4iJgivcmrVmW9ka38+Q08vbnFRcvoaXbmAiCML2nsWjovAy9zkb5sQnGqvljBnTN9Yk/sIvu5RitcJY773V8MHpm/2PLkaxZZLqtK1sAuL7HP3LcDzANbpSlG9kjy3u8f56iOdRnee3ieILAzf3r1WfvrB2RjPGjCOy/NwGcmdX+eJLMps4rwrWBWfewVtXF18T1fz7yw7UkB96gLazci8ImNemjdLT5Q11uW80ZZSAfKA1es1fyNd4rDKN1idJkNviKpvtSv2F5GdxAg08lOrRDF6h0mNpxw2bq0KmtSPkeK72kBV+7WQ8zWjN7VWFOvoucHaYFPFMpybeBRm/GRuhx18Lm8Ry1+M31/2Zq2m4NBy9GkAfOzOguUifHTreyxx973BJj8f9t075jpjQlax3jg7dSR6Gf1MWU0aM+gwiMj+FJlwamTGnS3xhnOr95CuCKFaLyqOLuz4iMicarslarDfsGfBRE5vIwuAM22OszwfqFtgYHDFVM3EnCp43yywYhwyeAIRPPf+LpYIgxC/s78Nzkwk2Idy7sCFTmQR+9HR0yafs6RKl77o1mmYgci8idAmxNcIT89GigxdmGt4H6dOKHHGV5Pk5WNV7tv2Q8yERjk1mPFAkGEuK9P53cjUJJ88N7OO2OImjw34GL9IDS1Kniyb5w3K6QL7JyCPfFm/4ftsTWsVr6nieAuFXEb6yxU9DZxI+wF43f7XdFFXgbtYvTbMVADMiIITa32DIWDTQ49r1FesTnyH4NicJtBVRBaFPU9pttGZo45YJ9m3VHLNchc/q1HkCqpHE6FySY5/aLx/tOwXxlurkXTz8sKmwW0JSU+n0fX16Gl1/b/k/Mi409HT+99y7h9gwqerZOmAc88hodit/PXVJbocGFRdNpKh1vrqkv0cRCzsaqphl1Ed6fvEw3xuddi4dyoim8s8dcXXoOKub3R4XpDlZcQ8WsVHS3BPBhNUnndCwL502CXQNu8hbMny5ilnJIhXxPYaB2XgEW7+eEZeM++ySnlN1d29rz459Jz6IQqSNW4pqbpRBJf6Naeh8tYahWlf4sYEgZBgVDzfDYg01ZV4jRnHw4cM1ITCEdRXLqhSI50W3Bk6JtYf793NOyuFB4ByD7CDKfl0A82WsxGNyIpsXuX5Nnp8hhVZ1DqgDt1K0+OAzvdGqeJTVExGRDnoldhlupqiIIHpbvaqw1zFVc5MU1nX4qJ5jkKN7dqKDadK2ueF/ZN0WWKxJbiezCs/+3yBnvpaic8Vt7bynHEo4IA8sIvbUmr7zWfou2GgQfRfYW6E3IgdR0hTUgGYxXqX+kinTYInCMH100LP6ir397406S1dYrJFn0bdNc7mCp+iKN8PvCNiJlCBmVgoXNC96RglVtC1Nz1Owo5xeQXDovcyd8nRLSxgJ+sswBQ6YH1BqoAVRCoPaRc37j3doF8rAa7kO5lTjp4ysZ59+xwxSZ6juf0/av8PC8y3munZt+H3RUPKbMHxoHN+bBtq18I/u0IwKMS6QE9u6+ZXcrEXqMHIpJy6v849nzUMgqbKbuQgQ+sirt7tcfb53e9YUfTRJQB/++3nd7+/+XDx7bcu53aNFWaje3Ij1U3MkuWDB+z3esDuC9toEAyL2EaEr9mJi1LSXAeY2Otim8CFWUhFhWYkpgLphJIScFzEj4IE3gdiEc02mA2bEz84OgDY57GJ2uMTu0RdV/NEh8LMc21U7Mp3qNdOFhDr3qXR7tG65iNdkPTYYpe2MdjApPHFJm3di693sSQWbDTQVE81WSD22KkG0YgC0+yX94SV8tF4gvcPXFjmvf3/YThqazK7zn8n2WJ5J0bvGdnL5Ek2R/2Ou48/KSdI2tpZ2Y5f+tQ0Ge11lh3gZD6DsNtg5x5+ma4hq9kU72FQ9LXAjFtZ12AuV15nXJ53a9sAicu6g4YuAxAG41mFdc51Zk3EI+ZzTOI1pFv76qMzWRSV6EeiBtyJ44CbHsrde3pr/k7DNnXDmz7Osn4ob9dY5H+T4VezljeDDTtGMzyYu+HAO8zpSpeMMBktS3QqDx6432Alho8Oj511LYoyk6mU8fX7d1foNxdHbZNSw4x8mTSV4Po/3qIvFVUj2K0VF5mifaTOtMkNnYDoFn2oi86CaV2NlU4iXqRdojJ2GwFLtDwqcHSIqgk8jj2Ybh6/QQPmWBUJVsuSTRBewGXEAuSGaJVH60q7QzMu2tUO6RybvlX4ULpzKsiqwCpWWUlDd1viQfviB78+YTJIp4pCM1tF3wuELuIWUDWEF0uAWkpAVs7/lYBqiaN3wnCIU9G3Fzy6Zyz2heOR2wpqTc/oTIsME2iMEr/8xNLWIqLz3iE8X5brn8StWUW/34nIiFFZrqPirneoW8rHvTzdgfCa4+gaQ2RULJmIWBQ5JJ0iN1pki0xvmCHR9YfIFlxuNC7i5650aQuzTkc9wasLERkTKdUJEyVVxXwbLeF9QLskN2mIrzFPsVdYmZVKGpnFf5IC6uufMog4xqfNk51NLpdZnkLYlnD8/DcisgLfZsbEChvsErY7mtMEl0LBRCKmmUjHdMl1xuc8i/0sukP7+4TEoyODd2jHxkLs0o5d1dul/XNC2q8S0v63hLT/R0Laf05D28iS4zlNoVIa6vHdM5EVFQfje75NcE/WxMubBHZJUXG2LMo01re1MjFfxk5C8pRZCqNE0y8kfmxEZNolJCZYQa1IGm/SEk7jTeqtrsoEvUiJaMqqk7iqRhrretDbBCrESGMds1S0wa1JQrwS7FZgITUlCTbh+pWVSqJLYf1KlmZFcZ4grCaLMiM8QQzbEk7wSAJ01Xxr4odFLWWdhHJZZQneNIhihhHMExQQ6QwvqSDbiFlXXdoC8+0fNJ+n4HudAQxoEsoODiYN1y6xNgn1+bJcv0oTg9bZnJk/JwEaIzqL2yuuR1jJ6KpaJznmQJUSFb/KTbsYf7ReWx3C1KxcnD9+cMQRB7MvCXGHJh8PQa5De8E4TeHD6GyRYhHZImZx9i7hFLaBzlgJSYpZElXHyvVPuTblAMw/Em2tSBLanC1oCjdGQ6C5oDmLVjC6S5uJNLukkHnFqSYyhbQ9cbZMoJtkqTfYRO3536EeyiCPQljRJdNG4fiRkJZ2AotP0TKVqFUyWWtAIleJ9KvLzHdbPAF1oyguEhiSrhQoFdvpjOvNSjKduQ6z8alvscJJNng+Uggbg/La9bePTZdpg0X0Pse5NvNKxWoWWFOlrldQCqpVdF7j29F1TXJsstC5YRG/2fWxSAP7aC5xnsc+AyyP/axaQwcluItYkRElZZEElcgSTuCmsSJLkxzpEY9SiLm8iQ7PVOr4kKWs1KVikYlybJipomefcSZoPIidlqqO2lGnoQvFt/HDWlw61NNswWX067whniDl3/q80bWOJZpA41gfOgGr0XMTuFwm2bpimeQAl1LFVmDFvFqmOGYF0ySFWih0kg2bog+EoAbAlaLTja7DHQB07Iw/RzV2Op7YbGJ7IEkqyqRrAB3dE5XxLSOp2DIL9ON6MN2NoCr+nVVmrilvdLJRO1O3ZF2L1ySbLEHhpu+JE1sZeLKxtUGZuUBSdHax1vbDjKxi1fkPSNPbkkV/CCipKpYKCzPA3I1BeZOEcPyr1yGRffrU6wIagbCSywzrMmLDgC5phWNTVRTzFPadogTk4FBHExGPL2RLOS6Ea4eyVHkCjuMHMnWC2LB2seEE+QCaxk4EcA2PEzgnmn6JvwFCAK3RqCZwpTRbJlC8uowdZdOKpDgHiuTRDWmtSAgVNwJhE6/FVpdmpaOjaq6JiF0oEewW+1CiDqQz9vTN0sTfVo5o/Be9pqdnbLrbMjpaa5XPk+ShV4onuAsrTVWWs9hV70naVtQvQynEYIg2uIgdDV5nTGiDFwksgzVTJoUZvi5FAugmI1UlYoZZQ7BoAUTRN5WR6EMl0GDoJnskYbO8z5izHJ0pmjODzrDKPZqhBvj3MDuuc1ZCKY11CAUy0EQfAb4BkRyFSnWafAgm0knuoii53NJBY8GD8lvIKhqo9x33mJWhixlBvzNFl/QWFbgPtNC+xYpl1W8GkpxJzjQ0Z6hH90sPAEpIV2UplUFD4FGENitsEDOoVHQxthUekJZ7nyYUIcF7r6NhATHhkd1HcKE5E6k78ndYtaN1+dTIyCU1K6pm7ff1SlaDGw0hQddUNe2IjEQlVpqid9Rg6AjuzipuRPD0rVzqF1eu7PUZOvctvp4jswp0KQIw4A/Utz4GtgV6T83vzAiqw+s83NRJhLeAlt3NKYLB3WQ1xYqsZkywIH/Qc3cCfO2e+oReGJAM8YLjSkCv32UFfVxrEPcwgHsPr33PnNLDcTdzakC4ff/iEWffLkQWsabpbsirMCz6SG8NnIqxcMEU3ahHFFLbuO49dKgWfKTjJaDnJmwHDvi5mhqk6JeKarMHtPv4bOX7Y+U7kwHa8rhRncbuR6SavNPdcMo+nhxH8Da283dAaNevgzOP2fv/cH9DO9jlea0UYOzw3gCvIV4S7z23sL1c5lhT5NK1G27Q4FQ1q+R/cRp+RdMKvuFcKgdfHxQjQlgjTSm0O8P7+1UpLDQmE7T3HSBMu6EFmL3tpiGVgg5o+5guqSqYMzemYrod0jXmYGvG6ZIiTteUI6w1Wwq3cG2//vDWB0jmE+pvGH/PTp+fpNOz5awS7EtF+20Scfjwdfg9DjHxuC4otUXDcncgiRSCQm4F2jCzGlMUCAUqQxqLXdGjyovu7VpYcYI+aa4oLpeMYI4sByOuD3BxWu5gqJE2jaeTXbna6jB7nXS2jexltca+4DFnWGcrmdwncE5c465BL5W2qZHVit0WPGE8AOQOjeUW7jTfiIVwitXsDdfSOuI75+0cHsvRr/4XM/RGbJt/Dagb8OW1MAjnMyKLsjJUhdVwkjC+nVg69+yb/lpAj8WdBWHmn9XL73/4s/V9zzvLUUvsmyDbfp9mcV/M7hq4wVuq0L81MTn9wrMBzIVPfez6n/R7XrQ87+z6vetxZPLyId32pN8wxY4zQ+9/+3hh504VdcETiJfmTBNFSyzI1lqV3jzj/VwQBBJ6jj6+e40uhfnx5XN0+f784j9fo0+Xwrz6CT3drLZIUGZWVCGyktq3SpNKUWLgWz+8+l//7dmToESoWSXUcX15gE6dFTjcjkcn3n33PObXbi9e1kyFj3j+uJju6qYDnB8JGHfnCz7Eb88wbb2Tz0yZCnP09s37ILN/SEHTxbKO2xn/Rwo6C8vWsvvVqFCYyGHlCUvwGO/gPeuwxIZu8AlapMPuvkJv8lxBnNbt8hA7zdVLivLYd86HvoVcnr27crfS6PNYgfWErx87QSVnqfq7G11eWVZGol9Whkd2gogiQzv2uAxrSyxz3bWmVRAddnGeM/tlzNsH204v//A9N+EGsC4hHHDpT/j57hYYsNLmWiex6+56pWH03nN4JZVpVPJA6ebwwAYLwMz2sObVE8vezYeJZX2Z1NN6NyZ4QUN+41RRXM8deL5Ya0mYNTld3Ghg4yCrlxUWSzprXCcixYItK0VzNN8CTSpyyBoK65nySOiBQdHoiLUcHHSRAO+AR7T9uyVc0QMAihbS0MxndsfPM4ov2lzoDGcuFT8B6dKoNMQXCbbEIkG1ME9xHFLhn5QJhIrzrI7EpTPL+x68ncesP1o3mHACC/bCrKgS1KCP25I+R5/qa+wtBMB+RFd1AGxwE/w2ZqnVrXomMCZGXOOaaR8Xf44w50Fjomy/CAluWEFi3poqewcyYSTSBi5zJtCny1GFQiBBNpm+iq6yLVFZJmj7ZgkrqmNn9FqyCUpc3I0YOxUd4u0JuHWtFTJOxTJ6p0jg2RofCa3QEQvUmTyYdx5gBCKQTrBAGP0i1QarfNinG6E3S0j2UgjbE38LuXRzajaUirDpGRk18b5v3NJg3n2qc8wggIyHzIjBDJnwea6QllAwY9WSb7ERnuKaYzHFO/4dApR1gkgnRDmY4G7Isn1JWVsPdgkO7O7NE/ulkhJAIVjHw4O724s9VoaRimOFAC8a1Uw8vbh9/VYu5WIR7v5OSWZWNPny7jD70Q7oTmOH7wvLt2X3TWVWVBifLD7Ktq5iIifcLaHHDTnO+idN1SjDsjJETitpP+Q4w9cVIVTrEZ4Befw4cLTjEk+AL2RN3KVUWxQoTBjwNoVy2uGR9ni0Wgke+HQphb1XrN4KGYfND9HAUNqd1ToeHt3IvYmRQy2FmgHOaN7Mx8dhevYwE0gzUwX0J4LiAupVtKe6whrhXJb2djEryhSSG9EumROcwbdSyGIkrxZ6cmjmIOqnNSKscc9EbvWPVLoRAEa/ME7RG8/YbCCGuwR7RTMxdyZHE8ab+Z8kXWFUBNc+ayGuFEJzDAgiZr37AwTh8vWufb1GbEmMJ4TOZcrqgcDk53SF10xWYF0SWZRKFmwkQ5FOzdyFwHMORWQLdLafNybWjdpJyGSfwx2rEwUZ2OEwanOZIxgMjN/wl3p1O7dse95Gt11bZlkJ0y9ni23R51AGnpFj3Po7WUFwHy+poIqRekogEEj066cWMLOCqzbU2w15Zmfkh5k2avzxs57TMbBbJ5vTy/1z8uaFGyvhvIKuaeOEG1ZQbfW6s/YULenoI5JfhWigEAcXAoAHH7gM6o5b6xjs7pNtrR/vNqcfMh2tyemdp+YDxodmOJgbzLhVCHdQBl/v7F4enJ2adO3cQYsyN3V45aJhqU6jQA7o8UaBfL3b8cfDSxartcE0S3Y3/agm1SAxz9gd9Mek2zHm3AabsTHqoQStF6eOXrlTmVVWULOSJ3glwTuRZOTY8F8bXXDAUlIyadRpz6vOB8l9vNYysmdfJoqE/Ofs5++/R0/fnr+5eobOmTZMLCumVzSHUvggL1wuZXJcoH0vYZAtu3B8+GWGL45kjCmZOKq4r/7TrmqIg+bEQEQ+WtPn+xwXAmn/Td1vJ/AHPIXeTLEIwaS3mWKYx0Kn603kA85Zpd0ISCqkWcE4Vk49WbVpzxCBez1cXgXnXLN8SqSRbqb8J7sR6ihiDxezPeTp6izeiH1nHZ41fKVhJ/7rg0TwyWAv+MAN7ZRl5OFQplQpEwMGTzYgaqmWWLA/9mRVi3Rb4a7CPkLS3T01Iu4FU8Fa0kSoP7/Y4eC2cBBfDrtoJ6v5V4q5WRGsKCoVzWXBBA4W3HXU0xU2jAqjD6bHczzlbN/ik07WQT/SMtHGtUfniVVcJVYGwJDaqe5XqxOCHXllcxeNuqA5VdjQPIuWVLZnf1jl80s9YvN4dqXkmuUNeJj/Hi5L7i3Vwcbw4D/2Wtu1acMGTjtJlk80y2ZIj/VntiPTDDYPhczJNXOv56u+4T4CAdcYnTGbgt/X8qS3YDN1ftSphF4GJupsVLBYsUbaSOU0vqVWUINhtCfwrZn91pPw7AuW55xOp+XewXh31XOB5e3ovaP0XN0eY5rpXvnROghDYlu/zj5HJcd2yez9LBWigqhtORblh1TICfzJO2TQqca3/FVqg95hsmJixKXLcSLN8U1f1p8EZPqXilr1Ye0jB3KmZ+htjkv0Gf7h7KNcCld3+s/h5YlWeE2t5cQpVuhLRdUWAQahLqXQtLaowsWpdr4Z/GYafekx8IilrFiNAinc9B0u3zif9ZQmYLXdQB88OOpdOYUuT2kDZv09XkNL74AYWd/QX7xMI1UJEfRj9fPm5nEvzw5GaqTGzlPMvIeZfiEw2jCRy41GuqSELRixnzwP1Qn6PNnhAbHTc/y2OTfoKSDCUkHaawieLp91pIUqAff4W7rEZIs+6V3g2+YFtugX0kbPrrUjTOCwj9z2XVcLWIFaNdhk9kYcSLzBAQhU/+9UmkI5z1B8u9NOb1CPofM68zowY5hhcKP53xwx2Wnyesem6jN8fei91nUXMPVxFNDhbKYJ2DUPBrtr0yZkumUYrFAYkOJw8TOUDcRsCTha4QZTzumCCR+rB+UEqH4FLkdAB4G7owrFEvHWBmB65l9sxdjEbFPP3WMpjWBTNjFsYzBZFRND4LejgsDRwDvqLkeSJi9zJuJ1EIt6NuyUoagw7eUZUFLdsh1YFgej3Zb3B7p2DrhOe/cd4LrEqt5T9s/P26lsVmwApY7s6bC+rEt+v9P0TPSeJQ7WQqptugX/iy6x+OtBxJiakV0U9do8D11NVix/eQHUD8ztZCbRYFY13vr+WY3ugowKo2R5jOrIZTUfBBfutMf9mNbbpgfKEYBHV90x7Tk8k0WJxbY5j3DsoJ2+81fWVNlrKGNiIcNGAdY3qWuEDuiPnhdZc7ahaVHRF19S5Qj8UnG+Rf9RYc4WjOboHOqeXXAwyMqGzjMi5Q070aP773SO3Pit/4z5mDUfHW22fQ4vKwMm95EtTA+f9Q/NEL7Ljg9Hu5j8DH3clm7qbeTACset4PjiKbrIooLJ9ti2PLhAhHqiQ7C1fWamCNU1xuUudy6yWEpVR/vhifnD25El72DlRN5OtSzKtH2I9ojCjnwwcl+zqaRMZInsMmXHseuBSmzCoUkiMqxjvvZ3CCtfTh+ZcqV4xGXuUI24Ko0zmlUqVjSkQ1NTleFlPJ+yJR39etolHTX9cZe03/UJFAu9NVSAaRXfObH0o+3mxtBbKdpLlYltUbkhpqgl3NG5H2FYMK9e+P8+8yy88P/h85pCYX/MqQpn5/npnPD13E2m+3gOEddOq7XBdHLfEM26VEwsqFIj767DeU8yr67hf1D0wfDsBEzWuMSLzjIEjhQ8a8ukRyowxGTb78K929tt9xEyiFX3T/+gwwSt8YafrFxRNU08wtrsPuPp6Rm0fnyGzmD8MGtUmYnAUkbkfEaVb/5Jd7Iw94Dz0qRPxx1BdhbcDvpEd5Ci9640++PYqOT9oVHCq42u2R/haA27SaRTLv9xgQRdSsPcApYrrEc6QGkyNaxQZynd4OPNBe1SJ+sANUhw6e2xGji9rr8JJ6RotpyiomIX36jpevhxtNGy1SZM6yq60QmUIVkqXbTuYW8owCFVKmkMdLAoXe15YQdH1/A4vU87TZIh0SCD+1fkp9eQ2rn/Mupoz+OYvL/23MPjuArVmmfrlDd6/0nVB7KDzOSZ3Xq4ig7TqFMRZjfUe9SJwA2+aduVdC8k0K0/IQ3vdVKhy+s3/3h3ha7sPYV+EyPdV1puE1VSH8Ptx40McwtqiKwoudFHBZHvpoTTYpCFms41eJ0NRBikgfoWhK0W3GPlUsUGoJAnMHIdHw0qyKjTADwbbKrJOnx2uVxjznK3EQNM9BXhZKjW+xQhSOyGbnVfbUfa+XUCaWTaK2NKnTHoQZuENCxlCoEQ/AhOE1uKuvJFKma2B04UkUWRFCfujnw7PnxAKFyCv2GK8r6nGTvEsuFYZFqfquGtHdnp8N/9bOsarSC3rtQ4KyWbIq06xLDjAAEHwFTYGwCxkhUWYgCckRpuyo8KjIy82U4E29xcLL7n4e9v37z3996L3vDNhWKk6sf+o2O2MX2TrSWvUgngTd3HWfg+N01n7LqdbyWY0eipY0I/A7QOKOytO+r2yCNgOjgbXiXSZm89r58EMz5dYLZbdLCmCjIFFhVHRApCS2Md5Wu3hiPwCptNSu3rBG8d9rqFtmW0lMogaeX769/ehFJwg2KPve+kWk6fYNkvMNgJsc6xAzsJAsX8/eK3q8sr9A7fFkzkTVvv8LLauU2ehrnTRHFkWn4ag9ntm1ZjPoVLFqOnZ7sqx2wxXcHmqYvw6yknNzt2gmVeK1+ee5Rez8VeDvl0i3JirIB6xsV/+brhpjBH5ENLMvbphniJdaFPlN3o21WDF9886hauuPc50lUgRR1r9BdtlBTLv845JjecaUPzv7zwf3vefMrEgpLwRwum6AbzoCGD57zzG4RFjrREI9tS0SXTRm2tZz+lsiixWXmw/oYH1OdhwCQEpaZi0xVCu3otIlUHhbyxJxvOqTBq+6f/GwAA//8elVjt" } diff --git a/x-pack/filebeat/module/fortinet/_meta/config.yml b/x-pack/filebeat/module/fortinet/_meta/config.yml index 0b2eb336295..0754f27de13 100644 --- a/x-pack/filebeat/module/fortinet/_meta/config.yml +++ b/x-pack/filebeat/module/fortinet/_meta/config.yml @@ -30,3 +30,41 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + fortimail: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9529 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + + fortimanager: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9530 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc b/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc index ee6448f4cdd..acf35ecacc9 100644 --- a/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/fortinet/_meta/docs.asciidoc @@ -5,7 +5,13 @@ == Fortinet module -This is a module for Fortinet FortiOS logs sent in the syslog format. +This is a module for Fortinet logs sent in the syslog format. It supports the +following devices: + +- `firewall` fileset: Supports FortiOS Firewall logs. +- `clientendpoint` fileset: Supports FortiClient Endpoint Protection logs. +- `fortimail` fileset: Supports FortiMail logs. +- `fortimanager` fileset: Supports FortiManager logs. To configure a remote syslog destination, please reference the https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/260508/log-syslogd-syslogd2-syslogd3-syslogd4-setting[Fortigate/FortiOS Documentation]. @@ -95,7 +101,97 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `fortimail` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "fortinetfortimail" device revision 131. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9529` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `fortimanager` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "fortinetmgr" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9530` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/fortinet/fields.go b/x-pack/filebeat/module/fortinet/fields.go index 79f41101159..60f2d21f39d 100644 --- a/x-pack/filebeat/module/fortinet/fields.go +++ b/x-pack/filebeat/module/fortinet/fields.go @@ -19,5 +19,5 @@ func init() { // AssetFortinet returns asset data. // This is the base64 encoded gzipped contents of module/fortinet. func AssetFortinet() string { - return "eJzsvetzGzmWL/h9/gpsfdhyddhyV1V33Tu1M7Ohkey2tiWZbfrRsdERDDDzkEQpE0gDSFKsv34Dj0zmWxCFQ7nu3v7QURZJnB9eB+d9XpE72P9KVkJqxkH/GyGa6Qx+JW8Pf0lBJZIVmgn+K/mvfyOE1N8nNyItM/g3QlYMslT9aj81/3tFOM3hV8JB74S8O2Ncg1zRBM7M3+uvESK2IHeSafiVaFk2P9H7An41+HZCpo2/p7CiZaYXluSvZEUzBa2Pe3Cr/93SHIhYEb2BChipgZHdBiTYz7SkqxVLyIYqsgTgRCwVyC2kZ735SUUfMZm1FGURPpXuoh7IWtScZq3pjVMfoz9E4kAkV+vW36cpjG9Yb1c+bpgy3yNMkVJBSrQgCS106ddf0h3JQSm6Nv+mmiQiB2UmLcznnaEJuRZrcgmJSEEOT8SNxbqgjp1ONS5sgeuFmVrkgT1g5NX3S67smieCa+BamfvBuNKU6wqGGsSoWX4MwJTq7gd9dMxhMiQI1WS3YcmGUKJAKSY42TCtCCW3oL8wzUGpavfPekejnqzaiDJLCYctSLKE+twVVCogN6CpgUbJSoq8QerFtVir1zOa3IFWP/SGv2QSEp3tXxLtcVPyARyzcCecN2CeDS5kBlvIjljJTPDu/Wyt5CUUEhKqPZIUVoxDSgTPLCxNlxmQnBbDqHK1XkS7MBN7fOPv+dXlj2RLs9LfeJYC12zF/OmEe5pokom12y/Z2wg7O2aG96fFfs9sR0GlZkmZUWl/7zf2bPRk9IY+6qQMnYzeyOMnZXRLtqfdk5/+955M74mhirMhT7u+Yvnbwk6kuy3fDLotPYbpoUOToEQpE6S39+nLhnX/n4ZMaaohB66/RXC0TJleJBnt3OFvBB5wLfffIrCNkam+RWCMHwcMV2KqOMe3e9JSoMdwD9xlWwGkMXWoEblmSM9sfLEyCxg0PTmkJyQ8TYvoyCG90R/QIsZXsWNaOdEq8oZVZXD53HL1phlp+cjACj56+ZJTiNUlZ19LOIjRsp6//9O+rdReCJ6Yx4Fq8a1rtiPsZstw2WFzdS8MGbZiCW3e52uxJm+2wDWZW+ZMSp6CNCqIBM+oelNfsXtIiQJtBmn9uE1DjSss1Sb0xn6ywlJvQm/oR21K3xIY37503MHszesRa/K4NdgIhSSvNs/lO6F0k0Vm3ROpgKeMr6sP1dCxadiQ/jjry445YL0fjS7s1Wz7F0LTVBpeOXbdu4vbm70Wf9TF3f6Cvby//P93ec1q4fOGLl9whrSmtSwllKzZFnhtJPvjCgJmiY6zX+BqIOm3KPz9MTwaowYNUewXEr4i7HXTeWg32M57uber/MaRJjN7kV56a7am5OO+AJLQPgdZAgGmNyDJpyuuf/yFCEneZoLqn38iS6rsKaocZCu2LqUV/R6Y9zHi7h943tYNiqd8RrAvmF+vBZaZbUo7rij/4Q0MQu6oTNGEugZHa0y7uZJXs88teY8SCRntbikhaq805P4R9bDNaBtwJ1W5xTP/FpKtGadZ9Zu2tPLAOmDJXxOBEVezz78MLIGH31uJpy9Bjai/yjFen8NB7QuOx74+G6ApyJP4rt9ZUuTq8ileUoe36Sy1wxznK/2mjWxZskC3s9FK0Lo6CFr2ohjV5UJkGSRayD8iAzar9wwxN+bMMUUSt3SQGqQtQfVadMUWMrHQ36DGlyfLb0VUzYWywW654GS5720aIRK+lqC0GVCxvMj2fp/Mlw2jJ0CTDVEsBfLiz0RvZEl++utffyA7qogC4DWViZX4JoTXgJVQheAK8JYi+cOcikSUXNc2hTJfOqZnrrIaHIG8oEuxhcZiMD4YWVmxN6Ul0Hz0/iR/mGPzzEsFKSu7clqMhfpuSHKsDQtsRZj+V/nTn3/8d+VY+uvCMtAK9L96s/mX0Qev6R4k+Ym84QktVJk5z4pRKR/F14dGf6LzYyC2cojKzz+R/zTTfUl+/pn8J0mENPKynYUn+pL8n5n+v8wXmSLtRflucAu5SOGb1XX5DhYJzbIlTe5wJWAHjgttrw3VTq8wiwg8LQTj2qomGoYDnO3hWICUAik+7SAPqgISRjOL2CJVWkgjWfO9kzrMB1uasdQdjCFQhKxEyVPzwmRgwTO+9sLRg8GL7RvRGzmGL9Bfhwm30cgu7DNB02/lnfNwiGK/A8lBS5YMaB1eFW5+2erC7rmvmLB59qk+SLRiVW3bGXkndmZr+jon40RIo4xpQe4AigcW7Zt48f4giyZFAkottixdpFhe1zcV51kDB0m1veSpWcGGXrhlUpc0M0p7y/bOB0wcLGdG7ba+crsYbhb+ql9dEmm4tbIGFbtoVK5B1197cCWURAp6evaVcJFw0yshUVxBfcZ/dVnZXj9ALjSQuT/viQT70C73Y4zS/K9yxPwBHC+e0kIVGcOMbPim1XnFemL/NyGbGZ6LeN7trTNvgD/r1amrtBb/hPyv4WF07GXFsmfw0RuqRjmaXZzPvOybUG6Wh+WFkF2Jl9gn8g8XBlF+G+aPT+6psoq4Vd2HTKltVb48/OSgsDs5x2rmZ+Snv/5Cdnbdc6Cc0CwbthVYo74Vkw72I7IDCW5YqkkGVGkieCddpL2Izy4m/rEXceCuYrht/dp9ETK1C2ejmiDZcJGJ9b7riFsx2ZNiCfkrSTZU0kS7RTSXem/xW6M5JyX3MT1Zy2Y+mlEbO6HbOeoxnQgTvkurUeRGyBS8ciNIuhvlaZazdsRKmliJ1fkouLc5iCQpZTWi0pSnVKaEC5nTjP0+FN8rZD64PqmPcjh6iUS57D1Jj1qkA+oazOuMrcDOeEDBV5AIno4I2IftXiiNaWeZmBDjiciLDPTgARg1olIrwGvJOmywkW8m9TMd5LmhPXicx45y+2SOHr9ccL2JtE2H/NRYMS+HKKf0mRb+DU8xlt0M+bvg2NUWJtiioV6JmC689mN3hXssCu1GnxMN99pfPrIFqRrpFOlUHNjA/j71sO2BxprmIU0vETKFFO8d9EE2/plSNcVKxqgibeovNv3r/ddKivzMjlrapHyVAKeSCSfW52Wm2SvNQBJaFFmV/XKoZZNTTtdDqbmEZNa9U+mLDpTDqgjT3ysidtx5xjTNi65l0CM21AzE/u3TiiQbZrQbkYI6Izel0lZNag5qbiXVI3G5VMORmzTJwFYrg3sLp5CE7CZXBN3aSViBBJ64A0GNaJ2yLUuNZGPPwzAjm1eM7GNn8YYneV8webIZHvbT+YLuzUlkOtu7ySrD9Iy8ZkDZAzptG4246aMmnJeGG9f87KxHsg4nE2VsDpT3BLmnjlivf+yrYiXIryWUJztK5nS7U3TgjzuqiAWRjpwbC+7H2IsaUShoLSgCT1vnGuH1XecYWIsFAtRigSE9FzFZUXvQn6KPiiArNV6R51EhO+rj4BvTey4f9eYcyzYf4mvHOAsOD0SnGkJsQxBNekJ8DMFalRm222lEixKlTkQOrx2GWnmxUdli1TshlPslaCmQIwcEtiCZxkwdmZhYRd0nATY8O1MmH9zkxV7tQPdK15kuZjTrdyogYSt2UHyGpVvnzBmrqeJlZfxopoENqE2MLD0kTFQmqtQ7WQZxe7X5VJvwua2lNzVBIcn7uQ+NZaoKCOja1Sz9aofGsiRVIRSLyDiCzpZVp3nqKkzZUP7q7o5W4SkzvcArXfRIVsTLHCRLHsuLBud2giy2iYk1M9nqm+HYkrvfvaltgadC+oDZyZmJ5W/PUL2mcu2K5W+QDOvRBhh+LnhvuQ0HnQbmOD1mrbrv+hfSZ/17NuOtXBtaxxZzoQklG1/xYjiANhPrRRWo8ixMvTqIj2bqp6iZ0uJ9f7PhVrZqtWUfw4K/yFiyx749E3xhZgH44to824/w5TLDjJseXsAPZQYW2DA7FVzDPbbEWgO64s5ed6iHStNUmf+zjyrNKkBDBWAeeJyTDeVrWHDYYfOCMccl7BqufiuEaC3ZstTQ4BD9GH3loBtpvfn8DbMOVdBozK5euYyhla2cWjSrCHbjixyYpvw2oNzaDDCzYFXBQXWI+ZJbkGdkDm5TSgXyjK7BlvL2ke4rISsMvbGrYZzcntjfE/f7Rt0KIclSip35rPqrlzWd2jVaT/oqnVGpY5vp6oFjW1T8nRK97NBT3SmRpbXYiHWlRAHeoYj1Fp9zQjOQuo4ukgei/m/OveXZR6MIgA1CGhCYU8IFfyWhAKvJTEU/WLXhlE9OUkppLkytr9idtHLca+Y8bJX7pzezHdMbLyw7Xk8uLcGlzTbhRPBXa2H+e+IlsELKYkBwRJw3bTgDX1sABqRYEcMdNAN1RuYHntJtbNDMrMJBfOHS+UpllBiXMuqCbVLPfv3CU5JkpdLVgfT/6G2T/QlTZid9TrS3bxjB1346LgKdXPpxN2xYo3dlmfCEsu8fUrwMykuLglClRMKsvdTsxqA+aTfsmt3Br4SSYrNXLKEZSZm6e0kKaXuivCSgk++HBWUq6TG5l4986F2ejaQ5aJCKFFTZKl7KFnJwtQgSkeeGi4mW076fWgM6mRT33HvwXBJfYw8RHibHvhORF2X/DiJsGyU7xlOx8/G0ieAJFPplHUkxuhi9aa7KLNuTryXNnPEzFTll3HMN3iCUiZGnq2n1jCUuTUzdiITXjN9B6nOBqkB0qqx1yiso5pPvamhnLJ3auKxXFQKV1TU7OzmzRBdABe/9/LlwvS+85ZXM++V6aqczyJx1Gzthm1g9TYvWnf9pSfvnyJL2imX4d7ye8ltLrb7GEtIyAVJ5jmDY3KZAMpotBl5TtEdkbklWYnP3fWw8gOaFGbULQHKnjio5EMNi7Kmbh25D1aa+oUYsHMgyLJONi/ytcmzqNMOLaqROiTAzkZrMmZKJ+VX9736mKTH8nBNmY+5KnmRApfmTLYR3gOYTCL21U1aJnQ97HxzzK/t1nr7pFysR+ZLxum5288HyaaPyEa/XlslSndrS15RGLIBxi99pHKQDV+LCUXc1GcctpU6DQzeN18vnrMxXl+TWcZoXvnADcd32fNKvwfbDsFztDNDPYctvmJ+vLu2S+pS3mk30rQdtj5wLA3RTOHOHyPCCHVPDSupW7TFr2be9uj5B24kLk3Zs7pTvE54as/QXNWFydfmgJBvLPveAJGuA/cTTg0R7Ri5cfqavd5q5D6alWQtQtr/x43feHLcsdZ25KXT9GJU8A+VWRrgHZSfIlkpGl1kvC9AVZWCcFBkdYQQKuEKtj9La0Kao6iifGU5lJIwqv5CZfZ6/vpp1ZWjiS8Y6i8JYXvaRDQWDcyEPnhYHklxxTeZszallFiNHtBASs3jt9z3+ZQ7prJLdhK3qaP/TAGncZXvKUjFwcG7ffySMJ1mZgmFnvpGt+fkZefHmnuZFBr+SmTOIuGEt9z4btotYz9zJfZvWOHV4WoaRMXVnRO4jcD0iFa9hxrz1T8MHpu4mXK5asvUaJF4Lu+El+9z0BXgMVjrdSFAbkaXm9DhdfaTTaMv1fgLLQt/37rnyiw9OxvihLsZxdTmcRhLsnU9EXixOHHdld8XHXtk2rs6+p8rlKwNHcJufurLtZkRaJmNamhdLnylqrIm85pZC2soDhq9X+Ea6xFGZ7qh8ngi9flV9w12pf4jMJEZKI78wTJSSG5pU9ZSHhVvDgk6qxwj+qhJQ5TQXcrpm9KbWEqiKHhusNNVlLMG5tkdRlj2b2mGIL8U9Yenr8ffLvKzlKRAaRJ96hY/dXTAohq9u9Y4hd9/rHfLLft+9Y54zxkUZy8fZyCNR6+h3ynDSmEaHnkX2L5EHxq7M2DoS51lm+B5RZZKAUqsyI28MfZKIFJQ5ElWx32HNgvEU7iMvQMaUPk7yfCJvsYStKiYrEEuQ1r+ZU8kyG8EzYMFz/ne+JtQu4ivz28GZcYRzKJauuNAzScSeOnlRx3MWIFXhk24dh+ktmRcRDgHxVYWnH0aSDJ2Zq/8eYweUOOGrDvLytir3bfMhZVyRFDRl2YCRYSlK3fjdyNREdvLYzMpiS+s4Notj/CHVkBcZWjTPOUlhRb0LyFe+rHz4PlrTSMVbkBnd20QuLfzjSl4M3EjzgdW6/a9hVWWBO1u90kyXtjAjGZzYQTfoF2x66nWN6sVq2HcSGhspAq9KRJ6b+4RzjC7c6IQ1gn0LKbYsdfazqopcDmo0ECoVyfGOxsdby96y7CA1Js24vGHR4L6wQU/Pw+sr6ri8/jexPNLudPT0/h+x9A6Y4dtVMLzCuZc2oNjt/Hx2Ra56AlUTBlrVWp9dMo0gYmJXnQ27jqpIP8Ye5mOrh4V7xyIWS5FiZ3z1Mu66QofHQgyWEfFoE79agnMZnCDzvGEC9qnDLoC29oewNUtrV86IES+PrTX20sAjvPzxhLx63kWJ+UxV3b1nn1z1nMoRZYM17iEpm1YEF/q1hKH01qoK01TgxgkMIYNW8bRtEKmzK+mWsoz2HRmkNoUTm1+5AilHOi24O3SMrT+e380rK7kvAOUcsL0p+XADxdZnIxyR5Ytlmab76PYZli+i5gE1xi0VHFfofNJKFX9EyUTEKgedFLuFKk+RkMBUM3rV1VylZcp0nVl3qIvmEQ01tjtkbDhWcnAvTE/SRYnFXsHtybTyi89vyAufK/G5zIysvGSZTeCwcWBv7guhzDd/IK/6hgbe9cLccbHjLUVIQVLaYhbb9ugjnTYTegITXDcs9KLKcr/1qUnXsKbJnnwaVdcytpT0OZLyPeHWEjNOcsr4StIcJsMxCipt1178Ogkt4XJmyZJbkbrg6ENZwEbU2QAo8oD0ZUMFzEJgaUjtunG3sCPvSm5VyRuRQkZeML49+9NLwkTykizN/4H5P8pptldMnf1p2L+ok2Kxymivc35sGaot4V/MiCVqbV2WT+6r5ldiNVmoQQtUpO6vS4+zKoOgQJqDPAhom8flux1kn2++UAnkowsA/tOfPt98Of/w5k9/cjG3WyopGz2TOyHvYqYsP3jBvlQEmx62USMY5bGFCJ+zE7dKSf0c0MQ8F3sEFWYlJHDFkpgMpGFKQkCcx7eCDPgHYg262FHWb078ZOuArX0ee1BzfWKnqKtyiXQp9DJVWsbOfLf52mgGseZbGu0drXI+8Iykxya7HBqD9UQan2xyyHvx+S5miBUbNTRVU0UzxB471cFqRAPT7Kb3DDPlo+sJPt5wYcB7+f9Dn+pBZHad/57liKUNG70HMgnyWQ5H5cedwifECYK2Wjvb0Etf6DqivYqys3Uyf7Bmt97JfdgzXZWsZqfwh9mkrxVlmVnrqpjLzPOMq8tmbputxGXUQQ3rgRIG41GFVcz1woiIR8znmMBrG27ts48uRJ6XvGuJ6qHjxxVueiq6W7jXf4NhmbrGpo6TrJ+KbU55+t9i2Gt2wKapZsdwhiej6xNugVOlKljCRLQo0VNp8Bb9jkredzp869AVz4uFwGLG89ubGXnv7KiHoNRhIF9PGkow/8c1+VqCHKndWmZ8IaFbqRM3uKFhEN2TD1XS2WBYVy2lJxEf0uagInYbATNocZTh6KFR9YBz7MnjpvEbNNCMyhxht8ywCOYFWkRMQK4HLdNoXWlbY8atdtUaOqW6KxU+ddwl8GSTUxkrraQed1/QXvviJ3ufaNILp4oy5mIT/SwksIqbQFUPvFrbUksIw4rlbwijFjR6JwxXcSr68bJO9wWL/eD4ym05GNEzOmi+oIltjBI//cSMrXhE5b0x8HJdbP/C7/Um+vue8EWi5SJVUeuuN0Y3Ix/neQoYeJvR6ByDL4CvGY+YFNkfGiM2mi9WC7VjOonOP/hilYmdonn82JXm2Fxv8UZH8LokfME4JjthvACZL/fRAt57YxfJHc7gW5phnBVWLAoptFjEd0nZ0bd/WViLY/yxM7S7mYn1IsVYbDNw/Pi3hC9yer/QOpbZoD2wOdEZIDwKOeNIoBnHA11kapEts0Vst2hr7D8jDh69Mnhj7Ni1EJtjx87qbY79V8Sxf0Ec+38gjv0/Ecf+d5yxtSgyugQMllKPHl8944u8zKzwvdwjvJPV4MUdglySlxlb5wWO9G2kTJqtYwch+ZEZhlCi4GsS3zbCF8oFJCLsoJIJjjZpBsbRJtVelQVCL9KE12nVKKqqFtqoHnCPwEK00EYxwxrbqjUog5ec3XPKhYIE4RBufzGrgvQobH8Rhd4ATRHMaiIvFkmGYMM2AyM4Sey4crnX8c2iZmSFMnJRLhB8GolkmiU0Q0ggUgu6Bp7sI0ZdNcfmNNv/DukSA/d2YcuAoozsysHgoHaBtSijL9fF9hccG7RaLJn+d5RCY4laxO0V1xlYiuisWqFcczsqJDJ+lptyNv5ovbYaA4PeODt/fOOIG9yKfSiDu2ry8SrINcZesQwwdBi1WGFsIlvFTM5uD4whG6gFK2yQ4gKF1bFi+5dU6aJXzD/S2EomKGNnbAUYaoyyhuYcUhYtYbQ9NuM4pyQXaZmBSgTGavvB2RqBN4lC7aiO2vO/MfpQBHmUgSWsmdKSxreEHMZGkPgkFFhLLdHWWtlK5BKJv7rIfHfEEUbXEmiOIEi6VCAs2HjC9W4jmFq4DrPxR99TSVEOeDqSCBtj5K3rbx97XKY05dH7HKdKL0sZq1lgNSq4XkEYo5bRscaXo6uc5NjD2s4Nq/jNro+tNDA15pqmaew7wNLYbtWqdBDCW8TyRSKFyFGqEpmBEdQ0li9wgiN9xSOMZS7uopdnKlT8kqWsUIVkkQfNqGa6jB59ljEO8UrsHEZVUTvq1OPa5Nv4Zq1MuKqni1Umoj/n9eAIIf9G543OdcygCBzH6NAIUKPHJmRijXJ0+RrlAhdCxmZg+bJcY1yznKkEgy3kCuXAYvSB4KBtcaXo40bn4a4AdOyIPzdq7HA8vtvF1kBQMsqEawAdXRMV8SUjIdl6MdCP68nj7jjI+G9WsXBNeaMPG7Uz9WFY1+IV5ZAhJG76njixmYEfNjY3KBbOkBQdLlXKfLhINrHy/HtDw33BojsCCpD5WlKuezV3Y4y8Qxk4/tPrKpF9+tTpAhphYCnWC6qKiA0DmkNLGntUCTTDkO8kJHYdXNVRpMHjL7IZOW4J18bIQqYIiOMbMhWCbVg52zBCPICC2IEAruExgnKi4Gv8AzBUoDXaqAiqlGJrBMarithWNiUTjHsgkzS6IK1kMlQVN8LAOl6LreaYpYpeVXOb8NiJEoPdYp86qCvSGXv6eq3jHys3aHyPXt3TM/a4+yJ6tdYyXaLEoZcyQ3gLSwVykbLYWe8obSsqzxDGMuhEaZrHtgZvF4wrTVcIksGWSY0hhm8LjlC6SQtZ8phm1qGyaAMVRc9LLciHkpMe6Tp6BLFZ3measZRcSEiZJhdUpr6aobLl34fhuM5ZiKs01iHUDmOb6BNb3yARGRlK1anjIRjHW7k3eZGJPfQaCz64fitRRivqHXjGzBo6m5HtdyZhDfckp91CCwdfLF+X3WYg6CAzpmxzhoq633pbQImosiiE1KRfeJSQ3YZqwjQpJKzGjsITwnIf04RiaOG91lFDIIz7yu4jdaEzxrE78jegGmpNnIposQa9AXl2+L7aiLL3ohHCYQuybkekBSmoVEBuQFPbEdzdVVovwYtrsVavZy7t9Qdy6Vt8vSR6M9ClyBYD/gC+9bGFzckt6C9Mc1DD+9w/1CiLt7Itu+tbZIm7ySqgMtmcMc4G8dmeuyeor91hn7YXhg2GeJ3Rkttev+vS9nGtirgPF3Dv1GufmBN+Oe56TnURbt+/eETZNxuxiJjTFFZ51ZIlH+Fe21sxZi44RTfqEYZ0aFx3aztU82yk46WtnovYDtzWz1WgiYSvJSg9UbT7+Gjlx9fKdyKDbcvjqDqO3bVI1XGnbXPKFCaHyPrGWn+3FdrVr4Mzj9n7/+H+hobY1WXFFCzt4bNhtYZ4QbyPPMLmcVlSBcSFa9doSO9W1bvkf/E8eHndCr5GLqQrXz+4jIRQRRSAbXdGp/tVScoVTU7Q3rdXYdqR5lbsPRyapJS2A9oU6AJkzpy4cSrQB5KuMQfbsgzWQDLYQkaoUmzN3cYd+vUPH31bkvkZ+belP3HSl8/S6dkgKzn7WkK3TSIdvnwNvMdVTDyuC0ol0bDUXchEcA42toLsmN6MMQpCBjJDaoldwlHpRY9WLcxyWn5SP1GZWLOEZsQgGFF9LIrnRWdJjbRpfL61KzZ7NQyvEc62E52o1tgPPM0YVYuNQNcJnBJXq2u2l8qhqZHhis0WPMP1AIi7NAatfdN8I5YkAyrPzjMljCLeum+X1llO3vlfnJFzvq//1RtdW11ecU1oepaIvCg1yGE2jGLGNxPDU8++6+6F7bHY2hCm/1X+9Ocf/93ovpeN7ahW7LtB2P6cLuJ6zEINN3QPkvyP2ianXnsYFtzwrY+d/4N/5vkBc+vUT+7HkcHLD/G277sNUwydM3L7/uMbM3eQ4Iwn1l6aMpVIKChP9kaq9OJZ1o0FIXaFXpKPN7+SK65//uklubq9fPPPX8mnK65/+Qt5sdvsCQemNyBJshHKt0oTUkKi7bd+/OX//j9++H5wRUBvEHlcdz0sTz3L6XA7HoV8+h55zefuLF5VoIavePptgW7ypgeQH1kwLviBH8LbEUwP2slnJnVJM3J9fjsI9nfBAc+WddzJ+H8Fh7PhtTVw/zAs1E7kYeZpt+BbfIMn9mFNNezoM7RIt6d7Rs7TVFo7rTvlQ3DqpzfJi2P9nE/1hVxd3MzcqzTqHsupOqH3o2VUcpKqf7vJ1cxAGbF+mTU8shNElDU0tMfXsJLEFq671mkZRAMuTVNmvkyzg8O20ct/+J074QEwKqG94MLf8Mv2EehBOcRao8h1oU8aJbce4UxIXbPkHtNNrYPNbgDT+4c5rzrx2rv5ML6uHpNqWjdjC89hSG88lRXXo7OaL1VKJMyInM5u1JNxiOHLkvI1nNWqUyL4iq1LCSlZ7u2YwFMbNTTMZ4ojSw/0kkZHpOVBoiuEegdZRNm/mcIV3QAgIRcaFj6yO36cUfylTbla0IULxUcYutASZ/AVwpFYIWQLZxjXAav+SYGwqDRdVJY4PLG8q8GbeZx1qTWNCc8gwb7RG5AcNPm4L+Al+VQ9Y9fWAPYzmVUGsN5L8H5MUqta9ZxAmBhRjSvQ3i7+ktAsGxQmisMXbYAblTYwbwvSvIGMa0GUto854+TT1ShDSWyALBq/is6yzaCiQGj7ZgaWoGJH9JphEVJc3IsYOxTd2tsR0LrWCosM+Dp6p0iL2QgfiFLoiATqRB6aNRwwnCQ2nGBFKHkr5I7KtN+nm5DztQ32koSaG39vY+mWoHcAfFj0jFw18bE+bqFp1nTVOTDEloy3kRG9GTLu41xtWELOtGFLvsXG8BS3GeWn8OMHGCirAJGGibI3wbbJ8uBJ2RoNdm0V2PbLE9tTCYmtQrCNVw8uzGNPpWZJmVFJbL1oUoF48eb+12uxFqvVcPd3SBZ6A+jb2wL70RB0t7GB+43BbeCel3oDXPtg8VHYqoxZOSEsoMeRHIf+SYEcBSxKnYjTrrQnOQ54XiYJKDWC2VYeP6442nGBJxYXMSLuWsg9GUhM6GE7BXNqYYQORsOVrINPFYKbd8XwrSHhsP4h6QlK7Vlt49WjG3k3KXFVS23OQMYgrefj7TAdeZhxopguB/gnsckF4Fm0H3VDFaGpKMzrojfAJBE7ftgyt3Ca3gsu8pG4WtuTQzFXov60QoQR7hlPDf8RUtULQMlblgE598DOessQYuzl9cTcnRwNGK/n/yzhCqNLMPdRC3FXYWiOAwsRM9/9CQvh4vXmPl8j9kqMB4QuBWb2wMDkl7ChWyZKK10mIi+kyNlIhCKcGtwbTpeZTSJbkYtpbIxva7aDCLKLsCV1kkEALYRRm8scAXCAfo0Pe3cbr+zhvo0eu0OaZcl1N50ttkSf2jTwRXKMWh8kBdn3eA0cJEuqKdkFsYF+3dACpjf2qR3q7UY82LPkxzOl5bjzs5rTMWW3nm1OP03PyYsXjhbivAZV01oJ1ywHZfi6k/YkFDDqRPK7EK0oxIMbYQsPPnEbZODROqZ297MdrZ/D5vTjQkVrcho8NW8wfmiGvbnZGR8YQgAz+OPO7qcHZydPunfuokWZm3x456LVUj0NA3mAj9cM5I97HH9+eMtitTY4zZaF8Ud5Ug4S844F8I+THseYc+sdxlqotyloHTt19MydUm8WOeiNeAYvCW1ZkomD4b82uuG2lpIUqFanCa/OB5F5e60BMnEukSwh/zz765//TF5cX57PfiCXTGnG1yVTG0htKvwglkysBXpdoClPmI2WXTkcfpvtF0cixqRAtipO5X+aXR1CUN8Ya5GP1vT5MdclsWH/dd5vw/BnMQ35TCkfKpN+iBSjWazqdJ2JfKApK5WjQIQkiuUso9KxJ8M2zR1K7Ls+nF5l77li6SkrjTQj5T+Zg1BZETt1MQ+XHC/P4pxP3XXr1vCZhg37rzcS2U96Z8EbbqCRlpEOmzKFxAwM6Lls7FILuaac/T4RVc3xjkLoYh+x0s0zNbLcKyYHc0mRqv68NeTsa+FKfLnaRa2o5ndAM71JqARSSEhFzjgdTLhrsKcZ1Qy4Vg+Gx2f0lLO9ps86WVf6EQqkg2uuzveGcRVUalsM6TDVabZ6wmJHntmEcNQVpCCphnQRLahs4nwY5vO2olg7z2ZSbFlaFw/z36NFkXlJtXcwfPEf86y1ZdphAecwSZaeaJY1SV/rT+9HpjnYPNRGTm6Z855vuoL7SAm4WuiM2RT8sZIn3FuZqfGjRib0emCiTka1EitVRGkhHcc3o+WgqaX2vf3WmfnW98Ozz1maZnA6Lndj6YXyuYHtbfC9o/hc1R7jNNOdeWqNCkN8X3lnX5Iio2bLzPssJAGeyH0xZuW3oZAn0CcDIuhkrVu+E0qTG5psGB9R6VKKxDm+6671J24j/QsJhn0Y+cgVOVNn5DqlBfls/+Hko1Rwl3f6r/7jSTZ0C0ZyyoBK8rUEuSe2BqEqBFdQSVTDyalmvgv7m9PwS18DLzEjS1ZVgeRu+q4u3zjOakongHo4QB98cdRQpLbLE67BrHvGq9LSrSJGRjf0Dy9TRJacD+qx6mX98jjPsysjNZJj50dceA0TfyMo2TGeip0iqoCErVhiPnk5lCfo42T7F8RMz+E9xNyQF7YiLPDk8AxZ1+UPjdUiJbfv+DWsabInn1S78G3tgc27ibTRo2sNhRMo7COvfVPVslBsrpo9ZOZF7K14XQdgIPu/lWlq03n6y9eeNr5APVad14nXAzO2Mxw8aP43R0z2NHG9Y1P1Eb7e9F7xujd26uNVQPuzOY3BrnYYtPfmEJDptqG3Q8MFKR5OfrZpAzFbAo5muNkpp7Bi3NvqLXOyVf1yWowUHbTojkoUQ8J2MMB0xL/YjLG22WLP3ddSGqlNWduwtabJJj9xCfwDVbvgpKcdNbcDpcnLkvF4HcSi3g0zZZtUiPt4DjCpZtqO3RZXRvuQ3j/QtbOHGvftewB1QWV1psyfXx6mstuwXil1Ym6H0WVd8HvQ9HT0niWurIWQe7wN/w9VUP5fD1aMqYC0q6hX4vnQ02SW5T9e29EfmNuziUS9WVX11qdnNXoKFsC1FMUxrCMV5bJnXAg6456m0bbhgXQEi9Fld5z2Hl6IvKB8X99He+1sO32nr2xBmmdowfhKDAsFVN1h5wg9wD86WmSFbAe4VdFXX7FiBN6WWbYn/yhpxlYMUnJp856dcXAQyg6Wi0SIO/ZMTvcvsCSO/kF/ptmYNB+92uzBHV6U2orcR7Ywffiuf6hJ+C473hztbPJn5OO+cFM/WA7M4rgdHN88CatF1GKyHdgGgzNEyO/VUNnaLphTmOpq4bKNzlkWCyEra791MX+4HtnyRq2cyMepWosCtw/RxFIYyg9a7iuYUggkSaQNytAx+0EKqodNkwlfUBXT298YWPp0+sgjlzKLuM2NUSPuSq2MLkoZyxrSGFOBXNB1PJ3yMHT056k9dNTwx/bQ/tQjMBa418CtaBVfOTHjRzvNtaC3kdAJlYktUTkSp8glbPHcj5asFa9e+/++8BBe+//wcU1DZn+agRyOzvPTeUbvuZtM03luLa6NVmu96aS+IZpRqRhfgZQjftf+vE8yr6bg/+DSD5pnTwCyqku8amzDwJWybm2BeqUGSJzs+L1xfntz7D7aCGLZ/NPfoR+gNd7wkxUbkKexRxiZ3Uc8vbiwrR9/IBeW/jA0kPpExVJG1vkCpG/+Ca0ozInivIDqOm4sZGPDDdHvVaNS9OROs9+PtUo+vjTK8G6TOft92FrD7pB4ytXf3xAOa6GZ28BiQ9VIByiVnLqsUGMrHfHx5oJmq9E6QPUCXDpnrCqcXuXfDAekKLY+RUZFu75R3fXw42ijZcNNmFJldKHTjmyDpfCsdU/zoViEICWqDbS3KU3u+cYQJ3PrnJ7iTieJkKgrg3sv8ou5De2cfowa3PM4kI/nnhMYx1moUtlii/mid12q3pA9CCZdmKNHy+hlGhXWwOwOvEaNVNzgu0O7kuaDZHnrX4iy/johydX8/O83MzIz7xR5z0e6rxzQImVSH4P2404Mo7VsKNlAcqeOMiKHMWHcGmRDTefqep11iTAbBupbEB644ISUC5L1ikI+g5DrcNRVQUaVBotZU12erMNnE+WWZix1B3EARJcRnqyq9RQjtCt2B3vVZduRTn4VQBp57I3WhVow24MWZWi7lRgLktBv4DaxNa8yX4Rkev/AjUpEnqPWiQvE7XB4g9BwCv6OSci6mmZsE8suo3yh1HM1vDWUHQ//4mdb5WgNonWpxotCsFOEVQ8BdgiIRWBBDWsDdlmTDeW8VzgDu9yUp2qBjPhsT1S2uX5YfM/DL9fnt/7de90hXz8oWsiu7T96zTam7hZbkZVYC3Be9XHmvs9N3Rm7audbcqYVeeFAqB9stQ6b2Ft11O0MTyzowdlkJRI3u/ZYP3GmfbjAWTvpYAvSRgqsyowkgidQaKMoz90ejpRX2O0wua9beKOwVy20DdBCSE2EWd93/30+FII7uOyxz52Q69MHWHYTDFom1iV1xU4GC8X87c372dWM3ND7nPG0bus9vK1mbicPw2w1URyZlp9Gb3ZT06rFp+GUxejh2S7LcbE6XcLmcyfhV1NGFztaxjLPla8ufZVej2ISYXa6TXnmWgHVjPP/5fOG68QcnvYlydi329pLjAr9TNGNvl211eJrp27ukntfElUOhKhTRf5DaSn4+r+WGU3uMqY0pP/x2v/tZf0p4ytIhj9aMQk7mg0KMnSZNX5DKE+JEmTkWEpYM6Xl3mj2p2QWBdUbX6y/xkC6GHogrVHqVDBdIrTL10qEbFQhr+XJGjlw3YhJqaOAhdSMQ/MGDJ/xFpJ24P1be/hdbEY1Hnlr/uP9vPHF7h0ZXMcVy+BsQ9XmLJHJz117a/BS/Vfv1F18uPj5J/KOqk0VJ/4QkMHjO8YACDHKK1XwK1mC7ppFUljRMtMLuwS/khXNetnZD8C/EWmZgeWHBZWK8bVbYbPUaq8yse5WmB9iSaStSTu21PvG9DoHgDX/O3epxLYzqWU8Lz6cX159mv8wvOxtZHea9V6gWLgyKnNyntxxscsgXQP52KQ1AQptoVqP0xSAoYCnKBjm1sBbJ6t07C+TkAZaGUUC9e68JkByUK2s8nFI/U6TBzi9nq6BSAZiPiYBDHnmSaTT4nN4Wx74STBrOTTriFD+1mKGE1iGuGYsLJcORrsI5QSWvBduHwuJGdrWmgqA0YtxPYAYKxAUBMKwNNuVBxLBU0Ve2cLztkgOpEQxnoAtg9ZuAzeFs2dtJXGWyxblsuOTVwTWZ+6///O7G/E7yzL6+q9nf/4uAKBh6j1VksRZTPdiNAqGTcDox5SSWM9Wc+hxBJxme80SNeT9jQTlozUxO/9yK3NXlUvfM9Bq1xWUR6B2I+DBXmV03QbnQIe+d1jcy7kUZi1VdAJF8eqbeWCKAk0w+mhFkaS0Pj0n/fiKG0Vha1JIkQUhRGMMh5J8YezBfL9n/iWR9q0B5sItTq+O8BQy2XUvoCD7wNQduYYtBO2cSijSK/2x0zD0fPbSZesTQ5NDam0SKWhr3fDV0dal+WIQcCzh4pGMYjB6BAFLN0JkAhIi52oC0mHsy3vmomsM55XL71Gqg/3RIMnnQDNWpIUgvMe+QJElCS2a0/iwWJYdO1SZsF8e7s8WCY9ZKy3Zeg2SFFRrkFxZDuXslMkd6JRq6no+LKmCX/5CgCei1cc6bAITj2WMJa1rSaXktWtRHYoP7RV3wIIe8DJlUws0ELQRCsKMHI5BJWLAGxLtqDk08xaRaUCT9rrjl8Wee9bImDO0QiDpDZ7Zw8WZeU9zqPGj1Bu0m9VuYxJ2iPSmkKKXWRcJ0UdXX1OLRGS+SwBnmtFKlGrXbw6DO1IYGmMFO6RGYS0pT3cs7UXHR0L1373hp5BwSBey7FX/iITl9vyCfC2ppFwzDgaaESc+lN53G4ywHyGCCtBnxl0FCO1Lykeox9lKA6c1wDgSoTnowZIgseBYCs26PKGoEIRTD+YxoulyIFyVRPKE+Lq3cwh7jhOaZf0glkhgLmiWgQzEISUDuQCkV8+wdO/SJReOFgGevnJhsFWsXShD72ePkDjC3OXt/JAfErZug8UaCMrD0iM2DguJTV5c+GK1wXctSaWV2bHUwIv++ONYgGtJM06nhPAnnZ8LR4Hcnn8MOz5oBv+LgYymSRiINuFm2kKYYcUA2lCFJBk18bSojONZranuNWiMBUfwFVuX0l1yQ4cty6BtW63F8rdTgOo0YZtC1CuLhQSpRWcKEJpJoo3Hlof2boagq79a6/tC7CaUkqexoha6j/8kbVrjuAZzTiKBqnN0LjpUHoKDx5zm83d1xksgc9pQpdiUCPm0jXPDhx2i4TxdgueprfwbYY6hZLPeAE1BIjkR3n38OCPvOhTG0WSpWP6GyA64rdrruWXYBtqaK4vJsKMnofrCVsxTqQr4h6ASZYoZMHZhCASHrlk4pcIy3zgwYSE3icjKfHxRnnTxP7+/mpGLNoEJIHlOOdZRvr4iFx0Ck0hKjhbGN7+9mVkwbRoTcMy7Z4NHsdSy9tPaJTWFzDAINtzMOBI2q2S7Sk4VR6oqkAUhtMZLJGiVt64iQ3KRBqLSkvYzdiPh+nL+1ia6H2zOEpSWzK5cCLd0+mfKFJX5hDP4SSCd2l29vuEqr/siom7nCLgSdza8xr7J7tUPwWfLZuNg+zy7JRftwqsTQPqNtkgsSbzkWrmO0U5VCLyMJde0mLCYPgXUoXz3eVGQCy0zkom1IlQpkThXi/UGPyqg20HeoiP+HAtrwlbjZy8S2ourt/NYeNMM/ThcXs+ioeXoi3t5G21th7psRcfrAlUiIV71y/FGhrtaxcLKCvSzcDWLdhbUhOkxEtr5/F08tOjndj6/joV2R9GPrZHoYqHttFHBQAtLsmKZBhkDdFEiSTGzT53WnOMY5AO2g6cBccpNoxVJsB1BMs0SmiHKeoddrYgRoybydYge0WtrQGIZOLorFhhCncis9cVvBdV0/NqTNnAucmh+LwDOFtBMip/fBFkRUwr9mmSRMFzasQkPivJIqaaS8om8tCdi0ZTY8a0dQUIhpA64WWm/eEI8RCHLknL1QADaseEvl0YCDo04S/u9GEikdXjMjXF5EUzwwdYl0RB5IqRDZQLWFjec4xJsbFB4GEcKW8b1UFmfSIjenVsaCZArrkGuaBIakJfCFs+o5BcqzE6SbpJikauhEOEYUN5dzMhNaPp4arYL7YbVNbhYtVkhiNDyspQSysupLSqTWDKxllPc+Phg70um7owAvWZ8TWQYX84KuNeyW26DRNqx6xmxww9WERoHJZKRvtrRUK0YX4MsJOPakCttU+MO0Ql8OWU80TKzcdUDhYlIJEH/6u3cU7Mh3KRNKxDgJJeKiy+QX9XwMGN0e+A6xALgIQTrWlQ+bjgkqvoABu8NbGIKlHJrVJXHCPmQeXQHB2LtqnoM2JHy0yT+MvYoPYDOWT9Yeo+zhh6Vt7EEKVQNWHg5121cgQuG5Cu7tI3PzNGyNqeUKReGaBNa2s3sJ7DpBZqX9lj5x/xKr6TASm0ZxEVa9KbAoQYqNLEFhymkSp9AEzoASx+tFVmAmNpHD1zgy670iuZsoJxmdFzv56RDagrVZjfYXB0B17svpEPqIVz9dgx4wGSYDd3yDNBqi2csGWAZyqUOBcETCu8h7xyz0GdJC3WyzXw/f9RmPmR6e5Js0YAVbIZTGi8DrQloPg8SdpRWp7uISqz0jsp+J5YpfCU3OowRK1FV4wZMR9EnX0Earh0rXZZYe/vp06HTUxPs1Sw8tjdFQ2dNZZ9CThzQQmQJlg/uzfns/bUva9GJ65pGhCdStCCFCRPg2jriLNGXDdiGGof6H4SpiiSkREjCRciy1b0nkdbt0Nsy1IoPhRioSB3nYJmhD4XFM5FY125gLgSoYqAVHom0UPNZJ1s0CJBNWloJiZRAYlB97JEYB3Q/sXNPAnJDWUbe3CcbytfgS01f3s6JBFUIroBQrnYgiYLAUALwY/1h4Ba2EpmqWrAi7bcnY8OF+rSm4DEsVdMGxP+tpDK1ddQlS8HTs6VhlKZ5QAGWFc3VoqBlr+42icNa6mLc55xme8VceaYbyuna1rOqCwvMWhgm8P6O52mxYC3Q30GSa+9y+RBknF8lGnKFVeCumf3wxjdnIPP5bRAuNMGoiSpIPrK113Gw3H6c+Wp7HSoTYDJwJkocRB9d/VcNsm4/4etB7F21n5XrERH4zJpvbajaoJWKeesJBKsEbnJTNSsiOPTs+oXb0LAt7gdMYefdfBXRpHE9I7LMINCY4eAgGhgPqxOmC9iuGGvzhhkJAAfUOddMFTS3Qlu7C8kUrh2VKaQrLNuiS3vyyu2BXgC0rynWG/OPy5D3RNIc8I5QnUjfpzMBCSBl6m6oRWIT2NMEGQlgAz16w0zgEkj6x1sjOEPzCIWhWWyTrFRTL94TY0xtWbEtk7qkGfG0fGPLAISKbkGmDKtw9tv5OekSGAezc1bPoXagkfB8gSUppLjfewNrIBdfUw07Oq5VHBvD8Dc3LmFFky+R2Wwm3lSilYtMDcAomw0UugifpkNCLuQ+uLKyba6BVdLCdmlwDTZCxIENfVVINl5c8klY3p2TmWS203MIkgVi15F356H1Pzd0gefBfndOPgS5qzeUp2pD79AqsVyTdz0SE2iw6kPZLl9WBCJiRVKx45mgabAGslmmfCGBKiyr6DugUi+BaouNdEiN42LrDWLqy7tqeLKiS8kSoso8pyHKyEZgRdi8E0qHvRaMYrpFtr8QFiC0siQvkmZNhLhAGh6jmW1o7DxJVxc3s/AOWQYjWvVMJxgVTwKHJ3TbctL7wnKFR+KqmkkjSZS3oHdC3hEt6WrFkiF649j4QhUMZ8WuZvM3F4TxpSh5SuazqxA4iUWvQDKacSQp4MpTIY5MsOxdNSzFQuVNXTc383As5lWaztN7si2nIuUaNWVheXqNqHdMr/3VgUywSY5xrDZR1YlntqlJEG9wtc2xLCjvJVszTm3RAR+aawm7Nt61Yal2joQA7kZfRgX8ATIbcfGIIE+8rJujwGxpxtKcItmfzSt0c35RK582XtcTJe8/hbDY+IH91TqFBPUzxCf6gCPQtDpOLQKav7sfH0IGFFCZBJQtvWNYpd1skbnW8KMgMsonslOOdx9en9+aV17kjK8PEgsny72GAEtFRrkox7n303CJUjtZ5QhcQLG8wzayqj3+OAyWAFewyBhaK8Qbes/yMm8UO2h4OJ01zIju1w5JCOQpqE+rqehtrD7V4gM4CYFct0hOIONIjMrew9bwEyAmKvLF7PMaAEUkdELMPPLxuDajGpZtW2uS2Wx22ahdGIIKKfn3WqzDdTwrX+Hg8LWCQtL3MrFDtPG8dZadHpFROGhSkGWJOU3CHTs5zYyisEhpr78+icRszJ32ZCAlLUIPw0KrzTAA63EVTnLKSyT5+sYMTRNdymC/Tk6VBpkqjXa2biyF5unynGkjlHbydl5mmhUZEO4tL7WCEHQSzfhKJqg6gqPSUhUas7BttTZUPXEmkLIyx2c4jk5oMHcO4/7kJ6HxPrXSPAg+K9I62JgKa1Sdg9rkaPbdOibAkAmsretfN8SCxI77ODKBOhlmWRhbnTY0ljxf5xotTcH2EK4laJdvIiT7HdKqXvsqE7YFp2HANg5Uu3CPkJOGdsqcgSvwdIkUraXc7OLq1eV83qUxgYUzLeQrvDiFd0AzvSE3jlBgHZ0KFt4F7MAKqwSeF1hlY2oudTOb/z0AiFojdpr0hX3IrKr8fRvoB8g1UpnFG3rvUiZyZis+kk+cafI5LB4P72yHHWaOFeNq+2k9osMfB8yuP77Nxy3okGgWDrsFZiP1W9hVYUfC2/c7uSmT0NqhntGRdQwwgecIdqhtiAww34Eo+MY7TJiNfzyq4OY/HHYqE1iFTGFH5pnQj1ife22OIZKw5CxVGuSWZg2TVW1sNOQbsvhZAOAVotR7Kw79LAOfXC4Ylv3YNgG6bY0/CkNkKSq7qv2R88DIRAMIkUnVeDqcKswYIbIUlVPV6LpUHkCEyadqTBWzCmURIkvxGNbhXD2GaxlISEbb91lK5o+LLhFZuiukQLK1GUBfYEneutSTmRRh8YyC7xhWxug5WWV0bXO+eOo6cjIX+HU+I0x52sH56KIAiVpR6X0Brp636+oSEt1oMKF2ejxgCu/yiFlA5oBn7kxkgawUt35MD1Vw/RFRarwIufelDouLE6XGC3MxKB4R4lJQpSDFN/s6OqFmX/PtHZbWZzWq1KlXlpCQ6ePquuI1xp1RvSFiRTIhCtccrNGezoWdJKVkeu8jswOwAla275fzWyIKzXL2u+/jCyH8ynxrwY1QjQPr8+zW0iBcPKYRfbGhCn5CzH2yuCyRQC5abARqyMKsNf44DCzhcyZFAipMQS5ExpI9npI3s+MHqneFEIhFbM3OCJGFHhIx0Xb+SdtzLdakLDJBUwJSCknC8uDMt5YwFT/xtLhqvzo2scD7XLQgbYqT4GAiHg8DGoQE6BVSLAHROn7N+F3tN5gZYrWhPAhc0rTVRkX26cN1pcZ06TwESLOJOxiFNRkKj+tPUnRUsS6sp3EpN3ig6dVDWWyx4k+PsQd7UIipmNUiuSTVR6FCfF88qLAH5quhuJ0Kz3tSCOrtnHwtQemqgWlojYivJZXqbiLk/ElL9I+SSso140AMEQL3RUZ5oPT2tRSawn0CkGK17b1aOSo21GYJwEmP3jS8nI6XaDk+1LmK4HXYaJaJHaTkVdOwzlaWkb1aUlV9ZAOh7QcuONp9FjgRvGvyDzuJsNASC6VUE9t9/KI6HKU6YiXtRz88DF/SlIklWt/3D2Z4sgxq+26hYEn5DkiIjO9hJJlQMJFFHAUNMazPmSY9PftPKdal+WMwWNf/CiuJcADtbsOSDanIPho0VvO0OhTEgTGEQl8VSXeTcbxPvAY7FyX7ODBYEQc1nKD7kGzTFDK0pYEE2BZSz8HalMZBIRZDOM9A6uAaCNLjx7l6c1ef5g72dYHQPsUHsSEX6ZwC+ZiinRJLZvJRtg3jqnkyZdgSrkBKmpVYrVQbvXqHaE0Ay8VUn6yj0y7NsGQ2mz2qBrhDs9PFpDL8REZhkdnIA/MilYrQVn1i0qI9AdXo0JgJo9byEiY9SviKicTqV+FQzLcxTc/vr2YVmUC7ogRVZkghgLUlvEtlHA1axSSDZWax/BTY6UcqNe5AfJq412LdGVFaAl/blHDrUA9pxSKVEos7QPKZfzi/vPo0J/P5e0K16yoVLueVGSAKemUGgWlaBgji3TdAwi6+SijnWAJMo+G/I0NubuYBD4oBNfmWHK9VV0DCnguVCKw9ahQSf18VEp+3yI2j8v7Xk6hRPWITsLhimm3RkM0PBKxBvO412mhAGgYTqzrK7fmFRRmcr6GAa0T9am5W51G6lYKvWFC+lsATCI5ec6WUkM54HTag6l5LTWIPgJooI/VUXeox8X0PNKJ6mh58WZVHffuPy1siZFAtFgU2y2SBVtHNjR9kuvBYsGyKX84vHwlHlwVSB4UKx9zQCOycoGALeI/IvDv6OI4NLUCmUhQy2aaGVyELtp4dSlEU9l8ewWOQGq6Nh7TJtI9FWYBkhfk1HszLGptBWoDhEEcCxdM6P/q6O46YpUxeOKwB/hH3K3MuT4vQefv9efU+nVC05myeHq2h+jikjK9dQBUWg+5AdcTCWLVVfZGejbZ0fT676pKbgPU7xuPheiKYwR9RnQov8cLmWwRLQFgVctoRro8t66n4Qw7Ep6G7rcrZNl2H4pGOOMUfdBzGQ/kkl6HiOahNQSVgdQM/YLXFLjqkxoHhFroNCuRXMsHrku4rKD8ill/JBLdBehdSoMVUyQQ1k8fDCm6LrmSC2dzbwwlt6q1kgtvU2+PZUJn6br1hXb09MMREnj6ywDwee9IR23r3DnpwR28lEzwJ0MMK8+AomWB2y/ZYQhtlGzRojbI9lrAe2QbJSY7149tjK5ngdZz2qD4FtS1UCvMYzy9CzzDakflvqqDuxDkHHaacqIy2C1lGxTSfX5PzwEKZSmXTFTyfaKO9tGjaJKbAPBAVEQVNh8Y4HE0RExoPjjVbo0Jw9doV+QpR3fRUt7YIYmtgoXqlKVrBwv/555/OfryvFqdVNnQKD9bhOU9zxn3F/DaZSTRYNTNCS2UozTRWC+3zUouqy4IlQ7Rk6zUExWWpcvkbYPWr8/aQDokpLJh16S5a2bfzcvnqxlIL9S+Wy67YGBXe+echElNw8KIersW6R2ACiSpYwsTEHYsV+lBTCo1+2Jn7gJiIV5en8+Gaj8o7V3ueoFb0+bgBS6SqQmYL5Oq6Am0gQrxjVuOzaUtHoFMlYqCkr0bRITGKBvEN1p3GImJVVSLUGuRLwlaECw4vzRd55Z4LWEC9kUARQzi/XF3OPZHAGCq83bR1yrxlErZBNkkspuGeRS1C+7xrgdz2Nm30nzu2960WGsvR89EMTXIbfB4IxEcsYOJpPEuOWMB7pCVNAD2kI8mo2jhaQXqwlpSnDKt9+e35R0tBZbROUQ3DhFYnzZaathSc/h+8Sn4OaA0pb+d1+3mLLnsEOivyn1jDCMFVQpJxjdDZ6i3L4LBcJVTFuUOiq3TJOWRY58sp745G2O45OPHXqI0keGHwRIIWoEBWgAbG639hMEokB6WzaHRScD5dhaKy1elLBRKzk+Mn3sBXFdsKbelYTrV0fFpdD7EzOMqiyPZtMuNgZOZYBkvH0/ef1lL9w3XFlUKufg0oY1hBDg1ELSJTmFBP0wFP8BmSiDypgSfw0k2VKYhk6/ikbLPEAKHSoFmshJxW1J8E69Dzqy7rHLhSOkd1sVTBRV6OK0D6XkrLPfn08eZhgFuKJPZW5XRConK2tMBrC3IAEtgbBFfX7OqXId3XK0SLHFrKaFRgnzvAOrQeBofo9ehiC/R8fFOlojAjf48DZANn0BLSP5cZB0mXLDMMSiWUe4qBznLUmIbPoTEMW6z6UNWWhSglWyaxTOSfzdChO2K+i6UzOiBXl+RFydnXEhw1YnvhsxUDGRBkvxWsWCB6O2zieRFcaHBbYJ3e2W3za0FInMqJg+dqpiAhnwtOPjrFNpABFRzXt2LdKt7mbdasswbjwOR4Md+nHfIPb4MNytsy4wlW26I2c76gGtZBxmUDCo0DtDCF6I4GDeKj2sITyCJ3aEa1z1+uwxZll30taYaWj2dwdAlMgUENGjBggkMGtrtim1G88/tlRj5fn98G7dIOqYX9l6e1sN9RLgpNiwLRKXp+S94366yfF0VWl94J0qp3WI32v7hG+2tx5OoBvdtBwbZIKwf0jnyBglxxpplbsM+249vD0O5pqTeIZWr/eV7qzaOK1N5XhltMQJ8UhNZPuEdL767y9P45yBkO//H/BQAA//8zhIZC" + return "eJzsvetzG7eWL/p9/grcfDhxUra84zxmds7M3NJI9rbOyDK35cfUrV3FArsXSURooA2gSTF//S08utlvtSgsSp45+ZBKRHLhh9fCeq8X5AZ2v5OlVIYJMP9EiGGGw+/kzf4vKehEsdwwKX4n//5PhJDq++SdTAsO/0TIkgFP9e/uU/vPCyJoBr8TAWYr1c0JEwbUkiZwYv9efY0QuQG1VczA78Soov6J2eXwu8W3lSqt/T2FJS24mbshfydLyjU0Pu7ALf+5ohkQuSRmDSUwUgEj2zUocJ8ZRZdLlpA11WQBIIhcaFAbSE8681Oa3mMyKyWLfPpU2ou6H9ahFpQ3pjc8+tD4fUPsB8n0qvH38RGGN6yzKx/XTNvvEaZJoSElRpKE5qYI66/olmSgNV3Z/6eGJDIDbSct7ect0oRcyhU5h0SmoPon4mmxNqhDp1PShQ0IM7dTi0w4AEZe/bDk2q15IoUBYbS9H0xoQ4UpYehejIZlhwBMqWl/0EXHPCY7BKGGbNcsWRNKNGjNpCBrZjSh5ArMF2YEaF3u/knnaFST1WtZ8JQI2IAiC6jOXU6VBvIODLXQKFkqmdWGenYpV/rljCY3YPQPHfLnTEFi+O45MQE3JR/AMwt/wkUN5knvQnLYAD9gJbkU7fvZWMlzyBUk1AQkKSyZgJRIwR0sQxccSEbzflSZXs2jXZiRPX4X7vnF+U9kQ3kRbjxLQRi2ZOF0wi1NDOFy5fdLdTbCzY5Z8uG0uO/Z7cipMiwpOFXu92FjTwZPRof0QSel72R0KA+flMEt2Rx3T1793z0Z3xM7Ks6GPOz6ysUfczeR9rY8GXQbegjTQ4emQMtCJUhv78OXDev+PwyZNtRABsI8RXC0SJmZJ5y27vATgQfCqN1TBLa2MtVTBMbEYcBwJaaSczzdk5YCPYR74C7bEiCNqUMNyDV9embti6VZwKLpyCEdIeFhWkRLDulQv0OLGF7FlmnlSKsoalaV3uXzy9WZZqTlIz0reO/lS44hVheCfS1gL0arav7hT7umUnsmRWIfB2rkU9dsB9jNhuGyw/rqntlh2JIltH6fL+WKvN6AMOTaMWdSiBSUVUEUBEbVmfqS3UJKNBhLpPHj5hh6WGEpN6FD+8EKS7UJHdL32pSuJTC+femwg9mZ1z3W5H5rsJYaSV6tn8u3Ups6i+TtE6lBpEysyg9137Gp2ZC+nfVlhxywzo8GF/ZitvmF0DRVllcOXff24nZmb+S3urib37CX97f/uctrVwufN7T5gjek1a1lKaFkxTYgKiPZtysI2CU6zH6Bq4GkT1H4+zY8GoMGDZnv5gq+Iux13XnoNtjNe7Fzq/zaD01m7iI9D9ZsQ8nHXQ4koV0OsgACzKxBkU8Xwvz0G5GKvOGSmp9fkQXV7hSVDrIlWxXKiX53zPsQcfcbnrdzg+IpnxHsC/bXK4llZhvTjsuRv3kDg1RbqlI0oa7G0WrTrq/kxexzQ96jRAGn7S0lRO+0gSw8ogG2pbYGf1K1Xzz7/1KxFROUl79pSit3rAOW/DUSGHEx+/xbzxIE+J2VePgSVIi6qxzj9dkf1K7geOjrswaagjqK7/qtG4pcnD/ES+rx1p2ljsxhvtInbWTjyRzdzkZLQetiL2i5i2JVlzPJOSRGqm+RAdvVe4SYG3vmmCaJXzpILdKGoHop22ILGVnoJ6jxZcniqYiqmdQu2C2Tgix2nU0jRMHXArSxBDXLcr4L+2S/bBk9AZqsiWYpkGd/IWatCvLq119/IFuqiQYQ1SgjK/EkhNcJK6FzKTTgLUXyzZyKRBbCVDaFIlt4pmevsu6lQJ7RhdxAbTGY6I2sLNmbNgpoNnh/km/m2DzyUkHKiracFmOhvuuTHCvDAlsSZv5RvPrLT3/VnqW/zB0DLUH/ozObf1h98JLuQJFX5LVIaK4L7j0rVqW8F1/vo/5A50dPbGXfKD+/Iv9mp/uc/Pwz+TeSSGXlZTeLMOhz8r+4+d/2i0yT5qJ817uFQqbwZHVdsYV5Qjlf0OQGVwL24IQ07tpQ4/UKu4gg0lwyYZxqYqA/wNkdjjkoJZHi0/byoM4hYZQ7xA6pNlJZyVrsvNRhP9hQzlJ/MPpAEbKUhUjtC8PBgWdiFYSjO4MXmzeiQzmGLzBchxG30cAu7Lik6VN55wIcotmfQDIwiiU9WkdQhetfdrqwf+5LJmyffWr2Eq1cltt2Qt7Krd2ars7JBJHKKmNGkhuA/I5FexIv3jeyaEomoPV8w9J5iuV1fV1ynhUIUNS4S57aFazphRumTEG5VdobtnfRY+JgGbNqt/OVu8XwswhX/eKcKMuttTOouEWjagWm+tqdK6EVUtDTo6+Ej4QbXwmF4grqMv6L89L2+gEyaYBch/OeKHAP7WI3xCjtP6Uj5htwvISR5jrnDDOy4Umr85p1xP4nIZtZnot43t2ts29AOOvlqSu1lvCE/PfwMHr2smT8EXz0dlSrHM3OTmdB9k2osMvDslyqtsRL3BP5zYVBFE/D/PHJP1VOEXeqe58ptanKF/uf7BV2L+c4zfyEvPr1N7J1654BFYRy3m8rcEZ9Jybt7UdkCwo8WWoIB6oNkaKVLtJcxEcXE7/tRey5qxhu27B2X6RK3cK5qCZI1kJyudq1HXFLpjpSLCG/kmRNFU2MX0R7qXcOvzOaC1KIENPDGzbzwYza2And3lGP6UQY8V06jSKzQqYUpRtB0e0gT3OctSVW0sRJrN5HIYLNQSZJoUqK2lCRUpUSIVVGOfuzL75Xqqx3fdIQ5XDwEsli0XmS7rVIe9QVmJecLcHNuEfB15BIkQ4I2PvtnmuDaWcZmRATicxyDqb3AAwaUakT4I1iLTZYyzdT5pEO8rUdu/c4Dx3l5skcPH6ZFGYdaZv2+amxYl72UU7pIy38a5FiLLsl+acU2NUWRtiiHb0UMX147cf2CndYFNqNPiUGbk24fGQDStfSKdKxOLCe/X3oYdsBjTXNfZpeIlUKKd47GIJswjOlqxFLGaOMtKm+WPevd18rJbMTR7VwSfk6AUEVk16szwpu2AvDQBGa57zMftnXssmooKu+1FxCuHPvlPqiB+WxasLM95rIrfCeMUOzvG0ZDIjtaBZi9/YZTZI1s9qNTEGfkHeFNk5NqhO1t5KagbhcauDATRplYMulxb2BY0hCbpPLAf3aKViCApH4A0GtaJ2yDUutZOPOQz8juy4Z2cfW4vVP8jZn6mgz3O+n9wXd2pPIDN/5yWrL9Ky8ZkG5AzpuG4246YMmnOeWG1f87KQzZBVOJovYHCjrCHIPpVitf+yr4iTIrwUURztK9nT7U7Tnj1uqiQORDpwbB+6n2IsaUShoLCgCT1tlBuH1XWUYWPM5AtR8jiE95zFZUZPoq+hUEWSl2ivyOCpkS33sfWM6z+W93pxD2eZdfO0QZ8H+gWhVQ4htCKJJR4iPIVjrgmO7nQa0KFmYRGbw0mOolBcXlS2XnRNCRViChgI5cEBgA4oZzNSRkYmVo4ckwJpnZ8zkg5u82Kkd6F/pKtPFUnN+pxwStmR7xadfuvXOnKGaKkFWxo9m6tmAysTI0n3CRGmiSoOTpRd3UJuPtQmfm1p6XROUiry/DqGxTJcBAW27mhu/3KGhLEmdS80iMo5JZ8up0yL1FaZcKH95dwer8BTczPFKF92TFYkiA8WS+/Ki3rkdIYttZGL1TLbqZni25O93Z2obEKlUIWB2dGZy8ccjVK8pXbty8Qck/Xq0BYafC95ZbstBx4F5To9Zq+677oUMWf+BzQQr15pWscVCGkLJOlS86A+g5XI1LwNVHoWplwfx3kz9GDVTGrzvby7cylWtduyjX/CXnCU77NszwhdmDkAori34boAvFxwzbrp/AT8UHBywfnYqhYFbbIm1AnQhvL1uXw+Vpqm2/3KPKuUloL4CMHc8zsmaihXMBWyxecGQ4xK2NVe/E0KMUWxRGKhxiG6MvvbQrbRef/76WYfOaTRmV60cZ2hlK8cWzSmC7fgiD6Yuv/Uoty4DzC5YWXBQ72O+1AbUCbkGvymFBnVCV+BKeYdI96VUJYYO7ZKMl9sT93vif1+rWyEVWSi5tZ+Vfw2yple7ButJX6QzqkxsM11FOLZFJdwp2ckOPdadkjytxEasKyVzCA5FrLf4VBDKQZkqukjtBw1/8+6twD5qRQBcEFKPwJwSIcULBTk4TWYs+sGpDcd8cpJCKXthKn3F7aST414y72Er3T+dmW2ZWQdh2fN6cu4GXLhsE0GkeLGS9r9HXgInpMx7BEfEedOaM/ClA2BByiWx3MEw0Cfkes9T2o0N6plVOIjPfDpfoa0S41NGfbBNGthvWHhKEl5oUx7I8D+dbXI/YdruZMiJDvYNK/i6T4dFoKNLP/6G9Wv0viwTnlD2/V2Kl0V57lAQqrVMmLOX2t3o1Sfdhl2yG/idUJKvd5ollJOU6ZvnJFeuJ8pzAib5vl9Qpooeknt5z4fe59komoEBpUlOtavipV0hB1+LIJFZZrmYbDjtu6k1YJJRcc+/B48l8dX2EOFh8uw7kVledO8gwrZRsmUildsQT5tIkUBunleRFIOL0ZnmsuB8R74WlHvjZyozykTgGqI2EJcDT1fd6hlLXBqZuhUJL5m4gTTkApWB6FQ761RQUOwn31XQTlg6tnG8UxUCldXVOzt5s0QbQAnv/fVj4XqfB8srue6W66mczqAy1m7shG1iDWM6tP78j0vaP0eWtJeM49/xaspv3GjVNVaQFgmQ0nME/eY2DYpRPu95TdEekWs3ZCk2t9/H2gNoX5hBuwAkN/qgkgMxLMZhdPvQraleVzfUioU9WYZFsvaRv2WOTZVmeFZSapUIsxOphjnRKrG/qv6/m2lKLD8XhLmYu0IkHKiyf3KF8PbQQgJhsHaqMrHzbu+DZ35Ft87Tk36xEpktmKjqZtcfrJA2qu7xem2YKvSxLX11acQBGLb4HcdB2nMlzvzovibjsKXUa3DopvFq+byV+eKcXHlO8ywUbiC+215I+rXYfuiXq70B+jFs+TXz88W5W9KQ8laxia71oOmR82GAfgon/hBZXrBlul9J3egdZi37plc3JGh7cWHUji288n3EU2OX/qwamFyc3ynJxrLP3SHJWmCvRLqXaE/Imc/PDPVOuf9gXJp1AFXzGz99F8xxi8JUmZvSVI9RIThovzLSPyhbSTZUMbrgnSxAX5SBCZJzOsAINAiNWh+lsaF1UdWPfGI5lZUwyvxCZvf5+uXFrC1Dk1Ay1lsUhvKyD2woODkXcu9p8SDJhTDkmq0Edcxi4IjmUmEWr/2+w7/sIZ2Vspt0VR3df1ogtbvsTlkqew7O1fuPhImEFylYdhYa2dqfn5Bnr29plnP4ncy8QcSTddz7pN8u4jxzR/dtOuPU/mnpR8b0jRW5D8B1j1S8mhnzKjwNH5i+GXG5GsVWK1B4Lez6l+xz3RcQMDjpdK1AryVP7enxuvpAp9GG6/0IloWu7z1w5WcfvIzxQ1WM4+K8P41ksnc+kVk+P3LclduVEHvl2rh6+54uFi8sHClcfurStZuRaZEMaWlBLH2kqLE68opbSuUqD1i+XuIb6BJHVbql6nEi9LpV9S13peEhspMYKI38zDJRSt7RpKyn3C/cWhZ0VD1GihelgKrGuZDXNaM3tVZAdfTYYG2oKWIJzpU9ijL+aGqHHXwhbwlLXw6/X/ZlLY6B0CL61Cl87O+CRdF/dct3DLn7XueQn3f77h3ynDEhi1g+zloeiV5Fv1OWk8Y0OnQssr9EJoxdmbFxJE45t3yP6CJJQOtlwclrOz5JZAraHomy2G+/ZsFECreRF4AzbQ6TPB/IW9zAThVTJYgFKOffzKhi3EXw9FjwvP9drAh1i/jC/rZ3ZgLhHMqFLy70SBJxGJ08q+I5c1A6D0m3nsN0liyICPuA+LLC0w8DSYbezNV9j7EDSrzwVQV5BVuV/7b9kDKhSQqGMt5jZFjIwtR+NzA1yY8em1labGkVx+ZwDD+kBrKco0XznJIUljS4gELly9KHH6I1rVS8AcXpziVyGRkeV/Ks50baD5zWHX4NyzIL3NvqtWGmcIUZSe/E9rpBt2DTQ69rVC9Wzb6T0NhIEXhVIrPM3iecY3TmqRNWC/bNldyw1NvPyipyGejBQKhUJoc7Gu9vLXvD+F5qTOpxef2iwW3ugp4eh9eXo+Py+j/k4kC708HT+z9yERww/bcrZ3iFc89dQLHf+evZBbnoCFR1GGhVa0N2yTiCiIldVTbsKqoifR97WIit7hfuPYuYL2SKnfHVybhrCx0BC7FYBsSjdfxqCd5lcITM85oJOKQO+wDayh/CViytXDkDRrwsttbYSQOP8PLHE/KqeecF5jNVdveeffLVc0pHlAvWuIWkqFsRfOjXAvrSW8sqTGOBG0cwhPRaxdOmQaTKrqQbyjjtOjJIZQonLr9yCUoNdFrwd+gQW388v1tQVrJQAMo7YDtTCuEGmq1OBjgiy+aLIk130e0zLJtHzQOq0S00HFbofNRKFZ+iYjJilYNWit1cF8dISGC6Hr3qa67SImWmyqzb10ULiPoa2+0zNjwr2bsXxifpo8Rir+DmaFr52efX5FnIlfhccCsrLxh3CRwuDuz1bS61/eYP5EXX0CDaXpgbIbeioQhpSApXzGLTpD7QaTOhRzDBtcNCz8os96uQmnQJK5rsyKdBdY2zhaKPkZQfBm4sMRMko0wsFc1gNBwjp8p17cWvk9AQLmduWHIlUx8cvS8LWIs66wFF7pC+XKiAXQgsDalZN+4KtuRtIZwq+U6mwMkzJjYnPz4nTCbPycL+C+y/qKB8p5k++bHfv2iSfL7ktNM5P7YM1ZTwz2bEDepsXY5P7srmV3I5WqjBSFSk/q+LgLMsg6BB2YPcC2iTxeW7LWSf332hCshHHwD844+f3305/fD6xx99zO2GKsoGz+RWqpuYKct3XrAv5YB1D9ugEYyK2EJEyNmJW6Wkeg5oYp+LHYIKs5QKhGZJTAZSMyUhIM7iW0F6/AOxiM63lHWbEz/YOuBqn8cmaq9P7BR1XSyQLoVZpNqo2JnvLl8bzSBWf0ujvaNlzgeekfTQZJd9Y7COSBOSTfZ5LyHfxZJYskFDUzlVNEPsoVPtrUbUM812ek8/Uz64nuD9DRcWfJD/P3RH3YvMvvPfoxyxtGajD0BGQT7K4Sj9uGP4pDxC0FZjZ2t66TNTRbSXUXauTuYPzuzWObl3e6bLktXsGP4wl/S1pIzbtS6LucwCz7g4r+e2uUpcVh00sOopYTAcVVjGXM+tiHjAfA4JvHbh1iH76ExmWSHalqgOOnFY4aaHoruCW/M36JepK2z6MMn6odiuqUj/Q/Z7zfbYDDXsEM7wYHTdgRvgdKFzljAZLUr0WBq8Q7+lSnSdDk8duhZZPpdYzPj66t2MvPd21H1Qaj+Qr0cNJbj++yX5WoAaqN1acDFX0K7UiRvcUDOI7siHMumsN6yrktKTiA9pnaiM3UbAEs0PMhzdRdX0OMceTDeN36CBcqoyhN2yZBHMCzSPmIBcES3SaF1pGzTjVrtqkE6paUuFD6W7AJGsM6pipZVUdHc57bQvfrD3iSadcKooNOfr6GchgWXcBKqK8HLlSi0hkJWLPxCo5jR6JwxfcSr68XJO9zmL/eCEym0ZWNEzOmgxp4lrjBI//cTS1iKi8l4jvFjlm1/ErVlHf98TMU+Mmqc6at31GnVL+TDP0wTCG06jcwwxB7FiImJSZJc0Rmy0mC/nestMEp1/iPmSy62mWfzYlTptYTZ41BG8LomYM4HJTpjIQWWLXbSA9w7tPLnBIb6hHOOssHyeK2nkPL5LylHf/DJ3Fsf4tDna3eRyNU8xFtsSjh//loh5Rm/nxsQyGzQJ2xPNAeFRyJhAAs0EHuic6zlf8Hlst2iD9l8QiUevDF6jHbsWYp127KzeOu1fEWn/hkj7nxFp/wsi7b/i0DYy53QBGCyloh5fPRPzrOBO+F7sEN7Jknh+gyCXZAVnqyzHkb6tlEn5KnYQUqDMMIQSDV+T+LYRMdc+IBFhB7VKcLRJSxhHm9Q7XeQIvUgTUaVVo6iqRhqresAtAgsx0ljFDIu2U2tQiBeC3QoqpIYE4RBufrOrgvQobH6TuVkDTRHMajLL5wlHsGFbwghOEkdXLXYmvlnUUtYolPNijuDTSBQzLKEcIYFIz+kKRLKLGHVVpy0o3/0J6QID92buyoCiUPblYHBQ+8BaFOqLVb75DccGrecLZv6KUmgs0fO4veJahJWMzqo1yjV3VCFR8bPctLfxR+u1VSMMZu3t/PGNI564E/tQiPtq8vEqyNVoLxkHDB1Gz5cYm8iWMZOzm4QxZAM9Z7kLUpyjsDqWb35Jtck7xfwj0dYqQaHN2RIw1BjtDM0ZpCxawmiTNhM4pySTacFBJxJjtQNxtkLgTTLXW2qi9vyvUe+LII9CWMGKaaNofEvInjaCxKcgx1pqhbbW2lUiV0j81Ufm+yOOQN0ooBmCIOlTgbBg4wnX27Vkeu47zManvqOKohzwdCARNgblje9vH5su04aK6H2OU20WhYrVLLCkCr5XEAbVIjrW+HJ0mZMcm6zr3LCM3+z60EoDYzRXNE1j3wGWxnarlqWDEN4ils0TJWWGUpXIEkZQ01g2xwmODBWPMJY5v4leninX8UuWslznikUmyqlhpogefcaZgHgldvZUddSOOhVdl3wb36zFpa96Ol9yGf05r4gjhPxbnTc617FEETiO1aERoEaPTeByhXJ0xQrlAudSxWZg2aJYYVyzjOkEgy1kGuXAYvSBEGBccaXodKPzcF8AOnbEn6caOxxPbLexNRCUjDLpG0BH10RlfMlIKraa9/TjejDdrQAV/83K574pb3SyUTtT78n6Fq8ohwwhcTP0xInNDALZ2Nwgn3tDUnS4VGv74TxZx8rz75CG25xFdwTkoLKVosJ0au7GoLxFIRz/6fWVyD59anUBjUBYydWc6jxiw4A6aUVjU1VAOYZ8pyBx6+CrjiIRj7/IlnLcEq41ylKlCIjjGzI1gm1Ye9swQjyAhtiBAL7hMYJyouFr/APQV6A1GlUEVUqzFQLj1XlsK5tWCcY9UEkaXZDWKumrihuBsInXYqtOs9DRq2puEhE7UaK3W+xDifoinbGnb1Ym/rHyRON79KqenrHp7vLo1VqLdIESh14ojvAWFhrUPGWxs95R2laUniGMZTCJNjSLbQ3ezJnQhi4RJIMNUwZDDN/kAqF0k5GqEDHNrH1l0Xoqip4WRpIPhSCdoavoEcRmeZ8pZyk5U5AyQ86oSkM1Q+3Kv/fD8Z2zEFdpqEOoI+Oa6BNX3yCRnPSl6lTxEEzgrdzrLOdyB53Ggneu31IW0Yp6Tzxjdg29zcj1O1OwgluS0Xahhb0vVqyKdjMQdJCcadecoRw9bL0roER0kedSGdItPErIdk0NYYbkCpZDR+EBYbn3aULRt/BB66ggECZCZfeButCcCeyO/DWodrQ6Tk2MXIFZgzrZf1+vZdF50QgRsAFVtSMykuRUaSDvwFDXEdzfVVotwbNLudIvZz7t9QdyHlp8PSdm3dOlyBUD/gCh9bGDLcgVmC/MCND9+9w91CiLt3Qtu6tb5Ab3k9VAVbI+YYL14nM9d49QX7vFPl0vDBcM8ZLTQrhev6vC9XEti7j3F3Bv1WsfmRN+Oe5qTlUR7tC/eEDZtxsxj5jTNK3yqhuWfIRb427FkLngGN2oBxjSvnHdletQLfhAx0tXPRexHbirn6vBEAVfC9BmpGj34dHK96+V70UG15bHj+o5dtsiVcWdNs0pY5g8Iucba/zdVWjXv/fOPGbv/7v7G9rBLs5LpuDG7j8bTmuIF8R7zyNsH5cF1UB8uHaFhnRuVbVL4RePg1dUreAr5FL58vW9y0gI1UQDuHZndLxflaJC0+QI7X07Fab90MKJvftDkxTKdUAbA52DypgXN44Fej+kb8zBNozDCgiHDXBCtWYr4Tdu36+//+i7ksyPyL/d+CMnffEonZ4tskKwrwW02yTS/stXw3tYxcTDuqCUEg1L/YVMpBDgYivIlpn1EKMgpCczpJLYFRyUXnRv1cIup+Mn1RPF5YollBOLYED1cSgeF50baqBN4+OtXb7e6X54tXC2rWxFtcZ+4ClnVM/XEl0n8Epcpa65Xir7pkaWK9Zb8PTXAyD+0li07k0LjVgSDlSdnHItrSLeuG/nzllO3oZfnJBTsav+r0PdOF1eC0NoepLILC8MqH42jGLGtxPDU8++a++F67HY2BBm/lG8+stPf7W673ltO8oV+64Xdjin87ges6mGG7oDRf65ssnplwGGA9d/62Pn/+CfebHH3Dj1o/txYPDyXbzt+3bDFDvOCbl6//G1nTso8MYTZy9NmU4U5FQkOytVBvGMt2NBiFuh5+Tju9/JhTA/v3pOLq7OX//X7+TThTC//UKebdc7IoCZNSiSrKUOrdKkUpAY962ffvt//58fvu9dETBrRB7XXg/HU08y2t+ORyOfvnte82t/Fi9KUP1XPH1aoOu86Q7kBxaMm/zA9+FtCaZ77eQzU6agnFyeXvWC/VMKwLNlHXYy/j8p4KR/bS3cb4aFuonczTzdFjzFN3hkH1bUwJY+Qot0d7pn5DRNlbPT+lPeB6d6epMsP9TP+VBfyMXZu5l/lQbdYxnVR/R+NIxKXlINbze5mFkoA9Yvu4YHdoKIsoZ27OE1LCWxue+udVwGUYNL05TZL1O+d9jWevn3v3NHPABWJXQXXIYbft48Ah0o+1hrFLlu6pNGyVVAOJPKVCy5w3RT52BzG8DM7m7Oq4+89n4+TKzKx6Sc1ruhhRfQpzcey4ob0DnNl2otE2ZFTm836sg4xPJlRcUKTirVKZFiyVaFgpQsdo4miNRFDfXzmfzA0gOdpNEBabl30CVCvQMeUfavp3BFNwAoyKSBeYjsjh9nFH9pU6HndO5D8RFI50bhEF8iHIklQrYwx7gOWPVPcoRFpem8tMThieVtDd7O46Q9Wt2Y8AgS7GuzBiXAkI+7HJ6TT+UzdukMYD+TWWkA67wE74cktbJVzxGEiQHVuAQd7OLPCeW8V5jI9190AW5UucC8DSj7BjJhJNHGPeZMkE8XgwwlcQGyaPwqOsu2RGWO0PbNElagY0f0WrIIKS7+RYwdiu7s7QhofWuFOQexit4p0mG2wgeiFDoggXqRh/KaA0aQxIUTLAklb6TaUpV2+3QTcrpywV6KUHvjb10s3QLMFkD0i56Rqybe18ctDeV1V50HQ1zJeBcZ0ZkhEyHO1YUlZMxYthRabPRPccOpOIYff4KBsgwQqZkoOxNsmiz3npSN1WBXToFtvjyxPZWQuCoEm3j14KZ57KkyLCk4VcTViyYliGevb3+/lCu5XPZ3f4dkbtaAvr0NsB/tgP421nC/trgt3NPCrEGYECw+CFsXMSsnTAvo8UMOQ/+kQQ0CloVJ5HFXOgw5DPi6SBLQegCzqzx+WHG0wwJPHC5iRdyVVDvSk5jQwXYM5tTACC2Mlis5B5/OpbDviuVbfcJh9UPSEZSas9rEq0c38G5S4quWupwBziCt5hPsMC15mAmimSl6+CdxyQUQWHSguqaa0FTm9nUxa2CKyK3Yb5lfOENvpZDZQFyt68mhmS9Rf1whwgr3TKSW/0ilqwWg5A3jQE4DsJPOMkwx9opqYv5ODgaMV/N/lHCFwSW4DlELcVehb449CxEz3/0BC+Hj9a5DvkbslRgOCF1IzOyBnskvYE03TBZOukxkliuZsYEIRTg2uNeCLrhLIluSs3FsTGwqtoMIso2wIXWSXgANhFGbyxwAsGf8Ch/27tZe2f19Gzx2+zTLQph2OltsiT51aeDz5BC1fpIU5N7jFQhQLCmn5BbEBfq1QwuYWbuntq+3GwlgT5KfTrRRw87Pck6HlN16tDm9Gp9TEC/8WIjz6lVNKyXcsAy05ete2lOQw6ATKexCtKIQd26EKzz4wG1QE4/WIbW7H+1o/TxtTj/NdbQmp5OnFgzGd82wMzc34z1DmMAMvt3Zvbpzduqoe+cvWpS5qbt3Llot1eMwkDv4eMVAvt3j+PPdWxartcFxtmwaf1RH5SAx79gE/nHU4xhzbp3DWAn1LgWtZaeOnrlTmPU8A7OWj+AloQ1LMvEwwtcGN9zVUlIS1eo04tX5IHmw11ogI+cSyRLyXye//uUv5Nnl+ensB3LOtGFiVTC9htSlwvdi4XIl0esCjXnCXLTs0uMI2+y+OBAxpiSyVXEs/9Puah+C6sY4i3y0ps/3uS6JC/uv8n5rhj+Hqc9nSkVfmfR9pBjlsarTtSbygaas0H4EIhXRLGOcKs+eLNu0dyhx73p/epW755qlx6w0Uo+U/2QPQmlFbNXF3F9yvDyLUzF2151bI2Qa1uy/wUjkPumchWC4gVpaRtpvypQKMzCg47JxSy3Vigr250hUtcA7ClMX+4CVrp+pgeVeMtWbS4pU9eeNHc69Fr7El69d1IhqfguUm3VCFZBcQSozJmhvwl2NPc2oYSCMvjM8ntNjzvaSPupkfelHyJEOrr0631vGlVNlXDGk/VTH2eoRix0FZjOFoy4hBUUNpPNoQWUj58MynzfliJXzbKbkhqVV8bDwPZrnPEiqnYMRiv/YZ60p0/YLOPtJsvRIs6yGDLX+zG5gmr3NQ13k5IZ57/m6LbgPlICrhM6YTcHvK3nCrZOZaj+qZUKveibqZVQnsVJNtJHKc3xLLQND3Wjfu2+d2G993z/7jKUph+NxuXduvKl8rmd7a3zvID5Xtsc4znRnYbRahSGxK72zz0nOqd0y+z5LRUAkapcPWfldKOQR9MkJEXSq0i3fSm3IO5qsmRhQ6VKKxDm+a6/1J+Ei/XMFln1Y+cgXOdMn5DKlOfns/sfLR6kUPu/0H93Hk6zpBqzkxIEq8rUAtSOuBqHOpdBQSlT9yal2vnP3m+Pwy1ADL7GUFSurQAo/fV+XbxhnOaUjQN0foA+hOOpUpK7LE67BrH3Gy9LSjSJGVjcMDy/TRBVC9Oqx+nn18njPsy8jNZBjFyjOg4aJvxGUbJlI5VYTnUPCliyxnzzvyxMMcbLdC2Kn5/HuY27IM1cRFkSyf4ac6/KH2mqRQrh3/BJWNNmRT7pZ+LbywGbtRNro0bV2hCMo7AOvfV3VclBcrpo7ZPZF7Kx4VQegJ/u/kWnq0nm6y9ecNr5APVSd14vXPTN2M+w9aOE3B0z2OHG9Q1MNEb7B9F7yutdu6sNVQLuzOY7BrnIYNPdmH5Dpt6GzQ/0FKe5OfnZpAzFbAg5muLkpp7BkItjqHXNyVf0ymg8UHXToDkoUQ8K2N8C0xL/YjLGy2WLPPdRSGqhNWdmwjaHJOjtyCfz9qG7BSUc7qm8HSpOXBRPxOohFvRt2yi6pEPfx7GFS9bQdty2+jPY+vb+na2cHNe7bdwfqnKryTNk/P99PZbtmnVLqxN4Oq8v64PdJ0zPRe5b4shZS7fA2/F91TsW/31kxpgTSrKJeiud9T5Ndln996ajfMbdHE4k6syrrrY/PavAUzEEYJfNDWEcqi0XHuDDpjIcxrbYNd6QjOIw+u+O49/BMZjkVu+o+umvn2ul7fWUDyj5DcyaWsl8ooPoGO0foDv7R0iJLZFvArYq+/IoVI/Cm4HxH/l5QzpYMUnLu8p69cbAXyhYW80TKG/ZITvcvsCB+/L3+TPmQNB+92uzeHZ4XxoncB7Ywvfuuf6iGCF12gjna2+RPyMdd7qe+txzYxfE7OLx5CpbzqMVkW7AtBm+IUN/rvrK1bTDHMNVVwmUTnbcs5lKV1n7nYv5wObDltVo5kY9TuRY5bh+ikaWwI99puS9hKimRJJEmKDuO3Q+SU9NvmkzEnOqY3v4aYRXS6SNTLhSPuM01qhF3pVJG54WKZQ2p0dSg5nQVT6fck47+PDVJRw1/bJIOpx6BscCtAeFEq/jKiaUf7TRXgt5aQStUJrZE5Yc4Ri5hg+d+dMM68epl+O+zAOFl+I8Q19Rn9qccVH90XpjOI3rP/WTqznNnca21WutMJw0N0axKxcQSlBrwu3bnfZR51QX/O5e+1zx7BJBlXeJlbRt6rpRza0vUK9UzxNGO32vvt7fH7qOLIFb1P/0ndAO0hht+snwN6jj2CCuzh4inZ2eu9eMP5MyN3w8NlDlSsZSBdT4DFZp/QiMKc6Q4L6C6jmsLWdtwO+j3ulYpenSn2Z+HWiXvXxqlf7fJNfuz31rDbpB4ysV/viYCVtIwv4H5muqBDlA6OXZZodpW+sGHmwvarUbrANUJcGmdsbJwepl/0x+QotnqGBkVzfpGVdfDj4ONli03YVoX0YVOR9kFS+FZ6x7mQ3EIQSlUG2hnU+rc87UdnFw75/QYdzpKhERVGTx4kZ9du9DO8ceoxj0PA3l/7jmCcZiFas3nG8wXve1SDYbsXjDp3B49WkQv06ixCLMbCBo1UnGD7/btSuoPkuOtvxDt/HVSkYvr0/98NyMz+06R92Kg+8oeLVIm9SFoP25lP1rHhpI1JDf6ICPyNCaMW4Osr+lcVa+zKhHmwkBDC8I9FxyRckGxTlHIRxByPY6qKsig0uAwG2qKo3X4rKPcUM5SfxB7QLQZ4dGqWo8xQrdiN7DTbbYd6eSXAaSRaa+NyfWcuR60KKTdVmIsSEKfwG1iK1FmvkjFzO6OG5XILEOtEzcRt8cRDEL9KfhbpoC3Nc3YJpYtp2Ku9WM1vLUjex7+Jcy2zNHqRetTjee5ZMcIq+4D7BEQh8CB6tcG3LImaypEp3AGdrmpMKoDMuCzPVLZ5uphCT0Pv1yeXoV372Vr+OpBMVK1bf/Ra7YxfTPfSF5gLcBp2cdZhD43VWfssp1vIZjR5JkHoX9w1TpcYm/ZUbdFnjjQvbPhBRI3uwxYPwlmQrjASTPpYAPKRQosC04SKRLIjVWUr/0eDpRX2G4xua9feKuwly20LdBcKkOkXd+3/3HaF4Lbu+yxz51Uq+MHWLYTDBom1gX1xU56C8X87fX72cWMvKO3GRNp1da7f1vt3I4ehtloojgwrTCNzuzGplWJT/0pi9HDs32W43x5vITNx07CL6eMLnY0jGWBK1+chyq9AcUoQn68TXnkWgHljLP/9nnDVWKOSLuSZOzb7ewlVoV+pOjG0K7aafGVUzfzyb3PiS56QtSpJv+qjZJi9e8LTpMbzrSB9F9fhr89rz5lYglJ/0dLpmBLea8gQxe89htCRUq0JAPHUsGKaaN2VrM/JrPIqVmHYv0VBtLG0AHpjFLHgukToX2+ViJVrQp5JU9WyEGYWkxKFQUslWEC6jeg/4w3kDQD79+4w+9jM0p65I39j/fXtS+270jvOi4Zh5M11euTRCU/t+2tk5fq3zun7uzD2c+vyFuq12Wc+F1Aeo/vEAMgxCqvVMPvZAGmbRZJYUkLbuZuCX4nS8o72dl3wH8n04KD44c5VZqJlV9hu9R6p7lctSvM97Ek0tSkPVvqfGN8nSeAtf+c+lRi15nUMZ5nH07PLz5d/9C/7E1kN4Z1XqBYuDhVGTlNboTcckhXQD7WxxoBhbZQjcdpDEBfwFMUDNfOwFslq7TsL6OQeloZRQL19rQagGSgG1nlw5C6nSb3cDo9XSci6Yn5GAXQ55knkU5LyOFteOBHwaxU36wjQvlbgxmOYOnjmrGwnHsYzSKUI1iyTrh9LCSWtKs1NQFGJ8Z1D2KoQNAkEJalua48kEiRavLCFZ53RXIgJZqJBFwZtGYbuDGcHWsribNcriiXo09eEFid+P/+t+/eyT8Z5/Tlryd/+W4CQMvUO6okibOY/sWoFQwbgdGNKSWxnq066WEEgvKdYYnu8/5GgvLRmZi9f7mRuauLRegZ6LTrEso9UHsKeLCXnK6a4Dzoqe8dFvfyLoVZQxUdQZG/eDIPTJ6jCUYfnSiSFM6n56WfUHEjz11NCiX5JIRojGFfkm8ae7Df75h/SaR9q4E584vTqSM8hky13QsoyD4wfUMuYQOTdk4nFOmV/thqGHo6e+6z9YkdU0DqbBIpGGfdCNXRVoX94iTgWMLFPRlFb/QIApZ2hMgIJETOVQdkprGv4JmLrjGcli6/e6kO7ke9Qz4GmqEiLQThPQ4FityQ0BhzHB8Wy3K0pyoT7sv9/dki4bFrZRRbrUCRnBoDSmjHobydMrkBk1JDfc+HBdXw2y8ERCIbfaynTWDksYyxpFUtqZS89C2qp+JDe8U9sEkPeJGysQXqCdqYCsJSno5BJ7LHGxLtqHk0141BxgGN2usOXxZ37lktY86ONQWSWeOZPXycWfA0TzV+FGaNdrOabUymHSKzzpXsZNZFQvTR19c0MpE8dAkQzDBailLN+s3T4A4UhsZYwdZQg7AWVKRblnai4yOh+o8O+TEkAtK5KjrVPyJhuTo9I18LqqgwTICFZsWJD0Xw3U5G2I0QQQUYMuMuJgjtCyoGRo+zlRZOg8AwEmkEmN6SILHguBHqdXmmokIQTgOY+4imi55wVRLJExLq3l7DtOc4oZx3g1gigTmjnIOaiEMpBmoOSK+eZenBpUvO/FgERPrCh8GWsXZTGXo3e4TEEebOr673+SHT1q23WANBeVg6gw3DQmKTZ2ehWO3ku5akysnsWGrgWZf+MBYQRlEu6JgQ/qDzc+ZHIFenH6cdHzSD/1lPRtMoDESbcD1tYZphxQJaU40kGdXxNEYZxrNcUdNp0BgLjhRLtiqUv+R2HLYoJm3bciUXfxwDVKsJ2xiiTlksJEiNccYAoZkkmnhceejgZph09Zcrc5vL7YhS8jBW1ED38b9Ic6xhXL05J5FAVTk6Z61R7oKDx5yur99WGS8TmdOaas3GRMiHbZwnP+0Q9efpEjxPbenfmOYYStarNdAUFJIT4e3HjzPytjXCMBqeysUfiOxAuKq9gVtO20BXc2U+Gnb0IFRf2JKFUcoC/lNQySLFDBg7swNMDl1zcAqNZb7xYKaF3CSSF9nwojzo4n9+fzEjZ80BRoBkGRVYR/nygpy1BhhFUgi0ML7rq3czB6Y5xggc++654FEstaz5tLaHGkNmGQTrb2YcCZtTsn0lp5IjlRXIJiF0xkskaKW3rhyGZDKdiMoo2s3YjYTry+kbl+i+tzkr0EYxt3JTuKXXP1OmqcpGnMEPAunV7vL1na7y+i8i6nZ+AF/izoXXuDfZv/pT8Lmy2TjYPs+uyFmz8OoIkG6jLRJLEi+E0b5jtFcVJl7GQhiaj1hMHwJqX777NM/JmVGccLnShGotE+9qcd7gewV0e8gbdMSfY2FN2HL47EVCe3bx5joW3pSjH4fzy1k0tAJ9cc+voq1tX5et6Hh9oEokxMtuOd7IcJfLWFhZjn4WLmbRzoIeMT1GQnt9/TYeWvRze319GQvtlqIfWyvRxULbaqOCgRYWZMm4ARUDdF4gSTGzT63WnMMY1B22g4cB8cpNrRXJZDuCYoYllCPKevtdLQcjVk0Uqyl6RKetAYll4Giv2MQQ6kTxxhefCqrx+LUHbeC1zKD+vQlwNoBmUvz8epIVMaXQrUkWCcO5o03EpCiPlBqqqBjJS3sgFkOJo+/sCApyqcyEm5V2iyfEQzRlWVKh7whAOzT85dxKwFMjztJuLwYSaR3uc2N8XgSTord1STREYRDSGmUE1gY3nOMcXGzQ9DCOFDZMmL6yPpEQvT11YyRALoQBtaTJ1IC8FDZ4RqWwUNPsJOk6yeeZ7gsRjgHl7dmMvJuaPp7a7UK7YVUNLlZu1hREaHlZWksd5NTGKKNYuFypMW58eLD3OdM3VoBeMbEiahpf5jncGtUut0Ei7djljDjyvVWEhkHJZKCvdjRUSyZWoHLFhLHDFa6pcWvQEXwZZSIxiru46p7CRCSSoH/x5jqM5kK4SXOsiQBHuVRcfBP5VQUPM0a3A6412AR4CMG6DlWIG54SVb0Hg/cG1jFNlHIrVKXHCPmQBXR7B2LlqroP2IHy0yT+MnZGugOdt36w9BZnDQOqYGOZpFDVYOHlXDdxTVwwJF/ZuWt8Zo+WszmlTPswRJfQ0mxmP4LNzNG8tIfKP/ZXZqkkVmpLLy7SGG8MHGqgQh3b5DCFVJsjaEJ7YOm9tSIHEFP76ICb+LJrs6QZ6ymnGR3X+2vSGmoM1Xrb21wdAdfbL6Q11F24uu0Y8ICpaTZ0xzPA6A2esaSHZWifOjQJntR4D3nrmE19lozUR9vM99f32sy7TG8Pki1qsCab4bTBy0CrA7q+niTsaKOPdxG1XJotVd1OLGP4CmF1GCtWoqrGNZh+xJB8Bel07VibosDa20+f9p2e6mAvZtNje1M0dM5U9mnKiQOaS55g+eBen87eX4ayFq24rnFEeCJFA9I0YQJ8W0ecJfqyBtdQY1//gzBdDgkpkYoIOWXZqt6TSOu272051YoPueypSB3nYFnS+8LiXCbOtTsxFwJ03tMKj0RaqOtZK1t0EiCXtLSUCimBxKL62BliGNDtyM49CMg7yjh5fZusqVhBKDV9fnVNFOhcCg2ECr0FRTRMDCWAQOubgZu7SmS6bMGKtN9hGBcu1B1rDB7DUjVdQPzfCqpSV0ddsRTCeK40jDY0m1CAZUkzPc9p0am7TeKwlqoY96mgfKeZL8/0jgq6cvWsqsICswaGEbx/4nlaHFgH9E9Q5DK4XD5MMs4vEwOZxipwV89+eB2aM5Dr66tJuNAEozqqSfKRq72Og+Xq4yxU22uNMgKGgzdR4iD66Ou/GlBV+4lQD2Lnq/0sfY+Iic+s/daa6jVaqZg3YYDJKoGf3FjNiggOPbd+021o2Bb3PaZp591+FdGkcTkjquAw0Zjh4SAaGPerM00XcF0xVvYNsxIADqhTYZjOaeaEtmYXkjFcW6pSSJdYtkWf9hSU2/14E6B9TbHemL+fT3lPFM0A7whVifTdcUYgAaRM3/S1SKwDe5ggowBcoEeHzAguiaR/vLGCM9SP0DQ0803CCz324j0wxtSVFdswZQrKSRgrNLacgFDTDaiUYRXOfnN9StoDDIPZeqtnXzvQSHi+wILkSt7ugoF1IhdfUQNbOqxVHBrD8DdPl7C8zpfIbDaTr0vRykemTsCo6g0U2ggfpkNCJtVucmVl11wDq6SF69LgG2xMEQfW9EWu2HBxyQdheXtKZoq5Ts9TkMwRu468PZ1a/3NN53ge7Len5MMkd/WailSv6Q1aJZZL8rYzxAgarPpQrsuXE4GIXJJUbgWXNJ2sgawXqZgroBrLKvoWqDILoMZhI62hhnGx1Rox9eVtSZ4s6UKxhOgiy+gUZWQtsSJs3kptpr0WjGK6RTa/ETZBaGVJlif1mghxgdQ8RjPX0Nh7ki7O3s2md8iyGNGqZ3rBKH8QODyh25WT3uWOK9wTV9lMGkmivAKzleqGGEWXS5b0jTeMTcx1znBW7GJ2/fqMMLGQhUjJ9exiCpzEodegGOUCSQq4CKMQP8xk2btsWIqFKpi63r27no7FvkrjeXoPtuWUQ/lGTXxanl4t6h3Ta3+xH2aySY4JrDZR5YlnrqnJJN7ga5tjWVDeK7ZigrqiAyE01w3s23hXhqXKOTIFcDv6MirgD8BdxMU9gjzxsm4OArOhnKUZRbI/21fo3elZpXy6eN0wKHn/aQqLjR/YX67TlKB+hvhE73FMNK0OjxYBzX/6H+9DBjRQlUwoW3rDsEq7uSJzDfKDIDgVI9kph7sPL0+v7CsvMyZWe4lFkMXOwARLBadCFsPc+2G4ZGG8rHIALqBY3mEXWdWkPwyDJSA0zDlDa4X4jt6yrMhqxQ5qHk5vDbOi+6VHMgXyGNSH1VQMNtaQavEBvIRALhtDjiATSIzK3cMG+REQIxX5YvZ5nQBFJnREzDzw8bi0VC3Ldq01yWw2O6/VLpyCCin591Kuput4Tr7CwRFqBU1J3+Nyi2jjeeMtO51BBuGgSUGOJWY0me7YySi3isI8pZ3++iQSs7F3OgwDKWkMdDcstNoMPbDuV+Eko6JAkq/fWdI0MYWa7NfJqDagUm3QztY7N0L9dAXOtJbaeHk7K7hhOQciguWlUhAmnURLX6sEVUfwozRUhdosXFutNdUPnAmkrMjwGY4fZ2owdwbD/uQHoQk+tcI+CCEr0jnYmJ7WqDoDvc7Q7LtVTIAdZmJt3fC6IRYk9tzHDzNRJ8MsC+Oq006NJc9WmUFLU3A9hCsJ2uebSMX+hLSs177k0rXgtAzYxYEaH+4x5aShnTJv4Jp4umSK1lJudnbx4vz6uj3GCBbBjFQv8OIU3gLlZk3e+YEm1tEpYeFdwBasaZXAsxyrbEzFpd7Nrv9zAhC9Quw0GQr7kFlZ+ftqoh8gM0hlFt/RW58ykTFX8ZF8EsyQz9Pi8fDO9rTDLLBiXF0/rXt0+BOA2fUntPm4AjMlmkXAdo7ZSP0KtmXYkQz2/VZuyii0ZqhndGQtA8zEcwRb1DZEFljoQDT5xntMmI1/AqrJzX8EbDWXWIVMYUuuuTT3WJ9bY48hkrDkLVUG1IbymsmqMjba4Wuy+MkEwEtEqfdK7vtZTnxyhWRY9mPXBOiqQX8QhuQpKruq/JHXEyMTLSBEJlXhaXGqacYIyVNUTlWha49yByJMPlVhKpnVVBYheYrHsPbn6j5cy0JCMtq+5ym5vl90ieTpNlcSydZmAX2BBXnjU09mSk6LZ5Riy7AyRk/JktOVy/kSqe/IyXzg1+mMMB3GnpyPLnNQqBWV3ufg63n7ri5TohstJtROj3tM07s8YhaQ2eO59iayiawUt35MB9Xk+iOyMHgRcu8LMy0uThYGL8zForhHiEtOtYYU3+zrx5lq9rXf3mJpfU6jSr165QaSKr1fXVe8xrgzatZELgmXMvfNwWrt6XzYSVIoZnYhMnsCVsDK9v1yekVkbljG/gx9fGEKv7LfmgsrVOPA+jy7cmMQIe/TiD5fUw2vEHOfHC43yEQumq8lasjCrEF/GAaW8DlTMgE9TUHOJWfJDk/Jmzn6E9W7XErEIrZ2Z6TkUw+JHGk7/6DtuZQrUuRc0pSAUlKRaXlw9lsLGIufeFhcdVgdl1gQfC5GkuaIo+BgJB4PAxpMCdDLlVwAonX8kombym8ws4NVhvJJ4JK6rTYqsk8fLks1pj3OXYAMG7mDUViTHeF+/UnylirWhvUwLuWJTzS9BijzDVb86SH24AAKMRWzXCSfpHovVIjvSwA17YH5akfcjIXnPSgE9eqafC1Am7KB6dQaEV8LqvTNSMj5g5bo7wVVVBgmgNhBCNzmnIqJ0tvXQhoKtwlAitW292LpR3GhNgsAQTrjjcPL6HCJlsNDncsIXo+Nci63kJIXdcM6WzpG9mJBdfmRC4R2H/jgaP/ZxIngXZO/u0lMCy1xUAo9st2HL6rHUegDVtJ99MPd8BVNmVyg9X3/YMmTxaS27w4KlpTvgUyR8QOMhEsNI1nEUdAQy/q8aTKM5/5XyVVh/zgZrO9/hZVE2IN2u2bJmpTD3hs0VvO0KhTEg7EDTX1VFN2OxvE+8BpsfZTs/cBgRRxUcCbdh2STpsDRlgYSYBtIAwdrjjQMCrEYwikHZSbXQFABP87Vu/b1aW5gVxUI7Y54JzbkIp1jIO9TtFNhyUwhyrZmXLVPppq2hEtQivICq5VqrVdv31gjwDI51ifr4LRLS5bMZrN71QD3aLYmH1WGH8goHDIXeWBfpEIT2qhPTBpjj0C1OjRmwqizvEyTHhV8xUTi9KvpUOy3MU3P7y9m5TAT7YoKdMGRQgArS3h7lGE0aBWTLJaZw/JqYqcfpfWwA/Fh4l6DdXOijQKxcinhzqE+pRWL0lrObwDJZ/7h9Pzi0zW5vn5PqPFdpabLeQUHREGv4DAxTcsCQbz7Fsi0i68TKgSWAFNr+O+HIe/eXU94UCyo0bfkcK26BDLtudCJxNqjWiHx92Uh8evGcMOogv/1KGpUZ7ARWEIzwzZoyK73AziDeNVrtNaAdBpMrOooV6dnDuXkfA0NwiDqV9d2de6lW2n4igXlawEigcnRa76UEtIZr8IGdNVrqT7YHaBGykg9VJe6T3zfHY2oHqYHn5flUd/8/fyKSDWpFosGl2UyR6vo5ulPMl0ELFg2xS+n5/eEY4ocqYNCiePajjGxc4KGDeA9Itdt6sM41jQHlSqZq2STWl6FLNgGdqhknrv/Cwjug9RybTykdaZ9KMocFMvtr/FgnlfYLNIcLIc4ECie1vkx1N3xg7mRyTOPdYJ/xP/KnsvjIvTe/nBeg09nKlp7No+P1o56P6RMrHxAFRaDbkH1g01j1U71RXo2mtL16eyiPdwIrD8xHg/fE8ESv0d1KrzEC5dvMVkCwqqQ04xwvW9ZTy3uciA+DN1VWc627jqU93TEaXGn4zAeyge5DLXIQK9zqgCrG/geqyt20RpqGBhuodtJgfxaJXhd0kMF5XvE8muV4DZIb0OaaDHVKkHN5AmwJrdF1yrBbO4d4Ext6q1VgtvUO+BZU5WGbr3TunoHYIiJPF1kE/N43ElHbOvdOeiTO3prleBJgAHWNA+OVglmt+yAZWqjbIsGrVF2wDKtR7ZFcpRjff/22FoleB2nA6pPk9oWao15jK/Ppp5htCPzH1RD1YnzGsw05URz2ixkGRXT9fUlOZ1YKFNrPl7B84E22nOHpjnEGJg7oiKioGmNMQzHUMSExr1jzdWokEK/9EW+pqhuZqxbWwSxdWKhem0oWsHCf/nLq5OfbsvFaZQNHcODdXhO04yJUDG/OcwoGqyaGVNLZWjDDFYL7dPCyLLLghuGGMVWK5gUl6WLxR+A1a8u2ENaQ4xhwaxLd9bIvr0uFi/eudGm+heLRVtsjArv9HPfEGNw8KIeLuWqM8AIEp2zhMmROxYr9KEaaWr0w9beB8REvKo8XQjXvFfeud6JBLWiz8c1uEHKKmSuQK6pKtBORIh3zCp8Lm3pAHS6QAyUDNUoWkMMokF8g02rsYhclpUIjQH1nLAlEVLAc/tFUbrnJiygWSugiCGcXy7Or8MgE2Oo8HbT1SkLlknYTLJJYjEN/ywaObXPu5HIbW/TWv+5Q3vfGmmwHD0fLWmSueDziUBCxAImntqz5Aeb8B4ZRRNAD+lIONVrP9YkPdgoKlKG1b786vSjG0FzWqWoTsOEVifNlZp2I3j9f/IqhTmgNaS8uq7azzt0/B7onMh/ZA1jCq4CEi4MQmerN4zDfrkKKItzT4muMoUQwLHOl1fe/RjTds/Dib9GTSSTFwZPJGgAmsgK0MAE/W8ajALJQektGq0UnE8XU1G56vSFBoXZyfGTqOEri21NbelYjLV0fFhdD7m1OIo857vmMMNgFPcsg6XD6fsPa6n+4bLkSlOufgWIM6wghxqixiBjmFBP0x7P5DOkEHlSDc/ESzdWpiCSreOTds0SJwiVFs18KdW4ov4gWPueX1VZ54krZTJUF0sZXBTkuBxU6KW02JFPH9/dDXBDkcTespzOlKicDc3x2oLsgUzsDYKra7b1yynd10tE8wwaymhUYJ9bwFpj3Q0O0evRxjbR8/GkSkVhRv4eBsgFzqAlpH8uuABFF4xbBqUTKsKIE53lqDENn6fGMGyw6kOVWzZFKdkwhWUi/2xJT90R+10sndEDuTgnzwrBvhbgRyOuFz5bMlATguw3kuVzRG+HSzzPJxca3ORYp3d2Vf/aJCRe5cTBczHTkJDPuSAfvWI7kQHlAte34twqweZt16y1BsPA1HAx34cd8g9vJhuUNwUXCVbboiZzPqMGVpOMyxYUGgdoYJqiO1o0iI9qA89EFrlFM6p9/nI5bVG2/GtBOVo+nsXRHmAMDGrQgAUzOWRgs803nOKd3y8z8vny9GrSLm2RWth/eVgL+y0VMjc0zxGdoqdX5H29zvppnvOq9M4krXqL1Wj/i2+0v5IHrh7Qmy3kbIO0ckBvyBfIyYVghvkF++w6vt0N7ZYWZo1Ypva/TguzvleR2tvScIsJ6JOGqfUTbtHSu8s8vf/q5Qzd/ygRhb7HJ1Xc/knrsZMbUFvFTPAz/VMbdncBU1jSgpu587z/TpaUNzp7jczGLmIpS3UaMpPtGhR4u1i4NVVZWeliuiA96cxPaXqPybQP7x1TcX/Wv9f+Ug7rULezModHHxq/b4j9IJlus6CxEcZPfGNXPq6ZdiXymPYVXY0kCc1NEdZf0e2+qfGaGpLIDLSdtMvq65zQS7ki55DItHW8q4l4Wp3Lceh0SrouBqWvt/xDCQfAyKsflly7NU+kMCCMC0xiQhsqTAlD92LsCfOZAjDtGti66JjH5Gq9UxPSJWlZw4KsmdGEkiswX5gRli2F3T/pHI1qsnotC54SARtQZAHVucup0kDegaG+DOhSyaw21LNLudIvZzS5AaN/6JA/ZwoSw3fPiQm4KfkAnln4Ey5qME96F5LDpqPUTlnJHhGhsZLnkCvwvj6LJIUlE5ASKbiDZeiCA8lo3o8q06tukEvMExj2uGwSfHH+ky9b5m98ZTPx34JbmhjC5crvV/cVc7NjTpzwp8V9z25HTpVhScGpcr8PG3syeDI6pA86KX0no0N5+KQMbsnmuHvy6v/uyfie9JTPi7QhD7u+cvHHvDfX8Mmg6zZTeBLQFPS6zZ8ENrtsWPf/YcicMyvrFiR4EuBokTIzTzjtNMx5EvCgJw3/SQBbJ12H9pMAxsRhwHAlppJzPN2TlgI9hHvgLtsSII2pQw3INX16Zu2LpVnAounIIR0h4WFaREsO6VC/Q4sYXsUeP8IRVlHUrCq9y+eXqzPNSMtHelbw3suXHEOsDk7hvTu4mn/4066p1J5JkdjHgRr51DXbAXazYbjssL66Z3aYqrtoeSAv5Yq83oAwZbGFQqSgrAqiIDCqztSX7BZSosFYIo0fN8fQwwpLuQkd2g9WWKpN6JC+16b0mdFj25cOO5ided1jTe63BmvZidZFOJdvpTZ1FsnbJ1KDSJ2vxn+o+45NzYb07axvJ+xoyup2fjS4sBezzS/1dMre695e3M7sjfxWF3fzG/by/vY/d3l7fMcIvKHNF7whrW4tSwklK7YBURnJvl1BwC7RYfYLXA0kfYrC37fh0Rg0aMh8N1ed4vkx9rruPHQb7Oa92LlVfu2HJjN3kZ4Ha7ahrssrSWiXgyyAADNrUOTThTA//UakIm+4pObnV8T3lAyd/hqN/++Y9yHi7jc8b+cGxVM+I9gXknZ0YFSAY9pxOfI3b2CQaktViibU1Thabdr1lbyYfW7Ie5Qo4LQbIah9zQ//iAbYociuO6naL579f6nYirm+Tv43TWnljnXAkr9GAiMuZp9/61mCAL+zEg9fggpRd5VjvD77g9oVHA99fdZAU1BH8V2/dUORi/OHeEk93rqz1JE5zFf6pI1sPJmj29loKWhd7AUtd1Gs6nImOXexht8iA7ar9wgxN/bMMU0Sv3SQWqQNQfVSdgNVhxf6CWp8WbJ4KqJqJrULdsukj9ftzL7sGMk00SzL+S7sk/2yS+sFmqyJZimQZ38hZq0K8urXX38gW6qJBhDVKCMr8SSE1wkroXMpNOAtRfLNnApXWrWyKVTp5/Yq614K5BldyA3UFoOJ3sjKkr1po4Bmg/cn+WaOzSMvFaSsaMtpMRbquz7JsTIssCVh5h/Fq7/89FftWfrL3DHQEvQ/OrP5h9UHL+kOFHlFXouE5roIxZ+sSnkvvt5H/YHOj57Yyr5Rfn5F/s1O9zn5+WfybySRysrLvgiSH/Q5+V/c/G/7RaZJc1G+691CIVN4srqu2MI8oZwvaHKDKwF7cEIad22o8XqFXUQQaS6ZME41abdTKYG6wzEHpTodFqLLgzqHhFHuEDuk2khlJWux81KH/WBDOUv9wegDRchSFiK1LwwHB56JVRCO7gxebN6IDuUYvsBwHUbcRgO7sOOSpk/lnQtwfPOlDIxiSY/WEVTh+pedLuyf+5IJ22efmr1EK5fltp2Qt3Jrt6arczJBpLLKmJHkBiC/Y9GexIv3jSyakgloPd+wdJ5ieV1fl5xnBQIUNe6Su0JXNb2wrF1ycd60vYseEwfLmFW7na/cLYafRbjqF+dEWW6tnUHFLRpVKzDV1+5cCa2Qgp4efSV8JNz4SigUV1CX8V+cl7bXD65bwb7GpgL30C52Q4zS/lM6Yr4Bx0vZb1bnvFOu7X9McIdmHbH/SchmPf0KY553d+vsGxDOennqSq0lPCH/PTyMnr0sWafNwBF89HZUqxzNzk5nQfZNqLDLw7Jcqr4Ggi5x8dsKgyiehvnjk3+qnCLe30Cmo8oX+5/sFXYv5zjN/IS8+vU3snXrngEVhHLebytwRn0nJu3tR2QLCjxZaggHqg2RopUu0lzERxcTv+1F7LmrGG7bsHZfpErdwrmoJkjWQnK52rUdcUumeip9/kqSNVU0MX4R7aXeOfzOaC5IIUJMD2/YzAczamMndHtHPaYTYcR36TSKzAqZUpRuBEW3gzzNcdaWWEkTJ7F6H4UINgeZJIUqKWpDRUpVSoRUGeXsz774Xqmy3vVJQ5TDwUski0XnSbrXIu1RV2BecrYEN+MeBV9DIkU6IGDvt3uuDaadZWRCro5LzsH0HoBBIyp1ArxRrMUGa/lmyjzSQb62Y/ce56Gj3DyZg8cvk8K0+0s9tJJA2gmQeHDRA5E+0sK/FinGsluSf0qBXW1hhC3a0UsR04fXfmyvcIdFod3oU2Lg1oTLV1awLNGlY3FgPfv70MO2Axprmvs0vUSqFFK8dzAE2YRnSlcjljJGGWlTfbHuX+++VkpmJ45q4ZLydQKCKia9WJ8V3LAXhoEitFaDal/LJqOCrvpScwnhzr1T6oselMeqCTPfayK3wnvGDM3ytmUwIHb1pJXsBh8xo0myZla7kSnoE/Ku0MapSXWivtXWQFwuNXDgJo0ysOXS4t7AMSQht8nlgH7tFCxBgUj8gaBWtE7ZhqVWsml2NaqW0jKy65KRfWwtXv8kb3OmjjbD/X56X9CtPYnM8J2frLZMz8prFpQ7oOO20YibPmjCeW65ccXPTjpDVuFksojNgbKOIPdQitX6x74qToL8WkBxtKPkeny5U7Tnj1uqiQORDpwbB+6n2IsaUShoLCgCT1tlBuH1XWUYWPM5AtR8jiE95zFZUZPoq+hUEWSl2ivyOCpkS33sfWM6z+W93pxD2eZdfO0QZ8H+gWhVQ4htCOrt5/FwwVoXHNvtNKBFycIkMoOXHkOlvLiobNkthE1F2W2krkAOHBDYgOpWIj7SxMrRQxJgzbMzZvLBTV7s1A70r3SV6eJKllPtHbBLtld8+qVb78wZqqkSZGX8aKaeDahMjCzdJ0yUJqo0OFl6cfc3fkDbhM9NLb2uCUpF3l+H0Fimy4CAtl3NjV/u0FCWpM6lZhEZx6Sz5dRpkfoKUy6Uv7y7g1V4Cm7meKWL7smKRJGBYsl9eVHv3I6QxTYysXomW3UzPFvy97sztdArhd3Nt+Tij0eoXlO6dmW3f34dGH4ueGe5Q9OHEWCe02PWqvuueyFD1n+9BbOTxsrYYiENoWQdKl70B9ByuZqXgSqPwtTLg3hvpn6MmikN3rcvRe7ZR7/gLzlLdti3Z4QvzByAUFxb8N0AXy44Ztx0/wJ+KDg0S6fXIbmSx7fYEmsF6EJ4e92+HipNU23/5R5VyktAfQVg7nickzUVK5gL2GLzgiHHJWxrrn4nhBij2KIwUOMQ3Rh97aFbab3+/PWzDp3TaMyuWjnXcPj4N8cpgu34otD9uCa/9Si3LgPMLlhZcFDvY77UBtQJuQa/KYUGdUJX4Ep5h0j3pVQlhg7tkoyX2xPfItb/vla3QiqyUHKrXeM//9ekbCxt1a7BetIX6YwqE9tMVxGObVEJd0p2skOPdackTyuxEetKyRyCQxHrLT4VhHJQpoouUvtBw9+8eyuwj1oRABeE1CMwp0RI8UJBDk6TGYt+6GvoiFtHv1DKXphKX3E76eS4l8x72Er3T2dmW2bWQVj2vJ6cuwEXLttEECle+LYuIy+BE1LmPYIj4rxpzRn40gGwIOWSWO5gGOgTcr3nKe3GBvXMKhzEZz6dr9BWifEpoz7YJg3sNyw8LZtz+gM51EPV/YRpu5MhJzrYN6zg6z4dFoGOLv20WrWRblkmPKHs+7sUL4vy3KEgVGuZMGcvtbvRq0+6DbtkN/A7oSRf7zRLKCcp0zfPSa5cT5TnBEzyfb+gTBU9JPfyng+9z7NRNAMDSpOcalfFS7tCDr4WQSKzzHIx2XDad1NrwCSj4p5/Dx5L4qvtIcLD5Nl3IrO86N5BhG2jZMtEKrchnjaRIoHcPK8iKQYXozPNZcH5zreXc8bP1De09VxD1AbicuDpqls9Y4lLI1O3IuElEzeQhlygMhCdamedCgqK/eS7CtoJS8c2jneqQqCyunpnJ2+WaAMo4b2/fixc7/NgeSXX3XI9ldMZVMbajZ2wTaxhTIfWn/9xSfvnyJK2b9x/rCm/caNV11hBWiRASs8R9JvbNChG+bznNUV7RK7dkKXY3H4faw+gfWEG7QKQ3OiDSg7EsBiH0e1Dt6Z6Xd1QKxb2ZBkWydpH/pY5NlWa4VlJqVUizE6kGuZEq8T+qvr/bqYpsfxcEOZi7gqRcKDK/skVwttDCwmEwdqpysTOu70Pnvn1dAR80i9WIrMFE1Xd7PqDFdJG1T1eL9f0+tiWvro00m013rD4HcdB2nMlzvzovibjsKXUa3DopvFq+byV+eKcXHlO8ywUbiC+215I+rXYfuiXq70B+jFs+TXz88W5W9KQ8laxia71oOmR82GAfgon/hBZXrBlul9J3egdZi37plc3JGh7cWHUji288n3EU2OX/qwauN4VlAxIsrHsc3dIshbYK5HuJdoTcubzM0O9U+4/GJdmHUDV/MZP3wVz3KIwVeamNNVjVAjXItUZfPyDspVkQxWjC97JAvRFGZggOacDjECD0Kj1URobWhdV/cgnllNZCaPML2R2n69fXszaMjQJJWO9RWEoL/vAhoKTcyH3nhYPklwIQ67ZSlDHLAaOaC4VZvHa7zv8yx7SWSm7SVfV0f2nBVK7y+6UpbLn4Fy9/0iYSHiRgmVnoZGt/fkJefb6lmY5h9/JzBtEPFnHvU/67SLOM3d036YzTu2fln5kTN9YkfsAXPdIxauZMa/C0/CB6ZsRl6tRbLUChdfCrn/JPtd9AQGDk07XCvRa8tSeHq+rD3Qabbjej2BZ6PreA1d+9sHLGD9UxTguzvvTSCZ75xOZ5fMjx125XQmxV66Nq7fv6WLxwsKRwuWnLl27GZkWyZCWFsTSR4oaqyOvuKVUrvKA5eslvoEucVSlW6oeJ0KvW1XfclcaHiI7iYHSyM8sE6XkHU3Kesr9wq1lQUfVY6R4UQqoapwLeV0zelNrBVRHjw3WhpoiluBc2aMo44+mdtjBF/KWsPTl8PtlX9biGAgtok+dwsf+LlgU/Ve3fMeQu+91Dvl5t+/eIc8ZE7KI5eOs5ZHoVfQ7ZTlpTKNDxyL7S2TC2JUZG0filHPL94gukgS0XhacvLbjk0SmoO2RKIv99msWTKRwG3kBONPmMMnzgbzFDexUMVWCWIBy/s2MKsZdBE+PBc/738WKULeIL+xve2cmEM6hXPjiQo8kEYfRybMqnjMHpfOQdOs5TGfJgoiwD4gvKzz9MJBk6M1c3fcYO6DEC19VkFewVflv2w8pE5qkYCjjPUaGhSxM7XcDU5P86LGZpcWWVnFsDsfwQ2ogyzlaNM8pSWFJgwsoVL4sffghWtNKxRtQnO5cIpeR4XElz3pupP3Aad3h17Ass8C9rV4bZgpXmJH0TmyvG3QLNj30ukb1YtXsOwmNjRSBVyUyy+x9wjlGZ546YbVg31zJDUu9/aysIpeBHgyESmVyuKPx/tayN4zvpcakHpfXLxrc5i7o6XF4fTk6Lq//Qy4OtDsdPL3/IxfBAdN/u3KGVzj33AUU+52/nl2Qi45AVYeBVrU2ZJeMI4iY2FVlw66iKtL3sYeF2Op+4d6ziPlCptgZX52Mu7bQEbAQi2VAPFrHr5bgXQZHyDyvmYBD6rAPoK38IWzF0sqVM2DEy2JrjZ008Agvfzwhr5p3XmA+U2V379knXz2ndES5YI1bSIq6FcGHfi2gL721rMI0FrhxBENIr1U8bRpEquxKuqGM064jg1SmcOLyK5eg1ECnBX+HDrH1x/O7BWUlCwWgvAO2M6UQbqDZ6mSAI7JsvijSdBfdPsOyedQ8oBrdQsNhhc5HrVTxKSomI1Y5aKXYzXVxjIQEpuvRq77mKi1SZqrMun1dtICor7HdPmPDs5K9e2F8kj5KLPYKbo6mlZ99fk2ehVyJzwW3svKCcZfA4eLAXt/mUttv/kBedA0Nou2FuRFyKxqKkIakcMUsNk3qA502E3oEE1w7LPSszHK/CqlJl7CiyY58GlTXOFso+hhJ+WHgxhIzQTLKxFLRDEbDMXKqXNde/DoJDeFy5oYlVzL1wdH7soC1qLMeUOQO6cuFCtiFwNKQmnXjrmBL3hbCqZLvZAqcPGNic/Ljc8Jk8pws7L/A/osKynea6ZMf+/2LJsnnS047nfNjy1BNCf9sRtygztbl+OSubH4ll6OFGoxERer/ugg4yzIIGpQ9yL2ANllcvttC9vndF6qAfPQBwD/++Pndl9MPr3/80cfcbqiibPBMbqW6iZmyfOcF+1IOWPewDRrBqIgtRIScnbhVSqrngCb2udghqDBLqUBolsRkIDVTEgLiLL4VpMc/EIvofEtZtznxg60DrvZ5bKL2+sROUdfFAulSmEWqjYqd+e7ytdEMYvW3NNo7WuZ84BlJD0122TcG64g0Idlkn/cS8l0siSUbNDSVU0UzxB461d5qRD3TbKf39DPlg+sJ3t9wYcEH+f9Dd9S9yOw7/z3KEUtrNvoAZBTkoxyO0o87hk/KIwRtNXa2ppc+M1VEexll5+pk/uDMbp2Te7dnuixZzY7hD3NJX0vKuF3rspjLLPCMi/N6bpurxGXVQQOrnhIGw1GFZcz13IqIB8znkMBrF24dso/OZJYVom2J6qAThxVueii6K7g1f4N+mbrCpg+TrB+K7ZqK9D9kv9dsj81Qww7hDA9G1x24AU4XOmcJk9GiRI+lwTv0W6pE1+nw1KFrkeVzicWMr6/ezch7b0fdB6X2A/l61FCC679fkq8FqIHarQUXcwXtSp24wQ01g+iOfCiTznrDuiopPYn4kNaJythtBCzR/CDD0V1UTY9z7MF00/gNGiinKkPYLUsWwbxA84gJyBXRIo3WlbZBM261qwbplJq2VPhQugsQyTqjKlZaSUV3l9NO++IHe59o0gmnikJzvo5+FhJYxk2gqggvV67UEgJZufgDgWpOo3fC8BWnoh8v53Sfs9gPTqjcloEVPaODFnOauMYo8dNPLG0tIirvNcKLVb75RdyadfT3PRHzxKh5qqPWXa9Rt5QP8zxNILzhNDrHEHMQKyYiJkV2SWPERov5cq63zCTR+YeYL7ncaprFj12p0xZmg0cdweuSiDkTmOyEiRxUtthFC3jv0M6TGxziG8oxzgrL57mSRs7ju6Qc9c0vc2dxjE+bo91NLlfzFGOxLeH48W+JmGf0dm5MLLNBk7A90RwQHoWMCSTQTOCBzrme8wWfx3aLNmj/BZF49MrgNdqxayHWacfO6q3T/hWR9m+ItP8Zkfa/INL+Kw5tI3NOF4DBUirq8dUzMc8K7oTvxQ7hnSyJ5zcIcklWcLbKchzp20qZlK9iByEFygxDKNHwNYlvGxFz7QMSEXZQqwRHm7SEcbRJvdNFjtCLNBFVWjWKqmqksaoH3CKwECONVcywaDu1BoV4IditoEJqSBAO4eY3uypIj8LmN5mbNdAUwawms3yecAQbtiWM4CRxdNViZ+KbRS1ljUI5L+YIPo1EMcMSyhESiPScrkAku4hRV3XagvLdn5AuMHBv5q4MKAplXw4GB7UPrEWhvljlm99wbNB6vmDmryiFxhI9j9srrkVYyeisWqNcc0cVEhU/y017G3+0Xls1wmDW3s4f3zjiiTuxD4W4ryYfr4JcjfaSccDQYfR8ibGJbBkzObtJGEM20HOWuyDFOQqrY/nml1SbvFPMPxJtrRIU2pwtAUON0c7QnEHKoiWMNmkzgXNKMpkWHHQiMVY7EGcrBN4kc72lJmrP/xr1vgjyKIQVrJg2isa3hOxpI0h8CnKspVZoa61dJXKFxF99ZL4/4gjUjQKaIQiSPhUICzaecL1dS6bnvsNsfOo7qijKAU8HEmFjUN74/vax6TJtqIje5zjVZlGoWM0CS6rgewVhUC2iY40vR5c5ybHJus4Ny/jNrg+tNDBGc0XTNPYdYGlst2pZOgjhLWLZPFFSZihViSxhBDWNZXOc4MhQ8QhjmfOb6OWZch2/ZCnLda5YZKKcGmaK6NFnnAmIV2JnT1VH7ahT0XXJt/HNWlz6qqfzJZfRn/OKOELIv9V5o3MdSxSB41gdGgFq9NgELlcoR1esUC5wLv9/9r7uyY0byfP9/gqsH07ShIayZY/3xuedjd7u9rhvWnKvWrInNiaiAqwCixihgBKAIpv+6y+QQH2jSDYbKEp7Nw8TVpNMJL4S+flLGVqAFcsqj3HNCqrSGGKhUFEObIw+EJxoAFcKTje4DLcA0KEz/izV0Ol4fLsNbYFEqSgTtgF0cEtUhNeMhKR54unH9WS6W05k+DerTGxT3uBkg3ambsnaFq9RDlmEwk3XEye0MHBkQ0uDMrGOpODsYqXMh0m6DlXnPyJNHkoaPBBQElnkEnM9wtwNQXkbhXD4p9cikX34MOgCGoCwFHmCVRmwYUCXtMShqUqCWQz9TpIU1sGijkYiHn6RDeWwEK4dykJmETgO78hUEXzDyvqGI+QDKBI6EcA2PI5gnCjyKfwB8AG0BqMawZRSNI8geFUZ2sumZBrjHsg0C65IK5n6UHEDENbhWmx1aVYqOKrmJuWhCyW83WKfStSCdIaevs51+GNliYaP6DU9PUPT3ZXB0VqrbBklD72SLMJbWCkik4yGrnqP0raijgzFWAadKo2L0N7gTUK50ngVQTPYUKljqOGbkkeAbtJCVjykm9UHi+ZBFL2otEDvKo5GQzfZIxGb5f2KGc3QpSQZ1egSy8yhGSqAf/ezYztnRVylqQ6hQAaa6CPAN0gFQ75SnSYfgvJ4K3ddlEzsyKix4MH1W4kqGKj3kWfMrKH1GUG/M0ly8oAKPARaaGOxPK+GzUCiM8moguYM9ehu6wFACamqLIXUaAw8itB2jTWiGpWSrKaOwhPSch/ThMK38M7qaFhAlDtk9wlcaEZ57I78HVbNaF0+FdIiJ3pN5KL9vlqLavSiIcTJhsimHZEWqMRSEfSGaAwdwe1dxc0SPL8VuXp1Z8teX6Ar1+LrJdJrT5ciAAN+R1zrY2Cbo7dE/0Y1J8q/z+NDHWXxVtCyu7lFMLidrCJYpusF5dTLH/TcnQFfeyA+oRcGJEO8Yrji0Os3r6CPaw3i7gdwH+C175lTfDjuZk4NCLfrXzxh7JuNSALWNB2HvArDovfkQcOtmHIXzNGNekIgtY3r3kKHas4mOl4Cem7EduCAn6uIRpJ8qojSe0C7T89WfjxWvlUZoC2PHdVK7KFHqsk77btT9vFkOYLYWO/vgNCufvDOPGTv/8P9Dc1gN1e1UICx/WcDrIZwSbyPPMLmcVliRZBN1264QaNb1eyS+8V5+OVNK/iGcyEtfL13GRHCCilCoN0Z3t+vSmKucDpDe98RwrQdmoPa2x6atJLQAW0f0yWRBbXqxlxMt0Paxhx0QxnJCWJkQxjCStGc241r+/X7jz5AMp9RfsP4e0768iydng1nFaefKjJsk4j9l6/D72mIiad1Qak1GprZC5kKzgnkVqAt1espQYGQpzKk0dglOam86NGmhVlOkCfNE8VETlPMkOFgwvQBLs7LHQw10abxfGtXrnfKz14nnW0rBlmtoR94zChWyVpEtwmsEdeYa9BLpW1qZKRitwWPHw8A2UtjuIU3zTViSRnBcnHBlDCGeO++XUGwHP3sfrFAF3zX/GtEXYMtr7hGOFukoigrTaRfDEdx45uJxTPPvhruBfRY7G0I1f+oXn/9zZ+N7XvV2Y56xb7ysu3OaRI2Ynas4wbviET/2vjk1CvHBjDnv/Wh63/in3ne8tw79Xv348Tk5UOy7dmwYYoZZ4He/vL+2sydSGKdJ+AvzahKJSkxT3dGq3TqGRvmgiBYoZfo/Zsf0A3X375+iW7eXl3//Qf04Ybr779Dz7frHeKE6jWRKF0L5VqlCSlJquFb33z/7//y4pl3RYheR5Rxw/UAmboosL8dj4p8+h55ze/tWbypmfJf8ezzYrormw5wfiJg3NEPvI/fgWLaWie/UqkrzNDtxVsvs78LTuL5sk47Gf8lOFn419aw+8WIUJjIYeEJW/A5vsF79iHHmmzxGVqkw+m+QxdZJsFPa0+5j53m6U2L8tQ451NjITeXb+7sqzQZHiuwmjH60XMqWU3Vvd3o5s6wMuH9Mmt4YieIIGtoxp5ew1oTS2x3rXkFRIddnGXUfBmzNmDb6eXvf+dmPADGJIQLLtwNv+ofgRErba51FL3u2CcNo7eOwzshdSOSR0I3gwAbbADVu8OSV8289nY+lOf1Y1JP683UwnPisxvn8uI67sDyxUqJlBqV0/qNRjoOMnJZYp6TRWM6pYKvaF5JkqHlDmgSnkHWkF/OlCdCD4yKRie0Ze+gqwh4Byyg7t8t4QruAJCkEJokLrM7fJ5R+KXNuEpwYlPxI5AutYxDfBXhSKwiVAuzGNchFv5JGWFRcZbUnrh4avnQgjfzWAxH6zoTzqDBXus1kZxo9H5XkpfoQ/2M3YID7Ft0VzvARi/BL1OaWt2qZwZlYsI0rpl2fvGXCDPmVSbK9ouQ4IYlJOZtiDRvIOVaIKXhMaccfbiZFCgpJMhGk1fBRbYhKsoIbd8MYUlU6IxeQzZCiYt9EUOnooO/PQK3trVCwgjPg3eKBJ6N8hFRC53QQK3Kg1knAMNRCukEK4TRT0JusczGfboRusgh2UsibG78A+TSLYneEsL9qmdg1MTHxriFxqwbqrPMIICMh8yI0Qwpd3mukJZQUG3Ekmux4Z/ihmE+Rxz/CAdlnSDScVGOJth3WbaRlI2xYHMwYPsvT+hIJUkBhWATDg/uuIg9lpqmFcMSAV40qpl4fv3ww63IxWrl7/5O0kSvSfTt7TH73gxob2OH72vDt2H3otJrwrVLFp9kW1UhkROOS+ixQ06z/kEROcmwqHQq5l1pN+Q0w/dVmhKlJngG5PHTwNFOSzwBvpBRcXMhd8hTmDDibQ7h1OORDHg0UgkCfKoU3LwrRm75lMPmh2ikKPVntQmHRzfxbmJkUUuhZoBRkjXzcX6YgT5MOVJUVx75iaC4gDgR7aiusUI4E6V5XfSaUInElrdbZhdO4wfBRTGRVws9ORS1EPXzKhFGuac8M/JHSNUsAEY/UUbQhWNsMVqGY5y9vJmYvZOTCePN/M+SrjC5BPcuayHsKvjm6FmIkPXuT1gIm6937+o1Qq/EdELoUsSsHvBMfknWeENFBdplKopSioJOZCiSuZm75njJoIhshS7380b5phE7EZkcctjTOpGXgR6HQZvLnMCgZ/yGv9i723ll2/s2eezaMsuK62E5W2iNPoMy8CQ9xaw/SguC9zgnnEia1lOCBYFEv2FqAdVreGp9vd2QY3aRfrNQWk4HP+s5nQK7dbY5vd4/J6de2LEizstrmjZGuKYFUUauW21PkpJMBpHcLgQDhTi4EQA8+MRtkEcerVOwu892tL49bk7fJCpYk9Ojp+YcxodmOJobzLgVCEcIgy93dq8Pzk7Ounf2ogWZmzy8c8GwVOcRIAfkeCNAvtzj+O3hLQvV2mCeLTtOPspZJUjIO3aE/Jj1OIac2+gwNko9lKAN/NTBK3cqvU4KotfiDFES3PMkI8uG+9rkhgOWkhRRvU57ojrvBHP+WsPInnMZyRPy98Wfvv4aPb+9urh7ga6o0pTnFVVrkkEpvJcXJnIRHRdoXyQMsmVXlg+3zfDFiYwxKSJ7FffVf5pd9XHQ3BjwyAdr+vyY65JC2n9T99tx/AFPvpgp5j6Y9DZTDLNQ6HSDibzDGa2UHQEJiRQtKMPSiicjNs0dSuFd95dXwT1XNJsTaaSbKf/BHITaizjAxWwvebw6iwu+765DWMNVGnb8v85JBJ+MzoJz3JBOWUbmd2UKGTMxYBSygaUWMsec/r4nq5rHOwrHLvYJK909UxPLvaLSW0saCfXnJzMcvBYW4stiF/Wymn8mmOl1iiVBpSSZKCjH3oK7jni6w5oSrtXB9HiG55ztLT7rZC30IykjHVxzdZ4ZwVViqQEMqZ3qfrE6I9iREzbHSNQVyYjEmmRJsKSyPefDCJ+f6hGb4NmdFBuaNeBh7nu4LJnTVEcHw4H/mGetr9P6FZx2kjSbaZbNkA7rT+8mpultHgqZkxtqo+froeI+AQHXKJ0hm4I/VvMkD6AzdX7UqYTOPRO1OiporFghpYW0Et9QK4jGMNoz+NbCfOuZf/YFzTJG5pNyb2C8Y+WcZ3s7cu8kOVe3x5hnundutA7CEN/V0dmXqGTYbJl5n4VEhKdyV055+SEVcgZ78ogMOtnYlj8LpdEbnK4pnzDpMhxJcnw1XOsPHDL9S0mM+DD6kQU5Uwt0m+ES/Qr/sPpRJritO/3H+PFEa7whRnNiBEv0qSJyhwCDUJWCK1JrVP7iVDPfBH4zj7x0GHipoSxpjQLJ7fQtLt80n/WUZmC1PUDvHDjqsZxCl6e4DrPhGa+hpXsgRsY2dA8vVUhWnHvtWPWyeXls5NnCSE3U2DmKibMw428ERlvKM7FVSJUkpSuamk9e+uoEXZ7s+IKY6Vl+25wb9BwQYQlP22cIQpcvOquFKg7v+C3JcbpDH1Qf+LaJwBbDQtrg2bVmhBkM9onXvmtqAStQqwaHzLyIoxVvcAA81f+9SlMo5xkvX3/a8RXqKXReq157Zgwz9B4095sTJjtPXu/UVF2Gr3O917LuGqY+jQI6ns08DrsmYNDfmzYh027DaIf8gBSHi5+hbCBkS8DJCjeYckZWlDtfPQgnQPUrcDkBOgjcnVQoFom31gEzUP9CC8bGZxt77g5LaQKbsvFha43TdTEzBH47Kiw4GllH3e2I0uRlSXm4DmJB74aZMhQVxn08PUKqW7YD22JhtNvyfk/XzhHXcd++A1yXWNZnyvz5ZTuV7ZqOoNSRuR3GlrXJ70dNTwfvWWJhLYTcxdvwH1WJ+V8OIsbUjPRR1Gv13Pc0mWX58RVQPzC3s6lEo1nVeOv7ZzV5ChLCtRTlKaIjE9Vy5Fw46oy7MY21TQ6UIwCPtrpj3nt4KYoS811zH+HaQTt9a69siDTPUEL5SviVAqw+xq4ROiA/BlZkzdmWxEVFX32KlSPwU8XYDv1nhRldUZKhK6h7ts5BLytbskxSIT7SMwXdfyNLZMdv7WfMprT54GizbTi8rDSo3Ce2MD181981Q7guO84dbX3yC/R+V9qpt54Dszh2B6c3T5JVEhRMdsC24cE6IuQz5YOtHTIzh6uuUS773FnPYilk7e2HEPO724kt72DlBD5O9VqUcfsQ7VkKM/JBz33NphQikibSZ8qMY/YDlVj7XZMpT7AKGe3vEJaunD4w5UqygNvcoRpwVxpjNKlkKG9Ih6YiMsF5OJuyJR38eeqTDpr+2CftTn0EwUIeNOGgWoU3Tgz9YKe5UfTWkgxSZUJrVHaIOWoJezL3PQwL6tUr99+XjoVX7j9cXpPP7Y8Zkf7sPDedM0bP7WS6wXPwuHZarY2mk7mGaMakonxFpJyIu47nPcu8uor/waX3umdnYLLGJV51tsFzpSCsLaJeKc8Qsx2/axu3N8fuPWQQy+6f/kbGCVrTDT9puSZyHn+E0dldxtPzS2j9+AJdwvh+1ojUM4GlTKzzJZGu+SfpZWHuAeclUUPHnYXsbLgZ9JnqIEXv3Wn6+6leycdDo/h3G93T3/3eGvoxkky5+ds14iQXmtoNLNdYTXSAUuncsEKdrbSDTzcXNFsdrQPUKMFlcMZq4PS6/safkKJoPkdFRR/fqOl6+H6y0bKRJlSpKrjSCZQhWSqet+5pMRTgkEgZ1Qc62pSu9Lw2g6N7CE7vk06zZEg0yOAuivz8HlI79z9GHel5GpOPl557eJwWoUqxZBPzRR+GVJ0j28tMlpijh6vgMI0qFmH6kTiLOhK4wVdtu5LugwSy9TukIF4nJLq5v/jbmzt0Z94p9Auf6L7SchupkvoUbt9vhZ9bEEPpmqQf1UlO5OOEcFwMMl/TuQavs4EIgzRQ14KwlYJ7tFwi6QgU8gxKruWjQQWZNBqAZ411NVuHzy6XG8xoZg+ih4mhIJwN1XqfIIQV+0h2aii2A538OoE0MO211qVKKPSgjUIatjLGgqT4M7hNNOd15YuQVO8O3KhUFEVUnLgj+bZ8OIeQvwR/SyVhQ0sztItlyzBPlDpXw1szspXhv7nZ1jVaXm5tqXFSCjpHWrWPYcsBAg6AKb81AMuarjHnI+CM2HBTblRgZCJmOxNsc/OwuJ6Hv91evHXv3qvB8M2DooUc+v6DY7ZR9THZCFbFWoCLuo8zd31ums7YdTvfilOt0HPLhHoBaB1Q2Ft31B2QR8C0dzasiiTNbh2vHzjVLl1g0S862BAJmQKriqFU8JSU2hjK93YPJ+AVttuY0tcuvDHY6xbahtFSSI2EWd+f/+PCl4LrXfbQ507IfP4Ey2GBQc/FusQW7MQLFPPX61/ubu7QG/xQUJ41bb3922rmNnsaZq+J4sS03DRGs9s3rUZ98pcsBk/PtlWOyWq+gs1zF+HXU46udvScZU4q31w5lF7HxV4O2XybcmasgHrGxX/7uuGmMIdnY00y9O0Gf4kxoc+U3ejaVYMV3wR1C1vc+xKpypOijhX6UWkpeP6XJcPpR0aVJtmPr9zfXjafUr4iqf+jFZVki5lXkcFL1vkNwjxDSqCJYylJTpWWO2PZzyksSqzXDqy/4QENeRgxCU6pudi0hdC2XisVsoNC3uiTDeeE605OSs23a8i4aLqpLQaXf5r3Kb4zssIV0wnciR/QCrNeKXJvSv0M/red5Ii6U2TbMr4tW9MSr1Y0hUYCS0I4EkvAjegAejX7ovAjJjO82AemMr71jcvYcM0jq5OFig2TNCFRJN6igiiFc4dLlAojv6GBmU+RvBU5uiKpyCbCPo5WcB+VxXwOmMA0YHhOaQRFmOZFEytEudKY65oNv42v6UmPeDZ+p7yqONxDaqxbbeuc2vYEaG1sW+iw+xvVnChV7/7hLgicbIjsAlSUWCqC3hCNQVN3NbfNUM9vRa5e3dmk2hcj8lcuHaxVKzB6R6ywsCecd9icQJIhmygunKdFmwuVx1We3R6/cff85uobF3CxsG+tdQ2YAA841YiJ3O7XGNcGZgedrN1pge+pft8h83u3sYvJkzEifdJJ8Z2MEeXpkzK5JZt59+T1/9+T/XtiRo2zIU+7vmL5z8SLdfXZcLeJFSp9GmuSxMyKffqyxbr/T+MMbL94BfdPYw5XGdUJ4FF/juz1DafPiLF1wI66QRmj/DTG4mpMteT4fE9aRk5qFht32VaEZLGLQKbDFl3YRAskSbKRHjJSEp5mRQz0kBH1A1bE9CrOX2c+bIzrXT67XKNpBlo+5FnBRy9fOoda7aIDjRotm/m7P+36Ru2l4Kl5HLAWn7tlOyFuAKQuojjsru6lGcYmv3Tu863IXVtXV8UAWHLGBJHECarR1Ff0gWRIEei02/txfww1bbDUmzCi/WSDpdmEEelHbcrYExjev3TawRzN6xFr8rg1CAixsOdc/lznlboTyYYnUhHeIA8zkSvfsen4kL6c9aWnHLDRjyYX9uZu812LBzhx3YeLO5q9Fl/q4m6+j7283/+/u7yRa5/cGg/lgnWkdb1lGcIopxvCGyfZl6sImCU6zX8R1wLJPkfl78uIaEw6NES5SyT5FGGvu8FD2GCYtwPzu3aYYndwkV46b7bGtsI6xWMJsiR18uiHG66/+R4JiX5iAutvX/fTvFLBVzSv5HR+SzvvU9TdL3jeEAb9XMsmwTKeATNjKjumrib60h0MQm6xzKIpdfs71VuF5NeevoeRJAyPU9MstKp7RB3bDgwTTqpqUT6EpDnlmNW/6WsrB9Yhlv61JzHi5u7X7z1LgLxosijAEjQcjVc5xOvTHtSx4njq67MmOItYXt8z7WAodHP1lCip5bcbLAUyp8VKP2snG0uT6H423OTgtooWXBRjulwKxgA39UsUwGb1zpBzY84cVSi1S1e3h+soqrdi3M5ieqE/Q4uvSJefi6paCKXrwr3lbrRpTScuQ1DRomQ7t0/my5DMTHC6RopmBD3/Gum1rNDrP/3pBdpi10qoHmXPSnwWyusRK+H66kRbivSLORW2qUrtU2hwV81VVl4K6Dleig3pLAb1l+jU4k1pSXAxeX/SL+bYnHmpSEZPAk04tFBf+TTHxrFAV4jqGvcHRPorCxNaMz1uZ/UPBPUiOyLRa3TNU1yqiuEGrOxRct1H/YnBD09upW+Ub1+jfzPTfYm+/Rb9G0qFNPqyxRyom6n9T6b/t/kiVai/KH74Cy4y8tnaunxLkhQztsTpx/ilTxnhQtet0cCuMItY17yAaTLVlQ4OR3QwIzgyALiNGXBs+9hrIY1mzXdW6zAfdMAofEwhtBIVz8wLw6AhgwJEgOOSF/s3YkQ5RCzQXYc9YaOJXdgxgbPP5Z1z7CBFf4dmlJKmHqvDmcLdL4MtbJ/7WgibZx/rVqMVq3rbFuhnsTVbM7Y5KUdCGmNMC/SRkPLAon0WL94Xsmi2MUWyidnw/LqWPNCWyvan5tCJv2MXbqiElqk3V33fO/e4OLo93WEx7CzcVb+5QtJIawUOlXFvkcnu/81KRKtnPvtK9PuRTOTLRQkFjQV/C371DtDwmx7NqSTYNQKaEJTmf3Ug5gsIvLiRElUyGhu95LM15xWNVQj7xBTp00Cjjj3vcOvMG1B3BHKnrrZa3BPy3yPCaMXLqF3QLDF6aAEkJLq7vLhzum+KuVkeWpRCDjVeBE/kF5cGUX0e7o8P9qkCQ9zX6haNTfmq/UlrsFs9ByzzBXr9p+/RFta9IJgjzJjfV1BXP69Q6z9CWyKJJYs1YgQrjQQflIv0F/HsauKXvYieuxojbOvW7jchM1g4yGoi6ZoLJvLdMBC3onKkxSL0J5SuscSptotIAL7IcGE7uKOKu5we1vOZT1bUhi7otoH6mEGEfd0WjEVRGCVT8DqMIPF2UqaBZB2olTgFjdXGKLjzOYg0rWRNUWnMMywzxIUsMKO/+/J7hSy865O5LIeTl+i4Xnh7FqnlumHmFaMrAjP2GPiKpIJnEwp2u92J0jMA2vsmRHkqipIR7T0Ak05UDAr8NNC00ljqMx3kezO29zhPHeX+yZw8foXgwZGQs1GCxJNBD3h2poW/5lmMZTckfxf8TOg59ei1imnTa98PV3gkoqLd6AsEzbhdC3IHh1tzl+3LA/Ps71MP227YCvzpJCVJhcxIFu8ddEk27plSzYi1jlFn2jRf7MbXx6+VFMUCqFZQlK9SwrGkwqr1RcU0/aOmRCJclqyufmmxbArMce4rzUWIQXinthctU5ZXhah+ppDYchsZ07goh55Bx3HdNWl8+7RC6Zoa60ZkRC3Qm0ppMJO6RC161kReLtbkxE3aK8BWK8P3hsyhCcEm1wPatbNN03hqDwQ2qnVGNzQzmg2cB78gu68F2fvB4vkn+VBSOdsM2/20saAHcxKpZjs7WWWEntHXDFNwQPf7RgNu+gG071qeLUZDtuhqVWgJVARvxdmsf+irAhrkp4pUsx0lc7rtKWrl4xZD29OqC8DVZbME5kK1emgWNaBS0FvQCDItL3SE1zcvYvBaJhFYLZMY2nMZUhT1iYZq9dFSjaArdV6R85iQA/PR+8aMnstHvTmnis1Dcu2UYEH7QAzQEEI7gnA6UuJDKNaqYmcCzReVTkVBXlkeGuPFNXAZnRDM3RL0DMiJA0I2RFIdGxp0Cn3aje6KAKdakw5cPjM3brOvdFPpYqhB3Mm2um8NH792a4M5U5gqTleOn83k2YDGxUizUWfYphOsl29fF5mIm/Br30rvWoJCol/uXWosVXVCwNCvBuPXOzRVJalKoWhAwXHU2QJzmmctunBzdydReCqmk3jQRY8URbwqiKTpY2WRd24zdX4+opKtuRlWLNn7PZrahvAM+iQflFti+c8zoNfUoV0x7k7bZSx+LfhouaEf8F7GrKSPiVX31WQnWCdmnJdrjZvcYi40wk0nNX8CLRN5UieqnEWo1wfx0UJ9DsyUnuz7K6RbAWr1GPa7UfwFo+lujm47E3LhDhhw4Nqc7SbkcsVi5k37F/Bd5cD//eJUcE0eYmusDUM3bauAuroqy5T5P3hUMasZ8gHAHHic0zXmOUk42caWBVOBS7LthPpBCdFa0mWlSUdCjHP0lWXdaOvd52+iKXGJgwm7ZuXYqEPHLDcHDMFhfpFlpqu/eYxbqAAzC1YDDqo250tuiFyge2I3pVJELnBOAMrbZbqvhKx5GNGuyVi9PYXfI/v7Dm6FkGgpxdZ8Vv81rfs4GrNrEk/6JrvDUod20zWEQ3tU3J0So+rQue6UYFnbgzTSlRIlcQHFWG/xBUeYEamb7CLZDur+ZsNbTnx0QAAgCcmjMGeIC/5HSUoClsy+7Ic5+qL0cfR93VCsHveK2ghbHf4Zzcw11WhlPbqCAZdQbcKR4H/MhfnvPS8BKCmJR3GMOG/cCQa+AgYMk2KFoMM8JWqB7luZMmxs0K2sisPxpS3nq5QxYmzJqE22yZz4bbqZpKxSuj6Q7h+jbYKfUGV20tVEO/+GUXzh02kVaHbtx94wv0VvYZniKWXPDhlehssr4AJhpURKwV9qdsNrT8KG3dKP5IdOI0NoXPgSlRJ6orxERKfP/IoyljhUw+oDQSwYimgiFSqxAhQvBUAOrpu0KAojxUQvaD8urSE63avu2ffgXBpfZw8jPExWfKeiKKvxHYywbRhtKc/E1uXTum6TL5tMisnFGE1zVTG2Q58qzKzzMxMFpq4RL8y7HoiJiaer6/WM1MB+1BqO8o8kc7VAdSI6VuCdcgaK+eSrhrUFzfZtHBuhQkQVdd3OTtYtMWSgZu+X+3Px9UvpPK/ofgzX0wSdiSzosLFTbBerG7PTJm+/pv1tYE17RVn8O95M+ScYrbnGkmRVSlAdOSJ+d5vtqZ94XtNoj8h9r43/8H3sPIDmhZn0C5D0ozoJciCEx9iNbh66NVbr5oYatdBTZVila5v5W9fYNGWGlzWlAUSYmUgzzELJ1Pyq+fe40hQZec4RhZy7iqeMYGn+BEB4LWuugLDu/FoXdh6OPljhV41xnj7rFysVxbJp37vqPViubFQ+4vXaUFmpuT19XW0EGJj2+M0TIPVciUs7usVknPaUWgtuvsa11st8c+VacKPnDrih7k1pi34Nby/8erV1QJ+rwb9zP99cdfu7NmJi7D3oR+RsGqCdwsIeIiMLtlT5jdSN2sXEsu9HdV2BtlUX9vqxuTW+Z253fNkMjG6uDmqyofxzBzRZw9hrnrUa7QJd2vpMh3fK7Af7tVlgUPa/8c1Xzh23rHRTuSl08xhVnBFlV0bYB2Ur0AZLipdsVAVoQRkoRyXDE4JAEa6i4qP0NrSrqtqRF0ZSGQ2jri+kZp/vX93cDXVo5CBjrUdhqi77xIaCR9dCtpEWyyS64Rrd05xjEBYTR7QUMiZ47bOR/DKH9K7W3QSgOsJ/GkY6dxlOWSY8B+ftL+8R5SmrMmLEmWtka36+QM+vH3BRMvIDurMOEUsWpPfC7xeByNzssU1wTrVPi58zqj4alfsEvh5RitdxY751T8M7qj7uCblqSfOcyHgt7PxL9ms3FuB4AO10LYlaC5aZ02Nt9YlOo73Q+wyehXHs3Unl5++sjvGiAeO4ufKXkRwdnU9FUSYz513BrrjcK2jjav17qlr+0bAjONSnrqDdjMiqdMpKc2rpmbLGupw30lJIQB4wcr3mb6JLHJbZFsvzZOiNUfWNdMXuITKTmIBGfm6EKEZvcFrjKfuVWyOCZrVjBP9jraDK/VLI2prBm1pLglXw3GClsa5CKc6NPwpTdjazwwy+FA+IZq+m3y/zslZzcGg4+jACPrZ3wXDhv7r1Oxa5+97okF+N++6d8pxRLqpQMc5OHYnKg98pI0lDOh1GHtnvAhOOjczYOxIXjBm5h1SVpkSpVcXQtRkfpSIjyhyJGuzXb1lQnpGHwAvAqNKnaZ5PlC0wMJhismZiSSTENwssKYMMHo8Hz8bfeY4wLOIfzW+9M+MRzqFYWnChM2nEbnT0vMnnLIlUpSu6tRJmtGRORWgT4muEpxcTRYbWzTV+j2MnlFjlq0nycr4q+23zIaZcoYxoTJnHybAUle78bmJqgs2em1l7bHGTxwZ8TD+kmhQli5bNc4EyssIuBOSQL+sYvsvWNFrxhkiGd1DIpYV7XNFzz400H4DV7X5NVnUVuPXVK011BcCMyDux1jYYAzY99boGjWJ1/DspDs1pBFmViqIw9ynOMbq01BHtJPuWUmxoZv1nNYpcQdRkIlQm0tMDjY/3lv1EWas1pt28PL9q8FBC0tN5ZH09elxZ/0+xPNHvdPL0/o9YugCM/3aVNB5w7hUkFNudv7+7QTcjharLRjTUWlddsp+DgIVdTTVsHtSQfow/zOVW+5V7KyKSpchiV3yNKu6GSofjBRleJtSjdXi0BBsymKHyvOMCdqXDNoG2iYfQnGZNKGfCiVeEthpHZeABXv5wSl4z77KK+UzV3b3vPlj0nDoQBckaDyStul4Em/q1JL7y1hqFaV/ixgyOEK9XPOs7RJrqSrzBlOFxIAM1rnAE9ZUrIuVEpwV7h07x9YeLuzljpXAAUDYAO5qSSzdQNF9MSERaJMsqy3bB/TO0SILWAXXoVoqcBnS+10sVnqKkIiDKwaDELlHVHAUJVHWzVy3mKq4yqpvKuhYXzXHka2zXVmxYUdKGF/ZP0maJhV7BzWxW+eWv1+i5q5X4tWJGV15SBgUckAd2/VAKZb75Av1x7GjgwyjMRy62vGcIKZJWAGax6VOf6LSZ4hlccMO00Mu6yv2tK026JTlOd+jDpLnG6FLicxTlu4F7S0w5KjDlK4kLsjcdo8QSuvbGx0noKZd3MCx6KzKbHN3CAnayzjxMoQPaF6QKmIWIZSH1cePeki36ueJgSr4RGWHoOeWbxR9eIirSl2hp/o+Y/8Mcs52iavEHf3xRp2WyYnjUOT+0DtXX8C/vEAwKvi6Qk7u6+ZVY7QVq0CIqp/avS8dnDYOgiDQH2cvQpggrdwec/frmNywJem8TgP/wh1/f/Hbx7voPf7A5txssMZ08k1shP4YsWT54wX6rB+xG2CadYJiHViJczU5YlJLmOcCpeS52EUyYlZCEK5qGFCAdV1IEjovwXhBPfCAU0WSL6bg58ZO9A4B9HpqouT6hS9RVtYx0KfQyU1qGrnyHeu1oDrHuWxrsHa1rPuI5SU8tdmkbg41UGlds0ta9uHoXQ2JFJx1N9VSjOWJPnaoXjcgzzWF5j18on4wn+HjHhWHe6f/vxqO2KrPt/HeWI5Z1fPSOkb1MnuVw1HHcffwJMUPSVm9nO3bpc91ktNdZdoCT+QLcbqOTezgyXUNW0zniYVD0tcKUmbWuwVzunMy4uerWtgESlzEHNck9EAbTWYV1znViVMQT5nNK4jWkW7vqo0tRFBUfeqJG3PHTgJueyt1b8qD/Svw6dcObOk2zfipv95hn/yH8UbOWN401PUUyPJm78cA95lSlSppSESxLdC4LHrjfYsnHQYfPnXXFizIRsYTx/ds3d+gX60dtk1L9jHyaNZXg/j9v0aeKyAns1orxRJIhUmfc5IaOQ3SH3tVFZ960rkZLTwM+pF2iInQbAUO0PMlxdIiq9gTHnkw3C9+gATMsiwi7ZchGcC/gMmABckO0yoJ1pe3RDIt21SOdYT3UCp9Kd0l4ui6wDFVW0tDdlXjUvvjJ0SecjtKpgtBM1sHPQkpWYQuoGsKrHKCWIpAVy39GoFri4J0wLOJU8OMFQfeEhn5wHHJbQYzqGZxpnuAUGqOELz8xtBUPaLx3CC/zcvMdf9Dr4O97ypNUyyRTQXHXO9QN5dMiT0cQ3jAcXGLwhPCc8oBFkWPSMXKjebJK1JbqNLj84MmKia3CRfjclS5trjfxqEeIuqQ8oTymOKG8JLJY7oIlvI9ol+nHOMQ3mMU4K7RMSim0SMKHpID65rsEPI7habNod5OJPMliLLYhHD7/LeVJgR8SrUO5DfqEzYlmJMKjUFAeiWnK4zFdMpWwJUtCh0V7tL+OSDw4MniHdmgsxC7t0FW9Xdp/ikj7+4i0/zUi7f8Vkfaf49DWomR4SWKIlIZ6ePOMJ0XFQPle7iK8kzXx8mMEvaSoGM2LMo72bbRMzPLQSUiOMo2hlCjyKQ3vG+GJsgmJEXZQyTSONWkIx7Em1U5VZYRepClvyqqjmKpaaGN6kIcIIkQLbQyzWLTBrIlCvOL0gWMuFEkjHMLN92ZVIj0Km+9FqdcEZxHcaqIok5RF8GEbwhGCJEBXLnc6vFvUUFZRKJdVEiGmkUqqaYpZhAIileCc8HQXMOuqS5tjtvudZMsYfG8SgAGNQtnCwcTh2ibWRqG+zMvN93F80CpZUv3nKEBjqUrC9oobEJYiuKhWUa45UCWpDF/lpqyPP1ivrQ5hotfWzx/eOWKJg9oXhbhFkw+HINehvaKMxLBhVLKKsYl0FbI4u084hm6gElpCkmISRdTRcvNdpnQ5AvMPRFvJNAptRlckhhmjwNFckIwGKxjt06Y8zikpRFYxolIRY7UdcZpHkE2iVFusg/b871D3ZZAHISxJTpWWOLwnpKUdQeOTpIy11DLaWitAIpeR5KvNzLdHPAJ1LQkuIiiSthQoFtvxlOvtWlCV2A6z4anvsMRRDng2UQgbgvLG9rcPTZcqjXnwPseZ0stKhmoWWFMltldQDKpVcF7D69F1TXJostC5YRW+2fWpSAP7aOY4y0LfAZqFDqvW0EER3iJaJKkUooiCSmQIRzDTaJHESY50iEcxlrn8GByeqVThIUtpqUpJAxNlWFNdBc8+Y5STcBA7LVUVtKNOQxeKb8O7tZiwqKfJiongz3lDPELKv7F5g0sdQzSCxDE2dARWg+cmMJFHObo8j3KBSyFDC7BiWeUxrllBVRpDLBQqyoGN0QeCEw3gSsHpBpfhFgA6dMafpRo6HY9vt6EtkCgVZcI2gA5uiYrwmpGQNE88/bieTHfLiQz/ZpWJbcobnGzQztQtWdviNcohi1C46XrihBYGjmxoaVAm1pEUnF2slPkwSdeh6vxHpMlDSYMHAkoii1xirkeYuyEob6MQDv/0WiSyDx8GXUADEJYiT7AqAzYM6JKWODRVSTCLod9JksI6WNTRSMTDL7KhHBbCtUNZyCwCx+EdmSqCb1hZ33CEfABFQicC2IbHEYwTRT6FPwA+gNZgVCOYUormEQSvKkN72ZRMY9wDmWbBFWklUx8qbgDCOlyLrS7NSgVH1dykPHShhLdb7FOJWpDO0NPXuQ5/rCzR8BG9pqdnaLq7Mjhaa5Uto+ShV5JFeAsrRWSS0dBV71HaVtSRoRjLoFOlcRHaG7xJKFcaryJoBhsqdQw1fFPyCNBNWsiKh3Sz+mDRPIiiF5UW6F3F0WjoJnskYrO8XzGjGbqUJKMaXWKZOTRDBfDvfnZs56yIqzTVIRTIQBN9BPgGqWDIV6rT5ENQHm/lrouSiR0ZNRY8uH4rUQUD9T7yjJk1tD4j6HcmSU4eUIGHQAttLJbn1bAZSHQmGVXQnKEe3W09ACghVZWlkBqNgUcR2q6xRlSjUpLV1FF4QlruY5pQ+BbeWR0NC4hyh+w+gQvNKI/dkb/Dqhmty6dCWuREr4lctN9Xa1GNXjSEONkQ2bQj0gKVWCqC3hCNoSO4vau4WYLntyJXr+5s2esLdOVafL1Eeu3pUgRgwO+Ia30MbHP0lujfqOZE+fd5fKijLN4KWnY3twgGt5NVBMt0vaCcevmDnrsz4GsPxCf0woBkiFcMVxx6/eYV9HGtQdz9AO4DvPY9c4oPx93MqQHhdv2LJ4x9sxFJwJqm45BXYVj0njxouBVT7oI5ulFPCKS2cd1b6FDN2UTHS0DPjdgOHPBzFdFIkk8VUXoPaPfp2cqPx8q3KgO05bGjWok99Eg1ead9d8o+nixHEBvr/R0Q2tUP3pmH7P1/uL+hGezmqhYKMLb/bIDVEC6J95FH2DwuS6wIsunaDTdodKuaXXK/OA+/vGkF33AupIWv9y4jQlghRQi0O8P7+1VJzBVOZ2jvO0KYtkNzUHvbQ5NWEjqg7WO6JLKgVt2Yi+l2SNuYg24oIzlBjGwIQ1gpmnO7cW2/fv/RB0jmM8pvGH/PSV+epdOz4azi9FNFhm0Ssf/ydfg9DTHxtC4otUZDM3shU8E5gdwKtKV6PSUoEPJUhjQauyQnlRc92rQwywnypHmimMhpihkyHEyYPsDFebmDoSbaNJ5v7cr1TvnZ66SzbcUgqzX0A48ZxSpZi+g2gTXiGnMNeqm0TY2MVOy24PHjASB7aQy38Ka5RiwpI1guLpgSxhDv3bcrCJajn90vFuiC75p/jahrsOUV1whni1QUZaWJ9IvhKG58M7F45tlXw72AHou9DaH6H9Xrr7/5s7F9rzrbUa/YV1623TlNwkbMjnXc4B2R6F8bn5x65dgA5vy3PnT9T/wzz1uee6d+736cmLx8SLY9GzZMMeMs0Ntf3l+buRNJrPME/KUZVakkJebpzmiVTj1jw1wQBCv0Er1/8wO64frb1y/Rzdur67//gD7ccP39d+j5dr1DnFC9JhKla6FcqzQhJUk1fOub7//9X148864I0euIMm64HiBTFwX2t+NRkU/fI6/5vT2LNzVT/iuefV5Md2XTAc5PBIw7+oH38TtQTFvr5FcqdYUZur1462X2d8FJPF/WaSfjvwQnC//aGna/GBEKEzksPGELPsc3eM8+5FiTLT5Di3Q43XfoIssk+GntKfex0zy9aVGeGud8aizk5vLNnX2VJsNjBVYzRj96TiWrqbq3G93cGVYmvF9mDU/sBBFkDc3Y02tYa2KJ7a41r4DosIuzjJovY9YGbDu9/P3v3IwHwJiEcMGFu+FX/SMwYqXNtY6i1x37pGH01nF4J6RuRPJI6GYQYIMNoHp3WPKqmdfezofyvH5M6mm9mVp4Tnx241xeXMcdWL5YKZFSo3Jav9FIx0FGLkvMc7JoTKdU8BXNK0kytNwBTcIzyBryy5nyROiBUdHohLbsHXQVAe+ABdT9uyVcwR0AkhRCk8RldofPMwq/tBlXCU5sKn4E0qWWcYivIhyJVYRqYRbjOsTCPykjLCrOktoTF08tH1rwZh6L4WhdZ8IZNNhrvSaSE43e70ryEn2on7FbcIB9i+5qB9joJfhlSlOrW/XMoExMmMY1084v/hJhxrzKRNl+ERLcsITEvA2R5g2kXAukNDzmlKMPN5MCJYUE2WjyKrjINkRFGaHtmyEsiQqd0WvIRihxsS9i6FR08LdH4Na2VkgY4XnwTpHAs1E+ImqhExqoVXkw6wRgOEohnWCFMPpJyC2W2bhPN0IXOSR7SYTNjX+AXLol0VtCuF/1DIya+NgYt9CYdUN1lhkEkPGQGTGaIeUuzxXSEgqqjVhyLTb8U9wwzOeI4x/hoKwTRDouytEE+y7LNpKyMRZsDgZs/+UJHakkKaAQbMLhwR0XscdS07RiWCLAi0Y1E8+vH364FblYrfzd30ma6DWJvr09Zt+bAe1t7PB9bfg27F5Uek24dsnik2yrKiRywnEJPXbIadY/KCInGRaVTsW8K+2GnGb4vkpTotQEz4A8fho42mmJJ8AXMipuLuQOeQoTRrzNIZx6PJIBj0YqQYBPlYKbd8XILZ9y2PwQjRSl/qw24fDoJt5NjCxqKdQMMEqyZj7ODzPQhylHiurKIz8RFBcQJ6Id1TVWCGeiNK+LXhMqkdjydsvswmn8ILgoJvJqoSeHohaifl4lwij3lGdG/gipmgXA6CfKCLpwjC1Gy3CMs5c3E7N3cjJhvJn/WdIVJpfg3mUthF0F3xw9CxGy3v0JC2Hz9e5dvUbolZhOCF2KmNUDnskvyRpvqKhAu0xFUUpR0IkMRTI3c9ccLxkUka3Q5X7eKN80Yicik0MOe1on8jLQ4zBoc5kTGPSM3/AXe3c7r2x73yaPXVtmWXE9LGcLrdFnUAaepKeY9UdpQfAe54QTSdN6SrAgkOg3TC2geg1Pra+3G3LMLtJvFkrL6eBnPadTYLfONqfX++fk1As7VsR5eU3TxgjXtCDKyHWr7UlSkskgktuFYKAQBzcCgAefuA3yyKN1Cnb32Y7Wt8fN6ZtEBWtyevTUnMP40AxHc4MZtwLhCGHw5c7u9cHZyVn3zl60IHOTh3cuGJbqPALkgBxvBMiXexy/PbxloVobzLNlx8lHOasECXnHjpAfsx7HkHMbHcZGqYcStIGfOnjlTqXXSUH0WpwhSoJ7nmRk2XBfm9xwwFKSIqrXaU9U551gzl9rGNlzLiN5Qv6++NPXX6Pnt1cXdy/QFVWa8ryiak0yKIX38sJELqLjAu2LhEG27Mry4bYZvjiRMSZFZK/ivvpPs6s+DpobAx75YE2fH3NdUkj7b+p+O44/4MkXM8XcB5PeZophFgqdbjCRdzijlbIjICGRogVlWFrxZMSmuUMpvOv+8iq454pmcyKNdDPlP5iDUHsRB7iY7SWPV2dxwffddQhruErDjv/XOYngk9FZcI4b0inLyPyuTCFjJgaMQjaw1ELmmNPf92RV83hH4djFPmGlu2dqYrlXVHprSSOh/vxkhoPXwkJ8WeyiXlbzzwQzvU6xJKiUJBMF5dhbcNcRT3dYU8K1Opgez/Ccs73FZ52shX4kZaSDa67OMyO4Siw1gCG1U90vVmcEO3LC5hiJuiIZkViTLAmWVLbnfBjh81M9YhM8u5NiQ7MGPMx9D5clc5rq6GA48B/zrPV1Wr+C006SZjPNshnSYf3p3cQ0vc1DIXNyQ230fD1U3Ccg4BqlM2RT8MdqnuQBdKbOjzqV0LlnolZHBY0VK6S0kFbiG2oF0RhGewbfWphvPfPPvqBZxsh8Uu4NjHesnPNsb0funSTn6vYY80z3zo3WQRjiuzo6+xKVDJstM++zkIjwVO7KKS8/pELOYE8ekUEnG9vyZ6E0eoPTNeUTJl2GI0mOr4Zr/YFDpn8piREfRj+yIGdqgW4zXKJf4R9WP8oEt3Wn/xg/nmiNN8RoToxgiT5VRO4QYBCqUnBFao3KX5xq5pvAb+aRlw4DLzWUJa1RILmdvsXlm+azntIMrLYH6J0DRz2WU+jyFNdhNjzjNbR0D8TI2Ibu4aUKyYpzrx2rXjYvj408WxipiRo7RzFxFmb8jcBoS3kmtgqpkqR0RVPzyUtfnaDLkx1fEDM9y2+bc4OeAyIs4Wn7DEHo8kVntVDF4R2/JTlOd+iD6gPfNhHYYlhIGzy71owwg8E+8dp3TS1gBWrV4JCZF3G04g0OgKf6v1dpCuU84+XrTzu+Qj2FzmvVa8+MYYbeg+Z+c8Jk58nrnZqqy/B1rvda1l3D1KdRQMezmcdh1wQM+nvTJmTabRjtkB+Q4nDxM5QNhGwJOFnhBlPOyIpy56sH4QSofgUuJ0AHgbuTCsUi8dY6YAbqX2jB2PhsY8/dYSlNYFM2PmytcbouZobAb0eFBUcj66i7HVGavCwpD9dBLOjdMFOGosK4j6dHSHXLdmBbLIx2W97v6do54jru23eA6xLL+kyZP79sp7Jd0xGUOjK3w9iyNvn9qOnp4D1LLKyFkLt4G/6jKjH/y0HEmJqRPop6rZ77niazLD++AuoH5nY2lWg0qxpvff+sJk9BQriWojxFdGSiWo6cC0edcTemsbbJgXIE4NFWd8x7Dy9FUWK+a+4jXDtop2/tlQ2R5hlKKF8Jv1KA1cfYNUIH5MfAiqw525K4qOirT7FyBH6qGNuh/6wwoytKMnQFdc/WOehlZUuWSSrER3qmoPtvZIns+K39jNmUNh8cbbYNh5eVBpX7xBamh+/6u2YI12XHuaOtT36B3u9KO/XWc2AWx+7g9OZJskqCgskO2DY8WEeEfKZ8sLVDZuZw1TXKZZ8761kshay9/RBifnc7seUdrJzAx6leizJuH6I9S2FGPui5r9mUQkTSRPpMmXHMfqASa79rMuUJViGj/R3C0pXTB6ZcSRZwmztUA+5KY4wmlQzlDenQVEQmOA9nU7akgz9PfdJB0x/7pN2pjyBYyIMmHFSr8MaJoR/sNDeK3lqSQapMaI3KDjFHLWFP5r6HYUG9euX++9Kx8Mr9h8tr8rn9MSPSn53npnPG6LmdTDd4Dh7XTqu10XQy1xDNmFSUr4iUE3HX8bxnmVdX8T+49F737AxM1rjEq842eK4UhLVF1CvlGWK243dt4/bm2L2HDGLZ/dPfyDhBa7rhJy3XRM7jjzA6u8t4en4JrR9foEsY388akXomsJSJdb4k0jX/JL0szD3gvCRq6LizkJ0NN4M+Ux2k6L07TX8/1Sv5eGgU/26je/q731tDP0aSKTd/u0ac5EJTu4HlGquJDlAqnRtWqLOVdvDp5oJmq6N1gBoluAzOWA2cXtff+BNSFM3nqKjo4xs1XQ/fTzZaNtKEKlUFVzqBMiRLxfPWPS2GAhwSKaP6QEeb0pWe12ZwdA/B6X3SaZYMiQYZ3EWRn99Dauf+x6gjPU9j8vHScw+P0yJUKZZsYr7ow5Cqc2R7mckSc/RwFRymUcUiTD8SZ1FHAjf4qm1X0n2QQLZ+hxTE64REN/cXf3tzh+7MO4V+4RPdV1puI1VSn8Lt+63wcwtiKF2T9KM6yYl8nBCOi0HmazrX4HU2EGGQBupaELZScI+WSyQdgUKeQcm1fDSoIJNGA/Cssa5m6/DZ5XKDGc3sQfQwMRSEs6Fa7xOEsGIfyU4NxXagk18nkAamvda6VAmFHrRRSMNWxliQFH8Gt4nmvK58EZLq3YEblYqiiIoTdyTflg/nEPKX4G+pJGxoaYZ2sWwZ5olS52p4a0a2Mvw3N9u6RsvLrS01TkpB50ir9jFsOUDAATDltwZgWdM15nwEnBEbbsqNCoxMxGxngm1uHhbX8/C324u37t17NRi+eVC0kEPff3DMNqo+JhvBqlgLcFH3ceauz03TGbtu51txqhV6bplQLwCtAwp76466A/IImPbOhlWRpNmt4/UDp9qlCyz6RQcbIiFTYFUxlAqeklIbQ/ne7uEEvMJ2G1P62oU3BnvdQtswWgqpkTDr+/N/XPhScL3LHvrcCZnPn2A5LDDouViX2IKdeIFi/nr9y93NHXqDHwrKs6att39bzdxmT8PsNVGcmJabxmh2+6bVqE/+ksXg6dm2yjFZzVewee4i/HrK0dWOnrPMSeWbK4fS67jYyyGbb1POjBVQz7j4b1833BTm8GysSYa+3eAvMSb0mbIbXbtqsOKboG5hi3tfIlV5UtSxQj8qLQXP/7JkOP3IqNIk+/GV+9vL5lPKVyT1f7Sikmwx8yoyeMk6v0GYZ0gJNHEsJcmp0nJnLPs5hUWJ9dqB9Tc8oCEPIybBKTUXm7YQ2tZrpUJ2UMgbfbLhnHAtd//j/wYAAP//M4fDsw==" } diff --git a/x-pack/filebeat/module/fortinet/fortimail/_meta/fields.yml b/x-pack/filebeat/module/fortinet/fortimail/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/fortinet/fortimail/config/input.yml b/x-pack/filebeat/module/fortinet/fortimail/config/input.yml new file mode 100644 index 00000000000..a994af47a3b --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Fortinet" + product: "FortiMail" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/fortinet/fortimail/config/liblogparser.js + - ${path.home}/module/fortinet/fortimail/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/fortinet/fortimail/config/liblogparser.js b/x-pack/filebeat/module/fortinet/fortimail/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} client_name=\"%{p0}"); + +var dup42 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(info,false), Constant(')"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); + +var dup43 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); + +var dup44 = // "Pattern{Field(saddr,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); + +var dup45 = // "Pattern{Constant('"'), Field(context,false), Constant('" to='), Field(p0,false)}" +match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); + +var dup46 = // "Pattern{Field(context,true), Constant(' to='), Field(p0,false)}" +match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); + +var dup47 = // "Pattern{Constant('"'), Field(to,false), Constant('" direction='), Field(p0,false)}" +match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); + +var dup48 = // "Pattern{Field(to,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); + +var dup49 = // "Pattern{Constant('"'), Field(direction,false), Constant('" message_length='), Field(p0,false)}" +match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); + +var dup50 = // "Pattern{Field(direction,true), Constant(' message_length='), Field(p0,false)}" +match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); + +var dup51 = // "Pattern{Field(fld4,true), Constant(' virus='), Field(p0,false)}" +match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); + +var dup52 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" disposition='), Field(p0,false)}" +match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); + +var dup53 = // "Pattern{Field(virusname,true), Constant(' disposition='), Field(p0,false)}" +match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); + +var dup54 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" classifier='), Field(p0,false)}" +match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); + +var dup55 = // "Pattern{Field(disposition,true), Constant(' classifier='), Field(p0,false)}" +match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); + +var dup56 = // "Pattern{Constant('"'), Field(filter,false), Constant('" subject='), Field(p0,false)}" +match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); + +var dup57 = // "Pattern{Field(filter,true), Constant(' subject='), Field(p0,false)}" +match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); + +var dup58 = // "Pattern{Constant('"'), Field(subject,false), Constant('"')}" +match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); + +var dup59 = // "Pattern{Field(subject,false)}" +match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); + +var dup60 = setc("eventcategory","1207000000"); + +var dup61 = // "Pattern{Field(,false), Constant('resolved='), Field(p0,false)}" +match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); + +var dup62 = setc("eventcategory","1207040000"); + +var dup63 = linear_select([ + dup3, + dup4, +]); + +var dup64 = linear_select([ + dup5, + dup6, +]); + +var dup65 = linear_select([ + dup19, + dup20, +]); + +var dup66 = linear_select([ + dup22, + dup23, +]); + +var dup67 = linear_select([ + dup3, + dup20, +]); + +var dup68 = linear_select([ + dup24, + dup25, +]); + +var dup69 = linear_select([ + dup27, + dup28, +]); + +var dup70 = linear_select([ + dup29, + dup30, +]); + +var dup71 = linear_select([ + dup36, + dup37, +]); + +var dup72 = linear_select([ + dup38, + dup39, +]); + +var dup73 = linear_select([ + dup40, + dup41, +]); + +var dup74 = linear_select([ + dup42, + dup43, + dup44, +]); + +var dup75 = linear_select([ + dup45, + dup46, +]); + +var dup76 = linear_select([ + dup47, + dup48, +]); + +var dup77 = linear_select([ + dup49, + dup50, +]); + +var dup78 = linear_select([ + dup52, + dup53, +]); + +var dup79 = linear_select([ + dup54, + dup55, +]); + +var dup80 = linear_select([ + dup56, + dup57, +]); + +var dup81 = linear_select([ + dup58, + dup59, +]); + +var dup82 = all_match({ + processors: [ + dup2, + dup63, + dup16, + dup64, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var hdr1 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' log_part='), Field(hfld3,true), Constant(' type='), Field(msgIdPart1,true), Constant(' subtype='), Field(msgIdPart2,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" +match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ + setc("header_id","0001"), + dup1, +])); + +var hdr2 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' log_part='), Field(hfld3,true), Constant(' type='), Field(messageid,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" +match("HEADER#1:0002", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ + setc("header_id","0002"), +])); + +var hdr3 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' type='), Field(msgIdPart1,true), Constant(' subtype='), Field(msgIdPart2,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" +match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ + setc("header_id","0003"), + dup1, +])); + +var hdr4 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' type='), Field(messageid,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" +match("HEADER#3:0004", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ + setc("header_id","0004"), +])); + +var select1 = linear_select([ + hdr1, + hdr2, + hdr3, + hdr4, +]); + +var part1 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' reason='), Field(result,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#0:event_admin/2", "nwparser.p0", "%{action->} status=%{event_state->} reason=%{result->} msg=%{p0}"); + +var all1 = all_match({ + processors: [ + dup2, + dup63, + part1, + dup64, + ], + on_success: processor_chain([ + dup7, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg1 = msg("event_admin", all1); + +var msg2 = msg("event_pop3", dup82); + +var all2 = all_match({ + processors: [ + dup2, + dup63, + dup16, + dup64, + ], + on_success: processor_chain([ + dup7, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg3 = msg("event_webmail", all2); + +var msg4 = msg("event_system", dup82); + +var msg5 = msg("event_imap", dup82); + +var part2 = // "Pattern{Field(fld1,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/4", "nwparser.p0", "%{fld1}, relay=%{p0}"); + +var part3 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant('], version='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/5_0", "nwparser.p0", "%{shost}[%{saddr}], version=%{p0}"); + +var part4 = // "Pattern{Field(shost,false), Constant(', version='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/5_1", "nwparser.p0", "%{shost}, version=%{p0}"); + +var select2 = linear_select([ + part3, + part4, +]); + +var part5 = // "Pattern{Field(version,false), Constant(', verify='), Field(fld2,false), Constant(', cipher='), Field(s_cipher,false), Constant(', bits='), Field(fld3,false), Constant('"')}" +match("MESSAGE#5:event_smtp:01/6", "nwparser.p0", "%{version}, verify=%{fld2}, cipher=%{s_cipher}, bits=%{fld3}\""); + +var all3 = all_match({ + processors: [ + dup18, + dup65, + dup21, + dup66, + part2, + select2, + part5, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg6 = msg("event_smtp:01", all3); + +var part6 = // "Pattern{Field(fld1,false), Constant(', cert-subject='), Field(cert_subject,false), Constant(', cert-issuer='), Field(fld2,false), Constant(', verifymsg='), Field(fld3,false), Constant('"')}" +match("MESSAGE#6:event_smtp:02/4", "nwparser.p0", "%{fld1}, cert-subject=%{cert_subject}, cert-issuer=%{fld2}, verifymsg=%{fld3}\""); + +var all4 = all_match({ + processors: [ + dup18, + dup65, + dup21, + dup66, + part6, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg7 = msg("event_smtp:02", all4); + +var part7 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="to=<<'), Field(to,false), Constant('>, delay='), Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant(', relay='), Field(shost,false), Constant('['), Field(saddr,false), Constant('], dsn='), Field(fld4,false), Constant(', stat='), Field(fld5,false), Constant('"')}" +match("MESSAGE#7:event_smtp:03/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"to=\u003c\u003c%{to}>, delay=%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}[%{saddr}], dsn=%{fld4}, stat=%{fld5}\""); + +var all5 = all_match({ + processors: [ + dup18, + dup65, + part7, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg8 = msg("event_smtp:03", all5); + +var part8 = // "Pattern{Constant('user='), Field(username,false), Constant('ui='), Field(network_service,false), Constant('action='), Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="from=<<'), Field(from,false), Constant('>, size='), Field(bytes,false), Constant(', class='), Field(fld2,false), Constant(', nrcpts='), Field(p0,false)}" +match("MESSAGE#8:event_smtp:04/0", "nwparser.payload", "user=%{username}ui=%{network_service}action=%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"from=\u003c\u003c%{from}>, size=%{bytes}, class=%{fld2}, nrcpts=%{p0}"); + +var part9 = // "Pattern{Field(fld3,false), Constant(', msgid=<<'), Field(fld4,false), Constant('>, proto='), Field(p0,false)}" +match("MESSAGE#8:event_smtp:04/1_0", "nwparser.p0", "%{fld3}, msgid=\u003c\u003c%{fld4}>, proto=%{p0}"); + +var part10 = // "Pattern{Field(fld3,false), Constant(', proto='), Field(p0,false)}" +match("MESSAGE#8:event_smtp:04/1_1", "nwparser.p0", "%{fld3}, proto=%{p0}"); + +var select3 = linear_select([ + part9, + part10, +]); + +var part11 = // "Pattern{Field(protocol,false), Constant(', daemon='), Field(process,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#8:event_smtp:04/2", "nwparser.p0", "%{protocol}, daemon=%{process}, relay=%{p0}"); + +var part12 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant('] (may be forged)"')}" +match("MESSAGE#8:event_smtp:04/3_0", "nwparser.p0", "%{shost}[%{saddr}] (may be forged)\""); + +var part13 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant(']"')}" +match("MESSAGE#8:event_smtp:04/3_1", "nwparser.p0", "%{shost}[%{saddr}]\""); + +var part14 = // "Pattern{Field(shost,false), Constant('"')}" +match("MESSAGE#8:event_smtp:04/3_2", "nwparser.p0", "%{shost}\""); + +var select4 = linear_select([ + part12, + part13, + part14, +]); + +var all6 = all_match({ + processors: [ + part8, + select3, + part11, + select4, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg9 = msg("event_smtp:04", all6); + +var part15 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="Milter: to=<<'), Field(to,false), Constant('>, reject='), Field(fld1,false), Constant('"')}" +match("MESSAGE#9:event_smtp:05/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"Milter: to=\u003c\u003c%{to}>, reject=%{fld1}\""); + +var all7 = all_match({ + processors: [ + dup18, + dup67, + part15, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg10 = msg("event_smtp:05", all7); + +var part16 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="timeout waiting for input from'), Field(p0,false)}" +match("MESSAGE#10:event_smtp:06/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"timeout waiting for input from%{p0}"); + +var part17 = // "Pattern{Constant('['), Field(saddr,false), Constant(']during server cmd'), Field(p0,false)}" +match("MESSAGE#10:event_smtp:06/3_0", "nwparser.p0", "[%{saddr}]during server cmd%{p0}"); + +var part18 = // "Pattern{Field(saddr,false), Constant('during server cmd'), Field(p0,false)}" +match("MESSAGE#10:event_smtp:06/3_1", "nwparser.p0", "%{saddr}during server cmd%{p0}"); + +var select5 = linear_select([ + part17, + part18, +]); + +var part19 = // "Pattern{Field(fld5,false), Constant('"')}" +match("MESSAGE#10:event_smtp:06/4", "nwparser.p0", "%{fld5}\""); + +var all8 = all_match({ + processors: [ + dup18, + dup65, + part16, + select5, + part19, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg11 = msg("event_smtp:06", all8); + +var part20 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="collect:'), Field(fld1,false), Constant('timeout on connection from'), Field(shost,false), Constant(', from=<<'), Field(from,false), Constant('>"')}" +match("MESSAGE#11:event_smtp:07/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"collect:%{fld1}timeout on connection from%{shost}, from=\u003c\u003c%{from}>\""); + +var all9 = all_match({ + processors: [ + dup18, + dup67, + part20, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg12 = msg("event_smtp:07", all9); + +var part21 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="DSN: to <<'), Field(to,false), Constant('>; reason:'), Field(result,false), Constant('; sessionid:'), Field(fld5,false), Constant('"')}" +match("MESSAGE#12:event_smtp:08/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"DSN: to \u003c\u003c%{to}>; reason:%{result}; sessionid:%{fld5}\""); + +var all10 = all_match({ + processors: [ + dup18, + dup67, + part21, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg13 = msg("event_smtp:08", all10); + +var part22 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="lost input channel from'), Field(shost,false), Constant('['), Field(saddr,false), Constant('] (may be forged) to SMTP_MTA after rcpt"')}" +match("MESSAGE#13:event_smtp:09/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"lost input channel from%{shost}[%{saddr}] (may be forged) to SMTP_MTA after rcpt\""); + +var all11 = all_match({ + processors: [ + dup18, + dup65, + part22, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg14 = msg("event_smtp:09", all11); + +var part23 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="'), Field(shost,false), Constant('['), Field(saddr,false), Constant(']: possible SMTP attack: command='), Field(fld1,false), Constant(', count='), Field(dclass_counter1,false), Constant('"')}" +match("MESSAGE#14:event_smtp:10/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"%{shost}[%{saddr}]: possible SMTP attack: command=%{fld1}, count=%{dclass_counter1}\""); + +var all12 = all_match({ + processors: [ + dup18, + dup65, + part23, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + setc("dclass_counter1_string","count"), + ]), +}); + +var msg15 = msg("event_smtp:10", all12); + +var part24 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" log_part='), Field(id1,true), Constant(' msg="to=<<'), Field(to,false), Constant(', delay='), Field(p0,false)}" +match("MESSAGE#15:event_smtp:11/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" log_part=%{id1->} msg=\"to=\u003c\u003c%{to}, delay=%{p0}"); + +var part25 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant(', relay='), Field(shost,false), Constant('"')}" +match("MESSAGE#15:event_smtp:11/3_0", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}\""); + +var part26 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant('"')}" +match("MESSAGE#15:event_smtp:11/3_1", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}\""); + +var part27 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant('"')}" +match("MESSAGE#15:event_smtp:11/3_2", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}\""); + +var part28 = // "Pattern{Field(fld1,false), Constant('"')}" +match("MESSAGE#15:event_smtp:11/3_3", "nwparser.p0", "%{fld1}\""); + +var select6 = linear_select([ + part25, + part26, + part27, + part28, +]); + +var all13 = all_match({ + processors: [ + dup18, + dup65, + part24, + select6, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg16 = msg("event_smtp:11", all13); + +var part29 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' session_id='), Field(p0,false)}" +match("MESSAGE#16:event_smtp/2", "nwparser.p0", "%{action->} status=%{event_state->} session_id=%{p0}"); + +var all14 = all_match({ + processors: [ + dup2, + dup63, + part29, + dup68, + dup64, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg17 = msg("event_smtp", all14); + +var part30 = tagval("MESSAGE#17:event_smtp:12", "nwparser.payload", tvm, { + "action": "action", + "log_part": "id1", + "msg": "info", + "session_id": "sessionid", + "status": "event_state", + "ui": "network_service", + "user": "username", +}, processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, +])); + +var msg18 = msg("event_smtp:12", part30); + +var select7 = linear_select([ + msg6, + msg7, + msg8, + msg9, + msg10, + msg11, + msg12, + msg13, + msg14, + msg15, + msg16, + msg17, + msg18, +]); + +var part31 = // "Pattern{Constant('msg='), Field(p0,false)}" +match("MESSAGE#18:event_update/0", "nwparser.payload", "msg=%{p0}"); + +var all15 = all_match({ + processors: [ + part31, + dup64, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg19 = msg("event_update", all15); + +var part32 = // "Pattern{Field(network_service,false), Constant('('), Field(saddr,false), Constant(') module='), Field(p0,false)}" +match("MESSAGE#19:event_config/1_0", "nwparser.p0", "%{network_service}(%{saddr}) module=%{p0}"); + +var part33 = // "Pattern{Field(network_service,true), Constant(' module='), Field(p0,false)}" +match("MESSAGE#19:event_config/1_1", "nwparser.p0", "%{network_service->} module=%{p0}"); + +var select8 = linear_select([ + part32, + part33, +]); + +var part34 = // "Pattern{Field(fld1,true), Constant(' submodule='), Field(fld2,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#19:event_config/2", "nwparser.p0", "%{fld1->} submodule=%{fld2->} msg=%{p0}"); + +var all16 = all_match({ + processors: [ + dup2, + select8, + part34, + dup64, + ], + on_success: processor_chain([ + setc("eventcategory","1701000000"), + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); + +var msg20 = msg("event_config", all16); + +var select9 = linear_select([ + dup31, + dup32, +]); + +var all17 = all_match({ + processors: [ + dup26, + dup69, + dup70, + select9, + dup68, + dup64, + ], + on_success: processor_chain([ + dup33, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg21 = msg("virus", all17); + +var part35 = // "Pattern{Constant('"'), Field(to,false), Constant('" client_name="'), Field(p0,false)}" +match("MESSAGE#21:virus_infected/2_0", "nwparser.p0", "\"%{to}\" client_name=\"%{p0}"); + +var part36 = // "Pattern{Field(to,true), Constant(' client_name="'), Field(p0,false)}" +match("MESSAGE#21:virus_infected/2_1", "nwparser.p0", "%{to->} client_name=\"%{p0}"); + +var select10 = linear_select([ + part35, + part36, +]); + +var part37 = // "Pattern{Field(fqdn,false), Constant('" client_ip="'), Field(saddr,false), Constant('" session_id='), Field(p0,false)}" +match("MESSAGE#21:virus_infected/3", "nwparser.p0", "%{fqdn}\" client_ip=\"%{saddr}\" session_id=%{p0}"); + +var all18 = all_match({ + processors: [ + dup26, + dup69, + select10, + part37, + dup68, + dup64, + ], + on_success: processor_chain([ + dup33, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup15, + ]), +}); + +var msg22 = msg("virus_infected", all18); + +var part38 = // "Pattern{Constant('from="'), Field(from,false), Constant('" to='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/0_0", "nwparser.payload", "from=\"%{from}\" to=%{p0}"); + +var part39 = // "Pattern{Field(from,true), Constant(' to='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/0_1", "nwparser.payload", "%{from->} to=%{p0}"); + +var select11 = linear_select([ + part38, + part39, +]); + +var part40 = // "Pattern{Constant('"'), Field(sdomain,true), Constant(' ['), Field(saddr,false), Constant(']" session_id='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/2_0", "nwparser.p0", "\"%{sdomain->} [%{saddr}]\" session_id=%{p0}"); + +var part41 = // "Pattern{Field(sdomain,true), Constant(' ['), Field(saddr,false), Constant('] session_id='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/2_1", "nwparser.p0", "%{sdomain->} [%{saddr}] session_id=%{p0}"); + +var part42 = // "Pattern{Constant('"['), Field(saddr,false), Constant(']" session_id='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/2_2", "nwparser.p0", "\"[%{saddr}]\" session_id=%{p0}"); + +var part43 = // "Pattern{Constant('['), Field(saddr,false), Constant('] session_id='), Field(p0,false)}" +match("MESSAGE#22:virus_file-signature/2_3", "nwparser.p0", "[%{saddr}] session_id=%{p0}"); + +var select12 = linear_select([ + part40, + part41, + part42, + part43, + dup31, + dup32, +]); + +var part44 = // "Pattern{Constant('"Attachment file ('), Field(filename,false), Constant(') has sha1 hash value: '), Field(checksum,false), Constant('"')}" +match("MESSAGE#22:virus_file-signature/4_0", "nwparser.p0", "\"Attachment file (%{filename}) has sha1 hash value: %{checksum}\""); + +var select13 = linear_select([ + part44, + dup5, + dup6, +]); + +var all19 = all_match({ + processors: [ + select11, + dup70, + select12, + dup68, + select13, + ], + on_success: processor_chain([ + dup33, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg23 = msg("virus_file-signature", all19); + +var part45 = // "Pattern{Field(,false), Constant('MSISDN='), Field(fld3,true), Constant(' resolved='), Field(p0,false)}" +match("MESSAGE#23:statistics/5", "nwparser.p0", "%{}MSISDN=%{fld3->} resolved=%{p0}"); + +var all20 = all_match({ + processors: [ + dup35, + dup71, + dup72, + dup73, + dup74, + part45, + dup75, + dup76, + dup77, + dup51, + dup78, + dup79, + dup80, + dup81, + ], + on_success: processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg24 = msg("statistics", all20); + +var all21 = all_match({ + processors: [ + dup35, + dup71, + dup72, + dup73, + dup74, + dup61, + dup75, + dup76, + dup77, + dup51, + dup78, + dup79, + dup80, + dup81, + ], + on_success: processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg25 = msg("statistics:01", all21); + +var part46 = // "Pattern{Constant('"'), Field(direction,false), Constant('" subject='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/4_0", "nwparser.p0", "\"%{direction}\" subject=%{p0}"); + +var part47 = // "Pattern{Field(direction,true), Constant(' subject='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/4_1", "nwparser.p0", "%{direction->} subject=%{p0}"); + +var select14 = linear_select([ + part46, + part47, +]); + +var part48 = // "Pattern{Constant('"'), Field(subject,false), Constant('" classifier='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/5_0", "nwparser.p0", "\"%{subject}\" classifier=%{p0}"); + +var part49 = // "Pattern{Field(subject,true), Constant(' classifier='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/5_1", "nwparser.p0", "%{subject->} classifier=%{p0}"); + +var select15 = linear_select([ + part48, + part49, +]); + +var part50 = // "Pattern{Constant('"'), Field(filter,false), Constant('" disposition='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/6_0", "nwparser.p0", "\"%{filter}\" disposition=%{p0}"); + +var part51 = // "Pattern{Field(filter,true), Constant(' disposition='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/6_1", "nwparser.p0", "%{filter->} disposition=%{p0}"); + +var select16 = linear_select([ + part50, + part51, +]); + +var part52 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" client_name="'), Field(p0,false)}" +match("MESSAGE#25:statistics:02/7_0", "nwparser.p0", "\"%{disposition}\" client_name=\"%{p0}"); + +var part53 = // "Pattern{Field(disposition,true), Constant(' client_name="'), Field(p0,false)}" +match("MESSAGE#25:statistics:02/7_1", "nwparser.p0", "%{disposition->} client_name=\"%{p0}"); + +var select17 = linear_select([ + part52, + part53, +]); + +var part54 = // "Pattern{Constant('"'), Field(context,false), Constant('" virus='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/10_0", "nwparser.p0", "\"%{context}\" virus=%{p0}"); + +var part55 = // "Pattern{Field(context,true), Constant(' virus='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/10_1", "nwparser.p0", "%{context->} virus=%{p0}"); + +var select18 = linear_select([ + part54, + part55, +]); + +var part56 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" message_length='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/11_0", "nwparser.p0", "\"%{virusname}\" message_length=%{p0}"); + +var part57 = // "Pattern{Field(virusname,true), Constant(' message_length='), Field(p0,false)}" +match("MESSAGE#25:statistics:02/11_1", "nwparser.p0", "%{virusname->} message_length=%{p0}"); + +var select19 = linear_select([ + part56, + part57, +]); + +var part58 = // "Pattern{Field(fld4,false)}" +match_copy("MESSAGE#25:statistics:02/12", "nwparser.p0", "fld4"); + +var all22 = all_match({ + processors: [ + dup35, + dup71, + dup69, + dup76, + select14, + select15, + select16, + select17, + dup74, + dup61, + select18, + select19, + part58, + ], + on_success: processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg26 = msg("statistics:02", all22); + +var part59 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name="'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{p0}"); + +var part60 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant('] (may be forged)"'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/1_0", "nwparser.p0", "%{fqdn}[%{saddr}] (may be forged)\"%{p0}"); + +var part61 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']"'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/1_1", "nwparser.p0", "%{fqdn}[%{saddr}]\"%{p0}"); + +var part62 = // "Pattern{Constant('['), Field(saddr,false), Constant(']"'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/1_2", "nwparser.p0", "[%{saddr}]\"%{p0}"); + +var select20 = linear_select([ + part60, + part61, + part62, +]); + +var part63 = // "Pattern{Constant('dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/2", "nwparser.p0", "dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\"%{p0}"); + +var part64 = // "Pattern{Constant(' polid="'), Field(fld5,false), Constant('" domain="'), Field(domain,false), Constant('" subject="'), Field(subject,false), Constant('" mailer="'), Field(agent,false), Constant('" resolved="'), Field(context,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#26:statistics:03/3_0", "nwparser.p0", " polid=\"%{fld5}\" domain=\"%{domain}\" subject=\"%{subject}\" mailer=\"%{agent}\" resolved=\"%{context}\"%{p0}"); + +var part65 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#26:statistics:03/3_1", "nwparser.p0", "p0"); + +var select21 = linear_select([ + part64, + part65, +]); + +var part66 = // "Pattern{Field(,false), Constant('direction="'), Field(direction,false), Constant('" virus="'), Field(virusname,false), Constant('" disposition="'), Field(disposition,false), Constant('" classifier="'), Field(filter,false), Constant('" message_length='), Field(fld4,false)}" +match("MESSAGE#26:statistics:03/4", "nwparser.p0", "%{}direction=\"%{direction}\" virus=\"%{virusname}\" disposition=\"%{disposition}\" classifier=\"%{filter}\" message_length=%{fld4}"); + +var all23 = all_match({ + processors: [ + part59, + select20, + part63, + select21, + part66, + ], + on_success: processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg27 = msg("statistics:03", all23); + +var part67 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" client_name='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=%{p0}"); + +var part68 = // "Pattern{Field(sessionid,true), Constant(' client_name='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/1_1", "nwparser.p0", "%{sessionid->} client_name=%{p0}"); + +var select22 = linear_select([ + part67, + part68, +]); + +var part69 = // "Pattern{Constant('"'), Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']"dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_0", "nwparser.p0", "\"%{fqdn}[%{saddr}]\"dst_ip=%{p0}"); + +var part70 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_1", "nwparser.p0", "%{fqdn}[%{saddr}]dst_ip=%{p0}"); + +var part71 = // "Pattern{Constant('"['), Field(saddr,false), Constant(']"dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_2", "nwparser.p0", "\"[%{saddr}]\"dst_ip=%{p0}"); + +var part72 = // "Pattern{Constant('['), Field(saddr,false), Constant(']dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_3", "nwparser.p0", "[%{saddr}]dst_ip=%{p0}"); + +var part73 = // "Pattern{Constant('"'), Field(saddr,false), Constant('"dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_4", "nwparser.p0", "\"%{saddr}\"dst_ip=%{p0}"); + +var part74 = // "Pattern{Field(saddr,false), Constant('dst_ip='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/2_5", "nwparser.p0", "%{saddr}dst_ip=%{p0}"); + +var select23 = linear_select([ + part69, + part70, + part71, + part72, + part73, + part74, +]); + +var part75 = // "Pattern{Constant('"'), Field(daddr,false), Constant('" from='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/3_0", "nwparser.p0", "\"%{daddr}\" from=%{p0}"); + +var part76 = // "Pattern{Field(daddr,true), Constant(' from='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/3_1", "nwparser.p0", "%{daddr->} from=%{p0}"); + +var select24 = linear_select([ + part75, + part76, +]); + +var part77 = // "Pattern{Constant('"'), Field(from,false), Constant('" hfrom='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/4_0", "nwparser.p0", "\"%{from}\" hfrom=%{p0}"); + +var part78 = // "Pattern{Field(from,true), Constant(' hfrom='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/4_1", "nwparser.p0", "%{from->} hfrom=%{p0}"); + +var select25 = linear_select([ + part77, + part78, +]); + +var part79 = // "Pattern{Constant('"'), Field(fld3,false), Constant('" to='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/5_0", "nwparser.p0", "\"%{fld3}\" to=%{p0}"); + +var part80 = // "Pattern{Field(fld3,true), Constant(' to='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/5_1", "nwparser.p0", "%{fld3->} to=%{p0}"); + +var select26 = linear_select([ + part79, + part80, +]); + +var part81 = // "Pattern{Constant('"'), Field(to,false), Constant('" polid='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/6_0", "nwparser.p0", "\"%{to}\" polid=%{p0}"); + +var part82 = // "Pattern{Field(to,true), Constant(' polid='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/6_1", "nwparser.p0", "%{to->} polid=%{p0}"); + +var select27 = linear_select([ + part81, + part82, +]); + +var part83 = // "Pattern{Constant('"'), Field(fld5,false), Constant('" domain='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/7_0", "nwparser.p0", "\"%{fld5}\" domain=%{p0}"); + +var part84 = // "Pattern{Field(fld5,true), Constant(' domain='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/7_1", "nwparser.p0", "%{fld5->} domain=%{p0}"); + +var select28 = linear_select([ + part83, + part84, +]); + +var part85 = // "Pattern{Constant('"'), Field(domain,false), Constant('" subject='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/8_0", "nwparser.p0", "\"%{domain}\" subject=%{p0}"); + +var part86 = // "Pattern{Field(domain,true), Constant(' subject='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/8_1", "nwparser.p0", "%{domain->} subject=%{p0}"); + +var select29 = linear_select([ + part85, + part86, +]); + +var part87 = // "Pattern{Constant('"'), Field(subject,false), Constant('" mailer='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/9_0", "nwparser.p0", "\"%{subject}\" mailer=%{p0}"); + +var part88 = // "Pattern{Field(subject,true), Constant(' mailer='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/9_1", "nwparser.p0", "%{subject->} mailer=%{p0}"); + +var select30 = linear_select([ + part87, + part88, +]); + +var part89 = // "Pattern{Constant('"'), Field(agent,false), Constant('" resolved='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/10_0", "nwparser.p0", "\"%{agent}\" resolved=%{p0}"); + +var part90 = // "Pattern{Field(agent,true), Constant(' resolved='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/10_1", "nwparser.p0", "%{agent->} resolved=%{p0}"); + +var select31 = linear_select([ + part89, + part90, +]); + +var part91 = // "Pattern{Constant('"'), Field(context,false), Constant('" direction='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/11_0", "nwparser.p0", "\"%{context}\" direction=%{p0}"); + +var part92 = // "Pattern{Field(context,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/11_1", "nwparser.p0", "%{context->} direction=%{p0}"); + +var select32 = linear_select([ + part91, + part92, +]); + +var part93 = // "Pattern{Constant('"'), Field(direction,false), Constant('" virus='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/12_0", "nwparser.p0", "\"%{direction}\" virus=%{p0}"); + +var part94 = // "Pattern{Field(direction,true), Constant(' virus='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/12_1", "nwparser.p0", "%{direction->} virus=%{p0}"); + +var select33 = linear_select([ + part93, + part94, +]); + +var part95 = // "Pattern{Constant('"'), Field(filter,false), Constant('" message_length='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/15_0", "nwparser.p0", "\"%{filter}\" message_length=%{p0}"); + +var part96 = // "Pattern{Field(filter,true), Constant(' message_length='), Field(p0,false)}" +match("MESSAGE#27:statistics:04/15_1", "nwparser.p0", "%{filter->} message_length=%{p0}"); + +var select34 = linear_select([ + part95, + part96, +]); + +var part97 = // "Pattern{Constant('"'), Field(fld6,false), Constant('"')}" +match("MESSAGE#27:statistics:04/16_0", "nwparser.p0", "\"%{fld6}\""); + +var part98 = // "Pattern{Field(fld6,false)}" +match_copy("MESSAGE#27:statistics:04/16_1", "nwparser.p0", "fld6"); + +var select35 = linear_select([ + part97, + part98, +]); + +var all24 = all_match({ + processors: [ + dup35, + select22, + select23, + select24, + select25, + select26, + select27, + select28, + select29, + select30, + select31, + select32, + select33, + dup78, + dup79, + select34, + select35, + ], + on_success: processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg28 = msg("statistics:04", all24); + +var part99 = tagval("MESSAGE#28:statistics:05", "nwparser.payload", tvm, { + "classifier": "filter", + "client_ip": "saddr", + "client_name": "fqdn", + "direction": "direction", + "disposition": "disposition", + "domain": "domain", + "dst_ip": "daddr", + "from": "from", + "hfrom": "fld3", + "mailer": "agent", + "message_length": "fld6", + "polid": "fld5", + "resolved": "context", + "session_id": "sessionid", + "src_type": "fld7", + "subject": "subject", + "to": "to", + "virus": "virusname", +}, processor_chain([ + dup60, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, +])); + +var msg29 = msg("statistics:05", part99); + +var select36 = linear_select([ + msg24, + msg25, + msg26, + msg27, + msg28, + msg29, +]); + +var part100 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" client_name="'), Field(p0,false)}" +match("MESSAGE#29:spam/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=\"%{p0}"); + +var part101 = // "Pattern{Field(sessionid,true), Constant(' client_name="'), Field(p0,false)}" +match("MESSAGE#29:spam/1_1", "nwparser.p0", "%{sessionid->} client_name=\"%{p0}"); + +var select37 = linear_select([ + part100, + part101, +]); + +var part102 = // "Pattern{Field(,false), Constant('from='), Field(p0,false)}" +match("MESSAGE#29:spam/3", "nwparser.p0", "%{}from=%{p0}"); + +var part103 = // "Pattern{Constant('"'), Field(to,false), Constant('" subject='), Field(p0,false)}" +match("MESSAGE#29:spam/5_0", "nwparser.p0", "\"%{to}\" subject=%{p0}"); + +var part104 = // "Pattern{Field(to,true), Constant(' subject='), Field(p0,false)}" +match("MESSAGE#29:spam/5_1", "nwparser.p0", "%{to->} subject=%{p0}"); + +var select38 = linear_select([ + part103, + part104, +]); + +var part105 = // "Pattern{Constant('"'), Field(subject,false), Constant('" msg='), Field(p0,false)}" +match("MESSAGE#29:spam/6_0", "nwparser.p0", "\"%{subject}\" msg=%{p0}"); + +var part106 = // "Pattern{Field(subject,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#29:spam/6_1", "nwparser.p0", "%{subject->} msg=%{p0}"); + +var select39 = linear_select([ + part105, + part106, +]); + +var all25 = all_match({ + processors: [ + dup35, + select37, + dup74, + part102, + dup69, + select38, + select39, + dup64, + ], + on_success: processor_chain([ + dup62, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg30 = msg("spam", all25); + +var part107 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name="'), Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(fld2,false), Constant(')" dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" +match("MESSAGE#30:spam:04", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{fqdn->} [%{saddr}] (%{fld2})\" dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ + dup62, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, +])); + +var msg31 = msg("spam:04", part107); + +var part108 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name='), Field(p0,false)}" +match("MESSAGE#31:spam:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=%{p0}"); + +var part109 = // "Pattern{Constant('"'), Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']" '), Field(p0,false)}" +match("MESSAGE#31:spam:03/1_0", "nwparser.p0", "\"%{fqdn->} [%{saddr}]\" %{p0}"); + +var part110 = // "Pattern{Constant(' "'), Field(fqdn,false), Constant('" client_ip="'), Field(saddr,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#31:spam:03/1_1", "nwparser.p0", " \"%{fqdn}\" client_ip=\"%{saddr}\"%{p0}"); + +var select40 = linear_select([ + part109, + part110, +]); + +var part111 = // "Pattern{Field(,false), Constant('dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" +match("MESSAGE#31:spam:03/2", "nwparser.p0", "%{}dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\""); + +var all26 = all_match({ + processors: [ + part108, + select40, + part111, + ], + on_success: processor_chain([ + dup62, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg32 = msg("spam:03", all26); + +var part112 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" +match("MESSAGE#32:spam:02", "nwparser.payload", "session_id=\"%{sessionid}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ + dup62, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, +])); + +var msg33 = msg("spam:02", part112); + +var part113 = // "Pattern{Constant('"'), Field(to,false), Constant('" msg='), Field(p0,false)}" +match("MESSAGE#33:spam:01/3_0", "nwparser.p0", "\"%{to}\" msg=%{p0}"); + +var part114 = // "Pattern{Field(to,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#33:spam:01/3_1", "nwparser.p0", "%{to->} msg=%{p0}"); + +var select41 = linear_select([ + part113, + part114, +]); + +var all27 = all_match({ + processors: [ + dup35, + dup71, + dup69, + select41, + dup64, + ], + on_success: processor_chain([ + dup62, + dup8, + dup9, + dup10, + dup11, + dup12, + dup34, + dup15, + ]), +}); + +var msg34 = msg("spam:01", all27); + +var select42 = linear_select([ + msg30, + msg31, + msg32, + msg33, + msg34, +]); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "event_admin": msg1, + "event_config": msg20, + "event_imap": msg5, + "event_pop3": msg2, + "event_smtp": select7, + "event_system": msg4, + "event_update": msg19, + "event_webmail": msg3, + "spam": select42, + "statistics": select36, + "virus": msg21, + "virus_file-signature": msg23, + "virus_infected": msg22, + }), +]); + +var part115 = // "Pattern{Constant('user='), Field(username,true), Constant(' ui='), Field(p0,false)}" +match("MESSAGE#0:event_admin/0", "nwparser.payload", "user=%{username->} ui=%{p0}"); + +var part116 = // "Pattern{Field(network_service,false), Constant('('), Field(saddr,false), Constant(') action='), Field(p0,false)}" +match("MESSAGE#0:event_admin/1_0", "nwparser.p0", "%{network_service}(%{saddr}) action=%{p0}"); + +var part117 = // "Pattern{Field(network_service,true), Constant(' action='), Field(p0,false)}" +match("MESSAGE#0:event_admin/1_1", "nwparser.p0", "%{network_service->} action=%{p0}"); + +var part118 = // "Pattern{Constant('"'), Field(event_description,false), Constant('"')}" +match("MESSAGE#0:event_admin/3_0", "nwparser.p0", "\"%{event_description}\""); + +var part119 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#0:event_admin/3_1", "nwparser.p0", "event_description"); + +var part120 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#1:event_pop3/2", "nwparser.p0", "%{action->} status=%{event_state->} msg=%{p0}"); + +var part121 = // "Pattern{Constant('user='), Field(username,false), Constant('ui='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/0", "nwparser.payload", "user=%{username}ui=%{p0}"); + +var part122 = // "Pattern{Field(network_service,false), Constant('('), Field(hostip,false), Constant(') action='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/1_0", "nwparser.p0", "%{network_service}(%{hostip}) action=%{p0}"); + +var part123 = // "Pattern{Field(network_service,false), Constant('action='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/1_1", "nwparser.p0", "%{network_service}action=%{p0}"); + +var part124 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/2", "nwparser.p0", "%{action}status=%{event_state}session_id=%{p0}"); + +var part125 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('"msg="STARTTLS='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/3_0", "nwparser.p0", "\"%{sessionid}\"msg=\"STARTTLS=%{p0}"); + +var part126 = // "Pattern{Field(sessionid,false), Constant('msg="STARTTLS='), Field(p0,false)}" +match("MESSAGE#5:event_smtp:01/3_1", "nwparser.p0", "%{sessionid}msg=\"STARTTLS=%{p0}"); + +var part127 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" msg='), Field(p0,false)}" +match("MESSAGE#16:event_smtp/3_0", "nwparser.p0", "\"%{sessionid}\" msg=%{p0}"); + +var part128 = // "Pattern{Field(sessionid,true), Constant(' msg='), Field(p0,false)}" +match("MESSAGE#16:event_smtp/3_1", "nwparser.p0", "%{sessionid->} msg=%{p0}"); + +var part129 = // "Pattern{Constant('from='), Field(p0,false)}" +match("MESSAGE#20:virus/0", "nwparser.payload", "from=%{p0}"); + +var part130 = // "Pattern{Constant('"'), Field(from,false), Constant('" to='), Field(p0,false)}" +match("MESSAGE#20:virus/1_0", "nwparser.p0", "\"%{from}\" to=%{p0}"); + +var part131 = // "Pattern{Field(from,true), Constant(' to='), Field(p0,false)}" +match("MESSAGE#20:virus/1_1", "nwparser.p0", "%{from->} to=%{p0}"); + +var part132 = // "Pattern{Constant('"'), Field(to,false), Constant('" src='), Field(p0,false)}" +match("MESSAGE#20:virus/2_0", "nwparser.p0", "\"%{to}\" src=%{p0}"); + +var part133 = // "Pattern{Field(to,true), Constant(' src='), Field(p0,false)}" +match("MESSAGE#20:virus/2_1", "nwparser.p0", "%{to->} src=%{p0}"); + +var part134 = // "Pattern{Constant('"'), Field(saddr,false), Constant('" session_id='), Field(p0,false)}" +match("MESSAGE#20:virus/3_0", "nwparser.p0", "\"%{saddr}\" session_id=%{p0}"); + +var part135 = // "Pattern{Field(saddr,true), Constant(' session_id='), Field(p0,false)}" +match("MESSAGE#20:virus/3_1", "nwparser.p0", "%{saddr->} session_id=%{p0}"); + +var part136 = // "Pattern{Constant('session_id='), Field(p0,false)}" +match("MESSAGE#23:statistics/0", "nwparser.payload", "session_id=%{p0}"); + +var part137 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" from='), Field(p0,false)}" +match("MESSAGE#23:statistics/1_0", "nwparser.p0", "\"%{sessionid}\" from=%{p0}"); + +var part138 = // "Pattern{Field(sessionid,true), Constant(' from='), Field(p0,false)}" +match("MESSAGE#23:statistics/1_1", "nwparser.p0", "%{sessionid->} from=%{p0}"); + +var part139 = // "Pattern{Constant('"'), Field(from,false), Constant('" mailer='), Field(p0,false)}" +match("MESSAGE#23:statistics/2_0", "nwparser.p0", "\"%{from}\" mailer=%{p0}"); + +var part140 = // "Pattern{Field(from,true), Constant(' mailer='), Field(p0,false)}" +match("MESSAGE#23:statistics/2_1", "nwparser.p0", "%{from->} mailer=%{p0}"); + +var part141 = // "Pattern{Constant('"'), Field(agent,false), Constant('" client_name="'), Field(p0,false)}" +match("MESSAGE#23:statistics/3_0", "nwparser.p0", "\"%{agent}\" client_name=\"%{p0}"); + +var part142 = // "Pattern{Field(agent,true), Constant(' client_name="'), Field(p0,false)}" +match("MESSAGE#23:statistics/3_1", "nwparser.p0", "%{agent->} client_name=\"%{p0}"); + +var part143 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(info,false), Constant(')"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); + +var part144 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); + +var part145 = // "Pattern{Field(saddr,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); + +var part146 = // "Pattern{Constant('"'), Field(context,false), Constant('" to='), Field(p0,false)}" +match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); + +var part147 = // "Pattern{Field(context,true), Constant(' to='), Field(p0,false)}" +match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); + +var part148 = // "Pattern{Constant('"'), Field(to,false), Constant('" direction='), Field(p0,false)}" +match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); + +var part149 = // "Pattern{Field(to,true), Constant(' direction='), Field(p0,false)}" +match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); + +var part150 = // "Pattern{Constant('"'), Field(direction,false), Constant('" message_length='), Field(p0,false)}" +match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); + +var part151 = // "Pattern{Field(direction,true), Constant(' message_length='), Field(p0,false)}" +match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); + +var part152 = // "Pattern{Field(fld4,true), Constant(' virus='), Field(p0,false)}" +match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); + +var part153 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" disposition='), Field(p0,false)}" +match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); + +var part154 = // "Pattern{Field(virusname,true), Constant(' disposition='), Field(p0,false)}" +match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); + +var part155 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" classifier='), Field(p0,false)}" +match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); + +var part156 = // "Pattern{Field(disposition,true), Constant(' classifier='), Field(p0,false)}" +match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); + +var part157 = // "Pattern{Constant('"'), Field(filter,false), Constant('" subject='), Field(p0,false)}" +match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); + +var part158 = // "Pattern{Field(filter,true), Constant(' subject='), Field(p0,false)}" +match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); + +var part159 = // "Pattern{Constant('"'), Field(subject,false), Constant('"')}" +match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); + +var part160 = // "Pattern{Field(subject,false)}" +match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); + +var part161 = // "Pattern{Field(,false), Constant('resolved='), Field(p0,false)}" +match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); + +var select43 = linear_select([ + dup3, + dup4, +]); + +var select44 = linear_select([ + dup5, + dup6, +]); + +var select45 = linear_select([ + dup19, + dup20, +]); + +var select46 = linear_select([ + dup22, + dup23, +]); + +var select47 = linear_select([ + dup3, + dup20, +]); + +var select48 = linear_select([ + dup24, + dup25, +]); + +var select49 = linear_select([ + dup27, + dup28, +]); + +var select50 = linear_select([ + dup29, + dup30, +]); + +var select51 = linear_select([ + dup36, + dup37, +]); + +var select52 = linear_select([ + dup38, + dup39, +]); + +var select53 = linear_select([ + dup40, + dup41, +]); + +var select54 = linear_select([ + dup42, + dup43, + dup44, +]); + +var select55 = linear_select([ + dup45, + dup46, +]); + +var select56 = linear_select([ + dup47, + dup48, +]); + +var select57 = linear_select([ + dup49, + dup50, +]); + +var select58 = linear_select([ + dup52, + dup53, +]); + +var select59 = linear_select([ + dup54, + dup55, +]); + +var select60 = linear_select([ + dup56, + dup57, +]); + +var select61 = linear_select([ + dup58, + dup59, +]); + +var all28 = all_match({ + processors: [ + dup2, + dup63, + dup16, + dup64, + ], + on_success: processor_chain([ + dup17, + dup8, + dup9, + dup10, + dup11, + dup12, + dup13, + dup14, + dup15, + ]), +}); diff --git a/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml new file mode 100644 index 00000000000..ef17c6f4130 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Fortinet FortiMail + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/fortinet/fortimail/manifest.yml b/x-pack/filebeat/module/fortinet/fortimail/manifest.yml new file mode 100644 index 00000000000..321a6ff308a --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["fortinet.fortimail", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9529 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/fortinet/fortimail/test/generated.log b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log new file mode 100644 index 00000000000..0e5a02242a5 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log @@ -0,0 +1,100 @@ +date=2016-1-29 time=06:09:59 device_id=pexe log_id=nes log_part=eab type=event subtype=update pri=high msg="boNemoe" +date=2016-2-12 time=13:12:33 device_id=ehend log_id=ritquiin log_part=umqui type=virus subtype=infected pri=very-high from="mest" to=enderitq client_name="sperna884.internal.domain" client_ip="10.165.201.71" session_id="pisciv" msg="uii" +date=2016-2-26 time=20:15:08 device_id=doeiu log_id=nia log_part=olupt type=event subtype=config pri=low user=quipexe ui=alo(10.212.18.145) module=umdo submodule=itessequ msg=vol +date=2016-3-12 time=03:17:42 device_id=uipexea log_id=tatio log_part=minim type=event subtype=pop3 pri=high user=ceroinBC ui=ratvolup action=deny status=iatu msg="ionofde" +date=2016-3-26 time=10:20:16 device_id=itati log_id=mfu log_part=uid type=event subtype=pop3 pri=very-high user=obeataev ui=lor action=block status=autfu msg="natura" +date=2016-4-9 time=17:22:51 device_id=llamcorp log_id=ari log_part=eataevit type=event subtype=system pri=high user=iam ui=mqua action=allow status=olab msg=mquisnos +date=2016-4-24 time=00:25:25 device_id=enimad log_id=incididu log_part=eci type=virus pri=very-high from=tenbyCic to=boree src=10.98.69.43 session_id="iinea" msg=ipit +date=2016-5-8 time=07:27:59 device_id=taliqu log_id=temUten log_part=ccusan type=virus subtype=infected pri=low from="Ciceroi" to="aveniam" client_name="uradi7307.internal.corp" client_ip="10.118.96.139" session_id="sitas" msg=ehenderi +date=2016-5-22 time=14:30:33 device_id=smo log_id=litessec log_part=emporinc type=event subtype=pop3 pri=very-high user=ipsumq ui=atcu action=allow status=tessec msg="remipsum" +date=2016-6-5 time=21:33:08 device_id=ntutl log_id=caecatc log_part=onsequat type=event subtype=update pri=low msg="edquiano" +date=2016-6-20 time=04:35:42 device_id=idestla log_id=Nemoeni log_part=uradi type=statistics pri=very-high session_id="lup" from="remeumf" mailer=antiumto client_name="10.241.165.37" MSISDN=aUteni resolved=ittenbyC to="aperi" direction="inbound" message_length=ita virus="ipi" disposition=rsitamet classifier="lupt" subject="xea" +date=2016-7-4 time=11:38:16 device_id=amvolup log_id=sequi log_part=rehend type=event subtype=webmail pri=high user=eme ui=numqu(10.232.149.140) action=allow status=lum msg=utali +date=2016-7-18 time=18:40:50 device_id=estiae log_id=sci log_part=oei type=virus_file-signature pri=low snostrud to=nama src="10.24.67.250" session_id="dolor" msg="nnum" +date=2016-8-2 time=01:43:25 device_id=oluptas log_id=tNequepo log_part=lup type=event subtype=update pri=medium msg=equat +date=2016-8-16 time=08:45:59 device_id=abi log_id=sectetur log_part=uioffi type=event subtype=update pri=high msg=veniamq +date=2016-8-30 time=15:48:33 device_id=orem log_id=beata log_part=hitecto type=statistics pri=very-high session_id="texp" client_name="[10.179.124.125]"dst_ip="10.177.36.38" from="sequine" to="ectio" polid="dutper" domain="lamcolab3252.www.invalid" subject="gel" mailer="lorsitam" resolved="mpo" direction="inbound" virus="ris" disposition="uamqu" classifier="lor" message_length=oide +date=2016-9-13 time=22:51:07 device_id=didunt log_id=uptatema log_part=intocc type=virus subtype=file-signature pri=very-high from="orema" to=invento src=[10.164.39.248] session_id="nofdeFin" msg=sequam +date=2016-9-28 time=05:53:42 device_id=tvolu log_id=ecte log_part=tinvolu type=virus_file-signature pri=high from="ntiumdo" to="autfu" src=gnaaliq [10.52.135.156] session_id="litse" msg="icabo" +date=2016-10-12 time=12:56:16 device_id=stru log_id=tectobe log_part=Nequepo type=event subtype=config pri=very-high user=pora ui=boree module=evolup submodule=ionofdeF msg="evelit" +date=2016-10-26 time=19:58:50 device_id=uatD log_id=ariatu log_part=edquiac type=event subtype=smtp pri=high user=atno ui=tani action=allow status=ntocca session_id=ostru log_part=ntoccae msg=autf +date=2016-11-10 time=03:01:24 device_id=tenimad log_id=minimav log_part=udexerci type=spam pri=very-high session_id="itam" client_name="str976.internal.localhost [10.166.225.26]" from=tanimid to=umdo subject="natuse" msg="gnamal" +date=2016-11-24 time=10:03:59 device_id=intoc log_id=rQuisau log_part=itess type=virus subtype=infected pri=high from=evit to="runtm" client_name="molli4306.www5.home" client_ip="10.218.243.47" session_id="borios" msg=rsitvolu +date=2016-12-8 time=17:06:33 device_id=quamqua log_id=eacommod log_part=ctetura type=event subtype=imap pri=high user=tpersp ui=stla action=allow status=sequamni msg=uradi +date=2016-12-23 time=00:09:07 device_id=dolore log_id=onsecte log_part=nBCSedut type=virus subtype=file-signature pri=high from="modocons" to=gitsed src="10.16.177.212" session_id="emp" msg="Attachment file (pisciv) has sha1 hash value: lumdolor" +date=2017-1-6 time=07:11:41 device_id=uaUten log_id=nby log_part=mve type=event subtype=config pri=low user=isau ui=rautodi(10.96.97.81) module=pis submodule=nsequat msg=doloreme +date=2017-1-20 time=14:14:16 device_id=aec log_id=fdeF log_part=iquidexe type=spam pri=low session_id="niamq" client_name= "lapariat7287.internal.host" client_ip="10.140.7.83" dst_ip="10.68.246.187" from="icabo" to="gna" subject="con" msg="preh" +date=2017-2-3 time=21:16:50 device_id=amcor log_id=ica log_part=lillum type=event subtype=admin pri=very-high user=dicta ui=taedicta action=accept status=poriss reason=failure msg=equaturv +date=2017-2-18 time=04:19:24 device_id=tpersp log_id=llamc log_part=nte type=event subtype=pop3 pri=very-high user=utali ui=porinc(10.48.204.44) action=accept status=dat msg=aincidu +date=2017-3-4 time=11:21:59 device_id=dipisci log_id=spernatu log_part=admi type=event subtype=pop3 pri=very-high user=quunt ui=olori action=allow status=autodit msg=elit +date=2017-3-18 time=18:24:33 device_id=nte log_id=ulpa log_part=sitam type=virus subtype=file-signature pri=low enderit to=sequa src="[10.111.233.194]" session_id=eirure msg=deserun +date=2017-4-2 time=01:27:07 device_id=ptateve log_id=enderi log_part=ptatem type=event subtype=smtp pri=very-high user=fugi ui=labo action=block status=ullamcor session_id=itationu msg=proident +date=2017-4-16 time=08:29:41 device_id=atione log_id=lores log_part=ritati type=statistics pri=very-high session_id=uii client_name=estl5804.internal.local client_ip=10.73.207.70 dst_ip=10.179.210.218 from=taut hfrom=tanimi to=rumSecti polid=iuntNe domain=atise3421.www5.localdomain mailer=oluptas resolved=emvele src_type=isnost direction=inbound virus=Sedut disposition=yCiceroi classifier=quunt message_length=acommod subject=sitvol +date=2017-4-30 time=15:32:16 device_id=liquide log_id=odt log_part=Sedutpe type=event subtype=admin pri=medium user=rroq ui=rcit(10.43.62.246) action=accept status=estl reason=success msg=citatio +date=2017-5-14 time=22:34:50 device_id=taedict log_id=edquian log_part=loremeu type=event subtype=admin pri=very-high user=volupta ui=dmi action=allow status=aaliq reason=unknown msg=lupta +date=2017-5-29 time=05:37:24 device_id=occ log_id=oloreseo log_part=iruredol type=virus subtype=file-signature pri=very-high derit to=orese src="[10.28.105.124]" session_id="strude" msg=eritin +date=2017-6-12 time=12:39:58 device_id=temUten log_id=dutper log_part=sitamet type=event subtype=admin pri=very-high user=illumqui ui=saq action=block status=ritqu reason=unknown msg="idolor" +date=2017-6-26 time=19:42:33 device_id=quide log_id=quaU log_part=undeomni type=virus_file-signature pri=medium acomm to=iutali src="[10.219.13.150]" session_id=Finibus msg=radi +date=2017-7-11 time=02:45:07 device_id=inrepr log_id=mol log_part=umdolors type=event subtype=pop3 pri=medium user=imad ui=oriosam(10.163.114.215) action=deny status=sitametc msg=onsequa +date=2017-7-25 time=09:47:41 device_id=riosa log_id=tNe log_part=pisc type=event subtype=webmail pri=very-high user=caecat ui=rautod(10.124.32.120) action=accept status=atcupi msg=atem +date=2017-8-8 time=16:50:15 device_id=undeom log_id=emullamc log_part=tec type=event subtype=imap pri=medium user=eetdo ui=tlab action=cancel status=liq msg=seddoeiu +date=2017-8-22 time=23:52:50 device_id=edictasu log_id=mdolors log_part=oremi type=event subtype=imap pri=medium user=atis ui=atDuis action=accept status=nisiut msg="rumwri" +date=2017-9-6 time=06:55:24 device_id=lumqu log_id=onulamco log_part=ons type=event subtype=pop3 pri=low user=uptat ui=unt action=accept status=uido msg=tla +date=2017-9-20 time=13:57:58 device_id=uamqu log_id=olori log_part=ido type=spam pri=low session_id="sunt" from="autfugit" to="emUte" msg=iusmodi +date=2017-10-4 time=21:00:32 device_id=umS log_id=iciadese log_part=riatur type=event subtype=webmail pri=very-high user=xeacommo ui=Cicero(10.247.53.179) action=cancel status=ditau msg=atemaccu +date=2017-10-19 time=04:03:07 device_id=urau log_id=etur log_part=rsitvol type=event subtype=config pri=low user=laborum ui=ostr(10.70.91.185) module=lumdo submodule=acom msg="eFini" +date=2017-11-2 time=11:05:41 device_id=upta log_id=itessequ log_part=iusmodit type=event subtype=update pri=very-high msg=exerci +date=2017-11-16 time=18:08:15 device_id=mmodoco log_id=amni log_part=atnul type=event subtype=webmail pri=medium user=iquidexe ui=illumq(10.215.65.52) action=accept status=tasnul msg="tuserr" +date=2017-12-1 time=01:10:49 device_id=porinc log_id=riame log_part=riat type=event subtype=admin pri=medium user=rumSec ui=orp action=deny status=udan reason=unknown msg="essequam" +date=2017-12-15 time=08:13:24 device_id=itse log_id=ilm log_part=mvel type=virus subtype=infected pri=high from=seos to=exercita client_name="edolori3822.api.home" client_ip="10.63.177.46" session_id="oluptate" msg=lit +date=2017-12-29 time=15:15:58 device_id=iciade log_id=uis log_part=amc type=event subtype=webmail pri=medium user=Ute ui=ptassita action=allow status=runtm msg="eturadip" +date=2018-1-12 time=22:18:32 device_id=colabori log_id=imidestl log_part=piscing type=virus subtype=file-signature pri=high from="isn" to=smod src="idunt [10.29.120.226]" session_id="atev" msg="ectio" +date=2018-1-27 time=05:21:06 device_id=atcupid log_id=onse log_part=psa type=virus_file-signature pri=high destla to="fugitse" src=[10.12.86.130] session_id=dese msg="Attachment file (duntutla) has sha1 hash value: lamco" +date=2018-2-10 time=12:23:41 device_id=gna log_id=ici log_part=quamnih type=event subtype=pop3 pri=low user=iameaque ui=identsun action=deny status=aquio msg="rspicia" +date=2018-2-24 time=19:26:15 device_id=uiineavo log_id=sistena log_part=uidexeac type=virus subtype=infected pri=high from="amquisno" to=modoc client_name="magnam3267.corp" client_ip="10.95.32.86" session_id="Bonorum" msg=lesti +date=2018-3-11 time=02:28:49 device_id=lupta log_id=byC log_part=imadm type=spam pri=low session_id="nci" from="orroquis" to="ulapa" subject="iumdo" msg="iusmodit" +date=2018-3-25 time=09:31:24 device_id=obeataev log_id=umf log_part=olesti type=event subtype=config pri=low user=quaeabil ui=emip module=aturQu submodule=itesse msg="iamqui" +date=2018-4-8 time=16:33:58 device_id=inim log_id=etdol log_part=Sed type=event subtype=pop3 pri=very-high user=tten ui=etur action=allow status=mipsumqu msg="eprehen" +date=2018-4-22 time=23:36:32 device_id=itaedict log_id=olorema log_part=rep type=event subtype=update pri=low msg=ptatemse +date=2018-5-7 time=06:39:06 device_id=eleumi log_id=edic log_part=udexerc type=event subtype=pop3 pri=low user=olabori ui=odic action=block status=lica msg=secil +date=2018-5-21 time=13:41:41 device_id=nimadmin log_id=midest log_part=modt type=event subtype=update pri=very-high msg=tocca +date=2018-6-4 time=20:44:15 device_id=usant log_id=mipsumq log_part=ident type=event subtype=config pri=very-high user=sequatD ui=ercitati(10.40.89.185) module=temse submodule=caecat msg="cusanti" +date=2018-6-19 time=03:46:49 device_id=conseq log_id=itame log_part=tenat type=virus subtype=infected pri=very-high from="yCiceroi" to="nostrum" client_name="orroquis5179.local" client_ip="10.252.96.71" session_id="tvolu" msg="dutper" +date=2018-7-3 time=10:49:23 device_id=ugiatqu log_id=eruntmo log_part=nimve type=virus subtype=infected pri=very-high from=natus to=boreet client_name="luptasnu757.www.home" client_ip="10.174.210.232" session_id=ovolupta msg="volup" +date=2018-7-17 time=17:51:58 device_id=Bonoru log_id=rcitati log_part=nula type=event subtype=imap pri=medium user=deomni ui=adipi(10.120.232.62) action=block status=ntutl msg="volupt" +date=2018-8-1 time=00:54:32 device_id=mquameiu log_id=loremq log_part=turmagni type=event subtype=imap pri=very-high user=emUtenim ui=ende action=block status=amnis msg=rvelil +date=2018-8-15 time=07:57:06 device_id=rumetMa log_id=mexerci log_part=urEx type=virus subtype=file-signature pri=medium liq to=abore src=10.200.225.45 session_id=dol msg=exe +date=2018-8-29 time=14:59:40 device_id=audant log_id=rspicia log_part=pitl type=statistics pri=high session_id=mmod client_name=taevit4968.mail.local client_ip=10.144.111.42 dst_ip=10.62.61.1 from=lam hfrom=asnu to=com polid=rep domain=mveni5084.internal.local mailer=num resolved=ctetura src_type=quaerat direction=inbound virus=umexer disposition=amnih classifier=tper message_length=pisciv subject=tconsect +date=2018-9-12 time=22:02:15 device_id=emipsumq log_id=culpaq log_part=quamq type=event subtype=pop3 pri=medium user=emvel ui=pta(10.183.213.223) action=block status=hend msg=remagna +date=2018-9-27 time=05:04:49 device_id=lauda log_id=plicaboN log_part=dolo type=virus subtype=file-signature pri=medium from="elit" to=sam src="tMal [10.52.190.18]" session_id=isni msg=quid +date=2018-10-11 time=12:07:23 device_id=inibus log_id=secte log_part=ctobeat type=event subtype=config pri=low user=iqui ui=animide module=pid submodule=itanimi msg="onoru" +date=2018-10-25 time=19:09:57 device_id=naaliq log_id=plica log_part=asiarc type=event subtype=imap pri=low user=seq ui=snula(10.203.110.206) action=deny status=dipi msg=ecatc +date=2018-11-9 time=02:12:32 device_id=dolo log_id=velites log_part=oloremi type=virus_file-signature pri=high apari to=tsunt src="caecat [10.108.10.197]" session_id=enim msg="Attachment file (umq) has sha1 hash value: sistena" +date=2018-11-23 time=09:15:06 device_id=imipsam log_id=eumiu log_part=tatevel type=event subtype=smtp pri=high user=quisnostui=sequines(10.115.154.104) action=cancelstatus=lorumsession_id="suntexpl" msg="DSN: to <; reason:success; sessionid:tatis" +date=2018-12-7 time=16:17:40 device_id=econ log_id=aborio log_part=rve type=event subtype=smtp pri=medium user=nbyCiui=runtmollaction=blockstatus=velillumsession_id="ionev" msg="to=<, delay=rna, xdelay=cons, mailer=ipv6-icmp, pri=lupta, relay=olaboris3175.internal.home[10.250.94.95], dsn=tno, stat=imvenia" +date=2018-12-21 time=23:20:14 device_id=atevelit log_id=ugitsed log_part=dminimve type=virus subtype=file-signature pri=very-high from="onse" to=uiac src=tquii [10.164.49.95] session_id=emeumfu msg="inBCSedu" +date=2019-1-5 time=06:22:49 device_id=ddo log_id=emp log_part=inBC type=event subtype=smtp pri=low user=eacommui=aboNem(10.11.45.141) action=allowstatus=remasession_id="mcol"msg="STARTTLS=tion, cert-subject=umquia, cert-issuer=lorsita, verifymsg=spici" +date=2019-1-19 time=13:25:23 device_id=odit log_id=vol log_part=epteurs type=statistics pri=very-high session_id="cteturad" client_name="modi6930.internal.test[10.60.164.100]"dst_ip="10.161.1.146" from="etconse" to="nproiden" polid="ionem" domain="taevitae6868.www.corp" subject="ehende" mailer="rep" resolved="nostru" direction="internal" virus="ipiscin" disposition="trudexe" classifier="qua" message_length=modit +date=2019-2-2 time=20:27:57 device_id=orsit log_id=deFinibu log_part=iaecons type=event subtype=admin pri=very-high user=rautod ui=onorumet(10.157.118.41) action=cancel status=chit reason=unknown msg="erspici" +date=2019-2-17 time=03:30:32 device_id=quidol log_id=tinv log_part=Utenima type=statistics pri=high session_id=temqu client_name=uradip7802.mail.example client_ip=10.44.35.57 dst_ip=10.93.239.216 from=vento hfrom=litsed to=ciun polid=rehender domain=tetura7106.www5.corp mailer=eosquir resolved=tqu src_type=emips direction=internal virus=tinvolu disposition=ptat classifier=amquisn message_length=Finibus subject=nsequat +date=2019-3-3 time=10:33:06 device_id=evelite log_id=remquela log_part=toreve type=event subtype=update pri=high msg="dolor" +date=2019-3-17 time=17:35:40 device_id=itse log_id=lapari log_part=Bonor type=event subtype=update pri=medium msg=exeaco +date=2019-4-1 time=00:38:14 device_id=emvele log_id=tNeq log_part=olorsita type=virus_file-signature pri=medium eleumiu to=etdol src="imadmin [10.123.154.140]" session_id=liqu msg=dolor +date=2019-4-15 time=07:40:49 device_id=aliq log_id=utem log_part=oreetd type=event subtype=imap pri=very-high user=mremape ui=ude action=deny status=emac msg=rmagnido +date=2019-4-29 time=14:43:23 device_id=pariatur log_id=cita log_part=tvo type=event subtype=admin pri=high user=rve ui=atemacc(10.141.108.1) action=deny status=ciunt reason=success msg="beataevi" +date=2019-5-13 time=21:45:57 device_id=imaven log_id=dmin log_part=sum type=event subtype=system pri=low user=lore ui=nim action=cancel status=edquiac msg=psamvolu +date=2019-5-28 time=04:48:31 device_id=iade log_id=tae log_part=obe type=event subtype=admin pri=medium user=ulapari ui=rittenby(10.31.31.193) action=deny status=nvol reason=unknown msg="luptatem" +date=2019-6-11 time=11:51:06 device_id=conse log_id=ruredolo log_part=ati type=event subtype=system pri=low user=olors ui=roid(10.234.156.8) action=block status=uteiru msg="xer" +date=2019-6-25 time=18:53:40 device_id=nvol log_id=uame log_part=quia type=event subtype=update pri=very-high msg="labor" +date=2019-7-10 time=01:56:14 device_id=mwritte log_id=modit log_part=quamnih type=event subtype=config pri=medium user=itanimid ui=uiin module=nibusBo submodule=iusm msg="nostru" +date=2019-7-24 time=08:58:48 device_id=vel log_id=preh log_part=madmini type=event subtype=update pri=high msg=edutpers +date=2019-8-7 time=16:01:23 device_id=sBonoru log_id=everi log_part=squ type=virus subtype=file-signature pri=medium from="utla" to=nse src=10.160.236.78 session_id=nostrude msg="Attachment file (rinc) has sha1 hash value: tno" +date=2019-8-21 time=23:03:57 device_id=cid log_id=nonproi log_part=dolor type=event subtype=admin pri=medium user=molli ui=oeiusm(10.244.19.62) action=accept status=nnumquam reason=unknown msg="tdolore" +date=2019-9-5 time=06:06:31 device_id=icta log_id=epteu log_part=nvent type=event subtype=webmail pri=high user=mquiavol ui=odiconse(10.147.52.164) action=allow status=untutl msg=ugiatnul +date=2019-9-19 time=13:09:05 device_id=quaturve log_id=elaudant log_part=olup type=spam pri=high session_id="iacon" client_name= "ncu3839.www.localhost" client_ip="10.201.105.58" dst_ip="10.251.183.113" from="ent" to="ionemu" subject="eseosqu" msg="uptatem" +date=2019-10-3 time=20:11:40 device_id=eprehen log_id=oinB log_part=lor type=statistics pri=low session_id="citatio" client_name="[10.209.203.156]"dst_ip="10.132.139.98" from="pariat" to="borisnis" direction="unknown" virus="oremagn" disposition="emagna" classifier="uidolor" message_length=remag +date=2019-10-18 time=03:14:14 device_id=tiumtot log_id=ulamcola log_part=epr type=event subtype=admin pri=low user=nculpa ui=enbyCice(10.152.196.145) action=block status=uptas reason=success msg="iadeseru" +date=2019-11-1 time=10:16:48 device_id=equ log_id=turadip log_part=ataev type=virus_file-signature pri=medium from="oree" to="nimadmi" src="utaliq [10.78.38.143]" session_id=qui msg="Attachment file (epteurs) has sha1 hash value: did" +date=2019-11-15 time=17:19:22 device_id=sunt log_id=orumSe log_part=olupta type=event subtype=update pri=very-high msg=pta +date=2019-11-30 time=00:21:57 device_id=ntutlabo log_id=leumiure log_part=tasnu type=event subtype=smtp pri=high user=amquaui=tionevol(10.209.124.81) action=allowstatus=tobesession_id="ssequa" log_part=emp msg="to=<; reason:success; sessionid:tatis\"", + "fileset.name": "fortimail", + "host.ip": "10.115.154.104", + "input.type": "log", + "log.level": "high", + "log.offset": 14016, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.115.154.104" + ], + "related.user": [ + "quisnost" + ], + "rsa.email.email_dst": "iqu", + "rsa.internal.messageid": "event_smtp", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "smtp", + "rsa.misc.event_state": "lorum", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "imipsam", + "rsa.misc.log_session_id": "suntexpl", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "smtp", + "rsa.misc.reference_id": "eumiu", + "rsa.misc.reference_id1": "tatevel", + "rsa.misc.result": "success", + "rsa.misc.severity": "high", + "rsa.network.network_service": "sequines", + "rsa.time.event_time": "2018-11-23T11:15:06.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.115.154.104" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "quisnost" + }, + { + "@timestamp": "2018-12-07T18:17:40.000Z", + "event.action": "block", + "event.code": "aborio", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2018-12-7 time=16:17:40 device_id=econ log_id=aborio log_part=rve type=event subtype=smtp pri=medium user=nbyCiui=runtmollaction=blockstatus=velillumsession_id=\"ionev\" msg=\"to=<, delay=rna, xdelay=cons, mailer=ipv6-icmp, pri=lupta, relay=olaboris3175.internal.home[10.250.94.95], dsn=tno, stat=imvenia\"", + "fileset.name": "fortimail", + "host.hostname": "olaboris3175.internal.home", + "input.type": "log", + "log.level": "medium", + "log.offset": 14269, + "network.protocol": "ipv6-icmp", + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.250.94.95" + ], + "related.user": [ + "nbyCi" + ], + "rsa.email.email_dst": "vitaedi", + "rsa.internal.messageid": "event_smtp", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "smtp", + "rsa.misc.event_state": "velillum", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "econ", + "rsa.misc.log_session_id": "ionev", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "smtp", + "rsa.misc.reference_id": "aborio", + "rsa.misc.reference_id1": "rve", + "rsa.misc.severity": "medium", + "rsa.network.network_service": "runtmoll", + "rsa.time.event_time": "2018-12-07T18:17:40.000Z", + "service.type": "fortinet", + "source.address": "olaboris3175.internal.home", + "source.ip": [ + "10.250.94.95" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "nbyCi" + }, + { + "@timestamp": "2018-12-22T01:20:14.000Z", + "event.action": "virus_file-signature", + "event.code": "ugitsed", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2018-12-21 time=23:20:14 device_id=atevelit log_id=ugitsed log_part=dminimve type=virus subtype=file-signature pri=very-high from=\"onse\" to=uiac src=tquii [10.164.49.95] session_id=emeumfu msg=\"inBCSedu\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 14586, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.164.49.95" + ], + "rsa.email.email_dst": "uiac", + "rsa.email.email_src": "onse", + "rsa.internal.event_desc": "inBCSedu", + "rsa.internal.messageid": "virus_file-signature", + "rsa.misc.event_type": "virus_file-signature", + "rsa.misc.hardware_id": "atevelit", + "rsa.misc.log_session_id": "emeumfu", + "rsa.misc.msgIdPart1": "virus", + "rsa.misc.msgIdPart2": "file-signature", + "rsa.misc.reference_id": "ugitsed", + "rsa.misc.reference_id1": "dminimve", + "rsa.misc.severity": "very-high", + "rsa.time.event_time": "2018-12-22T01:20:14.000Z", + "service.type": "fortinet", + "source.domain": "tquii", + "source.ip": [ + "10.164.49.95" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-05T08:22:49.000Z", + "event.action": "allow", + "event.code": "emp", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-1-5 time=06:22:49 device_id=ddo log_id=emp log_part=inBC type=event subtype=smtp pri=low user=eacommui=aboNem(10.11.45.141) action=allowstatus=remasession_id=\"mcol\"msg=\"STARTTLS=tion, cert-subject=umquia, cert-issuer=lorsita, verifymsg=spici\"", + "fileset.name": "fortimail", + "host.ip": "10.11.45.141", + "input.type": "log", + "log.level": "low", + "log.offset": 14795, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.11.45.141" + ], + "related.user": [ + "eacomm" + ], + "rsa.crypto.cert_subject": "umquia", + "rsa.internal.messageid": "event_smtp", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "smtp", + "rsa.misc.event_state": "rema", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "ddo", + "rsa.misc.log_session_id": "mcol", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "smtp", + "rsa.misc.reference_id": "emp", + "rsa.misc.reference_id1": "inBC", + "rsa.misc.severity": "low", + "rsa.network.network_service": "aboNem", + "rsa.time.event_time": "2019-01-05T08:22:49.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "eacomm" + }, + { + "@timestamp": "2019-01-19T15:25:23.000Z", + "destination.ip": [ + "10.161.1.146" + ], + "event.action": "statistics", + "event.code": "vol", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-1-19 time=13:25:23 device_id=odit log_id=vol log_part=epteurs type=statistics pri=very-high session_id=\"cteturad\" client_name=\"modi6930.internal.test[10.60.164.100]\"dst_ip=\"10.161.1.146\" from=\"etconse\" to=\"nproiden\" polid=\"ionem\" domain=\"taevitae6868.www.corp\" subject=\"ehende\" mailer=\"rep\" resolved=\"nostru\" direction=\"internal\" virus=\"ipiscin\" disposition=\"trudexe\" classifier=\"qua\" message_length=modit", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 15048, + "network.direction": "internal", + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.60.164.100", + "10.161.1.146" + ], + "rsa.email.email_dst": "nproiden", + "rsa.email.email_src": "etconse", + "rsa.email.subject": "ehende", + "rsa.internal.messageid": "statistics", + "rsa.misc.client": "rep", + "rsa.misc.context": "nostru", + "rsa.misc.disposition": "trudexe", + "rsa.misc.event_type": "statistics", + "rsa.misc.filter": "qua", + "rsa.misc.hardware_id": "odit", + "rsa.misc.log_session_id": "cteturad", + "rsa.misc.reference_id": "vol", + "rsa.misc.reference_id1": "epteurs", + "rsa.misc.severity": "very-high", + "rsa.misc.virusname": "ipiscin", + "rsa.network.domain": "taevitae6868.www.corp", + "rsa.time.event_time": "2019-01-19T15:25:23.000Z", + "rsa.web.fqdn": "modi6930.internal.test", + "server.domain": "taevitae6868.www.corp", + "service.type": "fortinet", + "source.ip": [ + "10.60.164.100" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-02-02T22:27:57.000Z", + "event.action": "cancel", + "event.code": "deFinibu", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-2-2 time=20:27:57 device_id=orsit log_id=deFinibu log_part=iaecons type=event subtype=admin pri=very-high user=rautod ui=onorumet(10.157.118.41) action=cancel status=chit reason=unknown msg=\"erspici\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 15464, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.157.118.41" + ], + "related.user": [ + "rautod" + ], + "rsa.internal.event_desc": "erspici", + "rsa.internal.messageid": "event_admin", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "admin", + "rsa.misc.event_state": "chit", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "orsit", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "admin", + "rsa.misc.reference_id": "deFinibu", + "rsa.misc.reference_id1": "iaecons", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "very-high", + "rsa.network.network_service": "onorumet", + "rsa.time.event_time": "2019-02-02T22:27:57.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.157.118.41" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "rautod" + }, + { + "@timestamp": "2019-02-17T05:30:32.000Z", + "destination.ip": [ + "10.93.239.216" + ], + "event.action": "statistics", + "event.code": "tinv", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-2-17 time=03:30:32 device_id=quidol log_id=tinv log_part=Utenima type=statistics pri=high session_id=temqu client_name=uradip7802.mail.example client_ip=10.44.35.57 dst_ip=10.93.239.216 from=vento hfrom=litsed to=ciun polid=rehender domain=tetura7106.www5.corp mailer=eosquir resolved=tqu src_type=emips direction=internal virus=tinvolu disposition=ptat classifier=amquisn message_length=Finibus subject=nsequat", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 15674, + "network.direction": "internal", + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.44.35.57", + "10.93.239.216" + ], + "rsa.email.email_dst": "ciun", + "rsa.email.email_src": "vento", + "rsa.email.subject": "nsequat", + "rsa.internal.messageid": "statistics", + "rsa.misc.client": "eosquir", + "rsa.misc.context": "tqu", + "rsa.misc.disposition": "ptat", + "rsa.misc.event_type": "statistics", + "rsa.misc.filter": "amquisn", + "rsa.misc.hardware_id": "quidol", + "rsa.misc.log_session_id": "temqu", + "rsa.misc.reference_id": "tinv", + "rsa.misc.reference_id1": "Utenima", + "rsa.misc.severity": "high", + "rsa.misc.virusname": "tinvolu", + "rsa.network.domain": "tetura7106.www5.corp", + "rsa.time.event_time": "2019-02-17T05:30:32.000Z", + "rsa.web.fqdn": "uradip7802.mail.example", + "server.domain": "tetura7106.www5.corp", + "service.type": "fortinet", + "source.ip": [ + "10.44.35.57" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-03T12:33:06.000Z", + "event.action": "event", + "event.code": "remquela", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-3-3 time=10:33:06 device_id=evelite log_id=remquela log_part=toreve type=event subtype=update pri=high msg=\"dolor\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 16096, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "rsa.internal.event_desc": "dolor", + "rsa.internal.messageid": "event_update", + "rsa.misc.category": "update", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "evelite", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "update", + "rsa.misc.reference_id": "remquela", + "rsa.misc.reference_id1": "toreve", + "rsa.misc.severity": "high", + "rsa.time.event_time": "2019-03-03T12:33:06.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-17T19:35:40.000Z", + "event.action": "event", + "event.code": "lapari", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-3-17 time=17:35:40 device_id=itse log_id=lapari log_part=Bonor type=event subtype=update pri=medium msg=exeaco", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 16221, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "rsa.internal.event_desc": "exeaco", + "rsa.internal.messageid": "event_update", + "rsa.misc.category": "update", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "itse", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "update", + "rsa.misc.reference_id": "lapari", + "rsa.misc.reference_id1": "Bonor", + "rsa.misc.severity": "medium", + "rsa.time.event_time": "2019-03-17T19:35:40.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-01T02:38:14.000Z", + "event.action": "virus_file-signature", + "event.code": "tNeq", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-4-1 time=00:38:14 device_id=emvele log_id=tNeq log_part=olorsita type=virus_file-signature pri=medium eleumiu to=etdol src=\"imadmin [10.123.154.140]\" session_id=liqu msg=dolor", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 16342, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.123.154.140" + ], + "rsa.email.email_dst": "etdol", + "rsa.email.email_src": "eleumiu", + "rsa.internal.event_desc": "dolor", + "rsa.internal.messageid": "virus_file-signature", + "rsa.misc.event_type": "virus_file-signature", + "rsa.misc.hardware_id": "emvele", + "rsa.misc.log_session_id": "liqu", + "rsa.misc.reference_id": "tNeq", + "rsa.misc.reference_id1": "olorsita", + "rsa.misc.severity": "medium", + "rsa.time.event_time": "2019-04-01T02:38:14.000Z", + "service.type": "fortinet", + "source.domain": "imadmin", + "source.ip": [ + "10.123.154.140" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-15T09:40:49.000Z", + "event.action": "deny", + "event.code": "utem", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-4-15 time=07:40:49 device_id=aliq log_id=utem log_part=oreetd type=event subtype=imap pri=very-high user=mremape ui=ude action=deny status=emac msg=rmagnido", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 16528, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.user": [ + "mremape" + ], + "rsa.internal.event_desc": "rmagnido", + "rsa.internal.messageid": "event_imap", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "imap", + "rsa.misc.event_state": "emac", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "aliq", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "imap", + "rsa.misc.reference_id": "utem", + "rsa.misc.reference_id1": "oreetd", + "rsa.misc.severity": "very-high", + "rsa.network.network_service": "ude", + "rsa.time.event_time": "2019-04-15T09:40:49.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "mremape" + }, + { + "@timestamp": "2019-04-29T16:43:23.000Z", + "event.action": "deny", + "event.code": "cita", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-4-29 time=14:43:23 device_id=pariatur log_id=cita log_part=tvo type=event subtype=admin pri=high user=rve ui=atemacc(10.141.108.1) action=deny status=ciunt reason=success msg=\"beataevi\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 16695, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.141.108.1" + ], + "related.user": [ + "rve" + ], + "rsa.internal.event_desc": "beataevi", + "rsa.internal.messageid": "event_admin", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "admin", + "rsa.misc.event_state": "ciunt", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "pariatur", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "admin", + "rsa.misc.reference_id": "cita", + "rsa.misc.reference_id1": "tvo", + "rsa.misc.result": "success", + "rsa.misc.severity": "high", + "rsa.network.network_service": "atemacc", + "rsa.time.event_time": "2019-04-29T16:43:23.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.141.108.1" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "rve" + }, + { + "@timestamp": "2019-05-13T23:45:57.000Z", + "event.action": "cancel", + "event.code": "dmin", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-5-13 time=21:45:57 device_id=imaven log_id=dmin log_part=sum type=event subtype=system pri=low user=lore ui=nim action=cancel status=edquiac msg=psamvolu", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "low", + "log.offset": 16891, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.user": [ + "lore" + ], + "rsa.internal.event_desc": "psamvolu", + "rsa.internal.messageid": "event_system", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "system", + "rsa.misc.event_state": "edquiac", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "imaven", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "system", + "rsa.misc.reference_id": "dmin", + "rsa.misc.reference_id1": "sum", + "rsa.misc.severity": "low", + "rsa.network.network_service": "nim", + "rsa.time.event_time": "2019-05-13T23:45:57.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "lore" + }, + { + "@timestamp": "2019-05-28T06:48:31.000Z", + "event.action": "deny", + "event.code": "tae", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-5-28 time=04:48:31 device_id=iade log_id=tae log_part=obe type=event subtype=admin pri=medium user=ulapari ui=rittenby(10.31.31.193) action=deny status=nvol reason=unknown msg=\"luptatem\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 17055, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.31.31.193" + ], + "related.user": [ + "ulapari" + ], + "rsa.internal.event_desc": "luptatem", + "rsa.internal.messageid": "event_admin", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "admin", + "rsa.misc.event_state": "nvol", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "iade", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "admin", + "rsa.misc.reference_id": "tae", + "rsa.misc.reference_id1": "obe", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "medium", + "rsa.network.network_service": "rittenby", + "rsa.time.event_time": "2019-05-28T06:48:31.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.31.31.193" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "ulapari" + }, + { + "@timestamp": "2019-06-11T13:51:06.000Z", + "event.action": "block", + "event.code": "ruredolo", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-6-11 time=11:51:06 device_id=conse log_id=ruredolo log_part=ati type=event subtype=system pri=low user=olors ui=roid(10.234.156.8) action=block status=uteiru msg=\"xer\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "low", + "log.offset": 17252, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.234.156.8" + ], + "related.user": [ + "olors" + ], + "rsa.internal.event_desc": "xer", + "rsa.internal.messageid": "event_system", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "system", + "rsa.misc.event_state": "uteiru", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "conse", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "system", + "rsa.misc.reference_id": "ruredolo", + "rsa.misc.reference_id1": "ati", + "rsa.misc.severity": "low", + "rsa.network.network_service": "roid", + "rsa.time.event_time": "2019-06-11T13:51:06.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.234.156.8" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "olors" + }, + { + "@timestamp": "2019-06-25T20:53:40.000Z", + "event.action": "event", + "event.code": "uame", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-6-25 time=18:53:40 device_id=nvol log_id=uame log_part=quia type=event subtype=update pri=very-high msg=\"labor\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 17430, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "rsa.internal.event_desc": "labor", + "rsa.internal.messageid": "event_update", + "rsa.misc.category": "update", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "nvol", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "update", + "rsa.misc.reference_id": "uame", + "rsa.misc.reference_id1": "quia", + "rsa.misc.severity": "very-high", + "rsa.time.event_time": "2019-06-25T20:53:40.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-10T03:56:14.000Z", + "event.action": "event", + "event.code": "modit", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-7-10 time=01:56:14 device_id=mwritte log_id=modit log_part=quamnih type=event subtype=config pri=medium user=itanimid ui=uiin module=nibusBo submodule=iusm msg=\"nostru\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 17552, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.user": [ + "itanimid" + ], + "rsa.internal.event_desc": "nostru", + "rsa.internal.messageid": "event_config", + "rsa.misc.category": "config", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "mwritte", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "config", + "rsa.misc.reference_id": "modit", + "rsa.misc.reference_id1": "quamnih", + "rsa.misc.severity": "medium", + "rsa.network.network_service": "uiin", + "rsa.time.event_time": "2019-07-10T03:56:14.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "itanimid" + }, + { + "@timestamp": "2019-07-24T10:58:48.000Z", + "event.action": "event", + "event.code": "preh", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-7-24 time=08:58:48 device_id=vel log_id=preh log_part=madmini type=event subtype=update pri=high msg=edutpers", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 17731, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "rsa.internal.event_desc": "edutpers", + "rsa.internal.messageid": "event_update", + "rsa.misc.category": "update", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "vel", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "update", + "rsa.misc.reference_id": "preh", + "rsa.misc.reference_id1": "madmini", + "rsa.misc.severity": "high", + "rsa.time.event_time": "2019-07-24T10:58:48.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-08-07T18:01:23.000Z", + "event.action": "virus_file-signature", + "event.code": "everi", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-8-7 time=16:01:23 device_id=sBonoru log_id=everi log_part=squ type=virus subtype=file-signature pri=medium from=\"utla\" to=nse src=10.160.236.78 session_id=nostrude msg=\"Attachment file (rinc) has sha1 hash value: tno\"", + "file.name": "rinc", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 17851, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.160.236.78" + ], + "rsa.email.email_dst": "nse", + "rsa.email.email_src": "utla", + "rsa.internal.messageid": "virus_file-signature", + "rsa.misc.checksum": "tno", + "rsa.misc.event_type": "virus_file-signature", + "rsa.misc.hardware_id": "sBonoru", + "rsa.misc.log_session_id": "nostrude", + "rsa.misc.msgIdPart1": "virus", + "rsa.misc.msgIdPart2": "file-signature", + "rsa.misc.reference_id": "everi", + "rsa.misc.reference_id1": "squ", + "rsa.misc.severity": "medium", + "rsa.time.event_time": "2019-08-07T18:01:23.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.160.236.78" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-08-22T01:03:57.000Z", + "event.action": "accept", + "event.code": "nonproi", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-8-21 time=23:03:57 device_id=cid log_id=nonproi log_part=dolor type=event subtype=admin pri=medium user=molli ui=oeiusm(10.244.19.62) action=accept status=nnumquam reason=unknown msg=\"tdolore\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 18079, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.244.19.62" + ], + "related.user": [ + "molli" + ], + "rsa.internal.event_desc": "tdolore", + "rsa.internal.messageid": "event_admin", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "admin", + "rsa.misc.event_state": "nnumquam", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "cid", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "admin", + "rsa.misc.reference_id": "nonproi", + "rsa.misc.reference_id1": "dolor", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "medium", + "rsa.network.network_service": "oeiusm", + "rsa.time.event_time": "2019-08-22T01:03:57.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.244.19.62" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "molli" + }, + { + "@timestamp": "2019-09-05T08:06:31.000Z", + "event.action": "allow", + "event.code": "epteu", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-9-5 time=06:06:31 device_id=icta log_id=epteu log_part=nvent type=event subtype=webmail pri=high user=mquiavol ui=odiconse(10.147.52.164) action=allow status=untutl msg=ugiatnul", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 18282, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.147.52.164" + ], + "related.user": [ + "mquiavol" + ], + "rsa.internal.event_desc": "ugiatnul", + "rsa.internal.messageid": "event_webmail", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "webmail", + "rsa.misc.event_state": "untutl", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "icta", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "webmail", + "rsa.misc.reference_id": "epteu", + "rsa.misc.reference_id1": "nvent", + "rsa.misc.severity": "high", + "rsa.network.network_service": "odiconse", + "rsa.time.event_time": "2019-09-05T08:06:31.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.147.52.164" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "mquiavol" + }, + { + "@timestamp": "2019-09-19T15:09:05.000Z", + "destination.ip": [ + "10.251.183.113" + ], + "event.action": "spam", + "event.code": "elaudant", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-9-19 time=13:09:05 device_id=quaturve log_id=elaudant log_part=olup type=spam pri=high session_id=\"iacon\" client_name= \"ncu3839.www.localhost\" client_ip=\"10.201.105.58\" dst_ip=\"10.251.183.113\" from=\"ent\" to=\"ionemu\" subject=\"eseosqu\" msg=\"uptatem\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "high", + "log.offset": 18470, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.201.105.58", + "10.251.183.113" + ], + "rsa.email.email_dst": "ionemu", + "rsa.email.email_src": "ent", + "rsa.email.subject": "eseosqu", + "rsa.internal.event_desc": "uptatem", + "rsa.internal.messageid": "spam", + "rsa.misc.event_type": "spam", + "rsa.misc.hardware_id": "quaturve", + "rsa.misc.log_session_id": "iacon", + "rsa.misc.reference_id": "elaudant", + "rsa.misc.reference_id1": "olup", + "rsa.misc.severity": "high", + "rsa.time.event_time": "2019-09-19T15:09:05.000Z", + "rsa.web.fqdn": "ncu3839.www.localhost", + "service.type": "fortinet", + "source.ip": [ + "10.201.105.58" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-03T22:11:40.000Z", + "destination.ip": [ + "10.132.139.98" + ], + "event.action": "statistics", + "event.code": "oinB", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-10-3 time=20:11:40 device_id=eprehen log_id=oinB log_part=lor type=statistics pri=low session_id=\"citatio\" client_name=\"[10.209.203.156]\"dst_ip=\"10.132.139.98\" from=\"pariat\" to=\"borisnis\" direction=\"unknown\" virus=\"oremagn\" disposition=\"emagna\" classifier=\"uidolor\" message_length=remag", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "low", + "log.offset": 18728, + "network.direction": "unknown", + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.209.203.156", + "10.132.139.98" + ], + "rsa.email.email_dst": "borisnis", + "rsa.email.email_src": "pariat", + "rsa.internal.messageid": "statistics", + "rsa.misc.disposition": "emagna", + "rsa.misc.event_type": "statistics", + "rsa.misc.filter": "uidolor", + "rsa.misc.hardware_id": "eprehen", + "rsa.misc.log_session_id": "citatio", + "rsa.misc.reference_id": "oinB", + "rsa.misc.reference_id1": "lor", + "rsa.misc.severity": "low", + "rsa.misc.virusname": "oremagn", + "rsa.time.event_time": "2019-10-03T22:11:40.000Z", + "rsa.web.fqdn": "", + "service.type": "fortinet", + "source.ip": [ + "10.209.203.156" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-18T05:14:14.000Z", + "event.action": "block", + "event.code": "ulamcola", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-10-18 time=03:14:14 device_id=tiumtot log_id=ulamcola log_part=epr type=event subtype=admin pri=low user=nculpa ui=enbyCice(10.152.196.145) action=block status=uptas reason=success msg=\"iadeseru\"", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "low", + "log.offset": 19025, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.152.196.145" + ], + "related.user": [ + "nculpa" + ], + "rsa.internal.event_desc": "iadeseru", + "rsa.internal.messageid": "event_admin", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "admin", + "rsa.misc.event_state": "uptas", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "tiumtot", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "admin", + "rsa.misc.reference_id": "ulamcola", + "rsa.misc.reference_id1": "epr", + "rsa.misc.result": "success", + "rsa.misc.severity": "low", + "rsa.network.network_service": "enbyCice", + "rsa.time.event_time": "2019-10-18T05:14:14.000Z", + "service.type": "fortinet", + "source.ip": [ + "10.152.196.145" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ], + "user.name": "nculpa" + }, + { + "@timestamp": "2019-11-01T12:16:48.000Z", + "event.action": "virus_file-signature", + "event.code": "turadip", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-11-1 time=10:16:48 device_id=equ log_id=turadip log_part=ataev type=virus_file-signature pri=medium from=\"oree\" to=\"nimadmi\" src=\"utaliq [10.78.38.143]\" session_id=qui msg=\"Attachment file (epteurs) has sha1 hash value: did\"", + "file.name": "epteurs", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "medium", + "log.offset": 19231, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.78.38.143" + ], + "rsa.email.email_dst": "nimadmi", + "rsa.email.email_src": "oree", + "rsa.internal.messageid": "virus_file-signature", + "rsa.misc.checksum": "did", + "rsa.misc.event_type": "virus_file-signature", + "rsa.misc.hardware_id": "equ", + "rsa.misc.log_session_id": "qui", + "rsa.misc.reference_id": "turadip", + "rsa.misc.reference_id1": "ataev", + "rsa.misc.severity": "medium", + "rsa.time.event_time": "2019-11-01T12:16:48.000Z", + "service.type": "fortinet", + "source.domain": "utaliq", + "source.ip": [ + "10.78.38.143" + ], + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-15T19:19:22.000Z", + "event.action": "event", + "event.code": "orumSe", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-11-15 time=17:19:22 device_id=sunt log_id=orumSe log_part=olupta type=event subtype=update pri=very-high msg=pta", + "fileset.name": "fortimail", + "input.type": "log", + "log.level": "very-high", + "log.offset": 19466, + "observer.product": "FortiMail", + "observer.type": "Firewall", + "observer.vendor": "Fortinet", + "rsa.internal.event_desc": "pta", + "rsa.internal.messageid": "event_update", + "rsa.misc.category": "update", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "sunt", + "rsa.misc.msgIdPart1": "event", + "rsa.misc.msgIdPart2": "update", + "rsa.misc.reference_id": "orumSe", + "rsa.misc.reference_id1": "olupta", + "rsa.misc.severity": "very-high", + "rsa.time.event_time": "2019-11-15T19:19:22.000Z", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimail", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-30T02:21:57.000Z", + "event.action": "allow", + "event.code": "leumiure", + "event.dataset": "fortinet.fortimail", + "event.module": "fortinet", + "event.original": "date=2019-11-30 time=00:21:57 device_id=ntutlabo log_id=leumiure log_part=tasnu type=event subtype=smtp pri=high user=amquaui=tionevol(10.209.124.81) action=allowstatus=tobesession_id=\"ssequa\" log_part=emp msg=\"to=< + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml b/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml new file mode 100644 index 00000000000..5d399e10da5 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Fortinet" + product: "FortiManager" + type: "Configuration" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/fortinet/fortimanager/config/liblogparser.js + - ${path.home}/module/fortinet/fortimanager/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/fortinet/fortimanager/config/liblogparser.js b/x-pack/filebeat/module/fortinet/fortimanager/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} time=%{htime->} devname=%{hdevice->} device_id=%{hfld1->} log_id=%{id->} type=%{hfld2->} subtype=%{hfld3->} pri=%{hseverity->} %{payload}", processor_chain([ + setc("header_id","0001"), + call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("hfld2"), + constant("_fortinetmgr"), + ], + }), +])); + +var hdr2 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' log_id='), Field(id,true), Constant(' '), Field(payload,false)}" +match("HEADER#1:0002", "message", "logver=%{hfld1->} date=%{hdate->} time=%{htime->} log_id=%{id->} %{payload}", processor_chain([ + setc("header_id","0002"), + dup1, +])); + +var hdr3 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' logver='), Field(fld1,true), Constant(' '), Field(payload,false)}" +match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} logver=%{fld1->} %{payload}", processor_chain([ + setc("header_id","0003"), + dup1, +])); + +var hdr4 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' dtime='), Field(hdatetime,true), Constant(' devid='), Field(hfld2,true), Constant(' devname='), Field(hdevice,true), Constant(' '), Field(payload,false)}" +match("HEADER#3:0004", "message", "logver=%{hfld1->} dtime=%{hdatetime->} devid=%{hfld2->} devname=%{hdevice->} %{payload}", processor_chain([ + setc("header_id","0004"), + dup2, +])); + +var hdr5 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' devname="'), Field(hdevice,false), Constant('" devid="'), Field(hfld2,false), Constant('" '), Field(payload,false)}" +match("HEADER#4:0005", "message", "logver=%{hfld1->} devname=\"%{hdevice}\" devid=\"%{hfld2}\" %{payload}", processor_chain([ + setc("header_id","0005"), + dup2, +])); + +var select1 = linear_select([ + hdr1, + hdr2, + hdr3, + hdr4, + hdr5, +]); + +var part1 = // "Pattern{Constant('user='), Field(fld1,true), Constant(' adom='), Field(domain,true), Constant(' user='), Field(username,true), Constant(' ui='), Field(fld2,true), Constant(' action='), Field(action,true), Constant(' status='), Field(event_state,true), Constant(' msg="'), Field(event_description,false), Constant('"')}" +match("MESSAGE#0:fortinetmgr:01", "nwparser.payload", "user=%{fld1->} adom=%{domain->} user=%{username->} ui=%{fld2->} action=%{action->} status=%{event_state->} msg=\"%{event_description}\"", processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, +])); + +var msg1 = msg("fortinetmgr:01", part1); + +var part2 = // "Pattern{Constant('user='), Field(username,true), Constant(' adom='), Field(domain,true), Constant(' msg="'), Field(event_description,false), Constant('"')}" +match("MESSAGE#1:fortinetmgr", "nwparser.payload", "user=%{username->} adom=%{domain->} msg=\"%{event_description}\"", processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, +])); + +var msg2 = msg("fortinetmgr", part2); + +var part3 = // "Pattern{Constant('user="'), Field(username,false), Constant('" userfrom='), Field(fld7,true), Constant(' msg="'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/0", "nwparser.payload", "user=\"%{username}\" userfrom=%{fld7->} msg=\"%{p0}"); + +var part4 = // "Pattern{Constant('User'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/1_0", "nwparser.p0", "User%{p0}"); + +var part5 = // "Pattern{Constant('user'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/1_1", "nwparser.p0", "user%{p0}"); + +var select2 = linear_select([ + part4, + part5, +]); + +var part6 = // "Pattern{Field(,false), Constant('''), Field(fld3,false), Constant('' with profile ''), Field(fld4,false), Constant('' '), Field(fld5,true), Constant(' from '), Field(fld6,false), Constant('('), Field(hostip,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/2", "nwparser.p0", "%{}'%{fld3}' with profile '%{fld4}' %{fld5->} from %{fld6}(%{hostip})%{p0}"); + +var part7 = // "Pattern{Constant('."'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/3_0", "nwparser.p0", ".\"%{p0}"); + +var part8 = // "Pattern{Constant('"'), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/3_1", "nwparser.p0", "\"%{p0}"); + +var select3 = linear_select([ + part7, + part8, +]); + +var part9 = // "Pattern{Field(,false), Constant('adminprof='), Field(p0,false)}" +match("MESSAGE#2:fortinetmgr:04/4", "nwparser.p0", "%{}adminprof=%{p0}"); + +var part10 = // "Pattern{Field(fld2,true), Constant(' sid='), Field(sid,true), Constant(' user_type="'), Field(profile,false), Constant('"')}" +match("MESSAGE#2:fortinetmgr:04/5_0", "nwparser.p0", "%{fld2->} sid=%{sid->} user_type=\"%{profile}\""); + +var part11 = // "Pattern{Field(fld2,false)}" +match_copy("MESSAGE#2:fortinetmgr:04/5_1", "nwparser.p0", "fld2"); + +var select4 = linear_select([ + part10, + part11, +]); + +var all1 = all_match({ + processors: [ + part3, + select2, + part6, + select3, + part9, + select4, + ], + on_success: processor_chain([ + dup11, + dup4, + lookup({ + dest: "nwparser.event_cat", + map: map_getEventLegacyCategory, + key: field("fld5"), + }), + dup22, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, + ]), +}); + +var msg3 = msg("fortinetmgr:04", all1); + +var part12 = // "Pattern{Constant('user='), Field(username,true), Constant(' userfrom='), Field(fld4,true), Constant(' msg="'), Field(event_description,false), Constant('" adminprof='), Field(fld2,false)}" +match("MESSAGE#3:fortinetmgr:02", "nwparser.payload", "user=%{username->} userfrom=%{fld4->} msg=\"%{event_description}\" adminprof=%{fld2}", processor_chain([ + dup3, + dup4, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, +])); + +var msg4 = msg("fortinetmgr:02", part12); + +var part13 = // "Pattern{Constant('user="'), Field(username,false), Constant('" msg="Login from ssh:'), Field(fld1,true), Constant(' for '), Field(fld2,true), Constant(' from '), Field(saddr,true), Constant(' port '), Field(sport,false), Constant('" remote_ip="'), Field(daddr,false), Constant('" remote_port='), Field(dport,true), Constant(' valid='), Field(fld3,true), Constant(' authmsg="'), Field(result,false), Constant('" extrainfo='), Field(fld5,false)}" +match("MESSAGE#4:fortinetmgr:03", "nwparser.payload", "user=\"%{username}\" msg=\"Login from ssh:%{fld1->} for %{fld2->} from %{saddr->} port %{sport}\" remote_ip=\"%{daddr}\" remote_port=%{dport->} valid=%{fld3->} authmsg=\"%{result}\" extrainfo=%{fld5}", processor_chain([ + dup11, + dup4, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, + lookup({ + dest: "nwparser.event_cat", + map: map_getEventLegacyCategory, + key: field("result"), + }), + dup22, +])); + +var msg5 = msg("fortinetmgr:03", part13); + +var part14 = // "Pattern{Constant('user="'), Field(username,false), Constant('" userfrom="'), Field(fld1,false), Constant('"msg="'), Field(p0,false)}" +match("MESSAGE#5:fortinetmgr:05/0", "nwparser.payload", "user=\"%{username}\" userfrom=\"%{fld1}\"msg=\"%{p0}"); + +var part15 = // "Pattern{Constant('dev='), Field(fld2,false), Constant(',vdom='), Field(fld3,false), Constant(',type='), Field(fld4,false), Constant(',key='), Field(fld5,false), Constant(',act='), Field(action,false), Constant(',pkgname='), Field(fld7,false), Constant(',allowaccess='), Field(fld8,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#5:fortinetmgr:05/1_0", "nwparser.p0", "dev=%{fld2},vdom=%{fld3},type=%{fld4},key=%{fld5},act=%{action},pkgname=%{fld7},allowaccess=%{fld8}\"%{p0}"); + +var part16 = // "Pattern{Field(event_description,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#5:fortinetmgr:05/1_1", "nwparser.p0", "%{event_description}\"%{p0}"); + +var select5 = linear_select([ + part15, + part16, +]); + +var part17 = // "Pattern{Field(domain,false), Constant('" adom="')}" +match("MESSAGE#5:fortinetmgr:05/2", "nwparser.p0", "%{domain}\" adom=\""); + +var all2 = all_match({ + processors: [ + part14, + select5, + part17, + ], + on_success: processor_chain([ + dup13, + dup4, + dup5, + dup6, + dup7, + dup8, + dup9, + dup10, + ]), +}); + +var msg6 = msg("fortinetmgr:05", all2); + +var part18 = tagval("MESSAGE#6:event_fortinetmgr_tvm", "nwparser.payload", tvm, { + "action": "action", + "adom": "domain", + "desc": "event_description", + "msg": "info", + "session_id": "sessionid", + "user": "username", + "userfrom": "fld1", +}, processor_chain([ + dup11, + dup4, + dup5, + dup6, + dup7, + setf("event_type","hfld2"), + dup9, + dup10, +])); + +var msg7 = msg("event_fortinetmgr_tvm", part18); + +var select6 = linear_select([ + msg1, + msg2, + msg3, + msg4, + msg5, + msg6, + msg7, +]); + +var part19 = tagval("MESSAGE#7:generic_fortinetmgr", "nwparser.payload", tvm, { + "action": "action", + "adminprof": "fld13", + "cat": "fcatnum", + "catdesc": "filter", + "cipher_suite": "fld24", + "content_switch_name": "fld15", + "craction": "fld9", + "crlevel": "fld10", + "crscore": "reputation_num", + "dev_id": "fld100", + "device_id": "hardware_id", + "devid": "hardware_id", + "devname": "event_source", + "devtype": "fld7", + "direction": "direction", + "dst": "daddr", + "dst_port": "dport", + "dstintf": "dinterface", + "dstip": "daddr", + "dstport": "dport", + "duration": "duration", + "eventtype": "vendor_event_cat", + "false_positive_mitigation": "fld17", + "ftp_cmd": "fld23", + "ftp_mode": "fld22", + "history_threat_weight": "fld21", + "hostname": "hostname", + "http_agent": "agent", + "http_host": "web_ref_domain", + "http_method": "web_method", + "http_refer": "web_referer", + "http_session_id": "sessionid", + "http_url": "web_query", + "http_version": "fld19", + "level": "severity", + "log_id": "id", + "logid": "id", + "main_type": "fld37", + "mastersrcmac": "fld8", + "method": "fld12", + "monitor_status": "fld18", + "msg": "event_description", + "msg_id": "fld25", + "osname": "os", + "osversion": "version", + "policy": "policyname", + "policyid": "policy_id", + "poluuid": "fld5", + "pri": "severity", + "profile": "rulename", + "proto": "fld6", + "rcvdbyte": "rbytes", + "reqtype": "fld11", + "sentbyte": "sbytes", + "server_pool_name": "fld16", + "service": "network_service", + "sessionid": "sessionid", + "severity_level": "fld101", + "signature_id": "sigid", + "signature_subclass": "fld14", + "src": "saddr", + "src_port": "sport", + "srccountry": "location_src", + "srcintf": "sinterface", + "srcip": "saddr", + "srcmac": "smacaddr", + "srcport": "sport", + "sub_type": "category", + "subtype": "category", + "threat_level": "threat_val", + "threat_weight": "fld20", + "timezone": "timezone", + "trandisp": "context", + "trigger_policy": "fld39", + "type": "event_type", + "url": "url", + "user": "username", + "user_name": "username", + "userfrom": "fld30", + "vd": "vsys", +}, processor_chain([ + dup13, + dup4, + dup5, + dup14, + dup23, +])); + +var msg8 = msg("generic_fortinetmgr", part19); + +var part20 = tagval("MESSAGE#8:generic_fortinetmgr_1", "nwparser.payload", tvm, { + "action": "action", + "app": "obj_name", + "appcat": "fld33", + "craction": "fld9", + "crlevel": "fld10", + "crscore": "reputation_num", + "date": "fld1", + "dstcountry": "location_dst", + "dstintf": "dinterface", + "dstintfrole": "fld31", + "dstip": "daddr", + "dstport": "dport", + "duration": "duration", + "eventtime": "event_time_string", + "level": "severity", + "logid": "id", + "logtime": "fld35", + "policyid": "policy_id", + "policytype": "fld34", + "poluuid": "fld5", + "proto": "fld6", + "rcvdbyte": "rbytes", + "sentbyte": "sbytes", + "sentpkt": "fld15", + "service": "network_service", + "sessionid": "sessionid", + "srccountry": "location_src", + "srcintf": "sinterface", + "srcintfrole": "fld30", + "srcip": "saddr", + "srcport": "sport", + "subtype": "category", + "time": "fld2", + "trandisp": "context", + "tranip": "dtransaddr", + "tranport": "dtransport", + "type": "event_type", + "vd": "vsys", +}, processor_chain([ + dup13, + dup4, + date_time({ + dest: "event_time", + args: ["fld1","fld2"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + dup6, + setf("hardware_id","hfld2"), + dup14, + dup23, +])); + +var msg9 = msg("generic_fortinetmgr_1", part20); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "event_fortinetmgr": select6, + "generic_fortinetmgr": msg8, + "generic_fortinetmgr_1": msg9, + }), +]); diff --git a/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml new file mode 100644 index 00000000000..8452bb6c2bf --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Fortinet Manager/Analyzer + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/fortinet/fortimanager/manifest.yml b/x-pack/filebeat/module/fortinet/fortimanager/manifest.yml new file mode 100644 index 00000000000..f5759fce05e --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["fortinet.fortimanager", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9530 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log new file mode 100644 index 00000000000..7da64dddce2 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log @@ -0,0 +1,100 @@ +logver=iusm devname="modtempo" devid="olab" vd=nto date=2016-1-29 time=6:09:59 logid=sse type=exercita subtype=der level=very-high eventtime=odoco logtime=ria srcip=10.20.234.169 srcport=1001 srcintf=eth5722 srcintfrole=vol dstip=10.44.173.44 dstport=6125 dstintf=enp0s3068 dstintfrole=nseq poluuid=itinvol sessionid=psa proto=21 action=allow policyid=ntium policytype=psaq crscore=13.800000 craction=eab crlevel=aliqu appcat=Ute service=lupt srccountry=dolore dstcountry=sequa trandisp=abo tranip=10.189.58.145 tranport=5273 duration=14.119000 sentbyte=7880 rcvdbyte=449 sentpkt=mqui app=nci +date=2016-2-12 time=1:12:33 logver=litesse devid=orev devname=pisciv logid=uii type=umexe subtype=estlabo level=high vd=iatnu srcip=10.182.84.248 srcport=4880 srcintf=enp0s208 dstip=10.162.33.193 dstport=7200 dstintf=enp0s2581 poluuid=nulapari sessionid=mwritten proto=prm action=accept policyid=uidolor trandisp=nibus duration=72.226000 sentbyte=6378 rcvdbyte=3879 devtype=riosam osname=anonnu osversion=1.410 mastersrcmac=ameaqu srcmac=01:00:5e:84:66:6c crscore=145.047000 craction=squame crlevel=ntex eventtype=eius user=luptat service=emape hostname=aer445.host profile=eumiu reqtype=uame url=https://www.example.net/orisn/cca.htm?ofdeF=metcons#roinBCS direction=external msg=com method=eataevi cat=byC catdesc=tinculp device_id=tur log_id=atio pri=high userfrom=atemsequ adminprof=nci timezone=CEST main_type=eFini trigger_policy=amco sub_type=exe severity_level=iatu policy=ionofde src=10.62.4.246 src_port=189 dst=10.171.204.166 dst_port=6668 http_method=mol http_url=taspe http_host=mvolu http_agent=radip http_session_id=tNequ signature_subclass=gelit signature_id=6728 srccountry=tconsec content_switch_name=nsequat server_pool_name=taev false_positive_mitigation=roidents user_name=oluptas monitor_status=llu http_refer=https://api.example.org/tamremap/tur.html?radipis=isetq#estqui http_version=uasiarch dev_id=emaper threat_weight=ssitasp history_threat_weight=eum threat_level=sum ftp_mode=uaerat ftp_cmd=boreet cipher_suite=onev msg_id=tenima +logver=seq dtime=2016-02-26 20:15:08.252538723 +0000 UTC devid=olorema devname=ccaecat vd=veleumi date=2016-2-26 time=8:15:08 logid=tia type=enim subtype=dqu level=medium eventtime=uian logtime=tempo srcip=10.200.188.142 srcport=4665 srcintf=eth4496 srcintfrole=eetd dstip=10.94.103.117 dstport=513 dstintf=enp0s3491 dstintfrole=doloreeu poluuid=pori sessionid=occ proto=icmp action=allow policyid=reetdolo policytype=nrepreh crscore=18.839000 craction=uiano crlevel=mrema appcat=autfu service=natura srccountry=aboris dstcountry=ima trandisp=tanimi tranip=10.15.159.80 tranport=6378 duration=121.916000 sentbyte=6517 rcvdbyte=13 sentpkt=ugiatqu app=eacomm +logver=liqu devname="lorem" devid="emq" vd=isiu date=2016-3-12 time=3:17:42 logid=nimadmi type=iatisu subtype=iat level=low eventtime=suntinc logtime=elits srcip=10.131.233.27 srcport=5037 srcintf=eth3676 srcintfrole=eataevit dstip=10.50.112.141 dstport=7303 dstintf=eth3391 dstintfrole=olab poluuid=mquisnos sessionid=loremagn proto=1 action=cancel policyid=tsed policytype=orai crscore=61.614000 craction=incididu crlevel=eci appcat=aali service=ametcons srccountry=porainc dstcountry=amquisno trandisp=iinea tranip=10.27.88.95 tranport=776 duration=5.911000 sentbyte=1147 rcvdbyte=3269 sentpkt=tvol app=moll +date=2016-3-26 time=10:20:16 logver=inim devid=ema devname=roinBCSe logid=onse type=tae subtype=tatno level=very-high vd=oluptate srcip=10.52.54.178 srcport=4427 srcintf=lo1567 dstip=10.37.58.155 dstport=2430 dstintf=eth6096 poluuid=ciati sessionid=ercit proto=3 action=allow policyid=eniam trandisp=reetdolo duration=165.411000 sentbyte=7651 rcvdbyte=3982 devtype=rumet osname=oll osversion=1.5670 mastersrcmac=nido srcmac=01:00:5e:c3:0a:41 crscore=71.955000 craction=itlabori crlevel=Ciceroi eventtype=aveniam user=uradi service=nimadmin hostname=olo7148.mail.home profile=snulapar reqtype=aedic url=https://api.example.com/iumto/aboreetd.gif?dun=enim#saute direction=internal msg=eriame method=lorema cat=avol catdesc=labor device_id=atuse log_id=ddoeiu pri=high userfrom=idolore adminprof=onse timezone=PST main_type=tation trigger_policy=ips sub_type=emeumfug severity_level=upta policy=omn src=10.87.212.179 src_port=1758 dst=10.157.213.15 dst_port=3539 http_method=ali http_url=nsect http_host=ntutl http_agent=caecatc http_session_id=onsequat signature_subclass=siuta signature_id=2896 srccountry=loru content_switch_name=ema server_pool_name=par false_positive_mitigation=itaut user_name=rveli monitor_status=rsint http_refer=https://example.com/idestla/Nemoeni.htm?taed=lup#remeumf http_version=antiumto dev_id=strude threat_weight=ctetura history_threat_weight=usmod threat_level=edqui ftp_mode=mquidol ftp_cmd=ita cipher_suite=ipi msg_id=rsitamet +date=2016-4-9 time=5:22:51 logver=eseru devid=remeum devname=orain logid=quip type=oin subtype=uisquam level=high vd=tinvol srcip=10.19.68.92 srcport=1409 srcintf=enp0s33 dstip=10.38.22.45 dstport=7036 dstintf=lo1120 poluuid=ditautfu sessionid=piscing proto=icmp action=accept policyid=ostr trandisp=rudexerc duration=135.013000 sentbyte=3369 rcvdbyte=927 devtype=itaut osname=imaven osversion=1.152 mastersrcmac=umdolo srcmac=01:00:5e:f7:4a:fd crscore=169.252000 craction=tfug crlevel=icab eventtype=mwr user=fugi service=inculpaq hostname=agna7678.internal.host profile=equa reqtype=mexercit url=https://www.example.net/tasuntex/sunt.txt?ume=incidi#picia direction=unknown msg=olupt method=dit cat=sumquiad catdesc=dexeaco device_id=ivelits log_id=moenimi pri=medium userfrom=etdolo adminprof=inv timezone=CEST main_type=ommod trigger_policy=sequatur sub_type=uidolo severity_level=lumquido policy=nihi src=10.114.150.67 src_port=1407 dst=10.76.73.140 dst_port=3075 http_method=uines http_url=nsec http_host=onse http_agent=emips http_session_id=imadmi signature_subclass=ostrume signature_id=6051 srccountry=eataev content_switch_name=liquide server_pool_name=uasia false_positive_mitigation=emp user_name=aperia monitor_status=ofdeFini http_refer=https://example.org/vol/riat.htm?atvol=umiur#imad http_version=msequi dev_id=isnostru threat_weight=iquaUten history_threat_weight=santium threat_level=iciatisu ftp_mode=rehender ftp_cmd=eporroqu cipher_suite=uat msg_id=tem +logver=suntinc date=2016-4-24 time=12:25:25 log_id=xeac devid=nidolo devname=tatn logid=eli type=nnu subtype=dolo level=low vd=nse srcip=10.202.204.239 srcport=7783 srcintf=lo2857 dstip=10.147.28.176 dstport=7432 dstintf=enp0s1462 poluuid=mporain sessionid=icons proto=0 action=accept policyid=sequi trandisp=rehend duration=3.138000 sentbyte=6354 rcvdbyte=3605 devtype=numqu osname=qui osversion=1.4059 mastersrcmac=equi srcmac=01:00:5e:68:86:a1 crscore=72.701000 craction=tat crlevel=ipitla eventtype=quae user=maccusa service=uptat hostname=equep5085.mail.domain profile=aqu reqtype=rpo url=https://www.example.org/inesci/serror.html?mqu=apariat#tlabore direction=internal msg=ihilm method=atDu cat=eav catdesc=ionevo device_id=remagn log_id=run pri=very-high userfrom=iamquis adminprof=quirat timezone=CET main_type=ittenbyC trigger_policy=isc sub_type=aturve severity_level=emulla policy=mpori src=10.195.36.51 src_port=3905 dst=10.95.64.124 dst_port=7042 http_method=iadese http_url=nsectet http_host=utla http_agent=utei http_session_id=laborum signature_subclass=tionof signature_id=7613 srccountry=oin content_switch_name=lapari server_pool_name=data false_positive_mitigation=dolor user_name=nnum monitor_status=eritqu http_refer=https://internal.example.net/wri/bor.jpg?hitect=dol#leumiu http_version=namali dev_id=taevit threat_weight=rinrepre history_threat_weight=etconse threat_level=tincu ftp_mode=ari ftp_cmd=exercit cipher_suite=sci msg_id=quamnih +logver=occae dtime=2016-05-08 07:27:59.552538723 +0000 UTC devid=ctetura devname=labore vd=texp date=2016-5-8 time=7:27:59 logid=tMalor type=acc subtype=amc level=very-high eventtime=amest logtime=corp srcip=10.176.216.90 srcport=2428 srcintf=eth2591 srcintfrole=dantiumt dstip=10.186.85.3 dstport=5366 dstintf=lo821 dstintfrole=ento poluuid=pic sessionid=evita proto=prm action=allow policyid=duntut policytype=magni crscore=102.339000 craction=uptat crlevel=uam appcat=boris service=nti srccountry=abi dstcountry=sectetur trandisp=uioffi tranip=10.114.16.155 tranport=1608 duration=62.941000 sentbyte=5110 rcvdbyte=3818 sentpkt=ipi app=reseos +logver=mcolab date=2016-5-22 time=2:30:33 log_id=neav devid=oquisqu devname=sperna logid=eabilloi type=estia subtype=tper level=very-high vd=volupt srcip=10.188.169.107 srcport=2138 srcintf=eth6448 dstip=10.214.7.83 dstport=1696 dstintf=lo1616 poluuid=tenatu sessionid=uun proto=HOPOPT action=cancel policyid=ectio trandisp=dutper duration=4.781000 sentbyte=3423 rcvdbyte=3252 devtype=radi osname=gel osversion=1.3917 mastersrcmac=iduntu srcmac=01:00:5e:21:f5:0a crscore=57.435000 craction=uamqu crlevel=lor eventtype=oide user=dolore service=amvolu hostname=eturadi6608.mail.host profile=aera reqtype=ate url=https://api.example.com/nimid/itatione.htm?umwr=oluptate#issus direction=inbound msg=uaUteni method=udantium cat=pre catdesc=xeacom device_id=stlabo log_id=dictasu pri=low userfrom=catc adminprof=nsect timezone=GMT-07:00 main_type=asia trigger_policy=econs sub_type=uir severity_level=dol policy=essecil src=10.23.62.94 src_port=4368 dst=10.61.163.4 dst_port=1232 http_method=luptatem http_url=atem http_host=gnido http_agent=ratvolu http_session_id=olup signature_subclass=numqua signature_id=1411 srccountry=inculpa content_switch_name=abo server_pool_name=veniamqu false_positive_mitigation=nse user_name=non monitor_status=paquioff http_refer=https://www5.example.org/maven/hende.jpg?labor=didunt#uptatema http_version=intocc dev_id=liqu threat_weight=eporr history_threat_weight=xeacomm threat_level=mveleu ftp_mode=nofdeFin ftp_cmd=sequam cipher_suite=temvel msg_id=ris +date=2016-6-5 time=9:33:08 logver=nisiuta devid=tvolu devname=ecte logid=tinvolu type=iurer subtype=iciadese level=medium vd=gnaaliq srcip=10.52.135.156 srcport=2660 srcintf=eth4502 dstip=10.133.89.11 dstport=1098 dstintf=lo4901 poluuid=sintoc sessionid=volupt proto=1 action=deny policyid=uiinea trandisp=Utenima duration=111.502000 sentbyte=1871 rcvdbyte=5074 devtype=ptatem osname=Nequepor osversion=1.2580 mastersrcmac=ugiatnu srcmac=01:00:5e:4a:7f:b8 crscore=103.738000 craction=mnisi crlevel=scivelit eventtype=tDuisaut user=oinBC service=quameius hostname=ipsumdol4488.api.localdomain profile=ommodico reqtype=ptas url=https://example.com/tetu/stru.htm?tlabore=Exc#pora direction=unknown msg=uteirure method=nevo cat=ide catdesc=aali device_id=adip log_id=tium pri=very-high userfrom=iusmodi adminprof=uamest timezone=PST main_type=uiac trigger_policy=epte sub_type=idolo severity_level=quinesc policy=madmi src=10.28.76.42 src_port=3427 dst=10.106.31.86 dst_port=4198 http_method=sno http_url=atno http_host=tani http_agent=volu http_session_id=nonn signature_subclass=inventor signature_id=6088 srccountry=autf content_switch_name=quamni server_pool_name=iatisu false_positive_mitigation=sec user_name=cons monitor_status=sBon http_refer=https://www.example.com/tae/ccaec.htm?aperiame=isc#ullamcor http_version=tobea dev_id=tor threat_weight=qui history_threat_weight=ntmollit threat_level=tenatus ftp_mode=cipitlab ftp_cmd=ipsumd cipher_suite=antiu msg_id=uirati +logver=ersp dtime=2016-06-20 04:35:42.332538723 +0000 UTC devid=tquov devname=diconseq vd=inven date=2016-6-20 time=4:35:42 logid=osquira type=tes subtype=mquame level=medium eventtime=tnulapa logtime=orain srcip=10.238.164.74 srcport=2201 srcintf=lo4249 srcintfrole=madmi dstip=10.106.162.153 dstport=341 dstintf=lo7114 dstintfrole=amvo poluuid=qui sessionid=tasn proto=1 action=accept policyid=squirati policytype=Sedutp crscore=92.058000 craction=nbyCic crlevel=utlabor appcat=itessequ service=porro srccountry=ine dstcountry=lup trandisp=tatemUt tranip=10.58.214.16 tranport=508 duration=166.566000 sentbyte=2715 rcvdbyte=7130 sentpkt=pici app=abor +logver=tquiin dtime=2016-07-04 11:38:16.592538723 +0000 UTC devid=tse devname=tenimad vd=minimav date=2016-7-4 time=11:38:16 logid=udexerci type=naal subtype=lore level=high eventtime=idolore logtime=pid srcip=10.225.141.20 srcport=2282 srcintf=enp0s4046 srcintfrole=natuse dstip=10.217.150.196 dstport=4639 dstintf=lo2438 dstintfrole=archite poluuid=loreme sessionid=untu proto=6 action=cancel policyid=datatno policytype=siutali crscore=49.988000 craction=usmodte crlevel=msequi appcat=tau service=exercita srccountry=ris dstcountry=eumiu trandisp=orumSe tranip=10.110.31.190 tranport=945 duration=12.946000 sentbyte=248 rcvdbyte=5300 sentpkt=eeufugia app=evit +date=2016-7-18 time=6:40:50 devname=molli device_id=velitse log_id=oditem type=generic subtype=gitsedqu pri=very-high devid=oremi devname=mestq logid=temUt type=olor subtype=ineavo level=very-high vd=mquelau srcip=10.168.236.85 srcport=6846 srcintf=eth651 dstip=10.140.113.244 dstport=4374 dstintf=lo4367 poluuid=fugitsed sessionid=quam proto=tcp action=deny policyid=fugiat trandisp=atisun duration=101.653000 sentbyte=3962 rcvdbyte=7741 devtype=dmin osname=fugi osversion=1.3319 mastersrcmac=inci srcmac=01:00:5e:e6:ad:ae crscore=39.291000 craction=avol crlevel=icero eventtype=xer user=emipsumd service=isisten hostname=cusant4946.www.domain profile=itecto reqtype=reetdol url=https://api.example.com/isnostr/umqu.htm?emquia=inesci#isnisi direction=unknown msg=aquioffi method=tamet cat=quatur catdesc=uisa device_id=eFi log_id=mexe pri=high userfrom=rpori adminprof=ice timezone=GMT+02:00 main_type=entorev trigger_policy=commodo sub_type=conseq severity_level=ame policy=tatn src=10.137.56.173 src_port=3932 dst=10.69.103.176 dst_port=1229 http_method=umdolo http_url=uptate http_host=amc http_agent=cusant http_session_id=orumSe signature_subclass=ratv signature_id=5227 srccountry=dutp content_switch_name=psaquaea server_pool_name=taevita false_positive_mitigation=ameiusm user_name=proide monitor_status=ano http_refer=https://www5.example.org/tvol/velitess.htm?edqui=nre#veli http_version=volupta dev_id=rnatu threat_weight=elitse history_threat_weight=ima threat_level=quasia ftp_mode=adi ftp_cmd=umwrit cipher_suite=uptate msg_id=mac +logver=dolore devname="onsecte" devid="nBCSedut" vd=ugiat date=2016-8-2 time=1:43:25 logid=onulam type=ate subtype=odoconse level=high eventtime=quatu logtime=veli srcip=10.30.47.165 srcport=631 srcintf=eth267 srcintfrole=sectet dstip=10.5.235.217 dstport=3689 dstintf=lo5047 dstintfrole=pitl poluuid=por sessionid=quidexea proto=tcp action=deny policyid=runtmol policytype=texpli crscore=57.772000 craction=ptass crlevel=rita appcat=esseci service=tametcon srccountry=liqua dstcountry=mvele trandisp=isis tranip=10.25.212.118 tranport=1190 duration=179.686000 sentbyte=238 rcvdbyte=7122 sentpkt=dantium app=lor +date=2016-8-16 time=8:45:59 logver=onemulla devid=dolorem devname=tvolu logid=nreprehe type=tetu subtype=mdol level=high vd=nby srcip=10.20.26.210 srcport=2791 srcintf=eth5968 dstip=10.85.96.153 dstport=5286 dstintf=eth4392 poluuid=nsequat sessionid=doloreme proto=0 action=deny policyid=reprehe trandisp=tincu duration=93.111000 sentbyte=2826 rcvdbyte=6247 devtype=lor osname=oraincid osversion=1.225 mastersrcmac=emeumfug srcmac=01:00:5e:1d:39:39 crscore=114.626000 craction=liqua crlevel=olo eventtype=psumqu user=untincul service=iduntu hostname=ccaeca5504.internal.example profile=reseo reqtype=oreetd url=https://example.org/tiaec/rumwrit.txt?oconsequ=edquiac#urerepr direction=external msg=ercit method=etMal cat=qua catdesc=rsita device_id=ate log_id=ipsamvo pri=low userfrom=adeseru adminprof=tdol timezone=CET main_type=rem trigger_policy=asper sub_type=idunt severity_level=luptat policy=eveli src=10.149.13.76 src_port=7809 dst=10.40.152.253 dst_port=1478 http_method=ritt http_url=iaeco http_host=equaturv http_agent=siu http_session_id=snost signature_subclass=tpersp signature_id=2624 srccountry=quaea content_switch_name=ametcons server_pool_name=utali false_positive_mitigation=porinc user_name=tetur monitor_status=xce http_refer=https://example.com/aincidu/nimadmin.jpg?itinv=eumfugi#etdolor http_version=lupta dev_id=xeaco threat_weight=nvolupt history_threat_weight=oremi threat_level=elites ftp_mode=nbyCi ftp_cmd=tevel cipher_suite=usc msg_id=rem +logver=cab dtime=2016-08-30 15:48:33.632538723 +0000 UTC devid=atisund devname=xea vd=ites date=2016-8-30 time=3:48:33 logid=isetq type=iutali subtype=velite level=high eventtime=avolupt logtime=ariatur srcip=10.98.194.212 srcport=5469 srcintf=lo1208 srcintfrole=atisetqu dstip=10.51.213.42 dstport=988 dstintf=enp0s3449 dstintfrole=ilmol poluuid=eri sessionid=quunt proto=HOPOPT action=deny policyid=mquae policytype=eriti crscore=96.729000 craction=cidunt crlevel=plica appcat=ore service=quidolor srccountry=inven dstcountry=eufugi trandisp=accusant tranip=10.233.120.207 tranport=136 duration=171.844000 sentbyte=2859 rcvdbyte=4844 sentpkt=eaqu app=nvol +logver=leumiu devname="tla" devid="item" vd=nimid date=2016-9-13 time=10:51:07 logid=dat type=periam subtype=dqu level=high eventtime=dminima logtime=dutpers srcip=10.245.187.229 srcport=4953 srcintf=lo3642 srcintfrole=prehen dstip=10.67.132.242 dstport=2340 dstintf=enp0s2700 dstintfrole=sequa poluuid=iosamnis sessionid=volupt proto=6 action=allow policyid=idid policytype=tesse crscore=64.509000 craction=boru crlevel=ptateve appcat=enderi service=ptatem srccountry=ptatevel dstcountry=tenatuse trandisp=psaqua tranip=10.241.132.176 tranport=7224 duration=167.705000 sentbyte=6595 rcvdbyte=7301 sentpkt=tame app=atione +date=2016-9-28 time=5:53:42 logver=vitaedic devid=orin devname=uii logid=estl type=sitam subtype=orem level=very-high vd=uuntur srcip=10.210.28.247 srcport=3449 srcintf=eth4185 dstip=10.237.180.17 dstport=3023 dstintf=lo7672 poluuid=tate sessionid=onevo proto=6 action=allow policyid=aeconseq trandisp=lor duration=96.560000 sentbyte=2760 rcvdbyte=1775 devtype=emqu osname=riss osversion=1.1847 mastersrcmac=sitvol srcmac=01:00:5e:a5:5a:54 crscore=129.120000 craction=olorsi crlevel=aliq eventtype=mes user=mven service=olorsit hostname=tore7088.www.invalid profile=ruredo reqtype=mac url=https://mail.example.org/ptassita/its.gif?risnis=uov#itlab direction=outbound msg=sBono method=loremqu cat=tetur catdesc=amvo device_id=siuta log_id=urmagn pri=low userfrom=uptat adminprof=idex timezone=GMT+02:00 main_type=tatione trigger_policy=nimveni sub_type=idi severity_level=ore policy=quid src=10.212.214.4 src_port=6040 dst=10.199.47.220 dst_port=4084 http_method=oin http_url=hil http_host=cingel http_agent=modocon http_session_id=ipsu signature_subclass=ntNeq signature_id=1081 srccountry=aUt content_switch_name=boNem server_pool_name=nturm false_positive_mitigation=emips user_name=atv monitor_status=onu http_refer=https://www5.example.net/alorum/obeataev.gif?atDu=nsec#quidolor http_version=oqu dev_id=naaliq threat_weight=remeu history_threat_weight=osquir threat_level=mod ftp_mode=col ftp_cmd=mve cipher_suite=liquide msg_id=odt +date=2016-10-12 time=12:56:16 logver=inv devid=rroq devname=rcit logid=aecatcup type=olabor subtype=estl level=very-high vd=citatio srcip=10.168.40.197 srcport=7699 srcintf=enp0s3071 dstip=10.206.69.135 dstport=6396 dstintf=eth3862 poluuid=utfug sessionid=aturQu proto=udp action=deny policyid=mipsamvo trandisp=eiusmod duration=91.147000 sentbyte=6153 rcvdbyte=4059 devtype=oreveri osname=ehende osversion=1.760 mastersrcmac=Except srcmac=01:00:5e:bf:07:ee crscore=45.760000 craction=dol crlevel=sciun eventtype=metcons user=itasper service=uae hostname=mve1890.internal.home profile=tatemU reqtype=mad url=https://www.example.org/redol/gnaa.htm?aliquamq=dtempori#toditaut direction=unknown msg=dexerc method=strumex cat=eprehend catdesc=asnu device_id=hitec log_id=henderit pri=medium userfrom=perspici adminprof=ationul timezone=PST main_type=itsedq trigger_policy=uto sub_type=emUte severity_level=molestia policy=quir src=10.46.56.204 src_port=2463 dst=10.234.165.130 dst_port=7079 http_method=umf http_url=quames http_host=dolorsit http_agent=archite http_session_id=remq signature_subclass=veniamq signature_id=1236 srccountry=uta content_switch_name=emo server_pool_name=itq false_positive_mitigation=derit user_name=orese monitor_status=dolor http_refer=https://mail.example.com/ntexpl/dunt.jpg?yCic=nder#mdolore http_version=Cic dev_id=olorema threat_weight=mollita history_threat_weight=tatem threat_level=iae ftp_mode=quido ftp_cmd=emip cipher_suite=inBC msg_id=mol +logver=turadipi date=2016-10-26 time=7:58:50 log_id=usmodi devid=ree devname=saquaea logid=ation type=luptas subtype=minim level=very-high vd=lorsi srcip=10.61.123.159 srcport=754 srcintf=eth7713 dstip=10.141.158.225 dstport=4690 dstintf=lo1586 poluuid=ate sessionid=idolor proto=1 action=block policyid=nreprehe trandisp=onse duration=71.505000 sentbyte=4010 rcvdbyte=4527 devtype=duntutla osname=ntium osversion=1.4450 mastersrcmac=asuntexp srcmac=01:00:5e:26:56:73 crscore=5.843000 craction=nse crlevel=modoc eventtype=boNem user=iumt service=tsed hostname=eturad6143.www.home profile=uamnihil reqtype=llam url=https://example.net/aparia/tatnon.jpg?rever=ore#offici direction=outbound msg=metco method=acom cat=ceroinB catdesc=nim device_id=utaliqu log_id=rsi pri=high userfrom=imadmi adminprof=isnis timezone=CEST main_type=olupta trigger_policy=tsuntinc sub_type=inrepreh severity_level=quovo policy=urExcep src=10.128.46.70 src_port=5269 dst=10.95.117.134 dst_port=1723 http_method=acommodi http_url=essecill http_host=billoi http_agent=moles http_session_id=dipiscin signature_subclass=olup signature_id=5976 srccountry=undeomni content_switch_name=accusa server_pool_name=natu false_positive_mitigation=liquid user_name=enim monitor_status=Finibus http_refer=https://www.example.org/xeacom/des.gif?umdolo=ntiu#radipisc http_version=Cice dev_id=taedi threat_weight=tquido history_threat_weight=ptasnula threat_level=oru ftp_mode=ill ftp_cmd=mporinc cipher_suite=onsectet msg_id=idolo +date=2016-11-10 time=3:01:24 logver=edolo devid=ugiatquo devname=ntium logid=uptate type=lloinven subtype=econs level=medium vd=tetura srcip=10.135.106.42 srcport=6602 srcintf=lo154 dstip=10.224.30.160 dstport=5302 dstintf=eth1247 poluuid=etconsec sessionid=caboNem proto=21 action=cancel policyid=rumetMal trandisp=oconse duration=2.970000 sentbyte=7685 rcvdbyte=1506 devtype=sequam osname=oditempo osversion=1.7544 mastersrcmac=taliqui srcmac=01:00:5e:98:79:a3 crscore=78.248000 craction=rcitat crlevel=dolorema eventtype=emagn user=radipis service=ctetu hostname=orinrep5386.www.corp profile=stenatus reqtype=equep url=https://www.example.com/tali/BCS.txt?iqu=niamqu#equamnih direction=inbound msg=autemv method=emq cat=plicaboN catdesc=amc device_id=vol log_id=admi pri=medium userfrom=culpaq adminprof=saute timezone=GMT+02:00 main_type=ende trigger_policy=abor sub_type=magnid severity_level=adol policy=iutal src=10.208.21.135 src_port=2721 dst=10.253.228.140 dst_port=6748 http_method=ugitse http_url=quiineav http_host=billoinv http_agent=sci http_session_id=col signature_subclass=obea signature_id=5700 srccountry=tatev content_switch_name=luptas server_pool_name=uptatem false_positive_mitigation=oinv user_name=inculp monitor_status=onofd http_refer=https://internal.example.org/nisiu/imad.html?ptatem=itasp#dexe http_version=tat dev_id=onproide threat_weight=ntmo history_threat_weight=loreeu threat_level=temse ftp_mode=aspernat ftp_cmd=ume cipher_suite=caecat msg_id=rautod +logver=ercitat date=2016-11-24 time=10:03:59 log_id=lapar devid=ritati devname=edquia logid=itesse type=mullam subtype=mexerc level=medium vd=amvolu srcip=10.120.231.161 srcport=1129 srcintf=lo653 dstip=10.210.62.203 dstport=4381 dstintf=lo3057 poluuid=ataevita sessionid=oremqu proto=6 action=cancel policyid=velitsed trandisp=magnaali duration=92.900000 sentbyte=3984 rcvdbyte=4009 devtype=ulla osname=equatDu osversion=1.1710 mastersrcmac=aconse srcmac=01:00:5e:92:c2:23 crscore=20.350000 craction=squira crlevel=aliqui eventtype=ess user=uide service=scivel hostname=henderi724.www5.home profile=tquas reqtype=aquio url=https://www.example.com/iame/orroquis.htm?tiumd=ntmoll#mexer direction=internal msg=isnostru method=nofdeFi cat=aquioff catdesc=saqu device_id=remips log_id=illoi pri=medium userfrom=abori adminprof=uisnostr timezone=GMT+02:00 main_type=ilmole trigger_policy=ugi sub_type=niamquis severity_level=nisi policy=emveleum src=10.243.226.122 src_port=3512 dst=10.3.23.172 dst_port=7332 http_method=emullamc http_url=tec http_host=Nemo http_agent=tutlabo http_session_id=mveleum signature_subclass=liq signature_id=7229 srccountry=sBonorum content_switch_name=atems server_pool_name=quira false_positive_mitigation=tassita user_name=olorem monitor_status=sedquiac http_refer=https://www.example.com/atDuis/asnulapa.html?rumwri=velill#ore http_version=tation dev_id=loinve threat_weight=tatevel history_threat_weight=iumdolo threat_level=untu ftp_mode=ict ftp_cmd=squirati cipher_suite=tem msg_id=mestq +logver=luptate date=2016-12-8 time=5:06:33 log_id=llamc devid=eleumiu devname=uei logid=Nequepo type=radipis subtype=cive level=low vd=orumSec srcip=10.56.74.7 srcport=6149 srcintf=eth2940 dstip=10.73.10.215 dstport=2079 dstintf=lo3472 poluuid=oeni sessionid=untutlab proto=0 action=cancel policyid=consecte trandisp=pteurs duration=26.872000 sentbyte=617 rcvdbyte=1651 devtype=ons osname=tiaecon osversion=1.5380 mastersrcmac=unt srcmac=01:00:5e:99:7b:4a crscore=124.392000 craction=queporro crlevel=uid eventtype=snostrum user=psa service=nculpaq hostname=reseosqu1629.mail.lan profile=utemvel reqtype=epteur url=https://www.example.net/iame/laudanti.htm?stquido=rsitvolu#mnisi direction=external msg=uameiusm method=adm cat=gelitsed catdesc=tiumto device_id=cor log_id=odoco pri=high userfrom=labore adminprof=ianonnu timezone=PST main_type=rum trigger_policy=erc sub_type=ehende severity_level=tutla policy=licaboNe src=10.94.242.80 src_port=2724 dst=10.106.85.174 dst_port=307 http_method=atiset http_url=serror http_host=onse http_agent=umquam http_session_id=emagn signature_subclass=emulla signature_id=1963 srccountry=iquaUt content_switch_name=mnihilm server_pool_name=redo false_positive_mitigation=etMaloru user_name=lmo monitor_status=iquidex http_refer=https://www.example.org/remipsu/tan.html?mcorpor=doconse#etdol http_version=dolorsi dev_id=nturmag threat_weight=tura history_threat_weight=osquirat threat_level=equat ftp_mode=aliquid ftp_cmd=usantiu cipher_suite=idunt msg_id=atqu +logver=liquam dtime=2016-12-23 00:09:07.712538723 +0000 UTC devid=min devname=oluptat vd=odt date=2016-12-23 time=12:09:07 logid=rspici type=snisi subtype=magnaal level=low eventtime=etquasia logtime=nula srcip=10.117.63.181 srcport=5299 srcintf=lo7416 srcintfrole=Cicero dstip=10.247.53.179 dstport=6493 dstintf=lo3706 dstintfrole=atemaccu poluuid=veritat sessionid=aliquipe proto=3 action=block policyid=aer policytype=osquira crscore=171.144000 craction=minim crlevel=scipi appcat=tur service=acon srccountry=Nemoenim dstcountry=usm trandisp=labori tranip=10.168.20.20 tranport=68 duration=167.038000 sentbyte=7188 rcvdbyte=5749 sentpkt=xeac app=umdolors +logver=uiadolo date=2017-1-6 time=7:11:41 log_id=empor devid=umexerci devname=duntut logid=uovol type=prehend subtype=eufug level=low vd=eufug srcip=10.100.53.8 srcport=4318 srcintf=eth5767 dstip=10.163.17.172 dstport=854 dstintf=enp0s3903 poluuid=upta sessionid=atc proto=3 action=block policyid=upta trandisp=itessequ duration=165.935000 sentbyte=4211 rcvdbyte=405 devtype=exerci osname=idata osversion=1.2208 mastersrcmac=usmod srcmac=01:00:5e:c0:47:f3 crscore=135.374000 craction=isiutali crlevel=iquidexe eventtype=illumq user=luptatem service=ite hostname=tasnul4179.internal.host profile=amvo reqtype=tnul url=https://www.example.org/ess/quiad.jpg?ten=litanim#rQuisaut direction=inbound msg=modico method=metco cat=cillu catdesc=iuntNeq device_id=eddoei log_id=rsin pri=very-high userfrom=eriam adminprof=pernat timezone=CEST main_type=imve trigger_policy=essequam sub_type=ueporro severity_level=aliqu policy=upt src=10.141.156.217 src_port=2700 dst=10.53.168.187 dst_port=73 http_method=emacc http_url=emp http_host=lamcola http_agent=veli http_session_id=venia signature_subclass=risni signature_id=1535 srccountry=uat content_switch_name=onemulla server_pool_name=riaturEx false_positive_mitigation=deri user_name=amqu monitor_status=lorsitam http_refer=https://api.example.org/onpr/litseddo.gif?oremqu=idex#radip http_version=upta dev_id=tetura threat_weight=rumet history_threat_weight=uptasnul threat_level=antiumdo ftp_mode=ecill ftp_cmd=iduntu cipher_suite=pisci msg_id=sunt +date=2017-1-20 time=2:14:16 devname=oco device_id=aboree log_id=ainci type=generic subtype=osqu pri=very-high devid=sus devname=imavenia logid=expli type=ugiat subtype=rnat level=low vd=orem srcip=10.37.174.58 srcport=3193 srcintf=lo2990 dstip=10.249.60.66 dstport=4859 dstintf=enp0s1732 poluuid=eve sessionid=tco proto=3 action=accept policyid=oluptate trandisp=lit duration=70.988000 sentbyte=6327 rcvdbyte=837 devtype=oquisqu osname=turadip osversion=1.3402 mastersrcmac=amc srcmac=01:00:5e:dd:dc:44 crscore=160.379000 craction=apar crlevel=runtm eventtype=eturadip user=olorsi service=itseddo hostname=bore5546.www.local profile=labo reqtype=lpaquiof url=https://example.com/xeac/llitanim.txt?oreverit=scip#Finibus direction=inbound msg=eufugia method=ncididun cat=hen catdesc=periamea device_id=itametco log_id=vel pri=high userfrom=rere adminprof=pta timezone=CEST main_type=equeporr trigger_policy=met sub_type=volup severity_level=ptate policy=entsu src=10.44.198.184 src_port=5695 dst=10.189.82.19 dst_port=4267 http_method=odoc http_url=atura http_host=tur http_agent=tur http_session_id=atnonpr signature_subclass=ita signature_id=7570 srccountry=colabori content_switch_name=imidestl server_pool_name=piscing false_positive_mitigation=ceroi user_name=iconsequ monitor_status=iat http_refer=https://www.example.net/siuta/atev.htm?CSe=exerci#inesciu http_version=quid dev_id=atcupid threat_weight=onse history_threat_weight=psa threat_level=ate ftp_mode=con ftp_cmd=tqu cipher_suite=eirur msg_id=dese +logver=mquisnos date=2017-2-3 time=9:16:50 log_id=lore devid=isci devname=Dui logid=reetdo type=ever subtype=civelits level=high vd=quiav srcip=10.154.34.15 srcport=5986 srcintf=enp0s4064 dstip=10.153.172.249 dstport=7030 dstintf=enp0s3067 poluuid=henderit sessionid=remq proto=21 action=cancel policyid=tla trandisp=arch duration=52.795000 sentbyte=5453 rcvdbyte=3097 devtype=ror osname=onsecte osversion=1.91 mastersrcmac=aecatcup srcmac=01:00:5e:58:7e:f5 crscore=133.560000 craction=quas crlevel=occaeca eventtype=eturadip user=ent service=rumSecti hostname=Utenima260.mail.invalid profile=cept reqtype=aedictas url=https://api.example.org/orio/gna.gif?aaliquaU=olu#iameaque direction=external msg=essequa method=aquio cat=rspicia catdesc=deom device_id=oluptat log_id=roinBCSe pri=medium userfrom=onproide adminprof=uamnih timezone=GMT+02:00 main_type=tatisetq trigger_policy=uidolo sub_type=umdolore severity_level=dmi policy=tam src=10.151.170.207 src_port=1400 dst=10.181.183.104 dst_port=5554 http_method=amni http_url=tatio http_host=amquisno http_agent=modoc http_session_id=magnam signature_subclass=uinesc signature_id=4248 srccountry=idatat content_switch_name=onev server_pool_name=orsi false_positive_mitigation=ntsunt user_name=iosamni monitor_status=idu http_refer=https://example.net/idolo/reet.txt?its=umdolor#isiu http_version=assi dev_id=eserun threat_weight=rvelill history_threat_weight=lupta threat_level=byC ftp_mode=imadm ftp_cmd=uta cipher_suite=tisu msg_id=remagnam +logver=iumdo date=2017-2-18 time=4:19:24 log_id=iusmodit devid=aturv devname=ectetura logid=obeataev type=umf subtype=olesti level=low vd=quaeabil srcip=10.19.99.129 srcport=956 srcintf=eth62 dstip=10.205.132.218 dstport=1643 dstintf=enp0s5908 poluuid=inim sessionid=etdol proto=17 action=deny policyid=oremeumf trandisp=lesti duration=49.961000 sentbyte=3376 rcvdbyte=6209 devtype=enima osname=tnulapar osversion=1.7278 mastersrcmac=sequ srcmac=01:00:5e:4a:1d:f8 crscore=84.522000 craction=tionula crlevel=accus eventtype=uatu user=mquis service=lab hostname=uido2046.mail.lan profile=tena reqtype=aal url=https://mail.example.org/nimadmin/lumqui.txt?iquip=tinculpa#umtota direction=external msg=rumSecti method=riamea cat=eca catdesc=oluptate device_id=Duisa log_id=consequa pri=low userfrom=iaecon adminprof=aevitaed timezone=PT main_type=rep trigger_policy=remap sub_type=deri severity_level=quaeratv policy=involu src=10.70.7.23 src_port=2758 dst=10.130.240.11 dst_port=6515 http_method=odic http_url=iuta http_host=liquaUte http_agent=scivelit http_session_id=Nequ signature_subclass=quid signature_id=1044 srccountry=lloinve content_switch_name=borisnis server_pool_name=onorumet false_positive_mitigation=ptatema user_name=eavolup monitor_status=ipsumq http_refer=https://www.example.org/tno/iss.gif?ptatev=atu#teturad http_version=eturad dev_id=tDuis threat_weight=mwritten history_threat_weight=tat threat_level=equ ftp_mode=sumdolo ftp_cmd=idolorem cipher_suite=temvele msg_id=oremque +logver=inimve devname="uio" devid="mexercit" vd=byC date=2017-3-4 time=11:21:59 logid=uae type=oremip subtype=its level=very-high eventtime=iavol logtime=natuserr srcip=10.37.161.101 srcport=1552 srcintf=enp0s6659 srcintfrole=evit dstip=10.111.182.212 dstport=4493 dstintf=lo6533 dstintfrole=lamco poluuid=tion sessionid=hender proto=icmp action=deny policyid=seq policytype=rumSe crscore=88.660000 craction=madmi crlevel=tlabore appcat=idunt service=expl srccountry=olore dstcountry=uian trandisp=atuserro tranip=10.17.209.252 tranport=2119 duration=135.770000 sentbyte=313 rcvdbyte=6509 sentpkt=oinBCS app=itsedd +logver=ipis devname="itautfu" devid="nesci" vd=tam date=2017-3-18 time=6:24:33 logid=sin type=idexeac subtype=nimadmin level=medium eventtime=edutper logtime=tevelite srcip=10.158.175.98 srcport=1491 srcintf=enp0s7649 srcintfrole=oinBCSed dstip=10.170.196.181 dstport=6994 dstintf=enp0s5873 dstintfrole=obeatae poluuid=iquid sessionid=evo proto=udp action=allow policyid=mqu policytype=pteursi crscore=98.596000 craction=expl crlevel=essecill appcat=totamre service=rpo srccountry=velites dstcountry=nonpro trandisp=nula tranip=10.153.166.133 tranport=4638 duration=39.506000 sentbyte=6610 rcvdbyte=1936 sentpkt=olu app=imide +date=2017-4-2 time=1:27:07 logver=amn devid=itessequ devname=porissu logid=umd type=sumd subtype=sectetur level=low vd=aUtenima srcip=10.62.10.137 srcport=5596 srcintf=lo6539 dstip=10.138.249.251 dstport=630 dstintf=eth1576 poluuid=deritinv sessionid=evelite proto=6 action=accept policyid=stiaecon trandisp=usBono duration=155.835000 sentbyte=3942 rcvdbyte=5360 devtype=ttenb osname=olor osversion=1.5978 mastersrcmac=lapa srcmac=01:00:5e:b0:3e:44 crscore=105.845000 craction=lors crlevel=oluptat eventtype=enimad user=tis service=qua hostname=con6049.internal.lan profile=quelaud reqtype=luptat url=https://internal.example.com/temse/caecat.jpg?emeu=tatemac#quisn direction=inbound msg=teursint method=etMa cat=llita catdesc=ntsunt device_id=nturmag log_id=uredol pri=high userfrom=temsequi adminprof=mquia timezone=ET main_type=enbyCic trigger_policy=iveli sub_type=conseq severity_level=itame policy=tenat src=10.63.171.91 src_port=4396 dst=10.48.25.200 dst_port=5179 http_method=nse http_url=mveniam http_host=tuser http_agent=mmo http_session_id=eve signature_subclass=nbyCicer signature_id=6129 srccountry=ciad content_switch_name=ugiatqu server_pool_name=eruntmo false_positive_mitigation=nimve user_name=usanti monitor_status=ion http_refer=https://mail.example.org/gelits/iavo.txt?udexerc=ovolupta#volup http_version=macc dev_id=ria threat_weight=beat history_threat_weight=rro threat_level=tuser ftp_mode=ctasu ftp_cmd=irat cipher_suite=sitame msg_id=oinven +logver=ute dtime=2017-04-16 08:29:41.792538723 +0000 UTC devid=mexer devname=iam vd=Bonoru date=2017-4-16 time=8:29:41 logid=rcitati type=nula subtype=ameaquei level=low eventtime=adipi logtime=mquis srcip=10.174.17.46 srcport=2743 srcintf=eth6814 srcintfrole=ine dstip=10.77.105.81 dstport=4455 dstintf=enp0s7799 dstintfrole=orem poluuid=giatqu sessionid=rsint proto=udp action=allow policyid=paq policytype=uianon crscore=60.762000 craction=uisautem crlevel=mquameiu appcat=loremq service=turmagni srccountry=ores dstcountry=ddoe trandisp=uid tranip=10.38.168.190 tranport=7260 duration=129.140000 sentbyte=368 rcvdbyte=7791 sentpkt=incidi app=aedictas +logver=temaccus devname="ons" devid="unt" vd=liq date=2017-4-30 time=3:32:16 logid=abore type=iumdo subtype=oreeu level=high eventtime=exe logtime=tis srcip=10.36.99.207 srcport=4829 srcintf=lo497 srcintfrole=tvol dstip=10.225.37.73 dstport=5630 dstintf=eth1882 dstintfrole=eniamqu poluuid=iumt sessionid=porissus proto=udp action=cancel policyid=tsunt policytype=rnat crscore=88.508000 craction=ured crlevel=ctetu appcat=oreeu service=uasiarch srccountry=Malor dstcountry=boriosa trandisp=cillumdo tranip=10.166.142.198 tranport=4151 duration=1.040000 sentbyte=465 rcvdbyte=7663 sentpkt=oreetd app=lor +logver=etc devname="eturadip" devid="nost" vd=atus date=2017-5-14 time=10:34:50 logid=tassitas type=obea subtype=velite level=medium eventtime=litse logtime=san srcip=10.66.90.225 srcport=4846 srcintf=lo4891 srcintfrole=moenimi dstip=10.214.156.161 dstport=3854 dstintf=eth1188 dstintfrole=ati poluuid=rauto sessionid=doloreeu proto=6 action=block policyid=eumfu policytype=docons crscore=3.408000 craction=eumf crlevel=roquisq appcat=uasi service=maveniam srccountry=uis dstcountry=lill trandisp=remeum tranip=10.145.194.12 tranport=1001 duration=25.398000 sentbyte=6452 rcvdbyte=6820 sentpkt=aturE app=umto +logver=pariat devname="iutal" devid="teturad" vd=ese date=2017-5-29 time=5:37:24 logid=eddoei type=lorumw subtype=eca level=medium eventtime=nimve logtime=duntut srcip=10.6.242.108 srcport=3373 srcintf=lo3230 srcintfrole=qua dstip=10.156.208.5 dstport=7612 dstintf=lo1800 dstintfrole=quisn poluuid=pteu sessionid=uatD proto=0 action=cancel policyid=antiu policytype=velillum crscore=166.389000 craction=iatquovo crlevel=lapari appcat=Mal service=itinvo srccountry=snulap dstcountry=cidu trandisp=hilmol tranip=10.163.36.101 tranport=253 duration=72.488000 sentbyte=1880 rcvdbyte=4638 sentpkt=ident app=scip +date=2017-6-12 time=12:39:58 devname=uamqu device_id=iusmodi log_id=esciun type=generic subtype=tasnul pri=medium devid=ccusant devname=epteurs logid=rmag type=quisquam subtype=eporroqu level=very-high vd=dit srcip=10.25.134.171 srcport=7867 srcintf=eth4543 dstip=10.43.235.230 dstport=2198 dstintf=lo4581 poluuid=BCSe sessionid=rem proto=0 action=allow policyid=eeufug trandisp=ntin duration=6.686000 sentbyte=5763 rcvdbyte=1048 devtype=cinge osname=tatem osversion=1.4713 mastersrcmac=eritqu srcmac=01:00:5e:ed:6b:57 crscore=10.603000 craction=nimip crlevel=iutaliq eventtype=olore user=onemul service=trudexe hostname=remeum2641.www5.corp profile=Quisa reqtype=quiav url=https://www5.example.com/elit/sam.htm?nevolu=unt#isni direction=outbound msg=ecillum method=olor cat=amei catdesc=doconseq device_id=conseq log_id=emve pri=very-high userfrom=tiu adminprof=wri timezone=GMT-07:00 main_type=asper trigger_policy=dictasun sub_type=psa severity_level=lorese policy=olupta src=10.220.148.127 src_port=6681 dst=10.68.233.163 dst_port=3126 http_method=itanimi http_url=onoru http_host=data http_agent=ugits http_session_id=ittenb signature_subclass=tobeatae signature_id=5617 srccountry=quis content_switch_name=exe server_pool_name=naa false_positive_mitigation=equat user_name=estiaec monitor_status=pitlabo http_refer=https://example.net/rcitat/ree.htm?ionofdeF=rsp#imipsa http_version=nostrum dev_id=autodita threat_weight=ntut history_threat_weight=temveleu threat_level=itametco ftp_mode=etcons ftp_cmd=etco cipher_suite=iuntN msg_id=utfugi +logver=isnostru date=2017-6-26 time=7:42:33 log_id=nul devid=ntocca devname=trudex logid=tvol type=lup subtype=mipsamv level=medium vd=qua srcip=10.249.194.7 srcport=4987 srcintf=enp0s2282 dstip=10.57.116.17 dstport=90 dstintf=enp0s7442 poluuid=xcep sessionid=gnidol proto=0 action=allow policyid=uaeab trandisp=ptat duration=136.310000 sentbyte=1078 rcvdbyte=6196 devtype=eturadip osname=amquaera osversion=1.4481 mastersrcmac=equ srcmac=01:00:5e:00:fd:79 crscore=18.750000 craction=olesti crlevel=edquia eventtype=ihi user=undeomn service=ape hostname=itaspe3216.localdomain profile=onsecte reqtype=prehende url=https://example.org/porro/issu.htm?inculpa=ruredol#iadeseru direction=unknown msg=numq method=quae cat=periam catdesc=ain device_id=umiurer log_id=mquido pri=very-high userfrom=onorume adminprof=abill timezone=GMT+02:00 main_type=uov trigger_policy=mini sub_type=mve severity_level=tionev policy=uasiarch src=10.116.82.108 src_port=7276 dst=10.94.177.125 dst_port=6683 http_method=nimides http_url=olorsit http_host=naaliq http_agent=plica http_session_id=asiarc signature_subclass=lor signature_id=5152 srccountry=snula content_switch_name=pici server_pool_name=bori false_positive_mitigation=dipi user_name=ecatc monitor_status=quovolu http_refer=https://example.net/itse/sse.gif?lupt=quatur#dminim http_version=ptatevel dev_id=aperiame threat_weight=stenat history_threat_weight=uianonnu threat_level=tatiset ftp_mode=quira ftp_cmd=ciatisun cipher_suite=duntutl msg_id=nven +date=2017-7-11 time=2:45:07 devname=saq device_id=asiarch log_id=ssuscipi type=generic subtype=utla pri=medium devid=tquovo devname=fugi logid=nse type=nesciu subtype=todit level=very-high vd=inrepreh srcip=10.14.192.162 srcport=2536 srcintf=enp0s4429 dstip=10.179.128.6 dstport=3375 dstintf=enp0s4580 poluuid=ptate sessionid=volupta proto=3 action=cancel policyid=utla trandisp=emi duration=171.651000 sentbyte=3313 rcvdbyte=7131 devtype=velites osname=oloremi osversion=1.4442 mastersrcmac=apari srcmac=01:00:5e:0c:fb:2b crscore=140.065000 craction=uel crlevel=fficiad eventtype=teirured user=nostru service=rcit hostname=mea6298.api.example profile=eumiu reqtype=tatevel url=https://mail.example.org/uamquaer/texplica.gif?sequa=lorum#suntexpl direction=inbound msg=Sedut method=tatis cat=audant catdesc=obeata device_id=uredol log_id=uptat pri=low userfrom=entorev adminprof=quuntur timezone=GMT+02:00 main_type=exercit trigger_policy=dexer sub_type=idolor severity_level=onpr policy=uira src=10.115.121.243 src_port=550 dst=10.113.152.241 dst_port=2330 http_method=ali http_url=udexerci http_host=uae http_agent=imveni http_session_id=econ signature_subclass=aborio signature_id=1122 srccountry=setquas content_switch_name=nbyCi server_pool_name=runtmoll false_positive_mitigation=busBon user_name=norumetM monitor_status=isno http_refer=https://internal.example.com/ameaq/Quis.html?lestiae=iav#umiure http_version=isiut dev_id=tin threat_weight=rporiss history_threat_weight=billoinv threat_level=etconse ftp_mode=nesciu ftp_cmd=mali cipher_suite=roinBCSe msg_id=eetdolor +date=2017-7-25 time=9:47:41 logver=upt devid=equamni devname=atcupi logid=enima type=uptateve subtype=fugitsed level=medium vd=lorem srcip=10.68.159.207 srcport=3320 srcintf=enp0s7206 dstip=10.139.195.188 dstport=893 dstintf=enp0s6960 poluuid=lits sessionid=tvolu proto=17 action=accept policyid=ollitan trandisp=temseq duration=0.684000 sentbyte=3045 rcvdbyte=6863 devtype=edictasu osname=eturadi osversion=1.3804 mastersrcmac=edquiano srcmac=01:00:5e:09:79:f2 crscore=11.231000 craction=taevitae crlevel=tevel eventtype=tatemse user=gitsed service=agn hostname=iqu7510.internal.corp profile=equeporr reqtype=amremap url=https://www5.example.org/aqu/utemvele.gif?serrorsi=tsedquia#rsit direction=unknown msg=ntutlabo method=idex cat=nihilmo catdesc=reetdo device_id=xeaco log_id=taliqu pri=medium userfrom=hite adminprof=umfugi timezone=CT main_type=dminimve trigger_policy=remips sub_type=laboreet severity_level=uptate policy=tot src=10.49.82.45 src_port=435 dst=10.179.153.97 dst_port=1908 http_method=ade http_url=nihilmol http_host=nder http_agent=ano http_session_id=rumexer signature_subclass=eab signature_id=2387 srccountry=saquaeab content_switch_name=eli server_pool_name=rissusci false_positive_mitigation=ectetur user_name=dictasun monitor_status=inimv http_refer=https://api.example.org/volup/untNeq.htm?mremaper=uteirur#ntium http_version=ide dev_id=quunturm threat_weight=quovo history_threat_weight=quaturve threat_level=ntiumdol ftp_mode=conse ftp_cmd=aturve cipher_suite=edqui msg_id=tvolu +logver=ore devname="lors" devid="saute" vd=ecillumd date=2017-8-8 time=4:50:15 logid=iumto type=sequatu subtype=tiumtot level=medium eventtime=mdoloree logtime=que srcip=10.98.52.184 srcport=7402 srcintf=eth3784 srcintfrole=ita dstip=10.99.55.115 dstport=1537 dstintf=eth855 dstintfrole=isnostru poluuid=iad sessionid=ngelits proto=tcp action=accept policyid=billoi policytype=reseo crscore=158.047000 craction=uov crlevel=pariat appcat=icaboNe service=boreetd srccountry=uir dstcountry=rumex trandisp=ectobea tranip=10.205.83.138 tranport=6239 duration=170.113000 sentbyte=3290 rcvdbyte=722 sentpkt=ibus app=lumdol +logver=onnu devname="reprehe" devid="metMa" vd=emoen date=2017-8-22 time=11:52:50 logid=ptate type=mipsumqu subtype=turad level=high eventtime=billo logtime=doloremi srcip=10.197.128.162 srcport=2052 srcintf=lo6750 srcintfrole=ionof dstip=10.90.189.248 dstport=1293 dstintf=lo2402 dstintfrole=roi poluuid=reh sessionid=volup proto=prm action=allow policyid=iconsequ policytype=ueporr crscore=127.832000 craction=archite crlevel=tur appcat=ddo service=emp srccountry=inBC dstcountry=did trandisp=atcupi tranip=10.228.11.50 tranport=984 duration=3.401000 sentbyte=6907 rcvdbyte=422 sentpkt=mcol app=tion +date=2017-9-6 time=6:55:24 devname=moll device_id=roinBCS log_id=odit type=event subtype=vol pri=low desc=aloru user=cteturad userfrom=modi msg=cip action=deny adom=ntoccae2859.www.test session_id=incididu +date=2017-9-20 time=1:57:58 devname=uinesci device_id=otamr log_id=tsed type=generic subtype=rExc pri=medium devid=saute devname=umdol logid=rerepr type=ipiscin subtype=trudexe level=high vd=ineavol srcip=10.29.34.211 srcport=5638 srcintf=eth1805 dstip=10.161.15.82 dstport=6598 dstintf=enp0s5799 poluuid=aco sessionid=eFini proto=17 action=cancel policyid=mipsa trandisp=uas duration=118.122000 sentbyte=1737 rcvdbyte=6283 devtype=umexe osname=xce osversion=1.7318 mastersrcmac=suntex srcmac=01:00:5e:5b:68:89 crscore=29.865000 craction=rcitati crlevel=siutali eventtype=uiratio user=ficia service=orsit hostname=deFinibu3940.internal.lan profile=rautod reqtype=onorumet url=https://www5.example.com/etcon/chit.txt?erspici=itinvolu#adeserun direction=unknown msg=tinv method=Utenima cat=nse catdesc=umq device_id=enim log_id=oreve pri=low userfrom=snisiu adminprof=atem timezone=ET main_type=vento trigger_policy=litsed sub_type=ciun severity_level=rehender policy=tetura src=10.124.71.88 src_port=7540 dst=10.22.248.52 dst_port=6566 http_method=cons http_url=tinvolu http_host=ptat http_agent=amquisn http_session_id=Finibus signature_subclass=nsequat signature_id=3661 srccountry=scipi content_switch_name=rem server_pool_name=reh false_positive_mitigation=rsitame user_name=tcons monitor_status=squamest http_refer=https://mail.example.com/emveleum/siuta.html?ate=epteur#onproi http_version=usmodit dev_id=orese threat_weight=umdolore history_threat_weight=umqui threat_level=adipisci ftp_mode=eir ftp_cmd=ull cipher_suite=tlabor msg_id=itecto +date=2017-10-4 time=9:00:32 logver=ametcons devid=velite devname=ipexeac logid=explicab type=samvolu subtype=teiru level=low vd=orinrep srcip=10.228.213.136 srcport=7247 srcintf=lo1719 dstip=10.185.107.27 dstport=2257 dstintf=enp0s4999 poluuid=iduntutl sessionid=mipsumd proto=udp action=block policyid=quelauda trandisp=rcit duration=166.303000 sentbyte=7229 rcvdbyte=6230 devtype=orese osname=evelite osversion=1.4895 mastersrcmac=oremipsu srcmac=01:00:5e:cd:f6:0e crscore=37.237000 craction=equunt crlevel=mto eventtype=iae user=dent service=Uten hostname=tatiset4191.localdomain profile=aconseq reqtype=mquamei url=https://api.example.org/fug/liquid.txt?ptate=lloi#nseq direction=external msg=isetqua method=ianonn cat=oluptas catdesc=doe device_id=quipex log_id=rchitect pri=very-high userfrom=Bonor adminprof=ipex timezone=PT main_type=upta trigger_policy=ivel sub_type=tmollita severity_level=tionofd policy=iatnula src=10.185.37.176 src_port=1859 dst=10.26.58.20 dst_port=2809 http_method=essequam http_url=undeo http_host=ficiade http_agent=uiinea http_session_id=uianonn signature_subclass=eavolupt signature_id=784 srccountry=elitsedq content_switch_name=liquam server_pool_name=sinto false_positive_mitigation=edi user_name=eumiure monitor_status=ore http_refer=https://internal.example.com/mSe/sis.gif?rchite=rcit#orumwri http_version=tiae dev_id=giat threat_weight=nculpa history_threat_weight=olupt threat_level=tvol ftp_mode=ostru ftp_cmd=mea cipher_suite=tuserror msg_id=agnama +logver=deritq dtime=2017-10-19 04:03:07.172538723 +0000 UTC devid=boreetdo devname=teni vd=iin date=2017-10-19 time=4:03:07 logid=nostr type=luptatem subtype=tNequepo level=low eventtime=eumfug logtime=sper srcip=10.200.12.126 srcport=2347 srcintf=enp0s7374 srcintfrole=liqu dstip=10.14.145.107 dstport=4362 dstintf=enp0s7861 dstintfrole=aliq poluuid=utem sessionid=oreetd proto=HOPOPT action=block policyid=Nequepo policytype=edictas crscore=55.933000 craction=tur crlevel=borisnis appcat=elitsedd service=hitecto srccountry=loremi dstcountry=nven trandisp=isci tranip=10.250.231.196 tranport=5863 duration=4.105000 sentbyte=2763 rcvdbyte=5047 sentpkt=aquioff app=cip +logver=onsequat dtime=2017-11-02 11:05:41.432538723 +0000 UTC devid=tiumd devname=atuse vd=imad date=2017-11-2 time=11:05:41 logid=tura type=equuntur subtype=rve level=high eventtime=mqua logtime=xer srcip=10.225.34.176 srcport=5569 srcintf=lo2867 srcintfrole=amquisn dstip=10.21.203.112 dstport=5930 dstintf=enp0s1294 dstintfrole=sum poluuid=lloinve sessionid=eni proto=HOPOPT action=cancel policyid=edquiac policytype=psamvolu crscore=80.314000 craction=unturma crlevel=iavol appcat=psumdol service=urautodi srccountry=equamni dstcountry=fugia trandisp=uptate tranip=10.103.36.192 tranport=1974 duration=129.001000 sentbyte=2801 rcvdbyte=2565 sentpkt=imidest app=citation +logver=nof devname="usantiu" devid="periam" vd=remip date=2017-11-16 time=6:08:15 logid=dexea type=aturExc subtype=antiumto level=low eventtime=obe logtime=niamqu srcip=10.140.59.161 srcport=3599 srcintf=eth575 srcintfrole=tev dstip=10.5.67.140 dstport=5687 dstintf=enp0s6143 dstintfrole=intoc poluuid=obeataev sessionid=rrorsit proto=udp action=accept policyid=umquid policytype=olabo crscore=79.046000 craction=dolor crlevel=rsp appcat=quir service=giatqu srccountry=olors dstcountry=roid trandisp=lorum tranip=10.118.111.183 tranport=5410 duration=96.462000 sentbyte=6821 rcvdbyte=6222 sentpkt=mipsu app=nvol +date=2017-12-1 time=1:10:49 logver=llu devid=quaUt devname=labor logid=oris type=tatemse subtype=uta level=very-high vd=tse srcip=10.170.104.148 srcport=5722 srcintf=lo259 dstip=10.60.92.40 dstport=5836 dstintf=enp0s4446 poluuid=dicons sessionid=BCSedutp proto=udp action=accept policyid=ritatise trandisp=nihilm duration=104.607000 sentbyte=6659 rcvdbyte=5351 devtype=isauteir osname=eritquii osversion=1.4493 mastersrcmac=uisno srcmac=01:00:5e:e9:ec:d5 crscore=34.736000 craction=itaed crlevel=invol eventtype=Loremips user=cidun service=tassitas hostname=nimadmi4084.api.home profile=eufugia reqtype=nor url=https://example.net/aturQui/tquii.html?uiac=squ#litess direction=unknown msg=involupt method=itempo cat=upt catdesc=rve device_id=amq log_id=abillo pri=high userfrom=ationem adminprof=Nem timezone=OMST main_type=ollita trigger_policy=dipisci sub_type=amnisiu severity_level=ptat policy=epr src=10.7.70.169 src_port=2514 dst=10.28.212.191 dst_port=1997 http_method=nostru http_url=Loremip http_host=veleumiu http_agent=rcita http_session_id=turad signature_subclass=sequamni signature_id=4799 srccountry=ollita content_switch_name=ectetu server_pool_name=radi false_positive_mitigation=ula user_name=itsed monitor_status=rad http_refer=https://internal.example.com/ididu/autodit.gif?seru=oriss#imadmin http_version=suntexpl dev_id=urve threat_weight=sBonoru history_threat_weight=everi threat_level=squ ftp_mode=emagnaal ftp_cmd=nih cipher_suite=ncididu msg_id=itati +date=2017-12-15 time=8:13:24 logver=estla devid=ione devname=ecillum logid=maccu type=ame subtype=pitlabo level=very-high vd=urExc srcip=10.37.124.214 srcport=6919 srcintf=lo7727 dstip=10.37.111.228 dstport=7082 dstintf=enp0s20 poluuid=dmini sessionid=tquid proto=17 action=block policyid=iatisun trandisp=cto duration=144.899000 sentbyte=2372 rcvdbyte=7417 devtype=imadmini osname=iatisund osversion=1.6506 mastersrcmac=aUtenim srcmac=01:00:5e:28:0c:11 crscore=172.422000 craction=etdol crlevel=sed eventtype=uep user=ametco service=nde hostname=reprehe3525.www5.example profile=mquisno reqtype=eaco url=https://mail.example.org/mvele/teveli.htm?Nequepor=luptate#aturvel direction=internal msg=dexea method=sedquia cat=litesse catdesc=ntmo device_id=aliqu log_id=iqu pri=very-high userfrom=ationula adminprof=doconse timezone=CEST main_type=oreeufug trigger_policy=ptatems sub_type=tenima severity_level=emagnam policy=iaco src=10.148.197.60 src_port=5711 dst=10.143.144.52 dst_port=974 http_method=nvo http_url=lab http_host=sedqui http_agent=iuntNe http_session_id=tdolor signature_subclass=Ute signature_id=2191 srccountry=uepor content_switch_name=umSecti server_pool_name=eabil false_positive_mitigation=ibusB user_name=rporis monitor_status=etco http_refer=https://example.org/ereprehe/olu.html?liqu=ipsu#siarch http_version=itautfu dev_id=rrorsi threat_weight=ole history_threat_weight=odi threat_level=tper ftp_mode=olor ftp_cmd=corpo cipher_suite=commod msg_id=iumd +logver=aborisn dtime=2017-12-29 15:15:58.472538723 +0000 UTC devid=onproid devname=sitv vd=equam date=2017-12-29 time=3:15:58 logid=bor type=ameaquei subtype=aeca level=very-high eventtime=aperiam logtime=ngelit srcip=10.217.145.137 srcport=5242 srcintf=enp0s6940 srcintfrole=orema dstip=10.22.149.132 dstport=7725 dstintf=lo7156 dstintfrole=neavolup poluuid=lits sessionid=Nemoen proto=0 action=block policyid=rur policytype=quaturve crscore=166.007000 craction=oeiusmod crlevel=uidolore appcat=iacon service=ncu srccountry=quaturve dstcountry=ciad trandisp=diconseq tranip=10.251.183.113 tranport=2604 duration=161.433000 sentbyte=5697 rcvdbyte=7299 sentpkt=eseosqu app=uptatem +logver=uamnihil devname="nisi" devid="imadm" vd=siutali date=2018-1-12 time=10:18:32 logid=mfugi type=ceroinBC subtype=lorumw level=low eventtime=squir logtime=commod srcip=10.183.16.252 srcport=3150 srcintf=lo6718 srcintfrole=eabillo dstip=10.203.66.175 dstport=3904 dstintf=enp0s3868 dstintfrole=dipisciv poluuid=nsequun sessionid=hen proto=icmp action=accept policyid=velillum policytype=itamet crscore=123.013000 craction=hil crlevel=itl appcat=idolo service=ncidid srccountry=oid dstcountry=iarchit trandisp=volupt tranip=10.51.60.203 tranport=5315 duration=165.955000 sentbyte=7551 rcvdbyte=1519 sentpkt=ten app=Utenim +date=2018-1-27 time=5:21:06 logver=uasiarch devid=iamquisn devname=magnama logid=reprehe type=citatio subtype=dolo level=medium vd=esciunt srcip=10.133.245.26 srcport=1727 srcintf=enp0s2674 dstip=10.76.87.30 dstport=2858 dstintf=enp0s2918 poluuid=remag sessionid=roinBCSe proto=HOPOPT action=accept policyid=labori trandisp=ditau duration=39.920000 sentbyte=5413 rcvdbyte=6650 devtype=tam osname=olu osversion=1.409 mastersrcmac=iut srcmac=01:00:5e:5c:c2:50 crscore=69.137000 craction=boris crlevel=ris eventtype=nisiuta user=utper service=uipexe hostname=ursint411.www.lan profile=gnamali reqtype=iumdo url=https://example.org/tem/iadeseru.jpg?olorsita=odoco#etc direction=internal msg=lamco method=natuser cat=Excepteu catdesc=omnis device_id=tati log_id=orinc pri=very-high userfrom=eturadi adminprof=cinge timezone=PT main_type=ira trigger_policy=niamq sub_type=quatD severity_level=nevol policy=lumquid src=10.157.14.165 src_port=7170 dst=10.61.200.105 dst_port=2813 http_method=tquov http_url=natu http_host=doei http_agent=acomm http_session_id=veleumi signature_subclass=volupt signature_id=6822 srccountry=itatise content_switch_name=ure server_pool_name=userro false_positive_mitigation=oree user_name=nimadmi monitor_status=utaliq http_refer=https://example.com/tinvolu/uredol.txt?did=lamcol#idolor http_version=tutlabor dev_id=nse threat_weight=rauto history_threat_weight=rese threat_level=nonproi ftp_mode=doconse ftp_cmd=henderi cipher_suite=tisunde msg_id=ende +date=2018-2-10 time=12:23:41 logver=commod devid=oris devname=rcita logid=ataev type=oris subtype=incidi level=high vd=tutlabo srcip=10.32.66.161 srcport=881 srcintf=lo4523 dstip=10.134.238.8 dstport=2976 dstintf=enp0s1238 poluuid=edquiac sessionid=sit proto=HOPOPT action=allow policyid=olo trandisp=laboris duration=163.866000 sentbyte=7328 rcvdbyte=5375 devtype=tutl osname=nevolu osversion=1.5475 mastersrcmac=ostru srcmac=01:00:5e:e9:5f:84 crscore=157.516000 craction=aven crlevel=idolore eventtype=psaqu user=psa service=pta hostname=ididunt7607.mail.localhost profile=ntutlabo reqtype=leumiure url=https://mail.example.net/epteurs/usmodtem.gif?itvo=asi#tobe direction=internal msg=Lore method=oin cat=eritquii catdesc=taliqui device_id=ecatcu log_id=entoreve pri=high userfrom=umquam adminprof=onev timezone=CET main_type=tionev trigger_policy=ali sub_type=ionu severity_level=perna policy=moll src=10.242.178.15 src_port=3948 dst=10.217.111.77 dst_port=7309 http_method=datatno http_url=equepor http_host=antium http_agent=ugiatn http_session_id=utpe signature_subclass=hend signature_id=1170 srccountry=agnamali content_switch_name=ptateve server_pool_name=aliqua false_positive_mitigation=officiad user_name=nimadmin monitor_status=iavol http_refer=https://example.net/iumtota/qui.jpg?quel=ugitsed#ritatis http_version=olor dev_id=emoenim threat_weight=turadipi history_threat_weight=umSec threat_level=onsecte ftp_mode=inibusBo ftp_cmd=tqui cipher_suite=sequun msg_id=nimadm +date=2018-2-24 time=7:26:15 logver=vitaedic devid=remip devname=rsita logid=rehe type=aper subtype=gnaa level=low vd=uta srcip=10.161.128.235 srcport=6280 srcintf=eth2121 dstip=10.84.29.117 dstport=1245 dstintf=eth7500 poluuid=errorsi sessionid=umwr proto=HOPOPT action=cancel policyid=cupida trandisp=rinc duration=5.709000 sentbyte=289 rcvdbyte=6059 devtype=dquia osname=ommod osversion=1.142 mastersrcmac=dico srcmac=01:00:5e:06:53:8a crscore=35.836000 craction=imipsa crlevel=iscinge eventtype=ora user=meumfug service=inimve hostname=mco2906.domain profile=sitvolu reqtype=eratv url=https://www.example.com/iadolo/cidu.txt?aliquide=redolori#eav direction=inbound msg=nse method=turQuis cat=tat catdesc=pta device_id=henderi log_id=onsec pri=high userfrom=itaspern adminprof=tau timezone=GMT+02:00 main_type=rsintoc trigger_policy=boreetd sub_type=rehende severity_level=sitamet policy=xerc src=10.199.119.251 src_port=7286 dst=10.86.152.227 dst_port=850 http_method=ant http_url=tiu http_host=ommodoco http_agent=rehe http_session_id=eseosqu signature_subclass=oeius signature_id=641 srccountry=eaqueip content_switch_name=laud server_pool_name=uido false_positive_mitigation=uis user_name=msequin monitor_status=autem http_refer=https://internal.example.org/ipi/qua.htm?itat=adipisc#omnisist http_version=orroqui dev_id=sci threat_weight=psamvolu history_threat_weight=itsedqui threat_level=oreve ftp_mode=omn ftp_cmd=onevol cipher_suite=ese msg_id=reprehen +date=2018-3-11 time=2:28:49 logver=eumfugia devid=nimvenia devname=dol logid=rissusc type=lit subtype=quin level=low vd=eddoei srcip=10.35.73.208 srcport=7081 srcintf=eth6552 dstip=10.216.120.61 dstport=6389 dstintf=eth2068 poluuid=dolor sessionid=emUteni proto=tcp action=deny policyid=illoin trandisp=rinre duration=166.295000 sentbyte=5988 rcvdbyte=3374 devtype=olorem osname=mquae osversion=1.1789 mastersrcmac=rQuis srcmac=01:00:5e:b5:9a:3e crscore=5.250000 craction=enimadmi crlevel=elit eventtype=uia user=tem service=unt hostname=ntex5135.corp profile=mqua reqtype=equa url=https://internal.example.com/isc/umdol.jpg?atn=sectet#boreetd direction=outbound msg=olorin method=oluptat cat=olors catdesc=mSecti device_id=ius log_id=quian pri=low userfrom=urExce adminprof=upt timezone=PST main_type=pteurs trigger_policy=intocc sub_type=abo severity_level=orisnis policy=reseo src=10.239.194.105 src_port=3629 dst=10.234.171.117 dst_port=4488 http_method=tenatus http_url=odic http_host=ono http_agent=umtota http_session_id=consequ signature_subclass=ine signature_id=3409 srccountry=dex content_switch_name=ipis server_pool_name=nsecte false_positive_mitigation=miurere user_name=tat monitor_status=pitlabor http_refer=https://example.com/olupta/ape.jpg?mnisiut=eabil#olu http_version=uaUte dev_id=empor threat_weight=ate history_threat_weight=eca threat_level=inre ftp_mode=aliqu ftp_cmd=orem cipher_suite=dquian msg_id=isaute +logver=emagnaal dtime=2018-03-25 09:31:24.032538723 +0000 UTC devid=uunturm devname=nonnumq vd=tqu date=2018-3-25 time=9:31:24 logid=ntocca type=emquelau subtype=adolorsi level=medium eventtime=maliquam logtime=ovol srcip=10.34.41.75 srcport=4436 srcintf=enp0s7638 srcintfrole=eseosqu dstip=10.249.16.201 dstport=4293 dstintf=lo5084 dstintfrole=mvele poluuid=qui sessionid=etMa proto=3 action=accept policyid=aspe policytype=uradipi crscore=22.220000 craction=atu crlevel=amremape appcat=illoinve service=uis srccountry=itanimi dstcountry=rinc trandisp=isistena tranip=10.107.168.208 tranport=1864 duration=45.477000 sentbyte=1067 rcvdbyte=2855 sentpkt=ctionofd app=uianonnu +logver=nisiste date=2018-4-8 time=4:33:58 log_id=sedqu devid=itautfu devname=aaliq logid=tDui type=ernatur subtype=itsed level=low vd=xeacomm srcip=10.112.57.220 srcport=5803 srcintf=enp0s1897 dstip=10.19.151.236 dstport=884 dstintf=enp0s4144 poluuid=estiaeco sessionid=vele proto=HOPOPT action=allow policyid=yCiceroi trandisp=loremeu duration=156.263000 sentbyte=3719 rcvdbyte=7292 devtype=colab osname=itte osversion=1.6905 mastersrcmac=orumS srcmac=01:00:5e:c1:b8:93 crscore=60.950000 craction=uptat crlevel=incidun eventtype=agnaaliq user=aturQuis service=cepteurs hostname=tat1845.internal.invalid profile=rumetMal reqtype=tiumtot url=https://www.example.com/imadm/ugiat.txt?Nequepor=nisiu#ptat direction=inbound msg=eddoe method=seq cat=uae catdesc=tobeata device_id=ctas log_id=vol pri=high userfrom=gna adminprof=itautf timezone=ET main_type=eprehe trigger_policy=ariatu sub_type=aqueip severity_level=aqueip policy=rautod src=10.96.168.24 src_port=6206 dst=10.109.106.194 dst_port=5356 http_method=Sedut http_url=stiaec http_host=rveli http_agent=serr http_session_id=umdolo signature_subclass=iduntut signature_id=4281 srccountry=rorsitv content_switch_name=caboNemo server_pool_name=cididun false_positive_mitigation=iamqu user_name=ommodoc monitor_status=mwrit http_refer=https://www5.example.com/madminim/onse.txt?reeuf=orinrepr#tinvo http_version=oru dev_id=ainc threat_weight=aeab history_threat_weight=iat threat_level=acom ftp_mode=olo ftp_cmd=eipsaq cipher_suite=enatu msg_id=mfu +logver=aliqui date=2018-4-22 time=11:36:32 log_id=uipexea devid=sauteiru devname=nibusB logid=eetdolo type=issuscip subtype=iduntu level=high vd=rinc srcip=10.109.224.208 srcport=1769 srcintf=enp0s3638 dstip=10.31.34.96 dstport=4651 dstintf=enp0s390 poluuid=atis sessionid=edol proto=icmp action=deny policyid=adip trandisp=ugiatq duration=128.795000 sentbyte=4249 rcvdbyte=6693 devtype=atemUte osname=emag osversion=1.1353 mastersrcmac=ecatcup srcmac=01:00:5e:63:85:d2 crscore=62.286000 craction=oin crlevel=isautem eventtype=eiusm user=assit service=ulpaq hostname=ulamc767.internal.lan profile=iades reqtype=mremape url=https://mail.example.net/ionemu/nul.jpg?volupt=ori#sed direction=inbound msg=maveniam method=ctobeat cat=emoenim catdesc=oqui device_id=olab log_id=remagnam pri=high userfrom=mSecti adminprof=volupt timezone=OMST main_type=ela trigger_policy=fugits sub_type=litseddo severity_level=idestl policy=ptasn src=10.112.155.228 src_port=5011 dst=10.47.191.95 dst_port=6242 http_method=velillu http_url=radipi http_host=iatn http_agent=aturE http_session_id=beat signature_subclass=pern signature_id=7568 srccountry=itvolupt content_switch_name=uradip server_pool_name=perspi false_positive_mitigation=uaer user_name=aed monitor_status=tectobe http_refer=https://example.org/scingeli/uatDuis.gif?apari=itesseci#utali http_version=ofdeFin dev_id=siutaliq threat_weight=urvel history_threat_weight=turE threat_level=ntium ftp_mode=imadmi ftp_cmd=dquiac cipher_suite=liquide msg_id=uatD +logver=gnidolor dtime=2018-05-07 06:39:06.812538723 +0000 UTC devid=BCSedut devname=metco vd=vel date=2018-5-7 time=6:39:06 logid=tmol type=acommodi subtype=ccaecat level=low eventtime=mqu logtime=mips srcip=10.103.169.94 srcport=2174 srcintf=lo5821 srcintfrole=osqu dstip=10.140.137.17 dstport=446 dstintf=enp0s4444 dstintfrole=iono poluuid=atcupi sessionid=dexe proto=0 action=allow policyid=exerci policytype=ems crscore=15.728000 craction=nulapa crlevel=tess appcat=eroi service=enby srccountry=riatur dstcountry=amrema trandisp=illum tranip=10.62.241.218 tranport=7444 duration=5.969000 sentbyte=4832 rcvdbyte=6033 sentpkt=urere app=involu +logver=tem devname="litsedq" devid="amre" vd=orpori date=2018-5-21 time=1:41:41 logid=sistena type=iam subtype=saquae level=low eventtime=itanimid logtime=ianonnum srcip=10.90.229.92 srcport=6796 srcintf=lo1752 srcintfrole=inculp dstip=10.251.212.166 dstport=3925 dstintf=eth1592 dstintfrole=aboNemo poluuid=tsedquia sessionid=ididun proto=21 action=cancel policyid=enim policytype=gnido crscore=85.453000 craction=erepr crlevel=tsedqu appcat=uisa service=uptat srccountry=siutal dstcountry=umetMalo trandisp=onevolu tranip=10.77.105.160 tranport=5541 duration=155.903000 sentbyte=5294 rcvdbyte=2687 sentpkt=ira app=umfu +date=2018-6-4 time=8:44:15 logver=uamq devid=mnisist devname=dutp logid=ecillu type=ipsaqu subtype=asun level=very-high vd=llumd srcip=10.100.223.157 srcport=1307 srcintf=eth5742 dstip=10.232.243.87 dstport=4546 dstintf=lo299 poluuid=atisetq sessionid=mSectio proto=0 action=cancel policyid=nonnumqu trandisp=atis duration=63.050000 sentbyte=3508 rcvdbyte=205 devtype=uam osname=tisunde osversion=1.4261 mastersrcmac=rured srcmac=01:00:5e:8a:c1:2a crscore=19.243000 craction=meumfug crlevel=iam eventtype=animi user=porainc service=nsectetu hostname=spici5547.internal.test profile=tate reqtype=sintocca url=https://mail.example.org/asuntex/uovolup.html?amali=uiav#henderi direction=internal msg=tnul method=ons cat=radip catdesc=amremap device_id=dolorsit log_id=atisund pri=very-high userfrom=uredo adminprof=uamni timezone=CT main_type=quisqua trigger_policy=sedquian sub_type=lamcorpo severity_level=rem policy=apariat src=10.216.49.112 src_port=4521 dst=10.112.242.68 dst_port=3105 http_method=aut http_url=eriti http_host=ipsum http_agent=com http_session_id=uptate signature_subclass=tevelite signature_id=5880 srccountry=nimadmi content_switch_name=mquiado server_pool_name=agn false_positive_mitigation=dip user_name=urmag monitor_status=nim http_refer=https://www5.example.net/tutlabo/incid.gif?ptate=tconsect#usm http_version=uunturma dev_id=namaliqu threat_weight=tatemacc history_threat_weight=licab threat_level=roidents ftp_mode=volupta ftp_cmd=stiaeco cipher_suite=tanim msg_id=osam +date=2018-6-19 time=3:46:49 logver=tla devid=nimve devname=edutpe logid=tenb type=billoinv subtype=asia level=medium vd=paquioff srcip=10.252.175.174 srcport=1995 srcintf=enp0s1531 dstip=10.196.226.219 dstport=545 dstintf=lo2390 poluuid=uaera sessionid=nsequa proto=tcp action=accept policyid=orporis trandisp=oluptate duration=28.731000 sentbyte=2397 rcvdbyte=1768 devtype=itvolu osname=citation osversion=1.491 mastersrcmac=aincid srcmac=01:00:5e:7e:ea:3f crscore=149.960000 craction=tNeque crlevel=uidolore eventtype=uatDuisa user=usB service=magnaali hostname=istenatu3686.invalid profile=remagna reqtype=eritqu url=https://example.org/mnisiut/porinci.htm?norum=emUten#dminimve direction=internal msg=oremagna method=nulamc cat=tempori catdesc=rsintocc device_id=nderit log_id=etco pri=very-high userfrom=lore adminprof=ameiusmo timezone=PT main_type=veniamqu trigger_policy=equat sub_type=reeu severity_level=atemacc policy=rsitvolu src=10.182.58.108 src_port=4811 dst=10.96.100.84 dst_port=2253 http_method=utlabore http_url=texplica http_host=boru http_agent=ntut http_session_id=elaud signature_subclass=acomm signature_id=5667 srccountry=emUten content_switch_name=uamni server_pool_name=laboris false_positive_mitigation=pers user_name=lpaquiof monitor_status=isisten http_refer=https://api.example.net/seddoei/rnatur.jpg?olores=idolorem#umdolors http_version=uid dev_id=numqua threat_weight=citatio history_threat_weight=sed threat_level=mUten ftp_mode=eursint ftp_cmd=velillum cipher_suite=oin msg_id=teurs +logver=untutl devname="cons" devid="vel" vd=illumdo date=2018-7-3 time=10:49:23 logid=rios type=deF subtype=dutpe level=very-high eventtime=itan logtime=uisnos srcip=10.228.61.5 srcport=1179 srcintf=eth4741 srcintfrole=lites dstip=10.246.41.77 dstport=1217 dstintf=lo7502 dstintfrole=olu poluuid=ectet sessionid=tquovo proto=17 action=block policyid=lapa policytype=xeacom crscore=22.822000 craction=qui crlevel=henderi appcat=rainc service=dminim srccountry=sse dstcountry=tatem trandisp=umexe tranip=10.157.22.21 tranport=5252 duration=135.630000 sentbyte=2167 rcvdbyte=2952 sentpkt=quamei app=nvento +logver=qua devname="llumdo" devid="tot" vd=itquii date=2018-7-17 time=5:51:58 logid=psu type=iat subtype=ept level=high eventtime=ectob logtime=aUtenim srcip=10.242.119.111 srcport=645 srcintf=lo1640 srcintfrole=tDuisa dstip=10.239.231.168 dstport=88 dstintf=lo3385 dstintfrole=nimi poluuid=niamqu sessionid=uioffi proto=1 action=allow policyid=consequa policytype=tionu crscore=60.452000 craction=quines crlevel=entsu appcat=ineavol service=abor srccountry=giatq dstcountry=nonpro trandisp=elitsedd tranip=10.188.131.18 tranport=981 duration=46.954000 sentbyte=2770 rcvdbyte=4226 sentpkt=tam app=uovo +logver=orinrepr date=2018-8-1 time=12:54:32 log_id=untut devid=siu devname=lorem logid=icons type=hende subtype=umdol level=medium vd=psaq srcip=10.24.154.250 srcport=2108 srcintf=eth2707 dstip=10.124.187.230 dstport=6119 dstintf=lo105 poluuid=mqu sessionid=tse proto=udp action=accept policyid=ueip trandisp=amvo duration=20.956000 sentbyte=2068 rcvdbyte=306 devtype=reetdolo osname=tten osversion=1.979 mastersrcmac=usa srcmac=01:00:5e:6a:a6:c9 crscore=45.307000 craction=oremagna crlevel=siuta eventtype=amnihil user=nderit service=ficia hostname=tru3812.mail.lan profile=olo reqtype=xer url=https://api.example.net/nsec/smo.gif?etq=trumexe#rai direction=outbound msg=tNequepo method=byCicer cat=imvenia catdesc=ipit device_id=tdolorem log_id=nderitin pri=low userfrom=enderitq adminprof=amvolu timezone=GMT-07:00 main_type=temvele trigger_policy=ofd sub_type=quam severity_level=umdol policy=porincid src=10.106.101.87 src_port=7569 dst=10.247.124.74 dst_port=2491 http_method=inea http_url=ipsu http_host=iden http_agent=oreseo http_session_id=edictasu signature_subclass=aerat signature_id=4358 srccountry=lites content_switch_name=col server_pool_name=litsedd false_positive_mitigation=mnis user_name=ainci monitor_status=aturve http_refer=https://api.example.com/mporain/secte.txt?amqui=rume#uptate http_version=tisundeo dev_id=uid threat_weight=eFini history_threat_weight=mnis threat_level=tametco ftp_mode=snisiut ftp_cmd=lit cipher_suite=laborio msg_id=aaliqu +date=2018-8-15 time=7:57:06 devname=mid device_id=henderi log_id=consec type=event subtype=dquia pri=high desc=isiutali user=rehe userfrom=volupta msg=etcons action=deny adom=etdol408.internal.home session_id=agnamali +date=2018-8-29 time=2:59:40 logver=cae devid=Utenimad devname=onsequ logid=Bon type=amquisno subtype=mullam level=very-high vd=admi srcip=10.111.106.60 srcport=5449 srcintf=lo5820 dstip=10.142.181.192 dstport=4386 dstintf=lo6200 poluuid=lmolest sessionid=miurerep proto=17 action=allow policyid=Sed trandisp=isau duration=66.574000 sentbyte=75 rcvdbyte=806 devtype=idest osname=ostru osversion=1.4342 mastersrcmac=enimip srcmac=01:00:5e:11:d6:5d crscore=66.141000 craction=umquiado crlevel=taspe eventtype=empori user=mipsum service=tium hostname=riaturE1644.www5.example profile=ender reqtype=uine url=https://internal.example.com/dolo/exeacom.txt?tlab=eufugiat#upta direction=internal msg=reetdo method=mad cat=mdolor catdesc=amcorpor device_id=oremquel log_id=san pri=high userfrom=amqui adminprof=itatise timezone=GMT-07:00 main_type=cia trigger_policy=lup sub_type=cipitla severity_level=niam policy=mullamc src=10.215.144.167 src_port=6675 dst=10.162.114.52 dst_port=2925 http_method=quepor http_url=Lor http_host=ten http_agent=exeacomm http_session_id=cusan signature_subclass=oquisq signature_id=4993 srccountry=ihilmol content_switch_name=seosqui server_pool_name=tiset false_positive_mitigation=ciade user_name=erspici monitor_status=xercitat http_refer=https://internal.example.net/utlab/entoreve.html?umdol=nseq#autodita http_version=loreme dev_id=eratv threat_weight=tametcon history_threat_weight=orsi threat_level=ull ftp_mode=mcor ftp_cmd=iamquis cipher_suite=aeabi msg_id=ore +date=2018-9-12 time=10:02:15 logver=catcup devid=ectetur devname=cons logid=spiciati type=upidata subtype=utlabo level=high vd=ersp srcip=10.101.207.156 srcport=2086 srcintf=enp0s4931 dstip=10.12.8.82 dstport=4369 dstintf=enp0s7520 poluuid=nemull sessionid=trumex proto=6 action=accept policyid=doloremq trandisp=iade duration=26.420000 sentbyte=5013 rcvdbyte=7641 devtype=uidolo osname=ita osversion=1.6452 mastersrcmac=rchite srcmac=01:00:5e:41:90:bf crscore=107.693000 craction=tionem crlevel=volupta eventtype=adol user=econsequ service=orever hostname=mdolo7008.api.corp profile=reetdolo reqtype=psam url=https://www5.example.org/orumet/aliqu.txt?tion=sun#utod direction=outbound msg=rinci method=uamestqu cat=riatu catdesc=ulaparia device_id=remagna log_id=fugi pri=very-high userfrom=xerc adminprof=caecat timezone=OMST main_type=cor trigger_policy=nonnumqu sub_type=uidexea severity_level=emu policy=asia src=10.162.128.87 src_port=6214 dst=10.78.75.82 dst_port=7799 http_method=uptat http_url=con http_host=tem http_agent=orpori http_session_id=lor signature_subclass=quiinea signature_id=7098 srccountry=rroquis content_switch_name=dolorema server_pool_name=prehe false_positive_mitigation=bori user_name=Sedutp monitor_status=ritinvo http_refer=https://internal.example.net/ica/nat.jpg?ddoe=nsequ#lloinve http_version=tdolo dev_id=billoi threat_weight=sequu history_threat_weight=ffic threat_level=imadmini ftp_mode=isnostru ftp_cmd=ostr cipher_suite=tinvo msg_id=lorumwr +logver=ctetura devname="reseosqu" devid="ittenbyC" vd=tlabor date=2018-9-27 time=5:04:49 logid=auteir type=uredolo subtype=uido level=medium eventtime=quiratio logtime=aincidu srcip=10.75.198.93 srcport=1982 srcintf=eth725 srcintfrole=umqu dstip=10.137.36.151 dstport=196 dstintf=lo1813 dstintfrole=rspici poluuid=duntutla sessionid=emeu proto=1 action=block policyid=atemUten policytype=turadipi crscore=16.226000 craction=estqu crlevel=orinre appcat=prehen service=equa srccountry=ciatisun dstcountry=mdolorem trandisp=nnumq tranip=10.51.106.43 tranport=6486 duration=78.551000 sentbyte=3531 rcvdbyte=5464 sentpkt=oremeumf app=volupt +logver=tnulapa devname="caecatcu" devid="xcepte" vd=deserun date=2018-10-11 time=12:07:23 logid=mvol type=erep subtype=teurs level=low eventtime=tiumdol logtime=byCicer srcip=10.154.151.111 srcport=5860 srcintf=eth1273 srcintfrole=uisnos dstip=10.7.230.206 dstport=5757 dstintf=lo1291 dstintfrole=pisc poluuid=eumfu sessionid=tseddoe proto=HOPOPT action=allow policyid=emulla policytype=bill crscore=147.522000 craction=oditaut crlevel=oloremqu appcat=untNeque service=reetdol srccountry=perspi dstcountry=tlab trandisp=udexerci tranip=10.249.93.150 tranport=799 duration=113.020000 sentbyte=2808 rcvdbyte=5744 sentpkt=ovolup app=squ +date=2018-10-25 time=7:09:57 logver=dolor devid=lit devname=ptatem logid=oeiusmod type=ugi subtype=utaliq level=very-high vd=toc srcip=10.76.177.154 srcport=1428 srcintf=eth4425 dstip=10.207.160.170 dstport=7037 dstintf=lo1570 poluuid=reseo sessionid=iration proto=tcp action=deny policyid=magn trandisp=iaecon duration=54.100000 sentbyte=622 rcvdbyte=6280 devtype=ill osname=oris osversion=1.5718 mastersrcmac=ulamcol srcmac=01:00:5e:19:ce:4b crscore=142.771000 craction=oNe crlevel=utfu eventtype=santiumd user=cididunt service=ctasu hostname=itse5466.api.example profile=ica reqtype=mnisis url=https://internal.example.com/nonnumqu/isciveli.gif?wri=aute#iscin direction=outbound msg=uat method=itasper cat=nibusBo catdesc=volupta device_id=olorinr log_id=iameaq pri=high userfrom=docons adminprof=uun timezone=OMST main_type=mremap trigger_policy=ate sub_type=agnaal severity_level=ibusB policy=mexe src=10.217.209.221 src_port=3639 dst=10.26.4.3 dst_port=5291 http_method=rsitame http_url=eca http_host=quirat http_agent=urmagn http_session_id=essec signature_subclass=prehende signature_id=1261 srccountry=setquas content_switch_name=nti server_pool_name=osamnis false_positive_mitigation=atisetqu user_name=ciduntut monitor_status=atisu http_refer=https://internal.example.com/architec/incul.txt?aborios=mco#amnisiu http_version=suntincu dev_id=lore threat_weight=equatu history_threat_weight=enbyCi threat_level=dolo ftp_mode=adipi ftp_cmd=beata cipher_suite=evelites msg_id=ipiscive +logver=umtot date=2018-11-9 time=2:12:32 log_id=eumiurer devid=inv devname=eac logid=rainc type=tinculp subtype=uianon level=high vd=corpori srcip=10.232.131.132 srcport=581 srcintf=enp0s6255 dstip=10.232.246.98 dstport=1854 dstintf=enp0s1526 poluuid=ivelit sessionid=itlabori proto=icmp action=accept policyid=oide trandisp=magni duration=72.993000 sentbyte=5817 rcvdbyte=6960 devtype=rrorsit osname=emipsu osversion=1.6603 mastersrcmac=temUte srcmac=01:00:5e:fe:be:28 crscore=134.746000 craction=hitec crlevel=sci eventtype=luptatev user=ruredo service=iamquis hostname=dquiac6194.api.lan profile=nidolo reqtype=runtmoll url=https://www5.example.org/utlabo/scip.html?voluptas=inv#upta direction=external msg=ors method=olupta cat=raincidu catdesc=nisi device_id=uipexea log_id=taedic pri=high userfrom=ugi adminprof=urExcep timezone=CET main_type=usant trigger_policy=uidolore sub_type=litse severity_level=ugitse policy=utfugi src=10.241.140.241 src_port=1813 dst=10.180.162.174 dst_port=7186 http_method=ido http_url=atnu http_host=ssuscipi http_agent=evita http_session_id=tconsect signature_subclass=lpaquiof signature_id=532 srccountry=lors content_switch_name=Finibus server_pool_name=totam false_positive_mitigation=idat user_name=nulapar monitor_status=git http_refer=https://www5.example.com/odtem/tati.jpg?ueips=umqu#ntexpli http_version=siuta dev_id=porincid threat_weight=itame history_threat_weight=inv threat_level=remaper ftp_mode=quaUteni ftp_cmd=evelit cipher_suite=oluptat msg_id=ditem +date=2018-11-23 time=9:15:06 devname=oditautf device_id=asiarc log_id=eddoei type=generic subtype=iatqu pri=very-high devid=itessec devname=dat logid=tdol type=emul subtype=ariatu level=high vd=reseo srcip=10.53.70.207 srcport=1793 srcintf=lo2279 dstip=10.73.140.61 dstport=2114 dstintf=lo368 poluuid=stlabo sessionid=atema proto=1 action=deny policyid=orporiss trandisp=iamq duration=128.426000 sentbyte=1800 rcvdbyte=5783 devtype=pis osname=riosam osversion=1.2052 mastersrcmac=iosam srcmac=01:00:5e:21:d3:0a crscore=65.426000 craction=archi crlevel=nes eventtype=atvolupt user=umwritt service=uae hostname=amco1592.mail.host profile=aaliq reqtype=olupta url=https://internal.example.com/ssusci/snostrud.txt?dolo=siutaliq#obeata direction=outbound msg=tame method=olo cat=vel catdesc=equamn device_id=tempora log_id=enimip pri=very-high userfrom=saqua adminprof=aperia timezone=OMST main_type=tNeque trigger_policy=metcon sub_type=enimadmi severity_level=orem policy=corpor src=10.110.99.222 src_port=5685 dst=10.62.140.108 dst_port=1225 http_method=ssitasp http_url=ptat http_host=asp http_agent=uatDui http_session_id=nofdeFin signature_subclass=unde signature_id=3979 srccountry=seruntm content_switch_name=aera server_pool_name=scive false_positive_mitigation=ngelit user_name=moenimi monitor_status=mqu http_refer=https://mail.example.org/ueipsaq/upid.gif?utla=emUte#tisund http_version=tutla dev_id=isund threat_weight=atemU history_threat_weight=uidex threat_level=uptate ftp_mode=eac ftp_cmd=peria cipher_suite=amaliq msg_id=ium +logver=ptate date=2018-12-7 time=4:17:40 log_id=tenatu devid=emo devname=ratio logid=maperia type=Maloru subtype=sumquia level=low vd=imadmini srcip=10.237.5.219 srcport=3828 srcintf=eth4604 dstip=10.197.99.150 dstport=3877 dstintf=enp0s7388 poluuid=odo sessionid=itseddoe proto=prm action=accept policyid=itinvo trandisp=uiavol duration=96.864000 sentbyte=2685 rcvdbyte=7612 devtype=urmagn osname=ficiade osversion=1.2691 mastersrcmac=equ srcmac=01:00:5e:f5:2a:24 crscore=163.671000 craction=mipsum crlevel=dolor eventtype=cupidata user=niamquis service=lapariat hostname=dicta7226.mail.example profile=eddoei reqtype=cingel url=https://api.example.com/temporai/umw.jpg?mveniamq=litsed#ptasn direction=unknown msg=loinv method=umd cat=madmi catdesc=xercit device_id=avolup log_id=etdo pri=medium userfrom=veleum adminprof=emUten timezone=CT main_type=proiden trigger_policy=cita sub_type=iac severity_level=ntincul policy=mnisiste src=10.4.244.115 src_port=4588 dst=10.53.50.77 dst_port=5330 http_method=lorem http_url=lore http_host=orroqu http_agent=tlabo http_session_id=iameaque signature_subclass=sautemve signature_id=6466 srccountry=emoe content_switch_name=ameiusmo server_pool_name=ntiumtot false_positive_mitigation=aeab user_name=idolo monitor_status=temac http_refer=https://api.example.net/ollita/idolore.html?illu=iut#asiarc http_version=imidest dev_id=mwri threat_weight=orsi history_threat_weight=ritinvol threat_level=rporiss ftp_mode=atu ftp_cmd=ddo cipher_suite=veli msg_id=ata +logver=lor dtime=2018-12-21 23:20:14.972538723 +0000 UTC devid=ori devname=eleumiu vd=amre date=2018-12-21 time=11:20:14 logid=atur type=untex subtype=Except level=very-high eventtime=econse logtime=iac srcip=10.221.100.157 srcport=865 srcintf=lo4518 srcintfrole=mqu dstip=10.236.211.111 dstport=1801 dstintf=enp0s454 dstintfrole=rauto poluuid=pteursi sessionid=iquamqua proto=tcp action=allow policyid=psumqui policytype=equeporr crscore=32.741000 craction=cusanti crlevel=doloreme appcat=nsecte service=reprehen srccountry=taspe dstcountry=litess trandisp=enimadm tranip=10.120.212.78 tranport=119 duration=17.257000 sentbyte=4752 rcvdbyte=3484 sentpkt=ntsuntin app=ectetur +date=2019-1-5 time=6:22:49 logver=intocca devid=vel devname=xeacom logid=orum type=voluptat subtype=nsequ level=medium vd=tenimad srcip=10.140.215.210 srcport=7229 srcintf=lo568 dstip=10.71.213.217 dstport=7475 dstintf=eth5820 poluuid=lup sessionid=reetdolo proto=HOPOPT action=accept policyid=dolor trandisp=emagnam duration=154.150000 sentbyte=2336 rcvdbyte=5326 devtype=emull osname=enatuser osversion=1.3052 mastersrcmac=ectob srcmac=01:00:5e:4a:5d:af crscore=9.013000 craction=niamqu crlevel=nrep eventtype=lauda user=ionevo service=busB hostname=pidatatn2627.www.localdomain profile=eritinvo reqtype=quiav url=https://mail.example.org/ngelit/dipiscin.gif?serro=ctet#umiurere direction=inbound msg=ciun method=ssitaspe cat=deomnis catdesc=ulamcol device_id=onn log_id=redol pri=medium userfrom=utlabore adminprof=nci timezone=OMST main_type=liqu trigger_policy=ectetura sub_type=aUte severity_level=untNeque policy=roi src=10.210.82.202 src_port=2749 dst=10.208.231.15 dst_port=412 http_method=rios http_url=diconseq http_host=tenima http_agent=iusm http_session_id=mveleumi signature_subclass=equinesc signature_id=5076 srccountry=mfugiatq content_switch_name=dmini server_pool_name=emveleu false_positive_mitigation=loree user_name=riatur monitor_status=tempor http_refer=https://internal.example.com/spiciati/tise.gif?ctas=rvelillu#qua http_version=ciat dev_id=iamq threat_weight=porin history_threat_weight=yCi threat_level=arc ftp_mode=santium ftp_cmd=numquame cipher_suite=umfugi msg_id=amestqui +logver=tesseq devname="nimides" devid="iusmodte" vd=involup date=2019-1-19 time=1:25:23 logid=edd type=dolorsi subtype=mcolabo level=low eventtime=exe logtime=nve srcip=10.226.255.3 srcport=5449 srcintf=lo7680 srcintfrole=iaconseq dstip=10.123.59.69 dstport=5399 dstintf=lo5835 dstintfrole=ntsunti poluuid=bor sessionid=uisnos proto=6 action=accept policyid=tation policytype=seddoe crscore=21.625000 craction=eur crlevel=ntmolli appcat=pitl service=nulap srccountry=ipexe dstcountry=aqueipsa trandisp=psum tranip=10.53.251.202 tranport=7501 duration=131.751000 sentbyte=6876 rcvdbyte=220 sentpkt=ugi app=ptate +logver=rur devname="edut" devid="sitametc" vd=iarchite date=2019-2-2 time=8:27:57 logid=uide type=iono subtype=aboris level=very-high eventtime=imidest logtime=ulamc srcip=10.3.85.176 srcport=318 srcintf=eth2546 srcintfrole=uptateve dstip=10.212.56.26 dstport=3032 dstintf=enp0s2353 dstintfrole=loin poluuid=cinge sessionid=tutl proto=udp action=block policyid=nesciu policytype=ueip crscore=162.484000 craction=orumSe crlevel=mSe appcat=itame service=quaturv srccountry=lumdolor dstcountry=persp trandisp=leumi tranip=10.29.141.252 tranport=2077 duration=106.468000 sentbyte=3472 rcvdbyte=7868 sentpkt=orum app=reseos +date=2019-2-17 time=3:30:32 devname=orem device_id=seq log_id=cus type=generic subtype=tnulap pri=very-high devid=psamvolu devname=inculp logid=eni type=tcupid subtype=ercita level=very-high vd=olorinr srcip=10.110.166.81 srcport=7354 srcintf=lo3023 dstip=10.181.48.82 dstport=1225 dstintf=eth7640 poluuid=conseq sessionid=Nemoen proto=6 action=cancel policyid=umquamei trandisp=nih duration=55.527000 sentbyte=3449 rcvdbyte=4658 devtype=quia osname=eabill osversion=1.95 mastersrcmac=oeiusmo srcmac=01:00:5e:82:ca:1b crscore=67.321000 craction=rumwrit crlevel=tionofd eventtype=ill user=orroquis service=laparia hostname=emveleu4029.api.local profile=tconse reqtype=ntsun url=https://internal.example.net/inc/riaturEx.htm?mnihilm=itinvo#lestia direction=external msg=metcons method=lumd cat=liquaUt catdesc=snos device_id=maccusan log_id=oeni pri=medium userfrom=tiaecon adminprof=tincu timezone=GMT-07:00 main_type=untmoll trigger_policy=par sub_type=idatatno severity_level=tfugit policy=tla src=10.126.11.186 src_port=589 dst=10.236.175.163 dst_port=6562 http_method=atemqui http_url=icaboN http_host=Utenimad http_agent=res http_session_id=officiad signature_subclass=nsectet signature_id=3977 srccountry=temU content_switch_name=ciduntut server_pool_name=ionofd false_positive_mitigation=etqua user_name=udantiu monitor_status=tium http_refer=https://internal.example.net/leumiu/iuta.html?tfugit=rorsitv#tiaecons http_version=uamestq dev_id=aliquaUt threat_weight=boreet history_threat_weight=mquam threat_level=volu ftp_mode=nof ftp_cmd=boNe cipher_suite=ovolu msg_id=cid +logver=equamn devname="mes" devid="itatio" vd=ssecillu date=2019-3-3 time=10:33:06 logid=oeius type=itin subtype=nostrud level=medium eventtime=byCic logtime=mnisiuta srcip=10.171.60.173 srcport=209 srcintf=lo1917 srcintfrole=usmodite dstip=10.11.150.136 dstport=3615 dstintf=lo5438 dstintfrole=olup poluuid=urQuis sessionid=iquip proto=1 action=cancel policyid=untutl policytype=elite crscore=176.898000 craction=ipsaq crlevel=spici appcat=nvolupt service=antiu srccountry=llumquid dstcountry=paq trandisp=olup tranip=10.83.98.220 tranport=1300 duration=73.115000 sentbyte=5812 rcvdbyte=3339 sentpkt=amquis app=umtotam +logver=pitlabo dtime=2019-03-17 17:35:40.532538723 +0000 UTC devid=lorsita devname=datatno vd=emac date=2019-3-17 time=5:35:40 logid=uiavo type=tdo subtype=ratvolup level=high eventtime=dolo logtime=quioffic srcip=10.238.49.73 srcport=1554 srcintf=enp0s11 srcintfrole=riatu dstip=10.74.88.209 dstport=740 dstintf=lo5287 dstintfrole=quep poluuid=tfugitse sessionid=oenimips proto=udp action=deny policyid=mdo policytype=map crscore=148.871000 craction=osqui crlevel=consequ appcat=catcupid service=velitess srccountry=sit dstcountry=ipisc trandisp=onsectet tranip=10.92.3.166 tranport=5777 duration=156.314000 sentbyte=715 rcvdbyte=3946 sentpkt=itvol app=dolo +logver=amquisno dtime=2019-04-01 00:38:14.792538723 +0000 UTC devid=uptasnul devname=ptate vd=deri date=2019-4-1 time=12:38:14 logid=periamea type=equatD subtype=quaturQu level=high eventtime=rpo logtime=inr srcip=10.119.248.36 srcport=2450 srcintf=enp0s1885 srcintfrole=ten dstip=10.187.107.47 dstport=288 dstintf=lo2445 dstintfrole=fugia poluuid=psa sessionid=iset proto=prm action=allow policyid=ecte policytype=ionemull crscore=84.399000 craction=sBo crlevel=nimides appcat=iurere service=edolorin srccountry=labor dstcountry=quelaud trandisp=ira tranip=10.84.200.121 tranport=3226 duration=128.212000 sentbyte=2150 rcvdbyte=4329 sentpkt=nos app=icta +logver=itseddo devname="tasu" devid="mquae" vd=CSedu date=2019-4-15 time=7:40:49 logid=atae type=aeconseq subtype=boNemo level=very-high eventtime=nemulla logtime=tmollit srcip=10.167.128.229 srcport=4052 srcintf=eth1833 srcintfrole=ciatisu dstip=10.135.213.17 dstport=6427 dstintf=eth6468 dstintfrole=ritat poluuid=dipi sessionid=asnulapa proto=prm action=block policyid=onsequa policytype=seddoe crscore=23.021000 craction=Bonorume crlevel=emeumfu appcat=tla service=uidexea srccountry=odtem dstcountry=nvolupt trandisp=stia tranip=10.30.239.222 tranport=1546 duration=10.721000 sentbyte=6561 rcvdbyte=1057 sentpkt=itectobe app=rroq +date=2019-4-29 time=2:43:23 devname=uunt device_id=pic log_id=unt type=generic subtype=emUt pri=medium devid=pernatur devname=orem logid=enbyCice type=velil subtype=nsequat level=low vd=duntutl srcip=10.238.172.76 srcport=156 srcintf=lo1215 dstip=10.201.119.253 dstport=2230 dstintf=enp0s7218 poluuid=nimad sessionid=tionu proto=udp action=block policyid=emagna trandisp=quin duration=68.078000 sentbyte=2527 rcvdbyte=1150 devtype=consequ osname=min osversion=1.1028 mastersrcmac=edicta srcmac=01:00:5e:cd:6c:ed crscore=163.905000 craction=itinvolu crlevel=urerepre eventtype=iumdol user=serror service=uptass hostname=rspic5637.api.local profile=itatise reqtype=iut url=https://api.example.net/ita/esse.txt?amquis=iatquovo#rExce direction=inbound msg=uraut method=reetdol cat=umtotam catdesc=itaedi device_id=ant log_id=tiumt pri=very-high userfrom=ratvolup adminprof=iamqu timezone=CT main_type=quaturve trigger_policy=tsunti sub_type=ero severity_level=iusmodi policy=acomm src=10.169.133.219 src_port=92 dst=10.115.166.48 dst_port=7491 http_method=eleumiur http_url=ididun http_host=edi http_agent=gia http_session_id=uaturQui signature_subclass=emi signature_id=5446 srccountry=etM content_switch_name=eve server_pool_name=iru false_positive_mitigation=ipit user_name=emq monitor_status=elitsedq http_refer=https://www.example.net/onsequat/emagnaa.gif?itse=tco#nnumqua http_version=erit dev_id=lorsitam threat_weight=emagnama history_threat_weight=ute threat_level=Excep ftp_mode=utpersp ftp_cmd=rehe cipher_suite=tiumt msg_id=ulamc +logver=runt date=2019-5-13 time=9:45:57 log_id=emipsu devid=icaboNem devname=Except logid=fugits type=maliquam subtype=mav level=very-high vd=ecill srcip=10.36.122.89 srcport=5040 srcintf=lo3887 dstip=10.206.76.186 dstport=741 dstintf=eth2435 poluuid=atisund sessionid=enbyCic proto=1 action=block policyid=nrepre trandisp=uisautem duration=145.667000 sentbyte=4247 rcvdbyte=4374 devtype=tio osname=aconseq osversion=1.4195 mastersrcmac=enatuser srcmac=01:00:5e:1a:9c:4f crscore=124.786000 craction=rcitatio crlevel=olore eventtype=ntexp user=atio service=roquisqu hostname=rror3870.www5.local profile=volu reqtype=occ url=https://www5.example.net/culpa/isun.txt?cola=tura#rat direction=internal msg=sect method=ing cat=nis catdesc=aboreet device_id=ulapari log_id=isetqu pri=high userfrom=ons adminprof=Sedu timezone=CEST main_type=icaboNem trigger_policy=enderi sub_type=edqu severity_level=cita policy=uidolore src=10.146.255.40 src_port=3003 dst=10.226.39.82 dst_port=3950 http_method=oluptate http_url=orumwrit http_host=aconse http_agent=ites http_session_id=abori signature_subclass=dolor signature_id=3543 srccountry=amqu content_switch_name=uamest server_pool_name=ntoccaec false_positive_mitigation=ites user_name=caecatcu monitor_status=iof http_refer=https://api.example.com/uae/mdolo.txt?aute=itatise#utpers http_version=equunt dev_id=Nemo threat_weight=itse history_threat_weight=lillumq threat_level=idid ftp_mode=uis ftp_cmd=velits cipher_suite=mmodo msg_id=rporissu +logver=utemvel dtime=2019-05-28 04:48:31.832538723 +0000 UTC devid=exercita devname=emaperi vd=aspernat date=2019-5-28 time=4:48:31 logid=ddoei type=nihi subtype=umfu level=low eventtime=ehen logtime=olupt srcip=10.53.82.96 srcport=7088 srcintf=eth297 srcintfrole=nostru dstip=10.224.212.88 dstport=5404 dstintf=lo4266 dstintfrole=natuserr poluuid=ipi sessionid=eniamqui proto=icmp action=deny policyid=urvelill policytype=iadese crscore=174.116000 craction=isundeo crlevel=emq appcat=rehender service=uat srccountry=apa dstcountry=tani trandisp=per tranip=10.35.240.70 tranport=2587 duration=62.993000 sentbyte=7102 rcvdbyte=2380 sentpkt=ataevit app=chi +logver=lorsita devname="oeius" devid="trud" vd=aco date=2019-6-11 time=11:51:06 logid=uei type=tsedqu subtype=agni level=very-high eventtime=rsint logtime=catc srcip=10.186.253.240 srcport=6982 srcintf=enp0s5429 srcintfrole=end dstip=10.233.128.7 dstport=2455 dstintf=eth5315 dstintfrole=onnumq poluuid=lupt sessionid=ugiatq proto=prm action=cancel policyid=utla policytype=iosamn crscore=164.209000 craction=tor crlevel=toreve appcat=ita service=orain srccountry=tnulap dstcountry=aevitae trandisp=aqu tranip=10.66.149.234 tranport=6236 duration=128.130000 sentbyte=6344 rcvdbyte=475 sentpkt=loremeu app=tate +logver=elaud dtime=2019-06-25 18:53:40.352538723 +0000 UTC devid=iad devname=irat vd=upi date=2019-6-25 time=6:53:40 logid=rsintocc type=itanim subtype=sinto level=medium eventtime=lore logtime=eabi srcip=10.227.133.134 srcport=3351 srcintf=enp0s4820 srcintfrole=erspici dstip=10.46.11.114 dstport=4009 dstintf=enp0s7159 dstintfrole=oremq poluuid=rspiciat sessionid=ptas proto=tcp action=cancel policyid=ore policytype=dut crscore=128.554000 craction=remape crlevel=itectob appcat=sedquia service=mquisnos srccountry=mwritt dstcountry=avolupt trandisp=lumdolo tranip=10.173.140.201 tranport=6422 duration=133.394000 sentbyte=7249 rcvdbyte=1387 sentpkt=str app=sit +logver=elillum dtime=2019-07-10 01:56:14.612538723 +0000 UTC devid=isnos devname=emp vd=eos date=2019-7-10 time=1:56:14 logid=sciveli type=Bonoru subtype=rai level=low eventtime=omm logtime=cepteu srcip=10.205.18.11 srcport=6737 srcintf=eth4759 srcintfrole=ueipsa dstip=10.69.130.207 dstport=1191 dstintf=eth614 dstintfrole=architec poluuid=era sessionid=ptatem proto=udp action=cancel policyid=isi policytype=ssecill crscore=44.181000 craction=exerci crlevel=ptatemUt appcat=temqu service=ofd srccountry=nimvenia dstcountry=ari trandisp=eir tranip=10.170.236.123 tranport=4346 duration=150.036000 sentbyte=6877 rcvdbyte=1751 sentpkt=orum app=tation +logver=repre date=2019-7-24 time=8:58:48 log_id=ore devid=ionemu devname=rehend logid=uiad type=tasu subtype=sciun level=high vd=taev srcip=10.196.124.206 srcport=7569 srcintf=enp0s2181 dstip=10.186.88.110 dstport=4203 dstintf=enp0s5497 poluuid=asnulapa sessionid=hende proto=0 action=deny policyid=ntmolli trandisp=uto duration=178.755000 sentbyte=6361 rcvdbyte=1742 devtype=ipsu osname=taedi osversion=1.2682 mastersrcmac=acom srcmac=01:00:5e:99:e3:a5 crscore=175.099000 craction=Cic crlevel=aturveli eventtype=lica user=Exc service=amvolup hostname=velill3821.mail.invalid profile=asnulap reqtype=usmodte url=https://example.com/loremag/mqu.gif?bore=lapari#aborios direction=external msg=lorem method=mnisiuta cat=quiadolo catdesc=abo device_id=msequine log_id=mrem pri=medium userfrom=atuserr adminprof=nsequatu timezone=ET main_type=uptasnu trigger_policy=atemUt sub_type=iurere severity_level=oident policy=volup src=10.97.254.192 src_port=302 dst=10.124.34.251 dst_port=3899 http_method=imide http_url=sequa http_host=ine http_agent=ollitan http_session_id=eacomm signature_subclass=onseq signature_id=6250 srccountry=reetd content_switch_name=equamnih server_pool_name=tevelite false_positive_mitigation=sitvolup user_name=epor monitor_status=atatnonp http_refer=https://example.org/elauda/ria.htm?uptatemU=iono#quun http_version=itationu dev_id=eniamqui threat_weight=adolo history_threat_weight=oreetdol threat_level=uinesciu ftp_mode=sciun ftp_cmd=tametc cipher_suite=rExcep msg_id=avolup +logver=olores devname="ineavol" devid="bori" vd=taev date=2019-8-7 time=4:01:23 logid=ngelit type=uidexea subtype=stiaec level=very-high eventtime=quipex logtime=rsintoc srcip=10.9.41.221 srcport=4010 srcintf=eth434 srcintfrole=estlabor dstip=10.81.58.91 dstport=2247 dstintf=lo6072 dstintfrole=udexerci poluuid=onemul sessionid=elaud proto=tcp action=cancel policyid=trudexe policytype=tiumtota crscore=53.861000 craction=ariaturE crlevel=fug appcat=umqu service=umqu srccountry=roide dstcountry=tio trandisp=autem tranip=10.204.98.238 tranport=3885 duration=108.380000 sentbyte=2498 rcvdbyte=3936 sentpkt=aquioffi app=aliqui +date=2019-8-21 time=11:03:57 devname=unti device_id=tena log_id=velits type=event subtype=oditautf pri=high desc=rmagni user=tiono userfrom=utemvele msg=taevi action=cancel adom=xplicabo4308.www.example session_id=tquo +logver=nrepr devname="uipex" devid="alorumw" vd=nibus date=2019-9-5 time=6:06:31 logid=eiusmo type=rci subtype=seosquir level=medium eventtime=ume logtime=ercitati srcip=10.35.84.125 srcport=341 srcintf=enp0s2388 srcintfrole=pernatu dstip=10.37.120.29 dstport=4170 dstintf=enp0s1127 dstintfrole=tasuntex poluuid=etura sessionid=taedi proto=udp action=accept policyid=quiacon policytype=udexerc crscore=66.169000 craction=undeomni crlevel=ritquiin appcat=taspern service=iadeser srccountry=nos dstcountry=mollita trandisp=eserun tranip=10.212.208.70 tranport=3237 duration=36.569000 sentbyte=5330 rcvdbyte=11 sentpkt=otamr app=eveli +logver=temsequi devname="aturvel" devid="elaudan" vd=alorum date=2019-9-19 time=1:09:05 logid=olor type=inesc subtype=tlaborio level=high eventtime=equeporr logtime=seq srcip=10.143.65.84 srcport=2670 srcintf=enp0s5828 srcintfrole=ddoeiu dstip=10.199.201.26 dstport=3770 dstintf=eth4236 dstintfrole=ore poluuid=onse sessionid=abo proto=1 action=accept policyid=magnaa policytype=tateveli crscore=94.258000 craction=xplica crlevel=dex appcat=rsintocc service=iusmo srccountry=oquisqu dstcountry=ullamcor trandisp=remagn tranip=10.207.207.106 tranport=2048 duration=94.877000 sentbyte=6896 rcvdbyte=7419 sentpkt=tvolup app=ites +logver=rExce dtime=2019-10-03 20:11:40.172538723 +0000 UTC devid=rittenby devname=gni vd=ritq date=2019-10-3 time=8:11:40 logid=lestiaec type=rissusci subtype=fdeFi level=high eventtime=ehende logtime=riatu srcip=10.204.27.48 srcport=5998 srcintf=lo7358 srcintfrole=emaperia dstip=10.163.236.253 dstport=7768 dstintf=enp0s2100 dstintfrole=sequatu poluuid=ugi sessionid=oditau proto=1 action=block policyid=mvele policytype=atae crscore=123.668000 craction=imips crlevel=admi appcat=ocons service=tiumdol srccountry=sunt dstcountry=rrorsi trandisp=remagna tranip=10.41.61.88 tranport=426 duration=82.943000 sentbyte=525 rcvdbyte=3702 sentpkt=dolor app=ips +logver=ipitlab dtime=2019-10-18 03:14:14.432538723 +0000 UTC devid=ipsa devname=dents vd=erepreh date=2019-10-18 time=3:14:14 logid=amest type=dolore subtype=xer level=medium eventtime=onemul logtime=off srcip=10.246.81.164 srcport=3453 srcintf=lo3071 srcintfrole=ende dstip=10.185.44.26 dstport=3193 dstintf=lo7861 dstintfrole=tationul poluuid=tam sessionid=byCic proto=0 action=cancel policyid=cons policytype=serro crscore=5.473000 craction=uiac crlevel=aecatcu appcat=sed service=uisnostr srccountry=aquei dstcountry=ation trandisp=sumqu tranip=10.53.110.111 tranport=2549 duration=141.141000 sentbyte=5569 rcvdbyte=5239 sentpkt=entore app=uaturQ +logver=xpli date=2019-11-1 time=10:16:48 log_id=quae devid=totamre devname=lam logid=quamestq type=porai subtype=oinve level=medium vd=hender srcip=10.84.154.230 srcport=1335 srcintf=enp0s1127 dstip=10.212.63.179 dstport=6790 dstintf=eth1762 poluuid=eufugia sessionid=temqu proto=3 action=allow policyid=tvolup trandisp=lori duration=130.339000 sentbyte=4763 rcvdbyte=4334 devtype=rnatur osname=etdolo osversion=1.802 mastersrcmac=adipisci srcmac=01:00:5e:7b:68:0e crscore=36.122000 craction=culpaq crlevel=quis eventtype=lupt user=upt service=aboN hostname=cupida6106.www5.local profile=tdo reqtype=asperna url=https://api.example.com/aco/empo.jpg?iumdol=iusm#ido direction=unknown msg=peri method=aspernat cat=seq catdesc=olup device_id=uamqu log_id=veli pri=high userfrom=etco adminprof=nulap timezone=CT main_type=radip trigger_policy=tali sub_type=ntin severity_level=loreseos policy=ites src=10.109.172.90 src_port=2785 dst=10.146.77.206 dst_port=1554 http_method=amnihilm http_url=ipsamv http_host=proid http_agent=xcep http_session_id=udantium signature_subclass=sum signature_id=1723 srccountry=iaecon content_switch_name=euf server_pool_name=norume false_positive_mitigation=hilmo user_name=aquaeab monitor_status=eporr http_refer=https://www.example.com/metMalo/santiu.jpg?icon=enderit#roquisqu http_version=lapa dev_id=imadm threat_weight=giatquo history_threat_weight=oeiusm threat_level=oreeuf ftp_mode=iusmodt ftp_cmd=umwrit cipher_suite=atatn msg_id=uatD +date=2019-11-15 time=5:19:22 devname=ptate device_id=Nemoe log_id=cupidat type=generic subtype=onsequ pri=high devid=nostr devname=umtotam logid=mqua type=emU subtype=gnido level=very-high vd=plicab srcip=10.8.161.226 srcport=3191 srcintf=eth5256 dstip=10.13.234.237 dstport=3760 dstintf=enp0s1149 poluuid=oeiusmo sessionid=nisi proto=6 action=allow policyid=lupt trandisp=tlaborio duration=18.804000 sentbyte=1061 rcvdbyte=6464 devtype=itan osname=iquidexe osversion=1.2314 mastersrcmac=fugia srcmac=01:00:5e:09:8f:0e crscore=5.320000 craction=onof crlevel=quam eventtype=rure user=ipis service=liqu hostname=unt2122.internal.local profile=orsitame reqtype=tassitas url=https://example.org/uidolor/turve.htm?temporai=uasiarch#ect direction=unknown msg=occae method=lpaqu cat=minimav catdesc=col device_id=riamea log_id=ern pri=low userfrom=odtempo adminprof=con timezone=CEST main_type=offici trigger_policy=uipexe sub_type=ium severity_level=quamqua policy=nsequatu src=10.38.18.72 src_port=3177 dst=10.202.250.141 dst_port=1824 http_method=volu http_url=quatDui http_host=stenat http_agent=liquip http_session_id=eiusmodt signature_subclass=dmi signature_id=4174 srccountry=ameaque content_switch_name=pitlabor server_pool_name=essequa false_positive_mitigation=ini user_name=maperia monitor_status=ovolup http_refer=https://mail.example.com/veniamq/uisno.htm?luptas=omm#eaquei http_version=iveli dev_id=lill threat_weight=voluptat history_threat_weight=aturveli threat_level=incidunt ftp_mode=tatnonp ftp_cmd=abi cipher_suite=nimave msg_id=atu +logver=siu date=2019-11-30 time=12:21:57 log_id=inrepr devid=cero devname=ita logid=xercitat type=meumfug subtype=umt level=very-high vd=laparia srcip=10.195.87.127 srcport=760 srcintf=lo3094 dstip=10.52.118.202 dstport=6556 dstintf=enp0s5751 poluuid=ectobe sessionid=rehender proto=udp action=block policyid=orinc trandisp=tcons duration=52.473000 sentbyte=7043 rcvdbyte=4714 devtype=suscipi osname=imipsam osversion=1.4674 mastersrcmac=hilm srcmac=01:00:5e:73:ca:c1 crscore=54.412000 craction=etd crlevel=erspici eventtype=tfug user=atatno service=sed hostname=luptat2613.internal.localhost profile=olupt reqtype=mipsum url=https://www.example.net/Maloru/lapariat.htm?tlabori=rehender#odtempo direction=inbound msg=alorum method=tmollit cat=bori catdesc=antium device_id=reetdo log_id=rchitec pri=medium userfrom=cipitlab adminprof=venia timezone=CT main_type=quid trigger_policy=mwrit sub_type=cid severity_level=lupt policy=adipisc src=10.182.124.88 src_port=116 dst=10.139.144.75 dst_port=5037 http_method=utodi http_url=isiutali http_host=oremeu http_agent=mquaerat http_session_id=conse signature_subclass=mestq signature_id=5535 srccountry=turQuisa content_switch_name=itasper server_pool_name=cidu false_positive_mitigation=ips user_name=modo monitor_status=ela http_refer=https://example.org/unti/niamqu.html?ris=veli#giatnu http_version=tanimide dev_id=ectetur threat_weight=umexer history_threat_weight=nim threat_level=nisiuta ftp_mode=cipitla ftp_cmd=ditautf cipher_suite=oluptasn msg_id=madmin +date=2019-12-14 time=7:24:31 logver=imadm devid=stla devname=cab logid=orr type=olu subtype=quatDu level=low vd=siste srcip=10.151.47.249 srcport=6697 srcintf=lo5632 dstip=10.155.194.6 dstport=3005 dstintf=enp0s6106 poluuid=quatDu sessionid=deFinib proto=HOPOPT action=block policyid=taedic trandisp=ffi duration=130.219000 sentbyte=2693 rcvdbyte=568 devtype=consequ osname=rumw osversion=1.1386 mastersrcmac=temveleu srcmac=01:00:5e:df:96:27 crscore=104.315000 craction=item crlevel=remipsum eventtype=olupt user=usc service=ernat hostname=neavo4796.internal.domain profile=tatemac reqtype=exer url=https://www5.example.com/xea/ssecill.html?quianonn=quun#one direction=internal msg=riame method=uaUte cat=quae catdesc=utlabor device_id=ameius log_id=tate pri=very-high userfrom=lupta adminprof=atemseq timezone=CEST main_type=amcolab trigger_policy=ectobea sub_type=itsedq severity_level=pta policy=remipsu src=10.35.10.19 src_port=3941 dst=10.188.124.185 dst_port=5837 http_method=tali http_url=tasper http_host=amquisn http_agent=esciu http_session_id=iamea signature_subclass=perspi signature_id=7117 srccountry=emaccus content_switch_name=expl server_pool_name=giat false_positive_mitigation=uscipi user_name=dolo monitor_status=tionevol http_refer=https://internal.example.com/uptatema/dutpers.htm?tion=iumdol#ept http_version=Mal dev_id=tquasia threat_weight=ficiad history_threat_weight=roinBC threat_level=eufu ftp_mode=tio ftp_cmd=equatDu cipher_suite=exea msg_id=tasnulap diff --git a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json new file mode 100644 index 00000000000..58b8f8f4689 --- /dev/null +++ b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json @@ -0,0 +1,7561 @@ +[ + { + "@timestamp": "2016-01-29T08:09:59.000Z", + "destination.bytes": 449, + "destination.geo.country_name": "sequa", + "destination.ip": [ + "10.44.173.44" + ], + "destination.nat.ip": "10.189.58.145", + "destination.nat.port": 5273, + "destination.port": 6125, + "event.action": "allow", + "event.code": "sse", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=iusm devname=\"modtempo\" devid=\"olab\" vd=nto date=2016-1-29 time=6:09:59 logid=sse type=exercita subtype=der level=very-high eventtime=odoco logtime=ria srcip=10.20.234.169 srcport=1001 srcintf=eth5722 srcintfrole=vol dstip=10.44.173.44 dstport=6125 dstintf=enp0s3068 dstintfrole=nseq poluuid=itinvol sessionid=psa proto=21 action=allow policyid=ntium policytype=psaq crscore=13.800000 craction=eab crlevel=aliqu appcat=Ute service=lupt srccountry=dolore dstcountry=sequa trandisp=abo tranip=10.189.58.145 tranport=5273 duration=14.119000 sentbyte=7880 rcvdbyte=449 sentpkt=mqui app=nci", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 0, + "network.bytes": 8329, + "observer.egress.interface.name": "enp0s3068", + "observer.ingress.interface.name": "eth5722", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.44.173.44", + "10.20.234.169", + "10.189.58.145" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "der", + "rsa.misc.context": "abo", + "rsa.misc.event_source": "modtempo", + "rsa.misc.event_type": "exercita", + "rsa.misc.hardware_id": "olab", + "rsa.misc.log_session_id": "psa", + "rsa.misc.obj_name": "nci", + "rsa.misc.policy_id": "ntium", + "rsa.misc.reference_id": "sse", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "nto", + "rsa.network.dinterface": "enp0s3068", + "rsa.network.network_service": "lupt", + "rsa.network.sinterface": "eth5722", + "rsa.time.duration_time": 14.119, + "rsa.time.event_time": "2016-01-29T08:09:59.000Z", + "rsa.time.event_time_str": "odoco", + "rsa.web.reputation_num": 13.8, + "service.type": "fortinet", + "source.bytes": 7880, + "source.geo.country_name": "dolore", + "source.ip": [ + "10.20.234.169" + ], + "source.port": 1001, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-12T03:12:33.000Z", + "destination.bytes": 3879, + "destination.ip": [ + "10.171.204.166" + ], + "destination.port": 6668, + "event.action": "accept", + "event.code": "atio", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-2-12 time=1:12:33 logver=litesse devid=orev devname=pisciv logid=uii type=umexe subtype=estlabo level=high vd=iatnu srcip=10.182.84.248 srcport=4880 srcintf=enp0s208 dstip=10.162.33.193 dstport=7200 dstintf=enp0s2581 poluuid=nulapari sessionid=mwritten proto=prm action=accept policyid=uidolor trandisp=nibus duration=72.226000 sentbyte=6378 rcvdbyte=3879 devtype=riosam osname=anonnu osversion=1.410 mastersrcmac=ameaqu srcmac=01:00:5e:84:66:6c crscore=145.047000 craction=squame crlevel=ntex eventtype=eius user=luptat service=emape hostname=aer445.host profile=eumiu reqtype=uame url=https://www.example.net/orisn/cca.htm?ofdeF=metcons#roinBCS direction=external msg=com method=eataevi cat=byC catdesc=tinculp device_id=tur log_id=atio pri=high userfrom=atemsequ adminprof=nci timezone=CEST main_type=eFini trigger_policy=amco sub_type=exe severity_level=iatu policy=ionofde src=10.62.4.246 src_port=189 dst=10.171.204.166 dst_port=6668 http_method=mol http_url=taspe http_host=mvolu http_agent=radip http_session_id=tNequ signature_subclass=gelit signature_id=6728 srccountry=tconsec content_switch_name=nsequat server_pool_name=taev false_positive_mitigation=roidents user_name=oluptas monitor_status=llu http_refer=https://api.example.org/tamremap/tur.html?radipis=isetq#estqui http_version=uasiarch dev_id=emaper threat_weight=ssitasp history_threat_weight=eum threat_level=sum ftp_mode=uaerat ftp_cmd=boreet cipher_suite=onev msg_id=tenima", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "aer445.host", + "http.request.referrer": "https://api.example.org/tamremap/tur.html?radipis=isetq#estqui", + "input.type": "log", + "log.level": "high", + "log.offset": 593, + "network.bytes": 10257, + "network.direction": "external", + "observer.egress.interface.name": "enp0s2581", + "observer.ingress.interface.name": "enp0s208", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.410", + "related.ip": [ + "10.62.4.246", + "10.171.204.166" + ], + "related.user": [ + "oluptas" + ], + "rsa.internal.event_desc": "com", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "eius", + "rsa.misc.OS": "anonnu", + "rsa.misc.action": [ + "mol", + "accept" + ], + "rsa.misc.category": "exe", + "rsa.misc.client": "radip", + "rsa.misc.context": "nibus", + "rsa.misc.event_source": "pisciv", + "rsa.misc.event_type": "umexe", + "rsa.misc.fcatnum": "byC", + "rsa.misc.filter": "tinculp", + "rsa.misc.hardware_id": "tur", + "rsa.misc.log_session_id": "tNequ", + "rsa.misc.policy_id": "uidolor", + "rsa.misc.policy_name": "ionofde", + "rsa.misc.reference_id": "atio", + "rsa.misc.rule_name": "eumiu", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 6728, + "rsa.misc.version": "1.410", + "rsa.misc.vsys": "iatnu", + "rsa.network.alias_host": [ + "aer445.host" + ], + "rsa.network.dinterface": "enp0s2581", + "rsa.network.network_service": "emape", + "rsa.network.sinterface": "enp0s208", + "rsa.threat.threat_desc": "sum", + "rsa.time.duration_time": 72.226, + "rsa.time.event_time": "2016-02-12T03:12:33.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 145.047, + "rsa.web.web_ref_domain": "mvolu", + "rule.name": "eumiu", + "service.type": "fortinet", + "source.bytes": 6378, + "source.geo.country_name": "tconsec", + "source.ip": [ + "10.62.4.246" + ], + "source.mac": "01:00:5e:84:66:6c", + "source.port": 189, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.net/orisn/cca.htm?ofdeF=metcons#roinBCS", + "url.query": "taspe", + "user.name": "oluptas" + }, + { + "@timestamp": "2016-02-26T10:15:08.000Z", + "destination.bytes": 13, + "destination.geo.country_name": "ima", + "destination.ip": [ + "10.94.103.117" + ], + "destination.nat.ip": "10.15.159.80", + "destination.nat.port": 6378, + "destination.port": 513, + "event.action": "allow", + "event.code": "tia", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=seq dtime=2016-02-26 20:15:08.252538723 +0000 UTC devid=olorema devname=ccaecat vd=veleumi date=2016-2-26 time=8:15:08 logid=tia type=enim subtype=dqu level=medium eventtime=uian logtime=tempo srcip=10.200.188.142 srcport=4665 srcintf=eth4496 srcintfrole=eetd dstip=10.94.103.117 dstport=513 dstintf=enp0s3491 dstintfrole=doloreeu poluuid=pori sessionid=occ proto=icmp action=allow policyid=reetdolo policytype=nrepreh crscore=18.839000 craction=uiano crlevel=mrema appcat=autfu service=natura srccountry=aboris dstcountry=ima trandisp=tanimi tranip=10.15.159.80 tranport=6378 duration=121.916000 sentbyte=6517 rcvdbyte=13 sentpkt=ugiatqu app=eacomm", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 2051, + "network.bytes": 6530, + "observer.egress.interface.name": "enp0s3491", + "observer.ingress.interface.name": "eth4496", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.200.188.142", + "10.94.103.117", + "10.15.159.80" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "dqu", + "rsa.misc.context": "tanimi", + "rsa.misc.event_source": "ccaecat", + "rsa.misc.event_type": "enim", + "rsa.misc.hardware_id": "olorema", + "rsa.misc.log_session_id": "occ", + "rsa.misc.obj_name": "eacomm", + "rsa.misc.policy_id": "reetdolo", + "rsa.misc.reference_id": "tia", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "veleumi", + "rsa.network.dinterface": "enp0s3491", + "rsa.network.network_service": "natura", + "rsa.network.sinterface": "eth4496", + "rsa.time.duration_time": 121.916, + "rsa.time.event_time": "2016-02-26T10:15:08.000Z", + "rsa.time.event_time_str": "uian", + "rsa.web.reputation_num": 18.839, + "service.type": "fortinet", + "source.bytes": 6517, + "source.geo.country_name": "aboris", + "source.ip": [ + "10.200.188.142" + ], + "source.port": 4665, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-03-12T05:17:42.000Z", + "destination.bytes": 3269, + "destination.geo.country_name": "amquisno", + "destination.ip": [ + "10.50.112.141" + ], + "destination.nat.ip": "10.27.88.95", + "destination.nat.port": 776, + "destination.port": 7303, + "event.action": "cancel", + "event.code": "nimadmi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=liqu devname=\"lorem\" devid=\"emq\" vd=isiu date=2016-3-12 time=3:17:42 logid=nimadmi type=iatisu subtype=iat level=low eventtime=suntinc logtime=elits srcip=10.131.233.27 srcport=5037 srcintf=eth3676 srcintfrole=eataevit dstip=10.50.112.141 dstport=7303 dstintf=eth3391 dstintfrole=olab poluuid=mquisnos sessionid=loremagn proto=1 action=cancel policyid=tsed policytype=orai crscore=61.614000 craction=incididu crlevel=eci appcat=aali service=ametcons srccountry=porainc dstcountry=amquisno trandisp=iinea tranip=10.27.88.95 tranport=776 duration=5.911000 sentbyte=1147 rcvdbyte=3269 sentpkt=tvol app=moll", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 2708, + "network.bytes": 4416, + "observer.egress.interface.name": "eth3391", + "observer.ingress.interface.name": "eth3676", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.50.112.141", + "10.131.233.27", + "10.27.88.95" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "iat", + "rsa.misc.context": "iinea", + "rsa.misc.event_source": "lorem", + "rsa.misc.event_type": "iatisu", + "rsa.misc.hardware_id": "emq", + "rsa.misc.log_session_id": "loremagn", + "rsa.misc.obj_name": "moll", + "rsa.misc.policy_id": "tsed", + "rsa.misc.reference_id": "nimadmi", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "isiu", + "rsa.network.dinterface": "eth3391", + "rsa.network.network_service": "ametcons", + "rsa.network.sinterface": "eth3676", + "rsa.time.duration_time": 5.911, + "rsa.time.event_time": "2016-03-12T05:17:42.000Z", + "rsa.time.event_time_str": "suntinc", + "rsa.web.reputation_num": 61.614, + "service.type": "fortinet", + "source.bytes": 1147, + "source.geo.country_name": "porainc", + "source.ip": [ + "10.131.233.27" + ], + "source.port": 5037, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-03-26T12:20:16.000Z", + "destination.bytes": 3982, + "destination.ip": [ + "10.157.213.15" + ], + "destination.port": 3539, + "event.action": "allow", + "event.code": "ddoeiu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-3-26 time=10:20:16 logver=inim devid=ema devname=roinBCSe logid=onse type=tae subtype=tatno level=very-high vd=oluptate srcip=10.52.54.178 srcport=4427 srcintf=lo1567 dstip=10.37.58.155 dstport=2430 dstintf=eth6096 poluuid=ciati sessionid=ercit proto=3 action=allow policyid=eniam trandisp=reetdolo duration=165.411000 sentbyte=7651 rcvdbyte=3982 devtype=rumet osname=oll osversion=1.5670 mastersrcmac=nido srcmac=01:00:5e:c3:0a:41 crscore=71.955000 craction=itlabori crlevel=Ciceroi eventtype=aveniam user=uradi service=nimadmin hostname=olo7148.mail.home profile=snulapar reqtype=aedic url=https://api.example.com/iumto/aboreetd.gif?dun=enim#saute direction=internal msg=eriame method=lorema cat=avol catdesc=labor device_id=atuse log_id=ddoeiu pri=high userfrom=idolore adminprof=onse timezone=PST main_type=tation trigger_policy=ips sub_type=emeumfug severity_level=upta policy=omn src=10.87.212.179 src_port=1758 dst=10.157.213.15 dst_port=3539 http_method=ali http_url=nsect http_host=ntutl http_agent=caecatc http_session_id=onsequat signature_subclass=siuta signature_id=2896 srccountry=loru content_switch_name=ema server_pool_name=par false_positive_mitigation=itaut user_name=rveli monitor_status=rsint http_refer=https://example.com/idestla/Nemoeni.htm?taed=lup#remeumf http_version=antiumto dev_id=strude threat_weight=ctetura history_threat_weight=usmod threat_level=edqui ftp_mode=mquidol ftp_cmd=ita cipher_suite=ipi msg_id=rsitamet", + "event.timezone": "PST", + "fileset.name": "fortimanager", + "host.name": "olo7148.mail.home", + "http.request.referrer": "https://example.com/idestla/Nemoeni.htm?taed=lup#remeumf", + "input.type": "log", + "log.level": "high", + "log.offset": 3319, + "network.bytes": 11633, + "network.direction": "internal", + "network.protocol": "GGP", + "observer.egress.interface.name": "eth6096", + "observer.ingress.interface.name": "lo1567", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.5670", + "related.ip": [ + "10.87.212.179", + "10.157.213.15" + ], + "related.user": [ + "rveli" + ], + "rsa.internal.event_desc": "eriame", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "aveniam", + "rsa.misc.OS": "oll", + "rsa.misc.action": [ + "allow", + "ali" + ], + "rsa.misc.category": "emeumfug", + "rsa.misc.client": "caecatc", + "rsa.misc.context": "reetdolo", + "rsa.misc.event_source": "roinBCSe", + "rsa.misc.event_type": "tae", + "rsa.misc.fcatnum": "avol", + "rsa.misc.filter": "labor", + "rsa.misc.hardware_id": "atuse", + "rsa.misc.log_session_id": "onsequat", + "rsa.misc.policy_id": "eniam", + "rsa.misc.policy_name": "omn", + "rsa.misc.reference_id": "ddoeiu", + "rsa.misc.rule_name": "snulapar", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 2896, + "rsa.misc.version": "1.5670", + "rsa.misc.vsys": "oluptate", + "rsa.network.alias_host": [ + "olo7148.mail.home" + ], + "rsa.network.dinterface": "eth6096", + "rsa.network.network_service": "nimadmin", + "rsa.network.sinterface": "lo1567", + "rsa.threat.threat_desc": "edqui", + "rsa.time.duration_time": 165.411, + "rsa.time.event_time": "2016-03-26T12:20:16.000Z", + "rsa.time.timezone": "PST", + "rsa.web.reputation_num": 71.955, + "rsa.web.web_ref_domain": "ntutl", + "rule.name": "snulapar", + "service.type": "fortinet", + "source.bytes": 7651, + "source.geo.country_name": "loru", + "source.ip": [ + "10.87.212.179" + ], + "source.mac": "01:00:5e:c3:0a:41", + "source.port": 1758, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.com/iumto/aboreetd.gif?dun=enim#saute", + "url.query": "nsect", + "user.name": "rveli" + }, + { + "@timestamp": "2016-04-09T07:22:51.000Z", + "destination.bytes": 927, + "destination.ip": [ + "10.76.73.140" + ], + "destination.port": 3075, + "event.action": "accept", + "event.code": "moenimi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-4-9 time=5:22:51 logver=eseru devid=remeum devname=orain logid=quip type=oin subtype=uisquam level=high vd=tinvol srcip=10.19.68.92 srcport=1409 srcintf=enp0s33 dstip=10.38.22.45 dstport=7036 dstintf=lo1120 poluuid=ditautfu sessionid=piscing proto=icmp action=accept policyid=ostr trandisp=rudexerc duration=135.013000 sentbyte=3369 rcvdbyte=927 devtype=itaut osname=imaven osversion=1.152 mastersrcmac=umdolo srcmac=01:00:5e:f7:4a:fd crscore=169.252000 craction=tfug crlevel=icab eventtype=mwr user=fugi service=inculpaq hostname=agna7678.internal.host profile=equa reqtype=mexercit url=https://www.example.net/tasuntex/sunt.txt?ume=incidi#picia direction=unknown msg=olupt method=dit cat=sumquiad catdesc=dexeaco device_id=ivelits log_id=moenimi pri=medium userfrom=etdolo adminprof=inv timezone=CEST main_type=ommod trigger_policy=sequatur sub_type=uidolo severity_level=lumquido policy=nihi src=10.114.150.67 src_port=1407 dst=10.76.73.140 dst_port=3075 http_method=uines http_url=nsec http_host=onse http_agent=emips http_session_id=imadmi signature_subclass=ostrume signature_id=6051 srccountry=eataev content_switch_name=liquide server_pool_name=uasia false_positive_mitigation=emp user_name=aperia monitor_status=ofdeFini http_refer=https://example.org/vol/riat.htm?atvol=umiur#imad http_version=msequi dev_id=isnostru threat_weight=iquaUten history_threat_weight=santium threat_level=iciatisu ftp_mode=rehender ftp_cmd=eporroqu cipher_suite=uat msg_id=tem", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "agna7678.internal.host", + "http.request.referrer": "https://example.org/vol/riat.htm?atvol=umiur#imad", + "input.type": "log", + "log.level": "medium", + "log.offset": 4778, + "network.bytes": 4296, + "network.direction": "unknown", + "observer.egress.interface.name": "lo1120", + "observer.ingress.interface.name": "enp0s33", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.152", + "related.ip": [ + "10.76.73.140", + "10.114.150.67" + ], + "related.user": [ + "aperia" + ], + "rsa.internal.event_desc": "olupt", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "mwr", + "rsa.misc.OS": "imaven", + "rsa.misc.action": [ + "accept", + "uines" + ], + "rsa.misc.category": "uidolo", + "rsa.misc.client": "emips", + "rsa.misc.context": "rudexerc", + "rsa.misc.event_source": "orain", + "rsa.misc.event_type": "oin", + "rsa.misc.fcatnum": "sumquiad", + "rsa.misc.filter": "dexeaco", + "rsa.misc.hardware_id": "ivelits", + "rsa.misc.log_session_id": "imadmi", + "rsa.misc.policy_id": "ostr", + "rsa.misc.policy_name": "nihi", + "rsa.misc.reference_id": "moenimi", + "rsa.misc.rule_name": "equa", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 6051, + "rsa.misc.version": "1.152", + "rsa.misc.vsys": "tinvol", + "rsa.network.alias_host": [ + "agna7678.internal.host" + ], + "rsa.network.dinterface": "lo1120", + "rsa.network.network_service": "inculpaq", + "rsa.network.sinterface": "enp0s33", + "rsa.threat.threat_desc": "iciatisu", + "rsa.time.duration_time": 135.013, + "rsa.time.event_time": "2016-04-09T07:22:51.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 169.252, + "rsa.web.web_ref_domain": "onse", + "rule.name": "equa", + "service.type": "fortinet", + "source.bytes": 3369, + "source.geo.country_name": "eataev", + "source.ip": [ + "10.114.150.67" + ], + "source.mac": "01:00:5e:f7:4a:fd", + "source.port": 1407, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.net/tasuntex/sunt.txt?ume=incidi#picia", + "url.query": "nsec", + "user.name": "aperia" + }, + { + "@timestamp": "2016-04-24T14:25:25.000Z", + "destination.bytes": 3605, + "destination.ip": [ + "10.95.64.124" + ], + "destination.port": 7042, + "event.action": "accept", + "event.code": "run", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=suntinc date=2016-4-24 time=12:25:25 log_id=xeac devid=nidolo devname=tatn logid=eli type=nnu subtype=dolo level=low vd=nse srcip=10.202.204.239 srcport=7783 srcintf=lo2857 dstip=10.147.28.176 dstport=7432 dstintf=enp0s1462 poluuid=mporain sessionid=icons proto=0 action=accept policyid=sequi trandisp=rehend duration=3.138000 sentbyte=6354 rcvdbyte=3605 devtype=numqu osname=qui osversion=1.4059 mastersrcmac=equi srcmac=01:00:5e:68:86:a1 crscore=72.701000 craction=tat crlevel=ipitla eventtype=quae user=maccusa service=uptat hostname=equep5085.mail.domain profile=aqu reqtype=rpo url=https://www.example.org/inesci/serror.html?mqu=apariat#tlabore direction=internal msg=ihilm method=atDu cat=eav catdesc=ionevo device_id=remagn log_id=run pri=very-high userfrom=iamquis adminprof=quirat timezone=CET main_type=ittenbyC trigger_policy=isc sub_type=aturve severity_level=emulla policy=mpori src=10.195.36.51 src_port=3905 dst=10.95.64.124 dst_port=7042 http_method=iadese http_url=nsectet http_host=utla http_agent=utei http_session_id=laborum signature_subclass=tionof signature_id=7613 srccountry=oin content_switch_name=lapari server_pool_name=data false_positive_mitigation=dolor user_name=nnum monitor_status=eritqu http_refer=https://internal.example.net/wri/bor.jpg?hitect=dol#leumiu http_version=namali dev_id=taevit threat_weight=rinrepre history_threat_weight=etconse threat_level=tincu ftp_mode=ari ftp_cmd=exercit cipher_suite=sci msg_id=quamnih", + "event.timezone": "CET", + "fileset.name": "fortimanager", + "host.name": "equep5085.mail.domain", + "http.request.referrer": "https://internal.example.net/wri/bor.jpg?hitect=dol#leumiu", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6253, + "network.bytes": 9959, + "network.direction": "internal", + "observer.egress.interface.name": "enp0s1462", + "observer.ingress.interface.name": "lo2857", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4059", + "related.ip": [ + "10.195.36.51", + "10.95.64.124" + ], + "related.user": [ + "nnum" + ], + "rsa.internal.event_desc": "ihilm", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "quae", + "rsa.misc.OS": "qui", + "rsa.misc.action": [ + "iadese", + "accept" + ], + "rsa.misc.category": "aturve", + "rsa.misc.client": "utei", + "rsa.misc.context": "rehend", + "rsa.misc.event_source": "tatn", + "rsa.misc.event_type": "nnu", + "rsa.misc.fcatnum": "eav", + "rsa.misc.filter": "ionevo", + "rsa.misc.hardware_id": "remagn", + "rsa.misc.log_session_id": "laborum", + "rsa.misc.policy_id": "sequi", + "rsa.misc.policy_name": "mpori", + "rsa.misc.reference_id": "run", + "rsa.misc.rule_name": "aqu", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 7613, + "rsa.misc.version": "1.4059", + "rsa.misc.vsys": "nse", + "rsa.network.alias_host": [ + "equep5085.mail.domain" + ], + "rsa.network.dinterface": "enp0s1462", + "rsa.network.network_service": "uptat", + "rsa.network.sinterface": "lo2857", + "rsa.threat.threat_desc": "tincu", + "rsa.time.duration_time": 3.138, + "rsa.time.event_time": "2016-04-24T14:25:25.000Z", + "rsa.time.timezone": "CET", + "rsa.web.reputation_num": 72.701, + "rsa.web.web_ref_domain": "utla", + "rule.name": "aqu", + "service.type": "fortinet", + "source.bytes": 6354, + "source.geo.country_name": "oin", + "source.ip": [ + "10.195.36.51" + ], + "source.mac": "01:00:5e:68:86:a1", + "source.port": 3905, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.org/inesci/serror.html?mqu=apariat#tlabore", + "url.query": "nsectet", + "user.name": "nnum" + }, + { + "@timestamp": "2016-05-08T09:27:59.000Z", + "destination.bytes": 3818, + "destination.geo.country_name": "sectetur", + "destination.ip": [ + "10.186.85.3" + ], + "destination.nat.ip": "10.114.16.155", + "destination.nat.port": 1608, + "destination.port": 5366, + "event.action": "allow", + "event.code": "tMalor", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=occae dtime=2016-05-08 07:27:59.552538723 +0000 UTC devid=ctetura devname=labore vd=texp date=2016-5-8 time=7:27:59 logid=tMalor type=acc subtype=amc level=very-high eventtime=amest logtime=corp srcip=10.176.216.90 srcport=2428 srcintf=eth2591 srcintfrole=dantiumt dstip=10.186.85.3 dstport=5366 dstintf=lo821 dstintfrole=ento poluuid=pic sessionid=evita proto=prm action=allow policyid=duntut policytype=magni crscore=102.339000 craction=uptat crlevel=uam appcat=boris service=nti srccountry=abi dstcountry=sectetur trandisp=uioffi tranip=10.114.16.155 tranport=1608 duration=62.941000 sentbyte=5110 rcvdbyte=3818 sentpkt=ipi app=reseos", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 7719, + "network.bytes": 8928, + "observer.egress.interface.name": "lo821", + "observer.ingress.interface.name": "eth2591", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.176.216.90", + "10.114.16.155", + "10.186.85.3" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "amc", + "rsa.misc.context": "uioffi", + "rsa.misc.event_source": "labore", + "rsa.misc.event_type": "acc", + "rsa.misc.hardware_id": "ctetura", + "rsa.misc.log_session_id": "evita", + "rsa.misc.obj_name": "reseos", + "rsa.misc.policy_id": "duntut", + "rsa.misc.reference_id": "tMalor", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "texp", + "rsa.network.dinterface": "lo821", + "rsa.network.network_service": "nti", + "rsa.network.sinterface": "eth2591", + "rsa.time.duration_time": 62.941, + "rsa.time.event_time": "2016-05-08T09:27:59.000Z", + "rsa.time.event_time_str": "amest", + "rsa.web.reputation_num": 102.339, + "service.type": "fortinet", + "source.bytes": 5110, + "source.geo.country_name": "abi", + "source.ip": [ + "10.176.216.90" + ], + "source.port": 2428, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-05-22T04:30:33.000Z", + "destination.bytes": 3252, + "destination.ip": [ + "10.61.163.4" + ], + "destination.port": 1232, + "event.action": "cancel", + "event.code": "dictasu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=mcolab date=2016-5-22 time=2:30:33 log_id=neav devid=oquisqu devname=sperna logid=eabilloi type=estia subtype=tper level=very-high vd=volupt srcip=10.188.169.107 srcport=2138 srcintf=eth6448 dstip=10.214.7.83 dstport=1696 dstintf=lo1616 poluuid=tenatu sessionid=uun proto=HOPOPT action=cancel policyid=ectio trandisp=dutper duration=4.781000 sentbyte=3423 rcvdbyte=3252 devtype=radi osname=gel osversion=1.3917 mastersrcmac=iduntu srcmac=01:00:5e:21:f5:0a crscore=57.435000 craction=uamqu crlevel=lor eventtype=oide user=dolore service=amvolu hostname=eturadi6608.mail.host profile=aera reqtype=ate url=https://api.example.com/nimid/itatione.htm?umwr=oluptate#issus direction=inbound msg=uaUteni method=udantium cat=pre catdesc=xeacom device_id=stlabo log_id=dictasu pri=low userfrom=catc adminprof=nsect timezone=GMT-07:00 main_type=asia trigger_policy=econs sub_type=uir severity_level=dol policy=essecil src=10.23.62.94 src_port=4368 dst=10.61.163.4 dst_port=1232 http_method=luptatem http_url=atem http_host=gnido http_agent=ratvolu http_session_id=olup signature_subclass=numqua signature_id=1411 srccountry=inculpa content_switch_name=abo server_pool_name=veniamqu false_positive_mitigation=nse user_name=non monitor_status=paquioff http_refer=https://www5.example.org/maven/hende.jpg?labor=didunt#uptatema http_version=intocc dev_id=liqu threat_weight=eporr history_threat_weight=xeacomm threat_level=mveleu ftp_mode=nofdeFin ftp_cmd=sequam cipher_suite=temvel msg_id=ris", + "event.timezone": "GMT-07:00", + "fileset.name": "fortimanager", + "host.name": "eturadi6608.mail.host", + "http.request.referrer": "https://www5.example.org/maven/hende.jpg?labor=didunt#uptatema", + "input.type": "log", + "log.level": "low", + "log.offset": 8364, + "network.bytes": 6675, + "network.direction": "inbound", + "observer.egress.interface.name": "lo1616", + "observer.ingress.interface.name": "eth6448", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.3917", + "related.ip": [ + "10.61.163.4", + "10.23.62.94" + ], + "related.user": [ + "non" + ], + "rsa.internal.event_desc": "uaUteni", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "oide", + "rsa.misc.OS": "gel", + "rsa.misc.action": [ + "cancel", + "luptatem" + ], + "rsa.misc.category": "uir", + "rsa.misc.client": "ratvolu", + "rsa.misc.context": "dutper", + "rsa.misc.event_source": "sperna", + "rsa.misc.event_type": "estia", + "rsa.misc.fcatnum": "pre", + "rsa.misc.filter": "xeacom", + "rsa.misc.hardware_id": "stlabo", + "rsa.misc.log_session_id": "olup", + "rsa.misc.policy_id": "ectio", + "rsa.misc.policy_name": "essecil", + "rsa.misc.reference_id": "dictasu", + "rsa.misc.rule_name": "aera", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 1411, + "rsa.misc.version": "1.3917", + "rsa.misc.vsys": "volupt", + "rsa.network.alias_host": [ + "eturadi6608.mail.host" + ], + "rsa.network.dinterface": "lo1616", + "rsa.network.network_service": "amvolu", + "rsa.network.sinterface": "eth6448", + "rsa.threat.threat_desc": "mveleu", + "rsa.time.duration_time": 4.781, + "rsa.time.event_time": "2016-05-22T04:30:33.000Z", + "rsa.time.timezone": "GMT-07:00", + "rsa.web.reputation_num": 57.435, + "rsa.web.web_ref_domain": "gnido", + "rule.name": "aera", + "service.type": "fortinet", + "source.bytes": 3423, + "source.geo.country_name": "inculpa", + "source.ip": [ + "10.23.62.94" + ], + "source.mac": "01:00:5e:21:f5:0a", + "source.port": 4368, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.com/nimid/itatione.htm?umwr=oluptate#issus", + "url.query": "atem", + "user.name": "non" + }, + { + "@timestamp": "2016-06-05T11:33:08.000Z", + "destination.bytes": 5074, + "destination.ip": [ + "10.106.31.86" + ], + "destination.port": 4198, + "event.action": "deny", + "event.code": "tium", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-6-5 time=9:33:08 logver=nisiuta devid=tvolu devname=ecte logid=tinvolu type=iurer subtype=iciadese level=medium vd=gnaaliq srcip=10.52.135.156 srcport=2660 srcintf=eth4502 dstip=10.133.89.11 dstport=1098 dstintf=lo4901 poluuid=sintoc sessionid=volupt proto=1 action=deny policyid=uiinea trandisp=Utenima duration=111.502000 sentbyte=1871 rcvdbyte=5074 devtype=ptatem osname=Nequepor osversion=1.2580 mastersrcmac=ugiatnu srcmac=01:00:5e:4a:7f:b8 crscore=103.738000 craction=mnisi crlevel=scivelit eventtype=tDuisaut user=oinBC service=quameius hostname=ipsumdol4488.api.localdomain profile=ommodico reqtype=ptas url=https://example.com/tetu/stru.htm?tlabore=Exc#pora direction=unknown msg=uteirure method=nevo cat=ide catdesc=aali device_id=adip log_id=tium pri=very-high userfrom=iusmodi adminprof=uamest timezone=PST main_type=uiac trigger_policy=epte sub_type=idolo severity_level=quinesc policy=madmi src=10.28.76.42 src_port=3427 dst=10.106.31.86 dst_port=4198 http_method=sno http_url=atno http_host=tani http_agent=volu http_session_id=nonn signature_subclass=inventor signature_id=6088 srccountry=autf content_switch_name=quamni server_pool_name=iatisu false_positive_mitigation=sec user_name=cons monitor_status=sBon http_refer=https://www.example.com/tae/ccaec.htm?aperiame=isc#ullamcor http_version=tobea dev_id=tor threat_weight=qui history_threat_weight=ntmollit threat_level=tenatus ftp_mode=cipitlab ftp_cmd=ipsumd cipher_suite=antiu msg_id=uirati", + "event.timezone": "PST", + "fileset.name": "fortimanager", + "host.name": "ipsumdol4488.api.localdomain", + "http.request.referrer": "https://www.example.com/tae/ccaec.htm?aperiame=isc#ullamcor", + "input.type": "log", + "log.level": "very-high", + "log.offset": 9850, + "network.bytes": 6945, + "network.direction": "unknown", + "observer.egress.interface.name": "lo4901", + "observer.ingress.interface.name": "eth4502", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2580", + "related.ip": [ + "10.28.76.42", + "10.106.31.86" + ], + "related.user": [ + "cons" + ], + "rsa.internal.event_desc": "uteirure", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "tDuisaut", + "rsa.misc.OS": "Nequepor", + "rsa.misc.action": [ + "sno", + "deny" + ], + "rsa.misc.category": "idolo", + "rsa.misc.client": "volu", + "rsa.misc.context": "Utenima", + "rsa.misc.event_source": "ecte", + "rsa.misc.event_type": "iurer", + "rsa.misc.fcatnum": "ide", + "rsa.misc.filter": "aali", + "rsa.misc.hardware_id": "adip", + "rsa.misc.log_session_id": "nonn", + "rsa.misc.policy_id": "uiinea", + "rsa.misc.policy_name": "madmi", + "rsa.misc.reference_id": "tium", + "rsa.misc.rule_name": "ommodico", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 6088, + "rsa.misc.version": "1.2580", + "rsa.misc.vsys": "gnaaliq", + "rsa.network.alias_host": [ + "ipsumdol4488.api.localdomain" + ], + "rsa.network.dinterface": "lo4901", + "rsa.network.network_service": "quameius", + "rsa.network.sinterface": "eth4502", + "rsa.threat.threat_desc": "tenatus", + "rsa.time.duration_time": 111.502, + "rsa.time.event_time": "2016-06-05T11:33:08.000Z", + "rsa.time.timezone": "PST", + "rsa.web.reputation_num": 103.738, + "rsa.web.web_ref_domain": "tani", + "rule.name": "ommodico", + "service.type": "fortinet", + "source.bytes": 1871, + "source.geo.country_name": "autf", + "source.ip": [ + "10.28.76.42" + ], + "source.mac": "01:00:5e:4a:7f:b8", + "source.port": 3427, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.com/tetu/stru.htm?tlabore=Exc#pora", + "url.query": "atno", + "user.name": "cons" + }, + { + "@timestamp": "2016-06-20T06:35:42.000Z", + "destination.bytes": 7130, + "destination.geo.country_name": "lup", + "destination.ip": [ + "10.106.162.153" + ], + "destination.nat.ip": "10.58.214.16", + "destination.nat.port": 508, + "destination.port": 341, + "event.action": "accept", + "event.code": "osquira", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ersp dtime=2016-06-20 04:35:42.332538723 +0000 UTC devid=tquov devname=diconseq vd=inven date=2016-6-20 time=4:35:42 logid=osquira type=tes subtype=mquame level=medium eventtime=tnulapa logtime=orain srcip=10.238.164.74 srcport=2201 srcintf=lo4249 srcintfrole=madmi dstip=10.106.162.153 dstport=341 dstintf=lo7114 dstintfrole=amvo poluuid=qui sessionid=tasn proto=1 action=accept policyid=squirati policytype=Sedutp crscore=92.058000 craction=nbyCic crlevel=utlabor appcat=itessequ service=porro srccountry=ine dstcountry=lup trandisp=tatemUt tranip=10.58.214.16 tranport=508 duration=166.566000 sentbyte=2715 rcvdbyte=7130 sentpkt=pici app=abor", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 11323, + "network.bytes": 9845, + "observer.egress.interface.name": "lo7114", + "observer.ingress.interface.name": "lo4249", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.238.164.74", + "10.58.214.16", + "10.106.162.153" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "mquame", + "rsa.misc.context": "tatemUt", + "rsa.misc.event_source": "diconseq", + "rsa.misc.event_type": "tes", + "rsa.misc.hardware_id": "tquov", + "rsa.misc.log_session_id": "tasn", + "rsa.misc.obj_name": "abor", + "rsa.misc.policy_id": "squirati", + "rsa.misc.reference_id": "osquira", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "inven", + "rsa.network.dinterface": "lo7114", + "rsa.network.network_service": "porro", + "rsa.network.sinterface": "lo4249", + "rsa.time.duration_time": 166.566, + "rsa.time.event_time": "2016-06-20T06:35:42.000Z", + "rsa.time.event_time_str": "tnulapa", + "rsa.web.reputation_num": 92.058, + "service.type": "fortinet", + "source.bytes": 2715, + "source.geo.country_name": "ine", + "source.ip": [ + "10.238.164.74" + ], + "source.port": 2201, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-07-04T13:38:16.000Z", + "destination.bytes": 5300, + "destination.geo.country_name": "eumiu", + "destination.ip": [ + "10.217.150.196" + ], + "destination.nat.ip": "10.110.31.190", + "destination.nat.port": 945, + "destination.port": 4639, + "event.action": "cancel", + "event.code": "udexerci", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=tquiin dtime=2016-07-04 11:38:16.592538723 +0000 UTC devid=tse devname=tenimad vd=minimav date=2016-7-4 time=11:38:16 logid=udexerci type=naal subtype=lore level=high eventtime=idolore logtime=pid srcip=10.225.141.20 srcport=2282 srcintf=enp0s4046 srcintfrole=natuse dstip=10.217.150.196 dstport=4639 dstintf=lo2438 dstintfrole=archite poluuid=loreme sessionid=untu proto=6 action=cancel policyid=datatno policytype=siutali crscore=49.988000 craction=usmodte crlevel=msequi appcat=tau service=exercita srccountry=ris dstcountry=eumiu trandisp=orumSe tranip=10.110.31.190 tranport=945 duration=12.946000 sentbyte=248 rcvdbyte=5300 sentpkt=eeufugia app=evit", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 11976, + "network.bytes": 5548, + "observer.egress.interface.name": "lo2438", + "observer.ingress.interface.name": "enp0s4046", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.217.150.196", + "10.110.31.190", + "10.225.141.20" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "lore", + "rsa.misc.context": "orumSe", + "rsa.misc.event_source": "tenimad", + "rsa.misc.event_type": "naal", + "rsa.misc.hardware_id": "tse", + "rsa.misc.log_session_id": "untu", + "rsa.misc.obj_name": "evit", + "rsa.misc.policy_id": "datatno", + "rsa.misc.reference_id": "udexerci", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "minimav", + "rsa.network.dinterface": "lo2438", + "rsa.network.network_service": "exercita", + "rsa.network.sinterface": "enp0s4046", + "rsa.time.duration_time": 12.946, + "rsa.time.event_time": "2016-07-04T13:38:16.000Z", + "rsa.time.event_time_str": "idolore", + "rsa.web.reputation_num": 49.988, + "service.type": "fortinet", + "source.bytes": 248, + "source.geo.country_name": "ris", + "source.ip": [ + "10.225.141.20" + ], + "source.port": 2282, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-07-18T08:40:50.000Z", + "destination.bytes": 7741, + "destination.ip": [ + "10.69.103.176" + ], + "destination.port": 1229, + "event.action": "deny", + "event.code": "mexe", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-7-18 time=6:40:50 devname=molli device_id=velitse log_id=oditem type=generic subtype=gitsedqu pri=very-high devid=oremi devname=mestq logid=temUt type=olor subtype=ineavo level=very-high vd=mquelau srcip=10.168.236.85 srcport=6846 srcintf=eth651 dstip=10.140.113.244 dstport=4374 dstintf=lo4367 poluuid=fugitsed sessionid=quam proto=tcp action=deny policyid=fugiat trandisp=atisun duration=101.653000 sentbyte=3962 rcvdbyte=7741 devtype=dmin osname=fugi osversion=1.3319 mastersrcmac=inci srcmac=01:00:5e:e6:ad:ae crscore=39.291000 craction=avol crlevel=icero eventtype=xer user=emipsumd service=isisten hostname=cusant4946.www.domain profile=itecto reqtype=reetdol url=https://api.example.com/isnostr/umqu.htm?emquia=inesci#isnisi direction=unknown msg=aquioffi method=tamet cat=quatur catdesc=uisa device_id=eFi log_id=mexe pri=high userfrom=rpori adminprof=ice timezone=GMT+02:00 main_type=entorev trigger_policy=commodo sub_type=conseq severity_level=ame policy=tatn src=10.137.56.173 src_port=3932 dst=10.69.103.176 dst_port=1229 http_method=umdolo http_url=uptate http_host=amc http_agent=cusant http_session_id=orumSe signature_subclass=ratv signature_id=5227 srccountry=dutp content_switch_name=psaquaea server_pool_name=taevita false_positive_mitigation=ameiusm user_name=proide monitor_status=ano http_refer=https://www5.example.org/tvol/velitess.htm?edqui=nre#veli http_version=volupta dev_id=rnatu threat_weight=elitse history_threat_weight=ima threat_level=quasia ftp_mode=adi ftp_cmd=umwrit cipher_suite=uptate msg_id=mac", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "cusant4946.www.domain", + "http.request.referrer": "https://www5.example.org/tvol/velitess.htm?edqui=nre#veli", + "input.type": "log", + "log.level": "high", + "log.offset": 12639, + "network.bytes": 11703, + "network.direction": "unknown", + "observer.egress.interface.name": "lo4367", + "observer.ingress.interface.name": "eth651", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.3319", + "related.ip": [ + "10.137.56.173", + "10.69.103.176" + ], + "related.user": [ + "proide" + ], + "rsa.internal.event_desc": "aquioffi", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "xer", + "rsa.misc.OS": "fugi", + "rsa.misc.action": [ + "umdolo", + "deny" + ], + "rsa.misc.category": "conseq", + "rsa.misc.client": "cusant", + "rsa.misc.context": "atisun", + "rsa.misc.event_source": "mestq", + "rsa.misc.event_type": "olor", + "rsa.misc.fcatnum": "quatur", + "rsa.misc.filter": "uisa", + "rsa.misc.hardware_id": "eFi", + "rsa.misc.log_session_id": "orumSe", + "rsa.misc.policy_id": "fugiat", + "rsa.misc.policy_name": "tatn", + "rsa.misc.reference_id": "mexe", + "rsa.misc.rule_name": "itecto", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 5227, + "rsa.misc.version": "1.3319", + "rsa.misc.vsys": "mquelau", + "rsa.network.alias_host": [ + "cusant4946.www.domain" + ], + "rsa.network.dinterface": "lo4367", + "rsa.network.network_service": "isisten", + "rsa.network.sinterface": "eth651", + "rsa.threat.threat_desc": "quasia", + "rsa.time.duration_time": 101.653, + "rsa.time.event_time": "2016-07-18T08:40:50.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 39.291, + "rsa.web.web_ref_domain": "amc", + "rule.name": "itecto", + "service.type": "fortinet", + "source.bytes": 3962, + "source.geo.country_name": "dutp", + "source.ip": [ + "10.137.56.173" + ], + "source.mac": "01:00:5e:e6:ad:ae", + "source.port": 3932, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.com/isnostr/umqu.htm?emquia=inesci#isnisi", + "url.query": "uptate", + "user.name": "proide" + }, + { + "@timestamp": "2016-08-02T03:43:25.000Z", + "destination.bytes": 7122, + "destination.geo.country_name": "mvele", + "destination.ip": [ + "10.5.235.217" + ], + "destination.nat.ip": "10.25.212.118", + "destination.nat.port": 1190, + "destination.port": 3689, + "event.action": "deny", + "event.code": "onulam", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=dolore devname=\"onsecte\" devid=\"nBCSedut\" vd=ugiat date=2016-8-2 time=1:43:25 logid=onulam type=ate subtype=odoconse level=high eventtime=quatu logtime=veli srcip=10.30.47.165 srcport=631 srcintf=eth267 srcintfrole=sectet dstip=10.5.235.217 dstport=3689 dstintf=lo5047 dstintfrole=pitl poluuid=por sessionid=quidexea proto=tcp action=deny policyid=runtmol policytype=texpli crscore=57.772000 craction=ptass crlevel=rita appcat=esseci service=tametcon srccountry=liqua dstcountry=mvele trandisp=isis tranip=10.25.212.118 tranport=1190 duration=179.686000 sentbyte=238 rcvdbyte=7122 sentpkt=dantium app=lor", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 14185, + "network.bytes": 7360, + "observer.egress.interface.name": "lo5047", + "observer.ingress.interface.name": "eth267", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.30.47.165", + "10.5.235.217", + "10.25.212.118" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "odoconse", + "rsa.misc.context": "isis", + "rsa.misc.event_source": "onsecte", + "rsa.misc.event_type": "ate", + "rsa.misc.hardware_id": "nBCSedut", + "rsa.misc.log_session_id": "quidexea", + "rsa.misc.obj_name": "lor", + "rsa.misc.policy_id": "runtmol", + "rsa.misc.reference_id": "onulam", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ugiat", + "rsa.network.dinterface": "lo5047", + "rsa.network.network_service": "tametcon", + "rsa.network.sinterface": "eth267", + "rsa.time.duration_time": 179.686, + "rsa.time.event_time": "2016-08-02T03:43:25.000Z", + "rsa.time.event_time_str": "quatu", + "rsa.web.reputation_num": 57.772, + "service.type": "fortinet", + "source.bytes": 238, + "source.geo.country_name": "liqua", + "source.ip": [ + "10.30.47.165" + ], + "source.port": 631, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-16T10:45:59.000Z", + "destination.bytes": 6247, + "destination.ip": [ + "10.40.152.253" + ], + "destination.port": 1478, + "event.action": "deny", + "event.code": "ipsamvo", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-8-16 time=8:45:59 logver=onemulla devid=dolorem devname=tvolu logid=nreprehe type=tetu subtype=mdol level=high vd=nby srcip=10.20.26.210 srcport=2791 srcintf=eth5968 dstip=10.85.96.153 dstport=5286 dstintf=eth4392 poluuid=nsequat sessionid=doloreme proto=0 action=deny policyid=reprehe trandisp=tincu duration=93.111000 sentbyte=2826 rcvdbyte=6247 devtype=lor osname=oraincid osversion=1.225 mastersrcmac=emeumfug srcmac=01:00:5e:1d:39:39 crscore=114.626000 craction=liqua crlevel=olo eventtype=psumqu user=untincul service=iduntu hostname=ccaeca5504.internal.example profile=reseo reqtype=oreetd url=https://example.org/tiaec/rumwrit.txt?oconsequ=edquiac#urerepr direction=external msg=ercit method=etMal cat=qua catdesc=rsita device_id=ate log_id=ipsamvo pri=low userfrom=adeseru adminprof=tdol timezone=CET main_type=rem trigger_policy=asper sub_type=idunt severity_level=luptat policy=eveli src=10.149.13.76 src_port=7809 dst=10.40.152.253 dst_port=1478 http_method=ritt http_url=iaeco http_host=equaturv http_agent=siu http_session_id=snost signature_subclass=tpersp signature_id=2624 srccountry=quaea content_switch_name=ametcons server_pool_name=utali false_positive_mitigation=porinc user_name=tetur monitor_status=xce http_refer=https://example.com/aincidu/nimadmin.jpg?itinv=eumfugi#etdolor http_version=lupta dev_id=xeaco threat_weight=nvolupt history_threat_weight=oremi threat_level=elites ftp_mode=nbyCi ftp_cmd=tevel cipher_suite=usc msg_id=rem", + "event.timezone": "CET", + "fileset.name": "fortimanager", + "host.name": "ccaeca5504.internal.example", + "http.request.referrer": "https://example.com/aincidu/nimadmin.jpg?itinv=eumfugi#etdolor", + "input.type": "log", + "log.level": "low", + "log.offset": 14797, + "network.bytes": 9073, + "network.direction": "external", + "observer.egress.interface.name": "eth4392", + "observer.ingress.interface.name": "eth5968", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.225", + "related.ip": [ + "10.40.152.253", + "10.149.13.76" + ], + "related.user": [ + "tetur" + ], + "rsa.internal.event_desc": "ercit", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "psumqu", + "rsa.misc.OS": "oraincid", + "rsa.misc.action": [ + "ritt", + "deny" + ], + "rsa.misc.category": "idunt", + "rsa.misc.client": "siu", + "rsa.misc.context": "tincu", + "rsa.misc.event_source": "tvolu", + "rsa.misc.event_type": "tetu", + "rsa.misc.fcatnum": "qua", + "rsa.misc.filter": "rsita", + "rsa.misc.hardware_id": "ate", + "rsa.misc.log_session_id": "snost", + "rsa.misc.policy_id": "reprehe", + "rsa.misc.policy_name": "eveli", + "rsa.misc.reference_id": "ipsamvo", + "rsa.misc.rule_name": "reseo", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 2624, + "rsa.misc.version": "1.225", + "rsa.misc.vsys": "nby", + "rsa.network.alias_host": [ + "ccaeca5504.internal.example" + ], + "rsa.network.dinterface": "eth4392", + "rsa.network.network_service": "iduntu", + "rsa.network.sinterface": "eth5968", + "rsa.threat.threat_desc": "elites", + "rsa.time.duration_time": 93.111, + "rsa.time.event_time": "2016-08-16T10:45:59.000Z", + "rsa.time.timezone": "CET", + "rsa.web.reputation_num": 114.626, + "rsa.web.web_ref_domain": "equaturv", + "rule.name": "reseo", + "service.type": "fortinet", + "source.bytes": 2826, + "source.geo.country_name": "quaea", + "source.ip": [ + "10.149.13.76" + ], + "source.mac": "01:00:5e:1d:39:39", + "source.port": 7809, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.org/tiaec/rumwrit.txt?oconsequ=edquiac#urerepr", + "url.query": "iaeco", + "user.name": "tetur" + }, + { + "@timestamp": "2016-08-30T05:48:33.000Z", + "destination.bytes": 4844, + "destination.geo.country_name": "eufugi", + "destination.ip": [ + "10.51.213.42" + ], + "destination.nat.ip": "10.233.120.207", + "destination.nat.port": 136, + "destination.port": 988, + "event.action": "deny", + "event.code": "isetq", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=cab dtime=2016-08-30 15:48:33.632538723 +0000 UTC devid=atisund devname=xea vd=ites date=2016-8-30 time=3:48:33 logid=isetq type=iutali subtype=velite level=high eventtime=avolupt logtime=ariatur srcip=10.98.194.212 srcport=5469 srcintf=lo1208 srcintfrole=atisetqu dstip=10.51.213.42 dstport=988 dstintf=enp0s3449 dstintfrole=ilmol poluuid=eri sessionid=quunt proto=HOPOPT action=deny policyid=mquae policytype=eriti crscore=96.729000 craction=cidunt crlevel=plica appcat=ore service=quidolor srccountry=inven dstcountry=eufugi trandisp=accusant tranip=10.233.120.207 tranport=136 duration=171.844000 sentbyte=2859 rcvdbyte=4844 sentpkt=eaqu app=nvol", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 16267, + "network.bytes": 7703, + "observer.egress.interface.name": "enp0s3449", + "observer.ingress.interface.name": "lo1208", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.98.194.212", + "10.51.213.42", + "10.233.120.207" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "velite", + "rsa.misc.context": "accusant", + "rsa.misc.event_source": "xea", + "rsa.misc.event_type": "iutali", + "rsa.misc.hardware_id": "atisund", + "rsa.misc.log_session_id": "quunt", + "rsa.misc.obj_name": "nvol", + "rsa.misc.policy_id": "mquae", + "rsa.misc.reference_id": "isetq", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ites", + "rsa.network.dinterface": "enp0s3449", + "rsa.network.network_service": "quidolor", + "rsa.network.sinterface": "lo1208", + "rsa.time.duration_time": 171.844, + "rsa.time.event_time": "2016-08-30T05:48:33.000Z", + "rsa.time.event_time_str": "avolupt", + "rsa.web.reputation_num": 96.729, + "service.type": "fortinet", + "source.bytes": 2859, + "source.geo.country_name": "inven", + "source.ip": [ + "10.98.194.212" + ], + "source.port": 5469, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-13T12:51:07.000Z", + "destination.bytes": 7301, + "destination.geo.country_name": "tenatuse", + "destination.ip": [ + "10.67.132.242" + ], + "destination.nat.ip": "10.241.132.176", + "destination.nat.port": 7224, + "destination.port": 2340, + "event.action": "allow", + "event.code": "dat", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=leumiu devname=\"tla\" devid=\"item\" vd=nimid date=2016-9-13 time=10:51:07 logid=dat type=periam subtype=dqu level=high eventtime=dminima logtime=dutpers srcip=10.245.187.229 srcport=4953 srcintf=lo3642 srcintfrole=prehen dstip=10.67.132.242 dstport=2340 dstintf=enp0s2700 dstintfrole=sequa poluuid=iosamnis sessionid=volupt proto=6 action=allow policyid=idid policytype=tesse crscore=64.509000 craction=boru crlevel=ptateve appcat=enderi service=ptatem srccountry=ptatevel dstcountry=tenatuse trandisp=psaqua tranip=10.241.132.176 tranport=7224 duration=167.705000 sentbyte=6595 rcvdbyte=7301 sentpkt=tame app=atione", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 16925, + "network.bytes": 13896, + "observer.egress.interface.name": "enp0s2700", + "observer.ingress.interface.name": "lo3642", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.67.132.242", + "10.241.132.176", + "10.245.187.229" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "dqu", + "rsa.misc.context": "psaqua", + "rsa.misc.event_source": "tla", + "rsa.misc.event_type": "periam", + "rsa.misc.hardware_id": "item", + "rsa.misc.log_session_id": "volupt", + "rsa.misc.obj_name": "atione", + "rsa.misc.policy_id": "idid", + "rsa.misc.reference_id": "dat", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "nimid", + "rsa.network.dinterface": "enp0s2700", + "rsa.network.network_service": "ptatem", + "rsa.network.sinterface": "lo3642", + "rsa.time.duration_time": 167.705, + "rsa.time.event_time": "2016-09-13T12:51:07.000Z", + "rsa.time.event_time_str": "dminima", + "rsa.web.reputation_num": 64.509, + "service.type": "fortinet", + "source.bytes": 6595, + "source.geo.country_name": "ptatevel", + "source.ip": [ + "10.245.187.229" + ], + "source.port": 4953, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-28T07:53:42.000Z", + "destination.bytes": 1775, + "destination.ip": [ + "10.199.47.220" + ], + "destination.port": 4084, + "event.action": "allow", + "event.code": "urmagn", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-9-28 time=5:53:42 logver=vitaedic devid=orin devname=uii logid=estl type=sitam subtype=orem level=very-high vd=uuntur srcip=10.210.28.247 srcport=3449 srcintf=eth4185 dstip=10.237.180.17 dstport=3023 dstintf=lo7672 poluuid=tate sessionid=onevo proto=6 action=allow policyid=aeconseq trandisp=lor duration=96.560000 sentbyte=2760 rcvdbyte=1775 devtype=emqu osname=riss osversion=1.1847 mastersrcmac=sitvol srcmac=01:00:5e:a5:5a:54 crscore=129.120000 craction=olorsi crlevel=aliq eventtype=mes user=mven service=olorsit hostname=tore7088.www.invalid profile=ruredo reqtype=mac url=https://mail.example.org/ptassita/its.gif?risnis=uov#itlab direction=outbound msg=sBono method=loremqu cat=tetur catdesc=amvo device_id=siuta log_id=urmagn pri=low userfrom=uptat adminprof=idex timezone=GMT+02:00 main_type=tatione trigger_policy=nimveni sub_type=idi severity_level=ore policy=quid src=10.212.214.4 src_port=6040 dst=10.199.47.220 dst_port=4084 http_method=oin http_url=hil http_host=cingel http_agent=modocon http_session_id=ipsu signature_subclass=ntNeq signature_id=1081 srccountry=aUt content_switch_name=boNem server_pool_name=nturm false_positive_mitigation=emips user_name=atv monitor_status=onu http_refer=https://www5.example.net/alorum/obeataev.gif?atDu=nsec#quidolor http_version=oqu dev_id=naaliq threat_weight=remeu history_threat_weight=osquir threat_level=mod ftp_mode=col ftp_cmd=mve cipher_suite=liquide msg_id=odt", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "tore7088.www.invalid", + "http.request.referrer": "https://www5.example.net/alorum/obeataev.gif?atDu=nsec#quidolor", + "input.type": "log", + "log.level": "low", + "log.offset": 17547, + "network.bytes": 4535, + "network.direction": "outbound", + "observer.egress.interface.name": "lo7672", + "observer.ingress.interface.name": "eth4185", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1847", + "related.ip": [ + "10.199.47.220", + "10.212.214.4" + ], + "related.user": [ + "atv" + ], + "rsa.internal.event_desc": "sBono", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "mes", + "rsa.misc.OS": "riss", + "rsa.misc.action": [ + "allow", + "oin" + ], + "rsa.misc.category": "idi", + "rsa.misc.client": "modocon", + "rsa.misc.context": "lor", + "rsa.misc.event_source": "uii", + "rsa.misc.event_type": "sitam", + "rsa.misc.fcatnum": "tetur", + "rsa.misc.filter": "amvo", + "rsa.misc.hardware_id": "siuta", + "rsa.misc.log_session_id": "ipsu", + "rsa.misc.policy_id": "aeconseq", + "rsa.misc.policy_name": "quid", + "rsa.misc.reference_id": "urmagn", + "rsa.misc.rule_name": "ruredo", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 1081, + "rsa.misc.version": "1.1847", + "rsa.misc.vsys": "uuntur", + "rsa.network.alias_host": [ + "tore7088.www.invalid" + ], + "rsa.network.dinterface": "lo7672", + "rsa.network.network_service": "olorsit", + "rsa.network.sinterface": "eth4185", + "rsa.threat.threat_desc": "mod", + "rsa.time.duration_time": 96.56, + "rsa.time.event_time": "2016-09-28T07:53:42.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 129.12, + "rsa.web.web_ref_domain": "cingel", + "rule.name": "ruredo", + "service.type": "fortinet", + "source.bytes": 2760, + "source.geo.country_name": "aUt", + "source.ip": [ + "10.212.214.4" + ], + "source.mac": "01:00:5e:a5:5a:54", + "source.port": 6040, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/ptassita/its.gif?risnis=uov#itlab", + "url.query": "hil", + "user.name": "atv" + }, + { + "@timestamp": "2016-10-12T14:56:16.000Z", + "destination.bytes": 4059, + "destination.ip": [ + "10.234.165.130" + ], + "destination.port": 7079, + "event.action": "deny", + "event.code": "henderit", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-10-12 time=12:56:16 logver=inv devid=rroq devname=rcit logid=aecatcup type=olabor subtype=estl level=very-high vd=citatio srcip=10.168.40.197 srcport=7699 srcintf=enp0s3071 dstip=10.206.69.135 dstport=6396 dstintf=eth3862 poluuid=utfug sessionid=aturQu proto=udp action=deny policyid=mipsamvo trandisp=eiusmod duration=91.147000 sentbyte=6153 rcvdbyte=4059 devtype=oreveri osname=ehende osversion=1.760 mastersrcmac=Except srcmac=01:00:5e:bf:07:ee crscore=45.760000 craction=dol crlevel=sciun eventtype=metcons user=itasper service=uae hostname=mve1890.internal.home profile=tatemU reqtype=mad url=https://www.example.org/redol/gnaa.htm?aliquamq=dtempori#toditaut direction=unknown msg=dexerc method=strumex cat=eprehend catdesc=asnu device_id=hitec log_id=henderit pri=medium userfrom=perspici adminprof=ationul timezone=PST main_type=itsedq trigger_policy=uto sub_type=emUte severity_level=molestia policy=quir src=10.46.56.204 src_port=2463 dst=10.234.165.130 dst_port=7079 http_method=umf http_url=quames http_host=dolorsit http_agent=archite http_session_id=remq signature_subclass=veniamq signature_id=1236 srccountry=uta content_switch_name=emo server_pool_name=itq false_positive_mitigation=derit user_name=orese monitor_status=dolor http_refer=https://mail.example.com/ntexpl/dunt.jpg?yCic=nder#mdolore http_version=Cic dev_id=olorema threat_weight=mollita history_threat_weight=tatem threat_level=iae ftp_mode=quido ftp_cmd=emip cipher_suite=inBC msg_id=mol", + "event.timezone": "PST", + "fileset.name": "fortimanager", + "host.name": "mve1890.internal.home", + "http.request.referrer": "https://mail.example.com/ntexpl/dunt.jpg?yCic=nder#mdolore", + "input.type": "log", + "log.level": "medium", + "log.offset": 18984, + "network.bytes": 10212, + "network.direction": "unknown", + "observer.egress.interface.name": "eth3862", + "observer.ingress.interface.name": "enp0s3071", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.760", + "related.ip": [ + "10.234.165.130", + "10.46.56.204" + ], + "related.user": [ + "orese" + ], + "rsa.internal.event_desc": "dexerc", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "metcons", + "rsa.misc.OS": "ehende", + "rsa.misc.action": [ + "deny", + "umf" + ], + "rsa.misc.category": "emUte", + "rsa.misc.client": "archite", + "rsa.misc.context": "eiusmod", + "rsa.misc.event_source": "rcit", + "rsa.misc.event_type": "olabor", + "rsa.misc.fcatnum": "eprehend", + "rsa.misc.filter": "asnu", + "rsa.misc.hardware_id": "hitec", + "rsa.misc.log_session_id": "remq", + "rsa.misc.policy_id": "mipsamvo", + "rsa.misc.policy_name": "quir", + "rsa.misc.reference_id": "henderit", + "rsa.misc.rule_name": "tatemU", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 1236, + "rsa.misc.version": "1.760", + "rsa.misc.vsys": "citatio", + "rsa.network.alias_host": [ + "mve1890.internal.home" + ], + "rsa.network.dinterface": "eth3862", + "rsa.network.network_service": "uae", + "rsa.network.sinterface": "enp0s3071", + "rsa.threat.threat_desc": "iae", + "rsa.time.duration_time": 91.147, + "rsa.time.event_time": "2016-10-12T14:56:16.000Z", + "rsa.time.timezone": "PST", + "rsa.web.reputation_num": 45.76, + "rsa.web.web_ref_domain": "dolorsit", + "rule.name": "tatemU", + "service.type": "fortinet", + "source.bytes": 6153, + "source.geo.country_name": "uta", + "source.ip": [ + "10.46.56.204" + ], + "source.mac": "01:00:5e:bf:07:ee", + "source.port": 2463, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.org/redol/gnaa.htm?aliquamq=dtempori#toditaut", + "url.query": "quames", + "user.name": "orese" + }, + { + "@timestamp": "2016-10-26T09:58:50.000Z", + "destination.bytes": 4527, + "destination.ip": [ + "10.95.117.134" + ], + "destination.port": 1723, + "event.action": "block", + "event.code": "rsi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=turadipi date=2016-10-26 time=7:58:50 log_id=usmodi devid=ree devname=saquaea logid=ation type=luptas subtype=minim level=very-high vd=lorsi srcip=10.61.123.159 srcport=754 srcintf=eth7713 dstip=10.141.158.225 dstport=4690 dstintf=lo1586 poluuid=ate sessionid=idolor proto=1 action=block policyid=nreprehe trandisp=onse duration=71.505000 sentbyte=4010 rcvdbyte=4527 devtype=duntutla osname=ntium osversion=1.4450 mastersrcmac=asuntexp srcmac=01:00:5e:26:56:73 crscore=5.843000 craction=nse crlevel=modoc eventtype=boNem user=iumt service=tsed hostname=eturad6143.www.home profile=uamnihil reqtype=llam url=https://example.net/aparia/tatnon.jpg?rever=ore#offici direction=outbound msg=metco method=acom cat=ceroinB catdesc=nim device_id=utaliqu log_id=rsi pri=high userfrom=imadmi adminprof=isnis timezone=CEST main_type=olupta trigger_policy=tsuntinc sub_type=inrepreh severity_level=quovo policy=urExcep src=10.128.46.70 src_port=5269 dst=10.95.117.134 dst_port=1723 http_method=acommodi http_url=essecill http_host=billoi http_agent=moles http_session_id=dipiscin signature_subclass=olup signature_id=5976 srccountry=undeomni content_switch_name=accusa server_pool_name=natu false_positive_mitigation=liquid user_name=enim monitor_status=Finibus http_refer=https://www.example.org/xeacom/des.gif?umdolo=ntiu#radipisc http_version=Cice dev_id=taedi threat_weight=tquido history_threat_weight=ptasnula threat_level=oru ftp_mode=ill ftp_cmd=mporinc cipher_suite=onsectet msg_id=idolo", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "eturad6143.www.home", + "http.request.referrer": "https://www.example.org/xeacom/des.gif?umdolo=ntiu#radipisc", + "input.type": "log", + "log.level": "high", + "log.offset": 20462, + "network.bytes": 8537, + "network.direction": "outbound", + "observer.egress.interface.name": "lo1586", + "observer.ingress.interface.name": "eth7713", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4450", + "related.ip": [ + "10.95.117.134", + "10.128.46.70" + ], + "related.user": [ + "enim" + ], + "rsa.internal.event_desc": "metco", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "boNem", + "rsa.misc.OS": "ntium", + "rsa.misc.action": [ + "acommodi", + "block" + ], + "rsa.misc.category": "inrepreh", + "rsa.misc.client": "moles", + "rsa.misc.context": "onse", + "rsa.misc.event_source": "saquaea", + "rsa.misc.event_type": "luptas", + "rsa.misc.fcatnum": "ceroinB", + "rsa.misc.filter": "nim", + "rsa.misc.hardware_id": "utaliqu", + "rsa.misc.log_session_id": "dipiscin", + "rsa.misc.policy_id": "nreprehe", + "rsa.misc.policy_name": "urExcep", + "rsa.misc.reference_id": "rsi", + "rsa.misc.rule_name": "uamnihil", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 5976, + "rsa.misc.version": "1.4450", + "rsa.misc.vsys": "lorsi", + "rsa.network.alias_host": [ + "eturad6143.www.home" + ], + "rsa.network.dinterface": "lo1586", + "rsa.network.network_service": "tsed", + "rsa.network.sinterface": "eth7713", + "rsa.threat.threat_desc": "oru", + "rsa.time.duration_time": 71.505, + "rsa.time.event_time": "2016-10-26T09:58:50.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 5.843, + "rsa.web.web_ref_domain": "billoi", + "rule.name": "uamnihil", + "service.type": "fortinet", + "source.bytes": 4010, + "source.geo.country_name": "undeomni", + "source.ip": [ + "10.128.46.70" + ], + "source.mac": "01:00:5e:26:56:73", + "source.port": 5269, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.net/aparia/tatnon.jpg?rever=ore#offici", + "url.query": "essecill", + "user.name": "enim" + }, + { + "@timestamp": "2016-11-10T05:01:24.000Z", + "destination.bytes": 1506, + "destination.ip": [ + "10.253.228.140" + ], + "destination.port": 6748, + "event.action": "cancel", + "event.code": "admi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2016-11-10 time=3:01:24 logver=edolo devid=ugiatquo devname=ntium logid=uptate type=lloinven subtype=econs level=medium vd=tetura srcip=10.135.106.42 srcport=6602 srcintf=lo154 dstip=10.224.30.160 dstport=5302 dstintf=eth1247 poluuid=etconsec sessionid=caboNem proto=21 action=cancel policyid=rumetMal trandisp=oconse duration=2.970000 sentbyte=7685 rcvdbyte=1506 devtype=sequam osname=oditempo osversion=1.7544 mastersrcmac=taliqui srcmac=01:00:5e:98:79:a3 crscore=78.248000 craction=rcitat crlevel=dolorema eventtype=emagn user=radipis service=ctetu hostname=orinrep5386.www.corp profile=stenatus reqtype=equep url=https://www.example.com/tali/BCS.txt?iqu=niamqu#equamnih direction=inbound msg=autemv method=emq cat=plicaboN catdesc=amc device_id=vol log_id=admi pri=medium userfrom=culpaq adminprof=saute timezone=GMT+02:00 main_type=ende trigger_policy=abor sub_type=magnid severity_level=adol policy=iutal src=10.208.21.135 src_port=2721 dst=10.253.228.140 dst_port=6748 http_method=ugitse http_url=quiineav http_host=billoinv http_agent=sci http_session_id=col signature_subclass=obea signature_id=5700 srccountry=tatev content_switch_name=luptas server_pool_name=uptatem false_positive_mitigation=oinv user_name=inculp monitor_status=onofd http_refer=https://internal.example.org/nisiu/imad.html?ptatem=itasp#dexe http_version=tat dev_id=onproide threat_weight=ntmo history_threat_weight=loreeu threat_level=temse ftp_mode=aspernat ftp_cmd=ume cipher_suite=caecat msg_id=rautod", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "orinrep5386.www.corp", + "http.request.referrer": "https://internal.example.org/nisiu/imad.html?ptatem=itasp#dexe", + "input.type": "log", + "log.level": "medium", + "log.offset": 21953, + "network.bytes": 9191, + "network.direction": "inbound", + "observer.egress.interface.name": "eth1247", + "observer.ingress.interface.name": "lo154", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.7544", + "related.ip": [ + "10.208.21.135", + "10.253.228.140" + ], + "related.user": [ + "inculp" + ], + "rsa.internal.event_desc": "autemv", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "emagn", + "rsa.misc.OS": "oditempo", + "rsa.misc.action": [ + "cancel", + "ugitse" + ], + "rsa.misc.category": "magnid", + "rsa.misc.client": "sci", + "rsa.misc.context": "oconse", + "rsa.misc.event_source": "ntium", + "rsa.misc.event_type": "lloinven", + "rsa.misc.fcatnum": "plicaboN", + "rsa.misc.filter": "amc", + "rsa.misc.hardware_id": "vol", + "rsa.misc.log_session_id": "col", + "rsa.misc.policy_id": "rumetMal", + "rsa.misc.policy_name": "iutal", + "rsa.misc.reference_id": "admi", + "rsa.misc.rule_name": "stenatus", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 5700, + "rsa.misc.version": "1.7544", + "rsa.misc.vsys": "tetura", + "rsa.network.alias_host": [ + "orinrep5386.www.corp" + ], + "rsa.network.dinterface": "eth1247", + "rsa.network.network_service": "ctetu", + "rsa.network.sinterface": "lo154", + "rsa.threat.threat_desc": "temse", + "rsa.time.duration_time": 2.97, + "rsa.time.event_time": "2016-11-10T05:01:24.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 78.248, + "rsa.web.web_ref_domain": "billoinv", + "rule.name": "stenatus", + "service.type": "fortinet", + "source.bytes": 7685, + "source.geo.country_name": "tatev", + "source.ip": [ + "10.208.21.135" + ], + "source.mac": "01:00:5e:98:79:a3", + "source.port": 2721, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.com/tali/BCS.txt?iqu=niamqu#equamnih", + "url.query": "quiineav", + "user.name": "inculp" + }, + { + "@timestamp": "2016-11-24T12:03:59.000Z", + "destination.bytes": 4009, + "destination.ip": [ + "10.3.23.172" + ], + "destination.port": 7332, + "event.action": "cancel", + "event.code": "illoi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ercitat date=2016-11-24 time=10:03:59 log_id=lapar devid=ritati devname=edquia logid=itesse type=mullam subtype=mexerc level=medium vd=amvolu srcip=10.120.231.161 srcport=1129 srcintf=lo653 dstip=10.210.62.203 dstport=4381 dstintf=lo3057 poluuid=ataevita sessionid=oremqu proto=6 action=cancel policyid=velitsed trandisp=magnaali duration=92.900000 sentbyte=3984 rcvdbyte=4009 devtype=ulla osname=equatDu osversion=1.1710 mastersrcmac=aconse srcmac=01:00:5e:92:c2:23 crscore=20.350000 craction=squira crlevel=aliqui eventtype=ess user=uide service=scivel hostname=henderi724.www5.home profile=tquas reqtype=aquio url=https://www.example.com/iame/orroquis.htm?tiumd=ntmoll#mexer direction=internal msg=isnostru method=nofdeFi cat=aquioff catdesc=saqu device_id=remips log_id=illoi pri=medium userfrom=abori adminprof=uisnostr timezone=GMT+02:00 main_type=ilmole trigger_policy=ugi sub_type=niamquis severity_level=nisi policy=emveleum src=10.243.226.122 src_port=3512 dst=10.3.23.172 dst_port=7332 http_method=emullamc http_url=tec http_host=Nemo http_agent=tutlabo http_session_id=mveleum signature_subclass=liq signature_id=7229 srccountry=sBonorum content_switch_name=atems server_pool_name=quira false_positive_mitigation=tassita user_name=olorem monitor_status=sedquiac http_refer=https://www.example.com/atDuis/asnulapa.html?rumwri=velill#ore http_version=tation dev_id=loinve threat_weight=tatevel history_threat_weight=iumdolo threat_level=untu ftp_mode=ict ftp_cmd=squirati cipher_suite=tem msg_id=mestq", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "henderi724.www5.home", + "http.request.referrer": "https://www.example.com/atDuis/asnulapa.html?rumwri=velill#ore", + "input.type": "log", + "log.level": "medium", + "log.offset": 23443, + "network.bytes": 7993, + "network.direction": "internal", + "observer.egress.interface.name": "lo3057", + "observer.ingress.interface.name": "lo653", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1710", + "related.ip": [ + "10.243.226.122", + "10.3.23.172" + ], + "related.user": [ + "olorem" + ], + "rsa.internal.event_desc": "isnostru", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "ess", + "rsa.misc.OS": "equatDu", + "rsa.misc.action": [ + "emullamc", + "cancel" + ], + "rsa.misc.category": "niamquis", + "rsa.misc.client": "tutlabo", + "rsa.misc.context": "magnaali", + "rsa.misc.event_source": "edquia", + "rsa.misc.event_type": "mullam", + "rsa.misc.fcatnum": "aquioff", + "rsa.misc.filter": "saqu", + "rsa.misc.hardware_id": "remips", + "rsa.misc.log_session_id": "mveleum", + "rsa.misc.policy_id": "velitsed", + "rsa.misc.policy_name": "emveleum", + "rsa.misc.reference_id": "illoi", + "rsa.misc.rule_name": "tquas", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 7229, + "rsa.misc.version": "1.1710", + "rsa.misc.vsys": "amvolu", + "rsa.network.alias_host": [ + "henderi724.www5.home" + ], + "rsa.network.dinterface": "lo3057", + "rsa.network.network_service": "scivel", + "rsa.network.sinterface": "lo653", + "rsa.threat.threat_desc": "untu", + "rsa.time.duration_time": 92.9, + "rsa.time.event_time": "2016-11-24T12:03:59.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 20.35, + "rsa.web.web_ref_domain": "Nemo", + "rule.name": "tquas", + "service.type": "fortinet", + "source.bytes": 3984, + "source.geo.country_name": "sBonorum", + "source.ip": [ + "10.243.226.122" + ], + "source.mac": "01:00:5e:92:c2:23", + "source.port": 3512, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.com/iame/orroquis.htm?tiumd=ntmoll#mexer", + "url.query": "tec", + "user.name": "olorem" + }, + { + "@timestamp": "2016-12-08T07:06:33.000Z", + "destination.bytes": 1651, + "destination.ip": [ + "10.106.85.174" + ], + "destination.port": 307, + "event.action": "cancel", + "event.code": "odoco", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=luptate date=2016-12-8 time=5:06:33 log_id=llamc devid=eleumiu devname=uei logid=Nequepo type=radipis subtype=cive level=low vd=orumSec srcip=10.56.74.7 srcport=6149 srcintf=eth2940 dstip=10.73.10.215 dstport=2079 dstintf=lo3472 poluuid=oeni sessionid=untutlab proto=0 action=cancel policyid=consecte trandisp=pteurs duration=26.872000 sentbyte=617 rcvdbyte=1651 devtype=ons osname=tiaecon osversion=1.5380 mastersrcmac=unt srcmac=01:00:5e:99:7b:4a crscore=124.392000 craction=queporro crlevel=uid eventtype=snostrum user=psa service=nculpaq hostname=reseosqu1629.mail.lan profile=utemvel reqtype=epteur url=https://www.example.net/iame/laudanti.htm?stquido=rsitvolu#mnisi direction=external msg=uameiusm method=adm cat=gelitsed catdesc=tiumto device_id=cor log_id=odoco pri=high userfrom=labore adminprof=ianonnu timezone=PST main_type=rum trigger_policy=erc sub_type=ehende severity_level=tutla policy=licaboNe src=10.94.242.80 src_port=2724 dst=10.106.85.174 dst_port=307 http_method=atiset http_url=serror http_host=onse http_agent=umquam http_session_id=emagn signature_subclass=emulla signature_id=1963 srccountry=iquaUt content_switch_name=mnihilm server_pool_name=redo false_positive_mitigation=etMaloru user_name=lmo monitor_status=iquidex http_refer=https://www.example.org/remipsu/tan.html?mcorpor=doconse#etdol http_version=dolorsi dev_id=nturmag threat_weight=tura history_threat_weight=osquirat threat_level=equat ftp_mode=aliquid ftp_cmd=usantiu cipher_suite=idunt msg_id=atqu", + "event.timezone": "PST", + "fileset.name": "fortimanager", + "host.name": "reseosqu1629.mail.lan", + "http.request.referrer": "https://www.example.org/remipsu/tan.html?mcorpor=doconse#etdol", + "input.type": "log", + "log.level": "high", + "log.offset": 24962, + "network.bytes": 2268, + "network.direction": "external", + "observer.egress.interface.name": "lo3472", + "observer.ingress.interface.name": "eth2940", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.5380", + "related.ip": [ + "10.94.242.80", + "10.106.85.174" + ], + "related.user": [ + "lmo" + ], + "rsa.internal.event_desc": "uameiusm", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "snostrum", + "rsa.misc.OS": "tiaecon", + "rsa.misc.action": [ + "cancel", + "atiset" + ], + "rsa.misc.category": "ehende", + "rsa.misc.client": "umquam", + "rsa.misc.context": "pteurs", + "rsa.misc.event_source": "uei", + "rsa.misc.event_type": "radipis", + "rsa.misc.fcatnum": "gelitsed", + "rsa.misc.filter": "tiumto", + "rsa.misc.hardware_id": "cor", + "rsa.misc.log_session_id": "emagn", + "rsa.misc.policy_id": "consecte", + "rsa.misc.policy_name": "licaboNe", + "rsa.misc.reference_id": "odoco", + "rsa.misc.rule_name": "utemvel", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 1963, + "rsa.misc.version": "1.5380", + "rsa.misc.vsys": "orumSec", + "rsa.network.alias_host": [ + "reseosqu1629.mail.lan" + ], + "rsa.network.dinterface": "lo3472", + "rsa.network.network_service": "nculpaq", + "rsa.network.sinterface": "eth2940", + "rsa.threat.threat_desc": "equat", + "rsa.time.duration_time": 26.872, + "rsa.time.event_time": "2016-12-08T07:06:33.000Z", + "rsa.time.timezone": "PST", + "rsa.web.reputation_num": 124.392, + "rsa.web.web_ref_domain": "onse", + "rule.name": "utemvel", + "service.type": "fortinet", + "source.bytes": 617, + "source.geo.country_name": "iquaUt", + "source.ip": [ + "10.94.242.80" + ], + "source.mac": "01:00:5e:99:7b:4a", + "source.port": 2724, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.net/iame/laudanti.htm?stquido=rsitvolu#mnisi", + "url.query": "serror", + "user.name": "lmo" + }, + { + "@timestamp": "2016-12-23T14:09:07.000Z", + "destination.bytes": 5749, + "destination.geo.country_name": "usm", + "destination.ip": [ + "10.247.53.179" + ], + "destination.nat.ip": "10.168.20.20", + "destination.nat.port": 68, + "destination.port": 6493, + "event.action": "block", + "event.code": "rspici", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=liquam dtime=2016-12-23 00:09:07.712538723 +0000 UTC devid=min devname=oluptat vd=odt date=2016-12-23 time=12:09:07 logid=rspici type=snisi subtype=magnaal level=low eventtime=etquasia logtime=nula srcip=10.117.63.181 srcport=5299 srcintf=lo7416 srcintfrole=Cicero dstip=10.247.53.179 dstport=6493 dstintf=lo3706 dstintfrole=atemaccu poluuid=veritat sessionid=aliquipe proto=3 action=block policyid=aer policytype=osquira crscore=171.144000 craction=minim crlevel=scipi appcat=tur service=acon srccountry=Nemoenim dstcountry=usm trandisp=labori tranip=10.168.20.20 tranport=68 duration=167.038000 sentbyte=7188 rcvdbyte=5749 sentpkt=xeac app=umdolors", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 26461, + "network.bytes": 12937, + "network.protocol": "GGP", + "observer.egress.interface.name": "lo3706", + "observer.ingress.interface.name": "lo7416", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.168.20.20", + "10.117.63.181", + "10.247.53.179" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "magnaal", + "rsa.misc.context": "labori", + "rsa.misc.event_source": "oluptat", + "rsa.misc.event_type": "snisi", + "rsa.misc.hardware_id": "min", + "rsa.misc.log_session_id": "aliquipe", + "rsa.misc.obj_name": "umdolors", + "rsa.misc.policy_id": "aer", + "rsa.misc.reference_id": "rspici", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "odt", + "rsa.network.dinterface": "lo3706", + "rsa.network.network_service": "acon", + "rsa.network.sinterface": "lo7416", + "rsa.time.duration_time": 167.038, + "rsa.time.event_time": "2016-12-23T14:09:07.000Z", + "rsa.time.event_time_str": "etquasia", + "rsa.web.reputation_num": 171.144, + "service.type": "fortinet", + "source.bytes": 7188, + "source.geo.country_name": "Nemoenim", + "source.ip": [ + "10.117.63.181" + ], + "source.port": 5299, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-01-06T09:11:41.000Z", + "destination.bytes": 405, + "destination.ip": [ + "10.53.168.187" + ], + "destination.port": 73, + "event.action": "block", + "event.code": "rsin", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=uiadolo date=2017-1-6 time=7:11:41 log_id=empor devid=umexerci devname=duntut logid=uovol type=prehend subtype=eufug level=low vd=eufug srcip=10.100.53.8 srcport=4318 srcintf=eth5767 dstip=10.163.17.172 dstport=854 dstintf=enp0s3903 poluuid=upta sessionid=atc proto=3 action=block policyid=upta trandisp=itessequ duration=165.935000 sentbyte=4211 rcvdbyte=405 devtype=exerci osname=idata osversion=1.2208 mastersrcmac=usmod srcmac=01:00:5e:c0:47:f3 crscore=135.374000 craction=isiutali crlevel=iquidexe eventtype=illumq user=luptatem service=ite hostname=tasnul4179.internal.host profile=amvo reqtype=tnul url=https://www.example.org/ess/quiad.jpg?ten=litanim#rQuisaut direction=inbound msg=modico method=metco cat=cillu catdesc=iuntNeq device_id=eddoei log_id=rsin pri=very-high userfrom=eriam adminprof=pernat timezone=CEST main_type=imve trigger_policy=essequam sub_type=ueporro severity_level=aliqu policy=upt src=10.141.156.217 src_port=2700 dst=10.53.168.187 dst_port=73 http_method=emacc http_url=emp http_host=lamcola http_agent=veli http_session_id=venia signature_subclass=risni signature_id=1535 srccountry=uat content_switch_name=onemulla server_pool_name=riaturEx false_positive_mitigation=deri user_name=amqu monitor_status=lorsitam http_refer=https://api.example.org/onpr/litseddo.gif?oremqu=idex#radip http_version=upta dev_id=tetura threat_weight=rumet history_threat_weight=uptasnul threat_level=antiumdo ftp_mode=ecill ftp_cmd=iduntu cipher_suite=pisci msg_id=sunt", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "tasnul4179.internal.host", + "http.request.referrer": "https://api.example.org/onpr/litseddo.gif?oremqu=idex#radip", + "input.type": "log", + "log.level": "very-high", + "log.offset": 27119, + "network.bytes": 4616, + "network.direction": "inbound", + "network.protocol": "GGP", + "observer.egress.interface.name": "enp0s3903", + "observer.ingress.interface.name": "eth5767", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2208", + "related.ip": [ + "10.141.156.217", + "10.53.168.187" + ], + "related.user": [ + "amqu" + ], + "rsa.internal.event_desc": "modico", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "illumq", + "rsa.misc.OS": "idata", + "rsa.misc.action": [ + "block", + "emacc" + ], + "rsa.misc.category": "ueporro", + "rsa.misc.client": "veli", + "rsa.misc.context": "itessequ", + "rsa.misc.event_source": "duntut", + "rsa.misc.event_type": "prehend", + "rsa.misc.fcatnum": "cillu", + "rsa.misc.filter": "iuntNeq", + "rsa.misc.hardware_id": "eddoei", + "rsa.misc.log_session_id": "venia", + "rsa.misc.policy_id": "upta", + "rsa.misc.policy_name": "upt", + "rsa.misc.reference_id": "rsin", + "rsa.misc.rule_name": "amvo", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 1535, + "rsa.misc.version": "1.2208", + "rsa.misc.vsys": "eufug", + "rsa.network.alias_host": [ + "tasnul4179.internal.host" + ], + "rsa.network.dinterface": "enp0s3903", + "rsa.network.network_service": "ite", + "rsa.network.sinterface": "eth5767", + "rsa.threat.threat_desc": "antiumdo", + "rsa.time.duration_time": 165.935, + "rsa.time.event_time": "2017-01-06T09:11:41.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 135.374, + "rsa.web.web_ref_domain": "lamcola", + "rule.name": "amvo", + "service.type": "fortinet", + "source.bytes": 4211, + "source.geo.country_name": "uat", + "source.ip": [ + "10.141.156.217" + ], + "source.mac": "01:00:5e:c0:47:f3", + "source.port": 2700, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.org/ess/quiad.jpg?ten=litanim#rQuisaut", + "url.query": "emp", + "user.name": "amqu" + }, + { + "@timestamp": "2017-01-20T04:14:16.000Z", + "destination.bytes": 837, + "destination.ip": [ + "10.189.82.19" + ], + "destination.port": 4267, + "event.action": "accept", + "event.code": "vel", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-1-20 time=2:14:16 devname=oco device_id=aboree log_id=ainci type=generic subtype=osqu pri=very-high devid=sus devname=imavenia logid=expli type=ugiat subtype=rnat level=low vd=orem srcip=10.37.174.58 srcport=3193 srcintf=lo2990 dstip=10.249.60.66 dstport=4859 dstintf=enp0s1732 poluuid=eve sessionid=tco proto=3 action=accept policyid=oluptate trandisp=lit duration=70.988000 sentbyte=6327 rcvdbyte=837 devtype=oquisqu osname=turadip osversion=1.3402 mastersrcmac=amc srcmac=01:00:5e:dd:dc:44 crscore=160.379000 craction=apar crlevel=runtm eventtype=eturadip user=olorsi service=itseddo hostname=bore5546.www.local profile=labo reqtype=lpaquiof url=https://example.com/xeac/llitanim.txt?oreverit=scip#Finibus direction=inbound msg=eufugia method=ncididun cat=hen catdesc=periamea device_id=itametco log_id=vel pri=high userfrom=rere adminprof=pta timezone=CEST main_type=equeporr trigger_policy=met sub_type=volup severity_level=ptate policy=entsu src=10.44.198.184 src_port=5695 dst=10.189.82.19 dst_port=4267 http_method=odoc http_url=atura http_host=tur http_agent=tur http_session_id=atnonpr signature_subclass=ita signature_id=7570 srccountry=colabori content_switch_name=imidestl server_pool_name=piscing false_positive_mitigation=ceroi user_name=iconsequ monitor_status=iat http_refer=https://www.example.net/siuta/atev.htm?CSe=exerci#inesciu http_version=quid dev_id=atcupid threat_weight=onse history_threat_weight=psa threat_level=ate ftp_mode=con ftp_cmd=tqu cipher_suite=eirur msg_id=dese", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "bore5546.www.local", + "http.request.referrer": "https://www.example.net/siuta/atev.htm?CSe=exerci#inesciu", + "input.type": "log", + "log.level": "high", + "log.offset": 28610, + "network.bytes": 7164, + "network.direction": "inbound", + "network.protocol": "GGP", + "observer.egress.interface.name": "enp0s1732", + "observer.ingress.interface.name": "lo2990", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.3402", + "related.ip": [ + "10.44.198.184", + "10.189.82.19" + ], + "related.user": [ + "iconsequ" + ], + "rsa.internal.event_desc": "eufugia", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "eturadip", + "rsa.misc.OS": "turadip", + "rsa.misc.action": [ + "odoc", + "accept" + ], + "rsa.misc.category": "volup", + "rsa.misc.client": "tur", + "rsa.misc.context": "lit", + "rsa.misc.event_source": "imavenia", + "rsa.misc.event_type": "ugiat", + "rsa.misc.fcatnum": "hen", + "rsa.misc.filter": "periamea", + "rsa.misc.hardware_id": "itametco", + "rsa.misc.log_session_id": "atnonpr", + "rsa.misc.policy_id": "oluptate", + "rsa.misc.policy_name": "entsu", + "rsa.misc.reference_id": "vel", + "rsa.misc.rule_name": "labo", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 7570, + "rsa.misc.version": "1.3402", + "rsa.misc.vsys": "orem", + "rsa.network.alias_host": [ + "bore5546.www.local" + ], + "rsa.network.dinterface": "enp0s1732", + "rsa.network.network_service": "itseddo", + "rsa.network.sinterface": "lo2990", + "rsa.threat.threat_desc": "ate", + "rsa.time.duration_time": 70.988, + "rsa.time.event_time": "2017-01-20T04:14:16.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 160.379, + "rsa.web.web_ref_domain": "tur", + "rule.name": "labo", + "service.type": "fortinet", + "source.bytes": 6327, + "source.geo.country_name": "colabori", + "source.ip": [ + "10.44.198.184" + ], + "source.mac": "01:00:5e:dd:dc:44", + "source.port": 5695, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.com/xeac/llitanim.txt?oreverit=scip#Finibus", + "url.query": "atura", + "user.name": "iconsequ" + }, + { + "@timestamp": "2017-02-03T11:16:50.000Z", + "destination.bytes": 3097, + "destination.ip": [ + "10.181.183.104" + ], + "destination.port": 5554, + "event.action": "cancel", + "event.code": "roinBCSe", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=mquisnos date=2017-2-3 time=9:16:50 log_id=lore devid=isci devname=Dui logid=reetdo type=ever subtype=civelits level=high vd=quiav srcip=10.154.34.15 srcport=5986 srcintf=enp0s4064 dstip=10.153.172.249 dstport=7030 dstintf=enp0s3067 poluuid=henderit sessionid=remq proto=21 action=cancel policyid=tla trandisp=arch duration=52.795000 sentbyte=5453 rcvdbyte=3097 devtype=ror osname=onsecte osversion=1.91 mastersrcmac=aecatcup srcmac=01:00:5e:58:7e:f5 crscore=133.560000 craction=quas crlevel=occaeca eventtype=eturadip user=ent service=rumSecti hostname=Utenima260.mail.invalid profile=cept reqtype=aedictas url=https://api.example.org/orio/gna.gif?aaliquaU=olu#iameaque direction=external msg=essequa method=aquio cat=rspicia catdesc=deom device_id=oluptat log_id=roinBCSe pri=medium userfrom=onproide adminprof=uamnih timezone=GMT+02:00 main_type=tatisetq trigger_policy=uidolo sub_type=umdolore severity_level=dmi policy=tam src=10.151.170.207 src_port=1400 dst=10.181.183.104 dst_port=5554 http_method=amni http_url=tatio http_host=amquisno http_agent=modoc http_session_id=magnam signature_subclass=uinesc signature_id=4248 srccountry=idatat content_switch_name=onev server_pool_name=orsi false_positive_mitigation=ntsunt user_name=iosamni monitor_status=idu http_refer=https://example.net/idolo/reet.txt?its=umdolor#isiu http_version=assi dev_id=eserun threat_weight=rvelill history_threat_weight=lupta threat_level=byC ftp_mode=imadm ftp_cmd=uta cipher_suite=tisu msg_id=remagnam", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "Utenima260.mail.invalid", + "http.request.referrer": "https://example.net/idolo/reet.txt?its=umdolor#isiu", + "input.type": "log", + "log.level": "medium", + "log.offset": 30121, + "network.bytes": 8550, + "network.direction": "external", + "observer.egress.interface.name": "enp0s3067", + "observer.ingress.interface.name": "enp0s4064", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.91", + "related.ip": [ + "10.151.170.207", + "10.181.183.104" + ], + "related.user": [ + "iosamni" + ], + "rsa.internal.event_desc": "essequa", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "eturadip", + "rsa.misc.OS": "onsecte", + "rsa.misc.action": [ + "amni", + "cancel" + ], + "rsa.misc.category": "umdolore", + "rsa.misc.client": "modoc", + "rsa.misc.context": "arch", + "rsa.misc.event_source": "Dui", + "rsa.misc.event_type": "ever", + "rsa.misc.fcatnum": "rspicia", + "rsa.misc.filter": "deom", + "rsa.misc.hardware_id": "oluptat", + "rsa.misc.log_session_id": "magnam", + "rsa.misc.policy_id": "tla", + "rsa.misc.policy_name": "tam", + "rsa.misc.reference_id": "roinBCSe", + "rsa.misc.rule_name": "cept", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 4248, + "rsa.misc.version": "1.91", + "rsa.misc.vsys": "quiav", + "rsa.network.alias_host": [ + "Utenima260.mail.invalid" + ], + "rsa.network.dinterface": "enp0s3067", + "rsa.network.network_service": "rumSecti", + "rsa.network.sinterface": "enp0s4064", + "rsa.threat.threat_desc": "byC", + "rsa.time.duration_time": 52.795, + "rsa.time.event_time": "2017-02-03T11:16:50.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 133.56, + "rsa.web.web_ref_domain": "amquisno", + "rule.name": "cept", + "service.type": "fortinet", + "source.bytes": 5453, + "source.geo.country_name": "idatat", + "source.ip": [ + "10.151.170.207" + ], + "source.mac": "01:00:5e:58:7e:f5", + "source.port": 1400, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.org/orio/gna.gif?aaliquaU=olu#iameaque", + "url.query": "tatio", + "user.name": "iosamni" + }, + { + "@timestamp": "2017-02-18T06:19:24.000Z", + "destination.bytes": 6209, + "destination.ip": [ + "10.130.240.11" + ], + "destination.port": 6515, + "event.action": "deny", + "event.code": "consequa", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=iumdo date=2017-2-18 time=4:19:24 log_id=iusmodit devid=aturv devname=ectetura logid=obeataev type=umf subtype=olesti level=low vd=quaeabil srcip=10.19.99.129 srcport=956 srcintf=eth62 dstip=10.205.132.218 dstport=1643 dstintf=enp0s5908 poluuid=inim sessionid=etdol proto=17 action=deny policyid=oremeumf trandisp=lesti duration=49.961000 sentbyte=3376 rcvdbyte=6209 devtype=enima osname=tnulapar osversion=1.7278 mastersrcmac=sequ srcmac=01:00:5e:4a:1d:f8 crscore=84.522000 craction=tionula crlevel=accus eventtype=uatu user=mquis service=lab hostname=uido2046.mail.lan profile=tena reqtype=aal url=https://mail.example.org/nimadmin/lumqui.txt?iquip=tinculpa#umtota direction=external msg=rumSecti method=riamea cat=eca catdesc=oluptate device_id=Duisa log_id=consequa pri=low userfrom=iaecon adminprof=aevitaed timezone=PT main_type=rep trigger_policy=remap sub_type=deri severity_level=quaeratv policy=involu src=10.70.7.23 src_port=2758 dst=10.130.240.11 dst_port=6515 http_method=odic http_url=iuta http_host=liquaUte http_agent=scivelit http_session_id=Nequ signature_subclass=quid signature_id=1044 srccountry=lloinve content_switch_name=borisnis server_pool_name=onorumet false_positive_mitigation=ptatema user_name=eavolup monitor_status=ipsumq http_refer=https://www.example.org/tno/iss.gif?ptatev=atu#teturad http_version=eturad dev_id=tDuis threat_weight=mwritten history_threat_weight=tat threat_level=equ ftp_mode=sumdolo ftp_cmd=idolorem cipher_suite=temvele msg_id=oremque", + "event.timezone": "PT", + "fileset.name": "fortimanager", + "host.name": "uido2046.mail.lan", + "http.request.referrer": "https://www.example.org/tno/iss.gif?ptatev=atu#teturad", + "input.type": "log", + "log.level": "low", + "log.offset": 31615, + "network.bytes": 9585, + "network.direction": "external", + "observer.egress.interface.name": "enp0s5908", + "observer.ingress.interface.name": "eth62", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.7278", + "related.ip": [ + "10.70.7.23", + "10.130.240.11" + ], + "related.user": [ + "eavolup" + ], + "rsa.internal.event_desc": "rumSecti", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "uatu", + "rsa.misc.OS": "tnulapar", + "rsa.misc.action": [ + "odic", + "deny" + ], + "rsa.misc.category": "deri", + "rsa.misc.client": "scivelit", + "rsa.misc.context": "lesti", + "rsa.misc.event_source": "ectetura", + "rsa.misc.event_type": "umf", + "rsa.misc.fcatnum": "eca", + "rsa.misc.filter": "oluptate", + "rsa.misc.hardware_id": "Duisa", + "rsa.misc.log_session_id": "Nequ", + "rsa.misc.policy_id": "oremeumf", + "rsa.misc.policy_name": "involu", + "rsa.misc.reference_id": "consequa", + "rsa.misc.rule_name": "tena", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 1044, + "rsa.misc.version": "1.7278", + "rsa.misc.vsys": "quaeabil", + "rsa.network.alias_host": [ + "uido2046.mail.lan" + ], + "rsa.network.dinterface": "enp0s5908", + "rsa.network.network_service": "lab", + "rsa.network.sinterface": "eth62", + "rsa.threat.threat_desc": "equ", + "rsa.time.duration_time": 49.961, + "rsa.time.event_time": "2017-02-18T06:19:24.000Z", + "rsa.time.timezone": "PT", + "rsa.web.reputation_num": 84.522, + "rsa.web.web_ref_domain": "liquaUte", + "rule.name": "tena", + "service.type": "fortinet", + "source.bytes": 3376, + "source.geo.country_name": "lloinve", + "source.ip": [ + "10.70.7.23" + ], + "source.mac": "01:00:5e:4a:1d:f8", + "source.port": 2758, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/nimadmin/lumqui.txt?iquip=tinculpa#umtota", + "url.query": "iuta", + "user.name": "eavolup" + }, + { + "@timestamp": "2017-03-04T13:21:59.000Z", + "destination.bytes": 6509, + "destination.geo.country_name": "uian", + "destination.ip": [ + "10.111.182.212" + ], + "destination.nat.ip": "10.17.209.252", + "destination.nat.port": 2119, + "destination.port": 4493, + "event.action": "deny", + "event.code": "uae", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=inimve devname=\"uio\" devid=\"mexercit\" vd=byC date=2017-3-4 time=11:21:59 logid=uae type=oremip subtype=its level=very-high eventtime=iavol logtime=natuserr srcip=10.37.161.101 srcport=1552 srcintf=enp0s6659 srcintfrole=evit dstip=10.111.182.212 dstport=4493 dstintf=lo6533 dstintfrole=lamco poluuid=tion sessionid=hender proto=icmp action=deny policyid=seq policytype=rumSe crscore=88.660000 craction=madmi crlevel=tlabore appcat=idunt service=expl srccountry=olore dstcountry=uian trandisp=atuserro tranip=10.17.209.252 tranport=2119 duration=135.770000 sentbyte=313 rcvdbyte=6509 sentpkt=oinBCS app=itsedd", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 33111, + "network.bytes": 6822, + "observer.egress.interface.name": "lo6533", + "observer.ingress.interface.name": "enp0s6659", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.37.161.101", + "10.111.182.212", + "10.17.209.252" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "its", + "rsa.misc.context": "atuserro", + "rsa.misc.event_source": "uio", + "rsa.misc.event_type": "oremip", + "rsa.misc.hardware_id": "mexercit", + "rsa.misc.log_session_id": "hender", + "rsa.misc.obj_name": "itsedd", + "rsa.misc.policy_id": "seq", + "rsa.misc.reference_id": "uae", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "byC", + "rsa.network.dinterface": "lo6533", + "rsa.network.network_service": "expl", + "rsa.network.sinterface": "enp0s6659", + "rsa.time.duration_time": 135.77, + "rsa.time.event_time": "2017-03-04T13:21:59.000Z", + "rsa.time.event_time_str": "iavol", + "rsa.web.reputation_num": 88.66, + "service.type": "fortinet", + "source.bytes": 313, + "source.geo.country_name": "olore", + "source.ip": [ + "10.37.161.101" + ], + "source.port": 1552, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-03-18T08:24:33.000Z", + "destination.bytes": 1936, + "destination.geo.country_name": "nonpro", + "destination.ip": [ + "10.170.196.181" + ], + "destination.nat.ip": "10.153.166.133", + "destination.nat.port": 4638, + "destination.port": 6994, + "event.action": "allow", + "event.code": "sin", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ipis devname=\"itautfu\" devid=\"nesci\" vd=tam date=2017-3-18 time=6:24:33 logid=sin type=idexeac subtype=nimadmin level=medium eventtime=edutper logtime=tevelite srcip=10.158.175.98 srcport=1491 srcintf=enp0s7649 srcintfrole=oinBCSed dstip=10.170.196.181 dstport=6994 dstintf=enp0s5873 dstintfrole=obeatae poluuid=iquid sessionid=evo proto=udp action=allow policyid=mqu policytype=pteursi crscore=98.596000 craction=expl crlevel=essecill appcat=totamre service=rpo srccountry=velites dstcountry=nonpro trandisp=nula tranip=10.153.166.133 tranport=4638 duration=39.506000 sentbyte=6610 rcvdbyte=1936 sentpkt=olu app=imide", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 33726, + "network.bytes": 8546, + "observer.egress.interface.name": "enp0s5873", + "observer.ingress.interface.name": "enp0s7649", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.170.196.181", + "10.153.166.133", + "10.158.175.98" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "nimadmin", + "rsa.misc.context": "nula", + "rsa.misc.event_source": "itautfu", + "rsa.misc.event_type": "idexeac", + "rsa.misc.hardware_id": "nesci", + "rsa.misc.log_session_id": "evo", + "rsa.misc.obj_name": "imide", + "rsa.misc.policy_id": "mqu", + "rsa.misc.reference_id": "sin", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "tam", + "rsa.network.dinterface": "enp0s5873", + "rsa.network.network_service": "rpo", + "rsa.network.sinterface": "enp0s7649", + "rsa.time.duration_time": 39.506, + "rsa.time.event_time": "2017-03-18T08:24:33.000Z", + "rsa.time.event_time_str": "edutper", + "rsa.web.reputation_num": 98.596, + "service.type": "fortinet", + "source.bytes": 6610, + "source.geo.country_name": "velites", + "source.ip": [ + "10.158.175.98" + ], + "source.port": 1491, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-02T03:27:07.000Z", + "destination.bytes": 5360, + "destination.ip": [ + "10.48.25.200" + ], + "destination.port": 5179, + "event.action": "accept", + "event.code": "uredol", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-4-2 time=1:27:07 logver=amn devid=itessequ devname=porissu logid=umd type=sumd subtype=sectetur level=low vd=aUtenima srcip=10.62.10.137 srcport=5596 srcintf=lo6539 dstip=10.138.249.251 dstport=630 dstintf=eth1576 poluuid=deritinv sessionid=evelite proto=6 action=accept policyid=stiaecon trandisp=usBono duration=155.835000 sentbyte=3942 rcvdbyte=5360 devtype=ttenb osname=olor osversion=1.5978 mastersrcmac=lapa srcmac=01:00:5e:b0:3e:44 crscore=105.845000 craction=lors crlevel=oluptat eventtype=enimad user=tis service=qua hostname=con6049.internal.lan profile=quelaud reqtype=luptat url=https://internal.example.com/temse/caecat.jpg?emeu=tatemac#quisn direction=inbound msg=teursint method=etMa cat=llita catdesc=ntsunt device_id=nturmag log_id=uredol pri=high userfrom=temsequi adminprof=mquia timezone=ET main_type=enbyCic trigger_policy=iveli sub_type=conseq severity_level=itame policy=tenat src=10.63.171.91 src_port=4396 dst=10.48.25.200 dst_port=5179 http_method=nse http_url=mveniam http_host=tuser http_agent=mmo http_session_id=eve signature_subclass=nbyCicer signature_id=6129 srccountry=ciad content_switch_name=ugiatqu server_pool_name=eruntmo false_positive_mitigation=nimve user_name=usanti monitor_status=ion http_refer=https://mail.example.org/gelits/iavo.txt?udexerc=ovolupta#volup http_version=macc dev_id=ria threat_weight=beat history_threat_weight=rro threat_level=tuser ftp_mode=ctasu ftp_cmd=irat cipher_suite=sitame msg_id=oinven", + "event.timezone": "ET", + "fileset.name": "fortimanager", + "host.name": "con6049.internal.lan", + "http.request.referrer": "https://mail.example.org/gelits/iavo.txt?udexerc=ovolupta#volup", + "input.type": "log", + "log.level": "high", + "log.offset": 34352, + "network.bytes": 9302, + "network.direction": "inbound", + "observer.egress.interface.name": "eth1576", + "observer.ingress.interface.name": "lo6539", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.5978", + "related.ip": [ + "10.63.171.91", + "10.48.25.200" + ], + "related.user": [ + "usanti" + ], + "rsa.internal.event_desc": "teursint", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "enimad", + "rsa.misc.OS": "olor", + "rsa.misc.action": [ + "accept", + "nse" + ], + "rsa.misc.category": "conseq", + "rsa.misc.client": "mmo", + "rsa.misc.context": "usBono", + "rsa.misc.event_source": "porissu", + "rsa.misc.event_type": "sumd", + "rsa.misc.fcatnum": "llita", + "rsa.misc.filter": "ntsunt", + "rsa.misc.hardware_id": "nturmag", + "rsa.misc.log_session_id": "eve", + "rsa.misc.policy_id": "stiaecon", + "rsa.misc.policy_name": "tenat", + "rsa.misc.reference_id": "uredol", + "rsa.misc.rule_name": "quelaud", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 6129, + "rsa.misc.version": "1.5978", + "rsa.misc.vsys": "aUtenima", + "rsa.network.alias_host": [ + "con6049.internal.lan" + ], + "rsa.network.dinterface": "eth1576", + "rsa.network.network_service": "qua", + "rsa.network.sinterface": "lo6539", + "rsa.threat.threat_desc": "tuser", + "rsa.time.duration_time": 155.835, + "rsa.time.event_time": "2017-04-02T03:27:07.000Z", + "rsa.time.timezone": "ET", + "rsa.web.reputation_num": 105.845, + "rsa.web.web_ref_domain": "tuser", + "rule.name": "quelaud", + "service.type": "fortinet", + "source.bytes": 3942, + "source.geo.country_name": "ciad", + "source.ip": [ + "10.63.171.91" + ], + "source.mac": "01:00:5e:b0:3e:44", + "source.port": 4396, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.com/temse/caecat.jpg?emeu=tatemac#quisn", + "url.query": "mveniam", + "user.name": "usanti" + }, + { + "@timestamp": "2017-04-16T10:29:41.000Z", + "destination.bytes": 7791, + "destination.geo.country_name": "ddoe", + "destination.ip": [ + "10.77.105.81" + ], + "destination.nat.ip": "10.38.168.190", + "destination.nat.port": 7260, + "destination.port": 4455, + "event.action": "allow", + "event.code": "rcitati", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ute dtime=2017-04-16 08:29:41.792538723 +0000 UTC devid=mexer devname=iam vd=Bonoru date=2017-4-16 time=8:29:41 logid=rcitati type=nula subtype=ameaquei level=low eventtime=adipi logtime=mquis srcip=10.174.17.46 srcport=2743 srcintf=eth6814 srcintfrole=ine dstip=10.77.105.81 dstport=4455 dstintf=enp0s7799 dstintfrole=orem poluuid=giatqu sessionid=rsint proto=udp action=allow policyid=paq policytype=uianon crscore=60.762000 craction=uisautem crlevel=mquameiu appcat=loremq service=turmagni srccountry=ores dstcountry=ddoe trandisp=uid tranip=10.38.168.190 tranport=7260 duration=129.140000 sentbyte=368 rcvdbyte=7791 sentpkt=incidi app=aedictas", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 35821, + "network.bytes": 8159, + "observer.egress.interface.name": "enp0s7799", + "observer.ingress.interface.name": "eth6814", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.174.17.46", + "10.77.105.81", + "10.38.168.190" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ameaquei", + "rsa.misc.context": "uid", + "rsa.misc.event_source": "iam", + "rsa.misc.event_type": "nula", + "rsa.misc.hardware_id": "mexer", + "rsa.misc.log_session_id": "rsint", + "rsa.misc.obj_name": "aedictas", + "rsa.misc.policy_id": "paq", + "rsa.misc.reference_id": "rcitati", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "Bonoru", + "rsa.network.dinterface": "enp0s7799", + "rsa.network.network_service": "turmagni", + "rsa.network.sinterface": "eth6814", + "rsa.time.duration_time": 129.14, + "rsa.time.event_time": "2017-04-16T10:29:41.000Z", + "rsa.time.event_time_str": "adipi", + "rsa.web.reputation_num": 60.762, + "service.type": "fortinet", + "source.bytes": 368, + "source.geo.country_name": "ores", + "source.ip": [ + "10.174.17.46" + ], + "source.port": 2743, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-30T05:32:16.000Z", + "destination.bytes": 7663, + "destination.geo.country_name": "boriosa", + "destination.ip": [ + "10.225.37.73" + ], + "destination.nat.ip": "10.166.142.198", + "destination.nat.port": 4151, + "destination.port": 5630, + "event.action": "cancel", + "event.code": "abore", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=temaccus devname=\"ons\" devid=\"unt\" vd=liq date=2017-4-30 time=3:32:16 logid=abore type=iumdo subtype=oreeu level=high eventtime=exe logtime=tis srcip=10.36.99.207 srcport=4829 srcintf=lo497 srcintfrole=tvol dstip=10.225.37.73 dstport=5630 dstintf=eth1882 dstintfrole=eniamqu poluuid=iumt sessionid=porissus proto=udp action=cancel policyid=tsunt policytype=rnat crscore=88.508000 craction=ured crlevel=ctetu appcat=oreeu service=uasiarch srccountry=Malor dstcountry=boriosa trandisp=cillumdo tranip=10.166.142.198 tranport=4151 duration=1.040000 sentbyte=465 rcvdbyte=7663 sentpkt=oreetd app=lor", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 36476, + "network.bytes": 8128, + "observer.egress.interface.name": "eth1882", + "observer.ingress.interface.name": "lo497", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.225.37.73", + "10.36.99.207", + "10.166.142.198" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "oreeu", + "rsa.misc.context": "cillumdo", + "rsa.misc.event_source": "ons", + "rsa.misc.event_type": "iumdo", + "rsa.misc.hardware_id": "unt", + "rsa.misc.log_session_id": "porissus", + "rsa.misc.obj_name": "lor", + "rsa.misc.policy_id": "tsunt", + "rsa.misc.reference_id": "abore", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "liq", + "rsa.network.dinterface": "eth1882", + "rsa.network.network_service": "uasiarch", + "rsa.network.sinterface": "lo497", + "rsa.time.duration_time": 1.04, + "rsa.time.event_time": "2017-04-30T05:32:16.000Z", + "rsa.time.event_time_str": "exe", + "rsa.web.reputation_num": 88.508, + "service.type": "fortinet", + "source.bytes": 465, + "source.geo.country_name": "Malor", + "source.ip": [ + "10.36.99.207" + ], + "source.port": 4829, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-05-14T12:34:50.000Z", + "destination.bytes": 6820, + "destination.geo.country_name": "lill", + "destination.ip": [ + "10.214.156.161" + ], + "destination.nat.ip": "10.145.194.12", + "destination.nat.port": 1001, + "destination.port": 3854, + "event.action": "block", + "event.code": "tassitas", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=etc devname=\"eturadip\" devid=\"nost\" vd=atus date=2017-5-14 time=10:34:50 logid=tassitas type=obea subtype=velite level=medium eventtime=litse logtime=san srcip=10.66.90.225 srcport=4846 srcintf=lo4891 srcintfrole=moenimi dstip=10.214.156.161 dstport=3854 dstintf=eth1188 dstintfrole=ati poluuid=rauto sessionid=doloreeu proto=6 action=block policyid=eumfu policytype=docons crscore=3.408000 craction=eumf crlevel=roquisq appcat=uasi service=maveniam srccountry=uis dstcountry=lill trandisp=remeum tranip=10.145.194.12 tranport=1001 duration=25.398000 sentbyte=6452 rcvdbyte=6820 sentpkt=aturE app=umto", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 37079, + "network.bytes": 13272, + "observer.egress.interface.name": "eth1188", + "observer.ingress.interface.name": "lo4891", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.214.156.161", + "10.66.90.225", + "10.145.194.12" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "velite", + "rsa.misc.context": "remeum", + "rsa.misc.event_source": "eturadip", + "rsa.misc.event_type": "obea", + "rsa.misc.hardware_id": "nost", + "rsa.misc.log_session_id": "doloreeu", + "rsa.misc.obj_name": "umto", + "rsa.misc.policy_id": "eumfu", + "rsa.misc.reference_id": "tassitas", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "atus", + "rsa.network.dinterface": "eth1188", + "rsa.network.network_service": "maveniam", + "rsa.network.sinterface": "lo4891", + "rsa.time.duration_time": 25.398, + "rsa.time.event_time": "2017-05-14T12:34:50.000Z", + "rsa.time.event_time_str": "litse", + "rsa.web.reputation_num": 3.408, + "service.type": "fortinet", + "source.bytes": 6452, + "source.geo.country_name": "uis", + "source.ip": [ + "10.66.90.225" + ], + "source.port": 4846, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-05-29T07:37:24.000Z", + "destination.bytes": 4638, + "destination.geo.country_name": "cidu", + "destination.ip": [ + "10.156.208.5" + ], + "destination.nat.ip": "10.163.36.101", + "destination.nat.port": 253, + "destination.port": 7612, + "event.action": "cancel", + "event.code": "eddoei", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=pariat devname=\"iutal\" devid=\"teturad\" vd=ese date=2017-5-29 time=5:37:24 logid=eddoei type=lorumw subtype=eca level=medium eventtime=nimve logtime=duntut srcip=10.6.242.108 srcport=3373 srcintf=lo3230 srcintfrole=qua dstip=10.156.208.5 dstport=7612 dstintf=lo1800 dstintfrole=quisn poluuid=pteu sessionid=uatD proto=0 action=cancel policyid=antiu policytype=velillum crscore=166.389000 craction=iatquovo crlevel=lapari appcat=Mal service=itinvo srccountry=snulap dstcountry=cidu trandisp=hilmol tranip=10.163.36.101 tranport=253 duration=72.488000 sentbyte=1880 rcvdbyte=4638 sentpkt=ident app=scip", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 37688, + "network.bytes": 6518, + "observer.egress.interface.name": "lo1800", + "observer.ingress.interface.name": "lo3230", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.163.36.101", + "10.156.208.5", + "10.6.242.108" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "eca", + "rsa.misc.context": "hilmol", + "rsa.misc.event_source": "iutal", + "rsa.misc.event_type": "lorumw", + "rsa.misc.hardware_id": "teturad", + "rsa.misc.log_session_id": "uatD", + "rsa.misc.obj_name": "scip", + "rsa.misc.policy_id": "antiu", + "rsa.misc.reference_id": "eddoei", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ese", + "rsa.network.dinterface": "lo1800", + "rsa.network.network_service": "itinvo", + "rsa.network.sinterface": "lo3230", + "rsa.time.duration_time": 72.488, + "rsa.time.event_time": "2017-05-29T07:37:24.000Z", + "rsa.time.event_time_str": "nimve", + "rsa.web.reputation_num": 166.389, + "service.type": "fortinet", + "source.bytes": 1880, + "source.geo.country_name": "snulap", + "source.ip": [ + "10.6.242.108" + ], + "source.port": 3373, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-06-12T14:39:58.000Z", + "destination.bytes": 1048, + "destination.ip": [ + "10.68.233.163" + ], + "destination.port": 3126, + "event.action": "allow", + "event.code": "emve", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-6-12 time=12:39:58 devname=uamqu device_id=iusmodi log_id=esciun type=generic subtype=tasnul pri=medium devid=ccusant devname=epteurs logid=rmag type=quisquam subtype=eporroqu level=very-high vd=dit srcip=10.25.134.171 srcport=7867 srcintf=eth4543 dstip=10.43.235.230 dstport=2198 dstintf=lo4581 poluuid=BCSe sessionid=rem proto=0 action=allow policyid=eeufug trandisp=ntin duration=6.686000 sentbyte=5763 rcvdbyte=1048 devtype=cinge osname=tatem osversion=1.4713 mastersrcmac=eritqu srcmac=01:00:5e:ed:6b:57 crscore=10.603000 craction=nimip crlevel=iutaliq eventtype=olore user=onemul service=trudexe hostname=remeum2641.www5.corp profile=Quisa reqtype=quiav url=https://www5.example.com/elit/sam.htm?nevolu=unt#isni direction=outbound msg=ecillum method=olor cat=amei catdesc=doconseq device_id=conseq log_id=emve pri=very-high userfrom=tiu adminprof=wri timezone=GMT-07:00 main_type=asper trigger_policy=dictasun sub_type=psa severity_level=lorese policy=olupta src=10.220.148.127 src_port=6681 dst=10.68.233.163 dst_port=3126 http_method=itanimi http_url=onoru http_host=data http_agent=ugits http_session_id=ittenb signature_subclass=tobeatae signature_id=5617 srccountry=quis content_switch_name=exe server_pool_name=naa false_positive_mitigation=equat user_name=estiaec monitor_status=pitlabo http_refer=https://example.net/rcitat/ree.htm?ionofdeF=rsp#imipsa http_version=nostrum dev_id=autodita threat_weight=ntut history_threat_weight=temveleu threat_level=itametco ftp_mode=etcons ftp_cmd=etco cipher_suite=iuntN msg_id=utfugi", + "event.timezone": "GMT-07:00", + "fileset.name": "fortimanager", + "host.name": "remeum2641.www5.corp", + "http.request.referrer": "https://example.net/rcitat/ree.htm?ionofdeF=rsp#imipsa", + "input.type": "log", + "log.level": "very-high", + "log.offset": 38295, + "network.bytes": 6811, + "network.direction": "outbound", + "observer.egress.interface.name": "lo4581", + "observer.ingress.interface.name": "eth4543", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4713", + "related.ip": [ + "10.68.233.163", + "10.220.148.127" + ], + "related.user": [ + "estiaec" + ], + "rsa.internal.event_desc": "ecillum", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "olore", + "rsa.misc.OS": "tatem", + "rsa.misc.action": [ + "allow", + "itanimi" + ], + "rsa.misc.category": "psa", + "rsa.misc.client": "ugits", + "rsa.misc.context": "ntin", + "rsa.misc.event_source": "epteurs", + "rsa.misc.event_type": "quisquam", + "rsa.misc.fcatnum": "amei", + "rsa.misc.filter": "doconseq", + "rsa.misc.hardware_id": "conseq", + "rsa.misc.log_session_id": "ittenb", + "rsa.misc.policy_id": "eeufug", + "rsa.misc.policy_name": "olupta", + "rsa.misc.reference_id": "emve", + "rsa.misc.rule_name": "Quisa", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 5617, + "rsa.misc.version": "1.4713", + "rsa.misc.vsys": "dit", + "rsa.network.alias_host": [ + "remeum2641.www5.corp" + ], + "rsa.network.dinterface": "lo4581", + "rsa.network.network_service": "trudexe", + "rsa.network.sinterface": "eth4543", + "rsa.threat.threat_desc": "itametco", + "rsa.time.duration_time": 6.686, + "rsa.time.event_time": "2017-06-12T14:39:58.000Z", + "rsa.time.timezone": "GMT-07:00", + "rsa.web.reputation_num": 10.603, + "rsa.web.web_ref_domain": "data", + "rule.name": "Quisa", + "service.type": "fortinet", + "source.bytes": 5763, + "source.geo.country_name": "quis", + "source.ip": [ + "10.220.148.127" + ], + "source.mac": "01:00:5e:ed:6b:57", + "source.port": 6681, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.com/elit/sam.htm?nevolu=unt#isni", + "url.query": "onoru", + "user.name": "estiaec" + }, + { + "@timestamp": "2017-06-26T09:42:33.000Z", + "destination.bytes": 6196, + "destination.ip": [ + "10.94.177.125" + ], + "destination.port": 6683, + "event.action": "allow", + "event.code": "mquido", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=isnostru date=2017-6-26 time=7:42:33 log_id=nul devid=ntocca devname=trudex logid=tvol type=lup subtype=mipsamv level=medium vd=qua srcip=10.249.194.7 srcport=4987 srcintf=enp0s2282 dstip=10.57.116.17 dstport=90 dstintf=enp0s7442 poluuid=xcep sessionid=gnidol proto=0 action=allow policyid=uaeab trandisp=ptat duration=136.310000 sentbyte=1078 rcvdbyte=6196 devtype=eturadip osname=amquaera osversion=1.4481 mastersrcmac=equ srcmac=01:00:5e:00:fd:79 crscore=18.750000 craction=olesti crlevel=edquia eventtype=ihi user=undeomn service=ape hostname=itaspe3216.localdomain profile=onsecte reqtype=prehende url=https://example.org/porro/issu.htm?inculpa=ruredol#iadeseru direction=unknown msg=numq method=quae cat=periam catdesc=ain device_id=umiurer log_id=mquido pri=very-high userfrom=onorume adminprof=abill timezone=GMT+02:00 main_type=uov trigger_policy=mini sub_type=mve severity_level=tionev policy=uasiarch src=10.116.82.108 src_port=7276 dst=10.94.177.125 dst_port=6683 http_method=nimides http_url=olorsit http_host=naaliq http_agent=plica http_session_id=asiarc signature_subclass=lor signature_id=5152 srccountry=snula content_switch_name=pici server_pool_name=bori false_positive_mitigation=dipi user_name=ecatc monitor_status=quovolu http_refer=https://example.net/itse/sse.gif?lupt=quatur#dminim http_version=ptatevel dev_id=aperiame threat_weight=stenat history_threat_weight=uianonnu threat_level=tatiset ftp_mode=quira ftp_cmd=ciatisun cipher_suite=duntutl msg_id=nven", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "itaspe3216.localdomain", + "http.request.referrer": "https://example.net/itse/sse.gif?lupt=quatur#dminim", + "input.type": "log", + "log.level": "very-high", + "log.offset": 39842, + "network.bytes": 7274, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s7442", + "observer.ingress.interface.name": "enp0s2282", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4481", + "related.ip": [ + "10.94.177.125", + "10.116.82.108" + ], + "related.user": [ + "ecatc" + ], + "rsa.internal.event_desc": "numq", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "ihi", + "rsa.misc.OS": "amquaera", + "rsa.misc.action": [ + "nimides", + "allow" + ], + "rsa.misc.category": "mve", + "rsa.misc.client": "plica", + "rsa.misc.context": "ptat", + "rsa.misc.event_source": "trudex", + "rsa.misc.event_type": "lup", + "rsa.misc.fcatnum": "periam", + "rsa.misc.filter": "ain", + "rsa.misc.hardware_id": "umiurer", + "rsa.misc.log_session_id": "asiarc", + "rsa.misc.policy_id": "uaeab", + "rsa.misc.policy_name": "uasiarch", + "rsa.misc.reference_id": "mquido", + "rsa.misc.rule_name": "onsecte", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 5152, + "rsa.misc.version": "1.4481", + "rsa.misc.vsys": "qua", + "rsa.network.alias_host": [ + "itaspe3216.localdomain" + ], + "rsa.network.dinterface": "enp0s7442", + "rsa.network.network_service": "ape", + "rsa.network.sinterface": "enp0s2282", + "rsa.threat.threat_desc": "tatiset", + "rsa.time.duration_time": 136.31, + "rsa.time.event_time": "2017-06-26T09:42:33.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 18.75, + "rsa.web.web_ref_domain": "naaliq", + "rule.name": "onsecte", + "service.type": "fortinet", + "source.bytes": 1078, + "source.geo.country_name": "snula", + "source.ip": [ + "10.116.82.108" + ], + "source.mac": "01:00:5e:00:fd:79", + "source.port": 7276, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.org/porro/issu.htm?inculpa=ruredol#iadeseru", + "url.query": "olorsit", + "user.name": "ecatc" + }, + { + "@timestamp": "2017-07-11T04:45:07.000Z", + "destination.bytes": 7131, + "destination.ip": [ + "10.113.152.241" + ], + "destination.port": 2330, + "event.action": "cancel", + "event.code": "uptat", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-7-11 time=2:45:07 devname=saq device_id=asiarch log_id=ssuscipi type=generic subtype=utla pri=medium devid=tquovo devname=fugi logid=nse type=nesciu subtype=todit level=very-high vd=inrepreh srcip=10.14.192.162 srcport=2536 srcintf=enp0s4429 dstip=10.179.128.6 dstport=3375 dstintf=enp0s4580 poluuid=ptate sessionid=volupta proto=3 action=cancel policyid=utla trandisp=emi duration=171.651000 sentbyte=3313 rcvdbyte=7131 devtype=velites osname=oloremi osversion=1.4442 mastersrcmac=apari srcmac=01:00:5e:0c:fb:2b crscore=140.065000 craction=uel crlevel=fficiad eventtype=teirured user=nostru service=rcit hostname=mea6298.api.example profile=eumiu reqtype=tatevel url=https://mail.example.org/uamquaer/texplica.gif?sequa=lorum#suntexpl direction=inbound msg=Sedut method=tatis cat=audant catdesc=obeata device_id=uredol log_id=uptat pri=low userfrom=entorev adminprof=quuntur timezone=GMT+02:00 main_type=exercit trigger_policy=dexer sub_type=idolor severity_level=onpr policy=uira src=10.115.121.243 src_port=550 dst=10.113.152.241 dst_port=2330 http_method=ali http_url=udexerci http_host=uae http_agent=imveni http_session_id=econ signature_subclass=aborio signature_id=1122 srccountry=setquas content_switch_name=nbyCi server_pool_name=runtmoll false_positive_mitigation=busBon user_name=norumetM monitor_status=isno http_refer=https://internal.example.com/ameaq/Quis.html?lestiae=iav#umiure http_version=isiut dev_id=tin threat_weight=rporiss history_threat_weight=billoinv threat_level=etconse ftp_mode=nesciu ftp_cmd=mali cipher_suite=roinBCSe msg_id=eetdolor", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "mea6298.api.example", + "http.request.referrer": "https://internal.example.com/ameaq/Quis.html?lestiae=iav#umiure", + "input.type": "log", + "log.level": "low", + "log.offset": 41333, + "network.bytes": 10444, + "network.direction": "inbound", + "network.protocol": "GGP", + "observer.egress.interface.name": "enp0s4580", + "observer.ingress.interface.name": "enp0s4429", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4442", + "related.ip": [ + "10.115.121.243", + "10.113.152.241" + ], + "related.user": [ + "norumetM" + ], + "rsa.internal.event_desc": "Sedut", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "teirured", + "rsa.misc.OS": "oloremi", + "rsa.misc.action": [ + "ali", + "cancel" + ], + "rsa.misc.category": "idolor", + "rsa.misc.client": "imveni", + "rsa.misc.context": "emi", + "rsa.misc.event_source": "fugi", + "rsa.misc.event_type": "nesciu", + "rsa.misc.fcatnum": "audant", + "rsa.misc.filter": "obeata", + "rsa.misc.hardware_id": "uredol", + "rsa.misc.log_session_id": "econ", + "rsa.misc.policy_id": "utla", + "rsa.misc.policy_name": "uira", + "rsa.misc.reference_id": "uptat", + "rsa.misc.rule_name": "eumiu", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 1122, + "rsa.misc.version": "1.4442", + "rsa.misc.vsys": "inrepreh", + "rsa.network.alias_host": [ + "mea6298.api.example" + ], + "rsa.network.dinterface": "enp0s4580", + "rsa.network.network_service": "rcit", + "rsa.network.sinterface": "enp0s4429", + "rsa.threat.threat_desc": "etconse", + "rsa.time.duration_time": 171.651, + "rsa.time.event_time": "2017-07-11T04:45:07.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 140.065, + "rsa.web.web_ref_domain": "uae", + "rule.name": "eumiu", + "service.type": "fortinet", + "source.bytes": 3313, + "source.geo.country_name": "setquas", + "source.ip": [ + "10.115.121.243" + ], + "source.mac": "01:00:5e:0c:fb:2b", + "source.port": 550, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/uamquaer/texplica.gif?sequa=lorum#suntexpl", + "url.query": "udexerci", + "user.name": "norumetM" + }, + { + "@timestamp": "2017-07-25T11:47:41.000Z", + "destination.bytes": 6863, + "destination.ip": [ + "10.179.153.97" + ], + "destination.port": 1908, + "event.action": "accept", + "event.code": "taliqu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-7-25 time=9:47:41 logver=upt devid=equamni devname=atcupi logid=enima type=uptateve subtype=fugitsed level=medium vd=lorem srcip=10.68.159.207 srcport=3320 srcintf=enp0s7206 dstip=10.139.195.188 dstport=893 dstintf=enp0s6960 poluuid=lits sessionid=tvolu proto=17 action=accept policyid=ollitan trandisp=temseq duration=0.684000 sentbyte=3045 rcvdbyte=6863 devtype=edictasu osname=eturadi osversion=1.3804 mastersrcmac=edquiano srcmac=01:00:5e:09:79:f2 crscore=11.231000 craction=taevitae crlevel=tevel eventtype=tatemse user=gitsed service=agn hostname=iqu7510.internal.corp profile=equeporr reqtype=amremap url=https://www5.example.org/aqu/utemvele.gif?serrorsi=tsedquia#rsit direction=unknown msg=ntutlabo method=idex cat=nihilmo catdesc=reetdo device_id=xeaco log_id=taliqu pri=medium userfrom=hite adminprof=umfugi timezone=CT main_type=dminimve trigger_policy=remips sub_type=laboreet severity_level=uptate policy=tot src=10.49.82.45 src_port=435 dst=10.179.153.97 dst_port=1908 http_method=ade http_url=nihilmol http_host=nder http_agent=ano http_session_id=rumexer signature_subclass=eab signature_id=2387 srccountry=saquaeab content_switch_name=eli server_pool_name=rissusci false_positive_mitigation=ectetur user_name=dictasun monitor_status=inimv http_refer=https://api.example.org/volup/untNeq.htm?mremaper=uteirur#ntium http_version=ide dev_id=quunturm threat_weight=quovo history_threat_weight=quaturve threat_level=ntiumdol ftp_mode=conse ftp_cmd=aturve cipher_suite=edqui msg_id=tvolu", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "iqu7510.internal.corp", + "http.request.referrer": "https://api.example.org/volup/untNeq.htm?mremaper=uteirur#ntium", + "input.type": "log", + "log.level": "medium", + "log.offset": 42910, + "network.bytes": 9908, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s6960", + "observer.ingress.interface.name": "enp0s7206", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.3804", + "related.ip": [ + "10.49.82.45", + "10.179.153.97" + ], + "related.user": [ + "dictasun" + ], + "rsa.internal.event_desc": "ntutlabo", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "tatemse", + "rsa.misc.OS": "eturadi", + "rsa.misc.action": [ + "ade", + "accept" + ], + "rsa.misc.category": "laboreet", + "rsa.misc.client": "ano", + "rsa.misc.context": "temseq", + "rsa.misc.event_source": "atcupi", + "rsa.misc.event_type": "uptateve", + "rsa.misc.fcatnum": "nihilmo", + "rsa.misc.filter": "reetdo", + "rsa.misc.hardware_id": "xeaco", + "rsa.misc.log_session_id": "rumexer", + "rsa.misc.policy_id": "ollitan", + "rsa.misc.policy_name": "tot", + "rsa.misc.reference_id": "taliqu", + "rsa.misc.rule_name": "equeporr", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 2387, + "rsa.misc.version": "1.3804", + "rsa.misc.vsys": "lorem", + "rsa.network.alias_host": [ + "iqu7510.internal.corp" + ], + "rsa.network.dinterface": "enp0s6960", + "rsa.network.network_service": "agn", + "rsa.network.sinterface": "enp0s7206", + "rsa.threat.threat_desc": "ntiumdol", + "rsa.time.duration_time": 0.684, + "rsa.time.event_time": "2017-07-25T11:47:41.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 11.231, + "rsa.web.web_ref_domain": "nder", + "rule.name": "equeporr", + "service.type": "fortinet", + "source.bytes": 3045, + "source.geo.country_name": "saquaeab", + "source.ip": [ + "10.49.82.45" + ], + "source.mac": "01:00:5e:09:79:f2", + "source.port": 435, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.org/aqu/utemvele.gif?serrorsi=tsedquia#rsit", + "url.query": "nihilmol", + "user.name": "dictasun" + }, + { + "@timestamp": "2017-08-08T06:50:15.000Z", + "destination.bytes": 722, + "destination.geo.country_name": "rumex", + "destination.ip": [ + "10.99.55.115" + ], + "destination.nat.ip": "10.205.83.138", + "destination.nat.port": 6239, + "destination.port": 1537, + "event.action": "accept", + "event.code": "iumto", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ore devname=\"lors\" devid=\"saute\" vd=ecillumd date=2017-8-8 time=4:50:15 logid=iumto type=sequatu subtype=tiumtot level=medium eventtime=mdoloree logtime=que srcip=10.98.52.184 srcport=7402 srcintf=eth3784 srcintfrole=ita dstip=10.99.55.115 dstport=1537 dstintf=eth855 dstintfrole=isnostru poluuid=iad sessionid=ngelits proto=tcp action=accept policyid=billoi policytype=reseo crscore=158.047000 craction=uov crlevel=pariat appcat=icaboNe service=boreetd srccountry=uir dstcountry=rumex trandisp=ectobea tranip=10.205.83.138 tranport=6239 duration=170.113000 sentbyte=3290 rcvdbyte=722 sentpkt=ibus app=lumdol", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 44420, + "network.bytes": 4012, + "observer.egress.interface.name": "eth855", + "observer.ingress.interface.name": "eth3784", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.205.83.138", + "10.99.55.115", + "10.98.52.184" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "tiumtot", + "rsa.misc.context": "ectobea", + "rsa.misc.event_source": "lors", + "rsa.misc.event_type": "sequatu", + "rsa.misc.hardware_id": "saute", + "rsa.misc.log_session_id": "ngelits", + "rsa.misc.obj_name": "lumdol", + "rsa.misc.policy_id": "billoi", + "rsa.misc.reference_id": "iumto", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ecillumd", + "rsa.network.dinterface": "eth855", + "rsa.network.network_service": "boreetd", + "rsa.network.sinterface": "eth3784", + "rsa.time.duration_time": 170.113, + "rsa.time.event_time": "2017-08-08T06:50:15.000Z", + "rsa.time.event_time_str": "mdoloree", + "rsa.web.reputation_num": 158.047, + "service.type": "fortinet", + "source.bytes": 3290, + "source.geo.country_name": "uir", + "source.ip": [ + "10.98.52.184" + ], + "source.port": 7402, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-08-22T13:52:50.000Z", + "destination.bytes": 422, + "destination.geo.country_name": "did", + "destination.ip": [ + "10.90.189.248" + ], + "destination.nat.ip": "10.228.11.50", + "destination.nat.port": 984, + "destination.port": 1293, + "event.action": "allow", + "event.code": "ptate", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=onnu devname=\"reprehe\" devid=\"metMa\" vd=emoen date=2017-8-22 time=11:52:50 logid=ptate type=mipsumqu subtype=turad level=high eventtime=billo logtime=doloremi srcip=10.197.128.162 srcport=2052 srcintf=lo6750 srcintfrole=ionof dstip=10.90.189.248 dstport=1293 dstintf=lo2402 dstintfrole=roi poluuid=reh sessionid=volup proto=prm action=allow policyid=iconsequ policytype=ueporr crscore=127.832000 craction=archite crlevel=tur appcat=ddo service=emp srccountry=inBC dstcountry=did trandisp=atcupi tranip=10.228.11.50 tranport=984 duration=3.401000 sentbyte=6907 rcvdbyte=422 sentpkt=mcol app=tion", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 45036, + "network.bytes": 7329, + "observer.egress.interface.name": "lo2402", + "observer.ingress.interface.name": "lo6750", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.228.11.50", + "10.90.189.248", + "10.197.128.162" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "turad", + "rsa.misc.context": "atcupi", + "rsa.misc.event_source": "reprehe", + "rsa.misc.event_type": "mipsumqu", + "rsa.misc.hardware_id": "metMa", + "rsa.misc.log_session_id": "volup", + "rsa.misc.obj_name": "tion", + "rsa.misc.policy_id": "iconsequ", + "rsa.misc.reference_id": "ptate", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "emoen", + "rsa.network.dinterface": "lo2402", + "rsa.network.network_service": "emp", + "rsa.network.sinterface": "lo6750", + "rsa.time.duration_time": 3.401, + "rsa.time.event_time": "2017-08-22T13:52:50.000Z", + "rsa.time.event_time_str": "billo", + "rsa.web.reputation_num": 127.832, + "service.type": "fortinet", + "source.bytes": 6907, + "source.geo.country_name": "inBC", + "source.ip": [ + "10.197.128.162" + ], + "source.port": 2052, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-09-06T08:55:24.000Z", + "event.action": "deny", + "event.code": "odit", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-9-6 time=6:55:24 devname=moll device_id=roinBCS log_id=odit type=event subtype=vol pri=low desc=aloru user=cteturad userfrom=modi msg=cip action=deny adom=ntoccae2859.www.test session_id=incididu", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 45638, + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.user": [ + "cteturad" + ], + "rsa.db.index": "cip", + "rsa.internal.event_desc": "aloru", + "rsa.internal.messageid": "event_fortinetmgr", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "vol", + "rsa.misc.event_source": "moll", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "roinBCS", + "rsa.misc.log_session_id": "incididu", + "rsa.misc.reference_id": "odit", + "rsa.misc.severity": "low", + "rsa.network.domain": "ntoccae2859.www.test", + "rsa.time.event_time": "2017-09-06T08:55:24.000Z", + "server.domain": "ntoccae2859.www.test", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "user.name": "cteturad" + }, + { + "@timestamp": "2017-09-20T03:57:58.000Z", + "destination.bytes": 6283, + "destination.ip": [ + "10.22.248.52" + ], + "destination.port": 6566, + "event.action": "cancel", + "event.code": "oreve", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-9-20 time=1:57:58 devname=uinesci device_id=otamr log_id=tsed type=generic subtype=rExc pri=medium devid=saute devname=umdol logid=rerepr type=ipiscin subtype=trudexe level=high vd=ineavol srcip=10.29.34.211 srcport=5638 srcintf=eth1805 dstip=10.161.15.82 dstport=6598 dstintf=enp0s5799 poluuid=aco sessionid=eFini proto=17 action=cancel policyid=mipsa trandisp=uas duration=118.122000 sentbyte=1737 rcvdbyte=6283 devtype=umexe osname=xce osversion=1.7318 mastersrcmac=suntex srcmac=01:00:5e:5b:68:89 crscore=29.865000 craction=rcitati crlevel=siutali eventtype=uiratio user=ficia service=orsit hostname=deFinibu3940.internal.lan profile=rautod reqtype=onorumet url=https://www5.example.com/etcon/chit.txt?erspici=itinvolu#adeserun direction=unknown msg=tinv method=Utenima cat=nse catdesc=umq device_id=enim log_id=oreve pri=low userfrom=snisiu adminprof=atem timezone=ET main_type=vento trigger_policy=litsed sub_type=ciun severity_level=rehender policy=tetura src=10.124.71.88 src_port=7540 dst=10.22.248.52 dst_port=6566 http_method=cons http_url=tinvolu http_host=ptat http_agent=amquisn http_session_id=Finibus signature_subclass=nsequat signature_id=3661 srccountry=scipi content_switch_name=rem server_pool_name=reh false_positive_mitigation=rsitame user_name=tcons monitor_status=squamest http_refer=https://mail.example.com/emveleum/siuta.html?ate=epteur#onproi http_version=usmodit dev_id=orese threat_weight=umdolore history_threat_weight=umqui threat_level=adipisci ftp_mode=eir ftp_cmd=ull cipher_suite=tlabor msg_id=itecto", + "event.timezone": "ET", + "fileset.name": "fortimanager", + "host.name": "deFinibu3940.internal.lan", + "http.request.referrer": "https://mail.example.com/emveleum/siuta.html?ate=epteur#onproi", + "input.type": "log", + "log.level": "low", + "log.offset": 45844, + "network.bytes": 8020, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s5799", + "observer.ingress.interface.name": "eth1805", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.7318", + "related.ip": [ + "10.124.71.88", + "10.22.248.52" + ], + "related.user": [ + "tcons" + ], + "rsa.internal.event_desc": "tinv", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "uiratio", + "rsa.misc.OS": "xce", + "rsa.misc.action": [ + "cancel", + "cons" + ], + "rsa.misc.category": "ciun", + "rsa.misc.client": "amquisn", + "rsa.misc.context": "uas", + "rsa.misc.event_source": "umdol", + "rsa.misc.event_type": "ipiscin", + "rsa.misc.fcatnum": "nse", + "rsa.misc.filter": "umq", + "rsa.misc.hardware_id": "enim", + "rsa.misc.log_session_id": "Finibus", + "rsa.misc.policy_id": "mipsa", + "rsa.misc.policy_name": "tetura", + "rsa.misc.reference_id": "oreve", + "rsa.misc.rule_name": "rautod", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 3661, + "rsa.misc.version": "1.7318", + "rsa.misc.vsys": "ineavol", + "rsa.network.alias_host": [ + "deFinibu3940.internal.lan" + ], + "rsa.network.dinterface": "enp0s5799", + "rsa.network.network_service": "orsit", + "rsa.network.sinterface": "eth1805", + "rsa.threat.threat_desc": "adipisci", + "rsa.time.duration_time": 118.122, + "rsa.time.event_time": "2017-09-20T03:57:58.000Z", + "rsa.time.timezone": "ET", + "rsa.web.reputation_num": 29.865, + "rsa.web.web_ref_domain": "ptat", + "rule.name": "rautod", + "service.type": "fortinet", + "source.bytes": 1737, + "source.geo.country_name": "scipi", + "source.ip": [ + "10.124.71.88" + ], + "source.mac": "01:00:5e:5b:68:89", + "source.port": 7540, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.com/etcon/chit.txt?erspici=itinvolu#adeserun", + "url.query": "tinvolu", + "user.name": "tcons" + }, + { + "@timestamp": "2017-10-04T11:00:32.000Z", + "destination.bytes": 6230, + "destination.ip": [ + "10.26.58.20" + ], + "destination.port": 2809, + "event.action": "block", + "event.code": "rchitect", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-10-4 time=9:00:32 logver=ametcons devid=velite devname=ipexeac logid=explicab type=samvolu subtype=teiru level=low vd=orinrep srcip=10.228.213.136 srcport=7247 srcintf=lo1719 dstip=10.185.107.27 dstport=2257 dstintf=enp0s4999 poluuid=iduntutl sessionid=mipsumd proto=udp action=block policyid=quelauda trandisp=rcit duration=166.303000 sentbyte=7229 rcvdbyte=6230 devtype=orese osname=evelite osversion=1.4895 mastersrcmac=oremipsu srcmac=01:00:5e:cd:f6:0e crscore=37.237000 craction=equunt crlevel=mto eventtype=iae user=dent service=Uten hostname=tatiset4191.localdomain profile=aconseq reqtype=mquamei url=https://api.example.org/fug/liquid.txt?ptate=lloi#nseq direction=external msg=isetqua method=ianonn cat=oluptas catdesc=doe device_id=quipex log_id=rchitect pri=very-high userfrom=Bonor adminprof=ipex timezone=PT main_type=upta trigger_policy=ivel sub_type=tmollita severity_level=tionofd policy=iatnula src=10.185.37.176 src_port=1859 dst=10.26.58.20 dst_port=2809 http_method=essequam http_url=undeo http_host=ficiade http_agent=uiinea http_session_id=uianonn signature_subclass=eavolupt signature_id=784 srccountry=elitsedq content_switch_name=liquam server_pool_name=sinto false_positive_mitigation=edi user_name=eumiure monitor_status=ore http_refer=https://internal.example.com/mSe/sis.gif?rchite=rcit#orumwri http_version=tiae dev_id=giat threat_weight=nculpa history_threat_weight=olupt threat_level=tvol ftp_mode=ostru ftp_cmd=mea cipher_suite=tuserror msg_id=agnama", + "event.timezone": "PT", + "fileset.name": "fortimanager", + "host.name": "tatiset4191.localdomain", + "http.request.referrer": "https://internal.example.com/mSe/sis.gif?rchite=rcit#orumwri", + "input.type": "log", + "log.level": "very-high", + "log.offset": 47392, + "network.bytes": 13459, + "network.direction": "external", + "observer.egress.interface.name": "enp0s4999", + "observer.ingress.interface.name": "lo1719", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4895", + "related.ip": [ + "10.185.37.176", + "10.26.58.20" + ], + "related.user": [ + "eumiure" + ], + "rsa.internal.event_desc": "isetqua", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "iae", + "rsa.misc.OS": "evelite", + "rsa.misc.action": [ + "essequam", + "block" + ], + "rsa.misc.category": "tmollita", + "rsa.misc.client": "uiinea", + "rsa.misc.context": "rcit", + "rsa.misc.event_source": "ipexeac", + "rsa.misc.event_type": "samvolu", + "rsa.misc.fcatnum": "oluptas", + "rsa.misc.filter": "doe", + "rsa.misc.hardware_id": "quipex", + "rsa.misc.log_session_id": "uianonn", + "rsa.misc.policy_id": "quelauda", + "rsa.misc.policy_name": "iatnula", + "rsa.misc.reference_id": "rchitect", + "rsa.misc.rule_name": "aconseq", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 784, + "rsa.misc.version": "1.4895", + "rsa.misc.vsys": "orinrep", + "rsa.network.alias_host": [ + "tatiset4191.localdomain" + ], + "rsa.network.dinterface": "enp0s4999", + "rsa.network.network_service": "Uten", + "rsa.network.sinterface": "lo1719", + "rsa.threat.threat_desc": "tvol", + "rsa.time.duration_time": 166.303, + "rsa.time.event_time": "2017-10-04T11:00:32.000Z", + "rsa.time.timezone": "PT", + "rsa.web.reputation_num": 37.237, + "rsa.web.web_ref_domain": "ficiade", + "rule.name": "aconseq", + "service.type": "fortinet", + "source.bytes": 7229, + "source.geo.country_name": "elitsedq", + "source.ip": [ + "10.185.37.176" + ], + "source.mac": "01:00:5e:cd:f6:0e", + "source.port": 1859, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.org/fug/liquid.txt?ptate=lloi#nseq", + "url.query": "undeo", + "user.name": "eumiure" + }, + { + "@timestamp": "2017-10-19T06:03:07.000Z", + "destination.bytes": 5047, + "destination.geo.country_name": "nven", + "destination.ip": [ + "10.14.145.107" + ], + "destination.nat.ip": "10.250.231.196", + "destination.nat.port": 5863, + "destination.port": 4362, + "event.action": "block", + "event.code": "nostr", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=deritq dtime=2017-10-19 04:03:07.172538723 +0000 UTC devid=boreetdo devname=teni vd=iin date=2017-10-19 time=4:03:07 logid=nostr type=luptatem subtype=tNequepo level=low eventtime=eumfug logtime=sper srcip=10.200.12.126 srcport=2347 srcintf=enp0s7374 srcintfrole=liqu dstip=10.14.145.107 dstport=4362 dstintf=enp0s7861 dstintfrole=aliq poluuid=utem sessionid=oreetd proto=HOPOPT action=block policyid=Nequepo policytype=edictas crscore=55.933000 craction=tur crlevel=borisnis appcat=elitsedd service=hitecto srccountry=loremi dstcountry=nven trandisp=isci tranip=10.250.231.196 tranport=5863 duration=4.105000 sentbyte=2763 rcvdbyte=5047 sentpkt=aquioff app=cip", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 48887, + "network.bytes": 7810, + "observer.egress.interface.name": "enp0s7861", + "observer.ingress.interface.name": "enp0s7374", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.14.145.107", + "10.250.231.196", + "10.200.12.126" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "tNequepo", + "rsa.misc.context": "isci", + "rsa.misc.event_source": "teni", + "rsa.misc.event_type": "luptatem", + "rsa.misc.hardware_id": "boreetdo", + "rsa.misc.log_session_id": "oreetd", + "rsa.misc.obj_name": "cip", + "rsa.misc.policy_id": "Nequepo", + "rsa.misc.reference_id": "nostr", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "iin", + "rsa.network.dinterface": "enp0s7861", + "rsa.network.network_service": "hitecto", + "rsa.network.sinterface": "enp0s7374", + "rsa.time.duration_time": 4.105, + "rsa.time.event_time": "2017-10-19T06:03:07.000Z", + "rsa.time.event_time_str": "eumfug", + "rsa.web.reputation_num": 55.933, + "service.type": "fortinet", + "source.bytes": 2763, + "source.geo.country_name": "loremi", + "source.ip": [ + "10.200.12.126" + ], + "source.port": 2347, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-11-02T13:05:41.000Z", + "destination.bytes": 2565, + "destination.geo.country_name": "fugia", + "destination.ip": [ + "10.21.203.112" + ], + "destination.nat.ip": "10.103.36.192", + "destination.nat.port": 1974, + "destination.port": 5930, + "event.action": "cancel", + "event.code": "tura", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=onsequat dtime=2017-11-02 11:05:41.432538723 +0000 UTC devid=tiumd devname=atuse vd=imad date=2017-11-2 time=11:05:41 logid=tura type=equuntur subtype=rve level=high eventtime=mqua logtime=xer srcip=10.225.34.176 srcport=5569 srcintf=lo2867 srcintfrole=amquisn dstip=10.21.203.112 dstport=5930 dstintf=enp0s1294 dstintfrole=sum poluuid=lloinve sessionid=eni proto=HOPOPT action=cancel policyid=edquiac policytype=psamvolu crscore=80.314000 craction=unturma crlevel=iavol appcat=psumdol service=urautodi srccountry=equamni dstcountry=fugia trandisp=uptate tranip=10.103.36.192 tranport=1974 duration=129.001000 sentbyte=2801 rcvdbyte=2565 sentpkt=imidest app=citation", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 49556, + "network.bytes": 5366, + "observer.egress.interface.name": "enp0s1294", + "observer.ingress.interface.name": "lo2867", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.225.34.176", + "10.21.203.112", + "10.103.36.192" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "rve", + "rsa.misc.context": "uptate", + "rsa.misc.event_source": "atuse", + "rsa.misc.event_type": "equuntur", + "rsa.misc.hardware_id": "tiumd", + "rsa.misc.log_session_id": "eni", + "rsa.misc.obj_name": "citation", + "rsa.misc.policy_id": "edquiac", + "rsa.misc.reference_id": "tura", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "imad", + "rsa.network.dinterface": "enp0s1294", + "rsa.network.network_service": "urautodi", + "rsa.network.sinterface": "lo2867", + "rsa.time.duration_time": 129.001, + "rsa.time.event_time": "2017-11-02T13:05:41.000Z", + "rsa.time.event_time_str": "mqua", + "rsa.web.reputation_num": 80.314, + "service.type": "fortinet", + "source.bytes": 2801, + "source.geo.country_name": "equamni", + "source.ip": [ + "10.225.34.176" + ], + "source.port": 5569, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-11-16T08:08:15.000Z", + "destination.bytes": 6222, + "destination.geo.country_name": "roid", + "destination.ip": [ + "10.5.67.140" + ], + "destination.nat.ip": "10.118.111.183", + "destination.nat.port": 5410, + "destination.port": 5687, + "event.action": "accept", + "event.code": "dexea", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=nof devname=\"usantiu\" devid=\"periam\" vd=remip date=2017-11-16 time=6:08:15 logid=dexea type=aturExc subtype=antiumto level=low eventtime=obe logtime=niamqu srcip=10.140.59.161 srcport=3599 srcintf=eth575 srcintfrole=tev dstip=10.5.67.140 dstport=5687 dstintf=enp0s6143 dstintfrole=intoc poluuid=obeataev sessionid=rrorsit proto=udp action=accept policyid=umquid policytype=olabo crscore=79.046000 craction=dolor crlevel=rsp appcat=quir service=giatqu srccountry=olors dstcountry=roid trandisp=lorum tranip=10.118.111.183 tranport=5410 duration=96.462000 sentbyte=6821 rcvdbyte=6222 sentpkt=mipsu app=nvol", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 50230, + "network.bytes": 13043, + "observer.egress.interface.name": "enp0s6143", + "observer.ingress.interface.name": "eth575", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.140.59.161", + "10.118.111.183", + "10.5.67.140" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "antiumto", + "rsa.misc.context": "lorum", + "rsa.misc.event_source": "usantiu", + "rsa.misc.event_type": "aturExc", + "rsa.misc.hardware_id": "periam", + "rsa.misc.log_session_id": "rrorsit", + "rsa.misc.obj_name": "nvol", + "rsa.misc.policy_id": "umquid", + "rsa.misc.reference_id": "dexea", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "remip", + "rsa.network.dinterface": "enp0s6143", + "rsa.network.network_service": "giatqu", + "rsa.network.sinterface": "eth575", + "rsa.time.duration_time": 96.462, + "rsa.time.event_time": "2017-11-16T08:08:15.000Z", + "rsa.time.event_time_str": "obe", + "rsa.web.reputation_num": 79.046, + "service.type": "fortinet", + "source.bytes": 6821, + "source.geo.country_name": "olors", + "source.ip": [ + "10.140.59.161" + ], + "source.port": 3599, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-01T03:10:49.000Z", + "destination.bytes": 5351, + "destination.ip": [ + "10.28.212.191" + ], + "destination.port": 1997, + "event.action": "accept", + "event.code": "abillo", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-12-1 time=1:10:49 logver=llu devid=quaUt devname=labor logid=oris type=tatemse subtype=uta level=very-high vd=tse srcip=10.170.104.148 srcport=5722 srcintf=lo259 dstip=10.60.92.40 dstport=5836 dstintf=enp0s4446 poluuid=dicons sessionid=BCSedutp proto=udp action=accept policyid=ritatise trandisp=nihilm duration=104.607000 sentbyte=6659 rcvdbyte=5351 devtype=isauteir osname=eritquii osversion=1.4493 mastersrcmac=uisno srcmac=01:00:5e:e9:ec:d5 crscore=34.736000 craction=itaed crlevel=invol eventtype=Loremips user=cidun service=tassitas hostname=nimadmi4084.api.home profile=eufugia reqtype=nor url=https://example.net/aturQui/tquii.html?uiac=squ#litess direction=unknown msg=involupt method=itempo cat=upt catdesc=rve device_id=amq log_id=abillo pri=high userfrom=ationem adminprof=Nem timezone=OMST main_type=ollita trigger_policy=dipisci sub_type=amnisiu severity_level=ptat policy=epr src=10.7.70.169 src_port=2514 dst=10.28.212.191 dst_port=1997 http_method=nostru http_url=Loremip http_host=veleumiu http_agent=rcita http_session_id=turad signature_subclass=sequamni signature_id=4799 srccountry=ollita content_switch_name=ectetu server_pool_name=radi false_positive_mitigation=ula user_name=itsed monitor_status=rad http_refer=https://internal.example.com/ididu/autodit.gif?seru=oriss#imadmin http_version=suntexpl dev_id=urve threat_weight=sBonoru history_threat_weight=everi threat_level=squ ftp_mode=emagnaal ftp_cmd=nih cipher_suite=ncididu msg_id=itati", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "nimadmi4084.api.home", + "http.request.referrer": "https://internal.example.com/ididu/autodit.gif?seru=oriss#imadmin", + "input.type": "log", + "log.level": "high", + "log.offset": 50842, + "network.bytes": 12010, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s4446", + "observer.ingress.interface.name": "lo259", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4493", + "related.ip": [ + "10.7.70.169", + "10.28.212.191" + ], + "related.user": [ + "itsed" + ], + "rsa.internal.event_desc": "involupt", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "Loremips", + "rsa.misc.OS": "eritquii", + "rsa.misc.action": [ + "nostru", + "accept" + ], + "rsa.misc.category": "amnisiu", + "rsa.misc.client": "rcita", + "rsa.misc.context": "nihilm", + "rsa.misc.event_source": "labor", + "rsa.misc.event_type": "tatemse", + "rsa.misc.fcatnum": "upt", + "rsa.misc.filter": "rve", + "rsa.misc.hardware_id": "amq", + "rsa.misc.log_session_id": "turad", + "rsa.misc.policy_id": "ritatise", + "rsa.misc.policy_name": "epr", + "rsa.misc.reference_id": "abillo", + "rsa.misc.rule_name": "eufugia", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 4799, + "rsa.misc.version": "1.4493", + "rsa.misc.vsys": "tse", + "rsa.network.alias_host": [ + "nimadmi4084.api.home" + ], + "rsa.network.dinterface": "enp0s4446", + "rsa.network.network_service": "tassitas", + "rsa.network.sinterface": "lo259", + "rsa.threat.threat_desc": "squ", + "rsa.time.duration_time": 104.607, + "rsa.time.event_time": "2017-12-01T03:10:49.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 34.736, + "rsa.web.web_ref_domain": "veleumiu", + "rule.name": "eufugia", + "service.type": "fortinet", + "source.bytes": 6659, + "source.geo.country_name": "ollita", + "source.ip": [ + "10.7.70.169" + ], + "source.mac": "01:00:5e:e9:ec:d5", + "source.port": 2514, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.net/aturQui/tquii.html?uiac=squ#litess", + "url.query": "Loremip", + "user.name": "itsed" + }, + { + "@timestamp": "2017-12-15T10:13:24.000Z", + "destination.bytes": 7417, + "destination.ip": [ + "10.143.144.52" + ], + "destination.port": 974, + "event.action": "block", + "event.code": "iqu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2017-12-15 time=8:13:24 logver=estla devid=ione devname=ecillum logid=maccu type=ame subtype=pitlabo level=very-high vd=urExc srcip=10.37.124.214 srcport=6919 srcintf=lo7727 dstip=10.37.111.228 dstport=7082 dstintf=enp0s20 poluuid=dmini sessionid=tquid proto=17 action=block policyid=iatisun trandisp=cto duration=144.899000 sentbyte=2372 rcvdbyte=7417 devtype=imadmini osname=iatisund osversion=1.6506 mastersrcmac=aUtenim srcmac=01:00:5e:28:0c:11 crscore=172.422000 craction=etdol crlevel=sed eventtype=uep user=ametco service=nde hostname=reprehe3525.www5.example profile=mquisno reqtype=eaco url=https://mail.example.org/mvele/teveli.htm?Nequepor=luptate#aturvel direction=internal msg=dexea method=sedquia cat=litesse catdesc=ntmo device_id=aliqu log_id=iqu pri=very-high userfrom=ationula adminprof=doconse timezone=CEST main_type=oreeufug trigger_policy=ptatems sub_type=tenima severity_level=emagnam policy=iaco src=10.148.197.60 src_port=5711 dst=10.143.144.52 dst_port=974 http_method=nvo http_url=lab http_host=sedqui http_agent=iuntNe http_session_id=tdolor signature_subclass=Ute signature_id=2191 srccountry=uepor content_switch_name=umSecti server_pool_name=eabil false_positive_mitigation=ibusB user_name=rporis monitor_status=etco http_refer=https://example.org/ereprehe/olu.html?liqu=ipsu#siarch http_version=itautfu dev_id=rrorsi threat_weight=ole history_threat_weight=odi threat_level=tper ftp_mode=olor ftp_cmd=corpo cipher_suite=commod msg_id=iumd", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "reprehe3525.www5.example", + "http.request.referrer": "https://example.org/ereprehe/olu.html?liqu=ipsu#siarch", + "input.type": "log", + "log.level": "very-high", + "log.offset": 52319, + "network.bytes": 9789, + "network.direction": "internal", + "observer.egress.interface.name": "enp0s20", + "observer.ingress.interface.name": "lo7727", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.6506", + "related.ip": [ + "10.143.144.52", + "10.148.197.60" + ], + "related.user": [ + "rporis" + ], + "rsa.internal.event_desc": "dexea", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "uep", + "rsa.misc.OS": "iatisund", + "rsa.misc.action": [ + "nvo", + "block" + ], + "rsa.misc.category": "tenima", + "rsa.misc.client": "iuntNe", + "rsa.misc.context": "cto", + "rsa.misc.event_source": "ecillum", + "rsa.misc.event_type": "ame", + "rsa.misc.fcatnum": "litesse", + "rsa.misc.filter": "ntmo", + "rsa.misc.hardware_id": "aliqu", + "rsa.misc.log_session_id": "tdolor", + "rsa.misc.policy_id": "iatisun", + "rsa.misc.policy_name": "iaco", + "rsa.misc.reference_id": "iqu", + "rsa.misc.rule_name": "mquisno", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 2191, + "rsa.misc.version": "1.6506", + "rsa.misc.vsys": "urExc", + "rsa.network.alias_host": [ + "reprehe3525.www5.example" + ], + "rsa.network.dinterface": "enp0s20", + "rsa.network.network_service": "nde", + "rsa.network.sinterface": "lo7727", + "rsa.threat.threat_desc": "tper", + "rsa.time.duration_time": 144.899, + "rsa.time.event_time": "2017-12-15T10:13:24.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 172.422, + "rsa.web.web_ref_domain": "sedqui", + "rule.name": "mquisno", + "service.type": "fortinet", + "source.bytes": 2372, + "source.geo.country_name": "uepor", + "source.ip": [ + "10.148.197.60" + ], + "source.mac": "01:00:5e:28:0c:11", + "source.port": 5711, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/mvele/teveli.htm?Nequepor=luptate#aturvel", + "url.query": "lab", + "user.name": "rporis" + }, + { + "@timestamp": "2017-12-29T05:15:58.000Z", + "destination.bytes": 7299, + "destination.geo.country_name": "ciad", + "destination.ip": [ + "10.22.149.132" + ], + "destination.nat.ip": "10.251.183.113", + "destination.nat.port": 2604, + "destination.port": 7725, + "event.action": "block", + "event.code": "bor", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=aborisn dtime=2017-12-29 15:15:58.472538723 +0000 UTC devid=onproid devname=sitv vd=equam date=2017-12-29 time=3:15:58 logid=bor type=ameaquei subtype=aeca level=very-high eventtime=aperiam logtime=ngelit srcip=10.217.145.137 srcport=5242 srcintf=enp0s6940 srcintfrole=orema dstip=10.22.149.132 dstport=7725 dstintf=lo7156 dstintfrole=neavolup poluuid=lits sessionid=Nemoen proto=0 action=block policyid=rur policytype=quaturve crscore=166.007000 craction=oeiusmod crlevel=uidolore appcat=iacon service=ncu srccountry=quaturve dstcountry=ciad trandisp=diconseq tranip=10.251.183.113 tranport=2604 duration=161.433000 sentbyte=5697 rcvdbyte=7299 sentpkt=eseosqu app=uptatem", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 53795, + "network.bytes": 12996, + "observer.egress.interface.name": "lo7156", + "observer.ingress.interface.name": "enp0s6940", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.22.149.132", + "10.217.145.137", + "10.251.183.113" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "aeca", + "rsa.misc.context": "diconseq", + "rsa.misc.event_source": "sitv", + "rsa.misc.event_type": "ameaquei", + "rsa.misc.hardware_id": "onproid", + "rsa.misc.log_session_id": "Nemoen", + "rsa.misc.obj_name": "uptatem", + "rsa.misc.policy_id": "rur", + "rsa.misc.reference_id": "bor", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "equam", + "rsa.network.dinterface": "lo7156", + "rsa.network.network_service": "ncu", + "rsa.network.sinterface": "enp0s6940", + "rsa.time.duration_time": 161.433, + "rsa.time.event_time": "2017-12-29T05:15:58.000Z", + "rsa.time.event_time_str": "aperiam", + "rsa.web.reputation_num": 166.007, + "service.type": "fortinet", + "source.bytes": 5697, + "source.geo.country_name": "quaturve", + "source.ip": [ + "10.217.145.137" + ], + "source.port": 5242, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-01-12T12:18:32.000Z", + "destination.bytes": 1519, + "destination.geo.country_name": "iarchit", + "destination.ip": [ + "10.203.66.175" + ], + "destination.nat.ip": "10.51.60.203", + "destination.nat.port": 5315, + "destination.port": 3904, + "event.action": "accept", + "event.code": "mfugi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=uamnihil devname=\"nisi\" devid=\"imadm\" vd=siutali date=2018-1-12 time=10:18:32 logid=mfugi type=ceroinBC subtype=lorumw level=low eventtime=squir logtime=commod srcip=10.183.16.252 srcport=3150 srcintf=lo6718 srcintfrole=eabillo dstip=10.203.66.175 dstport=3904 dstintf=enp0s3868 dstintfrole=dipisciv poluuid=nsequun sessionid=hen proto=icmp action=accept policyid=velillum policytype=itamet crscore=123.013000 craction=hil crlevel=itl appcat=idolo service=ncidid srccountry=oid dstcountry=iarchit trandisp=volupt tranip=10.51.60.203 tranport=5315 duration=165.955000 sentbyte=7551 rcvdbyte=1519 sentpkt=ten app=Utenim", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 54475, + "network.bytes": 9070, + "observer.egress.interface.name": "enp0s3868", + "observer.ingress.interface.name": "lo6718", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.203.66.175", + "10.51.60.203", + "10.183.16.252" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "lorumw", + "rsa.misc.context": "volupt", + "rsa.misc.event_source": "nisi", + "rsa.misc.event_type": "ceroinBC", + "rsa.misc.hardware_id": "imadm", + "rsa.misc.log_session_id": "hen", + "rsa.misc.obj_name": "Utenim", + "rsa.misc.policy_id": "velillum", + "rsa.misc.reference_id": "mfugi", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "siutali", + "rsa.network.dinterface": "enp0s3868", + "rsa.network.network_service": "ncidid", + "rsa.network.sinterface": "lo6718", + "rsa.time.duration_time": 165.955, + "rsa.time.event_time": "2018-01-12T12:18:32.000Z", + "rsa.time.event_time_str": "squir", + "rsa.web.reputation_num": 123.013, + "service.type": "fortinet", + "source.bytes": 7551, + "source.geo.country_name": "oid", + "source.ip": [ + "10.183.16.252" + ], + "source.port": 3150, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-01-27T07:21:06.000Z", + "destination.bytes": 6650, + "destination.ip": [ + "10.61.200.105" + ], + "destination.port": 2813, + "event.action": "accept", + "event.code": "orinc", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-1-27 time=5:21:06 logver=uasiarch devid=iamquisn devname=magnama logid=reprehe type=citatio subtype=dolo level=medium vd=esciunt srcip=10.133.245.26 srcport=1727 srcintf=enp0s2674 dstip=10.76.87.30 dstport=2858 dstintf=enp0s2918 poluuid=remag sessionid=roinBCSe proto=HOPOPT action=accept policyid=labori trandisp=ditau duration=39.920000 sentbyte=5413 rcvdbyte=6650 devtype=tam osname=olu osversion=1.409 mastersrcmac=iut srcmac=01:00:5e:5c:c2:50 crscore=69.137000 craction=boris crlevel=ris eventtype=nisiuta user=utper service=uipexe hostname=ursint411.www.lan profile=gnamali reqtype=iumdo url=https://example.org/tem/iadeseru.jpg?olorsita=odoco#etc direction=internal msg=lamco method=natuser cat=Excepteu catdesc=omnis device_id=tati log_id=orinc pri=very-high userfrom=eturadi adminprof=cinge timezone=PT main_type=ira trigger_policy=niamq sub_type=quatD severity_level=nevol policy=lumquid src=10.157.14.165 src_port=7170 dst=10.61.200.105 dst_port=2813 http_method=tquov http_url=natu http_host=doei http_agent=acomm http_session_id=veleumi signature_subclass=volupt signature_id=6822 srccountry=itatise content_switch_name=ure server_pool_name=userro false_positive_mitigation=oree user_name=nimadmi monitor_status=utaliq http_refer=https://example.com/tinvolu/uredol.txt?did=lamcol#idolor http_version=tutlabor dev_id=nse threat_weight=rauto history_threat_weight=rese threat_level=nonproi ftp_mode=doconse ftp_cmd=henderi cipher_suite=tisunde msg_id=ende", + "event.timezone": "PT", + "fileset.name": "fortimanager", + "host.name": "ursint411.www.lan", + "http.request.referrer": "https://example.com/tinvolu/uredol.txt?did=lamcol#idolor", + "input.type": "log", + "log.level": "very-high", + "log.offset": 55100, + "network.bytes": 12063, + "network.direction": "internal", + "observer.egress.interface.name": "enp0s2918", + "observer.ingress.interface.name": "enp0s2674", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.409", + "related.ip": [ + "10.61.200.105", + "10.157.14.165" + ], + "related.user": [ + "nimadmi" + ], + "rsa.internal.event_desc": "lamco", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "nisiuta", + "rsa.misc.OS": "olu", + "rsa.misc.action": [ + "accept", + "tquov" + ], + "rsa.misc.category": "quatD", + "rsa.misc.client": "acomm", + "rsa.misc.context": "ditau", + "rsa.misc.event_source": "magnama", + "rsa.misc.event_type": "citatio", + "rsa.misc.fcatnum": "Excepteu", + "rsa.misc.filter": "omnis", + "rsa.misc.hardware_id": "tati", + "rsa.misc.log_session_id": "veleumi", + "rsa.misc.policy_id": "labori", + "rsa.misc.policy_name": "lumquid", + "rsa.misc.reference_id": "orinc", + "rsa.misc.rule_name": "gnamali", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 6822, + "rsa.misc.version": "1.409", + "rsa.misc.vsys": "esciunt", + "rsa.network.alias_host": [ + "ursint411.www.lan" + ], + "rsa.network.dinterface": "enp0s2918", + "rsa.network.network_service": "uipexe", + "rsa.network.sinterface": "enp0s2674", + "rsa.threat.threat_desc": "nonproi", + "rsa.time.duration_time": 39.92, + "rsa.time.event_time": "2018-01-27T07:21:06.000Z", + "rsa.time.timezone": "PT", + "rsa.web.reputation_num": 69.137, + "rsa.web.web_ref_domain": "doei", + "rule.name": "gnamali", + "service.type": "fortinet", + "source.bytes": 5413, + "source.geo.country_name": "itatise", + "source.ip": [ + "10.157.14.165" + ], + "source.mac": "01:00:5e:5c:c2:50", + "source.port": 7170, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.org/tem/iadeseru.jpg?olorsita=odoco#etc", + "url.query": "natu", + "user.name": "nimadmi" + }, + { + "@timestamp": "2018-02-10T14:23:41.000Z", + "destination.bytes": 5375, + "destination.ip": [ + "10.217.111.77" + ], + "destination.port": 7309, + "event.action": "allow", + "event.code": "entoreve", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-2-10 time=12:23:41 logver=commod devid=oris devname=rcita logid=ataev type=oris subtype=incidi level=high vd=tutlabo srcip=10.32.66.161 srcport=881 srcintf=lo4523 dstip=10.134.238.8 dstport=2976 dstintf=enp0s1238 poluuid=edquiac sessionid=sit proto=HOPOPT action=allow policyid=olo trandisp=laboris duration=163.866000 sentbyte=7328 rcvdbyte=5375 devtype=tutl osname=nevolu osversion=1.5475 mastersrcmac=ostru srcmac=01:00:5e:e9:5f:84 crscore=157.516000 craction=aven crlevel=idolore eventtype=psaqu user=psa service=pta hostname=ididunt7607.mail.localhost profile=ntutlabo reqtype=leumiure url=https://mail.example.net/epteurs/usmodtem.gif?itvo=asi#tobe direction=internal msg=Lore method=oin cat=eritquii catdesc=taliqui device_id=ecatcu log_id=entoreve pri=high userfrom=umquam adminprof=onev timezone=CET main_type=tionev trigger_policy=ali sub_type=ionu severity_level=perna policy=moll src=10.242.178.15 src_port=3948 dst=10.217.111.77 dst_port=7309 http_method=datatno http_url=equepor http_host=antium http_agent=ugiatn http_session_id=utpe signature_subclass=hend signature_id=1170 srccountry=agnamali content_switch_name=ptateve server_pool_name=aliqua false_positive_mitigation=officiad user_name=nimadmin monitor_status=iavol http_refer=https://example.net/iumtota/qui.jpg?quel=ugitsed#ritatis http_version=olor dev_id=emoenim threat_weight=turadipi history_threat_weight=umSec threat_level=onsecte ftp_mode=inibusBo ftp_cmd=tqui cipher_suite=sequun msg_id=nimadm", + "event.timezone": "CET", + "fileset.name": "fortimanager", + "host.name": "ididunt7607.mail.localhost", + "http.request.referrer": "https://example.net/iumtota/qui.jpg?quel=ugitsed#ritatis", + "input.type": "log", + "log.level": "high", + "log.offset": 56577, + "network.bytes": 12703, + "network.direction": "internal", + "observer.egress.interface.name": "enp0s1238", + "observer.ingress.interface.name": "lo4523", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.5475", + "related.ip": [ + "10.242.178.15", + "10.217.111.77" + ], + "related.user": [ + "nimadmin" + ], + "rsa.internal.event_desc": "Lore", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "psaqu", + "rsa.misc.OS": "nevolu", + "rsa.misc.action": [ + "datatno", + "allow" + ], + "rsa.misc.category": "ionu", + "rsa.misc.client": "ugiatn", + "rsa.misc.context": "laboris", + "rsa.misc.event_source": "rcita", + "rsa.misc.event_type": "oris", + "rsa.misc.fcatnum": "eritquii", + "rsa.misc.filter": "taliqui", + "rsa.misc.hardware_id": "ecatcu", + "rsa.misc.log_session_id": "utpe", + "rsa.misc.policy_id": "olo", + "rsa.misc.policy_name": "moll", + "rsa.misc.reference_id": "entoreve", + "rsa.misc.rule_name": "ntutlabo", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 1170, + "rsa.misc.version": "1.5475", + "rsa.misc.vsys": "tutlabo", + "rsa.network.alias_host": [ + "ididunt7607.mail.localhost" + ], + "rsa.network.dinterface": "enp0s1238", + "rsa.network.network_service": "pta", + "rsa.network.sinterface": "lo4523", + "rsa.threat.threat_desc": "onsecte", + "rsa.time.duration_time": 163.866, + "rsa.time.event_time": "2018-02-10T14:23:41.000Z", + "rsa.time.timezone": "CET", + "rsa.web.reputation_num": 157.516, + "rsa.web.web_ref_domain": "antium", + "rule.name": "ntutlabo", + "service.type": "fortinet", + "source.bytes": 7328, + "source.geo.country_name": "agnamali", + "source.ip": [ + "10.242.178.15" + ], + "source.mac": "01:00:5e:e9:5f:84", + "source.port": 3948, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.net/epteurs/usmodtem.gif?itvo=asi#tobe", + "url.query": "equepor", + "user.name": "nimadmin" + }, + { + "@timestamp": "2018-02-24T09:26:15.000Z", + "destination.bytes": 6059, + "destination.ip": [ + "10.86.152.227" + ], + "destination.port": 850, + "event.action": "cancel", + "event.code": "onsec", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-2-24 time=7:26:15 logver=vitaedic devid=remip devname=rsita logid=rehe type=aper subtype=gnaa level=low vd=uta srcip=10.161.128.235 srcport=6280 srcintf=eth2121 dstip=10.84.29.117 dstport=1245 dstintf=eth7500 poluuid=errorsi sessionid=umwr proto=HOPOPT action=cancel policyid=cupida trandisp=rinc duration=5.709000 sentbyte=289 rcvdbyte=6059 devtype=dquia osname=ommod osversion=1.142 mastersrcmac=dico srcmac=01:00:5e:06:53:8a crscore=35.836000 craction=imipsa crlevel=iscinge eventtype=ora user=meumfug service=inimve hostname=mco2906.domain profile=sitvolu reqtype=eratv url=https://www.example.com/iadolo/cidu.txt?aliquide=redolori#eav direction=inbound msg=nse method=turQuis cat=tat catdesc=pta device_id=henderi log_id=onsec pri=high userfrom=itaspern adminprof=tau timezone=GMT+02:00 main_type=rsintoc trigger_policy=boreetd sub_type=rehende severity_level=sitamet policy=xerc src=10.199.119.251 src_port=7286 dst=10.86.152.227 dst_port=850 http_method=ant http_url=tiu http_host=ommodoco http_agent=rehe http_session_id=eseosqu signature_subclass=oeius signature_id=641 srccountry=eaqueip content_switch_name=laud server_pool_name=uido false_positive_mitigation=uis user_name=msequin monitor_status=autem http_refer=https://internal.example.org/ipi/qua.htm?itat=adipisc#omnisist http_version=orroqui dev_id=sci threat_weight=psamvolu history_threat_weight=itsedqui threat_level=oreve ftp_mode=omn ftp_cmd=onevol cipher_suite=ese msg_id=reprehen", + "event.timezone": "GMT+02:00", + "fileset.name": "fortimanager", + "host.name": "mco2906.domain", + "http.request.referrer": "https://internal.example.org/ipi/qua.htm?itat=adipisc#omnisist", + "input.type": "log", + "log.level": "high", + "log.offset": 58063, + "network.bytes": 6348, + "network.direction": "inbound", + "observer.egress.interface.name": "eth7500", + "observer.ingress.interface.name": "eth2121", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.142", + "related.ip": [ + "10.199.119.251", + "10.86.152.227" + ], + "related.user": [ + "msequin" + ], + "rsa.internal.event_desc": "nse", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "ora", + "rsa.misc.OS": "ommod", + "rsa.misc.action": [ + "ant", + "cancel" + ], + "rsa.misc.category": "rehende", + "rsa.misc.client": "rehe", + "rsa.misc.context": "rinc", + "rsa.misc.event_source": "rsita", + "rsa.misc.event_type": "aper", + "rsa.misc.fcatnum": "tat", + "rsa.misc.filter": "pta", + "rsa.misc.hardware_id": "henderi", + "rsa.misc.log_session_id": "eseosqu", + "rsa.misc.policy_id": "cupida", + "rsa.misc.policy_name": "xerc", + "rsa.misc.reference_id": "onsec", + "rsa.misc.rule_name": "sitvolu", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 641, + "rsa.misc.version": "1.142", + "rsa.misc.vsys": "uta", + "rsa.network.alias_host": [ + "mco2906.domain" + ], + "rsa.network.dinterface": "eth7500", + "rsa.network.network_service": "inimve", + "rsa.network.sinterface": "eth2121", + "rsa.threat.threat_desc": "oreve", + "rsa.time.duration_time": 5.709, + "rsa.time.event_time": "2018-02-24T09:26:15.000Z", + "rsa.time.timezone": "GMT+02:00", + "rsa.web.reputation_num": 35.836, + "rsa.web.web_ref_domain": "ommodoco", + "rule.name": "sitvolu", + "service.type": "fortinet", + "source.bytes": 289, + "source.geo.country_name": "eaqueip", + "source.ip": [ + "10.199.119.251" + ], + "source.mac": "01:00:5e:06:53:8a", + "source.port": 7286, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.com/iadolo/cidu.txt?aliquide=redolori#eav", + "url.query": "tiu", + "user.name": "msequin" + }, + { + "@timestamp": "2018-03-11T04:28:49.000Z", + "destination.bytes": 3374, + "destination.ip": [ + "10.234.171.117" + ], + "destination.port": 4488, + "event.action": "deny", + "event.code": "quian", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-3-11 time=2:28:49 logver=eumfugia devid=nimvenia devname=dol logid=rissusc type=lit subtype=quin level=low vd=eddoei srcip=10.35.73.208 srcport=7081 srcintf=eth6552 dstip=10.216.120.61 dstport=6389 dstintf=eth2068 poluuid=dolor sessionid=emUteni proto=tcp action=deny policyid=illoin trandisp=rinre duration=166.295000 sentbyte=5988 rcvdbyte=3374 devtype=olorem osname=mquae osversion=1.1789 mastersrcmac=rQuis srcmac=01:00:5e:b5:9a:3e crscore=5.250000 craction=enimadmi crlevel=elit eventtype=uia user=tem service=unt hostname=ntex5135.corp profile=mqua reqtype=equa url=https://internal.example.com/isc/umdol.jpg?atn=sectet#boreetd direction=outbound msg=olorin method=oluptat cat=olors catdesc=mSecti device_id=ius log_id=quian pri=low userfrom=urExce adminprof=upt timezone=PST main_type=pteurs trigger_policy=intocc sub_type=abo severity_level=orisnis policy=reseo src=10.239.194.105 src_port=3629 dst=10.234.171.117 dst_port=4488 http_method=tenatus http_url=odic http_host=ono http_agent=umtota http_session_id=consequ signature_subclass=ine signature_id=3409 srccountry=dex content_switch_name=ipis server_pool_name=nsecte false_positive_mitigation=miurere user_name=tat monitor_status=pitlabor http_refer=https://example.com/olupta/ape.jpg?mnisiut=eabil#olu http_version=uaUte dev_id=empor threat_weight=ate history_threat_weight=eca threat_level=inre ftp_mode=aliqu ftp_cmd=orem cipher_suite=dquian msg_id=isaute", + "event.timezone": "PST", + "fileset.name": "fortimanager", + "host.name": "ntex5135.corp", + "http.request.referrer": "https://example.com/olupta/ape.jpg?mnisiut=eabil#olu", + "input.type": "log", + "log.level": "low", + "log.offset": 59527, + "network.bytes": 9362, + "network.direction": "outbound", + "observer.egress.interface.name": "eth2068", + "observer.ingress.interface.name": "eth6552", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1789", + "related.ip": [ + "10.239.194.105", + "10.234.171.117" + ], + "related.user": [ + "tat" + ], + "rsa.internal.event_desc": "olorin", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "uia", + "rsa.misc.OS": "mquae", + "rsa.misc.action": [ + "tenatus", + "deny" + ], + "rsa.misc.category": "abo", + "rsa.misc.client": "umtota", + "rsa.misc.context": "rinre", + "rsa.misc.event_source": "dol", + "rsa.misc.event_type": "lit", + "rsa.misc.fcatnum": "olors", + "rsa.misc.filter": "mSecti", + "rsa.misc.hardware_id": "ius", + "rsa.misc.log_session_id": "consequ", + "rsa.misc.policy_id": "illoin", + "rsa.misc.policy_name": "reseo", + "rsa.misc.reference_id": "quian", + "rsa.misc.rule_name": "mqua", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 3409, + "rsa.misc.version": "1.1789", + "rsa.misc.vsys": "eddoei", + "rsa.network.alias_host": [ + "ntex5135.corp" + ], + "rsa.network.dinterface": "eth2068", + "rsa.network.network_service": "unt", + "rsa.network.sinterface": "eth6552", + "rsa.threat.threat_desc": "inre", + "rsa.time.duration_time": 166.295, + "rsa.time.event_time": "2018-03-11T04:28:49.000Z", + "rsa.time.timezone": "PST", + "rsa.web.reputation_num": 5.25, + "rsa.web.web_ref_domain": "ono", + "rule.name": "mqua", + "service.type": "fortinet", + "source.bytes": 5988, + "source.geo.country_name": "dex", + "source.ip": [ + "10.239.194.105" + ], + "source.mac": "01:00:5e:b5:9a:3e", + "source.port": 3629, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.com/isc/umdol.jpg?atn=sectet#boreetd", + "url.query": "odic", + "user.name": "tat" + }, + { + "@timestamp": "2018-03-25T11:31:24.000Z", + "destination.bytes": 2855, + "destination.geo.country_name": "rinc", + "destination.ip": [ + "10.249.16.201" + ], + "destination.nat.ip": "10.107.168.208", + "destination.nat.port": 1864, + "destination.port": 4293, + "event.action": "accept", + "event.code": "ntocca", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=emagnaal dtime=2018-03-25 09:31:24.032538723 +0000 UTC devid=uunturm devname=nonnumq vd=tqu date=2018-3-25 time=9:31:24 logid=ntocca type=emquelau subtype=adolorsi level=medium eventtime=maliquam logtime=ovol srcip=10.34.41.75 srcport=4436 srcintf=enp0s7638 srcintfrole=eseosqu dstip=10.249.16.201 dstport=4293 dstintf=lo5084 dstintfrole=mvele poluuid=qui sessionid=etMa proto=3 action=accept policyid=aspe policytype=uradipi crscore=22.220000 craction=atu crlevel=amremape appcat=illoinve service=uis srccountry=itanimi dstcountry=rinc trandisp=isistena tranip=10.107.168.208 tranport=1864 duration=45.477000 sentbyte=1067 rcvdbyte=2855 sentpkt=ctionofd app=uianonnu", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 60960, + "network.bytes": 3922, + "network.protocol": "GGP", + "observer.egress.interface.name": "lo5084", + "observer.ingress.interface.name": "enp0s7638", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.249.16.201", + "10.107.168.208", + "10.34.41.75" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "adolorsi", + "rsa.misc.context": "isistena", + "rsa.misc.event_source": "nonnumq", + "rsa.misc.event_type": "emquelau", + "rsa.misc.hardware_id": "uunturm", + "rsa.misc.log_session_id": "etMa", + "rsa.misc.obj_name": "uianonnu", + "rsa.misc.policy_id": "aspe", + "rsa.misc.reference_id": "ntocca", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "tqu", + "rsa.network.dinterface": "lo5084", + "rsa.network.network_service": "uis", + "rsa.network.sinterface": "enp0s7638", + "rsa.time.duration_time": 45.477, + "rsa.time.event_time": "2018-03-25T11:31:24.000Z", + "rsa.time.event_time_str": "maliquam", + "rsa.web.reputation_num": 22.22, + "service.type": "fortinet", + "source.bytes": 1067, + "source.geo.country_name": "itanimi", + "source.ip": [ + "10.34.41.75" + ], + "source.port": 4436, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-04-08T06:33:58.000Z", + "destination.bytes": 7292, + "destination.ip": [ + "10.109.106.194" + ], + "destination.port": 5356, + "event.action": "allow", + "event.code": "vol", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=nisiste date=2018-4-8 time=4:33:58 log_id=sedqu devid=itautfu devname=aaliq logid=tDui type=ernatur subtype=itsed level=low vd=xeacomm srcip=10.112.57.220 srcport=5803 srcintf=enp0s1897 dstip=10.19.151.236 dstport=884 dstintf=enp0s4144 poluuid=estiaeco sessionid=vele proto=HOPOPT action=allow policyid=yCiceroi trandisp=loremeu duration=156.263000 sentbyte=3719 rcvdbyte=7292 devtype=colab osname=itte osversion=1.6905 mastersrcmac=orumS srcmac=01:00:5e:c1:b8:93 crscore=60.950000 craction=uptat crlevel=incidun eventtype=agnaaliq user=aturQuis service=cepteurs hostname=tat1845.internal.invalid profile=rumetMal reqtype=tiumtot url=https://www.example.com/imadm/ugiat.txt?Nequepor=nisiu#ptat direction=inbound msg=eddoe method=seq cat=uae catdesc=tobeata device_id=ctas log_id=vol pri=high userfrom=gna adminprof=itautf timezone=ET main_type=eprehe trigger_policy=ariatu sub_type=aqueip severity_level=aqueip policy=rautod src=10.96.168.24 src_port=6206 dst=10.109.106.194 dst_port=5356 http_method=Sedut http_url=stiaec http_host=rveli http_agent=serr http_session_id=umdolo signature_subclass=iduntut signature_id=4281 srccountry=rorsitv content_switch_name=caboNemo server_pool_name=cididun false_positive_mitigation=iamqu user_name=ommodoc monitor_status=mwrit http_refer=https://www5.example.com/madminim/onse.txt?reeuf=orinrepr#tinvo http_version=oru dev_id=ainc threat_weight=aeab history_threat_weight=iat threat_level=acom ftp_mode=olo ftp_cmd=eipsaq cipher_suite=enatu msg_id=mfu", + "event.timezone": "ET", + "fileset.name": "fortimanager", + "host.name": "tat1845.internal.invalid", + "http.request.referrer": "https://www5.example.com/madminim/onse.txt?reeuf=orinrepr#tinvo", + "input.type": "log", + "log.level": "high", + "log.offset": 61635, + "network.bytes": 11011, + "network.direction": "inbound", + "observer.egress.interface.name": "enp0s4144", + "observer.ingress.interface.name": "enp0s1897", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.6905", + "related.ip": [ + "10.109.106.194", + "10.96.168.24" + ], + "related.user": [ + "ommodoc" + ], + "rsa.internal.event_desc": "eddoe", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "agnaaliq", + "rsa.misc.OS": "itte", + "rsa.misc.action": [ + "allow", + "Sedut" + ], + "rsa.misc.category": "aqueip", + "rsa.misc.client": "serr", + "rsa.misc.context": "loremeu", + "rsa.misc.event_source": "aaliq", + "rsa.misc.event_type": "ernatur", + "rsa.misc.fcatnum": "uae", + "rsa.misc.filter": "tobeata", + "rsa.misc.hardware_id": "ctas", + "rsa.misc.log_session_id": "umdolo", + "rsa.misc.policy_id": "yCiceroi", + "rsa.misc.policy_name": "rautod", + "rsa.misc.reference_id": "vol", + "rsa.misc.rule_name": "rumetMal", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 4281, + "rsa.misc.version": "1.6905", + "rsa.misc.vsys": "xeacomm", + "rsa.network.alias_host": [ + "tat1845.internal.invalid" + ], + "rsa.network.dinterface": "enp0s4144", + "rsa.network.network_service": "cepteurs", + "rsa.network.sinterface": "enp0s1897", + "rsa.threat.threat_desc": "acom", + "rsa.time.duration_time": 156.263, + "rsa.time.event_time": "2018-04-08T06:33:58.000Z", + "rsa.time.timezone": "ET", + "rsa.web.reputation_num": 60.95, + "rsa.web.web_ref_domain": "rveli", + "rule.name": "rumetMal", + "service.type": "fortinet", + "source.bytes": 3719, + "source.geo.country_name": "rorsitv", + "source.ip": [ + "10.96.168.24" + ], + "source.mac": "01:00:5e:c1:b8:93", + "source.port": 6206, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.com/imadm/ugiat.txt?Nequepor=nisiu#ptat", + "url.query": "stiaec", + "user.name": "ommodoc" + }, + { + "@timestamp": "2018-04-22T13:36:32.000Z", + "destination.bytes": 6693, + "destination.ip": [ + "10.47.191.95" + ], + "destination.port": 6242, + "event.action": "deny", + "event.code": "remagnam", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=aliqui date=2018-4-22 time=11:36:32 log_id=uipexea devid=sauteiru devname=nibusB logid=eetdolo type=issuscip subtype=iduntu level=high vd=rinc srcip=10.109.224.208 srcport=1769 srcintf=enp0s3638 dstip=10.31.34.96 dstport=4651 dstintf=enp0s390 poluuid=atis sessionid=edol proto=icmp action=deny policyid=adip trandisp=ugiatq duration=128.795000 sentbyte=4249 rcvdbyte=6693 devtype=atemUte osname=emag osversion=1.1353 mastersrcmac=ecatcup srcmac=01:00:5e:63:85:d2 crscore=62.286000 craction=oin crlevel=isautem eventtype=eiusm user=assit service=ulpaq hostname=ulamc767.internal.lan profile=iades reqtype=mremape url=https://mail.example.net/ionemu/nul.jpg?volupt=ori#sed direction=inbound msg=maveniam method=ctobeat cat=emoenim catdesc=oqui device_id=olab log_id=remagnam pri=high userfrom=mSecti adminprof=volupt timezone=OMST main_type=ela trigger_policy=fugits sub_type=litseddo severity_level=idestl policy=ptasn src=10.112.155.228 src_port=5011 dst=10.47.191.95 dst_port=6242 http_method=velillu http_url=radipi http_host=iatn http_agent=aturE http_session_id=beat signature_subclass=pern signature_id=7568 srccountry=itvolupt content_switch_name=uradip server_pool_name=perspi false_positive_mitigation=uaer user_name=aed monitor_status=tectobe http_refer=https://example.org/scingeli/uatDuis.gif?apari=itesseci#utali http_version=ofdeFin dev_id=siutaliq threat_weight=urvel history_threat_weight=turE threat_level=ntium ftp_mode=imadmi ftp_cmd=dquiac cipher_suite=liquide msg_id=uatD", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "ulamc767.internal.lan", + "http.request.referrer": "https://example.org/scingeli/uatDuis.gif?apari=itesseci#utali", + "input.type": "log", + "log.level": "high", + "log.offset": 63134, + "network.bytes": 10942, + "network.direction": "inbound", + "observer.egress.interface.name": "enp0s390", + "observer.ingress.interface.name": "enp0s3638", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1353", + "related.ip": [ + "10.47.191.95", + "10.112.155.228" + ], + "related.user": [ + "aed" + ], + "rsa.internal.event_desc": "maveniam", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "eiusm", + "rsa.misc.OS": "emag", + "rsa.misc.action": [ + "deny", + "velillu" + ], + "rsa.misc.category": "litseddo", + "rsa.misc.client": "aturE", + "rsa.misc.context": "ugiatq", + "rsa.misc.event_source": "nibusB", + "rsa.misc.event_type": "issuscip", + "rsa.misc.fcatnum": "emoenim", + "rsa.misc.filter": "oqui", + "rsa.misc.hardware_id": "olab", + "rsa.misc.log_session_id": "beat", + "rsa.misc.policy_id": "adip", + "rsa.misc.policy_name": "ptasn", + "rsa.misc.reference_id": "remagnam", + "rsa.misc.rule_name": "iades", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 7568, + "rsa.misc.version": "1.1353", + "rsa.misc.vsys": "rinc", + "rsa.network.alias_host": [ + "ulamc767.internal.lan" + ], + "rsa.network.dinterface": "enp0s390", + "rsa.network.network_service": "ulpaq", + "rsa.network.sinterface": "enp0s3638", + "rsa.threat.threat_desc": "ntium", + "rsa.time.duration_time": 128.795, + "rsa.time.event_time": "2018-04-22T13:36:32.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 62.286, + "rsa.web.web_ref_domain": "iatn", + "rule.name": "iades", + "service.type": "fortinet", + "source.bytes": 4249, + "source.geo.country_name": "itvolupt", + "source.ip": [ + "10.112.155.228" + ], + "source.mac": "01:00:5e:63:85:d2", + "source.port": 5011, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.net/ionemu/nul.jpg?volupt=ori#sed", + "url.query": "radipi", + "user.name": "aed" + }, + { + "@timestamp": "2018-05-07T08:39:06.000Z", + "destination.bytes": 6033, + "destination.geo.country_name": "amrema", + "destination.ip": [ + "10.140.137.17" + ], + "destination.nat.ip": "10.62.241.218", + "destination.nat.port": 7444, + "destination.port": 446, + "event.action": "allow", + "event.code": "tmol", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=gnidolor dtime=2018-05-07 06:39:06.812538723 +0000 UTC devid=BCSedut devname=metco vd=vel date=2018-5-7 time=6:39:06 logid=tmol type=acommodi subtype=ccaecat level=low eventtime=mqu logtime=mips srcip=10.103.169.94 srcport=2174 srcintf=lo5821 srcintfrole=osqu dstip=10.140.137.17 dstport=446 dstintf=enp0s4444 dstintfrole=iono poluuid=atcupi sessionid=dexe proto=0 action=allow policyid=exerci policytype=ems crscore=15.728000 craction=nulapa crlevel=tess appcat=eroi service=enby srccountry=riatur dstcountry=amrema trandisp=illum tranip=10.62.241.218 tranport=7444 duration=5.969000 sentbyte=4832 rcvdbyte=6033 sentpkt=urere app=involu", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 64633, + "network.bytes": 10865, + "observer.egress.interface.name": "enp0s4444", + "observer.ingress.interface.name": "lo5821", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.103.169.94", + "10.140.137.17", + "10.62.241.218" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ccaecat", + "rsa.misc.context": "illum", + "rsa.misc.event_source": "metco", + "rsa.misc.event_type": "acommodi", + "rsa.misc.hardware_id": "BCSedut", + "rsa.misc.log_session_id": "dexe", + "rsa.misc.obj_name": "involu", + "rsa.misc.policy_id": "exerci", + "rsa.misc.reference_id": "tmol", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "vel", + "rsa.network.dinterface": "enp0s4444", + "rsa.network.network_service": "enby", + "rsa.network.sinterface": "lo5821", + "rsa.time.duration_time": 5.969, + "rsa.time.event_time": "2018-05-07T08:39:06.000Z", + "rsa.time.event_time_str": "mqu", + "rsa.web.reputation_num": 15.728, + "service.type": "fortinet", + "source.bytes": 4832, + "source.geo.country_name": "riatur", + "source.ip": [ + "10.103.169.94" + ], + "source.port": 2174, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-05-21T03:41:41.000Z", + "destination.bytes": 2687, + "destination.geo.country_name": "umetMalo", + "destination.ip": [ + "10.251.212.166" + ], + "destination.nat.ip": "10.77.105.160", + "destination.nat.port": 5541, + "destination.port": 3925, + "event.action": "cancel", + "event.code": "sistena", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=tem devname=\"litsedq\" devid=\"amre\" vd=orpori date=2018-5-21 time=1:41:41 logid=sistena type=iam subtype=saquae level=low eventtime=itanimid logtime=ianonnum srcip=10.90.229.92 srcport=6796 srcintf=lo1752 srcintfrole=inculp dstip=10.251.212.166 dstport=3925 dstintf=eth1592 dstintfrole=aboNemo poluuid=tsedquia sessionid=ididun proto=21 action=cancel policyid=enim policytype=gnido crscore=85.453000 craction=erepr crlevel=tsedqu appcat=uisa service=uptat srccountry=siutal dstcountry=umetMalo trandisp=onevolu tranip=10.77.105.160 tranport=5541 duration=155.903000 sentbyte=5294 rcvdbyte=2687 sentpkt=ira app=umfu", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 65278, + "network.bytes": 7981, + "observer.egress.interface.name": "eth1592", + "observer.ingress.interface.name": "lo1752", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.90.229.92", + "10.251.212.166", + "10.77.105.160" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "saquae", + "rsa.misc.context": "onevolu", + "rsa.misc.event_source": "litsedq", + "rsa.misc.event_type": "iam", + "rsa.misc.hardware_id": "amre", + "rsa.misc.log_session_id": "ididun", + "rsa.misc.obj_name": "umfu", + "rsa.misc.policy_id": "enim", + "rsa.misc.reference_id": "sistena", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "orpori", + "rsa.network.dinterface": "eth1592", + "rsa.network.network_service": "uptat", + "rsa.network.sinterface": "lo1752", + "rsa.time.duration_time": 155.903, + "rsa.time.event_time": "2018-05-21T03:41:41.000Z", + "rsa.time.event_time_str": "itanimid", + "rsa.web.reputation_num": 85.453, + "service.type": "fortinet", + "source.bytes": 5294, + "source.geo.country_name": "siutal", + "source.ip": [ + "10.90.229.92" + ], + "source.port": 6796, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-06-04T10:44:15.000Z", + "destination.bytes": 205, + "destination.ip": [ + "10.112.242.68" + ], + "destination.port": 3105, + "event.action": "cancel", + "event.code": "atisund", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-6-4 time=8:44:15 logver=uamq devid=mnisist devname=dutp logid=ecillu type=ipsaqu subtype=asun level=very-high vd=llumd srcip=10.100.223.157 srcport=1307 srcintf=eth5742 dstip=10.232.243.87 dstport=4546 dstintf=lo299 poluuid=atisetq sessionid=mSectio proto=0 action=cancel policyid=nonnumqu trandisp=atis duration=63.050000 sentbyte=3508 rcvdbyte=205 devtype=uam osname=tisunde osversion=1.4261 mastersrcmac=rured srcmac=01:00:5e:8a:c1:2a crscore=19.243000 craction=meumfug crlevel=iam eventtype=animi user=porainc service=nsectetu hostname=spici5547.internal.test profile=tate reqtype=sintocca url=https://mail.example.org/asuntex/uovolup.html?amali=uiav#henderi direction=internal msg=tnul method=ons cat=radip catdesc=amremap device_id=dolorsit log_id=atisund pri=very-high userfrom=uredo adminprof=uamni timezone=CT main_type=quisqua trigger_policy=sedquian sub_type=lamcorpo severity_level=rem policy=apariat src=10.216.49.112 src_port=4521 dst=10.112.242.68 dst_port=3105 http_method=aut http_url=eriti http_host=ipsum http_agent=com http_session_id=uptate signature_subclass=tevelite signature_id=5880 srccountry=nimadmi content_switch_name=mquiado server_pool_name=agn false_positive_mitigation=dip user_name=urmag monitor_status=nim http_refer=https://www5.example.net/tutlabo/incid.gif?ptate=tconsect#usm http_version=uunturma dev_id=namaliqu threat_weight=tatemacc history_threat_weight=licab threat_level=roidents ftp_mode=volupta ftp_cmd=stiaeco cipher_suite=tanim msg_id=osam", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "spici5547.internal.test", + "http.request.referrer": "https://www5.example.net/tutlabo/incid.gif?ptate=tconsect#usm", + "input.type": "log", + "log.level": "very-high", + "log.offset": 65899, + "network.bytes": 3713, + "network.direction": "internal", + "observer.egress.interface.name": "lo299", + "observer.ingress.interface.name": "eth5742", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4261", + "related.ip": [ + "10.216.49.112", + "10.112.242.68" + ], + "related.user": [ + "urmag" + ], + "rsa.internal.event_desc": "tnul", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "animi", + "rsa.misc.OS": "tisunde", + "rsa.misc.action": [ + "aut", + "cancel" + ], + "rsa.misc.category": "lamcorpo", + "rsa.misc.client": "com", + "rsa.misc.context": "atis", + "rsa.misc.event_source": "dutp", + "rsa.misc.event_type": "ipsaqu", + "rsa.misc.fcatnum": "radip", + "rsa.misc.filter": "amremap", + "rsa.misc.hardware_id": "dolorsit", + "rsa.misc.log_session_id": "uptate", + "rsa.misc.policy_id": "nonnumqu", + "rsa.misc.policy_name": "apariat", + "rsa.misc.reference_id": "atisund", + "rsa.misc.rule_name": "tate", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 5880, + "rsa.misc.version": "1.4261", + "rsa.misc.vsys": "llumd", + "rsa.network.alias_host": [ + "spici5547.internal.test" + ], + "rsa.network.dinterface": "lo299", + "rsa.network.network_service": "nsectetu", + "rsa.network.sinterface": "eth5742", + "rsa.threat.threat_desc": "roidents", + "rsa.time.duration_time": 63.05, + "rsa.time.event_time": "2018-06-04T10:44:15.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 19.243, + "rsa.web.web_ref_domain": "ipsum", + "rule.name": "tate", + "service.type": "fortinet", + "source.bytes": 3508, + "source.geo.country_name": "nimadmi", + "source.ip": [ + "10.216.49.112" + ], + "source.mac": "01:00:5e:8a:c1:2a", + "source.port": 4521, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/asuntex/uovolup.html?amali=uiav#henderi", + "url.query": "eriti", + "user.name": "urmag" + }, + { + "@timestamp": "2018-06-19T05:46:49.000Z", + "destination.bytes": 1768, + "destination.ip": [ + "10.96.100.84" + ], + "destination.port": 2253, + "event.action": "accept", + "event.code": "etco", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-6-19 time=3:46:49 logver=tla devid=nimve devname=edutpe logid=tenb type=billoinv subtype=asia level=medium vd=paquioff srcip=10.252.175.174 srcport=1995 srcintf=enp0s1531 dstip=10.196.226.219 dstport=545 dstintf=lo2390 poluuid=uaera sessionid=nsequa proto=tcp action=accept policyid=orporis trandisp=oluptate duration=28.731000 sentbyte=2397 rcvdbyte=1768 devtype=itvolu osname=citation osversion=1.491 mastersrcmac=aincid srcmac=01:00:5e:7e:ea:3f crscore=149.960000 craction=tNeque crlevel=uidolore eventtype=uatDuisa user=usB service=magnaali hostname=istenatu3686.invalid profile=remagna reqtype=eritqu url=https://example.org/mnisiut/porinci.htm?norum=emUten#dminimve direction=internal msg=oremagna method=nulamc cat=tempori catdesc=rsintocc device_id=nderit log_id=etco pri=very-high userfrom=lore adminprof=ameiusmo timezone=PT main_type=veniamqu trigger_policy=equat sub_type=reeu severity_level=atemacc policy=rsitvolu src=10.182.58.108 src_port=4811 dst=10.96.100.84 dst_port=2253 http_method=utlabore http_url=texplica http_host=boru http_agent=ntut http_session_id=elaud signature_subclass=acomm signature_id=5667 srccountry=emUten content_switch_name=uamni server_pool_name=laboris false_positive_mitigation=pers user_name=lpaquiof monitor_status=isisten http_refer=https://api.example.net/seddoei/rnatur.jpg?olores=idolorem#umdolors http_version=uid dev_id=numqua threat_weight=citatio history_threat_weight=sed threat_level=mUten ftp_mode=eursint ftp_cmd=velillum cipher_suite=oin msg_id=teurs", + "event.timezone": "PT", + "fileset.name": "fortimanager", + "host.name": "istenatu3686.invalid", + "http.request.referrer": "https://api.example.net/seddoei/rnatur.jpg?olores=idolorem#umdolors", + "input.type": "log", + "log.level": "very-high", + "log.offset": 67398, + "network.bytes": 4165, + "network.direction": "internal", + "observer.egress.interface.name": "lo2390", + "observer.ingress.interface.name": "enp0s1531", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.491", + "related.ip": [ + "10.96.100.84", + "10.182.58.108" + ], + "related.user": [ + "lpaquiof" + ], + "rsa.internal.event_desc": "oremagna", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "uatDuisa", + "rsa.misc.OS": "citation", + "rsa.misc.action": [ + "accept", + "utlabore" + ], + "rsa.misc.category": "reeu", + "rsa.misc.client": "ntut", + "rsa.misc.context": "oluptate", + "rsa.misc.event_source": "edutpe", + "rsa.misc.event_type": "billoinv", + "rsa.misc.fcatnum": "tempori", + "rsa.misc.filter": "rsintocc", + "rsa.misc.hardware_id": "nderit", + "rsa.misc.log_session_id": "elaud", + "rsa.misc.policy_id": "orporis", + "rsa.misc.policy_name": "rsitvolu", + "rsa.misc.reference_id": "etco", + "rsa.misc.rule_name": "remagna", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 5667, + "rsa.misc.version": "1.491", + "rsa.misc.vsys": "paquioff", + "rsa.network.alias_host": [ + "istenatu3686.invalid" + ], + "rsa.network.dinterface": "lo2390", + "rsa.network.network_service": "magnaali", + "rsa.network.sinterface": "enp0s1531", + "rsa.threat.threat_desc": "mUten", + "rsa.time.duration_time": 28.731, + "rsa.time.event_time": "2018-06-19T05:46:49.000Z", + "rsa.time.timezone": "PT", + "rsa.web.reputation_num": 149.96, + "rsa.web.web_ref_domain": "boru", + "rule.name": "remagna", + "service.type": "fortinet", + "source.bytes": 2397, + "source.geo.country_name": "emUten", + "source.ip": [ + "10.182.58.108" + ], + "source.mac": "01:00:5e:7e:ea:3f", + "source.port": 4811, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.org/mnisiut/porinci.htm?norum=emUten#dminimve", + "url.query": "texplica", + "user.name": "lpaquiof" + }, + { + "@timestamp": "2018-07-03T12:49:23.000Z", + "destination.bytes": 2952, + "destination.geo.country_name": "tatem", + "destination.ip": [ + "10.246.41.77" + ], + "destination.nat.ip": "10.157.22.21", + "destination.nat.port": 5252, + "destination.port": 1217, + "event.action": "block", + "event.code": "rios", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=untutl devname=\"cons\" devid=\"vel\" vd=illumdo date=2018-7-3 time=10:49:23 logid=rios type=deF subtype=dutpe level=very-high eventtime=itan logtime=uisnos srcip=10.228.61.5 srcport=1179 srcintf=eth4741 srcintfrole=lites dstip=10.246.41.77 dstport=1217 dstintf=lo7502 dstintfrole=olu poluuid=ectet sessionid=tquovo proto=17 action=block policyid=lapa policytype=xeacom crscore=22.822000 craction=qui crlevel=henderi appcat=rainc service=dminim srccountry=sse dstcountry=tatem trandisp=umexe tranip=10.157.22.21 tranport=5252 duration=135.630000 sentbyte=2167 rcvdbyte=2952 sentpkt=quamei app=nvento", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 68917, + "network.bytes": 5119, + "observer.egress.interface.name": "lo7502", + "observer.ingress.interface.name": "eth4741", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.246.41.77", + "10.157.22.21", + "10.228.61.5" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "dutpe", + "rsa.misc.context": "umexe", + "rsa.misc.event_source": "cons", + "rsa.misc.event_type": "deF", + "rsa.misc.hardware_id": "vel", + "rsa.misc.log_session_id": "tquovo", + "rsa.misc.obj_name": "nvento", + "rsa.misc.policy_id": "lapa", + "rsa.misc.reference_id": "rios", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "illumdo", + "rsa.network.dinterface": "lo7502", + "rsa.network.network_service": "dminim", + "rsa.network.sinterface": "eth4741", + "rsa.time.duration_time": 135.63, + "rsa.time.event_time": "2018-07-03T12:49:23.000Z", + "rsa.time.event_time_str": "itan", + "rsa.web.reputation_num": 22.822, + "service.type": "fortinet", + "source.bytes": 2167, + "source.geo.country_name": "sse", + "source.ip": [ + "10.228.61.5" + ], + "source.port": 1179, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-17T07:51:58.000Z", + "destination.bytes": 4226, + "destination.geo.country_name": "nonpro", + "destination.ip": [ + "10.239.231.168" + ], + "destination.nat.ip": "10.188.131.18", + "destination.nat.port": 981, + "destination.port": 88, + "event.action": "allow", + "event.code": "psu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=qua devname=\"llumdo\" devid=\"tot\" vd=itquii date=2018-7-17 time=5:51:58 logid=psu type=iat subtype=ept level=high eventtime=ectob logtime=aUtenim srcip=10.242.119.111 srcport=645 srcintf=lo1640 srcintfrole=tDuisa dstip=10.239.231.168 dstport=88 dstintf=lo3385 dstintfrole=nimi poluuid=niamqu sessionid=uioffi proto=1 action=allow policyid=consequa policytype=tionu crscore=60.452000 craction=quines crlevel=entsu appcat=ineavol service=abor srccountry=giatq dstcountry=nonpro trandisp=elitsedd tranip=10.188.131.18 tranport=981 duration=46.954000 sentbyte=2770 rcvdbyte=4226 sentpkt=tam app=uovo", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 69520, + "network.bytes": 6996, + "observer.egress.interface.name": "lo3385", + "observer.ingress.interface.name": "lo1640", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.188.131.18", + "10.239.231.168", + "10.242.119.111" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ept", + "rsa.misc.context": "elitsedd", + "rsa.misc.event_source": "llumdo", + "rsa.misc.event_type": "iat", + "rsa.misc.hardware_id": "tot", + "rsa.misc.log_session_id": "uioffi", + "rsa.misc.obj_name": "uovo", + "rsa.misc.policy_id": "consequa", + "rsa.misc.reference_id": "psu", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "itquii", + "rsa.network.dinterface": "lo3385", + "rsa.network.network_service": "abor", + "rsa.network.sinterface": "lo1640", + "rsa.time.duration_time": 46.954, + "rsa.time.event_time": "2018-07-17T07:51:58.000Z", + "rsa.time.event_time_str": "ectob", + "rsa.web.reputation_num": 60.452, + "service.type": "fortinet", + "source.bytes": 2770, + "source.geo.country_name": "giatq", + "source.ip": [ + "10.242.119.111" + ], + "source.port": 645, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-01T14:54:32.000Z", + "destination.bytes": 306, + "destination.ip": [ + "10.247.124.74" + ], + "destination.port": 2491, + "event.action": "accept", + "event.code": "nderitin", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=orinrepr date=2018-8-1 time=12:54:32 log_id=untut devid=siu devname=lorem logid=icons type=hende subtype=umdol level=medium vd=psaq srcip=10.24.154.250 srcport=2108 srcintf=eth2707 dstip=10.124.187.230 dstport=6119 dstintf=lo105 poluuid=mqu sessionid=tse proto=udp action=accept policyid=ueip trandisp=amvo duration=20.956000 sentbyte=2068 rcvdbyte=306 devtype=reetdolo osname=tten osversion=1.979 mastersrcmac=usa srcmac=01:00:5e:6a:a6:c9 crscore=45.307000 craction=oremagna crlevel=siuta eventtype=amnihil user=nderit service=ficia hostname=tru3812.mail.lan profile=olo reqtype=xer url=https://api.example.net/nsec/smo.gif?etq=trumexe#rai direction=outbound msg=tNequepo method=byCicer cat=imvenia catdesc=ipit device_id=tdolorem log_id=nderitin pri=low userfrom=enderitq adminprof=amvolu timezone=GMT-07:00 main_type=temvele trigger_policy=ofd sub_type=quam severity_level=umdol policy=porincid src=10.106.101.87 src_port=7569 dst=10.247.124.74 dst_port=2491 http_method=inea http_url=ipsu http_host=iden http_agent=oreseo http_session_id=edictasu signature_subclass=aerat signature_id=4358 srccountry=lites content_switch_name=col server_pool_name=litsedd false_positive_mitigation=mnis user_name=ainci monitor_status=aturve http_refer=https://api.example.com/mporain/secte.txt?amqui=rume#uptate http_version=tisundeo dev_id=uid threat_weight=eFini history_threat_weight=mnis threat_level=tametco ftp_mode=snisiut ftp_cmd=lit cipher_suite=laborio msg_id=aaliqu", + "event.timezone": "GMT-07:00", + "fileset.name": "fortimanager", + "host.name": "tru3812.mail.lan", + "http.request.referrer": "https://api.example.com/mporain/secte.txt?amqui=rume#uptate", + "input.type": "log", + "log.level": "low", + "log.offset": 70122, + "network.bytes": 2374, + "network.direction": "outbound", + "observer.egress.interface.name": "lo105", + "observer.ingress.interface.name": "eth2707", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.979", + "related.ip": [ + "10.106.101.87", + "10.247.124.74" + ], + "related.user": [ + "ainci" + ], + "rsa.internal.event_desc": "tNequepo", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "amnihil", + "rsa.misc.OS": "tten", + "rsa.misc.action": [ + "accept", + "inea" + ], + "rsa.misc.category": "quam", + "rsa.misc.client": "oreseo", + "rsa.misc.context": "amvo", + "rsa.misc.event_source": "lorem", + "rsa.misc.event_type": "hende", + "rsa.misc.fcatnum": "imvenia", + "rsa.misc.filter": "ipit", + "rsa.misc.hardware_id": "tdolorem", + "rsa.misc.log_session_id": "edictasu", + "rsa.misc.policy_id": "ueip", + "rsa.misc.policy_name": "porincid", + "rsa.misc.reference_id": "nderitin", + "rsa.misc.rule_name": "olo", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 4358, + "rsa.misc.version": "1.979", + "rsa.misc.vsys": "psaq", + "rsa.network.alias_host": [ + "tru3812.mail.lan" + ], + "rsa.network.dinterface": "lo105", + "rsa.network.network_service": "ficia", + "rsa.network.sinterface": "eth2707", + "rsa.threat.threat_desc": "tametco", + "rsa.time.duration_time": 20.956, + "rsa.time.event_time": "2018-08-01T14:54:32.000Z", + "rsa.time.timezone": "GMT-07:00", + "rsa.web.reputation_num": 45.307, + "rsa.web.web_ref_domain": "iden", + "rule.name": "olo", + "service.type": "fortinet", + "source.bytes": 2068, + "source.geo.country_name": "lites", + "source.ip": [ + "10.106.101.87" + ], + "source.mac": "01:00:5e:6a:a6:c9", + "source.port": 7569, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.net/nsec/smo.gif?etq=trumexe#rai", + "url.query": "ipsu", + "user.name": "ainci" + }, + { + "@timestamp": "2018-08-15T09:57:06.000Z", + "event.action": "deny", + "event.code": "consec", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-8-15 time=7:57:06 devname=mid device_id=henderi log_id=consec type=event subtype=dquia pri=high desc=isiutali user=rehe userfrom=volupta msg=etcons action=deny adom=etdol408.internal.home session_id=agnamali", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 71594, + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.user": [ + "rehe" + ], + "rsa.db.index": "etcons", + "rsa.internal.event_desc": "isiutali", + "rsa.internal.messageid": "event_fortinetmgr", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "dquia", + "rsa.misc.event_source": "mid", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "henderi", + "rsa.misc.log_session_id": "agnamali", + "rsa.misc.reference_id": "consec", + "rsa.misc.severity": "high", + "rsa.network.domain": "etdol408.internal.home", + "rsa.time.event_time": "2018-08-15T09:57:06.000Z", + "server.domain": "etdol408.internal.home", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "user.name": "rehe" + }, + { + "@timestamp": "2018-08-29T04:59:40.000Z", + "destination.bytes": 806, + "destination.ip": [ + "10.162.114.52" + ], + "destination.port": 2925, + "event.action": "allow", + "event.code": "san", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-8-29 time=2:59:40 logver=cae devid=Utenimad devname=onsequ logid=Bon type=amquisno subtype=mullam level=very-high vd=admi srcip=10.111.106.60 srcport=5449 srcintf=lo5820 dstip=10.142.181.192 dstport=4386 dstintf=lo6200 poluuid=lmolest sessionid=miurerep proto=17 action=allow policyid=Sed trandisp=isau duration=66.574000 sentbyte=75 rcvdbyte=806 devtype=idest osname=ostru osversion=1.4342 mastersrcmac=enimip srcmac=01:00:5e:11:d6:5d crscore=66.141000 craction=umquiado crlevel=taspe eventtype=empori user=mipsum service=tium hostname=riaturE1644.www5.example profile=ender reqtype=uine url=https://internal.example.com/dolo/exeacom.txt?tlab=eufugiat#upta direction=internal msg=reetdo method=mad cat=mdolor catdesc=amcorpor device_id=oremquel log_id=san pri=high userfrom=amqui adminprof=itatise timezone=GMT-07:00 main_type=cia trigger_policy=lup sub_type=cipitla severity_level=niam policy=mullamc src=10.215.144.167 src_port=6675 dst=10.162.114.52 dst_port=2925 http_method=quepor http_url=Lor http_host=ten http_agent=exeacomm http_session_id=cusan signature_subclass=oquisq signature_id=4993 srccountry=ihilmol content_switch_name=seosqui server_pool_name=tiset false_positive_mitigation=ciade user_name=erspici monitor_status=xercitat http_refer=https://internal.example.net/utlab/entoreve.html?umdol=nseq#autodita http_version=loreme dev_id=eratv threat_weight=tametcon history_threat_weight=orsi threat_level=ull ftp_mode=mcor ftp_cmd=iamquis cipher_suite=aeabi msg_id=ore", + "event.timezone": "GMT-07:00", + "fileset.name": "fortimanager", + "host.name": "riaturE1644.www5.example", + "http.request.referrer": "https://internal.example.net/utlab/entoreve.html?umdol=nseq#autodita", + "input.type": "log", + "log.level": "high", + "log.offset": 71812, + "network.bytes": 881, + "network.direction": "internal", + "observer.egress.interface.name": "lo6200", + "observer.ingress.interface.name": "lo5820", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4342", + "related.ip": [ + "10.162.114.52", + "10.215.144.167" + ], + "related.user": [ + "erspici" + ], + "rsa.internal.event_desc": "reetdo", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "empori", + "rsa.misc.OS": "ostru", + "rsa.misc.action": [ + "quepor", + "allow" + ], + "rsa.misc.category": "cipitla", + "rsa.misc.client": "exeacomm", + "rsa.misc.context": "isau", + "rsa.misc.event_source": "onsequ", + "rsa.misc.event_type": "amquisno", + "rsa.misc.fcatnum": "mdolor", + "rsa.misc.filter": "amcorpor", + "rsa.misc.hardware_id": "oremquel", + "rsa.misc.log_session_id": "cusan", + "rsa.misc.policy_id": "Sed", + "rsa.misc.policy_name": "mullamc", + "rsa.misc.reference_id": "san", + "rsa.misc.rule_name": "ender", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 4993, + "rsa.misc.version": "1.4342", + "rsa.misc.vsys": "admi", + "rsa.network.alias_host": [ + "riaturE1644.www5.example" + ], + "rsa.network.dinterface": "lo6200", + "rsa.network.network_service": "tium", + "rsa.network.sinterface": "lo5820", + "rsa.threat.threat_desc": "ull", + "rsa.time.duration_time": 66.574, + "rsa.time.event_time": "2018-08-29T04:59:40.000Z", + "rsa.time.timezone": "GMT-07:00", + "rsa.web.reputation_num": 66.141, + "rsa.web.web_ref_domain": "ten", + "rule.name": "ender", + "service.type": "fortinet", + "source.bytes": 75, + "source.geo.country_name": "ihilmol", + "source.ip": [ + "10.215.144.167" + ], + "source.mac": "01:00:5e:11:d6:5d", + "source.port": 6675, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.com/dolo/exeacom.txt?tlab=eufugiat#upta", + "url.query": "Lor", + "user.name": "erspici" + }, + { + "@timestamp": "2018-09-12T12:02:15.000Z", + "destination.bytes": 7641, + "destination.ip": [ + "10.78.75.82" + ], + "destination.port": 7799, + "event.action": "accept", + "event.code": "fugi", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-9-12 time=10:02:15 logver=catcup devid=ectetur devname=cons logid=spiciati type=upidata subtype=utlabo level=high vd=ersp srcip=10.101.207.156 srcport=2086 srcintf=enp0s4931 dstip=10.12.8.82 dstport=4369 dstintf=enp0s7520 poluuid=nemull sessionid=trumex proto=6 action=accept policyid=doloremq trandisp=iade duration=26.420000 sentbyte=5013 rcvdbyte=7641 devtype=uidolo osname=ita osversion=1.6452 mastersrcmac=rchite srcmac=01:00:5e:41:90:bf crscore=107.693000 craction=tionem crlevel=volupta eventtype=adol user=econsequ service=orever hostname=mdolo7008.api.corp profile=reetdolo reqtype=psam url=https://www5.example.org/orumet/aliqu.txt?tion=sun#utod direction=outbound msg=rinci method=uamestqu cat=riatu catdesc=ulaparia device_id=remagna log_id=fugi pri=very-high userfrom=xerc adminprof=caecat timezone=OMST main_type=cor trigger_policy=nonnumqu sub_type=uidexea severity_level=emu policy=asia src=10.162.128.87 src_port=6214 dst=10.78.75.82 dst_port=7799 http_method=uptat http_url=con http_host=tem http_agent=orpori http_session_id=lor signature_subclass=quiinea signature_id=7098 srccountry=rroquis content_switch_name=dolorema server_pool_name=prehe false_positive_mitigation=bori user_name=Sedutp monitor_status=ritinvo http_refer=https://internal.example.net/ica/nat.jpg?ddoe=nsequ#lloinve http_version=tdolo dev_id=billoi threat_weight=sequu history_threat_weight=ffic threat_level=imadmini ftp_mode=isnostru ftp_cmd=ostr cipher_suite=tinvo msg_id=lorumwr", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "mdolo7008.api.corp", + "http.request.referrer": "https://internal.example.net/ica/nat.jpg?ddoe=nsequ#lloinve", + "input.type": "log", + "log.level": "very-high", + "log.offset": 73306, + "network.bytes": 12654, + "network.direction": "outbound", + "observer.egress.interface.name": "enp0s7520", + "observer.ingress.interface.name": "enp0s4931", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.6452", + "related.ip": [ + "10.162.128.87", + "10.78.75.82" + ], + "related.user": [ + "Sedutp" + ], + "rsa.internal.event_desc": "rinci", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "adol", + "rsa.misc.OS": "ita", + "rsa.misc.action": [ + "uptat", + "accept" + ], + "rsa.misc.category": "uidexea", + "rsa.misc.client": "orpori", + "rsa.misc.context": "iade", + "rsa.misc.event_source": "cons", + "rsa.misc.event_type": "upidata", + "rsa.misc.fcatnum": "riatu", + "rsa.misc.filter": "ulaparia", + "rsa.misc.hardware_id": "remagna", + "rsa.misc.log_session_id": "lor", + "rsa.misc.policy_id": "doloremq", + "rsa.misc.policy_name": "asia", + "rsa.misc.reference_id": "fugi", + "rsa.misc.rule_name": "reetdolo", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 7098, + "rsa.misc.version": "1.6452", + "rsa.misc.vsys": "ersp", + "rsa.network.alias_host": [ + "mdolo7008.api.corp" + ], + "rsa.network.dinterface": "enp0s7520", + "rsa.network.network_service": "orever", + "rsa.network.sinterface": "enp0s4931", + "rsa.threat.threat_desc": "imadmini", + "rsa.time.duration_time": 26.42, + "rsa.time.event_time": "2018-09-12T12:02:15.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 107.693, + "rsa.web.web_ref_domain": "tem", + "rule.name": "reetdolo", + "service.type": "fortinet", + "source.bytes": 5013, + "source.geo.country_name": "rroquis", + "source.ip": [ + "10.162.128.87" + ], + "source.mac": "01:00:5e:41:90:bf", + "source.port": 6214, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.org/orumet/aliqu.txt?tion=sun#utod", + "url.query": "con", + "user.name": "Sedutp" + }, + { + "@timestamp": "2018-09-27T07:04:49.000Z", + "destination.bytes": 5464, + "destination.geo.country_name": "mdolorem", + "destination.ip": [ + "10.137.36.151" + ], + "destination.nat.ip": "10.51.106.43", + "destination.nat.port": 6486, + "destination.port": 196, + "event.action": "block", + "event.code": "auteir", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ctetura devname=\"reseosqu\" devid=\"ittenbyC\" vd=tlabor date=2018-9-27 time=5:04:49 logid=auteir type=uredolo subtype=uido level=medium eventtime=quiratio logtime=aincidu srcip=10.75.198.93 srcport=1982 srcintf=eth725 srcintfrole=umqu dstip=10.137.36.151 dstport=196 dstintf=lo1813 dstintfrole=rspici poluuid=duntutla sessionid=emeu proto=1 action=block policyid=atemUten policytype=turadipi crscore=16.226000 craction=estqu crlevel=orinre appcat=prehen service=equa srccountry=ciatisun dstcountry=mdolorem trandisp=nnumq tranip=10.51.106.43 tranport=6486 duration=78.551000 sentbyte=3531 rcvdbyte=5464 sentpkt=oremeumf app=volupt", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 74789, + "network.bytes": 8995, + "observer.egress.interface.name": "lo1813", + "observer.ingress.interface.name": "eth725", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.137.36.151", + "10.51.106.43", + "10.75.198.93" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "uido", + "rsa.misc.context": "nnumq", + "rsa.misc.event_source": "reseosqu", + "rsa.misc.event_type": "uredolo", + "rsa.misc.hardware_id": "ittenbyC", + "rsa.misc.log_session_id": "emeu", + "rsa.misc.obj_name": "volupt", + "rsa.misc.policy_id": "atemUten", + "rsa.misc.reference_id": "auteir", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "tlabor", + "rsa.network.dinterface": "lo1813", + "rsa.network.network_service": "equa", + "rsa.network.sinterface": "eth725", + "rsa.time.duration_time": 78.551, + "rsa.time.event_time": "2018-09-27T07:04:49.000Z", + "rsa.time.event_time_str": "quiratio", + "rsa.web.reputation_num": 16.226, + "service.type": "fortinet", + "source.bytes": 3531, + "source.geo.country_name": "ciatisun", + "source.ip": [ + "10.75.198.93" + ], + "source.port": 1982, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-11T14:07:23.000Z", + "destination.bytes": 5744, + "destination.geo.country_name": "tlab", + "destination.ip": [ + "10.7.230.206" + ], + "destination.nat.ip": "10.249.93.150", + "destination.nat.port": 799, + "destination.port": 5757, + "event.action": "allow", + "event.code": "mvol", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=tnulapa devname=\"caecatcu\" devid=\"xcepte\" vd=deserun date=2018-10-11 time=12:07:23 logid=mvol type=erep subtype=teurs level=low eventtime=tiumdol logtime=byCicer srcip=10.154.151.111 srcport=5860 srcintf=eth1273 srcintfrole=uisnos dstip=10.7.230.206 dstport=5757 dstintf=lo1291 dstintfrole=pisc poluuid=eumfu sessionid=tseddoe proto=HOPOPT action=allow policyid=emulla policytype=bill crscore=147.522000 craction=oditaut crlevel=oloremqu appcat=untNeque service=reetdol srccountry=perspi dstcountry=tlab trandisp=udexerci tranip=10.249.93.150 tranport=799 duration=113.020000 sentbyte=2808 rcvdbyte=5744 sentpkt=ovolup app=squ", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 75425, + "network.bytes": 8552, + "observer.egress.interface.name": "lo1291", + "observer.ingress.interface.name": "eth1273", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.7.230.206", + "10.154.151.111", + "10.249.93.150" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "teurs", + "rsa.misc.context": "udexerci", + "rsa.misc.event_source": "caecatcu", + "rsa.misc.event_type": "erep", + "rsa.misc.hardware_id": "xcepte", + "rsa.misc.log_session_id": "tseddoe", + "rsa.misc.obj_name": "squ", + "rsa.misc.policy_id": "emulla", + "rsa.misc.reference_id": "mvol", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "deserun", + "rsa.network.dinterface": "lo1291", + "rsa.network.network_service": "reetdol", + "rsa.network.sinterface": "eth1273", + "rsa.time.duration_time": 113.02, + "rsa.time.event_time": "2018-10-11T14:07:23.000Z", + "rsa.time.event_time_str": "tiumdol", + "rsa.web.reputation_num": 147.522, + "service.type": "fortinet", + "source.bytes": 2808, + "source.geo.country_name": "perspi", + "source.ip": [ + "10.154.151.111" + ], + "source.port": 5860, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-25T09:09:57.000Z", + "destination.bytes": 6280, + "destination.ip": [ + "10.26.4.3" + ], + "destination.port": 5291, + "event.action": "deny", + "event.code": "iameaq", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-10-25 time=7:09:57 logver=dolor devid=lit devname=ptatem logid=oeiusmod type=ugi subtype=utaliq level=very-high vd=toc srcip=10.76.177.154 srcport=1428 srcintf=eth4425 dstip=10.207.160.170 dstport=7037 dstintf=lo1570 poluuid=reseo sessionid=iration proto=tcp action=deny policyid=magn trandisp=iaecon duration=54.100000 sentbyte=622 rcvdbyte=6280 devtype=ill osname=oris osversion=1.5718 mastersrcmac=ulamcol srcmac=01:00:5e:19:ce:4b crscore=142.771000 craction=oNe crlevel=utfu eventtype=santiumd user=cididunt service=ctasu hostname=itse5466.api.example profile=ica reqtype=mnisis url=https://internal.example.com/nonnumqu/isciveli.gif?wri=aute#iscin direction=outbound msg=uat method=itasper cat=nibusBo catdesc=volupta device_id=olorinr log_id=iameaq pri=high userfrom=docons adminprof=uun timezone=OMST main_type=mremap trigger_policy=ate sub_type=agnaal severity_level=ibusB policy=mexe src=10.217.209.221 src_port=3639 dst=10.26.4.3 dst_port=5291 http_method=rsitame http_url=eca http_host=quirat http_agent=urmagn http_session_id=essec signature_subclass=prehende signature_id=1261 srccountry=setquas content_switch_name=nti server_pool_name=osamnis false_positive_mitigation=atisetqu user_name=ciduntut monitor_status=atisu http_refer=https://internal.example.com/architec/incul.txt?aborios=mco#amnisiu http_version=suntincu dev_id=lore threat_weight=equatu history_threat_weight=enbyCi threat_level=dolo ftp_mode=adipi ftp_cmd=beata cipher_suite=evelites msg_id=ipiscive", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "itse5466.api.example", + "http.request.referrer": "https://internal.example.com/architec/incul.txt?aborios=mco#amnisiu", + "input.type": "log", + "log.level": "high", + "log.offset": 76059, + "network.bytes": 6902, + "network.direction": "outbound", + "observer.egress.interface.name": "lo1570", + "observer.ingress.interface.name": "eth4425", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.5718", + "related.ip": [ + "10.26.4.3", + "10.217.209.221" + ], + "related.user": [ + "ciduntut" + ], + "rsa.internal.event_desc": "uat", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "santiumd", + "rsa.misc.OS": "oris", + "rsa.misc.action": [ + "rsitame", + "deny" + ], + "rsa.misc.category": "agnaal", + "rsa.misc.client": "urmagn", + "rsa.misc.context": "iaecon", + "rsa.misc.event_source": "ptatem", + "rsa.misc.event_type": "ugi", + "rsa.misc.fcatnum": "nibusBo", + "rsa.misc.filter": "volupta", + "rsa.misc.hardware_id": "olorinr", + "rsa.misc.log_session_id": "essec", + "rsa.misc.policy_id": "magn", + "rsa.misc.policy_name": "mexe", + "rsa.misc.reference_id": "iameaq", + "rsa.misc.rule_name": "ica", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 1261, + "rsa.misc.version": "1.5718", + "rsa.misc.vsys": "toc", + "rsa.network.alias_host": [ + "itse5466.api.example" + ], + "rsa.network.dinterface": "lo1570", + "rsa.network.network_service": "ctasu", + "rsa.network.sinterface": "eth4425", + "rsa.threat.threat_desc": "dolo", + "rsa.time.duration_time": 54.1, + "rsa.time.event_time": "2018-10-25T09:09:57.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 142.771, + "rsa.web.web_ref_domain": "quirat", + "rule.name": "ica", + "service.type": "fortinet", + "source.bytes": 622, + "source.geo.country_name": "setquas", + "source.ip": [ + "10.217.209.221" + ], + "source.mac": "01:00:5e:19:ce:4b", + "source.port": 3639, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.com/nonnumqu/isciveli.gif?wri=aute#iscin", + "url.query": "eca", + "user.name": "ciduntut" + }, + { + "@timestamp": "2018-11-09T04:12:32.000Z", + "destination.bytes": 6960, + "destination.ip": [ + "10.180.162.174" + ], + "destination.port": 7186, + "event.action": "accept", + "event.code": "taedic", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=umtot date=2018-11-9 time=2:12:32 log_id=eumiurer devid=inv devname=eac logid=rainc type=tinculp subtype=uianon level=high vd=corpori srcip=10.232.131.132 srcport=581 srcintf=enp0s6255 dstip=10.232.246.98 dstport=1854 dstintf=enp0s1526 poluuid=ivelit sessionid=itlabori proto=icmp action=accept policyid=oide trandisp=magni duration=72.993000 sentbyte=5817 rcvdbyte=6960 devtype=rrorsit osname=emipsu osversion=1.6603 mastersrcmac=temUte srcmac=01:00:5e:fe:be:28 crscore=134.746000 craction=hitec crlevel=sci eventtype=luptatev user=ruredo service=iamquis hostname=dquiac6194.api.lan profile=nidolo reqtype=runtmoll url=https://www5.example.org/utlabo/scip.html?voluptas=inv#upta direction=external msg=ors method=olupta cat=raincidu catdesc=nisi device_id=uipexea log_id=taedic pri=high userfrom=ugi adminprof=urExcep timezone=CET main_type=usant trigger_policy=uidolore sub_type=litse severity_level=ugitse policy=utfugi src=10.241.140.241 src_port=1813 dst=10.180.162.174 dst_port=7186 http_method=ido http_url=atnu http_host=ssuscipi http_agent=evita http_session_id=tconsect signature_subclass=lpaquiof signature_id=532 srccountry=lors content_switch_name=Finibus server_pool_name=totam false_positive_mitigation=idat user_name=nulapar monitor_status=git http_refer=https://www5.example.com/odtem/tati.jpg?ueips=umqu#ntexpli http_version=siuta dev_id=porincid threat_weight=itame history_threat_weight=inv threat_level=remaper ftp_mode=quaUteni ftp_cmd=evelit cipher_suite=oluptat msg_id=ditem", + "event.timezone": "CET", + "fileset.name": "fortimanager", + "host.name": "dquiac6194.api.lan", + "http.request.referrer": "https://www5.example.com/odtem/tati.jpg?ueips=umqu#ntexpli", + "input.type": "log", + "log.level": "high", + "log.offset": 77550, + "network.bytes": 12777, + "network.direction": "external", + "observer.egress.interface.name": "enp0s1526", + "observer.ingress.interface.name": "enp0s6255", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.6603", + "related.ip": [ + "10.241.140.241", + "10.180.162.174" + ], + "related.user": [ + "nulapar" + ], + "rsa.internal.event_desc": "ors", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "luptatev", + "rsa.misc.OS": "emipsu", + "rsa.misc.action": [ + "accept", + "ido" + ], + "rsa.misc.category": "litse", + "rsa.misc.client": "evita", + "rsa.misc.context": "magni", + "rsa.misc.event_source": "eac", + "rsa.misc.event_type": "tinculp", + "rsa.misc.fcatnum": "raincidu", + "rsa.misc.filter": "nisi", + "rsa.misc.hardware_id": "uipexea", + "rsa.misc.log_session_id": "tconsect", + "rsa.misc.policy_id": "oide", + "rsa.misc.policy_name": "utfugi", + "rsa.misc.reference_id": "taedic", + "rsa.misc.rule_name": "nidolo", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 532, + "rsa.misc.version": "1.6603", + "rsa.misc.vsys": "corpori", + "rsa.network.alias_host": [ + "dquiac6194.api.lan" + ], + "rsa.network.dinterface": "enp0s1526", + "rsa.network.network_service": "iamquis", + "rsa.network.sinterface": "enp0s6255", + "rsa.threat.threat_desc": "remaper", + "rsa.time.duration_time": 72.993, + "rsa.time.event_time": "2018-11-09T04:12:32.000Z", + "rsa.time.timezone": "CET", + "rsa.web.reputation_num": 134.746, + "rsa.web.web_ref_domain": "ssuscipi", + "rule.name": "nidolo", + "service.type": "fortinet", + "source.bytes": 5817, + "source.geo.country_name": "lors", + "source.ip": [ + "10.241.140.241" + ], + "source.mac": "01:00:5e:fe:be:28", + "source.port": 1813, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.org/utlabo/scip.html?voluptas=inv#upta", + "url.query": "atnu", + "user.name": "nulapar" + }, + { + "@timestamp": "2018-11-23T11:15:06.000Z", + "destination.bytes": 5783, + "destination.ip": [ + "10.62.140.108" + ], + "destination.port": 1225, + "event.action": "deny", + "event.code": "enimip", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2018-11-23 time=9:15:06 devname=oditautf device_id=asiarc log_id=eddoei type=generic subtype=iatqu pri=very-high devid=itessec devname=dat logid=tdol type=emul subtype=ariatu level=high vd=reseo srcip=10.53.70.207 srcport=1793 srcintf=lo2279 dstip=10.73.140.61 dstport=2114 dstintf=lo368 poluuid=stlabo sessionid=atema proto=1 action=deny policyid=orporiss trandisp=iamq duration=128.426000 sentbyte=1800 rcvdbyte=5783 devtype=pis osname=riosam osversion=1.2052 mastersrcmac=iosam srcmac=01:00:5e:21:d3:0a crscore=65.426000 craction=archi crlevel=nes eventtype=atvolupt user=umwritt service=uae hostname=amco1592.mail.host profile=aaliq reqtype=olupta url=https://internal.example.com/ssusci/snostrud.txt?dolo=siutaliq#obeata direction=outbound msg=tame method=olo cat=vel catdesc=equamn device_id=tempora log_id=enimip pri=very-high userfrom=saqua adminprof=aperia timezone=OMST main_type=tNeque trigger_policy=metcon sub_type=enimadmi severity_level=orem policy=corpor src=10.110.99.222 src_port=5685 dst=10.62.140.108 dst_port=1225 http_method=ssitasp http_url=ptat http_host=asp http_agent=uatDui http_session_id=nofdeFin signature_subclass=unde signature_id=3979 srccountry=seruntm content_switch_name=aera server_pool_name=scive false_positive_mitigation=ngelit user_name=moenimi monitor_status=mqu http_refer=https://mail.example.org/ueipsaq/upid.gif?utla=emUte#tisund http_version=tutla dev_id=isund threat_weight=atemU history_threat_weight=uidex threat_level=uptate ftp_mode=eac ftp_cmd=peria cipher_suite=amaliq msg_id=ium", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "amco1592.mail.host", + "http.request.referrer": "https://mail.example.org/ueipsaq/upid.gif?utla=emUte#tisund", + "input.type": "log", + "log.level": "very-high", + "log.offset": 79056, + "network.bytes": 7583, + "network.direction": "outbound", + "observer.egress.interface.name": "lo368", + "observer.ingress.interface.name": "lo2279", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2052", + "related.ip": [ + "10.62.140.108", + "10.110.99.222" + ], + "related.user": [ + "moenimi" + ], + "rsa.internal.event_desc": "tame", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "atvolupt", + "rsa.misc.OS": "riosam", + "rsa.misc.action": [ + "deny", + "ssitasp" + ], + "rsa.misc.category": "enimadmi", + "rsa.misc.client": "uatDui", + "rsa.misc.context": "iamq", + "rsa.misc.event_source": "dat", + "rsa.misc.event_type": "emul", + "rsa.misc.fcatnum": "vel", + "rsa.misc.filter": "equamn", + "rsa.misc.hardware_id": "tempora", + "rsa.misc.log_session_id": "nofdeFin", + "rsa.misc.policy_id": "orporiss", + "rsa.misc.policy_name": "corpor", + "rsa.misc.reference_id": "enimip", + "rsa.misc.rule_name": "aaliq", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 3979, + "rsa.misc.version": "1.2052", + "rsa.misc.vsys": "reseo", + "rsa.network.alias_host": [ + "amco1592.mail.host" + ], + "rsa.network.dinterface": "lo368", + "rsa.network.network_service": "uae", + "rsa.network.sinterface": "lo2279", + "rsa.threat.threat_desc": "uptate", + "rsa.time.duration_time": 128.426, + "rsa.time.event_time": "2018-11-23T11:15:06.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 65.426, + "rsa.web.web_ref_domain": "asp", + "rule.name": "aaliq", + "service.type": "fortinet", + "source.bytes": 1800, + "source.geo.country_name": "seruntm", + "source.ip": [ + "10.110.99.222" + ], + "source.mac": "01:00:5e:21:d3:0a", + "source.port": 5685, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.com/ssusci/snostrud.txt?dolo=siutaliq#obeata", + "url.query": "ptat", + "user.name": "moenimi" + }, + { + "@timestamp": "2018-12-07T06:17:40.000Z", + "destination.bytes": 7612, + "destination.ip": [ + "10.53.50.77" + ], + "destination.port": 5330, + "event.action": "accept", + "event.code": "etdo", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ptate date=2018-12-7 time=4:17:40 log_id=tenatu devid=emo devname=ratio logid=maperia type=Maloru subtype=sumquia level=low vd=imadmini srcip=10.237.5.219 srcport=3828 srcintf=eth4604 dstip=10.197.99.150 dstport=3877 dstintf=enp0s7388 poluuid=odo sessionid=itseddoe proto=prm action=accept policyid=itinvo trandisp=uiavol duration=96.864000 sentbyte=2685 rcvdbyte=7612 devtype=urmagn osname=ficiade osversion=1.2691 mastersrcmac=equ srcmac=01:00:5e:f5:2a:24 crscore=163.671000 craction=mipsum crlevel=dolor eventtype=cupidata user=niamquis service=lapariat hostname=dicta7226.mail.example profile=eddoei reqtype=cingel url=https://api.example.com/temporai/umw.jpg?mveniamq=litsed#ptasn direction=unknown msg=loinv method=umd cat=madmi catdesc=xercit device_id=avolup log_id=etdo pri=medium userfrom=veleum adminprof=emUten timezone=CT main_type=proiden trigger_policy=cita sub_type=iac severity_level=ntincul policy=mnisiste src=10.4.244.115 src_port=4588 dst=10.53.50.77 dst_port=5330 http_method=lorem http_url=lore http_host=orroqu http_agent=tlabo http_session_id=iameaque signature_subclass=sautemve signature_id=6466 srccountry=emoe content_switch_name=ameiusmo server_pool_name=ntiumtot false_positive_mitigation=aeab user_name=idolo monitor_status=temac http_refer=https://api.example.net/ollita/idolore.html?illu=iut#asiarc http_version=imidest dev_id=mwri threat_weight=orsi history_threat_weight=ritinvol threat_level=rporiss ftp_mode=atu ftp_cmd=ddo cipher_suite=veli msg_id=ata", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "dicta7226.mail.example", + "http.request.referrer": "https://api.example.net/ollita/idolore.html?illu=iut#asiarc", + "input.type": "log", + "log.level": "medium", + "log.offset": 80595, + "network.bytes": 10297, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s7388", + "observer.ingress.interface.name": "eth4604", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2691", + "related.ip": [ + "10.4.244.115", + "10.53.50.77" + ], + "related.user": [ + "idolo" + ], + "rsa.internal.event_desc": "loinv", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "cupidata", + "rsa.misc.OS": "ficiade", + "rsa.misc.action": [ + "accept", + "lorem" + ], + "rsa.misc.category": "iac", + "rsa.misc.client": "tlabo", + "rsa.misc.context": "uiavol", + "rsa.misc.event_source": "ratio", + "rsa.misc.event_type": "Maloru", + "rsa.misc.fcatnum": "madmi", + "rsa.misc.filter": "xercit", + "rsa.misc.hardware_id": "avolup", + "rsa.misc.log_session_id": "iameaque", + "rsa.misc.policy_id": "itinvo", + "rsa.misc.policy_name": "mnisiste", + "rsa.misc.reference_id": "etdo", + "rsa.misc.rule_name": "eddoei", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 6466, + "rsa.misc.version": "1.2691", + "rsa.misc.vsys": "imadmini", + "rsa.network.alias_host": [ + "dicta7226.mail.example" + ], + "rsa.network.dinterface": "enp0s7388", + "rsa.network.network_service": "lapariat", + "rsa.network.sinterface": "eth4604", + "rsa.threat.threat_desc": "rporiss", + "rsa.time.duration_time": 96.864, + "rsa.time.event_time": "2018-12-07T06:17:40.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 163.671, + "rsa.web.web_ref_domain": "orroqu", + "rule.name": "eddoei", + "service.type": "fortinet", + "source.bytes": 2685, + "source.geo.country_name": "emoe", + "source.ip": [ + "10.4.244.115" + ], + "source.mac": "01:00:5e:f5:2a:24", + "source.port": 4588, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.com/temporai/umw.jpg?mveniamq=litsed#ptasn", + "url.query": "lore", + "user.name": "idolo" + }, + { + "@timestamp": "2018-12-21T13:20:14.000Z", + "destination.bytes": 3484, + "destination.geo.country_name": "litess", + "destination.ip": [ + "10.236.211.111" + ], + "destination.nat.ip": "10.120.212.78", + "destination.nat.port": 119, + "destination.port": 1801, + "event.action": "allow", + "event.code": "atur", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=lor dtime=2018-12-21 23:20:14.972538723 +0000 UTC devid=ori devname=eleumiu vd=amre date=2018-12-21 time=11:20:14 logid=atur type=untex subtype=Except level=very-high eventtime=econse logtime=iac srcip=10.221.100.157 srcport=865 srcintf=lo4518 srcintfrole=mqu dstip=10.236.211.111 dstport=1801 dstintf=enp0s454 dstintfrole=rauto poluuid=pteursi sessionid=iquamqua proto=tcp action=allow policyid=psumqui policytype=equeporr crscore=32.741000 craction=cusanti crlevel=doloreme appcat=nsecte service=reprehen srccountry=taspe dstcountry=litess trandisp=enimadm tranip=10.120.212.78 tranport=119 duration=17.257000 sentbyte=4752 rcvdbyte=3484 sentpkt=ntsuntin app=ectetur", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 82093, + "network.bytes": 8236, + "observer.egress.interface.name": "enp0s454", + "observer.ingress.interface.name": "lo4518", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.236.211.111", + "10.221.100.157", + "10.120.212.78" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "Except", + "rsa.misc.context": "enimadm", + "rsa.misc.event_source": "eleumiu", + "rsa.misc.event_type": "untex", + "rsa.misc.hardware_id": "ori", + "rsa.misc.log_session_id": "iquamqua", + "rsa.misc.obj_name": "ectetur", + "rsa.misc.policy_id": "psumqui", + "rsa.misc.reference_id": "atur", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "amre", + "rsa.network.dinterface": "enp0s454", + "rsa.network.network_service": "reprehen", + "rsa.network.sinterface": "lo4518", + "rsa.time.duration_time": 17.257, + "rsa.time.event_time": "2018-12-21T13:20:14.000Z", + "rsa.time.event_time_str": "econse", + "rsa.web.reputation_num": 32.741, + "service.type": "fortinet", + "source.bytes": 4752, + "source.geo.country_name": "taspe", + "source.ip": [ + "10.221.100.157" + ], + "source.port": 865, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-05T08:22:49.000Z", + "destination.bytes": 5326, + "destination.ip": [ + "10.208.231.15" + ], + "destination.port": 412, + "event.action": "accept", + "event.code": "redol", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-1-5 time=6:22:49 logver=intocca devid=vel devname=xeacom logid=orum type=voluptat subtype=nsequ level=medium vd=tenimad srcip=10.140.215.210 srcport=7229 srcintf=lo568 dstip=10.71.213.217 dstport=7475 dstintf=eth5820 poluuid=lup sessionid=reetdolo proto=HOPOPT action=accept policyid=dolor trandisp=emagnam duration=154.150000 sentbyte=2336 rcvdbyte=5326 devtype=emull osname=enatuser osversion=1.3052 mastersrcmac=ectob srcmac=01:00:5e:4a:5d:af crscore=9.013000 craction=niamqu crlevel=nrep eventtype=lauda user=ionevo service=busB hostname=pidatatn2627.www.localdomain profile=eritinvo reqtype=quiav url=https://mail.example.org/ngelit/dipiscin.gif?serro=ctet#umiurere direction=inbound msg=ciun method=ssitaspe cat=deomnis catdesc=ulamcol device_id=onn log_id=redol pri=medium userfrom=utlabore adminprof=nci timezone=OMST main_type=liqu trigger_policy=ectetura sub_type=aUte severity_level=untNeque policy=roi src=10.210.82.202 src_port=2749 dst=10.208.231.15 dst_port=412 http_method=rios http_url=diconseq http_host=tenima http_agent=iusm http_session_id=mveleumi signature_subclass=equinesc signature_id=5076 srccountry=mfugiatq content_switch_name=dmini server_pool_name=emveleu false_positive_mitigation=loree user_name=riatur monitor_status=tempor http_refer=https://internal.example.com/spiciati/tise.gif?ctas=rvelillu#qua http_version=ciat dev_id=iamq threat_weight=porin history_threat_weight=yCi threat_level=arc ftp_mode=santium ftp_cmd=numquame cipher_suite=umfugi msg_id=amestqui", + "event.timezone": "OMST", + "fileset.name": "fortimanager", + "host.name": "pidatatn2627.www.localdomain", + "http.request.referrer": "https://internal.example.com/spiciati/tise.gif?ctas=rvelillu#qua", + "input.type": "log", + "log.level": "medium", + "log.offset": 82769, + "network.bytes": 7662, + "network.direction": "inbound", + "observer.egress.interface.name": "eth5820", + "observer.ingress.interface.name": "lo568", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.3052", + "related.ip": [ + "10.208.231.15", + "10.210.82.202" + ], + "related.user": [ + "riatur" + ], + "rsa.internal.event_desc": "ciun", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "lauda", + "rsa.misc.OS": "enatuser", + "rsa.misc.action": [ + "accept", + "rios" + ], + "rsa.misc.category": "aUte", + "rsa.misc.client": "iusm", + "rsa.misc.context": "emagnam", + "rsa.misc.event_source": "xeacom", + "rsa.misc.event_type": "voluptat", + "rsa.misc.fcatnum": "deomnis", + "rsa.misc.filter": "ulamcol", + "rsa.misc.hardware_id": "onn", + "rsa.misc.log_session_id": "mveleumi", + "rsa.misc.policy_id": "dolor", + "rsa.misc.policy_name": "roi", + "rsa.misc.reference_id": "redol", + "rsa.misc.rule_name": "eritinvo", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 5076, + "rsa.misc.version": "1.3052", + "rsa.misc.vsys": "tenimad", + "rsa.network.alias_host": [ + "pidatatn2627.www.localdomain" + ], + "rsa.network.dinterface": "eth5820", + "rsa.network.network_service": "busB", + "rsa.network.sinterface": "lo568", + "rsa.threat.threat_desc": "arc", + "rsa.time.duration_time": 154.15, + "rsa.time.event_time": "2019-01-05T08:22:49.000Z", + "rsa.time.timezone": "OMST", + "rsa.web.reputation_num": 9.013, + "rsa.web.web_ref_domain": "tenima", + "rule.name": "eritinvo", + "service.type": "fortinet", + "source.bytes": 2336, + "source.geo.country_name": "mfugiatq", + "source.ip": [ + "10.210.82.202" + ], + "source.mac": "01:00:5e:4a:5d:af", + "source.port": 2749, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://mail.example.org/ngelit/dipiscin.gif?serro=ctet#umiurere", + "url.query": "diconseq", + "user.name": "riatur" + }, + { + "@timestamp": "2019-01-19T03:25:23.000Z", + "destination.bytes": 220, + "destination.geo.country_name": "aqueipsa", + "destination.ip": [ + "10.123.59.69" + ], + "destination.nat.ip": "10.53.251.202", + "destination.nat.port": 7501, + "destination.port": 5399, + "event.action": "accept", + "event.code": "edd", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=tesseq devname=\"nimides\" devid=\"iusmodte\" vd=involup date=2019-1-19 time=1:25:23 logid=edd type=dolorsi subtype=mcolabo level=low eventtime=exe logtime=nve srcip=10.226.255.3 srcport=5449 srcintf=lo7680 srcintfrole=iaconseq dstip=10.123.59.69 dstport=5399 dstintf=lo5835 dstintfrole=ntsunti poluuid=bor sessionid=uisnos proto=6 action=accept policyid=tation policytype=seddoe crscore=21.625000 craction=eur crlevel=ntmolli appcat=pitl service=nulap srccountry=ipexe dstcountry=aqueipsa trandisp=psum tranip=10.53.251.202 tranport=7501 duration=131.751000 sentbyte=6876 rcvdbyte=220 sentpkt=ugi app=ptate", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 84276, + "network.bytes": 7096, + "observer.egress.interface.name": "lo5835", + "observer.ingress.interface.name": "lo7680", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.226.255.3", + "10.123.59.69", + "10.53.251.202" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "mcolabo", + "rsa.misc.context": "psum", + "rsa.misc.event_source": "nimides", + "rsa.misc.event_type": "dolorsi", + "rsa.misc.hardware_id": "iusmodte", + "rsa.misc.log_session_id": "uisnos", + "rsa.misc.obj_name": "ptate", + "rsa.misc.policy_id": "tation", + "rsa.misc.reference_id": "edd", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "involup", + "rsa.network.dinterface": "lo5835", + "rsa.network.network_service": "nulap", + "rsa.network.sinterface": "lo7680", + "rsa.time.duration_time": 131.751, + "rsa.time.event_time": "2019-01-19T03:25:23.000Z", + "rsa.time.event_time_str": "exe", + "rsa.web.reputation_num": 21.625, + "service.type": "fortinet", + "source.bytes": 6876, + "source.geo.country_name": "ipexe", + "source.ip": [ + "10.226.255.3" + ], + "source.port": 5449, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-02-02T10:27:57.000Z", + "destination.bytes": 7868, + "destination.geo.country_name": "persp", + "destination.ip": [ + "10.212.56.26" + ], + "destination.nat.ip": "10.29.141.252", + "destination.nat.port": 2077, + "destination.port": 3032, + "event.action": "block", + "event.code": "uide", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=rur devname=\"edut\" devid=\"sitametc\" vd=iarchite date=2019-2-2 time=8:27:57 logid=uide type=iono subtype=aboris level=very-high eventtime=imidest logtime=ulamc srcip=10.3.85.176 srcport=318 srcintf=eth2546 srcintfrole=uptateve dstip=10.212.56.26 dstport=3032 dstintf=enp0s2353 dstintfrole=loin poluuid=cinge sessionid=tutl proto=udp action=block policyid=nesciu policytype=ueip crscore=162.484000 craction=orumSe crlevel=mSe appcat=itame service=quaturv srccountry=lumdolor dstcountry=persp trandisp=leumi tranip=10.29.141.252 tranport=2077 duration=106.468000 sentbyte=3472 rcvdbyte=7868 sentpkt=orum app=reseos", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 84887, + "network.bytes": 11340, + "observer.egress.interface.name": "enp0s2353", + "observer.ingress.interface.name": "eth2546", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.212.56.26", + "10.3.85.176", + "10.29.141.252" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "aboris", + "rsa.misc.context": "leumi", + "rsa.misc.event_source": "edut", + "rsa.misc.event_type": "iono", + "rsa.misc.hardware_id": "sitametc", + "rsa.misc.log_session_id": "tutl", + "rsa.misc.obj_name": "reseos", + "rsa.misc.policy_id": "nesciu", + "rsa.misc.reference_id": "uide", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "iarchite", + "rsa.network.dinterface": "enp0s2353", + "rsa.network.network_service": "quaturv", + "rsa.network.sinterface": "eth2546", + "rsa.time.duration_time": 106.468, + "rsa.time.event_time": "2019-02-02T10:27:57.000Z", + "rsa.time.event_time_str": "imidest", + "rsa.web.reputation_num": 162.484, + "service.type": "fortinet", + "source.bytes": 3472, + "source.geo.country_name": "lumdolor", + "source.ip": [ + "10.3.85.176" + ], + "source.port": 318, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-02-17T05:30:32.000Z", + "destination.bytes": 4658, + "destination.ip": [ + "10.236.175.163" + ], + "destination.port": 6562, + "event.action": "cancel", + "event.code": "oeni", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-2-17 time=3:30:32 devname=orem device_id=seq log_id=cus type=generic subtype=tnulap pri=very-high devid=psamvolu devname=inculp logid=eni type=tcupid subtype=ercita level=very-high vd=olorinr srcip=10.110.166.81 srcport=7354 srcintf=lo3023 dstip=10.181.48.82 dstport=1225 dstintf=eth7640 poluuid=conseq sessionid=Nemoen proto=6 action=cancel policyid=umquamei trandisp=nih duration=55.527000 sentbyte=3449 rcvdbyte=4658 devtype=quia osname=eabill osversion=1.95 mastersrcmac=oeiusmo srcmac=01:00:5e:82:ca:1b crscore=67.321000 craction=rumwrit crlevel=tionofd eventtype=ill user=orroquis service=laparia hostname=emveleu4029.api.local profile=tconse reqtype=ntsun url=https://internal.example.net/inc/riaturEx.htm?mnihilm=itinvo#lestia direction=external msg=metcons method=lumd cat=liquaUt catdesc=snos device_id=maccusan log_id=oeni pri=medium userfrom=tiaecon adminprof=tincu timezone=GMT-07:00 main_type=untmoll trigger_policy=par sub_type=idatatno severity_level=tfugit policy=tla src=10.126.11.186 src_port=589 dst=10.236.175.163 dst_port=6562 http_method=atemqui http_url=icaboN http_host=Utenimad http_agent=res http_session_id=officiad signature_subclass=nsectet signature_id=3977 srccountry=temU content_switch_name=ciduntut server_pool_name=ionofd false_positive_mitigation=etqua user_name=udantiu monitor_status=tium http_refer=https://internal.example.net/leumiu/iuta.html?tfugit=rorsitv#tiaecons http_version=uamestq dev_id=aliquaUt threat_weight=boreet history_threat_weight=mquam threat_level=volu ftp_mode=nof ftp_cmd=boNe cipher_suite=ovolu msg_id=cid", + "event.timezone": "GMT-07:00", + "fileset.name": "fortimanager", + "host.name": "emveleu4029.api.local", + "http.request.referrer": "https://internal.example.net/leumiu/iuta.html?tfugit=rorsitv#tiaecons", + "input.type": "log", + "log.level": "medium", + "log.offset": 85506, + "network.bytes": 8107, + "network.direction": "external", + "observer.egress.interface.name": "eth7640", + "observer.ingress.interface.name": "lo3023", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.95", + "related.ip": [ + "10.236.175.163", + "10.126.11.186" + ], + "related.user": [ + "udantiu" + ], + "rsa.internal.event_desc": "metcons", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "ill", + "rsa.misc.OS": "eabill", + "rsa.misc.action": [ + "cancel", + "atemqui" + ], + "rsa.misc.category": "idatatno", + "rsa.misc.client": "res", + "rsa.misc.context": "nih", + "rsa.misc.event_source": "inculp", + "rsa.misc.event_type": "tcupid", + "rsa.misc.fcatnum": "liquaUt", + "rsa.misc.filter": "snos", + "rsa.misc.hardware_id": "maccusan", + "rsa.misc.log_session_id": "officiad", + "rsa.misc.policy_id": "umquamei", + "rsa.misc.policy_name": "tla", + "rsa.misc.reference_id": "oeni", + "rsa.misc.rule_name": "tconse", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 3977, + "rsa.misc.version": "1.95", + "rsa.misc.vsys": "olorinr", + "rsa.network.alias_host": [ + "emveleu4029.api.local" + ], + "rsa.network.dinterface": "eth7640", + "rsa.network.network_service": "laparia", + "rsa.network.sinterface": "lo3023", + "rsa.threat.threat_desc": "volu", + "rsa.time.duration_time": 55.527, + "rsa.time.event_time": "2019-02-17T05:30:32.000Z", + "rsa.time.timezone": "GMT-07:00", + "rsa.web.reputation_num": 67.321, + "rsa.web.web_ref_domain": "Utenimad", + "rule.name": "tconse", + "service.type": "fortinet", + "source.bytes": 3449, + "source.geo.country_name": "temU", + "source.ip": [ + "10.126.11.186" + ], + "source.mac": "01:00:5e:82:ca:1b", + "source.port": 589, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://internal.example.net/inc/riaturEx.htm?mnihilm=itinvo#lestia", + "url.query": "icaboN", + "user.name": "udantiu" + }, + { + "@timestamp": "2019-03-03T12:33:06.000Z", + "destination.bytes": 3339, + "destination.geo.country_name": "paq", + "destination.ip": [ + "10.11.150.136" + ], + "destination.nat.ip": "10.83.98.220", + "destination.nat.port": 1300, + "destination.port": 3615, + "event.action": "cancel", + "event.code": "oeius", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=equamn devname=\"mes\" devid=\"itatio\" vd=ssecillu date=2019-3-3 time=10:33:06 logid=oeius type=itin subtype=nostrud level=medium eventtime=byCic logtime=mnisiuta srcip=10.171.60.173 srcport=209 srcintf=lo1917 srcintfrole=usmodite dstip=10.11.150.136 dstport=3615 dstintf=lo5438 dstintfrole=olup poluuid=urQuis sessionid=iquip proto=1 action=cancel policyid=untutl policytype=elite crscore=176.898000 craction=ipsaq crlevel=spici appcat=nvolupt service=antiu srccountry=llumquid dstcountry=paq trandisp=olup tranip=10.83.98.220 tranport=1300 duration=73.115000 sentbyte=5812 rcvdbyte=3339 sentpkt=amquis app=umtotam", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 87085, + "network.bytes": 9151, + "observer.egress.interface.name": "lo5438", + "observer.ingress.interface.name": "lo1917", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.83.98.220", + "10.171.60.173", + "10.11.150.136" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "nostrud", + "rsa.misc.context": "olup", + "rsa.misc.event_source": "mes", + "rsa.misc.event_type": "itin", + "rsa.misc.hardware_id": "itatio", + "rsa.misc.log_session_id": "iquip", + "rsa.misc.obj_name": "umtotam", + "rsa.misc.policy_id": "untutl", + "rsa.misc.reference_id": "oeius", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ssecillu", + "rsa.network.dinterface": "lo5438", + "rsa.network.network_service": "antiu", + "rsa.network.sinterface": "lo1917", + "rsa.time.duration_time": 73.115, + "rsa.time.event_time": "2019-03-03T12:33:06.000Z", + "rsa.time.event_time_str": "byCic", + "rsa.web.reputation_num": 176.898, + "service.type": "fortinet", + "source.bytes": 5812, + "source.geo.country_name": "llumquid", + "source.ip": [ + "10.171.60.173" + ], + "source.port": 209, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-17T07:35:40.000Z", + "destination.bytes": 3946, + "destination.geo.country_name": "ipisc", + "destination.ip": [ + "10.74.88.209" + ], + "destination.nat.ip": "10.92.3.166", + "destination.nat.port": 5777, + "destination.port": 740, + "event.action": "deny", + "event.code": "uiavo", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=pitlabo dtime=2019-03-17 17:35:40.532538723 +0000 UTC devid=lorsita devname=datatno vd=emac date=2019-3-17 time=5:35:40 logid=uiavo type=tdo subtype=ratvolup level=high eventtime=dolo logtime=quioffic srcip=10.238.49.73 srcport=1554 srcintf=enp0s11 srcintfrole=riatu dstip=10.74.88.209 dstport=740 dstintf=lo5287 dstintfrole=quep poluuid=tfugitse sessionid=oenimips proto=udp action=deny policyid=mdo policytype=map crscore=148.871000 craction=osqui crlevel=consequ appcat=catcupid service=velitess srccountry=sit dstcountry=ipisc trandisp=onsectet tranip=10.92.3.166 tranport=5777 duration=156.314000 sentbyte=715 rcvdbyte=3946 sentpkt=itvol app=dolo", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 87705, + "network.bytes": 4661, + "observer.egress.interface.name": "lo5287", + "observer.ingress.interface.name": "enp0s11", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.74.88.209", + "10.92.3.166", + "10.238.49.73" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "ratvolup", + "rsa.misc.context": "onsectet", + "rsa.misc.event_source": "datatno", + "rsa.misc.event_type": "tdo", + "rsa.misc.hardware_id": "lorsita", + "rsa.misc.log_session_id": "oenimips", + "rsa.misc.obj_name": "dolo", + "rsa.misc.policy_id": "mdo", + "rsa.misc.reference_id": "uiavo", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "emac", + "rsa.network.dinterface": "lo5287", + "rsa.network.network_service": "velitess", + "rsa.network.sinterface": "enp0s11", + "rsa.time.duration_time": 156.314, + "rsa.time.event_time": "2019-03-17T07:35:40.000Z", + "rsa.time.event_time_str": "dolo", + "rsa.web.reputation_num": 148.871, + "service.type": "fortinet", + "source.bytes": 715, + "source.geo.country_name": "sit", + "source.ip": [ + "10.238.49.73" + ], + "source.port": 1554, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-01T14:38:14.000Z", + "destination.bytes": 4329, + "destination.geo.country_name": "quelaud", + "destination.ip": [ + "10.187.107.47" + ], + "destination.nat.ip": "10.84.200.121", + "destination.nat.port": 3226, + "destination.port": 288, + "event.action": "allow", + "event.code": "periamea", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=amquisno dtime=2019-04-01 00:38:14.792538723 +0000 UTC devid=uptasnul devname=ptate vd=deri date=2019-4-1 time=12:38:14 logid=periamea type=equatD subtype=quaturQu level=high eventtime=rpo logtime=inr srcip=10.119.248.36 srcport=2450 srcintf=enp0s1885 srcintfrole=ten dstip=10.187.107.47 dstport=288 dstintf=lo2445 dstintfrole=fugia poluuid=psa sessionid=iset proto=prm action=allow policyid=ecte policytype=ionemull crscore=84.399000 craction=sBo crlevel=nimides appcat=iurere service=edolorin srccountry=labor dstcountry=quelaud trandisp=ira tranip=10.84.200.121 tranport=3226 duration=128.212000 sentbyte=2150 rcvdbyte=4329 sentpkt=nos app=icta", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 88364, + "network.bytes": 6479, + "observer.egress.interface.name": "lo2445", + "observer.ingress.interface.name": "enp0s1885", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.119.248.36", + "10.84.200.121", + "10.187.107.47" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "quaturQu", + "rsa.misc.context": "ira", + "rsa.misc.event_source": "ptate", + "rsa.misc.event_type": "equatD", + "rsa.misc.hardware_id": "uptasnul", + "rsa.misc.log_session_id": "iset", + "rsa.misc.obj_name": "icta", + "rsa.misc.policy_id": "ecte", + "rsa.misc.reference_id": "periamea", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "deri", + "rsa.network.dinterface": "lo2445", + "rsa.network.network_service": "edolorin", + "rsa.network.sinterface": "enp0s1885", + "rsa.time.duration_time": 128.212, + "rsa.time.event_time": "2019-04-01T14:38:14.000Z", + "rsa.time.event_time_str": "rpo", + "rsa.web.reputation_num": 84.399, + "service.type": "fortinet", + "source.bytes": 2150, + "source.geo.country_name": "labor", + "source.ip": [ + "10.119.248.36" + ], + "source.port": 2450, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-15T09:40:49.000Z", + "destination.bytes": 1057, + "destination.geo.country_name": "nvolupt", + "destination.ip": [ + "10.135.213.17" + ], + "destination.nat.ip": "10.30.239.222", + "destination.nat.port": 1546, + "destination.port": 6427, + "event.action": "block", + "event.code": "atae", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=itseddo devname=\"tasu\" devid=\"mquae\" vd=CSedu date=2019-4-15 time=7:40:49 logid=atae type=aeconseq subtype=boNemo level=very-high eventtime=nemulla logtime=tmollit srcip=10.167.128.229 srcport=4052 srcintf=eth1833 srcintfrole=ciatisu dstip=10.135.213.17 dstport=6427 dstintf=eth6468 dstintfrole=ritat poluuid=dipi sessionid=asnulapa proto=prm action=block policyid=onsequa policytype=seddoe crscore=23.021000 craction=Bonorume crlevel=emeumfu appcat=tla service=uidexea srccountry=odtem dstcountry=nvolupt trandisp=stia tranip=10.30.239.222 tranport=1546 duration=10.721000 sentbyte=6561 rcvdbyte=1057 sentpkt=itectobe app=rroq", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 89019, + "network.bytes": 7618, + "observer.egress.interface.name": "eth6468", + "observer.ingress.interface.name": "eth1833", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.167.128.229", + "10.30.239.222", + "10.135.213.17" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "boNemo", + "rsa.misc.context": "stia", + "rsa.misc.event_source": "tasu", + "rsa.misc.event_type": "aeconseq", + "rsa.misc.hardware_id": "mquae", + "rsa.misc.log_session_id": "asnulapa", + "rsa.misc.obj_name": "rroq", + "rsa.misc.policy_id": "onsequa", + "rsa.misc.reference_id": "atae", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "CSedu", + "rsa.network.dinterface": "eth6468", + "rsa.network.network_service": "uidexea", + "rsa.network.sinterface": "eth1833", + "rsa.time.duration_time": 10.721, + "rsa.time.event_time": "2019-04-15T09:40:49.000Z", + "rsa.time.event_time_str": "nemulla", + "rsa.web.reputation_num": 23.021, + "service.type": "fortinet", + "source.bytes": 6561, + "source.geo.country_name": "odtem", + "source.ip": [ + "10.167.128.229" + ], + "source.port": 4052, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-29T04:43:23.000Z", + "destination.bytes": 1150, + "destination.ip": [ + "10.115.166.48" + ], + "destination.port": 7491, + "event.action": "block", + "event.code": "tiumt", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-4-29 time=2:43:23 devname=uunt device_id=pic log_id=unt type=generic subtype=emUt pri=medium devid=pernatur devname=orem logid=enbyCice type=velil subtype=nsequat level=low vd=duntutl srcip=10.238.172.76 srcport=156 srcintf=lo1215 dstip=10.201.119.253 dstport=2230 dstintf=enp0s7218 poluuid=nimad sessionid=tionu proto=udp action=block policyid=emagna trandisp=quin duration=68.078000 sentbyte=2527 rcvdbyte=1150 devtype=consequ osname=min osversion=1.1028 mastersrcmac=edicta srcmac=01:00:5e:cd:6c:ed crscore=163.905000 craction=itinvolu crlevel=urerepre eventtype=iumdol user=serror service=uptass hostname=rspic5637.api.local profile=itatise reqtype=iut url=https://api.example.net/ita/esse.txt?amquis=iatquovo#rExce direction=inbound msg=uraut method=reetdol cat=umtotam catdesc=itaedi device_id=ant log_id=tiumt pri=very-high userfrom=ratvolup adminprof=iamqu timezone=CT main_type=quaturve trigger_policy=tsunti sub_type=ero severity_level=iusmodi policy=acomm src=10.169.133.219 src_port=92 dst=10.115.166.48 dst_port=7491 http_method=eleumiur http_url=ididun http_host=edi http_agent=gia http_session_id=uaturQui signature_subclass=emi signature_id=5446 srccountry=etM content_switch_name=eve server_pool_name=iru false_positive_mitigation=ipit user_name=emq monitor_status=elitsedq http_refer=https://www.example.net/onsequat/emagnaa.gif?itse=tco#nnumqua http_version=erit dev_id=lorsitam threat_weight=emagnama history_threat_weight=ute threat_level=Excep ftp_mode=utpersp ftp_cmd=rehe cipher_suite=tiumt msg_id=ulamc", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "rspic5637.api.local", + "http.request.referrer": "https://www.example.net/onsequat/emagnaa.gif?itse=tco#nnumqua", + "input.type": "log", + "log.level": "very-high", + "log.offset": 89654, + "network.bytes": 3677, + "network.direction": "inbound", + "observer.egress.interface.name": "enp0s7218", + "observer.ingress.interface.name": "lo1215", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1028", + "related.ip": [ + "10.169.133.219", + "10.115.166.48" + ], + "related.user": [ + "emq" + ], + "rsa.internal.event_desc": "uraut", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "iumdol", + "rsa.misc.OS": "min", + "rsa.misc.action": [ + "block", + "eleumiur" + ], + "rsa.misc.category": "ero", + "rsa.misc.client": "gia", + "rsa.misc.context": "quin", + "rsa.misc.event_source": "orem", + "rsa.misc.event_type": "velil", + "rsa.misc.fcatnum": "umtotam", + "rsa.misc.filter": "itaedi", + "rsa.misc.hardware_id": "ant", + "rsa.misc.log_session_id": "uaturQui", + "rsa.misc.policy_id": "emagna", + "rsa.misc.policy_name": "acomm", + "rsa.misc.reference_id": "tiumt", + "rsa.misc.rule_name": "itatise", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 5446, + "rsa.misc.version": "1.1028", + "rsa.misc.vsys": "duntutl", + "rsa.network.alias_host": [ + "rspic5637.api.local" + ], + "rsa.network.dinterface": "enp0s7218", + "rsa.network.network_service": "uptass", + "rsa.network.sinterface": "lo1215", + "rsa.threat.threat_desc": "Excep", + "rsa.time.duration_time": 68.078, + "rsa.time.event_time": "2019-04-29T04:43:23.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 163.905, + "rsa.web.web_ref_domain": "edi", + "rule.name": "itatise", + "service.type": "fortinet", + "source.bytes": 2527, + "source.geo.country_name": "etM", + "source.ip": [ + "10.169.133.219" + ], + "source.mac": "01:00:5e:cd:6c:ed", + "source.port": 92, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.net/ita/esse.txt?amquis=iatquovo#rExce", + "url.query": "ididun", + "user.name": "emq" + }, + { + "@timestamp": "2019-05-13T11:45:57.000Z", + "destination.bytes": 4374, + "destination.ip": [ + "10.226.39.82" + ], + "destination.port": 3950, + "event.action": "block", + "event.code": "isetqu", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=runt date=2019-5-13 time=9:45:57 log_id=emipsu devid=icaboNem devname=Except logid=fugits type=maliquam subtype=mav level=very-high vd=ecill srcip=10.36.122.89 srcport=5040 srcintf=lo3887 dstip=10.206.76.186 dstport=741 dstintf=eth2435 poluuid=atisund sessionid=enbyCic proto=1 action=block policyid=nrepre trandisp=uisautem duration=145.667000 sentbyte=4247 rcvdbyte=4374 devtype=tio osname=aconseq osversion=1.4195 mastersrcmac=enatuser srcmac=01:00:5e:1a:9c:4f crscore=124.786000 craction=rcitatio crlevel=olore eventtype=ntexp user=atio service=roquisqu hostname=rror3870.www5.local profile=volu reqtype=occ url=https://www5.example.net/culpa/isun.txt?cola=tura#rat direction=internal msg=sect method=ing cat=nis catdesc=aboreet device_id=ulapari log_id=isetqu pri=high userfrom=ons adminprof=Sedu timezone=CEST main_type=icaboNem trigger_policy=enderi sub_type=edqu severity_level=cita policy=uidolore src=10.146.255.40 src_port=3003 dst=10.226.39.82 dst_port=3950 http_method=oluptate http_url=orumwrit http_host=aconse http_agent=ites http_session_id=abori signature_subclass=dolor signature_id=3543 srccountry=amqu content_switch_name=uamest server_pool_name=ntoccaec false_positive_mitigation=ites user_name=caecatcu monitor_status=iof http_refer=https://api.example.com/uae/mdolo.txt?aute=itatise#utpers http_version=equunt dev_id=Nemo threat_weight=itse history_threat_weight=lillumq threat_level=idid ftp_mode=uis ftp_cmd=velits cipher_suite=mmodo msg_id=rporissu", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "rror3870.www5.local", + "http.request.referrer": "https://api.example.com/uae/mdolo.txt?aute=itatise#utpers", + "input.type": "log", + "log.level": "high", + "log.offset": 91192, + "network.bytes": 8621, + "network.direction": "internal", + "observer.egress.interface.name": "eth2435", + "observer.ingress.interface.name": "lo3887", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4195", + "related.ip": [ + "10.146.255.40", + "10.226.39.82" + ], + "related.user": [ + "caecatcu" + ], + "rsa.internal.event_desc": "sect", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "ntexp", + "rsa.misc.OS": "aconseq", + "rsa.misc.action": [ + "block", + "oluptate" + ], + "rsa.misc.category": "edqu", + "rsa.misc.client": "ites", + "rsa.misc.context": "uisautem", + "rsa.misc.event_source": "Except", + "rsa.misc.event_type": "maliquam", + "rsa.misc.fcatnum": "nis", + "rsa.misc.filter": "aboreet", + "rsa.misc.hardware_id": "ulapari", + "rsa.misc.log_session_id": "abori", + "rsa.misc.policy_id": "nrepre", + "rsa.misc.policy_name": "uidolore", + "rsa.misc.reference_id": "isetqu", + "rsa.misc.rule_name": "volu", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 3543, + "rsa.misc.version": "1.4195", + "rsa.misc.vsys": "ecill", + "rsa.network.alias_host": [ + "rror3870.www5.local" + ], + "rsa.network.dinterface": "eth2435", + "rsa.network.network_service": "roquisqu", + "rsa.network.sinterface": "lo3887", + "rsa.threat.threat_desc": "idid", + "rsa.time.duration_time": 145.667, + "rsa.time.event_time": "2019-05-13T11:45:57.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 124.786, + "rsa.web.web_ref_domain": "aconse", + "rule.name": "volu", + "service.type": "fortinet", + "source.bytes": 4247, + "source.geo.country_name": "amqu", + "source.ip": [ + "10.146.255.40" + ], + "source.mac": "01:00:5e:1a:9c:4f", + "source.port": 3003, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.net/culpa/isun.txt?cola=tura#rat", + "url.query": "orumwrit", + "user.name": "caecatcu" + }, + { + "@timestamp": "2019-05-28T06:48:31.000Z", + "destination.bytes": 2380, + "destination.geo.country_name": "tani", + "destination.ip": [ + "10.224.212.88" + ], + "destination.nat.ip": "10.35.240.70", + "destination.nat.port": 2587, + "destination.port": 5404, + "event.action": "deny", + "event.code": "ddoei", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=utemvel dtime=2019-05-28 04:48:31.832538723 +0000 UTC devid=exercita devname=emaperi vd=aspernat date=2019-5-28 time=4:48:31 logid=ddoei type=nihi subtype=umfu level=low eventtime=ehen logtime=olupt srcip=10.53.82.96 srcport=7088 srcintf=eth297 srcintfrole=nostru dstip=10.224.212.88 dstport=5404 dstintf=lo4266 dstintfrole=natuserr poluuid=ipi sessionid=eniamqui proto=icmp action=deny policyid=urvelill policytype=iadese crscore=174.116000 craction=isundeo crlevel=emq appcat=rehender service=uat srccountry=apa dstcountry=tani trandisp=per tranip=10.35.240.70 tranport=2587 duration=62.993000 sentbyte=7102 rcvdbyte=2380 sentpkt=ataevit app=chi", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 92675, + "network.bytes": 9482, + "observer.egress.interface.name": "lo4266", + "observer.ingress.interface.name": "eth297", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.53.82.96", + "10.224.212.88", + "10.35.240.70" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "umfu", + "rsa.misc.context": "per", + "rsa.misc.event_source": "emaperi", + "rsa.misc.event_type": "nihi", + "rsa.misc.hardware_id": "exercita", + "rsa.misc.log_session_id": "eniamqui", + "rsa.misc.obj_name": "chi", + "rsa.misc.policy_id": "urvelill", + "rsa.misc.reference_id": "ddoei", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "aspernat", + "rsa.network.dinterface": "lo4266", + "rsa.network.network_service": "uat", + "rsa.network.sinterface": "eth297", + "rsa.time.duration_time": 62.993, + "rsa.time.event_time": "2019-05-28T06:48:31.000Z", + "rsa.time.event_time_str": "ehen", + "rsa.web.reputation_num": 174.116, + "service.type": "fortinet", + "source.bytes": 7102, + "source.geo.country_name": "apa", + "source.ip": [ + "10.53.82.96" + ], + "source.port": 7088, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-11T13:51:06.000Z", + "destination.bytes": 475, + "destination.geo.country_name": "aevitae", + "destination.ip": [ + "10.233.128.7" + ], + "destination.nat.ip": "10.66.149.234", + "destination.nat.port": 6236, + "destination.port": 2455, + "event.action": "cancel", + "event.code": "uei", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=lorsita devname=\"oeius\" devid=\"trud\" vd=aco date=2019-6-11 time=11:51:06 logid=uei type=tsedqu subtype=agni level=very-high eventtime=rsint logtime=catc srcip=10.186.253.240 srcport=6982 srcintf=enp0s5429 srcintfrole=end dstip=10.233.128.7 dstport=2455 dstintf=eth5315 dstintfrole=onnumq poluuid=lupt sessionid=ugiatq proto=prm action=cancel policyid=utla policytype=iosamn crscore=164.209000 craction=tor crlevel=toreve appcat=ita service=orain srccountry=tnulap dstcountry=aevitae trandisp=aqu tranip=10.66.149.234 tranport=6236 duration=128.130000 sentbyte=6344 rcvdbyte=475 sentpkt=loremeu app=tate", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 93330, + "network.bytes": 6819, + "observer.egress.interface.name": "eth5315", + "observer.ingress.interface.name": "enp0s5429", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.186.253.240", + "10.233.128.7", + "10.66.149.234" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "agni", + "rsa.misc.context": "aqu", + "rsa.misc.event_source": "oeius", + "rsa.misc.event_type": "tsedqu", + "rsa.misc.hardware_id": "trud", + "rsa.misc.log_session_id": "ugiatq", + "rsa.misc.obj_name": "tate", + "rsa.misc.policy_id": "utla", + "rsa.misc.reference_id": "uei", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "aco", + "rsa.network.dinterface": "eth5315", + "rsa.network.network_service": "orain", + "rsa.network.sinterface": "enp0s5429", + "rsa.time.duration_time": 128.13, + "rsa.time.event_time": "2019-06-11T13:51:06.000Z", + "rsa.time.event_time_str": "rsint", + "rsa.web.reputation_num": 164.209, + "service.type": "fortinet", + "source.bytes": 6344, + "source.geo.country_name": "tnulap", + "source.ip": [ + "10.186.253.240" + ], + "source.port": 6982, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-25T08:53:40.000Z", + "destination.bytes": 1387, + "destination.geo.country_name": "avolupt", + "destination.ip": [ + "10.46.11.114" + ], + "destination.nat.ip": "10.173.140.201", + "destination.nat.port": 6422, + "destination.port": 4009, + "event.action": "cancel", + "event.code": "rsintocc", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=elaud dtime=2019-06-25 18:53:40.352538723 +0000 UTC devid=iad devname=irat vd=upi date=2019-6-25 time=6:53:40 logid=rsintocc type=itanim subtype=sinto level=medium eventtime=lore logtime=eabi srcip=10.227.133.134 srcport=3351 srcintf=enp0s4820 srcintfrole=erspici dstip=10.46.11.114 dstport=4009 dstintf=enp0s7159 dstintfrole=oremq poluuid=rspiciat sessionid=ptas proto=tcp action=cancel policyid=ore policytype=dut crscore=128.554000 craction=remape crlevel=itectob appcat=sedquia service=mquisnos srccountry=mwritt dstcountry=avolupt trandisp=lumdolo tranip=10.173.140.201 tranport=6422 duration=133.394000 sentbyte=7249 rcvdbyte=1387 sentpkt=str app=sit", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 93940, + "network.bytes": 8636, + "observer.egress.interface.name": "enp0s7159", + "observer.ingress.interface.name": "enp0s4820", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.173.140.201", + "10.227.133.134", + "10.46.11.114" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "sinto", + "rsa.misc.context": "lumdolo", + "rsa.misc.event_source": "irat", + "rsa.misc.event_type": "itanim", + "rsa.misc.hardware_id": "iad", + "rsa.misc.log_session_id": "ptas", + "rsa.misc.obj_name": "sit", + "rsa.misc.policy_id": "ore", + "rsa.misc.reference_id": "rsintocc", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "upi", + "rsa.network.dinterface": "enp0s7159", + "rsa.network.network_service": "mquisnos", + "rsa.network.sinterface": "enp0s4820", + "rsa.time.duration_time": 133.394, + "rsa.time.event_time": "2019-06-25T08:53:40.000Z", + "rsa.time.event_time_str": "lore", + "rsa.web.reputation_num": 128.554, + "service.type": "fortinet", + "source.bytes": 7249, + "source.geo.country_name": "mwritt", + "source.ip": [ + "10.227.133.134" + ], + "source.port": 3351, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-10T03:56:14.000Z", + "destination.bytes": 1751, + "destination.geo.country_name": "ari", + "destination.ip": [ + "10.69.130.207" + ], + "destination.nat.ip": "10.170.236.123", + "destination.nat.port": 4346, + "destination.port": 1191, + "event.action": "cancel", + "event.code": "sciveli", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=elillum dtime=2019-07-10 01:56:14.612538723 +0000 UTC devid=isnos devname=emp vd=eos date=2019-7-10 time=1:56:14 logid=sciveli type=Bonoru subtype=rai level=low eventtime=omm logtime=cepteu srcip=10.205.18.11 srcport=6737 srcintf=eth4759 srcintfrole=ueipsa dstip=10.69.130.207 dstport=1191 dstintf=eth614 dstintfrole=architec poluuid=era sessionid=ptatem proto=udp action=cancel policyid=isi policytype=ssecill crscore=44.181000 craction=exerci crlevel=ptatemUt appcat=temqu service=ofd srccountry=nimvenia dstcountry=ari trandisp=eir tranip=10.170.236.123 tranport=4346 duration=150.036000 sentbyte=6877 rcvdbyte=1751 sentpkt=orum app=tation", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "low", + "log.offset": 94604, + "network.bytes": 8628, + "observer.egress.interface.name": "eth614", + "observer.ingress.interface.name": "eth4759", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.205.18.11", + "10.69.130.207", + "10.170.236.123" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "rai", + "rsa.misc.context": "eir", + "rsa.misc.event_source": "emp", + "rsa.misc.event_type": "Bonoru", + "rsa.misc.hardware_id": "isnos", + "rsa.misc.log_session_id": "ptatem", + "rsa.misc.obj_name": "tation", + "rsa.misc.policy_id": "isi", + "rsa.misc.reference_id": "sciveli", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "eos", + "rsa.network.dinterface": "eth614", + "rsa.network.network_service": "ofd", + "rsa.network.sinterface": "eth4759", + "rsa.time.duration_time": 150.036, + "rsa.time.event_time": "2019-07-10T03:56:14.000Z", + "rsa.time.event_time_str": "omm", + "rsa.web.reputation_num": 44.181, + "service.type": "fortinet", + "source.bytes": 6877, + "source.geo.country_name": "nimvenia", + "source.ip": [ + "10.205.18.11" + ], + "source.port": 6737, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-24T10:58:48.000Z", + "destination.bytes": 1742, + "destination.ip": [ + "10.124.34.251" + ], + "destination.port": 3899, + "event.action": "deny", + "event.code": "mrem", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=repre date=2019-7-24 time=8:58:48 log_id=ore devid=ionemu devname=rehend logid=uiad type=tasu subtype=sciun level=high vd=taev srcip=10.196.124.206 srcport=7569 srcintf=enp0s2181 dstip=10.186.88.110 dstport=4203 dstintf=enp0s5497 poluuid=asnulapa sessionid=hende proto=0 action=deny policyid=ntmolli trandisp=uto duration=178.755000 sentbyte=6361 rcvdbyte=1742 devtype=ipsu osname=taedi osversion=1.2682 mastersrcmac=acom srcmac=01:00:5e:99:e3:a5 crscore=175.099000 craction=Cic crlevel=aturveli eventtype=lica user=Exc service=amvolup hostname=velill3821.mail.invalid profile=asnulap reqtype=usmodte url=https://example.com/loremag/mqu.gif?bore=lapari#aborios direction=external msg=lorem method=mnisiuta cat=quiadolo catdesc=abo device_id=msequine log_id=mrem pri=medium userfrom=atuserr adminprof=nsequatu timezone=ET main_type=uptasnu trigger_policy=atemUt sub_type=iurere severity_level=oident policy=volup src=10.97.254.192 src_port=302 dst=10.124.34.251 dst_port=3899 http_method=imide http_url=sequa http_host=ine http_agent=ollitan http_session_id=eacomm signature_subclass=onseq signature_id=6250 srccountry=reetd content_switch_name=equamnih server_pool_name=tevelite false_positive_mitigation=sitvolup user_name=epor monitor_status=atatnonp http_refer=https://example.org/elauda/ria.htm?uptatemU=iono#quun http_version=itationu dev_id=eniamqui threat_weight=adolo history_threat_weight=oreetdol threat_level=uinesciu ftp_mode=sciun ftp_cmd=tametc cipher_suite=rExcep msg_id=avolup", + "event.timezone": "ET", + "fileset.name": "fortimanager", + "host.name": "velill3821.mail.invalid", + "http.request.referrer": "https://example.org/elauda/ria.htm?uptatemU=iono#quun", + "input.type": "log", + "log.level": "medium", + "log.offset": 95254, + "network.bytes": 8103, + "network.direction": "external", + "observer.egress.interface.name": "enp0s5497", + "observer.ingress.interface.name": "enp0s2181", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2682", + "related.ip": [ + "10.97.254.192", + "10.124.34.251" + ], + "related.user": [ + "epor" + ], + "rsa.internal.event_desc": "lorem", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "lica", + "rsa.misc.OS": "taedi", + "rsa.misc.action": [ + "imide", + "deny" + ], + "rsa.misc.category": "iurere", + "rsa.misc.client": "ollitan", + "rsa.misc.context": "uto", + "rsa.misc.event_source": "rehend", + "rsa.misc.event_type": "tasu", + "rsa.misc.fcatnum": "quiadolo", + "rsa.misc.filter": "abo", + "rsa.misc.hardware_id": "msequine", + "rsa.misc.log_session_id": "eacomm", + "rsa.misc.policy_id": "ntmolli", + "rsa.misc.policy_name": "volup", + "rsa.misc.reference_id": "mrem", + "rsa.misc.rule_name": "asnulap", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 6250, + "rsa.misc.version": "1.2682", + "rsa.misc.vsys": "taev", + "rsa.network.alias_host": [ + "velill3821.mail.invalid" + ], + "rsa.network.dinterface": "enp0s5497", + "rsa.network.network_service": "amvolup", + "rsa.network.sinterface": "enp0s2181", + "rsa.threat.threat_desc": "uinesciu", + "rsa.time.duration_time": 178.755, + "rsa.time.event_time": "2019-07-24T10:58:48.000Z", + "rsa.time.timezone": "ET", + "rsa.web.reputation_num": 175.099, + "rsa.web.web_ref_domain": "ine", + "rule.name": "asnulap", + "service.type": "fortinet", + "source.bytes": 6361, + "source.geo.country_name": "reetd", + "source.ip": [ + "10.97.254.192" + ], + "source.mac": "01:00:5e:99:e3:a5", + "source.port": 302, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.com/loremag/mqu.gif?bore=lapari#aborios", + "url.query": "sequa", + "user.name": "epor" + }, + { + "@timestamp": "2019-08-07T06:01:23.000Z", + "destination.bytes": 3936, + "destination.geo.country_name": "tio", + "destination.ip": [ + "10.81.58.91" + ], + "destination.nat.ip": "10.204.98.238", + "destination.nat.port": 3885, + "destination.port": 2247, + "event.action": "cancel", + "event.code": "ngelit", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=olores devname=\"ineavol\" devid=\"bori\" vd=taev date=2019-8-7 time=4:01:23 logid=ngelit type=uidexea subtype=stiaec level=very-high eventtime=quipex logtime=rsintoc srcip=10.9.41.221 srcport=4010 srcintf=eth434 srcintfrole=estlabor dstip=10.81.58.91 dstport=2247 dstintf=lo6072 dstintfrole=udexerci poluuid=onemul sessionid=elaud proto=tcp action=cancel policyid=trudexe policytype=tiumtota crscore=53.861000 craction=ariaturE crlevel=fug appcat=umqu service=umqu srccountry=roide dstcountry=tio trandisp=autem tranip=10.204.98.238 tranport=3885 duration=108.380000 sentbyte=2498 rcvdbyte=3936 sentpkt=aquioffi app=aliqui", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "very-high", + "log.offset": 96754, + "network.bytes": 6434, + "observer.egress.interface.name": "lo6072", + "observer.ingress.interface.name": "eth434", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.81.58.91", + "10.204.98.238", + "10.9.41.221" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "stiaec", + "rsa.misc.context": "autem", + "rsa.misc.event_source": "ineavol", + "rsa.misc.event_type": "uidexea", + "rsa.misc.hardware_id": "bori", + "rsa.misc.log_session_id": "elaud", + "rsa.misc.obj_name": "aliqui", + "rsa.misc.policy_id": "trudexe", + "rsa.misc.reference_id": "ngelit", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "taev", + "rsa.network.dinterface": "lo6072", + "rsa.network.network_service": "umqu", + "rsa.network.sinterface": "eth434", + "rsa.time.duration_time": 108.38, + "rsa.time.event_time": "2019-08-07T06:01:23.000Z", + "rsa.time.event_time_str": "quipex", + "rsa.web.reputation_num": 53.861, + "service.type": "fortinet", + "source.bytes": 2498, + "source.geo.country_name": "roide", + "source.ip": [ + "10.9.41.221" + ], + "source.port": 4010, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-08-21T13:03:57.000Z", + "event.action": "cancel", + "event.code": "velits", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-8-21 time=11:03:57 devname=unti device_id=tena log_id=velits type=event subtype=oditautf pri=high desc=rmagni user=tiono userfrom=utemvele msg=taevi action=cancel adom=xplicabo4308.www.example session_id=tquo", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 97381, + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.user": [ + "tiono" + ], + "rsa.db.index": "taevi", + "rsa.internal.event_desc": "rmagni", + "rsa.internal.messageid": "event_fortinetmgr", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "oditautf", + "rsa.misc.event_source": "unti", + "rsa.misc.event_type": "event", + "rsa.misc.hardware_id": "tena", + "rsa.misc.log_session_id": "tquo", + "rsa.misc.reference_id": "velits", + "rsa.misc.severity": "high", + "rsa.network.domain": "xplicabo4308.www.example", + "rsa.time.event_time": "2019-08-21T13:03:57.000Z", + "server.domain": "xplicabo4308.www.example", + "service.type": "fortinet", + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "user.name": "tiono" + }, + { + "@timestamp": "2019-09-05T08:06:31.000Z", + "destination.bytes": 11, + "destination.geo.country_name": "mollita", + "destination.ip": [ + "10.37.120.29" + ], + "destination.nat.ip": "10.212.208.70", + "destination.nat.port": 3237, + "destination.port": 4170, + "event.action": "accept", + "event.code": "eiusmo", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=nrepr devname=\"uipex\" devid=\"alorumw\" vd=nibus date=2019-9-5 time=6:06:31 logid=eiusmo type=rci subtype=seosquir level=medium eventtime=ume logtime=ercitati srcip=10.35.84.125 srcport=341 srcintf=enp0s2388 srcintfrole=pernatu dstip=10.37.120.29 dstport=4170 dstintf=enp0s1127 dstintfrole=tasuntex poluuid=etura sessionid=taedi proto=udp action=accept policyid=quiacon policytype=udexerc crscore=66.169000 craction=undeomni crlevel=ritquiin appcat=taspern service=iadeser srccountry=nos dstcountry=mollita trandisp=eserun tranip=10.212.208.70 tranport=3237 duration=36.569000 sentbyte=5330 rcvdbyte=11 sentpkt=otamr app=eveli", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 97600, + "network.bytes": 5341, + "observer.egress.interface.name": "enp0s1127", + "observer.ingress.interface.name": "enp0s2388", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.212.208.70", + "10.35.84.125", + "10.37.120.29" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "seosquir", + "rsa.misc.context": "eserun", + "rsa.misc.event_source": "uipex", + "rsa.misc.event_type": "rci", + "rsa.misc.hardware_id": "alorumw", + "rsa.misc.log_session_id": "taedi", + "rsa.misc.obj_name": "eveli", + "rsa.misc.policy_id": "quiacon", + "rsa.misc.reference_id": "eiusmo", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "nibus", + "rsa.network.dinterface": "enp0s1127", + "rsa.network.network_service": "iadeser", + "rsa.network.sinterface": "enp0s2388", + "rsa.time.duration_time": 36.569, + "rsa.time.event_time": "2019-09-05T08:06:31.000Z", + "rsa.time.event_time_str": "ume", + "rsa.web.reputation_num": 66.169, + "service.type": "fortinet", + "source.bytes": 5330, + "source.geo.country_name": "nos", + "source.ip": [ + "10.35.84.125" + ], + "source.port": 341, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-09-19T03:09:05.000Z", + "destination.bytes": 7419, + "destination.geo.country_name": "ullamcor", + "destination.ip": [ + "10.199.201.26" + ], + "destination.nat.ip": "10.207.207.106", + "destination.nat.port": 2048, + "destination.port": 3770, + "event.action": "accept", + "event.code": "olor", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=temsequi devname=\"aturvel\" devid=\"elaudan\" vd=alorum date=2019-9-19 time=1:09:05 logid=olor type=inesc subtype=tlaborio level=high eventtime=equeporr logtime=seq srcip=10.143.65.84 srcport=2670 srcintf=enp0s5828 srcintfrole=ddoeiu dstip=10.199.201.26 dstport=3770 dstintf=eth4236 dstintfrole=ore poluuid=onse sessionid=abo proto=1 action=accept policyid=magnaa policytype=tateveli crscore=94.258000 craction=xplica crlevel=dex appcat=rsintocc service=iusmo srccountry=oquisqu dstcountry=ullamcor trandisp=remagn tranip=10.207.207.106 tranport=2048 duration=94.877000 sentbyte=6896 rcvdbyte=7419 sentpkt=tvolup app=ites", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 98232, + "network.bytes": 14315, + "observer.egress.interface.name": "eth4236", + "observer.ingress.interface.name": "enp0s5828", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.207.207.106", + "10.199.201.26", + "10.143.65.84" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.category": "tlaborio", + "rsa.misc.context": "remagn", + "rsa.misc.event_source": "aturvel", + "rsa.misc.event_type": "inesc", + "rsa.misc.hardware_id": "elaudan", + "rsa.misc.log_session_id": "abo", + "rsa.misc.obj_name": "ites", + "rsa.misc.policy_id": "magnaa", + "rsa.misc.reference_id": "olor", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "alorum", + "rsa.network.dinterface": "eth4236", + "rsa.network.network_service": "iusmo", + "rsa.network.sinterface": "enp0s5828", + "rsa.time.duration_time": 94.877, + "rsa.time.event_time": "2019-09-19T03:09:05.000Z", + "rsa.time.event_time_str": "equeporr", + "rsa.web.reputation_num": 94.258, + "service.type": "fortinet", + "source.bytes": 6896, + "source.geo.country_name": "oquisqu", + "source.ip": [ + "10.143.65.84" + ], + "source.port": 2670, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-03T10:11:40.000Z", + "destination.bytes": 3702, + "destination.geo.country_name": "rrorsi", + "destination.ip": [ + "10.163.236.253" + ], + "destination.nat.ip": "10.41.61.88", + "destination.nat.port": 426, + "destination.port": 7768, + "event.action": "block", + "event.code": "lestiaec", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=rExce dtime=2019-10-03 20:11:40.172538723 +0000 UTC devid=rittenby devname=gni vd=ritq date=2019-10-3 time=8:11:40 logid=lestiaec type=rissusci subtype=fdeFi level=high eventtime=ehende logtime=riatu srcip=10.204.27.48 srcport=5998 srcintf=lo7358 srcintfrole=emaperia dstip=10.163.236.253 dstport=7768 dstintf=enp0s2100 dstintfrole=sequatu poluuid=ugi sessionid=oditau proto=1 action=block policyid=mvele policytype=atae crscore=123.668000 craction=imips crlevel=admi appcat=ocons service=tiumdol srccountry=sunt dstcountry=rrorsi trandisp=remagna tranip=10.41.61.88 tranport=426 duration=82.943000 sentbyte=525 rcvdbyte=3702 sentpkt=dolor app=ips", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "high", + "log.offset": 98858, + "network.bytes": 4227, + "observer.egress.interface.name": "enp0s2100", + "observer.ingress.interface.name": "lo7358", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.41.61.88", + "10.163.236.253", + "10.204.27.48" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "fdeFi", + "rsa.misc.context": "remagna", + "rsa.misc.event_source": "gni", + "rsa.misc.event_type": "rissusci", + "rsa.misc.hardware_id": "rittenby", + "rsa.misc.log_session_id": "oditau", + "rsa.misc.obj_name": "ips", + "rsa.misc.policy_id": "mvele", + "rsa.misc.reference_id": "lestiaec", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ritq", + "rsa.network.dinterface": "enp0s2100", + "rsa.network.network_service": "tiumdol", + "rsa.network.sinterface": "lo7358", + "rsa.time.duration_time": 82.943, + "rsa.time.event_time": "2019-10-03T10:11:40.000Z", + "rsa.time.event_time_str": "ehende", + "rsa.web.reputation_num": 123.668, + "service.type": "fortinet", + "source.bytes": 525, + "source.geo.country_name": "sunt", + "source.ip": [ + "10.204.27.48" + ], + "source.port": 5998, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-18T05:14:14.000Z", + "destination.bytes": 5239, + "destination.geo.country_name": "ation", + "destination.ip": [ + "10.185.44.26" + ], + "destination.nat.ip": "10.53.110.111", + "destination.nat.port": 2549, + "destination.port": 3193, + "event.action": "cancel", + "event.code": "amest", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=ipitlab dtime=2019-10-18 03:14:14.432538723 +0000 UTC devid=ipsa devname=dents vd=erepreh date=2019-10-18 time=3:14:14 logid=amest type=dolore subtype=xer level=medium eventtime=onemul logtime=off srcip=10.246.81.164 srcport=3453 srcintf=lo3071 srcintfrole=ende dstip=10.185.44.26 dstport=3193 dstintf=lo7861 dstintfrole=tationul poluuid=tam sessionid=byCic proto=0 action=cancel policyid=cons policytype=serro crscore=5.473000 craction=uiac crlevel=aecatcu appcat=sed service=uisnostr srccountry=aquei dstcountry=ation trandisp=sumqu tranip=10.53.110.111 tranport=2549 duration=141.141000 sentbyte=5569 rcvdbyte=5239 sentpkt=entore app=uaturQ", + "fileset.name": "fortimanager", + "input.type": "log", + "log.level": "medium", + "log.offset": 99513, + "network.bytes": 10808, + "observer.egress.interface.name": "lo7861", + "observer.ingress.interface.name": "lo3071", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "related.ip": [ + "10.246.81.164", + "10.53.110.111", + "10.185.44.26" + ], + "rsa.internal.messageid": "generic_fortinetmgr_1", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "xer", + "rsa.misc.context": "sumqu", + "rsa.misc.event_source": "dents", + "rsa.misc.event_type": "dolore", + "rsa.misc.hardware_id": "ipsa", + "rsa.misc.log_session_id": "byCic", + "rsa.misc.obj_name": "uaturQ", + "rsa.misc.policy_id": "cons", + "rsa.misc.reference_id": "amest", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "erepreh", + "rsa.network.dinterface": "lo7861", + "rsa.network.network_service": "uisnostr", + "rsa.network.sinterface": "lo3071", + "rsa.time.duration_time": 141.141, + "rsa.time.event_time": "2019-10-18T05:14:14.000Z", + "rsa.time.event_time_str": "onemul", + "rsa.web.reputation_num": 5.473, + "service.type": "fortinet", + "source.bytes": 5569, + "source.geo.country_name": "aquei", + "source.ip": [ + "10.246.81.164" + ], + "source.port": 3453, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-01T12:16:48.000Z", + "destination.bytes": 4334, + "destination.ip": [ + "10.146.77.206" + ], + "destination.port": 1554, + "event.action": "allow", + "event.code": "veli", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=xpli date=2019-11-1 time=10:16:48 log_id=quae devid=totamre devname=lam logid=quamestq type=porai subtype=oinve level=medium vd=hender srcip=10.84.154.230 srcport=1335 srcintf=enp0s1127 dstip=10.212.63.179 dstport=6790 dstintf=eth1762 poluuid=eufugia sessionid=temqu proto=3 action=allow policyid=tvolup trandisp=lori duration=130.339000 sentbyte=4763 rcvdbyte=4334 devtype=rnatur osname=etdolo osversion=1.802 mastersrcmac=adipisci srcmac=01:00:5e:7b:68:0e crscore=36.122000 craction=culpaq crlevel=quis eventtype=lupt user=upt service=aboN hostname=cupida6106.www5.local profile=tdo reqtype=asperna url=https://api.example.com/aco/empo.jpg?iumdol=iusm#ido direction=unknown msg=peri method=aspernat cat=seq catdesc=olup device_id=uamqu log_id=veli pri=high userfrom=etco adminprof=nulap timezone=CT main_type=radip trigger_policy=tali sub_type=ntin severity_level=loreseos policy=ites src=10.109.172.90 src_port=2785 dst=10.146.77.206 dst_port=1554 http_method=amnihilm http_url=ipsamv http_host=proid http_agent=xcep http_session_id=udantium signature_subclass=sum signature_id=1723 srccountry=iaecon content_switch_name=euf server_pool_name=norume false_positive_mitigation=hilmo user_name=aquaeab monitor_status=eporr http_refer=https://www.example.com/metMalo/santiu.jpg?icon=enderit#roquisqu http_version=lapa dev_id=imadm threat_weight=giatquo history_threat_weight=oeiusm threat_level=oreeuf ftp_mode=iusmodt ftp_cmd=umwrit cipher_suite=atatn msg_id=uatD", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "cupida6106.www5.local", + "http.request.referrer": "https://www.example.com/metMalo/santiu.jpg?icon=enderit#roquisqu", + "input.type": "log", + "log.level": "high", + "log.offset": 100164, + "network.bytes": 9097, + "network.direction": "unknown", + "network.protocol": "GGP", + "observer.egress.interface.name": "eth1762", + "observer.ingress.interface.name": "enp0s1127", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.802", + "related.ip": [ + "10.146.77.206", + "10.109.172.90" + ], + "related.user": [ + "aquaeab" + ], + "rsa.internal.event_desc": "peri", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "lupt", + "rsa.misc.OS": "etdolo", + "rsa.misc.action": [ + "allow", + "amnihilm" + ], + "rsa.misc.category": "ntin", + "rsa.misc.client": "xcep", + "rsa.misc.context": "lori", + "rsa.misc.event_source": "lam", + "rsa.misc.event_type": "porai", + "rsa.misc.fcatnum": "seq", + "rsa.misc.filter": "olup", + "rsa.misc.hardware_id": "uamqu", + "rsa.misc.log_session_id": "udantium", + "rsa.misc.policy_id": "tvolup", + "rsa.misc.policy_name": "ites", + "rsa.misc.reference_id": "veli", + "rsa.misc.rule_name": "tdo", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 1723, + "rsa.misc.version": "1.802", + "rsa.misc.vsys": "hender", + "rsa.network.alias_host": [ + "cupida6106.www5.local" + ], + "rsa.network.dinterface": "eth1762", + "rsa.network.network_service": "aboN", + "rsa.network.sinterface": "enp0s1127", + "rsa.threat.threat_desc": "oreeuf", + "rsa.time.duration_time": 130.339, + "rsa.time.event_time": "2019-11-01T12:16:48.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 36.122, + "rsa.web.web_ref_domain": "proid", + "rule.name": "tdo", + "service.type": "fortinet", + "source.bytes": 4763, + "source.geo.country_name": "iaecon", + "source.ip": [ + "10.109.172.90" + ], + "source.mac": "01:00:5e:7b:68:0e", + "source.port": 2785, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://api.example.com/aco/empo.jpg?iumdol=iusm#ido", + "url.query": "ipsamv", + "user.name": "aquaeab" + }, + { + "@timestamp": "2019-11-15T07:19:22.000Z", + "destination.bytes": 6464, + "destination.ip": [ + "10.202.250.141" + ], + "destination.port": 1824, + "event.action": "allow", + "event.code": "ern", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-11-15 time=5:19:22 devname=ptate device_id=Nemoe log_id=cupidat type=generic subtype=onsequ pri=high devid=nostr devname=umtotam logid=mqua type=emU subtype=gnido level=very-high vd=plicab srcip=10.8.161.226 srcport=3191 srcintf=eth5256 dstip=10.13.234.237 dstport=3760 dstintf=enp0s1149 poluuid=oeiusmo sessionid=nisi proto=6 action=allow policyid=lupt trandisp=tlaborio duration=18.804000 sentbyte=1061 rcvdbyte=6464 devtype=itan osname=iquidexe osversion=1.2314 mastersrcmac=fugia srcmac=01:00:5e:09:8f:0e crscore=5.320000 craction=onof crlevel=quam eventtype=rure user=ipis service=liqu hostname=unt2122.internal.local profile=orsitame reqtype=tassitas url=https://example.org/uidolor/turve.htm?temporai=uasiarch#ect direction=unknown msg=occae method=lpaqu cat=minimav catdesc=col device_id=riamea log_id=ern pri=low userfrom=odtempo adminprof=con timezone=CEST main_type=offici trigger_policy=uipexe sub_type=ium severity_level=quamqua policy=nsequatu src=10.38.18.72 src_port=3177 dst=10.202.250.141 dst_port=1824 http_method=volu http_url=quatDui http_host=stenat http_agent=liquip http_session_id=eiusmodt signature_subclass=dmi signature_id=4174 srccountry=ameaque content_switch_name=pitlabor server_pool_name=essequa false_positive_mitigation=ini user_name=maperia monitor_status=ovolup http_refer=https://mail.example.com/veniamq/uisno.htm?luptas=omm#eaquei http_version=iveli dev_id=lill threat_weight=voluptat history_threat_weight=aturveli threat_level=incidunt ftp_mode=tatnonp ftp_cmd=abi cipher_suite=nimave msg_id=atu", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "unt2122.internal.local", + "http.request.referrer": "https://mail.example.com/veniamq/uisno.htm?luptas=omm#eaquei", + "input.type": "log", + "log.level": "low", + "log.offset": 101635, + "network.bytes": 7525, + "network.direction": "unknown", + "observer.egress.interface.name": "enp0s1149", + "observer.ingress.interface.name": "eth5256", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.2314", + "related.ip": [ + "10.38.18.72", + "10.202.250.141" + ], + "related.user": [ + "maperia" + ], + "rsa.internal.event_desc": "occae", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "rure", + "rsa.misc.OS": "iquidexe", + "rsa.misc.action": [ + "allow", + "volu" + ], + "rsa.misc.category": "ium", + "rsa.misc.client": "liquip", + "rsa.misc.context": "tlaborio", + "rsa.misc.event_source": "umtotam", + "rsa.misc.event_type": "emU", + "rsa.misc.fcatnum": "minimav", + "rsa.misc.filter": "col", + "rsa.misc.hardware_id": "riamea", + "rsa.misc.log_session_id": "eiusmodt", + "rsa.misc.policy_id": "lupt", + "rsa.misc.policy_name": "nsequatu", + "rsa.misc.reference_id": "ern", + "rsa.misc.rule_name": "orsitame", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 4174, + "rsa.misc.version": "1.2314", + "rsa.misc.vsys": "plicab", + "rsa.network.alias_host": [ + "unt2122.internal.local" + ], + "rsa.network.dinterface": "enp0s1149", + "rsa.network.network_service": "liqu", + "rsa.network.sinterface": "eth5256", + "rsa.threat.threat_desc": "incidunt", + "rsa.time.duration_time": 18.804, + "rsa.time.event_time": "2019-11-15T07:19:22.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 5.32, + "rsa.web.web_ref_domain": "stenat", + "rule.name": "orsitame", + "service.type": "fortinet", + "source.bytes": 1061, + "source.geo.country_name": "ameaque", + "source.ip": [ + "10.38.18.72" + ], + "source.mac": "01:00:5e:09:8f:0e", + "source.port": 3177, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://example.org/uidolor/turve.htm?temporai=uasiarch#ect", + "url.query": "quatDui", + "user.name": "maperia" + }, + { + "@timestamp": "2019-11-30T14:21:57.000Z", + "destination.bytes": 4714, + "destination.ip": [ + "10.139.144.75" + ], + "destination.port": 5037, + "event.action": "block", + "event.code": "rchitec", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "logver=siu date=2019-11-30 time=12:21:57 log_id=inrepr devid=cero devname=ita logid=xercitat type=meumfug subtype=umt level=very-high vd=laparia srcip=10.195.87.127 srcport=760 srcintf=lo3094 dstip=10.52.118.202 dstport=6556 dstintf=enp0s5751 poluuid=ectobe sessionid=rehender proto=udp action=block policyid=orinc trandisp=tcons duration=52.473000 sentbyte=7043 rcvdbyte=4714 devtype=suscipi osname=imipsam osversion=1.4674 mastersrcmac=hilm srcmac=01:00:5e:73:ca:c1 crscore=54.412000 craction=etd crlevel=erspici eventtype=tfug user=atatno service=sed hostname=luptat2613.internal.localhost profile=olupt reqtype=mipsum url=https://www.example.net/Maloru/lapariat.htm?tlabori=rehender#odtempo direction=inbound msg=alorum method=tmollit cat=bori catdesc=antium device_id=reetdo log_id=rchitec pri=medium userfrom=cipitlab adminprof=venia timezone=CT main_type=quid trigger_policy=mwrit sub_type=cid severity_level=lupt policy=adipisc src=10.182.124.88 src_port=116 dst=10.139.144.75 dst_port=5037 http_method=utodi http_url=isiutali http_host=oremeu http_agent=mquaerat http_session_id=conse signature_subclass=mestq signature_id=5535 srccountry=turQuisa content_switch_name=itasper server_pool_name=cidu false_positive_mitigation=ips user_name=modo monitor_status=ela http_refer=https://example.org/unti/niamqu.html?ris=veli#giatnu http_version=tanimide dev_id=ectetur threat_weight=umexer history_threat_weight=nim threat_level=nisiuta ftp_mode=cipitla ftp_cmd=ditautf cipher_suite=oluptasn msg_id=madmin", + "event.timezone": "CT", + "fileset.name": "fortimanager", + "host.name": "luptat2613.internal.localhost", + "http.request.referrer": "https://example.org/unti/niamqu.html?ris=veli#giatnu", + "input.type": "log", + "log.level": "medium", + "log.offset": 103183, + "network.bytes": 11757, + "network.direction": "inbound", + "observer.egress.interface.name": "enp0s5751", + "observer.ingress.interface.name": "lo3094", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.4674", + "related.ip": [ + "10.139.144.75", + "10.182.124.88" + ], + "related.user": [ + "modo" + ], + "rsa.internal.event_desc": "alorum", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "tfug", + "rsa.misc.OS": "imipsam", + "rsa.misc.action": [ + "block", + "utodi" + ], + "rsa.misc.category": "cid", + "rsa.misc.client": "mquaerat", + "rsa.misc.context": "tcons", + "rsa.misc.event_source": "ita", + "rsa.misc.event_type": "meumfug", + "rsa.misc.fcatnum": "bori", + "rsa.misc.filter": "antium", + "rsa.misc.hardware_id": "reetdo", + "rsa.misc.log_session_id": "conse", + "rsa.misc.policy_id": "orinc", + "rsa.misc.policy_name": "adipisc", + "rsa.misc.reference_id": "rchitec", + "rsa.misc.rule_name": "olupt", + "rsa.misc.severity": "medium", + "rsa.misc.sig_id": 5535, + "rsa.misc.version": "1.4674", + "rsa.misc.vsys": "laparia", + "rsa.network.alias_host": [ + "luptat2613.internal.localhost" + ], + "rsa.network.dinterface": "enp0s5751", + "rsa.network.network_service": "sed", + "rsa.network.sinterface": "lo3094", + "rsa.threat.threat_desc": "nisiuta", + "rsa.time.duration_time": 52.473, + "rsa.time.event_time": "2019-11-30T14:21:57.000Z", + "rsa.time.timezone": "CT", + "rsa.web.reputation_num": 54.412, + "rsa.web.web_ref_domain": "oremeu", + "rule.name": "olupt", + "service.type": "fortinet", + "source.bytes": 7043, + "source.geo.country_name": "turQuisa", + "source.ip": [ + "10.182.124.88" + ], + "source.mac": "01:00:5e:73:ca:c1", + "source.port": 116, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www.example.net/Maloru/lapariat.htm?tlabori=rehender#odtempo", + "url.query": "isiutali", + "user.name": "modo" + }, + { + "@timestamp": "2019-12-14T09:24:31.000Z", + "destination.bytes": 568, + "destination.ip": [ + "10.188.124.185" + ], + "destination.port": 5837, + "event.action": "block", + "event.code": "tate", + "event.dataset": "fortinet.fortimanager", + "event.module": "fortinet", + "event.original": "date=2019-12-14 time=7:24:31 logver=imadm devid=stla devname=cab logid=orr type=olu subtype=quatDu level=low vd=siste srcip=10.151.47.249 srcport=6697 srcintf=lo5632 dstip=10.155.194.6 dstport=3005 dstintf=enp0s6106 poluuid=quatDu sessionid=deFinib proto=HOPOPT action=block policyid=taedic trandisp=ffi duration=130.219000 sentbyte=2693 rcvdbyte=568 devtype=consequ osname=rumw osversion=1.1386 mastersrcmac=temveleu srcmac=01:00:5e:df:96:27 crscore=104.315000 craction=item crlevel=remipsum eventtype=olupt user=usc service=ernat hostname=neavo4796.internal.domain profile=tatemac reqtype=exer url=https://www5.example.com/xea/ssecill.html?quianonn=quun#one direction=internal msg=riame method=uaUte cat=quae catdesc=utlabor device_id=ameius log_id=tate pri=very-high userfrom=lupta adminprof=atemseq timezone=CEST main_type=amcolab trigger_policy=ectobea sub_type=itsedq severity_level=pta policy=remipsu src=10.35.10.19 src_port=3941 dst=10.188.124.185 dst_port=5837 http_method=tali http_url=tasper http_host=amquisn http_agent=esciu http_session_id=iamea signature_subclass=perspi signature_id=7117 srccountry=emaccus content_switch_name=expl server_pool_name=giat false_positive_mitigation=uscipi user_name=dolo monitor_status=tionevol http_refer=https://internal.example.com/uptatema/dutpers.htm?tion=iumdol#ept http_version=Mal dev_id=tquasia threat_weight=ficiad history_threat_weight=roinBC threat_level=eufu ftp_mode=tio ftp_cmd=equatDu cipher_suite=exea msg_id=tasnulap", + "event.timezone": "CEST", + "fileset.name": "fortimanager", + "host.name": "neavo4796.internal.domain", + "http.request.referrer": "https://internal.example.com/uptatema/dutpers.htm?tion=iumdol#ept", + "input.type": "log", + "log.level": "very-high", + "log.offset": 104692, + "network.bytes": 3261, + "network.direction": "internal", + "observer.egress.interface.name": "enp0s6106", + "observer.ingress.interface.name": "lo5632", + "observer.product": "FortiManager", + "observer.type": "Configuration", + "observer.vendor": "Fortinet", + "observer.version": "1.1386", + "related.ip": [ + "10.188.124.185", + "10.35.10.19" + ], + "related.user": [ + "dolo" + ], + "rsa.internal.event_desc": "riame", + "rsa.internal.messageid": "generic_fortinetmgr", + "rsa.investigations.event_vcat": "olupt", + "rsa.misc.OS": "rumw", + "rsa.misc.action": [ + "block", + "tali" + ], + "rsa.misc.category": "itsedq", + "rsa.misc.client": "esciu", + "rsa.misc.context": "ffi", + "rsa.misc.event_source": "cab", + "rsa.misc.event_type": "olu", + "rsa.misc.fcatnum": "quae", + "rsa.misc.filter": "utlabor", + "rsa.misc.hardware_id": "ameius", + "rsa.misc.log_session_id": "iamea", + "rsa.misc.policy_id": "taedic", + "rsa.misc.policy_name": "remipsu", + "rsa.misc.reference_id": "tate", + "rsa.misc.rule_name": "tatemac", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 7117, + "rsa.misc.version": "1.1386", + "rsa.misc.vsys": "siste", + "rsa.network.alias_host": [ + "neavo4796.internal.domain" + ], + "rsa.network.dinterface": "enp0s6106", + "rsa.network.network_service": "ernat", + "rsa.network.sinterface": "lo5632", + "rsa.threat.threat_desc": "eufu", + "rsa.time.duration_time": 130.219, + "rsa.time.event_time": "2019-12-14T09:24:31.000Z", + "rsa.time.timezone": "CEST", + "rsa.web.reputation_num": 104.315, + "rsa.web.web_ref_domain": "amquisn", + "rule.name": "tatemac", + "service.type": "fortinet", + "source.bytes": 2693, + "source.geo.country_name": "emaccus", + "source.ip": [ + "10.35.10.19" + ], + "source.mac": "01:00:5e:df:96:27", + "source.port": 3941, + "tags": [ + "fortinet.fortimanager", + "forwarded" + ], + "url.original": "https://www5.example.com/xea/ssecill.html?quianonn=quun#one", + "url.query": "tasper", + "user.name": "dolo" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/imperva/_meta/docs.asciidoc b/x-pack/filebeat/module/imperva/_meta/docs.asciidoc index bb1c301cd4c..5f96d5ff79b 100644 --- a/x-pack/filebeat/module/imperva/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/imperva/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc b/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc index 9b53fa89810..90b29c1ebcb 100644 --- a/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/infoblox/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/juniper/_meta/config.yml b/x-pack/filebeat/module/juniper/_meta/config.yml index 12ec5964e29..be40af66202 100644 --- a/x-pack/filebeat/module/juniper/_meta/config.yml +++ b/x-pack/filebeat/module/juniper/_meta/config.yml @@ -17,3 +17,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + netscreen: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9523 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc index 1c14aa17126..c59b7ac4a95 100644 --- a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc @@ -51,7 +51,52 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +[float] +==== `netscreen` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "netscreen" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9523` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/juniper/fields.go b/x-pack/filebeat/module/juniper/fields.go index 392e80bb2ab..6122a564654 100644 --- a/x-pack/filebeat/module/juniper/fields.go +++ b/x-pack/filebeat/module/juniper/fields.go @@ -19,5 +19,5 @@ func init() { // AssetJuniper returns asset data. // This is the base64 encoded gzipped contents of module/juniper. func AssetJuniper() string { - return "eJzsvf9zGzeSKP77/hX45IeP7ZRDJ07ie+u3d698knLRru3oLNu5erVVUyCmSSLCAGMAQ4r561+hgRkOORhKogBKvvf2h61YJBvdDaDR3/s7cgXr1+SPRvIa9F8IsdwKeE3+7v9A/v7p/W+XfyGkBMM0ry1X8jX5t78QQtrfkBkHUZrJX0j4r9f4qfvfd0TSCl4TCXal9NWESwt6RhlM3N+7rxGilqBXmlt4Taxu+p/YdQ2vHY4rpcve30uY0UbYApd8TWZUGNj6eIBu+7/3tAKiZsQuoEWMdIiR1QI04GdW09mMM7KghkwBJFFTA3oJ5WRAnzb0DsTMtWrq25Oyy9TNsoi1pGKLvPHVx9aPLbFZpDLzrb/vX2F8wwa78nHBjfse4YY0BkpiFWG0tk3gv6YrUoExdO7+TS1hqgLjiFbu8x3QhLxVc3IKTJV4jCOEeFh8F6lDyWnhwhKkLRxpiQEHhDNzP7DcIM+ZkhakNe5+cGkslbZFw0RxtLw6BMGS2t0Phthxj5NbglBLVgvOFoQSA8ZwJcmCW0MoeQ/2d24lGNPu/mRwNDpizUI1oiQSlqDJFLpzV1NtgLwDSx1qlMy0qnpLPX2r5ubFBWVXYM2zAfhTroFZsX5ObMCbkg/ghYU/4bKH5iTKSAFLEAdwUii5ez+3OHkKtQZGbcCkhBmXUBIlBaJl6VQAqWgdx6oy8yLZhdmzx+/CPT8//YEsqWjCjeclSMtnPJxOuKbMEqHmfr/0YCOQOu7Ah9OC33PbUVNtOWsE1fj7sLGT0ZMxAH3QSYmdjAHk8ZMyuiXL4+7Jy/+3J/v3xK2aZ0Pud33V9I8CCdndlkeD3ZIeIvSyo6bBqEazTG/v/dmW6/7fDzNjqYUKpH2MyNGm5LZggu7c4UeCHkir148RsYXTqR4jYlwehlhejamVHI/3pJVAD5Eeedk2AyhT2lAjek3Mzux9sXULOGwGeshASbifFbGjhwyg32BFjHNxx7VyJC7Knlclyj7PrgGZidhHIhy8M/vYMdTqRvIvDWzUaN3RH/603jZqT5Rk7nGgVj12y3ZE3Cx5XnHY5+6JW4bPOKP9+/xWzcnZEqQllyicSSNL0M4E0RAE1YD0Gb+GkhiwDsjWj7fXMOMGS7sJA9j3Nli6TRiAvtOmDD2B6f1Lhx3MAV134MndeLBQJpO+2j+Xvypj+yJS7J5IA7Lkct5+aGLHpudD+nr4yw85YIMfjTL2/GL5E6FlqZ2sHLvuu8wdUG/V18rc5avc7H31fy97Hbfyy4ZdueAdaX1vWUkomfMlyM5J9vUqAo5Fh/kv8log5WNU/r6OiMaoQ0PV60LDlwx73Q8e4gYj3dM1cvnML00u8CI9D95sS8nHdQ2E0aEEmQIBbhegyadzaX94RZQmvwhF7Y8vyZQaPEVtgGzG541G1e8Gug9Rd79iujEMms/4TOBfcL+eq1xutn3WcbvyV+9gUHpFdZlNqetJtB7ZfU6eX3ze0vco0SDo7pYSYtbGQhUe0YC2g7YAf1KNZ577t9J8ziUV7W+2tZUb+JBL/9qTGHF+8flVhAUB/QEn7s+CDqMhl1O8PpuDOlQcD319FkBL0EeJXf+KS5Hz0/tEST2+/WApgjksVvqonWyCFdn9bLRVtM43ihZeFGe6nCghgFmlv0YB7Lj3ADk37sxxQ5hnHZQO0y1F9a3aVVvIHkY/QouvYtPHoqpWymCyW6Ukma4Hm0aIhi8NGOsAGl7VYh32yX3ZCXoClC2I4SWQp98Tu9ANefnzz8/IihpiAGS3yh5OPArl9RacMLWSBvKxgn01p4KpRtrOp9BUUy/03FU2UQjkKZ2qJfSYwWU0s7IVb8ZqoNXo/WFfzbF5YFZByZtdPS0Fo76JaY6dY4HPCLf/bF5+/8NfjRfpL2oUoC3S/xxQ809nD76la9DkJTmTjNamET6y4kzKO8n1GPR7Bj8iuZWxVX58Sf7Vkfuc/Pgj+VfClHb6MlIRFn1O/n9h/6f7IjdkmynfRLdQqhIera0rV1AwKsSUsqu8GrBHTiqL14Zab1c4JoIsa8WlRdPEQjzBGQ9HAVqrTPlpG33Q1MA4FYgxYmqs0k6zlmuvdbgPllTw0h+MGFKEzFQjS/fCCEDkuZwH5ejG5MXtGzGAnCIWGK7DnrDRyC6shaLlY3nnAjrE8D+BVGA1ZxGrI5jC/S+jLeyf+1YIu2ef2o1Gq2bttk3Ir2rltmZoc3JJlHbGmFXkCqC+gWmP4sX7SpimFQNjiiUvizJX1PWslTxzkKCpxUteOg727MIl17ahwhntW753GXFx8Io7sxtj5cgMT0W46uenRDtpbdChgkyjeg62+9qNnDA6U9LTg3PCZ8Lt54TOEgoaCv7z09b3+gEqZYFchvPONOBDO12PCUr3vzYQ8xUEXsJKhakFz5nZ8KjNecMHav+j0M2czM143vHWuTcgnPX21LVWS3hC/ntEGL14mXHxADF6t6ozji5O3lwE3ZdR6djDq1rpXY2X4BP51aVBNI/D/fHJP1VoiKPpHnOlbpvyzeYnG4Pd6zlomU/Iy59fkRXyvQIqCRUi7itApz6qSRv/EVmBBg+WWiKAGkuU3CkX2Wbig6uJXzcTI3c1R9g28O53pUtkHGY1AVtIJdR8vRuIm3E90GIJ+ZmwBdWUWc9Ed6nXiD86zSVpZMjpEVs+89GK2tQF3T5QnzOIsCd2iRZF5ZRMJdswgqarUZmGknVHraQMNVYfo5DB56AYa3QL0VgqS6pLIpWuqOB/xvJ7la6i/ClDlsPBLFLNdPAk3YlJG6w7ZF4IPgOkOGLgG2BKliMK9ma7C2Nz+ln2EMQlU1UtwEYPwKgTlaICbzXfEYO9ejNtH+ggX7q1o8d57Chvn8zR41cpaReJtmlTn5oq52WT5VQ+EOPPZJmD7Q7kn0rm7rawRyy61VsV06fXftzl8EBEZbvRb4iFaxsuH1mCNr1yinJfHlhkf+972NZAU5G5KdNjSpdQ5nsHQ5JNeKZMt2KrY7SZNt0X+/H14WulVTVBqA0W5RsGkmquvFpfNcLy7ywHTWhdi7b6ZdPLpqKSzmOluYQIDO+09qJHyuNqCLdPDFEr6SNjllb1rmcwYOxWcygOb581hC24s25UCWZC3jXGopnUB+puJbUjebnUwoGbtFeAzWYO7yUcQxPCTW4X9LzTMAMNkvkDQZ1qXfIlL51mg+chLsguW0H2cYd5cSKva66PRuFmP30s6NqdRG7F2hNrnNBz+ppDCg/oft9owk0fdeE8d9K4k2eTwZJdOplqUkugaqDI3Rdix//UVwU1yC8NNEc7Su50+1O0kY8raggiUY6cG0Tuh9RMTagUbDE0g0ybVzbD6zuvcuBaFxlQrYsc2nOdUhRtA32ZHGoGXan3ijyMCbljPkbfmMFzeac351CxeZNcOyRYsHkgdrohpHYEUTZQ4lMo1qYRucNOI1aUaixTFbzwOHTGC2Zlq9nghFAZWLBlQI4cEFiC5jZn6cgewtrVQxFgL7Kzz+WTt3hx0DvQv9JdpYuDhnGnGhif8Y3hE9dufTBnrKdK0JXzZzNFNqBzMfJyUzDRuqjKEGSJ4h3M5mNtwudtK71vCSpNfrsMqbHctAkBu341XL/dobEqSVMrwxMKjludLTSnZek7TGEqf3t3R7vwNMIW+VoX3VEUyaYCzdldZVGUtiNUse0hrF/J1t0ML5b8/R6QtgRZKh0SZvdSpqZ/PED3mja0q6Z/AIvb0Q6x/LXgA3Y7CbofMS/pc/aq+2Z4IUPVfxAzwcu1oF1usVSWULIIHS/iCbRCzYs2UeVBhHp7EO8s1I/RM2VL9v0Hplth12oUH3HFXwnO1rlvzx65cIEIhObaUqxH5HIjcuZNxxn4oRGAiMXFqZIWrnNrrB1C59L76zb9UGlZGvd/+KhS0SIUawBzw+PMFlTOoZCwyi0LxgKXsOqF+lEJsVbzaWOhJyGGOfrGo+609f7zFxcdpqbJhF3HOcGzta3cxzQ0BHfzizwyff0tYtxiBZhjWNtw0GxyvvQS9IRcgt+UxoCe0DlgK++Q6T5TusVhALsF4/V2hr8n/ve9vhVKk6lWK/dZ+9ega3qza7Sf9Hl5QbVN7abrAKf2qIQ7pQbVoce6U0qUndqY60qpGkJAMddb/EYSKkDbLrtIbxYNf/PhrSA+ek0AMAkpojCXRCr5nYYa0JLZl/2AZsMxnxzWaO0uTGev4E6iHveC+whbG/4ZULbidhGUZS/rySkuOMVqE0mU/G6u3H/veQlQSSkiimNGumkvGPgCEXBIqhlx0sFyMBNyuZEpu4MN+pVVeTA+8eV8jXFGjC8Z9ck2ZRC/gfGUMNEY2x7I8I/BNuFPuHE7GWqig3/DKb746bgKdHTtx9+wuEXv2zLlU8qe3GR4OSxPEQtCjVGMo7/U7UbUnsQNe8uv4DWhpF6sDWdUkJKbq+ek1jgT5TkBy57EFWWq6SG1l3d86H2djaYVWNCG1NRgFy+DjRx8LwKmqspJMbUVtB+W1oBle9U9/x48lMbX28MMD5MX30xVdTO8gxm2jZIVl6VahXxapiSD2j7vMilGmTEgc9YIsSZfGiq887NUFeUySA3ZW0iokaer7/VMpS7tId2phG+5vIIy1AK1iejUoHcqGCjuk2861Ca83LdxYtAVIquo60928m6JXQRa9HCk1YPg9VsdPK/kctiupws6g6747mCn3C7WsCZi68//fk37x8Sa9oyL/He8I/kXXK27xhrKhgFpI0cQd7cZ0JyKIvKaZntELnHJVm3efR97D6B7YUb9AsCuzEEtB1J4jMPq7qFbULPobqhTCyNVhg1b+MzftsamKzM8aSHttAhzhHTLTIxm7lfdv4eVpsTJc0k45tw1kgmg2v0JG+FtUAsFhMHbqdvCzpujD174NcM+T4/6xWKqmnLZ9c3uP1ihbFTf4fVact2YY3v6+toIIjDu8TtOgDRyJU786r4n47in1Ftw2V3jHfu8l/n8lLz3kuZpaNxA/LS9UPTrcHsW16u9A/ohfPk99/P5KbI0lLx1YmLoPdiOyPk0QE/CxB8iJwtW3MSN1KVZ5+xlvx3VDQXaXl3Y68eW3vg+4qlxrD/pFibnpzdqsqn8czdosg6xl7LcaLQTcuLrM0O/U+E/2K/NIoJ6+xs/fBPccdPGdpWbynaPUSMFGM8Z5R+UlSJLqjmdikEVoG/KwCWpBR0RBAakydofZWtD+6qqX3niJJXTMNr6Qu72+fLF+cWuDk1Cy1jvURiryz5woOCtayE3kRaPJDmXllzyuaQoLEaOaK10zua1Twbyyx3Si1Z3U9jVEf/TIdK7y3jKShU5OO9/+0i4ZKIpwYmzMMjW/XxCnp5d06oW8JpceIeIB4vSexL3i2Bk7uixTXRObZ6WOGbcXDmV+wC87lCK13Njvg9PwwdurvaEXK3m8znofCPs4iz73I8FBBxQO11oMAslSnd6vK0+Mml0K/R+BM/CMPYepPLTD17HeNY14zg/jZeR3Do6z1RVF0fOu8JdCblXOMbV+/dMM/3OoaMk1qfOcNyMKhs2ZqUFtfSBssb6mHfSUmnsPODkeovfyJQ4qssV1Q+ToTfsqu+kKw0PkSNipDXyUydEKXlHWdtPOa7cOhF0VDtGye9aBVXvl0Le1kw+1FoDNclzg42ltkmlOHf+KMrFg5kdbvGpuia8fDH+frmXtTkGhg6jT4PGx/4uOCziV7d9xzJP3xsc8tPh3L1DnjMuVZMqxtmrIzHz5HfKSdKUToeBR/anxIBzd2bcOhJvhHByj5iGMTBm1ghy5tYnTJVg3JFom/3GLQsuS7hOzADBjT1M87ynbMGF0RTTLRJT0BjfrKjmAjN4Ih48H3+Xc0KRid+530YpkxnOoZr65kIPpBGH1cnTLp+zBm3qUHTrJcyAZUFF2CTEtx2eno0UGXo31/A9zp1Q4pWvLskr+Kr8t92HlEtDSrCUi4iTYaoa2/vdCGlKHD03s/XY0i6PDfEYf0gtVLXIls3zhpQwoyEEFDpftjH8kK3ptOIlaEHXWMhlVXhcydPIjXQfoNUdfg2ztgrc++qN5bbBxowkStjGNhg2bLrvdU0axer5dxhNjWkGWcVUVbn7lOcYnXjohPeSfWutlrz0/rO2i1wFZjQRqlTs8EDj3b1lv3Cx0RpZPy8vrhpc15j09DCyvl09r6z/Q00P9DsdTN7f1TQEYOK3q+b5GueeYkKx3/nLi3NyPlCo+mhk61obqkv2Y5CwsKurhp0nNaTv4g8LudVx5d6LiGKqytwVX4OKu12lI+BCHC4j6tEifbcEHzI4QuV5zwUcSod9Am0XD+FzXnahnBEnXpXaahyUgSd4+dMpeR3ddZPzmWqne1988t1z2kAUJmtcA2v6XgSf+jWFWHlr24VpX+LGERwhUa94ue0Q6aor6ZJyQYeBDNK5wgnWV85A65FJC/4OHeLrTxd3C8ZKFRpA+QDsgKSQbmD4fDIiEXlVTJuyXCf3z/CqSFoH1IPbGDis0fleL1V6iJqrhF0OdkrsCtMcoyCBm372qu+5SpuS266ybtMXLWAUG2y3qdjwomQTXthPpM8SS83B5dGs8pPPZ+RpqJX43AinK0+5wAIOzAM7u66Vcd98Rr4bOhrkbhTmSqqV3DKEDLAGm1kst6GPTNpk9AguuN200JO2yv19KE16C3PK1uTTqLkm+FTThyjKDwtvsZhLUlEuZ5pWsDcdo6Yap/bm75OwpVxe4LLkvSp9cvSmLWAv6yyCFLlB+8JUAceIXBbSdt+497AivzYSTcl3qgRBnnK5nHz7nHDFnpOp+z9w/0clFWvDzeTbeHzRsrqYCTqYnJ9ah9rW8E8uCC6Kvi6Uk+t2+JWa7W3UYFVWTP1fpwHPtg2CAe0OchShZZVW7u5g9vnd71QD+egTgL/99vO73998OPv2W59zu6Sa8tEzuVL6KmXJ8o0X7Pd2wX6EbdQJRmVqJSLU7KTtUtI9B5S552KdwYSZKQ3ScJZSgPRcSRkwrtJ7QSLxgVRAixXlw+HE9/YOYO/z1EDd9Uldom6aaaZLYaelsTp15TvWa2dziPXf0mTvaFvzkc9Jemixy2Yw2EClCcUmm7qXUO/iQMz4qKOpJTWbI/ZQUqPdiCJk7pb3xIXywf0E7+64cMgH/f/DcNWNyuwn/z3IESt7PvqAyF4kH+RwtHHcffgpdYSkra2d7dmlT22X0d5m2WGfzGfodhuc3Jsj023Lan6MeBgWfc0oF47XbTOXiyAzzk/7tW3YicuZgxbmkRYG41mFbc514VTEA+g5JPEa061D9dGJqqpG7nqiBtjJwxo33Re793Bt/wPiOnWHmzlMs74vbpdUlv+u4lGzDW6WWn6IZLg3dsOFt5Azjak54ypZluixLHjEfkW1HAYdHjvqRlZ1oXIJ48v37y7Ib96PuklKjSPy5aipBJf/+ZZ8aUCP9G5thCw07HbqzJvc0HOIrsmHtugsmtbVaeks4UPaB6pSjxFwQOuDHEc3QbWR4Ni94ZbpBzRQQXWVYbcc2AzuBVonLEDugDZlsqm0WzDTdrvaAl1Su6sV3hfuFCRbVFSnKivp4K5rOhhffO/oE2WDdKokMItF8rPAYJa2gKoDPJtjq6UMYNX0jwxQa5p8EobvOJX8eGHQveCpH5zQua0Cp3omR1oWlOFglPTlJw62kQmN9x7g6bxe/iSv7SL5+85kwawuSpO073oPuoN8WOTpFoCXgiaXGLIAOecyYVHkEHSO3GhZzAqz4pYllx+ymAm1MrRKn7vShy3tMh/0DFEXJgsuc4oTLmvQ1XSdLOF9ALtmV3mAL6nIcVZ4XdRaWVWkD0kh9OVPBXoc08MW2e6mUPOizMFsBzh9/huTRUWvC2tTuQ22AbsTLSDDo1BxmQlpLvMhXQtTiKkoUodFt2B/nxF48s7gPdipeyH2Yaeu6u3D/jkj7FcZYf9LRtj/IyPsv+aBbVUt6BRyiJQOenrzTBZVI1D5nq4zvJMt8Poqg15SNYLPqzqP9u20TCrmqZOQAmSeQykx8IWl943IwviExAw7aDTLY006wHmsSbM2TZ1hFimTXVl1FlPVKutMD7jOIEKsss4wywUbzZoswBvJryWVygDLcAiXrxxXMj0Ky1eqtgugZQa3mqrqgokMPmwHOEOQBOHq6dqmd4s6yCYL5LopMsQ0mOaWMyoyFBCZgs5BsnXCrKs+bEnF+k8opznwXhbYBjQLZN8OJg/WPrE2C/TpvF6+yuODNsWU279maTTGTJF2VtwOYK2Si2qT5ZojVGA6fZWb8T7+ZLO2eoDBLryfP71zxANHtS8LcN9NPl0HuR7sGReQw4YxxSzHJvJZyuLsbcA5dANT8BqTFIssoo7Xy59KY+tBM/9EsI1mWWALPoMcZoxBR3MFJU9WMLoNm8s8p6RSZSPAMJWD2wE4n2eQTao2K2qTzvzvQY9lkCcBrGHOjdU0vSdkAzuDxqehzsVqnY3XBjuR60zy1Wfm+yOeAbrVQKsMiqQvBcqFdj7lerVQ3BR+wmx66GuqaZYDXo4UwqaAvPTz7VPD5cZSmXzOcWnstNGphgW2UMHPCsoBtUmOa3o9uq1JTg0WJzfM0g+7PrTTwD6Yc1qWqe8AL1OHVdvWQRneIl4VTCtVZelK5ABnMNN4VeRJjgwdj3Kwub5K3p6pNulblvLa1JonBiqo5bZJnn0muIR0LXY2UE3SiTodXCy+Te/WEsp3PS1mQiV/zjvgGVL+nc2bXOo4oBkkjrOhM6CaPDdBqHmWoyvnWS5wrXRqAVZNm3mOa1Zxw3KIhcpkObA55kBIsNhcKTnc5DLcN4BOnfHnoaZOx5OrVWoLJEtFmfIDoJNboiq9ZqQ0nxeReVz3hruSoNO/WXXhh/ImB5t0MvUGrB/xmuWQZSjcDDNxUguDADa1NKgL70hKji41xn1YsEWqOv8BaLiuefJAQA26mmsq7aDnbgrIqyyA0z+9vhPZp087U0ATANZqXlBTJxwY0AetaWqoGqjIod9pYMgH33U0E/D0THaQ07Zw7UFWusyAcXpHpsngGzbeN5whH8BA6kQAP/A4g3Fi4Ev6AxBr0JoMagZTyvB5BsFr6tReNqNZjnugWZlckTaaxbriJgBs043Y6sNsTPKumksmUxdKRKfF3heob9KZmnw7t+mPlQeaPqLXzfRMDXddJ+/W2pTTLHnojRYZ3sLGgC5KnrrqPcvYijYylIMNlhlLq9Te4GXBpbF0lkEzWHJtc6jhy1pmaN1klW5kSjdrrC1apKPom8Yq8qGRZLB0lz2ScVjeZyp4SU40lNySE6rL0M3QYPv3ODp+clZGLo1NCEUwOESfYH8DpgSJlep0+RBc5uPcWVULtYbBYMEb+TdTTbKm3rc8Y46H3meE8840zOGaVHS30cImFivnze4wkOxICm5wOEO7eth6bKBETFPXSlsybDxKyGpBLeGW1BpmY0fhHmm5dxlCEWN8sDo6FAiXobP7SF9owWXuifw9VN1qfTwNsWoOdgF6svm+Wahm8KIRImEJuhtHZBWpqTZA3oGlOBHc31XaseDpWzU3Ly582eszchpGfD0ndhGZUoTNgD9AGH2MaEvyHuzv3Eow8X0eHuoszJvhyO7uFuHinlgDVLPFhEsexQ9n7h6hv/aO+MRZGJgM8ULQRuKs33mDc1zbJu7xBu47/dr30JS/HXdHU9eEO8wvHjH23UYUCWuabtd5FZclH+Ha4q0YcxccYxr1iEDaDK57jxOqpRiZeIndczOOA8f+uQYs0fClAWP3NO0+PFv57r3yvcqAY3n8ql5i73qkurzTbXfKPpw8Rhgb2/o7dmg3r6OUp5z9f/N8Q7fY+WkrFHDt+NlAqyFdEu8dj7B7XKbUAPHp2h02ZHCrul0Kv3gYfGU3Cr7DXGnfvj7KRkKoIQYAx53R/fOqNJWGsiOM9x10mPZLS1R7N4eGNRonoO1DugZdca9uHAvpzZJ+MAdfcgFzIAKWIAg1hs+l37jNvP740ceWzA8ov3H9PSd9+iCTnh1mjeRfGtgdk0jjl6+H72EdEw+bgtJqNLz0F5IpKQFzK8iK28WYoCAkUhnSaewaDiovurNp4diJ8qR7ooSac0YFcRiMmD6IxcNih0uNjGl8ON7Vi7WJo9dLZ1upnazW1A88FZyaYqGy2wTeiOvMNZylshlq5KRifwRPvB8A8ZfGYYtvWhjEwgRQPXkjjHKG+NZ9O8VgOfk1/GJC3sh1968BdIu2vJGW0HLCVFU3FnRcDGdx4zvC8pln3+zuBc5Y3NoQbv/ZvPz+h7862/e0tx0tx76Joh3OaZE2YnZbxw1dgyb/0vnkzIuABiIXv/Wp63/yn3m5wXnr1O/djwOTl2+SbU92B6a4dSbk/W8fzxztoME7T9BfWnLDNNRUsrXTKoN6JnZzQQhy6Dn5+O41OZf2x5fPyfn707P/ek0+nUv76ifydLVYEwncLkATtlAmjEpTWgOz+K0fXv2v/+/ZkyhHwC4yyrhdfqBMnVQ0Po7HZD59d7zml/4snrdIxa94+biQ7sumGzA/sGHcrR/4GL47iunGOvnMtW2oIG/fvI8i+6eSkM+XddjJ+N9KwiTOW4fuVyNCkZCbhSduwWN8g/fsw5xaWNEHGJGOp/uCvClLjX5af8pj6HRPL6vqQ+Oc942FnJ+8u/Cv0mh4rKLmiNGPLaeS11TD203OLxwqI94vx8MDJ0Ek4aFbe5yHrSZW+OlaxxUQPXRpWXL3ZSo2AdveLP/4O3fEA+BMQrzgKtzw0+0jMEBlk2udRa+77ZNGyfuA4YXSthPJA6FbYoANN4Db9c2S1xyZ954eLuftY9KS9W6M8RJiduOxvLgBO7R8qTGKcadyer/RQMchTi5rKucw6UwnpuSMzxsNJZmuESbIErOG4nKmPrD1wKBodERbji46y9DvQCTU/fslXMkdABoqZaEImd3p84zSs7aUpqCFT8XPALq2Og/wWYYjMctQLSxyXIdc/U/qDEylZdF64vKp5bsWvKNjsrta35nwABrsmV2AlmDJx3UNz8mn9hl7iw6wH8lF6wAbvAS/jWlq7aieIygTI6Zxi3Twiz8nVIioMlFvvogJblRjYt4StHsDubSKGIuPOZfk0/moQGGYIJtNXiUX2Q6oqjOMfXOANZjUGb0ObIYSF/8ipk5FR397Bmz9aIVCgJwnnxSJODvlI6MWOqKBepWHil4ARhKG6QQzQskvSq+oLodzugl5M8dkL02ou/HXmEs3BbsCkHHVM3HXxLvGuJWloh+q88gQbBmPmREDCrkMea6YllBx68RSGLERJ3EpqDxGHP8WDso2QaTnohwQuO2y3ERSls6CnaMBu/3ypI5UAsMuBMt0/eBuF7Gn2nLWCKoJ9osmLRJPz65fv1VzNZvFp78DK+wCsm/vFrIf3YL+NvbwPnN4O3TfNHYB0oZk8VG0TZOyc8LtEnr8kuOofzKgRxFWjWXquJwOS44jfNkwBsaM4Iydxw9rjnZY4gniRZyKO1d6TSKFCQPcjiGctnCEHRydVMIAn6mVdO+Kk1sx5bD7IRkoSttULdP1oxt5NynxXUuxZkBwKDt6gh9mRx/mkhhum4j8JFhcAEFEB6gLaggtVe1eF7sArolayc2WecZZeq2kqkbyanEmh+G+Rf1xlQin3HNZOvmjtOkYQMkvXAB5ExCbDNhwG2ev7Ajzd3I0Ybyj/0HSFUZZcBmyFtJyIUZjhBEp693vwQifr3cZ6jVSc2I8IXSqclYPRIifwoIuuWpQu2SqqrWq+EiGIhwbuTNJpwKLyGbkZD9uXC47sZMRyV0Mt7ROEkVgC8Okw2UOQDCyfodf7t3tvbKb+zZ67DZllo20u+VsqTX6EsvAC3aIWX8rLQjf4zlI0Jy1JCFDMNFvN7WA2wU+tbHZbiQgO2E/TIzV48HPlqZD2m49GE0v99MU1Au/Vka6oqZpZ4RbXoFxct1rexpqGA0ihV1I1hTixo3AxoP33AZ9y6N1SO/uBztaP96Oph8Kk2zI6a1JCw7jmygc0IYUbwTCLYTB10vdyxup00fdO3/RktCmb965ZL1UjyNAbpDjnQD5eo/jjzdvWarRBsfZstvJR31UCZLyjt1Cfhz1OKakbXAYO6UeS9B2/NTJK3cauygqsAv1AFESuuVJJh6N8LXRDcdeSlpl9Trtiep8UCL4ax0ie85lJk/If01+/v578vTt6ZuLZ+SUG8vlvOFmASWWwkdxEWqusvcF2hcJw2zZmccjbDN+cSRjTKvMXsV99Z9uV2MYdDcGPfLJhj7f5bowTPvv6n57jj/EKRYzpTLWJn2TKUZFqu50O4R8oCVvjF+BKE0Mr7ig2osnJzbdHWL4rsfLq/CeG14es9NIP1P+kzsIrRdxpy/m5pLnq7N4I/fddQxrhErDnv83OInwk8FZCI4b6JVllHFXptI5EwMGIRtktdJzKvmfe7KqZb6jcFtmH8Dp/pkaYfeM62gtaaauP7+45fC18C2+fO+irazmX4EKu2BUA6k1lKrikkYL7nri6YJaDtKaG9PjBT0mtW/pgxLrWz9CnenguqvzxAmummqLzZA2pO4Xq0dsdhSEzW0k6gxK0NRCWSRLKttzPpzw+aVdsQueXWi15GXXPCx8j9a1CJrq4GCE5j/uWdvWaeMKzoZIXh6Jym7J0OvPrkfIjA4PxczJJffR88Wu4j7SAq5TOlMOBb+r5gnXqDP1ftSrhJ5HCPU6Kmqs1BBjlfYS30GrwFJc7Ql+a+K+9SROfcXLUsDxpNw7XO+2ci6yvT25d5Cca8djHIfci7Bar8OQXLfR2eekFtRtmXuflSYgmV7XY15+TIU8gj15iww63dmWvypjyTvKFlyOmHQlzSQ5vtnl9SeJmf61Bic+nH7km5yZCXlb0pp8xn94/ahU0ted/nP4eJIFXYLTnARQTb40oNcEexCaWkkDrUYVL0519Bb4m+PIy9ADjznImrddIKUn3/flG8ezJekIqG4O0IfQHPW2mOKUp7wOs90z3raW3mpi5GzD8PByQ3QjZdSONc+7l8dHnn0bqZEauwCxCBZm/o2gZMVlqVaGmBoYn3HmPnkeqxMMebLDC+LI8/hucm7IU+wIC5JtniEMXT7rcYs0Et/xtzCnbE0+me3Gt10EttotpE2eXetWOILBPvLa900tRAVr1fCQuRdxwPGuD0Ck+n+r0hTLeYbs2yY7v0I91p3Xq9cRipHC6EELvzmA2OPk9Y6RGjJ8g+u9lXVnSPp4F9AhNcdx2HUBg+292SRk+m0Y7FC8IcXNxc9YNpByJOBohRuSXMKMy+CrR+GEXf0qWo80HUTsDioUy4TbxgGzo/6lFoydzzY37aGX0khvys6HbS1li+rILfA3qyLDycA66m9HliEvUy7TTRBLejccyVhUmPfxjAipftkObotvo70p749M7RxgnfftuwHrmur2TLk/P9+QslrwQSt14m6Hs2V98vutyLPJZ5b4thZKr/Nt+N9MTeW/3dgxpkVku4t6q57HnibHlr+9QOg30PZgKtGAqrbf+n6qRk9BAdJqVR8iOkrVTAfOhVud8bCms7bhhnIExNFXdxz3Hp6oqqZy3d1HvHY4Tt/bK0vQ7hkquJypuFJAzVXuGqEb5MeOFdlitoK8XdFnX3LlCPzSCLEm/9lQwWccSnKKdc/eORhFZQXTgil1xR8o6P47TIlff2M/UzGmzSfvNrsJh9eNRZX7wBGmN9/1D90SYcpOcEd7n/yEfFzXnvSN58Axx+/g+OZpmBVJm8nuoO1w8I4I/cTE2tbuInMMV12nXG5j5z2LtdKttx9DzB/ejmx5r1dO4uPU8qLOO4doDyvcyjd67ls0tVKZNJFtpNw6bj9ITW3cNclkQU3KaH8PsA7l9IkhN1ok3OYe1IS70hmjRaNTeUN6MA3ogs7T2ZQb0Mmfp23QSdMft0GHU59BsMC1BYmqVXrjxMFPdpo7RW+hYSdVJrVG5Zc4Ri3hlsz9iMuievUi/PdJQOFF+I+Q1xRz+1MBOp6dF8h5wOi5J6YfPEePa2/U2oCcMgxEcyYVlzPQeiTuOqT7KHT1Ff8bWR91zx4BybYv8ay3DZErhWFtlfVKRZY42vE783F7d+w+Ygax7v/pHzBM0Bof+MnrBejj+COczh4ynp6e4OjHZ+QE14+jBtoeqVnKCJ9PQIfhn7CVhbmnOS9kDR33GNnbcLfoE9PrFL13p/mfh3ol794aJb7b5JL/GffW8KtMMuX8H2dEwlxZ7jewXlAzMgHKsGO3FeptpV98fLig2+psE6AGCS47Z6xtnN7W38QTUgyfH6OiYru/UTf18OPooGUnTbgxTXKlEyFjslQ+b939YiiIIWid1Qc62JS+9Dxzi5NLDE7vk05HyZDoOoOHKPLTS0zt3P8Y9aTnYUjeXXruwXFchBojimXOF303pBoc2VFkysIdPdokb9NocgHmVxAs6kzNDb7ZjCvpP0goW38iBuN1SpPzyzf/eHdBLtw7RX6TI9NXNthmqqQ+BNuPKxXHFsUQWwC7Mgc5kW8nhPP2IIsNnev6dXYtwjANNIwg3EjBPVouaD5oCvkASq7Ho+sKMmo0IM6W2uZoEz77WC6p4KU/iBEkdgXh0bpa7xOEyLErWJtdsZ3o5LcJpIlhL6ytTcFxBm0W0LiVORjC6CO4TXwu28oXpbld33CjmKqqrH3ibom3xyM4hOIl+CuuQexamqldLCtBZWHMQw28dSt7Gf57oLat0Ypi60uNi1rxY6RVxxD2GBDEAJGKWwPIVragUg4aZ+RuNxVWRURGYrZHatvcPSxh5uHvb9+8D+/ei53luwfFKr3r+0/es42bq2KpRJOLAW/aOc4yzLnpJmO343wbya0hTz0S5hl268DC3nai7g54gkhHqRFNJmn2NuD6SXIb0gUm20UHS9CYKTBrBGFKMqitM5Qv/R6OtFdYrXJKX894Z7C3I7QdorXSlijH31///U0sBTfK9tTnTun58RMsdwsMtlysU+qbnUQbxfzH2W8X5xfkHb2uuCy7sd7xbXW0HT0Nc2uI4ghZgYwBdfvI6tSneMli8vRsX+VYzI5XsPnQRfgtydnVji1nWZDK56ehS2/AYi+G4nib8sC9AlqKq//2dcNdYY4sh5pk6tuN/hJnQj9QdmMYV41WfBfUrXxx73NimkiKOjXkb8ZqJef/NhWUXQluLJR/exH+9rz7lMsZsPhHM65hRUVUkaFT0fsNobIkRpGRY6lhzo3Va2fZH1NY1NQuQrP+Dgeyi8MASXRKHQtNXwjt67WY0r0u5J0+2WEO0ur1X/5PAAAA///7GLnI" + return "eJzsvW2TGzeSIPx9fwUefzhJDpmyZVt7o5udC213e9w7ktyrluSNi4moAFEgCTcKKAEosulf/wQSqBdWochuNlBs7d18mLCaZCKRSCTyPb9DN3T7Gv1RCVZS9S8IGWY4fY3+w/0B/cen979d/wtCOdVEsdIwKV6jv/0LQqj+DVowynM9+xfk/+s1fGr/9x0SuKCvkaBmI9XNjAlD1QITOrN/b76GkFxTtVHM0NfIqKr7idmW9LXFcSNV3vl7The44iaDJV+jBeaa7nw8QLf+33tcUCQXyKxojRhqEEObFVUUPjMKLxaMoBXWaE6pQHKuqVrTfDbYn9L4HptZKlmVd99Kn6jtsoC1wHxne+Orj60fWqJdpNDLnb/vX2H8wAan8nHFtP0eYhpVmubISERwaSpPf4U3qKBa46X9NzaIyIJqu2lpP++BRuitXKJzSmQObBzYiIPF+kgdu50aLl1TYTK7tciAPcKJqe9JroHmRApDhdH2fjChDRamRkMHcTSsOAbBHJv+B0PsmMPJLoGwQZsVIyuEkaZaMynQihmNMHpPze/MCKp1ffqzAWs0m9UrWfEcCbqmCs1pw3clVpqid9RgixpGCyWLzlJP38qlfnGFyQ01+tkA/DlTlBi+fY6MxxujD9QJC8fhooPmLEhITteUH0FJLkX/fu5Q8pyWihJsPCY5XTBBcyQFB7QMnnOKClyGsSr0Mot2Yfac8Tt/zy/Pf0BrzCt/41lOhWEL5rmT3mJiEJdLd15qcBCwO2bBe26B79njKLEyjFQcK/i9P9jZKGcMQB/FKSHOGEAe55TRI1lPeyYv/9+Z7D8Tu2qaA3nY9ZXzPzLYSP9YHg12a3yM0EuOmqJaVookensfTrZU9/9hmGmDDS2oMI8ROVzlzGSE494dfiToUWHU9jEitrI61WNEjInjEEurMdWS4/FyWk7xMdIjLdkWlOYxbagRvSZkZ3a+WLsFLDYDPWSgJDzMiujpIQPoB6yIcSr2XCsTUVF0vCpB8jlyDbYZiXwoQMF7k49MoVZXgn2paKtGq2b//k/bXaP2TApiHwds5GO3bEfEzZqlFYdd6p7ZZdiCEdy9z2/lEl2sqTDoGoQzqkROlTVBFPWCarD1BbulOdLUWCA7P95dQ48bLPUhDGA/2GBpDmEA+l6HMvQExvcvHceYg33dgyb3o8FK6kT6apcvf5XadEUk73OkpiJnYll/qENs0/EhfT30Zccw2OBHo4S9vFr/hHCeKysrx657n7iD3Rv5tRJ3/So1eV/930teS630sqEvF5wjrestyxFGS7amonGSfb2KgCXRcf6LtBZI/hiVv68jojHq0JDlNlP0S4Kz7gYP4YBh3/MtUPnCLY2u4CI9995sg9HHbUkRwUMJMqeIMrOiCn26FOaHV0gq9AuX2Pz4Es2xBi6qA2QLtqwUqH4H9n2MuvsV7xvCoOmMzwj+BfvrpUzlZttnHdcrf/UOBqk2WOXJlLqOROtsu0vJy6vPO/oeRopy3D9ShPRWG1r4R9SjbaGtqONU7Yhn/y0VWzKBef2bXW3lAB1S6V97EiMurz6/CpDAoz+gxMNJ0GA0pHKM16dl1KHieOzrs6I4p2qS2PWvsBS6PH9IlNTh2w2WApjjYqWP2snGSZbcz4ZrReuyVbTgoljT5UxyTomR6msUwJZ6J8i5sTzHNCKOdDS3mO4oqm9lX21Bewj9CC2+gswfi6paSA3JboUUaL4dHBpCin6pqDYWoGZFybf+nOyXraBHFJMV0iyn6On3yKxUhV7+/PMztMEaaUpFs8oeSjwK5fUOlNClFJqmIwX5ariCyEqYxqdQFXMn9OxV1kEI6CmeyzXtEIOJYGZlLd60URQXo/eHfDVsc2JS0ZxVfT0tBqG+CWmOjWOBLRAz/6xefv/DX7QT6S9KEKA10v8c7Oaf1h58i7dUoZfoQhBc6oq7yIo1Ke8l10PQHxj8CORWhlb58SX6N7vd5+jHH9G/ISKV1ZdhF37R5+h/cPO/7BeZRrtE+SZ4hELm9NHaumJDM4I5n2Nyk1YDdsgJaeDaYOPsCktEKvJSMmHANDE0nOAMzJFRpWSi/LRWH9QlJQxzwBgw1UYqq1mLrdM67AdrzFnuGCOEFEILWYncvjCcAvJMLL1ydDB5cfdGDCDHiAX667AnbDRyClsucf5Y3jmPDtLsT4oKahQjAavDm8LdL4Mt7J77WgjbZx+bVqOVi/rYZuhXubFHM7Q5mUBSWWPMSHRDaXmAaI/ixftKiKYkoVpna5Zneaqo60UteZZUUIUNXPLcUrBjF66ZMhXm1mjf8b2LgIuDFcya3RArB2K4XfirfnmOlJXWGhwqQDSsltQ0XztICa0SJT2dnBIuE24/JVSSUNBQ8F+e177XD7SQhqJrz+9EUXho59sxQWn/VwdivoLAi18p0yVnKTMbHrU5r9lA7X8UupmVuQn5HW6dfQM8r9dcV1st/gn57xFhdOJlwfgJYvR2VWscXZ29ufK6L8HCkocVpVR9jRfBE/nVpUFUj8P98ck9VWCIg+kecqXumvJV+5PWYHd6DljmM/Ty51doA3QvKBYIcx72FYBTH9Sk1n+ENlRRBxYbxCnWBknRKxfZJeLJ1cSvm4iBu5oibOtp97tUORAOspooWQnJ5XLbD8QtmBposQj9jMgKK0yMI6K91FvAH5zmAlXC5/TwHZ/5aEVt7IJuF6hPGUTYE7sEi6KwSqYUdRhB4c2oTAPJ2lMrMQGN1cUohPc5SEIqVUPUBoscqxwJqQrM2Z+h/F6piiB9cp/lcDSJZDUfPEn3IlKLdYPMC84WFHYcMPA1JVLkIwp2e9yZNin9LHs2xASRRcmpCTLAqBMVgwJvFOuJwU69mTInYuRru3aQncdYeZczR9mvkMKsIh1TW58aK+elzXLKT0T4C5GnILsF+acUqbst7BGLdvVaxXTptR/7FB6IqGQ3+g0y9Nb4y4fWVOlOOUW+Lw8scL4PZbYtxbG22ZbpEalymqd7B32SjX+mdLNirWPUmTbNF7vx9eFrpWQxA6gVFOVrQgVWTDq1vqi4Yd8ZRhXCZcnr6pe2l02BBV6GSnMR4hDeqe1Fh5TDVSNmnmgkN8JFxgwuyr5n0GNsV7MoDm+f0YismLVuZE71DL2rtAEzqQvU3kpsRvJysaFHHtJeAbZYWLzXdApNCA65XtDRTtEFVVQQxxDYqtY5W7PcajbAD2FBdl0Lso894oU3eVsyNdkO2/N0saBby4nM8K3brLZCz+prFilg0P2+0YiHPurCeW6lcSPPZoMlm3QyWcWWQMVAkXsoxIb+sa8KaJBfKlpNxkqWux0XtfJxgzUCJPIRvgHkfohN1IhKwQ5BE8i0ZWESvL7LIgWuZZYA1TJLoT2XMUXRLtCX0aEm0JU6r8hpTMie+Rh8YwbP5b3enGPF5iG5dkywoH0get0QYjuCMBko8TEUa13x1GGnEStKVobIgr5wODTGC2Rly8WAQ7DwJNgxIEcYhK6pYiZl6ciejdWr+yLATmRnn8snbfHioHege6WbShcLDeJOJSVswVrDJ6zdumDOWE8Vryunz2YKHEDjYmR5WzBRu6hyH2QJ4u3N5qkO4fOuld61BKVCv1371Fim64SAvl8N1q9PaKxKUpdSs4iC4068Bea0yF2HKUjlr+/uaBeeipssXeuie4oiURVUMXJfWRTc2wRVbHs21q1ka26GE0vufg+2tqYil8onzO7dmZz/cYLuNXVoV87/oCRsR1vE0teCD8htJeh+xJykT9mr7pvhhfRV/17MeC/XCje5xUIahNHKd7wIJ9ByuczqRJWTCPWaEe8t1KfombIj+/4O6VbQtRrER1jxl5yRberbs0cuXAECvrm24NsRuVzxlHnTYQJ+qDgFxMLiVApDb1NrrA1Cl8L569p+qDjPtf0/eFQxrxEKNYA58DiTFRZLmgm6SS0LxgKXdNMJ9YMSYoxi88rQjoQY5uhrh7rV1rvPX1h06BJHE3YN5ThL1rZyH9HAEOznFzlkuvpbwLiFCjBLsLrhoG5zvtSaqhm6pu5QKk3VDC8ptPL2me4LqWocBrBrME5vJ/B75H7f6VshFZorubGf1X/1uqYzu0b7SV/mV1iZ2G66BnBsj4q/U3JQHTrVnZI8b9TGVFdKltQHFFO9xW8Ewpwq02QXqXZR/zcX3vLio9MEAJKQAgpzjoQU3ylaUrBk9mU/gNkw5ZNDKqXshWnsFThJ0ONeMBdhq8M/g51tmFl5ZdnJenQOC86h2kQgKb5bSvvfe14CUFKygOKYcN+4Ewx8AQhYJOUCWelgGNUzdN3KlP5gg25lVRqMz1w5X6WtEeNKRl2yTe7Fryc8RoRX2tQM6f8xOCb4CdP2JH1NtPdvWMUXPh1XgSbXftwNC1v0ri1TOqXsySHDy2J5DlggrLUkDPyl9jSC9iQc2Ft2Q18jjMrVVjOCOcqZvnmOSgUzUZ4jasiTsKKMFT6m9vKeD72rs1G4oIYqjUqsoYuXhkYOrhcBkUVhpZjcCdoPS2uoIXvVPfcenErj65xhgofJiW8ii7Ia3sEEx4bRholcbnw+LZGC0NI8bzIpRokx2Oai4nyLvlSYO+dnLgvMhJcaorMQlyNPV9frGUtd2rN1qxK+ZeKG5r4WqE5Exxq8U95AsZ9806A2Y/m+g+ODrhBJRV13spNzS/QRqNGDkVYnweu30nte0fWwXU8TdKaqYP3BTqldrH5NwNbx/35N+8fImvaC8fR3vNnyL7Bac40VzStCUR05omF3m6aKYZ4FXtNkj8g1LFmrzf33sfMA2hdm1C9AyY0+quVADI+xX90+dCusV80NtWphoMqwIiuX+VvX2DRlhmc1pF6LMLuRZpmZVsT+qvn3sNIUWXkuEIOcu0oQTrGyf4JGeC1qvoDQeztVXdh5OPrghF817PP0qF8sIos5E03f7O6D5ctG1T1erzVTlZ7a09fVRgCBcY/fNAHSwJU4c6u7nozjnlJnwSV3jTfkc17my3P03kmap75xA3LT9nzRr8XtWVivdg7oU/jyO+7ny3MgqS95a8TE0HuwG5FzaYBuCzPHRFYWbJgOG6lrvU3Zy343qusLtJ26sNePLZzxPSHXWNKfNQujy/ODmmws/9wBTdYi9lLkrUY7Q2euPtP3O+Xug/3aLCCodr/xwzfeHTevTFO5KU3zGFWCU+0oI92DspFojRXDcz6oAnRNGZhAJccjgkBToZP2R9k50K6q6laeWUllNYy6vpDZc75+cXnV16GRbxnrPApjddlHDhS8cy1kG2lxSKJLYdA1WwoMwmKERUupUjavfTKQX5ZJr2rdTUJXR/hPi0jnLgOX5TLAOO9/+4iYILzKqRVnfpCt/fkMPb24xUXJ6Wt05RwiDixI71nYLwKRucljm+Ccap+WMGZM31iV+wi87lGK13FjvvdPwwemb/aEXI1iyyVV6UbYhUn2uRsL8DiAdrpSVK8kzy33OFt9ZNLoTuh9As/CMPbupfLTD07HeNY047g8D5eR3Dk6T2RRZhPnXcGp+NwrGOPq/Hu6mn9n0ZEC6lMXMG5G5hUZs9K8WnqirLEu5o20lAo6D1i5XuM3MiUOq3yD1Wky9IZd9a10xf4hspsYaY381ApRjN5hUvdTDiu3VgRNasdI8V2toKr9UsjZmtGHWiuKdfTcYG2wqWIpzo0/CjN+MrPDLj6Xt4jlL8bfL/uyVlNgaDH6NGh87O6CxSJ8det3LPH0vQGTnw/n7h3znDEhq1gxzk4diV5Gv1NWksZ0Ogw8sj9FBpy6M+MOS7zh3Mo9pCtCqNaLiqMLuz4iMqfaskTd7DdsWTCR09vIBOBMm+M0zwfKFlgYTDFVIzGnCuKbBVaMQwZPwIPn4u9iiTAQ8Tv72+DORAI+lHPXXOhEGrFfHT1t8jlLqnTpi26dhBmQzKsIbUJ83eHp2UiRoXNzDd/j1AklTvlqkry8r8p9236ImdAopwYzHnAyzGVlOr8b2Zrkk+dm1h5b3OSxAR7jD6mhRcmTZfO8QTldYB8C8p0v6xi+z9a0WvGaKo63UMhlpH9c0dPAjbQfgNXtf00XdRW489Vrw0wFjRlRcGOtbTBs2PTQ6xo1itXx7xAcG9MEsorIorD3KQ0bnTnoiHWSfUsl1yx3/rO6i1xB9WgiVC7J8YHG+3vLfmG81RpJNy8vrBrclpD0dBpZX6+eVtb/IedH+p2O3t5/yLkPwIRvV8nSNc49h4Rid/LXV5focqBQddFI1rXWV5fsxyBiYVdTDbuMakjfxx/mc6vDyr0TEdlc5qkrvgYVd32lw+OCLC4j6tEqfrcEFzKYoPK84wL2pcMugbaJh7Aly5tQzogTr4htNQ7KwCO8/PGUvGbfZZXymaqne199ct1z6kAUJGvcUlJ1vQgu9WtOQ+WtdRemfYkbEzhCgl7xfNch0lRX4jVmHA8DGahxhSOor1xQpUYmLbg7dIyvP17czRsrhW8A5QKwgy35dAPNlrMRiciKbF7l+Ta6f4YVWdQ6oA7cStPjGp3v9VLFh6iYjNjloFdil+lqioIEprvZq67nKq5yZprKurYvmscoNNiurdhwoqQNL+zfpMsSi03B9WRW+dnnC/TU10p8rrjVleeMQwEH5IFd3JZS228+Q98NHQ2iH4W5EXIjdgwhTUkFzSzWu9BHJm0SPIELrp8WelZXub/3pUlv6RKTLfo0aq5xNlf4FEX5fuEdEjOBCszEQuGC7k3HKLGCqb3p+yTsKJdXsCx6L3OXHN22BexknQWQQge0L0gVsIRIZSHt9o17Tzfo10qAKflO5pSjp0ysZ98+R0yS52hu/4/a/8MC861mevZtOL5oSJktOB5Mzo+tQ+1q+GdXCBYFXxfIyW09/Eou9jZqMDIppu6vc49n3QZBU2UZOYjQuogrd3uYfX73O1YUfXQJwN9++/nd728+XHz7rcu5XWOF2ShPbqS6iVmyfPCC/V4v2I2wjTrBsIitRPianbhdSprnABP7XGwTmDALqajQjMQUIB1XUgKMi/hekEB8IBbQbIPZcDjxg70D0Ps8NlB7fWKXqOtqnuhSmHmujYpd+Q712skcYt23NNo7Wtd8pHOSHlvs0g4GG6g0vtikrXvx9S4WxIKNOprqrSZzxB671WA3osA2++U9YaF8dD/B+zsuLPJe//8wXLVVmd3kv5OwWN7x0XtE9iJ5Euao47j78JNygqStnZPt2KVPTZPRXmfZQZ/MZ+B2G3Du4ch03bKaTREPg6KvBWbc0rpu5nLlZcblebe2DTpxWXPQ0GWghcF4VmGdc51ZFfGI/RyTeA3p1r766EwWRSX6nqgBduK4xk0Pxe49vTV/p2GdusFNH6dZPxS3ayzyf5fhqFmLm8GGHSMZHozdcOEd5HSlS0aYjJYlOpUFD9hvsBLDoMNjR12LosxkKmF8/f7dFfrN+VHbpNQwIl8mTSW4/s+36EtF1Ujv1oqLTNF+p860yQ0dh+gWfaiLzoJpXY2WTiI+pF2gMvYYAQu0PMpxdAiqCQTHHgw3jz+gAXOsigSnZcEmcC/gMmIBcgO0yqNNpd2BGbfb1Q7oHJu+VvhQuHMqyKrAKlZZSQN3W+LB+OIHR58wGaRTRYGZraLzAqGLuAVUDeDFElotJQAr538kgFri6JMwXMep6OwFQfeMxX5wfOe2glrVMzrSIsMEBqPELz+xsLWIaLx3AM+X5foncWtW0d93IjJiVJbrqH3XO9At5OMiT3cAvOY4usQQGRVLJiIWRQ5Bp8iNFtki0xtmSHT5IbIFlxuNi/i5K13YwqzTQU8QdSEiYyKlOGGipKqYb6MlvA9gl+QmDfA15il4hZVZqaSRWfyQFEBf/5SBxzE+bJ7sbnK5zPIUxLaA4+e/EZEV+DYzJpbbYBew5WhOEzwKBROJkGYiHdIl1xmf8yx2WHQH9vcJgUfvDN6BHbsXYhd27KreLuyfE8J+lRD2vyaE/T8Twv5LGthGlhzPaQqR0kCPb56JrKg4KN/zbYJ3sgZe3iTQS4qKs2VRptG+rZaJ+TJ2EpKHzFIoJZp+IfF9IyLTLiExwQlqRdJYkxZwGmtSb3VVJphFSkRTVp3EVDXSWNOD3iYQIUYaa5ilgg1mTRLglWC3AgupKUnAhOtXliqJHoX1K1maFcV5AreaLMqM8AQ+bAs4QZAE4Kr51sR3i1rIOgnkssoSxDSIYoYRzBMUEOkML6kg24hZV13YAvPtnzSfp8B7nUEb0CSQXTuYNFi7xNok0OfLcv0qjQ9aZ3Nm/pKk0RjRWdxZcT3ASkYX1TrJNQeolKj4VW7a+fijzdrqAKZm5fz88Z0jDjiofUmAu27y8TrIdWAvGKcpbBidLVIcIlvELM7eBZxCN9AZKyFJMUsi6li5/inXphw0848EWyuSBDZnC5rCjNHgaC5ozqIVjO7CZiINlxQyrzjVRKagtgfOlglkkyz1BpuoM/870EMZ5FEAK7pk2igc3xPSwk6g8SlapiK1SkZrDZ3IVSL56jLzHYsngG4UxUUCRdKVAqVCO51yvVlJpjM3YTY+9C1WOAmD5yOFsDEgr918+9hwmTZYRJ9znGszr1SsYYE1VOpmBaWAWkXHNb4eXdckxwYLkxsW8YddH9tpYB/MJc7z2HeA5bHDqnXroARvESsyoqQsknQlsoATmGmsyNIkR/qORynIXN5Eb89U6vgtS1mpS8UiA+XYMFNFzz7jTNB4LXZaqDrqRJ0GLhTfxndrcem6nmYLLqM/5w3wBCn/1uaNLnUs0AQSx9rQCVCNnpvA5TIJ64plkgtcShVbgBXzapnimhVMkxRiodBJGDbFHAhBDTRXig43ugx3DaBjZ/w5qLHT8cRmE9sCSVJRJt0A6OiWqIyvGUnFlllgHteD4W4EVfHfrDJzQ3mjg406mboF60a8JmGyBIWbfiZObGHgwcaWBmXmHEnR0cVa2w8zsopV5z8ATW9LFj0QUFJVLBUWZtBzNwbkTRLA8Z9e14ns06feFNAIgJVcZliXEQcGdEErHBuqopin0O8UJUAH13U0EfD4RLaQ47Zw7UCWKk+AcXxHpk7gG9bON5wgH0DT2IkAbuBxAuNE0y/xGSDUoDUa1ASmlGbLBIJXl7G9bFqRFPdAkTy6Iq0VCXXFjQDYxBux1YVZ6ehdNddExC6UCE6LfShQ16Qz9vbN0sRnKwc0fkSvmekZG+62jN6ttcrnSfLQK8UTvIWVpirLWeyq9yRjK+rIUAoyGKINLmJ7g9cZE9rgRQLNYM2USaGGr0uRoHWTkaoSMd2sobZogY6ibyoj0YdKoMHSTfZIwmF5nzFnOTpTNGcGnWGV+26GGtq/h9Fxk7MSUmlsQiiAgSH6CPobEMlRqFSnyYdgIh3lLoqSyy0dDBY8SL+FrKI19b4jj1kaOp8RzDtTdElvUYH7jRbaWKxYVv1hIMmR5EzDcIZ6dX/00EAJ6aospTJo2HgUoc0KG8QMKhVdjLHCA9Jy7zOEIkR4b3U0KCAmfGf3kb7QnInUE/k7qNrVunhqZOSSmhVVs/b7eiWrwYuGkKBrqppxREaiEitN0TtqMEwEd3cVNyR4+lYu9YsrV/b6DJ37EV/PkVkFphRBM+AP1I8+BrQFek/N78wIqsPnPGTqJMRbwMju5hbB4m6zmmJFVjMmWBA/mLk7QX/tnviEWRiQDPGC40rArN9lBXNc6ybu4QbuvX7te/aUvh13s6emCbefXzxi7NuDyCLWNN2t8yosiz7SWwO3YsxdMMU06hGB1A6uew8TqgUfmXgJ3XMTjgOH/rmaGqTol4pqs6dp9/HZyvfvle9UBhjL41Z1ErvvkWryTnfdKftwchhBbGzn79ChXb8O7jzm7P/D8w3tYpfntVCAtcO8AVZDvCTee7KwfVzmWFPk0rUbbNDgVjWn5H9xGnxFMwq+wVwq174+SEaEsEaaUhh3hvfPq1JYaEwmGO876DDtlhag9rZMQyoFE9D2IV1SVTCnbkyFdLukG8zB1ozTJUWcrilHWGu2FO7g2nn9YdaHlswnlN+w/h5On59k0rPFrBLsS0X7YxJx+PJ18D2uY+JxU1BqjYbl7kISKQSF3Aq0YWY1JigQClSGNBq7okeVF93btLDkBHnSPFFcLhnBHFkMRkwfwOK02MFSI2MaT0e7crXVYfQ66Wwb2ctqjf3AY86wzlYyuU3gjLjGXINZKu1QIysVuyN4wv0AkLs0Flt40/wgFsIpVrM3XEtriO/ct3MIlqNf/S9m6I3YNv8aQDdgy2thEM5nRBZlZagKi+Ekbny7sXTm2Tf9s4AZizsHwsw/q5ff//AXa/ued46jptg3QbQ9n2ZxI2Z3ddzgLVXoXxufnH7h0QDkwrc+dv1Pep4XLc47XL/3PI5MXj4k2570B6bYdWbo/W8fL+zeqaLOeQL+0pxpomiJBdlardKrZ7yfC4KAQs/Rx3ev0aUwP758ji7fn1/812v06VKYVz+hp5vVFgnKzIoqRFZS+1FpUilKDHzrh1f/+/979iRIEWpWCWVcnx4gU2cFDo/j0Ym5757X/Nrx4mWNVPiK548L6a5sOoD5kQ3j7vzAh/DtKaatdfKZKVNhjt6+eR9E9k8paDpf1nGc8X+koLMwbS26X40IhY0cFp5wBI/xDd5zDkts6AafYEQ6cPcVepPnCvy0jstD6DRPLynKY+OcD42FXJ69u3Kv0mh4rMB6wujHjlPJaar+7UaXVxaVEe+XpeGRkyCi0NCuPU7DWhPL3HStaQVEB12c58x+GfM2YNuZ5R9+5yZkAGsSwgWX/oaf77LAAJU21zqJXnfXJw2j9x7DK6lMI5IHQjeHABscADPbw5JXT0x7tx8mlvVjUm/r3RjhBQ3ZjVN5cT12YPlirSVhVuV0fqOBjoOsXFZYLOmsMZ2IFAu2rBTN0XwLMKnIIWsoLGfKI1sPDIpGR7Tl4KKLBP0OeETdv1vCFd0BoGghDc18Znf8PKP4pM2FznDmUvETgC6NSgN8kYAlFgmqhXmK65Cq/0mZgKg4z2pPXDq1vG/B233M+qt1nQkn0GAvzIoqQQ36uC3pc/SpfsbeggPsR3RVO8AGL8FvY5paPapnAmVixDSukfZ+8ecIcx5UJsr2i5DghhUk5q2psm8gE0YibeAxZwJ9uhwVKAQSZJPJq+gi2wKVZYKxbxawojp2Rq8Fm6DExb2IsVPRwd+eAFs3WiHjVCyjT4oEnK3ykVALHdFAncqDeScAIxCBdIIFwugXqTZY5cM53Qi9WUKyl0LY3vhbyKWbU7OhVIRVz8hdE+8b45YG826oziGDoGU8ZEYMdsiEz3OFtISCGSuW/IiN8BbXHIsp4vh3cFDWCSIdF+Vgg7suyzaSsrYW7BIM2N2XJ3akkhLoQrCO1w/ubhF7rAwjFccKQb9oVCPx9OL29Vu5lItFePo7JZlZ0eTHu4PsR7ugu40dvC8s3hbdN5VZUWF8svgo2rqK2Tnhbgk9bslx1D9pqkYRlpUhclpK+yXHEb6uCKFaj+AMncePa452XOIJ4IWsiruUaosChQkD3KYQTjs40h6OVipBgE+XUth3xcqtkHLY/BANFKXdXa3j9aMbeTcxcl1LoWaAM5o3+/F+mJ4+zATSzFQB+YmguIB6Ee2hrrBGOJelfV3MijKF5Ea0R+YIZ/CtFLIYyauFmRyauRb10yoRVrlnIrfyRyrdEACjXxin6I1HbDYgw12cvaLZmLuTownjzf5Pkq4wSoJrn7UQlwqhPQYIEbPe/QGEcPl6175eIzYlxhNC5zJl9UBg83O6wmsmK9AuiSxKJQs2kqFIp0buQuA5hyKyBTrbjxsT60bsJESyj+GO1omCCOxgGHW4zBEIBtZv8Et9up1Xtr1vo2zXlllWwvTL2WJr9DmUgWfkGLP+TloQvMdLKqhipN4SEAQS/fqpBcys4KkNzXZDHtkZ+WGmjRoPftZ7Oqbt1sn29HL/nrx64dZKuK+gadoY4YYVVFu57rQ9RUs6GkTypxCtKcTBg4DGgw88BnVH1jqmd/fJWOvHu+3ph0xHG3J65615h/GhHQ72BjtuBcIdhMHXu7uXB3enJj07d9Gi7E0dPrlovVSnESAH5HgjQL5edvzx8JHFGm0wzZHdTT6qSSVIzDt2B/kxKTvG3NuAGRulHkrQen7q6JU7lVllBTUreYIoCd7xJCOHhv/a6IFDLyUlk3qd9kR1Pkju/bUWkT18mcgT8l+zn7//Hj19e/7m6hk6Z9owsayYXtEcSuGDuHC5lMn7Au2LhEG27MLh4Y8ZvjiSMaZkYq/ivvpPe6ohDJobAx75aEOf73NdCKT9N3W/Hccf4BSKmWIRapPeZophHqs7XW8jH3DOKu1WQFIhzQrGsXLiyYpNe4cIvOvh8iq455rlU3Ya6WbKf7KMUHsRe30x20uers7ijdh31yGs4SsNO/5f7ySCTwa84B03tFOWkYddmVKlTAwYhGyA1FItsWB/7smqFulY4a7EPoLSXZ4aIfeCqWAtaaKuP7/Y5eC1cC2+XO+inazmXynmZkWwoqhUNJcFEzhYcNcRT1fYMCqMPpgez/GUu32LT7pZ1/qRlokY116dJ1ZwlVgZaIbUbnW/WJ2w2ZEXNneRqAuaU4UNzbNoSWV7+MMKn1/qFZvg2ZWSa5Y3zcP893BZcq+pDhjDN/+xz9quThtWcNpNsnyiXTZL+l5/ZjuyzeDwUMicXDMXPV/1FfeRFnCN0hlzKPh9NU96CzpT50edSuhlYKNORwWNFWukjVRO4ltoBTUYVnsC35rZbz0J775gec7pdFLuHax3VzkXON6O3DtKztXjMabZ7pVfrdNhSGzr6OxzVHJsj8y+z1IhKojalmNefkiFnMCevEMGnWpsy1+lNugdJismRky6HCeSHN/0af1JQKZ/qagVH1Y/ck3O9Ay9zXGJPsM/nH6US+HqTv85fDzRCq+p1Zw4xQp9qajaIuhBqEspNK01qnBxqt1vBr+ZRl76HnjEQlas7gIp3PZdX75xPOstTYBqy0AffHPUu2IKU57SOsz6PF63lt5pYmRtQ//wMo1UJUTQjtXPm5fHRZ5dG6mRGjsPMfMWZvqDwGjDRC43GumSErZgxH7yPFQn6PNkhxfEbs/h2+bcoKfQEZYK0j5DELp81qEWqgS842/pEpMt+qR3G982EdiiX0gbPbvWrjCBwT7y2ndNLUAFatWAyeyLOKB40wcgUP2/U2kK5TxD8u1uO71CPdad16nXgR3DDoOM5n9zxGanyesd26rP8PWu91rWXcDWx7uADnczjcOuCRjsnk2bkOmOYXBC4YYUh4ufoWwg5kjA0Qo32HJOF0x4Xz0IJ+jqV+BypOkgYHdUoVgi3FoHTE/9iy0YG59t6r37XkojvSkbH7YxmKyKiVvgt6sCwdHAOuoeR5IhL3Mm4k0Qi3o37JahqDDt4xkQUt2yHTgW10a7Le8PTO0cYJ327TuAdYlVzVP2z8/brWxWbNBKHdnbYW1Zl/x+p+2Z6DNLXFsLqbbpDvyvusTibwc7xtSI7HZRr9Xz0NNkyfLXFwD9wN5OphINdlX3W9+/q1EuyKgwSpbHiI5cVvOBc+FOPO7XtNY2PVCOADi66o5p7+GZLEosts19hGsH4/SdvbKmyj5DGRMLGVYKsL5JXSN0QH70rMgasw1N2xV98SVVjsAvFedb9J8V5mzBaI7Ooe7ZOQeDqGzoPCNS3rATBd1/p3Pk1m/tZ8zHtPno3WbbcHhZGVC5jxxheviuf2iW8FN2vDva+eRn6OO2dFtvPQeWOO4Exw9P0UUWtZlsD22Lg3NEqCc61La2j8wUrrpGudzFznkWS6lqbz+EmD+8HTnyTq+cyOxU06JMO4doDynsygc99zWaSspEmsguUnYdex6oxCbsmiQiwzpmtL8DWPly+siQK8UjHnMHasRTaYzRrFKxvCEdmJqqDC/j2ZQt6OjP0y7oqOmPu6A91ycQLPTWUAGqVXzjxMKPxs2NordStJcqE1ujcktMUUu4I3M/wrKgXr3w/33mUXjh/8PnNYXc/phTFc7O89s5YfTcbaYbPAePa2fU2mA7uR+IZk0qJhZUqZG463Dfk+yrq/gfJH3QPTsBknVf4kXnGAJXCsLaMumVCiwxGftduLi9ZbuPkEGsun/6Bx0maI0P/GTliqpp/BFWZ/cZT0/PYPTjM3QG64dRo8pM1CxlhM5nVPnhn3QnC3NPc16aNHTcIWTnwO2iT3SnU/Tek2Z/HuuVvH9rlPBpo2v2Z9hbw24SyZTLf1wgQZfSMHeA5QrrkQlQmkzdVqhzlG7x8eGC9qiTTYAaJLj0eKxunF7X34QTUjRbTlFRsdvfqJl6+HF00LKVJkzrKrrSCZAhWSqdt+5hMRTAkCqV1Ac6OJSu9Lywi6NrCE7vk06TZEg0ncF9FPnpNaR27n+MOtLzOCTvLz334DguQrXm2Trli94PqXpHdhCZPLOsh6vobRp1KsDshnqLOlFzg2/acSXdBwlk609IQ7xOKnR5/eYf767QlX2n0G9iZPpKi22iSupjsP24kWFsQQyRFSU3+ign8t2EcNoeZKGhc02/zqZFGKSB+hGErRTco+VSxQZNIU+g5Do8mq4go0YD4GywqSab8NnFco05yx0jBpDoC8LJulrvE4RAsRu61X2xHYnz6wTSyLBXxpQ6YzCDNgloOMoUBCH4EdwmthR15YtUzGwP3CgiiyJpn7g74u3w8A6hcAn+hinK+5ZmbBfLhmORaX2qgbd2ZSfDf/e7rWu0gti6UuOslGyKtOoQwg4DBBgAUmFrAMhKVliIQeOM1O2m/KqAyEjMdqK2zc3D4mce/v72zXv/7r3oLd88KEaqvu8/es82pm+yteRVKgK8qec4Cz/nppmMXY/zrQQzGj11SOhn0K0DCnvribo98AiQDu6GV4mk2VuP6yfBjE8XmO0WHaypgkyBRcURkYLQ0lhD+dqd4Uh7hc0mpfR1hLcGez1C2yJaSmWQtPT99d/fhFJwg2SPzXdSLadPsOwXGOy4WOfYNTsJNor5+8VvV5dX6B2+LZjIm7He4WO1e5s8DXNniOLItvw2Brvbt61GfQqXLEZPz3ZVjtliuoLNUxfh11tOrnbsOMu8VL489116PRZ7MeTTHcqJewXUOy7+29cNN4U5Ih9qkrFvN/hLrAl9ouxGP64arPgmqFu44t7nSFeBFHWs0V+1UVIs/zbnmNxwpg3N//rC/+158ykTC0rCHy2YohvMg4oMnvPObxAWOdISjbClokumjdpay35KYVFis/LN+hscUB+HAZLglJoKTVcI7eq1iFSdLuSNPtlgToXp5KTUePuBjLNmmtqsd/nHcR/DO6cLXHGTwZ14jRaY75Qi72xpN4P/fSc5op4U2Y6Mb8vWjMKLBSMwSGBOqUByDn0jOg29mnPR+B6b6V/sA1sZ3vrGZWyxFonVyUKnbpM0IlEU3qCCao2Xvi8RkVZ+wwCzkCL5Vi7ROSUyHwn7eFjRfVSu53PEBKYewlNKIyjCtC+aXCAmtMHC1GiEbXzDjnrE8+E7FVTF4R4ya90aV+fUjidAK2vbwoTd35kRVOv69A9PQRB0TVW3QUWJlaboHTUYNHVfc9ss9fStXOoXVy6p9tkA/LlPB2vVCow+UCcsHIeLDpojnWToOokL52HR5kIv0yrP/ozf+Xt+ef6DD7i4tm+tdQ09AW4xMYjLpTuvYV8b2B1MsvbcAt/Tu3OH7O/9wc5GOWMA+ihOCXHGAPI4p4weyXraM3n5/85k/5nYVdMcyMOur5z/kQV7XT0a7NapQqUPQ03RlFmxDydbqvv/MMzA9ktXcP8w5HCVM5NBP+rHiN6u4fSIEFtFnKgbFTEmjkMsrcZUS47Hy2k5PWpYbFqyLSjNUxeBjIctum0TXSNJmg/0kIGS8DAroqeHDKAfsCLGqTh9nXl/MG6QfI5cg21GIh8KUPDe5CNTqNU+OtCo0arZv//TdteoPZOC2McBG/nYLdsRcQNN6hKKwy51z+wyLvmlc5/fyqUf6+qrGKCXnDVBFPWCarD1BbulOdIUJu3u/Hh3DT1usNSHMID9YIOlOYQB6HsdytATGN+/dBxjDvZ1D5rcjwYRWyzs4ctf67xSz5G8z5GaiqbzMJdLHWKbjg/p66EvO4bBBj8aJezl1fqnth/gyHXvE3eweyO/VuKuX6Um76v/e8mbuPbJ07gvF5wjrestyxFGS7amonGSfb2KgCXRcf6LtBZI/hiVv68jojHq0JDlNlP0S4Kz7gYP4YBh376Z34XvKXYFF+m592Yb7CqsCR5KkDmtk0c/XQrzwyskFfqFS2x+fLmb5kWkWLBlpcbzW9p9H6PufsX7hjDoYy2bBMt4gp4ZY9kxdTXR1+5gkGqDVZ5Mqds/qd4pJJ939D2MFOV4mJrmWqv6R9Sj7ZthAqfqtsuHVGzJBOb1b3a1lQN0SKV/7UmMuLz6/CpAAhTsJosikKDBaEjlGK9Py6hDxfHY12dFcZ6wvH7HtIOl0OX5Q6KkDt9usBTAHBcrfdRONk6y5H423OTgtooWXBRrupxJzqFv6tcogC31TpBzY3mOaUQc6erxcB1F9a0cjrMYJ/QjtPgKMn8sqmohtakL9+bbwaE1k7gsQM2Kkm/9OdkvQzIzxWSFNMspevo9MitVoZc///wMbbAfJVSvsocSj0J5vQMl/FydZKQgXw1XuKEqtU+h6btqr7IOQkBP8VyuaYcYLFyiU4s3bRTFxej9IV8N25yYVDRnRzVNOESob0KaY+NYYAvETN33B0T6C9cmtEZ6OM7qnwjqRbZUoZfoQhBc6orjplnZveR6CPoDgx+B3MrQKj++RP9mt/sc/fgj+jdEpLL6sus5UA9T+x/c/C/7RabRLlHC7S+EzOmjtXXFhmYEcz7H5CZ96VNOhTT1aDSwKywR65oXME3GptIBcyRvZgQsAw23MQeM3Rx7I5XVrMXWaR32g04zihBSCC1kJXL7wnAYyKChI8Ddkhd3b8QAcoxYoL8Oe8JGI6ew5RLnj+Wd8+ggzf6EYZSKkYDV4U3h7pfBFnbPfS2E7bOPTavRykV9bDP0q9zYoxnanEwgqawxZiS6obQ8QLRH8eJ9JURzgymydcqB5xe15IGxVG4+tYBJ/B27cM0UjEy9PN/1vYuAi6M70x2I4Xbhr/rlOVJWWmtwqAxni4xO/28okaye+eSU2J1HMpIvlyQUNBT8bfOrD9ANv5nRTBTFfhDQiKC0/6sDMV9B4MWvlOmSs9TdSx6tOa9ZqkLYB6ZIH9c06q78DrfOvgH1RCDPdbXV4p+Q/x4RRideBuOCJonRwwggqdDV2Zsrr/sSLCx5WFFK1dd4ETyRX10aRPU43B+f3FMFhnho1C0amvJV+5PWYHd6DljmM/Ty51doA3QvKBYIcx72FdTVzwvU+o/QhirqwGKDOMXaICl65SK7RDy5mvh1EzFwV1OEbT3tfpcqB8JBVhMlKyG5XG77gbgFUwMtFqGfEVlhhYlxRKTQvshi4Sa4o0r4nB6+4zMfraiNXdDtAvUpgwj7pi1Yi6KwSqYUdRhB4c2oTAPJ2lMrMQGN1cUohPc5SEIqVUPUBoscqxwJqQrM2Z+h/F6piiB9cp/lcDSJ7jYLbw+RWqwbZF5wtqCw44CBrymRIh9RsNvjzrSZoKF9aENMEFmUnJogA4w6UTEo8OONprXBypyIka/t2kF2HmPlXc4cZb9CiuidkPNBgsSDmx6I/ESEvxB5CrJbkH9KcaLuOfXqtYrp0ms/9ik8EFHJbvQbBMO4/Qhy3w63xi7flwcWON+HMtu2Pwr84SAVJVLlNE/3DvokG/9M6WbFWseoM22aL3bj68PXSsliBlArKMrXhAqsmHRqfVFxw74zjCqEy5LX1S9tL5sCC7wMleYixCG8U9uLDimHq0bMPNFIboSLjBlclH3PoMe4npo0vH1GI7Ji1rqROdUz9K7SBsykLlDXPWskLxcbeuQh7RVgi4XFe02n0ITgkOsFHe3c0DRBHENgq1rnbM1yq9kAP4QF2XUtyD72iBfe5G3J1GQ7bM/TxYJuLScyw7dus9oKPauvWaSAQff7RiMe+oFu37U8mw2WbLurVbElUBF9FGdD/9hXBTTILxWtJmMly92Oi1r5uMEw9rTqNuDqolkCcrFGPTREjagU7BA0gUxbFibB67ssUuBaZglQLbMU2nMZUxTtAo016qOFmkBX6rwipzEhe+Zj8I0ZPJf3enOOFZuH5NoxwYL2geh1Q4jtCMJkoMTHUKx1xU/UNF9WhsiCvnA4NMaLH+Ay4BAsPAl2DMgRBqFrqphJ3Rp0rPu0X90XAY6NJu25fCYe3OZe6abSxUKDuJMbdd8aPmHt1gVzxnqqeF05fTZT4AAaFyPLB5Nhm0mwQbxDU2QSHsLnXSu9awlKhX679qmxTNcJAX2/Gqxfn9BYlaQupWYRBcedeAvMaZG33YWbuzvahafiJkvXuuieokhUBVWM3FcWBfc20eTnO1SyNTfDiSV3vwdbW1ORw5zkg3JLzv84QfeaOrQrh9Npu4ilrwUfkBvmAe9FzEn6lL3qvhmdBOvFjPdyrXCTWyykQbiZpBZOoOVymdWJKicR6jUj3luoT9EzZUf2/R3SraBr9bDtd6P4S87IdoppOyNy4QoQ8M21Bd+OyOWKp8ybDhPwQ+Wb/4fFqRSG3qbWWBuELttRAXV1VZ5r+3/wqGJeIxRqAHPgcSYrLJY0E3STWhaMBS7pphPqByXEGMXmlaEdCTHM0dcOdautd5+/kaHEJY4m7BrK8cGEjkluDhiC/fwih0xXfwsYt1ABZglWNxzUbc6XWlM1Q9fUHUqlqZrhJYVW3j7TfSFVjcMAdg3G6e0Efo/c7zt9K6RCcyU39rP6r6Se42jNrtF+0pf5FVYmtpuuARzbo+LvlBxUh051pyTP2xmkia6ULKkPKKZ6i98IhDlVpskuUu2i/m8uvOXFR6cJACQhBRTmHAkpvlO0pGDJ7Mt+mGIuym4f/dA0FKfHvWAuwlaHfwY780M1WlmPzmHBOVSbCCTFd0tp/3vPSwBKShZQHBPuG3eCgS8AAYukXCCYMM+onqHrVqb0Bxt0K6vSYHzmyvkqbY0YVzLqkm1yL36baSaEV9rUDOn/MTgm+AnT9iR9TbT3b1jFFz4dV4Em137cDQtb9K4tUzql7Mkhw8tieQ5YIKy1JAz8pfY0gvYkHNhbdkNfdwYZwuDC56hUMBPlOaKGPAkryljhWAOrDwSxYClqqNKoxBq6eGlo5OCnScuisFJM7gTth6U11JC96p57D06l8XXOMMHD5MQ3kUVZDe9ggmPDaMNELjc+n9ZPm3zeZFKMEmOwzUXF+RZ9qTB3zs9cFpj5Qbyw73ohLkeerq7XM9EA+8FoOCZuaO5rgepEdKzBO+UNFPvJNw1qM5bvOzg+6AqRVNR1Jzs5t0QfgRq9365Phddvpfe8outhu54m6ExVwfqDnVK7WP2anTF5+zXtHyNr2gvG09/xZsu/wGrNNVY0rwhFdeSIht1tbqZ+FnhNkz0i1ztj/PvvY+cBtC/MqF+Akht9VMuBGB5jv7p96FZYr5obatXCQJVhRVYu87eusWnKDM9qSL0WYXYjzTIzrYj9VfPvYaUpsvJcIAY5d5UgnGJl/wSN8FrUfAFhPfm1Luw8HH1wwq8a9nl61C8WkcW8Gd+72HmwfNmousfrtWaq0lN7+rraCCAw7vGbJkAauBJnbnXXk3HcU+osuOkG1zov8+W5H8GNnvrGDfVsSlf0a3F7FtarnQP6VAP+vfv58rw737URE0PvwW5EzqUBui3MHBNZWbBhOmykrvU2ZS/73aiuL9B26sJeP7ZwxvfE447PmoXR5flBTTaWf+6AJmsReynyVqOdoTNXn+n7nXL3wX5tFhBUu9/44RvvjptXpqnclKZ5jCrBqXaUke5B2Ui0xorhOR9UAbqmDEygkuMRQaCp0En7o+wcaFdVdSvPrKSyGkZdX8jsOV+/uLzq69DIt4x1HoWxuuwjBwreuRayjbQ4JNGlMOiaLQUGYTHCoqVUKZvXPhnIL8ukV7XuJqGrI/ynRaRzl4HLchlgnPe/fURMEF7l1IozP8jW/nyGnl7c4qLk9DW6cg4RBxak9yzsF4HI3OSxTXBOtU9LGDOmb6zKfQRe9yjF67gx3/un4QPTN3tCrkax5ZKqdCPswiT73I0FeBxAO10pqleS55Z7nK0+Mml0J/Q+gWdhGHv3UvnpB6djPGuacVyeh8tI7hydJ7Ios4nzruBUfO4VjHF1/j1dzb+z6EgB9akLGDcj84qMWWleLT1R1lgX80ZaSgWdB6xcr/EbmRKHVb7B6jQZesOu+la6Yv8Q2U2MtEZ+aoUoRu8wqfsph5VbK4ImtWOk+K5WUNV+KeRszehDrRXFOnpusDbYVLEU58YfhRk/mdlhF5/LW8TyF+Pvl31ZqykwtBh9GjQ+dnfBYhG+uvU7lnj63oDJz4dz9455zpiQVawYZ6eORC+j3ykrSWM6HQYe2Z8iA07dmXGHJd5wbuUe0hUhVOtFxdGFXR8RmVNtWaJu9hu2LJjI6W1kAnCmzXGa5wNlCywMppiqkZhTBfHNAivGIYMn4MFz8XexRBiI+J39bXBnIgEfyrlrLnQijdivjp42+ZwlVbr0RbdOwgxI5lWENiG+7vD0bKTI0Lm5hu9x6oQSp3w1SV7eV+W+bT/ETGiUU4MZDzgZ5rIynd+NbE3yyXMza48tbvLYAI/xh9TQouTJsnneoJwusA8B+c6XdQzfZ2tarXhNFcdbKOQy0j+u6GngRtoPwOr2v6aLugrc+eq1YaaCxowouLHWNhg2bHrodY0axer4dwiOjWkCWUVkUdj7lIaNzhx0xDrJvqWSa5Y7/1ndRa6gejQRKpfk+EDj/b1lvzDeao2km5cXVg1uS0h6Oo2sr1dPK+v/kPMj/U5Hb+8/5NwHYMK3q2TpGueeQ0KxO/nrq0t0OVCoumgk61rrq0v2YxCxsKuphl1GNaTv4w/zudVh5d6JiGwu89QVX4OKu77S4XFBFpcR9WgVv1uCCxlMUHnecQH70mGXQNvEQ9iS5U0oZ8SJV8S2Ggdl4BFe/nhKXrPvskr5TNXTva8+ue45dSAKkjVuKam6XgSX+jWnofLWugvTvsSNCRwhQa94vusQaaor8RozjoeBDNS4whHUVy6oUiOTFtwdOsbXHy/u5o2VwjeAcgHYwZZ8uoFmy9mIRGRFNq/yfBvdP8OKLGodUAdupelxjc73eqniQ1RMRuxy0Cuxy3Q1RUEC093sVddzFVc5M01lXdsXzWMUGmzXVmw4UdKGF/Zv0mWJxabgejKr/OzzBXrqayU+V9zqynPGoYAD8sAubkup7Tefoe+GjgbRj8LcCLkRO4aQpqSCZhbrXegjkzYJnsAF108LPaur3N/70qS3dInJFn0aNdc4myt8iqJ8v/AOiZlABWZioXBB96ZjlFjB1N70fRJ2lMsrWBa9l7lLjm7bAnayzgJIoQPaF6QKWEKkspB2+8a9pxv0ayXAlHwnc8rRUybWs2+fIybJczS3/0ft/2GB+VYzPfs2HF80pMwWHA8m58fWoXY1/LMrBIuCrwvk5LYefiUXexs1GJkUU/fXucezboOgqbKMHERoXcSVuz3MPr/7HSuKProE4G+//fzu9zcfLr791uXcrrHCbJQnN1LdxCxZPnjBfq8X7EbYRp1gWMRWInzNTtwuJc1zgIl9LrYJTJiFVFRoRmIKkI4rKQHGRXwvSCA+EAtotsFsOJz4wd4B6H0eG6i9PrFL1HU1T3QpzDzXRsWufId67WQOse5bGu0drWs+0jlJjy12aQeDDVQaX2zS1r34ehcLYsFGHU31VpM5Yo/darAbUWCb/fKesFA+up/g/R0XFnmv/38YrtqqzG7y30lYLO/46D0ie5E8CXPUcdx9+Ek5QdLWzsl27NKnpslor7PsoE/mM3C7DTj3cGS6blnNpoiHQdHXAjNuaV03c7nyMuPyvFvbBp24rDlo6DLQwmA8q7DOuc6sinjEfo5JvIZ0a199dCaLohJ9T9QAO3Fc46aHYvee3pq/07BO3eCmj9OsH4rbNRb5v8tw1KzFzWDDjpEMD8ZuuPAOcrrSJSNMRssSncqCB+w3WIlh0OGxo65FUWYylTC+fv/uCv3m/KhtUmoYkS+TphJc/+db9KWiaqR3a8VFpmi/U2fa5IaOQ3SLPtRFZ8G0rkZLJxEf0i5QGXuMgAVaHuU4OgTVBIJjD4abxx/QgDlWRYLTsmATuBdwGbEAuQFa5dGm0u7AjNvtagd0jk1fK3wo3DkVZFVgFauspIG7LfFgfPGDo0+YDNKposDMVtF5gdBF3AKqBvBiCa2WEoCV8z8SQC1x9EkYruNUdPaCoHvGYj84vnNbQa3qGR1pkWECg1Hil59Y2FpENN47gOfLcv2TuDWr6O87ERkxKst11L7rHegW8nGRpzsAXnMcXWKIjIolExGLIoegU+RGi2yR6Q0zJLr8ENmCy43GRfzclS5sYdbpoCeIuhCRMZFSnDBRUlXMt9ES3gewS3KTBvga8xS8wsqsVNLILH5ICqCvf8rA4xgfNk92N7lcZnkKYlvA8fPfiMgKfJsZE8ttsAvYcjSnCR6FgolESDORDumS64zPeRY7LLoD+/uEwKN3Bu/Ajt0LsQs7dlVvF/bPCWG/Sgj7XxPC/p8JYf8lDWwjS47nNIVIaaDHN89EVlQclO/5NsE7WQMvbxLoJUXF2bIo02jfVsvEfBk7CclDZimUEk2/kPi+EZFpl5CY4AS1ImmsSQs4jTWpt7oqE8wiJaIpq05iqhpprOlBbxOIECONNcxSwQazJgnwSrBbgYXUlCRgwvUrS5VEj8L6lSzNiuI8gVtNFmVGeAIftgWcIEgCcNV8a+K7RS1knQRyWWUJYhpEMcMI5gkKiHSGl1SQbcSsqy5sgfn2T5rPU+C9zqANaBLIrh1MGqxdYm0S6PNluX6Vxgetszkzf0nSaIzoLO6suB5gJaOLap3kmgNUSlT8KjftfPzRZm11AFOzcn7++M4RBxzUviTAXTf5eB3kOrAXjNMUNozOFikOkS1iFmfvAk6hG+iMlZCkmCURdaxc/5RrUw6a+UeCrRVJApuzBU1hxmhwNBc0Z9EKRndhM5GGSwqZV5xqIlNQ2wNnywSySZZ6g03Umf8d6KEM8iiAFV0ybRSO7wlpYSfQ+BQtU5FaJaO1hk7kKpF8dZn5jsUTQDeK4iKBIulKgVKhnU653qwk05mbMBsf+hYrnITB85FC2BiQ126+fWy4TBssos85zrWZVyrWsMAaKnWzglJAraLjGl+PrmuSY4OFyQ2L+MOuj+00sA/mEud57DvA8thh1bp1UIK3iBUZUVIWSboSWcAJzDRWZGmSI33HoxRkLm+it2cqdfyWpazUpWKRgXJsmKmiZ59xJmi8FjstVB11ok4DF4pv47u1uHRdT7MFl9Gf8wZ4gpR/a/NGlzoWaAKJY23oBKhGz03gcpmEdcUyyQUupYotwIp5tUxxzQqmSQqxUOgkDJtiDoSgBporRYcbXYa7BtCxM/4c1NjpeGKziW2BJKkok24AdHRLVMbXjKRiyywwj+vBcDeCqvhvVpm5obzRwUadTN2CdSNekzBZgsJNPxMntjDwYGNLgzJzjqTo6GKt7YcZWcWq8x+Aprclix4IKKkqlgoLM+i5GwPyJgng+E+v60T26VNvCmgEwEouM6zLiAMDuqAVjg1VUcxT6HeKEqCD6zqaCHh8IlvIcVu4diBLlSfAOL4jUyfwDWvnG06QD6Bp7EQAN/A4gXGi6Zf4DBBq0BoNagJTSrNlAsGry9heNq1IinugSB5dkdaKhLriRgBs4o3Y6sKsdPSummsiYhdKBKfFPhSoa9IZe/tmaeKzlQMaP6LXzPSMDXdbRu/WWuXzJHnoleIJ3sJKU5XlLHbVe5KxFXVkKAUZDNEGF7G9weuMCW3wIoFmsGbKpFDD16VI0LrJSFWJmG7WUFu0QEfRN5WR6EMl0GDpJnsk4bC8z5izHJ0pmjODzrDKfTdDDe3fw+i4yVkJqTQ2IRTAwBB9BP0NiOQoVKrT5EMwkY5yF0XJ5ZYOBgsepN9CVtGaet+RxywNnc8I5p0puqS3qMD9RgttLFYsq/4wkORIcqZhOEO9uj96aKCEdFWWUhk0bDyK0GaFDWIGlYouxljhAWm59xlCESK8tzoaFBATvrP7SF9ozkTqifwdVO1qXTw1MnJJzYqqWft9vZLV4EVDSNA1Vc04IiNRiZWm6B01GCaCu7uKGxI8fSuX+sWVK3t9hs79iK/nyKwCU4qgGfAH6kcfA9oCvafmd2YE1eFzHjJ1EuItYGR3c4tgcbdZTbEiqxkTLIgfzNydoL92T3zCLAxIhnjBcSVg1u+ygjmudRP3cAP3Xr/2PXtK34672VPThNvPLx4x9u1BZBFrmu7WeRWWRR/prYFbMeYumGIa9YhAagfXvYcJ1YKPTLyE7rkJx4FD/1xNDVL0S0W12dO0+/hs5fv3yncqA4zlcas6id33SDV5p7vulH04OYwgNrbzd+jQrl8Hdx5z9v/h+YZ2scvzWijA2mHeAKshXhLvPVnYPi5zrCly6doNNmhwq5pT8r84Db6iGQXfYC6Va18fJCNCWCNNKYw7w/vnVSksNCYTjPcddJh2SwtQe1umIZWCCWj7kC6pKphTN6ZCul3SDeZga8bpkiJO15QjrDVbCndw7bz+MOtDS+YTym9Yfw+nz08y6dliVgn2paL9MYk4fPk6+B7XMfG4KSi1RsNydyGJFIJCbgXaMLMaExQIBSpDGo1d0aPKi+5tWlhygjxpnigul4xgjiwGI6YPYHFa7GCpkTGNp6NdudrqMHqddLaN7GW1xn7gMWdYZyuZ3CZwRlxjrsEslXaokZWK3RE84X4AyF0aiy28aX4QC+EUq9kbrqU1xHfu2zkEy9Gv/hcz9EZsm38NoBuw5bUwCOczIouyMlSFxXASN77dWDrz7Jv+WcCMxZ0DYeaf1cvvf/iLtX3PO8dRU+ybINqeT7O4EbO7Om7wlir0r41PTr/waABy4Vsfu/4nPc+LFucdrt97HkcmLx+SbU/6A1PsOjP0/rePF3bvVFHnPAF/ac40UbTEgmytVunVM97PBUFAoefo47vX6FKYH18+R5fvzy/+6zX6dCnMq5/Q081qiwRlZkUVIiup/ag0qRQlBr71w6v//f89exKkCDWrhDKuTw+QqbMCh8fx6MTcd89rfu148bJGKnzF88eFdFc2HcD8yIZxd37gQ/j2FNPWOvnMlKkwR2/fvA8i+6cUNJ0v6zjO+D9S0FmYthbdr0aEwkYOC084gsf4Bu85hyU2dINPMCIduPsKvclzBX5ax+UhdJqnlxTlsXHOh8ZCLs/eXblXaTQ8VmA9YfRjx6nkNFX/dqPLK4vKiPfL0vDISRBRaGjXHqdhrYllbrrWtAKigy7Oc2a/jHkbsO3M8g+/cxMygDUJ4YJLf8PPd1lggEqba51Er7vrk4bRe4/hlVSmEckDoZtDgA0OgJntYcmrJ6a92w8Ty/oxqbf1bozwgobsxqm8uB47sHyx1pIwq3I6v9FAx0FWLisslnTWmE5EigVbVormaL4FmFTkkDUUljPlka0HBkWjI9pycNFFgn4HPKLu3y3hiu4AULSQhmY+szt+nlF80uZCZzhzqfgJQJdGpQG+SMASiwTVwjzFdUjV/6RMQFScZ7UnLp1a3rfg7T5m/dW6zoQTaLAXZkWVoAZ93Jb0OfpUP2NvwQH2I7qqHWCDl+C3MU2tHtUzgTIxYhrXSHu/+HOEOQ8qE2X7RUhwwwoS89ZU2TeQCSORNvCYM4E+XY4KFAIJssnkVXSRbYHKMsHYNwtYUR07o9eCTVDi4l7E2Kno4G9PgK0brZBxKpbRJ0UCzlb5SKiFjmigTuXBvBOAEYhAOsECYfSLVBus8uGcboTeLCHZSyFsb/wt5NLNqdlQKsKqZ+SuifeNcUuDeTdU55BB0DIeMiMGO2TC57lCWkLBjBVLfsRGeItrjsUUcfw7OCjrBJGOi3KwwV2XZRtJWVsLdgkG7O7LEztSSQl0IVjH6wd3t4g9VoaRimOFoF80qpF4enH7+q1cysUiPP2dksysaPLj3UH2o13Q3cYO3hcWb4vum8qsqDA+WXwUbV3F7Jxwt4Qet+Q46p80VaMIy8oQOS2l/ZLjCF9XhFCtR3CGzuPHNUc7LvEE8EJWxV1KtUWBwoQBblMIpx0caQ9HK5UgwKdLKey7YuVWSDlsfogGitLurtbx+tGNvJsYua6lUDPAGc2b/Xg/TE8fZgJpZqqA/ERQXEC9iPZQV1gjnMvSvi5mRZlCciPaI3OEM/hWClmM5NXCTA7NXIv6aZUIq9wzkVv5I5VuCIDRL4xT9MYjNhuQ4S7OXtFszN3J0YTxZv8nSVcYJcG1z1qIS4XQHgOEiFnv/gBCuHy9a1+vEZsS4wmhc5myeiCw+Tld4TWTFWiXRBalkgUbyVCkUyN3IfCcQxHZAp3tx42JdSN2EiLZx3BH60RBBHYwjDpc5ggEA+s3+KU+3c4r2963UbZryywrYfrlbLE1+hzKwDNyjFl/Jy0I3uMlFVQxUm8JCAKJfv3UAmZW8NSGZrshj+yM/DDTRo0HP+s9HdN262R7erl/T169cGsl3FfQNG2McMMKqq1cd9qeoiUdDSL5U4jWFOLgQUDjwQceg7ojax3Tu/tkrPXj3fb0Q6ajDTm989a8w/jQDgd7gx23AuEOwuDr3d3Lg7tTk56du2hR9qYOn1y0XqrTCJADcrwRIF8vO/54+MhijTaY5sjuJh/VpBIk5h27g/yYlB1j7m3AjI1SDyVoPT919MqdyqyygpqVPEGUBO94kpFDw39t9MChl5KSSb1Oe6I6HyT3/lqLyB6+TOQJ+a/Zz99/j56+PX9z9QydM22YWFZMr2gOpfBBXLhcyuR9gfZFwiBbduHw8McMXxzJGFMysVdxX/2nPdUQBs2NAY98tKHP97kuBNL+m7rfjuMPcArFTLEItUlvM8Uwj9WdrreRDzhnlXYrIKmQZgXjWDnxZMWmvUME3vVweRXcc83yKTuNdDPlP1lGqL2Ivb6Y7SVPV2fxRuy76xDW8JWGHf+vdxLBJwNe8I4b2inLyMOuTKlSJgYMQjZAaqmWWLA/92RVi3SscFdiH0HpLk+NkHvBVLCWNFHXn1/scvBauBZfrnfRTlbzrxRzsyJYUVQqmsuCCRwsuOuIpytsGBVGH0yP53jK3b7FJ92sa/1Iy0SMa6/OEyu4SqwMNENqt7pfrE7Y7MgLm7tI1AXNqcKG5lm0pLI9/GGFzy/1ik3w7ErJNcub5mH+e7gsuddUB4zhm//YZ21Xpw0rOO0mWT7RLpslfa8/sx3ZZnB4KGROrpmLnq/6ivtIC7hG6Yw5FPy+mie9BZ2p86NOJfQysFGno4LGijXSRion8S20ghoMqz2Bb83st56Ed1+wPOd0Oin3Dta7q5wLHG9H7h0l5+rxGNNs98qv1ukwJLZ1dPY5Kjm2R2bfZ6kQFURtyzEvP6RCTmBP3iGDTjW25a9SG/QOkxUTIyZdjhNJjm/6tP4kINO/VNSKD6sfuSZneobe5rhEn+EfTj/KpXB1p/8cPp5ohdfUak6cYoW+VFRtEfQg1KUUmtYaVbg41e43g99MIy99DzxiIStWd4EUbvuuL984nvWWJkC1ZaAPvjnqXTGFKU9pHWZ9Hq9bS+80MbK2oX94mUaqEiJox+rnzcvjIs+ujdRIjZ2HmHkLM/1BYLRhIpcbjXRJCVswYj95HqoT9Hmywwtit+fwbXNu0FPoCEsFaZ8hCF0+61ALVQLe8bd0ickWfdK7jW+bCGzRL6SNnl1rV5jAYB957bumFqACtWrAZPZFHFC86QMQqP7fqTSFcp4h+Xa3nV6hHuvO69TrwI5hh0FG8785YrPT5PWObdVn+HrXey3rLmDr411Ah7uZxmHXBAx2z6ZNyHTHMDihcEOKw8XPUDYQcyTgaIUbbDmnCya8rx6EE3T1K3A50nQQsDuqUCwRbq0Dpqf+xRaMjc829d59L6WR3pSND9sYTFbFxC3w21WB4GhgHXWPI8mQlzkT8SaIRb0bdstQVJj28QwIqW7ZDhyLa6PdlvcHpnYOsE779h3AusSq5in75+ftVjYrNmiljuztsLasS36/0/ZM9Jklrq2FVNt0B/5XXWLxt4MdY2pEdruo1+p56GmyZPnrC4B+YG8nU4kGu6r7re/f1SgXZFQYJctjREcuq/nAuXAnHvdrWmubHihHABxddce09/BMFiUW2+Y+wrWDcfrOXllTZZ+hjImFDCsFWN+krhE6ID96VmSN2Yam7Yq++JIqR+CXivMt+s8Kc7ZgNEfnUPfsnINBVDZ0nhEpb9iJgu6/0zly67f2M+Zj2nz0brNtOLysDKjcR44wPXzXPzRL+Ck73h3tfPIz9HFbuq23ngNLHHeC44en6CKL2ky2h7bFwTki1BMdalvbR2YKV12jXO5i5zyLpVS1tx9CzB/ejhx5p1dOZHaqaVGmnUO0hxR25YOe+xpNJWUiTWQXKbuOPQ9UYhN2TRKRYR0z2t8BrHw5fWTIleIRj7kDNeKpNMZoVqlY3pAOTE1VhpfxbMoWdPTnaRd01PTHXdCe6xMIFnprqADVKr5xYuFH4+ZG0Vsp2kuVia1RuSWmqCXckbkfYVlQr174/z7zKLzw/+HzmkJuf8ypCmfn+e2cMHruNtMNnoPHtTNqbbCd3A9EsyYVEwuq1EjcdbjvSfbVVfwPkj7onp0Aybov8aJzDIErBWFtmfRKBZaYjP0uXNzest1HyCBW3T/9gw4TtMYHfrJyRdU0/girs/uMp6dnMPrxGTqD9cOoUWUmapYyQuczqvzwT7qThbmnOS9NGjruELJz4HbRJ7rTKXrvSbM/j/VK3r81Svi00TX7M+ytYTeJZMrlPy6QoEtpmDvAcoX1yAQoTaZuK9Q5Srf4+HBBe9TJJkANElx6PFY3Tq/rb8IJKZotp6io2O1v1Ew9/Dg6aNlKE6Z1FV3pBMiQLJXOW/ewGApgSJVK6gMdHEpXel7YxdE1BKf3SadJMiSazuA+ivz0GlI79z9GHel5HJL3l557cBwXoVrzbJ3yRe+HVL0jO4hMnlnWw1X0No06FWB2Q71Fnai5wTftuJLugwSy9SekIV4nFbq8fvOPd1foyr5T6DcxMn2lxTZRJfUx2H7cyDC2IIbIipIbfZQT+W5COG0PstDQuaZfZ9MiDNJA/QjCVgru0XKpYoOmkCdQch0eTVeQUaMBcDbYVJNN+Oxiucac5Y4RA0j0BeFkXa33CUKg2A3d6r7YjsT5dQJpZNgrY0qdMZhBmwQ0HGUKghD8CG4TW4q68kUqZrYHbhSRRZG0T9wd8XZ4eIdQuAR/wxTlfUsztotlw7HItD7VwFu7spPhv/vd1jVaQWxdqXFWSjZFWnUIYYcBAgwAqbA1AGQlKyzEoHFG6nZTflVAZCRmO1Hb5uZh8TMPf3/75r1/9170lm8eFCNV3/cfvWcb0zfZWvIqFQHe1HOchZ9z00zGrsf5VoIZjZ46JPQz6NYBhb31RN0eeARIB3fDq0TS7K3H9ZNgxqcLzHaLDtZUQabAouKISEFoaayhfO3OcKS9wmaTUvo6wluDvR6hbREtpTJIWvr++u9vQim4QbLH5jupltMnWPYLDHZcrHPsmp0EG8X8/eK3q8sr9A7fFkzkzVjv8LHavU2ehrkzRHFkW34bg93t21ajPoVLFqOnZ7sqx2wxXcHmqYvw6y0nVzt2nGVeKl+e+y69Hou9GPLpDuXEvQLqHRf/7euGm8IckQ81ydi3G/wl1oQ+UXajH1cNVnwT1C1cce9zpKtAijrW6K/aKCmWf5tzTG4404bmf33h//a8+ZSJBSXhjxZM0Q3mQUUGz3nnNwiLHGmJRthS0SXTRm2tZT+lsCixWflm/Q0OqI/DAElwSk2FpiuEdvVaRKpOF/JGn2wwp8Ko7b/8/wEAAP//sMlYiA==" } diff --git a/x-pack/filebeat/module/juniper/netscreen/_meta/fields.yml b/x-pack/filebeat/module/juniper/netscreen/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/juniper/netscreen/config/input.yml b/x-pack/filebeat/module/juniper/netscreen/config/input.yml new file mode 100644 index 00000000000..9b4a5566a9b --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Juniper" + product: "Netscreen" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/juniper/netscreen/config/liblogparser.js + - ${path.home}/module/juniper/netscreen/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/juniper/netscreen/config/liblogparser.js b/x-pack/filebeat/module/juniper/netscreen/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} for %{p0}"); + +var dup7 = // "Pattern{Constant('domain address '), Field(domain,true), Constant(' in zone '), Field(p0,false)}" +match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); + +var dup8 = // "Pattern{Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); + +var dup9 = date_time({ + dest: "event_time", + args: ["fld1"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup10 = // "Pattern{Constant('('), Field(fld1,false), Constant(')')}" +match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); + +var dup11 = // "Pattern{Field(fld1,false)}" +match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); + +var dup12 = // "Pattern{Constant('Address '), Field(p0,false)}" +match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); + +var dup13 = // "Pattern{Constant('MIP('), Field(interface,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); + +var dup14 = // "Pattern{Field(group_object,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); + +var dup15 = // "Pattern{Constant('admin '), Field(p0,false)}" +match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); + +var dup16 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); + +var dup17 = setc("eventcategory","1502000000"); + +var dup18 = setc("eventcategory","1703000000"); + +var dup19 = setc("eventcategory","1603000000"); + +var dup20 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ')}" +match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); + +var dup21 = // "Pattern{}" +match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); + +var dup22 = setc("eventcategory","1502050000"); + +var dup23 = // "Pattern{Constant(''), Field(p0,false)}" +match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); + +var dup24 = // "Pattern{Constant('password '), Field(p0,false)}" +match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); + +var dup25 = // "Pattern{Constant('name '), Field(p0,false)}" +match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); + +var dup26 = // "Pattern{Field(administrator,false)}" +match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); + +var dup27 = setc("eventcategory","1801010000"); + +var dup28 = setc("eventcategory","1401060000"); + +var dup29 = setc("ec_subject","User"); + +var dup30 = setc("ec_activity","Logon"); + +var dup31 = setc("ec_theme","Authentication"); + +var dup32 = setc("ec_outcome","Success"); + +var dup33 = setc("eventcategory","1401070000"); + +var dup34 = setc("ec_activity","Logoff"); + +var dup35 = setc("eventcategory","1303000000"); + +var dup36 = // "Pattern{Field(disposition,false)}" +match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); + +var dup37 = setc("eventcategory","1402020200"); + +var dup38 = setc("ec_theme","UserGroup"); + +var dup39 = setc("ec_outcome","Error"); + +var dup40 = // "Pattern{Constant('via '), Field(p0,false)}" +match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); + +var dup41 = // "Pattern{Field(fld1,false), Constant(')')}" +match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); + +var dup42 = setc("eventcategory","1402020300"); + +var dup43 = setc("ec_activity","Modify"); + +var dup44 = setc("eventcategory","1605000000"); + +var dup45 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(p0,false)}" +match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); + +var dup46 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); + +var dup47 = // "Pattern{Field(username,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); + +var dup48 = // "Pattern{Constant('NSRP Peer . ('), Field(p0,false)}" +match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); + +var dup49 = // "Pattern{Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); + +var dup50 = setc("eventcategory","1701020000"); + +var dup51 = setc("ec_theme","Configuration"); + +var dup52 = // "Pattern{Constant('changed'), Field(p0,false)}" +match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); + +var dup53 = setc("eventcategory","1301000000"); + +var dup54 = setc("ec_outcome","Failure"); + +var dup55 = // "Pattern{Constant('The '), Field(p0,false)}" +match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); + +var dup56 = // "Pattern{Constant('interface'), Field(p0,false)}" +match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); + +var dup57 = // "Pattern{Constant('Interface'), Field(p0,false)}" +match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); + +var dup58 = setc("eventcategory","1001000000"); + +var dup59 = setc("dclass_counter1_string","Number of times the attack occurred"); + +var dup60 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$OUT"), + field("saddr"), + field("daddr"), + ], +}); + +var dup61 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$OUT"), + field("saddr"), + field("daddr"), + field("sport"), + field("dport"), + ], +}); + +var dup62 = setc("eventcategory","1608010000"); + +var dup63 = // "Pattern{Constant('DNS entries have been '), Field(p0,false)}" +match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); + +var dup64 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" +match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); + +var dup65 = // "Pattern{Field(zone,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); + +var dup66 = // "Pattern{Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); + +var dup67 = // "Pattern{Constant('int '), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); + +var dup68 = // "Pattern{Field(dport,false), Constant(','), Field(p0,false)}" +match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); + +var dup69 = // "Pattern{Field(dport,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); + +var dup70 = // "Pattern{Field(space,false), Constant('using protocol '), Field(p0,false)}" +match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); + +var dup71 = // "Pattern{Field(protocol,false), Constant(','), Field(p0,false)}" +match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); + +var dup72 = // "Pattern{Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); + +var dup73 = // "Pattern{Constant('. '), Field(p0,false)}" +match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); + +var dup74 = // "Pattern{Field(fld2,false), Constant(': SYN '), Field(p0,false)}" +match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); + +var dup75 = // "Pattern{Constant('SYN '), Field(p0,false)}" +match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); + +var dup76 = // "Pattern{Constant('timeout value '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); + +var dup77 = // "Pattern{Constant('destination '), Field(p0,false)}" +match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); + +var dup78 = // "Pattern{Constant('source '), Field(p0,false)}" +match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); + +var dup79 = // "Pattern{Constant('A '), Field(p0,false)}" +match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); + +var dup80 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var dup81 = // "Pattern{Constant(', int '), Field(p0,false)}" +match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); + +var dup82 = // "Pattern{Constant('int '), Field(p0,false)}" +match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); + +var dup83 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); + +var dup84 = setc("eventcategory","1002020000"); + +var dup85 = setc("eventcategory","1002000000"); + +var dup86 = setc("eventcategory","1603110000"); + +var dup87 = // "Pattern{Constant('HA '), Field(p0,false)}" +match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); + +var dup88 = // "Pattern{Constant('encryption '), Field(p0,false)}" +match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); + +var dup89 = // "Pattern{Constant('authentication '), Field(p0,false)}" +match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); + +var dup90 = // "Pattern{Constant('key '), Field(p0,false)}" +match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); + +var dup91 = setc("eventcategory","1613040200"); + +var dup92 = // "Pattern{Constant('disabled'), Field(,false)}" +match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); + +var dup93 = // "Pattern{Constant('set to '), Field(trigger_val,false)}" +match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); + +var dup94 = // "Pattern{Constant('up'), Field(,false)}" +match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); + +var dup95 = // "Pattern{Constant('down'), Field(,false)}" +match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); + +var dup96 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); + +var dup97 = setc("eventcategory","1613050200"); + +var dup98 = // "Pattern{Constant('set'), Field(,false)}" +match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); + +var dup99 = // "Pattern{Constant('unset'), Field(,false)}" +match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); + +var dup100 = // "Pattern{Constant('undefined '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); + +var dup101 = // "Pattern{Constant('set '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); + +var dup102 = // "Pattern{Constant('active '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); + +var dup103 = // "Pattern{Constant('to '), Field(p0,false)}" +match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); + +var dup104 = // "Pattern{Constant('created '), Field(p0,false)}" +match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); + +var dup105 = // "Pattern{Constant(', '), Field(p0,false)}" +match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); + +var dup106 = // "Pattern{Constant('is '), Field(p0,false)}" +match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); + +var dup107 = // "Pattern{Constant('was '), Field(p0,false)}" +match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); + +var dup108 = // "Pattern{Constant(''), Field(fld2,false)}" +match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); + +var dup109 = // "Pattern{Constant('threshold '), Field(p0,false)}" +match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); + +var dup110 = // "Pattern{Constant('interval '), Field(p0,false)}" +match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); + +var dup111 = // "Pattern{Constant('of '), Field(p0,false)}" +match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); + +var dup112 = // "Pattern{Constant('that '), Field(p0,false)}" +match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); + +var dup113 = // "Pattern{Constant('Zone '), Field(p0,false)}" +match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); + +var dup114 = // "Pattern{Constant('Interface '), Field(p0,false)}" +match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); + +var dup115 = // "Pattern{Constant('n '), Field(p0,false)}" +match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); + +var dup116 = // "Pattern{Constant('.'), Field(,false)}" +match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); + +var dup117 = setc("eventcategory","1603090000"); + +var dup118 = // "Pattern{Constant('for '), Field(p0,false)}" +match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); + +var dup119 = // "Pattern{Constant('the '), Field(p0,false)}" +match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); + +var dup120 = // "Pattern{Constant('removed '), Field(p0,false)}" +match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); + +var dup121 = setc("eventcategory","1603030000"); + +var dup122 = // "Pattern{Constant('interface '), Field(p0,false)}" +match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); + +var dup123 = // "Pattern{Constant('the interface '), Field(p0,false)}" +match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); + +var dup124 = // "Pattern{Field(interface,false)}" +match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); + +var dup125 = // "Pattern{Constant('s '), Field(p0,false)}" +match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); + +var dup126 = // "Pattern{Constant('on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); + +var dup127 = // "Pattern{Constant('has been '), Field(p0,false)}" +match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); + +var dup128 = // "Pattern{Constant(''), Field(disposition,false), Constant('.')}" +match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); + +var dup129 = // "Pattern{Constant('removed from '), Field(p0,false)}" +match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); + +var dup130 = // "Pattern{Constant('added to '), Field(p0,false)}" +match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); + +var dup131 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); + +var dup132 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var dup133 = // "Pattern{Constant('Interface '), Field(p0,false)}" +match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); + +var dup134 = // "Pattern{Constant('set to '), Field(fld2,false)}" +match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); + +var dup135 = // "Pattern{Constant('gateway '), Field(p0,false)}" +match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); + +var dup136 = // "Pattern{Field(,true), Constant(' '), Field(disposition,false)}" +match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); + +var dup137 = // "Pattern{Constant('port number '), Field(p0,false)}" +match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); + +var dup138 = // "Pattern{Constant('has been '), Field(disposition,false)}" +match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); + +var dup139 = // "Pattern{Constant('IP '), Field(p0,false)}" +match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); + +var dup140 = // "Pattern{Constant('port '), Field(p0,false)}" +match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); + +var dup141 = setc("eventcategory","1702030000"); + +var dup142 = // "Pattern{Constant('up '), Field(p0,false)}" +match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); + +var dup143 = // "Pattern{Constant('down '), Field(p0,false)}" +match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); + +var dup144 = setc("eventcategory","1601000000"); + +var dup145 = // "Pattern{Constant('('), Field(fld1,false), Constant(') ')}" +match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); + +var dup146 = date_time({ + dest: "event_time", + args: ["fld2"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup147 = setc("eventcategory","1103000000"); + +var dup148 = setc("ec_subject","NetworkComm"); + +var dup149 = setc("ec_activity","Scan"); + +var dup150 = setc("ec_theme","TEV"); + +var dup151 = setc("eventcategory","1103010000"); + +var dup152 = // "Pattern{Constant(': '), Field(p0,false)}" +match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); + +var dup153 = // "Pattern{Constant('IP '), Field(p0,false)}" +match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); + +var dup154 = // "Pattern{Constant('address pool '), Field(p0,false)}" +match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); + +var dup155 = // "Pattern{Constant('pool '), Field(p0,false)}" +match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); + +var dup156 = // "Pattern{Constant('enabled '), Field(p0,false)}" +match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); + +var dup157 = // "Pattern{Constant('disabled '), Field(p0,false)}" +match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); + +var dup158 = // "Pattern{Constant('AH '), Field(p0,false)}" +match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); + +var dup159 = // "Pattern{Constant('ESP '), Field(p0,false)}" +match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); + +var dup160 = // "Pattern{Constant('’'), Field(p0,false)}" +match("MESSAGE#347:00018:02/1_0", "nwparser.p0", "’%{p0}"); + +var dup161 = // "Pattern{Constant('&'), Field(p0,false)}" +match("MESSAGE#347:00018:02/1_1", "nwparser.p0", "\u0026%{p0}"); + +var dup162 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); + +var dup163 = // "Pattern{Constant('Source'), Field(p0,false)}" +match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); + +var dup164 = // "Pattern{Constant('Destination'), Field(p0,false)}" +match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); + +var dup165 = // "Pattern{Constant('from '), Field(p0,false)}" +match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); + +var dup166 = // "Pattern{Constant('policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); + +var dup167 = // "Pattern{Constant('Attempt to enable '), Field(p0,false)}" +match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); + +var dup168 = // "Pattern{Constant('traffic logging via syslog '), Field(p0,false)}" +match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); + +var dup169 = // "Pattern{Constant('syslog '), Field(p0,false)}" +match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); + +var dup170 = // "Pattern{Constant('Syslog '), Field(p0,false)}" +match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); + +var dup171 = // "Pattern{Constant('host '), Field(p0,false)}" +match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); + +var dup172 = // "Pattern{Constant('domain name '), Field(p0,false)}" +match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); + +var dup173 = // "Pattern{Constant('has been changed to '), Field(fld2,false)}" +match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); + +var dup174 = // "Pattern{Constant('security facility '), Field(p0,false)}" +match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); + +var dup175 = // "Pattern{Constant('facility '), Field(p0,false)}" +match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); + +var dup176 = // "Pattern{Constant('local0'), Field(,false)}" +match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); + +var dup177 = // "Pattern{Constant('local1'), Field(,false)}" +match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); + +var dup178 = // "Pattern{Constant('local2'), Field(,false)}" +match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); + +var dup179 = // "Pattern{Constant('local3'), Field(,false)}" +match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); + +var dup180 = // "Pattern{Constant('local4'), Field(,false)}" +match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); + +var dup181 = // "Pattern{Constant('local5'), Field(,false)}" +match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); + +var dup182 = // "Pattern{Constant('local6'), Field(,false)}" +match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); + +var dup183 = // "Pattern{Constant('local7'), Field(,false)}" +match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); + +var dup184 = // "Pattern{Constant('auth/sec'), Field(,false)}" +match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); + +var dup185 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); + +var dup186 = setc("eventcategory","1603020000"); + +var dup187 = setc("eventcategory","1803000000"); + +var dup188 = // "Pattern{Constant('All '), Field(p0,false)}" +match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); + +var dup189 = setc("eventcategory","1603010000"); + +var dup190 = setc("eventcategory","1603100000"); + +var dup191 = // "Pattern{Constant('primary '), Field(p0,false)}" +match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); + +var dup192 = // "Pattern{Constant('secondary '), Field(p0,false)}" +match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); + +var dup193 = // "Pattern{Constant('t '), Field(p0,false)}" +match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); + +var dup194 = // "Pattern{Constant('w '), Field(p0,false)}" +match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); + +var dup195 = // "Pattern{Constant('server '), Field(p0,false)}" +match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); + +var dup196 = // "Pattern{Constant('has '), Field(p0,false)}" +match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); + +var dup197 = // "Pattern{Constant('SCS'), Field(p0,false)}" +match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); + +var dup198 = // "Pattern{Constant('bound to '), Field(p0,false)}" +match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); + +var dup199 = // "Pattern{Constant('unbound from '), Field(p0,false)}" +match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); + +var dup200 = setc("eventcategory","1801030000"); + +var dup201 = setc("eventcategory","1302010200"); + +var dup202 = // "Pattern{Constant('PKA RSA '), Field(p0,false)}" +match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); + +var dup203 = // "Pattern{Constant('unbind '), Field(p0,false)}" +match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); + +var dup204 = // "Pattern{Constant('PKA key '), Field(p0,false)}" +match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); + +var dup205 = setc("eventcategory","1304000000"); + +var dup206 = // "Pattern{Constant('Multiple login failures '), Field(p0,false)}" +match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); + +var dup207 = // "Pattern{Constant('occurred for '), Field(p0,false)}" +match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); + +var dup208 = setc("eventcategory","1401030000"); + +var dup209 = // "Pattern{Constant('aborted'), Field(,false)}" +match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); + +var dup210 = // "Pattern{Constant('performed'), Field(,false)}" +match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); + +var dup211 = setc("eventcategory","1605020000"); + +var dup212 = // "Pattern{Constant('IP pool of DHCP server on '), Field(p0,false)}" +match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); + +var dup213 = setc("ec_subject","Certificate"); + +var dup214 = // "Pattern{Constant('certificate '), Field(p0,false)}" +match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); + +var dup215 = // "Pattern{Constant('CRL '), Field(p0,false)}" +match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); + +var dup216 = // "Pattern{Constant('auto '), Field(p0,false)}" +match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); + +var dup217 = // "Pattern{Constant('RSA '), Field(p0,false)}" +match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); + +var dup218 = // "Pattern{Constant('DSA '), Field(p0,false)}" +match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); + +var dup219 = // "Pattern{Constant('key pair.'), Field(,false)}" +match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); + +var dup220 = setc("ec_subject","CryptoKey"); + +var dup221 = setc("ec_subject","Configuration"); + +var dup222 = setc("ec_activity","Request"); + +var dup223 = // "Pattern{Constant('FIPS test for '), Field(p0,false)}" +match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); + +var dup224 = // "Pattern{Constant('ECDSA '), Field(p0,false)}" +match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); + +var dup225 = setc("eventcategory","1612000000"); + +var dup226 = // "Pattern{Constant('yes '), Field(p0,false)}" +match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); + +var dup227 = // "Pattern{Constant('no '), Field(p0,false)}" +match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); + +var dup228 = // "Pattern{Constant('location '), Field(p0,false)}" +match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); + +var dup229 = // "Pattern{Field(,true), Constant(' '), Field(interface,false)}" +match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); + +var dup230 = // "Pattern{Constant('arp re'), Field(p0,false)}" +match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); + +var dup231 = // "Pattern{Constant('q '), Field(p0,false)}" +match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); + +var dup232 = // "Pattern{Constant('ply '), Field(p0,false)}" +match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); + +var dup233 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); + +var dup234 = setc("eventcategory","1201000000"); + +var dup235 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" +match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); + +var dup236 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); + +var dup237 = // "Pattern{Constant('NACN Policy Manager '), Field(p0,false)}" +match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); + +var dup238 = // "Pattern{Constant('1 '), Field(p0,false)}" +match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); + +var dup239 = // "Pattern{Constant('2 '), Field(p0,false)}" +match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); + +var dup240 = // "Pattern{Constant('unset '), Field(p0,false)}" +match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); + +var dup241 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var dup242 = setc("eventcategory","1401000000"); + +var dup243 = // "Pattern{Constant('SSH '), Field(p0,false)}" +match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); + +var dup244 = // "Pattern{Constant('SCS: NetScreen '), Field(p0,false)}" +match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); + +var dup245 = // "Pattern{Constant('NetScreen '), Field(p0,false)}" +match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); + +var dup246 = // "Pattern{Constant('S'), Field(p0,false)}" +match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); + +var dup247 = // "Pattern{Constant('CS: SSH'), Field(p0,false)}" +match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); + +var dup248 = // "Pattern{Constant('SH'), Field(p0,false)}" +match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); + +var dup249 = // "Pattern{Constant('the root system '), Field(p0,false)}" +match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); + +var dup250 = // "Pattern{Constant('vsys '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); + +var dup251 = // "Pattern{Constant('CS: SSH '), Field(p0,false)}" +match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); + +var dup252 = // "Pattern{Constant('SH '), Field(p0,false)}" +match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); + +var dup253 = // "Pattern{Constant('a '), Field(p0,false)}" +match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); + +var dup254 = // "Pattern{Constant('ert '), Field(p0,false)}" +match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); + +var dup255 = // "Pattern{Constant('SSL '), Field(p0,false)}" +match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); + +var dup256 = setc("eventcategory","1608000000"); + +var dup257 = // "Pattern{Constant('id: '), Field(p0,false)}" +match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); + +var dup258 = // "Pattern{Constant('ID '), Field(p0,false)}" +match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); + +var dup259 = // "Pattern{Constant('permit '), Field(p0,false)}" +match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); + +var dup260 = // "Pattern{Constant('IGMP '), Field(p0,false)}" +match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); + +var dup261 = // "Pattern{Constant('IGMP will '), Field(p0,false)}" +match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); + +var dup262 = // "Pattern{Constant('not do '), Field(p0,false)}" +match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); + +var dup263 = // "Pattern{Constant('do '), Field(p0,false)}" +match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); + +var dup264 = // "Pattern{Constant('shut down '), Field(p0,false)}" +match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); + +var dup265 = // "Pattern{Constant('NSRP: '), Field(p0,false)}" +match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); + +var dup266 = // "Pattern{Constant('Unit '), Field(p0,false)}" +match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); + +var dup267 = // "Pattern{Constant('local unit= '), Field(p0,false)}" +match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); + +var dup268 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); + +var dup269 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Sec'), Field(p0,false)}" +match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); + +var dup270 = // "Pattern{Constant('ruity'), Field(p0,false)}" +match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); + +var dup271 = // "Pattern{Constant('urity'), Field(p0,false)}" +match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); + +var dup272 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state')}" +match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); + +var dup273 = // "Pattern{Constant(''), Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); + +var dup274 = setc("eventcategory","1805010000"); + +var dup275 = setc("eventcategory","1805000000"); + +var dup276 = date_time({ + dest: "starttime", + args: ["fld2"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup277 = call({ + dest: "nwparser.bytes", + fn: CALC, + args: [ + field("sbytes"), + constant("+"), + field("rbytes"), + ], +}); + +var dup278 = setc("action","Deny"); + +var dup279 = setc("disposition","Deny"); + +var dup280 = setc("direction","outgoing"); + +var dup281 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$IN"), + field("saddr"), + field("daddr"), + field("sport"), + field("dport"), + ], +}); + +var dup282 = setc("direction","incoming"); + +var dup283 = setc("eventcategory","1801000000"); + +var dup284 = setf("action","disposition"); + +var dup285 = // "Pattern{Constant('start_time='), Field(p0,false)}" +match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); + +var dup286 = // "Pattern{Constant('\"'), Field(fld2,false), Constant('\"'), Field(p0,false)}" +match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); + +var dup287 = // "Pattern{Constant(' "'), Field(fld2,false), Constant('" '), Field(p0,false)}" +match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); + +var dup288 = // "Pattern{Field(daddr,false)}" +match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); + +var dup289 = // "Pattern{Constant('Admin '), Field(p0,false)}" +match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); + +var dup290 = // "Pattern{Constant('Vsys admin '), Field(p0,false)}" +match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); + +var dup291 = // "Pattern{Constant('Telnet '), Field(p0,false)}" +match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); + +var dup292 = setc("eventcategory","1401050200"); + +var dup293 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$IN"), + field("daddr"), + field("saddr"), + ], +}); + +var dup294 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$IN"), + field("daddr"), + field("saddr"), + field("dport"), + field("sport"), + ], +}); + +var dup295 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); + +var dup296 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); + +var dup297 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.'), Field(p0,false)}" +match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); + +var dup298 = // "Pattern{Field(obj_type,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var dup299 = setc("eventcategory","1204000000"); + +var dup300 = // "Pattern{Field(signame,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var dup301 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" +match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); + +var dup302 = // "Pattern{Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); + +var dup303 = setc("eventcategory","1801020000"); + +var dup304 = setc("disposition","failed"); + +var dup305 = // "Pattern{Constant('ut '), Field(p0,false)}" +match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); + +var dup306 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); + +var dup307 = // "Pattern{Constant('user '), Field(p0,false)}" +match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); + +var dup308 = // "Pattern{Constant('the '), Field(logon_type,false)}" +match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); + +var dup309 = // "Pattern{Constant('WebAuth user '), Field(p0,false)}" +match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); + +var dup310 = // "Pattern{Constant('backup1 '), Field(p0,false)}" +match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); + +var dup311 = // "Pattern{Constant('backup2 '), Field(p0,false)}" +match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); + +var dup312 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); + +var dup313 = // "Pattern{Constant('assigned '), Field(p0,false)}" +match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); + +var dup314 = // "Pattern{Constant('assigned to '), Field(p0,false)}" +match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); + +var dup315 = setc("eventcategory","1803020000"); + +var dup316 = setc("eventcategory","1613030000"); + +var dup317 = // "Pattern{Constant('''), Field(administrator,false), Constant('' '), Field(p0,false)}" +match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); + +var dup318 = // "Pattern{Constant('SSH: P'), Field(p0,false)}" +match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); + +var dup319 = // "Pattern{Constant('KA '), Field(p0,false)}" +match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); + +var dup320 = // "Pattern{Constant('assword '), Field(p0,false)}" +match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); + +var dup321 = // "Pattern{Constant('\''), Field(administrator,false), Constant('\' '), Field(p0,false)}" +match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); + +var dup322 = // "Pattern{Constant('at host '), Field(saddr,false)}" +match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); + +var dup323 = // "Pattern{Field(,false), Constant('S'), Field(p0,false)}" +match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); + +var dup324 = // "Pattern{Constant('CS '), Field(p0,false)}" +match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); + +var dup325 = setc("event_description","Cannot connect to NSM server"); + +var dup326 = setc("eventcategory","1603040000"); + +var dup327 = // "Pattern{Constant('from server.ini file.'), Field(,false)}" +match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); + +var dup328 = // "Pattern{Constant('pattern '), Field(p0,false)}" +match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); + +var dup329 = // "Pattern{Constant('server.ini '), Field(p0,false)}" +match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); + +var dup330 = // "Pattern{Constant('file.'), Field(,false)}" +match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); + +var dup331 = // "Pattern{Constant('AV pattern '), Field(p0,false)}" +match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); + +var dup332 = // "Pattern{Constant('added into '), Field(p0,false)}" +match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); + +var dup333 = // "Pattern{Constant('loader '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); + +var dup334 = call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$OUT"), + field("daddr"), + field("saddr"), + field("dport"), + field("sport"), + ], +}); + +var dup335 = linear_select([ + dup10, + dup11, +]); + +var dup336 = // "Pattern{Constant('Policy ID='), Field(policy_id,true), Constant(' Rate='), Field(fld2,true), Constant(' exceeds threshold')}" +match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var dup337 = linear_select([ + dup13, + dup14, +]); + +var dup338 = linear_select([ + dup15, + dup16, +]); + +var dup339 = linear_select([ + dup56, + dup57, +]); + +var dup340 = linear_select([ + dup65, + dup66, +]); + +var dup341 = linear_select([ + dup68, + dup69, +]); + +var dup342 = linear_select([ + dup71, + dup72, +]); + +var dup343 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(interface,false), Constant(')')}" +match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup61, +])); + +var dup344 = linear_select([ + dup74, + dup75, +]); + +var dup345 = linear_select([ + dup81, + dup82, +]); + +var dup346 = linear_select([ + dup24, + dup90, +]); + +var dup347 = linear_select([ + dup94, + dup95, +]); + +var dup348 = linear_select([ + dup98, + dup99, +]); + +var dup349 = linear_select([ + dup100, + dup101, + dup102, +]); + +var dup350 = linear_select([ + dup113, + dup114, +]); + +var dup351 = linear_select([ + dup111, + dup16, +]); + +var dup352 = linear_select([ + dup127, + dup107, +]); + +var dup353 = linear_select([ + dup8, + dup21, +]); + +var dup354 = linear_select([ + dup122, + dup133, +]); + +var dup355 = linear_select([ + dup142, + dup143, +]); + +var dup356 = linear_select([ + dup145, + dup21, +]); + +var dup357 = linear_select([ + dup127, + dup106, +]); + +var dup358 = linear_select([ + dup152, + dup96, +]); + +var dup359 = linear_select([ + dup154, + dup155, +]); + +var dup360 = linear_select([ + dup156, + dup157, +]); + +var dup361 = linear_select([ + dup99, + dup134, +]); + +var dup362 = linear_select([ + dup158, + dup159, +]); + +var dup363 = linear_select([ + dup160, + dup161, +]); + +var dup364 = linear_select([ + dup163, + dup164, +]); + +var dup365 = linear_select([ + dup165, + dup103, +]); + +var dup366 = linear_select([ + dup164, + dup163, +]); + +var dup367 = linear_select([ + dup46, + dup47, +]); + +var dup368 = linear_select([ + dup168, + dup169, +]); + +var dup369 = linear_select([ + dup174, + dup175, +]); + +var dup370 = linear_select([ + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, +]); + +var dup371 = linear_select([ + dup49, + dup21, +]); + +var dup372 = linear_select([ + dup191, + dup192, +]); + +var dup373 = linear_select([ + dup96, + dup152, +]); + +var dup374 = linear_select([ + dup198, + dup199, +]); + +var dup375 = linear_select([ + dup24, + dup202, +]); + +var dup376 = linear_select([ + dup103, + dup165, +]); + +var dup377 = linear_select([ + dup207, + dup118, +]); + +var dup378 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var dup379 = linear_select([ + dup214, + dup215, +]); + +var dup380 = linear_select([ + dup217, + dup218, +]); + +var dup381 = linear_select([ + dup224, + dup217, +]); + +var dup382 = linear_select([ + dup226, + dup227, +]); + +var dup383 = linear_select([ + dup233, + dup124, +]); + +var dup384 = linear_select([ + dup231, + dup232, +]); + +var dup385 = linear_select([ + dup235, + dup236, +]); + +var dup386 = linear_select([ + dup238, + dup239, +]); + +var dup387 = linear_select([ + dup244, + dup245, +]); + +var dup388 = linear_select([ + dup247, + dup248, +]); + +var dup389 = linear_select([ + dup249, + dup250, +]); + +var dup390 = linear_select([ + dup251, + dup252, +]); + +var dup391 = linear_select([ + dup253, + dup254, +]); + +var dup392 = linear_select([ + dup262, + dup263, +]); + +var dup393 = linear_select([ + dup266, + dup267, +]); + +var dup394 = linear_select([ + dup270, + dup271, +]); + +var dup395 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var dup396 = linear_select([ + dup286, + dup287, +]); + +var dup397 = linear_select([ + dup289, + dup290, +]); + +var dup398 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup3, + dup60, +])); + +var dup399 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to zone '), Field(zone,false), Constant(', proto '), Field(protocol,true), Constant(' (int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup4, + dup59, + dup5, + dup9, + dup2, + dup3, + dup60, +])); + +var dup400 = linear_select([ + dup302, + dup26, +]); + +var dup401 = linear_select([ + dup115, + dup305, +]); + +var dup402 = linear_select([ + dup125, + dup96, +]); + +var dup403 = linear_select([ + dup191, + dup310, + dup311, +]); + +var dup404 = linear_select([ + dup312, + dup16, +]); + +var dup405 = linear_select([ + dup319, + dup320, +]); + +var dup406 = linear_select([ + dup321, + dup317, +]); + +var dup407 = linear_select([ + dup324, + dup252, +]); + +var dup408 = linear_select([ + dup329, + dup331, +]); + +var dup409 = linear_select([ + dup332, + dup129, +]); + +var dup410 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup60, + dup284, +])); + +var dup411 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup278, + dup279, + dup60, +])); + +var dup412 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup60, + dup284, +])); + +var dup413 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup278, + dup279, + dup61, +])); + +var dup414 = all_match({ + processors: [ + dup265, + dup393, + dup268, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var dup415 = all_match({ + processors: [ + dup269, + dup394, + dup272, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var dup416 = all_match({ + processors: [ + dup80, + dup345, + dup295, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var dup417 = all_match({ + processors: [ + dup298, + dup345, + dup131, + ], + on_success: processor_chain([ + dup299, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup61, + ]), +}); + +var dup418 = all_match({ + processors: [ + dup300, + dup345, + dup131, + ], + on_success: processor_chain([ + dup299, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup61, + ]), +}); + +var hdr1 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' [No Name]system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" +match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ + setc("header_id","0001"), +])); + +var hdr2 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' ['), Field(hvsys,false), Constant(']system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" +match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ + setc("header_id","0003"), +])); + +var hdr3 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" +match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ + setc("header_id","0004"), +])); + +var hdr4 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' '), Field(p0,false)}" +match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); + +var part1 = // "Pattern{Constant('[No Name]system'), Field(p0,false)}" +match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); + +var part2 = // "Pattern{Constant('['), Field(hvsys,false), Constant(']system'), Field(p0,false)}" +match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); + +var part3 = // "Pattern{Constant('system'), Field(p0,false)}" +match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); + +var select1 = linear_select([ + part1, + part2, + part3, +]); + +var part4 = // "Pattern{Constant('-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); + +var all1 = all_match({ + processors: [ + hdr4, + select1, + part4, + ], + on_success: processor_chain([ + setc("header_id","0002"), + ]), +}); + +var select2 = linear_select([ + hdr1, + hdr2, + hdr3, + all1, +]); + +var part5 = // "Pattern{Field(zone,true), Constant(' address '), Field(interface,true), Constant(' with ip address '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1 = msg("00001", part5); + +var part6 = // "Pattern{Field(zone,true), Constant(' address '), Field(interface,true), Constant(' with domain name '), Field(domain,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg2 = msg("00001:01", part6); + +var part7 = // "Pattern{Constant('ip address '), Field(hostip,true), Constant(' in zone '), Field(p0,false)}" +match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); + +var select3 = linear_select([ + part7, + dup7, +]); + +var part8 = // "Pattern{Field(zone,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); + +var all2 = all_match({ + processors: [ + dup6, + select3, + part8, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg3 = msg("00001:02", all2); + +var part9 = // "Pattern{Constant('arp entry '), Field(hostip,true), Constant(' interface changed!')}" +match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg4 = msg("00001:03", part9); + +var part10 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' in zone '), Field(p0,false)}" +match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); + +var select4 = linear_select([ + part10, + dup7, +]); + +var part11 = // "Pattern{Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' session'), Field(p0,false)}" +match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); + +var part12 = // "Pattern{Constant('.'), Field(fld1,false)}" +match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); + +var select5 = linear_select([ + dup8, + part12, +]); + +var all3 = all_match({ + processors: [ + dup6, + select4, + part11, + select5, + ], + on_success: processor_chain([ + dup1, + dup9, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg5 = msg("00001:04", all3); + +var part13 = // "Pattern{Field(fld2,false), Constant(': Address '), Field(group_object,true), Constant(' for ip address '), Field(hostip,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' session '), Field(p0,false)}" +match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); + +var all4 = all_match({ + processors: [ + part13, + dup335, + ], + on_success: processor_chain([ + dup1, + dup9, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg6 = msg("00001:05", all4); + +var part14 = // "Pattern{Constant('Address group '), Field(group_object,true), Constant(' '), Field(info,false)}" +match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg7 = msg("00001:06", part14); + +var msg8 = msg("00001:07", dup336); + +var part15 = // "Pattern{Constant('for IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); + +var part16 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('via NSRP Peer session. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); + +var all5 = all_match({ + processors: [ + dup12, + dup337, + part15, + dup338, + part16, + ], + on_success: processor_chain([ + dup1, + dup9, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg9 = msg("00001:08", all5); + +var part17 = // "Pattern{Constant('for IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' session. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); + +var all6 = all_match({ + processors: [ + dup12, + dup337, + part17, + ], + on_success: processor_chain([ + dup1, + dup9, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg10 = msg("00001:09", all6); + +var select6 = linear_select([ + msg1, + msg2, + msg3, + msg4, + msg5, + msg6, + msg7, + msg8, + msg9, + msg10, +]); + +var part18 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg11 = msg("00002:03", part18); + +var part19 = // "Pattern{Constant('E-mail address '), Field(user_address,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg12 = msg("00002:04", part19); + +var part20 = // "Pattern{Constant('E-mail notification has been '), Field(disposition,false)}" +match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg13 = msg("00002:05", part20); + +var part21 = // "Pattern{Constant('Inclusion of traffic logs with e-mail notification of event alarms has been '), Field(disposition,false)}" +match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg14 = msg("00002:06", part21); + +var part22 = // "Pattern{Constant('LCD display has been '), Field(action,true), Constant(' and the LCD control keys have been '), Field(disposition,false)}" +match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg15 = msg("00002:07", part22); + +var part23 = // "Pattern{Constant('HTTP component blocking for '), Field(fld2,true), Constant(' is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup4, + dup5, + dup9, +])); + +var msg16 = msg("00002:55", part23); + +var part24 = // "Pattern{Constant('LCD display has been '), Field(disposition,false)}" +match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg17 = msg("00002:08", part24); + +var part25 = // "Pattern{Constant('LCD control keys have been '), Field(disposition,false)}" +match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg18 = msg("00002:09", part25); + +var part26 = // "Pattern{Constant('Mail server '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg19 = msg("00002:10", part26); + +var part27 = // "Pattern{Constant('Management restriction for '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ + dup17, + dup2, + dup3, + dup4, + dup5, +])); + +var msg20 = msg("00002:11", part27); + +var part28 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to default port '), Field(change_new,false)}" +match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg21 = msg("00002:12", part28); + +var part29 = // "Pattern{Constant('System configuration has been '), Field(disposition,false)}" +match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg22 = msg("00002:15", part29); + +var msg23 = msg("00002:17", dup336); + +var part30 = // "Pattern{Constant('Unexpected error from e'), Field(p0,false)}" +match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); + +var part31 = // "Pattern{Constant('-mail '), Field(p0,false)}" +match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); + +var part32 = // "Pattern{Constant('mail '), Field(p0,false)}" +match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); + +var select7 = linear_select([ + part31, + part32, +]); + +var part33 = // "Pattern{Constant('server('), Field(fld2,false), Constant('):')}" +match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); + +var all7 = all_match({ + processors: [ + part30, + select7, + part33, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg24 = msg("00002:18", all7); + +var part34 = // "Pattern{Constant('Web Admin '), Field(change_attribute,true), Constant(' value has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg25 = msg("00002:19", part34); + +var part35 = // "Pattern{Constant('Root admin password restriction of minimum '), Field(fld2,true), Constant(' characters has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); + +var part36 = // "Pattern{Constant('from Console '), Field(,false)}" +match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); + +var select8 = linear_select([ + part36, + dup20, + dup21, +]); + +var all8 = all_match({ + processors: [ + part35, + select8, + ], + on_success: processor_chain([ + dup22, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg26 = msg("00002:20", all8); + +var part37 = // "Pattern{Constant('Root admin '), Field(p0,false)}" +match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); + +var part38 = // "Pattern{Field(fld2,true), Constant(' admin '), Field(p0,false)}" +match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); + +var select9 = linear_select([ + part37, + part38, +]); + +var select10 = linear_select([ + dup24, + dup25, +]); + +var part39 = // "Pattern{Constant('has been changed by admin '), Field(administrator,false)}" +match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); + +var all9 = all_match({ + processors: [ + select9, + dup23, + select10, + part39, + ], + on_success: processor_chain([ + dup22, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg27 = msg("00002:21", all9); + +var part40 = // "Pattern{Field(change_attribute,true), Constant(' from '), Field(protocol,true), Constant(' before administrative session disconnects has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' by admin '), Field(p0,false)}" +match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); + +var part41 = // "Pattern{Field(administrator,true), Constant(' from Console')}" +match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); + +var part42 = // "Pattern{Field(administrator,true), Constant(' from host '), Field(saddr,false)}" +match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); + +var select11 = linear_select([ + part41, + part42, + dup26, +]); + +var all10 = all_match({ + processors: [ + part40, + select11, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg28 = msg("00002:22", all10); + +var part43 = // "Pattern{Constant('Root admin access restriction through console only has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); + +var part44 = // "Pattern{Constant('from Console'), Field(,false)}" +match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); + +var select12 = linear_select([ + dup20, + part44, + dup21, +]); + +var all11 = all_match({ + processors: [ + part43, + select12, + ], + on_success: processor_chain([ + dup22, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg29 = msg("00002:23", all11); + +var part45 = // "Pattern{Constant('Admin access restriction of '), Field(protocol,true), Constant(' administration through tunnel only has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' from '), Field(p0,false)}" +match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); + +var part46 = // "Pattern{Constant('host '), Field(saddr,false)}" +match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); + +var part47 = // "Pattern{Constant('Console'), Field(,false)}" +match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); + +var select13 = linear_select([ + part46, + part47, +]); + +var all12 = all_match({ + processors: [ + part45, + select13, + ], + on_success: processor_chain([ + dup22, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg30 = msg("00002:24", all12); + +var part48 = // "Pattern{Constant('Admin AUTH: Local instance of an '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + setc("eventcategory","1402000000"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg31 = msg("00002:25", part48); + +var part49 = // "Pattern{Constant('Cannot connect to e-mail server '), Field(hostip,false), Constant('.')}" +match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg32 = msg("00002:26", part49); + +var part50 = // "Pattern{Constant('Mail server is not configured.'), Field(,false)}" +match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg33 = msg("00002:27", part50); + +var part51 = // "Pattern{Constant('Mail recipients were not configured.'), Field(,false)}" +match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg34 = msg("00002:28", part51); + +var part52 = // "Pattern{Constant('Single use password restriction for read-write administrators has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false)}" +match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg35 = msg("00002:29", part52); + +var part53 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ + dup28, + dup29, + dup30, + dup31, + dup32, + dup2, + dup3, + dup4, + dup5, +])); + +var msg36 = msg("00002:30", part53); + +var part54 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged out for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ + dup33, + dup29, + dup34, + dup2, + dup3, + dup4, + dup5, +])); + +var msg37 = msg("00002:41", part54); + +var part55 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,true), Constant(' '), Field(space,true), Constant(' ('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false)}" +match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ + dup35, + dup29, + dup30, + dup31, + dup2, + dup3, + dup4, + dup5, +])); + +var msg38 = msg("00002:31", part55); + +var part56 = // "Pattern{Constant('E-mail notification '), Field(p0,false)}" +match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); + +var part57 = // "Pattern{Constant('Transparent virutal '), Field(p0,false)}" +match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); + +var select14 = linear_select([ + part56, + part57, +]); + +var part58 = // "Pattern{Constant('wire mode has been '), Field(disposition,false)}" +match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); + +var all13 = all_match({ + processors: [ + select14, + part58, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg39 = msg("00002:32", all13); + +var part59 = // "Pattern{Constant('Malicious URL '), Field(url,true), Constant(' has been '), Field(disposition,true), Constant(' for zone '), Field(zone,false)}" +match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg40 = msg("00002:35", part59); + +var part60 = // "Pattern{Constant('Bypass'), Field(p0,false)}" +match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); + +var part61 = // "Pattern{Constant('-others-IPSec '), Field(p0,false)}" +match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); + +var part62 = // "Pattern{Constant(' non-IP traffic '), Field(p0,false)}" +match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); + +var select15 = linear_select([ + part61, + part62, +]); + +var part63 = // "Pattern{Constant('option has been '), Field(disposition,false)}" +match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); + +var all14 = all_match({ + processors: [ + part60, + select15, + part63, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg41 = msg("00002:36", all14); + +var part64 = // "Pattern{Constant('Logging of '), Field(p0,false)}" +match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); + +var part65 = // "Pattern{Constant('dropped '), Field(p0,false)}" +match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); + +var part66 = // "Pattern{Constant('IKE '), Field(p0,false)}" +match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); + +var part67 = // "Pattern{Constant('SNMP '), Field(p0,false)}" +match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); + +var part68 = // "Pattern{Constant('ICMP '), Field(p0,false)}" +match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); + +var select16 = linear_select([ + part65, + part66, + part67, + part68, +]); + +var part69 = // "Pattern{Constant('traffic to self has been '), Field(disposition,false)}" +match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); + +var all15 = all_match({ + processors: [ + part64, + select16, + part69, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg42 = msg("00002:37", all15); + +var part70 = // "Pattern{Constant('Logging of dropped traffic to self (excluding multicast) has been '), Field(p0,false)}" +match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); + +var part71 = // "Pattern{Field(disposition,true), Constant(' on '), Field(zone,false)}" +match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); + +var select17 = linear_select([ + part71, + dup36, +]); + +var all16 = all_match({ + processors: [ + part70, + select17, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg43 = msg("00002:38", all16); + +var part72 = // "Pattern{Constant('Traffic shaping is '), Field(disposition,false)}" +match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg44 = msg("00002:39", part72); + +var part73 = // "Pattern{Constant('Admin account created for ''), Field(username,false), Constant('' by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ + dup37, + dup29, + setc("ec_activity","Create"), + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg45 = msg("00002:40", part73); + +var part74 = // "Pattern{Constant('ADMIN AUTH: Privilege requested for unknown user '), Field(username,false), Constant('. Possible HA syncronization problem.')}" +match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ + dup35, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg46 = msg("00002:44", part74); + +var part75 = // "Pattern{Field(change_attribute,true), Constant(' for account ''), Field(change_old,false), Constant('' has been '), Field(disposition,true), Constant(' to ''), Field(change_new,false), Constant('' '), Field(p0,false)}" +match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); + +var part76 = // "Pattern{Constant('by '), Field(administrator,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); + +var select18 = linear_select([ + part76, + dup40, +]); + +var part77 = // "Pattern{Constant(''), Field(logon_type,true), Constant(' from host '), Field(p0,false)}" +match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); + +var part78 = // "Pattern{Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); + +var part79 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); + +var select19 = linear_select([ + part78, + part79, +]); + +var all17 = all_match({ + processors: [ + part75, + select18, + part77, + select19, + dup41, + ], + on_success: processor_chain([ + dup42, + dup43, + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg47 = msg("00002:42", all17); + +var part80 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for '), Field(p0,false)}" +match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); + +var part81 = // "Pattern{Constant('''), Field(username,false), Constant('''), Field(p0,false)}" +match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); + +var part82 = // "Pattern{Constant('"'), Field(username,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); + +var select20 = linear_select([ + part81, + part82, +]); + +var part83 = // "Pattern{Field(,false), Constant('by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); + +var all18 = all_match({ + processors: [ + part80, + select20, + part83, + ], + on_success: processor_chain([ + dup42, + dup29, + dup43, + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg48 = msg("00002:43", all18); + +var part84 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for "'), Field(username,false), Constant('" by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ + dup42, + dup29, + dup43, + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg49 = msg("00002:50", part84); + +var part85 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for "'), Field(username,false), Constant('" by '), Field(administrator,true), Constant(' '), Field(fld2,true), Constant(' via '), Field(logon_type,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ + dup42, + dup29, + dup43, + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg50 = msg("00002:51", part85); + +var part86 = // "Pattern{Constant('Extraneous exit is issued by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg51 = msg("00002:45", part86); + +var part87 = // "Pattern{Constant('Ping of Death attack protection '), Field(p0,false)}" +match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); + +var part88 = // "Pattern{Constant('Src Route IP option filtering '), Field(p0,false)}" +match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); + +var part89 = // "Pattern{Constant('Teardrop attack protection '), Field(p0,false)}" +match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); + +var part90 = // "Pattern{Constant('Land attack protection '), Field(p0,false)}" +match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); + +var part91 = // "Pattern{Constant('SYN flood protection '), Field(p0,false)}" +match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); + +var select21 = linear_select([ + part87, + part88, + part89, + part90, + part91, +]); + +var part92 = // "Pattern{Constant('is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); + +var all19 = all_match({ + processors: [ + select21, + part92, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg52 = msg("00002:47", all19); + +var part93 = // "Pattern{Constant('Dropping pkts if not '), Field(p0,false)}" +match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); + +var part94 = // "Pattern{Constant('exactly same with incoming if '), Field(p0,false)}" +match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); + +var part95 = // "Pattern{Constant('in route table '), Field(p0,false)}" +match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); + +var select22 = linear_select([ + part94, + part95, +]); + +var part96 = // "Pattern{Constant('(IP spoof protection) is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); + +var part97 = // "Pattern{Constant('NSRP Peer. ('), Field(p0,false)}" +match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); + +var select23 = linear_select([ + part97, + dup45, +]); + +var all20 = all_match({ + processors: [ + part93, + select22, + part96, + select23, + dup41, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg53 = msg("00002:48", all20); + +var part98 = // "Pattern{Field(signame,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); + +var part99 = // "Pattern{Constant('protection'), Field(p0,false)}" +match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); + +var part100 = // "Pattern{Constant('limiting'), Field(p0,false)}" +match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); + +var part101 = // "Pattern{Constant('detection'), Field(p0,false)}" +match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); + +var part102 = // "Pattern{Constant('filtering '), Field(p0,false)}" +match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); + +var select24 = linear_select([ + part99, + part100, + part101, + part102, +]); + +var part103 = // "Pattern{Field(,false), Constant('is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); + +var part104 = // "Pattern{Constant('admin via '), Field(p0,false)}" +match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); + +var select25 = linear_select([ + dup46, + part104, + dup47, +]); + +var select26 = linear_select([ + dup48, + dup45, +]); + +var all21 = all_match({ + processors: [ + part98, + select24, + part103, + select25, + select26, + dup41, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg54 = msg("00002:52", all21); + +var part105 = // "Pattern{Constant('Admin password for account "'), Field(username,false), Constant('" has been '), Field(disposition,true), Constant(' by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ + dup42, + dup43, + dup38, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg55 = msg("00002:53", part105); + +var part106 = // "Pattern{Constant('Traffic shaping clearing DSCP selector is turned O'), Field(p0,false)}" +match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); + +var part107 = // "Pattern{Constant('FF'), Field(p0,false)}" +match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); + +var part108 = // "Pattern{Constant('N'), Field(p0,false)}" +match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); + +var select27 = linear_select([ + part107, + part108, +]); + +var all22 = all_match({ + processors: [ + part106, + select27, + dup49, + ], + on_success: processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, + dup9, + ]), +}); + +var msg56 = msg("00002:54", all22); + +var part109 = // "Pattern{Field(change_attribute,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); + +var part110 = // "Pattern{Constant('has been changed'), Field(p0,false)}" +match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); + +var select28 = linear_select([ + part110, + dup52, +]); + +var part111 = // "Pattern{Field(,false), Constant('from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); + +var all23 = all_match({ + processors: [ + part109, + select28, + part111, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg57 = msg("00002", all23); + +var part112 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' failed. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ + dup53, + dup9, + dup2, + dup3, + dup4, + dup5, +])); + +var msg58 = msg("00002:56", part112); + +var select29 = linear_select([ + msg11, + msg12, + msg13, + msg14, + msg15, + msg16, + msg17, + msg18, + msg19, + msg20, + msg21, + msg22, + msg23, + msg24, + msg25, + msg26, + msg27, + msg28, + msg29, + msg30, + msg31, + msg32, + msg33, + msg34, + msg35, + msg36, + msg37, + msg38, + msg39, + msg40, + msg41, + msg42, + msg43, + msg44, + msg45, + msg46, + msg47, + msg48, + msg49, + msg50, + msg51, + msg52, + msg53, + msg54, + msg55, + msg56, + msg57, + msg58, +]); + +var part113 = // "Pattern{Constant('Multiple authentication failures have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false)}" +match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ + dup53, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg59 = msg("00003", part113); + +var part114 = // "Pattern{Constant('Multiple authentication failures have been detected!'), Field(,false)}" +match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ + dup53, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg60 = msg("00003:01", part114); + +var part115 = // "Pattern{Constant('The console debug buffer has been '), Field(disposition,false)}" +match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg61 = msg("00003:02", part115); + +var part116 = // "Pattern{Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" +match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg62 = msg("00003:03", part116); + +var part117 = // "Pattern{Constant('serial'), Field(p0,false)}" +match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); + +var part118 = // "Pattern{Constant('local'), Field(p0,false)}" +match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); + +var select30 = linear_select([ + part117, + part118, +]); + +var part119 = // "Pattern{Field(,false), Constant('console has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false), Constant('.')}" +match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); + +var all24 = all_match({ + processors: [ + dup55, + select30, + part119, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg63 = msg("00003:05", all24); + +var select31 = linear_select([ + msg59, + msg60, + msg61, + msg62, + msg63, +]); + +var part120 = // "Pattern{Field(info,false), Constant('DNS server IP has been changed')}" +match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg64 = msg("00004", part120); + +var part121 = // "Pattern{Constant('DNS cache table has been '), Field(disposition,false)}" +match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg65 = msg("00004:01", part121); + +var part122 = // "Pattern{Constant('Daily DNS lookup has been '), Field(disposition,false)}" +match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg66 = msg("00004:02", part122); + +var part123 = // "Pattern{Constant('Daily DNS lookup time has been '), Field(disposition,false)}" +match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg67 = msg("00004:03", part123); + +var part124 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); + +var part125 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' '), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); + +var all25 = all_match({ + processors: [ + part124, + dup339, + part125, + ], + on_success: processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup59, + dup3, + dup60, + ]), +}); + +var msg68 = msg("00004:04", all25); + +var part126 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,false)}" +match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup3, + dup61, +])); + +var msg69 = msg("00004:05", part126); + +var part127 = // "Pattern{Constant('DNS lookup time has been changed to start at '), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' with an interval of '), Field(fld4,false)}" +match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg70 = msg("00004:06", part127); + +var part128 = // "Pattern{Constant('DNS cache table entries have been refreshed as result of external event.'), Field(,false)}" +match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg71 = msg("00004:07", part128); + +var part129 = // "Pattern{Constant('DNS Proxy module has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg72 = msg("00004:08", part129); + +var part130 = // "Pattern{Constant('DNS Proxy module has more concurrent client requests than allowed.'), Field(,false)}" +match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ + dup62, + dup2, + dup3, + dup4, + dup5, +])); + +var msg73 = msg("00004:09", part130); + +var part131 = // "Pattern{Constant('DNS Proxy server select table entries exceeded maximum limit.'), Field(,false)}" +match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ + dup62, + dup2, + dup3, + dup4, + dup5, +])); + +var msg74 = msg("00004:10", part131); + +var part132 = // "Pattern{Constant('Proxy server select table added with domain '), Field(domain,false), Constant(', interface '), Field(interface,false), Constant(', primary-ip '), Field(fld2,false), Constant(', secondary-ip '), Field(fld3,false), Constant(', tertiary-ip '), Field(fld4,false), Constant(', failover '), Field(disposition,false)}" +match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg75 = msg("00004:11", part132); + +var part133 = // "Pattern{Constant('DNS Proxy server select table entry '), Field(disposition,true), Constant(' with domain '), Field(domain,false)}" +match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg76 = msg("00004:12", part133); + +var part134 = // "Pattern{Constant('DDNS server '), Field(domain,true), Constant(' returned incorrect ip '), Field(fld2,false), Constant(', local-ip should be '), Field(fld3,false)}" +match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg77 = msg("00004:13", part134); + +var part135 = // "Pattern{Constant('automatically refreshed '), Field(p0,false)}" +match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); + +var part136 = // "Pattern{Constant('refreshed by HA '), Field(p0,false)}" +match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); + +var select32 = linear_select([ + part135, + part136, +]); + +var all26 = all_match({ + processors: [ + dup63, + select32, + dup49, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg78 = msg("00004:14", all26); + +var part137 = // "Pattern{Constant('DNS entries have been refreshed as result of DNS server address change. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg79 = msg("00004:15", part137); + +var part138 = // "Pattern{Constant('DNS entries have been manually refreshed. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg80 = msg("00004:16", part138); + +var all27 = all_match({ + processors: [ + dup64, + dup340, + dup67, + ], + on_success: processor_chain([ + dup58, + dup2, + dup4, + dup59, + dup9, + dup5, + dup3, + dup60, + ]), +}); + +var msg81 = msg("00004:17", all27); + +var select33 = linear_select([ + msg64, + msg65, + msg66, + msg67, + msg68, + msg69, + msg70, + msg71, + msg72, + msg73, + msg74, + msg75, + msg76, + msg77, + msg78, + msg79, + msg80, + msg81, +]); + +var part139 = // "Pattern{Field(signame,true), Constant(' alarm threshold from the same source has been changed to '), Field(trigger_val,false)}" +match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg82 = msg("00005", part139); + +var part140 = // "Pattern{Constant('Logging of '), Field(fld2,true), Constant(' traffic to self has been '), Field(disposition,false)}" +match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg83 = msg("00005:01", part140); + +var part141 = // "Pattern{Constant('SYN flood '), Field(fld2,true), Constant(' has been changed to '), Field(fld3,false)}" +match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg84 = msg("00005:02", part141); + +var part142 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(p0,false)}" +match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); + +var part143 = // "Pattern{Field(fld99,false), Constant('interface '), Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); + +var part144 = // "Pattern{Constant('in zone '), Field(zone,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); + +var select34 = linear_select([ + part144, + dup73, +]); + +var part145 = // "Pattern{Constant(''), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); + +var all28 = all_match({ + processors: [ + part142, + dup341, + dup70, + dup342, + part143, + select34, + part145, + ], + on_success: processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup59, + dup61, + ]), +}); + +var msg85 = msg("00005:03", all28); + +var msg86 = msg("00005:04", dup343); + +var part146 = // "Pattern{Constant('SYN flood drop pak in '), Field(fld2,true), Constant(' mode when receiving unknown dst mac has been '), Field(disposition,true), Constant(' on '), Field(zone,false), Constant('.')}" +match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ + setc("eventcategory","1001020100"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg87 = msg("00005:05", part146); + +var part147 = // "Pattern{Constant('flood timeout has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" +match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); + +var all29 = all_match({ + processors: [ + dup344, + part147, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg88 = msg("00005:06", all29); + +var part148 = // "Pattern{Constant('SYN flood '), Field(p0,false)}" +match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); + +var part149 = // "Pattern{Constant('alarm threshold '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); + +var part150 = // "Pattern{Constant('packet queue size '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); + +var part151 = // "Pattern{Constant('attack threshold '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); + +var part152 = // "Pattern{Constant('same source IP threshold '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); + +var select35 = linear_select([ + part149, + part150, + dup76, + part151, + part152, +]); + +var part153 = // "Pattern{Constant('is set to '), Field(trigger_val,false), Constant('.')}" +match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); + +var all30 = all_match({ + processors: [ + part148, + select35, + part153, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg89 = msg("00005:07", all30); + +var part154 = // "Pattern{Constant('flood same '), Field(p0,false)}" +match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); + +var select36 = linear_select([ + dup77, + dup78, +]); + +var part155 = // "Pattern{Constant('ip threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" +match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); + +var all31 = all_match({ + processors: [ + dup344, + part154, + select36, + part155, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg90 = msg("00005:08", all31); + +var part156 = // "Pattern{Constant('Screen service '), Field(service,true), Constant(' is '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg91 = msg("00005:09", part156); + +var part157 = // "Pattern{Constant('Screen service '), Field(service,true), Constant(' is '), Field(disposition,true), Constant(' on '), Field(zone,false)}" +match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg92 = msg("00005:10", part157); + +var part158 = // "Pattern{Constant('The SYN flood '), Field(p0,false)}" +match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); + +var part159 = // "Pattern{Constant('alarm threshold'), Field(,false)}" +match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); + +var part160 = // "Pattern{Constant('packet queue size'), Field(,false)}" +match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); + +var part161 = // "Pattern{Constant('timeout value'), Field(,false)}" +match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); + +var part162 = // "Pattern{Constant('attack threshold'), Field(,false)}" +match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); + +var part163 = // "Pattern{Constant('same source IP'), Field(,false)}" +match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); + +var select37 = linear_select([ + part159, + part160, + part161, + part162, + part163, +]); + +var all32 = all_match({ + processors: [ + part158, + select37, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg93 = msg("00005:11", all32); + +var part164 = // "Pattern{Constant('The SYN-ACK-ACK proxy threshold value has been set to '), Field(trigger_val,true), Constant(' on '), Field(interface,false), Constant('.')}" +match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg94 = msg("00005:12", part164); + +var part165 = // "Pattern{Constant('The session limit threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" +match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg95 = msg("00005:13", part165); + +var part166 = // "Pattern{Constant('syn proxy drop packet with unknown mac!'), Field(,false)}" +match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg96 = msg("00005:14", part166); + +var part167 = // "Pattern{Field(signame,true), Constant(' alarm threshold has been changed to '), Field(trigger_val,false)}" +match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg97 = msg("00005:15", part167); + +var part168 = // "Pattern{Field(signame,true), Constant(' threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" +match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg98 = msg("00005:16", part168); + +var part169 = // "Pattern{Constant('destination-based '), Field(p0,false)}" +match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); + +var part170 = // "Pattern{Constant('source-based '), Field(p0,false)}" +match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); + +var select38 = linear_select([ + part169, + part170, +]); + +var part171 = // "Pattern{Constant('session-limit threshold has been set at '), Field(trigger_val,true), Constant(' in zone '), Field(zone,false), Constant('.')}" +match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); + +var all33 = all_match({ + processors: [ + dup79, + select38, + part171, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg99 = msg("00005:17", all33); + +var all34 = all_match({ + processors: [ + dup80, + dup345, + dup83, + ], + on_success: processor_chain([ + dup84, + dup2, + dup59, + dup9, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg100 = msg("00005:18", all34); + +var part172 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup84, + dup2, + dup3, + dup4, + dup5, + dup59, + dup61, +])); + +var msg101 = msg("00005:19", part172); + +var part173 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' int '), Field(interface,false), Constant(').'), Field(space,true), Constant(' Occurred '), Field(fld2,true), Constant(' times. ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" +match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ + dup84, + dup9, + dup2, + dup3, + dup4, + dup5, +])); + +var msg102 = msg("00005:20", part173); + +var select39 = linear_select([ + msg82, + msg83, + msg84, + msg85, + msg86, + msg87, + msg88, + msg89, + msg90, + msg91, + msg92, + msg93, + msg94, + msg95, + msg96, + msg97, + msg98, + msg99, + msg100, + msg101, + msg102, +]); + +var part174 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup85, + dup2, + dup3, + dup4, + dup59, + dup5, + dup61, +])); + +var msg103 = msg("00006", part174); + +var part175 = // "Pattern{Constant('Hostname set to "'), Field(hostname,false), Constant('"')}" +match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg104 = msg("00006:01", part175); + +var part176 = // "Pattern{Constant('Domain set to '), Field(domain,false)}" +match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg105 = msg("00006:02", part176); + +var part177 = // "Pattern{Constant('An optional ScreenOS feature has been activated via a software key.'), Field(,false)}" +match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg106 = msg("00006:03", part177); + +var part178 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" +match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); + +var all35 = all_match({ + processors: [ + part178, + dup340, + dup67, + ], + on_success: processor_chain([ + dup84, + dup2, + dup59, + dup9, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg107 = msg("00006:04", all35); + +var all36 = all_match({ + processors: [ + dup64, + dup340, + dup67, + ], + on_success: processor_chain([ + dup84, + dup2, + dup59, + dup9, + dup3, + dup4, + dup5, + dup60, + ]), +}); + +var msg108 = msg("00006:05", all36); + +var select40 = linear_select([ + msg103, + msg104, + msg105, + msg106, + msg107, + msg108, +]); + +var part179 = // "Pattern{Constant('HA cluster ID has been changed to '), Field(fld2,false)}" +match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg109 = msg("00007", part179); + +var part180 = // "Pattern{Field(change_attribute,true), Constant(' of the local NetScreen device has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg110 = msg("00007:01", part180); + +var part181 = // "Pattern{Constant('HA state of the local device has changed to backup because a device with a '), Field(p0,false)}" +match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); + +var part182 = // "Pattern{Constant('higher priority has been detected'), Field(,false)}" +match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); + +var part183 = // "Pattern{Constant('lower MAC value has been detected'), Field(,false)}" +match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); + +var select41 = linear_select([ + part182, + part183, +]); + +var all37 = all_match({ + processors: [ + part181, + select41, + ], + on_success: processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg111 = msg("00007:02", all37); + +var part184 = // "Pattern{Constant('HA state of the local device has changed to init because IP tracking has failed'), Field(,false)}" +match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg112 = msg("00007:03", part184); + +var select42 = linear_select([ + dup88, + dup89, +]); + +var part185 = // "Pattern{Constant('has been changed'), Field(,false)}" +match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); + +var all38 = all_match({ + processors: [ + dup87, + select42, + dup23, + dup346, + part185, + ], + on_success: processor_chain([ + dup91, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg113 = msg("00007:04", all38); + +var part186 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because a master already exists'), Field(,false)}" +match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg114 = msg("00007:05", part186); + +var part187 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster'), Field(,false)}" +match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg115 = msg("00007:06", part187); + +var part188 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster'), Field(,false)}" +match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg116 = msg("00007:07", part188); + +var part189 = // "Pattern{Constant('HA: Local device has been elected master because no other master exists'), Field(,false)}" +match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg117 = msg("00007:08", part189); + +var part190 = // "Pattern{Constant('HA: Local device priority has been changed to '), Field(fld2,false)}" +match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg118 = msg("00007:09", part190); + +var part191 = // "Pattern{Constant('HA: Previous master has promoted the local NetScreen device to master'), Field(,false)}" +match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg119 = msg("00007:10", part191); + +var part192 = // "Pattern{Constant('IP tracking device failover threshold has been '), Field(p0,false)}" +match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); + +var select43 = linear_select([ + dup92, + dup93, +]); + +var all39 = all_match({ + processors: [ + part192, + select43, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg120 = msg("00007:11", all39); + +var part193 = // "Pattern{Constant('IP tracking has been '), Field(disposition,false)}" +match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg121 = msg("00007:12", part193); + +var part194 = // "Pattern{Constant('IP tracking to '), Field(hostip,true), Constant(' with interval '), Field(fld2,true), Constant(' threshold '), Field(trigger_val,true), Constant(' weight '), Field(fld4,true), Constant(' interface '), Field(interface,true), Constant(' method '), Field(fld5,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg122 = msg("00007:13", part194); + +var part195 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup85, + dup2, + dup3, + dup4, + dup59, + dup5, + dup60, +])); + +var msg123 = msg("00007:14", part195); + +var part196 = // "Pattern{Constant('Primary HA interface has been changed to '), Field(interface,false)}" +match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg124 = msg("00007:15", part196); + +var part197 = // "Pattern{Constant('Reporting of HA configuration and status changes to NetScreen-Global Manager has been '), Field(disposition,false)}" +match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg125 = msg("00007:16", part197); + +var part198 = // "Pattern{Constant('Tracked IP '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg126 = msg("00007:17", part198); + +var part199 = // "Pattern{Constant('Tracked IP '), Field(hostip,true), Constant(' options have been changed from int '), Field(fld2,true), Constant(' thr '), Field(fld3,true), Constant(' wgt '), Field(fld4,true), Constant(' inf '), Field(fld5,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); + +var part200 = // "Pattern{Constant('ping '), Field(p0,false)}" +match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); + +var part201 = // "Pattern{Constant('ARP '), Field(p0,false)}" +match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); + +var select44 = linear_select([ + part200, + part201, +]); + +var part202 = // "Pattern{Constant('to '), Field(fld6,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); + +var part203 = // "Pattern{Constant('ping'), Field(,false)}" +match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); + +var part204 = // "Pattern{Constant('ARP'), Field(,false)}" +match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); + +var select45 = linear_select([ + part203, + part204, +]); + +var all40 = all_match({ + processors: [ + part199, + select44, + part202, + select45, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg127 = msg("00007:18", all40); + +var part205 = // "Pattern{Constant('Change '), Field(change_attribute,true), Constant(' path from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" +match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg128 = msg("00007:20", part205); + +var part206 = // "Pattern{Constant('HA Slave is '), Field(p0,false)}" +match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); + +var all41 = all_match({ + processors: [ + part206, + dup347, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg129 = msg("00007:21", all41); + +var part207 = // "Pattern{Constant('HA change group id to '), Field(groupid,false)}" +match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg130 = msg("00007:22", part207); + +var part208 = // "Pattern{Constant('HA change priority to '), Field(fld2,false)}" +match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg131 = msg("00007:23", part208); + +var part209 = // "Pattern{Constant('HA change state to init'), Field(,false)}" +match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg132 = msg("00007:24", part209); + +var part210 = // "Pattern{Constant('HA: Change state to initial state.'), Field(,false)}" +match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg133 = msg("00007:25", part210); + +var part211 = // "Pattern{Constant('HA: Change state to slave for '), Field(p0,false)}" +match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); + +var part212 = // "Pattern{Constant('tracking ip failed'), Field(,false)}" +match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); + +var part213 = // "Pattern{Constant('linkdown'), Field(,false)}" +match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); + +var select46 = linear_select([ + part212, + part213, +]); + +var all42 = all_match({ + processors: [ + part211, + select46, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg134 = msg("00007:26", all42); + +var part214 = // "Pattern{Constant('HA: Change to master command issued from original master to change state'), Field(,false)}" +match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg135 = msg("00007:27", part214); + +var part215 = // "Pattern{Constant('HA: Elected master no other master'), Field(,false)}" +match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg136 = msg("00007:28", part215); + +var part216 = // "Pattern{Constant('HA: Elected slave '), Field(p0,false)}" +match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); + +var part217 = // "Pattern{Constant('lower priority'), Field(,false)}" +match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); + +var part218 = // "Pattern{Constant('MAC value is larger'), Field(,false)}" +match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); + +var part219 = // "Pattern{Constant('master already exists'), Field(,false)}" +match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); + +var part220 = // "Pattern{Constant('detect new master with higher priority'), Field(,false)}" +match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); + +var part221 = // "Pattern{Constant('detect new master with smaller MAC value'), Field(,false)}" +match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); + +var select47 = linear_select([ + part217, + part218, + part219, + part220, + part221, +]); + +var all43 = all_match({ + processors: [ + part216, + select47, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg137 = msg("00007:29", all43); + +var part222 = // "Pattern{Constant('HA: Promoted master command issued from original master to change state'), Field(,false)}" +match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg138 = msg("00007:30", part222); + +var part223 = // "Pattern{Constant('HA: ha link '), Field(p0,false)}" +match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); + +var all44 = all_match({ + processors: [ + part223, + dup347, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg139 = msg("00007:31", all44); + +var part224 = // "Pattern{Constant('NSRP '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); + +var select48 = linear_select([ + dup89, + dup88, +]); + +var part225 = // "Pattern{Constant('changed.'), Field(,false)}" +match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); + +var all45 = all_match({ + processors: [ + part224, + select48, + dup23, + dup346, + part225, + ], + on_success: processor_chain([ + dup91, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg140 = msg("00007:32", all45); + +var part226 = // "Pattern{Constant('NSRP: VSD '), Field(p0,false)}" +match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); + +var part227 = // "Pattern{Constant('Virtual Security Device group '), Field(p0,false)}" +match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); + +var select49 = linear_select([ + part226, + part227, +]); + +var part228 = // "Pattern{Constant(''), Field(fld2,true), Constant(' change'), Field(p0,false)}" +match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); + +var part229 = // "Pattern{Constant('d '), Field(p0,false)}" +match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); + +var select50 = linear_select([ + part229, + dup96, +]); + +var part230 = // "Pattern{Constant('to '), Field(fld3,true), Constant(' mode.')}" +match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); + +var all46 = all_match({ + processors: [ + select49, + part228, + select50, + part230, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg141 = msg("00007:33", all46); + +var part231 = // "Pattern{Constant('NSRP: message '), Field(fld2,true), Constant(' dropped: invalid encryption password.')}" +match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ + dup97, + dup2, + dup3, + dup4, + dup5, +])); + +var msg142 = msg("00007:34", part231); + +var part232 = // "Pattern{Constant('NSRP: nsrp interface change to '), Field(interface,false), Constant('.')}" +match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg143 = msg("00007:35", part232); + +var part233 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' local unit='), Field(fld3,true), Constant(' duplicate from unit='), Field(fld4,false)}" +match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg144 = msg("00007:36", part233); + +var part234 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' is '), Field(p0,false)}" +match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); + +var all47 = all_match({ + processors: [ + part234, + dup348, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg145 = msg("00007:37", all47); + +var part235 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' peer='), Field(fld3,true), Constant(' from '), Field(p0,false)}" +match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); + +var part236 = // "Pattern{Constant('state '), Field(p0,false)}" +match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); + +var part237 = // "Pattern{Constant('missed heartbeat'), Field(,false)}" +match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); + +var part238 = // "Pattern{Constant('group detached'), Field(,false)}" +match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); + +var select51 = linear_select([ + part237, + part238, +]); + +var all48 = all_match({ + processors: [ + part235, + dup349, + dup103, + dup349, + part236, + select51, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg146 = msg("00007:38", all48); + +var part239 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' is '), Field(p0,false)}" +match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); + +var all49 = all_match({ + processors: [ + part239, + dup348, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg147 = msg("00007:39", all49); + +var part240 = // "Pattern{Constant('Remove pathname '), Field(fld2,true), Constant(' (ifnum='), Field(fld3,false), Constant(') as secondary HA path')}" +match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg148 = msg("00007:40", part240); + +var part241 = // "Pattern{Constant('Session sync ended by unit='), Field(fld2,false)}" +match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg149 = msg("00007:41", part241); + +var part242 = // "Pattern{Constant('Set secondary HA path to '), Field(fld2,true), Constant(' (ifnum='), Field(fld3,false), Constant(')')}" +match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg150 = msg("00007:42", part242); + +var part243 = // "Pattern{Constant('VSD '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg151 = msg("00007:43", part243); + +var part244 = // "Pattern{Constant('vsd group id='), Field(groupid,true), Constant(' is '), Field(disposition,true), Constant(' total number='), Field(fld3,false)}" +match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg152 = msg("00007:44", part244); + +var part245 = // "Pattern{Constant('vsd group '), Field(group,true), Constant(' local unit '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg153 = msg("00007:45", part245); + +var part246 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup85, + dup2, + dup3, + dup4, + dup59, + dup5, + dup60, +])); + +var msg154 = msg("00007:46", part246); + +var part247 = // "Pattern{Constant('The HA channel changed to interface '), Field(interface,false)}" +match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg155 = msg("00007:47", part247); + +var part248 = // "Pattern{Constant('Message '), Field(fld2,true), Constant(' was dropped because it contained an invalid encryption password.')}" +match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ + dup97, + dup2, + dup3, + dup4, + setc("disposition","dropped"), + setc("result","Invalid encryption Password"), +])); + +var msg156 = msg("00007:48", part248); + +var part249 = // "Pattern{Constant('The '), Field(change_attribute,true), Constant(' of all Virtual Security Device groups changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ + setc("eventcategory","1604000000"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg157 = msg("00007:49", part249); + +var part250 = // "Pattern{Constant('Device '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); + +var part251 = // "Pattern{Constant('has joined '), Field(p0,false)}" +match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); + +var part252 = // "Pattern{Constant('quit current '), Field(p0,false)}" +match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); + +var select52 = linear_select([ + part251, + part252, +]); + +var part253 = // "Pattern{Constant('NSRP cluster '), Field(fld3,false)}" +match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); + +var all50 = all_match({ + processors: [ + part250, + select52, + part253, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg158 = msg("00007:50", all50); + +var part254 = // "Pattern{Constant('Virtual Security Device group '), Field(group,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); + +var part255 = // "Pattern{Constant('deleted '), Field(p0,false)}" +match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); + +var select53 = linear_select([ + dup104, + part255, +]); + +var select54 = linear_select([ + dup105, + dup73, +]); + +var part256 = // "Pattern{Constant('The total number of members in the group '), Field(p0,false)}" +match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); + +var select55 = linear_select([ + dup106, + dup107, +]); + +var all51 = all_match({ + processors: [ + part254, + select53, + dup23, + select54, + part256, + select55, + dup108, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg159 = msg("00007:51", all51); + +var part257 = // "Pattern{Constant('Virtual Security Device group '), Field(group,true), Constant(' '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg160 = msg("00007:52", part257); + +var part258 = // "Pattern{Constant('The secondary HA path of the devices was set to interface '), Field(interface,true), Constant(' with ifnum '), Field(fld2,false)}" +match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg161 = msg("00007:53", part258); + +var part259 = // "Pattern{Constant('The '), Field(change_attribute,true), Constant(' of the devices changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg162 = msg("00007:54", part259); + +var part260 = // "Pattern{Constant('The interface '), Field(interface,true), Constant(' with ifnum '), Field(fld2,true), Constant(' was removed from the secondary HA path of the devices.')}" +match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg163 = msg("00007:55", part260); + +var part261 = // "Pattern{Constant('The probe that detects the status of High Availability link '), Field(fld2,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg164 = msg("00007:56", part261); + +var select56 = linear_select([ + dup109, + dup110, +]); + +var select57 = linear_select([ + dup111, + dup112, +]); + +var part262 = // "Pattern{Constant('the probe detecting the status of High Availability link '), Field(fld2,true), Constant(' was set to '), Field(fld3,false)}" +match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); + +var all52 = all_match({ + processors: [ + dup55, + select56, + dup23, + select57, + part262, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg165 = msg("00007:57", all52); + +var part263 = // "Pattern{Constant('A request by device '), Field(fld2,true), Constant(' for session synchronization(s) was accepted.')}" +match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg166 = msg("00007:58", part263); + +var part264 = // "Pattern{Constant('The current session synchronization by device '), Field(fld2,true), Constant(' completed.')}" +match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg167 = msg("00007:59", part264); + +var part265 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' direction was set to '), Field(direction,false)}" +match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg168 = msg("00007:60", part265); + +var part266 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' was set.')}" +match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg169 = msg("00007:61", part266); + +var part267 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' was unset.')}" +match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg170 = msg("00007:62", part267); + +var part268 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' was unset.')}" +match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg171 = msg("00007:63", part268); + +var part269 = // "Pattern{Constant(''), Field(fld2,true), Constant(' was removed from the monitoring list '), Field(p0,false)}" +match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); + +var part270 = // "Pattern{Constant(''), Field(fld3,false)}" +match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); + +var all53 = all_match({ + processors: [ + dup350, + part269, + dup351, + part270, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg172 = msg("00007:64", all53); + +var part271 = // "Pattern{Constant(''), Field(fld2,true), Constant(' with weight '), Field(fld3,true), Constant(' was added'), Field(p0,false)}" +match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); + +var part272 = // "Pattern{Constant(' to or updated on '), Field(p0,false)}" +match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); + +var part273 = // "Pattern{Constant('/updated to '), Field(p0,false)}" +match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); + +var select58 = linear_select([ + part272, + part273, +]); + +var part274 = // "Pattern{Constant('the monitoring list '), Field(p0,false)}" +match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); + +var part275 = // "Pattern{Constant(''), Field(fld4,false)}" +match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); + +var all54 = all_match({ + processors: [ + dup350, + part271, + select58, + part274, + dup351, + part275, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg173 = msg("00007:65", all54); + +var part276 = // "Pattern{Constant('The monitoring '), Field(p0,false)}" +match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); + +var part277 = // "Pattern{Constant('Monitoring '), Field(p0,false)}" +match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); + +var select59 = linear_select([ + part276, + part277, +]); + +var part278 = // "Pattern{Constant('threshold was modified to '), Field(trigger_val,true), Constant(' o'), Field(p0,false)}" +match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); + +var part279 = // "Pattern{Constant('f '), Field(p0,false)}" +match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); + +var select60 = linear_select([ + part279, + dup115, +]); + +var all55 = all_match({ + processors: [ + select59, + part278, + select60, + dup108, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg174 = msg("00007:66", all55); + +var part280 = // "Pattern{Constant('NSRP data forwarding '), Field(disposition,false), Constant('.')}" +match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg175 = msg("00007:67", part280); + +var part281 = // "Pattern{Constant('NSRP b'), Field(p0,false)}" +match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); + +var part282 = // "Pattern{Constant('lack '), Field(p0,false)}" +match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); + +var part283 = // "Pattern{Constant('ack '), Field(p0,false)}" +match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); + +var select61 = linear_select([ + part282, + part283, +]); + +var part284 = // "Pattern{Constant('hole prevention '), Field(disposition,false), Constant('. Master(s) of Virtual Security Device groups '), Field(p0,false)}" +match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); + +var part285 = // "Pattern{Constant('may not exist '), Field(p0,false)}" +match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); + +var part286 = // "Pattern{Constant('always exists '), Field(p0,false)}" +match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); + +var select62 = linear_select([ + part285, + part286, +]); + +var all56 = all_match({ + processors: [ + part281, + select61, + part284, + select62, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg176 = msg("00007:68", all56); + +var part287 = // "Pattern{Constant('NSRP Run Time Object synchronization between devices was '), Field(disposition,false)}" +match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg177 = msg("00007:69", part287); + +var part288 = // "Pattern{Constant('The NSRP encryption key was changed.'), Field(,false)}" +match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg178 = msg("00007:70", part288); + +var part289 = // "Pattern{Constant('NSRP transparent Active-Active mode was '), Field(disposition,false), Constant('.')}" +match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg179 = msg("00007:71", part289); + +var part290 = // "Pattern{Constant('NSRP: nsrp link probe enable on '), Field(interface,false)}" +match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg180 = msg("00007:72", part290); + +var select63 = linear_select([ + msg109, + msg110, + msg111, + msg112, + msg113, + msg114, + msg115, + msg116, + msg117, + msg118, + msg119, + msg120, + msg121, + msg122, + msg123, + msg124, + msg125, + msg126, + msg127, + msg128, + msg129, + msg130, + msg131, + msg132, + msg133, + msg134, + msg135, + msg136, + msg137, + msg138, + msg139, + msg140, + msg141, + msg142, + msg143, + msg144, + msg145, + msg146, + msg147, + msg148, + msg149, + msg150, + msg151, + msg152, + msg153, + msg154, + msg155, + msg156, + msg157, + msg158, + msg159, + msg160, + msg161, + msg162, + msg163, + msg164, + msg165, + msg166, + msg167, + msg168, + msg169, + msg170, + msg171, + msg172, + msg173, + msg174, + msg175, + msg176, + msg177, + msg178, + msg179, + msg180, +]); + +var part291 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup59, + dup5, + dup61, +])); + +var msg181 = msg("00008", part291); + +var msg182 = msg("00008:01", dup343); + +var part292 = // "Pattern{Constant('NTP settings have been changed'), Field(,false)}" +match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg183 = msg("00008:02", part292); + +var part293 = // "Pattern{Constant('The system clock has been updated through NTP'), Field(,false)}" +match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg184 = msg("00008:03", part293); + +var part294 = // "Pattern{Constant('System clock '), Field(p0,false)}" +match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); + +var part295 = // "Pattern{Constant('configurations have been'), Field(p0,false)}" +match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); + +var part296 = // "Pattern{Constant('was'), Field(p0,false)}" +match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); + +var part297 = // "Pattern{Constant('is'), Field(p0,false)}" +match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); + +var select64 = linear_select([ + part295, + part296, + part297, +]); + +var part298 = // "Pattern{Field(,false), Constant('changed'), Field(p0,false)}" +match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); + +var part299 = // "Pattern{Constant(' by admin '), Field(administrator,false)}" +match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); + +var part300 = // "Pattern{Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); + +var part301 = // "Pattern{Constant(' by '), Field(username,false)}" +match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); + +var part302 = // "Pattern{Constant(' manually.'), Field(,false)}" +match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); + +var part303 = // "Pattern{Constant(' manually'), Field(,false)}" +match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); + +var select65 = linear_select([ + part299, + part300, + part301, + part302, + part303, + dup21, +]); + +var all57 = all_match({ + processors: [ + part294, + select64, + part298, + select65, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + dup9, + ]), +}); + +var msg185 = msg("00008:04", all57); + +var part304 = // "Pattern{Constant('failed to get clock through NTP'), Field(,false)}" +match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg186 = msg("00008:05", part304); + +var part305 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup59, + dup61, +])); + +var msg187 = msg("00008:06", part305); + +var part306 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup59, + dup60, +])); + +var msg188 = msg("00008:07", part306); + +var part307 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup59, + dup60, +])); + +var msg189 = msg("00008:08", part307); + +var part308 = // "Pattern{Constant('system clock is changed manually'), Field(,false)}" +match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg190 = msg("00008:09", part308); + +var part309 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,false), Constant('(zone '), Field(p0,false)}" +match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); + +var all58 = all_match({ + processors: [ + part309, + dup340, + dup67, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, + dup60, + ]), +}); + +var msg191 = msg("00008:10", all58); + +var select66 = linear_select([ + msg181, + msg182, + msg183, + msg184, + msg185, + msg186, + msg187, + msg188, + msg189, + msg190, + msg191, +]); + +var part310 = // "Pattern{Constant('802.1Q VLAN trunking for the interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg192 = msg("00009", part310); + +var part311 = // "Pattern{Constant('802.1Q VLAN tag '), Field(fld1,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg193 = msg("00009:01", part311); + +var part312 = // "Pattern{Constant('DHCP on the interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg194 = msg("00009:02", part312); + +var part313 = // "Pattern{Field(change_attribute,true), Constant(' for interface '), Field(interface,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg195 = msg("00009:03", part313); + +var part314 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg196 = msg("00009:05", part314); + +var part315 = // "Pattern{Field(fld2,false), Constant(': The 802.1Q tag '), Field(p0,false)}" +match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); + +var part316 = // "Pattern{Constant('The 802.1Q tag '), Field(p0,false)}" +match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); + +var select67 = linear_select([ + part315, + part316, +]); + +var select68 = linear_select([ + dup119, + dup16, +]); + +var part317 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); + +var part318 = // "Pattern{Constant('changed to '), Field(p0,false)}" +match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); + +var select69 = linear_select([ + dup120, + part318, +]); + +var part319 = // "Pattern{Field(info,true), Constant(' from host '), Field(saddr,false)}" +match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); + +var part320 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); + +var select70 = linear_select([ + part319, + part320, +]); + +var all59 = all_match({ + processors: [ + select67, + dup118, + select68, + part317, + select69, + dup23, + select70, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg197 = msg("00009:06", all59); + +var part321 = // "Pattern{Constant('Maximum bandwidth '), Field(fld2,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); + +var part322 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is less than t'), Field(p0,false)}" +match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); + +var part323 = // "Pattern{Constant('he total '), Field(p0,false)}" +match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); + +var part324 = // "Pattern{Constant('otal '), Field(p0,false)}" +match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); + +var select71 = linear_select([ + part323, + part324, +]); + +var part325 = // "Pattern{Constant('guaranteed bandwidth '), Field(fld3,false)}" +match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); + +var all60 = all_match({ + processors: [ + part321, + dup339, + part322, + select71, + part325, + ], + on_success: processor_chain([ + dup121, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg198 = msg("00009:07", all60); + +var part326 = // "Pattern{Constant('The configured bandwidth setting on the interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,false)}" +match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg199 = msg("00009:09", part326); + +var part327 = // "Pattern{Constant('The operational mode for the interface '), Field(interface,true), Constant(' has been changed to '), Field(p0,false)}" +match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); + +var part328 = // "Pattern{Constant('Route'), Field(,false)}" +match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); + +var part329 = // "Pattern{Constant('NAT'), Field(,false)}" +match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); + +var select72 = linear_select([ + part328, + part329, +]); + +var all61 = all_match({ + processors: [ + part327, + select72, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg200 = msg("00009:10", all61); + +var part330 = // "Pattern{Field(fld1,false), Constant(': VLAN '), Field(p0,false)}" +match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); + +var part331 = // "Pattern{Constant('VLAN '), Field(p0,false)}" +match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); + +var select73 = linear_select([ + part330, + part331, +]); + +var part332 = // "Pattern{Constant('tag '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); + +var all62 = all_match({ + processors: [ + select73, + part332, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg201 = msg("00009:11", all62); + +var part333 = // "Pattern{Constant('DHCP client has been '), Field(disposition,true), Constant(' on interface '), Field(interface,false)}" +match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg202 = msg("00009:12", part333); + +var part334 = // "Pattern{Constant('DHCP relay agent settings on '), Field(interface,true), Constant(' have been '), Field(disposition,false)}" +match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg203 = msg("00009:13", part334); + +var part335 = // "Pattern{Constant('Global-PRO has been '), Field(p0,false)}" +match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); + +var part336 = // "Pattern{Constant('Global PRO has been '), Field(p0,false)}" +match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); + +var part337 = // "Pattern{Constant('DNS proxy was '), Field(p0,false)}" +match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); + +var select74 = linear_select([ + part335, + part336, + part337, +]); + +var part338 = // "Pattern{Constant(''), Field(disposition,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); + +var select75 = linear_select([ + dup122, + dup123, +]); + +var part339 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); + +var select76 = linear_select([ + part339, + dup124, +]); + +var all63 = all_match({ + processors: [ + select74, + part338, + select75, + dup23, + select76, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg204 = msg("00009:14", all63); + +var part340 = // "Pattern{Constant('Route between secondary IP'), Field(p0,false)}" +match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); + +var part341 = // "Pattern{Constant(' addresses '), Field(p0,false)}" +match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); + +var select77 = linear_select([ + part341, + dup125, +]); + +var all64 = all_match({ + processors: [ + part340, + select77, + dup126, + dup352, + dup128, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg205 = msg("00009:15", all64); + +var part342 = // "Pattern{Constant('Secondary IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); + +var part343 = // "Pattern{Constant('deleted from '), Field(p0,false)}" +match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); + +var select78 = linear_select([ + dup129, + dup130, + part343, +]); + +var part344 = // "Pattern{Constant('interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); + +var all65 = all_match({ + processors: [ + part342, + dup352, + dup23, + select78, + part344, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg206 = msg("00009:16", all65); + +var part345 = // "Pattern{Constant('Secondary IP address '), Field(p0,false)}" +match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); + +var part346 = // "Pattern{Field(hostip,false), Constant('/'), Field(mask,true), Constant(' was added to interface '), Field(p0,false)}" +match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); + +var part347 = // "Pattern{Field(hostip,true), Constant(' was added to interface '), Field(p0,false)}" +match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); + +var select79 = linear_select([ + part346, + part347, +]); + +var part348 = // "Pattern{Field(interface,false), Constant('.')}" +match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); + +var all66 = all_match({ + processors: [ + part345, + select79, + part348, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg207 = msg("00009:17", all66); + +var part349 = // "Pattern{Constant('The configured bandwidth on the interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,false)}" +match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg208 = msg("00009:18", part349); + +var part350 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg209 = msg("00009:19", part350); + +var part351 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg210 = msg("00009:27", part351); + +var part352 = // "Pattern{Field(fld2,false), Constant(': '), Field(service,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); + +var part353 = // "Pattern{Field(service,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); + +var select80 = linear_select([ + part352, + part353, +]); + +var part354 = // "Pattern{Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); + +var part355 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false)}" +match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); + +var part356 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); + +var part357 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false)}" +match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); + +var part358 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); + +var select81 = linear_select([ + part355, + part356, + part357, + part358, +]); + +var all67 = all_match({ + processors: [ + select80, + part354, + select81, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg211 = msg("00009:20", all67); + +var part359 = // "Pattern{Constant('Source Route IP option! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var all68 = all_match({ + processors: [ + part359, + dup345, + dup131, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, + dup60, + ]), +}); + +var msg212 = msg("00009:21", all68); + +var part360 = // "Pattern{Constant('MTU for interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg213 = msg("00009:22", part360); + +var part361 = // "Pattern{Constant('Secondary IP address '), Field(hostip,true), Constant(' has been added to interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup9, + dup3, + dup4, + dup5, +])); + +var msg214 = msg("00009:23", part361); + +var part362 = // "Pattern{Constant('Web has been enabled on interface '), Field(interface,true), Constant(' by admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); + +var part363 = // "Pattern{Field(logon_type,true), Constant(' '), Field(space,false), Constant('('), Field(p0,false)}" +match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); + +var part364 = // "Pattern{Field(logon_type,false), Constant('. ('), Field(p0,false)}" +match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); + +var select82 = linear_select([ + part363, + part364, +]); + +var part365 = // "Pattern{Constant(')'), Field(fld1,false)}" +match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); + +var all69 = all_match({ + processors: [ + part362, + select82, + part365, + ], + on_success: processor_chain([ + dup1, + dup2, + dup9, + dup3, + dup4, + dup5, + ]), +}); + +var msg215 = msg("00009:24", all69); + +var part366 = // "Pattern{Constant('Web has been enabled on interface '), Field(interface,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup9, + dup3, + dup4, + dup5, +])); + +var msg216 = msg("00009:25", part366); + +var part367 = // "Pattern{Field(protocol,true), Constant(' has been '), Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' by '), Field(username,true), Constant(' via NSRP Peer . '), Field(p0,false)}" +match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); + +var all70 = all_match({ + processors: [ + part367, + dup335, + ], + on_success: processor_chain([ + dup1, + dup2, + dup9, + dup3, + dup4, + dup5, + ]), +}); + +var msg217 = msg("00009:26", all70); + +var select83 = linear_select([ + msg192, + msg193, + msg194, + msg195, + msg196, + msg197, + msg198, + msg199, + msg200, + msg201, + msg202, + msg203, + msg204, + msg205, + msg206, + msg207, + msg208, + msg209, + msg210, + msg211, + msg212, + msg213, + msg214, + msg215, + msg216, + msg217, +]); + +var part368 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); + +var part369 = // "Pattern{Constant('using protocol '), Field(p0,false)}" +match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); + +var part370 = // "Pattern{Constant('proto '), Field(p0,false)}" +match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); + +var select84 = linear_select([ + part369, + part370, +]); + +var part371 = // "Pattern{Constant(''), Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); + +var part372 = // "Pattern{Constant('( zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); + +var part373 = // "Pattern{Constant('zone '), Field(zone,true), Constant(' int '), Field(interface,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); + +var select85 = linear_select([ + part372, + part373, + dup126, +]); + +var part374 = // "Pattern{Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times'), Field(p0,false)}" +match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); + +var all71 = all_match({ + processors: [ + part368, + select84, + part371, + select85, + part374, + dup353, + ], + on_success: processor_chain([ + dup58, + dup2, + dup4, + dup59, + dup5, + dup9, + dup3, + dup61, + ]), +}); + +var msg218 = msg("00010", all71); + +var part375 = // "Pattern{Constant('MIP '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg219 = msg("00010:01", part375); + +var part376 = // "Pattern{Constant('Mapped IP '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg220 = msg("00010:02", part376); + +var all72 = all_match({ + processors: [ + dup132, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup9, + dup3, + dup60, + ]), +}); + +var msg221 = msg("00010:03", all72); + +var select86 = linear_select([ + msg218, + msg219, + msg220, + msg221, +]); + +var part377 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg222 = msg("00011", part377); + +var part378 = // "Pattern{Constant('Route to '), Field(daddr,false), Constant('/'), Field(fld2,true), Constant(' [ '), Field(p0,false)}" +match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); + +var select87 = linear_select([ + dup57, + dup56, +]); + +var part379 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' gateway '), Field(fld3,true), Constant(' ] has been '), Field(disposition,false)}" +match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); + +var all73 = all_match({ + processors: [ + part378, + select87, + part379, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg223 = msg("00011:01", all73); + +var part380 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, +])); + +var msg224 = msg("00011:02", part380); + +var part381 = // "Pattern{Constant('An '), Field(p0,false)}" +match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); + +var part382 = // "Pattern{Constant('import '), Field(p0,false)}" +match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); + +var part383 = // "Pattern{Constant('export '), Field(p0,false)}" +match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); + +var select88 = linear_select([ + part382, + part383, +]); + +var part384 = // "Pattern{Constant('rule in virtual router '), Field(node,true), Constant(' to virtual router '), Field(fld4,true), Constant(' with '), Field(p0,false)}" +match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); + +var part385 = // "Pattern{Constant('route-map '), Field(fld3,true), Constant(' and protocol '), Field(protocol,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); + +var part386 = // "Pattern{Constant('IP-prefix '), Field(hostip,false), Constant('/'), Field(interface,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); + +var select89 = linear_select([ + part385, + part386, +]); + +var all74 = all_match({ + processors: [ + part381, + select88, + part384, + select89, + dup36, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg225 = msg("00011:03", all74); + +var part387 = // "Pattern{Constant('A route in virtual router '), Field(node,true), Constant(' that has IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' through '), Field(p0,false)}" +match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); + +var part388 = // "Pattern{Constant(''), Field(interface,true), Constant(' and gateway '), Field(fld3,true), Constant(' with metric '), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); + +var all75 = all_match({ + processors: [ + part387, + dup354, + part388, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg226 = msg("00011:04", all75); + +var part389 = // "Pattern{Constant('sharable virtual router using name'), Field(p0,false)}" +match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); + +var part390 = // "Pattern{Constant('virtual router with name'), Field(p0,false)}" +match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); + +var select90 = linear_select([ + part389, + part390, +]); + +var part391 = // "Pattern{Field(,true), Constant(' '), Field(node,true), Constant(' and id '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); + +var all76 = all_match({ + processors: [ + dup79, + select90, + part391, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg227 = msg("00011:05", all76); + +var part392 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup59, + dup3, + dup60, +])); + +var msg228 = msg("00011:07", part392); + +var part393 = // "Pattern{Constant('Route(s) in virtual router '), Field(node,true), Constant(' with an IP address '), Field(hostip,true), Constant(' and gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg229 = msg("00011:08", part393); + +var part394 = // "Pattern{Constant('The auto-route-export feature in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg230 = msg("00011:09", part394); + +var part395 = // "Pattern{Constant('The maximum number of routes that can be created in virtual router '), Field(node,true), Constant(' is '), Field(fld2,false)}" +match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg231 = msg("00011:10", part395); + +var part396 = // "Pattern{Constant('The maximum routes limit in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg232 = msg("00011:11", part396); + +var part397 = // "Pattern{Constant('The router-id of virtual router '), Field(node,true), Constant(' used by OSPF BGP routing instances id has been uninitialized')}" +match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg233 = msg("00011:12", part397); + +var part398 = // "Pattern{Constant('The router-id that can be used by OSPF BGP routing instances in virtual router '), Field(node,true), Constant(' has been set to '), Field(fld2,false)}" +match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg234 = msg("00011:13", part398); + +var part399 = // "Pattern{Constant('The routing preference for protocol '), Field(protocol,true), Constant(' in virtual router '), Field(node,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); + +var part400 = // "Pattern{Constant('reset'), Field(,false)}" +match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); + +var select91 = linear_select([ + dup134, + part400, +]); + +var all77 = all_match({ + processors: [ + part399, + select91, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg235 = msg("00011:14", all77); + +var part401 = // "Pattern{Constant('The system default-route in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg236 = msg("00011:15", part401); + +var part402 = // "Pattern{Constant('The system default-route through virtual router '), Field(node,true), Constant(' has been added in virtual router '), Field(fld2,false)}" +match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg237 = msg("00011:16", part402); + +var part403 = // "Pattern{Constant('The virtual router '), Field(node,true), Constant(' has been made '), Field(p0,false)}" +match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); + +var part404 = // "Pattern{Constant('sharable'), Field(,false)}" +match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); + +var part405 = // "Pattern{Constant('unsharable'), Field(,false)}" +match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); + +var part406 = // "Pattern{Constant('default virtual router for virtual system '), Field(fld2,false)}" +match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); + +var select92 = linear_select([ + part404, + part405, + part406, +]); + +var all78 = all_match({ + processors: [ + part403, + select92, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg238 = msg("00011:17", all78); + +var part407 = // "Pattern{Constant('Source route(s) '), Field(p0,false)}" +match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); + +var part408 = // "Pattern{Constant('A source route '), Field(p0,false)}" +match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); + +var select93 = linear_select([ + part407, + part408, +]); + +var part409 = // "Pattern{Constant('in virtual router '), Field(node,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); + +var part410 = // "Pattern{Constant('with route addresses of '), Field(p0,false)}" +match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); + +var part411 = // "Pattern{Constant('that has IP address '), Field(p0,false)}" +match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); + +var select94 = linear_select([ + part410, + part411, +]); + +var part412 = // "Pattern{Constant(''), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' through interface '), Field(interface,true), Constant(' and '), Field(p0,false)}" +match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); + +var part413 = // "Pattern{Constant('a default gateway address '), Field(p0,false)}" +match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); + +var select95 = linear_select([ + part413, + dup135, +]); + +var part414 = // "Pattern{Constant(''), Field(fld3,true), Constant(' with metric '), Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); + +var all79 = all_match({ + processors: [ + select93, + part409, + select94, + part412, + select95, + part414, + dup352, + dup128, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg239 = msg("00011:18", all79); + +var part415 = // "Pattern{Constant('Source Route(s) in virtual router '), Field(node,true), Constant(' with '), Field(p0,false)}" +match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); + +var part416 = // "Pattern{Constant('route addresses of '), Field(p0,false)}" +match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); + +var part417 = // "Pattern{Constant('an IP address '), Field(p0,false)}" +match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); + +var select96 = linear_select([ + part416, + part417, +]); + +var part418 = // "Pattern{Constant(''), Field(hostip,false), Constant('/'), Field(fld3,true), Constant(' and '), Field(p0,false)}" +match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); + +var part419 = // "Pattern{Constant('a default gateway address of '), Field(p0,false)}" +match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); + +var select97 = linear_select([ + part419, + dup135, +]); + +var part420 = // "Pattern{Constant(''), Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); + +var part421 = // "Pattern{Constant('has been'), Field(p0,false)}" +match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); + +var select98 = linear_select([ + dup107, + part421, +]); + +var all80 = all_match({ + processors: [ + part415, + select96, + part418, + select97, + part420, + select98, + dup136, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg240 = msg("00011:19", all80); + +var part422 = // "Pattern{Field(fld2,false), Constant(': A '), Field(p0,false)}" +match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); + +var select99 = linear_select([ + part422, + dup79, +]); + +var part423 = // "Pattern{Constant('route has been created in virtual router "'), Field(node,false), Constant('"'), Field(space,false), Constant('with an IP address '), Field(hostip,true), Constant(' and next-hop as virtual router "'), Field(fld3,false), Constant('"')}" +match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); + +var all81 = all_match({ + processors: [ + select99, + part423, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg241 = msg("00011:20", all81); + +var part424 = // "Pattern{Constant('SIBR route(s) in virtual router '), Field(node,true), Constant(' for interface '), Field(interface,true), Constant(' with an IP address '), Field(hostip,true), Constant(' and gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg242 = msg("00011:21", part424); + +var part425 = // "Pattern{Constant('SIBR route in virtual router '), Field(node,true), Constant(' for interface '), Field(interface,true), Constant(' that has IP address '), Field(hostip,true), Constant(' through interface '), Field(fld3,true), Constant(' and gateway '), Field(fld4,true), Constant(' with metric '), Field(fld5,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg243 = msg("00011:22", part425); + +var all82 = all_match({ + processors: [ + dup132, + dup345, + dup131, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup9, + dup3, + dup4, + dup5, + call({ + dest: "nwparser.inout", + fn: DIRCHK, + args: [ + field("$IN"), + field("saddr"), + field("daddr"), + ], + }), + ]), +}); + +var msg244 = msg("00011:23", all82); + +var part426 = // "Pattern{Constant('Route in virtual router "'), Field(node,false), Constant('" that has IP address '), Field(hostip,true), Constant(' through interface '), Field(interface,true), Constant(' and gateway '), Field(fld2,true), Constant(' with metric '), Field(fld3,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg245 = msg("00011:24", part426); + +var part427 = // "Pattern{Constant('Route(s) in virtual router "'), Field(node,false), Constant('" with an IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' and gateway '), Field(fld3,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg246 = msg("00011:25", part427); + +var part428 = // "Pattern{Constant('Route in virtual router "'), Field(node,false), Constant('" with IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' and next-hop as virtual router "'), Field(fld3,false), Constant('" created. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg247 = msg("00011:26", part428); + +var select100 = linear_select([ + msg222, + msg223, + msg224, + msg225, + msg226, + msg227, + msg228, + msg229, + msg230, + msg231, + msg232, + msg233, + msg234, + msg235, + msg236, + msg237, + msg238, + msg239, + msg240, + msg241, + msg242, + msg243, + msg244, + msg245, + msg246, + msg247, +]); + +var part429 = // "Pattern{Constant('Service group '), Field(group,true), Constant(' comments have been '), Field(disposition,false)}" +match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg248 = msg("00012:02", part429); + +var part430 = // "Pattern{Constant('Service group '), Field(change_old,true), Constant(' '), Field(change_attribute,true), Constant(' has been changed to '), Field(change_new,false)}" +match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg249 = msg("00012:03", part430); + +var part431 = // "Pattern{Field(fld2,true), Constant(' Service group '), Field(group,true), Constant(' has '), Field(disposition,true), Constant(' member '), Field(username,true), Constant(' from host '), Field(saddr,false)}" +match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg250 = msg("00012:04", part431); + +var part432 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(') ('), Field(fld3,false), Constant(')')}" +match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup61, +])); + +var msg251 = msg("00012:05", part432); + +var part433 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup59, + dup61, +])); + +var msg252 = msg("00012:06", part433); + +var part434 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup61, + dup59, +])); + +var msg253 = msg("00012:07", part434); + +var part435 = // "Pattern{Field(fld2,false), Constant(': Service '), Field(service,true), Constant(' has been '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg254 = msg("00012:08", part435); + +var all83 = all_match({ + processors: [ + dup80, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup9, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg255 = msg("00012:09", all83); + +var all84 = all_match({ + processors: [ + dup132, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup9, + dup59, + dup3, + dup4, + dup5, + dup60, + ]), +}); + +var msg256 = msg("00012:10", all84); + +var part436 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup59, + dup5, + dup9, + dup61, +])); + +var msg257 = msg("00012:11", part436); + +var part437 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(zone,false), Constant(') '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg258 = msg("00012:12", part437); + +var part438 = // "Pattern{Constant('Service group '), Field(group,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg259 = msg("00012", part438); + +var part439 = // "Pattern{Constant('Service '), Field(service,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg260 = msg("00012:01", part439); + +var select101 = linear_select([ + msg248, + msg249, + msg250, + msg251, + msg252, + msg253, + msg254, + msg255, + msg256, + msg257, + msg258, + msg259, + msg260, +]); + +var part440 = // "Pattern{Constant('Global Manager error in decoding bytes has been detected'), Field(,false)}" +match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg261 = msg("00013", part440); + +var part441 = // "Pattern{Constant('Intruder has attempted to connect to the NetScreen-Global Manager port! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, + setc("signame","An Attempt to connect to NetScreen-Global Manager Port."), +])); + +var msg262 = msg("00013:01", part441); + +var part442 = // "Pattern{Constant('URL Filtering '), Field(fld2,true), Constant(' has been changed to '), Field(fld3,false)}" +match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg263 = msg("00013:02", part442); + +var part443 = // "Pattern{Constant('Web Filtering has been '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup4, + dup5, + dup9, +])); + +var msg264 = msg("00013:03", part443); + +var select102 = linear_select([ + msg261, + msg262, + msg263, + msg264, +]); + +var part444 = // "Pattern{Field(change_attribute,true), Constant(' in minutes has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg265 = msg("00014", part444); + +var part445 = // "Pattern{Constant('The group member '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); + +var part446 = // "Pattern{Constant('to a group'), Field(,false)}" +match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); + +var part447 = // "Pattern{Constant('from a group'), Field(,false)}" +match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); + +var select103 = linear_select([ + part446, + part447, +]); + +var all85 = all_match({ + processors: [ + part445, + select103, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg266 = msg("00014:01", all85); + +var part448 = // "Pattern{Constant('The user group '), Field(group,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,false)}" +match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg267 = msg("00014:02", part448); + +var part449 = // "Pattern{Constant('The user '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(administrator,false)}" +match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg268 = msg("00014:03", part449); + +var part450 = // "Pattern{Constant('Communication error with '), Field(hostname,true), Constant(' server { '), Field(hostip,true), Constant(' }: SrvErr ('), Field(fld2,false), Constant('), SockErr ('), Field(fld3,false), Constant('), Valid ('), Field(fld4,false), Constant('),Connected ('), Field(fld5,false), Constant(')')}" +match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg269 = msg("00014:04", part450); + +var part451 = // "Pattern{Constant('System clock configurations have been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false)}" +match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg270 = msg("00014:05", part451); + +var part452 = // "Pattern{Constant('System clock is '), Field(disposition,true), Constant(' manually.')}" +match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg271 = msg("00014:06", part452); + +var part453 = // "Pattern{Constant('System up time is '), Field(disposition,true), Constant(' by '), Field(fld2,false)}" +match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg272 = msg("00014:07", part453); + +var part454 = // "Pattern{Constant('Communication error with '), Field(hostname,true), Constant(' server['), Field(hostip,false), Constant(']: SrvErr('), Field(fld2,false), Constant('),SockErr('), Field(fld3,false), Constant('),Valid('), Field(fld4,false), Constant('),Connected('), Field(fld5,false), Constant(') ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ + dup27, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg273 = msg("00014:08", part454); + +var select104 = linear_select([ + msg265, + msg266, + msg267, + msg268, + msg269, + msg270, + msg271, + msg272, + msg273, +]); + +var part455 = // "Pattern{Constant('Authentication type has been changed to '), Field(authmethod,false)}" +match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg274 = msg("00015", part455); + +var part456 = // "Pattern{Constant('IP tracking to '), Field(daddr,true), Constant(' has '), Field(disposition,false)}" +match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg275 = msg("00015:01", part456); + +var part457 = // "Pattern{Constant('LDAP '), Field(p0,false)}" +match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); + +var part458 = // "Pattern{Constant('server name '), Field(p0,false)}" +match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); + +var part459 = // "Pattern{Constant('distinguished name '), Field(p0,false)}" +match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); + +var part460 = // "Pattern{Constant('common name '), Field(p0,false)}" +match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); + +var select105 = linear_select([ + part458, + dup137, + part459, + part460, +]); + +var all86 = all_match({ + processors: [ + part457, + select105, + dup138, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg276 = msg("00015:02", all86); + +var part461 = // "Pattern{Constant('Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link'), Field(,false)}" +match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg277 = msg("00015:03", part461); + +var part462 = // "Pattern{Constant('RADIUS server '), Field(p0,false)}" +match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); + +var part463 = // "Pattern{Constant('secret '), Field(p0,false)}" +match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); + +var select106 = linear_select([ + dup139, + dup140, + part463, +]); + +var all87 = all_match({ + processors: [ + part462, + select106, + dup138, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg278 = msg("00015:04", all87); + +var part464 = // "Pattern{Constant('SecurID '), Field(p0,false)}" +match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); + +var part465 = // "Pattern{Constant('authentication port '), Field(p0,false)}" +match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); + +var part466 = // "Pattern{Constant('duress mode '), Field(p0,false)}" +match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); + +var part467 = // "Pattern{Constant('number of retries value '), Field(p0,false)}" +match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); + +var select107 = linear_select([ + part465, + part466, + dup76, + part467, +]); + +var all88 = all_match({ + processors: [ + part464, + select107, + dup138, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg279 = msg("00015:05", all88); + +var part468 = // "Pattern{Constant('Master '), Field(p0,false)}" +match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); + +var part469 = // "Pattern{Constant('Backup '), Field(p0,false)}" +match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); + +var select108 = linear_select([ + part468, + part469, +]); + +var part470 = // "Pattern{Constant('SecurID server IP address has been '), Field(disposition,false)}" +match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); + +var all89 = all_match({ + processors: [ + select108, + part470, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg280 = msg("00015:06", all89); + +var part471 = // "Pattern{Constant('HA change from slave to master'), Field(,false)}" +match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg281 = msg("00015:07", part471); + +var part472 = // "Pattern{Constant('inconsistent configuration between master and slave'), Field(,false)}" +match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ + dup141, + dup2, + dup3, + dup4, + dup5, +])); + +var msg282 = msg("00015:08", part472); + +var part473 = // "Pattern{Constant('configuration '), Field(p0,false)}" +match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); + +var part474 = // "Pattern{Constant('Configuration '), Field(p0,false)}" +match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); + +var select109 = linear_select([ + part473, + part474, +]); + +var part475 = // "Pattern{Constant('out of sync between local unit and remote unit'), Field(,false)}" +match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); + +var all90 = all_match({ + processors: [ + select109, + part475, + ], + on_success: processor_chain([ + dup141, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg283 = msg("00015:09", all90); + +var part476 = // "Pattern{Constant('HA control channel change to '), Field(interface,false)}" +match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg284 = msg("00015:10", part476); + +var part477 = // "Pattern{Constant('HA data channel change to '), Field(interface,false)}" +match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg285 = msg("00015:11", part477); + +var part478 = // "Pattern{Constant('control '), Field(p0,false)}" +match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); + +var part479 = // "Pattern{Constant('data '), Field(p0,false)}" +match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); + +var select110 = linear_select([ + part478, + part479, +]); + +var part480 = // "Pattern{Constant('channel moved from link '), Field(p0,false)}" +match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); + +var part481 = // "Pattern{Constant('('), Field(interface,false), Constant(')')}" +match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); + +var all91 = all_match({ + processors: [ + dup87, + select110, + part480, + dup355, + dup103, + dup355, + part481, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg286 = msg("00015:12", all91); + +var part482 = // "Pattern{Constant('HA: Slave is down'), Field(,false)}" +match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, +])); + +var msg287 = msg("00015:13", part482); + +var part483 = // "Pattern{Constant('NSRP link '), Field(p0,false)}" +match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); + +var all92 = all_match({ + processors: [ + part483, + dup355, + dup116, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg288 = msg("00015:14", all92); + +var part484 = // "Pattern{Constant('no HA '), Field(fld2,true), Constant(' channel available ('), Field(fld3,true), Constant(' used by other channel)')}" +match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg289 = msg("00015:15", part484); + +var part485 = // "Pattern{Constant('The NSRP configuration is out of synchronization between the local device and the peer device.'), Field(,false)}" +match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg290 = msg("00015:16", part485); + +var part486 = // "Pattern{Constant('NSRP '), Field(change_attribute,true), Constant(' '), Field(change_old,true), Constant(' changed to link channel '), Field(change_new,false)}" +match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg291 = msg("00015:17", part486); + +var part487 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' on peer device '), Field(fld2,true), Constant(' changed from '), Field(fld3,true), Constant(' to '), Field(fld4,true), Constant(' state.')}" +match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ + dup121, + dup2, + dup3, + dup4, + dup5, + setc("change_attribute","RTO mirror group"), +])); + +var msg292 = msg("00015:18", part487); + +var part488 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' on local device '), Field(fld2,false), Constant(', detected a duplicate direction on the peer device '), Field(fld3,false)}" +match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg293 = msg("00015:19", part488); + +var part489 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' changed on the local device from '), Field(fld2,true), Constant(' to up state, it had peer device '), Field(fld3,false)}" +match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg294 = msg("00015:20", part489); + +var part490 = // "Pattern{Constant('Peer device '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); + +var part491 = // "Pattern{Constant('disappeared '), Field(p0,false)}" +match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); + +var part492 = // "Pattern{Constant('was discovered '), Field(p0,false)}" +match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); + +var select111 = linear_select([ + part491, + part492, +]); + +var all93 = all_match({ + processors: [ + part490, + select111, + dup116, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg295 = msg("00015:21", all93); + +var part493 = // "Pattern{Constant('The local '), Field(p0,false)}" +match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); + +var part494 = // "Pattern{Constant('The peer '), Field(p0,false)}" +match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); + +var part495 = // "Pattern{Constant('Peer '), Field(p0,false)}" +match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); + +var select112 = linear_select([ + part493, + part494, + part495, +]); + +var part496 = // "Pattern{Constant('device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed '), Field(change_attribute,true), Constant(' from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); + +var all94 = all_match({ + processors: [ + select112, + part496, + dup356, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg296 = msg("00015:22", all94); + +var part497 = // "Pattern{Constant('WebAuth is set to '), Field(fld2,false)}" +match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg297 = msg("00015:23", part497); + +var part498 = // "Pattern{Constant('Default firewall authentication server has been changed to '), Field(hostname,false)}" +match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg298 = msg("00015:24", part498); + +var part499 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' attempted to verify the encrypted password '), Field(fld2,false), Constant('. Verification was successful')}" +match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ + setc("eventcategory","1613050100"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg299 = msg("00015:25", part499); + +var part500 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' attempted to verify the encrypted password '), Field(fld2,false), Constant('. Verification failed')}" +match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ + dup97, + dup2, + dup3, + dup4, + dup5, +])); + +var msg300 = msg("00015:29", part500); + +var part501 = // "Pattern{Constant('unit '), Field(fld2,true), Constant(' just dis'), Field(p0,false)}" +match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); + +var part502 = // "Pattern{Constant('appeared'), Field(,false)}" +match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); + +var part503 = // "Pattern{Constant('covered'), Field(,false)}" +match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); + +var select113 = linear_select([ + part502, + part503, +]); + +var all95 = all_match({ + processors: [ + part501, + select113, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg301 = msg("00015:26", all95); + +var part504 = // "Pattern{Constant('NSRP: HA data channel change to '), Field(interface,false), Constant('. ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + dup146, +])); + +var msg302 = msg("00015:33", part504); + +var part505 = // "Pattern{Constant('NSRP: '), Field(fld2,false)}" +match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg303 = msg("00015:27", part505); + +var part506 = // "Pattern{Constant('Auth server '), Field(hostname,true), Constant(' RADIUS retry timeout has been set to default of '), Field(fld2,false)}" +match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg304 = msg("00015:28", part506); + +var part507 = // "Pattern{Constant('Number of RADIUS retries for auth server '), Field(hostname,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); + +var part508 = // "Pattern{Constant('set to '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); + +var all96 = all_match({ + processors: [ + part507, + dup357, + part508, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg305 = msg("00015:30", all96); + +var part509 = // "Pattern{Constant('Forced timeout for Auth server '), Field(hostname,true), Constant(' is unset to its default value, '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg306 = msg("00015:31", part509); + +var part510 = // "Pattern{Constant('Accounting port of server RADIUS is set to '), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup4, + dup5, + dup9, +])); + +var msg307 = msg("00015:32", part510); + +var select114 = linear_select([ + msg274, + msg275, + msg276, + msg277, + msg278, + msg279, + msg280, + msg281, + msg282, + msg283, + msg284, + msg285, + msg286, + msg287, + msg288, + msg289, + msg290, + msg291, + msg292, + msg293, + msg294, + msg295, + msg296, + msg297, + msg298, + msg299, + msg300, + msg301, + msg302, + msg303, + msg304, + msg305, + msg306, + msg307, +]); + +var part511 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup147, + dup148, + dup149, + dup150, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg308 = msg("00016", part511); + +var part512 = // "Pattern{Constant('Address VIP ('), Field(fld2,false), Constant(') for '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ + dup1, + dup148, + dup149, + dup150, + dup2, + dup3, + dup4, + dup5, +])); + +var msg309 = msg("00016:01", part512); + +var part513 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(') has been '), Field(disposition,false)}" +match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ + dup1, + dup148, + dup149, + dup150, + dup2, + dup3, + dup4, + dup5, +])); + +var msg310 = msg("00016:02", part513); + +var part514 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ + dup147, + dup148, + dup149, + dup150, + dup2, + dup3, + dup4, + dup5, +])); + +var msg311 = msg("00016:03", part514); + +var part515 = // "Pattern{Constant('VIP multi-port was '), Field(disposition,false)}" +match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg312 = msg("00016:05", part515); + +var part516 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup147, + dup148, + dup149, + dup150, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg313 = msg("00016:06", part516); + +var part517 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' ( zone '), Field(p0,false)}" +match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); + +var all97 = all_match({ + processors: [ + part517, + dup340, + dup67, + ], + on_success: processor_chain([ + dup147, + dup148, + dup149, + dup150, + dup2, + dup9, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg314 = msg("00016:07", all97); + +var part518 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' HTTP '), Field(fld4,false), Constant(') Modify by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + setc("eventcategory","1001020305"), + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg315 = msg("00016:08", part518); + +var part519 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' HTTP '), Field(fld4,false), Constant(') New by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + setc("eventcategory","1001030305"), + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg316 = msg("00016:09", part519); + +var select115 = linear_select([ + msg308, + msg309, + msg310, + msg311, + msg312, + msg313, + msg314, + msg315, + msg316, +]); + +var part520 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup151, + dup2, + dup3, + dup59, + dup4, + dup5, +])); + +var msg317 = msg("00017", part520); + +var part521 = // "Pattern{Constant('Gateway '), Field(fld2,true), Constant(' at '), Field(fld3,true), Constant(' in '), Field(fld5,true), Constant(' mode with ID '), Field(p0,false)}" +match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); + +var part522 = // "Pattern{Constant('['), Field(fld4,false), Constant('] '), Field(p0,false)}" +match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); + +var part523 = // "Pattern{Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); + +var select116 = linear_select([ + part522, + part523, +]); + +var part524 = // "Pattern{Constant('has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(fld,false)}" +match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); + +var all98 = all_match({ + processors: [ + part521, + select116, + part524, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg318 = msg("00017:23", all98); + +var part525 = // "Pattern{Field(fld1,false), Constant(': Gateway '), Field(p0,false)}" +match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); + +var part526 = // "Pattern{Constant('Gateway '), Field(p0,false)}" +match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); + +var select117 = linear_select([ + part525, + part526, +]); + +var part527 = // "Pattern{Constant(''), Field(fld2,true), Constant(' at '), Field(fld3,true), Constant(' in '), Field(fld5,true), Constant(' mode with ID'), Field(p0,false)}" +match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); + +var part528 = // "Pattern{Constant(''), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); + +var all99 = all_match({ + processors: [ + select117, + part527, + dup358, + part528, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg319 = msg("00017:01", all99); + +var part529 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Gateway settings have been '), Field(disposition,false)}" +match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg320 = msg("00017:02", part529); + +var part530 = // "Pattern{Constant('IKE key '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg321 = msg("00017:03", part530); + +var part531 = // "Pattern{Constant(''), Field(group_object,true), Constant(' with range '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); + +var all100 = all_match({ + processors: [ + dup153, + dup359, + part531, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg322 = msg("00017:04", all100); + +var part532 = // "Pattern{Constant('IPSec NAT-T for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg323 = msg("00017:05", part532); + +var part533 = // "Pattern{Constant('The DF-BIT for VPN '), Field(group,true), Constant(' has been set to '), Field(p0,false)}" +match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); + +var part534 = // "Pattern{Constant('clear '), Field(p0,false)}" +match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); + +var part535 = // "Pattern{Constant('copy '), Field(p0,false)}" +match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); + +var select118 = linear_select([ + part534, + dup101, + part535, +]); + +var all101 = all_match({ + processors: [ + part533, + select118, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg324 = msg("00017:06", all101); + +var part536 = // "Pattern{Constant('The DF-BIT for VPN '), Field(group,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); + +var part537 = // "Pattern{Constant('clear'), Field(,false)}" +match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); + +var part538 = // "Pattern{Constant('cleared'), Field(,false)}" +match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); + +var part539 = // "Pattern{Constant('copy'), Field(,false)}" +match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); + +var part540 = // "Pattern{Constant('copied'), Field(,false)}" +match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); + +var select119 = linear_select([ + part537, + part538, + dup98, + part539, + part540, +]); + +var all102 = all_match({ + processors: [ + part536, + select119, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg325 = msg("00017:07", all102); + +var part541 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and SPI '), Field(fld3,false), Constant('/'), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg326 = msg("00017:08", part541); + +var part542 = // "Pattern{Field(fld1,false), Constant(': VPN '), Field(p0,false)}" +match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); + +var part543 = // "Pattern{Constant('VPN '), Field(p0,false)}" +match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); + +var select120 = linear_select([ + part542, + part543, +]); + +var part544 = // "Pattern{Constant(''), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); + +var part545 = // "Pattern{Constant('no-rekey '), Field(p0,false)}" +match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); + +var part546 = // "Pattern{Constant('rekey, '), Field(p0,false)}" +match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); + +var part547 = // "Pattern{Constant('rekey '), Field(p0,false)}" +match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); + +var select121 = linear_select([ + part545, + part546, + part547, +]); + +var part548 = // "Pattern{Constant('and p2-proposal '), Field(fld3,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); + +var part549 = // "Pattern{Field(disposition,true), Constant(' from peer unit')}" +match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); + +var part550 = // "Pattern{Field(disposition,true), Constant(' from host '), Field(saddr,false)}" +match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); + +var select122 = linear_select([ + part549, + part550, + dup36, +]); + +var all103 = all_match({ + processors: [ + select120, + part544, + select121, + part548, + select122, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg327 = msg("00017:09", all103); + +var part551 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false), Constant('. Src IF '), Field(sinterface,true), Constant(' dst IP '), Field(daddr,true), Constant(' with rekeying '), Field(p0,false)}" +match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); + +var all104 = all_match({ + processors: [ + part551, + dup360, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg328 = msg("00017:10", all104); + +var part552 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg329 = msg("00017:11", part552); + +var part553 = // "Pattern{Constant('VPN monitoring '), Field(p0,false)}" +match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); + +var part554 = // "Pattern{Constant('frequency '), Field(p0,false)}" +match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); + +var select123 = linear_select([ + dup109, + dup110, + part554, +]); + +var all105 = all_match({ + processors: [ + part553, + select123, + dup127, + dup361, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg330 = msg("00017:12", all105); + +var part555 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal '), Field(fld3,true), Constant(' has been added by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg331 = msg("00017:26", part555); + +var part556 = // "Pattern{Constant('No IP pool has been assigned. You cannot allocate an IP address.'), Field(,false)}" +match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg332 = msg("00017:13", part556); + +var part557 = // "Pattern{Constant('P1 proposal '), Field(fld2,true), Constant(' with '), Field(protocol_detail,false), Constant(', DH group '), Field(group,false), Constant(', ESP '), Field(encryption_type,false), Constant(', auth '), Field(authmethod,false), Constant(', and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup9, + dup5, +])); + +var msg333 = msg("00017:14", part557); + +var part558 = // "Pattern{Constant('P2 proposal '), Field(fld2,true), Constant(' with DH group '), Field(group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); + +var part559 = // "Pattern{Constant(''), Field(encryption_type,true), Constant(' auth '), Field(authmethod,true), Constant(' and lifetime ('), Field(fld3,false), Constant(') ('), Field(fld4,false), Constant(') has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); + +var all106 = all_match({ + processors: [ + part558, + dup362, + part559, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg334 = msg("00017:15", all106); + +var part560 = // "Pattern{Constant('P1 proposal '), Field(fld2,true), Constant(' with '), Field(protocol_detail,true), Constant(' DH group '), Field(group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); + +var part561 = // "Pattern{Constant(''), Field(encryption_type,true), Constant(' auth '), Field(authmethod,true), Constant(' and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); + +var all107 = all_match({ + processors: [ + part560, + dup362, + part561, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg335 = msg("00017:31", all107); + +var part562 = // "Pattern{Constant('vpnmonitor interval is '), Field(p0,false)}" +match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); + +var all108 = all_match({ + processors: [ + part562, + dup361, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg336 = msg("00017:16", all108); + +var part563 = // "Pattern{Constant('vpnmonitor threshold is '), Field(p0,false)}" +match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); + +var select124 = linear_select([ + dup99, + dup93, +]); + +var all109 = all_match({ + processors: [ + part563, + select124, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg337 = msg("00017:17", all109); + +var part564 = // "Pattern{Constant(''), Field(group_object,true), Constant(' with range '), Field(fld2,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); + +var all110 = all_match({ + processors: [ + dup153, + dup359, + part564, + ], + on_success: processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg338 = msg("00017:18", all110); + +var part565 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at '), Field(p0,false)}" +match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); + +var part566 = // "Pattern{Field(,true), Constant(' '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); + +var all111 = all_match({ + processors: [ + part565, + dup339, + part566, + ], + on_success: processor_chain([ + dup151, + dup2, + dup3, + dup59, + dup4, + dup5, + ]), +}); + +var msg339 = msg("00017:19", all111); + +var all112 = all_match({ + processors: [ + dup64, + dup340, + dup67, + ], + on_success: processor_chain([ + dup151, + dup2, + dup9, + dup59, + dup3, + dup4, + dup5, + ]), +}); + +var msg340 = msg("00017:20", all112); + +var part567 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup151, + dup2, + dup3, + dup59, + dup4, + dup5, +])); + +var msg341 = msg("00017:21", part567); + +var part568 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg342 = msg("00017:22", part568); + +var part569 = // "Pattern{Constant('VPN "'), Field(group,false), Constant('" has been bound to tunnel interface '), Field(interface,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg343 = msg("00017:24", part569); + +var part570 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal standard has been added by admin '), Field(administrator,true), Constant(' via NSRP Peer ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg344 = msg("00017:25", part570); + +var part571 = // "Pattern{Constant('P2 proposal '), Field(fld2,true), Constant(' with DH group '), Field(group,false), Constant(', ESP, enc '), Field(encryption_type,false), Constant(', auth '), Field(authmethod,false), Constant(', and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg345 = msg("00017:28", part571); + +var part572 = // "Pattern{Constant('L2TP "'), Field(fld2,false), Constant('", all-L2TP-users secret "'), Field(fld3,false), Constant('" keepalive '), Field(fld4,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup4, + dup5, + dup9, +])); + +var msg346 = msg("00017:29", part572); + +var select125 = linear_select([ + msg317, + msg318, + msg319, + msg320, + msg321, + msg322, + msg323, + msg324, + msg325, + msg326, + msg327, + msg328, + msg329, + msg330, + msg331, + msg332, + msg333, + msg334, + msg335, + msg336, + msg337, + msg338, + msg339, + msg340, + msg341, + msg342, + msg343, + msg344, + msg345, + msg346, +]); + +var part573 = // "Pattern{Constant('Positions of policies '), Field(fld2,true), Constant(' and '), Field(fld3,true), Constant(' have been exchanged')}" +match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg347 = msg("00018", part573); + +var part574 = // "Pattern{Constant('Deny Policy Alarm'), Field(,false)}" +match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ + setc("eventcategory","1502010000"), + dup2, + dup4, + dup5, + dup3, +])); + +var msg348 = msg("00018:01", part574); + +var part575 = // "Pattern{Constant('Device'), Field(p0,false)}" +match("MESSAGE#347:00018:02/0", "nwparser.payload", "Device%{p0}"); + +var part576 = // "Pattern{Constant('s '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' by admin '), Field(administrator,false)}" +match("MESSAGE#347:00018:02/2", "nwparser.p0", "s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}"); + +var all113 = all_match({ + processors: [ + part575, + dup363, + part576, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg349 = msg("00018:02", all113); + +var part577 = // "Pattern{Field(fld2,true), Constant(' Policy ('), Field(policy_id,false), Constant(', '), Field(info,true), Constant(' ) was '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg350 = msg("00018:04", part577); + +var part578 = // "Pattern{Field(fld2,true), Constant(' Policy ('), Field(policy_id,false), Constant(', '), Field(info,true), Constant(' ) was '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer')}" +match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ + dup17, + dup2, + dup3, + dup4, + dup5, +])); + +var msg351 = msg("00018:16", part578); + +var part579 = // "Pattern{Field(fld2,true), Constant(' Policy '), Field(policy_id,true), Constant(' has been moved '), Field(p0,false)}" +match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); + +var part580 = // "Pattern{Constant('before '), Field(p0,false)}" +match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); + +var part581 = // "Pattern{Constant('after '), Field(p0,false)}" +match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); + +var select126 = linear_select([ + part580, + part581, +]); + +var part582 = // "Pattern{Constant(''), Field(fld3,true), Constant(' by admin '), Field(administrator,false)}" +match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); + +var all114 = all_match({ + processors: [ + part579, + select126, + part582, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg352 = msg("00018:06", all114); + +var part583 = // "Pattern{Constant('Policy '), Field(policy_id,true), Constant(' application was modified to '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg353 = msg("00018:08", part583); + +var part584 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup17, + dup3, + dup2, + dup9, + dup4, + dup5, +])); + +var msg354 = msg("00018:09", part584); + +var part585 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(p0,false)}" +match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); + +var part586 = // "Pattern{Field(disposition,true), Constant(' from peer unit by '), Field(p0,false)}" +match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); + +var part587 = // "Pattern{Field(disposition,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); + +var select127 = linear_select([ + part586, + part587, +]); + +var part588 = // "Pattern{Field(username,true), Constant(' via '), Field(interface,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); + +var all115 = all_match({ + processors: [ + part585, + select127, + part588, + ], + on_success: processor_chain([ + dup17, + dup3, + dup2, + dup9, + dup4, + dup5, + ]), +}); + +var msg355 = msg("00018:10", all115); + +var part589 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); + +var part590 = // "Pattern{Constant('Attack group '), Field(signame,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); + +var select128 = linear_select([ + part589, + part590, +]); + +var part591 = // "Pattern{Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); + +var part592 = // "Pattern{Constant('to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); + +var select129 = linear_select([ + part592, + dup16, +]); + +var all116 = all_match({ + processors: [ + dup162, + select128, + part591, + select129, + dup10, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg356 = msg("00018:11", all116); + +var part593 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the '), Field(p0,false)}" +match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); + +var part594 = // "Pattern{Constant('application '), Field(p0,false)}" +match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); + +var part595 = // "Pattern{Constant('attack severity '), Field(p0,false)}" +match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); + +var part596 = // "Pattern{Constant('DI attack component '), Field(p0,false)}" +match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); + +var select130 = linear_select([ + part594, + part595, + part596, +]); + +var part597 = // "Pattern{Constant('was modified by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); + +var all117 = all_match({ + processors: [ + part593, + select130, + part597, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg357 = msg("00018:12", all117); + +var part598 = // "Pattern{Field(,false), Constant('address '), Field(dhost,false), Constant('('), Field(daddr,false), Constant(') was '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); + +var all118 = all_match({ + processors: [ + dup364, + part598, + dup365, + dup166, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg358 = msg("00018:32", all118); + +var part599 = // "Pattern{Field(,false), Constant('address '), Field(dhost,true), Constant(' was '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); + +var all119 = all_match({ + processors: [ + dup364, + part599, + dup365, + dup166, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg359 = msg("00018:22", all119); + +var part600 = // "Pattern{Field(agent,true), Constant(' was '), Field(disposition,true), Constant(' from policy '), Field(policy_id,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); + +var select131 = linear_select([ + dup78, + dup77, +]); + +var part601 = // "Pattern{Constant('address by admin '), Field(administrator,true), Constant(' via NSRP Peer')}" +match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); + +var all120 = all_match({ + processors: [ + part600, + select131, + part601, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg360 = msg("00018:15", all120); + +var part602 = // "Pattern{Field(agent,true), Constant(' was '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); + +var part603 = // "Pattern{Constant('to'), Field(p0,false)}" +match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); + +var part604 = // "Pattern{Constant('from'), Field(p0,false)}" +match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); + +var select132 = linear_select([ + part603, + part604, +]); + +var part605 = // "Pattern{Field(,false), Constant('policy '), Field(policy_id,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); + +var part606 = // "Pattern{Constant('service '), Field(p0,false)}" +match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); + +var part607 = // "Pattern{Constant('source address '), Field(p0,false)}" +match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); + +var part608 = // "Pattern{Constant('destination address '), Field(p0,false)}" +match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); + +var select133 = linear_select([ + part606, + part607, + part608, +]); + +var part609 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); + +var all121 = all_match({ + processors: [ + part602, + select132, + part605, + select133, + part609, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg361 = msg("00018:14", all121); + +var part610 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg362 = msg("00018:29", part610); + +var part611 = // "Pattern{Field(agent,true), Constant(' was added to policy '), Field(policy_id,true), Constant(' '), Field(rule_group,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer '), Field(space,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg363 = msg("00018:07", part611); + +var part612 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg364 = msg("00018:18", part612); + +var part613 = // "Pattern{Constant('AntiSpam ns-profile was '), Field(disposition,true), Constant(' from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg365 = msg("00018:17", part613); + +var part614 = // "Pattern{Constant('Source address Info '), Field(info,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg366 = msg("00018:19", part614); + +var part615 = // "Pattern{Constant('Destination '), Field(p0,false)}" +match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); + +var part616 = // "Pattern{Constant('Source '), Field(p0,false)}" +match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); + +var select134 = linear_select([ + part615, + part616, +]); + +var part617 = // "Pattern{Constant('address '), Field(info,true), Constant(' was added to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); + +var part618 = // "Pattern{Constant('from host '), Field(p0,false)}" +match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); + +var select135 = linear_select([ + part618, + dup103, +]); + +var part619 = // "Pattern{Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); + +var part620 = // "Pattern{Field(daddr,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); + +var select136 = linear_select([ + part619, + part620, +]); + +var part621 = // "Pattern{Field(dport,false), Constant(':('), Field(fld1,false), Constant(')')}" +match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); + +var all122 = all_match({ + processors: [ + select134, + part617, + select135, + dup23, + select136, + part621, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg367 = msg("00018:23", all122); + +var part622 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was deleted from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg368 = msg("00018:21", part622); + +var part623 = // "Pattern{Constant('Policy ('), Field(policyname,false), Constant(') was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg369 = msg("00018:24", part623); + +var part624 = // "Pattern{Field(,false), Constant('address '), Field(info,true), Constant(' was added to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); + +var all123 = all_match({ + processors: [ + dup366, + part624, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg370 = msg("00018:25", all123); + +var part625 = // "Pattern{Field(,false), Constant('address '), Field(info,true), Constant(' was deleted from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); + +var all124 = all_match({ + processors: [ + dup366, + part625, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg371 = msg("00018:30", all124); + +var part626 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the application was modified to '), Field(disposition,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); + +var part627 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(p0,false)}" +match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); + +var select137 = linear_select([ + dup48, + part627, +]); + +var all125 = all_match({ + processors: [ + part626, + dup367, + select137, + dup41, + ], + on_success: processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg372 = msg("00018:26", all125); + +var part628 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the DI attack component was modified by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ + dup17, + dup2, + dup4, + dup5, + dup9, +])); + +var msg373 = msg("00018:27", part628); + +var part629 = // "Pattern{Constant('In policy '), Field(policyname,false), Constant(', the DI attack component was modified by admin '), Field(administrator,true), Constant(' via '), Field(logon_type,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ + dup17, + dup2, + dup4, + dup5, + dup9, + setc("info","the DI attack component was modified"), +])); + +var msg374 = msg("00018:28", part629); + +var part630 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(disposition,false)}" +match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ + dup17, + dup2, + dup3, + dup4, + dup5, +])); + +var msg375 = msg("00018:03", part630); + +var part631 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the option '), Field(fld2,true), Constant(' was '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg376 = msg("00018:31", part631); + +var select138 = linear_select([ + msg347, + msg348, + msg349, + msg350, + msg351, + msg352, + msg353, + msg354, + msg355, + msg356, + msg357, + msg358, + msg359, + msg360, + msg361, + msg362, + msg363, + msg364, + msg365, + msg366, + msg367, + msg368, + msg369, + msg370, + msg371, + msg372, + msg373, + msg374, + msg375, + msg376, +]); + +var part632 = // "Pattern{Constant('Attempt to enable WebTrends has '), Field(disposition,true), Constant(' because WebTrends settings have not yet been configured')}" +match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg377 = msg("00019", part632); + +var part633 = // "Pattern{Constant('has '), Field(disposition,true), Constant(' because syslog settings have not yet been configured')}" +match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); + +var all126 = all_match({ + processors: [ + dup167, + dup368, + part633, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg378 = msg("00019:01", all126); + +var part634 = // "Pattern{Constant('Socket cannot be assigned for '), Field(p0,false)}" +match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); + +var part635 = // "Pattern{Constant('WebTrends'), Field(,false)}" +match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); + +var part636 = // "Pattern{Constant('syslog'), Field(,false)}" +match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); + +var select139 = linear_select([ + part635, + part636, +]); + +var all127 = all_match({ + processors: [ + part634, + select139, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg379 = msg("00019:02", all127); + +var part637 = // "Pattern{Constant('Syslog VPN encryption has been '), Field(disposition,false)}" +match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ + dup91, + dup2, + dup3, + dup4, + dup5, +])); + +var msg380 = msg("00019:03", part637); + +var select140 = linear_select([ + dup171, + dup78, +]); + +var select141 = linear_select([ + dup139, + dup172, + dup137, + dup122, +]); + +var all128 = all_match({ + processors: [ + dup170, + select140, + dup23, + select141, + dup173, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg381 = msg("00019:04", all128); + +var part638 = // "Pattern{Constant('Syslog message level has been changed to '), Field(p0,false)}" +match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); + +var part639 = // "Pattern{Constant('debug'), Field(,false)}" +match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); + +var part640 = // "Pattern{Constant('information'), Field(,false)}" +match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); + +var part641 = // "Pattern{Constant('notification'), Field(,false)}" +match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); + +var part642 = // "Pattern{Constant('warning'), Field(,false)}" +match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); + +var part643 = // "Pattern{Constant('error'), Field(,false)}" +match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); + +var part644 = // "Pattern{Constant('critical'), Field(,false)}" +match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); + +var part645 = // "Pattern{Constant('alert'), Field(,false)}" +match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); + +var part646 = // "Pattern{Constant('emergency'), Field(,false)}" +match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); + +var select142 = linear_select([ + part639, + part640, + part641, + part642, + part643, + part644, + part645, + part646, +]); + +var all129 = all_match({ + processors: [ + part638, + select142, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg382 = msg("00019:05", all129); + +var part647 = // "Pattern{Constant('has been changed to '), Field(p0,false)}" +match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); + +var all130 = all_match({ + processors: [ + dup170, + dup369, + part647, + dup370, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg383 = msg("00019:06", all130); + +var part648 = // "Pattern{Constant('WebTrends VPN encryption has been '), Field(disposition,false)}" +match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ + dup91, + dup2, + dup3, + dup4, + dup5, +])); + +var msg384 = msg("00019:07", part648); + +var part649 = // "Pattern{Constant('WebTrends has been '), Field(disposition,false)}" +match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg385 = msg("00019:08", part649); + +var part650 = // "Pattern{Constant('WebTrends host '), Field(p0,false)}" +match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); + +var select143 = linear_select([ + dup139, + dup172, + dup137, +]); + +var all131 = all_match({ + processors: [ + part650, + select143, + dup173, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg386 = msg("00019:09", all131); + +var part651 = // "Pattern{Constant('Traffic logging via syslog '), Field(p0,false)}" +match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); + +var part652 = // "Pattern{Constant('Syslog '), Field(p0,false)}" +match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); + +var select144 = linear_select([ + part651, + part652, +]); + +var all132 = all_match({ + processors: [ + dup185, + select144, + dup138, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg387 = msg("00019:10", all132); + +var part653 = // "Pattern{Constant('has '), Field(disposition,true), Constant(' because there is no syslog server defined')}" +match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); + +var all133 = all_match({ + processors: [ + dup167, + dup368, + part653, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg388 = msg("00019:11", all133); + +var part654 = // "Pattern{Constant('Removing all syslog servers'), Field(,false)}" +match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg389 = msg("00019:12", part654); + +var part655 = // "Pattern{Constant('Syslog server '), Field(hostip,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); + +var select145 = linear_select([ + dup107, + dup106, +]); + +var part656 = // "Pattern{Constant(''), Field(disposition,false)}" +match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); + +var all134 = all_match({ + processors: [ + part655, + select145, + part656, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg390 = msg("00019:13", all134); + +var part657 = // "Pattern{Constant('for '), Field(hostip,true), Constant(' has been changed to '), Field(p0,false)}" +match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); + +var all135 = all_match({ + processors: [ + dup170, + dup369, + part657, + dup370, + ], + on_success: processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg391 = msg("00019:14", all135); + +var part658 = // "Pattern{Constant('Syslog cannot connect to the TCP server '), Field(hostip,false), Constant('; the connection is closed.')}" +match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg392 = msg("00019:15", part658); + +var part659 = // "Pattern{Constant('All syslog servers were removed.'), Field(,false)}" +match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ + setc("eventcategory","1701030000"), + setc("ec_activity","Delete"), + dup51, + dup2, + dup3, + dup4, + dup5, +])); + +var msg393 = msg("00019:16", part659); + +var part660 = // "Pattern{Constant('Syslog server '), Field(hostip,true), Constant(' host port number has been changed to '), Field(network_port,true), Constant(' '), Field(fld5,false)}" +match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, +])); + +var msg394 = msg("00019:17", part660); + +var part661 = // "Pattern{Constant('Traffic logging '), Field(p0,false)}" +match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); + +var part662 = // "Pattern{Constant('via syslog '), Field(p0,false)}" +match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); + +var part663 = // "Pattern{Constant('for syslog server '), Field(hostip,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); + +var select146 = linear_select([ + part662, + part663, +]); + +var all136 = all_match({ + processors: [ + part661, + select146, + dup138, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg395 = msg("00019:18", all136); + +var part664 = // "Pattern{Constant('Transport protocol for syslog server '), Field(hostip,true), Constant(' was changed to udp')}" +match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, +])); + +var msg396 = msg("00019:19", part664); + +var part665 = // "Pattern{Constant('The traffic/IDP syslog is enabled on backup device by netscreen via web from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup4, + dup5, +])); + +var msg397 = msg("00019:20", part665); + +var select147 = linear_select([ + msg377, + msg378, + msg379, + msg380, + msg381, + msg382, + msg383, + msg384, + msg385, + msg386, + msg387, + msg388, + msg389, + msg390, + msg391, + msg392, + msg393, + msg394, + msg395, + msg396, + msg397, +]); + +var part666 = // "Pattern{Constant('Schedule '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg398 = msg("00020", part666); + +var part667 = // "Pattern{Constant('System memory is low '), Field(p0,false)}" +match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); + +var part668 = // "Pattern{Constant('( '), Field(p0,false)}" +match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); + +var select148 = linear_select([ + dup152, + part668, +]); + +var part669 = // "Pattern{Constant(''), Field(fld2,true), Constant(' bytes allocated out of '), Field(p0,false)}" +match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); + +var part670 = // "Pattern{Constant('total '), Field(fld3,true), Constant(' bytes')}" +match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); + +var part671 = // "Pattern{Field(fld4,true), Constant(' bytes total')}" +match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); + +var select149 = linear_select([ + part670, + part671, +]); + +var all137 = all_match({ + processors: [ + part667, + select148, + part669, + select149, + ], + on_success: processor_chain([ + dup186, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg399 = msg("00020:01", all137); + +var part672 = // "Pattern{Constant('System memory is low ('), Field(fld2,true), Constant(' allocated out of '), Field(fld3,true), Constant(' ) '), Field(fld4,true), Constant(' times in '), Field(fld5,false)}" +match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ + dup186, + dup2, + dup3, + dup4, + dup5, +])); + +var msg400 = msg("00020:02", part672); + +var select150 = linear_select([ + msg398, + msg399, + msg400, +]); + +var part673 = // "Pattern{Constant('DIP '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg401 = msg("00021", part673); + +var part674 = // "Pattern{Constant('IP pool '), Field(fld2,true), Constant(' with range '), Field(info,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg402 = msg("00021:01", part674); + +var part675 = // "Pattern{Constant('DNS server is not configured'), Field(,false)}" +match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg403 = msg("00021:02", part675); + +var part676 = // "Pattern{Constant('Connection refused by the DNS server'), Field(,false)}" +match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ + dup187, + dup2, + dup3, + dup4, + dup5, +])); + +var msg404 = msg("00021:03", part676); + +var part677 = // "Pattern{Constant('Unknown DNS error'), Field(,false)}" +match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg405 = msg("00021:04", part677); + +var part678 = // "Pattern{Constant('DIP port-translatation stickiness was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg406 = msg("00021:05", part678); + +var part679 = // "Pattern{Constant('DIP port-translation stickiness was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup4, + dup5, + dup9, + setc("info","DIP port-translation stickiness was modified"), +])); + +var msg407 = msg("00021:06", part679); + +var select151 = linear_select([ + msg401, + msg402, + msg403, + msg404, + msg405, + msg406, + msg407, +]); + +var part680 = // "Pattern{Constant('power supplies '), Field(p0,false)}" +match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); + +var part681 = // "Pattern{Constant('fans '), Field(p0,false)}" +match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); + +var select152 = linear_select([ + part680, + part681, +]); + +var part682 = // "Pattern{Constant('are '), Field(fld2,true), Constant(' functioning properly')}" +match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); + +var all138 = all_match({ + processors: [ + dup188, + select152, + part682, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg408 = msg("00022", all138); + +var part683 = // "Pattern{Constant('At least one power supply '), Field(p0,false)}" +match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); + +var part684 = // "Pattern{Constant('The power supply '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); + +var part685 = // "Pattern{Constant('At least one fan '), Field(p0,false)}" +match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); + +var select153 = linear_select([ + part683, + part684, + part685, +]); + +var part686 = // "Pattern{Constant('is not functioning properly'), Field(p0,false)}" +match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); + +var all139 = all_match({ + processors: [ + select153, + part686, + dup371, + ], + on_success: processor_chain([ + dup189, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg409 = msg("00022:01", all139); + +var part687 = // "Pattern{Constant('Global Manager VPN management tunnel has been '), Field(disposition,false)}" +match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg410 = msg("00022:02", part687); + +var part688 = // "Pattern{Constant('Global Manager domain name has been defined as '), Field(domain,false)}" +match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg411 = msg("00022:03", part688); + +var part689 = // "Pattern{Constant('Reporting of the '), Field(p0,false)}" +match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); + +var part690 = // "Pattern{Constant('network activities '), Field(p0,false)}" +match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); + +var part691 = // "Pattern{Constant('device resources '), Field(p0,false)}" +match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); + +var part692 = // "Pattern{Constant('event logs '), Field(p0,false)}" +match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); + +var part693 = // "Pattern{Constant('summary logs '), Field(p0,false)}" +match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); + +var select154 = linear_select([ + part690, + part691, + part692, + part693, +]); + +var part694 = // "Pattern{Constant('to Global Manager has been '), Field(disposition,false)}" +match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); + +var all140 = all_match({ + processors: [ + part689, + select154, + part694, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg412 = msg("00022:04", all140); + +var part695 = // "Pattern{Constant('Global Manager has been '), Field(disposition,false)}" +match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg413 = msg("00022:05", part695); + +var part696 = // "Pattern{Constant('Global Manager '), Field(p0,false)}" +match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); + +var part697 = // "Pattern{Constant('report '), Field(p0,false)}" +match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); + +var part698 = // "Pattern{Constant('listen '), Field(p0,false)}" +match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); + +var select155 = linear_select([ + part697, + part698, +]); + +var part699 = // "Pattern{Constant('port has been set to '), Field(interface,false)}" +match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); + +var all141 = all_match({ + processors: [ + part696, + select155, + part699, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg414 = msg("00022:06", all141); + +var part700 = // "Pattern{Constant('The Global Manager keep-alive value has been changed to '), Field(fld2,false)}" +match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg415 = msg("00022:07", part700); + +var part701 = // "Pattern{Constant('System temperature '), Field(p0,false)}" +match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); + +var part702 = // "Pattern{Constant('System's temperature: '), Field(p0,false)}" +match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); + +var part703 = // "Pattern{Constant('The system temperature '), Field(p0,false)}" +match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); + +var select156 = linear_select([ + part701, + part702, + part703, +]); + +var part704 = // "Pattern{Constant('('), Field(fld2,true), Constant(' C'), Field(p0,false)}" +match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); + +var part705 = // "Pattern{Constant('entigrade, '), Field(p0,false)}" +match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); + +var select157 = linear_select([ + part705, + dup96, +]); + +var part706 = // "Pattern{Constant(''), Field(fld3,true), Constant(' F'), Field(p0,false)}" +match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); + +var part707 = // "Pattern{Constant('ahrenheit '), Field(p0,false)}" +match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); + +var select158 = linear_select([ + part707, + dup96, +]); + +var part708 = // "Pattern{Constant(') is too high'), Field(,false)}" +match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); + +var all142 = all_match({ + processors: [ + select156, + part704, + select157, + part706, + select158, + part708, + ], + on_success: processor_chain([ + dup190, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg416 = msg("00022:08", all142); + +var part709 = // "Pattern{Constant('power supply is no'), Field(p0,false)}" +match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); + +var select159 = linear_select([ + dup193, + dup194, +]); + +var part710 = // "Pattern{Constant('functioning properly'), Field(,false)}" +match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); + +var all143 = all_match({ + processors: [ + dup55, + dup372, + part709, + select159, + part710, + ], + on_success: processor_chain([ + dup190, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg417 = msg("00022:09", all143); + +var part711 = // "Pattern{Constant('The NetScreen device was unable to upgrade the file system'), Field(p0,false)}" +match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); + +var part712 = // "Pattern{Constant(' due to an internal conflict'), Field(,false)}" +match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); + +var part713 = // "Pattern{Constant(', but the old file system is intact'), Field(,false)}" +match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); + +var select160 = linear_select([ + part712, + part713, +]); + +var all144 = all_match({ + processors: [ + part711, + select160, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg418 = msg("00022:10", all144); + +var part714 = // "Pattern{Constant('The NetScreen device was unable to upgrade '), Field(p0,false)}" +match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); + +var part715 = // "Pattern{Constant('due to an internal conflict'), Field(,false)}" +match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); + +var part716 = // "Pattern{Constant('the loader, but the loader is intact'), Field(,false)}" +match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); + +var select161 = linear_select([ + part715, + part716, +]); + +var all145 = all_match({ + processors: [ + part714, + select161, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg419 = msg("00022:11", all145); + +var part717 = // "Pattern{Constant('Battery is no'), Field(p0,false)}" +match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); + +var select162 = linear_select([ + dup194, + dup193, +]); + +var part718 = // "Pattern{Constant('functioning properly.'), Field(,false)}" +match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); + +var all146 = all_match({ + processors: [ + part717, + select162, + part718, + ], + on_success: processor_chain([ + dup190, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg420 = msg("00022:12", all146); + +var part719 = // "Pattern{Constant('System's temperature ('), Field(fld2,true), Constant(' Centigrade, '), Field(fld3,true), Constant(' Fahrenheit) is OK now.')}" +match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg421 = msg("00022:13", part719); + +var part720 = // "Pattern{Constant('The power supply '), Field(fld2,true), Constant(' is functioning properly. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg422 = msg("00022:14", part720); + +var select163 = linear_select([ + msg408, + msg409, + msg410, + msg411, + msg412, + msg413, + msg414, + msg415, + msg416, + msg417, + msg418, + msg419, + msg420, + msg421, + msg422, +]); + +var part721 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' is not responding')}" +match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ + dup189, + dup2, + dup3, + dup4, + dup5, +])); + +var msg423 = msg("00023", part721); + +var part722 = // "Pattern{Constant('VIP/load balance server '), Field(hostip,true), Constant(' cannot be contacted')}" +match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ + dup189, + dup2, + dup3, + dup4, + dup5, +])); + +var msg424 = msg("00023:01", part722); + +var part723 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' cannot be contacted')}" +match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ + dup189, + dup2, + dup3, + dup4, + dup5, +])); + +var msg425 = msg("00023:02", part723); + +var select164 = linear_select([ + msg423, + msg424, + msg425, +]); + +var part724 = // "Pattern{Constant('The DHCP '), Field(p0,false)}" +match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); + +var part725 = // "Pattern{Constant(' DHCP '), Field(p0,false)}" +match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); + +var select165 = linear_select([ + part724, + part725, +]); + +var part726 = // "Pattern{Constant('IP address pool has '), Field(p0,false)}" +match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); + +var part727 = // "Pattern{Constant('options have been '), Field(p0,false)}" +match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); + +var select166 = linear_select([ + part726, + part727, +]); + +var all147 = all_match({ + processors: [ + select165, + dup195, + select166, + dup52, + dup371, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg426 = msg("00024", all147); + +var part728 = // "Pattern{Constant('Traffic log '), Field(p0,false)}" +match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); + +var part729 = // "Pattern{Constant('Alarm log '), Field(p0,false)}" +match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); + +var part730 = // "Pattern{Constant('Event log '), Field(p0,false)}" +match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); + +var part731 = // "Pattern{Constant('Self log '), Field(p0,false)}" +match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); + +var part732 = // "Pattern{Constant('Asset Recovery log '), Field(p0,false)}" +match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); + +var select167 = linear_select([ + part728, + part729, + part730, + part731, + part732, +]); + +var part733 = // "Pattern{Constant('has overflowed'), Field(,false)}" +match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); + +var all148 = all_match({ + processors: [ + select167, + part733, + ], + on_success: processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg427 = msg("00024:01", all148); + +var part734 = // "Pattern{Constant('DHCP relay agent settings on '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); + +var part735 = // "Pattern{Constant('are '), Field(p0,false)}" +match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); + +var part736 = // "Pattern{Constant('have been '), Field(p0,false)}" +match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); + +var select168 = linear_select([ + part735, + part736, +]); + +var part737 = // "Pattern{Constant(''), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); + +var all149 = all_match({ + processors: [ + part734, + select168, + part737, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg428 = msg("00024:02", all149); + +var part738 = // "Pattern{Constant('DHCP server IP address pool '), Field(p0,false)}" +match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); + +var select169 = linear_select([ + dup196, + dup106, +]); + +var part739 = // "Pattern{Constant('changed. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); + +var all150 = all_match({ + processors: [ + part738, + select169, + part739, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg429 = msg("00024:03", all150); + +var select170 = linear_select([ + msg426, + msg427, + msg428, + msg429, +]); + +var part740 = // "Pattern{Constant('The DHCP server IP address pool has changed'), Field(,false)}" +match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg430 = msg("00025", part740); + +var part741 = // "Pattern{Constant('PKI: The current device '), Field(disposition,true), Constant(' to save the certificate authority configuration.')}" +match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg431 = msg("00025:01", part741); + +var part742 = // "Pattern{Field(disposition,true), Constant(' to send the X509 request file via e-mail')}" +match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg432 = msg("00025:02", part742); + +var part743 = // "Pattern{Field(disposition,true), Constant(' to save the CA configuration')}" +match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg433 = msg("00025:03", part743); + +var part744 = // "Pattern{Constant('Cannot load more X509 certificates. The '), Field(result,false)}" +match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg434 = msg("00025:04", part744); + +var select171 = linear_select([ + msg430, + msg431, + msg432, + msg433, + msg434, +]); + +var part745 = // "Pattern{Field(signame,true), Constant(' have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg435 = msg("00026", part745); + +var part746 = // "Pattern{Field(signame,true), Constant(' have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on interface '), Field(interface,false)}" +match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup61, +])); + +var msg436 = msg("00026:13", part746); + +var part747 = // "Pattern{Constant('PKA key has been '), Field(p0,false)}" +match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); + +var part748 = // "Pattern{Constant('admin user '), Field(administrator,false), Constant('. (Key ID = '), Field(fld2,false), Constant(')')}" +match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); + +var all151 = all_match({ + processors: [ + dup197, + dup373, + part747, + dup374, + part748, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg437 = msg("00026:01", all151); + +var part749 = // "Pattern{Constant(': SCS '), Field(p0,false)}" +match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); + +var select172 = linear_select([ + part749, + dup96, +]); + +var part750 = // "Pattern{Constant('has been '), Field(disposition,true), Constant(' for '), Field(p0,false)}" +match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); + +var part751 = // "Pattern{Constant('root system '), Field(p0,false)}" +match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); + +var part752 = // "Pattern{Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); + +var select173 = linear_select([ + part751, + part752, +]); + +var all152 = all_match({ + processors: [ + dup197, + select172, + part750, + select173, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg438 = msg("00026:02", all152); + +var part753 = // "Pattern{Constant(''), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); + +var all153 = all_match({ + processors: [ + dup197, + dup373, + part753, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg439 = msg("00026:03", all153); + +var part754 = // "Pattern{Constant('SCS: Connection has been terminated for admin user '), Field(administrator,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,false)}" +match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ + dup200, + dup2, + dup4, + dup5, + dup3, +])); + +var msg440 = msg("00026:04", part754); + +var part755 = // "Pattern{Constant('SCS: Host client has requested NO cipher from '), Field(interface,false)}" +match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ + dup200, + dup2, + dup3, + dup4, + dup5, +])); + +var msg441 = msg("00026:05", part755); + +var part756 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' has been authenticated using PKA RSA from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. (key-ID='), Field(fld2,false)}" +match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ + dup201, + dup29, + dup30, + dup31, + dup32, + dup2, + dup3, + dup4, + dup5, +])); + +var msg442 = msg("00026:06", part756); + +var part757 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' has been authenticated using password from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" +match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ + dup201, + dup29, + dup30, + dup31, + dup32, + dup2, + dup3, + dup4, + dup5, +])); + +var msg443 = msg("00026:07", part757); + +var part758 = // "Pattern{Constant('SSH user '), Field(username,true), Constant(' has been authenticated using '), Field(p0,false)}" +match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); + +var part759 = // "Pattern{Constant('from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' [ with key ID '), Field(fld2,true), Constant(' ]')}" +match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); + +var all154 = all_match({ + processors: [ + part758, + dup375, + part759, + ], + on_success: processor_chain([ + dup201, + dup29, + dup30, + dup31, + dup32, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg444 = msg("00026:08", all154); + +var part760 = // "Pattern{Constant('IPSec tunnel on int '), Field(interface,true), Constant(' with tunnel ID '), Field(fld2,true), Constant(' received a packet with a bad SPI.')}" +match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg445 = msg("00026:09", part760); + +var part761 = // "Pattern{Constant('SSH: '), Field(p0,false)}" +match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); + +var part762 = // "Pattern{Constant('Failed '), Field(p0,false)}" +match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); + +var part763 = // "Pattern{Constant('Attempt '), Field(p0,false)}" +match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); + +var select174 = linear_select([ + part762, + part763, +]); + +var part764 = // "Pattern{Constant('bind duplicate '), Field(p0,false)}" +match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); + +var select175 = linear_select([ + part764, + dup203, +]); + +var part765 = // "Pattern{Constant('admin user ''), Field(administrator,false), Constant('' (Key ID '), Field(fld2,false), Constant(')')}" +match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); + +var all155 = all_match({ + processors: [ + part761, + select174, + dup103, + select175, + dup204, + dup376, + part765, + ], + on_success: processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg446 = msg("00026:10", all155); + +var part766 = // "Pattern{Constant('SSH: Maximum number of PKA keys ('), Field(fld2,false), Constant(') has been bound to user ''), Field(username,false), Constant('' Key not bound. (Key ID '), Field(fld3,false), Constant(')')}" +match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg447 = msg("00026:11", part766); + +var part767 = // "Pattern{Constant('IKE '), Field(fld2,false), Constant(': Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed')}" +match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg448 = msg("00026:12", part767); + +var select176 = linear_select([ + msg435, + msg436, + msg437, + msg438, + msg439, + msg440, + msg441, + msg442, + msg443, + msg444, + msg445, + msg446, + msg447, + msg448, +]); + +var part768 = // "Pattern{Constant('user '), Field(username,true), Constant(' from '), Field(p0,false)}" +match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); + +var part769 = // "Pattern{Constant('IP address '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); + +var part770 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); + +var part771 = // "Pattern{Constant('console'), Field(,false)}" +match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); + +var select177 = linear_select([ + part769, + part770, + part771, +]); + +var all156 = all_match({ + processors: [ + dup206, + dup377, + part768, + select177, + ], + on_success: processor_chain([ + dup208, + dup30, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg449 = msg("00027", all156); + +var part772 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to default port '), Field(change_new,false), Constant('. '), Field(info,false)}" +match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg450 = msg("00027:01", part772); + +var part773 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('. '), Field(info,false)}" +match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg451 = msg("00027:02", part773); + +var part774 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to port '), Field(change_new,false), Constant('. '), Field(info,false)}" +match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg452 = msg("00027:03", part774); + +var part775 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to port '), Field(change_new,false)}" +match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg453 = msg("00027:04", part775); + +var part776 = // "Pattern{Constant('ScreenOS '), Field(version,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); + +var part777 = // "Pattern{Constant('Serial '), Field(p0,false)}" +match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); + +var part778 = // "Pattern{Constant('serial '), Field(p0,false)}" +match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); + +var select178 = linear_select([ + part777, + part778, +]); + +var part779 = // "Pattern{Constant('# '), Field(fld2,false), Constant(': Asset recovery '), Field(p0,false)}" +match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); + +var part780 = // "Pattern{Constant('performed '), Field(p0,false)}" +match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); + +var select179 = linear_select([ + part780, + dup127, +]); + +var select180 = linear_select([ + dup209, + dup210, +]); + +var all157 = all_match({ + processors: [ + part776, + select178, + part779, + select179, + dup23, + select180, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg454 = msg("00027:05", all157); + +var part781 = // "Pattern{Constant('Device Reset (Asset Recovery) has been '), Field(p0,false)}" +match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); + +var select181 = linear_select([ + dup210, + dup209, +]); + +var all158 = all_match({ + processors: [ + part781, + select181, + ], + on_success: processor_chain([ + setc("eventcategory","1606000000"), + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg455 = msg("00027:06", all158); + +var part782 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('. '), Field(info,false)}" +match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg456 = msg("00027:07", part782); + +var part783 = // "Pattern{Constant('System configuration has been erased'), Field(,false)}" +match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg457 = msg("00027:08", part783); + +var part784 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' is due to expire in '), Field(fld3,false), Constant('.')}" +match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg458 = msg("00027:09", part784); + +var part785 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' has expired.')}" +match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg459 = msg("00027:10", part785); + +var part786 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' expired after 30-day grace period.')}" +match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg460 = msg("00027:11", part786); + +var part787 = // "Pattern{Constant('Request to retrieve license key failed to reach '), Field(p0,false)}" +match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); + +var part788 = // "Pattern{Constant('the server '), Field(p0,false)}" +match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); + +var select182 = linear_select([ + part788, + dup195, +]); + +var part789 = // "Pattern{Constant('by '), Field(fld2,false), Constant('. Server url: '), Field(url,false)}" +match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); + +var all159 = all_match({ + processors: [ + part787, + select182, + part789, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg461 = msg("00027:12", all159); + +var part790 = // "Pattern{Constant('user '), Field(username,false)}" +match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); + +var all160 = all_match({ + processors: [ + dup206, + dup377, + part790, + ], + on_success: processor_chain([ + dup208, + dup30, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg462 = msg("00027:13", all160); + +var part791 = // "Pattern{Constant('Configuration Erasure Process '), Field(p0,false)}" +match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); + +var part792 = // "Pattern{Constant('has been initiated '), Field(p0,false)}" +match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); + +var part793 = // "Pattern{Constant('aborted '), Field(p0,false)}" +match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); + +var select183 = linear_select([ + part792, + part793, +]); + +var part794 = // "Pattern{Constant('.'), Field(space,false), Constant('('), Field(fld1,false), Constant(')')}" +match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); + +var all161 = all_match({ + processors: [ + part791, + select183, + part794, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg463 = msg("00027:14", all161); + +var part795 = // "Pattern{Constant('Waiting for 2nd confirmation. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg464 = msg("00027:15", part795); + +var part796 = // "Pattern{Constant('Admin '), Field(fld3,true), Constant(' policy id '), Field(policy_id,true), Constant(' name "'), Field(fld2,true), Constant(' has been re-enabled by NetScreen system after being locked due to excessive failed login attempts ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg465 = msg("00027:16", part796); + +var part797 = // "Pattern{Constant('Admin '), Field(username,true), Constant(' is locked and will be unlocked after '), Field(duration,true), Constant(' minutes ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg466 = msg("00027:17", part797); + +var part798 = // "Pattern{Constant('Login attempt by admin '), Field(username,true), Constant(' from '), Field(saddr,true), Constant(' is refused as this account is locked ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg467 = msg("00027:18", part798); + +var part799 = // "Pattern{Constant('Admin '), Field(username,true), Constant(' has been re-enabled by NetScreen system after being locked due to excessive failed login attempts ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg468 = msg("00027:19", part799); + +var select184 = linear_select([ + msg449, + msg450, + msg451, + msg452, + msg453, + msg454, + msg455, + msg456, + msg457, + msg458, + msg459, + msg460, + msg461, + msg462, + msg463, + msg464, + msg465, + msg466, + msg467, + msg468, +]); + +var part800 = // "Pattern{Constant('An Intruder'), Field(p0,false)}" +match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); + +var part801 = // "Pattern{Constant('Intruder'), Field(p0,false)}" +match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); + +var part802 = // "Pattern{Constant('An intruter'), Field(p0,false)}" +match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); + +var select185 = linear_select([ + part800, + part801, + part802, +]); + +var part803 = // "Pattern{Field(,false), Constant('has attempted to connect to the NetScreen-Global PRO port! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); + +var all162 = all_match({ + processors: [ + select185, + part803, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + setc("signame","Attempt to Connect to the NetScreen-Global Port"), + ]), +}); + +var msg469 = msg("00028", all162); + +var part804 = // "Pattern{Constant('DNS has been refreshed'), Field(,false)}" +match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg470 = msg("00029", part804); + +var part805 = // "Pattern{Constant('DHCP file write: out of memory.'), Field(,false)}" +match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ + dup186, + dup2, + dup3, + dup4, + dup5, +])); + +var msg471 = msg("00029:01", part805); + +var part806 = // "Pattern{Constant('The DHCP process cannot open file '), Field(fld2,true), Constant(' to '), Field(p0,false)}" +match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); + +var part807 = // "Pattern{Constant('read '), Field(p0,false)}" +match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); + +var part808 = // "Pattern{Constant('write '), Field(p0,false)}" +match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); + +var select186 = linear_select([ + part807, + part808, +]); + +var part809 = // "Pattern{Constant('data.'), Field(,false)}" +match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); + +var all163 = all_match({ + processors: [ + part806, + select186, + part809, + ], + on_success: processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg472 = msg("00029:02", all163); + +var part810 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is full. Unable to '), Field(p0,false)}" +match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); + +var part811 = // "Pattern{Constant('commit '), Field(p0,false)}" +match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); + +var part812 = // "Pattern{Constant('offer '), Field(p0,false)}" +match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); + +var select187 = linear_select([ + part811, + part812, +]); + +var part813 = // "Pattern{Constant('IP address to client at '), Field(fld2,false)}" +match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); + +var all164 = all_match({ + processors: [ + dup212, + dup339, + part810, + select187, + part813, + ], + on_success: processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg473 = msg("00029:03", all164); + +var part814 = // "Pattern{Constant('DHCP server set to OFF on '), Field(interface,true), Constant(' (another server found on '), Field(hostip,false), Constant(').')}" +match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg474 = msg("00029:04", part814); + +var select188 = linear_select([ + msg470, + msg471, + msg472, + msg473, + msg474, +]); + +var part815 = // "Pattern{Constant('CA configuration is invalid'), Field(,false)}" +match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg475 = msg("00030", part815); + +var part816 = // "Pattern{Constant('DSS checking of CRLs has been changed from '), Field(p0,false)}" +match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); + +var part817 = // "Pattern{Constant('0 to 1'), Field(,false)}" +match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); + +var part818 = // "Pattern{Constant('1 to 0'), Field(,false)}" +match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); + +var select189 = linear_select([ + part817, + part818, +]); + +var all165 = all_match({ + processors: [ + part816, + select189, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg476 = msg("00030:01", all165); + +var part819 = // "Pattern{Constant('For the X509 certificate '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg477 = msg("00030:05", part819); + +var part820 = // "Pattern{Constant('In the X509 certificate request the '), Field(fld2,true), Constant(' field has been changed from '), Field(fld3,false)}" +match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg478 = msg("00030:06", part820); + +var part821 = // "Pattern{Constant('RA X509 certificate cannot be loaded'), Field(,false)}" +match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg479 = msg("00030:07", part821); + +var part822 = // "Pattern{Constant('Self-signed X509 certificate cannot be generated'), Field(,false)}" +match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg480 = msg("00030:10", part822); + +var part823 = // "Pattern{Constant('The public key for ScreenOS image has successfully been updated'), Field(,false)}" +match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg481 = msg("00030:12", part823); + +var part824 = // "Pattern{Constant('The public key used for ScreenOS image authentication cannot be '), Field(p0,false)}" +match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); + +var part825 = // "Pattern{Constant('decoded'), Field(,false)}" +match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); + +var part826 = // "Pattern{Constant('loaded'), Field(,false)}" +match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); + +var select190 = linear_select([ + part825, + part826, +]); + +var all166 = all_match({ + processors: [ + part824, + select190, + ], + on_success: processor_chain([ + dup35, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg482 = msg("00030:13", all166); + +var part827 = // "Pattern{Constant('CA IDENT '), Field(p0,false)}" +match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); + +var part828 = // "Pattern{Constant('Challenge password '), Field(p0,false)}" +match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); + +var part829 = // "Pattern{Constant('CA CGI URL '), Field(p0,false)}" +match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); + +var part830 = // "Pattern{Constant('RA CGI URL '), Field(p0,false)}" +match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); + +var select191 = linear_select([ + part827, + part828, + part829, + part830, +]); + +var part831 = // "Pattern{Constant('for SCEP '), Field(p0,false)}" +match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); + +var part832 = // "Pattern{Constant('requests '), Field(p0,false)}" +match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); + +var select192 = linear_select([ + part832, + dup16, +]); + +var part833 = // "Pattern{Constant('has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); + +var all167 = all_match({ + processors: [ + dup55, + select191, + part831, + select192, + part833, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg483 = msg("00030:14", all167); + +var msg484 = msg("00030:02", dup378); + +var part834 = // "Pattern{Constant('X509 certificate for ScreenOS image authentication is invalid'), Field(,false)}" +match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg485 = msg("00030:15", part834); + +var part835 = // "Pattern{Constant('X509 certificate has been deleted'), Field(,false)}" +match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg486 = msg("00030:16", part835); + +var part836 = // "Pattern{Constant('PKI CRL: no revoke info accept per config DN '), Field(interface,false), Constant('.')}" +match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg487 = msg("00030:18", part836); + +var part837 = // "Pattern{Constant('PKI: A configurable item '), Field(change_attribute,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); + +var part838 = // "Pattern{Constant('mode '), Field(p0,false)}" +match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); + +var part839 = // "Pattern{Constant('field'), Field(p0,false)}" +match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); + +var select193 = linear_select([ + part838, + part839, +]); + +var part840 = // "Pattern{Field(,false), Constant('has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); + +var all168 = all_match({ + processors: [ + part837, + select193, + part840, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg488 = msg("00030:19", all168); + +var part841 = // "Pattern{Constant('PKI: NSRP cold sync start for total of '), Field(fld2,true), Constant(' items.')}" +match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg489 = msg("00030:30", part841); + +var part842 = // "Pattern{Constant('PKI: NSRP sync received cold sync item '), Field(fld2,true), Constant(' out of order expect '), Field(fld3,true), Constant(' of '), Field(fld4,false), Constant('.')}" +match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg490 = msg("00030:31", part842); + +var part843 = // "Pattern{Constant('PKI: NSRP sync received cold sync item '), Field(fld2,true), Constant(' without first item.')}" +match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg491 = msg("00030:32", part843); + +var part844 = // "Pattern{Constant('PKI: NSRP sync received normal item during cold sync.'), Field(,false)}" +match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg492 = msg("00030:33", part844); + +var part845 = // "Pattern{Constant('PKI: The CRL '), Field(policy_id,true), Constant(' is deleted.')}" +match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg493 = msg("00030:34", part845); + +var part846 = // "Pattern{Constant('PKI: The NSRP high availability synchronization '), Field(fld2,true), Constant(' failed.')}" +match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg494 = msg("00030:35", part846); + +var part847 = // "Pattern{Constant('PKI: The '), Field(change_attribute,true), Constant(' has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" +match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg495 = msg("00030:36", part847); + +var part848 = // "Pattern{Constant('PKI: The X.509 certificate for the ScreenOS image authentication is invalid.'), Field(,false)}" +match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg496 = msg("00030:37", part848); + +var part849 = // "Pattern{Constant('PKI: The X.509 local certificate cannot be sync to vsd member.'), Field(,false)}" +match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg497 = msg("00030:38", part849); + +var part850 = // "Pattern{Constant('PKI: The X.509 certificate '), Field(p0,false)}" +match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); + +var part851 = // "Pattern{Constant('revocation list '), Field(p0,false)}" +match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); + +var select194 = linear_select([ + part851, + dup16, +]); + +var part852 = // "Pattern{Constant('cannot be loaded during NSRP synchronization.'), Field(,false)}" +match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); + +var all169 = all_match({ + processors: [ + part850, + select194, + part852, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg498 = msg("00030:39", all169); + +var part853 = // "Pattern{Constant('X509 '), Field(p0,false)}" +match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); + +var part854 = // "Pattern{Constant('cannot be loaded'), Field(,false)}" +match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); + +var all170 = all_match({ + processors: [ + part853, + dup379, + part854, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg499 = msg("00030:17", all170); + +var part855 = // "Pattern{Constant('PKI: The certificate '), Field(fld2,true), Constant(' will expire '), Field(p0,false)}" +match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); + +var part856 = // "Pattern{Constant('please '), Field(p0,false)}" +match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); + +var select195 = linear_select([ + dup216, + part856, +]); + +var part857 = // "Pattern{Constant('renew.'), Field(,false)}" +match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); + +var all171 = all_match({ + processors: [ + part855, + select195, + part857, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg500 = msg("00030:40", all171); + +var part858 = // "Pattern{Constant('PKI: The certificate revocation list has expired issued by certificate authority '), Field(fld2,false), Constant('.')}" +match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg501 = msg("00030:41", part858); + +var part859 = // "Pattern{Constant('PKI: The configuration content of certificate authority '), Field(fld2,true), Constant(' is not valid.')}" +match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg502 = msg("00030:42", part859); + +var part860 = // "Pattern{Constant('PKI: The device cannot allocate this object id number '), Field(fld2,false), Constant('.')}" +match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg503 = msg("00030:43", part860); + +var part861 = // "Pattern{Constant('PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].'), Field(,false)}" +match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg504 = msg("00030:44", part861); + +var part862 = // "Pattern{Constant('PKI: The device cannot find the PKI object '), Field(fld2,true), Constant(' during cold sync.')}" +match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg505 = msg("00030:45", part862); + +var part863 = // "Pattern{Constant('PKI: The device cannot load X.509 certificate onto the device certificate '), Field(fld2,false), Constant('.')}" +match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg506 = msg("00030:46", part863); + +var part864 = // "Pattern{Constant('PKI: The device cannot load a certificate pending SCEP completion.'), Field(,false)}" +match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg507 = msg("00030:47", part864); + +var part865 = // "Pattern{Constant('PKI: The device cannot load an X.509 certificate revocation list (CRL).'), Field(,false)}" +match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg508 = msg("00030:48", part865); + +var part866 = // "Pattern{Constant('PKI: The device cannot load the CA certificate received through SCEP.'), Field(,false)}" +match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg509 = msg("00030:49", part866); + +var part867 = // "Pattern{Constant('PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.'), Field(,false)}" +match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg510 = msg("00030:50", part867); + +var part868 = // "Pattern{Constant('PKI: The device cannot load the X.509 local certificate received through SCEP.'), Field(,false)}" +match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg511 = msg("00030:51", part868); + +var part869 = // "Pattern{Constant('PKI: The device cannot load the X.509 '), Field(product,true), Constant(' during boot.')}" +match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg512 = msg("00030:52", part869); + +var part870 = // "Pattern{Constant('PKI: The device cannot load the X.509 certificate file.'), Field(,false)}" +match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg513 = msg("00030:53", part870); + +var part871 = // "Pattern{Constant('PKI: The device completed the coldsync of the PKI object at '), Field(fld2,true), Constant(' attempt.')}" +match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ + dup44, + dup213, + dup31, + dup2, + dup3, + dup4, + dup5, +])); + +var msg514 = msg("00030:54", part871); + +var part872 = // "Pattern{Constant('PKI: The device could not generate '), Field(p0,false)}" +match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); + +var all172 = all_match({ + processors: [ + part872, + dup380, + dup219, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg515 = msg("00030:55", all172); + +var part873 = // "Pattern{Constant('PKI: The device detected an invalid RSA key.'), Field(,false)}" +match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg516 = msg("00030:56", part873); + +var part874 = // "Pattern{Constant('PKI: The device detected an invalid digital signature algorithm (DSA) key.'), Field(,false)}" +match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ + dup35, + dup220, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg517 = msg("00030:57", part874); + +var part875 = // "Pattern{Constant('PKI: The device failed to coldsync the PKI object at '), Field(fld2,true), Constant(' attempt.')}" +match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ + dup86, + dup220, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg518 = msg("00030:58", part875); + +var part876 = // "Pattern{Constant('PKI: The device failed to decode the public key of the image'), Field(p0,false)}" +match("MESSAGE#512:00030:59/0", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{p0}"); + +var part877 = // "Pattern{Constant('s signer certificate.'), Field(,false)}" +match("MESSAGE#512:00030:59/2", "nwparser.p0", "s signer certificate.%{}"); + +var all173 = all_match({ + processors: [ + part876, + dup363, + part877, + ], + on_success: processor_chain([ + dup35, + dup220, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg519 = msg("00030:59", all173); + +var part878 = // "Pattern{Constant('PKI: The device failed to install the RSA key.'), Field(,false)}" +match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ + dup35, + dup220, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg520 = msg("00030:60", part878); + +var part879 = // "Pattern{Constant('PKI: The device failed to retrieve the pending certificate '), Field(fld2,false), Constant('.')}" +match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg521 = msg("00030:61", part879); + +var part880 = // "Pattern{Constant('PKI: The device failed to save the certificate authority related configuration.'), Field(,false)}" +match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg522 = msg("00030:62", part880); + +var part881 = // "Pattern{Constant('PKI: The device failed to store the authority configuration.'), Field(,false)}" +match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ + dup18, + dup221, + dup51, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg523 = msg("00030:63", part881); + +var part882 = // "Pattern{Constant('PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.'), Field(,false)}" +match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ + dup18, + dup220, + dup51, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg524 = msg("00030:64", part882); + +var part883 = // "Pattern{Constant('PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.'), Field(,false)}" +match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ + dup18, + dup220, + dup51, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg525 = msg("00030:65", part883); + +var part884 = // "Pattern{Constant('PKI: The device has detected an invalid X.509 object attribute '), Field(fld2,false), Constant('.')}" +match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg526 = msg("00030:66", part884); + +var part885 = // "Pattern{Constant('PKI: The device has detected invalid X.509 object content.'), Field(,false)}" +match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg527 = msg("00030:67", part885); + +var part886 = // "Pattern{Constant('PKI: The device has failed to load an invalid X.509 object.'), Field(,false)}" +match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg528 = msg("00030:68", part886); + +var part887 = // "Pattern{Constant('PKI: The device is loading the version 0 PKI data.'), Field(,false)}" +match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg529 = msg("00030:69", part887); + +var part888 = // "Pattern{Constant('PKI: The device successfully generated a new '), Field(p0,false)}" +match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); + +var all174 = all_match({ + processors: [ + part888, + dup380, + dup219, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg530 = msg("00030:70", all174); + +var part889 = // "Pattern{Constant('PKI: The public key of image'), Field(p0,false)}" +match("MESSAGE#524:00030:71/0", "nwparser.payload", "PKI: The public key of image%{p0}"); + +var part890 = // "Pattern{Constant('s signer has been loaded successfully, for future image authentication.'), Field(,false)}" +match("MESSAGE#524:00030:71/2", "nwparser.p0", "s signer has been loaded successfully, for future image authentication.%{}"); + +var all175 = all_match({ + processors: [ + part889, + dup363, + part890, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg531 = msg("00030:71", all175); + +var part891 = // "Pattern{Constant('PKI: The signature of the image'), Field(p0,false)}" +match("MESSAGE#525:00030:72/0", "nwparser.payload", "PKI: The signature of the image%{p0}"); + +var part892 = // "Pattern{Constant('s signer certificate cannot be verified.'), Field(,false)}" +match("MESSAGE#525:00030:72/2", "nwparser.p0", "s signer certificate cannot be verified.%{}"); + +var all176 = all_match({ + processors: [ + part891, + dup363, + part892, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg532 = msg("00030:72", all176); + +var part893 = // "Pattern{Constant('PKI: The '), Field(p0,false)}" +match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); + +var part894 = // "Pattern{Constant('file name '), Field(p0,false)}" +match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); + +var part895 = // "Pattern{Constant('friendly name of a certificate '), Field(p0,false)}" +match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); + +var part896 = // "Pattern{Constant('vsys name '), Field(p0,false)}" +match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); + +var select196 = linear_select([ + part894, + part895, + part896, +]); + +var part897 = // "Pattern{Constant('is too long '), Field(fld2,true), Constant(' to do NSRP synchronization allowed '), Field(fld3,false), Constant('.')}" +match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); + +var all177 = all_match({ + processors: [ + part893, + select196, + part897, + ], + on_success: processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg533 = msg("00030:73", all177); + +var part898 = // "Pattern{Constant('PKI: Upgrade from earlier version save to file.'), Field(,false)}" +match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg534 = msg("00030:74", part898); + +var part899 = // "Pattern{Constant('PKI: X.509 certificate has been deleted distinguished name '), Field(username,false), Constant('.')}" +match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg535 = msg("00030:75", part899); + +var part900 = // "Pattern{Constant('PKI: X.509 '), Field(p0,false)}" +match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); + +var part901 = // "Pattern{Constant('file has been loaded successfully filename '), Field(fld2,false), Constant('.')}" +match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); + +var all178 = all_match({ + processors: [ + part900, + dup379, + part901, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg536 = msg("00030:76", all178); + +var part902 = // "Pattern{Constant('PKI: failed to install DSA key.'), Field(,false)}" +match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ + dup18, + dup220, + dup51, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg537 = msg("00030:77", part902); + +var part903 = // "Pattern{Constant('PKI: no FQDN available when requesting certificate.'), Field(,false)}" +match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ + dup35, + dup213, + dup222, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg538 = msg("00030:78", part903); + +var part904 = // "Pattern{Constant('PKI: no cert revocation check per config DN '), Field(username,false), Constant('.')}" +match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ + dup35, + dup213, + dup222, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg539 = msg("00030:79", part904); + +var part905 = // "Pattern{Constant('PKI: no nsrp sync for pre 2.5 objects.'), Field(,false)}" +match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg540 = msg("00030:80", part905); + +var part906 = // "Pattern{Constant('X509 certificate with subject name '), Field(fld2,true), Constant(' is deleted.')}" +match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg541 = msg("00030:81", part906); + +var part907 = // "Pattern{Constant('create new authcfg for CA '), Field(fld2,false)}" +match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg542 = msg("00030:82", part907); + +var part908 = // "Pattern{Constant('loadCert: Cannot acquire authcfg for this CA cert '), Field(fld2,false), Constant('.')}" +match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ + dup35, + dup213, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg543 = msg("00030:83", part908); + +var part909 = // "Pattern{Constant('upgrade to 4.0 copy authcfg from global.'), Field(,false)}" +match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg544 = msg("00030:84", part909); + +var part910 = // "Pattern{Constant('System CPU utilization is high ('), Field(fld2,true), Constant(' alarm threshold: '), Field(trigger_val,false), Constant(') '), Field(info,false)}" +match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ + setc("eventcategory","1603080000"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg545 = msg("00030:85", part910); + +var part911 = // "Pattern{Constant('Pair-wise invoked by started after key generation. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); + +var all179 = all_match({ + processors: [ + dup223, + dup381, + part911, + ], + on_success: processor_chain([ + dup225, + dup2, + dup4, + dup5, + dup9, + ]), +}); + +var msg546 = msg("00030:86", all179); + +var part912 = // "Pattern{Constant('SYSTEM CPU utilization is high ('), Field(fld2,true), Constant(' > '), Field(fld3,true), Constant(' ) '), Field(fld4,true), Constant(' times in '), Field(fld5,true), Constant(' minute ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" +match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + dup9, +])); + +var msg547 = msg("00030:87", part912); + +var part913 = // "Pattern{Constant('Pair-wise invoked by passed. ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" +match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); + +var all180 = all_match({ + processors: [ + dup223, + dup381, + part913, + ], + on_success: processor_chain([ + dup225, + dup2, + dup4, + dup5, + dup9, + ]), +}); + +var msg548 = msg("00030:88", all180); + +var select197 = linear_select([ + msg475, + msg476, + msg477, + msg478, + msg479, + msg480, + msg481, + msg482, + msg483, + msg484, + msg485, + msg486, + msg487, + msg488, + msg489, + msg490, + msg491, + msg492, + msg493, + msg494, + msg495, + msg496, + msg497, + msg498, + msg499, + msg500, + msg501, + msg502, + msg503, + msg504, + msg505, + msg506, + msg507, + msg508, + msg509, + msg510, + msg511, + msg512, + msg513, + msg514, + msg515, + msg516, + msg517, + msg518, + msg519, + msg520, + msg521, + msg522, + msg523, + msg524, + msg525, + msg526, + msg527, + msg528, + msg529, + msg530, + msg531, + msg532, + msg533, + msg534, + msg535, + msg536, + msg537, + msg538, + msg539, + msg540, + msg541, + msg542, + msg543, + msg544, + msg545, + msg546, + msg547, + msg548, +]); + +var part914 = // "Pattern{Constant('ARP detected IP conflict: IP address '), Field(hostip,true), Constant(' changed from '), Field(sinterface,true), Constant(' to interface '), Field(dinterface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ + dup121, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg549 = msg("00031:13", part914); + +var part915 = // "Pattern{Constant('SNMP AuthenTraps have been '), Field(disposition,false)}" +match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg550 = msg("00031", part915); + +var part916 = // "Pattern{Constant('SNMP VPN has been '), Field(disposition,false)}" +match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg551 = msg("00031:01", part916); + +var part917 = // "Pattern{Constant('SNMP community '), Field(fld2,true), Constant(' attributes-write access '), Field(p0,false)}" +match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); + +var part918 = // "Pattern{Constant('; receive traps '), Field(p0,false)}" +match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); + +var part919 = // "Pattern{Constant('; receive traffic alarms '), Field(p0,false)}" +match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); + +var part920 = // "Pattern{Constant('-have been modified'), Field(,false)}" +match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); + +var all181 = all_match({ + processors: [ + part917, + dup382, + part918, + dup382, + part919, + dup382, + part920, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg552 = msg("00031:02", all181); + +var part921 = // "Pattern{Field(fld2,true), Constant(' SNMP host '), Field(hostip,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); + +var select198 = linear_select([ + dup130, + dup129, +]); + +var part922 = // "Pattern{Constant('SNMP community '), Field(fld3,false)}" +match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); + +var all182 = all_match({ + processors: [ + part921, + select198, + part922, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg553 = msg("00031:03", all182); + +var part923 = // "Pattern{Constant('SNMP '), Field(p0,false)}" +match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); + +var part924 = // "Pattern{Constant('contact '), Field(p0,false)}" +match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); + +var select199 = linear_select([ + part924, + dup228, +]); + +var part925 = // "Pattern{Constant('description has been modified'), Field(,false)}" +match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); + +var all183 = all_match({ + processors: [ + part923, + select199, + part925, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg554 = msg("00031:04", all183); + +var part926 = // "Pattern{Constant('SNMP system '), Field(p0,false)}" +match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); + +var select200 = linear_select([ + dup228, + dup25, +]); + +var part927 = // "Pattern{Constant('has been changed to '), Field(fld2,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); + +var all184 = all_match({ + processors: [ + part926, + select200, + part927, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg555 = msg("00031:11", all184); + +var part928 = // "Pattern{Field(fld2,false), Constant(': SNMP community name "'), Field(fld3,false), Constant('" '), Field(p0,false)}" +match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); + +var part929 = // "Pattern{Constant('attributes -- '), Field(p0,false)}" +match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); + +var part930 = // "Pattern{Constant('-- '), Field(p0,false)}" +match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); + +var select201 = linear_select([ + part929, + part930, +]); + +var part931 = // "Pattern{Constant('write access, '), Field(p0,false)}" +match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); + +var part932 = // "Pattern{Constant('; receive traps, '), Field(p0,false)}" +match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); + +var part933 = // "Pattern{Constant('; receive traffic alarms, '), Field(p0,false)}" +match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); + +var part934 = // "Pattern{Constant('-'), Field(p0,false)}" +match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); + +var part935 = // "Pattern{Constant('- '), Field(p0,false)}" +match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); + +var select202 = linear_select([ + part935, + dup96, +]); + +var part936 = // "Pattern{Constant('have been modified'), Field(,false)}" +match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); + +var all185 = all_match({ + processors: [ + part928, + select201, + part931, + dup382, + part932, + dup382, + part933, + dup382, + part934, + select202, + part936, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg556 = msg("00031:08", all185); + +var part937 = // "Pattern{Constant('Detect IP conflict ('), Field(fld2,false), Constant(') on '), Field(p0,false)}" +match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); + +var all186 = all_match({ + processors: [ + part937, + dup339, + dup229, + ], + on_success: processor_chain([ + dup121, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg557 = msg("00031:05", all186); + +var part938 = // "Pattern{Constant('q, '), Field(p0,false)}" +match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); + +var select203 = linear_select([ + part938, + dup231, + dup232, +]); + +var part939 = // "Pattern{Constant('detect IP conflict ( '), Field(hostip,true), Constant(' )'), Field(p0,false)}" +match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); + +var select204 = linear_select([ + dup105, + dup96, +]); + +var part940 = // "Pattern{Constant('mac'), Field(p0,false)}" +match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); + +var part941 = // "Pattern{Constant(''), Field(macaddr,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); + +var all187 = all_match({ + processors: [ + dup230, + select203, + part939, + select204, + part940, + dup358, + part941, + dup354, + dup23, + dup383, + ], + on_success: processor_chain([ + dup121, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg558 = msg("00031:06", all187); + +var part942 = // "Pattern{Constant('detects a duplicate virtual security device group master IP address '), Field(hostip,false), Constant(', MAC address '), Field(macaddr,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); + +var all188 = all_match({ + processors: [ + dup230, + dup384, + part942, + dup339, + dup229, + ], + on_success: processor_chain([ + dup121, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg559 = msg("00031:07", all188); + +var part943 = // "Pattern{Constant('detected an IP conflict (IP '), Field(hostip,false), Constant(', MAC '), Field(macaddr,false), Constant(') on interface '), Field(p0,false)}" +match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); + +var all189 = all_match({ + processors: [ + dup230, + dup384, + part943, + dup383, + ], + on_success: processor_chain([ + dup121, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg560 = msg("00031:09", all189); + +var part944 = // "Pattern{Field(fld2,false), Constant(': SNMP community "'), Field(fld3,false), Constant('" has been moved. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg561 = msg("00031:10", part944); + +var part945 = // "Pattern{Field(fld2,true), Constant(' system contact has been changed to '), Field(fld3,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg562 = msg("00031:12", part945); + +var select205 = linear_select([ + msg549, + msg550, + msg551, + msg552, + msg553, + msg554, + msg555, + msg556, + msg557, + msg558, + msg559, + msg560, + msg561, + msg562, +]); + +var part946 = // "Pattern{Field(signame,true), Constant(' has been detected and blocked! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup234, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg563 = msg("00032", part946); + +var part947 = // "Pattern{Field(signame,true), Constant(' has been detected and blocked! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false)}" +match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ + dup234, + dup2, + dup3, + dup4, + dup5, + dup61, +])); + +var msg564 = msg("00032:01", part947); + +var part948 = // "Pattern{Constant('Vsys '), Field(fld2,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); + +var part949 = // "Pattern{Constant('changed to '), Field(fld3,false)}" +match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); + +var part950 = // "Pattern{Constant('created'), Field(,false)}" +match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); + +var part951 = // "Pattern{Constant('deleted'), Field(,false)}" +match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); + +var part952 = // "Pattern{Constant('removed'), Field(,false)}" +match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); + +var select206 = linear_select([ + part949, + part950, + part951, + part952, +]); + +var all190 = all_match({ + processors: [ + part948, + select206, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg565 = msg("00032:03", all190); + +var part953 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup234, + dup2, + dup3, + dup4, + dup59, + dup5, + dup61, +])); + +var msg566 = msg("00032:04", part953); + +var part954 = // "Pattern{Field(change_attribute,true), Constant(' for vsys '), Field(fld2,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg567 = msg("00032:05", part954); + +var msg568 = msg("00032:02", dup378); + +var select207 = linear_select([ + msg563, + msg564, + msg565, + msg566, + msg567, + msg568, +]); + +var part955 = // "Pattern{Constant('NSM has been '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("agent","NSM"), +])); + +var msg569 = msg("00033:25", part955); + +var part956 = // "Pattern{Constant('timeout value has been '), Field(p0,false)}" +match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); + +var part957 = // "Pattern{Constant('returned'), Field(p0,false)}" +match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); + +var select208 = linear_select([ + dup52, + part957, +]); + +var part958 = // "Pattern{Field(,false), Constant('to '), Field(fld2,false)}" +match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); + +var all191 = all_match({ + processors: [ + dup385, + part956, + select208, + part958, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg570 = msg("00033", all191); + +var part959 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" +match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); + +var part960 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); + +var select209 = linear_select([ + part959, + part960, +]); + +var part961 = // "Pattern{Constant('host has been set to '), Field(fld4,false)}" +match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); + +var all192 = all_match({ + processors: [ + dup162, + select209, + dup23, + dup372, + part961, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg571 = msg("00033:03", all192); + +var part962 = // "Pattern{Constant('host has been '), Field(disposition,false)}" +match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); + +var all193 = all_match({ + processors: [ + dup385, + dup23, + dup372, + part962, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg572 = msg("00033:02", all193); + +var part963 = // "Pattern{Constant('Reporting of '), Field(fld2,true), Constant(' to '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg573 = msg("00033:04", part963); + +var part964 = // "Pattern{Constant('Global PRO has been '), Field(disposition,false)}" +match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg574 = msg("00033:05", part964); + +var part965 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('. The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ + dup27, + dup2, + dup3, + dup59, + dup4, + dup5, + dup61, +])); + +var msg575 = msg("00033:06", part965); + +var part966 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('. The threshold was exceeded '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ + dup27, + dup2, + dup3, + setc("dclass_counter1_string","Number of times the threshold was exceeded"), + dup4, + dup5, + dup61, +])); + +var msg576 = msg("00033:01", part966); + +var part967 = // "Pattern{Constant('User-defined service '), Field(service,true), Constant(' has been '), Field(disposition,true), Constant(' from '), Field(fld2,true), Constant(' distribution')}" +match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg577 = msg("00033:07", part967); + +var part968 = // "Pattern{Constant('?s CA certificate field has not been specified.'), Field(,false)}" +match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); + +var all194 = all_match({ + processors: [ + dup237, + dup386, + part968, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg578 = msg("00033:08", all194); + +var part969 = // "Pattern{Constant('?s Cert-Subject field has not been specified.'), Field(,false)}" +match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); + +var all195 = all_match({ + processors: [ + dup237, + dup386, + part969, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg579 = msg("00033:09", all195); + +var part970 = // "Pattern{Constant('?s host field has been '), Field(p0,false)}" +match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); + +var part971 = // "Pattern{Constant('set to '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); + +var select210 = linear_select([ + part971, + dup240, +]); + +var all196 = all_match({ + processors: [ + dup237, + dup386, + part970, + select210, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg580 = msg("00033:10", all196); + +var part972 = // "Pattern{Constant('?s outgoing interface used to report NACN to Policy Manager '), Field(p0,false)}" +match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); + +var part973 = // "Pattern{Constant('has not been specified.'), Field(,false)}" +match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); + +var all197 = all_match({ + processors: [ + dup237, + dup386, + part972, + dup386, + part973, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg581 = msg("00033:11", all197); + +var part974 = // "Pattern{Constant('?s password field has been '), Field(p0,false)}" +match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); + +var select211 = linear_select([ + dup101, + dup240, +]); + +var all198 = all_match({ + processors: [ + dup237, + dup386, + part974, + select211, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg582 = msg("00033:12", all198); + +var part975 = // "Pattern{Constant('?s policy-domain field has been '), Field(p0,false)}" +match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); + +var part976 = // "Pattern{Constant('unset .'), Field(,false)}" +match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); + +var part977 = // "Pattern{Constant('set to '), Field(domain,false), Constant('.')}" +match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); + +var select212 = linear_select([ + part976, + part977, +]); + +var all199 = all_match({ + processors: [ + dup237, + dup386, + part975, + select212, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg583 = msg("00033:13", all199); + +var part978 = // "Pattern{Constant('?s CA certificate field has been set to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); + +var all200 = all_match({ + processors: [ + dup237, + dup386, + part978, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg584 = msg("00033:14", all200); + +var part979 = // "Pattern{Constant('?s Cert-Subject field has been set to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); + +var all201 = all_match({ + processors: [ + dup237, + dup386, + part979, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg585 = msg("00033:15", all201); + +var part980 = // "Pattern{Constant('?s outgoing-interface field has been set to '), Field(interface,false), Constant('.')}" +match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); + +var all202 = all_match({ + processors: [ + dup237, + dup386, + part980, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg586 = msg("00033:16", all202); + +var part981 = // "Pattern{Constant('?s port field has been '), Field(p0,false)}" +match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); + +var part982 = // "Pattern{Constant('set to '), Field(network_port,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); + +var part983 = // "Pattern{Constant('reset to the default value '), Field(p0,false)}" +match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); + +var select213 = linear_select([ + part982, + part983, +]); + +var all203 = all_match({ + processors: [ + dup237, + dup386, + part981, + select213, + dup116, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg587 = msg("00033:17", all203); + +var part984 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(p0,false)}" +match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); + +var part985 = // "Pattern{Field(fld99,false), Constant('arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' time.')}" +match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); + +var all204 = all_match({ + processors: [ + part984, + dup341, + dup70, + dup342, + part985, + ], + on_success: processor_chain([ + dup27, + dup2, + dup4, + dup5, + dup3, + dup59, + dup61, + ]), +}); + +var msg588 = msg("00033:19", all204); + +var part986 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' time.')}" +match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ + dup27, + dup2, + dup4, + dup5, + dup3, + dup59, + dup60, +])); + +var msg589 = msg("00033:20", part986); + +var all205 = all_match({ + processors: [ + dup241, + dup345, + dup83, + ], + on_success: processor_chain([ + dup27, + dup2, + dup9, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg590 = msg("00033:21", all205); + +var part987 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var all206 = all_match({ + processors: [ + part987, + dup345, + dup83, + ], + on_success: processor_chain([ + dup27, + dup2, + dup9, + dup59, + dup3, + dup4, + dup5, + dup60, + ]), +}); + +var msg591 = msg("00033:22", all206); + +var part988 = // "Pattern{Constant('NSM primary server with name '), Field(hostname,true), Constant(' was set: addr '), Field(hostip,false), Constant(', port '), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg592 = msg("00033:23", part988); + +var part989 = // "Pattern{Constant('session threshold From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(info,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ + setc("eventcategory","1001030500"), + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg593 = msg("00033:24", part989); + +var select214 = linear_select([ + msg569, + msg570, + msg571, + msg572, + msg573, + msg574, + msg575, + msg576, + msg577, + msg578, + msg579, + msg580, + msg581, + msg582, + msg583, + msg584, + msg585, + msg586, + msg587, + msg588, + msg589, + msg590, + msg591, + msg592, + msg593, +]); + +var part990 = // "Pattern{Constant('SCS: Failed '), Field(p0,false)}" +match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); + +var part991 = // "Pattern{Constant('Failed '), Field(p0,false)}" +match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); + +var select215 = linear_select([ + part990, + part991, +]); + +var part992 = // "Pattern{Constant('bind '), Field(p0,false)}" +match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); + +var part993 = // "Pattern{Constant('retrieve '), Field(p0,false)}" +match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); + +var select216 = linear_select([ + part992, + dup203, + part993, +]); + +var select217 = linear_select([ + dup198, + dup103, + dup165, +]); + +var part994 = // "Pattern{Constant('SSH user '), Field(username,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" +match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); + +var all207 = all_match({ + processors: [ + select215, + dup103, + select216, + dup204, + select217, + part994, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg594 = msg("00034", all207); + +var part995 = // "Pattern{Constant('SCS: Incompatible '), Field(p0,false)}" +match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); + +var part996 = // "Pattern{Constant('Incompatible '), Field(p0,false)}" +match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); + +var select218 = linear_select([ + part995, + part996, +]); + +var part997 = // "Pattern{Constant('SSH version '), Field(version,true), Constant(' has been received from '), Field(p0,false)}" +match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); + +var part998 = // "Pattern{Constant('the SSH '), Field(p0,false)}" +match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); + +var select219 = linear_select([ + part998, + dup243, +]); + +var part999 = // "Pattern{Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); + +var all208 = all_match({ + processors: [ + select218, + part997, + select219, + part999, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg595 = msg("00034:01", all208); + +var part1000 = // "Pattern{Constant('Maximum number of SCS sessions '), Field(fld2,true), Constant(' has been reached. Connection request from SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been '), Field(disposition,false)}" +match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg596 = msg("00034:02", part1000); + +var part1001 = // "Pattern{Constant('device failed to authenticate the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); + +var all209 = all_match({ + processors: [ + dup387, + part1001, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg597 = msg("00034:03", all209); + +var part1002 = // "Pattern{Constant('SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" +match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg598 = msg("00034:04", part1002); + +var part1003 = // "Pattern{Constant('NetScreen device failed to generate a PKA RSA challenge for SSH user '), Field(username,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" +match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg599 = msg("00034:05", part1003); + +var part1004 = // "Pattern{Constant('device failed to '), Field(p0,false)}" +match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); + +var part1005 = // "Pattern{Constant('identify itself '), Field(p0,false)}" +match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); + +var part1006 = // "Pattern{Constant('send the identification string '), Field(p0,false)}" +match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); + +var select220 = linear_select([ + part1005, + part1006, +]); + +var part1007 = // "Pattern{Constant('to the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); + +var all210 = all_match({ + processors: [ + dup387, + part1004, + select220, + part1007, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg600 = msg("00034:06", all210); + +var part1008 = // "Pattern{Constant('SCS connection has been terminated for admin user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg601 = msg("00034:07", part1008); + +var part1009 = // "Pattern{Constant('SCS: SCS has been '), Field(disposition,true), Constant(' for '), Field(username,true), Constant(' with '), Field(fld2,true), Constant(' existing PKA keys already bound to '), Field(fld3,true), Constant(' SSH users.')}" +match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg602 = msg("00034:08", part1009); + +var part1010 = // "Pattern{Constant('SCS has been '), Field(disposition,true), Constant(' for '), Field(username,true), Constant(' with '), Field(fld2,true), Constant(' PKA keys already bound to '), Field(fld3,true), Constant(' SSH users')}" +match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg603 = msg("00034:09", part1010); + +var part1011 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" +match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); + +var part1012 = // "Pattern{Constant(''), Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); + +var part1013 = // "Pattern{Constant('with'), Field(p0,false)}" +match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); + +var part1014 = // "Pattern{Constant('at'), Field(p0,false)}" +match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); + +var select221 = linear_select([ + part1013, + part1014, +]); + +var part1015 = // "Pattern{Field(,false), Constant('IP '), Field(hostip,true), Constant(' but '), Field(disposition,true), Constant(' because '), Field(result,false)}" +match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); + +var all211 = all_match({ + processors: [ + dup246, + dup388, + part1011, + dup354, + part1012, + select221, + part1015, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg604 = msg("00034:10", all211); + +var part1016 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" +match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); + +var part1017 = // "Pattern{Constant('but '), Field(disposition,true), Constant(' because '), Field(result,false)}" +match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); + +var all212 = all_match({ + processors: [ + dup246, + dup388, + part1016, + dup389, + part1017, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg605 = msg("00034:12", all212); + +var part1018 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection to '), Field(p0,false)}" +match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); + +var part1019 = // "Pattern{Constant('because '), Field(result,false)}" +match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); + +var all213 = all_match({ + processors: [ + dup246, + dup388, + part1018, + dup389, + part1019, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg606 = msg("00034:11", all213); + +var part1020 = // "Pattern{Constant('SSH client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection because '), Field(result,false)}" +match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg607 = msg("00034:15", part1020); + +var part1021 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' cannot log in via SCS to '), Field(service,true), Constant(' using the shared '), Field(interface,true), Constant(' interface because '), Field(result,false)}" +match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); + +var all214 = all_match({ + processors: [ + dup246, + dup390, + part1021, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg608 = msg("00034:18", all214); + +var part1022 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' the PKA RSA challenge')}" +match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); + +var all215 = all_match({ + processors: [ + dup246, + dup390, + part1022, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg609 = msg("00034:20", all215); + +var part1023 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has requested '), Field(p0,false)}" +match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); + +var part1024 = // "Pattern{Constant('authentication which is not '), Field(p0,false)}" +match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); + +var part1025 = // "Pattern{Constant('supported '), Field(p0,false)}" +match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); + +var select222 = linear_select([ + part1025, + dup156, +]); + +var part1026 = // "Pattern{Constant('for that '), Field(p0,false)}" +match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); + +var part1027 = // "Pattern{Constant('client'), Field(,false)}" +match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); + +var part1028 = // "Pattern{Constant('user'), Field(,false)}" +match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); + +var select223 = linear_select([ + part1027, + part1028, +]); + +var all216 = all_match({ + processors: [ + dup246, + dup390, + part1023, + dup375, + part1024, + select222, + part1026, + select223, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg610 = msg("00034:21", all216); + +var part1029 = // "Pattern{Constant('SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has unsuccessfully attempted to log in via SCS to vsys '), Field(fld2,true), Constant(' using the shared untrusted interface')}" +match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg611 = msg("00034:22", part1029); + +var part1030 = // "Pattern{Constant('SCS: Unable '), Field(p0,false)}" +match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); + +var part1031 = // "Pattern{Constant('Unable '), Field(p0,false)}" +match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); + +var select224 = linear_select([ + part1030, + part1031, +]); + +var part1032 = // "Pattern{Constant('to validate cookie from the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); + +var all217 = all_match({ + processors: [ + dup162, + select224, + part1032, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg612 = msg("00034:23", all217); + +var part1033 = // "Pattern{Constant('AC '), Field(username,true), Constant(' is advertising URL '), Field(fld2,false)}" +match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg613 = msg("00034:24", part1033); + +var part1034 = // "Pattern{Constant('Message from AC '), Field(username,false), Constant(': '), Field(fld2,false)}" +match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg614 = msg("00034:25", part1034); + +var part1035 = // "Pattern{Constant('PPPoE Settings changed'), Field(,false)}" +match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg615 = msg("00034:26", part1035); + +var part1036 = // "Pattern{Constant('PPPoE is '), Field(disposition,true), Constant(' on '), Field(interface,true), Constant(' interface')}" +match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg616 = msg("00034:27", part1036); + +var part1037 = // "Pattern{Constant('PPPoE'), Field(p0,false)}" +match("MESSAGE#608:00034:28/0", "nwparser.payload", "PPPoE%{p0}"); + +var part1038 = // "Pattern{Constant('s session closed by AC'), Field(,false)}" +match("MESSAGE#608:00034:28/2", "nwparser.p0", "s session closed by AC%{}"); + +var all218 = all_match({ + processors: [ + part1037, + dup363, + part1038, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg617 = msg("00034:28", all218); + +var part1039 = // "Pattern{Constant('SCS: Disabled for '), Field(username,false), Constant('. Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg618 = msg("00034:29", part1039); + +var part1040 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to remove PKA key removed.')}" +match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg619 = msg("00034:30", part1040); + +var part1041 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to retrieve host key')}" +match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg620 = msg("00034:31", part1041); + +var part1042 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to send identification string to client host at '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" +match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg621 = msg("00034:32", part1042); + +var part1043 = // "Pattern{Constant('SCS: Max '), Field(fld2,true), Constant(' sessions reached unabel to accept connection : '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg622 = msg("00034:33", part1043); + +var part1044 = // "Pattern{Constant('SCS: Maximum number for SCS sessions '), Field(fld2,true), Constant(' has been reached. Connection request from SSH user at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg623 = msg("00034:34", part1044); + +var part1045 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has unsuccessfully attempted to log in via SCS to '), Field(service,true), Constant(' using the shared untrusted interface because SCS is disabled on that interface.')}" +match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg624 = msg("00034:35", part1045); + +var part1046 = // "Pattern{Constant('SCS: Unsupported cipher type '), Field(fld2,true), Constant(' requested from: '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg625 = msg("00034:36", part1046); + +var part1047 = // "Pattern{Constant('The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed'), Field(,false)}" +match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg626 = msg("00034:37", part1047); + +var part1048 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to retreive PKA key bound to SSH user '), Field(username,true), Constant(' (Key ID '), Field(fld2,false), Constant(')')}" +match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg627 = msg("00034:38", part1048); + +var part1049 = // "Pattern{Constant('SSH: Error processing packet from host '), Field(saddr,true), Constant(' (Code '), Field(fld2,false), Constant(')')}" +match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg628 = msg("00034:39", part1049); + +var part1050 = // "Pattern{Constant('SSH: Device failed to send initialization string to client at '), Field(saddr,false)}" +match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg629 = msg("00034:40", part1050); + +var part1051 = // "Pattern{Constant('SCP: Admin user ''), Field(administrator,false), Constant('' attempted to transfer file '), Field(p0,false)}" +match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); + +var part1052 = // "Pattern{Constant('the device with insufficient privilege.'), Field(,false)}" +match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); + +var all219 = all_match({ + processors: [ + part1051, + dup376, + part1052, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg630 = msg("00034:41", all219); + +var part1053 = // "Pattern{Constant('SSH: Maximum number of SSH sessions ('), Field(fld2,false), Constant(') exceeded. Connection request from SSH user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' denied.')}" +match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg631 = msg("00034:42", part1053); + +var part1054 = // "Pattern{Constant('Ethernet driver ran out of rx bd (port '), Field(network_port,false), Constant(')')}" +match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg632 = msg("00034:43", part1054); + +var part1055 = // "Pattern{Constant('Potential replay attack detected on SSH connection initiated from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg633 = msg("00034:44", part1055); + +var select225 = linear_select([ + msg594, + msg595, + msg596, + msg597, + msg598, + msg599, + msg600, + msg601, + msg602, + msg603, + msg604, + msg605, + msg606, + msg607, + msg608, + msg609, + msg610, + msg611, + msg612, + msg613, + msg614, + msg615, + msg616, + msg617, + msg618, + msg619, + msg620, + msg621, + msg622, + msg623, + msg624, + msg625, + msg626, + msg627, + msg628, + msg629, + msg630, + msg631, + msg632, + msg633, +]); + +var part1056 = // "Pattern{Constant('PKI Verify Error: '), Field(resultcode,false), Constant(':'), Field(result,false)}" +match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg634 = msg("00035", part1056); + +var part1057 = // "Pattern{Constant('SSL - Error MessageID in incoming mail - '), Field(fld2,false)}" +match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg635 = msg("00035:01", part1057); + +var part1058 = // "Pattern{Constant('SSL - cipher type '), Field(fld2,true), Constant(' is not allowed in export or firewall only system')}" +match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg636 = msg("00035:02", part1058); + +var part1059 = // "Pattern{Constant('SSL CA changed'), Field(,false)}" +match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg637 = msg("00035:03", part1059); + +var part1060 = // "Pattern{Constant('SSL Error when retrieve local c'), Field(p0,false)}" +match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); + +var part1061 = // "Pattern{Constant('a(verify) '), Field(p0,false)}" +match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); + +var part1062 = // "Pattern{Constant('ert(verify) '), Field(p0,false)}" +match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); + +var part1063 = // "Pattern{Constant('ert(all) '), Field(p0,false)}" +match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); + +var select226 = linear_select([ + part1061, + part1062, + part1063, +]); + +var part1064 = // "Pattern{Constant(': '), Field(fld2,false)}" +match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); + +var all220 = all_match({ + processors: [ + part1060, + select226, + part1064, + ], + on_success: processor_chain([ + dup117, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg638 = msg("00035:04", all220); + +var part1065 = // "Pattern{Constant('SSL No ssl context. Not ready for connections.'), Field(,false)}" +match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg639 = msg("00035:05", part1065); + +var part1066 = // "Pattern{Constant('SSL c'), Field(p0,false)}" +match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); + +var part1067 = // "Pattern{Constant('changed to none'), Field(,false)}" +match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); + +var all221 = all_match({ + processors: [ + part1066, + dup391, + part1067, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg640 = msg("00035:06", all221); + +var part1068 = // "Pattern{Constant('SSL cert subject mismatch: '), Field(fld2,true), Constant(' recieved '), Field(fld3,true), Constant(' is expected')}" +match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg641 = msg("00035:07", part1068); + +var part1069 = // "Pattern{Constant('SSL certificate changed'), Field(,false)}" +match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg642 = msg("00035:08", part1069); + +var part1070 = // "Pattern{Constant('enabled'), Field(,false)}" +match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); + +var select227 = linear_select([ + part1070, + dup92, +]); + +var all222 = all_match({ + processors: [ + dup255, + select227, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg643 = msg("00035:09", all222); + +var part1071 = // "Pattern{Constant('SSL memory allocation fails in process_c'), Field(p0,false)}" +match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); + +var part1072 = // "Pattern{Constant('a()'), Field(,false)}" +match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); + +var part1073 = // "Pattern{Constant('ert()'), Field(,false)}" +match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); + +var select228 = linear_select([ + part1072, + part1073, +]); + +var all223 = all_match({ + processors: [ + part1071, + select228, + ], + on_success: processor_chain([ + dup186, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg644 = msg("00035:10", all223); + +var part1074 = // "Pattern{Constant('SSL no ssl c'), Field(p0,false)}" +match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); + +var part1075 = // "Pattern{Constant('a'), Field(,false)}" +match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); + +var part1076 = // "Pattern{Constant('ert'), Field(,false)}" +match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); + +var select229 = linear_select([ + part1075, + part1076, +]); + +var all224 = all_match({ + processors: [ + part1074, + select229, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg645 = msg("00035:11", all224); + +var part1077 = // "Pattern{Constant('SSL set c'), Field(p0,false)}" +match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); + +var part1078 = // "Pattern{Constant('id is invalid '), Field(fld2,false)}" +match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); + +var all225 = all_match({ + processors: [ + part1077, + dup391, + part1078, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg646 = msg("00035:12", all225); + +var part1079 = // "Pattern{Constant('verify '), Field(p0,false)}" +match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); + +var select230 = linear_select([ + dup101, + part1079, +]); + +var part1080 = // "Pattern{Constant('cert failed. Key type is not RSA'), Field(,false)}" +match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); + +var all226 = all_match({ + processors: [ + dup255, + select230, + part1080, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg647 = msg("00035:13", all226); + +var part1081 = // "Pattern{Constant('SSL ssl context init failed'), Field(,false)}" +match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg648 = msg("00035:14", part1081); + +var part1082 = // "Pattern{Field(change_attribute,true), Constant(' has been changed '), Field(p0,false)}" +match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); + +var part1083 = // "Pattern{Constant('from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); + +var part1084 = // "Pattern{Constant('to '), Field(fld2,false)}" +match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); + +var select231 = linear_select([ + part1083, + part1084, +]); + +var all227 = all_match({ + processors: [ + part1082, + select231, + ], + on_success: processor_chain([ + dup186, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg649 = msg("00035:15", all227); + +var part1085 = // "Pattern{Constant('web SSL certificate changed to by '), Field(username,true), Constant(' via web from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(fld5,false)}" +match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg650 = msg("00035:16", part1085); + +var select232 = linear_select([ + msg634, + msg635, + msg636, + msg637, + msg638, + msg639, + msg640, + msg641, + msg642, + msg643, + msg644, + msg645, + msg646, + msg647, + msg648, + msg649, + msg650, +]); + +var part1086 = // "Pattern{Constant('An optional ScreenOS feature has been activated via a software key'), Field(,false)}" +match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg651 = msg("00036", part1086); + +var part1087 = // "Pattern{Field(fld2,true), Constant(' license keys were updated successfully by '), Field(p0,false)}" +match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); + +var part1088 = // "Pattern{Constant('manual '), Field(p0,false)}" +match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); + +var select233 = linear_select([ + dup216, + part1088, +]); + +var part1089 = // "Pattern{Constant('retrieval'), Field(,false)}" +match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); + +var all228 = all_match({ + processors: [ + part1087, + select233, + part1089, + ], + on_success: processor_chain([ + dup256, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg652 = msg("00036:01", all228); + +var select234 = linear_select([ + msg651, + msg652, +]); + +var part1090 = // "Pattern{Constant('Intra-zone block for zone '), Field(zone,true), Constant(' was set to o'), Field(p0,false)}" +match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); + +var part1091 = // "Pattern{Constant('n'), Field(,false)}" +match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); + +var part1092 = // "Pattern{Constant('ff'), Field(,false)}" +match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); + +var select235 = linear_select([ + part1091, + part1092, +]); + +var all229 = all_match({ + processors: [ + part1090, + select235, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg653 = msg("00037", all229); + +var part1093 = // "Pattern{Constant('New zone '), Field(zone,true), Constant(' ( '), Field(p0,false)}" +match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); + +var select236 = linear_select([ + dup257, + dup258, +]); + +var part1094 = // "Pattern{Constant(''), Field(fld2,false), Constant(') was created.'), Field(p0,false)}" +match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); + +var all230 = all_match({ + processors: [ + part1093, + select236, + part1094, + dup353, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg654 = msg("00037:01", all230); + +var part1095 = // "Pattern{Constant('Tunnel zone '), Field(src_zone,true), Constant(' was bound to out zone '), Field(dst_zone,false), Constant('.')}" +match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg655 = msg("00037:02", part1095); + +var part1096 = // "Pattern{Constant('was was '), Field(p0,false)}" +match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); + +var part1097 = // "Pattern{Field(zone,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); + +var select237 = linear_select([ + part1096, + part1097, +]); + +var part1098 = // "Pattern{Constant('virtual router '), Field(p0,false)}" +match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); + +var part1099 = // "Pattern{Field(node,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); + +var part1100 = // "Pattern{Field(node,false), Constant('.')}" +match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); + +var select238 = linear_select([ + part1099, + part1100, +]); + +var all231 = all_match({ + processors: [ + dup113, + select237, + dup374, + part1098, + select238, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg656 = msg("00037:03", all231); + +var part1101 = // "Pattern{Constant('Zone '), Field(zone,true), Constant(' was changed to non-shared.')}" +match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg657 = msg("00037:04", part1101); + +var part1102 = // "Pattern{Constant('Zone '), Field(zone,true), Constant(' ( '), Field(p0,false)}" +match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); + +var select239 = linear_select([ + dup258, + dup257, +]); + +var part1103 = // "Pattern{Constant(''), Field(fld2,false), Constant(') was deleted. '), Field(p0,false)}" +match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); + +var part1104 = // "Pattern{Field(space,false)}" +match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); + +var select240 = linear_select([ + dup10, + part1104, +]); + +var all232 = all_match({ + processors: [ + part1102, + select239, + part1103, + select240, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg658 = msg("00037:05", all232); + +var part1105 = // "Pattern{Constant('IP/TCP reassembly for ALG was '), Field(disposition,true), Constant(' on zone '), Field(zone,false), Constant('.')}" +match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg659 = msg("00037:06", part1105); + +var select241 = linear_select([ + msg653, + msg654, + msg655, + msg656, + msg657, + msg658, + msg659, +]); + +var part1106 = // "Pattern{Constant('OSPF routing instance in vrouter '), Field(p0,false)}" +match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); + +var part1107 = // "Pattern{Field(node,true), Constant(' is '), Field(p0,false)}" +match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); + +var part1108 = // "Pattern{Field(node,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); + +var select242 = linear_select([ + part1107, + part1108, +]); + +var all233 = all_match({ + processors: [ + part1106, + select242, + dup36, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg660 = msg("00038", all233); + +var part1109 = // "Pattern{Constant('BGP instance name created for vr '), Field(node,false)}" +match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg661 = msg("00039", part1109); + +var part1110 = // "Pattern{Constant('Low watermark'), Field(p0,false)}" +match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); + +var part1111 = // "Pattern{Constant('High watermark'), Field(p0,false)}" +match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); + +var select243 = linear_select([ + part1110, + part1111, +]); + +var part1112 = // "Pattern{Field(,false), Constant('for early aging has been changed to the default '), Field(fld2,false)}" +match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); + +var all234 = all_match({ + processors: [ + select243, + part1112, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg662 = msg("00040", all234); + +var part1113 = // "Pattern{Constant('VPN ''), Field(group,false), Constant('' from '), Field(daddr,true), Constant(' is '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg663 = msg("00040:01", part1113); + +var select244 = linear_select([ + msg662, + msg663, +]); + +var part1114 = // "Pattern{Constant('A route-map name in virtual router '), Field(node,true), Constant(' has been removed')}" +match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg664 = msg("00041", part1114); + +var part1115 = // "Pattern{Constant('VPN ''), Field(group,false), Constant('' from '), Field(daddr,true), Constant(' is '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg665 = msg("00041:01", part1115); + +var select245 = linear_select([ + msg664, + msg665, +]); + +var part1116 = // "Pattern{Constant('Replay packet detected on IPSec tunnel on '), Field(interface,true), Constant(' with tunnel ID '), Field(fld2,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,false), Constant(', '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg666 = msg("00042", part1116); + +var part1117 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup9, + dup4, + dup5, + dup60, +])); + +var msg667 = msg("00042:01", part1117); + +var select246 = linear_select([ + msg666, + msg667, +]); + +var part1118 = // "Pattern{Constant('Receive StopCCN_msg, remove l2tp tunnel ('), Field(fld2,false), Constant('-'), Field(fld3,false), Constant('), Result code '), Field(resultcode,true), Constant(' ('), Field(result,false), Constant('). ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg668 = msg("00043", part1118); + +var part1119 = // "Pattern{Constant('access list '), Field(listnum,true), Constant(' sequence number '), Field(fld3,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); + +var part1120 = // "Pattern{Constant('deny '), Field(p0,false)}" +match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); + +var select247 = linear_select([ + dup259, + part1120, +]); + +var part1121 = // "Pattern{Constant('ip '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' '), Field(disposition,true), Constant(' in vrouter '), Field(node,false)}" +match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); + +var all235 = all_match({ + processors: [ + part1119, + select247, + part1121, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg669 = msg("00044", all235); + +var part1122 = // "Pattern{Constant('access list '), Field(listnum,true), Constant(' '), Field(disposition,true), Constant(' in vrouter '), Field(node,false), Constant('.')}" +match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg670 = msg("00044:01", part1122); + +var select248 = linear_select([ + msg669, + msg670, +]); + +var part1123 = // "Pattern{Constant('RIP instance in virtual router '), Field(node,true), Constant(' was '), Field(disposition,false), Constant('.')}" +match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg671 = msg("00045", part1123); + +var part1124 = // "Pattern{Constant('remove '), Field(p0,false)}" +match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); + +var part1125 = // "Pattern{Constant('add '), Field(p0,false)}" +match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); + +var select249 = linear_select([ + part1124, + part1125, +]); + +var part1126 = // "Pattern{Constant('multicast policy from '), Field(src_zone,true), Constant(' '), Field(fld4,true), Constant(' to '), Field(dst_zone,true), Constant(' '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); + +var all236 = all_match({ + processors: [ + dup185, + select249, + part1126, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg672 = msg("00047", all236); + +var part1127 = // "Pattern{Constant('Access list entry '), Field(listnum,true), Constant(' with '), Field(p0,false)}" +match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); + +var part1128 = // "Pattern{Constant('a sequence '), Field(p0,false)}" +match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); + +var part1129 = // "Pattern{Constant('sequence '), Field(p0,false)}" +match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); + +var select250 = linear_select([ + part1128, + part1129, +]); + +var part1130 = // "Pattern{Constant('number '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); + +var part1131 = // "Pattern{Constant('with an action of '), Field(p0,false)}" +match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); + +var select251 = linear_select([ + part1131, + dup112, +]); + +var part1132 = // "Pattern{Constant('with an IP '), Field(p0,false)}" +match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); + +var select252 = linear_select([ + part1132, + dup139, +]); + +var part1133 = // "Pattern{Constant('address '), Field(p0,false)}" +match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); + +var part1134 = // "Pattern{Constant('and subnetwork mask of '), Field(p0,false)}" +match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); + +var select253 = linear_select([ + part1134, + dup16, +]); + +var part1135 = // "Pattern{Field(,true), Constant(' '), Field(fld3,false), Constant('was '), Field(p0,false)}" +match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); + +var part1136 = // "Pattern{Constant('created on '), Field(p0,false)}" +match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); + +var select254 = linear_select([ + part1136, + dup129, +]); + +var part1137 = // "Pattern{Constant('virtual router '), Field(node,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); + +var all237 = all_match({ + processors: [ + part1127, + select250, + part1130, + select251, + dup259, + select252, + part1133, + select253, + part1135, + select254, + part1137, + ], + on_success: processor_chain([ + setc("eventcategory","1501000000"), + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg673 = msg("00048", all237); + +var part1138 = // "Pattern{Constant('Route '), Field(p0,false)}" +match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); + +var part1139 = // "Pattern{Constant('map entry '), Field(p0,false)}" +match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); + +var part1140 = // "Pattern{Constant('entry '), Field(p0,false)}" +match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); + +var select255 = linear_select([ + part1139, + part1140, +]); + +var part1141 = // "Pattern{Constant('with sequence number '), Field(fld2,true), Constant(' in route map binck-ospf'), Field(p0,false)}" +match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); + +var part1142 = // "Pattern{Constant(' in '), Field(p0,false)}" +match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); + +var select256 = linear_select([ + part1142, + dup105, +]); + +var part1143 = // "Pattern{Constant('virtual router '), Field(node,true), Constant(' was '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); + +var all238 = all_match({ + processors: [ + part1138, + select255, + part1141, + select256, + part1143, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg674 = msg("00048:01", all238); + +var part1144 = // "Pattern{Field(space,false), Constant('set match interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ + dup211, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg675 = msg("00048:02", part1144); + +var select257 = linear_select([ + msg673, + msg674, + msg675, +]); + +var part1145 = // "Pattern{Constant('Route-lookup preference changed to '), Field(fld8,true), Constant(' ('), Field(fld2,false), Constant(') => '), Field(fld3,true), Constant(' ('), Field(fld4,false), Constant(') => '), Field(fld5,true), Constant(' ('), Field(fld6,false), Constant(') in virtual router ('), Field(node,false), Constant(')')}" +match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg676 = msg("00049", part1145); + +var part1146 = // "Pattern{Constant('SIBR routing '), Field(disposition,true), Constant(' in virtual router '), Field(node,false)}" +match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg677 = msg("00049:01", part1146); + +var part1147 = // "Pattern{Constant('A virtual router with name '), Field(node,true), Constant(' and ID '), Field(fld2,true), Constant(' has been removed')}" +match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg678 = msg("00049:02", part1147); + +var part1148 = // "Pattern{Constant('The router-id of virtual router "'), Field(node,false), Constant('" used by OSPF, BGP routing instances id has been uninitialized. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg679 = msg("00049:03", part1148); + +var part1149 = // "Pattern{Constant('The system default-route through virtual router "'), Field(node,false), Constant('" has been added in virtual router "'), Field(fld4,false), Constant('" ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg680 = msg("00049:04", part1149); + +var part1150 = // "Pattern{Constant('Subnetwork conflict checking for interfaces in virtual router ('), Field(node,false), Constant(') has been enabled. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg681 = msg("00049:05", part1150); + +var select258 = linear_select([ + msg676, + msg677, + msg678, + msg679, + msg680, + msg681, +]); + +var part1151 = // "Pattern{Constant('Track IP enabled ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg682 = msg("00050", part1151); + +var part1152 = // "Pattern{Constant('Session utilization has reached '), Field(fld2,false), Constant(', which is '), Field(fld3,true), Constant(' of the system capacity!')}" +match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg683 = msg("00051", part1152); + +var part1153 = // "Pattern{Constant('AV: Suspicious client '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' used '), Field(fld2,true), Constant(' percent of AV resources, which exceeded the max of '), Field(fld3,true), Constant(' percent.')}" +match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg684 = msg("00052", part1153); + +var part1154 = // "Pattern{Constant('router '), Field(p0,false)}" +match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); + +var select259 = linear_select([ + dup171, + part1154, +]); + +var part1155 = // "Pattern{Constant('instance was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); + +var all239 = all_match({ + processors: [ + dup260, + select259, + part1155, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg685 = msg("00055", all239); + +var part1156 = // "Pattern{Constant('proxy '), Field(p0,false)}" +match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); + +var part1157 = // "Pattern{Constant('function '), Field(p0,false)}" +match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); + +var select260 = linear_select([ + part1156, + part1157, +]); + +var part1158 = // "Pattern{Constant('was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); + +var all240 = all_match({ + processors: [ + dup260, + select260, + part1158, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg686 = msg("00055:01", all240); + +var part1159 = // "Pattern{Constant('same subnet check on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); + +var all241 = all_match({ + processors: [ + dup261, + dup392, + part1159, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg687 = msg("00055:02", all241); + +var part1160 = // "Pattern{Constant('router alert IP option check on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); + +var all242 = all_match({ + processors: [ + dup261, + dup392, + part1160, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg688 = msg("00055:03", all242); + +var part1161 = // "Pattern{Constant('IGMP version was changed to '), Field(version,true), Constant(' on interface '), Field(interface,false)}" +match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg689 = msg("00055:04", part1161); + +var part1162 = // "Pattern{Constant('IGMP query '), Field(p0,false)}" +match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); + +var part1163 = // "Pattern{Constant('max response time '), Field(p0,false)}" +match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); + +var select261 = linear_select([ + dup110, + part1163, +]); + +var part1164 = // "Pattern{Constant('was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false)}" +match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); + +var all243 = all_match({ + processors: [ + part1162, + select261, + part1164, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg690 = msg("00055:05", all243); + +var part1165 = // "Pattern{Constant('IGMP l'), Field(p0,false)}" +match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); + +var part1166 = // "Pattern{Constant('eave '), Field(p0,false)}" +match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); + +var part1167 = // "Pattern{Constant('ast member query '), Field(p0,false)}" +match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); + +var select262 = linear_select([ + part1166, + part1167, +]); + +var part1168 = // "Pattern{Constant('interval was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); + +var all244 = all_match({ + processors: [ + part1165, + select262, + part1168, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg691 = msg("00055:06", all244); + +var part1169 = // "Pattern{Constant('routers '), Field(p0,false)}" +match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); + +var part1170 = // "Pattern{Constant('hosts '), Field(p0,false)}" +match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); + +var part1171 = // "Pattern{Constant('groups '), Field(p0,false)}" +match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); + +var select263 = linear_select([ + part1169, + part1170, + part1171, +]); + +var part1172 = // "Pattern{Constant('accept list ID was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); + +var all245 = all_match({ + processors: [ + dup260, + select263, + part1172, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg692 = msg("00055:07", all245); + +var part1173 = // "Pattern{Constant('all groups '), Field(p0,false)}" +match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); + +var part1174 = // "Pattern{Constant('group '), Field(p0,false)}" +match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); + +var select264 = linear_select([ + part1173, + part1174, +]); + +var part1175 = // "Pattern{Constant(''), Field(group,true), Constant(' static flag was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); + +var all246 = all_match({ + processors: [ + dup260, + select264, + part1175, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg693 = msg("00055:08", all246); + +var part1176 = // "Pattern{Constant('IGMP static group '), Field(group,true), Constant(' was added on interface '), Field(interface,false)}" +match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg694 = msg("00055:09", part1176); + +var part1177 = // "Pattern{Constant('IGMP proxy always is '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" +match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg695 = msg("00055:10", part1177); + +var select265 = linear_select([ + msg685, + msg686, + msg687, + msg688, + msg689, + msg690, + msg691, + msg692, + msg693, + msg694, + msg695, +]); + +var part1178 = // "Pattern{Constant('Remove multicast policy from '), Field(src_zone,true), Constant(' '), Field(saddr,true), Constant(' to '), Field(dst_zone,true), Constant(' '), Field(daddr,false)}" +match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg696 = msg("00056", part1178); + +var part1179 = // "Pattern{Field(fld2,false), Constant(': static multicast route src='), Field(saddr,false), Constant(', grp='), Field(group,true), Constant(' input ifp = '), Field(sinterface,true), Constant(' output ifp = '), Field(dinterface,true), Constant(' added')}" +match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg697 = msg("00057", part1179); + +var part1180 = // "Pattern{Constant('PIMSM protocol configured on interface '), Field(interface,false)}" +match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg698 = msg("00058", part1180); + +var part1181 = // "Pattern{Constant('DDNS module is '), Field(p0,false)}" +match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); + +var part1182 = // "Pattern{Constant('initialized '), Field(p0,false)}" +match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); + +var select266 = linear_select([ + part1182, + dup264, + dup157, + dup156, +]); + +var all247 = all_match({ + processors: [ + part1181, + select266, + dup116, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg699 = msg("00059", all247); + +var part1183 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with server type "'), Field(fld3,false), Constant('" name "'), Field(hostname,false), Constant('" refresh-interval '), Field(fld5,true), Constant(' hours minimum update interval '), Field(fld6,true), Constant(' minutes with '), Field(p0,false)}" +match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); + +var part1184 = // "Pattern{Constant('secure '), Field(p0,false)}" +match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); + +var part1185 = // "Pattern{Constant('clear-text '), Field(p0,false)}" +match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); + +var select267 = linear_select([ + part1184, + part1185, +]); + +var part1186 = // "Pattern{Constant('secure connection.'), Field(,false)}" +match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); + +var all248 = all_match({ + processors: [ + part1183, + select267, + part1186, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg700 = msg("00059:02", all248); + +var part1187 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with user name "'), Field(username,false), Constant('" agent "'), Field(fld3,false), Constant('"')}" +match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg701 = msg("00059:03", part1187); + +var part1188 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with interface "'), Field(interface,false), Constant('" host-name "'), Field(hostname,false), Constant('"')}" +match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg702 = msg("00059:04", part1188); + +var part1189 = // "Pattern{Constant('Hostname '), Field(p0,false)}" +match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); + +var part1190 = // "Pattern{Constant('Source interface '), Field(p0,false)}" +match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); + +var part1191 = // "Pattern{Constant('Username and password '), Field(p0,false)}" +match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); + +var part1192 = // "Pattern{Constant('Server '), Field(p0,false)}" +match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); + +var select268 = linear_select([ + part1189, + part1190, + part1191, + part1192, +]); + +var part1193 = // "Pattern{Constant('of DDNS entry with id '), Field(fld2,true), Constant(' is cleared.')}" +match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); + +var all249 = all_match({ + processors: [ + select268, + part1193, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg703 = msg("00059:05", all249); + +var part1194 = // "Pattern{Constant('Agent of DDNS entry with id '), Field(fld2,true), Constant(' is reset to its default value.')}" +match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg704 = msg("00059:06", part1194); + +var part1195 = // "Pattern{Constant('Updates for DDNS entry with id '), Field(fld2,true), Constant(' are set to be sent in secure ('), Field(protocol,false), Constant(') mode.')}" +match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg705 = msg("00059:07", part1195); + +var part1196 = // "Pattern{Constant('Refresh '), Field(p0,false)}" +match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); + +var part1197 = // "Pattern{Constant('Minimum update '), Field(p0,false)}" +match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); + +var select269 = linear_select([ + part1196, + part1197, +]); + +var part1198 = // "Pattern{Constant('interval of DDNS entry with id '), Field(fld2,true), Constant(' is set to default value ('), Field(fld3,false), Constant(').')}" +match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); + +var all250 = all_match({ + processors: [ + select269, + part1198, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg706 = msg("00059:08", all250); + +var part1199 = // "Pattern{Constant('No-Change '), Field(p0,false)}" +match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); + +var part1200 = // "Pattern{Constant('Error '), Field(p0,false)}" +match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); + +var select270 = linear_select([ + part1199, + part1200, +]); + +var part1201 = // "Pattern{Constant('response received for DDNS entry update for id '), Field(fld2,true), Constant(' user "'), Field(username,false), Constant('" domain "'), Field(domain,false), Constant('" server type " d'), Field(p0,false)}" +match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); + +var part1202 = // "Pattern{Constant('yndns '), Field(p0,false)}" +match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); + +var select271 = linear_select([ + dup263, + part1202, +]); + +var part1203 = // "Pattern{Constant('", server name "'), Field(hostname,false), Constant('"')}" +match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); + +var all251 = all_match({ + processors: [ + dup162, + select270, + part1201, + select271, + part1203, + ], + on_success: processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg707 = msg("00059:09", all251); + +var part1204 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is '), Field(disposition,false), Constant('.')}" +match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg708 = msg("00059:01", part1204); + +var select272 = linear_select([ + msg699, + msg700, + msg701, + msg702, + msg703, + msg704, + msg705, + msg706, + msg707, + msg708, +]); + +var part1205 = // "Pattern{Constant('Track IP IP address '), Field(hostip,true), Constant(' failed. ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Track IP failed"), +])); + +var msg709 = msg("00062:01", part1205); + +var part1206 = // "Pattern{Constant('Track IP failure reached threshold. ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Track IP failure reached threshold"), +])); + +var msg710 = msg("00062:02", part1206); + +var part1207 = // "Pattern{Constant('Track IP IP address '), Field(hostip,true), Constant(' succeeded. ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Track IP succeeded"), +])); + +var msg711 = msg("00062:03", part1207); + +var part1208 = // "Pattern{Constant('HA linkdown'), Field(,false)}" +match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg712 = msg("00062", part1208); + +var select273 = linear_select([ + msg709, + msg710, + msg711, + msg712, +]); + +var part1209 = // "Pattern{Constant('nsrp track-ip ip '), Field(hostip,true), Constant(' '), Field(disposition,false), Constant('!')}" +match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg713 = msg("00063", part1209); + +var part1210 = // "Pattern{Constant('Can not create track-ip list'), Field(,false)}" +match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg714 = msg("00064", part1210); + +var part1211 = // "Pattern{Constant('track ip fail reaches threshold system may fail over!'), Field(,false)}" +match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg715 = msg("00064:01", part1211); + +var part1212 = // "Pattern{Constant('Anti-Spam is detached from policy ID '), Field(policy_id,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ + dup17, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg716 = msg("00064:02", part1212); + +var select274 = linear_select([ + msg714, + msg715, + msg716, +]); + +var msg717 = msg("00070", dup414); + +var part1213 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state from '), Field(fld3,true), Constant(' to '), Field(p0,false)}" +match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); + +var part1214 = // "Pattern{Constant('Init'), Field(,false)}" +match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); + +var part1215 = // "Pattern{Constant('init. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); + +var select275 = linear_select([ + part1214, + part1215, +]); + +var all252 = all_match({ + processors: [ + dup269, + dup394, + part1213, + select275, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg718 = msg("00070:01", all252); + +var part1216 = // "Pattern{Constant('NSRP: nsrp control channel change to '), Field(interface,false)}" +match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg719 = msg("00070:02", part1216); + +var select276 = linear_select([ + msg717, + msg718, + msg719, +]); + +var msg720 = msg("00071", dup414); + +var part1217 = // "Pattern{Constant('The local device '), Field(fld1,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed state')}" +match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg721 = msg("00071:01", part1217); + +var select277 = linear_select([ + msg720, + msg721, +]); + +var msg722 = msg("00072", dup414); + +var msg723 = msg("00072:01", dup415); + +var select278 = linear_select([ + msg722, + msg723, +]); + +var msg724 = msg("00073", dup414); + +var msg725 = msg("00073:01", dup415); + +var select279 = linear_select([ + msg724, + msg725, +]); + +var msg726 = msg("00074", dup395); + +var all253 = all_match({ + processors: [ + dup265, + dup393, + dup273, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg727 = msg("00075", all253); + +var part1218 = // "Pattern{Constant('The local device '), Field(hardware_id,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed state from '), Field(event_state,true), Constant(' to inoperable. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("event_description","local device in the Virtual Security Device group changed state to inoperable"), +])); + +var msg728 = msg("00075:02", part1218); + +var part1219 = // "Pattern{Constant('The local device '), Field(hardware_id,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg729 = msg("00075:01", part1219); + +var select280 = linear_select([ + msg727, + msg728, + msg729, +]); + +var msg730 = msg("00076", dup395); + +var part1220 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' send 2nd path request to unit='), Field(fld3,false)}" +match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); + +var all254 = all_match({ + processors: [ + dup265, + dup393, + part1220, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg731 = msg("00076:01", all254); + +var select281 = linear_select([ + msg730, + msg731, +]); + +var part1221 = // "Pattern{Constant('HA link disconnect. Begin to use second path of HA'), Field(,false)}" +match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, +])); + +var msg732 = msg("00077", part1221); + +var all255 = all_match({ + processors: [ + dup265, + dup393, + dup273, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg733 = msg("00077:01", all255); + +var part1222 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,false)}" +match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ + setc("eventcategory","1607000000"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg734 = msg("00077:02", part1222); + +var select282 = linear_select([ + msg732, + msg733, + msg734, +]); + +var part1223 = // "Pattern{Constant('RTSYNC: NSRP route synchronization is '), Field(disposition,false)}" +match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ + dup274, + dup2, + dup3, + dup4, + dup5, +])); + +var msg735 = msg("00084", part1223); + +var part1224 = // "Pattern{Constant('Failover '), Field(p0,false)}" +match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); + +var part1225 = // "Pattern{Constant('Recovery '), Field(p0,false)}" +match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); + +var select283 = linear_select([ + part1224, + part1225, +]); + +var part1226 = // "Pattern{Constant('untrust interface occurred.'), Field(,false)}" +match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); + +var all256 = all_match({ + processors: [ + select283, + dup103, + dup372, + part1226, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg736 = msg("00090", all256); + +var part1227 = // "Pattern{Constant('A new route cannot be added to the device because the maximum number of system route entries '), Field(fld2,true), Constant(' has been exceeded')}" +match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg737 = msg("00200", part1227); + +var part1228 = // "Pattern{Constant('A route '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' cannot be added to the virtual router '), Field(node,true), Constant(' because the number of route entries in the virtual router exceeds the maximum number of routes '), Field(fld3,true), Constant(' allowed')}" +match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg738 = msg("00201", part1228); + +var part1229 = // "Pattern{Field(fld2,true), Constant(' hello-packet flood from neighbor (ip = '), Field(hostip,true), Constant(' router-id = '), Field(fld3,false), Constant(') on interface '), Field(interface,true), Constant(' packet is dropped')}" +match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ + dup274, + dup2, + dup4, + dup5, + dup3, +])); + +var msg739 = msg("00202", part1229); + +var part1230 = // "Pattern{Field(fld2,true), Constant(' lsa flood on interface '), Field(interface,true), Constant(' has dropped a packet.')}" +match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ + dup274, + dup2, + dup4, + dup5, + dup3, +])); + +var msg740 = msg("00203", part1230); + +var part1231 = // "Pattern{Constant('The total number of redistributed routes into '), Field(p0,false)}" +match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); + +var part1232 = // "Pattern{Constant('BGP '), Field(p0,false)}" +match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); + +var part1233 = // "Pattern{Constant('OSPF '), Field(p0,false)}" +match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); + +var select284 = linear_select([ + part1232, + part1233, +]); + +var part1234 = // "Pattern{Constant('in vrouter '), Field(node,true), Constant(' exceeded system limit ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); + +var all257 = all_match({ + processors: [ + part1231, + select284, + part1234, + ], + on_success: processor_chain([ + dup274, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg741 = msg("00206", all257); + +var part1235 = // "Pattern{Constant('LSA flood in OSPF with router-id '), Field(fld2,true), Constant(' on '), Field(p0,false)}" +match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); + +var part1236 = // "Pattern{Constant(''), Field(interface,true), Constant(' forced the interface to drop a packet.')}" +match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); + +var all258 = all_match({ + processors: [ + part1235, + dup354, + part1236, + ], + on_success: processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg742 = msg("00206:01", all258); + +var part1237 = // "Pattern{Constant('OSPF instance with router-id '), Field(fld3,true), Constant(' received a Hello packet flood from neighbor (IP address '), Field(hostip,false), Constant(', router ID '), Field(fld2,false), Constant(') on '), Field(p0,false)}" +match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); + +var part1238 = // "Pattern{Constant(''), Field(interface,true), Constant(' forcing the interface to drop the packet.')}" +match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); + +var all259 = all_match({ + processors: [ + part1237, + dup354, + part1238, + ], + on_success: processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg743 = msg("00206:02", all259); + +var part1239 = // "Pattern{Constant('Link State Advertisement Id '), Field(fld2,false), Constant(', router ID '), Field(fld3,false), Constant(', type '), Field(fld4,true), Constant(' cannot be deleted from the real-time database in area '), Field(fld5,false)}" +match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg744 = msg("00206:03", part1239); + +var part1240 = // "Pattern{Constant('Reject second OSPF neighbor ('), Field(fld2,false), Constant(') on interface ('), Field(interface,false), Constant(') since it_s configured as point-to-point interface')}" +match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg745 = msg("00206:04", part1240); + +var select285 = linear_select([ + msg741, + msg742, + msg743, + msg744, + msg745, +]); + +var part1241 = // "Pattern{Constant('System wide RIP route limit exceeded, RIP route dropped.'), Field(,false)}" +match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg746 = msg("00207", part1241); + +var part1242 = // "Pattern{Field(fld2,true), Constant(' RIP routes dropped from last system wide RIP route limit exceed.')}" +match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg747 = msg("00207:01", part1242); + +var part1243 = // "Pattern{Constant('RIP database size limit exceeded for '), Field(fld2,false), Constant(', RIP route dropped.')}" +match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg748 = msg("00207:02", part1243); + +var part1244 = // "Pattern{Field(fld2,true), Constant(' RIP routes dropped from the last database size exceed in vr '), Field(fld3,false), Constant('.')}" +match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ + dup275, + dup2, + dup3, + dup4, + dup5, +])); + +var msg749 = msg("00207:03", part1244); + +var select286 = linear_select([ + msg746, + msg747, + msg748, + msg749, +]); + +var part1245 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=outgoing action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" +match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup278, + dup279, + dup280, +])); + +var msg750 = msg("00257", part1245); + +var part1246 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=incoming action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,false)}" +match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup281, + dup278, + dup279, + dup282, +])); + +var msg751 = msg("00257:14", part1246); + +var part1247 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=outgoing action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" +match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, + dup280, +])); + +var msg752 = msg("00257:01", part1247); + +var part1248 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=incoming action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,false)}" +match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup281, + dup284, + dup282, +])); + +var msg753 = msg("00257:15", part1248); + +var part1249 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup278, + dup279, +])); + +var msg754 = msg("00257:02", part1249); + +var part1250 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, +])); + +var msg755 = msg("00257:03", part1250); + +var part1251 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" +match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup278, + dup279, +])); + +var msg756 = msg("00257:04", part1251); + +var part1252 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" +match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, +])); + +var msg757 = msg("00257:05", part1252); + +var part1253 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,true), Constant(' icmp code='), Field(icmpcode,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" +match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); + +var all260 = all_match({ + processors: [ + dup285, + dup396, + part1253, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup284, + ]), +}); + +var msg758 = msg("00257:19", all260); + +var part1254 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); + +var all261 = all_match({ + processors: [ + dup285, + dup396, + part1254, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup284, + ]), +}); + +var msg759 = msg("00257:16", all261); + +var part1255 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); + +var all262 = all_match({ + processors: [ + dup285, + dup396, + part1255, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, + ]), +}); + +var msg760 = msg("00257:17", all262); + +var part1256 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); + +var all263 = all_match({ + processors: [ + dup285, + dup396, + part1256, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, + ]), +}); + +var msg761 = msg("00257:18", all263); + +var part1257 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(p0,false)}" +match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); + +var part1258 = // "Pattern{Field(dport,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); + +var part1259 = // "Pattern{Field(dport,false)}" +match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); + +var select287 = linear_select([ + part1258, + part1259, +]); + +var all264 = all_match({ + processors: [ + part1257, + select287, + ], + on_success: processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup278, + dup279, + ]), +}); + +var msg762 = msg("00257:06", all264); + +var part1260 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup61, + dup284, +])); + +var msg763 = msg("00257:07", part1260); + +var part1261 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' tcp='), Field(icmptype,false)}" +match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup278, + dup279, +])); + +var msg764 = msg("00257:08", part1261); + +var part1262 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(p0,false)}" +match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); + +var part1263 = // "Pattern{Field(icmptype,true), Constant(' icmp code='), Field(icmpcode,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" +match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); + +var part1264 = // "Pattern{Field(icmptype,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); + +var part1265 = // "Pattern{Field(icmptype,false)}" +match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); + +var select288 = linear_select([ + part1263, + part1264, + part1265, +]); + +var all265 = all_match({ + processors: [ + part1262, + select288, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup284, + ]), +}); + +var msg765 = msg("00257:09", all265); + +var part1266 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(p0,false)}" +match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); + +var part1267 = // "Pattern{Field(daddr,true), Constant(' session_id='), Field(sessionid,false)}" +match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); + +var select289 = linear_select([ + part1267, + dup288, +]); + +var all266 = all_match({ + processors: [ + part1266, + select289, + ], + on_success: processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup278, + dup279, + ]), +}); + +var msg766 = msg("00257:10", all266); + +var part1268 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(p0,false)}" +match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); + +var part1269 = // "Pattern{Field(daddr,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" +match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); + +var select290 = linear_select([ + part1269, + dup288, +]); + +var all267 = all_match({ + processors: [ + part1268, + select290, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup284, + ]), +}); + +var msg767 = msg("00257:11", all267); + +var part1270 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' type='), Field(fld3,false)}" +match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup276, + dup277, + dup60, + dup284, +])); + +var msg768 = msg("00257:12", part1270); + +var part1271 = // "Pattern{Constant('start_time="'), Field(fld2,false)}" +match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ + dup283, + dup2, + dup3, + dup276, + dup4, + dup5, +])); + +var msg769 = msg("00257:13", part1271); + +var select291 = linear_select([ + msg750, + msg751, + msg752, + msg753, + msg754, + msg755, + msg756, + msg757, + msg758, + msg759, + msg760, + msg761, + msg762, + msg763, + msg764, + msg765, + msg766, + msg767, + msg768, + msg769, +]); + +var part1272 = // "Pattern{Constant('user '), Field(username,true), Constant(' has logged on via '), Field(p0,false)}" +match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); + +var part1273 = // "Pattern{Constant('the console '), Field(p0,false)}" +match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); + +var select292 = linear_select([ + part1273, + dup291, + dup243, +]); + +var part1274 = // "Pattern{Constant('from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); + +var all268 = all_match({ + processors: [ + dup397, + part1272, + select292, + part1274, + ], + on_success: processor_chain([ + dup28, + dup29, + dup30, + dup31, + dup32, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg770 = msg("00259", all268); + +var part1275 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' has logged out via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); + +var all269 = all_match({ + processors: [ + dup397, + part1275, + ], + on_success: processor_chain([ + dup33, + dup29, + dup34, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg771 = msg("00259:07", all269); + +var part1276 = // "Pattern{Constant('Management session via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for [vsys] admin '), Field(administrator,true), Constant(' has timed out')}" +match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup5, +])); + +var msg772 = msg("00259:01", part1276); + +var part1277 = // "Pattern{Constant('Management session via '), Field(logon_type,true), Constant(' for [ vsys ] admin '), Field(administrator,true), Constant(' has timed out')}" +match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup5, +])); + +var msg773 = msg("00259:02", part1277); + +var part1278 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via the '), Field(logon_type,true), Constant(' has failed')}" +match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ + dup208, + dup29, + dup30, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg774 = msg("00259:03", part1278); + +var part1279 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has failed')}" +match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ + dup208, + dup29, + dup30, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); + +var msg775 = msg("00259:04", part1279); + +var part1280 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log out of the '), Field(p0,false)}" +match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); + +var part1281 = // "Pattern{Constant('Web '), Field(p0,false)}" +match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); + +var select293 = linear_select([ + dup243, + dup291, + part1281, +]); + +var part1282 = // "Pattern{Constant('session on host '), Field(daddr,false), Constant(':'), Field(dport,false)}" +match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); + +var all270 = all_match({ + processors: [ + part1280, + select293, + part1282, + ], + on_success: processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg776 = msg("00259:05", all270); + +var part1283 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log out of the serial console session.')}" +match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup5, +])); + +var msg777 = msg("00259:06", part1283); + +var select294 = linear_select([ + msg770, + msg771, + msg772, + msg773, + msg774, + msg775, + msg776, + msg777, +]); + +var part1284 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been rejected via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup5, +])); + +var msg778 = msg("00262", part1284); + +var part1285 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been accepted via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ + setc("eventcategory","1401050100"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg779 = msg("00263", part1285); + +var part1286 = // "Pattern{Constant('ActiveX control '), Field(p0,false)}" +match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); + +var part1287 = // "Pattern{Constant('JAVA applet '), Field(p0,false)}" +match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); + +var part1288 = // "Pattern{Constant('EXE file '), Field(p0,false)}" +match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); + +var part1289 = // "Pattern{Constant('ZIP file '), Field(p0,false)}" +match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); + +var select295 = linear_select([ + part1286, + part1287, + part1288, + part1289, +]); + +var part1290 = // "Pattern{Constant('has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('. '), Field(info,false)}" +match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); + +var all271 = all_match({ + processors: [ + select295, + part1290, + ], + on_success: processor_chain([ + setc("eventcategory","1003000000"), + dup2, + dup4, + dup5, + dup3, + dup61, + ]), +}); + +var msg780 = msg("00400", all271); + +var part1291 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" +match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ + dup85, + dup2, + dup4, + dup5, + dup3, + dup293, +])); + +var msg781 = msg("00401", part1291); + +var part1292 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" +match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ + dup85, + dup2, + dup4, + dup5, + dup3, + dup294, +])); + +var msg782 = msg("00402", part1292); + +var part1293 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at '), Field(p0,false)}" +match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); + +var part1294 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' in zone '), Field(zone,false), Constant('. '), Field(info,false)}" +match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); + +var all272 = all_match({ + processors: [ + part1293, + dup339, + part1294, + ], + on_success: processor_chain([ + dup85, + dup2, + dup4, + dup5, + dup3, + dup294, + ]), +}); + +var msg783 = msg("00402:01", all272); + +var select296 = linear_select([ + msg782, + msg783, +]); + +var part1295 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" +match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ + dup85, + dup2, + dup4, + dup5, + dup3, + dup293, +])); + +var msg784 = msg("00403", part1295); + +var part1296 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" +match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ + dup147, + dup148, + dup149, + dup150, + dup2, + dup4, + dup5, + dup3, + dup294, +])); + +var msg785 = msg("00404", part1296); + +var part1297 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" +match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ + dup147, + dup2, + dup4, + dup5, + dup3, + dup293, +])); + +var msg786 = msg("00405", part1297); + +var msg787 = msg("00406", dup416); + +var msg788 = msg("00407", dup416); + +var msg789 = msg("00408", dup416); + +var all273 = all_match({ + processors: [ + dup132, + dup345, + dup295, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup60, + ]), +}); + +var msg790 = msg("00409", all273); + +var msg791 = msg("00410", dup416); + +var part1298 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup60, +])); + +var msg792 = msg("00410:01", part1298); + +var select297 = linear_select([ + msg791, + msg792, +]); + +var part1299 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto TCP (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); + +var all274 = all_match({ + processors: [ + part1299, + dup345, + dup295, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg793 = msg("00411", all274); + +var part1300 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at '), Field(p0,false)}" +match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); + +var part1301 = // "Pattern{Field(,true), Constant(' '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); + +var all275 = all_match({ + processors: [ + part1300, + dup339, + part1301, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var msg794 = msg("00413", all275); + +var part1302 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,false), Constant('(zone '), Field(group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); + +var all276 = all_match({ + processors: [ + part1302, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, + dup61, + ]), +}); + +var msg795 = msg("00413:01", all276); + +var part1303 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup59, + dup5, + dup9, +])); + +var msg796 = msg("00413:02", part1303); + +var select298 = linear_select([ + msg794, + msg795, + msg796, +]); + +var part1304 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, +])); + +var msg797 = msg("00414", part1304); + +var part1305 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup3, + dup59, + dup4, + dup5, + dup9, +])); + +var msg798 = msg("00414:01", part1305); + +var select299 = linear_select([ + msg797, + msg798, +]); + +var part1306 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, +])); + +var msg799 = msg("00415", part1306); + +var all277 = all_match({ + processors: [ + dup132, + dup345, + dup296, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup60, + ]), +}); + +var msg800 = msg("00423", all277); + +var all278 = all_match({ + processors: [ + dup80, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup60, + ]), +}); + +var msg801 = msg("00429", all278); + +var all279 = all_match({ + processors: [ + dup132, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup60, + ]), +}); + +var msg802 = msg("00429:01", all279); + +var select300 = linear_select([ + msg801, + msg802, +]); + +var all280 = all_match({ + processors: [ + dup80, + dup345, + dup297, + dup353, + ], + on_success: processor_chain([ + dup85, + dup2, + dup59, + dup3, + dup9, + dup4, + dup5, + dup61, + ]), +}); + +var msg803 = msg("00430", all280); + +var all281 = all_match({ + processors: [ + dup132, + dup345, + dup297, + dup353, + ], + on_success: processor_chain([ + dup85, + dup2, + dup59, + dup3, + dup9, + dup4, + dup5, + dup60, + ]), +}); + +var msg804 = msg("00430:01", all281); + +var select301 = linear_select([ + msg803, + msg804, +]); + +var msg805 = msg("00431", dup417); + +var msg806 = msg("00432", dup417); + +var msg807 = msg("00433", dup418); + +var msg808 = msg("00434", dup418); + +var msg809 = msg("00435", dup398); + +var all282 = all_match({ + processors: [ + dup132, + dup345, + dup296, + ], + on_success: processor_chain([ + dup58, + dup2, + dup4, + dup59, + dup5, + dup3, + dup60, + ]), +}); + +var msg810 = msg("00435:01", all282); + +var select302 = linear_select([ + msg809, + msg810, +]); + +var msg811 = msg("00436", dup398); + +var all283 = all_match({ + processors: [ + dup64, + dup340, + dup67, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup9, + dup4, + dup5, + dup3, + dup60, + ]), +}); + +var msg812 = msg("00436:01", all283); + +var select303 = linear_select([ + msg811, + msg812, +]); + +var part1307 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, +])); + +var msg813 = msg("00437", part1307); + +var all284 = all_match({ + processors: [ + dup301, + dup340, + dup67, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + dup9, + ]), +}); + +var msg814 = msg("00437:01", all284); + +var part1308 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + dup9, +])); + +var msg815 = msg("00437:02", part1308); + +var select304 = linear_select([ + msg813, + msg814, + msg815, +]); + +var part1309 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" +match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, +])); + +var msg816 = msg("00438", part1309); + +var part1310 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, +])); + +var msg817 = msg("00438:01", part1310); + +var all285 = all_match({ + processors: [ + dup301, + dup340, + dup67, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, + dup61, + ]), +}); + +var msg818 = msg("00438:02", all285); + +var select305 = linear_select([ + msg816, + msg817, + msg818, +]); + +var part1311 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup9, + dup60, +])); + +var msg819 = msg("00440", part1311); + +var part1312 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup3, + dup61, +])); + +var msg820 = msg("00440:02", part1312); + +var all286 = all_match({ + processors: [ + dup241, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup3, + dup9, + dup61, + ]), +}); + +var msg821 = msg("00440:01", all286); + +var part1313 = // "Pattern{Constant('Fragmented traffic! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); + +var all287 = all_match({ + processors: [ + part1313, + dup345, + dup83, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup3, + dup9, + dup60, + ]), +}); + +var msg822 = msg("00440:03", all287); + +var select306 = linear_select([ + msg819, + msg820, + msg821, + msg822, +]); + +var part1314 = // "Pattern{Field(signame,true), Constant(' id='), Field(fld2,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup4, + dup59, + dup5, + dup9, + dup2, + dup3, + dup60, +])); + +var msg823 = msg("00441", part1314); + +var msg824 = msg("00442", dup399); + +var msg825 = msg("00443", dup399); + +var part1315 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' issued command '), Field(fld2,true), Constant(' to redirect output.')}" +match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg826 = msg("00511", part1315); + +var part1316 = // "Pattern{Constant('All System Config saved by admin '), Field(p0,false)}" +match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); + +var all288 = all_match({ + processors: [ + part1316, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg827 = msg("00511:01", all288); + +var part1317 = // "Pattern{Constant('All logged events or alarms are cleared by admin '), Field(administrator,false), Constant('.')}" +match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg828 = msg("00511:02", part1317); + +var part1318 = // "Pattern{Constant('Get new software from flash to slot (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" +match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); + +var all289 = all_match({ + processors: [ + part1318, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg829 = msg("00511:03", all289); + +var part1319 = // "Pattern{Constant('Get new software from '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') to slot (file: '), Field(fld3,false), Constant(') by admin '), Field(p0,false)}" +match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); + +var all290 = all_match({ + processors: [ + part1319, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg830 = msg("00511:04", all290); + +var part1320 = // "Pattern{Constant('Get new software to '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" +match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); + +var all291 = all_match({ + processors: [ + part1320, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg831 = msg("00511:05", all291); + +var part1321 = // "Pattern{Constant('Log setting is modified by admin '), Field(p0,false)}" +match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); + +var all292 = all_match({ + processors: [ + part1321, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg832 = msg("00511:06", all292); + +var part1322 = // "Pattern{Constant('Save configuration to '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" +match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); + +var all293 = all_match({ + processors: [ + part1322, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg833 = msg("00511:07", all293); + +var part1323 = // "Pattern{Constant('Save new software from slot (file: '), Field(fld2,false), Constant(') to flash by admin '), Field(p0,false)}" +match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); + +var all294 = all_match({ + processors: [ + part1323, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg834 = msg("00511:08", all294); + +var part1324 = // "Pattern{Constant('Save new software from '), Field(hostip,true), Constant(' (file: '), Field(result,false), Constant(') to flash by admin '), Field(p0,false)}" +match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); + +var all295 = all_match({ + processors: [ + part1324, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg835 = msg("00511:09", all295); + +var part1325 = // "Pattern{Constant('System Config from flash to slot - '), Field(fld2,true), Constant(' by admin '), Field(p0,false)}" +match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); + +var all296 = all_match({ + processors: [ + part1325, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg836 = msg("00511:10", all296); + +var part1326 = // "Pattern{Constant('System Config load from '), Field(hostip,true), Constant(' (file '), Field(fld2,false), Constant(') to slot - '), Field(fld3,true), Constant(' by admin '), Field(p0,false)}" +match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); + +var all297 = all_match({ + processors: [ + part1326, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg837 = msg("00511:11", all297); + +var part1327 = // "Pattern{Constant('System Config load from '), Field(hostip,true), Constant(' (file '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" +match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); + +var all298 = all_match({ + processors: [ + part1327, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg838 = msg("00511:12", all298); + +var part1328 = // "Pattern{Constant('The system configuration was loaded from the slot by admin '), Field(p0,false)}" +match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); + +var all299 = all_match({ + processors: [ + part1328, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg839 = msg("00511:13", all299); + +var part1329 = // "Pattern{Constant('FIPS: Attempt to set RADIUS shared secret with invalid length '), Field(fld2,false)}" +match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg840 = msg("00511:14", part1329); + +var select307 = linear_select([ + msg826, + msg827, + msg828, + msg829, + msg830, + msg831, + msg832, + msg833, + msg834, + msg835, + msg836, + msg837, + msg838, + msg839, + msg840, +]); + +var part1330 = // "Pattern{Constant('The physical state of '), Field(p0,false)}" +match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); + +var part1331 = // "Pattern{Constant('the Interface '), Field(p0,false)}" +match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); + +var select308 = linear_select([ + dup123, + part1331, + dup122, +]); + +var part1332 = // "Pattern{Constant(''), Field(interface,true), Constant(' has changed to '), Field(p0,false)}" +match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); + +var part1333 = // "Pattern{Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); + +var part1334 = // "Pattern{Field(result,false)}" +match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); + +var select309 = linear_select([ + part1333, + part1334, +]); + +var all300 = all_match({ + processors: [ + part1330, + select308, + part1332, + select309, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + dup9, + ]), +}); + +var msg841 = msg("00513", all300); + +var part1335 = // "Pattern{Constant('Vsys Admin '), Field(p0,false)}" +match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); + +var select310 = linear_select([ + part1335, + dup289, +]); + +var part1336 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has logged on via the '), Field(logon_type,true), Constant(' ( HTTP'), Field(p0,false)}" +match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); + +var part1337 = // "Pattern{Constant('S'), Field(p0,false)}" +match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); + +var select311 = linear_select([ + dup96, + part1337, +]); + +var part1338 = // "Pattern{Field(,false), Constant(') to port '), Field(interface,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); + +var all301 = all_match({ + processors: [ + select310, + part1336, + select311, + part1338, + ], + on_success: processor_chain([ + dup303, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg842 = msg("00515", all301); + +var part1339 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); + +var part1340 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' has failed '), Field(p0,false)}" +match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); + +var part1341 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has failed '), Field(p0,false)}" +match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); + +var select312 = linear_select([ + part1340, + part1341, +]); + +var part1342 = // "Pattern{Field(fld2,false)}" +match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); + +var all302 = all_match({ + processors: [ + part1339, + select312, + part1342, + ], + on_success: processor_chain([ + dup208, + dup29, + dup30, + dup31, + dup54, + dup2, + dup4, + dup5, + dup304, + dup3, + ]), +}); + +var msg843 = msg("00515:01", all302); + +var part1343 = // "Pattern{Constant('Management session via '), Field(p0,false)}" +match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); + +var part1344 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' for '), Field(p0,false)}" +match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); + +var part1345 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for '), Field(p0,false)}" +match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); + +var select313 = linear_select([ + part1344, + part1345, +]); + +var part1346 = // "Pattern{Constant('[vsys] admin '), Field(p0,false)}" +match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); + +var part1347 = // "Pattern{Constant('vsys admin '), Field(p0,false)}" +match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); + +var select314 = linear_select([ + part1346, + part1347, + dup15, +]); + +var part1348 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has timed out')}" +match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); + +var all303 = all_match({ + processors: [ + part1343, + select313, + select314, + part1348, + ], + on_success: processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg844 = msg("00515:02", all303); + +var part1349 = // "Pattern{Constant('[Vsys] '), Field(p0,false)}" +match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); + +var part1350 = // "Pattern{Constant('Vsys '), Field(p0,false)}" +match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); + +var select315 = linear_select([ + part1349, + part1350, +]); + +var part1351 = // "Pattern{Constant('Admin '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" +match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); + +var part1352 = // "Pattern{Field(logon_type,false)}" +match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); + +var select316 = linear_select([ + dup306, + part1352, +]); + +var all304 = all_match({ + processors: [ + select315, + part1351, + dup401, + dup40, + select316, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg845 = msg("00515:04", all304); + +var part1353 = // "Pattern{Constant('Admin User '), Field(administrator,true), Constant(' has logged on via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg846 = msg("00515:06", part1353); + +var part1354 = // "Pattern{Field(,false), Constant('Admin '), Field(p0,false)}" +match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); + +var select317 = linear_select([ + dup307, + dup16, +]); + +var part1355 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" +match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); + +var part1356 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld2,false), Constant(')')}" +match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); + +var select318 = linear_select([ + dup308, + part1356, + dup306, +]); + +var all305 = all_match({ + processors: [ + part1354, + select317, + part1355, + dup401, + dup40, + select318, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg847 = msg("00515:05", all305); + +var part1357 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' login attempt for '), Field(logon_type,false), Constant('(http) management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false)}" +match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg848 = msg("00515:07", part1357); + +var part1358 = // "Pattern{Field(fld2,true), Constant(' Admin User "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('(http'), Field(p0,false)}" +match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); + +var part1359 = // "Pattern{Constant(') '), Field(p0,false)}" +match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); + +var part1360 = // "Pattern{Constant('s) '), Field(p0,false)}" +match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); + +var select319 = linear_select([ + part1359, + part1360, +]); + +var part1361 = // "Pattern{Constant('management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); + +var all306 = all_match({ + processors: [ + part1358, + select319, + part1361, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg849 = msg("00515:08", all306); + +var part1362 = // "Pattern{Constant('User '), Field(username,true), Constant(' telnet management session from ('), Field(saddr,false), Constant(':'), Field(sport,false), Constant(') timed out')}" +match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg850 = msg("00515:09", part1362); + +var part1363 = // "Pattern{Constant('User '), Field(username,true), Constant(' logged out of telnet session from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg851 = msg("00515:10", part1363); + +var part1364 = // "Pattern{Constant('The session limit threshold has been set to '), Field(trigger_val,true), Constant(' on zone '), Field(zone,false), Constant('.')}" +match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg852 = msg("00515:11", part1364); + +var part1365 = // "Pattern{Constant('[ Vsys ] Admin User "'), Field(administrator,false), Constant('" logged in for Web( http'), Field(p0,false)}" +match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); + +var part1366 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(')')}" +match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); + +var all307 = all_match({ + processors: [ + part1365, + dup402, + part1366, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg853 = msg("00515:12", all307); + +var select320 = linear_select([ + dup290, + dup289, +]); + +var part1367 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" +match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); + +var select321 = linear_select([ + dup308, + dup306, +]); + +var all308 = all_match({ + processors: [ + select320, + part1367, + dup401, + dup40, + select321, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg854 = msg("00515:13", all308); + +var part1368 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log o'), Field(p0,false)}" +match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); + +var part1369 = // "Pattern{Field(username,true), Constant(' '), Field(fld1,true), Constant(' has been forced to log o'), Field(p0,false)}" +match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); + +var select322 = linear_select([ + part1368, + part1369, +]); + +var part1370 = // "Pattern{Constant('of the '), Field(p0,false)}" +match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); + +var part1371 = // "Pattern{Constant('serial '), Field(logon_type,true), Constant(' session.')}" +match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); + +var part1372 = // "Pattern{Field(logon_type,true), Constant(' session on host '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' ('), Field(event_time,false), Constant(')')}" +match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); + +var part1373 = // "Pattern{Field(logon_type,true), Constant(' session on host '), Field(hostip,false), Constant(':'), Field(network_port,false)}" +match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); + +var select323 = linear_select([ + part1371, + part1372, + part1373, +]); + +var all309 = all_match({ + processors: [ + select322, + dup401, + part1370, + select323, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg855 = msg("00515:14", all309); + +var part1374 = // "Pattern{Field(fld2,false), Constant(': Admin User '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" +match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); + +var part1375 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); + +var part1376 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); + +var select324 = linear_select([ + part1375, + part1376, +]); + +var all310 = all_match({ + processors: [ + part1374, + dup401, + dup40, + select324, + dup41, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg856 = msg("00515:15", all310); + +var part1377 = // "Pattern{Field(fld2,false), Constant(': Admin '), Field(p0,false)}" +match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); + +var select325 = linear_select([ + part1377, + dup289, +]); + +var part1378 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' attempt access to '), Field(url,true), Constant(' illegal from '), Field(logon_type,false), Constant('( http'), Field(p0,false)}" +match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); + +var part1379 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); + +var all311 = all_match({ + processors: [ + select325, + part1378, + dup402, + part1379, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg857 = msg("00515:16", all311); + +var part1380 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged out for '), Field(logon_type,false), Constant('('), Field(p0,false)}" +match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); + +var part1381 = // "Pattern{Constant('https '), Field(p0,false)}" +match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); + +var part1382 = // "Pattern{Constant(' http '), Field(p0,false)}" +match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); + +var select326 = linear_select([ + part1381, + part1382, +]); + +var part1383 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); + +var all312 = all_match({ + processors: [ + part1380, + select326, + part1383, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg858 = msg("00515:17", all312); + +var part1384 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' login attempt for '), Field(logon_type,false), Constant('(https) management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ + dup242, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg859 = msg("00515:18", part1384); + +var part1385 = // "Pattern{Constant('Vsys admin user '), Field(administrator,true), Constant(' logged on via '), Field(p0,false)}" +match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); + +var part1386 = // "Pattern{Field(logon_type,true), Constant(' from remote IP address '), Field(saddr,true), Constant(' using port '), Field(sport,false), Constant('. ('), Field(p0,false)}" +match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); + +var part1387 = // "Pattern{Constant('the console. ('), Field(p0,false)}" +match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); + +var select327 = linear_select([ + part1386, + part1387, +]); + +var all313 = all_match({ + processors: [ + part1385, + select327, + dup41, + ], + on_success: processor_chain([ + dup242, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg860 = msg("00515:19", all313); + +var part1388 = // "Pattern{Constant('netscreen: Management session via SCS from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for admin netscreen has timed out ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ + dup242, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg861 = msg("00515:20", part1388); + +var select328 = linear_select([ + msg842, + msg843, + msg844, + msg845, + msg846, + msg847, + msg848, + msg849, + msg850, + msg851, + msg852, + msg853, + msg854, + msg855, + msg856, + msg857, + msg858, + msg859, + msg860, + msg861, +]); + +var part1389 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' '), Field(fld1,false), Constant('at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg862 = msg("00518", part1389); + +var part1390 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg863 = msg("00518:17", part1390); + +var part1391 = // "Pattern{Constant('Local authentication for WebAuth user '), Field(username,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg864 = msg("00518:01", part1391); + +var part1392 = // "Pattern{Constant('Local authentication for user '), Field(username,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg865 = msg("00518:02", part1392); + +var part1393 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' must enter "Next Code" for SecurID '), Field(hostip,false)}" +match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg866 = msg("00518:03", part1393); + +var part1394 = // "Pattern{Constant('WebAuth user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup205, + dup2, + dup4, + dup5, + dup3, +])); + +var msg867 = msg("00518:04", part1394); + +var part1395 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been challenged via the '), Field(authmethod,true), Constant(' server at '), Field(hostip,true), Constant(' (Rejected since challenge is not supported for '), Field(logon_type,false), Constant(')')}" +match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ + dup205, + dup2, + dup4, + dup5, + dup3, +])); + +var msg868 = msg("00518:05", part1395); + +var part1396 = // "Pattern{Constant('Error in authentication for WebAuth user '), Field(username,false)}" +match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ + dup35, + dup29, + dup31, + dup54, + dup2, + dup4, + dup5, + dup3, +])); + +var msg869 = msg("00518:06", part1396); + +var part1397 = // "Pattern{Constant('Authentication for user '), Field(username,true), Constant(' was denied (long '), Field(p0,false)}" +match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); + +var part1398 = // "Pattern{Constant('username '), Field(p0,false)}" +match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); + +var select329 = linear_select([ + dup24, + part1398, +]); + +var part1399 = // "Pattern{Constant(')'), Field(,false)}" +match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); + +var all314 = all_match({ + processors: [ + part1397, + select329, + part1399, + ], + on_success: processor_chain([ + dup53, + dup29, + dup31, + dup54, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg870 = msg("00518:07", all314); + +var part1400 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' '), Field(authmethod,true), Constant(' authentication attempt has timed out')}" +match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ + dup35, + dup29, + dup31, + dup39, + dup2, + dup4, + dup5, + dup3, +])); + +var msg871 = msg("00518:08", part1400); + +var part1401 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup205, + dup2, + dup4, + dup5, + dup3, +])); + +var msg872 = msg("00518:09", part1401); + +var part1402 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,true), Constant(' ('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' failed due to '), Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ + dup208, + dup29, + dup30, + dup31, + dup54, + dup2, + dup4, + dup9, + dup5, + dup3, + dup304, +])); + +var msg873 = msg("00518:10", part1402); + +var part1403 = // "Pattern{Constant('ADM: Local admin authentication failed for login name '), Field(p0,false)}" +match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); + +var part1404 = // "Pattern{Constant('''), Field(username,false), Constant('': '), Field(p0,false)}" +match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); + +var part1405 = // "Pattern{Field(username,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); + +var select330 = linear_select([ + part1404, + part1405, +]); + +var part1406 = // "Pattern{Field(result,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); + +var all315 = all_match({ + processors: [ + part1403, + select330, + part1406, + ], + on_success: processor_chain([ + dup208, + dup29, + dup30, + dup31, + dup54, + dup2, + dup9, + dup4, + dup5, + dup3, + ]), +}); + +var msg874 = msg("00518:11", all315); + +var part1407 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ + dup242, + dup2, + dup4, + dup9, + dup5, + dup3, +])); + +var msg875 = msg("00518:12", part1407); + +var part1408 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' is rejected by the Radius server at '), Field(hostip,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ + dup292, + dup2, + dup3, + dup4, + dup9, + dup5, +])); + +var msg876 = msg("00518:13", part1408); + +var part1409 = // "Pattern{Field(fld2,false), Constant(': Admin user has been rejected via the Radius server at '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ + dup292, + dup2, + dup4, + dup5, + dup9, +])); + +var msg877 = msg("00518:14", part1409); + +var select331 = linear_select([ + msg862, + msg863, + msg864, + msg865, + msg866, + msg867, + msg868, + msg869, + msg870, + msg871, + msg872, + msg873, + msg874, + msg875, + msg876, + msg877, +]); + +var part1410 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); + +var part1411 = // "Pattern{Constant('of group '), Field(group,true), Constant(' at '), Field(saddr,true), Constant(' has '), Field(p0,false)}" +match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); + +var part1412 = // "Pattern{Field(group,true), Constant(' at '), Field(saddr,true), Constant(' has '), Field(p0,false)}" +match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); + +var select332 = linear_select([ + dup196, + part1411, + part1412, +]); + +var part1413 = // "Pattern{Constant('been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server '), Field(p0,false)}" +match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); + +var part1414 = // "Pattern{Constant('at '), Field(p0,false)}" +match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); + +var select333 = linear_select([ + part1414, + dup16, +]); + +var part1415 = // "Pattern{Constant(''), Field(hostip,false)}" +match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); + +var all316 = all_match({ + processors: [ + part1410, + select332, + part1413, + select333, + part1415, + ], + on_success: processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg878 = msg("00519", all316); + +var part1416 = // "Pattern{Constant('Local authentication for '), Field(p0,false)}" +match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); + +var select334 = linear_select([ + dup309, + dup307, +]); + +var part1417 = // "Pattern{Constant(''), Field(username,true), Constant(' was '), Field(disposition,false)}" +match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); + +var all317 = all_match({ + processors: [ + part1416, + select334, + part1417, + ], + on_success: processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg879 = msg("00519:01", all317); + +var part1418 = // "Pattern{Constant('User '), Field(p0,false)}" +match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); + +var select335 = linear_select([ + dup309, + part1418, +]); + +var part1419 = // "Pattern{Constant(''), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" +match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); + +var all318 = all_match({ + processors: [ + dup162, + select335, + part1419, + ], + on_success: processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg880 = msg("00519:02", all318); + +var part1420 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(fld4,false)}" +match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ + dup242, + dup2, + dup3, + dup4, + dup5, +])); + +var msg881 = msg("00519:03", part1420); + +var part1421 = // "Pattern{Constant('ADM: Local admin authentication successful for login name '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ + dup242, + dup2, + dup4, + dup5, + dup9, +])); + +var msg882 = msg("00519:04", part1421); + +var part1422 = // "Pattern{Field(fld2,false), Constant('Admin user '), Field(administrator,true), Constant(' has been accepted via the Radius server at '), Field(hostip,false), Constant('('), Field(fld1,false), Constant(')')}" +match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ + dup242, + dup2, + dup4, + dup5, + dup9, +])); + +var msg883 = msg("00519:05", part1422); + +var select336 = linear_select([ + msg878, + msg879, + msg880, + msg881, + msg882, + msg883, +]); + +var part1423 = // "Pattern{Field(hostname,true), Constant(' user authentication attempt has timed out')}" +match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ + dup35, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg884 = msg("00520", part1423); + +var part1424 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); + +var part1425 = // "Pattern{Constant('RADIUS '), Field(p0,false)}" +match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); + +var part1426 = // "Pattern{Constant('SecurID '), Field(p0,false)}" +match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); + +var part1427 = // "Pattern{Constant('LDAP '), Field(p0,false)}" +match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); + +var part1428 = // "Pattern{Constant('Local '), Field(p0,false)}" +match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); + +var select337 = linear_select([ + part1425, + part1426, + part1427, + part1428, +]); + +var part1429 = // "Pattern{Constant('authentication attempt has timed out'), Field(,false)}" +match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); + +var all319 = all_match({ + processors: [ + part1424, + select337, + part1429, + ], + on_success: processor_chain([ + dup35, + dup31, + dup39, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg885 = msg("00520:01", all319); + +var part1430 = // "Pattern{Constant('Trying '), Field(p0,false)}" +match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); + +var part1431 = // "Pattern{Constant('server '), Field(fld2,false)}" +match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); + +var all320 = all_match({ + processors: [ + part1430, + dup403, + part1431, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg886 = msg("00520:02", all320); + +var part1432 = // "Pattern{Constant('Primary '), Field(p0,false)}" +match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); + +var part1433 = // "Pattern{Constant('Backup1 '), Field(p0,false)}" +match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); + +var part1434 = // "Pattern{Constant('Backup2 '), Field(p0,false)}" +match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); + +var select338 = linear_select([ + part1432, + part1433, + part1434, +]); + +var part1435 = // "Pattern{Constant(''), Field(fld2,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); + +var part1436 = // "Pattern{Constant(''), Field(fld3,false), Constant(', and '), Field(p0,false)}" +match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); + +var part1437 = // "Pattern{Constant(''), Field(fld4,true), Constant(' servers failed')}" +match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); + +var all321 = all_match({ + processors: [ + dup162, + select338, + part1435, + dup403, + part1436, + dup403, + part1437, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg887 = msg("00520:03", all321); + +var part1438 = // "Pattern{Constant('Trying '), Field(fld2,true), Constant(' Server '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg888 = msg("00520:04", part1438); + +var part1439 = // "Pattern{Constant('Active Server Switchover: New requests for '), Field(fld31,true), Constant(' server will try '), Field(fld32,true), Constant(' from now on. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg889 = msg("00520:05", part1439); + +var select339 = linear_select([ + msg884, + msg885, + msg886, + msg887, + msg888, + msg889, +]); + +var part1440 = // "Pattern{Constant('Can't connect to E-mail server '), Field(hostip,false)}" +match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg890 = msg("00521", part1440); + +var part1441 = // "Pattern{Constant('HA link state has '), Field(fld2,false)}" +match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg891 = msg("00522", part1441); + +var part1442 = // "Pattern{Constant('URL filtering received an error from '), Field(fld2,true), Constant(' (error '), Field(resultcode,false), Constant(').')}" +match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ + dup234, + dup2, + dup3, + dup4, + dup5, +])); + +var msg892 = msg("00523", part1442); + +var part1443 = // "Pattern{Constant('NetScreen device at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has responded successfully to SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ + dup211, + dup2, + dup3, + dup4, + dup5, +])); + +var msg893 = msg("00524", part1443); + +var part1444 = // "Pattern{Constant('SNMP request from an unknown SNMP community public at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg894 = msg("00524:02", part1444); + +var part1445 = // "Pattern{Constant('SNMP: NetScreen device has responded successfully to the SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg895 = msg("00524:03", part1445); + +var part1446 = // "Pattern{Constant('SNMP request from an unknown SNMP community admin at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg896 = msg("00524:04", part1446); + +var part1447 = // "Pattern{Constant('SNMP request from an unknown SNMP community '), Field(fld2,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ + dup18, + dup2, + dup4, + dup5, + dup9, +])); + +var msg897 = msg("00524:05", part1447); + +var part1448 = // "Pattern{Constant('SNMP request has been received from an unknown host in SNMP community '), Field(fld2,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ + dup18, + dup2, + dup4, + dup5, + dup9, +])); + +var msg898 = msg("00524:06", part1448); + +var part1449 = // "Pattern{Constant('SNMP request from an unknown SNMP community '), Field(fld2,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' has been received')}" +match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg899 = msg("00524:12", part1449); + +var part1450 = // "Pattern{Constant('SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been received, but the SNMP version type is incorrect. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ + dup19, + dup2, + dup4, + setc("result","the SNMP version type is incorrect"), + dup5, + dup9, +])); + +var msg900 = msg("00524:14", part1450); + +var part1451 = // "Pattern{Constant('SNMP request has been received'), Field(p0,false)}" +match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); + +var part1452 = // "Pattern{Field(,false), Constant('but '), Field(result,false)}" +match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); + +var all322 = all_match({ + processors: [ + part1451, + dup404, + part1452, + ], + on_success: processor_chain([ + dup18, + dup2, + dup4, + dup5, + ]), +}); + +var msg901 = msg("00524:13", all322); + +var part1453 = // "Pattern{Constant('Response to SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' has '), Field(disposition,true), Constant(' due to '), Field(result,false)}" +match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg902 = msg("00524:07", part1453); + +var part1454 = // "Pattern{Constant('SNMP community '), Field(fld2,true), Constant(' cannot be added because '), Field(result,false)}" +match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg903 = msg("00524:08", part1454); + +var part1455 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be added to community '), Field(fld2,true), Constant(' because of '), Field(result,false)}" +match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg904 = msg("00524:09", part1455); + +var part1456 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be added because '), Field(result,false)}" +match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg905 = msg("00524:10", part1456); + +var part1457 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be removed from community '), Field(fld2,true), Constant(' because '), Field(result,false)}" +match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ + dup18, + dup2, + dup4, + dup5, +])); + +var msg906 = msg("00524:11", part1457); + +var part1458 = // "Pattern{Constant('SNMP user/community '), Field(fld34,true), Constant(' doesn't exist. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg907 = msg("00524:16", part1458); + +var select340 = linear_select([ + msg893, + msg894, + msg895, + msg896, + msg897, + msg898, + msg899, + msg900, + msg901, + msg902, + msg903, + msg904, + msg905, + msg906, + msg907, +]); + +var part1459 = // "Pattern{Constant('The new PIN for user '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' has been '), Field(disposition,true), Constant(' by SecurID '), Field(fld2,false)}" +match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ + dup205, + setc("ec_subject","Password"), + dup38, + dup2, + dup3, + dup4, + dup5, +])); + +var msg908 = msg("00525", part1459); + +var part1460 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' has selected a system-generated PIN for authentication with SecurID '), Field(fld2,false)}" +match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg909 = msg("00525:01", part1460); + +var part1461 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' must enter the "new PIN" for SecurID '), Field(fld2,false)}" +match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg910 = msg("00525:02", part1461); + +var part1462 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' must make a "New PIN" choice for SecurID '), Field(fld2,false)}" +match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg911 = msg("00525:03", part1462); + +var select341 = linear_select([ + msg908, + msg909, + msg910, + msg911, +]); + +var part1463 = // "Pattern{Constant('The user limit has been exceeded and '), Field(hostip,true), Constant(' cannot be added')}" +match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ + dup37, + dup221, + dup38, + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg912 = msg("00526", part1463); + +var part1464 = // "Pattern{Constant('A DHCP-'), Field(p0,false)}" +match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); + +var part1465 = // "Pattern{Constant(' assigned '), Field(p0,false)}" +match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); + +var select342 = linear_select([ + dup313, + part1465, +]); + +var part1466 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' has been '), Field(p0,false)}" +match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); + +var part1467 = // "Pattern{Constant('freed from '), Field(p0,false)}" +match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); + +var part1468 = // "Pattern{Constant('freed '), Field(p0,false)}" +match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); + +var select343 = linear_select([ + dup314, + part1467, + part1468, +]); + +var all323 = all_match({ + processors: [ + part1464, + select342, + part1466, + select343, + dup108, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg913 = msg("00527", all323); + +var part1469 = // "Pattern{Constant('A DHCP-assigned IP address has been manually released'), Field(,false)}" +match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg914 = msg("00527:01", part1469); + +var part1470 = // "Pattern{Constant('DHCP server has '), Field(p0,false)}" +match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); + +var part1471 = // "Pattern{Constant('released '), Field(p0,false)}" +match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); + +var part1472 = // "Pattern{Constant('assigned or released '), Field(p0,false)}" +match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); + +var select344 = linear_select([ + dup313, + part1471, + part1472, +]); + +var part1473 = // "Pattern{Constant('an IP address'), Field(,false)}" +match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); + +var all324 = all_match({ + processors: [ + part1470, + select344, + part1473, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg915 = msg("00527:02", all324); + +var part1474 = // "Pattern{Constant('MAC address '), Field(macaddr,true), Constant(' has detected an IP conflict and has declined address '), Field(hostip,false)}" +match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ + dup274, + dup2, + dup3, + dup4, + dup5, +])); + +var msg916 = msg("00527:03", part1474); + +var part1475 = // "Pattern{Constant('One or more DHCP-assigned IP addresses have been manually released.'), Field(,false)}" +match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg917 = msg("00527:04", part1475); + +var part1476 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is more than '), Field(fld2,true), Constant(' allocated.')}" +match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); + +var all325 = all_match({ + processors: [ + dup212, + dup339, + part1476, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg918 = msg("00527:05", all325); + +var part1477 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); + +var select345 = linear_select([ + dup106, + dup127, +]); + +var part1478 = // "Pattern{Constant('released from '), Field(p0,false)}" +match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); + +var select346 = linear_select([ + dup314, + part1478, +]); + +var part1479 = // "Pattern{Constant(''), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); + +var all326 = all_match({ + processors: [ + part1477, + select345, + dup23, + select346, + part1479, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg919 = msg("00527:06", all326); + +var part1480 = // "Pattern{Constant('One or more IP addresses have expired. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg920 = msg("00527:07", part1480); + +var part1481 = // "Pattern{Constant('DHCP server on interface '), Field(interface,true), Constant(' received '), Field(protocol_detail,true), Constant(' from '), Field(smacaddr,true), Constant(' requesting out-of-scope IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg921 = msg("00527:08", part1481); + +var part1482 = // "Pattern{Constant('MAC address '), Field(macaddr,true), Constant(' has '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); + +var part1483 = // "Pattern{Constant('address '), Field(hostip,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); + +var part1484 = // "Pattern{Field(hostip,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); + +var select347 = linear_select([ + part1483, + part1484, +]); + +var all327 = all_match({ + processors: [ + part1482, + select347, + dup41, + ], + on_success: processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg922 = msg("00527:09", all327); + +var part1485 = // "Pattern{Constant('One or more IP addresses are expired. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg923 = msg("00527:10", part1485); + +var select348 = linear_select([ + msg913, + msg914, + msg915, + msg916, + msg917, + msg918, + msg919, + msg920, + msg921, + msg922, + msg923, +]); + +var part1486 = // "Pattern{Constant('SCS: User ''), Field(username,false), Constant('' authenticated using password :')}" +match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ + setc("eventcategory","1302010000"), + dup29, + dup31, + dup32, + dup2, + dup3, + dup4, + dup5, +])); + +var msg924 = msg("00528", part1486); + +var part1487 = // "Pattern{Constant('SCS: Connection terminated for user '), Field(username,true), Constant(' from')}" +match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg925 = msg("00528:01", part1487); + +var part1488 = // "Pattern{Constant('SCS: Disabled for all root/vsys on device. Client host attempting connection to interface ''), Field(interface,false), Constant('' with address '), Field(hostip,true), Constant(' from '), Field(saddr,false)}" +match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg926 = msg("00528:02", part1488); + +var part1489 = // "Pattern{Constant('SSH: NetScreen device '), Field(disposition,true), Constant(' to identify itself to the SSH client at '), Field(hostip,false)}" +match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ + dup205, + dup2, + dup4, + dup5, + dup3, +])); + +var msg927 = msg("00528:03", part1489); + +var part1490 = // "Pattern{Constant('SSH: Incompatible SSH version string has been received from SSH client at '), Field(hostip,false)}" +match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ + dup205, + dup2, + dup4, + dup5, + dup3, +])); + +var msg928 = msg("00528:04", part1490); + +var part1491 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to send identification string to client host at '), Field(hostip,false)}" +match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ + dup205, + dup2, + dup3, + dup4, + dup5, +])); + +var msg929 = msg("00528:05", part1491); + +var part1492 = // "Pattern{Constant('SSH: Client at '), Field(saddr,true), Constant(' attempted to connect with invalid version string.')}" +match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ + dup315, + dup2, + dup3, + dup4, + dup5, + setc("result","invalid version string"), +])); + +var msg930 = msg("00528:06", part1492); + +var part1493 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to negotiate '), Field(p0,false)}" +match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); + +var part1494 = // "Pattern{Constant('MAC '), Field(p0,false)}" +match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); + +var part1495 = // "Pattern{Constant('key exchange '), Field(p0,false)}" +match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); + +var part1496 = // "Pattern{Constant('host key '), Field(p0,false)}" +match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); + +var select349 = linear_select([ + dup88, + part1494, + part1495, + part1496, +]); + +var part1497 = // "Pattern{Constant('algorithm with host '), Field(hostip,false)}" +match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); + +var all328 = all_match({ + processors: [ + part1493, + select349, + part1497, + ], + on_success: processor_chain([ + dup316, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg931 = msg("00528:07", all328); + +var part1498 = // "Pattern{Constant('SSH: Unsupported cipher type '), Field(fld2,true), Constant(' requested from '), Field(saddr,false)}" +match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ + dup316, + dup2, + dup4, + dup5, + dup3, +])); + +var msg932 = msg("00528:08", part1498); + +var part1499 = // "Pattern{Constant('SSH: Host client has requested NO cipher from '), Field(saddr,false)}" +match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg933 = msg("00528:09", part1499); + +var part1500 = // "Pattern{Constant('SSH: Disabled for ''), Field(vsys,false), Constant(''. Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg934 = msg("00528:10", part1500); + +var part1501 = // "Pattern{Constant('SSH: Disabled for '), Field(fld2,true), Constant(' Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg935 = msg("00528:11", part1501); + +var part1502 = // "Pattern{Constant('SSH: SSH user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' tried unsuccessfully to log in to '), Field(vsys,true), Constant(' using the shared untrusted interface. SSH disabled on that interface.')}" +match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + setc("disposition","disabled"), +])); + +var msg936 = msg("00528:12", part1502); + +var part1503 = // "Pattern{Constant('SSH: SSH client at '), Field(saddr,true), Constant(' tried unsuccessfully to '), Field(p0,false)}" +match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); + +var part1504 = // "Pattern{Constant('make '), Field(p0,false)}" +match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); + +var part1505 = // "Pattern{Constant('establish '), Field(p0,false)}" +match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); + +var select350 = linear_select([ + part1504, + part1505, +]); + +var part1506 = // "Pattern{Constant('an SSH connection to '), Field(p0,false)}" +match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); + +var part1507 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' SSH '), Field(p0,false)}" +match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); + +var part1508 = // "Pattern{Constant('not enabled '), Field(p0,false)}" +match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); + +var select351 = linear_select([ + part1508, + dup157, +]); + +var part1509 = // "Pattern{Constant('on that interface.'), Field(,false)}" +match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); + +var all329 = all_match({ + processors: [ + part1503, + select350, + part1506, + dup339, + part1507, + select351, + part1509, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg937 = msg("00528:13", all329); + +var part1510 = // "Pattern{Constant('SSH: SSH client '), Field(saddr,true), Constant(' unsuccessfully attempted to make an SSH connection to '), Field(vsys,true), Constant(' SSH was not completely initialized for that system.')}" +match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg938 = msg("00528:14", part1510); + +var part1511 = // "Pattern{Constant('SSH: Admin user '), Field(p0,false)}" +match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); + +var part1512 = // "Pattern{Field(administrator,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); + +var select352 = linear_select([ + dup317, + part1512, +]); + +var part1513 = // "Pattern{Constant('at host '), Field(saddr,true), Constant(' requested unsupported '), Field(p0,false)}" +match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); + +var part1514 = // "Pattern{Constant('PKA algorithm '), Field(p0,false)}" +match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); + +var part1515 = // "Pattern{Constant('authentication method '), Field(p0,false)}" +match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); + +var select353 = linear_select([ + part1514, + part1515, +]); + +var all330 = all_match({ + processors: [ + part1511, + select352, + part1513, + select353, + dup108, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg939 = msg("00528:15", all330); + +var part1516 = // "Pattern{Constant('SCP: Admin ''), Field(administrator,false), Constant('' at host '), Field(saddr,true), Constant(' executed invalid scp command: ''), Field(fld2,false), Constant(''')}" +match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg940 = msg("00528:16", part1516); + +var part1517 = // "Pattern{Constant('SCP: Disabled for ''), Field(username,false), Constant(''. Attempted file transfer failed from host '), Field(saddr,false)}" +match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg941 = msg("00528:17", part1517); + +var part1518 = // "Pattern{Constant('authentication successful for admin user '), Field(p0,false)}" +match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); + +var all331 = all_match({ + processors: [ + dup318, + dup405, + part1518, + dup406, + dup322, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + setc("disposition","successful"), + setc("event_description","authentication successful for admin user"), + ]), +}); + +var msg942 = msg("00528:18", all331); + +var part1519 = // "Pattern{Constant('authentication failed for admin user '), Field(p0,false)}" +match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); + +var all332 = all_match({ + processors: [ + dup318, + dup405, + part1519, + dup406, + dup322, + ], + on_success: processor_chain([ + dup208, + dup29, + dup31, + dup54, + dup2, + dup4, + dup5, + dup304, + dup3, + setc("event_description","authentication failed for admin user"), + ]), +}); + +var msg943 = msg("00528:26", all332); + +var part1520 = // "Pattern{Constant(': SSH user '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' using password from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); + +var all333 = all_match({ + processors: [ + dup323, + dup407, + part1520, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg944 = msg("00528:19", all333); + +var part1521 = // "Pattern{Constant(': Connection has been '), Field(disposition,true), Constant(' for admin user '), Field(administrator,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); + +var all334 = all_match({ + processors: [ + dup323, + dup407, + part1521, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg945 = msg("00528:20", all334); + +var part1522 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has requested PKA RSA authentication, which is not supported for that client.')}" +match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, +])); + +var msg946 = msg("00528:21", part1522); + +var part1523 = // "Pattern{Constant('SCS: SSH client at '), Field(saddr,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" +match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); + +var part1524 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' but '), Field(disposition,true), Constant(' because SCS is not enabled for that interface.')}" +match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); + +var all335 = all_match({ + processors: [ + part1523, + dup339, + part1524, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + setc("result","SCS is not enabled for that interface"), + ]), +}); + +var msg947 = msg("00528:22", all335); + +var part1525 = // "Pattern{Constant('SCS: SSH client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection to vsys '), Field(vsys,true), Constant(' because SCS cannot generate the host and server keys before timing out.')}" +match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + setc("result","SCS cannot generate the host and server keys before timing out"), +])); + +var msg948 = msg("00528:23", part1525); + +var part1526 = // "Pattern{Constant('SSH: '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup283, + dup2, + dup3, + dup4, + dup5, +])); + +var msg949 = msg("00528:24", part1526); + +var part1527 = // "Pattern{Constant('SSH: Admin '), Field(p0,false)}" +match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); + +var part1528 = // "Pattern{Constant('at host '), Field(saddr,true), Constant(' attempted to be authenticated with no authentication methods enabled.')}" +match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); + +var all336 = all_match({ + processors: [ + part1527, + dup406, + part1528, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + ]), +}); + +var msg950 = msg("00528:25", all336); + +var select354 = linear_select([ + msg924, + msg925, + msg926, + msg927, + msg928, + msg929, + msg930, + msg931, + msg932, + msg933, + msg934, + msg935, + msg936, + msg937, + msg938, + msg939, + msg940, + msg941, + msg942, + msg943, + msg944, + msg945, + msg946, + msg947, + msg948, + msg949, + msg950, +]); + +var part1529 = // "Pattern{Constant('manually '), Field(p0,false)}" +match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); + +var part1530 = // "Pattern{Constant('automatically '), Field(p0,false)}" +match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); + +var select355 = linear_select([ + part1529, + part1530, +]); + +var part1531 = // "Pattern{Constant('refreshed'), Field(,false)}" +match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); + +var all337 = all_match({ + processors: [ + dup63, + select355, + part1531, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg951 = msg("00529", all337); + +var part1532 = // "Pattern{Constant('DNS entries have been refreshed by '), Field(p0,false)}" +match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); + +var part1533 = // "Pattern{Constant('state change'), Field(,false)}" +match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); + +var part1534 = // "Pattern{Constant('HA'), Field(,false)}" +match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); + +var select356 = linear_select([ + part1533, + part1534, +]); + +var all338 = all_match({ + processors: [ + part1532, + select356, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg952 = msg("00529:01", all338); + +var select357 = linear_select([ + msg951, + msg952, +]); + +var part1535 = // "Pattern{Constant('An IP conflict has been detected and the DHCP client has declined address '), Field(hostip,false)}" +match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ + dup274, + dup2, + dup3, + dup4, + dup5, +])); + +var msg953 = msg("00530", part1535); + +var part1536 = // "Pattern{Constant('DHCP client IP '), Field(hostip,true), Constant(' for the '), Field(p0,false)}" +match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); + +var part1537 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' has been manually released')}" +match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); + +var all339 = all_match({ + processors: [ + part1536, + dup339, + part1537, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg954 = msg("00530:01", all339); + +var part1538 = // "Pattern{Constant('DHCP client is unable to get an IP address for the '), Field(interface,true), Constant(' interface')}" +match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg955 = msg("00530:02", part1538); + +var part1539 = // "Pattern{Constant('DHCP client lease for '), Field(hostip,true), Constant(' has expired')}" +match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg956 = msg("00530:03", part1539); + +var part1540 = // "Pattern{Constant('DHCP server '), Field(hostip,true), Constant(' has assigned the untrust Interface '), Field(interface,true), Constant(' with lease '), Field(fld2,false), Constant('.')}" +match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg957 = msg("00530:04", part1540); + +var part1541 = // "Pattern{Constant('DHCP server '), Field(hostip,true), Constant(' has assigned the '), Field(interface,true), Constant(' interface '), Field(fld2,true), Constant(' with lease '), Field(fld3,false)}" +match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg958 = msg("00530:05", part1541); + +var part1542 = // "Pattern{Constant('DHCP client is unable to get IP address for the untrust interface.'), Field(,false)}" +match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg959 = msg("00530:06", part1542); + +var select358 = linear_select([ + msg953, + msg954, + msg955, + msg956, + msg957, + msg958, + msg959, +]); + +var part1543 = // "Pattern{Constant('System clock configurations have been changed by admin '), Field(p0,false)}" +match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); + +var all340 = all_match({ + processors: [ + part1543, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg960 = msg("00531", all340); + +var part1544 = // "Pattern{Constant('failed to get clock through NTP'), Field(,false)}" +match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg961 = msg("00531:01", part1544); + +var part1545 = // "Pattern{Constant('The system clock has been updated through NTP.'), Field(,false)}" +match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg962 = msg("00531:02", part1545); + +var part1546 = // "Pattern{Constant('The system clock was updated from '), Field(type,true), Constant(' NTP server type '), Field(hostname,true), Constant(' with a'), Field(p0,false)}" +match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); + +var part1547 = // "Pattern{Constant(' ms '), Field(p0,false)}" +match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); + +var select359 = linear_select([ + part1547, + dup115, +]); + +var part1548 = // "Pattern{Constant('adjustment of '), Field(fld3,false), Constant('. Authentication was '), Field(fld4,false), Constant('. Update mode was '), Field(p0,false)}" +match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); + +var part1549 = // "Pattern{Field(fld5,false), Constant('('), Field(fld2,false), Constant(')')}" +match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); + +var part1550 = // "Pattern{Field(fld5,false)}" +match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); + +var select360 = linear_select([ + part1549, + part1550, +]); + +var all341 = all_match({ + processors: [ + part1546, + select359, + part1548, + select360, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + dup146, + ]), +}); + +var msg963 = msg("00531:03", all341); + +var part1551 = // "Pattern{Constant('The NetScreen device is attempting to contact the '), Field(p0,false)}" +match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); + +var part1552 = // "Pattern{Constant('primary backup '), Field(p0,false)}" +match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); + +var part1553 = // "Pattern{Constant('secondary backup '), Field(p0,false)}" +match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); + +var select361 = linear_select([ + part1552, + part1553, + dup191, +]); + +var part1554 = // "Pattern{Constant('NTP server '), Field(hostname,false)}" +match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); + +var all342 = all_match({ + processors: [ + part1551, + select361, + part1554, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg964 = msg("00531:04", all342); + +var part1555 = // "Pattern{Constant('No NTP server could be contacted. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ + dup86, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg965 = msg("00531:05", part1555); + +var part1556 = // "Pattern{Constant('Network Time Protocol adjustment of '), Field(fld2,true), Constant(' from NTP server '), Field(hostname,true), Constant(' exceeds the allowed adjustment of '), Field(fld3,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ + dup86, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg966 = msg("00531:06", part1556); + +var part1557 = // "Pattern{Constant('No acceptable time could be obtained from any NTP server. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ + dup86, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg967 = msg("00531:07", part1557); + +var part1558 = // "Pattern{Constant('Administrator '), Field(administrator,true), Constant(' changed the '), Field(change_attribute,true), Constant(' from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' (by '), Field(fld3,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(') ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg968 = msg("00531:08", part1558); + +var part1559 = // "Pattern{Constant('Network Time Protocol settings changed. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg969 = msg("00531:09", part1559); + +var part1560 = // "Pattern{Constant('NTP server is '), Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ + dup86, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg970 = msg("00531:10", part1560); + +var part1561 = // "Pattern{Constant('The system clock will be changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' received from primary NTP server '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("event_description","system clock changed based on receive from primary NTP server"), +])); + +var msg971 = msg("00531:11", part1561); + +var part1562 = // "Pattern{Field(fld35,true), Constant(' NTP server '), Field(saddr,true), Constant(' could not be contacted. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg972 = msg("00531:12", part1562); + +var select362 = linear_select([ + msg960, + msg961, + msg962, + msg963, + msg964, + msg965, + msg966, + msg967, + msg968, + msg969, + msg970, + msg971, + msg972, +]); + +var part1563 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' is now responding')}" +match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg973 = msg("00533", part1563); + +var part1564 = // "Pattern{Field(fld2,true), Constant(' has been cleared')}" +match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg974 = msg("00534", part1564); + +var part1565 = // "Pattern{Constant('Cannot find the CA certificate with distinguished name '), Field(fld2,false)}" +match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg975 = msg("00535", part1565); + +var part1566 = // "Pattern{Constant('Distinguished name '), Field(dn,true), Constant(' in the X509 certificate request is '), Field(disposition,false)}" +match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg976 = msg("00535:01", part1566); + +var part1567 = // "Pattern{Constant('Local certificate with distinguished name '), Field(dn,true), Constant(' is '), Field(disposition,false)}" +match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg977 = msg("00535:02", part1567); + +var part1568 = // "Pattern{Constant('PKCS #7 data cannot be decapsulated'), Field(,false)}" +match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg978 = msg("00535:03", part1568); + +var part1569 = // "Pattern{Constant('SCEP_FAILURE message has been received from the CA'), Field(,false)}" +match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, + setc("result","SCEP_FAILURE message"), +])); + +var msg979 = msg("00535:04", part1569); + +var part1570 = // "Pattern{Constant('PKI error message has been received: '), Field(result,false)}" +match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, +])); + +var msg980 = msg("00535:05", part1570); + +var part1571 = // "Pattern{Constant('PKI: Saved CA configuration (CA cert subject name '), Field(dn,false), Constant('). ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ + dup316, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Saved CA configuration - cert subject name"), +])); + +var msg981 = msg("00535:06", part1571); + +var select363 = linear_select([ + msg975, + msg976, + msg977, + msg978, + msg979, + msg980, + msg981, +]); + +var part1572 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); + +var part1573 = // "Pattern{Constant('Phase 2 msg ID '), Field(sessionid,false), Constant(': '), Field(disposition,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); + +var part1574 = // "Pattern{Constant('Phase 1: '), Field(disposition,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); + +var part1575 = // "Pattern{Constant('phase 2:'), Field(disposition,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); + +var part1576 = // "Pattern{Constant('phase 1:'), Field(disposition,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); + +var select364 = linear_select([ + part1573, + part1574, + part1575, + part1576, +]); + +var all343 = all_match({ + processors: [ + part1572, + select364, + dup10, + ], + on_success: processor_chain([ + dup44, + dup2, + dup9, + dup3, + dup4, + dup5, + ]), +}); + +var msg982 = msg("00536:49", all343); + +var part1577 = // "Pattern{Constant('UDP packets have been received from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' at interface '), Field(interface,true), Constant(' at '), Field(daddr,false), Constant('/'), Field(dport,false)}" +match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup3, + dup61, +])); + +var msg983 = msg("00536", part1577); + +var part1578 = // "Pattern{Constant('Attempt to set tunnel ('), Field(fld2,false), Constant(') without IP address at both end points! Check outgoing interface.')}" +match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg984 = msg("00536:01", part1578); + +var part1579 = // "Pattern{Constant('Gateway '), Field(fld2,true), Constant(' at '), Field(hostip,true), Constant(' in '), Field(fld4,true), Constant(' mode with ID: '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg985 = msg("00536:02", part1579); + +var part1580 = // "Pattern{Constant('IKE gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false), Constant('. '), Field(info,false)}" +match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg986 = msg("00536:03", part1580); + +var part1581 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has deactivated the SA with ID '), Field(fld2,false), Constant('.')}" +match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ + setc("eventcategory","1801010100"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg987 = msg("00536:04", part1581); + +var part1582 = // "Pattern{Constant('VPN ID number cannot be assigned'), Field(,false)}" +match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg988 = msg("00536:05", part1582); + +var part1583 = // "Pattern{Constant('Local gateway IP address has changed to '), Field(fld2,false), Constant('. VPNs cannot terminate at an interface with IP '), Field(hostip,false)}" +match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg989 = msg("00536:06", part1583); + +var part1584 = // "Pattern{Constant('Local gateway IP address has changed from '), Field(change_old,true), Constant(' to another setting')}" +match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg990 = msg("00536:07", part1584); + +var part1585 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Sent initial contact notification message')}" +match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg991 = msg("00536:08", part1585); + +var part1586 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Sent initial contact notification')}" +match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg992 = msg("00536:09", part1586); + +var part1587 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Responded to a packet with a bad SPI after rebooting')}" +match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg993 = msg("00536:10", part1587); + +var part1588 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Removed Phase 2 SAs after receiving a notification message')}" +match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg994 = msg("00536:11", part1588); + +var part1589 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Rejected first Phase 1 packet from an unrecognized source')}" +match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg995 = msg("00536:12", part1589); + +var part1590 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Rejected an initial Phase 1 packet from an unrecognized peer gateway')}" +match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg996 = msg("00536:13", part1590); + +var part1591 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received initial contact notification and removed Phase '), Field(p0,false)}" +match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); + +var part1592 = // "Pattern{Constant('SAs'), Field(,false)}" +match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); + +var all344 = all_match({ + processors: [ + part1591, + dup386, + part1592, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg997 = msg("00536:14", all344); + +var part1593 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received a notification message for '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ + dup44, + dup2, + dup9, + dup3, + dup4, + dup5, +])); + +var msg998 = msg("00536:50", part1593); + +var part1594 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received incorrect ID payload: IP address '), Field(fld2,true), Constant(' instead of IP address '), Field(fld3,false)}" +match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg999 = msg("00536:15", part1594); + +var part1595 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Phase 2 negotiation request is already in the task list')}" +match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1000 = msg("00536:16", part1595); + +var part1596 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Heartbeats have been lost '), Field(fld2,true), Constant(' times')}" +match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1001 = msg("00536:17", part1596); + +var part1597 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Dropped peer packet because no policy uses the peer configuration')}" +match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1002 = msg("00536:18", part1597); + +var part1598 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Dropped packet because remote gateway OK is not used in any VPN tunnel configurations')}" +match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1003 = msg("00536:19", part1598); + +var part1599 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Added the initial contact task to the task list')}" +match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1004 = msg("00536:20", part1599); + +var part1600 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Added Phase 2 session tasks to the task list')}" +match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1005 = msg("00536:21", part1600); + +var part1601 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1 : '), Field(disposition,true), Constant(' proposals from peer. Negotiations failed')}" +match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + setc("result","Negotiations failed"), +])); + +var msg1006 = msg("00536:22", part1601); + +var part1602 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1 : Aborted negotiations because the time limit has elapsed')}" +match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + setc("result","The time limit has elapsed"), + setc("disposition","Aborted"), +])); + +var msg1007 = msg("00536:23", part1602); + +var part1603 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled')}" +match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1008 = msg("00536:24", part1603); + +var part1604 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Received DH group '), Field(fld2,true), Constant(' instead of expected group '), Field(fld3,true), Constant(' for PFS')}" +match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1009 = msg("00536:25", part1604); + +var part1605 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: No policy exists for the proxy ID received: local ID '), Field(fld2,true), Constant(' remote ID '), Field(fld3,false)}" +match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1010 = msg("00536:26", part1605); + +var part1606 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: RSA private key is needed to sign packets')}" +match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1011 = msg("00536:27", part1606); + +var part1607 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Aggressive mode negotiations have '), Field(disposition,false)}" +match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1012 = msg("00536:28", part1607); + +var part1608 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Vendor ID payload indicates that the peer does not support NAT-T')}" +match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1013 = msg("00536:29", part1608); + +var part1609 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Retransmission limit has been reached')}" +match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1014 = msg("00536:30", part1609); + +var part1610 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Received an invalid RSA signature')}" +match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1015 = msg("00536:31", part1610); + +var part1611 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Received an incorrect public key authentication method')}" +match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1016 = msg("00536:32", part1611); + +var part1612 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: No private key exists to sign packets')}" +match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1017 = msg("00536:33", part1612); + +var part1613 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID')}" +match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1018 = msg("00536:34", part1613); + +var part1614 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: IKE initiator has detected NAT in front of the local device')}" +match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1019 = msg("00536:35", part1614); + +var part1615 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Discarded a second initial packet'), Field(p0,false)}" +match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); + +var part1616 = // "Pattern{Field(,false), Constant('which arrived within '), Field(fld2,true), Constant(' after the first')}" +match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); + +var all345 = all_match({ + processors: [ + part1615, + dup404, + part1616, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1020 = msg("00536:36", all345); + +var part1617 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Completed Aggressive mode negotiations with a '), Field(fld2,true), Constant(' lifetime')}" +match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1021 = msg("00536:37", part1617); + +var part1618 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Certificate received has a subject name that does not match the ID payload')}" +match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1022 = msg("00536:38", part1618); + +var part1619 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Certificate received has a different IP address '), Field(fld2,true), Constant(' than expected')}" +match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1023 = msg("00536:39", part1619); + +var part1620 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Cannot use a preshared key because the peer'), Field(p0,false)}" +match("MESSAGE#1011:00536:40/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{p0}"); + +var part1621 = // "Pattern{Constant('s gateway has a dynamic IP address and negotiations are in Main mode'), Field(,false)}" +match("MESSAGE#1011:00536:40/2", "nwparser.p0", "s gateway has a dynamic IP address and negotiations are in Main mode%{}"); + +var all346 = all_match({ + processors: [ + part1620, + dup363, + part1621, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1024 = msg("00536:40", all346); + +var part1622 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Initiated negotiations in Aggressive mode')}" +match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1025 = msg("00536:47", part1622); + +var part1623 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Cannot verify RSA signature')}" +match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1026 = msg("00536:41", part1623); + +var part1624 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Initiated Main mode negotiations')}" +match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1027 = msg("00536:42", part1624); + +var part1625 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Initiated negotiations')}" +match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1028 = msg("00536:43", part1625); + +var part1626 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Changed heartbeat interval to '), Field(fld2,false)}" +match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1029 = msg("00536:44", part1626); + +var part1627 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Heartbeats have been '), Field(disposition,true), Constant(' because '), Field(result,false)}" +match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1030 = msg("00536:45", part1627); + +var part1628 = // "Pattern{Constant('Received an IKE packet on '), Field(interface,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('/'), Field(fld1,false), Constant('. Cookies: '), Field(ike_cookie1,false), Constant(', '), Field(ike_cookie2,false), Constant('. ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Received an IKE packet on interface"), +])); + +var msg1031 = msg("00536:48", part1628); + +var part1629 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received a bad SPI')}" +match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1032 = msg("00536:46", part1629); + +var select365 = linear_select([ + msg982, + msg983, + msg984, + msg985, + msg986, + msg987, + msg988, + msg989, + msg990, + msg991, + msg992, + msg993, + msg994, + msg995, + msg996, + msg997, + msg998, + msg999, + msg1000, + msg1001, + msg1002, + msg1003, + msg1004, + msg1005, + msg1006, + msg1007, + msg1008, + msg1009, + msg1010, + msg1011, + msg1012, + msg1013, + msg1014, + msg1015, + msg1016, + msg1017, + msg1018, + msg1019, + msg1020, + msg1021, + msg1022, + msg1023, + msg1024, + msg1025, + msg1026, + msg1027, + msg1028, + msg1029, + msg1030, + msg1031, + msg1032, +]); + +var part1630 = // "Pattern{Constant('PPPoE '), Field(disposition,true), Constant(' to establish a session: '), Field(info,false)}" +match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ + dup18, + dup2, + dup4, + dup5, + dup3, +])); + +var msg1033 = msg("00537", part1630); + +var part1631 = // "Pattern{Constant('PPPoE session shuts down: '), Field(result,false)}" +match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1034 = msg("00537:01", part1631); + +var part1632 = // "Pattern{Constant('The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: '), Field(result,false)}" +match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1035 = msg("00537:02", part1632); + +var part1633 = // "Pattern{Constant('PPPoE session has successfully established'), Field(,false)}" +match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1036 = msg("00537:03", part1633); + +var select366 = linear_select([ + msg1033, + msg1034, + msg1035, + msg1036, +]); + +var part1634 = // "Pattern{Constant('NACN failed to register to Policy Manager '), Field(fld2,true), Constant(' because '), Field(p0,false)}" +match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); + +var select367 = linear_select([ + dup111, + dup119, +]); + +var part1635 = // "Pattern{Constant(''), Field(result,false)}" +match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); + +var all347 = all_match({ + processors: [ + part1634, + select367, + part1635, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1037 = msg("00538", all347); + +var part1636 = // "Pattern{Constant('NACN successfully registered to Policy Manager '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1038 = msg("00538:01", part1636); + +var part1637 = // "Pattern{Constant('The NACN protocol has started for Policy Manager '), Field(fld2,true), Constant(' on hostname '), Field(hostname,true), Constant(' IP address '), Field(hostip,true), Constant(' port '), Field(network_port,false), Constant('.')}" +match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1039 = msg("00538:02", part1637); + +var part1638 = // "Pattern{Constant('Cannot connect to NSM Server at '), Field(hostip,true), Constant(' ('), Field(fld2,true), Constant(' connect attempt(s)) '), Field(fld3,false)}" +match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ + dup19, + dup2, + dup4, + dup5, + dup3, +])); + +var msg1040 = msg("00538:03", part1638); + +var part1639 = // "Pattern{Constant('Device is not known to Global PRO data collector at '), Field(hostip,false)}" +match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1041 = msg("00538:04", part1639); + +var part1640 = // "Pattern{Constant('Lost '), Field(p0,false)}" +match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); + +var part1641 = // "Pattern{Constant('socket connection'), Field(p0,false)}" +match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); + +var part1642 = // "Pattern{Constant('connection'), Field(p0,false)}" +match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); + +var select368 = linear_select([ + part1641, + part1642, +]); + +var part1643 = // "Pattern{Field(,false), Constant('to Global PRO data collector at '), Field(hostip,false)}" +match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); + +var all348 = all_match({ + processors: [ + part1640, + select368, + part1643, + ], + on_success: processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1042 = msg("00538:05", all348); + +var part1644 = // "Pattern{Constant('Device has connected to the Global PRO'), Field(p0,false)}" +match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); + +var part1645 = // "Pattern{Constant(' '), Field(fld2,true), Constant(' primary data collector at '), Field(p0,false)}" +match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); + +var part1646 = // "Pattern{Constant(' primary data collector at '), Field(p0,false)}" +match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); + +var select369 = linear_select([ + part1645, + part1646, +]); + +var part1647 = // "Pattern{Field(hostip,false)}" +match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); + +var all349 = all_match({ + processors: [ + part1644, + select369, + part1647, + ], + on_success: processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1043 = msg("00538:06", all349); + +var part1648 = // "Pattern{Constant('Connection to Global PRO data collector at '), Field(hostip,true), Constant(' has'), Field(p0,false)}" +match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); + +var part1649 = // "Pattern{Constant(' been'), Field(p0,false)}" +match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); + +var select370 = linear_select([ + part1649, + dup16, +]); + +var all350 = all_match({ + processors: [ + part1648, + select370, + dup136, + ], + on_success: processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1044 = msg("00538:07", all350); + +var part1650 = // "Pattern{Constant('Cannot connect to Global PRO data collector at '), Field(hostip,false)}" +match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1045 = msg("00538:08", part1650); + +var part1651 = // "Pattern{Constant('NSM: Connected to NSM server at '), Field(hostip,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ + dup303, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("event_description","Connected to NSM server"), +])); + +var msg1046 = msg("00538:09", part1651); + +var part1652 = // "Pattern{Constant('NSM: Connection to NSM server at '), Field(hostip,true), Constant(' is down. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(p0,false)}" +match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); + +var part1653 = // "Pattern{Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); + +var select371 = linear_select([ + part1653, + dup41, +]); + +var all351 = all_match({ + processors: [ + part1652, + select371, + ], + on_success: processor_chain([ + dup200, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("event_description","Connection to NSM server is down"), + ]), +}); + +var msg1047 = msg("00538:10", all351); + +var part1654 = // "Pattern{Constant('NSM: Cannot connect to NSM server at '), Field(hostip,false), Constant('. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld2,true), Constant(' connect attempt(s)) ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ + dup200, + dup2, + dup3, + dup9, + dup4, + dup5, + dup325, +])); + +var msg1048 = msg("00538:11", part1654); + +var part1655 = // "Pattern{Constant('NSM: Cannot connect to NSM server at '), Field(hostip,false), Constant('. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ + dup200, + dup2, + dup3, + dup9, + dup4, + dup5, + dup325, +])); + +var msg1049 = msg("00538:12", part1655); + +var part1656 = // "Pattern{Constant('NSM: Sent 2B message ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, + setc("event_description","Sent 2B message"), +])); + +var msg1050 = msg("00538:13", part1656); + +var select372 = linear_select([ + msg1037, + msg1038, + msg1039, + msg1040, + msg1041, + msg1042, + msg1043, + msg1044, + msg1045, + msg1046, + msg1047, + msg1048, + msg1049, + msg1050, +]); + +var part1657 = // "Pattern{Constant('No IP address in L2TP IP pool for user '), Field(username,false)}" +match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1051 = msg("00539", part1657); + +var part1658 = // "Pattern{Constant('No L2TP IP pool for user '), Field(username,false)}" +match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1052 = msg("00539:01", part1658); + +var part1659 = // "Pattern{Constant('Cannot allocate IP addr from Pool '), Field(group_object,true), Constant(' for user '), Field(username,false)}" +match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ + dup117, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1053 = msg("00539:02", part1659); + +var part1660 = // "Pattern{Constant('Dialup HDLC PPP failed to establish a session: '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1054 = msg("00539:03", part1660); + +var part1661 = // "Pattern{Constant('Dialup HDLC PPP session has successfully established.'), Field(,false)}" +match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1055 = msg("00539:04", part1661); + +var part1662 = // "Pattern{Constant('No IP Pool has been assigned. You cannot allocate an IP address'), Field(,false)}" +match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1056 = msg("00539:05", part1662); + +var part1663 = // "Pattern{Constant('PPP settings changed.'), Field(,false)}" +match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1057 = msg("00539:06", part1663); + +var select373 = linear_select([ + msg1051, + msg1052, + msg1053, + msg1054, + msg1055, + msg1056, + msg1057, +]); + +var part1664 = // "Pattern{Constant('ScreenOS '), Field(fld2,true), Constant(' serial # '), Field(serial_number,false), Constant(': Asset recovery has been '), Field(disposition,false)}" +match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ + dup326, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1058 = msg("00541", part1664); + +var part1665 = // "Pattern{Constant('Neighbor router ID - '), Field(fld2,true), Constant(' IP address - '), Field(hostip,true), Constant(' changed its state to '), Field(change_new,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ + dup275, + dup9, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1059 = msg("00541:01", part1665); + +var part1666 = // "Pattern{Constant('The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' state, (neighbor router-id 1'), Field(fld2,false), Constant(', ip-address '), Field(hostip,false), Constant('). ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ + dup275, + dup9, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1060 = msg("00541:02", part1666); + +var part1667 = // "Pattern{Constant('LSA in following area aged out: LSA area ID '), Field(fld3,false), Constant(', LSA ID '), Field(fld4,false), Constant(', router ID '), Field(fld2,false), Constant(', type '), Field(fld7,true), Constant(' in OSPF. ('), Field(fld1,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); + +var part1668 = // "Pattern{Constant('<<'), Field(fld16,false), Constant('>')}" +match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); + +var select374 = linear_select([ + part1668, + dup21, +]); + +var all352 = all_match({ + processors: [ + part1667, + select374, + ], + on_success: processor_chain([ + dup44, + dup9, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1061 = msg("00541:03", all352); + +var select375 = linear_select([ + msg1058, + msg1059, + msg1060, + msg1061, +]); + +var part1669 = // "Pattern{Constant('BGP of vr: '), Field(node,false), Constant(', prefix adding: '), Field(fld2,false), Constant(', ribin overflow '), Field(fld3,true), Constant(' times (max rib-in '), Field(fld4,false), Constant(')')}" +match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1062 = msg("00542", part1669); + +var part1670 = // "Pattern{Constant('Access for '), Field(p0,false)}" +match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); + +var part1671 = // "Pattern{Constant('WebAuth firewall '), Field(p0,false)}" +match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); + +var part1672 = // "Pattern{Constant('firewall '), Field(p0,false)}" +match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); + +var select376 = linear_select([ + part1671, + part1672, +]); + +var part1673 = // "Pattern{Constant('user '), Field(username,true), Constant(' '), Field(space,false), Constant('at '), Field(hostip,true), Constant(' (accepted at '), Field(fld2,true), Constant(' for duration '), Field(duration,true), Constant(' via the '), Field(logon_type,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); + +var part1674 = // "Pattern{Constant('by policy id '), Field(policy_id,true), Constant(' is '), Field(p0,false)}" +match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); + +var select377 = linear_select([ + part1674, + dup106, +]); + +var part1675 = // "Pattern{Constant('now over ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); + +var all353 = all_match({ + processors: [ + part1670, + select376, + part1673, + select377, + part1675, + ], + on_success: processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup9, + dup3, + ]), +}); + +var msg1063 = msg("00543", all353); + +var part1676 = // "Pattern{Constant('User '), Field(username,true), Constant(' [ of group '), Field(group,true), Constant(' ] at '), Field(hostip,true), Constant(' has been challenged by the RADIUS server at '), Field(daddr,false)}" +match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup3, + dup60, + setc("action","RADIUS server challenge"), +])); + +var msg1064 = msg("00544", part1676); + +var part1677 = // "Pattern{Constant('delete-route-> trust-vr: '), Field(fld2,false)}" +match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ + dup283, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1065 = msg("00546", part1677); + +var part1678 = // "Pattern{Constant('AV: Content from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' was not scanned because max content size was exceeded.')}" +match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup3, + dup61, +])); + +var msg1066 = msg("00547", part1678); + +var part1679 = // "Pattern{Constant('AV: Content from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' was not scanned due to a scan engine error or constraint.')}" +match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup3, + dup61, +])); + +var msg1067 = msg("00547:01", part1679); + +var part1680 = // "Pattern{Constant('AV object scan-mgr data has been '), Field(disposition,false), Constant('.')}" +match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1068 = msg("00547:02", part1680); + +var part1681 = // "Pattern{Constant('AV: Content from '), Field(location_desc,false), Constant(', http url: '), Field(url,false), Constant(', is passed '), Field(p0,false)}" +match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); + +var part1682 = // "Pattern{Constant('due to '), Field(p0,false)}" +match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); + +var part1683 = // "Pattern{Constant('because '), Field(p0,false)}" +match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); + +var select378 = linear_select([ + part1682, + part1683, +]); + +var part1684 = // "Pattern{Constant(''), Field(result,false), Constant('. ('), Field(event_time_string,false), Constant(')')}" +match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); + +var all354 = all_match({ + processors: [ + part1681, + select378, + part1684, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + setc("event_description","Content is bypassed for connection"), + ]), +}); + +var msg1069 = msg("00547:03", all354); + +var select379 = linear_select([ + msg1066, + msg1067, + msg1068, + msg1069, +]); + +var part1685 = // "Pattern{Constant('add-route-> untrust-vr: '), Field(fld2,false)}" +match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ + dup283, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1070 = msg("00549", part1685); + +var part1686 = // "Pattern{Constant('Error '), Field(resultcode,true), Constant(' occurred during configlet file processing.')}" +match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1071 = msg("00551", part1686); + +var part1687 = // "Pattern{Constant('Error '), Field(resultcode,true), Constant(' occurred, causing failure to establish secure management with Management System.')}" +match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ + dup86, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1072 = msg("00551:01", part1687); + +var part1688 = // "Pattern{Constant('Configlet file '), Field(p0,false)}" +match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); + +var part1689 = // "Pattern{Constant('decryption '), Field(p0,false)}" +match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); + +var select380 = linear_select([ + part1689, + dup89, +]); + +var all355 = all_match({ + processors: [ + part1688, + select380, + dup128, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1073 = msg("00551:02", all355); + +var part1690 = // "Pattern{Constant('Rapid Deployment cannot start because gateway has undergone configuration changes. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ + dup18, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1074 = msg("00551:03", part1690); + +var part1691 = // "Pattern{Constant('Secure management established successfully with remote server. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1075 = msg("00551:04", part1691); + +var select381 = linear_select([ + msg1071, + msg1072, + msg1073, + msg1074, + msg1075, +]); + +var part1692 = // "Pattern{Constant('SCAN-MGR: Failed to get '), Field(p0,false)}" +match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); + +var part1693 = // "Pattern{Constant('AltServer '), Field(p0,false)}" +match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); + +var part1694 = // "Pattern{Constant('Version '), Field(p0,false)}" +match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); + +var part1695 = // "Pattern{Constant('Path_GateLockCE '), Field(p0,false)}" +match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); + +var select382 = linear_select([ + part1693, + part1694, + part1695, +]); + +var all356 = all_match({ + processors: [ + part1692, + select382, + dup327, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1076 = msg("00553", all356); + +var part1696 = // "Pattern{Constant('SCAN-MGR: Zero pattern size from server.ini.'), Field(,false)}" +match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1077 = msg("00553:01", part1696); + +var part1697 = // "Pattern{Constant('SCAN-MGR: Pattern size from server.ini is too large: '), Field(bytes,true), Constant(' (bytes).')}" +match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1078 = msg("00553:02", part1697); + +var part1698 = // "Pattern{Constant('SCAN-MGR: Pattern URL from server.ini is too long: '), Field(fld2,false), Constant('; max is '), Field(fld3,false), Constant('.')}" +match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1079 = msg("00553:03", part1698); + +var part1699 = // "Pattern{Constant('SCAN-MGR: Failed to retrieve '), Field(p0,false)}" +match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); + +var select383 = linear_select([ + dup328, + dup329, +]); + +var part1700 = // "Pattern{Constant('file: '), Field(fld2,false), Constant('; http status code: '), Field(resultcode,false), Constant('.')}" +match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); + +var all357 = all_match({ + processors: [ + part1699, + select383, + part1700, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1080 = msg("00553:04", all357); + +var part1701 = // "Pattern{Constant('SCAN-MGR: Failed to write pattern into a RAM file.'), Field(,false)}" +match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1081 = msg("00553:05", part1701); + +var part1702 = // "Pattern{Constant('SCAN-MGR: Check Pattern File failed: code from VSAPI: '), Field(resultcode,false)}" +match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1082 = msg("00553:06", part1702); + +var part1703 = // "Pattern{Constant('SCAN-MGR: Failed to write pattern into flash.'), Field(,false)}" +match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1083 = msg("00553:07", part1703); + +var part1704 = // "Pattern{Constant('SCAN-MGR: Internal error while setting up for retrieving '), Field(p0,false)}" +match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); + +var select384 = linear_select([ + dup329, + dup328, +]); + +var all358 = all_match({ + processors: [ + part1704, + select384, + dup330, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1084 = msg("00553:08", all358); + +var part1705 = // "Pattern{Constant('SCAN-MGR: '), Field(fld2,true), Constant(' '), Field(disposition,false), Constant(': Err: '), Field(resultcode,false), Constant('.')}" +match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1085 = msg("00553:09", part1705); + +var part1706 = // "Pattern{Constant('SCAN-MGR: TMIntCPVSInit '), Field(disposition,true), Constant(' due to '), Field(result,false)}" +match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1086 = msg("00553:10", part1706); + +var part1707 = // "Pattern{Constant('SCAN-MGR: Attempted Pattern Creation Date('), Field(fld2,false), Constant(') is after AV Key Expiration date('), Field(fld3,false), Constant(').')}" +match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1087 = msg("00553:11", part1707); + +var part1708 = // "Pattern{Constant('SCAN-MGR: TMIntSetDecompressLayer '), Field(disposition,false), Constant(': Layer: '), Field(fld2,false), Constant(', Err: '), Field(resultcode,false), Constant('.')}" +match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1088 = msg("00553:12", part1708); + +var part1709 = // "Pattern{Constant('SCAN-MGR: TMIntSetExtractFileSizeLimit '), Field(disposition,false), Constant(': Limit: '), Field(fld2,false), Constant(', Err: '), Field(resultcode,false), Constant('.')}" +match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1089 = msg("00553:13", part1709); + +var part1710 = // "Pattern{Constant('SCAN-MGR: TMIntScanFile '), Field(disposition,false), Constant(': ret: '), Field(fld2,false), Constant('; cpapiErrCode: '), Field(resultcode,false), Constant('.')}" +match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1090 = msg("00553:14", part1710); + +var part1711 = // "Pattern{Constant('SCAN-MGR: VSAPI resource usage error. Left usage: '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1091 = msg("00553:15", part1711); + +var part1712 = // "Pattern{Constant('SCAN-MGR: Set decompress layer to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1092 = msg("00553:16", part1712); + +var part1713 = // "Pattern{Constant('SCAN-MGR: Set maximum content size to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1093 = msg("00553:17", part1713); + +var part1714 = // "Pattern{Constant('SCAN-MGR: Set maximum number of concurrent messages to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1094 = msg("00553:18", part1714); + +var part1715 = // "Pattern{Constant('SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1095 = msg("00553:19", part1715); + +var part1716 = // "Pattern{Constant('SCAN-MGR: Set Pattern URL to '), Field(fld2,false), Constant('; update interval is '), Field(fld3,false), Constant('.')}" +match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1096 = msg("00553:20", part1716); + +var part1717 = // "Pattern{Constant('SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.'), Field(,false)}" +match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1097 = msg("00553:21", part1717); + +var part1718 = // "Pattern{Constant('SCAN-MGR: New pattern updated: version: '), Field(version,false), Constant(', size: '), Field(bytes,true), Constant(' (bytes).')}" +match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1098 = msg("00553:22", part1718); + +var select385 = linear_select([ + msg1076, + msg1077, + msg1078, + msg1079, + msg1080, + msg1081, + msg1082, + msg1083, + msg1084, + msg1085, + msg1086, + msg1087, + msg1088, + msg1089, + msg1090, + msg1091, + msg1092, + msg1093, + msg1094, + msg1095, + msg1096, + msg1097, + msg1098, +]); + +var part1719 = // "Pattern{Constant('SCAN-MGR: Cannot get '), Field(p0,false)}" +match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); + +var part1720 = // "Pattern{Constant('AltServer info '), Field(p0,false)}" +match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); + +var part1721 = // "Pattern{Constant('Version number '), Field(p0,false)}" +match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); + +var part1722 = // "Pattern{Constant('Path_GateLockCE info '), Field(p0,false)}" +match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); + +var select386 = linear_select([ + part1720, + part1721, + part1722, +]); + +var all359 = all_match({ + processors: [ + part1719, + select386, + dup327, + ], + on_success: processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1099 = msg("00554", all359); + +var part1723 = // "Pattern{Constant('SCAN-MGR: Per server.ini file, the AV pattern file size is zero.'), Field(,false)}" +match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1100 = msg("00554:01", part1723); + +var part1724 = // "Pattern{Constant('SCAN-MGR: AV pattern file size is too large ('), Field(bytes,true), Constant(' bytes).')}" +match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1101 = msg("00554:02", part1724); + +var part1725 = // "Pattern{Constant('SCAN-MGR: Alternate AV pattern file server URL is too long: '), Field(bytes,true), Constant(' bytes. Max: '), Field(fld2,true), Constant(' bytes.')}" +match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1102 = msg("00554:03", part1725); + +var part1726 = // "Pattern{Constant('SCAN-MGR: Cannot retrieve '), Field(p0,false)}" +match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); + +var part1727 = // "Pattern{Constant('file from '), Field(hostip,false), Constant(':'), Field(network_port,false), Constant('. HTTP status code: '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); + +var all360 = all_match({ + processors: [ + part1726, + dup408, + part1727, + ], + on_success: processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1103 = msg("00554:04", all360); + +var part1728 = // "Pattern{Constant('SCAN-MGR: Cannot write AV pattern file to '), Field(p0,false)}" +match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); + +var part1729 = // "Pattern{Constant('RAM '), Field(p0,false)}" +match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); + +var part1730 = // "Pattern{Constant('flash '), Field(p0,false)}" +match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); + +var select387 = linear_select([ + part1729, + part1730, +]); + +var all361 = all_match({ + processors: [ + part1728, + select387, + dup116, + ], + on_success: processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1104 = msg("00554:05", all361); + +var part1731 = // "Pattern{Constant('SCAN-MGR: Cannot check AV pattern file. VSAPI code: '), Field(fld2,false)}" +match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ + dup144, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1105 = msg("00554:06", part1731); + +var part1732 = // "Pattern{Constant('SCAN-MGR: Internal error occurred while retrieving '), Field(p0,false)}" +match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); + +var all362 = all_match({ + processors: [ + part1732, + dup408, + dup330, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1106 = msg("00554:07", all362); + +var part1733 = // "Pattern{Constant('SCAN-MGR: Internal error occurred when calling this function: '), Field(fld2,false), Constant('. '), Field(fld3,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); + +var part1734 = // "Pattern{Constant('Error: '), Field(resultcode,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); + +var part1735 = // "Pattern{Constant('Returned a NULL VSC handler '), Field(p0,false)}" +match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); + +var part1736 = // "Pattern{Constant('cpapiErrCode: '), Field(resultcode,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); + +var select388 = linear_select([ + part1734, + part1735, + part1736, +]); + +var all363 = all_match({ + processors: [ + part1733, + select388, + dup116, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1107 = msg("00554:08", all363); + +var part1737 = // "Pattern{Constant('SCAN-MGR: Number of decompression layers has been set to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1108 = msg("00554:09", part1737); + +var part1738 = // "Pattern{Constant('SCAN-MGR: Maximum content size has been set to '), Field(fld2,true), Constant(' KB.')}" +match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1109 = msg("00554:10", part1738); + +var part1739 = // "Pattern{Constant('SCAN-MGR: Maximum number of concurrent messages has been set to '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1110 = msg("00554:11", part1739); + +var part1740 = // "Pattern{Constant('SCAN-MGR: Fail mode has been set to '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); + +var part1741 = // "Pattern{Constant('drop '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); + +var part1742 = // "Pattern{Constant('pass '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); + +var select389 = linear_select([ + part1741, + part1742, +]); + +var part1743 = // "Pattern{Constant('unexamined traffic if '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); + +var part1744 = // "Pattern{Constant('content size '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); + +var part1745 = // "Pattern{Constant('number of concurrent messages '), Field(p0,false)}" +match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); + +var select390 = linear_select([ + part1744, + part1745, +]); + +var part1746 = // "Pattern{Constant('exceeds max.'), Field(,false)}" +match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); + +var all364 = all_match({ + processors: [ + part1740, + select389, + part1743, + select390, + part1746, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1111 = msg("00554:12", all364); + +var part1747 = // "Pattern{Constant('SCAN-MGR: URL for AV pattern update server has been set to '), Field(fld2,false), Constant(', and the update interval to '), Field(fld3,true), Constant(' minutes.')}" +match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1112 = msg("00554:13", part1747); + +var part1748 = // "Pattern{Constant('SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.'), Field(,false)}" +match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1113 = msg("00554:14", part1748); + +var part1749 = // "Pattern{Constant('SCAN-MGR: New AV pattern file has been updated. Version: '), Field(version,false), Constant('; size: '), Field(bytes,true), Constant(' bytes.')}" +match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1114 = msg("00554:15", part1749); + +var part1750 = // "Pattern{Constant('SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1115 = msg("00554:16", part1750); + +var part1751 = // "Pattern{Constant('SCAN-MGR: Attempted to load AV pattern file created '), Field(fld2,true), Constant(' after the AV subscription expired. (Exp: '), Field(fld3,false), Constant(')')}" +match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1116 = msg("00554:17", part1751); + +var select391 = linear_select([ + msg1099, + msg1100, + msg1101, + msg1102, + msg1103, + msg1104, + msg1105, + msg1106, + msg1107, + msg1108, + msg1109, + msg1110, + msg1111, + msg1112, + msg1113, + msg1114, + msg1115, + msg1116, +]); + +var part1752 = // "Pattern{Constant('Vrouter '), Field(node,true), Constant(' PIMSM cannot process non-multicast address '), Field(hostip,false)}" +match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1117 = msg("00555", part1752); + +var part1753 = // "Pattern{Constant('UF-MGR: Failed to process a request. Reason: '), Field(result,false)}" +match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1118 = msg("00556", part1753); + +var part1754 = // "Pattern{Constant('UF-MGR: Failed to abort a transaction. Reason: '), Field(result,false)}" +match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1119 = msg("00556:01", part1754); + +var part1755 = // "Pattern{Constant('UF-MGR: UF '), Field(p0,false)}" +match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); + +var part1756 = // "Pattern{Constant('K'), Field(p0,false)}" +match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); + +var part1757 = // "Pattern{Constant('k'), Field(p0,false)}" +match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); + +var select392 = linear_select([ + part1756, + part1757, +]); + +var part1758 = // "Pattern{Constant('ey '), Field(p0,false)}" +match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); + +var part1759 = // "Pattern{Constant('Expired'), Field(p0,false)}" +match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); + +var part1760 = // "Pattern{Constant('expired'), Field(p0,false)}" +match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); + +var select393 = linear_select([ + part1759, + part1760, +]); + +var part1761 = // "Pattern{Field(,false), Constant('(expiration date: '), Field(fld2,false), Constant('; current date: '), Field(fld3,false), Constant(').')}" +match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); + +var all365 = all_match({ + processors: [ + part1755, + select392, + part1758, + select393, + part1761, + ], + on_success: processor_chain([ + dup256, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1120 = msg("00556:02", all365); + +var part1762 = // "Pattern{Constant('UF-MGR: Failed to '), Field(p0,false)}" +match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); + +var part1763 = // "Pattern{Constant('enable '), Field(p0,false)}" +match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); + +var part1764 = // "Pattern{Constant('disable '), Field(p0,false)}" +match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); + +var select394 = linear_select([ + part1763, + part1764, +]); + +var part1765 = // "Pattern{Constant('cache.'), Field(,false)}" +match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); + +var all366 = all_match({ + processors: [ + part1762, + select394, + part1765, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1121 = msg("00556:03", all366); + +var part1766 = // "Pattern{Constant('UF-MGR: Internal Error: '), Field(resultcode,false)}" +match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1122 = msg("00556:04", part1766); + +var part1767 = // "Pattern{Constant('UF-MGR: Cache size changed to '), Field(fld2,false), Constant('(K).')}" +match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1123 = msg("00556:05", part1767); + +var part1768 = // "Pattern{Constant('UF-MGR: Cache timeout changes to '), Field(fld2,true), Constant(' (hours).')}" +match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1124 = msg("00556:06", part1768); + +var part1769 = // "Pattern{Constant('UF-MGR: Category update interval changed to '), Field(fld2,true), Constant(' (weeks).')}" +match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1125 = msg("00556:07", part1769); + +var part1770 = // "Pattern{Constant('UF-MGR: Cache '), Field(p0,false)}" +match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); + +var all367 = all_match({ + processors: [ + part1770, + dup360, + dup116, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1126 = msg("00556:08", all367); + +var part1771 = // "Pattern{Constant('UF-MGR: URL BLOCKED: ip_addr ('), Field(fld2,false), Constant(') -> ip_addr ('), Field(fld3,false), Constant('), '), Field(fld4,true), Constant(' action: '), Field(disposition,false), Constant(', category: '), Field(fld5,false), Constant(', reason '), Field(result,false)}" +match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ + dup234, + dup2, + dup3, + dup4, + dup5, + dup284, +])); + +var msg1127 = msg("00556:09", part1771); + +var part1772 = // "Pattern{Constant('UF-MGR: URL FILTER ERR: ip_addr ('), Field(fld2,false), Constant(') -> ip_addr ('), Field(fld3,false), Constant('), host: '), Field(fld5,true), Constant(' page: '), Field(fld4,true), Constant(' code: '), Field(resultcode,true), Constant(' reason: '), Field(result,false), Constant('.')}" +match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ + dup234, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1128 = msg("00556:10", part1772); + +var part1773 = // "Pattern{Constant('UF-MGR: Primary CPA server changed to '), Field(fld2,false)}" +match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1129 = msg("00556:11", part1773); + +var part1774 = // "Pattern{Constant('UF-MGR: '), Field(fld2,true), Constant(' CPA server '), Field(p0,false)}" +match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); + +var select395 = linear_select([ + dup140, + dup171, +]); + +var part1775 = // "Pattern{Constant('changed to '), Field(fld3,false), Constant('.')}" +match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); + +var all368 = all_match({ + processors: [ + part1774, + select395, + part1775, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1130 = msg("00556:12", all368); + +var part1776 = // "Pattern{Constant('UF-MGR: SurfControl URL filtering '), Field(disposition,false), Constant('.')}" +match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1131 = msg("00556:13", part1776); + +var part1777 = // "Pattern{Constant('UF-MGR: The url '), Field(url,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); + +var part1778 = // "Pattern{Constant('category '), Field(fld2,false), Constant('.')}" +match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); + +var all369 = all_match({ + processors: [ + part1777, + dup409, + part1778, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1132 = msg("00556:14", all369); + +var part1779 = // "Pattern{Constant('UF-MGR: The category '), Field(fld2,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); + +var part1780 = // "Pattern{Constant('profile '), Field(fld3,true), Constant(' with action '), Field(disposition,false), Constant('.')}" +match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); + +var all370 = all_match({ + processors: [ + part1779, + dup409, + part1780, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + dup284, + ]), +}); + +var msg1133 = msg("00556:15", all370); + +var part1781 = // "Pattern{Constant('UF-MGR: The '), Field(p0,false)}" +match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); + +var part1782 = // "Pattern{Constant('profile '), Field(p0,false)}" +match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); + +var part1783 = // "Pattern{Constant('category '), Field(p0,false)}" +match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); + +var select396 = linear_select([ + part1782, + part1783, +]); + +var part1784 = // "Pattern{Constant(''), Field(fld2,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); + +var select397 = linear_select([ + dup104, + dup120, +]); + +var all371 = all_match({ + processors: [ + part1781, + select396, + part1784, + select397, + dup116, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1134 = msg("00556:16", all371); + +var part1785 = // "Pattern{Constant('UF-MGR: The category '), Field(fld2,true), Constant(' was set in profile '), Field(profile,true), Constant(' as the '), Field(p0,false)}" +match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); + +var part1786 = // "Pattern{Constant('black '), Field(p0,false)}" +match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); + +var part1787 = // "Pattern{Constant('white '), Field(p0,false)}" +match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); + +var select398 = linear_select([ + part1786, + part1787, +]); + +var part1788 = // "Pattern{Constant('list.'), Field(,false)}" +match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); + +var all372 = all_match({ + processors: [ + part1785, + select398, + part1788, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1135 = msg("00556:17", all372); + +var part1789 = // "Pattern{Constant('UF-MGR: The action for '), Field(fld2,true), Constant(' in profile '), Field(profile,true), Constant(' was '), Field(p0,false)}" +match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); + +var part1790 = // "Pattern{Constant('changed '), Field(p0,false)}" +match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); + +var select399 = linear_select([ + dup101, + part1790, +]); + +var part1791 = // "Pattern{Constant('to '), Field(fld3,false), Constant('.')}" +match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); + +var all373 = all_match({ + processors: [ + part1789, + select399, + part1791, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1136 = msg("00556:18", all373); + +var part1792 = // "Pattern{Constant('UF-MGR: The category list from the CPA server '), Field(p0,false)}" +match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); + +var part1793 = // "Pattern{Constant('updated on'), Field(p0,false)}" +match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); + +var select400 = linear_select([ + dup103, + dup96, +]); + +var part1794 = // "Pattern{Constant('the device.'), Field(,false)}" +match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); + +var all374 = all_match({ + processors: [ + part1792, + dup357, + part1793, + select400, + part1794, + ], + on_success: processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1137 = msg("00556:20", all374); + +var part1795 = // "Pattern{Constant('UF-MGR: URL BLOCKED: '), Field(saddr,false), Constant('('), Field(sport,false), Constant(')->'), Field(daddr,false), Constant('('), Field(dport,false), Constant('), '), Field(fld2,true), Constant(' action: '), Field(disposition,false), Constant(', category: '), Field(category,false), Constant(', reason: '), Field(result,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ + dup234, + dup2, + dup3, + dup9, + dup4, + dup5, + dup284, +])); + +var msg1138 = msg("00556:21", part1795); + +var part1796 = // "Pattern{Constant('UF-MGR: URL BLOCKED: '), Field(saddr,false), Constant('('), Field(sport,false), Constant(')->'), Field(daddr,false), Constant('('), Field(dport,false), Constant('), '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ + dup234, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1139 = msg("00556:22", part1796); + +var select401 = linear_select([ + msg1118, + msg1119, + msg1120, + msg1121, + msg1122, + msg1123, + msg1124, + msg1125, + msg1126, + msg1127, + msg1128, + msg1129, + msg1130, + msg1131, + msg1132, + msg1133, + msg1134, + msg1135, + msg1136, + msg1137, + msg1138, + msg1139, +]); + +var part1797 = // "Pattern{Constant('PPP LCP on interface '), Field(interface,true), Constant(' is '), Field(fld2,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1140 = msg("00572", part1797); + +var part1798 = // "Pattern{Constant('PPP authentication state on interface '), Field(interface,false), Constant(': '), Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1141 = msg("00572:01", part1798); + +var part1799 = // "Pattern{Constant('PPP on interface '), Field(interface,true), Constant(' is '), Field(disposition,true), Constant(' by receiving Terminate-Request. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1142 = msg("00572:03", part1799); + +var select402 = linear_select([ + msg1140, + msg1141, + msg1142, +]); + +var part1800 = // "Pattern{Constant('PBR policy "'), Field(policyname,false), Constant('" rebuilding lookup tree for virtual router "'), Field(node,false), Constant('". ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg1143 = msg("00615", part1800); + +var part1801 = // "Pattern{Constant('PBR policy "'), Field(policyname,false), Constant('" lookup tree rebuilt successfully in virtual router "'), Field(node,false), Constant('". ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ + dup44, + dup2, + dup4, + dup5, + dup9, +])); + +var msg1144 = msg("00615:01", part1801); + +var select403 = linear_select([ + msg1143, + msg1144, +]); + +var part1802 = // "Pattern{Field(signame,true), Constant(' attack! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,false), Constant(', through policy '), Field(policyname,false), Constant('. Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup9, + dup4, + dup5, + dup61, +])); + +var msg1145 = msg("00601", part1802); + +var part1803 = // "Pattern{Field(signame,true), Constant(' has been detected from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' through policy '), Field(policyname,true), Constant(' '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup9, + dup4, + dup5, + dup61, +])); + +var msg1146 = msg("00601:01", part1803); + +var part1804 = // "Pattern{Constant('Error in initializing multicast.'), Field(,false)}" +match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1147 = msg("00601:18", part1804); + +var select404 = linear_select([ + msg1145, + msg1146, + msg1147, +]); + +var part1805 = // "Pattern{Constant('PIMSM Error in initializing interface state change'), Field(,false)}" +match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ + dup19, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1148 = msg("00602", part1805); + +var part1806 = // "Pattern{Constant('Switch event: the status of ethernet port '), Field(fld2,true), Constant(' changed to link '), Field(p0,false)}" +match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); + +var part1807 = // "Pattern{Constant(', duplex '), Field(p0,false)}" +match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); + +var part1808 = // "Pattern{Constant('full '), Field(p0,false)}" +match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); + +var part1809 = // "Pattern{Constant('half '), Field(p0,false)}" +match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); + +var select405 = linear_select([ + part1808, + part1809, +]); + +var part1810 = // "Pattern{Constant(', speed 10'), Field(p0,false)}" +match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); + +var part1811 = // "Pattern{Constant('0 '), Field(p0,false)}" +match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); + +var select406 = linear_select([ + part1811, + dup96, +]); + +var part1812 = // "Pattern{Constant('M. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); + +var all375 = all_match({ + processors: [ + part1806, + dup355, + part1807, + select405, + part1810, + select406, + part1812, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1149 = msg("00612", all375); + +var part1813 = // "Pattern{Constant('RTSYNC: Event posted to send all the DRP routes to backup device. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1150 = msg("00620", part1813); + +var part1814 = // "Pattern{Constant('RTSYNC: '), Field(p0,false)}" +match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); + +var part1815 = // "Pattern{Constant('Serviced'), Field(p0,false)}" +match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); + +var part1816 = // "Pattern{Constant('Recieved'), Field(p0,false)}" +match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); + +var select407 = linear_select([ + part1815, + part1816, +]); + +var part1817 = // "Pattern{Field(,false), Constant('coldstart request for route synchronization from NSRP peer. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); + +var all376 = all_match({ + processors: [ + part1814, + select407, + part1817, + ], + on_success: processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1151 = msg("00620:01", all376); + +var part1818 = // "Pattern{Constant('RTSYNC: Started timer to purge all the DRP backup routes - '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1152 = msg("00620:02", part1818); + +var part1819 = // "Pattern{Constant('RTSYNC: Event posted to purge backup routes in all vrouters. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1153 = msg("00620:03", part1819); + +var part1820 = // "Pattern{Constant('RTSYNC: Timer to purge the DRP backup routes is stopped. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1154 = msg("00620:04", part1820); + +var select408 = linear_select([ + msg1150, + msg1151, + msg1152, + msg1153, + msg1154, +]); + +var part1821 = // "Pattern{Constant('NHRP : NHRP instance in virtual router '), Field(node,true), Constant(' is created. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ + dup275, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1155 = msg("00622", part1821); + +var part1822 = // "Pattern{Constant('Session (id '), Field(sessionid,true), Constant(' src-ip '), Field(saddr,true), Constant(' dst-ip '), Field(daddr,true), Constant(' dst port '), Field(dport,false), Constant(') route is '), Field(p0,false)}" +match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); + +var part1823 = // "Pattern{Constant('invalid'), Field(p0,false)}" +match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); + +var part1824 = // "Pattern{Constant('valid'), Field(p0,false)}" +match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); + +var select409 = linear_select([ + part1823, + part1824, +]); + +var all377 = all_match({ + processors: [ + part1822, + select409, + dup49, + ], + on_success: processor_chain([ + dup275, + dup2, + dup4, + dup5, + dup9, + ]), +}); + +var msg1156 = msg("00625", all377); + +var part1825 = // "Pattern{Constant('audit log queue '), Field(p0,false)}" +match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); + +var part1826 = // "Pattern{Constant('Traffic Log '), Field(p0,false)}" +match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); + +var part1827 = // "Pattern{Constant('Event Alarm Log '), Field(p0,false)}" +match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); + +var part1828 = // "Pattern{Constant('Event Log '), Field(p0,false)}" +match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); + +var select410 = linear_select([ + part1826, + part1827, + part1828, +]); + +var part1829 = // "Pattern{Constant('is overwritten ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); + +var all378 = all_match({ + processors: [ + part1825, + select410, + part1829, + ], + on_success: processor_chain([ + dup225, + dup2, + dup4, + dup5, + dup9, + ]), +}); + +var msg1157 = msg("00628", all378); + +var part1830 = // "Pattern{Constant('Log setting was modified to '), Field(disposition,true), Constant(' '), Field(fld2,true), Constant(' level by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup4, + dup5, + dup9, + dup284, +])); + +var msg1158 = msg("00767:50", part1830); + +var part1831 = // "Pattern{Constant('Attack CS:Man in Middle is created by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup9, +])); + +var msg1159 = msg("00767:51", part1831); + +var part1832 = // "Pattern{Constant('Attack group '), Field(group,true), Constant(' is created by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup9, +])); + +var msg1160 = msg("00767:52", part1832); + +var part1833 = // "Pattern{Constant('Attack CS:Man in Middle is added to attack group '), Field(group,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ + dup58, + dup2, + dup4, + dup5, + dup9, +])); + +var msg1161 = msg("00767:53", part1833); + +var part1834 = // "Pattern{Constant('Cannot contact the SecurID server'), Field(,false)}" +match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ + dup27, + setc("ec_theme","Communication"), + dup39, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1162 = msg("00767", part1834); + +var part1835 = // "Pattern{Constant('System auto-config of file '), Field(fld2,true), Constant(' from TFTP server '), Field(hostip,true), Constant(' has '), Field(p0,false)}" +match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); + +var part1836 = // "Pattern{Constant('been loaded successfully'), Field(,false)}" +match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); + +var part1837 = // "Pattern{Constant('failed'), Field(,false)}" +match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); + +var select411 = linear_select([ + part1836, + part1837, +]); + +var all379 = all_match({ + processors: [ + part1835, + select411, + ], + on_success: processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1163 = msg("00767:01", all379); + +var part1838 = // "Pattern{Constant('netscreen: System Config saved from host '), Field(saddr,false)}" +match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ + setc("eventcategory","1702000000"), + dup2, + dup3, + dup4, + dup5, +])); + +var msg1164 = msg("00767:02", part1838); + +var part1839 = // "Pattern{Constant('System Config saved to filename '), Field(filename,false)}" +match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1165 = msg("00767:03", part1839); + +var part1840 = // "Pattern{Constant('System is operational.'), Field(,false)}" +match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1166 = msg("00767:04", part1840); + +var part1841 = // "Pattern{Constant('The device cannot contact the SecurID server'), Field(,false)}" +match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1167 = msg("00767:05", part1841); + +var part1842 = // "Pattern{Constant('The device cannot send data to the SecurID server'), Field(,false)}" +match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ + dup27, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1168 = msg("00767:06", part1842); + +var part1843 = // "Pattern{Constant('The system configuration was saved from peer unit by admin'), Field(,false)}" +match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1169 = msg("00767:07", part1843); + +var part1844 = // "Pattern{Constant('The system configuration was saved by admin '), Field(p0,false)}" +match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); + +var all380 = all_match({ + processors: [ + part1844, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1170 = msg("00767:08", all380); + +var part1845 = // "Pattern{Constant('traffic shaping is turned O'), Field(p0,false)}" +match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); + +var part1846 = // "Pattern{Constant('N'), Field(,false)}" +match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); + +var part1847 = // "Pattern{Constant('FF'), Field(,false)}" +match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); + +var select412 = linear_select([ + part1846, + part1847, +]); + +var all381 = all_match({ + processors: [ + part1845, + select412, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1171 = msg("00767:09", all381); + +var part1848 = // "Pattern{Constant('The system configuration was saved from host '), Field(saddr,true), Constant(' by admin '), Field(p0,false)}" +match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); + +var all382 = all_match({ + processors: [ + part1848, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1172 = msg("00767:10", all382); + +var part1849 = // "Pattern{Constant('Fatal error. The NetScreen device was unable to upgrade the '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); + +var part1850 = // "Pattern{Constant('file system '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); + +var select413 = linear_select([ + dup333, + part1850, +]); + +var part1851 = // "Pattern{Constant(', and the '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); + +var part1852 = // "Pattern{Constant('old file system '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); + +var select414 = linear_select([ + dup333, + part1852, +]); + +var part1853 = // "Pattern{Constant('is damaged.'), Field(,false)}" +match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); + +var all383 = all_match({ + processors: [ + part1849, + select413, + part1851, + select414, + part1853, + ], + on_success: processor_chain([ + dup18, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1173 = msg("00767:11", all383); + +var part1854 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1174 = msg("00767:12", part1854); + +var part1855 = // "Pattern{Field(fld2,false), Constant('Environment variable '), Field(fld3,true), Constant(' is changed to '), Field(fld4,true), Constant(' by admin '), Field(p0,false)}" +match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); + +var all384 = all_match({ + processors: [ + part1855, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1175 = msg("00767:13", all384); + +var part1856 = // "Pattern{Constant('System was '), Field(p0,false)}" +match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); + +var part1857 = // "Pattern{Constant('reset '), Field(p0,false)}" +match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); + +var select415 = linear_select([ + part1857, + dup264, +]); + +var part1858 = // "Pattern{Constant('at '), Field(fld2,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); + +var part1859 = // "Pattern{Constant('admin '), Field(administrator,false)}" +match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); + +var part1860 = // "Pattern{Field(username,false)}" +match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); + +var select416 = linear_select([ + part1859, + part1860, +]); + +var all385 = all_match({ + processors: [ + part1856, + select415, + part1858, + select416, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1176 = msg("00767:14", all385); + +var part1861 = // "Pattern{Constant('System '), Field(p0,false)}" +match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); + +var part1862 = // "Pattern{Constant('Event '), Field(p0,false)}" +match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); + +var part1863 = // "Pattern{Constant('Traffic '), Field(p0,false)}" +match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); + +var select417 = linear_select([ + part1861, + part1862, + part1863, +]); + +var part1864 = // "Pattern{Constant('log was reviewed by '), Field(p0,false)}" +match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); + +var part1865 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('.')}" +match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); + +var all386 = all_match({ + processors: [ + dup185, + select417, + part1864, + dup338, + part1865, + ], + on_success: processor_chain([ + dup225, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1177 = msg("00767:15", all386); + +var part1866 = // "Pattern{Field(fld2,true), Constant(' Admin '), Field(administrator,true), Constant(' issued command '), Field(info,true), Constant(' to redirect output.')}" +match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1178 = msg("00767:16", part1866); + +var part1867 = // "Pattern{Field(fld2,true), Constant(' Save new software from '), Field(fld3,true), Constant(' to flash by admin '), Field(p0,false)}" +match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); + +var all387 = all_match({ + processors: [ + part1867, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1179 = msg("00767:17", all387); + +var part1868 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' has been '), Field(fld2,true), Constant(' saved to flash.')}" +match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1180 = msg("00767:18", part1868); + +var part1869 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' was rejected because the authentication check failed.')}" +match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1181 = msg("00767:19", part1869); + +var part1870 = // "Pattern{Constant('The dictionary file version of the RADIUS server '), Field(hostname,true), Constant(' does not match '), Field(fld2,false)}" +match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1182 = msg("00767:20", part1870); + +var part1871 = // "Pattern{Constant('Session ('), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(', '), Field(fld4,false), Constant(') cleared '), Field(fld5,false)}" +match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1183 = msg("00767:21", part1871); + +var part1872 = // "Pattern{Constant('The system configuration was not saved '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); + +var part1873 = // "Pattern{Field(fld2,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); + +var part1874 = // "Pattern{Constant(''), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); + +var select418 = linear_select([ + part1873, + part1874, +]); + +var part1875 = // "Pattern{Constant('by administrator '), Field(fld3,false), Constant('. '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); + +var part1876 = // "Pattern{Constant('It was locked '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); + +var part1877 = // "Pattern{Constant('Locked '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); + +var select419 = linear_select([ + part1876, + part1877, +]); + +var part1878 = // "Pattern{Constant('by administrator '), Field(fld4,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); + +var all388 = all_match({ + processors: [ + part1872, + select418, + part1875, + select419, + part1878, + dup356, + ], + on_success: processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1184 = msg("00767:22", all388); + +var part1879 = // "Pattern{Constant('Save new software from slot filename '), Field(filename,true), Constant(' to flash memory by administrator '), Field(administrator,false)}" +match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1185 = msg("00767:23", part1879); + +var part1880 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from '), Field(p0,false)}" +match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); + +var select420 = linear_select([ + dup171, + dup16, +]); + +var part1881 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); + +var part1882 = // "Pattern{Field(saddr,true), Constant(' by '), Field(p0,false)}" +match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); + +var select421 = linear_select([ + part1881, + part1882, +]); + +var all389 = all_match({ + processors: [ + part1880, + select420, + dup23, + select421, + dup108, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var msg1186 = msg("00767:25", all389); + +var part1883 = // "Pattern{Constant('Lock configuration '), Field(p0,false)}" +match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); + +var part1884 = // "Pattern{Constant('started'), Field(p0,false)}" +match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); + +var part1885 = // "Pattern{Constant('ended'), Field(p0,false)}" +match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); + +var select422 = linear_select([ + part1884, + part1885, +]); + +var part1886 = // "Pattern{Field(,false), Constant('by task '), Field(p0,false)}" +match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); + +var part1887 = // "Pattern{Constant(''), Field(fld3,false), Constant(', with a timeout value of '), Field(fld2,false)}" +match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); + +var part1888 = // "Pattern{Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); + +var select423 = linear_select([ + part1887, + part1888, +]); + +var all390 = all_match({ + processors: [ + part1883, + select422, + part1886, + select423, + ], + on_success: processor_chain([ + dup50, + dup43, + dup51, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1187 = msg("00767:26", all390); + +var part1889 = // "Pattern{Constant('Environment variable '), Field(fld2,true), Constant(' changed to '), Field(p0,false)}" +match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); + +var part1890 = // "Pattern{Field(fld3,true), Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); + +var part1891 = // "Pattern{Field(fld3,false)}" +match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); + +var select424 = linear_select([ + part1890, + part1891, +]); + +var all391 = all_match({ + processors: [ + part1889, + select424, + ], + on_success: processor_chain([ + dup225, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1188 = msg("00767:27", all391); + +var part1892 = // "Pattern{Constant('The system configuration was loaded from IP address '), Field(hostip,true), Constant(' under filename '), Field(filename,true), Constant(' by administrator by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1189 = msg("00767:28", part1892); + +var part1893 = // "Pattern{Constant('Save configuration to IP address '), Field(hostip,true), Constant(' under filename '), Field(filename,true), Constant(' by administrator by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1190 = msg("00767:29", part1893); + +var part1894 = // "Pattern{Field(fld2,false), Constant(': The system configuration was saved from host '), Field(saddr,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1191 = msg("00767:30", part1894); + +var part1895 = // "Pattern{Constant('logged events or alarms '), Field(p0,false)}" +match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); + +var part1896 = // "Pattern{Constant('traffic logs '), Field(p0,false)}" +match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); + +var select425 = linear_select([ + part1895, + part1896, +]); + +var part1897 = // "Pattern{Constant('were cleared by admin '), Field(p0,false)}" +match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); + +var all392 = all_match({ + processors: [ + dup188, + select425, + part1897, + dup400, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1192 = msg("00767:31", all392); + +var part1898 = // "Pattern{Constant('SIP parser error '), Field(p0,false)}" +match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); + +var part1899 = // "Pattern{Constant('SIP-field'), Field(p0,false)}" +match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); + +var part1900 = // "Pattern{Constant('Message'), Field(p0,false)}" +match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); + +var select426 = linear_select([ + part1899, + part1900, +]); + +var part1901 = // "Pattern{Constant(': '), Field(result,false), Constant('('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); + +var all393 = all_match({ + processors: [ + part1898, + select426, + part1901, + ], + on_success: processor_chain([ + dup27, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1193 = msg("00767:32", all393); + +var part1902 = // "Pattern{Constant('Daylight Saving Time has started. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1194 = msg("00767:33", part1902); + +var part1903 = // "Pattern{Constant('NetScreen devices do not support multiple IP addresses '), Field(hostip,true), Constant(' or ports '), Field(network_port,true), Constant(' in SIP headers RESPONSE ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ + dup315, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1195 = msg("00767:34", part1903); + +var part1904 = // "Pattern{Constant('Environment variable '), Field(fld2,true), Constant(' set to '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1196 = msg("00767:35", part1904); + +var part1905 = // "Pattern{Constant('System configuration saved from '), Field(fld2,true), Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1197 = msg("00767:36", part1905); + +var part1906 = // "Pattern{Constant('Trial keys are available to download to enable advanced features. '), Field(space,true), Constant(' To find out, please visit '), Field(url,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ + dup256, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1198 = msg("00767:37", part1906); + +var part1907 = // "Pattern{Constant('Log buffer was full and remaining messages were sent to external destination. '), Field(fld2,true), Constant(' packets were dropped. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ + setc("eventcategory","1602000000"), + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1199 = msg("00767:38", part1907); + +var part1908 = // "Pattern{Constant('Cannot '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); + +var part1909 = // "Pattern{Constant('download '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); + +var part1910 = // "Pattern{Constant('parse '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); + +var select427 = linear_select([ + part1909, + part1910, +]); + +var part1911 = // "Pattern{Constant('attack database '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); + +var part1912 = // "Pattern{Constant('from '), Field(url,true), Constant(' ('), Field(result,false), Constant('). '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); + +var part1913 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); + +var select428 = linear_select([ + part1912, + part1913, +]); + +var all394 = all_match({ + processors: [ + part1908, + select427, + part1911, + select428, + dup10, + ], + on_success: processor_chain([ + dup326, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1200 = msg("00767:39", all394); + +var part1914 = // "Pattern{Constant('Deep Inspection update key is '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ + dup62, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1201 = msg("00767:40", part1914); + +var part1915 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1202 = msg("00767:42", part1915); + +var part1916 = // "Pattern{Constant('Daylight Saving Time ended. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1203 = msg("00767:43", part1916); + +var part1917 = // "Pattern{Constant('New GMT zone ahead or behind by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ + dup44, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1204 = msg("00767:44", part1917); + +var part1918 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' is saved to flash. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1205 = msg("00767:45", part1918); + +var part1919 = // "Pattern{Constant('System configuration saved by netscreen via '), Field(logon_type,true), Constant(' by netscreen. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1206 = msg("00767:46", part1919); + +var part1920 = // "Pattern{Constant('User '), Field(username,true), Constant(' belongs to a different group in the RADIUS server than that allowed in the device. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + dup9, +])); + +var msg1207 = msg("00767:47", part1920); + +var part1921 = // "Pattern{Constant('System configuration saved by '), Field(p0,false)}" +match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); + +var part1922 = // "Pattern{Field(logon_type,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); + +var all395 = all_match({ + processors: [ + part1921, + dup367, + part1922, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup9, + dup4, + dup5, + ]), +}); + +var msg1208 = msg("00767:24", all395); + +var part1923 = // "Pattern{Constant('HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ + dup274, + dup2, + dup3, + dup9, + dup4, + dup5, +])); + +var msg1209 = msg("00767:48", part1923); + +var part1924 = // "Pattern{Field(fld2,true), Constant(' turn o'), Field(p0,false)}" +match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); + +var part1925 = // "Pattern{Constant('n'), Field(p0,false)}" +match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); + +var part1926 = // "Pattern{Constant('ff'), Field(p0,false)}" +match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); + +var select429 = linear_select([ + part1925, + part1926, +]); + +var part1927 = // "Pattern{Field(,false), Constant('debug switch for '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); + +var all396 = all_match({ + processors: [ + part1924, + select429, + part1927, + ], + on_success: processor_chain([ + dup1, + dup2, + dup4, + dup5, + dup9, + ]), +}); + +var msg1210 = msg("00767:49", all396); + +var select430 = linear_select([ + msg1158, + msg1159, + msg1160, + msg1161, + msg1162, + msg1163, + msg1164, + msg1165, + msg1166, + msg1167, + msg1168, + msg1169, + msg1170, + msg1171, + msg1172, + msg1173, + msg1174, + msg1175, + msg1176, + msg1177, + msg1178, + msg1179, + msg1180, + msg1181, + msg1182, + msg1183, + msg1184, + msg1185, + msg1186, + msg1187, + msg1188, + msg1189, + msg1190, + msg1191, + msg1192, + msg1193, + msg1194, + msg1195, + msg1196, + msg1197, + msg1198, + msg1199, + msg1200, + msg1201, + msg1202, + msg1203, + msg1204, + msg1205, + msg1206, + msg1207, + msg1208, + msg1209, + msg1210, +]); + +var part1928 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup279, + dup3, + dup277, + dup60, +])); + +var msg1211 = msg("01269", part1928); + +var msg1212 = msg("01269:01", dup410); + +var msg1213 = msg("01269:02", dup411); + +var msg1214 = msg("01269:03", dup412); + +var select431 = linear_select([ + msg1211, + msg1212, + msg1213, + msg1214, +]); + +var part1929 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup278, + dup279, + dup277, + dup334, +])); + +var msg1215 = msg("17852", part1929); + +var part1930 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup334, + dup284, +])); + +var msg1216 = msg("17852:01", part1930); + +var part1931 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup278, + dup279, + dup61, +])); + +var msg1217 = msg("17852:02", part1931); + +var part1932 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup334, + dup284, +])); + +var msg1218 = msg("17852:03", part1932); + +var select432 = linear_select([ + msg1215, + msg1216, + msg1217, + msg1218, +]); + +var msg1219 = msg("23184", dup413); + +var part1933 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup61, + dup284, +])); + +var msg1220 = msg("23184:01", part1933); + +var part1934 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup278, + dup279, + dup277, + dup61, +])); + +var msg1221 = msg("23184:02", part1934); + +var part1935 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup334, + dup284, +])); + +var msg1222 = msg("23184:03", part1935); + +var select433 = linear_select([ + msg1219, + msg1220, + msg1221, + msg1222, +]); + +var msg1223 = msg("27052", dup413); + +var part1936 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,false), Constant('direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup61, + dup284, +])); + +var msg1224 = msg("27052:01", part1936); + +var select434 = linear_select([ + msg1223, + msg1224, +]); + +var part1937 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup187, + dup2, + dup4, + dup279, + dup5, + dup276, + dup3, + dup277, + dup278, + dup60, +])); + +var msg1225 = msg("39568", part1937); + +var msg1226 = msg("39568:01", dup410); + +var msg1227 = msg("39568:02", dup411); + +var msg1228 = msg("39568:03", dup412); + +var select435 = linear_select([ + msg1225, + msg1226, + msg1227, + msg1228, +]); + +var chain1 = processor_chain([ + select2, + msgid_select({ + "00001": select6, + "00002": select29, + "00003": select31, + "00004": select33, + "00005": select39, + "00006": select40, + "00007": select63, + "00008": select66, + "00009": select83, + "00010": select86, + "00011": select100, + "00012": select101, + "00013": select102, + "00014": select104, + "00015": select114, + "00016": select115, + "00017": select125, + "00018": select138, + "00019": select147, + "00020": select150, + "00021": select151, + "00022": select163, + "00023": select164, + "00024": select170, + "00025": select171, + "00026": select176, + "00027": select184, + "00028": msg469, + "00029": select188, + "00030": select197, + "00031": select205, + "00032": select207, + "00033": select214, + "00034": select225, + "00035": select232, + "00036": select234, + "00037": select241, + "00038": msg660, + "00039": msg661, + "00040": select244, + "00041": select245, + "00042": select246, + "00043": msg668, + "00044": select248, + "00045": msg671, + "00047": msg672, + "00048": select257, + "00049": select258, + "00050": msg682, + "00051": msg683, + "00052": msg684, + "00055": select265, + "00056": msg696, + "00057": msg697, + "00058": msg698, + "00059": select272, + "00062": select273, + "00063": msg713, + "00064": select274, + "00070": select276, + "00071": select277, + "00072": select278, + "00073": select279, + "00074": msg726, + "00075": select280, + "00076": select281, + "00077": select282, + "00084": msg735, + "00090": msg736, + "00200": msg737, + "00201": msg738, + "00202": msg739, + "00203": msg740, + "00206": select285, + "00207": select286, + "00257": select291, + "00259": select294, + "00262": msg778, + "00263": msg779, + "00400": msg780, + "00401": msg781, + "00402": select296, + "00403": msg784, + "00404": msg785, + "00405": msg786, + "00406": msg787, + "00407": msg788, + "00408": msg789, + "00409": msg790, + "00410": select297, + "00411": msg793, + "00413": select298, + "00414": select299, + "00415": msg799, + "00423": msg800, + "00429": select300, + "00430": select301, + "00431": msg805, + "00432": msg806, + "00433": msg807, + "00434": msg808, + "00435": select302, + "00436": select303, + "00437": select304, + "00438": select305, + "00440": select306, + "00441": msg823, + "00442": msg824, + "00443": msg825, + "00511": select307, + "00513": msg841, + "00515": select328, + "00518": select331, + "00519": select336, + "00520": select339, + "00521": msg890, + "00522": msg891, + "00523": msg892, + "00524": select340, + "00525": select341, + "00526": msg912, + "00527": select348, + "00528": select354, + "00529": select357, + "00530": select358, + "00531": select362, + "00533": msg973, + "00534": msg974, + "00535": select363, + "00536": select365, + "00537": select366, + "00538": select372, + "00539": select373, + "00541": select375, + "00542": msg1062, + "00543": msg1063, + "00544": msg1064, + "00546": msg1065, + "00547": select379, + "00549": msg1070, + "00551": select381, + "00553": select385, + "00554": select391, + "00555": msg1117, + "00556": select401, + "00572": select402, + "00601": select404, + "00602": msg1148, + "00612": msg1149, + "00615": select403, + "00620": select408, + "00622": msg1155, + "00625": msg1156, + "00628": msg1157, + "00767": select430, + "01269": select431, + "17852": select432, + "23184": select433, + "27052": select434, + "39568": select435, + }), +]); + +var part1938 = // "Pattern{Constant('Address '), Field(group_object,true), Constant(' for '), Field(p0,false)}" +match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); + +var part1939 = // "Pattern{Constant('domain address '), Field(domain,true), Constant(' in zone '), Field(p0,false)}" +match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); + +var part1940 = // "Pattern{Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); + +var part1941 = // "Pattern{Constant('('), Field(fld1,false), Constant(')')}" +match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); + +var part1942 = // "Pattern{Field(fld1,false)}" +match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); + +var part1943 = // "Pattern{Constant('Address '), Field(p0,false)}" +match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); + +var part1944 = // "Pattern{Constant('MIP('), Field(interface,false), Constant(') '), Field(p0,false)}" +match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); + +var part1945 = // "Pattern{Field(group_object,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); + +var part1946 = // "Pattern{Constant('admin '), Field(p0,false)}" +match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); + +var part1947 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); + +var part1948 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ')}" +match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); + +var part1949 = // "Pattern{}" +match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); + +var part1950 = // "Pattern{Constant(''), Field(p0,false)}" +match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); + +var part1951 = // "Pattern{Constant('password '), Field(p0,false)}" +match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); + +var part1952 = // "Pattern{Constant('name '), Field(p0,false)}" +match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); + +var part1953 = // "Pattern{Field(administrator,false)}" +match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); + +var part1954 = // "Pattern{Field(disposition,false)}" +match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); + +var part1955 = // "Pattern{Constant('via '), Field(p0,false)}" +match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); + +var part1956 = // "Pattern{Field(fld1,false), Constant(')')}" +match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); + +var part1957 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(p0,false)}" +match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); + +var part1958 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); + +var part1959 = // "Pattern{Field(username,true), Constant(' via '), Field(p0,false)}" +match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); + +var part1960 = // "Pattern{Constant('NSRP Peer . ('), Field(p0,false)}" +match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); + +var part1961 = // "Pattern{Constant('. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); + +var part1962 = // "Pattern{Constant('changed'), Field(p0,false)}" +match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); + +var part1963 = // "Pattern{Constant('The '), Field(p0,false)}" +match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); + +var part1964 = // "Pattern{Constant('interface'), Field(p0,false)}" +match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); + +var part1965 = // "Pattern{Constant('Interface'), Field(p0,false)}" +match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); + +var part1966 = // "Pattern{Constant('DNS entries have been '), Field(p0,false)}" +match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); + +var part1967 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" +match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); + +var part1968 = // "Pattern{Field(zone,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); + +var part1969 = // "Pattern{Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); + +var part1970 = // "Pattern{Constant('int '), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); + +var part1971 = // "Pattern{Field(dport,false), Constant(','), Field(p0,false)}" +match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); + +var part1972 = // "Pattern{Field(dport,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); + +var part1973 = // "Pattern{Field(space,false), Constant('using protocol '), Field(p0,false)}" +match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); + +var part1974 = // "Pattern{Field(protocol,false), Constant(','), Field(p0,false)}" +match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); + +var part1975 = // "Pattern{Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); + +var part1976 = // "Pattern{Constant('. '), Field(p0,false)}" +match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); + +var part1977 = // "Pattern{Field(fld2,false), Constant(': SYN '), Field(p0,false)}" +match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); + +var part1978 = // "Pattern{Constant('SYN '), Field(p0,false)}" +match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); + +var part1979 = // "Pattern{Constant('timeout value '), Field(p0,false)}" +match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); + +var part1980 = // "Pattern{Constant('destination '), Field(p0,false)}" +match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); + +var part1981 = // "Pattern{Constant('source '), Field(p0,false)}" +match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); + +var part1982 = // "Pattern{Constant('A '), Field(p0,false)}" +match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); + +var part1983 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var part1984 = // "Pattern{Constant(', int '), Field(p0,false)}" +match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); + +var part1985 = // "Pattern{Constant('int '), Field(p0,false)}" +match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); + +var part1986 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); + +var part1987 = // "Pattern{Constant('HA '), Field(p0,false)}" +match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); + +var part1988 = // "Pattern{Constant('encryption '), Field(p0,false)}" +match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); + +var part1989 = // "Pattern{Constant('authentication '), Field(p0,false)}" +match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); + +var part1990 = // "Pattern{Constant('key '), Field(p0,false)}" +match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); + +var part1991 = // "Pattern{Constant('disabled'), Field(,false)}" +match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); + +var part1992 = // "Pattern{Constant('set to '), Field(trigger_val,false)}" +match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); + +var part1993 = // "Pattern{Constant('up'), Field(,false)}" +match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); + +var part1994 = // "Pattern{Constant('down'), Field(,false)}" +match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); + +var part1995 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); + +var part1996 = // "Pattern{Constant('set'), Field(,false)}" +match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); + +var part1997 = // "Pattern{Constant('unset'), Field(,false)}" +match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); + +var part1998 = // "Pattern{Constant('undefined '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); + +var part1999 = // "Pattern{Constant('set '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); + +var part2000 = // "Pattern{Constant('active '), Field(p0,false)}" +match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); + +var part2001 = // "Pattern{Constant('to '), Field(p0,false)}" +match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); + +var part2002 = // "Pattern{Constant('created '), Field(p0,false)}" +match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); + +var part2003 = // "Pattern{Constant(', '), Field(p0,false)}" +match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); + +var part2004 = // "Pattern{Constant('is '), Field(p0,false)}" +match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); + +var part2005 = // "Pattern{Constant('was '), Field(p0,false)}" +match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); + +var part2006 = // "Pattern{Constant(''), Field(fld2,false)}" +match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); + +var part2007 = // "Pattern{Constant('threshold '), Field(p0,false)}" +match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); + +var part2008 = // "Pattern{Constant('interval '), Field(p0,false)}" +match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); + +var part2009 = // "Pattern{Constant('of '), Field(p0,false)}" +match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); + +var part2010 = // "Pattern{Constant('that '), Field(p0,false)}" +match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); + +var part2011 = // "Pattern{Constant('Zone '), Field(p0,false)}" +match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); + +var part2012 = // "Pattern{Constant('Interface '), Field(p0,false)}" +match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); + +var part2013 = // "Pattern{Constant('n '), Field(p0,false)}" +match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); + +var part2014 = // "Pattern{Constant('.'), Field(,false)}" +match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); + +var part2015 = // "Pattern{Constant('for '), Field(p0,false)}" +match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); + +var part2016 = // "Pattern{Constant('the '), Field(p0,false)}" +match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); + +var part2017 = // "Pattern{Constant('removed '), Field(p0,false)}" +match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); + +var part2018 = // "Pattern{Constant('interface '), Field(p0,false)}" +match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); + +var part2019 = // "Pattern{Constant('the interface '), Field(p0,false)}" +match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); + +var part2020 = // "Pattern{Field(interface,false)}" +match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); + +var part2021 = // "Pattern{Constant('s '), Field(p0,false)}" +match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); + +var part2022 = // "Pattern{Constant('on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); + +var part2023 = // "Pattern{Constant('has been '), Field(p0,false)}" +match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); + +var part2024 = // "Pattern{Constant(''), Field(disposition,false), Constant('.')}" +match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); + +var part2025 = // "Pattern{Constant('removed from '), Field(p0,false)}" +match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); + +var part2026 = // "Pattern{Constant('added to '), Field(p0,false)}" +match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); + +var part2027 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); + +var part2028 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var part2029 = // "Pattern{Constant('Interface '), Field(p0,false)}" +match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); + +var part2030 = // "Pattern{Constant('set to '), Field(fld2,false)}" +match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); + +var part2031 = // "Pattern{Constant('gateway '), Field(p0,false)}" +match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); + +var part2032 = // "Pattern{Field(,true), Constant(' '), Field(disposition,false)}" +match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); + +var part2033 = // "Pattern{Constant('port number '), Field(p0,false)}" +match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); + +var part2034 = // "Pattern{Constant('has been '), Field(disposition,false)}" +match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); + +var part2035 = // "Pattern{Constant('IP '), Field(p0,false)}" +match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); + +var part2036 = // "Pattern{Constant('port '), Field(p0,false)}" +match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); + +var part2037 = // "Pattern{Constant('up '), Field(p0,false)}" +match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); + +var part2038 = // "Pattern{Constant('down '), Field(p0,false)}" +match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); + +var part2039 = // "Pattern{Constant('('), Field(fld1,false), Constant(') ')}" +match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); + +var part2040 = // "Pattern{Constant(': '), Field(p0,false)}" +match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); + +var part2041 = // "Pattern{Constant('IP '), Field(p0,false)}" +match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); + +var part2042 = // "Pattern{Constant('address pool '), Field(p0,false)}" +match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); + +var part2043 = // "Pattern{Constant('pool '), Field(p0,false)}" +match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); + +var part2044 = // "Pattern{Constant('enabled '), Field(p0,false)}" +match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); + +var part2045 = // "Pattern{Constant('disabled '), Field(p0,false)}" +match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); + +var part2046 = // "Pattern{Constant('AH '), Field(p0,false)}" +match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); + +var part2047 = // "Pattern{Constant('ESP '), Field(p0,false)}" +match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); + +var part2048 = // "Pattern{Constant('’'), Field(p0,false)}" +match("MESSAGE#347:00018:02/1_0", "nwparser.p0", "’%{p0}"); + +var part2049 = // "Pattern{Constant('&'), Field(p0,false)}" +match("MESSAGE#347:00018:02/1_1", "nwparser.p0", "\u0026%{p0}"); + +var part2050 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); + +var part2051 = // "Pattern{Constant('Source'), Field(p0,false)}" +match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); + +var part2052 = // "Pattern{Constant('Destination'), Field(p0,false)}" +match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); + +var part2053 = // "Pattern{Constant('from '), Field(p0,false)}" +match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); + +var part2054 = // "Pattern{Constant('policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); + +var part2055 = // "Pattern{Constant('Attempt to enable '), Field(p0,false)}" +match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); + +var part2056 = // "Pattern{Constant('traffic logging via syslog '), Field(p0,false)}" +match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); + +var part2057 = // "Pattern{Constant('syslog '), Field(p0,false)}" +match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); + +var part2058 = // "Pattern{Constant('Syslog '), Field(p0,false)}" +match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); + +var part2059 = // "Pattern{Constant('host '), Field(p0,false)}" +match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); + +var part2060 = // "Pattern{Constant('domain name '), Field(p0,false)}" +match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); + +var part2061 = // "Pattern{Constant('has been changed to '), Field(fld2,false)}" +match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); + +var part2062 = // "Pattern{Constant('security facility '), Field(p0,false)}" +match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); + +var part2063 = // "Pattern{Constant('facility '), Field(p0,false)}" +match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); + +var part2064 = // "Pattern{Constant('local0'), Field(,false)}" +match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); + +var part2065 = // "Pattern{Constant('local1'), Field(,false)}" +match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); + +var part2066 = // "Pattern{Constant('local2'), Field(,false)}" +match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); + +var part2067 = // "Pattern{Constant('local3'), Field(,false)}" +match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); + +var part2068 = // "Pattern{Constant('local4'), Field(,false)}" +match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); + +var part2069 = // "Pattern{Constant('local5'), Field(,false)}" +match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); + +var part2070 = // "Pattern{Constant('local6'), Field(,false)}" +match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); + +var part2071 = // "Pattern{Constant('local7'), Field(,false)}" +match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); + +var part2072 = // "Pattern{Constant('auth/sec'), Field(,false)}" +match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); + +var part2073 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); + +var part2074 = // "Pattern{Constant('All '), Field(p0,false)}" +match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); + +var part2075 = // "Pattern{Constant('primary '), Field(p0,false)}" +match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); + +var part2076 = // "Pattern{Constant('secondary '), Field(p0,false)}" +match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); + +var part2077 = // "Pattern{Constant('t '), Field(p0,false)}" +match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); + +var part2078 = // "Pattern{Constant('w '), Field(p0,false)}" +match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); + +var part2079 = // "Pattern{Constant('server '), Field(p0,false)}" +match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); + +var part2080 = // "Pattern{Constant('has '), Field(p0,false)}" +match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); + +var part2081 = // "Pattern{Constant('SCS'), Field(p0,false)}" +match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); + +var part2082 = // "Pattern{Constant('bound to '), Field(p0,false)}" +match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); + +var part2083 = // "Pattern{Constant('unbound from '), Field(p0,false)}" +match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); + +var part2084 = // "Pattern{Constant('PKA RSA '), Field(p0,false)}" +match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); + +var part2085 = // "Pattern{Constant('unbind '), Field(p0,false)}" +match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); + +var part2086 = // "Pattern{Constant('PKA key '), Field(p0,false)}" +match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); + +var part2087 = // "Pattern{Constant('Multiple login failures '), Field(p0,false)}" +match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); + +var part2088 = // "Pattern{Constant('occurred for '), Field(p0,false)}" +match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); + +var part2089 = // "Pattern{Constant('aborted'), Field(,false)}" +match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); + +var part2090 = // "Pattern{Constant('performed'), Field(,false)}" +match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); + +var part2091 = // "Pattern{Constant('IP pool of DHCP server on '), Field(p0,false)}" +match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); + +var part2092 = // "Pattern{Constant('certificate '), Field(p0,false)}" +match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); + +var part2093 = // "Pattern{Constant('CRL '), Field(p0,false)}" +match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); + +var part2094 = // "Pattern{Constant('auto '), Field(p0,false)}" +match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); + +var part2095 = // "Pattern{Constant('RSA '), Field(p0,false)}" +match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); + +var part2096 = // "Pattern{Constant('DSA '), Field(p0,false)}" +match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); + +var part2097 = // "Pattern{Constant('key pair.'), Field(,false)}" +match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); + +var part2098 = // "Pattern{Constant('FIPS test for '), Field(p0,false)}" +match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); + +var part2099 = // "Pattern{Constant('ECDSA '), Field(p0,false)}" +match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); + +var part2100 = // "Pattern{Constant('yes '), Field(p0,false)}" +match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); + +var part2101 = // "Pattern{Constant('no '), Field(p0,false)}" +match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); + +var part2102 = // "Pattern{Constant('location '), Field(p0,false)}" +match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); + +var part2103 = // "Pattern{Field(,true), Constant(' '), Field(interface,false)}" +match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); + +var part2104 = // "Pattern{Constant('arp re'), Field(p0,false)}" +match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); + +var part2105 = // "Pattern{Constant('q '), Field(p0,false)}" +match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); + +var part2106 = // "Pattern{Constant('ply '), Field(p0,false)}" +match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); + +var part2107 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); + +var part2108 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" +match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); + +var part2109 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); + +var part2110 = // "Pattern{Constant('NACN Policy Manager '), Field(p0,false)}" +match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); + +var part2111 = // "Pattern{Constant('1 '), Field(p0,false)}" +match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); + +var part2112 = // "Pattern{Constant('2 '), Field(p0,false)}" +match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); + +var part2113 = // "Pattern{Constant('unset '), Field(p0,false)}" +match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); + +var part2114 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var part2115 = // "Pattern{Constant('SSH '), Field(p0,false)}" +match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); + +var part2116 = // "Pattern{Constant('SCS: NetScreen '), Field(p0,false)}" +match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); + +var part2117 = // "Pattern{Constant('NetScreen '), Field(p0,false)}" +match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); + +var part2118 = // "Pattern{Constant('S'), Field(p0,false)}" +match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); + +var part2119 = // "Pattern{Constant('CS: SSH'), Field(p0,false)}" +match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); + +var part2120 = // "Pattern{Constant('SH'), Field(p0,false)}" +match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); + +var part2121 = // "Pattern{Constant('the root system '), Field(p0,false)}" +match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); + +var part2122 = // "Pattern{Constant('vsys '), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); + +var part2123 = // "Pattern{Constant('CS: SSH '), Field(p0,false)}" +match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); + +var part2124 = // "Pattern{Constant('SH '), Field(p0,false)}" +match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); + +var part2125 = // "Pattern{Constant('a '), Field(p0,false)}" +match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); + +var part2126 = // "Pattern{Constant('ert '), Field(p0,false)}" +match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); + +var part2127 = // "Pattern{Constant('SSL '), Field(p0,false)}" +match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); + +var part2128 = // "Pattern{Constant('id: '), Field(p0,false)}" +match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); + +var part2129 = // "Pattern{Constant('ID '), Field(p0,false)}" +match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); + +var part2130 = // "Pattern{Constant('permit '), Field(p0,false)}" +match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); + +var part2131 = // "Pattern{Constant('IGMP '), Field(p0,false)}" +match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); + +var part2132 = // "Pattern{Constant('IGMP will '), Field(p0,false)}" +match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); + +var part2133 = // "Pattern{Constant('not do '), Field(p0,false)}" +match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); + +var part2134 = // "Pattern{Constant('do '), Field(p0,false)}" +match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); + +var part2135 = // "Pattern{Constant('shut down '), Field(p0,false)}" +match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); + +var part2136 = // "Pattern{Constant('NSRP: '), Field(p0,false)}" +match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); + +var part2137 = // "Pattern{Constant('Unit '), Field(p0,false)}" +match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); + +var part2138 = // "Pattern{Constant('local unit= '), Field(p0,false)}" +match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); + +var part2139 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); + +var part2140 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Sec'), Field(p0,false)}" +match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); + +var part2141 = // "Pattern{Constant('ruity'), Field(p0,false)}" +match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); + +var part2142 = // "Pattern{Constant('urity'), Field(p0,false)}" +match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); + +var part2143 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state')}" +match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); + +var part2144 = // "Pattern{Constant(''), Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); + +var part2145 = // "Pattern{Constant('start_time='), Field(p0,false)}" +match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); + +var part2146 = // "Pattern{Constant('\"'), Field(fld2,false), Constant('\"'), Field(p0,false)}" +match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); + +var part2147 = // "Pattern{Constant(' "'), Field(fld2,false), Constant('" '), Field(p0,false)}" +match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); + +var part2148 = // "Pattern{Field(daddr,false)}" +match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); + +var part2149 = // "Pattern{Constant('Admin '), Field(p0,false)}" +match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); + +var part2150 = // "Pattern{Constant('Vsys admin '), Field(p0,false)}" +match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); + +var part2151 = // "Pattern{Constant('Telnet '), Field(p0,false)}" +match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); + +var part2152 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); + +var part2153 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); + +var part2154 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.'), Field(p0,false)}" +match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); + +var part2155 = // "Pattern{Field(obj_type,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var part2156 = // "Pattern{Field(signame,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); + +var part2157 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" +match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); + +var part2158 = // "Pattern{Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); + +var part2159 = // "Pattern{Constant('ut '), Field(p0,false)}" +match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); + +var part2160 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); + +var part2161 = // "Pattern{Constant('user '), Field(p0,false)}" +match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); + +var part2162 = // "Pattern{Constant('the '), Field(logon_type,false)}" +match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); + +var part2163 = // "Pattern{Constant('WebAuth user '), Field(p0,false)}" +match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); + +var part2164 = // "Pattern{Constant('backup1 '), Field(p0,false)}" +match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); + +var part2165 = // "Pattern{Constant('backup2 '), Field(p0,false)}" +match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); + +var part2166 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); + +var part2167 = // "Pattern{Constant('assigned '), Field(p0,false)}" +match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); + +var part2168 = // "Pattern{Constant('assigned to '), Field(p0,false)}" +match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); + +var part2169 = // "Pattern{Constant('''), Field(administrator,false), Constant('' '), Field(p0,false)}" +match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); + +var part2170 = // "Pattern{Constant('SSH: P'), Field(p0,false)}" +match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); + +var part2171 = // "Pattern{Constant('KA '), Field(p0,false)}" +match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); + +var part2172 = // "Pattern{Constant('assword '), Field(p0,false)}" +match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); + +var part2173 = // "Pattern{Constant('\''), Field(administrator,false), Constant('\' '), Field(p0,false)}" +match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); + +var part2174 = // "Pattern{Constant('at host '), Field(saddr,false)}" +match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); + +var part2175 = // "Pattern{Field(,false), Constant('S'), Field(p0,false)}" +match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); + +var part2176 = // "Pattern{Constant('CS '), Field(p0,false)}" +match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); + +var part2177 = // "Pattern{Constant('from server.ini file.'), Field(,false)}" +match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); + +var part2178 = // "Pattern{Constant('pattern '), Field(p0,false)}" +match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); + +var part2179 = // "Pattern{Constant('server.ini '), Field(p0,false)}" +match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); + +var part2180 = // "Pattern{Constant('file.'), Field(,false)}" +match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); + +var part2181 = // "Pattern{Constant('AV pattern '), Field(p0,false)}" +match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); + +var part2182 = // "Pattern{Constant('added into '), Field(p0,false)}" +match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); + +var part2183 = // "Pattern{Constant('loader '), Field(p0,false)}" +match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); + +var select436 = linear_select([ + dup10, + dup11, +]); + +var part2184 = // "Pattern{Constant('Policy ID='), Field(policy_id,true), Constant(' Rate='), Field(fld2,true), Constant(' exceeds threshold')}" +match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var select437 = linear_select([ + dup13, + dup14, +]); + +var select438 = linear_select([ + dup15, + dup16, +]); + +var select439 = linear_select([ + dup56, + dup57, +]); + +var select440 = linear_select([ + dup65, + dup66, +]); + +var select441 = linear_select([ + dup68, + dup69, +]); + +var select442 = linear_select([ + dup71, + dup72, +]); + +var part2185 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(interface,false), Constant(')')}" +match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ + dup58, + dup2, + dup3, + dup4, + dup5, + dup61, +])); + +var select443 = linear_select([ + dup74, + dup75, +]); + +var select444 = linear_select([ + dup81, + dup82, +]); + +var select445 = linear_select([ + dup24, + dup90, +]); + +var select446 = linear_select([ + dup94, + dup95, +]); + +var select447 = linear_select([ + dup98, + dup99, +]); + +var select448 = linear_select([ + dup100, + dup101, + dup102, +]); + +var select449 = linear_select([ + dup113, + dup114, +]); + +var select450 = linear_select([ + dup111, + dup16, +]); + +var select451 = linear_select([ + dup127, + dup107, +]); + +var select452 = linear_select([ + dup8, + dup21, +]); + +var select453 = linear_select([ + dup122, + dup133, +]); + +var select454 = linear_select([ + dup142, + dup143, +]); + +var select455 = linear_select([ + dup145, + dup21, +]); + +var select456 = linear_select([ + dup127, + dup106, +]); + +var select457 = linear_select([ + dup152, + dup96, +]); + +var select458 = linear_select([ + dup154, + dup155, +]); + +var select459 = linear_select([ + dup156, + dup157, +]); + +var select460 = linear_select([ + dup99, + dup134, +]); + +var select461 = linear_select([ + dup158, + dup159, +]); + +var select462 = linear_select([ + dup160, + dup161, +]); + +var select463 = linear_select([ + dup163, + dup164, +]); + +var select464 = linear_select([ + dup165, + dup103, +]); + +var select465 = linear_select([ + dup164, + dup163, +]); + +var select466 = linear_select([ + dup46, + dup47, +]); + +var select467 = linear_select([ + dup168, + dup169, +]); + +var select468 = linear_select([ + dup174, + dup175, +]); + +var select469 = linear_select([ + dup176, + dup177, + dup178, + dup179, + dup180, + dup181, + dup182, + dup183, + dup184, +]); + +var select470 = linear_select([ + dup49, + dup21, +]); + +var select471 = linear_select([ + dup191, + dup192, +]); + +var select472 = linear_select([ + dup96, + dup152, +]); + +var select473 = linear_select([ + dup198, + dup199, +]); + +var select474 = linear_select([ + dup24, + dup202, +]); + +var select475 = linear_select([ + dup103, + dup165, +]); + +var select476 = linear_select([ + dup207, + dup118, +]); + +var part2186 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" +match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var select477 = linear_select([ + dup214, + dup215, +]); + +var select478 = linear_select([ + dup217, + dup218, +]); + +var select479 = linear_select([ + dup224, + dup217, +]); + +var select480 = linear_select([ + dup226, + dup227, +]); + +var select481 = linear_select([ + dup233, + dup124, +]); + +var select482 = linear_select([ + dup231, + dup232, +]); + +var select483 = linear_select([ + dup235, + dup236, +]); + +var select484 = linear_select([ + dup238, + dup239, +]); + +var select485 = linear_select([ + dup244, + dup245, +]); + +var select486 = linear_select([ + dup247, + dup248, +]); + +var select487 = linear_select([ + dup249, + dup250, +]); + +var select488 = linear_select([ + dup251, + dup252, +]); + +var select489 = linear_select([ + dup253, + dup254, +]); + +var select490 = linear_select([ + dup262, + dup263, +]); + +var select491 = linear_select([ + dup266, + dup267, +]); + +var select492 = linear_select([ + dup270, + dup271, +]); + +var part2187 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" +match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); + +var select493 = linear_select([ + dup286, + dup287, +]); + +var select494 = linear_select([ + dup289, + dup290, +]); + +var part2188 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" +match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ + dup58, + dup2, + dup59, + dup4, + dup5, + dup3, + dup60, +])); + +var part2189 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to zone '), Field(zone,false), Constant(', proto '), Field(protocol,true), Constant(' (int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" +match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ + dup58, + dup4, + dup59, + dup5, + dup9, + dup2, + dup3, + dup60, +])); + +var select495 = linear_select([ + dup302, + dup26, +]); + +var select496 = linear_select([ + dup115, + dup305, +]); + +var select497 = linear_select([ + dup125, + dup96, +]); + +var select498 = linear_select([ + dup191, + dup310, + dup311, +]); + +var select499 = linear_select([ + dup312, + dup16, +]); + +var select500 = linear_select([ + dup319, + dup320, +]); + +var select501 = linear_select([ + dup321, + dup317, +]); + +var select502 = linear_select([ + dup324, + dup252, +]); + +var select503 = linear_select([ + dup329, + dup331, +]); + +var select504 = linear_select([ + dup332, + dup129, +]); + +var part2190 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup60, + dup284, +])); + +var part2191 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup278, + dup279, + dup60, +])); + +var part2192 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" +match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup283, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup60, + dup284, +])); + +var part2193 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" +match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup187, + dup2, + dup4, + dup5, + dup276, + dup3, + dup277, + dup278, + dup279, + dup61, +])); + +var all397 = all_match({ + processors: [ + dup265, + dup393, + dup268, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var all398 = all_match({ + processors: [ + dup269, + dup394, + dup272, + ], + on_success: processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, + ]), +}); + +var all399 = all_match({ + processors: [ + dup80, + dup345, + dup295, + ], + on_success: processor_chain([ + dup58, + dup2, + dup59, + dup3, + dup4, + dup5, + dup61, + ]), +}); + +var all400 = all_match({ + processors: [ + dup298, + dup345, + dup131, + ], + on_success: processor_chain([ + dup299, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup61, + ]), +}); + +var all401 = all_match({ + processors: [ + dup300, + dup345, + dup131, + ], + on_success: processor_chain([ + dup299, + dup2, + dup3, + dup9, + dup59, + dup4, + dup5, + dup61, + ]), +}); diff --git a/x-pack/filebeat/module/juniper/netscreen/ingest/pipeline.yml b/x-pack/filebeat/module/juniper/netscreen/ingest/pipeline.yml new file mode 100644 index 00000000000..7e5bef61bab --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Netscreen + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/juniper/netscreen/manifest.yml b/x-pack/filebeat/module/juniper/netscreen/manifest.yml new file mode 100644 index 00000000000..7da6bc1d60b --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["juniper.netscreen", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9523 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/juniper/netscreen/test/generated.log b/x-pack/filebeat/module/juniper/netscreen/test/generated.log new file mode 100644 index 00000000000..3d8481ffa94 --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/test/generated.log @@ -0,0 +1,100 @@ +modtempo: NetScreen device_id=olab system-low-00628(rci): audit log queue Event Alarm Log is overwritten (2016-1-29 06:09:59) +luptat: NetScreen device_id=isiutal [moenimi]system-low-00620(gnaali): RTSYNC: Timer to purge the DRP backup routes is stopped. (2016-2-12 13:12:33) +deomni: NetScreen device_id=tquovol [ntsuntin]system-medium-00062(tatno): Track IP IP address 10.159.227.210 succeeded. (ofdeF) +untutlab: NetScreen device_id=tem [ons]system-medium-00004: DNS lookup time has been changed to start at ationu:ali with an interval of nsect +eve: NetScreen device_id=tatiset [eprehen]system-medium-00034(piscing): Ethernet driver ran out of rx bd (port 1044) +eomnisis: NetScreen device_id=mqui [civeli]system-high-00026: SCS: SCS has been tasuntex for enp0s5377 . +rehender: NetScreen device_id=eporroqu [uat]system-high-00026(atquovo): SSH: Maximum number of PKA keys (suntinc) has been bound to user 'xeac' Key not bound. (Key ID nidolo) +intoccae: NetScreen device_id=ents [pida]system-low-00535(idolor): PKCS #7 data cannot be decapsulated +numqu: NetScreen device_id=qui [No Name]system-medium-00520: Active Server Switchover: New requests for equi server will try agnaali from now on. (2016-5-22 14:30:33) +ipitla: NetScreen device_id=quae [maccusa]system-high-00072(rQuisau): NSRP: Unit idex of VSD group xerci aqu +atu: NetScreen device_id=umexerci [ern]system-low-00084(iadese): RTSYNC: NSRP route synchronization is nsectet +dol: NetScreen device_id=leumiu [namali]system-medium-00527(atevel): MAC address 01:00:5e:11:0a:26 has detected an IP conflict and has declined address 10.90.127.74 +acc: NetScreen device_id=amc [atur]system-low-00050(corp): Track IP enabled (2016-7-18 18:40:50) +tper: NetScreen device_id=olor [Neque]system-medium-00524(xerc): SNMP request from an unknown SNMP community public at 10.61.30.190:2509 has been received. (2016-8-2 01:43:25) +etdol: NetScreen device_id=uela [boN]system-medium-00521: Can't connect to E-mail server 10.210.240.175 +ati: NetScreen device_id=tlabo [uames]system-medium-00553(mpo): SCAN-MGR: Set maximum content size to offi. +umwr: NetScreen device_id=oluptate [issus]system-high-00005(uaUteni): SYN flood udantium has been changed to pre +tate: NetScreen device_id=imvenia [spi]system-high-00038(etdo): OSPF routing instance in vrouter urerepr is ese +smo: NetScreen device_id=etcons [iusmodi]system-medium-00012: ate Service group uiac has epte member idolo from host 10.170.139.87 +ersp: NetScreen device_id=tquov [diconseq]system-high-00551(mod): Rapid Deployment cannot start because gateway has undergone configuration changes. (2016-10-26 19:58:50) +mquame: NetScreen device_id=nihilmol [xercita]system-medium-00071(tiumt): The local device reetdolo in the Virtual Security Device group norum changed state +isnisi: NetScreen device_id=ritatise [uamei]system-medium-00057(quatur): uisa: static multicast route src=10.198.41.214, grp=cusant input ifp = lo2786 output ifp = eth3657 added +isis: NetScreen device_id=uasiar [utlab]system-high-00075(loremqu): The local device dantium in the Virtual Security Device group lor velillu +bor: NetScreen device_id=rauto [ationev]system-low-00039(mdol): BGP instance name created for vr itation +iaeco: NetScreen device_id=equaturv [siu]system-high-00262(veniamqu): Admin user rum has been rejected via the quaea server at 10.11.251.51 +orroq: NetScreen device_id=vitaedic [orin]system-high-00038(ons): OSPF routing instance in vrouter remagn ecillu +enderit: NetScreen device_id=taut [tanimi]system-medium-00515(commodi): emporain Admin User "ntiumto" logged in for umetMalo(https) management (port 2206) from 10.80.237.27:2883 +ori: NetScreen device_id=tconsect [rum]system-high-00073(eporroq): NSRP: Unit ulla of VSD group iqu oin +mipsum: NetScreen device_id=lmo [aliquamq]system-medium-00030: X509 certificate for ScreenOS image authentication is invalid +orroqu: NetScreen device_id=elitsed [labore]system-medium-00034(erc): PPPoE Settings changed +ntNe: NetScreen device_id=itanim [nesciun]system-medium-00612: Switch event: the status of ethernet port mollita changed to link down , duplex full , speed 10 M. (2017-4-2 01:27:07) +quide: NetScreen device_id=quaU [undeomni]system-medium-00077(acomm): NSRP: local unit= iutali of VSD group itat stlaboru +emq: NetScreen device_id=plicaboN [amc]system-high-00536(acommo): IKE 10.10.77.119: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations +scivel: NetScreen device_id=henderi [iusmodt]system-medium-00536(tquas): IKE 10.200.22.41: Received incorrect ID payload: IP address lorinr instead of IP address ercita +equu: NetScreen device_id=sintoc [atae]system-medium-00203(tem): mestq lsa flood on interface eth82 has dropped a packet. +iqui: NetScreen device_id=tesseci [tat]system-high-00011(cive): The virtual router nse has been made unsharable +rroqui: NetScreen device_id=ursin [utemvel]system-medium-00002: ADMIN AUTH: Privilege requested for unknown user atu. Possible HA syncronization problem. +orumSe: NetScreen device_id=dolor [isiut]system-high-00206(emagn): OSPF instance with router-id emulla received a Hello packet flood from neighbor (IP address 10.219.1.151, router ID mnihilm) on Interface enp0s3375 forcing the interface to drop the packet. +eque: NetScreen device_id=eufug [est]system-medium-00075: The local device ntincul in the Virtual Security Device group reet tquo +imadmini: NetScreen device_id=ide [edq]system-medium-00026(tise): SSH: Attempt to unbind PKA key from admin user 'ntut' (Key ID emullam) +ihilmole: NetScreen device_id=saquaea [ons]system-high-00048(quas): Route map entry with sequence number gia in route map binck-ospf in virtual router itatio was porinc (2017-8-22 23:52:50) +orum: NetScreen device_id=oinBCSed [orem]system-medium-00050(ilm): Track IP enabled (2017-9-6 06:55:24) +ncididun: NetScreen device_id=hen [periamea]system-medium-00555: Vrouter ali PIMSM cannot process non-multicast address 10.158.18.51 +umwri: NetScreen device_id=odoc [atura]system-high-00030: SYSTEM CPU utilization is high (oreeu > nvo ) iamqui times in tassita minute (2017-10-4 21:00:32)< +inc: NetScreen device_id=tect [uiad]system-low-00003: The console debug buffer has been roinBCSe +nseq: NetScreen device_id=borumSec [tatemseq]system-medium-00026(dmi): SCS has been tam for eth7686 . +uiineavo: NetScreen device_id=sistena [uidexeac]system-high-00620(amquisno): RTSYNC: Event posted to send all the DRP routes to backup device. (2017-11-16 18:08:15) +sunt: NetScreen device_id=dquianon [urExc]system-high-00025(iamqui): PKI: The current device quide to save the certificate authority configuration. +etdol: NetScreen device_id=Sed [oremeumf]system-high-00076: The local device etur in the Virtual Security Device group fugiatn enima +giatquo: NetScreen device_id=lors [its]system-low-00524: SNMP request from an unknown SNMP community public at 10.46.217.155:76 has been received. (2017-12-29 15:15:58) +magnaa: NetScreen device_id=sumquiad [No Name]system-high-00628: audit log queue Event Log is overwritten (2018-1-12 22:18:32) +tnulapa: NetScreen device_id=madmi [No Name]system-high-00628(adeser): audit log queue Event Log is overwritten (2018-1-27 05:21:06) +laboree: NetScreen device_id=udantiu [itametco]system-high-00556(stiaecon): UF-MGR: usBono CPA server port changed to rumexe. +nturmag: NetScreen device_id=uredol [maliqua]system-medium-00058(mquia): PIMSM protocol configured on interface eth2266 +ueporroq: NetScreen device_id=ute [No Name]system-low-00625: Session (id tationu src-ip 10.142.21.251 dst-ip 10.154.16.147 dst port 6881) route is valid. (2018-3-11 02:28:49) +adipi: NetScreen device_id=mquis [ratvo]system-low-00042(isno): Replay packet detected on IPSec tunnel on enp0s1170 with tunnel ID nderiti! From 10.105.212.51 to 10.119.53.68/1783, giatqu (2018-3-25 09:31:24) +emvel: NetScreen device_id=pta [dolo]system-medium-00057(eacommod): uamqu: static multicast route src=10.174.2.175, grp=aparia input ifp = lo6813 output ifp = enp0s90 added +giat: NetScreen device_id=ttenb [eirure]system-high-00549(rem): add-route-> untrust-vr: exer +lapari: NetScreen device_id=rcitat [cinge]system-high-00536(luptate): IKE gateway eritqu has been elites. pariat +accus: NetScreen device_id=CSed [tiu]system-low-00049(upta): The router-id of virtual router "asper" used by OSPF, BGP routing instances id has been uninitialized. (dictasun) +itanimi: NetScreen device_id=onoru [data]system-high-00064(eosqui): Can not create track-ip list +int: NetScreen device_id=ionevo [llitani]system-high-00541(itametco): The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from etcons to etco state, (neighbor router-id 1iuntN, ip-address 10.89.179.48). (2018-6-19 03:46:49) +mmodicon: NetScreen device_id=eetdo [mquisno]system-low-00017(lup): mipsamv From 10.57.108.5:5523 using protocol icmp on interface enp0s4987. The attack occurred 2282 times +inimve: NetScreen device_id=aea [emipsumd]system-low-00263(ptat): Admin user saq has been accepted via the asiarch server at 10.197.10.110 +tlab: NetScreen device_id=vel [ionevo]system-high-00622: NHRP : NHRP instance in virtual router ptate is created. (2018-8-1 00:54:32) +qui: NetScreen device_id=caboN [imipsam]system-high-00528(catcupid): SSH: Admin user 'ritquiin' at host 10.59.51.171 requested unsupported authentication method texplica +udexerci: NetScreen device_id=uae [imveni]system-medium-00071(ptatemse): NSRP: Unit itationu of VSD group setquas nbyCi +isno: NetScreen device_id=luptatev [occaeca]system-high-00018(urau): aeca Policy (oNem, itaedict ) was eroi from host 10.80.103.229 by admin fugitsed (2018-9-12 22:02:15) +utlabore: NetScreen device_id=edquiano [mSecti]system-high-00207(tDuisaut): RIP database size limit exceeded for uel, RIP route dropped. +agn: NetScreen device_id=iqu [quamqua]system-high-00075: NSRP: Unit equeporr of VSD group amremap oremagna +ntium: NetScreen device_id=ide [quunturm]system-low-00040(isautem): High watermark for early aging has been changed to the default usan +catcu: NetScreen device_id=quame [tionemu]system-low-00524(eursi): SNMP host 10.163.9.35 cannot be removed from community uatDu because failure +cteturad: NetScreen device_id=modi [No Name]system-low-00625(ecatcu): Session (id ntoccae src-ip 10.51.161.245 dst-ip 10.193.80.21 dst port 5657) route is valid. (2018-11-23 09:15:06) +chit: NetScreen device_id=iusmodit [lor]system-high-00524(adeserun): SNMP request has been received, but success +vento: NetScreen device_id=litsed [ciun]system-medium-00072: The local device inrepr in the Virtual Security Device group lla changed state +rissusci: NetScreen device_id=uaturQ [iusmod]system-medium-00533(mips): VIP server 10.41.222.7 is now responding +upta: NetScreen device_id=ivel [tmollita]system-low-00070(deFinib): NSRP: nsrp control channel change to lo4065 +ommodic: NetScreen device_id=mmodic [essequam]system-low-00040(nihi): VPN 'xeaco' from 10.134.20.213 is eavolupt (2019-2-2 20:27:57) +ptasnul: NetScreen device_id=utaliqui [mcorpor]system-medium-00023(ostru): VIP/load balance server 10.110.144.189 cannot be contacted +luptatem: NetScreen device_id=ing [hen]system-medium-00034(umquid): SCS: SCS has been olabo for tasnu with conse existing PKA keys already bound to ruredolo SSH users. +iat: NetScreen device_id=orain [equaturQ]system-low-00554: SCAN-MGR: Attempted to load AV pattern file created quia after the AV subscription expired. (Exp: Exce) +dese: NetScreen device_id=ptasn [liqui]system-low-00541: ScreenOS invol serial # Loremips: Asset recovery has been cidun +ole: NetScreen device_id=odi [tper]system-medium-00628(ectetur): audit log queue Event Log is overwritten (2019-4-15 07:40:49) +iadolo: NetScreen device_id=ecatcup [No Name]system-high-00628: audit log queue Traffic Log is overwritten (2019-4-29 14:43:23) +qui: NetScreen device_id=iaecon [dminima]system-high-00538(psaquaea): NACN failed to register to Policy Manager eabillo because of success +eosqu: NetScreen device_id=reetdolo [umquam]system-low-00075(enderi): The local device labore in the Virtual Security Device group uasiarch changed state from iamquisn to inoperable. (2019-5-28 04:48:31) +veleumi: NetScreen device_id=volupt [equ]system-high-00535(ure): SCEP_FAILURE message has been received from the CA +reseo: NetScreen device_id=entoreve [rudexer]system-medium-00026(iruredol): IKE iad: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed +ptate: NetScreen device_id=oloreeu [imipsa]system-high-00038: OSPF routing instance in vrouter uame taevitae +archi: NetScreen device_id=caboNe [ptate]system-high-00003(ius): Multiple authentication failures have been detected! +remap: NetScreen device_id=ntium [veniamqu]system-high-00529: DNS entries have been refreshed by HA +llumdo: NetScreen device_id=tot [itquii]system-high-00625(erspici): Session (id oreeu src-ip 10.126.150.15 dst-ip 10.185.50.112 dst port 7180) route is invalid. (2019-8-21 23:03:57) +quepo: NetScreen device_id=tDuisa [iscive]system-medium-00521: Can't connect to E-mail server 10.152.90.59 +lorem: NetScreen device_id=icons [hende]system-low-00077(usBonor): HA link disconnect. Begin to use second path of HA +preh: NetScreen device_id=dol [No Name]system-low-00625: Session (id gnamal src-ip 10.119.181.171 dst-ip 10.166.144.66 dst port 3051) route is invalid. (2019-10-3 20:11:40) +avolup: NetScreen device_id=litse [archit]system-high-00041(untutlab): A route-map name in virtual router estqu has been removed +eddoeiu: NetScreen device_id=consect [eetdolo]system-medium-00038(remipsum): OSPF routing instance in vrouter ons emporin +texpl: NetScreen device_id=isquames [No Name]system-low-00021: DIP port-translation stickiness was atio by utla via ntm from host 10.96.165.147 to 10.96.218.99:277 (2019-11-15 17:19:22) +elaudant: NetScreen device_id=ratvolu [odte]system-medium-00021(eum): DIP port-translation stickiness was uidol by repr via idu from host 10.201.72.59 to 10.230.29.67:7478 (2019-11-30 00:21:57) +toc: NetScreen device_id=rau [sciuntN]system-low-00602: PIMSM Error in initializing interface state change diff --git a/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json new file mode 100644 index 00000000000..a33eb424fdd --- /dev/null +++ b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json @@ -0,0 +1,2565 @@ +[ + { + "event.code": "00628", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "modtempo: NetScreen device_id=olab system-low-00628(rci): audit log queue Event Alarm Log is overwritten (2016-1-29 06:09:59)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 0, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00628", + "rsa.misc.hardware_id": "olab", + "rsa.misc.severity": "low", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00620", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "luptat: NetScreen device_id=isiutal [moenimi]system-low-00620(gnaali): RTSYNC: Timer to purge the DRP backup routes is stopped. (2016-2-12 13:12:33)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 126, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00620", + "rsa.misc.hardware_id": "isiutal", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "moenimi", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00062", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "deomni: NetScreen device_id=tquovol [ntsuntin]system-medium-00062(tatno): Track IP IP address 10.159.227.210 succeeded. (ofdeF)", + "fileset.name": "netscreen", + "host.ip": "10.159.227.210", + "input.type": "log", + "log.level": "medium", + "log.offset": 275, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.159.227.210" + ], + "rsa.internal.event_desc": "Track IP succeeded", + "rsa.internal.messageid": "00062", + "rsa.misc.hardware_id": "tquovol", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ntsuntin", + "rsa.time.event_time_str": "ofdeF", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00004", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "untutlab: NetScreen device_id=tem [ons]system-medium-00004: DNS lookup time has been changed to start at ationu:ali with an interval of nsect", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 403, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00004", + "rsa.misc.hardware_id": "tem", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ons", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00034", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "eve: NetScreen device_id=tatiset [eprehen]system-medium-00034(piscing): Ethernet driver ran out of rx bd (port 1044)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 545, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00034", + "rsa.misc.hardware_id": "tatiset", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "eprehen", + "rsa.network.network_port": 1044, + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00026", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "eomnisis: NetScreen device_id=mqui [civeli]system-high-00026: SCS: SCS has been tasuntex for enp0s5377 .", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 662, + "network.interface.name": "enp0s5377", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00026", + "rsa.misc.disposition": "tasuntex", + "rsa.misc.hardware_id": "mqui", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "civeli", + "rsa.network.interface": "enp0s5377", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00026", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "rehender: NetScreen device_id=eporroqu [uat]system-high-00026(atquovo): SSH: Maximum number of PKA keys (suntinc) has been bound to user 'xeac' Key not bound. (Key ID nidolo)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 767, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.user": [ + "xeac" + ], + "rsa.internal.messageid": "00026", + "rsa.misc.hardware_id": "eporroqu", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "uat", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "xeac" + }, + { + "event.code": "00535", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "intoccae: NetScreen device_id=ents [pida]system-low-00535(idolor): PKCS #7 data cannot be decapsulated", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 942, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00535", + "rsa.misc.hardware_id": "ents", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "pida", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00520", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "numqu: NetScreen device_id=qui [No Name]system-medium-00520: Active Server Switchover: New requests for equi server will try agnaali from now on. (2016-5-22 14:30:33)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 1045, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00520", + "rsa.misc.hardware_id": "qui", + "rsa.misc.severity": "medium", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00072", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ipitla: NetScreen device_id=quae [maccusa]system-high-00072(rQuisau): NSRP: Unit idex of VSD group xerci aqu", + "fileset.name": "netscreen", + "group.name": "xerci", + "input.type": "log", + "log.level": "high", + "log.offset": 1212, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "aqu", + "rsa.internal.messageid": "00072", + "rsa.misc.group": "xerci", + "rsa.misc.hardware_id": "quae", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "maccusa", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00084", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "atu: NetScreen device_id=umexerci [ern]system-low-00084(iadese): RTSYNC: NSRP route synchronization is nsectet", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 1321, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00084", + "rsa.misc.disposition": "nsectet", + "rsa.misc.hardware_id": "umexerci", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "ern", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00527", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "dol: NetScreen device_id=leumiu [namali]system-medium-00527(atevel): MAC address 01:00:5e:11:0a:26 has detected an IP conflict and has declined address 10.90.127.74", + "fileset.name": "netscreen", + "host.ip": "10.90.127.74", + "host.mac": "01:00:5e:11:0a:26", + "input.type": "log", + "log.level": "medium", + "log.offset": 1432, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.90.127.74" + ], + "rsa.internal.messageid": "00527", + "rsa.misc.hardware_id": "leumiu", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "namali", + "rsa.network.eth_host": "01:00:5e:11:0a:26", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00050", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "acc: NetScreen device_id=amc [atur]system-low-00050(corp): Track IP enabled (2016-7-18 18:40:50)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 1597, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00050", + "rsa.misc.hardware_id": "amc", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "atur", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00524", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "tper: NetScreen device_id=olor [Neque]system-medium-00524(xerc): SNMP request from an unknown SNMP community public at 10.61.30.190:2509 has been received. (2016-8-2 01:43:25)", + "fileset.name": "netscreen", + "host.ip": "10.61.30.190", + "input.type": "log", + "log.level": "medium", + "log.offset": 1694, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.61.30.190" + ], + "rsa.internal.messageid": "00524", + "rsa.misc.hardware_id": "olor", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "Neque", + "rsa.network.network_port": 2509, + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00521", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "etdol: NetScreen device_id=uela [boN]system-medium-00521: Can't connect to E-mail server 10.210.240.175", + "fileset.name": "netscreen", + "host.ip": "10.210.240.175", + "input.type": "log", + "log.level": "medium", + "log.offset": 1870, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.210.240.175" + ], + "rsa.internal.messageid": "00521", + "rsa.misc.hardware_id": "uela", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "boN", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00553", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ati: NetScreen device_id=tlabo [uames]system-medium-00553(mpo): SCAN-MGR: Set maximum content size to offi.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 1974, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00553", + "rsa.misc.hardware_id": "tlabo", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "uames", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00005", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "umwr: NetScreen device_id=oluptate [issus]system-high-00005(uaUteni): SYN flood udantium has been changed to pre", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 2082, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00005", + "rsa.misc.hardware_id": "oluptate", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "issus", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00038", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "tate: NetScreen device_id=imvenia [spi]system-high-00038(etdo): OSPF routing instance in vrouter urerepr is ese", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 2195, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00038", + "rsa.misc.disposition": "ese", + "rsa.misc.hardware_id": "imvenia", + "rsa.misc.node": "urerepr", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "spi", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00012", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "smo: NetScreen device_id=etcons [iusmodi]system-medium-00012: ate Service group uiac has epte member idolo from host 10.170.139.87", + "fileset.name": "netscreen", + "group.name": "uiac", + "input.type": "log", + "log.level": "medium", + "log.offset": 2307, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.170.139.87" + ], + "related.user": [ + "idolo" + ], + "rsa.internal.messageid": "00012", + "rsa.misc.disposition": "epte", + "rsa.misc.group": "uiac", + "rsa.misc.hardware_id": "etcons", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "iusmodi", + "service.type": "juniper", + "source.ip": [ + "10.170.139.87" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "idolo" + }, + { + "event.code": "00551", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ersp: NetScreen device_id=tquov [diconseq]system-high-00551(mod): Rapid Deployment cannot start because gateway has undergone configuration changes. (2016-10-26 19:58:50)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 2438, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00551", + "rsa.misc.hardware_id": "tquov", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "diconseq", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00071", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "mquame: NetScreen device_id=nihilmol [xercita]system-medium-00071(tiumt): The local device reetdolo in the Virtual Security Device group norum changed state", + "fileset.name": "netscreen", + "group.name": "norum", + "input.type": "log", + "log.level": "medium", + "log.offset": 2609, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00071", + "rsa.misc.group": "norum", + "rsa.misc.hardware_id": "nihilmol", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "xercita", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00057", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "isnisi: NetScreen device_id=ritatise [uamei]system-medium-00057(quatur): uisa: static multicast route src=10.198.41.214, grp=cusant input ifp = lo2786 output ifp = eth3657 added", + "fileset.name": "netscreen", + "group.name": "cusant", + "input.type": "log", + "log.level": "medium", + "log.offset": 2766, + "observer.egress.interface.name": "eth3657", + "observer.ingress.interface.name": "lo2786", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.198.41.214" + ], + "rsa.internal.messageid": "00057", + "rsa.misc.group": "cusant", + "rsa.misc.hardware_id": "ritatise", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "uamei", + "rsa.network.dinterface": "eth3657", + "rsa.network.sinterface": "lo2786", + "service.type": "juniper", + "source.ip": [ + "10.198.41.214" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00075", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "isis: NetScreen device_id=uasiar [utlab]system-high-00075(loremqu): The local device dantium in the Virtual Security Device group lor velillu", + "fileset.name": "netscreen", + "group.name": "lor", + "input.type": "log", + "log.level": "high", + "log.offset": 2944, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "velillu", + "rsa.internal.messageid": "00075", + "rsa.misc.group": "lor", + "rsa.misc.hardware_id": "uasiar", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "utlab", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00039", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "bor: NetScreen device_id=rauto [ationev]system-low-00039(mdol): BGP instance name created for vr itation", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 3086, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00039", + "rsa.misc.hardware_id": "rauto", + "rsa.misc.node": "itation", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "ationev", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00262", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "iaeco: NetScreen device_id=equaturv [siu]system-high-00262(veniamqu): Admin user rum has been rejected via the quaea server at 10.11.251.51", + "fileset.name": "netscreen", + "host.ip": "10.11.251.51", + "input.type": "log", + "log.level": "high", + "log.offset": 3191, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.11.251.51" + ], + "related.user": [ + "rum" + ], + "rsa.identity.logon_type": "quaea", + "rsa.internal.messageid": "00262", + "rsa.misc.hardware_id": "equaturv", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "siu", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "rum" + }, + { + "event.code": "00038", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "orroq: NetScreen device_id=vitaedic [orin]system-high-00038(ons): OSPF routing instance in vrouter remagn ecillu", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 3331, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00038", + "rsa.misc.disposition": "ecillu", + "rsa.misc.hardware_id": "vitaedic", + "rsa.misc.node": "remagn", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "orin", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00515", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "enderit: NetScreen device_id=taut [tanimi]system-medium-00515(commodi): emporain Admin User \"ntiumto\" logged in for umetMalo(https) management (port 2206) from 10.80.237.27:2883", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 3444, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.80.237.27" + ], + "related.user": [ + "ntiumto" + ], + "rsa.identity.logon_type": "umetMalo", + "rsa.internal.messageid": "00515", + "rsa.misc.hardware_id": "taut", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "tanimi", + "rsa.network.network_port": 2206, + "service.type": "juniper", + "source.ip": [ + "10.80.237.27" + ], + "source.port": 2883, + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "ntiumto" + }, + { + "event.code": "00073", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ori: NetScreen device_id=tconsect [rum]system-high-00073(eporroq): NSRP: Unit ulla of VSD group iqu oin", + "fileset.name": "netscreen", + "group.name": "iqu", + "input.type": "log", + "log.level": "high", + "log.offset": 3622, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "oin", + "rsa.internal.messageid": "00073", + "rsa.misc.group": "iqu", + "rsa.misc.hardware_id": "tconsect", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "rum", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00030", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "mipsum: NetScreen device_id=lmo [aliquamq]system-medium-00030: X509 certificate for ScreenOS image authentication is invalid", + "event.outcome": "unknown", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 3726, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00030", + "rsa.investigations.ec_outcome": "Error", + "rsa.investigations.ec_subject": "Certificate", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.hardware_id": "lmo", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "aliquamq", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00034", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "orroqu: NetScreen device_id=elitsed [labore]system-medium-00034(erc): PPPoE Settings changed", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 3851, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00034", + "rsa.misc.hardware_id": "elitsed", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "labore", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00612", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ntNe: NetScreen device_id=itanim [nesciun]system-medium-00612: Switch event: the status of ethernet port mollita changed to link down , duplex full , speed 10 M. (2017-4-2 01:27:07)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 3944, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00612", + "rsa.misc.hardware_id": "itanim", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "nesciun", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00077", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "quide: NetScreen device_id=quaU [undeomni]system-medium-00077(acomm): NSRP: local unit= iutali of VSD group itat stlaboru", + "fileset.name": "netscreen", + "group.name": "itat", + "input.type": "log", + "log.level": "medium", + "log.offset": 4126, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "stlaboru", + "rsa.internal.messageid": "00077", + "rsa.misc.group": "itat", + "rsa.misc.hardware_id": "quaU", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "undeomni", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00536", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "emq: NetScreen device_id=plicaboN [amc]system-high-00536(acommo): IKE 10.10.77.119: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", + "fileset.name": "netscreen", + "host.ip": "10.10.77.119", + "input.type": "log", + "log.level": "high", + "log.offset": 4248, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.10.77.119" + ], + "rsa.internal.messageid": "00536", + "rsa.misc.hardware_id": "plicaboN", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "amc", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00536", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "scivel: NetScreen device_id=henderi [iusmodt]system-medium-00536(tquas): IKE 10.200.22.41: Received incorrect ID payload: IP address lorinr instead of IP address ercita", + "fileset.name": "netscreen", + "host.ip": "10.200.22.41", + "input.type": "log", + "log.level": "medium", + "log.offset": 4418, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.200.22.41" + ], + "rsa.internal.messageid": "00536", + "rsa.misc.hardware_id": "henderi", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "iusmodt", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00203", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "equu: NetScreen device_id=sintoc [atae]system-medium-00203(tem): mestq lsa flood on interface eth82 has dropped a packet.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 4587, + "network.interface.name": "eth82", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00203", + "rsa.misc.hardware_id": "sintoc", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "atae", + "rsa.network.interface": "eth82", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00011", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "iqui: NetScreen device_id=tesseci [tat]system-high-00011(cive): The virtual router nse has been made unsharable", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 4709, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00011", + "rsa.misc.hardware_id": "tesseci", + "rsa.misc.node": "nse", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "tat", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00002", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "rroqui: NetScreen device_id=ursin [utemvel]system-medium-00002: ADMIN AUTH: Privilege requested for unknown user atu. Possible HA syncronization problem.", + "event.outcome": "unknown", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 4821, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.user": [ + "atu" + ], + "rsa.internal.messageid": "00002", + "rsa.investigations.ec_outcome": "Error", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.hardware_id": "ursin", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "utemvel", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "atu" + }, + { + "event.code": "00206", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "orumSe: NetScreen device_id=dolor [isiut]system-high-00206(emagn): OSPF instance with router-id emulla received a Hello packet flood from neighbor (IP address 10.219.1.151, router ID mnihilm) on Interface enp0s3375 forcing the interface to drop the packet.", + "fileset.name": "netscreen", + "host.ip": "10.219.1.151", + "input.type": "log", + "log.level": "high", + "log.offset": 4975, + "network.interface.name": "enp0s3375", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.219.1.151" + ], + "rsa.internal.messageid": "00206", + "rsa.misc.hardware_id": "dolor", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "isiut", + "rsa.network.interface": "enp0s3375", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00075", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "eque: NetScreen device_id=eufug [est]system-medium-00075: The local device ntincul in the Virtual Security Device group reet tquo", + "fileset.name": "netscreen", + "group.name": "reet", + "input.type": "log", + "log.level": "medium", + "log.offset": 5232, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "tquo", + "rsa.internal.messageid": "00075", + "rsa.misc.group": "reet", + "rsa.misc.hardware_id": "eufug", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "est", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00026", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "imadmini: NetScreen device_id=ide [edq]system-medium-00026(tise): SSH: Attempt to unbind PKA key from admin user 'ntut' (Key ID emullam)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 5362, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.user": [ + "ntut" + ], + "rsa.internal.messageid": "00026", + "rsa.misc.hardware_id": "ide", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "edq", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "ntut" + }, + { + "event.code": "00048", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ihilmole: NetScreen device_id=saquaea [ons]system-high-00048(quas): Route map entry with sequence number gia in route map binck-ospf in virtual router itatio was porinc (2017-8-22 23:52:50)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 5499, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00048", + "rsa.misc.disposition": "porinc", + "rsa.misc.hardware_id": "saquaea", + "rsa.misc.node": "itatio", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ons", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00050", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "orum: NetScreen device_id=oinBCSed [orem]system-medium-00050(ilm): Track IP enabled (2017-9-6 06:55:24)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 5689, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00050", + "rsa.misc.hardware_id": "oinBCSed", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "orem", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00555", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ncididun: NetScreen device_id=hen [periamea]system-medium-00555: Vrouter ali PIMSM cannot process non-multicast address 10.158.18.51", + "fileset.name": "netscreen", + "host.ip": "10.158.18.51", + "input.type": "log", + "log.level": "medium", + "log.offset": 5793, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.158.18.51" + ], + "rsa.internal.messageid": "00555", + "rsa.misc.hardware_id": "hen", + "rsa.misc.node": "ali", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "periamea", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00030", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "umwri: NetScreen device_id=odoc [atura]system-high-00030: SYSTEM CPU utilization is high (oreeu > nvo ) iamqui times in tassita minute (2017-10-4 21:00:32)<", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 5926, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00030", + "rsa.misc.hardware_id": "odoc", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "atura", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00003", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "inc: NetScreen device_id=tect [uiad]system-low-00003: The console debug buffer has been roinBCSe", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 6093, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00003", + "rsa.misc.disposition": "roinBCSe", + "rsa.misc.hardware_id": "tect", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "uiad", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00026", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "nseq: NetScreen device_id=borumSec [tatemseq]system-medium-00026(dmi): SCS has been tam for eth7686 .", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 6190, + "network.interface.name": "eth7686", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00026", + "rsa.misc.disposition": "tam", + "rsa.misc.hardware_id": "borumSec", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "tatemseq", + "rsa.network.interface": "eth7686", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00620", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "uiineavo: NetScreen device_id=sistena [uidexeac]system-high-00620(amquisno): RTSYNC: Event posted to send all the DRP routes to backup device. (2017-11-16 18:08:15)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 6292, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00620", + "rsa.misc.hardware_id": "sistena", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "uidexeac", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00025", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "sunt: NetScreen device_id=dquianon [urExc]system-high-00025(iamqui): PKI: The current device quide to save the certificate authority configuration.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 6457, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00025", + "rsa.misc.disposition": "quide", + "rsa.misc.hardware_id": "dquianon", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "urExc", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00076", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "etdol: NetScreen device_id=Sed [oremeumf]system-high-00076: The local device etur in the Virtual Security Device group fugiatn enima", + "fileset.name": "netscreen", + "group.name": "fugiatn", + "input.type": "log", + "log.level": "high", + "log.offset": 6605, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "enima", + "rsa.internal.messageid": "00076", + "rsa.misc.group": "fugiatn", + "rsa.misc.hardware_id": "Sed", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "oremeumf", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00524", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "giatquo: NetScreen device_id=lors [its]system-low-00524: SNMP request from an unknown SNMP community public at 10.46.217.155:76 has been received. (2017-12-29 15:15:58)", + "fileset.name": "netscreen", + "host.ip": "10.46.217.155", + "input.type": "log", + "log.level": "low", + "log.offset": 6738, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.46.217.155" + ], + "rsa.internal.messageid": "00524", + "rsa.misc.hardware_id": "lors", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "its", + "rsa.network.network_port": 76, + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00628", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "magnaa: NetScreen device_id=sumquiad [No Name]system-high-00628: audit log queue Event Log is overwritten (2018-1-12 22:18:32)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 6907, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00628", + "rsa.misc.hardware_id": "sumquiad", + "rsa.misc.severity": "high", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00628", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "tnulapa: NetScreen device_id=madmi [No Name]system-high-00628(adeser): audit log queue Event Log is overwritten (2018-1-27 05:21:06)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 7034, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00628", + "rsa.misc.hardware_id": "madmi", + "rsa.misc.severity": "high", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00556", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "laboree: NetScreen device_id=udantiu [itametco]system-high-00556(stiaecon): UF-MGR: usBono CPA server port changed to rumexe.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 7167, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00556", + "rsa.misc.hardware_id": "udantiu", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "itametco", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00058", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "nturmag: NetScreen device_id=uredol [maliqua]system-medium-00058(mquia): PIMSM protocol configured on interface eth2266", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 7293, + "network.interface.name": "eth2266", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00058", + "rsa.misc.hardware_id": "uredol", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "maliqua", + "rsa.network.interface": "eth2266", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.154.16.147" + ], + "destination.port": 6881, + "event.code": "00625", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ueporroq: NetScreen device_id=ute [No Name]system-low-00625: Session (id tationu src-ip 10.142.21.251 dst-ip 10.154.16.147 dst port 6881) route is valid. (2018-3-11 02:28:49)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 7413, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.142.21.251", + "10.154.16.147" + ], + "rsa.internal.messageid": "00625", + "rsa.misc.hardware_id": "ute", + "rsa.misc.log_session_id": "tationu", + "rsa.misc.severity": "low", + "service.type": "juniper", + "source.ip": [ + "10.142.21.251" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.119.53.68" + ], + "destination.port": 1783, + "event.code": "00042", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "adipi: NetScreen device_id=mquis [ratvo]system-low-00042(isno): Replay packet detected on IPSec tunnel on enp0s1170 with tunnel ID nderiti! From 10.105.212.51 to 10.119.53.68/1783, giatqu (2018-3-25 09:31:24)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 7588, + "network.interface.name": "enp0s1170", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.105.212.51", + "10.119.53.68" + ], + "rsa.db.index": "giatqu", + "rsa.internal.messageid": "00042", + "rsa.misc.hardware_id": "mquis", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "ratvo", + "rsa.network.interface": "enp0s1170", + "service.type": "juniper", + "source.ip": [ + "10.105.212.51" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00057", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "emvel: NetScreen device_id=pta [dolo]system-medium-00057(eacommod): uamqu: static multicast route src=10.174.2.175, grp=aparia input ifp = lo6813 output ifp = enp0s90 added", + "fileset.name": "netscreen", + "group.name": "aparia", + "input.type": "log", + "log.level": "medium", + "log.offset": 7797, + "observer.egress.interface.name": "enp0s90", + "observer.ingress.interface.name": "lo6813", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.174.2.175" + ], + "rsa.internal.messageid": "00057", + "rsa.misc.group": "aparia", + "rsa.misc.hardware_id": "pta", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "dolo", + "rsa.network.dinterface": "enp0s90", + "rsa.network.sinterface": "lo6813", + "service.type": "juniper", + "source.ip": [ + "10.174.2.175" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00549", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "giat: NetScreen device_id=ttenb [eirure]system-high-00549(rem): add-route-> untrust-vr: exer", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 7970, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00549", + "rsa.misc.hardware_id": "ttenb", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "eirure", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00536", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "lapari: NetScreen device_id=rcitat [cinge]system-high-00536(luptate): IKE gateway eritqu has been elites. pariat", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 8063, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "pariat", + "rsa.internal.messageid": "00536", + "rsa.misc.disposition": "elites", + "rsa.misc.hardware_id": "rcitat", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "cinge", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00049", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "accus: NetScreen device_id=CSed [tiu]system-low-00049(upta): The router-id of virtual router \"asper\" used by OSPF, BGP routing instances id has been uninitialized. (dictasun)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 8176, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00049", + "rsa.misc.hardware_id": "CSed", + "rsa.misc.node": "asper", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "tiu", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00064", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "itanimi: NetScreen device_id=onoru [data]system-high-00064(eosqui): Can not create track-ip list", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 8351, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00064", + "rsa.misc.hardware_id": "onoru", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "data", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00541", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "int: NetScreen device_id=ionevo [llitani]system-high-00541(itametco): The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from etcons to etco state, (neighbor router-id 1iuntN, ip-address 10.89.179.48). (2018-6-19 03:46:49)", + "fileset.name": "netscreen", + "host.ip": "10.89.179.48", + "input.type": "log", + "log.level": "high", + "log.offset": 8448, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.89.179.48" + ], + "rsa.internal.messageid": "00541", + "rsa.misc.change_new": "etco", + "rsa.misc.change_old": "etcons", + "rsa.misc.hardware_id": "ionevo", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "llitani", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00017", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "mmodicon: NetScreen device_id=eetdo [mquisno]system-low-00017(lup): mipsamv From 10.57.108.5:5523 using protocol icmp on interface enp0s4987. The attack occurred 2282 times", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 8744, + "network.interface.name": "enp0s4987", + "network.protocol": "icmp", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.57.108.5" + ], + "rsa.counters.dclass_c1": 2282, + "rsa.counters.dclass_c1_str": "Number of times the attack occurred", + "rsa.internal.messageid": "00017", + "rsa.misc.hardware_id": "eetdo", + "rsa.misc.policy_name": "mipsamv", + "rsa.misc.severity": "low", + "rsa.misc.space": "", + "rsa.misc.vsys": "mquisno", + "rsa.network.interface": "enp0s4987", + "service.type": "juniper", + "source.ip": [ + "10.57.108.5" + ], + "source.port": 5523, + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00263", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "inimve: NetScreen device_id=aea [emipsumd]system-low-00263(ptat): Admin user saq has been accepted via the asiarch server at 10.197.10.110", + "fileset.name": "netscreen", + "host.ip": "10.197.10.110", + "input.type": "log", + "log.level": "low", + "log.offset": 8917, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.197.10.110" + ], + "related.user": [ + "saq" + ], + "rsa.identity.logon_type": "asiarch", + "rsa.internal.messageid": "00263", + "rsa.misc.hardware_id": "aea", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "emipsumd", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "saq" + }, + { + "event.code": "00622", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "tlab: NetScreen device_id=vel [ionevo]system-high-00622: NHRP : NHRP instance in virtual router ptate is created. (2018-8-1 00:54:32)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 9056, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00622", + "rsa.misc.hardware_id": "vel", + "rsa.misc.node": "ptate", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ionevo", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00528", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "qui: NetScreen device_id=caboN [imipsam]system-high-00528(catcupid): SSH: Admin user 'ritquiin' at host 10.59.51.171 requested unsupported authentication method texplica", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 9190, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.59.51.171" + ], + "related.user": [ + "ritquiin" + ], + "rsa.internal.messageid": "00528", + "rsa.misc.hardware_id": "caboN", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "imipsam", + "service.type": "juniper", + "source.ip": [ + "10.59.51.171" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "ritquiin" + }, + { + "event.code": "00071", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "udexerci: NetScreen device_id=uae [imveni]system-medium-00071(ptatemse): NSRP: Unit itationu of VSD group setquas nbyCi", + "fileset.name": "netscreen", + "group.name": "setquas", + "input.type": "log", + "log.level": "medium", + "log.offset": 9360, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "nbyCi", + "rsa.internal.messageid": "00071", + "rsa.misc.group": "setquas", + "rsa.misc.hardware_id": "uae", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "imveni", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00018", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "isno: NetScreen device_id=luptatev [occaeca]system-high-00018(urau): aeca Policy (oNem, itaedict ) was eroi from host 10.80.103.229 by admin fugitsed (2018-9-12 22:02:15)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 9480, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.80.103.229" + ], + "related.user": [ + "fugitsed" + ], + "rsa.db.index": "itaedict", + "rsa.internal.messageid": "00018", + "rsa.misc.disposition": "eroi", + "rsa.misc.hardware_id": "luptatev", + "rsa.misc.policy_id": "oNem", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "occaeca", + "service.type": "juniper", + "source.ip": [ + "10.80.103.229" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "fugitsed" + }, + { + "event.code": "00207", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "utlabore: NetScreen device_id=edquiano [mSecti]system-high-00207(tDuisaut): RIP database size limit exceeded for uel, RIP route dropped.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 9651, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00207", + "rsa.misc.hardware_id": "edquiano", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "mSecti", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00075", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "agn: NetScreen device_id=iqu [quamqua]system-high-00075: NSRP: Unit equeporr of VSD group amremap oremagna", + "fileset.name": "netscreen", + "group.name": "amremap", + "input.type": "log", + "log.level": "high", + "log.offset": 9788, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.db.index": "oremagna", + "rsa.internal.messageid": "00075", + "rsa.misc.group": "amremap", + "rsa.misc.hardware_id": "iqu", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "quamqua", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00040", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ntium: NetScreen device_id=ide [quunturm]system-low-00040(isautem): High watermark for early aging has been changed to the default usan", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 9895, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00040", + "rsa.misc.hardware_id": "ide", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "quunturm", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00524", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "catcu: NetScreen device_id=quame [tionemu]system-low-00524(eursi): SNMP host 10.163.9.35 cannot be removed from community uatDu because failure", + "fileset.name": "netscreen", + "host.ip": "10.163.9.35", + "input.type": "log", + "log.level": "low", + "log.offset": 10031, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.163.9.35" + ], + "rsa.internal.messageid": "00524", + "rsa.misc.hardware_id": "quame", + "rsa.misc.result": "failure", + "rsa.misc.severity": "low", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.193.80.21" + ], + "destination.port": 5657, + "event.code": "00625", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "cteturad: NetScreen device_id=modi [No Name]system-low-00625(ecatcu): Session (id ntoccae src-ip 10.51.161.245 dst-ip 10.193.80.21 dst port 5657) route is valid. (2018-11-23 09:15:06)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 10175, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.51.161.245", + "10.193.80.21" + ], + "rsa.internal.messageid": "00625", + "rsa.misc.hardware_id": "modi", + "rsa.misc.log_session_id": "ntoccae", + "rsa.misc.severity": "low", + "service.type": "juniper", + "source.ip": [ + "10.51.161.245" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00524", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "chit: NetScreen device_id=iusmodit [lor]system-high-00524(adeserun): SNMP request has been received, but success", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 10359, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00524", + "rsa.misc.hardware_id": "iusmodit", + "rsa.misc.result": "success", + "rsa.misc.severity": "high", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00072", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "vento: NetScreen device_id=litsed [ciun]system-medium-00072: The local device inrepr in the Virtual Security Device group lla changed state", + "fileset.name": "netscreen", + "group.name": "lla", + "input.type": "log", + "log.level": "medium", + "log.offset": 10472, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00072", + "rsa.misc.group": "lla", + "rsa.misc.hardware_id": "litsed", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "ciun", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00533", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "rissusci: NetScreen device_id=uaturQ [iusmod]system-medium-00533(mips): VIP server 10.41.222.7 is now responding", + "fileset.name": "netscreen", + "host.ip": "10.41.222.7", + "input.type": "log", + "log.level": "medium", + "log.offset": 10612, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.41.222.7" + ], + "rsa.internal.messageid": "00533", + "rsa.misc.hardware_id": "uaturQ", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "iusmod", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00070", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "upta: NetScreen device_id=ivel [tmollita]system-low-00070(deFinib): NSRP: nsrp control channel change to lo4065", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 10725, + "network.interface.name": "lo4065", + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00070", + "rsa.misc.hardware_id": "ivel", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "tmollita", + "rsa.network.interface": "lo4065", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.134.20.213" + ], + "event.code": "00040", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ommodic: NetScreen device_id=mmodic [essequam]system-low-00040(nihi): VPN 'xeaco' from 10.134.20.213 is eavolupt (2019-2-2 20:27:57)", + "fileset.name": "netscreen", + "group.name": "xeaco", + "input.type": "log", + "log.level": "low", + "log.offset": 10837, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.134.20.213" + ], + "rsa.internal.messageid": "00040", + "rsa.misc.disposition": "eavolupt", + "rsa.misc.group": "xeaco", + "rsa.misc.hardware_id": "mmodic", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "essequam", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00023", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ptasnul: NetScreen device_id=utaliqui [mcorpor]system-medium-00023(ostru): VIP/load balance server 10.110.144.189 cannot be contacted", + "fileset.name": "netscreen", + "host.ip": "10.110.144.189", + "input.type": "log", + "log.level": "medium", + "log.offset": 10970, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.110.144.189" + ], + "rsa.internal.messageid": "00023", + "rsa.misc.hardware_id": "utaliqui", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "mcorpor", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00034", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "luptatem: NetScreen device_id=ing [hen]system-medium-00034(umquid): SCS: SCS has been olabo for tasnu with conse existing PKA keys already bound to ruredolo SSH users.", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 11104, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.user": [ + "tasnu" + ], + "rsa.internal.messageid": "00034", + "rsa.misc.disposition": "olabo", + "rsa.misc.hardware_id": "ing", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "hen", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "tasnu" + }, + { + "event.code": "00554", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "iat: NetScreen device_id=orain [equaturQ]system-low-00554: SCAN-MGR: Attempted to load AV pattern file created quia after the AV subscription expired. (Exp: Exce)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 11272, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00554", + "rsa.misc.hardware_id": "orain", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "equaturQ", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00541", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "dese: NetScreen device_id=ptasn [liqui]system-low-00541: ScreenOS invol serial # Loremips: Asset recovery has been cidun", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 11435, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00541", + "rsa.misc.disposition": "cidun", + "rsa.misc.hardware_id": "ptasn", + "rsa.misc.serial_number": "Loremips", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "liqui", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00628", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ole: NetScreen device_id=odi [tper]system-medium-00628(ectetur): audit log queue Event Log is overwritten (2019-4-15 07:40:49)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 11556, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00628", + "rsa.misc.hardware_id": "odi", + "rsa.misc.severity": "medium", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00628", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "iadolo: NetScreen device_id=ecatcup [No Name]system-high-00628: audit log queue Traffic Log is overwritten (2019-4-29 14:43:23)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 11683, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00628", + "rsa.misc.hardware_id": "ecatcup", + "rsa.misc.severity": "high", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00538", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "qui: NetScreen device_id=iaecon [dminima]system-high-00538(psaquaea): NACN failed to register to Policy Manager eabillo because of success", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 11811, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00538", + "rsa.misc.hardware_id": "iaecon", + "rsa.misc.result": "success", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "dminima", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00075", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "eosqu: NetScreen device_id=reetdolo [umquam]system-low-00075(enderi): The local device labore in the Virtual Security Device group uasiarch changed state from iamquisn to inoperable. (2019-5-28 04:48:31)", + "fileset.name": "netscreen", + "group.name": "uasiarch", + "input.type": "log", + "log.level": "low", + "log.offset": 11950, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.event_desc": "local device in the Virtual Security Device group changed state to inoperable", + "rsa.internal.messageid": "00075", + "rsa.misc.event_state": "iamquisn", + "rsa.misc.group": "uasiarch", + "rsa.misc.hardware_id": "reetdolo", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "umquam", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00535", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "veleumi: NetScreen device_id=volupt [equ]system-high-00535(ure): SCEP_FAILURE message has been received from the CA", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 12154, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00535", + "rsa.misc.hardware_id": "volupt", + "rsa.misc.result": "SCEP_FAILURE message", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "equ", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00026", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "reseo: NetScreen device_id=entoreve [rudexer]system-medium-00026(iruredol): IKE iad: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 12270, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00026", + "rsa.misc.hardware_id": "entoreve", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "rudexer", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00038", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "ptate: NetScreen device_id=oloreeu [imipsa]system-high-00038: OSPF routing instance in vrouter uame taevitae", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 12443, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00038", + "rsa.misc.disposition": "taevitae", + "rsa.misc.hardware_id": "oloreeu", + "rsa.misc.node": "uame", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "imipsa", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00003", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "archi: NetScreen device_id=caboNe [ptate]system-high-00003(ius): Multiple authentication failures have been detected!", + "event.outcome": "failure", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 12552, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00003", + "rsa.investigations.ec_outcome": "Failure", + "rsa.investigations.ec_theme": "Authentication", + "rsa.misc.hardware_id": "caboNe", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "ptate", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00529", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "remap: NetScreen device_id=ntium [veniamqu]system-high-00529: DNS entries have been refreshed by HA", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 12670, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00529", + "rsa.misc.hardware_id": "ntium", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "veniamqu", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.185.50.112" + ], + "destination.port": 7180, + "event.code": "00625", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "llumdo: NetScreen device_id=tot [itquii]system-high-00625(erspici): Session (id oreeu src-ip 10.126.150.15 dst-ip 10.185.50.112 dst port 7180) route is invalid. (2019-8-21 23:03:57)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 12770, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.185.50.112", + "10.126.150.15" + ], + "rsa.internal.messageid": "00625", + "rsa.misc.hardware_id": "tot", + "rsa.misc.log_session_id": "oreeu", + "rsa.misc.severity": "high", + "service.type": "juniper", + "source.ip": [ + "10.126.150.15" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00521", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "quepo: NetScreen device_id=tDuisa [iscive]system-medium-00521: Can't connect to E-mail server 10.152.90.59", + "fileset.name": "netscreen", + "host.ip": "10.152.90.59", + "input.type": "log", + "log.level": "medium", + "log.offset": 12952, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.152.90.59" + ], + "rsa.internal.messageid": "00521", + "rsa.misc.hardware_id": "tDuisa", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "iscive", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00077", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "lorem: NetScreen device_id=icons [hende]system-low-00077(usBonor): HA link disconnect. Begin to use second path of HA", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 13059, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00077", + "rsa.misc.hardware_id": "icons", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "hende", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.166.144.66" + ], + "destination.port": 3051, + "event.code": "00625", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "preh: NetScreen device_id=dol [No Name]system-low-00625: Session (id gnamal src-ip 10.119.181.171 dst-ip 10.166.144.66 dst port 3051) route is invalid. (2019-10-3 20:11:40)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 13177, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.119.181.171", + "10.166.144.66" + ], + "rsa.internal.messageid": "00625", + "rsa.misc.hardware_id": "dol", + "rsa.misc.log_session_id": "gnamal", + "rsa.misc.severity": "low", + "service.type": "juniper", + "source.ip": [ + "10.119.181.171" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00041", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "avolup: NetScreen device_id=litse [archit]system-high-00041(untutlab): A route-map name in virtual router estqu has been removed", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "high", + "log.offset": 13350, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00041", + "rsa.misc.hardware_id": "litse", + "rsa.misc.node": "estqu", + "rsa.misc.severity": "high", + "rsa.misc.vsys": "archit", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "event.code": "00038", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "eddoeiu: NetScreen device_id=consect [eetdolo]system-medium-00038(remipsum): OSPF routing instance in vrouter ons emporin", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 13479, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00038", + "rsa.misc.disposition": "emporin", + "rsa.misc.hardware_id": "consect", + "rsa.misc.node": "ons", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "eetdolo", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.96.218.99" + ], + "destination.port": 277, + "event.code": "00021", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "texpl: NetScreen device_id=isquames [No Name]system-low-00021: DIP port-translation stickiness was atio by utla via ntm from host 10.96.165.147 to 10.96.218.99:277 (2019-11-15 17:19:22)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 13601, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.96.165.147", + "10.96.218.99" + ], + "related.user": [ + "utla" + ], + "rsa.db.index": "DIP port-translation stickiness was modified", + "rsa.identity.logon_type": "ntm", + "rsa.internal.messageid": "00021", + "rsa.misc.disposition": "atio", + "rsa.misc.hardware_id": "isquames", + "rsa.misc.severity": "low", + "service.type": "juniper", + "source.ip": [ + "10.96.165.147" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "utla" + }, + { + "destination.ip": [ + "10.230.29.67" + ], + "destination.port": 7478, + "event.code": "00021", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "elaudant: NetScreen device_id=ratvolu [odte]system-medium-00021(eum): DIP port-translation stickiness was uidol by repr via idu from host 10.201.72.59 to 10.230.29.67:7478 (2019-11-30 00:21:57)", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "medium", + "log.offset": 13787, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.201.72.59", + "10.230.29.67" + ], + "related.user": [ + "repr" + ], + "rsa.db.index": "DIP port-translation stickiness was modified", + "rsa.identity.logon_type": "idu", + "rsa.internal.messageid": "00021", + "rsa.misc.disposition": "uidol", + "rsa.misc.hardware_id": "ratvolu", + "rsa.misc.severity": "medium", + "service.type": "juniper", + "source.ip": [ + "10.201.72.59" + ], + "tags": [ + "juniper.netscreen", + "forwarded" + ], + "user.name": "repr" + }, + { + "event.code": "00602", + "event.dataset": "juniper.netscreen", + "event.module": "juniper", + "event.original": "toc: NetScreen device_id=rau [sciuntN]system-low-00602: PIMSM Error in initializing interface state change", + "fileset.name": "netscreen", + "input.type": "log", + "log.level": "low", + "log.offset": 13981, + "observer.product": "Netscreen", + "observer.type": "Firewall", + "observer.vendor": "Juniper", + "rsa.internal.messageid": "00602", + "rsa.misc.hardware_id": "rau", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "sciuntN", + "service.type": "juniper", + "tags": [ + "juniper.netscreen", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc index 3e3c651214a..8a3facdc259 100644 --- a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc @@ -161,7 +161,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/netscout/_meta/docs.asciidoc b/x-pack/filebeat/module/netscout/_meta/docs.asciidoc index 8f773354af9..3d0477a9f43 100644 --- a/x-pack/filebeat/module/netscout/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/netscout/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/proofpoint/README.md b/x-pack/filebeat/module/proofpoint/README.md new file mode 100644 index 00000000000..9ce835721f0 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/README.md @@ -0,0 +1,7 @@ +# proofpoint module + +This is a module for Proofpoint Email Security logs. + +Autogenerated from RSA NetWitness log parser 2.0 XML proofpoint version 131 +at 2020-09-01 14:17:48.203341 +0000 UTC. + diff --git a/x-pack/filebeat/module/proofpoint/_meta/config.yml b/x-pack/filebeat/module/proofpoint/_meta/config.yml new file mode 100644 index 00000000000..d25f23041e3 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/_meta/config.yml @@ -0,0 +1,19 @@ +- module: proofpoint + emailsecurity: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9531 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc b/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc new file mode 100644 index 00000000000..b4f2ce21100 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/_meta/docs.asciidoc @@ -0,0 +1,66 @@ +[role="xpack"] + +:modulename: proofpoint +:has-dashboards: false + +== Proofpoint module + +experimental[] + +This is a module for receiving Proofpoint Email Security logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: emailsecurity + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `emailsecurity` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "proofpoint" device revision 131. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9531` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + diff --git a/x-pack/filebeat/module/proofpoint/_meta/fields.yml b/x-pack/filebeat/module/proofpoint/_meta/fields.yml new file mode 100644 index 00000000000..6a65d925e9e --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/_meta/fields.yml @@ -0,0 +1,5 @@ +- key: proofpoint + title: Proofpoint Email Security + description: > + proofpoint fields. + fields: diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/_meta/fields.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml new file mode 100644 index 00000000000..0598b8e63d1 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Proofpoint" + product: "Email" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/proofpoint/emailsecurity/config/liblogparser.js + - ${path.home}/module/proofpoint/emailsecurity/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/config/liblogparser.js b/x-pack/filebeat/module/proofpoint/emailsecurity/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); + +var dup19 = // "Pattern{Constant('attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(p0,false)}" +match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); + +var dup20 = // "Pattern{Constant('mod='), Field(p0,false)}" +match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); + +var dup21 = call({ + dest: "nwparser.filename", + fn: RMQ, + args: [ + field("fld1"), + ], +}); + +var dup22 = setc("eventcategory","1207040200"); + +var dup23 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' version="'), Field(component_version,false), Constant('" duration='), Field(p0,false)}" +match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); + +var dup24 = // "Pattern{Field(duration_string,false)}" +match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); + +var dup25 = setc("eventcategory","1003010000"); + +var dup26 = setc("eventcategory","1003000000"); + +var dup27 = setc("eventcategory","1207040000"); + +var dup28 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); + +var dup29 = // "Pattern{Constant('['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); + +var dup30 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); + +var dup31 = // "Pattern{Field(dhost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); + +var dup32 = // "Pattern{Field(,false), Constant('dsn='), Field(resultcode,false), Constant(', stat='), Field(info,false)}" +match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); + +var dup33 = // "Pattern{Constant('['), Field(daddr,false), Constant(']')}" +match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); + +var dup34 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant(']')}" +match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); + +var dup35 = // "Pattern{Field(dhost,false)}" +match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); + +var dup36 = date_time({ + dest: "event_time", + args: ["hdate","htime"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup37 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); + +var dup38 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); + +var dup39 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); + +var dup40 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant(']')}" +match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); + +var dup41 = // "Pattern{Field(,false), Constant('field='), Field(fld2,false), Constant(', status='), Field(info,false)}" +match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); + +var dup42 = // "Pattern{Field(,false), Constant('version='), Field(fld55,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" +match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); + +var dup43 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(fld71,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); + +var dup44 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); + +var dup45 = linear_select([ + dup1, + dup2, + dup3, + dup4, + dup5, +]); + +var dup46 = linear_select([ + dup14, + dup15, +]); + +var dup47 = linear_select([ + dup19, + dup20, +]); + +var dup48 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" +match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ + dup26, + dup9, +])); + +var dup49 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var dup50 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var dup51 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" +match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ + dup17, + dup9, +])); + +var dup52 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" +match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ + dup17, + dup9, +])); + +var dup53 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" +match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ + dup27, + dup9, +])); + +var dup54 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' version='), Field(fld55,false)}" +match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ + dup17, + dup9, +])); + +var dup55 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sig='), Field(fld60,false)}" +match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ + dup17, + dup9, +])); + +var dup56 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,false)}" +match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ + dup17, + dup9, +])); + +var dup57 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' addr='), Field(saddr,false)}" +match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ + dup17, + dup9, +])); + +var dup58 = linear_select([ + dup28, + dup29, + dup30, + dup31, +]); + +var dup59 = linear_select([ + dup40, + dup33, + dup34, + dup35, +]); + +var dup60 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': timeout waiting for input from '), Field(fld11,true), Constant(' during server cmd read')}" +match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ + dup17, + dup9, +])); + +var dup61 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(event_description,false)}" +match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ + dup17, + dup9, +])); + +var dup62 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" +match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ + dup17, + dup9, +])); + +var dup63 = all_match({ + processors: [ + dup38, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var dup64 = all_match({ + processors: [ + dup39, + dup59, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var dup65 = all_match({ + processors: [ + dup37, + dup58, + dup41, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var dup66 = all_match({ + processors: [ + dup37, + dup58, + dup42, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var dup67 = all_match({ + processors: [ + dup43, + dup59, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var dup68 = all_match({ + processors: [ + dup44, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var hdr1 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld3,false), Constant(']: '), Field(p0,false)}" +match("HEADER#0:0024/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{hinstance}[%{hfld3}]: %{p0}", processor_chain([ + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld3"), + constant("]: "), + field("p0"), + ], + }), +])); + +var part1 = // "Pattern{Field(,false), Constant('s='), Field(hfld4,true), Constant(' cmd=send '), Field(p0,false)}" +match("HEADER#0:0024/2", "nwparser.p0", "%{}s=%{hfld4->} cmd=send %{p0}"); + +var all1 = all_match({ + processors: [ + hdr1, + dup45, + part1, + ], + on_success: processor_chain([ + setc("header_id","0024"), + setc("messageid","send"), + ]), +}); + +var hdr2 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld3,false), Constant(']: '), Field(p0,false)}" +match("HEADER#1:0023/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]: %{p0}"); + +var part2 = // "Pattern{Field(,true), Constant(' '), Field(payload,false)}" +match("HEADER#1:0023/2", "nwparser.p0", "%{} %{payload}"); + +var all2 = all_match({ + processors: [ + hdr2, + dup45, + part2, + ], + on_success: processor_chain([ + setc("header_id","0023"), + ]), +}); + +var hdr3 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(p0,false)}" +match("HEADER#2:0025", "message", "%{hdate}T%{htime}.%{hfld1->} %{hinstance->} %{messageid}[%{hfld2}]: %{p0}", processor_chain([ + setc("header_id","0025"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant("["), + field("hfld2"), + constant("]: "), + field("p0"), + ], + }), +])); + +var hdr4 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld4,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' attachment='), Field(hfld7,true), Constant(' file='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#3:0026", "message", "%{hmonth->} %{hday->} %{htime->} %{hostname->} %{hinstance}[%{hfld4}]: %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0026"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld4"), + constant("]: "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" m="), + field("hfld2"), + constant(" x="), + field("hfld3"), + constant(" attachment="), + field("hfld7"), + constant(" file="), + field("hfld5"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr5 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' attachment='), Field(hfld7,true), Constant(' file='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#4:0003", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0003"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" m="), + field("hfld2"), + constant(" x="), + field("hfld3"), + constant(" attachment="), + field("hfld7"), + constant(" file="), + field("hfld5"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr6 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld3,true), Constant(' m='), Field(hfld4,true), Constant(' x='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#5:0015", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} m=%{hfld4->} x=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0015"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld2"), + constant("]: "), + field("hseverity"), + constant(" s="), + field("hfld3"), + constant(" m="), + field("hfld4"), + constant(" x="), + field("hfld5"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr7 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld3,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#6:0016", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0016"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld2"), + constant("]: "), + field("hseverity"), + constant(" s="), + field("hfld3"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr8 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(severity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(p0,false)}" +match("HEADER#7:0017", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ + setc("header_id","0017"), + call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_ttl"), + ], + }), + dup7, +])); + +var hdr9 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant(': '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' m='), Field(hfld3,true), Constant(' x='), Field(hfld4,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#8:0018", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} cmd=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0018"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(": "), + field("hseverity"), + constant(" s="), + field("hfld2"), + constant(" m="), + field("hfld3"), + constant(" x="), + field("hfld4"), + constant(" cmd="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr10 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#9:0019", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance->} %{hseverity->} s=%{hfld2->} mod=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0019"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld2"), + constant(" mod="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr11 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,false), Constant('='), Field(hfld3,true), Constant(' '), Field(p0,false)}" +match("HEADER#10:0020", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} mod=%{msgIdPart1->} %{msgIdPart2}=%{hfld3->} %{p0}", processor_chain([ + setc("header_id","0020"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld2"), + constant("]: "), + field("hseverity"), + constant(" mod="), + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant("="), + field("hfld3"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr12 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(severity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(p0,false)}" +match("HEADER#11:0021", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ + setc("header_id","0021"), + call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_type"), + ], + }), + dup7, +])); + +var hdr13 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant(': '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' m='), Field(hfld3,true), Constant(' x='), Field(hfld4,true), Constant(' '), Field(msgIdPart1,false), Constant('='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#12:0022", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} %{msgIdPart1}=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0022"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(": "), + field("hseverity"), + constant(" s="), + field("hfld2"), + constant(" m="), + field("hfld3"), + constant(" x="), + field("hfld4"), + constant(" "), + field("msgIdPart1"), + constant("="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr14 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#13:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0001"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" m="), + field("hfld2"), + constant(" x="), + field("hfld3"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr15 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#14:0008", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} cmd=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0008"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" m="), + field("hfld2"), + constant(" x="), + field("hfld3"), + constant(" cmd="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr16 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#15:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0002"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr17 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#16:0007", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0007"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" mod="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr18 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#17:0012", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} cmd=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0012"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" s="), + field("hfld1"), + constant(" cmd="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr19 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' type='), Field(hfld5,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#18:0004", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} type=%{hfld5->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0004"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" mod="), + field("msgIdPart1"), + constant(" type="), + field("hfld5"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr20 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' pid='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#19:0005", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} pid=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0005"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" pid="), + field("hfld5"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr21 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" +match("HEADER#20:0006", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ + setc("header_id","0006"), + dup6, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" mod="), + field("msgIdPart1"), + constant(" cmd="), + field("msgIdPart2"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr22 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#21:0009", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{messageid->} %{p0}", processor_chain([ + setc("header_id","0009"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("hseverity"), + constant(" mod="), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr23 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#22:0014", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld2->} %{hinstance}[%{hfld1}]: %{messageid->} %{p0}", processor_chain([ + setc("header_id","0014"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant("["), + field("hfld1"), + constant("]: "), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr24 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(p0,false)}" +match("HEADER#23:0013", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid}[%{hfld1}]: %{p0}", processor_chain([ + setc("header_id","0013"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("messageid"), + constant("["), + field("hfld1"), + constant("]: "), + field("p0"), + ], + }), +])); + +var hdr25 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#24:0011", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","0011"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hinstance"), + constant(" "), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr26 = // "Pattern{Field(messageid,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(p0,false)}" +match("HEADER#25:0010", "message", "%{messageid}[%{hfld1}]: %{p0}", processor_chain([ + setc("header_id","0010"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant("["), + field("hfld1"), + constant("]: "), + field("p0"), + ], + }), +])); + +var select1 = linear_select([ + all1, + all2, + hdr3, + hdr4, + hdr5, + hdr6, + hdr7, + hdr8, + hdr9, + hdr10, + hdr11, + hdr12, + hdr13, + hdr14, + hdr15, + hdr16, + hdr17, + hdr18, + hdr19, + hdr20, + hdr21, + hdr22, + hdr23, + hdr24, + hdr25, + hdr26, +]); + +var part3 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' r='), Field(event_counter,true), Constant(' value='), Field(to,true), Constant(' verified='), Field(fld3,true), Constant(' routes='), Field(fld4,false)}" +match("MESSAGE#0:mail_env_rcpt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ + dup8, + dup9, +])); + +var msg1 = msg("mail_env_rcpt", part3); + +var part4 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' r='), Field(event_counter,true), Constant(' value='), Field(to,true), Constant(' verified='), Field(fld3,true), Constant(' routes='), Field(fld4,false)}" +match("MESSAGE#1:mail_env_rcpt:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ + dup8, + dup9, +])); + +var msg2 = msg("mail_env_rcpt:01", part4); + +var select2 = linear_select([ + msg1, + msg2, +]); + +var part5 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,true), Constant(' a='), Field(fld12,false)}" +match("MESSAGE#2:mail_attachment", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ + dup10, + dup9, +])); + +var msg3 = msg("mail_attachment", part5); + +var part6 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,true), Constant(' a='), Field(fld12,false)}" +match("MESSAGE#3:mail_attachment:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ + dup10, + dup9, +])); + +var msg4 = msg("mail_attachment:01", part6); + +var part7 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,false)}" +match("MESSAGE#4:mail_attachment:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ + dup10, + dup9, +])); + +var msg5 = msg("mail_attachment:02", part7); + +var part8 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,false)}" +match("MESSAGE#5:mail_attachment:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ + dup10, + dup9, +])); + +var msg6 = msg("mail_attachment:03", part8); + +var select3 = linear_select([ + msg3, + msg4, + msg5, + msg6, +]); + +var part9 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#6:mail_msg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup11, + dup9, + dup12, + dup13, +])); + +var msg7 = msg("mail_msg", part9); + +var part10 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#7:mail_msg:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup11, + dup9, + dup12, + dup13, +])); + +var msg8 = msg("mail_msg:01", part10); + +var part11 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#8:mail_msg:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup11, + dup9, + dup12, + dup13, +])); + +var msg9 = msg("mail_msg:04", part11); + +var part12 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#9:mail_msg:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup11, + dup9, + dup12, + dup13, +])); + +var msg10 = msg("mail_msg:02", part12); + +var part13 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#10:mail_msg:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup11, + dup9, + dup12, + dup13, +])); + +var msg11 = msg("mail_msg:03", part13); + +var select4 = linear_select([ + msg7, + msg8, + msg9, + msg10, + msg11, +]); + +var part14 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(to,true), Constant(' ofrom='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(p0,false)}" +match("MESSAGE#11:mail_env_from:ofrom/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); + +var all3 = all_match({ + processors: [ + part14, + dup46, + ], + on_success: processor_chain([ + dup16, + dup9, + ]), +}); + +var msg12 = msg("mail_env_from:ofrom", all3); + +var part15 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(to,true), Constant(' ofrom='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" +match("MESSAGE#12:mail_env_from:ofrom:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ + dup16, + dup9, +])); + +var msg13 = msg("mail_env_from:ofrom:01", part15); + +var part16 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(p0,false)}" +match("MESSAGE#13:mail_env_from/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); + +var all4 = all_match({ + processors: [ + part16, + dup46, + ], + on_success: processor_chain([ + dup16, + dup9, + ]), +}); + +var msg14 = msg("mail_env_from", all4); + +var part17 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" +match("MESSAGE#14:mail_env_from:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ + dup16, + dup9, +])); + +var msg15 = msg("mail_env_from:01", part17); + +var select5 = linear_select([ + msg12, + msg13, + msg14, + msg15, +]); + +var part18 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(ddomain,true), Constant(' routes='), Field(fld4,false)}" +match("MESSAGE#15:mail_helo", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ + dup17, + dup9, +])); + +var msg16 = msg("mail_helo", part18); + +var part19 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(ddomain,true), Constant(' routes='), Field(fld4,false)}" +match("MESSAGE#16:mail_helo:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ + dup17, + dup9, +])); + +var msg17 = msg("mail_helo:01", part19); + +var select6 = linear_select([ + msg16, + msg17, +]); + +var part20 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#17:mail_continue-system-sendmail", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg18 = msg("mail_continue-system-sendmail", part20); + +var part21 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#18:mail_release", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=%{result->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg19 = msg("mail_release", part21); + +var part22 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#19:session_data/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} %{p0}"); + +var part23 = // "Pattern{Constant('rcpt_notroutes='), Field(fld20,true), Constant(' data_routes='), Field(fld21,false)}" +match("MESSAGE#19:session_data/1_0", "nwparser.p0", "rcpt_notroutes=%{fld20->} data_routes=%{fld21}"); + +var part24 = // "Pattern{Constant('rcpt='), Field(to,true), Constant(' suborg='), Field(fld22,false)}" +match("MESSAGE#19:session_data/1_1", "nwparser.p0", "rcpt=%{to->} suborg=%{fld22}"); + +var part25 = // "Pattern{Constant('from='), Field(from,true), Constant(' suborg='), Field(fld22,false)}" +match("MESSAGE#19:session_data/1_2", "nwparser.p0", "from=%{from->} suborg=%{fld22}"); + +var select7 = linear_select([ + part23, + part24, + part25, +]); + +var all5 = all_match({ + processors: [ + part22, + select7, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg20 = msg("session_data", all5); + +var part26 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rcpt_notroutes='), Field(fld20,true), Constant(' data_routes='), Field(fld21,false)}" +match("MESSAGE#20:session_data:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rcpt_notroutes=%{fld20->} data_routes=%{fld21}", processor_chain([ + dup17, + dup9, +])); + +var msg21 = msg("session_data:01", part26); + +var select8 = linear_select([ + msg20, + msg21, +]); + +var part27 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' folder='), Field(fld22,true), Constant(' pri='), Field(fld23,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#21:session_store", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg22 = msg("session_store", part27); + +var part28 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' folder='), Field(fld22,true), Constant(' pri='), Field(fld23,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#22:session_store:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg23 = msg("session_store:01", part28); + +var select9 = linear_select([ + msg22, + msg23, +]); + +var part29 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" +match("MESSAGE#23:session_headers", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ + dup17, + dup9, +])); + +var msg24 = msg("session_headers", part29); + +var part30 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" +match("MESSAGE#24:session_headers:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ + dup17, + dup9, +])); + +var msg25 = msg("session_headers:01", part30); + +var select10 = linear_select([ + msg24, + msg25, +]); + +var part31 = // "Pattern{Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,false)}" +match("MESSAGE#25:session_judge/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}"); + +var all6 = all_match({ + processors: [ + dup18, + dup47, + part31, + ], + on_success: processor_chain([ + dup17, + dup9, + dup21, + ]), +}); + +var msg26 = msg("session_judge", all6); + +var part32 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,false)}" +match("MESSAGE#26:session_judge:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}", processor_chain([ + dup17, + dup9, +])); + +var msg27 = msg("session_judge:01", part32); + +var select11 = linear_select([ + msg26, + msg27, +]); + +var part33 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ip='), Field(hostip,true), Constant(' country='), Field(location_country,true), Constant(' lip='), Field(fld24,true), Constant(' prot='), Field(fld25,true), Constant(' hops_active='), Field(fld26,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' perlwait='), Field(fld27,false)}" +match("MESSAGE#27:session_connect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ + dup17, + dup9, +])); + +var msg28 = msg("session_connect", part33); + +var part34 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ip='), Field(hostip,true), Constant(' country='), Field(location_country,true), Constant(' lip='), Field(fld24,true), Constant(' prot='), Field(fld25,true), Constant(' hops_active='), Field(fld26,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' perlwait='), Field(fld27,false)}" +match("MESSAGE#28:session_connect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ + dup17, + dup9, +])); + +var msg29 = msg("session_connect:01", part34); + +var select12 = linear_select([ + msg28, + msg29, +]); + +var part35 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' host='), Field(hostname,true), Constant(' resolve='), Field(fld28,true), Constant(' reverse='), Field(fld13,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" +match("MESSAGE#29:session_resolve", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ + dup17, + dup9, +])); + +var msg30 = msg("session_resolve", part35); + +var part36 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' host='), Field(hostname,true), Constant(' resolve='), Field(fld28,true), Constant(' reverse='), Field(fld13,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" +match("MESSAGE#30:session_resolve:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ + dup17, + dup9, +])); + +var msg31 = msg("session_resolve:01", part36); + +var select13 = linear_select([ + msg30, + msg31, +]); + +var part37 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' ip='), Field(hostip,true), Constant(' rate='), Field(fld29,true), Constant(' crate='), Field(fld30,true), Constant(' limit='), Field(fld31,false)}" +match("MESSAGE#31:session_throttle", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ + dup17, + dup9, +])); + +var msg32 = msg("session_throttle", part37); + +var part38 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' ip='), Field(hostip,true), Constant(' rate='), Field(fld29,true), Constant(' crate='), Field(fld30,true), Constant(' limit='), Field(fld31,false)}" +match("MESSAGE#32:session_throttle:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ + dup17, + dup9, +])); + +var msg33 = msg("session_throttle:01", part38); + +var select14 = linear_select([ + msg32, + msg33, +]); + +var part39 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' rate='), Field(fld58,false)}" +match("MESSAGE#33:session_dispose", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ + dup22, + dup9, +])); + +var msg34 = msg("session_dispose", part39); + +var part40 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' rate='), Field(fld58,false)}" +match("MESSAGE#34:session_dispose:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ + dup22, + dup9, +])); + +var msg35 = msg("session_dispose:01", part40); + +var part41 = // "Pattern{Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,false)}" +match("MESSAGE#35:session_dispose:02/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}"); + +var all7 = all_match({ + processors: [ + dup18, + dup47, + part41, + ], + on_success: processor_chain([ + dup22, + dup9, + dup21, + ]), +}); + +var msg36 = msg("session_dispose:02", all7); + +var part42 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,false)}" +match("MESSAGE#36:session_dispose:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}", processor_chain([ + dup22, + dup9, +])); + +var msg37 = msg("session_dispose:03", part42); + +var select15 = linear_select([ + msg34, + msg35, + msg36, + msg37, +]); + +var part43 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#37:session_disconnect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup17, + dup9, + dup13, +])); + +var msg38 = msg("session_disconnect", part43); + +var part44 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#38:session_disconnect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup17, + dup9, + dup13, +])); + +var msg39 = msg("session_disconnect:01", part44); + +var select16 = linear_select([ + msg38, + msg39, +]); + +var part45 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#39:av_run:02/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{fld1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} %{p0}"); + +var part46 = // "Pattern{Constant('cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" +match("MESSAGE#39:av_run:02/1_0", "nwparser.p0", "cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); + +var part47 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" +match("MESSAGE#39:av_run:02/1_2", "nwparser.p0", "vendor=%{fld36->} duration=%{p0}"); + +var select17 = linear_select([ + part46, + dup23, + part47, +]); + +var all8 = all_match({ + processors: [ + part45, + select17, + dup24, + ], + on_success: processor_chain([ + dup25, + dup9, + dup21, + ]), +}); + +var msg40 = msg("av_run:02", all8); + +var part48 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#40:av_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ + dup25, + dup9, +])); + +var msg41 = msg("av_run:03", part48); + +var part49 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#41:av_run/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} %{p0}"); + +var part50 = // "Pattern{Constant('name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" +match("MESSAGE#41:av_run/1_1", "nwparser.p0", "name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); + +var part51 = // "Pattern{Constant('name='), Field(fld34,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" +match("MESSAGE#41:av_run/1_2", "nwparser.p0", "name=%{fld34->} vendor=%{fld36->} duration=%{p0}"); + +var select18 = linear_select([ + dup23, + part50, + part51, +]); + +var all9 = all_match({ + processors: [ + part49, + select18, + dup24, + ], + on_success: processor_chain([ + dup25, + dup9, + ]), +}); + +var msg42 = msg("av_run", all9); + +var part52 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#42:av_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ + dup25, + dup9, +])); + +var msg43 = msg("av_run:01", part52); + +var select19 = linear_select([ + msg40, + msg41, + msg42, + msg43, +]); + +var msg44 = msg("av_refresh", dup48); + +var msg45 = msg("av_init", dup48); + +var part53 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" +match("MESSAGE#45:av_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ + dup26, + dup9, +])); + +var msg46 = msg("av_load", part53); + +var part54 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#46:access_run:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg47 = msg("access_run:02", part54); + +var part55 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#47:access_run:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg48 = msg("access_run:04", part55); + +var msg49 = msg("access_run:03", dup49); + +var msg50 = msg("access_run:01", dup50); + +var select20 = linear_select([ + msg47, + msg48, + msg49, + msg50, +]); + +var part56 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" +match("MESSAGE#50:access_refresh", "nwparser.payload", "%{fld0->} %{severity->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ + dup17, + dup9, +])); + +var msg51 = msg("access_refresh", part56); + +var msg52 = msg("access_refresh:01", dup51); + +var select21 = linear_select([ + msg51, + msg52, +]); + +var msg53 = msg("access_load", dup52); + +var msg54 = msg("regulation_init", dup51); + +var msg55 = msg("regulation_refresh", dup51); + +var part57 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} %{p0}"); + +var part58 = // "Pattern{Constant('ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/1_0", "nwparser.p0", "ipscore=%{fld40->} suspectscore=%{p0}"); + +var part59 = // "Pattern{Constant('suspectscore='), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/1_1", "nwparser.p0", "suspectscore=%{p0}"); + +var select22 = linear_select([ + part58, + part59, +]); + +var part60 = // "Pattern{Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/2", "nwparser.p0", "%{fld41->} phishscore=%{fld42->} %{p0}"); + +var part61 = // "Pattern{Constant('bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/3_0", "nwparser.p0", "bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{p0}"); + +var part62 = // "Pattern{Constant('adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' classifier='), Field(p0,false)}" +match("MESSAGE#55:spam_run:rule/3_1", "nwparser.p0", "adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{p0}"); + +var select23 = linear_select([ + part61, + part62, +]); + +var part63 = // "Pattern{Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#55:spam_run:rule/4", "nwparser.p0", "%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}"); + +var all10 = all_match({ + processors: [ + part57, + select22, + part60, + select23, + part63, + ], + on_success: processor_chain([ + dup27, + dup9, + ]), +}); + +var msg56 = msg("spam_run:rule", all10); + +var part64 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#56:spam_run:rule_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ + dup27, + dup9, +])); + +var msg57 = msg("spam_run:rule_02", part64); + +var part65 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' ndrscore='), Field(fld57,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' adjustscore='), Field(fld58,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#57:spam_run:rule_03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld57->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld58->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ + dup27, + dup9, +])); + +var msg58 = msg("spam_run:rule_03", part65); + +var part66 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' kscore.is_bulkscore='), Field(fld57,true), Constant(' kscore.compositescore='), Field(fld40,true), Constant(' circleOfTrustscore='), Field(fld41,true), Constant(' compositescore='), Field(fld42,true), Constant(' urlsuspect_oldscore='), Field(fld43,true), Constant(' suspectscore='), Field(reputation_num,true), Constant(' recipient_domain_to_sender_totalscore='), Field(fld58,true), Constant(' phishscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld45,true), Constant(' kscore.is_spamscore='), Field(fld46,true), Constant(' recipient_to_sender_totalscore='), Field(fld47,true), Constant(' recipient_domain_to_sender_domain_totalscore='), Field(fld48,true), Constant(' rbsscore='), Field(fld49,true), Constant(' spamscore='), Field(fld50,true), Constant(' recipient_to_sender_domain_totalscore='), Field(fld51,true), Constant(' urlsuspectscore='), Field(fld52,true), Constant(' '), Field(fld53,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#58:spam_run:rule_04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} kscore.is_bulkscore=%{fld57->} kscore.compositescore=%{fld40->} circleOfTrustscore=%{fld41->} compositescore=%{fld42->} urlsuspect_oldscore=%{fld43->} suspectscore=%{reputation_num->} recipient_domain_to_sender_totalscore=%{fld58->} phishscore=%{fld44->} bulkscore=%{fld45->} kscore.is_spamscore=%{fld46->} recipient_to_sender_totalscore=%{fld47->} recipient_domain_to_sender_domain_totalscore=%{fld48->} rbsscore=%{fld49->} spamscore=%{fld50->} recipient_to_sender_domain_totalscore=%{fld51->} urlsuspectscore=%{fld52->} %{fld53->} duration=%{duration_string}", processor_chain([ + dup27, + dup9, +])); + +var msg59 = msg("spam_run:rule_04", part66); + +var part67 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' ndrscore='), Field(fld53,true), Constant(' suspectscore='), Field(fld40,true), Constant(' malwarescore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' adjustscore='), Field(fld54,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#59:spam_run:rule_05", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld53->} suspectscore=%{fld40->} malwarescore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld54->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ + dup27, + dup9, +])); + +var msg60 = msg("spam_run:rule_05", part67); + +var part68 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' mod='), Field(agent,true), Constant(' total_uri_count='), Field(dclass_counter1,true), Constant(' uris_excluded_from_report_info='), Field(dclass_counter2,false)}" +match("MESSAGE#60:spam_run:rule_06", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} mod=%{agent->} total_uri_count=%{dclass_counter1->} uris_excluded_from_report_info=%{dclass_counter2}", processor_chain([ + dup27, + dup9, +])); + +var msg61 = msg("spam_run:rule_06", part68); + +var part69 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' tests='), Field(fld52,false)}" +match("MESSAGE#61:spam_run:action_01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ + dup27, + dup9, +])); + +var msg62 = msg("spam_run:action_01", part69); + +var part70 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' tests='), Field(fld52,false)}" +match("MESSAGE#62:spam_run:action", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ + dup27, + dup9, +])); + +var msg63 = msg("spam_run:action", part70); + +var part71 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' num_domains='), Field(fld53,true), Constant(' num_domains_to_lookup='), Field(fld40,false)}" +match("MESSAGE#63:spam_run:action_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} num_domains=%{fld53->} num_domains_to_lookup=%{fld40}", processor_chain([ + dup27, + dup9, +])); + +var msg64 = msg("spam_run:action_02", part71); + +var select24 = linear_select([ + msg56, + msg57, + msg58, + msg59, + msg60, + msg61, + msg62, + msg63, + msg64, +]); + +var msg65 = msg("spam_refresh", dup53); + +var msg66 = msg("spam_init", dup53); + +var part72 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" +match("MESSAGE#66:spam_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ + dup27, + dup9, +])); + +var msg67 = msg("spam_load", part72); + +var part73 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' policy='), Field(fld38,true), Constant(' address='), Field(fld54,false)}" +match("MESSAGE#67:batv_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ + dup17, + dup9, +])); + +var msg68 = msg("batv_run", part73); + +var part74 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' policy='), Field(fld38,true), Constant(' address='), Field(fld54,false)}" +match("MESSAGE#68:batv_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ + dup17, + dup9, +])); + +var msg69 = msg("batv_run:01", part74); + +var msg70 = msg("batv_run:02", dup49); + +var msg71 = msg("batv_run:03", dup50); + +var select25 = linear_select([ + msg68, + msg69, + msg70, + msg71, +]); + +var msg72 = msg("zerohour_refresh", dup54); + +var msg73 = msg("zerohour_init", dup54); + +var msg74 = msg("zerohour_load", dup52); + +var part75 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' count='), Field(fld2,true), Constant(' name='), Field(fld34,true), Constant(' init_time='), Field(fld3,true), Constant(' init_virusthreat='), Field(fld4,true), Constant(' virusthreat='), Field(fld5,true), Constant(' virusthreatid='), Field(fld6,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#74:zerohour_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg75 = msg("zerohour_run", part75); + +var part76 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' count='), Field(fld2,true), Constant(' name='), Field(fld34,true), Constant(' init_time='), Field(fld3,true), Constant(' init_virusthreat='), Field(fld4,true), Constant(' virusthreat='), Field(fld5,true), Constant(' virusthreatid='), Field(fld6,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#75:zerohour_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg76 = msg("zerohour_run:01", part76); + +var select26 = linear_select([ + msg75, + msg76, +]); + +var part77 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#76:service_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg77 = msg("service_refresh", part77); + +var part78 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#77:perl_clone", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg78 = msg("perl_clone", part78); + +var part79 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#78:cvt_convert", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg79 = msg("cvt_convert", part79); + +var part80 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#79:cvt_convert:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg80 = msg("cvt_convert:01", part80); + +var part81 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#80:cvt_convert:02", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg81 = msg("cvt_convert:02", part81); + +var select27 = linear_select([ + msg79, + msg80, + msg81, +]); + +var part82 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#81:cvt_detect", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg82 = msg("cvt_detect", part82); + +var msg83 = msg("cvtd:01", dup55); + +var msg84 = msg("cvtd", dup56); + +var select28 = linear_select([ + msg83, + msg84, +]); + +var part83 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(fld5,true), Constant(' mod='), Field(agent,true), Constant(' encrypted='), Field(fld6,false)}" +match("MESSAGE#84:cvtd_encrypted", "nwparser.payload", "%{fld0->} %{severity->} pid=%{fld5->} mod=%{agent->} encrypted=%{fld6}", processor_chain([ + dup17, + dup9, +])); + +var msg85 = msg("cvtd_encrypted", part83); + +var msg86 = msg("filter:01", dup55); + +var msg87 = msg("filter", dup56); + +var select29 = linear_select([ + msg86, + msg87, +]); + +var msg88 = msg("soap_listen", dup57); + +var msg89 = msg("http_listen", dup57); + +var part84 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(event_description,false)}" +match("MESSAGE#89:mltr", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{event_description}", processor_chain([ + dup17, + dup9, +])); + +var msg90 = msg("mltr", part84); + +var msg91 = msg("milter_listen", dup57); + +var msg92 = msg("smtpsrv_load", dup52); + +var msg93 = msg("smtpsrv_listen", dup57); + +var part85 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#93:smtpsrv_run", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg94 = msg("smtpsrv_run", part85); + +var part86 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#94:smtpsrv/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{p0}"); + +var part87 = // "Pattern{Field(result,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#94:smtpsrv/1_0", "nwparser.p0", "%{result->} err=%{fld58}"); + +var part88 = // "Pattern{Field(result,false)}" +match_copy("MESSAGE#94:smtpsrv/1_1", "nwparser.p0", "result"); + +var select30 = linear_select([ + part87, + part88, +]); + +var all11 = all_match({ + processors: [ + part86, + select30, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg95 = msg("smtpsrv", all11); + +var part89 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' cmd='), Field(obj_type,true), Constant(' profile='), Field(fld52,true), Constant(' qid='), Field(fld15,true), Constant(' rcpts='), Field(to,false)}" +match("MESSAGE#95:send", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ + dup17, + dup9, +])); + +var msg96 = msg("send", part89); + +var part90 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' cmd='), Field(obj_type,true), Constant(' profile='), Field(fld52,true), Constant(' qid='), Field(fld15,true), Constant(' rcpts='), Field(to,false)}" +match("MESSAGE#96:send:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ + dup17, + dup9, +])); + +var msg97 = msg("send:01", part90); + +var part91 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' cmd='), Field(obj_type,true), Constant(' rcpt='), Field(to,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#97:send:02", "nwparser.payload", "%{fld0}: %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} rcpt=%{to->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg98 = msg("send:02", part91); + +var select31 = linear_select([ + msg96, + msg97, + msg98, +]); + +var part92 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(p0,false)}" +match("MESSAGE#98:queued-alert/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{p0}"); + +var part93 = // "Pattern{Field(fld55,true), Constant(' tls_verify='), Field(fld70,false), Constant(', pri='), Field(p0,false)}" +match("MESSAGE#98:queued-alert/1_0", "nwparser.p0", "%{fld55->} tls_verify=%{fld70}, pri=%{p0}"); + +var part94 = // "Pattern{Field(fld55,false), Constant(', pri='), Field(p0,false)}" +match("MESSAGE#98:queued-alert/1_1", "nwparser.p0", "%{fld55}, pri=%{p0}"); + +var select32 = linear_select([ + part93, + part94, +]); + +var part95 = // "Pattern{Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#98:queued-alert/2", "nwparser.p0", "%{fld23}, relay=%{p0}"); + +var all12 = all_match({ + processors: [ + part92, + select32, + part95, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg99 = msg("queued-alert", all12); + +var part96 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#99:queued-alert:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); + +var part97 = // "Pattern{Constant('['), Field(fld50,false), Constant('] ['), Field(daddr,false), Constant(']')}" +match("MESSAGE#99:queued-alert:01/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}]"); + +var select33 = linear_select([ + part97, + dup33, + dup34, + dup35, +]); + +var all13 = all_match({ + processors: [ + part96, + select33, + ], + on_success: processor_chain([ + dup17, + dup9, + dup36, + ]), +}); + +var msg100 = msg("queued-alert:01", all13); + +var part98 = // "Pattern{Constant('['), Field(fld50,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#100:queued-alert:02/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}],%{p0}"); + +var select34 = linear_select([ + part98, + dup29, + dup30, + dup31, +]); + +var part99 = // "Pattern{Field(,false), Constant('version='), Field(version,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(s_cipher,false), Constant(', bits='), Field(fld59,false)}" +match("MESSAGE#100:queued-alert:02/2", "nwparser.p0", "%{}version=%{version}, verify=%{fld57}, cipher=%{s_cipher}, bits=%{fld59}"); + +var all14 = all_match({ + processors: [ + dup37, + select34, + part99, + ], + on_success: processor_chain([ + dup17, + dup9, + dup36, + ]), +}); + +var msg101 = msg("queued-alert:02", all14); + +var select35 = linear_select([ + msg99, + msg100, + msg101, +]); + +var msg102 = msg("queued-VoltageEncrypt", dup63); + +var msg103 = msg("queued-VoltageEncrypt:01", dup64); + +var select36 = linear_select([ + msg102, + msg103, +]); + +var msg104 = msg("queued-default", dup63); + +var msg105 = msg("queued-default:01", dup64); + +var msg106 = msg("queued-default:02", dup65); + +var msg107 = msg("queued-default:03", dup66); + +var msg108 = msg("queued-default:04", dup60); + +var select37 = linear_select([ + msg104, + msg105, + msg106, + msg107, + msg108, +]); + +var msg109 = msg("queued-reinject", dup63); + +var msg110 = msg("queued-reinject:01", dup64); + +var msg111 = msg("queued-reinject:02", dup65); + +var msg112 = msg("queued-reinject:03", dup66); + +var part100 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': maxrcpts='), Field(fld56,false), Constant(', rcpts='), Field(fld57,false), Constant(', count='), Field(fld58,false), Constant(', ids='), Field(fld59,false)}" +match("MESSAGE#111:queued-reinject:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: maxrcpts=%{fld56}, rcpts=%{fld57}, count=%{fld58}, ids=%{fld59}", processor_chain([ + dup17, + dup9, +])); + +var msg113 = msg("queued-reinject:05", part100); + +var msg114 = msg("queued-reinject:04", dup60); + +var msg115 = msg("queued-reinject:06", dup61); + +var select38 = linear_select([ + msg109, + msg110, + msg111, + msg112, + msg113, + msg114, + msg115, +]); + +var part101 = // "Pattern{Field(,false), Constant('version='), Field(version,false), Constant(', verify='), Field(disposition,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" +match("MESSAGE#114:queued-eurort/2", "nwparser.p0", "%{}version=%{version}, verify=%{disposition}, cipher=%{fld58}, bits=%{fld59}"); + +var all15 = all_match({ + processors: [ + dup37, + dup58, + part101, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg116 = msg("queued-eurort", all15); + +var msg117 = msg("queued-eurort:01", dup63); + +var msg118 = msg("queued-eurort:02", dup67); + +var msg119 = msg("queued-eurort:03", dup60); + +var select39 = linear_select([ + msg116, + msg117, + msg118, + msg119, +]); + +var msg120 = msg("queued-vdedc2v5", dup63); + +var msg121 = msg("queued-vdedc2v5:01", dup67); + +var select40 = linear_select([ + msg120, + msg121, +]); + +var msg122 = msg("sm-msp-queue", dup66); + +var part102 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: starting daemon ('), Field(fld7,false), Constant('): '), Field(fld6,false)}" +match("MESSAGE#122:sm-msp-queue:01", "nwparser.payload", "%{agent}[%{process_id}]: starting daemon (%{fld7}): %{fld6}", processor_chain([ + setc("eventcategory","1605000000"), + dup9, +])); + +var msg123 = msg("sm-msp-queue:01", part102); + +var part103 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', ctladdr='), Field(fld13,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#123:sm-msp-queue:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, ctladdr=%{fld13}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); + +var all16 = all_match({ + processors: [ + part103, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg124 = msg("sm-msp-queue:02", all16); + +var select41 = linear_select([ + msg122, + msg123, + msg124, +]); + +var part104 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', tls_verify='), Field(fld24,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#124:sendmail:15/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, tls_verify=%{fld24}, pri=%{fld23}, relay=%{p0}"); + +var part105 = // "Pattern{Field(dhost,false), Constant('. ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#124:sendmail:15/1_1", "nwparser.p0", "%{dhost}. [%{daddr}],%{p0}"); + +var part106 = // "Pattern{Field(dhost,false), Constant('.,'), Field(p0,false)}" +match("MESSAGE#124:sendmail:15/1_2", "nwparser.p0", "%{dhost}.,%{p0}"); + +var select42 = linear_select([ + dup28, + part105, + part106, +]); + +var all17 = all_match({ + processors: [ + part104, + select42, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg125 = msg("sendmail:15", all17); + +var part107 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld54,false), Constant(', nrcpts='), Field(fld55,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(p0,false)}" +match("MESSAGE#125:sendmail:14/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld54}, nrcpts=%{fld55}, msgid=%{id}, proto=%{protocol}, daemon=%{p0}"); + +var part108 = // "Pattern{Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#125:sendmail:14/1_0", "nwparser.p0", "%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); + +var part109 = // "Pattern{Field(fld69,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#125:sendmail:14/1_1", "nwparser.p0", "%{fld69}, relay=%{p0}"); + +var select43 = linear_select([ + part108, + part109, +]); + +var all18 = all_match({ + processors: [ + part107, + select43, + dup59, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg126 = msg("sendmail:14", all18); + +var msg127 = msg("sendmail", dup68); + +var part110 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': available mech='), Field(fld2,false), Constant(', allowed mech='), Field(fld3,false)}" +match("MESSAGE#127:sendmail:01", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: available mech=%{fld2}, allowed mech=%{fld3}", processor_chain([ + dup17, + dup9, +])); + +var msg128 = msg("sendmail:01", part110); + +var part111 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': milter='), Field(fld2,false), Constant(', action='), Field(action,false), Constant(', reject='), Field(fld3,false)}" +match("MESSAGE#128:sendmail:02", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: milter=%{fld2}, action=%{action}, reject=%{fld3}", processor_chain([ + dup17, + dup9, +])); + +var msg129 = msg("sendmail:02", part111); + +var part112 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': '), Field(fld57,false), Constant(': host='), Field(hostname,false), Constant(', addr='), Field(saddr,false), Constant(', reject='), Field(fld3,false)}" +match("MESSAGE#129:sendmail:03", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}: host=%{hostname}, addr=%{saddr}, reject=%{fld3}", processor_chain([ + dup17, + dup9, +])); + +var msg130 = msg("sendmail:03", part112); + +var part113 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': '), Field(fld2,false), Constant(': '), Field(fld3,false), Constant(': vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" +match("MESSAGE#130:sendmail:08", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ + dup17, + dup9, +])); + +var msg131 = msg("sendmail:08", part113); + +var part114 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': '), Field(fld2,false), Constant(': '), Field(fld3,false), Constant(': rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" +match("MESSAGE#131:sendmail:09", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} suspectscore=%{fld41->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ + dup17, + dup9, +])); + +var msg132 = msg("sendmail:09", part114); + +var part115 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': rcpt'), Field(p0,false)}" +match("MESSAGE#132:sendmail:10/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: rcpt%{p0}"); + +var part116 = // "Pattern{Constant(': '), Field(p0,false)}" +match("MESSAGE#132:sendmail:10/1_0", "nwparser.p0", ": %{p0}"); + +var part117 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#132:sendmail:10/1_1", "nwparser.p0", "p0"); + +var select44 = linear_select([ + part116, + part117, +]); + +var part118 = // "Pattern{Field(,true), Constant(' '), Field(fld2,false)}" +match("MESSAGE#132:sendmail:10/2", "nwparser.p0", "%{} %{fld2}"); + +var all19 = all_match({ + processors: [ + part115, + select44, + part118, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg133 = msg("sendmail:10", all19); + +var part119 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#133:sendmail:11/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); + +var all20 = all_match({ + processors: [ + part119, + dup58, + dup42, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg134 = msg("sendmail:11", all20); + +var part120 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': SYSERR('), Field(fld2,false), Constant('): '), Field(action,false), Constant(': '), Field(event_description,true), Constant(' from '), Field(from,false), Constant(', from='), Field(fld3,false)}" +match("MESSAGE#134:sendmail:12", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} from %{from}, from=%{fld3}", processor_chain([ + dup17, + dup9, +])); + +var msg135 = msg("sendmail:12", part120); + +var part121 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant(']'), Field(p0,false)}" +match("MESSAGE#135:sendmail:13/0_0", "nwparser.payload", "%{fld10->} %{agent}]%{p0}"); + +var part122 = // "Pattern{Field(agent,false), Constant(']'), Field(p0,false)}" +match("MESSAGE#135:sendmail:13/0_1", "nwparser.payload", "%{agent}]%{p0}"); + +var select45 = linear_select([ + part121, + part122, +]); + +var part123 = // "Pattern{Field(process_id,false), Constant('[: '), Field(fld1,false), Constant(': SYSERR('), Field(fld2,false), Constant('): '), Field(action,false), Constant(': '), Field(event_description,true), Constant(' file '), Field(filename,false), Constant(': '), Field(fld3,false)}" +match("MESSAGE#135:sendmail:13/1", "nwparser.p0", "%{process_id}[: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} file %{filename}: %{fld3}"); + +var all21 = all_match({ + processors: [ + select45, + part123, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg136 = msg("sendmail:13", all21); + +var part124 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': '), Field(fld57,false), Constant(':'), Field(event_description,false)}" +match("MESSAGE#136:sendmail:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}:%{event_description}", processor_chain([ + dup17, + dup9, +])); + +var msg137 = msg("sendmail:04", part124); + +var part125 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(':'), Field(event_description,false)}" +match("MESSAGE#137:sendmail:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}:%{event_description}", processor_chain([ + dup17, + dup9, +])); + +var msg138 = msg("sendmail:05", part125); + +var part126 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: AUTH='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#169:sendmail:06/0", "nwparser.payload", "%{agent}[%{process_id}]: AUTH=%{authmethod}, relay=%{p0}"); + +var part127 = // "Pattern{Field(,false), Constant('authid='), Field(uid,false), Constant(', mech='), Field(scheme,false), Constant(', bits='), Field(fld59,false)}" +match("MESSAGE#169:sendmail:06/2", "nwparser.p0", "%{}authid=%{uid}, mech=%{scheme}, bits=%{fld59}"); + +var all22 = all_match({ + processors: [ + part126, + dup58, + part127, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg139 = msg("sendmail:06", all22); + +var msg140 = msg("sendmail:07", dup61); + +var select46 = linear_select([ + msg125, + msg126, + msg127, + msg128, + msg129, + msg130, + msg131, + msg132, + msg133, + msg134, + msg135, + msg136, + msg137, + msg138, + msg139, + msg140, +]); + +var part128 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' pid='), Field(process_id,true), Constant(' status='), Field(fld29,false)}" +match("MESSAGE#138:info:eid_pid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} pid=%{process_id->} status=%{fld29}", processor_chain([ + dup17, + dup9, +])); + +var msg141 = msg("info:eid_pid_status", part128); + +var part129 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status='), Field(fld29,false)}" +match("MESSAGE#139:info:eid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=%{fld29}", processor_chain([ + dup17, + dup9, +])); + +var msg142 = msg("info:eid_status", part129); + +var part130 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' '), Field(info,false)}" +match("MESSAGE#140:info:eid", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} %{info}", processor_chain([ + dup17, + dup9, +])); + +var msg143 = msg("info:eid", part130); + +var msg144 = msg("info:pid", dup62); + +var part131 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(p0,false)}" +match("MESSAGE#143:info/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{p0}"); + +var part132 = // "Pattern{Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ofrom='), Field(from,false)}" +match("MESSAGE#143:info/1_0", "nwparser.p0", "%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ofrom=%{from}"); + +var part133 = // "Pattern{Field(sessionid1,true), Constant(' status='), Field(info,true), Constant(' restquery_stage='), Field(fld3,false)}" +match("MESSAGE#143:info/1_1", "nwparser.p0", "%{sessionid1->} status=%{info->} restquery_stage=%{fld3}"); + +var part134 = // "Pattern{Field(sessionid1,false)}" +match_copy("MESSAGE#143:info/1_2", "nwparser.p0", "sessionid1"); + +var select47 = linear_select([ + part132, + part133, + part134, +]); + +var all23 = all_match({ + processors: [ + part131, + select47, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg145 = msg("info", all23); + +var part135 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sys='), Field(fld1,true), Constant(' evt='), Field(action,true), Constant(' active='), Field(fld2,true), Constant(' expires='), Field(fld3,true), Constant(' msg='), Field(event_description,false)}" +match("MESSAGE#144:info:02", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{action->} active=%{fld2->} expires=%{fld3->} msg=%{event_description}", processor_chain([ + dup17, + dup9, +])); + +var msg146 = msg("info:02", part135); + +var part136 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' server='), Field(saddr,true), Constant(' elapsed='), Field(duration_string,true), Constant(' avgtime='), Field(fld2,true), Constant(' qname='), Field(fld3,true), Constant(' qtype='), Field(fld4,false)}" +match("MESSAGE#145:info:03", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} server=%{saddr->} elapsed=%{duration_string->} avgtime=%{fld2->} qname=%{fld3->} qtype=%{fld4}", processor_chain([ + dup17, + dup9, +])); + +var msg147 = msg("info:03", part136); + +var part137 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" +match("MESSAGE#146:info:01", "nwparser.payload", "%{fld0->} %{severity->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ + dup17, + dup9, +])); + +var msg148 = msg("info:01", part137); + +var part138 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sys='), Field(fld1,true), Constant(' evt='), Field(p0,false)}" +match("MESSAGE#147:info:04/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{p0}"); + +var part139 = // "Pattern{Field(action,true), Constant(' msg='), Field(event_description,false)}" +match("MESSAGE#147:info:04/1_0", "nwparser.p0", "%{action->} msg=%{event_description}"); + +var part140 = // "Pattern{Field(action,false)}" +match_copy("MESSAGE#147:info:04/1_1", "nwparser.p0", "action"); + +var select48 = linear_select([ + part139, + part140, +]); + +var all24 = all_match({ + processors: [ + part138, + select48, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg149 = msg("info:04", all24); + +var part141 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#148:info:05/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} %{p0}"); + +var part142 = // "Pattern{Constant('type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" +match("MESSAGE#148:info:05/1_0", "nwparser.p0", "type=%{fld6->} cmd=%{obj_type->} id=%{fld5}"); + +var part143 = // "Pattern{Constant('cmd='), Field(obj_type,false)}" +match("MESSAGE#148:info:05/1_1", "nwparser.p0", "cmd=%{obj_type}"); + +var select49 = linear_select([ + part142, + part143, +]); + +var all25 = all_match({ + processors: [ + part141, + select49, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg150 = msg("info:05", all25); + +var select50 = linear_select([ + msg141, + msg142, + msg143, + msg144, + msg145, + msg146, + msg147, + msg148, + msg149, + msg150, +]); + +var msg151 = msg("note:pid", dup62); + +var part144 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' module='), Field(agent,true), Constant(' action='), Field(action,true), Constant(' size='), Field(bytes,false)}" +match("MESSAGE#149:note:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} module=%{agent->} action=%{action->} size=%{bytes}", processor_chain([ + dup17, + dup9, +])); + +var msg152 = msg("note:01", part144); + +var select51 = linear_select([ + msg151, + msg152, +]); + +var part145 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' secprofile_name='), Field(fld3,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#150:rprt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} secprofile_name=%{fld3->} rcpts=%{dclass_counter2->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var msg153 = msg("rprt", part145); + +var part146 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' module='), Field(agent,true), Constant(' age='), Field(fld6,true), Constant(' limit='), Field(fld31,false)}" +match("MESSAGE#151:err", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} module=%{agent->} age=%{fld6->} limit=%{fld31}", processor_chain([ + dup17, + dup9, +])); + +var msg154 = msg("err", part146); + +var part147 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' eid='), Field(fld4,true), Constant(' result='), Field(result,false)}" +match("MESSAGE#152:warn", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} eid=%{fld4->} result=%{result}", processor_chain([ + dup17, + dup9, +])); + +var msg155 = msg("warn", part147); + +var part148 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status="'), Field(event_state,true), Constant(' file: '), Field(filename,false), Constant('"')}" +match("MESSAGE#153:warn:01", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file: %{filename}\"", processor_chain([ + dup17, + dup9, +])); + +var msg156 = msg("warn:01", part148); + +var part149 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status="'), Field(event_state,true), Constant(' file '), Field(filename,true), Constant(' does not contain enough (or correct) info. Fix this or remove the file."')}" +match("MESSAGE#154:warn:02", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file %{filename->} does not contain enough (or correct) info. Fix this or remove the file.\"", processor_chain([ + dup17, + dup9, + setc("event_description","does not contain enough (or correct) info. Fix this or remove the file"), +])); + +var msg157 = msg("warn:02", part149); + +var select52 = linear_select([ + msg155, + msg156, + msg157, +]); + +var msg158 = msg("queued-aglife", dup68); + +var msg159 = msg("pdr_run", dup50); + +var part150 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' ttl='), Field(fld1,true), Constant(' reply="'), Field(p0,false)}" +match("MESSAGE#157:pdr_ttl/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} ttl=%{fld1->} reply=\"%{p0}"); + +var part151 = // "Pattern{Constant('\"'), Field(fld2,true), Constant(' rscore='), Field(fld3,false), Constant('\""')}" +match("MESSAGE#157:pdr_ttl/1_0", "nwparser.p0", "\\\"%{fld2->} rscore=%{fld3}\\\"\""); + +var part152 = // "Pattern{Field(fld2,false), Constant('"')}" +match("MESSAGE#157:pdr_ttl/1_1", "nwparser.p0", "%{fld2}\""); + +var select53 = linear_select([ + part151, + part152, +]); + +var all26 = all_match({ + processors: [ + part150, + select53, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var msg160 = msg("pdr_ttl", all26); + +var part153 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' signature='), Field(fld1,true), Constant(' identity='), Field(sigid_string,true), Constant(' host='), Field(hostname,true), Constant(' result='), Field(result,true), Constant(' result_detail='), Field(fld2,false)}" +match("MESSAGE#158:dkimv_run:signature", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} signature=%{fld1->} identity=%{sigid_string->} host=%{hostname->} result=%{result->} result_detail=%{fld2}", processor_chain([ + dup17, + dup9, +])); + +var msg161 = msg("dkimv_run:signature", part153); + +var part154 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' status="'), Field(info,false), Constant(', '), Field(event_state,false), Constant('"')}" +match("MESSAGE#159:dkimv_run:status", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=\"%{info}, %{event_state}\"", processor_chain([ + dup17, + dup9, +])); + +var msg162 = msg("dkimv_run:status", part154); + +var select54 = linear_select([ + msg161, + msg162, +]); + +var part155 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' unexpected response type='), Field(fld1,false)}" +match("MESSAGE#160:dkimv_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} unexpected response type=%{fld1}", processor_chain([ + dup17, + dup9, + setc("result","unexpected response"), +])); + +var msg163 = msg("dkimv_type", part155); + +var part156 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' publickey_cache_entries='), Field(fld6,false)}" +match("MESSAGE#161:dkimv_type:01", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} publickey_cache_entries=%{fld6}", processor_chain([ + dup17, + dup9, +])); + +var msg164 = msg("dkimv_type:01", part156); + +var select55 = linear_select([ + msg163, + msg164, +]); + +var msg165 = msg("dmarc_run:rule", dup49); + +var part157 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' result='), Field(result,true), Constant(' result_detail='), Field(fld2,false)}" +match("MESSAGE#163:dmarc_run:result", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} result=%{result->} result_detail=%{fld2}", processor_chain([ + dup17, + dup9, +])); + +var msg166 = msg("dmarc_run:result", part157); + +var select56 = linear_select([ + msg165, + msg166, +]); + +var part158 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' policy_cache_entries='), Field(fld6,false)}" +match("MESSAGE#164:dmarc_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} policy_cache_entries=%{fld6}", processor_chain([ + dup17, + dup9, +])); + +var msg167 = msg("dmarc_type", part158); + +var msg168 = msg("spf_run:rule", dup49); + +var part159 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cmd='), Field(obj_type,true), Constant(' result='), Field(result,false)}" +match("MESSAGE#166:spf_run:cmd", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cmd=%{obj_type->} result=%{result}", processor_chain([ + dup17, + dup9, +])); + +var msg169 = msg("spf_run:cmd", part159); + +var select57 = linear_select([ + msg168, + msg169, +]); + +var part160 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' suspectscore='), Field(fld41,true), Constant(' malwarescore='), Field(fld49,true), Constant(' phishscore='), Field(fld42,true), Constant(' adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' tests='), Field(fld52,false)}" +match("MESSAGE#167:action_checksubmsg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} suspectscore=%{fld41->} malwarescore=%{fld49->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} tests=%{fld52}", processor_chain([ + dup17, + dup9, +])); + +var msg170 = msg("action_checksubmsg", part160); + +var part161 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' authscope='), Field(fld5,true), Constant(' err='), Field(fld58,false)}" +match("MESSAGE#168:rest_oauth", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} authscope=%{fld5->} err=%{fld58}", processor_chain([ + dup17, + dup9, +])); + +var msg171 = msg("rest_oauth", part161); + +var part162 = // "Pattern{Constant('mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(id,true), Constant(' load smartid ccard')}" +match("MESSAGE#171:filter_instance1:01", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid ccard", processor_chain([ + dup17, + dup9, + setc("event_description","load smartid ccard"), + dup36, +])); + +var msg172 = msg("filter_instance1:01", part162); + +var part163 = // "Pattern{Constant('mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(id,true), Constant(' load smartid jcb')}" +match("MESSAGE#172:filter_instance1:02", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid jcb", processor_chain([ + dup17, + dup9, + setc("event_description","load smartid jcb"), + dup36, +])); + +var msg173 = msg("filter_instance1:02", part163); + +var part164 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject="'), Field(subject,false), Constant('" '), Field(p0,false)}" +match("MESSAGE#173:filter_instance1:03/0", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=\"%{subject}\" %{p0}"); + +var part165 = // "Pattern{Constant('spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(p0,false)}" +match("MESSAGE#173:filter_instance1:03/1_0", "nwparser.p0", "spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{p0}"); + +var part166 = // "Pattern{Constant('duration='), Field(p0,false)}" +match("MESSAGE#173:filter_instance1:03/1_1", "nwparser.p0", "duration=%{p0}"); + +var select58 = linear_select([ + part165, + part166, +]); + +var part167 = // "Pattern{Field(fld16,true), Constant(' elapsed='), Field(duration_string,false)}" +match("MESSAGE#173:filter_instance1:03/2", "nwparser.p0", "%{fld16->} elapsed=%{duration_string}"); + +var all27 = all_match({ + processors: [ + part164, + select58, + part167, + ], + on_success: processor_chain([ + dup11, + dup9, + dup12, + dup13, + dup36, + ]), +}); + +var msg174 = msg("filter_instance1:03", all27); + +var part168 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" +match("MESSAGE#174:filter_instance1:04", "nwparser.payload", "s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ + dup17, + dup9, + dup13, + dup36, +])); + +var msg175 = msg("filter_instance1:04", part168); + +var part169 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' header.from="\"'), Field(info,false), Constant('\" '), Field(fld4,true), Constant(' <<'), Field(user_address,false), Constant('>"')}" +match("MESSAGE#175:filter_instance1:05", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} header.from=\"\\\"%{info}\\\" %{fld4->} \u003c\u003c%{user_address}>\"", processor_chain([ + dup17, + dup9, + dup36, +])); + +var msg176 = msg("filter_instance1:05", part169); + +var part170 = tagval("MESSAGE#176:filter_instance1", "nwparser.payload", tvm, { + "X-Proofpoint-Spam-Details": "fld71", + "a": "fld12", + "action": "action", + "active": "fld2", + "addr": "saddr", + "adjust": "fld46", + "adjustscore": "fld54", + "adultscore": "fld44", + "alert": "fld53", + "attachments": "fld80", + "avgtime": "fld2", + "bulkscore": "fld43", + "cipher": "s_cipher", + "cipher_bits": "fld59", + "classifier": "fld45", + "cmd": "obj_type", + "corrupted": "fld9", + "country": "location_country", + "data_notroutes": "fld32", + "data_routes": "fld31", + "definitions": "fld50", + "delegate-for": "fld5", + "dict": "fld87", + "dkimresult": "fld65", + "duration": "duration_string", + "elapsed": "duration_string", + "engine": "fld49", + "evt": "action", + "expires": "fld3", + "file": "filename", + "from": "from", + "guid": "fld14", + "hdr_mid": "id", + "header-size": "bytes", + "header.from": "fld40", + "helo": "fld32", + "hops-ip": "fld61", + "hops_active": "fld26", + "host": "hostname", + "id": "id", + "install_dir": "directory", + "instance": "fld90", + "ip": "hostip", + "ksurl": "fld7", + "lint": "fld33", + "lip": "fld24", + "m": "mail_id", + "malwarescore": "fld41", + "maxfd": "fld91", + "method": "fld37", + "mime": "content_type", + "mlxlogscore": "fld95", + "mlxscore": "fld94", + "mod": "agent", + "module": "event_source", + "msg": "msg", + "msgs": "fld76", + "notroutes": "fld18", + "num_domains": "fld53", + "num_domains_to_lookup": "fld40", + "oext": "fld8", + "omime": "fld7", + "perlwait": "fld27", + "phishscore": "fld42", + "pid": "process_id", + "policy": "fld48", + "policy_cache_entries": "fld6", + "profile": "fld52", + "prot": "fld25", + "protected": "fld10", + "publickey_cache_entries": "fld6", + "qid": "fld15", + "qname": "fld3", + "qtype": "fld4", + "query": "fld38", + "r": "event_counter", + "rcpt": "to", + "rcpt_notroutes": "fld29", + "rcpt_routes": "fld28", + "rcpts": "fld59", + "realm": "fld61", + "reason": "fld47", + "record": "fld39", + "release": "fld92", + "resolve": "fld28", + "result": "result", + "result_detail": "fld74", + "result_record": "fld2", + "reverse": "fld13", + "rewritten": "fld17", + "routes": "fld4", + "rule": "rulename", + "s": "sessionid", + "scancount": "fld18", + "score": "fld39", + "server": "saddr", + "sha256": "checksum", + "sig": "fld60", + "signatures": "fld94", + "size": "bytes", + "smtp.mailfrom": "fld44", + "spamscore": "reputation_num", + "spfresult": "fld68", + "subject": "subject", + "submsgadjust": "fld53", + "suborg": "fld22", + "suspectscore": "fld41", + "sys": "fld1", + "tests": "fld52", + "threshold": "fld11", + "tls": "fld60", + "tls_version": "fld84", + "type": "fld1", + "uid": "uid", + "user": "username", + "value": "context", + "vendor": "fld36", + "verified": "fld3", + "verify": "fld57", + "version": "version", + "virtual": "fld11", + "virusname": "threat_name", + "x": "sessionid1", +}, processor_chain([ + dup17, + dup36, +])); + +var msg177 = msg("filter_instance1", part170); + +var select59 = linear_select([ + msg172, + msg173, + msg174, + msg175, + msg176, + msg177, +]); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "access_load": msg53, + "access_refresh": select21, + "access_run": select20, + "action_checksubmsg": msg170, + "av_init": msg45, + "av_load": msg46, + "av_refresh": msg44, + "av_run": select19, + "batv_run": select25, + "cvt_convert": select27, + "cvt_detect": msg82, + "cvtd": select28, + "cvtd_encrypted": msg85, + "dkimv_run": select54, + "dkimv_type": select55, + "dmarc_run": select56, + "dmarc_type": msg167, + "err": msg154, + "filter": select29, + "filter_instance1": select59, + "http_listen": msg89, + "info": select50, + "mail_attachment": select3, + "mail_continue-system-sendmail": msg18, + "mail_env_from": select5, + "mail_env_rcpt": select2, + "mail_helo": select6, + "mail_msg": select4, + "mail_release": msg19, + "milter_listen": msg91, + "mltr": msg90, + "note": select51, + "pdr_run": msg159, + "pdr_ttl": msg160, + "perl_clone": msg78, + "queued-VoltageEncrypt": select36, + "queued-aglife": msg158, + "queued-alert": select35, + "queued-default": select37, + "queued-eurort": select39, + "queued-reinject": select38, + "queued-vdedc2v5": select40, + "regulation_init": msg54, + "regulation_refresh": msg55, + "rest_oauth": msg171, + "rprt": msg153, + "send": select31, + "sendmail": select46, + "service_refresh": msg77, + "session_connect": select12, + "session_data": select8, + "session_disconnect": select16, + "session_dispose": select15, + "session_headers": select10, + "session_judge": select11, + "session_resolve": select13, + "session_store": select9, + "session_throttle": select14, + "sm-msp-queue": select41, + "smtpsrv": msg95, + "smtpsrv_listen": msg93, + "smtpsrv_load": msg92, + "smtpsrv_run": msg94, + "soap_listen": msg88, + "spam_init": msg66, + "spam_load": msg67, + "spam_refresh": msg65, + "spam_run": select24, + "spf_run": select57, + "warn": select52, + "zerohour_init": msg73, + "zerohour_load": msg74, + "zerohour_refresh": msg72, + "zerohour_run": select26, + }), +]); + +var part171 = // "Pattern{Constant('info'), Field(p0,false)}" +match("HEADER#0:0024/1_0", "nwparser.p0", "info%{p0}"); + +var part172 = // "Pattern{Constant('rprt'), Field(p0,false)}" +match("HEADER#0:0024/1_1", "nwparser.p0", "rprt%{p0}"); + +var part173 = // "Pattern{Constant('warn'), Field(p0,false)}" +match("HEADER#0:0024/1_2", "nwparser.p0", "warn%{p0}"); + +var part174 = // "Pattern{Constant('err'), Field(p0,false)}" +match("HEADER#0:0024/1_3", "nwparser.p0", "err%{p0}"); + +var part175 = // "Pattern{Constant('note'), Field(p0,false)}" +match("HEADER#0:0024/1_4", "nwparser.p0", "note%{p0}"); + +var part176 = // "Pattern{Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" +match("MESSAGE#11:mail_env_from:ofrom/1_0", "nwparser.p0", "%{hostip->} sampling=%{fld19}"); + +var part177 = // "Pattern{Field(hostip,false)}" +match_copy("MESSAGE#11:mail_env_from:ofrom/1_1", "nwparser.p0", "hostip"); + +var part178 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#25:session_judge/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); + +var part179 = // "Pattern{Constant('attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(p0,false)}" +match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); + +var part180 = // "Pattern{Constant('mod='), Field(p0,false)}" +match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); + +var part181 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' version="'), Field(component_version,false), Constant('" duration='), Field(p0,false)}" +match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); + +var part182 = // "Pattern{Field(duration_string,false)}" +match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); + +var part183 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); + +var part184 = // "Pattern{Constant('['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); + +var part185 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant('],'), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); + +var part186 = // "Pattern{Field(dhost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); + +var part187 = // "Pattern{Field(,false), Constant('dsn='), Field(resultcode,false), Constant(', stat='), Field(info,false)}" +match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); + +var part188 = // "Pattern{Constant('['), Field(daddr,false), Constant(']')}" +match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); + +var part189 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant(']')}" +match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); + +var part190 = // "Pattern{Field(dhost,false)}" +match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); + +var part191 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); + +var part192 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); + +var part193 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); + +var part194 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant(']')}" +match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); + +var part195 = // "Pattern{Field(,false), Constant('field='), Field(fld2,false), Constant(', status='), Field(info,false)}" +match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); + +var part196 = // "Pattern{Field(,false), Constant('version='), Field(fld55,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" +match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); + +var part197 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(fld71,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); + +var part198 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" +match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); + +var select60 = linear_select([ + dup1, + dup2, + dup3, + dup4, + dup5, +]); + +var select61 = linear_select([ + dup14, + dup15, +]); + +var select62 = linear_select([ + dup19, + dup20, +]); + +var part199 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" +match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ + dup26, + dup9, +])); + +var part200 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var part201 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" +match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ + dup17, + dup9, +])); + +var part202 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" +match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ + dup17, + dup9, +])); + +var part203 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" +match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ + dup17, + dup9, +])); + +var part204 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" +match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ + dup27, + dup9, +])); + +var part205 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' version='), Field(fld55,false)}" +match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ + dup17, + dup9, +])); + +var part206 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sig='), Field(fld60,false)}" +match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ + dup17, + dup9, +])); + +var part207 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,false)}" +match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ + dup17, + dup9, +])); + +var part208 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' addr='), Field(saddr,false)}" +match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ + dup17, + dup9, +])); + +var select63 = linear_select([ + dup28, + dup29, + dup30, + dup31, +]); + +var select64 = linear_select([ + dup40, + dup33, + dup34, + dup35, +]); + +var part209 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': timeout waiting for input from '), Field(fld11,true), Constant(' during server cmd read')}" +match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ + dup17, + dup9, +])); + +var part210 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(event_description,false)}" +match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ + dup17, + dup9, +])); + +var part211 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" +match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ + dup17, + dup9, +])); + +var all28 = all_match({ + processors: [ + dup38, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var all29 = all_match({ + processors: [ + dup39, + dup59, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var all30 = all_match({ + processors: [ + dup37, + dup58, + dup41, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var all31 = all_match({ + processors: [ + dup37, + dup58, + dup42, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var all32 = all_match({ + processors: [ + dup43, + dup59, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); + +var all33 = all_match({ + processors: [ + dup44, + dup58, + dup32, + ], + on_success: processor_chain([ + dup17, + dup9, + ]), +}); diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml new file mode 100644 index 00000000000..5618f330e7c --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Proofpoint Email Security + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/manifest.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/manifest.yml new file mode 100644 index 00000000000..de5ef117be3 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["proofpoint.emailsecurity", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9531 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log new file mode 100644 index 00000000000..2c98612c595 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log @@ -0,0 +1,100 @@ +January 29 06:09:59 avolupt low mod=perl cmd=clone cmd=olab id=nto duration=sse +2016/02/12T13:12:33.umdo itessequ session_store[vol]: info luptat high s=nibus mod=mipsumq cmd=gnaali module=enatus rule=mquia folder=ameaqu pri=aqu duration=utper +February 26 20:15:08 emape low s=incidi mod=session_connect cmd=nse ip=10.46.185.46 country=temvel lip=iatu prot=serror hops_active=anti routes=ofdeF notroutes=metcons perlwait=roinBCS +2016/03/12T03:17:42.iam mqua queued-eurort[3391]: olab: from=mquisnos, size=5771, class=ore, nrcpts=etconsec, msgid=err, proto=rdp, daemon=mUt, tls_verify=usmodte, auth=ele, relay=tenbyCic5882.api.home [10.69.20.77] +March 26 10:20:16 pteursi medium mod=service cmd=refresh cmd=turveli duration=toccae +April 9 17:22:51 ccusan low mod=zerohour type=Ciceroi cmd=refresh id=aveniam version=uradi +April 24 00:25:25 aboreetd high mod=smtpsrv cmd=listen cmd=dun addr=10.89.185.38 +May 8 07:27:59 ctetura medium mod=zerohour type=dolore cmd=init id=abor version=iqui +May 22 14:30:33 ritatis oloremi high s=icab mod=av_run cmd=mwr rule=fugi name=inculpaq cleaned=agna vendor=tionemu duration=eomnisis +2016/06/05T21:33:08.incidi picia queued-reinject[mUtenima]: warn emaperi[7183]: sumquiad: from=dexeaco, size=6178, class=colabor, nrcpts=iusmodt, msgid=etdolo, proto=tcp, daemon=lorumw, relay=ommod3671.mail.domain +June 20 04:35:42 imadmi high s=tion mod=session_judge cmd=eataev module=liquide rule=uasia +2016/07/04T11:38:16.uames tati access_run[utaliqu]: warn oriosamn medium s=santium m=iciatisu x=rehender mod=eporroqu cmd=uat rule=tem duration=est +July 18 18:40:50 samvolu err eid=ittenbyC module=isc age=aturve limit=emulla +2016/08/02T01:43:25.itame eumfug zerohour_init[lit]: note asun low mod=quamnih type=oluptate cmd=onseq id=serunt version=aquaeabi +August 16 08:45:59 ento warn eid=pic status="evita file suntexp does not contain enough (or correct) info. Fix this or remove the file." +August 30 15:48:33 tmo very-high s=abi mod=spam_run cmd=sectetur rule=uioffi policy=oru score=temqu ndrscore=edol ipscore=colab suspectscore=ommodico phishscore=quatD bulkscore=mcolab spamscore=67.309000 adjustscore=tenima adultscore=tsedqu classifier=agnid adjust=proide reason=dolorem scancount=tlab engine=volupt definitions=osqui raw=xerc tests=iutali duration=fdeFi +2016/09/13T22:51:07.sequine ectio dkimv_type[dutper]: err lamcolab: low mod=radi unexpected response type=gel +September 28 05:53:42 xeacomm very-high mod=av type=aturQui cmd=load id=utlabor +October 12 12:56:16 madmi tur low s=uatD mod=mail_attachment cmd=ariatu id=edquiac file=nci mime=tev type=saute omime=ntocca oext=ostru corrupted=ntoccae protected=autf size=3471 virtual=temquiav +2016/10/26T19:58:50.tor qui queued-aglife[4499]: eavolup: to=fugiatn, delay=docon, xdelay=etconsec, mailer=ios, pri=evolu, relay=ersp3536.www5.lan, dsn=sauteiru, stat=mod +2016/11/10T03:01:24.iquipe itempor mail_env_rcpt[quin]: err upida high s=nve m=remag x=uredol mod=ccaecat cmd=tquiin r=7440 value=temqu verified=ovol routes=ptasn +November 24 10:03:59 idolore low mod=spam type=eetdolo cmd=refresh id=cteturad engine=untut definitions=uamni +December 8 17:06:33 orumSe high mod=regulation type=isnost cmd=init id=queips action=cancel dict=itess file=iscinge +2016-12-23T12:09:07.inci atatn queued-alert[temUt]: info avol[752]: STARTTLS=essequam, relay=[10.193.83.81], version=1.5020, verify=str, cipher=iat, bits=etur +2017/01/06T07:11:41.isnostr umqu smtpsrv_run[tinv]: warn adipisc medium mod=isnisi cmd=ritatise rule=uamei duration=siut +2017/01/20T14:14:16.ttenby boris dkimv_run[stenatu]: err isiuta low s=ratv m=riat x=ianon mod=tsed cmd=nts status="siut, tconsect" +2017/02/03T21:16:50.ctetura aveni sendmail[elit]: note seosqui sequamni[3866]: STARTTLS=tdol, relay=sit6590.lan [10.123.143.188], version=ncididun, verify=umSe, cipher=xeacomm, bits=cinge +February 18 04:19:24 runtmol very-high mod=spam type=odi cmd=load id=ptass +March 4 11:21:59 aec medium mod=spam type=iduntu cmd=load id=ccaeca +March 18 18:24:33 leumiu tla very-high s=uaeratv mod=session_connect cmd=isa ip=10.38.65.236 country=dqu lip=pid prot=rExc hops_active=iusmo routes=tame notroutes=naaliq perlwait=nte +2017/04/02T01:27:07.ullamcor itationu dmarc_run[proident]: rprt maliquam medium s=atione m=lores x=ritati mod=orisni cmd=ons rule=remagn duration=ecillu +April 16 08:29:41 umetMalo high mod=av type=utp cmd=refresh id=aeconseq vendor=lor engine=Sedut definitions=yCiceroi signatures=quunt +April 30 15:32:16 aliq low mod=access type=teni cmd=refresh id=dquiac action=accept dict=tore file=elits +2017/05/14T22:34:50.uamnihi risnis mail_release[uov]: info itlab low s=sBono m=loremqu x=tetur mod=amvo cmd=siuta status=failure err=ommodo +May 29 05:37:24 atv high mod=access type=quira cmd=refresh id=rehende action=block dict=obeataev file=tempor +June 12 12:39:58 tlaboree note s=norumet m=dtempo x=tin module=fugitse action=deny size=3916 +2017/06/26T19:42:33.aturQu aaliq session_store[mipsamvo]: warn eiusmod very-high s=reetdo m=oreveri x=ehende mod=eaqueip cmd=eum module=lamc rule=umetMal folder=asper pri=umq duration=naal +2017/07/11T02:45:07.uto iuntNequ pdr_ttl[esseq]: warn aincidun low s=veniamq mod=occ ttl=oloreseo reply="\"iruredol rscore=veniamqu\"" +July 25 09:47:41 minim ataevi low s=repreh mod=av_run cmd=plic rule=irured name=illumqui cleaned=saq vendor=amali duration=ate +2017/08/08T16:50:15.autfugi tasun mail_continue-system-sendmail[duntutla]: err ntium low s=asuntexp mod=adminim cmd=orisni action=cancel err=lmole +2017/08/22T23:52:50.dolorem tem spam_init[exeacomm]: info aspe very-high mod=mides type=ciun cmd=olupta id=tsuntinc engine=inrepreh definitions=quovo +September 6 06:55:24 occaec acommodi medium s=quaeab mod=mail_env_rcpt cmd=fici r=5161 value=dipiscin verified=olup routes=aco +2017/09/20T13:57:58.mag tob smtpsrv_load[dolores]: rprt equamnih high mod=deF type=itempo cmd=orumw id=redol +October 4 21:00:32 radipis high s=tiumto mod=mail_env_from cmd=litan value=nder qid=stenatus tls=equep routes=ever notroutes=tali host=BCS3474.lan ip=10.1.204.187 sampling=quin +2017/10/19T04:03:07.nculpaq culpaqui regulation_init[tvolup]: note tdolore low mod=col type=obea cmd=emp id=agnaaliq action=cancel dict=uptatem file=oinv +queued-reinject[2957]: odt +2017/11/16T18:08:15.caecat rautod rprt[olest]: info eataev very-high s=ritati m=edquia x=itesse mod=mullam cmd=mexerc secprofile_name=meaque rcpts=5808 duration=mip +2017/12/01T01:10:49.deriti sintocc session_throttle[cididu]: rprt uteir high s=mwrit mod=ptat cmd=der rule=equuntur ip=10.219.133.187 rate=quameiu crate=diduntu limit=eiusmod +December 15 08:13:24 tassita very-high mod=smtpsrv cmd=run cmd=oremi rule=ugitsedq duration=turmag +2017/12/29T15:15:58.consecte pteurs dkimv_run[catcupi]: info autf very-high s=tiaecon m=uaturve x=amquisno mod=uido cmd=tla signature=mquiad identity=CSe host=lors7553.api.local result=unknown result_detail=rroqui +2018/01/12T22:18:32.itae dtempo cvtd[atnula]: warn ditautf low mod=iquidex cmd=olup +2018/01/27T05:21:06.rspici snisi queued-aglife[766]: olor: to=etquasia, delay=nula, xdelay=quiacons, mailer=uisa, pri=xeacommo, relay=[10.65.174.31], dsn=atur, stat=issu +2018/02/10T12:23:41.ite tasnul note[tuserr]: note tise very-high s=tnul m=expl x=ess module=quiad action=cancel size=6084 +2018/02/24T19:26:15.llumq tenim spam_init[eiusmo]: warn ainc medium mod=antiumdo type=ecill cmd=iduntu id=pisci engine=sunt definitions=texplica +March 11 02:28:49 ate action_checksubmsg s=con m=tqu x=eirur action=accept score=tametco submsgadjust=mquisnos spamscore=25.933000 suspectscore=cit malwarescore=siar phishscore=isn adultscore=veniamq bulkscore=lup tests=iumtotam +2018/03/25T09:31:24.voluptas velill regulation_init[rspic]: err orinrepr high mod=meum type=borumSec cmd=aecatcup id=snisiut action=allow dict=nre file=inB +2018/04/08T16:33:58.upt ulamc cvt_detect[cept]: err aedictas low pid=4253 mod=orio cmd=gna name=ici status=success err=olu +2018/04/22T23:36:32.seq moll queued-VoltageEncrypt[2861]: sunt: from=dquianon, size=956, class=itesse, nrcpts=iamqui, msgid=quide, proto=igmp, daemon=cididun, relay=str4641.domain [10.151.31.58] +2018/05/07T06:39:06.cti rumSecti session_throttle[riamea]: info eca very-high s=tes mod=equam cmd=isi rule=iaecon ip=10.119.38.124 rate=rep crate=remap limit=deri +May 21 13:41:41 scipit high pid=745 mod=cvt cmd=detect cmd=borisnis name=onorumet status=success err=isiutali +June 4 20:44:15 aedict low mod=cvtd cmd=miurere +2018/06/19T03:46:49.seq rumSe queued-vdedc2v5[tatnonp]: rprt ommo[4821]: idunt: to=expl, delay=olore, xdelay=uian, mailer=atuserro, pri=madminim, relay=[10.52.47.230] [10.113.119.47], dsn=quioff, stat=iuntN +2018/07/03T10:49:23.mquis lorsi filter[tetura]: rprt eeufug high mod=modt sig=iduntutl +July 17 17:51:58 expl very-high pid=prehende mod=cvtd cmd=encrypted encrypted=lup +August 1 00:54:32 umd sumd medium s=dat mod=session_judge cmd=aUtenima module=turQuis rule=taevi +2018/08/15T07:57:06.ercitati eve spf_run[rro]: err oeiusmo very-high s=cusanti m=tconse x=rem mod=tseddoei cmd=teursint rule=etMa duration=llita +2018/08/29T14:59:40.nostrum orroquis av_init[eumi]: info tvo low mod=tuser type=mmo cmd=eve id=nbyCicer vendor=scipit engine=equuntu definitions=quamni signatures=turveli +September 12 22:02:15 ihilm medium s=caboNemo mod=mltr uptas +2018/09/27T05:04:49.dol exe info[tis]: note oluptat low eid=tinvolup pid=497 status=tvol +October 11 12:07:23 eritqui medium s=atus mod=session_judge cmd=tassitas module=obea rule=velite +2018/10/25T19:09:57.lore luptate av_init[eritqu]: err elites very-high mod=tamr type=serr cmd=usci id=unturmag vendor=dexeaco engine=lupta definitions=ura signatures=oreeufug +2018/11/09T02:12:32.ree itten milter_listen[quipexea]: warn orsitv medium mod=nostrum cmd=autodita addr=10.27.154.247 +2018/11/23T09:15:06.utfugi ursintoc dkimv_type[tio]: rprt mmodicon: high mod=trudex unexpected response type=tvol +2018/12/07T16:17:40.rehen uaeab session_throttle[ptat]: warn mipsu high s=eturadip mod=amquaera cmd=rsitamet rule=leumiur ip=10.253.121.154 rate=olesti crate=edquia limit=ihi +December 21 23:20:14 emoenimi high pid=5895 mod=cvt cmd=detect cmd=mqu name=onorume status=unknown err=veleu +January 5 06:22:49 dquia high s=bori mod=mltr dipi +January 19 13:25:23 quovolu high s=dexe mod=mltr nemul +2019/02/02T20:27:57.quatur dminim mail_msg[ptatevel]: warn aperiame very-high s=eirured mod=sequamn cmd=perspici module=inimve rule=aea action=allow attachments=5821 rcpts=296 routes=ptat size=4878 guid=nde hdr_mid=quame qid=orumwri subject=atisu spamscore=66.849000 virusname=tse duration=rad elapsed=iat +2019/02/17T03:30:32.lorum suntexpl sm-msp-queue[iqu]: rprt iquamqu[6293]: audant: to=obeata, ctladdr=uredol, delay=uptat, xdelay=toditau, mailer=uiad, pri=nvolupta, relay=[10.80.133.120] [10.147.147.248], dsn=onpr, stat=uira +2019/03/03T10:33:06.aliqu sequine regulation_refresh[utaliqui]: note isciv very-high mod=econ type=aborio cmd=rve id=catcup action=deny dict=runtmoll file=busBon +2019/03/17T17:35:40.occaeca dan queued-alert[pta]: err upt[4762]: itaedict: to=eroi, delay=onemull, xdelay=mdo, mailer=labore, pri=lorem, relay=[10.68.159.207] [10.232.240.177], dsn=estq, stat=quasiarc +2019/04/01T00:38:14.tDuisaut uel warn[dexerc]: info vol high eid=agn status="iqu file: quamqua" +April 15 07:40:49 uunturm very-high mod=regulation type=iaconseq cmd=init id=tseddo action=cancel dict=rissusci file=ectetur +April 29 14:43:23 quaturve medium mod=zerohour type=gnamali cmd=init id=iumtota version=issusci +2019/05/13T21:45:57.ecillumd iumto dmarc_type[sequatu]: rprt tiumtot: medium mod=mdoloree type=que cmd=inBCSed id=cteturad policy_cache_entries=umq +May 28 04:48:31 reseo quam very-high s=pariat mod=mail_env_rcpt cmd=icaboNe r=4840 value=lumd verified=tiaec routes=lorem +June 11 11:51:06 seq low mod=info sys=lorsita evt=deny active=itation expires=utlabo msg=tat +June 25 18:53:40 ididu medium s=epteurs mod=mail_env_from cmd=itse value=rever ofrom=sBonoru qid=ecatcu tls=ntoccae routes=iscive notroutes=amni host=etconse5657.api.lan ip=10.118.249.126 sampling=dminimv +2019/07/10T01:56:14.rep nostru access_load[docons]: info emipsumq low mod=qua type=modit cmd=tatione id=aedicta +July 24 08:58:48 uas high s=reeufu mod=mail_env_from cmd=umexe value=xce ofrom=omnisis qid=corporis tls=tco routes=stiaec notroutes=Cicero host=ven5410.mail.host ip=10.170.55.203 sampling=deom +2019/08/07T16:01:23.Utenima nse info[umq]: note enim low mod=meaquei sys=snisiu evt=allow active=atev expires=vento msg=litsed +August 21 23:03:57 susc taed high s=mipsumd mod=mail_continue-system-sendmail cmd=eiusmo action=block err=sum +September 5 06:06:31 ipex low s=upta cmd=send profile=ivel qid=tmollita rcpts=tionofd +2019/09/19T13:09:05.ccaec repreh http_listen[imven]: note usan very-high mod=idolo cmd=olup addr=10.199.46.88 +2019/10/03T20:11:40.nulapari beataevi queued-VoltageEncrypt[3274]: eruntmol: from=plicab, size=5930, class=dmin, nrcpts=sum, msgid=lloinve, proto=ggp, daemon=nim, relay=Sedutper7794.www5.domain [10.154.22.241] +2019/10/18T03:14:14.nvol doloreeu cvtd_encrypted[elillumq]: info loremeum medium pid=obeataev mod=rrorsit encrypted=aincid +November 1 10:16:48 nis info pid=472 iin /uteiru: xer +2019/11/15T17:19:22.isauteir eritquii soap_listen[atevelit]: note dese low mod=ionula cmd=itaed addr=10.38.111.125 +November 30 00:21:57 ationem high mod=spam type=ing cmd=load id=ollita +2019/12/14T07:24:31.nih ncididu queued-default[4250]: STARTTLS=gitsed, relay=estla4081.corp, version=meumf, verify=rExce, cipher=quisquam, bits=boreet diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json new file mode 100644 index 00000000000..ea2fb8b7304 --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json @@ -0,0 +1,2545 @@ +[ + { + "event.code": "perl_clone", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "January 29 06:09:59 avolupt low mod=perl cmd=clone cmd=olab id=nto duration=sse", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 0, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "perl_clone", + "rsa.misc.client": "perl", + "rsa.misc.msgIdPart1": "perl", + "rsa.misc.msgIdPart2": "clone", + "rsa.misc.obj_type": "clone cmd=olab", + "rsa.misc.severity": "low", + "rsa.time.duration_str": "sse", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_store", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/02/12T13:12:33.umdo itessequ session_store[vol]: info luptat high s=nibus mod=mipsumq cmd=gnaali module=enatus rule=mquia folder=ameaqu pri=aqu duration=utper", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 80, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_store", + "rsa.misc.client": "mipsumq", + "rsa.misc.event_source": "enatus", + "rsa.misc.log_session_id": "nibus", + "rsa.misc.obj_type": "gnaali", + "rsa.misc.rule_name": "mquia", + "rsa.misc.severity": "high", + "rsa.time.duration_str": "utper", + "rule.name": "mquia", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_connect_nse", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "February 26 20:15:08 emape low s=incidi mod=session_connect cmd=nse ip=10.46.185.46 country=temvel lip=iatu prot=serror hops_active=anti routes=ofdeF notroutes=metcons perlwait=roinBCS", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 244, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_connect_nse", + "rsa.misc.msgIdPart1": "session_connect", + "rsa.misc.msgIdPart2": "nse", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "tenbyCic5882.api.home", + "destination.ip": [ + "10.69.20.77" + ], + "event.code": "err", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/03/12T03:17:42.iam mqua queued-eurort[3391]: olab: from=mquisnos, size=5771, class=ore, nrcpts=etconsec, msgid=err, proto=rdp, daemon=mUt, tls_verify=usmodte, auth=ele, relay=tenbyCic5882.api.home [10.69.20.77]", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 429, + "network.bytes": 5771, + "network.protocol": "rdp", + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 3391, + "related.ip": [ + "10.69.20.77" + ], + "rsa.email.email_src": "mquisnos", + "rsa.internal.messageid": "queued-eurort", + "rsa.misc.client": "queued-eurort", + "rsa.misc.reference_id": "err", + "rsa.network.host_dst": "tenbyCic5882.api.home", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "service_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "March 26 10:20:16 pteursi medium mod=service cmd=refresh cmd=turveli duration=toccae", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 645, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "service_refresh", + "rsa.misc.client": "service", + "rsa.misc.msgIdPart1": "service", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh cmd=turveli", + "rsa.misc.severity": "medium", + "rsa.time.duration_str": "toccae", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "zerohour_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 9 17:22:51 ccusan low mod=zerohour type=Ciceroi cmd=refresh id=aveniam version=uradi", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 730, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "zerohour_refresh", + "rsa.misc.client": "zerohour", + "rsa.misc.msgIdPart1": "zerohour", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "smtpsrv_listen", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 24 00:25:25 aboreetd high mod=smtpsrv cmd=listen cmd=dun addr=10.89.185.38", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 821, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.89.185.38" + ], + "rsa.internal.messageid": "smtpsrv_listen", + "rsa.misc.client": "smtpsrv", + "rsa.misc.msgIdPart1": "smtpsrv", + "rsa.misc.msgIdPart2": "listen", + "rsa.misc.obj_type": "listen cmd=dun", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "source.ip": [ + "10.89.185.38" + ], + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "zerohour_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "May 8 07:27:59 ctetura medium mod=zerohour type=dolore cmd=init id=abor version=iqui", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 902, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "zerohour_init", + "rsa.misc.client": "zerohour", + "rsa.misc.msgIdPart1": "zerohour", + "rsa.misc.msgIdPart2": "init", + "rsa.misc.obj_type": "init", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "May 22 14:30:33 ritatis oloremi high s=icab mod=av_run cmd=mwr rule=fugi name=inculpaq cleaned=agna vendor=tionemu duration=eomnisis", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 987, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_run", + "rsa.misc.client": "av_run", + "rsa.misc.log_session_id": "icab", + "rsa.misc.obj_type": "mwr", + "rsa.misc.rule_name": "fugi", + "rsa.misc.severity": "high", + "rsa.time.duration_str": "eomnisis", + "rule.name": "fugi", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "ommod3671.mail.domain", + "event.code": "etdolo", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/06/05T21:33:08.incidi picia queued-reinject[mUtenima]: warn emaperi[7183]: sumquiad: from=dexeaco, size=6178, class=colabor, nrcpts=iusmodt, msgid=etdolo, proto=tcp, daemon=lorumw, relay=ommod3671.mail.domain", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 1120, + "network.bytes": 6178, + "network.protocol": "tcp", + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 7183, + "rsa.email.email_src": "dexeaco", + "rsa.internal.messageid": "queued-reinject", + "rsa.misc.client": "emaperi", + "rsa.misc.reference_id": "etdolo", + "rsa.network.host_dst": "ommod3671.mail.domain", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_judge_eataev", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "June 20 04:35:42 imadmi high s=tion mod=session_judge cmd=eataev module=liquide rule=uasia", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 1334, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_judge_eataev", + "rsa.misc.msgIdPart1": "session_judge", + "rsa.misc.msgIdPart2": "eataev", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "access_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/07/04T11:38:16.uames tati access_run[utaliqu]: warn oriosamn medium s=santium m=iciatisu x=rehender mod=eporroqu cmd=uat rule=tem duration=est", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 1425, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "access_run", + "rsa.misc.client": "eporroqu", + "rsa.misc.log_session_id": "santium", + "rsa.misc.log_session_id1": "rehender", + "rsa.misc.mail_id": "iciatisu", + "rsa.misc.obj_type": "uat", + "rsa.misc.rule_name": "tem", + "rsa.misc.severity": "medium", + "rsa.time.duration_str": "est", + "rule.name": "tem", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "err", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "July 18 18:40:50 samvolu err eid=ittenbyC module=isc age=aturve limit=emulla", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "err", + "log.offset": 1573, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "err", + "rsa.misc.client": "isc", + "rsa.misc.severity": "err", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "zerohour_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/08/02T01:43:25.itame eumfug zerohour_init[lit]: note asun low mod=quamnih type=oluptate cmd=onseq id=serunt version=aquaeabi", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 1650, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "zerohour_init", + "rsa.misc.client": "quamnih", + "rsa.misc.obj_type": "onseq", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "warn", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "August 16 08:45:59 ento warn eid=pic status=\"evita file suntexp does not contain enough (or correct) info. Fix this or remove the file.\"", + "file.name": "suntexp", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "warn", + "log.offset": 1780, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "does not contain enough (or correct) info. Fix this or remove the file", + "rsa.internal.messageid": "warn", + "rsa.misc.event_state": "evita", + "rsa.misc.severity": "warn", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_run_sectetur", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "August 30 15:48:33 tmo very-high s=abi mod=spam_run cmd=sectetur rule=uioffi policy=oru score=temqu ndrscore=edol ipscore=colab suspectscore=ommodico phishscore=quatD bulkscore=mcolab spamscore=67.309000 adjustscore=tenima adultscore=tsedqu classifier=agnid adjust=proide reason=dolorem scancount=tlab engine=volupt definitions=osqui raw=xerc tests=iutali duration=fdeFi", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 1917, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_run_sectetur", + "rsa.misc.msgIdPart1": "spam_run", + "rsa.misc.msgIdPart2": "sectetur", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dkimv_type", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/09/13T22:51:07.sequine ectio dkimv_type[dutper]: err lamcolab: low mod=radi unexpected response type=gel", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 2288, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "dkimv_type", + "rsa.misc.client": "radi", + "rsa.misc.result": "unexpected response", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "September 28 05:53:42 xeacomm very-high mod=av type=aturQui cmd=load id=utlabor", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 2398, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_load", + "rsa.misc.client": "av", + "rsa.misc.msgIdPart1": "av", + "rsa.misc.msgIdPart2": "load", + "rsa.misc.obj_type": "load", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_attachment", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "October 12 12:56:16 madmi tur low s=uatD mod=mail_attachment cmd=ariatu id=edquiac file=nci mime=tev type=saute omime=ntocca oext=ostru corrupted=ntoccae protected=autf size=3471 virtual=temquiav", + "file.name": "nci", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 2478, + "network.bytes": 3471, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_attachment", + "rsa.misc.client": "mail_attachment", + "rsa.misc.content_type": "tev", + "rsa.misc.log_session_id": "uatD", + "rsa.misc.obj_type": "ariatu", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "ersp3536.www5.lan", + "event.code": "queued-aglife", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/10/26T19:58:50.tor qui queued-aglife[4499]: eavolup: to=fugiatn, delay=docon, xdelay=etconsec, mailer=ios, pri=evolu, relay=ersp3536.www5.lan, dsn=sauteiru, stat=mod", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 2674, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 4499, + "rsa.db.index": "mod", + "rsa.email.email_dst": "fugiatn", + "rsa.internal.messageid": "queued-aglife", + "rsa.misc.client": "queued-aglife", + "rsa.misc.result_code": "sauteiru", + "rsa.network.host_dst": "ersp3536.www5.lan", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_rcpt", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016/11/10T03:01:24.iquipe itempor mail_env_rcpt[quin]: err upida high s=nve m=remag x=uredol mod=ccaecat cmd=tquiin r=7440 value=temqu verified=ovol routes=ptasn", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 2845, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.counters.event_counter": 7440, + "rsa.email.email_dst": "temqu", + "rsa.internal.messageid": "mail_env_rcpt", + "rsa.misc.client": "ccaecat", + "rsa.misc.log_session_id": "nve", + "rsa.misc.log_session_id1": "uredol", + "rsa.misc.mail_id": "remag", + "rsa.misc.obj_type": "tquiin", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "November 24 10:03:59 idolore low mod=spam type=eetdolo cmd=refresh id=cteturad engine=untut definitions=uamni", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 3008, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_refresh", + "rsa.misc.client": "spam", + "rsa.misc.msgIdPart1": "spam", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "regulation_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "December 8 17:06:33 orumSe high mod=regulation type=isnost cmd=init id=queips action=cancel dict=itess file=iscinge", + "file.name": "iscinge", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 3118, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "regulation_init", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.client": "regulation", + "rsa.misc.msgIdPart1": "regulation", + "rsa.misc.msgIdPart2": "init", + "rsa.misc.obj_type": "init", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.193.83.81" + ], + "event.code": "queued-alert", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2016-12-23T12:09:07.inci atatn queued-alert[temUt]: info avol[752]: STARTTLS=essequam, relay=[10.193.83.81], version=1.5020, verify=str, cipher=iat, bits=etur", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 3234, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "observer.version": "1.5020", + "process.pid": 752, + "related.ip": [ + "10.193.83.81" + ], + "rsa.crypto.cipher_src": "iat", + "rsa.internal.messageid": "queued-alert", + "rsa.misc.client": "avol", + "rsa.misc.version": "1.5020", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "smtpsrv_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/01/06T07:11:41.isnostr umqu smtpsrv_run[tinv]: warn adipisc medium mod=isnisi cmd=ritatise rule=uamei duration=siut", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 3393, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "smtpsrv_run", + "rsa.misc.client": "isnisi", + "rsa.misc.obj_type": "ritatise", + "rsa.misc.rule_name": "uamei", + "rsa.misc.severity": "medium", + "rsa.time.duration_str": "siut", + "rule.name": "uamei", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dkimv_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/01/20T14:14:16.ttenby boris dkimv_run[stenatu]: err isiuta low s=ratv m=riat x=ianon mod=tsed cmd=nts status=\"siut, tconsect\"", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 3514, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.db.index": "siut", + "rsa.internal.messageid": "dkimv_run", + "rsa.misc.client": "tsed", + "rsa.misc.event_state": "tconsect", + "rsa.misc.log_session_id": "ratv", + "rsa.misc.log_session_id1": "ianon", + "rsa.misc.mail_id": "riat", + "rsa.misc.obj_type": "nts", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "sit6590.lan", + "destination.ip": [ + "10.123.143.188" + ], + "event.code": "sendmail", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/02/03T21:16:50.ctetura aveni sendmail[elit]: note seosqui sequamni[3866]: STARTTLS=tdol, relay=sit6590.lan [10.123.143.188], version=ncididun, verify=umSe, cipher=xeacomm, bits=cinge", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 3645, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 3866, + "related.ip": [ + "10.123.143.188" + ], + "rsa.internal.messageid": "sendmail", + "rsa.misc.client": "sequamni", + "rsa.network.host_dst": "sit6590.lan", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "February 18 04:19:24 runtmol very-high mod=spam type=odi cmd=load id=ptass", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 3833, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_load", + "rsa.misc.client": "spam", + "rsa.misc.msgIdPart1": "spam", + "rsa.misc.msgIdPart2": "load", + "rsa.misc.obj_type": "load", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "March 4 11:21:59 aec medium mod=spam type=iduntu cmd=load id=ccaeca", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 3908, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_load", + "rsa.misc.client": "spam", + "rsa.misc.msgIdPart1": "spam", + "rsa.misc.msgIdPart2": "load", + "rsa.misc.obj_type": "load", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_connect", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "March 18 18:24:33 leumiu tla very-high s=uaeratv mod=session_connect cmd=isa ip=10.38.65.236 country=dqu lip=pid prot=rExc hops_active=iusmo routes=tame notroutes=naaliq perlwait=nte", + "fileset.name": "emailsecurity", + "geo.country_name": "dqu", + "host.ip": "10.38.65.236", + "input.type": "log", + "log.level": "very-high", + "log.offset": 3976, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.38.65.236" + ], + "rsa.internal.messageid": "session_connect", + "rsa.misc.client": "session_connect", + "rsa.misc.log_session_id": "uaeratv", + "rsa.misc.obj_type": "isa", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dmarc_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/04/02T01:27:07.ullamcor itationu dmarc_run[proident]: rprt maliquam medium s=atione m=lores x=ritati mod=orisni cmd=ons rule=remagn duration=ecillu", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 4159, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "dmarc_run", + "rsa.misc.client": "orisni", + "rsa.misc.log_session_id": "atione", + "rsa.misc.log_session_id1": "ritati", + "rsa.misc.mail_id": "lores", + "rsa.misc.obj_type": "ons", + "rsa.misc.rule_name": "remagn", + "rsa.misc.severity": "medium", + "rsa.time.duration_str": "ecillu", + "rule.name": "remagn", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 16 08:29:41 umetMalo high mod=av type=utp cmd=refresh id=aeconseq vendor=lor engine=Sedut definitions=yCiceroi signatures=quunt", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 4312, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_refresh", + "rsa.misc.client": "av", + "rsa.misc.msgIdPart1": "av", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "access_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 30 15:32:16 aliq low mod=access type=teni cmd=refresh id=dquiac action=accept dict=tore file=elits", + "file.name": "elits", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 4446, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "access_refresh", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.client": "access", + "rsa.misc.msgIdPart1": "access", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_release", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/05/14T22:34:50.uamnihi risnis mail_release[uov]: info itlab low s=sBono m=loremqu x=tetur mod=amvo cmd=siuta status=failure err=ommodo", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 4551, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_release", + "rsa.misc.client": "amvo", + "rsa.misc.log_session_id": "sBono", + "rsa.misc.log_session_id1": "tetur", + "rsa.misc.mail_id": "loremqu", + "rsa.misc.obj_type": "siuta", + "rsa.misc.result": "failure", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "access_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "May 29 05:37:24 atv high mod=access type=quira cmd=refresh id=rehende action=block dict=obeataev file=tempor", + "file.name": "tempor", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 4691, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "access_refresh", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.client": "access", + "rsa.misc.msgIdPart1": "access", + "rsa.misc.msgIdPart2": "refresh", + "rsa.misc.obj_type": "refresh", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "note", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "June 12 12:39:58 tlaboree note s=norumet m=dtempo x=tin module=fugitse action=deny size=3916", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "note", + "log.offset": 4800, + "network.bytes": 3916, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "note", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.client": "fugitse", + "rsa.misc.log_session_id": "norumet", + "rsa.misc.log_session_id1": "tin", + "rsa.misc.mail_id": "dtempo", + "rsa.misc.severity": "note", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_store", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/06/26T19:42:33.aturQu aaliq session_store[mipsamvo]: warn eiusmod very-high s=reetdo m=oreveri x=ehende mod=eaqueip cmd=eum module=lamc rule=umetMal folder=asper pri=umq duration=naal", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 4893, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_store", + "rsa.misc.client": "eaqueip", + "rsa.misc.event_source": "lamc", + "rsa.misc.log_session_id": "reetdo", + "rsa.misc.log_session_id1": "ehende", + "rsa.misc.mail_id": "oreveri", + "rsa.misc.obj_type": "eum", + "rsa.misc.rule_name": "umetMal", + "rsa.misc.severity": "very-high", + "rsa.time.duration_str": "naal", + "rule.name": "umetMal", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "pdr_ttl", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/07/11T02:45:07.uto iuntNequ pdr_ttl[esseq]: warn aincidun low s=veniamq mod=occ ttl=oloreseo reply=\"\\\"iruredol rscore=veniamqu\\\"\"", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 5082, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "pdr_ttl", + "rsa.misc.client": "occ", + "rsa.misc.log_session_id": "veniamq", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "July 25 09:47:41 minim ataevi low s=repreh mod=av_run cmd=plic rule=irured name=illumqui cleaned=saq vendor=amali duration=ate", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 5217, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_run", + "rsa.misc.client": "av_run", + "rsa.misc.log_session_id": "repreh", + "rsa.misc.obj_type": "plic", + "rsa.misc.rule_name": "irured", + "rsa.misc.severity": "low", + "rsa.time.duration_str": "ate", + "rule.name": "irured", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "mail_continue-system-sendmail", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/08/08T16:50:15.autfugi tasun mail_continue-system-sendmail[duntutla]: err ntium low s=asuntexp mod=adminim cmd=orisni action=cancel err=lmole", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 5344, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_continue-system-sendmail", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.client": "adminim", + "rsa.misc.log_session_id": "asuntexp", + "rsa.misc.obj_type": "orisni", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/08/22T23:52:50.dolorem tem spam_init[exeacomm]: info aspe very-high mod=mides type=ciun cmd=olupta id=tsuntinc engine=inrepreh definitions=quovo", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 5491, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_init", + "rsa.misc.client": "mides", + "rsa.misc.obj_type": "olupta", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_rcpt", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "September 6 06:55:24 occaec acommodi medium s=quaeab mod=mail_env_rcpt cmd=fici r=5161 value=dipiscin verified=olup routes=aco", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 5641, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.counters.event_counter": 5161, + "rsa.email.email_dst": "dipiscin", + "rsa.internal.messageid": "mail_env_rcpt", + "rsa.misc.client": "mail_env_rcpt", + "rsa.misc.log_session_id": "quaeab", + "rsa.misc.obj_type": "fici", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "smtpsrv_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/09/20T13:57:58.mag tob smtpsrv_load[dolores]: rprt equamnih high mod=deF type=itempo cmd=orumw id=redol", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 5768, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "smtpsrv_load", + "rsa.misc.client": "deF", + "rsa.misc.obj_type": "orumw", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_from_litan", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "October 4 21:00:32 radipis high s=tiumto mod=mail_env_from cmd=litan value=nder qid=stenatus tls=equep routes=ever notroutes=tali host=BCS3474.lan ip=10.1.204.187 sampling=quin", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 5877, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_env_from_litan", + "rsa.misc.msgIdPart1": "mail_env_from", + "rsa.misc.msgIdPart2": "litan", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "regulation_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/10/19T04:03:07.nculpaq culpaqui regulation_init[tvolup]: note tdolore low mod=col type=obea cmd=emp id=agnaaliq action=cancel dict=uptatem file=oinv", + "file.name": "oinv", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 6054, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "regulation_init", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.client": "col", + "rsa.misc.obj_type": "emp", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "queued-reinject", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "queued-reinject[2957]: odt", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 6208, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 2957, + "rsa.internal.event_desc": "odt", + "rsa.internal.messageid": "queued-reinject", + "rsa.misc.client": "queued-reinject", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "rprt", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/11/16T18:08:15.caecat rautod rprt[olest]: info eataev very-high s=ritati m=edquia x=itesse mod=mullam cmd=mexerc secprofile_name=meaque rcpts=5808 duration=mip", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6235, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.counters.dclass_c2": 5808, + "rsa.internal.messageid": "rprt", + "rsa.misc.client": "mullam", + "rsa.misc.log_session_id": "ritati", + "rsa.misc.log_session_id1": "itesse", + "rsa.misc.mail_id": "edquia", + "rsa.misc.obj_type": "mexerc", + "rsa.misc.severity": "very-high", + "rsa.time.duration_str": "mip", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_throttle", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/12/01T01:10:49.deriti sintocc session_throttle[cididu]: rprt uteir high s=mwrit mod=ptat cmd=der rule=equuntur ip=10.219.133.187 rate=quameiu crate=diduntu limit=eiusmod", + "fileset.name": "emailsecurity", + "host.ip": "10.219.133.187", + "input.type": "log", + "log.level": "high", + "log.offset": 6400, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.219.133.187" + ], + "rsa.internal.messageid": "session_throttle", + "rsa.misc.client": "ptat", + "rsa.misc.log_session_id": "mwrit", + "rsa.misc.obj_type": "der", + "rsa.misc.rule_name": "equuntur", + "rsa.misc.severity": "high", + "rule.name": "equuntur", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "smtpsrv_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "December 15 08:13:24 tassita very-high mod=smtpsrv cmd=run cmd=oremi rule=ugitsedq duration=turmag", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6575, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "smtpsrv_run", + "rsa.misc.client": "smtpsrv", + "rsa.misc.msgIdPart1": "smtpsrv", + "rsa.misc.msgIdPart2": "run", + "rsa.misc.obj_type": "run cmd=oremi", + "rsa.misc.rule_name": "ugitsedq", + "rsa.misc.severity": "very-high", + "rsa.time.duration_str": "turmag", + "rule.name": "ugitsedq", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dkimv_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2017/12/29T15:15:58.consecte pteurs dkimv_run[catcupi]: info autf very-high s=tiaecon m=uaturve x=amquisno mod=uido cmd=tla signature=mquiad identity=CSe host=lors7553.api.local result=unknown result_detail=rroqui", + "fileset.name": "emailsecurity", + "host.name": "lors7553.api.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6674, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "dkimv_run", + "rsa.misc.client": "uido", + "rsa.misc.log_session_id": "tiaecon", + "rsa.misc.log_session_id1": "amquisno", + "rsa.misc.mail_id": "uaturve", + "rsa.misc.obj_type": "tla", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id_str": "CSe", + "rsa.network.alias_host": [ + "lors7553.api.local" + ], + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvtd", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/01/12T22:18:32.itae dtempo cvtd[atnula]: warn ditautf low mod=iquidex cmd=olup", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 6888, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "cvtd", + "rsa.misc.client": "iquidex", + "rsa.misc.obj_type": "olup", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.65.174.31" + ], + "event.code": "queued-aglife", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/01/27T05:21:06.rspici snisi queued-aglife[766]: olor: to=etquasia, delay=nula, xdelay=quiacons, mailer=uisa, pri=xeacommo, relay=[10.65.174.31], dsn=atur, stat=issu", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 6972, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 766, + "related.ip": [ + "10.65.174.31" + ], + "rsa.db.index": "issu", + "rsa.email.email_dst": "etquasia", + "rsa.internal.messageid": "queued-aglife", + "rsa.misc.client": "queued-aglife", + "rsa.misc.result_code": "atur", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "note", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/02/10T12:23:41.ite tasnul note[tuserr]: note tise very-high s=tnul m=expl x=ess module=quiad action=cancel size=6084", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 7142, + "network.bytes": 6084, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "note", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.client": "quiad", + "rsa.misc.log_session_id": "tnul", + "rsa.misc.log_session_id1": "ess", + "rsa.misc.mail_id": "expl", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/02/24T19:26:15.llumq tenim spam_init[eiusmo]: warn ainc medium mod=antiumdo type=ecill cmd=iduntu id=pisci engine=sunt definitions=texplica", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 7264, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_init", + "rsa.misc.client": "antiumdo", + "rsa.misc.obj_type": "iduntu", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "action_checksubmsg", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "March 11 02:28:49 ate action_checksubmsg s=con m=tqu x=eirur action=accept score=tametco submsgadjust=mquisnos spamscore=25.933000 suspectscore=cit malwarescore=siar phishscore=isn adultscore=veniamq bulkscore=lup tests=iumtotam", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "action_checksubmsg", + "log.offset": 7409, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "action_checksubmsg", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.log_session_id": "con", + "rsa.misc.log_session_id1": "eirur", + "rsa.misc.mail_id": "tqu", + "rsa.misc.severity": "action_checksubmsg", + "rsa.web.reputation_num": 25.933, + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "regulation_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/03/25T09:31:24.voluptas velill regulation_init[rspic]: err orinrepr high mod=meum type=borumSec cmd=aecatcup id=snisiut action=allow dict=nre file=inB", + "file.name": "inB", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 7638, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "regulation_init", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.client": "meum", + "rsa.misc.obj_type": "aecatcup", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvt_detect", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/04/08T16:33:58.upt ulamc cvt_detect[cept]: err aedictas low pid=4253 mod=orio cmd=gna name=ici status=success err=olu", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 7794, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 4253, + "rsa.internal.messageid": "cvt_detect", + "rsa.misc.client": "orio", + "rsa.misc.obj_type": "gna", + "rsa.misc.result": "success", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "str4641.domain", + "destination.ip": [ + "10.151.31.58" + ], + "event.code": "quide", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/04/22T23:36:32.seq moll queued-VoltageEncrypt[2861]: sunt: from=dquianon, size=956, class=itesse, nrcpts=iamqui, msgid=quide, proto=igmp, daemon=cididun, relay=str4641.domain [10.151.31.58]", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 7917, + "network.bytes": 956, + "network.protocol": "igmp", + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 2861, + "related.ip": [ + "10.151.31.58" + ], + "rsa.email.email_src": "dquianon", + "rsa.internal.messageid": "queued-VoltageEncrypt", + "rsa.misc.client": "queued-VoltageEncrypt", + "rsa.misc.reference_id": "quide", + "rsa.network.host_dst": "str4641.domain", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_throttle", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/05/07T06:39:06.cti rumSecti session_throttle[riamea]: info eca very-high s=tes mod=equam cmd=isi rule=iaecon ip=10.119.38.124 rate=rep crate=remap limit=deri", + "fileset.name": "emailsecurity", + "host.ip": "10.119.38.124", + "input.type": "log", + "log.level": "very-high", + "log.offset": 8112, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.119.38.124" + ], + "rsa.internal.messageid": "session_throttle", + "rsa.misc.client": "equam", + "rsa.misc.log_session_id": "tes", + "rsa.misc.obj_type": "isi", + "rsa.misc.rule_name": "iaecon", + "rsa.misc.severity": "very-high", + "rule.name": "iaecon", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvt_detect", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "May 21 13:41:41 scipit high pid=745 mod=cvt cmd=detect cmd=borisnis name=onorumet status=success err=isiutali", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 8275, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 745, + "rsa.internal.messageid": "cvt_detect", + "rsa.misc.client": "cvt", + "rsa.misc.msgIdPart1": "cvt", + "rsa.misc.msgIdPart2": "detect", + "rsa.misc.obj_type": "detect cmd=borisnis", + "rsa.misc.result": "success", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvtd", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "June 4 20:44:15 aedict low mod=cvtd cmd=miurere", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 8385, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "cvtd", + "rsa.misc.client": "cvtd", + "rsa.misc.obj_type": "miurere", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.113.119.47" + ], + "event.code": "queued-vdedc2v5", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/06/19T03:46:49.seq rumSe queued-vdedc2v5[tatnonp]: rprt ommo[4821]: idunt: to=expl, delay=olore, xdelay=uian, mailer=atuserro, pri=madminim, relay=[10.52.47.230] [10.113.119.47], dsn=quioff, stat=iuntN", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 8433, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 4821, + "related.ip": [ + "10.113.119.47" + ], + "rsa.db.index": "iuntN", + "rsa.email.email_dst": "expl", + "rsa.internal.messageid": "queued-vdedc2v5", + "rsa.misc.client": "ommo", + "rsa.misc.result_code": "quioff", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "filter", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/07/03T10:49:23.mquis lorsi filter[tetura]: rprt eeufug high mod=modt sig=iduntutl", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 8640, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "filter", + "rsa.misc.client": "modt", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvtd_encrypted", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "July 17 17:51:58 expl very-high pid=prehende mod=cvtd cmd=encrypted encrypted=lup", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 8727, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "cvtd_encrypted", + "rsa.misc.client": "cvtd cmd=encrypted", + "rsa.misc.msgIdPart1": "cvtd", + "rsa.misc.msgIdPart2": "encrypted", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_judge", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "August 1 00:54:32 umd sumd medium s=dat mod=session_judge cmd=aUtenima module=turQuis rule=taevi", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 8809, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_judge", + "rsa.misc.client": "session_judge", + "rsa.misc.event_source": "turQuis", + "rsa.misc.log_session_id": "dat", + "rsa.misc.obj_type": "aUtenima", + "rsa.misc.rule_name": "taevi", + "rsa.misc.severity": "medium", + "rule.name": "taevi", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spf_run", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/08/15T07:57:06.ercitati eve spf_run[rro]: err oeiusmo very-high s=cusanti m=tconse x=rem mod=tseddoei cmd=teursint rule=etMa duration=llita", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 8906, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spf_run", + "rsa.misc.client": "tseddoei", + "rsa.misc.log_session_id": "cusanti", + "rsa.misc.log_session_id1": "rem", + "rsa.misc.mail_id": "tconse", + "rsa.misc.obj_type": "teursint", + "rsa.misc.rule_name": "etMa", + "rsa.misc.severity": "very-high", + "rsa.time.duration_str": "llita", + "rule.name": "etMa", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/08/29T14:59:40.nostrum orroquis av_init[eumi]: info tvo low mod=tuser type=mmo cmd=eve id=nbyCicer vendor=scipit engine=equuntu definitions=quamni signatures=turveli", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 9051, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_init", + "rsa.misc.client": "tuser", + "rsa.misc.obj_type": "eve", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mltr", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "September 12 22:02:15 ihilm medium s=caboNemo mod=mltr uptas", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 9222, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "uptas", + "rsa.internal.messageid": "mltr", + "rsa.misc.client": "mltr", + "rsa.misc.log_session_id": "caboNemo", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "info", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/09/27T05:04:49.dol exe info[tis]: note oluptat low eid=tinvolup pid=497 status=tvol", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 9283, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 497, + "rsa.internal.messageid": "info", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_judge_tassitas", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "October 11 12:07:23 eritqui medium s=atus mod=session_judge cmd=tassitas module=obea rule=velite", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 9372, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "session_judge_tassitas", + "rsa.misc.msgIdPart1": "session_judge", + "rsa.misc.msgIdPart2": "tassitas", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "av_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/10/25T19:09:57.lore luptate av_init[eritqu]: err elites very-high mod=tamr type=serr cmd=usci id=unturmag vendor=dexeaco engine=lupta definitions=ura signatures=oreeufug", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 9469, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "av_init", + "rsa.misc.client": "tamr", + "rsa.misc.obj_type": "usci", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "milter_listen", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/11/09T02:12:32.ree itten milter_listen[quipexea]: warn orsitv medium mod=nostrum cmd=autodita addr=10.27.154.247", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 9644, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.27.154.247" + ], + "rsa.internal.messageid": "milter_listen", + "rsa.misc.client": "nostrum", + "rsa.misc.obj_type": "autodita", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "source.ip": [ + "10.27.154.247" + ], + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dkimv_type", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/11/23T09:15:06.utfugi ursintoc dkimv_type[tio]: rprt mmodicon: high mod=trudex unexpected response type=tvol", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 9762, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "dkimv_type", + "rsa.misc.client": "trudex", + "rsa.misc.result": "unexpected response", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "session_throttle", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2018/12/07T16:17:40.rehen uaeab session_throttle[ptat]: warn mipsu high s=eturadip mod=amquaera cmd=rsitamet rule=leumiur ip=10.253.121.154 rate=olesti crate=edquia limit=ihi", + "fileset.name": "emailsecurity", + "host.ip": "10.253.121.154", + "input.type": "log", + "log.level": "high", + "log.offset": 9876, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.253.121.154" + ], + "rsa.internal.messageid": "session_throttle", + "rsa.misc.client": "amquaera", + "rsa.misc.log_session_id": "eturadip", + "rsa.misc.obj_type": "rsitamet", + "rsa.misc.rule_name": "leumiur", + "rsa.misc.severity": "high", + "rule.name": "leumiur", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvt_detect", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "December 21 23:20:14 emoenimi high pid=5895 mod=cvt cmd=detect cmd=mqu name=onorume status=unknown err=veleu", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 10051, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 5895, + "rsa.internal.messageid": "cvt_detect", + "rsa.misc.client": "cvt", + "rsa.misc.msgIdPart1": "cvt", + "rsa.misc.msgIdPart2": "detect", + "rsa.misc.obj_type": "detect cmd=mqu", + "rsa.misc.result": "unknown", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mltr", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "January 5 06:22:49 dquia high s=bori mod=mltr dipi", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 10160, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "dipi", + "rsa.internal.messageid": "mltr", + "rsa.misc.client": "mltr", + "rsa.misc.log_session_id": "bori", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mltr", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "January 19 13:25:23 quovolu high s=dexe mod=mltr nemul", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 10211, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "nemul", + "rsa.internal.messageid": "mltr", + "rsa.misc.client": "mltr", + "rsa.misc.log_session_id": "dexe", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "quame", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/02/02T20:27:57.quatur dminim mail_msg[ptatevel]: warn aperiame very-high s=eirured mod=sequamn cmd=perspici module=inimve rule=aea action=allow attachments=5821 rcpts=296 routes=ptat size=4878 guid=nde hdr_mid=quame qid=orumwri subject=atisu spamscore=66.849000 virusname=tse duration=rad elapsed=iat", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 10266, + "network.bytes": 4878, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.counters.dclass_c1": 5821, + "rsa.counters.dclass_c1_str": "No of attachments:", + "rsa.counters.dclass_c2": 296, + "rsa.counters.dclass_c2_str": "No of recipients:", + "rsa.email.subject": "atisu", + "rsa.internal.messageid": "mail_msg", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.client": "sequamn", + "rsa.misc.event_source": "inimve", + "rsa.misc.log_session_id": "eirured", + "rsa.misc.obj_type": "perspici", + "rsa.misc.reference_id": "quame", + "rsa.misc.rule_name": "aea", + "rsa.misc.severity": "very-high", + "rsa.threat.threat_category": "tse", + "rsa.time.duration_str": "rad", + "rsa.web.reputation_num": 66.849, + "rule.name": "aea", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.147.147.248" + ], + "event.code": "sm-msp-queue", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/02/17T03:30:32.lorum suntexpl sm-msp-queue[iqu]: rprt iquamqu[6293]: audant: to=obeata, ctladdr=uredol, delay=uptat, xdelay=toditau, mailer=uiad, pri=nvolupta, relay=[10.80.133.120] [10.147.147.248], dsn=onpr, stat=uira", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 10572, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 6293, + "related.ip": [ + "10.147.147.248" + ], + "rsa.db.index": "uira", + "rsa.email.email_dst": "obeata", + "rsa.internal.messageid": "sm-msp-queue", + "rsa.misc.client": "iquamqu", + "rsa.misc.result_code": "onpr", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "regulation_refresh", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/03/03T10:33:06.aliqu sequine regulation_refresh[utaliqui]: note isciv very-high mod=econ type=aborio cmd=rve id=catcup action=deny dict=runtmoll file=busBon", + "file.name": "busBon", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 10797, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "regulation_refresh", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.client": "econ", + "rsa.misc.obj_type": "rve", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.232.240.177" + ], + "event.code": "queued-alert", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/03/17T17:35:40.occaeca dan queued-alert[pta]: err upt[4762]: itaedict: to=eroi, delay=onemull, xdelay=mdo, mailer=labore, pri=lorem, relay=[10.68.159.207] [10.232.240.177], dsn=estq, stat=quasiarc", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 10959, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 4762, + "related.ip": [ + "10.232.240.177" + ], + "rsa.db.index": "quasiarc", + "rsa.email.email_dst": "eroi", + "rsa.internal.messageid": "queued-alert", + "rsa.misc.client": "upt", + "rsa.misc.result_code": "estq", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "warn", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/04/01T00:38:14.tDuisaut uel warn[dexerc]: info vol high eid=agn status=\"iqu file: quamqua\"", + "file.name": "quamqua", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 11161, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "warn", + "rsa.misc.event_state": "iqu", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "cancel", + "event.code": "regulation_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 15 07:40:49 uunturm very-high mod=regulation type=iaconseq cmd=init id=tseddo action=cancel dict=rissusci file=ectetur", + "file.name": "ectetur", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 11257, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "regulation_init", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.client": "regulation", + "rsa.misc.msgIdPart1": "regulation", + "rsa.misc.msgIdPart2": "init", + "rsa.misc.obj_type": "init", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "zerohour_init", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "April 29 14:43:23 quaturve medium mod=zerohour type=gnamali cmd=init id=iumtota version=issusci", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 11382, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "zerohour_init", + "rsa.misc.client": "zerohour", + "rsa.misc.msgIdPart1": "zerohour", + "rsa.misc.msgIdPart2": "init", + "rsa.misc.obj_type": "init", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "dmarc_type", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/05/13T21:45:57.ecillumd iumto dmarc_type[sequatu]: rprt tiumtot: medium mod=mdoloree type=que cmd=inBCSed id=cteturad policy_cache_entries=umq", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 11478, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "dmarc_type", + "rsa.misc.client": "mdoloree", + "rsa.misc.obj_type": "inBCSed", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_rcpt", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "May 28 04:48:31 reseo quam very-high s=pariat mod=mail_env_rcpt cmd=icaboNe r=4840 value=lumd verified=tiaec routes=lorem", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 11626, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.counters.event_counter": 4840, + "rsa.email.email_dst": "lumd", + "rsa.internal.messageid": "mail_env_rcpt", + "rsa.misc.client": "mail_env_rcpt", + "rsa.misc.log_session_id": "pariat", + "rsa.misc.obj_type": "icaboNe", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "info", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "June 11 11:51:06 seq low mod=info sys=lorsita evt=deny active=itation expires=utlabo msg=tat", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 11748, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "tat", + "rsa.internal.messageid": "info", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.client": "info", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_from_itse", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "June 25 18:53:40 ididu medium s=epteurs mod=mail_env_from cmd=itse value=rever ofrom=sBonoru qid=ecatcu tls=ntoccae routes=iscive notroutes=amni host=etconse5657.api.lan ip=10.118.249.126 sampling=dminimv", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 11841, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_env_from_itse", + "rsa.misc.msgIdPart1": "mail_env_from", + "rsa.misc.msgIdPart2": "itse", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "access_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/07/10T01:56:14.rep nostru access_load[docons]: info emipsumq low mod=qua type=modit cmd=tatione id=aedicta", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 12046, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "access_load", + "rsa.misc.client": "qua", + "rsa.misc.obj_type": "tatione", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "mail_env_from_umexe", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "July 24 08:58:48 uas high s=reeufu mod=mail_env_from cmd=umexe value=xce ofrom=omnisis qid=corporis tls=tco routes=stiaec notroutes=Cicero host=ven5410.mail.host ip=10.170.55.203 sampling=deom", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 12158, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_env_from_umexe", + "rsa.misc.msgIdPart1": "mail_env_from", + "rsa.misc.msgIdPart2": "umexe", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "allow", + "event.code": "info", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/08/07T16:01:23.Utenima nse info[umq]: note enim low mod=meaquei sys=snisiu evt=allow active=atev expires=vento msg=litsed", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 12351, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.event_desc": "litsed", + "rsa.internal.messageid": "info", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.client": "meaquei", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "mail_continue-system-sendmail", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "August 21 23:03:57 susc taed high s=mipsumd mod=mail_continue-system-sendmail cmd=eiusmo action=block err=sum", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 12478, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "mail_continue-system-sendmail", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.client": "mail_continue-system-sendmail", + "rsa.misc.log_session_id": "mipsumd", + "rsa.misc.obj_type": "eiusmo", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "send", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "September 5 06:06:31 ipex low s=upta cmd=send profile=ivel qid=tmollita rcpts=tionofd", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 12588, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.email.email_dst": "tionofd", + "rsa.internal.messageid": "send", + "rsa.misc.log_session_id": "upta", + "rsa.misc.obj_type": "send", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "http_listen", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/09/19T13:09:05.ccaec repreh http_listen[imven]: note usan very-high mod=idolo cmd=olup addr=10.199.46.88", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "very-high", + "log.offset": 12674, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.199.46.88" + ], + "rsa.internal.messageid": "http_listen", + "rsa.misc.client": "idolo", + "rsa.misc.obj_type": "olup", + "rsa.misc.severity": "very-high", + "service.type": "proofpoint", + "source.ip": [ + "10.199.46.88" + ], + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "Sedutper7794.www5.domain", + "destination.ip": [ + "10.154.22.241" + ], + "event.code": "lloinve", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/10/03T20:11:40.nulapari beataevi queued-VoltageEncrypt[3274]: eruntmol: from=plicab, size=5930, class=dmin, nrcpts=sum, msgid=lloinve, proto=ggp, daemon=nim, relay=Sedutper7794.www5.domain [10.154.22.241]", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 12784, + "network.bytes": 5930, + "network.protocol": "ggp", + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 3274, + "related.ip": [ + "10.154.22.241" + ], + "rsa.email.email_src": "plicab", + "rsa.internal.messageid": "queued-VoltageEncrypt", + "rsa.misc.client": "queued-VoltageEncrypt", + "rsa.misc.reference_id": "lloinve", + "rsa.network.host_dst": "Sedutper7794.www5.domain", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "cvtd_encrypted", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/10/18T03:14:14.nvol doloreeu cvtd_encrypted[elillumq]: info loremeum medium pid=obeataev mod=rrorsit encrypted=aincid", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "medium", + "log.offset": 12994, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "cvtd_encrypted", + "rsa.misc.client": "rrorsit", + "rsa.misc.severity": "medium", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "info", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "November 1 10:16:48 nis info pid=472 iin /uteiru: xer", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "info", + "log.offset": 13117, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 472, + "rsa.db.index": "uteiru", + "rsa.internal.messageid": "info", + "rsa.misc.action": [ + "iin" + ], + "rsa.misc.result_code": "xer", + "rsa.misc.severity": "info", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "soap_listen", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/11/15T17:19:22.isauteir eritquii soap_listen[atevelit]: note dese low mod=ionula cmd=itaed addr=10.38.111.125", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "low", + "log.offset": 13171, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "related.ip": [ + "10.38.111.125" + ], + "rsa.internal.messageid": "soap_listen", + "rsa.misc.client": "ionula", + "rsa.misc.obj_type": "itaed", + "rsa.misc.severity": "low", + "service.type": "proofpoint", + "source.ip": [ + "10.38.111.125" + ], + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "event.code": "spam_load", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "November 30 00:21:57 ationem high mod=spam type=ing cmd=load id=ollita", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.level": "high", + "log.offset": 13286, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "rsa.internal.messageid": "spam_load", + "rsa.misc.client": "spam", + "rsa.misc.msgIdPart1": "spam", + "rsa.misc.msgIdPart2": "load", + "rsa.misc.obj_type": "load", + "rsa.misc.severity": "high", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + }, + { + "destination.address": "estla4081.corp", + "event.code": "queued-default", + "event.dataset": "proofpoint.emailsecurity", + "event.module": "proofpoint", + "event.original": "2019/12/14T07:24:31.nih ncididu queued-default[4250]: STARTTLS=gitsed, relay=estla4081.corp, version=meumf, verify=rExce, cipher=quisquam, bits=boreet", + "fileset.name": "emailsecurity", + "input.type": "log", + "log.offset": 13357, + "observer.product": "Email", + "observer.type": "Firewall", + "observer.vendor": "Proofpoint", + "process.pid": 4250, + "rsa.internal.messageid": "queued-default", + "rsa.misc.client": "queued-default", + "rsa.network.host_dst": "estla4081.corp", + "service.type": "proofpoint", + "tags": [ + "proofpoint.emailsecurity", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/proofpoint/fields.go b/x-pack/filebeat/module/proofpoint/fields.go new file mode 100644 index 00000000000..1eaf9c03f9f --- /dev/null +++ b/x-pack/filebeat/module/proofpoint/fields.go @@ -0,0 +1,23 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package proofpoint + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("filebeat", "proofpoint", asset.ModuleFieldsPri, AssetProofpoint); err != nil { + panic(err) + } +} + +// AssetProofpoint returns asset data. +// This is the base64 encoded gzipped contents of module/proofpoint. +func AssetProofpoint() string { + return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb9+78pOUjW5tR8+ynVdXWzUFYpokIgwwBjCkmL/+Cg3McMjBUBIFUPK72w9bsUg2uhtAo3/3d+QK1q9JrZWa1YpL+xdCLLcCXpOL7m/krKJckEtgjeZ2/RdCSjBM89pyJV+Tf/sLIaQHgsw4iNJM/kLCf73GL7j/fUckreA1kWBXSl9NuLSgZ5TBxP29+xohagl6pbmF18Tqpv+JXdfw2mG9Urrs/b2EGW2ELXDJ12RGhYGtjwcYt/97TysgakbsAlrESIcYWS1AA35mNZ3NOCMLasgUQBI1NaCXUE4G9GlD70DMXKumvj0pu0zdLItYSyq2yBtffWz92BKbRSoz3/r7/hXGN2ywKx8X3LjvEW5IY6AkVhFGa9sE/mu6IhUYQ+fu39QSpiowjmjlPt8BTchbNSenwFQJOk6Ih8V3kTqUnBYuLEHawpGWGHBAODP3A8sN8pwpaUFa4+4Hl8ZSaVs0TBRHy6tDECyp3f1giB33OLklCLVkteBsQSgxYAxXkiy4NYSS92B/51aCMe3uTwZHoyPWLFQjSiJhCZpMoTt3NdUGyDuw1KFGyUyrqrfU07dqbl5cUHYF1jwbgD/lGpgV6+fEBrwp+QBeWPgTLntoTqKMFLAEcQAnhZK793OLk6dQa2DUBkxKmHEJJVFSIFqWTgWQitZxrCozL5JdmD17/C7c8/PTH8iSiibceF6CtHzGw+mEa8osEWru90sPNgKp4w58OC34PbcdNdWWs0ZQjb8PGzsZPRkD0AedlNjJGEAePymjW7I87p68/P97sn9P3Kp5NuR+11dN/yiQkN1teTTYLekhQi87ahqMajTL9Pben2257v/9MDOWWqgArYpHhxxtSm4LJujOHX4k6IG0ev0YEVs4neoxIsblYYjl1ZhayfF4T1oJ9BDpkZdtM4AypQ01otfE7MzeF1u3gMNmoIcMlIT7WRE7esgA+g1WxDgXd1wrR+Ki7HlVouzz7BqQmYh9JMLBO7OPHUOtbiT/0sBGjdYd/eFP622j9kRJ5h4HatVjt2xHxM2S5xWHfe6euGX4jDPav89v1ZycLUFaconCmTSyBO1MEA1BUA1In/FrKIkB64Bs/Xh7DTNusLSbMIB9b4Ol24QB6DttytATmN6/dNjBHNB1B57cjQcLZTLpq/1z+asyti8ixe6JNCBLLufthyZ2bHo+pK+Hv/yQAzb40Shjzy+WPxFaltrJyrHrvsvcAfVWfa3MXb7Kzd5X/++y13Erv2zYlQvekdb3lpWEkjlfguycZF+vIuBYdJj/Iq8FUj5G5e/riGiMOjRUvS40fMmw1/3gIW4w0j1dI5fP/NLkAi/S8+DNtpR8XNdAGB1KkCkQ4HYBmnw6l/aHV0Rp8otQ1P74kkypwVPUBshmfN5oVP1uoPsQdfcrphvDoPmMzwT+BffrucrlZttnHbcrf/UOBqVXVJfZlLqeROuR3efk+cXnLX2PEg2C7m4pIWZtLFThEQ1oO2gL8CfVeOa5fyvN51xS0f5mW1u5gQ+59K89iRHnF59fRVgQ0B9w4v4s6DAacjnF67M5qEPF8dDXZwG0BH2U2PWvuBQ5P71PlNTj2w+WIpjDYqWP2skmWJHdz0ZbRet8o2jhRXGmy4kSAphV+msUwI57D5Bz484cN4R51kHpMN1SVN+qXbWF7GH0I7T4KjZ9LKpqpQwmu1VKkul6sGmEaPjSgLEOoOFVLdZhn9yXnaAnQNmCGF4Cefo9sQvdkJc///yMrKghBkB2q+zhxKNQXm/BCVMraSAfK9hXcyqYaqTtfApNNfVCz11lE4VAntKpWkKPGVxGMytb8WasBlqN3h/21RybB2YVlLzZ1dNSMOqbmObYORb4jHD7z+bl9z/81XiR/qJGAdoi/c8BNf909uBbugZNXpIzyWhtGuEjK86kvJNcj0G/Z/AjklsZW+XHl+RfHbnPyY8/kn8lTGmnLyMVYdHn5L8L+z/dF7kh20z5JrqFUpXwaG1duYKCUSGmlF3l1YA9clJZvDbUervCMRFk6YsDkNUQT3DGw1GA1ipTftpGHzQ1ME4FYoyYGqu006zl2msd7oMlFbz0ByOGFCEz1cjSvTACEHku50E5ujF5cftGDCCniAWG67AnbDSyC2uhaPlY3rmADjH8TyAVWM1ZxOoIpnD/y2gL++e+FcLu2ad2o9GqWbttE/KrWrmtGdqcXBKlnTFmFbkCqG9g2qN48b4SpmnFwJhiycuizBV1PWslzxwkaGrxkpeOgz27cMm1bahwRvuW711GXBy84s7sxlg5MsNTEa76+SnRTlobdKgg06ieg+2+diMnjM6U9PTgnPCZcPs5obOEgoaC//y09b1+gEpZIJfhvDMN+NBO12OC0v2vDcR8BYGXsFJhasFzZjY8anPe8IHa/yh0MydzM553vHXuDQhnvT11rdUSnpD/GhFGL15mXDxAjN6t6oyji5M3F0H3ZVQ69vCqVnpX4yX4RH51aRDN43B/fPJPFRriaLrHXKnbpnyz+cnGYPd6DlrmE/Ly51dkhXyvgEpChYj7CtCpj2rSxn9EVqDBg6WWCKDGEiV3ykW2mfjgauLXzcTIXc0Rtg28+13pEhmHWU3AFlIJNV/vBuJmXA+0WEJ+JmxBNWXWM9Fd6jXij05zSRoZcnrEls98tKI2dUG3D9TnDCLsiV2iRVE5JVPJNoyg6WpUpqFk3VErKUON1ccoZPA5KMYa3UI0lsqS6pJIpSsq+J+x/F6lqyh/ypDlcDCLVDMdPEl3YtIG6w6ZF4LPACmOGPgGmJLliIK92e7C2Jx+lj0EcclUVQuw0QMw6kSlqMBbzXfEYK/eTNsHOsiXbu3ocR47ytsnc/T4VUraRaJt2tSnpsp52WQ5lQ/E+DNZ5mC7A/mnkrm7LewRi271VsX06bUfdzk8EFHZbvQbYuHahstHlqBNr5yi3JcHFtnf+x62NdBUZG7K9JjSJZT53sGQZBOeKdOt2OoYbaZN98V+fH34WmlVTRBqg0X5hoGkmiuv1leNsPw7y0ETWteirX7Z9LKpqKTzWGkuIQLDO6296JHyuBrC7RND1Er6yJilVb3rGQwYu9UcisPbZw1hC+6sG1WCmZB3jbFoJvWBultJ7UheLrVw4CbtFWCzmcN7CcfQhHCT2wU97zTMQINk/kBQp1qXfMlLp9ngeYgLsstWkH3cYV6cyOua66NRuNlPHwu6dieRW7H2xBon9Jy+5pDCA7rfN5pw00ddOM+dNO7k2WSwZJdOpprUEqgaKHL3hdjxP/VVQQ3ySwPN0Y6SO93+FG3k44oagkiUI+cGkfshNVMTKgVbDM0g0+aVzfD6zqscuNZFBlTrIof2XKcURdtAXyaHmkFX6r0iD2NC7piP0Tdm8Fze6c05VGzeJNcOCRZsHoidbgipHUGUDZT4FIq1aUTusNOIFaUay1QFLzwOnfGCWdlqNjghVAYWbBmQIwcElhCaYT4AYe3qoQiwF9nZ5/LJW7w46B3oX+mu0sVBw7hTDYzP+MbwiWu3Ppgz1lMl6Mr5s5kiG9C5GHm5KZhoXVRlCLJE8Q5m87E24fO2ld63BJUmv12G1Fhu2oSAXb8art/u0FiVpKmV4QkFx63OFprTsvQdpjCVv727o114GmGLfK2L7iiKZFOB5uyusihK2xGq2PYQ1q9k626GF0v+fg9IW4IslQ4Js3spU9M/HqB7TRvaVdM/gMXtaIdY/lrwAbudBN2PmJf0OXvVfTO8kKHqP4iZ4OVa0C63WCpLKFmEjhfxBFqh5kWbqPIgQr09iHcW6sfombIl+/6O6VbYtRrFR1zxV4Kzde7bs0cuXCACobm2FOsRudyInHnTcQZ+aAQgYnFxqqSF69waa4fQufT+uk0/VFqWxv0fPqpUtAjFGsDc8DizBZVzKCSscsuCscAlrHqhflRCrNV82ljoSYhhjr7xqDttvf/8xUWHqWkyYddxTvBsbSv3MQ0Nwd38Io9MX3+LGLdYAeYY1jYcNJucL70EPSGX4DelMaAndA7Yyjtkus+UbnEYwG7BeL2d4e+J/32vb4XSZKrVyn3W/jXomt7sGu0nfV5eUG1Tu+k6wKk9KuFOqUF16LHulBJlpzbmulKqhhBQzPUWv5GECtC2yy7Sm0XD33x4K4iPXhMATEKKKMwlkUp+p6EGtGT2ZT+g2XDMJ4c1WrsL09kruJOox73gPsLWhn8GlK24XQRl2ct6cooLTrHaRBIlv5sr9997XgJUUoqI4piRbtoLBr5ABBySakacdLAczIRcbmTK7mCDfmVVHoxPfDlfY5wR40tGfbJNGcRvYDwlTDTGtgcy/GOwTfgTbtxOhpro4N9wii9+Oq4CHV378TcsbtH7tkz5lLInNxleDstTxIJQYxTj6C91uxG1J3HD3vIreE0oqRdrwxkVpOTm6jmpNc5EeU7AsidxRZlqekjt5R0fel9no2kFFrQhNTXYxctgIwffi4CpqnJSTG0F7YelNWDZXnXPvwcPpfH19jDDw+TFN1NV3QzvYIZto2TFZalWIZ+WKcmgts+7TIpRZgzInDVCrMmXhgrv/CxVRbkMUkP2FhJq5Onqez1TqUt7SHcq4Vsur6AMtUBtIjo16J0KBor75JsOtQkv922cGHSFyCrq+pOdvFtiF4EWvd8uHwqv3+rgeSWXw3Y9XdAZdMV3BzvldrGGNRFbf/73a9o/Jta0Z1zkv+Mdyb/gat011lA2DEgbOYK4u82A5lQUkdc02yNyiUu2avPu+9h7AN0LM+oXAHZlDmo5kMJjHFZ3D92CmkV3Q51aGKkybNjCZ/62NTZdmeFJC2mnRZgjpFtmYjRzv+r+Paw0JU6eS8Ix566RTADV7k/YCG+DWiggDN5O3RZ23hx98MKvGfZ5etQvFlPVlMuub3b/wQplo/oOr9eS68Yc29PX10YQgXGP33ECpJErceJX9z0Zxz2l3oLL7hrv2Oe9zOen5L2XNE9D4wbip+2Fol+H27O4Xu0d0A/hy++5n89PkaWh5K0TE0PvwXZEzqcBehIm/hA5WbDiJm6kLs06Zy/77ahuKND26sJeP7b0xvcRT41j/Um3MDk/vVGTTeWfu0GTdYi9lOVGo52QE1+fGfqdCv/Bfm0WEdTb3/jhm+COmza2q9xUtnuMGinAeM4o/6CsFFlSzelUDKoAfVMGLkkt6IggMCBN1v4oWxvaV1X9yhMnqZyG0dYXcrfPly/OL3Z1aBJaxnqPwlhd9oEDBW9dC7mJtHgkybm05JLPJUVhMXJEa6VzNq99MpBf7pBetLqbwq6O+J8Okd5dxlNWqsjBef/bR8IlE00JTpyFQbbu5xPy9OyaVrWf6osOEQ8Wpfck7hfByNzRY5vonNo8LXHMuLlyKvcBeN2hFK/nxnwfnoYP3FztCblazedz0PlG2MVZ9rkfCwg4oHa60GAWSpTu9HhbfWTS6Fbo/QiehWHsPUjlpx+8jvGsa8ZxfhovI7l1dJ6pqi6OnHeFuxJyr3CMq/fvmWb6nUNHSaxPneG4GVU2bMxKC2rpA2WN9THvpKXS2HnAyfUWv5EpcVSXK6ofJkNv2FXfSVcaHiJHxEhr5KdOiFLyjrK2n3JcuXUi6Kh2jJLftQqq3i+FvK2ZfKi1BmqS5wYbS22TSnHu/FGUiwczO9ziU3VNePli/P1yL2tzDAwdRp8GjY/9XXBYxK9u+45lnr43OOSnw7l7hzxnXKomVYyzV0di5snvlJOkKZ0OA4/sT4kB5+7MuHUk3gjh5B4xDWNgzKwR5MytT5gqwbgj0Tb7jVsWXJZwnZgBght7mOZ5T9mCC6MpplskpqAxvllRzQVm8EQ8eD7+LueEIhO/c7+NUiYznEM19c2FHkgjDquTp10+Zw3a1KHo1kuYAcuCirBJiG87PD0bKTL0bq7he5w7ocQrX12SV/BV+W+7DymXhpRgKRcRJ8NUNbb3uxHSlDh6bmbrsaVdHhviMf6QWqhqkS2b5w0pYUZDCCh0vmxj+CFb02nFS9CCrrGQy6rwuJKnkRvpPkCrO/waZm0VuPfVG8ttg40ZSZSwjW0wbNh03+uaNIrV8+8wmhrTDLKKqapy9ynPMTrx0AnvJfvWWi156f1nbRe5CsxoIlSp2OGBxrt7y37hYqM1sn5eXlw1uK4x6elhZH27el5Z/4eaHuh3Opi8/62mIQATv101z9c49xQTiv3OX16ck/OBQtVHI1vX2lBdsh+DhIVdXTXsPKkhfRd/WMitjiv3XkQUU1XmrvgaVNztKh0BF+JwGVGPFum7JfiQwREqz3su4FA67BNou3gIn/OyC+WMOPGq1FbjoAw8wcufTsnr6K6bnM9UO9374pPvntMGojBZ4xpY0/ci+NSvKcTKW9suTPsSN47gCIl6xctth0hXXUmXlAs6DGSQzhVOsL5yBlqPTFrwd+gQX3+6uFswVqrQAMoHYAckhXQDw+eTEYnIq2LalOU6uX+GV0XSOqAe3MbAYY3O93qp0kPUXCXscrBTYleY5hgFCdz0s1d9z1XalNx2lXWbvmgBo9hgu03Fhhclm/DCfiJ9llhqDi6PZpWffD4jT0OtxOdGOF15ygUWcGAe2Nl1rYz75jPy3dDRIHejMFdSreSWIWSANdjMYrkNfWTSJqNHcMHtpoWetFXu70Np0luYU7Ymn0bNNcGnmj5EUX5YeIvFXJKKcjnTtIK96Rg11Ti1N3+fhC3l8gKXJe9V6ZOjN20Be1lnEaTIDdoXpgo4RuSykLb7xr2HFfm1kWhKvlMlCPKUy+Xk2+eEK/acTN3/gfs/KqlYG24m38bji5bVxUzQweT81DrUtoZ/ckFwUfR1oZxct8Ov1GxvowarsmLq/zoNeLZtEAxod5CjCC2rtHJ3B7PP736nGshHnwD87bef3/3+5sPZt9/6nNsl1ZSPnsmV0lcpS5ZvvGC/twv2I2yjTjAqUysRoWYnbZeS7jmgzD0X6wwmzExpkIazlAKk50rKgHGV3gsSiQ+kAlqsKB8OJ763dwB7n6cG6q5P6hJ100wzXQo7LY3VqSvfsV47m0Os/5Yme0fbmo98TtJDi102g8EGKk0oNtnUvYR6FwdixkcdTS2p2Ryxh5Ia7UYUIXO3vCculA/uJ3h3x4VDPuj/H4arblRmP/nvQY5Y2fPRB0T2Ivkgh6ON4+7DT6kjJG1t7WzPLn1qu4z2NssO+2Q+Q7fb4OTeHJluW1bzY8TDsOhrRrlwvG6buVwEmXF+2q9tw05czhy0MI+0MBjPKmxzrgunIh5AzyGJ15huHaqPTlRVNXLXEzXATh7WuOm+2L2Ha/t3iOvUHW7mMM36vrhdUln+u4pHzTa4WWr5IZLh3tgNF95CzjSm5oyrZFmix7LgEfsV1XIYdHjsqBtZ1YXKJYwv37+7IL95P+omKTWOyJejphJc/sdb8qUBPdK7tRGy0LDbqTNvckPPIbomH9qis2haV6els4QPaR+oSj1GwAGtD3Ic3QTVRoJj94Zbph/QQAXVVYbdcmAzuBdonbAAuQPalMmm0m7BTNvtagt0Se2uVnhfuFOQbFFRnaqspIO7rulgfPG9o0+UDdKpksAsFsnPAoNZ2gKqDvBsjq2WMoBV0z8yQK1p8kkYvuNU8uOFQfeCp35wQue2CpzqmRxpWVCGg1HSl5842EYmNN57gKfzevmTvLaL5O87kwWzuihN0r7rPegO8mGRp1sAXgqaXGLIAuScy4RFkUPQOXKjZTErzIpbllx+yGIm1MrQKn3uSh+2tMt80DNEXZgsuMwpTrisQVfTdbKE9wHsml3lAb6kIsdZ4XVRa2VVkT4khdCXPxXocUwPW2S7m0LNizIHsx3g9PlvTBYVvS6sTeU22AbsTrSADI9CxWUmpLnMh3QtTCGmokgdFt2C/X1G4Mk7g/dgp+6F2Ieduqq3D/vnjLBfZYT9Lxlh/4+MsP+aB7ZVtaBTyCFSOujpzTNZVI1A5Xu6zvBOtsDrqwx6SdUIPq/qPNq30zKpmKdOQgqQeQ6lxMAXlt43IgvjExIz7KDRLI816QDnsSbN2jR1hlmkTHZl1VlMVausMz3gOoMIsco6wywXbDRrsgBvJL+WVCoDLMMhXL5yXMn0KCxfqdougJYZ3GqqqgsmMviwHeAMQRKEq6drm94t6iCbLJDrpsgQ02CaW86oyFBAZAo6B8nWCbOu+rAlFes/oZzmwHtZYBvQLJB9O5g8WPvE2izQp/N6+SqPD9oUU27/mqXRGDNF2llxO4C1Si6qTZZrjlCB6fRVbsb7+JPN2uoBBrvwfv70zhEPHNW+LMB9N/l0HeR6sGdcQA4bxhSzHJvIZymLs7cB59ANTMFrTFIssog6Xi9/Ko2tB838E8E2mmWBLfgMcpgxBh3NFZQ8WcHoNmwu85ySSpWNAMNUDm4H4HyeQTap2qyoTTrzvwc9lkGeBLCGOTdW0/SekA3sDBqfhjoXq3U2XhvsRK4zyVefme+PeAboVgOtMiiSvhQoF9r5lOvVQnFT+Amz6aGvqaZZDng5UgibAvLSz7dPDZcbS2XyOcelsdNGpxoW2EIFPysoB9QmOa7p9ei2Jjk1WJzcMEs/7PrQTgP7YM5pWaa+A7xMHVZtWwdleIt4VTCtVJWlK5EDnMFM41WRJzkydDzKweb6Knl7ptqkb1nKa1NrnhiooJbbJnn2meAS0rXY2UA1SSfqdHCx+Da9W0so3/W0mAmV/DnvgGdI+Xc2b3Kp44BmkDjOhs6AavLcBKHmWY6unGe5wLXSqQVYNW3mOa5ZxQ3LIRYqk+XA5pgDIcFic6XkcJPLcN8AOnXGn4eaOh1PrlapLZAsFWXKD4BObomq9JqR0nxeROZx3RvuSoJO/2bVhR/Kmxxs0snUG7B+xGuWQ5ahcDPMxEktDALY1NKgLrwjKTm61Bj3YcEWqer8B6DhuubJAwE16GquqbSDnrspIK+yAE7/9PpOZJ8+7UwBTQBYq3lBTZ1wYEAftKapoWqgIod+p4EhH3zX0UzA0zPZQU7bwrUHWekyA8bpHZkmg2/YeN9whnwAA6kTAfzA4wzGiYEv6Q9ArEFrMqgZTCnD5xkEr6lTe9mMZjnugWZlckXaaBbripsAsE03YqsPszHJu2oumUxdKBGdFntfoL5JZ2ry7dymP1YeaPqIXjfTMzXcdZ28W2tTTrPkoTdaZHgLGwO6KHnqqvcsYyvayFAONlhmLK1Se4OXBZfG0lkGzWDJtc2hhi9rmaF1k1W6kSndrLG2aJGOom8aq8iHRpLB0l32SMZheZ+p4CU50VByS06oLkM3Q4Pt3+Po+MlZGbk0NiEUweAQfYL9DZgSJFaq0+VDcJmPc2dVLdQaBoMFb+TfTDXJmnrf8ow5HnqfEc470zCHa1LR3UYLm1isnDe7w0CyIym4weEM7eph67GBEjFNXSttybDxKCGrBbWEW1JrmI0dhXuk5d5lCEWM8cHq6FAgXIbO7iN9oQWXuSfy91B1q/XxNMSqOdgF6Mnm+2ahmsGLRoiEJehuHJFVpKbaAHkHluJEcH9XaceCp2/V3Ly48GWvz8hpGPH1nNhFZEoRNgP+AGH0MaItyXuwv3MrwcT3eXioszBvhiO7u1uEi3tiDVDNFhMueRQ/nLl7hP7aO+ITZ2FgMsQLQRuJs37nDc5xbZu4xxu47/Rr30NT/nbcHU1dE+4wv3jE2HcbUSSsabpd51VclnyEa4u3YsxdcIxp1CMCaTO47j1OqJZiZOIlds/NOA4c++casETDlwaM3dO0+/Bs5bv3yvcqA47l8at6ib3rkeryTrfdKftw8hhhbGzr79ih3byOUp5y9v/N8w3dYuenrVDAteNnA62GdEm8dzzC7nGZUgPEp2t32JDBrep2KfziYfCV3Sj4DnOlffv6KBsJoYYYABx3RvfPq9JUGsqOMN530GHaLy1R7d0cGtZonIC2D+kadMW9unEspDdL+sEcfMkFzIEIWIIg1Bg+l37jNvP640cfWzI/oPzG9fec9OmDTHp2mDWSf2lgd0wijV++Hr6HdUw8bApKq9Hw0l9IpqQEzK0gK24XY4KCkEhlSKexaziovOjOpoVjJ8qT7okSas4ZFcRhMGL6IBYPix0uNTKm8eF4Vy/WJo5eL51tpXayWlM/8FRwaoqFym4TeCOuM9dwlspmqJGTiv0RPPF+AMRfGoctvmlhEAsTQPXkjTDKGeJb9+0Ug+Xk1/CLCXkj192/BtAt2vJGWkLLCVNV3VjQcTGcxY3vCMtnnn2zuxc4Y3FrQ7j9Z/Py+x/+6mzf0952tBz7Jop2OKdF2ojZbR03dA2a/EvnkzMvAhqIXPzWp67/yX/m5QbnrVO/dz8OTF6+SbY92R2Y4taZkPe/fTxztIMG7zxBf2nJDdNQU8nWTqsM6pnYzQUhyKHn5OO71+Rc2h9fPifn70/P/vM1+XQu7aufyNPVYk0kcLsATdhCmTAqTWkNzOK3fnj1v/7bsydRjoBdZJRxu/xAmTqpaHwcj8l8+u54zS/9WTxvkYpf8fJxId2XTTdgfmDDuFs/8DF8dxTTjXXymWvbUEHevnkfRfZPJSGfL+uwk/F/lIRJnLcO3a9GhCIhNwtP3ILH+Abv2Yc5tbCiDzAiHU/3BXlTlhr9tP6Ux9Dpnl5W1YfGOe8bCzk/eXfhX6XR8FhFzRGjH1tOJa+phrebnF84VEa8X46HB06CSMJDt/Y4D1tNrPDTtY4rIHro0rLk7stUbAK2vVn+8XfuiAfAmYR4wVW44afbR2CAyibXOoted9snjZL3AcMLpW0nkgdCt8QAG24At+ubJa85Mu89PVzO28ekJevdGOMlxOzGY3lxA3Zo+VJjFONO5fR+o4GOQ5xc1lTOYdKZTkzJGZ83GkoyXSNMkCVmDcXlTH1g64FB0eiIthxddJah34FIqPv3S7iSOwA0VMpCETK70+cZpWdtKU1BC5+KnwF0bXUe4LMMR2KWoVpY5LgOufqf1BmYSsui9cTlU8t3LXhHx2R3tb4z4QE02DO7AC3Bko/rGp6TT+0z9hYdYD+Si9YBNngJfhvT1NpRPUdQJkZM4xbp4Bd/TqgQUWWi3nwRE9yoxsS8JWj3BnJpFTEWH3MuyafzUYHCMEE2m7xKLrIdUFVnGPvmAGswqTN6HdgMJS7+RUydio7+9gzY+tEKhQA5Tz4pEnF2ykdGLXREA/UqDxW9AIwkDNMJZoSSX5ReUV0O53QT8maOyV6aUHfjrzGXbgp2BSDjqmfirol3jXErS0U/VOeRIdgyHjMjBhRyGfJcMS2h4taJpTBiI07iUlB5jDj+LRyUbYJIz0U5IHDbZbmJpCydBTtHA3b75UkdqQSGXQiW6frB3S5iT7XlrBFUE+wXTVoknp5dv36r5mo2i09/B1bYBWTf3i1kP7oF/W3s4X3m8HbovmnsAqQNyeKjaJsmZeeE2yX0+CXHUf9kQI8irBrL1HE5HZYcR/iyYQyMGcEZO48f1hztsMQTxIs4FXeu9JpEChMGuB1DOG3hCDs4OqmEAT5TK+neFSe3Ysph90MyUJS2qVqm60c38m5S4ruWYs2A4FB29AQ/zI4+zCUx3DYR+UmwuACCiA5QF9QQWqravS52AVwTtZKbLfOMs/RaSVWN5NXiTA7DfYv64yoRTrnnsnTyR2nTMYCSX7gA8iYgNhmw4TbOXtkR5u/kaMJ4R/+DpCuMsuAyZC2k5UKMxggjUta734MRPl/vMtRrpObEeELoVOWsHogQP4UFXXLVoHbJVFVrVfGRDEU4NnJnkk4FFpHNyMl+3LhcdmInI5K7GG5pnSSKwBaGSYfLHIBgZP0Ov9y723tlN/dt9NhtyiwbaXfL2VJr9CWWgRfsELP+VloQvsdzkKA5a0lChmCi325qAbcLfGpjs91IQHbCfpgYq8eDny1Nh7TdejCaXu6nKagXfq2MdEVN084It7wC4+S61/Y01DAaRAq7kKwpxI0bgY0H77kN+pZH65De3Q92tH68HU0/FCbZkNNbkxYcxjdROKANKd4IhFsIg6+Xupc3UqePunf+oiWhTd+8c8l6qR5HgNwgxzsB8vUexx9v3rJUow2Os2W3k4/6qBIk5R27hfw46nFMSdvgMHZKPZag7fipk1fuNHZRVGAX6gGiJHTLk0w8GuFroxuOvZS0yup12hPV+aBE8Nc6RPacy0yekP+c/Pz99+Tp29M3F8/IKTeWy3nDzQJKLIWP4iLUXGXvC7QvEobZsjOPR9hm/OJIxphWmb2K++o/3a7GMOhuDHrkkw19vst1YZj239X99hx/iFMsZkplrE36JlOMilTd6XYI+UBL3hi/AlGaGF5xQbUXT05sujvE8F2Pl1fhPTe8PGankX6m/Cd3EFov4k5fzM0lz1dn8Ubuu+sY1giVhj3/b3AS4SeDsxAcN9AryyjjrkylcyYGDEI2yGql51TyP/dkVct8R+G2zD6A0/0zNcLuGdfRWtJMXX9+ccvha+FbfPneRVtZzb8CFXbBqAZSayhVxSWNFtz1xNMFtRykNTemxwt6TGrf0gcl1rd+hDrTwXVX54kTXDXVFpshbUjdL1aP2OwoCJvbSNQZlKCphbJIllS253w44fNLu2IXPLvQasnLrnlY+B6taxE01cHBCM1/3LO2rdPGFZwNkbw8EpXdkqHXn12PkBkdHoqZk0vuo+eLXcV9pAVcp3SmHAp+V80TrlFn6v2oVwk9jxDqdVTUWKkhxirtJb6DVoGluNoT/NbEfetJnPqKl6WA40m5d7jebeVcZHt7cu8gOdeOxzgOuRdhtV6HIbluo7PPSS2o2zL3PitNQDK9rse8/JgKeQR78hYZdLqzLX9VxpJ3lC24HDHpSppJcnyzy+tPEjP9aw1OfDj9yDc5MxPytqQ1+Yz/8PpRqaSvO/3n8PEkC7oEpzkJoJp8aUCvCfYgNLWSBlqNKl6c6ugt8DfHkZehBx5zkDVvu0BKT77vyzeOZ0vSEVDdHKAPoTnqbTHFKU95HWa7Z7xtLb3VxMjZhuHh5YboRsqoHWuedy+Pjzz7NlIjNXYBYhEszPwbQcmKy1KtDDE1MD7jzH3yPFYnGPJkhxfEkefx3eTckKfYERYk2zxDGLp81uMWaSS+429hTtmafDLbjW+7CGy1W0ibPLvWrXAEg33kte+bWogK1qrhIXMv4oDjXR+ASPX/VqUplvMM2bdNdn6Feqw7r1evIxQjhdGDFn5zALHHyesdIzVk+AbXeyvrzpD08S6gQ2qO47DrAgbbe7NJyPTbMNiheEOKm4ufsWwg5UjA0Qo3JLmEGZfBV4/CCbv6VbQeaTqI2B1UKJYJt40DZkf9Sy0YO59tbtpDL6WR3pSdD9tayhbVkVvgb1ZFhpOBddTfjixDXqZcppsglvRuOJKxqDDv4xkRUv2yHdwW30Z7U94fmdo5wDrv23cD1jXV7Zlyf36+IWW14INW6sTdDmfL+uT3W5Fnk88s8W0tlF7n2/C/mZrKf7uxY0yLyHYX9VY9jz1Nji1/e4HQb6DtwVSiAVVtv/X9VI2eggKk1ao+RHSUqpkOnAu3OuNhTWdtww3lCIijr+447j08UVVN5bq7j3jtcJy+t1eWoN0zVHA5U3GlgJqr3DVCN8iPHSuyxWwFebuiz77kyhH4pRFiTf6joYLPOJTkFOuevXMwisoKpgVT6oo/UND9d5gSv/7GfqZiTJtP3m12Ew6vG4sq94EjTG++6x+6JcKUneCO9j75Cfm4rj3pG8+BY47fwfHN0zArkjaT3UHb4eAdEfqJibWt3UXmGK66Trncxs57FmulW28/hpg/vB3Z8l6vnMTHqeVFnXcO0R5WuJVv9Ny3aGqlMmki20i5ddx+kJrauGuSyYKalNH+HmAdyukTQ260SLjNPagJd6UzRotGp/KG9GAa0AWdp7MpN6CTP0/boJOmP26DDqc+g2CBawsSVav0xomDn+w0d4reQsNOqkxqjcovcYxawi2Z+xGXRfXqRfjvk4DCi/AfIa8p5vanAnQ8Oy+Q84DRc09MP3iOHtfeqLUBOWUYiOZMKi5noPVI3HVI91Ho6iv+N7I+6p49ApJtX+JZbxsiVwrD2irrlYoscbTjd+bj9u7YfcQMYt3/0z9gmKA1PvCT1wvQx/FHOJ09ZDw9PcHRj8/ICa4fRw20PVKzlBE+n4AOwz9hKwtzT3NeyBo67jGyt+Fu0Sem1yl6707zPw/1St69NUp8t8kl/zPureFXmWTK+T/OiIS5stxvYL2gZmQClGHHbivU20q/+PhwQbfV2SZADRJcds5Y2zi9rb+JJ6QYPj9GRcV2f6Nu6uHH0UHLTppwY5rkSidCxmSpfN66+8VQEEPQOqsPdLApfel55hYnlxic3iedjpIh0XUGD1Hkp5eY2rn/MepJz8OQvLv03IPjuAg1RhTLnC/6bkg1OLKjyJSFO3q0Sd6m0eQCzK8gWNSZmht8sxlX0n+QULb+RAzG65Qm55dv/vHugly4d4r8Jkemr2ywzVRJfQi2H1cqji2KIbYAdmUOciLfTgjn7UEWGzrX9evsWoRhGmgYQbiRgnu0XNB80BTyAZRcj0fXFWTUaECcLbXN0SZ89rFcUsFLfxAjSOwKwqN1td4nCJFjV7A2u2I70clvE0gTw15YW5uC4wzaLKBxK3MwhNFHcJv4XLaVL0pzu77hRjFVVVn7xN0Sb49HcAjFS/BXXIPYtTRTu1hWgsrCmIcaeOtW9jL890BtW6MVxdaXGhe14sdIq44h7DEgiAEiFbcGkK1sQaUcNM7I3W4qrIqIjMRsj9S2uXtYwszD39++eR/evRc7y3cPilV61/efvGcbN1fFUokmFwPetHOcZZhz003Gbsf5NpJbQ556JMwz7NaBhb3tRN0d8ASRjlIjmkzS7G3A9ZPkNqQLTLaLDpagMVNg1gjClGRQW2coX/o9HGmvsFrllL6e8c5gb0doO0RrpS1Rjr+//vubWApulO2pz53S8+MnWO4WGGy5WKfUNzuJNor5+9lvF+cX5B29rrgsu7He8W11tB09DXNriOIIWYGMAXX7yOrUp3jJYvL0bF/lWMyOV7D50EX4LcnZ1Y4tZ1mQyuenoUtvwGIvhuJ4m/LAvQJaiqv/8nXDXWGOLIeaZOrbjf4SZ0I/UHZjGFeNVnwX1K18ce9zYppIijo15G/GaiXn/zYVlF0JbiyUf3sR/va8+5TLGbD4RzOuYUVFVJGhU9H7DaGyJEaRkWOpYc6N1Wtn2R9TWNTULkKz/g4HsovDAEl0Sh0LTV8I7eu1mNK9LuSdPtlhDtLq9V/+bwAAAP//wSvBkg==" +} diff --git a/x-pack/filebeat/module/radware/_meta/docs.asciidoc b/x-pack/filebeat/module/radware/_meta/docs.asciidoc index 7335cb86eab..622f5d5e461 100644 --- a/x-pack/filebeat/module/radware/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/radware/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/snort/README.md b/x-pack/filebeat/module/snort/README.md new file mode 100644 index 00000000000..3be60407787 --- /dev/null +++ b/x-pack/filebeat/module/snort/README.md @@ -0,0 +1,7 @@ +# snort module + +This is a module for Snort/Sourcefire logs. + +Autogenerated from RSA NetWitness log parser 2.0 XML snort version 134 +at 2020-09-01 14:18:11.30825 +0000 UTC. + diff --git a/x-pack/filebeat/module/snort/_meta/config.yml b/x-pack/filebeat/module/snort/_meta/config.yml new file mode 100644 index 00000000000..e3804a605b9 --- /dev/null +++ b/x-pack/filebeat/module/snort/_meta/config.yml @@ -0,0 +1,19 @@ +- module: snort + log: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9532 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/snort/_meta/docs.asciidoc b/x-pack/filebeat/module/snort/_meta/docs.asciidoc new file mode 100644 index 00000000000..f2ae38f0043 --- /dev/null +++ b/x-pack/filebeat/module/snort/_meta/docs.asciidoc @@ -0,0 +1,66 @@ +[role="xpack"] + +:modulename: snort +:has-dashboards: false + +== Snort module + +experimental[] + +This is a module for receiving Snort/Sourcefire logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: log + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `log` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "snort" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9532` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + diff --git a/x-pack/filebeat/module/snort/_meta/fields.yml b/x-pack/filebeat/module/snort/_meta/fields.yml new file mode 100644 index 00000000000..f9589132eb0 --- /dev/null +++ b/x-pack/filebeat/module/snort/_meta/fields.yml @@ -0,0 +1,5 @@ +- key: snort + title: Snort/Sourcefire + description: > + snort fields. + fields: diff --git a/x-pack/filebeat/module/snort/fields.go b/x-pack/filebeat/module/snort/fields.go new file mode 100644 index 00000000000..f143694b520 --- /dev/null +++ b/x-pack/filebeat/module/snort/fields.go @@ -0,0 +1,23 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package snort + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("filebeat", "snort", asset.ModuleFieldsPri, AssetSnort); err != nil { + panic(err) + } +} + +// AssetSnort returns asset data. +// This is the base64 encoded gzipped contents of module/snort. +func AssetSnort() string { + return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb9+78pOUjW5tR8+ynVdXWzUFYpokIgwwBjCkmL/+Cg3McMjBUBIFUPK72w9bsUg2uhtAo3/3d+QK1q+JkUrbvxBiuRXwmly6f764VI1mMOMa/kJICYZpXluu5Gvyb38hhPgfkRkHUZrJX0j4r9f4mfvfd0TSCl4TCXal9NWESwt6RhlM3N+7rxGilqBXmlt4Taxu+p/YdQ2vHYorpcve30uY0UbYApd8TWZUGNj6eIBs+7/3tAKiZsQuoEWMdIiR1QI04GdW09mMM7KghkwBJFFTA3oJ5WRAnzb0DsTMtWrq25Oyy9TNsoi1pGKLvPHVx9aPLbFZpDLzrb/vX2F8wwa78nHBjfse4YY0BkpiFWG0tk3gv6YrUoExdO7+TS1hqgLjiFbu8x3QhLxVc3IKTJWg44R4WHwXqUPJaeHCEqQtHGmJAQeEM3M/sNwgz5mSFqQ17n5waSyVtkXDRHG0vDoEwZLa3Q+G2HGPk1uCUEtWC84WhBIDxnAlyYJbQyh5D/Z3biUY0+7+ZHA0OmLNQjWiJBKWoMkUunNXU22AvANLHWqUzLSqeks9favm5sUFZVdgzbMB+FOugVmxfk5swJuSD+CFhT/hsofmJMpIAUsQB3BSKLl7P7c4eQq1BkZtwKSEGZdQEiUFomXpVACpaB3HqjLzItmF2bPH78I9Pz/9gSypaMKN5yVIy2c8nE64pswSoeZ+v/RgI5A67sCH04Lfc9tRU205awTV+PuwsZPRkzEAfdBJiZ2MAeTxkzK6Jcvj7snL/78n+/fErZpnQ+53fdX0jwIJ2d2WR4Pdkh4i9LKjpsGg6vsYcXNsy3X/74eZsdRCBdI+RuRoU3JbMEF37vAjQQ+k1evHiNjC6VSPETEuD0Msr8bUSo7He9JKoIdIj7xsmwGUKW2oEb0mZmf2vti6BRw2Az1koCTcz4rY0UMG0G+wIsa5uONaORIXZc+rEmWfZ9eAzETsIxEO3pl97BhqdSP5lwY2arTu6A9/Wm8btSdKMvc4UKseu2U7Im6WPK847HP3xC3DZ5zR/n1+q+bkbAnSEu/RJI0sQTsTREMQVAPSZ/waSmLAOiBbP95ew4wbLO0mDGDf22DpNmEA+k6bMvQEpvcvHXYwB3TdgSd348FCmUz6av9c/qqM7YtIsXsiDciSy3n7oYkdm54P6evhLz/kgA1+NMrY84vlT4SWpXaycuy67zJ3QL1VXytzl69ys/fV/7vsddzKLxt25YJ3pPW9ZSWhZM6XIDsn2derCDgWHea/yGuBlI9R+fs6IhqjDg1VrwsNXzLsdT94iBuMdE/XyOUzvzS5wIv0PHizLSUf1zUQRocSZAoEuF2AJp/Opf3hFVGa/CIUtT++JFNq8BS1AbIZnzcaVb8b6D5E3f2K6cYwaD7jM4F/wf16rnK52fZZx+3KX72DQekV1WU2pa4n0Xpk9zl5fvF5S9+jRIOgu1tKiFkbC1V4RAPaDtoC/Ek1nnnu30rzOZdUtL/Z1lZu4EMu/WtPYsT5xedXERYE9AecuD8LOoyGXE7x+mwO6lBxPPT1WQAtQR8ldv0rLkXOT+8TJfX49oOlCOawWOmjdrIJVmT3s9FW0TrfKFp4UZzpcqKEAGaV/hoFsOPeA+TcuDPHDWGedVA6TLcU1bdqV20hexj9CC2+ik0fi6paKYPJbpWSZLoebBohGr40YKwDaHhVi3XYJ/dlJ+gJULYghpdAnn5P7EI35OXPPz8jK2qIAZDdKns48SiU11twwtRKGsjHCvbVnAqmGmk7n0JTTb3Qc1fZRCGQp3SqltBjBpfRzMpWvBmrgVaj94d9NcfmgVkFJW929bQUjPompjl2jgU+I9z+s3n5/Q9/NV6kv6hRgLZI/3NAzT+dPfiWrkGTl+RMMlqbRvjIijMp7yTXY9DvGfyI5FbGVvnxJflXR+5z8uOP5F8JU9rpy0hFWPQ5+e/C/k/3RW7INlO+iW6hVCU8WltXrqBgVIgpZVd5NWCPnFQWrw213q5wTARZ1opLi6aJhXiCMx6OArRWmfLTNvqgqYFxKhBjxNRYpZ1mLdde63AfLKngpT8YMaQImalGlu6FEYDIczkPytGNyYvbN2IAOUUsMFyHPWGjkV1YC0XLx/LOBXSI4X8CqcBqziJWRzCF+19GW9g/960Qds8+tRuNVs3abZuQX9XKbc3Q5uSSKO2MMavIFUB9A9MexYv3lTBNKwbGFEteFmWuqOtZK3nmIEFTi5e8dBzs2YVLrm1DhTPat3zvMuLi4BV3ZjfGypEZnopw1c9PiXbS2qBDBZlG9Rxs97UbOWF0pqSnB+eEz4TbzwmdJRQ0FPznp63v9QNUygK5DOedacCHdroeE5Tuf20g5isIvISVClMLnjOz4VGb84YP1P5HoZs5mZvxvOOtc29AOOvtqWutlvCE/NeIMJpQnSoeIEbvVnXG0cXJm4ug+zIqHXt4VSu9q/ESfCK/ujSI5nG4Pz75pwoNcTTdY67UbVO+2fxkY7B7PQct8wl5+fMrskK+V0AloULEfQXo1Ec1aeM/IivQ4MFSSwRQY4mSO+Ui20x8cDXx62Zi5K7mCNsG3v2udImMw6wmYAuphJqvdwNxM64HWiwhPxO2oJoy65noLvUa8UenuSSNDDk9YstnPlpRm7qg2wfqcwYR9sQu0aKonJKpZBtG0HQ1KtNQsu6olZShxupjFDL4HBRjjW4hGktlSXVJpNIVFfzPWH6v0lWUP2XIcjiYRaqZDp6kOzFpg3WHzAvBZ4AURwx8A0zJckTB3mx3YWxOP8segrhkqqoF2OgBGHWiUlTgreY7YrBXb6btAx3kS7d29DiPHeXtkzl6/Col7SLRNm3qU1PlvGyynMoHYvyZLHOw3YH8U8nc3Rb2iEW3eqti+vTaj7scHoiobDf6DbFwbcPlI0vQpldOUe7LA4vs730P2xpoKjI3ZXpM6RLKfO9gSLIJz5TpVmx1jDbTpvtiP74+fK20qiYItcGifMNAUs2VV+urRlj+neWgCa1r0Va/bHrZVFTSeaw0lxCB4Z3WXvRIeVwN4faJIWolfWTM0qre9QwGjN1qDsXh7bOGsAV31o0qwUzIu8ZYNJP6QN2tpHYkL5daOHCT9gqw2czhvYRjaEK4ye2CnncaZqBBMn8gqFOtS77kpdNs8DzEBdllK8g+7jAvTuR1zfXRKNzsp48FXbuTyK1Ye2KNE3pOX3NI4QHd7xtNuOmjLpznThp38mwyWLJLJ1NNaglUDRS5+0Ls+J/6qqAG+aWB5mhHyZ1uf4o28nFFDUEkypFzg8j9kJqpCZWCLYZmkGnzymZ4fedVDlzrIgOqdZFDe65TiqJtoC+TQ82gK/VekYcxIXfMx+gbM3gu7/TmHCo2b5JrhwQLNg/ETjeE1I4gygZKfArF2jQid9hpxIpSjWWqghceh854waxsNRucECoDC7YMyJEDAkvQ3OYsHdlDWLt6KALsRXb2uXzyFi8Oegf6V7qrdHHQMO5UA+MzvjF84tqtD+aM9VQJunL+bKbIBnQuRl5uCiZaF1UZgixRvIPZfKxN+LxtpfctQaXJb5chNZabNiFg16+G67c7NFYlaWpleELBcauzhea0LH2HKUzlb+/uaBeeRtgiX+uiO4oi2VSgOburLIrSdoQqtj2E9SvZupvhxZK/3wPSliBLpUPC7F7K1PSPB+he04Z21fQPYHE72iGWvxZ8wG4nQfcj5iV9zl513wwvZKj6D2ImeLkWtMstlsoSShah40U8gVaoedEmqjyIUG8P4p2F+jF6pmzJvr9juhV2rUbxEVf8leBsnfv27JELF4hAaK4txXpELjciZ950nIEfGgGIWFycKmnhOrfG2iF0Lr2/btMPlZalcf+HjyoVLUKxBjA3PM5sQeUcCgmr3LJgLHAJq16oH5UQazWfNhZ6EmKYo2886k5b7z9/cdFhappM2HWcEzxb28p9TENDcDe/yCPT198ixi1WgDmGtQ0HzSbnSy9BT8gl+E1pDOgJnQO28g6Z7jOlWxwGsFswXm9n+Hvif9/rW6E0mWq1cp+1fw26pje7RvtJn5cXVNvUbroOcGqPSrhTalAdeqw7pUTZqY25rpSqIQQUc73FbyShArTtsov0ZtHwNx/eCuKj1wQAk5AiCnNJpJLfaagBLZl92Q9oNhzzyWGN1u7CdPYK7iTqcS+4j7C14Z8BZStuF0FZ9rKenOKCU6w2kUTJ7+bK/feelwCVlCKiOGakm/aCgS8QAYekmhEnHSwHMyGXG5myO9igX1mVB+MTX87XGGfE+JJRn2xTBvEbGE8JE42x7YEM/xhsE/6EG7eToSY6+Dec4oufjqtAR9d+/A2LW/S+LVM+pezJTYaXw/IUsSDUGMU4+kvdbkTtSdywt/wKXhNK6sXacEYFKbm5ek5qjTNRnhOw7ElcUaaaHlJ7eceH3tfZaFqBBW1ITQ128TLYyMH3ImCqqpwUU1tB+2FpDVi2V93z78FDaXy9PczwMHnxzVRVN8M7mGHbKFlxWapVyKdlSjKo7fMuk2KUGQMyZ40Qa/KlocI7P0tVUS6D1JC9hYQaebr6Xs9U6tIe0p1K+JbLKyhDLVCbiE4NeqeCgeI++aZDbcLLfRsnBl0hsoq6/mQn75bYRaBF77fLh8Lrtzp4XsnlsF1PF3QGXfHdwU65XaxhTcTWn//9mvaPiTXtGRf573hH8i+4WneNNZQNA9JGjiDubjOgORVF5DXN9ohc4pKt2rz7PvYeQPfCjPoFgF2Zg1oOpPAYh9XdQ7egZtHdUKcWRqoMG7bwmb9tjU1XZnjSQtppEeYI6ZaZGM3cr7p/DytNiZPnknDMuWskE0C1+xM2wtugFgoIg7dTt4WdN0cfvPBrhn2eHvWLxVQ15bLrm91/sELZqL7D67XkujHH9vT1tRFEYNzjd5wAaeRKnPjVfU/GcU+pt+Cyu8Y79nkv8/kpee8lzdPQuIH4aXuh6Nfh9iyuV3sH9EP48nvu5/NTZGkoeevExNB7sB2R82mAnoSJP0ROFqy4iRupS7PO2ct+O6obCrS9urDXjy298X3EU+NYf9ItTM5Pb9RkU/nnbtBkHWIvZbnRaCfkxNdnhn6nwn+wX5tFBPX2N374Jrjjpo3tKjeV7R6jRgownjPKPygrRZZUczoVgypA35SBS1ILOiIIDEiTtT/K1ob2VVW/8sRJKqdhtPWF3O3z5Yvzi10dmoSWsd6jMFaXfeBAwVvXQm4iLR5Jci4tueRzSVFYjBzRWumczWufDOSXO6QXre6msKsj/qdDpHeX8ZSVKnJw3v/2kXDJRFOCE2dhkK37+YQ8PbumVS3gNbnwDhEPFqX3JO4Xwcjc0WOb6JzaPC1xzLi5cir3AXjdoRSv58Z8H56GD9xc7Qm5Ws3nc9D5RtjFWfa5HwsIOKB2utBgFkqU7vR4W31k0uhW6P0InoVh7D1I5acfvI7xrGvGcX4aLyO5dXSeqaoujpx3hbsScq9wjKv375lm+p1DR0msT53huBlVNmzMSgtq6QNljfUx76Sl0th5wMn1Fr+RKXFUlyuqHyZDb9hV30lXGh4iR8RIa+SnTohS8o6ytp9yXLl1IuiodoyS37UKqt4vhbytmXyotQZqkucGG0ttk0px7vxRlIsHMzvc4lN1TXj5Yvz9ci9rcwwMHUafBo2P/V1wWMSvbvuOZZ6+Nzjkp8O5e4c8Z1yqJlWMs1dHYubJ75STpCmdDgOP7E+JAefuzLh1JN4I4eQeMQ1jYMysEeTMrU+YKsG4I9E2+41bFlyWcJ2YAYIbe5jmeU/ZggujKaZbJKagMb5ZUc0FZvBEPHg+/i7nhCITv3O/jVImM5xDNfXNhR5IIw6rk6ddPmcN2tSh6NZLmAHLgoqwSYhvOzw9Gyky9G6u4XucO6HEK19dklfwVflvuw8pl4aUYCkXESfDVDW297sR0pQ4em5m67GlXR4b4jH+kFqoapEtm+cNKWFGQwgodL5sY/ghW9NpxUvQgq6xkMuq8LiSp5Eb6T5Aqzv8GmZtFbj31RvLbYONGUmUsI1tMGzYdN/rmjSK1fPvMJoa0wyyiqmqcvcpzzE68dAJ7yX71loteen9Z20XuQrMaCJUqdjhgca7e8t+4WKjNbJ+Xl5cNbiuMenpYWR9u3peWf+Hmh7odzqYvP+tpiEAE79dNc/XOPcUE4r9zl9enJPzgULVRyNb19pQXbIfg4SFXV017DypIX0Xf1jIrY4r915EFFNV5q74GlTc7SodARficBlRjxbpuyX4kMERKs97LuBQOuwTaLt4CJ/zsgvljDjxqtRW46AMPMHLn07J6+ium5zPVDvd++KT757TBqIwWeMaWNP3IvjUrynEylvbLkz7EjeO4AiJesXLbYdIV11Jl5QLOgxkkM4VTrC+cgZaj0xa8HfoEF9/urhbMFaq0ADKB2AHJIV0A8PnkxGJyKti2pTlOrl/hldF0jqgHtzGwGGNzvd6qdJD1Fwl7HKwU2JXmOYYBQnc9LNXfc9V2pTcdpV1m75oAaPYYLtNxYYXJZvwwn4ifZZYag4uj2aVn3w+I09DrcTnRjhdecoFFnBgHtjZda2M++Yz8t3Q0SB3ozBXUq3kliFkgDXYzGK5DX1k0iajR3DB7aaFnrRV7u9DadJbmFO2Jp9GzTXBp5o+RFF+WHiLxVySinI507SCvekYNdU4tTd/n4Qt5fIClyXvVemTozdtAXtZZxGkyA3aF6YKOEbkspC2+8a9hxX5tZFoSr5TJQjylMvl5NvnhCv2nEzd/4H7PyqpWBtuJt/G44uW1cVM0MHk/NQ61LaGf3JBcFH0daGcXLfDr9Rsb6MGq7Ji6v86DXi2bRAMaHeQowgtq7Rydwezz+9+pxrIR58A/O23n9/9/ubD2bff+pzbJdWUj57JldJXKUuWb7xgv7cL9iNso04wKlMrEaFmJ22Xku45oMw9F+sMJsxMaZCGs5QCpOdKyoBxld4LEokPpAJarCgfDie+t3cAe5+nBuquT+oSddNMM10KOy2N1akr37FeO5tDrP+WJntH25qPfE7SQ4tdNoPBBipNKDbZ1L2EehcHYsZHHU0tqdkcsYeSGu1GFCFzt7wnLpQP7id4d8eFQz7o/x+Gq25UZj/570GOWNnz0QdE9iL5IIejjePuw0+pIyRtbe1szy59aruM9jbLDvtkPkO32+Dk3hyZbltW82PEw7Doa0a5cLxum7lcBJlxftqvbcNOXM4ctDCPtDAYzypsc64LpyIeQM8hideYbh2qj05UVTVy1xM1wE4e1rjpvti9h2v7d4jr1B1u5jDN+r64XVJZ/ruKR802uFlq+SGS4d7YDRfeQs40puaMq2RZosey4BH7FdVyGHR47KgbWdWFyiWML9+/uyC/eT/qJik1jsiXo6YSXP7HW/KlAT3Su7URstCw26kzb3JDzyG6Jh/aorNoWlenpbOED2kfqEo9RsABrQ9yHN0E1UaCY/eGW6Yf0EAF1VWG3XJgM7gXaJ2wALkD2pTJptJuwUzb7WoLdEntrlZ4X7hTkGxRUZ2qrKSDu67pYHzxvaNPlA3SqZLALBbJzwKDWdoCqg7wbI6tljKAVdM/MkCtafJJGL7jVPLjhUH3gqd+cELntgqc6pkcaVlQhoNR0pefONhGJjTee4Cn83r5k7y2i+TvO5MFs7ooTdK+6z3oDvJhkadbAF4KmlxiyALknMuERZFD0Dlyo2UxK8yKW5ZcfshiJtTK0Cp97koftrTLfNAzRF2YLLjMKU64rEFX03WyhPcB7Jpd5QG+pCLHWeF1UWtlVZE+JIXQlz8V6HFMD1tku5tCzYsyB7Md4PT5b0wWFb0urE3lNtgG7E60gAyPQsVlJqS5zId0LUwhpqJIHRbdgv19RuDJO4P3YKfuhdiHnbqqtw/754ywX2WE/S8ZYf+PjLD/mge2VbWgU8ghUjro6c0zWVSNQOV7us7wTrbA66sMeknVCD6v6jzat9MyqZinTkIKkHkOpcTAF5beNyIL4xMSM+yg0SyPNekA57Emzdo0dYZZpEx2ZdVZTFWrrDM94DqDCLHKOsMsF2w0a7IAbyS/llQqAyzDIVy+clzJ9CgsX6naLoCWGdxqqqoLJjL4sB3gDEEShKuna5veLeogmyyQ66bIENNgmlvOqMhQQGQKOgfJ1gmzrvqwJRXrP6Gc5sB7WWAb0CyQfTuYPFj7xNos0Kfzevkqjw/aFFNu/5ql0RgzRdpZcTuAtUouqk2Wa45Qgen0VW7G+/iTzdrqAQa78H7+9M4RDxzVvizAfTf5dB3kerBnXEAOG8YUsxybyGcpi7O3AefQDUzBa0xSLLKIOl4vfyqNrQfN/BPBNpplgS34DHKYMQYdzRWUPFnB6DZsLvOckkqVjQDDVA5uB+B8nkE2qdqsqE06878HPZZBngSwhjk3VtP0npAN7Awan4Y6F6t1Nl4b7ESuM8lXn5nvj3gG6FYDrTIokr4UKBfa+ZTr1UJxU/gJs+mhr6mmWQ54OVIImwLy0s+3Tw2XG0tl8jnHpbHTRqcaFthCBT8rKAfUJjmu6fXotiY5NVic3DBLP+z60E4D+2DOaVmmvgO8TB1WbVsHZXiLeFUwrVSVpSuRA5zBTONVkSc5MnQ8ysHm+ip5e6bapG9ZymtTa54YqKCW2yZ59pngEtK12NlANUkn6nRwsfg2vVtLKN/1tJgJlfw574BnSPl3Nm9yqeOAZpA4zobOgGry3ASh5lmOrpxnucC10qkFWDVt5jmuWcUNyyEWKpPlwOaYAyHBYnOl5HCTy3DfADp1xp+HmjodT65WqS2QLBVlyg+ATm6JqvSakdJ8XkTmcd0b7kqCTv9m1YUfypscbNLJ1BuwfsRrlkOWoXAzzMRJLQwC2NTSoC68Iyk5utQY92HBFqnq/Aeg4brmyQMBNehqrqm0g567KSCvsgBO//T6TmSfPu1MAU0AWKt5QU2dcGBAH7SmqaFqoCKHfqeBIR9819FMwNMz2UFO28K1B1npMgPG6R2ZJoNv2HjfcIZ8AAOpEwH8wOMMxomBL+kPQKxBazKoGUwpw+cZBK+pU3vZjGY57oFmZXJF2mgW64qbALBNN2KrD7MxybtqLplMXSgRnRZ7X6C+SWdq8u3cpj9WHmj6iF430zM13HWdvFtrU06z5KE3WmR4CxsDuih56qr3LGMr2shQDjZYZiytUnuDlwWXxtJZBs1gybXNoYYva5mhdZNVupEp3ayxtmiRjqJvGqvIh0aSwdJd9kjGYXmfqeAlOdFQcktOqC5DN0OD7d/j6PjJWRm5NDYhFMHgEH2C/Q2YEiRWqtPlQ3CZj3NnVS3UGgaDBW/k30w1yZp63/KMOR56nxHOO9Mwh2tS0d1GC5tYrJw3u8NAsiMpuMHhDO3qYeuxgRIxTV0rbcmw8SghqwW1hFtSa5iNHYV7pOXeZQhFjPHB6uhQIFyGzu4jfaEFl7kn8vdQdav18TTEqjnYBejJ5vtmoZrBi0aIhCXobhyRVaSm2gB5B5biRHB/V2nHgqdv1dy8uPBlr8/IaRjx9ZzYRWRKETYD/gBh9DGiLcl7sL9zK8HE93l4qLMwb4Yju7tbhIt7Yg1QzRYTLnkUP5y5e4T+2jviE2dhYDLEC0EbibN+5w3OcW2buMcbuO/0a99DU/523B1NXRPuML94xNh3G1EkrGm6XedVXJZ8hGuLt2LMXXCMadQjAmkzuO49TqiWYmTiJXbPzTgOHPvnGrBEw5cGjN3TtPvwbOW798r3KgOO5fGreom965Hq8k633Sn7cPIYYWxs6+/Yod28jlKecvb/zfMN3WLnp61QwLXjZwOthnRJvHc8wu5xmVIDxKdrd9iQwa3qdin84mHwld0o+A5zpX37+igbCaGGGAAcd0b3z6vSVBrKjjDed9Bh2i8tUe3dHBrWaJyAtg/pGnTFvbpxLKQ3S/rBHHzJBcyBCFiCINQYPpd+4zbz+uNHH1syP6D8xvX3nPTpg0x6dpg1kn9pYHdMIo1fvh6+h3VMPGwKSqvR8NJfSKakBMytICtuF2OCgpBIZUinsWs4qLzozqaFYyfKk+6JEmrOGRXEYTBi+iAWD4sdLjUypvHheFcv1iaOXi+dbaV2slpTP/BUcGqKhcpuE3gjrjPXcJbKZqiRk4r9ETzxfgDEXxqHLb5pYRALE0D15I0wyhniW/ftFIPl5Nfwiwl5I9fdvwbQLdryRlpCywlTVd1Y0HExnMWN7wjLZ559s7sXOGNxa0O4/Wfz8vsf/ups39PedrQc+yaKdjinRdqI2W0dN3QNmvxL55MzLwIaiFz81qeu/8l/5uUG561Tv3c/Dkxevkm2PdkdmOLWmZD3v308c7SDBu88QX9pyQ3TUFPJ1k6rDOqZ2M0FIcih5+Tju9fkXNofXz4n5+9Pz/7zNfl0Lu2rn8jT1WJNJHC7AE3YQpkwKk1pDczit3549b/+27MnUY6AXWSUcbv8QJk6qWh8HI/JfPrueM0v/Vk8b5GKX/HycSHdl003YH5gw7hbP/AxfHcU04118plr21BB3r55H0X2TyUhny/rsJPxf5SESZy3Dt2vRoQiITcLT9yCx/gG79mHObWwog8wIh1P9wV5U5Ya/bT+lMfQ6Z5eVtWHxjnvGws5P3l34V+l0fBYRc0Rox9bTiWvqYa3m5xfOFRGvF+OhwdOgkjCQ7f2OA9bTazw07WOKyB66NKy5O7LVGwCtr1Z/vF37ogHwJmEeMFVuOGn20dggMom1zqLXnfbJ42S9wHDC6VtJ5IHQrfEABtuALfrmyWvOTLvPT1cztvHpCXr3RjjJcTsxmN5cQN2aPlSYxTjTuX0fqOBjkOcXNZUzmHSmU5MyRmfNxpKMl0jTJAlZg3F5Ux9YOuBQdHoiLYcXXSWod+BSKj790u4kjsANFTKQhEyu9PnGaVnbSlNQQufip8BdG11HuCzDEdilqFaWOS4Drn6n9QZmErLovXE5VPLdy14R8dkd7W+M+EBNNgzuwAtwZKP6xqek0/tM/YWHWA/kovWATZ4CX4b09TaUT1HUCZGTOMW6eAXf06oEFFlot58ERPcqMbEvCVo9wZyaRUxFh9zLsmn81GBwjBBNpu8Si6yHVBVZxj75gBrMKkzeh3YDCUu/kVMnYqO/vYM2PrRCoUAOU8+KRJxdspHRi10RAP1Kg8VvQCMJAzTCWaEkl+UXlFdDud0E/JmjslemlB3468xl24KdgUg46pn4q6Jd41xK0tFP1TnkSHYMh4zIwYUchnyXDEtoeLWiaUwYiNO4lJQeYw4/i0clG2CSM9FOSBw22W5iaQsnQU7RwN2++VJHakEhl0Ilun6wd0uYk+15awRVBPsF01aJJ6eXb9+q+ZqNotPfwdW2AVk394tZD+6Bf1t7OF95vB26L5p7AKkDcnio2ibJmXnhNsl9Pglx1H/ZECPIqway9RxOR2WHEf4smEMjBnBGTuPH9Yc7bDEE8SLOBV3rvSaRAoTBrgdQzht4Qg7ODqphAE+Uyvp3hUnt2LKYfdDMlCUtqlaputHN/JuUuK7lmLNgOBQdvQEP8yOPswlMdw2EflJsLgAgogOUBfUEFqq2r0udgFcE7WSmy3zjLP0WklVjeTV4kwOw32L+uMqEU6557J08kdp0zGAkl+4APImIDYZsOE2zl7ZEebv5GjCeEf/g6QrjLLgMmQtpOVCjMYII1LWu9+DET5f7zLUa6TmxHhC6FTlrB6IED+FBV1y1aB2yVRVa1XxkQxFODZyZ5JOBRaRzcjJfty4XHZiJyOSuxhuaZ0kisAWhkmHyxyAYGT9Dr/cu9t7ZTf3bfTYbcosG2l3y9lSa/QlloEX7BCz/lZaEL7Hc5CgOWtJQoZgot9uagG3C3xqY7PdSEB2wn6YGKvHg58tTYe03Xowml7upymoF36tjHRFTdPOCLe8AuPkutf2NNQwGkQKu5CsKcSNG4GNB++5DfqWR+uQ3t0PdrR+vB1NPxQm2ZDTW5MWHMY3UTigDSneCIRbCIOvl7qXN1Knj7p3/qIloU3fvHPJeqkeR4DcIMc7AfL1Hscfb96yVKMNjrNlt5OP+qgSJOUdu4X8OOpxTEnb4DB2Sj2WoO34qZNX7jR2UVRgF+oBoiR0y5NMPBrha6Mbjr2UtMrqddoT1fmgRPDXOkT2nMtMnpD/nPz8/ffk6dvTNxfPyCk3lst5w80CSiyFj+Ii1Fxl7wu0LxKG2bIzj0fYZvziSMaYVpm9ivvqP92uxjDobgx65JMNfb7LdWGY9t/V/fYcf4hTLGZKZaxN+iZTjIpU3el2CPlAS94YvwJRmhhecUG1F09ObLo7xPBdj5dX4T03vDxmp5F+pvwndxBaL+JOX8zNJc9XZ/FG7rvrGNYIlYY9/29wEuEng7MQHDfQK8so465MpXMmBgxCNshqpedU8j/3ZFXLfEfhtsw+gNP9MzXC7hnX0VrSTF1/fnHL4WvhW3z53kVbWc2/AhV2wagGUmsoVcUljRbc9cTTBbUcpDU3pscLekxq39IHJda3foQ608F1V+eJE1w11RabIW1I3S9Wj9jsKAib20jUGZSgqYWySJZUtud8OOHzS7tiFzy70GrJy655WPgerWsRNNXBwQjNf9yztq3TxhWcDZG8PBKV3ZKh159dj5AZHR6KmZNL7qPni13FfaQFXKd0phwKflfNE65RZ+r9qFcJPY8Q6nVU1FipIcYq7SW+g1aBpbjaE/zWxH3rSZz6ipelgONJuXe43m3lXGR7e3LvIDnXjsc4DrkXYbVehyG5bqOzz0ktqNsy9z4rTUAyva7HvPyYCnkEe/IWGXS6sy1/VcaSd5QtuBwx6UqaSXJ8s8vrTxIz/WsNTnw4/cg3OTMT8rakNfmM//D6Uamkrzv95/DxJAu6BKc5CaCafGlArwn2IDS1kgZajSpenOroLfA3x5GXoQcec5A1b7tASk++78s3jmdL0hFQ3RygD6E56m0xxSlPeR1mu2e8bS291cTI2Ybh4eWG6EbKqB1rnncvj488+zZSIzV2AWIRLMz8G0HJistSrQwxNTA+48x98jxWJxjyZIcXxJHn8d3k3JCn2BEWJNs8Qxi6fNbjFmkkvuNvYU7Zmnwy241vuwhstVtImzy71q1wBIN95LXvm1qICtaq4SFzL+KA410fgEj1/1alKZbzDNm3TXZ+hXqsO69XryMUI4XRgxZ+cwCxx8nrHSM1ZPgG13sr686Q9PEuoENqjuOw6wIG23uzScj02zDYoXhDipuLn7FsIOVIwNEKNyS5hBmXwVePwgm7+lW0Hmk6iNgdVCiWCbeNA2ZH/UstGDufbW7aQy+lkd6UnQ/bWsoW1ZFb4G9WRYaTgXXU344sQ16mXKabIJb0bjiSsagw7+MZEVL9sh3cFt9Ge1PeH5naOcA679t3A9Y11e2Zcn9+viFlteCDVurE3Q5ny/rk91uRZ5PPLPFtLZRe59vwv5mayn+7sWNMi8h2F/VWPY89TY4tf3uB0G+g7cFUogFVbb/1/VSNnoICpNWqPkR0lKqZDpwLtzrjYU1nbcMN5QiIo6/uOO49PFFVTeW6u4947XCcvrdXlqDdM1RwOVNxpYCaq9w1QjfIjx0rssVsBXm7os++5MoR+KURYk3+o6GCzziU5BTrnr1zMIrKCqYFU+qKP1DQ/XeYEr/+xn6mYkybT95tdhMOrxuLKveBI0xvvusfuiXClJ3gjvY++Qn5uK496RvPgWOO38HxzdMwK5I2k91B2+HgHRH6iYm1rd1F5hiuuk653MbOexZrpVtvP4aYP7wd2fJer5zEx6nlRZ13DtEeVriVb/Tct2hqpTJpIttIuXXcfpCa2rhrksmCmpTR/h5gHcrpE0NutEi4zT2oCXelM0aLRqfyhvRgGtAFnaezKTegkz9P26CTpj9ugw6nPoNggWsLElWr9MaJg5/sNHeK3kLDTqpMao3KL3GMWsItmfsRl0X16kX475OAwovwHyGvKeb2pwJ0PDsvkPOA0XNPTD94jh7X3qi1ATllGIjmTCouZ6D1SNx1SPdR6Oor/jeyPuqePQKSbV/iWW8bIlcKw9oq65WKLHG043fm4/bu2H3EDGLd/9M/YJigNT7wk9cL0MfxRzidPWQ8PT3B0Y/PyAmuH0cNtD1Ss5QRPp+ADsM/YSsLc09zXsgaOu4xsrfhbtEnptcpeu9O8z8P9UrevTVKfLfJJf8z7q3hV5lkyvk/zoiEubLcb2C9oGZkApRhx24r1NtKv/j4cEG31dkmQA0SXHbOWNs4va2/iSekGD4/RkXFdn+jburhx9FBy06acGOa5EonQsZkqXzeuvvFUBBD0DqrD3SwKX3peeYWJ5cYnN4nnY6SIdF1Bg9R5KeXmNq5/zHqSc/DkLy79NyD47gINUYUy5wv+m5INTiyo8iUhTt6tEneptHkAsyvIFjUmZobfLMZV9J/kFC2/kQMxuuUJueXb/7x7oJcuHeK/CZHpq9ssM1USX0Ith9XKo4tiiG2AHZlDnIi304I5+1BFhs61/Xr7FqEYRpoGEG4kYJ7tFzQfNAU8gGUXI9H1xVk1GhAnC21zdEmfPaxXFLBS38QI0jsCsKjdbXeJwiRY1ewNrtiO9HJbxNIE8NeWFubguMM2iygcStzMITRR3Cb+Fy2lS9Kc7u+4UYxVVVZ+8TdEm+PR3AIxUvwV1yD2LU0U7tYVoLKwpiHGnjrVvYy/PdAbVujFcXWlxoXteLHSKuOIewxIIgBIhW3BpCtbEGlHDTOyN1uKqyKiIzEbI/Utrl7WMLMw9/fvnkf3r0XO8t3D4pVetf3n7xnGzdXxVKJJhcD3rRznGWYc9NNxm7H+TaSW0OeeiTMM+zWgYW97UTdHfAEkY5SI5pM0uxtwPWT5DakC0y2iw6WoDFTYNYIwpRkUFtnKF/6PRxpr7Ba5ZS+nvHOYG9HaDtEa6UtUY6/v/77m1gKbpTtqc+d0vPjJ1juFhhsuVin1Dc7iTaK+fvZbxfnF+Qdva64LLux3vFtdbQdPQ1za4jiCFmBjAF1+8jq1Kd4yWLy9Gxf5VjMjlew+dBF+C3J2dWOLWdZkMrnp6FLb8BiL4bieJvywL0CWoqr//J1w11hjiyHmmTq243+EmdCP1B2YxhXjVZ8F9StfHHvc2KaSIo6NeRvxmol5/82FZRdCW4slH97Ef72vPuUyxmw+EczrmFFRVSRoVPR+w2hsiRGkZFjqWHOjdVrZ9kfU1jU1C5Cs/4OB7KLwwBJdEodC01fCO3rtZjSvS7knT7ZYQ7S6vVf/m8AAAD///snugo=" +} diff --git a/x-pack/filebeat/module/snort/log/_meta/fields.yml b/x-pack/filebeat/module/snort/log/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/snort/log/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/snort/log/config/input.yml b/x-pack/filebeat/module/snort/log/config/input.yml new file mode 100644 index 00000000000..cd99c6e04da --- /dev/null +++ b/x-pack/filebeat/module/snort/log/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Snort" + product: "IDS" + type: "IDS" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/snort/log/config/liblogparser.js + - ${path.home}/module/snort/log/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/snort/log/config/liblogparser.js b/x-pack/filebeat/module/snort/log/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/snort/log/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var dup3 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Impact: '), Field(p0,false)}" +match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); + +var dup4 = // "Pattern{Field(hfld10,true), Constant(' [Impact: '), Field(p0,false)}" +match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); + +var dup5 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var dup6 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Classification: '), Field(p0,false)}" +match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); + +var dup7 = // "Pattern{Field(hfld10,true), Constant(' [Classification: '), Field(p0,false)}" +match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); + +var dup8 = // "Pattern{Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); + +var dup9 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" ['), Field(p0,false)}" +match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); + +var dup10 = // "Pattern{Field(hfld10,true), Constant(' ['), Field(p0,false)}" +match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); + +var dup11 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); + +var dup12 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var dup13 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var dup14 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var dup15 = call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(" "), + field("p0"), + ], +}); + +var dup16 = setc("messageid","Primary_Detection_Engine"); + +var dup17 = call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_"), + field("msgIdPart2"), + ], +}); + +var dup18 = call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant(" From "), + field("hsensor"), + constant(" at "), + field("p0"), + ], +}); + +var dup19 = call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant(" "), + field("msgIdPart3"), + constant(" "), + field("p0"), + ], +}); + +var dup20 = // "Pattern{Constant('at'), Field(p0,false)}" +match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); + +var dup21 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); + +var dup22 = call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_"), + field("msgIdPart2"), + constant("_"), + field("msgIdPart3"), + ], +}); + +var dup23 = call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_"), + field("msgIdPart2"), + constant("_"), + field("msgIdPart3"), + constant("_"), + field("msgIdPart4"), + ], +}); + +var dup24 = setc("messageid","HMNOTIFY"); + +var dup25 = setc("messageid","SystemSettings"); + +var dup26 = // "Pattern{Constant('['), Field(hpid,false), Constant(']: ['), Field(p0,false)}" +match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); + +var dup27 = // "Pattern{Constant(': ['), Field(p0,false)}" +match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); + +var dup28 = // "Pattern{Constant(']'), Field(hversion,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hevent_source,true), Constant(' '), Field(payload,false)}" +match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); + +var dup29 = setc("messageid","Snort_AlertLog"); + +var dup30 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); + +var dup31 = date_time({ + dest: "event_time", + args: ["month","day","time"], + fmts: [ + [dB,dF,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup32 = setf("msg","$MSG"); + +var dup33 = // "Pattern{Field(threat_val,true), Constant(' ]:alert {'), Field(p0,false)}" +match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); + +var dup34 = // "Pattern{Field(threat_val,true), Constant(' ]: '), Field(fld1,true), Constant(' {'), Field(p0,false)}" +match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); + +var dup35 = // "Pattern{Field(threat_val,false), Constant(']: {'), Field(p0,false)}" +match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); + +var dup36 = // "Pattern{Field(threat_val,true), Constant(' ] {'), Field(p0,false)}" +match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); + +var dup37 = // "Pattern{Field(protocol,false), Constant('} '), Field(p0,false)}" +match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); + +var dup38 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(') -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); + +var dup39 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); + +var dup40 = // "Pattern{Field(saddr,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); + +var dup41 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(location_dst,false), Constant(')')}" +match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); + +var dup42 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false)}" +match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); + +var dup43 = // "Pattern{Field(daddr,false)}" +match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); + +var dup44 = setc("eventcategory","1003030000"); + +var dup45 = setf("severity","threat_val"); + +var dup46 = setf("event_log","hfld1"); + +var dup47 = setf("hostname","host"); + +var dup48 = setf("hostid","host"); + +var dup49 = setf("event_counter","hevent_source"); + +var dup50 = setf("sigid","messageid"); + +var dup51 = setf("version","hversion"); + +var dup52 = setf("sensor","hfld11"); + +var dup53 = setf("context","hfld10"); + +var dup54 = setf("fld10","hfld10"); + +var dup55 = call({ + dest: "nwparser.signame", + fn: RMQ, + args: [ + field("fld10"), + ], +}); + +var dup56 = date_time({ + dest: "event_time", + args: ["event_time_string"], + fmts: [ + [dB,dF,dH,dc(":"),dU,dc(":"),dO,dW,dc(" UTC")], + ], +}); + +var dup57 = // "Pattern{Field(context,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); + +var dup58 = // "Pattern{Constant('<<'), Field(interface,false), Constant('> '), Field(p0,false)}" +match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); + +var dup59 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); + +var dup60 = // "Pattern{Constant('{'), Field(protocol,false), Constant('} '), Field(p0,false)}" +match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); + +var dup61 = setc("eventcategory","1103000000"); + +var dup62 = setc("eventcategory","1002040000"); + +var dup63 = setc("eventcategory","1001020206"); + +var dup64 = setc("eventcategory","1002000000"); + +var dup65 = setc("eventcategory","1001020200"); + +var dup66 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" +match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); + +var dup67 = // "Pattern{Constant(' <<'), Field(interface,false), Constant('> '), Field(p0,false)}" +match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); + +var dup68 = // "Pattern{Constant(': '), Field(p0,false)}" +match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); + +var dup69 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); + +var dup70 = setc("eventcategory","1001020100"); + +var dup71 = setc("eventcategory","1001030000"); + +var dup72 = setc("ec_subject","NetworkComm"); + +var dup73 = setc("ec_activity","Detect"); + +var dup74 = setc("ec_theme","TEV"); + +var dup75 = // "Pattern{Field(context,true), Constant(' <<'), Field(interface,false), Constant('> '), Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); + +var dup76 = setf("signame","context"); + +var dup77 = setc("ec_subject","Process"); + +var dup78 = setc("eventcategory","1001020204"); + +var dup79 = setc("eventcategory","1001030500"); + +var dup80 = setc("eventcategory","1001020300"); + +var dup81 = setc("eventcategory","1001030305"); + +var dup82 = setc("eventcategory","1104000000"); + +var dup83 = setc("eventcategory","1001020205"); + +var dup84 = setc("ec_activity","Scan"); + +var dup85 = setc("eventcategory","1002010100"); + +var dup86 = setc("eventcategory","1002060000"); + +var dup87 = setc("eventcategory","1103020000"); + +var dup88 = setc("eventcategory","1103030000"); + +var dup89 = setc("eventcategory","1001020309"); + +var dup90 = setc("eventcategory","1301000000"); + +var dup91 = setc("eventcategory","1401030000"); + +var dup92 = setc("eventcategory","1003020000"); + +var dup93 = setc("eventcategory","1001030202"); + +var dup94 = setc("eventcategory","1001020308"); + +var dup95 = setc("eventcategory","1001030301"); + +var dup96 = setc("eventcategory","1001030304"); + +var dup97 = setc("eventcategory","1001020306"); + +var dup98 = setc("eventcategory","1001030302"); + +var dup99 = setc("eventcategory","1001020202"); + +var dup100 = setc("eventcategory","1003010000"); + +var dup101 = setc("eventcategory","1001020305"); + +var dup102 = setc("eventcategory","1003000000"); + +var dup103 = setc("eventcategory","1001030201"); + +var dup104 = setc("eventcategory","1001030203"); + +var dup105 = setc("eventcategory","1001020301"); + +var dup106 = setc("eventcategory","1001020304"); + +var dup107 = setc("eventcategory","1201010000"); + +var dup108 = setc("eventcategory","1303000000"); + +var dup109 = setc("eventcategory","1001020203"); + +var dup110 = setc("eventcategory","1204000000"); + +var dup111 = setc("eventcategory","1001020307"); + +var dup112 = setc("eventcategory","1401060000"); + +var dup113 = // "Pattern{Field(threat_val,true), Constant(' ]:alert '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); + +var dup114 = // "Pattern{Field(threat_val,false), Constant(']: '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); + +var dup115 = // "Pattern{Field(threat_val,true), Constant(' ] '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); + +var dup116 = // "Pattern{Constant(''), Field(p0,false)}" +match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); + +var dup117 = setc("eventcategory","1003050000"); + +var dup118 = setc("eventcategory","1001020201"); + +var dup119 = setc("eventcategory","1207040100"); + +var dup120 = setc("eventcategory","1102000000"); + +var dup121 = setc("eventcategory","1003010800"); + +var dup122 = setc("eventcategory","1603090000"); + +var dup123 = setc("eventcategory","1003040000"); + +var dup124 = // "Pattern{Constant(':alert '), Field(p0,false)}" +match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); + +var dup125 = // "Pattern{Constant(''), Field(saddr,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); + +var dup126 = // "Pattern{Constant(''), Field(daddr,false)}" +match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); + +var dup127 = setc("eventcategory","1605000000"); + +var dup128 = setc("dclass_counter1_string","connections"); + +var dup129 = date_time({ + dest: "event_time", + args: ["event_time_string"], + fmts: [ + [dB,dF,dH,dc(":"),dT,dc(":"),dS,dW], + ], +}); + +var dup130 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' MAC: '), Field(smacaddr,true), Constant(' TTL '), Field(p0,false)}" +match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); + +var dup131 = // "Pattern{Field(sinterface,true), Constant(' ('), Field(protocol,true), Constant(' detected)')}" +match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); + +var dup132 = // "Pattern{Field(sinterface,false)}" +match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); + +var dup133 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> '), Field(p0,false)}" +match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); + +var dup134 = // "Pattern{Field(protocol,false)}" +match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); + +var dup135 = setc("eventcategory","1605020000"); + +var dup136 = // "Pattern{Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); + +var dup137 = setc("ec_subject","User"); + +var dup138 = setc("ec_activity","Logon"); + +var dup139 = setc("ec_theme","Authentication"); + +var dup140 = setc("ec_outcome","Success"); + +var dup141 = setf("filename","hfld1"); + +var dup142 = setf("username","hfld3"); + +var dup143 = setf("hostip","hfld2"); + +var dup144 = setc("ec_activity","Logoff"); + +var dup145 = // "Pattern{Constant('>'), Field(p0,false)}" +match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); + +var dup146 = setc("category","Session Expiration"); + +var dup147 = // "Pattern{Field(fld1,false), Constant(']['), Field(policyname,false), Constant('] Connection Type: '), Field(event_state,false), Constant(', User: '), Field(username,false), Constant(', Client: '), Field(application,false), Constant(', Application Protocol: '), Field(protocol,false), Constant(', Web App: '), Field(application,false), Constant(', Access Control Rule Name: '), Field(rulename,false), Constant(', Access Control Rule Action: '), Field(action,false), Constant(', Access Control Rule Reasons: '), Field(result,false), Constant(', URL Category: '), Field(category,false), Constant(', URL Reputation: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); + +var dup148 = // "Pattern{Constant('Risk unknown, URL: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); + +var dup149 = // "Pattern{Field(reputation_num,false), Constant(', URL: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); + +var dup150 = setc("eventcategory","1801000000"); + +var dup151 = setc("dclass_counter1_string","Number of File Events"); + +var dup152 = setc("dclass_counter2_string","Number of IPS Events"); + +var dup153 = // "Pattern{Constant('-*> '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); + +var dup154 = // "Pattern{Constant('> '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); + +var dup155 = // "Pattern{Constant('From "'), Field(sensor,false), Constant('" at '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); + +var dup156 = // "Pattern{Constant('at '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); + +var dup157 = // "Pattern{Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); + +var dup158 = date_time({ + dest: "event_time", + args: ["month","day","time"], + fmts: [ + [dB,dF,dH,dc(":"),dT,dc(":"),dS], + ], +}); + +var dup159 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' '), Field(network_service,false)}" +match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); + +var dup160 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" +match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); + +var dup161 = date_time({ + dest: "event_time", + args: ["hyear","hmonth","day","time"], + fmts: [ + [dW,dG,dF,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup162 = date_time({ + dest: "event_time", + args: ["month","day","hyear","time"], + fmts: [ + [dB,dF,dW,dH,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup163 = date_time({ + dest: "starttime", + args: ["fld21"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dc("T"),dH,dc(":"),dU,dc(":"),dO,dc("Z")], + ], +}); + +var dup164 = setf("msg_id","hfld3"); + +var dup165 = constant("1003030000"); + +var dup166 = constant("1001000000"); + +var dup167 = linear_select([ + dup3, + dup4, +]); + +var dup168 = linear_select([ + dup6, + dup7, +]); + +var dup169 = linear_select([ + dup9, + dup10, +]); + +var dup170 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(p0,false)}" +match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ + dup19, +])); + +var dup171 = linear_select([ + dup26, + dup27, +]); + +var dup172 = linear_select([ + dup33, + dup34, + dup35, + dup36, +]); + +var dup173 = linear_select([ + dup38, + dup39, + dup40, +]); + +var dup174 = linear_select([ + dup41, + dup42, + dup43, +]); + +var dup175 = linear_select([ + dup58, + dup59, +]); + +var dup176 = linear_select([ + dup67, + dup68, + dup69, +]); + +var dup177 = linear_select([ + dup113, + dup114, + dup115, +]); + +var dup178 = linear_select([ + dup68, + dup69, +]); + +var dup179 = linear_select([ + dup67, + dup124, + dup68, + dup69, +]); + +var dup180 = linear_select([ + dup39, + dup125, +]); + +var dup181 = linear_select([ + dup42, + dup126, +]); + +var dup182 = linear_select([ + dup131, + dup132, +]); + +var dup183 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(version,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, +])); + +var dup184 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var dup185 = linear_select([ + dup136, + dup134, +]); + +var dup186 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' '), Field(product,false)}" +match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var dup187 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" +match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var dup188 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,false)}" +match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var dup189 = linear_select([ + dup148, + dup149, +]); + +var dup190 = linear_select([ + dup153, + dup154, +]); + +var dup191 = linear_select([ + dup155, + dup156, +]); + +var dup192 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup193 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var dup194 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup195 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var dup196 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup197 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup198 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup199 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup200 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup201 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup202 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup203 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup204 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup205 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup206 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup207 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup208 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup209 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup210 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup211 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup212 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup213 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup82, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup214 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup215 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup85, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup216 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup85, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup217 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup218 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup86, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup219 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup86, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup220 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup221 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup222 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup223 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup224 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup87, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup225 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup88, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup226 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup88, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup227 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup228 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup229 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup230 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup231 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup232 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup233 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup234 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup235 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup236 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup91, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup237 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup91, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup238 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup239 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup240 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup241 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup242 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup243 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup244 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup245 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup246 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup95, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup247 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup95, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup248 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup96, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup249 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup96, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup250 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup251 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup252 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup253 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup254 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup255 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup256 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup257 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup258 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup259 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup260 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup261 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup262 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup263 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup264 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup265 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup266 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup267 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup268 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup269 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup270 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup271 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup103, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup272 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup103, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup273 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup274 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup275 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup276 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup277 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup278 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup106, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup279 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup106, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup280 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup281 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup107, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup282 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup107, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup283 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup284 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup285 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup286 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup287 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup288 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup289 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup290 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup291 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup292 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup293 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup294 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup295 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup109, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup296 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup109, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup297 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup110, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup298 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup111, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup299 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup111, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup300 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup110, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var dup301 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup112, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup302 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup303 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup117, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup304 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup305 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup118, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup306 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup307 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup308 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup309 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup310 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup311 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup312 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup119, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup313 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup120, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup314 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup315 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup316 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup317 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup121, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup318 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup319 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup122, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup320 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup123, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup321 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup322 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup323 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup324 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup325 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup326 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup119, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup327 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup121, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup328 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup329 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup120, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup330 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup331 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup332 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup333 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup334 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup335 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup336 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup337 = all_match({ + processors: [ + dup66, + dup179, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup338 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup118, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup339 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup340 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup341 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup342 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup343 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup344 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup345 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup346 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup347 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup348 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup349 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup350 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup351 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup352 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var dup353 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var dup354 = all_match({ + processors: [ + dup130, + dup182, + ], + on_success: processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var dup355 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + dup159, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var dup356 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + dup160, + dup185, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var hdr1 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z %FTD-'), Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" +match("HEADER#0:0055", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ + setc("header_id","0055"), + dup1, +])); + +var hdr2 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z '), Field(hostname,true), Constant(' '), Field(fld1,true), Constant(' %NGIPS-'), Field(severity,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" +match("HEADER#1:0056", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %{fld1->} %NGIPS-%{severity}-%{hfld3}:%{payload}", processor_chain([ + setc("header_id","0056"), + setc("messageid","NGIPS_events"), +])); + +var part1 = // "Pattern{Field(result,false), Constant('] From '), Field(p0,false)}" +match("HEADER#2:00010/2", "nwparser.p0", "%{result}] From %{p0}"); + +var part2 = // "Pattern{Constant('"'), Field(group_object,false), Constant('/'), Field(hfld11,false), Constant('" at '), Field(p0,false)}" +match("HEADER#2:00010/3_0", "nwparser.p0", "\"%{group_object}/%{hfld11}\" at %{p0}"); + +var part3 = // "Pattern{Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(p0,false)}" +match("HEADER#2:00010/3_1", "nwparser.p0", "%{group_object}/%{hfld11->} at %{p0}"); + +var select1 = linear_select([ + part2, + part3, +]); + +var part4 = // "Pattern{Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#2:00010/4", "nwparser.p0", "%{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var all1 = all_match({ + processors: [ + dup2, + dup167, + part1, + select1, + part4, + ], + on_success: processor_chain([ + setc("header_id","00010"), + ]), +}); + +var all2 = all_match({ + processors: [ + dup2, + dup167, + dup5, + ], + on_success: processor_chain([ + setc("header_id","00011"), + ]), +}); + +var all3 = all_match({ + processors: [ + dup2, + dup168, + dup8, + ], + on_success: processor_chain([ + setc("header_id","00012"), + ]), +}); + +var all4 = all_match({ + processors: [ + dup2, + dup169, + dup11, + ], + on_success: processor_chain([ + setc("header_id","00013"), + ]), +}); + +var hdr3 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant(':'), Field(hfld3,true), Constant(' at '), Field(hfld4,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant(']'), Field(payload,false)}" +match("HEADER#6:0015", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: %{hfld2}:%{hfld3->} at %{hfld4}: [%{hevent_source}:%{messageid}:%{hversion}]%{payload}", processor_chain([ + setc("header_id","0015"), +])); + +var all5 = all_match({ + processors: [ + dup12, + dup167, + dup13, + ], + on_success: processor_chain([ + setc("header_id","00020"), + ]), +}); + +var all6 = all_match({ + processors: [ + dup12, + dup167, + dup5, + ], + on_success: processor_chain([ + setc("header_id","00021"), + ]), +}); + +var all7 = all_match({ + processors: [ + dup12, + dup168, + dup8, + ], + on_success: processor_chain([ + setc("header_id","00022"), + ]), +}); + +var all8 = all_match({ + processors: [ + dup12, + dup169, + dup11, + ], + on_success: processor_chain([ + setc("header_id","00023"), + ]), +}); + +var all9 = all_match({ + processors: [ + dup14, + dup167, + dup13, + ], + on_success: processor_chain([ + setc("header_id","00030"), + ]), +}); + +var all10 = all_match({ + processors: [ + dup14, + dup167, + dup5, + ], + on_success: processor_chain([ + setc("header_id","00031"), + ]), +}); + +var all11 = all_match({ + processors: [ + dup14, + dup168, + dup8, + ], + on_success: processor_chain([ + setc("header_id","00032"), + ]), +}); + +var all12 = all_match({ + processors: [ + dup14, + dup169, + dup11, + ], + on_success: processor_chain([ + setc("header_id","00033"), + ]), +}); + +var hdr4 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#15:0030/0", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var all13 = all_match({ + processors: [ + hdr4, + dup168, + dup8, + ], + on_success: processor_chain([ + setc("header_id","0030"), + ]), +}); + +var hdr5 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" +match("HEADER#16:0004", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ + setc("header_id","0004"), +])); + +var hdr6 = // "Pattern{Constant('snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" +match("HEADER#17:0005", "message", "snort: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ + setc("header_id","0005"), +])); + +var hdr7 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: '), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#18:0018", "message", "snort[%{hpid}]: %{messageid}: %{payload}", processor_chain([ + setc("header_id","0018"), +])); + +var hdr8 = // "Pattern{Constant('snort: '), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#19:0006", "message", "snort: %{messageid}: %{payload}", processor_chain([ + setc("header_id","0006"), +])); + +var hdr9 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort['), Field(hpid,false), Constant(']: '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#20:0007", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: %{messageid->} %{p0}", processor_chain([ + setc("header_id","0007"), + dup15, +])); + +var hdr10 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" +match("HEADER#21:0008", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ + setc("header_id","0008"), +])); + +var hdr11 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hfld1,false), Constant(': [Primary Detection Engine ('), Field(hfld10,false), Constant(')]['), Field(policyname,false), Constant(']['), Field(hfld2,false), Constant(':'), Field(id,false), Constant(':'), Field(hfld3,false), Constant(']'), Field(payload,false)}" +match("HEADER#22:0046", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine (%{hfld10})][%{policyname}][%{hfld2}:%{id}:%{hfld3}]%{payload}", processor_chain([ + setc("header_id","0046"), + dup16, +])); + +var hdr12 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hpid,false), Constant(']['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" +match("HEADER#23:0009", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hpid}][%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ + setc("header_id","0009"), +])); + +var hdr13 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld5,false), Constant(': '), Field(hfld6,false), Constant(': '), Field(hfld7,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" +match("HEADER#24:0022", "message", "%{hfld1->} %{hfld2->} %{hfld3->} %{host->} %{hfld5}: %{hfld6}: %{hfld7}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ + setc("header_id","0022"), + dup17, + dup18, +])); + +var hdr14 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" +match("HEADER#25:0010", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ + setc("header_id","0010"), + dup17, + dup18, +])); + +var part5 = // "Pattern{Constant('From '), Field(hsensor,true), Constant(' at'), Field(p0,false)}" +match("HEADER#26:0011/1_0", "nwparser.p0", "From %{hsensor->} at%{p0}"); + +var select2 = linear_select([ + part5, + dup20, +]); + +var all14 = all_match({ + processors: [ + dup170, + select2, + dup21, + ], + on_success: processor_chain([ + setc("header_id","0011"), + dup22, + ]), +}); + +var part6 = // "Pattern{Field(fld10,true), Constant(' From '), Field(hsensor,true), Constant(' at'), Field(p0,false)}" +match("HEADER#27:0014/1_0", "nwparser.p0", "%{fld10->} From %{hsensor->} at%{p0}"); + +var select3 = linear_select([ + part6, + dup20, +]); + +var all15 = all_match({ + processors: [ + dup170, + select3, + dup21, + ], + on_success: processor_chain([ + setc("header_id","0014"), + dup22, + ]), +}); + +var hdr15 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(msgIdPart4,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" +match("HEADER#28:0012", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} From %{hsensor->} at %{p0}", processor_chain([ + setc("header_id","0012"), + dup23, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant(" "), + field("msgIdPart3"), + constant(" "), + field("msgIdPart4"), + constant(" From "), + field("hsensor"), + constant(" at "), + field("p0"), + ], + }), +])); + +var hdr16 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(msgIdPart4,true), Constant(' '), Field(hfld12,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" +match("HEADER#29:0016", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} %{hfld12->} From %{hsensor->} at %{p0}", processor_chain([ + setc("header_id","0016"), + dup23, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant(" "), + field("msgIdPart3"), + constant(" "), + field("msgIdPart4"), + constant(" "), + field("hfld12"), + constant(" From "), + field("hsensor"), + constant(" at "), + field("p0"), + ], + }), +])); + +var hdr17 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort: '), Field(messageid,false), Constant(':'), Field(payload,false)}" +match("HEADER#30:0013", "message", "%{month->} %{day->} %{time->} %{host->} snort: %{messageid}:%{payload}", processor_chain([ + setc("header_id","0013"), +])); + +var hdr18 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': HMNOTIFY: '), Field(payload,false)}" +match("HEADER#31:0020", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: HMNOTIFY: %{payload}", processor_chain([ + setc("header_id","0020"), + dup24, +])); + +var hdr19 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' : HMNOTIFY: '), Field(payload,false)}" +match("HEADER#32:0035", "message", "%{month->} %{day->} %{time->} %{host->} : HMNOTIFY: %{payload}", processor_chain([ + setc("header_id","0035"), + dup24, +])); + +var hdr20 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hsigid,false), Constant(':'), Field(hversion,false), Constant('] "'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#33:0017", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] \"%{messageid->} %{p0}", processor_chain([ + setc("header_id","0017"), + dup15, +])); + +var hdr21 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hsigid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#34:0019", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] %{messageid->} %{p0}", processor_chain([ + setc("header_id","0019"), + dup15, +])); + +var hdr22 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hfld1,false), Constant(': [Primary Detection Engine'), Field(payload,false)}" +match("HEADER#35:0041", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine%{payload}", processor_chain([ + setc("header_id","0041"), + dup16, +])); + +var hdr23 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': Protocol: '), Field(hprotocol,false), Constant(', '), Field(payload,false)}" +match("HEADER#36:0045", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Protocol: %{hprotocol}, %{payload}", processor_chain([ + setc("header_id","0045"), + setc("messageid","connection_events"), +])); + +var hdr24 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(hfld4,true), Constant(' '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" +match("HEADER#37:0042", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{hfld4->} %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ + setc("header_id","0042"), + dup25, +])); + +var hdr25 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hfld5,false), Constant('] '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" +match("HEADER#38:00212", "message", "%{month->} %{day->} %{time->} %{hfld1}: [%{hfld5}] %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ + setc("header_id","00212"), + dup25, +])); + +var hdr26 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" +match("HEADER#39:0021", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ + setc("header_id","0021"), + dup25, +])); + +var hdr27 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" +match("HEADER#40:0029", "message", "%{month->} %{day->} %{time->} %{host}: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ + setc("header_id","0029"), +])); + +var hdr28 = // "Pattern{Constant('snort'), Field(p0,false)}" +match("HEADER#41:0024/0", "message", "snort%{p0}"); + +var all16 = all_match({ + processors: [ + hdr28, + dup171, + dup28, + ], + on_success: processor_chain([ + setc("header_id","0024"), + dup29, + ]), +}); + +var hdr29 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort'), Field(p0,false)}" +match("HEADER#42:0025/0", "message", "%{month->} %{day->} %{time->} snort%{p0}"); + +var all17 = all_match({ + processors: [ + hdr29, + dup171, + dup28, + ], + on_success: processor_chain([ + setc("header_id","0025"), + dup29, + ]), +}); + +var part7 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#43:0023/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var all18 = all_match({ + processors: [ + dup30, + dup167, + part7, + ], + on_success: processor_chain([ + setc("header_id","0023"), + dup29, + ]), +}); + +var part8 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#44:0026/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var all19 = all_match({ + processors: [ + dup30, + dup167, + part8, + ], + on_success: processor_chain([ + setc("header_id","0026"), + dup29, + ]), +}); + +var all20 = all_match({ + processors: [ + dup30, + dup168, + dup8, + ], + on_success: processor_chain([ + setc("header_id","0027"), + dup29, + ]), +}); + +var all21 = all_match({ + processors: [ + dup30, + dup169, + dup11, + ], + on_success: processor_chain([ + setc("header_id","0028"), + dup29, + ]), +}); + +var hdr30 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': Sha256:'), Field(hfld2,true), Constant(' Disposition: Malware'), Field(p0,false)}" +match("HEADER#47:0040", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Sha256:%{hfld2->} Disposition: Malware%{p0}", processor_chain([ + setc("header_id","0040"), + setc("messageid","MALWARE"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant(" Disposition: Malware"), + field("p0"), + ], + }), +])); + +var hdr31 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" +match("HEADER#48:0043", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} From %{hsensor->} at %{p0}", processor_chain([ + setc("header_id","0043"), + dup22, + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant(" "), + field("msgIdPart2"), + constant(" "), + field("msgIdPart3"), + constant(" From "), + field("hsensor"), + constant(" at "), + field("p0"), + ], + }), +])); + +var hdr32 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(messageid,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" +match("HEADER#49:0044", "message", "%{month->} %{day->} %{time->} %{host->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ + setc("header_id","0044"), +])); + +var hdr33 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(hyear,true), Constant(' '), Field(time,true), Constant(' '), Field(p0,false)}" +match("HEADER#50:0057/0", "message", "%{month->} %{day->} %{hyear->} %{time->} %{p0}"); + +var part9 = // "Pattern{Field(hostname,false), Constant(': %FTD-'), Field(p0,false)}" +match("HEADER#50:0057/1_0", "nwparser.p0", "%{hostname}: %FTD-%{p0}"); + +var part10 = // "Pattern{Field(hostname,true), Constant(' %FTD-'), Field(p0,false)}" +match("HEADER#50:0057/1_1", "nwparser.p0", "%{hostname->} %FTD-%{p0}"); + +var select4 = linear_select([ + part9, + part10, +]); + +var part11 = // "Pattern{Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" +match("HEADER#50:0057/2", "nwparser.p0", "%{fld2}-%{hfld3}:%{payload}"); + +var all22 = all_match({ + processors: [ + hdr33, + select4, + part11, + ], + on_success: processor_chain([ + setc("header_id","0057"), + dup1, + ]), +}); + +var hdr34 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z '), Field(hostname,true), Constant(' %FTD-'), Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" +match("HEADER#51:0058", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ + setc("header_id","0058"), + dup1, +])); + +var select5 = linear_select([ + hdr1, + hdr2, + all1, + all2, + all3, + all4, + hdr3, + all5, + all6, + all7, + all8, + all9, + all10, + all11, + all12, + all13, + hdr5, + hdr6, + hdr7, + hdr8, + hdr9, + hdr10, + hdr11, + hdr12, + hdr13, + hdr14, + all14, + all15, + hdr15, + hdr16, + hdr17, + hdr18, + hdr19, + hdr20, + hdr21, + hdr22, + hdr23, + hdr24, + hdr25, + hdr26, + hdr27, + all16, + all17, + all18, + all19, + all20, + all21, + hdr30, + hdr31, + hdr32, + all22, + hdr34, +]); + +var part12 = // "Pattern{Field(event_type,true), Constant(' (Sensor '), Field(sensor,false), Constant('): Severity:'), Field(severity,false), Constant(': '), Field(result,false)}" +match("MESSAGE#0:HMNOTIFY", "nwparser.payload", "%{event_type->} (Sensor %{sensor}): Severity:%{severity}: %{result}", processor_chain([ + setc("eventcategory","1604000000"), + dup31, + dup32, +])); + +var msg1 = msg("HMNOTIFY", part12); + +var msg2 = msg("0", dup192); + +var msg3 = msg("0:01", dup193); + +var select6 = linear_select([ + msg2, + msg3, +]); + +var msg4 = msg("1", dup194); + +var msg5 = msg("1:01", dup195); + +var select7 = linear_select([ + msg4, + msg5, +]); + +var msg6 = msg("2", dup192); + +var msg7 = msg("2:01", dup193); + +var select8 = linear_select([ + msg6, + msg7, +]); + +var msg8 = msg("3", dup192); + +var msg9 = msg("3:01", dup193); + +var select9 = linear_select([ + msg8, + msg9, +]); + +var msg10 = msg("3-10127", dup196); + +var msg11 = msg("3-10161", dup197); + +var msg12 = msg("3-10480", dup196); + +var msg13 = msg("3-10481", dup196); + +var msg14 = msg("3-11619", dup196); + +var msg15 = msg("3-11672", dup196); + +var msg16 = msg("3-12028", dup196); + +var msg17 = msg("3-12636", dup196); + +var msg18 = msg("3-12692", dup196); + +var msg19 = msg("3-7019", dup196); + +var msg20 = msg("3-7196", dup197); + +var msg21 = msg("3-8092", dup198); + +var msg22 = msg("3-8351", dup197); + +var msg23 = msg("3-10126", dup196); + +var msg24 = msg("4", dup192); + +var msg25 = msg("4:01", dup193); + +var select10 = linear_select([ + msg24, + msg25, +]); + +var msg26 = msg("5", dup195); + +var msg27 = msg("6", dup192); + +var msg28 = msg("6:01", dup193); + +var select11 = linear_select([ + msg27, + msg28, +]); + +var msg29 = msg("7", dup192); + +var msg30 = msg("7:01", dup193); + +var select12 = linear_select([ + msg29, + msg30, +]); + +var msg31 = msg("8", dup194); + +var msg32 = msg("8:01", dup195); + +var select13 = linear_select([ + msg31, + msg32, +]); + +var msg33 = msg("9", dup199); + +var msg34 = msg("10", dup200); + +var all23 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + setc("eventcategory","1614000000"), + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg35 = msg("11", all23); + +var msg36 = msg("12", dup192); + +var msg37 = msg("12:01", dup193); + +var select14 = linear_select([ + msg36, + msg37, +]); + +var msg38 = msg("13", dup192); + +var msg39 = msg("13:01", dup193); + +var select15 = linear_select([ + msg38, + msg39, +]); + +var msg40 = msg("14", dup192); + +var msg41 = msg("15", dup192); + +var msg42 = msg("15:01", dup193); + +var select16 = linear_select([ + msg41, + msg42, +]); + +var msg43 = msg("16", dup192); + +var msg44 = msg("16:01", dup193); + +var select17 = linear_select([ + msg43, + msg44, +]); + +var msg45 = msg("17", dup192); + +var msg46 = msg("17:01", dup193); + +var select18 = linear_select([ + msg45, + msg46, +]); + +var msg47 = msg("18", dup192); + +var msg48 = msg("18:01", dup193); + +var select19 = linear_select([ + msg47, + msg48, +]); + +var msg49 = msg("19", dup194); + +var msg50 = msg("19:01", dup195); + +var select20 = linear_select([ + msg49, + msg50, +]); + +var msg51 = msg("20", dup194); + +var msg52 = msg("20:01", dup195); + +var select21 = linear_select([ + msg51, + msg52, +]); + +var msg53 = msg("21", dup194); + +var msg54 = msg("21:01", dup195); + +var select22 = linear_select([ + msg53, + msg54, +]); + +var msg55 = msg("23", dup194); + +var msg56 = msg("23:01", dup195); + +var select23 = linear_select([ + msg55, + msg56, +]); + +var msg57 = msg("24", dup201); + +var msg58 = msg("25", dup201); + +var all24 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var msg59 = msg("25:01", all24); + +var select24 = linear_select([ + msg58, + msg59, +]); + +var msg60 = msg("26", dup195); + +var msg61 = msg("27", dup202); + +var msg62 = msg("28", dup202); + +var msg63 = msg("29", dup202); + +var msg64 = msg("30", dup202); + +var msg65 = msg("34", dup202); + +var msg66 = msg("45", dup192); + +var msg67 = msg("46", dup192); + +var msg68 = msg("46:01", dup193); + +var select25 = linear_select([ + msg67, + msg68, +]); + +var msg69 = msg("47", dup192); + +var msg70 = msg("47:01", dup193); + +var select26 = linear_select([ + msg69, + msg70, +]); + +var msg71 = msg("54", dup192); + +var msg72 = msg("54:01", dup193); + +var select27 = linear_select([ + msg71, + msg72, +]); + +var msg73 = msg("55", dup192); + +var msg74 = msg("55:01", dup193); + +var select28 = linear_select([ + msg73, + msg74, +]); + +var msg75 = msg("58", dup192); + +var msg76 = msg("58:01", dup193); + +var select29 = linear_select([ + msg75, + msg76, +]); + +var msg77 = msg("96", dup192); + +var msg78 = msg("97", dup192); + +var msg79 = msg("97:01", dup193); + +var select30 = linear_select([ + msg78, + msg79, +]); + +var msg80 = msg("103", dup203); + +var msg81 = msg("103:01", dup204); + +var select31 = linear_select([ + msg80, + msg81, +]); + +var msg82 = msg("104", dup205); + +var msg83 = msg("104:01", dup206); + +var select32 = linear_select([ + msg82, + msg83, +]); + +var msg84 = msg("105", dup203); + +var msg85 = msg("105:01", dup204); + +var select33 = linear_select([ + msg84, + msg85, +]); + +var msg86 = msg("105-1", dup203); + +var msg87 = msg("105-2", dup203); + +var msg88 = msg("105-3", dup203); + +var msg89 = msg("105-4", dup207); + +var msg90 = msg("106", dup203); + +var msg91 = msg("106:01", dup204); + +var select34 = linear_select([ + msg90, + msg91, +]); + +var msg92 = msg("106-1", dup208); + +var msg93 = msg("106-2", dup209); + +var msg94 = msg("106-3", dup208); + +var msg95 = msg("106-4", dup208); + +var msg96 = msg("107", dup203); + +var msg97 = msg("107:01", dup204); + +var select35 = linear_select([ + msg96, + msg97, +]); + +var msg98 = msg("108", dup203); + +var all25 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var msg99 = msg("108:01", all25); + +var msg100 = msg("108:02", dup204); + +var select36 = linear_select([ + msg98, + msg99, + msg100, +]); + +var msg101 = msg("109", dup203); + +var msg102 = msg("109:01", dup204); + +var select37 = linear_select([ + msg101, + msg102, +]); + +var msg103 = msg("110", dup203); + +var msg104 = msg("110:01", dup204); + +var select38 = linear_select([ + msg103, + msg104, +]); + +var msg105 = msg("110-1", dup207); + +var msg106 = msg("110-2", dup207); + +var msg107 = msg("110-3", dup207); + +var msg108 = msg("110-4", dup207); + +var msg109 = msg("111", dup203); + +var msg110 = msg("111:01", dup204); + +var select39 = linear_select([ + msg109, + msg110, +]); + +var msg111 = msg("111-1", dup207); + +var msg112 = msg("111-10", dup207); + +var msg113 = msg("111-11", dup207); + +var msg114 = msg("111-12", dup207); + +var msg115 = msg("111-13", dup207); + +var msg116 = msg("111-14", dup207); + +var msg117 = msg("111-15", dup207); + +var msg118 = msg("111-16", dup207); + +var msg119 = msg("111-17", dup207); + +var msg120 = msg("111-2", dup207); + +var msg121 = msg("111-3", dup207); + +var msg122 = msg("111-4", dup207); + +var msg123 = msg("111-5", dup207); + +var msg124 = msg("111-6", dup207); + +var msg125 = msg("111-7", dup207); + +var msg126 = msg("111-8", dup207); + +var msg127 = msg("111-9", dup207); + +var msg128 = msg("112", dup203); + +var msg129 = msg("112:01", dup204); + +var select40 = linear_select([ + msg128, + msg129, +]); + +var msg130 = msg("112-1", dup207); + +var msg131 = msg("112-2", dup207); + +var msg132 = msg("112-3", dup207); + +var msg133 = msg("112-4", dup207); + +var msg134 = msg("113", dup203); + +var msg135 = msg("113:01", dup204); + +var select41 = linear_select([ + msg134, + msg135, +]); + +var msg136 = msg("114", dup203); + +var msg137 = msg("114:01", dup204); + +var select42 = linear_select([ + msg136, + msg137, +]); + +var msg138 = msg("115", dup203); + +var msg139 = msg("115:01", dup204); + +var select43 = linear_select([ + msg138, + msg139, +]); + +var msg140 = msg("115-1", dup207); + +var msg141 = msg("115-2", dup207); + +var msg142 = msg("115-3", dup210); + +var msg143 = msg("115-4", dup210); + +var msg144 = msg("115-5", dup207); + +var msg145 = msg("116", dup203); + +var msg146 = msg("116:01", dup204); + +var select44 = linear_select([ + msg145, + msg146, +]); + +var msg147 = msg("116-5", dup209); + +var msg148 = msg("117", dup203); + +var msg149 = msg("117:01", dup204); + +var select45 = linear_select([ + msg148, + msg149, +]); + +var msg150 = msg("118", dup203); + +var msg151 = msg("118:01", dup204); + +var select46 = linear_select([ + msg150, + msg151, +]); + +var msg152 = msg("119", dup203); + +var all26 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var msg153 = msg("119:01", all26); + +var select47 = linear_select([ + msg152, + msg153, +]); + +var msg154 = msg("119-1", dup211); + +var msg155 = msg("119-10", dup211); + +var msg156 = msg("119-11", dup211); + +var msg157 = msg("119-12", dup211); + +var msg158 = msg("119-13", dup211); + +var msg159 = msg("119-14", dup211); + +var msg160 = msg("119-15", dup211); + +var msg161 = msg("119-16", dup211); + +var msg162 = msg("119-17", dup211); + +var msg163 = msg("119-18", dup211); + +var msg164 = msg("119-2", dup211); + +var msg165 = msg("119-3", dup211); + +var msg166 = msg("119-4", dup211); + +var msg167 = msg("119-5", dup211); + +var msg168 = msg("119-6", dup211); + +var msg169 = msg("119-7", dup211); + +var msg170 = msg("119-8", dup211); + +var msg171 = msg("119-9", dup211); + +var msg172 = msg("120", dup203); + +var msg173 = msg("120:01", dup204); + +var select48 = linear_select([ + msg172, + msg173, +]); + +var msg174 = msg("120-1", dup211); + +var msg175 = msg("121", dup203); + +var msg176 = msg("121:01", dup204); + +var select49 = linear_select([ + msg175, + msg176, +]); + +var msg177 = msg("121-1", dup212); + +var msg178 = msg("121-2", dup212); + +var msg179 = msg("121-3", dup212); + +var msg180 = msg("121-4", dup212); + +var msg181 = msg("122", dup203); + +var msg182 = msg("122:01", dup204); + +var select50 = linear_select([ + msg181, + msg182, +]); + +var msg183 = msg("122-1", dup212); + +var msg184 = msg("122-10", dup212); + +var msg185 = msg("122-11", dup213); + +var msg186 = msg("122-12", dup212); + +var msg187 = msg("122-13", dup212); + +var msg188 = msg("122-14", dup212); + +var msg189 = msg("122-15", dup213); + +var msg190 = msg("122-16", dup212); + +var msg191 = msg("122-17", dup212); + +var msg192 = msg("122-18", dup212); + +var msg193 = msg("122-19", dup213); + +var msg194 = msg("122-2", dup212); + +var msg195 = msg("122-20", dup212); + +var msg196 = msg("122-21", dup212); + +var msg197 = msg("122-22", dup212); + +var msg198 = msg("122-23", dup213); + +var msg199 = msg("122-24", dup212); + +var msg200 = msg("122-25", dup213); + +var msg201 = msg("122-26", dup213); + +var msg202 = msg("122-27", dup212); + +var msg203 = msg("122-3", dup213); + +var msg204 = msg("122-4", dup212); + +var msg205 = msg("122-5", dup212); + +var msg206 = msg("122-6", dup212); + +var msg207 = msg("122-7", dup213); + +var msg208 = msg("122-8", dup212); + +var msg209 = msg("122-9", dup212); + +var msg210 = msg("123-10", dup207); + +var msg211 = msg("123-9", dup207); + +var msg212 = msg("124", dup203); + +var msg213 = msg("124:01", dup204); + +var select51 = linear_select([ + msg212, + msg213, +]); + +var msg214 = msg("124-1", dup210); + +var msg215 = msg("125", dup203); + +var msg216 = msg("125:01", dup204); + +var select52 = linear_select([ + msg215, + msg216, +]); + +var msg217 = msg("125-3", dup207); + +var msg218 = msg("125-5", dup207); + +var msg219 = msg("125-6", dup214); + +var msg220 = msg("125-8", dup207); + +var msg221 = msg("126", dup203); + +var msg222 = msg("126:01", dup204); + +var select53 = linear_select([ + msg221, + msg222, +]); + +var msg223 = msg("126-1", dup207); + +var msg224 = msg("127", dup203); + +var msg225 = msg("127:01", dup204); + +var select54 = linear_select([ + msg224, + msg225, +]); + +var msg226 = msg("128", dup203); + +var msg227 = msg("128:01", dup204); + +var select55 = linear_select([ + msg226, + msg227, +]); + +var msg228 = msg("129", dup203); + +var msg229 = msg("129:01", dup204); + +var select56 = linear_select([ + msg228, + msg229, +]); + +var msg230 = msg("129-2", dup207); + +var msg231 = msg("129-6", dup207); + +var msg232 = msg("130", dup203); + +var msg233 = msg("130:01", dup204); + +var select57 = linear_select([ + msg232, + msg233, +]); + +var msg234 = msg("131", dup203); + +var msg235 = msg("131:01", dup204); + +var select58 = linear_select([ + msg234, + msg235, +]); + +var msg236 = msg("131-3", dup207); + +var msg237 = msg("132", dup203); + +var msg238 = msg("132:01", dup204); + +var select59 = linear_select([ + msg237, + msg238, +]); + +var msg239 = msg("133", dup203); + +var msg240 = msg("133:01", dup204); + +var select60 = linear_select([ + msg239, + msg240, +]); + +var msg241 = msg("134", dup203); + +var msg242 = msg("134:01", dup204); + +var select61 = linear_select([ + msg241, + msg242, +]); + +var msg243 = msg("135", dup203); + +var msg244 = msg("135:01", dup204); + +var select62 = linear_select([ + msg243, + msg244, +]); + +var msg245 = msg("136", dup203); + +var msg246 = msg("136:01", dup204); + +var select63 = linear_select([ + msg245, + msg246, +]); + +var msg247 = msg("137", dup203); + +var msg248 = msg("137:01", dup204); + +var select64 = linear_select([ + msg247, + msg248, +]); + +var msg249 = msg("138", dup203); + +var msg250 = msg("138:01", dup204); + +var select65 = linear_select([ + msg249, + msg250, +]); + +var msg251 = msg("140", dup203); + +var msg252 = msg("140:01", dup204); + +var select66 = linear_select([ + msg251, + msg252, +]); + +var msg253 = msg("141", dup203); + +var msg254 = msg("141:01", dup204); + +var select67 = linear_select([ + msg253, + msg254, +]); + +var msg255 = msg("142", dup203); + +var msg256 = msg("142:01", dup204); + +var select68 = linear_select([ + msg255, + msg256, +]); + +var msg257 = msg("143", dup203); + +var msg258 = msg("143:01", dup204); + +var select69 = linear_select([ + msg257, + msg258, +]); + +var msg259 = msg("144", dup214); + +var all27 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg260 = msg("144:01", all27); + +var select70 = linear_select([ + msg259, + msg260, +]); + +var msg261 = msg("145", dup203); + +var msg262 = msg("145:01", dup204); + +var select71 = linear_select([ + msg261, + msg262, +]); + +var msg263 = msg("146", dup203); + +var msg264 = msg("146:01", dup204); + +var select72 = linear_select([ + msg263, + msg264, +]); + +var msg265 = msg("147", dup203); + +var msg266 = msg("147:01", dup204); + +var select73 = linear_select([ + msg265, + msg266, +]); + +var msg267 = msg("148", dup203); + +var msg268 = msg("148:01", dup204); + +var select74 = linear_select([ + msg267, + msg268, +]); + +var msg269 = msg("149", dup203); + +var msg270 = msg("149:01", dup204); + +var select75 = linear_select([ + msg269, + msg270, +]); + +var msg271 = msg("150", dup203); + +var msg272 = msg("150:01", dup204); + +var select76 = linear_select([ + msg271, + msg272, +]); + +var msg273 = msg("151", dup203); + +var msg274 = msg("151:01", dup204); + +var select77 = linear_select([ + msg273, + msg274, +]); + +var msg275 = msg("152", dup203); + +var msg276 = msg("152:01", dup204); + +var select78 = linear_select([ + msg275, + msg276, +]); + +var msg277 = msg("153", dup203); + +var msg278 = msg("153:01", dup204); + +var select79 = linear_select([ + msg277, + msg278, +]); + +var msg279 = msg("154", dup203); + +var msg280 = msg("154:01", dup204); + +var select80 = linear_select([ + msg279, + msg280, +]); + +var msg281 = msg("155", dup203); + +var msg282 = msg("155:01", dup204); + +var select81 = linear_select([ + msg281, + msg282, +]); + +var msg283 = msg("156", dup203); + +var msg284 = msg("156:01", dup204); + +var select82 = linear_select([ + msg283, + msg284, +]); + +var msg285 = msg("157", dup203); + +var msg286 = msg("157:01", dup204); + +var select83 = linear_select([ + msg285, + msg286, +]); + +var msg287 = msg("158", dup203); + +var msg288 = msg("158:01", dup204); + +var select84 = linear_select([ + msg287, + msg288, +]); + +var msg289 = msg("159", dup203); + +var msg290 = msg("159:01", dup204); + +var select85 = linear_select([ + msg289, + msg290, +]); + +var msg291 = msg("160", dup203); + +var msg292 = msg("160:01", dup204); + +var select86 = linear_select([ + msg291, + msg292, +]); + +var msg293 = msg("161", dup203); + +var msg294 = msg("161:01", dup204); + +var select87 = linear_select([ + msg293, + msg294, +]); + +var msg295 = msg("162", dup203); + +var msg296 = msg("162:01", dup204); + +var select88 = linear_select([ + msg295, + msg296, +]); + +var msg297 = msg("163", dup203); + +var msg298 = msg("163:01", dup204); + +var select89 = linear_select([ + msg297, + msg298, +]); + +var msg299 = msg("164", dup203); + +var msg300 = msg("164:01", dup204); + +var select90 = linear_select([ + msg299, + msg300, +]); + +var msg301 = msg("165", dup203); + +var msg302 = msg("165:01", dup204); + +var select91 = linear_select([ + msg301, + msg302, +]); + +var msg303 = msg("166", dup203); + +var msg304 = msg("166:01", dup204); + +var select92 = linear_select([ + msg303, + msg304, +]); + +var msg305 = msg("167", dup203); + +var msg306 = msg("167:01", dup204); + +var select93 = linear_select([ + msg305, + msg306, +]); + +var msg307 = msg("168", dup203); + +var msg308 = msg("168:01", dup204); + +var select94 = linear_select([ + msg307, + msg308, +]); + +var msg309 = msg("169", dup203); + +var msg310 = msg("169:01", dup204); + +var select95 = linear_select([ + msg309, + msg310, +]); + +var msg311 = msg("170", dup203); + +var msg312 = msg("170:01", dup204); + +var select96 = linear_select([ + msg311, + msg312, +]); + +var msg313 = msg("171", dup203); + +var msg314 = msg("171:01", dup204); + +var select97 = linear_select([ + msg313, + msg314, +]); + +var msg315 = msg("172", dup203); + +var msg316 = msg("172:01", dup204); + +var select98 = linear_select([ + msg315, + msg316, +]); + +var msg317 = msg("173", dup203); + +var msg318 = msg("173:01", dup204); + +var select99 = linear_select([ + msg317, + msg318, +]); + +var msg319 = msg("174", dup203); + +var msg320 = msg("174:01", dup204); + +var select100 = linear_select([ + msg319, + msg320, +]); + +var msg321 = msg("175", dup203); + +var msg322 = msg("175:01", dup204); + +var select101 = linear_select([ + msg321, + msg322, +]); + +var msg323 = msg("176", dup203); + +var msg324 = msg("176:01", dup204); + +var select102 = linear_select([ + msg323, + msg324, +]); + +var msg325 = msg("177", dup203); + +var msg326 = msg("177:01", dup204); + +var select103 = linear_select([ + msg325, + msg326, +]); + +var msg327 = msg("179", dup203); + +var msg328 = msg("179:01", dup204); + +var select104 = linear_select([ + msg327, + msg328, +]); + +var msg329 = msg("180", dup203); + +var msg330 = msg("180:01", dup204); + +var select105 = linear_select([ + msg329, + msg330, +]); + +var all28 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup72, + dup73, + dup74, + dup84, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg331 = msg("181", all28); + +var all29 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup72, + dup73, + dup74, + dup84, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg332 = msg("181:01", all29); + +var select106 = linear_select([ + msg331, + msg332, +]); + +var msg333 = msg("182", dup203); + +var msg334 = msg("182:01", dup204); + +var select107 = linear_select([ + msg333, + msg334, +]); + +var msg335 = msg("183", dup203); + +var msg336 = msg("183:01", dup204); + +var select108 = linear_select([ + msg335, + msg336, +]); + +var msg337 = msg("184", dup203); + +var msg338 = msg("184:01", dup204); + +var select109 = linear_select([ + msg337, + msg338, +]); + +var msg339 = msg("185", dup203); + +var msg340 = msg("185:01", dup204); + +var select110 = linear_select([ + msg339, + msg340, +]); + +var msg341 = msg("186", dup203); + +var msg342 = msg("186:01", dup204); + +var select111 = linear_select([ + msg341, + msg342, +]); + +var msg343 = msg("187", dup203); + +var msg344 = msg("187:01", dup204); + +var select112 = linear_select([ + msg343, + msg344, +]); + +var msg345 = msg("188", dup203); + +var msg346 = msg("188:01", dup204); + +var select113 = linear_select([ + msg345, + msg346, +]); + +var msg347 = msg("189", dup203); + +var msg348 = msg("189:01", dup204); + +var select114 = linear_select([ + msg347, + msg348, +]); + +var msg349 = msg("190", dup203); + +var msg350 = msg("190:01", dup204); + +var select115 = linear_select([ + msg349, + msg350, +]); + +var msg351 = msg("191", dup203); + +var msg352 = msg("191:01", dup204); + +var select116 = linear_select([ + msg351, + msg352, +]); + +var msg353 = msg("192", dup203); + +var msg354 = msg("192:01", dup204); + +var select117 = linear_select([ + msg353, + msg354, +]); + +var msg355 = msg("193", dup203); + +var msg356 = msg("193:01", dup204); + +var select118 = linear_select([ + msg355, + msg356, +]); + +var msg357 = msg("194", dup203); + +var msg358 = msg("194:01", dup204); + +var select119 = linear_select([ + msg357, + msg358, +]); + +var msg359 = msg("195", dup203); + +var msg360 = msg("195:01", dup204); + +var select120 = linear_select([ + msg359, + msg360, +]); + +var msg361 = msg("196", dup203); + +var msg362 = msg("196:01", dup204); + +var select121 = linear_select([ + msg361, + msg362, +]); + +var msg363 = msg("197", dup203); + +var msg364 = msg("197:01", dup204); + +var select122 = linear_select([ + msg363, + msg364, +]); + +var msg365 = msg("198", dup203); + +var msg366 = msg("198:01", dup204); + +var select123 = linear_select([ + msg365, + msg366, +]); + +var msg367 = msg("199", dup203); + +var msg368 = msg("199:01", dup204); + +var select124 = linear_select([ + msg367, + msg368, +]); + +var msg369 = msg("200", dup203); + +var msg370 = msg("200:01", dup204); + +var select125 = linear_select([ + msg369, + msg370, +]); + +var msg371 = msg("201", dup203); + +var msg372 = msg("201:01", dup204); + +var select126 = linear_select([ + msg371, + msg372, +]); + +var msg373 = msg("202", dup203); + +var msg374 = msg("202:01", dup204); + +var select127 = linear_select([ + msg373, + msg374, +]); + +var msg375 = msg("203", dup203); + +var msg376 = msg("203:01", dup204); + +var select128 = linear_select([ + msg375, + msg376, +]); + +var msg377 = msg("204", dup203); + +var msg378 = msg("204:01", dup204); + +var select129 = linear_select([ + msg377, + msg378, +]); + +var msg379 = msg("205", dup203); + +var msg380 = msg("205:01", dup204); + +var select130 = linear_select([ + msg379, + msg380, +]); + +var msg381 = msg("206", dup203); + +var msg382 = msg("206:01", dup204); + +var select131 = linear_select([ + msg381, + msg382, +]); + +var msg383 = msg("207", dup203); + +var msg384 = msg("207:01", dup204); + +var select132 = linear_select([ + msg383, + msg384, +]); + +var msg385 = msg("208", dup203); + +var msg386 = msg("208:01", dup204); + +var select133 = linear_select([ + msg385, + msg386, +]); + +var msg387 = msg("209", dup203); + +var msg388 = msg("209:01", dup204); + +var select134 = linear_select([ + msg387, + msg388, +]); + +var msg389 = msg("210", dup203); + +var msg390 = msg("210:01", dup204); + +var select135 = linear_select([ + msg389, + msg390, +]); + +var msg391 = msg("211", dup203); + +var msg392 = msg("211:01", dup204); + +var select136 = linear_select([ + msg391, + msg392, +]); + +var msg393 = msg("212", dup203); + +var msg394 = msg("212:01", dup204); + +var select137 = linear_select([ + msg393, + msg394, +]); + +var msg395 = msg("213", dup203); + +var msg396 = msg("213:01", dup204); + +var select138 = linear_select([ + msg395, + msg396, +]); + +var msg397 = msg("214", dup203); + +var msg398 = msg("214:01", dup204); + +var select139 = linear_select([ + msg397, + msg398, +]); + +var msg399 = msg("215", dup203); + +var msg400 = msg("215:01", dup204); + +var select140 = linear_select([ + msg399, + msg400, +]); + +var msg401 = msg("216", dup203); + +var msg402 = msg("216:01", dup204); + +var select141 = linear_select([ + msg401, + msg402, +]); + +var msg403 = msg("217", dup203); + +var msg404 = msg("217:01", dup204); + +var select142 = linear_select([ + msg403, + msg404, +]); + +var msg405 = msg("218", dup203); + +var msg406 = msg("218:01", dup204); + +var select143 = linear_select([ + msg405, + msg406, +]); + +var msg407 = msg("219", dup203); + +var msg408 = msg("219:01", dup204); + +var select144 = linear_select([ + msg407, + msg408, +]); + +var msg409 = msg("220", dup203); + +var msg410 = msg("220:01", dup204); + +var select145 = linear_select([ + msg409, + msg410, +]); + +var msg411 = msg("221", dup215); + +var msg412 = msg("221:01", dup216); + +var select146 = linear_select([ + msg411, + msg412, +]); + +var msg413 = msg("222", dup215); + +var msg414 = msg("222:01", dup216); + +var select147 = linear_select([ + msg413, + msg414, +]); + +var msg415 = msg("223", dup215); + +var msg416 = msg("223:01", dup216); + +var select148 = linear_select([ + msg415, + msg416, +]); + +var msg417 = msg("224", dup215); + +var msg418 = msg("224:01", dup216); + +var select149 = linear_select([ + msg417, + msg418, +]); + +var msg419 = msg("225", dup215); + +var msg420 = msg("225:01", dup216); + +var select150 = linear_select([ + msg419, + msg420, +]); + +var msg421 = msg("226", dup215); + +var msg422 = msg("226:01", dup216); + +var select151 = linear_select([ + msg421, + msg422, +]); + +var msg423 = msg("227", dup215); + +var msg424 = msg("227:01", dup216); + +var select152 = linear_select([ + msg423, + msg424, +]); + +var msg425 = msg("228", dup215); + +var msg426 = msg("228:01", dup216); + +var select153 = linear_select([ + msg425, + msg426, +]); + +var msg427 = msg("229", dup215); + +var msg428 = msg("229:01", dup216); + +var select154 = linear_select([ + msg427, + msg428, +]); + +var msg429 = msg("230", dup215); + +var msg430 = msg("230:01", dup216); + +var select155 = linear_select([ + msg429, + msg430, +]); + +var msg431 = msg("231", dup215); + +var msg432 = msg("231:01", dup216); + +var select156 = linear_select([ + msg431, + msg432, +]); + +var msg433 = msg("232", dup215); + +var msg434 = msg("232:01", dup216); + +var select157 = linear_select([ + msg433, + msg434, +]); + +var msg435 = msg("233", dup215); + +var msg436 = msg("233:01", dup216); + +var select158 = linear_select([ + msg435, + msg436, +]); + +var msg437 = msg("234", dup215); + +var msg438 = msg("234:01", dup216); + +var select159 = linear_select([ + msg437, + msg438, +]); + +var msg439 = msg("235", dup215); + +var msg440 = msg("235:01", dup216); + +var select160 = linear_select([ + msg439, + msg440, +]); + +var msg441 = msg("236", dup215); + +var msg442 = msg("236:01", dup216); + +var select161 = linear_select([ + msg441, + msg442, +]); + +var msg443 = msg("237", dup215); + +var msg444 = msg("237:01", dup216); + +var select162 = linear_select([ + msg443, + msg444, +]); + +var msg445 = msg("238", dup215); + +var msg446 = msg("238:01", dup216); + +var select163 = linear_select([ + msg445, + msg446, +]); + +var msg447 = msg("239", dup215); + +var msg448 = msg("239:01", dup216); + +var select164 = linear_select([ + msg447, + msg448, +]); + +var msg449 = msg("240", dup215); + +var msg450 = msg("240:01", dup216); + +var select165 = linear_select([ + msg449, + msg450, +]); + +var msg451 = msg("241", dup215); + +var msg452 = msg("241:01", dup216); + +var select166 = linear_select([ + msg451, + msg452, +]); + +var msg453 = msg("243", dup215); + +var msg454 = msg("243:01", dup216); + +var select167 = linear_select([ + msg453, + msg454, +]); + +var msg455 = msg("244", dup215); + +var msg456 = msg("244:01", dup216); + +var select168 = linear_select([ + msg455, + msg456, +]); + +var msg457 = msg("245", dup215); + +var msg458 = msg("245:01", dup216); + +var select169 = linear_select([ + msg457, + msg458, +]); + +var msg459 = msg("246", dup215); + +var msg460 = msg("246:01", dup216); + +var select170 = linear_select([ + msg459, + msg460, +]); + +var msg461 = msg("247", dup215); + +var msg462 = msg("247:01", dup216); + +var select171 = linear_select([ + msg461, + msg462, +]); + +var msg463 = msg("248", dup215); + +var msg464 = msg("248:01", dup216); + +var select172 = linear_select([ + msg463, + msg464, +]); + +var msg465 = msg("249", dup215); + +var msg466 = msg("249:01", dup216); + +var select173 = linear_select([ + msg465, + msg466, +]); + +var msg467 = msg("250", dup215); + +var msg468 = msg("250:01", dup216); + +var select174 = linear_select([ + msg467, + msg468, +]); + +var msg469 = msg("251", dup215); + +var msg470 = msg("251:01", dup216); + +var select175 = linear_select([ + msg469, + msg470, +]); + +var msg471 = msg("252", dup196); + +var msg472 = msg("252:01", dup217); + +var select176 = linear_select([ + msg471, + msg472, +]); + +var msg473 = msg("253", dup196); + +var msg474 = msg("253:01", dup217); + +var select177 = linear_select([ + msg473, + msg474, +]); + +var msg475 = msg("254", dup196); + +var msg476 = msg("254:01", dup217); + +var select178 = linear_select([ + msg475, + msg476, +]); + +var msg477 = msg("255", dup196); + +var msg478 = msg("255:01", dup217); + +var select179 = linear_select([ + msg477, + msg478, +]); + +var msg479 = msg("256", dup196); + +var msg480 = msg("256:01", dup217); + +var select180 = linear_select([ + msg479, + msg480, +]); + +var msg481 = msg("257", dup196); + +var msg482 = msg("257:01", dup217); + +var select181 = linear_select([ + msg481, + msg482, +]); + +var msg483 = msg("258", dup218); + +var msg484 = msg("258:01", dup219); + +var select182 = linear_select([ + msg483, + msg484, +]); + +var msg485 = msg("259", dup218); + +var msg486 = msg("259:01", dup219); + +var select183 = linear_select([ + msg485, + msg486, +]); + +var msg487 = msg("260", dup218); + +var msg488 = msg("260:01", dup219); + +var select184 = linear_select([ + msg487, + msg488, +]); + +var msg489 = msg("261", dup218); + +var msg490 = msg("261:01", dup219); + +var select185 = linear_select([ + msg489, + msg490, +]); + +var msg491 = msg("262", dup218); + +var msg492 = msg("262:01", dup219); + +var select186 = linear_select([ + msg491, + msg492, +]); + +var msg493 = msg("264", dup218); + +var msg494 = msg("264:01", dup219); + +var select187 = linear_select([ + msg493, + msg494, +]); + +var msg495 = msg("265", dup218); + +var msg496 = msg("265:01", dup219); + +var select188 = linear_select([ + msg495, + msg496, +]); + +var msg497 = msg("266", dup218); + +var msg498 = msg("266:01", dup219); + +var select189 = linear_select([ + msg497, + msg498, +]); + +var msg499 = msg("267", dup218); + +var msg500 = msg("267:01", dup219); + +var select190 = linear_select([ + msg499, + msg500, +]); + +var msg501 = msg("268", dup198); + +var msg502 = msg("268:01", dup220); + +var select191 = linear_select([ + msg501, + msg502, +]); + +var msg503 = msg("269", dup198); + +var msg504 = msg("269:01", dup220); + +var select192 = linear_select([ + msg503, + msg504, +]); + +var msg505 = msg("270", dup198); + +var msg506 = msg("270:01", dup220); + +var select193 = linear_select([ + msg505, + msg506, +]); + +var msg507 = msg("271", dup198); + +var msg508 = msg("271:01", dup220); + +var select194 = linear_select([ + msg507, + msg508, +]); + +var msg509 = msg("272", dup198); + +var msg510 = msg("272:01", dup220); + +var select195 = linear_select([ + msg509, + msg510, +]); + +var msg511 = msg("273", dup198); + +var msg512 = msg("273:01", dup220); + +var select196 = linear_select([ + msg511, + msg512, +]); + +var msg513 = msg("274", dup198); + +var msg514 = msg("274:01", dup220); + +var select197 = linear_select([ + msg513, + msg514, +]); + +var msg515 = msg("275", dup198); + +var msg516 = msg("275:01", dup220); + +var select198 = linear_select([ + msg515, + msg516, +]); + +var msg517 = msg("276", dup198); + +var msg518 = msg("276:01", dup220); + +var select199 = linear_select([ + msg517, + msg518, +]); + +var msg519 = msg("277", dup198); + +var msg520 = msg("277:01", dup220); + +var select200 = linear_select([ + msg519, + msg520, +]); + +var msg521 = msg("278", dup198); + +var msg522 = msg("278:01", dup220); + +var select201 = linear_select([ + msg521, + msg522, +]); + +var msg523 = msg("279", dup198); + +var msg524 = msg("279:01", dup220); + +var select202 = linear_select([ + msg523, + msg524, +]); + +var msg525 = msg("280", dup198); + +var msg526 = msg("280:01", dup220); + +var select203 = linear_select([ + msg525, + msg526, +]); + +var msg527 = msg("281", dup198); + +var msg528 = msg("281:01", dup220); + +var select204 = linear_select([ + msg527, + msg528, +]); + +var msg529 = msg("282", dup198); + +var msg530 = msg("282:01", dup220); + +var select205 = linear_select([ + msg529, + msg530, +]); + +var msg531 = msg("283", dup197); + +var msg532 = msg("283:01", dup221); + +var select206 = linear_select([ + msg531, + msg532, +]); + +var msg533 = msg("284", dup197); + +var msg534 = msg("284:01", dup221); + +var select207 = linear_select([ + msg533, + msg534, +]); + +var msg535 = msg("285", dup197); + +var msg536 = msg("285:01", dup221); + +var select208 = linear_select([ + msg535, + msg536, +]); + +var msg537 = msg("286", dup197); + +var msg538 = msg("286:01", dup221); + +var select209 = linear_select([ + msg537, + msg538, +]); + +var msg539 = msg("287", dup197); + +var msg540 = msg("287:01", dup221); + +var select210 = linear_select([ + msg539, + msg540, +]); + +var msg541 = msg("288", dup197); + +var msg542 = msg("288:01", dup221); + +var select211 = linear_select([ + msg541, + msg542, +]); + +var msg543 = msg("289", dup197); + +var msg544 = msg("289:01", dup221); + +var select212 = linear_select([ + msg543, + msg544, +]); + +var msg545 = msg("290", dup197); + +var msg546 = msg("290:01", dup221); + +var select213 = linear_select([ + msg545, + msg546, +]); + +var msg547 = msg("291", dup197); + +var msg548 = msg("291:01", dup221); + +var select214 = linear_select([ + msg547, + msg548, +]); + +var msg549 = msg("292", dup197); + +var msg550 = msg("292:01", dup221); + +var select215 = linear_select([ + msg549, + msg550, +]); + +var msg551 = msg("293", dup197); + +var msg552 = msg("293:01", dup221); + +var select216 = linear_select([ + msg551, + msg552, +]); + +var msg553 = msg("295", dup197); + +var msg554 = msg("295:01", dup221); + +var select217 = linear_select([ + msg553, + msg554, +]); + +var msg555 = msg("296", dup197); + +var msg556 = msg("296:01", dup221); + +var select218 = linear_select([ + msg555, + msg556, +]); + +var msg557 = msg("297", dup197); + +var msg558 = msg("297:01", dup221); + +var select219 = linear_select([ + msg557, + msg558, +]); + +var msg559 = msg("298", dup197); + +var msg560 = msg("298:01", dup221); + +var select220 = linear_select([ + msg559, + msg560, +]); + +var msg561 = msg("299", dup197); + +var msg562 = msg("299:01", dup221); + +var select221 = linear_select([ + msg561, + msg562, +]); + +var msg563 = msg("300", dup197); + +var msg564 = msg("300:01", dup221); + +var select222 = linear_select([ + msg563, + msg564, +]); + +var msg565 = msg("301", dup197); + +var msg566 = msg("301:01", dup221); + +var select223 = linear_select([ + msg565, + msg566, +]); + +var msg567 = msg("302", dup197); + +var msg568 = msg("302:01", dup221); + +var select224 = linear_select([ + msg567, + msg568, +]); + +var msg569 = msg("303", dup218); + +var msg570 = msg("303:01", dup219); + +var select225 = linear_select([ + msg569, + msg570, +]); + +var msg571 = msg("304", dup197); + +var msg572 = msg("304:01", dup221); + +var select226 = linear_select([ + msg571, + msg572, +]); + +var msg573 = msg("305", dup197); + +var msg574 = msg("305:01", dup221); + +var select227 = linear_select([ + msg573, + msg574, +]); + +var msg575 = msg("306", dup196); + +var msg576 = msg("306:01", dup217); + +var select228 = linear_select([ + msg575, + msg576, +]); + +var msg577 = msg("307", dup197); + +var msg578 = msg("307:01", dup221); + +var select229 = linear_select([ + msg577, + msg578, +]); + +var msg579 = msg("308", dup197); + +var msg580 = msg("308:01", dup221); + +var select230 = linear_select([ + msg579, + msg580, +]); + +var msg581 = msg("309", dup197); + +var msg582 = msg("309:01", dup221); + +var select231 = linear_select([ + msg581, + msg582, +]); + +var msg583 = msg("310", dup197); + +var msg584 = msg("310:01", dup221); + +var select232 = linear_select([ + msg583, + msg584, +]); + +var msg585 = msg("311", dup197); + +var msg586 = msg("311:01", dup221); + +var select233 = linear_select([ + msg585, + msg586, +]); + +var msg587 = msg("312", dup222); + +var msg588 = msg("312:01", dup223); + +var select234 = linear_select([ + msg587, + msg588, +]); + +var msg589 = msg("313", dup197); + +var msg590 = msg("313:01", dup221); + +var select235 = linear_select([ + msg589, + msg590, +]); + +var msg591 = msg("314", dup218); + +var msg592 = msg("314:01", dup219); + +var select236 = linear_select([ + msg591, + msg592, +]); + +var msg593 = msg("315", dup197); + +var msg594 = msg("315:01", dup221); + +var select237 = linear_select([ + msg593, + msg594, +]); + +var msg595 = msg("316", dup197); + +var msg596 = msg("316:01", dup221); + +var select238 = linear_select([ + msg595, + msg596, +]); + +var msg597 = msg("317", dup197); + +var msg598 = msg("317:01", dup221); + +var select239 = linear_select([ + msg597, + msg598, +]); + +var msg599 = msg("318", dup196); + +var msg600 = msg("318:01", dup217); + +var select240 = linear_select([ + msg599, + msg600, +]); + +var msg601 = msg("319", dup197); + +var msg602 = msg("319:01", dup221); + +var select241 = linear_select([ + msg601, + msg602, +]); + +var msg603 = msg("320", dup205); + +var msg604 = msg("320:01", dup206); + +var select242 = linear_select([ + msg603, + msg604, +]); + +var msg605 = msg("321", dup224); + +var all30 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup87, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg606 = msg("321:01", all30); + +var select243 = linear_select([ + msg605, + msg606, +]); + +var msg607 = msg("322", dup225); + +var msg608 = msg("322:01", dup226); + +var select244 = linear_select([ + msg607, + msg608, +]); + +var msg609 = msg("323", dup225); + +var msg610 = msg("323:01", dup226); + +var select245 = linear_select([ + msg609, + msg610, +]); + +var msg611 = msg("324", dup225); + +var msg612 = msg("324:01", dup226); + +var select246 = linear_select([ + msg611, + msg612, +]); + +var msg613 = msg("325", dup225); + +var msg614 = msg("325:01", dup226); + +var select247 = linear_select([ + msg613, + msg614, +]); + +var msg615 = msg("326", dup225); + +var msg616 = msg("326:01", dup226); + +var select248 = linear_select([ + msg615, + msg616, +]); + +var msg617 = msg("327", dup225); + +var msg618 = msg("327:01", dup226); + +var select249 = linear_select([ + msg617, + msg618, +]); + +var msg619 = msg("328", dup225); + +var msg620 = msg("328:01", dup226); + +var select250 = linear_select([ + msg619, + msg620, +]); + +var msg621 = msg("329", dup225); + +var msg622 = msg("329:01", dup226); + +var select251 = linear_select([ + msg621, + msg622, +]); + +var msg623 = msg("330", dup225); + +var msg624 = msg("330:01", dup226); + +var select252 = linear_select([ + msg623, + msg624, +]); + +var msg625 = msg("331", dup225); + +var msg626 = msg("331:01", dup226); + +var select253 = linear_select([ + msg625, + msg626, +]); + +var msg627 = msg("332", dup225); + +var msg628 = msg("332:01", dup226); + +var select254 = linear_select([ + msg627, + msg628, +]); + +var msg629 = msg("333", dup225); + +var msg630 = msg("333:01", dup226); + +var select255 = linear_select([ + msg629, + msg630, +]); + +var msg631 = msg("334", dup227); + +var msg632 = msg("334:01", dup228); + +var select256 = linear_select([ + msg631, + msg632, +]); + +var msg633 = msg("335", dup227); + +var msg634 = msg("335:01", dup228); + +var select257 = linear_select([ + msg633, + msg634, +]); + +var msg635 = msg("336", dup227); + +var msg636 = msg("336:01", dup228); + +var select258 = linear_select([ + msg635, + msg636, +]); + +var msg637 = msg("337", dup222); + +var msg638 = msg("337:01", dup223); + +var select259 = linear_select([ + msg637, + msg638, +]); + +var msg639 = msg("338", dup227); + +var msg640 = msg("338:01", dup228); + +var select260 = linear_select([ + msg639, + msg640, +]); + +var msg641 = msg("339", dup227); + +var msg642 = msg("339:01", dup228); + +var select261 = linear_select([ + msg641, + msg642, +]); + +var msg643 = msg("340", dup197); + +var msg644 = msg("340:01", dup221); + +var select262 = linear_select([ + msg643, + msg644, +]); + +var msg645 = msg("341", dup197); + +var msg646 = msg("341:01", dup221); + +var select263 = linear_select([ + msg645, + msg646, +]); + +var msg647 = msg("342", dup197); + +var msg648 = msg("342:01", dup221); + +var select264 = linear_select([ + msg647, + msg648, +]); + +var msg649 = msg("343", dup197); + +var msg650 = msg("343:01", dup221); + +var select265 = linear_select([ + msg649, + msg650, +]); + +var msg651 = msg("344", dup197); + +var msg652 = msg("344:01", dup221); + +var select266 = linear_select([ + msg651, + msg652, +]); + +var msg653 = msg("345", dup197); + +var msg654 = msg("345:01", dup221); + +var select267 = linear_select([ + msg653, + msg654, +]); + +var msg655 = msg("346", dup227); + +var msg656 = msg("346:01", dup228); + +var select268 = linear_select([ + msg655, + msg656, +]); + +var msg657 = msg("347", dup227); + +var msg658 = msg("347:01", dup228); + +var select269 = linear_select([ + msg657, + msg658, +]); + +var msg659 = msg("348", dup227); + +var msg660 = msg("348:01", dup228); + +var select270 = linear_select([ + msg659, + msg660, +]); + +var msg661 = msg("349", dup197); + +var msg662 = msg("349:01", dup221); + +var select271 = linear_select([ + msg661, + msg662, +]); + +var msg663 = msg("350", dup197); + +var msg664 = msg("350:01", dup221); + +var select272 = linear_select([ + msg663, + msg664, +]); + +var msg665 = msg("351", dup197); + +var msg666 = msg("351:01", dup221); + +var select273 = linear_select([ + msg665, + msg666, +]); + +var msg667 = msg("352", dup197); + +var msg668 = msg("352:01", dup221); + +var select274 = linear_select([ + msg667, + msg668, +]); + +var msg669 = msg("353", dup194); + +var msg670 = msg("353:01", dup229); + +var select275 = linear_select([ + msg669, + msg670, +]); + +var msg671 = msg("354", dup194); + +var msg672 = msg("354:01", dup229); + +var select276 = linear_select([ + msg671, + msg672, +]); + +var msg673 = msg("355", dup227); + +var msg674 = msg("355:01", dup228); + +var select277 = linear_select([ + msg673, + msg674, +]); + +var msg675 = msg("356", dup227); + +var msg676 = msg("356:01", dup228); + +var select278 = linear_select([ + msg675, + msg676, +]); + +var msg677 = msg("357", dup194); + +var msg678 = msg("357:01", dup229); + +var select279 = linear_select([ + msg677, + msg678, +]); + +var msg679 = msg("358", dup194); + +var msg680 = msg("358:01", dup229); + +var select280 = linear_select([ + msg679, + msg680, +]); + +var all31 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup82, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg681 = msg("359", all31); + +var all32 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup82, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg682 = msg("359:01", all32); + +var select281 = linear_select([ + msg681, + msg682, +]); + +var msg683 = msg("360", dup227); + +var msg684 = msg("360:01", dup228); + +var select282 = linear_select([ + msg683, + msg684, +]); + +var msg685 = msg("361", dup227); + +var msg686 = msg("361:01", dup228); + +var select283 = linear_select([ + msg685, + msg686, +]); + +var msg687 = msg("362", dup227); + +var msg688 = msg("362:01", dup228); + +var select284 = linear_select([ + msg687, + msg688, +]); + +var msg689 = msg("363", dup230); + +var msg690 = msg("363:01", dup231); + +var select285 = linear_select([ + msg689, + msg690, +]); + +var msg691 = msg("364", dup230); + +var msg692 = msg("364:01", dup231); + +var select286 = linear_select([ + msg691, + msg692, +]); + +var msg693 = msg("365", dup232); + +var msg694 = msg("365:01", dup231); + +var select287 = linear_select([ + msg693, + msg694, +]); + +var msg695 = msg("366", dup232); + +var msg696 = msg("366:01", dup231); + +var select288 = linear_select([ + msg695, + msg696, +]); + +var msg697 = msg("368", dup232); + +var msg698 = msg("368:01", dup231); + +var select289 = linear_select([ + msg697, + msg698, +]); + +var msg699 = msg("369", dup232); + +var msg700 = msg("369:01", dup231); + +var select290 = linear_select([ + msg699, + msg700, +]); + +var msg701 = msg("370", dup232); + +var msg702 = msg("370:01", dup231); + +var select291 = linear_select([ + msg701, + msg702, +]); + +var msg703 = msg("371", dup232); + +var msg704 = msg("371:01", dup231); + +var select292 = linear_select([ + msg703, + msg704, +]); + +var msg705 = msg("372", dup232); + +var msg706 = msg("372:01", dup231); + +var select293 = linear_select([ + msg705, + msg706, +]); + +var msg707 = msg("373", dup232); + +var msg708 = msg("373:01", dup231); + +var select294 = linear_select([ + msg707, + msg708, +]); + +var msg709 = msg("374", dup232); + +var msg710 = msg("374:01", dup231); + +var select295 = linear_select([ + msg709, + msg710, +]); + +var msg711 = msg("375", dup232); + +var msg712 = msg("375:01", dup231); + +var select296 = linear_select([ + msg711, + msg712, +]); + +var msg713 = msg("376", dup232); + +var msg714 = msg("376:01", dup233); + +var select297 = linear_select([ + msg713, + msg714, +]); + +var msg715 = msg("377", dup232); + +var msg716 = msg("377:01", dup231); + +var select298 = linear_select([ + msg715, + msg716, +]); + +var msg717 = msg("378", dup232); + +var msg718 = msg("378:01", dup231); + +var select299 = linear_select([ + msg717, + msg718, +]); + +var msg719 = msg("379", dup232); + +var msg720 = msg("379:01", dup231); + +var select300 = linear_select([ + msg719, + msg720, +]); + +var msg721 = msg("380", dup232); + +var msg722 = msg("380:01", dup231); + +var select301 = linear_select([ + msg721, + msg722, +]); + +var msg723 = msg("381", dup232); + +var msg724 = msg("381:01", dup231); + +var select302 = linear_select([ + msg723, + msg724, +]); + +var msg725 = msg("382", dup232); + +var msg726 = msg("382:01", dup231); + +var select303 = linear_select([ + msg725, + msg726, +]); + +var msg727 = msg("384", dup232); + +var msg728 = msg("384:01", dup231); + +var select304 = linear_select([ + msg727, + msg728, +]); + +var msg729 = msg("385", dup232); + +var msg730 = msg("385:01", dup231); + +var select305 = linear_select([ + msg729, + msg730, +]); + +var msg731 = msg("386", dup232); + +var msg732 = msg("386:01", dup231); + +var select306 = linear_select([ + msg731, + msg732, +]); + +var msg733 = msg("387", dup232); + +var msg734 = msg("387:01", dup231); + +var select307 = linear_select([ + msg733, + msg734, +]); + +var msg735 = msg("388", dup232); + +var msg736 = msg("388:01", dup231); + +var select308 = linear_select([ + msg735, + msg736, +]); + +var msg737 = msg("389", dup232); + +var msg738 = msg("389:01", dup231); + +var select309 = linear_select([ + msg737, + msg738, +]); + +var msg739 = msg("390", dup230); + +var msg740 = msg("390:01", dup231); + +var select310 = linear_select([ + msg739, + msg740, +]); + +var msg741 = msg("391", dup232); + +var msg742 = msg("391:01", dup231); + +var select311 = linear_select([ + msg741, + msg742, +]); + +var msg743 = msg("392", dup232); + +var msg744 = msg("392:01", dup231); + +var select312 = linear_select([ + msg743, + msg744, +]); + +var msg745 = msg("393", dup232); + +var msg746 = msg("393:01", dup231); + +var select313 = linear_select([ + msg745, + msg746, +]); + +var msg747 = msg("394", dup232); + +var msg748 = msg("394:01", dup231); + +var select314 = linear_select([ + msg747, + msg748, +]); + +var msg749 = msg("395", dup232); + +var msg750 = msg("395:01", dup231); + +var select315 = linear_select([ + msg749, + msg750, +]); + +var msg751 = msg("396", dup232); + +var msg752 = msg("396:01", dup231); + +var select316 = linear_select([ + msg751, + msg752, +]); + +var msg753 = msg("397", dup232); + +var msg754 = msg("397:01", dup231); + +var select317 = linear_select([ + msg753, + msg754, +]); + +var msg755 = msg("398", dup232); + +var msg756 = msg("398:01", dup231); + +var select318 = linear_select([ + msg755, + msg756, +]); + +var msg757 = msg("399", dup232); + +var msg758 = msg("399:01", dup231); + +var select319 = linear_select([ + msg757, + msg758, +]); + +var msg759 = msg("400", dup232); + +var msg760 = msg("400:01", dup231); + +var select320 = linear_select([ + msg759, + msg760, +]); + +var msg761 = msg("401", dup232); + +var msg762 = msg("401:01", dup231); + +var select321 = linear_select([ + msg761, + msg762, +]); + +var msg763 = msg("402", dup232); + +var msg764 = msg("402:01", dup231); + +var select322 = linear_select([ + msg763, + msg764, +]); + +var msg765 = msg("403", dup232); + +var msg766 = msg("403:01", dup231); + +var select323 = linear_select([ + msg765, + msg766, +]); + +var msg767 = msg("404", dup232); + +var msg768 = msg("404:01", dup231); + +var select324 = linear_select([ + msg767, + msg768, +]); + +var msg769 = msg("405", dup232); + +var msg770 = msg("405:01", dup231); + +var select325 = linear_select([ + msg769, + msg770, +]); + +var msg771 = msg("406", dup232); + +var msg772 = msg("406:01", dup231); + +var select326 = linear_select([ + msg771, + msg772, +]); + +var msg773 = msg("407", dup232); + +var msg774 = msg("407:01", dup231); + +var select327 = linear_select([ + msg773, + msg774, +]); + +var msg775 = msg("408", dup232); + +var msg776 = msg("408:01", dup231); + +var select328 = linear_select([ + msg775, + msg776, +]); + +var msg777 = msg("409", dup232); + +var msg778 = msg("409:01", dup231); + +var select329 = linear_select([ + msg777, + msg778, +]); + +var msg779 = msg("410", dup232); + +var msg780 = msg("410:01", dup231); + +var select330 = linear_select([ + msg779, + msg780, +]); + +var msg781 = msg("411", dup232); + +var msg782 = msg("411:01", dup231); + +var select331 = linear_select([ + msg781, + msg782, +]); + +var msg783 = msg("412", dup232); + +var msg784 = msg("412:01", dup231); + +var select332 = linear_select([ + msg783, + msg784, +]); + +var msg785 = msg("413", dup232); + +var msg786 = msg("413:01", dup231); + +var select333 = linear_select([ + msg785, + msg786, +]); + +var msg787 = msg("414", dup232); + +var msg788 = msg("414:01", dup231); + +var select334 = linear_select([ + msg787, + msg788, +]); + +var msg789 = msg("415", dup232); + +var msg790 = msg("415:01", dup231); + +var select335 = linear_select([ + msg789, + msg790, +]); + +var msg791 = msg("416", dup232); + +var msg792 = msg("416:01", dup231); + +var select336 = linear_select([ + msg791, + msg792, +]); + +var msg793 = msg("417", dup232); + +var msg794 = msg("417:01", dup231); + +var select337 = linear_select([ + msg793, + msg794, +]); + +var msg795 = msg("418", dup232); + +var msg796 = msg("418:01", dup231); + +var select338 = linear_select([ + msg795, + msg796, +]); + +var msg797 = msg("419", dup232); + +var msg798 = msg("419:01", dup231); + +var select339 = linear_select([ + msg797, + msg798, +]); + +var msg799 = msg("420", dup232); + +var msg800 = msg("420:01", dup231); + +var select340 = linear_select([ + msg799, + msg800, +]); + +var msg801 = msg("421", dup232); + +var msg802 = msg("421:01", dup231); + +var select341 = linear_select([ + msg801, + msg802, +]); + +var msg803 = msg("422", dup232); + +var msg804 = msg("422:01", dup231); + +var select342 = linear_select([ + msg803, + msg804, +]); + +var msg805 = msg("423", dup232); + +var msg806 = msg("423:01", dup231); + +var select343 = linear_select([ + msg805, + msg806, +]); + +var msg807 = msg("424", dup232); + +var msg808 = msg("424:01", dup231); + +var select344 = linear_select([ + msg807, + msg808, +]); + +var msg809 = msg("425", dup232); + +var msg810 = msg("425:01", dup231); + +var select345 = linear_select([ + msg809, + msg810, +]); + +var msg811 = msg("426", dup232); + +var msg812 = msg("426:01", dup231); + +var select346 = linear_select([ + msg811, + msg812, +]); + +var msg813 = msg("427", dup232); + +var msg814 = msg("427:01", dup231); + +var select347 = linear_select([ + msg813, + msg814, +]); + +var msg815 = msg("428", dup232); + +var msg816 = msg("428:01", dup231); + +var select348 = linear_select([ + msg815, + msg816, +]); + +var msg817 = msg("429", dup232); + +var msg818 = msg("429:01", dup231); + +var select349 = linear_select([ + msg817, + msg818, +]); + +var msg819 = msg("430", dup232); + +var msg820 = msg("430:01", dup231); + +var select350 = linear_select([ + msg819, + msg820, +]); + +var all33 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg821 = msg("431", all33); + +var all34 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg822 = msg("431:01", all34); + +var select351 = linear_select([ + msg821, + msg822, +]); + +var msg823 = msg("432", dup232); + +var msg824 = msg("432:01", dup231); + +var select352 = linear_select([ + msg823, + msg824, +]); + +var msg825 = msg("433", dup232); + +var msg826 = msg("433:01", dup231); + +var select353 = linear_select([ + msg825, + msg826, +]); + +var msg827 = msg("436", dup232); + +var msg828 = msg("436:01", dup231); + +var select354 = linear_select([ + msg827, + msg828, +]); + +var msg829 = msg("437", dup232); + +var msg830 = msg("437:01", dup231); + +var select355 = linear_select([ + msg829, + msg830, +]); + +var msg831 = msg("438", dup232); + +var msg832 = msg("438:01", dup231); + +var select356 = linear_select([ + msg831, + msg832, +]); + +var msg833 = msg("439", dup232); + +var msg834 = msg("439:01", dup231); + +var select357 = linear_select([ + msg833, + msg834, +]); + +var msg835 = msg("440", dup232); + +var msg836 = msg("440:01", dup231); + +var select358 = linear_select([ + msg835, + msg836, +]); + +var msg837 = msg("441", dup232); + +var msg838 = msg("441:01", dup231); + +var select359 = linear_select([ + msg837, + msg838, +]); + +var msg839 = msg("443", dup232); + +var msg840 = msg("443:01", dup231); + +var select360 = linear_select([ + msg839, + msg840, +]); + +var msg841 = msg("445", dup232); + +var msg842 = msg("445:01", dup231); + +var select361 = linear_select([ + msg841, + msg842, +]); + +var msg843 = msg("446", dup232); + +var msg844 = msg("446:01", dup231); + +var select362 = linear_select([ + msg843, + msg844, +]); + +var msg845 = msg("448", dup232); + +var msg846 = msg("448:01", dup231); + +var select363 = linear_select([ + msg845, + msg846, +]); + +var msg847 = msg("449", dup232); + +var msg848 = msg("449:01", dup231); + +var select364 = linear_select([ + msg847, + msg848, +]); + +var msg849 = msg("450", dup232); + +var msg850 = msg("450:01", dup231); + +var select365 = linear_select([ + msg849, + msg850, +]); + +var msg851 = msg("451", dup232); + +var msg852 = msg("451:01", dup231); + +var select366 = linear_select([ + msg851, + msg852, +]); + +var msg853 = msg("452", dup232); + +var msg854 = msg("452:01", dup231); + +var select367 = linear_select([ + msg853, + msg854, +]); + +var msg855 = msg("453", dup232); + +var msg856 = msg("453:01", dup231); + +var select368 = linear_select([ + msg855, + msg856, +]); + +var msg857 = msg("454", dup232); + +var msg858 = msg("454:01", dup231); + +var select369 = linear_select([ + msg857, + msg858, +]); + +var msg859 = msg("455", dup232); + +var msg860 = msg("455:01", dup231); + +var select370 = linear_select([ + msg859, + msg860, +]); + +var msg861 = msg("456", dup232); + +var msg862 = msg("456:01", dup231); + +var select371 = linear_select([ + msg861, + msg862, +]); + +var msg863 = msg("457", dup232); + +var msg864 = msg("457:01", dup231); + +var select372 = linear_select([ + msg863, + msg864, +]); + +var msg865 = msg("458", dup232); + +var msg866 = msg("458:01", dup231); + +var select373 = linear_select([ + msg865, + msg866, +]); + +var msg867 = msg("459", dup232); + +var msg868 = msg("459:01", dup231); + +var select374 = linear_select([ + msg867, + msg868, +]); + +var msg869 = msg("460", dup232); + +var msg870 = msg("460:01", dup231); + +var select375 = linear_select([ + msg869, + msg870, +]); + +var msg871 = msg("461", dup232); + +var msg872 = msg("461:01", dup231); + +var select376 = linear_select([ + msg871, + msg872, +]); + +var msg873 = msg("462", dup232); + +var msg874 = msg("462:01", dup231); + +var select377 = linear_select([ + msg873, + msg874, +]); + +var msg875 = msg("463", dup232); + +var msg876 = msg("463:01", dup231); + +var select378 = linear_select([ + msg875, + msg876, +]); + +var msg877 = msg("465", dup232); + +var msg878 = msg("465:01", dup231); + +var select379 = linear_select([ + msg877, + msg878, +]); + +var msg879 = msg("466", dup232); + +var msg880 = msg("466:01", dup231); + +var select380 = linear_select([ + msg879, + msg880, +]); + +var msg881 = msg("467", dup232); + +var msg882 = msg("467:01", dup231); + +var select381 = linear_select([ + msg881, + msg882, +]); + +var msg883 = msg("469", dup232); + +var msg884 = msg("469:01", dup231); + +var select382 = linear_select([ + msg883, + msg884, +]); + +var msg885 = msg("471", dup230); + +var msg886 = msg("471:01", dup233); + +var select383 = linear_select([ + msg885, + msg886, +]); + +var msg887 = msg("472", dup232); + +var msg888 = msg("472:01", dup231); + +var select384 = linear_select([ + msg887, + msg888, +]); + +var msg889 = msg("473", dup232); + +var msg890 = msg("473:01", dup231); + +var select385 = linear_select([ + msg889, + msg890, +]); + +var msg891 = msg("474", dup234); + +var msg892 = msg("474:01", dup235); + +var select386 = linear_select([ + msg891, + msg892, +]); + +var msg893 = msg("475", dup232); + +var msg894 = msg("475:01", dup231); + +var select387 = linear_select([ + msg893, + msg894, +]); + +var msg895 = msg("476", dup234); + +var msg896 = msg("476:01", dup235); + +var select388 = linear_select([ + msg895, + msg896, +]); + +var msg897 = msg("477", dup230); + +var msg898 = msg("477:01", dup233); + +var select389 = linear_select([ + msg897, + msg898, +]); + +var msg899 = msg("478", dup194); + +var msg900 = msg("478:01", dup229); + +var select390 = linear_select([ + msg899, + msg900, +]); + +var msg901 = msg("480", dup232); + +var msg902 = msg("480:01", dup231); + +var select391 = linear_select([ + msg901, + msg902, +]); + +var msg903 = msg("481", dup232); + +var msg904 = msg("481:01", dup231); + +var select392 = linear_select([ + msg903, + msg904, +]); + +var msg905 = msg("482", dup232); + +var msg906 = msg("482:01", dup231); + +var select393 = linear_select([ + msg905, + msg906, +]); + +var msg907 = msg("483", dup232); + +var msg908 = msg("483:01", dup231); + +var select394 = linear_select([ + msg907, + msg908, +]); + +var msg909 = msg("484", dup234); + +var msg910 = msg("484:01", dup235); + +var select395 = linear_select([ + msg909, + msg910, +]); + +var msg911 = msg("485", dup232); + +var msg912 = msg("485:01", dup231); + +var select396 = linear_select([ + msg911, + msg912, +]); + +var msg913 = msg("486", dup232); + +var msg914 = msg("486:01", dup231); + +var select397 = linear_select([ + msg913, + msg914, +]); + +var msg915 = msg("487", dup232); + +var msg916 = msg("487:01", dup231); + +var select398 = linear_select([ + msg915, + msg916, +]); + +var msg917 = msg("488", dup196); + +var msg918 = msg("488:01", dup217); + +var select399 = linear_select([ + msg917, + msg918, +]); + +var msg919 = msg("489", dup227); + +var msg920 = msg("489:01", dup228); + +var select400 = linear_select([ + msg919, + msg920, +]); + +var msg921 = msg("490", dup196); + +var msg922 = msg("490:01", dup217); + +var select401 = linear_select([ + msg921, + msg922, +]); + +var msg923 = msg("491", dup227); + +var msg924 = msg("492", dup236); + +var msg925 = msg("492:01", dup237); + +var select402 = linear_select([ + msg924, + msg925, +]); + +var msg926 = msg("493", dup196); + +var msg927 = msg("493:01", dup217); + +var select403 = linear_select([ + msg926, + msg927, +]); + +var msg928 = msg("494", dup196); + +var msg929 = msg("494:01", dup217); + +var select404 = linear_select([ + msg928, + msg929, +]); + +var msg930 = msg("495", dup196); + +var msg931 = msg("495:01", dup217); + +var select405 = linear_select([ + msg930, + msg931, +]); + +var msg932 = msg("496", dup196); + +var msg933 = msg("496:01", dup217); + +var select406 = linear_select([ + msg932, + msg933, +]); + +var msg934 = msg("497", dup196); + +var msg935 = msg("497:01", dup217); + +var select407 = linear_select([ + msg934, + msg935, +]); + +var msg936 = msg("498", dup196); + +var msg937 = msg("498:01", dup217); + +var select408 = linear_select([ + msg936, + msg937, +]); + +var msg938 = msg("499", dup230); + +var msg939 = msg("499:01", dup233); + +var select409 = linear_select([ + msg938, + msg939, +]); + +var msg940 = msg("500", dup196); + +var msg941 = msg("500:01", dup217); + +var select410 = linear_select([ + msg940, + msg941, +]); + +var msg942 = msg("501", dup196); + +var msg943 = msg("501:01", dup217); + +var select411 = linear_select([ + msg942, + msg943, +]); + +var msg944 = msg("502", dup196); + +var msg945 = msg("502:01", dup217); + +var select412 = linear_select([ + msg944, + msg945, +]); + +var msg946 = msg("503", dup196); + +var msg947 = msg("503:01", dup217); + +var select413 = linear_select([ + msg946, + msg947, +]); + +var msg948 = msg("504", dup196); + +var msg949 = msg("504:01", dup217); + +var select414 = linear_select([ + msg948, + msg949, +]); + +var msg950 = msg("505", dup196); + +var msg951 = msg("505:01", dup217); + +var select415 = linear_select([ + msg950, + msg951, +]); + +var msg952 = msg("506", dup238); + +var msg953 = msg("506:01", dup239); + +var select416 = linear_select([ + msg952, + msg953, +]); + +var msg954 = msg("507", dup196); + +var msg955 = msg("507:01", dup217); + +var select417 = linear_select([ + msg954, + msg955, +]); + +var msg956 = msg("508", dup196); + +var msg957 = msg("508:01", dup217); + +var select418 = linear_select([ + msg956, + msg957, +]); + +var msg958 = msg("509", dup240); + +var msg959 = msg("509:01", dup241); + +var select419 = linear_select([ + msg958, + msg959, +]); + +var msg960 = msg("510", dup196); + +var msg961 = msg("510:01", dup217); + +var select420 = linear_select([ + msg960, + msg961, +]); + +var msg962 = msg("511", dup196); + +var msg963 = msg("511:01", dup217); + +var select421 = linear_select([ + msg962, + msg963, +]); + +var msg964 = msg("512", dup236); + +var msg965 = msg("512:01", dup237); + +var select422 = linear_select([ + msg964, + msg965, +]); + +var msg966 = msg("513", dup196); + +var msg967 = msg("513:01", dup217); + +var select423 = linear_select([ + msg966, + msg967, +]); + +var msg968 = msg("514", dup238); + +var msg969 = msg("514:01", dup239); + +var select424 = linear_select([ + msg968, + msg969, +]); + +var msg970 = msg("516", dup242); + +var msg971 = msg("516:01", dup243); + +var select425 = linear_select([ + msg970, + msg971, +]); + +var msg972 = msg("517", dup196); + +var msg973 = msg("517:01", dup217); + +var select426 = linear_select([ + msg972, + msg973, +]); + +var msg974 = msg("518", dup196); + +var msg975 = msg("518:01", dup217); + +var select427 = linear_select([ + msg974, + msg975, +]); + +var msg976 = msg("519", dup196); + +var msg977 = msg("519:01", dup217); + +var select428 = linear_select([ + msg976, + msg977, +]); + +var msg978 = msg("520", dup196); + +var msg979 = msg("520:01", dup217); + +var select429 = linear_select([ + msg978, + msg979, +]); + +var msg980 = msg("521", dup196); + +var msg981 = msg("521:01", dup217); + +var select430 = linear_select([ + msg980, + msg981, +]); + +var msg982 = msg("522", dup196); + +var msg983 = msg("522:01", dup217); + +var select431 = linear_select([ + msg982, + msg983, +]); + +var msg984 = msg("523", dup196); + +var msg985 = msg("523:01", dup217); + +var select432 = linear_select([ + msg984, + msg985, +]); + +var msg986 = msg("524", dup244); + +var msg987 = msg("524:01", dup245); + +var select433 = linear_select([ + msg986, + msg987, +]); + +var msg988 = msg("525", dup196); + +var msg989 = msg("525:01", dup217); + +var select434 = linear_select([ + msg988, + msg989, +]); + +var msg990 = msg("526", dup244); + +var msg991 = msg("526:01", dup245); + +var select435 = linear_select([ + msg990, + msg991, +]); + +var msg992 = msg("527", dup196); + +var msg993 = msg("527:01", dup217); + +var select436 = linear_select([ + msg992, + msg993, +]); + +var msg994 = msg("528", dup196); + +var msg995 = msg("528:01", dup217); + +var select437 = linear_select([ + msg994, + msg995, +]); + +var msg996 = msg("529", dup198); + +var msg997 = msg("529:01", dup220); + +var select438 = linear_select([ + msg996, + msg997, +]); + +var msg998 = msg("530", dup196); + +var msg999 = msg("530:01", dup217); + +var select439 = linear_select([ + msg998, + msg999, +]); + +var msg1000 = msg("532", dup246); + +var msg1001 = msg("532:01", dup247); + +var select440 = linear_select([ + msg1000, + msg1001, +]); + +var msg1002 = msg("533", dup246); + +var msg1003 = msg("533:01", dup247); + +var select441 = linear_select([ + msg1002, + msg1003, +]); + +var msg1004 = msg("534", dup196); + +var msg1005 = msg("534:01", dup217); + +var select442 = linear_select([ + msg1004, + msg1005, +]); + +var msg1006 = msg("535", dup196); + +var msg1007 = msg("535:01", dup217); + +var select443 = linear_select([ + msg1006, + msg1007, +]); + +var msg1008 = msg("536", dup246); + +var msg1009 = msg("536:01", dup247); + +var select444 = linear_select([ + msg1008, + msg1009, +]); + +var msg1010 = msg("537", dup246); + +var msg1011 = msg("537:01", dup247); + +var select445 = linear_select([ + msg1010, + msg1011, +]); + +var msg1012 = msg("538", dup246); + +var msg1013 = msg("538:01", dup247); + +var select446 = linear_select([ + msg1012, + msg1013, +]); + +var msg1014 = msg("539", dup246); + +var msg1015 = msg("539:01", dup247); + +var select447 = linear_select([ + msg1014, + msg1015, +]); + +var msg1016 = msg("540", dup196); + +var msg1017 = msg("540:01", dup217); + +var select448 = linear_select([ + msg1016, + msg1017, +]); + +var msg1018 = msg("541", dup196); + +var msg1019 = msg("541:01", dup217); + +var select449 = linear_select([ + msg1018, + msg1019, +]); + +var msg1020 = msg("542", dup196); + +var msg1021 = msg("542:01", dup217); + +var select450 = linear_select([ + msg1020, + msg1021, +]); + +var msg1022 = msg("543", dup227); + +var msg1023 = msg("543:01", dup228); + +var select451 = linear_select([ + msg1022, + msg1023, +]); + +var msg1024 = msg("544", dup227); + +var msg1025 = msg("544:01", dup228); + +var select452 = linear_select([ + msg1024, + msg1025, +]); + +var msg1026 = msg("545", dup227); + +var msg1027 = msg("545:01", dup228); + +var select453 = linear_select([ + msg1026, + msg1027, +]); + +var msg1028 = msg("546", dup227); + +var msg1029 = msg("546:01", dup228); + +var select454 = linear_select([ + msg1028, + msg1029, +]); + +var msg1030 = msg("547", dup227); + +var msg1031 = msg("547:01", dup228); + +var select455 = linear_select([ + msg1030, + msg1031, +]); + +var msg1032 = msg("548", dup227); + +var msg1033 = msg("548:01", dup228); + +var select456 = linear_select([ + msg1032, + msg1033, +]); + +var msg1034 = msg("549", dup196); + +var msg1035 = msg("549:01", dup217); + +var select457 = linear_select([ + msg1034, + msg1035, +]); + +var msg1036 = msg("550", dup196); + +var msg1037 = msg("550:01", dup217); + +var select458 = linear_select([ + msg1036, + msg1037, +]); + +var msg1038 = msg("551", dup196); + +var msg1039 = msg("551:01", dup217); + +var select459 = linear_select([ + msg1038, + msg1039, +]); + +var msg1040 = msg("552", dup196); + +var msg1041 = msg("552:01", dup217); + +var select460 = linear_select([ + msg1040, + msg1041, +]); + +var msg1042 = msg("553", dup227); + +var msg1043 = msg("553:01", dup228); + +var select461 = linear_select([ + msg1042, + msg1043, +]); + +var msg1044 = msg("554", dup227); + +var msg1045 = msg("554:01", dup228); + +var select462 = linear_select([ + msg1044, + msg1045, +]); + +var msg1046 = msg("555", dup248); + +var msg1047 = msg("555:01", dup249); + +var select463 = linear_select([ + msg1046, + msg1047, +]); + +var msg1048 = msg("556", dup196); + +var msg1049 = msg("556:01", dup217); + +var select464 = linear_select([ + msg1048, + msg1049, +]); + +var msg1050 = msg("557", dup196); + +var msg1051 = msg("557:01", dup217); + +var select465 = linear_select([ + msg1050, + msg1051, +]); + +var msg1052 = msg("558", dup196); + +var msg1053 = msg("558:01", dup217); + +var select466 = linear_select([ + msg1052, + msg1053, +]); + +var msg1054 = msg("559", dup196); + +var msg1055 = msg("559:01", dup217); + +var select467 = linear_select([ + msg1054, + msg1055, +]); + +var msg1056 = msg("560", dup196); + +var msg1057 = msg("560:01", dup217); + +var select468 = linear_select([ + msg1056, + msg1057, +]); + +var msg1058 = msg("561", dup196); + +var msg1059 = msg("561:01", dup217); + +var select469 = linear_select([ + msg1058, + msg1059, +]); + +var msg1060 = msg("562", dup196); + +var msg1061 = msg("562:01", dup217); + +var select470 = linear_select([ + msg1060, + msg1061, +]); + +var msg1062 = msg("563", dup196); + +var msg1063 = msg("563:01", dup217); + +var select471 = linear_select([ + msg1062, + msg1063, +]); + +var msg1064 = msg("564", dup196); + +var msg1065 = msg("564:01", dup217); + +var select472 = linear_select([ + msg1064, + msg1065, +]); + +var msg1066 = msg("565", dup196); + +var msg1067 = msg("565:01", dup217); + +var select473 = linear_select([ + msg1066, + msg1067, +]); + +var msg1068 = msg("566", dup196); + +var msg1069 = msg("566:01", dup217); + +var select474 = linear_select([ + msg1068, + msg1069, +]); + +var msg1070 = msg("567", dup250); + +var msg1071 = msg("567:01", dup251); + +var select475 = linear_select([ + msg1070, + msg1071, +]); + +var msg1072 = msg("568", dup196); + +var msg1073 = msg("568:01", dup217); + +var select476 = linear_select([ + msg1072, + msg1073, +]); + +var msg1074 = msg("569", dup252); + +var all35 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg1075 = msg("569:01", all35); + +var select477 = linear_select([ + msg1074, + msg1075, +]); + +var msg1076 = msg("570", dup197); + +var msg1077 = msg("570:01", dup221); + +var select478 = linear_select([ + msg1076, + msg1077, +]); + +var msg1078 = msg("571", dup197); + +var msg1079 = msg("571:01", dup221); + +var select479 = linear_select([ + msg1078, + msg1079, +]); + +var msg1080 = msg("572", dup198); + +var msg1081 = msg("572:01", dup220); + +var select480 = linear_select([ + msg1080, + msg1081, +]); + +var msg1082 = msg("573", dup197); + +var msg1083 = msg("573:01", dup221); + +var select481 = linear_select([ + msg1082, + msg1083, +]); + +var msg1084 = msg("574", dup253); + +var msg1085 = msg("574:01", dup254); + +var select482 = linear_select([ + msg1084, + msg1085, +]); + +var msg1086 = msg("575", dup255); + +var msg1087 = msg("575:01", dup256); + +var select483 = linear_select([ + msg1086, + msg1087, +]); + +var msg1088 = msg("576", dup255); + +var msg1089 = msg("576:01", dup256); + +var select484 = linear_select([ + msg1088, + msg1089, +]); + +var msg1090 = msg("577", dup255); + +var msg1091 = msg("577:01", dup256); + +var select485 = linear_select([ + msg1090, + msg1091, +]); + +var msg1092 = msg("578", dup255); + +var msg1093 = msg("578:01", dup256); + +var select486 = linear_select([ + msg1092, + msg1093, +]); + +var msg1094 = msg("579", dup255); + +var msg1095 = msg("579:01", dup256); + +var select487 = linear_select([ + msg1094, + msg1095, +]); + +var msg1096 = msg("580", dup255); + +var msg1097 = msg("580:01", dup256); + +var select488 = linear_select([ + msg1096, + msg1097, +]); + +var msg1098 = msg("581", dup257); + +var all36 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg1099 = msg("581:01", all36); + +var select489 = linear_select([ + msg1098, + msg1099, +]); + +var msg1100 = msg("582", dup255); + +var msg1101 = msg("582:01", dup256); + +var select490 = linear_select([ + msg1100, + msg1101, +]); + +var msg1102 = msg("583", dup255); + +var msg1103 = msg("583:01", dup256); + +var select491 = linear_select([ + msg1102, + msg1103, +]); + +var msg1104 = msg("584", dup255); + +var msg1105 = msg("584:01", dup256); + +var select492 = linear_select([ + msg1104, + msg1105, +]); + +var msg1106 = msg("585", dup255); + +var msg1107 = msg("585:01", dup256); + +var select493 = linear_select([ + msg1106, + msg1107, +]); + +var msg1108 = msg("586", dup255); + +var msg1109 = msg("586:01", dup256); + +var select494 = linear_select([ + msg1108, + msg1109, +]); + +var msg1110 = msg("587", dup255); + +var msg1111 = msg("587:01", dup256); + +var select495 = linear_select([ + msg1110, + msg1111, +]); + +var msg1112 = msg("588", dup255); + +var msg1113 = msg("588:01", dup256); + +var select496 = linear_select([ + msg1112, + msg1113, +]); + +var msg1114 = msg("589", dup255); + +var msg1115 = msg("589:01", dup256); + +var select497 = linear_select([ + msg1114, + msg1115, +]); + +var msg1116 = msg("590", dup255); + +var msg1117 = msg("590:01", dup256); + +var select498 = linear_select([ + msg1116, + msg1117, +]); + +var msg1118 = msg("591", dup255); + +var msg1119 = msg("591:01", dup256); + +var select499 = linear_select([ + msg1118, + msg1119, +]); + +var msg1120 = msg("592", dup255); + +var msg1121 = msg("592:01", dup256); + +var select500 = linear_select([ + msg1120, + msg1121, +]); + +var msg1122 = msg("593", dup255); + +var msg1123 = msg("593:01", dup256); + +var select501 = linear_select([ + msg1122, + msg1123, +]); + +var msg1124 = msg("594", dup255); + +var msg1125 = msg("594:01", dup256); + +var select502 = linear_select([ + msg1124, + msg1125, +]); + +var msg1126 = msg("595", dup258); + +var msg1127 = msg("595:01", dup259); + +var select503 = linear_select([ + msg1126, + msg1127, +]); + +var msg1128 = msg("596", dup255); + +var msg1129 = msg("596:01", dup256); + +var select504 = linear_select([ + msg1128, + msg1129, +]); + +var msg1130 = msg("597", dup255); + +var msg1131 = msg("597:01", dup256); + +var select505 = linear_select([ + msg1130, + msg1131, +]); + +var msg1132 = msg("598", dup258); + +var msg1133 = msg("598:01", dup259); + +var select506 = linear_select([ + msg1132, + msg1133, +]); + +var msg1134 = msg("599", dup258); + +var msg1135 = msg("599:01", dup259); + +var select507 = linear_select([ + msg1134, + msg1135, +]); + +var msg1136 = msg("600", dup255); + +var msg1137 = msg("600:01", dup256); + +var select508 = linear_select([ + msg1136, + msg1137, +]); + +var msg1138 = msg("601", dup196); + +var msg1139 = msg("601:01", dup217); + +var select509 = linear_select([ + msg1138, + msg1139, +]); + +var msg1140 = msg("602", dup196); + +var msg1141 = msg("602:01", dup217); + +var select510 = linear_select([ + msg1140, + msg1141, +]); + +var msg1142 = msg("603", dup196); + +var msg1143 = msg("603:01", dup217); + +var select511 = linear_select([ + msg1142, + msg1143, +]); + +var msg1144 = msg("604", dup196); + +var msg1145 = msg("604:01", dup217); + +var select512 = linear_select([ + msg1144, + msg1145, +]); + +var msg1146 = msg("605", dup236); + +var msg1147 = msg("605:01", dup237); + +var select513 = linear_select([ + msg1146, + msg1147, +]); + +var msg1148 = msg("606", dup196); + +var msg1149 = msg("606:01", dup217); + +var select514 = linear_select([ + msg1148, + msg1149, +]); + +var msg1150 = msg("607", dup196); + +var msg1151 = msg("607:01", dup217); + +var select515 = linear_select([ + msg1150, + msg1151, +]); + +var msg1152 = msg("608", dup196); + +var msg1153 = msg("608:01", dup217); + +var select516 = linear_select([ + msg1152, + msg1153, +]); + +var msg1154 = msg("609", dup196); + +var msg1155 = msg("609:01", dup217); + +var select517 = linear_select([ + msg1154, + msg1155, +]); + +var msg1156 = msg("610", dup196); + +var msg1157 = msg("610:01", dup217); + +var select518 = linear_select([ + msg1156, + msg1157, +]); + +var msg1158 = msg("611", dup236); + +var msg1159 = msg("611:01", dup237); + +var select519 = linear_select([ + msg1158, + msg1159, +]); + +var msg1160 = msg("612", dup255); + +var msg1161 = msg("612:01", dup256); + +var select520 = linear_select([ + msg1160, + msg1161, +]); + +var msg1162 = msg("613", dup194); + +var msg1163 = msg("613:01", dup229); + +var select521 = linear_select([ + msg1162, + msg1163, +]); + +var msg1164 = msg("614", dup205); + +var msg1165 = msg("614:01", dup206); + +var select522 = linear_select([ + msg1164, + msg1165, +]); + +var msg1166 = msg("615", dup194); + +var msg1167 = msg("615:01", dup229); + +var select523 = linear_select([ + msg1166, + msg1167, +]); + +var msg1168 = msg("616", dup194); + +var msg1169 = msg("616:01", dup229); + +var select524 = linear_select([ + msg1168, + msg1169, +]); + +var msg1170 = msg("617", dup194); + +var msg1171 = msg("617:01", dup229); + +var select525 = linear_select([ + msg1170, + msg1171, +]); + +var msg1172 = msg("618", dup194); + +var msg1173 = msg("618:01", dup229); + +var select526 = linear_select([ + msg1172, + msg1173, +]); + +var msg1174 = msg("619", dup194); + +var msg1175 = msg("619:01", dup229); + +var select527 = linear_select([ + msg1174, + msg1175, +]); + +var msg1176 = msg("620", dup194); + +var msg1177 = msg("620:01", dup229); + +var select528 = linear_select([ + msg1176, + msg1177, +]); + +var msg1178 = msg("621", dup194); + +var msg1179 = msg("621:01", dup229); + +var select529 = linear_select([ + msg1178, + msg1179, +]); + +var msg1180 = msg("622", dup194); + +var msg1181 = msg("622:01", dup229); + +var select530 = linear_select([ + msg1180, + msg1181, +]); + +var msg1182 = msg("623", dup194); + +var msg1183 = msg("623:01", dup229); + +var select531 = linear_select([ + msg1182, + msg1183, +]); + +var msg1184 = msg("624", dup194); + +var msg1185 = msg("624:01", dup229); + +var select532 = linear_select([ + msg1184, + msg1185, +]); + +var msg1186 = msg("625", dup194); + +var msg1187 = msg("625:01", dup229); + +var select533 = linear_select([ + msg1186, + msg1187, +]); + +var msg1188 = msg("626", dup194); + +var msg1189 = msg("626:01", dup229); + +var select534 = linear_select([ + msg1188, + msg1189, +]); + +var msg1190 = msg("627", dup194); + +var msg1191 = msg("627:01", dup229); + +var select535 = linear_select([ + msg1190, + msg1191, +]); + +var msg1192 = msg("628", dup234); + +var msg1193 = msg("628:01", dup235); + +var select536 = linear_select([ + msg1192, + msg1193, +]); + +var msg1194 = msg("629", dup225); + +var msg1195 = msg("629:01", dup226); + +var select537 = linear_select([ + msg1194, + msg1195, +]); + +var msg1196 = msg("630", dup234); + +var msg1197 = msg("630:01", dup229); + +var select538 = linear_select([ + msg1196, + msg1197, +]); + +var all37 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg1198 = msg("631", all37); + +var msg1199 = msg("631:01", dup251); + +var select539 = linear_select([ + msg1198, + msg1199, +]); + +var msg1200 = msg("632", dup250); + +var msg1201 = msg("632:01", dup251); + +var select540 = linear_select([ + msg1200, + msg1201, +]); + +var msg1202 = msg("634", dup194); + +var msg1203 = msg("634:01", dup229); + +var select541 = linear_select([ + msg1202, + msg1203, +]); + +var msg1204 = msg("635", dup194); + +var msg1205 = msg("635:01", dup229); + +var select542 = linear_select([ + msg1204, + msg1205, +]); + +var msg1206 = msg("636", dup194); + +var msg1207 = msg("636:01", dup229); + +var select543 = linear_select([ + msg1206, + msg1207, +]); + +var msg1208 = msg("637", dup194); + +var msg1209 = msg("637:01", dup229); + +var select544 = linear_select([ + msg1208, + msg1209, +]); + +var msg1210 = msg("638", dup196); + +var msg1211 = msg("638:01", dup217); + +var select545 = linear_select([ + msg1210, + msg1211, +]); + +var msg1212 = msg("639", dup196); + +var msg1213 = msg("639:01", dup217); + +var select546 = linear_select([ + msg1212, + msg1213, +]); + +var msg1214 = msg("640", dup196); + +var msg1215 = msg("640:01", dup217); + +var select547 = linear_select([ + msg1214, + msg1215, +]); + +var msg1216 = msg("641", dup196); + +var msg1217 = msg("641:01", dup217); + +var select548 = linear_select([ + msg1216, + msg1217, +]); + +var msg1218 = msg("642", dup196); + +var msg1219 = msg("642:01", dup217); + +var select549 = linear_select([ + msg1218, + msg1219, +]); + +var msg1220 = msg("643", dup196); + +var msg1221 = msg("643:01", dup217); + +var select550 = linear_select([ + msg1220, + msg1221, +]); + +var msg1222 = msg("644", dup196); + +var msg1223 = msg("644:01", dup217); + +var select551 = linear_select([ + msg1222, + msg1223, +]); + +var msg1224 = msg("645", dup196); + +var msg1225 = msg("645:01", dup217); + +var select552 = linear_select([ + msg1224, + msg1225, +]); + +var msg1226 = msg("646", dup196); + +var msg1227 = msg("646:01", dup217); + +var select553 = linear_select([ + msg1226, + msg1227, +]); + +var msg1228 = msg("647", dup196); + +var msg1229 = msg("647:01", dup217); + +var select554 = linear_select([ + msg1228, + msg1229, +]); + +var msg1230 = msg("648", dup196); + +var msg1231 = msg("648:01", dup217); + +var select555 = linear_select([ + msg1230, + msg1231, +]); + +var msg1232 = msg("649", dup196); + +var msg1233 = msg("649:01", dup217); + +var select556 = linear_select([ + msg1232, + msg1233, +]); + +var msg1234 = msg("650", dup196); + +var msg1235 = msg("650:01", dup217); + +var select557 = linear_select([ + msg1234, + msg1235, +]); + +var msg1236 = msg("651", dup196); + +var msg1237 = msg("651:01", dup217); + +var select558 = linear_select([ + msg1236, + msg1237, +]); + +var msg1238 = msg("652", dup196); + +var msg1239 = msg("652:01", dup217); + +var select559 = linear_select([ + msg1238, + msg1239, +]); + +var msg1240 = msg("653", dup196); + +var msg1241 = msg("653:01", dup217); + +var select560 = linear_select([ + msg1240, + msg1241, +]); + +var msg1242 = msg("654", dup197); + +var msg1243 = msg("654:01", dup221); + +var select561 = linear_select([ + msg1242, + msg1243, +]); + +var msg1244 = msg("655", dup250); + +var msg1245 = msg("655:01", dup251); + +var select562 = linear_select([ + msg1244, + msg1245, +]); + +var msg1246 = msg("656", dup197); + +var msg1247 = msg("656:01", dup221); + +var select563 = linear_select([ + msg1246, + msg1247, +]); + +var msg1248 = msg("657", dup197); + +var msg1249 = msg("657:01", dup221); + +var select564 = linear_select([ + msg1248, + msg1249, +]); + +var msg1250 = msg("658", dup198); + +var msg1251 = msg("658:01", dup220); + +var select565 = linear_select([ + msg1250, + msg1251, +]); + +var msg1252 = msg("659", dup250); + +var msg1253 = msg("659:01", dup251); + +var select566 = linear_select([ + msg1252, + msg1253, +]); + +var msg1254 = msg("660", dup250); + +var msg1255 = msg("660:01", dup251); + +var select567 = linear_select([ + msg1254, + msg1255, +]); + +var msg1256 = msg("661", dup250); + +var msg1257 = msg("661:01", dup251); + +var select568 = linear_select([ + msg1256, + msg1257, +]); + +var msg1258 = msg("662", dup250); + +var msg1259 = msg("662:01", dup251); + +var select569 = linear_select([ + msg1258, + msg1259, +]); + +var msg1260 = msg("663", dup250); + +var msg1261 = msg("663:01", dup251); + +var select570 = linear_select([ + msg1260, + msg1261, +]); + +var msg1262 = msg("664", dup250); + +var msg1263 = msg("664:01", dup251); + +var select571 = linear_select([ + msg1262, + msg1263, +]); + +var msg1264 = msg("665", dup250); + +var msg1265 = msg("665:01", dup251); + +var select572 = linear_select([ + msg1264, + msg1265, +]); + +var msg1266 = msg("666", dup250); + +var msg1267 = msg("666:01", dup251); + +var select573 = linear_select([ + msg1266, + msg1267, +]); + +var msg1268 = msg("667", dup250); + +var msg1269 = msg("667:01", dup251); + +var select574 = linear_select([ + msg1268, + msg1269, +]); + +var msg1270 = msg("668", dup250); + +var msg1271 = msg("668:01", dup251); + +var select575 = linear_select([ + msg1270, + msg1271, +]); + +var msg1272 = msg("669", dup250); + +var msg1273 = msg("669:01", dup251); + +var select576 = linear_select([ + msg1272, + msg1273, +]); + +var msg1274 = msg("670", dup250); + +var msg1275 = msg("670:01", dup251); + +var select577 = linear_select([ + msg1274, + msg1275, +]); + +var msg1276 = msg("671", dup250); + +var msg1277 = msg("671:01", dup251); + +var select578 = linear_select([ + msg1276, + msg1277, +]); + +var msg1278 = msg("672", dup250); + +var msg1279 = msg("672:01", dup251); + +var select579 = linear_select([ + msg1278, + msg1279, +]); + +var msg1280 = msg("673", dup260); + +var msg1281 = msg("673:01", dup261); + +var select580 = linear_select([ + msg1280, + msg1281, +]); + +var msg1282 = msg("674", dup197); + +var msg1283 = msg("674:01", dup221); + +var select581 = linear_select([ + msg1282, + msg1283, +]); + +var msg1284 = msg("675", dup197); + +var msg1285 = msg("675:01", dup221); + +var select582 = linear_select([ + msg1284, + msg1285, +]); + +var msg1286 = msg("676", dup260); + +var msg1287 = msg("676:01", dup261); + +var select583 = linear_select([ + msg1286, + msg1287, +]); + +var msg1288 = msg("677", dup196); + +var msg1289 = msg("677:01", dup217); + +var select584 = linear_select([ + msg1288, + msg1289, +]); + +var msg1290 = msg("678", dup196); + +var msg1291 = msg("678:01", dup217); + +var select585 = linear_select([ + msg1290, + msg1291, +]); + +var msg1292 = msg("679", dup196); + +var msg1293 = msg("679:01", dup217); + +var select586 = linear_select([ + msg1292, + msg1293, +]); + +var msg1294 = msg("680", dup236); + +var msg1295 = msg("680:01", dup237); + +var select587 = linear_select([ + msg1294, + msg1295, +]); + +var msg1296 = msg("681", dup260); + +var msg1297 = msg("681:01", dup261); + +var select588 = linear_select([ + msg1296, + msg1297, +]); + +var msg1298 = msg("682", dup197); + +var msg1299 = msg("682:01", dup221); + +var select589 = linear_select([ + msg1298, + msg1299, +]); + +var msg1300 = msg("683", dup196); + +var msg1301 = msg("683:01", dup217); + +var select590 = linear_select([ + msg1300, + msg1301, +]); + +var msg1302 = msg("684", dup196); + +var msg1303 = msg("684:01", dup217); + +var select591 = linear_select([ + msg1302, + msg1303, +]); + +var msg1304 = msg("685", dup196); + +var msg1305 = msg("685:01", dup217); + +var select592 = linear_select([ + msg1304, + msg1305, +]); + +var msg1306 = msg("686", dup240); + +var msg1307 = msg("686:01", dup241); + +var select593 = linear_select([ + msg1306, + msg1307, +]); + +var msg1308 = msg("687", dup260); + +var msg1309 = msg("687:01", dup261); + +var select594 = linear_select([ + msg1308, + msg1309, +]); + +var msg1310 = msg("688", dup236); + +var msg1311 = msg("688:01", dup237); + +var select595 = linear_select([ + msg1310, + msg1311, +]); + +var msg1312 = msg("689", dup240); + +var msg1313 = msg("689:01", dup241); + +var select596 = linear_select([ + msg1312, + msg1313, +]); + +var msg1314 = msg("690", dup197); + +var msg1315 = msg("690:01", dup221); + +var select597 = linear_select([ + msg1314, + msg1315, +]); + +var msg1316 = msg("691", dup240); + +var msg1317 = msg("691:01", dup241); + +var select598 = linear_select([ + msg1316, + msg1317, +]); + +var msg1318 = msg("692", dup240); + +var msg1319 = msg("692:01", dup241); + +var select599 = linear_select([ + msg1318, + msg1319, +]); + +var msg1320 = msg("693", dup240); + +var msg1321 = msg("693:01", dup241); + +var select600 = linear_select([ + msg1320, + msg1321, +]); + +var msg1322 = msg("694", dup240); + +var msg1323 = msg("694:01", dup241); + +var select601 = linear_select([ + msg1322, + msg1323, +]); + +var msg1324 = msg("695", dup197); + +var msg1325 = msg("695:01", dup221); + +var select602 = linear_select([ + msg1324, + msg1325, +]); + +var msg1326 = msg("696", dup197); + +var msg1327 = msg("696:01", dup221); + +var select603 = linear_select([ + msg1326, + msg1327, +]); + +var msg1328 = msg("697", dup197); + +var msg1329 = msg("697:01", dup221); + +var select604 = linear_select([ + msg1328, + msg1329, +]); + +var msg1330 = msg("698", dup197); + +var msg1331 = msg("698:01", dup221); + +var select605 = linear_select([ + msg1330, + msg1331, +]); + +var msg1332 = msg("699", dup197); + +var msg1333 = msg("699:01", dup221); + +var select606 = linear_select([ + msg1332, + msg1333, +]); + +var msg1334 = msg("700", dup197); + +var msg1335 = msg("700:01", dup221); + +var select607 = linear_select([ + msg1334, + msg1335, +]); + +var msg1336 = msg("701", dup197); + +var msg1337 = msg("701:01", dup221); + +var select608 = linear_select([ + msg1336, + msg1337, +]); + +var msg1338 = msg("702", dup197); + +var msg1339 = msg("702:01", dup221); + +var select609 = linear_select([ + msg1338, + msg1339, +]); + +var msg1340 = msg("703", dup197); + +var msg1341 = msg("703:01", dup221); + +var select610 = linear_select([ + msg1340, + msg1341, +]); + +var msg1342 = msg("704", dup197); + +var msg1343 = msg("704:01", dup221); + +var select611 = linear_select([ + msg1342, + msg1343, +]); + +var msg1344 = msg("705", dup197); + +var msg1345 = msg("705:01", dup221); + +var select612 = linear_select([ + msg1344, + msg1345, +]); + +var msg1346 = msg("706", dup197); + +var msg1347 = msg("706:01", dup221); + +var select613 = linear_select([ + msg1346, + msg1347, +]); + +var msg1348 = msg("707", dup197); + +var msg1349 = msg("707:01", dup221); + +var select614 = linear_select([ + msg1348, + msg1349, +]); + +var msg1350 = msg("708", dup197); + +var msg1351 = msg("708:01", dup221); + +var select615 = linear_select([ + msg1350, + msg1351, +]); + +var msg1352 = msg("709", dup248); + +var msg1353 = msg("709:01", dup249); + +var select616 = linear_select([ + msg1352, + msg1353, +]); + +var msg1354 = msg("710", dup248); + +var msg1355 = msg("710:01", dup249); + +var select617 = linear_select([ + msg1354, + msg1355, +]); + +var msg1356 = msg("711", dup196); + +var msg1357 = msg("711:01", dup217); + +var select618 = linear_select([ + msg1356, + msg1357, +]); + +var msg1358 = msg("712", dup196); + +var msg1359 = msg("712:01", dup217); + +var select619 = linear_select([ + msg1358, + msg1359, +]); + +var msg1360 = msg("713", dup198); + +var msg1361 = msg("713:01", dup220); + +var select620 = linear_select([ + msg1360, + msg1361, +]); + +var msg1362 = msg("714", dup196); + +var msg1363 = msg("714:01", dup217); + +var select621 = linear_select([ + msg1362, + msg1363, +]); + +var msg1364 = msg("715", dup248); + +var msg1365 = msg("715:01", dup249); + +var select622 = linear_select([ + msg1364, + msg1365, +]); + +var msg1366 = msg("716", dup248); + +var msg1367 = msg("716:01", dup249); + +var select623 = linear_select([ + msg1366, + msg1367, +]); + +var msg1368 = msg("717", dup196); + +var msg1369 = msg("717:01", dup217); + +var select624 = linear_select([ + msg1368, + msg1369, +]); + +var msg1370 = msg("718", dup196); + +var msg1371 = msg("718:01", dup217); + +var select625 = linear_select([ + msg1370, + msg1371, +]); + +var msg1372 = msg("719", dup196); + +var msg1373 = msg("719:01", dup217); + +var select626 = linear_select([ + msg1372, + msg1373, +]); + +var msg1374 = msg("720", dup192); + +var msg1375 = msg("720:01", dup262); + +var select627 = linear_select([ + msg1374, + msg1375, +]); + +var msg1376 = msg("721", dup263); + +var msg1377 = msg("721:01", dup264); + +var select628 = linear_select([ + msg1376, + msg1377, +]); + +var msg1378 = msg("722", dup238); + +var msg1379 = msg("722:01", dup239); + +var select629 = linear_select([ + msg1378, + msg1379, +]); + +var msg1380 = msg("723", dup238); + +var msg1381 = msg("723:01", dup239); + +var select630 = linear_select([ + msg1380, + msg1381, +]); + +var msg1382 = msg("724", dup238); + +var msg1383 = msg("724:01", dup239); + +var select631 = linear_select([ + msg1382, + msg1383, +]); + +var msg1384 = msg("725", dup238); + +var msg1385 = msg("725:01", dup239); + +var select632 = linear_select([ + msg1384, + msg1385, +]); + +var msg1386 = msg("726", dup238); + +var msg1387 = msg("726:01", dup239); + +var select633 = linear_select([ + msg1386, + msg1387, +]); + +var msg1388 = msg("727", dup238); + +var msg1389 = msg("727:01", dup239); + +var select634 = linear_select([ + msg1388, + msg1389, +]); + +var msg1390 = msg("728", dup238); + +var msg1391 = msg("728:01", dup239); + +var select635 = linear_select([ + msg1390, + msg1391, +]); + +var msg1392 = msg("729", dup263); + +var msg1393 = msg("729:01", dup264); + +var select636 = linear_select([ + msg1392, + msg1393, +]); + +var msg1394 = msg("730", dup263); + +var msg1395 = msg("730:01", dup264); + +var select637 = linear_select([ + msg1394, + msg1395, +]); + +var msg1396 = msg("731", dup238); + +var msg1397 = msg("731:01", dup239); + +var select638 = linear_select([ + msg1396, + msg1397, +]); + +var msg1398 = msg("732", dup238); + +var msg1399 = msg("732:01", dup239); + +var select639 = linear_select([ + msg1398, + msg1399, +]); + +var msg1400 = msg("733", dup238); + +var msg1401 = msg("733:01", dup239); + +var select640 = linear_select([ + msg1400, + msg1401, +]); + +var msg1402 = msg("734", dup238); + +var msg1403 = msg("734:01", dup239); + +var select641 = linear_select([ + msg1402, + msg1403, +]); + +var msg1404 = msg("735", dup238); + +var msg1405 = msg("735:01", dup239); + +var select642 = linear_select([ + msg1404, + msg1405, +]); + +var msg1406 = msg("736", dup263); + +var msg1407 = msg("736:01", dup264); + +var select643 = linear_select([ + msg1406, + msg1407, +]); + +var msg1408 = msg("737", dup263); + +var msg1409 = msg("737:01", dup264); + +var select644 = linear_select([ + msg1408, + msg1409, +]); + +var msg1410 = msg("738", dup263); + +var msg1411 = msg("738:01", dup264); + +var select645 = linear_select([ + msg1410, + msg1411, +]); + +var msg1412 = msg("739", dup238); + +var msg1413 = msg("739:01", dup239); + +var select646 = linear_select([ + msg1412, + msg1413, +]); + +var msg1414 = msg("740", dup263); + +var msg1415 = msg("740:01", dup264); + +var select647 = linear_select([ + msg1414, + msg1415, +]); + +var msg1416 = msg("741", dup238); + +var msg1417 = msg("741:01", dup239); + +var select648 = linear_select([ + msg1416, + msg1417, +]); + +var msg1418 = msg("742", dup238); + +var msg1419 = msg("742:01", dup239); + +var select649 = linear_select([ + msg1418, + msg1419, +]); + +var msg1420 = msg("743", dup238); + +var msg1421 = msg("743:01", dup239); + +var select650 = linear_select([ + msg1420, + msg1421, +]); + +var msg1422 = msg("744", dup238); + +var msg1423 = msg("744:01", dup239); + +var select651 = linear_select([ + msg1422, + msg1423, +]); + +var msg1424 = msg("745", dup238); + +var msg1425 = msg("745:01", dup239); + +var select652 = linear_select([ + msg1424, + msg1425, +]); + +var msg1426 = msg("746", dup238); + +var msg1427 = msg("746:01", dup239); + +var select653 = linear_select([ + msg1426, + msg1427, +]); + +var msg1428 = msg("747", dup238); + +var msg1429 = msg("747:01", dup239); + +var select654 = linear_select([ + msg1428, + msg1429, +]); + +var msg1430 = msg("748", dup238); + +var msg1431 = msg("748:01", dup239); + +var select655 = linear_select([ + msg1430, + msg1431, +]); + +var msg1432 = msg("749", dup238); + +var msg1433 = msg("749:01", dup239); + +var select656 = linear_select([ + msg1432, + msg1433, +]); + +var msg1434 = msg("751", dup238); + +var msg1435 = msg("751:01", dup239); + +var select657 = linear_select([ + msg1434, + msg1435, +]); + +var msg1436 = msg("752", dup238); + +var msg1437 = msg("752:01", dup239); + +var select658 = linear_select([ + msg1436, + msg1437, +]); + +var msg1438 = msg("753", dup238); + +var msg1439 = msg("753:01", dup239); + +var select659 = linear_select([ + msg1438, + msg1439, +]); + +var msg1440 = msg("754", dup263); + +var msg1441 = msg("754:01", dup264); + +var select660 = linear_select([ + msg1440, + msg1441, +]); + +var msg1442 = msg("755", dup238); + +var msg1443 = msg("755:01", dup239); + +var select661 = linear_select([ + msg1442, + msg1443, +]); + +var msg1444 = msg("756", dup238); + +var msg1445 = msg("756:01", dup239); + +var select662 = linear_select([ + msg1444, + msg1445, +]); + +var msg1446 = msg("757", dup192); + +var msg1447 = msg("757:01", dup262); + +var select663 = linear_select([ + msg1446, + msg1447, +]); + +var msg1448 = msg("758", dup192); + +var msg1449 = msg("758:01", dup262); + +var select664 = linear_select([ + msg1448, + msg1449, +]); + +var msg1450 = msg("759", dup263); + +var msg1451 = msg("759:01", dup264); + +var select665 = linear_select([ + msg1450, + msg1451, +]); + +var msg1452 = msg("760", dup238); + +var msg1453 = msg("760:01", dup239); + +var select666 = linear_select([ + msg1452, + msg1453, +]); + +var msg1454 = msg("761", dup238); + +var msg1455 = msg("761:01", dup239); + +var select667 = linear_select([ + msg1454, + msg1455, +]); + +var msg1456 = msg("762", dup238); + +var msg1457 = msg("762:01", dup239); + +var select668 = linear_select([ + msg1456, + msg1457, +]); + +var msg1458 = msg("763", dup238); + +var msg1459 = msg("763:01", dup239); + +var select669 = linear_select([ + msg1458, + msg1459, +]); + +var msg1460 = msg("764", dup238); + +var msg1461 = msg("764:01", dup239); + +var select670 = linear_select([ + msg1460, + msg1461, +]); + +var msg1462 = msg("765", dup238); + +var msg1463 = msg("765:01", dup239); + +var select671 = linear_select([ + msg1462, + msg1463, +]); + +var msg1464 = msg("766", dup238); + +var msg1465 = msg("766:01", dup239); + +var select672 = linear_select([ + msg1464, + msg1465, +]); + +var msg1466 = msg("767", dup238); + +var msg1467 = msg("767:01", dup239); + +var select673 = linear_select([ + msg1466, + msg1467, +]); + +var msg1468 = msg("768", dup238); + +var msg1469 = msg("768:01", dup239); + +var select674 = linear_select([ + msg1468, + msg1469, +]); + +var msg1470 = msg("769", dup238); + +var msg1471 = msg("769:01", dup239); + +var select675 = linear_select([ + msg1470, + msg1471, +]); + +var msg1472 = msg("770", dup238); + +var msg1473 = msg("770:01", dup239); + +var select676 = linear_select([ + msg1472, + msg1473, +]); + +var msg1474 = msg("771", dup192); + +var msg1475 = msg("771:01", dup262); + +var select677 = linear_select([ + msg1474, + msg1475, +]); + +var msg1476 = msg("772", dup192); + +var msg1477 = msg("772:01", dup262); + +var select678 = linear_select([ + msg1476, + msg1477, +]); + +var msg1478 = msg("773", dup263); + +var msg1479 = msg("773:01", dup264); + +var select679 = linear_select([ + msg1478, + msg1479, +]); + +var msg1480 = msg("774", dup192); + +var msg1481 = msg("774:01", dup262); + +var select680 = linear_select([ + msg1480, + msg1481, +]); + +var msg1482 = msg("775", dup238); + +var msg1483 = msg("775:01", dup239); + +var select681 = linear_select([ + msg1482, + msg1483, +]); + +var msg1484 = msg("776", dup238); + +var msg1485 = msg("776:01", dup239); + +var select682 = linear_select([ + msg1484, + msg1485, +]); + +var msg1486 = msg("777", dup238); + +var msg1487 = msg("777:01", dup239); + +var select683 = linear_select([ + msg1486, + msg1487, +]); + +var msg1488 = msg("778", dup263); + +var msg1489 = msg("778:01", dup264); + +var select684 = linear_select([ + msg1488, + msg1489, +]); + +var msg1490 = msg("779", dup238); + +var msg1491 = msg("779:01", dup239); + +var select685 = linear_select([ + msg1490, + msg1491, +]); + +var msg1492 = msg("780", dup238); + +var msg1493 = msg("780:01", dup239); + +var select686 = linear_select([ + msg1492, + msg1493, +]); + +var msg1494 = msg("781", dup238); + +var msg1495 = msg("781:01", dup239); + +var select687 = linear_select([ + msg1494, + msg1495, +]); + +var msg1496 = msg("782", dup238); + +var msg1497 = msg("782:01", dup239); + +var select688 = linear_select([ + msg1496, + msg1497, +]); + +var msg1498 = msg("783", dup238); + +var msg1499 = msg("783:01", dup239); + +var select689 = linear_select([ + msg1498, + msg1499, +]); + +var msg1500 = msg("784", dup238); + +var msg1501 = msg("784:01", dup239); + +var select690 = linear_select([ + msg1500, + msg1501, +]); + +var msg1502 = msg("785", dup238); + +var msg1503 = msg("785:01", dup239); + +var select691 = linear_select([ + msg1502, + msg1503, +]); + +var msg1504 = msg("786", dup238); + +var msg1505 = msg("786:01", dup239); + +var select692 = linear_select([ + msg1504, + msg1505, +]); + +var msg1506 = msg("787", dup238); + +var msg1507 = msg("787:01", dup239); + +var select693 = linear_select([ + msg1506, + msg1507, +]); + +var msg1508 = msg("788", dup238); + +var msg1509 = msg("788:01", dup239); + +var select694 = linear_select([ + msg1508, + msg1509, +]); + +var msg1510 = msg("789", dup238); + +var msg1511 = msg("789:01", dup239); + +var select695 = linear_select([ + msg1510, + msg1511, +]); + +var msg1512 = msg("790", dup238); + +var msg1513 = msg("790:01", dup239); + +var select696 = linear_select([ + msg1512, + msg1513, +]); + +var msg1514 = msg("791", dup238); + +var msg1515 = msg("791:01", dup239); + +var select697 = linear_select([ + msg1514, + msg1515, +]); + +var msg1516 = msg("792", dup238); + +var msg1517 = msg("792:01", dup239); + +var select698 = linear_select([ + msg1516, + msg1517, +]); + +var msg1518 = msg("793", dup263); + +var msg1519 = msg("793:01", dup264); + +var select699 = linear_select([ + msg1518, + msg1519, +]); + +var msg1520 = msg("794", dup238); + +var msg1521 = msg("794:01", dup239); + +var select700 = linear_select([ + msg1520, + msg1521, +]); + +var msg1522 = msg("795", dup238); + +var msg1523 = msg("795:01", dup239); + +var select701 = linear_select([ + msg1522, + msg1523, +]); + +var msg1524 = msg("796", dup238); + +var msg1525 = msg("796:01", dup239); + +var select702 = linear_select([ + msg1524, + msg1525, +]); + +var msg1526 = msg("797", dup238); + +var msg1527 = msg("797:01", dup239); + +var select703 = linear_select([ + msg1526, + msg1527, +]); + +var msg1528 = msg("798", dup238); + +var msg1529 = msg("798:01", dup239); + +var select704 = linear_select([ + msg1528, + msg1529, +]); + +var msg1530 = msg("799", dup238); + +var msg1531 = msg("799:01", dup239); + +var select705 = linear_select([ + msg1530, + msg1531, +]); + +var msg1532 = msg("800", dup238); + +var msg1533 = msg("800:01", dup239); + +var select706 = linear_select([ + msg1532, + msg1533, +]); + +var msg1534 = msg("801", dup238); + +var msg1535 = msg("801:01", dup239); + +var select707 = linear_select([ + msg1534, + msg1535, +]); + +var msg1536 = msg("802", dup192); + +var msg1537 = msg("802:01", dup262); + +var select708 = linear_select([ + msg1536, + msg1537, +]); + +var msg1538 = msg("803", dup265); + +var msg1539 = msg("803:01", dup266); + +var select709 = linear_select([ + msg1538, + msg1539, +]); + +var msg1540 = msg("804", dup267); + +var msg1541 = msg("804:01", dup268); + +var select710 = linear_select([ + msg1540, + msg1541, +]); + +var msg1542 = msg("805", dup265); + +var msg1543 = msg("805:01", dup266); + +var select711 = linear_select([ + msg1542, + msg1543, +]); + +var msg1544 = msg("806", dup265); + +var msg1545 = msg("806:01", dup266); + +var select712 = linear_select([ + msg1544, + msg1545, +]); + +var msg1546 = msg("807", dup265); + +var msg1547 = msg("807:01", dup266); + +var select713 = linear_select([ + msg1546, + msg1547, +]); + +var msg1548 = msg("808", dup265); + +var msg1549 = msg("808:01", dup266); + +var select714 = linear_select([ + msg1548, + msg1549, +]); + +var msg1550 = msg("809", dup269); + +var msg1551 = msg("809:01", dup270); + +var select715 = linear_select([ + msg1550, + msg1551, +]); + +var msg1552 = msg("810", dup265); + +var msg1553 = msg("810:01", dup266); + +var select716 = linear_select([ + msg1552, + msg1553, +]); + +var msg1554 = msg("811", dup265); + +var msg1555 = msg("811:01", dup266); + +var select717 = linear_select([ + msg1554, + msg1555, +]); + +var msg1556 = msg("812", dup265); + +var msg1557 = msg("812:01", dup266); + +var select718 = linear_select([ + msg1556, + msg1557, +]); + +var msg1558 = msg("813", dup265); + +var msg1559 = msg("813:01", dup266); + +var select719 = linear_select([ + msg1558, + msg1559, +]); + +var msg1560 = msg("815", dup265); + +var msg1561 = msg("815:01", dup266); + +var select720 = linear_select([ + msg1560, + msg1561, +]); + +var msg1562 = msg("817", dup265); + +var msg1563 = msg("817:01", dup266); + +var select721 = linear_select([ + msg1562, + msg1563, +]); + +var msg1564 = msg("818", dup265); + +var msg1565 = msg("818:01", dup266); + +var select722 = linear_select([ + msg1564, + msg1565, +]); + +var msg1566 = msg("819", dup265); + +var msg1567 = msg("819:01", dup266); + +var select723 = linear_select([ + msg1566, + msg1567, +]); + +var msg1568 = msg("820", dup265); + +var msg1569 = msg("820:01", dup266); + +var select724 = linear_select([ + msg1568, + msg1569, +]); + +var msg1570 = msg("821", dup267); + +var msg1571 = msg("821:01", dup268); + +var select725 = linear_select([ + msg1570, + msg1571, +]); + +var msg1572 = msg("823", dup265); + +var msg1573 = msg("823:01", dup266); + +var select726 = linear_select([ + msg1572, + msg1573, +]); + +var msg1574 = msg("824", dup265); + +var msg1575 = msg("824:01", dup266); + +var select727 = linear_select([ + msg1574, + msg1575, +]); + +var msg1576 = msg("825", dup265); + +var msg1577 = msg("825:01", dup266); + +var select728 = linear_select([ + msg1576, + msg1577, +]); + +var msg1578 = msg("826", dup265); + +var msg1579 = msg("826:01", dup266); + +var select729 = linear_select([ + msg1578, + msg1579, +]); + +var msg1580 = msg("827", dup265); + +var msg1581 = msg("827:01", dup266); + +var select730 = linear_select([ + msg1580, + msg1581, +]); + +var msg1582 = msg("828", dup265); + +var msg1583 = msg("828:01", dup266); + +var select731 = linear_select([ + msg1582, + msg1583, +]); + +var msg1584 = msg("829", dup265); + +var msg1585 = msg("829:01", dup266); + +var select732 = linear_select([ + msg1584, + msg1585, +]); + +var msg1586 = msg("830", dup265); + +var msg1587 = msg("830:01", dup266); + +var select733 = linear_select([ + msg1586, + msg1587, +]); + +var msg1588 = msg("832", dup265); + +var msg1589 = msg("832:01", dup266); + +var select734 = linear_select([ + msg1588, + msg1589, +]); + +var msg1590 = msg("833", dup265); + +var msg1591 = msg("833:01", dup266); + +var select735 = linear_select([ + msg1590, + msg1591, +]); + +var msg1592 = msg("834", dup265); + +var msg1593 = msg("834:01", dup266); + +var select736 = linear_select([ + msg1592, + msg1593, +]); + +var msg1594 = msg("835", dup265); + +var msg1595 = msg("835:01", dup266); + +var select737 = linear_select([ + msg1594, + msg1595, +]); + +var msg1596 = msg("836", dup265); + +var msg1597 = msg("836:01", dup266); + +var select738 = linear_select([ + msg1596, + msg1597, +]); + +var msg1598 = msg("837", dup265); + +var msg1599 = msg("837:01", dup266); + +var select739 = linear_select([ + msg1598, + msg1599, +]); + +var msg1600 = msg("838", dup265); + +var msg1601 = msg("838:01", dup266); + +var select740 = linear_select([ + msg1600, + msg1601, +]); + +var msg1602 = msg("839", dup225); + +var msg1603 = msg("839:01", dup226); + +var select741 = linear_select([ + msg1602, + msg1603, +]); + +var msg1604 = msg("840", dup265); + +var msg1605 = msg("840:01", dup266); + +var select742 = linear_select([ + msg1604, + msg1605, +]); + +var msg1606 = msg("841", dup265); + +var msg1607 = msg("841:01", dup266); + +var select743 = linear_select([ + msg1606, + msg1607, +]); + +var msg1608 = msg("842", dup265); + +var msg1609 = msg("842:01", dup266); + +var select744 = linear_select([ + msg1608, + msg1609, +]); + +var msg1610 = msg("843", dup265); + +var msg1611 = msg("843:01", dup266); + +var select745 = linear_select([ + msg1610, + msg1611, +]); + +var msg1612 = msg("844", dup265); + +var msg1613 = msg("844:01", dup266); + +var select746 = linear_select([ + msg1612, + msg1613, +]); + +var msg1614 = msg("845", dup265); + +var msg1615 = msg("845:01", dup266); + +var select747 = linear_select([ + msg1614, + msg1615, +]); + +var msg1616 = msg("846", dup265); + +var msg1617 = msg("846:01", dup266); + +var select748 = linear_select([ + msg1616, + msg1617, +]); + +var msg1618 = msg("847", dup265); + +var msg1619 = msg("847:01", dup266); + +var select749 = linear_select([ + msg1618, + msg1619, +]); + +var msg1620 = msg("848", dup265); + +var msg1621 = msg("848:01", dup266); + +var select750 = linear_select([ + msg1620, + msg1621, +]); + +var msg1622 = msg("849", dup265); + +var msg1623 = msg("849:01", dup266); + +var select751 = linear_select([ + msg1622, + msg1623, +]); + +var msg1624 = msg("850", dup265); + +var msg1625 = msg("850:01", dup266); + +var select752 = linear_select([ + msg1624, + msg1625, +]); + +var msg1626 = msg("851", dup265); + +var msg1627 = msg("851:01", dup266); + +var select753 = linear_select([ + msg1626, + msg1627, +]); + +var msg1628 = msg("852", dup265); + +var msg1629 = msg("852:01", dup266); + +var select754 = linear_select([ + msg1628, + msg1629, +]); + +var msg1630 = msg("853", dup265); + +var msg1631 = msg("853:01", dup266); + +var select755 = linear_select([ + msg1630, + msg1631, +]); + +var msg1632 = msg("854", dup265); + +var msg1633 = msg("854:01", dup266); + +var select756 = linear_select([ + msg1632, + msg1633, +]); + +var msg1634 = msg("855", dup265); + +var msg1635 = msg("855:01", dup266); + +var select757 = linear_select([ + msg1634, + msg1635, +]); + +var msg1636 = msg("856", dup265); + +var msg1637 = msg("856:01", dup266); + +var select758 = linear_select([ + msg1636, + msg1637, +]); + +var msg1638 = msg("857", dup265); + +var msg1639 = msg("857:01", dup266); + +var select759 = linear_select([ + msg1638, + msg1639, +]); + +var msg1640 = msg("858", dup265); + +var msg1641 = msg("858:01", dup266); + +var select760 = linear_select([ + msg1640, + msg1641, +]); + +var msg1642 = msg("859", dup265); + +var msg1643 = msg("859:01", dup266); + +var select761 = linear_select([ + msg1642, + msg1643, +]); + +var msg1644 = msg("860", dup265); + +var msg1645 = msg("860:01", dup266); + +var select762 = linear_select([ + msg1644, + msg1645, +]); + +var msg1646 = msg("861", dup240); + +var msg1647 = msg("861:01", dup241); + +var select763 = linear_select([ + msg1646, + msg1647, +]); + +var msg1648 = msg("862", dup265); + +var msg1649 = msg("862:01", dup266); + +var select764 = linear_select([ + msg1648, + msg1649, +]); + +var msg1650 = msg("863", dup265); + +var msg1651 = msg("863:01", dup266); + +var select765 = linear_select([ + msg1650, + msg1651, +]); + +var msg1652 = msg("864", dup265); + +var msg1653 = msg("864:01", dup266); + +var select766 = linear_select([ + msg1652, + msg1653, +]); + +var msg1654 = msg("865", dup265); + +var msg1655 = msg("865:01", dup266); + +var select767 = linear_select([ + msg1654, + msg1655, +]); + +var msg1656 = msg("866", dup265); + +var msg1657 = msg("866:01", dup266); + +var select768 = linear_select([ + msg1656, + msg1657, +]); + +var msg1658 = msg("867", dup265); + +var msg1659 = msg("867:01", dup266); + +var select769 = linear_select([ + msg1658, + msg1659, +]); + +var msg1660 = msg("868", dup265); + +var msg1661 = msg("868:01", dup266); + +var select770 = linear_select([ + msg1660, + msg1661, +]); + +var msg1662 = msg("869", dup265); + +var msg1663 = msg("869:01", dup266); + +var select771 = linear_select([ + msg1662, + msg1663, +]); + +var msg1664 = msg("870", dup265); + +var msg1665 = msg("870:01", dup266); + +var select772 = linear_select([ + msg1664, + msg1665, +]); + +var msg1666 = msg("871", dup265); + +var msg1667 = msg("871:01", dup266); + +var select773 = linear_select([ + msg1666, + msg1667, +]); + +var msg1668 = msg("872", dup265); + +var msg1669 = msg("872:01", dup266); + +var select774 = linear_select([ + msg1668, + msg1669, +]); + +var msg1670 = msg("873", dup265); + +var msg1671 = msg("873:01", dup266); + +var select775 = linear_select([ + msg1670, + msg1671, +]); + +var msg1672 = msg("874", dup240); + +var msg1673 = msg("874:01", dup241); + +var select776 = linear_select([ + msg1672, + msg1673, +]); + +var msg1674 = msg("875", dup265); + +var msg1675 = msg("875:01", dup266); + +var select777 = linear_select([ + msg1674, + msg1675, +]); + +var msg1676 = msg("876", dup267); + +var msg1677 = msg("876:01", dup268); + +var select778 = linear_select([ + msg1676, + msg1677, +]); + +var msg1678 = msg("877", dup265); + +var msg1679 = msg("877:01", dup266); + +var select779 = linear_select([ + msg1678, + msg1679, +]); + +var msg1680 = msg("878", dup265); + +var msg1681 = msg("878:01", dup266); + +var select780 = linear_select([ + msg1680, + msg1681, +]); + +var msg1682 = msg("879", dup265); + +var msg1683 = msg("879:01", dup266); + +var select781 = linear_select([ + msg1682, + msg1683, +]); + +var msg1684 = msg("880", dup265); + +var msg1685 = msg("880:01", dup266); + +var select782 = linear_select([ + msg1684, + msg1685, +]); + +var msg1686 = msg("881", dup265); + +var msg1687 = msg("881:01", dup266); + +var select783 = linear_select([ + msg1686, + msg1687, +]); + +var msg1688 = msg("882", dup265); + +var msg1689 = msg("882:01", dup266); + +var select784 = linear_select([ + msg1688, + msg1689, +]); + +var msg1690 = msg("883", dup265); + +var msg1691 = msg("883:01", dup266); + +var select785 = linear_select([ + msg1690, + msg1691, +]); + +var msg1692 = msg("884", dup265); + +var msg1693 = msg("884:01", dup266); + +var select786 = linear_select([ + msg1692, + msg1693, +]); + +var msg1694 = msg("885", dup265); + +var msg1695 = msg("885:01", dup266); + +var select787 = linear_select([ + msg1694, + msg1695, +]); + +var msg1696 = msg("886", dup265); + +var msg1697 = msg("886:01", dup266); + +var select788 = linear_select([ + msg1696, + msg1697, +]); + +var msg1698 = msg("887", dup240); + +var msg1699 = msg("887:01", dup241); + +var select789 = linear_select([ + msg1698, + msg1699, +]); + +var msg1700 = msg("888", dup265); + +var msg1701 = msg("888:01", dup266); + +var select790 = linear_select([ + msg1700, + msg1701, +]); + +var msg1702 = msg("889", dup265); + +var msg1703 = msg("889:01", dup266); + +var select791 = linear_select([ + msg1702, + msg1703, +]); + +var msg1704 = msg("890", dup265); + +var msg1705 = msg("890:01", dup266); + +var select792 = linear_select([ + msg1704, + msg1705, +]); + +var msg1706 = msg("891", dup265); + +var msg1707 = msg("891:01", dup266); + +var select793 = linear_select([ + msg1706, + msg1707, +]); + +var msg1708 = msg("892", dup265); + +var msg1709 = msg("892:01", dup266); + +var select794 = linear_select([ + msg1708, + msg1709, +]); + +var msg1710 = msg("893", dup265); + +var msg1711 = msg("893:01", dup266); + +var select795 = linear_select([ + msg1710, + msg1711, +]); + +var msg1712 = msg("894", dup265); + +var msg1713 = msg("894:01", dup266); + +var select796 = linear_select([ + msg1712, + msg1713, +]); + +var msg1714 = msg("895", dup265); + +var msg1715 = msg("895:01", dup266); + +var select797 = linear_select([ + msg1714, + msg1715, +]); + +var msg1716 = msg("896", dup197); + +var msg1717 = msg("896:01", dup266); + +var select798 = linear_select([ + msg1716, + msg1717, +]); + +var msg1718 = msg("897", dup265); + +var msg1719 = msg("897:01", dup266); + +var select799 = linear_select([ + msg1718, + msg1719, +]); + +var msg1720 = msg("898", dup265); + +var msg1721 = msg("898:01", dup266); + +var select800 = linear_select([ + msg1720, + msg1721, +]); + +var msg1722 = msg("899", dup265); + +var msg1723 = msg("899:01", dup266); + +var select801 = linear_select([ + msg1722, + msg1723, +]); + +var msg1724 = msg("900", dup265); + +var msg1725 = msg("900:01", dup266); + +var select802 = linear_select([ + msg1724, + msg1725, +]); + +var msg1726 = msg("901", dup265); + +var msg1727 = msg("901:01", dup266); + +var select803 = linear_select([ + msg1726, + msg1727, +]); + +var msg1728 = msg("902", dup265); + +var msg1729 = msg("902:01", dup266); + +var select804 = linear_select([ + msg1728, + msg1729, +]); + +var msg1730 = msg("903", dup265); + +var msg1731 = msg("903:01", dup266); + +var select805 = linear_select([ + msg1730, + msg1731, +]); + +var msg1732 = msg("904", dup196); + +var msg1733 = msg("904:01", dup217); + +var select806 = linear_select([ + msg1732, + msg1733, +]); + +var msg1734 = msg("905", dup265); + +var msg1735 = msg("905:01", dup266); + +var select807 = linear_select([ + msg1734, + msg1735, +]); + +var msg1736 = msg("906", dup265); + +var msg1737 = msg("906:01", dup266); + +var select808 = linear_select([ + msg1736, + msg1737, +]); + +var msg1738 = msg("907", dup265); + +var msg1739 = msg("907:01", dup266); + +var select809 = linear_select([ + msg1738, + msg1739, +]); + +var msg1740 = msg("908", dup265); + +var msg1741 = msg("908:01", dup266); + +var select810 = linear_select([ + msg1740, + msg1741, +]); + +var msg1742 = msg("909", dup265); + +var msg1743 = msg("909:01", dup266); + +var select811 = linear_select([ + msg1742, + msg1743, +]); + +var msg1744 = msg("910", dup265); + +var msg1745 = msg("910:01", dup266); + +var select812 = linear_select([ + msg1744, + msg1745, +]); + +var msg1746 = msg("911", dup265); + +var msg1747 = msg("911:01", dup266); + +var select813 = linear_select([ + msg1746, + msg1747, +]); + +var msg1748 = msg("912", dup265); + +var msg1749 = msg("912:01", dup266); + +var select814 = linear_select([ + msg1748, + msg1749, +]); + +var msg1750 = msg("913", dup265); + +var msg1751 = msg("913:01", dup266); + +var select815 = linear_select([ + msg1750, + msg1751, +]); + +var msg1752 = msg("914", dup265); + +var msg1753 = msg("914:01", dup266); + +var select816 = linear_select([ + msg1752, + msg1753, +]); + +var msg1754 = msg("915", dup265); + +var msg1755 = msg("915:01", dup266); + +var select817 = linear_select([ + msg1754, + msg1755, +]); + +var msg1756 = msg("916", dup271); + +var msg1757 = msg("916:01", dup272); + +var select818 = linear_select([ + msg1756, + msg1757, +]); + +var msg1758 = msg("917", dup265); + +var msg1759 = msg("917:01", dup266); + +var select819 = linear_select([ + msg1758, + msg1759, +]); + +var msg1760 = msg("918", dup265); + +var msg1761 = msg("918:01", dup266); + +var select820 = linear_select([ + msg1760, + msg1761, +]); + +var msg1762 = msg("919", dup265); + +var msg1763 = msg("919:01", dup266); + +var select821 = linear_select([ + msg1762, + msg1763, +]); + +var msg1764 = msg("920", dup265); + +var msg1765 = msg("920:01", dup266); + +var select822 = linear_select([ + msg1764, + msg1765, +]); + +var msg1766 = msg("921", dup265); + +var msg1767 = msg("921:01", dup266); + +var select823 = linear_select([ + msg1766, + msg1767, +]); + +var msg1768 = msg("922", dup265); + +var msg1769 = msg("922:01", dup266); + +var select824 = linear_select([ + msg1768, + msg1769, +]); + +var msg1770 = msg("923", dup271); + +var msg1771 = msg("923:01", dup272); + +var select825 = linear_select([ + msg1770, + msg1771, +]); + +var msg1772 = msg("924", dup265); + +var msg1773 = msg("924:01", dup266); + +var select826 = linear_select([ + msg1772, + msg1773, +]); + +var msg1774 = msg("925", dup265); + +var msg1775 = msg("925:01", dup266); + +var select827 = linear_select([ + msg1774, + msg1775, +]); + +var msg1776 = msg("926", dup271); + +var msg1777 = msg("926:01", dup272); + +var select828 = linear_select([ + msg1776, + msg1777, +]); + +var msg1778 = msg("927", dup265); + +var msg1779 = msg("927:01", dup266); + +var select829 = linear_select([ + msg1778, + msg1779, +]); + +var msg1780 = msg("928", dup265); + +var msg1781 = msg("928:01", dup266); + +var select830 = linear_select([ + msg1780, + msg1781, +]); + +var msg1782 = msg("929", dup265); + +var msg1783 = msg("929:01", dup266); + +var select831 = linear_select([ + msg1782, + msg1783, +]); + +var msg1784 = msg("930", dup265); + +var msg1785 = msg("930:01", dup266); + +var select832 = linear_select([ + msg1784, + msg1785, +]); + +var msg1786 = msg("931", dup265); + +var msg1787 = msg("931:01", dup266); + +var select833 = linear_select([ + msg1786, + msg1787, +]); + +var msg1788 = msg("932", dup265); + +var msg1789 = msg("932:01", dup266); + +var select834 = linear_select([ + msg1788, + msg1789, +]); + +var msg1790 = msg("933", dup265); + +var msg1791 = msg("933:01", dup266); + +var select835 = linear_select([ + msg1790, + msg1791, +]); + +var msg1792 = msg("935", dup198); + +var msg1793 = msg("935:01", dup220); + +var select836 = linear_select([ + msg1792, + msg1793, +]); + +var msg1794 = msg("936", dup265); + +var msg1795 = msg("936:01", dup266); + +var select837 = linear_select([ + msg1794, + msg1795, +]); + +var msg1796 = msg("937", dup265); + +var msg1797 = msg("937:01", dup266); + +var select838 = linear_select([ + msg1796, + msg1797, +]); + +var msg1798 = msg("939", dup196); + +var msg1799 = msg("939:01", dup217); + +var select839 = linear_select([ + msg1798, + msg1799, +]); + +var msg1800 = msg("940", dup265); + +var msg1801 = msg("940:01", dup217); + +var select840 = linear_select([ + msg1800, + msg1801, +]); + +var msg1802 = msg("941", dup265); + +var msg1803 = msg("941:01", dup266); + +var select841 = linear_select([ + msg1802, + msg1803, +]); + +var msg1804 = msg("942", dup265); + +var msg1805 = msg("942:01", dup266); + +var select842 = linear_select([ + msg1804, + msg1805, +]); + +var msg1806 = msg("943", dup265); + +var msg1807 = msg("943:01", dup266); + +var select843 = linear_select([ + msg1806, + msg1807, +]); + +var msg1808 = msg("944", dup265); + +var msg1809 = msg("944:01", dup266); + +var select844 = linear_select([ + msg1808, + msg1809, +]); + +var msg1810 = msg("945", dup265); + +var msg1811 = msg("945:01", dup266); + +var select845 = linear_select([ + msg1810, + msg1811, +]); + +var msg1812 = msg("946", dup265); + +var msg1813 = msg("946:01", dup266); + +var select846 = linear_select([ + msg1812, + msg1813, +]); + +var msg1814 = msg("947", dup265); + +var msg1815 = msg("947:01", dup266); + +var select847 = linear_select([ + msg1814, + msg1815, +]); + +var msg1816 = msg("948", dup265); + +var msg1817 = msg("948:01", dup266); + +var select848 = linear_select([ + msg1816, + msg1817, +]); + +var msg1818 = msg("949", dup265); + +var msg1819 = msg("949:01", dup266); + +var select849 = linear_select([ + msg1818, + msg1819, +]); + +var msg1820 = msg("950", dup265); + +var msg1821 = msg("950:01", dup266); + +var select850 = linear_select([ + msg1820, + msg1821, +]); + +var msg1822 = msg("951", dup265); + +var msg1823 = msg("951:01", dup266); + +var select851 = linear_select([ + msg1822, + msg1823, +]); + +var msg1824 = msg("952", dup265); + +var msg1825 = msg("952:01", dup266); + +var select852 = linear_select([ + msg1824, + msg1825, +]); + +var msg1826 = msg("953", dup265); + +var msg1827 = msg("953:01", dup217); + +var select853 = linear_select([ + msg1826, + msg1827, +]); + +var msg1828 = msg("954", dup265); + +var msg1829 = msg("954:01", dup266); + +var select854 = linear_select([ + msg1828, + msg1829, +]); + +var msg1830 = msg("955", dup265); + +var msg1831 = msg("955:01", dup266); + +var select855 = linear_select([ + msg1830, + msg1831, +]); + +var msg1832 = msg("956", dup265); + +var msg1833 = msg("956:01", dup266); + +var select856 = linear_select([ + msg1832, + msg1833, +]); + +var msg1834 = msg("957", dup265); + +var msg1835 = msg("957:01", dup266); + +var select857 = linear_select([ + msg1834, + msg1835, +]); + +var msg1836 = msg("958", dup265); + +var msg1837 = msg("958:01", dup266); + +var select858 = linear_select([ + msg1836, + msg1837, +]); + +var msg1838 = msg("959", dup196); + +var msg1839 = msg("959:01", dup217); + +var select859 = linear_select([ + msg1838, + msg1839, +]); + +var msg1840 = msg("960", dup265); + +var msg1841 = msg("960:01", dup266); + +var select860 = linear_select([ + msg1840, + msg1841, +]); + +var msg1842 = msg("961", dup265); + +var msg1843 = msg("961:01", dup266); + +var select861 = linear_select([ + msg1842, + msg1843, +]); + +var msg1844 = msg("962", dup265); + +var msg1845 = msg("962:01", dup217); + +var select862 = linear_select([ + msg1844, + msg1845, +]); + +var msg1846 = msg("963", dup265); + +var msg1847 = msg("963:01", dup266); + +var select863 = linear_select([ + msg1846, + msg1847, +]); + +var msg1848 = msg("964", dup265); + +var msg1849 = msg("964:01", dup266); + +var select864 = linear_select([ + msg1848, + msg1849, +]); + +var msg1850 = msg("965", dup265); + +var msg1851 = msg("965:01", dup266); + +var select865 = linear_select([ + msg1850, + msg1851, +]); + +var msg1852 = msg("966", dup265); + +var msg1853 = msg("966:01", dup266); + +var select866 = linear_select([ + msg1852, + msg1853, +]); + +var msg1854 = msg("967", dup265); + +var msg1855 = msg("967:01", dup266); + +var select867 = linear_select([ + msg1854, + msg1855, +]); + +var msg1856 = msg("968", dup265); + +var msg1857 = msg("968:01", dup266); + +var select868 = linear_select([ + msg1856, + msg1857, +]); + +var msg1858 = msg("969", dup265); + +var msg1859 = msg("969:01", dup266); + +var select869 = linear_select([ + msg1858, + msg1859, +]); + +var msg1860 = msg("970", dup265); + +var msg1861 = msg("970:01", dup266); + +var select870 = linear_select([ + msg1860, + msg1861, +]); + +var msg1862 = msg("971", dup265); + +var msg1863 = msg("971:01", dup266); + +var select871 = linear_select([ + msg1862, + msg1863, +]); + +var msg1864 = msg("972", dup265); + +var msg1865 = msg("972:01", dup266); + +var select872 = linear_select([ + msg1864, + msg1865, +]); + +var msg1866 = msg("973", dup265); + +var msg1867 = msg("973:01", dup266); + +var select873 = linear_select([ + msg1866, + msg1867, +]); + +var msg1868 = msg("974", dup265); + +var msg1869 = msg("974:01", dup266); + +var select874 = linear_select([ + msg1868, + msg1869, +]); + +var msg1870 = msg("975", dup265); + +var msg1871 = msg("975:01", dup266); + +var select875 = linear_select([ + msg1870, + msg1871, +]); + +var msg1872 = msg("976", dup265); + +var msg1873 = msg("976:01", dup266); + +var select876 = linear_select([ + msg1872, + msg1873, +]); + +var msg1874 = msg("977", dup265); + +var msg1875 = msg("977:01", dup266); + +var select877 = linear_select([ + msg1874, + msg1875, +]); + +var msg1876 = msg("978", dup196); + +var msg1877 = msg("978:01", dup217); + +var select878 = linear_select([ + msg1876, + msg1877, +]); + +var msg1878 = msg("979", dup196); + +var msg1879 = msg("979:01", dup217); + +var select879 = linear_select([ + msg1878, + msg1879, +]); + +var msg1880 = msg("980", dup265); + +var msg1881 = msg("980:01", dup266); + +var select880 = linear_select([ + msg1880, + msg1881, +]); + +var msg1882 = msg("981", dup265); + +var msg1883 = msg("981:01", dup266); + +var select881 = linear_select([ + msg1882, + msg1883, +]); + +var msg1884 = msg("982", dup265); + +var msg1885 = msg("982:01", dup266); + +var select882 = linear_select([ + msg1884, + msg1885, +]); + +var msg1886 = msg("983", dup265); + +var msg1887 = msg("983:01", dup266); + +var select883 = linear_select([ + msg1886, + msg1887, +]); + +var msg1888 = msg("984", dup265); + +var msg1889 = msg("984:01", dup266); + +var select884 = linear_select([ + msg1888, + msg1889, +]); + +var msg1890 = msg("985", dup265); + +var msg1891 = msg("985:01", dup266); + +var select885 = linear_select([ + msg1890, + msg1891, +]); + +var msg1892 = msg("986", dup265); + +var msg1893 = msg("986:01", dup266); + +var select886 = linear_select([ + msg1892, + msg1893, +]); + +var msg1894 = msg("987", dup265); + +var msg1895 = msg("987:01", dup266); + +var select887 = linear_select([ + msg1894, + msg1895, +]); + +var msg1896 = msg("988", dup265); + +var msg1897 = msg("988:01", dup266); + +var select888 = linear_select([ + msg1896, + msg1897, +]); + +var msg1898 = msg("989", dup192); + +var msg1899 = msg("989:01", dup262); + +var select889 = linear_select([ + msg1898, + msg1899, +]); + +var msg1900 = msg("990", dup265); + +var msg1901 = msg("990:01", dup266); + +var select890 = linear_select([ + msg1900, + msg1901, +]); + +var msg1902 = msg("991", dup265); + +var msg1903 = msg("991:01", dup266); + +var select891 = linear_select([ + msg1902, + msg1903, +]); + +var msg1904 = msg("992", dup265); + +var msg1905 = msg("992:01", dup266); + +var select892 = linear_select([ + msg1904, + msg1905, +]); + +var msg1906 = msg("993", dup265); + +var msg1907 = msg("993:01", dup266); + +var select893 = linear_select([ + msg1906, + msg1907, +]); + +var msg1908 = msg("994", dup265); + +var msg1909 = msg("994:01", dup266); + +var select894 = linear_select([ + msg1908, + msg1909, +]); + +var msg1910 = msg("995", dup265); + +var msg1911 = msg("995:01", dup266); + +var select895 = linear_select([ + msg1910, + msg1911, +]); + +var msg1912 = msg("996", dup265); + +var msg1913 = msg("996:01", dup266); + +var select896 = linear_select([ + msg1912, + msg1913, +]); + +var msg1914 = msg("997", dup265); + +var msg1915 = msg("997:01", dup266); + +var select897 = linear_select([ + msg1914, + msg1915, +]); + +var msg1916 = msg("998", dup265); + +var msg1917 = msg("998:01", dup266); + +var select898 = linear_select([ + msg1916, + msg1917, +]); + +var msg1918 = msg("999", dup265); + +var msg1919 = msg("999:01", dup266); + +var select899 = linear_select([ + msg1918, + msg1919, +]); + +var msg1920 = msg("1000", dup265); + +var msg1921 = msg("1000:01", dup266); + +var select900 = linear_select([ + msg1920, + msg1921, +]); + +var msg1922 = msg("1001", dup265); + +var msg1923 = msg("1001:01", dup266); + +var select901 = linear_select([ + msg1922, + msg1923, +]); + +var msg1924 = msg("1002", dup265); + +var msg1925 = msg("1002:01", dup266); + +var select902 = linear_select([ + msg1924, + msg1925, +]); + +var msg1926 = msg("1003", dup265); + +var msg1927 = msg("1003:01", dup266); + +var select903 = linear_select([ + msg1926, + msg1927, +]); + +var msg1928 = msg("1004", dup265); + +var msg1929 = msg("1004:01", dup266); + +var select904 = linear_select([ + msg1928, + msg1929, +]); + +var msg1930 = msg("1005", dup265); + +var msg1931 = msg("1005:01", dup266); + +var select905 = linear_select([ + msg1930, + msg1931, +]); + +var msg1932 = msg("1007", dup265); + +var msg1933 = msg("1007:01", dup266); + +var select906 = linear_select([ + msg1932, + msg1933, +]); + +var msg1934 = msg("1008", dup265); + +var msg1935 = msg("1008:01", dup266); + +var select907 = linear_select([ + msg1934, + msg1935, +]); + +var msg1936 = msg("1009", dup196); + +var msg1937 = msg("1009:01", dup217); + +var select908 = linear_select([ + msg1936, + msg1937, +]); + +var msg1938 = msg("1010", dup265); + +var msg1939 = msg("1010:01", dup266); + +var select909 = linear_select([ + msg1938, + msg1939, +]); + +var msg1940 = msg("1011", dup267); + +var msg1941 = msg("1011:01", dup268); + +var select910 = linear_select([ + msg1940, + msg1941, +]); + +var msg1942 = msg("1012", dup265); + +var msg1943 = msg("1012:01", dup266); + +var select911 = linear_select([ + msg1942, + msg1943, +]); + +var msg1944 = msg("1013", dup265); + +var msg1945 = msg("1013:01", dup266); + +var select912 = linear_select([ + msg1944, + msg1945, +]); + +var msg1946 = msg("1014", dup267); + +var msg1947 = msg("1014:01", dup268); + +var select913 = linear_select([ + msg1946, + msg1947, +]); + +var msg1948 = msg("1015", dup265); + +var msg1949 = msg("1015:01", dup266); + +var select914 = linear_select([ + msg1948, + msg1949, +]); + +var msg1950 = msg("1016", dup265); + +var msg1951 = msg("1016:01", dup266); + +var select915 = linear_select([ + msg1950, + msg1951, +]); + +var msg1952 = msg("1017", dup265); + +var msg1953 = msg("1017:01", dup266); + +var select916 = linear_select([ + msg1952, + msg1953, +]); + +var msg1954 = msg("1018", dup265); + +var msg1955 = msg("1018:01", dup266); + +var select917 = linear_select([ + msg1954, + msg1955, +]); + +var msg1956 = msg("1019", dup265); + +var msg1957 = msg("1019:01", dup266); + +var select918 = linear_select([ + msg1956, + msg1957, +]); + +var msg1958 = msg("1020", dup265); + +var msg1959 = msg("1020:01", dup266); + +var select919 = linear_select([ + msg1958, + msg1959, +]); + +var msg1960 = msg("1021", dup265); + +var msg1961 = msg("1021:01", dup266); + +var select920 = linear_select([ + msg1960, + msg1961, +]); + +var msg1962 = msg("1022", dup265); + +var msg1963 = msg("1022:01", dup266); + +var select921 = linear_select([ + msg1962, + msg1963, +]); + +var msg1964 = msg("1023", dup265); + +var msg1965 = msg("1023:01", dup266); + +var select922 = linear_select([ + msg1964, + msg1965, +]); + +var msg1966 = msg("1024", dup265); + +var msg1967 = msg("1024:01", dup266); + +var select923 = linear_select([ + msg1966, + msg1967, +]); + +var msg1968 = msg("1025", dup265); + +var msg1969 = msg("1025:01", dup266); + +var select924 = linear_select([ + msg1968, + msg1969, +]); + +var msg1970 = msg("1026", dup265); + +var msg1971 = msg("1026:01", dup266); + +var select925 = linear_select([ + msg1970, + msg1971, +]); + +var msg1972 = msg("1027", dup265); + +var msg1973 = msg("1027:01", dup266); + +var select926 = linear_select([ + msg1972, + msg1973, +]); + +var msg1974 = msg("1028", dup265); + +var msg1975 = msg("1028:01", dup266); + +var select927 = linear_select([ + msg1974, + msg1975, +]); + +var msg1976 = msg("1029", dup265); + +var msg1977 = msg("1029:01", dup266); + +var select928 = linear_select([ + msg1976, + msg1977, +]); + +var msg1978 = msg("1030", dup265); + +var msg1979 = msg("1030:01", dup266); + +var select929 = linear_select([ + msg1978, + msg1979, +]); + +var msg1980 = msg("1031", dup265); + +var msg1981 = msg("1031:01", dup266); + +var select930 = linear_select([ + msg1980, + msg1981, +]); + +var msg1982 = msg("1032", dup265); + +var msg1983 = msg("1032:01", dup266); + +var select931 = linear_select([ + msg1982, + msg1983, +]); + +var msg1984 = msg("1033", dup265); + +var msg1985 = msg("1033:01", dup266); + +var select932 = linear_select([ + msg1984, + msg1985, +]); + +var msg1986 = msg("1034", dup265); + +var msg1987 = msg("1034:01", dup266); + +var select933 = linear_select([ + msg1986, + msg1987, +]); + +var msg1988 = msg("1035", dup265); + +var msg1989 = msg("1035:01", dup266); + +var select934 = linear_select([ + msg1988, + msg1989, +]); + +var msg1990 = msg("1036", dup265); + +var msg1991 = msg("1036:01", dup266); + +var select935 = linear_select([ + msg1990, + msg1991, +]); + +var msg1992 = msg("1037", dup265); + +var msg1993 = msg("1037:01", dup266); + +var select936 = linear_select([ + msg1992, + msg1993, +]); + +var msg1994 = msg("1038", dup265); + +var msg1995 = msg("1038:01", dup266); + +var select937 = linear_select([ + msg1994, + msg1995, +]); + +var msg1996 = msg("1039", dup265); + +var msg1997 = msg("1039:01", dup266); + +var select938 = linear_select([ + msg1996, + msg1997, +]); + +var msg1998 = msg("1040", dup265); + +var msg1999 = msg("1040:01", dup266); + +var select939 = linear_select([ + msg1998, + msg1999, +]); + +var msg2000 = msg("1041", dup265); + +var msg2001 = msg("1041:01", dup266); + +var select940 = linear_select([ + msg2000, + msg2001, +]); + +var msg2002 = msg("1042", dup196); + +var msg2003 = msg("1042:01", dup217); + +var select941 = linear_select([ + msg2002, + msg2003, +]); + +var msg2004 = msg("1043", dup265); + +var msg2005 = msg("1043:01", dup266); + +var select942 = linear_select([ + msg2004, + msg2005, +]); + +var msg2006 = msg("1044", dup265); + +var msg2007 = msg("1044:01", dup266); + +var select943 = linear_select([ + msg2006, + msg2007, +]); + +var msg2008 = msg("1045", dup273); + +var all38 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg2009 = msg("1045:01", all38); + +var select944 = linear_select([ + msg2008, + msg2009, +]); + +var msg2010 = msg("1046", dup265); + +var msg2011 = msg("1046:01", dup266); + +var select945 = linear_select([ + msg2010, + msg2011, +]); + +var msg2012 = msg("1047", dup198); + +var msg2013 = msg("1047:01", dup220); + +var select946 = linear_select([ + msg2012, + msg2013, +]); + +var msg2014 = msg("1048", dup265); + +var msg2015 = msg("1048:01", dup266); + +var select947 = linear_select([ + msg2014, + msg2015, +]); + +var msg2016 = msg("1049", dup198); + +var msg2017 = msg("1049:01", dup220); + +var select948 = linear_select([ + msg2016, + msg2017, +]); + +var msg2018 = msg("1050", dup265); + +var msg2019 = msg("1050:01", dup266); + +var select949 = linear_select([ + msg2018, + msg2019, +]); + +var msg2020 = msg("1051", dup265); + +var msg2021 = msg("1051:01", dup266); + +var select950 = linear_select([ + msg2020, + msg2021, +]); + +var msg2022 = msg("1052", dup265); + +var msg2023 = msg("1052:01", dup266); + +var select951 = linear_select([ + msg2022, + msg2023, +]); + +var msg2024 = msg("1053", dup267); + +var msg2025 = msg("1053:01", dup268); + +var select952 = linear_select([ + msg2024, + msg2025, +]); + +var msg2026 = msg("1054", dup265); + +var msg2027 = msg("1054:01", dup266); + +var select953 = linear_select([ + msg2026, + msg2027, +]); + +var msg2028 = msg("1055", dup265); + +var msg2029 = msg("1055:01", dup266); + +var select954 = linear_select([ + msg2028, + msg2029, +]); + +var msg2030 = msg("1056", dup265); + +var msg2031 = msg("1056:01", dup266); + +var select955 = linear_select([ + msg2030, + msg2031, +]); + +var msg2032 = msg("1057", dup265); + +var msg2033 = msg("1057:01", dup266); + +var select956 = linear_select([ + msg2032, + msg2033, +]); + +var msg2034 = msg("1058", dup265); + +var msg2035 = msg("1058:01", dup266); + +var select957 = linear_select([ + msg2034, + msg2035, +]); + +var msg2036 = msg("1059", dup265); + +var msg2037 = msg("1059:01", dup266); + +var select958 = linear_select([ + msg2036, + msg2037, +]); + +var msg2038 = msg("1060", dup265); + +var msg2039 = msg("1060:01", dup266); + +var select959 = linear_select([ + msg2038, + msg2039, +]); + +var msg2040 = msg("1061", dup265); + +var msg2041 = msg("1061:01", dup266); + +var select960 = linear_select([ + msg2040, + msg2041, +]); + +var msg2042 = msg("1062", dup265); + +var msg2043 = msg("1062:01", dup266); + +var select961 = linear_select([ + msg2042, + msg2043, +]); + +var msg2044 = msg("1063", dup267); + +var msg2045 = msg("1063:01", dup268); + +var select962 = linear_select([ + msg2044, + msg2045, +]); + +var msg2046 = msg("1064", dup265); + +var msg2047 = msg("1064:01", dup266); + +var select963 = linear_select([ + msg2046, + msg2047, +]); + +var msg2048 = msg("1065", dup265); + +var msg2049 = msg("1065:01", dup266); + +var select964 = linear_select([ + msg2048, + msg2049, +]); + +var msg2050 = msg("1066", dup248); + +var msg2051 = msg("1066:01", dup249); + +var select965 = linear_select([ + msg2050, + msg2051, +]); + +var msg2052 = msg("1067", dup265); + +var msg2053 = msg("1067:01", dup266); + +var select966 = linear_select([ + msg2052, + msg2053, +]); + +var msg2054 = msg("1068", dup274); + +var msg2055 = msg("1068:01", dup275); + +var select967 = linear_select([ + msg2054, + msg2055, +]); + +var msg2056 = msg("1069", dup265); + +var msg2057 = msg("1069:01", dup266); + +var select968 = linear_select([ + msg2056, + msg2057, +]); + +var msg2058 = msg("1070", dup265); + +var msg2059 = msg("1070:01", dup266); + +var select969 = linear_select([ + msg2058, + msg2059, +]); + +var msg2060 = msg("1071", dup265); + +var msg2061 = msg("1071:01", dup266); + +var select970 = linear_select([ + msg2060, + msg2061, +]); + +var msg2062 = msg("1072", dup265); + +var msg2063 = msg("1072:01", dup266); + +var select971 = linear_select([ + msg2062, + msg2063, +]); + +var msg2064 = msg("1073", dup265); + +var msg2065 = msg("1073:01", dup266); + +var select972 = linear_select([ + msg2064, + msg2065, +]); + +var msg2066 = msg("1075", dup265); + +var msg2067 = msg("1075:01", dup266); + +var select973 = linear_select([ + msg2066, + msg2067, +]); + +var msg2068 = msg("1076", dup265); + +var msg2069 = msg("1076:01", dup266); + +var select974 = linear_select([ + msg2068, + msg2069, +]); + +var msg2070 = msg("1077", dup265); + +var msg2071 = msg("1077:01", dup266); + +var select975 = linear_select([ + msg2070, + msg2071, +]); + +var msg2072 = msg("1078", dup265); + +var msg2073 = msg("1078:01", dup266); + +var select976 = linear_select([ + msg2072, + msg2073, +]); + +var msg2074 = msg("1079", dup265); + +var msg2075 = msg("1079:01", dup266); + +var select977 = linear_select([ + msg2074, + msg2075, +]); + +var msg2076 = msg("1080", dup267); + +var msg2077 = msg("1080:01", dup268); + +var select978 = linear_select([ + msg2076, + msg2077, +]); + +var msg2078 = msg("1081", dup198); + +var msg2079 = msg("1081:01", dup220); + +var select979 = linear_select([ + msg2078, + msg2079, +]); + +var msg2080 = msg("1082", dup196); + +var msg2081 = msg("1082:01", dup217); + +var select980 = linear_select([ + msg2080, + msg2081, +]); + +var msg2082 = msg("1083", dup198); + +var msg2083 = msg("1083:01", dup220); + +var select981 = linear_select([ + msg2082, + msg2083, +]); + +var msg2084 = msg("1084", dup198); + +var msg2085 = msg("1084:01", dup220); + +var select982 = linear_select([ + msg2084, + msg2085, +]); + +var msg2086 = msg("1085", dup197); + +var msg2087 = msg("1085:01", dup221); + +var select983 = linear_select([ + msg2086, + msg2087, +]); + +var msg2088 = msg("1086", dup197); + +var msg2089 = msg("1086:01", dup221); + +var select984 = linear_select([ + msg2088, + msg2089, +]); + +var msg2090 = msg("1087", dup196); + +var msg2091 = msg("1087:01", dup217); + +var select985 = linear_select([ + msg2090, + msg2091, +]); + +var msg2092 = msg("1088", dup265); + +var msg2093 = msg("1088:01", dup266); + +var select986 = linear_select([ + msg2092, + msg2093, +]); + +var msg2094 = msg("1089", dup265); + +var msg2095 = msg("1089:01", dup266); + +var select987 = linear_select([ + msg2094, + msg2095, +]); + +var msg2096 = msg("1090", dup265); + +var msg2097 = msg("1090:01", dup266); + +var select988 = linear_select([ + msg2096, + msg2097, +]); + +var msg2098 = msg("1091", dup198); + +var msg2099 = msg("1091:01", dup220); + +var select989 = linear_select([ + msg2098, + msg2099, +]); + +var msg2100 = msg("1092", dup265); + +var msg2101 = msg("1092:01", dup266); + +var select990 = linear_select([ + msg2100, + msg2101, +]); + +var msg2102 = msg("1093", dup265); + +var msg2103 = msg("1093:01", dup266); + +var select991 = linear_select([ + msg2102, + msg2103, +]); + +var msg2104 = msg("1094", dup265); + +var msg2105 = msg("1094:01", dup266); + +var select992 = linear_select([ + msg2104, + msg2105, +]); + +var msg2106 = msg("1095", dup265); + +var msg2107 = msg("1095:01", dup266); + +var select993 = linear_select([ + msg2106, + msg2107, +]); + +var msg2108 = msg("1096", dup265); + +var msg2109 = msg("1096:01", dup266); + +var select994 = linear_select([ + msg2108, + msg2109, +]); + +var msg2110 = msg("1097", dup267); + +var msg2111 = msg("1097:01", dup268); + +var select995 = linear_select([ + msg2110, + msg2111, +]); + +var msg2112 = msg("1098", dup265); + +var msg2113 = msg("1098:01", dup266); + +var select996 = linear_select([ + msg2112, + msg2113, +]); + +var msg2114 = msg("1099", dup194); + +var msg2115 = msg("1099:01", dup229); + +var select997 = linear_select([ + msg2114, + msg2115, +]); + +var msg2116 = msg("1100", dup196); + +var msg2117 = msg("1100:01", dup217); + +var select998 = linear_select([ + msg2116, + msg2117, +]); + +var msg2118 = msg("1101", dup196); + +var msg2119 = msg("1101:01", dup217); + +var select999 = linear_select([ + msg2118, + msg2119, +]); + +var msg2120 = msg("1102", dup196); + +var msg2121 = msg("1102:01", dup217); + +var select1000 = linear_select([ + msg2120, + msg2121, +]); + +var msg2122 = msg("1103", dup196); + +var msg2123 = msg("1103:01", dup217); + +var select1001 = linear_select([ + msg2122, + msg2123, +]); + +var msg2124 = msg("1104", dup196); + +var msg2125 = msg("1104:01", dup217); + +var select1002 = linear_select([ + msg2124, + msg2125, +]); + +var msg2126 = msg("1105", dup265); + +var msg2127 = msg("1105:01", dup266); + +var select1003 = linear_select([ + msg2126, + msg2127, +]); + +var msg2128 = msg("1106", dup265); + +var msg2129 = msg("1106:01", dup266); + +var select1004 = linear_select([ + msg2128, + msg2129, +]); + +var msg2130 = msg("1107", dup265); + +var msg2131 = msg("1107:01", dup266); + +var select1005 = linear_select([ + msg2130, + msg2131, +]); + +var msg2132 = msg("1108", dup265); + +var msg2133 = msg("1108:01", dup266); + +var select1006 = linear_select([ + msg2132, + msg2133, +]); + +var msg2134 = msg("1109", dup265); + +var msg2135 = msg("1109:01", dup266); + +var select1007 = linear_select([ + msg2134, + msg2135, +]); + +var msg2136 = msg("1110", dup265); + +var msg2137 = msg("1110:01", dup266); + +var select1008 = linear_select([ + msg2136, + msg2137, +]); + +var msg2138 = msg("1111", dup267); + +var msg2139 = msg("1111:01", dup268); + +var select1009 = linear_select([ + msg2138, + msg2139, +]); + +var msg2140 = msg("1112", dup265); + +var msg2141 = msg("1112:01", dup266); + +var select1010 = linear_select([ + msg2140, + msg2141, +]); + +var msg2142 = msg("1113", dup265); + +var msg2143 = msg("1113:01", dup266); + +var select1011 = linear_select([ + msg2142, + msg2143, +]); + +var msg2144 = msg("1114", dup196); + +var msg2145 = msg("1114:01", dup217); + +var select1012 = linear_select([ + msg2144, + msg2145, +]); + +var msg2146 = msg("1115", dup198); + +var msg2147 = msg("1115:01", dup220); + +var select1013 = linear_select([ + msg2146, + msg2147, +]); + +var msg2148 = msg("1116", dup265); + +var msg2149 = msg("1116:01", dup266); + +var select1014 = linear_select([ + msg2148, + msg2149, +]); + +var msg2150 = msg("1117", dup265); + +var msg2151 = msg("1117:01", dup266); + +var select1015 = linear_select([ + msg2150, + msg2151, +]); + +var msg2152 = msg("1118", dup196); + +var msg2153 = msg("1118:01", dup217); + +var select1016 = linear_select([ + msg2152, + msg2153, +]); + +var msg2154 = msg("1119", dup265); + +var msg2155 = msg("1119:01", dup266); + +var select1017 = linear_select([ + msg2154, + msg2155, +]); + +var msg2156 = msg("1120", dup265); + +var msg2157 = msg("1120:01", dup266); + +var select1018 = linear_select([ + msg2156, + msg2157, +]); + +var msg2158 = msg("1121", dup265); + +var msg2159 = msg("1121:01", dup266); + +var select1019 = linear_select([ + msg2158, + msg2159, +]); + +var msg2160 = msg("1122", dup196); + +var msg2161 = msg("1122:01", dup217); + +var select1020 = linear_select([ + msg2160, + msg2161, +]); + +var msg2162 = msg("1123", dup265); + +var msg2163 = msg("1123:01", dup266); + +var select1021 = linear_select([ + msg2162, + msg2163, +]); + +var msg2164 = msg("1124", dup265); + +var msg2165 = msg("1124:01", dup266); + +var select1022 = linear_select([ + msg2164, + msg2165, +]); + +var msg2166 = msg("1125", dup265); + +var msg2167 = msg("1125:01", dup266); + +var select1023 = linear_select([ + msg2166, + msg2167, +]); + +var msg2168 = msg("1126", dup265); + +var msg2169 = msg("1126:01", dup266); + +var select1024 = linear_select([ + msg2168, + msg2169, +]); + +var msg2170 = msg("1127", dup265); + +var msg2171 = msg("1127:01", dup266); + +var select1025 = linear_select([ + msg2170, + msg2171, +]); + +var msg2172 = msg("1128", dup265); + +var msg2173 = msg("1128:01", dup266); + +var select1026 = linear_select([ + msg2172, + msg2173, +]); + +var msg2174 = msg("1129", dup265); + +var msg2175 = msg("1129:01", dup266); + +var select1027 = linear_select([ + msg2174, + msg2175, +]); + +var msg2176 = msg("1130", dup265); + +var msg2177 = msg("1130:01", dup266); + +var select1028 = linear_select([ + msg2176, + msg2177, +]); + +var msg2178 = msg("1131", dup265); + +var msg2179 = msg("1131:01", dup266); + +var select1029 = linear_select([ + msg2178, + msg2179, +]); + +var msg2180 = msg("1132", dup197); + +var msg2181 = msg("1132:01", dup221); + +var select1030 = linear_select([ + msg2180, + msg2181, +]); + +var msg2182 = msg("1133", dup194); + +var msg2183 = msg("1133:01", dup229); + +var select1031 = linear_select([ + msg2182, + msg2183, +]); + +var msg2184 = msg("1134", dup265); + +var msg2185 = msg("1134:01", dup266); + +var select1032 = linear_select([ + msg2184, + msg2185, +]); + +var msg2186 = msg("1136", dup196); + +var msg2187 = msg("1136:01", dup217); + +var select1033 = linear_select([ + msg2186, + msg2187, +]); + +var msg2188 = msg("1137", dup265); + +var msg2189 = msg("1137:01", dup266); + +var select1034 = linear_select([ + msg2188, + msg2189, +]); + +var msg2190 = msg("1138", dup198); + +var msg2191 = msg("1138:01", dup220); + +var select1035 = linear_select([ + msg2190, + msg2191, +]); + +var msg2192 = msg("1139", dup196); + +var msg2193 = msg("1139:01", dup217); + +var select1036 = linear_select([ + msg2192, + msg2193, +]); + +var msg2194 = msg("1140", dup265); + +var msg2195 = msg("1140:01", dup266); + +var select1037 = linear_select([ + msg2194, + msg2195, +]); + +var msg2196 = msg("1141", dup265); + +var msg2197 = msg("1141:01", dup266); + +var select1038 = linear_select([ + msg2196, + msg2197, +]); + +var msg2198 = msg("1142", dup265); + +var msg2199 = msg("1142:01", dup266); + +var select1039 = linear_select([ + msg2198, + msg2199, +]); + +var msg2200 = msg("1143", dup265); + +var msg2201 = msg("1143:01", dup266); + +var select1040 = linear_select([ + msg2200, + msg2201, +]); + +var msg2202 = msg("1144", dup265); + +var msg2203 = msg("1144:01", dup266); + +var select1041 = linear_select([ + msg2202, + msg2203, +]); + +var msg2204 = msg("1145", dup265); + +var msg2205 = msg("1145:01", dup266); + +var select1042 = linear_select([ + msg2204, + msg2205, +]); + +var msg2206 = msg("1146", dup265); + +var msg2207 = msg("1146:01", dup266); + +var select1043 = linear_select([ + msg2206, + msg2207, +]); + +var msg2208 = msg("1147", dup265); + +var msg2209 = msg("1147:01", dup266); + +var select1044 = linear_select([ + msg2208, + msg2209, +]); + +var msg2210 = msg("1148", dup265); + +var msg2211 = msg("1148:01", dup266); + +var select1045 = linear_select([ + msg2210, + msg2211, +]); + +var msg2212 = msg("1149", dup265); + +var msg2213 = msg("1149:01", dup266); + +var select1046 = linear_select([ + msg2212, + msg2213, +]); + +var msg2214 = msg("1150", dup265); + +var msg2215 = msg("1150:01", dup266); + +var select1047 = linear_select([ + msg2214, + msg2215, +]); + +var msg2216 = msg("1151", dup265); + +var msg2217 = msg("1151:01", dup266); + +var select1048 = linear_select([ + msg2216, + msg2217, +]); + +var msg2218 = msg("1152", dup265); + +var msg2219 = msg("1152:01", dup266); + +var select1049 = linear_select([ + msg2218, + msg2219, +]); + +var msg2220 = msg("1153", dup265); + +var msg2221 = msg("1153:01", dup266); + +var select1050 = linear_select([ + msg2220, + msg2221, +]); + +var msg2222 = msg("1154", dup265); + +var msg2223 = msg("1154:01", dup266); + +var select1051 = linear_select([ + msg2222, + msg2223, +]); + +var msg2224 = msg("1155", dup265); + +var msg2225 = msg("1155:01", dup266); + +var select1052 = linear_select([ + msg2224, + msg2225, +]); + +var msg2226 = msg("1156", dup265); + +var msg2227 = msg("1156:01", dup266); + +var select1053 = linear_select([ + msg2226, + msg2227, +]); + +var msg2228 = msg("1157", dup265); + +var msg2229 = msg("1157:01", dup266); + +var select1054 = linear_select([ + msg2228, + msg2229, +]); + +var msg2230 = msg("1158", dup265); + +var msg2231 = msg("1158:01", dup266); + +var select1055 = linear_select([ + msg2230, + msg2231, +]); + +var msg2232 = msg("1159", dup265); + +var msg2233 = msg("1159:01", dup266); + +var select1056 = linear_select([ + msg2232, + msg2233, +]); + +var msg2234 = msg("1160", dup196); + +var msg2235 = msg("1160:01", dup217); + +var select1057 = linear_select([ + msg2234, + msg2235, +]); + +var msg2236 = msg("1161", dup265); + +var msg2237 = msg("1161:01", dup266); + +var select1058 = linear_select([ + msg2236, + msg2237, +]); + +var msg2238 = msg("1162", dup265); + +var msg2239 = msg("1162:01", dup266); + +var select1059 = linear_select([ + msg2238, + msg2239, +]); + +var msg2240 = msg("1163", dup265); + +var msg2241 = msg("1163:01", dup266); + +var select1060 = linear_select([ + msg2240, + msg2241, +]); + +var msg2242 = msg("1164", dup265); + +var msg2243 = msg("1164:01", dup266); + +var select1061 = linear_select([ + msg2242, + msg2243, +]); + +var msg2244 = msg("1165", dup265); + +var msg2245 = msg("1165:01", dup266); + +var select1062 = linear_select([ + msg2244, + msg2245, +]); + +var msg2246 = msg("1166", dup265); + +var msg2247 = msg("1166:01", dup266); + +var select1063 = linear_select([ + msg2246, + msg2247, +]); + +var msg2248 = msg("1167", dup265); + +var msg2249 = msg("1167:01", dup266); + +var select1064 = linear_select([ + msg2248, + msg2249, +]); + +var msg2250 = msg("1168", dup265); + +var msg2251 = msg("1168:01", dup266); + +var select1065 = linear_select([ + msg2250, + msg2251, +]); + +var msg2252 = msg("1171", dup196); + +var msg2253 = msg("1171:01", dup217); + +var select1066 = linear_select([ + msg2252, + msg2253, +]); + +var msg2254 = msg("1172", dup265); + +var msg2255 = msg("1172:01", dup266); + +var select1067 = linear_select([ + msg2254, + msg2255, +]); + +var msg2256 = msg("1173", dup265); + +var msg2257 = msg("1173:01", dup266); + +var select1068 = linear_select([ + msg2256, + msg2257, +]); + +var msg2258 = msg("1174", dup265); + +var msg2259 = msg("1174:01", dup266); + +var select1069 = linear_select([ + msg2258, + msg2259, +]); + +var msg2260 = msg("1175", dup265); + +var msg2261 = msg("1175:01", dup266); + +var select1070 = linear_select([ + msg2260, + msg2261, +]); + +var msg2262 = msg("1176", dup265); + +var msg2263 = msg("1176:01", dup266); + +var select1071 = linear_select([ + msg2262, + msg2263, +]); + +var msg2264 = msg("1177", dup196); + +var msg2265 = msg("1177:01", dup217); + +var select1072 = linear_select([ + msg2264, + msg2265, +]); + +var msg2266 = msg("1178", dup265); + +var msg2267 = msg("1178:01", dup266); + +var select1073 = linear_select([ + msg2266, + msg2267, +]); + +var msg2268 = msg("1179", dup265); + +var msg2269 = msg("1179:01", dup266); + +var select1074 = linear_select([ + msg2268, + msg2269, +]); + +var msg2270 = msg("1180", dup265); + +var msg2271 = msg("1180:01", dup266); + +var select1075 = linear_select([ + msg2270, + msg2271, +]); + +var msg2272 = msg("1181", dup198); + +var msg2273 = msg("1181:01", dup220); + +var select1076 = linear_select([ + msg2272, + msg2273, +]); + +var msg2274 = msg("1182", dup265); + +var msg2275 = msg("1182:01", dup266); + +var select1077 = linear_select([ + msg2274, + msg2275, +]); + +var msg2276 = msg("1183", dup196); + +var msg2277 = msg("1183:01", dup217); + +var select1078 = linear_select([ + msg2276, + msg2277, +]); + +var msg2278 = msg("1184", dup196); + +var msg2279 = msg("1184:01", dup217); + +var select1079 = linear_select([ + msg2278, + msg2279, +]); + +var msg2280 = msg("1185", dup265); + +var msg2281 = msg("1185:01", dup266); + +var select1080 = linear_select([ + msg2280, + msg2281, +]); + +var msg2282 = msg("1186", dup196); + +var msg2283 = msg("1186:01", dup217); + +var select1081 = linear_select([ + msg2282, + msg2283, +]); + +var msg2284 = msg("1187", dup265); + +var msg2285 = msg("1187:01", dup266); + +var select1082 = linear_select([ + msg2284, + msg2285, +]); + +var msg2286 = msg("1188", dup196); + +var msg2287 = msg("1188:01", dup217); + +var select1083 = linear_select([ + msg2286, + msg2287, +]); + +var msg2288 = msg("1189", dup196); + +var msg2289 = msg("1189:01", dup217); + +var select1084 = linear_select([ + msg2288, + msg2289, +]); + +var msg2290 = msg("1190", dup196); + +var msg2291 = msg("1190:01", dup217); + +var select1085 = linear_select([ + msg2290, + msg2291, +]); + +var msg2292 = msg("1191", dup196); + +var msg2293 = msg("1191:01", dup217); + +var select1086 = linear_select([ + msg2292, + msg2293, +]); + +var msg2294 = msg("1192", dup194); + +var msg2295 = msg("1192:01", dup229); + +var select1087 = linear_select([ + msg2294, + msg2295, +]); + +var msg2296 = msg("1193", dup269); + +var msg2297 = msg("1193:01", dup270); + +var select1088 = linear_select([ + msg2296, + msg2297, +]); + +var msg2298 = msg("1194", dup265); + +var msg2299 = msg("1194:01", dup266); + +var select1089 = linear_select([ + msg2298, + msg2299, +]); + +var msg2300 = msg("1195", dup265); + +var msg2301 = msg("1195:01", dup266); + +var select1090 = linear_select([ + msg2300, + msg2301, +]); + +var msg2302 = msg("1196", dup265); + +var msg2303 = msg("1196:01", dup266); + +var select1091 = linear_select([ + msg2302, + msg2303, +]); + +var msg2304 = msg("1197", dup265); + +var msg2305 = msg("1197:01", dup266); + +var select1092 = linear_select([ + msg2304, + msg2305, +]); + +var msg2306 = msg("1198", dup196); + +var msg2307 = msg("1198:01", dup217); + +var select1093 = linear_select([ + msg2306, + msg2307, +]); + +var msg2308 = msg("1199", dup265); + +var msg2309 = msg("1199:01", dup266); + +var select1094 = linear_select([ + msg2308, + msg2309, +]); + +var msg2310 = msg("1200", dup196); + +var msg2311 = msg("1200:01", dup217); + +var select1095 = linear_select([ + msg2310, + msg2311, +]); + +var msg2312 = msg("1201", dup196); + +var msg2313 = msg("1201:01", dup217); + +var select1096 = linear_select([ + msg2312, + msg2313, +]); + +var msg2314 = msg("1202", dup265); + +var msg2315 = msg("1202:01", dup266); + +var select1097 = linear_select([ + msg2314, + msg2315, +]); + +var msg2316 = msg("1204", dup265); + +var msg2317 = msg("1204:01", dup266); + +var select1098 = linear_select([ + msg2316, + msg2317, +]); + +var msg2318 = msg("1205", dup265); + +var msg2319 = msg("1205:01", dup266); + +var select1099 = linear_select([ + msg2318, + msg2319, +]); + +var msg2320 = msg("1206", dup265); + +var msg2321 = msg("1206:01", dup266); + +var select1100 = linear_select([ + msg2320, + msg2321, +]); + +var msg2322 = msg("1207", dup265); + +var msg2323 = msg("1207:01", dup266); + +var select1101 = linear_select([ + msg2322, + msg2323, +]); + +var msg2324 = msg("1208", dup265); + +var msg2325 = msg("1208:01", dup266); + +var select1102 = linear_select([ + msg2324, + msg2325, +]); + +var msg2326 = msg("1209", dup265); + +var msg2327 = msg("1209:01", dup266); + +var select1103 = linear_select([ + msg2326, + msg2327, +]); + +var msg2328 = msg("1211", dup265); + +var msg2329 = msg("1211:01", dup266); + +var select1104 = linear_select([ + msg2328, + msg2329, +]); + +var msg2330 = msg("1212", dup265); + +var msg2331 = msg("1212:01", dup266); + +var select1105 = linear_select([ + msg2330, + msg2331, +]); + +var msg2332 = msg("1213", dup265); + +var msg2333 = msg("1213:01", dup266); + +var select1106 = linear_select([ + msg2332, + msg2333, +]); + +var msg2334 = msg("1214", dup265); + +var msg2335 = msg("1214:01", dup266); + +var select1107 = linear_select([ + msg2334, + msg2335, +]); + +var msg2336 = msg("1215", dup265); + +var msg2337 = msg("1215:01", dup266); + +var select1108 = linear_select([ + msg2336, + msg2337, +]); + +var msg2338 = msg("1216", dup265); + +var msg2339 = msg("1216:01", dup266); + +var select1109 = linear_select([ + msg2338, + msg2339, +]); + +var msg2340 = msg("1217", dup265); + +var msg2341 = msg("1217:01", dup266); + +var select1110 = linear_select([ + msg2340, + msg2341, +]); + +var msg2342 = msg("1218", dup265); + +var msg2343 = msg("1218:01", dup266); + +var select1111 = linear_select([ + msg2342, + msg2343, +]); + +var msg2344 = msg("1219", dup265); + +var msg2345 = msg("1219:01", dup266); + +var select1112 = linear_select([ + msg2344, + msg2345, +]); + +var msg2346 = msg("1220", dup265); + +var msg2347 = msg("1220:01", dup266); + +var select1113 = linear_select([ + msg2346, + msg2347, +]); + +var msg2348 = msg("1221", dup265); + +var msg2349 = msg("1221:01", dup266); + +var select1114 = linear_select([ + msg2348, + msg2349, +]); + +var msg2350 = msg("1222", dup265); + +var msg2351 = msg("1222:01", dup266); + +var select1115 = linear_select([ + msg2350, + msg2351, +]); + +var msg2352 = msg("1224", dup265); + +var msg2353 = msg("1224:01", dup266); + +var select1116 = linear_select([ + msg2352, + msg2353, +]); + +var msg2354 = msg("1225", dup196); + +var msg2355 = msg("1225:01", dup217); + +var select1117 = linear_select([ + msg2354, + msg2355, +]); + +var msg2356 = msg("1226", dup196); + +var msg2357 = msg("1226:01", dup217); + +var select1118 = linear_select([ + msg2356, + msg2357, +]); + +var msg2358 = msg("1227", dup196); + +var msg2359 = msg("1227:01", dup217); + +var select1119 = linear_select([ + msg2358, + msg2359, +]); + +var msg2360 = msg("1228", dup194); + +var msg2361 = msg("1228:01", dup229); + +var select1120 = linear_select([ + msg2360, + msg2361, +]); + +var msg2362 = msg("1229", dup227); + +var msg2363 = msg("1229:01", dup228); + +var select1121 = linear_select([ + msg2362, + msg2363, +]); + +var msg2364 = msg("1230", dup263); + +var msg2365 = msg("1230:01", dup264); + +var select1122 = linear_select([ + msg2364, + msg2365, +]); + +var msg2366 = msg("1231", dup263); + +var msg2367 = msg("1231:01", dup264); + +var select1123 = linear_select([ + msg2366, + msg2367, +]); + +var msg2368 = msg("1232", dup263); + +var msg2369 = msg("1232:01", dup264); + +var select1124 = linear_select([ + msg2368, + msg2369, +]); + +var msg2370 = msg("1233", dup265); + +var msg2371 = msg("1233:01", dup266); + +var select1125 = linear_select([ + msg2370, + msg2371, +]); + +var msg2372 = msg("1234", dup263); + +var msg2373 = msg("1234:01", dup264); + +var select1126 = linear_select([ + msg2372, + msg2373, +]); + +var msg2374 = msg("1235", dup263); + +var msg2375 = msg("1235:01", dup264); + +var select1127 = linear_select([ + msg2374, + msg2375, +]); + +var msg2376 = msg("1236", dup196); + +var msg2377 = msg("1236:01", dup217); + +var select1128 = linear_select([ + msg2376, + msg2377, +]); + +var msg2378 = msg("1237", dup196); + +var msg2379 = msg("1237:01", dup217); + +var select1129 = linear_select([ + msg2378, + msg2379, +]); + +var msg2380 = msg("1238", dup196); + +var msg2381 = msg("1238:01", dup217); + +var select1130 = linear_select([ + msg2380, + msg2381, +]); + +var msg2382 = msg("1239", dup276); + +var msg2383 = msg("1239:01", dup277); + +var select1131 = linear_select([ + msg2382, + msg2383, +]); + +var msg2384 = msg("1240", dup197); + +var msg2385 = msg("1240:01", dup221); + +var select1132 = linear_select([ + msg2384, + msg2385, +]); + +var msg2386 = msg("1241", dup265); + +var msg2387 = msg("1241:01", dup266); + +var select1133 = linear_select([ + msg2386, + msg2387, +]); + +var msg2388 = msg("1242", dup265); + +var msg2389 = msg("1242:01", dup266); + +var select1134 = linear_select([ + msg2388, + msg2389, +]); + +var msg2390 = msg("1243", dup265); + +var msg2391 = msg("1243:01", dup266); + +var select1135 = linear_select([ + msg2390, + msg2391, +]); + +var msg2392 = msg("1244", dup265); + +var msg2393 = msg("1244:01", dup266); + +var select1136 = linear_select([ + msg2392, + msg2393, +]); + +var msg2394 = msg("1245", dup265); + +var msg2395 = msg("1245:01", dup266); + +var select1137 = linear_select([ + msg2394, + msg2395, +]); + +var msg2396 = msg("1246", dup267); + +var msg2397 = msg("1246:01", dup268); + +var select1138 = linear_select([ + msg2396, + msg2397, +]); + +var msg2398 = msg("1247", dup267); + +var msg2399 = msg("1247:01", dup268); + +var select1139 = linear_select([ + msg2398, + msg2399, +]); + +var msg2400 = msg("1248", dup265); + +var msg2401 = msg("1248:01", dup266); + +var select1140 = linear_select([ + msg2400, + msg2401, +]); + +var msg2402 = msg("1249", dup265); + +var msg2403 = msg("1249:01", dup266); + +var select1141 = linear_select([ + msg2402, + msg2403, +]); + +var msg2404 = msg("1250", dup265); + +var msg2405 = msg("1250:01", dup266); + +var select1142 = linear_select([ + msg2404, + msg2405, +]); + +var msg2406 = msg("1251", dup196); + +var msg2407 = msg("1251:01", dup217); + +var select1143 = linear_select([ + msg2406, + msg2407, +]); + +var msg2408 = msg("1252", dup278); + +var msg2409 = msg("1252:01", dup279); + +var select1144 = linear_select([ + msg2408, + msg2409, +]); + +var msg2410 = msg("1253", dup278); + +var msg2411 = msg("1253:01", dup279); + +var select1145 = linear_select([ + msg2410, + msg2411, +]); + +var msg2412 = msg("1254", dup265); + +var msg2413 = msg("1254:01", dup266); + +var select1146 = linear_select([ + msg2412, + msg2413, +]); + +var msg2414 = msg("1255", dup265); + +var msg2415 = msg("1255:01", dup266); + +var select1147 = linear_select([ + msg2414, + msg2415, +]); + +var msg2416 = msg("1256", dup265); + +var msg2417 = msg("1256:01", dup266); + +var select1148 = linear_select([ + msg2416, + msg2417, +]); + +var msg2418 = msg("1257", dup198); + +var msg2419 = msg("1257:01", dup220); + +var select1149 = linear_select([ + msg2418, + msg2419, +]); + +var msg2420 = msg("1258", dup198); + +var msg2421 = msg("1258:01", dup220); + +var select1150 = linear_select([ + msg2420, + msg2421, +]); + +var msg2422 = msg("1259", dup265); + +var msg2423 = msg("1259:01", dup266); + +var select1151 = linear_select([ + msg2422, + msg2423, +]); + +var msg2424 = msg("1260", dup196); + +var msg2425 = msg("1260:01", dup217); + +var select1152 = linear_select([ + msg2424, + msg2425, +]); + +var msg2426 = msg("1261", dup197); + +var msg2427 = msg("1261:01", dup221); + +var select1153 = linear_select([ + msg2426, + msg2427, +]); + +var msg2428 = msg("1262", dup258); + +var msg2429 = msg("1262:01", dup259); + +var select1154 = linear_select([ + msg2428, + msg2429, +]); + +var msg2430 = msg("1263", dup258); + +var msg2431 = msg("1263:01", dup259); + +var select1155 = linear_select([ + msg2430, + msg2431, +]); + +var msg2432 = msg("1264", dup258); + +var msg2433 = msg("1264:01", dup259); + +var select1156 = linear_select([ + msg2432, + msg2433, +]); + +var msg2434 = msg("1265", dup258); + +var msg2435 = msg("1265:01", dup259); + +var select1157 = linear_select([ + msg2434, + msg2435, +]); + +var msg2436 = msg("1266", dup258); + +var msg2437 = msg("1266:01", dup259); + +var select1158 = linear_select([ + msg2436, + msg2437, +]); + +var msg2438 = msg("1267", dup258); + +var msg2439 = msg("1267:01", dup259); + +var select1159 = linear_select([ + msg2438, + msg2439, +]); + +var msg2440 = msg("1268", dup280); + +var all39 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg2441 = msg("1268:01", all39); + +var select1160 = linear_select([ + msg2440, + msg2441, +]); + +var msg2442 = msg("1269", dup258); + +var msg2443 = msg("1269:01", dup259); + +var select1161 = linear_select([ + msg2442, + msg2443, +]); + +var msg2444 = msg("1270", dup258); + +var msg2445 = msg("1270:01", dup259); + +var select1162 = linear_select([ + msg2444, + msg2445, +]); + +var msg2446 = msg("1271", dup258); + +var msg2447 = msg("1271:01", dup259); + +var select1163 = linear_select([ + msg2446, + msg2447, +]); + +var msg2448 = msg("1272", dup258); + +var msg2449 = msg("1272:01", dup259); + +var select1164 = linear_select([ + msg2448, + msg2449, +]); + +var msg2450 = msg("1273", dup258); + +var msg2451 = msg("1273:01", dup259); + +var select1165 = linear_select([ + msg2450, + msg2451, +]); + +var msg2452 = msg("1274", dup258); + +var msg2453 = msg("1274:01", dup259); + +var select1166 = linear_select([ + msg2452, + msg2453, +]); + +var msg2454 = msg("1275", dup258); + +var msg2455 = msg("1275:01", dup259); + +var select1167 = linear_select([ + msg2454, + msg2455, +]); + +var msg2456 = msg("1276", dup258); + +var msg2457 = msg("1276:01", dup259); + +var select1168 = linear_select([ + msg2456, + msg2457, +]); + +var msg2458 = msg("1277", dup255); + +var msg2459 = msg("1277:01", dup256); + +var select1169 = linear_select([ + msg2458, + msg2459, +]); + +var msg2460 = msg("1278", dup255); + +var msg2461 = msg("1278:01", dup256); + +var select1170 = linear_select([ + msg2460, + msg2461, +]); + +var msg2462 = msg("1279", dup255); + +var msg2463 = msg("1279:01", dup256); + +var select1171 = linear_select([ + msg2462, + msg2463, +]); + +var msg2464 = msg("1280", dup255); + +var msg2465 = msg("1280:01", dup256); + +var select1172 = linear_select([ + msg2464, + msg2465, +]); + +var msg2466 = msg("1281", dup255); + +var msg2467 = msg("1281:01", dup256); + +var select1173 = linear_select([ + msg2466, + msg2467, +]); + +var msg2468 = msg("1282", dup255); + +var msg2469 = msg("1282:01", dup256); + +var select1174 = linear_select([ + msg2468, + msg2469, +]); + +var msg2470 = msg("1283", dup198); + +var msg2471 = msg("1283:01", dup220); + +var select1175 = linear_select([ + msg2470, + msg2471, +]); + +var msg2472 = msg("1284", dup265); + +var msg2473 = msg("1284:01", dup266); + +var select1176 = linear_select([ + msg2472, + msg2473, +]); + +var msg2474 = msg("1285", dup265); + +var msg2475 = msg("1285:01", dup266); + +var select1177 = linear_select([ + msg2474, + msg2475, +]); + +var msg2476 = msg("1286", dup265); + +var msg2477 = msg("1286:01", dup266); + +var select1178 = linear_select([ + msg2476, + msg2477, +]); + +var msg2478 = msg("1287", dup265); + +var msg2479 = msg("1287:01", dup266); + +var select1179 = linear_select([ + msg2478, + msg2479, +]); + +var msg2480 = msg("1288", dup265); + +var msg2481 = msg("1288:01", dup266); + +var select1180 = linear_select([ + msg2480, + msg2481, +]); + +var msg2482 = msg("1289", dup196); + +var msg2483 = msg("1289:01", dup217); + +var select1181 = linear_select([ + msg2482, + msg2483, +]); + +var msg2484 = msg("1290", dup265); + +var msg2485 = msg("1290:01", dup266); + +var select1182 = linear_select([ + msg2484, + msg2485, +]); + +var msg2486 = msg("1291", dup265); + +var msg2487 = msg("1291:01", dup266); + +var select1183 = linear_select([ + msg2486, + msg2487, +]); + +var msg2488 = msg("1292", dup196); + +var msg2489 = msg("1292:01", dup217); + +var select1184 = linear_select([ + msg2488, + msg2489, +]); + +var msg2490 = msg("1293", dup196); + +var msg2491 = msg("1293:01", dup217); + +var select1185 = linear_select([ + msg2490, + msg2491, +]); + +var msg2492 = msg("1294", dup196); + +var msg2493 = msg("1294:01", dup217); + +var select1186 = linear_select([ + msg2492, + msg2493, +]); + +var msg2494 = msg("1295", dup196); + +var msg2495 = msg("1295:01", dup217); + +var select1187 = linear_select([ + msg2494, + msg2495, +]); + +var msg2496 = msg("1296", dup255); + +var msg2497 = msg("1296:01", dup256); + +var select1188 = linear_select([ + msg2496, + msg2497, +]); + +var msg2498 = msg("1297", dup255); + +var msg2499 = msg("1297:01", dup256); + +var select1189 = linear_select([ + msg2498, + msg2499, +]); + +var msg2500 = msg("1298", dup255); + +var msg2501 = msg("1298:01", dup256); + +var select1190 = linear_select([ + msg2500, + msg2501, +]); + +var msg2502 = msg("1299", dup255); + +var msg2503 = msg("1299:01", dup256); + +var select1191 = linear_select([ + msg2502, + msg2503, +]); + +var msg2504 = msg("1300", dup265); + +var msg2505 = msg("1300:01", dup266); + +var select1192 = linear_select([ + msg2504, + msg2505, +]); + +var msg2506 = msg("1301", dup265); + +var msg2507 = msg("1301:01", dup266); + +var select1193 = linear_select([ + msg2506, + msg2507, +]); + +var msg2508 = msg("1302", dup265); + +var msg2509 = msg("1302:01", dup266); + +var select1194 = linear_select([ + msg2508, + msg2509, +]); + +var msg2510 = msg("1303", dup265); + +var msg2511 = msg("1303:01", dup266); + +var select1195 = linear_select([ + msg2510, + msg2511, +]); + +var msg2512 = msg("1304", dup265); + +var msg2513 = msg("1304:01", dup266); + +var select1196 = linear_select([ + msg2512, + msg2513, +]); + +var msg2514 = msg("1305", dup265); + +var msg2515 = msg("1305:01", dup266); + +var select1197 = linear_select([ + msg2514, + msg2515, +]); + +var msg2516 = msg("1306", dup265); + +var msg2517 = msg("1306:01", dup266); + +var select1198 = linear_select([ + msg2516, + msg2517, +]); + +var msg2518 = msg("1307", dup265); + +var msg2519 = msg("1307:01", dup266); + +var select1199 = linear_select([ + msg2518, + msg2519, +]); + +var msg2520 = msg("1308", dup265); + +var msg2521 = msg("1308:01", dup266); + +var select1200 = linear_select([ + msg2520, + msg2521, +]); + +var msg2522 = msg("1309", dup265); + +var msg2523 = msg("1309:01", dup266); + +var select1201 = linear_select([ + msg2522, + msg2523, +]); + +var msg2524 = msg("1310", dup281); + +var msg2525 = msg("1310:01", dup282); + +var select1202 = linear_select([ + msg2524, + msg2525, +]); + +var msg2526 = msg("1311", dup281); + +var msg2527 = msg("1311:01", dup282); + +var select1203 = linear_select([ + msg2526, + msg2527, +]); + +var msg2528 = msg("1312", dup281); + +var msg2529 = msg("1312:01", dup282); + +var select1204 = linear_select([ + msg2528, + msg2529, +]); + +var msg2530 = msg("1313", dup281); + +var msg2531 = msg("1313:01", dup282); + +var select1205 = linear_select([ + msg2530, + msg2531, +]); + +var msg2532 = msg("1314", dup281); + +var msg2533 = msg("1314:01", dup282); + +var select1206 = linear_select([ + msg2532, + msg2533, +]); + +var msg2534 = msg("1315", dup281); + +var msg2535 = msg("1315:01", dup282); + +var select1207 = linear_select([ + msg2534, + msg2535, +]); + +var msg2536 = msg("1316", dup281); + +var msg2537 = msg("1316:01", dup282); + +var select1208 = linear_select([ + msg2536, + msg2537, +]); + +var msg2538 = msg("1317", dup281); + +var msg2539 = msg("1317:01", dup282); + +var select1209 = linear_select([ + msg2538, + msg2539, +]); + +var msg2540 = msg("1318", dup281); + +var msg2541 = msg("1318:01", dup282); + +var select1210 = linear_select([ + msg2540, + msg2541, +]); + +var msg2542 = msg("1319", dup281); + +var msg2543 = msg("1319:01", dup282); + +var select1211 = linear_select([ + msg2542, + msg2543, +]); + +var msg2544 = msg("1320", dup281); + +var msg2545 = msg("1320:01", dup282); + +var select1212 = linear_select([ + msg2544, + msg2545, +]); + +var msg2546 = msg("1321", dup196); + +var msg2547 = msg("1321:01", dup217); + +var select1213 = linear_select([ + msg2546, + msg2547, +]); + +var msg2548 = msg("1322", dup196); + +var msg2549 = msg("1322:01", dup217); + +var select1214 = linear_select([ + msg2548, + msg2549, +]); + +var msg2550 = msg("1323", dup196); + +var msg2551 = msg("1323:01", dup217); + +var select1215 = linear_select([ + msg2550, + msg2551, +]); + +var msg2552 = msg("1324", dup197); + +var msg2553 = msg("1324:01", dup221); + +var select1216 = linear_select([ + msg2552, + msg2553, +]); + +var msg2554 = msg("1325", dup197); + +var msg2555 = msg("1325:01", dup221); + +var select1217 = linear_select([ + msg2554, + msg2555, +]); + +var msg2556 = msg("1326", dup197); + +var msg2557 = msg("1326:01", dup221); + +var select1218 = linear_select([ + msg2556, + msg2557, +]); + +var msg2558 = msg("1327", dup197); + +var msg2559 = msg("1327:01", dup221); + +var select1219 = linear_select([ + msg2558, + msg2559, +]); + +var msg2560 = msg("1328", dup265); + +var msg2561 = msg("1328:01", dup266); + +var select1220 = linear_select([ + msg2560, + msg2561, +]); + +var msg2562 = msg("1329", dup265); + +var msg2563 = msg("1329:01", dup266); + +var select1221 = linear_select([ + msg2562, + msg2563, +]); + +var msg2564 = msg("1330", dup265); + +var msg2565 = msg("1330:01", dup266); + +var select1222 = linear_select([ + msg2564, + msg2565, +]); + +var msg2566 = msg("1331", dup265); + +var msg2567 = msg("1331:01", dup266); + +var select1223 = linear_select([ + msg2566, + msg2567, +]); + +var msg2568 = msg("1332", dup265); + +var msg2569 = msg("1332:01", dup266); + +var select1224 = linear_select([ + msg2568, + msg2569, +]); + +var msg2570 = msg("1333", dup265); + +var msg2571 = msg("1333:01", dup266); + +var select1225 = linear_select([ + msg2570, + msg2571, +]); + +var msg2572 = msg("1334", dup265); + +var msg2573 = msg("1334:01", dup266); + +var select1226 = linear_select([ + msg2572, + msg2573, +]); + +var msg2574 = msg("1335", dup265); + +var msg2575 = msg("1335:01", dup266); + +var select1227 = linear_select([ + msg2574, + msg2575, +]); + +var msg2576 = msg("1336", dup265); + +var msg2577 = msg("1336:01", dup266); + +var select1228 = linear_select([ + msg2576, + msg2577, +]); + +var msg2578 = msg("1337", dup265); + +var msg2579 = msg("1337:01", dup266); + +var select1229 = linear_select([ + msg2578, + msg2579, +]); + +var msg2580 = msg("1338", dup265); + +var msg2581 = msg("1338:01", dup266); + +var select1230 = linear_select([ + msg2580, + msg2581, +]); + +var msg2582 = msg("1339", dup265); + +var msg2583 = msg("1339:01", dup266); + +var select1231 = linear_select([ + msg2582, + msg2583, +]); + +var msg2584 = msg("1340", dup274); + +var msg2585 = msg("1340:01", dup275); + +var select1232 = linear_select([ + msg2584, + msg2585, +]); + +var msg2586 = msg("1341", dup265); + +var msg2587 = msg("1341:01", dup266); + +var select1233 = linear_select([ + msg2586, + msg2587, +]); + +var msg2588 = msg("1342", dup265); + +var msg2589 = msg("1342:01", dup266); + +var select1234 = linear_select([ + msg2588, + msg2589, +]); + +var msg2590 = msg("1343", dup265); + +var msg2591 = msg("1343:01", dup266); + +var select1235 = linear_select([ + msg2590, + msg2591, +]); + +var msg2592 = msg("1344", dup265); + +var msg2593 = msg("1344:01", dup266); + +var select1236 = linear_select([ + msg2592, + msg2593, +]); + +var msg2594 = msg("1345", dup265); + +var msg2595 = msg("1345:01", dup266); + +var select1237 = linear_select([ + msg2594, + msg2595, +]); + +var msg2596 = msg("1346", dup265); + +var msg2597 = msg("1346:01", dup266); + +var select1238 = linear_select([ + msg2596, + msg2597, +]); + +var msg2598 = msg("1347", dup265); + +var msg2599 = msg("1347:01", dup266); + +var select1239 = linear_select([ + msg2598, + msg2599, +]); + +var msg2600 = msg("1348", dup265); + +var msg2601 = msg("1348:01", dup266); + +var select1240 = linear_select([ + msg2600, + msg2601, +]); + +var msg2602 = msg("1349", dup265); + +var msg2603 = msg("1349:01", dup266); + +var select1241 = linear_select([ + msg2602, + msg2603, +]); + +var msg2604 = msg("1350", dup265); + +var msg2605 = msg("1350:01", dup266); + +var select1242 = linear_select([ + msg2604, + msg2605, +]); + +var msg2606 = msg("1351", dup267); + +var msg2607 = msg("1351:01", dup268); + +var select1243 = linear_select([ + msg2606, + msg2607, +]); + +var msg2608 = msg("1352", dup267); + +var msg2609 = msg("1352:01", dup268); + +var select1244 = linear_select([ + msg2608, + msg2609, +]); + +var msg2610 = msg("1353", dup265); + +var msg2611 = msg("1353:01", dup266); + +var select1245 = linear_select([ + msg2610, + msg2611, +]); + +var msg2612 = msg("1354", dup265); + +var msg2613 = msg("1354:01", dup266); + +var select1246 = linear_select([ + msg2612, + msg2613, +]); + +var msg2614 = msg("1355", dup267); + +var msg2615 = msg("1355:01", dup268); + +var select1247 = linear_select([ + msg2614, + msg2615, +]); + +var msg2616 = msg("1356", dup267); + +var msg2617 = msg("1356:01", dup268); + +var select1248 = linear_select([ + msg2616, + msg2617, +]); + +var msg2618 = msg("1357", dup265); + +var msg2619 = msg("1357:01", dup266); + +var select1249 = linear_select([ + msg2618, + msg2619, +]); + +var msg2620 = msg("1358", dup265); + +var msg2621 = msg("1358:01", dup266); + +var select1250 = linear_select([ + msg2620, + msg2621, +]); + +var msg2622 = msg("1359", dup265); + +var msg2623 = msg("1359:01", dup266); + +var select1251 = linear_select([ + msg2622, + msg2623, +]); + +var msg2624 = msg("1360", dup265); + +var msg2625 = msg("1360:01", dup266); + +var select1252 = linear_select([ + msg2624, + msg2625, +]); + +var msg2626 = msg("1361", dup265); + +var msg2627 = msg("1361:01", dup266); + +var select1253 = linear_select([ + msg2626, + msg2627, +]); + +var msg2628 = msg("1362", dup265); + +var msg2629 = msg("1362:01", dup266); + +var select1254 = linear_select([ + msg2628, + msg2629, +]); + +var msg2630 = msg("1363", dup265); + +var msg2631 = msg("1363:01", dup266); + +var select1255 = linear_select([ + msg2630, + msg2631, +]); + +var msg2632 = msg("1364", dup265); + +var msg2633 = msg("1364:01", dup266); + +var select1256 = linear_select([ + msg2632, + msg2633, +]); + +var msg2634 = msg("1365", dup265); + +var msg2635 = msg("1365:01", dup266); + +var select1257 = linear_select([ + msg2634, + msg2635, +]); + +var msg2636 = msg("1366", dup265); + +var msg2637 = msg("1366:01", dup266); + +var select1258 = linear_select([ + msg2636, + msg2637, +]); + +var msg2638 = msg("1367", dup265); + +var msg2639 = msg("1367:01", dup266); + +var select1259 = linear_select([ + msg2638, + msg2639, +]); + +var msg2640 = msg("1368", dup265); + +var msg2641 = msg("1368:01", dup266); + +var select1260 = linear_select([ + msg2640, + msg2641, +]); + +var msg2642 = msg("1369", dup265); + +var msg2643 = msg("1369:01", dup266); + +var select1261 = linear_select([ + msg2642, + msg2643, +]); + +var msg2644 = msg("1370", dup265); + +var msg2645 = msg("1370:01", dup266); + +var select1262 = linear_select([ + msg2644, + msg2645, +]); + +var msg2646 = msg("1371", dup265); + +var msg2647 = msg("1371:01", dup266); + +var select1263 = linear_select([ + msg2646, + msg2647, +]); + +var msg2648 = msg("1372", dup265); + +var msg2649 = msg("1372:01", dup266); + +var select1264 = linear_select([ + msg2648, + msg2649, +]); + +var msg2650 = msg("1373", dup265); + +var msg2651 = msg("1373:01", dup266); + +var select1265 = linear_select([ + msg2650, + msg2651, +]); + +var msg2652 = msg("1374", dup265); + +var msg2653 = msg("1374:01", dup266); + +var select1266 = linear_select([ + msg2652, + msg2653, +]); + +var msg2654 = msg("1375", dup238); + +var msg2655 = msg("1375:01", dup239); + +var select1267 = linear_select([ + msg2654, + msg2655, +]); + +var msg2656 = msg("1376", dup265); + +var msg2657 = msg("1376:01", dup266); + +var select1268 = linear_select([ + msg2656, + msg2657, +]); + +var msg2658 = msg("1377", dup227); + +var msg2659 = msg("1377:01", dup228); + +var select1269 = linear_select([ + msg2658, + msg2659, +]); + +var msg2660 = msg("1378", dup227); + +var msg2661 = msg("1378:01", dup228); + +var select1270 = linear_select([ + msg2660, + msg2661, +]); + +var msg2662 = msg("1379", dup222); + +var msg2663 = msg("1379:01", dup223); + +var select1271 = linear_select([ + msg2662, + msg2663, +]); + +var msg2664 = msg("1380", dup265); + +var msg2665 = msg("1380:01", dup266); + +var select1272 = linear_select([ + msg2664, + msg2665, +]); + +var msg2666 = msg("1381", dup194); + +var msg2667 = msg("1381:01", dup229); + +var select1273 = linear_select([ + msg2666, + msg2667, +]); + +var msg2668 = msg("1382", dup222); + +var msg2669 = msg("1382:01", dup223); + +var select1274 = linear_select([ + msg2668, + msg2669, +]); + +var msg2670 = msg("1383", dup196); + +var msg2671 = msg("1383:01", dup217); + +var select1275 = linear_select([ + msg2670, + msg2671, +]); + +var msg2672 = msg("1384", dup196); + +var msg2673 = msg("1384:01", dup217); + +var select1276 = linear_select([ + msg2672, + msg2673, +]); + +var msg2674 = msg("1385", dup240); + +var msg2675 = msg("1385:01", dup241); + +var select1277 = linear_select([ + msg2674, + msg2675, +]); + +var msg2676 = msg("1386", dup197); + +var msg2677 = msg("1386:01", dup221); + +var select1278 = linear_select([ + msg2676, + msg2677, +]); + +var msg2678 = msg("1387", dup197); + +var msg2679 = msg("1387:01", dup221); + +var select1279 = linear_select([ + msg2678, + msg2679, +]); + +var msg2680 = msg("1388", dup222); + +var msg2681 = msg("1388:01", dup223); + +var select1280 = linear_select([ + msg2680, + msg2681, +]); + +var msg2682 = msg("1389", dup265); + +var msg2683 = msg("1389:01", dup266); + +var select1281 = linear_select([ + msg2682, + msg2683, +]); + +var msg2684 = msg("1390", dup196); + +var msg2685 = msg("1390:01", dup217); + +var select1282 = linear_select([ + msg2684, + msg2685, +]); + +var msg2686 = msg("1391", dup267); + +var msg2687 = msg("1391:01", dup268); + +var select1283 = linear_select([ + msg2686, + msg2687, +]); + +var msg2688 = msg("1392", dup265); + +var msg2689 = msg("1392:01", dup266); + +var select1284 = linear_select([ + msg2688, + msg2689, +]); + +var msg2690 = msg("1393", dup196); + +var msg2691 = msg("1393:01", dup217); + +var select1285 = linear_select([ + msg2690, + msg2691, +]); + +var msg2692 = msg("1394", dup196); + +var msg2693 = msg("1394:01", dup217); + +var select1286 = linear_select([ + msg2692, + msg2693, +]); + +var msg2694 = msg("1395", dup265); + +var msg2695 = msg("1395:01", dup266); + +var select1287 = linear_select([ + msg2694, + msg2695, +]); + +var msg2696 = msg("1396", dup265); + +var msg2697 = msg("1396:01", dup266); + +var select1288 = linear_select([ + msg2696, + msg2697, +]); + +var msg2698 = msg("1397", dup265); + +var msg2699 = msg("1397:01", dup266); + +var select1289 = linear_select([ + msg2698, + msg2699, +]); + +var msg2700 = msg("1398", dup196); + +var msg2701 = msg("1398:01", dup217); + +var select1290 = linear_select([ + msg2700, + msg2701, +]); + +var msg2702 = msg("1399", dup265); + +var msg2703 = msg("1399:01", dup266); + +var select1291 = linear_select([ + msg2702, + msg2703, +]); + +var msg2704 = msg("1400", dup265); + +var msg2705 = msg("1400:01", dup266); + +var select1292 = linear_select([ + msg2704, + msg2705, +]); + +var msg2706 = msg("1401", dup265); + +var msg2707 = msg("1401:01", dup266); + +var select1293 = linear_select([ + msg2706, + msg2707, +]); + +var msg2708 = msg("1402", dup265); + +var msg2709 = msg("1402:01", dup266); + +var select1294 = linear_select([ + msg2708, + msg2709, +]); + +var msg2710 = msg("1403", dup265); + +var msg2711 = msg("1403:01", dup266); + +var select1295 = linear_select([ + msg2710, + msg2711, +]); + +var msg2712 = msg("1404", dup265); + +var msg2713 = msg("1404:01", dup266); + +var select1296 = linear_select([ + msg2712, + msg2713, +]); + +var msg2714 = msg("1405", dup265); + +var msg2715 = msg("1405:01", dup266); + +var select1297 = linear_select([ + msg2714, + msg2715, +]); + +var msg2716 = msg("1406", dup265); + +var msg2717 = msg("1406:01", dup266); + +var select1298 = linear_select([ + msg2716, + msg2717, +]); + +var msg2718 = msg("1407", dup265); + +var msg2719 = msg("1407:01", dup266); + +var select1299 = linear_select([ + msg2718, + msg2719, +]); + +var msg2720 = msg("1408", dup198); + +var msg2721 = msg("1408:01", dup220); + +var select1300 = linear_select([ + msg2720, + msg2721, +]); + +var msg2722 = msg("1409", dup222); + +var msg2723 = msg("1409:01", dup223); + +var select1301 = linear_select([ + msg2722, + msg2723, +]); + +var msg2724 = msg("1410", dup265); + +var msg2725 = msg("1410:01", dup266); + +var select1302 = linear_select([ + msg2724, + msg2725, +]); + +var msg2726 = msg("1411", dup242); + +var msg2727 = msg("1411:01", dup243); + +var select1303 = linear_select([ + msg2726, + msg2727, +]); + +var msg2728 = msg("1412", dup283); + +var msg2729 = msg("1412:01", dup284); + +var select1304 = linear_select([ + msg2728, + msg2729, +]); + +var msg2730 = msg("1413", dup242); + +var msg2731 = msg("1413:01", dup243); + +var select1305 = linear_select([ + msg2730, + msg2731, +]); + +var msg2732 = msg("1414", dup283); + +var msg2733 = msg("1414:01", dup284); + +var select1306 = linear_select([ + msg2732, + msg2733, +]); + +var msg2734 = msg("1415", dup242); + +var msg2735 = msg("1415:01", dup243); + +var select1307 = linear_select([ + msg2734, + msg2735, +]); + +var msg2736 = msg("1416", dup242); + +var msg2737 = msg("1416:01", dup243); + +var select1308 = linear_select([ + msg2736, + msg2737, +]); + +var msg2738 = msg("1417", dup242); + +var msg2739 = msg("1417:01", dup243); + +var select1309 = linear_select([ + msg2738, + msg2739, +]); + +var msg2740 = msg("1418", dup283); + +var msg2741 = msg("1418:01", dup284); + +var select1310 = linear_select([ + msg2740, + msg2741, +]); + +var msg2742 = msg("1419", dup242); + +var msg2743 = msg("1419:01", dup243); + +var select1311 = linear_select([ + msg2742, + msg2743, +]); + +var msg2744 = msg("1420", dup283); + +var msg2745 = msg("1420:01", dup284); + +var select1312 = linear_select([ + msg2744, + msg2745, +]); + +var msg2746 = msg("1421", dup253); + +var msg2747 = msg("1421:01", dup254); + +var select1313 = linear_select([ + msg2746, + msg2747, +]); + +var msg2748 = msg("1422", dup222); + +var msg2749 = msg("1422:01", dup223); + +var select1314 = linear_select([ + msg2748, + msg2749, +]); + +var msg2750 = msg("1423", dup197); + +var msg2751 = msg("1423:01", dup217); + +var select1315 = linear_select([ + msg2750, + msg2751, +]); + +var msg2752 = msg("1424", dup196); + +var msg2753 = msg("1424:01", dup217); + +var select1316 = linear_select([ + msg2752, + msg2753, +]); + +var msg2754 = msg("1425", dup265); + +var msg2755 = msg("1425:01", dup217); + +var select1317 = linear_select([ + msg2754, + msg2755, +]); + +var msg2756 = msg("1426", dup242); + +var msg2757 = msg("1426:01", dup243); + +var select1318 = linear_select([ + msg2756, + msg2757, +]); + +var msg2758 = msg("1427", dup242); + +var msg2759 = msg("1427:01", dup243); + +var select1319 = linear_select([ + msg2758, + msg2759, +]); + +var msg2760 = msg("1428", dup196); + +var msg2761 = msg("1428:01", dup217); + +var select1320 = linear_select([ + msg2760, + msg2761, +]); + +var msg2762 = msg("1429", dup196); + +var msg2763 = msg("1429:01", dup217); + +var select1321 = linear_select([ + msg2762, + msg2763, +]); + +var msg2764 = msg("1430", dup278); + +var msg2765 = msg("1430:01", dup279); + +var select1322 = linear_select([ + msg2764, + msg2765, +]); + +var msg2766 = msg("1431", dup196); + +var msg2767 = msg("1431:01", dup217); + +var select1323 = linear_select([ + msg2766, + msg2767, +]); + +var msg2768 = msg("1432", dup196); + +var msg2769 = msg("1432:01", dup217); + +var select1324 = linear_select([ + msg2768, + msg2769, +]); + +var msg2770 = msg("1433", dup265); + +var msg2771 = msg("1433:01", dup266); + +var select1325 = linear_select([ + msg2770, + msg2771, +]); + +var msg2772 = msg("1434", dup265); + +var msg2773 = msg("1434:01", dup266); + +var select1326 = linear_select([ + msg2772, + msg2773, +]); + +var msg2774 = msg("1435", dup196); + +var msg2775 = msg("1435:01", dup217); + +var select1327 = linear_select([ + msg2774, + msg2775, +]); + +var msg2776 = msg("1436", dup196); + +var msg2777 = msg("1436:01", dup217); + +var select1328 = linear_select([ + msg2776, + msg2777, +]); + +var msg2778 = msg("1437", dup196); + +var msg2779 = msg("1437:01", dup217); + +var select1329 = linear_select([ + msg2778, + msg2779, +]); + +var msg2780 = msg("1438", dup196); + +var msg2781 = msg("1438:01", dup217); + +var select1330 = linear_select([ + msg2780, + msg2781, +]); + +var msg2782 = msg("1439", dup196); + +var msg2783 = msg("1439:01", dup217); + +var select1331 = linear_select([ + msg2782, + msg2783, +]); + +var msg2784 = msg("1440", dup196); + +var msg2785 = msg("1440:01", dup217); + +var select1332 = linear_select([ + msg2784, + msg2785, +]); + +var msg2786 = msg("1441", dup196); + +var msg2787 = msg("1441:01", dup217); + +var select1333 = linear_select([ + msg2786, + msg2787, +]); + +var msg2788 = msg("1442", dup196); + +var msg2789 = msg("1442:01", dup217); + +var select1334 = linear_select([ + msg2788, + msg2789, +]); + +var msg2790 = msg("1443", dup196); + +var msg2791 = msg("1443:01", dup217); + +var select1335 = linear_select([ + msg2790, + msg2791, +]); + +var msg2792 = msg("1444", dup196); + +var msg2793 = msg("1444:01", dup217); + +var select1336 = linear_select([ + msg2792, + msg2793, +]); + +var msg2794 = msg("1445", dup227); + +var msg2795 = msg("1445:01", dup228); + +var select1337 = linear_select([ + msg2794, + msg2795, +]); + +var msg2796 = msg("1446", dup250); + +var msg2797 = msg("1446:01", dup251); + +var select1338 = linear_select([ + msg2796, + msg2797, +]); + +var msg2798 = msg("1447", dup196); + +var msg2799 = msg("1447:01", dup217); + +var select1339 = linear_select([ + msg2798, + msg2799, +]); + +var msg2800 = msg("1448", dup196); + +var msg2801 = msg("1448:01", dup217); + +var select1340 = linear_select([ + msg2800, + msg2801, +]); + +var msg2802 = msg("1449", dup227); + +var msg2803 = msg("1449:01", dup228); + +var select1341 = linear_select([ + msg2802, + msg2803, +]); + +var msg2804 = msg("1450", dup250); + +var msg2805 = msg("1450:01", dup251); + +var select1342 = linear_select([ + msg2804, + msg2805, +]); + +var msg2806 = msg("1451", dup265); + +var msg2807 = msg("1451:01", dup266); + +var select1343 = linear_select([ + msg2806, + msg2807, +]); + +var msg2808 = msg("1452", dup265); + +var msg2809 = msg("1452:01", dup266); + +var select1344 = linear_select([ + msg2808, + msg2809, +]); + +var msg2810 = msg("1453", dup265); + +var msg2811 = msg("1453:01", dup266); + +var select1345 = linear_select([ + msg2810, + msg2811, +]); + +var msg2812 = msg("1454", dup265); + +var msg2813 = msg("1454:01", dup266); + +var select1346 = linear_select([ + msg2812, + msg2813, +]); + +var msg2814 = msg("1455", dup265); + +var msg2815 = msg("1455:01", dup266); + +var select1347 = linear_select([ + msg2814, + msg2815, +]); + +var msg2816 = msg("1456", dup265); + +var msg2817 = msg("1456:01", dup266); + +var select1348 = linear_select([ + msg2816, + msg2817, +]); + +var msg2818 = msg("1457", dup265); + +var msg2819 = msg("1457:01", dup266); + +var select1349 = linear_select([ + msg2818, + msg2819, +]); + +var msg2820 = msg("1458", dup265); + +var msg2821 = msg("1458:01", dup266); + +var select1350 = linear_select([ + msg2820, + msg2821, +]); + +var msg2822 = msg("1459", dup265); + +var msg2823 = msg("1459:01", dup266); + +var select1351 = linear_select([ + msg2822, + msg2823, +]); + +var msg2824 = msg("1460", dup265); + +var msg2825 = msg("1460:01", dup266); + +var select1352 = linear_select([ + msg2824, + msg2825, +]); + +var msg2826 = msg("1461", dup265); + +var msg2827 = msg("1461:01", dup266); + +var select1353 = linear_select([ + msg2826, + msg2827, +]); + +var msg2828 = msg("1462", dup265); + +var msg2829 = msg("1462:01", dup266); + +var select1354 = linear_select([ + msg2828, + msg2829, +]); + +var msg2830 = msg("1463", dup196); + +var msg2831 = msg("1463:01", dup217); + +var select1355 = linear_select([ + msg2830, + msg2831, +]); + +var msg2832 = msg("1464", dup196); + +var msg2833 = msg("1464:01", dup217); + +var select1356 = linear_select([ + msg2832, + msg2833, +]); + +var msg2834 = msg("1465", dup265); + +var msg2835 = msg("1465:01", dup266); + +var select1357 = linear_select([ + msg2834, + msg2835, +]); + +var msg2836 = msg("1466", dup265); + +var msg2837 = msg("1466:01", dup266); + +var select1358 = linear_select([ + msg2836, + msg2837, +]); + +var msg2838 = msg("1467", dup265); + +var msg2839 = msg("1467:01", dup266); + +var select1359 = linear_select([ + msg2838, + msg2839, +]); + +var msg2840 = msg("1468", dup265); + +var msg2841 = msg("1468:01", dup266); + +var select1360 = linear_select([ + msg2840, + msg2841, +]); + +var msg2842 = msg("1469", dup265); + +var msg2843 = msg("1469:01", dup266); + +var select1361 = linear_select([ + msg2842, + msg2843, +]); + +var msg2844 = msg("1470", dup265); + +var msg2845 = msg("1470:01", dup266); + +var select1362 = linear_select([ + msg2844, + msg2845, +]); + +var msg2846 = msg("1471", dup265); + +var msg2847 = msg("1471:01", dup266); + +var select1363 = linear_select([ + msg2846, + msg2847, +]); + +var msg2848 = msg("1472", dup265); + +var msg2849 = msg("1472:01", dup266); + +var select1364 = linear_select([ + msg2848, + msg2849, +]); + +var msg2850 = msg("1473", dup265); + +var msg2851 = msg("1473:01", dup266); + +var select1365 = linear_select([ + msg2850, + msg2851, +]); + +var msg2852 = msg("1474", dup265); + +var msg2853 = msg("1474:01", dup266); + +var select1366 = linear_select([ + msg2852, + msg2853, +]); + +var msg2854 = msg("1475", dup265); + +var msg2855 = msg("1475:01", dup266); + +var select1367 = linear_select([ + msg2854, + msg2855, +]); + +var msg2856 = msg("1476", dup265); + +var msg2857 = msg("1476:01", dup266); + +var select1368 = linear_select([ + msg2856, + msg2857, +]); + +var msg2858 = msg("1477", dup265); + +var msg2859 = msg("1477:01", dup266); + +var select1369 = linear_select([ + msg2858, + msg2859, +]); + +var msg2860 = msg("1478", dup265); + +var msg2861 = msg("1478:01", dup266); + +var select1370 = linear_select([ + msg2860, + msg2861, +]); + +var msg2862 = msg("1479", dup265); + +var msg2863 = msg("1479:01", dup266); + +var select1371 = linear_select([ + msg2862, + msg2863, +]); + +var msg2864 = msg("1480", dup265); + +var msg2865 = msg("1480:01", dup266); + +var select1372 = linear_select([ + msg2864, + msg2865, +]); + +var msg2866 = msg("1481", dup265); + +var msg2867 = msg("1481:01", dup266); + +var select1373 = linear_select([ + msg2866, + msg2867, +]); + +var msg2868 = msg("1482", dup265); + +var msg2869 = msg("1482:01", dup266); + +var select1374 = linear_select([ + msg2868, + msg2869, +]); + +var msg2870 = msg("1483", dup265); + +var msg2871 = msg("1483:01", dup266); + +var select1375 = linear_select([ + msg2870, + msg2871, +]); + +var msg2872 = msg("1484", dup265); + +var msg2873 = msg("1484:01", dup266); + +var select1376 = linear_select([ + msg2872, + msg2873, +]); + +var msg2874 = msg("1485", dup265); + +var msg2875 = msg("1485:01", dup266); + +var select1377 = linear_select([ + msg2874, + msg2875, +]); + +var msg2876 = msg("1486", dup265); + +var msg2877 = msg("1486:01", dup266); + +var select1378 = linear_select([ + msg2876, + msg2877, +]); + +var msg2878 = msg("1487", dup265); + +var msg2879 = msg("1487:01", dup266); + +var select1379 = linear_select([ + msg2878, + msg2879, +]); + +var msg2880 = msg("1488", dup265); + +var msg2881 = msg("1488:01", dup266); + +var select1380 = linear_select([ + msg2880, + msg2881, +]); + +var msg2882 = msg("1489", dup265); + +var msg2883 = msg("1489:01", dup266); + +var select1381 = linear_select([ + msg2882, + msg2883, +]); + +var msg2884 = msg("1490", dup265); + +var msg2885 = msg("1490:01", dup266); + +var select1382 = linear_select([ + msg2884, + msg2885, +]); + +var msg2886 = msg("1491", dup265); + +var msg2887 = msg("1491:01", dup266); + +var select1383 = linear_select([ + msg2886, + msg2887, +]); + +var msg2888 = msg("1492", dup265); + +var msg2889 = msg("1492:01", dup266); + +var select1384 = linear_select([ + msg2888, + msg2889, +]); + +var msg2890 = msg("1493", dup265); + +var msg2891 = msg("1493:01", dup266); + +var select1385 = linear_select([ + msg2890, + msg2891, +]); + +var msg2892 = msg("1494", dup265); + +var msg2893 = msg("1494:01", dup266); + +var select1386 = linear_select([ + msg2892, + msg2893, +]); + +var msg2894 = msg("1495", dup265); + +var msg2895 = msg("1495:01", dup266); + +var select1387 = linear_select([ + msg2894, + msg2895, +]); + +var msg2896 = msg("1496", dup265); + +var msg2897 = msg("1496:01", dup266); + +var select1388 = linear_select([ + msg2896, + msg2897, +]); + +var msg2898 = msg("1497", dup265); + +var msg2899 = msg("1497:01", dup266); + +var select1389 = linear_select([ + msg2898, + msg2899, +]); + +var msg2900 = msg("1498", dup265); + +var msg2901 = msg("1498:01", dup266); + +var select1390 = linear_select([ + msg2900, + msg2901, +]); + +var msg2902 = msg("1499", dup265); + +var msg2903 = msg("1499:01", dup266); + +var select1391 = linear_select([ + msg2902, + msg2903, +]); + +var msg2904 = msg("1500", dup265); + +var msg2905 = msg("1500:01", dup266); + +var select1392 = linear_select([ + msg2904, + msg2905, +]); + +var msg2906 = msg("1501", dup265); + +var msg2907 = msg("1501:01", dup266); + +var select1393 = linear_select([ + msg2906, + msg2907, +]); + +var msg2908 = msg("1502", dup265); + +var msg2909 = msg("1502:01", dup266); + +var select1394 = linear_select([ + msg2908, + msg2909, +]); + +var msg2910 = msg("1503", dup265); + +var msg2911 = msg("1503:01", dup266); + +var select1395 = linear_select([ + msg2910, + msg2911, +]); + +var msg2912 = msg("1504", dup196); + +var msg2913 = msg("1504:01", dup217); + +var select1396 = linear_select([ + msg2912, + msg2913, +]); + +var msg2914 = msg("1505", dup269); + +var msg2915 = msg("1505:01", dup270); + +var select1397 = linear_select([ + msg2914, + msg2915, +]); + +var msg2916 = msg("1506", dup269); + +var msg2917 = msg("1506:01", dup270); + +var select1398 = linear_select([ + msg2916, + msg2917, +]); + +var msg2918 = msg("1507", dup269); + +var msg2919 = msg("1507:01", dup270); + +var select1399 = linear_select([ + msg2918, + msg2919, +]); + +var msg2920 = msg("1508", dup265); + +var msg2921 = msg("1508:01", dup266); + +var select1400 = linear_select([ + msg2920, + msg2921, +]); + +var msg2922 = msg("1509", dup265); + +var msg2923 = msg("1509:01", dup266); + +var select1401 = linear_select([ + msg2922, + msg2923, +]); + +var msg2924 = msg("1510", dup269); + +var msg2925 = msg("1510:01", dup270); + +var select1402 = linear_select([ + msg2924, + msg2925, +]); + +var msg2926 = msg("1511", dup265); + +var msg2927 = msg("1511:01", dup266); + +var select1403 = linear_select([ + msg2926, + msg2927, +]); + +var msg2928 = msg("1512", dup269); + +var msg2929 = msg("1512:01", dup270); + +var select1404 = linear_select([ + msg2928, + msg2929, +]); + +var msg2930 = msg("1513", dup265); + +var msg2931 = msg("1513:01", dup266); + +var select1405 = linear_select([ + msg2930, + msg2931, +]); + +var msg2932 = msg("1514", dup269); + +var msg2933 = msg("1514:01", dup270); + +var select1406 = linear_select([ + msg2932, + msg2933, +]); + +var msg2934 = msg("1515", dup265); + +var msg2935 = msg("1515:01", dup266); + +var select1407 = linear_select([ + msg2934, + msg2935, +]); + +var msg2936 = msg("1516", dup269); + +var msg2937 = msg("1516:01", dup270); + +var select1408 = linear_select([ + msg2936, + msg2937, +]); + +var msg2938 = msg("1517", dup265); + +var msg2939 = msg("1517:01", dup266); + +var select1409 = linear_select([ + msg2938, + msg2939, +]); + +var msg2940 = msg("1518", dup265); + +var msg2941 = msg("1518:01", dup266); + +var select1410 = linear_select([ + msg2940, + msg2941, +]); + +var msg2942 = msg("1519", dup265); + +var msg2943 = msg("1519:01", dup266); + +var select1411 = linear_select([ + msg2942, + msg2943, +]); + +var msg2944 = msg("1520", dup265); + +var msg2945 = msg("1520:01", dup266); + +var select1412 = linear_select([ + msg2944, + msg2945, +]); + +var msg2946 = msg("1521", dup265); + +var msg2947 = msg("1521:01", dup266); + +var select1413 = linear_select([ + msg2946, + msg2947, +]); + +var msg2948 = msg("1522", dup265); + +var msg2949 = msg("1522:01", dup266); + +var select1414 = linear_select([ + msg2948, + msg2949, +]); + +var msg2950 = msg("1523", dup265); + +var msg2951 = msg("1523:01", dup266); + +var select1415 = linear_select([ + msg2950, + msg2951, +]); + +var msg2952 = msg("1524", dup265); + +var msg2953 = msg("1524:01", dup266); + +var select1416 = linear_select([ + msg2952, + msg2953, +]); + +var msg2954 = msg("1525", dup265); + +var msg2955 = msg("1525:01", dup266); + +var select1417 = linear_select([ + msg2954, + msg2955, +]); + +var msg2956 = msg("1526", dup265); + +var msg2957 = msg("1526:01", dup266); + +var select1418 = linear_select([ + msg2956, + msg2957, +]); + +var msg2958 = msg("1527", dup240); + +var msg2959 = msg("1527:01", dup241); + +var select1419 = linear_select([ + msg2958, + msg2959, +]); + +var msg2960 = msg("1528", dup265); + +var msg2961 = msg("1528:01", dup266); + +var select1420 = linear_select([ + msg2960, + msg2961, +]); + +var msg2962 = msg("1529", dup222); + +var msg2963 = msg("1529:01", dup223); + +var select1421 = linear_select([ + msg2962, + msg2963, +]); + +var msg2964 = msg("1530", dup227); + +var msg2965 = msg("1530:01", dup228); + +var select1422 = linear_select([ + msg2964, + msg2965, +]); + +var msg2966 = msg("1531", dup265); + +var msg2967 = msg("1531:01", dup266); + +var select1423 = linear_select([ + msg2966, + msg2967, +]); + +var msg2968 = msg("1532", dup265); + +var msg2969 = msg("1532:01", dup266); + +var select1424 = linear_select([ + msg2968, + msg2969, +]); + +var msg2970 = msg("1533", dup265); + +var msg2971 = msg("1533:01", dup266); + +var select1425 = linear_select([ + msg2970, + msg2971, +]); + +var msg2972 = msg("1534", dup265); + +var msg2973 = msg("1534:01", dup266); + +var select1426 = linear_select([ + msg2972, + msg2973, +]); + +var msg2974 = msg("1535", dup265); + +var msg2975 = msg("1535:01", dup266); + +var select1427 = linear_select([ + msg2974, + msg2975, +]); + +var msg2976 = msg("1536", dup269); + +var msg2977 = msg("1536:01", dup270); + +var select1428 = linear_select([ + msg2976, + msg2977, +]); + +var msg2978 = msg("1537", dup265); + +var msg2979 = msg("1537:01", dup266); + +var select1429 = linear_select([ + msg2978, + msg2979, +]); + +var msg2980 = msg("1538", dup222); + +var msg2981 = msg("1538:01", dup223); + +var select1430 = linear_select([ + msg2980, + msg2981, +]); + +var msg2982 = msg("1539", dup265); + +var msg2983 = msg("1539:01", dup266); + +var select1431 = linear_select([ + msg2982, + msg2983, +]); + +var msg2984 = msg("1540", dup265); + +var msg2985 = msg("1540:01", dup266); + +var select1432 = linear_select([ + msg2984, + msg2985, +]); + +var msg2986 = msg("1541", dup225); + +var msg2987 = msg("1541:01", dup226); + +var select1433 = linear_select([ + msg2986, + msg2987, +]); + +var msg2988 = msg("1542", dup265); + +var msg2989 = msg("1542:01", dup266); + +var select1434 = linear_select([ + msg2988, + msg2989, +]); + +var msg2990 = msg("1543", dup265); + +var msg2991 = msg("1543:01", dup266); + +var select1435 = linear_select([ + msg2990, + msg2991, +]); + +var msg2992 = msg("1544", dup267); + +var msg2993 = msg("1544:01", dup268); + +var select1436 = linear_select([ + msg2992, + msg2993, +]); + +var msg2994 = msg("1545", dup198); + +var msg2995 = msg("1545:01", dup220); + +var select1437 = linear_select([ + msg2994, + msg2995, +]); + +var msg2996 = msg("1546", dup198); + +var msg2997 = msg("1546:01", dup220); + +var select1438 = linear_select([ + msg2996, + msg2997, +]); + +var msg2998 = msg("1547", dup269); + +var msg2999 = msg("1547:01", dup270); + +var select1439 = linear_select([ + msg2998, + msg2999, +]); + +var msg3000 = msg("1548", dup265); + +var msg3001 = msg("1548:01", dup266); + +var select1440 = linear_select([ + msg3000, + msg3001, +]); + +var msg3002 = msg("1549", dup222); + +var msg3003 = msg("1549:01", dup223); + +var select1441 = linear_select([ + msg3002, + msg3003, +]); + +var msg3004 = msg("1550", dup222); + +var msg3005 = msg("1550:01", dup223); + +var select1442 = linear_select([ + msg3004, + msg3005, +]); + +var msg3006 = msg("1551", dup265); + +var msg3007 = msg("1551:01", dup266); + +var select1443 = linear_select([ + msg3006, + msg3007, +]); + +var msg3008 = msg("1552", dup265); + +var msg3009 = msg("1552:01", dup266); + +var select1444 = linear_select([ + msg3008, + msg3009, +]); + +var msg3010 = msg("1553", dup265); + +var msg3011 = msg("1553:01", dup266); + +var select1445 = linear_select([ + msg3010, + msg3011, +]); + +var msg3012 = msg("1554", dup265); + +var msg3013 = msg("1554:01", dup266); + +var select1446 = linear_select([ + msg3012, + msg3013, +]); + +var msg3014 = msg("1555", dup265); + +var msg3015 = msg("1555:01", dup266); + +var select1447 = linear_select([ + msg3014, + msg3015, +]); + +var msg3016 = msg("1556", dup265); + +var msg3017 = msg("1556:01", dup266); + +var select1448 = linear_select([ + msg3016, + msg3017, +]); + +var msg3018 = msg("1557", dup265); + +var msg3019 = msg("1557:01", dup266); + +var select1449 = linear_select([ + msg3018, + msg3019, +]); + +var msg3020 = msg("1558", dup267); + +var msg3021 = msg("1558:01", dup268); + +var select1450 = linear_select([ + msg3020, + msg3021, +]); + +var msg3022 = msg("1559", dup265); + +var msg3023 = msg("1559:01", dup266); + +var select1451 = linear_select([ + msg3022, + msg3023, +]); + +var msg3024 = msg("1560", dup265); + +var msg3025 = msg("1560:01", dup266); + +var select1452 = linear_select([ + msg3024, + msg3025, +]); + +var msg3026 = msg("1561", dup265); + +var msg3027 = msg("1561:01", dup266); + +var select1453 = linear_select([ + msg3026, + msg3027, +]); + +var msg3028 = msg("1562", dup222); + +var msg3029 = msg("1562:01", dup223); + +var select1454 = linear_select([ + msg3028, + msg3029, +]); + +var msg3030 = msg("1563", dup265); + +var msg3031 = msg("1563:01", dup266); + +var select1455 = linear_select([ + msg3030, + msg3031, +]); + +var msg3032 = msg("1564", dup265); + +var msg3033 = msg("1564:01", dup266); + +var select1456 = linear_select([ + msg3032, + msg3033, +]); + +var msg3034 = msg("1565", dup269); + +var msg3035 = msg("1565:01", dup270); + +var select1457 = linear_select([ + msg3034, + msg3035, +]); + +var msg3036 = msg("1566", dup265); + +var msg3037 = msg("1566:01", dup266); + +var select1458 = linear_select([ + msg3036, + msg3037, +]); + +var msg3038 = msg("1567", dup265); + +var msg3039 = msg("1567:01", dup266); + +var select1459 = linear_select([ + msg3038, + msg3039, +]); + +var msg3040 = msg("1568", dup265); + +var msg3041 = msg("1568:01", dup266); + +var select1460 = linear_select([ + msg3040, + msg3041, +]); + +var msg3042 = msg("1569", dup265); + +var msg3043 = msg("1569:01", dup266); + +var select1461 = linear_select([ + msg3042, + msg3043, +]); + +var msg3044 = msg("1570", dup265); + +var msg3045 = msg("1570:01", dup266); + +var select1462 = linear_select([ + msg3044, + msg3045, +]); + +var msg3046 = msg("1571", dup265); + +var msg3047 = msg("1571:01", dup266); + +var select1463 = linear_select([ + msg3046, + msg3047, +]); + +var msg3048 = msg("1572", dup265); + +var msg3049 = msg("1572:01", dup266); + +var select1464 = linear_select([ + msg3048, + msg3049, +]); + +var msg3050 = msg("1573", dup265); + +var msg3051 = msg("1573:01", dup266); + +var select1465 = linear_select([ + msg3050, + msg3051, +]); + +var msg3052 = msg("1574", dup265); + +var msg3053 = msg("1574:01", dup266); + +var select1466 = linear_select([ + msg3052, + msg3053, +]); + +var msg3054 = msg("1575", dup265); + +var msg3055 = msg("1575:01", dup266); + +var select1467 = linear_select([ + msg3054, + msg3055, +]); + +var msg3056 = msg("1576", dup265); + +var msg3057 = msg("1576:01", dup266); + +var select1468 = linear_select([ + msg3056, + msg3057, +]); + +var msg3058 = msg("1577", dup265); + +var msg3059 = msg("1577:01", dup266); + +var select1469 = linear_select([ + msg3058, + msg3059, +]); + +var msg3060 = msg("1578", dup265); + +var msg3061 = msg("1578:01", dup266); + +var select1470 = linear_select([ + msg3060, + msg3061, +]); + +var msg3062 = msg("1579", dup265); + +var msg3063 = msg("1579:01", dup266); + +var select1471 = linear_select([ + msg3062, + msg3063, +]); + +var msg3064 = msg("1580", dup265); + +var msg3065 = msg("1580:01", dup266); + +var select1472 = linear_select([ + msg3064, + msg3065, +]); + +var msg3066 = msg("1581", dup265); + +var msg3067 = msg("1581:01", dup266); + +var select1473 = linear_select([ + msg3066, + msg3067, +]); + +var msg3068 = msg("1582", dup265); + +var msg3069 = msg("1582:01", dup266); + +var select1474 = linear_select([ + msg3068, + msg3069, +]); + +var msg3070 = msg("1583", dup265); + +var msg3071 = msg("1583:01", dup266); + +var select1475 = linear_select([ + msg3070, + msg3071, +]); + +var msg3072 = msg("1584", dup265); + +var msg3073 = msg("1584:01", dup266); + +var select1476 = linear_select([ + msg3072, + msg3073, +]); + +var msg3074 = msg("1585", dup265); + +var msg3075 = msg("1585:01", dup266); + +var select1477 = linear_select([ + msg3074, + msg3075, +]); + +var msg3076 = msg("1586", dup265); + +var msg3077 = msg("1586:01", dup266); + +var select1478 = linear_select([ + msg3076, + msg3077, +]); + +var msg3078 = msg("1587", dup265); + +var msg3079 = msg("1587:01", dup266); + +var select1479 = linear_select([ + msg3078, + msg3079, +]); + +var msg3080 = msg("1588", dup265); + +var msg3081 = msg("1588:01", dup266); + +var select1480 = linear_select([ + msg3080, + msg3081, +]); + +var msg3082 = msg("1589", dup265); + +var msg3083 = msg("1589:01", dup266); + +var select1481 = linear_select([ + msg3082, + msg3083, +]); + +var msg3084 = msg("1590", dup265); + +var msg3085 = msg("1590:01", dup266); + +var select1482 = linear_select([ + msg3084, + msg3085, +]); + +var msg3086 = msg("1591", dup265); + +var msg3087 = msg("1591:01", dup266); + +var select1483 = linear_select([ + msg3086, + msg3087, +]); + +var msg3088 = msg("1592", dup265); + +var msg3089 = msg("1592:01", dup266); + +var select1484 = linear_select([ + msg3088, + msg3089, +]); + +var msg3090 = msg("1593", dup265); + +var msg3091 = msg("1593:01", dup266); + +var select1485 = linear_select([ + msg3090, + msg3091, +]); + +var msg3092 = msg("1594", dup265); + +var msg3093 = msg("1594:01", dup266); + +var select1486 = linear_select([ + msg3092, + msg3093, +]); + +var msg3094 = msg("1595", dup265); + +var msg3095 = msg("1595:01", dup266); + +var select1487 = linear_select([ + msg3094, + msg3095, +]); + +var msg3096 = msg("1597", dup265); + +var msg3097 = msg("1597:01", dup266); + +var select1488 = linear_select([ + msg3096, + msg3097, +]); + +var msg3098 = msg("1598", dup265); + +var msg3099 = msg("1598:01", dup266); + +var select1489 = linear_select([ + msg3098, + msg3099, +]); + +var msg3100 = msg("1599", dup265); + +var msg3101 = msg("1599:01", dup266); + +var select1490 = linear_select([ + msg3100, + msg3101, +]); + +var msg3102 = msg("1600", dup265); + +var msg3103 = msg("1600:01", dup266); + +var select1491 = linear_select([ + msg3102, + msg3103, +]); + +var msg3104 = msg("1601", dup265); + +var msg3105 = msg("1601:01", dup266); + +var select1492 = linear_select([ + msg3104, + msg3105, +]); + +var msg3106 = msg("1602", dup265); + +var msg3107 = msg("1602:01", dup266); + +var select1493 = linear_select([ + msg3106, + msg3107, +]); + +var msg3108 = msg("1603", dup265); + +var msg3109 = msg("1603:01", dup266); + +var select1494 = linear_select([ + msg3108, + msg3109, +]); + +var msg3110 = msg("1604", dup265); + +var msg3111 = msg("1604:01", dup266); + +var select1495 = linear_select([ + msg3110, + msg3111, +]); + +var msg3112 = msg("1605", dup198); + +var msg3113 = msg("1605:01", dup220); + +var select1496 = linear_select([ + msg3112, + msg3113, +]); + +var msg3114 = msg("1606", dup265); + +var msg3115 = msg("1606:01", dup266); + +var select1497 = linear_select([ + msg3114, + msg3115, +]); + +var msg3116 = msg("1607", dup265); + +var msg3117 = msg("1607:01", dup266); + +var select1498 = linear_select([ + msg3116, + msg3117, +]); + +var msg3118 = msg("1608", dup265); + +var msg3119 = msg("1608:01", dup266); + +var select1499 = linear_select([ + msg3118, + msg3119, +]); + +var msg3120 = msg("1609", dup265); + +var msg3121 = msg("1609:01", dup266); + +var select1500 = linear_select([ + msg3120, + msg3121, +]); + +var msg3122 = msg("1610", dup269); + +var msg3123 = msg("1610:01", dup270); + +var select1501 = linear_select([ + msg3122, + msg3123, +]); + +var msg3124 = msg("1611", dup265); + +var msg3125 = msg("1611:01", dup266); + +var select1502 = linear_select([ + msg3124, + msg3125, +]); + +var msg3126 = msg("1612", dup265); + +var msg3127 = msg("1612:01", dup266); + +var select1503 = linear_select([ + msg3126, + msg3127, +]); + +var msg3128 = msg("1613", dup265); + +var msg3129 = msg("1613:01", dup266); + +var select1504 = linear_select([ + msg3128, + msg3129, +]); + +var msg3130 = msg("1614", dup265); + +var msg3131 = msg("1614:01", dup266); + +var select1505 = linear_select([ + msg3130, + msg3131, +]); + +var msg3132 = msg("1615", dup265); + +var msg3133 = msg("1615:01", dup266); + +var select1506 = linear_select([ + msg3132, + msg3133, +]); + +var msg3134 = msg("1616", dup196); + +var msg3135 = msg("1616:01", dup217); + +var select1507 = linear_select([ + msg3134, + msg3135, +]); + +var msg3136 = msg("1617", dup265); + +var msg3137 = msg("1617:01", dup266); + +var select1508 = linear_select([ + msg3136, + msg3137, +]); + +var msg3138 = msg("1618", dup196); + +var msg3139 = msg("1618:01", dup217); + +var select1509 = linear_select([ + msg3138, + msg3139, +]); + +var msg3140 = msg("1619", dup265); + +var msg3141 = msg("1619:01", dup266); + +var select1510 = linear_select([ + msg3140, + msg3141, +]); + +var msg3142 = msg("1620", dup196); + +var msg3143 = msg("1620:01", dup217); + +var select1511 = linear_select([ + msg3142, + msg3143, +]); + +var msg3144 = msg("1621", dup222); + +var msg3145 = msg("1621:01", dup223); + +var select1512 = linear_select([ + msg3144, + msg3145, +]); + +var msg3146 = msg("1622", dup227); + +var msg3147 = msg("1622:01", dup228); + +var select1513 = linear_select([ + msg3146, + msg3147, +]); + +var msg3148 = msg("1623", dup227); + +var msg3149 = msg("1623:01", dup228); + +var select1514 = linear_select([ + msg3148, + msg3149, +]); + +var msg3150 = msg("1624", dup222); + +var msg3151 = msg("1624:01", dup223); + +var select1515 = linear_select([ + msg3150, + msg3151, +]); + +var msg3152 = msg("1625", dup222); + +var msg3153 = msg("1625:01", dup223); + +var select1516 = linear_select([ + msg3152, + msg3153, +]); + +var msg3154 = msg("1626", dup265); + +var msg3155 = msg("1626:01", dup266); + +var select1517 = linear_select([ + msg3154, + msg3155, +]); + +var msg3156 = msg("1627", dup196); + +var msg3157 = msg("1627:01", dup217); + +var select1518 = linear_select([ + msg3156, + msg3157, +]); + +var msg3158 = msg("1628", dup265); + +var msg3159 = msg("1628:01", dup266); + +var select1519 = linear_select([ + msg3158, + msg3159, +]); + +var msg3160 = msg("1629", dup196); + +var msg3161 = msg("1629:01", dup217); + +var select1520 = linear_select([ + msg3160, + msg3161, +]); + +var msg3162 = msg("1630", dup227); + +var msg3163 = msg("1630:01", dup228); + +var select1521 = linear_select([ + msg3162, + msg3163, +]); + +var msg3164 = msg("1631", dup196); + +var msg3165 = msg("1631:01", dup217); + +var select1522 = linear_select([ + msg3164, + msg3165, +]); + +var msg3166 = msg("1632", dup196); + +var msg3167 = msg("1632:01", dup217); + +var select1523 = linear_select([ + msg3166, + msg3167, +]); + +var msg3168 = msg("1633", dup196); + +var msg3169 = msg("1633:01", dup217); + +var select1524 = linear_select([ + msg3168, + msg3169, +]); + +var msg3170 = msg("1634", dup222); + +var msg3171 = msg("1634:01", dup223); + +var select1525 = linear_select([ + msg3170, + msg3171, +]); + +var msg3172 = msg("1635", dup222); + +var msg3173 = msg("1635:01", dup223); + +var select1526 = linear_select([ + msg3172, + msg3173, +]); + +var msg3174 = msg("1636", dup222); + +var msg3175 = msg("1636:01", dup223); + +var select1527 = linear_select([ + msg3174, + msg3175, +]); + +var msg3176 = msg("1637", dup265); + +var msg3177 = msg("1637:01", dup266); + +var select1528 = linear_select([ + msg3176, + msg3177, +]); + +var msg3178 = msg("1638", dup194); + +var msg3179 = msg("1638:01", dup229); + +var select1529 = linear_select([ + msg3178, + msg3179, +]); + +var msg3180 = msg("1639", dup196); + +var msg3181 = msg("1639:01", dup217); + +var select1530 = linear_select([ + msg3180, + msg3181, +]); + +var msg3182 = msg("1640", dup196); + +var msg3183 = msg("1640:01", dup217); + +var select1531 = linear_select([ + msg3182, + msg3183, +]); + +var msg3184 = msg("1641", dup198); + +var msg3185 = msg("1641:01", dup220); + +var select1532 = linear_select([ + msg3184, + msg3185, +]); + +var msg3186 = msg("1642", dup265); + +var msg3187 = msg("1642:01", dup266); + +var select1533 = linear_select([ + msg3186, + msg3187, +]); + +var msg3188 = msg("1643", dup265); + +var msg3189 = msg("1643:01", dup266); + +var select1534 = linear_select([ + msg3188, + msg3189, +]); + +var msg3190 = msg("1644", dup265); + +var msg3191 = msg("1644:01", dup266); + +var select1535 = linear_select([ + msg3190, + msg3191, +]); + +var msg3192 = msg("1645", dup265); + +var msg3193 = msg("1645:01", dup266); + +var select1536 = linear_select([ + msg3192, + msg3193, +]); + +var msg3194 = msg("1646", dup265); + +var msg3195 = msg("1646:01", dup266); + +var select1537 = linear_select([ + msg3194, + msg3195, +]); + +var msg3196 = msg("1647", dup265); + +var msg3197 = msg("1647:01", dup266); + +var select1538 = linear_select([ + msg3196, + msg3197, +]); + +var msg3198 = msg("1648", dup265); + +var msg3199 = msg("1648:01", dup266); + +var select1539 = linear_select([ + msg3198, + msg3199, +]); + +var msg3200 = msg("1649", dup265); + +var msg3201 = msg("1649:01", dup266); + +var select1540 = linear_select([ + msg3200, + msg3201, +]); + +var msg3202 = msg("1650", dup265); + +var msg3203 = msg("1650:01", dup266); + +var select1541 = linear_select([ + msg3202, + msg3203, +]); + +var msg3204 = msg("1651", dup265); + +var msg3205 = msg("1651:01", dup266); + +var select1542 = linear_select([ + msg3204, + msg3205, +]); + +var msg3206 = msg("1652", dup265); + +var msg3207 = msg("1652:01", dup266); + +var select1543 = linear_select([ + msg3206, + msg3207, +]); + +var msg3208 = msg("1653", dup265); + +var msg3209 = msg("1653:01", dup266); + +var select1544 = linear_select([ + msg3208, + msg3209, +]); + +var msg3210 = msg("1654", dup265); + +var msg3211 = msg("1654:01", dup266); + +var select1545 = linear_select([ + msg3210, + msg3211, +]); + +var msg3212 = msg("1655", dup269); + +var msg3213 = msg("1655:01", dup270); + +var select1546 = linear_select([ + msg3212, + msg3213, +]); + +var msg3214 = msg("1656", dup265); + +var msg3215 = msg("1656:01", dup266); + +var select1547 = linear_select([ + msg3214, + msg3215, +]); + +var msg3216 = msg("1657", dup265); + +var msg3217 = msg("1657:01", dup266); + +var select1548 = linear_select([ + msg3216, + msg3217, +]); + +var msg3218 = msg("1658", dup265); + +var msg3219 = msg("1658:01", dup266); + +var select1549 = linear_select([ + msg3218, + msg3219, +]); + +var msg3220 = msg("1659", dup265); + +var msg3221 = msg("1659:01", dup266); + +var select1550 = linear_select([ + msg3220, + msg3221, +]); + +var msg3222 = msg("1660", dup265); + +var msg3223 = msg("1660:01", dup266); + +var select1551 = linear_select([ + msg3222, + msg3223, +]); + +var msg3224 = msg("1661", dup265); + +var msg3225 = msg("1661:01", dup266); + +var select1552 = linear_select([ + msg3224, + msg3225, +]); + +var msg3226 = msg("1662", dup265); + +var msg3227 = msg("1662:01", dup266); + +var select1553 = linear_select([ + msg3226, + msg3227, +]); + +var msg3228 = msg("1663", dup265); + +var msg3229 = msg("1663:01", dup266); + +var select1554 = linear_select([ + msg3228, + msg3229, +]); + +var msg3230 = msg("1664", dup265); + +var msg3231 = msg("1664:01", dup266); + +var select1555 = linear_select([ + msg3230, + msg3231, +]); + +var msg3232 = msg("1665", dup265); + +var msg3233 = msg("1665:01", dup266); + +var select1556 = linear_select([ + msg3232, + msg3233, +]); + +var msg3234 = msg("1666", dup196); + +var msg3235 = msg("1666:01", dup217); + +var select1557 = linear_select([ + msg3234, + msg3235, +]); + +var msg3236 = msg("1667", dup265); + +var msg3237 = msg("1667:01", dup266); + +var select1558 = linear_select([ + msg3236, + msg3237, +]); + +var msg3238 = msg("1668", dup265); + +var msg3239 = msg("1668:01", dup266); + +var select1559 = linear_select([ + msg3238, + msg3239, +]); + +var msg3240 = msg("1669", dup198); + +var msg3241 = msg("1669:01", dup220); + +var select1560 = linear_select([ + msg3240, + msg3241, +]); + +var msg3242 = msg("1670", dup265); + +var msg3243 = msg("1670:01", dup266); + +var select1561 = linear_select([ + msg3242, + msg3243, +]); + +var msg3244 = msg("1671", dup265); + +var msg3245 = msg("1671:01", dup266); + +var select1562 = linear_select([ + msg3244, + msg3245, +]); + +var msg3246 = msg("1672", dup227); + +var msg3247 = msg("1672:01", dup228); + +var select1563 = linear_select([ + msg3246, + msg3247, +]); + +var msg3248 = msg("1673", dup196); + +var msg3249 = msg("1673:01", dup217); + +var select1564 = linear_select([ + msg3248, + msg3249, +]); + +var msg3250 = msg("1674", dup196); + +var msg3251 = msg("1674:01", dup217); + +var select1565 = linear_select([ + msg3250, + msg3251, +]); + +var msg3252 = msg("1675", dup196); + +var msg3253 = msg("1675:01", dup217); + +var select1566 = linear_select([ + msg3252, + msg3253, +]); + +var msg3254 = msg("1676", dup196); + +var msg3255 = msg("1676:01", dup217); + +var select1567 = linear_select([ + msg3254, + msg3255, +]); + +var msg3256 = msg("1677", dup196); + +var msg3257 = msg("1677:01", dup217); + +var select1568 = linear_select([ + msg3256, + msg3257, +]); + +var msg3258 = msg("1678", dup196); + +var msg3259 = msg("1678:01", dup217); + +var select1569 = linear_select([ + msg3258, + msg3259, +]); + +var msg3260 = msg("1679", dup196); + +var msg3261 = msg("1679:01", dup217); + +var select1570 = linear_select([ + msg3260, + msg3261, +]); + +var msg3262 = msg("1680", dup196); + +var msg3263 = msg("1680:01", dup217); + +var select1571 = linear_select([ + msg3262, + msg3263, +]); + +var msg3264 = msg("1681", dup196); + +var msg3265 = msg("1681:01", dup217); + +var select1572 = linear_select([ + msg3264, + msg3265, +]); + +var msg3266 = msg("1682", dup196); + +var msg3267 = msg("1682:01", dup217); + +var select1573 = linear_select([ + msg3266, + msg3267, +]); + +var msg3268 = msg("1683", dup196); + +var msg3269 = msg("1683:01", dup217); + +var select1574 = linear_select([ + msg3268, + msg3269, +]); + +var msg3270 = msg("1684", dup196); + +var msg3271 = msg("1684:01", dup217); + +var select1575 = linear_select([ + msg3270, + msg3271, +]); + +var msg3272 = msg("1685", dup196); + +var msg3273 = msg("1685:01", dup217); + +var select1576 = linear_select([ + msg3272, + msg3273, +]); + +var msg3274 = msg("1686", dup196); + +var msg3275 = msg("1686:01", dup217); + +var select1577 = linear_select([ + msg3274, + msg3275, +]); + +var msg3276 = msg("1687", dup196); + +var msg3277 = msg("1687:01", dup217); + +var select1578 = linear_select([ + msg3276, + msg3277, +]); + +var msg3278 = msg("1688", dup196); + +var msg3279 = msg("1688:01", dup217); + +var select1579 = linear_select([ + msg3278, + msg3279, +]); + +var msg3280 = msg("1689", dup196); + +var msg3281 = msg("1689:01", dup217); + +var select1580 = linear_select([ + msg3280, + msg3281, +]); + +var msg3282 = msg("1690", dup196); + +var msg3283 = msg("1690:01", dup217); + +var select1581 = linear_select([ + msg3282, + msg3283, +]); + +var msg3284 = msg("1691", dup196); + +var msg3285 = msg("1691:01", dup217); + +var select1582 = linear_select([ + msg3284, + msg3285, +]); + +var msg3286 = msg("1692", dup196); + +var msg3287 = msg("1692:01", dup217); + +var select1583 = linear_select([ + msg3286, + msg3287, +]); + +var msg3288 = msg("1693", dup196); + +var msg3289 = msg("1693:01", dup217); + +var select1584 = linear_select([ + msg3288, + msg3289, +]); + +var msg3290 = msg("1694", dup196); + +var msg3291 = msg("1694:01", dup217); + +var select1585 = linear_select([ + msg3290, + msg3291, +]); + +var msg3292 = msg("1695", dup196); + +var msg3293 = msg("1695:01", dup217); + +var select1586 = linear_select([ + msg3292, + msg3293, +]); + +var msg3294 = msg("1696", dup196); + +var msg3295 = msg("1696:01", dup217); + +var select1587 = linear_select([ + msg3294, + msg3295, +]); + +var msg3296 = msg("1697", dup196); + +var msg3297 = msg("1697:01", dup217); + +var select1588 = linear_select([ + msg3296, + msg3297, +]); + +var msg3298 = msg("1698", dup196); + +var msg3299 = msg("1698:01", dup217); + +var select1589 = linear_select([ + msg3298, + msg3299, +]); + +var msg3300 = msg("1699", dup196); + +var msg3301 = msg("1699:01", dup217); + +var select1590 = linear_select([ + msg3300, + msg3301, +]); + +var msg3302 = msg("1700", dup265); + +var msg3303 = msg("1700:01", dup266); + +var select1591 = linear_select([ + msg3302, + msg3303, +]); + +var msg3304 = msg("1701", dup265); + +var msg3305 = msg("1701:01", dup266); + +var select1592 = linear_select([ + msg3304, + msg3305, +]); + +var msg3306 = msg("1702", dup265); + +var msg3307 = msg("1702:01", dup266); + +var select1593 = linear_select([ + msg3306, + msg3307, +]); + +var msg3308 = msg("1703", dup265); + +var msg3309 = msg("1703:01", dup266); + +var select1594 = linear_select([ + msg3308, + msg3309, +]); + +var msg3310 = msg("1704", dup265); + +var msg3311 = msg("1704:01", dup266); + +var select1595 = linear_select([ + msg3310, + msg3311, +]); + +var msg3312 = msg("1705", dup269); + +var msg3313 = msg("1705:01", dup270); + +var select1596 = linear_select([ + msg3312, + msg3313, +]); + +var msg3314 = msg("1706", dup265); + +var msg3315 = msg("1706:01", dup266); + +var select1597 = linear_select([ + msg3314, + msg3315, +]); + +var msg3316 = msg("1707", dup269); + +var msg3317 = msg("1707:01", dup270); + +var select1598 = linear_select([ + msg3316, + msg3317, +]); + +var msg3318 = msg("1708", dup265); + +var msg3319 = msg("1708:01", dup266); + +var select1599 = linear_select([ + msg3318, + msg3319, +]); + +var msg3320 = msg("1709", dup265); + +var msg3321 = msg("1709:01", dup266); + +var select1600 = linear_select([ + msg3320, + msg3321, +]); + +var msg3322 = msg("1710", dup265); + +var msg3323 = msg("1710:01", dup266); + +var select1601 = linear_select([ + msg3322, + msg3323, +]); + +var msg3324 = msg("1711", dup265); + +var msg3325 = msg("1711:01", dup266); + +var select1602 = linear_select([ + msg3324, + msg3325, +]); + +var msg3326 = msg("1712", dup265); + +var msg3327 = msg("1712:01", dup266); + +var select1603 = linear_select([ + msg3326, + msg3327, +]); + +var msg3328 = msg("1713", dup265); + +var msg3329 = msg("1713:01", dup266); + +var select1604 = linear_select([ + msg3328, + msg3329, +]); + +var msg3330 = msg("1714", dup265); + +var msg3331 = msg("1714:01", dup266); + +var select1605 = linear_select([ + msg3330, + msg3331, +]); + +var msg3332 = msg("1715", dup265); + +var msg3333 = msg("1715:01", dup266); + +var select1606 = linear_select([ + msg3332, + msg3333, +]); + +var msg3334 = msg("1716", dup265); + +var msg3335 = msg("1716:01", dup266); + +var select1607 = linear_select([ + msg3334, + msg3335, +]); + +var msg3336 = msg("1717", dup265); + +var msg3337 = msg("1717:01", dup266); + +var select1608 = linear_select([ + msg3336, + msg3337, +]); + +var msg3338 = msg("1718", dup265); + +var msg3339 = msg("1718:01", dup266); + +var select1609 = linear_select([ + msg3338, + msg3339, +]); + +var msg3340 = msg("1719", dup265); + +var msg3341 = msg("1719:01", dup266); + +var select1610 = linear_select([ + msg3340, + msg3341, +]); + +var msg3342 = msg("1720", dup265); + +var msg3343 = msg("1720:01", dup266); + +var select1611 = linear_select([ + msg3342, + msg3343, +]); + +var msg3344 = msg("1721", dup265); + +var msg3345 = msg("1721:01", dup266); + +var select1612 = linear_select([ + msg3344, + msg3345, +]); + +var msg3346 = msg("1722", dup265); + +var msg3347 = msg("1722:01", dup266); + +var select1613 = linear_select([ + msg3346, + msg3347, +]); + +var msg3348 = msg("1723", dup265); + +var msg3349 = msg("1723:01", dup266); + +var select1614 = linear_select([ + msg3348, + msg3349, +]); + +var msg3350 = msg("1724", dup265); + +var msg3351 = msg("1724:01", dup266); + +var select1615 = linear_select([ + msg3350, + msg3351, +]); + +var msg3352 = msg("1725", dup265); + +var msg3353 = msg("1725:01", dup266); + +var select1616 = linear_select([ + msg3352, + msg3353, +]); + +var msg3354 = msg("1726", dup265); + +var msg3355 = msg("1726:01", dup266); + +var select1617 = linear_select([ + msg3354, + msg3355, +]); + +var msg3356 = msg("1727", dup265); + +var msg3357 = msg("1727:01", dup266); + +var select1618 = linear_select([ + msg3356, + msg3357, +]); + +var msg3358 = msg("1728", dup227); + +var msg3359 = msg("1728:01", dup228); + +var select1619 = linear_select([ + msg3358, + msg3359, +]); + +var msg3360 = msg("1729", dup196); + +var msg3361 = msg("1729:01", dup217); + +var select1620 = linear_select([ + msg3360, + msg3361, +]); + +var msg3362 = msg("1730", dup265); + +var msg3363 = msg("1730:01", dup266); + +var select1621 = linear_select([ + msg3362, + msg3363, +]); + +var msg3364 = msg("1731", dup265); + +var msg3365 = msg("1731:01", dup266); + +var select1622 = linear_select([ + msg3364, + msg3365, +]); + +var msg3366 = msg("1732", dup255); + +var msg3367 = msg("1732:01", dup256); + +var select1623 = linear_select([ + msg3366, + msg3367, +]); + +var msg3368 = msg("1733", dup258); + +var msg3369 = msg("1733:01", dup259); + +var select1624 = linear_select([ + msg3368, + msg3369, +]); + +var msg3370 = msg("1734", dup222); + +var msg3371 = msg("1734:01", dup223); + +var select1625 = linear_select([ + msg3370, + msg3371, +]); + +var msg3372 = msg("1735", dup265); + +var msg3373 = msg("1735:01", dup266); + +var select1626 = linear_select([ + msg3372, + msg3373, +]); + +var msg3374 = msg("1736", dup265); + +var msg3375 = msg("1736:01", dup266); + +var select1627 = linear_select([ + msg3374, + msg3375, +]); + +var msg3376 = msg("1737", dup265); + +var msg3377 = msg("1737:01", dup266); + +var select1628 = linear_select([ + msg3376, + msg3377, +]); + +var msg3378 = msg("1738", dup265); + +var msg3379 = msg("1738:01", dup266); + +var select1629 = linear_select([ + msg3378, + msg3379, +]); + +var msg3380 = msg("1739", dup285); + +var msg3381 = msg("1739:01", dup286); + +var select1630 = linear_select([ + msg3380, + msg3381, +]); + +var msg3382 = msg("1740", dup285); + +var msg3383 = msg("1740:01", dup286); + +var select1631 = linear_select([ + msg3382, + msg3383, +]); + +var msg3384 = msg("1741", dup265); + +var msg3385 = msg("1741:01", dup266); + +var select1632 = linear_select([ + msg3384, + msg3385, +]); + +var msg3386 = msg("1742", dup198); + +var msg3387 = msg("1742:01", dup220); + +var select1633 = linear_select([ + msg3386, + msg3387, +]); + +var msg3388 = msg("1743", dup198); + +var msg3389 = msg("1743:01", dup220); + +var select1634 = linear_select([ + msg3388, + msg3389, +]); + +var msg3390 = msg("1744", dup285); + +var msg3391 = msg("1744:01", dup286); + +var select1635 = linear_select([ + msg3390, + msg3391, +]); + +var msg3392 = msg("1745", dup265); + +var msg3393 = msg("1745:01", dup266); + +var select1636 = linear_select([ + msg3392, + msg3393, +]); + +var msg3394 = msg("1746", dup255); + +var msg3395 = msg("1746:01", dup256); + +var select1637 = linear_select([ + msg3394, + msg3395, +]); + +var msg3396 = msg("1747", dup258); + +var msg3397 = msg("1747:01", dup259); + +var select1638 = linear_select([ + msg3396, + msg3397, +]); + +var msg3398 = msg("1748", dup222); + +var msg3399 = msg("1748:01", dup223); + +var select1639 = linear_select([ + msg3398, + msg3399, +]); + +var msg3400 = msg("1749", dup265); + +var msg3401 = msg("1749:01", dup266); + +var select1640 = linear_select([ + msg3400, + msg3401, +]); + +var msg3402 = msg("1750", dup265); + +var msg3403 = msg("1750:01", dup266); + +var select1641 = linear_select([ + msg3402, + msg3403, +]); + +var msg3404 = msg("1751", dup222); + +var msg3405 = msg("1751:01", dup223); + +var select1642 = linear_select([ + msg3404, + msg3405, +]); + +var msg3406 = msg("1752", dup196); + +var msg3407 = msg("1752:01", dup217); + +var select1643 = linear_select([ + msg3406, + msg3407, +]); + +var msg3408 = msg("1753", dup265); + +var msg3409 = msg("1753:01", dup266); + +var select1644 = linear_select([ + msg3408, + msg3409, +]); + +var msg3410 = msg("1754", dup265); + +var msg3411 = msg("1754:01", dup266); + +var select1645 = linear_select([ + msg3410, + msg3411, +]); + +var msg3412 = msg("1755", dup222); + +var msg3413 = msg("1755:01", dup223); + +var select1646 = linear_select([ + msg3412, + msg3413, +]); + +var msg3414 = msg("1756", dup265); + +var msg3415 = msg("1756:01", dup266); + +var select1647 = linear_select([ + msg3414, + msg3415, +]); + +var msg3416 = msg("1757", dup269); + +var msg3417 = msg("1757:01", dup270); + +var select1648 = linear_select([ + msg3416, + msg3417, +]); + +var msg3418 = msg("1758", dup265); + +var msg3419 = msg("1758:01", dup266); + +var select1649 = linear_select([ + msg3418, + msg3419, +]); + +var msg3420 = msg("1759", dup260); + +var msg3421 = msg("1759:01", dup261); + +var select1650 = linear_select([ + msg3420, + msg3421, +]); + +var msg3422 = msg("1760", dup196); + +var msg3423 = msg("1760:01", dup217); + +var select1651 = linear_select([ + msg3422, + msg3423, +]); + +var msg3424 = msg("1761", dup196); + +var msg3425 = msg("1761:01", dup217); + +var select1652 = linear_select([ + msg3424, + msg3425, +]); + +var msg3426 = msg("1762", dup269); + +var msg3427 = msg("1762:01", dup270); + +var select1653 = linear_select([ + msg3426, + msg3427, +]); + +var msg3428 = msg("1763", dup198); + +var msg3429 = msg("1763:01", dup220); + +var select1654 = linear_select([ + msg3428, + msg3429, +]); + +var msg3430 = msg("1764", dup198); + +var msg3431 = msg("1764:01", dup220); + +var select1655 = linear_select([ + msg3430, + msg3431, +]); + +var msg3432 = msg("1765", dup265); + +var msg3433 = msg("1765:01", dup266); + +var select1656 = linear_select([ + msg3432, + msg3433, +]); + +var msg3434 = msg("1766", dup265); + +var msg3435 = msg("1766:01", dup266); + +var select1657 = linear_select([ + msg3434, + msg3435, +]); + +var msg3436 = msg("1767", dup265); + +var msg3437 = msg("1767:01", dup266); + +var select1658 = linear_select([ + msg3436, + msg3437, +]); + +var msg3438 = msg("1768", dup267); + +var msg3439 = msg("1768:01", dup268); + +var select1659 = linear_select([ + msg3438, + msg3439, +]); + +var msg3440 = msg("1769", dup265); + +var msg3441 = msg("1769:01", dup266); + +var select1660 = linear_select([ + msg3440, + msg3441, +]); + +var msg3442 = msg("1770", dup265); + +var msg3443 = msg("1770:01", dup266); + +var select1661 = linear_select([ + msg3442, + msg3443, +]); + +var msg3444 = msg("1771", dup287); + +var msg3445 = msg("1771:01", dup288); + +var select1662 = linear_select([ + msg3444, + msg3445, +]); + +var msg3446 = msg("1772", dup265); + +var msg3447 = msg("1772:01", dup266); + +var select1663 = linear_select([ + msg3446, + msg3447, +]); + +var msg3448 = msg("1773", dup265); + +var msg3449 = msg("1773:01", dup266); + +var select1664 = linear_select([ + msg3448, + msg3449, +]); + +var msg3450 = msg("1774", dup265); + +var msg3451 = msg("1774:01", dup266); + +var select1665 = linear_select([ + msg3450, + msg3451, +]); + +var msg3452 = msg("1775", dup240); + +var msg3453 = msg("1775:01", dup241); + +var select1666 = linear_select([ + msg3452, + msg3453, +]); + +var msg3454 = msg("1776", dup240); + +var msg3455 = msg("1776:01", dup241); + +var select1667 = linear_select([ + msg3454, + msg3455, +]); + +var msg3456 = msg("1777", dup198); + +var msg3457 = msg("1777:01", dup220); + +var select1668 = linear_select([ + msg3456, + msg3457, +]); + +var msg3458 = msg("1778", dup198); + +var msg3459 = msg("1778:01", dup220); + +var select1669 = linear_select([ + msg3458, + msg3459, +]); + +var msg3460 = msg("1779", dup227); + +var msg3461 = msg("1779:01", dup228); + +var select1670 = linear_select([ + msg3460, + msg3461, +]); + +var msg3462 = msg("1780", dup222); + +var msg3463 = msg("1780:01", dup223); + +var select1671 = linear_select([ + msg3462, + msg3463, +]); + +var msg3464 = msg("1781", dup281); + +var msg3465 = msg("1781:01", dup282); + +var select1672 = linear_select([ + msg3464, + msg3465, +]); + +var msg3466 = msg("1782", dup281); + +var msg3467 = msg("1782:01", dup282); + +var select1673 = linear_select([ + msg3466, + msg3467, +]); + +var msg3468 = msg("1783", dup281); + +var msg3469 = msg("1783:01", dup282); + +var select1674 = linear_select([ + msg3468, + msg3469, +]); + +var msg3470 = msg("1784", dup281); + +var msg3471 = msg("1784:01", dup282); + +var select1675 = linear_select([ + msg3470, + msg3471, +]); + +var msg3472 = msg("1785", dup281); + +var msg3473 = msg("1785:01", dup282); + +var select1676 = linear_select([ + msg3472, + msg3473, +]); + +var msg3474 = msg("1786", dup281); + +var msg3475 = msg("1786:01", dup282); + +var select1677 = linear_select([ + msg3474, + msg3475, +]); + +var msg3476 = msg("1787", dup265); + +var msg3477 = msg("1787:01", dup266); + +var select1678 = linear_select([ + msg3476, + msg3477, +]); + +var msg3478 = msg("1788", dup265); + +var msg3479 = msg("1788:01", dup266); + +var select1679 = linear_select([ + msg3478, + msg3479, +]); + +var msg3480 = msg("1789", dup196); + +var msg3481 = msg("1789:01", dup217); + +var select1680 = linear_select([ + msg3480, + msg3481, +]); + +var msg3482 = msg("1790", dup196); + +var msg3483 = msg("1790:01", dup217); + +var select1681 = linear_select([ + msg3482, + msg3483, +]); + +var msg3484 = msg("1791", dup192); + +var msg3485 = msg("1791:01", dup262); + +var select1682 = linear_select([ + msg3484, + msg3485, +]); + +var msg3486 = msg("1792", dup222); + +var msg3487 = msg("1792:01", dup223); + +var select1683 = linear_select([ + msg3486, + msg3487, +]); + +var msg3488 = msg("1793", dup281); + +var msg3489 = msg("1793:01", dup282); + +var select1684 = linear_select([ + msg3488, + msg3489, +]); + +var msg3490 = msg("1794", dup281); + +var msg3491 = msg("1794:01", dup282); + +var select1685 = linear_select([ + msg3490, + msg3491, +]); + +var msg3492 = msg("1795", dup281); + +var msg3493 = msg("1795:01", dup282); + +var select1686 = linear_select([ + msg3492, + msg3493, +]); + +var msg3494 = msg("1796", dup281); + +var msg3495 = msg("1796:01", dup282); + +var select1687 = linear_select([ + msg3494, + msg3495, +]); + +var msg3496 = msg("1797", dup281); + +var msg3497 = msg("1797:01", dup282); + +var select1688 = linear_select([ + msg3496, + msg3497, +]); + +var msg3498 = msg("1798", dup281); + +var msg3499 = msg("1798:01", dup282); + +var select1689 = linear_select([ + msg3498, + msg3499, +]); + +var msg3500 = msg("1799", dup281); + +var msg3501 = msg("1799:01", dup282); + +var select1690 = linear_select([ + msg3500, + msg3501, +]); + +var msg3502 = msg("1800", dup263); + +var msg3503 = msg("1800:01", dup264); + +var select1691 = linear_select([ + msg3502, + msg3503, +]); + +var msg3504 = msg("1801", dup267); + +var msg3505 = msg("1801:01", dup268); + +var select1692 = linear_select([ + msg3504, + msg3505, +]); + +var msg3506 = msg("1802", dup267); + +var msg3507 = msg("1802:01", dup268); + +var select1693 = linear_select([ + msg3506, + msg3507, +]); + +var msg3508 = msg("1803", dup267); + +var msg3509 = msg("1803:01", dup268); + +var select1694 = linear_select([ + msg3508, + msg3509, +]); + +var msg3510 = msg("1804", dup267); + +var msg3511 = msg("1804:01", dup268); + +var select1695 = linear_select([ + msg3510, + msg3511, +]); + +var msg3512 = msg("1805", dup265); + +var msg3513 = msg("1805:01", dup266); + +var select1696 = linear_select([ + msg3512, + msg3513, +]); + +var msg3514 = msg("1806", dup196); + +var msg3515 = msg("1806:01", dup217); + +var select1697 = linear_select([ + msg3514, + msg3515, +]); + +var msg3516 = msg("1807", dup265); + +var msg3517 = msg("1807:01", dup266); + +var select1698 = linear_select([ + msg3516, + msg3517, +]); + +var msg3518 = msg("1808", dup267); + +var msg3519 = msg("1808:01", dup268); + +var select1699 = linear_select([ + msg3518, + msg3519, +]); + +var msg3520 = msg("1809", dup238); + +var msg3521 = msg("1809:01", dup239); + +var select1700 = linear_select([ + msg3520, + msg3521, +]); + +var msg3522 = msg("1810", dup196); + +var msg3523 = msg("1810:01", dup217); + +var select1701 = linear_select([ + msg3522, + msg3523, +]); + +var msg3524 = msg("1811", dup196); + +var msg3525 = msg("1811:01", dup217); + +var select1702 = linear_select([ + msg3524, + msg3525, +]); + +var msg3526 = msg("1812", dup196); + +var msg3527 = msg("1812:01", dup217); + +var select1703 = linear_select([ + msg3526, + msg3527, +]); + +var msg3528 = msg("1813", dup232); + +var msg3529 = msg("1813:01", dup231); + +var select1704 = linear_select([ + msg3528, + msg3529, +]); + +var msg3530 = msg("1814", dup198); + +var msg3531 = msg("1814:01", dup220); + +var select1705 = linear_select([ + msg3530, + msg3531, +]); + +var msg3532 = msg("1815", dup265); + +var msg3533 = msg("1815:01", dup266); + +var select1706 = linear_select([ + msg3532, + msg3533, +]); + +var msg3534 = msg("1816", dup265); + +var msg3535 = msg("1816:01", dup266); + +var select1707 = linear_select([ + msg3534, + msg3535, +]); + +var msg3536 = msg("1817", dup265); + +var msg3537 = msg("1817:01", dup266); + +var select1708 = linear_select([ + msg3536, + msg3537, +]); + +var msg3538 = msg("1818", dup265); + +var msg3539 = msg("1818:01", dup266); + +var select1709 = linear_select([ + msg3538, + msg3539, +]); + +var msg3540 = msg("1819", dup196); + +var msg3541 = msg("1819:01", dup217); + +var select1710 = linear_select([ + msg3540, + msg3541, +]); + +var msg3542 = msg("1820", dup265); + +var msg3543 = msg("1820:01", dup266); + +var select1711 = linear_select([ + msg3542, + msg3543, +]); + +var msg3544 = msg("1821", dup201); + +var msg3545 = msg("1821:01", dup289); + +var select1712 = linear_select([ + msg3544, + msg3545, +]); + +var msg3546 = msg("1822", dup265); + +var msg3547 = msg("1822:01", dup266); + +var select1713 = linear_select([ + msg3546, + msg3547, +]); + +var msg3548 = msg("1823", dup265); + +var msg3549 = msg("1823:01", dup266); + +var select1714 = linear_select([ + msg3548, + msg3549, +]); + +var msg3550 = msg("1824", dup265); + +var msg3551 = msg("1824:01", dup266); + +var select1715 = linear_select([ + msg3550, + msg3551, +]); + +var msg3552 = msg("1825", dup265); + +var msg3553 = msg("1825:01", dup266); + +var select1716 = linear_select([ + msg3552, + msg3553, +]); + +var msg3554 = msg("1826", dup265); + +var msg3555 = msg("1826:01", dup266); + +var select1717 = linear_select([ + msg3554, + msg3555, +]); + +var msg3556 = msg("1827", dup265); + +var msg3557 = msg("1827:01", dup266); + +var select1718 = linear_select([ + msg3556, + msg3557, +]); + +var msg3558 = msg("1828", dup265); + +var msg3559 = msg("1828:01", dup266); + +var select1719 = linear_select([ + msg3558, + msg3559, +]); + +var msg3560 = msg("1829", dup265); + +var msg3561 = msg("1829:01", dup266); + +var select1720 = linear_select([ + msg3560, + msg3561, +]); + +var msg3562 = msg("1830", dup265); + +var msg3563 = msg("1830:01", dup266); + +var select1721 = linear_select([ + msg3562, + msg3563, +]); + +var msg3564 = msg("1831", dup198); + +var msg3565 = msg("1831:01", dup220); + +var select1722 = linear_select([ + msg3564, + msg3565, +]); + +var msg3566 = msg("1832", dup196); + +var msg3567 = msg("1832:01", dup217); + +var select1723 = linear_select([ + msg3566, + msg3567, +]); + +var msg3568 = msg("1833", dup281); + +var msg3569 = msg("1833:01", dup282); + +var select1724 = linear_select([ + msg3568, + msg3569, +]); + +var msg3570 = msg("1834", dup265); + +var msg3571 = msg("1834:01", dup266); + +var select1725 = linear_select([ + msg3570, + msg3571, +]); + +var msg3572 = msg("1835", dup265); + +var msg3573 = msg("1835:01", dup266); + +var select1726 = linear_select([ + msg3572, + msg3573, +]); + +var msg3574 = msg("1836", dup281); + +var msg3575 = msg("1836:01", dup282); + +var select1727 = linear_select([ + msg3574, + msg3575, +]); + +var msg3576 = msg("1837", dup281); + +var msg3577 = msg("1837:01", dup282); + +var select1728 = linear_select([ + msg3576, + msg3577, +]); + +var msg3578 = msg("1838", dup197); + +var msg3579 = msg("1838:01", dup221); + +var select1729 = linear_select([ + msg3578, + msg3579, +]); + +var msg3580 = msg("1839", dup265); + +var msg3581 = msg("1839:01", dup266); + +var select1730 = linear_select([ + msg3580, + msg3581, +]); + +var msg3582 = msg("1840", dup265); + +var msg3583 = msg("1840:01", dup266); + +var select1731 = linear_select([ + msg3582, + msg3583, +]); + +var msg3584 = msg("1841", dup265); + +var msg3585 = msg("1841:01", dup266); + +var select1732 = linear_select([ + msg3584, + msg3585, +]); + +var msg3586 = msg("1842", dup222); + +var msg3587 = msg("1842:01", dup223); + +var select1733 = linear_select([ + msg3586, + msg3587, +]); + +var msg3588 = msg("1843", dup205); + +var msg3589 = msg("1843:01", dup206); + +var select1734 = linear_select([ + msg3588, + msg3589, +]); + +var msg3590 = msg("1844", dup222); + +var msg3591 = msg("1844:01", dup223); + +var select1735 = linear_select([ + msg3590, + msg3591, +]); + +var msg3592 = msg("1845", dup222); + +var msg3593 = msg("1845:01", dup223); + +var select1736 = linear_select([ + msg3592, + msg3593, +]); + +var msg3594 = msg("1846", dup196); + +var msg3595 = msg("1846:01", dup217); + +var select1737 = linear_select([ + msg3594, + msg3595, +]); + +var msg3596 = msg("1847", dup265); + +var msg3597 = msg("1847:01", dup266); + +var select1738 = linear_select([ + msg3596, + msg3597, +]); + +var msg3598 = msg("1848", dup265); + +var msg3599 = msg("1848:01", dup266); + +var select1739 = linear_select([ + msg3598, + msg3599, +]); + +var msg3600 = msg("1849", dup265); + +var msg3601 = msg("1849:01", dup266); + +var select1740 = linear_select([ + msg3600, + msg3601, +]); + +var msg3602 = msg("1850", dup197); + +var msg3603 = msg("1850:01", dup221); + +var select1741 = linear_select([ + msg3602, + msg3603, +]); + +var msg3604 = msg("1851", dup265); + +var msg3605 = msg("1851:01", dup266); + +var select1742 = linear_select([ + msg3604, + msg3605, +]); + +var msg3606 = msg("1852", dup265); + +var msg3607 = msg("1852:01", dup266); + +var select1743 = linear_select([ + msg3606, + msg3607, +]); + +var msg3608 = msg("1853", dup205); + +var msg3609 = msg("1853:01", dup206); + +var select1744 = linear_select([ + msg3608, + msg3609, +]); + +var msg3610 = msg("1854", dup215); + +var msg3611 = msg("1854:01", dup216); + +var select1745 = linear_select([ + msg3610, + msg3611, +]); + +var msg3612 = msg("1855", dup215); + +var msg3613 = msg("1855:01", dup216); + +var select1746 = linear_select([ + msg3612, + msg3613, +]); + +var msg3614 = msg("1856", dup215); + +var msg3615 = msg("1856:01", dup216); + +var select1747 = linear_select([ + msg3614, + msg3615, +]); + +var msg3616 = msg("1857", dup265); + +var msg3617 = msg("1857:01", dup266); + +var select1748 = linear_select([ + msg3616, + msg3617, +]); + +var msg3618 = msg("1858", dup265); + +var msg3619 = msg("1858:01", dup266); + +var select1749 = linear_select([ + msg3618, + msg3619, +]); + +var msg3620 = msg("1859", dup265); + +var msg3621 = msg("1859:01", dup266); + +var select1750 = linear_select([ + msg3620, + msg3621, +]); + +var msg3622 = msg("1860", dup265); + +var msg3623 = msg("1860:01", dup266); + +var select1751 = linear_select([ + msg3622, + msg3623, +]); + +var msg3624 = msg("1861", dup265); + +var msg3625 = msg("1861:01", dup266); + +var select1752 = linear_select([ + msg3624, + msg3625, +]); + +var msg3626 = msg("1862", dup265); + +var msg3627 = msg("1862:01", dup266); + +var select1753 = linear_select([ + msg3626, + msg3627, +]); + +var msg3628 = msg("1863", dup267); + +var msg3629 = msg("1863:01", dup268); + +var select1754 = linear_select([ + msg3628, + msg3629, +]); + +var msg3630 = msg("1864", dup227); + +var msg3631 = msg("1864:01", dup228); + +var select1755 = linear_select([ + msg3630, + msg3631, +]); + +var msg3632 = msg("1865", dup265); + +var msg3633 = msg("1865:01", dup266); + +var select1756 = linear_select([ + msg3632, + msg3633, +]); + +var msg3634 = msg("1866", dup222); + +var msg3635 = msg("1866:01", dup223); + +var select1757 = linear_select([ + msg3634, + msg3635, +]); + +var msg3636 = msg("1867", dup196); + +var msg3637 = msg("1867:01", dup217); + +var select1758 = linear_select([ + msg3636, + msg3637, +]); + +var msg3638 = msg("1868", dup265); + +var msg3639 = msg("1869", dup265); + +var msg3640 = msg("1870", dup265); + +var msg3641 = msg("1870:01", dup266); + +var select1759 = linear_select([ + msg3640, + msg3641, +]); + +var msg3642 = msg("1871", dup240); + +var msg3643 = msg("1871:01", dup241); + +var select1760 = linear_select([ + msg3642, + msg3643, +]); + +var msg3644 = msg("1872", dup265); + +var msg3645 = msg("1872:01", dup266); + +var select1761 = linear_select([ + msg3644, + msg3645, +]); + +var msg3646 = msg("1873", dup265); + +var msg3647 = msg("1873:01", dup266); + +var select1762 = linear_select([ + msg3646, + msg3647, +]); + +var msg3648 = msg("1874", dup265); + +var msg3649 = msg("1874:01", dup266); + +var select1763 = linear_select([ + msg3648, + msg3649, +]); + +var msg3650 = msg("1875", dup265); + +var msg3651 = msg("1875:01", dup266); + +var select1764 = linear_select([ + msg3650, + msg3651, +]); + +var msg3652 = msg("1876", dup265); + +var msg3653 = msg("1876:01", dup266); + +var select1765 = linear_select([ + msg3652, + msg3653, +]); + +var msg3654 = msg("1877", dup265); + +var msg3655 = msg("1877:01", dup266); + +var select1766 = linear_select([ + msg3654, + msg3655, +]); + +var msg3656 = msg("1878", dup265); + +var msg3657 = msg("1878:01", dup266); + +var select1767 = linear_select([ + msg3656, + msg3657, +]); + +var msg3658 = msg("1879", dup269); + +var msg3659 = msg("1879:01", dup270); + +var select1768 = linear_select([ + msg3658, + msg3659, +]); + +var msg3660 = msg("1880", dup265); + +var msg3661 = msg("1880:01", dup266); + +var select1769 = linear_select([ + msg3660, + msg3661, +]); + +var msg3662 = msg("1881", dup238); + +var msg3663 = msg("1881:01", dup239); + +var select1770 = linear_select([ + msg3662, + msg3663, +]); + +var msg3664 = msg("1882", dup196); + +var msg3665 = msg("1882:01", dup217); + +var select1771 = linear_select([ + msg3664, + msg3665, +]); + +var msg3666 = msg("1883", dup196); + +var msg3667 = msg("1883:01", dup217); + +var select1772 = linear_select([ + msg3666, + msg3667, +]); + +var msg3668 = msg("1884", dup196); + +var msg3669 = msg("1884:01", dup217); + +var select1773 = linear_select([ + msg3668, + msg3669, +]); + +var msg3670 = msg("1885", dup196); + +var msg3671 = msg("1885:01", dup217); + +var select1774 = linear_select([ + msg3670, + msg3671, +]); + +var msg3672 = msg("1886", dup196); + +var msg3673 = msg("1886:01", dup217); + +var select1775 = linear_select([ + msg3672, + msg3673, +]); + +var msg3674 = msg("1887", dup238); + +var msg3675 = msg("1887:01", dup239); + +var select1776 = linear_select([ + msg3674, + msg3675, +]); + +var msg3676 = msg("1888", dup222); + +var msg3677 = msg("1888:01", dup223); + +var select1777 = linear_select([ + msg3676, + msg3677, +]); + +var msg3678 = msg("1889", dup290); + +var all40 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg3679 = msg("1889:01", all40); + +var select1778 = linear_select([ + msg3678, + msg3679, +]); + +var msg3680 = msg("1890", dup208); + +var msg3681 = msg("1890:01", dup291); + +var select1779 = linear_select([ + msg3680, + msg3681, +]); + +var msg3682 = msg("1891", dup208); + +var msg3683 = msg("1891:01", dup291); + +var select1780 = linear_select([ + msg3682, + msg3683, +]); + +var msg3684 = msg("1892", dup292); + +var msg3685 = msg("1893", dup292); + +var all41 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg3686 = msg("1893:01", all41); + +var select1781 = linear_select([ + msg3685, + msg3686, +]); + +var msg3687 = msg("1894", dup293); + +var msg3688 = msg("1894:01", dup294); + +var select1782 = linear_select([ + msg3687, + msg3688, +]); + +var msg3689 = msg("1895", dup293); + +var msg3690 = msg("1895:01", dup294); + +var select1783 = linear_select([ + msg3689, + msg3690, +]); + +var msg3691 = msg("1896", dup293); + +var msg3692 = msg("1896:01", dup294); + +var select1784 = linear_select([ + msg3691, + msg3692, +]); + +var msg3693 = msg("1897", dup293); + +var msg3694 = msg("1897:01", dup294); + +var select1785 = linear_select([ + msg3693, + msg3694, +]); + +var msg3695 = msg("1898", dup293); + +var msg3696 = msg("1898:01", dup294); + +var select1786 = linear_select([ + msg3695, + msg3696, +]); + +var msg3697 = msg("1899", dup293); + +var msg3698 = msg("1899:01", dup294); + +var select1787 = linear_select([ + msg3697, + msg3698, +]); + +var msg3699 = msg("1900", dup293); + +var msg3700 = msg("1900:01", dup294); + +var select1788 = linear_select([ + msg3699, + msg3700, +]); + +var msg3701 = msg("1901", dup222); + +var msg3702 = msg("1901:01", dup223); + +var select1789 = linear_select([ + msg3701, + msg3702, +]); + +var msg3703 = msg("1902", dup222); + +var msg3704 = msg("1902:01", dup223); + +var select1790 = linear_select([ + msg3703, + msg3704, +]); + +var msg3705 = msg("1903", dup222); + +var msg3706 = msg("1903:01", dup223); + +var select1791 = linear_select([ + msg3705, + msg3706, +]); + +var msg3707 = msg("1904", dup222); + +var msg3708 = msg("1904:01", dup223); + +var select1792 = linear_select([ + msg3707, + msg3708, +]); + +var msg3709 = msg("1905", dup222); + +var msg3710 = msg("1905:01", dup223); + +var select1793 = linear_select([ + msg3709, + msg3710, +]); + +var msg3711 = msg("1906", dup201); + +var msg3712 = msg("1906:01", dup289); + +var select1794 = linear_select([ + msg3711, + msg3712, +]); + +var msg3713 = msg("1907", dup222); + +var msg3714 = msg("1907:01", dup217); + +var select1795 = linear_select([ + msg3713, + msg3714, +]); + +var msg3715 = msg("1908", dup201); + +var msg3716 = msg("1908:01", dup289); + +var select1796 = linear_select([ + msg3715, + msg3716, +]); + +var msg3717 = msg("1909", dup201); + +var msg3718 = msg("1909:01", dup289); + +var select1797 = linear_select([ + msg3717, + msg3718, +]); + +var msg3719 = msg("1910", dup222); + +var msg3720 = msg("1910:01", dup217); + +var select1798 = linear_select([ + msg3719, + msg3720, +]); + +var msg3721 = msg("1911", dup222); + +var msg3722 = msg("1911:01", dup223); + +var select1799 = linear_select([ + msg3721, + msg3722, +]); + +var msg3723 = msg("1912", dup201); + +var msg3724 = msg("1912:01", dup289); + +var select1800 = linear_select([ + msg3723, + msg3724, +]); + +var msg3725 = msg("1913", dup255); + +var msg3726 = msg("1913:01", dup217); + +var select1801 = linear_select([ + msg3725, + msg3726, +]); + +var msg3727 = msg("1914", dup201); + +var msg3728 = msg("1914:01", dup217); + +var select1802 = linear_select([ + msg3727, + msg3728, +]); + +var msg3729 = msg("1915", dup255); + +var msg3730 = msg("1915:01", dup217); + +var select1803 = linear_select([ + msg3729, + msg3730, +]); + +var msg3731 = msg("1916", dup201); + +var msg3732 = msg("1916:01", dup217); + +var select1804 = linear_select([ + msg3731, + msg3732, +]); + +var msg3733 = msg("1917", dup194); + +var msg3734 = msg("1917:01", dup217); + +var select1805 = linear_select([ + msg3733, + msg3734, +]); + +var msg3735 = msg("1918", dup234); + +var msg3736 = msg("1918:01", dup235); + +var select1806 = linear_select([ + msg3735, + msg3736, +]); + +var msg3737 = msg("1919", dup222); + +var msg3738 = msg("1919:01", dup223); + +var select1807 = linear_select([ + msg3737, + msg3738, +]); + +var msg3739 = msg("1920", dup222); + +var msg3740 = msg("1920:01", dup223); + +var select1808 = linear_select([ + msg3739, + msg3740, +]); + +var msg3741 = msg("1921", dup201); + +var msg3742 = msg("1921:01", dup289); + +var select1809 = linear_select([ + msg3741, + msg3742, +]); + +var msg3743 = msg("1922", dup255); + +var msg3744 = msg("1922:01", dup217); + +var select1810 = linear_select([ + msg3743, + msg3744, +]); + +var msg3745 = msg("1923", dup258); + +var all42 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup85, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg3746 = msg("1923:01", all42); + +var select1811 = linear_select([ + msg3745, + msg3746, +]); + +var msg3747 = msg("1924", dup255); + +var msg3748 = msg("1924:01", dup216); + +var select1812 = linear_select([ + msg3747, + msg3748, +]); + +var msg3749 = msg("1925", dup287); + +var msg3750 = msg("1925:01", dup288); + +var select1813 = linear_select([ + msg3749, + msg3750, +]); + +var msg3751 = msg("1926", dup255); + +var msg3752 = msg("1926:01", dup256); + +var select1814 = linear_select([ + msg3751, + msg3752, +]); + +var msg3753 = msg("1927", dup227); + +var msg3754 = msg("1927:01", dup216); + +var select1815 = linear_select([ + msg3753, + msg3754, +]); + +var msg3755 = msg("1928", dup227); + +var msg3756 = msg("1928:01", dup216); + +var select1816 = linear_select([ + msg3755, + msg3756, +]); + +var msg3757 = msg("1929", dup192); + +var msg3758 = msg("1929:01", dup216); + +var select1817 = linear_select([ + msg3757, + msg3758, +]); + +var msg3759 = msg("1930", dup222); + +var msg3760 = msg("1930:01", dup223); + +var select1818 = linear_select([ + msg3759, + msg3760, +]); + +var msg3761 = msg("1931", dup265); + +var msg3762 = msg("1931:01", dup266); + +var select1819 = linear_select([ + msg3761, + msg3762, +]); + +var msg3763 = msg("1932", dup265); + +var msg3764 = msg("1932:01", dup216); + +var select1820 = linear_select([ + msg3763, + msg3764, +]); + +var msg3765 = msg("1933", dup265); + +var msg3766 = msg("1933:01", dup266); + +var select1821 = linear_select([ + msg3765, + msg3766, +]); + +var msg3767 = msg("1934", dup222); + +var msg3768 = msg("1934:01", dup223); + +var select1822 = linear_select([ + msg3767, + msg3768, +]); + +var msg3769 = msg("1935", dup196); + +var msg3770 = msg("1935:01", dup217); + +var select1823 = linear_select([ + msg3769, + msg3770, +]); + +var msg3771 = msg("1936", dup222); + +var msg3772 = msg("1936:01", dup223); + +var select1824 = linear_select([ + msg3771, + msg3772, +]); + +var msg3773 = msg("1937", dup222); + +var msg3774 = msg("1937:01", dup219); + +var select1825 = linear_select([ + msg3773, + msg3774, +]); + +var msg3775 = msg("1938", dup222); + +var msg3776 = msg("1938:01", dup219); + +var select1826 = linear_select([ + msg3775, + msg3776, +]); + +var msg3777 = msg("1939", dup197); + +var msg3778 = msg("1939:01", dup219); + +var select1827 = linear_select([ + msg3777, + msg3778, +]); + +var msg3779 = msg("1940", dup196); + +var msg3780 = msg("1940:01", dup217); + +var select1828 = linear_select([ + msg3779, + msg3780, +]); + +var msg3781 = msg("1941", dup295); + +var msg3782 = msg("1941:01", dup296); + +var select1829 = linear_select([ + msg3781, + msg3782, +]); + +var msg3783 = msg("1942", dup222); + +var msg3784 = msg("1942:01", dup219); + +var select1830 = linear_select([ + msg3783, + msg3784, +]); + +var msg3785 = msg("1943", dup265); + +var msg3786 = msg("1943:01", dup266); + +var select1831 = linear_select([ + msg3785, + msg3786, +]); + +var msg3787 = msg("1944", dup265); + +var msg3788 = msg("1944:01", dup266); + +var select1832 = linear_select([ + msg3787, + msg3788, +]); + +var msg3789 = msg("1945", dup265); + +var msg3790 = msg("1945:01", dup266); + +var select1833 = linear_select([ + msg3789, + msg3790, +]); + +var msg3791 = msg("1946", dup265); + +var msg3792 = msg("1946:01", dup266); + +var select1834 = linear_select([ + msg3791, + msg3792, +]); + +var msg3793 = msg("1947", dup269); + +var msg3794 = msg("1947:01", dup270); + +var select1835 = linear_select([ + msg3793, + msg3794, +]); + +var msg3795 = msg("1948", dup196); + +var msg3796 = msg("1948:01", dup217); + +var select1836 = linear_select([ + msg3795, + msg3796, +]); + +var msg3797 = msg("1949", dup255); + +var msg3798 = msg("1949:01", dup220); + +var select1837 = linear_select([ + msg3797, + msg3798, +]); + +var msg3799 = msg("1950", dup258); + +var all43 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg3800 = msg("1950:01", all43); + +var select1838 = linear_select([ + msg3799, + msg3800, +]); + +var msg3801 = msg("1951", dup287); + +var msg3802 = msg("1951:01", dup288); + +var select1839 = linear_select([ + msg3801, + msg3802, +]); + +var msg3803 = msg("1952", dup255); + +var msg3804 = msg("1952:01", dup266); + +var select1840 = linear_select([ + msg3803, + msg3804, +]); + +var msg3805 = msg("1953", dup287); + +var msg3806 = msg("1953:01", dup288); + +var select1841 = linear_select([ + msg3805, + msg3806, +]); + +var msg3807 = msg("1954", dup255); + +var msg3808 = msg("1954:01", dup256); + +var select1842 = linear_select([ + msg3807, + msg3808, +]); + +var msg3809 = msg("1955", dup287); + +var msg3810 = msg("1955:01", dup221); + +var select1843 = linear_select([ + msg3809, + msg3810, +]); + +var msg3811 = msg("1956", dup255); + +var msg3812 = msg("1956:01", dup217); + +var select1844 = linear_select([ + msg3811, + msg3812, +]); + +var msg3813 = msg("1957", dup258); + +var msg3814 = msg("1957:01", dup259); + +var select1845 = linear_select([ + msg3813, + msg3814, +]); + +var msg3815 = msg("1958", dup255); + +var msg3816 = msg("1958:01", dup256); + +var select1846 = linear_select([ + msg3815, + msg3816, +]); + +var msg3817 = msg("1959", dup280); + +var msg3818 = msg("1959:01", dup245); + +var select1847 = linear_select([ + msg3817, + msg3818, +]); + +var msg3819 = msg("1960", dup257); + +var msg3820 = msg("1960:01", dup221); + +var select1848 = linear_select([ + msg3819, + msg3820, +]); + +var msg3821 = msg("1961", dup258); + +var all44 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup88, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var msg3822 = msg("1961:01", all44); + +var select1849 = linear_select([ + msg3821, + msg3822, +]); + +var msg3823 = msg("1962", dup255); + +var msg3824 = msg("1962:01", dup226); + +var select1850 = linear_select([ + msg3823, + msg3824, +]); + +var msg3825 = msg("1963", dup222); + +var msg3826 = msg("1963:01", dup223); + +var select1851 = linear_select([ + msg3825, + msg3826, +]); + +var msg3827 = msg("1964", dup222); + +var msg3828 = msg("1964:01", dup223); + +var select1852 = linear_select([ + msg3827, + msg3828, +]); + +var msg3829 = msg("1965", dup201); + +var msg3830 = msg("1965:01", dup226); + +var select1853 = linear_select([ + msg3829, + msg3830, +]); + +var msg3831 = msg("1966", dup196); + +var msg3832 = msg("1966:01", dup226); + +var select1854 = linear_select([ + msg3831, + msg3832, +]); + +var msg3833 = msg("1967", dup265); + +var msg3834 = msg("1967:01", dup226); + +var select1855 = linear_select([ + msg3833, + msg3834, +]); + +var msg3835 = msg("1968", dup265); + +var msg3836 = msg("1968:01", dup226); + +var select1856 = linear_select([ + msg3835, + msg3836, +]); + +var msg3837 = msg("1969", dup265); + +var msg3838 = msg("1969:01", dup228); + +var select1857 = linear_select([ + msg3837, + msg3838, +]); + +var msg3839 = msg("1970", dup297); + +var msg3840 = msg("1970:01", dup228); + +var select1858 = linear_select([ + msg3839, + msg3840, +]); + +var msg3841 = msg("1971", dup227); + +var msg3842 = msg("1971:01", dup223); + +var select1859 = linear_select([ + msg3841, + msg3842, +]); + +var msg3843 = msg("1972", dup222); + +var msg3844 = msg("1972:01", dup223); + +var select1860 = linear_select([ + msg3843, + msg3844, +]); + +var msg3845 = msg("1973", dup222); + +var msg3846 = msg("1973:01", dup228); + +var select1861 = linear_select([ + msg3845, + msg3846, +]); + +var msg3847 = msg("1974", dup222); + +var msg3848 = msg("1974:01", dup223); + +var select1862 = linear_select([ + msg3847, + msg3848, +]); + +var msg3849 = msg("1975", dup222); + +var msg3850 = msg("1975:01", dup228); + +var select1863 = linear_select([ + msg3849, + msg3850, +]); + +var msg3851 = msg("1976", dup222); + +var msg3852 = msg("1976:01", dup223); + +var select1864 = linear_select([ + msg3851, + msg3852, +]); + +var msg3853 = msg("1977", dup265); + +var msg3854 = msg("1977:01", dup223); + +var select1865 = linear_select([ + msg3853, + msg3854, +]); + +var msg3855 = msg("1978", dup265); + +var msg3856 = msg("1978:01", dup266); + +var select1866 = linear_select([ + msg3855, + msg3856, +]); + +var msg3857 = msg("1979", dup265); + +var msg3858 = msg("1979:01", dup266); + +var select1867 = linear_select([ + msg3857, + msg3858, +]); + +var msg3859 = msg("1980", dup192); + +var msg3860 = msg("1980:01", dup262); + +var select1868 = linear_select([ + msg3859, + msg3860, +]); + +var msg3861 = msg("1981", dup192); + +var msg3862 = msg("1981:01", dup262); + +var select1869 = linear_select([ + msg3861, + msg3862, +]); + +var msg3863 = msg("1982", dup192); + +var msg3864 = msg("1982:01", dup262); + +var select1870 = linear_select([ + msg3863, + msg3864, +]); + +var msg3865 = msg("1983", dup192); + +var msg3866 = msg("1983:01", dup262); + +var select1871 = linear_select([ + msg3865, + msg3866, +]); + +var msg3867 = msg("1984", dup192); + +var msg3868 = msg("1984:01", dup262); + +var select1872 = linear_select([ + msg3867, + msg3868, +]); + +var msg3869 = msg("1985", dup192); + +var msg3870 = msg("1985:01", dup262); + +var select1873 = linear_select([ + msg3869, + msg3870, +]); + +var msg3871 = msg("1986", dup196); + +var msg3872 = msg("1986:01", dup217); + +var select1874 = linear_select([ + msg3871, + msg3872, +]); + +var msg3873 = msg("1987", dup222); + +var msg3874 = msg("1987:01", dup223); + +var select1875 = linear_select([ + msg3873, + msg3874, +]); + +var msg3875 = msg("1988", dup196); + +var msg3876 = msg("1988:01", dup217); + +var select1876 = linear_select([ + msg3875, + msg3876, +]); + +var msg3877 = msg("1989", dup196); + +var msg3878 = msg("1989:01", dup217); + +var select1877 = linear_select([ + msg3877, + msg3878, +]); + +var msg3879 = msg("1990", dup196); + +var msg3880 = msg("1990:01", dup217); + +var select1878 = linear_select([ + msg3879, + msg3880, +]); + +var msg3881 = msg("1991", dup196); + +var msg3882 = msg("1991:01", dup217); + +var select1879 = linear_select([ + msg3881, + msg3882, +]); + +var msg3883 = msg("1992", dup227); + +var msg3884 = msg("1992:01", dup228); + +var select1880 = linear_select([ + msg3883, + msg3884, +]); + +var msg3885 = msg("1993", dup222); + +var msg3886 = msg("1993:01", dup223); + +var select1881 = linear_select([ + msg3885, + msg3886, +]); + +var msg3887 = msg("1994", dup265); + +var msg3888 = msg("1994:01", dup266); + +var select1882 = linear_select([ + msg3887, + msg3888, +]); + +var msg3889 = msg("1995", dup265); + +var msg3890 = msg("1995:01", dup266); + +var select1883 = linear_select([ + msg3889, + msg3890, +]); + +var msg3891 = msg("1996", dup265); + +var msg3892 = msg("1996:01", dup266); + +var select1884 = linear_select([ + msg3891, + msg3892, +]); + +var msg3893 = msg("1997", dup265); + +var msg3894 = msg("1997:01", dup266); + +var select1885 = linear_select([ + msg3893, + msg3894, +]); + +var msg3895 = msg("1998", dup265); + +var msg3896 = msg("1998:01", dup266); + +var select1886 = linear_select([ + msg3895, + msg3896, +]); + +var msg3897 = msg("1999", dup265); + +var msg3898 = msg("1999:01", dup266); + +var select1887 = linear_select([ + msg3897, + msg3898, +]); + +var msg3899 = msg("2000", dup265); + +var msg3900 = msg("2000:01", dup266); + +var select1888 = linear_select([ + msg3899, + msg3900, +]); + +var msg3901 = msg("2001", dup265); + +var msg3902 = msg("2001:01", dup266); + +var select1889 = linear_select([ + msg3901, + msg3902, +]); + +var msg3903 = msg("2002", dup196); + +var msg3904 = msg("2002:01", dup217); + +var select1890 = linear_select([ + msg3903, + msg3904, +]); + +var msg3905 = msg("2003", dup238); + +var msg3906 = msg("2003:01", dup239); + +var select1891 = linear_select([ + msg3905, + msg3906, +]); + +var msg3907 = msg("2004", dup238); + +var msg3908 = msg("2004:01", dup239); + +var select1892 = linear_select([ + msg3907, + msg3908, +]); + +var msg3909 = msg("2005", dup258); + +var msg3910 = msg("2005:01", dup259); + +var select1893 = linear_select([ + msg3909, + msg3910, +]); + +var msg3911 = msg("2006", dup255); + +var msg3912 = msg("2006:01", dup256); + +var select1894 = linear_select([ + msg3911, + msg3912, +]); + +var msg3913 = msg("2007", dup255); + +var msg3914 = msg("2007:01", dup256); + +var select1895 = linear_select([ + msg3913, + msg3914, +]); + +var msg3915 = msg("2008", dup196); + +var msg3916 = msg("2008:01", dup217); + +var select1896 = linear_select([ + msg3915, + msg3916, +]); + +var msg3917 = msg("2009", dup196); + +var msg3918 = msg("2009:01", dup217); + +var select1897 = linear_select([ + msg3917, + msg3918, +]); + +var msg3919 = msg("2010", dup196); + +var msg3920 = msg("2010:01", dup217); + +var select1898 = linear_select([ + msg3919, + msg3920, +]); + +var msg3921 = msg("2011", dup196); + +var msg3922 = msg("2011:01", dup217); + +var select1899 = linear_select([ + msg3921, + msg3922, +]); + +var msg3923 = msg("2012", dup196); + +var msg3924 = msg("2012:01", dup217); + +var select1900 = linear_select([ + msg3923, + msg3924, +]); + +var msg3925 = msg("2013", dup196); + +var msg3926 = msg("2013:01", dup217); + +var select1901 = linear_select([ + msg3925, + msg3926, +]); + +var msg3927 = msg("2014", dup255); + +var msg3928 = msg("2014:01", dup256); + +var select1902 = linear_select([ + msg3927, + msg3928, +]); + +var msg3929 = msg("2015", dup258); + +var msg3930 = msg("2015:01", dup259); + +var select1903 = linear_select([ + msg3929, + msg3930, +]); + +var msg3931 = msg("2016", dup255); + +var msg3932 = msg("2016:01", dup256); + +var select1904 = linear_select([ + msg3931, + msg3932, +]); + +var msg3933 = msg("2017", dup258); + +var msg3934 = msg("2017:01", dup259); + +var select1905 = linear_select([ + msg3933, + msg3934, +]); + +var msg3935 = msg("2018", dup287); + +var msg3936 = msg("2018:01", dup288); + +var select1906 = linear_select([ + msg3935, + msg3936, +]); + +var msg3937 = msg("2019", dup255); + +var msg3938 = msg("2019:01", dup256); + +var select1907 = linear_select([ + msg3937, + msg3938, +]); + +var msg3939 = msg("2020", dup287); + +var msg3940 = msg("2020:01", dup288); + +var select1908 = linear_select([ + msg3939, + msg3940, +]); + +var msg3941 = msg("2021", dup255); + +var msg3942 = msg("2021:01", dup256); + +var select1909 = linear_select([ + msg3941, + msg3942, +]); + +var msg3943 = msg("2022", dup287); + +var msg3944 = msg("2022:01", dup288); + +var select1910 = linear_select([ + msg3943, + msg3944, +]); + +var msg3945 = msg("2023", dup255); + +var msg3946 = msg("2023:01", dup256); + +var select1911 = linear_select([ + msg3945, + msg3946, +]); + +var msg3947 = msg("2024", dup222); + +var msg3948 = msg("2024:01", dup223); + +var select1912 = linear_select([ + msg3947, + msg3948, +]); + +var msg3949 = msg("2025", dup222); + +var msg3950 = msg("2025:01", dup223); + +var select1913 = linear_select([ + msg3949, + msg3950, +]); + +var msg3951 = msg("2026", dup222); + +var msg3952 = msg("2026:01", dup223); + +var select1914 = linear_select([ + msg3951, + msg3952, +]); + +var msg3953 = msg("2027", dup222); + +var msg3954 = msg("2027:01", dup223); + +var select1915 = linear_select([ + msg3953, + msg3954, +]); + +var msg3955 = msg("2028", dup222); + +var msg3956 = msg("2028:01", dup223); + +var select1916 = linear_select([ + msg3955, + msg3956, +]); + +var msg3957 = msg("2029", dup222); + +var msg3958 = msg("2029:01", dup223); + +var select1917 = linear_select([ + msg3957, + msg3958, +]); + +var msg3959 = msg("2030", dup222); + +var msg3960 = msg("2030:01", dup223); + +var select1918 = linear_select([ + msg3959, + msg3960, +]); + +var msg3961 = msg("2031", dup255); + +var msg3962 = msg("2031:01", dup256); + +var select1919 = linear_select([ + msg3961, + msg3962, +]); + +var msg3963 = msg("2032", dup255); + +var msg3964 = msg("2032:01", dup256); + +var select1920 = linear_select([ + msg3963, + msg3964, +]); + +var msg3965 = msg("2033", dup255); + +var msg3966 = msg("2033:01", dup256); + +var select1921 = linear_select([ + msg3965, + msg3966, +]); + +var msg3967 = msg("2034", dup255); + +var msg3968 = msg("2034:01", dup256); + +var select1922 = linear_select([ + msg3967, + msg3968, +]); + +var msg3969 = msg("2035", dup258); + +var msg3970 = msg("2035:01", dup259); + +var select1923 = linear_select([ + msg3969, + msg3970, +]); + +var msg3971 = msg("2036", dup255); + +var msg3972 = msg("2036:01", dup256); + +var select1924 = linear_select([ + msg3971, + msg3972, +]); + +var msg3973 = msg("2037", dup255); + +var msg3974 = msg("2037:01", dup256); + +var select1925 = linear_select([ + msg3973, + msg3974, +]); + +var msg3975 = msg("2038", dup255); + +var msg3976 = msg("2038:01", dup256); + +var select1926 = linear_select([ + msg3975, + msg3976, +]); + +var msg3977 = msg("2039", dup196); + +var msg3978 = msg("2039:01", dup217); + +var select1927 = linear_select([ + msg3977, + msg3978, +]); + +var msg3979 = msg("2040", dup196); + +var msg3980 = msg("2040:01", dup217); + +var select1928 = linear_select([ + msg3979, + msg3980, +]); + +var msg3981 = msg("2041", dup236); + +var msg3982 = msg("2041:01", dup237); + +var select1929 = linear_select([ + msg3981, + msg3982, +]); + +var msg3983 = msg("2042", dup196); + +var msg3984 = msg("2042:01", dup217); + +var select1930 = linear_select([ + msg3983, + msg3984, +]); + +var msg3985 = msg("2043", dup236); + +var msg3986 = msg("2043:01", dup237); + +var select1931 = linear_select([ + msg3985, + msg3986, +]); + +var msg3987 = msg("2044", dup196); + +var msg3988 = msg("2044:01", dup217); + +var select1932 = linear_select([ + msg3987, + msg3988, +]); + +var msg3989 = msg("2045", dup222); + +var msg3990 = msg("2045:01", dup223); + +var select1933 = linear_select([ + msg3989, + msg3990, +]); + +var msg3991 = msg("2046", dup222); + +var msg3992 = msg("2046:01", dup223); + +var select1934 = linear_select([ + msg3991, + msg3992, +]); + +var msg3993 = msg("2047", dup196); + +var msg3994 = msg("2047:01", dup217); + +var select1935 = linear_select([ + msg3993, + msg3994, +]); + +var msg3995 = msg("2048", dup222); + +var msg3996 = msg("2048:01", dup223); + +var select1936 = linear_select([ + msg3995, + msg3996, +]); + +var msg3997 = msg("2049", dup240); + +var msg3998 = msg("2049:01", dup241); + +var select1937 = linear_select([ + msg3997, + msg3998, +]); + +var msg3999 = msg("2050", dup260); + +var msg4000 = msg("2050:01", dup261); + +var select1938 = linear_select([ + msg3999, + msg4000, +]); + +var msg4001 = msg("2051", dup265); + +var msg4002 = msg("2051:01", dup266); + +var select1939 = linear_select([ + msg4001, + msg4002, +]); + +var msg4003 = msg("2052", dup197); + +var msg4004 = msg("2052:01", dup221); + +var select1940 = linear_select([ + msg4003, + msg4004, +]); + +var msg4005 = msg("2053", dup265); + +var msg4006 = msg("2053:01", dup266); + +var select1941 = linear_select([ + msg4005, + msg4006, +]); + +var msg4007 = msg("2054", dup265); + +var msg4008 = msg("2054:01", dup266); + +var select1942 = linear_select([ + msg4007, + msg4008, +]); + +var msg4009 = msg("2055", dup265); + +var msg4010 = msg("2055:01", dup266); + +var select1943 = linear_select([ + msg4009, + msg4010, +]); + +var msg4011 = msg("2056", dup265); + +var msg4012 = msg("2056:01", dup266); + +var select1944 = linear_select([ + msg4011, + msg4012, +]); + +var msg4013 = msg("2057", dup265); + +var msg4014 = msg("2057:01", dup266); + +var select1945 = linear_select([ + msg4013, + msg4014, +]); + +var msg4015 = msg("2058", dup265); + +var msg4016 = msg("2058:01", dup266); + +var select1946 = linear_select([ + msg4015, + msg4016, +]); + +var msg4017 = msg("2059", dup265); + +var msg4018 = msg("2059:01", dup266); + +var select1947 = linear_select([ + msg4017, + msg4018, +]); + +var msg4019 = msg("2060", dup265); + +var msg4020 = msg("2060:01", dup266); + +var select1948 = linear_select([ + msg4019, + msg4020, +]); + +var msg4021 = msg("2061", dup265); + +var msg4022 = msg("2061:01", dup266); + +var select1949 = linear_select([ + msg4021, + msg4022, +]); + +var msg4023 = msg("2062", dup265); + +var msg4024 = msg("2062:01", dup266); + +var select1950 = linear_select([ + msg4023, + msg4024, +]); + +var msg4025 = msg("2063", dup260); + +var msg4026 = msg("2063:01", dup261); + +var select1951 = linear_select([ + msg4025, + msg4026, +]); + +var msg4027 = msg("2064", dup265); + +var msg4028 = msg("2064:01", dup266); + +var select1952 = linear_select([ + msg4027, + msg4028, +]); + +var msg4029 = msg("2065", dup265); + +var msg4030 = msg("2065:01", dup266); + +var select1953 = linear_select([ + msg4029, + msg4030, +]); + +var msg4031 = msg("2066", dup265); + +var msg4032 = msg("2066:01", dup266); + +var select1954 = linear_select([ + msg4031, + msg4032, +]); + +var msg4033 = msg("2067", dup265); + +var msg4034 = msg("2067:01", dup266); + +var select1955 = linear_select([ + msg4033, + msg4034, +]); + +var msg4035 = msg("2068", dup265); + +var msg4036 = msg("2068:01", dup266); + +var select1956 = linear_select([ + msg4035, + msg4036, +]); + +var msg4037 = msg("2069", dup265); + +var msg4038 = msg("2069:01", dup266); + +var select1957 = linear_select([ + msg4037, + msg4038, +]); + +var msg4039 = msg("2070", dup265); + +var msg4040 = msg("2070:01", dup266); + +var select1958 = linear_select([ + msg4039, + msg4040, +]); + +var msg4041 = msg("2071", dup265); + +var msg4042 = msg("2071:01", dup266); + +var select1959 = linear_select([ + msg4041, + msg4042, +]); + +var msg4043 = msg("2072", dup265); + +var msg4044 = msg("2072:01", dup266); + +var select1960 = linear_select([ + msg4043, + msg4044, +]); + +var msg4045 = msg("2073", dup265); + +var msg4046 = msg("2073:01", dup266); + +var select1961 = linear_select([ + msg4045, + msg4046, +]); + +var msg4047 = msg("2074", dup265); + +var msg4048 = msg("2074:01", dup266); + +var select1962 = linear_select([ + msg4047, + msg4048, +]); + +var msg4049 = msg("2075", dup265); + +var msg4050 = msg("2075:01", dup266); + +var select1963 = linear_select([ + msg4049, + msg4050, +]); + +var msg4051 = msg("2076", dup265); + +var msg4052 = msg("2076:01", dup266); + +var select1964 = linear_select([ + msg4051, + msg4052, +]); + +var msg4053 = msg("2077", dup265); + +var msg4054 = msg("2077:01", dup266); + +var select1965 = linear_select([ + msg4053, + msg4054, +]); + +var msg4055 = msg("2078", dup265); + +var msg4056 = msg("2078:01", dup266); + +var select1966 = linear_select([ + msg4055, + msg4056, +]); + +var msg4057 = msg("2079", dup258); + +var msg4058 = msg("2079:01", dup259); + +var select1967 = linear_select([ + msg4057, + msg4058, +]); + +var msg4059 = msg("2080", dup255); + +var msg4060 = msg("2080:01", dup256); + +var select1968 = linear_select([ + msg4059, + msg4060, +]); + +var msg4061 = msg("2081", dup258); + +var msg4062 = msg("2081:01", dup259); + +var select1969 = linear_select([ + msg4061, + msg4062, +]); + +var msg4063 = msg("2082", dup255); + +var msg4064 = msg("2082:01", dup256); + +var select1970 = linear_select([ + msg4063, + msg4064, +]); + +var msg4065 = msg("2083", dup255); + +var msg4066 = msg("2083:01", dup256); + +var select1971 = linear_select([ + msg4065, + msg4066, +]); + +var msg4067 = msg("2084", dup255); + +var msg4068 = msg("2084:01", dup256); + +var select1972 = linear_select([ + msg4067, + msg4068, +]); + +var msg4069 = msg("2085", dup265); + +var msg4070 = msg("2085:01", dup266); + +var select1973 = linear_select([ + msg4069, + msg4070, +]); + +var msg4071 = msg("2086", dup265); + +var msg4072 = msg("2086:01", dup266); + +var select1974 = linear_select([ + msg4071, + msg4072, +]); + +var msg4073 = msg("2087", dup222); + +var msg4074 = msg("2087:01", dup223); + +var select1975 = linear_select([ + msg4073, + msg4074, +]); + +var msg4075 = msg("2088", dup255); + +var msg4076 = msg("2088:01", dup256); + +var select1976 = linear_select([ + msg4075, + msg4076, +]); + +var msg4077 = msg("2089", dup255); + +var msg4078 = msg("2089:01", dup256); + +var select1977 = linear_select([ + msg4077, + msg4078, +]); + +var msg4079 = msg("2090", dup267); + +var msg4080 = msg("2090:01", dup268); + +var select1978 = linear_select([ + msg4079, + msg4080, +]); + +var msg4081 = msg("2091", dup194); + +var msg4082 = msg("2091:01", dup229); + +var select1979 = linear_select([ + msg4081, + msg4082, +]); + +var msg4083 = msg("2092", dup222); + +var msg4084 = msg("2092:01", dup223); + +var select1980 = linear_select([ + msg4083, + msg4084, +]); + +var msg4085 = msg("2093", dup222); + +var msg4086 = msg("2093:01", dup223); + +var select1981 = linear_select([ + msg4085, + msg4086, +]); + +var msg4087 = msg("2094", dup222); + +var msg4088 = msg("2094:01", dup223); + +var select1982 = linear_select([ + msg4087, + msg4088, +]); + +var msg4089 = msg("2095", dup201); + +var msg4090 = msg("2095:01", dup289); + +var select1983 = linear_select([ + msg4089, + msg4090, +]); + +var msg4091 = msg("2096", dup192); + +var msg4092 = msg("2096:01", dup262); + +var select1984 = linear_select([ + msg4091, + msg4092, +]); + +var msg4093 = msg("2097", dup192); + +var msg4094 = msg("2097:01", dup262); + +var select1985 = linear_select([ + msg4093, + msg4094, +]); + +var msg4095 = msg("2098", dup192); + +var msg4096 = msg("2098:01", dup262); + +var select1986 = linear_select([ + msg4095, + msg4096, +]); + +var msg4097 = msg("2099", dup192); + +var msg4098 = msg("2099:01", dup262); + +var select1987 = linear_select([ + msg4097, + msg4098, +]); + +var msg4099 = msg("2100", dup192); + +var msg4100 = msg("2100:01", dup262); + +var select1988 = linear_select([ + msg4099, + msg4100, +]); + +var msg4101 = msg("2101", dup198); + +var msg4102 = msg("2101:01", dup220); + +var select1989 = linear_select([ + msg4101, + msg4102, +]); + +var msg4103 = msg("2102", dup198); + +var msg4104 = msg("2102:01", dup220); + +var select1990 = linear_select([ + msg4103, + msg4104, +]); + +var msg4105 = msg("2103", dup276); + +var msg4106 = msg("2103:01", dup277); + +var select1991 = linear_select([ + msg4105, + msg4106, +]); + +var msg4107 = msg("2104", dup197); + +var msg4108 = msg("2104:01", dup221); + +var select1992 = linear_select([ + msg4107, + msg4108, +]); + +var msg4109 = msg("2105", dup222); + +var msg4110 = msg("2105:01", dup223); + +var select1993 = linear_select([ + msg4109, + msg4110, +]); + +var msg4111 = msg("2106", dup222); + +var msg4112 = msg("2106:01", dup223); + +var select1994 = linear_select([ + msg4111, + msg4112, +]); + +var msg4113 = msg("2107", dup222); + +var msg4114 = msg("2107:01", dup223); + +var select1995 = linear_select([ + msg4113, + msg4114, +]); + +var msg4115 = msg("2108", dup222); + +var msg4116 = msg("2108:01", dup223); + +var select1996 = linear_select([ + msg4115, + msg4116, +]); + +var msg4117 = msg("2109", dup222); + +var msg4118 = msg("2109:01", dup223); + +var select1997 = linear_select([ + msg4117, + msg4118, +]); + +var msg4119 = msg("2110", dup222); + +var msg4120 = msg("2110:01", dup223); + +var select1998 = linear_select([ + msg4119, + msg4120, +]); + +var msg4121 = msg("2111", dup222); + +var msg4122 = msg("2111:01", dup223); + +var select1999 = linear_select([ + msg4121, + msg4122, +]); + +var msg4123 = msg("2112", dup222); + +var msg4124 = msg("2112:01", dup223); + +var select2000 = linear_select([ + msg4123, + msg4124, +]); + +var msg4125 = msg("2113", dup222); + +var msg4126 = msg("2113:01", dup223); + +var select2001 = linear_select([ + msg4125, + msg4126, +]); + +var msg4127 = msg("2114", dup222); + +var msg4128 = msg("2114:01", dup223); + +var select2002 = linear_select([ + msg4127, + msg4128, +]); + +var msg4129 = msg("2115", dup265); + +var msg4130 = msg("2115:01", dup266); + +var select2003 = linear_select([ + msg4129, + msg4130, +]); + +var msg4131 = msg("2116", dup265); + +var msg4132 = msg("2116:01", dup266); + +var select2004 = linear_select([ + msg4131, + msg4132, +]); + +var msg4133 = msg("2117", dup265); + +var msg4134 = msg("2117:01", dup266); + +var select2005 = linear_select([ + msg4133, + msg4134, +]); + +var msg4135 = msg("2118", dup222); + +var msg4136 = msg("2118:01", dup223); + +var select2006 = linear_select([ + msg4135, + msg4136, +]); + +var msg4137 = msg("2119", dup222); + +var msg4138 = msg("2119:01", dup223); + +var select2007 = linear_select([ + msg4137, + msg4138, +]); + +var msg4139 = msg("2120", dup222); + +var msg4140 = msg("2120:01", dup223); + +var select2008 = linear_select([ + msg4139, + msg4140, +]); + +var msg4141 = msg("2121", dup298); + +var msg4142 = msg("2121:01", dup299); + +var select2009 = linear_select([ + msg4141, + msg4142, +]); + +var msg4143 = msg("2122", dup298); + +var msg4144 = msg("2122:01", dup299); + +var select2010 = linear_select([ + msg4143, + msg4144, +]); + +var msg4145 = msg("2123", dup196); + +var msg4146 = msg("2123:01", dup217); + +var select2011 = linear_select([ + msg4145, + msg4146, +]); + +var msg4147 = msg("2124", dup192); + +var msg4148 = msg("2124:01", dup262); + +var select2012 = linear_select([ + msg4147, + msg4148, +]); + +var msg4149 = msg("2125", dup227); + +var msg4150 = msg("2125:01", dup228); + +var select2013 = linear_select([ + msg4149, + msg4150, +]); + +var msg4151 = msg("2126", dup222); + +var msg4152 = msg("2126:01", dup223); + +var select2014 = linear_select([ + msg4151, + msg4152, +]); + +var msg4153 = msg("2127", dup265); + +var msg4154 = msg("2127:01", dup266); + +var select2015 = linear_select([ + msg4153, + msg4154, +]); + +var msg4155 = msg("2128", dup265); + +var msg4156 = msg("2128:01", dup266); + +var select2016 = linear_select([ + msg4155, + msg4156, +]); + +var msg4157 = msg("2129", dup265); + +var msg4158 = msg("2129:01", dup266); + +var select2017 = linear_select([ + msg4157, + msg4158, +]); + +var msg4159 = msg("2130", dup265); + +var msg4160 = msg("2130:01", dup266); + +var select2018 = linear_select([ + msg4159, + msg4160, +]); + +var msg4161 = msg("2131", dup265); + +var msg4162 = msg("2131:01", dup266); + +var select2019 = linear_select([ + msg4161, + msg4162, +]); + +var msg4163 = msg("2132", dup265); + +var msg4164 = msg("2132:01", dup266); + +var select2020 = linear_select([ + msg4163, + msg4164, +]); + +var msg4165 = msg("2133", dup265); + +var msg4166 = msg("2133:01", dup266); + +var select2021 = linear_select([ + msg4165, + msg4166, +]); + +var msg4167 = msg("2134", dup265); + +var msg4168 = msg("2134:01", dup266); + +var select2022 = linear_select([ + msg4167, + msg4168, +]); + +var msg4169 = msg("2135", dup265); + +var msg4170 = msg("2135:01", dup266); + +var select2023 = linear_select([ + msg4169, + msg4170, +]); + +var msg4171 = msg("2136", dup285); + +var msg4172 = msg("2136:01", dup286); + +var select2024 = linear_select([ + msg4171, + msg4172, +]); + +var msg4173 = msg("2137", dup265); + +var msg4174 = msg("2137:01", dup266); + +var select2025 = linear_select([ + msg4173, + msg4174, +]); + +var msg4175 = msg("2138", dup265); + +var msg4176 = msg("2138:01", dup266); + +var select2026 = linear_select([ + msg4175, + msg4176, +]); + +var msg4177 = msg("2139", dup265); + +var msg4178 = msg("2139:01", dup266); + +var select2027 = linear_select([ + msg4177, + msg4178, +]); + +var msg4179 = msg("2140", dup265); + +var msg4180 = msg("2140:01", dup266); + +var select2028 = linear_select([ + msg4179, + msg4180, +]); + +var msg4181 = msg("2141", dup265); + +var msg4182 = msg("2141:01", dup266); + +var select2029 = linear_select([ + msg4181, + msg4182, +]); + +var msg4183 = msg("2142", dup265); + +var msg4184 = msg("2142:01", dup266); + +var select2030 = linear_select([ + msg4183, + msg4184, +]); + +var msg4185 = msg("2143", dup265); + +var msg4186 = msg("2143:01", dup266); + +var select2031 = linear_select([ + msg4185, + msg4186, +]); + +var msg4187 = msg("2144", dup265); + +var msg4188 = msg("2144:01", dup266); + +var select2032 = linear_select([ + msg4187, + msg4188, +]); + +var msg4189 = msg("2145", dup265); + +var msg4190 = msg("2145:01", dup266); + +var select2033 = linear_select([ + msg4189, + msg4190, +]); + +var msg4191 = msg("2146", dup265); + +var msg4192 = msg("2146:01", dup266); + +var select2034 = linear_select([ + msg4191, + msg4192, +]); + +var msg4193 = msg("2147", dup265); + +var msg4194 = msg("2147:01", dup266); + +var select2035 = linear_select([ + msg4193, + msg4194, +]); + +var msg4195 = msg("2148", dup265); + +var msg4196 = msg("2148:01", dup266); + +var select2036 = linear_select([ + msg4195, + msg4196, +]); + +var msg4197 = msg("2149", dup265); + +var msg4198 = msg("2149:01", dup266); + +var select2037 = linear_select([ + msg4197, + msg4198, +]); + +var msg4199 = msg("2150", dup265); + +var msg4200 = msg("2150:01", dup266); + +var select2038 = linear_select([ + msg4199, + msg4200, +]); + +var msg4201 = msg("2151", dup265); + +var msg4202 = msg("2151:01", dup266); + +var select2039 = linear_select([ + msg4201, + msg4202, +]); + +var msg4203 = msg("2152", dup265); + +var msg4204 = msg("2152:01", dup266); + +var select2040 = linear_select([ + msg4203, + msg4204, +]); + +var msg4205 = msg("2153", dup265); + +var msg4206 = msg("2153:01", dup266); + +var select2041 = linear_select([ + msg4205, + msg4206, +]); + +var msg4207 = msg("2154", dup265); + +var msg4208 = msg("2154:01", dup266); + +var select2042 = linear_select([ + msg4207, + msg4208, +]); + +var msg4209 = msg("2155", dup265); + +var msg4210 = msg("2155:01", dup266); + +var select2043 = linear_select([ + msg4209, + msg4210, +]); + +var msg4211 = msg("2156", dup265); + +var msg4212 = msg("2156:01", dup266); + +var select2044 = linear_select([ + msg4211, + msg4212, +]); + +var msg4213 = msg("2157", dup265); + +var msg4214 = msg("2157:01", dup266); + +var select2045 = linear_select([ + msg4213, + msg4214, +]); + +var msg4215 = msg("2158", dup196); + +var msg4216 = msg("2158:01", dup217); + +var select2046 = linear_select([ + msg4215, + msg4216, +]); + +var msg4217 = msg("2159", dup196); + +var msg4218 = msg("2159:01", dup217); + +var select2047 = linear_select([ + msg4217, + msg4218, +]); + +var msg4219 = msg("2160", dup263); + +var msg4220 = msg("2160:01", dup264); + +var select2048 = linear_select([ + msg4219, + msg4220, +]); + +var msg4221 = msg("2161", dup263); + +var msg4222 = msg("2161:01", dup264); + +var select2049 = linear_select([ + msg4221, + msg4222, +]); + +var msg4223 = msg("2162", dup263); + +var msg4224 = msg("2162:01", dup264); + +var select2050 = linear_select([ + msg4223, + msg4224, +]); + +var msg4225 = msg("2163", dup263); + +var msg4226 = msg("2163:01", dup264); + +var select2051 = linear_select([ + msg4225, + msg4226, +]); + +var msg4227 = msg("2164", dup263); + +var msg4228 = msg("2164:01", dup264); + +var select2052 = linear_select([ + msg4227, + msg4228, +]); + +var msg4229 = msg("2165", dup263); + +var msg4230 = msg("2165:01", dup264); + +var select2053 = linear_select([ + msg4229, + msg4230, +]); + +var msg4231 = msg("2166", dup263); + +var msg4232 = msg("2166:01", dup264); + +var select2054 = linear_select([ + msg4231, + msg4232, +]); + +var msg4233 = msg("2167", dup263); + +var msg4234 = msg("2167:01", dup264); + +var select2055 = linear_select([ + msg4233, + msg4234, +]); + +var msg4235 = msg("2168", dup263); + +var msg4236 = msg("2168:01", dup264); + +var select2056 = linear_select([ + msg4235, + msg4236, +]); + +var msg4237 = msg("2169", dup263); + +var msg4238 = msg("2169:01", dup264); + +var select2057 = linear_select([ + msg4237, + msg4238, +]); + +var msg4239 = msg("2170", dup263); + +var msg4240 = msg("2170:01", dup264); + +var select2058 = linear_select([ + msg4239, + msg4240, +]); + +var msg4241 = msg("2171", dup263); + +var msg4242 = msg("2171:01", dup264); + +var select2059 = linear_select([ + msg4241, + msg4242, +]); + +var msg4243 = msg("2172", dup263); + +var msg4244 = msg("2172:01", dup264); + +var select2060 = linear_select([ + msg4243, + msg4244, +]); + +var msg4245 = msg("2173", dup263); + +var msg4246 = msg("2173:01", dup264); + +var select2061 = linear_select([ + msg4245, + msg4246, +]); + +var msg4247 = msg("2174", dup276); + +var msg4248 = msg("2174:01", dup277); + +var select2062 = linear_select([ + msg4247, + msg4248, +]); + +var msg4249 = msg("2175", dup276); + +var msg4250 = msg("2175:01", dup277); + +var select2063 = linear_select([ + msg4249, + msg4250, +]); + +var msg4251 = msg("2176", dup246); + +var msg4252 = msg("2176:01", dup247); + +var select2064 = linear_select([ + msg4251, + msg4252, +]); + +var msg4253 = msg("2177", dup246); + +var msg4254 = msg("2177:01", dup247); + +var select2065 = linear_select([ + msg4253, + msg4254, +]); + +var msg4255 = msg("2178", dup227); + +var msg4256 = msg("2178:01", dup228); + +var select2066 = linear_select([ + msg4255, + msg4256, +]); + +var msg4257 = msg("2179", dup227); + +var msg4258 = msg("2179:01", dup228); + +var select2067 = linear_select([ + msg4257, + msg4258, +]); + +var msg4259 = msg("2180", dup196); + +var msg4260 = msg("2180:01", dup217); + +var select2068 = linear_select([ + msg4259, + msg4260, +]); + +var msg4261 = msg("2181", dup196); + +var msg4262 = msg("2181:01", dup217); + +var select2069 = linear_select([ + msg4261, + msg4262, +]); + +var msg4263 = msg("2182", dup192); + +var msg4264 = msg("2182:01", dup262); + +var select2070 = linear_select([ + msg4263, + msg4264, +]); + +var msg4265 = msg("2183", dup222); + +var msg4266 = msg("2183:01", dup223); + +var select2071 = linear_select([ + msg4265, + msg4266, +]); + +var msg4267 = msg("2184", dup201); + +var msg4268 = msg("2184:01", dup289); + +var select2072 = linear_select([ + msg4267, + msg4268, +]); + +var msg4269 = msg("2185", dup222); + +var msg4270 = msg("2185:01", dup223); + +var select2073 = linear_select([ + msg4269, + msg4270, +]); + +var msg4271 = msg("2186", dup196); + +var msg4272 = msg("2186:01", dup217); + +var select2074 = linear_select([ + msg4271, + msg4272, +]); + +var msg4273 = msg("2187", dup196); + +var msg4274 = msg("2187:01", dup217); + +var select2075 = linear_select([ + msg4273, + msg4274, +]); + +var msg4275 = msg("2188", dup196); + +var msg4276 = msg("2188:01", dup217); + +var select2076 = linear_select([ + msg4275, + msg4276, +]); + +var msg4277 = msg("2189", dup196); + +var msg4278 = msg("2189:01", dup217); + +var select2077 = linear_select([ + msg4277, + msg4278, +]); + +var msg4279 = msg("2190", dup276); + +var msg4280 = msg("2190:01", dup277); + +var select2078 = linear_select([ + msg4279, + msg4280, +]); + +var msg4281 = msg("2191", dup276); + +var msg4282 = msg("2191:01", dup277); + +var select2079 = linear_select([ + msg4281, + msg4282, +]); + +var msg4283 = msg("2192", dup276); + +var msg4284 = msg("2192:01", dup277); + +var select2080 = linear_select([ + msg4283, + msg4284, +]); + +var msg4285 = msg("2193", dup276); + +var msg4286 = msg("2193:01", dup277); + +var select2081 = linear_select([ + msg4285, + msg4286, +]); + +var msg4287 = msg("2194", dup265); + +var msg4288 = msg("2194:01", dup266); + +var select2082 = linear_select([ + msg4287, + msg4288, +]); + +var msg4289 = msg("2195", dup265); + +var msg4290 = msg("2195:01", dup266); + +var select2083 = linear_select([ + msg4289, + msg4290, +]); + +var msg4291 = msg("2196", dup265); + +var msg4292 = msg("2196:01", dup266); + +var select2084 = linear_select([ + msg4291, + msg4292, +]); + +var msg4293 = msg("2197", dup265); + +var msg4294 = msg("2197:01", dup266); + +var select2085 = linear_select([ + msg4293, + msg4294, +]); + +var msg4295 = msg("2198", dup265); + +var msg4296 = msg("2198:01", dup266); + +var select2086 = linear_select([ + msg4295, + msg4296, +]); + +var msg4297 = msg("2199", dup265); + +var msg4298 = msg("2199:01", dup266); + +var select2087 = linear_select([ + msg4297, + msg4298, +]); + +var msg4299 = msg("2200", dup265); + +var msg4300 = msg("2200:01", dup266); + +var select2088 = linear_select([ + msg4299, + msg4300, +]); + +var msg4301 = msg("2201", dup265); + +var msg4302 = msg("2201:01", dup266); + +var select2089 = linear_select([ + msg4301, + msg4302, +]); + +var msg4303 = msg("2202", dup265); + +var msg4304 = msg("2202:01", dup266); + +var select2090 = linear_select([ + msg4303, + msg4304, +]); + +var msg4305 = msg("2203", dup265); + +var msg4306 = msg("2203:01", dup266); + +var select2091 = linear_select([ + msg4305, + msg4306, +]); + +var msg4307 = msg("2204", dup265); + +var msg4308 = msg("2204:01", dup266); + +var select2092 = linear_select([ + msg4307, + msg4308, +]); + +var msg4309 = msg("2205", dup265); + +var msg4310 = msg("2205:01", dup266); + +var select2093 = linear_select([ + msg4309, + msg4310, +]); + +var msg4311 = msg("2206", dup265); + +var msg4312 = msg("2206:01", dup266); + +var select2094 = linear_select([ + msg4311, + msg4312, +]); + +var msg4313 = msg("2207", dup265); + +var msg4314 = msg("2207:01", dup266); + +var select2095 = linear_select([ + msg4313, + msg4314, +]); + +var msg4315 = msg("2208", dup265); + +var msg4316 = msg("2208:01", dup266); + +var select2096 = linear_select([ + msg4315, + msg4316, +]); + +var msg4317 = msg("2209", dup265); + +var msg4318 = msg("2209:01", dup266); + +var select2097 = linear_select([ + msg4317, + msg4318, +]); + +var msg4319 = msg("2210", dup265); + +var msg4320 = msg("2210:01", dup266); + +var select2098 = linear_select([ + msg4319, + msg4320, +]); + +var msg4321 = msg("2211", dup265); + +var msg4322 = msg("2211:01", dup266); + +var select2099 = linear_select([ + msg4321, + msg4322, +]); + +var msg4323 = msg("2212", dup265); + +var msg4324 = msg("2212:01", dup266); + +var select2100 = linear_select([ + msg4323, + msg4324, +]); + +var msg4325 = msg("2213", dup265); + +var msg4326 = msg("2213:01", dup266); + +var select2101 = linear_select([ + msg4325, + msg4326, +]); + +var msg4327 = msg("2214", dup265); + +var msg4328 = msg("2214:01", dup266); + +var select2102 = linear_select([ + msg4327, + msg4328, +]); + +var msg4329 = msg("2215", dup265); + +var msg4330 = msg("2215:01", dup266); + +var select2103 = linear_select([ + msg4329, + msg4330, +]); + +var msg4331 = msg("2216", dup265); + +var msg4332 = msg("2216:01", dup266); + +var select2104 = linear_select([ + msg4331, + msg4332, +]); + +var msg4333 = msg("2217", dup265); + +var msg4334 = msg("2217:01", dup266); + +var select2105 = linear_select([ + msg4333, + msg4334, +]); + +var msg4335 = msg("2218", dup265); + +var msg4336 = msg("2218:01", dup266); + +var select2106 = linear_select([ + msg4335, + msg4336, +]); + +var msg4337 = msg("2219", dup265); + +var msg4338 = msg("2219:01", dup266); + +var select2107 = linear_select([ + msg4337, + msg4338, +]); + +var msg4339 = msg("2220", dup265); + +var msg4340 = msg("2220:01", dup266); + +var select2108 = linear_select([ + msg4339, + msg4340, +]); + +var msg4341 = msg("2221", dup265); + +var msg4342 = msg("2221:01", dup266); + +var select2109 = linear_select([ + msg4341, + msg4342, +]); + +var msg4343 = msg("2222", dup194); + +var msg4344 = msg("2222:01", dup229); + +var select2110 = linear_select([ + msg4343, + msg4344, +]); + +var msg4345 = msg("2223", dup265); + +var msg4346 = msg("2223:01", dup266); + +var select2111 = linear_select([ + msg4345, + msg4346, +]); + +var msg4347 = msg("2224", dup265); + +var msg4348 = msg("2224:01", dup266); + +var select2112 = linear_select([ + msg4347, + msg4348, +]); + +var msg4349 = msg("2225", dup265); + +var msg4350 = msg("2225:01", dup266); + +var select2113 = linear_select([ + msg4349, + msg4350, +]); + +var msg4351 = msg("2226", dup265); + +var msg4352 = msg("2226:01", dup266); + +var select2114 = linear_select([ + msg4351, + msg4352, +]); + +var msg4353 = msg("2227", dup265); + +var msg4354 = msg("2227:01", dup266); + +var select2115 = linear_select([ + msg4353, + msg4354, +]); + +var msg4355 = msg("2228", dup240); + +var msg4356 = msg("2228:01", dup241); + +var select2116 = linear_select([ + msg4355, + msg4356, +]); + +var msg4357 = msg("2229", dup265); + +var msg4358 = msg("2229:01", dup266); + +var select2117 = linear_select([ + msg4357, + msg4358, +]); + +var msg4359 = msg("2230", dup265); + +var msg4360 = msg("2230:01", dup266); + +var select2118 = linear_select([ + msg4359, + msg4360, +]); + +var msg4361 = msg("2231", dup265); + +var msg4362 = msg("2231:01", dup266); + +var select2119 = linear_select([ + msg4361, + msg4362, +]); + +var msg4363 = msg("2232", dup265); + +var msg4364 = msg("2232:01", dup266); + +var select2120 = linear_select([ + msg4363, + msg4364, +]); + +var msg4365 = msg("2233", dup265); + +var msg4366 = msg("2233:01", dup266); + +var select2121 = linear_select([ + msg4365, + msg4366, +]); + +var msg4367 = msg("2234", dup265); + +var msg4368 = msg("2234:01", dup266); + +var select2122 = linear_select([ + msg4367, + msg4368, +]); + +var msg4369 = msg("2235", dup265); + +var msg4370 = msg("2235:01", dup266); + +var select2123 = linear_select([ + msg4369, + msg4370, +]); + +var msg4371 = msg("2236", dup265); + +var msg4372 = msg("2236:01", dup266); + +var select2124 = linear_select([ + msg4371, + msg4372, +]); + +var msg4373 = msg("2237", dup265); + +var msg4374 = msg("2237:01", dup266); + +var select2125 = linear_select([ + msg4373, + msg4374, +]); + +var msg4375 = msg("2238", dup265); + +var msg4376 = msg("2238:01", dup266); + +var select2126 = linear_select([ + msg4375, + msg4376, +]); + +var msg4377 = msg("2239", dup265); + +var msg4378 = msg("2239:01", dup266); + +var select2127 = linear_select([ + msg4377, + msg4378, +]); + +var msg4379 = msg("2240", dup265); + +var msg4380 = msg("2240:01", dup266); + +var select2128 = linear_select([ + msg4379, + msg4380, +]); + +var msg4381 = msg("2241", dup265); + +var msg4382 = msg("2241:01", dup266); + +var select2129 = linear_select([ + msg4381, + msg4382, +]); + +var msg4383 = msg("2242", dup265); + +var msg4384 = msg("2242:01", dup266); + +var select2130 = linear_select([ + msg4383, + msg4384, +]); + +var msg4385 = msg("2243", dup265); + +var msg4386 = msg("2243:01", dup266); + +var select2131 = linear_select([ + msg4385, + msg4386, +]); + +var msg4387 = msg("2244", dup265); + +var msg4388 = msg("2244:01", dup266); + +var select2132 = linear_select([ + msg4387, + msg4388, +]); + +var msg4389 = msg("2245", dup265); + +var msg4390 = msg("2245:01", dup266); + +var select2133 = linear_select([ + msg4389, + msg4390, +]); + +var msg4391 = msg("2246", dup265); + +var msg4392 = msg("2246:01", dup266); + +var select2134 = linear_select([ + msg4391, + msg4392, +]); + +var msg4393 = msg("2247", dup265); + +var msg4394 = msg("2247:01", dup266); + +var select2135 = linear_select([ + msg4393, + msg4394, +]); + +var msg4395 = msg("2248", dup265); + +var msg4396 = msg("2248:01", dup266); + +var select2136 = linear_select([ + msg4395, + msg4396, +]); + +var msg4397 = msg("2249", dup265); + +var msg4398 = msg("2249:01", dup266); + +var select2137 = linear_select([ + msg4397, + msg4398, +]); + +var msg4399 = msg("2250", dup298); + +var msg4400 = msg("2250:01", dup299); + +var select2138 = linear_select([ + msg4399, + msg4400, +]); + +var msg4401 = msg("2251", dup276); + +var msg4402 = msg("2251:01", dup277); + +var select2139 = linear_select([ + msg4401, + msg4402, +]); + +var msg4403 = msg("2252", dup276); + +var msg4404 = msg("2252:01", dup277); + +var select2140 = linear_select([ + msg4403, + msg4404, +]); + +var msg4405 = msg("2253", dup222); + +var msg4406 = msg("2253:01", dup223); + +var select2141 = linear_select([ + msg4405, + msg4406, +]); + +var msg4407 = msg("2254", dup222); + +var msg4408 = msg("2254:01", dup223); + +var select2142 = linear_select([ + msg4407, + msg4408, +]); + +var msg4409 = msg("2255", dup255); + +var msg4410 = msg("2255:01", dup256); + +var select2143 = linear_select([ + msg4409, + msg4410, +]); + +var msg4411 = msg("2256", dup255); + +var msg4412 = msg("2256:01", dup256); + +var select2144 = linear_select([ + msg4411, + msg4412, +]); + +var msg4413 = msg("2257", dup276); + +var msg4414 = msg("2257:01", dup277); + +var select2145 = linear_select([ + msg4413, + msg4414, +]); + +var msg4415 = msg("2258", dup276); + +var msg4416 = msg("2258:01", dup277); + +var select2146 = linear_select([ + msg4415, + msg4416, +]); + +var msg4417 = msg("2259", dup222); + +var msg4418 = msg("2259:01", dup223); + +var select2147 = linear_select([ + msg4417, + msg4418, +]); + +var msg4419 = msg("2260", dup222); + +var msg4420 = msg("2260:01", dup223); + +var select2148 = linear_select([ + msg4419, + msg4420, +]); + +var msg4421 = msg("2261", dup194); + +var msg4422 = msg("2261:01", dup229); + +var select2149 = linear_select([ + msg4421, + msg4422, +]); + +var msg4423 = msg("2262", dup194); + +var msg4424 = msg("2262:01", dup229); + +var select2150 = linear_select([ + msg4423, + msg4424, +]); + +var msg4425 = msg("2263", dup194); + +var msg4426 = msg("2263:01", dup229); + +var select2151 = linear_select([ + msg4425, + msg4426, +]); + +var msg4427 = msg("2264", dup194); + +var msg4428 = msg("2264:01", dup229); + +var select2152 = linear_select([ + msg4427, + msg4428, +]); + +var msg4429 = msg("2265", dup194); + +var msg4430 = msg("2265:01", dup229); + +var select2153 = linear_select([ + msg4429, + msg4430, +]); + +var msg4431 = msg("2266", dup194); + +var msg4432 = msg("2266:01", dup229); + +var select2154 = linear_select([ + msg4431, + msg4432, +]); + +var msg4433 = msg("2267", dup194); + +var msg4434 = msg("2267:01", dup229); + +var select2155 = linear_select([ + msg4433, + msg4434, +]); + +var msg4435 = msg("2268", dup194); + +var msg4436 = msg("2268:01", dup229); + +var select2156 = linear_select([ + msg4435, + msg4436, +]); + +var msg4437 = msg("2269", dup194); + +var msg4438 = msg("2269:01", dup229); + +var select2157 = linear_select([ + msg4437, + msg4438, +]); + +var msg4439 = msg("2270", dup194); + +var msg4440 = msg("2270:01", dup229); + +var select2158 = linear_select([ + msg4439, + msg4440, +]); + +var msg4441 = msg("2271", dup192); + +var msg4442 = msg("2271:01", dup262); + +var select2159 = linear_select([ + msg4441, + msg4442, +]); + +var msg4443 = msg("2272", dup222); + +var msg4444 = msg("2272:01", dup223); + +var select2160 = linear_select([ + msg4443, + msg4444, +]); + +var msg4445 = msg("2273", dup196); + +var msg4446 = msg("2273:01", dup217); + +var select2161 = linear_select([ + msg4445, + msg4446, +]); + +var msg4447 = msg("2274", dup298); + +var msg4448 = msg("2274:01", dup299); + +var select2162 = linear_select([ + msg4447, + msg4448, +]); + +var msg4449 = msg("2275", dup250); + +var msg4450 = msg("2275:01", dup251); + +var select2163 = linear_select([ + msg4449, + msg4450, +]); + +var msg4451 = msg("2276", dup265); + +var msg4452 = msg("2276:01", dup266); + +var select2164 = linear_select([ + msg4451, + msg4452, +]); + +var msg4453 = msg("2277", dup265); + +var msg4454 = msg("2277:01", dup266); + +var select2165 = linear_select([ + msg4453, + msg4454, +]); + +var msg4455 = msg("2278", dup265); + +var msg4456 = msg("2278:01", dup266); + +var select2166 = linear_select([ + msg4455, + msg4456, +]); + +var msg4457 = msg("2279", dup265); + +var msg4458 = msg("2279:01", dup266); + +var select2167 = linear_select([ + msg4457, + msg4458, +]); + +var msg4459 = msg("2280", dup265); + +var msg4460 = msg("2280:01", dup266); + +var select2168 = linear_select([ + msg4459, + msg4460, +]); + +var msg4461 = msg("2281", dup265); + +var msg4462 = msg("2281:01", dup266); + +var select2169 = linear_select([ + msg4461, + msg4462, +]); + +var msg4463 = msg("2282", dup265); + +var msg4464 = msg("2282:01", dup266); + +var select2170 = linear_select([ + msg4463, + msg4464, +]); + +var msg4465 = msg("2283", dup265); + +var msg4466 = msg("2283:01", dup266); + +var select2171 = linear_select([ + msg4465, + msg4466, +]); + +var msg4467 = msg("2284", dup265); + +var msg4468 = msg("2284:01", dup266); + +var select2172 = linear_select([ + msg4467, + msg4468, +]); + +var msg4469 = msg("2285", dup265); + +var msg4470 = msg("2285:01", dup266); + +var select2173 = linear_select([ + msg4469, + msg4470, +]); + +var msg4471 = msg("2286", dup265); + +var msg4472 = msg("2286:01", dup266); + +var select2174 = linear_select([ + msg4471, + msg4472, +]); + +var msg4473 = msg("2287", dup265); + +var msg4474 = msg("2287:01", dup266); + +var select2175 = linear_select([ + msg4473, + msg4474, +]); + +var msg4475 = msg("2288", dup265); + +var msg4476 = msg("2288:01", dup266); + +var select2176 = linear_select([ + msg4475, + msg4476, +]); + +var msg4477 = msg("2289", dup265); + +var msg4478 = msg("2289:01", dup266); + +var select2177 = linear_select([ + msg4477, + msg4478, +]); + +var msg4479 = msg("2290", dup265); + +var msg4480 = msg("2290:01", dup266); + +var select2178 = linear_select([ + msg4479, + msg4480, +]); + +var msg4481 = msg("2291", dup265); + +var msg4482 = msg("2291:01", dup266); + +var select2179 = linear_select([ + msg4481, + msg4482, +]); + +var msg4483 = msg("2292", dup265); + +var msg4484 = msg("2292:01", dup266); + +var select2180 = linear_select([ + msg4483, + msg4484, +]); + +var msg4485 = msg("2293", dup265); + +var msg4486 = msg("2293:01", dup266); + +var select2181 = linear_select([ + msg4485, + msg4486, +]); + +var msg4487 = msg("2294", dup265); + +var msg4488 = msg("2294:01", dup266); + +var select2182 = linear_select([ + msg4487, + msg4488, +]); + +var msg4489 = msg("2295", dup265); + +var msg4490 = msg("2295:01", dup266); + +var select2183 = linear_select([ + msg4489, + msg4490, +]); + +var msg4491 = msg("2296", dup265); + +var msg4492 = msg("2296:01", dup266); + +var select2184 = linear_select([ + msg4491, + msg4492, +]); + +var msg4493 = msg("2297", dup265); + +var msg4494 = msg("2297:01", dup266); + +var select2185 = linear_select([ + msg4493, + msg4494, +]); + +var msg4495 = msg("2298", dup265); + +var msg4496 = msg("2298:01", dup266); + +var select2186 = linear_select([ + msg4495, + msg4496, +]); + +var msg4497 = msg("2299", dup265); + +var msg4498 = msg("2299:01", dup266); + +var select2187 = linear_select([ + msg4497, + msg4498, +]); + +var msg4499 = msg("2300", dup265); + +var msg4500 = msg("2300:01", dup266); + +var select2188 = linear_select([ + msg4499, + msg4500, +]); + +var msg4501 = msg("2301", dup265); + +var msg4502 = msg("2301:01", dup266); + +var select2189 = linear_select([ + msg4501, + msg4502, +]); + +var msg4503 = msg("2302", dup265); + +var msg4504 = msg("2302:01", dup266); + +var select2190 = linear_select([ + msg4503, + msg4504, +]); + +var msg4505 = msg("2303", dup265); + +var msg4506 = msg("2303:01", dup266); + +var select2191 = linear_select([ + msg4505, + msg4506, +]); + +var msg4507 = msg("2304", dup265); + +var msg4508 = msg("2304:01", dup266); + +var select2192 = linear_select([ + msg4507, + msg4508, +]); + +var msg4509 = msg("2305", dup265); + +var msg4510 = msg("2305:01", dup266); + +var select2193 = linear_select([ + msg4509, + msg4510, +]); + +var msg4511 = msg("2306", dup265); + +var msg4512 = msg("2306:01", dup266); + +var select2194 = linear_select([ + msg4511, + msg4512, +]); + +var msg4513 = msg("2307", dup265); + +var msg4514 = msg("2307:01", dup266); + +var select2195 = linear_select([ + msg4513, + msg4514, +]); + +var msg4515 = msg("2308", dup276); + +var msg4516 = msg("2308:01", dup277); + +var select2196 = linear_select([ + msg4515, + msg4516, +]); + +var msg4517 = msg("2309", dup276); + +var msg4518 = msg("2309:01", dup277); + +var select2197 = linear_select([ + msg4517, + msg4518, +]); + +var msg4519 = msg("2310", dup276); + +var msg4520 = msg("2310:01", dup277); + +var select2198 = linear_select([ + msg4519, + msg4520, +]); + +var msg4521 = msg("2311", dup276); + +var msg4522 = msg("2311:01", dup277); + +var select2199 = linear_select([ + msg4521, + msg4522, +]); + +var msg4523 = msg("2312", dup196); + +var msg4524 = msg("2312:01", dup217); + +var select2200 = linear_select([ + msg4523, + msg4524, +]); + +var msg4525 = msg("2313", dup196); + +var msg4526 = msg("2313:01", dup217); + +var select2201 = linear_select([ + msg4525, + msg4526, +]); + +var msg4527 = msg("2314", dup196); + +var msg4528 = msg("2314:01", dup217); + +var select2202 = linear_select([ + msg4527, + msg4528, +]); + +var msg4529 = msg("2315", dup276); + +var msg4530 = msg("2315:01", dup277); + +var select2203 = linear_select([ + msg4529, + msg4530, +]); + +var msg4531 = msg("2316", dup276); + +var msg4532 = msg("2316:01", dup277); + +var select2204 = linear_select([ + msg4531, + msg4532, +]); + +var msg4533 = msg("2317", dup196); + +var msg4534 = msg("2317:01", dup217); + +var select2205 = linear_select([ + msg4533, + msg4534, +]); + +var msg4535 = msg("2318", dup196); + +var msg4536 = msg("2318:01", dup217); + +var select2206 = linear_select([ + msg4535, + msg4536, +]); + +var msg4537 = msg("2319", dup222); + +var msg4538 = msg("2319:01", dup223); + +var select2207 = linear_select([ + msg4537, + msg4538, +]); + +var msg4539 = msg("2320", dup222); + +var msg4540 = msg("2320:01", dup223); + +var select2208 = linear_select([ + msg4539, + msg4540, +]); + +var msg4541 = msg("2321", dup265); + +var msg4542 = msg("2321:01", dup266); + +var select2209 = linear_select([ + msg4541, + msg4542, +]); + +var msg4543 = msg("2322", dup265); + +var msg4544 = msg("2322:01", dup266); + +var select2210 = linear_select([ + msg4543, + msg4544, +]); + +var msg4545 = msg("2323", dup265); + +var msg4546 = msg("2323:01", dup266); + +var select2211 = linear_select([ + msg4545, + msg4546, +]); + +var msg4547 = msg("2324", dup265); + +var msg4548 = msg("2324:01", dup266); + +var select2212 = linear_select([ + msg4547, + msg4548, +]); + +var msg4549 = msg("2325", dup265); + +var msg4550 = msg("2325:01", dup266); + +var select2213 = linear_select([ + msg4549, + msg4550, +]); + +var msg4551 = msg("2326", dup265); + +var msg4552 = msg("2326:01", dup266); + +var select2214 = linear_select([ + msg4551, + msg4552, +]); + +var msg4553 = msg("2327", dup265); + +var msg4554 = msg("2327:01", dup266); + +var select2215 = linear_select([ + msg4553, + msg4554, +]); + +var msg4555 = msg("2328", dup265); + +var msg4556 = msg("2328:01", dup266); + +var select2216 = linear_select([ + msg4555, + msg4556, +]); + +var msg4557 = msg("2329", dup260); + +var msg4558 = msg("2329:01", dup261); + +var select2217 = linear_select([ + msg4557, + msg4558, +]); + +var msg4559 = msg("2330", dup222); + +var msg4560 = msg("2330:01", dup223); + +var select2218 = linear_select([ + msg4559, + msg4560, +]); + +var msg4561 = msg("2331", dup265); + +var msg4562 = msg("2331:01", dup266); + +var select2219 = linear_select([ + msg4561, + msg4562, +]); + +var msg4563 = msg("2332", dup227); + +var msg4564 = msg("2332:01", dup228); + +var select2220 = linear_select([ + msg4563, + msg4564, +]); + +var msg4565 = msg("2333", dup227); + +var msg4566 = msg("2333:01", dup228); + +var select2221 = linear_select([ + msg4565, + msg4566, +]); + +var msg4567 = msg("2334", dup227); + +var msg4568 = msg("2334:01", dup228); + +var select2222 = linear_select([ + msg4567, + msg4568, +]); + +var msg4569 = msg("2335", dup227); + +var msg4570 = msg("2335:01", dup228); + +var select2223 = linear_select([ + msg4569, + msg4570, +]); + +var msg4571 = msg("2336", dup274); + +var msg4572 = msg("2336:01", dup275); + +var select2224 = linear_select([ + msg4571, + msg4572, +]); + +var msg4573 = msg("2337", dup295); + +var msg4574 = msg("2337:01", dup296); + +var select2225 = linear_select([ + msg4573, + msg4574, +]); + +var msg4575 = msg("2338", dup222); + +var msg4576 = msg("2338:01", dup223); + +var select2226 = linear_select([ + msg4575, + msg4576, +]); + +var msg4577 = msg("2339", dup274); + +var msg4578 = msg("2339:01", dup275); + +var select2227 = linear_select([ + msg4577, + msg4578, +]); + +var msg4579 = msg("2340", dup222); + +var msg4580 = msg("2340:01", dup223); + +var select2228 = linear_select([ + msg4579, + msg4580, +]); + +var msg4581 = msg("2341", dup265); + +var msg4582 = msg("2341:01", dup266); + +var select2229 = linear_select([ + msg4581, + msg4582, +]); + +var msg4583 = msg("2342", dup265); + +var msg4584 = msg("2342:01", dup266); + +var select2230 = linear_select([ + msg4583, + msg4584, +]); + +var msg4585 = msg("2343", dup222); + +var msg4586 = msg("2343:01", dup223); + +var select2231 = linear_select([ + msg4585, + msg4586, +]); + +var msg4587 = msg("2344", dup222); + +var msg4588 = msg("2344:01", dup223); + +var select2232 = linear_select([ + msg4587, + msg4588, +]); + +var msg4589 = msg("2345", dup265); + +var msg4590 = msg("2345:01", dup266); + +var select2233 = linear_select([ + msg4589, + msg4590, +]); + +var msg4591 = msg("2346", dup265); + +var msg4592 = msg("2346:01", dup266); + +var select2234 = linear_select([ + msg4591, + msg4592, +]); + +var msg4593 = msg("2347", dup265); + +var msg4594 = msg("2347:01", dup266); + +var select2235 = linear_select([ + msg4593, + msg4594, +]); + +var msg4595 = msg("2348", dup276); + +var msg4596 = msg("2348:01", dup277); + +var select2236 = linear_select([ + msg4595, + msg4596, +]); + +var msg4597 = msg("2349", dup276); + +var msg4598 = msg("2349:01", dup277); + +var select2237 = linear_select([ + msg4597, + msg4598, +]); + +var msg4599 = msg("2350", dup276); + +var msg4600 = msg("2350:01", dup277); + +var select2238 = linear_select([ + msg4599, + msg4600, +]); + +var msg4601 = msg("2351", dup276); + +var msg4602 = msg("2351:01", dup277); + +var select2239 = linear_select([ + msg4601, + msg4602, +]); + +var msg4603 = msg("2352", dup276); + +var msg4604 = msg("2352:01", dup277); + +var select2240 = linear_select([ + msg4603, + msg4604, +]); + +var msg4605 = msg("2353", dup196); + +var msg4606 = msg("2353:01", dup217); + +var select2241 = linear_select([ + msg4605, + msg4606, +]); + +var msg4607 = msg("2354", dup196); + +var msg4608 = msg("2354:01", dup217); + +var select2242 = linear_select([ + msg4607, + msg4608, +]); + +var msg4609 = msg("2355", dup196); + +var msg4610 = msg("2355:01", dup217); + +var select2243 = linear_select([ + msg4609, + msg4610, +]); + +var msg4611 = msg("2356", dup196); + +var msg4612 = msg("2356:01", dup217); + +var select2244 = linear_select([ + msg4611, + msg4612, +]); + +var msg4613 = msg("2357", dup196); + +var msg4614 = msg("2357:01", dup217); + +var select2245 = linear_select([ + msg4613, + msg4614, +]); + +var msg4615 = msg("2358", dup196); + +var msg4616 = msg("2358:01", dup217); + +var select2246 = linear_select([ + msg4615, + msg4616, +]); + +var msg4617 = msg("2359", dup196); + +var msg4618 = msg("2359:01", dup217); + +var select2247 = linear_select([ + msg4617, + msg4618, +]); + +var msg4619 = msg("2360", dup196); + +var msg4620 = msg("2360:01", dup217); + +var select2248 = linear_select([ + msg4619, + msg4620, +]); + +var msg4621 = msg("2361", dup196); + +var msg4622 = msg("2361:01", dup217); + +var select2249 = linear_select([ + msg4621, + msg4622, +]); + +var msg4623 = msg("2362", dup196); + +var msg4624 = msg("2362:01", dup217); + +var select2250 = linear_select([ + msg4623, + msg4624, +]); + +var msg4625 = msg("2363", dup265); + +var msg4626 = msg("2363:01", dup266); + +var select2251 = linear_select([ + msg4625, + msg4626, +]); + +var msg4627 = msg("2364", dup265); + +var msg4628 = msg("2364:01", dup266); + +var select2252 = linear_select([ + msg4627, + msg4628, +]); + +var msg4629 = msg("2365", dup265); + +var msg4630 = msg("2365:01", dup266); + +var select2253 = linear_select([ + msg4629, + msg4630, +]); + +var msg4631 = msg("2366", dup265); + +var msg4632 = msg("2366:01", dup266); + +var select2254 = linear_select([ + msg4631, + msg4632, +]); + +var msg4633 = msg("2367", dup265); + +var msg4634 = msg("2367:01", dup266); + +var select2255 = linear_select([ + msg4633, + msg4634, +]); + +var msg4635 = msg("2368", dup265); + +var msg4636 = msg("2368:01", dup266); + +var select2256 = linear_select([ + msg4635, + msg4636, +]); + +var msg4637 = msg("2369", dup265); + +var msg4638 = msg("2369:01", dup266); + +var select2257 = linear_select([ + msg4637, + msg4638, +]); + +var msg4639 = msg("2370", dup265); + +var msg4640 = msg("2370:01", dup266); + +var select2258 = linear_select([ + msg4639, + msg4640, +]); + +var msg4641 = msg("2371", dup265); + +var msg4642 = msg("2371:01", dup266); + +var select2259 = linear_select([ + msg4641, + msg4642, +]); + +var msg4643 = msg("2372", dup265); + +var msg4644 = msg("2372:01", dup266); + +var select2260 = linear_select([ + msg4643, + msg4644, +]); + +var msg4645 = msg("2373", dup222); + +var msg4646 = msg("2373:01", dup266); + +var select2261 = linear_select([ + msg4645, + msg4646, +]); + +var msg4647 = msg("2374", dup222); + +var msg4648 = msg("2374:01", dup266); + +var select2262 = linear_select([ + msg4647, + msg4648, +]); + +var msg4649 = msg("2375", dup192); + +var msg4650 = msg("2375:01", dup266); + +var select2263 = linear_select([ + msg4649, + msg4650, +]); + +var msg4651 = msg("2376", dup222); + +var msg4652 = msg("2376:01", dup266); + +var select2264 = linear_select([ + msg4651, + msg4652, +]); + +var msg4653 = msg("2377", dup222); + +var msg4654 = msg("2377:01", dup217); + +var select2265 = linear_select([ + msg4653, + msg4654, +]); + +var msg4655 = msg("2378", dup222); + +var msg4656 = msg("2378:01", dup266); + +var select2266 = linear_select([ + msg4655, + msg4656, +]); + +var msg4657 = msg("2379", dup222); + +var msg4658 = msg("2379:01", dup266); + +var select2267 = linear_select([ + msg4657, + msg4658, +]); + +var msg4659 = msg("2380", dup222); + +var msg4660 = msg("2380:01", dup217); + +var select2268 = linear_select([ + msg4659, + msg4660, +]); + +var msg4661 = msg("2381", dup267); + +var msg4662 = msg("2381:01", dup268); + +var select2269 = linear_select([ + msg4661, + msg4662, +]); + +var msg4663 = msg("2382", dup276); + +var msg4664 = msg("2382:01", dup266); + +var select2270 = linear_select([ + msg4663, + msg4664, +]); + +var msg4665 = msg("2383", dup276); + +var msg4666 = msg("2383:01", dup266); + +var select2271 = linear_select([ + msg4665, + msg4666, +]); + +var msg4667 = msg("2384", dup276); + +var msg4668 = msg("2384:01", dup266); + +var select2272 = linear_select([ + msg4667, + msg4668, +]); + +var msg4669 = msg("2385", dup276); + +var msg4670 = msg("2385:01", dup266); + +var select2273 = linear_select([ + msg4669, + msg4670, +]); + +var msg4671 = msg("2386", dup194); + +var msg4672 = msg("2386:01", dup266); + +var select2274 = linear_select([ + msg4671, + msg4672, +]); + +var msg4673 = msg("2387", dup265); + +var msg4674 = msg("2387:01", dup266); + +var select2275 = linear_select([ + msg4673, + msg4674, +]); + +var msg4675 = msg("2388", dup265); + +var msg4676 = msg("2388:01", dup266); + +var select2276 = linear_select([ + msg4675, + msg4676, +]); + +var msg4677 = msg("2389", dup222); + +var msg4678 = msg("2389:01", dup266); + +var select2277 = linear_select([ + msg4677, + msg4678, +]); + +var msg4679 = msg("2390", dup222); + +var msg4680 = msg("2390:01", dup266); + +var select2278 = linear_select([ + msg4679, + msg4680, +]); + +var msg4681 = msg("2391", dup222); + +var msg4682 = msg("2391:01", dup266); + +var select2279 = linear_select([ + msg4681, + msg4682, +]); + +var msg4683 = msg("2392", dup222); + +var msg4684 = msg("2392:01", dup266); + +var select2280 = linear_select([ + msg4683, + msg4684, +]); + +var msg4685 = msg("2393", dup265); + +var msg4686 = msg("2393:01", dup266); + +var select2281 = linear_select([ + msg4685, + msg4686, +]); + +var msg4687 = msg("2394", dup198); + +var msg4688 = msg("2394:01", dup266); + +var select2282 = linear_select([ + msg4687, + msg4688, +]); + +var msg4689 = msg("2395", dup265); + +var msg4690 = msg("2395:01", dup266); + +var select2283 = linear_select([ + msg4689, + msg4690, +]); + +var msg4691 = msg("2396", dup269); + +var msg4692 = msg("2396:01", dup266); + +var select2284 = linear_select([ + msg4691, + msg4692, +]); + +var msg4693 = msg("2397", dup265); + +var msg4694 = msg("2397:01", dup266); + +var select2285 = linear_select([ + msg4693, + msg4694, +]); + +var msg4695 = msg("2398", dup265); + +var msg4696 = msg("2398:01", dup266); + +var select2286 = linear_select([ + msg4695, + msg4696, +]); + +var msg4697 = msg("2399", dup265); + +var msg4698 = msg("2399:01", dup300); + +var select2287 = linear_select([ + msg4697, + msg4698, +]); + +var msg4699 = msg("2400", dup265); + +var msg4700 = msg("2400:01", dup266); + +var select2288 = linear_select([ + msg4699, + msg4700, +]); + +var msg4701 = msg("2401", dup276); + +var msg4702 = msg("2401:01", dup266); + +var select2289 = linear_select([ + msg4701, + msg4702, +]); + +var msg4703 = msg("2402", dup276); + +var msg4704 = msg("2402:01", dup277); + +var select2290 = linear_select([ + msg4703, + msg4704, +]); + +var msg4705 = msg("2403", dup276); + +var msg4706 = msg("2403:01", dup266); + +var select2291 = linear_select([ + msg4705, + msg4706, +]); + +var msg4707 = msg("2404", dup276); + +var msg4708 = msg("2404:01", dup266); + +var select2292 = linear_select([ + msg4707, + msg4708, +]); + +var msg4709 = msg("2405", dup265); + +var msg4710 = msg("2405:01", dup266); + +var select2293 = linear_select([ + msg4709, + msg4710, +]); + +var msg4711 = msg("2406", dup248); + +var msg4712 = msg("2406:01", dup266); + +var select2294 = linear_select([ + msg4711, + msg4712, +]); + +var msg4713 = msg("2407", dup265); + +var msg4714 = msg("2407:01", dup266); + +var select2295 = linear_select([ + msg4713, + msg4714, +]); + +var msg4715 = msg("2408", dup265); + +var msg4716 = msg("2408:01", dup266); + +var select2296 = linear_select([ + msg4715, + msg4716, +]); + +var msg4717 = msg("2409", dup222); + +var msg4718 = msg("2409:01", dup268); + +var select2297 = linear_select([ + msg4717, + msg4718, +]); + +var msg4719 = msg("2410", dup265); + +var msg4720 = msg("2410:01", dup229); + +var select2298 = linear_select([ + msg4719, + msg4720, +]); + +var msg4721 = msg("2411", dup267); + +var msg4722 = msg("2411:01", dup266); + +var select2299 = linear_select([ + msg4721, + msg4722, +]); + +var msg4723 = msg("2412", dup287); + +var msg4724 = msg("2412:01", dup266); + +var select2300 = linear_select([ + msg4723, + msg4724, +]); + +var msg4725 = msg("2413", dup196); + +var msg4726 = msg("2413:01", dup266); + +var select2301 = linear_select([ + msg4725, + msg4726, +]); + +var msg4727 = msg("2414", dup196); + +var msg4728 = msg("2414:01", dup266); + +var select2302 = linear_select([ + msg4727, + msg4728, +]); + +var msg4729 = msg("2415", dup196); + +var msg4730 = msg("2415:01", dup266); + +var select2303 = linear_select([ + msg4729, + msg4730, +]); + +var msg4731 = msg("2416", dup227); + +var msg4732 = msg("2416:01", dup266); + +var select2304 = linear_select([ + msg4731, + msg4732, +]); + +var msg4733 = msg("2417", dup227); + +var msg4734 = msg("2417:01", dup266); + +var select2305 = linear_select([ + msg4733, + msg4734, +]); + +var msg4735 = msg("2418", dup196); + +var msg4736 = msg("2418:01", dup266); + +var select2306 = linear_select([ + msg4735, + msg4736, +]); + +var msg4737 = msg("2419", dup196); + +var msg4738 = msg("2419:01", dup266); + +var select2307 = linear_select([ + msg4737, + msg4738, +]); + +var msg4739 = msg("2420", dup196); + +var msg4740 = msg("2420:01", dup266); + +var select2308 = linear_select([ + msg4739, + msg4740, +]); + +var msg4741 = msg("2421", dup196); + +var msg4742 = msg("2421:01", dup270); + +var select2309 = linear_select([ + msg4741, + msg4742, +]); + +var msg4743 = msg("2422", dup196); + +var msg4744 = msg("2422:01", dup266); + +var select2310 = linear_select([ + msg4743, + msg4744, +]); + +var msg4745 = msg("2423", dup196); + +var msg4746 = msg("2423:01", dup217); + +var select2311 = linear_select([ + msg4745, + msg4746, +]); + +var msg4747 = msg("2424", dup222); + +var msg4748 = msg("2424:01", dup223); + +var select2312 = linear_select([ + msg4747, + msg4748, +]); + +var msg4749 = msg("2425", dup222); + +var msg4750 = msg("2425:01", dup223); + +var select2313 = linear_select([ + msg4749, + msg4750, +]); + +var msg4751 = msg("2426", dup222); + +var msg4752 = msg("2426:01", dup266); + +var select2314 = linear_select([ + msg4751, + msg4752, +]); + +var msg4753 = msg("2427", dup222); + +var msg4754 = msg("2427:01", dup266); + +var select2315 = linear_select([ + msg4753, + msg4754, +]); + +var msg4755 = msg("2428", dup222); + +var msg4756 = msg("2428:01", dup266); + +var select2316 = linear_select([ + msg4755, + msg4756, +]); + +var msg4757 = msg("2429", dup222); + +var msg4758 = msg("2429:01", dup266); + +var select2317 = linear_select([ + msg4757, + msg4758, +]); + +var msg4759 = msg("2430", dup222); + +var msg4760 = msg("2430:01", dup266); + +var select2318 = linear_select([ + msg4759, + msg4760, +]); + +var msg4761 = msg("2431", dup222); + +var msg4762 = msg("2431:01", dup266); + +var select2319 = linear_select([ + msg4761, + msg4762, +]); + +var all45 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + setc("eventcategory","1001030303"), + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg4763 = msg("2432", all45); + +var msg4764 = msg("2432:01", dup266); + +var select2320 = linear_select([ + msg4763, + msg4764, +]); + +var msg4765 = msg("2433", dup267); + +var msg4766 = msg("2433:01", dup266); + +var select2321 = linear_select([ + msg4765, + msg4766, +]); + +var msg4767 = msg("2434", dup265); + +var msg4768 = msg("2434:01", dup266); + +var select2322 = linear_select([ + msg4767, + msg4768, +]); + +var msg4769 = msg("2435", dup265); + +var msg4770 = msg("2435:01", dup266); + +var select2323 = linear_select([ + msg4769, + msg4770, +]); + +var msg4771 = msg("2436", dup265); + +var msg4772 = msg("2436:01", dup266); + +var select2324 = linear_select([ + msg4771, + msg4772, +]); + +var msg4773 = msg("2437", dup265); + +var msg4774 = msg("2437:01", dup266); + +var select2325 = linear_select([ + msg4773, + msg4774, +]); + +var msg4775 = msg("2438", dup267); + +var msg4776 = msg("2438:01", dup266); + +var select2326 = linear_select([ + msg4775, + msg4776, +]); + +var msg4777 = msg("2439", dup267); + +var msg4778 = msg("2439:01", dup266); + +var select2327 = linear_select([ + msg4777, + msg4778, +]); + +var msg4779 = msg("2440", dup267); + +var msg4780 = msg("2440:01", dup266); + +var select2328 = linear_select([ + msg4779, + msg4780, +]); + +var msg4781 = msg("2441", dup285); + +var msg4782 = msg("2441:01", dup266); + +var select2329 = linear_select([ + msg4781, + msg4782, +]); + +var msg4783 = msg("2442", dup267); + +var msg4784 = msg("2442:01", dup266); + +var select2330 = linear_select([ + msg4783, + msg4784, +]); + +var msg4785 = msg("2443", dup222); + +var msg4786 = msg("2443:01", dup266); + +var select2331 = linear_select([ + msg4785, + msg4786, +]); + +var msg4787 = msg("2444", dup222); + +var msg4788 = msg("2444:01", dup266); + +var select2332 = linear_select([ + msg4787, + msg4788, +]); + +var msg4789 = msg("2445", dup222); + +var msg4790 = msg("2445:01", dup266); + +var select2333 = linear_select([ + msg4789, + msg4790, +]); + +var msg4791 = msg("2446", dup222); + +var msg4792 = msg("2446:01", dup223); + +var select2334 = linear_select([ + msg4791, + msg4792, +]); + +var msg4793 = msg("2447", dup265); + +var msg4794 = msg("2447:01", dup266); + +var select2335 = linear_select([ + msg4793, + msg4794, +]); + +var msg4795 = msg("2448", dup265); + +var msg4796 = msg("2448:01", dup266); + +var select2336 = linear_select([ + msg4795, + msg4796, +]); + +var msg4797 = msg("2449", dup222); + +var msg4798 = msg("2449:01", dup266); + +var select2337 = linear_select([ + msg4797, + msg4798, +]); + +var msg4799 = msg("2450", dup301); + +var msg4800 = msg("2450:01", dup266); + +var select2338 = linear_select([ + msg4799, + msg4800, +]); + +var msg4801 = msg("2451", dup196); + +var msg4802 = msg("2451:01", dup266); + +var select2339 = linear_select([ + msg4801, + msg4802, +]); + +var msg4803 = msg("2452", dup196); + +var msg4804 = msg("2452:01", dup266); + +var select2340 = linear_select([ + msg4803, + msg4804, +]); + +var msg4805 = msg("2453", dup196); + +var msg4806 = msg("2453:01", dup266); + +var select2341 = linear_select([ + msg4805, + msg4806, +]); + +var msg4807 = msg("2454", dup301); + +var msg4808 = msg("2454:01", dup266); + +var select2342 = linear_select([ + msg4807, + msg4808, +]); + +var msg4809 = msg("2455", dup196); + +var msg4810 = msg("2455:01", dup266); + +var select2343 = linear_select([ + msg4809, + msg4810, +]); + +var msg4811 = msg("2456", dup196); + +var msg4812 = msg("2456:01", dup217); + +var select2344 = linear_select([ + msg4811, + msg4812, +]); + +var msg4813 = msg("2457", dup196); + +var msg4814 = msg("2457:01", dup217); + +var select2345 = linear_select([ + msg4813, + msg4814, +]); + +var msg4815 = msg("2458", dup196); + +var msg4816 = msg("2458:01", dup217); + +var select2346 = linear_select([ + msg4815, + msg4816, +]); + +var msg4817 = msg("2459", dup196); + +var msg4818 = msg("2459:01", dup266); + +var select2347 = linear_select([ + msg4817, + msg4818, +]); + +var msg4819 = msg("2460", dup196); + +var msg4820 = msg("2460:01", dup270); + +var select2348 = linear_select([ + msg4819, + msg4820, +]); + +var msg4821 = msg("2461", dup196); + +var msg4822 = msg("2461:01", dup241); + +var select2349 = linear_select([ + msg4821, + msg4822, +]); + +var msg4823 = msg("2462", dup222); + +var msg4824 = msg("2462:01", dup266); + +var select2350 = linear_select([ + msg4823, + msg4824, +]); + +var msg4825 = msg("2463", dup222); + +var msg4826 = msg("2463:01", dup266); + +var select2351 = linear_select([ + msg4825, + msg4826, +]); + +var msg4827 = msg("2464", dup222); + +var msg4828 = msg("2464:01", dup266); + +var select2352 = linear_select([ + msg4827, + msg4828, +]); + +var msg4829 = msg("2465", dup246); + +var msg4830 = msg("2465:01", dup266); + +var select2353 = linear_select([ + msg4829, + msg4830, +]); + +var msg4831 = msg("2466", dup246); + +var msg4832 = msg("2466:01", dup286); + +var select2354 = linear_select([ + msg4831, + msg4832, +]); + +var msg4833 = msg("2467", dup246); + +var msg4834 = msg("2467:01", dup247); + +var select2355 = linear_select([ + msg4833, + msg4834, +]); + +var msg4835 = msg("2468", dup246); + +var msg4836 = msg("2468:01", dup247); + +var select2356 = linear_select([ + msg4835, + msg4836, +]); + +var msg4837 = msg("2469", dup246); + +var msg4838 = msg("2469:01", dup247); + +var select2357 = linear_select([ + msg4837, + msg4838, +]); + +var msg4839 = msg("2470", dup246); + +var msg4840 = msg("2470:01", dup247); + +var select2358 = linear_select([ + msg4839, + msg4840, +]); + +var msg4841 = msg("2471", dup246); + +var msg4842 = msg("2471:01", dup247); + +var select2359 = linear_select([ + msg4841, + msg4842, +]); + +var msg4843 = msg("2472", dup246); + +var msg4844 = msg("2472:01", dup247); + +var select2360 = linear_select([ + msg4843, + msg4844, +]); + +var msg4845 = msg("2473", dup246); + +var msg4846 = msg("2473:01", dup247); + +var select2361 = linear_select([ + msg4845, + msg4846, +]); + +var msg4847 = msg("2474", dup246); + +var msg4848 = msg("2474:01", dup247); + +var select2362 = linear_select([ + msg4847, + msg4848, +]); + +var msg4849 = msg("2475", dup246); + +var msg4850 = msg("2475:01", dup247); + +var select2363 = linear_select([ + msg4849, + msg4850, +]); + +var msg4851 = msg("2476", dup276); + +var msg4852 = msg("2476:01", dup277); + +var select2364 = linear_select([ + msg4851, + msg4852, +]); + +var msg4853 = msg("2477", dup276); + +var msg4854 = msg("2477:01", dup277); + +var select2365 = linear_select([ + msg4853, + msg4854, +]); + +var msg4855 = msg("2478", dup276); + +var msg4856 = msg("2478:01", dup277); + +var select2366 = linear_select([ + msg4855, + msg4856, +]); + +var msg4857 = msg("2479", dup276); + +var msg4858 = msg("2479:01", dup277); + +var select2367 = linear_select([ + msg4857, + msg4858, +]); + +var msg4859 = msg("2480", dup276); + +var msg4860 = msg("2480:01", dup277); + +var select2368 = linear_select([ + msg4859, + msg4860, +]); + +var msg4861 = msg("2481", dup276); + +var msg4862 = msg("2481:01", dup277); + +var select2369 = linear_select([ + msg4861, + msg4862, +]); + +var msg4863 = msg("2482", dup276); + +var msg4864 = msg("2482:01", dup277); + +var select2370 = linear_select([ + msg4863, + msg4864, +]); + +var msg4865 = msg("2483", dup276); + +var msg4866 = msg("2483:01", dup277); + +var select2371 = linear_select([ + msg4865, + msg4866, +]); + +var msg4867 = msg("2484", dup265); + +var msg4868 = msg("2484:01", dup266); + +var select2372 = linear_select([ + msg4867, + msg4868, +]); + +var msg4869 = msg("2485", dup194); + +var msg4870 = msg("2485:01", dup229); + +var select2373 = linear_select([ + msg4869, + msg4870, +]); + +var msg4871 = msg("2486", dup198); + +var msg4872 = msg("2486:01", dup220); + +var select2374 = linear_select([ + msg4871, + msg4872, +]); + +var msg4873 = msg("2487", dup297); + +var msg4874 = msg("2487:01", dup300); + +var select2375 = linear_select([ + msg4873, + msg4874, +]); + +var msg4875 = msg("2488", dup197); + +var msg4876 = msg("2488:01", dup221); + +var select2376 = linear_select([ + msg4875, + msg4876, +]); + +var msg4877 = msg("2489", dup222); + +var msg4878 = msg("2489:01", dup223); + +var select2377 = linear_select([ + msg4877, + msg4878, +]); + +var msg4879 = msg("2490", dup222); + +var msg4880 = msg("2490:01", dup223); + +var select2378 = linear_select([ + msg4879, + msg4880, +]); + +var msg4881 = msg("2491", dup276); + +var msg4882 = msg("2491:01", dup277); + +var select2379 = linear_select([ + msg4881, + msg4882, +]); + +var msg4883 = msg("2492", dup276); + +var msg4884 = msg("2492:01", dup277); + +var select2380 = linear_select([ + msg4883, + msg4884, +]); + +var msg4885 = msg("2493", dup276); + +var msg4886 = msg("2493:01", dup277); + +var select2381 = linear_select([ + msg4885, + msg4886, +]); + +var msg4887 = msg("2494", dup276); + +var msg4888 = msg("2494:01", dup277); + +var select2382 = linear_select([ + msg4887, + msg4888, +]); + +var msg4889 = msg("2495", dup276); + +var msg4890 = msg("2495:01", dup277); + +var select2383 = linear_select([ + msg4889, + msg4890, +]); + +var msg4891 = msg("2496", dup276); + +var msg4892 = msg("2496:01", dup277); + +var select2384 = linear_select([ + msg4891, + msg4892, +]); + +var msg4893 = msg("2497", dup196); + +var msg4894 = msg("2497:01", dup217); + +var select2385 = linear_select([ + msg4893, + msg4894, +]); + +var msg4895 = msg("2498", dup196); + +var msg4896 = msg("2498:01", dup217); + +var select2386 = linear_select([ + msg4895, + msg4896, +]); + +var msg4897 = msg("2499", dup196); + +var msg4898 = msg("2499:01", dup217); + +var select2387 = linear_select([ + msg4897, + msg4898, +]); + +var msg4899 = msg("2500", dup298); + +var msg4900 = msg("2500:01", dup299); + +var select2388 = linear_select([ + msg4899, + msg4900, +]); + +var msg4901 = msg("2501", dup298); + +var msg4902 = msg("2501:01", dup299); + +var select2389 = linear_select([ + msg4901, + msg4902, +]); + +var msg4903 = msg("2502", dup298); + +var msg4904 = msg("2502:01", dup299); + +var select2390 = linear_select([ + msg4903, + msg4904, +]); + +var msg4905 = msg("2503", dup250); + +var msg4906 = msg("2503:01", dup251); + +var select2391 = linear_select([ + msg4905, + msg4906, +]); + +var msg4907 = msg("2504", dup250); + +var msg4908 = msg("2504:01", dup251); + +var select2392 = linear_select([ + msg4907, + msg4908, +]); + +var msg4909 = msg("2505", dup265); + +var msg4910 = msg("2505:01", dup266); + +var select2393 = linear_select([ + msg4909, + msg4910, +]); + +var msg4911 = msg("2506", dup265); + +var msg4912 = msg("2506:01", dup266); + +var select2394 = linear_select([ + msg4911, + msg4912, +]); + +var msg4913 = msg("2507", dup276); + +var msg4914 = msg("2507:01", dup277); + +var select2395 = linear_select([ + msg4913, + msg4914, +]); + +var msg4915 = msg("2508", dup276); + +var msg4916 = msg("2508:01", dup277); + +var select2396 = linear_select([ + msg4915, + msg4916, +]); + +var msg4917 = msg("2509", dup276); + +var msg4918 = msg("2509:01", dup277); + +var select2397 = linear_select([ + msg4917, + msg4918, +]); + +var msg4919 = msg("2510", dup276); + +var msg4920 = msg("2510:01", dup277); + +var select2398 = linear_select([ + msg4919, + msg4920, +]); + +var msg4921 = msg("2511", dup276); + +var msg4922 = msg("2511:01", dup277); + +var select2399 = linear_select([ + msg4921, + msg4922, +]); + +var msg4923 = msg("2512", dup276); + +var msg4924 = msg("2512:01", dup277); + +var select2400 = linear_select([ + msg4923, + msg4924, +]); + +var msg4925 = msg("2513", dup276); + +var msg4926 = msg("2513:01", dup277); + +var select2401 = linear_select([ + msg4925, + msg4926, +]); + +var msg4927 = msg("2514", dup276); + +var msg4928 = msg("2514:01", dup277); + +var select2402 = linear_select([ + msg4927, + msg4928, +]); + +var msg4929 = msg("2515", dup267); + +var msg4930 = msg("2515:01", dup268); + +var select2403 = linear_select([ + msg4929, + msg4930, +]); + +var msg4931 = msg("2516", dup222); + +var msg4932 = msg("2516:01", dup223); + +var select2404 = linear_select([ + msg4931, + msg4932, +]); + +var msg4933 = msg("2517", dup222); + +var msg4934 = msg("2517:01", dup223); + +var select2405 = linear_select([ + msg4933, + msg4934, +]); + +var msg4935 = msg("2518", dup222); + +var msg4936 = msg("2518:01", dup223); + +var select2406 = linear_select([ + msg4935, + msg4936, +]); + +var msg4937 = msg("2519", dup222); + +var msg4938 = msg("2519:01", dup223); + +var select2407 = linear_select([ + msg4937, + msg4938, +]); + +var msg4939 = msg("2520", dup265); + +var msg4940 = msg("2520:01", dup266); + +var select2408 = linear_select([ + msg4939, + msg4940, +]); + +var msg4941 = msg("2521", dup265); + +var msg4942 = msg("2521:01", dup266); + +var select2409 = linear_select([ + msg4941, + msg4942, +]); + +var msg4943 = msg("2522", dup265); + +var msg4944 = msg("2522:01", dup266); + +var select2410 = linear_select([ + msg4943, + msg4944, +]); + +var msg4945 = msg("2523", dup198); + +var msg4946 = msg("2523:01", dup220); + +var select2411 = linear_select([ + msg4945, + msg4946, +]); + +var msg4947 = msg("2524", dup276); + +var msg4948 = msg("2524:01", dup277); + +var select2412 = linear_select([ + msg4947, + msg4948, +]); + +var msg4949 = msg("2525", dup276); + +var msg4950 = msg("2525:01", dup277); + +var select2413 = linear_select([ + msg4949, + msg4950, +]); + +var msg4951 = msg("2526", dup276); + +var msg4952 = msg("2526:01", dup277); + +var select2414 = linear_select([ + msg4951, + msg4952, +]); + +var msg4953 = msg("2527", dup250); + +var msg4954 = msg("2527:01", dup251); + +var select2415 = linear_select([ + msg4953, + msg4954, +]); + +var msg4955 = msg("2528", dup222); + +var msg4956 = msg("2528:01", dup223); + +var select2416 = linear_select([ + msg4955, + msg4956, +]); + +var msg4957 = msg("2529", dup196); + +var msg4958 = msg("2529:01", dup217); + +var select2417 = linear_select([ + msg4957, + msg4958, +]); + +var msg4959 = msg("2530", dup196); + +var msg4960 = msg("2530:01", dup217); + +var select2418 = linear_select([ + msg4959, + msg4960, +]); + +var msg4961 = msg("2531", dup196); + +var msg4962 = msg("2531:01", dup217); + +var select2419 = linear_select([ + msg4961, + msg4962, +]); + +var msg4963 = msg("2532", dup298); + +var msg4964 = msg("2532:01", dup299); + +var select2420 = linear_select([ + msg4963, + msg4964, +]); + +var msg4965 = msg("2533", dup298); + +var msg4966 = msg("2533:01", dup299); + +var select2421 = linear_select([ + msg4965, + msg4966, +]); + +var msg4967 = msg("2534", dup298); + +var msg4968 = msg("2534:01", dup299); + +var select2422 = linear_select([ + msg4967, + msg4968, +]); + +var msg4969 = msg("2535", dup298); + +var msg4970 = msg("2535:01", dup299); + +var select2423 = linear_select([ + msg4969, + msg4970, +]); + +var msg4971 = msg("2536", dup298); + +var msg4972 = msg("2536:01", dup299); + +var select2424 = linear_select([ + msg4971, + msg4972, +]); + +var msg4973 = msg("2537", dup298); + +var msg4974 = msg("2537:01", dup299); + +var select2425 = linear_select([ + msg4973, + msg4974, +]); + +var msg4975 = msg("2538", dup250); + +var msg4976 = msg("2538:01", dup251); + +var select2426 = linear_select([ + msg4975, + msg4976, +]); + +var msg4977 = msg("2539", dup250); + +var msg4978 = msg("2539:01", dup251); + +var select2427 = linear_select([ + msg4977, + msg4978, +]); + +var msg4979 = msg("2540", dup250); + +var msg4980 = msg("2540:01", dup251); + +var select2428 = linear_select([ + msg4979, + msg4980, +]); + +var msg4981 = msg("2541", dup250); + +var msg4982 = msg("2541:01", dup251); + +var select2429 = linear_select([ + msg4981, + msg4982, +]); + +var msg4983 = msg("2542", dup250); + +var msg4984 = msg("2542:01", dup251); + +var select2430 = linear_select([ + msg4983, + msg4984, +]); + +var msg4985 = msg("2543", dup250); + +var msg4986 = msg("2543:01", dup251); + +var select2431 = linear_select([ + msg4985, + msg4986, +]); + +var msg4987 = msg("2544", dup250); + +var msg4988 = msg("2544:01", dup251); + +var select2432 = linear_select([ + msg4987, + msg4988, +]); + +var msg4989 = msg("2545", dup222); + +var msg4990 = msg("2545:01", dup223); + +var select2433 = linear_select([ + msg4989, + msg4990, +]); + +var msg4991 = msg("2546", dup222); + +var msg4992 = msg("2546:01", dup223); + +var select2434 = linear_select([ + msg4991, + msg4992, +]); + +var msg4993 = msg("2547", dup196); + +var msg4994 = msg("2547:01", dup217); + +var select2435 = linear_select([ + msg4993, + msg4994, +]); + +var msg4995 = msg("2548", dup196); + +var msg4996 = msg("2548:01", dup217); + +var select2436 = linear_select([ + msg4995, + msg4996, +]); + +var msg4997 = msg("2549", dup196); + +var msg4998 = msg("2549:01", dup217); + +var select2437 = linear_select([ + msg4997, + msg4998, +]); + +var msg4999 = msg("2550", dup197); + +var msg5000 = msg("2550:01", dup221); + +var select2438 = linear_select([ + msg4999, + msg5000, +]); + +var msg5001 = msg("2551", dup222); + +var msg5002 = msg("2552", dup222); + +var msg5003 = msg("2553", dup222); + +var msg5004 = msg("2554", dup222); + +var msg5005 = msg("2555", dup222); + +var msg5006 = msg("2556", dup222); + +var msg5007 = msg("2557", dup222); + +var msg5008 = msg("2558", dup222); + +var msg5009 = msg("2559", dup222); + +var msg5010 = msg("2560", dup222); + +var msg5011 = msg("2561", dup196); + +var msg5012 = msg("2562", dup265); + +var msg5013 = msg("2563", dup276); + +var msg5014 = msg("2564", dup276); + +var msg5015 = msg("2565", dup265); + +var msg5016 = msg("2566", dup265); + +var msg5017 = msg("2567", dup265); + +var msg5018 = msg("2568", dup265); + +var msg5019 = msg("2569", dup265); + +var msg5020 = msg("2570", dup196); + +var msg5021 = msg("2571", dup265); + +var msg5022 = msg("2572", dup267); + +var msg5023 = msg("2573", dup265); + +var msg5024 = msg("2574", dup227); + +var msg5025 = msg("2575", dup265); + +var msg5026 = msg("2576", dup222); + +var msg5027 = msg("2577", dup265); + +var msg5028 = msg("2578", dup197); + +var msg5029 = msg("2579", dup197); + +var msg5030 = msg("2580", dup265); + +var msg5031 = msg("2581", dup265); + +var msg5032 = msg("2582", dup265); + +var msg5033 = msg("2583", dup222); + +var msg5034 = msg("2584", dup222); + +var msg5035 = msg("2585", dup196); + +var msg5036 = msg("2586", dup196); + +var msg5037 = msg("2587", dup196); + +var msg5038 = msg("2588", dup265); + +var msg5039 = msg("2589", dup265); + +var msg5040 = msg("2590", dup222); + +var msg5041 = msg("2590:01", dup223); + +var select2439 = linear_select([ + msg5040, + msg5041, +]); + +var msg5042 = msg("2591", dup222); + +var msg5043 = msg("2592", dup222); + +var msg5044 = msg("2593", dup222); + +var msg5045 = msg("2594", dup222); + +var msg5046 = msg("2595", dup222); + +var msg5047 = msg("2596", dup222); + +var msg5048 = msg("2597", dup267); + +var msg5049 = msg("2598", dup267); + +var msg5050 = msg("2599", dup222); + +var msg5051 = msg("2600", dup222); + +var msg5052 = msg("2601", dup222); + +var msg5053 = msg("2602", dup222); + +var msg5054 = msg("2603", dup222); + +var msg5055 = msg("2604", dup222); + +var msg5056 = msg("2605", dup222); + +var msg5057 = msg("2606", dup222); + +var msg5058 = msg("2607", dup222); + +var msg5059 = msg("2608", dup222); + +var msg5060 = msg("2609", dup222); + +var msg5061 = msg("2610", dup222); + +var msg5062 = msg("2611", dup222); + +var msg5063 = msg("2612", dup222); + +var msg5064 = msg("2613", dup222); + +var msg5065 = msg("2614", dup222); + +var msg5066 = msg("2615", dup222); + +var msg5067 = msg("2616", dup222); + +var msg5068 = msg("2617", dup222); + +var msg5069 = msg("2618", dup222); + +var msg5070 = msg("2619", dup222); + +var msg5071 = msg("2620", dup222); + +var msg5072 = msg("2621", dup222); + +var msg5073 = msg("2622", dup222); + +var msg5074 = msg("2623", dup222); + +var msg5075 = msg("2624", dup222); + +var msg5076 = msg("2625", dup222); + +var msg5077 = msg("2626", dup222); + +var msg5078 = msg("2627", dup222); + +var msg5079 = msg("2628", dup222); + +var msg5080 = msg("2629", dup222); + +var msg5081 = msg("2630", dup222); + +var msg5082 = msg("2631", dup222); + +var msg5083 = msg("2632", dup222); + +var msg5084 = msg("2633", dup222); + +var msg5085 = msg("2634", dup222); + +var msg5086 = msg("2635", dup222); + +var msg5087 = msg("2636", dup222); + +var msg5088 = msg("2637", dup222); + +var msg5089 = msg("2638", dup222); + +var msg5090 = msg("2639", dup222); + +var msg5091 = msg("2640", dup222); + +var msg5092 = msg("2641", dup222); + +var msg5093 = msg("2642", dup222); + +var msg5094 = msg("2643", dup222); + +var msg5095 = msg("2644", dup222); + +var msg5096 = msg("2645", dup222); + +var msg5097 = msg("2646", dup222); + +var msg5098 = msg("2647", dup222); + +var msg5099 = msg("2648", dup222); + +var msg5100 = msg("2649", dup222); + +var msg5101 = msg("2650", dup222); + +var msg5102 = msg("2651", dup222); + +var msg5103 = msg("2652", dup222); + +var msg5104 = msg("2653", dup222); + +var msg5105 = msg("2654", dup240); + +var msg5106 = msg("2655", dup196); + +var msg5107 = msg("2656", dup267); + +var msg5108 = msg("2657", dup267); + +var msg5109 = msg("2658", dup265); + +var msg5110 = msg("2659", dup265); + +var msg5111 = msg("2660", dup265); + +var msg5112 = msg("2661", dup265); + +var msg5113 = msg("2662", dup265); + +var msg5114 = msg("2663", dup267); + +var msg5115 = msg("2664", dup196); + +var msg5116 = msg("2665", dup196); + +var msg5117 = msg("2666", dup298); + +var msg5118 = msg("2667", dup265); + +var msg5119 = msg("2668", dup265); + +var msg5120 = msg("2669", dup265); + +var msg5121 = msg("2670", dup265); + +var msg5122 = msg("2671", dup267); + +var msg5123 = msg("2672", dup265); + +var msg5124 = msg("2673", dup267); + +var msg5125 = msg("2674", dup222); + +var msg5126 = msg("2675", dup222); + +var msg5127 = msg("2676", dup222); + +var msg5128 = msg("2677", dup222); + +var msg5129 = msg("2678", dup222); + +var msg5130 = msg("2679", dup222); + +var msg5131 = msg("2680", dup222); + +var msg5132 = msg("2681", dup222); + +var msg5133 = msg("2682", dup222); + +var msg5134 = msg("2683", dup222); + +var msg5135 = msg("2684", dup222); + +var msg5136 = msg("2685", dup222); + +var msg5137 = msg("2686", dup222); + +var msg5138 = msg("2687", dup222); + +var msg5139 = msg("2688", dup222); + +var msg5140 = msg("2689", dup222); + +var msg5141 = msg("2690", dup222); + +var msg5142 = msg("2691", dup222); + +var msg5143 = msg("2692", dup222); + +var msg5144 = msg("2693", dup222); + +var msg5145 = msg("2694", dup222); + +var msg5146 = msg("2695", dup222); + +var msg5147 = msg("2696", dup222); + +var msg5148 = msg("2697", dup222); + +var msg5149 = msg("2698", dup222); + +var msg5150 = msg("2699", dup222); + +var msg5151 = msg("2700", dup222); + +var msg5152 = msg("2701", dup260); + +var msg5153 = msg("2702", dup260); + +var msg5154 = msg("2703", dup260); + +var msg5155 = msg("2704", dup260); + +var msg5156 = msg("2705", dup267); + +var msg5157 = msg("2706", dup196); + +var msg5158 = msg("2707", dup197); + +var msg5159 = msg("2708", dup222); + +var msg5160 = msg("2709", dup222); + +var msg5161 = msg("2710", dup222); + +var msg5162 = msg("2711", dup222); + +var msg5163 = msg("2712", dup222); + +var msg5164 = msg("2713", dup222); + +var msg5165 = msg("2714", dup222); + +var msg5166 = msg("2715", dup222); + +var msg5167 = msg("2716", dup222); + +var msg5168 = msg("2717", dup222); + +var msg5169 = msg("2718", dup222); + +var msg5170 = msg("2719", dup222); + +var msg5171 = msg("2720", dup222); + +var msg5172 = msg("2721", dup222); + +var msg5173 = msg("2722", dup222); + +var msg5174 = msg("2723", dup222); + +var msg5175 = msg("2724", dup222); + +var msg5176 = msg("2725", dup222); + +var msg5177 = msg("2726", dup222); + +var msg5178 = msg("2727", dup222); + +var msg5179 = msg("2728", dup222); + +var msg5180 = msg("2729", dup222); + +var msg5181 = msg("2730", dup222); + +var msg5182 = msg("2731", dup222); + +var msg5183 = msg("2732", dup222); + +var msg5184 = msg("2733", dup222); + +var msg5185 = msg("2734", dup222); + +var msg5186 = msg("2735", dup222); + +var msg5187 = msg("2736", dup222); + +var msg5188 = msg("2737", dup222); + +var msg5189 = msg("2738", dup222); + +var msg5190 = msg("2739", dup222); + +var msg5191 = msg("2740", dup222); + +var msg5192 = msg("2741", dup222); + +var msg5193 = msg("2742", dup222); + +var msg5194 = msg("2743", dup222); + +var msg5195 = msg("2744", dup222); + +var msg5196 = msg("2745", dup222); + +var msg5197 = msg("2746", dup222); + +var msg5198 = msg("2747", dup222); + +var msg5199 = msg("2748", dup222); + +var msg5200 = msg("2749", dup222); + +var msg5201 = msg("2750", dup222); + +var msg5202 = msg("2751", dup222); + +var msg5203 = msg("2752", dup222); + +var msg5204 = msg("2753", dup222); + +var msg5205 = msg("2754", dup222); + +var msg5206 = msg("2755", dup222); + +var msg5207 = msg("2756", dup222); + +var msg5208 = msg("2757", dup222); + +var msg5209 = msg("2758", dup222); + +var msg5210 = msg("2759", dup222); + +var msg5211 = msg("2760", dup222); + +var msg5212 = msg("2761", dup222); + +var msg5213 = msg("2762", dup222); + +var msg5214 = msg("2763", dup222); + +var msg5215 = msg("2764", dup222); + +var msg5216 = msg("2765", dup222); + +var msg5217 = msg("2766", dup222); + +var msg5218 = msg("2767", dup222); + +var msg5219 = msg("2768", dup222); + +var msg5220 = msg("2769", dup222); + +var msg5221 = msg("2770", dup222); + +var msg5222 = msg("2771", dup222); + +var msg5223 = msg("2772", dup222); + +var msg5224 = msg("2773", dup222); + +var msg5225 = msg("2774", dup222); + +var msg5226 = msg("2775", dup222); + +var msg5227 = msg("2776", dup222); + +var msg5228 = msg("2777", dup222); + +var msg5229 = msg("2778", dup222); + +var msg5230 = msg("2779", dup222); + +var msg5231 = msg("2780", dup222); + +var msg5232 = msg("2781", dup222); + +var msg5233 = msg("2782", dup222); + +var msg5234 = msg("2783", dup222); + +var msg5235 = msg("2784", dup222); + +var msg5236 = msg("2785", dup222); + +var msg5237 = msg("2786", dup222); + +var msg5238 = msg("2787", dup222); + +var msg5239 = msg("2788", dup222); + +var msg5240 = msg("2789", dup222); + +var msg5241 = msg("2790", dup222); + +var msg5242 = msg("2791", dup222); + +var msg5243 = msg("2792", dup222); + +var msg5244 = msg("2793", dup222); + +var msg5245 = msg("2794", dup222); + +var msg5246 = msg("2795", dup222); + +var msg5247 = msg("2796", dup222); + +var msg5248 = msg("2797", dup222); + +var msg5249 = msg("2798", dup222); + +var msg5250 = msg("2799", dup222); + +var msg5251 = msg("2800", dup222); + +var msg5252 = msg("2801", dup222); + +var msg5253 = msg("2802", dup222); + +var msg5254 = msg("2803", dup222); + +var msg5255 = msg("2804", dup222); + +var msg5256 = msg("2805", dup222); + +var msg5257 = msg("2806", dup222); + +var msg5258 = msg("2807", dup222); + +var msg5259 = msg("2808", dup222); + +var msg5260 = msg("2809", dup222); + +var msg5261 = msg("2810", dup222); + +var msg5262 = msg("2811", dup222); + +var msg5263 = msg("2812", dup222); + +var msg5264 = msg("2813", dup222); + +var msg5265 = msg("2814", dup222); + +var msg5266 = msg("2815", dup222); + +var msg5267 = msg("2816", dup222); + +var msg5268 = msg("2817", dup222); + +var msg5269 = msg("2818", dup222); + +var msg5270 = msg("2819", dup222); + +var msg5271 = msg("2820", dup222); + +var msg5272 = msg("2821", dup222); + +var msg5273 = msg("2822", dup222); + +var msg5274 = msg("2823", dup222); + +var msg5275 = msg("2824", dup222); + +var msg5276 = msg("2825", dup222); + +var msg5277 = msg("2826", dup222); + +var msg5278 = msg("2827", dup222); + +var msg5279 = msg("2828", dup222); + +var msg5280 = msg("2829", dup222); + +var msg5281 = msg("2830", dup222); + +var msg5282 = msg("2831", dup222); + +var msg5283 = msg("2832", dup222); + +var msg5284 = msg("2833", dup222); + +var msg5285 = msg("2834", dup222); + +var msg5286 = msg("2835", dup222); + +var msg5287 = msg("2836", dup222); + +var msg5288 = msg("2837", dup222); + +var msg5289 = msg("2838", dup222); + +var msg5290 = msg("2839", dup222); + +var msg5291 = msg("2840", dup222); + +var msg5292 = msg("2841", dup222); + +var msg5293 = msg("2842", dup222); + +var msg5294 = msg("2843", dup222); + +var msg5295 = msg("2844", dup222); + +var msg5296 = msg("2845", dup222); + +var msg5297 = msg("2846", dup222); + +var msg5298 = msg("2847", dup222); + +var msg5299 = msg("2848", dup222); + +var msg5300 = msg("2849", dup222); + +var msg5301 = msg("2850", dup222); + +var msg5302 = msg("2851", dup222); + +var msg5303 = msg("2852", dup222); + +var msg5304 = msg("2853", dup222); + +var msg5305 = msg("2854", dup222); + +var msg5306 = msg("2855", dup222); + +var msg5307 = msg("2856", dup222); + +var msg5308 = msg("2857", dup222); + +var msg5309 = msg("2858", dup222); + +var msg5310 = msg("2859", dup222); + +var msg5311 = msg("2860", dup222); + +var msg5312 = msg("2861", dup222); + +var msg5313 = msg("2862", dup222); + +var msg5314 = msg("2863", dup222); + +var msg5315 = msg("2864", dup222); + +var msg5316 = msg("2865", dup222); + +var msg5317 = msg("2866", dup222); + +var msg5318 = msg("2867", dup222); + +var msg5319 = msg("2868", dup222); + +var msg5320 = msg("2869", dup222); + +var msg5321 = msg("2870", dup222); + +var msg5322 = msg("2871", dup222); + +var msg5323 = msg("2872", dup222); + +var msg5324 = msg("2873", dup222); + +var msg5325 = msg("2874", dup222); + +var msg5326 = msg("2875", dup222); + +var msg5327 = msg("2876", dup222); + +var msg5328 = msg("2877", dup222); + +var msg5329 = msg("2878", dup222); + +var msg5330 = msg("2879", dup222); + +var msg5331 = msg("2880", dup222); + +var msg5332 = msg("2881", dup222); + +var msg5333 = msg("2882", dup222); + +var msg5334 = msg("2883", dup222); + +var msg5335 = msg("2884", dup222); + +var msg5336 = msg("2885", dup222); + +var msg5337 = msg("2886", dup222); + +var msg5338 = msg("2887", dup222); + +var msg5339 = msg("2888", dup222); + +var msg5340 = msg("2889", dup222); + +var msg5341 = msg("2890", dup222); + +var msg5342 = msg("2891", dup222); + +var msg5343 = msg("2892", dup222); + +var msg5344 = msg("2893", dup222); + +var msg5345 = msg("2894", dup222); + +var msg5346 = msg("2895", dup222); + +var msg5347 = msg("2896", dup222); + +var msg5348 = msg("2897", dup222); + +var msg5349 = msg("2898", dup222); + +var msg5350 = msg("2899", dup222); + +var msg5351 = msg("2900", dup222); + +var msg5352 = msg("2901", dup222); + +var msg5353 = msg("2902", dup222); + +var msg5354 = msg("2903", dup222); + +var msg5355 = msg("2904", dup222); + +var msg5356 = msg("2905", dup222); + +var msg5357 = msg("2906", dup222); + +var msg5358 = msg("2907", dup222); + +var msg5359 = msg("2908", dup222); + +var msg5360 = msg("2909", dup222); + +var msg5361 = msg("2910", dup222); + +var msg5362 = msg("2911", dup222); + +var msg5363 = msg("2912", dup222); + +var msg5364 = msg("2913", dup222); + +var msg5365 = msg("2914", dup222); + +var msg5366 = msg("2915", dup222); + +var msg5367 = msg("2916", dup222); + +var msg5368 = msg("2917", dup222); + +var msg5369 = msg("2918", dup222); + +var msg5370 = msg("2919", dup222); + +var msg5371 = msg("2921", dup244); + +var msg5372 = msg("2922", dup196); + +var msg5373 = msg("2923", dup236); + +var msg5374 = msg("2924", dup236); + +var msg5375 = msg("2925", dup196); + +var msg5376 = msg("2926", dup196); + +var msg5377 = msg("2927", dup222); + +var msg5378 = msg("2928", dup276); + +var msg5379 = msg("2929", dup276); + +var msg5380 = msg("2930", dup276); + +var msg5381 = msg("2931", dup276); + +var msg5382 = msg("2932", dup276); + +var msg5383 = msg("2933", dup276); + +var msg5384 = msg("2934", dup276); + +var msg5385 = msg("2935", dup276); + +var msg5386 = msg("2936", dup276); + +var msg5387 = msg("2937", dup276); + +var msg5388 = msg("2938", dup276); + +var msg5389 = msg("2939", dup276); + +var msg5390 = msg("2940", dup276); + +var msg5391 = msg("2941", dup276); + +var msg5392 = msg("2942", dup276); + +var msg5393 = msg("2943", dup276); + +var msg5394 = msg("2944", dup276); + +var msg5395 = msg("2945", dup276); + +var msg5396 = msg("2946", dup276); + +var msg5397 = msg("2947", dup276); + +var msg5398 = msg("2948", dup276); + +var msg5399 = msg("2949", dup276); + +var msg5400 = msg("2950", dup197); + +var msg5401 = msg("2951", dup197); + +var msg5402 = msg("2952", dup246); + +var msg5403 = msg("2953", dup246); + +var msg5404 = msg("2954", dup246); + +var msg5405 = msg("2955", dup246); + +var msg5406 = msg("2956", dup276); + +var msg5407 = msg("2957", dup276); + +var msg5408 = msg("2958", dup276); + +var msg5409 = msg("2959", dup276); + +var msg5410 = msg("2960", dup276); + +var msg5411 = msg("2961", dup276); + +var msg5412 = msg("2962", dup276); + +var msg5413 = msg("2963", dup276); + +var msg5414 = msg("2964", dup276); + +var msg5415 = msg("2965", dup276); + +var msg5416 = msg("2966", dup276); + +var msg5417 = msg("2967", dup276); + +var msg5418 = msg("2968", dup276); + +var msg5419 = msg("2969", dup276); + +var msg5420 = msg("2970", dup276); + +var msg5421 = msg("2971", dup276); + +var msg5422 = msg("2972", dup246); + +var msg5423 = msg("2973", dup246); + +var msg5424 = msg("2974", dup246); + +var msg5425 = msg("2975", dup246); + +var msg5426 = msg("2976", dup246); + +var msg5427 = msg("2977", dup246); + +var msg5428 = msg("2978", dup246); + +var msg5429 = msg("2979", dup246); + +var msg5430 = msg("2980", dup246); + +var msg5431 = msg("2981", dup246); + +var msg5432 = msg("2982", dup246); + +var msg5433 = msg("2983", dup246); + +var msg5434 = msg("2984", dup276); + +var msg5435 = msg("2985", dup276); + +var msg5436 = msg("2986", dup276); + +var msg5437 = msg("2987", dup276); + +var msg5438 = msg("2988", dup276); + +var msg5439 = msg("2989", dup276); + +var msg5440 = msg("2990", dup276); + +var msg5441 = msg("2991", dup276); + +var msg5442 = msg("2992", dup276); + +var msg5443 = msg("2993", dup276); + +var msg5444 = msg("2994", dup276); + +var msg5445 = msg("2995", dup276); + +var msg5446 = msg("2996", dup276); + +var msg5447 = msg("2997", dup276); + +var msg5448 = msg("2998", dup276); + +var msg5449 = msg("2999", dup276); + +var msg5450 = msg("3000", dup276); + +var msg5451 = msg("3001", dup276); + +var msg5452 = msg("3002", dup276); + +var msg5453 = msg("3003", dup276); + +var msg5454 = msg("3004", dup276); + +var msg5455 = msg("3005", dup276); + +var msg5456 = msg("3006", dup222); + +var msg5457 = msg("3007", dup222); + +var msg5458 = msg("3008", dup222); + +var msg5459 = msg("3009", dup205); + +var msg5460 = msg("3010", dup205); + +var msg5461 = msg("3011", dup205); + +var msg5462 = msg("3012", dup205); + +var msg5463 = msg("3013", dup205); + +var msg5464 = msg("3014", dup205); + +var msg5465 = msg("3015", dup205); + +var msg5466 = msg("3016", dup205); + +var msg5467 = msg("3017", dup222); + +var msg5468 = msg("3018", dup276); + +var msg5469 = msg("3019", dup276); + +var msg5470 = msg("3020", dup276); + +var msg5471 = msg("3021", dup276); + +var msg5472 = msg("3022", dup276); + +var msg5473 = msg("3023", dup276); + +var msg5474 = msg("3024", dup276); + +var msg5475 = msg("3025", dup276); + +var msg5476 = msg("3026", dup276); + +var msg5477 = msg("3027", dup276); + +var msg5478 = msg("3028", dup276); + +var msg5479 = msg("3029", dup276); + +var msg5480 = msg("3030", dup276); + +var msg5481 = msg("3031", dup276); + +var msg5482 = msg("3032", dup276); + +var msg5483 = msg("3033", dup276); + +var msg5484 = msg("3034", dup276); + +var msg5485 = msg("3035", dup276); + +var msg5486 = msg("3036", dup276); + +var msg5487 = msg("3037", dup276); + +var msg5488 = msg("3038", dup276); + +var msg5489 = msg("3039", dup276); + +var msg5490 = msg("3040", dup276); + +var msg5491 = msg("3041", dup276); + +var msg5492 = msg("3042", dup198); + +var msg5493 = msg("3043", dup198); + +var msg5494 = msg("3044", dup198); + +var msg5495 = msg("3045", dup198); + +var msg5496 = msg("3046", dup198); + +var msg5497 = msg("3047", dup198); + +var msg5498 = msg("3048", dup198); + +var msg5499 = msg("3049", dup198); + +var msg5500 = msg("3050", dup198); + +var msg5501 = msg("3051", dup198); + +var msg5502 = msg("3052", dup198); + +var msg5503 = msg("3053", dup198); + +var msg5504 = msg("3054", dup198); + +var msg5505 = msg("3055", dup198); + +var msg5506 = msg("3056", dup198); + +var msg5507 = msg("3057", dup198); + +var msg5508 = msg("3058", dup222); + +var msg5509 = msg("3059", dup265); + +var msg5510 = msg("3060", dup265); + +var msg5511 = msg("3061", dup196); + +var msg5512 = msg("3062", dup265); + +var msg5513 = msg("3063", dup205); + +var msg5514 = msg("3064", dup205); + +var msg5515 = msg("3065", dup222); + +var msg5516 = msg("3066", dup222); + +var msg5517 = msg("3067", dup222); + +var msg5518 = msg("3068", dup222); + +var msg5519 = msg("3069", dup222); + +var msg5520 = msg("3070", dup222); + +var msg5521 = msg("3071", dup222); + +var msg5522 = msg("3072", dup222); + +var msg5523 = msg("3073", dup222); + +var msg5524 = msg("3074", dup222); + +var msg5525 = msg("3075", dup222); + +var msg5526 = msg("3076", dup222); + +var msg5527 = msg("3077", dup222); + +var msg5528 = msg("3078", dup222); + +var msg5529 = msg("3079", dup197); + +var msg5530 = msg("3080", dup222); + +var msg5531 = msg("3081", dup205); + +var msg5532 = msg("3082", dup205); + +var msg5533 = msg("3083", dup205); + +var msg5534 = msg("3084", dup222); + +var msg5535 = msg("3085", dup222); + +var msg5536 = msg("3086", dup302); + +var msg5537 = msg("3087", dup267); + +var msg5538 = msg("3088", dup267); + +var msg5539 = msg("3089", dup198); + +var msg5540 = msg("3090", dup276); + +var msg5541 = msg("3091", dup276); + +var msg5542 = msg("3092", dup276); + +var msg5543 = msg("3093", dup276); + +var msg5544 = msg("3094", dup276); + +var msg5545 = msg("3095", dup276); + +var msg5546 = msg("3096", dup276); + +var msg5547 = msg("3097", dup276); + +var msg5548 = msg("3098", dup276); + +var msg5549 = msg("3099", dup276); + +var msg5550 = msg("3100", dup276); + +var msg5551 = msg("3101", dup276); + +var msg5552 = msg("3102", dup276); + +var msg5553 = msg("3103", dup276); + +var msg5554 = msg("3104", dup276); + +var msg5555 = msg("3105", dup276); + +var msg5556 = msg("3106", dup276); + +var msg5557 = msg("3107", dup276); + +var msg5558 = msg("3108", dup276); + +var msg5559 = msg("3109", dup276); + +var msg5560 = msg("3110", dup276); + +var msg5561 = msg("3111", dup276); + +var msg5562 = msg("3112", dup276); + +var msg5563 = msg("3113", dup276); + +var msg5564 = msg("3114", dup276); + +var msg5565 = msg("3115", dup276); + +var msg5566 = msg("3116", dup276); + +var msg5567 = msg("3117", dup276); + +var msg5568 = msg("3118", dup276); + +var msg5569 = msg("3119", dup276); + +var msg5570 = msg("3120", dup276); + +var msg5571 = msg("3121", dup276); + +var msg5572 = msg("3122", dup276); + +var msg5573 = msg("3123", dup276); + +var msg5574 = msg("3124", dup276); + +var msg5575 = msg("3125", dup276); + +var msg5576 = msg("3126", dup276); + +var msg5577 = msg("3127", dup276); + +var msg5578 = msg("3128", dup276); + +var msg5579 = msg("3129", dup276); + +var msg5580 = msg("3130", dup197); + +var msg5581 = msg("3131", dup265); + +var msg5582 = msg("3132", dup265); + +var msg5583 = msg("3133", dup265); + +var msg5584 = msg("3134", dup265); + +var msg5585 = msg("3135", dup276); + +var msg5586 = msg("3136", dup276); + +var msg5587 = msg("3137", dup276); + +var msg5588 = msg("3138", dup276); + +var msg5589 = msg("3139", dup276); + +var msg5590 = msg("3140", dup276); + +var msg5591 = msg("3141", dup276); + +var msg5592 = msg("3142", dup276); + +var msg5593 = msg("3143", dup276); + +var msg5594 = msg("3144", dup276); + +var msg5595 = msg("3145", dup276); + +var msg5596 = msg("3146", dup276); + +var msg5597 = msg("3147", dup278); + +var msg5598 = msg("3148", dup265); + +var msg5599 = msg("3149", dup267); + +var msg5600 = msg("3150", dup297); + +var msg5601 = msg("3151", dup225); + +var msg5602 = msg("3152", dup236); + +var msg5603 = msg("3153", dup197); + +var msg5604 = msg("3154", dup197); + +var msg5605 = msg("3155", dup205); + +var msg5606 = msg("3156", dup276); + +var msg5607 = msg("3157", dup276); + +var msg5608 = msg("3158", dup276); + +var msg5609 = msg("3159", dup276); + +var msg5610 = msg("3160", dup276); + +var msg5611 = msg("3161", dup276); + +var msg5612 = msg("3162", dup276); + +var msg5613 = msg("3163", dup276); + +var msg5614 = msg("3164", dup276); + +var msg5615 = msg("3165", dup276); + +var msg5616 = msg("3166", dup201); + +var msg5617 = msg("3167", dup276); + +var msg5618 = msg("3168", dup201); + +var msg5619 = msg("3169", dup201); + +var msg5620 = msg("3170", dup201); + +var msg5621 = msg("3171", dup276); + +var msg5622 = msg("3172", dup276); + +var msg5623 = msg("3173", dup276); + +var msg5624 = msg("3174", dup276); + +var msg5625 = msg("3175", dup276); + +var msg5626 = msg("3176", dup276); + +var msg5627 = msg("3177", dup276); + +var msg5628 = msg("3178", dup276); + +var msg5629 = msg("3179", dup276); + +var msg5630 = msg("3180", dup276); + +var msg5631 = msg("3181", dup276); + +var msg5632 = msg("3182", dup276); + +var msg5633 = msg("3183", dup276); + +var msg5634 = msg("3184", dup276); + +var msg5635 = msg("3185", dup276); + +var msg5636 = msg("3186", dup276); + +var msg5637 = msg("3187", dup276); + +var msg5638 = msg("3188", dup276); + +var msg5639 = msg("3189", dup276); + +var msg5640 = msg("3190", dup276); + +var msg5641 = msg("3191", dup276); + +var msg5642 = msg("3192", dup265); + +var msg5643 = msg("3193", dup267); + +var msg5644 = msg("3194", dup267); + +var msg5645 = msg("3195", dup276); + +var msg5646 = msg("3196", dup276); + +var msg5647 = msg("3197", dup276); + +var msg5648 = msg("3198", dup276); + +var msg5649 = msg("3199", dup222); + +var msg5650 = msg("3200", dup222); + +var msg5651 = msg("3201", dup271); + +var msg5652 = msg("3202", dup276); + +var msg5653 = msg("3203", dup276); + +var msg5654 = msg("3204", dup276); + +var msg5655 = msg("3205", dup276); + +var msg5656 = msg("3206", dup276); + +var msg5657 = msg("3207", dup276); + +var msg5658 = msg("3208", dup276); + +var msg5659 = msg("3209", dup276); + +var msg5660 = msg("3210", dup276); + +var msg5661 = msg("3211", dup276); + +var msg5662 = msg("3212", dup276); + +var msg5663 = msg("3213", dup276); + +var msg5664 = msg("3214", dup276); + +var msg5665 = msg("3215", dup276); + +var msg5666 = msg("3216", dup276); + +var msg5667 = msg("3217", dup276); + +var msg5668 = msg("3218", dup276); + +var msg5669 = msg("3219", dup276); + +var msg5670 = msg("3220", dup276); + +var msg5671 = msg("3221", dup276); + +var msg5672 = msg("3222", dup276); + +var msg5673 = msg("3223", dup276); + +var msg5674 = msg("3224", dup276); + +var msg5675 = msg("3225", dup276); + +var msg5676 = msg("3226", dup276); + +var msg5677 = msg("3227", dup276); + +var msg5678 = msg("3228", dup276); + +var msg5679 = msg("3229", dup276); + +var msg5680 = msg("3230", dup276); + +var msg5681 = msg("3231", dup276); + +var msg5682 = msg("3232", dup276); + +var msg5683 = msg("3233", dup276); + +var msg5684 = msg("3234", dup276); + +var msg5685 = msg("3235", dup276); + +var msg5686 = msg("3236", dup276); + +var msg5687 = msg("3237", dup276); + +var msg5688 = msg("3238", dup201); + +var msg5689 = msg("3239", dup201); + +var msg5690 = msg("3240", dup276); + +var msg5691 = msg("3241", dup276); + +var msg5692 = msg("3242", dup276); + +var msg5693 = msg("3243", dup276); + +var msg5694 = msg("3244", dup276); + +var msg5695 = msg("3245", dup276); + +var msg5696 = msg("3246", dup276); + +var msg5697 = msg("3247", dup276); + +var msg5698 = msg("3248", dup276); + +var msg5699 = msg("3249", dup276); + +var msg5700 = msg("3250", dup276); + +var msg5701 = msg("3251", dup276); + +var msg5702 = msg("3252", dup276); + +var msg5703 = msg("3253", dup276); + +var msg5704 = msg("3254", dup276); + +var msg5705 = msg("3255", dup276); + +var msg5706 = msg("3256", dup201); + +var msg5707 = msg("3257", dup201); + +var msg5708 = msg("3258", dup201); + +var msg5709 = msg("3259", dup201); + +var msg5710 = msg("3260", dup201); + +var msg5711 = msg("3261", dup201); + +var msg5712 = msg("3262", dup276); + +var msg5713 = msg("3263", dup276); + +var msg5714 = msg("3264", dup276); + +var msg5715 = msg("3265", dup276); + +var msg5716 = msg("3266", dup276); + +var msg5717 = msg("3267", dup276); + +var msg5718 = msg("3268", dup276); + +var msg5719 = msg("3269", dup276); + +var msg5720 = msg("3270", dup276); + +var msg5721 = msg("3271", dup276); + +var msg5722 = msg("3272", dup205); + +var msg5723 = msg("3273", dup236); + +var msg5724 = msg("3274", dup278); + +var msg5725 = msg("3275", dup276); + +var msg5726 = msg("3276", dup276); + +var msg5727 = msg("3277", dup255); + +var msg5728 = msg("3278", dup255); + +var msg5729 = msg("3279", dup255); + +var msg5730 = msg("3280", dup255); + +var msg5731 = msg("3281", dup255); + +var msg5732 = msg("3282", dup255); + +var msg5733 = msg("3283", dup255); + +var msg5734 = msg("3284", dup255); + +var msg5735 = msg("3285", dup255); + +var msg5736 = msg("3286", dup255); + +var msg5737 = msg("3287", dup255); + +var msg5738 = msg("3288", dup255); + +var msg5739 = msg("3289", dup255); + +var msg5740 = msg("3290", dup255); + +var msg5741 = msg("3291", dup255); + +var msg5742 = msg("3292", dup255); + +var msg5743 = msg("3293", dup255); + +var msg5744 = msg("3294", dup255); + +var msg5745 = msg("3295", dup255); + +var msg5746 = msg("3296", dup255); + +var msg5747 = msg("3297", dup255); + +var msg5748 = msg("3298", dup255); + +var msg5749 = msg("3299", dup255); + +var msg5750 = msg("3300", dup255); + +var msg5751 = msg("3301", dup255); + +var msg5752 = msg("3302", dup255); + +var msg5753 = msg("3303", dup255); + +var msg5754 = msg("3304", dup255); + +var msg5755 = msg("3305", dup255); + +var msg5756 = msg("3306", dup255); + +var msg5757 = msg("3307", dup255); + +var msg5758 = msg("3308", dup255); + +var msg5759 = msg("3309", dup255); + +var msg5760 = msg("3310", dup255); + +var msg5761 = msg("3311", dup255); + +var msg5762 = msg("3312", dup255); + +var msg5763 = msg("3313", dup255); + +var msg5764 = msg("3314", dup255); + +var msg5765 = msg("3315", dup255); + +var msg5766 = msg("3316", dup255); + +var msg5767 = msg("3317", dup255); + +var msg5768 = msg("3318", dup255); + +var msg5769 = msg("3319", dup255); + +var msg5770 = msg("3320", dup255); + +var msg5771 = msg("3321", dup255); + +var msg5772 = msg("3322", dup255); + +var msg5773 = msg("3323", dup255); + +var msg5774 = msg("3324", dup255); + +var msg5775 = msg("3325", dup255); + +var msg5776 = msg("3326", dup255); + +var msg5777 = msg("3327", dup255); + +var msg5778 = msg("3328", dup255); + +var msg5779 = msg("3329", dup255); + +var msg5780 = msg("3330", dup255); + +var msg5781 = msg("3331", dup255); + +var msg5782 = msg("3332", dup255); + +var msg5783 = msg("3333", dup255); + +var msg5784 = msg("3334", dup255); + +var msg5785 = msg("3335", dup255); + +var msg5786 = msg("3336", dup255); + +var msg5787 = msg("3337", dup255); + +var msg5788 = msg("3338", dup255); + +var msg5789 = msg("3339", dup255); + +var msg5790 = msg("3340", dup255); + +var msg5791 = msg("3341", dup255); + +var msg5792 = msg("3342", dup255); + +var msg5793 = msg("3343", dup255); + +var msg5794 = msg("3344", dup255); + +var msg5795 = msg("3345", dup255); + +var msg5796 = msg("3346", dup255); + +var msg5797 = msg("3347", dup255); + +var msg5798 = msg("3348", dup255); + +var msg5799 = msg("3349", dup255); + +var msg5800 = msg("3350", dup255); + +var msg5801 = msg("3351", dup255); + +var msg5802 = msg("3352", dup255); + +var msg5803 = msg("3353", dup255); + +var msg5804 = msg("3354", dup255); + +var msg5805 = msg("3355", dup255); + +var msg5806 = msg("3356", dup255); + +var msg5807 = msg("3357", dup255); + +var msg5808 = msg("3358", dup255); + +var msg5809 = msg("3359", dup255); + +var msg5810 = msg("3360", dup255); + +var msg5811 = msg("3361", dup255); + +var msg5812 = msg("3362", dup255); + +var msg5813 = msg("3363", dup255); + +var msg5814 = msg("3364", dup255); + +var msg5815 = msg("3365", dup255); + +var msg5816 = msg("3366", dup255); + +var msg5817 = msg("3367", dup255); + +var msg5818 = msg("3368", dup255); + +var msg5819 = msg("3369", dup255); + +var msg5820 = msg("3370", dup255); + +var msg5821 = msg("3371", dup255); + +var msg5822 = msg("3372", dup255); + +var msg5823 = msg("3373", dup255); + +var msg5824 = msg("3374", dup255); + +var msg5825 = msg("3375", dup255); + +var msg5826 = msg("3376", dup255); + +var msg5827 = msg("3377", dup276); + +var msg5828 = msg("3378", dup276); + +var msg5829 = msg("3379", dup276); + +var msg5830 = msg("3380", dup276); + +var msg5831 = msg("3381", dup276); + +var msg5832 = msg("3382", dup276); + +var msg5833 = msg("3383", dup276); + +var msg5834 = msg("3384", dup276); + +var msg5835 = msg("3385", dup276); + +var msg5836 = msg("3386", dup276); + +var msg5837 = msg("3387", dup276); + +var msg5838 = msg("3388", dup276); + +var msg5839 = msg("3389", dup276); + +var msg5840 = msg("3390", dup276); + +var msg5841 = msg("3391", dup276); + +var msg5842 = msg("3392", dup276); + +var msg5843 = msg("3393", dup276); + +var msg5844 = msg("3394", dup276); + +var msg5845 = msg("3395", dup276); + +var msg5846 = msg("3396", dup276); + +var msg5847 = msg("3397", dup276); + +var msg5848 = msg("3398", dup276); + +var msg5849 = msg("3399", dup276); + +var msg5850 = msg("3400", dup276); + +var msg5851 = msg("3401", dup276); + +var msg5852 = msg("3402", dup276); + +var msg5853 = msg("3403", dup276); + +var msg5854 = msg("3404", dup276); + +var msg5855 = msg("3405", dup276); + +var msg5856 = msg("3406", dup276); + +var msg5857 = msg("3407", dup276); + +var msg5858 = msg("3408", dup276); + +var msg5859 = msg("3409", dup276); + +var msg5860 = msg("3410", dup276); + +var msg5861 = msg("3411", dup276); + +var msg5862 = msg("3412", dup276); + +var msg5863 = msg("3413", dup276); + +var msg5864 = msg("3414", dup276); + +var msg5865 = msg("3415", dup276); + +var msg5866 = msg("3416", dup276); + +var msg5867 = msg("3417", dup276); + +var msg5868 = msg("3418", dup276); + +var msg5869 = msg("3419", dup276); + +var msg5870 = msg("3420", dup276); + +var msg5871 = msg("3421", dup276); + +var msg5872 = msg("3422", dup276); + +var msg5873 = msg("3423", dup276); + +var msg5874 = msg("3424", dup276); + +var msg5875 = msg("3425", dup276); + +var msg5876 = msg("3426", dup276); + +var msg5877 = msg("3427", dup276); + +var msg5878 = msg("3428", dup276); + +var msg5879 = msg("3429", dup276); + +var msg5880 = msg("3430", dup276); + +var msg5881 = msg("3431", dup276); + +var msg5882 = msg("3432", dup276); + +var msg5883 = msg("3433", dup276); + +var msg5884 = msg("3434", dup276); + +var msg5885 = msg("3435", dup276); + +var msg5886 = msg("3436", dup276); + +var msg5887 = msg("3437", dup276); + +var msg5888 = msg("3438", dup276); + +var msg5889 = msg("3439", dup276); + +var msg5890 = msg("3440", dup276); + +var msg5891 = msg("3441", dup227); + +var msg5892 = msg("3442", dup198); + +var msg5893 = msg("3443", dup240); + +var msg5894 = msg("3444", dup240); + +var msg5895 = msg("3445", dup240); + +var msg5896 = msg("3446", dup240); + +var msg5897 = msg("3447", dup240); + +var msg5898 = msg("3448", dup240); + +var msg5899 = msg("3449", dup240); + +var msg5900 = msg("3450", dup240); + +var msg5901 = msg("3451", dup240); + +var msg5902 = msg("3452", dup240); + +var msg5903 = msg("3453", dup196); + +var msg5904 = msg("3454", dup196); + +var msg5905 = msg("3455", dup197); + +var msg5906 = msg("3456", dup240); + +var msg5907 = msg("3457", dup222); + +var msg5908 = msg("3458", dup222); + +var msg5909 = msg("3459", dup196); + +var msg5910 = msg("3460", dup227); + +var msg5911 = msg("3461", dup297); + +var msg5912 = msg("3462", dup222); + +var msg5913 = msg("3463", dup265); + +var msg5914 = msg("3464", dup267); + +var msg5915 = msg("3465", dup265); + +var msg5916 = msg("3466", dup267); + +var msg5917 = msg("3467", dup265); + +var msg5918 = msg("3468", dup265); + +var msg5919 = msg("3469", dup198); + +var msg5920 = msg("3470", dup197); + +var msg5921 = msg("3471", dup267); + +var msg5922 = msg("3472", dup197); + +var msg5923 = msg("3473", dup267); + +var msg5924 = msg("3474", dup197); + +var msg5925 = msg("3475", dup197); + +var msg5926 = msg("3476", dup197); + +var msg5927 = msg("3477", dup197); + +var msg5928 = msg("3478", dup197); + +var msg5929 = msg("3479", dup197); + +var msg5930 = msg("3480", dup197); + +var msg5931 = msg("3481", dup197); + +var msg5932 = msg("3482", dup197); + +var msg5933 = msg("3483", dup197); + +var msg5934 = msg("3484", dup197); + +var msg5935 = msg("3485", dup197); + +var msg5936 = msg("3486", dup265); + +var msg5937 = msg("3487", dup196); + +var msg5938 = msg("3488", dup196); + +var msg5939 = msg("3489", dup196); + +var msg5940 = msg("3490", dup196); + +var msg5941 = msg("3491", dup196); + +var msg5942 = msg("3492", dup196); + +var msg5943 = msg("3493", dup250); + +var msg5944 = msg("3494", dup250); + +var msg5945 = msg("3495", dup250); + +var msg5946 = msg("3496", dup250); + +var msg5947 = msg("3497", dup250); + +var msg5948 = msg("3498", dup250); + +var msg5949 = msg("3499", dup298); + +var msg5950 = msg("3500", dup298); + +var msg5951 = msg("3501", dup298); + +var msg5952 = msg("3502", dup298); + +var msg5953 = msg("3503", dup298); + +var msg5954 = msg("3504", dup298); + +var msg5955 = msg("3505", dup298); + +var msg5956 = msg("3506", dup298); + +var msg5957 = msg("3507", dup298); + +var msg5958 = msg("3508", dup298); + +var msg5959 = msg("3509", dup298); + +var msg5960 = msg("3510", dup298); + +var msg5961 = msg("3511", dup222); + +var msg5962 = msg("3512", dup196); + +var msg5963 = msg("3513", dup196); + +var msg5964 = msg("3514", dup196); + +var msg5965 = msg("3515", dup196); + +var msg5966 = msg("3516", dup196); + +var msg5967 = msg("3517", dup222); + +var msg5968 = msg("3518", dup197); + +var msg5969 = msg("3519", dup197); + +var msg5970 = msg("3520", dup222); + +var msg5971 = msg("3521", dup222); + +var msg5972 = msg("3522", dup222); + +var msg5973 = msg("3523", dup227); + +var msg5974 = msg("3524", dup196); + +var msg5975 = msg("3525", dup196); + +var msg5976 = msg("3526", dup222); + +var msg5977 = msg("3527", dup222); + +var msg5978 = msg("3528", dup240); + +var msg5979 = msg("3529", dup222); + +var msg5980 = msg("3530", dup197); + +var msg5981 = msg("3531", dup197); + +var msg5982 = msg("3532", dup222); + +var msg5983 = msg("3533", dup278); + +var msg5984 = msg("3534", dup197); + +var msg5985 = msg("3535", dup196); + +var msg5986 = msg("3536", dup197); + +var msg5987 = msg("3537", dup278); + +var msg5988 = msg("3538", dup222); + +var msg5989 = msg("3539", dup222); + +var msg5990 = msg("3540", dup222); + +var msg5991 = msg("3541", dup222); + +var msg5992 = msg("3542", dup240); + +var msg5993 = msg("3543", dup240); + +var msg5994 = msg("3544", dup265); + +var msg5995 = msg("3545", dup265); + +var msg5996 = msg("3546", dup267); + +var msg5997 = msg("3547", dup267); + +var msg5998 = msg("3548", dup265); + +var msg5999 = msg("3549", dup265); + +var msg6000 = msg("3550", dup267); + +var msg6001 = msg("3551", dup265); + +var msg6002 = msg("3552", dup265); + +var msg6003 = msg("3553", dup265); + +var msg6004 = msg("3554", dup276); + +var msg6005 = msg("3555", dup276); + +var msg6006 = msg("3556", dup276); + +var msg6007 = msg("3557", dup276); + +var msg6008 = msg("3558", dup276); + +var msg6009 = msg("3559", dup276); + +var msg6010 = msg("3560", dup276); + +var msg6011 = msg("3561", dup276); + +var msg6012 = msg("3562", dup276); + +var msg6013 = msg("3563", dup276); + +var msg6014 = msg("3564", dup276); + +var msg6015 = msg("3565", dup276); + +var msg6016 = msg("3566", dup276); + +var msg6017 = msg("3567", dup276); + +var msg6018 = msg("3568", dup276); + +var msg6019 = msg("3569", dup276); + +var msg6020 = msg("3570", dup276); + +var msg6021 = msg("3571", dup276); + +var msg6022 = msg("3572", dup276); + +var msg6023 = msg("3573", dup276); + +var msg6024 = msg("3574", dup276); + +var msg6025 = msg("3575", dup276); + +var msg6026 = msg("3576", dup276); + +var msg6027 = msg("3577", dup276); + +var msg6028 = msg("3578", dup276); + +var msg6029 = msg("3579", dup276); + +var msg6030 = msg("3580", dup276); + +var msg6031 = msg("3581", dup276); + +var msg6032 = msg("3582", dup276); + +var msg6033 = msg("3583", dup276); + +var msg6034 = msg("3584", dup276); + +var msg6035 = msg("3585", dup276); + +var msg6036 = msg("3586", dup276); + +var msg6037 = msg("3587", dup276); + +var msg6038 = msg("3588", dup276); + +var msg6039 = msg("3589", dup276); + +var msg6040 = msg("3590", dup276); + +var msg6041 = msg("3591", dup276); + +var msg6042 = msg("3592", dup276); + +var msg6043 = msg("3593", dup276); + +var msg6044 = msg("3594", dup276); + +var msg6045 = msg("3595", dup276); + +var msg6046 = msg("3596", dup276); + +var msg6047 = msg("3597", dup276); + +var msg6048 = msg("3598", dup276); + +var msg6049 = msg("3599", dup276); + +var msg6050 = msg("3600", dup276); + +var msg6051 = msg("3601", dup276); + +var msg6052 = msg("3602", dup276); + +var msg6053 = msg("3603", dup276); + +var msg6054 = msg("3604", dup276); + +var msg6055 = msg("3605", dup276); + +var msg6056 = msg("3606", dup276); + +var msg6057 = msg("3607", dup276); + +var msg6058 = msg("3608", dup276); + +var msg6059 = msg("3609", dup276); + +var msg6060 = msg("3610", dup276); + +var msg6061 = msg("3611", dup276); + +var msg6062 = msg("3612", dup276); + +var msg6063 = msg("3613", dup276); + +var msg6064 = msg("3614", dup276); + +var msg6065 = msg("3615", dup276); + +var msg6066 = msg("3616", dup276); + +var msg6067 = msg("3617", dup276); + +var msg6068 = msg("3618", dup276); + +var msg6069 = msg("3619", dup276); + +var msg6070 = msg("3620", dup276); + +var msg6071 = msg("3621", dup276); + +var msg6072 = msg("3622", dup276); + +var msg6073 = msg("3623", dup276); + +var msg6074 = msg("3624", dup276); + +var msg6075 = msg("3625", dup276); + +var msg6076 = msg("3626", dup198); + +var msg6077 = msg("3627", dup196); + +var msg6078 = msg("3628", dup196); + +var msg6079 = msg("3629", dup265); + +var msg6080 = msg("3630", dup222); + +var msg6081 = msg("3631", dup222); + +var msg6082 = msg("3632", dup267); + +var msg6083 = msg("3633", dup196); + +var msg6084 = msg("3634", dup267); + +var msg6085 = msg("3635", dup205); + +var msg6086 = msg("3636", dup205); + +var msg6087 = msg("3637", dup196); + +var msg6088 = msg("3638", dup267); + +var msg6089 = msg("3639", dup198); + +var msg6090 = msg("3640", dup198); + +var msg6091 = msg("3641", dup198); + +var msg6092 = msg("3642", dup198); + +var msg6093 = msg("3643", dup198); + +var msg6094 = msg("3644", dup198); + +var msg6095 = msg("3645", dup198); + +var msg6096 = msg("3646", dup198); + +var msg6097 = msg("3647", dup198); + +var msg6098 = msg("3648", dup198); + +var msg6099 = msg("3649", dup198); + +var msg6100 = msg("3650", dup198); + +var msg6101 = msg("3651", dup222); + +var msg6102 = msg("3652", dup222); + +var msg6103 = msg("3653", dup222); + +var msg6104 = msg("3654", dup222); + +var msg6105 = msg("3655", dup222); + +var msg6106 = msg("3656", dup222); + +var msg6107 = msg("3657", dup196); + +var msg6108 = msg("3658", dup222); + +var msg6109 = msg("3659", dup222); + +var msg6110 = msg("3660", dup222); + +var msg6111 = msg("3661", dup222); + +var msg6112 = msg("3662", dup222); + +var msg6113 = msg("3663", dup222); + +var msg6114 = msg("3664", dup222); + +var msg6115 = msg("3665", dup196); + +var msg6116 = msg("3666", dup196); + +var msg6117 = msg("3667", dup285); + +var msg6118 = msg("3668", dup285); + +var msg6119 = msg("3669", dup260); + +var msg6120 = msg("3670", dup260); + +var msg6121 = msg("3671", dup260); + +var msg6122 = msg("3672", dup260); + +var msg6123 = msg("3673", dup198); + +var msg6124 = msg("3674", dup265); + +var msg6125 = msg("3675", dup198); + +var msg6126 = msg("3676", dup265); + +var msg6127 = msg("3677", dup201); + +var msg6128 = msg("3678", dup201); + +var msg6129 = msg("3679", dup201); + +var msg6130 = msg("3680", dup196); + +var msg6131 = msg("3681", dup196); + +var msg6132 = msg("3682", dup250); + +var msg6133 = msg("3683", dup267); + +var msg6134 = msg("3684", dup196); + +var msg6135 = msg("3685", dup201); + +var msg6136 = msg("3686", dup197); + +var msg6137 = msg("3687", dup248); + +var msg6138 = msg("3688", dup248); + +var msg6139 = msg("3689", dup267); + +var msg6140 = msg("3690", dup260); + +var msg6141 = msg("3691", dup196); + +var msg6142 = msg("3692", dup196); + +var msg6143 = msg("3693", dup267); + +var msg6144 = msg("3694", dup265); + +var msg6145 = msg("3695", dup222); + +var msg6146 = msg("3696", dup198); + +var msg6147 = msg("3697", dup276); + +var msg6148 = msg("3698", dup276); + +var msg6149 = msg("3699", dup276); + +var msg6150 = msg("3700", dup276); + +var msg6151 = msg("3701", dup276); + +var msg6152 = msg("3702", dup276); + +var msg6153 = msg("3703", dup276); + +var msg6154 = msg("3704", dup276); + +var msg6155 = msg("3705", dup276); + +var msg6156 = msg("3706", dup276); + +var msg6157 = msg("3707", dup276); + +var msg6158 = msg("3708", dup276); + +var msg6159 = msg("3709", dup276); + +var msg6160 = msg("3710", dup276); + +var msg6161 = msg("3711", dup276); + +var msg6162 = msg("3712", dup276); + +var msg6163 = msg("3713", dup276); + +var msg6164 = msg("3714", dup276); + +var msg6165 = msg("3715", dup276); + +var msg6166 = msg("3716", dup276); + +var msg6167 = msg("3717", dup276); + +var msg6168 = msg("3718", dup276); + +var msg6169 = msg("3719", dup276); + +var msg6170 = msg("3720", dup276); + +var msg6171 = msg("3721", dup276); + +var msg6172 = msg("3722", dup276); + +var msg6173 = msg("3723", dup276); + +var msg6174 = msg("3724", dup276); + +var msg6175 = msg("3725", dup276); + +var msg6176 = msg("3726", dup276); + +var msg6177 = msg("3727", dup276); + +var msg6178 = msg("3728", dup276); + +var msg6179 = msg("3729", dup276); + +var msg6180 = msg("3730", dup276); + +var msg6181 = msg("3731", dup276); + +var msg6182 = msg("3732", dup276); + +var msg6183 = msg("3733", dup276); + +var msg6184 = msg("3734", dup276); + +var msg6185 = msg("3735", dup276); + +var msg6186 = msg("3736", dup276); + +var msg6187 = msg("3737", dup276); + +var msg6188 = msg("3738", dup276); + +var msg6189 = msg("3739", dup276); + +var msg6190 = msg("3740", dup276); + +var msg6191 = msg("3741", dup276); + +var msg6192 = msg("3742", dup276); + +var msg6193 = msg("3743", dup276); + +var msg6194 = msg("3744", dup276); + +var msg6195 = msg("3745", dup276); + +var msg6196 = msg("3746", dup276); + +var msg6197 = msg("3747", dup276); + +var msg6198 = msg("3748", dup276); + +var msg6199 = msg("3749", dup276); + +var msg6200 = msg("3750", dup276); + +var msg6201 = msg("3751", dup276); + +var msg6202 = msg("3752", dup276); + +var msg6203 = msg("3753", dup276); + +var msg6204 = msg("3754", dup276); + +var msg6205 = msg("3755", dup276); + +var msg6206 = msg("3756", dup276); + +var msg6207 = msg("3757", dup276); + +var msg6208 = msg("3758", dup276); + +var msg6209 = msg("3759", dup276); + +var msg6210 = msg("3760", dup276); + +var msg6211 = msg("3761", dup276); + +var msg6212 = msg("3762", dup276); + +var msg6213 = msg("3763", dup276); + +var msg6214 = msg("3764", dup276); + +var msg6215 = msg("3765", dup276); + +var msg6216 = msg("3766", dup276); + +var msg6217 = msg("3767", dup276); + +var msg6218 = msg("3768", dup276); + +var msg6219 = msg("3769", dup276); + +var msg6220 = msg("3770", dup276); + +var msg6221 = msg("3771", dup276); + +var msg6222 = msg("3772", dup276); + +var msg6223 = msg("3773", dup276); + +var msg6224 = msg("3774", dup276); + +var msg6225 = msg("3775", dup276); + +var msg6226 = msg("3776", dup276); + +var msg6227 = msg("3777", dup276); + +var msg6228 = msg("3778", dup276); + +var msg6229 = msg("3779", dup276); + +var msg6230 = msg("3780", dup276); + +var msg6231 = msg("3781", dup276); + +var msg6232 = msg("3782", dup276); + +var msg6233 = msg("3783", dup276); + +var msg6234 = msg("3784", dup276); + +var msg6235 = msg("3785", dup276); + +var msg6236 = msg("3786", dup276); + +var msg6237 = msg("3787", dup276); + +var msg6238 = msg("3788", dup276); + +var msg6239 = msg("3789", dup276); + +var msg6240 = msg("3790", dup276); + +var msg6241 = msg("3791", dup276); + +var msg6242 = msg("3792", dup276); + +var msg6243 = msg("3793", dup276); + +var msg6244 = msg("3794", dup276); + +var msg6245 = msg("3795", dup276); + +var msg6246 = msg("3796", dup276); + +var msg6247 = msg("3797", dup276); + +var msg6248 = msg("3798", dup276); + +var msg6249 = msg("3799", dup276); + +var msg6250 = msg("3800", dup276); + +var msg6251 = msg("3801", dup276); + +var msg6252 = msg("3802", dup276); + +var msg6253 = msg("3803", dup276); + +var msg6254 = msg("3804", dup276); + +var msg6255 = msg("3805", dup276); + +var msg6256 = msg("3806", dup276); + +var msg6257 = msg("3807", dup276); + +var msg6258 = msg("3808", dup276); + +var msg6259 = msg("3809", dup276); + +var msg6260 = msg("3810", dup276); + +var msg6261 = msg("3811", dup276); + +var msg6262 = msg("3812", dup276); + +var msg6263 = msg("3813", dup267); + +var msg6264 = msg("3814", dup265); + +var msg6265 = msg("3815", dup222); + +var msg6266 = msg("3816", dup267); + +var msg6267 = msg("3817", dup295); + +var msg6268 = msg("3818", dup295); + +var msg6269 = msg("3819", dup196); + +var msg6270 = msg("3820", dup265); + +var msg6271 = msg("3821", dup265); + +var msg6272 = msg("3822", dup265); + +var msg6273 = msg("3823", dup267); + +var msg6274 = msg("3824", dup222); + +var msg6275 = msg("3825", dup196); + +var msg6276 = msg("3826", dup196); + +var msg6277 = msg("3827", dup265); + +var msg6278 = msg("3828", dup276); + +var msg6279 = msg("3829", dup276); + +var msg6280 = msg("3830", dup276); + +var msg6281 = msg("3831", dup276); + +var msg6282 = msg("3832", dup276); + +var msg6283 = msg("3833", dup276); + +var msg6284 = msg("3834", dup276); + +var msg6285 = msg("3835", dup276); + +var msg6286 = msg("3836", dup276); + +var msg6287 = msg("3837", dup276); + +var msg6288 = msg("3838", dup276); + +var msg6289 = msg("3839", dup276); + +var msg6290 = msg("3840", dup276); + +var msg6291 = msg("3841", dup276); + +var msg6292 = msg("3842", dup276); + +var msg6293 = msg("3843", dup276); + +var msg6294 = msg("3844", dup276); + +var msg6295 = msg("3845", dup276); + +var msg6296 = msg("3846", dup276); + +var msg6297 = msg("3847", dup276); + +var msg6298 = msg("3848", dup276); + +var msg6299 = msg("3849", dup276); + +var msg6300 = msg("3850", dup276); + +var msg6301 = msg("3851", dup276); + +var msg6302 = msg("3852", dup276); + +var msg6303 = msg("3853", dup276); + +var msg6304 = msg("3854", dup276); + +var msg6305 = msg("3855", dup276); + +var msg6306 = msg("3856", dup276); + +var msg6307 = msg("3857", dup276); + +var msg6308 = msg("3858", dup276); + +var msg6309 = msg("3859", dup276); + +var msg6310 = msg("3860", dup276); + +var msg6311 = msg("3861", dup276); + +var msg6312 = msg("3862", dup276); + +var msg6313 = msg("3863", dup276); + +var msg6314 = msg("3864", dup276); + +var msg6315 = msg("3865", dup276); + +var msg6316 = msg("3866", dup276); + +var msg6317 = msg("3867", dup276); + +var msg6318 = msg("3868", dup276); + +var msg6319 = msg("3869", dup276); + +var msg6320 = msg("3870", dup276); + +var msg6321 = msg("3871", dup276); + +var msg6322 = msg("3872", dup276); + +var msg6323 = msg("3873", dup276); + +var msg6324 = msg("3874", dup276); + +var msg6325 = msg("3875", dup276); + +var msg6326 = msg("3876", dup276); + +var msg6327 = msg("3877", dup276); + +var msg6328 = msg("3878", dup276); + +var msg6329 = msg("3879", dup276); + +var msg6330 = msg("3880", dup276); + +var msg6331 = msg("3881", dup276); + +var msg6332 = msg("3882", dup276); + +var msg6333 = msg("3883", dup276); + +var msg6334 = msg("3884", dup276); + +var msg6335 = msg("3885", dup276); + +var msg6336 = msg("3886", dup276); + +var msg6337 = msg("3887", dup276); + +var msg6338 = msg("3888", dup276); + +var msg6339 = msg("3889", dup276); + +var msg6340 = msg("3890", dup276); + +var msg6341 = msg("3891", dup276); + +var msg6342 = msg("3892", dup276); + +var msg6343 = msg("3893", dup276); + +var msg6344 = msg("3894", dup276); + +var msg6345 = msg("3895", dup276); + +var msg6346 = msg("3896", dup276); + +var msg6347 = msg("3897", dup276); + +var msg6348 = msg("3898", dup276); + +var msg6349 = msg("3899", dup276); + +var msg6350 = msg("3900", dup276); + +var msg6351 = msg("3901", dup276); + +var msg6352 = msg("3902", dup276); + +var msg6353 = msg("3903", dup276); + +var msg6354 = msg("3904", dup276); + +var msg6355 = msg("3905", dup276); + +var msg6356 = msg("3906", dup276); + +var msg6357 = msg("3907", dup276); + +var msg6358 = msg("3908", dup276); + +var msg6359 = msg("3909", dup276); + +var msg6360 = msg("3910", dup276); + +var msg6361 = msg("3911", dup276); + +var msg6362 = msg("3912", dup276); + +var msg6363 = msg("3913", dup276); + +var msg6364 = msg("3914", dup276); + +var msg6365 = msg("3915", dup276); + +var msg6366 = msg("3916", dup276); + +var msg6367 = msg("3917", dup276); + +var msg6368 = msg("3918", dup276); + +var msg6369 = msg("3919", dup276); + +var msg6370 = msg("3920", dup276); + +var msg6371 = msg("3921", dup276); + +var msg6372 = msg("3922", dup276); + +var msg6373 = msg("3923", dup276); + +var msg6374 = msg("3924", dup276); + +var msg6375 = msg("3925", dup276); + +var msg6376 = msg("3926", dup276); + +var msg6377 = msg("3927", dup276); + +var msg6378 = msg("3928", dup276); + +var msg6379 = msg("3929", dup276); + +var msg6380 = msg("3930", dup276); + +var msg6381 = msg("3931", dup276); + +var msg6382 = msg("3932", dup276); + +var msg6383 = msg("3933", dup276); + +var msg6384 = msg("3934", dup276); + +var msg6385 = msg("3935", dup276); + +var msg6386 = msg("3936", dup276); + +var msg6387 = msg("3937", dup276); + +var msg6388 = msg("3938", dup276); + +var msg6389 = msg("3939", dup276); + +var msg6390 = msg("3940", dup276); + +var msg6391 = msg("3941", dup276); + +var msg6392 = msg("3942", dup276); + +var msg6393 = msg("3943", dup276); + +var msg6394 = msg("3944", dup276); + +var msg6395 = msg("3945", dup276); + +var msg6396 = msg("3946", dup276); + +var msg6397 = msg("3947", dup276); + +var msg6398 = msg("3948", dup276); + +var msg6399 = msg("3949", dup276); + +var msg6400 = msg("3950", dup276); + +var msg6401 = msg("3951", dup276); + +var msg6402 = msg("3952", dup276); + +var msg6403 = msg("3953", dup276); + +var msg6404 = msg("3954", dup276); + +var msg6405 = msg("3955", dup276); + +var msg6406 = msg("3956", dup276); + +var msg6407 = msg("3957", dup276); + +var msg6408 = msg("3958", dup276); + +var msg6409 = msg("3959", dup276); + +var msg6410 = msg("3960", dup276); + +var msg6411 = msg("3961", dup276); + +var msg6412 = msg("3962", dup276); + +var msg6413 = msg("3963", dup276); + +var msg6414 = msg("3964", dup276); + +var msg6415 = msg("3965", dup276); + +var msg6416 = msg("3966", dup276); + +var msg6417 = msg("3967", dup276); + +var msg6418 = msg("3968", dup276); + +var msg6419 = msg("3969", dup276); + +var msg6420 = msg("3970", dup276); + +var msg6421 = msg("3971", dup276); + +var msg6422 = msg("3972", dup276); + +var msg6423 = msg("3973", dup276); + +var msg6424 = msg("3974", dup276); + +var msg6425 = msg("3975", dup276); + +var msg6426 = msg("3976", dup276); + +var msg6427 = msg("3977", dup276); + +var msg6428 = msg("3978", dup276); + +var msg6429 = msg("3979", dup276); + +var msg6430 = msg("3980", dup276); + +var msg6431 = msg("3981", dup276); + +var msg6432 = msg("3982", dup276); + +var msg6433 = msg("3983", dup276); + +var msg6434 = msg("3984", dup276); + +var msg6435 = msg("3985", dup276); + +var msg6436 = msg("3986", dup276); + +var msg6437 = msg("3987", dup276); + +var msg6438 = msg("3988", dup276); + +var msg6439 = msg("3989", dup276); + +var msg6440 = msg("3990", dup276); + +var msg6441 = msg("3991", dup276); + +var msg6442 = msg("3992", dup276); + +var msg6443 = msg("3993", dup276); + +var msg6444 = msg("3994", dup276); + +var msg6445 = msg("3995", dup276); + +var msg6446 = msg("3996", dup276); + +var msg6447 = msg("3997", dup276); + +var msg6448 = msg("3998", dup276); + +var msg6449 = msg("3999", dup276); + +var msg6450 = msg("4000", dup276); + +var msg6451 = msg("4001", dup276); + +var msg6452 = msg("4002", dup276); + +var msg6453 = msg("4003", dup276); + +var msg6454 = msg("4004", dup276); + +var msg6455 = msg("4005", dup276); + +var msg6456 = msg("4006", dup276); + +var msg6457 = msg("4007", dup276); + +var msg6458 = msg("4008", dup276); + +var msg6459 = msg("4009", dup276); + +var msg6460 = msg("4010", dup276); + +var msg6461 = msg("4011", dup276); + +var msg6462 = msg("4012", dup276); + +var msg6463 = msg("4013", dup276); + +var msg6464 = msg("4014", dup276); + +var msg6465 = msg("4015", dup276); + +var msg6466 = msg("4016", dup276); + +var msg6467 = msg("4017", dup276); + +var msg6468 = msg("4018", dup276); + +var msg6469 = msg("4019", dup276); + +var msg6470 = msg("4020", dup276); + +var msg6471 = msg("4021", dup276); + +var msg6472 = msg("4022", dup276); + +var msg6473 = msg("4023", dup276); + +var msg6474 = msg("4024", dup276); + +var msg6475 = msg("4025", dup276); + +var msg6476 = msg("4026", dup276); + +var msg6477 = msg("4027", dup276); + +var msg6478 = msg("4028", dup276); + +var msg6479 = msg("4029", dup276); + +var msg6480 = msg("4030", dup276); + +var msg6481 = msg("4031", dup276); + +var msg6482 = msg("4032", dup276); + +var msg6483 = msg("4033", dup276); + +var msg6484 = msg("4034", dup276); + +var msg6485 = msg("4035", dup276); + +var msg6486 = msg("4036", dup276); + +var msg6487 = msg("4037", dup276); + +var msg6488 = msg("4038", dup276); + +var msg6489 = msg("4039", dup276); + +var msg6490 = msg("4040", dup276); + +var msg6491 = msg("4041", dup276); + +var msg6492 = msg("4042", dup276); + +var msg6493 = msg("4043", dup276); + +var msg6494 = msg("4044", dup276); + +var msg6495 = msg("4045", dup276); + +var msg6496 = msg("4046", dup276); + +var msg6497 = msg("4047", dup276); + +var msg6498 = msg("4048", dup276); + +var msg6499 = msg("4049", dup276); + +var msg6500 = msg("4050", dup276); + +var msg6501 = msg("4051", dup276); + +var msg6502 = msg("4052", dup276); + +var msg6503 = msg("4053", dup276); + +var msg6504 = msg("4054", dup276); + +var msg6505 = msg("4055", dup276); + +var msg6506 = msg("4056", dup276); + +var msg6507 = msg("4057", dup276); + +var msg6508 = msg("4058", dup276); + +var msg6509 = msg("4059", dup276); + +var msg6510 = msg("4060", dup196); + +var msg6511 = msg("4061", dup276); + +var msg6512 = msg("4062", dup276); + +var msg6513 = msg("4063", dup276); + +var msg6514 = msg("4064", dup276); + +var msg6515 = msg("4065", dup276); + +var msg6516 = msg("4066", dup276); + +var msg6517 = msg("4067", dup276); + +var msg6518 = msg("4068", dup276); + +var msg6519 = msg("4069", dup276); + +var msg6520 = msg("4070", dup276); + +var msg6521 = msg("4071", dup276); + +var msg6522 = msg("4072", dup276); + +var msg6523 = msg("4073", dup276); + +var msg6524 = msg("4074", dup276); + +var msg6525 = msg("4075", dup276); + +var msg6526 = msg("4076", dup276); + +var msg6527 = msg("4077", dup276); + +var msg6528 = msg("4078", dup276); + +var msg6529 = msg("4079", dup276); + +var msg6530 = msg("4080", dup276); + +var msg6531 = msg("4081", dup276); + +var msg6532 = msg("4082", dup276); + +var msg6533 = msg("4083", dup276); + +var msg6534 = msg("4084", dup276); + +var msg6535 = msg("4085", dup276); + +var msg6536 = msg("4086", dup276); + +var msg6537 = msg("4087", dup276); + +var msg6538 = msg("4088", dup276); + +var msg6539 = msg("4089", dup276); + +var msg6540 = msg("4090", dup276); + +var msg6541 = msg("4091", dup276); + +var msg6542 = msg("4092", dup276); + +var msg6543 = msg("4093", dup276); + +var msg6544 = msg("4094", dup276); + +var msg6545 = msg("4095", dup276); + +var msg6546 = msg("4096", dup276); + +var msg6547 = msg("4097", dup276); + +var msg6548 = msg("4098", dup276); + +var msg6549 = msg("4099", dup276); + +var msg6550 = msg("4100", dup276); + +var msg6551 = msg("4101", dup276); + +var msg6552 = msg("4102", dup276); + +var msg6553 = msg("4103", dup276); + +var msg6554 = msg("4104", dup276); + +var msg6555 = msg("4105", dup276); + +var msg6556 = msg("4106", dup276); + +var msg6557 = msg("4107", dup276); + +var msg6558 = msg("4108", dup276); + +var msg6559 = msg("4109", dup276); + +var msg6560 = msg("4110", dup276); + +var msg6561 = msg("4111", dup276); + +var msg6562 = msg("4112", dup276); + +var msg6563 = msg("4113", dup276); + +var msg6564 = msg("4114", dup276); + +var msg6565 = msg("4115", dup276); + +var msg6566 = msg("4116", dup276); + +var msg6567 = msg("4117", dup276); + +var msg6568 = msg("4118", dup276); + +var msg6569 = msg("4119", dup276); + +var msg6570 = msg("4120", dup276); + +var msg6571 = msg("4121", dup276); + +var msg6572 = msg("4122", dup276); + +var msg6573 = msg("4123", dup276); + +var msg6574 = msg("4124", dup276); + +var msg6575 = msg("4125", dup276); + +var msg6576 = msg("4126", dup196); + +var msg6577 = msg("4127", dup222); + +var msg6578 = msg("4128", dup265); + +var msg6579 = msg("4129", dup198); + +var msg6580 = msg("4130", dup222); + +var msg6581 = msg("4131", dup196); + +var msg6582 = msg("4132", dup265); + +var msg6583 = msg("4133", dup265); + +var msg6584 = msg("4134", dup265); + +var msg6585 = msg("4135", dup267); + +var msg6586 = msg("4136", dup267); + +var msg6587 = msg("4140", dup198); + +var msg6588 = msg("4141", dup198); + +var msg6589 = msg("4142", dup196); + +var msg6590 = msg("4143", dup196); + +var msg6591 = msg("4144", dup196); + +var msg6592 = msg("4145", dup265); + +var msg6593 = msg("4146", dup265); + +var msg6594 = msg("4147", dup265); + +var msg6595 = msg("4148", dup265); + +var msg6596 = msg("4149", dup265); + +var msg6597 = msg("4150", dup265); + +var msg6598 = msg("4151", dup265); + +var msg6599 = msg("4152", dup265); + +var msg6600 = msg("4153", dup265); + +var msg6601 = msg("4154", dup265); + +var msg6602 = msg("4155", dup265); + +var msg6603 = msg("4156", dup265); + +var msg6604 = msg("4157", dup265); + +var msg6605 = msg("4158", dup265); + +var msg6606 = msg("4159", dup265); + +var msg6607 = msg("4160", dup265); + +var msg6608 = msg("4161", dup265); + +var msg6609 = msg("4162", dup265); + +var msg6610 = msg("4163", dup265); + +var msg6611 = msg("4164", dup265); + +var msg6612 = msg("4165", dup265); + +var msg6613 = msg("4166", dup265); + +var msg6614 = msg("4167", dup265); + +var msg6615 = msg("4168", dup265); + +var msg6616 = msg("4169", dup265); + +var msg6617 = msg("4170", dup265); + +var msg6618 = msg("4171", dup265); + +var msg6619 = msg("4172", dup265); + +var msg6620 = msg("4173", dup265); + +var msg6621 = msg("4174", dup265); + +var msg6622 = msg("4175", dup265); + +var msg6623 = msg("4176", dup265); + +var msg6624 = msg("4177", dup265); + +var msg6625 = msg("4178", dup265); + +var msg6626 = msg("4179", dup265); + +var msg6627 = msg("4180", dup194); + +var msg6628 = msg("4181", dup265); + +var msg6629 = msg("4182", dup265); + +var msg6630 = msg("4183", dup265); + +var msg6631 = msg("4184", dup265); + +var msg6632 = msg("4185", dup265); + +var msg6633 = msg("4186", dup265); + +var msg6634 = msg("4187", dup265); + +var msg6635 = msg("4188", dup194); + +var msg6636 = msg("4189", dup265); + +var msg6637 = msg("4190", dup265); + +var msg6638 = msg("4191", dup265); + +var msg6639 = msg("4192", dup265); + +var msg6640 = msg("4193", dup265); + +var msg6641 = msg("4194", dup196); + +var msg6642 = msg("4195", dup265); + +var msg6643 = msg("4196", dup265); + +var msg6644 = msg("4197", dup265); + +var msg6645 = msg("4198", dup265); + +var msg6646 = msg("4199", dup265); + +var msg6647 = msg("4200", dup265); + +var msg6648 = msg("4201", dup265); + +var msg6649 = msg("4202", dup265); + +var msg6650 = msg("4203", dup265); + +var msg6651 = msg("4204", dup265); + +var msg6652 = msg("4205", dup265); + +var msg6653 = msg("4206", dup265); + +var msg6654 = msg("4207", dup265); + +var msg6655 = msg("4208", dup265); + +var msg6656 = msg("4209", dup265); + +var msg6657 = msg("4210", dup265); + +var msg6658 = msg("4211", dup265); + +var msg6659 = msg("4212", dup265); + +var msg6660 = msg("4213", dup265); + +var msg6661 = msg("4214", dup265); + +var msg6662 = msg("4215", dup265); + +var msg6663 = msg("4216", dup265); + +var msg6664 = msg("4217", dup265); + +var msg6665 = msg("4218", dup265); + +var msg6666 = msg("4219", dup265); + +var msg6667 = msg("4220", dup265); + +var msg6668 = msg("4221", dup265); + +var msg6669 = msg("4222", dup265); + +var msg6670 = msg("4223", dup265); + +var msg6671 = msg("4224", dup265); + +var msg6672 = msg("4225", dup265); + +var msg6673 = msg("4226", dup265); + +var msg6674 = msg("4227", dup265); + +var msg6675 = msg("4228", dup265); + +var msg6676 = msg("4229", dup265); + +var msg6677 = msg("4230", dup265); + +var msg6678 = msg("4231", dup265); + +var msg6679 = msg("4232", dup265); + +var msg6680 = msg("4233", dup265); + +var msg6681 = msg("4234", dup265); + +var msg6682 = msg("4235", dup265); + +var msg6683 = msg("4236", dup265); + +var msg6684 = msg("4237", dup276); + +var msg6685 = msg("4238", dup276); + +var msg6686 = msg("4239", dup276); + +var msg6687 = msg("4240", dup276); + +var msg6688 = msg("4241", dup276); + +var msg6689 = msg("4242", dup276); + +var msg6690 = msg("4243", dup276); + +var msg6691 = msg("4244", dup276); + +var msg6692 = msg("4245", dup276); + +var msg6693 = msg("4246", dup276); + +var msg6694 = msg("4247", dup276); + +var msg6695 = msg("4248", dup276); + +var msg6696 = msg("4249", dup276); + +var msg6697 = msg("4250", dup276); + +var msg6698 = msg("4251", dup276); + +var msg6699 = msg("4252", dup276); + +var msg6700 = msg("4253", dup276); + +var msg6701 = msg("4254", dup276); + +var msg6702 = msg("4255", dup276); + +var msg6703 = msg("4256", dup276); + +var msg6704 = msg("4257", dup276); + +var msg6705 = msg("4258", dup276); + +var msg6706 = msg("4259", dup276); + +var msg6707 = msg("4260", dup276); + +var msg6708 = msg("4261", dup276); + +var msg6709 = msg("4262", dup276); + +var msg6710 = msg("4263", dup276); + +var msg6711 = msg("4264", dup276); + +var msg6712 = msg("4265", dup276); + +var msg6713 = msg("4266", dup276); + +var msg6714 = msg("4267", dup276); + +var msg6715 = msg("4268", dup276); + +var msg6716 = msg("4269", dup276); + +var msg6717 = msg("4270", dup276); + +var msg6718 = msg("4271", dup276); + +var msg6719 = msg("4272", dup276); + +var msg6720 = msg("4273", dup276); + +var msg6721 = msg("4274", dup276); + +var msg6722 = msg("4275", dup276); + +var msg6723 = msg("4276", dup276); + +var msg6724 = msg("4277", dup276); + +var msg6725 = msg("4278", dup276); + +var msg6726 = msg("4279", dup276); + +var msg6727 = msg("4280", dup276); + +var msg6728 = msg("4281", dup276); + +var msg6729 = msg("4282", dup276); + +var msg6730 = msg("4283", dup276); + +var msg6731 = msg("4284", dup276); + +var msg6732 = msg("4285", dup276); + +var msg6733 = msg("4286", dup276); + +var msg6734 = msg("4287", dup276); + +var msg6735 = msg("4288", dup276); + +var msg6736 = msg("4289", dup276); + +var msg6737 = msg("4290", dup276); + +var msg6738 = msg("4291", dup276); + +var msg6739 = msg("4292", dup276); + +var msg6740 = msg("4293", dup276); + +var msg6741 = msg("4294", dup276); + +var msg6742 = msg("4295", dup276); + +var msg6743 = msg("4296", dup276); + +var msg6744 = msg("4297", dup276); + +var msg6745 = msg("4298", dup276); + +var msg6746 = msg("4299", dup276); + +var msg6747 = msg("4300", dup276); + +var msg6748 = msg("4301", dup276); + +var msg6749 = msg("4302", dup276); + +var msg6750 = msg("4303", dup276); + +var msg6751 = msg("4304", dup276); + +var msg6752 = msg("4305", dup276); + +var msg6753 = msg("4306", dup276); + +var msg6754 = msg("4307", dup276); + +var msg6755 = msg("4308", dup276); + +var msg6756 = msg("4309", dup276); + +var msg6757 = msg("4310", dup276); + +var msg6758 = msg("4311", dup276); + +var msg6759 = msg("4312", dup276); + +var msg6760 = msg("4313", dup276); + +var msg6761 = msg("4314", dup276); + +var msg6762 = msg("4315", dup276); + +var msg6763 = msg("4316", dup276); + +var msg6764 = msg("4317", dup276); + +var msg6765 = msg("4318", dup276); + +var msg6766 = msg("4319", dup276); + +var msg6767 = msg("4320", dup276); + +var msg6768 = msg("4321", dup276); + +var msg6769 = msg("4322", dup276); + +var msg6770 = msg("4323", dup276); + +var msg6771 = msg("4324", dup276); + +var msg6772 = msg("4325", dup276); + +var msg6773 = msg("4326", dup276); + +var msg6774 = msg("4327", dup276); + +var msg6775 = msg("4328", dup276); + +var msg6776 = msg("4329", dup276); + +var msg6777 = msg("4330", dup276); + +var msg6778 = msg("4331", dup276); + +var msg6779 = msg("4332", dup276); + +var msg6780 = msg("4333", dup276); + +var msg6781 = msg("4334", dup276); + +var msg6782 = msg("4335", dup276); + +var msg6783 = msg("4336", dup276); + +var msg6784 = msg("4337", dup276); + +var msg6785 = msg("4338", dup276); + +var msg6786 = msg("4339", dup276); + +var msg6787 = msg("4340", dup276); + +var msg6788 = msg("4341", dup276); + +var msg6789 = msg("4342", dup276); + +var msg6790 = msg("4343", dup276); + +var msg6791 = msg("4344", dup276); + +var msg6792 = msg("4345", dup276); + +var msg6793 = msg("4346", dup276); + +var msg6794 = msg("4347", dup276); + +var msg6795 = msg("4348", dup276); + +var msg6796 = msg("4349", dup276); + +var msg6797 = msg("4350", dup276); + +var msg6798 = msg("4351", dup276); + +var msg6799 = msg("4352", dup276); + +var msg6800 = msg("4353", dup276); + +var msg6801 = msg("4354", dup276); + +var msg6802 = msg("4355", dup276); + +var msg6803 = msg("4356", dup276); + +var msg6804 = msg("4357", dup276); + +var msg6805 = msg("4358", dup276); + +var msg6806 = msg("4359", dup276); + +var msg6807 = msg("4360", dup276); + +var msg6808 = msg("4361", dup276); + +var msg6809 = msg("4362", dup276); + +var msg6810 = msg("4363", dup276); + +var msg6811 = msg("4364", dup276); + +var msg6812 = msg("4365", dup276); + +var msg6813 = msg("4366", dup276); + +var msg6814 = msg("4367", dup276); + +var msg6815 = msg("4368", dup276); + +var msg6816 = msg("4369", dup276); + +var msg6817 = msg("4370", dup276); + +var msg6818 = msg("4371", dup276); + +var msg6819 = msg("4372", dup276); + +var msg6820 = msg("4373", dup276); + +var msg6821 = msg("4374", dup276); + +var msg6822 = msg("4375", dup276); + +var msg6823 = msg("4376", dup276); + +var msg6824 = msg("4377", dup276); + +var msg6825 = msg("4378", dup276); + +var msg6826 = msg("4379", dup276); + +var msg6827 = msg("4380", dup276); + +var msg6828 = msg("4381", dup276); + +var msg6829 = msg("4382", dup276); + +var msg6830 = msg("4383", dup276); + +var msg6831 = msg("4384", dup276); + +var msg6832 = msg("4385", dup276); + +var msg6833 = msg("4386", dup276); + +var msg6834 = msg("4387", dup276); + +var msg6835 = msg("4388", dup276); + +var msg6836 = msg("4389", dup276); + +var msg6837 = msg("4390", dup276); + +var msg6838 = msg("4391", dup276); + +var msg6839 = msg("4392", dup276); + +var msg6840 = msg("4393", dup276); + +var msg6841 = msg("4394", dup276); + +var msg6842 = msg("4395", dup276); + +var msg6843 = msg("4396", dup276); + +var msg6844 = msg("4397", dup276); + +var msg6845 = msg("4398", dup276); + +var msg6846 = msg("4399", dup276); + +var msg6847 = msg("4400", dup276); + +var msg6848 = msg("4401", dup276); + +var msg6849 = msg("4402", dup276); + +var msg6850 = msg("4403", dup276); + +var msg6851 = msg("4404", dup276); + +var msg6852 = msg("4405", dup276); + +var msg6853 = msg("4406", dup276); + +var msg6854 = msg("4407", dup276); + +var msg6855 = msg("4408", dup276); + +var msg6856 = msg("4409", dup276); + +var msg6857 = msg("4410", dup276); + +var msg6858 = msg("4411", dup276); + +var msg6859 = msg("4412", dup276); + +var msg6860 = msg("4413", dup276); + +var msg6861 = msg("4414", dup276); + +var msg6862 = msg("4415", dup276); + +var msg6863 = msg("4416", dup276); + +var msg6864 = msg("4417", dup276); + +var msg6865 = msg("4418", dup276); + +var msg6866 = msg("4419", dup276); + +var msg6867 = msg("4420", dup276); + +var msg6868 = msg("4421", dup276); + +var msg6869 = msg("4422", dup276); + +var msg6870 = msg("4423", dup276); + +var msg6871 = msg("4424", dup276); + +var msg6872 = msg("4425", dup276); + +var msg6873 = msg("4426", dup276); + +var msg6874 = msg("4427", dup276); + +var msg6875 = msg("4428", dup276); + +var msg6876 = msg("4429", dup276); + +var msg6877 = msg("4430", dup276); + +var msg6878 = msg("4431", dup276); + +var msg6879 = msg("4432", dup276); + +var msg6880 = msg("4433", dup276); + +var msg6881 = msg("4434", dup276); + +var msg6882 = msg("4435", dup276); + +var msg6883 = msg("4436", dup276); + +var msg6884 = msg("4437", dup276); + +var msg6885 = msg("4438", dup276); + +var msg6886 = msg("4439", dup276); + +var msg6887 = msg("4440", dup276); + +var msg6888 = msg("4441", dup276); + +var msg6889 = msg("4442", dup276); + +var msg6890 = msg("4443", dup276); + +var msg6891 = msg("4444", dup276); + +var msg6892 = msg("4445", dup276); + +var msg6893 = msg("4446", dup276); + +var msg6894 = msg("4447", dup276); + +var msg6895 = msg("4448", dup276); + +var msg6896 = msg("4449", dup276); + +var msg6897 = msg("4450", dup276); + +var msg6898 = msg("4451", dup276); + +var msg6899 = msg("4452", dup276); + +var msg6900 = msg("4453", dup276); + +var msg6901 = msg("4454", dup276); + +var msg6902 = msg("4455", dup276); + +var msg6903 = msg("4456", dup276); + +var msg6904 = msg("4457", dup276); + +var msg6905 = msg("4458", dup276); + +var msg6906 = msg("4459", dup276); + +var msg6907 = msg("4460", dup276); + +var msg6908 = msg("4461", dup276); + +var msg6909 = msg("4462", dup276); + +var msg6910 = msg("4463", dup276); + +var msg6911 = msg("4464", dup276); + +var msg6912 = msg("4465", dup276); + +var msg6913 = msg("4466", dup276); + +var msg6914 = msg("4467", dup276); + +var msg6915 = msg("4468", dup276); + +var msg6916 = msg("4469", dup276); + +var msg6917 = msg("4470", dup276); + +var msg6918 = msg("4471", dup276); + +var msg6919 = msg("4472", dup276); + +var msg6920 = msg("4473", dup276); + +var msg6921 = msg("4474", dup276); + +var msg6922 = msg("4475", dup276); + +var msg6923 = msg("4476", dup276); + +var msg6924 = msg("4477", dup276); + +var msg6925 = msg("4478", dup276); + +var msg6926 = msg("4479", dup276); + +var msg6927 = msg("4480", dup276); + +var msg6928 = msg("4481", dup276); + +var msg6929 = msg("4482", dup276); + +var msg6930 = msg("4483", dup276); + +var msg6931 = msg("4484", dup276); + +var msg6932 = msg("4485", dup276); + +var msg6933 = msg("4486", dup276); + +var msg6934 = msg("4487", dup276); + +var msg6935 = msg("4488", dup276); + +var msg6936 = msg("4489", dup276); + +var msg6937 = msg("4490", dup276); + +var msg6938 = msg("4491", dup276); + +var msg6939 = msg("4492", dup276); + +var msg6940 = msg("4493", dup276); + +var msg6941 = msg("4494", dup276); + +var msg6942 = msg("4495", dup276); + +var msg6943 = msg("4496", dup276); + +var msg6944 = msg("4497", dup276); + +var msg6945 = msg("4498", dup276); + +var msg6946 = msg("4499", dup276); + +var msg6947 = msg("4500", dup276); + +var msg6948 = msg("4501", dup276); + +var msg6949 = msg("4502", dup276); + +var msg6950 = msg("4503", dup276); + +var msg6951 = msg("4504", dup276); + +var msg6952 = msg("4505", dup276); + +var msg6953 = msg("4506", dup276); + +var msg6954 = msg("4507", dup276); + +var msg6955 = msg("4508", dup276); + +var msg6956 = msg("4509", dup276); + +var msg6957 = msg("4510", dup276); + +var msg6958 = msg("4511", dup276); + +var msg6959 = msg("4512", dup276); + +var msg6960 = msg("4513", dup276); + +var msg6961 = msg("4514", dup276); + +var msg6962 = msg("4515", dup276); + +var msg6963 = msg("4516", dup276); + +var msg6964 = msg("4517", dup276); + +var msg6965 = msg("4518", dup276); + +var msg6966 = msg("4519", dup276); + +var msg6967 = msg("4520", dup276); + +var msg6968 = msg("4521", dup276); + +var msg6969 = msg("4522", dup276); + +var msg6970 = msg("4523", dup276); + +var msg6971 = msg("4524", dup276); + +var msg6972 = msg("4525", dup276); + +var msg6973 = msg("4526", dup276); + +var msg6974 = msg("4527", dup276); + +var msg6975 = msg("4528", dup276); + +var msg6976 = msg("4529", dup276); + +var msg6977 = msg("4530", dup276); + +var msg6978 = msg("4531", dup276); + +var msg6979 = msg("4532", dup276); + +var msg6980 = msg("4533", dup276); + +var msg6981 = msg("4534", dup276); + +var msg6982 = msg("4535", dup276); + +var msg6983 = msg("4536", dup276); + +var msg6984 = msg("4537", dup276); + +var msg6985 = msg("4538", dup276); + +var msg6986 = msg("4539", dup276); + +var msg6987 = msg("4540", dup276); + +var msg6988 = msg("4541", dup276); + +var msg6989 = msg("4542", dup276); + +var msg6990 = msg("4543", dup276); + +var msg6991 = msg("4544", dup276); + +var msg6992 = msg("4545", dup276); + +var msg6993 = msg("4546", dup276); + +var msg6994 = msg("4547", dup276); + +var msg6995 = msg("4548", dup276); + +var msg6996 = msg("4549", dup276); + +var msg6997 = msg("4550", dup276); + +var msg6998 = msg("4551", dup276); + +var msg6999 = msg("4552", dup276); + +var msg7000 = msg("4553", dup276); + +var msg7001 = msg("4554", dup276); + +var msg7002 = msg("4555", dup276); + +var msg7003 = msg("4556", dup276); + +var msg7004 = msg("4557", dup276); + +var msg7005 = msg("4558", dup276); + +var msg7006 = msg("4559", dup276); + +var msg7007 = msg("4560", dup276); + +var msg7008 = msg("4561", dup276); + +var msg7009 = msg("4562", dup276); + +var msg7010 = msg("4563", dup276); + +var msg7011 = msg("4564", dup276); + +var msg7012 = msg("4565", dup276); + +var msg7013 = msg("4566", dup276); + +var msg7014 = msg("4567", dup276); + +var msg7015 = msg("4568", dup276); + +var msg7016 = msg("4569", dup276); + +var msg7017 = msg("4570", dup276); + +var msg7018 = msg("4571", dup276); + +var msg7019 = msg("4572", dup276); + +var msg7020 = msg("4573", dup276); + +var msg7021 = msg("4574", dup276); + +var msg7022 = msg("4575", dup276); + +var msg7023 = msg("4576", dup276); + +var msg7024 = msg("4577", dup276); + +var msg7025 = msg("4578", dup276); + +var msg7026 = msg("4579", dup276); + +var msg7027 = msg("4580", dup276); + +var msg7028 = msg("4581", dup276); + +var msg7029 = msg("4582", dup276); + +var msg7030 = msg("4583", dup276); + +var msg7031 = msg("4584", dup276); + +var msg7032 = msg("4585", dup276); + +var msg7033 = msg("4586", dup276); + +var msg7034 = msg("4587", dup276); + +var msg7035 = msg("4588", dup276); + +var msg7036 = msg("4589", dup276); + +var msg7037 = msg("4590", dup276); + +var msg7038 = msg("4591", dup276); + +var msg7039 = msg("4592", dup276); + +var msg7040 = msg("4593", dup276); + +var msg7041 = msg("4594", dup276); + +var msg7042 = msg("4595", dup276); + +var msg7043 = msg("4596", dup276); + +var msg7044 = msg("4597", dup276); + +var msg7045 = msg("4598", dup276); + +var msg7046 = msg("4599", dup276); + +var msg7047 = msg("4600", dup276); + +var msg7048 = msg("4601", dup276); + +var msg7049 = msg("4602", dup276); + +var msg7050 = msg("4603", dup276); + +var msg7051 = msg("4604", dup276); + +var msg7052 = msg("4605", dup276); + +var msg7053 = msg("4606", dup276); + +var msg7054 = msg("4607", dup276); + +var msg7055 = msg("4608", dup276); + +var msg7056 = msg("4609", dup276); + +var msg7057 = msg("4610", dup276); + +var msg7058 = msg("4611", dup276); + +var msg7059 = msg("4612", dup276); + +var msg7060 = msg("4613", dup276); + +var msg7061 = msg("4614", dup276); + +var msg7062 = msg("4615", dup276); + +var msg7063 = msg("4616", dup276); + +var msg7064 = msg("4617", dup276); + +var msg7065 = msg("4618", dup276); + +var msg7066 = msg("4619", dup276); + +var msg7067 = msg("4620", dup276); + +var msg7068 = msg("4621", dup276); + +var msg7069 = msg("4622", dup276); + +var msg7070 = msg("4623", dup276); + +var msg7071 = msg("4624", dup276); + +var msg7072 = msg("4625", dup276); + +var msg7073 = msg("4626", dup276); + +var msg7074 = msg("4627", dup276); + +var msg7075 = msg("4628", dup276); + +var msg7076 = msg("4629", dup276); + +var msg7077 = msg("4630", dup276); + +var msg7078 = msg("4631", dup276); + +var msg7079 = msg("4632", dup276); + +var msg7080 = msg("4633", dup276); + +var msg7081 = msg("4634", dup276); + +var msg7082 = msg("4635", dup276); + +var msg7083 = msg("4636", dup276); + +var msg7084 = msg("4637", dup267); + +var msg7085 = msg("4638", dup198); + +var msg7086 = msg("4639", dup222); + +var msg7087 = msg("4640", dup222); + +var msg7088 = msg("4641", dup222); + +var msg7089 = msg("4642", dup222); + +var msg7090 = msg("4643", dup267); + +var msg7091 = msg("4644", dup267); + +var msg7092 = msg("4645", dup196); + +var msg7093 = msg("4646", dup196); + +var msg7094 = msg("4647", dup201); + +var msg7095 = msg("4648", dup265); + +var msg7096 = msg("4649", dup260); + +var msg7097 = msg("4650", dup265); + +var msg7098 = msg("4651", dup276); + +var msg7099 = msg("4652", dup276); + +var msg7100 = msg("4653", dup276); + +var msg7101 = msg("4654", dup276); + +var msg7102 = msg("4655", dup276); + +var msg7103 = msg("4656", dup276); + +var msg7104 = msg("4657", dup276); + +var msg7105 = msg("4658", dup276); + +var msg7106 = msg("4659", dup276); + +var msg7107 = msg("4660", dup276); + +var msg7108 = msg("4661", dup276); + +var msg7109 = msg("4662", dup276); + +var msg7110 = msg("4663", dup276); + +var msg7111 = msg("4664", dup276); + +var msg7112 = msg("4665", dup276); + +var msg7113 = msg("4666", dup276); + +var msg7114 = msg("4667", dup276); + +var msg7115 = msg("4668", dup276); + +var msg7116 = msg("4669", dup276); + +var msg7117 = msg("4670", dup276); + +var msg7118 = msg("4671", dup276); + +var msg7119 = msg("4672", dup276); + +var msg7120 = msg("4673", dup276); + +var msg7121 = msg("4674", dup276); + +var msg7122 = msg("4675", dup267); + +var msg7123 = msg("4676", dup222); + +var msg7124 = msg("4677", dup222); + +var msg7125 = msg("4678", dup196); + +var msg7126 = msg("4679", dup267); + +var msg7127 = msg("4680", dup267); + +var msg7128 = msg("4681", dup265); + +var msg7129 = msg("4682", dup276); + +var msg7130 = msg("4683", dup276); + +var msg7131 = msg("4684", dup276); + +var msg7132 = msg("4685", dup276); + +var msg7133 = msg("4686", dup276); + +var msg7134 = msg("4687", dup276); + +var msg7135 = msg("4688", dup276); + +var msg7136 = msg("4689", dup276); + +var msg7137 = msg("4690", dup276); + +var msg7138 = msg("4691", dup276); + +var msg7139 = msg("4692", dup276); + +var msg7140 = msg("4693", dup276); + +var msg7141 = msg("4694", dup276); + +var msg7142 = msg("4695", dup276); + +var msg7143 = msg("4696", dup276); + +var msg7144 = msg("4697", dup276); + +var msg7145 = msg("4698", dup276); + +var msg7146 = msg("4699", dup276); + +var msg7147 = msg("4700", dup276); + +var msg7148 = msg("4701", dup276); + +var msg7149 = msg("4702", dup276); + +var msg7150 = msg("4703", dup276); + +var msg7151 = msg("4704", dup276); + +var msg7152 = msg("4705", dup276); + +var msg7153 = msg("4706", dup276); + +var msg7154 = msg("4707", dup276); + +var msg7155 = msg("4708", dup276); + +var msg7156 = msg("4709", dup276); + +var msg7157 = msg("4710", dup276); + +var msg7158 = msg("4711", dup276); + +var msg7159 = msg("4712", dup276); + +var msg7160 = msg("4713", dup276); + +var msg7161 = msg("4714", dup276); + +var msg7162 = msg("4715", dup276); + +var msg7163 = msg("4716", dup276); + +var msg7164 = msg("4717", dup276); + +var msg7165 = msg("4718", dup276); + +var msg7166 = msg("4719", dup276); + +var msg7167 = msg("4720", dup276); + +var msg7168 = msg("4721", dup276); + +var msg7169 = msg("4722", dup276); + +var msg7170 = msg("4723", dup276); + +var msg7171 = msg("4724", dup276); + +var msg7172 = msg("4725", dup276); + +var msg7173 = msg("4726", dup276); + +var msg7174 = msg("4727", dup276); + +var msg7175 = msg("4728", dup276); + +var msg7176 = msg("4729", dup276); + +var msg7177 = msg("4730", dup276); + +var msg7178 = msg("4731", dup276); + +var msg7179 = msg("4732", dup276); + +var msg7180 = msg("4733", dup276); + +var msg7181 = msg("4734", dup276); + +var msg7182 = msg("4735", dup276); + +var msg7183 = msg("4736", dup276); + +var msg7184 = msg("4737", dup276); + +var msg7185 = msg("4738", dup276); + +var msg7186 = msg("4739", dup276); + +var msg7187 = msg("4740", dup276); + +var msg7188 = msg("4741", dup276); + +var msg7189 = msg("4742", dup276); + +var msg7190 = msg("4743", dup276); + +var msg7191 = msg("4744", dup276); + +var msg7192 = msg("4745", dup276); + +var msg7193 = msg("4746", dup276); + +var msg7194 = msg("4747", dup276); + +var msg7195 = msg("4748", dup276); + +var msg7196 = msg("4749", dup276); + +var msg7197 = msg("4750", dup276); + +var msg7198 = msg("4751", dup276); + +var msg7199 = msg("4752", dup276); + +var msg7200 = msg("4753", dup276); + +var msg7201 = msg("4754", dup201); + +var msg7202 = msg("4755", dup201); + +var msg7203 = msg("4756", dup201); + +var msg7204 = msg("4757", dup201); + +var msg7205 = msg("4758", dup276); + +var msg7206 = msg("4759", dup276); + +var msg7207 = msg("4760", dup276); + +var msg7208 = msg("4761", dup276); + +var msg7209 = msg("4762", dup276); + +var msg7210 = msg("4763", dup276); + +var msg7211 = msg("4764", dup276); + +var msg7212 = msg("4765", dup276); + +var msg7213 = msg("4766", dup276); + +var msg7214 = msg("4767", dup276); + +var msg7215 = msg("4768", dup276); + +var msg7216 = msg("4769", dup276); + +var msg7217 = msg("4770", dup276); + +var msg7218 = msg("4771", dup276); + +var msg7219 = msg("4772", dup276); + +var msg7220 = msg("4773", dup276); + +var msg7221 = msg("4774", dup276); + +var msg7222 = msg("4775", dup276); + +var msg7223 = msg("4776", dup276); + +var msg7224 = msg("4777", dup276); + +var msg7225 = msg("4778", dup276); + +var msg7226 = msg("4779", dup276); + +var msg7227 = msg("4780", dup276); + +var msg7228 = msg("4781", dup276); + +var msg7229 = msg("4782", dup276); + +var msg7230 = msg("4783", dup276); + +var msg7231 = msg("4784", dup276); + +var msg7232 = msg("4785", dup276); + +var msg7233 = msg("4786", dup276); + +var msg7234 = msg("4787", dup276); + +var msg7235 = msg("4788", dup276); + +var msg7236 = msg("4789", dup276); + +var msg7237 = msg("4790", dup276); + +var msg7238 = msg("4791", dup276); + +var msg7239 = msg("4792", dup276); + +var msg7240 = msg("4793", dup276); + +var msg7241 = msg("4794", dup276); + +var msg7242 = msg("4795", dup276); + +var msg7243 = msg("4796", dup276); + +var msg7244 = msg("4797", dup276); + +var msg7245 = msg("4798", dup276); + +var msg7246 = msg("4799", dup276); + +var msg7247 = msg("4800", dup276); + +var msg7248 = msg("4801", dup276); + +var msg7249 = msg("4802", dup276); + +var msg7250 = msg("4803", dup276); + +var msg7251 = msg("4804", dup276); + +var msg7252 = msg("4805", dup276); + +var msg7253 = msg("4806", dup276); + +var msg7254 = msg("4807", dup276); + +var msg7255 = msg("4808", dup276); + +var msg7256 = msg("4809", dup276); + +var msg7257 = msg("4810", dup276); + +var msg7258 = msg("4811", dup276); + +var msg7259 = msg("4812", dup276); + +var msg7260 = msg("4813", dup276); + +var msg7261 = msg("4814", dup276); + +var msg7262 = msg("4815", dup276); + +var msg7263 = msg("4816", dup276); + +var msg7264 = msg("4817", dup276); + +var msg7265 = msg("4818", dup276); + +var msg7266 = msg("4819", dup276); + +var msg7267 = msg("4820", dup276); + +var msg7268 = msg("4821", dup276); + +var msg7269 = msg("4822", dup201); + +var msg7270 = msg("4823", dup201); + +var msg7271 = msg("4824", dup201); + +var msg7272 = msg("4825", dup201); + +var msg7273 = msg("4826", dup276); + +var msg7274 = msg("4827", dup276); + +var msg7275 = msg("4828", dup276); + +var msg7276 = msg("4829", dup276); + +var msg7277 = msg("4830", dup276); + +var msg7278 = msg("4831", dup276); + +var msg7279 = msg("4832", dup276); + +var msg7280 = msg("4833", dup276); + +var msg7281 = msg("4834", dup276); + +var msg7282 = msg("4835", dup276); + +var msg7283 = msg("4836", dup276); + +var msg7284 = msg("4837", dup276); + +var msg7285 = msg("4838", dup276); + +var msg7286 = msg("4839", dup276); + +var msg7287 = msg("4840", dup276); + +var msg7288 = msg("4841", dup276); + +var msg7289 = msg("4842", dup276); + +var msg7290 = msg("4843", dup276); + +var msg7291 = msg("4844", dup276); + +var msg7292 = msg("4845", dup276); + +var msg7293 = msg("4846", dup276); + +var msg7294 = msg("4847", dup276); + +var msg7295 = msg("4848", dup276); + +var msg7296 = msg("4849", dup276); + +var msg7297 = msg("4850", dup276); + +var msg7298 = msg("4851", dup276); + +var msg7299 = msg("4852", dup276); + +var msg7300 = msg("4853", dup276); + +var msg7301 = msg("4854", dup276); + +var msg7302 = msg("4855", dup276); + +var msg7303 = msg("4856", dup276); + +var msg7304 = msg("4857", dup276); + +var msg7305 = msg("4858", dup276); + +var msg7306 = msg("4859", dup276); + +var msg7307 = msg("4860", dup276); + +var msg7308 = msg("4861", dup276); + +var msg7309 = msg("4862", dup276); + +var msg7310 = msg("4863", dup276); + +var msg7311 = msg("4864", dup276); + +var msg7312 = msg("4865", dup276); + +var msg7313 = msg("4866", dup276); + +var msg7314 = msg("4867", dup276); + +var msg7315 = msg("4868", dup276); + +var msg7316 = msg("4869", dup276); + +var msg7317 = msg("4870", dup276); + +var msg7318 = msg("4871", dup276); + +var msg7319 = msg("4872", dup276); + +var msg7320 = msg("4873", dup276); + +var msg7321 = msg("4874", dup276); + +var msg7322 = msg("4875", dup276); + +var msg7323 = msg("4876", dup276); + +var msg7324 = msg("4877", dup276); + +var msg7325 = msg("4878", dup276); + +var msg7326 = msg("4879", dup276); + +var msg7327 = msg("4880", dup276); + +var msg7328 = msg("4881", dup276); + +var msg7329 = msg("4882", dup276); + +var msg7330 = msg("4883", dup276); + +var msg7331 = msg("4884", dup276); + +var msg7332 = msg("4885", dup276); + +var msg7333 = msg("4886", dup276); + +var msg7334 = msg("4887", dup276); + +var msg7335 = msg("4888", dup276); + +var msg7336 = msg("4889", dup276); + +var msg7337 = msg("4890", dup265); + +var msg7338 = msg("4891", dup265); + +var msg7339 = msg("4892", dup265); + +var msg7340 = msg("4893", dup265); + +var msg7341 = msg("4894", dup265); + +var msg7342 = msg("4895", dup265); + +var msg7343 = msg("4896", dup265); + +var msg7344 = msg("4897", dup265); + +var msg7345 = msg("4898", dup265); + +var msg7346 = msg("4899", dup265); + +var msg7347 = msg("4900", dup265); + +var msg7348 = msg("4901", dup265); + +var msg7349 = msg("4902", dup265); + +var msg7350 = msg("4903", dup265); + +var msg7351 = msg("4904", dup265); + +var msg7352 = msg("4905", dup265); + +var msg7353 = msg("4906", dup265); + +var msg7354 = msg("4907", dup265); + +var msg7355 = msg("4908", dup265); + +var msg7356 = msg("4909", dup265); + +var msg7357 = msg("4910", dup265); + +var msg7358 = msg("4911", dup265); + +var msg7359 = msg("4912", dup265); + +var msg7360 = msg("4913", dup265); + +var msg7361 = msg("4914", dup265); + +var msg7362 = msg("4915", dup265); + +var msg7363 = msg("4916", dup201); + +var msg7364 = msg("4917", dup201); + +var msg7365 = msg("4918", dup198); + +var msg7366 = msg("4919", dup198); + +var msg7367 = msg("4920", dup198); + +var msg7368 = msg("4921", dup198); + +var msg7369 = msg("4922", dup198); + +var msg7370 = msg("4923", dup198); + +var msg7371 = msg("4924", dup198); + +var msg7372 = msg("4925", dup198); + +var msg7373 = msg("4926", dup198); + +var msg7374 = msg("4927", dup198); + +var msg7375 = msg("4928", dup198); + +var msg7376 = msg("4929", dup198); + +var msg7377 = msg("4930", dup198); + +var msg7378 = msg("4931", dup198); + +var msg7379 = msg("4932", dup198); + +var msg7380 = msg("4933", dup198); + +var msg7381 = msg("4934", dup198); + +var msg7382 = msg("4935", dup198); + +var msg7383 = msg("4936", dup198); + +var msg7384 = msg("4937", dup198); + +var msg7385 = msg("4938", dup198); + +var msg7386 = msg("4939", dup198); + +var msg7387 = msg("4940", dup198); + +var msg7388 = msg("4941", dup198); + +var msg7389 = msg("4942", dup198); + +var msg7390 = msg("4943", dup198); + +var msg7391 = msg("4944", dup198); + +var msg7392 = msg("4945", dup198); + +var msg7393 = msg("4946", dup198); + +var msg7394 = msg("4947", dup198); + +var msg7395 = msg("4948", dup198); + +var msg7396 = msg("4949", dup198); + +var msg7397 = msg("4950", dup198); + +var msg7398 = msg("4951", dup198); + +var msg7399 = msg("4952", dup198); + +var msg7400 = msg("4953", dup198); + +var msg7401 = msg("4954", dup198); + +var msg7402 = msg("4955", dup198); + +var msg7403 = msg("4956", dup198); + +var msg7404 = msg("4957", dup198); + +var msg7405 = msg("4958", dup198); + +var msg7406 = msg("4959", dup198); + +var msg7407 = msg("4960", dup198); + +var msg7408 = msg("4961", dup198); + +var msg7409 = msg("4962", dup198); + +var msg7410 = msg("4963", dup198); + +var msg7411 = msg("4964", dup198); + +var msg7412 = msg("4965", dup198); + +var msg7413 = msg("4966", dup198); + +var msg7414 = msg("4967", dup198); + +var msg7415 = msg("4968", dup198); + +var msg7416 = msg("4969", dup198); + +var msg7417 = msg("4970", dup198); + +var msg7418 = msg("4971", dup198); + +var msg7419 = msg("4972", dup198); + +var msg7420 = msg("4973", dup198); + +var msg7421 = msg("4974", dup198); + +var msg7422 = msg("4975", dup198); + +var msg7423 = msg("4976", dup198); + +var msg7424 = msg("4977", dup198); + +var msg7425 = msg("4978", dup198); + +var msg7426 = msg("4979", dup198); + +var msg7427 = msg("4980", dup198); + +var msg7428 = msg("4981", dup198); + +var msg7429 = msg("4982", dup265); + +var msg7430 = msg("4983", dup265); + +var msg7431 = msg("4984", dup236); + +var msg7432 = msg("4985", dup267); + +var msg7433 = msg("4986", dup267); + +var msg7434 = msg("4987", dup267); + +var msg7435 = msg("4988", dup265); + +var msg7436 = msg("4989", dup260); + +var msg7437 = msg("4990", dup260); + +var msg7438 = msg("4991", dup276); + +var msg7439 = msg("4992", dup276); + +var msg7440 = msg("4993", dup276); + +var msg7441 = msg("4994", dup276); + +var msg7442 = msg("4995", dup276); + +var msg7443 = msg("4996", dup276); + +var msg7444 = msg("4997", dup276); + +var msg7445 = msg("4998", dup276); + +var msg7446 = msg("4999", dup276); + +var msg7447 = msg("5000", dup276); + +var msg7448 = msg("5001", dup276); + +var msg7449 = msg("5002", dup276); + +var msg7450 = msg("5003", dup276); + +var msg7451 = msg("5004", dup276); + +var msg7452 = msg("5005", dup276); + +var msg7453 = msg("5006", dup276); + +var msg7454 = msg("5007", dup276); + +var msg7455 = msg("5008", dup276); + +var msg7456 = msg("5009", dup276); + +var msg7457 = msg("5010", dup276); + +var msg7458 = msg("5011", dup276); + +var msg7459 = msg("5012", dup276); + +var msg7460 = msg("5013", dup276); + +var msg7461 = msg("5014", dup276); + +var msg7462 = msg("5015", dup276); + +var msg7463 = msg("5016", dup276); + +var msg7464 = msg("5017", dup276); + +var msg7465 = msg("5018", dup276); + +var msg7466 = msg("5019", dup276); + +var msg7467 = msg("5020", dup276); + +var msg7468 = msg("5021", dup276); + +var msg7469 = msg("5022", dup276); + +var msg7470 = msg("5023", dup276); + +var msg7471 = msg("5024", dup276); + +var msg7472 = msg("5025", dup276); + +var msg7473 = msg("5026", dup276); + +var msg7474 = msg("5027", dup276); + +var msg7475 = msg("5028", dup276); + +var msg7476 = msg("5029", dup276); + +var msg7477 = msg("5030", dup276); + +var msg7478 = msg("5031", dup276); + +var msg7479 = msg("5032", dup276); + +var msg7480 = msg("5033", dup276); + +var msg7481 = msg("5034", dup276); + +var msg7482 = msg("5035", dup276); + +var msg7483 = msg("5036", dup276); + +var msg7484 = msg("5037", dup276); + +var msg7485 = msg("5038", dup276); + +var msg7486 = msg("5039", dup276); + +var msg7487 = msg("5040", dup276); + +var msg7488 = msg("5041", dup276); + +var msg7489 = msg("5042", dup276); + +var msg7490 = msg("5043", dup276); + +var msg7491 = msg("5044", dup276); + +var msg7492 = msg("5045", dup276); + +var msg7493 = msg("5046", dup276); + +var msg7494 = msg("5047", dup276); + +var msg7495 = msg("5048", dup276); + +var msg7496 = msg("5049", dup276); + +var msg7497 = msg("5050", dup276); + +var msg7498 = msg("5051", dup276); + +var msg7499 = msg("5052", dup276); + +var msg7500 = msg("5053", dup276); + +var msg7501 = msg("5054", dup276); + +var msg7502 = msg("5055", dup276); + +var msg7503 = msg("5056", dup276); + +var msg7504 = msg("5057", dup276); + +var msg7505 = msg("5058", dup276); + +var msg7506 = msg("5059", dup276); + +var msg7507 = msg("5060", dup276); + +var msg7508 = msg("5061", dup276); + +var msg7509 = msg("5062", dup276); + +var msg7510 = msg("5063", dup276); + +var msg7511 = msg("5064", dup276); + +var msg7512 = msg("5065", dup276); + +var msg7513 = msg("5066", dup276); + +var msg7514 = msg("5067", dup276); + +var msg7515 = msg("5068", dup276); + +var msg7516 = msg("5069", dup276); + +var msg7517 = msg("5070", dup276); + +var msg7518 = msg("5071", dup276); + +var msg7519 = msg("5072", dup276); + +var msg7520 = msg("5073", dup276); + +var msg7521 = msg("5074", dup276); + +var msg7522 = msg("5075", dup276); + +var msg7523 = msg("5076", dup276); + +var msg7524 = msg("5077", dup276); + +var msg7525 = msg("5078", dup276); + +var msg7526 = msg("5079", dup276); + +var msg7527 = msg("5080", dup276); + +var msg7528 = msg("5081", dup276); + +var msg7529 = msg("5082", dup276); + +var msg7530 = msg("5083", dup276); + +var msg7531 = msg("5084", dup276); + +var msg7532 = msg("5085", dup276); + +var msg7533 = msg("5086", dup276); + +var msg7534 = msg("5087", dup276); + +var msg7535 = msg("5088", dup276); + +var msg7536 = msg("5089", dup276); + +var msg7537 = msg("5090", dup276); + +var msg7538 = msg("5091", dup276); + +var msg7539 = msg("5092", dup276); + +var msg7540 = msg("5093", dup276); + +var msg7541 = msg("5094", dup276); + +var msg7542 = msg("5095", dup276); + +var msg7543 = msg("5096", dup276); + +var msg7544 = msg("5097", dup276); + +var msg7545 = msg("5098", dup276); + +var msg7546 = msg("5099", dup276); + +var msg7547 = msg("5100", dup276); + +var msg7548 = msg("5101", dup276); + +var msg7549 = msg("5102", dup276); + +var msg7550 = msg("5103", dup276); + +var msg7551 = msg("5104", dup276); + +var msg7552 = msg("5105", dup276); + +var msg7553 = msg("5106", dup276); + +var msg7554 = msg("5107", dup276); + +var msg7555 = msg("5108", dup276); + +var msg7556 = msg("5109", dup276); + +var msg7557 = msg("5110", dup276); + +var msg7558 = msg("5111", dup276); + +var msg7559 = msg("5112", dup276); + +var msg7560 = msg("5113", dup276); + +var msg7561 = msg("5114", dup276); + +var msg7562 = msg("5115", dup276); + +var msg7563 = msg("5116", dup276); + +var msg7564 = msg("5117", dup276); + +var msg7565 = msg("5118", dup276); + +var msg7566 = msg("5119", dup276); + +var msg7567 = msg("5120", dup276); + +var msg7568 = msg("5121", dup276); + +var msg7569 = msg("5122", dup276); + +var msg7570 = msg("5123", dup276); + +var msg7571 = msg("5124", dup276); + +var msg7572 = msg("5125", dup276); + +var msg7573 = msg("5126", dup276); + +var msg7574 = msg("5127", dup276); + +var msg7575 = msg("5128", dup276); + +var msg7576 = msg("5129", dup276); + +var msg7577 = msg("5130", dup276); + +var msg7578 = msg("5131", dup276); + +var msg7579 = msg("5132", dup276); + +var msg7580 = msg("5133", dup276); + +var msg7581 = msg("5134", dup276); + +var msg7582 = msg("5135", dup276); + +var msg7583 = msg("5136", dup276); + +var msg7584 = msg("5137", dup276); + +var msg7585 = msg("5138", dup276); + +var msg7586 = msg("5139", dup276); + +var msg7587 = msg("5140", dup276); + +var msg7588 = msg("5141", dup276); + +var msg7589 = msg("5142", dup276); + +var msg7590 = msg("5143", dup276); + +var msg7591 = msg("5144", dup276); + +var msg7592 = msg("5145", dup276); + +var msg7593 = msg("5146", dup276); + +var msg7594 = msg("5147", dup276); + +var msg7595 = msg("5148", dup276); + +var msg7596 = msg("5149", dup276); + +var msg7597 = msg("5150", dup276); + +var msg7598 = msg("5151", dup276); + +var msg7599 = msg("5152", dup276); + +var msg7600 = msg("5153", dup276); + +var msg7601 = msg("5154", dup276); + +var msg7602 = msg("5155", dup276); + +var msg7603 = msg("5156", dup276); + +var msg7604 = msg("5157", dup276); + +var msg7605 = msg("5158", dup276); + +var msg7606 = msg("5159", dup276); + +var msg7607 = msg("5160", dup276); + +var msg7608 = msg("5161", dup276); + +var msg7609 = msg("5162", dup276); + +var msg7610 = msg("5163", dup276); + +var msg7611 = msg("5164", dup276); + +var msg7612 = msg("5165", dup276); + +var msg7613 = msg("5166", dup276); + +var msg7614 = msg("5167", dup276); + +var msg7615 = msg("5168", dup276); + +var msg7616 = msg("5169", dup276); + +var msg7617 = msg("5170", dup276); + +var msg7618 = msg("5171", dup276); + +var msg7619 = msg("5172", dup276); + +var msg7620 = msg("5173", dup276); + +var msg7621 = msg("5174", dup276); + +var msg7622 = msg("5175", dup276); + +var msg7623 = msg("5176", dup276); + +var msg7624 = msg("5177", dup276); + +var msg7625 = msg("5178", dup276); + +var msg7626 = msg("5179", dup276); + +var msg7627 = msg("5180", dup276); + +var msg7628 = msg("5181", dup276); + +var msg7629 = msg("5182", dup276); + +var msg7630 = msg("5183", dup276); + +var msg7631 = msg("5184", dup276); + +var msg7632 = msg("5185", dup276); + +var msg7633 = msg("5186", dup276); + +var msg7634 = msg("5187", dup276); + +var msg7635 = msg("5188", dup276); + +var msg7636 = msg("5189", dup276); + +var msg7637 = msg("5190", dup276); + +var msg7638 = msg("5191", dup276); + +var msg7639 = msg("5192", dup276); + +var msg7640 = msg("5193", dup276); + +var msg7641 = msg("5194", dup276); + +var msg7642 = msg("5195", dup276); + +var msg7643 = msg("5196", dup276); + +var msg7644 = msg("5197", dup276); + +var msg7645 = msg("5198", dup276); + +var msg7646 = msg("5199", dup276); + +var msg7647 = msg("5200", dup276); + +var msg7648 = msg("5201", dup276); + +var msg7649 = msg("5202", dup276); + +var msg7650 = msg("5203", dup276); + +var msg7651 = msg("5204", dup276); + +var msg7652 = msg("5205", dup276); + +var msg7653 = msg("5206", dup276); + +var msg7654 = msg("5207", dup276); + +var msg7655 = msg("5208", dup276); + +var msg7656 = msg("5209", dup276); + +var msg7657 = msg("5210", dup276); + +var msg7658 = msg("5211", dup276); + +var msg7659 = msg("5212", dup276); + +var msg7660 = msg("5213", dup276); + +var msg7661 = msg("5214", dup276); + +var msg7662 = msg("5215", dup276); + +var msg7663 = msg("5216", dup276); + +var msg7664 = msg("5217", dup276); + +var msg7665 = msg("5218", dup276); + +var msg7666 = msg("5219", dup276); + +var msg7667 = msg("5220", dup276); + +var msg7668 = msg("5221", dup276); + +var msg7669 = msg("5222", dup276); + +var msg7670 = msg("5223", dup276); + +var msg7671 = msg("5224", dup276); + +var msg7672 = msg("5225", dup276); + +var msg7673 = msg("5226", dup276); + +var msg7674 = msg("5227", dup276); + +var msg7675 = msg("5228", dup276); + +var msg7676 = msg("5229", dup276); + +var msg7677 = msg("5230", dup276); + +var msg7678 = msg("5231", dup276); + +var msg7679 = msg("5232", dup276); + +var msg7680 = msg("5233", dup276); + +var msg7681 = msg("5234", dup276); + +var msg7682 = msg("5235", dup276); + +var msg7683 = msg("5236", dup276); + +var msg7684 = msg("5237", dup276); + +var msg7685 = msg("5238", dup276); + +var msg7686 = msg("5239", dup276); + +var msg7687 = msg("5240", dup276); + +var msg7688 = msg("5241", dup276); + +var msg7689 = msg("5242", dup276); + +var msg7690 = msg("5243", dup276); + +var msg7691 = msg("5244", dup276); + +var msg7692 = msg("5245", dup276); + +var msg7693 = msg("5246", dup276); + +var msg7694 = msg("5247", dup276); + +var msg7695 = msg("5248", dup276); + +var msg7696 = msg("5249", dup276); + +var msg7697 = msg("5250", dup276); + +var msg7698 = msg("5251", dup276); + +var msg7699 = msg("5252", dup276); + +var msg7700 = msg("5253", dup276); + +var msg7701 = msg("5254", dup276); + +var msg7702 = msg("5255", dup276); + +var msg7703 = msg("5256", dup276); + +var msg7704 = msg("5257", dup276); + +var msg7705 = msg("5258", dup276); + +var msg7706 = msg("5259", dup276); + +var msg7707 = msg("5260", dup276); + +var msg7708 = msg("5261", dup276); + +var msg7709 = msg("5262", dup276); + +var msg7710 = msg("5263", dup276); + +var msg7711 = msg("5264", dup276); + +var msg7712 = msg("5265", dup276); + +var msg7713 = msg("5266", dup276); + +var msg7714 = msg("5267", dup276); + +var msg7715 = msg("5268", dup276); + +var msg7716 = msg("5269", dup276); + +var msg7717 = msg("5270", dup276); + +var msg7718 = msg("5271", dup276); + +var msg7719 = msg("5272", dup276); + +var msg7720 = msg("5273", dup276); + +var msg7721 = msg("5274", dup276); + +var msg7722 = msg("5275", dup276); + +var msg7723 = msg("5276", dup276); + +var msg7724 = msg("5277", dup276); + +var msg7725 = msg("5278", dup276); + +var msg7726 = msg("5279", dup276); + +var msg7727 = msg("5280", dup276); + +var msg7728 = msg("5281", dup276); + +var msg7729 = msg("5282", dup276); + +var msg7730 = msg("5283", dup276); + +var msg7731 = msg("5284", dup276); + +var msg7732 = msg("5285", dup276); + +var msg7733 = msg("5286", dup276); + +var msg7734 = msg("5287", dup276); + +var msg7735 = msg("5288", dup276); + +var msg7736 = msg("5289", dup276); + +var msg7737 = msg("5290", dup276); + +var msg7738 = msg("5291", dup276); + +var msg7739 = msg("5292", dup276); + +var msg7740 = msg("5293", dup276); + +var msg7741 = msg("5294", dup276); + +var msg7742 = msg("5295", dup276); + +var msg7743 = msg("5296", dup276); + +var msg7744 = msg("5297", dup276); + +var msg7745 = msg("5298", dup276); + +var msg7746 = msg("5299", dup276); + +var msg7747 = msg("5300", dup276); + +var msg7748 = msg("5301", dup201); + +var msg7749 = msg("5302", dup276); + +var msg7750 = msg("5303", dup201); + +var msg7751 = msg("5304", dup201); + +var msg7752 = msg("5305", dup276); + +var msg7753 = msg("5306", dup201); + +var msg7754 = msg("5307", dup276); + +var msg7755 = msg("5308", dup276); + +var msg7756 = msg("5309", dup201); + +var msg7757 = msg("5310", dup276); + +var msg7758 = msg("5311", dup201); + +var msg7759 = msg("5312", dup201); + +var msg7760 = msg("5313", dup276); + +var msg7761 = msg("5314", dup201); + +var msg7762 = msg("5315", dup276); + +var msg7763 = msg("5316", dup222); + +var msg7764 = msg("5317", dup222); + +var msg7765 = msg("5318", dup269); + +var msg7766 = msg("5319", dup269); + +var msg7767 = msg("5320", dup263); + +var msg7768 = msg("5321", dup263); + +var msg7769 = msg("5322", dup263); + +var msg7770 = msg("5323", dup263); + +var msg7771 = msg("5324", dup263); + +var msg7772 = msg("5325", dup201); + +var msg7773 = msg("5326", dup201); + +var msg7774 = msg("5327", dup201); + +var msg7775 = msg("5328", dup201); + +var msg7776 = msg("5329", dup201); + +var msg7777 = msg("5330", dup201); + +var msg7778 = msg("5331", dup201); + +var msg7779 = msg("5332", dup201); + +var msg7780 = msg("5333", dup276); + +var msg7781 = msg("5334", dup276); + +var msg7782 = msg("5335", dup276); + +var msg7783 = msg("5336", dup276); + +var msg7784 = msg("5337", dup276); + +var msg7785 = msg("5338", dup276); + +var msg7786 = msg("5339", dup276); + +var msg7787 = msg("5340", dup276); + +var msg7788 = msg("5341", dup276); + +var msg7789 = msg("5342", dup276); + +var msg7790 = msg("5343", dup276); + +var msg7791 = msg("5344", dup276); + +var msg7792 = msg("5345", dup276); + +var msg7793 = msg("5346", dup276); + +var msg7794 = msg("5347", dup276); + +var msg7795 = msg("5348", dup276); + +var msg7796 = msg("5349", dup276); + +var msg7797 = msg("5350", dup276); + +var msg7798 = msg("5351", dup276); + +var msg7799 = msg("5352", dup276); + +var msg7800 = msg("5353", dup276); + +var msg7801 = msg("5354", dup276); + +var msg7802 = msg("5355", dup276); + +var msg7803 = msg("5356", dup276); + +var msg7804 = msg("5357", dup276); + +var msg7805 = msg("5358", dup276); + +var msg7806 = msg("5359", dup276); + +var msg7807 = msg("5360", dup276); + +var msg7808 = msg("5361", dup276); + +var msg7809 = msg("5362", dup276); + +var msg7810 = msg("5363", dup276); + +var msg7811 = msg("5364", dup276); + +var msg7812 = msg("5365", dup276); + +var msg7813 = msg("5366", dup276); + +var msg7814 = msg("5367", dup276); + +var msg7815 = msg("5368", dup276); + +var msg7816 = msg("5369", dup276); + +var msg7817 = msg("5370", dup276); + +var msg7818 = msg("5371", dup276); + +var msg7819 = msg("5372", dup276); + +var msg7820 = msg("5373", dup276); + +var msg7821 = msg("5374", dup276); + +var msg7822 = msg("5375", dup276); + +var msg7823 = msg("5376", dup276); + +var msg7824 = msg("5377", dup276); + +var msg7825 = msg("5378", dup276); + +var msg7826 = msg("5379", dup276); + +var msg7827 = msg("5380", dup276); + +var msg7828 = msg("5381", dup276); + +var msg7829 = msg("5382", dup276); + +var msg7830 = msg("5383", dup276); + +var msg7831 = msg("5384", dup276); + +var msg7832 = msg("5385", dup276); + +var msg7833 = msg("5386", dup276); + +var msg7834 = msg("5387", dup276); + +var msg7835 = msg("5388", dup276); + +var msg7836 = msg("5389", dup276); + +var msg7837 = msg("5390", dup276); + +var msg7838 = msg("5391", dup276); + +var msg7839 = msg("5392", dup276); + +var msg7840 = msg("5393", dup276); + +var msg7841 = msg("5394", dup276); + +var msg7842 = msg("5395", dup276); + +var msg7843 = msg("5396", dup276); + +var msg7844 = msg("5397", dup276); + +var msg7845 = msg("5398", dup276); + +var msg7846 = msg("5399", dup276); + +var msg7847 = msg("5400", dup276); + +var msg7848 = msg("5401", dup276); + +var msg7849 = msg("5402", dup276); + +var msg7850 = msg("5403", dup276); + +var msg7851 = msg("5404", dup276); + +var msg7852 = msg("5405", dup276); + +var msg7853 = msg("5406", dup276); + +var msg7854 = msg("5407", dup276); + +var msg7855 = msg("5408", dup276); + +var msg7856 = msg("5409", dup276); + +var msg7857 = msg("5410", dup276); + +var msg7858 = msg("5411", dup276); + +var msg7859 = msg("5412", dup276); + +var msg7860 = msg("5413", dup276); + +var msg7861 = msg("5414", dup276); + +var msg7862 = msg("5415", dup276); + +var msg7863 = msg("5416", dup276); + +var msg7864 = msg("5417", dup276); + +var msg7865 = msg("5418", dup276); + +var msg7866 = msg("5419", dup276); + +var msg7867 = msg("5420", dup276); + +var msg7868 = msg("5421", dup276); + +var msg7869 = msg("5422", dup276); + +var msg7870 = msg("5423", dup276); + +var msg7871 = msg("5424", dup276); + +var msg7872 = msg("5425", dup276); + +var msg7873 = msg("5426", dup276); + +var msg7874 = msg("5427", dup276); + +var msg7875 = msg("5428", dup276); + +var msg7876 = msg("5429", dup276); + +var msg7877 = msg("5430", dup276); + +var msg7878 = msg("5431", dup276); + +var msg7879 = msg("5432", dup276); + +var msg7880 = msg("5433", dup276); + +var msg7881 = msg("5434", dup276); + +var msg7882 = msg("5435", dup276); + +var msg7883 = msg("5436", dup276); + +var msg7884 = msg("5437", dup276); + +var msg7885 = msg("5438", dup276); + +var msg7886 = msg("5439", dup276); + +var msg7887 = msg("5440", dup276); + +var msg7888 = msg("5441", dup276); + +var msg7889 = msg("5442", dup276); + +var msg7890 = msg("5443", dup276); + +var msg7891 = msg("5444", dup276); + +var msg7892 = msg("5445", dup276); + +var msg7893 = msg("5446", dup276); + +var msg7894 = msg("5447", dup276); + +var msg7895 = msg("5448", dup276); + +var msg7896 = msg("5449", dup276); + +var msg7897 = msg("5450", dup276); + +var msg7898 = msg("5451", dup276); + +var msg7899 = msg("5452", dup276); + +var msg7900 = msg("5453", dup276); + +var msg7901 = msg("5454", dup276); + +var msg7902 = msg("5455", dup276); + +var msg7903 = msg("5456", dup276); + +var msg7904 = msg("5457", dup276); + +var msg7905 = msg("5458", dup276); + +var msg7906 = msg("5459", dup276); + +var msg7907 = msg("5460", dup276); + +var msg7908 = msg("5461", dup276); + +var msg7909 = msg("5462", dup276); + +var msg7910 = msg("5463", dup276); + +var msg7911 = msg("5464", dup276); + +var msg7912 = msg("5465", dup276); + +var msg7913 = msg("5466", dup276); + +var msg7914 = msg("5467", dup276); + +var msg7915 = msg("5468", dup276); + +var msg7916 = msg("5469", dup276); + +var msg7917 = msg("5470", dup276); + +var msg7918 = msg("5471", dup276); + +var msg7919 = msg("5472", dup276); + +var msg7920 = msg("5473", dup276); + +var msg7921 = msg("5474", dup276); + +var msg7922 = msg("5475", dup276); + +var msg7923 = msg("5476", dup276); + +var msg7924 = msg("5477", dup276); + +var msg7925 = msg("5478", dup276); + +var msg7926 = msg("5479", dup276); + +var msg7927 = msg("5480", dup276); + +var msg7928 = msg("5481", dup276); + +var msg7929 = msg("5482", dup276); + +var msg7930 = msg("5483", dup276); + +var msg7931 = msg("5484", dup276); + +var msg7932 = msg("5485", dup276); + +var msg7933 = msg("5486", dup276); + +var msg7934 = msg("5487", dup276); + +var msg7935 = msg("5488", dup276); + +var msg7936 = msg("5489", dup276); + +var msg7937 = msg("5490", dup276); + +var msg7938 = msg("5491", dup276); + +var msg7939 = msg("5492", dup276); + +var msg7940 = msg("5493", dup276); + +var msg7941 = msg("5494", dup276); + +var msg7942 = msg("5495", dup276); + +var msg7943 = msg("5496", dup276); + +var msg7944 = msg("5497", dup276); + +var msg7945 = msg("5498", dup276); + +var msg7946 = msg("5499", dup276); + +var msg7947 = msg("5500", dup276); + +var msg7948 = msg("5501", dup276); + +var msg7949 = msg("5502", dup276); + +var msg7950 = msg("5503", dup276); + +var msg7951 = msg("5504", dup276); + +var msg7952 = msg("5505", dup276); + +var msg7953 = msg("5506", dup276); + +var msg7954 = msg("5507", dup276); + +var msg7955 = msg("5508", dup276); + +var msg7956 = msg("5509", dup276); + +var msg7957 = msg("5510", dup276); + +var msg7958 = msg("5511", dup276); + +var msg7959 = msg("5512", dup276); + +var msg7960 = msg("5513", dup276); + +var msg7961 = msg("5514", dup276); + +var msg7962 = msg("5515", dup276); + +var msg7963 = msg("5516", dup276); + +var msg7964 = msg("5517", dup276); + +var msg7965 = msg("5518", dup276); + +var msg7966 = msg("5519", dup276); + +var msg7967 = msg("5520", dup276); + +var msg7968 = msg("5521", dup276); + +var msg7969 = msg("5522", dup276); + +var msg7970 = msg("5523", dup276); + +var msg7971 = msg("5524", dup276); + +var msg7972 = msg("5525", dup276); + +var msg7973 = msg("5526", dup276); + +var msg7974 = msg("5527", dup276); + +var msg7975 = msg("5528", dup276); + +var msg7976 = msg("5529", dup276); + +var msg7977 = msg("5530", dup276); + +var msg7978 = msg("5531", dup276); + +var msg7979 = msg("5532", dup276); + +var msg7980 = msg("5533", dup276); + +var msg7981 = msg("5534", dup276); + +var msg7982 = msg("5535", dup276); + +var msg7983 = msg("5536", dup276); + +var msg7984 = msg("5537", dup276); + +var msg7985 = msg("5538", dup276); + +var msg7986 = msg("5539", dup276); + +var msg7987 = msg("5540", dup276); + +var msg7988 = msg("5541", dup276); + +var msg7989 = msg("5542", dup276); + +var msg7990 = msg("5543", dup276); + +var msg7991 = msg("5544", dup276); + +var msg7992 = msg("5545", dup276); + +var msg7993 = msg("5546", dup276); + +var msg7994 = msg("5547", dup276); + +var msg7995 = msg("5548", dup276); + +var msg7996 = msg("5549", dup276); + +var msg7997 = msg("5550", dup276); + +var msg7998 = msg("5551", dup276); + +var msg7999 = msg("5552", dup276); + +var msg8000 = msg("5553", dup276); + +var msg8001 = msg("5554", dup276); + +var msg8002 = msg("5555", dup276); + +var msg8003 = msg("5556", dup276); + +var msg8004 = msg("5557", dup276); + +var msg8005 = msg("5558", dup276); + +var msg8006 = msg("5559", dup276); + +var msg8007 = msg("5560", dup276); + +var msg8008 = msg("5561", dup276); + +var msg8009 = msg("5562", dup276); + +var msg8010 = msg("5563", dup276); + +var msg8011 = msg("5564", dup276); + +var msg8012 = msg("5565", dup276); + +var msg8013 = msg("5566", dup276); + +var msg8014 = msg("5567", dup276); + +var msg8015 = msg("5568", dup276); + +var msg8016 = msg("5569", dup276); + +var msg8017 = msg("5570", dup276); + +var msg8018 = msg("5571", dup276); + +var msg8019 = msg("5572", dup276); + +var msg8020 = msg("5573", dup276); + +var msg8021 = msg("5574", dup276); + +var msg8022 = msg("5575", dup276); + +var msg8023 = msg("5576", dup276); + +var msg8024 = msg("5577", dup276); + +var msg8025 = msg("5578", dup276); + +var msg8026 = msg("5579", dup276); + +var msg8027 = msg("5580", dup276); + +var msg8028 = msg("5581", dup276); + +var msg8029 = msg("5582", dup276); + +var msg8030 = msg("5583", dup276); + +var msg8031 = msg("5584", dup276); + +var msg8032 = msg("5585", dup276); + +var msg8033 = msg("5586", dup276); + +var msg8034 = msg("5587", dup276); + +var msg8035 = msg("5588", dup276); + +var msg8036 = msg("5589", dup276); + +var msg8037 = msg("5590", dup276); + +var msg8038 = msg("5591", dup276); + +var msg8039 = msg("5592", dup276); + +var msg8040 = msg("5593", dup276); + +var msg8041 = msg("5594", dup276); + +var msg8042 = msg("5595", dup276); + +var msg8043 = msg("5596", dup276); + +var msg8044 = msg("5597", dup276); + +var msg8045 = msg("5598", dup276); + +var msg8046 = msg("5599", dup276); + +var msg8047 = msg("5600", dup276); + +var msg8048 = msg("5601", dup276); + +var msg8049 = msg("5602", dup276); + +var msg8050 = msg("5603", dup276); + +var msg8051 = msg("5604", dup276); + +var msg8052 = msg("5605", dup276); + +var msg8053 = msg("5606", dup276); + +var msg8054 = msg("5607", dup276); + +var msg8055 = msg("5608", dup276); + +var msg8056 = msg("5609", dup276); + +var msg8057 = msg("5610", dup276); + +var msg8058 = msg("5611", dup276); + +var msg8059 = msg("5612", dup276); + +var msg8060 = msg("5613", dup276); + +var msg8061 = msg("5614", dup276); + +var msg8062 = msg("5615", dup276); + +var msg8063 = msg("5616", dup276); + +var msg8064 = msg("5617", dup276); + +var msg8065 = msg("5618", dup276); + +var msg8066 = msg("5619", dup276); + +var msg8067 = msg("5620", dup276); + +var msg8068 = msg("5621", dup276); + +var msg8069 = msg("5622", dup276); + +var msg8070 = msg("5623", dup276); + +var msg8071 = msg("5624", dup276); + +var msg8072 = msg("5625", dup276); + +var msg8073 = msg("5626", dup276); + +var msg8074 = msg("5627", dup276); + +var msg8075 = msg("5628", dup276); + +var msg8076 = msg("5629", dup276); + +var msg8077 = msg("5630", dup276); + +var msg8078 = msg("5631", dup276); + +var msg8079 = msg("5632", dup276); + +var msg8080 = msg("5633", dup276); + +var msg8081 = msg("5634", dup276); + +var msg8082 = msg("5635", dup276); + +var msg8083 = msg("5636", dup276); + +var msg8084 = msg("5637", dup276); + +var msg8085 = msg("5638", dup276); + +var msg8086 = msg("5639", dup276); + +var msg8087 = msg("5640", dup276); + +var msg8088 = msg("5641", dup276); + +var msg8089 = msg("5642", dup276); + +var msg8090 = msg("5643", dup276); + +var msg8091 = msg("5644", dup276); + +var msg8092 = msg("5645", dup276); + +var msg8093 = msg("5646", dup276); + +var msg8094 = msg("5647", dup276); + +var msg8095 = msg("5648", dup276); + +var msg8096 = msg("5649", dup276); + +var msg8097 = msg("5650", dup276); + +var msg8098 = msg("5651", dup276); + +var msg8099 = msg("5652", dup276); + +var msg8100 = msg("5653", dup276); + +var msg8101 = msg("5654", dup276); + +var msg8102 = msg("5655", dup276); + +var msg8103 = msg("5656", dup276); + +var msg8104 = msg("5657", dup276); + +var msg8105 = msg("5658", dup276); + +var msg8106 = msg("5659", dup276); + +var msg8107 = msg("5660", dup276); + +var msg8108 = msg("5661", dup276); + +var msg8109 = msg("5662", dup276); + +var msg8110 = msg("5663", dup276); + +var msg8111 = msg("5664", dup276); + +var msg8112 = msg("5665", dup276); + +var msg8113 = msg("5666", dup276); + +var msg8114 = msg("5667", dup276); + +var msg8115 = msg("5668", dup276); + +var msg8116 = msg("5669", dup276); + +var msg8117 = msg("5670", dup276); + +var msg8118 = msg("5671", dup276); + +var msg8119 = msg("5672", dup276); + +var msg8120 = msg("5673", dup276); + +var msg8121 = msg("5674", dup276); + +var msg8122 = msg("5675", dup276); + +var msg8123 = msg("5676", dup276); + +var msg8124 = msg("5677", dup276); + +var msg8125 = msg("5678", dup276); + +var msg8126 = msg("5679", dup276); + +var msg8127 = msg("5680", dup276); + +var msg8128 = msg("5681", dup276); + +var msg8129 = msg("5682", dup276); + +var msg8130 = msg("5683", dup276); + +var msg8131 = msg("5684", dup276); + +var msg8132 = msg("5685", dup250); + +var msg8133 = msg("5686", dup250); + +var msg8134 = msg("5687", dup250); + +var msg8135 = msg("5688", dup250); + +var msg8136 = msg("5689", dup250); + +var msg8137 = msg("5690", dup250); + +var msg8138 = msg("5691", dup250); + +var msg8139 = msg("5692", dup196); + +var msg8140 = msg("5693", dup196); + +var msg8141 = msg("5694", dup196); + +var msg8142 = msg("5695", dup267); + +var msg8143 = msg("5696", dup196); + +var msg8144 = msg("5697", dup196); + +var msg8145 = msg("5698", dup196); + +var msg8146 = msg("5699", dup196); + +var msg8147 = msg("5700", dup196); + +var msg8148 = msg("5701", dup196); + +var msg8149 = msg("5702", dup196); + +var msg8150 = msg("5703", dup196); + +var msg8151 = msg("5704", dup222); + +var msg8152 = msg("5705", dup222); + +var msg8153 = msg("5706", dup196); + +var msg8154 = msg("5707", dup196); + +var msg8155 = msg("5708", dup196); + +var msg8156 = msg("5709", dup265); + +var msg8157 = msg("5710", dup267); + +var msg8158 = msg("5711", dup267); + +var msg8159 = msg("5712", dup267); + +var msg8160 = msg("5713", dup197); + +var msg8161 = msg("5714", dup250); + +var msg8162 = msg("5715", dup201); + +var msg8163 = msg("5716", dup198); + +var msg8164 = msg("5717", dup198); + +var msg8165 = msg("5718", dup198); + +var msg8166 = msg("5719", dup198); + +var msg8167 = msg("5720", dup198); + +var msg8168 = msg("5721", dup198); + +var msg8169 = msg("5722", dup198); + +var msg8170 = msg("5723", dup198); + +var msg8171 = msg("5724", dup198); + +var msg8172 = msg("5725", dup198); + +var msg8173 = msg("5726", dup198); + +var msg8174 = msg("5727", dup198); + +var msg8175 = msg("5728", dup198); + +var msg8176 = msg("5729", dup198); + +var msg8177 = msg("5730", dup198); + +var msg8178 = msg("5731", dup198); + +var msg8179 = msg("5732", dup198); + +var msg8180 = msg("5733", dup198); + +var msg8181 = msg("5734", dup198); + +var msg8182 = msg("5735", dup198); + +var msg8183 = msg("5736", dup198); + +var msg8184 = msg("5737", dup198); + +var msg8185 = msg("5738", dup198); + +var msg8186 = msg("5739", dup197); + +var msg8187 = msg("5740", dup265); + +var msg8188 = msg("5741", dup267); + +var msg8189 = msg("5742", dup303); + +var msg8190 = msg("5743", dup303); + +var msg8191 = msg("5744", dup303); + +var msg8192 = msg("5745", dup303); + +var msg8193 = msg("5746", dup303); + +var msg8194 = msg("5747", dup303); + +var msg8195 = msg("5748", dup303); + +var msg8196 = msg("5749", dup303); + +var msg8197 = msg("5750", dup303); + +var msg8198 = msg("5751", dup303); + +var msg8199 = msg("5752", dup303); + +var msg8200 = msg("5753", dup303); + +var msg8201 = msg("5754", dup303); + +var msg8202 = msg("5755", dup303); + +var msg8203 = msg("5756", dup303); + +var msg8204 = msg("5757", dup303); + +var msg8205 = msg("5758", dup303); + +var msg8206 = msg("5759", dup303); + +var msg8207 = msg("5760", dup303); + +var msg8208 = msg("5761", dup303); + +var msg8209 = msg("5762", dup303); + +var msg8210 = msg("5763", dup303); + +var msg8211 = msg("5764", dup303); + +var msg8212 = msg("5765", dup303); + +var msg8213 = msg("5766", dup303); + +var msg8214 = msg("5767", dup303); + +var msg8215 = msg("5768", dup303); + +var msg8216 = msg("5769", dup303); + +var msg8217 = msg("5770", dup303); + +var msg8218 = msg("5771", dup303); + +var msg8219 = msg("5772", dup303); + +var msg8220 = msg("5773", dup303); + +var msg8221 = msg("5774", dup303); + +var msg8222 = msg("5775", dup303); + +var msg8223 = msg("5776", dup303); + +var msg8224 = msg("5777", dup303); + +var msg8225 = msg("5778", dup303); + +var msg8226 = msg("5779", dup303); + +var msg8227 = msg("5780", dup303); + +var msg8228 = msg("5781", dup303); + +var msg8229 = msg("5782", dup303); + +var msg8230 = msg("5783", dup303); + +var msg8231 = msg("5784", dup303); + +var msg8232 = msg("5785", dup303); + +var msg8233 = msg("5786", dup303); + +var msg8234 = msg("5787", dup303); + +var msg8235 = msg("5788", dup303); + +var msg8236 = msg("5789", dup303); + +var msg8237 = msg("5790", dup303); + +var msg8238 = msg("5791", dup303); + +var msg8239 = msg("5792", dup303); + +var msg8240 = msg("5793", dup303); + +var msg8241 = msg("5794", dup303); + +var msg8242 = msg("5795", dup303); + +var msg8243 = msg("5796", dup303); + +var msg8244 = msg("5797", dup303); + +var msg8245 = msg("5798", dup303); + +var msg8246 = msg("5799", dup303); + +var msg8247 = msg("5800", dup303); + +var msg8248 = msg("5801", dup303); + +var msg8249 = msg("5802", dup303); + +var msg8250 = msg("5803", dup303); + +var msg8251 = msg("5804", dup303); + +var msg8252 = msg("5805", dup303); + +var msg8253 = msg("5806", dup303); + +var msg8254 = msg("5807", dup303); + +var msg8255 = msg("5808", dup303); + +var msg8256 = msg("5809", dup303); + +var msg8257 = msg("5810", dup303); + +var msg8258 = msg("5811", dup303); + +var msg8259 = msg("5812", dup303); + +var msg8260 = msg("5813", dup303); + +var msg8261 = msg("5814", dup303); + +var msg8262 = msg("5815", dup303); + +var msg8263 = msg("5816", dup303); + +var msg8264 = msg("5817", dup303); + +var msg8265 = msg("5818", dup303); + +var msg8266 = msg("5819", dup303); + +var msg8267 = msg("5820", dup303); + +var msg8268 = msg("5821", dup303); + +var msg8269 = msg("5822", dup303); + +var msg8270 = msg("5823", dup303); + +var msg8271 = msg("5824", dup303); + +var msg8272 = msg("5825", dup303); + +var msg8273 = msg("5826", dup303); + +var msg8274 = msg("5827", dup303); + +var msg8275 = msg("5828", dup303); + +var msg8276 = msg("5829", dup303); + +var msg8277 = msg("5830", dup303); + +var msg8278 = msg("5831", dup303); + +var msg8279 = msg("5832", dup303); + +var msg8280 = msg("5833", dup303); + +var msg8281 = msg("5834", dup303); + +var msg8282 = msg("5835", dup303); + +var msg8283 = msg("5836", dup303); + +var msg8284 = msg("5837", dup303); + +var msg8285 = msg("5838", dup303); + +var msg8286 = msg("5839", dup303); + +var msg8287 = msg("5840", dup303); + +var msg8288 = msg("5841", dup303); + +var msg8289 = msg("5842", dup303); + +var msg8290 = msg("5843", dup303); + +var msg8291 = msg("5844", dup303); + +var msg8292 = msg("5845", dup303); + +var msg8293 = msg("5846", dup303); + +var msg8294 = msg("5847", dup303); + +var msg8295 = msg("5848", dup303); + +var msg8296 = msg("5849", dup303); + +var msg8297 = msg("5850", dup303); + +var msg8298 = msg("5851", dup303); + +var msg8299 = msg("5852", dup303); + +var msg8300 = msg("5853", dup303); + +var msg8301 = msg("5854", dup303); + +var msg8302 = msg("5855", dup303); + +var msg8303 = msg("5856", dup303); + +var msg8304 = msg("5857", dup303); + +var msg8305 = msg("5858", dup303); + +var msg8306 = msg("5859", dup303); + +var msg8307 = msg("5860", dup303); + +var msg8308 = msg("5861", dup303); + +var msg8309 = msg("5862", dup303); + +var msg8310 = msg("5863", dup303); + +var msg8311 = msg("5864", dup303); + +var msg8312 = msg("5865", dup303); + +var msg8313 = msg("5866", dup303); + +var msg8314 = msg("5867", dup303); + +var msg8315 = msg("5868", dup303); + +var msg8316 = msg("5869", dup303); + +var msg8317 = msg("5870", dup303); + +var msg8318 = msg("5871", dup303); + +var msg8319 = msg("5872", dup303); + +var msg8320 = msg("5873", dup303); + +var msg8321 = msg("5874", dup303); + +var msg8322 = msg("5875", dup303); + +var msg8323 = msg("5876", dup303); + +var msg8324 = msg("5877", dup303); + +var msg8325 = msg("5878", dup303); + +var msg8326 = msg("5879", dup303); + +var msg8327 = msg("5880", dup303); + +var msg8328 = msg("5881", dup303); + +var msg8329 = msg("5882", dup303); + +var msg8330 = msg("5883", dup303); + +var msg8331 = msg("5884", dup303); + +var msg8332 = msg("5885", dup303); + +var msg8333 = msg("5886", dup303); + +var msg8334 = msg("5887", dup303); + +var msg8335 = msg("5888", dup303); + +var msg8336 = msg("5889", dup303); + +var msg8337 = msg("5890", dup303); + +var msg8338 = msg("5891", dup303); + +var msg8339 = msg("5892", dup303); + +var msg8340 = msg("5893", dup303); + +var msg8341 = msg("5894", dup303); + +var msg8342 = msg("5895", dup303); + +var msg8343 = msg("5896", dup303); + +var msg8344 = msg("5897", dup303); + +var msg8345 = msg("5898", dup303); + +var msg8346 = msg("5899", dup303); + +var msg8347 = msg("5900", dup303); + +var msg8348 = msg("5901", dup303); + +var msg8349 = msg("5902", dup303); + +var msg8350 = msg("5903", dup303); + +var msg8351 = msg("5904", dup303); + +var msg8352 = msg("5905", dup303); + +var msg8353 = msg("5906", dup303); + +var msg8354 = msg("5907", dup303); + +var msg8355 = msg("5908", dup303); + +var msg8356 = msg("5909", dup303); + +var msg8357 = msg("5910", dup303); + +var msg8358 = msg("5911", dup303); + +var msg8359 = msg("5912", dup303); + +var msg8360 = msg("5913", dup303); + +var msg8361 = msg("5914", dup303); + +var msg8362 = msg("5915", dup303); + +var msg8363 = msg("5916", dup303); + +var msg8364 = msg("5917", dup303); + +var msg8365 = msg("5918", dup303); + +var msg8366 = msg("5919", dup303); + +var msg8367 = msg("5920", dup303); + +var msg8368 = msg("5921", dup303); + +var msg8369 = msg("5922", dup303); + +var msg8370 = msg("5923", dup303); + +var msg8371 = msg("5924", dup303); + +var msg8372 = msg("5925", dup303); + +var msg8373 = msg("5926", dup303); + +var msg8374 = msg("5927", dup303); + +var msg8375 = msg("5928", dup303); + +var msg8376 = msg("5929", dup303); + +var msg8377 = msg("5930", dup303); + +var msg8378 = msg("5931", dup303); + +var msg8379 = msg("5932", dup303); + +var msg8380 = msg("5933", dup303); + +var msg8381 = msg("5934", dup303); + +var msg8382 = msg("5935", dup303); + +var msg8383 = msg("5936", dup303); + +var msg8384 = msg("5937", dup303); + +var msg8385 = msg("5938", dup303); + +var msg8386 = msg("5939", dup303); + +var msg8387 = msg("5940", dup303); + +var msg8388 = msg("5941", dup303); + +var msg8389 = msg("5942", dup303); + +var msg8390 = msg("5943", dup303); + +var msg8391 = msg("5944", dup303); + +var msg8392 = msg("5945", dup303); + +var msg8393 = msg("5946", dup303); + +var msg8394 = msg("5947", dup303); + +var msg8395 = msg("5948", dup303); + +var msg8396 = msg("5949", dup303); + +var msg8397 = msg("5950", dup303); + +var msg8398 = msg("5951", dup303); + +var msg8399 = msg("5952", dup303); + +var msg8400 = msg("5953", dup303); + +var msg8401 = msg("5954", dup303); + +var msg8402 = msg("5955", dup303); + +var msg8403 = msg("5956", dup303); + +var msg8404 = msg("5957", dup303); + +var msg8405 = msg("5958", dup303); + +var msg8406 = msg("5959", dup303); + +var msg8407 = msg("5960", dup303); + +var msg8408 = msg("5961", dup303); + +var msg8409 = msg("5962", dup303); + +var msg8410 = msg("5963", dup303); + +var msg8411 = msg("5964", dup303); + +var msg8412 = msg("5965", dup303); + +var msg8413 = msg("5966", dup303); + +var msg8414 = msg("5967", dup303); + +var msg8415 = msg("5968", dup303); + +var msg8416 = msg("5969", dup303); + +var msg8417 = msg("5970", dup303); + +var msg8418 = msg("5971", dup303); + +var msg8419 = msg("5972", dup303); + +var msg8420 = msg("5973", dup303); + +var msg8421 = msg("5974", dup303); + +var msg8422 = msg("5975", dup303); + +var msg8423 = msg("5976", dup303); + +var msg8424 = msg("5977", dup303); + +var msg8425 = msg("5978", dup303); + +var msg8426 = msg("5979", dup303); + +var msg8427 = msg("5980", dup303); + +var msg8428 = msg("5981", dup303); + +var msg8429 = msg("5982", dup303); + +var msg8430 = msg("5983", dup303); + +var msg8431 = msg("5984", dup303); + +var msg8432 = msg("5985", dup303); + +var msg8433 = msg("5986", dup303); + +var msg8434 = msg("5987", dup303); + +var msg8435 = msg("5988", dup303); + +var msg8436 = msg("5989", dup303); + +var msg8437 = msg("5990", dup303); + +var msg8438 = msg("5991", dup303); + +var msg8439 = msg("5992", dup303); + +var msg8440 = msg("5993", dup303); + +var msg8441 = msg("5994", dup303); + +var msg8442 = msg("5995", dup303); + +var msg8443 = msg("5996", dup303); + +var msg8444 = msg("5997", dup267); + +var msg8445 = msg("5998", dup196); + +var msg8446 = msg("5999", dup196); + +var msg8447 = msg("6000", dup196); + +var msg8448 = msg("6001", dup196); + +var msg8449 = msg("6002", dup265); + +var msg8450 = msg("6003", dup265); + +var msg8451 = msg("6004", dup265); + +var msg8452 = msg("6005", dup265); + +var msg8453 = msg("6006", dup265); + +var msg8454 = msg("6007", dup265); + +var msg8455 = msg("6008", dup265); + +var msg8456 = msg("6009", dup265); + +var msg8457 = msg("6010", dup196); + +var msg8458 = msg("6011", dup222); + +var msg8459 = msg("6012", dup205); + +var msg8460 = msg("6013", dup205); + +var msg8461 = msg("6014", dup205); + +var msg8462 = msg("6015", dup205); + +var msg8463 = msg("6016", dup205); + +var msg8464 = msg("6017", dup205); + +var msg8465 = msg("6018", dup205); + +var msg8466 = msg("6019", dup205); + +var msg8467 = msg("6020", dup205); + +var msg8468 = msg("6021", dup205); + +var msg8469 = msg("6022", dup205); + +var msg8470 = msg("6023", dup205); + +var msg8471 = msg("6024", dup205); + +var msg8472 = msg("6025", dup205); + +var msg8473 = msg("6026", dup205); + +var msg8474 = msg("6027", dup205); + +var msg8475 = msg("6028", dup205); + +var msg8476 = msg("6029", dup205); + +var msg8477 = msg("6030", dup205); + +var msg8478 = msg("6031", dup205); + +var msg8479 = msg("6032", dup205); + +var msg8480 = msg("6033", dup205); + +var msg8481 = msg("6034", dup205); + +var msg8482 = msg("6035", dup205); + +var msg8483 = msg("6036", dup205); + +var msg8484 = msg("6037", dup205); + +var msg8485 = msg("6038", dup205); + +var msg8486 = msg("6039", dup205); + +var msg8487 = msg("6040", dup205); + +var msg8488 = msg("6041", dup205); + +var msg8489 = msg("6042", dup205); + +var msg8490 = msg("6043", dup205); + +var msg8491 = msg("6044", dup205); + +var msg8492 = msg("6045", dup205); + +var msg8493 = msg("6046", dup205); + +var msg8494 = msg("6047", dup205); + +var msg8495 = msg("6048", dup205); + +var msg8496 = msg("6049", dup205); + +var msg8497 = msg("6050", dup205); + +var msg8498 = msg("6051", dup205); + +var msg8499 = msg("6052", dup205); + +var msg8500 = msg("6053", dup205); + +var msg8501 = msg("6054", dup205); + +var msg8502 = msg("6055", dup205); + +var msg8503 = msg("6056", dup205); + +var msg8504 = msg("6057", dup205); + +var msg8505 = msg("6058", dup205); + +var msg8506 = msg("6059", dup205); + +var all46 = all_match({ + processors: [ + dup66, + dup178, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + date_time({ + dest: "event_time", + args: ["event_time_string"], + fmts: [ + [dB,dF,dH,dc(":"),dU,dc(":"),dO], + ], + }), + ]), +}); + +var msg8507 = msg("6060", all46); + +var msg8508 = msg("6061", dup205); + +var msg8509 = msg("6062", dup205); + +var msg8510 = msg("6063", dup205); + +var msg8511 = msg("6064", dup205); + +var msg8512 = msg("6065", dup205); + +var msg8513 = msg("6066", dup205); + +var msg8514 = msg("6067", dup205); + +var msg8515 = msg("6068", dup205); + +var msg8516 = msg("6069", dup205); + +var msg8517 = msg("6070", dup205); + +var msg8518 = msg("6071", dup205); + +var msg8519 = msg("6072", dup205); + +var msg8520 = msg("6073", dup205); + +var msg8521 = msg("6074", dup205); + +var msg8522 = msg("6075", dup205); + +var msg8523 = msg("6076", dup205); + +var msg8524 = msg("6077", dup205); + +var msg8525 = msg("6078", dup205); + +var msg8526 = msg("6079", dup205); + +var msg8527 = msg("6080", dup205); + +var msg8528 = msg("6081", dup205); + +var msg8529 = msg("6082", dup205); + +var msg8530 = msg("6083", dup205); + +var msg8531 = msg("6084", dup205); + +var msg8532 = msg("6085", dup205); + +var msg8533 = msg("6086", dup205); + +var msg8534 = msg("6087", dup205); + +var msg8535 = msg("6088", dup205); + +var msg8536 = msg("6089", dup205); + +var msg8537 = msg("6090", dup205); + +var msg8538 = msg("6091", dup205); + +var msg8539 = msg("6092", dup205); + +var msg8540 = msg("6093", dup205); + +var msg8541 = msg("6094", dup205); + +var msg8542 = msg("6095", dup205); + +var msg8543 = msg("6096", dup205); + +var msg8544 = msg("6097", dup205); + +var msg8545 = msg("6098", dup205); + +var msg8546 = msg("6099", dup205); + +var msg8547 = msg("6100", dup205); + +var msg8548 = msg("6101", dup205); + +var msg8549 = msg("6102", dup205); + +var msg8550 = msg("6103", dup205); + +var msg8551 = msg("6104", dup205); + +var msg8552 = msg("6105", dup205); + +var msg8553 = msg("6106", dup205); + +var msg8554 = msg("6107", dup205); + +var msg8555 = msg("6108", dup205); + +var msg8556 = msg("6109", dup205); + +var msg8557 = msg("6110", dup205); + +var msg8558 = msg("6111", dup205); + +var msg8559 = msg("6112", dup205); + +var msg8560 = msg("6113", dup205); + +var msg8561 = msg("6114", dup205); + +var msg8562 = msg("6115", dup205); + +var msg8563 = msg("6116", dup205); + +var msg8564 = msg("6117", dup205); + +var msg8565 = msg("6118", dup205); + +var msg8566 = msg("6119", dup205); + +var msg8567 = msg("6120", dup205); + +var msg8568 = msg("6121", dup205); + +var msg8569 = msg("6122", dup205); + +var msg8570 = msg("6123", dup205); + +var msg8571 = msg("6124", dup205); + +var msg8572 = msg("6125", dup205); + +var msg8573 = msg("6126", dup205); + +var msg8574 = msg("6127", dup205); + +var msg8575 = msg("6128", dup205); + +var msg8576 = msg("6129", dup205); + +var msg8577 = msg("6130", dup205); + +var msg8578 = msg("6131", dup205); + +var msg8579 = msg("6132", dup205); + +var msg8580 = msg("6133", dup205); + +var msg8581 = msg("6134", dup205); + +var msg8582 = msg("6135", dup205); + +var msg8583 = msg("6136", dup205); + +var msg8584 = msg("6137", dup205); + +var msg8585 = msg("6138", dup205); + +var msg8586 = msg("6139", dup205); + +var msg8587 = msg("6140", dup205); + +var msg8588 = msg("6141", dup205); + +var msg8589 = msg("6142", dup205); + +var msg8590 = msg("6143", dup205); + +var msg8591 = msg("6144", dup205); + +var msg8592 = msg("6145", dup205); + +var msg8593 = msg("6146", dup205); + +var msg8594 = msg("6147", dup205); + +var msg8595 = msg("6148", dup205); + +var msg8596 = msg("6149", dup205); + +var msg8597 = msg("6150", dup205); + +var msg8598 = msg("6151", dup205); + +var msg8599 = msg("6152", dup205); + +var msg8600 = msg("6153", dup205); + +var msg8601 = msg("6154", dup205); + +var msg8602 = msg("6155", dup205); + +var msg8603 = msg("6156", dup205); + +var msg8604 = msg("6157", dup205); + +var msg8605 = msg("6158", dup205); + +var msg8606 = msg("6159", dup205); + +var msg8607 = msg("6160", dup205); + +var msg8608 = msg("6161", dup205); + +var msg8609 = msg("6162", dup205); + +var msg8610 = msg("6163", dup205); + +var msg8611 = msg("6164", dup205); + +var msg8612 = msg("6165", dup205); + +var msg8613 = msg("6166", dup205); + +var msg8614 = msg("6167", dup205); + +var msg8615 = msg("6168", dup205); + +var msg8616 = msg("6169", dup205); + +var msg8617 = msg("6170", dup205); + +var msg8618 = msg("6171", dup205); + +var msg8619 = msg("6172", dup205); + +var msg8620 = msg("6173", dup205); + +var msg8621 = msg("6174", dup205); + +var msg8622 = msg("6175", dup205); + +var msg8623 = msg("6176", dup205); + +var msg8624 = msg("6177", dup205); + +var msg8625 = msg("6178", dup205); + +var msg8626 = msg("6179", dup205); + +var msg8627 = msg("6180", dup205); + +var msg8628 = msg("6181", dup205); + +var msg8629 = msg("6182", dup196); + +var msg8630 = msg("6183", dup303); + +var msg8631 = msg("6184", dup303); + +var msg8632 = msg("6185", dup303); + +var msg8633 = msg("6186", dup303); + +var msg8634 = msg("6187", dup303); + +var msg8635 = msg("6188", dup303); + +var msg8636 = msg("6189", dup303); + +var msg8637 = msg("6190", dup303); + +var msg8638 = msg("6191", dup303); + +var msg8639 = msg("6192", dup303); + +var msg8640 = msg("6193", dup303); + +var msg8641 = msg("6194", dup303); + +var msg8642 = msg("6195", dup303); + +var msg8643 = msg("6196", dup303); + +var msg8644 = msg("6197", dup303); + +var msg8645 = msg("6198", dup303); + +var msg8646 = msg("6199", dup303); + +var msg8647 = msg("6200", dup303); + +var msg8648 = msg("6201", dup303); + +var msg8649 = msg("6202", dup303); + +var msg8650 = msg("6203", dup303); + +var msg8651 = msg("6204", dup303); + +var msg8652 = msg("6205", dup303); + +var msg8653 = msg("6206", dup303); + +var msg8654 = msg("6207", dup303); + +var msg8655 = msg("6208", dup303); + +var msg8656 = msg("6209", dup303); + +var msg8657 = msg("6210", dup303); + +var msg8658 = msg("6211", dup303); + +var msg8659 = msg("6212", dup303); + +var msg8660 = msg("6213", dup303); + +var msg8661 = msg("6214", dup303); + +var msg8662 = msg("6215", dup303); + +var msg8663 = msg("6216", dup303); + +var msg8664 = msg("6217", dup303); + +var msg8665 = msg("6218", dup303); + +var msg8666 = msg("6219", dup303); + +var msg8667 = msg("6220", dup303); + +var msg8668 = msg("6221", dup303); + +var msg8669 = msg("6222", dup303); + +var msg8670 = msg("6223", dup303); + +var msg8671 = msg("6224", dup303); + +var msg8672 = msg("6225", dup303); + +var msg8673 = msg("6226", dup303); + +var msg8674 = msg("6227", dup303); + +var msg8675 = msg("6228", dup303); + +var msg8676 = msg("6229", dup303); + +var msg8677 = msg("6230", dup303); + +var msg8678 = msg("6231", dup303); + +var msg8679 = msg("6232", dup303); + +var msg8680 = msg("6233", dup303); + +var msg8681 = msg("6234", dup303); + +var msg8682 = msg("6235", dup303); + +var msg8683 = msg("6236", dup303); + +var msg8684 = msg("6237", dup303); + +var msg8685 = msg("6238", dup303); + +var msg8686 = msg("6239", dup303); + +var msg8687 = msg("6240", dup303); + +var msg8688 = msg("6241", dup303); + +var msg8689 = msg("6242", dup303); + +var msg8690 = msg("6243", dup303); + +var msg8691 = msg("6244", dup303); + +var msg8692 = msg("6245", dup303); + +var msg8693 = msg("6246", dup303); + +var msg8694 = msg("6247", dup303); + +var msg8695 = msg("6248", dup303); + +var msg8696 = msg("6249", dup303); + +var msg8697 = msg("6250", dup303); + +var msg8698 = msg("6251", dup303); + +var msg8699 = msg("6252", dup303); + +var msg8700 = msg("6253", dup303); + +var msg8701 = msg("6254", dup303); + +var msg8702 = msg("6255", dup303); + +var msg8703 = msg("6256", dup303); + +var msg8704 = msg("6257", dup303); + +var msg8705 = msg("6258", dup303); + +var msg8706 = msg("6259", dup303); + +var msg8707 = msg("6260", dup303); + +var msg8708 = msg("6261", dup303); + +var msg8709 = msg("6262", dup303); + +var msg8710 = msg("6263", dup303); + +var msg8711 = msg("6264", dup303); + +var msg8712 = msg("6265", dup303); + +var msg8713 = msg("6266", dup303); + +var msg8714 = msg("6267", dup303); + +var msg8715 = msg("6268", dup303); + +var msg8716 = msg("6269", dup303); + +var msg8717 = msg("6270", dup303); + +var msg8718 = msg("6271", dup303); + +var msg8719 = msg("6272", dup303); + +var msg8720 = msg("6273", dup303); + +var msg8721 = msg("6274", dup303); + +var msg8722 = msg("6275", dup303); + +var msg8723 = msg("6276", dup303); + +var msg8724 = msg("6277", dup303); + +var msg8725 = msg("6278", dup303); + +var msg8726 = msg("6279", dup303); + +var msg8727 = msg("6280", dup303); + +var msg8728 = msg("6281", dup303); + +var msg8729 = msg("6282", dup303); + +var msg8730 = msg("6283", dup303); + +var msg8731 = msg("6284", dup303); + +var msg8732 = msg("6285", dup205); + +var msg8733 = msg("6286", dup205); + +var msg8734 = msg("6287", dup205); + +var msg8735 = msg("6288", dup205); + +var msg8736 = msg("6289", dup205); + +var msg8737 = msg("6290", dup205); + +var msg8738 = msg("6291", dup205); + +var msg8739 = msg("6292", dup205); + +var msg8740 = msg("6293", dup205); + +var msg8741 = msg("6294", dup205); + +var msg8742 = msg("6295", dup205); + +var msg8743 = msg("6296", dup205); + +var msg8744 = msg("6297", dup205); + +var msg8745 = msg("6298", dup205); + +var msg8746 = msg("6299", dup205); + +var msg8747 = msg("6300", dup205); + +var msg8748 = msg("6301", dup205); + +var msg8749 = msg("6302", dup205); + +var msg8750 = msg("6303", dup205); + +var msg8751 = msg("6304", dup205); + +var msg8752 = msg("6305", dup205); + +var msg8753 = msg("6306", dup205); + +var msg8754 = msg("6307", dup205); + +var msg8755 = msg("6308", dup205); + +var msg8756 = msg("6309", dup205); + +var msg8757 = msg("6310", dup205); + +var msg8758 = msg("6311", dup205); + +var msg8759 = msg("6312", dup205); + +var msg8760 = msg("6313", dup205); + +var msg8761 = msg("6314", dup205); + +var msg8762 = msg("6315", dup205); + +var msg8763 = msg("6316", dup205); + +var msg8764 = msg("6317", dup205); + +var msg8765 = msg("6318", dup205); + +var msg8766 = msg("6319", dup205); + +var msg8767 = msg("6320", dup205); + +var msg8768 = msg("6321", dup205); + +var msg8769 = msg("6322", dup205); + +var msg8770 = msg("6323", dup205); + +var msg8771 = msg("6324", dup205); + +var msg8772 = msg("6325", dup205); + +var msg8773 = msg("6326", dup205); + +var msg8774 = msg("6327", dup205); + +var msg8775 = msg("6328", dup205); + +var msg8776 = msg("6329", dup205); + +var msg8777 = msg("6330", dup205); + +var msg8778 = msg("6331", dup205); + +var msg8779 = msg("6332", dup205); + +var msg8780 = msg("6333", dup205); + +var msg8781 = msg("6334", dup205); + +var msg8782 = msg("6335", dup205); + +var msg8783 = msg("6336", dup205); + +var msg8784 = msg("6337", dup205); + +var msg8785 = msg("6338", dup205); + +var msg8786 = msg("6339", dup205); + +var msg8787 = msg("6340", dup303); + +var msg8788 = msg("6341", dup303); + +var msg8789 = msg("6342", dup303); + +var msg8790 = msg("6343", dup303); + +var msg8791 = msg("6344", dup303); + +var msg8792 = msg("6345", dup303); + +var msg8793 = msg("6346", dup303); + +var msg8794 = msg("6347", dup303); + +var msg8795 = msg("6348", dup303); + +var msg8796 = msg("6349", dup303); + +var msg8797 = msg("6350", dup303); + +var msg8798 = msg("6351", dup303); + +var msg8799 = msg("6352", dup303); + +var msg8800 = msg("6353", dup303); + +var msg8801 = msg("6354", dup303); + +var msg8802 = msg("6355", dup303); + +var msg8803 = msg("6356", dup303); + +var msg8804 = msg("6357", dup303); + +var msg8805 = msg("6358", dup303); + +var msg8806 = msg("6359", dup303); + +var msg8807 = msg("6360", dup303); + +var msg8808 = msg("6361", dup303); + +var msg8809 = msg("6362", dup303); + +var msg8810 = msg("6363", dup303); + +var msg8811 = msg("6364", dup303); + +var msg8812 = msg("6365", dup303); + +var msg8813 = msg("6366", dup303); + +var msg8814 = msg("6367", dup303); + +var msg8815 = msg("6368", dup303); + +var msg8816 = msg("6369", dup303); + +var msg8817 = msg("6370", dup303); + +var msg8818 = msg("6371", dup303); + +var msg8819 = msg("6372", dup303); + +var msg8820 = msg("6373", dup303); + +var msg8821 = msg("6374", dup303); + +var msg8822 = msg("6375", dup303); + +var msg8823 = msg("6376", dup303); + +var msg8824 = msg("6377", dup303); + +var msg8825 = msg("6378", dup303); + +var msg8826 = msg("6379", dup303); + +var msg8827 = msg("6380", dup303); + +var msg8828 = msg("6381", dup303); + +var msg8829 = msg("6382", dup303); + +var msg8830 = msg("6383", dup303); + +var msg8831 = msg("6384", dup303); + +var msg8832 = msg("6385", dup303); + +var msg8833 = msg("6386", dup303); + +var msg8834 = msg("6387", dup303); + +var msg8835 = msg("6388", dup303); + +var msg8836 = msg("6389", dup303); + +var msg8837 = msg("6390", dup303); + +var msg8838 = msg("6391", dup303); + +var msg8839 = msg("6392", dup303); + +var msg8840 = msg("6393", dup303); + +var msg8841 = msg("6394", dup303); + +var msg8842 = msg("6395", dup205); + +var msg8843 = msg("6396", dup205); + +var msg8844 = msg("6397", dup205); + +var msg8845 = msg("6398", dup205); + +var msg8846 = msg("6399", dup205); + +var msg8847 = msg("6400", dup205); + +var msg8848 = msg("6401", dup205); + +var msg8849 = msg("6402", dup205); + +var msg8850 = msg("6403", dup269); + +var msg8851 = msg("6404", dup196); + +var msg8852 = msg("6405", dup222); + +var msg8853 = msg("6406", dup196); + +var msg8854 = msg("6407", dup196); + +var msg8855 = msg("6408", dup196); + +var msg8856 = msg("6409", dup267); + +var msg8857 = msg("6410", dup267); + +var msg8858 = msg("6411", dup267); + +var msg8859 = msg("6412", dup250); + +var msg8860 = msg("6413", dup250); + +var msg8861 = msg("6414", dup267); + +var msg8862 = msg("6415", dup276); + +var msg8863 = msg("6416", dup276); + +var msg8864 = msg("6417", dup276); + +var msg8865 = msg("6418", dup276); + +var msg8866 = msg("6419", dup276); + +var msg8867 = msg("6420", dup276); + +var msg8868 = msg("6421", dup276); + +var msg8869 = msg("6422", dup276); + +var msg8870 = msg("6423", dup276); + +var msg8871 = msg("6424", dup276); + +var msg8872 = msg("6425", dup276); + +var msg8873 = msg("6426", dup276); + +var msg8874 = msg("6427", dup276); + +var msg8875 = msg("6428", dup276); + +var msg8876 = msg("6429", dup276); + +var msg8877 = msg("6430", dup276); + +var msg8878 = msg("6431", dup276); + +var msg8879 = msg("6432", dup276); + +var msg8880 = msg("6433", dup276); + +var msg8881 = msg("6434", dup276); + +var msg8882 = msg("6435", dup276); + +var msg8883 = msg("6436", dup276); + +var msg8884 = msg("6437", dup276); + +var msg8885 = msg("6438", dup276); + +var msg8886 = msg("6439", dup276); + +var msg8887 = msg("6440", dup276); + +var msg8888 = msg("6441", dup276); + +var msg8889 = msg("6442", dup276); + +var msg8890 = msg("6443", dup276); + +var msg8891 = msg("6444", dup276); + +var msg8892 = msg("6445", dup276); + +var msg8893 = msg("6446", dup276); + +var msg8894 = msg("6447", dup276); + +var msg8895 = msg("6448", dup276); + +var msg8896 = msg("6449", dup276); + +var msg8897 = msg("6450", dup276); + +var msg8898 = msg("6451", dup276); + +var msg8899 = msg("6452", dup276); + +var msg8900 = msg("6453", dup276); + +var msg8901 = msg("6454", dup276); + +var msg8902 = msg("6455", dup276); + +var msg8903 = msg("6456", dup276); + +var msg8904 = msg("6457", dup276); + +var msg8905 = msg("6458", dup276); + +var msg8906 = msg("6459", dup276); + +var msg8907 = msg("6460", dup276); + +var msg8908 = msg("6461", dup276); + +var msg8909 = msg("6462", dup276); + +var msg8910 = msg("6463", dup276); + +var msg8911 = msg("6464", dup276); + +var msg8912 = msg("6465", dup276); + +var msg8913 = msg("6466", dup276); + +var msg8914 = msg("6467", dup196); + +var msg8915 = msg("6468", dup196); + +var msg8916 = msg("6469", dup196); + +var msg8917 = msg("6470", dup196); + +var msg8918 = msg("6471", dup285); + +var msg8919 = msg("6472", dup205); + +var msg8920 = msg("6473", dup205); + +var msg8921 = msg("6474", dup205); + +var msg8922 = msg("6475", dup205); + +var msg8923 = msg("6476", dup205); + +var msg8924 = msg("6477", dup303); + +var msg8925 = msg("6478", dup303); + +var msg8926 = msg("6479", dup303); + +var msg8927 = msg("6480", dup303); + +var msg8928 = msg("6481", dup303); + +var msg8929 = msg("6482", dup303); + +var msg8930 = msg("6483", dup303); + +var msg8931 = msg("6484", dup303); + +var msg8932 = msg("6485", dup303); + +var msg8933 = msg("6486", dup303); + +var msg8934 = msg("6487", dup303); + +var msg8935 = msg("6488", dup303); + +var msg8936 = msg("6489", dup303); + +var msg8937 = msg("6490", dup303); + +var msg8938 = msg("6491", dup303); + +var msg8939 = msg("6492", dup205); + +var msg8940 = msg("6493", dup205); + +var msg8941 = msg("6494", dup303); + +var msg8942 = msg("6495", dup303); + +var msg8943 = msg("6496", dup303); + +var msg8944 = msg("6497", dup205); + +var msg8945 = msg("6498", dup205); + +var msg8946 = msg("6499", dup205); + +var msg8947 = msg("6500", dup205); + +var msg8948 = msg("6501", dup205); + +var msg8949 = msg("6502", dup197); + +var msg8950 = msg("6503", dup197); + +var msg8951 = msg("6504", dup194); + +var msg8952 = msg("6505", dup267); + +var msg8953 = msg("6506", dup267); + +var msg8954 = msg("6507", dup267); + +var msg8955 = msg("6508", dup222); + +var msg8956 = msg("6509", dup267); + +var msg8957 = msg("6510", dup267); + +var msg8958 = msg("6511", dup267); + +var msg8959 = msg("6512", dup194); + +var msg8960 = msg("6513", dup222); + +var msg8961 = msg("6514", dup222); + +var msg8962 = msg("6515", dup222); + +var msg8963 = msg("6516", dup265); + +var msg8964 = msg("6517", dup265); + +var msg8965 = msg("6518", dup265); + +var msg8966 = msg("6519", dup265); + +var msg8967 = msg("6520", dup276); + +var msg8968 = msg("6521", dup276); + +var msg8969 = msg("6522", dup276); + +var msg8970 = msg("6523", dup276); + +var msg8971 = msg("6524", dup276); + +var msg8972 = msg("6525", dup276); + +var msg8973 = msg("6526", dup276); + +var msg8974 = msg("6527", dup276); + +var msg8975 = msg("6528", dup276); + +var msg8976 = msg("6529", dup276); + +var msg8977 = msg("6530", dup276); + +var msg8978 = msg("6531", dup276); + +var msg8979 = msg("6532", dup276); + +var msg8980 = msg("6533", dup276); + +var msg8981 = msg("6534", dup276); + +var msg8982 = msg("6535", dup276); + +var msg8983 = msg("6536", dup276); + +var msg8984 = msg("6537", dup276); + +var msg8985 = msg("6538", dup276); + +var msg8986 = msg("6539", dup276); + +var msg8987 = msg("6540", dup276); + +var msg8988 = msg("6541", dup276); + +var msg8989 = msg("6542", dup276); + +var msg8990 = msg("6543", dup276); + +var msg8991 = msg("6544", dup276); + +var msg8992 = msg("6545", dup276); + +var msg8993 = msg("6546", dup276); + +var msg8994 = msg("6547", dup276); + +var msg8995 = msg("6548", dup276); + +var msg8996 = msg("6549", dup276); + +var msg8997 = msg("6550", dup276); + +var msg8998 = msg("6551", dup276); + +var msg8999 = msg("6552", dup276); + +var msg9000 = msg("6553", dup276); + +var msg9001 = msg("6554", dup276); + +var msg9002 = msg("6555", dup276); + +var msg9003 = msg("6556", dup276); + +var msg9004 = msg("6557", dup276); + +var msg9005 = msg("6558", dup276); + +var msg9006 = msg("6559", dup276); + +var msg9007 = msg("6560", dup276); + +var msg9008 = msg("6561", dup276); + +var msg9009 = msg("6562", dup276); + +var msg9010 = msg("6563", dup276); + +var msg9011 = msg("6564", dup276); + +var msg9012 = msg("6565", dup276); + +var msg9013 = msg("6566", dup276); + +var msg9014 = msg("6567", dup276); + +var msg9015 = msg("6568", dup276); + +var msg9016 = msg("6569", dup276); + +var msg9017 = msg("6570", dup276); + +var msg9018 = msg("6571", dup276); + +var msg9019 = msg("6572", dup276); + +var msg9020 = msg("6573", dup276); + +var msg9021 = msg("6574", dup276); + +var msg9022 = msg("6575", dup276); + +var msg9023 = msg("6576", dup276); + +var msg9024 = msg("6577", dup276); + +var msg9025 = msg("6578", dup276); + +var msg9026 = msg("6579", dup276); + +var msg9027 = msg("6580", dup276); + +var msg9028 = msg("6581", dup276); + +var msg9029 = msg("6582", dup276); + +var msg9030 = msg("6583", dup276); + +var msg9031 = msg("6584", dup276); + +var msg9032 = msg("6585", dup276); + +var msg9033 = msg("6586", dup276); + +var msg9034 = msg("6587", dup276); + +var msg9035 = msg("6588", dup276); + +var msg9036 = msg("6589", dup276); + +var msg9037 = msg("6590", dup276); + +var msg9038 = msg("6591", dup276); + +var msg9039 = msg("6592", dup276); + +var msg9040 = msg("6593", dup276); + +var msg9041 = msg("6594", dup276); + +var msg9042 = msg("6595", dup276); + +var msg9043 = msg("6596", dup276); + +var msg9044 = msg("6597", dup276); + +var msg9045 = msg("6598", dup276); + +var msg9046 = msg("6599", dup276); + +var msg9047 = msg("6600", dup276); + +var msg9048 = msg("6601", dup276); + +var msg9049 = msg("6602", dup276); + +var msg9050 = msg("6603", dup276); + +var msg9051 = msg("6604", dup276); + +var msg9052 = msg("6605", dup276); + +var msg9053 = msg("6606", dup276); + +var msg9054 = msg("6607", dup276); + +var msg9055 = msg("6608", dup276); + +var msg9056 = msg("6609", dup276); + +var msg9057 = msg("6610", dup276); + +var msg9058 = msg("6611", dup276); + +var msg9059 = msg("6612", dup276); + +var msg9060 = msg("6613", dup276); + +var msg9061 = msg("6614", dup276); + +var msg9062 = msg("6615", dup276); + +var msg9063 = msg("6616", dup276); + +var msg9064 = msg("6617", dup276); + +var msg9065 = msg("6618", dup276); + +var msg9066 = msg("6619", dup276); + +var msg9067 = msg("6620", dup276); + +var msg9068 = msg("6621", dup276); + +var msg9069 = msg("6622", dup276); + +var msg9070 = msg("6623", dup276); + +var msg9071 = msg("6624", dup276); + +var msg9072 = msg("6625", dup276); + +var msg9073 = msg("6626", dup276); + +var msg9074 = msg("6627", dup276); + +var msg9075 = msg("6628", dup276); + +var msg9076 = msg("6629", dup276); + +var msg9077 = msg("6630", dup276); + +var msg9078 = msg("6631", dup276); + +var msg9079 = msg("6632", dup276); + +var msg9080 = msg("6633", dup276); + +var msg9081 = msg("6634", dup276); + +var msg9082 = msg("6635", dup276); + +var msg9083 = msg("6636", dup276); + +var msg9084 = msg("6637", dup276); + +var msg9085 = msg("6638", dup276); + +var msg9086 = msg("6639", dup276); + +var msg9087 = msg("6640", dup276); + +var msg9088 = msg("6641", dup276); + +var msg9089 = msg("6642", dup276); + +var msg9090 = msg("6643", dup276); + +var msg9091 = msg("6644", dup276); + +var msg9092 = msg("6645", dup276); + +var msg9093 = msg("6646", dup276); + +var msg9094 = msg("6647", dup276); + +var msg9095 = msg("6648", dup276); + +var msg9096 = msg("6649", dup276); + +var msg9097 = msg("6650", dup276); + +var msg9098 = msg("6651", dup276); + +var msg9099 = msg("6652", dup276); + +var msg9100 = msg("6653", dup276); + +var msg9101 = msg("6654", dup276); + +var msg9102 = msg("6655", dup276); + +var msg9103 = msg("6656", dup276); + +var msg9104 = msg("6657", dup276); + +var msg9105 = msg("6658", dup276); + +var msg9106 = msg("6659", dup276); + +var msg9107 = msg("6660", dup276); + +var msg9108 = msg("6661", dup276); + +var msg9109 = msg("6662", dup276); + +var msg9110 = msg("6663", dup276); + +var msg9111 = msg("6664", dup276); + +var msg9112 = msg("6665", dup276); + +var msg9113 = msg("6666", dup276); + +var msg9114 = msg("6667", dup276); + +var msg9115 = msg("6668", dup276); + +var msg9116 = msg("6669", dup276); + +var msg9117 = msg("6670", dup276); + +var msg9118 = msg("6671", dup276); + +var msg9119 = msg("6672", dup276); + +var msg9120 = msg("6673", dup276); + +var msg9121 = msg("6674", dup276); + +var msg9122 = msg("6675", dup276); + +var msg9123 = msg("6676", dup276); + +var msg9124 = msg("6677", dup276); + +var msg9125 = msg("6678", dup276); + +var msg9126 = msg("6679", dup276); + +var msg9127 = msg("6680", dup265); + +var msg9128 = msg("6681", dup265); + +var msg9129 = msg("6682", dup265); + +var msg9130 = msg("6683", dup265); + +var msg9131 = msg("6684", dup265); + +var msg9132 = msg("6685", dup265); + +var msg9133 = msg("6686", dup265); + +var msg9134 = msg("6687", dup265); + +var msg9135 = msg("6688", dup196); + +var msg9136 = msg("6689", dup267); + +var msg9137 = msg("6690", dup267); + +var msg9138 = msg("6691", dup267); + +var msg9139 = msg("6692", dup267); + +var msg9140 = msg("6693", dup267); + +var msg9141 = msg("6694", dup267); + +var msg9142 = msg("6695", dup267); + +var msg9143 = msg("6696", dup267); + +var msg9144 = msg("6697", dup267); + +var msg9145 = msg("6698", dup267); + +var msg9146 = msg("6699", dup267); + +var msg9147 = msg("6700", dup304); + +var msg9148 = msg("6701", dup267); + +var msg9149 = msg("6702", dup276); + +var msg9150 = msg("6703", dup276); + +var msg9151 = msg("6704", dup276); + +var msg9152 = msg("6705", dup276); + +var msg9153 = msg("6706", dup276); + +var msg9154 = msg("6707", dup276); + +var msg9155 = msg("6708", dup276); + +var msg9156 = msg("6709", dup276); + +var msg9157 = msg("6710", dup276); + +var msg9158 = msg("6711", dup276); + +var msg9159 = msg("6712", dup276); + +var msg9160 = msg("6713", dup276); + +var msg9161 = msg("6714", dup276); + +var msg9162 = msg("6715", dup276); + +var msg9163 = msg("6716", dup276); + +var msg9164 = msg("6717", dup276); + +var msg9165 = msg("6718", dup276); + +var msg9166 = msg("6719", dup276); + +var msg9167 = msg("6720", dup276); + +var msg9168 = msg("6721", dup276); + +var msg9169 = msg("6722", dup276); + +var msg9170 = msg("6723", dup276); + +var msg9171 = msg("6724", dup276); + +var msg9172 = msg("6725", dup276); + +var msg9173 = msg("6726", dup276); + +var msg9174 = msg("6727", dup276); + +var msg9175 = msg("6728", dup276); + +var msg9176 = msg("6729", dup276); + +var msg9177 = msg("6730", dup276); + +var msg9178 = msg("6731", dup276); + +var msg9179 = msg("6732", dup276); + +var msg9180 = msg("6733", dup276); + +var msg9181 = msg("6734", dup276); + +var msg9182 = msg("6735", dup276); + +var msg9183 = msg("6736", dup276); + +var msg9184 = msg("6737", dup276); + +var msg9185 = msg("6738", dup276); + +var msg9186 = msg("6739", dup276); + +var msg9187 = msg("6740", dup276); + +var msg9188 = msg("6741", dup276); + +var msg9189 = msg("6742", dup276); + +var msg9190 = msg("6743", dup276); + +var msg9191 = msg("6744", dup276); + +var msg9192 = msg("6745", dup276); + +var msg9193 = msg("6746", dup276); + +var msg9194 = msg("6747", dup276); + +var msg9195 = msg("6748", dup276); + +var msg9196 = msg("6749", dup276); + +var msg9197 = msg("6750", dup276); + +var msg9198 = msg("6751", dup276); + +var msg9199 = msg("6752", dup276); + +var msg9200 = msg("6753", dup276); + +var msg9201 = msg("6754", dup276); + +var msg9202 = msg("6755", dup276); + +var msg9203 = msg("6756", dup276); + +var msg9204 = msg("6757", dup276); + +var msg9205 = msg("6758", dup276); + +var msg9206 = msg("6759", dup276); + +var msg9207 = msg("6760", dup276); + +var msg9208 = msg("6761", dup276); + +var msg9209 = msg("6762", dup276); + +var msg9210 = msg("6763", dup276); + +var msg9211 = msg("6764", dup276); + +var msg9212 = msg("6765", dup276); + +var msg9213 = msg("6766", dup276); + +var msg9214 = msg("6767", dup276); + +var msg9215 = msg("6768", dup276); + +var msg9216 = msg("6769", dup276); + +var msg9217 = msg("6770", dup276); + +var msg9218 = msg("6771", dup276); + +var msg9219 = msg("6772", dup276); + +var msg9220 = msg("6773", dup276); + +var msg9221 = msg("6774", dup276); + +var msg9222 = msg("6775", dup276); + +var msg9223 = msg("6776", dup276); + +var msg9224 = msg("6777", dup276); + +var msg9225 = msg("6778", dup276); + +var msg9226 = msg("6779", dup276); + +var msg9227 = msg("6780", dup276); + +var msg9228 = msg("6781", dup276); + +var msg9229 = msg("6782", dup276); + +var msg9230 = msg("6783", dup276); + +var msg9231 = msg("6784", dup276); + +var msg9232 = msg("6785", dup276); + +var msg9233 = msg("6786", dup276); + +var msg9234 = msg("6787", dup276); + +var msg9235 = msg("6788", dup276); + +var msg9236 = msg("6789", dup276); + +var msg9237 = msg("6790", dup276); + +var msg9238 = msg("6791", dup276); + +var msg9239 = msg("6792", dup276); + +var msg9240 = msg("6793", dup276); + +var msg9241 = msg("6794", dup276); + +var msg9242 = msg("6795", dup276); + +var msg9243 = msg("6796", dup276); + +var msg9244 = msg("6797", dup276); + +var msg9245 = msg("6798", dup276); + +var msg9246 = msg("6799", dup276); + +var msg9247 = msg("6800", dup276); + +var msg9248 = msg("6801", dup276); + +var msg9249 = msg("6802", dup276); + +var msg9250 = msg("6803", dup276); + +var msg9251 = msg("6804", dup276); + +var msg9252 = msg("6805", dup276); + +var msg9253 = msg("6806", dup276); + +var msg9254 = msg("6807", dup276); + +var msg9255 = msg("6808", dup276); + +var msg9256 = msg("6809", dup276); + +var msg9257 = msg("6810", dup276); + +var msg9258 = msg("6811", dup276); + +var msg9259 = msg("6812", dup276); + +var msg9260 = msg("6813", dup276); + +var msg9261 = msg("6814", dup276); + +var msg9262 = msg("6815", dup276); + +var msg9263 = msg("6816", dup276); + +var msg9264 = msg("6817", dup276); + +var msg9265 = msg("6818", dup276); + +var msg9266 = msg("6819", dup276); + +var msg9267 = msg("6820", dup276); + +var msg9268 = msg("6821", dup276); + +var msg9269 = msg("6822", dup276); + +var msg9270 = msg("6823", dup276); + +var msg9271 = msg("6824", dup276); + +var msg9272 = msg("6825", dup276); + +var msg9273 = msg("6826", dup276); + +var msg9274 = msg("6827", dup276); + +var msg9275 = msg("6828", dup276); + +var msg9276 = msg("6829", dup276); + +var msg9277 = msg("6830", dup276); + +var msg9278 = msg("6831", dup276); + +var msg9279 = msg("6832", dup276); + +var msg9280 = msg("6833", dup276); + +var msg9281 = msg("6834", dup276); + +var msg9282 = msg("6835", dup276); + +var msg9283 = msg("6836", dup276); + +var msg9284 = msg("6837", dup276); + +var msg9285 = msg("6838", dup276); + +var msg9286 = msg("6839", dup276); + +var msg9287 = msg("6840", dup276); + +var msg9288 = msg("6841", dup276); + +var msg9289 = msg("6842", dup276); + +var msg9290 = msg("6843", dup276); + +var msg9291 = msg("6844", dup276); + +var msg9292 = msg("6845", dup276); + +var msg9293 = msg("6846", dup276); + +var msg9294 = msg("6847", dup276); + +var msg9295 = msg("6848", dup276); + +var msg9296 = msg("6849", dup276); + +var msg9297 = msg("6850", dup276); + +var msg9298 = msg("6851", dup276); + +var msg9299 = msg("6852", dup276); + +var msg9300 = msg("6853", dup276); + +var msg9301 = msg("6854", dup276); + +var msg9302 = msg("6855", dup276); + +var msg9303 = msg("6856", dup276); + +var msg9304 = msg("6857", dup276); + +var msg9305 = msg("6858", dup276); + +var msg9306 = msg("6859", dup276); + +var msg9307 = msg("6860", dup276); + +var msg9308 = msg("6861", dup276); + +var msg9309 = msg("6862", dup276); + +var msg9310 = msg("6863", dup276); + +var msg9311 = msg("6864", dup276); + +var msg9312 = msg("6865", dup276); + +var msg9313 = msg("6866", dup276); + +var msg9314 = msg("6867", dup276); + +var msg9315 = msg("6868", dup276); + +var msg9316 = msg("6869", dup276); + +var msg9317 = msg("6870", dup276); + +var msg9318 = msg("6871", dup276); + +var msg9319 = msg("6872", dup276); + +var msg9320 = msg("6873", dup276); + +var msg9321 = msg("6874", dup276); + +var msg9322 = msg("6875", dup276); + +var msg9323 = msg("6876", dup276); + +var msg9324 = msg("6877", dup276); + +var msg9325 = msg("6878", dup276); + +var msg9326 = msg("6879", dup276); + +var msg9327 = msg("6880", dup276); + +var msg9328 = msg("6881", dup276); + +var msg9329 = msg("6882", dup276); + +var msg9330 = msg("6883", dup276); + +var msg9331 = msg("6884", dup276); + +var msg9332 = msg("6885", dup276); + +var msg9333 = msg("6886", dup276); + +var msg9334 = msg("6887", dup276); + +var msg9335 = msg("6888", dup276); + +var msg9336 = msg("6889", dup276); + +var msg9337 = msg("6890", dup276); + +var msg9338 = msg("6891", dup276); + +var msg9339 = msg("6892", dup276); + +var msg9340 = msg("6893", dup276); + +var msg9341 = msg("6894", dup276); + +var msg9342 = msg("6895", dup276); + +var msg9343 = msg("6896", dup276); + +var msg9344 = msg("6897", dup276); + +var msg9345 = msg("6898", dup276); + +var msg9346 = msg("6899", dup276); + +var msg9347 = msg("6900", dup276); + +var msg9348 = msg("6901", dup276); + +var msg9349 = msg("6902", dup276); + +var msg9350 = msg("6903", dup276); + +var msg9351 = msg("6904", dup276); + +var msg9352 = msg("6905", dup276); + +var msg9353 = msg("6906", dup276); + +var msg9354 = msg("6907", dup276); + +var msg9355 = msg("6908", dup276); + +var msg9356 = msg("6909", dup276); + +var msg9357 = msg("6910", dup276); + +var msg9358 = msg("6911", dup276); + +var msg9359 = msg("6912", dup276); + +var msg9360 = msg("6913", dup276); + +var msg9361 = msg("6914", dup276); + +var msg9362 = msg("6915", dup276); + +var msg9363 = msg("6916", dup276); + +var msg9364 = msg("6917", dup276); + +var msg9365 = msg("6918", dup276); + +var msg9366 = msg("6919", dup276); + +var msg9367 = msg("6920", dup276); + +var msg9368 = msg("6921", dup276); + +var msg9369 = msg("6922", dup276); + +var msg9370 = msg("6923", dup276); + +var msg9371 = msg("6924", dup276); + +var msg9372 = msg("6925", dup276); + +var msg9373 = msg("6926", dup276); + +var msg9374 = msg("6927", dup276); + +var msg9375 = msg("6928", dup276); + +var msg9376 = msg("6929", dup276); + +var msg9377 = msg("6930", dup276); + +var msg9378 = msg("6931", dup276); + +var msg9379 = msg("6932", dup276); + +var msg9380 = msg("6933", dup276); + +var msg9381 = msg("6934", dup276); + +var msg9382 = msg("6935", dup276); + +var msg9383 = msg("6936", dup276); + +var msg9384 = msg("6937", dup276); + +var msg9385 = msg("6938", dup276); + +var msg9386 = msg("6939", dup276); + +var msg9387 = msg("6940", dup276); + +var msg9388 = msg("6941", dup276); + +var msg9389 = msg("6942", dup276); + +var msg9390 = msg("6943", dup276); + +var msg9391 = msg("6944", dup276); + +var msg9392 = msg("6945", dup276); + +var msg9393 = msg("6946", dup276); + +var msg9394 = msg("6947", dup276); + +var msg9395 = msg("6948", dup276); + +var msg9396 = msg("6949", dup276); + +var msg9397 = msg("6950", dup276); + +var msg9398 = msg("6951", dup276); + +var msg9399 = msg("6952", dup276); + +var msg9400 = msg("6953", dup276); + +var msg9401 = msg("6954", dup276); + +var msg9402 = msg("6955", dup276); + +var msg9403 = msg("6956", dup276); + +var msg9404 = msg("6957", dup276); + +var msg9405 = msg("6958", dup276); + +var msg9406 = msg("6959", dup276); + +var msg9407 = msg("6960", dup276); + +var msg9408 = msg("6961", dup276); + +var msg9409 = msg("6962", dup276); + +var msg9410 = msg("6963", dup276); + +var msg9411 = msg("6964", dup276); + +var msg9412 = msg("6965", dup276); + +var msg9413 = msg("6966", dup276); + +var msg9414 = msg("6967", dup276); + +var msg9415 = msg("6968", dup276); + +var msg9416 = msg("6969", dup276); + +var msg9417 = msg("6970", dup276); + +var msg9418 = msg("6971", dup276); + +var msg9419 = msg("6972", dup276); + +var msg9420 = msg("6973", dup276); + +var msg9421 = msg("6974", dup276); + +var msg9422 = msg("6975", dup276); + +var msg9423 = msg("6976", dup276); + +var msg9424 = msg("6977", dup276); + +var msg9425 = msg("6978", dup276); + +var msg9426 = msg("6979", dup276); + +var msg9427 = msg("6980", dup276); + +var msg9428 = msg("6981", dup276); + +var msg9429 = msg("6982", dup276); + +var msg9430 = msg("6983", dup276); + +var msg9431 = msg("6984", dup276); + +var msg9432 = msg("6985", dup276); + +var msg9433 = msg("6986", dup276); + +var msg9434 = msg("6987", dup276); + +var msg9435 = msg("6988", dup276); + +var msg9436 = msg("6989", dup276); + +var msg9437 = msg("6990", dup276); + +var msg9438 = msg("6991", dup276); + +var msg9439 = msg("6992", dup276); + +var msg9440 = msg("6993", dup276); + +var msg9441 = msg("6994", dup276); + +var msg9442 = msg("6995", dup276); + +var msg9443 = msg("6996", dup276); + +var msg9444 = msg("6997", dup276); + +var msg9445 = msg("6998", dup276); + +var msg9446 = msg("6999", dup276); + +var msg9447 = msg("7000", dup276); + +var msg9448 = msg("7001", dup276); + +var msg9449 = msg("7002", dup267); + +var msg9450 = msg("7003", dup265); + +var msg9451 = msg("7004", dup265); + +var msg9452 = msg("7005", dup265); + +var msg9453 = msg("7006", dup265); + +var msg9454 = msg("7007", dup265); + +var msg9455 = msg("7008", dup265); + +var msg9456 = msg("7009", dup265); + +var msg9457 = msg("7010", dup265); + +var msg9458 = msg("7011", dup265); + +var msg9459 = msg("7012", dup265); + +var msg9460 = msg("7013", dup265); + +var msg9461 = msg("7014", dup265); + +var msg9462 = msg("7015", dup265); + +var msg9463 = msg("7016", dup265); + +var msg9464 = msg("7017", dup265); + +var msg9465 = msg("7018", dup265); + +var msg9466 = msg("7019", dup196); + +var msg9467 = msg("7020", dup265); + +var msg9468 = msg("7021", dup198); + +var msg9469 = msg("7022", dup267); + +var msg9470 = msg("7023", dup196); + +var msg9471 = msg("7024", dup267); + +var msg9472 = msg("7025", dup267); + +var msg9473 = msg("7026", dup265); + +var msg9474 = msg("7027", dup265); + +var msg9475 = msg("7028", dup265); + +var msg9476 = msg("7029", dup265); + +var msg9477 = msg("7030", dup196); + +var msg9478 = msg("7031", dup196); + +var msg9479 = msg("7032", dup196); + +var msg9480 = msg("7033", dup196); + +var msg9481 = msg("7034", dup196); + +var msg9482 = msg("7035", dup276); + +var msg9483 = msg("7036", dup276); + +var msg9484 = msg("7037", dup276); + +var msg9485 = msg("7038", dup276); + +var msg9486 = msg("7039", dup276); + +var msg9487 = msg("7040", dup276); + +var msg9488 = msg("7041", dup276); + +var msg9489 = msg("7042", dup276); + +var msg9490 = msg("7043", dup276); + +var msg9491 = msg("7044", dup276); + +var msg9492 = msg("7045", dup276); + +var msg9493 = msg("7046", dup276); + +var msg9494 = msg("7047", dup267); + +var msg9495 = msg("7048", dup267); + +var msg9496 = msg("7049", dup303); + +var msg9497 = msg("7050", dup303); + +var msg9498 = msg("7051", dup303); + +var msg9499 = msg("7052", dup303); + +var msg9500 = msg("7053", dup303); + +var msg9501 = msg("7054", dup303); + +var msg9502 = msg("7055", dup303); + +var msg9503 = msg("7056", dup205); + +var msg9504 = msg("7057", dup205); + +var msg9505 = msg("7058", dup205); + +var msg9506 = msg("7059", dup205); + +var msg9507 = msg("7060", dup205); + +var msg9508 = msg("7061", dup205); + +var msg9509 = msg("7062", dup205); + +var msg9510 = msg("7063", dup205); + +var msg9511 = msg("7064", dup205); + +var msg9512 = msg("7065", dup205); + +var msg9513 = msg("7066", dup205); + +var msg9514 = msg("7067", dup205); + +var msg9515 = msg("7068", dup205); + +var msg9516 = msg("7069", dup205); + +var msg9517 = msg("7070", dup265); + +var msg9518 = msg("7071", dup265); + +var msg9519 = msg("7072", dup205); + +var msg9520 = msg("7073", dup205); + +var msg9521 = msg("7074", dup205); + +var msg9522 = msg("7075", dup205); + +var msg9523 = msg("7076", dup205); + +var msg9524 = msg("7077", dup205); + +var msg9525 = msg("7078", dup205); + +var msg9526 = msg("7079", dup205); + +var msg9527 = msg("7080", dup205); + +var msg9528 = msg("7081", dup205); + +var msg9529 = msg("7082", dup205); + +var msg9530 = msg("7083", dup205); + +var msg9531 = msg("7084", dup205); + +var msg9532 = msg("7085", dup205); + +var msg9533 = msg("7086", dup205); + +var msg9534 = msg("7087", dup205); + +var msg9535 = msg("7088", dup205); + +var msg9536 = msg("7089", dup205); + +var msg9537 = msg("7090", dup205); + +var msg9538 = msg("7091", dup205); + +var msg9539 = msg("7092", dup205); + +var msg9540 = msg("7093", dup205); + +var msg9541 = msg("7094", dup205); + +var msg9542 = msg("7095", dup205); + +var msg9543 = msg("7096", dup205); + +var msg9544 = msg("7097", dup205); + +var msg9545 = msg("7098", dup205); + +var msg9546 = msg("7099", dup205); + +var msg9547 = msg("7100", dup205); + +var msg9548 = msg("7101", dup205); + +var msg9549 = msg("7102", dup205); + +var msg9550 = msg("7103", dup205); + +var msg9551 = msg("7104", dup205); + +var msg9552 = msg("7105", dup205); + +var msg9553 = msg("7106", dup205); + +var msg9554 = msg("7107", dup205); + +var msg9555 = msg("7108", dup205); + +var msg9556 = msg("7109", dup205); + +var msg9557 = msg("7110", dup205); + +var msg9558 = msg("7111", dup205); + +var msg9559 = msg("7112", dup205); + +var msg9560 = msg("7113", dup205); + +var msg9561 = msg("7114", dup205); + +var msg9562 = msg("7115", dup205); + +var msg9563 = msg("7116", dup205); + +var msg9564 = msg("7117", dup205); + +var msg9565 = msg("7118", dup205); + +var msg9566 = msg("7119", dup205); + +var msg9567 = msg("7120", dup205); + +var msg9568 = msg("7121", dup205); + +var msg9569 = msg("7122", dup205); + +var msg9570 = msg("7123", dup303); + +var msg9571 = msg("7124", dup303); + +var msg9572 = msg("7125", dup303); + +var msg9573 = msg("7126", dup192); + +var msg9574 = msg("7127", dup303); + +var msg9575 = msg("7128", dup303); + +var msg9576 = msg("7129", dup303); + +var msg9577 = msg("7130", dup303); + +var msg9578 = msg("7131", dup303); + +var msg9579 = msg("7132", dup303); + +var msg9580 = msg("7133", dup303); + +var msg9581 = msg("7134", dup303); + +var msg9582 = msg("7135", dup303); + +var msg9583 = msg("7136", dup303); + +var msg9584 = msg("7137", dup303); + +var msg9585 = msg("7138", dup192); + +var msg9586 = msg("7139", dup192); + +var msg9587 = msg("7140", dup303); + +var msg9588 = msg("7141", dup303); + +var msg9589 = msg("7142", dup303); + +var msg9590 = msg("7143", dup303); + +var msg9591 = msg("7144", dup303); + +var msg9592 = msg("7145", dup303); + +var msg9593 = msg("7146", dup303); + +var msg9594 = msg("7147", dup303); + +var msg9595 = msg("7148", dup303); + +var msg9596 = msg("7149", dup303); + +var msg9597 = msg("7150", dup303); + +var msg9598 = msg("7151", dup303); + +var msg9599 = msg("7152", dup303); + +var msg9600 = msg("7153", dup303); + +var msg9601 = msg("7154", dup303); + +var msg9602 = msg("7155", dup303); + +var msg9603 = msg("7156", dup303); + +var msg9604 = msg("7157", dup303); + +var msg9605 = msg("7158", dup303); + +var msg9606 = msg("7159", dup303); + +var msg9607 = msg("7160", dup303); + +var msg9608 = msg("7161", dup303); + +var msg9609 = msg("7162", dup303); + +var msg9610 = msg("7163", dup303); + +var msg9611 = msg("7164", dup303); + +var msg9612 = msg("7165", dup303); + +var msg9613 = msg("7166", dup303); + +var msg9614 = msg("7167", dup303); + +var msg9615 = msg("7168", dup303); + +var msg9616 = msg("7169", dup303); + +var msg9617 = msg("7170", dup303); + +var msg9618 = msg("7171", dup303); + +var msg9619 = msg("7172", dup303); + +var msg9620 = msg("7173", dup303); + +var msg9621 = msg("7174", dup303); + +var msg9622 = msg("7175", dup303); + +var msg9623 = msg("7176", dup303); + +var msg9624 = msg("7177", dup303); + +var msg9625 = msg("7178", dup303); + +var msg9626 = msg("7179", dup303); + +var msg9627 = msg("7180", dup303); + +var msg9628 = msg("7181", dup303); + +var msg9629 = msg("7182", dup303); + +var msg9630 = msg("7183", dup303); + +var msg9631 = msg("7184", dup303); + +var msg9632 = msg("7185", dup303); + +var msg9633 = msg("7186", dup303); + +var msg9634 = msg("7187", dup303); + +var msg9635 = msg("7188", dup303); + +var msg9636 = msg("7189", dup303); + +var msg9637 = msg("7190", dup303); + +var msg9638 = msg("7191", dup303); + +var msg9639 = msg("7192", dup303); + +var msg9640 = msg("7193", dup303); + +var msg9641 = msg("7194", dup303); + +var msg9642 = msg("7195", dup303); + +var msg9643 = msg("7196", dup222); + +var msg9644 = msg("7197", dup265); + +var msg9645 = msg("7198", dup265); + +var msg9646 = msg("7199", dup267); + +var msg9647 = msg("7200", dup267); + +var msg9648 = msg("7201", dup267); + +var msg9649 = msg("7202", dup267); + +var msg9650 = msg("7203", dup267); + +var msg9651 = msg("7204", dup267); + +var msg9652 = msg("7205", dup267); + +var msg9653 = msg("7206", dup196); + +var msg9654 = msg("7207", dup260); + +var msg9655 = msg("7208", dup196); + +var msg9656 = msg("7209", dup276); + +var msg9657 = msg("7210", dup276); + +var msg9658 = msg("7211", dup276); + +var msg9659 = msg("7212", dup276); + +var msg9660 = msg("7213", dup276); + +var msg9661 = msg("7214", dup276); + +var msg9662 = msg("7215", dup276); + +var msg9663 = msg("7216", dup276); + +var msg9664 = msg("7217", dup276); + +var msg9665 = msg("7218", dup276); + +var msg9666 = msg("7219", dup276); + +var msg9667 = msg("7220", dup276); + +var msg9668 = msg("7221", dup276); + +var msg9669 = msg("7222", dup276); + +var msg9670 = msg("7223", dup276); + +var msg9671 = msg("7224", dup276); + +var msg9672 = msg("7225", dup276); + +var msg9673 = msg("7226", dup276); + +var msg9674 = msg("7227", dup276); + +var msg9675 = msg("7228", dup276); + +var msg9676 = msg("7229", dup276); + +var msg9677 = msg("7230", dup276); + +var msg9678 = msg("7231", dup276); + +var msg9679 = msg("7232", dup276); + +var msg9680 = msg("7233", dup276); + +var msg9681 = msg("7234", dup276); + +var msg9682 = msg("7235", dup276); + +var msg9683 = msg("7236", dup276); + +var msg9684 = msg("7237", dup276); + +var msg9685 = msg("7238", dup276); + +var msg9686 = msg("7239", dup276); + +var msg9687 = msg("7240", dup276); + +var msg9688 = msg("7241", dup276); + +var msg9689 = msg("7242", dup276); + +var msg9690 = msg("7243", dup276); + +var msg9691 = msg("7244", dup276); + +var msg9692 = msg("7245", dup276); + +var msg9693 = msg("7246", dup276); + +var msg9694 = msg("7247", dup276); + +var msg9695 = msg("7248", dup276); + +var msg9696 = msg("7249", dup276); + +var msg9697 = msg("7250", dup276); + +var msg9698 = msg("7251", dup276); + +var msg9699 = msg("7252", dup276); + +var msg9700 = msg("7253", dup276); + +var msg9701 = msg("7254", dup276); + +var msg9702 = msg("7255", dup276); + +var msg9703 = msg("7256", dup276); + +var msg9704 = msg("7257", dup276); + +var msg9705 = msg("7258", dup276); + +var msg9706 = msg("7259", dup276); + +var msg9707 = msg("7260", dup276); + +var msg9708 = msg("7261", dup276); + +var msg9709 = msg("7262", dup276); + +var msg9710 = msg("7263", dup276); + +var msg9711 = msg("7264", dup276); + +var msg9712 = msg("7265", dup276); + +var msg9713 = msg("7266", dup276); + +var msg9714 = msg("7267", dup276); + +var msg9715 = msg("7268", dup276); + +var msg9716 = msg("7269", dup276); + +var msg9717 = msg("7270", dup276); + +var msg9718 = msg("7271", dup276); + +var msg9719 = msg("7272", dup276); + +var msg9720 = msg("7273", dup276); + +var msg9721 = msg("7274", dup276); + +var msg9722 = msg("7275", dup276); + +var msg9723 = msg("7276", dup276); + +var msg9724 = msg("7277", dup276); + +var msg9725 = msg("7278", dup276); + +var msg9726 = msg("7279", dup276); + +var msg9727 = msg("7280", dup276); + +var msg9728 = msg("7281", dup276); + +var msg9729 = msg("7282", dup276); + +var msg9730 = msg("7283", dup276); + +var msg9731 = msg("7284", dup276); + +var msg9732 = msg("7285", dup276); + +var msg9733 = msg("7286", dup276); + +var msg9734 = msg("7287", dup276); + +var msg9735 = msg("7288", dup276); + +var msg9736 = msg("7289", dup276); + +var msg9737 = msg("7290", dup276); + +var msg9738 = msg("7291", dup276); + +var msg9739 = msg("7292", dup276); + +var msg9740 = msg("7293", dup276); + +var msg9741 = msg("7294", dup276); + +var msg9742 = msg("7295", dup276); + +var msg9743 = msg("7296", dup276); + +var msg9744 = msg("7297", dup276); + +var msg9745 = msg("7298", dup276); + +var msg9746 = msg("7299", dup276); + +var msg9747 = msg("7300", dup276); + +var msg9748 = msg("7301", dup276); + +var msg9749 = msg("7302", dup276); + +var msg9750 = msg("7303", dup276); + +var msg9751 = msg("7304", dup276); + +var msg9752 = msg("7305", dup276); + +var msg9753 = msg("7306", dup276); + +var msg9754 = msg("7307", dup276); + +var msg9755 = msg("7308", dup276); + +var msg9756 = msg("7309", dup276); + +var msg9757 = msg("7310", dup276); + +var msg9758 = msg("7311", dup276); + +var msg9759 = msg("7312", dup276); + +var msg9760 = msg("7313", dup276); + +var msg9761 = msg("7314", dup276); + +var msg9762 = msg("7315", dup276); + +var msg9763 = msg("7316", dup276); + +var msg9764 = msg("7317", dup276); + +var msg9765 = msg("7318", dup276); + +var msg9766 = msg("7319", dup276); + +var msg9767 = msg("7320", dup276); + +var msg9768 = msg("7321", dup276); + +var msg9769 = msg("7322", dup276); + +var msg9770 = msg("7323", dup276); + +var msg9771 = msg("7324", dup276); + +var msg9772 = msg("7325", dup276); + +var msg9773 = msg("7326", dup276); + +var msg9774 = msg("7327", dup276); + +var msg9775 = msg("7328", dup276); + +var msg9776 = msg("7329", dup276); + +var msg9777 = msg("7330", dup276); + +var msg9778 = msg("7331", dup276); + +var msg9779 = msg("7332", dup276); + +var msg9780 = msg("7333", dup276); + +var msg9781 = msg("7334", dup276); + +var msg9782 = msg("7335", dup276); + +var msg9783 = msg("7336", dup276); + +var msg9784 = msg("7337", dup276); + +var msg9785 = msg("7338", dup276); + +var msg9786 = msg("7339", dup276); + +var msg9787 = msg("7340", dup276); + +var msg9788 = msg("7341", dup276); + +var msg9789 = msg("7342", dup276); + +var msg9790 = msg("7343", dup276); + +var msg9791 = msg("7344", dup276); + +var msg9792 = msg("7345", dup276); + +var msg9793 = msg("7346", dup276); + +var msg9794 = msg("7347", dup276); + +var msg9795 = msg("7348", dup276); + +var msg9796 = msg("7349", dup276); + +var msg9797 = msg("7350", dup276); + +var msg9798 = msg("7351", dup276); + +var msg9799 = msg("7352", dup276); + +var msg9800 = msg("7353", dup276); + +var msg9801 = msg("7354", dup276); + +var msg9802 = msg("7355", dup276); + +var msg9803 = msg("7356", dup276); + +var msg9804 = msg("7357", dup276); + +var msg9805 = msg("7358", dup276); + +var msg9806 = msg("7359", dup276); + +var msg9807 = msg("7360", dup276); + +var msg9808 = msg("7361", dup276); + +var msg9809 = msg("7362", dup276); + +var msg9810 = msg("7363", dup276); + +var msg9811 = msg("7364", dup276); + +var msg9812 = msg("7365", dup276); + +var msg9813 = msg("7366", dup276); + +var msg9814 = msg("7367", dup276); + +var msg9815 = msg("7368", dup276); + +var msg9816 = msg("7369", dup276); + +var msg9817 = msg("7370", dup276); + +var msg9818 = msg("7371", dup276); + +var msg9819 = msg("7372", dup276); + +var msg9820 = msg("7373", dup276); + +var msg9821 = msg("7374", dup276); + +var msg9822 = msg("7375", dup276); + +var msg9823 = msg("7376", dup276); + +var msg9824 = msg("7377", dup276); + +var msg9825 = msg("7378", dup276); + +var msg9826 = msg("7379", dup276); + +var msg9827 = msg("7380", dup276); + +var msg9828 = msg("7381", dup276); + +var msg9829 = msg("7382", dup276); + +var msg9830 = msg("7383", dup276); + +var msg9831 = msg("7384", dup276); + +var msg9832 = msg("7385", dup276); + +var msg9833 = msg("7386", dup276); + +var msg9834 = msg("7387", dup276); + +var msg9835 = msg("7388", dup276); + +var msg9836 = msg("7389", dup276); + +var msg9837 = msg("7390", dup276); + +var msg9838 = msg("7391", dup276); + +var msg9839 = msg("7392", dup276); + +var msg9840 = msg("7393", dup276); + +var msg9841 = msg("7394", dup276); + +var msg9842 = msg("7395", dup276); + +var msg9843 = msg("7396", dup276); + +var msg9844 = msg("7397", dup276); + +var msg9845 = msg("7398", dup276); + +var msg9846 = msg("7399", dup276); + +var msg9847 = msg("7400", dup276); + +var msg9848 = msg("7401", dup276); + +var msg9849 = msg("7402", dup276); + +var msg9850 = msg("7403", dup276); + +var msg9851 = msg("7404", dup276); + +var msg9852 = msg("7405", dup276); + +var msg9853 = msg("7406", dup276); + +var msg9854 = msg("7407", dup276); + +var msg9855 = msg("7408", dup276); + +var msg9856 = msg("7409", dup276); + +var msg9857 = msg("7410", dup276); + +var msg9858 = msg("7411", dup276); + +var msg9859 = msg("7412", dup276); + +var msg9860 = msg("7413", dup276); + +var msg9861 = msg("7414", dup276); + +var msg9862 = msg("7415", dup276); + +var msg9863 = msg("7416", dup276); + +var msg9864 = msg("7417", dup276); + +var msg9865 = msg("7418", dup276); + +var msg9866 = msg("7419", dup276); + +var msg9867 = msg("7420", dup276); + +var msg9868 = msg("7421", dup196); + +var msg9869 = msg("7422", dup287); + +var msg9870 = msg("7423", dup287); + +var msg9871 = msg("7424", dup287); + +var msg9872 = msg("7425", dup265); + +var msg9873 = msg("7426", dup265); + +var msg9874 = msg("7427", dup265); + +var msg9875 = msg("7428", dup265); + +var msg9876 = msg("7429", dup265); + +var msg9877 = msg("7430", dup265); + +var msg9878 = msg("7431", dup265); + +var msg9879 = msg("7432", dup265); + +var msg9880 = msg("7433", dup265); + +var msg9881 = msg("7434", dup265); + +var msg9882 = msg("7435", dup265); + +var msg9883 = msg("7436", dup265); + +var msg9884 = msg("7437", dup265); + +var msg9885 = msg("7438", dup265); + +var msg9886 = msg("7439", dup265); + +var msg9887 = msg("7440", dup265); + +var msg9888 = msg("7441", dup265); + +var msg9889 = msg("7442", dup265); + +var msg9890 = msg("7443", dup265); + +var msg9891 = msg("7444", dup265); + +var msg9892 = msg("7445", dup265); + +var msg9893 = msg("7446", dup265); + +var msg9894 = msg("7447", dup265); + +var msg9895 = msg("7448", dup265); + +var msg9896 = msg("7449", dup265); + +var msg9897 = msg("7450", dup265); + +var msg9898 = msg("7451", dup265); + +var msg9899 = msg("7452", dup265); + +var msg9900 = msg("7453", dup265); + +var msg9901 = msg("7454", dup265); + +var msg9902 = msg("7455", dup265); + +var msg9903 = msg("7456", dup265); + +var msg9904 = msg("7457", dup265); + +var msg9905 = msg("7458", dup265); + +var msg9906 = msg("7459", dup265); + +var msg9907 = msg("7460", dup265); + +var msg9908 = msg("7461", dup265); + +var msg9909 = msg("7462", dup265); + +var msg9910 = msg("7463", dup265); + +var msg9911 = msg("7464", dup265); + +var msg9912 = msg("7465", dup265); + +var msg9913 = msg("7466", dup265); + +var msg9914 = msg("7467", dup265); + +var msg9915 = msg("7468", dup265); + +var msg9916 = msg("7469", dup265); + +var msg9917 = msg("7470", dup265); + +var msg9918 = msg("7471", dup265); + +var msg9919 = msg("7472", dup265); + +var msg9920 = msg("7473", dup265); + +var msg9921 = msg("7474", dup265); + +var msg9922 = msg("7475", dup265); + +var msg9923 = msg("7476", dup265); + +var msg9924 = msg("7477", dup265); + +var msg9925 = msg("7478", dup265); + +var msg9926 = msg("7479", dup265); + +var msg9927 = msg("7480", dup265); + +var msg9928 = msg("7481", dup265); + +var msg9929 = msg("7482", dup265); + +var msg9930 = msg("7483", dup265); + +var msg9931 = msg("7484", dup265); + +var msg9932 = msg("7485", dup265); + +var msg9933 = msg("7486", dup265); + +var msg9934 = msg("7487", dup265); + +var msg9935 = msg("7488", dup265); + +var msg9936 = msg("7489", dup265); + +var msg9937 = msg("7490", dup265); + +var msg9938 = msg("7491", dup265); + +var msg9939 = msg("7492", dup265); + +var msg9940 = msg("7493", dup265); + +var msg9941 = msg("7494", dup265); + +var msg9942 = msg("7495", dup265); + +var msg9943 = msg("7496", dup265); + +var msg9944 = msg("7497", dup265); + +var msg9945 = msg("7498", dup265); + +var msg9946 = msg("7499", dup265); + +var msg9947 = msg("7500", dup265); + +var msg9948 = msg("7501", dup265); + +var msg9949 = msg("7502", dup265); + +var msg9950 = msg("7503", dup265); + +var msg9951 = msg("7504", dup303); + +var msg9952 = msg("7505", dup303); + +var msg9953 = msg("7506", dup303); + +var msg9954 = msg("7507", dup303); + +var msg9955 = msg("7508", dup303); + +var msg9956 = msg("7509", dup303); + +var msg9957 = msg("7510", dup303); + +var msg9958 = msg("7511", dup303); + +var msg9959 = msg("7512", dup303); + +var msg9960 = msg("7513", dup303); + +var msg9961 = msg("7514", dup303); + +var msg9962 = msg("7515", dup303); + +var msg9963 = msg("7516", dup303); + +var msg9964 = msg("7517", dup303); + +var msg9965 = msg("7518", dup303); + +var msg9966 = msg("7519", dup303); + +var msg9967 = msg("7520", dup303); + +var msg9968 = msg("7521", dup303); + +var msg9969 = msg("7522", dup303); + +var msg9970 = msg("7523", dup303); + +var msg9971 = msg("7524", dup303); + +var msg9972 = msg("7525", dup303); + +var msg9973 = msg("7526", dup303); + +var msg9974 = msg("7527", dup303); + +var msg9975 = msg("7528", dup303); + +var msg9976 = msg("7529", dup303); + +var msg9977 = msg("7530", dup303); + +var msg9978 = msg("7531", dup303); + +var msg9979 = msg("7532", dup303); + +var msg9980 = msg("7533", dup303); + +var msg9981 = msg("7534", dup303); + +var msg9982 = msg("7535", dup303); + +var msg9983 = msg("7536", dup303); + +var msg9984 = msg("7537", dup303); + +var msg9985 = msg("7538", dup303); + +var msg9986 = msg("7539", dup303); + +var msg9987 = msg("7540", dup303); + +var msg9988 = msg("7541", dup303); + +var msg9989 = msg("7542", dup303); + +var msg9990 = msg("7543", dup303); + +var msg9991 = msg("7544", dup303); + +var msg9992 = msg("7545", dup303); + +var msg9993 = msg("7546", dup303); + +var msg9994 = msg("7547", dup303); + +var msg9995 = msg("7548", dup303); + +var msg9996 = msg("7549", dup303); + +var msg9997 = msg("7550", dup303); + +var msg9998 = msg("7551", dup303); + +var msg9999 = msg("7552", dup303); + +var msg10000 = msg("7553", dup303); + +var msg10001 = msg("7554", dup303); + +var msg10002 = msg("7555", dup303); + +var msg10003 = msg("7556", dup303); + +var msg10004 = msg("7557", dup303); + +var msg10005 = msg("7558", dup303); + +var msg10006 = msg("7559", dup303); + +var msg10007 = msg("7560", dup303); + +var msg10008 = msg("7561", dup303); + +var msg10009 = msg("7562", dup303); + +var msg10010 = msg("7563", dup303); + +var msg10011 = msg("7564", dup303); + +var msg10012 = msg("7565", dup303); + +var msg10013 = msg("7566", dup303); + +var msg10014 = msg("7567", dup303); + +var msg10015 = msg("7568", dup303); + +var msg10016 = msg("7569", dup303); + +var msg10017 = msg("7570", dup303); + +var msg10018 = msg("7571", dup303); + +var msg10019 = msg("7572", dup303); + +var msg10020 = msg("7573", dup303); + +var msg10021 = msg("7574", dup303); + +var msg10022 = msg("7575", dup303); + +var msg10023 = msg("7576", dup303); + +var msg10024 = msg("7577", dup303); + +var msg10025 = msg("7578", dup303); + +var msg10026 = msg("7579", dup303); + +var msg10027 = msg("7580", dup303); + +var msg10028 = msg("7581", dup303); + +var msg10029 = msg("7582", dup303); + +var msg10030 = msg("7583", dup303); + +var msg10031 = msg("7584", dup303); + +var msg10032 = msg("7585", dup303); + +var msg10033 = msg("7586", dup303); + +var msg10034 = msg("7587", dup303); + +var msg10035 = msg("7588", dup303); + +var msg10036 = msg("7589", dup303); + +var msg10037 = msg("7590", dup303); + +var msg10038 = msg("7591", dup303); + +var msg10039 = msg("7592", dup303); + +var msg10040 = msg("7593", dup303); + +var msg10041 = msg("7594", dup303); + +var msg10042 = msg("7595", dup303); + +var msg10043 = msg("7596", dup303); + +var msg10044 = msg("7597", dup303); + +var msg10045 = msg("7598", dup303); + +var msg10046 = msg("7599", dup303); + +var msg10047 = msg("7600", dup303); + +var msg10048 = msg("7601", dup303); + +var msg10049 = msg("7602", dup303); + +var msg10050 = msg("7603", dup303); + +var msg10051 = msg("7604", dup205); + +var msg10052 = msg("7605", dup205); + +var msg10053 = msg("7606", dup205); + +var msg10054 = msg("7607", dup205); + +var msg10055 = msg("7608", dup205); + +var msg10056 = msg("7609", dup205); + +var msg10057 = msg("7610", dup205); + +var msg10058 = msg("7611", dup205); + +var msg10059 = msg("7612", dup205); + +var msg10060 = msg("7613", dup205); + +var msg10061 = msg("7614", dup205); + +var msg10062 = msg("7615", dup205); + +var msg10063 = msg("7616", dup205); + +var msg10064 = msg("7617", dup205); + +var msg10065 = msg("7618", dup205); + +var msg10066 = msg("7619", dup205); + +var msg10067 = msg("7620", dup205); + +var msg10068 = msg("7621", dup205); + +var msg10069 = msg("7622", dup205); + +var msg10070 = msg("7623", dup205); + +var msg10071 = msg("7624", dup205); + +var msg10072 = msg("7625", dup205); + +var msg10073 = msg("7626", dup205); + +var msg10074 = msg("7627", dup205); + +var msg10075 = msg("7628", dup205); + +var msg10076 = msg("7629", dup205); + +var msg10077 = msg("7630", dup205); + +var msg10078 = msg("7631", dup205); + +var msg10079 = msg("7632", dup205); + +var msg10080 = msg("7633", dup205); + +var msg10081 = msg("7634", dup205); + +var msg10082 = msg("7635", dup205); + +var msg10083 = msg("7636", dup205); + +var msg10084 = msg("7637", dup205); + +var msg10085 = msg("7638", dup205); + +var msg10086 = msg("7639", dup205); + +var msg10087 = msg("7640", dup205); + +var msg10088 = msg("7641", dup205); + +var msg10089 = msg("7642", dup205); + +var msg10090 = msg("7643", dup205); + +var msg10091 = msg("7644", dup205); + +var msg10092 = msg("7645", dup205); + +var msg10093 = msg("7646", dup205); + +var msg10094 = msg("7647", dup205); + +var msg10095 = msg("7648", dup205); + +var msg10096 = msg("7649", dup205); + +var msg10097 = msg("7650", dup205); + +var msg10098 = msg("7651", dup205); + +var msg10099 = msg("7652", dup205); + +var msg10100 = msg("7653", dup205); + +var msg10101 = msg("7654", dup205); + +var msg10102 = msg("7655", dup205); + +var msg10103 = msg("7656", dup205); + +var msg10104 = msg("7657", dup205); + +var msg10105 = msg("7658", dup205); + +var msg10106 = msg("7659", dup205); + +var msg10107 = msg("7660", dup205); + +var msg10108 = msg("7661", dup205); + +var msg10109 = msg("7662", dup205); + +var msg10110 = msg("7663", dup205); + +var msg10111 = msg("7664", dup205); + +var msg10112 = msg("7665", dup205); + +var msg10113 = msg("7666", dup205); + +var msg10114 = msg("7667", dup205); + +var msg10115 = msg("7668", dup205); + +var msg10116 = msg("7669", dup205); + +var msg10117 = msg("7670", dup205); + +var msg10118 = msg("7671", dup205); + +var msg10119 = msg("7672", dup205); + +var msg10120 = msg("7673", dup205); + +var msg10121 = msg("7674", dup205); + +var msg10122 = msg("7675", dup205); + +var msg10123 = msg("7676", dup205); + +var msg10124 = msg("7677", dup205); + +var msg10125 = msg("7678", dup205); + +var msg10126 = msg("7679", dup205); + +var msg10127 = msg("7680", dup205); + +var msg10128 = msg("7681", dup205); + +var msg10129 = msg("7682", dup205); + +var msg10130 = msg("7683", dup205); + +var msg10131 = msg("7684", dup205); + +var msg10132 = msg("7685", dup205); + +var msg10133 = msg("7686", dup205); + +var msg10134 = msg("7687", dup205); + +var msg10135 = msg("7688", dup205); + +var msg10136 = msg("7689", dup205); + +var msg10137 = msg("7690", dup205); + +var msg10138 = msg("7691", dup205); + +var msg10139 = msg("7692", dup205); + +var msg10140 = msg("7693", dup205); + +var msg10141 = msg("7694", dup205); + +var msg10142 = msg("7695", dup205); + +var msg10143 = msg("7696", dup205); + +var msg10144 = msg("7697", dup205); + +var msg10145 = msg("7698", dup205); + +var msg10146 = msg("7699", dup205); + +var msg10147 = msg("7700", dup205); + +var msg10148 = msg("7701", dup205); + +var msg10149 = msg("7702", dup205); + +var msg10150 = msg("7703", dup205); + +var msg10151 = msg("7704", dup205); + +var msg10152 = msg("7705", dup205); + +var msg10153 = msg("7706", dup205); + +var msg10154 = msg("7707", dup205); + +var msg10155 = msg("7708", dup205); + +var msg10156 = msg("7709", dup205); + +var msg10157 = msg("7710", dup205); + +var msg10158 = msg("7711", dup205); + +var msg10159 = msg("7712", dup205); + +var msg10160 = msg("7713", dup205); + +var msg10161 = msg("7714", dup205); + +var msg10162 = msg("7715", dup205); + +var msg10163 = msg("7716", dup205); + +var msg10164 = msg("7717", dup205); + +var msg10165 = msg("7718", dup205); + +var msg10166 = msg("7719", dup205); + +var msg10167 = msg("7720", dup205); + +var msg10168 = msg("7721", dup205); + +var msg10169 = msg("7722", dup205); + +var msg10170 = msg("7723", dup205); + +var msg10171 = msg("7724", dup205); + +var msg10172 = msg("7725", dup205); + +var msg10173 = msg("7726", dup205); + +var msg10174 = msg("7727", dup205); + +var msg10175 = msg("7728", dup205); + +var msg10176 = msg("7729", dup205); + +var msg10177 = msg("7730", dup205); + +var msg10178 = msg("7731", dup205); + +var msg10179 = msg("7732", dup205); + +var msg10180 = msg("7733", dup205); + +var msg10181 = msg("7734", dup205); + +var msg10182 = msg("7735", dup205); + +var msg10183 = msg("7736", dup205); + +var msg10184 = msg("7737", dup205); + +var msg10185 = msg("7738", dup205); + +var msg10186 = msg("7739", dup205); + +var msg10187 = msg("7740", dup205); + +var msg10188 = msg("7741", dup205); + +var msg10189 = msg("7742", dup205); + +var msg10190 = msg("7743", dup205); + +var msg10191 = msg("7744", dup205); + +var msg10192 = msg("7745", dup205); + +var msg10193 = msg("7746", dup205); + +var msg10194 = msg("7747", dup205); + +var msg10195 = msg("7748", dup205); + +var msg10196 = msg("7749", dup205); + +var msg10197 = msg("7750", dup205); + +var msg10198 = msg("7751", dup205); + +var msg10199 = msg("7752", dup205); + +var msg10200 = msg("7753", dup205); + +var msg10201 = msg("7754", dup205); + +var msg10202 = msg("7755", dup205); + +var msg10203 = msg("7756", dup205); + +var msg10204 = msg("7757", dup205); + +var msg10205 = msg("7758", dup205); + +var msg10206 = msg("7759", dup205); + +var msg10207 = msg("7760", dup205); + +var msg10208 = msg("7761", dup205); + +var msg10209 = msg("7762", dup205); + +var msg10210 = msg("7763", dup205); + +var msg10211 = msg("7764", dup205); + +var msg10212 = msg("7765", dup205); + +var msg10213 = msg("7766", dup205); + +var msg10214 = msg("7767", dup205); + +var msg10215 = msg("7768", dup205); + +var msg10216 = msg("7769", dup205); + +var msg10217 = msg("7770", dup205); + +var msg10218 = msg("7771", dup205); + +var msg10219 = msg("7772", dup205); + +var msg10220 = msg("7773", dup205); + +var msg10221 = msg("7774", dup205); + +var msg10222 = msg("7775", dup205); + +var msg10223 = msg("7776", dup205); + +var msg10224 = msg("7777", dup205); + +var msg10225 = msg("7778", dup205); + +var msg10226 = msg("7779", dup205); + +var msg10227 = msg("7780", dup205); + +var msg10228 = msg("7781", dup205); + +var msg10229 = msg("7782", dup205); + +var msg10230 = msg("7783", dup205); + +var msg10231 = msg("7784", dup205); + +var msg10232 = msg("7785", dup205); + +var msg10233 = msg("7786", dup205); + +var msg10234 = msg("7787", dup205); + +var msg10235 = msg("7788", dup205); + +var msg10236 = msg("7789", dup205); + +var msg10237 = msg("7790", dup205); + +var msg10238 = msg("7791", dup205); + +var msg10239 = msg("7792", dup205); + +var msg10240 = msg("7793", dup205); + +var msg10241 = msg("7794", dup205); + +var msg10242 = msg("7795", dup205); + +var msg10243 = msg("7796", dup205); + +var msg10244 = msg("7797", dup205); + +var msg10245 = msg("7798", dup205); + +var msg10246 = msg("7799", dup205); + +var msg10247 = msg("7800", dup205); + +var msg10248 = msg("7801", dup205); + +var msg10249 = msg("7802", dup205); + +var msg10250 = msg("7803", dup205); + +var msg10251 = msg("7804", dup205); + +var msg10252 = msg("7805", dup205); + +var msg10253 = msg("7806", dup205); + +var msg10254 = msg("7807", dup205); + +var msg10255 = msg("7808", dup205); + +var msg10256 = msg("7809", dup205); + +var msg10257 = msg("7810", dup205); + +var msg10258 = msg("7811", dup205); + +var msg10259 = msg("7812", dup205); + +var msg10260 = msg("7813", dup205); + +var msg10261 = msg("7814", dup205); + +var msg10262 = msg("7815", dup205); + +var msg10263 = msg("7816", dup205); + +var msg10264 = msg("7817", dup205); + +var msg10265 = msg("7818", dup205); + +var msg10266 = msg("7819", dup205); + +var msg10267 = msg("7820", dup205); + +var msg10268 = msg("7821", dup205); + +var msg10269 = msg("7822", dup205); + +var msg10270 = msg("7823", dup303); + +var msg10271 = msg("7824", dup303); + +var msg10272 = msg("7825", dup303); + +var msg10273 = msg("7826", dup303); + +var msg10274 = msg("7827", dup303); + +var msg10275 = msg("7828", dup303); + +var msg10276 = msg("7829", dup303); + +var msg10277 = msg("7830", dup303); + +var msg10278 = msg("7831", dup303); + +var msg10279 = msg("7832", dup303); + +var msg10280 = msg("7833", dup303); + +var msg10281 = msg("7834", dup303); + +var msg10282 = msg("7835", dup303); + +var msg10283 = msg("7836", dup303); + +var msg10284 = msg("7837", dup303); + +var msg10285 = msg("7838", dup303); + +var msg10286 = msg("7839", dup303); + +var msg10287 = msg("7840", dup303); + +var msg10288 = msg("7841", dup303); + +var msg10289 = msg("7842", dup303); + +var msg10290 = msg("7843", dup303); + +var msg10291 = msg("7844", dup303); + +var msg10292 = msg("7845", dup303); + +var msg10293 = msg("7846", dup303); + +var msg10294 = msg("7847", dup303); + +var msg10295 = msg("7848", dup303); + +var msg10296 = msg("7849", dup303); + +var msg10297 = msg("7850", dup303); + +var msg10298 = msg("7851", dup303); + +var msg10299 = msg("7852", dup303); + +var msg10300 = msg("7853", dup303); + +var msg10301 = msg("7854", dup303); + +var msg10302 = msg("7855", dup303); + +var msg10303 = msg("7856", dup303); + +var msg10304 = msg("7857", dup303); + +var msg10305 = msg("7858", dup196); + +var msg10306 = msg("7859", dup196); + +var msg10307 = msg("7860", dup196); + +var msg10308 = msg("7861", dup196); + +var msg10309 = msg("7862", dup265); + +var msg10310 = msg("7863", dup265); + +var msg10311 = msg("7864", dup265); + +var msg10312 = msg("7865", dup265); + +var msg10313 = msg("7866", dup265); + +var msg10314 = msg("7867", dup265); + +var msg10315 = msg("7868", dup265); + +var msg10316 = msg("7869", dup265); + +var msg10317 = msg("7870", dup265); + +var msg10318 = msg("7871", dup265); + +var msg10319 = msg("7872", dup265); + +var msg10320 = msg("7873", dup265); + +var msg10321 = msg("7874", dup265); + +var msg10322 = msg("7875", dup265); + +var msg10323 = msg("7876", dup265); + +var msg10324 = msg("7877", dup265); + +var msg10325 = msg("7878", dup265); + +var msg10326 = msg("7879", dup265); + +var msg10327 = msg("7880", dup265); + +var msg10328 = msg("7881", dup265); + +var msg10329 = msg("7882", dup265); + +var msg10330 = msg("7883", dup265); + +var msg10331 = msg("7884", dup265); + +var msg10332 = msg("7885", dup265); + +var msg10333 = msg("7886", dup265); + +var msg10334 = msg("7887", dup265); + +var msg10335 = msg("7888", dup265); + +var msg10336 = msg("7889", dup265); + +var msg10337 = msg("7890", dup265); + +var msg10338 = msg("7891", dup265); + +var msg10339 = msg("7892", dup265); + +var msg10340 = msg("7893", dup265); + +var msg10341 = msg("7894", dup265); + +var msg10342 = msg("7895", dup265); + +var msg10343 = msg("7896", dup265); + +var msg10344 = msg("7897", dup265); + +var msg10345 = msg("7898", dup265); + +var msg10346 = msg("7899", dup265); + +var msg10347 = msg("7900", dup265); + +var msg10348 = msg("7901", dup265); + +var msg10349 = msg("7902", dup265); + +var msg10350 = msg("7903", dup265); + +var msg10351 = msg("7904", dup265); + +var msg10352 = msg("7905", dup265); + +var msg10353 = msg("7906", dup265); + +var msg10354 = msg("7907", dup265); + +var msg10355 = msg("7908", dup265); + +var msg10356 = msg("7909", dup265); + +var msg10357 = msg("7910", dup265); + +var msg10358 = msg("7911", dup265); + +var msg10359 = msg("7912", dup265); + +var msg10360 = msg("7913", dup265); + +var msg10361 = msg("7914", dup265); + +var msg10362 = msg("7915", dup265); + +var msg10363 = msg("7916", dup265); + +var msg10364 = msg("7917", dup265); + +var msg10365 = msg("7918", dup265); + +var msg10366 = msg("7919", dup265); + +var msg10367 = msg("7920", dup265); + +var msg10368 = msg("7921", dup265); + +var msg10369 = msg("7922", dup265); + +var msg10370 = msg("7923", dup265); + +var msg10371 = msg("7924", dup265); + +var msg10372 = msg("7925", dup265); + +var msg10373 = msg("7926", dup265); + +var msg10374 = msg("7927", dup265); + +var msg10375 = msg("7928", dup265); + +var msg10376 = msg("7929", dup265); + +var msg10377 = msg("7930", dup265); + +var msg10378 = msg("7931", dup265); + +var msg10379 = msg("7932", dup265); + +var msg10380 = msg("7933", dup265); + +var msg10381 = msg("7934", dup265); + +var msg10382 = msg("7935", dup265); + +var msg10383 = msg("7936", dup265); + +var msg10384 = msg("7937", dup265); + +var msg10385 = msg("7938", dup265); + +var msg10386 = msg("7939", dup265); + +var msg10387 = msg("7940", dup265); + +var msg10388 = msg("7941", dup265); + +var msg10389 = msg("7942", dup265); + +var msg10390 = msg("7943", dup265); + +var msg10391 = msg("7944", dup265); + +var msg10392 = msg("7945", dup265); + +var msg10393 = msg("7946", dup265); + +var msg10394 = msg("7947", dup265); + +var msg10395 = msg("7948", dup265); + +var msg10396 = msg("7949", dup265); + +var msg10397 = msg("7950", dup265); + +var msg10398 = msg("7951", dup265); + +var msg10399 = msg("7952", dup265); + +var msg10400 = msg("7953", dup265); + +var msg10401 = msg("7954", dup265); + +var msg10402 = msg("7955", dup265); + +var msg10403 = msg("7956", dup265); + +var msg10404 = msg("7957", dup265); + +var msg10405 = msg("7958", dup265); + +var msg10406 = msg("7959", dup265); + +var msg10407 = msg("7960", dup265); + +var msg10408 = msg("7961", dup265); + +var msg10409 = msg("7962", dup265); + +var msg10410 = msg("7963", dup265); + +var msg10411 = msg("7964", dup265); + +var msg10412 = msg("7965", dup265); + +var msg10413 = msg("7966", dup265); + +var msg10414 = msg("7967", dup265); + +var msg10415 = msg("7968", dup265); + +var msg10416 = msg("7969", dup265); + +var msg10417 = msg("7970", dup265); + +var msg10418 = msg("7971", dup265); + +var msg10419 = msg("7972", dup265); + +var msg10420 = msg("7973", dup265); + +var msg10421 = msg("7974", dup265); + +var msg10422 = msg("7975", dup265); + +var msg10423 = msg("7976", dup265); + +var msg10424 = msg("7977", dup265); + +var msg10425 = msg("7978", dup265); + +var msg10426 = msg("7979", dup265); + +var msg10427 = msg("7980", dup265); + +var msg10428 = msg("7981", dup265); + +var msg10429 = msg("7982", dup265); + +var msg10430 = msg("7983", dup265); + +var msg10431 = msg("7984", dup265); + +var msg10432 = msg("7985", dup265); + +var msg10433 = msg("7986", dup265); + +var msg10434 = msg("7987", dup265); + +var msg10435 = msg("7988", dup265); + +var msg10436 = msg("7989", dup265); + +var msg10437 = msg("7990", dup265); + +var msg10438 = msg("7991", dup265); + +var msg10439 = msg("7992", dup265); + +var msg10440 = msg("7993", dup265); + +var msg10441 = msg("7994", dup265); + +var msg10442 = msg("7995", dup265); + +var msg10443 = msg("7996", dup265); + +var msg10444 = msg("7997", dup265); + +var msg10445 = msg("7998", dup265); + +var msg10446 = msg("7999", dup265); + +var msg10447 = msg("8000", dup265); + +var msg10448 = msg("8001", dup265); + +var msg10449 = msg("8002", dup265); + +var msg10450 = msg("8003", dup265); + +var msg10451 = msg("8004", dup265); + +var msg10452 = msg("8005", dup265); + +var msg10453 = msg("8006", dup265); + +var msg10454 = msg("8007", dup265); + +var msg10455 = msg("8008", dup265); + +var msg10456 = msg("8009", dup265); + +var msg10457 = msg("8010", dup265); + +var msg10458 = msg("8011", dup265); + +var msg10459 = msg("8012", dup265); + +var msg10460 = msg("8013", dup265); + +var msg10461 = msg("8014", dup265); + +var msg10462 = msg("8015", dup265); + +var msg10463 = msg("8016", dup265); + +var msg10464 = msg("8017", dup265); + +var msg10465 = msg("8018", dup265); + +var msg10466 = msg("8019", dup265); + +var msg10467 = msg("8020", dup265); + +var msg10468 = msg("8021", dup265); + +var msg10469 = msg("8022", dup265); + +var msg10470 = msg("8023", dup265); + +var msg10471 = msg("8024", dup265); + +var msg10472 = msg("8025", dup265); + +var msg10473 = msg("8026", dup265); + +var msg10474 = msg("8027", dup265); + +var msg10475 = msg("8028", dup265); + +var msg10476 = msg("8029", dup265); + +var msg10477 = msg("8030", dup265); + +var msg10478 = msg("8031", dup265); + +var msg10479 = msg("8032", dup265); + +var msg10480 = msg("8033", dup265); + +var msg10481 = msg("8034", dup265); + +var msg10482 = msg("8035", dup265); + +var msg10483 = msg("8036", dup265); + +var msg10484 = msg("8037", dup265); + +var msg10485 = msg("8038", dup265); + +var msg10486 = msg("8039", dup265); + +var msg10487 = msg("8040", dup265); + +var msg10488 = msg("8041", dup265); + +var msg10489 = msg("8042", dup265); + +var msg10490 = msg("8043", dup265); + +var msg10491 = msg("8044", dup265); + +var msg10492 = msg("8045", dup265); + +var msg10493 = msg("8046", dup265); + +var msg10494 = msg("8047", dup265); + +var msg10495 = msg("8048", dup265); + +var msg10496 = msg("8049", dup265); + +var msg10497 = msg("8050", dup265); + +var msg10498 = msg("8051", dup265); + +var msg10499 = msg("8052", dup265); + +var msg10500 = msg("8053", dup265); + +var msg10501 = msg("8054", dup265); + +var msg10502 = msg("8055", dup265); + +var msg10503 = msg("8056", dup198); + +var msg10504 = msg("8057", dup198); + +var msg10505 = msg("8058", dup265); + +var msg10506 = msg("8059", dup260); + +var msg10507 = msg("8060", dup197); + +var msg10508 = msg("8061", dup265); + +var msg10509 = msg("8062", dup265); + +var msg10510 = msg("8063", dup265); + +var msg10511 = msg("8064", dup265); + +var msg10512 = msg("8065", dup265); + +var msg10513 = msg("8066", dup265); + +var msg10514 = msg("8067", dup265); + +var msg10515 = msg("8068", dup265); + +var msg10516 = msg("8069", dup265); + +var msg10517 = msg("8070", dup265); + +var msg10518 = msg("8071", dup303); + +var msg10519 = msg("8072", dup303); + +var msg10520 = msg("8073", dup303); + +var msg10521 = msg("8074", dup205); + +var msg10522 = msg("8075", dup205); + +var msg10523 = msg("8076", dup205); + +var msg10524 = msg("8077", dup205); + +var msg10525 = msg("8078", dup205); + +var msg10526 = msg("8079", dup205); + +var msg10527 = msg("8080", dup205); + +var msg10528 = msg("8081", dup194); + +var msg10529 = msg("8082", dup196); + +var msg10530 = msg("8083", dup197); + +var msg10531 = msg("8084", dup265); + +var msg10532 = msg("8085", dup267); + +var msg10533 = msg("8086", dup267); + +var msg10534 = msg("8087", dup201); + +var msg10535 = msg("8088", dup267); + +var msg10536 = msg("8089", dup267); + +var msg10537 = msg("8090", dup201); + +var msg10538 = msg("8091", dup267); + +var msg10539 = msg("8092", dup198); + +var msg10540 = msg("8093", dup276); + +var msg10541 = msg("8094", dup276); + +var msg10542 = msg("8095", dup276); + +var msg10543 = msg("8096", dup276); + +var msg10544 = msg("8097", dup276); + +var msg10545 = msg("8098", dup276); + +var msg10546 = msg("8099", dup276); + +var msg10547 = msg("8100", dup276); + +var msg10548 = msg("8101", dup276); + +var msg10549 = msg("8102", dup276); + +var msg10550 = msg("8103", dup276); + +var msg10551 = msg("8104", dup276); + +var msg10552 = msg("8105", dup276); + +var msg10553 = msg("8106", dup276); + +var msg10554 = msg("8107", dup276); + +var msg10555 = msg("8108", dup276); + +var msg10556 = msg("8109", dup276); + +var msg10557 = msg("8110", dup276); + +var msg10558 = msg("8111", dup276); + +var msg10559 = msg("8112", dup276); + +var msg10560 = msg("8113", dup276); + +var msg10561 = msg("8114", dup276); + +var msg10562 = msg("8115", dup276); + +var msg10563 = msg("8116", dup276); + +var msg10564 = msg("8117", dup276); + +var msg10565 = msg("8118", dup276); + +var msg10566 = msg("8119", dup276); + +var msg10567 = msg("8120", dup276); + +var msg10568 = msg("8121", dup276); + +var msg10569 = msg("8122", dup276); + +var msg10570 = msg("8123", dup276); + +var msg10571 = msg("8124", dup276); + +var msg10572 = msg("8125", dup276); + +var msg10573 = msg("8126", dup276); + +var msg10574 = msg("8127", dup276); + +var msg10575 = msg("8128", dup276); + +var msg10576 = msg("8129", dup276); + +var msg10577 = msg("8130", dup276); + +var msg10578 = msg("8131", dup276); + +var msg10579 = msg("8132", dup276); + +var msg10580 = msg("8133", dup276); + +var msg10581 = msg("8134", dup276); + +var msg10582 = msg("8135", dup276); + +var msg10583 = msg("8136", dup276); + +var msg10584 = msg("8137", dup276); + +var msg10585 = msg("8138", dup276); + +var msg10586 = msg("8139", dup276); + +var msg10587 = msg("8140", dup276); + +var msg10588 = msg("8141", dup276); + +var msg10589 = msg("8142", dup276); + +var msg10590 = msg("8143", dup276); + +var msg10591 = msg("8144", dup276); + +var msg10592 = msg("8145", dup276); + +var msg10593 = msg("8146", dup276); + +var msg10594 = msg("8147", dup276); + +var msg10595 = msg("8148", dup276); + +var msg10596 = msg("8149", dup276); + +var msg10597 = msg("8150", dup276); + +var msg10598 = msg("8151", dup276); + +var msg10599 = msg("8152", dup276); + +var msg10600 = msg("8153", dup276); + +var msg10601 = msg("8154", dup276); + +var msg10602 = msg("8155", dup276); + +var msg10603 = msg("8156", dup276); + +var msg10604 = msg("8157", dup276); + +var msg10605 = msg("8158", dup276); + +var msg10606 = msg("8159", dup276); + +var msg10607 = msg("8160", dup276); + +var msg10608 = msg("8161", dup276); + +var msg10609 = msg("8162", dup276); + +var msg10610 = msg("8163", dup276); + +var msg10611 = msg("8164", dup276); + +var msg10612 = msg("8165", dup276); + +var msg10613 = msg("8166", dup276); + +var msg10614 = msg("8167", dup276); + +var msg10615 = msg("8168", dup276); + +var msg10616 = msg("8169", dup276); + +var msg10617 = msg("8170", dup276); + +var msg10618 = msg("8171", dup276); + +var msg10619 = msg("8172", dup276); + +var msg10620 = msg("8173", dup276); + +var msg10621 = msg("8174", dup276); + +var msg10622 = msg("8175", dup276); + +var msg10623 = msg("8176", dup276); + +var msg10624 = msg("8177", dup276); + +var msg10625 = msg("8178", dup276); + +var msg10626 = msg("8179", dup276); + +var msg10627 = msg("8180", dup276); + +var msg10628 = msg("8181", dup276); + +var msg10629 = msg("8182", dup276); + +var msg10630 = msg("8183", dup276); + +var msg10631 = msg("8184", dup276); + +var msg10632 = msg("8185", dup276); + +var msg10633 = msg("8186", dup276); + +var msg10634 = msg("8187", dup276); + +var msg10635 = msg("8188", dup276); + +var msg10636 = msg("8189", dup276); + +var msg10637 = msg("8190", dup276); + +var msg10638 = msg("8191", dup276); + +var msg10639 = msg("8192", dup276); + +var msg10640 = msg("8193", dup276); + +var msg10641 = msg("8194", dup276); + +var msg10642 = msg("8195", dup276); + +var msg10643 = msg("8196", dup276); + +var msg10644 = msg("8197", dup276); + +var msg10645 = msg("8198", dup276); + +var msg10646 = msg("8199", dup276); + +var msg10647 = msg("8200", dup276); + +var msg10648 = msg("8201", dup276); + +var msg10649 = msg("8202", dup276); + +var msg10650 = msg("8203", dup276); + +var msg10651 = msg("8204", dup276); + +var msg10652 = msg("8205", dup276); + +var msg10653 = msg("8206", dup276); + +var msg10654 = msg("8207", dup276); + +var msg10655 = msg("8208", dup276); + +var msg10656 = msg("8209", dup276); + +var msg10657 = msg("8210", dup276); + +var msg10658 = msg("8211", dup276); + +var msg10659 = msg("8212", dup276); + +var msg10660 = msg("8213", dup276); + +var msg10661 = msg("8214", dup276); + +var msg10662 = msg("8215", dup276); + +var msg10663 = msg("8216", dup276); + +var msg10664 = msg("8217", dup276); + +var msg10665 = msg("8218", dup276); + +var msg10666 = msg("8219", dup276); + +var msg10667 = msg("8220", dup276); + +var msg10668 = msg("8221", dup276); + +var msg10669 = msg("8222", dup276); + +var msg10670 = msg("8223", dup276); + +var msg10671 = msg("8224", dup276); + +var msg10672 = msg("8225", dup276); + +var msg10673 = msg("8226", dup276); + +var msg10674 = msg("8227", dup276); + +var msg10675 = msg("8228", dup276); + +var msg10676 = msg("8229", dup276); + +var msg10677 = msg("8230", dup276); + +var msg10678 = msg("8231", dup276); + +var msg10679 = msg("8232", dup276); + +var msg10680 = msg("8233", dup276); + +var msg10681 = msg("8234", dup276); + +var msg10682 = msg("8235", dup276); + +var msg10683 = msg("8236", dup276); + +var msg10684 = msg("8237", dup276); + +var msg10685 = msg("8238", dup276); + +var msg10686 = msg("8239", dup276); + +var msg10687 = msg("8240", dup276); + +var msg10688 = msg("8241", dup276); + +var msg10689 = msg("8242", dup276); + +var msg10690 = msg("8243", dup276); + +var msg10691 = msg("8244", dup276); + +var msg10692 = msg("8245", dup276); + +var msg10693 = msg("8246", dup276); + +var msg10694 = msg("8247", dup276); + +var msg10695 = msg("8248", dup276); + +var msg10696 = msg("8249", dup276); + +var msg10697 = msg("8250", dup276); + +var msg10698 = msg("8251", dup276); + +var msg10699 = msg("8252", dup276); + +var msg10700 = msg("8253", dup276); + +var msg10701 = msg("8254", dup276); + +var msg10702 = msg("8255", dup276); + +var msg10703 = msg("8256", dup276); + +var msg10704 = msg("8257", dup276); + +var msg10705 = msg("8258", dup276); + +var msg10706 = msg("8259", dup276); + +var msg10707 = msg("8260", dup276); + +var msg10708 = msg("8261", dup276); + +var msg10709 = msg("8262", dup276); + +var msg10710 = msg("8263", dup276); + +var msg10711 = msg("8264", dup276); + +var msg10712 = msg("8265", dup276); + +var msg10713 = msg("8266", dup276); + +var msg10714 = msg("8267", dup276); + +var msg10715 = msg("8268", dup276); + +var msg10716 = msg("8269", dup276); + +var msg10717 = msg("8270", dup276); + +var msg10718 = msg("8271", dup276); + +var msg10719 = msg("8272", dup276); + +var msg10720 = msg("8273", dup276); + +var msg10721 = msg("8274", dup276); + +var msg10722 = msg("8275", dup276); + +var msg10723 = msg("8276", dup276); + +var msg10724 = msg("8277", dup276); + +var msg10725 = msg("8278", dup276); + +var msg10726 = msg("8279", dup276); + +var msg10727 = msg("8280", dup276); + +var msg10728 = msg("8281", dup276); + +var msg10729 = msg("8282", dup276); + +var msg10730 = msg("8283", dup276); + +var msg10731 = msg("8284", dup276); + +var msg10732 = msg("8285", dup276); + +var msg10733 = msg("8286", dup276); + +var msg10734 = msg("8287", dup276); + +var msg10735 = msg("8288", dup276); + +var msg10736 = msg("8289", dup276); + +var msg10737 = msg("8290", dup276); + +var msg10738 = msg("8291", dup276); + +var msg10739 = msg("8292", dup276); + +var msg10740 = msg("8293", dup276); + +var msg10741 = msg("8294", dup276); + +var msg10742 = msg("8295", dup276); + +var msg10743 = msg("8296", dup276); + +var msg10744 = msg("8297", dup276); + +var msg10745 = msg("8298", dup276); + +var msg10746 = msg("8299", dup276); + +var msg10747 = msg("8300", dup276); + +var msg10748 = msg("8301", dup276); + +var msg10749 = msg("8302", dup276); + +var msg10750 = msg("8303", dup276); + +var msg10751 = msg("8304", dup276); + +var msg10752 = msg("8305", dup276); + +var msg10753 = msg("8306", dup276); + +var msg10754 = msg("8307", dup276); + +var msg10755 = msg("8308", dup276); + +var msg10756 = msg("8309", dup276); + +var msg10757 = msg("8310", dup276); + +var msg10758 = msg("8311", dup276); + +var msg10759 = msg("8312", dup276); + +var msg10760 = msg("8313", dup276); + +var msg10761 = msg("8314", dup276); + +var msg10762 = msg("8315", dup276); + +var msg10763 = msg("8316", dup276); + +var msg10764 = msg("8317", dup276); + +var msg10765 = msg("8318", dup276); + +var msg10766 = msg("8319", dup276); + +var msg10767 = msg("8320", dup276); + +var msg10768 = msg("8321", dup276); + +var msg10769 = msg("8322", dup276); + +var msg10770 = msg("8323", dup276); + +var msg10771 = msg("8324", dup276); + +var msg10772 = msg("8325", dup276); + +var msg10773 = msg("8326", dup276); + +var msg10774 = msg("8327", dup276); + +var msg10775 = msg("8328", dup276); + +var msg10776 = msg("8329", dup276); + +var msg10777 = msg("8330", dup276); + +var msg10778 = msg("8331", dup276); + +var msg10779 = msg("8332", dup276); + +var msg10780 = msg("8333", dup276); + +var msg10781 = msg("8334", dup276); + +var msg10782 = msg("8335", dup276); + +var msg10783 = msg("8336", dup276); + +var msg10784 = msg("8337", dup276); + +var msg10785 = msg("8338", dup276); + +var msg10786 = msg("8339", dup276); + +var msg10787 = msg("8340", dup276); + +var msg10788 = msg("8341", dup276); + +var msg10789 = msg("8342", dup276); + +var msg10790 = msg("8343", dup276); + +var msg10791 = msg("8344", dup276); + +var msg10792 = msg("8345", dup276); + +var msg10793 = msg("8346", dup276); + +var msg10794 = msg("8347", dup276); + +var msg10795 = msg("8348", dup276); + +var msg10796 = msg("8349", dup265); + +var msg10797 = msg("8350", dup196); + +var msg10798 = msg("8351", dup222); + +var msg10799 = msg("8352", dup303); + +var msg10800 = msg("8353", dup303); + +var msg10801 = msg("8354", dup303); + +var msg10802 = msg("8355", dup303); + +var msg10803 = msg("8356", dup303); + +var msg10804 = msg("8357", dup303); + +var msg10805 = msg("8358", dup303); + +var msg10806 = msg("8359", dup303); + +var msg10807 = msg("8360", dup303); + +var msg10808 = msg("8361", dup205); + +var msg10809 = msg("8362", dup205); + +var msg10810 = msg("8363", dup265); + +var msg10811 = msg("8364", dup265); + +var msg10812 = msg("8365", dup265); + +var msg10813 = msg("8366", dup265); + +var msg10814 = msg("8367", dup265); + +var msg10815 = msg("8368", dup265); + +var msg10816 = msg("8369", dup265); + +var msg10817 = msg("8370", dup265); + +var msg10818 = msg("8371", dup265); + +var msg10819 = msg("8372", dup265); + +var msg10820 = msg("8373", dup265); + +var msg10821 = msg("8374", dup265); + +var msg10822 = msg("8375", dup265); + +var msg10823 = msg("8376", dup265); + +var msg10824 = msg("8377", dup265); + +var msg10825 = msg("8378", dup265); + +var msg10826 = msg("8379", dup265); + +var msg10827 = msg("8380", dup265); + +var msg10828 = msg("8381", dup265); + +var msg10829 = msg("8382", dup265); + +var msg10830 = msg("8383", dup265); + +var msg10831 = msg("8384", dup265); + +var msg10832 = msg("8385", dup265); + +var msg10833 = msg("8386", dup265); + +var msg10834 = msg("8387", dup265); + +var msg10835 = msg("8388", dup265); + +var msg10836 = msg("8389", dup265); + +var msg10837 = msg("8390", dup265); + +var msg10838 = msg("8391", dup265); + +var msg10839 = msg("8392", dup265); + +var msg10840 = msg("8393", dup265); + +var msg10841 = msg("8394", dup265); + +var msg10842 = msg("8395", dup265); + +var msg10843 = msg("8396", dup265); + +var msg10844 = msg("8397", dup265); + +var msg10845 = msg("8398", dup265); + +var msg10846 = msg("8399", dup265); + +var msg10847 = msg("8400", dup265); + +var msg10848 = msg("8401", dup265); + +var msg10849 = msg("8402", dup265); + +var msg10850 = msg("8403", dup265); + +var msg10851 = msg("8404", dup265); + +var msg10852 = msg("8405", dup265); + +var msg10853 = msg("8406", dup265); + +var msg10854 = msg("8407", dup267); + +var msg10855 = msg("8408", dup267); + +var msg10856 = msg("8409", dup265); + +var msg10857 = msg("8410", dup265); + +var msg10858 = msg("8411", dup265); + +var msg10859 = msg("8412", dup265); + +var msg10860 = msg("8413", dup265); + +var msg10861 = msg("8414", dup201); + +var msg10862 = msg("8415", dup222); + +var msg10863 = msg("8416", dup267); + +var msg10864 = msg("8417", dup265); + +var msg10865 = msg("8418", dup265); + +var msg10866 = msg("8419", dup265); + +var msg10867 = msg("8420", dup265); + +var msg10868 = msg("8421", dup265); + +var msg10869 = msg("8422", dup265); + +var msg10870 = msg("8423", dup265); + +var msg10871 = msg("8424", dup265); + +var msg10872 = msg("8425", dup265); + +var msg10873 = msg("8426", dup201); + +var msg10874 = msg("8427", dup201); + +var msg10875 = msg("8428", dup201); + +var msg10876 = msg("8429", dup201); + +var msg10877 = msg("8430", dup201); + +var msg10878 = msg("8431", dup201); + +var msg10879 = msg("8432", dup201); + +var msg10880 = msg("8433", dup201); + +var msg10881 = msg("8434", dup201); + +var msg10882 = msg("8435", dup201); + +var msg10883 = msg("8436", dup201); + +var msg10884 = msg("8437", dup201); + +var msg10885 = msg("8438", dup201); + +var msg10886 = msg("8439", dup201); + +var msg10887 = msg("8440", dup201); + +var msg10888 = msg("8441", dup267); + +var msg10889 = msg("8442", dup250); + +var msg10890 = msg("8443", dup265); + +var msg10891 = msg("8444", dup265); + +var msg10892 = msg("8445", dup265); + +var msg10893 = msg("8446", dup196); + +var msg10894 = msg("8447", dup265); + +var msg10895 = msg("8448", dup267); + +var msg10896 = msg("8449", dup276); + +var msg10897 = msg("8450", dup276); + +var msg10898 = msg("8451", dup276); + +var msg10899 = msg("8452", dup276); + +var msg10900 = msg("8453", dup276); + +var msg10901 = msg("8454", dup276); + +var msg10902 = msg("8455", dup276); + +var msg10903 = msg("8456", dup276); + +var msg10904 = msg("8457", dup276); + +var msg10905 = msg("8458", dup276); + +var msg10906 = msg("8459", dup276); + +var msg10907 = msg("8460", dup276); + +var msg10908 = msg("8461", dup303); + +var msg10909 = msg("8462", dup303); + +var msg10910 = msg("8463", dup303); + +var msg10911 = msg("8464", dup303); + +var msg10912 = msg("8465", dup303); + +var msg10913 = msg("8466", dup303); + +var msg10914 = msg("8467", dup303); + +var msg10915 = msg("8468", dup303); + +var msg10916 = msg("8469", dup303); + +var msg10917 = msg("8470", dup205); + +var msg10918 = msg("8471", dup205); + +var msg10919 = msg("8472", dup205); + +var msg10920 = msg("8473", dup205); + +var msg10921 = msg("8474", dup205); + +var msg10922 = msg("8475", dup205); + +var msg10923 = msg("8476", dup205); + +var msg10924 = msg("8477", dup205); + +var msg10925 = msg("8478", dup265); + +var msg10926 = msg("8479", dup222); + +var msg10927 = msg("8480", dup222); + +var msg10928 = msg("8481", dup198); + +var msg10929 = msg("8482", dup196); + +var msg10930 = msg("8483", dup196); + +var msg10931 = msg("8484", dup301); + +var msg10932 = msg("8485", dup265); + +var msg10933 = msg("8486", dup265); + +var msg10934 = msg("8487", dup265); + +var msg10935 = msg("8488", dup265); + +var msg10936 = msg("8489", dup265); + +var msg10937 = msg("8490", dup265); + +var msg10938 = msg("8491", dup265); + +var msg10939 = msg("8492", dup265); + +var msg10940 = msg("8493", dup265); + +var msg10941 = msg("8494", dup197); + +var msg10942 = msg("8495", dup197); + +var msg10943 = msg("8496", dup240); + +var msg10944 = msg("8497", dup240); + +var msg10945 = msg("8498", dup240); + +var msg10946 = msg("8499", dup240); + +var msg10947 = msg("8500", dup240); + +var msg10948 = msg("8501", dup240); + +var msg10949 = msg("8502", dup240); + +var msg10950 = msg("8503", dup240); + +var msg10951 = msg("8504", dup240); + +var msg10952 = msg("8505", dup240); + +var msg10953 = msg("8506", dup240); + +var msg10954 = msg("8507", dup240); + +var msg10955 = msg("8508", dup240); + +var msg10956 = msg("8509", dup240); + +var msg10957 = msg("8510", dup240); + +var msg10958 = msg("8511", dup240); + +var msg10959 = msg("8512", dup240); + +var msg10960 = msg("8513", dup240); + +var msg10961 = msg("8514", dup240); + +var msg10962 = msg("8515", dup240); + +var msg10963 = msg("8516", dup240); + +var msg10964 = msg("8517", dup240); + +var msg10965 = msg("8518", dup240); + +var msg10966 = msg("8519", dup240); + +var msg10967 = msg("8520", dup240); + +var msg10968 = msg("8521", dup240); + +var msg10969 = msg("8522", dup240); + +var msg10970 = msg("8523", dup240); + +var msg10971 = msg("8524", dup240); + +var msg10972 = msg("8525", dup240); + +var msg10973 = msg("8526", dup240); + +var msg10974 = msg("8527", dup240); + +var msg10975 = msg("8528", dup240); + +var msg10976 = msg("8529", dup240); + +var msg10977 = msg("8530", dup240); + +var msg10978 = msg("8531", dup240); + +var msg10979 = msg("8532", dup240); + +var msg10980 = msg("8533", dup240); + +var msg10981 = msg("8534", dup240); + +var msg10982 = msg("8535", dup240); + +var msg10983 = msg("8536", dup240); + +var msg10984 = msg("8537", dup240); + +var msg10985 = msg("8538", dup240); + +var msg10986 = msg("8539", dup240); + +var msg10987 = msg("8540", dup240); + +var msg10988 = msg("8541", dup222); + +var msg10989 = msg("8542", dup303); + +var msg10990 = msg("8543", dup303); + +var msg10991 = msg("8544", dup303); + +var msg10992 = msg("8545", dup303); + +var msg10993 = msg("8546", dup303); + +var msg10994 = msg("8547", dup205); + +var msg10995 = msg("8548", dup205); + +var msg10996 = msg("8549", dup205); + +var msg10997 = msg("8550", dup222); + +var msg10998 = msg("8551", dup222); + +var msg10999 = msg("8552", dup276); + +var msg11000 = msg("8553", dup276); + +var msg11001 = msg("8554", dup276); + +var msg11002 = msg("8555", dup276); + +var msg11003 = msg("8556", dup276); + +var msg11004 = msg("8557", dup276); + +var msg11005 = msg("8558", dup276); + +var msg11006 = msg("8559", dup276); + +var msg11007 = msg("8560", dup276); + +var msg11008 = msg("8561", dup276); + +var msg11009 = msg("8562", dup276); + +var msg11010 = msg("8563", dup276); + +var msg11011 = msg("8564", dup276); + +var msg11012 = msg("8565", dup276); + +var msg11013 = msg("8566", dup276); + +var msg11014 = msg("8567", dup276); + +var msg11015 = msg("8568", dup276); + +var msg11016 = msg("8569", dup276); + +var msg11017 = msg("8570", dup276); + +var msg11018 = msg("8571", dup276); + +var msg11019 = msg("8572", dup276); + +var msg11020 = msg("8573", dup276); + +var msg11021 = msg("8574", dup276); + +var msg11022 = msg("8575", dup276); + +var msg11023 = msg("8576", dup276); + +var msg11024 = msg("8577", dup276); + +var msg11025 = msg("8578", dup276); + +var msg11026 = msg("8579", dup276); + +var msg11027 = msg("8580", dup276); + +var msg11028 = msg("8581", dup276); + +var msg11029 = msg("8582", dup276); + +var msg11030 = msg("8583", dup276); + +var msg11031 = msg("8584", dup276); + +var msg11032 = msg("8585", dup276); + +var msg11033 = msg("8586", dup276); + +var msg11034 = msg("8587", dup276); + +var msg11035 = msg("8588", dup276); + +var msg11036 = msg("8589", dup276); + +var msg11037 = msg("8590", dup276); + +var msg11038 = msg("8591", dup276); + +var msg11039 = msg("8592", dup276); + +var msg11040 = msg("8593", dup276); + +var msg11041 = msg("8594", dup276); + +var msg11042 = msg("8595", dup276); + +var msg11043 = msg("8596", dup276); + +var msg11044 = msg("8597", dup276); + +var msg11045 = msg("8598", dup276); + +var msg11046 = msg("8599", dup276); + +var msg11047 = msg("8600", dup276); + +var msg11048 = msg("8601", dup276); + +var msg11049 = msg("8602", dup276); + +var msg11050 = msg("8603", dup276); + +var msg11051 = msg("8604", dup276); + +var msg11052 = msg("8605", dup276); + +var msg11053 = msg("8606", dup276); + +var msg11054 = msg("8607", dup276); + +var msg11055 = msg("8608", dup276); + +var msg11056 = msg("8609", dup276); + +var msg11057 = msg("8610", dup276); + +var msg11058 = msg("8611", dup276); + +var msg11059 = msg("8612", dup276); + +var msg11060 = msg("8613", dup276); + +var msg11061 = msg("8614", dup276); + +var msg11062 = msg("8615", dup276); + +var msg11063 = msg("8616", dup276); + +var msg11064 = msg("8617", dup276); + +var msg11065 = msg("8618", dup276); + +var msg11066 = msg("8619", dup276); + +var msg11067 = msg("8620", dup276); + +var msg11068 = msg("8621", dup276); + +var msg11069 = msg("8622", dup276); + +var msg11070 = msg("8623", dup276); + +var msg11071 = msg("8624", dup276); + +var msg11072 = msg("8625", dup276); + +var msg11073 = msg("8626", dup276); + +var msg11074 = msg("8627", dup276); + +var msg11075 = msg("8628", dup276); + +var msg11076 = msg("8629", dup276); + +var msg11077 = msg("8630", dup276); + +var msg11078 = msg("8631", dup276); + +var msg11079 = msg("8632", dup276); + +var msg11080 = msg("8633", dup276); + +var msg11081 = msg("8634", dup276); + +var msg11082 = msg("8635", dup276); + +var msg11083 = msg("8636", dup276); + +var msg11084 = msg("8637", dup276); + +var msg11085 = msg("8638", dup276); + +var msg11086 = msg("8639", dup276); + +var msg11087 = msg("8640", dup276); + +var msg11088 = msg("8641", dup276); + +var msg11089 = msg("8642", dup276); + +var msg11090 = msg("8643", dup276); + +var msg11091 = msg("8644", dup276); + +var msg11092 = msg("8645", dup276); + +var msg11093 = msg("8646", dup276); + +var msg11094 = msg("8647", dup276); + +var msg11095 = msg("8648", dup276); + +var msg11096 = msg("8649", dup276); + +var msg11097 = msg("8650", dup276); + +var msg11098 = msg("8651", dup276); + +var msg11099 = msg("8652", dup276); + +var msg11100 = msg("8653", dup276); + +var msg11101 = msg("8654", dup276); + +var msg11102 = msg("8655", dup276); + +var msg11103 = msg("8656", dup276); + +var msg11104 = msg("8657", dup276); + +var msg11105 = msg("8658", dup276); + +var msg11106 = msg("8659", dup276); + +var msg11107 = msg("8660", dup276); + +var msg11108 = msg("8661", dup276); + +var msg11109 = msg("8662", dup276); + +var msg11110 = msg("8663", dup276); + +var msg11111 = msg("8664", dup276); + +var msg11112 = msg("8665", dup276); + +var msg11113 = msg("8666", dup276); + +var msg11114 = msg("8667", dup276); + +var msg11115 = msg("8668", dup276); + +var msg11116 = msg("8669", dup276); + +var msg11117 = msg("8670", dup276); + +var msg11118 = msg("8671", dup276); + +var msg11119 = msg("8672", dup276); + +var msg11120 = msg("8673", dup276); + +var msg11121 = msg("8674", dup276); + +var msg11122 = msg("8675", dup276); + +var msg11123 = msg("8676", dup276); + +var msg11124 = msg("8677", dup276); + +var msg11125 = msg("8678", dup276); + +var msg11126 = msg("8679", dup276); + +var msg11127 = msg("8680", dup276); + +var msg11128 = msg("8681", dup276); + +var msg11129 = msg("8682", dup276); + +var msg11130 = msg("8683", dup276); + +var msg11131 = msg("8684", dup276); + +var msg11132 = msg("8685", dup276); + +var msg11133 = msg("8686", dup276); + +var msg11134 = msg("8687", dup276); + +var msg11135 = msg("8688", dup276); + +var msg11136 = msg("8689", dup276); + +var msg11137 = msg("8690", dup201); + +var msg11138 = msg("8691", dup276); + +var msg11139 = msg("8692", dup201); + +var msg11140 = msg("8693", dup276); + +var msg11141 = msg("8694", dup201); + +var msg11142 = msg("8695", dup201); + +var msg11143 = msg("8696", dup276); + +var msg11144 = msg("8697", dup201); + +var msg11145 = msg("8698", dup276); + +var msg11146 = msg("8699", dup201); + +var msg11147 = msg("8700", dup265); + +var msg11148 = msg("8701", dup267); + +var msg11149 = msg("8702", dup222); + +var msg11150 = msg("8703", dup222); + +var msg11151 = msg("8704", dup250); + +var msg11152 = msg("8705", dup222); + +var msg11153 = msg("8706", dup222); + +var msg11154 = msg("8707", dup269); + +var msg11155 = msg("8708", dup267); + +var msg11156 = msg("8709", dup198); + +var msg11157 = msg("8710", dup198); + +var msg11158 = msg("8711", dup267); + +var msg11159 = msg("8712", dup269); + +var msg11160 = msg("8713", dup260); + +var msg11161 = msg("8714", dup260); + +var msg11162 = msg("8715", dup260); + +var msg11163 = msg("8716", dup260); + +var msg11164 = msg("8717", dup265); + +var msg11165 = msg("8718", dup265); + +var msg11166 = msg("8719", dup265); + +var msg11167 = msg("8720", dup265); + +var msg11168 = msg("8721", dup265); + +var msg11169 = msg("8722", dup265); + +var msg11170 = msg("8723", dup265); + +var msg11171 = msg("8724", dup265); + +var msg11172 = msg("8725", dup265); + +var msg11173 = msg("8726", dup265); + +var msg11174 = msg("8727", dup265); + +var msg11175 = msg("8728", dup265); + +var msg11176 = msg("8729", dup222); + +var msg11177 = msg("8730", dup198); + +var msg11178 = msg("8731", dup196); + +var msg11179 = msg("8732", dup196); + +var msg11180 = msg("8733", dup196); + +var msg11181 = msg("8734", dup269); + +var msg11182 = msg("8735", dup265); + +var msg11183 = msg("8736", dup265); + +var msg11184 = msg("8737", dup265); + +var msg11185 = msg("8738", dup265); + +var msg11186 = msg("8739", dup265); + +var msg11187 = msg("8740", dup265); + +var msg11188 = msg("8741", dup265); + +var msg11189 = msg("8742", dup265); + +var msg11190 = msg("8743", dup265); + +var msg11191 = msg("8744", dup265); + +var msg11192 = msg("8745", dup265); + +var msg11193 = msg("8746", dup265); + +var msg11194 = msg("8747", dup265); + +var msg11195 = msg("8748", dup265); + +var msg11196 = msg("8749", dup265); + +var msg11197 = msg("8750", dup265); + +var msg11198 = msg("8751", dup265); + +var msg11199 = msg("8752", dup265); + +var msg11200 = msg("8753", dup265); + +var msg11201 = msg("8754", dup265); + +var msg11202 = msg("8755", dup265); + +var msg11203 = msg("8756", dup265); + +var msg11204 = msg("8757", dup265); + +var msg11205 = msg("8758", dup265); + +var msg11206 = msg("8759", dup265); + +var msg11207 = msg("8760", dup265); + +var msg11208 = msg("8761", dup265); + +var msg11209 = msg("8762", dup265); + +var msg11210 = msg("8763", dup265); + +var msg11211 = msg("8764", dup265); + +var msg11212 = msg("8765", dup265); + +var msg11213 = msg("8766", dup265); + +var msg11214 = msg("8767", dup265); + +var msg11215 = msg("8768", dup265); + +var msg11216 = msg("8769", dup265); + +var msg11217 = msg("8770", dup265); + +var msg11218 = msg("8771", dup265); + +var msg11219 = msg("8772", dup265); + +var msg11220 = msg("8773", dup265); + +var msg11221 = msg("8774", dup265); + +var msg11222 = msg("8775", dup265); + +var msg11223 = msg("8776", dup265); + +var msg11224 = msg("8777", dup265); + +var msg11225 = msg("8778", dup265); + +var msg11226 = msg("8779", dup265); + +var msg11227 = msg("8780", dup265); + +var msg11228 = msg("8781", dup265); + +var msg11229 = msg("8782", dup265); + +var msg11230 = msg("8783", dup265); + +var msg11231 = msg("8784", dup265); + +var msg11232 = msg("8785", dup265); + +var msg11233 = msg("8786", dup265); + +var msg11234 = msg("8787", dup265); + +var msg11235 = msg("8788", dup265); + +var msg11236 = msg("8789", dup265); + +var msg11237 = msg("8790", dup265); + +var msg11238 = msg("8791", dup265); + +var msg11239 = msg("8792", dup265); + +var msg11240 = msg("8793", dup265); + +var msg11241 = msg("8794", dup265); + +var msg11242 = msg("8795", dup265); + +var msg11243 = msg("8796", dup265); + +var msg11244 = msg("8797", dup265); + +var msg11245 = msg("8798", dup265); + +var msg11246 = msg("8799", dup265); + +var msg11247 = msg("8800", dup265); + +var msg11248 = msg("8801", dup265); + +var msg11249 = msg("8802", dup265); + +var msg11250 = msg("8803", dup265); + +var msg11251 = msg("8804", dup265); + +var msg11252 = msg("8805", dup265); + +var msg11253 = msg("8806", dup265); + +var msg11254 = msg("8807", dup265); + +var msg11255 = msg("8808", dup265); + +var msg11256 = msg("8809", dup265); + +var msg11257 = msg("8810", dup265); + +var msg11258 = msg("8811", dup265); + +var msg11259 = msg("8812", dup265); + +var msg11260 = msg("8813", dup265); + +var msg11261 = msg("8814", dup265); + +var msg11262 = msg("8815", dup265); + +var msg11263 = msg("8816", dup265); + +var msg11264 = msg("8817", dup265); + +var msg11265 = msg("8818", dup265); + +var msg11266 = msg("8819", dup265); + +var msg11267 = msg("8820", dup265); + +var msg11268 = msg("8821", dup265); + +var msg11269 = msg("8822", dup265); + +var msg11270 = msg("8823", dup265); + +var msg11271 = msg("8824", dup265); + +var msg11272 = msg("8825", dup265); + +var msg11273 = msg("8826", dup265); + +var msg11274 = msg("8827", dup265); + +var msg11275 = msg("8828", dup265); + +var msg11276 = msg("8829", dup265); + +var msg11277 = msg("8830", dup265); + +var msg11278 = msg("8831", dup265); + +var msg11279 = msg("8832", dup265); + +var msg11280 = msg("8833", dup265); + +var msg11281 = msg("8834", dup265); + +var msg11282 = msg("8835", dup265); + +var msg11283 = msg("8836", dup265); + +var msg11284 = msg("8837", dup265); + +var msg11285 = msg("8838", dup265); + +var msg11286 = msg("8839", dup265); + +var msg11287 = msg("8840", dup265); + +var msg11288 = msg("8841", dup265); + +var msg11289 = msg("8842", dup265); + +var msg11290 = msg("8843", dup265); + +var msg11291 = msg("8844", dup265); + +var msg11292 = msg("8845", dup265); + +var msg11293 = msg("8846", dup265); + +var msg11294 = msg("8847", dup265); + +var msg11295 = msg("8848", dup265); + +var msg11296 = msg("8849", dup265); + +var msg11297 = msg("8850", dup265); + +var msg11298 = msg("8851", dup265); + +var msg11299 = msg("8852", dup265); + +var msg11300 = msg("8853", dup265); + +var msg11301 = msg("8854", dup265); + +var msg11302 = msg("8855", dup265); + +var msg11303 = msg("8856", dup265); + +var msg11304 = msg("8857", dup276); + +var msg11305 = msg("8858", dup276); + +var msg11306 = msg("8859", dup276); + +var msg11307 = msg("8860", dup276); + +var msg11308 = msg("8861", dup276); + +var msg11309 = msg("8862", dup276); + +var msg11310 = msg("8863", dup276); + +var msg11311 = msg("8864", dup276); + +var msg11312 = msg("8865", dup276); + +var msg11313 = msg("8866", dup276); + +var msg11314 = msg("8867", dup276); + +var msg11315 = msg("8868", dup276); + +var msg11316 = msg("8869", dup276); + +var msg11317 = msg("8870", dup276); + +var msg11318 = msg("8871", dup276); + +var msg11319 = msg("8872", dup276); + +var msg11320 = msg("8873", dup276); + +var msg11321 = msg("8874", dup276); + +var msg11322 = msg("8875", dup276); + +var msg11323 = msg("8876", dup276); + +var msg11324 = msg("8877", dup276); + +var msg11325 = msg("8878", dup276); + +var msg11326 = msg("8879", dup276); + +var msg11327 = msg("8880", dup276); + +var msg11328 = msg("8881", dup276); + +var msg11329 = msg("8882", dup276); + +var msg11330 = msg("8883", dup276); + +var msg11331 = msg("8884", dup276); + +var msg11332 = msg("8885", dup276); + +var msg11333 = msg("8886", dup276); + +var msg11334 = msg("8887", dup276); + +var msg11335 = msg("8888", dup276); + +var msg11336 = msg("8889", dup276); + +var msg11337 = msg("8890", dup276); + +var msg11338 = msg("8891", dup276); + +var msg11339 = msg("8892", dup276); + +var msg11340 = msg("8893", dup276); + +var msg11341 = msg("8894", dup276); + +var msg11342 = msg("8895", dup276); + +var msg11343 = msg("8896", dup276); + +var msg11344 = msg("8897", dup276); + +var msg11345 = msg("8898", dup276); + +var msg11346 = msg("8899", dup276); + +var msg11347 = msg("8900", dup276); + +var msg11348 = msg("8901", dup276); + +var msg11349 = msg("8902", dup276); + +var msg11350 = msg("8903", dup276); + +var msg11351 = msg("8904", dup276); + +var msg11352 = msg("8905", dup276); + +var msg11353 = msg("8906", dup276); + +var msg11354 = msg("8907", dup276); + +var msg11355 = msg("8908", dup276); + +var msg11356 = msg("8909", dup276); + +var msg11357 = msg("8910", dup276); + +var msg11358 = msg("8911", dup276); + +var msg11359 = msg("8912", dup276); + +var msg11360 = msg("8913", dup276); + +var msg11361 = msg("8914", dup276); + +var msg11362 = msg("8915", dup276); + +var msg11363 = msg("8916", dup276); + +var msg11364 = msg("8917", dup276); + +var msg11365 = msg("8918", dup276); + +var msg11366 = msg("8919", dup276); + +var msg11367 = msg("8920", dup276); + +var msg11368 = msg("8921", dup276); + +var msg11369 = msg("8922", dup276); + +var msg11370 = msg("8923", dup276); + +var msg11371 = msg("8924", dup276); + +var msg11372 = msg("8925", dup276); + +var msg11373 = msg("8926", dup276); + +var msg11374 = msg("8927", dup276); + +var msg11375 = msg("8928", dup276); + +var msg11376 = msg("8929", dup276); + +var msg11377 = msg("8930", dup276); + +var msg11378 = msg("8931", dup276); + +var msg11379 = msg("8932", dup276); + +var msg11380 = msg("8933", dup276); + +var msg11381 = msg("8934", dup276); + +var msg11382 = msg("8935", dup276); + +var msg11383 = msg("8936", dup276); + +var msg11384 = msg("8937", dup276); + +var msg11385 = msg("8938", dup276); + +var msg11386 = msg("8939", dup276); + +var msg11387 = msg("8940", dup276); + +var msg11388 = msg("8941", dup276); + +var msg11389 = msg("8942", dup276); + +var msg11390 = msg("8943", dup276); + +var msg11391 = msg("8944", dup276); + +var msg11392 = msg("8945", dup276); + +var msg11393 = msg("8946", dup276); + +var msg11394 = msg("8947", dup276); + +var msg11395 = msg("8948", dup276); + +var msg11396 = msg("8949", dup276); + +var msg11397 = msg("8950", dup276); + +var msg11398 = msg("8951", dup276); + +var msg11399 = msg("8952", dup276); + +var msg11400 = msg("8953", dup276); + +var msg11401 = msg("8954", dup276); + +var msg11402 = msg("8955", dup276); + +var msg11403 = msg("8956", dup276); + +var msg11404 = msg("8957", dup276); + +var msg11405 = msg("8958", dup276); + +var msg11406 = msg("8959", dup276); + +var msg11407 = msg("8960", dup276); + +var msg11408 = msg("8961", dup276); + +var msg11409 = msg("8962", dup276); + +var msg11410 = msg("8963", dup276); + +var msg11411 = msg("8964", dup276); + +var msg11412 = msg("8965", dup276); + +var msg11413 = msg("8966", dup276); + +var msg11414 = msg("8967", dup276); + +var msg11415 = msg("8968", dup276); + +var msg11416 = msg("8969", dup276); + +var msg11417 = msg("8970", dup276); + +var msg11418 = msg("8971", dup276); + +var msg11419 = msg("8972", dup276); + +var msg11420 = msg("8973", dup276); + +var msg11421 = msg("8974", dup276); + +var msg11422 = msg("8975", dup276); + +var msg11423 = msg("8976", dup276); + +var msg11424 = msg("8977", dup276); + +var msg11425 = msg("8978", dup276); + +var msg11426 = msg("8979", dup276); + +var msg11427 = msg("8980", dup276); + +var msg11428 = msg("8981", dup276); + +var msg11429 = msg("8982", dup276); + +var msg11430 = msg("8983", dup276); + +var msg11431 = msg("8984", dup276); + +var msg11432 = msg("8985", dup276); + +var msg11433 = msg("8986", dup276); + +var msg11434 = msg("8987", dup276); + +var msg11435 = msg("8988", dup276); + +var msg11436 = msg("8989", dup276); + +var msg11437 = msg("8990", dup276); + +var msg11438 = msg("8991", dup276); + +var msg11439 = msg("8992", dup276); + +var msg11440 = msg("8993", dup276); + +var msg11441 = msg("8994", dup276); + +var msg11442 = msg("8995", dup276); + +var msg11443 = msg("8996", dup276); + +var msg11444 = msg("8997", dup276); + +var msg11445 = msg("8998", dup276); + +var msg11446 = msg("8999", dup276); + +var msg11447 = msg("9000", dup276); + +var msg11448 = msg("9001", dup276); + +var msg11449 = msg("9002", dup276); + +var msg11450 = msg("9003", dup276); + +var msg11451 = msg("9004", dup276); + +var msg11452 = msg("9005", dup276); + +var msg11453 = msg("9006", dup276); + +var msg11454 = msg("9007", dup276); + +var msg11455 = msg("9008", dup276); + +var msg11456 = msg("9009", dup276); + +var msg11457 = msg("9010", dup276); + +var msg11458 = msg("9011", dup276); + +var msg11459 = msg("9012", dup276); + +var msg11460 = msg("9013", dup276); + +var msg11461 = msg("9014", dup276); + +var msg11462 = msg("9015", dup276); + +var msg11463 = msg("9016", dup276); + +var msg11464 = msg("9017", dup276); + +var msg11465 = msg("9018", dup276); + +var msg11466 = msg("9019", dup276); + +var msg11467 = msg("9020", dup276); + +var msg11468 = msg("9021", dup276); + +var msg11469 = msg("9022", dup276); + +var msg11470 = msg("9023", dup276); + +var msg11471 = msg("9024", dup276); + +var msg11472 = msg("9025", dup276); + +var msg11473 = msg("9026", dup276); + +var msg11474 = msg("9027", dup276); + +var msg11475 = msg("9028", dup276); + +var msg11476 = msg("9029", dup276); + +var msg11477 = msg("9030", dup276); + +var msg11478 = msg("9031", dup276); + +var msg11479 = msg("9032", dup276); + +var msg11480 = msg("9033", dup276); + +var msg11481 = msg("9034", dup276); + +var msg11482 = msg("9035", dup276); + +var msg11483 = msg("9036", dup276); + +var msg11484 = msg("9037", dup276); + +var msg11485 = msg("9038", dup276); + +var msg11486 = msg("9039", dup276); + +var msg11487 = msg("9040", dup276); + +var msg11488 = msg("9041", dup276); + +var msg11489 = msg("9042", dup276); + +var msg11490 = msg("9043", dup276); + +var msg11491 = msg("9044", dup276); + +var msg11492 = msg("9045", dup276); + +var msg11493 = msg("9046", dup276); + +var msg11494 = msg("9047", dup276); + +var msg11495 = msg("9048", dup276); + +var msg11496 = msg("9049", dup276); + +var msg11497 = msg("9050", dup276); + +var msg11498 = msg("9051", dup276); + +var msg11499 = msg("9052", dup276); + +var msg11500 = msg("9053", dup276); + +var msg11501 = msg("9054", dup276); + +var msg11502 = msg("9055", dup276); + +var msg11503 = msg("9056", dup276); + +var msg11504 = msg("9057", dup276); + +var msg11505 = msg("9058", dup276); + +var msg11506 = msg("9059", dup276); + +var msg11507 = msg("9060", dup276); + +var msg11508 = msg("9061", dup276); + +var msg11509 = msg("9062", dup276); + +var msg11510 = msg("9063", dup276); + +var msg11511 = msg("9064", dup276); + +var msg11512 = msg("9065", dup276); + +var msg11513 = msg("9066", dup276); + +var msg11514 = msg("9067", dup276); + +var msg11515 = msg("9068", dup276); + +var msg11516 = msg("9069", dup276); + +var msg11517 = msg("9070", dup276); + +var msg11518 = msg("9071", dup276); + +var msg11519 = msg("9072", dup276); + +var msg11520 = msg("9073", dup276); + +var msg11521 = msg("9074", dup276); + +var msg11522 = msg("9075", dup276); + +var msg11523 = msg("9076", dup276); + +var msg11524 = msg("9077", dup276); + +var msg11525 = msg("9078", dup276); + +var msg11526 = msg("9079", dup276); + +var msg11527 = msg("9080", dup276); + +var msg11528 = msg("9081", dup276); + +var msg11529 = msg("9082", dup276); + +var msg11530 = msg("9083", dup276); + +var msg11531 = msg("9084", dup276); + +var msg11532 = msg("9085", dup276); + +var msg11533 = msg("9086", dup276); + +var msg11534 = msg("9087", dup276); + +var msg11535 = msg("9088", dup276); + +var msg11536 = msg("9089", dup276); + +var msg11537 = msg("9090", dup276); + +var msg11538 = msg("9091", dup276); + +var msg11539 = msg("9092", dup276); + +var msg11540 = msg("9093", dup276); + +var msg11541 = msg("9094", dup276); + +var msg11542 = msg("9095", dup276); + +var msg11543 = msg("9096", dup276); + +var msg11544 = msg("9097", dup276); + +var msg11545 = msg("9098", dup276); + +var msg11546 = msg("9099", dup276); + +var msg11547 = msg("9100", dup276); + +var msg11548 = msg("9101", dup276); + +var msg11549 = msg("9102", dup276); + +var msg11550 = msg("9103", dup276); + +var msg11551 = msg("9104", dup276); + +var msg11552 = msg("9105", dup276); + +var msg11553 = msg("9106", dup276); + +var msg11554 = msg("9107", dup276); + +var msg11555 = msg("9108", dup276); + +var msg11556 = msg("9109", dup276); + +var msg11557 = msg("9110", dup276); + +var msg11558 = msg("9111", dup276); + +var msg11559 = msg("9112", dup276); + +var msg11560 = msg("9113", dup276); + +var msg11561 = msg("9114", dup276); + +var msg11562 = msg("9115", dup276); + +var msg11563 = msg("9116", dup276); + +var msg11564 = msg("9117", dup276); + +var msg11565 = msg("9118", dup276); + +var msg11566 = msg("9119", dup276); + +var msg11567 = msg("9120", dup276); + +var msg11568 = msg("9121", dup276); + +var msg11569 = msg("9122", dup276); + +var msg11570 = msg("9123", dup276); + +var msg11571 = msg("9124", dup276); + +var msg11572 = msg("9125", dup276); + +var msg11573 = msg("9126", dup276); + +var msg11574 = msg("9127", dup276); + +var msg11575 = msg("9128", dup276); + +var msg11576 = msg("9129", dup265); + +var msg11577 = msg("9130", dup265); + +var msg11578 = msg("9131", dup265); + +var msg11579 = msg("9132", dup276); + +var msg11580 = msg("9133", dup276); + +var msg11581 = msg("9134", dup276); + +var msg11582 = msg("9135", dup276); + +var msg11583 = msg("9136", dup276); + +var msg11584 = msg("9137", dup276); + +var msg11585 = msg("9138", dup276); + +var msg11586 = msg("9139", dup276); + +var msg11587 = msg("9140", dup276); + +var msg11588 = msg("9141", dup276); + +var msg11589 = msg("9142", dup276); + +var msg11590 = msg("9143", dup276); + +var msg11591 = msg("9144", dup276); + +var msg11592 = msg("9145", dup276); + +var msg11593 = msg("9146", dup276); + +var msg11594 = msg("9147", dup276); + +var msg11595 = msg("9148", dup276); + +var msg11596 = msg("9149", dup276); + +var msg11597 = msg("9150", dup276); + +var msg11598 = msg("9151", dup276); + +var msg11599 = msg("9152", dup276); + +var msg11600 = msg("9153", dup276); + +var msg11601 = msg("9154", dup276); + +var msg11602 = msg("9155", dup276); + +var msg11603 = msg("9156", dup276); + +var msg11604 = msg("9157", dup276); + +var msg11605 = msg("9158", dup276); + +var msg11606 = msg("9159", dup276); + +var msg11607 = msg("9160", dup276); + +var msg11608 = msg("9161", dup276); + +var msg11609 = msg("9162", dup276); + +var msg11610 = msg("9163", dup276); + +var msg11611 = msg("9164", dup276); + +var msg11612 = msg("9165", dup276); + +var msg11613 = msg("9166", dup276); + +var msg11614 = msg("9167", dup276); + +var msg11615 = msg("9168", dup276); + +var msg11616 = msg("9169", dup276); + +var msg11617 = msg("9170", dup276); + +var msg11618 = msg("9171", dup276); + +var msg11619 = msg("9172", dup276); + +var msg11620 = msg("9173", dup276); + +var msg11621 = msg("9174", dup276); + +var msg11622 = msg("9175", dup276); + +var msg11623 = msg("9176", dup276); + +var msg11624 = msg("9177", dup276); + +var msg11625 = msg("9178", dup276); + +var msg11626 = msg("9179", dup276); + +var msg11627 = msg("9180", dup276); + +var msg11628 = msg("9181", dup276); + +var msg11629 = msg("9182", dup276); + +var msg11630 = msg("9183", dup276); + +var msg11631 = msg("9184", dup276); + +var msg11632 = msg("9185", dup276); + +var msg11633 = msg("9186", dup276); + +var msg11634 = msg("9187", dup276); + +var msg11635 = msg("9188", dup276); + +var msg11636 = msg("9189", dup276); + +var msg11637 = msg("9190", dup276); + +var msg11638 = msg("9191", dup276); + +var msg11639 = msg("9192", dup276); + +var msg11640 = msg("9193", dup276); + +var msg11641 = msg("9194", dup276); + +var msg11642 = msg("9195", dup276); + +var msg11643 = msg("9196", dup276); + +var msg11644 = msg("9197", dup276); + +var msg11645 = msg("9198", dup276); + +var msg11646 = msg("9199", dup276); + +var msg11647 = msg("9200", dup276); + +var msg11648 = msg("9201", dup276); + +var msg11649 = msg("9202", dup276); + +var msg11650 = msg("9203", dup276); + +var msg11651 = msg("9204", dup276); + +var msg11652 = msg("9205", dup276); + +var msg11653 = msg("9206", dup276); + +var msg11654 = msg("9207", dup276); + +var msg11655 = msg("9208", dup276); + +var msg11656 = msg("9209", dup276); + +var msg11657 = msg("9210", dup276); + +var msg11658 = msg("9211", dup276); + +var msg11659 = msg("9212", dup276); + +var msg11660 = msg("9213", dup276); + +var msg11661 = msg("9214", dup276); + +var msg11662 = msg("9215", dup276); + +var msg11663 = msg("9216", dup276); + +var msg11664 = msg("9217", dup276); + +var msg11665 = msg("9218", dup276); + +var msg11666 = msg("9219", dup276); + +var msg11667 = msg("9220", dup276); + +var msg11668 = msg("9221", dup276); + +var msg11669 = msg("9222", dup276); + +var msg11670 = msg("9223", dup276); + +var msg11671 = msg("9224", dup276); + +var msg11672 = msg("9225", dup276); + +var msg11673 = msg("9226", dup276); + +var msg11674 = msg("9227", dup276); + +var msg11675 = msg("9228", dup276); + +var msg11676 = msg("9229", dup276); + +var msg11677 = msg("9230", dup276); + +var msg11678 = msg("9231", dup276); + +var msg11679 = msg("9232", dup276); + +var msg11680 = msg("9233", dup276); + +var msg11681 = msg("9234", dup276); + +var msg11682 = msg("9235", dup276); + +var msg11683 = msg("9236", dup276); + +var msg11684 = msg("9237", dup276); + +var msg11685 = msg("9238", dup276); + +var msg11686 = msg("9239", dup276); + +var msg11687 = msg("9240", dup276); + +var msg11688 = msg("9241", dup276); + +var msg11689 = msg("9242", dup276); + +var msg11690 = msg("9243", dup276); + +var msg11691 = msg("9244", dup276); + +var msg11692 = msg("9245", dup276); + +var msg11693 = msg("9246", dup276); + +var msg11694 = msg("9247", dup276); + +var msg11695 = msg("9248", dup276); + +var msg11696 = msg("9249", dup276); + +var msg11697 = msg("9250", dup276); + +var msg11698 = msg("9251", dup276); + +var msg11699 = msg("9252", dup276); + +var msg11700 = msg("9253", dup276); + +var msg11701 = msg("9254", dup276); + +var msg11702 = msg("9255", dup276); + +var msg11703 = msg("9256", dup276); + +var msg11704 = msg("9257", dup276); + +var msg11705 = msg("9258", dup276); + +var msg11706 = msg("9259", dup276); + +var msg11707 = msg("9260", dup276); + +var msg11708 = msg("9261", dup276); + +var msg11709 = msg("9262", dup276); + +var msg11710 = msg("9263", dup276); + +var msg11711 = msg("9264", dup276); + +var msg11712 = msg("9265", dup276); + +var msg11713 = msg("9266", dup276); + +var msg11714 = msg("9267", dup276); + +var msg11715 = msg("9268", dup276); + +var msg11716 = msg("9269", dup276); + +var msg11717 = msg("9270", dup276); + +var msg11718 = msg("9271", dup276); + +var msg11719 = msg("9272", dup276); + +var msg11720 = msg("9273", dup276); + +var msg11721 = msg("9274", dup276); + +var msg11722 = msg("9275", dup276); + +var msg11723 = msg("9276", dup276); + +var msg11724 = msg("9277", dup276); + +var msg11725 = msg("9278", dup276); + +var msg11726 = msg("9279", dup276); + +var msg11727 = msg("9280", dup276); + +var msg11728 = msg("9281", dup276); + +var msg11729 = msg("9282", dup276); + +var msg11730 = msg("9283", dup276); + +var msg11731 = msg("9284", dup276); + +var msg11732 = msg("9285", dup276); + +var msg11733 = msg("9286", dup276); + +var msg11734 = msg("9287", dup276); + +var msg11735 = msg("9288", dup276); + +var msg11736 = msg("9289", dup276); + +var msg11737 = msg("9290", dup276); + +var msg11738 = msg("9291", dup276); + +var msg11739 = msg("9292", dup276); + +var msg11740 = msg("9293", dup276); + +var msg11741 = msg("9294", dup276); + +var msg11742 = msg("9295", dup276); + +var msg11743 = msg("9296", dup276); + +var msg11744 = msg("9297", dup276); + +var msg11745 = msg("9298", dup276); + +var msg11746 = msg("9299", dup276); + +var msg11747 = msg("9300", dup276); + +var msg11748 = msg("9301", dup276); + +var msg11749 = msg("9302", dup276); + +var msg11750 = msg("9303", dup276); + +var msg11751 = msg("9304", dup276); + +var msg11752 = msg("9305", dup276); + +var msg11753 = msg("9306", dup276); + +var msg11754 = msg("9307", dup276); + +var msg11755 = msg("9308", dup276); + +var msg11756 = msg("9309", dup276); + +var msg11757 = msg("9310", dup276); + +var msg11758 = msg("9311", dup276); + +var msg11759 = msg("9312", dup276); + +var msg11760 = msg("9313", dup276); + +var msg11761 = msg("9314", dup276); + +var msg11762 = msg("9315", dup276); + +var msg11763 = msg("9316", dup276); + +var msg11764 = msg("9317", dup276); + +var msg11765 = msg("9318", dup276); + +var msg11766 = msg("9319", dup276); + +var msg11767 = msg("9320", dup276); + +var msg11768 = msg("9321", dup276); + +var msg11769 = msg("9322", dup276); + +var msg11770 = msg("9323", dup276); + +var msg11771 = msg("9324", dup196); + +var msg11772 = msg("9325", dup198); + +var msg11773 = msg("9326", dup250); + +var msg11774 = msg("9327", dup250); + +var msg11775 = msg("9328", dup250); + +var msg11776 = msg("9329", dup250); + +var msg11777 = msg("9330", dup250); + +var msg11778 = msg("9331", dup250); + +var msg11779 = msg("9332", dup250); + +var msg11780 = msg("9333", dup250); + +var msg11781 = msg("9334", dup250); + +var msg11782 = msg("9335", dup250); + +var msg11783 = msg("9336", dup250); + +var msg11784 = msg("9337", dup250); + +var msg11785 = msg("9338", dup250); + +var msg11786 = msg("9339", dup196); + +var msg11787 = msg("9340", dup196); + +var msg11788 = msg("9341", dup227); + +var msg11789 = msg("9342", dup250); + +var msg11790 = msg("9343", dup250); + +var msg11791 = msg("9344", dup250); + +var msg11792 = msg("9345", dup287); + +var msg11793 = msg("9346", dup196); + +var msg11794 = msg("9347", dup196); + +var msg11795 = msg("9348", dup250); + +var msg11796 = msg("9349", dup250); + +var msg11797 = msg("9350", dup250); + +var msg11798 = msg("9351", dup196); + +var msg11799 = msg("9352", dup250); + +var msg11800 = msg("9353", dup196); + +var msg11801 = msg("9354", dup196); + +var msg11802 = msg("9355", dup196); + +var msg11803 = msg("9356", dup196); + +var msg11804 = msg("9357", dup196); + +var msg11805 = msg("9358", dup250); + +var msg11806 = msg("9359", dup250); + +var msg11807 = msg("9360", dup250); + +var msg11808 = msg("9361", dup250); + +var msg11809 = msg("9362", dup250); + +var msg11810 = msg("9363", dup196); + +var msg11811 = msg("9364", dup196); + +var msg11812 = msg("9365", dup250); + +var msg11813 = msg("9366", dup250); + +var msg11814 = msg("9367", dup250); + +var msg11815 = msg("9368", dup250); + +var msg11816 = msg("9369", dup250); + +var msg11817 = msg("9370", dup250); + +var msg11818 = msg("9371", dup250); + +var msg11819 = msg("9372", dup250); + +var msg11820 = msg("9373", dup250); + +var msg11821 = msg("9374", dup250); + +var msg11822 = msg("9375", dup250); + +var msg11823 = msg("9376", dup250); + +var msg11824 = msg("9377", dup250); + +var msg11825 = msg("9378", dup250); + +var msg11826 = msg("9379", dup250); + +var msg11827 = msg("9380", dup196); + +var msg11828 = msg("9381", dup250); + +var msg11829 = msg("9382", dup250); + +var msg11830 = msg("9383", dup250); + +var msg11831 = msg("9384", dup250); + +var msg11832 = msg("9385", dup250); + +var msg11833 = msg("9386", dup250); + +var msg11834 = msg("9387", dup196); + +var msg11835 = msg("9388", dup250); + +var msg11836 = msg("9389", dup250); + +var msg11837 = msg("9390", dup196); + +var msg11838 = msg("9391", dup250); + +var msg11839 = msg("9392", dup250); + +var msg11840 = msg("9393", dup250); + +var msg11841 = msg("9394", dup250); + +var msg11842 = msg("9395", dup196); + +var msg11843 = msg("9396", dup196); + +var msg11844 = msg("9397", dup250); + +var msg11845 = msg("9398", dup250); + +var msg11846 = msg("9399", dup250); + +var msg11847 = msg("9400", dup250); + +var msg11848 = msg("9401", dup265); + +var msg11849 = msg("9402", dup274); + +var msg11850 = msg("9403", dup250); + +var msg11851 = msg("9404", dup250); + +var msg11852 = msg("9405", dup250); + +var msg11853 = msg("9406", dup250); + +var msg11854 = msg("9407", dup196); + +var msg11855 = msg("9408", dup250); + +var msg11856 = msg("9409", dup250); + +var msg11857 = msg("9410", dup250); + +var msg11858 = msg("9411", dup250); + +var msg11859 = msg("9412", dup196); + +var msg11860 = msg("9413", dup250); + +var msg11861 = msg("9414", dup250); + +var msg11862 = msg("9415", dup250); + +var msg11863 = msg("9416", dup250); + +var msg11864 = msg("9417", dup250); + +var msg11865 = msg("9418", dup265); + +var msg11866 = msg("9419", dup196); + +var msg11867 = msg("9420", dup196); + +var msg11868 = msg("9421", dup196); + +var msg11869 = msg("9422", dup196); + +var msg11870 = msg("9423", dup196); + +var msg11871 = msg("9424", dup196); + +var msg11872 = msg("9425", dup196); + +var msg11873 = msg("9426", dup196); + +var msg11874 = msg("9427", dup265); + +var msg11875 = msg("9428", dup265); + +var msg11876 = msg("9429", dup265); + +var msg11877 = msg("9430", dup265); + +var msg11878 = msg("9431", dup222); + +var msg11879 = msg("9432", dup267); + +var msg11880 = msg("9433", dup267); + +var msg11881 = msg("9434", dup267); + +var msg11882 = msg("9435", dup267); + +var msg11883 = msg("9436", dup267); + +var msg11884 = msg("9437", dup276); + +var msg11885 = msg("9438", dup276); + +var msg11886 = msg("9439", dup276); + +var msg11887 = msg("9440", dup276); + +var msg11888 = msg("9441", dup276); + +var msg11889 = msg("9442", dup276); + +var msg11890 = msg("9443", dup276); + +var msg11891 = msg("9444", dup276); + +var msg11892 = msg("9445", dup276); + +var msg11893 = msg("9446", dup276); + +var msg11894 = msg("9447", dup276); + +var msg11895 = msg("9448", dup276); + +var msg11896 = msg("9449", dup276); + +var msg11897 = msg("9450", dup276); + +var msg11898 = msg("9451", dup276); + +var msg11899 = msg("9452", dup276); + +var msg11900 = msg("9453", dup276); + +var msg11901 = msg("9454", dup276); + +var msg11902 = msg("9455", dup276); + +var msg11903 = msg("9456", dup276); + +var msg11904 = msg("9457", dup276); + +var msg11905 = msg("9458", dup276); + +var msg11906 = msg("9459", dup276); + +var msg11907 = msg("9460", dup276); + +var msg11908 = msg("9461", dup276); + +var msg11909 = msg("9462", dup276); + +var msg11910 = msg("9463", dup276); + +var msg11911 = msg("9464", dup276); + +var msg11912 = msg("9465", dup276); + +var msg11913 = msg("9466", dup276); + +var msg11914 = msg("9467", dup276); + +var msg11915 = msg("9468", dup276); + +var msg11916 = msg("9469", dup276); + +var msg11917 = msg("9470", dup276); + +var msg11918 = msg("9471", dup276); + +var msg11919 = msg("9472", dup276); + +var msg11920 = msg("9473", dup276); + +var msg11921 = msg("9474", dup276); + +var msg11922 = msg("9475", dup276); + +var msg11923 = msg("9476", dup276); + +var msg11924 = msg("9477", dup276); + +var msg11925 = msg("9478", dup276); + +var msg11926 = msg("9479", dup276); + +var msg11927 = msg("9480", dup276); + +var msg11928 = msg("9481", dup276); + +var msg11929 = msg("9482", dup276); + +var msg11930 = msg("9483", dup276); + +var msg11931 = msg("9484", dup276); + +var msg11932 = msg("9485", dup276); + +var msg11933 = msg("9486", dup276); + +var msg11934 = msg("9487", dup276); + +var msg11935 = msg("9488", dup276); + +var msg11936 = msg("9489", dup276); + +var msg11937 = msg("9490", dup276); + +var msg11938 = msg("9491", dup276); + +var msg11939 = msg("9492", dup276); + +var msg11940 = msg("9493", dup276); + +var msg11941 = msg("9494", dup276); + +var msg11942 = msg("9495", dup276); + +var msg11943 = msg("9496", dup276); + +var msg11944 = msg("9497", dup276); + +var msg11945 = msg("9498", dup276); + +var msg11946 = msg("9499", dup276); + +var msg11947 = msg("9500", dup276); + +var msg11948 = msg("9501", dup276); + +var msg11949 = msg("9502", dup276); + +var msg11950 = msg("9503", dup276); + +var msg11951 = msg("9504", dup276); + +var msg11952 = msg("9505", dup276); + +var msg11953 = msg("9506", dup276); + +var msg11954 = msg("9507", dup276); + +var msg11955 = msg("9508", dup276); + +var msg11956 = msg("9509", dup276); + +var msg11957 = msg("9510", dup276); + +var msg11958 = msg("9511", dup276); + +var msg11959 = msg("9512", dup276); + +var msg11960 = msg("9513", dup276); + +var msg11961 = msg("9514", dup276); + +var msg11962 = msg("9515", dup276); + +var msg11963 = msg("9516", dup276); + +var msg11964 = msg("9517", dup276); + +var msg11965 = msg("9518", dup276); + +var msg11966 = msg("9519", dup276); + +var msg11967 = msg("9520", dup276); + +var msg11968 = msg("9521", dup276); + +var msg11969 = msg("9522", dup276); + +var msg11970 = msg("9523", dup276); + +var msg11971 = msg("9524", dup276); + +var msg11972 = msg("9525", dup276); + +var msg11973 = msg("9526", dup276); + +var msg11974 = msg("9527", dup276); + +var msg11975 = msg("9528", dup276); + +var msg11976 = msg("9529", dup276); + +var msg11977 = msg("9530", dup276); + +var msg11978 = msg("9531", dup276); + +var msg11979 = msg("9532", dup276); + +var msg11980 = msg("9533", dup276); + +var msg11981 = msg("9534", dup276); + +var msg11982 = msg("9535", dup276); + +var msg11983 = msg("9536", dup276); + +var msg11984 = msg("9537", dup276); + +var msg11985 = msg("9538", dup276); + +var msg11986 = msg("9539", dup276); + +var msg11987 = msg("9540", dup276); + +var msg11988 = msg("9541", dup276); + +var msg11989 = msg("9542", dup276); + +var msg11990 = msg("9543", dup276); + +var msg11991 = msg("9544", dup276); + +var msg11992 = msg("9545", dup276); + +var msg11993 = msg("9546", dup276); + +var msg11994 = msg("9547", dup276); + +var msg11995 = msg("9548", dup276); + +var msg11996 = msg("9549", dup276); + +var msg11997 = msg("9550", dup276); + +var msg11998 = msg("9551", dup276); + +var msg11999 = msg("9552", dup276); + +var msg12000 = msg("9553", dup276); + +var msg12001 = msg("9554", dup276); + +var msg12002 = msg("9555", dup276); + +var msg12003 = msg("9556", dup276); + +var msg12004 = msg("9557", dup276); + +var msg12005 = msg("9558", dup276); + +var msg12006 = msg("9559", dup276); + +var msg12007 = msg("9560", dup276); + +var msg12008 = msg("9561", dup276); + +var msg12009 = msg("9562", dup276); + +var msg12010 = msg("9563", dup276); + +var msg12011 = msg("9564", dup276); + +var msg12012 = msg("9565", dup276); + +var msg12013 = msg("9566", dup276); + +var msg12014 = msg("9567", dup276); + +var msg12015 = msg("9568", dup276); + +var msg12016 = msg("9569", dup276); + +var msg12017 = msg("9570", dup276); + +var msg12018 = msg("9571", dup276); + +var msg12019 = msg("9572", dup276); + +var msg12020 = msg("9573", dup276); + +var msg12021 = msg("9574", dup276); + +var msg12022 = msg("9575", dup276); + +var msg12023 = msg("9576", dup276); + +var msg12024 = msg("9577", dup276); + +var msg12025 = msg("9578", dup276); + +var msg12026 = msg("9579", dup276); + +var msg12027 = msg("9580", dup276); + +var msg12028 = msg("9581", dup276); + +var msg12029 = msg("9582", dup276); + +var msg12030 = msg("9583", dup276); + +var msg12031 = msg("9584", dup276); + +var msg12032 = msg("9585", dup276); + +var msg12033 = msg("9586", dup276); + +var msg12034 = msg("9587", dup276); + +var msg12035 = msg("9588", dup276); + +var msg12036 = msg("9589", dup276); + +var msg12037 = msg("9590", dup276); + +var msg12038 = msg("9591", dup276); + +var msg12039 = msg("9592", dup276); + +var msg12040 = msg("9593", dup276); + +var msg12041 = msg("9594", dup276); + +var msg12042 = msg("9595", dup276); + +var msg12043 = msg("9596", dup276); + +var msg12044 = msg("9597", dup276); + +var msg12045 = msg("9598", dup276); + +var msg12046 = msg("9599", dup276); + +var msg12047 = msg("9600", dup276); + +var msg12048 = msg("9601", dup276); + +var msg12049 = msg("9602", dup276); + +var msg12050 = msg("9603", dup276); + +var msg12051 = msg("9604", dup276); + +var msg12052 = msg("9605", dup276); + +var msg12053 = msg("9606", dup276); + +var msg12054 = msg("9607", dup276); + +var msg12055 = msg("9608", dup276); + +var msg12056 = msg("9609", dup276); + +var msg12057 = msg("9610", dup276); + +var msg12058 = msg("9611", dup276); + +var msg12059 = msg("9612", dup276); + +var msg12060 = msg("9613", dup276); + +var msg12061 = msg("9614", dup276); + +var msg12062 = msg("9615", dup276); + +var msg12063 = msg("9616", dup276); + +var msg12064 = msg("9617", dup276); + +var msg12065 = msg("9618", dup276); + +var msg12066 = msg("9619", dup267); + +var msg12067 = msg("9620", dup267); + +var msg12068 = msg("9621", dup295); + +var msg12069 = msg("9622", dup198); + +var msg12070 = msg("9623", dup273); + +var msg12071 = msg("9624", dup273); + +var msg12072 = msg("9625", dup267); + +var msg12073 = msg("9626", dup265); + +var msg12074 = msg("9627", dup265); + +var msg12075 = msg("9628", dup265); + +var msg12076 = msg("9629", dup265); + +var msg12077 = msg("9630", dup265); + +var msg12078 = msg("9631", dup265); + +var msg12079 = msg("9632", dup222); + +var msg12080 = msg("9633", dup222); + +var msg12081 = msg("9634", dup222); + +var msg12082 = msg("9635", dup222); + +var msg12083 = msg("9636", dup222); + +var msg12084 = msg("9637", dup267); + +var msg12085 = msg("9638", dup274); + +var msg12086 = msg("9639", dup265); + +var msg12087 = msg("9640", dup265); + +var msg12088 = msg("9641", dup267); + +var msg12089 = msg("9642", dup267); + +var msg12090 = msg("9643", dup267); + +var msg12091 = msg("9644", dup303); + +var msg12092 = msg("9645", dup303); + +var msg12093 = msg("9646", dup303); + +var msg12094 = msg("9647", dup303); + +var msg12095 = msg("9648", dup303); + +var msg12096 = msg("9649", dup303); + +var msg12097 = msg("9650", dup303); + +var msg12098 = msg("9651", dup303); + +var msg12099 = msg("9652", dup303); + +var msg12100 = msg("9653", dup205); + +var msg12101 = msg("9654", dup205); + +var msg12102 = msg("9655", dup205); + +var msg12103 = msg("9656", dup205); + +var msg12104 = msg("9657", dup205); + +var msg12105 = msg("9658", dup205); + +var msg12106 = msg("9659", dup205); + +var msg12107 = msg("9660", dup205); + +var msg12108 = msg("9661", dup205); + +var msg12109 = msg("9662", dup205); + +var msg12110 = msg("9663", dup205); + +var msg12111 = msg("9664", dup205); + +var msg12112 = msg("9665", dup205); + +var msg12113 = msg("9666", dup205); + +var msg12114 = msg("9667", dup205); + +var msg12115 = msg("9668", dup265); + +var msg12116 = msg("9669", dup265); + +var msg12117 = msg("9670", dup265); + +var msg12118 = msg("9671", dup265); + +var msg12119 = msg("9672", dup265); + +var msg12120 = msg("9673", dup265); + +var msg12121 = msg("9674", dup276); + +var msg12122 = msg("9675", dup276); + +var msg12123 = msg("9676", dup276); + +var msg12124 = msg("9677", dup276); + +var msg12125 = msg("9678", dup276); + +var msg12126 = msg("9679", dup276); + +var msg12127 = msg("9680", dup276); + +var msg12128 = msg("9681", dup276); + +var msg12129 = msg("9682", dup276); + +var msg12130 = msg("9683", dup276); + +var msg12131 = msg("9684", dup276); + +var msg12132 = msg("9685", dup276); + +var msg12133 = msg("9686", dup276); + +var msg12134 = msg("9687", dup276); + +var msg12135 = msg("9688", dup276); + +var msg12136 = msg("9689", dup276); + +var msg12137 = msg("9690", dup276); + +var msg12138 = msg("9691", dup276); + +var msg12139 = msg("9692", dup276); + +var msg12140 = msg("9693", dup276); + +var msg12141 = msg("9694", dup276); + +var msg12142 = msg("9695", dup276); + +var msg12143 = msg("9696", dup276); + +var msg12144 = msg("9697", dup276); + +var msg12145 = msg("9698", dup276); + +var msg12146 = msg("9699", dup276); + +var msg12147 = msg("9700", dup276); + +var msg12148 = msg("9701", dup276); + +var msg12149 = msg("9702", dup276); + +var msg12150 = msg("9703", dup276); + +var msg12151 = msg("9704", dup276); + +var msg12152 = msg("9705", dup276); + +var msg12153 = msg("9706", dup276); + +var msg12154 = msg("9707", dup276); + +var msg12155 = msg("9708", dup276); + +var msg12156 = msg("9709", dup276); + +var msg12157 = msg("9710", dup276); + +var msg12158 = msg("9711", dup276); + +var msg12159 = msg("9712", dup276); + +var msg12160 = msg("9713", dup276); + +var msg12161 = msg("9714", dup276); + +var msg12162 = msg("9715", dup276); + +var msg12163 = msg("9716", dup276); + +var msg12164 = msg("9717", dup276); + +var msg12165 = msg("9718", dup276); + +var msg12166 = msg("9719", dup276); + +var msg12167 = msg("9720", dup276); + +var msg12168 = msg("9721", dup276); + +var msg12169 = msg("9722", dup276); + +var msg12170 = msg("9723", dup276); + +var msg12171 = msg("9724", dup276); + +var msg12172 = msg("9725", dup276); + +var msg12173 = msg("9726", dup276); + +var msg12174 = msg("9727", dup276); + +var msg12175 = msg("9728", dup276); + +var msg12176 = msg("9729", dup276); + +var msg12177 = msg("9730", dup276); + +var msg12178 = msg("9731", dup276); + +var msg12179 = msg("9732", dup276); + +var msg12180 = msg("9733", dup276); + +var msg12181 = msg("9734", dup276); + +var msg12182 = msg("9735", dup276); + +var msg12183 = msg("9736", dup276); + +var msg12184 = msg("9737", dup276); + +var msg12185 = msg("9738", dup276); + +var msg12186 = msg("9739", dup276); + +var msg12187 = msg("9740", dup276); + +var msg12188 = msg("9741", dup276); + +var msg12189 = msg("9742", dup276); + +var msg12190 = msg("9743", dup276); + +var msg12191 = msg("9744", dup276); + +var msg12192 = msg("9745", dup276); + +var msg12193 = msg("9746", dup276); + +var msg12194 = msg("9747", dup276); + +var msg12195 = msg("9748", dup276); + +var msg12196 = msg("9749", dup276); + +var msg12197 = msg("9750", dup276); + +var msg12198 = msg("9751", dup276); + +var msg12199 = msg("9752", dup276); + +var msg12200 = msg("9753", dup276); + +var msg12201 = msg("9754", dup276); + +var msg12202 = msg("9755", dup276); + +var msg12203 = msg("9756", dup276); + +var msg12204 = msg("9757", dup276); + +var msg12205 = msg("9758", dup276); + +var msg12206 = msg("9759", dup276); + +var msg12207 = msg("9760", dup276); + +var msg12208 = msg("9761", dup276); + +var msg12209 = msg("9762", dup276); + +var msg12210 = msg("9763", dup276); + +var msg12211 = msg("9764", dup276); + +var msg12212 = msg("9765", dup276); + +var msg12213 = msg("9766", dup276); + +var msg12214 = msg("9767", dup276); + +var msg12215 = msg("9768", dup201); + +var msg12216 = msg("9769", dup276); + +var msg12217 = msg("9770", dup201); + +var msg12218 = msg("9771", dup276); + +var msg12219 = msg("9772", dup276); + +var msg12220 = msg("9773", dup201); + +var msg12221 = msg("9774", dup201); + +var msg12222 = msg("9775", dup276); + +var msg12223 = msg("9776", dup276); + +var msg12224 = msg("9777", dup276); + +var msg12225 = msg("9778", dup276); + +var msg12226 = msg("9779", dup201); + +var msg12227 = msg("9780", dup276); + +var msg12228 = msg("9781", dup276); + +var msg12229 = msg("9782", dup276); + +var msg12230 = msg("9783", dup201); + +var msg12231 = msg("9784", dup276); + +var msg12232 = msg("9785", dup201); + +var msg12233 = msg("9786", dup276); + +var msg12234 = msg("9787", dup276); + +var msg12235 = msg("9788", dup201); + +var msg12236 = msg("9789", dup276); + +var msg12237 = msg("9790", dup196); + +var msg12238 = msg("9791", dup265); + +var msg12239 = msg("9792", dup222); + +var msg12240 = msg("9793", dup265); + +var msg12241 = msg("9794", dup265); + +var msg12242 = msg("9795", dup194); + +var msg12243 = msg("9796", dup194); + +var msg12244 = msg("9797", dup194); + +var msg12245 = msg("9798", dup194); + +var msg12246 = msg("9799", dup194); + +var msg12247 = msg("9800", dup194); + +var msg12248 = msg("9801", dup198); + +var msg12249 = msg("9802", dup276); + +var msg12250 = msg("9803", dup276); + +var msg12251 = msg("9804", dup276); + +var msg12252 = msg("9805", dup276); + +var msg12253 = msg("9806", dup276); + +var msg12254 = msg("9807", dup276); + +var msg12255 = msg("9808", dup276); + +var msg12256 = msg("9809", dup276); + +var msg12257 = msg("9810", dup276); + +var msg12258 = msg("9811", dup276); + +var msg12259 = msg("9812", dup265); + +var msg12260 = msg("9813", dup222); + +var msg12261 = msg("9814", dup265); + +var msg12262 = msg("9815", dup265); + +var msg12263 = msg("9816", dup265); + +var msg12264 = msg("9817", dup265); + +var msg12265 = msg("9818", dup265); + +var msg12266 = msg("9819", dup265); + +var msg12267 = msg("9820", dup265); + +var msg12268 = msg("9821", dup265); + +var msg12269 = msg("9822", dup265); + +var msg12270 = msg("9823", dup267); + +var msg12271 = msg("9824", dup265); + +var msg12272 = msg("9825", dup265); + +var msg12273 = msg("9826", dup265); + +var msg12274 = msg("9827", dup303); + +var msg12275 = msg("9828", dup303); + +var msg12276 = msg("9829", dup303); + +var msg12277 = msg("9830", dup303); + +var msg12278 = msg("9831", dup303); + +var msg12279 = msg("9832", dup205); + +var msg12280 = msg("9833", dup205); + +var msg12281 = msg("9834", dup205); + +var msg12282 = msg("9835", dup205); + +var msg12283 = msg("9836", dup205); + +var msg12284 = msg("9837", dup205); + +var msg12285 = msg("9838", dup205); + +var msg12286 = msg("9839", dup205); + +var msg12287 = msg("9840", dup265); + +var msg12288 = msg("9841", dup222); + +var msg12289 = msg("9842", dup265); + +var msg12290 = msg("9843", dup265); + +var msg12291 = msg("9844", dup265); + +var msg12292 = msg("9845", dup265); + +var msg12293 = msg("9846", dup265); + +var msg12294 = msg("9847", dup265); + +var msg12295 = msg("9848", dup267); + +var msg12296 = msg("9849", dup267); + +var msg12297 = msg("9850", dup276); + +var msg12298 = msg("9851", dup276); + +var msg12299 = msg("9852", dup276); + +var msg12300 = msg("9853", dup276); + +var msg12301 = msg("9854", dup276); + +var msg12302 = msg("9855", dup276); + +var msg12303 = msg("9856", dup276); + +var msg12304 = msg("9857", dup276); + +var msg12305 = msg("9858", dup276); + +var msg12306 = msg("9859", dup276); + +var msg12307 = msg("9860", dup276); + +var msg12308 = msg("9861", dup276); + +var msg12309 = msg("9862", dup276); + +var msg12310 = msg("9863", dup276); + +var msg12311 = msg("9864", dup276); + +var msg12312 = msg("9865", dup276); + +var msg12313 = msg("9866", dup276); + +var msg12314 = msg("9867", dup276); + +var msg12315 = msg("9868", dup276); + +var msg12316 = msg("9869", dup276); + +var msg12317 = msg("9870", dup276); + +var msg12318 = msg("9871", dup276); + +var msg12319 = msg("9872", dup276); + +var msg12320 = msg("9873", dup276); + +var msg12321 = msg("9874", dup276); + +var msg12322 = msg("9875", dup276); + +var msg12323 = msg("9876", dup276); + +var msg12324 = msg("9877", dup276); + +var msg12325 = msg("9878", dup276); + +var msg12326 = msg("9879", dup276); + +var msg12327 = msg("9880", dup276); + +var msg12328 = msg("9881", dup276); + +var msg12329 = msg("9882", dup276); + +var msg12330 = msg("9883", dup276); + +var msg12331 = msg("9884", dup276); + +var msg12332 = msg("9885", dup276); + +var msg12333 = msg("9886", dup276); + +var msg12334 = msg("9887", dup276); + +var msg12335 = msg("9888", dup276); + +var msg12336 = msg("9889", dup276); + +var msg12337 = msg("9890", dup276); + +var msg12338 = msg("9891", dup276); + +var msg12339 = msg("9892", dup276); + +var msg12340 = msg("9893", dup276); + +var msg12341 = msg("9894", dup276); + +var msg12342 = msg("9895", dup276); + +var msg12343 = msg("9896", dup276); + +var msg12344 = msg("9897", dup276); + +var msg12345 = msg("9898", dup276); + +var msg12346 = msg("9899", dup276); + +var msg12347 = msg("9900", dup276); + +var msg12348 = msg("9901", dup276); + +var msg12349 = msg("9902", dup276); + +var msg12350 = msg("9903", dup276); + +var msg12351 = msg("9904", dup276); + +var msg12352 = msg("9905", dup276); + +var msg12353 = msg("9906", dup276); + +var msg12354 = msg("9907", dup276); + +var msg12355 = msg("9908", dup276); + +var msg12356 = msg("9909", dup276); + +var msg12357 = msg("9910", dup276); + +var msg12358 = msg("9911", dup276); + +var msg12359 = msg("9912", dup276); + +var msg12360 = msg("9913", dup276); + +var msg12361 = msg("9914", dup276); + +var msg12362 = msg("9915", dup276); + +var msg12363 = msg("9916", dup276); + +var msg12364 = msg("9917", dup276); + +var msg12365 = msg("9918", dup276); + +var msg12366 = msg("9919", dup276); + +var msg12367 = msg("9920", dup276); + +var msg12368 = msg("9921", dup276); + +var msg12369 = msg("9922", dup276); + +var msg12370 = msg("9923", dup276); + +var msg12371 = msg("9924", dup276); + +var msg12372 = msg("9925", dup276); + +var msg12373 = msg("9926", dup276); + +var msg12374 = msg("9927", dup276); + +var msg12375 = msg("9928", dup276); + +var msg12376 = msg("9929", dup276); + +var msg12377 = msg("9930", dup276); + +var msg12378 = msg("9931", dup276); + +var msg12379 = msg("9932", dup276); + +var msg12380 = msg("9933", dup276); + +var msg12381 = msg("9934", dup276); + +var msg12382 = msg("9935", dup276); + +var msg12383 = msg("9936", dup276); + +var msg12384 = msg("9937", dup276); + +var msg12385 = msg("9938", dup276); + +var msg12386 = msg("9939", dup276); + +var msg12387 = msg("9940", dup276); + +var msg12388 = msg("9941", dup276); + +var msg12389 = msg("9942", dup276); + +var msg12390 = msg("9943", dup276); + +var msg12391 = msg("9944", dup276); + +var msg12392 = msg("9945", dup276); + +var msg12393 = msg("9946", dup276); + +var msg12394 = msg("9947", dup276); + +var msg12395 = msg("9948", dup276); + +var msg12396 = msg("9949", dup276); + +var msg12397 = msg("9950", dup276); + +var msg12398 = msg("9951", dup276); + +var msg12399 = msg("9952", dup276); + +var msg12400 = msg("9953", dup276); + +var msg12401 = msg("9954", dup276); + +var msg12402 = msg("9955", dup276); + +var msg12403 = msg("9956", dup276); + +var msg12404 = msg("9957", dup276); + +var msg12405 = msg("9958", dup276); + +var msg12406 = msg("9959", dup276); + +var msg12407 = msg("9960", dup276); + +var msg12408 = msg("9961", dup276); + +var msg12409 = msg("9962", dup276); + +var msg12410 = msg("9963", dup276); + +var msg12411 = msg("9964", dup276); + +var msg12412 = msg("9965", dup276); + +var msg12413 = msg("9966", dup276); + +var msg12414 = msg("9967", dup276); + +var msg12415 = msg("9968", dup276); + +var msg12416 = msg("9969", dup276); + +var msg12417 = msg("9970", dup276); + +var msg12418 = msg("9971", dup276); + +var msg12419 = msg("9972", dup276); + +var msg12420 = msg("9973", dup276); + +var msg12421 = msg("9974", dup276); + +var msg12422 = msg("9975", dup276); + +var msg12423 = msg("9976", dup276); + +var msg12424 = msg("9977", dup276); + +var msg12425 = msg("9978", dup276); + +var msg12426 = msg("9979", dup276); + +var msg12427 = msg("9980", dup276); + +var msg12428 = msg("9981", dup276); + +var msg12429 = msg("9982", dup276); + +var msg12430 = msg("9983", dup276); + +var msg12431 = msg("9984", dup276); + +var msg12432 = msg("9985", dup276); + +var msg12433 = msg("9986", dup276); + +var msg12434 = msg("9987", dup276); + +var msg12435 = msg("9988", dup276); + +var msg12436 = msg("9989", dup276); + +var msg12437 = msg("9990", dup276); + +var msg12438 = msg("9991", dup276); + +var msg12439 = msg("9992", dup276); + +var msg12440 = msg("9993", dup276); + +var msg12441 = msg("9994", dup276); + +var msg12442 = msg("9995", dup276); + +var msg12443 = msg("9996", dup276); + +var msg12444 = msg("9997", dup276); + +var msg12445 = msg("9998", dup276); + +var msg12446 = msg("9999", dup276); + +var msg12447 = msg("10000", dup276); + +var msg12448 = msg("10001", dup276); + +var msg12449 = msg("10002", dup276); + +var msg12450 = msg("10003", dup276); + +var msg12451 = msg("10004", dup276); + +var msg12452 = msg("10005", dup276); + +var msg12453 = msg("10006", dup276); + +var msg12454 = msg("10007", dup276); + +var msg12455 = msg("10008", dup276); + +var msg12456 = msg("10009", dup276); + +var msg12457 = msg("10010", dup222); + +var msg12458 = msg("10011", dup222); + +var msg12459 = msg("10012", dup222); + +var msg12460 = msg("10013", dup265); + +var msg12461 = msg("10014", dup265); + +var msg12462 = msg("10015", dup265); + +var msg12463 = msg("10016", dup265); + +var msg12464 = msg("10017", dup265); + +var msg12465 = msg("10018", dup276); + +var msg12466 = msg("10019", dup276); + +var msg12467 = msg("10020", dup276); + +var msg12468 = msg("10021", dup276); + +var msg12469 = msg("10022", dup276); + +var msg12470 = msg("10023", dup276); + +var msg12471 = msg("10024", dup276); + +var msg12472 = msg("10025", dup276); + +var msg12473 = msg("10026", dup276); + +var msg12474 = msg("10027", dup276); + +var msg12475 = msg("10028", dup276); + +var msg12476 = msg("10029", dup276); + +var msg12477 = msg("10030", dup276); + +var msg12478 = msg("10031", dup276); + +var msg12479 = msg("10032", dup276); + +var msg12480 = msg("10033", dup276); + +var msg12481 = msg("10034", dup276); + +var msg12482 = msg("10035", dup276); + +var msg12483 = msg("10036", dup276); + +var msg12484 = msg("10037", dup276); + +var msg12485 = msg("10038", dup276); + +var msg12486 = msg("10039", dup276); + +var msg12487 = msg("10040", dup276); + +var msg12488 = msg("10041", dup276); + +var msg12489 = msg("10042", dup276); + +var msg12490 = msg("10043", dup276); + +var msg12491 = msg("10044", dup276); + +var msg12492 = msg("10045", dup276); + +var msg12493 = msg("10046", dup276); + +var msg12494 = msg("10047", dup276); + +var msg12495 = msg("10048", dup276); + +var msg12496 = msg("10049", dup276); + +var msg12497 = msg("10050", dup276); + +var msg12498 = msg("10051", dup276); + +var msg12499 = msg("10052", dup276); + +var msg12500 = msg("10053", dup276); + +var msg12501 = msg("10054", dup276); + +var msg12502 = msg("10055", dup276); + +var msg12503 = msg("10056", dup276); + +var msg12504 = msg("10057", dup276); + +var msg12505 = msg("10058", dup276); + +var msg12506 = msg("10059", dup276); + +var msg12507 = msg("10060", dup276); + +var msg12508 = msg("10061", dup276); + +var msg12509 = msg("10062", dup267); + +var msg12510 = msg("10063", dup265); + +var msg12511 = msg("10064", dup222); + +var msg12512 = msg("10065", dup192); + +var msg12513 = msg("10066", dup192); + +var msg12514 = msg("10067", dup192); + +var msg12515 = msg("10068", dup192); + +var msg12516 = msg("10069", dup192); + +var msg12517 = msg("10070", dup192); + +var msg12518 = msg("10071", dup192); + +var msg12519 = msg("10072", dup192); + +var msg12520 = msg("10073", dup192); + +var msg12521 = msg("10074", dup192); + +var msg12522 = msg("10075", dup192); + +var msg12523 = msg("10076", dup192); + +var msg12524 = msg("10077", dup192); + +var msg12525 = msg("10078", dup250); + +var msg12526 = msg("10079", dup250); + +var msg12527 = msg("10080", dup250); + +var msg12528 = msg("10081", dup250); + +var msg12529 = msg("10082", dup250); + +var msg12530 = msg("10083", dup250); + +var msg12531 = msg("10084", dup265); + +var msg12532 = msg("10085", dup265); + +var msg12533 = msg("10086", dup265); + +var msg12534 = msg("10087", dup222); + +var msg12535 = msg("10088", dup303); + +var msg12536 = msg("10089", dup303); + +var msg12537 = msg("10090", dup303); + +var msg12538 = msg("10091", dup303); + +var msg12539 = msg("10092", dup303); + +var msg12540 = msg("10093", dup303); + +var msg12541 = msg("10094", dup303); + +var msg12542 = msg("10095", dup303); + +var msg12543 = msg("10096", dup303); + +var msg12544 = msg("10097", dup303); + +var msg12545 = msg("10098", dup303); + +var msg12546 = msg("10099", dup303); + +var msg12547 = msg("10100", dup303); + +var msg12548 = msg("10101", dup205); + +var msg12549 = msg("10102", dup205); + +var msg12550 = msg("10103", dup205); + +var msg12551 = msg("10104", dup205); + +var msg12552 = msg("10105", dup205); + +var msg12553 = msg("10106", dup205); + +var msg12554 = msg("10107", dup205); + +var msg12555 = msg("10108", dup205); + +var msg12556 = msg("10109", dup205); + +var msg12557 = msg("10110", dup205); + +var msg12558 = msg("10111", dup205); + +var msg12559 = msg("10112", dup205); + +var msg12560 = msg("10113", dup192); + +var msg12561 = msg("10114", dup192); + +var msg12562 = msg("10115", dup198); + +var msg12563 = msg("10116", dup265); + +var msg12564 = msg("10117", dup276); + +var msg12565 = msg("10118", dup276); + +var msg12566 = msg("10119", dup276); + +var msg12567 = msg("10120", dup276); + +var msg12568 = msg("10121", dup276); + +var msg12569 = msg("10122", dup276); + +var msg12570 = msg("10123", dup287); + +var msg12571 = msg("10124", dup285); + +var msg12572 = msg("10125", dup222); + +var msg12573 = msg("10126", dup265); + +var msg12574 = msg("10127", dup198); + +var msg12575 = msg("10128", dup265); + +var msg12576 = msg("10129", dup265); + +var msg12577 = msg("10130", dup196); + +var msg12578 = msg("10131", dup269); + +var msg12579 = msg("10132", dup198); + +var msg12580 = msg("10133", dup198); + +var msg12581 = msg("10134", dup222); + +var msg12582 = msg("10135", dup198); + +var msg12583 = msg("10136", dup285); + +var msg12584 = msg("10137", dup265); + +var msg12585 = msg("10138", dup265); + +var msg12586 = msg("10139", dup265); + +var msg12587 = msg("10140", dup265); + +var msg12588 = msg("10141", dup265); + +var msg12589 = msg("10142", dup265); + +var msg12590 = msg("10143", dup265); + +var msg12591 = msg("10144", dup265); + +var msg12592 = msg("10145", dup265); + +var msg12593 = msg("10146", dup265); + +var msg12594 = msg("10147", dup265); + +var msg12595 = msg("10148", dup265); + +var msg12596 = msg("10149", dup265); + +var msg12597 = msg("10150", dup265); + +var msg12598 = msg("10151", dup265); + +var msg12599 = msg("10152", dup265); + +var msg12600 = msg("10153", dup265); + +var msg12601 = msg("10154", dup265); + +var msg12602 = msg("10155", dup265); + +var msg12603 = msg("10156", dup265); + +var msg12604 = msg("10157", dup265); + +var msg12605 = msg("10158", dup276); + +var msg12606 = msg("10159", dup276); + +var msg12607 = msg("10160", dup276); + +var msg12608 = msg("10161", dup276); + +var msg12609 = msg("10162", dup265); + +var msg12610 = msg("10163", dup265); + +var msg12611 = msg("10164", dup303); + +var msg12612 = msg("10165", dup303); + +var msg12613 = msg("10166", dup303); + +var msg12614 = msg("10167", dup303); + +var msg12615 = msg("10168", dup205); + +var msg12616 = msg("10169", dup205); + +var msg12617 = msg("10170", dup265); + +var msg12618 = msg("10171", dup265); + +var msg12619 = msg("10172", dup267); + +var msg12620 = msg("10173", dup194); + +var msg12621 = msg("10174", dup194); + +var msg12622 = msg("10175", dup194); + +var msg12623 = msg("10176", dup224); + +var msg12624 = msg("10177", dup224); + +var msg12625 = msg("10178", dup224); + +var msg12626 = msg("10179", dup303); + +var msg12627 = msg("10180", dup303); + +var msg12628 = msg("10181", dup303); + +var msg12629 = msg("10182", dup303); + +var msg12630 = msg("10183", dup303); + +var msg12631 = msg("10184", dup205); + +var msg12632 = msg("10185", dup205); + +var msg12633 = msg("10186", dup250); + +var msg12634 = msg("10187", dup197); + +var msg12635 = msg("10188", dup222); + +var msg12636 = msg("10189", dup265); + +var msg12637 = msg("10190", dup265); + +var msg12638 = msg("10191", dup265); + +var msg12639 = msg("10192", dup265); + +var msg12640 = msg("10193", dup265); + +var msg12641 = msg("10194", dup265); + +var msg12642 = msg("10195", dup267); + +var msg12643 = msg("10196", dup205); + +var msg12644 = msg("10197", dup205); + +var msg12645 = msg("10198", dup276); + +var msg12646 = msg("10199", dup276); + +var msg12647 = msg("10200", dup276); + +var msg12648 = msg("10201", dup276); + +var msg12649 = msg("10202", dup194); + +var msg12650 = msg("10203", dup194); + +var msg12651 = msg("10204", dup194); + +var msg12652 = msg("10205", dup194); + +var msg12653 = msg("10206", dup194); + +var msg12654 = msg("10207", dup194); + +var msg12655 = msg("10208", dup276); + +var msg12656 = msg("10209", dup276); + +var msg12657 = msg("10210", dup276); + +var msg12658 = msg("10211", dup276); + +var msg12659 = msg("10212", dup276); + +var msg12660 = msg("10213", dup276); + +var msg12661 = msg("10214", dup265); + +var msg12662 = msg("10215", dup265); + +var msg12663 = msg("10216", dup265); + +var msg12664 = msg("10217", dup276); + +var msg12665 = msg("10218", dup276); + +var msg12666 = msg("10219", dup276); + +var msg12667 = msg("10220", dup276); + +var msg12668 = msg("10221", dup276); + +var msg12669 = msg("10222", dup276); + +var msg12670 = msg("10223", dup276); + +var msg12671 = msg("10224", dup276); + +var msg12672 = msg("10225", dup276); + +var msg12673 = msg("10226", dup276); + +var msg12674 = msg("10227", dup276); + +var msg12675 = msg("10228", dup276); + +var msg12676 = msg("10229", dup276); + +var msg12677 = msg("10230", dup276); + +var msg12678 = msg("10231", dup276); + +var msg12679 = msg("10232", dup276); + +var msg12680 = msg("10233", dup276); + +var msg12681 = msg("10234", dup276); + +var msg12682 = msg("10235", dup276); + +var msg12683 = msg("10236", dup276); + +var msg12684 = msg("10237", dup276); + +var msg12685 = msg("10238", dup276); + +var msg12686 = msg("10239", dup276); + +var msg12687 = msg("10240", dup276); + +var msg12688 = msg("10241", dup276); + +var msg12689 = msg("10242", dup276); + +var msg12690 = msg("10243", dup276); + +var msg12691 = msg("10244", dup276); + +var msg12692 = msg("10245", dup276); + +var msg12693 = msg("10246", dup276); + +var msg12694 = msg("10247", dup276); + +var msg12695 = msg("10248", dup276); + +var msg12696 = msg("10249", dup276); + +var msg12697 = msg("10250", dup276); + +var msg12698 = msg("10251", dup276); + +var msg12699 = msg("10252", dup276); + +var msg12700 = msg("10253", dup276); + +var msg12701 = msg("10254", dup276); + +var msg12702 = msg("10255", dup276); + +var msg12703 = msg("10256", dup276); + +var msg12704 = msg("10257", dup276); + +var msg12705 = msg("10258", dup276); + +var msg12706 = msg("10259", dup276); + +var msg12707 = msg("10260", dup276); + +var msg12708 = msg("10261", dup276); + +var msg12709 = msg("10262", dup276); + +var msg12710 = msg("10263", dup276); + +var msg12711 = msg("10264", dup276); + +var msg12712 = msg("10265", dup276); + +var msg12713 = msg("10266", dup276); + +var msg12714 = msg("10267", dup276); + +var msg12715 = msg("10268", dup276); + +var msg12716 = msg("10269", dup276); + +var msg12717 = msg("10270", dup276); + +var msg12718 = msg("10271", dup276); + +var msg12719 = msg("10272", dup276); + +var msg12720 = msg("10273", dup276); + +var msg12721 = msg("10274", dup276); + +var msg12722 = msg("10275", dup276); + +var msg12723 = msg("10276", dup276); + +var msg12724 = msg("10277", dup276); + +var msg12725 = msg("10278", dup276); + +var msg12726 = msg("10279", dup276); + +var msg12727 = msg("10280", dup276); + +var msg12728 = msg("10281", dup276); + +var msg12729 = msg("10282", dup276); + +var msg12730 = msg("10283", dup276); + +var msg12731 = msg("10284", dup276); + +var msg12732 = msg("10285", dup276); + +var msg12733 = msg("10286", dup276); + +var msg12734 = msg("10287", dup276); + +var msg12735 = msg("10288", dup276); + +var msg12736 = msg("10289", dup276); + +var msg12737 = msg("10290", dup276); + +var msg12738 = msg("10291", dup276); + +var msg12739 = msg("10292", dup276); + +var msg12740 = msg("10293", dup276); + +var msg12741 = msg("10294", dup276); + +var msg12742 = msg("10295", dup276); + +var msg12743 = msg("10296", dup276); + +var msg12744 = msg("10297", dup276); + +var msg12745 = msg("10298", dup276); + +var msg12746 = msg("10299", dup276); + +var msg12747 = msg("10300", dup276); + +var msg12748 = msg("10301", dup276); + +var msg12749 = msg("10302", dup276); + +var msg12750 = msg("10303", dup276); + +var msg12751 = msg("10304", dup276); + +var msg12752 = msg("10305", dup276); + +var msg12753 = msg("10306", dup276); + +var msg12754 = msg("10307", dup276); + +var msg12755 = msg("10308", dup276); + +var msg12756 = msg("10309", dup276); + +var msg12757 = msg("10310", dup276); + +var msg12758 = msg("10311", dup276); + +var msg12759 = msg("10312", dup276); + +var msg12760 = msg("10313", dup276); + +var msg12761 = msg("10314", dup276); + +var msg12762 = msg("10315", dup276); + +var msg12763 = msg("10316", dup276); + +var msg12764 = msg("10317", dup276); + +var msg12765 = msg("10318", dup276); + +var msg12766 = msg("10319", dup276); + +var msg12767 = msg("10320", dup276); + +var msg12768 = msg("10321", dup276); + +var msg12769 = msg("10322", dup276); + +var msg12770 = msg("10323", dup276); + +var msg12771 = msg("10324", dup276); + +var msg12772 = msg("10325", dup276); + +var msg12773 = msg("10326", dup276); + +var msg12774 = msg("10327", dup276); + +var msg12775 = msg("10328", dup276); + +var msg12776 = msg("10329", dup276); + +var msg12777 = msg("10330", dup276); + +var msg12778 = msg("10331", dup276); + +var msg12779 = msg("10332", dup276); + +var msg12780 = msg("10333", dup276); + +var msg12781 = msg("10334", dup276); + +var msg12782 = msg("10335", dup276); + +var msg12783 = msg("10336", dup276); + +var msg12784 = msg("10337", dup276); + +var msg12785 = msg("10338", dup276); + +var msg12786 = msg("10339", dup276); + +var msg12787 = msg("10340", dup276); + +var msg12788 = msg("10341", dup276); + +var msg12789 = msg("10342", dup276); + +var msg12790 = msg("10343", dup276); + +var msg12791 = msg("10344", dup276); + +var msg12792 = msg("10345", dup276); + +var msg12793 = msg("10346", dup276); + +var msg12794 = msg("10347", dup276); + +var msg12795 = msg("10348", dup276); + +var msg12796 = msg("10349", dup276); + +var msg12797 = msg("10350", dup276); + +var msg12798 = msg("10351", dup276); + +var msg12799 = msg("10352", dup276); + +var msg12800 = msg("10353", dup276); + +var msg12801 = msg("10354", dup276); + +var msg12802 = msg("10355", dup276); + +var msg12803 = msg("10356", dup276); + +var msg12804 = msg("10357", dup276); + +var msg12805 = msg("10358", dup276); + +var msg12806 = msg("10359", dup276); + +var msg12807 = msg("10360", dup276); + +var msg12808 = msg("10361", dup276); + +var msg12809 = msg("10362", dup276); + +var msg12810 = msg("10363", dup276); + +var msg12811 = msg("10364", dup276); + +var msg12812 = msg("10365", dup276); + +var msg12813 = msg("10366", dup276); + +var msg12814 = msg("10367", dup276); + +var msg12815 = msg("10368", dup276); + +var msg12816 = msg("10369", dup276); + +var msg12817 = msg("10370", dup276); + +var msg12818 = msg("10371", dup276); + +var msg12819 = msg("10372", dup276); + +var msg12820 = msg("10373", dup276); + +var msg12821 = msg("10374", dup276); + +var msg12822 = msg("10375", dup276); + +var msg12823 = msg("10376", dup276); + +var msg12824 = msg("10377", dup276); + +var msg12825 = msg("10378", dup276); + +var msg12826 = msg("10379", dup276); + +var msg12827 = msg("10380", dup276); + +var msg12828 = msg("10381", dup276); + +var msg12829 = msg("10382", dup276); + +var msg12830 = msg("10383", dup276); + +var msg12831 = msg("10384", dup276); + +var msg12832 = msg("10385", dup276); + +var msg12833 = msg("10386", dup276); + +var msg12834 = msg("10387", dup265); + +var msg12835 = msg("10388", dup265); + +var msg12836 = msg("10389", dup265); + +var msg12837 = msg("10390", dup265); + +var msg12838 = msg("10391", dup265); + +var msg12839 = msg("10392", dup265); + +var msg12840 = msg("10393", dup265); + +var msg12841 = msg("10394", dup265); + +var msg12842 = msg("10395", dup265); + +var msg12843 = msg("10396", dup265); + +var msg12844 = msg("10397", dup265); + +var msg12845 = msg("10398", dup265); + +var msg12846 = msg("10399", dup265); + +var msg12847 = msg("10400", dup265); + +var msg12848 = msg("10401", dup265); + +var msg12849 = msg("10402", dup192); + +var msg12850 = msg("10403", dup192); + +var msg12851 = msg("10404", dup265); + +var msg12852 = msg("10405", dup265); + +var msg12853 = msg("10406", dup265); + +var msg12854 = msg("10407", dup222); + +var msg12855 = msg("10408", dup287); + +var msg12856 = msg("10409", dup258); + +var msg12857 = msg("10410", dup287); + +var msg12858 = msg("10411", dup258); + +var msg12859 = msg("10412", dup265); + +var msg12860 = msg("10413", dup265); + +var msg12861 = msg("10414", dup265); + +var msg12862 = msg("10415", dup265); + +var msg12863 = msg("10416", dup265); + +var msg12864 = msg("10417", dup265); + +var msg12865 = msg("10418", dup196); + +var msg12866 = msg("10419", dup265); + +var msg12867 = msg("10420", dup265); + +var msg12868 = msg("10421", dup265); + +var msg12869 = msg("10422", dup265); + +var msg12870 = msg("10423", dup265); + +var msg12871 = msg("10424", dup265); + +var msg12872 = msg("10425", dup265); + +var msg12873 = msg("10426", dup265); + +var msg12874 = msg("10427", dup194); + +var msg12875 = msg("10428", dup194); + +var msg12876 = msg("10429", dup194); + +var msg12877 = msg("10430", dup194); + +var msg12878 = msg("10431", dup194); + +var msg12879 = msg("10432", dup194); + +var msg12880 = msg("10433", dup194); + +var msg12881 = msg("10434", dup194); + +var msg12882 = msg("10435", dup303); + +var msg12883 = msg("10436", dup303); + +var msg12884 = msg("10437", dup303); + +var msg12885 = msg("10438", dup303); + +var msg12886 = msg("10439", dup303); + +var msg12887 = msg("10440", dup303); + +var msg12888 = msg("10441", dup303); + +var msg12889 = msg("10442", dup192); + +var msg12890 = msg("10443", dup192); + +var msg12891 = msg("10444", dup192); + +var msg12892 = msg("10445", dup192); + +var msg12893 = msg("10446", dup192); + +var msg12894 = msg("10447", dup192); + +var msg12895 = msg("10448", dup192); + +var msg12896 = msg("10449", dup192); + +var msg12897 = msg("10450", dup192); + +var msg12898 = msg("10451", dup192); + +var msg12899 = msg("10452", dup192); + +var msg12900 = msg("10453", dup192); + +var msg12901 = msg("10454", dup192); + +var msg12902 = msg("10455", dup192); + +var msg12903 = msg("10456", dup192); + +var msg12904 = msg("10457", dup192); + +var msg12905 = msg("10458", dup192); + +var msg12906 = msg("10459", dup192); + +var msg12907 = msg("10460", dup192); + +var msg12908 = msg("10461", dup192); + +var msg12909 = msg("10462", dup192); + +var msg12910 = msg("10463", dup192); + +var msg12911 = msg("10464", dup285); + +var msg12912 = msg("10465", dup265); + +var msg12913 = msg("10466", dup265); + +var msg12914 = msg("10467", dup265); + +var msg12915 = msg("10468", dup265); + +var msg12916 = msg("10469", dup265); + +var msg12917 = msg("10470", dup265); + +var msg12918 = msg("10471", dup265); + +var msg12919 = msg("10472", dup265); + +var msg12920 = msg("10473", dup265); + +var msg12921 = msg("10474", dup265); + +var msg12922 = msg("10475", dup222); + +var msg12923 = msg("10476", dup265); + +var msg12924 = msg("10477", dup265); + +var msg12925 = msg("10478", dup265); + +var msg12926 = msg("10479", dup265); + +var msg12927 = msg("10480", dup222); + +var msg12928 = msg("10481", dup222); + +var msg12929 = msg("10482", dup287); + +var msg12930 = msg("10483", dup258); + +var msg12931 = msg("10484", dup287); + +var msg12932 = msg("10485", dup258); + +var msg12933 = msg("10486", dup276); + +var msg12934 = msg("10487", dup276); + +var msg12935 = msg("10488", dup276); + +var msg12936 = msg("10489", dup276); + +var msg12937 = msg("10490", dup276); + +var msg12938 = msg("10491", dup276); + +var msg12939 = msg("10492", dup276); + +var msg12940 = msg("10493", dup276); + +var msg12941 = msg("10494", dup276); + +var msg12942 = msg("10495", dup276); + +var msg12943 = msg("10496", dup276); + +var msg12944 = msg("10497", dup276); + +var msg12945 = msg("10498", dup276); + +var msg12946 = msg("10499", dup276); + +var msg12947 = msg("10500", dup276); + +var msg12948 = msg("10501", dup276); + +var msg12949 = msg("10502", dup276); + +var msg12950 = msg("10503", dup276); + +var msg12951 = msg("10504", dup196); + +var msg12952 = msg("10505", dup196); + +var msg12953 = msg("10506", dup196); + +var msg12954 = msg("10507", dup196); + +var msg12955 = msg("10508", dup196); + +var msg12956 = msg("10509", dup196); + +var msg12957 = msg("10510", dup196); + +var msg12958 = msg("10511", dup196); + +var msg12959 = msg("10512", dup196); + +var msg12960 = msg("10513", dup196); + +var msg12961 = msg("10514", dup276); + +var msg12962 = msg("10515", dup276); + +var msg12963 = msg("10516", dup276); + +var msg12964 = msg("10517", dup276); + +var msg12965 = msg("10518", dup276); + +var msg12966 = msg("10519", dup276); + +var msg12967 = msg("10520", dup276); + +var msg12968 = msg("10521", dup276); + +var msg12969 = msg("10522", dup276); + +var msg12970 = msg("10523", dup276); + +var msg12971 = msg("10524", dup276); + +var msg12972 = msg("10525", dup276); + +var msg12973 = msg("10526", dup276); + +var msg12974 = msg("10527", dup276); + +var msg12975 = msg("10528", dup276); + +var msg12976 = msg("10529", dup276); + +var msg12977 = msg("10530", dup276); + +var msg12978 = msg("10531", dup276); + +var msg12979 = msg("10532", dup276); + +var msg12980 = msg("10533", dup276); + +var msg12981 = msg("10534", dup276); + +var msg12982 = msg("10535", dup276); + +var msg12983 = msg("10536", dup276); + +var msg12984 = msg("10537", dup276); + +var msg12985 = msg("10538", dup276); + +var msg12986 = msg("10539", dup276); + +var msg12987 = msg("10540", dup276); + +var msg12988 = msg("10541", dup276); + +var msg12989 = msg("10542", dup276); + +var msg12990 = msg("10543", dup276); + +var msg12991 = msg("10544", dup276); + +var msg12992 = msg("10545", dup276); + +var msg12993 = msg("10546", dup276); + +var msg12994 = msg("10547", dup276); + +var msg12995 = msg("10548", dup276); + +var msg12996 = msg("10549", dup276); + +var msg12997 = msg("10550", dup276); + +var msg12998 = msg("10551", dup276); + +var msg12999 = msg("10552", dup276); + +var msg13000 = msg("10553", dup276); + +var msg13001 = msg("10554", dup276); + +var msg13002 = msg("10555", dup276); + +var msg13003 = msg("10556", dup276); + +var msg13004 = msg("10557", dup276); + +var msg13005 = msg("10558", dup276); + +var msg13006 = msg("10559", dup276); + +var msg13007 = msg("10560", dup276); + +var msg13008 = msg("10561", dup276); + +var msg13009 = msg("10562", dup276); + +var msg13010 = msg("10563", dup276); + +var msg13011 = msg("10564", dup276); + +var msg13012 = msg("10565", dup276); + +var msg13013 = msg("10566", dup276); + +var msg13014 = msg("10567", dup276); + +var msg13015 = msg("10568", dup276); + +var msg13016 = msg("10569", dup276); + +var msg13017 = msg("10570", dup276); + +var msg13018 = msg("10571", dup276); + +var msg13019 = msg("10572", dup276); + +var msg13020 = msg("10573", dup276); + +var msg13021 = msg("10574", dup276); + +var msg13022 = msg("10575", dup276); + +var msg13023 = msg("10576", dup276); + +var msg13024 = msg("10577", dup276); + +var msg13025 = msg("10578", dup276); + +var msg13026 = msg("10579", dup276); + +var msg13027 = msg("10580", dup276); + +var msg13028 = msg("10581", dup276); + +var msg13029 = msg("10582", dup276); + +var msg13030 = msg("10583", dup276); + +var msg13031 = msg("10584", dup276); + +var msg13032 = msg("10585", dup276); + +var msg13033 = msg("10586", dup276); + +var msg13034 = msg("10587", dup276); + +var msg13035 = msg("10588", dup276); + +var msg13036 = msg("10589", dup276); + +var msg13037 = msg("10590", dup276); + +var msg13038 = msg("10591", dup276); + +var msg13039 = msg("10592", dup276); + +var msg13040 = msg("10593", dup276); + +var msg13041 = msg("10594", dup276); + +var msg13042 = msg("10595", dup276); + +var msg13043 = msg("10596", dup276); + +var msg13044 = msg("10597", dup276); + +var msg13045 = msg("10598", dup276); + +var msg13046 = msg("10599", dup276); + +var msg13047 = msg("10600", dup276); + +var msg13048 = msg("10601", dup276); + +var msg13049 = msg("10602", dup276); + +var msg13050 = msg("10603", dup276); + +var msg13051 = msg("10604", dup276); + +var msg13052 = msg("10605", dup276); + +var msg13053 = msg("10606", dup276); + +var msg13054 = msg("10607", dup276); + +var msg13055 = msg("10608", dup276); + +var msg13056 = msg("10609", dup276); + +var msg13057 = msg("10610", dup276); + +var msg13058 = msg("10611", dup276); + +var msg13059 = msg("10612", dup276); + +var msg13060 = msg("10613", dup276); + +var msg13061 = msg("10614", dup276); + +var msg13062 = msg("10615", dup276); + +var msg13063 = msg("10616", dup276); + +var msg13064 = msg("10617", dup276); + +var msg13065 = msg("10618", dup276); + +var msg13066 = msg("10619", dup276); + +var msg13067 = msg("10620", dup276); + +var msg13068 = msg("10621", dup276); + +var msg13069 = msg("10622", dup276); + +var msg13070 = msg("10623", dup276); + +var msg13071 = msg("10624", dup276); + +var msg13072 = msg("10625", dup276); + +var msg13073 = msg("10626", dup276); + +var msg13074 = msg("10627", dup276); + +var msg13075 = msg("10628", dup276); + +var msg13076 = msg("10629", dup276); + +var msg13077 = msg("10630", dup276); + +var msg13078 = msg("10631", dup276); + +var msg13079 = msg("10632", dup276); + +var msg13080 = msg("10633", dup276); + +var msg13081 = msg("10634", dup276); + +var msg13082 = msg("10635", dup276); + +var msg13083 = msg("10636", dup276); + +var msg13084 = msg("10637", dup276); + +var msg13085 = msg("10638", dup276); + +var msg13086 = msg("10639", dup276); + +var msg13087 = msg("10640", dup276); + +var msg13088 = msg("10641", dup276); + +var msg13089 = msg("10642", dup276); + +var msg13090 = msg("10643", dup276); + +var msg13091 = msg("10644", dup276); + +var msg13092 = msg("10645", dup276); + +var msg13093 = msg("10646", dup276); + +var msg13094 = msg("10647", dup276); + +var msg13095 = msg("10648", dup276); + +var msg13096 = msg("10649", dup276); + +var msg13097 = msg("10650", dup276); + +var msg13098 = msg("10651", dup276); + +var msg13099 = msg("10652", dup276); + +var msg13100 = msg("10653", dup276); + +var msg13101 = msg("10654", dup276); + +var msg13102 = msg("10655", dup276); + +var msg13103 = msg("10656", dup276); + +var msg13104 = msg("10657", dup276); + +var msg13105 = msg("10658", dup276); + +var msg13106 = msg("10659", dup276); + +var msg13107 = msg("10660", dup276); + +var msg13108 = msg("10661", dup276); + +var msg13109 = msg("10662", dup276); + +var msg13110 = msg("10663", dup276); + +var msg13111 = msg("10664", dup276); + +var msg13112 = msg("10665", dup276); + +var msg13113 = msg("10666", dup276); + +var msg13114 = msg("10667", dup276); + +var msg13115 = msg("10668", dup276); + +var msg13116 = msg("10669", dup276); + +var msg13117 = msg("10670", dup201); + +var msg13118 = msg("10671", dup276); + +var msg13119 = msg("10672", dup276); + +var msg13120 = msg("10673", dup201); + +var msg13121 = msg("10674", dup276); + +var msg13122 = msg("10675", dup201); + +var msg13123 = msg("10676", dup201); + +var msg13124 = msg("10677", dup201); + +var msg13125 = msg("10678", dup276); + +var msg13126 = msg("10679", dup276); + +var msg13127 = msg("10680", dup201); + +var msg13128 = msg("10681", dup276); + +var msg13129 = msg("10682", dup276); + +var msg13130 = msg("10683", dup201); + +var msg13131 = msg("10684", dup201); + +var msg13132 = msg("10685", dup276); + +var msg13133 = msg("10686", dup276); + +var msg13134 = msg("10687", dup276); + +var msg13135 = msg("10688", dup276); + +var msg13136 = msg("10689", dup201); + +var msg13137 = msg("10690", dup276); + +var msg13138 = msg("10691", dup201); + +var msg13139 = msg("10692", dup276); + +var msg13140 = msg("10693", dup276); + +var msg13141 = msg("10694", dup201); + +var msg13142 = msg("10695", dup201); + +var msg13143 = msg("10696", dup276); + +var msg13144 = msg("10697", dup276); + +var msg13145 = msg("10698", dup276); + +var msg13146 = msg("10699", dup276); + +var msg13147 = msg("10700", dup276); + +var msg13148 = msg("10701", dup276); + +var msg13149 = msg("10702", dup276); + +var msg13150 = msg("10703", dup276); + +var msg13151 = msg("10704", dup276); + +var msg13152 = msg("10705", dup276); + +var msg13153 = msg("10706", dup276); + +var msg13154 = msg("10707", dup276); + +var msg13155 = msg("10708", dup276); + +var msg13156 = msg("10709", dup276); + +var msg13157 = msg("10710", dup276); + +var msg13158 = msg("10711", dup276); + +var msg13159 = msg("10712", dup276); + +var msg13160 = msg("10713", dup276); + +var msg13161 = msg("10714", dup276); + +var msg13162 = msg("10715", dup276); + +var msg13163 = msg("10716", dup276); + +var msg13164 = msg("10717", dup276); + +var msg13165 = msg("10718", dup276); + +var msg13166 = msg("10719", dup276); + +var msg13167 = msg("10720", dup276); + +var msg13168 = msg("10721", dup276); + +var msg13169 = msg("10722", dup276); + +var msg13170 = msg("10723", dup276); + +var msg13171 = msg("10724", dup276); + +var msg13172 = msg("10725", dup276); + +var msg13173 = msg("10726", dup276); + +var msg13174 = msg("10727", dup276); + +var msg13175 = msg("10728", dup276); + +var msg13176 = msg("10729", dup276); + +var msg13177 = msg("10730", dup276); + +var msg13178 = msg("10731", dup276); + +var msg13179 = msg("10732", dup276); + +var msg13180 = msg("10733", dup276); + +var msg13181 = msg("10734", dup276); + +var msg13182 = msg("10735", dup276); + +var msg13183 = msg("10736", dup276); + +var msg13184 = msg("10737", dup276); + +var msg13185 = msg("10738", dup276); + +var msg13186 = msg("10739", dup276); + +var msg13187 = msg("10740", dup276); + +var msg13188 = msg("10741", dup276); + +var msg13189 = msg("10742", dup276); + +var msg13190 = msg("10743", dup276); + +var msg13191 = msg("10744", dup276); + +var msg13192 = msg("10745", dup276); + +var msg13193 = msg("10746", dup276); + +var msg13194 = msg("10747", dup276); + +var msg13195 = msg("10748", dup276); + +var msg13196 = msg("10749", dup276); + +var msg13197 = msg("10750", dup276); + +var msg13198 = msg("10751", dup276); + +var msg13199 = msg("10752", dup276); + +var msg13200 = msg("10753", dup276); + +var msg13201 = msg("10754", dup276); + +var msg13202 = msg("10755", dup276); + +var msg13203 = msg("10756", dup276); + +var msg13204 = msg("10757", dup276); + +var msg13205 = msg("10758", dup276); + +var msg13206 = msg("10759", dup276); + +var msg13207 = msg("10760", dup276); + +var msg13208 = msg("10761", dup276); + +var msg13209 = msg("10762", dup276); + +var msg13210 = msg("10763", dup276); + +var msg13211 = msg("10764", dup276); + +var msg13212 = msg("10765", dup276); + +var msg13213 = msg("10766", dup276); + +var msg13214 = msg("10767", dup276); + +var msg13215 = msg("10768", dup276); + +var msg13216 = msg("10769", dup276); + +var msg13217 = msg("10770", dup276); + +var msg13218 = msg("10771", dup276); + +var msg13219 = msg("10772", dup276); + +var msg13220 = msg("10773", dup276); + +var msg13221 = msg("10774", dup276); + +var msg13222 = msg("10775", dup276); + +var msg13223 = msg("10776", dup276); + +var msg13224 = msg("10777", dup276); + +var msg13225 = msg("10778", dup276); + +var msg13226 = msg("10779", dup276); + +var msg13227 = msg("10780", dup276); + +var msg13228 = msg("10781", dup276); + +var msg13229 = msg("10782", dup276); + +var msg13230 = msg("10783", dup276); + +var msg13231 = msg("10784", dup276); + +var msg13232 = msg("10785", dup276); + +var msg13233 = msg("10786", dup276); + +var msg13234 = msg("10787", dup276); + +var msg13235 = msg("10788", dup276); + +var msg13236 = msg("10789", dup276); + +var msg13237 = msg("10790", dup276); + +var msg13238 = msg("10791", dup276); + +var msg13239 = msg("10792", dup276); + +var msg13240 = msg("10793", dup276); + +var msg13241 = msg("10794", dup276); + +var msg13242 = msg("10795", dup276); + +var msg13243 = msg("10796", dup276); + +var msg13244 = msg("10797", dup276); + +var msg13245 = msg("10798", dup276); + +var msg13246 = msg("10799", dup276); + +var msg13247 = msg("10800", dup276); + +var msg13248 = msg("10801", dup276); + +var msg13249 = msg("10802", dup276); + +var msg13250 = msg("10803", dup276); + +var msg13251 = msg("10804", dup276); + +var msg13252 = msg("10805", dup276); + +var msg13253 = msg("10806", dup276); + +var msg13254 = msg("10807", dup276); + +var msg13255 = msg("10808", dup276); + +var msg13256 = msg("10809", dup276); + +var msg13257 = msg("10810", dup276); + +var msg13258 = msg("10811", dup276); + +var msg13259 = msg("10812", dup276); + +var msg13260 = msg("10813", dup276); + +var msg13261 = msg("10814", dup276); + +var msg13262 = msg("10815", dup276); + +var msg13263 = msg("10816", dup276); + +var msg13264 = msg("10817", dup276); + +var msg13265 = msg("10818", dup276); + +var msg13266 = msg("10819", dup276); + +var msg13267 = msg("10820", dup276); + +var msg13268 = msg("10821", dup276); + +var msg13269 = msg("10822", dup276); + +var msg13270 = msg("10823", dup276); + +var msg13271 = msg("10824", dup276); + +var msg13272 = msg("10825", dup276); + +var msg13273 = msg("10826", dup276); + +var msg13274 = msg("10827", dup276); + +var msg13275 = msg("10828", dup276); + +var msg13276 = msg("10829", dup276); + +var msg13277 = msg("10830", dup276); + +var msg13278 = msg("10831", dup276); + +var msg13279 = msg("10832", dup276); + +var msg13280 = msg("10833", dup276); + +var msg13281 = msg("10834", dup276); + +var msg13282 = msg("10835", dup276); + +var msg13283 = msg("10836", dup276); + +var msg13284 = msg("10837", dup276); + +var msg13285 = msg("10838", dup276); + +var msg13286 = msg("10839", dup276); + +var msg13287 = msg("10840", dup276); + +var msg13288 = msg("10841", dup276); + +var msg13289 = msg("10842", dup276); + +var msg13290 = msg("10843", dup276); + +var msg13291 = msg("10844", dup276); + +var msg13292 = msg("10845", dup276); + +var msg13293 = msg("10846", dup276); + +var msg13294 = msg("10847", dup276); + +var msg13295 = msg("10848", dup276); + +var msg13296 = msg("10849", dup276); + +var msg13297 = msg("10850", dup276); + +var msg13298 = msg("10851", dup276); + +var msg13299 = msg("10852", dup276); + +var msg13300 = msg("10853", dup276); + +var msg13301 = msg("10854", dup276); + +var msg13302 = msg("10855", dup276); + +var msg13303 = msg("10856", dup276); + +var msg13304 = msg("10857", dup276); + +var msg13305 = msg("10858", dup276); + +var msg13306 = msg("10859", dup276); + +var msg13307 = msg("10860", dup276); + +var msg13308 = msg("10861", dup276); + +var msg13309 = msg("10862", dup276); + +var msg13310 = msg("10863", dup276); + +var msg13311 = msg("10864", dup276); + +var msg13312 = msg("10865", dup276); + +var msg13313 = msg("10866", dup276); + +var msg13314 = msg("10867", dup276); + +var msg13315 = msg("10868", dup276); + +var msg13316 = msg("10869", dup276); + +var msg13317 = msg("10870", dup276); + +var msg13318 = msg("10871", dup276); + +var msg13319 = msg("10872", dup276); + +var msg13320 = msg("10873", dup276); + +var msg13321 = msg("10874", dup276); + +var msg13322 = msg("10875", dup276); + +var msg13323 = msg("10876", dup276); + +var msg13324 = msg("10877", dup276); + +var msg13325 = msg("10878", dup276); + +var msg13326 = msg("10879", dup276); + +var msg13327 = msg("10880", dup276); + +var msg13328 = msg("10881", dup276); + +var msg13329 = msg("10882", dup276); + +var msg13330 = msg("10883", dup276); + +var msg13331 = msg("10884", dup276); + +var msg13332 = msg("10885", dup276); + +var msg13333 = msg("10886", dup276); + +var msg13334 = msg("10887", dup276); + +var msg13335 = msg("10888", dup276); + +var msg13336 = msg("10889", dup276); + +var msg13337 = msg("10890", dup276); + +var msg13338 = msg("10891", dup276); + +var msg13339 = msg("10892", dup276); + +var msg13340 = msg("10893", dup276); + +var msg13341 = msg("10894", dup276); + +var msg13342 = msg("10895", dup276); + +var msg13343 = msg("10896", dup276); + +var msg13344 = msg("10897", dup276); + +var msg13345 = msg("10898", dup276); + +var msg13346 = msg("10899", dup276); + +var msg13347 = msg("10900", dup276); + +var msg13348 = msg("10901", dup276); + +var msg13349 = msg("10902", dup276); + +var msg13350 = msg("10903", dup276); + +var msg13351 = msg("10904", dup276); + +var msg13352 = msg("10905", dup276); + +var msg13353 = msg("10906", dup276); + +var msg13354 = msg("10907", dup276); + +var msg13355 = msg("10908", dup276); + +var msg13356 = msg("10909", dup276); + +var msg13357 = msg("10910", dup276); + +var msg13358 = msg("10911", dup276); + +var msg13359 = msg("10912", dup276); + +var msg13360 = msg("10913", dup276); + +var msg13361 = msg("10914", dup276); + +var msg13362 = msg("10915", dup276); + +var msg13363 = msg("10916", dup276); + +var msg13364 = msg("10917", dup276); + +var msg13365 = msg("10918", dup276); + +var msg13366 = msg("10919", dup276); + +var msg13367 = msg("10920", dup276); + +var msg13368 = msg("10921", dup276); + +var msg13369 = msg("10922", dup276); + +var msg13370 = msg("10923", dup276); + +var msg13371 = msg("10924", dup276); + +var msg13372 = msg("10925", dup276); + +var msg13373 = msg("10926", dup276); + +var msg13374 = msg("10927", dup276); + +var msg13375 = msg("10928", dup276); + +var msg13376 = msg("10929", dup276); + +var msg13377 = msg("10930", dup276); + +var msg13378 = msg("10931", dup276); + +var msg13379 = msg("10932", dup276); + +var msg13380 = msg("10933", dup276); + +var msg13381 = msg("10934", dup276); + +var msg13382 = msg("10935", dup276); + +var msg13383 = msg("10936", dup276); + +var msg13384 = msg("10937", dup276); + +var msg13385 = msg("10938", dup276); + +var msg13386 = msg("10939", dup276); + +var msg13387 = msg("10940", dup276); + +var msg13388 = msg("10941", dup276); + +var msg13389 = msg("10942", dup276); + +var msg13390 = msg("10943", dup276); + +var msg13391 = msg("10944", dup276); + +var msg13392 = msg("10945", dup276); + +var msg13393 = msg("10946", dup276); + +var msg13394 = msg("10947", dup276); + +var msg13395 = msg("10948", dup276); + +var msg13396 = msg("10949", dup276); + +var msg13397 = msg("10950", dup276); + +var msg13398 = msg("10951", dup276); + +var msg13399 = msg("10952", dup276); + +var msg13400 = msg("10953", dup276); + +var msg13401 = msg("10954", dup201); + +var msg13402 = msg("10955", dup201); + +var msg13403 = msg("10956", dup201); + +var msg13404 = msg("10957", dup201); + +var msg13405 = msg("10958", dup276); + +var msg13406 = msg("10959", dup201); + +var msg13407 = msg("10960", dup276); + +var msg13408 = msg("10961", dup276); + +var msg13409 = msg("10962", dup276); + +var msg13410 = msg("10963", dup276); + +var msg13411 = msg("10964", dup201); + +var msg13412 = msg("10965", dup276); + +var msg13413 = msg("10966", dup201); + +var msg13414 = msg("10967", dup201); + +var msg13415 = msg("10968", dup276); + +var msg13416 = msg("10969", dup276); + +var msg13417 = msg("10970", dup201); + +var msg13418 = msg("10971", dup201); + +var msg13419 = msg("10972", dup201); + +var msg13420 = msg("10973", dup201); + +var msg13421 = msg("10974", dup276); + +var msg13422 = msg("10975", dup276); + +var msg13423 = msg("10976", dup276); + +var msg13424 = msg("10977", dup276); + +var msg13425 = msg("10978", dup265); + +var msg13426 = msg("10979", dup265); + +var msg13427 = msg("10980", dup265); + +var msg13428 = msg("10981", dup265); + +var msg13429 = msg("10982", dup265); + +var msg13430 = msg("10983", dup265); + +var msg13431 = msg("10984", dup265); + +var msg13432 = msg("10985", dup265); + +var msg13433 = msg("10986", dup265); + +var msg13434 = msg("10987", dup265); + +var msg13435 = msg("10988", dup265); + +var msg13436 = msg("10989", dup265); + +var msg13437 = msg("10990", dup265); + +var msg13438 = msg("10991", dup265); + +var msg13439 = msg("10992", dup265); + +var msg13440 = msg("10993", dup265); + +var msg13441 = msg("10994", dup265); + +var msg13442 = msg("10995", dup198); + +var msg13443 = msg("10996", dup265); + +var msg13444 = msg("10997", dup267); + +var msg13445 = msg("10998", dup197); + +var msg13446 = msg("10999", dup265); + +var msg13447 = msg("11000", dup222); + +var msg13448 = msg("11001", dup222); + +var msg13449 = msg("11002", dup222); + +var msg13450 = msg("11003", dup222); + +var msg13451 = msg("11004", dup197); + +var msg13452 = msg("11005", dup276); + +var msg13453 = msg("11006", dup276); + +var msg13454 = msg("11007", dup276); + +var msg13455 = msg("11008", dup276); + +var msg13456 = msg("11009", dup276); + +var msg13457 = msg("11010", dup276); + +var msg13458 = msg("11011", dup276); + +var msg13459 = msg("11012", dup276); + +var msg13460 = msg("11013", dup276); + +var msg13461 = msg("11014", dup276); + +var msg13462 = msg("11015", dup276); + +var msg13463 = msg("11016", dup276); + +var msg13464 = msg("11017", dup276); + +var msg13465 = msg("11018", dup276); + +var msg13466 = msg("11019", dup276); + +var msg13467 = msg("11020", dup276); + +var msg13468 = msg("11021", dup276); + +var msg13469 = msg("11022", dup276); + +var msg13470 = msg("11023", dup276); + +var msg13471 = msg("11024", dup276); + +var msg13472 = msg("11025", dup276); + +var msg13473 = msg("11026", dup276); + +var msg13474 = msg("11027", dup276); + +var msg13475 = msg("11028", dup276); + +var msg13476 = msg("11029", dup276); + +var msg13477 = msg("11030", dup276); + +var msg13478 = msg("11031", dup276); + +var msg13479 = msg("11032", dup276); + +var msg13480 = msg("11033", dup276); + +var msg13481 = msg("11034", dup276); + +var msg13482 = msg("11035", dup276); + +var msg13483 = msg("11036", dup276); + +var msg13484 = msg("11037", dup276); + +var msg13485 = msg("11038", dup276); + +var msg13486 = msg("11039", dup276); + +var msg13487 = msg("11040", dup276); + +var msg13488 = msg("11041", dup276); + +var msg13489 = msg("11042", dup276); + +var msg13490 = msg("11043", dup276); + +var msg13491 = msg("11044", dup276); + +var msg13492 = msg("11045", dup276); + +var msg13493 = msg("11046", dup276); + +var msg13494 = msg("11047", dup276); + +var msg13495 = msg("11048", dup276); + +var msg13496 = msg("11049", dup276); + +var msg13497 = msg("11050", dup276); + +var msg13498 = msg("11051", dup276); + +var msg13499 = msg("11052", dup276); + +var msg13500 = msg("11053", dup276); + +var msg13501 = msg("11054", dup276); + +var msg13502 = msg("11055", dup276); + +var msg13503 = msg("11056", dup276); + +var msg13504 = msg("11057", dup276); + +var msg13505 = msg("11058", dup276); + +var msg13506 = msg("11059", dup276); + +var msg13507 = msg("11060", dup276); + +var msg13508 = msg("11061", dup276); + +var msg13509 = msg("11062", dup276); + +var msg13510 = msg("11063", dup276); + +var msg13511 = msg("11064", dup276); + +var msg13512 = msg("11065", dup276); + +var msg13513 = msg("11066", dup276); + +var msg13514 = msg("11067", dup276); + +var msg13515 = msg("11068", dup276); + +var msg13516 = msg("11069", dup276); + +var msg13517 = msg("11070", dup276); + +var msg13518 = msg("11071", dup276); + +var msg13519 = msg("11072", dup276); + +var msg13520 = msg("11073", dup276); + +var msg13521 = msg("11074", dup276); + +var msg13522 = msg("11075", dup276); + +var msg13523 = msg("11076", dup276); + +var msg13524 = msg("11077", dup276); + +var msg13525 = msg("11078", dup276); + +var msg13526 = msg("11079", dup276); + +var msg13527 = msg("11080", dup276); + +var msg13528 = msg("11081", dup276); + +var msg13529 = msg("11082", dup276); + +var msg13530 = msg("11083", dup276); + +var msg13531 = msg("11084", dup276); + +var msg13532 = msg("11085", dup276); + +var msg13533 = msg("11086", dup276); + +var msg13534 = msg("11087", dup276); + +var msg13535 = msg("11088", dup276); + +var msg13536 = msg("11089", dup276); + +var msg13537 = msg("11090", dup276); + +var msg13538 = msg("11091", dup276); + +var msg13539 = msg("11092", dup276); + +var msg13540 = msg("11093", dup276); + +var msg13541 = msg("11094", dup276); + +var msg13542 = msg("11095", dup276); + +var msg13543 = msg("11096", dup276); + +var msg13544 = msg("11097", dup276); + +var msg13545 = msg("11098", dup276); + +var msg13546 = msg("11099", dup276); + +var msg13547 = msg("11100", dup276); + +var msg13548 = msg("11101", dup276); + +var msg13549 = msg("11102", dup276); + +var msg13550 = msg("11103", dup276); + +var msg13551 = msg("11104", dup276); + +var msg13552 = msg("11105", dup276); + +var msg13553 = msg("11106", dup276); + +var msg13554 = msg("11107", dup276); + +var msg13555 = msg("11108", dup276); + +var msg13556 = msg("11109", dup276); + +var msg13557 = msg("11110", dup276); + +var msg13558 = msg("11111", dup276); + +var msg13559 = msg("11112", dup276); + +var msg13560 = msg("11113", dup276); + +var msg13561 = msg("11114", dup276); + +var msg13562 = msg("11115", dup276); + +var msg13563 = msg("11116", dup276); + +var msg13564 = msg("11117", dup276); + +var msg13565 = msg("11118", dup276); + +var msg13566 = msg("11119", dup276); + +var msg13567 = msg("11120", dup276); + +var msg13568 = msg("11121", dup276); + +var msg13569 = msg("11122", dup276); + +var msg13570 = msg("11123", dup276); + +var msg13571 = msg("11124", dup276); + +var msg13572 = msg("11125", dup276); + +var msg13573 = msg("11126", dup276); + +var msg13574 = msg("11127", dup276); + +var msg13575 = msg("11128", dup276); + +var msg13576 = msg("11129", dup276); + +var msg13577 = msg("11130", dup276); + +var msg13578 = msg("11131", dup276); + +var msg13579 = msg("11132", dup276); + +var msg13580 = msg("11133", dup276); + +var msg13581 = msg("11134", dup276); + +var msg13582 = msg("11135", dup276); + +var msg13583 = msg("11136", dup276); + +var msg13584 = msg("11137", dup276); + +var msg13585 = msg("11138", dup276); + +var msg13586 = msg("11139", dup276); + +var msg13587 = msg("11140", dup276); + +var msg13588 = msg("11141", dup276); + +var msg13589 = msg("11142", dup276); + +var msg13590 = msg("11143", dup276); + +var msg13591 = msg("11144", dup276); + +var msg13592 = msg("11145", dup276); + +var msg13593 = msg("11146", dup276); + +var msg13594 = msg("11147", dup276); + +var msg13595 = msg("11148", dup276); + +var msg13596 = msg("11149", dup276); + +var msg13597 = msg("11150", dup276); + +var msg13598 = msg("11151", dup276); + +var msg13599 = msg("11152", dup276); + +var msg13600 = msg("11153", dup276); + +var msg13601 = msg("11154", dup276); + +var msg13602 = msg("11155", dup276); + +var msg13603 = msg("11156", dup276); + +var msg13604 = msg("11157", dup276); + +var msg13605 = msg("11158", dup276); + +var msg13606 = msg("11159", dup276); + +var msg13607 = msg("11160", dup276); + +var msg13608 = msg("11161", dup276); + +var msg13609 = msg("11162", dup276); + +var msg13610 = msg("11163", dup276); + +var msg13611 = msg("11164", dup276); + +var msg13612 = msg("11165", dup276); + +var msg13613 = msg("11166", dup276); + +var msg13614 = msg("11167", dup276); + +var msg13615 = msg("11168", dup276); + +var msg13616 = msg("11169", dup276); + +var msg13617 = msg("11170", dup276); + +var msg13618 = msg("11171", dup276); + +var msg13619 = msg("11172", dup276); + +var msg13620 = msg("11173", dup276); + +var msg13621 = msg("11174", dup276); + +var msg13622 = msg("11175", dup201); + +var msg13623 = msg("11176", dup265); + +var msg13624 = msg("11177", dup265); + +var msg13625 = msg("11178", dup265); + +var msg13626 = msg("11179", dup265); + +var msg13627 = msg("11180", dup196); + +var msg13628 = msg("11181", dup265); + +var msg13629 = msg("11182", dup265); + +var msg13630 = msg("11183", dup265); + +var msg13631 = msg("11184", dup265); + +var msg13632 = msg("11185", dup198); + +var msg13633 = msg("11186", dup198); + +var msg13634 = msg("11187", dup265); + +var msg13635 = msg("11188", dup265); + +var msg13636 = msg("11189", dup265); + +var msg13637 = msg("11190", dup265); + +var msg13638 = msg("11191", dup196); + +var msg13639 = msg("11192", dup196); + +var msg13640 = msg("11193", dup240); + +var msg13641 = msg("11194", dup240); + +var msg13642 = msg("11196", dup197); + +var msg13643 = msg("11197", dup265); + +var msg13644 = msg("11198", dup265); + +var msg13645 = msg("11199", dup265); + +var msg13646 = msg("11200", dup265); + +var msg13647 = msg("11201", dup265); + +var msg13648 = msg("11202", dup265); + +var msg13649 = msg("11203", dup196); + +var msg13650 = msg("11204", dup196); + +var msg13651 = msg("11205", dup196); + +var msg13652 = msg("11206", dup265); + +var msg13653 = msg("11207", dup265); + +var msg13654 = msg("11208", dup265); + +var msg13655 = msg("11209", dup265); + +var msg13656 = msg("11210", dup265); + +var msg13657 = msg("11211", dup265); + +var msg13658 = msg("11212", dup265); + +var msg13659 = msg("11213", dup265); + +var msg13660 = msg("11214", dup265); + +var msg13661 = msg("11215", dup265); + +var msg13662 = msg("11216", dup265); + +var msg13663 = msg("11217", dup265); + +var msg13664 = msg("11218", dup265); + +var msg13665 = msg("11219", dup265); + +var msg13666 = msg("11220", dup265); + +var msg13667 = msg("11221", dup265); + +var msg13668 = msg("11222", dup198); + +var msg13669 = msg("11223", dup269); + +var msg13670 = msg("11224", dup265); + +var msg13671 = msg("11225", dup265); + +var msg13672 = msg("11226", dup265); + +var msg13673 = msg("11227", dup265); + +var msg13674 = msg("11228", dup265); + +var msg13675 = msg("11229", dup265); + +var msg13676 = msg("11230", dup265); + +var msg13677 = msg("11231", dup265); + +var msg13678 = msg("11232", dup265); + +var msg13679 = msg("11233", dup265); + +var msg13680 = msg("11234", dup265); + +var msg13681 = msg("11235", dup265); + +var msg13682 = msg("11236", dup265); + +var msg13683 = msg("11237", dup265); + +var msg13684 = msg("11238", dup265); + +var msg13685 = msg("11239", dup265); + +var msg13686 = msg("11240", dup265); + +var msg13687 = msg("11241", dup265); + +var msg13688 = msg("11242", dup265); + +var msg13689 = msg("11243", dup265); + +var msg13690 = msg("11244", dup265); + +var msg13691 = msg("11245", dup265); + +var msg13692 = msg("11246", dup265); + +var msg13693 = msg("11247", dup265); + +var msg13694 = msg("11248", dup265); + +var msg13695 = msg("11249", dup265); + +var msg13696 = msg("11250", dup265); + +var msg13697 = msg("11251", dup265); + +var msg13698 = msg("11252", dup265); + +var msg13699 = msg("11253", dup265); + +var msg13700 = msg("11254", dup265); + +var msg13701 = msg("11255", dup265); + +var msg13702 = msg("11256", dup265); + +var msg13703 = msg("11257", dup267); + +var msg13704 = msg("11258", dup197); + +var msg13705 = msg("11259", dup265); + +var msg13706 = msg("11260", dup265); + +var msg13707 = msg("11261", dup265); + +var msg13708 = msg("11262", dup265); + +var msg13709 = msg("11263", dup198); + +var msg13710 = msg("11264", dup260); + +var msg13711 = msg("11265", dup222); + +var msg13712 = msg("11266", dup222); + +var msg13713 = msg("11267", dup267); + +var msg13714 = msg("11268", dup194); + +var msg13715 = msg("11269", dup194); + +var msg13716 = msg("11270", dup194); + +var msg13717 = msg("11271", dup194); + +var msg13718 = msg("11272", dup267); + +var msg13719 = msg("11273", dup198); + +var msg13720 = msg("11274", dup265); + +var msg13721 = msg("11275", dup265); + +var msg13722 = msg("11276", dup265); + +var msg13723 = msg("11277", dup265); + +var msg13724 = msg("11278", dup265); + +var msg13725 = msg("11279", dup265); + +var msg13726 = msg("11280", dup265); + +var msg13727 = msg("11281", dup265); + +var msg13728 = msg("11282", dup265); + +var msg13729 = msg("11283", dup265); + +var msg13730 = msg("11284", dup265); + +var msg13731 = msg("11285", dup265); + +var msg13732 = msg("11286", dup265); + +var msg13733 = msg("11287", dup265); + +var msg13734 = msg("11288", dup287); + +var msg13735 = msg("11289", dup198); + +var msg13736 = msg("11290", dup197); + +var msg13737 = msg("11291", dup265); + +var msg13738 = msg("11292", dup265); + +var msg13739 = msg("11293", dup265); + +var msg13740 = msg("11294", dup265); + +var msg13741 = msg("11295", dup265); + +var msg13742 = msg("11296", dup265); + +var msg13743 = msg("11297", dup265); + +var msg13744 = msg("11298", dup265); + +var msg13745 = msg("11299", dup265); + +var msg13746 = msg("11300", dup265); + +var msg13747 = msg("11301", dup265); + +var msg13748 = msg("11302", dup265); + +var msg13749 = msg("11303", dup265); + +var msg13750 = msg("11304", dup265); + +var msg13751 = msg("11305", dup303); + +var msg13752 = msg("11306", dup303); + +var msg13753 = msg("11307", dup303); + +var msg13754 = msg("11308", dup303); + +var msg13755 = msg("11309", dup303); + +var msg13756 = msg("11310", dup303); + +var msg13757 = msg("11311", dup303); + +var msg13758 = msg("11312", dup303); + +var msg13759 = msg("11313", dup303); + +var msg13760 = msg("11314", dup192); + +var msg13761 = msg("11315", dup192); + +var msg13762 = msg("11316", dup192); + +var msg13763 = msg("11317", dup192); + +var msg13764 = msg("11318", dup192); + +var msg13765 = msg("11319", dup192); + +var msg13766 = msg("11320", dup192); + +var msg13767 = msg("11321", dup192); + +var msg13768 = msg("11322", dup192); + +var msg13769 = msg("11323", dup192); + +var msg13770 = msg("11324", dup265); + +var msg13771 = msg("11325", dup265); + +var msg13772 = msg("11326", dup276); + +var msg13773 = msg("11327", dup276); + +var msg13774 = msg("11328", dup276); + +var msg13775 = msg("11329", dup276); + +var msg13776 = msg("11330", dup276); + +var msg13777 = msg("11331", dup276); + +var msg13778 = msg("11332", dup276); + +var msg13779 = msg("11333", dup276); + +var msg13780 = msg("11334", dup276); + +var msg13781 = msg("11335", dup276); + +var msg13782 = msg("11336", dup276); + +var msg13783 = msg("11337", dup276); + +var msg13784 = msg("11338", dup276); + +var msg13785 = msg("11339", dup276); + +var msg13786 = msg("11340", dup276); + +var msg13787 = msg("11341", dup276); + +var msg13788 = msg("11342", dup276); + +var msg13789 = msg("11343", dup276); + +var msg13790 = msg("11344", dup276); + +var msg13791 = msg("11345", dup276); + +var msg13792 = msg("11346", dup276); + +var msg13793 = msg("11347", dup276); + +var msg13794 = msg("11348", dup276); + +var msg13795 = msg("11349", dup276); + +var msg13796 = msg("11350", dup276); + +var msg13797 = msg("11351", dup276); + +var msg13798 = msg("11352", dup276); + +var msg13799 = msg("11353", dup276); + +var msg13800 = msg("11354", dup276); + +var msg13801 = msg("11355", dup276); + +var msg13802 = msg("11356", dup276); + +var msg13803 = msg("11357", dup276); + +var msg13804 = msg("11358", dup276); + +var msg13805 = msg("11359", dup276); + +var msg13806 = msg("11360", dup276); + +var msg13807 = msg("11361", dup276); + +var msg13808 = msg("11362", dup276); + +var msg13809 = msg("11363", dup276); + +var msg13810 = msg("11364", dup276); + +var msg13811 = msg("11365", dup276); + +var msg13812 = msg("11366", dup276); + +var msg13813 = msg("11367", dup276); + +var msg13814 = msg("11368", dup276); + +var msg13815 = msg("11369", dup276); + +var msg13816 = msg("11370", dup276); + +var msg13817 = msg("11371", dup276); + +var msg13818 = msg("11372", dup276); + +var msg13819 = msg("11373", dup276); + +var msg13820 = msg("11374", dup276); + +var msg13821 = msg("11375", dup276); + +var msg13822 = msg("11376", dup276); + +var msg13823 = msg("11377", dup276); + +var msg13824 = msg("11378", dup276); + +var msg13825 = msg("11379", dup276); + +var msg13826 = msg("11380", dup276); + +var msg13827 = msg("11381", dup276); + +var msg13828 = msg("11382", dup276); + +var msg13829 = msg("11383", dup276); + +var msg13830 = msg("11384", dup276); + +var msg13831 = msg("11385", dup276); + +var msg13832 = msg("11386", dup276); + +var msg13833 = msg("11387", dup276); + +var msg13834 = msg("11388", dup276); + +var msg13835 = msg("11389", dup276); + +var msg13836 = msg("11390", dup276); + +var msg13837 = msg("11391", dup276); + +var msg13838 = msg("11392", dup276); + +var msg13839 = msg("11393", dup276); + +var msg13840 = msg("11394", dup276); + +var msg13841 = msg("11395", dup276); + +var msg13842 = msg("11396", dup276); + +var msg13843 = msg("11397", dup276); + +var msg13844 = msg("11398", dup276); + +var msg13845 = msg("11399", dup276); + +var msg13846 = msg("11400", dup276); + +var msg13847 = msg("11401", dup276); + +var msg13848 = msg("11402", dup276); + +var msg13849 = msg("11403", dup276); + +var msg13850 = msg("11404", dup276); + +var msg13851 = msg("11405", dup276); + +var msg13852 = msg("11406", dup276); + +var msg13853 = msg("11407", dup276); + +var msg13854 = msg("11408", dup276); + +var msg13855 = msg("11409", dup276); + +var msg13856 = msg("11410", dup276); + +var msg13857 = msg("11411", dup276); + +var msg13858 = msg("11412", dup276); + +var msg13859 = msg("11413", dup276); + +var msg13860 = msg("11414", dup276); + +var msg13861 = msg("11415", dup276); + +var msg13862 = msg("11416", dup276); + +var msg13863 = msg("11417", dup276); + +var msg13864 = msg("11418", dup276); + +var msg13865 = msg("11419", dup276); + +var msg13866 = msg("11420", dup276); + +var msg13867 = msg("11421", dup276); + +var msg13868 = msg("11422", dup276); + +var msg13869 = msg("11423", dup276); + +var msg13870 = msg("11424", dup276); + +var msg13871 = msg("11425", dup276); + +var msg13872 = msg("11426", dup276); + +var msg13873 = msg("11427", dup276); + +var msg13874 = msg("11428", dup276); + +var msg13875 = msg("11429", dup276); + +var msg13876 = msg("11430", dup276); + +var msg13877 = msg("11431", dup276); + +var msg13878 = msg("11432", dup276); + +var msg13879 = msg("11433", dup276); + +var msg13880 = msg("11434", dup276); + +var msg13881 = msg("11435", dup276); + +var msg13882 = msg("11436", dup276); + +var msg13883 = msg("11437", dup276); + +var msg13884 = msg("11438", dup276); + +var msg13885 = msg("11439", dup276); + +var msg13886 = msg("11440", dup276); + +var msg13887 = msg("11441", dup276); + +var msg13888 = msg("11442", dup276); + +var msg13889 = msg("11443", dup276); + +var msg13890 = msg("11444", dup276); + +var msg13891 = msg("11445", dup276); + +var msg13892 = msg("11446", dup276); + +var msg13893 = msg("11447", dup276); + +var msg13894 = msg("11448", dup276); + +var msg13895 = msg("11449", dup276); + +var msg13896 = msg("11450", dup276); + +var msg13897 = msg("11451", dup276); + +var msg13898 = msg("11452", dup276); + +var msg13899 = msg("11453", dup276); + +var msg13900 = msg("11454", dup276); + +var msg13901 = msg("11455", dup276); + +var msg13902 = msg("11456", dup276); + +var msg13903 = msg("11457", dup276); + +var msg13904 = msg("11458", dup276); + +var msg13905 = msg("11459", dup276); + +var msg13906 = msg("11460", dup276); + +var msg13907 = msg("11461", dup276); + +var msg13908 = msg("11462", dup276); + +var msg13909 = msg("11463", dup276); + +var msg13910 = msg("11464", dup276); + +var msg13911 = msg("11465", dup276); + +var msg13912 = msg("11466", dup276); + +var msg13913 = msg("11467", dup276); + +var msg13914 = msg("11468", dup276); + +var msg13915 = msg("11469", dup276); + +var msg13916 = msg("11470", dup276); + +var msg13917 = msg("11471", dup276); + +var msg13918 = msg("11472", dup276); + +var msg13919 = msg("11473", dup276); + +var msg13920 = msg("11474", dup276); + +var msg13921 = msg("11475", dup276); + +var msg13922 = msg("11476", dup276); + +var msg13923 = msg("11477", dup276); + +var msg13924 = msg("11478", dup276); + +var msg13925 = msg("11479", dup276); + +var msg13926 = msg("11480", dup276); + +var msg13927 = msg("11481", dup276); + +var msg13928 = msg("11482", dup276); + +var msg13929 = msg("11483", dup276); + +var msg13930 = msg("11484", dup276); + +var msg13931 = msg("11485", dup276); + +var msg13932 = msg("11486", dup276); + +var msg13933 = msg("11487", dup276); + +var msg13934 = msg("11488", dup276); + +var msg13935 = msg("11489", dup276); + +var msg13936 = msg("11490", dup276); + +var msg13937 = msg("11491", dup276); + +var msg13938 = msg("11492", dup276); + +var msg13939 = msg("11493", dup276); + +var msg13940 = msg("11494", dup276); + +var msg13941 = msg("11495", dup276); + +var msg13942 = msg("11496", dup276); + +var msg13943 = msg("11497", dup276); + +var msg13944 = msg("11498", dup276); + +var msg13945 = msg("11499", dup276); + +var msg13946 = msg("11500", dup276); + +var msg13947 = msg("11501", dup276); + +var msg13948 = msg("11502", dup276); + +var msg13949 = msg("11503", dup276); + +var msg13950 = msg("11504", dup276); + +var msg13951 = msg("11505", dup276); + +var msg13952 = msg("11506", dup276); + +var msg13953 = msg("11507", dup276); + +var msg13954 = msg("11508", dup276); + +var msg13955 = msg("11509", dup276); + +var msg13956 = msg("11510", dup276); + +var msg13957 = msg("11511", dup276); + +var msg13958 = msg("11512", dup276); + +var msg13959 = msg("11513", dup276); + +var msg13960 = msg("11514", dup276); + +var msg13961 = msg("11515", dup276); + +var msg13962 = msg("11516", dup276); + +var msg13963 = msg("11517", dup276); + +var msg13964 = msg("11518", dup276); + +var msg13965 = msg("11519", dup276); + +var msg13966 = msg("11520", dup276); + +var msg13967 = msg("11521", dup276); + +var msg13968 = msg("11522", dup276); + +var msg13969 = msg("11523", dup276); + +var msg13970 = msg("11524", dup276); + +var msg13971 = msg("11525", dup276); + +var msg13972 = msg("11526", dup276); + +var msg13973 = msg("11527", dup276); + +var msg13974 = msg("11528", dup276); + +var msg13975 = msg("11529", dup276); + +var msg13976 = msg("11530", dup276); + +var msg13977 = msg("11531", dup276); + +var msg13978 = msg("11532", dup276); + +var msg13979 = msg("11533", dup276); + +var msg13980 = msg("11534", dup276); + +var msg13981 = msg("11535", dup276); + +var msg13982 = msg("11536", dup276); + +var msg13983 = msg("11537", dup276); + +var msg13984 = msg("11538", dup276); + +var msg13985 = msg("11539", dup276); + +var msg13986 = msg("11540", dup276); + +var msg13987 = msg("11541", dup276); + +var msg13988 = msg("11542", dup276); + +var msg13989 = msg("11543", dup276); + +var msg13990 = msg("11544", dup276); + +var msg13991 = msg("11545", dup276); + +var msg13992 = msg("11546", dup276); + +var msg13993 = msg("11547", dup276); + +var msg13994 = msg("11548", dup276); + +var msg13995 = msg("11549", dup276); + +var msg13996 = msg("11550", dup276); + +var msg13997 = msg("11551", dup276); + +var msg13998 = msg("11552", dup276); + +var msg13999 = msg("11553", dup276); + +var msg14000 = msg("11554", dup276); + +var msg14001 = msg("11555", dup276); + +var msg14002 = msg("11556", dup276); + +var msg14003 = msg("11557", dup276); + +var msg14004 = msg("11558", dup276); + +var msg14005 = msg("11559", dup276); + +var msg14006 = msg("11560", dup276); + +var msg14007 = msg("11561", dup276); + +var msg14008 = msg("11562", dup276); + +var msg14009 = msg("11563", dup276); + +var msg14010 = msg("11564", dup276); + +var msg14011 = msg("11565", dup276); + +var msg14012 = msg("11566", dup276); + +var msg14013 = msg("11567", dup276); + +var msg14014 = msg("11568", dup276); + +var msg14015 = msg("11569", dup276); + +var msg14016 = msg("11570", dup276); + +var msg14017 = msg("11571", dup276); + +var msg14018 = msg("11572", dup276); + +var msg14019 = msg("11573", dup276); + +var msg14020 = msg("11574", dup276); + +var msg14021 = msg("11575", dup276); + +var msg14022 = msg("11576", dup276); + +var msg14023 = msg("11577", dup276); + +var msg14024 = msg("11578", dup276); + +var msg14025 = msg("11579", dup276); + +var msg14026 = msg("11580", dup276); + +var msg14027 = msg("11581", dup276); + +var msg14028 = msg("11582", dup276); + +var msg14029 = msg("11583", dup276); + +var msg14030 = msg("11584", dup276); + +var msg14031 = msg("11585", dup276); + +var msg14032 = msg("11586", dup276); + +var msg14033 = msg("11587", dup276); + +var msg14034 = msg("11588", dup201); + +var msg14035 = msg("11589", dup201); + +var msg14036 = msg("11590", dup201); + +var msg14037 = msg("11591", dup276); + +var msg14038 = msg("11592", dup276); + +var msg14039 = msg("11593", dup276); + +var msg14040 = msg("11594", dup276); + +var msg14041 = msg("11595", dup201); + +var msg14042 = msg("11596", dup201); + +var msg14043 = msg("11597", dup276); + +var msg14044 = msg("11598", dup201); + +var msg14045 = msg("11599", dup276); + +var msg14046 = msg("11600", dup276); + +var msg14047 = msg("11601", dup201); + +var msg14048 = msg("11602", dup276); + +var msg14049 = msg("11603", dup276); + +var msg14050 = msg("11604", dup276); + +var msg14051 = msg("11605", dup201); + +var msg14052 = msg("11606", dup276); + +var msg14053 = msg("11607", dup276); + +var msg14054 = msg("11608", dup276); + +var msg14055 = msg("11609", dup201); + +var msg14056 = msg("11610", dup201); + +var msg14057 = msg("11611", dup276); + +var msg14058 = msg("11612", dup201); + +var msg14059 = msg("11613", dup201); + +var msg14060 = msg("11614", dup276); + +var msg14061 = msg("11615", dup276); + +var msg14062 = msg("11616", dup260); + +var msg14063 = msg("11617", dup197); + +var msg14064 = msg("11618", dup197); + +var msg14065 = msg("11619", dup260); + +var msg14066 = msg("11620", dup265); + +var msg14067 = msg("11621", dup265); + +var msg14068 = msg("11622", dup265); + +var msg14069 = msg("11623", dup265); + +var msg14070 = msg("11624", dup265); + +var msg14071 = msg("11625", dup265); + +var msg14072 = msg("11626", dup265); + +var msg14073 = msg("11627", dup265); + +var msg14074 = msg("11628", dup265); + +var msg14075 = msg("11629", dup265); + +var msg14076 = msg("11630", dup265); + +var msg14077 = msg("11631", dup265); + +var msg14078 = msg("11632", dup265); + +var msg14079 = msg("11633", dup265); + +var msg14080 = msg("11634", dup265); + +var msg14081 = msg("11635", dup265); + +var msg14082 = msg("11636", dup265); + +var msg14083 = msg("11637", dup265); + +var msg14084 = msg("11638", dup265); + +var msg14085 = msg("11639", dup265); + +var msg14086 = msg("11640", dup265); + +var msg14087 = msg("11641", dup265); + +var msg14088 = msg("11642", dup265); + +var msg14089 = msg("11643", dup265); + +var msg14090 = msg("11644", dup265); + +var msg14091 = msg("11645", dup265); + +var msg14092 = msg("11646", dup265); + +var msg14093 = msg("11647", dup265); + +var msg14094 = msg("11648", dup265); + +var msg14095 = msg("11649", dup265); + +var msg14096 = msg("11650", dup265); + +var msg14097 = msg("11651", dup265); + +var msg14098 = msg("11652", dup265); + +var msg14099 = msg("11653", dup265); + +var msg14100 = msg("11654", dup265); + +var msg14101 = msg("11655", dup265); + +var msg14102 = msg("11656", dup265); + +var msg14103 = msg("11657", dup265); + +var msg14104 = msg("11658", dup265); + +var msg14105 = msg("11659", dup265); + +var msg14106 = msg("11660", dup265); + +var msg14107 = msg("11661", dup265); + +var msg14108 = msg("11662", dup265); + +var msg14109 = msg("11663", dup265); + +var msg14110 = msg("11664", dup265); + +var msg14111 = msg("11665", dup265); + +var msg14112 = msg("11666", dup265); + +var msg14113 = msg("11667", dup265); + +var msg14114 = msg("11668", dup267); + +var msg14115 = msg("11669", dup222); + +var msg14116 = msg("11670", dup197); + +var msg14117 = msg("11671", dup265); + +var msg14118 = msg("11672", dup222); + +var msg14119 = msg("11673", dup265); + +var msg14120 = msg("11674", dup265); + +var msg14121 = msg("11675", dup265); + +var msg14122 = msg("11676", dup265); + +var msg14123 = msg("11677", dup265); + +var msg14124 = msg("11678", dup265); + +var msg14125 = msg("11679", dup267); + +var msg14126 = msg("11680", dup222); + +var msg14127 = msg("11681", dup196); + +var msg14128 = msg("11682", dup287); + +var msg14129 = msg("11683", dup260); + +var msg14130 = msg("11684", dup222); + +var msg14131 = msg("11685", dup240); + +var msg14132 = msg("11686", dup222); + +var msg14133 = msg("11687", dup196); + +var msg14134 = msg("11688", dup276); + +var msg14135 = msg("11689", dup276); + +var msg14136 = msg("11690", dup276); + +var msg14137 = msg("11691", dup276); + +var msg14138 = msg("11692", dup276); + +var msg14139 = msg("11693", dup276); + +var msg14140 = msg("11694", dup276); + +var msg14141 = msg("11695", dup276); + +var msg14142 = msg("11696", dup276); + +var msg14143 = msg("11697", dup276); + +var msg14144 = msg("11698", dup276); + +var msg14145 = msg("11699", dup276); + +var msg14146 = msg("11700", dup276); + +var msg14147 = msg("11701", dup276); + +var msg14148 = msg("11702", dup276); + +var msg14149 = msg("11703", dup276); + +var msg14150 = msg("11704", dup276); + +var msg14151 = msg("11705", dup276); + +var msg14152 = msg("11706", dup276); + +var msg14153 = msg("11707", dup276); + +var msg14154 = msg("11708", dup276); + +var msg14155 = msg("11709", dup276); + +var msg14156 = msg("11710", dup276); + +var msg14157 = msg("11711", dup276); + +var msg14158 = msg("11712", dup276); + +var msg14159 = msg("11713", dup276); + +var msg14160 = msg("11714", dup276); + +var msg14161 = msg("11715", dup276); + +var msg14162 = msg("11716", dup276); + +var msg14163 = msg("11717", dup276); + +var msg14164 = msg("11718", dup276); + +var msg14165 = msg("11719", dup276); + +var msg14166 = msg("11720", dup276); + +var msg14167 = msg("11721", dup276); + +var msg14168 = msg("11722", dup276); + +var msg14169 = msg("11723", dup276); + +var msg14170 = msg("11724", dup276); + +var msg14171 = msg("11725", dup276); + +var msg14172 = msg("11726", dup276); + +var msg14173 = msg("11727", dup276); + +var msg14174 = msg("11728", dup276); + +var msg14175 = msg("11729", dup276); + +var msg14176 = msg("11730", dup276); + +var msg14177 = msg("11731", dup276); + +var msg14178 = msg("11732", dup276); + +var msg14179 = msg("11733", dup276); + +var msg14180 = msg("11734", dup276); + +var msg14181 = msg("11735", dup276); + +var msg14182 = msg("11736", dup276); + +var msg14183 = msg("11737", dup276); + +var msg14184 = msg("11738", dup276); + +var msg14185 = msg("11739", dup276); + +var msg14186 = msg("11740", dup276); + +var msg14187 = msg("11741", dup276); + +var msg14188 = msg("11742", dup276); + +var msg14189 = msg("11743", dup276); + +var msg14190 = msg("11744", dup276); + +var msg14191 = msg("11745", dup276); + +var msg14192 = msg("11746", dup276); + +var msg14193 = msg("11747", dup276); + +var msg14194 = msg("11748", dup276); + +var msg14195 = msg("11749", dup276); + +var msg14196 = msg("11750", dup276); + +var msg14197 = msg("11751", dup276); + +var msg14198 = msg("11752", dup276); + +var msg14199 = msg("11753", dup276); + +var msg14200 = msg("11754", dup276); + +var msg14201 = msg("11755", dup276); + +var msg14202 = msg("11756", dup276); + +var msg14203 = msg("11757", dup276); + +var msg14204 = msg("11758", dup276); + +var msg14205 = msg("11759", dup276); + +var msg14206 = msg("11760", dup276); + +var msg14207 = msg("11761", dup276); + +var msg14208 = msg("11762", dup276); + +var msg14209 = msg("11763", dup276); + +var msg14210 = msg("11764", dup276); + +var msg14211 = msg("11765", dup276); + +var msg14212 = msg("11766", dup276); + +var msg14213 = msg("11767", dup276); + +var msg14214 = msg("11768", dup276); + +var msg14215 = msg("11769", dup276); + +var msg14216 = msg("11770", dup276); + +var msg14217 = msg("11771", dup276); + +var msg14218 = msg("11772", dup276); + +var msg14219 = msg("11773", dup276); + +var msg14220 = msg("11774", dup276); + +var msg14221 = msg("11775", dup276); + +var msg14222 = msg("11776", dup276); + +var msg14223 = msg("11777", dup276); + +var msg14224 = msg("11778", dup276); + +var msg14225 = msg("11779", dup276); + +var msg14226 = msg("11780", dup276); + +var msg14227 = msg("11781", dup276); + +var msg14228 = msg("11782", dup276); + +var msg14229 = msg("11783", dup276); + +var msg14230 = msg("11784", dup276); + +var msg14231 = msg("11785", dup276); + +var msg14232 = msg("11786", dup276); + +var msg14233 = msg("11787", dup276); + +var msg14234 = msg("11788", dup276); + +var msg14235 = msg("11789", dup276); + +var msg14236 = msg("11790", dup276); + +var msg14237 = msg("11791", dup276); + +var msg14238 = msg("11792", dup276); + +var msg14239 = msg("11793", dup276); + +var msg14240 = msg("11794", dup276); + +var msg14241 = msg("11795", dup276); + +var msg14242 = msg("11796", dup276); + +var msg14243 = msg("11797", dup276); + +var msg14244 = msg("11798", dup276); + +var msg14245 = msg("11799", dup276); + +var msg14246 = msg("11800", dup276); + +var msg14247 = msg("11801", dup276); + +var msg14248 = msg("11802", dup276); + +var msg14249 = msg("11803", dup276); + +var msg14250 = msg("11804", dup276); + +var msg14251 = msg("11805", dup276); + +var msg14252 = msg("11806", dup276); + +var msg14253 = msg("11807", dup276); + +var msg14254 = msg("11808", dup276); + +var msg14255 = msg("11809", dup276); + +var msg14256 = msg("11810", dup276); + +var msg14257 = msg("11811", dup276); + +var msg14258 = msg("11812", dup276); + +var msg14259 = msg("11813", dup276); + +var msg14260 = msg("11814", dup276); + +var msg14261 = msg("11815", dup276); + +var msg14262 = msg("11816", dup196); + +var msg14263 = msg("11817", dup265); + +var msg14264 = msg("11818", dup265); + +var msg14265 = msg("11819", dup265); + +var msg14266 = msg("11820", dup265); + +var msg14267 = msg("11821", dup265); + +var msg14268 = msg("11822", dup265); + +var msg14269 = msg("11823", dup265); + +var msg14270 = msg("11824", dup265); + +var msg14271 = msg("11825", dup265); + +var msg14272 = msg("11826", dup265); + +var msg14273 = msg("11827", dup265); + +var msg14274 = msg("11828", dup265); + +var msg14275 = msg("11829", dup265); + +var msg14276 = msg("11830", dup265); + +var msg14277 = msg("11831", dup265); + +var msg14278 = msg("11832", dup265); + +var msg14279 = msg("11833", dup265); + +var msg14280 = msg("11834", dup265); + +var msg14281 = msg("11835", dup196); + +var msg14282 = msg("11836", dup196); + +var msg14283 = msg("11837", dup250); + +var msg14284 = msg("11838", dup267); + +var msg14285 = msg("11839", dup265); + +var msg14286 = msg("11840", dup265); + +var msg14287 = msg("11841", dup265); + +var msg14288 = msg("11842", dup265); + +var msg14289 = msg("11843", dup276); + +var msg14290 = msg("11844", dup276); + +var msg14291 = msg("11845", dup276); + +var msg14292 = msg("11846", dup276); + +var msg14293 = msg("11847", dup276); + +var msg14294 = msg("11848", dup276); + +var msg14295 = msg("11849", dup276); + +var msg14296 = msg("11850", dup276); + +var msg14297 = msg("11851", dup276); + +var msg14298 = msg("11852", dup276); + +var msg14299 = msg("11853", dup276); + +var msg14300 = msg("11854", dup276); + +var msg14301 = msg("11855", dup276); + +var msg14302 = msg("11856", dup276); + +var msg14303 = msg("11857", dup276); + +var msg14304 = msg("11858", dup276); + +var msg14305 = msg("11859", dup276); + +var msg14306 = msg("11860", dup276); + +var msg14307 = msg("11861", dup276); + +var msg14308 = msg("11862", dup276); + +var msg14309 = msg("11863", dup276); + +var msg14310 = msg("11864", dup276); + +var msg14311 = msg("11865", dup276); + +var msg14312 = msg("11866", dup276); + +var msg14313 = msg("11867", dup276); + +var msg14314 = msg("11868", dup276); + +var msg14315 = msg("11869", dup276); + +var msg14316 = msg("11870", dup276); + +var msg14317 = msg("11871", dup276); + +var msg14318 = msg("11872", dup276); + +var msg14319 = msg("11873", dup276); + +var msg14320 = msg("11874", dup276); + +var msg14321 = msg("11875", dup276); + +var msg14322 = msg("11876", dup276); + +var msg14323 = msg("11877", dup276); + +var msg14324 = msg("11878", dup276); + +var msg14325 = msg("11879", dup276); + +var msg14326 = msg("11880", dup276); + +var msg14327 = msg("11881", dup276); + +var msg14328 = msg("11882", dup276); + +var msg14329 = msg("11883", dup276); + +var msg14330 = msg("11884", dup276); + +var msg14331 = msg("11885", dup276); + +var msg14332 = msg("11886", dup276); + +var msg14333 = msg("11887", dup276); + +var msg14334 = msg("11888", dup276); + +var msg14335 = msg("11889", dup276); + +var msg14336 = msg("11890", dup276); + +var msg14337 = msg("11891", dup276); + +var msg14338 = msg("11892", dup276); + +var msg14339 = msg("11893", dup276); + +var msg14340 = msg("11894", dup276); + +var msg14341 = msg("11895", dup276); + +var msg14342 = msg("11896", dup276); + +var msg14343 = msg("11897", dup276); + +var msg14344 = msg("11898", dup276); + +var msg14345 = msg("11899", dup276); + +var msg14346 = msg("11900", dup276); + +var msg14347 = msg("11901", dup276); + +var msg14348 = msg("11902", dup276); + +var msg14349 = msg("11903", dup276); + +var msg14350 = msg("11904", dup276); + +var msg14351 = msg("11905", dup276); + +var msg14352 = msg("11906", dup276); + +var msg14353 = msg("11907", dup276); + +var msg14354 = msg("11908", dup276); + +var msg14355 = msg("11909", dup276); + +var msg14356 = msg("11910", dup276); + +var msg14357 = msg("11911", dup276); + +var msg14358 = msg("11912", dup276); + +var msg14359 = msg("11913", dup276); + +var msg14360 = msg("11914", dup276); + +var msg14361 = msg("11915", dup276); + +var msg14362 = msg("11916", dup276); + +var msg14363 = msg("11917", dup276); + +var msg14364 = msg("11918", dup276); + +var msg14365 = msg("11919", dup276); + +var msg14366 = msg("11920", dup276); + +var msg14367 = msg("11921", dup276); + +var msg14368 = msg("11922", dup276); + +var msg14369 = msg("11923", dup276); + +var msg14370 = msg("11924", dup276); + +var msg14371 = msg("11925", dup276); + +var msg14372 = msg("11926", dup276); + +var msg14373 = msg("11927", dup276); + +var msg14374 = msg("11928", dup276); + +var msg14375 = msg("11929", dup276); + +var msg14376 = msg("11930", dup276); + +var msg14377 = msg("11931", dup276); + +var msg14378 = msg("11932", dup276); + +var msg14379 = msg("11933", dup276); + +var msg14380 = msg("11934", dup276); + +var msg14381 = msg("11935", dup276); + +var msg14382 = msg("11936", dup276); + +var msg14383 = msg("11937", dup276); + +var msg14384 = msg("11938", dup276); + +var msg14385 = msg("11939", dup265); + +var msg14386 = msg("11940", dup265); + +var msg14387 = msg("11941", dup265); + +var msg14388 = msg("11942", dup265); + +var msg14389 = msg("11943", dup265); + +var msg14390 = msg("11944", dup265); + +var msg14391 = msg("11945", dup276); + +var msg14392 = msg("11946", dup196); + +var msg14393 = msg("11947", dup196); + +var msg14394 = msg("11948", dup303); + +var msg14395 = msg("11949", dup192); + +var msg14396 = msg("11950", dup192); + +var msg14397 = msg("11951", dup192); + +var msg14398 = msg("11952", dup192); + +var msg14399 = msg("11953", dup192); + +var msg14400 = msg("11954", dup192); + +var msg14401 = msg("11955", dup276); + +var msg14402 = msg("11956", dup276); + +var msg14403 = msg("11957", dup276); + +var msg14404 = msg("11958", dup276); + +var msg14405 = msg("11959", dup276); + +var msg14406 = msg("11960", dup276); + +var msg14407 = msg("11961", dup276); + +var msg14408 = msg("11962", dup276); + +var msg14409 = msg("11963", dup276); + +var msg14410 = msg("11964", dup276); + +var msg14411 = msg("11965", dup265); + +var msg14412 = msg("11966", dup265); + +var msg14413 = msg("11967", dup265); + +var msg14414 = msg("11968", dup196); + +var msg14415 = msg("11969", dup273); + +var msg14416 = msg("11970", dup198); + +var msg14417 = msg("11971", dup201); + +var msg14418 = msg("11972", dup196); + +var msg14419 = msg("11973", dup201); + +var msg14420 = msg("11974", dup287); + +var msg14421 = msg("11975", dup196); + +var msg14422 = msg("11976", dup197); + +var msg14423 = msg("11977", dup197); + +var msg14424 = msg("11978", dup201); + +var msg14425 = msg("11979", dup196); + +var msg14426 = msg("11980", dup201); + +var msg14427 = msg("11981", dup201); + +var msg14428 = msg("11982", dup196); + +var msg14429 = msg("11983", dup196); + +var msg14430 = msg("11984", dup196); + +var msg14431 = msg("11985", dup201); + +var msg14432 = msg("11986", dup287); + +var msg14433 = msg("11987", dup287); + +var msg14434 = msg("11988", dup287); + +var msg14435 = msg("11989", dup287); + +var msg14436 = msg("11990", dup287); + +var msg14437 = msg("11991", dup287); + +var msg14438 = msg("11992", dup297); + +var msg14439 = msg("11993", dup287); + +var msg14440 = msg("11994", dup287); + +var msg14441 = msg("11995", dup297); + +var msg14442 = msg("11996", dup287); + +var msg14443 = msg("11997", dup287); + +var msg14444 = msg("11998", dup287); + +var msg14445 = msg("11999", dup287); + +var msg14446 = msg("12000", dup196); + +var msg14447 = msg("12001", dup201); + +var msg14448 = msg("12002", dup197); + +var msg14449 = msg("12003", dup197); + +var msg14450 = msg("12004", dup196); + +var msg14451 = msg("12005", dup196); + +var msg14452 = msg("12006", dup196); + +var msg14453 = msg("12007", dup273); + +var msg14454 = msg("12008", dup287); + +var msg14455 = msg("12009", dup197); + +var msg14456 = msg("12010", dup265); + +var msg14457 = msg("12011", dup265); + +var msg14458 = msg("12012", dup265); + +var msg14459 = msg("12013", dup265); + +var msg14460 = msg("12014", dup265); + +var msg14461 = msg("12015", dup265); + +var msg14462 = msg("12016", dup265); + +var msg14463 = msg("12017", dup265); + +var msg14464 = msg("12018", dup265); + +var msg14465 = msg("12019", dup265); + +var msg14466 = msg("12020", dup265); + +var msg14467 = msg("12021", dup265); + +var msg14468 = msg("12022", dup265); + +var msg14469 = msg("12023", dup265); + +var msg14470 = msg("12024", dup265); + +var msg14471 = msg("12025", dup265); + +var msg14472 = msg("12026", dup265); + +var msg14473 = msg("12027", dup260); + +var msg14474 = msg("12028", dup250); + +var msg14475 = msg("12029", dup265); + +var msg14476 = msg("12030", dup265); + +var msg14477 = msg("12031", dup197); + +var msg14478 = msg("12032", dup197); + +var msg14479 = msg("12033", dup197); + +var msg14480 = msg("12034", dup197); + +var msg14481 = msg("12035", dup197); + +var msg14482 = msg("12036", dup197); + +var msg14483 = msg("12037", dup197); + +var msg14484 = msg("12038", dup197); + +var msg14485 = msg("12039", dup197); + +var msg14486 = msg("12040", dup197); + +var msg14487 = msg("12041", dup197); + +var msg14488 = msg("12042", dup197); + +var msg14489 = msg("12043", dup198); + +var msg14490 = msg("12044", dup198); + +var msg14491 = msg("12045", dup198); + +var msg14492 = msg("12046", dup273); + +var msg14493 = msg("12047", dup303); + +var msg14494 = msg("12048", dup303); + +var msg14495 = msg("12049", dup303); + +var msg14496 = msg("12050", dup303); + +var msg14497 = msg("12051", dup192); + +var msg14498 = msg("12052", dup192); + +var msg14499 = msg("12053", dup192); + +var msg14500 = msg("12054", dup192); + +var msg14501 = msg("12055", dup192); + +var msg14502 = msg("12056", dup267); + +var msg14503 = msg("12057", dup265); + +var msg14504 = msg("12058", dup222); + +var msg14505 = msg("12059", dup240); + +var msg14506 = msg("12060", dup240); + +var msg14507 = msg("12061", dup287); + +var msg14508 = msg("12062", dup265); + +var msg14509 = msg("12063", dup265); + +var msg14510 = msg("12064", dup265); + +var msg14511 = msg("12065", dup196); + +var msg14512 = msg("12066", dup196); + +var msg14513 = msg("12067", dup196); + +var msg14514 = msg("12068", dup196); + +var msg14515 = msg("12069", dup196); + +var msg14516 = msg("12070", dup196); + +var msg14517 = msg("12072", dup287); + +var msg14518 = msg("12073", dup196); + +var msg14519 = msg("12074", dup196); + +var msg14520 = msg("12075", dup269); + +var msg14521 = msg("12076", dup198); + +var msg14522 = msg("12077", dup192); + +var msg14523 = msg("12078", dup197); + +var msg14524 = msg("12079", dup197); + +var msg14525 = msg("12080", dup196); + +var msg14526 = msg("12081", dup222); + +var msg14527 = msg("12082", dup198); + +var msg14528 = msg("12083", dup265); + +var msg14529 = msg("12084", dup265); + +var msg14530 = msg("12085", dup265); + +var msg14531 = msg("12086", dup265); + +var msg14532 = msg("12087", dup265); + +var msg14533 = msg("12088", dup265); + +var msg14534 = msg("12089", dup265); + +var msg14535 = msg("12090", dup265); + +var msg14536 = msg("12091", dup198); + +var msg14537 = msg("12092", dup198); + +var msg14538 = msg("12093", dup198); + +var msg14539 = msg("12094", dup198); + +var msg14540 = msg("12095", dup265); + +var msg14541 = msg("12096", dup265); + +var msg14542 = msg("12097", dup265); + +var msg14543 = msg("12098", dup265); + +var msg14544 = msg("12099", dup269); + +var msg14545 = msg("12100", dup276); + +var msg14546 = msg("12101", dup276); + +var msg14547 = msg("12102", dup276); + +var msg14548 = msg("12103", dup276); + +var msg14549 = msg("12104", dup276); + +var msg14550 = msg("12105", dup276); + +var msg14551 = msg("12106", dup276); + +var msg14552 = msg("12107", dup276); + +var msg14553 = msg("12108", dup276); + +var msg14554 = msg("12109", dup276); + +var msg14555 = msg("12110", dup276); + +var msg14556 = msg("12111", dup276); + +var msg14557 = msg("12112", dup194); + +var msg14558 = msg("12113", dup197); + +var msg14559 = msg("12114", dup201); + +var msg14560 = msg("12115", dup201); + +var msg14561 = msg("12116", dup265); + +var msg14562 = msg("12117", dup265); + +var msg14563 = msg("12118", dup265); + +var msg14564 = msg("12119", dup265); + +var msg14565 = msg("12120", dup303); + +var msg14566 = msg("12121", dup303); + +var msg14567 = msg("12122", dup303); + +var msg14568 = msg("12123", dup303); + +var msg14569 = msg("12124", dup303); + +var msg14570 = msg("12125", dup303); + +var msg14571 = msg("12126", dup303); + +var msg14572 = msg("12127", dup303); + +var msg14573 = msg("12128", dup303); + +var msg14574 = msg("12129", dup303); + +var msg14575 = msg("12130", dup303); + +var msg14576 = msg("12131", dup303); + +var msg14577 = msg("12132", dup303); + +var msg14578 = msg("12133", dup303); + +var msg14579 = msg("12134", dup303); + +var msg14580 = msg("12135", dup303); + +var msg14581 = msg("12136", dup303); + +var msg14582 = msg("12137", dup303); + +var msg14583 = msg("12138", dup303); + +var msg14584 = msg("12139", dup303); + +var msg14585 = msg("12140", dup303); + +var msg14586 = msg("12141", dup303); + +var msg14587 = msg("12142", dup192); + +var msg14588 = msg("12143", dup192); + +var msg14589 = msg("12144", dup192); + +var msg14590 = msg("12145", dup192); + +var msg14591 = msg("12146", dup192); + +var msg14592 = msg("12147", dup192); + +var msg14593 = msg("12148", dup192); + +var msg14594 = msg("12149", dup192); + +var msg14595 = msg("12150", dup192); + +var msg14596 = msg("12151", dup192); + +var msg14597 = msg("12152", dup192); + +var msg14598 = msg("12153", dup192); + +var msg14599 = msg("12154", dup192); + +var msg14600 = msg("12155", dup192); + +var msg14601 = msg("12156", dup192); + +var msg14602 = msg("12157", dup192); + +var msg14603 = msg("12158", dup192); + +var msg14604 = msg("12159", dup192); + +var msg14605 = msg("12160", dup192); + +var msg14606 = msg("12161", dup192); + +var msg14607 = msg("12162", dup192); + +var msg14608 = msg("12163", dup192); + +var msg14609 = msg("12164", dup192); + +var msg14610 = msg("12165", dup192); + +var msg14611 = msg("12166", dup192); + +var msg14612 = msg("12167", dup196); + +var msg14613 = msg("12168", dup265); + +var msg14614 = msg("12169", dup265); + +var msg14615 = msg("12170", dup287); + +var msg14616 = msg("12171", dup287); + +var msg14617 = msg("12172", dup196); + +var msg14618 = msg("12173", dup196); + +var msg14619 = msg("12174", dup196); + +var msg14620 = msg("12175", dup196); + +var msg14621 = msg("12176", dup196); + +var msg14622 = msg("12177", dup196); + +var msg14623 = msg("12178", dup196); + +var msg14624 = msg("12179", dup196); + +var msg14625 = msg("12180", dup196); + +var msg14626 = msg("12181", dup196); + +var msg14627 = msg("12182", dup196); + +var msg14628 = msg("12183", dup197); + +var msg14629 = msg("12184", dup269); + +var msg14630 = msg("12185", dup287); + +var msg14631 = msg("12186", dup258); + +var msg14632 = msg("12187", dup287); + +var msg14633 = msg("12188", dup253); + +var msg14634 = msg("12189", dup265); + +var msg14635 = msg("12190", dup265); + +var msg14636 = msg("12191", dup265); + +var msg14637 = msg("12192", dup265); + +var msg14638 = msg("12193", dup265); + +var msg14639 = msg("12194", dup265); + +var msg14640 = msg("12195", dup265); + +var msg14641 = msg("12196", dup265); + +var msg14642 = msg("12197", dup222); + +var msg14643 = msg("12198", dup242); + +var msg14644 = msg("12199", dup198); + +var msg14645 = msg("12200", dup265); + +var msg14646 = msg("12201", dup265); + +var msg14647 = msg("12202", dup222); + +var msg14648 = msg("12203", dup265); + +var msg14649 = msg("12204", dup265); + +var msg14650 = msg("12205", dup265); + +var msg14651 = msg("12206", dup265); + +var msg14652 = msg("12207", dup265); + +var msg14653 = msg("12208", dup265); + +var msg14654 = msg("12209", dup196); + +var msg14655 = msg("12210", dup287); + +var msg14656 = msg("12211", dup287); + +var msg14657 = msg("12212", dup201); + +var msg14658 = msg("12213", dup201); + +var msg14659 = msg("12214", dup201); + +var msg14660 = msg("12215", dup201); + +var msg14661 = msg("12216", dup222); + +var msg14662 = msg("12217", dup222); + +var msg14663 = msg("12218", dup222); + +var msg14664 = msg("12219", dup197); + +var msg14665 = msg("12220", dup196); + +var msg14666 = msg("12221", dup265); + +var msg14667 = msg("12222", dup196); + +var msg14668 = msg("12223", dup196); + +var msg14669 = msg("12224", dup303); + +var msg14670 = msg("12225", dup303); + +var msg14671 = msg("12226", dup303); + +var msg14672 = msg("12227", dup303); + +var msg14673 = msg("12228", dup303); + +var msg14674 = msg("12229", dup303); + +var msg14675 = msg("12230", dup303); + +var msg14676 = msg("12231", dup303); + +var msg14677 = msg("12232", dup303); + +var msg14678 = msg("12233", dup192); + +var msg14679 = msg("12234", dup192); + +var msg14680 = msg("12235", dup192); + +var msg14681 = msg("12236", dup192); + +var msg14682 = msg("12237", dup192); + +var msg14683 = msg("12238", dup192); + +var msg14684 = msg("12239", dup192); + +var msg14685 = msg("12240", dup192); + +var msg14686 = msg("12241", dup192); + +var msg14687 = msg("12242", dup192); + +var msg14688 = msg("12243", dup192); + +var msg14689 = msg("12244", dup192); + +var msg14690 = msg("12245", dup192); + +var msg14691 = msg("12246", dup265); + +var msg14692 = msg("12247", dup265); + +var msg14693 = msg("12248", dup265); + +var msg14694 = msg("12249", dup265); + +var msg14695 = msg("12250", dup265); + +var msg14696 = msg("12251", dup265); + +var msg14697 = msg("12252", dup265); + +var msg14698 = msg("12253", dup265); + +var msg14699 = msg("12254", dup196); + +var msg14700 = msg("12255", dup265); + +var msg14701 = msg("12256", dup196); + +var msg14702 = msg("12257", dup265); + +var msg14703 = msg("12258", dup265); + +var msg14704 = msg("12259", dup265); + +var msg14705 = msg("12260", dup265); + +var msg14706 = msg("12261", dup265); + +var msg14707 = msg("12262", dup265); + +var msg14708 = msg("12263", dup265); + +var msg14709 = msg("12264", dup265); + +var msg14710 = msg("12265", dup265); + +var msg14711 = msg("12266", dup265); + +var msg14712 = msg("12267", dup265); + +var msg14713 = msg("12268", dup265); + +var msg14714 = msg("12269", dup265); + +var msg14715 = msg("12270", dup265); + +var msg14716 = msg("12271", dup265); + +var msg14717 = msg("12272", dup265); + +var msg14718 = msg("12273", dup265); + +var msg14719 = msg("12274", dup265); + +var msg14720 = msg("12275", dup265); + +var msg14721 = msg("12276", dup265); + +var msg14722 = msg("12277", dup196); + +var msg14723 = msg("12278", dup196); + +var msg14724 = msg("12279", dup197); + +var msg14725 = msg("12280", dup196); + +var msg14726 = msg("12281", dup196); + +var msg14727 = msg("12282", dup196); + +var msg14728 = msg("12283", dup196); + +var msg14729 = msg("12284", dup267); + +var msg14730 = msg("12285", dup196); + +var msg14731 = msg("12286", dup267); + +var msg14732 = msg("12287", dup303); + +var msg14733 = msg("12288", dup303); + +var msg14734 = msg("12289", dup303); + +var msg14735 = msg("12290", dup303); + +var msg14736 = msg("12291", dup303); + +var msg14737 = msg("12292", dup303); + +var msg14738 = msg("12293", dup303); + +var msg14739 = msg("12294", dup303); + +var msg14740 = msg("12295", dup303); + +var msg14741 = msg("12296", dup303); + +var msg14742 = msg("12297", dup192); + +var msg14743 = msg("12298", dup192); + +var msg14744 = msg("12299", dup196); + +var msg14745 = msg("12300", dup196); + +var msg14746 = msg("12301", dup265); + +var msg14747 = msg("12302", dup265); + +var msg14748 = msg("12303", dup196); + +var msg14749 = msg("12304", dup196); + +var msg14750 = msg("12305", dup196); + +var msg14751 = msg("12306", dup196); + +var msg14752 = msg("12307", dup276); + +var msg14753 = msg("12308", dup276); + +var msg14754 = msg("12309", dup276); + +var msg14755 = msg("12310", dup276); + +var msg14756 = msg("12311", dup276); + +var msg14757 = msg("12312", dup276); + +var msg14758 = msg("12313", dup276); + +var msg14759 = msg("12314", dup276); + +var msg14760 = msg("12315", dup276); + +var msg14761 = msg("12316", dup276); + +var msg14762 = msg("12317", dup276); + +var msg14763 = msg("12318", dup276); + +var msg14764 = msg("12319", dup276); + +var msg14765 = msg("12320", dup276); + +var msg14766 = msg("12321", dup276); + +var msg14767 = msg("12322", dup276); + +var msg14768 = msg("12323", dup276); + +var msg14769 = msg("12324", dup276); + +var msg14770 = msg("12325", dup276); + +var msg14771 = msg("12326", dup276); + +var msg14772 = msg("12327", dup276); + +var msg14773 = msg("12328", dup276); + +var msg14774 = msg("12329", dup276); + +var msg14775 = msg("12330", dup276); + +var msg14776 = msg("12331", dup276); + +var msg14777 = msg("12332", dup276); + +var msg14778 = msg("12333", dup276); + +var msg14779 = msg("12334", dup276); + +var msg14780 = msg("12335", dup276); + +var msg14781 = msg("12336", dup276); + +var msg14782 = msg("12337", dup276); + +var msg14783 = msg("12338", dup276); + +var msg14784 = msg("12339", dup276); + +var msg14785 = msg("12340", dup276); + +var msg14786 = msg("12341", dup276); + +var msg14787 = msg("12342", dup276); + +var msg14788 = msg("12343", dup276); + +var msg14789 = msg("12344", dup276); + +var msg14790 = msg("12345", dup276); + +var msg14791 = msg("12346", dup276); + +var msg14792 = msg("12347", dup276); + +var msg14793 = msg("12348", dup276); + +var msg14794 = msg("12349", dup276); + +var msg14795 = msg("12350", dup276); + +var msg14796 = msg("12351", dup276); + +var msg14797 = msg("12352", dup276); + +var msg14798 = msg("12353", dup276); + +var msg14799 = msg("12354", dup276); + +var msg14800 = msg("12355", dup276); + +var msg14801 = msg("12356", dup276); + +var msg14802 = msg("12357", dup196); + +var msg14803 = msg("12358", dup197); + +var msg14804 = msg("12359", dup197); + +var msg14805 = msg("12360", dup267); + +var msg14806 = msg("12361", dup303); + +var msg14807 = msg("12362", dup197); + +var msg14808 = msg("12363", dup303); + +var msg14809 = msg("12364", dup303); + +var msg14810 = msg("12365", dup303); + +var msg14811 = msg("12366", dup303); + +var msg14812 = msg("12367", dup303); + +var msg14813 = msg("12368", dup303); + +var msg14814 = msg("12369", dup303); + +var msg14815 = msg("12370", dup303); + +var msg14816 = msg("12371", dup303); + +var msg14817 = msg("12372", dup303); + +var msg14818 = msg("12373", dup192); + +var msg14819 = msg("12374", dup192); + +var msg14820 = msg("12375", dup192); + +var msg14821 = msg("12376", dup192); + +var msg14822 = msg("12377", dup192); + +var msg14823 = msg("12378", dup192); + +var msg14824 = msg("12379", dup303); + +var msg14825 = msg("12380", dup265); + +var msg14826 = msg("12381", dup265); + +var msg14827 = msg("12382", dup265); + +var msg14828 = msg("12383", dup265); + +var msg14829 = msg("12384", dup265); + +var msg14830 = msg("12385", dup265); + +var msg14831 = msg("12386", dup265); + +var msg14832 = msg("12387", dup265); + +var msg14833 = msg("12388", dup265); + +var msg14834 = msg("12389", dup265); + +var msg14835 = msg("12390", dup196); + +var msg14836 = msg("12391", dup196); + +var msg14837 = msg("12392", dup196); + +var msg14838 = msg("12393", dup265); + +var msg14839 = msg("12394", dup265); + +var msg14840 = msg("12395", dup265); + +var msg14841 = msg("12396", dup265); + +var msg14842 = msg("12397", dup265); + +var msg14843 = msg("12398", dup265); + +var msg14844 = msg("12399", dup265); + +var msg14845 = msg("12400", dup265); + +var msg14846 = msg("12401", dup265); + +var msg14847 = msg("12402", dup265); + +var msg14848 = msg("12403", dup265); + +var msg14849 = msg("12404", dup265); + +var msg14850 = msg("12405", dup265); + +var msg14851 = msg("12406", dup265); + +var msg14852 = msg("12407", dup265); + +var msg14853 = msg("12408", dup265); + +var msg14854 = msg("12409", dup265); + +var msg14855 = msg("12410", dup265); + +var msg14856 = msg("12411", dup265); + +var msg14857 = msg("12412", dup265); + +var msg14858 = msg("12413", dup265); + +var msg14859 = msg("12414", dup265); + +var msg14860 = msg("12415", dup265); + +var msg14861 = msg("12416", dup265); + +var msg14862 = msg("12417", dup265); + +var msg14863 = msg("12418", dup265); + +var msg14864 = msg("12419", dup265); + +var msg14865 = msg("12420", dup265); + +var msg14866 = msg("12421", dup196); + +var msg14867 = msg("12422", dup196); + +var msg14868 = msg("12423", dup250); + +var msg14869 = msg("12424", dup222); + +var msg14870 = msg("12425", dup196); + +var msg14871 = msg("12426", dup196); + +var msg14872 = msg("12427", dup196); + +var msg14873 = msg("12428", dup265); + +var msg14874 = msg("12429", dup265); + +var msg14875 = msg("12430", dup265); + +var msg14876 = msg("12431", dup265); + +var msg14877 = msg("12432", dup265); + +var msg14878 = msg("12433", dup265); + +var msg14879 = msg("12434", dup265); + +var msg14880 = msg("12435", dup265); + +var msg14881 = msg("12436", dup196); + +var msg14882 = msg("12437", dup196); + +var msg14883 = msg("12438", dup265); + +var msg14884 = msg("12439", dup265); + +var msg14885 = msg("12440", dup265); + +var msg14886 = msg("12441", dup265); + +var msg14887 = msg("12442", dup265); + +var msg14888 = msg("12443", dup265); + +var msg14889 = msg("12444", dup240); + +var msg14890 = msg("12445", dup240); + +var msg14891 = msg("12446", dup240); + +var msg14892 = msg("12447", dup240); + +var msg14893 = msg("12448", dup265); + +var msg14894 = msg("12449", dup265); + +var msg14895 = msg("12450", dup265); + +var msg14896 = msg("12451", dup265); + +var msg14897 = msg("12452", dup265); + +var msg14898 = msg("12453", dup265); + +var msg14899 = msg("12454", dup196); + +var msg14900 = msg("12455", dup196); + +var msg14901 = msg("12456", dup196); + +var msg14902 = msg("12457", dup196); + +var msg14903 = msg("12458", dup287); + +var msg14904 = msg("12459", dup265); + +var msg14905 = msg("12460", dup265); + +var msg14906 = msg("12461", dup265); + +var msg14907 = msg("12462", dup265); + +var msg14908 = msg("12463", dup222); + +var msg14909 = msg("12464", dup222); + +var msg14910 = msg("12465", dup196); + +var msg14911 = msg("12466", dup265); + +var msg14912 = msg("12467", dup265); + +var msg14913 = msg("12468", dup265); + +var msg14914 = msg("12469", dup265); + +var msg14915 = msg("12470", dup265); + +var msg14916 = msg("12471", dup265); + +var msg14917 = msg("12472", dup265); + +var msg14918 = msg("12473", dup265); + +var msg14919 = msg("12474", dup265); + +var msg14920 = msg("12475", dup265); + +var msg14921 = msg("12476", dup265); + +var msg14922 = msg("12477", dup265); + +var msg14923 = msg("12478", dup265); + +var msg14924 = msg("12479", dup265); + +var msg14925 = msg("12480", dup303); + +var msg14926 = msg("12481", dup303); + +var msg14927 = msg("12482", dup303); + +var msg14928 = msg("12483", dup303); + +var msg14929 = msg("12484", dup303); + +var msg14930 = msg("12485", dup303); + +var msg14931 = msg("12486", dup303); + +var msg14932 = msg("12487", dup303); + +var msg14933 = msg("12488", dup303); + +var msg14934 = msg("12489", dup276); + +var msg14935 = msg("12490", dup276); + +var msg14936 = msg("12491", dup276); + +var msg14937 = msg("12492", dup276); + +var msg14938 = msg("12493", dup276); + +var msg14939 = msg("12494", dup276); + +var msg14940 = msg("12495", dup276); + +var msg14941 = msg("12496", dup276); + +var msg14942 = msg("12497", dup276); + +var msg14943 = msg("12498", dup276); + +var msg14944 = msg("12499", dup276); + +var msg14945 = msg("12500", dup276); + +var msg14946 = msg("12501", dup276); + +var msg14947 = msg("12502", dup276); + +var msg14948 = msg("12503", dup276); + +var msg14949 = msg("12504", dup276); + +var msg14950 = msg("12505", dup276); + +var msg14951 = msg("12506", dup276); + +var msg14952 = msg("12507", dup276); + +var msg14953 = msg("12508", dup276); + +var msg14954 = msg("12509", dup276); + +var msg14955 = msg("12510", dup276); + +var msg14956 = msg("12511", dup276); + +var msg14957 = msg("12512", dup276); + +var msg14958 = msg("12513", dup276); + +var msg14959 = msg("12514", dup276); + +var msg14960 = msg("12515", dup276); + +var msg14961 = msg("12516", dup276); + +var msg14962 = msg("12517", dup276); + +var msg14963 = msg("12518", dup276); + +var msg14964 = msg("12519", dup276); + +var msg14965 = msg("12520", dup276); + +var msg14966 = msg("12521", dup276); + +var msg14967 = msg("12522", dup276); + +var msg14968 = msg("12523", dup276); + +var msg14969 = msg("12524", dup276); + +var msg14970 = msg("12525", dup276); + +var msg14971 = msg("12526", dup276); + +var msg14972 = msg("12527", dup276); + +var msg14973 = msg("12528", dup276); + +var msg14974 = msg("12529", dup276); + +var msg14975 = msg("12530", dup276); + +var msg14976 = msg("12531", dup276); + +var msg14977 = msg("12532", dup276); + +var msg14978 = msg("12533", dup276); + +var msg14979 = msg("12534", dup276); + +var msg14980 = msg("12535", dup276); + +var msg14981 = msg("12536", dup276); + +var msg14982 = msg("12537", dup276); + +var msg14983 = msg("12538", dup276); + +var msg14984 = msg("12539", dup276); + +var msg14985 = msg("12540", dup276); + +var msg14986 = msg("12541", dup276); + +var msg14987 = msg("12542", dup276); + +var msg14988 = msg("12543", dup276); + +var msg14989 = msg("12544", dup276); + +var msg14990 = msg("12545", dup276); + +var msg14991 = msg("12546", dup276); + +var msg14992 = msg("12547", dup276); + +var msg14993 = msg("12548", dup276); + +var msg14994 = msg("12549", dup276); + +var msg14995 = msg("12550", dup276); + +var msg14996 = msg("12551", dup276); + +var msg14997 = msg("12552", dup276); + +var msg14998 = msg("12553", dup276); + +var msg14999 = msg("12554", dup276); + +var msg15000 = msg("12555", dup276); + +var msg15001 = msg("12556", dup276); + +var msg15002 = msg("12557", dup276); + +var msg15003 = msg("12558", dup276); + +var msg15004 = msg("12559", dup276); + +var msg15005 = msg("12560", dup276); + +var msg15006 = msg("12561", dup276); + +var msg15007 = msg("12562", dup276); + +var msg15008 = msg("12563", dup276); + +var msg15009 = msg("12564", dup276); + +var msg15010 = msg("12565", dup276); + +var msg15011 = msg("12566", dup276); + +var msg15012 = msg("12567", dup276); + +var msg15013 = msg("12568", dup276); + +var msg15014 = msg("12569", dup276); + +var msg15015 = msg("12570", dup276); + +var msg15016 = msg("12571", dup276); + +var msg15017 = msg("12572", dup276); + +var msg15018 = msg("12573", dup276); + +var msg15019 = msg("12574", dup276); + +var msg15020 = msg("12575", dup276); + +var msg15021 = msg("12576", dup276); + +var msg15022 = msg("12577", dup276); + +var msg15023 = msg("12578", dup276); + +var msg15024 = msg("12579", dup276); + +var msg15025 = msg("12580", dup276); + +var msg15026 = msg("12581", dup276); + +var msg15027 = msg("12582", dup276); + +var msg15028 = msg("12583", dup276); + +var msg15029 = msg("12584", dup276); + +var msg15030 = msg("12585", dup276); + +var msg15031 = msg("12586", dup276); + +var msg15032 = msg("12587", dup276); + +var msg15033 = msg("12588", dup276); + +var msg15034 = msg("12589", dup276); + +var msg15035 = msg("12590", dup276); + +var msg15036 = msg("12591", dup198); + +var msg15037 = msg("12592", dup201); + +var msg15038 = msg("12593", dup196); + +var msg15039 = msg("12594", dup198); + +var msg15040 = msg("12595", dup269); + +var msg15041 = msg("12596", dup222); + +var msg15042 = msg("12597", dup198); + +var msg15043 = msg("12598", dup265); + +var msg15044 = msg("12599", dup265); + +var msg15045 = msg("12600", dup265); + +var msg15046 = msg("12601", dup265); + +var msg15047 = msg("12602", dup265); + +var msg15048 = msg("12603", dup265); + +var msg15049 = msg("12604", dup265); + +var msg15050 = msg("12605", dup265); + +var msg15051 = msg("12606", dup265); + +var msg15052 = msg("12607", dup265); + +var msg15053 = msg("12608", dup258); + +var msg15054 = msg("12609", dup258); + +var msg15055 = msg("12610", dup302); + +var msg15056 = msg("12611", dup196); + +var msg15057 = msg("12612", dup265); + +var msg15058 = msg("12613", dup265); + +var msg15059 = msg("12614", dup265); + +var msg15060 = msg("12615", dup265); + +var msg15061 = msg("12616", dup265); + +var msg15062 = msg("12617", dup265); + +var msg15063 = msg("12618", dup267); + +var msg15064 = msg("12619", dup196); + +var msg15065 = msg("12620", dup303); + +var msg15066 = msg("12621", dup303); + +var msg15067 = msg("12622", dup303); + +var msg15068 = msg("12623", dup303); + +var msg15069 = msg("12624", dup303); + +var msg15070 = msg("12625", dup303); + +var msg15071 = msg("12626", dup258); + +var msg15072 = msg("12627", dup287); + +var msg15073 = msg("12628", dup258); + +var msg15074 = msg("12629", dup265); + +var msg15075 = msg("12630", dup196); + +var msg15076 = msg("12631", dup196); + +var msg15077 = msg("12632", dup196); + +var msg15078 = msg("12633", dup196); + +var msg15079 = msg("12634", dup196); + +var msg15080 = msg("12635", dup198); + +var msg15081 = msg("12636", dup222); + +var msg15082 = msg("12637", dup194); + +var msg15083 = msg("12638", dup194); + +var msg15084 = msg("12639", dup194); + +var msg15085 = msg("12640", dup194); + +var msg15086 = msg("12641", dup196); + +var msg15087 = msg("12642", dup198); + +var msg15088 = msg("12643", dup265); + +var msg15089 = msg("12644", dup265); + +var msg15090 = msg("12645", dup265); + +var msg15091 = msg("12646", dup265); + +var msg15092 = msg("12647", dup265); + +var msg15093 = msg("12648", dup265); + +var msg15094 = msg("12649", dup265); + +var msg15095 = msg("12650", dup265); + +var msg15096 = msg("12651", dup265); + +var msg15097 = msg("12652", dup303); + +var msg15098 = msg("12653", dup303); + +var msg15099 = msg("12654", dup303); + +var msg15100 = msg("12655", dup303); + +var msg15101 = msg("12656", dup303); + +var msg15102 = msg("12657", dup303); + +var msg15103 = msg("12658", dup303); + +var msg15104 = msg("12659", dup303); + +var msg15105 = msg("12660", dup303); + +var msg15106 = msg("12661", dup192); + +var msg15107 = msg("12663", dup265); + +var msg15108 = msg("12664", dup196); + +var msg15109 = msg("12665", dup222); + +var msg15110 = msg("12666", dup222); + +var msg15111 = msg("12667", dup269); + +var msg15112 = msg("12668", dup265); + +var msg15113 = msg("12669", dup265); + +var msg15114 = msg("12670", dup265); + +var msg15115 = msg("12671", dup265); + +var msg15116 = msg("12672", dup303); + +var msg15117 = msg("12673", dup303); + +var msg15118 = msg("12674", dup303); + +var msg15119 = msg("12675", dup192); + +var msg15120 = msg("12676", dup303); + +var msg15121 = msg("12677", dup303); + +var msg15122 = msg("12678", dup303); + +var msg15123 = msg("12679", dup303); + +var msg15124 = msg("12680", dup201); + +var msg15125 = msg("12681", dup197); + +var msg15126 = msg("12682", dup201); + +var msg15127 = msg("12683", dup201); + +var msg15128 = msg("12684", dup192); + +var msg15129 = msg("12685", dup197); + +var msg15130 = msg("12686", dup196); + +var msg15131 = msg("12687", dup267); + +var msg15132 = msg("12688", dup267); + +var msg15133 = msg("12689", dup265); + +var msg15134 = msg("12690", dup265); + +var msg15135 = msg("12691", dup196); + +var msg15136 = msg("12692", dup201); + +var msg15137 = msg("12693", dup303); + +var msg15138 = msg("12694", dup303); + +var msg15139 = msg("12695", dup303); + +var msg15140 = msg("12696", dup303); + +var msg15141 = msg("12697", dup303); + +var msg15142 = msg("12698", dup303); + +var msg15143 = msg("12699", dup192); + +var msg15144 = msg("12700", dup192); + +var msg15145 = msg("12701", dup192); + +var msg15146 = msg("12702", dup192); + +var msg15147 = msg("12703", dup265); + +var msg15148 = msg("12704", dup197); + +var msg15149 = msg("12705", dup197); + +var msg15150 = msg("12706", dup197); + +var msg15151 = msg("12707", dup267); + +var msg15152 = msg("12708", dup222); + +var msg15153 = msg("12709", dup196); + +var msg15154 = msg("12710", dup196); + +var msg15155 = msg("12711", dup265); + +var msg15156 = msg("12712", dup242); + +var msg15157 = msg("12713", dup222); + +var msg15158 = msg("12714", dup265); + +var msg15159 = msg("12715", dup265); + +var msg15160 = msg("12716", dup265); + +var msg15161 = msg("12717", dup265); + +var msg15162 = msg("12718", dup303); + +var msg15163 = msg("12719", dup303); + +var msg15164 = msg("12720", dup303); + +var msg15165 = msg("12721", dup303); + +var msg15166 = msg("12722", dup303); + +var msg15167 = msg("12723", dup303); + +var msg15168 = msg("12724", dup192); + +var msg15169 = msg("12725", dup192); + +var msg15170 = msg("12726", dup192); + +var msg15171 = msg("12727", dup192); + +var msg15172 = msg("12728", dup267); + +var msg15173 = msg("12729", dup265); + +var msg15174 = msg("12730", dup265); + +var msg15175 = msg("12731", dup265); + +var msg15176 = msg("12732", dup265); + +var msg15177 = msg("12733", dup265); + +var msg15178 = msg("12734", dup265); + +var msg15179 = msg("12735", dup265); + +var msg15180 = msg("12736", dup265); + +var msg15181 = msg("12737", dup265); + +var msg15182 = msg("12738", dup265); + +var msg15183 = msg("12739", dup265); + +var msg15184 = msg("12740", dup265); + +var msg15185 = msg("12741", dup201); + +var msg15186 = msg("12742", dup222); + +var msg15187 = msg("12743", dup201); + +var msg15188 = msg("12744", dup267); + +var msg15189 = msg("12745", dup267); + +var msg15190 = msg("12746", dup222); + +var msg15191 = msg("12747", dup194); + +var msg15192 = msg("12748", dup194); + +var msg15193 = msg("12749", dup194); + +var msg15194 = msg("12750", dup194); + +var msg15195 = msg("12751", dup265); + +var msg15196 = msg("12752", dup265); + +var msg15197 = msg("12753", dup265); + +var msg15198 = msg("12754", dup265); + +var msg15199 = msg("12755", dup265); + +var msg15200 = msg("12756", dup265); + +var msg15201 = msg("12757", dup267); + +var msg15202 = msg("12758", dup303); + +var msg15203 = msg("12759", dup303); + +var msg15204 = msg("12760", dup303); + +var msg15205 = msg("12761", dup303); + +var msg15206 = msg("12762", dup265); + +var msg15207 = msg("12763", dup265); + +var msg15208 = msg("12764", dup265); + +var msg15209 = msg("12765", dup265); + +var msg15210 = msg("12766", dup265); + +var msg15211 = msg("12767", dup265); + +var msg15212 = msg("12768", dup265); + +var msg15213 = msg("12769", dup265); + +var msg15214 = msg("12770", dup196); + +var msg15215 = msg("12771", dup196); + +var msg15216 = msg("12772", dup196); + +var msg15217 = msg("12773", dup196); + +var msg15218 = msg("12774", dup196); + +var msg15219 = msg("12775", dup196); + +var msg15220 = msg("12776", dup265); + +var msg15221 = msg("12777", dup265); + +var msg15222 = msg("12778", dup265); + +var msg15223 = msg("12779", dup265); + +var msg15224 = msg("12780", dup265); + +var msg15225 = msg("12781", dup265); + +var msg15226 = msg("12782", dup265); + +var msg15227 = msg("12783", dup265); + +var msg15228 = msg("12784", dup197); + +var msg15229 = msg("12785", dup197); + +var msg15230 = msg("12786", dup222); + +var msg15231 = msg("12787", dup222); + +var msg15232 = msg("12788", dup222); + +var msg15233 = msg("12789", dup303); + +var msg15234 = msg("12790", dup303); + +var msg15235 = msg("12791", dup303); + +var msg15236 = msg("12792", dup303); + +var msg15237 = msg("12793", dup303); + +var msg15238 = msg("12794", dup303); + +var msg15239 = msg("12795", dup303); + +var msg15240 = msg("12796", dup303); + +var msg15241 = msg("12797", dup303); + +var msg15242 = msg("12798", dup196); + +var msg15243 = msg("12799", dup196); + +var msg15244 = msg("12800", dup196); + +var msg15245 = msg("12801", dup196); + +var msg15246 = msg("12802", dup196); + +var msg15247 = msg("12803", dup265); + +var msg15248 = msg("12804", dup265); + +var msg15249 = msg("12805", dup265); + +var msg15250 = msg("12806", dup265); + +var msg15251 = msg("12807", dup250); + +var msg15252 = msg("12808", dup276); + +var msg15253 = msg("12809", dup276); + +var msg15254 = msg("12810", dup276); + +var msg15255 = msg("12811", dup276); + +var msg15256 = msg("12812", dup276); + +var msg15257 = msg("12813", dup276); + +var msg15258 = msg("12814", dup276); + +var msg15259 = msg("12815", dup276); + +var msg15260 = msg("12816", dup276); + +var msg15261 = msg("12817", dup276); + +var msg15262 = msg("12818", dup276); + +var msg15263 = msg("12819", dup276); + +var msg15264 = msg("12820", dup276); + +var msg15265 = msg("12821", dup276); + +var msg15266 = msg("12822", dup276); + +var msg15267 = msg("12823", dup276); + +var msg15268 = msg("12824", dup276); + +var msg15269 = msg("12825", dup276); + +var msg15270 = msg("12826", dup276); + +var msg15271 = msg("12827", dup276); + +var msg15272 = msg("12828", dup276); + +var msg15273 = msg("12829", dup276); + +var msg15274 = msg("12830", dup276); + +var msg15275 = msg("12831", dup276); + +var msg15276 = msg("12832", dup276); + +var msg15277 = msg("12833", dup276); + +var msg15278 = msg("12834", dup276); + +var msg15279 = msg("12835", dup276); + +var msg15280 = msg("12836", dup276); + +var msg15281 = msg("12837", dup276); + +var msg15282 = msg("12838", dup276); + +var msg15283 = msg("12839", dup276); + +var msg15284 = msg("12840", dup276); + +var msg15285 = msg("12841", dup276); + +var msg15286 = msg("12842", dup276); + +var msg15287 = msg("12843", dup276); + +var msg15288 = msg("12844", dup276); + +var msg15289 = msg("12845", dup276); + +var msg15290 = msg("12846", dup276); + +var msg15291 = msg("12847", dup276); + +var msg15292 = msg("12848", dup276); + +var msg15293 = msg("12849", dup276); + +var msg15294 = msg("12850", dup276); + +var msg15295 = msg("12851", dup276); + +var msg15296 = msg("12852", dup276); + +var msg15297 = msg("12853", dup276); + +var msg15298 = msg("12854", dup276); + +var msg15299 = msg("12855", dup276); + +var msg15300 = msg("12856", dup276); + +var msg15301 = msg("12857", dup276); + +var msg15302 = msg("12858", dup276); + +var msg15303 = msg("12859", dup276); + +var msg15304 = msg("12860", dup276); + +var msg15305 = msg("12861", dup276); + +var msg15306 = msg("12862", dup276); + +var msg15307 = msg("12863", dup276); + +var msg15308 = msg("12864", dup276); + +var msg15309 = msg("12865", dup276); + +var msg15310 = msg("12866", dup276); + +var msg15311 = msg("12867", dup276); + +var msg15312 = msg("12868", dup276); + +var msg15313 = msg("12869", dup276); + +var msg15314 = msg("12870", dup276); + +var msg15315 = msg("12871", dup276); + +var msg15316 = msg("12872", dup276); + +var msg15317 = msg("12873", dup276); + +var msg15318 = msg("12874", dup276); + +var msg15319 = msg("12875", dup276); + +var msg15320 = msg("12876", dup276); + +var msg15321 = msg("12877", dup276); + +var msg15322 = msg("12878", dup276); + +var msg15323 = msg("12879", dup276); + +var msg15324 = msg("12880", dup276); + +var msg15325 = msg("12881", dup276); + +var msg15326 = msg("12882", dup276); + +var msg15327 = msg("12883", dup276); + +var msg15328 = msg("12884", dup276); + +var msg15329 = msg("12885", dup276); + +var msg15330 = msg("12886", dup276); + +var msg15331 = msg("12887", dup276); + +var msg15332 = msg("12888", dup276); + +var msg15333 = msg("12889", dup276); + +var msg15334 = msg("12890", dup276); + +var msg15335 = msg("12891", dup276); + +var msg15336 = msg("12892", dup276); + +var msg15337 = msg("12893", dup276); + +var msg15338 = msg("12894", dup276); + +var msg15339 = msg("12895", dup276); + +var msg15340 = msg("12896", dup276); + +var msg15341 = msg("12897", dup276); + +var msg15342 = msg("12898", dup276); + +var msg15343 = msg("12899", dup276); + +var msg15344 = msg("12900", dup276); + +var msg15345 = msg("12901", dup276); + +var msg15346 = msg("12902", dup276); + +var msg15347 = msg("12903", dup276); + +var msg15348 = msg("12904", dup222); + +var msg15349 = msg("12905", dup222); + +var msg15350 = msg("12906", dup276); + +var msg15351 = msg("12907", dup276); + +var msg15352 = msg("12908", dup276); + +var msg15353 = msg("12909", dup276); + +var msg15354 = msg("12910", dup276); + +var msg15355 = msg("12911", dup276); + +var msg15356 = msg("12912", dup276); + +var msg15357 = msg("12913", dup276); + +var msg15358 = msg("12914", dup276); + +var msg15359 = msg("12915", dup276); + +var msg15360 = msg("12916", dup276); + +var msg15361 = msg("12917", dup276); + +var msg15362 = msg("12918", dup276); + +var msg15363 = msg("12919", dup276); + +var msg15364 = msg("12920", dup276); + +var msg15365 = msg("12921", dup276); + +var msg15366 = msg("12922", dup276); + +var msg15367 = msg("12923", dup276); + +var msg15368 = msg("12924", dup276); + +var msg15369 = msg("12925", dup276); + +var msg15370 = msg("12926", dup276); + +var msg15371 = msg("12927", dup276); + +var msg15372 = msg("12928", dup276); + +var msg15373 = msg("12929", dup276); + +var msg15374 = msg("12930", dup276); + +var msg15375 = msg("12931", dup276); + +var msg15376 = msg("12932", dup276); + +var msg15377 = msg("12933", dup276); + +var msg15378 = msg("12934", dup276); + +var msg15379 = msg("12935", dup276); + +var msg15380 = msg("12936", dup276); + +var msg15381 = msg("12937", dup276); + +var msg15382 = msg("12938", dup276); + +var msg15383 = msg("12939", dup276); + +var msg15384 = msg("12940", dup276); + +var msg15385 = msg("12941", dup276); + +var msg15386 = msg("12942", dup276); + +var msg15387 = msg("12943", dup276); + +var msg15388 = msg("12944", dup276); + +var msg15389 = msg("12945", dup276); + +var msg15390 = msg("12946", dup276); + +var msg15391 = msg("12947", dup276); + +var msg15392 = msg("12948", dup265); + +var msg15393 = msg("12949", dup265); + +var msg15394 = msg("12950", dup265); + +var msg15395 = msg("12951", dup265); + +var msg15396 = msg("12952", dup265); + +var msg15397 = msg("12953", dup265); + +var msg15398 = msg("12954", dup265); + +var msg15399 = msg("12955", dup265); + +var msg15400 = msg("12956", dup265); + +var msg15401 = msg("12957", dup265); + +var msg15402 = msg("12958", dup265); + +var msg15403 = msg("12959", dup265); + +var msg15404 = msg("12960", dup265); + +var msg15405 = msg("12961", dup265); + +var msg15406 = msg("12962", dup265); + +var msg15407 = msg("12963", dup265); + +var msg15408 = msg("12964", dup265); + +var msg15409 = msg("12965", dup265); + +var msg15410 = msg("12966", dup265); + +var msg15411 = msg("12967", dup265); + +var msg15412 = msg("12968", dup265); + +var msg15413 = msg("12969", dup265); + +var msg15414 = msg("12970", dup265); + +var msg15415 = msg("12971", dup222); + +var msg15416 = msg("12972", dup265); + +var msg15417 = msg("12973", dup276); + +var msg15418 = msg("12974", dup276); + +var msg15419 = msg("12975", dup276); + +var msg15420 = msg("12976", dup276); + +var msg15421 = msg("12977", dup276); + +var msg15422 = msg("12978", dup276); + +var msg15423 = msg("12979", dup276); + +var msg15424 = msg("12980", dup276); + +var msg15425 = msg("12981", dup276); + +var msg15426 = msg("12982", dup276); + +var msg15427 = msg("12983", dup222); + +var msg15428 = msg("12984", dup276); + +var msg15429 = msg("12985", dup276); + +var msg15430 = msg("12986", dup276); + +var msg15431 = msg("12987", dup276); + +var msg15432 = msg("12988", dup276); + +var msg15433 = msg("12989", dup276); + +var msg15434 = msg("12990", dup276); + +var msg15435 = msg("12991", dup276); + +var msg15436 = msg("12992", dup276); + +var msg15437 = msg("12993", dup276); + +var msg15438 = msg("12994", dup276); + +var msg15439 = msg("12995", dup276); + +var msg15440 = msg("12996", dup276); + +var msg15441 = msg("12997", dup276); + +var msg15442 = msg("12998", dup276); + +var msg15443 = msg("12999", dup276); + +var msg15444 = msg("13000", dup276); + +var msg15445 = msg("13001", dup276); + +var msg15446 = msg("13002", dup276); + +var msg15447 = msg("13003", dup276); + +var msg15448 = msg("13004", dup276); + +var msg15449 = msg("13005", dup276); + +var msg15450 = msg("13006", dup276); + +var msg15451 = msg("13007", dup276); + +var msg15452 = msg("13008", dup276); + +var msg15453 = msg("13009", dup276); + +var msg15454 = msg("13010", dup276); + +var msg15455 = msg("13011", dup276); + +var msg15456 = msg("13012", dup276); + +var msg15457 = msg("13013", dup276); + +var msg15458 = msg("13014", dup276); + +var msg15459 = msg("13015", dup276); + +var msg15460 = msg("13016", dup276); + +var msg15461 = msg("13017", dup276); + +var msg15462 = msg("13018", dup276); + +var msg15463 = msg("13019", dup276); + +var msg15464 = msg("13020", dup276); + +var msg15465 = msg("13021", dup276); + +var msg15466 = msg("13022", dup276); + +var msg15467 = msg("13023", dup276); + +var msg15468 = msg("13024", dup276); + +var msg15469 = msg("13025", dup276); + +var msg15470 = msg("13026", dup276); + +var msg15471 = msg("13027", dup276); + +var msg15472 = msg("13028", dup276); + +var msg15473 = msg("13029", dup276); + +var msg15474 = msg("13030", dup276); + +var msg15475 = msg("13031", dup276); + +var msg15476 = msg("13032", dup276); + +var msg15477 = msg("13033", dup276); + +var msg15478 = msg("13034", dup276); + +var msg15479 = msg("13035", dup276); + +var msg15480 = msg("13036", dup276); + +var msg15481 = msg("13037", dup276); + +var msg15482 = msg("13038", dup276); + +var msg15483 = msg("13039", dup276); + +var msg15484 = msg("13040", dup276); + +var msg15485 = msg("13041", dup276); + +var msg15486 = msg("13042", dup276); + +var msg15487 = msg("13043", dup276); + +var msg15488 = msg("13044", dup276); + +var msg15489 = msg("13045", dup276); + +var msg15490 = msg("13046", dup276); + +var msg15491 = msg("13047", dup276); + +var msg15492 = msg("13048", dup276); + +var msg15493 = msg("13049", dup276); + +var msg15494 = msg("13050", dup276); + +var msg15495 = msg("13051", dup276); + +var msg15496 = msg("13052", dup276); + +var msg15497 = msg("13053", dup276); + +var msg15498 = msg("13054", dup276); + +var msg15499 = msg("13055", dup276); + +var msg15500 = msg("13056", dup276); + +var msg15501 = msg("13057", dup276); + +var msg15502 = msg("13058", dup276); + +var msg15503 = msg("13059", dup276); + +var msg15504 = msg("13060", dup276); + +var msg15505 = msg("13061", dup276); + +var msg15506 = msg("13062", dup276); + +var msg15507 = msg("13063", dup276); + +var msg15508 = msg("13064", dup276); + +var msg15509 = msg("13065", dup276); + +var msg15510 = msg("13066", dup276); + +var msg15511 = msg("13067", dup276); + +var msg15512 = msg("13068", dup276); + +var msg15513 = msg("13069", dup276); + +var msg15514 = msg("13070", dup276); + +var msg15515 = msg("13071", dup276); + +var msg15516 = msg("13072", dup276); + +var msg15517 = msg("13073", dup276); + +var msg15518 = msg("13074", dup276); + +var msg15519 = msg("13075", dup276); + +var msg15520 = msg("13076", dup276); + +var msg15521 = msg("13077", dup276); + +var msg15522 = msg("13078", dup276); + +var msg15523 = msg("13079", dup276); + +var msg15524 = msg("13080", dup276); + +var msg15525 = msg("13081", dup276); + +var msg15526 = msg("13082", dup276); + +var msg15527 = msg("13083", dup276); + +var msg15528 = msg("13084", dup276); + +var msg15529 = msg("13085", dup276); + +var msg15530 = msg("13086", dup276); + +var msg15531 = msg("13087", dup276); + +var msg15532 = msg("13088", dup276); + +var msg15533 = msg("13089", dup276); + +var msg15534 = msg("13090", dup276); + +var msg15535 = msg("13091", dup276); + +var msg15536 = msg("13092", dup276); + +var msg15537 = msg("13093", dup276); + +var msg15538 = msg("13094", dup276); + +var msg15539 = msg("13095", dup276); + +var msg15540 = msg("13096", dup276); + +var msg15541 = msg("13097", dup276); + +var msg15542 = msg("13098", dup276); + +var msg15543 = msg("13099", dup276); + +var msg15544 = msg("13100", dup276); + +var msg15545 = msg("13101", dup276); + +var msg15546 = msg("13102", dup276); + +var msg15547 = msg("13103", dup276); + +var msg15548 = msg("13104", dup276); + +var msg15549 = msg("13105", dup276); + +var msg15550 = msg("13106", dup276); + +var msg15551 = msg("13107", dup276); + +var msg15552 = msg("13108", dup276); + +var msg15553 = msg("13109", dup276); + +var msg15554 = msg("13110", dup276); + +var msg15555 = msg("13111", dup276); + +var msg15556 = msg("13112", dup276); + +var msg15557 = msg("13113", dup276); + +var msg15558 = msg("13114", dup276); + +var msg15559 = msg("13115", dup276); + +var msg15560 = msg("13116", dup276); + +var msg15561 = msg("13117", dup276); + +var msg15562 = msg("13118", dup276); + +var msg15563 = msg("13119", dup276); + +var msg15564 = msg("13120", dup276); + +var msg15565 = msg("13121", dup276); + +var msg15566 = msg("13122", dup276); + +var msg15567 = msg("13123", dup276); + +var msg15568 = msg("13124", dup276); + +var msg15569 = msg("13125", dup276); + +var msg15570 = msg("13126", dup276); + +var msg15571 = msg("13127", dup276); + +var msg15572 = msg("13128", dup276); + +var msg15573 = msg("13129", dup276); + +var msg15574 = msg("13130", dup201); + +var msg15575 = msg("13131", dup276); + +var msg15576 = msg("13132", dup276); + +var msg15577 = msg("13133", dup276); + +var msg15578 = msg("13134", dup201); + +var msg15579 = msg("13135", dup276); + +var msg15580 = msg("13136", dup276); + +var msg15581 = msg("13137", dup276); + +var msg15582 = msg("13138", dup276); + +var msg15583 = msg("13139", dup201); + +var msg15584 = msg("13140", dup201); + +var msg15585 = msg("13141", dup276); + +var msg15586 = msg("13142", dup276); + +var msg15587 = msg("13143", dup201); + +var msg15588 = msg("13144", dup201); + +var msg15589 = msg("13145", dup201); + +var msg15590 = msg("13146", dup276); + +var msg15591 = msg("13147", dup201); + +var msg15592 = msg("13148", dup201); + +var msg15593 = msg("13149", dup276); + +var msg15594 = msg("13150", dup276); + +var msg15595 = msg("13151", dup276); + +var msg15596 = msg("13152", dup201); + +var msg15597 = msg("13153", dup276); + +var msg15598 = msg("13154", dup276); + +var msg15599 = msg("13155", dup201); + +var msg15600 = msg("13156", dup201); + +var msg15601 = msg("13157", dup276); + +var msg15602 = msg("13158", dup222); + +var msg15603 = msg("13159", dup222); + +var msg15604 = msg("13160", dup267); + +var msg15605 = msg("13161", dup222); + +var msg15606 = msg("13162", dup276); + +var msg15607 = msg("13163", dup276); + +var msg15608 = msg("13164", dup276); + +var msg15609 = msg("13165", dup276); + +var msg15610 = msg("13166", dup276); + +var msg15611 = msg("13167", dup276); + +var msg15612 = msg("13168", dup276); + +var msg15613 = msg("13169", dup276); + +var msg15614 = msg("13170", dup276); + +var msg15615 = msg("13171", dup276); + +var msg15616 = msg("13172", dup276); + +var msg15617 = msg("13173", dup276); + +var msg15618 = msg("13174", dup276); + +var msg15619 = msg("13175", dup276); + +var msg15620 = msg("13176", dup276); + +var msg15621 = msg("13177", dup276); + +var msg15622 = msg("13178", dup276); + +var msg15623 = msg("13179", dup276); + +var msg15624 = msg("13180", dup276); + +var msg15625 = msg("13181", dup276); + +var msg15626 = msg("13182", dup276); + +var msg15627 = msg("13183", dup276); + +var msg15628 = msg("13184", dup276); + +var msg15629 = msg("13185", dup276); + +var msg15630 = msg("13186", dup276); + +var msg15631 = msg("13187", dup276); + +var msg15632 = msg("13188", dup276); + +var msg15633 = msg("13189", dup276); + +var msg15634 = msg("13190", dup276); + +var msg15635 = msg("13191", dup276); + +var msg15636 = msg("13192", dup276); + +var msg15637 = msg("13193", dup276); + +var msg15638 = msg("13194", dup276); + +var msg15639 = msg("13195", dup276); + +var msg15640 = msg("13196", dup276); + +var msg15641 = msg("13197", dup276); + +var msg15642 = msg("13198", dup276); + +var msg15643 = msg("13199", dup276); + +var msg15644 = msg("13200", dup276); + +var msg15645 = msg("13201", dup276); + +var msg15646 = msg("13202", dup276); + +var msg15647 = msg("13203", dup276); + +var msg15648 = msg("13204", dup276); + +var msg15649 = msg("13205", dup276); + +var msg15650 = msg("13206", dup276); + +var msg15651 = msg("13207", dup276); + +var msg15652 = msg("13208", dup276); + +var msg15653 = msg("13209", dup276); + +var msg15654 = msg("13210", dup276); + +var msg15655 = msg("13211", dup276); + +var msg15656 = msg("13212", dup276); + +var msg15657 = msg("13213", dup276); + +var msg15658 = msg("13214", dup276); + +var msg15659 = msg("13215", dup276); + +var msg15660 = msg("13216", dup265); + +var msg15661 = msg("13217", dup265); + +var msg15662 = msg("13218", dup265); + +var msg15663 = msg("13219", dup265); + +var msg15664 = msg("13220", dup265); + +var msg15665 = msg("13221", dup222); + +var msg15666 = msg("13222", dup222); + +var msg15667 = msg("13223", dup269); + +var msg15668 = msg("13224", dup265); + +var msg15669 = msg("13225", dup265); + +var msg15670 = msg("13226", dup265); + +var msg15671 = msg("13227", dup265); + +var msg15672 = msg("13228", dup265); + +var msg15673 = msg("13229", dup265); + +var msg15674 = msg("13230", dup265); + +var msg15675 = msg("13231", dup265); + +var msg15676 = msg("13232", dup265); + +var msg15677 = msg("13233", dup265); + +var msg15678 = msg("13234", dup265); + +var msg15679 = msg("13235", dup265); + +var msg15680 = msg("13236", dup303); + +var msg15681 = msg("13237", dup303); + +var msg15682 = msg("13238", dup303); + +var msg15683 = msg("13239", dup303); + +var msg15684 = msg("13240", dup303); + +var msg15685 = msg("13241", dup303); + +var msg15686 = msg("13242", dup303); + +var msg15687 = msg("13243", dup303); + +var msg15688 = msg("13244", dup303); + +var msg15689 = msg("13245", dup192); + +var msg15690 = msg("13246", dup192); + +var msg15691 = msg("13247", dup192); + +var msg15692 = msg("13248", dup192); + +var msg15693 = msg("13249", dup196); + +var msg15694 = msg("13250", dup287); + +var msg15695 = msg("13251", dup258); + +var msg15696 = msg("13252", dup287); + +var msg15697 = msg("13253", dup258); + +var msg15698 = msg("13254", dup287); + +var msg15699 = msg("13255", dup258); + +var msg15700 = msg("13256", dup287); + +var msg15701 = msg("13257", dup258); + +var msg15702 = msg("13258", dup265); + +var msg15703 = msg("13259", dup265); + +var msg15704 = msg("13260", dup265); + +var msg15705 = msg("13261", dup265); + +var msg15706 = msg("13262", dup265); + +var msg15707 = msg("13263", dup265); + +var msg15708 = msg("13264", dup265); + +var msg15709 = msg("13265", dup265); + +var msg15710 = msg("13266", dup265); + +var msg15711 = msg("13267", dup265); + +var msg15712 = msg("13268", dup269); + +var msg15713 = msg("13269", dup196); + +var msg15714 = msg("13270", dup196); + +var msg15715 = msg("13271", dup196); + +var msg15716 = msg("13272", dup196); + +var msg15717 = msg("13273", dup265); + +var msg15718 = msg("13274", dup265); + +var msg15719 = msg("13275", dup265); + +var msg15720 = msg("13276", dup265); + +var msg15721 = msg("13277", dup303); + +var msg15722 = msg("13278", dup303); + +var msg15723 = msg("13279", dup303); + +var msg15724 = msg("13280", dup303); + +var msg15725 = msg("13281", dup303); + +var msg15726 = msg("13282", dup303); + +var msg15727 = msg("13283", dup303); + +var msg15728 = msg("13284", dup303); + +var msg15729 = msg("13285", dup303); + +var msg15730 = msg("13286", dup303); + +var msg15731 = msg("13287", dup201); + +var msg15732 = msg("13288", dup201); + +var msg15733 = msg("13289", dup265); + +var msg15734 = msg("13290", dup265); + +var msg15735 = msg("13291", dup222); + +var msg15736 = msg("13292", dup196); + +var msg15737 = msg("13293", dup267); + +var msg15738 = msg("13294", dup265); + +var msg15739 = msg("13295", dup265); + +var msg15740 = msg("13296", dup265); + +var msg15741 = msg("13297", dup265); + +var msg15742 = msg("13298", dup265); + +var msg15743 = msg("13299", dup265); + +var msg15744 = msg("13300", dup267); + +var msg15745 = msg("13301", dup267); + +var msg15746 = msg("13302", dup265); + +var msg15747 = msg("13303", dup265); + +var msg15748 = msg("13304", dup265); + +var msg15749 = msg("13305", dup265); + +var msg15750 = msg("13306", dup265); + +var msg15751 = msg("13307", dup198); + +var msg15752 = msg("13308", dup265); + +var msg15753 = msg("13309", dup198); + +var msg15754 = msg("13310", dup198); + +var msg15755 = msg("13311", dup198); + +var msg15756 = msg("13312", dup265); + +var msg15757 = msg("13313", dup265); + +var msg15758 = msg("13314", dup265); + +var msg15759 = msg("13315", dup265); + +var msg15760 = msg("13316", dup267); + +var msg15761 = msg("13317", dup267); + +var msg15762 = msg("13318", dup267); + +var msg15763 = msg("13319", dup267); + +var msg15764 = msg("13320", dup267); + +var msg15765 = msg("13321", dup265); + +var msg15766 = msg("13322", dup265); + +var msg15767 = msg("13323", dup265); + +var msg15768 = msg("13324", dup265); + +var msg15769 = msg("13325", dup265); + +var msg15770 = msg("13326", dup265); + +var msg15771 = msg("13327", dup265); + +var msg15772 = msg("13328", dup265); + +var msg15773 = msg("13329", dup265); + +var msg15774 = msg("13330", dup265); + +var msg15775 = msg("13331", dup265); + +var msg15776 = msg("13332", dup265); + +var msg15777 = msg("13333", dup265); + +var msg15778 = msg("13334", dup265); + +var msg15779 = msg("13335", dup265); + +var msg15780 = msg("13336", dup265); + +var msg15781 = msg("13337", dup194); + +var msg15782 = msg("13338", dup194); + +var msg15783 = msg("13339", dup303); + +var msg15784 = msg("13340", dup303); + +var msg15785 = msg("13341", dup303); + +var msg15786 = msg("13342", dup303); + +var msg15787 = msg("13343", dup303); + +var msg15788 = msg("13344", dup303); + +var msg15789 = msg("13345", dup303); + +var msg15790 = msg("13346", dup303); + +var msg15791 = msg("13347", dup303); + +var msg15792 = msg("13348", dup265); + +var msg15793 = msg("13349", dup265); + +var msg15794 = msg("13350", dup265); + +var msg15795 = msg("13351", dup265); + +var msg15796 = msg("13352", dup265); + +var msg15797 = msg("13353", dup265); + +var msg15798 = msg("13354", dup265); + +var msg15799 = msg("13355", dup265); + +var msg15800 = msg("13356", dup260); + +var msg15801 = msg("13357", dup236); + +var msg15802 = msg("13358", dup273); + +var msg15803 = msg("13359", dup236); + +var msg15804 = msg("13360", dup236); + +var msg15805 = msg("13361", dup222); + +var msg15806 = msg("13362", dup222); + +var msg15807 = msg("13363", dup222); + +var msg15808 = msg("13364", dup197); + +var msg15809 = msg("13365", dup222); + +var msg15810 = msg("13366", dup260); + +var msg15811 = msg("13367", dup276); + +var msg15812 = msg("13368", dup276); + +var msg15813 = msg("13369", dup276); + +var msg15814 = msg("13370", dup276); + +var msg15815 = msg("13371", dup276); + +var msg15816 = msg("13372", dup276); + +var msg15817 = msg("13373", dup276); + +var msg15818 = msg("13374", dup276); + +var msg15819 = msg("13375", dup276); + +var msg15820 = msg("13376", dup276); + +var msg15821 = msg("13377", dup276); + +var msg15822 = msg("13378", dup276); + +var msg15823 = msg("13379", dup276); + +var msg15824 = msg("13380", dup276); + +var msg15825 = msg("13381", dup276); + +var msg15826 = msg("13382", dup276); + +var msg15827 = msg("13383", dup276); + +var msg15828 = msg("13384", dup276); + +var msg15829 = msg("13385", dup276); + +var msg15830 = msg("13386", dup276); + +var msg15831 = msg("13387", dup276); + +var msg15832 = msg("13388", dup276); + +var msg15833 = msg("13389", dup276); + +var msg15834 = msg("13390", dup276); + +var msg15835 = msg("13391", dup276); + +var msg15836 = msg("13392", dup276); + +var msg15837 = msg("13393", dup276); + +var msg15838 = msg("13394", dup276); + +var msg15839 = msg("13395", dup276); + +var msg15840 = msg("13396", dup276); + +var msg15841 = msg("13397", dup276); + +var msg15842 = msg("13398", dup276); + +var msg15843 = msg("13399", dup276); + +var msg15844 = msg("13400", dup276); + +var msg15845 = msg("13401", dup276); + +var msg15846 = msg("13402", dup276); + +var msg15847 = msg("13403", dup276); + +var msg15848 = msg("13404", dup276); + +var msg15849 = msg("13405", dup276); + +var msg15850 = msg("13406", dup276); + +var msg15851 = msg("13407", dup276); + +var msg15852 = msg("13408", dup276); + +var msg15853 = msg("13409", dup276); + +var msg15854 = msg("13410", dup276); + +var msg15855 = msg("13411", dup276); + +var msg15856 = msg("13412", dup276); + +var msg15857 = msg("13413", dup276); + +var msg15858 = msg("13414", dup276); + +var msg15859 = msg("13415", dup197); + +var msg15860 = msg("13416", dup198); + +var msg15861 = msg("13417", dup222); + +var msg15862 = msg("13418", dup198); + +var msg15863 = msg("13419", dup265); + +var msg15864 = msg("13420", dup265); + +var msg15865 = msg("13421", dup265); + +var msg15866 = msg("13422", dup265); + +var msg15867 = msg("13423", dup265); + +var msg15868 = msg("13424", dup265); + +var msg15869 = msg("13425", dup198); + +var msg15870 = msg("13426", dup265); + +var msg15871 = msg("13427", dup265); + +var msg15872 = msg("13428", dup265); + +var msg15873 = msg("13429", dup265); + +var msg15874 = msg("13430", dup265); + +var msg15875 = msg("13431", dup265); + +var msg15876 = msg("13432", dup265); + +var msg15877 = msg("13433", dup265); + +var msg15878 = msg("13434", dup265); + +var msg15879 = msg("13435", dup265); + +var msg15880 = msg("13436", dup265); + +var msg15881 = msg("13437", dup265); + +var msg15882 = msg("13438", dup265); + +var msg15883 = msg("13439", dup265); + +var msg15884 = msg("13440", dup265); + +var msg15885 = msg("13441", dup265); + +var msg15886 = msg("13442", dup265); + +var msg15887 = msg("13443", dup265); + +var msg15888 = msg("13444", dup265); + +var msg15889 = msg("13445", dup265); + +var msg15890 = msg("13446", dup265); + +var msg15891 = msg("13447", dup265); + +var msg15892 = msg("13448", dup201); + +var msg15893 = msg("13449", dup201); + +var msg15894 = msg("13450", dup198); + +var msg15895 = msg("13451", dup265); + +var msg15896 = msg("13452", dup265); + +var msg15897 = msg("13453", dup265); + +var msg15898 = msg("13454", dup265); + +var msg15899 = msg("13455", dup265); + +var msg15900 = msg("13456", dup265); + +var msg15901 = msg("13457", dup265); + +var msg15902 = msg("13458", dup265); + +var msg15903 = msg("13459", dup265); + +var msg15904 = msg("13460", dup265); + +var msg15905 = msg("13465", dup265); + +var msg15906 = msg("13466", dup265); + +var msg15907 = msg("13467", dup265); + +var msg15908 = msg("13468", dup265); + +var msg15909 = msg("13469", dup265); + +var msg15910 = msg("13470", dup196); + +var msg15911 = msg("13471", dup196); + +var msg15912 = msg("13472", dup196); + +var msg15913 = msg("13473", dup196); + +var msg15914 = msg("13474", dup267); + +var msg15915 = msg("13475", dup198); + +var msg15916 = msg("13476", dup197); + +var msg15917 = msg("13477", dup196); + +var msg15918 = msg("13478", dup196); + +var msg15919 = msg("13479", dup303); + +var msg15920 = msg("13480", dup303); + +var msg15921 = msg("13481", dup303); + +var msg15922 = msg("13482", dup303); + +var msg15923 = msg("13483", dup303); + +var msg15924 = msg("13484", dup303); + +var msg15925 = msg("13485", dup303); + +var msg15926 = msg("13486", dup303); + +var msg15927 = msg("13487", dup303); + +var msg15928 = msg("13488", dup303); + +var msg15929 = msg("13489", dup303); + +var msg15930 = msg("13490", dup303); + +var msg15931 = msg("13491", dup303); + +var msg15932 = msg("13492", dup303); + +var msg15933 = msg("13493", dup303); + +var msg15934 = msg("13494", dup303); + +var msg15935 = msg("13495", dup303); + +var msg15936 = msg("13496", dup303); + +var msg15937 = msg("13497", dup303); + +var msg15938 = msg("13498", dup303); + +var msg15939 = msg("13499", dup303); + +var msg15940 = msg("13500", dup303); + +var msg15941 = msg("13501", dup303); + +var msg15942 = msg("13502", dup303); + +var msg15943 = msg("13503", dup303); + +var msg15944 = msg("13504", dup303); + +var msg15945 = msg("13505", dup303); + +var msg15946 = msg("13506", dup192); + +var msg15947 = msg("13507", dup192); + +var msg15948 = msg("13508", dup192); + +var msg15949 = msg("13509", dup192); + +var msg15950 = msg("13510", dup222); + +var msg15951 = msg("13511", dup196); + +var msg15952 = msg("13512", dup260); + +var msg15953 = msg("13513", dup260); + +var msg15954 = msg("13514", dup260); + +var msg15955 = msg("13515", dup196); + +var msg15956 = msg("13516", dup197); + +var msg15957 = msg("13517", dup196); + +var msg15958 = msg("13518", dup265); + +var msg15959 = msg("13519", dup222); + +var msg15960 = msg("13520", dup269); + +var msg15961 = msg("13521", dup269); + +var msg15962 = msg("13522", dup197); + +var msg15963 = msg("13523", dup265); + +var msg15964 = msg("13524", dup265); + +var msg15965 = msg("13525", dup265); + +var msg15966 = msg("13526", dup265); + +var msg15967 = msg("13527", dup265); + +var msg15968 = msg("13528", dup265); + +var msg15969 = msg("13529", dup265); + +var msg15970 = msg("13530", dup265); + +var msg15971 = msg("13531", dup265); + +var msg15972 = msg("13532", dup265); + +var msg15973 = msg("13533", dup265); + +var msg15974 = msg("13534", dup265); + +var msg15975 = msg("13535", dup265); + +var msg15976 = msg("13536", dup265); + +var msg15977 = msg("13537", dup265); + +var msg15978 = msg("13538", dup265); + +var msg15979 = msg("13539", dup267); + +var msg15980 = msg("13540", dup267); + +var msg15981 = msg("13541", dup267); + +var msg15982 = msg("13542", dup267); + +var msg15983 = msg("13543", dup265); + +var msg15984 = msg("13544", dup265); + +var msg15985 = msg("13545", dup265); + +var msg15986 = msg("13546", dup265); + +var msg15987 = msg("13547", dup265); + +var msg15988 = msg("13548", dup265); + +var msg15989 = msg("13549", dup265); + +var msg15990 = msg("13550", dup265); + +var msg15991 = msg("13551", dup260); + +var msg15992 = msg("13552", dup222); + +var msg15993 = msg("13553", dup197); + +var msg15994 = msg("13554", dup197); + +var msg15995 = msg("13555", dup197); + +var msg15996 = msg("13556", dup303); + +var msg15997 = msg("13557", dup303); + +var msg15998 = msg("13558", dup303); + +var msg15999 = msg("13559", dup303); + +var msg16000 = msg("13560", dup303); + +var msg16001 = msg("13561", dup303); + +var msg16002 = msg("13562", dup303); + +var msg16003 = msg("13563", dup303); + +var msg16004 = msg("13564", dup303); + +var msg16005 = msg("13565", dup303); + +var msg16006 = msg("13566", dup303); + +var msg16007 = msg("13567", dup303); + +var msg16008 = msg("13568", dup303); + +var msg16009 = msg("13569", dup269); + +var msg16010 = msg("13570", dup265); + +var msg16011 = msg("13571", dup265); + +var msg16012 = msg("13572", dup269); + +var msg16013 = msg("13573", dup265); + +var msg16014 = msg("13580", dup267); + +var msg16015 = msg("13581", dup267); + +var msg16016 = msg("13582", dup265); + +var msg16017 = msg("13583", dup266); + +var msg16018 = msg("13584", dup266); + +var msg16019 = msg("13585", dup217); + +var all47 = all_match({ + processors: [ + dup66, + dup178, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup76, + dup56, + ]), +}); + +var msg16020 = msg("13585:01", all47); + +var select2440 = linear_select([ + msg16019, + msg16020, +]); + +var msg16021 = msg("13586", dup196); + +var msg16022 = msg("13587", dup287); + +var msg16023 = msg("13588", dup287); + +var msg16024 = msg("13589", dup287); + +var msg16025 = msg("13590", dup287); + +var msg16026 = msg("13591", dup194); + +var msg16027 = msg("13592", dup269); + +var msg16028 = msg("13593", dup260); + +var msg16029 = msg("13593:01", dup261); + +var select2441 = linear_select([ + msg16028, + msg16029, +]); + +var msg16030 = msg("13594", dup198); + +var msg16031 = msg("13595", dup266); + +var msg16032 = msg("13596", dup266); + +var msg16033 = msg("13597", dup266); + +var msg16034 = msg("13598", dup266); + +var msg16035 = msg("13599", dup229); + +var msg16036 = msg("13600", dup229); + +var msg16037 = msg("13601", dup229); + +var msg16038 = msg("13602", dup229); + +var msg16039 = msg("13603", dup266); + +var msg16040 = msg("13604", dup266); + +var msg16041 = msg("13605", dup266); + +var msg16042 = msg("13606", dup266); + +var msg16043 = msg("13607", dup266); + +var msg16044 = msg("13608", dup266); + +var msg16045 = msg("13609", dup266); + +var msg16046 = msg("13610", dup266); + +var msg16047 = msg("13611", dup196); + +var msg16048 = msg("13612", dup285); + +var msg16049 = msg("13613", dup285); + +var msg16050 = msg("13614", dup222); + +var msg16051 = msg("13615", dup222); + +var msg16052 = msg("13616", dup197); + +var msg16053 = msg("13617", dup222); + +var msg16054 = msg("13618", dup222); + +var msg16055 = msg("13619", dup196); + +var msg16056 = msg("13620", dup222); + +var msg16057 = msg("13621", dup266); + +var msg16058 = msg("13622", dup266); + +var msg16059 = msg("13623", dup266); + +var msg16060 = msg("13624", dup266); + +var msg16061 = msg("13625", dup262); + +var msg16062 = msg("13626", dup265); + +var msg16063 = msg("13627", dup266); + +var msg16064 = msg("13628", dup265); + +var msg16065 = msg("13628:01", dup266); + +var select2442 = linear_select([ + msg16064, + msg16065, +]); + +var msg16066 = msg("13629", dup265); + +var msg16067 = msg("13630", dup265); + +var msg16068 = msg("13631", dup196); + +var msg16069 = msg("13632", dup266); + +var msg16070 = msg("13633", dup265); + +var msg16071 = msg("13634", dup265); + +var msg16072 = msg("13635", dup192); + +var msg16073 = msg("13636", dup192); + +var msg16074 = msg("13637", dup303); + +var msg16075 = msg("13638", dup303); + +var msg16076 = msg("13639", dup303); + +var msg16077 = msg("13640", dup303); + +var msg16078 = msg("13641", dup303); + +var msg16079 = msg("13642", dup303); + +var msg16080 = msg("13643", dup303); + +var msg16081 = msg("13644", dup303); + +var msg16082 = msg("13645", dup303); + +var msg16083 = msg("13646", dup303); + +var msg16084 = msg("13647", dup303); + +var msg16085 = msg("13648", dup303); + +var msg16086 = msg("13649", dup303); + +var msg16087 = msg("13650", dup303); + +var msg16088 = msg("13651", dup303); + +var msg16089 = msg("13652", dup303); + +var msg16090 = msg("13653", dup303); + +var msg16091 = msg("13654", dup192); + +var msg16092 = msg("13655", dup192); + +var msg16093 = msg("13656", dup267); + +var msg16094 = msg("13657", dup265); + +var msg16095 = msg("13658", dup265); + +var msg16096 = msg("13659", dup265); + +var msg16097 = msg("13660", dup265); + +var msg16098 = msg("13661", dup265); + +var msg16099 = msg("13662", dup265); + +var msg16100 = msg("13663", dup222); + +var msg16101 = msg("13664", dup196); + +var msg16102 = msg("13665", dup267); + +var msg16103 = msg("13666", dup267); + +var msg16104 = msg("13667", dup196); + +var msg16105 = msg("13668", dup265); + +var msg16106 = msg("13669", dup265); + +var msg16107 = msg("13670", dup265); + +var msg16108 = msg("13671", dup265); + +var msg16109 = msg("13672", dup265); + +var msg16110 = msg("13673", dup265); + +var msg16111 = msg("13674", dup265); + +var msg16112 = msg("13675", dup265); + +var msg16113 = msg("13676", dup267); + +var msg16114 = msg("13677", dup265); + +var msg16115 = msg("13678", dup196); + +var msg16116 = msg("13679", dup265); + +var msg16117 = msg("13680", dup265); + +var msg16118 = msg("13681", dup265); + +var msg16119 = msg("13682", dup265); + +var msg16120 = msg("13683", dup265); + +var msg16121 = msg("13684", dup265); + +var msg16122 = msg("13685", dup265); + +var msg16123 = msg("13686", dup265); + +var msg16124 = msg("13687", dup265); + +var msg16125 = msg("13688", dup265); + +var msg16126 = msg("13689", dup265); + +var msg16127 = msg("13690", dup265); + +var msg16128 = msg("13691", dup265); + +var msg16129 = msg("13692", dup265); + +var msg16130 = msg("13693", dup196); + +var msg16131 = msg("13694", dup196); + +var msg16132 = msg("13695", dup196); + +var msg16133 = msg("13696", dup196); + +var msg16134 = msg("13697", dup196); + +var msg16135 = msg("13698", dup196); + +var msg16136 = msg("13699", dup265); + +var msg16137 = msg("13700", dup265); + +var msg16138 = msg("13709", dup240); + +var msg16139 = msg("13710", dup240); + +var msg16140 = msg("13711", dup201); + +var msg16141 = msg("13712", dup260); + +var msg16142 = msg("13713", dup260); + +var msg16143 = msg("13714", dup201); + +var msg16144 = msg("13715", dup267); + +var msg16145 = msg("13716", dup287); + +var msg16146 = msg("13717", dup258); + +var msg16147 = msg("13718", dup222); + +var msg16148 = msg("13719", dup197); + +var msg16149 = msg("13720", dup265); + +var msg16150 = msg("13721", dup265); + +var msg16151 = msg("13722", dup265); + +var msg16152 = msg("13723", dup265); + +var msg16153 = msg("13724", dup265); + +var msg16154 = msg("13725", dup265); + +var msg16155 = msg("13726", dup265); + +var msg16156 = msg("13727", dup265); + +var msg16157 = msg("13728", dup265); + +var msg16158 = msg("13729", dup265); + +var msg16159 = msg("13730", dup265); + +var msg16160 = msg("13731", dup265); + +var msg16161 = msg("13732", dup265); + +var msg16162 = msg("13733", dup265); + +var msg16163 = msg("13734", dup265); + +var msg16164 = msg("13735", dup265); + +var msg16165 = msg("13736", dup265); + +var msg16166 = msg("13737", dup265); + +var msg16167 = msg("13738", dup265); + +var msg16168 = msg("13739", dup265); + +var msg16169 = msg("13740", dup265); + +var msg16170 = msg("13741", dup265); + +var msg16171 = msg("13742", dup265); + +var msg16172 = msg("13743", dup265); + +var msg16173 = msg("13744", dup265); + +var msg16174 = msg("13745", dup265); + +var msg16175 = msg("13746", dup265); + +var msg16176 = msg("13747", dup265); + +var msg16177 = msg("13748", dup265); + +var msg16178 = msg("13749", dup265); + +var msg16179 = msg("13750", dup265); + +var msg16180 = msg("13751", dup265); + +var msg16181 = msg("13752", dup265); + +var msg16182 = msg("13753", dup265); + +var msg16183 = msg("13754", dup265); + +var msg16184 = msg("13755", dup265); + +var msg16185 = msg("13756", dup265); + +var msg16186 = msg("13757", dup265); + +var msg16187 = msg("13758", dup265); + +var msg16188 = msg("13759", dup265); + +var msg16189 = msg("13760", dup265); + +var msg16190 = msg("13761", dup265); + +var msg16191 = msg("13762", dup303); + +var msg16192 = msg("13763", dup303); + +var msg16193 = msg("13764", dup303); + +var msg16194 = msg("13765", dup303); + +var msg16195 = msg("13766", dup303); + +var msg16196 = msg("13767", dup303); + +var msg16197 = msg("13768", dup303); + +var msg16198 = msg("13769", dup303); + +var msg16199 = msg("13770", dup303); + +var msg16200 = msg("13771", dup303); + +var msg16201 = msg("13772", dup303); + +var msg16202 = msg("13773", dup198); + +var msg16203 = msg("13774", dup192); + +var msg16204 = msg("13775", dup192); + +var msg16205 = msg("13776", dup303); + +var msg16206 = msg("13777", dup303); + +var msg16207 = msg("13778", dup303); + +var msg16208 = msg("13779", dup303); + +var msg16209 = msg("13780", dup303); + +var msg16210 = msg("13781", dup303); + +var msg16211 = msg("13782", dup303); + +var msg16212 = msg("13783", dup265); + +var msg16213 = msg("13784", dup265); + +var msg16214 = msg("13785", dup265); + +var msg16215 = msg("13786", dup265); + +var msg16216 = msg("13787", dup265); + +var msg16217 = msg("13788", dup265); + +var msg16218 = msg("13789", dup265); + +var msg16219 = msg("13790", dup267); + +var msg16220 = msg("13791", dup260); + +var msg16221 = msg("13797", dup196); + +var msg16222 = msg("13798", dup198); + +var msg16223 = msg("13799", dup267); + +var msg16224 = msg("13800", dup222); + +var msg16225 = msg("13801", dup196); + +var msg16226 = msg("13802", dup198); + +var msg16227 = msg("13803", dup267); + +var msg16228 = msg("13804", dup222); + +var msg16229 = msg("13805", dup287); + +var msg16230 = msg("13806", dup258); + +var msg16231 = msg("13807", dup267); + +var msg16232 = msg("13808", dup303); + +var msg16233 = msg("13809", dup303); + +var msg16234 = msg("13810", dup303); + +var msg16235 = msg("13811", dup303); + +var msg16236 = msg("13812", dup303); + +var msg16237 = msg("13813", dup303); + +var msg16238 = msg("13814", dup192); + +var msg16239 = msg("13815", dup192); + +var msg16240 = msg("13816", dup255); + +var msg16241 = msg("13817", dup255); + +var msg16242 = msg("13818", dup255); + +var msg16243 = msg("13819", dup267); + +var msg16244 = msg("13820", dup265); + +var msg16245 = msg("13821", dup265); + +var msg16246 = msg("13822", dup265); + +var msg16247 = msg("13823", dup267); + +var msg16248 = msg("13824", dup269); + +var msg16249 = msg("13825", dup198); + +var msg16250 = msg("13826", dup196); + +var msg16251 = msg("13827", dup198); + +var msg16252 = msg("13828", dup265); + +var msg16253 = msg("13829", dup265); + +var msg16254 = msg("13830", dup265); + +var msg16255 = msg("13831", dup265); + +var msg16256 = msg("13832", dup265); + +var msg16257 = msg("13833", dup265); + +var msg16258 = msg("13834", dup265); + +var msg16259 = msg("13835", dup198); + +var msg16260 = msg("13838", dup267); + +var msg16261 = msg("13839", dup196); + +var msg16262 = msg("13840", dup197); + +var msg16263 = msg("13841", dup197); + +var msg16264 = msg("13842", dup197); + +var msg16265 = msg("13843", dup197); + +var msg16266 = msg("13844", dup196); + +var msg16267 = msg("13845", dup196); + +var msg16268 = msg("13846", dup222); + +var msg16269 = msg("13847", dup303); + +var msg16270 = msg("13848", dup303); + +var msg16271 = msg("13849", dup303); + +var msg16272 = msg("13850", dup303); + +var msg16273 = msg("13851", dup303); + +var msg16274 = msg("13852", dup303); + +var msg16275 = msg("13853", dup303); + +var msg16276 = msg("13854", dup303); + +var msg16277 = msg("13855", dup303); + +var msg16278 = msg("13856", dup192); + +var msg16279 = msg("13857", dup265); + +var msg16280 = msg("13858", dup265); + +var msg16281 = msg("13859", dup265); + +var msg16282 = msg("13860", dup265); + +var msg16283 = msg("13861", dup196); + +var msg16284 = msg("13862", dup196); + +var msg16285 = msg("13863", dup301); + +var msg16286 = msg("13864", dup196); + +var msg16287 = msg("13865", dup267); + +var msg16288 = msg("13866", dup303); + +var msg16289 = msg("13867", dup303); + +var msg16290 = msg("13868", dup303); + +var msg16291 = msg("13869", dup303); + +var msg16292 = msg("13870", dup303); + +var msg16293 = msg("13871", dup303); + +var msg16294 = msg("13872", dup303); + +var msg16295 = msg("13873", dup303); + +var msg16296 = msg("13874", dup303); + +var msg16297 = msg("13875", dup303); + +var msg16298 = msg("13876", dup192); + +var msg16299 = msg("13877", dup192); + +var msg16300 = msg("13878", dup192); + +var msg16301 = msg("13879", dup269); + +var msg16302 = msg("13880", dup196); + +var msg16303 = msg("13881", dup196); + +var msg16304 = msg("13882", dup196); + +var msg16305 = msg("13883", dup265); + +var msg16306 = msg("13884", dup265); + +var msg16307 = msg("13885", dup265); + +var msg16308 = msg("13886", dup265); + +var msg16309 = msg("13887", dup196); + +var msg16310 = msg("13888", dup260); + +var msg16311 = msg("13889", dup260); + +var msg16312 = msg("13890", dup260); + +var msg16313 = msg("13891", dup240); + +var msg16314 = msg("13892", dup196); + +var msg16315 = msg("13893", dup265); + +var msg16316 = msg("13894", dup287); + +var msg16317 = msg("13895", dup201); + +var msg16318 = msg("13896", dup196); + +var msg16319 = msg("13897", dup222); + +var msg16320 = msg("13898", dup196); + +var msg16321 = msg("13899", dup196); + +var msg16322 = msg("13900", dup196); + +var msg16323 = msg("13901", dup276); + +var msg16324 = msg("13902", dup201); + +var msg16325 = msg("13903", dup265); + +var msg16326 = msg("13904", dup265); + +var msg16327 = msg("13905", dup265); + +var msg16328 = msg("13906", dup265); + +var msg16329 = msg("13907", dup265); + +var msg16330 = msg("13908", dup265); + +var msg16331 = msg("13909", dup265); + +var msg16332 = msg("13910", dup265); + +var msg16333 = msg("13911", dup265); + +var msg16334 = msg("13912", dup196); + +var msg16335 = msg("13913", dup265); + +var msg16336 = msg("13914", dup265); + +var msg16337 = msg("13915", dup265); + +var msg16338 = msg("13916", dup222); + +var msg16339 = msg("13917", dup267); + +var msg16340 = msg("13918", dup267); + +var msg16341 = msg("13919", dup267); + +var msg16342 = msg("13920", dup267); + +var msg16343 = msg("13921", dup196); + +var msg16344 = msg("13922", dup197); + +var msg16345 = msg("13923", dup198); + +var msg16346 = msg("13924", dup267); + +var msg16347 = msg("13925", dup222); + +var msg16348 = msg("13926", dup197); + +var msg16349 = msg("13927", dup295); + +var msg16350 = msg("13928", dup260); + +var msg16351 = msg("13929", dup260); + +var msg16352 = msg("13930", dup303); + +var msg16353 = msg("13931", dup303); + +var msg16354 = msg("13932", dup303); + +var msg16355 = msg("13933", dup303); + +var msg16356 = msg("13934", dup303); + +var msg16357 = msg("13935", dup303); + +var msg16358 = msg("13936", dup303); + +var msg16359 = msg("13937", dup303); + +var msg16360 = msg("13938", dup303); + +var msg16361 = msg("13939", dup303); + +var msg16362 = msg("13940", dup303); + +var msg16363 = msg("13941", dup192); + +var msg16364 = msg("13942", dup192); + +var msg16365 = msg("13943", dup303); + +var msg16366 = msg("13944", dup192); + +var msg16367 = msg("13945", dup192); + +var msg16368 = msg("13946", dup267); + +var msg16369 = msg("13947", dup267); + +var msg16370 = msg("13948", dup196); + +var msg16371 = msg("13949", dup196); + +var msg16372 = msg("13950", dup267); + +var msg16373 = msg("13951", dup267); + +var msg16374 = msg("13952", dup192); + +var msg16375 = msg("13953", dup192); + +var msg16376 = msg("13954", dup267); + +var msg16377 = msg("13958", dup267); + +var msg16378 = msg("13960", dup267); + +var msg16379 = msg("13961", dup267); + +var msg16380 = msg("13962", dup265); + +var msg16381 = msg("13963", dup267); + +var msg16382 = msg("13964", dup196); + +var msg16383 = msg("13965", dup265); + +var msg16384 = msg("13966", dup265); + +var msg16385 = msg("13967", dup265); + +var msg16386 = msg("13968", dup265); + +var msg16387 = msg("13969", dup267); + +var msg16388 = msg("13970", dup192); + +var msg16389 = msg("13971", dup267); + +var msg16390 = msg("13972", dup269); + +var msg16391 = msg("13973", dup267); + +var msg16392 = msg("13974", dup265); + +var msg16393 = msg("13975", dup265); + +var msg16394 = msg("13976", dup265); + +var msg16395 = msg("13977", dup265); + +var msg16396 = msg("13978", dup265); + +var msg16397 = msg("13979", dup265); + +var msg16398 = msg("13980", dup267); + +var msg16399 = msg("13981", dup269); + +var msg16400 = msg("13982", dup265); + +var msg16401 = msg("13983", dup196); + +var msg16402 = msg("13984", dup255); + +var msg16403 = msg("13985", dup255); + +var msg16404 = msg("13986", dup255); + +var msg16405 = msg("13987", dup260); + +var msg16406 = msg("13988", dup260); + +var msg16407 = msg("13989", dup260); + +var msg16408 = msg("13990", dup260); + +var msg16409 = msg("13991", dup240); + +var msg16410 = msg("13992", dup240); + +var msg16411 = msg("13993", dup240); + +var msg16412 = msg("13994", dup240); + +var msg16413 = msg("13995", dup240); + +var msg16414 = msg("13996", dup240); + +var msg16415 = msg("13997", dup240); + +var msg16416 = msg("13998", dup240); + +var msg16417 = msg("13999", dup260); + +var msg16418 = msg("14000", dup260); + +var msg16419 = msg("14001", dup260); + +var msg16420 = msg("14002", dup260); + +var msg16421 = msg("14003", dup260); + +var msg16422 = msg("14004", dup260); + +var msg16423 = msg("14005", dup260); + +var msg16424 = msg("14006", dup260); + +var msg16425 = msg("14007", dup260); + +var msg16426 = msg("14008", dup260); + +var msg16427 = msg("14013", dup265); + +var msg16428 = msg("14014", dup265); + +var msg16429 = msg("14015", dup265); + +var msg16430 = msg("14016", dup265); + +var msg16431 = msg("14017", dup196); + +var msg16432 = msg("14018", dup196); + +var msg16433 = msg("14019", dup267); + +var msg16434 = msg("14020", dup267); + +var msg16435 = msg("14021", dup265); + +var msg16436 = msg("14022", dup265); + +var msg16437 = msg("14023", dup265); + +var msg16438 = msg("14024", dup265); + +var msg16439 = msg("14025", dup265); + +var msg16440 = msg("14026", dup265); + +var msg16441 = msg("14027", dup265); + +var msg16442 = msg("14028", dup265); + +var msg16443 = msg("14029", dup265); + +var msg16444 = msg("14030", dup265); + +var msg16445 = msg("14031", dup265); + +var msg16446 = msg("14032", dup265); + +var msg16447 = msg("14033", dup265); + +var msg16448 = msg("14034", dup265); + +var msg16449 = msg("14035", dup265); + +var msg16450 = msg("14036", dup265); + +var msg16451 = msg("14037", dup201); + +var msg16452 = msg("14038", dup201); + +var msg16453 = msg("14039", dup222); + +var msg16454 = msg("14040", dup222); + +var msg16455 = msg("14041", dup222); + +var msg16456 = msg("14042", dup265); + +var msg16457 = msg("14043", dup265); + +var msg16458 = msg("14044", dup265); + +var msg16459 = msg("14045", dup265); + +var msg16460 = msg("14046", dup265); + +var msg16461 = msg("14047", dup265); + +var msg16462 = msg("14048", dup265); + +var msg16463 = msg("14049", dup265); + +var msg16464 = msg("14050", dup265); + +var msg16465 = msg("14051", dup265); + +var msg16466 = msg("14052", dup265); + +var msg16467 = msg("14053", dup265); + +var msg16468 = msg("14054", dup303); + +var msg16469 = msg("14055", dup303); + +var msg16470 = msg("14056", dup303); + +var msg16471 = msg("14057", dup303); + +var msg16472 = msg("14058", dup303); + +var msg16473 = msg("14059", dup303); + +var msg16474 = msg("14060", dup303); + +var msg16475 = msg("14061", dup303); + +var msg16476 = msg("14062", dup303); + +var msg16477 = msg("14063", dup303); + +var msg16478 = msg("14064", dup303); + +var msg16479 = msg("14065", dup303); + +var msg16480 = msg("14066", dup303); + +var msg16481 = msg("14067", dup303); + +var msg16482 = msg("14068", dup303); + +var msg16483 = msg("14069", dup303); + +var msg16484 = msg("14070", dup303); + +var msg16485 = msg("14071", dup303); + +var msg16486 = msg("14072", dup303); + +var msg16487 = msg("14073", dup303); + +var msg16488 = msg("14074", dup303); + +var msg16489 = msg("14075", dup303); + +var msg16490 = msg("14076", dup303); + +var msg16491 = msg("14077", dup303); + +var msg16492 = msg("14078", dup303); + +var msg16493 = msg("14079", dup303); + +var msg16494 = msg("14080", dup303); + +var msg16495 = msg("14081", dup192); + +var msg16496 = msg("14082", dup192); + +var msg16497 = msg("14083", dup192); + +var msg16498 = msg("14084", dup192); + +var msg16499 = msg("14085", dup192); + +var msg16500 = msg("14086", dup192); + +var msg16501 = msg("14087", dup192); + +var msg16502 = msg("14088", dup265); + +var msg16503 = msg("14089", dup265); + +var msg16504 = msg("14090", dup265); + +var msg16505 = msg("14091", dup265); + +var msg16506 = msg("14092", dup265); + +var msg16507 = msg("14093", dup265); + +var msg16508 = msg("14094", dup265); + +var msg16509 = msg("14095", dup265); + +var msg16510 = msg("14096", dup265); + +var msg16511 = msg("14097", dup265); + +var msg16512 = msg("14098", dup265); + +var msg16513 = msg("14099", dup265); + +var msg16514 = msg("14100", dup265); + +var msg16515 = msg("14101", dup265); + +var msg16516 = msg("14102", dup265); + +var msg16517 = msg("14103", dup265); + +var msg16518 = msg("14104", dup265); + +var msg16519 = msg("14105", dup265); + +var msg16520 = msg("14106", dup265); + +var msg16521 = msg("14107", dup265); + +var msg16522 = msg("14108", dup265); + +var msg16523 = msg("14109", dup265); + +var msg16524 = msg("14110", dup265); + +var msg16525 = msg("14111", dup265); + +var msg16526 = msg("14112", dup265); + +var msg16527 = msg("14113", dup265); + +var msg16528 = msg("14114", dup265); + +var msg16529 = msg("14115", dup265); + +var msg16530 = msg("14116", dup265); + +var msg16531 = msg("14117", dup265); + +var msg16532 = msg("14118", dup265); + +var msg16533 = msg("14119", dup265); + +var msg16534 = msg("14120", dup265); + +var msg16535 = msg("14121", dup265); + +var msg16536 = msg("14122", dup265); + +var msg16537 = msg("14123", dup265); + +var msg16538 = msg("14124", dup265); + +var msg16539 = msg("14125", dup265); + +var msg16540 = msg("14126", dup265); + +var msg16541 = msg("14127", dup265); + +var msg16542 = msg("14128", dup265); + +var msg16543 = msg("14129", dup265); + +var msg16544 = msg("14130", dup265); + +var msg16545 = msg("14131", dup265); + +var msg16546 = msg("14132", dup265); + +var msg16547 = msg("14133", dup265); + +var msg16548 = msg("14134", dup265); + +var msg16549 = msg("14135", dup265); + +var msg16550 = msg("14136", dup265); + +var msg16551 = msg("14137", dup265); + +var msg16552 = msg("14138", dup265); + +var msg16553 = msg("14139", dup265); + +var msg16554 = msg("14140", dup265); + +var msg16555 = msg("14141", dup265); + +var msg16556 = msg("14142", dup265); + +var msg16557 = msg("14143", dup265); + +var msg16558 = msg("14144", dup265); + +var msg16559 = msg("14145", dup265); + +var msg16560 = msg("14146", dup265); + +var msg16561 = msg("14147", dup265); + +var msg16562 = msg("14148", dup265); + +var msg16563 = msg("14149", dup265); + +var msg16564 = msg("14150", dup265); + +var msg16565 = msg("14151", dup265); + +var msg16566 = msg("14152", dup265); + +var msg16567 = msg("14153", dup265); + +var msg16568 = msg("14154", dup265); + +var msg16569 = msg("14155", dup265); + +var msg16570 = msg("14156", dup265); + +var msg16571 = msg("14157", dup265); + +var msg16572 = msg("14158", dup265); + +var msg16573 = msg("14159", dup265); + +var msg16574 = msg("14160", dup265); + +var msg16575 = msg("14161", dup265); + +var msg16576 = msg("14162", dup265); + +var msg16577 = msg("14163", dup265); + +var msg16578 = msg("14164", dup265); + +var msg16579 = msg("14165", dup265); + +var msg16580 = msg("14166", dup265); + +var msg16581 = msg("14167", dup265); + +var msg16582 = msg("14168", dup265); + +var msg16583 = msg("14169", dup265); + +var msg16584 = msg("14170", dup265); + +var msg16585 = msg("14171", dup265); + +var msg16586 = msg("14172", dup265); + +var msg16587 = msg("14173", dup265); + +var msg16588 = msg("14174", dup265); + +var msg16589 = msg("14175", dup265); + +var msg16590 = msg("14176", dup265); + +var msg16591 = msg("14177", dup265); + +var msg16592 = msg("14178", dup265); + +var msg16593 = msg("14179", dup265); + +var msg16594 = msg("14180", dup265); + +var msg16595 = msg("14181", dup265); + +var msg16596 = msg("14182", dup265); + +var msg16597 = msg("14183", dup265); + +var msg16598 = msg("14184", dup265); + +var msg16599 = msg("14185", dup265); + +var msg16600 = msg("14186", dup265); + +var msg16601 = msg("14187", dup265); + +var msg16602 = msg("14188", dup265); + +var msg16603 = msg("14189", dup265); + +var msg16604 = msg("14190", dup265); + +var msg16605 = msg("14191", dup265); + +var msg16606 = msg("14192", dup265); + +var msg16607 = msg("14193", dup265); + +var msg16608 = msg("14194", dup265); + +var msg16609 = msg("14195", dup265); + +var msg16610 = msg("14196", dup265); + +var msg16611 = msg("14197", dup265); + +var msg16612 = msg("14198", dup265); + +var msg16613 = msg("14199", dup265); + +var msg16614 = msg("14200", dup265); + +var msg16615 = msg("14201", dup265); + +var msg16616 = msg("14202", dup265); + +var msg16617 = msg("14203", dup265); + +var msg16618 = msg("14204", dup265); + +var msg16619 = msg("14205", dup265); + +var msg16620 = msg("14206", dup265); + +var msg16621 = msg("14207", dup265); + +var msg16622 = msg("14208", dup265); + +var msg16623 = msg("14209", dup265); + +var msg16624 = msg("14210", dup265); + +var msg16625 = msg("14211", dup265); + +var msg16626 = msg("14212", dup265); + +var msg16627 = msg("14213", dup265); + +var msg16628 = msg("14214", dup265); + +var msg16629 = msg("14215", dup265); + +var msg16630 = msg("14216", dup265); + +var msg16631 = msg("14217", dup265); + +var msg16632 = msg("14218", dup265); + +var msg16633 = msg("14219", dup265); + +var msg16634 = msg("14220", dup265); + +var msg16635 = msg("14221", dup265); + +var msg16636 = msg("14222", dup265); + +var msg16637 = msg("14223", dup265); + +var msg16638 = msg("14224", dup265); + +var msg16639 = msg("14225", dup265); + +var msg16640 = msg("14226", dup265); + +var msg16641 = msg("14227", dup265); + +var msg16642 = msg("14228", dup265); + +var msg16643 = msg("14229", dup265); + +var msg16644 = msg("14230", dup222); + +var msg16645 = msg("14231", dup265); + +var msg16646 = msg("14232", dup265); + +var msg16647 = msg("14233", dup265); + +var msg16648 = msg("14234", dup265); + +var msg16649 = msg("14235", dup265); + +var msg16650 = msg("14236", dup265); + +var msg16651 = msg("14237", dup265); + +var msg16652 = msg("14238", dup265); + +var msg16653 = msg("14239", dup265); + +var msg16654 = msg("14240", dup265); + +var msg16655 = msg("14241", dup265); + +var msg16656 = msg("14242", dup265); + +var msg16657 = msg("14243", dup265); + +var msg16658 = msg("14244", dup265); + +var msg16659 = msg("14245", dup265); + +var msg16660 = msg("14246", dup265); + +var msg16661 = msg("14247", dup265); + +var msg16662 = msg("14248", dup265); + +var msg16663 = msg("14249", dup265); + +var msg16664 = msg("14250", dup265); + +var msg16665 = msg("14251", dup222); + +var msg16666 = msg("14252", dup269); + +var msg16667 = msg("14253", dup269); + +var msg16668 = msg("14254", dup269); + +var msg16669 = msg("14255", dup265); + +var msg16670 = msg("14256", dup265); + +var msg16671 = msg("14257", dup265); + +var msg16672 = msg("14258", dup265); + +var msg16673 = msg("14259", dup267); + +var msg16674 = msg("14260", dup267); + +var msg16675 = msg("14261", dup267); + +var msg16676 = msg("14262", dup267); + +var msg16677 = msg("14263", dup222); + +var msg16678 = msg("14264", dup196); + +var msg16679 = msg("14265", dup305); + +var msg16680 = msg("14266", dup265); + +var msg16681 = msg("14267", dup265); + +var msg16682 = msg("14268", dup265); + +var msg16683 = msg("14269", dup265); + +var msg16684 = msg("14270", dup265); + +var msg16685 = msg("14271", dup265); + +var msg16686 = msg("14272", dup265); + +var msg16687 = msg("14273", dup265); + +var msg16688 = msg("14274", dup265); + +var msg16689 = msg("14275", dup265); + +var msg16690 = msg("14276", dup265); + +var msg16691 = msg("14277", dup265); + +var msg16692 = msg("14278", dup265); + +var msg16693 = msg("14279", dup265); + +var msg16694 = msg("14280", dup265); + +var msg16695 = msg("14281", dup265); + +var msg16696 = msg("14282", dup265); + +var msg16697 = msg("14283", dup265); + +var msg16698 = msg("14284", dup265); + +var msg16699 = msg("14285", dup265); + +var msg16700 = msg("14286", dup265); + +var msg16701 = msg("14287", dup265); + +var msg16702 = msg("14288", dup265); + +var msg16703 = msg("14289", dup265); + +var msg16704 = msg("14290", dup265); + +var msg16705 = msg("14291", dup265); + +var msg16706 = msg("14292", dup265); + +var msg16707 = msg("14293", dup265); + +var msg16708 = msg("14294", dup265); + +var msg16709 = msg("14295", dup265); + +var msg16710 = msg("14296", dup265); + +var msg16711 = msg("14297", dup265); + +var msg16712 = msg("14298", dup265); + +var msg16713 = msg("14299", dup265); + +var msg16714 = msg("14300", dup265); + +var msg16715 = msg("14301", dup265); + +var msg16716 = msg("14302", dup265); + +var msg16717 = msg("14303", dup265); + +var msg16718 = msg("14304", dup265); + +var msg16719 = msg("14305", dup265); + +var msg16720 = msg("14306", dup265); + +var msg16721 = msg("14307", dup265); + +var msg16722 = msg("14308", dup265); + +var msg16723 = msg("14309", dup265); + +var msg16724 = msg("14310", dup265); + +var msg16725 = msg("14311", dup265); + +var msg16726 = msg("14312", dup265); + +var msg16727 = msg("14313", dup265); + +var msg16728 = msg("14314", dup265); + +var msg16729 = msg("14315", dup265); + +var msg16730 = msg("14316", dup267); + +var msg16731 = msg("14317", dup267); + +var msg16732 = msg("14318", dup267); + +var msg16733 = msg("14319", dup267); + +var msg16734 = msg("14320", dup265); + +var msg16735 = msg("14321", dup265); + +var msg16736 = msg("14322", dup265); + +var msg16737 = msg("14323", dup265); + +var msg16738 = msg("14324", dup265); + +var msg16739 = msg("14325", dup265); + +var msg16740 = msg("14326", dup265); + +var msg16741 = msg("14327", dup265); + +var msg16742 = msg("14328", dup265); + +var msg16743 = msg("14329", dup265); + +var msg16744 = msg("14330", dup265); + +var msg16745 = msg("14331", dup265); + +var msg16746 = msg("14332", dup265); + +var msg16747 = msg("14333", dup265); + +var msg16748 = msg("14334", dup265); + +var msg16749 = msg("14335", dup265); + +var msg16750 = msg("14336", dup265); + +var msg16751 = msg("14337", dup265); + +var msg16752 = msg("14338", dup265); + +var msg16753 = msg("14339", dup265); + +var msg16754 = msg("14340", dup265); + +var msg16755 = msg("14341", dup265); + +var msg16756 = msg("14342", dup265); + +var msg16757 = msg("14343", dup265); + +var msg16758 = msg("14344", dup265); + +var msg16759 = msg("14345", dup265); + +var msg16760 = msg("14346", dup265); + +var msg16761 = msg("14347", dup265); + +var msg16762 = msg("14348", dup265); + +var msg16763 = msg("14349", dup265); + +var msg16764 = msg("14350", dup265); + +var msg16765 = msg("14351", dup265); + +var msg16766 = msg("14352", dup265); + +var msg16767 = msg("14353", dup265); + +var msg16768 = msg("14354", dup265); + +var msg16769 = msg("14355", dup265); + +var msg16770 = msg("14356", dup265); + +var msg16771 = msg("14357", dup265); + +var msg16772 = msg("14358", dup265); + +var msg16773 = msg("14359", dup265); + +var msg16774 = msg("14360", dup265); + +var msg16775 = msg("14361", dup265); + +var msg16776 = msg("14362", dup265); + +var msg16777 = msg("14363", dup265); + +var msg16778 = msg("14364", dup265); + +var msg16779 = msg("14365", dup265); + +var msg16780 = msg("14366", dup265); + +var msg16781 = msg("14367", dup265); + +var msg16782 = msg("14368", dup265); + +var msg16783 = msg("14369", dup265); + +var msg16784 = msg("14370", dup265); + +var msg16785 = msg("14371", dup265); + +var msg16786 = msg("14372", dup265); + +var msg16787 = msg("14373", dup265); + +var msg16788 = msg("14374", dup265); + +var msg16789 = msg("14375", dup265); + +var msg16790 = msg("14376", dup265); + +var msg16791 = msg("14377", dup265); + +var msg16792 = msg("14378", dup265); + +var msg16793 = msg("14379", dup265); + +var msg16794 = msg("14380", dup265); + +var msg16795 = msg("14381", dup265); + +var msg16796 = msg("14382", dup265); + +var msg16797 = msg("14383", dup265); + +var msg16798 = msg("14384", dup265); + +var msg16799 = msg("14385", dup265); + +var msg16800 = msg("14386", dup265); + +var msg16801 = msg("14387", dup265); + +var msg16802 = msg("14388", dup265); + +var msg16803 = msg("14389", dup265); + +var msg16804 = msg("14390", dup265); + +var msg16805 = msg("14391", dup265); + +var msg16806 = msg("14392", dup265); + +var msg16807 = msg("14393", dup265); + +var msg16808 = msg("14394", dup265); + +var msg16809 = msg("14395", dup265); + +var msg16810 = msg("14396", dup265); + +var msg16811 = msg("14397", dup265); + +var msg16812 = msg("14398", dup265); + +var msg16813 = msg("14399", dup265); + +var msg16814 = msg("14400", dup265); + +var msg16815 = msg("14401", dup265); + +var msg16816 = msg("14402", dup265); + +var msg16817 = msg("14403", dup265); + +var msg16818 = msg("14404", dup265); + +var msg16819 = msg("14405", dup265); + +var msg16820 = msg("14406", dup265); + +var msg16821 = msg("14407", dup265); + +var msg16822 = msg("14408", dup265); + +var msg16823 = msg("14409", dup265); + +var msg16824 = msg("14410", dup265); + +var msg16825 = msg("14411", dup265); + +var msg16826 = msg("14412", dup265); + +var msg16827 = msg("14413", dup265); + +var msg16828 = msg("14414", dup265); + +var msg16829 = msg("14415", dup265); + +var msg16830 = msg("14416", dup265); + +var msg16831 = msg("14417", dup265); + +var msg16832 = msg("14418", dup265); + +var msg16833 = msg("14419", dup265); + +var msg16834 = msg("14420", dup265); + +var msg16835 = msg("14421", dup265); + +var msg16836 = msg("14422", dup265); + +var msg16837 = msg("14423", dup265); + +var msg16838 = msg("14424", dup265); + +var msg16839 = msg("14425", dup265); + +var msg16840 = msg("14426", dup265); + +var msg16841 = msg("14427", dup265); + +var msg16842 = msg("14428", dup265); + +var msg16843 = msg("14429", dup265); + +var msg16844 = msg("14430", dup265); + +var msg16845 = msg("14431", dup265); + +var msg16846 = msg("14432", dup265); + +var msg16847 = msg("14433", dup265); + +var msg16848 = msg("14434", dup265); + +var msg16849 = msg("14435", dup265); + +var msg16850 = msg("14436", dup265); + +var msg16851 = msg("14437", dup265); + +var msg16852 = msg("14438", dup265); + +var msg16853 = msg("14439", dup265); + +var msg16854 = msg("14440", dup265); + +var msg16855 = msg("14441", dup265); + +var msg16856 = msg("14442", dup265); + +var msg16857 = msg("14443", dup265); + +var msg16858 = msg("14444", dup265); + +var msg16859 = msg("14445", dup265); + +var msg16860 = msg("14446", dup265); + +var msg16861 = msg("14447", dup265); + +var msg16862 = msg("14448", dup265); + +var msg16863 = msg("14449", dup265); + +var msg16864 = msg("14450", dup265); + +var msg16865 = msg("14451", dup265); + +var msg16866 = msg("14452", dup265); + +var msg16867 = msg("14453", dup265); + +var msg16868 = msg("14454", dup265); + +var msg16869 = msg("14455", dup265); + +var msg16870 = msg("14456", dup265); + +var msg16871 = msg("14457", dup265); + +var msg16872 = msg("14458", dup265); + +var msg16873 = msg("14459", dup265); + +var msg16874 = msg("14460", dup265); + +var msg16875 = msg("14461", dup265); + +var msg16876 = msg("14462", dup265); + +var msg16877 = msg("14463", dup265); + +var msg16878 = msg("14464", dup265); + +var msg16879 = msg("14465", dup265); + +var msg16880 = msg("14466", dup265); + +var msg16881 = msg("14467", dup265); + +var msg16882 = msg("14468", dup265); + +var msg16883 = msg("14469", dup265); + +var msg16884 = msg("14470", dup265); + +var msg16885 = msg("14471", dup265); + +var msg16886 = msg("14472", dup265); + +var msg16887 = msg("14473", dup265); + +var msg16888 = msg("14474", dup265); + +var msg16889 = msg("14475", dup265); + +var msg16890 = msg("14476", dup265); + +var msg16891 = msg("14477", dup265); + +var msg16892 = msg("14478", dup265); + +var msg16893 = msg("14479", dup265); + +var msg16894 = msg("14480", dup265); + +var msg16895 = msg("14481", dup265); + +var msg16896 = msg("14482", dup265); + +var msg16897 = msg("14483", dup265); + +var msg16898 = msg("14484", dup265); + +var msg16899 = msg("14485", dup265); + +var msg16900 = msg("14486", dup265); + +var msg16901 = msg("14487", dup265); + +var msg16902 = msg("14488", dup265); + +var msg16903 = msg("14489", dup265); + +var msg16904 = msg("14490", dup265); + +var msg16905 = msg("14491", dup265); + +var msg16906 = msg("14492", dup265); + +var msg16907 = msg("14493", dup265); + +var msg16908 = msg("14494", dup265); + +var msg16909 = msg("14495", dup265); + +var msg16910 = msg("14496", dup265); + +var msg16911 = msg("14497", dup265); + +var msg16912 = msg("14498", dup265); + +var msg16913 = msg("14499", dup265); + +var msg16914 = msg("14500", dup265); + +var msg16915 = msg("14501", dup265); + +var msg16916 = msg("14502", dup265); + +var msg16917 = msg("14503", dup265); + +var msg16918 = msg("14504", dup265); + +var msg16919 = msg("14505", dup265); + +var msg16920 = msg("14506", dup265); + +var msg16921 = msg("14507", dup265); + +var msg16922 = msg("14508", dup265); + +var msg16923 = msg("14509", dup265); + +var msg16924 = msg("14510", dup265); + +var msg16925 = msg("14511", dup265); + +var msg16926 = msg("14512", dup265); + +var msg16927 = msg("14513", dup265); + +var msg16928 = msg("14514", dup265); + +var msg16929 = msg("14515", dup265); + +var msg16930 = msg("14516", dup265); + +var msg16931 = msg("14517", dup265); + +var msg16932 = msg("14518", dup265); + +var msg16933 = msg("14519", dup265); + +var msg16934 = msg("14520", dup265); + +var msg16935 = msg("14521", dup265); + +var msg16936 = msg("14522", dup265); + +var msg16937 = msg("14523", dup265); + +var msg16938 = msg("14524", dup265); + +var msg16939 = msg("14525", dup265); + +var msg16940 = msg("14526", dup265); + +var msg16941 = msg("14527", dup265); + +var msg16942 = msg("14528", dup265); + +var msg16943 = msg("14529", dup265); + +var msg16944 = msg("14530", dup265); + +var msg16945 = msg("14531", dup265); + +var msg16946 = msg("14532", dup265); + +var msg16947 = msg("14533", dup265); + +var msg16948 = msg("14534", dup265); + +var msg16949 = msg("14535", dup265); + +var msg16950 = msg("14536", dup265); + +var msg16951 = msg("14537", dup265); + +var msg16952 = msg("14538", dup265); + +var msg16953 = msg("14539", dup265); + +var msg16954 = msg("14540", dup265); + +var msg16955 = msg("14541", dup265); + +var msg16956 = msg("14542", dup265); + +var msg16957 = msg("14543", dup265); + +var msg16958 = msg("14544", dup265); + +var msg16959 = msg("14545", dup265); + +var msg16960 = msg("14546", dup265); + +var msg16961 = msg("14547", dup265); + +var msg16962 = msg("14548", dup265); + +var msg16963 = msg("14549", dup265); + +var msg16964 = msg("14550", dup265); + +var msg16965 = msg("14551", dup265); + +var msg16966 = msg("14552", dup265); + +var msg16967 = msg("14553", dup265); + +var msg16968 = msg("14554", dup265); + +var msg16969 = msg("14555", dup265); + +var msg16970 = msg("14556", dup265); + +var msg16971 = msg("14557", dup265); + +var msg16972 = msg("14558", dup265); + +var msg16973 = msg("14559", dup265); + +var msg16974 = msg("14560", dup265); + +var msg16975 = msg("14561", dup265); + +var msg16976 = msg("14562", dup265); + +var msg16977 = msg("14563", dup265); + +var msg16978 = msg("14564", dup265); + +var msg16979 = msg("14565", dup265); + +var msg16980 = msg("14566", dup265); + +var msg16981 = msg("14567", dup265); + +var msg16982 = msg("14568", dup265); + +var msg16983 = msg("14569", dup265); + +var msg16984 = msg("14570", dup265); + +var msg16985 = msg("14571", dup265); + +var msg16986 = msg("14572", dup265); + +var msg16987 = msg("14573", dup265); + +var msg16988 = msg("14574", dup265); + +var msg16989 = msg("14575", dup265); + +var msg16990 = msg("14576", dup265); + +var msg16991 = msg("14577", dup265); + +var msg16992 = msg("14578", dup265); + +var msg16993 = msg("14579", dup265); + +var msg16994 = msg("14580", dup265); + +var msg16995 = msg("14581", dup265); + +var msg16996 = msg("14582", dup265); + +var msg16997 = msg("14583", dup265); + +var msg16998 = msg("14584", dup265); + +var msg16999 = msg("14585", dup265); + +var msg17000 = msg("14586", dup265); + +var msg17001 = msg("14587", dup265); + +var msg17002 = msg("14588", dup265); + +var msg17003 = msg("14589", dup265); + +var msg17004 = msg("14590", dup265); + +var msg17005 = msg("14591", dup265); + +var msg17006 = msg("14592", dup265); + +var msg17007 = msg("14593", dup265); + +var msg17008 = msg("14594", dup265); + +var msg17009 = msg("14595", dup265); + +var msg17010 = msg("14596", dup265); + +var msg17011 = msg("14597", dup265); + +var msg17012 = msg("14598", dup265); + +var msg17013 = msg("14599", dup265); + +var msg17014 = msg("14600", dup222); + +var msg17015 = msg("14601", dup222); + +var msg17016 = msg("14602", dup222); + +var msg17017 = msg("14603", dup265); + +var msg17018 = msg("14604", dup265); + +var msg17019 = msg("14605", dup265); + +var msg17020 = msg("14606", dup265); + +var msg17021 = msg("14607", dup222); + +var msg17022 = msg("14608", dup197); + +var msg17023 = msg("14609", dup197); + +var msg17024 = msg("14610", dup265); + +var msg17025 = msg("14611", dup265); + +var msg17026 = msg("14612", dup265); + +var msg17027 = msg("14613", dup265); + +var msg17028 = msg("14614", dup265); + +var msg17029 = msg("14615", dup196); + +var msg17030 = msg("14616", dup201); + +var msg17031 = msg("14617", dup201); + +var msg17032 = msg("14618", dup201); + +var msg17033 = msg("14619", dup201); + +var msg17034 = msg("14620", dup201); + +var msg17035 = msg("14621", dup201); + +var msg17036 = msg("14622", dup201); + +var msg17037 = msg("14623", dup201); + +var msg17038 = msg("14624", dup201); + +var msg17039 = msg("14625", dup201); + +var msg17040 = msg("14626", dup201); + +var msg17041 = msg("14627", dup201); + +var msg17042 = msg("14628", dup265); + +var msg17043 = msg("14629", dup265); + +var msg17044 = msg("14630", dup265); + +var msg17045 = msg("14631", dup265); + +var msg17046 = msg("14632", dup265); + +var msg17047 = msg("14633", dup265); + +var msg17048 = msg("14634", dup265); + +var msg17049 = msg("14635", dup265); + +var msg17050 = msg("14636", dup265); + +var msg17051 = msg("14637", dup265); + +var msg17052 = msg("14638", dup265); + +var msg17053 = msg("14639", dup265); + +var msg17054 = msg("14640", dup265); + +var msg17055 = msg("14641", dup267); + +var msg17056 = msg("14642", dup196); + +var msg17057 = msg("14643", dup267); + +var msg17058 = msg("14644", dup196); + +var msg17059 = msg("14645", dup267); + +var msg17060 = msg("14646", dup198); + +var msg17061 = msg("14647", dup276); + +var msg17062 = msg("14648", dup276); + +var msg17063 = msg("14649", dup276); + +var msg17064 = msg("14650", dup276); + +var msg17065 = msg("14651", dup276); + +var msg17066 = msg("14652", dup276); + +var msg17067 = msg("14653", dup276); + +var msg17068 = msg("14654", dup276); + +var msg17069 = msg("14655", dup265); + +var msg17070 = msg("14656", dup265); + +var msg17071 = msg("14657", dup265); + +var msg17072 = msg("14661", dup276); + +var msg17073 = msg("14662", dup306); + +var msg17074 = msg("14663", dup306); + +var msg17075 = msg("14664", dup306); + +var msg17076 = msg("14665", dup306); + +var msg17077 = msg("14666", dup306); + +var msg17078 = msg("14667", dup306); + +var msg17079 = msg("14668", dup306); + +var msg17080 = msg("14669", dup306); + +var msg17081 = msg("14670", dup306); + +var msg17082 = msg("14671", dup306); + +var msg17083 = msg("14672", dup306); + +var msg17084 = msg("14673", dup306); + +var msg17085 = msg("14674", dup306); + +var msg17086 = msg("14675", dup306); + +var msg17087 = msg("14676", dup306); + +var msg17088 = msg("14677", dup306); + +var msg17089 = msg("14678", dup306); + +var msg17090 = msg("14679", dup306); + +var msg17091 = msg("14680", dup306); + +var msg17092 = msg("14681", dup306); + +var msg17093 = msg("14682", dup306); + +var msg17094 = msg("14683", dup306); + +var msg17095 = msg("14684", dup306); + +var msg17096 = msg("14685", dup306); + +var msg17097 = msg("14686", dup306); + +var msg17098 = msg("14687", dup306); + +var msg17099 = msg("14688", dup306); + +var msg17100 = msg("14689", dup306); + +var msg17101 = msg("14690", dup306); + +var msg17102 = msg("14691", dup306); + +var msg17103 = msg("14692", dup306); + +var msg17104 = msg("14693", dup306); + +var msg17105 = msg("14694", dup306); + +var msg17106 = msg("14695", dup306); + +var msg17107 = msg("14696", dup306); + +var msg17108 = msg("14697", dup306); + +var msg17109 = msg("14698", dup306); + +var msg17110 = msg("14699", dup306); + +var msg17111 = msg("14700", dup306); + +var msg17112 = msg("14701", dup306); + +var msg17113 = msg("14702", dup306); + +var msg17114 = msg("14703", dup306); + +var msg17115 = msg("14704", dup306); + +var msg17116 = msg("14705", dup306); + +var msg17117 = msg("14706", dup306); + +var msg17118 = msg("14707", dup306); + +var msg17119 = msg("14708", dup306); + +var msg17120 = msg("14709", dup276); + +var msg17121 = msg("14710", dup276); + +var msg17122 = msg("14711", dup276); + +var msg17123 = msg("14712", dup276); + +var msg17124 = msg("14713", dup276); + +var msg17125 = msg("14714", dup276); + +var msg17126 = msg("14715", dup276); + +var msg17127 = msg("14716", dup276); + +var msg17128 = msg("14717", dup276); + +var msg17129 = msg("14718", dup276); + +var msg17130 = msg("14719", dup276); + +var msg17131 = msg("14720", dup276); + +var msg17132 = msg("14721", dup276); + +var msg17133 = msg("14722", dup276); + +var msg17134 = msg("14723", dup276); + +var msg17135 = msg("14724", dup276); + +var msg17136 = msg("14725", dup201); + +var msg17137 = msg("14726", dup201); + +var msg17138 = msg("14727", dup307); + +var msg17139 = msg("14728", dup307); + +var msg17140 = msg("14729", dup307); + +var msg17141 = msg("14730", dup307); + +var msg17142 = msg("14731", dup307); + +var msg17143 = msg("14732", dup307); + +var msg17144 = msg("14733", dup307); + +var msg17145 = msg("14734", dup307); + +var msg17146 = msg("14735", dup307); + +var msg17147 = msg("14736", dup307); + +var msg17148 = msg("14737", dup276); + +var msg17149 = msg("14738", dup308); + +var msg17150 = msg("14739", dup308); + +var msg17151 = msg("14740", dup308); + +var msg17152 = msg("14741", dup273); + +var msg17153 = msg("14742", dup198); + +var msg17154 = msg("14743", dup227); + +var msg17155 = msg("14744", dup265); + +var msg17156 = msg("14745", dup265); + +var msg17157 = msg("14746", dup265); + +var msg17158 = msg("14747", dup265); + +var msg17159 = msg("14748", dup265); + +var msg17160 = msg("14749", dup265); + +var msg17161 = msg("14750", dup265); + +var msg17162 = msg("14751", dup265); + +var msg17163 = msg("14752", dup265); + +var msg17164 = msg("14753", dup265); + +var msg17165 = msg("14754", dup265); + +var msg17166 = msg("14755", dup265); + +var msg17167 = msg("14756", dup240); + +var msg17168 = msg("14757", dup240); + +var msg17169 = msg("14758", dup240); + +var msg17170 = msg("14759", dup240); + +var msg17171 = msg("14760", dup265); + +var msg17172 = msg("14761", dup265); + +var msg17173 = msg("14762", dup265); + +var msg17174 = msg("14763", dup265); + +var msg17175 = msg("14764", dup265); + +var msg17176 = msg("14765", dup265); + +var msg17177 = msg("14766", dup265); + +var msg17178 = msg("14767", dup265); + +var msg17179 = msg("14768", dup285); + +var msg17180 = msg("14769", dup222); + +var msg17181 = msg("14770", dup287); + +var msg17182 = msg("14771", dup197); + +var msg17183 = msg("14772", dup198); + +var msg17184 = msg("14773", dup222); + +var msg17185 = msg("14774", dup196); + +var msg17186 = msg("14775", dup196); + +var msg17187 = msg("14776", dup201); + +var msg17188 = msg("14777", dup196); + +var msg17189 = msg("14778", dup265); + +var msg17190 = msg("14779", dup265); + +var msg17191 = msg("14780", dup265); + +var msg17192 = msg("14781", dup265); + +var msg17193 = msg("14782", dup201); + +var msg17194 = msg("14783", dup201); + +var msg17195 = msg("14784", dup309); + +var msg17196 = msg("14785", dup309); + +var msg17197 = msg("14786", dup309); + +var msg17198 = msg("14787", dup309); + +var msg17199 = msg("14788", dup309); + +var msg17200 = msg("14789", dup309); + +var msg17201 = msg("14790", dup309); + +var msg17202 = msg("14791", dup309); + +var msg17203 = msg("14792", dup309); + +var msg17204 = msg("14793", dup309); + +var msg17205 = msg("14794", dup309); + +var msg17206 = msg("14795", dup309); + +var msg17207 = msg("14796", dup309); + +var msg17208 = msg("14797", dup309); + +var msg17209 = msg("14798", dup309); + +var msg17210 = msg("14799", dup309); + +var msg17211 = msg("14800", dup309); + +var msg17212 = msg("14801", dup309); + +var msg17213 = msg("14802", dup309); + +var msg17214 = msg("14803", dup309); + +var msg17215 = msg("14804", dup309); + +var msg17216 = msg("14805", dup309); + +var msg17217 = msg("14806", dup309); + +var msg17218 = msg("14807", dup309); + +var msg17219 = msg("14808", dup309); + +var msg17220 = msg("14809", dup309); + +var msg17221 = msg("14810", dup309); + +var msg17222 = msg("14811", dup309); + +var msg17223 = msg("14812", dup309); + +var msg17224 = msg("14813", dup309); + +var msg17225 = msg("14814", dup309); + +var msg17226 = msg("14815", dup309); + +var msg17227 = msg("14816", dup309); + +var msg17228 = msg("14817", dup197); + +var msg17229 = msg("14818", dup309); + +var msg17230 = msg("14819", dup309); + +var msg17231 = msg("14820", dup309); + +var msg17232 = msg("14821", dup309); + +var msg17233 = msg("14822", dup309); + +var msg17234 = msg("14823", dup309); + +var msg17235 = msg("14824", dup309); + +var msg17236 = msg("14825", dup309); + +var msg17237 = msg("14826", dup309); + +var msg17238 = msg("14827", dup309); + +var msg17239 = msg("14828", dup309); + +var msg17240 = msg("14829", dup309); + +var msg17241 = msg("14830", dup309); + +var msg17242 = msg("14831", dup309); + +var msg17243 = msg("14832", dup309); + +var msg17244 = msg("14833", dup309); + +var msg17245 = msg("14834", dup309); + +var msg17246 = msg("14835", dup309); + +var msg17247 = msg("14836", dup309); + +var msg17248 = msg("14837", dup309); + +var msg17249 = msg("14838", dup309); + +var msg17250 = msg("14839", dup309); + +var msg17251 = msg("14840", dup309); + +var msg17252 = msg("14841", dup309); + +var msg17253 = msg("14842", dup309); + +var msg17254 = msg("14843", dup309); + +var msg17255 = msg("14844", dup309); + +var msg17256 = msg("14845", dup309); + +var msg17257 = msg("14846", dup309); + +var msg17258 = msg("14847", dup309); + +var msg17259 = msg("14848", dup309); + +var msg17260 = msg("14849", dup309); + +var msg17261 = msg("14850", dup309); + +var msg17262 = msg("14851", dup309); + +var msg17263 = msg("14852", dup309); + +var msg17264 = msg("14853", dup309); + +var msg17265 = msg("14854", dup309); + +var msg17266 = msg("14855", dup309); + +var msg17267 = msg("14856", dup309); + +var msg17268 = msg("14857", dup309); + +var msg17269 = msg("14858", dup309); + +var msg17270 = msg("14859", dup309); + +var msg17271 = msg("14860", dup309); + +var msg17272 = msg("14861", dup309); + +var msg17273 = msg("14862", dup309); + +var msg17274 = msg("14863", dup309); + +var msg17275 = msg("14864", dup309); + +var msg17276 = msg("14865", dup309); + +var msg17277 = msg("14866", dup309); + +var msg17278 = msg("14867", dup309); + +var msg17279 = msg("14868", dup309); + +var msg17280 = msg("14869", dup309); + +var msg17281 = msg("14870", dup309); + +var msg17282 = msg("14871", dup309); + +var msg17283 = msg("14896", dup276); + +var msg17284 = msg("14897", dup265); + +var msg17285 = msg("14898", dup265); + +var msg17286 = msg("14899", dup276); + +var msg17287 = msg("14900", dup276); + +var msg17288 = msg("14986", dup196); + +var msg17289 = msg("14987", dup276); + +var msg17290 = msg("14988", dup276); + +var msg17291 = msg("14989", dup267); + +var msg17292 = msg("14990", dup267); + +var msg17293 = msg("14991", dup260); + +var msg17294 = msg("14992", dup267); + +var msg17295 = msg("14993", dup265); + +var msg17296 = msg("14994", dup265); + +var msg17297 = msg("14995", dup265); + +var msg17298 = msg("14996", dup265); + +var msg17299 = msg("14997", dup265); + +var msg17300 = msg("14998", dup265); + +var msg17301 = msg("14999", dup265); + +var msg17302 = msg("15000", dup265); + +var msg17303 = msg("15001", dup265); + +var msg17304 = msg("15002", dup265); + +var msg17305 = msg("15003", dup265); + +var msg17306 = msg("15004", dup265); + +var msg17307 = msg("15005", dup265); + +var msg17308 = msg("15006", dup265); + +var msg17309 = msg("15007", dup265); + +var msg17310 = msg("15008", dup265); + +var msg17311 = msg("15009", dup276); + +var msg17312 = msg("15010", dup222); + +var msg17313 = msg("15011", dup265); + +var msg17314 = msg("15012", dup265); + +var msg17315 = msg("15013", dup265); + +var msg17316 = msg("15014", dup267); + +var msg17317 = msg("15015", dup201); + +var msg17318 = msg("15016", dup307); + +var msg17319 = msg("15017", dup307); + +var msg17320 = msg("15018", dup307); + +var msg17321 = msg("15019", dup307); + +var msg17322 = msg("15020", dup307); + +var msg17323 = msg("15021", dup309); + +var msg17324 = msg("15022", dup309); + +var msg17325 = msg("15023", dup309); + +var msg17326 = msg("15024", dup309); + +var msg17327 = msg("15025", dup309); + +var msg17328 = msg("15026", dup309); + +var msg17329 = msg("15027", dup309); + +var msg17330 = msg("15028", dup309); + +var msg17331 = msg("15029", dup309); + +var msg17332 = msg("15030", dup309); + +var msg17333 = msg("15031", dup309); + +var msg17334 = msg("15032", dup309); + +var msg17335 = msg("15033", dup309); + +var msg17336 = msg("15034", dup309); + +var msg17337 = msg("15035", dup309); + +var msg17338 = msg("15036", dup309); + +var msg17339 = msg("15037", dup309); + +var msg17340 = msg("15038", dup309); + +var msg17341 = msg("15039", dup309); + +var msg17342 = msg("15040", dup309); + +var msg17343 = msg("15041", dup309); + +var msg17344 = msg("15042", dup309); + +var msg17345 = msg("15043", dup309); + +var msg17346 = msg("15044", dup309); + +var msg17347 = msg("15045", dup309); + +var msg17348 = msg("15046", dup309); + +var msg17349 = msg("15047", dup309); + +var msg17350 = msg("15048", dup309); + +var msg17351 = msg("15049", dup309); + +var msg17352 = msg("15050", dup309); + +var msg17353 = msg("15051", dup309); + +var msg17354 = msg("15052", dup309); + +var msg17355 = msg("15053", dup309); + +var msg17356 = msg("15054", dup309); + +var msg17357 = msg("15055", dup309); + +var msg17358 = msg("15056", dup309); + +var msg17359 = msg("15057", dup309); + +var msg17360 = msg("15058", dup309); + +var msg17361 = msg("15059", dup309); + +var msg17362 = msg("15060", dup309); + +var msg17363 = msg("15061", dup309); + +var msg17364 = msg("15062", dup309); + +var msg17365 = msg("15063", dup309); + +var msg17366 = msg("15064", dup309); + +var msg17367 = msg("15065", dup309); + +var msg17368 = msg("15066", dup309); + +var msg17369 = msg("15067", dup309); + +var msg17370 = msg("15068", dup309); + +var msg17371 = msg("15069", dup265); + +var msg17372 = msg("15070", dup265); + +var msg17373 = msg("15071", dup196); + +var msg17374 = msg("15072", dup196); + +var msg17375 = msg("15073", dup196); + +var msg17376 = msg("15074", dup196); + +var msg17377 = msg("15075", dup196); + +var msg17378 = msg("15076", dup197); + +var msg17379 = msg("15077", dup197); + +var msg17380 = msg("15078", dup222); + +var msg17381 = msg("15079", dup265); + +var msg17382 = msg("15080", dup222); + +var msg17383 = msg("15081", dup267); + +var msg17384 = msg("15082", dup222); + +var msg17385 = msg("15083", dup196); + +var msg17386 = msg("15084", dup265); + +var msg17387 = msg("15085", dup265); + +var msg17388 = msg("15086", dup265); + +var msg17389 = msg("15087", dup265); + +var msg17390 = msg("15088", dup265); + +var msg17391 = msg("15089", dup265); + +var msg17392 = msg("15090", dup265); + +var msg17393 = msg("15091", dup265); + +var msg17394 = msg("15092", dup265); + +var msg17395 = msg("15093", dup265); + +var msg17396 = msg("15094", dup265); + +var msg17397 = msg("15095", dup265); + +var msg17398 = msg("15096", dup265); + +var msg17399 = msg("15097", dup265); + +var msg17400 = msg("15098", dup265); + +var msg17401 = msg("15099", dup265); + +var msg17402 = msg("15100", dup265); + +var msg17403 = msg("15101", dup265); + +var msg17404 = msg("15102", dup265); + +var msg17405 = msg("15103", dup265); + +var msg17406 = msg("15104", dup267); + +var msg17407 = msg("15105", dup267); + +var msg17408 = msg("15106", dup267); + +var msg17409 = msg("15107", dup267); + +var msg17410 = msg("15108", dup267); + +var msg17411 = msg("15109", dup265); + +var msg17412 = msg("15110", dup265); + +var msg17413 = msg("15111", dup265); + +var msg17414 = msg("15112", dup265); + +var msg17415 = msg("15113", dup265); + +var msg17416 = msg("15114", dup267); + +var msg17417 = msg("15115", dup267); + +var msg17418 = msg("15116", dup265); + +var msg17419 = msg("15117", dup269); + +var msg17420 = msg("15118", dup265); + +var msg17421 = msg("15119", dup265); + +var msg17422 = msg("15120", dup265); + +var msg17423 = msg("15121", dup265); + +var msg17424 = msg("15122", dup265); + +var msg17425 = msg("15123", dup265); + +var msg17426 = msg("15124", dup276); + +var msg17427 = msg("15125", dup267); + +var msg17428 = msg("15126", dup265); + +var msg17429 = msg("15127", dup276); + +var msg17430 = msg("15128", dup276); + +var msg17431 = msg("15129", dup276); + +var msg17432 = msg("15130", dup276); + +var msg17433 = msg("15131", dup276); + +var msg17434 = msg("15132", dup276); + +var msg17435 = msg("15133", dup276); + +var msg17436 = msg("15134", dup276); + +var msg17437 = msg("15135", dup276); + +var msg17438 = msg("15136", dup276); + +var msg17439 = msg("15137", dup276); + +var msg17440 = msg("15138", dup276); + +var msg17441 = msg("15139", dup276); + +var msg17442 = msg("15140", dup276); + +var msg17443 = msg("15141", dup276); + +var msg17444 = msg("15142", dup276); + +var msg17445 = msg("15143", dup240); + +var msg17446 = msg("15144", dup240); + +var msg17447 = msg("15145", dup222); + +var msg17448 = msg("15146", dup222); + +var msg17449 = msg("15147", dup222); + +var msg17450 = msg("15148", dup198); + +var msg17451 = msg("15149", dup198); + +var msg17452 = msg("15150", dup285); + +var msg17453 = msg("15151", dup285); + +var msg17454 = msg("15152", dup285); + +var msg17455 = msg("15153", dup285); + +var msg17456 = msg("15154", dup285); + +var msg17457 = msg("15155", dup285); + +var msg17458 = msg("15156", dup285); + +var msg17459 = msg("15157", dup265); + +var msg17460 = msg("15158", dup265); + +var msg17461 = msg("15159", dup265); + +var msg17462 = msg("15160", dup265); + +var msg17463 = msg("15161", dup265); + +var msg17464 = msg("15162", dup265); + +var msg17465 = msg("15163", dup222); + +var msg17466 = msg("15164", dup196); + +var msg17467 = msg("15165", dup192); + +var msg17468 = msg("15166", dup267); + +var msg17469 = msg("15167", dup196); + +var msg17470 = msg("15168", dup196); + +var msg17471 = msg("15169", dup196); + +var msg17472 = msg("15170", dup196); + +var msg17473 = msg("15171", dup265); + +var msg17474 = msg("15172", dup196); + +var msg17475 = msg("15173", dup265); + +var msg17476 = msg("15174", dup265); + +var msg17477 = msg("15175", dup265); + +var msg17478 = msg("15176", dup265); + +var msg17479 = msg("15177", dup265); + +var msg17480 = msg("15178", dup265); + +var msg17481 = msg("15179", dup265); + +var msg17482 = msg("15180", dup265); + +var msg17483 = msg("15181", dup265); + +var msg17484 = msg("15182", dup265); + +var msg17485 = msg("15183", dup265); + +var msg17486 = msg("15184", dup265); + +var msg17487 = msg("15185", dup196); + +var msg17488 = msg("15186", dup201); + +var msg17489 = msg("15187", dup201); + +var msg17490 = msg("15188", dup201); + +var msg17491 = msg("15189", dup201); + +var msg17492 = msg("15190", dup267); + +var msg17493 = msg("15191", dup197); + +var msg17494 = msg("15192", dup265); + +var msg17495 = msg("15193", dup265); + +var msg17496 = msg("15194", dup265); + +var msg17497 = msg("15195", dup265); + +var msg17498 = msg("15196", dup276); + +var msg17499 = msg("15197", dup276); + +var msg17500 = msg("15198", dup276); + +var msg17501 = msg("15199", dup276); + +var msg17502 = msg("15200", dup276); + +var msg17503 = msg("15201", dup276); + +var msg17504 = msg("15202", dup276); + +var msg17505 = msg("15203", dup276); + +var msg17506 = msg("15204", dup276); + +var msg17507 = msg("15205", dup276); + +var msg17508 = msg("15206", dup276); + +var msg17509 = msg("15207", dup276); + +var msg17510 = msg("15208", dup276); + +var msg17511 = msg("15209", dup276); + +var msg17512 = msg("15210", dup276); + +var msg17513 = msg("15211", dup276); + +var msg17514 = msg("15212", dup276); + +var msg17515 = msg("15213", dup276); + +var msg17516 = msg("15214", dup276); + +var msg17517 = msg("15215", dup276); + +var msg17518 = msg("15216", dup276); + +var msg17519 = msg("15217", dup276); + +var msg17520 = msg("15218", dup276); + +var msg17521 = msg("15219", dup276); + +var msg17522 = msg("15220", dup276); + +var msg17523 = msg("15221", dup276); + +var msg17524 = msg("15222", dup276); + +var msg17525 = msg("15223", dup276); + +var msg17526 = msg("15224", dup276); + +var msg17527 = msg("15225", dup276); + +var msg17528 = msg("15226", dup276); + +var msg17529 = msg("15227", dup276); + +var msg17530 = msg("15228", dup265); + +var msg17531 = msg("15229", dup265); + +var msg17532 = msg("15230", dup265); + +var msg17533 = msg("15231", dup265); + +var msg17534 = msg("15232", dup265); + +var msg17535 = msg("15233", dup265); + +var msg17536 = msg("15234", dup265); + +var msg17537 = msg("15235", dup265); + +var msg17538 = msg("15236", dup267); + +var msg17539 = msg("15237", dup265); + +var msg17540 = msg("15238", dup196); + +var msg17541 = msg("15239", dup265); + +var msg17542 = msg("15240", dup265); + +var msg17543 = msg("15241", dup222); + +var msg17544 = msg("15242", dup267); + +var msg17545 = msg("15243", dup265); + +var msg17546 = msg("15244", dup265); + +var msg17547 = msg("15245", dup265); + +var msg17548 = msg("15246", dup265); + +var msg17549 = msg("15247", dup265); + +var msg17550 = msg("15248", dup265); + +var msg17551 = msg("15249", dup265); + +var msg17552 = msg("15250", dup265); + +var msg17553 = msg("15251", dup265); + +var msg17554 = msg("15252", dup265); + +var msg17555 = msg("15253", dup265); + +var msg17556 = msg("15254", dup265); + +var msg17557 = msg("15255", dup222); + +var msg17558 = msg("15256", dup196); + +var msg17559 = msg("15257", dup196); + +var msg17560 = msg("15258", dup196); + +var msg17561 = msg("15259", dup198); + +var msg17562 = msg("15260", dup198); + +var msg17563 = msg("15261", dup196); + +var msg17564 = msg("15262", dup196); + +var msg17565 = msg("15263", dup198); + +var msg17566 = msg("15264", dup267); + +var msg17567 = msg("15265", dup265); + +var msg17568 = msg("15266", dup265); + +var msg17569 = msg("15267", dup265); + +var msg17570 = msg("15268", dup265); + +var msg17571 = msg("15269", dup265); + +var msg17572 = msg("15270", dup265); + +var msg17573 = msg("15271", dup265); + +var msg17574 = msg("15272", dup265); + +var msg17575 = msg("15273", dup265); + +var msg17576 = msg("15274", dup265); + +var msg17577 = msg("15275", dup265); + +var msg17578 = msg("15276", dup265); + +var msg17579 = msg("15277", dup265); + +var msg17580 = msg("15278", dup265); + +var msg17581 = msg("15279", dup265); + +var msg17582 = msg("15280", dup265); + +var msg17583 = msg("15281", dup265); + +var msg17584 = msg("15282", dup265); + +var msg17585 = msg("15283", dup265); + +var msg17586 = msg("15284", dup265); + +var msg17587 = msg("15285", dup265); + +var msg17588 = msg("15286", dup265); + +var msg17589 = msg("15287", dup265); + +var msg17590 = msg("15288", dup265); + +var msg17591 = msg("15289", dup265); + +var msg17592 = msg("15290", dup265); + +var msg17593 = msg("15291", dup265); + +var msg17594 = msg("15292", dup196); + +var msg17595 = msg("15293", dup196); + +var msg17596 = msg("15294", dup265); + +var msg17597 = msg("15295", dup192); + +var msg17598 = msg("15296", dup192); + +var msg17599 = msg("15297", dup192); + +var msg17600 = msg("15298", dup267); + +var msg17601 = msg("15299", dup265); + +var msg17602 = msg("15300", dup267); + +var msg17603 = msg("15301", dup250); + +var msg17604 = msg("15302", dup198); + +var msg17605 = msg("15303", dup269); + +var msg17606 = msg("15304", dup265); + +var msg17607 = msg("15305", dup265); + +var msg17608 = msg("15306", dup267); + +var msg17609 = msg("15307", dup265); + +var msg17610 = msg("15308", dup265); + +var msg17611 = msg("15309", dup265); + +var msg17612 = msg("15310", dup265); + +var msg17613 = msg("15311", dup265); + +var msg17614 = msg("15312", dup265); + +var msg17615 = msg("15313", dup265); + +var msg17616 = msg("15314", dup265); + +var msg17617 = msg("15315", dup265); + +var msg17618 = msg("15316", dup265); + +var msg17619 = msg("15317", dup265); + +var msg17620 = msg("15318", dup265); + +var msg17621 = msg("15319", dup276); + +var msg17622 = msg("15320", dup276); + +var msg17623 = msg("15321", dup276); + +var msg17624 = msg("15322", dup276); + +var msg17625 = msg("15323", dup276); + +var msg17626 = msg("15324", dup276); + +var msg17627 = msg("15325", dup276); + +var msg17628 = msg("15326", dup276); + +var msg17629 = msg("15327", dup218); + +var msg17630 = msg("15328", dup267); + +var msg17631 = msg("15329", dup250); + +var msg17632 = msg("15330", dup265); + +var msg17633 = msg("15331", dup265); + +var msg17634 = msg("15332", dup265); + +var msg17635 = msg("15333", dup265); + +var msg17636 = msg("15334", dup265); + +var msg17637 = msg("15335", dup265); + +var msg17638 = msg("15336", dup265); + +var msg17639 = msg("15337", dup265); + +var msg17640 = msg("15338", dup265); + +var msg17641 = msg("15339", dup265); + +var msg17642 = msg("15340", dup265); + +var msg17643 = msg("15341", dup265); + +var msg17644 = msg("15342", dup265); + +var msg17645 = msg("15343", dup265); + +var msg17646 = msg("15344", dup265); + +var msg17647 = msg("15345", dup265); + +var msg17648 = msg("15346", dup197); + +var msg17649 = msg("15347", dup197); + +var msg17650 = msg("15348", dup197); + +var msg17651 = msg("15349", dup197); + +var msg17652 = msg("15350", dup265); + +var msg17653 = msg("15351", dup265); + +var msg17654 = msg("15352", dup265); + +var msg17655 = msg("15353", dup265); + +var msg17656 = msg("15354", dup250); + +var msg17657 = msg("15355", dup267); + +var msg17658 = msg("15356", dup250); + +var msg17659 = msg("15357", dup267); + +var msg17660 = msg("15358", dup250); + +var msg17661 = msg("15359", dup250); + +var msg17662 = msg("15360", dup250); + +var msg17663 = msg("15361", dup196); + +var msg17664 = msg("15362", dup196); + +var msg17665 = msg("15363", dup265); + +var msg17666 = msg("15364", dup222); + +var msg17667 = msg("15365", dup265); + +var all48 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + setc("eventcategory","1001030300"), + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg17668 = msg("15366", all48); + +var msg17669 = msg("15367", dup201); + +var msg17670 = msg("15368", dup265); + +var msg17671 = msg("15369", dup265); + +var msg17672 = msg("15370", dup265); + +var msg17673 = msg("15371", dup265); + +var msg17674 = msg("15372", dup265); + +var msg17675 = msg("15373", dup265); + +var msg17676 = msg("15374", dup265); + +var msg17677 = msg("15375", dup265); + +var msg17678 = msg("15376", dup265); + +var msg17679 = msg("15377", dup265); + +var msg17680 = msg("15378", dup265); + +var msg17681 = msg("15379", dup265); + +var msg17682 = msg("15380", dup265); + +var msg17683 = msg("15381", dup265); + +var msg17684 = msg("15382", dup222); + +var msg17685 = msg("15383", dup196); + +var msg17686 = msg("15384", dup265); + +var msg17687 = msg("15385", dup265); + +var msg17688 = msg("15386", dup196); + +var msg17689 = msg("15387", dup276); + +var msg17690 = msg("15388", dup222); + +var msg17691 = msg("15389", dup196); + +var msg17692 = msg("15390", dup196); + +var msg17693 = msg("15391", dup196); + +var msg17694 = msg("15392", dup196); + +var msg17695 = msg("15393", dup196); + +var msg17696 = msg("15394", dup196); + +var msg17697 = msg("15395", dup196); + +var msg17698 = msg("15396", dup196); + +var msg17699 = msg("15397", dup196); + +var msg17700 = msg("15398", dup196); + +var msg17701 = msg("15399", dup196); + +var msg17702 = msg("15400", dup196); + +var msg17703 = msg("15401", dup196); + +var msg17704 = msg("15402", dup196); + +var msg17705 = msg("15403", dup196); + +var msg17706 = msg("15404", dup196); + +var msg17707 = msg("15405", dup196); + +var msg17708 = msg("15406", dup196); + +var msg17709 = msg("15407", dup196); + +var msg17710 = msg("15408", dup196); + +var msg17711 = msg("15409", dup196); + +var msg17712 = msg("15410", dup196); + +var msg17713 = msg("15411", dup196); + +var msg17714 = msg("15412", dup222); + +var msg17715 = msg("15413", dup222); + +var msg17716 = msg("15414", dup196); + +var msg17717 = msg("15415", dup196); + +var msg17718 = msg("15416", dup196); + +var msg17719 = msg("15417", dup196); + +var msg17720 = msg("15418", dup196); + +var msg17721 = msg("15420", dup196); + +var msg17722 = msg("15421", dup196); + +var msg17723 = msg("15422", dup222); + +var msg17724 = msg("15423", dup263); + +var msg17725 = msg("15424", dup260); + +var msg17726 = msg("15425", dup260); + +var msg17727 = msg("15426", dup265); + +var msg17728 = msg("15427", dup265); + +var msg17729 = msg("15428", dup265); + +var msg17730 = msg("15429", dup196); + +var msg17731 = msg("15430", dup267); + +var msg17732 = msg("15431", dup222); + +var msg17733 = msg("15432", dup269); + +var msg17734 = msg("15433", dup267); + +var msg17735 = msg("15434", dup267); + +var msg17736 = msg("15435", dup198); + +var msg17737 = msg("15436", dup196); + +var msg17738 = msg("15437", dup196); + +var msg17739 = msg("15438", dup196); + +var msg17740 = msg("15439", dup196); + +var msg17741 = msg("15440", dup196); + +var msg17742 = msg("15441", dup196); + +var msg17743 = msg("15442", dup198); + +var msg17744 = msg("15443", dup198); + +var msg17745 = msg("15444", dup265); + +var msg17746 = msg("15445", dup287); + +var msg17747 = msg("15446", dup267); + +var msg17748 = msg("15447", dup265); + +var msg17749 = msg("15448", dup276); + +var msg17750 = msg("15449", dup196); + +var msg17751 = msg("15450", dup196); + +var msg17752 = msg("15451", dup196); + +var msg17753 = msg("15452", dup196); + +var msg17754 = msg("15453", dup276); + +var msg17755 = msg("15454", dup267); + +var msg17756 = msg("15455", dup222); + +var msg17757 = msg("15456", dup265); + +var msg17758 = msg("15457", dup269); + +var msg17759 = msg("15458", dup196); + +var msg17760 = msg("15459", dup196); + +var msg17761 = msg("15460", dup196); + +var msg17762 = msg("15461", dup196); + +var msg17763 = msg("15462", dup265); + +var msg17764 = msg("15463", dup265); + +var msg17765 = msg("15464", dup265); + +var msg17766 = msg("15465", dup267); + +var msg17767 = msg("15466", dup222); + +var msg17768 = msg("15467", dup222); + +var msg17769 = msg("15468", dup265); + +var msg17770 = msg("15469", dup265); + +var msg17771 = msg("15470", dup269); + +var msg17772 = msg("15471", dup196); + +var msg17773 = msg("15472", dup267); + +var msg17774 = msg("15473", dup267); + +var msg17775 = msg("15474", dup198); + +var msg17776 = msg("15475", dup265); + +var msg17777 = msg("15476", dup263); + +var msg17778 = msg("15477", dup222); + +var msg17779 = msg("15478", dup196); + +var msg17780 = msg("15479", dup222); + +var msg17781 = msg("15480", dup265); + +var msg17782 = msg("15481", dup196); + +var msg17783 = msg("15482", dup273); + +var msg17784 = msg("15483", dup265); + +var msg17785 = msg("15484", dup197); + +var msg17786 = msg("15485", dup197); + +var msg17787 = msg("15486", dup192); + +var msg17788 = msg("15487", dup196); + +var msg17789 = msg("15488", dup196); + +var msg17790 = msg("15489", dup222); + +var msg17791 = msg("15490", dup269); + +var msg17792 = msg("15491", dup222); + +var msg17793 = msg("15492", dup196); + +var msg17794 = msg("15493", dup196); + +var msg17795 = msg("15494", dup250); + +var msg17796 = msg("15495", dup250); + +var msg17797 = msg("15496", dup250); + +var msg17798 = msg("15497", dup250); + +var msg17799 = msg("15498", dup267); + +var msg17800 = msg("15499", dup267); + +var msg17801 = msg("15500", dup196); + +var msg17802 = msg("15501", dup265); + +var msg17803 = msg("15502", dup265); + +var msg17804 = msg("15503", dup196); + +var msg17805 = msg("15504", dup196); + +var msg17806 = msg("15505", dup265); + +var msg17807 = msg("15506", dup267); + +var msg17808 = msg("15507", dup201); + +var msg17809 = msg("15508", dup201); + +var msg17810 = msg("15509", dup198); + +var msg17811 = msg("15510", dup194); + +var msg17812 = msg("15511", dup222); + +var msg17813 = msg("15512", dup276); + +var msg17814 = msg("15513", dup276); + +var msg17815 = msg("15514", dup201); + +var msg17816 = msg("15515", dup260); + +var msg17817 = msg("15516", dup265); + +var msg17818 = msg("15517", dup267); + +var msg17819 = msg("15518", dup265); + +var msg17820 = msg("15519", dup267); + +var msg17821 = msg("15520", dup267); + +var msg17822 = msg("15521", dup267); + +var msg17823 = msg("15522", dup198); + +var msg17824 = msg("15523", dup222); + +var msg17825 = msg("15524", dup196); + +var msg17826 = msg("15525", dup196); + +var msg17827 = msg("15526", dup222); + +var msg17828 = msg("15527", dup198); + +var msg17829 = msg("15528", dup276); + +var msg17830 = msg("15529", dup265); + +var msg17831 = msg("15530", dup310); + +var msg17832 = msg("15531", dup267); + +var msg17833 = msg("15532", dup310); + +var msg17834 = msg("15533", dup310); + +var msg17835 = msg("15534", dup267); + +var msg17836 = msg("15535", dup267); + +var msg17837 = msg("15536", dup267); + +var msg17838 = msg("15537", dup267); + +var msg17839 = msg("15538", dup265); + +var msg17840 = msg("15539", dup267); + +var msg17841 = msg("15540", dup265); + +var msg17842 = msg("15541", dup267); + +var msg17843 = msg("15542", dup267); + +var msg17844 = msg("15543", dup265); + +var msg17845 = msg("15544", dup265); + +var msg17846 = msg("15545", dup265); + +var msg17847 = msg("15546", dup265); + +var msg17848 = msg("15547", dup265); + +var msg17849 = msg("15548", dup265); + +var msg17850 = msg("15549", dup265); + +var msg17851 = msg("15550", dup265); + +var msg17852 = msg("15551", dup265); + +var msg17853 = msg("15552", dup265); + +var msg17854 = msg("15553", dup263); + +var msg17855 = msg("15554", dup196); + +var msg17856 = msg("15555", dup222); + +var msg17857 = msg("15556", dup269); + +var msg17858 = msg("15557", dup265); + +var msg17859 = msg("15558", dup265); + +var msg17860 = msg("15559", dup201); + +var msg17861 = msg("15560", dup196); + +var msg17862 = msg("15561", dup196); + +var msg17863 = msg("15562", dup265); + +var msg17864 = msg("15563", dup192); + +var msg17865 = msg("15564", dup192); + +var msg17866 = msg("15565", dup192); + +var msg17867 = msg("15566", dup303); + +var msg17868 = msg("15567", dup303); + +var msg17869 = msg("15568", dup196); + +var msg17870 = msg("15569", dup196); + +var msg17871 = msg("15570", dup196); + +var msg17872 = msg("15571", dup222); + +var msg17873 = msg("15572", dup198); + +var msg17874 = msg("15573", dup222); + +var msg17875 = msg("15574", dup222); + +var msg17876 = msg("15575", dup196); + +var msg17877 = msg("15576", dup196); + +var msg17878 = msg("15577", dup196); + +var msg17879 = msg("15578", dup198); + +var msg17880 = msg("15579", dup198); + +var msg17881 = msg("15580", dup196); + +var msg17882 = msg("15581", dup198); + +var msg17883 = msg("15582", dup265); + +var msg17884 = msg("15583", dup194); + +var msg17885 = msg("15584", dup260); + +var msg17886 = msg("15585", dup265); + +var msg17887 = msg("15586", dup265); + +var msg17888 = msg("15587", dup265); + +var msg17889 = msg("15588", dup265); + +var msg17890 = msg("15589", dup265); + +var msg17891 = msg("15590", dup265); + +var msg17892 = msg("15591", dup265); + +var msg17893 = msg("15592", dup265); + +var msg17894 = msg("15593", dup265); + +var msg17895 = msg("15594", dup265); + +var msg17896 = msg("15595", dup265); + +var msg17897 = msg("15596", dup265); + +var msg17898 = msg("15597", dup265); + +var msg17899 = msg("15598", dup265); + +var msg17900 = msg("15599", dup265); + +var msg17901 = msg("15600", dup265); + +var msg17902 = msg("15601", dup265); + +var msg17903 = msg("15602", dup265); + +var msg17904 = msg("15603", dup265); + +var msg17905 = msg("15604", dup265); + +var msg17906 = msg("15605", dup265); + +var msg17907 = msg("15606", dup265); + +var msg17908 = msg("15607", dup265); + +var msg17909 = msg("15608", dup265); + +var msg17910 = msg("15609", dup265); + +var msg17911 = msg("15610", dup265); + +var msg17912 = msg("15611", dup265); + +var msg17913 = msg("15612", dup265); + +var msg17914 = msg("15613", dup265); + +var msg17915 = msg("15614", dup265); + +var msg17916 = msg("15615", dup265); + +var msg17917 = msg("15616", dup265); + +var msg17918 = msg("15617", dup265); + +var msg17919 = msg("15618", dup265); + +var msg17920 = msg("15619", dup265); + +var msg17921 = msg("15620", dup265); + +var msg17922 = msg("15621", dup265); + +var msg17923 = msg("15622", dup265); + +var msg17924 = msg("15623", dup265); + +var msg17925 = msg("15624", dup265); + +var msg17926 = msg("15625", dup265); + +var msg17927 = msg("15626", dup265); + +var msg17928 = msg("15627", dup265); + +var msg17929 = msg("15628", dup265); + +var msg17930 = msg("15629", dup265); + +var msg17931 = msg("15630", dup265); + +var msg17932 = msg("15631", dup265); + +var msg17933 = msg("15632", dup265); + +var msg17934 = msg("15633", dup265); + +var msg17935 = msg("15634", dup265); + +var msg17936 = msg("15635", dup265); + +var msg17937 = msg("15636", dup265); + +var msg17938 = msg("15637", dup265); + +var msg17939 = msg("15638", dup265); + +var msg17940 = msg("15639", dup265); + +var msg17941 = msg("15640", dup265); + +var msg17942 = msg("15641", dup265); + +var msg17943 = msg("15642", dup265); + +var msg17944 = msg("15643", dup265); + +var msg17945 = msg("15644", dup265); + +var msg17946 = msg("15645", dup265); + +var msg17947 = msg("15646", dup265); + +var msg17948 = msg("15647", dup265); + +var msg17949 = msg("15648", dup265); + +var msg17950 = msg("15649", dup265); + +var msg17951 = msg("15650", dup265); + +var msg17952 = msg("15651", dup265); + +var msg17953 = msg("15652", dup265); + +var msg17954 = msg("15653", dup265); + +var msg17955 = msg("15654", dup265); + +var msg17956 = msg("15655", dup265); + +var msg17957 = msg("15656", dup265); + +var msg17958 = msg("15657", dup265); + +var msg17959 = msg("15658", dup265); + +var msg17960 = msg("15659", dup265); + +var msg17961 = msg("15660", dup265); + +var msg17962 = msg("15661", dup265); + +var msg17963 = msg("15662", dup265); + +var msg17964 = msg("15663", dup265); + +var msg17965 = msg("15664", dup265); + +var msg17966 = msg("15665", dup265); + +var msg17967 = msg("15666", dup265); + +var msg17968 = msg("15667", dup265); + +var msg17969 = msg("15668", dup265); + +var msg17970 = msg("15669", dup265); + +var msg17971 = msg("15670", dup265); + +var msg17972 = msg("15671", dup265); + +var msg17973 = msg("15672", dup265); + +var msg17974 = msg("15673", dup265); + +var msg17975 = msg("15674", dup265); + +var msg17976 = msg("15675", dup265); + +var msg17977 = msg("15676", dup265); + +var msg17978 = msg("15677", dup265); + +var msg17979 = msg("15678", dup196); + +var msg17980 = msg("15679", dup196); + +var msg17981 = msg("15680", dup196); + +var msg17982 = msg("15681", dup269); + +var msg17983 = msg("15682", dup265); + +var msg17984 = msg("15683", dup285); + +var msg17985 = msg("15684", dup196); + +var msg17986 = msg("15685", dup265); + +var msg17987 = msg("15686", dup265); + +var msg17988 = msg("15687", dup265); + +var msg17989 = msg("15688", dup265); + +var msg17990 = msg("15689", dup265); + +var msg17991 = msg("15690", dup265); + +var msg17992 = msg("15691", dup265); + +var msg17993 = msg("15692", dup265); + +var msg17994 = msg("15693", dup267); + +var msg17995 = msg("15694", dup267); + +var msg17996 = msg("15695", dup267); + +var msg17997 = msg("15696", dup287); + +var msg17998 = msg("15697", dup265); + +var msg17999 = msg("15698", dup265); + +var msg18000 = msg("15699", dup222); + +var msg18001 = msg("15700", dup222); + +var msg18002 = msg("15701", dup285); + +var msg18003 = msg("15702", dup201); + +var msg18004 = msg("15703", dup267); + +var msg18005 = msg("15704", dup267); + +var msg18006 = msg("15705", dup267); + +var msg18007 = msg("15706", dup267); + +var msg18008 = msg("15707", dup267); + +var msg18009 = msg("15708", dup222); + +var msg18010 = msg("15709", dup267); + +var msg18011 = msg("15710", dup276); + +var msg18012 = msg("15711", dup222); + +var msg18013 = msg("15712", dup196); + +var msg18014 = msg("15713", dup196); + +var msg18015 = msg("15714", dup196); + +var msg18016 = msg("15715", dup197); + +var msg18017 = msg("15716", dup196); + +var msg18018 = msg("15717", dup196); + +var msg18019 = msg("15718", dup196); + +var msg18020 = msg("15719", dup196); + +var msg18021 = msg("15720", dup196); + +var msg18022 = msg("15721", dup196); + +var msg18023 = msg("15722", dup201); + +var msg18024 = msg("15723", dup260); + +var msg18025 = msg("15724", dup260); + +var msg18026 = msg("15725", dup260); + +var msg18027 = msg("15726", dup222); + +var msg18028 = msg("15727", dup196); + +var msg18029 = msg("15728", dup287); + +var msg18030 = msg("15729", dup287); + +var msg18031 = msg("15730", dup192); + +var msg18032 = msg("15731", dup269); + +var msg18033 = msg("15732", dup196); + +var msg18034 = msg("15733", dup196); + +var msg18035 = msg("15734", dup198); + +var msg18036 = msg("15847", dup276); + +var msg18037 = msg("15848", dup196); + +var msg18038 = msg("15849", dup196); + +var msg18039 = msg("15850", dup196); + +var all49 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg18040 = msg("15851", all49); + +var msg18041 = msg("15852", dup265); + +var msg18042 = msg("15853", dup265); + +var msg18043 = msg("15854", dup265); + +var msg18044 = msg("15855", dup265); + +var msg18045 = msg("15856", dup265); + +var msg18046 = msg("15857", dup196); + +var msg18047 = msg("15858", dup265); + +var msg18048 = msg("15859", dup265); + +var msg18049 = msg("15860", dup276); + +var msg18050 = msg("15861", dup265); + +var msg18051 = msg("15862", dup265); + +var msg18052 = msg("15863", dup265); + +var msg18053 = msg("15864", dup265); + +var msg18054 = msg("15865", dup265); + +var msg18055 = msg("15866", dup267); + +var msg18056 = msg("15867", dup265); + +var msg18057 = msg("15868", dup197); + +var msg18058 = msg("15869", dup267); + +var msg18059 = msg("15870", dup265); + +var msg18060 = msg("15871", dup265); + +var msg18061 = msg("15872", dup265); + +var msg18062 = msg("15873", dup196); + +var msg18063 = msg("15874", dup260); + +var msg18064 = msg("15875", dup260); + +var msg18065 = msg("15876", dup260); + +var msg18066 = msg("15877", dup260); + +var msg18067 = msg("15878", dup265); + +var msg18068 = msg("15879", dup265); + +var msg18069 = msg("15880", dup196); + +var msg18070 = msg("15881", dup276); + +var msg18071 = msg("15882", dup196); + +var msg18072 = msg("15883", dup222); + +var msg18073 = msg("15884", dup222); + +var msg18074 = msg("15885", dup222); + +var msg18075 = msg("15886", dup222); + +var msg18076 = msg("15887", dup222); + +var msg18077 = msg("15888", dup222); + +var msg18078 = msg("15889", dup222); + +var msg18079 = msg("15890", dup222); + +var msg18080 = msg("15891", dup222); + +var msg18081 = msg("15892", dup222); + +var msg18082 = msg("15893", dup196); + +var msg18083 = msg("15894", dup196); + +var msg18084 = msg("15895", dup222); + +var msg18085 = msg("15896", dup198); + +var msg18086 = msg("15897", dup267); + +var msg18087 = msg("15898", dup265); + +var msg18088 = msg("15899", dup265); + +var msg18089 = msg("15900", dup265); + +var msg18090 = msg("15901", dup222); + +var msg18091 = msg("15902", dup196); + +var msg18092 = msg("15903", dup196); + +var msg18093 = msg("15904", dup265); + +var msg18094 = msg("15905", dup265); + +var msg18095 = msg("15906", dup222); + +var msg18096 = msg("15907", dup222); + +var msg18097 = msg("15908", dup194); + +var msg18098 = msg("15909", dup265); + +var msg18099 = msg("15910", dup196); + +var msg18100 = msg("15911", dup276); + +var msg18101 = msg("15912", dup196); + +var msg18102 = msg("15913", dup265); + +var msg18103 = msg("15914", dup265); + +var msg18104 = msg("15915", dup265); + +var msg18105 = msg("15916", dup265); + +var msg18106 = msg("15917", dup297); + +var msg18107 = msg("15918", dup265); + +var msg18108 = msg("15919", dup265); + +var msg18109 = msg("15920", dup265); + +var msg18110 = msg("15921", dup265); + +var msg18111 = msg("15922", dup265); + +var msg18112 = msg("15923", dup265); + +var msg18113 = msg("15924", dup265); + +var msg18114 = msg("15925", dup265); + +var msg18115 = msg("15926", dup265); + +var msg18116 = msg("15927", dup265); + +var msg18117 = msg("15928", dup265); + +var msg18118 = msg("15929", dup265); + +var msg18119 = msg("15930", dup198); + +var msg18120 = msg("15931", dup196); + +var msg18121 = msg("15932", dup198); + +var msg18122 = msg("15933", dup265); + +var msg18123 = msg("15934", dup196); + +var msg18124 = msg("15935", dup196); + +var msg18125 = msg("15936", dup196); + +var msg18126 = msg("15937", dup197); + +var msg18127 = msg("15938", dup192); + +var msg18128 = msg("15939", dup196); + +var msg18129 = msg("15940", dup201); + +var msg18130 = msg("15941", dup198); + +var msg18131 = msg("15942", dup201); + +var msg18132 = msg("15943", dup201); + +var msg18133 = msg("15944", dup198); + +var msg18134 = msg("15945", dup265); + +var msg18135 = msg("15946", dup267); + +var msg18136 = msg("15947", dup287); + +var msg18137 = msg("15948", dup222); + +var msg18138 = msg("15949", dup222); + +var msg18139 = msg("15950", dup222); + +var msg18140 = msg("15951", dup260); + +var msg18141 = msg("15952", dup269); + +var msg18142 = msg("15953", dup265); + +var msg18143 = msg("15954", dup198); + +var msg18144 = msg("15955", dup196); + +var msg18145 = msg("15956", dup265); + +var msg18146 = msg("15957", dup198); + +var msg18147 = msg("15958", dup267); + +var msg18148 = msg("15959", dup198); + +var msg18149 = msg("15960", dup198); + +var msg18150 = msg("15961", dup196); + +var msg18151 = msg("15962", dup222); + +var msg18152 = msg("15963", dup218); + +var msg18153 = msg("15964", dup196); + +var msg18154 = msg("15965", dup222); + +var msg18155 = msg("15966", dup194); + +var msg18156 = msg("15967", dup222); + +var msg18157 = msg("15968", dup201); + +var msg18158 = msg("15969", dup198); + +var msg18159 = msg("15970", dup222); + +var msg18160 = msg("15971", dup196); + +var msg18161 = msg("15972", dup196); + +var msg18162 = msg("15973", dup222); + +var msg18163 = msg("15974", dup197); + +var msg18164 = msg("15975", dup267); + +var msg18165 = msg("15976", dup267); + +var msg18166 = msg("15977", dup201); + +var msg18167 = msg("15978", dup267); + +var msg18168 = msg("15979", dup222); + +var msg18169 = msg("15980", dup265); + +var msg18170 = msg("15981", dup198); + +var msg18171 = msg("15982", dup198); + +var msg18172 = msg("15983", dup196); + +var msg18173 = msg("15984", dup198); + +var msg18174 = msg("15985", dup196); + +var msg18175 = msg("15986", dup222); + +var msg18176 = msg("15987", dup265); + +var msg18177 = msg("15988", dup196); + +var msg18178 = msg("15989", dup198); + +var msg18179 = msg("15990", dup265); + +var msg18180 = msg("15991", dup198); + +var msg18181 = msg("15992", dup194); + +var msg18182 = msg("15993", dup201); + +var msg18183 = msg("15994", dup198); + +var msg18184 = msg("15995", dup269); + +var msg18185 = msg("15996", dup222); + +var msg18186 = msg("15997", dup196); + +var msg18187 = msg("15998", dup196); + +var msg18188 = msg("15999", dup287); + +var msg18189 = msg("16000", dup265); + +var msg18190 = msg("16001", dup196); + +var msg18191 = msg("16002", dup267); + +var msg18192 = msg("16003", dup267); + +var msg18193 = msg("16004", dup267); + +var msg18194 = msg("16005", dup201); + +var msg18195 = msg("16006", dup196); + +var msg18196 = msg("16007", dup196); + +var all50 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg18197 = msg("16008", all50); + +var msg18198 = msg("16009", dup222); + +var msg18199 = msg("16010", dup287); + +var msg18200 = msg("16011", dup196); + +var msg18201 = msg("16012", dup265); + +var msg18202 = msg("16013", dup196); + +var msg18203 = msg("16014", dup198); + +var msg18204 = msg("16015", dup222); + +var msg18205 = msg("16016", dup222); + +var msg18206 = msg("16017", dup222); + +var msg18207 = msg("16018", dup197); + +var msg18208 = msg("16019", dup222); + +var msg18209 = msg("16020", dup240); + +var msg18210 = msg("16021", dup265); + +var msg18211 = msg("16022", dup196); + +var msg18212 = msg("16023", dup196); + +var msg18213 = msg("16024", dup201); + +var msg18214 = msg("16025", dup222); + +var msg18215 = msg("16026", dup265); + +var msg18216 = msg("16027", dup267); + +var msg18217 = msg("16028", dup196); + +var msg18218 = msg("16029", dup197); + +var msg18219 = msg("16030", dup197); + +var msg18220 = msg("16031", dup265); + +var msg18221 = msg("16032", dup265); + +var msg18222 = msg("16033", dup196); + +var msg18223 = msg("16034", dup222); + +var msg18224 = msg("16035", dup196); + +var msg18225 = msg("16036", dup196); + +var msg18226 = msg("16037", dup222); + +var msg18227 = msg("16038", dup201); + +var msg18228 = msg("16039", dup198); + +var msg18229 = msg("16040", dup196); + +var msg18230 = msg("16041", dup222); + +var msg18231 = msg("16042", dup287); + +var msg18232 = msg("16043", dup265); + +var msg18233 = msg("16044", dup267); + +var msg18234 = msg("16045", dup196); + +var msg18235 = msg("16046", dup196); + +var msg18236 = msg("16047", dup196); + +var msg18237 = msg("16048", dup265); + +var msg18238 = msg("16049", dup260); + +var msg18239 = msg("16050", dup265); + +var msg18240 = msg("16051", dup196); + +var msg18241 = msg("16052", dup198); + +var msg18242 = msg("16053", dup267); + +var msg18243 = msg("16054", dup197); + +var msg18244 = msg("16055", dup222); + +var msg18245 = msg("16056", dup285); + +var msg18246 = msg("16057", dup222); + +var msg18247 = msg("16058", dup222); + +var msg18248 = msg("16059", dup196); + +var msg18249 = msg("16060", dup196); + +var msg18250 = msg("16061", dup196); + +var msg18251 = msg("16062", dup222); + +var msg18252 = msg("16063", dup267); + +var msg18253 = msg("16064", dup196); + +var msg18254 = msg("16065", dup196); + +var msg18255 = msg("16066", dup198); + +var msg18256 = msg("16067", dup196); + +var msg18257 = msg("16068", dup196); + +var msg18258 = msg("16069", dup222); + +var msg18259 = msg("16070", dup222); + +var msg18260 = msg("16071", dup198); + +var msg18261 = msg("16072", dup222); + +var msg18262 = msg("16073", dup197); + +var msg18263 = msg("16074", dup196); + +var msg18264 = msg("16075", dup196); + +var msg18265 = msg("16076", dup201); + +var msg18266 = msg("16077", dup201); + +var msg18267 = msg("16078", dup196); + +var msg18268 = msg("16079", dup267); + +var msg18269 = msg("16080", dup196); + +var msg18270 = msg("16081", dup201); + +var msg18271 = msg("16082", dup252); + +var msg18272 = msg("16083", dup287); + +var msg18273 = msg("16084", dup258); + +var msg18274 = msg("16085", dup201); + +var msg18275 = msg("16086", dup252); + +var msg18276 = msg("16087", dup263); + +var msg18277 = msg("16089", dup222); + +var msg18278 = msg("16090", dup267); + +var msg18279 = msg("16091", dup198); + +var msg18280 = msg("16092", dup192); + +var msg18281 = msg("16093", dup192); + +var msg18282 = msg("16094", dup192); + +var msg18283 = msg("16095", dup192); + +var msg18284 = msg("16096", dup192); + +var msg18285 = msg("16097", dup192); + +var msg18286 = msg("16098", dup192); + +var msg18287 = msg("16099", dup192); + +var msg18288 = msg("16100", dup192); + +var msg18289 = msg("16101", dup192); + +var msg18290 = msg("16102", dup192); + +var msg18291 = msg("16103", dup192); + +var msg18292 = msg("16104", dup192); + +var msg18293 = msg("16105", dup192); + +var msg18294 = msg("16106", dup192); + +var msg18295 = msg("16107", dup192); + +var msg18296 = msg("16108", dup192); + +var msg18297 = msg("16109", dup192); + +var msg18298 = msg("16110", dup192); + +var msg18299 = msg("16111", dup192); + +var msg18300 = msg("16112", dup192); + +var msg18301 = msg("16113", dup192); + +var msg18302 = msg("16114", dup303); + +var msg18303 = msg("16115", dup303); + +var msg18304 = msg("16116", dup303); + +var msg18305 = msg("16117", dup303); + +var msg18306 = msg("16118", dup303); + +var msg18307 = msg("16119", dup303); + +var msg18308 = msg("16120", dup303); + +var msg18309 = msg("16121", dup303); + +var msg18310 = msg("16122", dup303); + +var msg18311 = msg("16123", dup303); + +var msg18312 = msg("16124", dup192); + +var msg18313 = msg("16125", dup303); + +var msg18314 = msg("16126", dup303); + +var msg18315 = msg("16127", dup303); + +var msg18316 = msg("16128", dup303); + +var msg18317 = msg("16129", dup303); + +var msg18318 = msg("16130", dup303); + +var msg18319 = msg("16131", dup192); + +var msg18320 = msg("16132", dup303); + +var msg18321 = msg("16133", dup303); + +var msg18322 = msg("16134", dup303); + +var msg18323 = msg("16135", dup303); + +var msg18324 = msg("16136", dup303); + +var msg18325 = msg("16137", dup303); + +var msg18326 = msg("16138", dup303); + +var msg18327 = msg("16139", dup192); + +var msg18328 = msg("16140", dup192); + +var msg18329 = msg("16141", dup192); + +var msg18330 = msg("16142", dup196); + +var msg18331 = msg("16143", dup196); + +var msg18332 = msg("16144", dup196); + +var msg18333 = msg("16145", dup222); + +var msg18334 = msg("16146", dup311); + +var msg18335 = msg("16147", dup198); + +var msg18336 = msg("16148", dup196); + +var msg18337 = msg("16149", dup196); + +var msg18338 = msg("16150", dup196); + +var msg18339 = msg("16151", dup265); + +var msg18340 = msg("16152", dup196); + +var msg18341 = msg("16153", dup196); + +var msg18342 = msg("16154", dup196); + +var msg18343 = msg("16155", dup196); + +var msg18344 = msg("16156", dup196); + +var msg18345 = msg("16157", dup196); + +var msg18346 = msg("16158", dup196); + +var msg18347 = msg("16159", dup240); + +var msg18348 = msg("16160", dup240); + +var msg18349 = msg("16161", dup240); + +var msg18350 = msg("16162", dup240); + +var msg18351 = msg("16163", dup240); + +var msg18352 = msg("16164", dup240); + +var msg18353 = msg("16165", dup240); + +var msg18354 = msg("16166", dup240); + +var msg18355 = msg("16167", dup240); + +var msg18356 = msg("16168", dup198); + +var msg18357 = msg("16169", dup265); + +var msg18358 = msg("16170", dup267); + +var msg18359 = msg("16171", dup267); + +var msg18360 = msg("16172", dup196); + +var msg18361 = msg("16173", dup196); + +var msg18362 = msg("16174", dup196); + +var msg18363 = msg("16175", dup198); + +var msg18364 = msg("16176", dup196); + +var msg18365 = msg("16177", dup196); + +var msg18366 = msg("16178", dup196); + +var msg18367 = msg("16179", dup287); + +var msg18368 = msg("16180", dup265); + +var msg18369 = msg("16181", dup267); + +var msg18370 = msg("16182", dup196); + +var msg18371 = msg("16183", dup196); + +var msg18372 = msg("16184", dup222); + +var msg18373 = msg("16185", dup196); + +var msg18374 = msg("16186", dup267); + +var msg18375 = msg("16187", dup269); + +var msg18376 = msg("16188", dup265); + +var msg18377 = msg("16189", dup260); + +var msg18378 = msg("16190", dup196); + +var msg18379 = msg("16191", dup285); + +var msg18380 = msg("16192", dup285); + +var msg18381 = msg("16193", dup222); + +var msg18382 = msg("16194", dup267); + +var msg18383 = msg("16195", dup267); + +var msg18384 = msg("16196", dup273); + +var msg18385 = msg("16197", dup198); + +var msg18386 = msg("16198", dup260); + +var msg18387 = msg("16199", dup198); + +var msg18388 = msg("16200", dup196); + +var msg18389 = msg("16201", dup201); + +var msg18390 = msg("16202", dup198); + +var msg18391 = msg("16203", dup198); + +var msg18392 = msg("16204", dup267); + +var msg18393 = msg("16205", dup265); + +var msg18394 = msg("16206", dup196); + +var msg18395 = msg("16207", dup267); + +var msg18396 = msg("16208", dup260); + +var msg18397 = msg("16209", dup198); + +var msg18398 = msg("16210", dup198); + +var msg18399 = msg("16211", dup198); + +var msg18400 = msg("16212", dup198); + +var msg18401 = msg("16213", dup267); + +var msg18402 = msg("16214", dup198); + +var msg18403 = msg("16215", dup287); + +var msg18404 = msg("16216", dup265); + +var msg18405 = msg("16217", dup197); + +var msg18406 = msg("16218", dup265); + +var msg18407 = msg("16219", dup196); + +var msg18408 = msg("16220", dup265); + +var msg18409 = msg("16221", dup198); + +var msg18410 = msg("16222", dup269); + +var msg18411 = msg("16223", dup265); + +var msg18412 = msg("16224", dup265); + +var msg18413 = msg("16225", dup196); + +var msg18414 = msg("16226", dup196); + +var msg18415 = msg("16227", dup265); + +var msg18416 = msg("16228", dup269); + +var msg18417 = msg("16229", dup265); + +var msg18418 = msg("16230", dup265); + +var msg18419 = msg("16231", dup267); + +var msg18420 = msg("16232", dup267); + +var msg18421 = msg("16233", dup267); + +var msg18422 = msg("16234", dup267); + +var msg18423 = msg("16235", dup196); + +var msg18424 = msg("16236", dup196); + +var msg18425 = msg("16237", dup198); + +var msg18426 = msg("16238", dup201); + +var msg18427 = msg("16239", dup201); + +var msg18428 = msg("16240", dup196); + +var msg18429 = msg("16241", dup267); + +var msg18430 = msg("16242", dup192); + +var msg18431 = msg("16243", dup192); + +var msg18432 = msg("16244", dup192); + +var msg18433 = msg("16245", dup192); + +var msg18434 = msg("16246", dup192); + +var msg18435 = msg("16247", dup192); + +var msg18436 = msg("16248", dup192); + +var msg18437 = msg("16249", dup192); + +var msg18438 = msg("16250", dup192); + +var msg18439 = msg("16251", dup192); + +var msg18440 = msg("16252", dup192); + +var msg18441 = msg("16253", dup192); + +var msg18442 = msg("16254", dup192); + +var msg18443 = msg("16255", dup192); + +var msg18444 = msg("16256", dup192); + +var msg18445 = msg("16257", dup192); + +var msg18446 = msg("16258", dup192); + +var msg18447 = msg("16259", dup192); + +var msg18448 = msg("16260", dup192); + +var msg18449 = msg("16261", dup192); + +var msg18450 = msg("16262", dup192); + +var msg18451 = msg("16263", dup192); + +var msg18452 = msg("16264", dup192); + +var msg18453 = msg("16265", dup192); + +var msg18454 = msg("16266", dup192); + +var msg18455 = msg("16267", dup192); + +var msg18456 = msg("16268", dup192); + +var msg18457 = msg("16269", dup192); + +var msg18458 = msg("16270", dup192); + +var msg18459 = msg("16271", dup192); + +var msg18460 = msg("16272", dup192); + +var msg18461 = msg("16273", dup192); + +var msg18462 = msg("16274", dup192); + +var msg18463 = msg("16275", dup192); + +var msg18464 = msg("16276", dup303); + +var msg18465 = msg("16277", dup303); + +var msg18466 = msg("16278", dup303); + +var msg18467 = msg("16279", dup192); + +var msg18468 = msg("16280", dup192); + +var msg18469 = msg("16281", dup196); + +var msg18470 = msg("16282", dup196); + +var msg18471 = msg("16283", dup267); + +var msg18472 = msg("16284", dup196); + +var msg18473 = msg("16285", dup222); + +var msg18474 = msg("16286", dup265); + +var msg18475 = msg("16287", dup198); + +var msg18476 = msg("16288", dup222); + +var msg18477 = msg("16289", dup192); + +var msg18478 = msg("16290", dup260); + +var msg18479 = msg("16291", dup267); + +var msg18480 = msg("16292", dup222); + +var msg18481 = msg("16293", dup265); + +var msg18482 = msg("16294", dup201); + +var msg18483 = msg("16295", dup194); + +var msg18484 = msg("16296", dup194); + +var msg18485 = msg("16297", dup196); + +var msg18486 = msg("16298", dup196); + +var msg18487 = msg("16299", dup196); + +var msg18488 = msg("16300", dup265); + +var msg18489 = msg("16301", dup265); + +var msg18490 = msg("16302", dup196); + +var msg18491 = msg("16303", dup196); + +var msg18492 = msg("16304", dup196); + +var msg18493 = msg("16305", dup265); + +var msg18494 = msg("16306", dup265); + +var msg18495 = msg("16307", dup265); + +var msg18496 = msg("16308", dup265); + +var msg18497 = msg("16309", dup222); + +var msg18498 = msg("16310", dup269); + +var msg18499 = msg("16311", dup269); + +var msg18500 = msg("16312", dup269); + +var msg18501 = msg("16313", dup196); + +var msg18502 = msg("16314", dup222); + +var msg18503 = msg("16315", dup265); + +var msg18504 = msg("16316", dup265); + +var msg18505 = msg("16317", dup196); + +var msg18506 = msg("16318", dup265); + +var msg18507 = msg("16319", dup265); + +var msg18508 = msg("16320", dup267); + +var msg18509 = msg("16321", dup265); + +var msg18510 = msg("16322", dup265); + +var msg18511 = msg("16323", dup196); + +var msg18512 = msg("16324", dup265); + +var msg18513 = msg("16325", dup196); + +var msg18514 = msg("16326", dup196); + +var msg18515 = msg("16327", dup201); + +var msg18516 = msg("16328", dup196); + +var msg18517 = msg("16329", dup285); + +var msg18518 = msg("16330", dup265); + +var msg18519 = msg("16331", dup267); + +var msg18520 = msg("16332", dup269); + +var msg18521 = msg("16333", dup265); + +var msg18522 = msg("16334", dup196); + +var msg18523 = msg("16335", dup197); + +var msg18524 = msg("16336", dup267); + +var msg18525 = msg("16337", dup196); + +var msg18526 = msg("16338", dup265); + +var msg18527 = msg("16339", dup265); + +var msg18528 = msg("16340", dup196); + +var msg18529 = msg("16341", dup198); + +var msg18530 = msg("16342", dup265); + +var msg18531 = msg("16343", dup196); + +var msg18532 = msg("16344", dup287); + +var msg18533 = msg("16345", dup267); + +var msg18534 = msg("16346", dup267); + +var msg18535 = msg("16347", dup196); + +var msg18536 = msg("16348", dup198); + +var msg18537 = msg("16349", dup198); + +var msg18538 = msg("16350", dup198); + +var msg18539 = msg("16351", dup201); + +var all51 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + setc("eventcategory","1001020302"), + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg18540 = msg("16352", all51); + +var msg18541 = msg("16353", dup265); + +var msg18542 = msg("16354", dup197); + +var msg18543 = msg("16355", dup267); + +var msg18544 = msg("16356", dup201); + +var msg18545 = msg("16357", dup201); + +var msg18546 = msg("16358", dup192); + +var msg18547 = msg("16359", dup267); + +var msg18548 = msg("16360", dup265); + +var msg18549 = msg("16361", dup267); + +var msg18550 = msg("16362", dup196); + +var msg18551 = msg("16363", dup227); + +var msg18552 = msg("16364", dup198); + +var msg18553 = msg("16365", dup192); + +var msg18554 = msg("16366", dup222); + +var msg18555 = msg("16367", dup265); + +var msg18556 = msg("16368", dup196); + +var msg18557 = msg("16369", dup196); + +var msg18558 = msg("16370", dup265); + +var msg18559 = msg("16371", dup265); + +var msg18560 = msg("16372", dup265); + +var msg18561 = msg("16373", dup267); + +var msg18562 = msg("16374", dup196); + +var msg18563 = msg("16375", dup222); + +var msg18564 = msg("16376", dup196); + +var msg18565 = msg("16377", dup196); + +var msg18566 = msg("16378", dup267); + +var msg18567 = msg("16379", dup265); + +var msg18568 = msg("16380", dup265); + +var msg18569 = msg("16381", dup246); + +var msg18570 = msg("16382", dup265); + +var msg18571 = msg("16383", dup196); + +var msg18572 = msg("16384", dup198); + +var msg18573 = msg("16385", dup260); + +var msg18574 = msg("16386", dup265); + +var msg18575 = msg("16387", dup265); + +var msg18576 = msg("16388", dup265); + +var msg18577 = msg("16389", dup265); + +var msg18578 = msg("16390", dup196); + +var msg18579 = msg("16391", dup192); + +var msg18580 = msg("16392", dup273); + +var msg18581 = msg("16393", dup197); + +var msg18582 = msg("16394", dup198); + +var msg18583 = msg("16395", dup276); + +var msg18584 = msg("16396", dup276); + +var msg18585 = msg("16397", dup246); + +var msg18586 = msg("16398", dup246); + +var msg18587 = msg("16399", dup246); + +var msg18588 = msg("16400", dup246); + +var msg18589 = msg("16401", dup246); + +var msg18590 = msg("16402", dup246); + +var msg18591 = msg("16403", dup246); + +var msg18592 = msg("16404", dup246); + +var msg18593 = msg("16405", dup201); + +var msg18594 = msg("16406", dup265); + +var msg18595 = msg("16407", dup265); + +var msg18596 = msg("16408", dup198); + +var msg18597 = msg("16409", dup267); + +var msg18598 = msg("16410", dup265); + +var msg18599 = msg("16411", dup267); + +var msg18600 = msg("16412", dup267); + +var msg18601 = msg("16413", dup267); + +var msg18602 = msg("16414", dup267); + +var msg18603 = msg("16415", dup265); + +var msg18604 = msg("16416", dup196); + +var msg18605 = msg("16417", dup276); + +var msg18606 = msg("16418", dup276); + +var msg18607 = msg("16419", dup265); + +var msg18608 = msg("16420", dup265); + +var msg18609 = msg("16421", dup196); + +var msg18610 = msg("16422", dup196); + +var msg18611 = msg("16423", dup267); + +var msg18612 = msg("16424", dup265); + +var msg18613 = msg("16425", dup267); + +var msg18614 = msg("16426", dup267); + +var msg18615 = msg("16427", dup267); + +var msg18616 = msg("16428", dup222); + +var msg18617 = msg("16429", dup267); + +var msg18618 = msg("16430", dup267); + +var msg18619 = msg("16431", dup260); + +var msg18620 = msg("16432", dup265); + +var msg18621 = msg("16433", dup198); + +var msg18622 = msg("16434", dup196); + +var msg18623 = msg("16435", dup196); + +var msg18624 = msg("16436", dup196); + +var msg18625 = msg("16437", dup222); + +var msg18626 = msg("16438", dup269); + +var msg18627 = msg("16439", dup196); + +var msg18628 = msg("16440", dup196); + +var msg18629 = msg("16441", dup196); + +var msg18630 = msg("16442", dup196); + +var msg18631 = msg("16443", dup196); + +var msg18632 = msg("16444", dup196); + +var msg18633 = msg("16445", dup198); + +var msg18634 = msg("16446", dup287); + +var msg18635 = msg("16447", dup258); + +var msg18636 = msg("16448", dup201); + +var msg18637 = msg("16449", dup252); + +var msg18638 = msg("16450", dup260); + +var msg18639 = msg("16451", dup198); + +var msg18640 = msg("16452", dup265); + +var msg18641 = msg("16453", dup198); + +var msg18642 = msg("16454", dup198); + +var msg18643 = msg("16455", dup303); + +var msg18644 = msg("16456", dup303); + +var msg18645 = msg("16457", dup192); + +var msg18646 = msg("16458", dup267); + +var msg18647 = msg("16459", dup192); + +var msg18648 = msg("16460", dup297); + +var msg18649 = msg("16461", dup196); + +var msg18650 = msg("16462", dup196); + +var msg18651 = msg("16463", dup196); + +var msg18652 = msg("16464", dup267); + +var msg18653 = msg("16465", dup267); + +var msg18654 = msg("16466", dup196); + +var msg18655 = msg("16467", dup196); + +var msg18656 = msg("16468", dup196); + +var msg18657 = msg("16469", dup305); + +var msg18658 = msg("16470", dup267); + +var msg18659 = msg("16471", dup267); + +var msg18660 = msg("16472", dup267); + +var msg18661 = msg("16473", dup265); + +var msg18662 = msg("16474", dup196); + +var msg18663 = msg("16475", dup196); + +var msg18664 = msg("16476", dup265); + +var msg18665 = msg("16477", dup265); + +var msg18666 = msg("16478", dup265); + +var msg18667 = msg("16479", dup196); + +var msg18668 = msg("16480", dup196); + +var msg18669 = msg("16481", dup267); + +var msg18670 = msg("16482", dup310); + +var msg18671 = msg("16483", dup238); + +var msg18672 = msg("16484", dup196); + +var msg18673 = msg("16485", dup196); + +var msg18674 = msg("16486", dup192); + +var msg18675 = msg("16487", dup192); + +var msg18676 = msg("16488", dup192); + +var msg18677 = msg("16489", dup303); + +var msg18678 = msg("16490", dup196); + +var msg18679 = msg("16492", dup196); + +var msg18680 = msg("16493", dup196); + +var msg18681 = msg("16494", dup196); + +var msg18682 = msg("16495", dup196); + +var msg18683 = msg("16496", dup196); + +var msg18684 = msg("16497", dup196); + +var msg18685 = msg("16498", dup196); + +var msg18686 = msg("16499", dup196); + +var msg18687 = msg("16500", dup196); + +var msg18688 = msg("16501", dup196); + +var msg18689 = msg("16502", dup196); + +var msg18690 = msg("16503", dup267); + +var msg18691 = msg("16504", dup267); + +var msg18692 = msg("16505", dup267); + +var msg18693 = msg("16506", dup267); + +var msg18694 = msg("16507", dup267); + +var msg18695 = msg("16508", dup267); + +var msg18696 = msg("16509", dup267); + +var msg18697 = msg("16510", dup197); + +var msg18698 = msg("16511", dup197); + +var msg18699 = msg("16512", dup267); + +var msg18700 = msg("16513", dup196); + +var msg18701 = msg("16514", dup196); + +var msg18702 = msg("16515", dup196); + +var msg18703 = msg("16516", dup196); + +var msg18704 = msg("16517", dup196); + +var msg18705 = msg("16518", dup196); + +var msg18706 = msg("16519", dup196); + +var msg18707 = msg("16520", dup196); + +var msg18708 = msg("16521", dup196); + +var msg18709 = msg("16522", dup196); + +var msg18710 = msg("16523", dup196); + +var msg18711 = msg("16524", dup196); + +var msg18712 = msg("16525", dup196); + +var msg18713 = msg("16526", dup196); + +var msg18714 = msg("16527", dup196); + +var msg18715 = msg("16528", dup196); + +var msg18716 = msg("16529", dup196); + +var msg18717 = msg("16530", dup265); + +var msg18718 = msg("16531", dup276); + +var msg18719 = msg("16532", dup276); + +var msg18720 = msg("16533", dup267); + +var msg18721 = msg("16534", dup250); + +var msg18722 = msg("16535", dup267); + +var msg18723 = msg("16536", dup267); + +var msg18724 = msg("16537", dup267); + +var msg18725 = msg("16538", dup196); + +var msg18726 = msg("16539", dup197); + +var msg18727 = msg("16540", dup276); + +var msg18728 = msg("16541", dup197); + +var msg18729 = msg("16542", dup197); + +var msg18730 = msg("16543", dup267); + +var msg18731 = msg("16544", dup311); + +var msg18732 = msg("16545", dup267); + +var msg18733 = msg("16546", dup197); + +var msg18734 = msg("16547", dup196); + +var msg18735 = msg("16548", dup196); + +var msg18736 = msg("16549", dup196); + +var msg18737 = msg("16550", dup196); + +var msg18738 = msg("16551", dup196); + +var msg18739 = msg("16552", dup196); + +var msg18740 = msg("16553", dup267); + +var msg18741 = msg("16554", dup196); + +var msg18742 = msg("16555", dup196); + +var msg18743 = msg("16556", dup196); + +var msg18744 = msg("16557", dup196); + +var msg18745 = msg("16558", dup196); + +var msg18746 = msg("16559", dup309); + +var msg18747 = msg("16560", dup265); + +var msg18748 = msg("16561", dup267); + +var msg18749 = msg("16562", dup267); + +var msg18750 = msg("16563", dup267); + +var msg18751 = msg("16564", dup267); + +var msg18752 = msg("16565", dup265); + +var msg18753 = msg("16566", dup265); + +var msg18754 = msg("16567", dup265); + +var msg18755 = msg("16568", dup265); + +var msg18756 = msg("16569", dup265); + +var msg18757 = msg("16570", dup265); + +var msg18758 = msg("16571", dup265); + +var msg18759 = msg("16572", dup265); + +var msg18760 = msg("16573", dup196); + +var msg18761 = msg("16574", dup196); + +var msg18762 = msg("16575", dup222); + +var msg18763 = msg("16576", dup222); + +var msg18764 = msg("16577", dup276); + +var msg18765 = msg("16578", dup222); + +var msg18766 = msg("16579", dup222); + +var msg18767 = msg("16580", dup202); + +var msg18768 = msg("16581", dup202); + +var msg18769 = msg("16582", dup267); + +var msg18770 = msg("16583", dup267); + +var msg18771 = msg("16584", dup267); + +var msg18772 = msg("16585", dup267); + +var msg18773 = msg("16586", dup267); + +var msg18774 = msg("16587", dup201); + +var msg18775 = msg("16588", dup196); + +var msg18776 = msg("16589", dup222); + +var msg18777 = msg("16590", dup196); + +var msg18778 = msg("16591", dup196); + +var msg18779 = msg("16592", dup196); + +var msg18780 = msg("16593", dup267); + +var msg18781 = msg("16594", dup298); + +var msg18782 = msg("16595", dup267); + +var msg18783 = msg("16596", dup267); + +var msg18784 = msg("16597", dup222); + +var msg18785 = msg("16598", dup197); + +var msg18786 = msg("16599", dup222); + +var msg18787 = msg("16600", dup192); + +var msg18788 = msg("16601", dup267); + +var msg18789 = msg("16602", dup196); + +var msg18790 = msg("16603", dup197); + +var msg18791 = msg("16604", dup267); + +var msg18792 = msg("16605", dup267); + +var msg18793 = msg("16606", dup222); + +var msg18794 = msg("16607", dup196); + +var msg18795 = msg("16608", dup197); + +var msg18796 = msg("16609", dup197); + +var msg18797 = msg("16610", dup222); + +var msg18798 = msg("16611", dup267); + +var msg18799 = msg("16612", dup267); + +var msg18800 = msg("16613", dup192); + +var msg18801 = msg("16614", dup192); + +var msg18802 = msg("16615", dup192); + +var msg18803 = msg("16616", dup192); + +var msg18804 = msg("16617", dup192); + +var msg18805 = msg("16618", dup192); + +var msg18806 = msg("16619", dup192); + +var msg18807 = msg("16620", dup192); + +var msg18808 = msg("16621", dup192); + +var msg18809 = msg("16622", dup192); + +var msg18810 = msg("16623", dup192); + +var msg18811 = msg("16624", dup192); + +var msg18812 = msg("16625", dup192); + +var msg18813 = msg("16626", dup192); + +var msg18814 = msg("16627", dup192); + +var msg18815 = msg("16628", dup192); + +var msg18816 = msg("16629", dup196); + +var msg18817 = msg("16630", dup196); + +var msg18818 = msg("16631", dup196); + +var msg18819 = msg("16632", dup196); + +var msg18820 = msg("16633", dup267); + +var msg18821 = msg("16634", dup267); + +var msg18822 = msg("16635", dup265); + +var msg18823 = msg("16636", dup196); + +var msg18824 = msg("16637", dup196); + +var msg18825 = msg("16638", dup267); + +var msg18826 = msg("16639", dup267); + +var msg18827 = msg("16640", dup267); + +var msg18828 = msg("16641", dup267); + +var msg18829 = msg("16642", dup196); + +var msg18830 = msg("16643", dup267); + +var msg18831 = msg("16644", dup196); + +var msg18832 = msg("16645", dup196); + +var msg18833 = msg("16646", dup222); + +var msg18834 = msg("16647", dup267); + +var msg18835 = msg("16648", dup196); + +var msg18836 = msg("16649", dup267); + +var msg18837 = msg("16650", dup267); + +var msg18838 = msg("16651", dup267); + +var msg18839 = msg("16652", dup267); + +var msg18840 = msg("16653", dup267); + +var msg18841 = msg("16654", dup267); + +var msg18842 = msg("16655", dup267); + +var msg18843 = msg("16656", dup267); + +var msg18844 = msg("16657", dup267); + +var msg18845 = msg("16658", dup267); + +var msg18846 = msg("16659", dup196); + +var msg18847 = msg("16660", dup198); + +var msg18848 = msg("16661", dup196); + +var msg18849 = msg("16662", dup267); + +var msg18850 = msg("16663", dup267); + +var msg18851 = msg("16664", dup196); + +var msg18852 = msg("16665", dup265); + +var msg18853 = msg("16666", dup196); + +var msg18854 = msg("16667", dup196); + +var msg18855 = msg("16668", dup202); + +var msg18856 = msg("16669", dup303); + +var msg18857 = msg("16670", dup303); + +var msg18858 = msg("16671", dup267); + +var msg18859 = msg("16672", dup197); + +var msg18860 = msg("16673", dup267); + +var msg18861 = msg("16674", dup267); + +var msg18862 = msg("16675", dup196); + +var msg18863 = msg("16676", dup196); + +var msg18864 = msg("16677", dup196); + +var msg18865 = msg("16678", dup265); + +var msg18866 = msg("16679", dup201); + +var msg18867 = msg("16680", dup196); + +var msg18868 = msg("16681", dup267); + +var msg18869 = msg("16682", dup265); + +var msg18870 = msg("16683", dup267); + +var msg18871 = msg("16684", dup198); + +var msg18872 = msg("16685", dup222); + +var msg18873 = msg("16686", dup267); + +var msg18874 = msg("16687", dup201); + +var msg18875 = msg("16688", dup196); + +var msg18876 = msg("16689", dup265); + +var msg18877 = msg("16690", dup196); + +var msg18878 = msg("16691", dup265); + +var msg18879 = msg("16692", dup197); + +var msg18880 = msg("16693", dup303); + +var msg18881 = msg("16694", dup198); + +var msg18882 = msg("16695", dup303); + +var msg18883 = msg("16696", dup197); + +var msg18884 = msg("16697", dup198); + +var msg18885 = msg("16698", dup198); + +var msg18886 = msg("16699", dup257); + +var msg18887 = msg("16700", dup257); + +var msg18888 = msg("16701", dup257); + +var msg18889 = msg("16702", dup257); + +var msg18890 = msg("16703", dup260); + +var msg18891 = msg("16704", dup197); + +var msg18892 = msg("16705", dup222); + +var msg18893 = msg("16706", dup201); + +var msg18894 = msg("16707", dup260); + +var msg18895 = msg("16708", dup260); + +var msg18896 = msg("16709", dup198); + +var msg18897 = msg("16710", dup287); + +var msg18898 = msg("16711", dup201); + +var msg18899 = msg("16712", dup267); + +var msg18900 = msg("16713", dup267); + +var msg18901 = msg("16714", dup222); + +var msg18902 = msg("16715", dup267); + +var msg18903 = msg("16716", dup197); + +var msg18904 = msg("16717", dup287); + +var msg18905 = msg("16718", dup196); + +var msg18906 = msg("16719", dup201); + +var msg18907 = msg("16720", dup197); + +var msg18908 = msg("16721", dup197); + +var msg18909 = msg("16722", dup260); + +var msg18910 = msg("16723", dup260); + +var msg18911 = msg("16724", dup222); + +var msg18912 = msg("16725", dup197); + +var msg18913 = msg("16726", dup197); + +var msg18914 = msg("16727", dup201); + +var msg18915 = msg("16728", dup276); + +var msg18916 = msg("16729", dup197); + +var msg18917 = msg("16730", dup197); + +var msg18918 = msg("16731", dup197); + +var msg18919 = msg("16732", dup201); + +var msg18920 = msg("16733", dup197); + +var msg18921 = msg("16734", dup197); + +var msg18922 = msg("16735", dup222); + +var msg18923 = msg("16736", dup201); + +var msg18924 = msg("16737", dup197); + +var msg18925 = msg("16738", dup197); + +var msg18926 = msg("16739", dup201); + +var msg18927 = msg("16740", dup267); + +var msg18928 = msg("16741", dup267); + +var msg18929 = msg("16742", dup265); + +var msg18930 = msg("16743", dup197); + +var msg18931 = msg("16744", dup199); + +var msg18932 = msg("16745", dup197); + +var msg18933 = msg("16746", dup265); + +var msg18934 = msg("16747", dup265); + +var msg18935 = msg("16748", dup265); + +var msg18936 = msg("16749", dup265); + +var msg18937 = msg("16750", dup197); + +var msg18938 = msg("16751", dup197); + +var msg18939 = msg("16752", dup197); + +var msg18940 = msg("16753", dup197); + +var msg18941 = msg("16754", dup276); + +var msg18942 = msg("16755", dup276); + +var msg18943 = msg("16756", dup276); + +var msg18944 = msg("16757", dup276); + +var msg18945 = msg("16758", dup276); + +var msg18946 = msg("16759", dup276); + +var msg18947 = msg("16760", dup276); + +var msg18948 = msg("16761", dup276); + +var msg18949 = msg("16762", dup197); + +var msg18950 = msg("16763", dup197); + +var msg18951 = msg("16764", dup197); + +var msg18952 = msg("16765", dup197); + +var msg18953 = msg("16766", dup197); + +var msg18954 = msg("16767", dup265); + +var msg18955 = msg("16768", dup265); + +var msg18956 = msg("16769", dup265); + +var msg18957 = msg("16770", dup265); + +var msg18958 = msg("16771", dup197); + +var msg18959 = msg("16772", dup265); + +var msg18960 = msg("16773", dup265); + +var msg18961 = msg("16774", dup265); + +var msg18962 = msg("16775", dup265); + +var msg18963 = msg("16776", dup201); + +var msg18964 = msg("16777", dup198); + +var msg18965 = msg("16778", dup198); + +var msg18966 = msg("16779", dup265); + +var msg18967 = msg("16780", dup265); + +var msg18968 = msg("16781", dup265); + +var msg18969 = msg("16782", dup265); + +var msg18970 = msg("16783", dup265); + +var msg18971 = msg("16784", dup265); + +var msg18972 = msg("16785", dup267); + +var msg18973 = msg("16786", dup197); + +var msg18974 = msg("16787", dup201); + +var msg18975 = msg("16788", dup267); + +var msg18976 = msg("16789", dup267); + +var msg18977 = msg("16790", dup267); + +var msg18978 = msg("16791", dup265); + +var msg18979 = msg("16792", dup265); + +var msg18980 = msg("16793", dup265); + +var msg18981 = msg("16794", dup265); + +var msg18982 = msg("16795", dup227); + +var msg18983 = msg("16796", dup255); + +var msg18984 = msg("16797", dup201); + +var msg18985 = msg("16798", dup197); + +var msg18986 = msg("16799", dup197); + +var msg18987 = msg("16800", dup197); + +var msg18988 = msg("16801", dup267); + +var msg18989 = msg("16802", dup265); + +var msg18990 = msg("16803", dup265); + +var msg18991 = msg("16804", dup192); + +var msg18992 = msg("16805", dup192); + +var msg18993 = msg("16806", dup227); + +var msg18994 = msg("16807", dup227); + +var msg18995 = msg("16808", dup192); + +var msg18996 = msg("16809", dup202); + +var msg18997 = msg("16810", dup202); + +var msg18998 = msg("16811", dup202); + +var msg18999 = msg("16812", dup202); + +var msg19000 = msg("16813", dup202); + +var msg19001 = msg("16814", dup202); + +var msg19002 = msg("16815", dup202); + +var msg19003 = msg("16816", dup202); + +var msg19004 = msg("16817", dup202); + +var msg19005 = msg("16818", dup202); + +var msg19006 = msg("16819", dup202); + +var msg19007 = msg("16820", dup202); + +var msg19008 = msg("16821", dup202); + +var msg19009 = msg("16822", dup202); + +var msg19010 = msg("16823", dup202); + +var msg19011 = msg("16824", dup202); + +var msg19012 = msg("16825", dup202); + +var msg19013 = msg("16826", dup202); + +var msg19014 = msg("16827", dup202); + +var msg19015 = msg("16828", dup202); + +var msg19016 = msg("16829", dup202); + +var msg19017 = msg("16830", dup202); + +var msg19018 = msg("16831", dup202); + +var msg19019 = msg("16832", dup202); + +var msg19020 = msg("16833", dup202); + +var msg19021 = msg("16834", dup263); + +var msg19022 = msg("16835", dup263); + +var msg19023 = msg("16836", dup263); + +var msg19024 = msg("16837", dup263); + +var msg19025 = msg("16838", dup263); + +var msg19026 = msg("16839", dup263); + +var msg19027 = msg("16840", dup263); + +var msg19028 = msg("16841", dup263); + +var msg19029 = msg("16842", dup263); + +var msg19030 = msg("16843", dup263); + +var msg19031 = msg("16844", dup263); + +var msg19032 = msg("16845", dup263); + +var msg19033 = msg("16846", dup263); + +var msg19034 = msg("16847", dup263); + +var msg19035 = msg("16848", dup263); + +var msg19036 = msg("16849", dup263); + +var msg19037 = msg("16850", dup263); + +var msg19038 = msg("16851", dup263); + +var msg19039 = msg("16852", dup263); + +var msg19040 = msg("16853", dup263); + +var msg19041 = msg("16854", dup263); + +var msg19042 = msg("16855", dup263); + +var msg19043 = msg("16856", dup263); + +var msg19044 = msg("16857", dup263); + +var msg19045 = msg("16858", dup263); + +var msg19046 = msg("16859", dup263); + +var msg19047 = msg("16860", dup263); + +var msg19048 = msg("16861", dup263); + +var msg19049 = msg("16862", dup263); + +var msg19050 = msg("16863", dup263); + +var msg19051 = msg("16864", dup263); + +var msg19052 = msg("16865", dup263); + +var msg19053 = msg("16866", dup263); + +var msg19054 = msg("16867", dup263); + +var msg19055 = msg("16868", dup263); + +var msg19056 = msg("16869", dup263); + +var msg19057 = msg("16870", dup263); + +var msg19058 = msg("16871", dup263); + +var msg19059 = msg("16872", dup263); + +var msg19060 = msg("16873", dup263); + +var msg19061 = msg("16874", dup263); + +var msg19062 = msg("16875", dup263); + +var msg19063 = msg("16876", dup263); + +var msg19064 = msg("16877", dup263); + +var msg19065 = msg("16878", dup263); + +var msg19066 = msg("16879", dup263); + +var msg19067 = msg("16880", dup263); + +var msg19068 = msg("16881", dup263); + +var msg19069 = msg("16882", dup263); + +var msg19070 = msg("16883", dup263); + +var msg19071 = msg("16884", dup263); + +var msg19072 = msg("16885", dup263); + +var msg19073 = msg("16886", dup263); + +var msg19074 = msg("16887", dup263); + +var msg19075 = msg("16888", dup263); + +var msg19076 = msg("16889", dup263); + +var msg19077 = msg("16890", dup263); + +var msg19078 = msg("16891", dup263); + +var msg19079 = msg("16892", dup263); + +var msg19080 = msg("16893", dup263); + +var msg19081 = msg("16894", dup263); + +var msg19082 = msg("16895", dup263); + +var msg19083 = msg("16896", dup263); + +var msg19084 = msg("16897", dup263); + +var msg19085 = msg("16898", dup263); + +var msg19086 = msg("16899", dup263); + +var msg19087 = msg("16900", dup263); + +var msg19088 = msg("16901", dup263); + +var msg19089 = msg("16902", dup263); + +var msg19090 = msg("16903", dup263); + +var msg19091 = msg("16904", dup263); + +var msg19092 = msg("16905", dup263); + +var msg19093 = msg("16906", dup263); + +var msg19094 = msg("16907", dup263); + +var msg19095 = msg("16908", dup263); + +var msg19096 = msg("16909", dup263); + +var msg19097 = msg("16910", dup263); + +var msg19098 = msg("16911", dup269); + +var msg19099 = msg("16912", dup269); + +var msg19100 = msg("16913", dup269); + +var msg19101 = msg("16914", dup269); + +var msg19102 = msg("16915", dup269); + +var msg19103 = msg("16916", dup269); + +var msg19104 = msg("16917", dup269); + +var msg19105 = msg("16918", dup269); + +var msg19106 = msg("16919", dup269); + +var msg19107 = msg("16920", dup269); + +var msg19108 = msg("16921", dup269); + +var msg19109 = msg("16922", dup269); + +var msg19110 = msg("16923", dup269); + +var msg19111 = msg("16924", dup269); + +var msg19112 = msg("16925", dup269); + +var msg19113 = msg("16926", dup255); + +var msg19114 = msg("16927", dup269); + +var msg19115 = msg("16928", dup269); + +var msg19116 = msg("16929", dup269); + +var msg19117 = msg("16930", dup269); + +var msg19118 = msg("16931", dup269); + +var msg19119 = msg("16932", dup269); + +var msg19120 = msg("16933", dup269); + +var msg19121 = msg("16934", dup312); + +var msg19122 = msg("16935", dup312); + +var msg19123 = msg("16936", dup312); + +var msg19124 = msg("16937", dup312); + +var msg19125 = msg("16938", dup312); + +var msg19126 = msg("16939", dup312); + +var msg19127 = msg("16940", dup312); + +var msg19128 = msg("16941", dup312); + +var msg19129 = msg("16942", dup312); + +var msg19130 = msg("16943", dup312); + +var msg19131 = msg("16944", dup312); + +var msg19132 = msg("16945", dup312); + +var msg19133 = msg("16946", dup312); + +var msg19134 = msg("16947", dup312); + +var msg19135 = msg("16948", dup312); + +var msg19136 = msg("16949", dup312); + +var msg19137 = msg("16950", dup312); + +var msg19138 = msg("16951", dup312); + +var msg19139 = msg("16952", dup312); + +var msg19140 = msg("16953", dup312); + +var msg19141 = msg("16954", dup312); + +var msg19142 = msg("16955", dup312); + +var msg19143 = msg("16956", dup312); + +var msg19144 = msg("16957", dup312); + +var msg19145 = msg("16958", dup312); + +var msg19146 = msg("16959", dup312); + +var msg19147 = msg("16960", dup312); + +var msg19148 = msg("16961", dup312); + +var msg19149 = msg("16962", dup312); + +var msg19150 = msg("16963", dup312); + +var msg19151 = msg("16964", dup312); + +var msg19152 = msg("16965", dup312); + +var msg19153 = msg("16966", dup312); + +var msg19154 = msg("16967", dup312); + +var msg19155 = msg("16968", dup312); + +var msg19156 = msg("16969", dup312); + +var msg19157 = msg("16970", dup312); + +var msg19158 = msg("16971", dup312); + +var msg19159 = msg("16972", dup312); + +var msg19160 = msg("16973", dup312); + +var msg19161 = msg("16974", dup312); + +var msg19162 = msg("16975", dup312); + +var msg19163 = msg("16976", dup312); + +var msg19164 = msg("16977", dup312); + +var msg19165 = msg("16978", dup312); + +var msg19166 = msg("16979", dup312); + +var msg19167 = msg("16980", dup312); + +var msg19168 = msg("16981", dup312); + +var msg19169 = msg("16982", dup312); + +var msg19170 = msg("16983", dup312); + +var msg19171 = msg("16984", dup312); + +var msg19172 = msg("16985", dup312); + +var msg19173 = msg("16986", dup312); + +var msg19174 = msg("16987", dup312); + +var msg19175 = msg("16988", dup312); + +var msg19176 = msg("16989", dup312); + +var msg19177 = msg("16990", dup312); + +var msg19178 = msg("16991", dup312); + +var msg19179 = msg("16992", dup312); + +var msg19180 = msg("16993", dup312); + +var msg19181 = msg("16994", dup312); + +var msg19182 = msg("16995", dup312); + +var msg19183 = msg("16996", dup312); + +var msg19184 = msg("16997", dup312); + +var msg19185 = msg("16998", dup312); + +var msg19186 = msg("16999", dup312); + +var msg19187 = msg("17000", dup312); + +var msg19188 = msg("17001", dup312); + +var msg19189 = msg("17002", dup312); + +var msg19190 = msg("17003", dup312); + +var msg19191 = msg("17004", dup312); + +var msg19192 = msg("17005", dup312); + +var msg19193 = msg("17006", dup312); + +var msg19194 = msg("17007", dup312); + +var msg19195 = msg("17008", dup312); + +var msg19196 = msg("17009", dup312); + +var msg19197 = msg("17010", dup312); + +var msg19198 = msg("17011", dup312); + +var msg19199 = msg("17012", dup312); + +var msg19200 = msg("17013", dup312); + +var msg19201 = msg("17014", dup312); + +var msg19202 = msg("17015", dup312); + +var msg19203 = msg("17016", dup312); + +var msg19204 = msg("17017", dup312); + +var msg19205 = msg("17018", dup312); + +var msg19206 = msg("17019", dup312); + +var msg19207 = msg("17020", dup312); + +var msg19208 = msg("17021", dup312); + +var msg19209 = msg("17022", dup312); + +var msg19210 = msg("17023", dup312); + +var msg19211 = msg("17024", dup312); + +var msg19212 = msg("17025", dup312); + +var msg19213 = msg("17026", dup312); + +var msg19214 = msg("17027", dup312); + +var msg19215 = msg("17028", dup312); + +var msg19216 = msg("17029", dup312); + +var msg19217 = msg("17030", dup312); + +var msg19218 = msg("17031", dup312); + +var msg19219 = msg("17032", dup312); + +var msg19220 = msg("17033", dup312); + +var msg19221 = msg("17034", dup267); + +var msg19222 = msg("17035", dup267); + +var msg19223 = msg("17036", dup267); + +var msg19224 = msg("17037", dup267); + +var msg19225 = msg("17038", dup267); + +var msg19226 = msg("17039", dup267); + +var msg19227 = msg("17041", dup265); + +var msg19228 = msg("17042", dup265); + +var msg19229 = msg("17043", dup202); + +var msg19230 = msg("17044", dup240); + +var msg19231 = msg("17045", dup197); + +var msg19232 = msg("17046", dup197); + +var msg19233 = msg("17047", dup255); + +var msg19234 = msg("17048", dup201); + +var msg19235 = msg("17049", dup265); + +var msg19236 = msg("17050", dup265); + +var msg19237 = msg("17051", dup265); + +var msg19238 = msg("17052", dup265); + +var msg19239 = msg("17053", dup265); + +var msg19240 = msg("17054", dup265); + +var msg19241 = msg("17055", dup198); + +var msg19242 = msg("17056", dup201); + +var msg19243 = msg("17057", dup267); + +var msg19244 = msg("17058", dup287); + +var msg19245 = msg("17059", dup227); + +var msg19246 = msg("17060", dup197); + +var msg19247 = msg("17061", dup265); + +var msg19248 = msg("17062", dup265); + +var msg19249 = msg("17063", dup265); + +var msg19250 = msg("17064", dup265); + +var msg19251 = msg("17065", dup265); + +var msg19252 = msg("17066", dup265); + +var msg19253 = msg("17067", dup265); + +var msg19254 = msg("17068", dup265); + +var msg19255 = msg("17069", dup265); + +var msg19256 = msg("17070", dup265); + +var msg19257 = msg("17071", dup265); + +var msg19258 = msg("17072", dup265); + +var msg19259 = msg("17073", dup265); + +var msg19260 = msg("17074", dup265); + +var msg19261 = msg("17075", dup265); + +var msg19262 = msg("17076", dup265); + +var msg19263 = msg("17077", dup197); + +var msg19264 = msg("17078", dup265); + +var msg19265 = msg("17079", dup265); + +var msg19266 = msg("17080", dup265); + +var msg19267 = msg("17081", dup265); + +var msg19268 = msg("17082", dup265); + +var msg19269 = msg("17083", dup265); + +var msg19270 = msg("17084", dup265); + +var msg19271 = msg("17085", dup265); + +var msg19272 = msg("17086", dup197); + +var msg19273 = msg("17087", dup265); + +var msg19274 = msg("17088", dup265); + +var msg19275 = msg("17089", dup265); + +var msg19276 = msg("17090", dup265); + +var msg19277 = msg("17091", dup197); + +var msg19278 = msg("17092", dup265); + +var msg19279 = msg("17093", dup265); + +var msg19280 = msg("17094", dup265); + +var msg19281 = msg("17095", dup265); + +var msg19282 = msg("17096", dup265); + +var msg19283 = msg("17097", dup265); + +var msg19284 = msg("17098", dup197); + +var msg19285 = msg("17099", dup250); + +var msg19286 = msg("17100", dup250); + +var msg19287 = msg("17101", dup250); + +var msg19288 = msg("17102", dup250); + +var msg19289 = msg("17103", dup265); + +var msg19290 = msg("17104", dup197); + +var msg19291 = msg("17105", dup197); + +var msg19292 = msg("17106", dup269); + +var msg19293 = msg("17107", dup197); + +var msg19294 = msg("17108", dup197); + +var msg19295 = msg("17109", dup267); + +var msg19296 = msg("17110", dup202); + +var msg19297 = msg("17111", dup197); + +var msg19298 = msg("17112", dup255); + +var msg19299 = msg("17113", dup202); + +var msg19300 = msg("17114", dup267); + +var msg19301 = msg("17115", dup265); + +var msg19302 = msg("17116", dup265); + +var msg19303 = msg("17117", dup267); + +var msg19304 = msg("17118", dup267); + +var msg19305 = msg("17119", dup197); + +var msg19306 = msg("17120", dup267); + +var msg19307 = msg("17121", dup267); + +var msg19308 = msg("17122", dup267); + +var msg19309 = msg("17123", dup267); + +var msg19310 = msg("17124", dup267); + +var msg19311 = msg("17125", dup197); + +var msg19312 = msg("17126", dup202); + +var msg19313 = msg("17127", dup276); + +var msg19314 = msg("17128", dup267); + +var msg19315 = msg("17129", dup267); + +var msg19316 = msg("17130", dup267); + +var msg19317 = msg("17131", dup267); + +var msg19318 = msg("17132", dup267); + +var msg19319 = msg("17133", dup265); + +var msg19320 = msg("17134", dup197); + +var msg19321 = msg("17135", dup197); + +var msg19322 = msg("17136", dup267); + +var msg19323 = msg("17137", dup265); + +var msg19324 = msg("17138", dup201); + +var msg19325 = msg("17139", dup267); + +var msg19326 = msg("17140", dup197); + +var msg19327 = msg("17141", dup267); + +var msg19328 = msg("17142", dup201); + +var msg19329 = msg("17143", dup197); + +var msg19330 = msg("17144", dup197); + +var msg19331 = msg("17145", dup197); + +var msg19332 = msg("17146", dup197); + +var msg19333 = msg("17147", dup197); + +var msg19334 = msg("17148", dup201); + +var msg19335 = msg("17149", dup201); + +var msg19336 = msg("17150", dup201); + +var msg19337 = msg("17151", dup198); + +var msg19338 = msg("17152", dup198); + +var msg19339 = msg("17153", dup267); + +var msg19340 = msg("17154", dup267); + +var msg19341 = msg("17155", dup201); + +var msg19342 = msg("17156", dup267); + +var msg19343 = msg("17157", dup265); + +var msg19344 = msg("17158", dup265); + +var msg19345 = msg("17159", dup265); + +var msg19346 = msg("17160", dup197); + +var msg19347 = msg("17161", dup265); + +var msg19348 = msg("17162", dup265); + +var msg19349 = msg("17163", dup265); + +var msg19350 = msg("17164", dup265); + +var msg19351 = msg("17165", dup265); + +var msg19352 = msg("17166", dup201); + +var msg19353 = msg("17167", dup265); + +var msg19354 = msg("17168", dup265); + +var msg19355 = msg("17169", dup265); + +var msg19356 = msg("17170", dup265); + +var msg19357 = msg("17171", dup265); + +var msg19358 = msg("17172", dup265); + +var msg19359 = msg("17173", dup265); + +var msg19360 = msg("17174", dup265); + +var msg19361 = msg("17175", dup265); + +var msg19362 = msg("17176", dup265); + +var msg19363 = msg("17177", dup265); + +var msg19364 = msg("17178", dup265); + +var msg19365 = msg("17179", dup267); + +var msg19366 = msg("17180", dup267); + +var msg19367 = msg("17181", dup267); + +var msg19368 = msg("17182", dup267); + +var msg19369 = msg("17183", dup267); + +var msg19370 = msg("17184", dup267); + +var msg19371 = msg("17185", dup267); + +var msg19372 = msg("17186", dup267); + +var msg19373 = msg("17187", dup267); + +var msg19374 = msg("17188", dup267); + +var msg19375 = msg("17189", dup267); + +var msg19376 = msg("17190", dup267); + +var msg19377 = msg("17191", dup267); + +var msg19378 = msg("17192", dup267); + +var msg19379 = msg("17193", dup267); + +var msg19380 = msg("17194", dup267); + +var msg19381 = msg("17195", dup311); + +var msg19382 = msg("17196", dup267); + +var msg19383 = msg("17197", dup267); + +var msg19384 = msg("17198", dup267); + +var msg19385 = msg("17199", dup197); + +var msg19386 = msg("17200", dup197); + +var msg19387 = msg("17201", dup197); + +var msg19388 = msg("17202", dup197); + +var msg19389 = msg("17203", dup197); + +var msg19390 = msg("17204", dup197); + +var msg19391 = msg("17205", dup201); + +var msg19392 = msg("17206", dup201); + +var msg19393 = msg("17207", dup267); + +var msg19394 = msg("17208", dup267); + +var msg19395 = msg("17209", dup197); + +var msg19396 = msg("17210", dup267); + +var msg19397 = msg("17211", dup267); + +var msg19398 = msg("17212", dup201); + +var msg19399 = msg("17213", dup265); + +var msg19400 = msg("17214", dup197); + +var msg19401 = msg("17215", dup197); + +var msg19402 = msg("17216", dup267); + +var msg19403 = msg("17217", dup267); + +var msg19404 = msg("17218", dup267); + +var msg19405 = msg("17219", dup197); + +var msg19406 = msg("17220", dup197); + +var msg19407 = msg("17221", dup197); + +var msg19408 = msg("17222", dup197); + +var msg19409 = msg("17223", dup267); + +var msg19410 = msg("17224", dup250); + +var msg19411 = msg("17225", dup202); + +var msg19412 = msg("17226", dup202); + +var msg19413 = msg("17227", dup267); + +var msg19414 = msg("17228", dup267); + +var msg19415 = msg("17229", dup202); + +var msg19416 = msg("17230", dup202); + +var msg19417 = msg("17231", dup202); + +var msg19418 = msg("17232", dup202); + +var msg19419 = msg("17233", dup267); + +var msg19420 = msg("17234", dup238); + +var msg19421 = msg("17235", dup238); + +var msg19422 = msg("17236", dup267); + +var msg19423 = msg("17237", dup202); + +var msg19424 = msg("17238", dup197); + +var msg19425 = msg("17239", dup197); + +var msg19426 = msg("17240", dup197); + +var msg19427 = msg("17241", dup265); + +var msg19428 = msg("17242", dup267); + +var msg19429 = msg("17243", dup267); + +var msg19430 = msg("17244", dup197); + +var msg19431 = msg("17245", dup267); + +var msg19432 = msg("17246", dup287); + +var msg19433 = msg("17247", dup287); + +var msg19434 = msg("17248", dup287); + +var msg19435 = msg("17249", dup197); + +var msg19436 = msg("17250", dup197); + +var msg19437 = msg("17251", dup267); + +var msg19438 = msg("17252", dup276); + +var msg19439 = msg("17253", dup306); + +var msg19440 = msg("17254", dup265); + +var msg19441 = msg("17255", dup197); + +var msg19442 = msg("17256", dup267); + +var msg19443 = msg("17257", dup267); + +var msg19444 = msg("17258", dup267); + +var msg19445 = msg("17259", dup265); + +var msg19446 = msg("17260", dup201); + +var msg19447 = msg("17261", dup267); + +var msg19448 = msg("17262", dup267); + +var msg19449 = msg("17263", dup267); + +var msg19450 = msg("17264", dup267); + +var msg19451 = msg("17265", dup265); + +var msg19452 = msg("17266", dup287); + +var msg19453 = msg("17267", dup287); + +var msg19454 = msg("17268", dup267); + +var msg19455 = msg("17269", dup197); + +var msg19456 = msg("17270", dup260); + +var msg19457 = msg("17271", dup201); + +var msg19458 = msg("17272", dup197); + +var msg19459 = msg("17273", dup197); + +var msg19460 = msg("17274", dup197); + +var msg19461 = msg("17275", dup287); + +var msg19462 = msg("17276", dup287); + +var msg19463 = msg("17277", dup265); + +var msg19464 = msg("17278", dup265); + +var msg19465 = msg("17279", dup265); + +var msg19466 = msg("17280", dup265); + +var msg19467 = msg("17281", dup197); + +var msg19468 = msg("17282", dup197); + +var msg19469 = msg("17283", dup197); + +var msg19470 = msg("17284", dup201); + +var msg19471 = msg("17285", dup267); + +var msg19472 = msg("17286", dup197); + +var msg19473 = msg("17287", dup267); + +var msg19474 = msg("17288", dup197); + +var msg19475 = msg("17289", dup201); + +var msg19476 = msg("17290", dup202); + +var msg19477 = msg("17291", dup202); + +var msg19478 = msg("17292", dup267); + +var msg19479 = msg("17293", dup197); + +var msg19480 = msg("17294", dup197); + +var msg19481 = msg("17295", dup197); + +var msg19482 = msg("17296", dup265); + +var msg19483 = msg("17297", dup197); + +var msg19484 = msg("17298", dup197); + +var msg19485 = msg("17299", dup198); + +var msg19486 = msg("17300", dup197); + +var msg19487 = msg("17301", dup267); + +var msg19488 = msg("17302", dup198); + +var msg19489 = msg("17303", dup267); + +var msg19490 = msg("17304", dup197); + +var msg19491 = msg("17305", dup197); + +var msg19492 = msg("17306", dup198); + +var msg19493 = msg("17307", dup260); + +var msg19494 = msg("17308", dup267); + +var msg19495 = msg("17309", dup197); + +var msg19496 = msg("17310", dup267); + +var msg19497 = msg("17311", dup269); + +var msg19498 = msg("17312", dup269); + +var msg19499 = msg("17313", dup202); + +var msg19500 = msg("17314", dup202); + +var msg19501 = msg("17315", dup197); + +var msg19502 = msg("17316", dup267); + +var msg19503 = msg("17317", dup198); + +var msg19504 = msg("17318", dup267); + +var msg19505 = msg("17319", dup267); + +var msg19506 = msg("17320", dup267); + +var msg19507 = msg("17321", dup201); + +var msg19508 = msg("17322", dup202); + +var msg19509 = msg("17323", dup202); + +var msg19510 = msg("17324", dup199); + +var msg19511 = msg("17325", dup202); + +var msg19512 = msg("17326", dup197); + +var msg19513 = msg("17327", dup202); + +var msg19514 = msg("17328", dup197); + +var msg19515 = msg("17329", dup227); + +var msg19516 = msg("17330", dup265); + +var msg19517 = msg("17331", dup197); + +var msg19518 = msg("17332", dup250); + +var msg19519 = msg("17333", dup197); + +var msg19520 = msg("17334", dup197); + +var msg19521 = msg("17335", dup199); + +var msg19522 = msg("17336", dup199); + +var msg19523 = msg("17337", dup202); + +var msg19524 = msg("17338", dup202); + +var msg19525 = msg("17339", dup202); + +var msg19526 = msg("17340", dup202); + +var msg19527 = msg("17341", dup199); + +var msg19528 = msg("17342", dup199); + +var msg19529 = msg("17343", dup199); + +var msg19530 = msg("17344", dup199); + +var msg19531 = msg("17345", dup199); + +var msg19532 = msg("17346", dup267); + +var msg19533 = msg("17347", dup197); + +var msg19534 = msg("17348", dup197); + +var msg19535 = msg("17349", dup197); + +var msg19536 = msg("17350", dup267); + +var msg19537 = msg("17351", dup197); + +var msg19538 = msg("17352", dup197); + +var msg19539 = msg("17353", dup267); + +var msg19540 = msg("17354", dup198); + +var msg19541 = msg("17355", dup267); + +var msg19542 = msg("17356", dup197); + +var msg19543 = msg("17357", dup197); + +var msg19544 = msg("17358", dup197); + +var msg19545 = msg("17359", dup265); + +var msg19546 = msg("17360", dup197); + +var msg19547 = msg("17361", dup198); + +var msg19548 = msg("17362", dup197); + +var msg19549 = msg("17363", dup267); + +var msg19550 = msg("17364", dup202); + +var msg19551 = msg("17365", dup197); + +var msg19552 = msg("17366", dup197); + +var msg19553 = msg("17367", dup227); + +var msg19554 = msg("17368", dup267); + +var msg19555 = msg("17369", dup197); + +var msg19556 = msg("17370", dup265); + +var msg19557 = msg("17371", dup265); + +var msg19558 = msg("17372", dup197); + +var msg19559 = msg("17373", dup197); + +var msg19560 = msg("17374", dup197); + +var msg19561 = msg("17375", dup197); + +var msg19562 = msg("17376", dup267); + +var msg19563 = msg("17377", dup267); + +var msg19564 = msg("17378", dup197); + +var msg19565 = msg("17379", dup197); + +var msg19566 = msg("17380", dup265); + +var msg19567 = msg("17381", dup197); + +var msg19568 = msg("17382", dup267); + +var msg19569 = msg("17383", dup267); + +var msg19570 = msg("17384", dup197); + +var msg19571 = msg("17385", dup197); + +var msg19572 = msg("17386", dup267); + +var msg19573 = msg("17387", dup265); + +var msg19574 = msg("17388", dup197); + +var msg19575 = msg("17389", dup267); + +var msg19576 = msg("17390", dup198); + +var msg19577 = msg("17391", dup265); + +var msg19578 = msg("17392", dup199); + +var msg19579 = msg("17393", dup199); + +var msg19580 = msg("17394", dup265); + +var msg19581 = msg("17395", dup197); + +var msg19582 = msg("17396", dup267); + +var msg19583 = msg("17397", dup197); + +var msg19584 = msg("17398", dup267); + +var msg19585 = msg("17399", dup267); + +var msg19586 = msg("17400", dup263); + +var msg19587 = msg("17401", dup267); + +var msg19588 = msg("17402", dup267); + +var msg19589 = msg("17403", dup197); + +var msg19590 = msg("17404", dup197); + +var msg19591 = msg("17405", dup197); + +var msg19592 = msg("17406", dup197); + +var msg19593 = msg("17407", dup265); + +var msg19594 = msg("17408", dup197); + +var msg19595 = msg("17409", dup267); + +var msg19596 = msg("17410", dup197); + +var msg19597 = msg("17411", dup267); + +var msg19598 = msg("17412", dup260); + +var msg19599 = msg("17413", dup197); + +var msg19600 = msg("17414", dup287); + +var msg19601 = msg("17415", dup287); + +var msg19602 = msg("17416", dup198); + +var msg19603 = msg("17417", dup198); + +var msg19604 = msg("17418", dup202); + +var msg19605 = msg("17419", dup240); + +var msg19606 = msg("17420", dup265); + +var msg19607 = msg("17421", dup201); + +var msg19608 = msg("17422", dup267); + +var msg19609 = msg("17423", dup197); + +var msg19610 = msg("17424", dup201); + +var msg19611 = msg("17425", dup197); + +var msg19612 = msg("17426", dup265); + +var msg19613 = msg("17427", dup202); + +var msg19614 = msg("17428", dup202); + +var msg19615 = msg("17429", dup265); + +var msg19616 = msg("17430", dup267); + +var msg19617 = msg("17431", dup267); + +var msg19618 = msg("17432", dup197); + +var msg19619 = msg("17433", dup267); + +var msg19620 = msg("17434", dup267); + +var msg19621 = msg("17435", dup255); + +var msg19622 = msg("17436", dup255); + +var msg19623 = msg("17437", dup255); + +var msg19624 = msg("17438", dup255); + +var msg19625 = msg("17439", dup267); + +var msg19626 = msg("17440", dup197); + +var msg19627 = msg("17441", dup265); + +var msg19628 = msg("17442", dup267); + +var msg19629 = msg("17443", dup197); + +var msg19630 = msg("17444", dup197); + +var msg19631 = msg("17445", dup267); + +var msg19632 = msg("17446", dup227); + +var msg19633 = msg("17447", dup202); + +var msg19634 = msg("17448", dup267); + +var msg19635 = msg("17449", dup260); + +var msg19636 = msg("17450", dup197); + +var msg19637 = msg("17451", dup265); + +var msg19638 = msg("17452", dup265); + +var msg19639 = msg("17453", dup265); + +var msg19640 = msg("17454", dup265); + +var msg19641 = msg("17455", dup265); + +var msg19642 = msg("17456", dup265); + +var msg19643 = msg("17457", dup267); + +var msg19644 = msg("17458", dup201); + +var msg19645 = msg("17459", dup201); + +var msg19646 = msg("17460", dup201); + +var msg19647 = msg("17461", dup201); + +var msg19648 = msg("17462", dup267); + +var msg19649 = msg("17463", dup269); + +var msg19650 = msg("17464", dup265); + +var msg19651 = msg("17465", dup265); + +var msg19652 = msg("17466", dup267); + +var msg19653 = msg("17467", dup267); + +var msg19654 = msg("17468", dup267); + +var msg19655 = msg("17469", dup197); + +var msg19656 = msg("17470", dup267); + +var msg19657 = msg("17471", dup201); + +var msg19658 = msg("17472", dup201); + +var msg19659 = msg("17473", dup267); + +var msg19660 = msg("17474", dup201); + +var msg19661 = msg("17475", dup201); + +var msg19662 = msg("17476", dup267); + +var msg19663 = msg("17477", dup201); + +var msg19664 = msg("17478", dup267); + +var msg19665 = msg("17479", dup267); + +var msg19666 = msg("17480", dup201); + +var msg19667 = msg("17481", dup197); + +var msg19668 = msg("17482", dup197); + +var msg19669 = msg("17483", dup198); + +var msg19670 = msg("17484", dup198); + +var msg19671 = msg("17485", dup313); + +var msg19672 = msg("17486", dup197); + +var msg19673 = msg("17487", dup265); + +var msg19674 = msg("17488", dup267); + +var msg19675 = msg("17489", dup197); + +var msg19676 = msg("17490", dup267); + +var msg19677 = msg("17491", dup267); + +var msg19678 = msg("17492", dup267); + +var msg19679 = msg("17493", dup197); + +var msg19680 = msg("17494", dup197); + +var msg19681 = msg("17495", dup267); + +var msg19682 = msg("17496", dup267); + +var msg19683 = msg("17497", dup267); + +var msg19684 = msg("17498", dup265); + +var msg19685 = msg("17499", dup265); + +var msg19686 = msg("17500", dup265); + +var msg19687 = msg("17501", dup265); + +var msg19688 = msg("17502", dup265); + +var msg19689 = msg("17503", dup202); + +var msg19690 = msg("17504", dup197); + +var msg19691 = msg("17505", dup267); + +var msg19692 = msg("17506", dup267); + +var msg19693 = msg("17507", dup267); + +var msg19694 = msg("17508", dup265); + +var msg19695 = msg("17509", dup265); + +var msg19696 = msg("17510", dup265); + +var msg19697 = msg("17511", dup267); + +var msg19698 = msg("17512", dup201); + +var msg19699 = msg("17513", dup201); + +var msg19700 = msg("17514", dup201); + +var msg19701 = msg("17515", dup201); + +var msg19702 = msg("17516", dup201); + +var msg19703 = msg("17517", dup267); + +var msg19704 = msg("17518", dup227); + +var msg19705 = msg("17519", dup197); + +var msg19706 = msg("17520", dup267); + +var msg19707 = msg("17521", dup227); + +var msg19708 = msg("17522", dup197); + +var msg19709 = msg("17523", dup197); + +var msg19710 = msg("17524", dup197); + +var msg19711 = msg("17525", dup202); + +var msg19712 = msg("17526", dup197); + +var msg19713 = msg("17527", dup197); + +var msg19714 = msg("17528", dup197); + +var msg19715 = msg("17529", dup267); + +var msg19716 = msg("17530", dup197); + +var msg19717 = msg("17531", dup197); + +var msg19718 = msg("17532", dup267); + +var msg19719 = msg("17533", dup265); + +var msg19720 = msg("17534", dup202); + +var msg19721 = msg("17535", dup201); + +var msg19722 = msg("17536", dup197); + +var msg19723 = msg("17537", dup267); + +var msg19724 = msg("17538", dup267); + +var msg19725 = msg("17539", dup267); + +var msg19726 = msg("17540", dup202); + +var msg19727 = msg("17541", dup197); + +var msg19728 = msg("17542", dup267); + +var msg19729 = msg("17543", dup267); + +var msg19730 = msg("17544", dup197); + +var msg19731 = msg("17545", dup197); + +var msg19732 = msg("17546", dup202); + +var msg19733 = msg("17547", dup202); + +var msg19734 = msg("17548", dup197); + +var msg19735 = msg("17549", dup267); + +var msg19736 = msg("17550", dup197); + +var msg19737 = msg("17551", dup267); + +var msg19738 = msg("17552", dup265); + +var msg19739 = msg("17553", dup197); + +var msg19740 = msg("17554", dup267); + +var msg19741 = msg("17555", dup267); + +var msg19742 = msg("17556", dup267); + +var msg19743 = msg("17557", dup197); + +var msg19744 = msg("17558", dup197); + +var msg19745 = msg("17559", dup197); + +var msg19746 = msg("17560", dup197); + +var msg19747 = msg("17561", dup197); + +var msg19748 = msg("17562", dup197); + +var msg19749 = msg("17563", dup197); + +var msg19750 = msg("17564", dup202); + +var msg19751 = msg("17565", dup267); + +var msg19752 = msg("17566", dup267); + +var msg19753 = msg("17567", dup309); + +var msg19754 = msg("17568", dup197); + +var msg19755 = msg("17569", dup201); + +var msg19756 = msg("17570", dup267); + +var msg19757 = msg("17571", dup269); + +var msg19758 = msg("17572", dup265); + +var msg19759 = msg("17573", dup197); + +var msg19760 = msg("17574", dup197); + +var msg19761 = msg("17575", dup265); + +var msg19762 = msg("17576", dup265); + +var msg19763 = msg("17577", dup202); + +var msg19764 = msg("17578", dup197); + +var msg19765 = msg("17579", dup267); + +var msg19766 = msg("17580", dup267); + +var msg19767 = msg("17581", dup267); + +var msg19768 = msg("17582", dup265); + +var msg19769 = msg("17583", dup265); + +var msg19770 = msg("17584", dup202); + +var msg19771 = msg("17585", dup267); + +var msg19772 = msg("17586", dup269); + +var msg19773 = msg("17587", dup267); + +var msg19774 = msg("17588", dup265); + +var msg19775 = msg("17589", dup265); + +var msg19776 = msg("17590", dup260); + +var msg19777 = msg("17591", dup267); + +var msg19778 = msg("17592", dup265); + +var msg19779 = msg("17593", dup265); + +var msg19780 = msg("17594", dup265); + +var msg19781 = msg("17595", dup265); + +var msg19782 = msg("17596", dup265); + +var msg19783 = msg("17597", dup265); + +var msg19784 = msg("17598", dup202); + +var msg19785 = msg("17599", dup198); + +var msg19786 = msg("17600", dup202); + +var msg19787 = msg("17601", dup267); + +var msg19788 = msg("17602", dup198); + +var msg19789 = msg("17603", dup267); + +var msg19790 = msg("17604", dup267); + +var msg19791 = msg("17605", dup197); + +var msg19792 = msg("17606", dup267); + +var msg19793 = msg("17607", dup309); + +var msg19794 = msg("17608", dup267); + +var msg19795 = msg("17609", dup197); + +var msg19796 = msg("17610", dup201); + +var msg19797 = msg("17611", dup201); + +var msg19798 = msg("17612", dup201); + +var msg19799 = msg("17613", dup267); + +var msg19800 = msg("17614", dup265); + +var msg19801 = msg("17616", dup265); + +var msg19802 = msg("17618", dup267); + +var msg19803 = msg("17619", dup267); + +var msg19804 = msg("17620", dup197); + +var msg19805 = msg("17621", dup197); + +var msg19806 = msg("17622", dup267); + +var msg19807 = msg("17623", dup197); + +var msg19808 = msg("17624", dup197); + +var msg19809 = msg("17625", dup198); + +var msg19810 = msg("17626", dup197); + +var msg19811 = msg("17628", dup267); + +var msg19812 = msg("17629", dup265); + +var msg19813 = msg("17630", dup267); + +var msg19814 = msg("17631", dup197); + +var msg19815 = msg("17632", dup309); + +var msg19816 = msg("17633", dup197); + +var msg19817 = msg("17634", dup201); + +var msg19818 = msg("17635", dup201); + +var msg19819 = msg("17636", dup201); + +var msg19820 = msg("17637", dup201); + +var msg19821 = msg("17638", dup199); + +var msg19822 = msg("17639", dup306); + +var msg19823 = msg("17640", dup201); + +var msg19824 = msg("17641", dup197); + +var msg19825 = msg("17642", dup267); + +var msg19826 = msg("17643", dup314); + +var msg19827 = msg("17644", dup267); + +var msg19828 = msg("17645", dup267); + +var msg19829 = msg("17646", dup267); + +var msg19830 = msg("17647", dup267); + +var msg19831 = msg("17648", dup265); + +var msg19832 = msg("17649", dup197); + +var msg19833 = msg("17650", dup197); + +var msg19834 = msg("17651", dup287); + +var msg19835 = msg("17652", dup265); + +var msg19836 = msg("17653", dup265); + +var msg19837 = msg("17654", dup267); + +var msg19838 = msg("17655", dup267); + +var msg19839 = msg("17656", dup197); + +var msg19840 = msg("17657", dup311); + +var msg19841 = msg("17658", dup267); + +var msg19842 = msg("17659", dup197); + +var msg19843 = msg("17660", dup267); + +var msg19844 = msg("17661", dup309); + +var msg19845 = msg("17662", dup267); + +var msg19846 = msg("17663", dup197); + +var msg19847 = msg("17664", dup267); + +var msg19848 = msg("17665", dup201); + +var msg19849 = msg("17666", dup197); + +var msg19850 = msg("17667", dup198); + +var msg19851 = msg("17668", dup202); + +var msg19852 = msg("17669", dup267); + +var msg19853 = msg("17670", dup265); + +var msg19854 = msg("17671", dup265); + +var msg19855 = msg("17672", dup265); + +var msg19856 = msg("17673", dup265); + +var msg19857 = msg("17674", dup265); + +var msg19858 = msg("17675", dup265); + +var msg19859 = msg("17676", dup265); + +var msg19860 = msg("17677", dup265); + +var msg19861 = msg("17678", dup197); + +var msg19862 = msg("17679", dup265); + +var msg19863 = msg("17680", dup198); + +var msg19864 = msg("17685", dup267); + +var msg19865 = msg("17686", dup267); + +var msg19866 = msg("17687", dup267); + +var msg19867 = msg("17688", dup267); + +var msg19868 = msg("17689", dup267); + +var msg19869 = msg("17690", dup267); + +var msg19870 = msg("17691", dup267); + +var msg19871 = msg("17692", dup267); + +var msg19872 = msg("17693", dup309); + +var msg19873 = msg("17694", dup309); + +var msg19874 = msg("17695", dup197); + +var msg19875 = msg("17696", dup267); + +var msg19876 = msg("17697", dup309); + +var msg19877 = msg("17698", dup197); + +var msg19878 = msg("17699", dup315); + +var msg19879 = msg("17700", dup197); + +var msg19880 = msg("17701", dup267); + +var msg19881 = msg("17702", dup255); + +var msg19882 = msg("17703", dup267); + +var msg19883 = msg("17704", dup197); + +var msg19884 = msg("17705", dup197); + +var msg19885 = msg("17706", dup267); + +var msg19886 = msg("17707", dup201); + +var msg19887 = msg("17708", dup197); + +var msg19888 = msg("17709", dup267); + +var msg19889 = msg("17710", dup197); + +var msg19890 = msg("17711", dup267); + +var msg19891 = msg("17712", dup267); + +var msg19892 = msg("17713", dup197); + +var msg19893 = msg("17714", dup255); + +var msg19894 = msg("17715", dup255); + +var msg19895 = msg("17716", dup197); + +var msg19896 = msg("17717", dup197); + +var msg19897 = msg("17718", dup267); + +var msg19898 = msg("17719", dup267); + +var msg19899 = msg("17720", dup197); + +var msg19900 = msg("17721", dup267); + +var msg19901 = msg("17722", dup197); + +var msg19902 = msg("17723", dup276); + +var msg19903 = msg("17724", dup269); + +var msg19904 = msg("17725", dup197); + +var msg19905 = msg("17726", dup267); + +var msg19906 = msg("17727", dup197); + +var msg19907 = msg("17728", dup197); + +var msg19908 = msg("17729", dup267); + +var msg19909 = msg("17730", dup267); + +var msg19910 = msg("17731", dup202); + +var msg19911 = msg("17732", dup265); + +var msg19912 = msg("17733", dup265); + +var msg19913 = msg("17734", dup265); + +var msg19914 = msg("17735", dup197); + +var msg19915 = msg("17736", dup197); + +var msg19916 = msg("17737", dup197); + +var msg19917 = msg("17738", dup267); + +var msg19918 = msg("17739", dup202); + +var msg19919 = msg("17740", dup197); + +var msg19920 = msg("17741", dup311); + +var msg19921 = msg("17742", dup267); + +var msg19922 = msg("17743", dup267); + +var msg19923 = msg("17745", dup276); + +var msg19924 = msg("17746", dup197); + +var msg19925 = msg("17747", dup197); + +var msg19926 = msg("17748", dup202); + +var msg19927 = msg("17749", dup255); + +var msg19928 = msg("17750", dup198); + +var msg19929 = msg("17751", dup265); + +var msg19930 = msg("17752", dup267); + +var msg19931 = msg("17753", dup267); + +var msg19932 = msg("17754", dup267); + +var msg19933 = msg("17755", dup267); + +var msg19934 = msg("17756", dup197); + +var msg19935 = msg("17757", dup197); + +var msg19936 = msg("17758", dup267); + +var msg19937 = msg("17759", dup267); + +var msg19938 = msg("17760", dup267); + +var msg19939 = msg("17762", dup267); + +var msg19940 = msg("17763", dup267); + +var msg19941 = msg("17764", dup267); + +var msg19942 = msg("17765", dup197); + +var msg19943 = msg("17766", dup267); + +var msg19944 = msg("17767", dup267); + +var msg19945 = msg("17768", dup267); + +var msg19946 = msg("17769", dup267); + +var msg19947 = msg("17770", dup265); + +var msg19948 = msg("17771", dup267); + +var msg19949 = msg("17772", dup265); + +var msg19950 = msg("17773", dup267); + +var msg19951 = msg("17774", dup267); + +var msg19952 = msg("17775", dup316); + +var msg19953 = msg("17776", dup197); + +var msg19954 = msg("17777", dup197); + +var msg19955 = msg("17778", dup201); + +var msg19956 = msg("17779", dup260); + +var msg19957 = msg("17780", dup197); + +var msg19958 = msg("17781", dup267); + +var msg19959 = msg("17782", dup202); + +var msg19960 = msg("17783", dup202); + +var msg19961 = msg("17784", dup202); + +var msg19962 = msg("17785", dup202); + +var msg19963 = msg("17786", dup202); + +var msg19964 = msg("17787", dup202); + +var msg19965 = msg("17788", dup202); + +var msg19966 = msg("17789", dup202); + +var msg19967 = msg("17790", dup202); + +var msg19968 = msg("17791", dup202); + +var msg19969 = msg("17792", dup202); + +var msg19970 = msg("17793", dup202); + +var msg19971 = msg("17794", dup202); + +var msg19972 = msg("17795", dup202); + +var msg19973 = msg("17796", dup202); + +var msg19974 = msg("17797", dup202); + +var msg19975 = msg("17798", dup202); + +var msg19976 = msg("17799", dup202); + +var msg19977 = msg("17800", dup202); + +var msg19978 = msg("17801", dup202); + +var msg19979 = msg("17802", dup202); + +var msg19980 = msg("17803", dup267); + +var msg19981 = msg("17804", dup267); + +var msg19982 = msg("17805", dup238); + +var msg19983 = msg("17806", dup267); + +var msg19984 = msg("17807", dup267); + +var msg19985 = msg("17808", dup267); + +var msg19986 = msg("17809", dup202); + +var msg19987 = msg("17810", dup263); + +var msg19988 = msg("17811", dup263); + +var msg19989 = msg("17812", dup269); + +var msg19990 = msg("17813", dup263); + +var msg19991 = msg("17814", dup263); + +var msg19992 = msg("17815", dup263); + +var msg19993 = msg("17816", dup263); + +var msg19994 = msg("17817", dup263); + +var msg19995 = msg("17818", dup263); + +var msg19996 = msg("17819", dup263); + +var msg19997 = msg("17820", dup263); + +var msg19998 = msg("17821", dup263); + +var msg19999 = msg("17822", dup263); + +var msg20000 = msg("17823", dup263); + +var msg20001 = msg("17824", dup263); + +var msg20002 = msg("17825", dup263); + +var msg20003 = msg("17826", dup263); + +var msg20004 = msg("17827", dup263); + +var msg20005 = msg("17828", dup263); + +var msg20006 = msg("17829", dup263); + +var msg20007 = msg("17830", dup263); + +var msg20008 = msg("17831", dup263); + +var msg20009 = msg("17832", dup263); + +var msg20010 = msg("17833", dup263); + +var msg20011 = msg("17834", dup263); + +var msg20012 = msg("17835", dup263); + +var msg20013 = msg("17836", dup263); + +var msg20014 = msg("17837", dup263); + +var msg20015 = msg("17838", dup263); + +var msg20016 = msg("17839", dup263); + +var msg20017 = msg("17840", dup263); + +var msg20018 = msg("17841", dup263); + +var msg20019 = msg("17842", dup263); + +var msg20020 = msg("17843", dup263); + +var msg20021 = msg("17844", dup263); + +var msg20022 = msg("17845", dup263); + +var msg20023 = msg("17846", dup263); + +var msg20024 = msg("17847", dup263); + +var msg20025 = msg("17848", dup263); + +var msg20026 = msg("17849", dup263); + +var msg20027 = msg("17850", dup263); + +var msg20028 = msg("17851", dup263); + +var msg20029 = msg("17852", dup263); + +var msg20030 = msg("17853", dup263); + +var msg20031 = msg("17854", dup263); + +var msg20032 = msg("17855", dup263); + +var msg20033 = msg("17856", dup263); + +var msg20034 = msg("17857", dup263); + +var msg20035 = msg("17858", dup263); + +var msg20036 = msg("17859", dup263); + +var msg20037 = msg("17860", dup263); + +var msg20038 = msg("17861", dup263); + +var msg20039 = msg("17862", dup263); + +var msg20040 = msg("17863", dup263); + +var msg20041 = msg("17864", dup263); + +var msg20042 = msg("17865", dup263); + +var msg20043 = msg("17866", dup263); + +var msg20044 = msg("17867", dup263); + +var msg20045 = msg("17868", dup263); + +var msg20046 = msg("17869", dup263); + +var msg20047 = msg("17870", dup263); + +var msg20048 = msg("17871", dup263); + +var msg20049 = msg("17872", dup263); + +var msg20050 = msg("17873", dup263); + +var msg20051 = msg("17874", dup263); + +var msg20052 = msg("17875", dup197); + +var msg20053 = msg("17876", dup263); + +var msg20054 = msg("17877", dup263); + +var msg20055 = msg("17878", dup263); + +var msg20056 = msg("17879", dup263); + +var msg20057 = msg("17880", dup263); + +var msg20058 = msg("17881", dup263); + +var msg20059 = msg("17882", dup263); + +var msg20060 = msg("17883", dup263); + +var msg20061 = msg("17884", dup263); + +var msg20062 = msg("17885", dup263); + +var msg20063 = msg("17886", dup263); + +var msg20064 = msg("17887", dup263); + +var msg20065 = msg("17888", dup263); + +var msg20066 = msg("17889", dup263); + +var msg20067 = msg("17890", dup263); + +var msg20068 = msg("17891", dup263); + +var msg20069 = msg("17892", dup263); + +var msg20070 = msg("17893", dup263); + +var msg20071 = msg("17894", dup263); + +var msg20072 = msg("17895", dup263); + +var msg20073 = msg("17896", dup263); + +var msg20074 = msg("17897", dup263); + +var msg20075 = msg("17898", dup269); + +var msg20076 = msg("17899", dup269); + +var msg20077 = msg("17900", dup269); + +var msg20078 = msg("17901", dup269); + +var msg20079 = msg("17902", dup269); + +var msg20080 = msg("17903", dup269); + +var msg20081 = msg("17904", dup269); + +var msg20082 = msg("17905", dup269); + +var msg20083 = msg("17906", dup269); + +var msg20084 = msg("17907", dup269); + +var msg20085 = msg("17908", dup269); + +var msg20086 = msg("17909", dup269); + +var msg20087 = msg("17910", dup269); + +var msg20088 = msg("17911", dup269); + +var msg20089 = msg("17912", dup269); + +var msg20090 = msg("17913", dup269); + +var msg20091 = msg("17914", dup269); + +var msg20092 = msg("17915", dup269); + +var msg20093 = msg("17916", dup269); + +var msg20094 = msg("17917", dup269); + +var msg20095 = msg("17918", dup312); + +var msg20096 = msg("17919", dup312); + +var msg20097 = msg("17920", dup312); + +var msg20098 = msg("17921", dup312); + +var msg20099 = msg("17922", dup312); + +var msg20100 = msg("17923", dup312); + +var msg20101 = msg("17924", dup312); + +var msg20102 = msg("17925", dup312); + +var msg20103 = msg("17926", dup312); + +var msg20104 = msg("17927", dup312); + +var msg20105 = msg("17928", dup312); + +var msg20106 = msg("17929", dup312); + +var msg20107 = msg("17930", dup312); + +var msg20108 = msg("17931", dup312); + +var msg20109 = msg("17932", dup312); + +var msg20110 = msg("17933", dup312); + +var msg20111 = msg("17934", dup312); + +var msg20112 = msg("17935", dup312); + +var msg20113 = msg("17936", dup312); + +var msg20114 = msg("17937", dup312); + +var msg20115 = msg("17938", dup312); + +var msg20116 = msg("17939", dup312); + +var msg20117 = msg("17940", dup312); + +var msg20118 = msg("17941", dup312); + +var msg20119 = msg("17942", dup312); + +var msg20120 = msg("17943", dup312); + +var msg20121 = msg("17944", dup312); + +var msg20122 = msg("17945", dup312); + +var msg20123 = msg("17946", dup312); + +var msg20124 = msg("17947", dup312); + +var msg20125 = msg("17948", dup312); + +var msg20126 = msg("17949", dup312); + +var msg20127 = msg("17950", dup312); + +var msg20128 = msg("17951", dup312); + +var msg20129 = msg("17952", dup312); + +var msg20130 = msg("17953", dup312); + +var msg20131 = msg("17954", dup312); + +var msg20132 = msg("17955", dup312); + +var msg20133 = msg("17956", dup312); + +var msg20134 = msg("17957", dup312); + +var msg20135 = msg("17958", dup312); + +var msg20136 = msg("17959", dup312); + +var msg20137 = msg("17960", dup312); + +var msg20138 = msg("17961", dup312); + +var msg20139 = msg("17962", dup312); + +var msg20140 = msg("17963", dup312); + +var msg20141 = msg("17964", dup312); + +var msg20142 = msg("17965", dup312); + +var msg20143 = msg("17966", dup312); + +var msg20144 = msg("17967", dup312); + +var msg20145 = msg("17968", dup312); + +var msg20146 = msg("17969", dup312); + +var msg20147 = msg("17970", dup312); + +var msg20148 = msg("17971", dup312); + +var msg20149 = msg("17972", dup312); + +var msg20150 = msg("17973", dup287); + +var msg20151 = msg("17974", dup312); + +var msg20152 = msg("17975", dup312); + +var msg20153 = msg("17976", dup312); + +var msg20154 = msg("17977", dup312); + +var msg20155 = msg("17978", dup312); + +var msg20156 = msg("17979", dup312); + +var msg20157 = msg("17980", dup312); + +var msg20158 = msg("17981", dup312); + +var msg20159 = msg("17982", dup312); + +var msg20160 = msg("17983", dup312); + +var msg20161 = msg("17984", dup312); + +var msg20162 = msg("17985", dup312); + +var msg20163 = msg("17986", dup312); + +var msg20164 = msg("17987", dup312); + +var msg20165 = msg("17988", dup312); + +var msg20166 = msg("17989", dup312); + +var msg20167 = msg("17990", dup312); + +var msg20168 = msg("17991", dup312); + +var msg20169 = msg("17992", dup312); + +var msg20170 = msg("17993", dup312); + +var msg20171 = msg("17994", dup312); + +var msg20172 = msg("17995", dup312); + +var msg20173 = msg("17996", dup312); + +var msg20174 = msg("17997", dup312); + +var msg20175 = msg("17998", dup312); + +var msg20176 = msg("17999", dup312); + +var msg20177 = msg("18000", dup312); + +var msg20178 = msg("18001", dup312); + +var msg20179 = msg("18002", dup312); + +var msg20180 = msg("18003", dup312); + +var msg20181 = msg("18004", dup287); + +var msg20182 = msg("18005", dup312); + +var msg20183 = msg("18006", dup312); + +var msg20184 = msg("18007", dup312); + +var msg20185 = msg("18008", dup312); + +var msg20186 = msg("18009", dup312); + +var msg20187 = msg("18010", dup312); + +var msg20188 = msg("18011", dup312); + +var msg20189 = msg("18012", dup312); + +var msg20190 = msg("18013", dup312); + +var msg20191 = msg("18014", dup312); + +var msg20192 = msg("18015", dup312); + +var msg20193 = msg("18016", dup312); + +var msg20194 = msg("18017", dup312); + +var msg20195 = msg("18018", dup312); + +var msg20196 = msg("18019", dup312); + +var msg20197 = msg("18020", dup312); + +var msg20198 = msg("18021", dup312); + +var msg20199 = msg("18022", dup312); + +var msg20200 = msg("18023", dup312); + +var msg20201 = msg("18024", dup312); + +var msg20202 = msg("18025", dup312); + +var msg20203 = msg("18026", dup312); + +var msg20204 = msg("18027", dup312); + +var msg20205 = msg("18028", dup312); + +var msg20206 = msg("18029", dup312); + +var msg20207 = msg("18030", dup312); + +var msg20208 = msg("18031", dup312); + +var msg20209 = msg("18032", dup312); + +var msg20210 = msg("18033", dup312); + +var msg20211 = msg("18034", dup312); + +var msg20212 = msg("18035", dup312); + +var msg20213 = msg("18036", dup312); + +var msg20214 = msg("18037", dup312); + +var msg20215 = msg("18038", dup312); + +var msg20216 = msg("18039", dup312); + +var msg20217 = msg("18040", dup312); + +var msg20218 = msg("18041", dup312); + +var msg20219 = msg("18042", dup312); + +var msg20220 = msg("18043", dup312); + +var msg20221 = msg("18044", dup312); + +var msg20222 = msg("18045", dup312); + +var msg20223 = msg("18046", dup312); + +var msg20224 = msg("18047", dup312); + +var msg20225 = msg("18048", dup312); + +var msg20226 = msg("18049", dup312); + +var msg20227 = msg("18050", dup312); + +var msg20228 = msg("18051", dup265); + +var msg20229 = msg("18052", dup265); + +var msg20230 = msg("18053", dup312); + +var msg20231 = msg("18054", dup312); + +var msg20232 = msg("18055", dup312); + +var msg20233 = msg("18056", dup312); + +var msg20234 = msg("18057", dup312); + +var msg20235 = msg("18058", dup312); + +var msg20236 = msg("18059", dup312); + +var msg20237 = msg("18060", dup312); + +var msg20238 = msg("18061", dup312); + +var msg20239 = msg("18062", dup267); + +var msg20240 = msg("18063", dup267); + +var msg20241 = msg("18064", dup267); + +var msg20242 = msg("18065", dup267); + +var msg20243 = msg("18066", dup267); + +var msg20244 = msg("18067", dup267); + +var msg20245 = msg("18068", dup267); + +var msg20246 = msg("18069", dup265); + +var msg20247 = msg("18070", dup276); + +var msg20248 = msg("18071", dup267); + +var msg20249 = msg("18072", dup265); + +var msg20250 = msg("18073", dup267); + +var msg20251 = msg("18074", dup265); + +var msg20252 = msg("18076", dup265); + +var msg20253 = msg("18077", dup197); + +var msg20254 = msg("18078", dup197); + +var msg20255 = msg("18079", dup263); + +var msg20256 = msg("18080", dup263); + +var msg20257 = msg("18081", dup263); + +var msg20258 = msg("18082", dup263); + +var msg20259 = msg("18083", dup263); + +var msg20260 = msg("18084", dup263); + +var msg20261 = msg("18085", dup263); + +var msg20262 = msg("18086", dup263); + +var msg20263 = msg("18087", dup263); + +var msg20264 = msg("18088", dup263); + +var msg20265 = msg("18089", dup263); + +var msg20266 = msg("18090", dup263); + +var msg20267 = msg("18091", dup263); + +var msg20268 = msg("18092", dup263); + +var msg20269 = msg("18093", dup263); + +var msg20270 = msg("18094", dup263); + +var msg20271 = msg("18095", dup263); + +var msg20272 = msg("18096", dup265); + +var msg20273 = msg("18097", dup265); + +var msg20274 = msg("18098", dup269); + +var msg20275 = msg("18099", dup269); + +var msg20276 = msg("18100", dup263); + +var msg20277 = msg("18101", dup267); + +var msg20278 = msg("18102", dup202); + +var msg20279 = msg("18103", dup263); + +var msg20280 = msg("18104", dup263); + +var msg20281 = msg("18105", dup263); + +var msg20282 = msg("18106", dup263); + +var msg20283 = msg("18107", dup263); + +var msg20284 = msg("18108", dup263); + +var msg20285 = msg("18109", dup263); + +var msg20286 = msg("18110", dup263); + +var msg20287 = msg("18111", dup263); + +var msg20288 = msg("18112", dup263); + +var msg20289 = msg("18113", dup263); + +var msg20290 = msg("18114", dup263); + +var msg20291 = msg("18115", dup263); + +var msg20292 = msg("18116", dup263); + +var msg20293 = msg("18117", dup263); + +var msg20294 = msg("18118", dup263); + +var msg20295 = msg("18119", dup263); + +var msg20296 = msg("18120", dup263); + +var msg20297 = msg("18121", dup263); + +var msg20298 = msg("18122", dup263); + +var msg20299 = msg("18123", dup263); + +var msg20300 = msg("18124", dup263); + +var msg20301 = msg("18125", dup263); + +var msg20302 = msg("18126", dup263); + +var msg20303 = msg("18127", dup263); + +var msg20304 = msg("18128", dup263); + +var msg20305 = msg("18129", dup263); + +var msg20306 = msg("18130", dup263); + +var msg20307 = msg("18131", dup263); + +var msg20308 = msg("18132", dup263); + +var msg20309 = msg("18133", dup263); + +var msg20310 = msg("18134", dup263); + +var msg20311 = msg("18135", dup263); + +var msg20312 = msg("18136", dup263); + +var msg20313 = msg("18137", dup263); + +var msg20314 = msg("18138", dup263); + +var msg20315 = msg("18139", dup263); + +var msg20316 = msg("18140", dup263); + +var msg20317 = msg("18141", dup263); + +var msg20318 = msg("18142", dup263); + +var msg20319 = msg("18143", dup263); + +var msg20320 = msg("18144", dup263); + +var msg20321 = msg("18145", dup263); + +var msg20322 = msg("18146", dup263); + +var msg20323 = msg("18147", dup263); + +var msg20324 = msg("18148", dup263); + +var msg20325 = msg("18149", dup263); + +var msg20326 = msg("18150", dup263); + +var msg20327 = msg("18151", dup263); + +var msg20328 = msg("18152", dup263); + +var msg20329 = msg("18153", dup263); + +var msg20330 = msg("18154", dup263); + +var msg20331 = msg("18155", dup263); + +var msg20332 = msg("18156", dup263); + +var msg20333 = msg("18157", dup263); + +var msg20334 = msg("18158", dup263); + +var msg20335 = msg("18159", dup263); + +var msg20336 = msg("18160", dup263); + +var msg20337 = msg("18161", dup263); + +var msg20338 = msg("18162", dup263); + +var msg20339 = msg("18163", dup263); + +var msg20340 = msg("18164", dup263); + +var msg20341 = msg("18165", dup263); + +var msg20342 = msg("18166", dup263); + +var msg20343 = msg("18167", dup265); + +var msg20344 = msg("18168", dup265); + +var msg20345 = msg("18169", dup265); + +var msg20346 = msg("18170", dup267); + +var msg20347 = msg("18171", dup201); + +var msg20348 = msg("18172", dup201); + +var msg20349 = msg("18173", dup201); + +var msg20350 = msg("18174", dup267); + +var msg20351 = msg("18175", dup267); + +var msg20352 = msg("18176", dup267); + +var msg20353 = msg("18177", dup267); + +var msg20354 = msg("18178", dup267); + +var msg20355 = msg("18179", dup194); + +var msg20356 = msg("18180", dup307); + +var msg20357 = msg("18181", dup227); + +var msg20358 = msg("18182", dup227); + +var msg20359 = msg("18183", dup263); + +var msg20360 = msg("18184", dup263); + +var msg20361 = msg("18185", dup263); + +var msg20362 = msg("18186", dup267); + +var msg20363 = msg("18187", dup267); + +var msg20364 = msg("18188", dup287); + +var msg20365 = msg("18189", dup255); + +var msg20366 = msg("18190", dup255); + +var msg20367 = msg("18191", dup255); + +var msg20368 = msg("18192", dup255); + +var msg20369 = msg("18193", dup269); + +var msg20370 = msg("18194", dup269); + +var msg20371 = msg("18195", dup198); + +var msg20372 = msg("18196", dup265); + +var msg20373 = msg("18197", dup267); + +var msg20374 = msg("18198", dup267); + +var msg20375 = msg("18199", dup267); + +var msg20376 = msg("18200", dup197); + +var msg20377 = msg("18201", dup267); + +var msg20378 = msg("18202", dup269); + +var msg20379 = msg("18203", dup269); + +var msg20380 = msg("18204", dup269); + +var msg20381 = msg("18205", dup269); + +var msg20382 = msg("18206", dup269); + +var msg20383 = msg("18207", dup269); + +var msg20384 = msg("18208", dup267); + +var msg20385 = msg("18209", dup276); + +var msg20386 = msg("18210", dup267); + +var msg20387 = msg("18211", dup306); + +var msg20388 = msg("18212", dup197); + +var msg20389 = msg("18213", dup267); + +var msg20390 = msg("18214", dup267); + +var msg20391 = msg("18215", dup255); + +var msg20392 = msg("18216", dup265); + +var msg20393 = msg("18217", dup267); + +var msg20394 = msg("18218", dup287); + +var msg20395 = msg("18219", dup267); + +var msg20396 = msg("18220", dup267); + +var msg20397 = msg("18221", dup267); + +var msg20398 = msg("18222", dup267); + +var msg20399 = msg("18223", dup267); + +var msg20400 = msg("18224", dup267); + +var msg20401 = msg("18225", dup276); + +var msg20402 = msg("18226", dup276); + +var msg20403 = msg("18227", dup276); + +var msg20404 = msg("18228", dup202); + +var msg20405 = msg("18229", dup197); + +var msg20406 = msg("18230", dup267); + +var msg20407 = msg("18231", dup265); + +var msg20408 = msg("18232", dup202); + +var msg20409 = msg("18233", dup267); + +var msg20410 = msg("18234", dup265); + +var msg20411 = msg("18235", dup267); + +var msg20412 = msg("18236", dup267); + +var msg20413 = msg("18237", dup267); + +var msg20414 = msg("18238", dup267); + +var msg20415 = msg("18239", dup269); + +var msg20416 = msg("18240", dup265); + +var msg20417 = msg("18241", dup265); + +var msg20418 = msg("18242", dup265); + +var msg20419 = msg("18243", dup227); + +var msg20420 = msg("18244", dup197); + +var msg20421 = msg("18245", dup197); + +var msg20422 = msg("18246", dup197); + +var msg20423 = msg("18247", dup269); + +var msg20424 = msg("18248", dup197); + +var msg20425 = msg("18249", dup201); + +var msg20426 = msg("18250", dup197); + +var msg20427 = msg("18251", dup263); + +var msg20428 = msg("18252", dup255); + +var msg20429 = msg("18253", dup263); + +var msg20430 = msg("18254", dup263); + +var msg20431 = msg("18255", dup263); + +var msg20432 = msg("18256", dup263); + +var msg20433 = msg("18257", dup263); + +var msg20434 = msg("18258", dup263); + +var msg20435 = msg("18259", dup263); + +var msg20436 = msg("18260", dup263); + +var msg20437 = msg("18261", dup267); + +var msg20438 = msg("18262", dup267); + +var msg20439 = msg("18263", dup287); + +var msg20440 = msg("18264", dup287); + +var msg20441 = msg("18265", dup265); + +var msg20442 = msg("18266", dup255); + +var msg20443 = msg("18267", dup255); + +var msg20444 = msg("18268", dup263); + +var msg20445 = msg("18269", dup263); + +var msg20446 = msg("18270", dup263); + +var msg20447 = msg("18271", dup263); + +var msg20448 = msg("18272", dup263); + +var msg20449 = msg("18273", dup265); + +var msg20450 = msg("18274", dup265); + +var msg20451 = msg("18275", dup265); + +var msg20452 = msg("18276", dup202); + +var msg20453 = msg("18277", dup267); + +var msg20454 = msg("18278", dup276); + +var msg20455 = msg("18279", dup192); + +var msg20456 = msg("18280", dup267); + +var msg20457 = msg("18281", dup192); + +var msg20458 = msg("18282", dup267); + +var msg20459 = msg("18283", dup197); + +var msg20460 = msg("18284", dup197); + +var msg20461 = msg("18285", dup197); + +var msg20462 = msg("18286", dup267); + +var msg20463 = msg("18287", dup197); + +var msg20464 = msg("18288", dup197); + +var msg20465 = msg("18289", dup197); + +var msg20466 = msg("18290", dup197); + +var msg20467 = msg("18291", dup197); + +var msg20468 = msg("18292", dup197); + +var msg20469 = msg("18293", dup199); + +var msg20470 = msg("18294", dup197); + +var msg20471 = msg("18295", dup197); + +var msg20472 = msg("18296", dup267); + +var msg20473 = msg("18297", dup197); + +var msg20474 = msg("18298", dup267); + +var msg20475 = msg("18299", dup265); + +var msg20476 = msg("18300", dup199); + +var msg20477 = msg("18301", dup267); + +var msg20478 = msg("18302", dup267); + +var msg20479 = msg("18303", dup201); + +var msg20480 = msg("18304", dup267); + +var msg20481 = msg("18305", dup267); + +var msg20482 = msg("18306", dup267); + +var msg20483 = msg("18307", dup267); + +var msg20484 = msg("18308", dup197); + +var msg20485 = msg("18309", dup197); + +var msg20486 = msg("18310", dup267); + +var msg20487 = msg("18311", dup265); + +var msg20488 = msg("18312", dup197); + +var msg20489 = msg("18313", dup267); + +var msg20490 = msg("18314", dup201); + +var msg20491 = msg("18315", dup201); + +var msg20492 = msg("18316", dup255); + +var msg20493 = msg("18317", dup201); + +var msg20494 = msg("18318", dup202); + +var msg20495 = msg("18319", dup201); + +var msg20496 = msg("18320", dup197); + +var msg20497 = msg("18321", dup265); + +var msg20498 = msg("18322", dup265); + +var msg20499 = msg("18323", dup265); + +var msg20500 = msg("18324", dup265); + +var msg20501 = msg("18325", dup265); + +var msg20502 = msg("18326", dup227); + +var msg20503 = msg("18327", dup197); + +var msg20504 = msg("18328", dup267); + +var msg20505 = msg("18329", dup265); + +var msg20506 = msg("18330", dup276); + +var msg20507 = msg("18331", dup197); + +var msg20508 = msg("18332", dup267); + +var msg20509 = msg("18333", dup267); + +var msg20510 = msg("18334", dup267); + +var msg20511 = msg("18335", dup265); + +var msg20512 = msg("18336", dup269); + +var msg20513 = msg("18337", dup269); + +var msg20514 = msg("18338", dup269); + +var msg20515 = msg("18339", dup269); + +var msg20516 = msg("18340", dup269); + +var msg20517 = msg("18341", dup269); + +var msg20518 = msg("18342", dup269); + +var msg20519 = msg("18343", dup269); + +var msg20520 = msg("18344", dup269); + +var msg20521 = msg("18345", dup269); + +var msg20522 = msg("18346", dup269); + +var msg20523 = msg("18347", dup269); + +var msg20524 = msg("18348", dup269); + +var msg20525 = msg("18349", dup269); + +var msg20526 = msg("18350", dup269); + +var msg20527 = msg("18351", dup269); + +var msg20528 = msg("18352", dup269); + +var msg20529 = msg("18353", dup269); + +var msg20530 = msg("18354", dup269); + +var msg20531 = msg("18355", dup269); + +var msg20532 = msg("18356", dup269); + +var msg20533 = msg("18357", dup269); + +var msg20534 = msg("18358", dup269); + +var msg20535 = msg("18359", dup269); + +var msg20536 = msg("18360", dup269); + +var msg20537 = msg("18361", dup269); + +var msg20538 = msg("18362", dup269); + +var msg20539 = msg("18363", dup269); + +var msg20540 = msg("18364", dup269); + +var msg20541 = msg("18365", dup269); + +var msg20542 = msg("18366", dup269); + +var msg20543 = msg("18367", dup269); + +var msg20544 = msg("18368", dup269); + +var msg20545 = msg("18369", dup269); + +var msg20546 = msg("18370", dup269); + +var msg20547 = msg("18371", dup269); + +var msg20548 = msg("18372", dup269); + +var msg20549 = msg("18373", dup269); + +var msg20550 = msg("18374", dup269); + +var msg20551 = msg("18375", dup269); + +var msg20552 = msg("18376", dup269); + +var msg20553 = msg("18377", dup269); + +var msg20554 = msg("18378", dup269); + +var msg20555 = msg("18379", dup269); + +var msg20556 = msg("18380", dup269); + +var msg20557 = msg("18381", dup269); + +var msg20558 = msg("18382", dup269); + +var msg20559 = msg("18383", dup269); + +var msg20560 = msg("18384", dup269); + +var msg20561 = msg("18385", dup269); + +var msg20562 = msg("18386", dup269); + +var msg20563 = msg("18387", dup269); + +var msg20564 = msg("18388", dup269); + +var msg20565 = msg("18389", dup269); + +var msg20566 = msg("18390", dup269); + +var msg20567 = msg("18391", dup269); + +var msg20568 = msg("18392", dup269); + +var msg20569 = msg("18393", dup269); + +var msg20570 = msg("18394", dup269); + +var msg20571 = msg("18395", dup269); + +var msg20572 = msg("18396", dup265); + +var msg20573 = msg("18397", dup267); + +var msg20574 = msg("18398", dup265); + +var msg20575 = msg("18399", dup267); + +var msg20576 = msg("18400", dup202); + +var msg20577 = msg("18401", dup201); + +var msg20578 = msg("18402", dup267); + +var msg20579 = msg("18403", dup197); + +var msg20580 = msg("18404", dup267); + +var msg20581 = msg("18405", dup197); + +var msg20582 = msg("18406", dup201); + +var msg20583 = msg("18407", dup287); + +var msg20584 = msg("18408", dup267); + +var msg20585 = msg("18409", dup267); + +var msg20586 = msg("18410", dup267); + +var msg20587 = msg("18411", dup202); + +var msg20588 = msg("18412", dup202); + +var msg20589 = msg("18413", dup267); + +var msg20590 = msg("18414", dup265); + +var msg20591 = msg("18415", dup202); + +var msg20592 = msg("18416", dup197); + +var msg20593 = msg("18417", dup197); + +var msg20594 = msg("18418", dup267); + +var msg20595 = msg("18419", dup267); + +var msg20596 = msg("18420", dup201); + +var msg20597 = msg("18421", dup267); + +var msg20598 = msg("18422", dup306); + +var msg20599 = msg("18423", dup306); + +var msg20600 = msg("18424", dup306); + +var msg20601 = msg("18425", dup306); + +var msg20602 = msg("18426", dup260); + +var msg20603 = msg("18427", dup311); + +var msg20604 = msg("18428", dup311); + +var msg20605 = msg("18429", dup311); + +var msg20606 = msg("18430", dup311); + +var msg20607 = msg("18431", dup260); + +var msg20608 = msg("18432", dup267); + +var msg20609 = msg("18433", dup276); + +var msg20610 = msg("18434", dup276); + +var msg20611 = msg("18435", dup276); + +var msg20612 = msg("18436", dup276); + +var msg20613 = msg("18437", dup276); + +var msg20614 = msg("18438", dup276); + +var msg20615 = msg("18439", dup267); + +var msg20616 = msg("18440", dup267); + +var msg20617 = msg("18441", dup267); + +var msg20618 = msg("18442", dup267); + +var msg20619 = msg("18443", dup267); + +var msg20620 = msg("18444", dup202); + +var msg20621 = msg("18445", dup267); + +var msg20622 = msg("18446", dup276); + +var msg20623 = msg("18447", dup267); + +var msg20624 = msg("18448", dup267); + +var msg20625 = msg("18449", dup267); + +var msg20626 = msg("18450", dup202); + +var msg20627 = msg("18451", dup197); + +var msg20628 = msg("18452", dup267); + +var msg20629 = msg("18453", dup267); + +var msg20630 = msg("18454", dup267); + +var msg20631 = msg("18455", dup202); + +var msg20632 = msg("18456", dup265); + +var msg20633 = msg("18457", dup197); + +var msg20634 = msg("18458", dup202); + +var msg20635 = msg("18459", dup202); + +var msg20636 = msg("18460", dup197); + +var msg20637 = msg("18461", dup197); + +var msg20638 = msg("18462", dup197); + +var msg20639 = msg("18463", dup267); + +var msg20640 = msg("18464", dup265); + +var msg20641 = msg("18465", dup267); + +var msg20642 = msg("18466", dup267); + +var msg20643 = msg("18467", dup267); + +var msg20644 = msg("18468", dup197); + +var msg20645 = msg("18469", dup255); + +var msg20646 = msg("18470", dup198); + +var msg20647 = msg("18471", dup198); + +var msg20648 = msg("18472", dup201); + +var msg20649 = msg("18473", dup232); + +var msg20650 = msg("18474", dup232); + +var msg20651 = msg("18475", dup197); + +var msg20652 = msg("18476", dup197); + +var msg20653 = msg("18477", dup197); + +var msg20654 = msg("18478", dup265); + +var msg20655 = msg("18479", dup265); + +var msg20656 = msg("18480", dup197); + +var msg20657 = msg("18481", dup197); + +var msg20658 = msg("18482", dup267); + +var msg20659 = msg("18483", dup197); + +var msg20660 = msg("18484", dup197); + +var msg20661 = msg("18485", dup267); + +var msg20662 = msg("18486", dup267); + +var msg20663 = msg("18487", dup197); + +var msg20664 = msg("18488", dup267); + +var msg20665 = msg("18489", dup276); + +var msg20666 = msg("18490", dup265); + +var msg20667 = msg("18491", dup265); + +var msg20668 = msg("18492", dup263); + +var msg20669 = msg("18493", dup265); + +var msg20670 = msg("18494", dup276); + +var msg20671 = msg("18495", dup267); + +var msg20672 = msg("18496", dup267); + +var msg20673 = msg("18497", dup276); + +var msg20674 = msg("18498", dup267); + +var msg20675 = msg("18499", dup267); + +var msg20676 = msg("18500", dup276); + +var msg20677 = msg("18501", dup263); + +var msg20678 = msg("18502", dup287); + +var msg20679 = msg("18503", dup267); + +var msg20680 = msg("18504", dup197); + +var msg20681 = msg("18505", dup197); + +var msg20682 = msg("18506", dup197); + +var msg20683 = msg("18507", dup197); + +var msg20684 = msg("18508", dup267); + +var msg20685 = msg("18509", dup267); + +var msg20686 = msg("18510", dup197); + +var msg20687 = msg("18511", dup198); + +var msg20688 = msg("18512", dup197); + +var msg20689 = msg("18513", dup260); + +var msg20690 = msg("18514", dup267); + +var msg20691 = msg("18515", dup267); + +var msg20692 = msg("18516", dup202); + +var msg20693 = msg("18517", dup197); + +var msg20694 = msg("18518", dup269); + +var msg20695 = msg("18519", dup269); + +var msg20696 = msg("18520", dup267); + +var msg20697 = msg("18521", dup269); + +var msg20698 = msg("18522", dup269); + +var msg20699 = msg("18523", dup267); + +var msg20700 = msg("18524", dup287); + +var msg20701 = msg("18525", dup197); + +var msg20702 = msg("18526", dup267); + +var msg20703 = msg("18527", dup267); + +var msg20704 = msg("18528", dup265); + +var msg20705 = msg("18529", dup311); + +var msg20706 = msg("18530", dup311); + +var msg20707 = msg("18531", dup201); + +var msg20708 = msg("18532", dup201); + +var msg20709 = msg("18533", dup198); + +var msg20710 = msg("18534", dup198); + +var msg20711 = msg("18535", dup201); + +var msg20712 = msg("18536", dup202); + +var msg20713 = msg("18537", dup197); + +var msg20714 = msg("18538", dup267); + +var msg20715 = msg("18539", dup267); + +var msg20716 = msg("18540", dup267); + +var msg20717 = msg("18541", dup202); + +var msg20718 = msg("18542", dup267); + +var msg20719 = msg("18543", dup202); + +var msg20720 = msg("18544", dup202); + +var msg20721 = msg("18545", dup202); + +var msg20722 = msg("18546", dup202); + +var msg20723 = msg("18547", dup202); + +var msg20724 = msg("18548", dup202); + +var msg20725 = msg("18549", dup202); + +var msg20726 = msg("18550", dup202); + +var msg20727 = msg("18551", dup250); + +var msg20728 = msg("18552", dup250); + +var msg20729 = msg("18553", dup250); + +var msg20730 = msg("18554", dup250); + +var msg20731 = msg("18555", dup267); + +var msg20732 = msg("18556", dup260); + +var msg20733 = msg("18557", dup255); + +var msg20734 = msg("18558", dup255); + +var msg20735 = msg("18559", dup267); + +var msg20736 = msg("18560", dup267); + +var msg20737 = msg("18561", dup197); + +var msg20738 = msg("18562", dup303); + +var msg20739 = msg("18563", dup192); + +var msg20740 = msg("18564", dup303); + +var msg20741 = msg("18565", dup265); + +var msg20742 = msg("18566", dup265); + +var msg20743 = msg("18567", dup265); + +var msg20744 = msg("18568", dup265); + +var msg20745 = msg("18569", dup265); + +var msg20746 = msg("18570", dup265); + +var msg20747 = msg("18571", dup265); + +var msg20748 = msg("18572", dup265); + +var msg20749 = msg("18573", dup265); + +var msg20750 = msg("18574", dup197); + +var msg20751 = msg("18575", dup227); + +var msg20752 = msg("18576", dup265); + +var msg20753 = msg("18577", dup192); + +var msg20754 = msg("18578", dup197); + +var msg20755 = msg("18579", dup197); + +var msg20756 = msg("18580", dup227); + +var msg20757 = msg("18581", dup265); + +var msg20758 = msg("18582", dup265); + +var msg20759 = msg("18583", dup197); + +var msg20760 = msg("18584", dup197); + +var msg20761 = msg("18585", dup267); + +var msg20762 = msg("18586", dup260); + +var msg20763 = msg("18587", dup197); + +var msg20764 = msg("18588", dup227); + +var msg20765 = msg("18589", dup267); + +var msg20766 = msg("18590", dup197); + +var msg20767 = msg("18591", dup197); + +var msg20768 = msg("18592", dup267); + +var msg20769 = msg("18593", dup265); + +var msg20770 = msg("18594", dup202); + +var msg20771 = msg("18595", dup202); + +var msg20772 = msg("18596", dup197); + +var msg20773 = msg("18597", dup197); + +var msg20774 = msg("18598", dup227); + +var msg20775 = msg("18599", dup197); + +var msg20776 = msg("18600", dup197); + +var msg20777 = msg("18601", dup202); + +var msg20778 = msg("18602", dup260); + +var msg20779 = msg("18603", dup197); + +var msg20780 = msg("18604", dup201); + +var msg20781 = msg("18605", dup197); + +var msg20782 = msg("18606", dup202); + +var msg20783 = msg("18607", dup202); + +var msg20784 = msg("18608", dup202); + +var msg20785 = msg("18609", dup202); + +var msg20786 = msg("18610", dup197); + +var msg20787 = msg("18611", dup309); + +var msg20788 = msg("18612", dup309); + +var msg20789 = msg("18613", dup309); + +var msg20790 = msg("18614", dup202); + +var msg20791 = msg("18615", dup197); + +var msg20792 = msg("18616", dup197); + +var msg20793 = msg("18617", dup202); + +var msg20794 = msg("18618", dup202); + +var msg20795 = msg("18619", dup267); + +var msg20796 = msg("18620", dup267); + +var msg20797 = msg("18621", dup267); + +var msg20798 = msg("18622", dup267); + +var msg20799 = msg("18623", dup267); + +var msg20800 = msg("18624", dup267); + +var msg20801 = msg("18625", dup276); + +var msg20802 = msg("18626", dup276); + +var msg20803 = msg("18627", dup276); + +var msg20804 = msg("18628", dup276); + +var msg20805 = msg("18629", dup276); + +var msg20806 = msg("18630", dup197); + +var msg20807 = msg("18631", dup197); + +var msg20808 = msg("18632", dup267); + +var msg20809 = msg("18633", dup267); + +var msg20810 = msg("18634", dup267); + +var msg20811 = msg("18635", dup202); + +var msg20812 = msg("18636", dup267); + +var msg20813 = msg("18637", dup267); + +var msg20814 = msg("18638", dup267); + +var msg20815 = msg("18639", dup267); + +var msg20816 = msg("18640", dup265); + +var msg20817 = msg("18641", dup267); + +var msg20818 = msg("18642", dup197); + +var msg20819 = msg("18643", dup197); + +var msg20820 = msg("18644", dup267); + +var msg20821 = msg("18645", dup267); + +var msg20822 = msg("18646", dup267); + +var msg20823 = msg("18647", dup311); + +var msg20824 = msg("18648", dup202); + +var msg20825 = msg("18649", dup197); + +var msg20826 = msg("18650", dup276); + +var msg20827 = msg("18651", dup197); + +var msg20828 = msg("18652", dup197); + +var msg20829 = msg("18653", dup314); + +var msg20830 = msg("18654", dup202); + +var msg20831 = msg("18655", dup267); + +var msg20832 = msg("18656", dup197); + +var msg20833 = msg("18657", dup267); + +var msg20834 = msg("18658", dup197); + +var msg20835 = msg("18659", dup197); + +var msg20836 = msg("18660", dup197); + +var msg20837 = msg("18661", dup267); + +var msg20838 = msg("18662", dup267); + +var msg20839 = msg("18663", dup267); + +var msg20840 = msg("18664", dup267); + +var msg20841 = msg("18665", dup267); + +var msg20842 = msg("18666", dup267); + +var msg20843 = msg("18667", dup267); + +var msg20844 = msg("18668", dup265); + +var msg20845 = msg("18669", dup265); + +var msg20846 = msg("18670", dup267); + +var msg20847 = msg("18671", dup267); + +var msg20848 = msg("18672", dup265); + +var msg20849 = msg("18673", dup267); + +var msg20850 = msg("18674", dup265); + +var msg20851 = msg("18675", dup265); + +var msg20852 = msg("18676", dup197); + +var msg20853 = msg("18677", dup309); + +var msg20854 = msg("18678", dup267); + +var msg20855 = msg("18679", dup267); + +var msg20856 = msg("18680", dup202); + +var msg20857 = msg("18681", dup202); + +var msg20858 = msg("18682", dup202); + +var msg20859 = msg("18683", dup202); + +var msg20860 = msg("18684", dup202); + +var msg20861 = msg("18685", dup202); + +var msg20862 = msg("18686", dup192); + +var msg20863 = msg("18687", dup192); + +var msg20864 = msg("18688", dup192); + +var msg20865 = msg("18689", dup192); + +var msg20866 = msg("18690", dup192); + +var msg20867 = msg("18691", dup202); + +var msg20868 = msg("18700", dup202); + +var msg20869 = msg("18701", dup250); + +var msg20870 = msg("18702", dup250); + +var msg20871 = msg("18703", dup250); + +var msg20872 = msg("18704", dup250); + +var msg20873 = msg("18705", dup250); + +var msg20874 = msg("18706", dup202); + +var msg20875 = msg("18707", dup303); + +var msg20876 = msg("18708", dup263); + +var msg20877 = msg("18709", dup192); + +var msg20878 = msg("18710", dup197); + +var msg20879 = msg("18711", dup303); + +var msg20880 = msg("18712", dup263); + +var msg20881 = msg("18713", dup198); + +var msg20882 = msg("18714", dup198); + +var msg20883 = msg("18715", dup303); + +var msg20884 = msg("18716", dup192); + +var msg20885 = msg("18717", dup192); + +var msg20886 = msg("18718", dup303); + +var msg20887 = msg("18719", dup192); + +var msg20888 = msg("18720", dup192); + +var msg20889 = msg("18721", dup197); + +var msg20890 = msg("18722", dup197); + +var msg20891 = msg("18723", dup303); + +var msg20892 = msg("18724", dup303); + +var msg20893 = msg("18725", dup197); + +var msg20894 = msg("18726", dup197); + +var msg20895 = msg("18727", dup197); + +var msg20896 = msg("18728", dup197); + +var msg20897 = msg("18729", dup197); + +var msg20898 = msg("18730", dup197); + +var msg20899 = msg("18731", dup197); + +var msg20900 = msg("18732", dup197); + +var msg20901 = msg("18733", dup197); + +var msg20902 = msg("18734", dup197); + +var msg20903 = msg("18735", dup197); + +var msg20904 = msg("18736", dup197); + +var msg20905 = msg("18737", dup197); + +var msg20906 = msg("18738", dup197); + +var msg20907 = msg("18739", dup238); + +var msg20908 = msg("18740", dup267); + +var msg20909 = msg("18741", dup265); + +var msg20910 = msg("18742", dup267); + +var msg20911 = msg("18743", dup267); + +var msg20912 = msg("18744", dup197); + +var msg20913 = msg("18745", dup197); + +var msg20914 = msg("18746", dup197); + +var msg20915 = msg("18747", dup197); + +var msg20916 = msg("18748", dup197); + +var msg20917 = msg("18749", dup197); + +var msg20918 = msg("18750", dup201); + +var msg20919 = msg("18751", dup197); + +var msg20920 = msg("18752", dup197); + +var msg20921 = msg("18753", dup267); + +var msg20922 = msg("18754", dup267); + +var msg20923 = msg("18755", dup267); + +var msg20924 = msg("18756", dup267); + +var msg20925 = msg("18757", dup267); + +var msg20926 = msg("18758", dup287); + +var msg20927 = msg("18759", dup197); + +var msg20928 = msg("18760", dup197); + +var msg20929 = msg("18761", dup265); + +var msg20930 = msg("18762", dup269); + +var msg20931 = msg("18763", dup197); + +var msg20932 = msg("18764", dup201); + +var msg20933 = msg("18765", dup250); + +var msg20934 = msg("18766", dup267); + +var msg20935 = msg("18767", dup201); + +var msg20936 = msg("18768", dup197); + +var msg20937 = msg("18769", dup197); + +var msg20938 = msg("18770", dup267); + +var msg20939 = msg("18771", dup267); + +var msg20940 = msg("18772", dup267); + +var msg20941 = msg("18773", dup269); + +var msg20942 = msg("18774", dup269); + +var msg20943 = msg("18775", dup269); + +var msg20944 = msg("18776", dup267); + +var msg20945 = msg("18777", dup198); + +var msg20946 = msg("18778", dup197); + +var msg20947 = msg("18779", dup197); + +var msg20948 = msg("18780", dup197); + +var msg20949 = msg("18781", dup197); + +var msg20950 = msg("18782", dup269); + +var msg20951 = msg("18783", dup197); + +var msg20952 = msg("18784", dup197); + +var msg20953 = msg("18785", dup197); + +var msg20954 = msg("18786", dup197); + +var msg20955 = msg("18787", dup197); + +var msg20956 = msg("18788", dup197); + +var msg20957 = msg("18789", dup197); + +var msg20958 = msg("18790", dup201); + +var msg20959 = msg("18791", dup197); + +var msg20960 = msg("18792", dup267); + +var msg20961 = msg("18793", dup267); + +var msg20962 = msg("18794", dup265); + +var msg20963 = msg("18795", dup267); + +var msg20964 = msg("18796", dup197); + +var msg20965 = msg("18797", dup267); + +var msg20966 = msg("18798", dup198); + +var msg20967 = msg("18799", dup198); + +var msg20968 = msg("18800", dup202); + +var msg20969 = msg("18801", dup267); + +var msg20970 = msg("18802", dup265); + +var msg20971 = msg("18803", dup197); + +var msg20972 = msg("18804", dup267); + +var msg20973 = msg("18805", dup267); + +var msg20974 = msg("18806", dup267); + +var msg20975 = msg("18807", dup198); + +var msg20976 = msg("18808", dup201); + +var msg20977 = msg("18809", dup197); + +var msg20978 = msg("18810", dup265); + +var msg20979 = msg("18811", dup250); + +var msg20980 = msg("18812", dup250); + +var msg20981 = msg("18813", dup250); + +var msg20982 = msg("18814", dup250); + +var msg20983 = msg("18815", dup250); + +var msg20984 = msg("18816", dup250); + +var msg20985 = msg("18817", dup250); + +var msg20986 = msg("18818", dup250); + +var msg20987 = msg("18819", dup250); + +var msg20988 = msg("18820", dup250); + +var msg20989 = msg("18821", dup250); + +var msg20990 = msg("18822", dup250); + +var msg20991 = msg("18823", dup250); + +var msg20992 = msg("18824", dup250); + +var msg20993 = msg("18825", dup250); + +var msg20994 = msg("18826", dup250); + +var msg20995 = msg("18827", dup250); + +var msg20996 = msg("18828", dup250); + +var msg20997 = msg("18829", dup250); + +var msg20998 = msg("18830", dup250); + +var msg20999 = msg("18831", dup250); + +var msg21000 = msg("18832", dup250); + +var msg21001 = msg("18833", dup250); + +var msg21002 = msg("18834", dup250); + +var msg21003 = msg("18835", dup250); + +var msg21004 = msg("18836", dup250); + +var msg21005 = msg("18837", dup250); + +var msg21006 = msg("18838", dup250); + +var msg21007 = msg("18839", dup250); + +var msg21008 = msg("18840", dup250); + +var msg21009 = msg("18841", dup250); + +var msg21010 = msg("18842", dup250); + +var msg21011 = msg("18843", dup250); + +var msg21012 = msg("18844", dup250); + +var msg21013 = msg("18845", dup250); + +var msg21014 = msg("18846", dup250); + +var msg21015 = msg("18847", dup250); + +var msg21016 = msg("18848", dup250); + +var msg21017 = msg("18849", dup250); + +var msg21018 = msg("18850", dup250); + +var msg21019 = msg("18851", dup250); + +var msg21020 = msg("18852", dup250); + +var msg21021 = msg("18853", dup250); + +var msg21022 = msg("18854", dup250); + +var msg21023 = msg("18855", dup250); + +var msg21024 = msg("18856", dup250); + +var msg21025 = msg("18857", dup250); + +var msg21026 = msg("18858", dup250); + +var msg21027 = msg("18859", dup250); + +var msg21028 = msg("18860", dup250); + +var msg21029 = msg("18861", dup250); + +var msg21030 = msg("18862", dup250); + +var msg21031 = msg("18863", dup250); + +var msg21032 = msg("18864", dup250); + +var msg21033 = msg("18865", dup250); + +var msg21034 = msg("18866", dup250); + +var msg21035 = msg("18867", dup250); + +var msg21036 = msg("18868", dup250); + +var msg21037 = msg("18869", dup250); + +var msg21038 = msg("18870", dup250); + +var msg21039 = msg("18871", dup250); + +var msg21040 = msg("18872", dup250); + +var msg21041 = msg("18873", dup250); + +var msg21042 = msg("18874", dup250); + +var msg21043 = msg("18875", dup250); + +var msg21044 = msg("18876", dup250); + +var msg21045 = msg("18877", dup250); + +var msg21046 = msg("18878", dup250); + +var msg21047 = msg("18879", dup250); + +var msg21048 = msg("18880", dup250); + +var msg21049 = msg("18881", dup250); + +var msg21050 = msg("18882", dup250); + +var msg21051 = msg("18883", dup250); + +var msg21052 = msg("18884", dup250); + +var msg21053 = msg("18885", dup250); + +var msg21054 = msg("18886", dup250); + +var msg21055 = msg("18887", dup250); + +var msg21056 = msg("18888", dup250); + +var msg21057 = msg("18889", dup250); + +var msg21058 = msg("18890", dup250); + +var msg21059 = msg("18891", dup250); + +var msg21060 = msg("18892", dup250); + +var msg21061 = msg("18893", dup250); + +var msg21062 = msg("18894", dup250); + +var msg21063 = msg("18895", dup250); + +var msg21064 = msg("18896", dup250); + +var msg21065 = msg("18897", dup250); + +var msg21066 = msg("18898", dup250); + +var msg21067 = msg("18899", dup250); + +var msg21068 = msg("18900", dup269); + +var msg21069 = msg("18901", dup267); + +var msg21070 = msg("18902", dup267); + +var msg21071 = msg("18903", dup267); + +var msg21072 = msg("18904", dup265); + +var msg21073 = msg("18905", dup197); + +var msg21074 = msg("18906", dup197); + +var msg21075 = msg("18907", dup197); + +var msg21076 = msg("18908", dup197); + +var msg21077 = msg("18909", dup197); + +var msg21078 = msg("18910", dup197); + +var msg21079 = msg("18911", dup197); + +var msg21080 = msg("18912", dup197); + +var msg21081 = msg("18913", dup197); + +var msg21082 = msg("18914", dup197); + +var msg21083 = msg("18915", dup197); + +var msg21084 = msg("18916", dup197); + +var msg21085 = msg("18917", dup197); + +var msg21086 = msg("18918", dup197); + +var msg21087 = msg("18919", dup197); + +var msg21088 = msg("18920", dup197); + +var msg21089 = msg("18921", dup197); + +var msg21090 = msg("18922", dup197); + +var msg21091 = msg("18923", dup197); + +var msg21092 = msg("18924", dup197); + +var msg21093 = msg("18925", dup197); + +var msg21094 = msg("18926", dup201); + +var msg21095 = msg("18927", dup265); + +var msg21096 = msg("18928", dup197); + +var msg21097 = msg("18929", dup199); + +var msg21098 = msg("18930", dup267); + +var msg21099 = msg("18931", dup267); + +var msg21100 = msg("18932", dup265); + +var msg21101 = msg("18933", dup274); + +var msg21102 = msg("18934", dup197); + +var msg21103 = msg("18935", dup198); + +var msg21104 = msg("18936", dup269); + +var msg21105 = msg("18937", dup269); + +var msg21106 = msg("18938", dup269); + +var msg21107 = msg("18939", dup202); + +var msg21108 = msg("18940", dup269); + +var msg21109 = msg("18941", dup202); + +var msg21110 = msg("18942", dup269); + +var msg21111 = msg("18943", dup269); + +var msg21112 = msg("18944", dup269); + +var msg21113 = msg("18945", dup263); + +var msg21114 = msg("18946", dup192); + +var msg21115 = msg("18947", dup192); + +var msg21116 = msg("18948", dup267); + +var msg21117 = msg("18949", dup267); + +var msg21118 = msg("18950", dup267); + +var msg21119 = msg("18951", dup267); + +var msg21120 = msg("18952", dup267); + +var msg21121 = msg("18953", dup267); + +var msg21122 = msg("18954", dup267); + +var msg21123 = msg("18955", dup201); + +var msg21124 = msg("18956", dup201); + +var msg21125 = msg("18957", dup267); + +var msg21126 = msg("18958", dup267); + +var msg21127 = msg("18959", dup267); + +var msg21128 = msg("18960", dup267); + +var msg21129 = msg("18961", dup265); + +var msg21130 = msg("18962", dup265); + +var msg21131 = msg("18963", dup201); + +var msg21132 = msg("18964", dup267); + +var msg21133 = msg("18965", dup201); + +var msg21134 = msg("18966", dup267); + +var msg21135 = msg("18967", dup287); + +var msg21136 = msg("18968", dup201); + +var msg21137 = msg("18969", dup201); + +var msg21138 = msg("18970", dup202); + +var msg21139 = msg("18971", dup202); + +var msg21140 = msg("18972", dup199); + +var msg21141 = msg("18973", dup267); + +var msg21142 = msg("18974", dup265); + +var msg21143 = msg("18975", dup265); + +var msg21144 = msg("18976", dup202); + +var msg21145 = msg("18977", dup192); + +var msg21146 = msg("18978", dup192); + +var msg21147 = msg("18979", dup238); + +var msg21148 = msg("18980", dup303); + +var msg21149 = msg("18981", dup303); + +var msg21150 = msg("18982", dup303); + +var msg21151 = msg("18983", dup267); + +var msg21152 = msg("18984", dup269); + +var msg21153 = msg("18985", dup265); + +var msg21154 = msg("18986", dup267); + +var msg21155 = msg("18987", dup267); + +var msg21156 = msg("18988", dup267); + +var msg21157 = msg("18989", dup267); + +var msg21158 = msg("18990", dup267); + +var msg21159 = msg("18991", dup267); + +var msg21160 = msg("18992", dup267); + +var msg21161 = msg("18993", dup267); + +var msg21162 = msg("18994", dup197); + +var msg21163 = msg("18995", dup202); + +var msg21164 = msg("18996", dup202); + +var msg21165 = msg("18997", dup198); + +var msg21166 = msg("18998", dup197); + +var msg21167 = msg("18999", dup197); + +var msg21168 = msg("19000", dup240); + +var msg21169 = msg("19001", dup240); + +var msg21170 = msg("19002", dup197); + +var msg21171 = msg("19003", dup202); + +var msg21172 = msg("19004", dup202); + +var msg21173 = msg("19005", dup267); + +var msg21174 = msg("19006", dup197); + +var msg21175 = msg("19007", dup197); + +var msg21176 = msg("19008", dup267); + +var msg21177 = msg("19009", dup267); + +var msg21178 = msg("19010", dup267); + +var msg21179 = msg("19011", dup197); + +var msg21180 = msg("19012", dup197); + +var msg21181 = msg("19013", dup295); + +var msg21182 = msg("19014", dup295); + +var msg21183 = msg("19015", dup312); + +var msg21184 = msg("19016", dup192); + +var msg21185 = msg("19017", dup192); + +var msg21186 = msg("19018", dup192); + +var msg21187 = msg("19019", dup192); + +var msg21188 = msg("19020", dup267); + +var msg21189 = msg("19021", dup192); + +var msg21190 = msg("19022", dup192); + +var msg21191 = msg("19023", dup192); + +var msg21192 = msg("19024", dup192); + +var msg21193 = msg("19025", dup192); + +var msg21194 = msg("19026", dup303); + +var msg21195 = msg("19027", dup202); + +var msg21196 = msg("19028", dup192); + +var msg21197 = msg("19029", dup192); + +var msg21198 = msg("19030", dup192); + +var msg21199 = msg("19031", dup202); + +var msg21200 = msg("19032", dup192); + +var msg21201 = msg("19033", dup192); + +var msg21202 = msg("19034", dup192); + +var msg21203 = msg("19035", dup192); + +var msg21204 = msg("19036", dup192); + +var msg21205 = msg("19037", dup192); + +var msg21206 = msg("19038", dup192); + +var msg21207 = msg("19039", dup192); + +var msg21208 = msg("19040", dup192); + +var msg21209 = msg("19041", dup192); + +var msg21210 = msg("19042", dup192); + +var msg21211 = msg("19043", dup303); + +var msg21212 = msg("19044", dup303); + +var msg21213 = msg("19045", dup192); + +var msg21214 = msg("19046", dup303); + +var msg21215 = msg("19047", dup303); + +var msg21216 = msg("19048", dup192); + +var msg21217 = msg("19049", dup192); + +var msg21218 = msg("19050", dup192); + +var msg21219 = msg("19051", dup192); + +var msg21220 = msg("19052", dup265); + +var msg21221 = msg("19053", dup238); + +var msg21222 = msg("19054", dup192); + +var msg21223 = msg("19055", dup192); + +var msg21224 = msg("19056", dup192); + +var msg21225 = msg("19057", dup192); + +var msg21226 = msg("19058", dup238); + +var msg21227 = msg("19059", dup303); + +var msg21228 = msg("19060", dup192); + +var msg21229 = msg("19061", dup263); + +var msg21230 = msg("19062", dup192); + +var msg21231 = msg("19063", dup197); + +var msg21232 = msg("19064", dup267); + +var msg21233 = msg("19065", dup202); + +var msg21234 = msg("19066", dup202); + +var msg21235 = msg("19067", dup202); + +var msg21236 = msg("19068", dup202); + +var msg21237 = msg("19069", dup202); + +var msg21238 = msg("19070", dup202); + +var msg21239 = msg("19071", dup267); + +var msg21240 = msg("19072", dup197); + +var msg21241 = msg("19073", dup198); + +var msg21242 = msg("19074", dup265); + +var msg21243 = msg("19075", dup202); + +var msg21244 = msg("19076", dup202); + +var msg21245 = msg("19077", dup202); + +var msg21246 = msg("19078", dup267); + +var msg21247 = msg("19079", dup267); + +var msg21248 = msg("19080", dup267); + +var msg21249 = msg("19081", dup267); + +var msg21250 = msg("19082", dup267); + +var msg21251 = msg("19083", dup267); + +var msg21252 = msg("19084", dup267); + +var msg21253 = msg("19085", dup265); + +var msg21254 = msg("19086", dup202); + +var msg21255 = msg("19087", dup197); + +var msg21256 = msg("19088", dup197); + +var msg21257 = msg("19089", dup197); + +var msg21258 = msg("19090", dup197); + +var msg21259 = msg("19091", dup202); + +var msg21260 = msg("19092", dup202); + +var msg21261 = msg("19093", dup240); + +var msg21262 = msg("19094", dup240); + +var msg21263 = msg("19095", dup267); + +var msg21264 = msg("19096", dup267); + +var msg21265 = msg("19097", dup267); + +var msg21266 = msg("19098", dup202); + +var msg21267 = msg("19099", dup267); + +var msg21268 = msg("19100", dup197); + +var msg21269 = msg("19101", dup198); + +var msg21270 = msg("19102", dup265); + +var msg21271 = msg("19103", dup265); + +var msg21272 = msg("19104", dup197); + +var msg21273 = msg("19105", dup197); + +var msg21274 = msg("19106", dup303); + +var msg21275 = msg("19107", dup267); + +var msg21276 = msg("19108", dup265); + +var msg21277 = msg("19109", dup265); + +var msg21278 = msg("19110", dup265); + +var msg21279 = msg("19111", dup198); + +var msg21280 = msg("19112", dup197); + +var msg21281 = msg("19113", dup197); + +var msg21282 = msg("19114", dup197); + +var msg21283 = msg("19115", dup197); + +var msg21284 = msg("19116", dup267); + +var msg21285 = msg("19117", dup197); + +var msg21286 = msg("19118", dup201); + +var msg21287 = msg("19119", dup267); + +var msg21288 = msg("19120", dup197); + +var msg21289 = msg("19121", dup197); + +var msg21290 = msg("19122", dup312); + +var msg21291 = msg("19123", dup202); + +var msg21292 = msg("19124", dup267); + +var msg21293 = msg("19125", dup197); + +var msg21294 = msg("19126", dup197); + +var msg21295 = msg("19127", dup197); + +var msg21296 = msg("19128", dup202); + +var msg21297 = msg("19129", dup202); + +var msg21298 = msg("19130", dup267); + +var msg21299 = msg("19131", dup197); + +var msg21300 = msg("19132", dup197); + +var msg21301 = msg("19133", dup202); + +var msg21302 = msg("19134", dup267); + +var msg21303 = msg("19135", dup192); + +var msg21304 = msg("19136", dup201); + +var msg21305 = msg("19137", dup197); + +var msg21306 = msg("19138", dup197); + +var msg21307 = msg("19139", dup197); + +var msg21308 = msg("19140", dup197); + +var msg21309 = msg("19141", dup267); + +var msg21310 = msg("19142", dup260); + +var msg21311 = msg("19143", dup267); + +var msg21312 = msg("19144", dup267); + +var msg21313 = msg("19145", dup267); + +var msg21314 = msg("19146", dup267); + +var msg21315 = msg("19147", dup267); + +var msg21316 = msg("19148", dup267); + +var msg21317 = msg("19149", dup267); + +var msg21318 = msg("19150", dup267); + +var msg21319 = msg("19151", dup265); + +var msg21320 = msg("19152", dup265); + +var msg21321 = msg("19153", dup267); + +var msg21322 = msg("19154", dup202); + +var msg21323 = msg("19155", dup197); + +var msg21324 = msg("19156", dup197); + +var msg21325 = msg("19157", dup265); + +var msg21326 = msg("19158", dup202); + +var msg21327 = msg("19159", dup198); + +var msg21328 = msg("19160", dup197); + +var msg21329 = msg("19161", dup197); + +var msg21330 = msg("19162", dup202); + +var msg21331 = msg("19163", dup202); + +var msg21332 = msg("19164", dup192); + +var msg21333 = msg("19165", dup269); + +var msg21334 = msg("19166", dup202); + +var msg21335 = msg("19167", dup197); + +var msg21336 = msg("19168", dup197); + +var msg21337 = msg("19169", dup267); + +var msg21338 = msg("19170", dup267); + +var msg21339 = msg("19171", dup267); + +var msg21340 = msg("19172", dup276); + +var msg21341 = msg("19173", dup255); + +var msg21342 = msg("19174", dup267); + +var msg21343 = msg("19175", dup269); + +var msg21344 = msg("19176", dup265); + +var msg21345 = msg("19177", dup265); + +var msg21346 = msg("19178", dup202); + +var msg21347 = msg("19179", dup202); + +var msg21348 = msg("19180", dup267); + +var msg21349 = msg("19181", dup267); + +var msg21350 = msg("19182", dup197); + +var msg21351 = msg("19183", dup197); + +var msg21352 = msg("19184", dup267); + +var msg21353 = msg("19185", dup267); + +var msg21354 = msg("19186", dup265); + +var msg21355 = msg("19187", dup267); + +var msg21356 = msg("19188", dup267); + +var msg21357 = msg("19189", dup197); + +var msg21358 = msg("19190", dup246); + +var msg21359 = msg("19191", dup276); + +var msg21360 = msg("19192", dup198); + +var msg21361 = msg("19193", dup265); + +var msg21362 = msg("19194", dup265); + +var msg21363 = msg("19195", dup202); + +var msg21364 = msg("19196", dup267); + +var msg21365 = msg("19197", dup265); + +var msg21366 = msg("19198", dup265); + +var msg21367 = msg("19199", dup276); + +var msg21368 = msg("19200", dup267); + +var msg21369 = msg("19201", dup260); + +var msg21370 = msg("19202", dup260); + +var msg21371 = msg("19203", dup267); + +var msg21372 = msg("19204", dup267); + +var msg21373 = msg("19205", dup198); + +var msg21374 = msg("19206", dup197); + +var msg21375 = msg("19207", dup197); + +var msg21376 = msg("19208", dup197); + +var msg21377 = msg("19209", dup197); + +var msg21378 = msg("19210", dup197); + +var msg21379 = msg("19211", dup202); + +var msg21380 = msg("19212", dup197); + +var msg21381 = msg("19213", dup197); + +var msg21382 = msg("19214", dup265); + +var msg21383 = msg("19215", dup202); + +var msg21384 = msg("19216", dup267); + +var msg21385 = msg("19217", dup267); + +var msg21386 = msg("19218", dup265); + +var msg21387 = msg("19219", dup267); + +var msg21388 = msg("19220", dup267); + +var msg21389 = msg("19221", dup197); + +var msg21390 = msg("19222", dup267); + +var msg21391 = msg("19223", dup267); + +var msg21392 = msg("19224", dup202); + +var msg21393 = msg("19225", dup267); + +var msg21394 = msg("19226", dup197); + +var msg21395 = msg("19227", dup197); + +var msg21396 = msg("19228", dup199); + +var msg21397 = msg("19229", dup267); + +var msg21398 = msg("19230", dup267); + +var msg21399 = msg("19231", dup267); + +var msg21400 = msg("19232", dup267); + +var msg21401 = msg("19233", dup265); + +var msg21402 = msg("19234", dup265); + +var msg21403 = msg("19235", dup267); + +var msg21404 = msg("19236", dup267); + +var msg21405 = msg("19237", dup267); + +var msg21406 = msg("19238", dup267); + +var msg21407 = msg("19239", dup265); + +var msg21408 = msg("19240", dup265); + +var msg21409 = msg("19241", dup202); + +var msg21410 = msg("19242", dup202); + +var msg21411 = msg("19243", dup267); + +var msg21412 = msg("19244", dup265); + +var msg21413 = msg("19245", dup265); + +var msg21414 = msg("19246", dup265); + +var msg21415 = msg("19247", dup267); + +var msg21416 = msg("19248", dup197); + +var msg21417 = msg("19249", dup267); + +var msg21418 = msg("19250", dup197); + +var msg21419 = msg("19251", dup267); + +var msg21420 = msg("19252", dup265); + +var msg21421 = msg("19253", dup265); + +var msg21422 = msg("19254", dup201); + +var msg21423 = msg("19255", dup201); + +var msg21424 = msg("19256", dup269); + +var msg21425 = msg("19257", dup267); + +var msg21426 = msg("19258", dup267); + +var msg21427 = msg("19259", dup267); + +var msg21428 = msg("19260", dup202); + +var msg21429 = msg("19261", dup267); + +var msg21430 = msg("19262", dup267); + +var msg21431 = msg("19263", dup267); + +var msg21432 = msg("19264", dup267); + +var msg21433 = msg("19265", dup267); + +var msg21434 = msg("19266", dup267); + +var msg21435 = msg("19267", dup199); + +var msg21436 = msg("19268", dup202); + +var msg21437 = msg("19269", dup250); + +var msg21438 = msg("19270", dup250); + +var msg21439 = msg("19271", dup250); + +var msg21440 = msg("19272", dup250); + +var msg21441 = msg("19273", dup250); + +var msg21442 = msg("19274", dup250); + +var msg21443 = msg("19275", dup298); + +var msg21444 = msg("19276", dup298); + +var msg21445 = msg("19277", dup298); + +var msg21446 = msg("19278", dup298); + +var msg21447 = msg("19279", dup298); + +var msg21448 = msg("19280", dup298); + +var msg21449 = msg("19281", dup199); + +var msg21450 = msg("19282", dup199); + +var msg21451 = msg("19283", dup199); + +var msg21452 = msg("19284", dup199); + +var msg21453 = msg("19285", dup199); + +var msg21454 = msg("19286", dup199); + +var msg21455 = msg("19287", dup199); + +var msg21456 = msg("19288", dup199); + +var msg21457 = msg("19289", dup265); + +var msg21458 = msg("19290", dup276); + +var msg21459 = msg("19291", dup276); + +var msg21460 = msg("19292", dup202); + +var msg21461 = msg("19293", dup267); + +var msg21462 = msg("19294", dup267); + +var msg21463 = msg("19295", dup267); + +var msg21464 = msg("19296", dup267); + +var msg21465 = msg("19297", dup201); + +var msg21466 = msg("19298", dup201); + +var msg21467 = msg("19299", dup267); + +var msg21468 = msg("19300", dup267); + +var msg21469 = msg("19301", dup287); + +var msg21470 = msg("19302", dup287); + +var msg21471 = msg("19303", dup267); + +var msg21472 = msg("19304", dup265); + +var msg21473 = msg("19305", dup265); + +var msg21474 = msg("19306", dup267); + +var msg21475 = msg("19307", dup265); + +var msg21476 = msg("19308", dup197); + +var msg21477 = msg("19309", dup303); + +var msg21478 = msg("19310", dup192); + +var msg21479 = msg("19311", dup303); + +var msg21480 = msg("19312", dup192); + +var msg21481 = msg("19313", dup198); + +var msg21482 = msg("19314", dup276); + +var msg21483 = msg("19315", dup267); + +var msg21484 = msg("19316", dup267); + +var msg21485 = msg("19317", dup197); + +var msg21486 = msg("19318", dup267); + +var msg21487 = msg("19319", dup267); + +var msg21488 = msg("19320", dup267); + +var msg21489 = msg("19321", dup197); + +var msg21490 = msg("19322", dup202); + +var msg21491 = msg("19323", dup201); + +var msg21492 = msg("19324", dup303); + +var msg21493 = msg("19325", dup303); + +var msg21494 = msg("19326", dup192); + +var msg21495 = msg("19327", dup192); + +var msg21496 = msg("19328", dup192); + +var msg21497 = msg("19329", dup192); + +var msg21498 = msg("19330", dup192); + +var msg21499 = msg("19331", dup192); + +var msg21500 = msg("19332", dup192); + +var msg21501 = msg("19333", dup197); + +var msg21502 = msg("19334", dup197); + +var msg21503 = msg("19335", dup297); + +var msg21504 = msg("19336", dup297); + +var msg21505 = msg("19337", dup202); + +var msg21506 = msg("19338", dup202); + +var msg21507 = msg("19339", dup192); + +var msg21508 = msg("19340", dup263); + +var msg21509 = msg("19341", dup238); + +var msg21510 = msg("19342", dup263); + +var msg21511 = msg("19343", dup263); + +var msg21512 = msg("19344", dup263); + +var msg21513 = msg("19345", dup192); + +var msg21514 = msg("19346", dup192); + +var msg21515 = msg("19347", dup192); + +var msg21516 = msg("19348", dup192); + +var msg21517 = msg("19349", dup192); + +var msg21518 = msg("19350", dup197); + +var msg21519 = msg("19351", dup192); + +var msg21520 = msg("19352", dup192); + +var msg21521 = msg("19353", dup192); + +var msg21522 = msg("19354", dup192); + +var msg21523 = msg("19355", dup192); + +var msg21524 = msg("19356", dup202); + +var msg21525 = msg("19357", dup238); + +var msg21526 = msg("19358", dup202); + +var msg21527 = msg("19359", dup192); + +var msg21528 = msg("19360", dup192); + +var msg21529 = msg("19361", dup192); + +var msg21530 = msg("19362", dup192); + +var msg21531 = msg("19363", dup192); + +var msg21532 = msg("19364", dup202); + +var msg21533 = msg("19365", dup202); + +var msg21534 = msg("19366", dup192); + +var msg21535 = msg("19367", dup238); + +var msg21536 = msg("19368", dup192); + +var msg21537 = msg("19369", dup192); + +var msg21538 = msg("19370", dup192); + +var msg21539 = msg("19371", dup192); + +var msg21540 = msg("19372", dup269); + +var msg21541 = msg("19373", dup201); + +var msg21542 = msg("19374", dup201); + +var msg21543 = msg("19375", dup287); + +var msg21544 = msg("19376", dup287); + +var msg21545 = msg("19377", dup202); + +var msg21546 = msg("19378", dup202); + +var msg21547 = msg("19379", dup201); + +var msg21548 = msg("19380", dup201); + +var msg21549 = msg("19381", dup287); + +var msg21550 = msg("19382", dup287); + +var msg21551 = msg("19383", dup287); + +var msg21552 = msg("19384", dup287); + +var msg21553 = msg("19385", dup201); + +var msg21554 = msg("19386", dup201); + +var msg21555 = msg("19387", dup287); + +var msg21556 = msg("19388", dup287); + +var msg21557 = msg("19389", dup197); + +var msg21558 = msg("19390", dup197); + +var msg21559 = msg("19391", dup303); + +var msg21560 = msg("19392", dup303); + +var msg21561 = msg("19393", dup303); + +var msg21562 = msg("19394", dup192); + +var msg21563 = msg("19395", dup192); + +var msg21564 = msg("19396", dup192); + +var msg21565 = msg("19397", dup192); + +var msg21566 = msg("19398", dup192); + +var msg21567 = msg("19399", dup238); + +var msg21568 = msg("19400", dup238); + +var msg21569 = msg("19401", dup238); + +var msg21570 = msg("19402", dup238); + +var msg21571 = msg("19403", dup267); + +var msg21572 = msg("19404", dup192); + +var msg21573 = msg("19405", dup267); + +var msg21574 = msg("19406", dup267); + +var msg21575 = msg("19407", dup267); + +var msg21576 = msg("19408", dup267); + +var msg21577 = msg("19409", dup202); + +var msg21578 = msg("19410", dup202); + +var msg21579 = msg("19411", dup269); + +var msg21580 = msg("19412", dup267); + +var msg21581 = msg("19413", dup197); + +var msg21582 = msg("19414", dup197); + +var msg21583 = msg("19415", dup227); + +var msg21584 = msg("19416", dup265); + +var msg21585 = msg("19417", dup265); + +var msg21586 = msg("19418", dup265); + +var msg21587 = msg("19419", dup265); + +var msg21588 = msg("19420", dup197); + +var msg21589 = msg("19421", dup197); + +var msg21590 = msg("19422", dup265); + +var msg21591 = msg("19423", dup265); + +var msg21592 = msg("19424", dup265); + +var msg21593 = msg("19425", dup265); + +var msg21594 = msg("19426", dup192); + +var msg21595 = msg("19427", dup192); + +var msg21596 = msg("19428", dup192); + +var msg21597 = msg("19429", dup198); + +var msg21598 = msg("19430", dup265); + +var msg21599 = msg("19431", dup197); + +var msg21600 = msg("19432", dup197); + +var msg21601 = msg("19433", dup192); + +var msg21602 = msg("19434", dup269); + +var msg21603 = msg("19435", dup192); + +var msg21604 = msg("19436", dup267); + +var msg21605 = msg("19437", dup260); + +var msg21606 = msg("19438", dup260); + +var msg21607 = msg("19439", dup260); + +var msg21608 = msg("19440", dup260); + +var msg21609 = msg("19441", dup199); + +var msg21610 = msg("19442", dup267); + +var msg21611 = msg("19443", dup267); + +var msg21612 = msg("19444", dup265); + +var msg21613 = msg("19445", dup265); + +var msg21614 = msg("19446", dup265); + +var msg21615 = msg("19447", dup265); + +var msg21616 = msg("19448", dup265); + +var msg21617 = msg("19449", dup265); + +var msg21618 = msg("19450", dup265); + +var msg21619 = msg("19451", dup199); + +var msg21620 = msg("19452", dup199); + +var msg21621 = msg("19453", dup192); + +var msg21622 = msg("19454", dup192); + +var msg21623 = msg("19455", dup238); + +var msg21624 = msg("19456", dup192); + +var msg21625 = msg("19457", dup192); + +var msg21626 = msg("19458", dup197); + +var msg21627 = msg("19459", dup197); + +var msg21628 = msg("19460", dup265); + +var msg21629 = msg("19461", dup265); + +var msg21630 = msg("19462", dup267); + +var msg21631 = msg("19463", dup265); + +var msg21632 = msg("19464", dup197); + +var msg21633 = msg("19465", dup276); + +var msg21634 = msg("19466", dup267); + +var msg21635 = msg("19467", dup202); + +var msg21636 = msg("19468", dup267); + +var msg21637 = msg("19469", dup202); + +var msg21638 = msg("19470", dup263); + +var msg21639 = msg("19471", dup317); + +var msg21640 = msg("19472", dup317); + +var msg21641 = msg("19473", dup317); + +var msg21642 = msg("19474", dup202); + +var msg21643 = msg("19475", dup202); + +var msg21644 = msg("19476", dup267); + +var msg21645 = msg("19477", dup192); + +var msg21646 = msg("19478", dup238); + +var msg21647 = msg("19479", dup238); + +var msg21648 = msg("19480", dup198); + +var msg21649 = msg("19481", dup238); + +var msg21650 = msg("19482", dup269); + +var msg21651 = msg("19483", dup192); + +var msg21652 = msg("19484", dup192); + +var msg21653 = msg("19485", dup303); + +var msg21654 = msg("19486", dup303); + +var msg21655 = msg("19487", dup192); + +var msg21656 = msg("19488", dup238); + +var msg21657 = msg("19489", dup192); + +var msg21658 = msg("19490", dup192); + +var msg21659 = msg("19491", dup192); + +var msg21660 = msg("19492", dup192); + +var msg21661 = msg("19493", dup269); + +var msg21662 = msg("19494", dup192); + +var msg21663 = msg("19495", dup238); + +var msg21664 = msg("19496", dup263); + +var msg21665 = msg("19497", dup263); + +var msg21666 = msg("19498", dup263); + +var msg21667 = msg("19499", dup263); + +var msg21668 = msg("19500", dup263); + +var msg21669 = msg("19501", dup263); + +var msg21670 = msg("19502", dup263); + +var msg21671 = msg("19503", dup263); + +var msg21672 = msg("19504", dup263); + +var msg21673 = msg("19505", dup263); + +var msg21674 = msg("19506", dup263); + +var msg21675 = msg("19507", dup263); + +var msg21676 = msg("19508", dup263); + +var msg21677 = msg("19509", dup263); + +var msg21678 = msg("19510", dup263); + +var msg21679 = msg("19511", dup263); + +var msg21680 = msg("19512", dup263); + +var msg21681 = msg("19513", dup263); + +var msg21682 = msg("19514", dup263); + +var msg21683 = msg("19515", dup263); + +var msg21684 = msg("19516", dup263); + +var msg21685 = msg("19517", dup263); + +var msg21686 = msg("19518", dup263); + +var msg21687 = msg("19519", dup263); + +var msg21688 = msg("19520", dup263); + +var msg21689 = msg("19521", dup263); + +var msg21690 = msg("19522", dup263); + +var msg21691 = msg("19523", dup263); + +var msg21692 = msg("19524", dup263); + +var msg21693 = msg("19525", dup263); + +var msg21694 = msg("19526", dup263); + +var msg21695 = msg("19527", dup263); + +var msg21696 = msg("19528", dup263); + +var msg21697 = msg("19529", dup263); + +var msg21698 = msg("19530", dup263); + +var msg21699 = msg("19531", dup263); + +var msg21700 = msg("19532", dup263); + +var msg21701 = msg("19533", dup263); + +var msg21702 = msg("19534", dup263); + +var msg21703 = msg("19535", dup263); + +var msg21704 = msg("19536", dup263); + +var msg21705 = msg("19537", dup263); + +var msg21706 = msg("19538", dup263); + +var msg21707 = msg("19539", dup263); + +var msg21708 = msg("19540", dup263); + +var msg21709 = msg("19541", dup263); + +var msg21710 = msg("19542", dup263); + +var msg21711 = msg("19543", dup263); + +var msg21712 = msg("19544", dup263); + +var msg21713 = msg("19545", dup263); + +var msg21714 = msg("19546", dup263); + +var msg21715 = msg("19547", dup263); + +var msg21716 = msg("19548", dup263); + +var msg21717 = msg("19549", dup263); + +var msg21718 = msg("19550", dup263); + +var msg21719 = msg("19551", dup202); + +var msg21720 = msg("19552", dup267); + +var msg21721 = msg("19553", dup267); + +var msg21722 = msg("19554", dup263); + +var msg21723 = msg("19555", dup192); + +var msg21724 = msg("19556", dup192); + +var msg21725 = msg("19557", dup192); + +var msg21726 = msg("19558", dup267); + +var msg21727 = msg("19559", dup192); + +var msg21728 = msg("19560", dup197); + +var msg21729 = msg("19561", dup265); + +var msg21730 = msg("19562", dup265); + +var msg21731 = msg("19563", dup265); + +var msg21732 = msg("19564", dup265); + +var msg21733 = msg("19565", dup265); + +var msg21734 = msg("19566", dup303); + +var msg21735 = msg("19567", dup303); + +var msg21736 = msg("19568", dup192); + +var msg21737 = msg("19569", dup192); + +var msg21738 = msg("19570", dup263); + +var msg21739 = msg("19571", dup263); + +var msg21740 = msg("19572", dup192); + +var msg21741 = msg("19573", dup290); + +var msg21742 = msg("19574", dup290); + +var msg21743 = msg("19575", dup290); + +var msg21744 = msg("19576", dup263); + +var msg21745 = msg("19577", dup205); + +var msg21746 = msg("19578", dup303); + +var msg21747 = msg("19579", dup192); + +var msg21748 = msg("19580", dup238); + +var msg21749 = msg("19581", dup192); + +var msg21750 = msg("19582", dup192); + +var msg21751 = msg("19583", dup192); + +var msg21752 = msg("19584", dup238); + +var msg21753 = msg("19585", dup238); + +var msg21754 = msg("19586", dup192); + +var msg21755 = msg("19587", dup192); + +var msg21756 = msg("19588", dup192); + +var msg21757 = msg("19589", dup269); + +var msg21758 = msg("19590", dup192); + +var msg21759 = msg("19591", dup192); + +var msg21760 = msg("19592", dup192); + +var msg21761 = msg("19593", dup238); + +var msg21762 = msg("19594", dup303); + +var msg21763 = msg("19595", dup269); + +var msg21764 = msg("19596", dup192); + +var msg21765 = msg("19597", dup192); + +var msg21766 = msg("19598", dup303); + +var msg21767 = msg("19599", dup260); + +var msg21768 = msg("19600", dup260); + +var msg21769 = msg("19601", dup276); + +var msg21770 = msg("19602", dup276); + +var msg21771 = msg("19603", dup267); + +var msg21772 = msg("19604", dup267); + +var msg21773 = msg("19605", dup267); + +var msg21774 = msg("19606", dup267); + +var msg21775 = msg("19607", dup267); + +var msg21776 = msg("19608", dup192); + +var msg21777 = msg("19609", dup267); + +var msg21778 = msg("19610", dup265); + +var msg21779 = msg("19611", dup269); + +var msg21780 = msg("19612", dup192); + +var msg21781 = msg("19613", dup192); + +var msg21782 = msg("19614", dup192); + +var msg21783 = msg("19615", dup192); + +var msg21784 = msg("19616", dup192); + +var msg21785 = msg("19617", dup276); + +var msg21786 = msg("19618", dup276); + +var msg21787 = msg("19619", dup267); + +var msg21788 = msg("19620", dup267); + +var msg21789 = msg("19621", dup197); + +var msg21790 = msg("19622", dup269); + +var msg21791 = msg("19623", dup269); + +var msg21792 = msg("19624", dup269); + +var msg21793 = msg("19625", dup269); + +var msg21794 = msg("19626", dup269); + +var msg21795 = msg("19627", dup269); + +var msg21796 = msg("19628", dup269); + +var msg21797 = msg("19629", dup269); + +var msg21798 = msg("19630", dup269); + +var msg21799 = msg("19631", dup269); + +var msg21800 = msg("19632", dup269); + +var msg21801 = msg("19633", dup269); + +var msg21802 = msg("19634", dup269); + +var msg21803 = msg("19635", dup269); + +var msg21804 = msg("19636", dup269); + +var msg21805 = msg("19637", dup269); + +var msg21806 = msg("19638", dup269); + +var msg21807 = msg("19639", dup263); + +var msg21808 = msg("19640", dup263); + +var msg21809 = msg("19641", dup263); + +var msg21810 = msg("19642", dup263); + +var msg21811 = msg("19643", dup263); + +var msg21812 = msg("19644", dup263); + +var msg21813 = msg("19645", dup201); + +var msg21814 = msg("19646", dup267); + +var msg21815 = msg("19647", dup267); + +var msg21816 = msg("19648", dup267); + +var msg21817 = msg("19649", dup197); + +var msg21818 = msg("19650", dup265); + +var msg21819 = msg("19651", dup265); + +var msg21820 = msg("19652", dup202); + +var msg21821 = msg("19653", dup267); + +var msg21822 = msg("19654", dup192); + +var msg21823 = msg("19655", dup192); + +var msg21824 = msg("19656", dup192); + +var msg21825 = msg("19657", dup202); + +var msg21826 = msg("19658", dup192); + +var msg21827 = msg("19659", dup192); + +var msg21828 = msg("19660", dup192); + +var msg21829 = msg("19661", dup267); + +var msg21830 = msg("19662", dup263); + +var msg21831 = msg("19663", dup263); + +var msg21832 = msg("19664", dup263); + +var msg21833 = msg("19665", dup201); + +var msg21834 = msg("19666", dup267); + +var msg21835 = msg("19667", dup267); + +var msg21836 = msg("19668", dup276); + +var msg21837 = msg("19669", dup248); + +var msg21838 = msg("19670", dup278); + +var msg21839 = msg("19671", dup267); + +var msg21840 = msg("19672", dup267); + +var msg21841 = msg("19673", dup276); + +var msg21842 = msg("19674", dup267); + +var msg21843 = msg("19675", dup267); + +var msg21844 = msg("19676", dup267); + +var msg21845 = msg("19677", dup267); + +var msg21846 = msg("19678", dup267); + +var msg21847 = msg("19679", dup267); + +var msg21848 = msg("19680", dup267); + +var msg21849 = msg("19681", dup265); + +var msg21850 = msg("19682", dup201); + +var msg21851 = msg("19683", dup201); + +var msg21852 = msg("19684", dup267); + +var msg21853 = msg("19685", dup197); + +var msg21854 = msg("19686", dup267); + +var msg21855 = msg("19687", dup265); + +var msg21856 = msg("19688", dup201); + +var msg21857 = msg("19689", dup287); + +var msg21858 = msg("19690", dup267); + +var msg21859 = msg("19691", dup201); + +var msg21860 = msg("19692", dup265); + +var msg21861 = msg("19693", dup197); + +var msg21862 = msg("19694", dup265); + +var msg21863 = msg("19695", dup192); + +var msg21864 = msg("19696", dup192); + +var msg21865 = msg("19697", dup192); + +var msg21866 = msg("19698", dup192); + +var msg21867 = msg("19699", dup192); + +var msg21868 = msg("19700", dup192); + +var msg21869 = msg("19701", dup192); + +var msg21870 = msg("19702", dup192); + +var msg21871 = msg("19703", dup238); + +var msg21872 = msg("19704", dup192); + +var msg21873 = msg("19705", dup192); + +var msg21874 = msg("19706", dup192); + +var msg21875 = msg("19707", dup197); + +var msg21876 = msg("19708", dup267); + +var msg21877 = msg("19709", dup198); + +var msg21878 = msg("19710", dup267); + +var msg21879 = msg("19711", dup192); + +var msg21880 = msg("19712", dup192); + +var msg21881 = msg("19713", dup197); + +var msg21882 = msg("19714", dup197); + +var msg21883 = msg("19715", dup192); + +var msg21884 = msg("19716", dup192); + +var msg21885 = msg("19717", dup263); + +var msg21886 = msg("19718", dup192); + +var msg21887 = msg("19719", dup238); + +var msg21888 = msg("19720", dup192); + +var msg21889 = msg("19721", dup192); + +var msg21890 = msg("19722", dup192); + +var msg21891 = msg("19723", dup202); + +var msg21892 = msg("19724", dup192); + +var msg21893 = msg("19725", dup202); + +var msg21894 = msg("19726", dup202); + +var msg21895 = msg("19727", dup192); + +var msg21896 = msg("19728", dup202); + +var msg21897 = msg("19729", dup202); + +var msg21898 = msg("19730", dup202); + +var msg21899 = msg("19731", dup202); + +var msg21900 = msg("19732", dup202); + +var msg21901 = msg("19733", dup192); + +var msg21902 = msg("19734", dup263); + +var msg21903 = msg("19735", dup202); + +var msg21904 = msg("19736", dup202); + +var msg21905 = msg("19737", dup202); + +var msg21906 = msg("19738", dup263); + +var msg21907 = msg("19739", dup192); + +var msg21908 = msg("19740", dup238); + +var msg21909 = msg("19741", dup303); + +var msg21910 = msg("19742", dup192); + +var msg21911 = msg("19743", dup192); + +var msg21912 = msg("19744", dup238); + +var msg21913 = msg("19745", dup192); + +var msg21914 = msg("19746", dup192); + +var msg21915 = msg("19747", dup192); + +var msg21916 = msg("19748", dup192); + +var msg21917 = msg("19749", dup192); + +var msg21918 = msg("19750", dup192); + +var msg21919 = msg("19751", dup238); + +var msg21920 = msg("19752", dup192); + +var msg21921 = msg("19753", dup192); + +var msg21922 = msg("19754", dup192); + +var msg21923 = msg("19755", dup192); + +var msg21924 = msg("19756", dup269); + +var msg21925 = msg("19757", dup192); + +var msg21926 = msg("19758", dup192); + +var msg21927 = msg("19759", dup192); + +var msg21928 = msg("19760", dup192); + +var msg21929 = msg("19761", dup227); + +var msg21930 = msg("19762", dup192); + +var msg21931 = msg("19763", dup192); + +var msg21932 = msg("19764", dup192); + +var msg21933 = msg("19765", dup192); + +var msg21934 = msg("19766", dup238); + +var msg21935 = msg("19767", dup192); + +var msg21936 = msg("19768", dup263); + +var msg21937 = msg("19769", dup198); + +var msg21938 = msg("19770", dup198); + +var msg21939 = msg("19771", dup198); + +var msg21940 = msg("19772", dup263); + +var msg21941 = msg("19773", dup263); + +var msg21942 = msg("19774", dup192); + +var msg21943 = msg("19775", dup303); + +var msg21944 = msg("19776", dup192); + +var msg21945 = msg("19777", dup263); + +var msg21946 = msg("19778", dup269); + +var msg21947 = msg("19779", dup260); + +var msg21948 = msg("19780", dup202); + +var msg21949 = msg("19781", dup192); + +var msg21950 = msg("19782", dup192); + +var msg21951 = msg("19783", dup192); + +var msg21952 = msg("19784", dup238); + +var msg21953 = msg("19785", dup192); + +var msg21954 = msg("19786", dup263); + +var msg21955 = msg("19787", dup267); + +var msg21956 = msg("19788", dup192); + +var msg21957 = msg("19789", dup238); + +var msg21958 = msg("19790", dup238); + +var msg21959 = msg("19791", dup192); + +var msg21960 = msg("19792", dup192); + +var msg21961 = msg("19793", dup192); + +var msg21962 = msg("19794", dup192); + +var msg21963 = msg("19795", dup263); + +var msg21964 = msg("19796", dup192); + +var msg21965 = msg("19797", dup192); + +var msg21966 = msg("19798", dup192); + +var msg21967 = msg("19799", dup192); + +var msg21968 = msg("19800", dup192); + +var msg21969 = msg("19801", dup192); + +var msg21970 = msg("19802", dup192); + +var msg21971 = msg("19803", dup192); + +var msg21972 = msg("19804", dup192); + +var msg21973 = msg("19805", dup192); + +var msg21974 = msg("19806", dup267); + +var msg21975 = msg("19807", dup267); + +var msg21976 = msg("19808", dup267); + +var msg21977 = msg("19809", dup267); + +var msg21978 = msg("19810", dup260); + +var msg21979 = msg("19811", dup202); + +var msg21980 = msg("19812", dup267); + +var msg21981 = msg("19813", dup197); + +var msg21982 = msg("19814", dup267); + +var msg21983 = msg("19815", dup267); + +var msg21984 = msg("19816", dup276); + +var msg21985 = msg("19817", dup201); + +var msg21986 = msg("19818", dup265); + +var msg21987 = msg("19819", dup192); + +var msg21988 = msg("19820", dup192); + +var msg21989 = msg("19821", dup238); + +var msg21990 = msg("19822", dup192); + +var msg21991 = msg("19823", dup303); + +var msg21992 = msg("19824", dup192); + +var msg21993 = msg("19825", dup198); + +var msg21994 = msg("19826", dup267); + +var msg21995 = msg("19827", dup303); + +var msg21996 = msg("19828", dup192); + +var msg21997 = msg("19829", dup192); + +var msg21998 = msg("19830", dup192); + +var msg21999 = msg("19831", dup192); + +var msg22000 = msg("19832", dup192); + +var msg22001 = msg("19833", dup192); + +var msg22002 = msg("19834", dup192); + +var msg22003 = msg("19835", dup303); + +var msg22004 = msg("19836", dup192); + +var msg22005 = msg("19837", dup303); + +var msg22006 = msg("19838", dup303); + +var msg22007 = msg("19839", dup263); + +var msg22008 = msg("19840", dup303); + +var msg22009 = msg("19841", dup303); + +var msg22010 = msg("19842", dup263); + +var msg22011 = msg("19843", dup263); + +var msg22012 = msg("19844", dup192); + +var msg22013 = msg("19845", dup192); + +var msg22014 = msg("19846", dup192); + +var msg22015 = msg("19847", dup192); + +var msg22016 = msg("19848", dup263); + +var msg22017 = msg("19849", dup263); + +var msg22018 = msg("19850", dup238); + +var msg22019 = msg("19851", dup238); + +var msg22020 = msg("19852", dup192); + +var msg22021 = msg("19853", dup303); + +var msg22022 = msg("19854", dup192); + +var msg22023 = msg("19855", dup192); + +var msg22024 = msg("19856", dup192); + +var msg22025 = msg("19857", dup192); + +var msg22026 = msg("19858", dup192); + +var msg22027 = msg("19859", dup303); + +var msg22028 = msg("19860", dup303); + +var msg22029 = msg("19861", dup192); + +var msg22030 = msg("19862", dup192); + +var msg22031 = msg("19863", dup265); + +var msg22032 = msg("19864", dup192); + +var msg22033 = msg("19865", dup192); + +var msg22034 = msg("19866", dup192); + +var msg22035 = msg("19867", dup287); + +var msg22036 = msg("19868", dup263); + +var msg22037 = msg("19869", dup198); + +var msg22038 = msg("19870", dup198); + +var msg22039 = msg("19871", dup197); + +var msg22040 = msg("19872", dup267); + +var msg22041 = msg("19873", dup267); + +var msg22042 = msg("19874", dup263); + +var msg22043 = msg("19875", dup263); + +var msg22044 = msg("19876", dup263); + +var msg22045 = msg("19877", dup263); + +var msg22046 = msg("19878", dup263); + +var msg22047 = msg("19879", dup263); + +var msg22048 = msg("19880", dup263); + +var msg22049 = msg("19881", dup263); + +var msg22050 = msg("19882", dup269); + +var msg22051 = msg("19883", dup197); + +var msg22052 = msg("19884", dup287); + +var msg22053 = msg("19885", dup197); + +var msg22054 = msg("19886", dup267); + +var msg22055 = msg("19887", dup287); + +var msg22056 = msg("19888", dup287); + +var msg22057 = msg("19889", dup202); + +var msg22058 = msg("19890", dup255); + +var msg22059 = msg("19891", dup197); + +var msg22060 = msg("19892", dup197); + +var msg22061 = msg("19893", dup197); + +var msg22062 = msg("19894", dup267); + +var msg22063 = msg("19895", dup205); + +var msg22064 = msg("19896", dup263); + +var msg22065 = msg("19897", dup263); + +var msg22066 = msg("19898", dup205); + +var msg22067 = msg("19899", dup303); + +var msg22068 = msg("19900", dup303); + +var msg22069 = msg("19901", dup303); + +var msg22070 = msg("19902", dup303); + +var msg22071 = msg("19903", dup303); + +var msg22072 = msg("19904", dup303); + +var msg22073 = msg("19905", dup205); + +var msg22074 = msg("19906", dup202); + +var msg22075 = msg("19907", dup202); + +var msg22076 = msg("19908", dup197); + +var msg22077 = msg("19909", dup202); + +var msg22078 = msg("19910", dup265); + +var msg22079 = msg("19911", dup197); + +var msg22080 = msg("19912", dup263); + +var msg22081 = msg("19914", dup263); + +var msg22082 = msg("19915", dup205); + +var msg22083 = msg("19916", dup192); + +var msg22084 = msg("19917", dup205); + +var msg22085 = msg("19918", dup238); + +var msg22086 = msg("19919", dup205); + +var msg22087 = msg("19920", dup205); + +var msg22088 = msg("19921", dup192); + +var msg22089 = msg("19922", dup205); + +var msg22090 = msg("19923", dup263); + +var msg22091 = msg("19924", dup192); + +var msg22092 = msg("19925", dup201); + +var msg22093 = msg("19926", dup197); + +var msg22094 = msg("19927", dup318); + +var msg22095 = msg("19928", dup318); + +var msg22096 = msg("19929", dup318); + +var msg22097 = msg("19930", dup318); + +var msg22098 = msg("19931", dup205); + +var msg22099 = msg("19932", dup265); + +var msg22100 = msg("19933", dup265); + +var msg22101 = msg("19934", dup269); + +var msg22102 = msg("19935", dup205); + +var msg22103 = msg("19936", dup205); + +var msg22104 = msg("19937", dup267); + +var msg22105 = msg("19938", dup197); + +var msg22106 = msg("19939", dup303); + +var msg22107 = msg("19940", dup205); + +var msg22108 = msg("19941", dup205); + +var msg22109 = msg("19942", dup205); + +var msg22110 = msg("19943", dup267); + +var msg22111 = msg("19944", dup205); + +var msg22112 = msg("19945", dup205); + +var msg22113 = msg("19946", dup205); + +var msg22114 = msg("19947", dup205); + +var msg22115 = msg("19948", dup205); + +var msg22116 = msg("19949", dup205); + +var msg22117 = msg("19950", dup192); + +var msg22118 = msg("19951", dup263); + +var msg22119 = msg("19952", dup192); + +var msg22120 = msg("19953", dup205); + +var msg22121 = msg("19954", dup192); + +var msg22122 = msg("19955", dup192); + +var msg22123 = msg("19956", dup197); + +var msg22124 = msg("19957", dup267); + +var msg22125 = msg("19958", dup205); + +var msg22126 = msg("19959", dup205); + +var msg22127 = msg("19960", dup205); + +var msg22128 = msg("19961", dup205); + +var msg22129 = msg("19962", dup290); + +var msg22130 = msg("19963", dup205); + +var msg22131 = msg("19964", dup318); + +var msg22132 = msg("19965", dup205); + +var msg22133 = msg("19966", dup263); + +var msg22134 = msg("19967", dup205); + +var msg22135 = msg("19968", dup205); + +var msg22136 = msg("19969", dup205); + +var msg22137 = msg("19970", dup205); + +var msg22138 = msg("19971", dup303); + +var msg22139 = msg("19972", dup197); + +var msg22140 = msg("19973", dup290); + +var msg22141 = msg("19974", dup205); + +var msg22142 = msg("19975", dup205); + +var msg22143 = msg("19976", dup238); + +var msg22144 = msg("19977", dup205); + +var msg22145 = msg("19978", dup290); + +var msg22146 = msg("19979", dup263); + +var msg22147 = msg("19980", dup263); + +var msg22148 = msg("19981", dup192); + +var msg22149 = msg("19982", dup205); + +var msg22150 = msg("19983", dup205); + +var msg22151 = msg("19984", dup263); + +var msg22152 = msg("19985", dup263); + +var msg22153 = msg("19986", dup263); + +var msg22154 = msg("19987", dup303); + +var msg22155 = msg("19988", dup205); + +var msg22156 = msg("19989", dup303); + +var msg22157 = msg("19990", dup303); + +var msg22158 = msg("19991", dup205); + +var msg22159 = msg("19992", dup205); + +var msg22160 = msg("19993", dup192); + +var msg22161 = msg("19994", dup263); + +var msg22162 = msg("19995", dup202); + +var msg22163 = msg("19996", dup238); + +var msg22164 = msg("19997", dup192); + +var msg22165 = msg("19998", dup192); + +var msg22166 = msg("19999", dup303); + +var msg22167 = msg("20000", dup202); + +var msg22168 = msg("20001", dup192); + +var msg22169 = msg("20002", dup192); + +var msg22170 = msg("20003", dup192); + +var msg22171 = msg("20004", dup192); + +var msg22172 = msg("20005", dup192); + +var msg22173 = msg("20006", dup238); + +var msg22174 = msg("20007", dup303); + +var msg22175 = msg("20008", dup202); + +var msg22176 = msg("20009", dup269); + +var msg22177 = msg("20010", dup287); + +var msg22178 = msg("20011", dup202); + +var msg22179 = msg("20012", dup269); + +var msg22180 = msg("20013", dup197); + +var msg22181 = msg("20014", dup192); + +var msg22182 = msg("20015", dup192); + +var msg22183 = msg("20016", dup192); + +var msg22184 = msg("20017", dup238); + +var msg22185 = msg("20018", dup238); + +var msg22186 = msg("20019", dup238); + +var msg22187 = msg("20020", dup263); + +var msg22188 = msg("20021", dup269); + +var msg22189 = msg("20022", dup238); + +var msg22190 = msg("20023", dup263); + +var msg22191 = msg("20024", dup192); + +var msg22192 = msg("20025", dup263); + +var msg22193 = msg("20026", dup192); + +var msg22194 = msg("20027", dup263); + +var msg22195 = msg("20028", dup263); + +var msg22196 = msg("20029", dup267); + +var msg22197 = msg("20030", dup202); + +var msg22198 = msg("20031", dup267); + +var msg22199 = msg("20032", dup265); + +var msg22200 = msg("20033", dup265); + +var msg22201 = msg("20034", dup201); + +var msg22202 = msg("20035", dup192); + +var msg22203 = msg("20036", dup192); + +var msg22204 = msg("20037", dup192); + +var msg22205 = msg("20038", dup192); + +var msg22206 = msg("20039", dup269); + +var msg22207 = msg("20040", dup192); + +var msg22208 = msg("20041", dup263); + +var msg22209 = msg("20042", dup192); + +var msg22210 = msg("20043", dup263); + +var msg22211 = msg("20044", dup265); + +var msg22212 = msg("20045", dup260); + +var msg22213 = msg("20046", dup260); + +var msg22214 = msg("20047", dup260); + +var msg22215 = msg("20048", dup267); + +var msg22216 = msg("20049", dup267); + +var msg22217 = msg("20050", dup267); + +var msg22218 = msg("20051", dup197); + +var msg22219 = msg("20052", dup197); + +var msg22220 = msg("20053", dup240); + +var msg22221 = msg("20054", dup198); + +var msg22222 = msg("20055", dup197); + +var msg22223 = msg("20056", dup265); + +var msg22224 = msg("20057", dup202); + +var msg22225 = msg("20058", dup267); + +var msg22226 = msg("20059", dup267); + +var msg22227 = msg("20060", dup197); + +var msg22228 = msg("20061", dup201); + +var msg22229 = msg("20062", dup267); + +var msg22230 = msg("20063", dup303); + +var msg22231 = msg("20064", dup263); + +var msg22232 = msg("20065", dup192); + +var msg22233 = msg("20066", dup192); + +var msg22234 = msg("20067", dup192); + +var msg22235 = msg("20068", dup269); + +var msg22236 = msg("20069", dup192); + +var msg22237 = msg("20070", dup265); + +var msg22238 = msg("20071", dup265); + +var msg22239 = msg("20072", dup265); + +var msg22240 = msg("20073", dup267); + +var msg22241 = msg("20074", dup192); + +var msg22242 = msg("20075", dup192); + +var msg22243 = msg("20076", dup192); + +var msg22244 = msg("20077", dup192); + +var msg22245 = msg("20078", dup192); + +var msg22246 = msg("20079", dup192); + +var msg22247 = msg("20080", dup192); + +var msg22248 = msg("20081", dup192); + +var msg22249 = msg("20082", dup192); + +var msg22250 = msg("20083", dup192); + +var msg22251 = msg("20084", dup197); + +var msg22252 = msg("20085", dup192); + +var msg22253 = msg("20086", dup192); + +var msg22254 = msg("20087", dup192); + +var msg22255 = msg("20088", dup192); + +var msg22256 = msg("20089", dup202); + +var msg22257 = msg("20090", dup202); + +var msg22258 = msg("20091", dup202); + +var msg22259 = msg("20092", dup202); + +var msg22260 = msg("20093", dup202); + +var msg22261 = msg("20094", dup202); + +var msg22262 = msg("20095", dup313); + +var msg22263 = msg("20096", dup192); + +var msg22264 = msg("20097", dup192); + +var msg22265 = msg("20098", dup192); + +var msg22266 = msg("20099", dup192); + +var msg22267 = msg("20100", dup263); + +var msg22268 = msg("20101", dup263); + +var msg22269 = msg("20102", dup263); + +var msg22270 = msg("20103", dup263); + +var msg22271 = msg("20104", dup269); + +var msg22272 = msg("20105", dup269); + +var msg22273 = msg("20106", dup269); + +var msg22274 = msg("20107", dup192); + +var msg22275 = msg("20108", dup192); + +var msg22276 = msg("20109", dup192); + +var msg22277 = msg("20110", dup267); + +var msg22278 = msg("20111", dup267); + +var msg22279 = msg("20112", dup267); + +var msg22280 = msg("20113", dup267); + +var msg22281 = msg("20114", dup201); + +var msg22282 = msg("20115", dup267); + +var msg22283 = msg("20116", dup201); + +var msg22284 = msg("20117", dup267); + +var msg22285 = msg("20118", dup276); + +var msg22286 = msg("20119", dup267); + +var msg22287 = msg("20120", dup267); + +var msg22288 = msg("20121", dup202); + +var msg22289 = msg("20122", dup202); + +var msg22290 = msg("20123", dup202); + +var msg22291 = msg("20124", dup202); + +var msg22292 = msg("20125", dup202); + +var msg22293 = msg("20126", dup202); + +var msg22294 = msg("20127", dup267); + +var msg22295 = msg("20128", dup202); + +var msg22296 = msg("20129", dup202); + +var msg22297 = msg("20130", dup267); + +var msg22298 = msg("20131", dup287); + +var msg22299 = msg("20132", dup198); + +var msg22300 = msg("20133", dup265); + +var msg22301 = msg("20134", dup197); + +var msg22302 = msg("20135", dup197); + +var msg22303 = msg("20136", dup202); + +var msg22304 = msg("20137", dup265); + +var msg22305 = msg("20138", dup287); + +var msg22306 = msg("20139", dup197); + +var msg22307 = msg("20140", dup197); + +var msg22308 = msg("20141", dup197); + +var msg22309 = msg("20142", dup267); + +var msg22310 = msg("20143", dup263); + +var msg22311 = msg("20144", dup267); + +var msg22312 = msg("20145", dup267); + +var msg22313 = msg("20146", dup202); + +var msg22314 = msg("20147", dup267); + +var msg22315 = msg("20148", dup267); + +var msg22316 = msg("20149", dup267); + +var msg22317 = msg("20150", dup267); + +var msg22318 = msg("20151", dup202); + +var msg22319 = msg("20152", dup267); + +var msg22320 = msg("20153", dup267); + +var msg22321 = msg("20154", dup267); + +var msg22322 = msg("20155", dup267); + +var msg22323 = msg("20156", dup267); + +var msg22324 = msg("20157", dup202); + +var msg22325 = msg("20158", dup265); + +var msg22326 = msg("20159", dup265); + +var msg22327 = msg("20160", dup265); + +var msg22328 = msg("20161", dup265); + +var msg22329 = msg("20162", dup265); + +var msg22330 = msg("20163", dup197); + +var msg22331 = msg("20164", dup197); + +var msg22332 = msg("20165", dup197); + +var msg22333 = msg("20166", dup197); + +var msg22334 = msg("20167", dup197); + +var msg22335 = msg("20168", dup267); + +var msg22336 = msg("20169", dup267); + +var msg22337 = msg("20170", dup267); + +var msg22338 = msg("20171", dup267); + +var msg22339 = msg("20172", dup202); + +var msg22340 = msg("20173", dup202); + +var msg22341 = msg("20174", dup202); + +var msg22342 = msg("20175", dup265); + +var msg22343 = msg("20176", dup197); + +var msg22344 = msg("20177", dup197); + +var msg22345 = msg("20178", dup198); + +var msg22346 = msg("20179", dup197); + +var msg22347 = msg("20180", dup197); + +var msg22348 = msg("20181", dup265); + +var msg22349 = msg("20182", dup265); + +var msg22350 = msg("20183", dup202); + +var msg22351 = msg("20184", dup199); + +var msg22352 = msg("20185", dup199); + +var msg22353 = msg("20186", dup199); + +var msg22354 = msg("20187", dup199); + +var msg22355 = msg("20188", dup199); + +var msg22356 = msg("20189", dup199); + +var msg22357 = msg("20190", dup199); + +var msg22358 = msg("20191", dup199); + +var msg22359 = msg("20192", dup199); + +var msg22360 = msg("20193", dup199); + +var msg22361 = msg("20194", dup199); + +var msg22362 = msg("20195", dup199); + +var msg22363 = msg("20196", dup199); + +var msg22364 = msg("20197", dup199); + +var msg22365 = msg("20198", dup199); + +var msg22366 = msg("20199", dup199); + +var msg22367 = msg("20200", dup199); + +var msg22368 = msg("20201", dup269); + +var msg22369 = msg("20202", dup202); + +var msg22370 = msg("20203", dup263); + +var msg22371 = msg("20204", dup192); + +var msg22372 = msg("20205", dup202); + +var msg22373 = msg("20206", dup202); + +var msg22374 = msg("20207", dup197); + +var msg22375 = msg("20208", dup197); + +var msg22376 = msg("20209", dup197); + +var msg22377 = msg("20210", dup197); + +var msg22378 = msg("20211", dup197); + +var msg22379 = msg("20212", dup202); + +var msg22380 = msg("20213", dup202); + +var msg22381 = msg("20214", dup267); + +var msg22382 = msg("20215", dup202); + +var msg22383 = msg("20216", dup198); + +var msg22384 = msg("20217", dup198); + +var msg22385 = msg("20218", dup198); + +var msg22386 = msg("20219", dup192); + +var msg22387 = msg("20220", dup263); + +var msg22388 = msg("20221", dup192); + +var msg22389 = msg("20222", dup192); + +var msg22390 = msg("20223", dup265); + +var msg22391 = msg("20224", dup197); + +var msg22392 = msg("20225", dup246); + +var msg22393 = msg("20226", dup197); + +var msg22394 = msg("20227", dup267); + +var msg22395 = msg("20228", dup202); + +var msg22396 = msg("20229", dup202); + +var msg22397 = msg("20230", dup269); + +var msg22398 = msg("20231", dup269); + +var msg22399 = msg("20232", dup192); + +var msg22400 = msg("20233", dup192); + +var msg22401 = msg("20234", dup192); + +var msg22402 = msg("20235", dup192); + +var msg22403 = msg("20236", dup197); + +var msg22404 = msg("20237", dup197); + +var msg22405 = msg("20238", dup267); + +var msg22406 = msg("20239", dup197); + +var msg22407 = msg("20240", dup197); + +var msg22408 = msg("20241", dup197); + +var msg22409 = msg("20242", dup197); + +var msg22410 = msg("20243", dup202); + +var msg22411 = msg("20244", dup202); + +var msg22412 = msg("20245", dup202); + +var msg22413 = msg("20246", dup267); + +var msg22414 = msg("20247", dup267); + +var msg22415 = msg("20248", dup255); + +var msg22416 = msg("20249", dup267); + +var msg22417 = msg("20250", dup197); + +var msg22418 = msg("20251", dup198); + +var msg22419 = msg("20252", dup202); + +var msg22420 = msg("20253", dup276); + +var msg22421 = msg("20254", dup267); + +var msg22422 = msg("20255", dup202); + +var msg22423 = msg("20256", dup267); + +var msg22424 = msg("20257", dup265); + +var msg22425 = msg("20258", dup201); + +var msg22426 = msg("20259", dup265); + +var msg22427 = msg("20260", dup265); + +var msg22428 = msg("20261", dup265); + +var msg22429 = msg("20262", dup265); + +var msg22430 = msg("20263", dup265); + +var msg22431 = msg("20264", dup267); + +var msg22432 = msg("20265", dup202); + +var msg22433 = msg("20266", dup267); + +var msg22434 = msg("20267", dup267); + +var msg22435 = msg("20268", dup269); + +var msg22436 = msg("20269", dup265); + +var msg22437 = msg("20270", dup267); + +var msg22438 = msg("20271", dup198); + +var msg22439 = msg("20272", dup197); + +var msg22440 = msg("20273", dup267); + +var msg22441 = msg("20274", dup255); + +var msg22442 = msg("20275", dup201); + +var msg22443 = msg("20276", dup202); + +var msg22444 = msg("20277", dup265); + +var msg22445 = msg("20278", dup265); + +var msg22446 = msg("20279", dup265); + +var msg22447 = msg("20280", dup202); + +var msg22448 = msg("20281", dup202); + +var msg22449 = msg("20282", dup265); + +var msg22450 = msg("20283", dup197); + +var msg22451 = msg("20284", dup197); + +var msg22452 = msg("20285", dup265); + +var msg22453 = msg("20286", dup265); + +var msg22454 = msg("20287", dup265); + +var msg22455 = msg("20288", dup197); + +var msg22456 = msg("20289", dup198); + +var msg22457 = msg("20290", dup198); + +var msg22458 = msg("20291", dup192); + +var msg22459 = msg("20292", dup192); + +var msg22460 = msg("20293", dup269); + +var msg22461 = msg("20294", dup267); + +var msg22462 = msg("20295", dup267); + +var msg22463 = msg("20296", dup202); + +var msg22464 = msg("20297", dup202); + +var msg22465 = msg("20298", dup287); + +var msg22466 = msg("20299", dup287); + +var msg22467 = msg("20300", dup201); + +var msg22468 = msg("20301", dup201); + +var msg22469 = msg("20302", dup202); + +var msg22470 = msg("20303", dup287); + +var msg22471 = msg("20304", dup287); + +var msg22472 = msg("20305", dup287); + +var msg22473 = msg("20306", dup287); + +var msg22474 = msg("20307", dup287); + +var msg22475 = msg("20308", dup287); + +var msg22476 = msg("20309", dup202); + +var msg22477 = msg("20310", dup202); + +var msg22478 = msg("20311", dup202); + +var msg22479 = msg("20312", dup287); + +var msg22480 = msg("20313", dup202); + +var msg22481 = msg("20314", dup287); + +var msg22482 = msg("20315", dup287); + +var msg22483 = msg("20316", dup202); + +var msg22484 = msg("20317", dup202); + +var msg22485 = msg("20318", dup287); + +var msg22486 = msg("20319", dup287); + +var msg22487 = msg("20320", dup201); + +var msg22488 = msg("20321", dup201); + +var msg22489 = msg("20322", dup287); + +var msg22490 = msg("20323", dup287); + +var msg22491 = msg("20324", dup287); + +var msg22492 = msg("20325", dup287); + +var msg22493 = msg("20326", dup287); + +var msg22494 = msg("20327", dup287); + +var msg22495 = msg("20328", dup202); + +var msg22496 = msg("20329", dup202); + +var msg22497 = msg("20330", dup202); + +var msg22498 = msg("20331", dup202); + +var msg22499 = msg("20332", dup202); + +var msg22500 = msg("20333", dup287); + +var msg22501 = msg("20334", dup201); + +var msg22502 = msg("20335", dup201); + +var msg22503 = msg("20336", dup287); + +var msg22504 = msg("20337", dup287); + +var msg22505 = msg("20338", dup287); + +var msg22506 = msg("20339", dup287); + +var msg22507 = msg("20340", dup287); + +var msg22508 = msg("20341", dup287); + +var msg22509 = msg("20342", dup202); + +var msg22510 = msg("20343", dup202); + +var msg22511 = msg("20344", dup202); + +var msg22512 = msg("20345", dup202); + +var msg22513 = msg("20346", dup202); + +var msg22514 = msg("20347", dup202); + +var msg22515 = msg("20348", dup201); + +var msg22516 = msg("20349", dup201); + +var msg22517 = msg("20350", dup287); + +var msg22518 = msg("20351", dup287); + +var msg22519 = msg("20352", dup201); + +var msg22520 = msg("20353", dup287); + +var msg22521 = msg("20354", dup287); + +var msg22522 = msg("20355", dup287); + +var msg22523 = msg("20356", dup201); + +var msg22524 = msg("20357", dup201); + +var msg22525 = msg("20358", dup287); + +var msg22526 = msg("20359", dup287); + +var msg22527 = msg("20360", dup202); + +var msg22528 = msg("20361", dup202); + +var msg22529 = msg("20362", dup202); + +var msg22530 = msg("20363", dup202); + +var msg22531 = msg("20364", dup287); + +var msg22532 = msg("20365", dup287); + +var msg22533 = msg("20366", dup201); + +var msg22534 = msg("20367", dup201); + +var msg22535 = msg("20368", dup287); + +var msg22536 = msg("20369", dup287); + +var msg22537 = msg("20370", dup287); + +var msg22538 = msg("20371", dup287); + +var msg22539 = msg("20372", dup287); + +var msg22540 = msg("20373", dup287); + +var msg22541 = msg("20374", dup202); + +var msg22542 = msg("20375", dup202); + +var msg22543 = msg("20376", dup287); + +var msg22544 = msg("20377", dup287); + +var msg22545 = msg("20378", dup287); + +var msg22546 = msg("20379", dup287); + +var msg22547 = msg("20380", dup287); + +var msg22548 = msg("20381", dup202); + +var msg22549 = msg("20382", dup202); + +var msg22550 = msg("20383", dup202); + +var msg22551 = msg("20384", dup202); + +var msg22552 = msg("20385", dup201); + +var msg22553 = msg("20386", dup202); + +var msg22554 = msg("20387", dup201); + +var msg22555 = msg("20388", dup201); + +var msg22556 = msg("20389", dup201); + +var msg22557 = msg("20390", dup202); + +var msg22558 = msg("20391", dup201); + +var msg22559 = msg("20392", dup201); + +var msg22560 = msg("20393", dup197); + +var msg22561 = msg("20394", dup197); + +var msg22562 = msg("20395", dup197); + +var msg22563 = msg("20396", dup197); + +var msg22564 = msg("20397", dup197); + +var msg22565 = msg("20398", dup197); + +var msg22566 = msg("20399", dup197); + +var msg22567 = msg("20400", dup197); + +var msg22568 = msg("20401", dup197); + +var msg22569 = msg("20402", dup197); + +var msg22570 = msg("20403", dup197); + +var msg22571 = msg("20404", dup202); + +var msg22572 = msg("20405", dup287); + +var msg22573 = msg("20406", dup202); + +var msg22574 = msg("20407", dup202); + +var msg22575 = msg("20408", dup202); + +var msg22576 = msg("20409", dup202); + +var msg22577 = msg("20410", dup273); + +var msg22578 = msg("20411", dup202); + +var msg22579 = msg("20412", dup202); + +var msg22580 = msg("20413", dup202); + +var msg22581 = msg("20414", dup287); + +var msg22582 = msg("20415", dup202); + +var msg22583 = msg("20416", dup202); + +var msg22584 = msg("20417", dup202); + +var msg22585 = msg("20418", dup202); + +var msg22586 = msg("20419", dup273); + +var msg22587 = msg("20420", dup202); + +var msg22588 = msg("20421", dup202); + +var msg22589 = msg("20422", dup287); + +var msg22590 = msg("20423", dup287); + +var msg22591 = msg("20424", dup287); + +var msg22592 = msg("20425", dup287); + +var msg22593 = msg("20426", dup201); + +var msg22594 = msg("20427", dup287); + +var msg22595 = msg("20428", dup192); + +var msg22596 = msg("20429", dup267); + +var msg22597 = msg("20430", dup265); + +var msg22598 = msg("20431", dup197); + +var msg22599 = msg("20432", dup192); + +var msg22600 = msg("20433", dup303); + +var msg22601 = msg("20434", dup263); + +var msg22602 = msg("20435", dup192); + +var msg22603 = msg("20436", dup198); + +var msg22604 = msg("20437", dup198); + +var msg22605 = msg("20438", dup198); + +var msg22606 = msg("20439", dup198); + +var msg22607 = msg("20440", dup197); + +var msg22608 = msg("20441", dup197); + +var msg22609 = msg("20442", dup197); + +var msg22610 = msg("20443", dup202); + +var msg22611 = msg("20444", dup197); + +var msg22612 = msg("20445", dup197); + +var msg22613 = msg("20446", dup197); + +var msg22614 = msg("20447", dup192); + +var msg22615 = msg("20448", dup192); + +var msg22616 = msg("20449", dup238); + +var msg22617 = msg("20450", dup202); + +var msg22618 = msg("20451", dup202); + +var msg22619 = msg("20452", dup287); + +var msg22620 = msg("20453", dup287); + +var msg22621 = msg("20454", dup287); + +var msg22622 = msg("20455", dup202); + +var msg22623 = msg("20456", dup202); + +var msg22624 = msg("20457", dup202); + +var msg22625 = msg("20458", dup287); + +var msg22626 = msg("20459", dup202); + +var msg22627 = msg("20460", dup202); + +var msg22628 = msg("20461", dup202); + +var msg22629 = msg("20462", dup202); + +var msg22630 = msg("20463", dup287); + +var msg22631 = msg("20464", dup287); + +var msg22632 = msg("20465", dup287); + +var msg22633 = msg("20466", dup287); + +var msg22634 = msg("20467", dup287); + +var msg22635 = msg("20468", dup287); + +var msg22636 = msg("20469", dup287); + +var msg22637 = msg("20470", dup202); + +var msg22638 = msg("20471", dup202); + +var msg22639 = msg("20472", dup202); + +var msg22640 = msg("20473", dup202); + +var msg22641 = msg("20474", dup202); + +var msg22642 = msg("20475", dup202); + +var msg22643 = msg("20476", dup202); + +var msg22644 = msg("20477", dup202); + +var msg22645 = msg("20478", dup202); + +var msg22646 = msg("20479", dup202); + +var msg22647 = msg("20480", dup202); + +var msg22648 = msg("20481", dup202); + +var msg22649 = msg("20482", dup202); + +var msg22650 = msg("20483", dup202); + +var msg22651 = msg("20484", dup202); + +var msg22652 = msg("20485", dup287); + +var msg22653 = msg("20486", dup202); + +var msg22654 = msg("20487", dup287); + +var msg22655 = msg("20488", dup202); + +var msg22656 = msg("20489", dup202); + +var msg22657 = msg("20490", dup202); + +var msg22658 = msg("20491", dup202); + +var msg22659 = msg("20492", dup202); + +var msg22660 = msg("20493", dup202); + +var msg22661 = msg("20494", dup202); + +var msg22662 = msg("20495", dup202); + +var msg22663 = msg("20496", dup202); + +var msg22664 = msg("20497", dup202); + +var msg22665 = msg("20498", dup202); + +var msg22666 = msg("20499", dup202); + +var msg22667 = msg("20500", dup202); + +var msg22668 = msg("20501", dup202); + +var msg22669 = msg("20502", dup202); + +var msg22670 = msg("20503", dup202); + +var msg22671 = msg("20504", dup202); + +var msg22672 = msg("20505", dup202); + +var msg22673 = msg("20506", dup202); + +var msg22674 = msg("20507", dup202); + +var msg22675 = msg("20508", dup202); + +var msg22676 = msg("20509", dup202); + +var msg22677 = msg("20510", dup202); + +var msg22678 = msg("20511", dup202); + +var msg22679 = msg("20512", dup202); + +var msg22680 = msg("20513", dup202); + +var msg22681 = msg("20514", dup202); + +var msg22682 = msg("20515", dup202); + +var msg22683 = msg("20516", dup202); + +var msg22684 = msg("20517", dup202); + +var msg22685 = msg("20518", dup202); + +var msg22686 = msg("20519", dup202); + +var msg22687 = msg("20520", dup202); + +var msg22688 = msg("20521", dup202); + +var msg22689 = msg("20522", dup202); + +var msg22690 = msg("20523", dup269); + +var msg22691 = msg("20524", dup269); + +var msg22692 = msg("20525", dup192); + +var msg22693 = msg("20526", dup263); + +var msg22694 = msg("20527", dup202); + +var msg22695 = msg("20528", dup265); + +var msg22696 = msg("20529", dup267); + +var msg22697 = msg("20530", dup265); + +var msg22698 = msg("20531", dup265); + +var msg22699 = msg("20532", dup197); + +var msg22700 = msg("20533", dup265); + +var msg22701 = msg("20534", dup201); + +var msg22702 = msg("20535", dup265); + +var msg22703 = msg("20536", dup265); + +var msg22704 = msg("20537", dup265); + +var msg22705 = msg("20538", dup265); + +var msg22706 = msg("20539", dup265); + +var msg22707 = msg("20540", dup202); + +var msg22708 = msg("20541", dup276); + +var msg22709 = msg("20542", dup267); + +var msg22710 = msg("20543", dup201); + +var msg22711 = msg("20544", dup202); + +var msg22712 = msg("20545", dup202); + +var msg22713 = msg("20546", dup197); + +var msg22714 = msg("20547", dup197); + +var msg22715 = msg("20548", dup319); + +var msg22716 = msg("20549", dup287); + +var msg22717 = msg("20550", dup201); + +var msg22718 = msg("20551", dup197); + +var msg22719 = msg("20552", dup197); + +var msg22720 = msg("20553", dup197); + +var msg22721 = msg("20554", dup267); + +var msg22722 = msg("20555", dup197); + +var msg22723 = msg("20556", dup202); + +var msg22724 = msg("20557", dup197); + +var msg22725 = msg("20558", dup269); + +var msg22726 = msg("20559", dup197); + +var msg22727 = msg("20560", dup201); + +var msg22728 = msg("20561", dup192); + +var msg22729 = msg("20562", dup192); + +var msg22730 = msg("20563", dup202); + +var msg22731 = msg("20564", dup202); + +var msg22732 = msg("20565", dup197); + +var msg22733 = msg("20566", dup197); + +var msg22734 = msg("20567", dup267); + +var msg22735 = msg("20568", dup201); + +var msg22736 = msg("20569", dup202); + +var msg22737 = msg("20570", dup202); + +var msg22738 = msg("20571", dup202); + +var msg22739 = msg("20572", dup197); + +var msg22740 = msg("20573", dup265); + +var msg22741 = msg("20574", dup265); + +var msg22742 = msg("20575", dup267); + +var msg22743 = msg("20576", dup197); + +var msg22744 = msg("20577", dup267); + +var msg22745 = msg("20578", dup197); + +var msg22746 = msg("20579", dup267); + +var msg22747 = msg("20580", dup265); + +var msg22748 = msg("20581", dup267); + +var msg22749 = msg("20582", dup267); + +var msg22750 = msg("20583", dup265); + +var msg22751 = msg("20584", dup265); + +var msg22752 = msg("20585", dup265); + +var msg22753 = msg("20586", dup265); + +var msg22754 = msg("20587", dup192); + +var msg22755 = msg("20588", dup202); + +var msg22756 = msg("20589", dup202); + +var msg22757 = msg("20590", dup267); + +var msg22758 = msg("20591", dup265); + +var msg22759 = msg("20592", dup265); + +var msg22760 = msg("20593", dup265); + +var msg22761 = msg("20594", dup197); + +var msg22762 = msg("20595", dup192); + +var msg22763 = msg("20596", dup267); + +var msg22764 = msg("20597", dup267); + +var msg22765 = msg("20598", dup267); + +var msg22766 = msg("20599", dup267); + +var msg22767 = msg("20600", dup202); + +var msg22768 = msg("20601", dup202); + +var msg22769 = msg("20602", dup202); + +var msg22770 = msg("20603", dup197); + +var msg22771 = msg("20604", dup192); + +var msg22772 = msg("20605", dup192); + +var msg22773 = msg("20606", dup192); + +var msg22774 = msg("20607", dup197); + +var msg22775 = msg("20608", dup197); + +var msg22776 = msg("20609", dup197); + +var msg22777 = msg("20610", dup267); + +var msg22778 = msg("20611", dup197); + +var msg22779 = msg("20612", dup198); + +var msg22780 = msg("20613", dup198); + +var msg22781 = msg("20614", dup267); + +var msg22782 = msg("20615", dup260); + +var msg22783 = msg("20616", dup197); + +var msg22784 = msg("20617", dup267); + +var msg22785 = msg("20618", dup267); + +var msg22786 = msg("20619", dup197); + +var msg22787 = msg("20620", dup197); + +var msg22788 = msg("20621", dup202); + +var msg22789 = msg("20622", dup201); + +var msg22790 = msg("20623", dup260); + +var msg22791 = msg("20624", dup260); + +var msg22792 = msg("20625", dup260); + +var msg22793 = msg("20626", dup192); + +var msg22794 = msg("20627", dup192); + +var msg22795 = msg("20628", dup260); + +var msg22796 = msg("20629", dup260); + +var msg22797 = msg("20630", dup202); + +var msg22798 = msg("20631", dup202); + +var msg22799 = msg("20632", dup202); + +var msg22800 = msg("20633", dup202); + +var msg22801 = msg("20634", dup198); + +var msg22802 = msg("20635", dup260); + +var msg22803 = msg("20636", dup267); + +var msg22804 = msg("20637", dup267); + +var msg22805 = msg("20638", dup267); + +var msg22806 = msg("20639", dup263); + +var msg22807 = msg("20640", dup260); + +var msg22808 = msg("20641", dup260); + +var msg22809 = msg("20642", dup260); + +var msg22810 = msg("20643", dup260); + +var msg22811 = msg("20644", dup260); + +var msg22812 = msg("20645", dup260); + +var msg22813 = msg("20646", dup260); + +var msg22814 = msg("20647", dup260); + +var msg22815 = msg("20648", dup260); + +var msg22816 = msg("20649", dup260); + +var msg22817 = msg("20650", dup202); + +var msg22818 = msg("20651", dup202); + +var msg22819 = msg("20652", dup202); + +var msg22820 = msg("20653", dup197); + +var msg22821 = msg("20654", dup202); + +var msg22822 = msg("20655", dup267); + +var msg22823 = msg("20656", dup202); + +var msg22824 = msg("20657", dup202); + +var msg22825 = msg("20658", dup202); + +var msg22826 = msg("20659", dup267); + +var msg22827 = msg("20660", dup201); + +var msg22828 = msg("20661", dup202); + +var msg22829 = msg("20662", dup197); + +var msg22830 = msg("20663", dup202); + +var msg22831 = msg("20664", dup265); + +var msg22832 = msg("20665", dup265); + +var msg22833 = msg("20666", dup197); + +var msg22834 = msg("20667", dup197); + +var msg22835 = msg("20668", dup269); + +var msg22836 = msg("20669", dup269); + +var msg22837 = msg("20670", dup197); + +var msg22838 = msg("20671", dup267); + +var msg22839 = msg("20672", dup202); + +var msg22840 = msg("20673", dup267); + +var msg22841 = msg("20674", dup267); + +var msg22842 = msg("20675", dup267); + +var msg22843 = msg("20676", dup192); + +var msg22844 = msg("20677", dup192); + +var msg22845 = msg("20678", dup192); + +var msg22846 = msg("20679", dup192); + +var msg22847 = msg("20680", dup202); + +var msg22848 = msg("20681", dup192); + +var msg22849 = msg("20682", dup192); + +var msg22850 = msg("20683", dup202); + +var msg22851 = msg("20684", dup202); + +var msg22852 = msg("20685", dup192); + +var msg22853 = msg("20686", dup192); + +var msg22854 = msg("20687", dup192); + +var msg22855 = msg("20688", dup192); + +var msg22856 = msg("20689", dup192); + +var msg22857 = msg("20690", dup198); + +var msg22858 = msg("20691", dup265); + +var msg22859 = msg("20692", dup265); + +var msg22860 = msg("20693", dup192); + +var msg22861 = msg("20694", dup192); + +var msg22862 = msg("20695", dup192); + +var msg22863 = msg("20696", dup192); + +var msg22864 = msg("20697", dup192); + +var msg22865 = msg("20698", dup199); + +var msg22866 = msg("20699", dup267); + +var msg22867 = msg("20700", dup276); + +var msg22868 = msg("20701", dup276); + +var msg22869 = msg("20702", dup267); + +var msg22870 = msg("20703", dup267); + +var msg22871 = msg("20704", dup267); + +var msg22872 = msg("20705", dup265); + +var msg22873 = msg("20706", dup265); + +var msg22874 = msg("20707", dup265); + +var msg22875 = msg("20708", dup265); + +var msg22876 = msg("20709", dup265); + +var msg22877 = msg("20710", dup265); + +var msg22878 = msg("20711", dup265); + +var msg22879 = msg("20712", dup265); + +var msg22880 = msg("20713", dup265); + +var msg22881 = msg("20714", dup265); + +var msg22882 = msg("20715", dup265); + +var msg22883 = msg("20716", dup265); + +var msg22884 = msg("20717", dup202); + +var msg22885 = msg("20718", dup267); + +var msg22886 = msg("20719", dup267); + +var msg22887 = msg("20720", dup267); + +var msg22888 = msg("20721", dup267); + +var msg22889 = msg("20722", dup201); + +var msg22890 = msg("20723", dup202); + +var msg22891 = msg("20724", dup202); + +var msg22892 = msg("20725", dup198); + +var msg22893 = msg("20726", dup197); + +var msg22894 = msg("20727", dup265); + +var msg22895 = msg("20728", dup202); + +var msg22896 = msg("20729", dup267); + +var msg22897 = msg("20730", dup202); + +var msg22898 = msg("20731", dup202); + +var msg22899 = msg("20732", dup202); + +var msg22900 = msg("20733", dup202); + +var msg22901 = msg("20734", dup197); + +var msg22902 = msg("20735", dup202); + +var msg22903 = msg("20736", dup265); + +var msg22904 = msg("20737", dup285); + +var msg22905 = msg("20738", dup197); + +var msg22906 = msg("20739", dup265); + +var msg22907 = msg("20740", dup197); + +var msg22908 = msg("20741", dup198); + +var msg22909 = msg("20742", dup201); + +var msg22910 = msg("20743", dup201); + +var msg22911 = msg("20744", dup267); + +var msg22912 = msg("20745", dup197); + +var msg22913 = msg("20746", dup197); + +var msg22914 = msg("20747", dup197); + +var msg22915 = msg("20748", dup267); + +var msg22916 = msg("20749", dup197); + +var msg22917 = msg("20750", dup202); + +var msg22918 = msg("20751", dup202); + +var msg22919 = msg("20752", dup303); + +var msg22920 = msg("20753", dup303); + +var msg22921 = msg("20754", dup202); + +var msg22922 = msg("20755", dup202); + +var msg22923 = msg("20756", dup202); + +var msg22924 = msg("20757", dup202); + +var msg22925 = msg("20758", dup287); + +var msg22926 = msg("20759", dup192); + +var msg22927 = msg("20760", dup269); + +var msg22928 = msg("20761", dup197); + +var msg22929 = msg("20762", dup202); + +var msg22930 = msg("20763", dup192); + +var msg22931 = msg("20764", dup197); + +var msg22932 = msg("20765", dup265); + +var msg22933 = msg("20766", dup267); + +var msg22934 = msg("20767", dup267); + +var msg22935 = msg("20768", dup267); + +var msg22936 = msg("20769", dup267); + +var msg22937 = msg("20770", dup267); + +var msg22938 = msg("20771", dup267); + +var msg22939 = msg("20772", dup267); + +var msg22940 = msg("20773", dup267); + +var msg22941 = msg("20774", dup267); + +var msg22942 = msg("20775", dup267); + +var msg22943 = msg("20776", dup267); + +var msg22944 = msg("20777", dup267); + +var msg22945 = msg("20778", dup287); + +var msg22946 = msg("20779", dup287); + +var msg22947 = msg("20780", dup287); + +var msg22948 = msg("20781", dup287); + +var msg22949 = msg("20782", dup287); + +var msg22950 = msg("20783", dup287); + +var msg22951 = msg("20784", dup287); + +var msg22952 = msg("20785", dup287); + +var msg22953 = msg("20786", dup267); + +var msg22954 = msg("20787", dup267); + +var msg22955 = msg("20788", dup267); + +var msg22956 = msg("20789", dup267); + +var msg22957 = msg("20790", dup267); + +var msg22958 = msg("20791", dup202); + +var msg22959 = msg("20792", dup202); + +var msg22960 = msg("20793", dup202); + +var msg22961 = msg("20794", dup202); + +var msg22962 = msg("20795", dup202); + +var msg22963 = msg("20796", dup202); + +var msg22964 = msg("20797", dup202); + +var msg22965 = msg("20798", dup202); + +var msg22966 = msg("20799", dup202); + +var msg22967 = msg("20800", dup202); + +var msg22968 = msg("20801", dup202); + +var msg22969 = msg("20802", dup267); + +var msg22970 = msg("20803", dup287); + +var msg22971 = msg("20804", dup267); + +var msg22972 = msg("20805", dup267); + +var msg22973 = msg("20806", dup267); + +var msg22974 = msg("20807", dup267); + +var msg22975 = msg("20808", dup267); + +var msg22976 = msg("20809", dup267); + +var msg22977 = msg("20810", dup267); + +var msg22978 = msg("20811", dup267); + +var msg22979 = msg("20812", dup197); + +var msg22980 = msg("20813", dup197); + +var msg22981 = msg("20814", dup201); + +var msg22982 = msg("20815", dup202); + +var msg22983 = msg("20816", dup202); + +var msg22984 = msg("20817", dup202); + +var msg22985 = msg("20818", dup202); + +var msg22986 = msg("20819", dup265); + +var msg22987 = msg("20820", dup267); + +var msg22988 = msg("20821", dup267); + +var msg22989 = msg("20822", dup267); + +var msg22990 = msg("20823", dup267); + +var msg22991 = msg("20824", dup267); + +var msg22992 = msg("20825", dup267); + +var msg22993 = msg("20826", dup201); + +var msg22994 = msg("20827", dup267); + +var msg22995 = msg("20828", dup265); + +var msg22996 = msg("20829", dup265); + +var msg22997 = msg("20830", dup192); + +var msg22998 = msg("20831", dup201); + +var msg22999 = msg("20832", dup260); + +var msg23000 = msg("20833", dup263); + +var msg23001 = msg("20834", dup267); + +var msg23002 = msg("20835", dup267); + +var msg23003 = msg("20836", dup202); + +var msg23004 = msg("20837", dup192); + +var msg23005 = msg("20838", dup192); + +var msg23006 = msg("20839", dup202); + +var msg23007 = msg("20840", dup202); + +var msg23008 = msg("20841", dup202); + +var msg23009 = msg("20842", dup197); + +var msg23010 = msg("20843", dup197); + +var msg23011 = msg("20844", dup202); + +var msg23012 = msg("20845", dup267); + +var msg23013 = msg("20846", dup197); + +var msg23014 = msg("20847", dup197); + +var msg23015 = msg("20848", dup202); + +var msg23016 = msg("20849", dup202); + +var msg23017 = msg("20850", dup202); + +var msg23018 = msg("20851", dup202); + +var msg23019 = msg("20852", dup287); + +var msg23020 = msg("20853", dup201); + +var msg23021 = msg("20854", dup202); + +var msg23022 = msg("20855", dup202); + +var msg23023 = msg("20856", dup202); + +var msg23024 = msg("20857", dup202); + +var msg23025 = msg("20858", dup197); + +var msg23026 = msg("20859", dup287); + +var msg23027 = msg("20860", dup202); + +var msg23028 = msg("20861", dup201); + +var msg23029 = msg("20862", dup265); + +var msg23030 = msg("20863", dup265); + +var msg23031 = msg("20864", dup265); + +var msg23032 = msg("20865", dup265); + +var msg23033 = msg("20866", dup265); + +var msg23034 = msg("20867", dup265); + +var msg23035 = msg("20868", dup265); + +var msg23036 = msg("20869", dup287); + +var msg23037 = msg("20870", dup201); + +var msg23038 = msg("20871", dup267); + +var msg23039 = msg("20872", dup267); + +var msg23040 = msg("20873", dup202); + +var msg23041 = msg("20874", dup267); + +var msg23042 = msg("20875", dup265); + +var msg23043 = msg("20876", dup267); + +var msg23044 = msg("20877", dup238); + +var msg23045 = msg("20878", dup276); + +var msg23046 = msg("20879", dup267); + +var msg23047 = msg("20880", dup267); + +var msg23048 = msg("20881", dup202); + +var msg23049 = msg("20882", dup202); + +var msg23050 = msg("20883", dup265); + +var msg23051 = msg("20884", dup267); + +var msg23052 = msg("20885", dup202); + +var msg23053 = msg("20886", dup202); + +var msg23054 = msg("20887", dup202); + +var msg23055 = msg("20888", dup202); + +var msg23056 = msg("20889", dup197); + +var msg23057 = msg("20890", dup202); + +var msg23058 = msg("20891", dup202); + +var msg23059 = msg("20892", dup238); + +var msg23060 = msg("20893", dup202); + +var msg23061 = msg("20894", dup202); + +var msg23062 = msg("20895", dup287); + +var msg23063 = msg("20896", dup287); + +var msg23064 = msg("20897", dup202); + +var msg23065 = msg("20898", dup202); + +var msg23066 = msg("20899", dup202); + +var msg23067 = msg("20900", dup197); + +var msg23068 = msg("20901", dup267); + +var msg23069 = msg("20902", dup197); + +var msg23070 = msg("20903", dup197); + +var msg23071 = msg("20904", dup197); + +var msg23072 = msg("20905", dup202); + +var msg23073 = msg("20906", dup202); + +var msg23074 = msg("20907", dup202); + +var msg23075 = msg("20908", dup202); + +var msg23076 = msg("20909", dup269); + +var msg23077 = msg("20910", dup269); + +var msg23078 = msg("20911", dup202); + +var msg23079 = msg("20912", dup202); + +var msg23080 = msg("20913", dup202); + +var msg23081 = msg("20914", dup202); + +var msg23082 = msg("20915", dup202); + +var msg23083 = msg("20916", dup202); + +var msg23084 = msg("20917", dup202); + +var msg23085 = msg("20918", dup202); + +var msg23086 = msg("20919", dup267); + +var msg23087 = msg("20920", dup267); + +var msg23088 = msg("20921", dup197); + +var msg23089 = msg("20922", dup197); + +var msg23090 = msg("20923", dup197); + +var msg23091 = msg("20924", dup202); + +var msg23092 = msg("20925", dup202); + +var msg23093 = msg("20926", dup202); + +var msg23094 = msg("20927", dup192); + +var msg23095 = msg("20928", dup202); + +var msg23096 = msg("20929", dup202); + +var msg23097 = msg("20930", dup202); + +var msg23098 = msg("20931", dup202); + +var msg23099 = msg("20932", dup202); + +var msg23100 = msg("20933", dup202); + +var msg23101 = msg("20934", dup202); + +var msg23102 = msg("20935", dup202); + +var msg23103 = msg("20936", dup202); + +var msg23104 = msg("20937", dup202); + +var msg23105 = msg("20938", dup202); + +var msg23106 = msg("20939", dup202); + +var msg23107 = msg("20940", dup202); + +var msg23108 = msg("20941", dup202); + +var msg23109 = msg("20942", dup202); + +var msg23110 = msg("20943", dup202); + +var msg23111 = msg("20944", dup202); + +var msg23112 = msg("20945", dup202); + +var msg23113 = msg("20946", dup202); + +var msg23114 = msg("20947", dup202); + +var msg23115 = msg("20948", dup202); + +var msg23116 = msg("20949", dup265); + +var msg23117 = msg("20950", dup202); + +var msg23118 = msg("20951", dup202); + +var msg23119 = msg("20952", dup202); + +var msg23120 = msg("20953", dup202); + +var msg23121 = msg("20954", dup202); + +var msg23122 = msg("20955", dup202); + +var msg23123 = msg("20956", dup202); + +var msg23124 = msg("20957", dup202); + +var msg23125 = msg("20958", dup202); + +var msg23126 = msg("20959", dup202); + +var msg23127 = msg("20960", dup202); + +var msg23128 = msg("20961", dup202); + +var msg23129 = msg("20962", dup202); + +var msg23130 = msg("20963", dup202); + +var msg23131 = msg("20964", dup202); + +var msg23132 = msg("20965", dup202); + +var msg23133 = msg("20966", dup202); + +var msg23134 = msg("20967", dup202); + +var msg23135 = msg("20968", dup202); + +var msg23136 = msg("20969", dup202); + +var msg23137 = msg("20970", dup202); + +var msg23138 = msg("20971", dup202); + +var msg23139 = msg("20972", dup202); + +var msg23140 = msg("20973", dup202); + +var msg23141 = msg("20974", dup202); + +var msg23142 = msg("20975", dup202); + +var msg23143 = msg("20976", dup202); + +var msg23144 = msg("20977", dup202); + +var msg23145 = msg("20978", dup202); + +var msg23146 = msg("20979", dup202); + +var msg23147 = msg("20980", dup202); + +var msg23148 = msg("20981", dup202); + +var msg23149 = msg("20982", dup202); + +var msg23150 = msg("20983", dup202); + +var msg23151 = msg("20984", dup202); + +var msg23152 = msg("20985", dup202); + +var msg23153 = msg("20986", dup202); + +var msg23154 = msg("20987", dup202); + +var msg23155 = msg("20988", dup267); + +var msg23156 = msg("20989", dup199); + +var msg23157 = msg("20990", dup199); + +var msg23158 = msg("20991", dup202); + +var msg23159 = msg("20992", dup202); + +var msg23160 = msg("20993", dup197); + +var msg23161 = msg("20994", dup197); + +var msg23162 = msg("20995", dup202); + +var msg23163 = msg("20996", dup202); + +var msg23164 = msg("20997", dup267); + +var msg23165 = msg("20998", dup267); + +var msg23166 = msg("20999", dup202); + +var msg23167 = msg("21000", dup202); + +var msg23168 = msg("21001", dup202); + +var msg23169 = msg("21002", dup202); + +var msg23170 = msg("21003", dup202); + +var msg23171 = msg("21004", dup202); + +var msg23172 = msg("21005", dup202); + +var msg23173 = msg("21006", dup202); + +var msg23174 = msg("21007", dup202); + +var msg23175 = msg("21008", dup202); + +var msg23176 = msg("21009", dup202); + +var msg23177 = msg("21010", dup202); + +var msg23178 = msg("21011", dup202); + +var msg23179 = msg("21012", dup202); + +var msg23180 = msg("21013", dup202); + +var msg23181 = msg("21014", dup202); + +var msg23182 = msg("21015", dup202); + +var msg23183 = msg("21016", dup202); + +var msg23184 = msg("21017", dup202); + +var msg23185 = msg("21018", dup202); + +var msg23186 = msg("21019", dup197); + +var msg23187 = msg("21020", dup197); + +var msg23188 = msg("21021", dup197); + +var msg23189 = msg("21022", dup265); + +var msg23190 = msg("21023", dup265); + +var msg23191 = msg("21024", dup265); + +var msg23192 = msg("21025", dup202); + +var msg23193 = msg("21026", dup265); + +var msg23194 = msg("21027", dup202); + +var msg23195 = msg("21028", dup192); + +var msg23196 = msg("21029", dup265); + +var msg23197 = msg("21030", dup265); + +var msg23198 = msg("21031", dup265); + +var msg23199 = msg("21032", dup265); + +var msg23200 = msg("21033", dup265); + +var msg23201 = msg("21034", dup265); + +var msg23202 = msg("21035", dup202); + +var msg23203 = msg("21036", dup202); + +var msg23204 = msg("21037", dup287); + +var msg23205 = msg("21038", dup287); + +var msg23206 = msg("21039", dup287); + +var msg23207 = msg("21040", dup287); + +var msg23208 = msg("21041", dup202); + +var msg23209 = msg("21042", dup202); + +var msg23210 = msg("21043", dup202); + +var msg23211 = msg("21044", dup202); + +var msg23212 = msg("21045", dup202); + +var msg23213 = msg("21046", dup269); + +var msg23214 = msg("21047", dup269); + +var msg23215 = msg("21048", dup263); + +var msg23216 = msg("21049", dup263); + +var msg23217 = msg("21050", dup197); + +var msg23218 = msg("21051", dup267); + +var msg23219 = msg("21052", dup202); + +var msg23220 = msg("21053", dup202); + +var msg23221 = msg("21054", dup202); + +var msg23222 = msg("21055", dup192); + +var msg23223 = msg("21056", dup202); + +var msg23224 = msg("21057", dup201); + +var msg23225 = msg("21058", dup202); + +var msg23226 = msg("21059", dup202); + +var msg23227 = msg("21060", dup267); + +var msg23228 = msg("21061", dup202); + +var msg23229 = msg("21062", dup202); + +var msg23230 = msg("21063", dup265); + +var msg23231 = msg("21064", dup265); + +var msg23232 = msg("21065", dup201); + +var msg23233 = msg("21066", dup201); + +var msg23234 = msg("21067", dup201); + +var msg23235 = msg("21068", dup267); + +var msg23236 = msg("21069", dup267); + +var msg23237 = msg("21070", dup267); + +var msg23238 = msg("21071", dup267); + +var msg23239 = msg("21072", dup267); + +var msg23240 = msg("21073", dup267); + +var msg23241 = msg("21074", dup267); + +var msg23242 = msg("21075", dup267); + +var msg23243 = msg("21076", dup265); + +var msg23244 = msg("21077", dup202); + +var msg23245 = msg("21078", dup267); + +var msg23246 = msg("21079", dup202); + +var msg23247 = msg("21080", dup267); + +var msg23248 = msg("21081", dup267); + +var msg23249 = msg("21082", dup202); + +var msg23250 = msg("21083", dup202); + +var msg23251 = msg("21084", dup260); + +var msg23252 = msg("21085", dup260); + +var msg23253 = msg("21086", dup267); + +var msg23254 = msg("21087", dup238); + +var msg23255 = msg("21088", dup267); + +var msg23256 = msg("21089", dup267); + +var msg23257 = msg("21090", dup267); + +var msg23258 = msg("21091", dup267); + +var msg23259 = msg("21092", dup267); + +var msg23260 = msg("21093", dup267); + +var msg23261 = msg("21094", dup265); + +var msg23262 = msg("21095", dup265); + +var msg23263 = msg("21096", dup267); + +var msg23264 = msg("21097", dup267); + +var msg23265 = msg("21098", dup267); + +var msg23266 = msg("21099", dup267); + +var msg23267 = msg("21100", dup197); + +var msg23268 = msg("21101", dup287); + +var msg23269 = msg("21102", dup287); + +var msg23270 = msg("21103", dup287); + +var msg23271 = msg("21104", dup198); + +var msg23272 = msg("21105", dup197); + +var msg23273 = msg("21106", dup202); + +var msg23274 = msg("21107", dup197); + +var msg23275 = msg("21108", dup267); + +var msg23276 = msg("21109", dup202); + +var msg23277 = msg("21110", dup202); + +var msg23278 = msg("21111", dup202); + +var msg23279 = msg("21112", dup267); + +var msg23280 = msg("21113", dup202); + +var msg23281 = msg("21114", dup202); + +var msg23282 = msg("21115", dup202); + +var msg23283 = msg("21116", dup267); + +var msg23284 = msg("21117", dup192); + +var msg23285 = msg("21118", dup192); + +var msg23286 = msg("21119", dup192); + +var msg23287 = msg("21120", dup192); + +var msg23288 = msg("21121", dup192); + +var msg23289 = msg("21122", dup202); + +var msg23290 = msg("21123", dup202); + +var msg23291 = msg("21124", dup202); + +var msg23292 = msg("21125", dup202); + +var msg23293 = msg("21126", dup202); + +var msg23294 = msg("21127", dup202); + +var msg23295 = msg("21128", dup202); + +var msg23296 = msg("21129", dup192); + +var msg23297 = msg("21130", dup192); + +var msg23298 = msg("21131", dup192); + +var msg23299 = msg("21132", dup192); + +var msg23300 = msg("21133", dup192); + +var msg23301 = msg("21134", dup192); + +var msg23302 = msg("21135", dup192); + +var msg23303 = msg("21136", dup192); + +var msg23304 = msg("21137", dup192); + +var msg23305 = msg("21138", dup192); + +var msg23306 = msg("21139", dup192); + +var msg23307 = msg("21140", dup192); + +var msg23308 = msg("21141", dup267); + +var msg23309 = msg("21142", dup202); + +var msg23310 = msg("21143", dup202); + +var msg23311 = msg("21144", dup202); + +var msg23312 = msg("21145", dup202); + +var msg23313 = msg("21146", dup197); + +var msg23314 = msg("21147", dup197); + +var msg23315 = msg("21148", dup197); + +var msg23316 = msg("21149", dup197); + +var msg23317 = msg("21150", dup198); + +var msg23318 = msg("21151", dup202); + +var msg23319 = msg("21152", dup202); + +var msg23320 = msg("21153", dup202); + +var msg23321 = msg("21154", dup197); + +var msg23322 = msg("21155", dup197); + +var msg23323 = msg("21156", dup267); + +var msg23324 = msg("21157", dup267); + +var msg23325 = msg("21158", dup267); + +var msg23326 = msg("21159", dup267); + +var msg23327 = msg("21160", dup197); + +var msg23328 = msg("21161", dup265); + +var msg23329 = msg("21162", dup197); + +var msg23330 = msg("21163", dup197); + +var msg23331 = msg("21164", dup201); + +var msg23332 = msg("21165", dup265); + +var msg23333 = msg("21166", dup267); + +var msg23334 = msg("21167", dup267); + +var msg23335 = msg("21168", dup197); + +var msg23336 = msg("21169", dup303); + +var msg23337 = msg("21170", dup267); + +var msg23338 = msg("21171", dup320); + +var msg23339 = msg("21172", dup320); + +var msg23340 = msg("21173", dup320); + +var msg23341 = msg("21174", dup202); + +var msg23342 = msg("21175", dup269); + +var msg23343 = msg("21176", dup303); + +var msg23344 = msg("21177", dup192); + +var msg23345 = msg("21178", dup192); + +var msg23346 = msg("21179", dup192); + +var msg23347 = msg("21180", dup238); + +var msg23348 = msg("21181", dup192); + +var msg23349 = msg("21182", dup192); + +var msg23350 = msg("21183", dup192); + +var msg23351 = msg("21184", dup303); + +var msg23352 = msg("21185", dup238); + +var msg23353 = msg("21186", dup267); + +var msg23354 = msg("21187", dup192); + +var msg23355 = msg("21188", dup269); + +var msg23356 = msg("21189", dup267); + +var msg23357 = msg("21190", dup287); + +var msg23358 = msg("21191", dup276); + +var msg23359 = msg("21192", dup192); + +var msg23360 = msg("21193", dup192); + +var msg23361 = msg("21194", dup192); + +var msg23362 = msg("21195", dup192); + +var msg23363 = msg("21196", dup192); + +var msg23364 = msg("21197", dup192); + +var msg23365 = msg("21198", dup192); + +var msg23366 = msg("21199", dup192); + +var msg23367 = msg("21200", dup192); + +var msg23368 = msg("21201", dup192); + +var msg23369 = msg("21202", dup192); + +var msg23370 = msg("21203", dup263); + +var msg23371 = msg("21204", dup263); + +var msg23372 = msg("21205", dup263); + +var msg23373 = msg("21206", dup269); + +var msg23374 = msg("21207", dup192); + +var msg23375 = msg("21208", dup192); + +var msg23376 = msg("21209", dup192); + +var msg23377 = msg("21210", dup192); + +var msg23378 = msg("21211", dup192); + +var msg23379 = msg("21212", dup192); + +var msg23380 = msg("21213", dup238); + +var msg23381 = msg("21214", dup265); + +var msg23382 = msg("21215", dup192); + +var msg23383 = msg("21216", dup192); + +var msg23384 = msg("21217", dup192); + +var msg23385 = msg("21218", dup192); + +var msg23386 = msg("21219", dup192); + +var msg23387 = msg("21220", dup192); + +var msg23388 = msg("21221", dup192); + +var msg23389 = msg("21222", dup202); + +var msg23390 = msg("21223", dup192); + +var msg23391 = msg("21224", dup192); + +var msg23392 = msg("21225", dup269); + +var msg23393 = msg("21226", dup202); + +var msg23394 = msg("21227", dup192); + +var msg23395 = msg("21228", dup202); + +var msg23396 = msg("21229", dup198); + +var msg23397 = msg("21230", dup192); + +var msg23398 = msg("21231", dup202); + +var msg23399 = msg("21232", dup202); + +var msg23400 = msg("21233", dup265); + +var msg23401 = msg("21234", dup309); + +var msg23402 = msg("21235", dup197); + +var msg23403 = msg("21236", dup197); + +var msg23404 = msg("21237", dup197); + +var msg23405 = msg("21238", dup197); + +var msg23406 = msg("21239", dup202); + +var msg23407 = msg("21240", dup192); + +var msg23408 = msg("21241", dup192); + +var msg23409 = msg("21242", dup192); + +var msg23410 = msg("21243", dup267); + +var msg23411 = msg("21244", dup267); + +var msg23412 = msg("21245", dup263); + +var msg23413 = msg("21246", dup269); + +var msg23414 = msg("21247", dup197); + +var msg23415 = msg("21248", dup197); + +var msg23416 = msg("21249", dup192); + +var msg23417 = msg("21250", dup192); + +var msg23418 = msg("21251", dup192); + +var msg23419 = msg("21252", dup192); + +var msg23420 = msg("21253", dup267); + +var msg23421 = msg("21254", dup265); + +var msg23422 = msg("21255", dup227); + +var msg23423 = msg("21256", dup227); + +var msg23424 = msg("21257", dup194); + +var msg23425 = msg("21258", dup199); + +var msg23426 = msg("21259", dup267); + +var msg23427 = msg("21260", dup198); + +var msg23428 = msg("21261", dup197); + +var msg23429 = msg("21262", dup255); + +var msg23430 = msg("21263", dup197); + +var msg23431 = msg("21264", dup202); + +var msg23432 = msg("21265", dup199); + +var msg23433 = msg("21266", dup269); + +var msg23434 = msg("21267", dup287); + +var msg23435 = msg("21268", dup267); + +var msg23436 = msg("21269", dup202); + +var msg23437 = msg("21270", dup201); + +var msg23438 = msg("21271", dup260); + +var msg23439 = msg("21272", dup267); + +var msg23440 = msg("21273", dup202); + +var msg23441 = msg("21274", dup202); + +var msg23442 = msg("21275", dup192); + +var msg23443 = msg("21276", dup192); + +var msg23444 = msg("21277", dup192); + +var msg23445 = msg("21278", dup269); + +var msg23446 = msg("21279", dup192); + +var msg23447 = msg("21280", dup192); + +var msg23448 = msg("21281", dup267); + +var msg23449 = msg("21282", dup202); + +var msg23450 = msg("21283", dup202); + +var msg23451 = msg("21284", dup202); + +var msg23452 = msg("21285", dup202); + +var msg23453 = msg("21286", dup202); + +var msg23454 = msg("21287", dup202); + +var msg23455 = msg("21288", dup202); + +var msg23456 = msg("21289", dup276); + +var msg23457 = msg("21290", dup267); + +var msg23458 = msg("21291", dup202); + +var msg23459 = msg("21292", dup267); + +var msg23460 = msg("21293", dup267); + +var msg23461 = msg("21294", dup192); + +var msg23462 = msg("21295", dup202); + +var msg23463 = msg("21296", dup202); + +var msg23464 = msg("21297", dup265); + +var msg23465 = msg("21298", dup265); + +var msg23466 = msg("21299", dup267); + +var msg23467 = msg("21300", dup265); + +var msg23468 = msg("21301", dup267); + +var msg23469 = msg("21302", dup267); + +var msg23470 = msg("21303", dup192); + +var msg23471 = msg("21304", dup192); + +var msg23472 = msg("21305", dup197); + +var msg23473 = msg("21306", dup202); + +var msg23474 = msg("21307", dup267); + +var msg23475 = msg("21308", dup267); + +var msg23476 = msg("21309", dup276); + +var msg23477 = msg("21310", dup267); + +var msg23478 = msg("21311", dup202); + +var msg23479 = msg("21312", dup202); + +var msg23480 = msg("21313", dup202); + +var msg23481 = msg("21314", dup265); + +var msg23482 = msg("21315", dup198); + +var msg23483 = msg("21316", dup267); + +var msg23484 = msg("21317", dup197); + +var msg23485 = msg("21318", dup202); + +var msg23486 = msg("21319", dup276); + +var msg23487 = msg("21320", dup276); + +var msg23488 = msg("21321", dup276); + +var msg23489 = msg("21322", dup267); + +var msg23490 = msg("21323", dup267); + +var msg23491 = msg("21324", dup267); + +var msg23492 = msg("21325", dup202); + +var msg23493 = msg("21326", dup267); + +var msg23494 = msg("21327", dup194); + +var msg23495 = msg("21328", dup201); + +var msg23496 = msg("21329", dup201); + +var msg23497 = msg("21330", dup201); + +var msg23498 = msg("21331", dup201); + +var msg23499 = msg("21332", dup202); + +var msg23500 = msg("21333", dup265); + +var msg23501 = msg("21334", dup265); + +var msg23502 = msg("21335", dup287); + +var msg23503 = msg("21336", dup202); + +var msg23504 = msg("21337", dup265); + +var msg23505 = msg("21338", dup202); + +var msg23506 = msg("21339", dup267); + +var msg23507 = msg("21340", dup267); + +var msg23508 = msg("21341", dup267); + +var msg23509 = msg("21342", dup267); + +var msg23510 = msg("21343", dup267); + +var msg23511 = msg("21344", dup267); + +var msg23512 = msg("21345", dup267); + +var msg23513 = msg("21346", dup267); + +var msg23514 = msg("21347", dup202); + +var msg23515 = msg("21348", dup202); + +var msg23516 = msg("21349", dup197); + +var msg23517 = msg("21350", dup197); + +var msg23518 = msg("21351", dup267); + +var msg23519 = msg("21352", dup267); + +var msg23520 = msg("21353", dup269); + +var msg23521 = msg("21354", dup313); + +var msg23522 = msg("21355", dup313); + +var msg23523 = msg("21356", dup265); + +var msg23524 = msg("21357", dup267); + +var msg23525 = msg("21358", dup201); + +var msg23526 = msg("21359", dup192); + +var msg23527 = msg("21360", dup192); + +var msg23528 = msg("21361", dup238); + +var msg23529 = msg("21362", dup192); + +var msg23530 = msg("21363", dup202); + +var msg23531 = msg("21364", dup192); + +var msg23532 = msg("21365", dup192); + +var msg23533 = msg("21366", dup192); + +var msg23534 = msg("21367", dup192); + +var msg23535 = msg("21368", dup202); + +var msg23536 = msg("21369", dup202); + +var msg23537 = msg("21370", dup197); + +var msg23538 = msg("21371", dup197); + +var msg23539 = msg("21372", dup263); + +var msg23540 = msg("21373", dup263); + +var msg23541 = msg("21374", dup192); + +var msg23542 = msg("21375", dup267); + +var msg23543 = msg("21376", dup192); + +var msg23544 = msg("21377", dup260); + +var msg23545 = msg("21378", dup201); + +var msg23546 = msg("21379", dup202); + +var msg23547 = msg("21380", dup202); + +var msg23548 = msg("21381", dup202); + +var msg23549 = msg("21382", dup202); + +var msg23550 = msg("21383", dup202); + +var msg23551 = msg("21384", dup202); + +var msg23552 = msg("21385", dup265); + +var msg23553 = msg("21386", dup202); + +var msg23554 = msg("21387", dup267); + +var msg23555 = msg("21388", dup265); + +var msg23556 = msg("21389", dup265); + +var msg23557 = msg("21390", dup202); + +var msg23558 = msg("21391", dup202); + +var msg23559 = msg("21392", dup267); + +var msg23560 = msg("21393", dup197); + +var msg23561 = msg("21394", dup267); + +var msg23562 = msg("21395", dup260); + +var msg23563 = msg("21396", dup260); + +var msg23564 = msg("21397", dup197); + +var msg23565 = msg("21398", dup202); + +var msg23566 = msg("21399", dup267); + +var msg23567 = msg("21400", dup192); + +var msg23568 = msg("21401", dup192); + +var msg23569 = msg("21402", dup192); + +var msg23570 = msg("21403", dup238); + +var msg23571 = msg("21404", dup238); + +var msg23572 = msg("21405", dup267); + +var msg23573 = msg("21406", dup265); + +var msg23574 = msg("21407", dup201); + +var msg23575 = msg("21408", dup265); + +var msg23576 = msg("21409", dup201); + +var msg23577 = msg("21410", dup202); + +var msg23578 = msg("21411", dup202); + +var msg23579 = msg("21412", dup202); + +var msg23580 = msg("21413", dup201); + +var msg23581 = msg("21414", dup267); + +var msg23582 = msg("21415", dup267); + +var msg23583 = msg("21416", dup192); + +var msg23584 = msg("21417", dup267); + +var msg23585 = msg("21418", dup192); + +var msg23586 = msg("21419", dup197); + +var msg23587 = msg("21420", dup197); + +var msg23588 = msg("21421", dup197); + +var msg23589 = msg("21422", dup267); + +var msg23590 = msg("21423", dup267); + +var msg23591 = msg("21424", dup192); + +var msg23592 = msg("21425", dup192); + +var msg23593 = msg("21426", dup192); + +var msg23594 = msg("21427", dup192); + +var msg23595 = msg("21428", dup192); + +var msg23596 = msg("21429", dup269); + +var msg23597 = msg("21430", dup192); + +var msg23598 = msg("21431", dup267); + +var msg23599 = msg("21432", dup202); + +var msg23600 = msg("21433", dup202); + +var msg23601 = msg("21434", dup192); + +var msg23602 = msg("21435", dup192); + +var msg23603 = msg("21436", dup192); + +var msg23604 = msg("21437", dup197); + +var msg23605 = msg("21438", dup267); + +var msg23606 = msg("21439", dup267); + +var msg23607 = msg("21440", dup192); + +var msg23608 = msg("21441", dup202); + +var msg23609 = msg("21442", dup269); + +var msg23610 = msg("21443", dup202); + +var msg23611 = msg("21444", dup202); + +var msg23612 = msg("21445", dup227); + +var msg23613 = msg("21446", dup202); + +var msg23614 = msg("21447", dup202); + +var msg23615 = msg("21448", dup192); + +var msg23616 = msg("21449", dup192); + +var msg23617 = msg("21450", dup192); + +var msg23618 = msg("21451", dup269); + +var msg23619 = msg("21452", dup192); + +var msg23620 = msg("21453", dup269); + +var msg23621 = msg("21454", dup192); + +var msg23622 = msg("21455", dup269); + +var msg23623 = msg("21456", dup202); + +var msg23624 = msg("21457", dup267); + +var msg23625 = msg("21458", dup267); + +var msg23626 = msg("21459", dup260); + +var msg23627 = msg("21460", dup202); + +var msg23628 = msg("21461", dup202); + +var msg23629 = msg("21462", dup202); + +var msg23630 = msg("21463", dup202); + +var msg23631 = msg("21464", dup202); + +var msg23632 = msg("21465", dup265); + +var msg23633 = msg("21466", dup202); + +var msg23634 = msg("21467", dup202); + +var msg23635 = msg("21468", dup192); + +var msg23636 = msg("21469", dup269); + +var msg23637 = msg("21470", dup192); + +var msg23638 = msg("21471", dup202); + +var msg23639 = msg("21472", dup192); + +var msg23640 = msg("21473", dup192); + +var msg23641 = msg("21474", dup192); + +var msg23642 = msg("21475", dup269); + +var msg23643 = msg("21476", dup269); + +var msg23644 = msg("21477", dup192); + +var msg23645 = msg("21478", dup202); + +var msg23646 = msg("21479", dup202); + +var msg23647 = msg("21480", dup202); + +var msg23648 = msg("21481", dup267); + +var msg23649 = msg("21482", dup199); + +var msg23650 = msg("21483", dup197); + +var msg23651 = msg("21484", dup201); + +var msg23652 = msg("21485", dup198); + +var msg23653 = msg("21486", dup192); + +var msg23654 = msg("21487", dup192); + +var msg23655 = msg("21488", dup269); + +var msg23656 = msg("21489", dup267); + +var msg23657 = msg("21490", dup202); + +var msg23658 = msg("21491", dup197); + +var msg23659 = msg("21492", dup202); + +var msg23660 = msg("21493", dup265); + +var msg23661 = msg("21494", dup192); + +var msg23662 = msg("21495", dup192); + +var msg23663 = msg("21496", dup192); + +var msg23664 = msg("21497", dup192); + +var msg23665 = msg("21498", dup202); + +var msg23666 = msg("21499", dup202); + +var msg23667 = msg("21500", dup202); + +var msg23668 = msg("21501", dup265); + +var msg23669 = msg("21502", dup192); + +var msg23670 = msg("21503", dup267); + +var msg23671 = msg("21504", dup267); + +var msg23672 = msg("21505", dup267); + +var msg23673 = msg("21506", dup267); + +var msg23674 = msg("21507", dup267); + +var msg23675 = msg("21508", dup267); + +var msg23676 = msg("21509", dup267); + +var msg23677 = msg("21510", dup267); + +var msg23678 = msg("21511", dup192); + +var msg23679 = msg("21512", dup192); + +var msg23680 = msg("21513", dup198); + +var msg23681 = msg("21514", dup192); + +var msg23682 = msg("21515", dup265); + +var msg23683 = msg("21516", dup265); + +var msg23684 = msg("21517", dup265); + +var msg23685 = msg("21518", dup192); + +var msg23686 = msg("21519", dup202); + +var msg23687 = msg("21520", dup192); + +var msg23688 = msg("21521", dup192); + +var msg23689 = msg("21522", dup267); + +var msg23690 = msg("21523", dup192); + +var msg23691 = msg("21524", dup267); + +var msg23692 = msg("21525", dup192); + +var msg23693 = msg("21526", dup269); + +var msg23694 = msg("21527", dup192); + +var msg23695 = msg("21528", dup192); + +var msg23696 = msg("21529", dup197); + +var msg23697 = msg("21530", dup287); + +var msg23698 = msg("21531", dup265); + +var msg23699 = msg("21532", dup265); + +var msg23700 = msg("21533", dup287); + +var msg23701 = msg("21534", dup201); + +var msg23702 = msg("21535", dup201); + +var msg23703 = msg("21536", dup265); + +var msg23704 = msg("21537", dup269); + +var msg23705 = msg("21538", dup202); + +var msg23706 = msg("21539", dup202); + +var msg23707 = msg("21540", dup192); + +var msg23708 = msg("21541", dup192); + +var msg23709 = msg("21542", dup192); + +var msg23710 = msg("21543", dup192); + +var msg23711 = msg("21544", dup313); + +var msg23712 = msg("21545", dup313); + +var all52 = all_match({ + processors: [ + dup66, + dup178, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup120, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg23713 = msg("21546", all52); + +var msg23714 = msg("21547", dup192); + +var msg23715 = msg("21548", dup202); + +var msg23716 = msg("21549", dup202); + +var msg23717 = msg("21550", dup192); + +var msg23718 = msg("21551", dup192); + +var msg23719 = msg("21552", dup192); + +var msg23720 = msg("21553", dup192); + +var msg23721 = msg("21554", dup192); + +var msg23722 = msg("21555", dup205); + +var msg23723 = msg("21556", dup202); + +var msg23724 = msg("21557", dup201); + +var msg23725 = msg("21558", dup265); + +var msg23726 = msg("21559", dup265); + +var msg23727 = msg("21560", dup265); + +var msg23728 = msg("21561", dup265); + +var msg23729 = msg("21562", dup192); + +var msg23730 = msg("21563", dup192); + +var msg23731 = msg("21564", dup192); + +var msg23732 = msg("21565", dup192); + +var msg23733 = msg("21566", dup276); + +var msg23734 = msg("21567", dup267); + +var msg23735 = msg("21568", dup198); + +var msg23736 = msg("21569", dup265); + +var msg23737 = msg("21570", dup197); + +var msg23738 = msg("21571", dup267); + +var msg23739 = msg("21572", dup267); + +var msg23740 = msg("21573", dup202); + +var msg23741 = msg("21574", dup202); + +var msg23742 = msg("21575", dup202); + +var msg23743 = msg("21576", dup202); + +var msg23744 = msg("21577", dup202); + +var msg23745 = msg("21578", dup202); + +var msg23746 = msg("21579", dup202); + +var msg23747 = msg("21580", dup202); + +var msg23748 = msg("21581", dup202); + +var msg23749 = msg("21582", dup202); + +var msg23750 = msg("21583", dup269); + +var msg23751 = msg("21584", dup202); + +var msg23752 = msg("21585", dup202); + +var msg23753 = msg("21586", dup202); + +var msg23754 = msg("21587", dup267); + +var msg23755 = msg("21588", dup263); + +var msg23756 = msg("21589", dup265); + +var msg23757 = msg("21590", dup265); + +var msg23758 = msg("21591", dup263); + +var msg23759 = msg("21592", dup267); + +var msg23760 = msg("21593", dup192); + +var msg23761 = msg("21594", dup267); + +var msg23762 = msg("21595", dup202); + +var msg23763 = msg("21596", dup202); + +var msg23764 = msg("21597", dup202); + +var msg23765 = msg("21598", dup202); + +var msg23766 = msg("21599", dup201); + +var msg23767 = msg("21600", dup201); + +var msg23768 = msg("21601", dup201); + +var msg23769 = msg("21602", dup201); + +var msg23770 = msg("21603", dup201); + +var msg23771 = msg("21604", dup201); + +var msg23772 = msg("21605", dup201); + +var msg23773 = msg("21606", dup201); + +var msg23774 = msg("21607", dup267); + +var msg23775 = msg("21608", dup198); + +var msg23776 = msg("21609", dup267); + +var msg23777 = msg("21610", dup192); + +var msg23778 = msg("21611", dup202); + +var msg23779 = msg("21612", dup202); + +var msg23780 = msg("21613", dup202); + +var msg23781 = msg("21614", dup202); + +var msg23782 = msg("21615", dup202); + +var msg23783 = msg("21616", dup202); + +var msg23784 = msg("21617", dup202); + +var msg23785 = msg("21618", dup202); + +var msg23786 = msg("21619", dup267); + +var msg23787 = msg("21620", dup202); + +var msg23788 = msg("21621", dup202); + +var msg23789 = msg("21622", dup192); + +var msg23790 = msg("21623", dup202); + +var msg23791 = msg("21624", dup202); + +var msg23792 = msg("21625", dup202); + +var msg23793 = msg("21626", dup202); + +var msg23794 = msg("21627", dup202); + +var msg23795 = msg("21628", dup202); + +var msg23796 = msg("21629", dup265); + +var msg23797 = msg("21630", dup265); + +var msg23798 = msg("21631", dup192); + +var msg23799 = msg("21632", dup192); + +var msg23800 = msg("21633", dup276); + +var msg23801 = msg("21634", dup267); + +var msg23802 = msg("21635", dup192); + +var msg23803 = msg("21636", dup263); + +var msg23804 = msg("21637", dup312); + +var msg23805 = msg("21638", dup192); + +var msg23806 = msg("21639", dup263); + +var msg23807 = msg("21640", dup267); + +var msg23808 = msg("21641", dup192); + +var msg23809 = msg("21642", dup269); + +var msg23810 = msg("21643", dup192); + +var msg23811 = msg("21644", dup263); + +var msg23812 = msg("21645", dup263); + +var msg23813 = msg("21646", dup202); + +var msg23814 = msg("21647", dup202); + +var msg23815 = msg("21648", dup202); + +var msg23816 = msg("21649", dup202); + +var msg23817 = msg("21650", dup202); + +var msg23818 = msg("21651", dup202); + +var msg23819 = msg("21652", dup202); + +var msg23820 = msg("21653", dup265); + +var msg23821 = msg("21654", dup202); + +var msg23822 = msg("21655", dup267); + +var msg23823 = msg("21656", dup267); + +var msg23824 = msg("21657", dup202); + +var msg23825 = msg("21658", dup202); + +var msg23826 = msg("21659", dup202); + +var msg23827 = msg("21660", dup202); + +var msg23828 = msg("21661", dup202); + +var msg23829 = msg("21662", dup248); + +var msg23830 = msg("21663", dup260); + +var msg23831 = msg("21664", dup202); + +var msg23832 = msg("21665", dup202); + +var msg23833 = msg("21666", dup202); + +var msg23834 = msg("21667", dup265); + +var msg23835 = msg("21668", dup267); + +var msg23836 = msg("21669", dup287); + +var msg23837 = msg("21670", dup267); + +var msg23838 = msg("21671", dup201); + +var msg23839 = msg("21672", dup201); + +var msg23840 = msg("21673", dup287); + +var msg23841 = msg("21674", dup197); + +var msg23842 = msg("21675", dup197); + +var msg23843 = msg("21676", dup197); + +var msg23844 = msg("21677", dup197); + +var msg23845 = msg("21678", dup267); + +var msg23846 = msg("21679", dup267); + +var msg23847 = msg("21680", dup267); + +var msg23848 = msg("21681", dup267); + +var msg23849 = msg("21682", dup267); + +var msg23850 = msg("21683", dup267); + +var msg23851 = msg("21684", dup267); + +var msg23852 = msg("21685", dup267); + +var msg23853 = msg("21686", dup267); + +var msg23854 = msg("21687", dup202); + +var msg23855 = msg("21688", dup202); + +var msg23856 = msg("21689", dup202); + +var msg23857 = msg("21690", dup202); + +var msg23858 = msg("21691", dup202); + +var msg23859 = msg("21692", dup202); + +var msg23860 = msg("21693", dup202); + +var msg23861 = msg("21694", dup202); + +var msg23862 = msg("21695", dup202); + +var msg23863 = msg("21696", dup202); + +var msg23864 = msg("21697", dup202); + +var msg23865 = msg("21698", dup202); + +var msg23866 = msg("21699", dup202); + +var msg23867 = msg("21700", dup202); + +var msg23868 = msg("21701", dup202); + +var msg23869 = msg("21702", dup202); + +var msg23870 = msg("21703", dup202); + +var msg23871 = msg("21704", dup202); + +var msg23872 = msg("21705", dup202); + +var msg23873 = msg("21706", dup202); + +var msg23874 = msg("21707", dup202); + +var msg23875 = msg("21708", dup202); + +var msg23876 = msg("21709", dup202); + +var msg23877 = msg("21710", dup202); + +var msg23878 = msg("21711", dup202); + +var msg23879 = msg("21712", dup202); + +var msg23880 = msg("21713", dup202); + +var msg23881 = msg("21714", dup202); + +var msg23882 = msg("21715", dup202); + +var msg23883 = msg("21716", dup202); + +var msg23884 = msg("21717", dup202); + +var msg23885 = msg("21718", dup202); + +var msg23886 = msg("21719", dup202); + +var msg23887 = msg("21720", dup202); + +var msg23888 = msg("21721", dup202); + +var msg23889 = msg("21722", dup202); + +var msg23890 = msg("21723", dup202); + +var msg23891 = msg("21724", dup202); + +var msg23892 = msg("21725", dup202); + +var msg23893 = msg("21726", dup202); + +var msg23894 = msg("21727", dup202); + +var msg23895 = msg("21728", dup202); + +var msg23896 = msg("21729", dup202); + +var msg23897 = msg("21730", dup202); + +var msg23898 = msg("21731", dup202); + +var msg23899 = msg("21732", dup202); + +var msg23900 = msg("21733", dup202); + +var msg23901 = msg("21734", dup202); + +var msg23902 = msg("21735", dup202); + +var msg23903 = msg("21736", dup202); + +var msg23904 = msg("21737", dup202); + +var msg23905 = msg("21738", dup202); + +var msg23906 = msg("21739", dup202); + +var msg23907 = msg("21740", dup202); + +var msg23908 = msg("21741", dup202); + +var msg23909 = msg("21742", dup202); + +var msg23910 = msg("21743", dup202); + +var msg23911 = msg("21744", dup202); + +var msg23912 = msg("21745", dup202); + +var msg23913 = msg("21746", dup202); + +var msg23914 = msg("21747", dup202); + +var msg23915 = msg("21748", dup202); + +var msg23916 = msg("21749", dup202); + +var msg23917 = msg("21750", dup202); + +var msg23918 = msg("21751", dup202); + +var msg23919 = msg("21752", dup197); + +var msg23920 = msg("21753", dup197); + +var msg23921 = msg("21754", dup265); + +var msg23922 = msg("21755", dup202); + +var msg23923 = msg("21756", dup202); + +var msg23924 = msg("21757", dup202); + +var msg23925 = msg("21758", dup202); + +var msg23926 = msg("21759", dup197); + +var msg23927 = msg("21760", dup202); + +var msg23928 = msg("21761", dup202); + +var msg23929 = msg("21762", dup197); + +var msg23930 = msg("21763", dup198); + +var msg23931 = msg("21764", dup197); + +var msg23932 = msg("21765", dup202); + +var msg23933 = msg("21766", dup267); + +var msg23934 = msg("21767", dup287); + +var msg23935 = msg("21768", dup287); + +var msg23936 = msg("21769", dup192); + +var msg23937 = msg("21770", dup197); + +var msg23938 = msg("21771", dup197); + +var msg23939 = msg("21772", dup197); + +var msg23940 = msg("21773", dup197); + +var msg23941 = msg("21774", dup197); + +var msg23942 = msg("21775", dup197); + +var msg23943 = msg("21776", dup198); + +var msg23944 = msg("21777", dup260); + +var msg23945 = msg("21778", dup260); + +var msg23946 = msg("21779", dup260); + +var msg23947 = msg("21780", dup260); + +var msg23948 = msg("21781", dup260); + +var msg23949 = msg("21782", dup267); + +var msg23950 = msg("21783", dup267); + +var msg23951 = msg("21784", dup267); + +var msg23952 = msg("21785", dup201); + +var msg23953 = msg("21786", dup201); + +var msg23954 = msg("21787", dup201); + +var msg23955 = msg("21788", dup260); + +var msg23956 = msg("21789", dup260); + +var msg23957 = msg("21790", dup269); + +var msg23958 = msg("21791", dup265); + +var msg23959 = msg("21792", dup202); + +var msg23960 = msg("21793", dup265); + +var msg23961 = msg("21794", dup197); + +var msg23962 = msg("21795", dup285); + +var msg23963 = msg("21796", dup265); + +var msg23964 = msg("21797", dup197); + +var msg23965 = msg("21798", dup197); + +var msg23966 = msg("21799", dup197); + +var msg23967 = msg("21800", dup197); + +var msg23968 = msg("21801", dup197); + +var msg23969 = msg("21802", dup202); + +var msg23970 = msg("21803", dup202); + +var msg23971 = msg("21804", dup202); + +var msg23972 = msg("21805", dup197); + +var msg23973 = msg("21806", dup276); + +var msg23974 = msg("21807", dup202); + +var msg23975 = msg("21808", dup202); + +var msg23976 = msg("21809", dup202); + +var msg23977 = msg("21810", dup202); + +var msg23978 = msg("21811", dup202); + +var msg23979 = msg("21812", dup202); + +var msg23980 = msg("21813", dup202); + +var msg23981 = msg("21814", dup202); + +var msg23982 = msg("21815", dup202); + +var msg23983 = msg("21816", dup202); + +var msg23984 = msg("21817", dup198); + +var msg23985 = msg("21818", dup265); + +var msg23986 = msg("21819", dup265); + +var msg23987 = msg("21820", dup265); + +var msg23988 = msg("21821", dup265); + +var msg23989 = msg("21822", dup265); + +var msg23990 = msg("21823", dup265); + +var msg23991 = msg("21824", dup265); + +var msg23992 = msg("21825", dup265); + +var msg23993 = msg("21826", dup265); + +var msg23994 = msg("21827", dup265); + +var msg23995 = msg("21828", dup265); + +var msg23996 = msg("21829", dup265); + +var msg23997 = msg("21830", dup265); + +var msg23998 = msg("21831", dup265); + +var msg23999 = msg("21832", dup265); + +var msg24000 = msg("21833", dup265); + +var msg24001 = msg("21834", dup265); + +var msg24002 = msg("21835", dup265); + +var msg24003 = msg("21836", dup265); + +var msg24004 = msg("21837", dup265); + +var msg24005 = msg("21838", dup265); + +var msg24006 = msg("21839", dup265); + +var msg24007 = msg("21840", dup265); + +var msg24008 = msg("21841", dup265); + +var msg24009 = msg("21842", dup265); + +var msg24010 = msg("21843", dup265); + +var msg24011 = msg("21844", dup265); + +var msg24012 = msg("21845", dup202); + +var msg24013 = msg("21846", dup202); + +var msg24014 = msg("21847", dup202); + +var msg24015 = msg("21848", dup202); + +var msg24016 = msg("21849", dup202); + +var msg24017 = msg("21850", dup202); + +var msg24018 = msg("21851", dup202); + +var msg24019 = msg("21852", dup192); + +var msg24020 = msg("21853", dup230); + +var msg24021 = msg("21854", dup202); + +var msg24022 = msg("21855", dup202); + +var msg24023 = msg("21856", dup287); + +var msg24024 = msg("21857", dup287); + +var msg24025 = msg("21858", dup267); + +var msg24026 = msg("21859", dup267); + +var msg24027 = msg("21860", dup267); + +var msg24028 = msg("21861", dup202); + +var msg24029 = msg("21862", dup202); + +var msg24030 = msg("21863", dup202); + +var msg24031 = msg("21864", dup202); + +var msg24032 = msg("21865", dup202); + +var msg24033 = msg("21866", dup202); + +var msg24034 = msg("21867", dup202); + +var msg24035 = msg("21868", dup202); + +var msg24036 = msg("21869", dup202); + +var msg24037 = msg("21870", dup202); + +var msg24038 = msg("21871", dup202); + +var msg24039 = msg("21872", dup202); + +var msg24040 = msg("21873", dup202); + +var msg24041 = msg("21874", dup267); + +var msg24042 = msg("21875", dup267); + +var msg24043 = msg("21876", dup267); + +var msg24044 = msg("21877", dup202); + +var msg24045 = msg("21878", dup197); + +var msg24046 = msg("21879", dup202); + +var msg24047 = msg("21880", dup202); + +var msg24048 = msg("21881", dup287); + +var msg24049 = msg("21882", dup265); + +var msg24050 = msg("21883", dup265); + +var msg24051 = msg("21884", dup202); + +var msg24052 = msg("21885", dup202); + +var msg24053 = msg("21886", dup202); + +var msg24054 = msg("21887", dup202); + +var msg24055 = msg("21888", dup202); + +var msg24056 = msg("21889", dup202); + +var msg24057 = msg("21890", dup202); + +var msg24058 = msg("21891", dup202); + +var msg24059 = msg("21892", dup202); + +var msg24060 = msg("21893", dup202); + +var msg24061 = msg("21894", dup202); + +var msg24062 = msg("21895", dup202); + +var msg24063 = msg("21896", dup197); + +var msg24064 = msg("21897", dup197); + +var msg24065 = msg("21898", dup197); + +var msg24066 = msg("21899", dup197); + +var msg24067 = msg("21900", dup197); + +var msg24068 = msg("21901", dup197); + +var msg24069 = msg("21902", dup197); + +var msg24070 = msg("21903", dup197); + +var msg24071 = msg("21904", dup197); + +var msg24072 = msg("21905", dup197); + +var msg24073 = msg("21906", dup197); + +var msg24074 = msg("21907", dup197); + +var msg24075 = msg("21908", dup267); + +var msg24076 = msg("21909", dup267); + +var msg24077 = msg("21910", dup263); + +var msg24078 = msg("21911", dup202); + +var msg24079 = msg("21912", dup202); + +var msg24080 = msg("21913", dup265); + +var msg24081 = msg("21914", dup197); + +var msg24082 = msg("21915", dup267); + +var msg24083 = msg("21916", dup267); + +var msg24084 = msg("21917", dup197); + +var msg24085 = msg("21918", dup197); + +var msg24086 = msg("21919", dup197); + +var msg24087 = msg("21920", dup197); + +var msg24088 = msg("21921", dup197); + +var msg24089 = msg("21922", dup197); + +var msg24090 = msg("21923", dup265); + +var msg24091 = msg("21924", dup263); + +var msg24092 = msg("21925", dup269); + +var msg24093 = msg("21926", dup265); + +var msg24094 = msg("21927", dup197); + +var msg24095 = msg("21928", dup197); + +var msg24096 = msg("21929", dup305); + +var msg24097 = msg("21930", dup305); + +var msg24098 = msg("21931", dup197); + +var msg24099 = msg("21932", dup197); + +var msg24100 = msg("21933", dup197); + +var msg24101 = msg("21934", dup303); + +var msg24102 = msg("21935", dup197); + +var msg24103 = msg("21937", dup197); + +var msg24104 = msg("21938", dup192); + +var msg24105 = msg("21939", dup202); + +var msg24106 = msg("21940", dup202); + +var msg24107 = msg("21941", dup202); + +var msg24108 = msg("21942", dup197); + +var msg24109 = msg("21943", dup197); + +var msg24110 = msg("21944", dup265); + +var msg24111 = msg("21945", dup192); + +var msg24112 = msg("21946", dup192); + +var msg24113 = msg("21947", dup192); + +var msg24114 = msg("21948", dup269); + +var msg24115 = msg("21949", dup201); + +var msg24116 = msg("21950", dup265); + +var msg24117 = msg("21951", dup265); + +var msg24118 = msg("21952", dup197); + +var msg24119 = msg("21953", dup287); + +var msg24120 = msg("21954", dup287); + +var msg24121 = msg("21955", dup202); + +var msg24122 = msg("21956", dup202); + +var msg24123 = msg("21957", dup202); + +var msg24124 = msg("21958", dup202); + +var msg24125 = msg("21959", dup202); + +var msg24126 = msg("21960", dup202); + +var msg24127 = msg("21961", dup287); + +var msg24128 = msg("21962", dup202); + +var msg24129 = msg("21963", dup202); + +var msg24130 = msg("21964", dup202); + +var msg24131 = msg("21965", dup269); + +var msg24132 = msg("21966", dup192); + +var msg24133 = msg("21967", dup287); + +var msg24134 = msg("21968", dup192); + +var msg24135 = msg("21969", dup192); + +var msg24136 = msg("21970", dup192); + +var msg24137 = msg("21971", dup192); + +var msg24138 = msg("21972", dup192); + +var msg24139 = msg("21973", dup192); + +var msg24140 = msg("21974", dup269); + +var msg24141 = msg("21975", dup269); + +var msg24142 = msg("21976", dup192); + +var msg24143 = msg("21977", dup192); + +var msg24144 = msg("21978", dup192); + +var msg24145 = msg("21979", dup192); + +var msg24146 = msg("21980", dup192); + +var msg24147 = msg("21981", dup192); + +var msg24148 = msg("21982", dup192); + +var msg24149 = msg("21983", dup192); + +var msg24150 = msg("21984", dup192); + +var msg24151 = msg("21985", dup197); + +var msg24152 = msg("21986", dup197); + +var msg24153 = msg("21987", dup197); + +var msg24154 = msg("21988", dup197); + +var msg24155 = msg("21989", dup197); + +var msg24156 = msg("21990", dup197); + +var msg24157 = msg("21991", dup267); + +var msg24158 = msg("21992", dup267); + +var msg24159 = msg("21993", dup267); + +var msg24160 = msg("21994", dup267); + +var msg24161 = msg("21995", dup202); + +var msg24162 = msg("21996", dup202); + +var msg24163 = msg("21997", dup192); + +var msg24164 = msg("21998", dup192); + +var msg24165 = msg("21999", dup202); + +var msg24166 = msg("22000", dup238); + +var msg24167 = msg("22001", dup238); + +var msg24168 = msg("22002", dup202); + +var msg24169 = msg("22003", dup265); + +var msg24170 = msg("22004", dup276); + +var msg24171 = msg("22005", dup276); + +var msg24172 = msg("22006", dup276); + +var msg24173 = msg("22007", dup276); + +var msg24174 = msg("22008", dup276); + +var msg24175 = msg("22009", dup276); + +var msg24176 = msg("22010", dup276); + +var msg24177 = msg("22011", dup276); + +var msg24178 = msg("22012", dup276); + +var msg24179 = msg("22013", dup202); + +var msg24180 = msg("22014", dup202); + +var msg24181 = msg("22015", dup202); + +var msg24182 = msg("22016", dup202); + +var msg24183 = msg("22017", dup202); + +var msg24184 = msg("22018", dup202); + +var msg24185 = msg("22019", dup202); + +var msg24186 = msg("22020", dup202); + +var msg24187 = msg("22021", dup202); + +var msg24188 = msg("22022", dup202); + +var msg24189 = msg("22023", dup202); + +var msg24190 = msg("22024", dup202); + +var msg24191 = msg("22025", dup202); + +var msg24192 = msg("22026", dup202); + +var msg24193 = msg("22027", dup202); + +var msg24194 = msg("22028", dup202); + +var msg24195 = msg("22029", dup197); + +var msg24196 = msg("22030", dup197); + +var msg24197 = msg("22031", dup197); + +var msg24198 = msg("22032", dup197); + +var msg24199 = msg("22033", dup263); + +var msg24200 = msg("22034", dup263); + +var msg24201 = msg("22035", dup197); + +var msg24202 = msg("22036", dup197); + +var msg24203 = msg("22037", dup197); + +var msg24204 = msg("22038", dup265); + +var msg24205 = msg("22039", dup202); + +var msg24206 = msg("22040", dup202); + +var msg24207 = msg("22041", dup202); + +var msg24208 = msg("22042", dup202); + +var msg24209 = msg("22043", dup202); + +var msg24210 = msg("22044", dup202); + +var msg24211 = msg("22045", dup202); + +var msg24212 = msg("22046", dup202); + +var msg24213 = msg("22047", dup192); + +var msg24214 = msg("22048", dup192); + +var msg24215 = msg("22049", dup265); + +var msg24216 = msg("22050", dup202); + +var msg24217 = msg("22051", dup263); + +var msg24218 = msg("22052", dup197); + +var msg24219 = msg("22053", dup192); + +var msg24220 = msg("22054", dup192); + +var msg24221 = msg("22055", dup202); + +var msg24222 = msg("22056", dup192); + +var msg24223 = msg("22057", dup192); + +var msg24224 = msg("22058", dup192); + +var msg24225 = msg("22059", dup192); + +var msg24226 = msg("22060", dup192); + +var msg24227 = msg("22061", dup269); + +var msg24228 = msg("22062", dup192); + +var msg24229 = msg("22063", dup302); + +var msg24230 = msg("22064", dup199); + +var msg24231 = msg("22065", dup192); + +var msg24232 = msg("22066", dup197); + +var msg24233 = msg("22067", dup202); + +var msg24234 = msg("22068", dup202); + +var msg24235 = msg("22069", dup202); + +var msg24236 = msg("22070", dup202); + +var msg24237 = msg("22071", dup314); + +var msg24238 = msg("22072", dup314); + +var msg24239 = msg("22073", dup314); + +var msg24240 = msg("22074", dup314); + +var msg24241 = msg("22075", dup197); + +var msg24242 = msg("22076", dup197); + +var msg24243 = msg("22077", dup197); + +var msg24244 = msg("22078", dup197); + +var msg24245 = msg("22079", dup267); + +var msg24246 = msg("22080", dup269); + +var msg24247 = msg("22081", dup197); + +var msg24248 = msg("22082", dup202); + +var msg24249 = msg("22083", dup202); + +var msg24250 = msg("22084", dup202); + +var msg24251 = msg("22085", dup197); + +var msg24252 = msg("22086", dup197); + +var msg24253 = msg("22087", dup197); + +var msg24254 = msg("22088", dup267); + +var msg24255 = msg("22089", dup265); + +var msg24256 = msg("22090", dup269); + +var msg24257 = msg("22091", dup197); + +var msg24258 = msg("22092", dup197); + +var msg24259 = msg("22093", dup197); + +var msg24260 = msg("22094", dup197); + +var msg24261 = msg("22095", dup192); + +var msg24262 = msg("22096", dup263); + +var msg24263 = msg("22097", dup199); + +var msg24264 = msg("22098", dup202); + +var msg24265 = msg("22099", dup192); + +var msg24266 = msg("22100", dup192); + +var msg24267 = msg("22101", dup197); + +var msg24268 = msg("22102", dup197); + +var msg24269 = msg("22103", dup192); + +var msg24270 = msg("22104", dup197); + +var msg24271 = msg("22105", dup197); + +var msg24272 = msg("22106", dup197); + +var msg24273 = msg("22107", dup197); + +var msg24274 = msg("22108", dup197); + +var msg24275 = msg("22109", dup197); + +var msg24276 = msg("22110", dup267); + +var msg24277 = msg("22111", dup267); + +var msg24278 = msg("22112", dup267); + +var msg24279 = msg("22113", dup267); + +var msg24280 = msg("22114", dup267); + +var msg24281 = msg("22115", dup267); + +var msg24282 = msg("22116", dup263); + +var msg24283 = msg("22117", dup263); + +var msg24284 = msg("22118", dup263); + +var msg24285 = msg("22119", dup263); + +var msg24286 = msg("22120", dup263); + +var msg24287 = msg("22121", dup263); + +var msg24288 = msg("22122", dup263); + +var msg24289 = msg("22123", dup263); + +var msg24290 = msg("22124", dup263); + +var msg24291 = msg("22125", dup263); + +var msg24292 = msg("22126", dup263); + +var msg24293 = msg("22127", dup263); + +var msg24294 = msg("22128", dup263); + +var msg24295 = msg("22129", dup263); + +var msg24296 = msg("22130", dup263); + +var msg24297 = msg("22131", dup263); + +var msg24298 = msg("22132", dup263); + +var msg24299 = msg("22133", dup263); + +var msg24300 = msg("22134", dup263); + +var msg24301 = msg("22135", dup263); + +var msg24302 = msg("22136", dup263); + +var msg24303 = msg("22137", dup263); + +var msg24304 = msg("22138", dup263); + +var msg24305 = msg("22139", dup263); + +var msg24306 = msg("22140", dup263); + +var msg24307 = msg("22141", dup263); + +var msg24308 = msg("22142", dup263); + +var msg24309 = msg("22143", dup263); + +var msg24310 = msg("22144", dup263); + +var msg24311 = msg("22145", dup263); + +var msg24312 = msg("22146", dup263); + +var msg24313 = msg("22147", dup263); + +var msg24314 = msg("22148", dup263); + +var msg24315 = msg("22149", dup263); + +var msg24316 = msg("22150", dup263); + +var msg24317 = msg("22151", dup263); + +var msg24318 = msg("22152", dup263); + +var msg24319 = msg("22153", dup263); + +var msg24320 = msg("22154", dup263); + +var msg24321 = msg("22155", dup263); + +var msg24322 = msg("22156", dup263); + +var msg24323 = msg("22157", dup263); + +var msg24324 = msg("22158", dup263); + +var msg24325 = msg("22159", dup263); + +var msg24326 = msg("22160", dup263); + +var msg24327 = msg("22161", dup263); + +var msg24328 = msg("22162", dup263); + +var msg24329 = msg("22163", dup263); + +var msg24330 = msg("22164", dup263); + +var msg24331 = msg("22165", dup263); + +var msg24332 = msg("22166", dup263); + +var msg24333 = msg("22167", dup263); + +var msg24334 = msg("22168", dup263); + +var msg24335 = msg("22169", dup263); + +var msg24336 = msg("22170", dup263); + +var msg24337 = msg("22171", dup263); + +var msg24338 = msg("22172", dup263); + +var msg24339 = msg("22173", dup263); + +var msg24340 = msg("22174", dup263); + +var msg24341 = msg("22175", dup263); + +var msg24342 = msg("22176", dup263); + +var msg24343 = msg("22177", dup263); + +var msg24344 = msg("22178", dup263); + +var msg24345 = msg("22179", dup263); + +var msg24346 = msg("22180", dup263); + +var msg24347 = msg("22181", dup263); + +var msg24348 = msg("22182", dup263); + +var msg24349 = msg("22183", dup263); + +var msg24350 = msg("22184", dup263); + +var msg24351 = msg("22185", dup263); + +var msg24352 = msg("22186", dup263); + +var msg24353 = msg("22187", dup263); + +var msg24354 = msg("22188", dup263); + +var msg24355 = msg("22189", dup263); + +var msg24356 = msg("22190", dup263); + +var msg24357 = msg("22191", dup263); + +var msg24358 = msg("22192", dup263); + +var msg24359 = msg("22193", dup263); + +var msg24360 = msg("22194", dup263); + +var msg24361 = msg("22195", dup263); + +var msg24362 = msg("22196", dup263); + +var msg24363 = msg("22197", dup263); + +var msg24364 = msg("22198", dup263); + +var msg24365 = msg("22199", dup263); + +var msg24366 = msg("22200", dup263); + +var msg24367 = msg("22201", dup263); + +var msg24368 = msg("22202", dup263); + +var msg24369 = msg("22203", dup263); + +var msg24370 = msg("22204", dup263); + +var msg24371 = msg("22205", dup263); + +var msg24372 = msg("22206", dup263); + +var msg24373 = msg("22207", dup263); + +var msg24374 = msg("22208", dup263); + +var msg24375 = msg("22209", dup263); + +var msg24376 = msg("22210", dup263); + +var msg24377 = msg("22211", dup263); + +var msg24378 = msg("22212", dup263); + +var msg24379 = msg("22213", dup263); + +var msg24380 = msg("22214", dup263); + +var msg24381 = msg("22215", dup263); + +var msg24382 = msg("22216", dup263); + +var msg24383 = msg("22217", dup263); + +var msg24384 = msg("22218", dup263); + +var msg24385 = msg("22219", dup263); + +var msg24386 = msg("22220", dup263); + +var msg24387 = msg("22221", dup263); + +var msg24388 = msg("22222", dup263); + +var msg24389 = msg("22223", dup263); + +var msg24390 = msg("22224", dup263); + +var msg24391 = msg("22225", dup263); + +var msg24392 = msg("22226", dup263); + +var msg24393 = msg("22227", dup263); + +var msg24394 = msg("22228", dup263); + +var msg24395 = msg("22229", dup263); + +var msg24396 = msg("22230", dup263); + +var msg24397 = msg("22231", dup263); + +var msg24398 = msg("22232", dup263); + +var msg24399 = msg("22233", dup263); + +var msg24400 = msg("22234", dup263); + +var msg24401 = msg("22235", dup263); + +var msg24402 = msg("22236", dup263); + +var msg24403 = msg("22237", dup263); + +var msg24404 = msg("22238", dup263); + +var msg24405 = msg("22239", dup263); + +var msg24406 = msg("22240", dup263); + +var msg24407 = msg("22241", dup263); + +var msg24408 = msg("22242", dup263); + +var msg24409 = msg("22243", dup263); + +var msg24410 = msg("22244", dup263); + +var msg24411 = msg("22245", dup263); + +var msg24412 = msg("22246", dup263); + +var msg24413 = msg("22247", dup269); + +var msg24414 = msg("22248", dup263); + +var msg24415 = msg("22249", dup263); + +var msg24416 = msg("22250", dup263); + +var msg24417 = msg("22251", dup263); + +var msg24418 = msg("22252", dup263); + +var msg24419 = msg("22253", dup263); + +var msg24420 = msg("22254", dup263); + +var msg24421 = msg("22255", dup263); + +var msg24422 = msg("22256", dup263); + +var msg24423 = msg("22257", dup263); + +var msg24424 = msg("22258", dup263); + +var msg24425 = msg("22259", dup263); + +var msg24426 = msg("22260", dup263); + +var msg24427 = msg("22261", dup263); + +var msg24428 = msg("22262", dup263); + +var msg24429 = msg("22263", dup263); + +var msg24430 = msg("22264", dup263); + +var msg24431 = msg("22265", dup263); + +var msg24432 = msg("22266", dup263); + +var msg24433 = msg("22267", dup263); + +var msg24434 = msg("22268", dup263); + +var msg24435 = msg("22269", dup263); + +var msg24436 = msg("22270", dup263); + +var msg24437 = msg("22271", dup263); + +var msg24438 = msg("22272", dup263); + +var msg24439 = msg("22273", dup263); + +var msg24440 = msg("22274", dup263); + +var msg24441 = msg("22275", dup263); + +var msg24442 = msg("22276", dup263); + +var msg24443 = msg("22277", dup263); + +var msg24444 = msg("22278", dup263); + +var msg24445 = msg("22279", dup263); + +var msg24446 = msg("22280", dup263); + +var msg24447 = msg("22281", dup263); + +var msg24448 = msg("22282", dup263); + +var msg24449 = msg("22283", dup263); + +var msg24450 = msg("22284", dup263); + +var msg24451 = msg("22285", dup263); + +var msg24452 = msg("22286", dup263); + +var msg24453 = msg("22287", dup263); + +var msg24454 = msg("22288", dup263); + +var msg24455 = msg("22289", dup263); + +var msg24456 = msg("22290", dup263); + +var msg24457 = msg("22291", dup263); + +var msg24458 = msg("22292", dup263); + +var msg24459 = msg("22293", dup263); + +var msg24460 = msg("22294", dup263); + +var msg24461 = msg("22295", dup263); + +var msg24462 = msg("22296", dup263); + +var msg24463 = msg("22297", dup263); + +var msg24464 = msg("22298", dup263); + +var msg24465 = msg("22299", dup263); + +var msg24466 = msg("22300", dup263); + +var msg24467 = msg("22301", dup263); + +var msg24468 = msg("22302", dup263); + +var msg24469 = msg("22303", dup263); + +var msg24470 = msg("22304", dup263); + +var msg24471 = msg("22305", dup263); + +var msg24472 = msg("22306", dup263); + +var msg24473 = msg("22307", dup263); + +var msg24474 = msg("22308", dup269); + +var msg24475 = msg("22309", dup263); + +var msg24476 = msg("22310", dup263); + +var msg24477 = msg("22311", dup263); + +var msg24478 = msg("22312", dup263); + +var msg24479 = msg("22313", dup263); + +var msg24480 = msg("22314", dup263); + +var msg24481 = msg("22315", dup263); + +var msg24482 = msg("22316", dup263); + +var msg24483 = msg("22317", dup263); + +var msg24484 = msg("22318", dup263); + +var msg24485 = msg("22319", dup263); + +var msg24486 = msg("22320", dup263); + +var msg24487 = msg("22321", dup263); + +var msg24488 = msg("22322", dup263); + +var msg24489 = msg("22323", dup263); + +var msg24490 = msg("22324", dup263); + +var msg24491 = msg("22325", dup263); + +var msg24492 = msg("22326", dup263); + +var msg24493 = msg("22327", dup263); + +var msg24494 = msg("22328", dup263); + +var msg24495 = msg("22329", dup263); + +var msg24496 = msg("22330", dup263); + +var msg24497 = msg("22331", dup263); + +var msg24498 = msg("22332", dup263); + +var msg24499 = msg("22333", dup263); + +var msg24500 = msg("22334", dup263); + +var msg24501 = msg("22335", dup263); + +var msg24502 = msg("22336", dup263); + +var msg24503 = msg("22337", dup263); + +var msg24504 = msg("22338", dup263); + +var msg24505 = msg("22339", dup227); + +var msg24506 = msg("22340", dup227); + +var msg24507 = msg("22341", dup263); + +var msg24508 = msg("22342", dup263); + +var msg24509 = msg("22343", dup263); + +var msg24510 = msg("22344", dup263); + +var msg24511 = msg("22345", dup263); + +var msg24512 = msg("22346", dup263); + +var msg24513 = msg("22347", dup263); + +var msg24514 = msg("22348", dup263); + +var msg24515 = msg("22349", dup263); + +var msg24516 = msg("22350", dup263); + +var msg24517 = msg("22351", dup263); + +var msg24518 = msg("22352", dup263); + +var msg24519 = msg("22353", dup263); + +var msg24520 = msg("22354", dup263); + +var msg24521 = msg("22355", dup263); + +var msg24522 = msg("22356", dup263); + +var msg24523 = msg("22357", dup263); + +var msg24524 = msg("22358", dup263); + +var msg24525 = msg("22359", dup263); + +var msg24526 = msg("22360", dup263); + +var msg24527 = msg("22361", dup263); + +var msg24528 = msg("22362", dup263); + +var msg24529 = msg("22363", dup263); + +var msg24530 = msg("22364", dup263); + +var msg24531 = msg("22365", dup263); + +var msg24532 = msg("22366", dup263); + +var msg24533 = msg("22367", dup263); + +var msg24534 = msg("22368", dup263); + +var msg24535 = msg("22369", dup263); + +var msg24536 = msg("22370", dup263); + +var msg24537 = msg("22371", dup263); + +var msg24538 = msg("22372", dup263); + +var msg24539 = msg("22373", dup263); + +var msg24540 = msg("22374", dup263); + +var msg24541 = msg("22375", dup263); + +var msg24542 = msg("22376", dup263); + +var msg24543 = msg("22377", dup263); + +var msg24544 = msg("22378", dup263); + +var msg24545 = msg("22379", dup263); + +var msg24546 = msg("22380", dup263); + +var msg24547 = msg("22381", dup263); + +var msg24548 = msg("22382", dup263); + +var msg24549 = msg("22383", dup263); + +var msg24550 = msg("22384", dup263); + +var msg24551 = msg("22385", dup263); + +var msg24552 = msg("22386", dup263); + +var msg24553 = msg("22387", dup263); + +var msg24554 = msg("22388", dup263); + +var msg24555 = msg("22389", dup263); + +var msg24556 = msg("22390", dup263); + +var msg24557 = msg("22391", dup263); + +var msg24558 = msg("22392", dup263); + +var msg24559 = msg("22393", dup263); + +var msg24560 = msg("22394", dup263); + +var msg24561 = msg("22395", dup263); + +var msg24562 = msg("22396", dup263); + +var msg24563 = msg("22397", dup263); + +var msg24564 = msg("22398", dup263); + +var msg24565 = msg("22399", dup263); + +var msg24566 = msg("22400", dup263); + +var msg24567 = msg("22401", dup263); + +var msg24568 = msg("22402", dup263); + +var msg24569 = msg("22403", dup263); + +var msg24570 = msg("22404", dup263); + +var msg24571 = msg("22405", dup263); + +var msg24572 = msg("22406", dup263); + +var msg24573 = msg("22407", dup227); + +var msg24574 = msg("22408", dup263); + +var msg24575 = msg("22409", dup263); + +var msg24576 = msg("22410", dup263); + +var msg24577 = msg("22411", dup263); + +var msg24578 = msg("22412", dup263); + +var msg24579 = msg("22413", dup263); + +var msg24580 = msg("22414", dup263); + +var msg24581 = msg("22415", dup263); + +var msg24582 = msg("22416", dup263); + +var msg24583 = msg("22417", dup263); + +var msg24584 = msg("22418", dup263); + +var msg24585 = msg("22419", dup263); + +var msg24586 = msg("22420", dup263); + +var msg24587 = msg("22421", dup263); + +var msg24588 = msg("22422", dup263); + +var msg24589 = msg("22423", dup263); + +var msg24590 = msg("22424", dup263); + +var msg24591 = msg("22425", dup263); + +var msg24592 = msg("22426", dup263); + +var msg24593 = msg("22427", dup263); + +var msg24594 = msg("22428", dup263); + +var msg24595 = msg("22429", dup263); + +var msg24596 = msg("22430", dup263); + +var msg24597 = msg("22431", dup263); + +var msg24598 = msg("22432", dup263); + +var msg24599 = msg("22433", dup263); + +var msg24600 = msg("22434", dup263); + +var msg24601 = msg("22435", dup263); + +var msg24602 = msg("22436", dup263); + +var msg24603 = msg("22437", dup263); + +var msg24604 = msg("22438", dup263); + +var msg24605 = msg("22439", dup263); + +var msg24606 = msg("22440", dup263); + +var msg24607 = msg("22441", dup263); + +var msg24608 = msg("22442", dup263); + +var msg24609 = msg("22443", dup263); + +var msg24610 = msg("22444", dup263); + +var msg24611 = msg("22445", dup263); + +var msg24612 = msg("22446", dup263); + +var msg24613 = msg("22447", dup263); + +var msg24614 = msg("22448", dup263); + +var msg24615 = msg("22449", dup263); + +var msg24616 = msg("22450", dup263); + +var msg24617 = msg("22451", dup263); + +var msg24618 = msg("22452", dup263); + +var msg24619 = msg("22453", dup263); + +var msg24620 = msg("22454", dup263); + +var msg24621 = msg("22455", dup263); + +var msg24622 = msg("22456", dup263); + +var msg24623 = msg("22457", dup263); + +var msg24624 = msg("22458", dup263); + +var msg24625 = msg("22459", dup263); + +var msg24626 = msg("22460", dup263); + +var msg24627 = msg("22461", dup263); + +var msg24628 = msg("22462", dup263); + +var msg24629 = msg("22463", dup263); + +var msg24630 = msg("22464", dup263); + +var msg24631 = msg("22465", dup263); + +var msg24632 = msg("22466", dup263); + +var msg24633 = msg("22467", dup263); + +var msg24634 = msg("22468", dup263); + +var msg24635 = msg("22469", dup263); + +var msg24636 = msg("22470", dup263); + +var msg24637 = msg("22471", dup263); + +var msg24638 = msg("22472", dup263); + +var msg24639 = msg("22473", dup263); + +var msg24640 = msg("22474", dup263); + +var msg24641 = msg("22475", dup263); + +var msg24642 = msg("22476", dup263); + +var msg24643 = msg("22477", dup263); + +var msg24644 = msg("22478", dup263); + +var msg24645 = msg("22479", dup263); + +var msg24646 = msg("22480", dup263); + +var msg24647 = msg("22481", dup263); + +var msg24648 = msg("22482", dup263); + +var msg24649 = msg("22483", dup263); + +var msg24650 = msg("22484", dup263); + +var msg24651 = msg("22485", dup263); + +var msg24652 = msg("22486", dup263); + +var msg24653 = msg("22487", dup263); + +var msg24654 = msg("22488", dup263); + +var msg24655 = msg("22489", dup263); + +var msg24656 = msg("22490", dup263); + +var msg24657 = msg("22491", dup263); + +var msg24658 = msg("22492", dup263); + +var msg24659 = msg("22493", dup263); + +var msg24660 = msg("22494", dup263); + +var msg24661 = msg("22495", dup263); + +var msg24662 = msg("22496", dup263); + +var msg24663 = msg("22497", dup263); + +var msg24664 = msg("22498", dup263); + +var msg24665 = msg("22499", dup263); + +var msg24666 = msg("22500", dup263); + +var msg24667 = msg("22501", dup263); + +var msg24668 = msg("22502", dup263); + +var msg24669 = msg("22503", dup263); + +var msg24670 = msg("22504", dup263); + +var msg24671 = msg("22505", dup263); + +var msg24672 = msg("22506", dup263); + +var msg24673 = msg("22507", dup263); + +var msg24674 = msg("22508", dup263); + +var msg24675 = msg("22509", dup263); + +var msg24676 = msg("22510", dup263); + +var msg24677 = msg("22511", dup263); + +var msg24678 = msg("22512", dup263); + +var msg24679 = msg("22513", dup263); + +var msg24680 = msg("22514", dup263); + +var msg24681 = msg("22515", dup263); + +var msg24682 = msg("22516", dup263); + +var msg24683 = msg("22517", dup263); + +var msg24684 = msg("22518", dup263); + +var msg24685 = msg("22519", dup263); + +var msg24686 = msg("22520", dup263); + +var msg24687 = msg("22521", dup263); + +var msg24688 = msg("22522", dup263); + +var msg24689 = msg("22523", dup263); + +var msg24690 = msg("22524", dup263); + +var msg24691 = msg("22525", dup263); + +var msg24692 = msg("22526", dup263); + +var msg24693 = msg("22527", dup263); + +var msg24694 = msg("22528", dup263); + +var msg24695 = msg("22529", dup263); + +var msg24696 = msg("22530", dup263); + +var msg24697 = msg("22531", dup263); + +var msg24698 = msg("22532", dup263); + +var msg24699 = msg("22533", dup263); + +var msg24700 = msg("22534", dup263); + +var msg24701 = msg("22535", dup263); + +var msg24702 = msg("22536", dup263); + +var msg24703 = msg("22537", dup263); + +var msg24704 = msg("22538", dup263); + +var msg24705 = msg("22539", dup263); + +var msg24706 = msg("22540", dup263); + +var msg24707 = msg("22541", dup263); + +var msg24708 = msg("22542", dup263); + +var msg24709 = msg("22543", dup263); + +var msg24710 = msg("22544", dup263); + +var msg24711 = msg("22545", dup263); + +var msg24712 = msg("22546", dup263); + +var msg24713 = msg("22547", dup263); + +var msg24714 = msg("22548", dup263); + +var msg24715 = msg("22549", dup263); + +var msg24716 = msg("22550", dup263); + +var msg24717 = msg("22551", dup263); + +var msg24718 = msg("22552", dup263); + +var msg24719 = msg("22553", dup263); + +var msg24720 = msg("22554", dup263); + +var msg24721 = msg("22555", dup263); + +var msg24722 = msg("22556", dup263); + +var msg24723 = msg("22557", dup263); + +var msg24724 = msg("22558", dup263); + +var msg24725 = msg("22559", dup263); + +var msg24726 = msg("22560", dup263); + +var msg24727 = msg("22561", dup263); + +var msg24728 = msg("22562", dup263); + +var msg24729 = msg("22563", dup263); + +var msg24730 = msg("22564", dup263); + +var msg24731 = msg("22565", dup263); + +var msg24732 = msg("22566", dup263); + +var msg24733 = msg("22567", dup263); + +var msg24734 = msg("22568", dup263); + +var msg24735 = msg("22569", dup263); + +var msg24736 = msg("22570", dup263); + +var msg24737 = msg("22571", dup263); + +var msg24738 = msg("22572", dup263); + +var msg24739 = msg("22573", dup263); + +var msg24740 = msg("22574", dup263); + +var msg24741 = msg("22575", dup263); + +var msg24742 = msg("22576", dup263); + +var msg24743 = msg("22577", dup263); + +var msg24744 = msg("22578", dup298); + +var msg24745 = msg("22579", dup298); + +var msg24746 = msg("22580", dup263); + +var msg24747 = msg("22581", dup263); + +var msg24748 = msg("22582", dup263); + +var msg24749 = msg("22583", dup263); + +var msg24750 = msg("22584", dup263); + +var msg24751 = msg("22585", dup263); + +var msg24752 = msg("22586", dup263); + +var msg24753 = msg("22587", dup263); + +var msg24754 = msg("22588", dup263); + +var msg24755 = msg("22589", dup263); + +var msg24756 = msg("22590", dup263); + +var msg24757 = msg("22591", dup263); + +var msg24758 = msg("22592", dup250); + +var msg24759 = msg("22593", dup263); + +var msg24760 = msg("22594", dup263); + +var msg24761 = msg("22595", dup263); + +var msg24762 = msg("22596", dup263); + +var msg24763 = msg("22597", dup263); + +var msg24764 = msg("22598", dup263); + +var msg24765 = msg("22599", dup263); + +var msg24766 = msg("22600", dup263); + +var msg24767 = msg("22601", dup263); + +var msg24768 = msg("22602", dup263); + +var msg24769 = msg("22603", dup263); + +var msg24770 = msg("22604", dup263); + +var msg24771 = msg("22605", dup263); + +var msg24772 = msg("22606", dup263); + +var msg24773 = msg("22607", dup263); + +var msg24774 = msg("22608", dup263); + +var msg24775 = msg("22609", dup263); + +var msg24776 = msg("22610", dup263); + +var msg24777 = msg("22611", dup263); + +var msg24778 = msg("22612", dup263); + +var msg24779 = msg("22613", dup263); + +var msg24780 = msg("22614", dup263); + +var msg24781 = msg("22615", dup263); + +var msg24782 = msg("22616", dup263); + +var msg24783 = msg("22617", dup263); + +var msg24784 = msg("22618", dup263); + +var msg24785 = msg("22619", dup263); + +var msg24786 = msg("22620", dup263); + +var msg24787 = msg("22621", dup263); + +var msg24788 = msg("22622", dup263); + +var msg24789 = msg("22623", dup263); + +var msg24790 = msg("22624", dup263); + +var msg24791 = msg("22625", dup263); + +var msg24792 = msg("22626", dup263); + +var msg24793 = msg("22627", dup263); + +var msg24794 = msg("22628", dup263); + +var msg24795 = msg("22629", dup263); + +var msg24796 = msg("22630", dup263); + +var msg24797 = msg("22631", dup263); + +var msg24798 = msg("22632", dup263); + +var msg24799 = msg("22633", dup263); + +var msg24800 = msg("22634", dup263); + +var msg24801 = msg("22635", dup263); + +var msg24802 = msg("22636", dup263); + +var msg24803 = msg("22637", dup263); + +var msg24804 = msg("22638", dup263); + +var msg24805 = msg("22639", dup263); + +var msg24806 = msg("22640", dup263); + +var msg24807 = msg("22641", dup263); + +var msg24808 = msg("22642", dup263); + +var msg24809 = msg("22643", dup263); + +var msg24810 = msg("22644", dup263); + +var msg24811 = msg("22645", dup263); + +var msg24812 = msg("22646", dup263); + +var msg24813 = msg("22647", dup263); + +var msg24814 = msg("22648", dup263); + +var msg24815 = msg("22649", dup263); + +var msg24816 = msg("22650", dup263); + +var msg24817 = msg("22651", dup263); + +var msg24818 = msg("22652", dup263); + +var msg24819 = msg("22653", dup263); + +var msg24820 = msg("22654", dup263); + +var msg24821 = msg("22655", dup263); + +var msg24822 = msg("22656", dup250); + +var msg24823 = msg("22657", dup250); + +var msg24824 = msg("22658", dup263); + +var msg24825 = msg("22659", dup263); + +var msg24826 = msg("22660", dup263); + +var msg24827 = msg("22661", dup263); + +var msg24828 = msg("22662", dup263); + +var msg24829 = msg("22663", dup263); + +var msg24830 = msg("22664", dup263); + +var msg24831 = msg("22665", dup263); + +var msg24832 = msg("22666", dup263); + +var msg24833 = msg("22667", dup263); + +var msg24834 = msg("22668", dup263); + +var msg24835 = msg("22669", dup263); + +var msg24836 = msg("22670", dup263); + +var msg24837 = msg("22671", dup263); + +var msg24838 = msg("22672", dup263); + +var msg24839 = msg("22673", dup263); + +var msg24840 = msg("22674", dup263); + +var msg24841 = msg("22675", dup263); + +var msg24842 = msg("22676", dup263); + +var msg24843 = msg("22677", dup263); + +var msg24844 = msg("22678", dup263); + +var msg24845 = msg("22679", dup263); + +var msg24846 = msg("22680", dup263); + +var msg24847 = msg("22681", dup263); + +var msg24848 = msg("22682", dup263); + +var msg24849 = msg("22683", dup263); + +var msg24850 = msg("22684", dup263); + +var msg24851 = msg("22685", dup263); + +var msg24852 = msg("22686", dup263); + +var msg24853 = msg("22687", dup263); + +var msg24854 = msg("22688", dup263); + +var msg24855 = msg("22689", dup263); + +var msg24856 = msg("22690", dup263); + +var msg24857 = msg("22691", dup263); + +var msg24858 = msg("22692", dup263); + +var msg24859 = msg("22693", dup263); + +var msg24860 = msg("22694", dup263); + +var msg24861 = msg("22695", dup263); + +var msg24862 = msg("22696", dup263); + +var msg24863 = msg("22697", dup263); + +var msg24864 = msg("22698", dup263); + +var msg24865 = msg("22699", dup263); + +var msg24866 = msg("22700", dup263); + +var msg24867 = msg("22701", dup263); + +var msg24868 = msg("22702", dup263); + +var msg24869 = msg("22703", dup263); + +var msg24870 = msg("22704", dup263); + +var msg24871 = msg("22705", dup263); + +var msg24872 = msg("22706", dup263); + +var msg24873 = msg("22707", dup263); + +var msg24874 = msg("22708", dup263); + +var msg24875 = msg("22709", dup263); + +var msg24876 = msg("22710", dup263); + +var msg24877 = msg("22711", dup263); + +var msg24878 = msg("22712", dup263); + +var msg24879 = msg("22713", dup263); + +var msg24880 = msg("22714", dup263); + +var msg24881 = msg("22715", dup263); + +var msg24882 = msg("22716", dup263); + +var msg24883 = msg("22717", dup263); + +var msg24884 = msg("22718", dup263); + +var msg24885 = msg("22719", dup263); + +var msg24886 = msg("22720", dup263); + +var msg24887 = msg("22721", dup263); + +var msg24888 = msg("22722", dup263); + +var msg24889 = msg("22723", dup263); + +var msg24890 = msg("22724", dup263); + +var msg24891 = msg("22725", dup263); + +var msg24892 = msg("22726", dup263); + +var msg24893 = msg("22727", dup263); + +var msg24894 = msg("22728", dup263); + +var msg24895 = msg("22729", dup263); + +var msg24896 = msg("22730", dup263); + +var msg24897 = msg("22731", dup263); + +var msg24898 = msg("22732", dup263); + +var msg24899 = msg("22733", dup263); + +var msg24900 = msg("22734", dup263); + +var msg24901 = msg("22735", dup263); + +var msg24902 = msg("22736", dup263); + +var msg24903 = msg("22737", dup263); + +var msg24904 = msg("22738", dup263); + +var msg24905 = msg("22739", dup263); + +var msg24906 = msg("22740", dup263); + +var msg24907 = msg("22741", dup263); + +var msg24908 = msg("22742", dup263); + +var msg24909 = msg("22743", dup263); + +var msg24910 = msg("22744", dup263); + +var msg24911 = msg("22745", dup263); + +var msg24912 = msg("22746", dup263); + +var msg24913 = msg("22747", dup263); + +var msg24914 = msg("22748", dup263); + +var msg24915 = msg("22749", dup263); + +var msg24916 = msg("22750", dup263); + +var msg24917 = msg("22751", dup263); + +var msg24918 = msg("22752", dup263); + +var msg24919 = msg("22753", dup263); + +var msg24920 = msg("22754", dup263); + +var msg24921 = msg("22755", dup263); + +var msg24922 = msg("22756", dup263); + +var msg24923 = msg("22757", dup263); + +var msg24924 = msg("22758", dup263); + +var msg24925 = msg("22759", dup263); + +var msg24926 = msg("22760", dup263); + +var msg24927 = msg("22761", dup263); + +var msg24928 = msg("22762", dup263); + +var msg24929 = msg("22763", dup263); + +var msg24930 = msg("22764", dup263); + +var msg24931 = msg("22765", dup263); + +var msg24932 = msg("22766", dup263); + +var msg24933 = msg("22767", dup263); + +var msg24934 = msg("22768", dup263); + +var msg24935 = msg("22769", dup263); + +var msg24936 = msg("22770", dup263); + +var msg24937 = msg("22771", dup263); + +var msg24938 = msg("22772", dup263); + +var msg24939 = msg("22773", dup263); + +var msg24940 = msg("22774", dup263); + +var msg24941 = msg("22775", dup263); + +var msg24942 = msg("22776", dup263); + +var msg24943 = msg("22777", dup263); + +var msg24944 = msg("22778", dup263); + +var msg24945 = msg("22779", dup263); + +var msg24946 = msg("22780", dup263); + +var msg24947 = msg("22781", dup263); + +var msg24948 = msg("22782", dup263); + +var msg24949 = msg("22783", dup263); + +var msg24950 = msg("22784", dup263); + +var msg24951 = msg("22785", dup263); + +var msg24952 = msg("22786", dup263); + +var msg24953 = msg("22787", dup263); + +var msg24954 = msg("22788", dup263); + +var msg24955 = msg("22789", dup263); + +var msg24956 = msg("22790", dup263); + +var msg24957 = msg("22791", dup263); + +var msg24958 = msg("22792", dup263); + +var msg24959 = msg("22793", dup263); + +var msg24960 = msg("22794", dup263); + +var msg24961 = msg("22795", dup263); + +var msg24962 = msg("22796", dup263); + +var msg24963 = msg("22797", dup263); + +var msg24964 = msg("22798", dup263); + +var msg24965 = msg("22799", dup263); + +var msg24966 = msg("22800", dup263); + +var msg24967 = msg("22801", dup263); + +var msg24968 = msg("22802", dup263); + +var msg24969 = msg("22803", dup263); + +var msg24970 = msg("22804", dup263); + +var msg24971 = msg("22805", dup263); + +var msg24972 = msg("22806", dup263); + +var msg24973 = msg("22807", dup263); + +var msg24974 = msg("22808", dup263); + +var msg24975 = msg("22809", dup263); + +var msg24976 = msg("22810", dup263); + +var msg24977 = msg("22811", dup263); + +var msg24978 = msg("22812", dup263); + +var msg24979 = msg("22813", dup263); + +var msg24980 = msg("22814", dup263); + +var msg24981 = msg("22815", dup263); + +var msg24982 = msg("22816", dup263); + +var msg24983 = msg("22817", dup263); + +var msg24984 = msg("22818", dup263); + +var msg24985 = msg("22819", dup263); + +var msg24986 = msg("22820", dup263); + +var msg24987 = msg("22821", dup263); + +var msg24988 = msg("22822", dup263); + +var msg24989 = msg("22823", dup263); + +var msg24990 = msg("22824", dup263); + +var msg24991 = msg("22825", dup263); + +var msg24992 = msg("22826", dup263); + +var msg24993 = msg("22827", dup263); + +var msg24994 = msg("22828", dup263); + +var msg24995 = msg("22829", dup263); + +var msg24996 = msg("22830", dup263); + +var msg24997 = msg("22831", dup263); + +var msg24998 = msg("22832", dup263); + +var msg24999 = msg("22833", dup263); + +var msg25000 = msg("22834", dup263); + +var msg25001 = msg("22835", dup263); + +var msg25002 = msg("22836", dup263); + +var msg25003 = msg("22837", dup263); + +var msg25004 = msg("22838", dup263); + +var msg25005 = msg("22839", dup263); + +var msg25006 = msg("22840", dup263); + +var msg25007 = msg("22841", dup263); + +var msg25008 = msg("22842", dup263); + +var msg25009 = msg("22843", dup263); + +var msg25010 = msg("22844", dup263); + +var msg25011 = msg("22845", dup263); + +var msg25012 = msg("22846", dup263); + +var msg25013 = msg("22847", dup263); + +var msg25014 = msg("22848", dup263); + +var msg25015 = msg("22849", dup263); + +var msg25016 = msg("22850", dup263); + +var msg25017 = msg("22851", dup263); + +var msg25018 = msg("22852", dup263); + +var msg25019 = msg("22853", dup263); + +var msg25020 = msg("22854", dup263); + +var msg25021 = msg("22855", dup263); + +var msg25022 = msg("22856", dup263); + +var msg25023 = msg("22857", dup263); + +var msg25024 = msg("22858", dup263); + +var msg25025 = msg("22859", dup263); + +var msg25026 = msg("22860", dup263); + +var msg25027 = msg("22861", dup263); + +var msg25028 = msg("22862", dup263); + +var msg25029 = msg("22863", dup263); + +var msg25030 = msg("22864", dup263); + +var msg25031 = msg("22865", dup263); + +var msg25032 = msg("22866", dup263); + +var msg25033 = msg("22867", dup263); + +var msg25034 = msg("22868", dup263); + +var msg25035 = msg("22869", dup263); + +var msg25036 = msg("22870", dup263); + +var msg25037 = msg("22871", dup263); + +var msg25038 = msg("22872", dup263); + +var msg25039 = msg("22873", dup263); + +var msg25040 = msg("22874", dup263); + +var msg25041 = msg("22875", dup250); + +var msg25042 = msg("22876", dup263); + +var msg25043 = msg("22877", dup263); + +var msg25044 = msg("22878", dup263); + +var msg25045 = msg("22879", dup263); + +var msg25046 = msg("22880", dup263); + +var msg25047 = msg("22881", dup263); + +var msg25048 = msg("22882", dup263); + +var msg25049 = msg("22883", dup263); + +var msg25050 = msg("22884", dup263); + +var msg25051 = msg("22885", dup263); + +var msg25052 = msg("22886", dup263); + +var msg25053 = msg("22887", dup263); + +var msg25054 = msg("22888", dup263); + +var msg25055 = msg("22889", dup263); + +var msg25056 = msg("22890", dup263); + +var msg25057 = msg("22891", dup263); + +var msg25058 = msg("22892", dup263); + +var msg25059 = msg("22893", dup263); + +var msg25060 = msg("22894", dup263); + +var msg25061 = msg("22895", dup263); + +var msg25062 = msg("22896", dup263); + +var msg25063 = msg("22897", dup263); + +var msg25064 = msg("22898", dup263); + +var msg25065 = msg("22899", dup263); + +var msg25066 = msg("22900", dup263); + +var msg25067 = msg("22901", dup263); + +var msg25068 = msg("22902", dup263); + +var msg25069 = msg("22903", dup263); + +var msg25070 = msg("22904", dup263); + +var msg25071 = msg("22905", dup263); + +var msg25072 = msg("22906", dup263); + +var msg25073 = msg("22907", dup263); + +var msg25074 = msg("22908", dup263); + +var msg25075 = msg("22909", dup263); + +var msg25076 = msg("22910", dup263); + +var msg25077 = msg("22911", dup263); + +var msg25078 = msg("22912", dup263); + +var msg25079 = msg("22913", dup263); + +var msg25080 = msg("22914", dup263); + +var msg25081 = msg("22915", dup202); + +var msg25082 = msg("22916", dup202); + +var msg25083 = msg("22917", dup192); + +var msg25084 = msg("22918", dup192); + +var msg25085 = msg("22919", dup192); + +var msg25086 = msg("22920", dup192); + +var msg25087 = msg("22921", dup192); + +var msg25088 = msg("22922", dup192); + +var msg25089 = msg("22923", dup192); + +var msg25090 = msg("22924", dup227); + +var msg25091 = msg("22925", dup192); + +var msg25092 = msg("22926", dup192); + +var msg25093 = msg("22927", dup192); + +var msg25094 = msg("22928", dup192); + +var msg25095 = msg("22929", dup192); + +var msg25096 = msg("22930", dup192); + +var msg25097 = msg("22931", dup192); + +var msg25098 = msg("22932", dup192); + +var msg25099 = msg("22933", dup192); + +var msg25100 = msg("22934", dup192); + +var msg25101 = msg("22935", dup192); + +var msg25102 = msg("22936", dup192); + +var msg25103 = msg("22937", dup192); + +var msg25104 = msg("22938", dup197); + +var msg25105 = msg("22939", dup269); + +var msg25106 = msg("22940", dup202); + +var msg25107 = msg("22941", dup269); + +var msg25108 = msg("22942", dup285); + +var msg25109 = msg("22943", dup202); + +var msg25110 = msg("22944", dup202); + +var msg25111 = msg("22945", dup202); + +var msg25112 = msg("22946", dup202); + +var msg25113 = msg("22947", dup197); + +var msg25114 = msg("22948", dup201); + +var msg25115 = msg("22949", dup202); + +var msg25116 = msg("22950", dup197); + +var msg25117 = msg("22951", dup197); + +var msg25118 = msg("22952", dup199); + +var msg25119 = msg("22953", dup198); + +var msg25120 = msg("22954", dup197); + +var msg25121 = msg("22955", dup202); + +var msg25122 = msg("22956", dup202); + +var msg25123 = msg("22957", dup263); + +var msg25124 = msg("22958", dup263); + +var msg25125 = msg("22959", dup263); + +var msg25126 = msg("22960", dup263); + +var msg25127 = msg("22961", dup202); + +var msg25128 = msg("22962", dup202); + +var msg25129 = msg("22963", dup202); + +var msg25130 = msg("22964", dup202); + +var msg25131 = msg("22965", dup202); + +var msg25132 = msg("22966", dup202); + +var msg25133 = msg("22967", dup202); + +var msg25134 = msg("22968", dup202); + +var msg25135 = msg("22969", dup202); + +var msg25136 = msg("22970", dup202); + +var msg25137 = msg("22971", dup202); + +var msg25138 = msg("22972", dup202); + +var msg25139 = msg("22973", dup202); + +var msg25140 = msg("22974", dup202); + +var msg25141 = msg("22975", dup202); + +var msg25142 = msg("22976", dup202); + +var msg25143 = msg("22977", dup202); + +var msg25144 = msg("22978", dup202); + +var msg25145 = msg("22979", dup202); + +var msg25146 = msg("22980", dup202); + +var msg25147 = msg("22981", dup202); + +var msg25148 = msg("22982", dup202); + +var msg25149 = msg("22983", dup202); + +var msg25150 = msg("22984", dup202); + +var msg25151 = msg("22985", dup202); + +var msg25152 = msg("22986", dup202); + +var msg25153 = msg("22987", dup202); + +var msg25154 = msg("22988", dup202); + +var msg25155 = msg("22989", dup202); + +var msg25156 = msg("22990", dup202); + +var msg25157 = msg("22991", dup202); + +var msg25158 = msg("22992", dup202); + +var msg25159 = msg("22993", dup202); + +var msg25160 = msg("22994", dup202); + +var msg25161 = msg("22995", dup202); + +var msg25162 = msg("22996", dup202); + +var msg25163 = msg("22997", dup202); + +var msg25164 = msg("22998", dup202); + +var msg25165 = msg("22999", dup202); + +var msg25166 = msg("23000", dup202); + +var msg25167 = msg("23001", dup202); + +var msg25168 = msg("23002", dup202); + +var msg25169 = msg("23003", dup202); + +var msg25170 = msg("23004", dup197); + +var msg25171 = msg("23005", dup197); + +var msg25172 = msg("23006", dup197); + +var msg25173 = msg("23007", dup197); + +var msg25174 = msg("23008", dup201); + +var msg25175 = msg("23009", dup197); + +var msg25176 = msg("23010", dup197); + +var msg25177 = msg("23011", dup202); + +var msg25178 = msg("23012", dup202); + +var msg25179 = msg("23013", dup202); + +var msg25180 = msg("23014", dup197); + +var msg25181 = msg("23015", dup265); + +var msg25182 = msg("23016", dup192); + +var msg25183 = msg("23017", dup202); + +var msg25184 = msg("23018", dup202); + +var msg25185 = msg("23019", dup269); + +var msg25186 = msg("23020", dup263); + +var msg25187 = msg("23021", dup263); + +var msg25188 = msg("23022", dup263); + +var msg25189 = msg("23023", dup263); + +var msg25190 = msg("23024", dup263); + +var msg25191 = msg("23025", dup263); + +var msg25192 = msg("23026", dup263); + +var msg25193 = msg("23027", dup263); + +var msg25194 = msg("23028", dup263); + +var msg25195 = msg("23029", dup263); + +var msg25196 = msg("23030", dup263); + +var msg25197 = msg("23031", dup263); + +var msg25198 = msg("23032", dup263); + +var msg25199 = msg("23033", dup263); + +var msg25200 = msg("23034", dup263); + +var msg25201 = msg("23035", dup263); + +var msg25202 = msg("23036", dup263); + +var msg25203 = msg("23037", dup263); + +var msg25204 = msg("23038", dup263); + +var msg25205 = msg("23039", dup287); + +var msg25206 = msg("23040", dup287); + +var msg25207 = msg("23041", dup202); + +var msg25208 = msg("23042", dup269); + +var msg25209 = msg("23043", dup269); + +var msg25210 = msg("23044", dup269); + +var msg25211 = msg("23045", dup269); + +var msg25212 = msg("23046", dup267); + +var msg25213 = msg("23047", dup267); + +var msg25214 = msg("23048", dup265); + +var msg25215 = msg("23049", dup265); + +var msg25216 = msg("23050", dup265); + +var msg25217 = msg("23051", dup202); + +var msg25218 = msg("23054", dup267); + +var msg25219 = msg("23055", dup227); + +var msg25220 = msg("23056", dup197); + +var msg25221 = msg("23057", dup263); + +var msg25222 = msg("23058", dup202); + +var msg25223 = msg("23059", dup197); + +var msg25224 = msg("23060", dup267); + +var msg25225 = msg("23061", dup263); + +var msg25226 = msg("23062", dup263); + +var msg25227 = msg("23063", dup263); + +var msg25228 = msg("23064", dup263); + +var msg25229 = msg("23065", dup263); + +var msg25230 = msg("23066", dup263); + +var msg25231 = msg("23067", dup263); + +var msg25232 = msg("23068", dup263); + +var msg25233 = msg("23069", dup263); + +var msg25234 = msg("23070", dup263); + +var msg25235 = msg("23071", dup263); + +var msg25236 = msg("23072", dup263); + +var msg25237 = msg("23073", dup263); + +var msg25238 = msg("23074", dup263); + +var msg25239 = msg("23075", dup263); + +var msg25240 = msg("23076", dup263); + +var msg25241 = msg("23077", dup263); + +var msg25242 = msg("23078", dup263); + +var msg25243 = msg("23079", dup263); + +var msg25244 = msg("23080", dup263); + +var msg25245 = msg("23081", dup263); + +var msg25246 = msg("23082", dup263); + +var msg25247 = msg("23083", dup263); + +var msg25248 = msg("23084", dup263); + +var msg25249 = msg("23085", dup202); + +var msg25250 = msg("23086", dup202); + +var msg25251 = msg("23087", dup202); + +var msg25252 = msg("23088", dup202); + +var msg25253 = msg("23089", dup202); + +var msg25254 = msg("23090", dup265); + +var msg25255 = msg("23091", dup197); + +var msg25256 = msg("23092", dup197); + +var msg25257 = msg("23093", dup197); + +var msg25258 = msg("23094", dup197); + +var msg25259 = msg("23095", dup197); + +var msg25260 = msg("23096", dup267); + +var msg25261 = msg("23097", dup198); + +var msg25262 = msg("23098", dup197); + +var msg25263 = msg("23099", dup198); + +var msg25264 = msg("23100", dup197); + +var msg25265 = msg("23101", dup197); + +var msg25266 = msg("23102", dup192); + +var msg25267 = msg("23103", dup192); + +var msg25268 = msg("23104", dup192); + +var msg25269 = msg("23105", dup197); + +var msg25270 = msg("23106", dup192); + +var msg25271 = msg("23107", dup265); + +var msg25272 = msg("23108", dup192); + +var msg25273 = msg("23109", dup192); + +var msg25274 = msg("23110", dup197); + +var msg25275 = msg("23111", dup304); + +var msg25276 = msg("23112", dup198); + +var msg25277 = msg("23113", dup269); + +var msg25278 = msg("23114", dup269); + +var msg25279 = msg("23115", dup240); + +var msg25280 = msg("23116", dup265); + +var msg25281 = msg("23117", dup265); + +var msg25282 = msg("23118", dup265); + +var msg25283 = msg("23119", dup202); + +var msg25284 = msg("23120", dup202); + +var msg25285 = msg("23121", dup265); + +var msg25286 = msg("23122", dup265); + +var msg25287 = msg("23123", dup265); + +var msg25288 = msg("23124", dup267); + +var msg25289 = msg("23125", dup267); + +var msg25290 = msg("23126", dup267); + +var msg25291 = msg("23127", dup267); + +var msg25292 = msg("23128", dup265); + +var msg25293 = msg("23129", dup202); + +var msg25294 = msg("23130", dup202); + +var msg25295 = msg("23131", dup202); + +var msg25296 = msg("23132", dup202); + +var msg25297 = msg("23133", dup197); + +var msg25298 = msg("23134", dup265); + +var msg25299 = msg("23135", dup267); + +var msg25300 = msg("23136", dup267); + +var msg25301 = msg("23137", dup267); + +var msg25302 = msg("23138", dup201); + +var msg25303 = msg("23139", dup201); + +var msg25304 = msg("23140", dup269); + +var msg25305 = msg("23141", dup267); + +var msg25306 = msg("23142", dup265); + +var msg25307 = msg("23143", dup265); + +var msg25308 = msg("23144", dup265); + +var msg25309 = msg("23145", dup265); + +var msg25310 = msg("23146", dup265); + +var msg25311 = msg("23147", dup267); + +var msg25312 = msg("23148", dup202); + +var msg25313 = msg("23149", dup267); + +var msg25314 = msg("23150", dup197); + +var msg25315 = msg("23151", dup197); + +var msg25316 = msg("23152", dup197); + +var msg25317 = msg("23153", dup197); + +var msg25318 = msg("23154", dup197); + +var msg25319 = msg("23155", dup197); + +var msg25320 = msg("23156", dup267); + +var msg25321 = msg("23157", dup267); + +var msg25322 = msg("23158", dup202); + +var msg25323 = msg("23159", dup202); + +var msg25324 = msg("23160", dup202); + +var msg25325 = msg("23161", dup202); + +var msg25326 = msg("23162", dup276); + +var msg25327 = msg("23163", dup276); + +var msg25328 = msg("23164", dup267); + +var msg25329 = msg("23165", dup267); + +var msg25330 = msg("23166", dup202); + +var msg25331 = msg("23167", dup202); + +var msg25332 = msg("23168", dup202); + +var msg25333 = msg("23169", dup202); + +var msg25334 = msg("23170", dup197); + +var msg25335 = msg("23171", dup202); + +var msg25336 = msg("23172", dup265); + +var msg25337 = msg("23173", dup192); + +var msg25338 = msg("23174", dup197); + +var msg25339 = msg("23175", dup197); + +var msg25340 = msg("23176", dup202); + +var msg25341 = msg("23177", dup267); + +var msg25342 = msg("23178", dup197); + +var msg25343 = msg("23179", dup269); + +var msg25344 = msg("23180", dup250); + +var msg25345 = msg("23181", dup202); + +var msg25346 = msg("23182", dup267); + +var msg25347 = msg("23183", dup202); + +var msg25348 = msg("23184", dup202); + +var msg25349 = msg("23185", dup202); + +var msg25350 = msg("23186", dup265); + +var msg25351 = msg("23187", dup202); + +var msg25352 = msg("23188", dup202); + +var msg25353 = msg("23189", dup202); + +var msg25354 = msg("23190", dup202); + +var msg25355 = msg("23191", dup202); + +var msg25356 = msg("23192", dup202); + +var msg25357 = msg("23193", dup202); + +var msg25358 = msg("23194", dup202); + +var msg25359 = msg("23195", dup202); + +var msg25360 = msg("23196", dup202); + +var msg25361 = msg("23197", dup202); + +var msg25362 = msg("23198", dup202); + +var msg25363 = msg("23199", dup202); + +var msg25364 = msg("23200", dup202); + +var msg25365 = msg("23201", dup202); + +var msg25366 = msg("23202", dup202); + +var msg25367 = msg("23203", dup202); + +var msg25368 = msg("23204", dup202); + +var msg25369 = msg("23205", dup202); + +var msg25370 = msg("23206", dup202); + +var msg25371 = msg("23207", dup202); + +var msg25372 = msg("23208", dup202); + +var msg25373 = msg("23209", dup267); + +var msg25374 = msg("23210", dup267); + +var msg25375 = msg("23211", dup197); + +var msg25376 = msg("23212", dup265); + +var msg25377 = msg("23213", dup260); + +var msg25378 = msg("23214", dup192); + +var msg25379 = msg("23215", dup192); + +var msg25380 = msg("23216", dup260); + +var msg25381 = msg("23217", dup199); + +var msg25382 = msg("23218", dup267); + +var msg25383 = msg("23219", dup267); + +var msg25384 = msg("23220", dup267); + +var msg25385 = msg("23221", dup202); + +var msg25386 = msg("23222", dup202); + +var msg25387 = msg("23223", dup202); + +var msg25388 = msg("23224", dup202); + +var msg25389 = msg("23225", dup202); + +var msg25390 = msg("23226", dup202); + +var msg25391 = msg("23227", dup197); + +var msg25392 = msg("23228", dup265); + +var msg25393 = msg("23229", dup265); + +var msg25394 = msg("23230", dup197); + +var msg25395 = msg("23231", dup197); + +var msg25396 = msg("23232", dup197); + +var msg25397 = msg("23233", dup197); + +var msg25398 = msg("23234", dup202); + +var msg25399 = msg("23235", dup202); + +var msg25400 = msg("23236", dup199); + +var msg25401 = msg("23237", dup276); + +var msg25402 = msg("23238", dup276); + +var msg25403 = msg("23239", dup267); + +var msg25404 = msg("23240", dup276); + +var msg25405 = msg("23241", dup260); + +var msg25406 = msg("23242", dup202); + +var msg25407 = msg("23243", dup201); + +var msg25408 = msg("23244", dup192); + +var msg25409 = msg("23245", dup192); + +var msg25410 = msg("23246", dup303); + +var msg25411 = msg("23247", dup303); + +var msg25412 = msg("23248", dup267); + +var msg25413 = msg("23249", dup267); + +var msg25414 = msg("23250", dup202); + +var msg25415 = msg("23251", dup192); + +var msg25416 = msg("23252", dup202); + +var msg25417 = msg("23253", dup265); + +var msg25418 = msg("23254", dup192); + +var msg25419 = msg("23255", dup192); + +var msg25420 = msg("23256", dup202); + +var msg25421 = msg("23257", dup192); + +var msg25422 = msg("23258", dup267); + +var msg25423 = msg("23259", dup267); + +var msg25424 = msg("23260", dup267); + +var msg25425 = msg("23261", dup202); + +var msg25426 = msg("23262", dup192); + +var msg25427 = msg("23263", dup267); + +var msg25428 = msg("23264", dup267); + +var msg25429 = msg("23265", dup267); + +var msg25430 = msg("23266", dup197); + +var msg25431 = msg("23267", dup197); + +var msg25432 = msg("23268", dup197); + +var msg25433 = msg("23269", dup197); + +var msg25434 = msg("23270", dup197); + +var msg25435 = msg("23271", dup197); + +var msg25436 = msg("23272", dup197); + +var msg25437 = msg("23273", dup267); + +var msg25438 = msg("23274", dup267); + +var msg25439 = msg("23275", dup267); + +var msg25440 = msg("23276", dup267); + +var msg25441 = msg("23277", dup267); + +var msg25442 = msg("23278", dup265); + +var msg25443 = msg("23279", dup267); + +var msg25444 = msg("23280", dup265); + +var msg25445 = msg("23281", dup265); + +var msg25446 = msg("23282", dup265); + +var msg25447 = msg("23283", dup265); + +var msg25448 = msg("23284", dup265); + +var msg25449 = msg("23285", dup265); + +var msg25450 = msg("23286", dup265); + +var msg25451 = msg("23287", dup265); + +var msg25452 = msg("23288", dup265); + +var msg25453 = msg("23289", dup265); + +var msg25454 = msg("23290", dup265); + +var msg25455 = msg("23291", dup265); + +var msg25456 = msg("23292", dup265); + +var msg25457 = msg("23293", dup265); + +var msg25458 = msg("23294", dup265); + +var msg25459 = msg("23295", dup265); + +var msg25460 = msg("23296", dup265); + +var msg25461 = msg("23297", dup265); + +var msg25462 = msg("23298", dup265); + +var msg25463 = msg("23299", dup265); + +var msg25464 = msg("23300", dup265); + +var msg25465 = msg("23301", dup265); + +var msg25466 = msg("23302", dup265); + +var msg25467 = msg("23303", dup265); + +var msg25468 = msg("23304", dup265); + +var msg25469 = msg("23305", dup197); + +var msg25470 = msg("23306", dup192); + +var msg25471 = msg("23307", dup192); + +var msg25472 = msg("23308", dup192); + +var msg25473 = msg("23309", dup267); + +var msg25474 = msg("23310", dup267); + +var msg25475 = msg("23311", dup267); + +var msg25476 = msg("23312", dup267); + +var msg25477 = msg("23313", dup267); + +var msg25478 = msg("23314", dup276); + +var msg25479 = msg("23315", dup276); + +var msg25480 = msg("23316", dup267); + +var msg25481 = msg("23317", dup192); + +var msg25482 = msg("23318", dup287); + +var msg25483 = msg("23319", dup202); + +var msg25484 = msg("23320", dup202); + +var msg25485 = msg("23321", dup202); + +var msg25486 = msg("23322", dup202); + +var msg25487 = msg("23323", dup287); + +var msg25488 = msg("23324", dup287); + +var msg25489 = msg("23325", dup287); + +var msg25490 = msg("23326", dup287); + +var msg25491 = msg("23327", dup287); + +var msg25492 = msg("23328", dup287); + +var msg25493 = msg("23329", dup287); + +var msg25494 = msg("23330", dup197); + +var msg25495 = msg("23331", dup192); + +var msg25496 = msg("23332", dup192); + +var msg25497 = msg("23333", dup192); + +var msg25498 = msg("23334", dup192); + +var msg25499 = msg("23335", dup192); + +var msg25500 = msg("23336", dup192); + +var msg25501 = msg("23337", dup192); + +var msg25502 = msg("23338", dup192); + +var msg25503 = msg("23339", dup192); + +var msg25504 = msg("23340", dup192); + +var msg25505 = msg("23341", dup192); + +var msg25506 = msg("23342", dup192); + +var msg25507 = msg("23343", dup192); + +var msg25508 = msg("23344", dup192); + +var msg25509 = msg("23345", dup192); + +var msg25510 = msg("23346", dup197); + +var msg25511 = msg("23347", dup202); + +var msg25512 = msg("23348", dup202); + +var msg25513 = msg("23349", dup202); + +var msg25514 = msg("23350", dup202); + +var msg25515 = msg("23351", dup287); + +var msg25516 = msg("23352", dup265); + +var msg25517 = msg("23353", dup265); + +var msg25518 = msg("23354", dup197); + +var msg25519 = msg("23355", dup197); + +var msg25520 = msg("23356", dup197); + +var msg25521 = msg("23357", dup287); + +var msg25522 = msg("23358", dup287); + +var msg25523 = msg("23359", dup287); + +var msg25524 = msg("23360", dup265); + +var msg25525 = msg("23361", dup265); + +var msg25526 = msg("23362", dup265); + +var msg25527 = msg("23363", dup197); + +var msg25528 = msg("23364", dup197); + +var msg25529 = msg("23365", dup197); + +var msg25530 = msg("23366", dup197); + +var msg25531 = msg("23367", dup197); + +var msg25532 = msg("23368", dup274); + +var msg25533 = msg("23369", dup263); + +var msg25534 = msg("23370", dup197); + +var msg25535 = msg("23371", dup197); + +var msg25536 = msg("23372", dup265); + +var msg25537 = msg("23373", dup265); + +var msg25538 = msg("23374", dup265); + +var msg25539 = msg("23375", dup265); + +var msg25540 = msg("23376", dup265); + +var msg25541 = msg("23377", dup269); + +var msg25542 = msg("23378", dup269); + +var msg25543 = msg("23379", dup192); + +var msg25544 = msg("23380", dup192); + +var msg25545 = msg("23381", dup192); + +var msg25546 = msg("23382", dup192); + +var msg25547 = msg("23383", dup192); + +var msg25548 = msg("23384", dup267); + +var msg25549 = msg("23385", dup267); + +var msg25550 = msg("23386", dup197); + +var msg25551 = msg("23387", dup192); + +var msg25552 = msg("23388", dup192); + +var msg25553 = msg("23389", dup192); + +var msg25554 = msg("23390", dup192); + +var msg25555 = msg("23391", dup192); + +var msg25556 = msg("23392", dup198); + +var msg25557 = msg("23393", dup202); + +var msg25558 = msg("23394", dup192); + +var msg25559 = msg("23395", dup265); + +var msg25560 = msg("23396", dup265); + +var msg25561 = msg("23397", dup197); + +var msg25562 = msg("23398", dup197); + +var msg25563 = msg("23399", dup192); + +var msg25564 = msg("23400", dup202); + +var msg25565 = msg("23401", dup265); + +var msg25566 = msg("23402", dup265); + +var msg25567 = msg("23403", dup265); + +var msg25568 = msg("23404", dup197); + +var msg25569 = msg("23405", dup260); + +var msg25570 = msg("23406", dup260); + +var msg25571 = msg("23407", dup267); + +var msg25572 = msg("23408", dup265); + +var msg25573 = msg("23409", dup267); + +var msg25574 = msg("23410", dup267); + +var msg25575 = msg("23411", dup267); + +var msg25576 = msg("23412", dup267); + +var msg25577 = msg("23413", dup267); + +var msg25578 = msg("23414", dup267); + +var msg25579 = msg("23415", dup267); + +var msg25580 = msg("23416", dup267); + +var msg25581 = msg("23417", dup267); + +var msg25582 = msg("23418", dup267); + +var msg25583 = msg("23419", dup267); + +var msg25584 = msg("23420", dup267); + +var msg25585 = msg("23421", dup267); + +var msg25586 = msg("23422", dup267); + +var msg25587 = msg("23423", dup267); + +var msg25588 = msg("23424", dup267); + +var msg25589 = msg("23425", dup267); + +var msg25590 = msg("23426", dup267); + +var msg25591 = msg("23427", dup267); + +var msg25592 = msg("23428", dup267); + +var msg25593 = msg("23429", dup267); + +var msg25594 = msg("23430", dup267); + +var msg25595 = msg("23431", dup267); + +var msg25596 = msg("23432", dup267); + +var msg25597 = msg("23433", dup267); + +var msg25598 = msg("23434", dup267); + +var msg25599 = msg("23435", dup202); + +var msg25600 = msg("23436", dup267); + +var msg25601 = msg("23437", dup267); + +var msg25602 = msg("23438", dup265); + +var msg25603 = msg("23439", dup265); + +var msg25604 = msg("23440", dup265); + +var msg25605 = msg("23441", dup265); + +var msg25606 = msg("23442", dup199); + +var msg25607 = msg("23443", dup199); + +var msg25608 = msg("23444", dup197); + +var msg25609 = msg("23445", dup267); + +var msg25610 = msg("23446", dup192); + +var msg25611 = msg("23447", dup192); + +var msg25612 = msg("23448", dup238); + +var msg25613 = msg("23449", dup192); + +var msg25614 = msg("23450", dup192); + +var msg25615 = msg("23451", dup287); + +var msg25616 = msg("23452", dup263); + +var msg25617 = msg("23453", dup263); + +var msg25618 = msg("23454", dup263); + +var msg25619 = msg("23455", dup263); + +var msg25620 = msg("23456", dup197); + +var msg25621 = msg("23457", dup197); + +var msg25622 = msg("23458", dup197); + +var msg25623 = msg("23459", dup197); + +var msg25624 = msg("23460", dup192); + +var msg25625 = msg("23461", dup197); + +var msg25626 = msg("23462", dup197); + +var msg25627 = msg("23463", dup197); + +var msg25628 = msg("23464", dup201); + +var msg25629 = msg("23465", dup197); + +var msg25630 = msg("23466", dup265); + +var msg25631 = msg("23467", dup202); + +var msg25632 = msg("23468", dup192); + +var msg25633 = msg("23469", dup192); + +var msg25634 = msg("23470", dup265); + +var msg25635 = msg("23471", dup265); + +var msg25636 = msg("23472", dup303); + +var msg25637 = msg("23473", dup202); + +var msg25638 = msg("23474", dup202); + +var msg25639 = msg("23475", dup202); + +var msg25640 = msg("23476", dup202); + +var msg25641 = msg("23477", dup202); + +var msg25642 = msg("23478", dup197); + +var msg25643 = msg("23479", dup197); + +var msg25644 = msg("23480", dup265); + +var msg25645 = msg("23481", dup202); + +var msg25646 = msg("23482", dup202); + +var msg25647 = msg("23483", dup192); + +var msg25648 = msg("23484", dup202); + +var msg25649 = msg("23485", dup265); + +var msg25650 = msg("23486", dup202); + +var msg25651 = msg("23487", dup202); + +var msg25652 = msg("23488", dup202); + +var msg25653 = msg("23489", dup197); + +var msg25654 = msg("23490", dup267); + +var msg25655 = msg("23491", dup192); + +var msg25656 = msg("23492", dup192); + +var msg25657 = msg("23493", dup192); + +var msg25658 = msg("23494", dup192); + +var msg25659 = msg("23495", dup192); + +var all53 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg25660 = msg("23496", all53); + +var msg25661 = msg("23497", dup202); + +var msg25662 = msg("23498", dup202); + +var msg25663 = msg("23499", dup197); + +var msg25664 = msg("23500", dup267); + +var msg25665 = msg("23501", dup201); + +var msg25666 = msg("23502", dup201); + +var msg25667 = msg("23503", dup201); + +var msg25668 = msg("23504", dup267); + +var msg25669 = msg("23505", dup267); + +var msg25670 = msg("23506", dup267); + +var msg25671 = msg("23507", dup197); + +var msg25672 = msg("23508", dup197); + +var msg25673 = msg("23509", dup267); + +var msg25674 = msg("23510", dup267); + +var msg25675 = msg("23511", dup267); + +var msg25676 = msg("23512", dup267); + +var msg25677 = msg("23513", dup267); + +var msg25678 = msg("23514", dup267); + +var msg25679 = msg("23515", dup267); + +var msg25680 = msg("23516", dup267); + +var msg25681 = msg("23517", dup197); + +var msg25682 = msg("23518", dup197); + +var msg25683 = msg("23519", dup269); + +var msg25684 = msg("23520", dup269); + +var msg25685 = msg("23521", dup269); + +var msg25686 = msg("23522", dup267); + +var msg25687 = msg("23523", dup267); + +var msg25688 = msg("23524", dup267); + +var msg25689 = msg("23525", dup197); + +var msg25690 = msg("23526", dup197); + +var msg25691 = msg("23527", dup197); + +var msg25692 = msg("23528", dup197); + +var msg25693 = msg("23529", dup197); + +var msg25694 = msg("23530", dup197); + +var msg25695 = msg("23531", dup197); + +var msg25696 = msg("23532", dup197); + +var msg25697 = msg("23533", dup197); + +var msg25698 = msg("23534", dup197); + +var msg25699 = msg("23535", dup197); + +var msg25700 = msg("23536", dup197); + +var msg25701 = msg("23537", dup197); + +var msg25702 = msg("23538", dup197); + +var msg25703 = msg("23539", dup197); + +var msg25704 = msg("23540", dup197); + +var msg25705 = msg("23541", dup197); + +var msg25706 = msg("23542", dup197); + +var msg25707 = msg("23543", dup197); + +var msg25708 = msg("23544", dup197); + +var msg25709 = msg("23545", dup197); + +var msg25710 = msg("23546", dup197); + +var msg25711 = msg("23547", dup197); + +var msg25712 = msg("23548", dup197); + +var msg25713 = msg("23549", dup197); + +var msg25714 = msg("23550", dup197); + +var msg25715 = msg("23551", dup197); + +var msg25716 = msg("23552", dup197); + +var msg25717 = msg("23553", dup197); + +var msg25718 = msg("23554", dup197); + +var msg25719 = msg("23555", dup197); + +var msg25720 = msg("23556", dup197); + +var msg25721 = msg("23557", dup197); + +var msg25722 = msg("23558", dup197); + +var msg25723 = msg("23559", dup197); + +var msg25724 = msg("23560", dup201); + +var msg25725 = msg("23561", dup202); + +var msg25726 = msg("23562", dup202); + +var msg25727 = msg("23563", dup202); + +var msg25728 = msg("23564", dup197); + +var msg25729 = msg("23565", dup197); + +var msg25730 = msg("23566", dup197); + +var msg25731 = msg("23567", dup267); + +var msg25732 = msg("23568", dup267); + +var msg25733 = msg("23569", dup267); + +var msg25734 = msg("23570", dup202); + +var msg25735 = msg("23571", dup202); + +var msg25736 = msg("23572", dup202); + +var msg25737 = msg("23573", dup297); + +var msg25738 = msg("23574", dup202); + +var msg25739 = msg("23575", dup202); + +var msg25740 = msg("23576", dup202); + +var msg25741 = msg("23577", dup197); + +var msg25742 = msg("23578", dup267); + +var msg25743 = msg("23579", dup267); + +var msg25744 = msg("23580", dup197); + +var msg25745 = msg("23581", dup197); + +var msg25746 = msg("23582", dup197); + +var msg25747 = msg("23583", dup197); + +var msg25748 = msg("23584", dup197); + +var msg25749 = msg("23585", dup201); + +var msg25750 = msg("23586", dup197); + +var msg25751 = msg("23587", dup197); + +var msg25752 = msg("23588", dup197); + +var msg25753 = msg("23589", dup197); + +var msg25754 = msg("23590", dup197); + +var msg25755 = msg("23591", dup267); + +var msg25756 = msg("23592", dup267); + +var msg25757 = msg("23593", dup192); + +var msg25758 = msg("23594", dup192); + +var msg25759 = msg("23595", dup192); + +var msg25760 = msg("23596", dup269); + +var msg25761 = msg("23597", dup192); + +var msg25762 = msg("23598", dup202); + +var msg25763 = msg("23599", dup202); + +var msg25764 = msg("23600", dup192); + +var msg25765 = msg("23601", dup194); + +var msg25766 = msg("23602", dup194); + +var msg25767 = msg("23603", dup194); + +var msg25768 = msg("23604", dup194); + +var msg25769 = msg("23605", dup202); + +var msg25770 = msg("23606", dup192); + +var msg25771 = msg("23607", dup192); + +var msg25772 = msg("23608", dup313); + +var msg25773 = msg("23609", dup265); + +var msg25774 = msg("23610", dup238); + +var msg25775 = msg("23611", dup202); + +var msg25776 = msg("23612", dup202); + +var msg25777 = msg("23613", dup265); + +var msg25778 = msg("23614", dup201); + +var msg25779 = msg("23615", dup303); + +var msg25780 = msg("23616", dup202); + +var msg25781 = msg("23617", dup287); + +var msg25782 = msg("23618", dup202); + +var msg25783 = msg("23619", dup202); + +var msg25784 = msg("23620", dup202); + +var msg25785 = msg("23621", dup202); + +var msg25786 = msg("23622", dup202); + +var msg25787 = msg("23623", dup267); + +var msg25788 = msg("23624", dup265); + +var msg25789 = msg("23625", dup265); + +var msg25790 = msg("23626", dup310); + +var msg25791 = msg("23627", dup269); + +var msg25792 = msg("23628", dup192); + +var msg25793 = msg("23629", dup263); + +var msg25794 = msg("23630", dup192); + +var msg25795 = msg("23631", dup267); + +var msg25796 = msg("23632", dup197); + +var msg25797 = msg("23633", dup287); + +var msg25798 = msg("23634", dup287); + +var msg25799 = msg("23635", dup192); + +var msg25800 = msg("23636", dup202); + +var msg25801 = msg("23637", dup202); + +var msg25802 = msg("23638", dup202); + +var msg25803 = msg("23639", dup202); + +var msg25804 = msg("23640", dup202); + +var msg25805 = msg("23641", dup287); + +var msg25806 = msg("23642", dup287); + +var msg25807 = msg("23643", dup287); + +var msg25808 = msg("23644", dup202); + +var msg25809 = msg("23645", dup202); + +var msg25810 = msg("23646", dup287); + +var msg25811 = msg("23647", dup202); + +var msg25812 = msg("23648", dup202); + +var msg25813 = msg("23649", dup202); + +var msg25814 = msg("23650", dup202); + +var msg25815 = msg("23651", dup287); + +var msg25816 = msg("23652", dup287); + +var msg25817 = msg("23653", dup287); + +var msg25818 = msg("23654", dup287); + +var msg25819 = msg("23655", dup287); + +var msg25820 = msg("23656", dup287); + +var msg25821 = msg("23657", dup287); + +var msg25822 = msg("23658", dup202); + +var msg25823 = msg("23659", dup202); + +var msg25824 = msg("23660", dup202); + +var msg25825 = msg("23661", dup202); + +var msg25826 = msg("23662", dup202); + +var msg25827 = msg("23663", dup202); + +var msg25828 = msg("23664", dup202); + +var msg25829 = msg("23665", dup202); + +var msg25830 = msg("23666", dup202); + +var msg25831 = msg("23667", dup202); + +var msg25832 = msg("23668", dup202); + +var msg25833 = msg("23669", dup287); + +var msg25834 = msg("23670", dup202); + +var msg25835 = msg("23671", dup287); + +var msg25836 = msg("23672", dup202); + +var msg25837 = msg("23673", dup202); + +var msg25838 = msg("23674", dup202); + +var msg25839 = msg("23675", dup202); + +var msg25840 = msg("23676", dup202); + +var msg25841 = msg("23677", dup202); + +var msg25842 = msg("23678", dup202); + +var msg25843 = msg("23679", dup202); + +var msg25844 = msg("23680", dup202); + +var msg25845 = msg("23681", dup202); + +var msg25846 = msg("23682", dup202); + +var msg25847 = msg("23683", dup202); + +var msg25848 = msg("23684", dup202); + +var msg25849 = msg("23685", dup202); + +var msg25850 = msg("23686", dup202); + +var msg25851 = msg("23687", dup202); + +var msg25852 = msg("23688", dup202); + +var msg25853 = msg("23689", dup202); + +var msg25854 = msg("23690", dup202); + +var msg25855 = msg("23691", dup202); + +var msg25856 = msg("23692", dup202); + +var msg25857 = msg("23693", dup202); + +var msg25858 = msg("23694", dup202); + +var msg25859 = msg("23695", dup202); + +var msg25860 = msg("23696", dup202); + +var msg25861 = msg("23697", dup202); + +var msg25862 = msg("23698", dup269); + +var msg25863 = msg("23699", dup202); + +var msg25864 = msg("23700", dup202); + +var msg25865 = msg("23701", dup202); + +var msg25866 = msg("23702", dup202); + +var msg25867 = msg("23703", dup269); + +var msg25868 = msg("23704", dup267); + +var msg25869 = msg("23705", dup267); + +var msg25870 = msg("23706", dup267); + +var msg25871 = msg("23707", dup202); + +var msg25872 = msg("23708", dup202); + +var msg25873 = msg("23709", dup202); + +var msg25874 = msg("23710", dup202); + +var msg25875 = msg("23711", dup202); + +var msg25876 = msg("23712", dup202); + +var msg25877 = msg("23713", dup202); + +var msg25878 = msg("23714", dup202); + +var msg25879 = msg("23715", dup202); + +var msg25880 = msg("23716", dup202); + +var msg25881 = msg("23717", dup202); + +var msg25882 = msg("23718", dup202); + +var msg25883 = msg("23719", dup267); + +var msg25884 = msg("23720", dup202); + +var msg25885 = msg("23721", dup202); + +var msg25886 = msg("23722", dup202); + +var msg25887 = msg("23723", dup202); + +var msg25888 = msg("23724", dup202); + +var msg25889 = msg("23725", dup267); + +var msg25890 = msg("23726", dup267); + +var msg25891 = msg("23727", dup202); + +var msg25892 = msg("23728", dup202); + +var msg25893 = msg("23729", dup202); + +var msg25894 = msg("23730", dup202); + +var msg25895 = msg("23731", dup202); + +var msg25896 = msg("23732", dup269); + +var msg25897 = msg("23733", dup202); + +var msg25898 = msg("23734", dup202); + +var msg25899 = msg("23735", dup202); + +var msg25900 = msg("23736", dup202); + +var msg25901 = msg("23737", dup202); + +var msg25902 = msg("23738", dup202); + +var msg25903 = msg("23739", dup202); + +var msg25904 = msg("23740", dup202); + +var msg25905 = msg("23741", dup202); + +var msg25906 = msg("23742", dup202); + +var msg25907 = msg("23743", dup202); + +var msg25908 = msg("23744", dup202); + +var msg25909 = msg("23745", dup202); + +var msg25910 = msg("23746", dup202); + +var msg25911 = msg("23747", dup202); + +var msg25912 = msg("23748", dup202); + +var msg25913 = msg("23749", dup202); + +var msg25914 = msg("23750", dup202); + +var msg25915 = msg("23751", dup202); + +var msg25916 = msg("23752", dup202); + +var msg25917 = msg("23753", dup202); + +var msg25918 = msg("23754", dup202); + +var msg25919 = msg("23755", dup202); + +var msg25920 = msg("23756", dup267); + +var msg25921 = msg("23757", dup202); + +var msg25922 = msg("23758", dup202); + +var msg25923 = msg("23759", dup202); + +var msg25924 = msg("23760", dup202); + +var msg25925 = msg("23761", dup202); + +var msg25926 = msg("23762", dup202); + +var msg25927 = msg("23763", dup202); + +var msg25928 = msg("23764", dup202); + +var msg25929 = msg("23765", dup202); + +var msg25930 = msg("23766", dup202); + +var msg25931 = msg("23767", dup202); + +var msg25932 = msg("23768", dup202); + +var msg25933 = msg("23769", dup202); + +var msg25934 = msg("23770", dup202); + +var msg25935 = msg("23771", dup202); + +var msg25936 = msg("23772", dup202); + +var msg25937 = msg("23773", dup202); + +var msg25938 = msg("23774", dup202); + +var msg25939 = msg("23775", dup202); + +var msg25940 = msg("23776", dup202); + +var msg25941 = msg("23777", dup202); + +var msg25942 = msg("23778", dup192); + +var msg25943 = msg("23779", dup265); + +var msg25944 = msg("23780", dup192); + +var msg25945 = msg("23781", dup202); + +var msg25946 = msg("23782", dup192); + +var msg25947 = msg("23783", dup199); + +var msg25948 = msg("23784", dup260); + +var msg25949 = msg("23785", dup202); + +var msg25950 = msg("23786", dup202); + +var msg25951 = msg("23787", dup192); + +var msg25952 = msg("23788", dup192); + +var msg25953 = msg("23789", dup267); + +var msg25954 = msg("23790", dup267); + +var msg25955 = msg("23791", dup265); + +var msg25956 = msg("23792", dup265); + +var msg25957 = msg("23793", dup250); + +var msg25958 = msg("23794", dup202); + +var msg25959 = msg("23795", dup263); + +var msg25960 = msg("23796", dup197); + +var msg25961 = msg("23797", dup202); + +var msg25962 = msg("23798", dup202); + +var msg25963 = msg("23799", dup263); + +var msg25964 = msg("23800", dup263); + +var msg25965 = msg("23801", dup263); + +var msg25966 = msg("23802", dup263); + +var msg25967 = msg("23803", dup263); + +var msg25968 = msg("23804", dup263); + +var msg25969 = msg("23805", dup267); + +var msg25970 = msg("23806", dup197); + +var msg25971 = msg("23807", dup202); + +var msg25972 = msg("23808", dup202); + +var msg25973 = msg("23809", dup202); + +var msg25974 = msg("23810", dup202); + +var msg25975 = msg("23811", dup202); + +var msg25976 = msg("23812", dup202); + +var msg25977 = msg("23813", dup202); + +var msg25978 = msg("23814", dup202); + +var msg25979 = msg("23815", dup202); + +var msg25980 = msg("23816", dup202); + +var msg25981 = msg("23817", dup202); + +var msg25982 = msg("23818", dup202); + +var msg25983 = msg("23819", dup202); + +var msg25984 = msg("23820", dup202); + +var msg25985 = msg("23821", dup202); + +var msg25986 = msg("23822", dup202); + +var msg25987 = msg("23823", dup202); + +var msg25988 = msg("23824", dup263); + +var msg25989 = msg("23825", dup202); + +var msg25990 = msg("23826", dup202); + +var msg25991 = msg("23827", dup265); + +var msg25992 = msg("23828", dup265); + +var msg25993 = msg("23829", dup202); + +var msg25994 = msg("23830", dup202); + +var msg25995 = msg("23831", dup265); + +var msg25996 = msg("23832", dup265); + +var msg25997 = msg("23833", dup202); + +var msg25998 = msg("23834", dup267); + +var msg25999 = msg("23835", dup267); + +var msg26000 = msg("23836", dup265); + +var msg26001 = msg("23837", dup276); + +var msg26002 = msg("23838", dup276); + +var msg26003 = msg("23839", dup197); + +var msg26004 = msg("23840", dup267); + +var msg26005 = msg("23841", dup267); + +var msg26006 = msg("23842", dup197); + +var msg26007 = msg("23843", dup197); + +var msg26008 = msg("23844", dup201); + +var msg26009 = msg("23845", dup201); + +var msg26010 = msg("23846", dup267); + +var msg26011 = msg("23847", dup276); + +var msg26012 = msg("23848", dup202); + +var msg26013 = msg("23849", dup202); + +var msg26014 = msg("23850", dup202); + +var msg26015 = msg("23851", dup269); + +var msg26016 = msg("23852", dup269); + +var msg26017 = msg("23853", dup267); + +var msg26018 = msg("23854", dup267); + +var msg26019 = msg("23855", dup267); + +var msg26020 = msg("23856", dup267); + +var msg26021 = msg("23857", dup250); + +var msg26022 = msg("23858", dup250); + +var msg26023 = msg("23859", dup250); + +var msg26024 = msg("23860", dup265); + +var msg26025 = msg("23861", dup265); + +var msg26026 = msg("23862", dup265); + +var msg26027 = msg("23863", dup303); + +var msg26028 = msg("23864", dup202); + +var msg26029 = msg("23865", dup202); + +var msg26030 = msg("23866", dup202); + +var msg26031 = msg("23867", dup202); + +var msg26032 = msg("23868", dup202); + +var msg26033 = msg("23869", dup202); + +var msg26034 = msg("23870", dup202); + +var msg26035 = msg("23871", dup202); + +var msg26036 = msg("23872", dup201); + +var msg26037 = msg("23873", dup201); + +var msg26038 = msg("23874", dup201); + +var msg26039 = msg("23875", dup201); + +var msg26040 = msg("23876", dup192); + +var msg26041 = msg("23877", dup192); + +var msg26042 = msg("23878", dup265); + +var msg26043 = msg("23879", dup197); + +var msg26044 = msg("23880", dup197); + +var msg26045 = msg("23881", dup202); + +var msg26046 = msg("23882", dup202); + +var msg26047 = msg("23883", dup202); + +var msg26048 = msg("23884", dup202); + +var msg26049 = msg("23885", dup202); + +var msg26050 = msg("23886", dup202); + +var msg26051 = msg("23887", dup202); + +var msg26052 = msg("23888", dup202); + +var msg26053 = msg("23889", dup202); + +var msg26054 = msg("23890", dup202); + +var msg26055 = msg("23891", dup202); + +var msg26056 = msg("23892", dup202); + +var msg26057 = msg("23893", dup192); + +var msg26058 = msg("23894", dup250); + +var msg26059 = msg("23895", dup265); + +var msg26060 = msg("23896", dup265); + +var msg26061 = msg("23897", dup287); + +var msg26062 = msg("23898", dup222); + +var msg26063 = msg("23899", dup201); + +var msg26064 = msg("23900", dup201); + +var msg26065 = msg("23901", dup201); + +var msg26066 = msg("23902", dup201); + +var msg26067 = msg("23903", dup269); + +var msg26068 = msg("23904", dup263); + +var msg26069 = msg("23905", dup267); + +var msg26070 = msg("23906", dup267); + +var msg26071 = msg("23907", dup267); + +var msg26072 = msg("23908", dup267); + +var msg26073 = msg("23909", dup267); + +var msg26074 = msg("23910", dup267); + +var msg26075 = msg("23911", dup267); + +var msg26076 = msg("23912", dup267); + +var msg26077 = msg("23913", dup267); + +var msg26078 = msg("23914", dup267); + +var msg26079 = msg("23915", dup267); + +var msg26080 = msg("23916", dup267); + +var msg26081 = msg("23917", dup267); + +var msg26082 = msg("23918", dup267); + +var msg26083 = msg("23919", dup267); + +var msg26084 = msg("23920", dup267); + +var msg26085 = msg("23921", dup267); + +var msg26086 = msg("23922", dup267); + +var msg26087 = msg("23923", dup267); + +var msg26088 = msg("23924", dup267); + +var msg26089 = msg("23925", dup267); + +var msg26090 = msg("23926", dup267); + +var msg26091 = msg("23927", dup267); + +var msg26092 = msg("23928", dup267); + +var msg26093 = msg("23929", dup267); + +var msg26094 = msg("23930", dup267); + +var msg26095 = msg("23931", dup267); + +var msg26096 = msg("23932", dup267); + +var msg26097 = msg("23933", dup267); + +var msg26098 = msg("23934", dup260); + +var msg26099 = msg("23935", dup192); + +var msg26100 = msg("23936", dup192); + +var msg26101 = msg("23937", dup265); + +var msg26102 = msg("23938", dup192); + +var msg26103 = msg("23939", dup317); + +var msg26104 = msg("23940", dup317); + +var msg26105 = msg("23941", dup192); + +var msg26106 = msg("23942", dup192); + +var msg26107 = msg("23943", dup197); + +var msg26108 = msg("23944", dup265); + +var msg26109 = msg("23945", dup192); + +var msg26110 = msg("23946", dup192); + +var msg26111 = msg("23947", dup260); + +var msg26112 = msg("23948", dup192); + +var msg26113 = msg("23949", dup192); + +var msg26114 = msg("23950", dup267); + +var msg26115 = msg("23951", dup267); + +var msg26116 = msg("23952", dup197); + +var msg26117 = msg("23953", dup192); + +var msg26118 = msg("23954", dup303); + +var msg26119 = msg("23955", dup202); + +var msg26120 = msg("23956", dup197); + +var msg26121 = msg("23957", dup197); + +var msg26122 = msg("23958", dup197); + +var msg26123 = msg("23959", dup197); + +var msg26124 = msg("23960", dup197); + +var msg26125 = msg("23961", dup197); + +var msg26126 = msg("23962", dup202); + +var msg26127 = msg("23963", dup192); + +var msg26128 = msg("23964", dup267); + +var msg26129 = msg("23965", dup267); + +var msg26130 = msg("23966", dup287); + +var msg26131 = msg("23967", dup267); + +var msg26132 = msg("23968", dup192); + +var msg26133 = msg("23969", dup303); + +var msg26134 = msg("23970", dup202); + +var msg26135 = msg("23971", dup192); + +var msg26136 = msg("23972", dup192); + +var msg26137 = msg("23973", dup192); + +var msg26138 = msg("23974", dup197); + +var msg26139 = msg("23975", dup197); + +var msg26140 = msg("23976", dup192); + +var msg26141 = msg("23977", dup192); + +var msg26142 = msg("23978", dup192); + +var msg26143 = msg("23979", dup197); + +var msg26144 = msg("23980", dup197); + +var msg26145 = msg("23981", dup197); + +var msg26146 = msg("23982", dup197); + +var msg26147 = msg("23983", dup197); + +var msg26148 = msg("23984", dup265); + +var msg26149 = msg("23985", dup197); + +var msg26150 = msg("23986", dup197); + +var msg26151 = msg("23987", dup192); + +var msg26152 = msg("23988", dup265); + +var msg26153 = msg("23989", dup197); + +var msg26154 = msg("23990", dup202); + +var msg26155 = msg("23991", dup202); + +var msg26156 = msg("23992", dup197); + +var msg26157 = msg("23993", dup197); + +var msg26158 = msg("23994", dup265); + +var msg26159 = msg("23995", dup265); + +var msg26160 = msg("23996", dup267); + +var msg26161 = msg("23997", dup267); + +var msg26162 = msg("23998", dup197); + +var msg26163 = msg("23999", dup267); + +var msg26164 = msg("24000", dup267); + +var msg26165 = msg("24001", dup267); + +var msg26166 = msg("24002", dup267); + +var msg26167 = msg("24003", dup267); + +var msg26168 = msg("24004", dup197); + +var msg26169 = msg("24005", dup197); + +var msg26170 = msg("24006", dup201); + +var msg26171 = msg("24007", dup197); + +var msg26172 = msg("24008", dup267); + +var msg26173 = msg("24009", dup263); + +var msg26174 = msg("24010", dup192); + +var msg26175 = msg("24011", dup192); + +var msg26176 = msg("24012", dup192); + +var msg26177 = msg("24013", dup192); + +var msg26178 = msg("24014", dup192); + +var msg26179 = msg("24015", dup192); + +var msg26180 = msg("24016", dup192); + +var msg26181 = msg("24017", dup269); + +var msg26182 = msg("24018", dup269); + +var msg26183 = msg("24019", dup269); + +var msg26184 = msg("24020", dup267); + +var msg26185 = msg("24021", dup267); + +var msg26186 = msg("24022", dup267); + +var msg26187 = msg("24023", dup267); + +var msg26188 = msg("24024", dup267); + +var msg26189 = msg("24025", dup267); + +var msg26190 = msg("24026", dup267); + +var msg26191 = msg("24027", dup267); + +var msg26192 = msg("24028", dup267); + +var msg26193 = msg("24029", dup197); + +var msg26194 = msg("24030", dup197); + +var msg26195 = msg("24031", dup263); + +var msg26196 = msg("24032", dup263); + +var msg26197 = msg("24033", dup263); + +var msg26198 = msg("24034", dup263); + +var msg26199 = msg("24035", dup202); + +var msg26200 = msg("24036", dup267); + +var msg26201 = msg("24037", dup267); + +var msg26202 = msg("24038", dup267); + +var msg26203 = msg("24039", dup265); + +var msg26204 = msg("24040", dup265); + +var msg26205 = msg("24041", dup265); + +var msg26206 = msg("24042", dup265); + +var msg26207 = msg("24043", dup265); + +var msg26208 = msg("24044", dup265); + +var msg26209 = msg("24045", dup202); + +var msg26210 = msg("24046", dup202); + +var msg26211 = msg("24047", dup202); + +var msg26212 = msg("24048", dup202); + +var msg26213 = msg("24049", dup202); + +var msg26214 = msg("24050", dup202); + +var msg26215 = msg("24051", dup267); + +var msg26216 = msg("24052", dup267); + +var msg26217 = msg("24053", dup202); + +var msg26218 = msg("24054", dup202); + +var msg26219 = msg("24055", dup267); + +var msg26220 = msg("24056", dup267); + +var msg26221 = msg("24057", dup267); + +var msg26222 = msg("24058", dup267); + +var msg26223 = msg("24059", dup197); + +var msg26224 = msg("24060", dup197); + +var msg26225 = msg("24061", dup197); + +var msg26226 = msg("24062", dup192); + +var msg26227 = msg("24063", dup267); + +var msg26228 = msg("24064", dup267); + +var msg26229 = msg("24065", dup267); + +var msg26230 = msg("24066", dup267); + +var msg26231 = msg("24067", dup269); + +var msg26232 = msg("24068", dup269); + +var msg26233 = msg("24069", dup269); + +var msg26234 = msg("24070", dup269); + +var msg26235 = msg("24071", dup287); + +var msg26236 = msg("24072", dup287); + +var msg26237 = msg("24073", dup287); + +var msg26238 = msg("24074", dup202); + +var msg26239 = msg("24075", dup202); + +var msg26240 = msg("24076", dup202); + +var msg26241 = msg("24077", dup263); + +var msg26242 = msg("24078", dup202); + +var msg26243 = msg("24079", dup202); + +var msg26244 = msg("24080", dup202); + +var msg26245 = msg("24081", dup202); + +var msg26246 = msg("24082", dup263); + +var msg26247 = msg("24083", dup201); + +var msg26248 = msg("24084", dup267); + +var msg26249 = msg("24085", dup267); + +var msg26250 = msg("24086", dup263); + +var msg26251 = msg("24087", dup287); + +var msg26252 = msg("24088", dup230); + +var msg26253 = msg("24089", dup265); + +var msg26254 = msg("24090", dup267); + +var msg26255 = msg("24091", dup199); + +var msg26256 = msg("24092", dup263); + +var msg26257 = msg("24093", dup265); + +var msg26258 = msg("24094", dup202); + +var msg26259 = msg("24095", dup202); + +var msg26260 = msg("24096", dup202); + +var msg26261 = msg("24097", dup202); + +var msg26262 = msg("24098", dup202); + +var msg26263 = msg("24099", dup263); + +var msg26264 = msg("24100", dup202); + +var msg26265 = msg("24101", dup202); + +var msg26266 = msg("24102", dup263); + +var msg26267 = msg("24103", dup265); + +var msg26268 = msg("24104", dup265); + +var msg26269 = msg("24105", dup265); + +var msg26270 = msg("24106", dup265); + +var msg26271 = msg("24107", dup265); + +var msg26272 = msg("24108", dup265); + +var msg26273 = msg("24109", dup265); + +var msg26274 = msg("24110", dup265); + +var msg26275 = msg("24111", dup269); + +var msg26276 = msg("24112", dup260); + +var msg26277 = msg("24113", dup265); + +var msg26278 = msg("24114", dup199); + +var msg26279 = msg("24115", dup263); + +var msg26280 = msg("24116", dup263); + +var msg26281 = msg("24117", dup263); + +var msg26282 = msg("24118", dup263); + +var msg26283 = msg("24119", dup263); + +var msg26284 = msg("24120", dup263); + +var msg26285 = msg("24121", dup263); + +var msg26286 = msg("24122", dup263); + +var msg26287 = msg("24123", dup263); + +var msg26288 = msg("24124", dup267); + +var msg26289 = msg("24125", dup267); + +var msg26290 = msg("24126", dup267); + +var msg26291 = msg("24127", dup192); + +var msg26292 = msg("24128", dup265); + +var msg26293 = msg("24129", dup197); + +var msg26294 = msg("24130", dup197); + +var msg26295 = msg("24131", dup267); + +var msg26296 = msg("24132", dup267); + +var msg26297 = msg("24133", dup267); + +var msg26298 = msg("24134", dup267); + +var msg26299 = msg("24135", dup267); + +var msg26300 = msg("24136", dup267); + +var msg26301 = msg("24137", dup267); + +var msg26302 = msg("24138", dup202); + +var msg26303 = msg("24139", dup202); + +var msg26304 = msg("24140", dup202); + +var msg26305 = msg("24141", dup202); + +var msg26306 = msg("24142", dup202); + +var msg26307 = msg("24143", dup263); + +var msg26308 = msg("24144", dup263); + +var msg26309 = msg("24145", dup263); + +var msg26310 = msg("24146", dup263); + +var msg26311 = msg("24147", dup201); + +var msg26312 = msg("24148", dup269); + +var msg26313 = msg("24149", dup269); + +var msg26314 = msg("24150", dup202); + +var msg26315 = msg("24151", dup202); + +var msg26316 = msg("24152", dup267); + +var msg26317 = msg("24153", dup267); + +var msg26318 = msg("24154", dup198); + +var msg26319 = msg("24155", dup198); + +var msg26320 = msg("24156", dup202); + +var msg26321 = msg("24157", dup202); + +var msg26322 = msg("24158", dup202); + +var msg26323 = msg("24159", dup197); + +var msg26324 = msg("24160", dup197); + +var msg26325 = msg("24161", dup197); + +var msg26326 = msg("24162", dup197); + +var msg26327 = msg("24163", dup197); + +var msg26328 = msg("24164", dup197); + +var msg26329 = msg("24165", dup197); + +var msg26330 = msg("24166", dup197); + +var msg26331 = msg("24167", dup202); + +var msg26332 = msg("24168", dup269); + +var msg26333 = msg("24169", dup263); + +var msg26334 = msg("24170", dup267); + +var msg26335 = msg("24171", dup267); + +var msg26336 = msg("24172", dup260); + +var msg26337 = msg("24173", dup263); + +var msg26338 = msg("24174", dup263); + +var msg26339 = msg("24175", dup263); + +var msg26340 = msg("24176", dup201); + +var msg26341 = msg("24177", dup201); + +var msg26342 = msg("24178", dup201); + +var msg26343 = msg("24179", dup201); + +var msg26344 = msg("24180", dup201); + +var msg26345 = msg("24181", dup201); + +var msg26346 = msg("24182", dup263); + +var msg26347 = msg("24183", dup263); + +var msg26348 = msg("24184", dup263); + +var msg26349 = msg("24185", dup263); + +var msg26350 = msg("24186", dup197); + +var msg26351 = msg("24187", dup197); + +var msg26352 = msg("24188", dup197); + +var msg26353 = msg("24189", dup197); + +var msg26354 = msg("24190", dup202); + +var msg26355 = msg("24191", dup263); + +var msg26356 = msg("24192", dup197); + +var msg26357 = msg("24193", dup197); + +var msg26358 = msg("24194", dup197); + +var msg26359 = msg("24195", dup197); + +var msg26360 = msg("24196", dup265); + +var msg26361 = msg("24197", dup265); + +var msg26362 = msg("24198", dup197); + +var msg26363 = msg("24199", dup267); + +var msg26364 = msg("24200", dup267); + +var msg26365 = msg("24201", dup267); + +var msg26366 = msg("24202", dup267); + +var msg26367 = msg("24203", dup267); + +var msg26368 = msg("24204", dup267); + +var msg26369 = msg("24205", dup267); + +var msg26370 = msg("24206", dup202); + +var msg26371 = msg("24207", dup197); + +var msg26372 = msg("24208", dup197); + +var msg26373 = msg("24209", dup197); + +var msg26374 = msg("24210", dup267); + +var msg26375 = msg("24211", dup263); + +var msg26376 = msg("24212", dup267); + +var msg26377 = msg("24213", dup202); + +var msg26378 = msg("24214", dup263); + +var msg26379 = msg("24215", dup263); + +var msg26380 = msg("24216", dup263); + +var msg26381 = msg("24217", dup263); + +var msg26382 = msg("24218", dup202); + +var msg26383 = msg("24219", dup202); + +var msg26384 = msg("24220", dup197); + +var msg26385 = msg("24221", dup267); + +var msg26386 = msg("24222", dup267); + +var msg26387 = msg("24223", dup267); + +var msg26388 = msg("24224", dup263); + +var msg26389 = msg("24225", dup269); + +var msg26390 = msg("24226", dup267); + +var msg26391 = msg("24227", dup267); + +var msg26392 = msg("24228", dup267); + +var msg26393 = msg("24229", dup201); + +var msg26394 = msg("24230", dup201); + +var msg26395 = msg("24231", dup267); + +var msg26396 = msg("24232", dup267); + +var msg26397 = msg("24233", dup267); + +var msg26398 = msg("24234", dup267); + +var msg26399 = msg("24235", dup263); + +var msg26400 = msg("24236", dup263); + +var msg26401 = msg("24237", dup197); + +var msg26402 = msg("24238", dup197); + +var msg26403 = msg("24239", dup197); + +var msg26404 = msg("24240", dup197); + +var msg26405 = msg("24241", dup197); + +var msg26406 = msg("24242", dup197); + +var msg26407 = msg("24243", dup269); + +var msg26408 = msg("24244", dup197); + +var msg26409 = msg("24245", dup197); + +var msg26410 = msg("24246", dup265); + +var msg26411 = msg("24247", dup265); + +var msg26412 = msg("24248", dup265); + +var msg26413 = msg("24249", dup265); + +var msg26414 = msg("24250", dup202); + +var msg26415 = msg("24251", dup263); + +var msg26416 = msg("24252", dup267); + +var msg26417 = msg("24253", dup202); + +var msg26418 = msg("24254", dup202); + +var msg26419 = msg("24255", dup263); + +var msg26420 = msg("24256", dup265); + +var msg26421 = msg("24257", dup263); + +var msg26422 = msg("24258", dup263); + +var msg26423 = msg("24259", dup263); + +var msg26424 = msg("24260", dup263); + +var msg26425 = msg("24261", dup263); + +var msg26426 = msg("24262", dup263); + +var msg26427 = msg("24263", dup269); + +var msg26428 = msg("24264", dup269); + +var msg26429 = msg("24265", dup269); + +var msg26430 = msg("24266", dup197); + +var msg26431 = msg("24267", dup197); + +var msg26432 = msg("24268", dup197); + +var msg26433 = msg("24269", dup197); + +var msg26434 = msg("24270", dup287); + +var msg26435 = msg("24271", dup263); + +var msg26436 = msg("24272", dup197); + +var msg26437 = msg("24273", dup197); + +var msg26438 = msg("24274", dup265); + +var msg26439 = msg("24275", dup265); + +var msg26440 = msg("24276", dup265); + +var msg26441 = msg("24277", dup267); + +var msg26442 = msg("24278", dup267); + +var msg26443 = msg("24279", dup267); + +var msg26444 = msg("24280", dup267); + +var msg26445 = msg("24281", dup265); + +var msg26446 = msg("24282", dup265); + +var msg26447 = msg("24283", dup267); + +var msg26448 = msg("24284", dup197); + +var msg26449 = msg("24285", dup263); + +var msg26450 = msg("24286", dup263); + +var msg26451 = msg("24287", dup263); + +var msg26452 = msg("24288", dup263); + +var msg26453 = msg("24289", dup267); + +var msg26454 = msg("24290", dup267); + +var msg26455 = msg("24291", dup265); + +var msg26456 = msg("24292", dup265); + +var msg26457 = msg("24293", dup255); + +var msg26458 = msg("24294", dup197); + +var all54 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg26459 = msg("24295", all54); + +var msg26460 = msg("24296", dup232); + +var msg26461 = msg("24297", dup232); + +var msg26462 = msg("24298", dup232); + +var msg26463 = msg("24299", dup232); + +var msg26464 = msg("24300", dup197); + +var msg26465 = msg("24301", dup232); + +var msg26466 = msg("24302", dup232); + +var msg26467 = msg("24303", dup232); + +var msg26468 = msg("24304", dup313); + +var msg26469 = msg("24305", dup232); + +var msg26470 = msg("24306", dup265); + +var msg26471 = msg("24307", dup263); + +var msg26472 = msg("24308", dup263); + +var msg26473 = msg("24309", dup263); + +var msg26474 = msg("24310", dup263); + +var msg26475 = msg("24311", dup263); + +var msg26476 = msg("24312", dup263); + +var msg26477 = msg("24313", dup265); + +var msg26478 = msg("24314", dup197); + +var msg26479 = msg("24315", dup197); + +var msg26480 = msg("24316", dup197); + +var msg26481 = msg("24317", dup197); + +var msg26482 = msg("24318", dup197); + +var msg26483 = msg("24319", dup197); + +var msg26484 = msg("24320", dup197); + +var msg26485 = msg("24321", dup197); + +var msg26486 = msg("24322", dup265); + +var msg26487 = msg("24323", dup265); + +var msg26488 = msg("24324", dup197); + +var msg26489 = msg("24325", dup197); + +var msg26490 = msg("24326", dup197); + +var msg26491 = msg("24327", dup197); + +var msg26492 = msg("24328", dup197); + +var msg26493 = msg("24329", dup197); + +var msg26494 = msg("24330", dup197); + +var msg26495 = msg("24331", dup197); + +var msg26496 = msg("24332", dup197); + +var msg26497 = msg("24333", dup197); + +var msg26498 = msg("24334", dup269); + +var msg26499 = msg("24335", dup197); + +var msg26500 = msg("24336", dup197); + +var msg26501 = msg("24337", dup198); + +var msg26502 = msg("24338", dup197); + +var msg26503 = msg("24339", dup255); + +var msg26504 = msg("24340", dup263); + +var msg26505 = msg("24341", dup263); + +var msg26506 = msg("24342", dup265); + +var msg26507 = msg("24343", dup265); + +var msg26508 = msg("24344", dup267); + +var msg26509 = msg("24345", dup263); + +var msg26510 = msg("24346", dup263); + +var msg26511 = msg("24347", dup263); + +var msg26512 = msg("24348", dup265); + +var msg26513 = msg("24349", dup263); + +var msg26514 = msg("24350", dup263); + +var msg26515 = msg("24351", dup197); + +var msg26516 = msg("24352", dup197); + +var msg26517 = msg("24353", dup197); + +var msg26518 = msg("24354", dup197); + +var msg26519 = msg("24355", dup267); + +var msg26520 = msg("24356", dup267); + +var msg26521 = msg("24357", dup197); + +var msg26522 = msg("24358", dup197); + +var msg26523 = msg("24359", dup276); + +var msg26524 = msg("24360", dup276); + +var msg26525 = msg("24361", dup263); + +var msg26526 = msg("24362", dup202); + +var msg26527 = msg("24363", dup202); + +var msg26528 = msg("24364", dup202); + +var msg26529 = msg("24365", dup202); + +var msg26530 = msg("24366", dup319); + +var msg26531 = msg("24367", dup319); + +var msg26532 = msg("24368", dup260); + +var msg26533 = msg("24369", dup260); + +var msg26534 = msg("24370", dup197); + +var msg26535 = msg("24371", dup197); + +var msg26536 = msg("24372", dup198); + +var msg26537 = msg("24373", dup263); + +var msg26538 = msg("24374", dup263); + +var msg26539 = msg("24375", dup263); + +var msg26540 = msg("24376", dup263); + +var msg26541 = msg("24377", dup263); + +var msg26542 = msg("24378", dup287); + +var msg26543 = msg("24379", dup197); + +var msg26544 = msg("24380", dup197); + +var msg26545 = msg("24381", dup263); + +var msg26546 = msg("24382", dup263); + +var msg26547 = msg("24383", dup263); + +var msg26548 = msg("24384", dup263); + +var msg26549 = msg("24385", dup263); + +var msg26550 = msg("24386", dup287); + +var msg26551 = msg("24387", dup287); + +var msg26552 = msg("24388", dup202); + +var msg26553 = msg("24389", dup202); + +var msg26554 = msg("24390", dup202); + +var msg26555 = msg("24391", dup202); + +var msg26556 = msg("24392", dup202); + +var msg26557 = msg("24393", dup267); + +var msg26558 = msg("24394", dup267); + +var msg26559 = msg("24395", dup197); + +var msg26560 = msg("24396", dup197); + +var msg26561 = msg("24397", dup202); + +var msg26562 = msg("24398", dup263); + +var msg26563 = msg("24399", dup263); + +var msg26564 = msg("24400", dup263); + +var msg26565 = msg("24401", dup197); + +var msg26566 = msg("24402", dup263); + +var msg26567 = msg("24403", dup263); + +var msg26568 = msg("24404", dup263); + +var msg26569 = msg("24405", dup263); + +var msg26570 = msg("24406", dup263); + +var msg26571 = msg("24407", dup263); + +var msg26572 = msg("24408", dup263); + +var msg26573 = msg("24409", dup263); + +var msg26574 = msg("24410", dup263); + +var msg26575 = msg("24411", dup263); + +var msg26576 = msg("24412", dup202); + +var msg26577 = msg("24413", dup202); + +var msg26578 = msg("24414", dup197); + +var msg26579 = msg("24415", dup197); + +var msg26580 = msg("24416", dup263); + +var msg26581 = msg("24417", dup263); + +var msg26582 = msg("24418", dup263); + +var msg26583 = msg("24419", dup263); + +var msg26584 = msg("24420", dup263); + +var msg26585 = msg("24421", dup260); + +var msg26586 = msg("24422", dup260); + +var msg26587 = msg("24423", dup240); + +var msg26588 = msg("24424", dup240); + +var msg26589 = msg("24425", dup199); + +var msg26590 = msg("24426", dup263); + +var msg26591 = msg("24427", dup263); + +var msg26592 = msg("24428", dup201); + +var msg26593 = msg("24429", dup201); + +var msg26594 = msg("24430", dup201); + +var msg26595 = msg("24431", dup201); + +var msg26596 = msg("24432", dup202); + +var msg26597 = msg("24433", dup202); + +var msg26598 = msg("24434", dup202); + +var msg26599 = msg("24435", dup265); + +var msg26600 = msg("24436", dup265); + +var msg26601 = msg("24437", dup263); + +var msg26602 = msg("24438", dup263); + +var msg26603 = msg("24439", dup269); + +var msg26604 = msg("24440", dup287); + +var msg26605 = msg("24441", dup269); + +var msg26606 = msg("24442", dup269); + +var msg26607 = msg("24443", dup263); + +var msg26608 = msg("24444", dup263); + +var msg26609 = msg("24445", dup263); + +var msg26610 = msg("24446", dup255); + +var msg26611 = msg("24447", dup202); + +var msg26612 = msg("24448", dup202); + +var msg26613 = msg("24449", dup267); + +var msg26614 = msg("24450", dup263); + +var msg26615 = msg("24451", dup263); + +var msg26616 = msg("24452", dup197); + +var msg26617 = msg("24453", dup202); + +var msg26618 = msg("24454", dup202); + +var msg26619 = msg("24455", dup202); + +var msg26620 = msg("24456", dup202); + +var msg26621 = msg("24457", dup202); + +var msg26622 = msg("24458", dup202); + +var msg26623 = msg("24459", dup202); + +var msg26624 = msg("24460", dup202); + +var msg26625 = msg("24461", dup202); + +var msg26626 = msg("24462", dup202); + +var msg26627 = msg("24463", dup202); + +var msg26628 = msg("24464", dup202); + +var msg26629 = msg("24465", dup202); + +var msg26630 = msg("24466", dup202); + +var msg26631 = msg("24467", dup202); + +var msg26632 = msg("24468", dup202); + +var msg26633 = msg("24469", dup202); + +var msg26634 = msg("24470", dup202); + +var msg26635 = msg("24471", dup202); + +var msg26636 = msg("24472", dup202); + +var msg26637 = msg("24473", dup202); + +var msg26638 = msg("24474", dup202); + +var msg26639 = msg("24475", dup267); + +var msg26640 = msg("24476", dup197); + +var msg26641 = msg("24477", dup197); + +var msg26642 = msg("24478", dup197); + +var msg26643 = msg("24479", dup197); + +var msg26644 = msg("24480", dup197); + +var msg26645 = msg("24481", dup197); + +var msg26646 = msg("24482", dup263); + +var msg26647 = msg("24483", dup202); + +var msg26648 = msg("24484", dup202); + +var msg26649 = msg("24485", dup197); + +var msg26650 = msg("24486", dup197); + +var msg26651 = msg("24487", dup197); + +var msg26652 = msg("24488", dup267); + +var msg26653 = msg("24489", dup267); + +var msg26654 = msg("24490", dup267); + +var msg26655 = msg("24491", dup321); + +var msg26656 = msg("24492", dup321); + +var msg26657 = msg("24493", dup321); + +var msg26658 = msg("24494", dup321); + +var msg26659 = msg("24495", dup321); + +var msg26660 = msg("24496", dup321); + +var msg26661 = msg("24497", dup321); + +var msg26662 = msg("24498", dup311); + +var msg26663 = msg("24499", dup311); + +var msg26664 = msg("24500", dup314); + +var msg26665 = msg("24501", dup311); + +var msg26666 = msg("24502", dup311); + +var msg26667 = msg("24503", dup308); + +var msg26668 = msg("24504", dup321); + +var msg26669 = msg("24505", dup321); + +var msg26670 = msg("24506", dup314); + +var msg26671 = msg("24507", dup309); + +var msg26672 = msg("24508", dup309); + +var msg26673 = msg("24509", dup314); + +var msg26674 = msg("24510", dup311); + +var msg26675 = msg("24511", dup311); + +var msg26676 = msg("24512", dup309); + +var msg26677 = msg("24513", dup309); + +var msg26678 = msg("24514", dup321); + +var msg26679 = msg("24515", dup321); + +var msg26680 = msg("24516", dup321); + +var msg26681 = msg("24517", dup322); + +var msg26682 = msg("24518", dup311); + +var msg26683 = msg("24519", dup311); + +var msg26684 = msg("24520", dup323); + +var msg26685 = msg("24521", dup314); + +var msg26686 = msg("24522", dup308); + +var msg26687 = msg("24523", dup321); + +var msg26688 = msg("24524", dup324); + +var msg26689 = msg("24525", dup311); + +var msg26690 = msg("24526", dup311); + +var msg26691 = msg("24527", dup311); + +var msg26692 = msg("24528", dup311); + +var msg26693 = msg("24529", dup321); + +var msg26694 = msg("24530", dup321); + +var msg26695 = msg("24531", dup321); + +var msg26696 = msg("24532", dup321); + +var msg26697 = msg("24533", dup321); + +var msg26698 = msg("24534", dup321); + +var msg26699 = msg("24535", dup309); + +var msg26700 = msg("24536", dup309); + +var msg26701 = msg("24537", dup309); + +var msg26702 = msg("24538", dup309); + +var msg26703 = msg("24539", dup321); + +var msg26704 = msg("24540", dup321); + +var msg26705 = msg("24541", dup321); + +var msg26706 = msg("24542", dup321); + +var msg26707 = msg("24543", dup311); + +var msg26708 = msg("24544", dup311); + +var msg26709 = msg("24545", dup321); + +var msg26710 = msg("24546", dup311); + +var msg26711 = msg("24547", dup311); + +var msg26712 = msg("24548", dup311); + +var msg26713 = msg("24549", dup309); + +var msg26714 = msg("24550", dup309); + +var msg26715 = msg("24551", dup309); + +var msg26716 = msg("24552", dup309); + +var msg26717 = msg("24553", dup309); + +var msg26718 = msg("24554", dup314); + +var msg26719 = msg("24555", dup314); + +var msg26720 = msg("24556", dup309); + +var msg26721 = msg("24557", dup309); + +var msg26722 = msg("24558", dup309); + +var msg26723 = msg("24559", dup314); + +var msg26724 = msg("24560", dup314); + +var msg26725 = msg("24561", dup311); + +var msg26726 = msg("24562", dup321); + +var msg26727 = msg("24563", dup321); + +var msg26728 = msg("24564", dup321); + +var msg26729 = msg("24565", dup321); + +var msg26730 = msg("24566", dup321); + +var msg26731 = msg("24567", dup321); + +var msg26732 = msg("24568", dup325); + +var msg26733 = msg("24569", dup321); + +var msg26734 = msg("24570", dup314); + +var msg26735 = msg("24571", dup314); + +var msg26736 = msg("24572", dup314); + +var msg26737 = msg("24573", dup314); + +var msg26738 = msg("24574", dup314); + +var msg26739 = msg("24575", dup325); + +var msg26740 = msg("24576", dup321); + +var msg26741 = msg("24577", dup325); + +var msg26742 = msg("24578", dup314); + +var msg26743 = msg("24579", dup314); + +var msg26744 = msg("24580", dup314); + +var msg26745 = msg("24581", dup314); + +var msg26746 = msg("24582", dup314); + +var msg26747 = msg("24583", dup314); + +var msg26748 = msg("24584", dup314); + +var msg26749 = msg("24585", dup314); + +var msg26750 = msg("24586", dup321); + +var msg26751 = msg("24587", dup309); + +var msg26752 = msg("24588", dup309); + +var msg26753 = msg("24589", dup311); + +var msg26754 = msg("24590", dup311); + +var msg26755 = msg("24591", dup311); + +var msg26756 = msg("24592", dup311); + +var msg26757 = msg("24593", dup311); + +var msg26758 = msg("24594", dup321); + +var msg26759 = msg("24595", dup311); + +var msg26760 = msg("24596", dup311); + +var msg26761 = msg("24597", dup311); + +var msg26762 = msg("24598", dup326); + +var msg26763 = msg("24599", dup314); + +var msg26764 = msg("24600", dup311); + +var msg26765 = msg("24601", dup311); + +var msg26766 = msg("24602", dup311); + +var msg26767 = msg("24603", dup311); + +var msg26768 = msg("24604", dup311); + +var msg26769 = msg("24605", dup311); + +var msg26770 = msg("24606", dup311); + +var msg26771 = msg("24607", dup311); + +var msg26772 = msg("24608", dup311); + +var msg26773 = msg("24609", dup311); + +var msg26774 = msg("24610", dup311); + +var msg26775 = msg("24611", dup311); + +var msg26776 = msg("24612", dup311); + +var msg26777 = msg("24613", dup311); + +var msg26778 = msg("24614", dup311); + +var msg26779 = msg("24615", dup311); + +var msg26780 = msg("24616", dup311); + +var msg26781 = msg("24617", dup311); + +var msg26782 = msg("24618", dup311); + +var msg26783 = msg("24619", dup311); + +var msg26784 = msg("24620", dup311); + +var msg26785 = msg("24621", dup311); + +var msg26786 = msg("24622", dup311); + +var msg26787 = msg("24623", dup325); + +var msg26788 = msg("24624", dup321); + +var msg26789 = msg("24625", dup309); + +var msg26790 = msg("24626", dup309); + +var msg26791 = msg("24627", dup324); + +var msg26792 = msg("24628", dup316); + +var msg26793 = msg("24629", dup322); + +var msg26794 = msg("24630", dup321); + +var msg26795 = msg("24631", dup325); + +var msg26796 = msg("24632", dup325); + +var msg26797 = msg("24633", dup325); + +var msg26798 = msg("24634", dup325); + +var msg26799 = msg("24635", dup321); + +var msg26800 = msg("24636", dup311); + +var msg26801 = msg("24637", dup311); + +var msg26802 = msg("24638", dup311); + +var msg26803 = msg("24639", dup308); + +var msg26804 = msg("24640", dup309); + +var msg26805 = msg("24641", dup309); + +var msg26806 = msg("24642", dup311); + +var msg26807 = msg("24643", dup314); + +var msg26808 = msg("24644", dup314); + +var msg26809 = msg("24645", dup314); + +var msg26810 = msg("24646", dup314); + +var msg26811 = msg("24647", dup309); + +var msg26812 = msg("24648", dup311); + +var msg26813 = msg("24649", dup309); + +var msg26814 = msg("24650", dup309); + +var msg26815 = msg("24651", dup323); + +var msg26816 = msg("24652", dup311); + +var msg26817 = msg("24653", dup325); + +var msg26818 = msg("24654", dup325); + +var msg26819 = msg("24655", dup311); + +var msg26820 = msg("24656", dup311); + +var msg26821 = msg("24657", dup309); + +var msg26822 = msg("24658", dup309); + +var msg26823 = msg("24659", dup309); + +var msg26824 = msg("24660", dup325); + +var msg26825 = msg("24661", dup325); + +var msg26826 = msg("24662", dup311); + +var msg26827 = msg("24663", dup311); + +var msg26828 = msg("24664", dup311); + +var msg26829 = msg("24665", dup311); + +var msg26830 = msg("24666", dup309); + +var msg26831 = msg("24667", dup311); + +var msg26832 = msg("24668", dup311); + +var msg26833 = msg("24669", dup311); + +var msg26834 = msg("24670", dup311); + +var msg26835 = msg("24671", dup311); + +var msg26836 = msg("24672", dup309); + +var msg26837 = msg("24673", dup309); + +var msg26838 = msg("24674", dup309); + +var msg26839 = msg("24675", dup307); + +var msg26840 = msg("24676", dup307); + +var msg26841 = msg("24677", dup324); + +var msg26842 = msg("24678", dup309); + +var msg26843 = msg("24679", dup309); + +var msg26844 = msg("24680", dup309); + +var msg26845 = msg("24681", dup309); + +var msg26846 = msg("24682", dup309); + +var msg26847 = msg("24683", dup309); + +var msg26848 = msg("24684", dup309); + +var msg26849 = msg("24685", dup309); + +var msg26850 = msg("24686", dup309); + +var msg26851 = msg("24687", dup311); + +var msg26852 = msg("24688", dup311); + +var msg26853 = msg("24689", dup314); + +var msg26854 = msg("24690", dup314); + +var msg26855 = msg("24691", dup314); + +var msg26856 = msg("24692", dup314); + +var msg26857 = msg("24693", dup309); + +var msg26858 = msg("24694", dup311); + +var msg26859 = msg("24695", dup311); + +var msg26860 = msg("24696", dup308); + +var msg26861 = msg("24697", dup324); + +var msg26862 = msg("24698", dup324); + +var msg26863 = msg("24699", dup307); + +var msg26864 = msg("24700", dup307); + +var msg26865 = msg("24701", dup309); + +var msg26866 = msg("24702", dup324); + +var msg26867 = msg("24703", dup324); + +var msg26868 = msg("24704", dup322); + +var msg26869 = msg("24705", dup322); + +var msg26870 = msg("24706", dup309); + +var msg26871 = msg("24707", dup309); + +var msg26872 = msg("24708", dup314); + +var msg26873 = msg("24709", dup314); + +var msg26874 = msg("24710", dup314); + +var msg26875 = msg("24711", dup309); + +var msg26876 = msg("24712", dup309); + +var msg26877 = msg("24713", dup309); + +var msg26878 = msg("24714", dup309); + +var msg26879 = msg("24715", dup309); + +var msg26880 = msg("24716", dup309); + +var msg26881 = msg("24717", dup309); + +var msg26882 = msg("24718", dup309); + +var msg26883 = msg("24719", dup314); + +var msg26884 = msg("24720", dup323); + +var msg26885 = msg("24721", dup314); + +var msg26886 = msg("24722", dup314); + +var msg26887 = msg("24723", dup314); + +var msg26888 = msg("24724", dup314); + +var msg26889 = msg("24725", dup314); + +var msg26890 = msg("24726", dup314); + +var msg26891 = msg("24727", dup311); + +var msg26892 = msg("24728", dup311); + +var msg26893 = msg("24729", dup311); + +var msg26894 = msg("24730", dup311); + +var msg26895 = msg("24731", dup311); + +var msg26896 = msg("24732", dup311); + +var msg26897 = msg("24733", dup311); + +var msg26898 = msg("24734", dup311); + +var msg26899 = msg("24735", dup311); + +var msg26900 = msg("24736", dup311); + +var msg26901 = msg("24737", dup311); + +var msg26902 = msg("24738", dup309); + +var msg26903 = msg("24739", dup307); + +var msg26904 = msg("24740", dup327); + +var msg26905 = msg("24741", dup307); + +var msg26906 = msg("24742", dup307); + +var msg26907 = msg("24743", dup307); + +var msg26908 = msg("24744", dup307); + +var msg26909 = msg("24745", dup307); + +var msg26910 = msg("24746", dup307); + +var msg26911 = msg("24747", dup307); + +var msg26912 = msg("24748", dup307); + +var msg26913 = msg("24749", dup307); + +var msg26914 = msg("24750", dup307); + +var msg26915 = msg("24751", dup307); + +var msg26916 = msg("24752", dup307); + +var msg26917 = msg("24753", dup307); + +var msg26918 = msg("24754", dup307); + +var msg26919 = msg("24755", dup307); + +var msg26920 = msg("24756", dup307); + +var msg26921 = msg("24757", dup307); + +var msg26922 = msg("24758", dup307); + +var msg26923 = msg("24759", dup307); + +var msg26924 = msg("24760", dup307); + +var msg26925 = msg("24761", dup324); + +var msg26926 = msg("24762", dup324); + +var msg26927 = msg("24763", dup309); + +var msg26928 = msg("24764", dup309); + +var msg26929 = msg("24765", dup309); + +var msg26930 = msg("24766", dup314); + +var msg26931 = msg("24767", dup314); + +var msg26932 = msg("24768", dup309); + +var msg26933 = msg("24769", dup311); + +var msg26934 = msg("24770", dup311); + +var msg26935 = msg("24771", dup309); + +var msg26936 = msg("24772", dup309); + +var msg26937 = msg("24773", dup309); + +var msg26938 = msg("24774", dup323); + +var msg26939 = msg("24775", dup323); + +var msg26940 = msg("24776", dup323); + +var msg26941 = msg("24777", dup323); + +var msg26942 = msg("24778", dup311); + +var msg26943 = msg("24779", dup311); + +var msg26944 = msg("24780", dup311); + +var msg26945 = msg("24781", dup311); + +var msg26946 = msg("24782", dup311); + +var msg26947 = msg("24783", dup311); + +var msg26948 = msg("24784", dup311); + +var msg26949 = msg("24785", dup311); + +var msg26950 = msg("24786", dup311); + +var msg26951 = msg("24787", dup311); + +var msg26952 = msg("24788", dup311); + +var msg26953 = msg("24789", dup311); + +var msg26954 = msg("24790", dup311); + +var msg26955 = msg("24791", dup311); + +var msg26956 = msg("24792", dup325); + +var msg26957 = msg("24793", dup311); + +var msg26958 = msg("24794", dup311); + +var msg26959 = msg("24795", dup311); + +var msg26960 = msg("24796", dup311); + +var msg26961 = msg("24797", dup311); + +var msg26962 = msg("24798", dup311); + +var msg26963 = msg("24799", dup311); + +var msg26964 = msg("24800", dup311); + +var msg26965 = msg("24801", dup322); + +var msg26966 = msg("24802", dup309); + +var msg26967 = msg("24803", dup314); + +var msg26968 = msg("24804", dup307); + +var msg26969 = msg("24805", dup310); + +var msg26970 = msg("24806", dup314); + +var msg26971 = msg("24807", dup314); + +var msg26972 = msg("24808", dup325); + +var msg26973 = msg("24809", dup325); + +var msg26974 = msg("24810", dup314); + +var msg26975 = msg("24811", dup314); + +var msg26976 = msg("24812", dup314); + +var msg26977 = msg("24813", dup314); + +var msg26978 = msg("24814", dup315); + +var msg26979 = msg("24815", dup309); + +var msg26980 = msg("24816", dup314); + +var msg26981 = msg("24817", dup314); + +var msg26982 = msg("24818", dup314); + +var msg26983 = msg("24819", dup314); + +var msg26984 = msg("24820", dup314); + +var msg26985 = msg("24821", dup314); + +var msg26986 = msg("24822", dup314); + +var msg26987 = msg("24823", dup309); + +var msg26988 = msg("24824", dup314); + +var msg26989 = msg("24825", dup314); + +var msg26990 = msg("24826", dup314); + +var msg26991 = msg("24827", dup309); + +var msg26992 = msg("24828", dup309); + +var msg26993 = msg("24829", dup309); + +var msg26994 = msg("24830", dup309); + +var msg26995 = msg("24831", dup309); + +var msg26996 = msg("24832", dup309); + +var msg26997 = msg("24833", dup309); + +var msg26998 = msg("24834", dup309); + +var msg26999 = msg("24835", dup309); + +var msg27000 = msg("24836", dup309); + +var msg27001 = msg("24837", dup311); + +var msg27002 = msg("24838", dup311); + +var msg27003 = msg("24839", dup311); + +var msg27004 = msg("24840", dup311); + +var msg27005 = msg("24841", dup311); + +var msg27006 = msg("24842", dup321); + +var msg27007 = msg("24843", dup321); + +var msg27008 = msg("24844", dup321); + +var msg27009 = msg("24845", dup321); + +var msg27010 = msg("24846", dup321); + +var msg27011 = msg("24847", dup321); + +var msg27012 = msg("24848", dup321); + +var msg27013 = msg("24849", dup321); + +var msg27014 = msg("24850", dup321); + +var msg27015 = msg("24851", dup321); + +var msg27016 = msg("24852", dup321); + +var msg27017 = msg("24853", dup321); + +var msg27018 = msg("24854", dup321); + +var msg27019 = msg("24855", dup321); + +var msg27020 = msg("24856", dup321); + +var msg27021 = msg("24857", dup321); + +var msg27022 = msg("24858", dup321); + +var msg27023 = msg("24859", dup321); + +var msg27024 = msg("24860", dup311); + +var msg27025 = msg("24861", dup311); + +var msg27026 = msg("24862", dup311); + +var msg27027 = msg("24863", dup311); + +var msg27028 = msg("24864", dup311); + +var msg27029 = msg("24865", dup311); + +var msg27030 = msg("24866", dup314); + +var msg27031 = msg("24867", dup314); + +var msg27032 = msg("24868", dup309); + +var msg27033 = msg("24869", dup311); + +var msg27034 = msg("24870", dup311); + +var msg27035 = msg("24871", dup311); + +var msg27036 = msg("24872", dup311); + +var msg27037 = msg("24873", dup321); + +var msg27038 = msg("24874", dup307); + +var msg27039 = msg("24875", dup307); + +var msg27040 = msg("24876", dup307); + +var msg27041 = msg("24877", dup307); + +var msg27042 = msg("24878", dup314); + +var msg27043 = msg("24879", dup314); + +var msg27044 = msg("24880", dup314); + +var msg27045 = msg("24881", dup314); + +var msg27046 = msg("24882", dup314); + +var msg27047 = msg("24883", dup311); + +var msg27048 = msg("24884", dup311); + +var msg27049 = msg("24885", dup321); + +var msg27050 = msg("24886", dup321); + +var msg27051 = msg("24887", dup321); + +var msg27052 = msg("24888", dup311); + +var msg27053 = msg("24889", dup309); + +var msg27054 = msg("24890", dup309); + +var msg27055 = msg("24891", dup309); + +var msg27056 = msg("24892", dup309); + +var msg27057 = msg("24893", dup309); + +var msg27058 = msg("24894", dup309); + +var msg27059 = msg("24895", dup323); + +var msg27060 = msg("24896", dup323); + +var msg27061 = msg("24897", dup322); + +var msg27062 = msg("24898", dup307); + +var msg27063 = msg("24899", dup311); + +var msg27064 = msg("24900", dup311); + +var msg27065 = msg("24901", dup314); + +var msg27066 = msg("24902", dup314); + +var msg27067 = msg("24903", dup314); + +var msg27068 = msg("24904", dup309); + +var msg27069 = msg("24905", dup309); + +var msg27070 = msg("24906", dup309); + +var msg27071 = msg("24907", dup316); + +var msg27072 = msg("24908", dup328); + +var msg27073 = msg("24909", dup328); + +var msg27074 = msg("24910", dup322); + +var msg27075 = msg("24911", dup309); + +var msg27076 = msg("24912", dup309); + +var msg27077 = msg("24913", dup309); + +var msg27078 = msg("24914", dup309); + +var msg27079 = msg("24915", dup309); + +var msg27080 = msg("24916", dup321); + +var msg27081 = msg("24917", dup321); + +var msg27082 = msg("24918", dup321); + +var msg27083 = msg("24955", dup309); + +var msg27084 = msg("24956", dup311); + +var msg27085 = msg("24957", dup314); + +var msg27086 = msg("24958", dup314); + +var msg27087 = msg("24959", dup314); + +var msg27088 = msg("24960", dup314); + +var msg27089 = msg("24961", dup314); + +var msg27090 = msg("24962", dup314); + +var msg27091 = msg("24963", dup314); + +var msg27092 = msg("24964", dup309); + +var msg27093 = msg("24965", dup309); + +var msg27094 = msg("24966", dup309); + +var msg27095 = msg("24967", dup309); + +var msg27096 = msg("24968", dup309); + +var msg27097 = msg("24969", dup309); + +var msg27098 = msg("24970", dup309); + +var msg27099 = msg("24971", dup311); + +var all55 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup95, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg27100 = msg("24972", all55); + +var msg27101 = msg("24973", dup309); + +var msg27102 = msg("24974", dup309); + +var msg27103 = msg("24975", dup309); + +var msg27104 = msg("24976", dup321); + +var msg27105 = msg("24977", dup311); + +var msg27106 = msg("24978", dup311); + +var msg27107 = msg("24979", dup311); + +var msg27108 = msg("24980", dup323); + +var msg27109 = msg("24981", dup323); + +var msg27110 = msg("24982", dup323); + +var msg27111 = msg("24983", dup323); + +var msg27112 = msg("24984", dup314); + +var msg27113 = msg("24985", dup309); + +var msg27114 = msg("24986", dup309); + +var msg27115 = msg("24987", dup323); + +var msg27116 = msg("24988", dup309); + +var msg27117 = msg("24989", dup314); + +var msg27118 = msg("24990", dup314); + +var msg27119 = msg("24991", dup309); + +var msg27120 = msg("24992", dup309); + +var msg27121 = msg("24993", dup311); + +var msg27122 = msg("24994", dup314); + +var msg27123 = msg("24995", dup309); + +var msg27124 = msg("24996", dup309); + +var msg27125 = msg("24997", dup309); + +var msg27126 = msg("24998", dup309); + +var msg27127 = msg("24999", dup309); + +var msg27128 = msg("25000", dup309); + +var msg27129 = msg("25001", dup321); + +var msg27130 = msg("25002", dup321); + +var msg27131 = msg("25003", dup309); + +var msg27132 = msg("25004", dup311); + +var msg27133 = msg("25005", dup311); + +var msg27134 = msg("25006", dup307); + +var msg27135 = msg("25007", dup321); + +var msg27136 = msg("25008", dup311); + +var msg27137 = msg("25009", dup325); + +var msg27138 = msg("25010", dup321); + +var msg27139 = msg("25011", dup321); + +var msg27140 = msg("25012", dup309); + +var msg27141 = msg("25013", dup309); + +var msg27142 = msg("25014", dup323); + +var msg27143 = msg("25015", dup321); + +var msg27144 = msg("25016", dup321); + +var msg27145 = msg("25017", dup311); + +var msg27146 = msg("25018", dup321); + +var msg27147 = msg("25019", dup316); + +var msg27148 = msg("25020", dup316); + +var msg27149 = msg("25021", dup321); + +var msg27150 = msg("25022", dup321); + +var msg27151 = msg("25023", dup321); + +var msg27152 = msg("25024", dup321); + +var msg27153 = msg("25025", dup321); + +var msg27154 = msg("25026", dup321); + +var msg27155 = msg("25027", dup321); + +var msg27156 = msg("25028", dup321); + +var msg27157 = msg("25029", dup321); + +var msg27158 = msg("25030", dup321); + +var msg27159 = msg("25031", dup321); + +var msg27160 = msg("25032", dup314); + +var msg27161 = msg("25033", dup314); + +var msg27162 = msg("25034", dup314); + +var msg27163 = msg("25035", dup314); + +var msg27164 = msg("25036", dup324); + +var msg27165 = msg("25037", dup311); + +var msg27166 = msg("25038", dup311); + +var msg27167 = msg("25039", dup311); + +var msg27168 = msg("25040", dup311); + +var msg27169 = msg("25041", dup311); + +var msg27170 = msg("25042", dup311); + +var msg27171 = msg("25043", dup311); + +var msg27172 = msg("25044", dup311); + +var msg27173 = msg("25045", dup311); + +var msg27174 = msg("25046", dup311); + +var msg27175 = msg("25047", dup311); + +var msg27176 = msg("25048", dup311); + +var msg27177 = msg("25049", dup321); + +var msg27178 = msg("25050", dup321); + +var msg27179 = msg("25051", dup311); + +var msg27180 = msg("25052", dup311); + +var msg27181 = msg("25053", dup311); + +var msg27182 = msg("25054", dup321); + +var msg27183 = msg("25055", dup311); + +var msg27184 = msg("25056", dup311); + +var msg27185 = msg("25057", dup314); + +var msg27186 = msg("25058", dup311); + +var msg27187 = msg("25059", dup309); + +var msg27188 = msg("25060", dup314); + +var msg27189 = msg("25061", dup314); + +var msg27190 = msg("25062", dup314); + +var msg27191 = msg("25063", dup309); + +var msg27192 = msg("25064", dup309); + +var msg27193 = msg("25065", dup309); + +var msg27194 = msg("25066", dup309); + +var msg27195 = msg("25067", dup321); + +var msg27196 = msg("25068", dup321); + +var msg27197 = msg("25069", dup321); + +var msg27198 = msg("25070", dup321); + +var msg27199 = msg("25071", dup321); + +var msg27200 = msg("25072", dup321); + +var msg27201 = msg("25073", dup321); + +var msg27202 = msg("25074", dup321); + +var msg27203 = msg("25075", dup321); + +var msg27204 = msg("25076", dup321); + +var msg27205 = msg("25077", dup321); + +var msg27206 = msg("25078", dup311); + +var msg27207 = msg("25079", dup311); + +var msg27208 = msg("25080", dup329); + +var msg27209 = msg("25081", dup329); + +var msg27210 = msg("25082", dup314); + +var msg27211 = msg("25083", dup314); + +var msg27212 = msg("25084", dup311); + +var msg27213 = msg("25085", dup311); + +var msg27214 = msg("25086", dup311); + +var msg27215 = msg("25087", dup311); + +var msg27216 = msg("25088", dup311); + +var msg27217 = msg("25089", dup311); + +var msg27218 = msg("25090", dup311); + +var msg27219 = msg("25091", dup311); + +var msg27220 = msg("25092", dup311); + +var msg27221 = msg("25093", dup311); + +var msg27222 = msg("25094", dup311); + +var msg27223 = msg("25095", dup311); + +var msg27224 = msg("25096", dup311); + +var msg27225 = msg("25097", dup311); + +var msg27226 = msg("25098", dup321); + +var msg27227 = msg("25099", dup321); + +var msg27228 = msg("25100", dup321); + +var msg27229 = msg("25101", dup309); + +var msg27230 = msg("25102", dup307); + +var msg27231 = msg("25103", dup311); + +var msg27232 = msg("25104", dup314); + +var msg27233 = msg("25105", dup314); + +var msg27234 = msg("25106", dup311); + +var msg27235 = msg("25107", dup321); + +var msg27236 = msg("25108", dup321); + +var msg27237 = msg("25109", dup321); + +var msg27238 = msg("25110", dup321); + +var msg27239 = msg("25111", dup309); + +var msg27240 = msg("25112", dup309); + +var msg27241 = msg("25113", dup309); + +var msg27242 = msg("25114", dup309); + +var msg27243 = msg("25115", dup309); + +var msg27244 = msg("25116", dup309); + +var msg27245 = msg("25117", dup309); + +var msg27246 = msg("25118", dup309); + +var msg27247 = msg("25119", dup325); + +var msg27248 = msg("25120", dup314); + +var msg27249 = msg("25121", dup311); + +var msg27250 = msg("25122", dup311); + +var msg27251 = msg("25123", dup311); + +var msg27252 = msg("25124", dup311); + +var msg27253 = msg("25125", dup325); + +var msg27254 = msg("25126", dup325); + +var msg27255 = msg("25127", dup325); + +var msg27256 = msg("25128", dup325); + +var msg27257 = msg("25129", dup325); + +var msg27258 = msg("25130", dup325); + +var msg27259 = msg("25131", dup325); + +var msg27260 = msg("25132", dup325); + +var msg27261 = msg("25133", dup325); + +var msg27262 = msg("25134", dup325); + +var msg27263 = msg("25135", dup311); + +var msg27264 = msg("25136", dup311); + +var msg27265 = msg("25137", dup311); + +var msg27266 = msg("25138", dup311); + +var msg27267 = msg("25139", dup311); + +var msg27268 = msg("25140", dup311); + +var msg27269 = msg("25141", dup321); + +var msg27270 = msg("25142", dup321); + +var msg27271 = msg("25143", dup321); + +var msg27272 = msg("25144", dup321); + +var msg27273 = msg("25145", dup321); + +var msg27274 = msg("25146", dup321); + +var msg27275 = msg("25147", dup321); + +var msg27276 = msg("25148", dup321); + +var msg27277 = msg("25149", dup321); + +var msg27278 = msg("25150", dup321); + +var msg27279 = msg("25151", dup321); + +var msg27280 = msg("25152", dup321); + +var msg27281 = msg("25153", dup321); + +var msg27282 = msg("25154", dup321); + +var msg27283 = msg("25155", dup321); + +var msg27284 = msg("25156", dup321); + +var msg27285 = msg("25157", dup321); + +var msg27286 = msg("25158", dup321); + +var msg27287 = msg("25159", dup321); + +var msg27288 = msg("25160", dup321); + +var msg27289 = msg("25161", dup321); + +var msg27290 = msg("25162", dup321); + +var msg27291 = msg("25163", dup321); + +var msg27292 = msg("25164", dup321); + +var msg27293 = msg("25165", dup321); + +var msg27294 = msg("25166", dup321); + +var msg27295 = msg("25167", dup321); + +var msg27296 = msg("25168", dup321); + +var msg27297 = msg("25169", dup321); + +var msg27298 = msg("25170", dup321); + +var msg27299 = msg("25171", dup321); + +var msg27300 = msg("25172", dup321); + +var msg27301 = msg("25173", dup321); + +var msg27302 = msg("25174", dup321); + +var msg27303 = msg("25175", dup321); + +var msg27304 = msg("25176", dup321); + +var msg27305 = msg("25177", dup321); + +var msg27306 = msg("25178", dup308); + +var msg27307 = msg("25179", dup321); + +var msg27308 = msg("25180", dup321); + +var msg27309 = msg("25181", dup321); + +var msg27310 = msg("25182", dup321); + +var msg27311 = msg("25183", dup321); + +var msg27312 = msg("25184", dup321); + +var msg27313 = msg("25185", dup321); + +var msg27314 = msg("25186", dup321); + +var msg27315 = msg("25187", dup321); + +var msg27316 = msg("25188", dup321); + +var msg27317 = msg("25189", dup321); + +var msg27318 = msg("25190", dup321); + +var msg27319 = msg("25191", dup321); + +var msg27320 = msg("25192", dup321); + +var msg27321 = msg("25193", dup321); + +var msg27322 = msg("25194", dup321); + +var msg27323 = msg("25195", dup321); + +var msg27324 = msg("25196", dup321); + +var msg27325 = msg("25197", dup321); + +var msg27326 = msg("25198", dup321); + +var msg27327 = msg("25199", dup321); + +var msg27328 = msg("25200", dup321); + +var msg27329 = msg("25201", dup321); + +var msg27330 = msg("25202", dup321); + +var msg27331 = msg("25203", dup321); + +var msg27332 = msg("25204", dup321); + +var msg27333 = msg("25205", dup321); + +var msg27334 = msg("25206", dup321); + +var msg27335 = msg("25207", dup321); + +var msg27336 = msg("25208", dup321); + +var msg27337 = msg("25209", dup321); + +var msg27338 = msg("25210", dup321); + +var msg27339 = msg("25211", dup321); + +var msg27340 = msg("25212", dup321); + +var msg27341 = msg("25213", dup321); + +var msg27342 = msg("25214", dup321); + +var msg27343 = msg("25215", dup321); + +var msg27344 = msg("25216", dup321); + +var msg27345 = msg("25217", dup321); + +var msg27346 = msg("25218", dup321); + +var msg27347 = msg("25219", dup321); + +var msg27348 = msg("25220", dup321); + +var msg27349 = msg("25221", dup321); + +var msg27350 = msg("25222", dup321); + +var msg27351 = msg("25223", dup321); + +var msg27352 = msg("25224", dup321); + +var msg27353 = msg("25225", dup325); + +var msg27354 = msg("25226", dup325); + +var msg27355 = msg("25227", dup314); + +var msg27356 = msg("25228", dup314); + +var msg27357 = msg("25229", dup321); + +var msg27358 = msg("25230", dup321); + +var msg27359 = msg("25231", dup321); + +var msg27360 = msg("25232", dup311); + +var msg27361 = msg("25233", dup311); + +var msg27362 = msg("25234", dup325); + +var msg27363 = msg("25235", dup325); + +var msg27364 = msg("25236", dup311); + +var msg27365 = msg("25237", dup321); + +var msg27366 = msg("25238", dup311); + +var msg27367 = msg("25239", dup321); + +var msg27368 = msg("25240", dup321); + +var msg27369 = msg("25241", dup321); + +var msg27370 = msg("25242", dup321); + +var msg27371 = msg("25243", dup325); + +var msg27372 = msg("25244", dup321); + +var msg27373 = msg("25245", dup325); + +var msg27374 = msg("25246", dup311); + +var msg27375 = msg("25247", dup309); + +var msg27376 = msg("25248", dup309); + +var msg27377 = msg("25249", dup321); + +var msg27378 = msg("25250", dup314); + +var msg27379 = msg("25251", dup314); + +var msg27380 = msg("25252", dup309); + +var msg27381 = msg("25253", dup309); + +var msg27382 = msg("25254", dup314); + +var msg27383 = msg("25255", dup311); + +var msg27384 = msg("25256", dup321); + +var msg27385 = msg("25257", dup321); + +var msg27386 = msg("25258", dup321); + +var msg27387 = msg("25259", dup321); + +var msg27388 = msg("25260", dup325); + +var msg27389 = msg("25261", dup325); + +var msg27390 = msg("25262", dup325); + +var msg27391 = msg("25263", dup314); + +var msg27392 = msg("25264", dup314); + +var msg27393 = msg("25265", dup314); + +var msg27394 = msg("25266", dup311); + +var msg27395 = msg("25267", dup311); + +var msg27396 = msg("25268", dup321); + +var msg27397 = msg("25269", dup321); + +var msg27398 = msg("25270", dup309); + +var msg27399 = msg("25271", dup321); + +var msg27400 = msg("25272", dup311); + +var msg27401 = msg("25273", dup311); + +var msg27402 = msg("25274", dup324); + +var msg27403 = msg("25275", dup311); + +var msg27404 = msg("25276", dup311); + +var msg27405 = msg("25277", dup321); + +var msg27406 = msg("25278", dup321); + +var msg27407 = msg("25279", dup321); + +var msg27408 = msg("25280", dup321); + +var msg27409 = msg("25281", dup321); + +var msg27410 = msg("25282", dup321); + +var msg27411 = msg("25283", dup321); + +var msg27412 = msg("25284", dup321); + +var msg27413 = msg("25285", dup322); + +var msg27414 = msg("25286", dup314); + +var msg27415 = msg("25287", dup311); + +var msg27416 = msg("25288", dup311); + +var msg27417 = msg("25289", dup323); + +var msg27418 = msg("25290", dup323); + +var msg27419 = msg("25291", dup323); + +var msg27420 = msg("25292", dup323); + +var msg27421 = msg("25293", dup307); + +var msg27422 = msg("25294", dup307); + +var msg27423 = msg("25295", dup307); + +var msg27424 = msg("25296", dup307); + +var msg27425 = msg("25297", dup311); + +var msg27426 = msg("25298", dup311); + +var msg27427 = msg("25299", dup314); + +var msg27428 = msg("25300", dup314); + +var msg27429 = msg("25301", dup311); + +var msg27430 = msg("25302", dup311); + +var msg27431 = msg("25303", dup311); + +var msg27432 = msg("25304", dup311); + +var msg27433 = msg("25305", dup314); + +var msg27434 = msg("25306", dup314); + +var msg27435 = msg("25307", dup314); + +var msg27436 = msg("25308", dup314); + +var msg27437 = msg("25309", dup309); + +var msg27438 = msg("25310", dup309); + +var msg27439 = msg("25311", dup309); + +var msg27440 = msg("25312", dup311); + +var msg27441 = msg("25313", dup311); + +var msg27442 = msg("25314", dup324); + +var msg27443 = msg("25315", dup314); + +var msg27444 = msg("25316", dup309); + +var msg27445 = msg("25317", dup314); + +var msg27446 = msg("25318", dup314); + +var msg27447 = msg("25319", dup314); + +var msg27448 = msg("25320", dup311); + +var msg27449 = msg("25321", dup309); + +var msg27450 = msg("25322", dup311); + +var msg27451 = msg("25323", dup311); + +var msg27452 = msg("25324", dup311); + +var msg27453 = msg("25325", dup311); + +var msg27454 = msg("25326", dup311); + +var msg27455 = msg("25327", dup311); + +var msg27456 = msg("25328", dup311); + +var msg27457 = msg("25329", dup311); + +var msg27458 = msg("25330", dup309); + +var msg27459 = msg("25331", dup309); + +var msg27460 = msg("25332", dup309); + +var msg27461 = msg("25333", dup309); + +var msg27462 = msg("25334", dup309); + +var msg27463 = msg("25335", dup309); + +var msg27464 = msg("25336", dup309); + +var msg27465 = msg("25337", dup309); + +var msg27466 = msg("25338", dup309); + +var msg27467 = msg("25339", dup309); + +var msg27468 = msg("25340", dup309); + +var msg27469 = msg("25341", dup311); + +var msg27470 = msg("25342", dup324); + +var msg27471 = msg("25343", dup311); + +var msg27472 = msg("25344", dup311); + +var msg27473 = msg("25345", dup311); + +var msg27474 = msg("25346", dup311); + +var msg27475 = msg("25347", dup311); + +var msg27476 = msg("25348", dup311); + +var msg27477 = msg("25349", dup311); + +var msg27478 = msg("25350", dup311); + +var msg27479 = msg("25351", dup311); + +var msg27480 = msg("25352", dup311); + +var msg27481 = msg("25353", dup309); + +var msg27482 = msg("25354", dup309); + +var msg27483 = msg("25355", dup307); + +var msg27484 = msg("25356", dup309); + +var msg27485 = msg("25357", dup311); + +var msg27486 = msg("25358", dup311); + +var msg27487 = msg("25359", dup311); + +var msg27488 = msg("25360", dup311); + +var msg27489 = msg("25361", dup311); + +var msg27490 = msg("25362", dup311); + +var msg27491 = msg("25363", dup311); + +var msg27492 = msg("25364", dup311); + +var msg27493 = msg("25365", dup311); + +var msg27494 = msg("25366", dup309); + +var msg27495 = msg("25367", dup309); + +var msg27496 = msg("25368", dup321); + +var msg27497 = msg("25369", dup307); + +var msg27498 = msg("25370", dup311); + +var msg27499 = msg("25371", dup321); + +var msg27500 = msg("25372", dup325); + +var msg27501 = msg("25373", dup314); + +var msg27502 = msg("25374", dup314); + +var msg27503 = msg("25375", dup314); + +var msg27504 = msg("25376", dup309); + +var msg27505 = msg("25377", dup309); + +var msg27506 = msg("25378", dup309); + +var msg27507 = msg("25379", dup309); + +var msg27508 = msg("25380", dup309); + +var msg27509 = msg("25381", dup311); + +var msg27510 = msg("25382", dup311); + +var msg27511 = msg("25383", dup311); + +var msg27512 = msg("25384", dup311); + +var msg27513 = msg("25385", dup311); + +var msg27514 = msg("25386", dup311); + +var msg27515 = msg("25387", dup311); + +var msg27516 = msg("25388", dup311); + +var msg27517 = msg("25389", dup311); + +var msg27518 = msg("25390", dup311); + +var msg27519 = msg("25391", dup311); + +var msg27520 = msg("25392", dup307); + +var msg27521 = msg("25393", dup309); + +var msg27522 = msg("25394", dup314); + +var msg27523 = msg("25395", dup314); + +var msg27524 = msg("25396", dup314); + +var msg27525 = msg("25397", dup314); + +var msg27526 = msg("25398", dup314); + +var msg27527 = msg("25399", dup314); + +var msg27528 = msg("25400", dup314); + +var msg27529 = msg("25401", dup321); + +var msg27530 = msg("25402", dup321); + +var msg27531 = msg("25403", dup321); + +var msg27532 = msg("25404", dup321); + +var msg27533 = msg("25405", dup321); + +var msg27534 = msg("25406", dup321); + +var msg27535 = msg("25407", dup321); + +var msg27536 = msg("25408", dup321); + +var msg27537 = msg("25409", dup321); + +var msg27538 = msg("25410", dup321); + +var msg27539 = msg("25411", dup321); + +var msg27540 = msg("25412", dup321); + +var msg27541 = msg("25413", dup321); + +var msg27542 = msg("25414", dup321); + +var msg27543 = msg("25415", dup321); + +var msg27544 = msg("25416", dup321); + +var msg27545 = msg("25417", dup321); + +var msg27546 = msg("25418", dup321); + +var msg27547 = msg("25419", dup321); + +var msg27548 = msg("25420", dup321); + +var msg27549 = msg("25421", dup321); + +var msg27550 = msg("25422", dup321); + +var msg27551 = msg("25423", dup321); + +var msg27552 = msg("25424", dup321); + +var msg27553 = msg("25425", dup321); + +var msg27554 = msg("25426", dup321); + +var msg27555 = msg("25427", dup321); + +var msg27556 = msg("25428", dup321); + +var msg27557 = msg("25429", dup321); + +var msg27558 = msg("25430", dup321); + +var msg27559 = msg("25431", dup321); + +var msg27560 = msg("25432", dup321); + +var msg27561 = msg("25433", dup321); + +var msg27562 = msg("25434", dup321); + +var msg27563 = msg("25435", dup321); + +var msg27564 = msg("25436", dup321); + +var msg27565 = msg("25437", dup321); + +var msg27566 = msg("25438", dup321); + +var msg27567 = msg("25439", dup321); + +var msg27568 = msg("25440", dup321); + +var msg27569 = msg("25441", dup321); + +var msg27570 = msg("25442", dup321); + +var msg27571 = msg("25443", dup321); + +var msg27572 = msg("25444", dup321); + +var msg27573 = msg("25445", dup321); + +var msg27574 = msg("25446", dup321); + +var msg27575 = msg("25447", dup321); + +var msg27576 = msg("25448", dup321); + +var msg27577 = msg("25449", dup323); + +var msg27578 = msg("25450", dup323); + +var msg27579 = msg("25451", dup314); + +var msg27580 = msg("25452", dup314); + +var msg27581 = msg("25453", dup314); + +var msg27582 = msg("25454", dup314); + +var msg27583 = msg("25455", dup314); + +var msg27584 = msg("25456", dup314); + +var msg27585 = msg("25457", dup314); + +var msg27586 = msg("25458", dup314); + +var msg27587 = msg("25459", dup309); + +var msg27588 = msg("25460", dup309); + +var msg27589 = msg("25461", dup309); + +var msg27590 = msg("25462", dup309); + +var msg27591 = msg("25463", dup309); + +var msg27592 = msg("25464", dup309); + +var msg27593 = msg("25465", dup321); + +var msg27594 = msg("25466", dup324); + +var msg27595 = msg("25467", dup324); + +var msg27596 = msg("25468", dup324); + +var msg27597 = msg("25469", dup324); + +var msg27598 = msg("25470", dup321); + +var msg27599 = msg("25471", dup321); + +var msg27600 = msg("25472", dup311); + +var msg27601 = msg("25473", dup311); + +var msg27602 = msg("25474", dup314); + +var msg27603 = msg("25475", dup323); + +var msg27604 = msg("25476", dup325); + +var msg27605 = msg("25477", dup321); + +var msg27606 = msg("25478", dup314); + +var msg27607 = msg("25479", dup314); + +var msg27608 = msg("25502", dup309); + +var msg27609 = msg("25503", dup321); + +var msg27610 = msg("25504", dup321); + +var msg27611 = msg("25505", dup311); + +var msg27612 = msg("25506", dup311); + +var msg27613 = msg("25507", dup311); + +var msg27614 = msg("25508", dup311); + +var msg27615 = msg("25509", dup311); + +var msg27616 = msg("25510", dup311); + +var msg27617 = msg("25511", dup321); + +var msg27618 = msg("25512", dup321); + +var msg27619 = msg("25513", dup311); + +var msg27620 = msg("25514", dup311); + +var msg27621 = msg("25515", dup311); + +var msg27622 = msg("25516", dup314); + +var msg27623 = msg("25517", dup314); + +var msg27624 = msg("25518", dup323); + +var msg27625 = msg("25519", dup323); + +var msg27626 = msg("25520", dup323); + +var msg27627 = msg("25521", dup314); + +var msg27628 = msg("25522", dup314); + +var msg27629 = msg("25523", dup314); + +var msg27630 = msg("25524", dup314); + +var msg27631 = msg("25525", dup314); + +var msg27632 = msg("25526", dup307); + +var msg27633 = msg("25527", dup309); + +var msg27634 = msg("25528", dup311); + +var msg27635 = msg("25529", dup321); + +var msg27636 = msg("25530", dup321); + +var msg27637 = msg("25531", dup321); + +var msg27638 = msg("25532", dup321); + +var msg27639 = msg("25533", dup325); + +var msg27640 = msg("25534", dup330); + +var msg27641 = msg("25535", dup311); + +var msg27642 = msg("25536", dup314); + +var msg27643 = msg("25537", dup314); + +var msg27644 = msg("25538", dup311); + +var msg27645 = msg("25539", dup311); + +var msg27646 = msg("25540", dup311); + +var msg27647 = msg("25541", dup321); + +var msg27648 = msg("25542", dup308); + +var msg27649 = msg("25543", dup321); + +var msg27650 = msg("25544", dup325); + +var msg27651 = msg("25545", dup321); + +var msg27652 = msg("25546", dup321); + +var msg27653 = msg("25547", dup321); + +var msg27654 = msg("25548", dup321); + +var msg27655 = msg("25549", dup309); + +var msg27656 = msg("25550", dup309); + +var msg27657 = msg("25551", dup321); + +var msg27658 = msg("25552", dup314); + +var msg27659 = msg("25553", dup321); + +var msg27660 = msg("25554", dup321); + +var msg27661 = msg("25555", dup321); + +var msg27662 = msg("25556", dup314); + +var msg27663 = msg("25557", dup316); + +var msg27664 = msg("25558", dup311); + +var msg27665 = msg("25559", dup311); + +var msg27666 = msg("25560", dup311); + +var msg27667 = msg("25561", dup311); + +var msg27668 = msg("25562", dup314); + +var msg27669 = msg("25563", dup309); + +var msg27670 = msg("25564", dup309); + +var msg27671 = msg("25565", dup314); + +var msg27672 = msg("25566", dup314); + +var msg27673 = msg("25567", dup311); + +var msg27674 = msg("25568", dup311); + +var msg27675 = msg("25569", dup311); + +var msg27676 = msg("25570", dup321); + +var msg27677 = msg("25571", dup321); + +var msg27678 = msg("25572", dup321); + +var msg27679 = msg("25573", dup311); + +var msg27680 = msg("25574", dup311); + +var msg27681 = msg("25575", dup311); + +var msg27682 = msg("25576", dup311); + +var msg27683 = msg("25577", dup321); + +var msg27684 = msg("25578", dup311); + +var msg27685 = msg("25579", dup311); + +var msg27686 = msg("25580", dup311); + +var msg27687 = msg("25581", dup316); + +var msg27688 = msg("25582", dup316); + +var msg27689 = msg("25583", dup316); + +var msg27690 = msg("25584", dup316); + +var msg27691 = msg("25585", dup316); + +var msg27692 = msg("25586", dup309); + +var msg27693 = msg("25587", dup309); + +var msg27694 = msg("25588", dup309); + +var msg27695 = msg("25589", dup309); + +var msg27696 = msg("25590", dup311); + +var msg27697 = msg("25591", dup311); + +var msg27698 = msg("25592", dup314); + +var msg27699 = msg("25593", dup311); + +var msg27700 = msg("25594", dup311); + +var msg27701 = msg("25595", dup311); + +var msg27702 = msg("25596", dup311); + +var msg27703 = msg("25597", dup311); + +var msg27704 = msg("25598", dup311); + +var msg27705 = msg("25599", dup321); + +var msg27706 = msg("25600", dup321); + +var msg27707 = msg("25601", dup309); + +var msg27708 = msg("25602", dup314); + +var msg27709 = msg("25603", dup311); + +var msg27710 = msg("25604", dup314); + +var msg27711 = msg("25605", dup314); + +var msg27712 = msg("25606", dup314); + +var msg27713 = msg("25607", dup309); + +var msg27714 = msg("25608", dup309); + +var msg27715 = msg("25609", dup321); + +var msg27716 = msg("25610", dup321); + +var msg27717 = msg("25611", dup311); + +var msg27718 = msg("25612", dup309); + +var msg27719 = msg("25613", dup314); + +var msg27720 = msg("25614", dup314); + +var msg27721 = msg("25615", dup314); + +var msg27722 = msg("25616", dup314); + +var msg27723 = msg("25617", dup309); + +var msg27724 = msg("25618", dup309); + +var msg27725 = msg("25619", dup309); + +var msg27726 = msg("25620", dup309); + +var msg27727 = msg("25621", dup314); + +var msg27728 = msg("25622", dup314); + +var msg27729 = msg("25623", dup321); + +var msg27730 = msg("25624", dup321); + +var msg27731 = msg("25625", dup321); + +var msg27732 = msg("25626", dup321); + +var msg27733 = msg("25627", dup321); + +var msg27734 = msg("25628", dup321); + +var msg27735 = msg("25630", dup309); + +var msg27736 = msg("25631", dup309); + +var msg27737 = msg("25632", dup321); + +var msg27738 = msg("25633", dup321); + +var msg27739 = msg("25634", dup316); + +var msg27740 = msg("25635", dup316); + +var msg27741 = msg("25636", dup316); + +var msg27742 = msg("25637", dup316); + +var msg27743 = msg("25638", dup316); + +var msg27744 = msg("25639", dup316); + +var msg27745 = msg("25640", dup316); + +var msg27746 = msg("25641", dup316); + +var msg27747 = msg("25642", dup316); + +var msg27748 = msg("25643", dup316); + +var msg27749 = msg("25644", dup309); + +var msg27750 = msg("25645", dup309); + +var msg27751 = msg("25646", dup309); + +var msg27752 = msg("25647", dup309); + +var msg27753 = msg("25648", dup309); + +var msg27754 = msg("25649", dup309); + +var msg27755 = msg("25650", dup309); + +var msg27756 = msg("25651", dup311); + +var msg27757 = msg("25652", dup321); + +var msg27758 = msg("25653", dup314); + +var msg27759 = msg("25654", dup309); + +var msg27760 = msg("25655", dup309); + +var msg27761 = msg("25656", dup309); + +var msg27762 = msg("25657", dup314); + +var msg27763 = msg("25658", dup314); + +var msg27764 = msg("25659", dup325); + +var msg27765 = msg("25660", dup321); + +var msg27766 = msg("25661", dup321); + +var msg27767 = msg("25662", dup321); + +var msg27768 = msg("25663", dup321); + +var msg27769 = msg("25664", dup309); + +var msg27770 = msg("25665", dup321); + +var msg27771 = msg("25666", dup321); + +var msg27772 = msg("25667", dup321); + +var msg27773 = msg("25668", dup321); + +var msg27774 = msg("25669", dup321); + +var msg27775 = msg("25670", dup321); + +var msg27776 = msg("25671", dup321); + +var msg27777 = msg("25672", dup321); + +var msg27778 = msg("25673", dup321); + +var msg27779 = msg("25674", dup321); + +var msg27780 = msg("25675", dup321); + +var msg27781 = msg("25676", dup311); + +var msg27782 = msg("25677", dup311); + +var msg27783 = msg("25678", dup311); + +var msg27784 = msg("25679", dup311); + +var msg27785 = msg("25680", dup314); + +var msg27786 = msg("25681", dup309); + +var msg27787 = msg("25682", dup314); + +var msg27788 = msg("25683", dup309); + +var msg27789 = msg("25684", dup321); + +var msg27790 = msg("25685", dup321); + +var msg27791 = msg("25686", dup321); + +var msg27792 = msg("25687", dup321); + +var msg27793 = msg("25688", dup321); + +var msg27794 = msg("25689", dup321); + +var msg27795 = msg("25690", dup321); + +var msg27796 = msg("25691", dup321); + +var msg27797 = msg("25692", dup321); + +var msg27798 = msg("25693", dup321); + +var msg27799 = msg("25694", dup321); + +var msg27800 = msg("25695", dup321); + +var msg27801 = msg("25696", dup321); + +var msg27802 = msg("25697", dup321); + +var msg27803 = msg("25698", dup321); + +var msg27804 = msg("25699", dup321); + +var msg27805 = msg("25700", dup321); + +var msg27806 = msg("25701", dup321); + +var msg27807 = msg("25702", dup321); + +var msg27808 = msg("25703", dup321); + +var msg27809 = msg("25704", dup321); + +var msg27810 = msg("25705", dup321); + +var msg27811 = msg("25706", dup321); + +var msg27812 = msg("25707", dup321); + +var msg27813 = msg("25708", dup321); + +var msg27814 = msg("25709", dup321); + +var msg27815 = msg("25710", dup321); + +var msg27816 = msg("25711", dup321); + +var msg27817 = msg("25712", dup321); + +var msg27818 = msg("25713", dup321); + +var msg27819 = msg("25714", dup321); + +var msg27820 = msg("25715", dup321); + +var msg27821 = msg("25716", dup321); + +var msg27822 = msg("25717", dup321); + +var msg27823 = msg("25718", dup321); + +var msg27824 = msg("25719", dup321); + +var msg27825 = msg("25720", dup321); + +var msg27826 = msg("25721", dup321); + +var msg27827 = msg("25722", dup321); + +var msg27828 = msg("25723", dup321); + +var msg27829 = msg("25724", dup321); + +var msg27830 = msg("25725", dup321); + +var msg27831 = msg("25726", dup321); + +var msg27832 = msg("25727", dup321); + +var msg27833 = msg("25728", dup321); + +var msg27834 = msg("25729", dup321); + +var msg27835 = msg("25730", dup321); + +var msg27836 = msg("25731", dup321); + +var msg27837 = msg("25732", dup321); + +var msg27838 = msg("25733", dup321); + +var msg27839 = msg("25734", dup321); + +var msg27840 = msg("25735", dup321); + +var msg27841 = msg("25736", dup321); + +var msg27842 = msg("25737", dup321); + +var msg27843 = msg("25738", dup321); + +var msg27844 = msg("25739", dup321); + +var msg27845 = msg("25740", dup321); + +var msg27846 = msg("25741", dup321); + +var msg27847 = msg("25742", dup321); + +var msg27848 = msg("25743", dup321); + +var msg27849 = msg("25744", dup321); + +var msg27850 = msg("25745", dup321); + +var msg27851 = msg("25746", dup321); + +var msg27852 = msg("25747", dup321); + +var msg27853 = msg("25748", dup321); + +var msg27854 = msg("25749", dup321); + +var msg27855 = msg("25750", dup321); + +var msg27856 = msg("25751", dup321); + +var msg27857 = msg("25752", dup321); + +var msg27858 = msg("25753", dup321); + +var msg27859 = msg("25754", dup321); + +var msg27860 = msg("25755", dup321); + +var msg27861 = msg("25756", dup321); + +var msg27862 = msg("25757", dup321); + +var msg27863 = msg("25758", dup321); + +var msg27864 = msg("25759", dup321); + +var msg27865 = msg("25760", dup321); + +var msg27866 = msg("25761", dup321); + +var msg27867 = msg("25762", dup321); + +var msg27868 = msg("25763", dup321); + +var msg27869 = msg("25764", dup321); + +var msg27870 = msg("25765", dup321); + +var msg27871 = msg("25766", dup321); + +var msg27872 = msg("25767", dup314); + +var msg27873 = msg("25768", dup309); + +var msg27874 = msg("25769", dup314); + +var msg27875 = msg("25770", dup311); + +var msg27876 = msg("25771", dup325); + +var msg27877 = msg("25772", dup325); + +var msg27878 = msg("25773", dup325); + +var msg27879 = msg("25774", dup323); + +var msg27880 = msg("25775", dup325); + +var msg27881 = msg("25776", dup311); + +var msg27882 = msg("25777", dup311); + +var msg27883 = msg("25778", dup325); + +var msg27884 = msg("25779", dup311); + +var msg27885 = msg("25780", dup309); + +var msg27886 = msg("25781", dup311); + +var msg27887 = msg("25782", dup311); + +var msg27888 = msg("25783", dup322); + +var msg27889 = msg("25784", dup325); + +var msg27890 = msg("25785", dup325); + +var msg27891 = msg("25786", dup311); + +var msg27892 = msg("25787", dup311); + +var msg27893 = msg("25788", dup325); + +var msg27894 = msg("25789", dup325); + +var msg27895 = msg("25790", dup325); + +var msg27896 = msg("25791", dup325); + +var msg27897 = msg("25792", dup325); + +var msg27898 = msg("25793", dup325); + +var msg27899 = msg("25794", dup325); + +var msg27900 = msg("25795", dup309); + +var msg27901 = msg("25796", dup309); + +var msg27902 = msg("25797", dup311); + +var msg27903 = msg("25798", dup307); + +var msg27904 = msg("25799", dup311); + +var msg27905 = msg("25800", dup307); + +var msg27906 = msg("25801", dup311); + +var msg27907 = msg("25802", dup311); + +var msg27908 = msg("25803", dup311); + +var msg27909 = msg("25804", dup311); + +var msg27910 = msg("25805", dup311); + +var msg27911 = msg("25806", dup311); + +var msg27912 = msg("25807", dup321); + +var msg27913 = msg("25808", dup311); + +var msg27914 = msg("25809", dup321); + +var msg27915 = msg("25810", dup311); + +var msg27916 = msg("25811", dup311); + +var msg27917 = msg("25812", dup311); + +var msg27918 = msg("25813", dup311); + +var msg27919 = msg("25814", dup314); + +var msg27920 = msg("25815", dup309); + +var msg27921 = msg("25816", dup309); + +var msg27922 = msg("25817", dup321); + +var msg27923 = msg("25818", dup325); + +var msg27924 = msg("25819", dup325); + +var msg27925 = msg("25820", dup311); + +var msg27926 = msg("25821", dup311); + +var msg27927 = msg("25822", dup311); + +var msg27928 = msg("25823", dup311); + +var msg27929 = msg("25824", dup311); + +var msg27930 = msg("25825", dup314); + +var msg27931 = msg("25826", dup314); + +var msg27932 = msg("25827", dup314); + +var msg27933 = msg("25828", dup314); + +var msg27934 = msg("25829", dup321); + +var msg27935 = msg("25830", dup325); + +var msg27936 = msg("25831", dup311); + +var msg27937 = msg("25832", dup311); + +var msg27938 = msg("25833", dup325); + +var msg27939 = msg("25834", dup311); + +var msg27940 = msg("25835", dup307); + +var msg27941 = msg("25836", dup325); + +var msg27942 = msg("25837", dup325); + +var msg27943 = msg("25838", dup325); + +var msg27944 = msg("25839", dup325); + +var msg27945 = msg("25840", dup325); + +var msg27946 = msg("25841", dup325); + +var msg27947 = msg("25842", dup325); + +var msg27948 = msg("25843", dup325); + +var msg27949 = msg("25844", dup325); + +var msg27950 = msg("25845", dup325); + +var msg27951 = msg("25846", dup325); + +var msg27952 = msg("25847", dup325); + +var msg27953 = msg("25848", dup325); + +var msg27954 = msg("25849", dup314); + +var msg27955 = msg("25850", dup314); + +var msg27956 = msg("25851", dup314); + +var msg27957 = msg("25852", dup314); + +var msg27958 = msg("25853", dup309); + +var msg27959 = msg("25854", dup321); + +var msg27960 = msg("25855", dup311); + +var msg27961 = msg("25856", dup309); + +var msg27962 = msg("25857", dup311); + +var msg27963 = msg("25858", dup311); + +var msg27964 = msg("25859", dup311); + +var msg27965 = msg("25860", dup311); + +var msg27966 = msg("25861", dup311); + +var msg27967 = msg("25862", dup311); + +var msg27968 = msg("25863", dup321); + +var msg27969 = msg("25864", dup321); + +var msg27970 = msg("25865", dup321); + +var msg27971 = msg("25866", dup321); + +var msg27972 = msg("25867", dup321); + +var msg27973 = msg("25868", dup321); + +var msg27974 = msg("25869", dup309); + +var msg27975 = msg("25870", dup309); + +var msg27976 = msg("25871", dup309); + +var msg27977 = msg("25872", dup309); + +var msg27978 = msg("25873", dup309); + +var msg27979 = msg("25874", dup309); + +var msg27980 = msg("25875", dup309); + +var msg27981 = msg("25876", dup309); + +var msg27982 = msg("25877", dup309); + +var msg27983 = msg("25878", dup309); + +var msg27984 = msg("25879", dup309); + +var msg27985 = msg("25880", dup309); + +var msg27986 = msg("25881", dup309); + +var msg27987 = msg("25882", dup309); + +var msg27988 = msg("25883", dup309); + +var msg27989 = msg("25884", dup309); + +var msg27990 = msg("25885", dup309); + +var msg27991 = msg("25886", dup309); + +var msg27992 = msg("25887", dup309); + +var msg27993 = msg("25888", dup309); + +var msg27994 = msg("25889", dup309); + +var msg27995 = msg("25890", dup309); + +var msg27996 = msg("25891", dup309); + +var msg27997 = msg("25892", dup309); + +var msg27998 = msg("25893", dup309); + +var msg27999 = msg("25894", dup309); + +var msg28000 = msg("25895", dup309); + +var msg28001 = msg("25896", dup309); + +var msg28002 = msg("25897", dup309); + +var msg28003 = msg("25898", dup309); + +var msg28004 = msg("25899", dup309); + +var msg28005 = msg("25900", dup309); + +var msg28006 = msg("25901", dup309); + +var msg28007 = msg("25902", dup309); + +var msg28008 = msg("25903", dup309); + +var msg28009 = msg("25904", dup309); + +var msg28010 = msg("25905", dup309); + +var msg28011 = msg("25906", dup309); + +var msg28012 = msg("25907", dup314); + +var msg28013 = msg("25908", dup309); + +var msg28014 = msg("25909", dup309); + +var msg28015 = msg("25910", dup309); + +var msg28016 = msg("25911", dup309); + +var msg28017 = msg("25912", dup309); + +var msg28018 = msg("25913", dup309); + +var msg28019 = msg("25914", dup309); + +var msg28020 = msg("25915", dup309); + +var msg28021 = msg("25916", dup309); + +var msg28022 = msg("25917", dup309); + +var msg28023 = msg("25918", dup309); + +var msg28024 = msg("25919", dup309); + +var msg28025 = msg("25920", dup309); + +var msg28026 = msg("25921", dup309); + +var msg28027 = msg("25922", dup309); + +var msg28028 = msg("25923", dup309); + +var msg28029 = msg("25924", dup309); + +var msg28030 = msg("25925", dup309); + +var msg28031 = msg("25926", dup309); + +var msg28032 = msg("25927", dup309); + +var msg28033 = msg("25928", dup314); + +var msg28034 = msg("25929", dup314); + +var msg28035 = msg("25930", dup314); + +var msg28036 = msg("25931", dup314); + +var msg28037 = msg("25932", dup314); + +var msg28038 = msg("25933", dup314); + +var msg28039 = msg("25934", dup314); + +var msg28040 = msg("25935", dup314); + +var msg28041 = msg("25936", dup314); + +var msg28042 = msg("25937", dup314); + +var msg28043 = msg("25938", dup314); + +var msg28044 = msg("25939", dup314); + +var msg28045 = msg("25940", dup314); + +var msg28046 = msg("25941", dup314); + +var msg28047 = msg("25942", dup314); + +var msg28048 = msg("25943", dup314); + +var msg28049 = msg("25944", dup314); + +var msg28050 = msg("25945", dup314); + +var msg28051 = msg("25946", dup321); + +var msg28052 = msg("25947", dup314); + +var msg28053 = msg("25948", dup311); + +var msg28054 = msg("25949", dup321); + +var msg28055 = msg("25950", dup311); + +var msg28056 = msg("25951", dup311); + +var msg28057 = msg("25952", dup311); + +var msg28058 = msg("25953", dup311); + +var msg28059 = msg("25954", dup311); + +var msg28060 = msg("25955", dup311); + +var msg28061 = msg("25956", dup311); + +var msg28062 = msg("25957", dup311); + +var msg28063 = msg("25958", dup311); + +var msg28064 = msg("25959", dup311); + +var msg28065 = msg("25960", dup311); + +var msg28066 = msg("25961", dup311); + +var msg28067 = msg("25962", dup311); + +var msg28068 = msg("25963", dup311); + +var msg28069 = msg("25964", dup311); + +var msg28070 = msg("25965", dup311); + +var msg28071 = msg("25966", dup311); + +var msg28072 = msg("25967", dup311); + +var msg28073 = msg("25968", dup311); + +var msg28074 = msg("25969", dup309); + +var msg28075 = msg("25970", dup314); + +var msg28076 = msg("25971", dup311); + +var msg28077 = msg("25972", dup311); + +var msg28078 = msg("25973", dup321); + +var msg28079 = msg("25974", dup321); + +var msg28080 = msg("25975", dup314); + +var msg28081 = msg("25976", dup314); + +var msg28082 = msg("25977", dup314); + +var msg28083 = msg("25978", dup321); + +var msg28084 = msg("25979", dup321); + +var msg28085 = msg("25980", dup325); + +var msg28086 = msg("25981", dup314); + +var msg28087 = msg("25982", dup311); + +var msg28088 = msg("25983", dup327); + +var msg28089 = msg("25984", dup311); + +var msg28090 = msg("25985", dup311); + +var msg28091 = msg("25986", dup311); + +var msg28092 = msg("25987", dup321); + +var msg28093 = msg("25988", dup311); + +var msg28094 = msg("25989", dup311); + +var msg28095 = msg("25990", dup321); + +var msg28096 = msg("25991", dup321); + +var msg28097 = msg("25992", dup321); + +var msg28098 = msg("25993", dup321); + +var msg28099 = msg("25994", dup321); + +var msg28100 = msg("25995", dup321); + +var msg28101 = msg("25996", dup321); + +var msg28102 = msg("25997", dup321); + +var msg28103 = msg("25998", dup321); + +var msg28104 = msg("25999", dup321); + +var msg28105 = msg("26000", dup307); + +var msg28106 = msg("26001", dup307); + +var msg28107 = msg("26002", dup307); + +var msg28108 = msg("26003", dup307); + +var msg28109 = msg("26004", dup307); + +var msg28110 = msg("26005", dup307); + +var msg28111 = msg("26006", dup307); + +var msg28112 = msg("26007", dup307); + +var msg28113 = msg("26008", dup316); + +var msg28114 = msg("26009", dup316); + +var msg28115 = msg("26010", dup321); + +var msg28116 = msg("26011", dup309); + +var msg28117 = msg("26012", dup311); + +var msg28118 = msg("26013", dup311); + +var msg28119 = msg("26014", dup311); + +var msg28120 = msg("26015", dup321); + +var msg28121 = msg("26016", dup321); + +var msg28122 = msg("26017", dup321); + +var msg28123 = msg("26018", dup321); + +var msg28124 = msg("26019", dup321); + +var msg28125 = msg("26020", dup311); + +var msg28126 = msg("26021", dup314); + +var msg28127 = msg("26022", dup314); + +var msg28128 = msg("26023", dup321); + +var msg28129 = msg("26024", dup321); + +var msg28130 = msg("26025", dup314); + +var msg28131 = msg("26026", dup321); + +var msg28132 = msg("26027", dup309); + +var msg28133 = msg("26028", dup311); + +var msg28134 = msg("26029", dup311); + +var msg28135 = msg("26030", dup325); + +var msg28136 = msg("26031", dup311); + +var msg28137 = msg("26032", dup311); + +var msg28138 = msg("26033", dup311); + +var msg28139 = msg("26034", dup311); + +var msg28140 = msg("26035", dup311); + +var msg28141 = msg("26036", dup311); + +var msg28142 = msg("26037", dup311); + +var msg28143 = msg("26038", dup311); + +var msg28144 = msg("26039", dup311); + +var msg28145 = msg("26040", dup311); + +var msg28146 = msg("26041", dup311); + +var msg28147 = msg("26042", dup311); + +var msg28148 = msg("26043", dup311); + +var msg28149 = msg("26044", dup311); + +var msg28150 = msg("26045", dup311); + +var msg28151 = msg("26046", dup311); + +var msg28152 = msg("26047", dup311); + +var msg28153 = msg("26048", dup311); + +var msg28154 = msg("26049", dup311); + +var msg28155 = msg("26050", dup311); + +var msg28156 = msg("26051", dup311); + +var msg28157 = msg("26052", dup311); + +var msg28158 = msg("26053", dup311); + +var msg28159 = msg("26054", dup311); + +var msg28160 = msg("26055", dup311); + +var msg28161 = msg("26056", dup311); + +var msg28162 = msg("26057", dup323); + +var msg28163 = msg("26058", dup323); + +var msg28164 = msg("26059", dup314); + +var msg28165 = msg("26060", dup314); + +var msg28166 = msg("26061", dup314); + +var msg28167 = msg("26062", dup314); + +var msg28168 = msg("26063", dup314); + +var msg28169 = msg("26064", dup314); + +var msg28170 = msg("26065", dup314); + +var msg28171 = msg("26066", dup311); + +var msg28172 = msg("26067", dup311); + +var msg28173 = msg("26068", dup311); + +var msg28174 = msg("26069", dup311); + +var msg28175 = msg("26070", dup311); + +var msg28176 = msg("26071", dup311); + +var msg28177 = msg("26072", dup321); + +var msg28178 = msg("26073", dup309); + +var msg28179 = msg("26074", dup309); + +var msg28180 = msg("26075", dup321); + +var msg28181 = msg("26076", dup323); + +var msg28182 = msg("26077", dup323); + +var msg28183 = msg("26078", dup314); + +var msg28184 = msg("26079", dup314); + +var msg28185 = msg("26080", dup309); + +var msg28186 = msg("26081", dup325); + +var msg28187 = msg("26082", dup309); + +var msg28188 = msg("26083", dup314); + +var msg28189 = msg("26084", dup314); + +var msg28190 = msg("26085", dup314); + +var msg28191 = msg("26086", dup321); + +var msg28192 = msg("26087", dup321); + +var msg28193 = msg("26088", dup321); + +var msg28194 = msg("26089", dup309); + +var msg28195 = msg("26090", dup311); + +var msg28196 = msg("26091", dup311); + +var msg28197 = msg("26092", dup311); + +var msg28198 = msg("26093", dup311); + +var msg28199 = msg("26094", dup311); + +var msg28200 = msg("26095", dup311); + +var msg28201 = msg("26096", dup311); + +var msg28202 = msg("26097", dup311); + +var msg28203 = msg("26098", dup311); + +var msg28204 = msg("26099", dup311); + +var msg28205 = msg("26100", dup311); + +var msg28206 = msg("26101", dup314); + +var msg28207 = msg("26102", dup321); + +var msg28208 = msg("26103", dup309); + +var msg28209 = msg("26104", dup321); + +var msg28210 = msg("26105", dup309); + +var msg28211 = msg("26106", dup321); + +var msg28212 = msg("26107", dup316); + +var msg28213 = msg("26108", dup316); + +var msg28214 = msg("26109", dup309); + +var msg28215 = msg("26110", dup311); + +var msg28216 = msg("26111", dup311); + +var msg28217 = msg("26112", dup311); + +var msg28218 = msg("26113", dup311); + +var msg28219 = msg("26114", dup321); + +var msg28220 = msg("26115", dup321); + +var msg28221 = msg("26116", dup321); + +var msg28222 = msg("26117", dup321); + +var msg28223 = msg("26118", dup321); + +var msg28224 = msg("26119", dup321); + +var msg28225 = msg("26120", dup321); + +var msg28226 = msg("26121", dup321); + +var msg28227 = msg("26122", dup309); + +var msg28228 = msg("26123", dup309); + +var msg28229 = msg("26124", dup311); + +var msg28230 = msg("26125", dup325); + +var msg28231 = msg("26126", dup325); + +var msg28232 = msg("26127", dup325); + +var msg28233 = msg("26128", dup325); + +var msg28234 = msg("26129", dup325); + +var msg28235 = msg("26130", dup325); + +var msg28236 = msg("26131", dup311); + +var msg28237 = msg("26132", dup325); + +var msg28238 = msg("26133", dup325); + +var msg28239 = msg("26134", dup311); + +var msg28240 = msg("26135", dup325); + +var msg28241 = msg("26136", dup325); + +var msg28242 = msg("26137", dup325); + +var msg28243 = msg("26138", dup325); + +var msg28244 = msg("26139", dup321); + +var msg28245 = msg("26140", dup321); + +var msg28246 = msg("26141", dup321); + +var msg28247 = msg("26142", dup321); + +var msg28248 = msg("26143", dup321); + +var msg28249 = msg("26144", dup321); + +var msg28250 = msg("26145", dup321); + +var msg28251 = msg("26146", dup321); + +var msg28252 = msg("26147", dup321); + +var msg28253 = msg("26148", dup321); + +var msg28254 = msg("26149", dup321); + +var msg28255 = msg("26150", dup321); + +var msg28256 = msg("26151", dup321); + +var msg28257 = msg("26152", dup321); + +var msg28258 = msg("26153", dup321); + +var msg28259 = msg("26154", dup321); + +var msg28260 = msg("26155", dup321); + +var msg28261 = msg("26156", dup321); + +var msg28262 = msg("26157", dup325); + +var msg28263 = msg("26158", dup325); + +var msg28264 = msg("26159", dup325); + +var msg28265 = msg("26160", dup325); + +var msg28266 = msg("26161", dup325); + +var msg28267 = msg("26162", dup325); + +var msg28268 = msg("26163", dup309); + +var msg28269 = msg("26164", dup309); + +var msg28270 = msg("26165", dup314); + +var msg28271 = msg("26166", dup314); + +var msg28272 = msg("26167", dup314); + +var msg28273 = msg("26168", dup325); + +var msg28274 = msg("26169", dup325); + +var msg28275 = msg("26170", dup309); + +var msg28276 = msg("26171", dup309); + +var msg28277 = msg("26172", dup309); + +var msg28278 = msg("26173", dup309); + +var msg28279 = msg("26174", dup309); + +var msg28280 = msg("26175", dup309); + +var msg28281 = msg("26176", dup309); + +var msg28282 = msg("26177", dup309); + +var msg28283 = msg("26178", dup321); + +var msg28284 = msg("26179", dup331); + +var msg28285 = msg("26180", dup309); + +var msg28286 = msg("26181", dup314); + +var msg28287 = msg("26182", dup314); + +var msg28288 = msg("26183", dup314); + +var msg28289 = msg("26184", dup314); + +var msg28290 = msg("26185", dup314); + +var msg28291 = msg("26186", dup314); + +var msg28292 = msg("26187", dup314); + +var msg28293 = msg("26188", dup309); + +var msg28294 = msg("26189", dup321); + +var msg28295 = msg("26190", dup321); + +var msg28296 = msg("26191", dup314); + +var msg28297 = msg("26192", dup321); + +var msg28298 = msg("26193", dup311); + +var msg28299 = msg("26194", dup311); + +var msg28300 = msg("26195", dup309); + +var msg28301 = msg("26196", dup309); + +var msg28302 = msg("26197", dup309); + +var msg28303 = msg("26198", dup309); + +var msg28304 = msg("26199", dup309); + +var msg28305 = msg("26200", dup309); + +var msg28306 = msg("26201", dup321); + +var msg28307 = msg("26202", dup321); + +var msg28308 = msg("26203", dup321); + +var msg28309 = msg("26204", dup321); + +var msg28310 = msg("26205", dup321); + +var msg28311 = msg("26206", dup314); + +var msg28312 = msg("26207", dup314); + +var msg28313 = msg("26208", dup314); + +var msg28314 = msg("26209", dup309); + +var msg28315 = msg("26210", dup309); + +var msg28316 = msg("26211", dup321); + +var msg28317 = msg("26212", dup321); + +var msg28318 = msg("26213", dup311); + +var msg28319 = msg("26214", dup311); + +var msg28320 = msg("26215", dup311); + +var msg28321 = msg("26216", dup325); + +var msg28322 = msg("26217", dup325); + +var msg28323 = msg("26218", dup325); + +var msg28324 = msg("26219", dup325); + +var msg28325 = msg("26220", dup325); + +var msg28326 = msg("26221", dup325); + +var msg28327 = msg("26222", dup325); + +var msg28328 = msg("26223", dup325); + +var msg28329 = msg("26224", dup325); + +var msg28330 = msg("26225", dup325); + +var msg28331 = msg("26226", dup311); + +var msg28332 = msg("26227", dup311); + +var msg28333 = msg("26228", dup311); + +var msg28334 = msg("26229", dup311); + +var msg28335 = msg("26230", dup307); + +var msg28336 = msg("26231", dup311); + +var msg28337 = msg("26232", dup311); + +var msg28338 = msg("26233", dup311); + +var msg28339 = msg("26234", dup311); + +var msg28340 = msg("26235", dup311); + +var msg28341 = msg("26236", dup311); + +var msg28342 = msg("26237", dup311); + +var msg28343 = msg("26238", dup321); + +var msg28344 = msg("26239", dup321); + +var msg28345 = msg("26240", dup321); + +var msg28346 = msg("26241", dup314); + +var msg28347 = msg("26242", dup309); + +var msg28348 = msg("26243", dup309); + +var msg28349 = msg("26244", dup321); + +var msg28350 = msg("26245", dup321); + +var msg28351 = msg("26246", dup321); + +var msg28352 = msg("26247", dup321); + +var msg28353 = msg("26248", dup325); + +var msg28354 = msg("26249", dup321); + +var msg28355 = msg("26250", dup311); + +var msg28356 = msg("26251", dup314); + +var msg28357 = msg("26252", dup311); + +var msg28358 = msg("26253", dup311); + +var msg28359 = msg("26254", dup311); + +var msg28360 = msg("26255", dup311); + +var msg28361 = msg("26256", dup311); + +var msg28362 = msg("26257", dup311); + +var msg28363 = msg("26258", dup314); + +var msg28364 = msg("26259", dup314); + +var msg28365 = msg("26260", dup321); + +var msg28366 = msg("26261", dup311); + +var msg28367 = msg("26262", dup316); + +var msg28368 = msg("26263", dup311); + +var msg28369 = msg("26264", dup321); + +var msg28370 = msg("26265", dup321); + +var msg28371 = msg("26266", dup321); + +var msg28372 = msg("26267", dup321); + +var msg28373 = msg("26268", dup321); + +var msg28374 = msg("26269", dup321); + +var msg28375 = msg("26270", dup321); + +var msg28376 = msg("26271", dup321); + +var msg28377 = msg("26272", dup321); + +var msg28378 = msg("26273", dup321); + +var msg28379 = msg("26274", dup311); + +var msg28380 = msg("26275", dup311); + +var msg28381 = msg("26276", dup311); + +var msg28382 = msg("26277", dup311); + +var msg28383 = msg("26278", dup332); + +var msg28384 = msg("26279", dup332); + +var msg28385 = msg("26280", dup309); + +var msg28386 = msg("26281", dup309); + +var msg28387 = msg("26282", dup309); + +var msg28388 = msg("26283", dup309); + +var msg28389 = msg("26284", dup321); + +var msg28390 = msg("26285", dup321); + +var msg28391 = msg("26286", dup329); + +var msg28392 = msg("26287", dup314); + +var msg28393 = msg("26288", dup321); + +var msg28394 = msg("26289", dup321); + +var msg28395 = msg("26290", dup321); + +var msg28396 = msg("26291", dup321); + +var msg28397 = msg("26292", dup314); + +var msg28398 = msg("26293", dup311); + +var msg28399 = msg("26294", dup314); + +var msg28400 = msg("26295", dup314); + +var msg28401 = msg("26296", dup311); + +var msg28402 = msg("26297", dup311); + +var msg28403 = msg("26298", dup307); + +var msg28404 = msg("26299", dup322); + +var msg28405 = msg("26300", dup322); + +var msg28406 = msg("26301", dup307); + +var msg28407 = msg("26302", dup322); + +var msg28408 = msg("26303", dup322); + +var msg28409 = msg("26304", dup322); + +var msg28410 = msg("26305", dup307); + +var msg28411 = msg("26306", dup322); + +var msg28412 = msg("26307", dup322); + +var msg28413 = msg("26308", dup322); + +var msg28414 = msg("26309", dup307); + +var msg28415 = msg("26310", dup322); + +var msg28416 = msg("26311", dup322); + +var msg28417 = msg("26312", dup322); + +var msg28418 = msg("26313", dup307); + +var msg28419 = msg("26314", dup311); + +var msg28420 = msg("26315", dup311); + +var msg28421 = msg("26316", dup311); + +var msg28422 = msg("26317", dup309); + +var msg28423 = msg("26318", dup309); + +var msg28424 = msg("26319", dup321); + +var msg28425 = msg("26320", dup316); + +var msg28426 = msg("26321", dup306); + +var msg28427 = msg("26322", dup306); + +var msg28428 = msg("26323", dup311); + +var msg28429 = msg("26324", dup324); + +var msg28430 = msg("26325", dup321); + +var msg28431 = msg("26326", dup321); + +var msg28432 = msg("26327", dup321); + +var msg28433 = msg("26328", dup321); + +var msg28434 = msg("26329", dup309); + +var msg28435 = msg("26330", dup309); + +var msg28436 = msg("26331", dup321); + +var msg28437 = msg("26332", dup321); + +var msg28438 = msg("26333", dup309); + +var msg28439 = msg("26334", dup309); + +var msg28440 = msg("26335", dup321); + +var msg28441 = msg("26336", dup309); + +var msg28442 = msg("26337", dup311); + +var msg28443 = msg("26338", dup311); + +var msg28444 = msg("26339", dup311); + +var msg28445 = msg("26340", dup309); + +var msg28446 = msg("26341", dup311); + +var msg28447 = msg("26342", dup311); + +var msg28448 = msg("26343", dup311); + +var msg28449 = msg("26344", dup311); + +var msg28450 = msg("26345", dup311); + +var msg28451 = msg("26346", dup311); + +var msg28452 = msg("26347", dup311); + +var msg28453 = msg("26348", dup311); + +var msg28454 = msg("26349", dup311); + +var msg28455 = msg("26350", dup311); + +var msg28456 = msg("26351", dup311); + +var msg28457 = msg("26352", dup311); + +var msg28458 = msg("26353", dup323); + +var msg28459 = msg("26354", dup311); + +var msg28460 = msg("26355", dup314); + +var msg28461 = msg("26356", dup314); + +var msg28462 = msg("26357", dup314); + +var msg28463 = msg("26358", dup314); + +var msg28464 = msg("26359", dup314); + +var msg28465 = msg("26360", dup314); + +var msg28466 = msg("26361", dup314); + +var msg28467 = msg("26362", dup314); + +var msg28468 = msg("26363", dup314); + +var msg28469 = msg("26364", dup314); + +var msg28470 = msg("26365", dup314); + +var msg28471 = msg("26366", dup311); + +var msg28472 = msg("26367", dup311); + +var msg28473 = msg("26368", dup311); + +var msg28474 = msg("26369", dup321); + +var msg28475 = msg("26370", dup321); + +var msg28476 = msg("26371", dup321); + +var msg28477 = msg("26372", dup324); + +var msg28478 = msg("26373", dup324); + +var msg28479 = msg("26374", dup324); + +var msg28480 = msg("26375", dup314); + +var msg28481 = msg("26376", dup314); + +var msg28482 = msg("26377", dup311); + +var msg28483 = msg("26378", dup314); + +var msg28484 = msg("26379", dup324); + +var msg28485 = msg("26380", dup323); + +var msg28486 = msg("26381", dup323); + +var msg28487 = msg("26382", dup323); + +var msg28488 = msg("26383", dup311); + +var msg28489 = msg("26384", dup311); + +var msg28490 = msg("26385", dup311); + +var msg28491 = msg("26386", dup330); + +var msg28492 = msg("26387", dup321); + +var msg28493 = msg("26388", dup321); + +var msg28494 = msg("26389", dup314); + +var msg28495 = msg("26390", dup314); + +var msg28496 = msg("26391", dup309); + +var msg28497 = msg("26392", dup314); + +var msg28498 = msg("26393", dup314); + +var msg28499 = msg("26394", dup309); + +var msg28500 = msg("26395", dup321); + +var msg28501 = msg("26396", dup321); + +var msg28502 = msg("26397", dup323); + +var msg28503 = msg("26398", dup321); + +var msg28504 = msg("26399", dup321); + +var msg28505 = msg("26400", dup321); + +var msg28506 = msg("26401", dup321); + +var msg28507 = msg("26402", dup321); + +var msg28508 = msg("26403", dup321); + +var msg28509 = msg("26404", dup321); + +var msg28510 = msg("26405", dup321); + +var msg28511 = msg("26406", dup321); + +var msg28512 = msg("26407", dup321); + +var msg28513 = msg("26408", dup321); + +var msg28514 = msg("26409", dup321); + +var msg28515 = msg("26410", dup323); + +var msg28516 = msg("26411", dup321); + +var msg28517 = msg("26412", dup311); + +var msg28518 = msg("26413", dup321); + +var msg28519 = msg("26414", dup311); + +var msg28520 = msg("26415", dup314); + +var msg28521 = msg("26416", dup314); + +var msg28522 = msg("26417", dup314); + +var msg28523 = msg("26418", dup307); + +var msg28524 = msg("26419", dup325); + +var msg28525 = msg("26420", dup325); + +var msg28526 = msg("26421", dup309); + +var msg28527 = msg("26422", dup314); + +var msg28528 = msg("26423", dup314); + +var msg28529 = msg("26424", dup314); + +var msg28530 = msg("26425", dup307); + +var msg28531 = msg("26426", dup307); + +var msg28532 = msg("26427", dup324); + +var msg28533 = msg("26428", dup321); + +var msg28534 = msg("26429", dup314); + +var msg28535 = msg("26430", dup314); + +var msg28536 = msg("26431", dup311); + +var msg28537 = msg("26432", dup309); + +var msg28538 = msg("26433", dup309); + +var msg28539 = msg("26434", dup311); + +var msg28540 = msg("26435", dup321); + +var msg28541 = msg("26436", dup314); + +var msg28542 = msg("26437", dup314); + +var msg28543 = msg("26438", dup314); + +var msg28544 = msg("26439", dup325); + +var msg28545 = msg("26440", dup323); + +var msg28546 = msg("26441", dup323); + +var msg28547 = msg("26442", dup321); + +var msg28548 = msg("26443", dup321); + +var msg28549 = msg("26444", dup321); + +var msg28550 = msg("26445", dup321); + +var msg28551 = msg("26446", dup321); + +var msg28552 = msg("26447", dup321); + +var msg28553 = msg("26448", dup321); + +var msg28554 = msg("26449", dup321); + +var msg28555 = msg("26450", dup321); + +var msg28556 = msg("26451", dup323); + +var msg28557 = msg("26452", dup321); + +var msg28558 = msg("26453", dup309); + +var msg28559 = msg("26454", dup309); + +var msg28560 = msg("26455", dup309); + +var msg28561 = msg("26456", dup314); + +var msg28562 = msg("26457", dup314); + +var msg28563 = msg("26458", dup314); + +var msg28564 = msg("26459", dup309); + +var msg28565 = msg("26460", dup309); + +var msg28566 = msg("26461", dup309); + +var msg28567 = msg("26462", dup309); + +var msg28568 = msg("26463", dup321); + +var msg28569 = msg("26464", dup321); + +var msg28570 = msg("26465", dup314); + +var msg28571 = msg("26466", dup314); + +var msg28572 = msg("26467", dup321); + +var msg28573 = msg("26468", dup311); + +var msg28574 = msg("26469", dup311); + +var msg28575 = msg("26470", dup310); + +var msg28576 = msg("26471", dup333); + +var msg28577 = msg("26472", dup311); + +var msg28578 = msg("26473", dup309); + +var msg28579 = msg("26474", dup309); + +var msg28580 = msg("26475", dup309); + +var msg28581 = msg("26476", dup309); + +var msg28582 = msg("26477", dup309); + +var msg28583 = msg("26478", dup309); + +var msg28584 = msg("26479", dup309); + +var msg28585 = msg("26480", dup321); + +var msg28586 = msg("26481", dup321); + +var msg28587 = msg("26482", dup321); + +var msg28588 = msg("26483", dup323); + +var msg28589 = msg("26484", dup311); + +var msg28590 = msg("26485", dup311); + +var msg28591 = msg("26486", dup311); + +var msg28592 = msg("26487", dup311); + +var msg28593 = msg("26488", dup314); + +var msg28594 = msg("26489", dup309); + +var msg28595 = msg("26490", dup309); + +var msg28596 = msg("26491", dup311); + +var msg28597 = msg("26492", dup314); + +var msg28598 = msg("26493", dup314); + +var msg28599 = msg("26494", dup314); + +var msg28600 = msg("26495", dup309); + +var msg28601 = msg("26496", dup309); + +var msg28602 = msg("26497", dup314); + +var msg28603 = msg("26498", dup314); + +var msg28604 = msg("26499", dup311); + +var msg28605 = msg("26500", dup311); + +var msg28606 = msg("26501", dup309); + +var msg28607 = msg("26502", dup309); + +var msg28608 = msg("26503", dup309); + +var msg28609 = msg("26504", dup309); + +var msg28610 = msg("26505", dup314); + +var msg28611 = msg("26506", dup311); + +var msg28612 = msg("26507", dup311); + +var msg28613 = msg("26508", dup307); + +var msg28614 = msg("26509", dup307); + +var msg28615 = msg("26510", dup311); + +var msg28616 = msg("26511", dup311); + +var msg28617 = msg("26512", dup311); + +var msg28618 = msg("26513", dup323); + +var msg28619 = msg("26514", dup314); + +var msg28620 = msg("26515", dup314); + +var msg28621 = msg("26516", dup314); + +var msg28622 = msg("26517", dup314); + +var msg28623 = msg("26518", dup314); + +var msg28624 = msg("26519", dup314); + +var msg28625 = msg("26520", dup311); + +var msg28626 = msg("26521", dup311); + +var msg28627 = msg("26522", dup325); + +var msg28628 = msg("26523", dup314); + +var msg28629 = msg("26524", dup314); + +var msg28630 = msg("26525", dup314); + +var msg28631 = msg("26526", dup311); + +var msg28632 = msg("26527", dup311); + +var msg28633 = msg("26528", dup200); + +var msg28634 = msg("26529", dup200); + +var msg28635 = msg("26530", dup200); + +var msg28636 = msg("26531", dup321); + +var msg28637 = msg("26532", dup321); + +var msg28638 = msg("26533", dup321); + +var msg28639 = msg("26534", dup311); + +var msg28640 = msg("26535", dup311); + +var msg28641 = msg("26536", dup311); + +var msg28642 = msg("26537", dup311); + +var msg28643 = msg("26538", dup311); + +var msg28644 = msg("26539", dup311); + +var msg28645 = msg("26540", dup311); + +var msg28646 = msg("26541", dup311); + +var msg28647 = msg("26542", dup325); + +var msg28648 = msg("26543", dup314); + +var msg28649 = msg("26544", dup314); + +var msg28650 = msg("26545", dup314); + +var msg28651 = msg("26546", dup314); + +var msg28652 = msg("26547", dup311); + +var msg28653 = msg("26548", dup309); + +var msg28654 = msg("26549", dup311); + +var msg28655 = msg("26550", dup311); + +var msg28656 = msg("26551", dup311); + +var msg28657 = msg("26552", dup311); + +var msg28658 = msg("26553", dup321); + +var msg28659 = msg("26554", dup321); + +var msg28660 = msg("26555", dup321); + +var msg28661 = msg("26556", dup321); + +var msg28662 = msg("26557", dup314); + +var msg28663 = msg("26558", dup325); + +var msg28664 = msg("26559", dup307); + +var msg28665 = msg("26560", dup321); + +var msg28666 = msg("26561", dup321); + +var msg28667 = msg("26562", dup311); + +var msg28668 = msg("26563", dup321); + +var msg28669 = msg("26564", dup307); + +var msg28670 = msg("26565", dup314); + +var msg28671 = msg("26566", dup314); + +var msg28672 = msg("26567", dup314); + +var msg28673 = msg("26568", dup314); + +var msg28674 = msg("26569", dup325); + +var msg28675 = msg("26570", dup325); + +var msg28676 = msg("26571", dup325); + +var msg28677 = msg("26572", dup325); + +var msg28678 = msg("26573", dup311); + +var msg28679 = msg("26574", dup311); + +var msg28680 = msg("26575", dup324); + +var msg28681 = msg("26576", dup311); + +var msg28682 = msg("26577", dup325); + +var msg28683 = msg("26578", dup321); + +var msg28684 = msg("26579", dup321); + +var msg28685 = msg("26580", dup321); + +var msg28686 = msg("26581", dup321); + +var msg28687 = msg("26582", dup321); + +var msg28688 = msg("26583", dup321); + +var msg28689 = msg("26584", dup325); + +var msg28690 = msg("26585", dup314); + +var msg28691 = msg("26586", dup316); + +var msg28692 = msg("26587", dup314); + +var msg28693 = msg("26588", dup314); + +var msg28694 = msg("26589", dup321); + +var msg28695 = msg("26590", dup311); + +var msg28696 = msg("26591", dup307); + +var msg28697 = msg("26592", dup314); + +var msg28698 = msg("26593", dup309); + +var msg28699 = msg("26594", dup307); + +var msg28700 = msg("26595", dup323); + +var msg28701 = msg("26596", dup323); + +var msg28702 = msg("26597", dup309); + +var msg28703 = msg("26598", dup323); + +var msg28704 = msg("26599", dup311); + +var msg28705 = msg("26600", dup311); + +var msg28706 = msg("26601", dup311); + +var msg28707 = msg("26602", dup309); + +var msg28708 = msg("26603", dup321); + +var msg28709 = msg("26604", dup321); + +var msg28710 = msg("26605", dup321); + +var msg28711 = msg("26606", dup321); + +var msg28712 = msg("26607", dup321); + +var msg28713 = msg("26608", dup321); + +var msg28714 = msg("26609", dup321); + +var msg28715 = msg("26610", dup321); + +var msg28716 = msg("26611", dup321); + +var msg28717 = msg("26612", dup321); + +var msg28718 = msg("26613", dup321); + +var msg28719 = msg("26614", dup321); + +var msg28720 = msg("26615", dup323); + +var msg28721 = msg("26616", dup323); + +var msg28722 = msg("26617", dup311); + +var msg28723 = msg("26618", dup311); + +var msg28724 = msg("26619", dup325); + +var msg28725 = msg("26620", dup325); + +var msg28726 = msg("26621", dup314); + +var msg28727 = msg("26622", dup314); + +var msg28728 = msg("26623", dup314); + +var msg28729 = msg("26624", dup323); + +var msg28730 = msg("26625", dup323); + +var msg28731 = msg("26626", dup309); + +var msg28732 = msg("26627", dup309); + +var msg28733 = msg("26628", dup309); + +var msg28734 = msg("26629", dup325); + +var msg28735 = msg("26630", dup325); + +var msg28736 = msg("26631", dup325); + +var msg28737 = msg("26632", dup324); + +var msg28738 = msg("26633", dup314); + +var msg28739 = msg("26634", dup311); + +var msg28740 = msg("26635", dup311); + +var msg28741 = msg("26636", dup325); + +var msg28742 = msg("26637", dup325); + +var msg28743 = msg("26638", dup311); + +var msg28744 = msg("26639", dup314); + +var msg28745 = msg("26640", dup314); + +var msg28746 = msg("26641", dup311); + +var msg28747 = msg("26642", dup311); + +var msg28748 = msg("26643", dup324); + +var msg28749 = msg("26644", dup314); + +var msg28750 = msg("26645", dup314); + +var msg28751 = msg("26646", dup314); + +var msg28752 = msg("26647", dup314); + +var msg28753 = msg("26648", dup311); + +var msg28754 = msg("26649", dup311); + +var msg28755 = msg("26650", dup323); + +var msg28756 = msg("26651", dup309); + +var msg28757 = msg("26652", dup309); + +var msg28758 = msg("26653", dup311); + +var msg28759 = msg("26654", dup321); + +var msg28760 = msg("26655", dup321); + +var msg28761 = msg("26656", dup321); + +var msg28762 = msg("26657", dup321); + +var msg28763 = msg("26658", dup314); + +var msg28764 = msg("26659", dup314); + +var msg28765 = msg("26660", dup311); + +var msg28766 = msg("26661", dup311); + +var msg28767 = msg("26662", dup311); + +var msg28768 = msg("26663", dup309); + +var msg28769 = msg("26664", dup314); + +var msg28770 = msg("26665", dup314); + +var msg28771 = msg("26666", dup325); + +var msg28772 = msg("26667", dup309); + +var msg28773 = msg("26668", dup325); + +var msg28774 = msg("26669", dup314); + +var msg28775 = msg("26670", dup321); + +var msg28776 = msg("26671", dup321); + +var msg28777 = msg("26672", dup309); + +var msg28778 = msg("26673", dup309); + +var msg28779 = msg("26674", dup309); + +var msg28780 = msg("26675", dup309); + +var msg28781 = msg("26676", dup309); + +var msg28782 = msg("26677", dup321); + +var msg28783 = msg("26678", dup321); + +var msg28784 = msg("26679", dup321); + +var msg28785 = msg("26680", dup321); + +var msg28786 = msg("26681", dup321); + +var msg28787 = msg("26682", dup314); + +var msg28788 = msg("26683", dup321); + +var msg28789 = msg("26684", dup321); + +var msg28790 = msg("26685", dup325); + +var msg28791 = msg("26686", dup325); + +var msg28792 = msg("26687", dup314); + +var msg28793 = msg("26688", dup314); + +var msg28794 = msg("26689", dup321); + +var msg28795 = msg("26690", dup321); + +var msg28796 = msg("26691", dup321); + +var msg28797 = msg("26692", dup321); + +var msg28798 = msg("26693", dup321); + +var msg28799 = msg("26694", dup311); + +var msg28800 = msg("26695", dup321); + +var msg28801 = msg("26696", dup321); + +var msg28802 = msg("26697", dup321); + +var msg28803 = msg("26698", dup311); + +var msg28804 = msg("26699", dup309); + +var msg28805 = msg("26700", dup309); + +var msg28806 = msg("26701", dup309); + +var msg28807 = msg("26702", dup325); + +var msg28808 = msg("26703", dup321); + +var msg28809 = msg("26704", dup314); + +var msg28810 = msg("26705", dup321); + +var msg28811 = msg("26706", dup309); + +var msg28812 = msg("26707", dup309); + +var msg28813 = msg("26708", dup309); + +var msg28814 = msg("26709", dup309); + +var msg28815 = msg("26710", dup309); + +var msg28816 = msg("26711", dup309); + +var msg28817 = msg("26712", dup321); + +var msg28818 = msg("26713", dup321); + +var msg28819 = msg("26714", dup321); + +var msg28820 = msg("26715", dup321); + +var msg28821 = msg("26716", dup311); + +var msg28822 = msg("26717", dup311); + +var msg28823 = msg("26718", dup321); + +var msg28824 = msg("26719", dup321); + +var msg28825 = msg("26720", dup321); + +var msg28826 = msg("26721", dup321); + +var msg28827 = msg("26722", dup321); + +var msg28828 = msg("26723", dup321); + +var msg28829 = msg("26724", dup309); + +var msg28830 = msg("26725", dup321); + +var msg28831 = msg("26726", dup321); + +var msg28832 = msg("26727", dup321); + +var msg28833 = msg("26728", dup321); + +var msg28834 = msg("26729", dup321); + +var msg28835 = msg("26730", dup321); + +var msg28836 = msg("26731", dup321); + +var msg28837 = msg("26732", dup321); + +var msg28838 = msg("26733", dup321); + +var msg28839 = msg("26734", dup321); + +var msg28840 = msg("26735", dup321); + +var msg28841 = msg("26736", dup334); + +var msg28842 = msg("26737", dup321); + +var msg28843 = msg("26738", dup321); + +var msg28844 = msg("26739", dup321); + +var msg28845 = msg("26740", dup321); + +var msg28846 = msg("26741", dup311); + +var msg28847 = msg("26742", dup321); + +var msg28848 = msg("26743", dup324); + +var msg28849 = msg("26744", dup321); + +var msg28850 = msg("26745", dup333); + +var msg28851 = msg("26746", dup321); + +var msg28852 = msg("26747", dup324); + +var msg28853 = msg("26748", dup321); + +var msg28854 = msg("26749", dup321); + +var msg28855 = msg("26750", dup321); + +var msg28856 = msg("26751", dup325); + +var msg28857 = msg("26752", dup310); + +var msg28858 = msg("26753", dup325); + +var msg28859 = msg("26754", dup325); + +var msg28860 = msg("26755", dup309); + +var msg28861 = msg("26756", dup321); + +var msg28862 = msg("26757", dup321); + +var msg28863 = msg("26758", dup321); + +var msg28864 = msg("26759", dup323); + +var msg28865 = msg("26760", dup321); + +var msg28866 = msg("26761", dup321); + +var msg28867 = msg("26762", dup321); + +var msg28868 = msg("26763", dup321); + +var msg28869 = msg("26764", dup314); + +var msg28870 = msg("26765", dup314); + +var msg28871 = msg("26766", dup314); + +var msg28872 = msg("26767", dup314); + +var msg28873 = msg("26768", dup321); + +var msg28874 = msg("26769", dup324); + +var msg28875 = msg("26770", dup321); + +var msg28876 = msg("26771", dup321); + +var msg28877 = msg("26772", dup311); + +var msg28878 = msg("26773", dup321); + +var msg28879 = msg("26774", dup321); + +var msg28880 = msg("26775", dup321); + +var msg28881 = msg("26776", dup321); + +var msg28882 = msg("26777", dup321); + +var msg28883 = msg("26778", dup321); + +var msg28884 = msg("26779", dup321); + +var msg28885 = msg("26780", dup310); + +var msg28886 = msg("26781", dup321); + +var msg28887 = msg("26782", dup321); + +var msg28888 = msg("26783", dup321); + +var msg28889 = msg("26784", dup321); + +var msg28890 = msg("26785", dup321); + +var msg28891 = msg("26786", dup316); + +var msg28892 = msg("26787", dup316); + +var msg28893 = msg("26788", dup316); + +var msg28894 = msg("26789", dup316); + +var msg28895 = msg("26790", dup316); + +var msg28896 = msg("26791", dup316); + +var msg28897 = msg("26792", dup321); + +var msg28898 = msg("26793", dup321); + +var msg28899 = msg("26794", dup314); + +var msg28900 = msg("26795", dup321); + +var msg28901 = msg("26796", dup321); + +var msg28902 = msg("26797", dup314); + +var msg28903 = msg("26798", dup314); + +var msg28904 = msg("26799", dup309); + +var msg28905 = msg("26800", dup309); + +var msg28906 = msg("26801", dup309); + +var msg28907 = msg("26802", dup335); + +var msg28908 = msg("26803", dup321); + +var msg28909 = msg("26804", dup311); + +var msg28910 = msg("26805", dup311); + +var msg28911 = msg("26806", dup311); + +var msg28912 = msg("26807", dup311); + +var msg28913 = msg("26808", dup311); + +var msg28914 = msg("26809", dup321); + +var msg28915 = msg("26810", dup321); + +var msg28916 = msg("26811", dup321); + +var msg28917 = msg("26812", dup321); + +var msg28918 = msg("26813", dup321); + +var msg28919 = msg("26814", dup311); + +var msg28920 = msg("26815", dup321); + +var msg28921 = msg("26816", dup321); + +var msg28922 = msg("26817", dup323); + +var msg28923 = msg("26818", dup321); + +var msg28924 = msg("26819", dup321); + +var msg28925 = msg("26820", dup321); + +var msg28926 = msg("26821", dup321); + +var msg28927 = msg("26822", dup321); + +var msg28928 = msg("26823", dup321); + +var msg28929 = msg("26824", dup311); + +var msg28930 = msg("26825", dup311); + +var msg28931 = msg("26826", dup321); + +var msg28932 = msg("26827", dup321); + +var msg28933 = msg("26828", dup321); + +var msg28934 = msg("26829", dup322); + +var msg28935 = msg("26830", dup309); + +var msg28936 = msg("26831", dup309); + +var msg28937 = msg("26832", dup309); + +var msg28938 = msg("26833", dup309); + +var msg28939 = msg("26834", dup311); + +var msg28940 = msg("26835", dup321); + +var msg28941 = msg("26836", dup321); + +var msg28942 = msg("26837", dup321); + +var msg28943 = msg("26838", dup311); + +var msg28944 = msg("26839", dup321); + +var msg28945 = msg("26840", dup321); + +var msg28946 = msg("26841", dup321); + +var msg28947 = msg("26842", dup321); + +var msg28948 = msg("26843", dup314); + +var msg28949 = msg("26844", dup311); + +var msg28950 = msg("26845", dup325); + +var msg28951 = msg("26846", dup325); + +var msg28952 = msg("26847", dup325); + +var msg28953 = msg("26848", dup325); + +var msg28954 = msg("26849", dup323); + +var msg28955 = msg("26850", dup314); + +var msg28956 = msg("26851", dup314); + +var msg28957 = msg("26852", dup311); + +var msg28958 = msg("26853", dup311); + +var msg28959 = msg("26854", dup309); + +var msg28960 = msg("26855", dup309); + +var msg28961 = msg("26856", dup309); + +var msg28962 = msg("26857", dup309); + +var msg28963 = msg("26858", dup309); + +var msg28964 = msg("26859", dup309); + +var msg28965 = msg("26860", dup309); + +var msg28966 = msg("26861", dup309); + +var msg28967 = msg("26862", dup309); + +var msg28968 = msg("26863", dup309); + +var msg28969 = msg("26864", dup309); + +var msg28970 = msg("26865", dup307); + +var msg28971 = msg("26866", dup309); + +var msg28972 = msg("26867", dup325); + +var msg28973 = msg("26868", dup325); + +var msg28974 = msg("26869", dup311); + +var msg28975 = msg("26870", dup311); + +var msg28976 = msg("26871", dup311); + +var msg28977 = msg("26872", dup311); + +var msg28978 = msg("26873", dup325); + +var msg28979 = msg("26874", dup325); + +var msg28980 = msg("26875", dup325); + +var msg28981 = msg("26876", dup325); + +var msg28982 = msg("26877", dup323); + +var msg28983 = msg("26878", dup325); + +var msg28984 = msg("26879", dup314); + +var msg28985 = msg("26880", dup321); + +var msg28986 = msg("26881", dup321); + +var msg28987 = msg("26882", dup325); + +var msg28988 = msg("26883", dup325); + +var msg28989 = msg("26884", dup325); + +var msg28990 = msg("26885", dup325); + +var msg28991 = msg("26886", dup325); + +var msg28992 = msg("26887", dup325); + +var msg28993 = msg("26888", dup311); + +var msg28994 = msg("26889", dup311); + +var msg28995 = msg("26890", dup325); + +var msg28996 = msg("26891", dup311); + +var msg28997 = msg("26892", dup311); + +var msg28998 = msg("26893", dup311); + +var msg28999 = msg("26894", dup311); + +var msg29000 = msg("26895", dup311); + +var msg29001 = msg("26896", dup311); + +var msg29002 = msg("26897", dup311); + +var msg29003 = msg("26898", dup322); + +var msg29004 = msg("26899", dup322); + +var msg29005 = msg("26900", dup322); + +var msg29006 = msg("26901", dup322); + +var msg29007 = msg("26902", dup314); + +var msg29008 = msg("26903", dup314); + +var msg29009 = msg("26904", dup314); + +var msg29010 = msg("26905", dup324); + +var msg29011 = msg("26906", dup311); + +var msg29012 = msg("26907", dup311); + +var msg29013 = msg("26908", dup311); + +var msg29014 = msg("26909", dup314); + +var msg29015 = msg("26910", dup321); + +var msg29016 = msg("26911", dup321); + +var msg29017 = msg("26912", dup321); + +var msg29018 = msg("26913", dup321); + +var msg29019 = msg("26914", dup321); + +var msg29020 = msg("26915", dup321); + +var msg29021 = msg("26916", dup321); + +var msg29022 = msg("26917", dup321); + +var msg29023 = msg("26918", dup321); + +var msg29024 = msg("26919", dup321); + +var msg29025 = msg("26920", dup321); + +var msg29026 = msg("26921", dup321); + +var msg29027 = msg("26922", dup311); + +var msg29028 = msg("26923", dup321); + +var msg29029 = msg("26924", dup321); + +var msg29030 = msg("26925", dup322); + +var msg29031 = msg("26926", dup323); + +var msg29032 = msg("26927", dup309); + +var msg29033 = msg("26928", dup309); + +var msg29034 = msg("26929", dup311); + +var msg29035 = msg("26930", dup321); + +var msg29036 = msg("26931", dup321); + +var msg29037 = msg("26932", dup321); + +var msg29038 = msg("26933", dup321); + +var msg29039 = msg("26934", dup321); + +var msg29040 = msg("26935", dup311); + +var msg29041 = msg("26936", dup311); + +var msg29042 = msg("26937", dup311); + +var msg29043 = msg("26938", dup314); + +var msg29044 = msg("26939", dup314); + +var msg29045 = msg("26940", dup323); + +var msg29046 = msg("26941", dup323); + +var msg29047 = msg("26942", dup323); + +var msg29048 = msg("26943", dup321); + +var msg29049 = msg("26944", dup321); + +var msg29050 = msg("26945", dup321); + +var msg29051 = msg("26946", dup321); + +var msg29052 = msg("26947", dup311); + +var msg29053 = msg("26948", dup311); + +var msg29054 = msg("26949", dup311); + +var msg29055 = msg("26950", dup311); + +var msg29056 = msg("26951", dup311); + +var msg29057 = msg("26952", dup321); + +var msg29058 = msg("26953", dup311); + +var msg29059 = msg("26954", dup321); + +var msg29060 = msg("26955", dup321); + +var msg29061 = msg("26956", dup311); + +var msg29062 = msg("26957", dup311); + +var msg29063 = msg("26958", dup311); + +var msg29064 = msg("26959", dup311); + +var msg29065 = msg("26960", dup311); + +var msg29066 = msg("26961", dup311); + +var msg29067 = msg("26962", dup311); + +var msg29068 = msg("26963", dup311); + +var msg29069 = msg("26964", dup311); + +var msg29070 = msg("26965", dup321); + +var msg29071 = msg("26966", dup321); + +var msg29072 = msg("26967", dup321); + +var msg29073 = msg("26968", dup321); + +var msg29074 = msg("26969", dup321); + +var msg29075 = msg("26970", dup321); + +var msg29076 = msg("26971", dup321); + +var msg29077 = msg("26972", dup307); + +var msg29078 = msg("26973", dup309); + +var msg29079 = msg("26974", dup314); + +var msg29080 = msg("26975", dup314); + +var msg29081 = msg("26976", dup309); + +var msg29082 = msg("26977", dup309); + +var msg29083 = msg("26978", dup309); + +var msg29084 = msg("26979", dup309); + +var msg29085 = msg("26980", dup315); + +var msg29086 = msg("26981", dup324); + +var msg29087 = msg("26982", dup311); + +var msg29088 = msg("26983", dup311); + +var msg29089 = msg("26984", dup321); + +var msg29090 = msg("26985", dup311); + +var msg29091 = msg("26986", dup321); + +var msg29092 = msg("26987", dup321); + +var msg29093 = msg("26988", dup325); + +var msg29094 = msg("26989", dup323); + +var msg29095 = msg("26990", dup311); + +var msg29096 = msg("26991", dup311); + +var msg29097 = msg("26992", dup311); + +var msg29098 = msg("26993", dup314); + +var msg29099 = msg("26994", dup314); + +var msg29100 = msg("26995", dup321); + +var msg29101 = msg("26996", dup321); + +var msg29102 = msg("26997", dup321); + +var msg29103 = msg("26998", dup321); + +var msg29104 = msg("26999", dup321); + +var msg29105 = msg("27000", dup321); + +var msg29106 = msg("27001", dup309); + +var msg29107 = msg("27002", dup321); + +var msg29108 = msg("27003", dup321); + +var msg29109 = msg("27004", dup311); + +var msg29110 = msg("27005", dup311); + +var msg29111 = msg("27006", dup309); + +var msg29112 = msg("27007", dup321); + +var msg29113 = msg("27008", dup321); + +var msg29114 = msg("27009", dup321); + +var msg29115 = msg("27010", dup321); + +var msg29116 = msg("27011", dup321); + +var msg29117 = msg("27012", dup321); + +var msg29118 = msg("27013", dup321); + +var msg29119 = msg("27014", dup323); + +var msg29120 = msg("27015", dup325); + +var msg29121 = msg("27016", dup314); + +var msg29122 = msg("27017", dup321); + +var msg29123 = msg("27018", dup314); + +var msg29124 = msg("27019", dup314); + +var msg29125 = msg("27020", dup314); + +var msg29126 = msg("27021", dup321); + +var msg29127 = msg("27022", dup321); + +var msg29128 = msg("27023", dup321); + +var msg29129 = msg("27024", dup321); + +var msg29130 = msg("27025", dup321); + +var msg29131 = msg("27026", dup311); + +var msg29132 = msg("27027", dup311); + +var msg29133 = msg("27028", dup314); + +var msg29134 = msg("27029", dup314); + +var msg29135 = msg("27030", dup314); + +var msg29136 = msg("27031", dup314); + +var msg29137 = msg("27032", dup314); + +var msg29138 = msg("27033", dup321); + +var msg29139 = msg("27034", dup321); + +var msg29140 = msg("27035", dup321); + +var msg29141 = msg("27036", dup314); + +var msg29142 = msg("27037", dup314); + +var msg29143 = msg("27038", dup314); + +var msg29144 = msg("27039", dup321); + +var msg29145 = msg("27040", dup311); + +var msg29146 = msg("27041", dup311); + +var msg29147 = msg("27042", dup311); + +var msg29148 = msg("27043", dup321); + +var msg29149 = msg("27044", dup325); + +var msg29150 = msg("27045", dup321); + +var msg29151 = msg("27046", dup327); + +var msg29152 = msg("27047", dup314); + +var msg29153 = msg("27048", dup323); + +var msg29154 = msg("27049", dup321); + +var msg29155 = msg("27050", dup321); + +var msg29156 = msg("27051", dup321); + +var msg29157 = msg("27052", dup321); + +var msg29158 = msg("27053", dup321); + +var msg29159 = msg("27054", dup321); + +var msg29160 = msg("27055", dup321); + +var msg29161 = msg("27056", dup321); + +var msg29162 = msg("27057", dup321); + +var msg29163 = msg("27058", dup321); + +var msg29164 = msg("27059", dup321); + +var msg29165 = msg("27060", dup321); + +var msg29166 = msg("27061", dup311); + +var msg29167 = msg("27062", dup311); + +var msg29168 = msg("27063", dup311); + +var msg29169 = msg("27064", dup314); + +var msg29170 = msg("27065", dup321); + +var msg29171 = msg("27066", dup321); + +var msg29172 = msg("27067", dup311); + +var msg29173 = msg("27068", dup311); + +var msg29174 = msg("27069", dup311); + +var msg29175 = msg("27070", dup311); + +var msg29176 = msg("27071", dup311); + +var msg29177 = msg("27072", dup311); + +var msg29178 = msg("27073", dup311); + +var msg29179 = msg("27074", dup311); + +var msg29180 = msg("27075", dup311); + +var msg29181 = msg("27076", dup314); + +var msg29182 = msg("27077", dup314); + +var msg29183 = msg("27078", dup311); + +var msg29184 = msg("27079", dup311); + +var msg29185 = msg("27080", dup311); + +var msg29186 = msg("27081", dup311); + +var msg29187 = msg("27082", dup311); + +var msg29188 = msg("27083", dup311); + +var msg29189 = msg("27084", dup311); + +var msg29190 = msg("27085", dup307); + +var msg29191 = msg("27086", dup311); + +var msg29192 = msg("27087", dup311); + +var msg29193 = msg("27088", dup311); + +var msg29194 = msg("27089", dup309); + +var msg29195 = msg("27090", dup309); + +var msg29196 = msg("27091", dup321); + +var msg29197 = msg("27092", dup311); + +var msg29198 = msg("27093", dup321); + +var msg29199 = msg("27094", dup200); + +var msg29200 = msg("27095", dup200); + +var msg29201 = msg("27096", dup311); + +var msg29202 = msg("27097", dup200); + +var msg29203 = msg("27098", dup200); + +var msg29204 = msg("27099", dup200); + +var msg29205 = msg("27100", dup311); + +var msg29206 = msg("27101", dup311); + +var msg29207 = msg("27102", dup309); + +var msg29208 = msg("27103", dup309); + +var msg29209 = msg("27104", dup316); + +var msg29210 = msg("27105", dup316); + +var msg29211 = msg("27106", dup311); + +var msg29212 = msg("27107", dup311); + +var msg29213 = msg("27108", dup307); + +var msg29214 = msg("27109", dup311); + +var msg29215 = msg("27110", dup311); + +var msg29216 = msg("27111", dup314); + +var msg29217 = msg("27112", dup314); + +var msg29218 = msg("27113", dup311); + +var msg29219 = msg("27114", dup321); + +var msg29220 = msg("27115", dup311); + +var msg29221 = msg("27116", dup314); + +var msg29222 = msg("27117", dup314); + +var msg29223 = msg("27118", dup314); + +var msg29224 = msg("27119", dup307); + +var msg29225 = msg("27120", dup321); + +var msg29226 = msg("27121", dup314); + +var msg29227 = msg("27122", dup309); + +var msg29228 = msg("27123", dup309); + +var msg29229 = msg("27124", dup309); + +var msg29230 = msg("27125", dup309); + +var msg29231 = msg("27126", dup325); + +var msg29232 = msg("27127", dup325); + +var msg29233 = msg("27128", dup325); + +var msg29234 = msg("27129", dup325); + +var msg29235 = msg("27130", dup325); + +var msg29236 = msg("27131", dup325); + +var msg29237 = msg("27132", dup325); + +var msg29238 = msg("27133", dup325); + +var msg29239 = msg("27134", dup325); + +var msg29240 = msg("27135", dup325); + +var msg29241 = msg("27136", dup311); + +var msg29242 = msg("27137", dup311); + +var msg29243 = msg("27138", dup311); + +var msg29244 = msg("27139", dup311); + +var msg29245 = msg("27140", dup311); + +var msg29246 = msg("27141", dup311); + +var msg29247 = msg("27142", dup311); + +var msg29248 = msg("27143", dup311); + +var msg29249 = msg("27144", dup311); + +var msg29250 = msg("27145", dup321); + +var msg29251 = msg("27146", dup321); + +var msg29252 = msg("27147", dup325); + +var msg29253 = msg("27148", dup325); + +var msg29254 = msg("27149", dup325); + +var msg29255 = msg("27150", dup325); + +var msg29256 = msg("27151", dup325); + +var msg29257 = msg("27152", dup325); + +var msg29258 = msg("27153", dup325); + +var msg29259 = msg("27154", dup325); + +var msg29260 = msg("27155", dup321); + +var msg29261 = msg("27156", dup309); + +var msg29262 = msg("27157", dup309); + +var msg29263 = msg("27158", dup321); + +var msg29264 = msg("27159", dup321); + +var msg29265 = msg("27160", dup321); + +var msg29266 = msg("27161", dup311); + +var msg29267 = msg("27162", dup311); + +var msg29268 = msg("27163", dup311); + +var msg29269 = msg("27164", dup311); + +var msg29270 = msg("27165", dup314); + +var msg29271 = msg("27166", dup309); + +var msg29272 = msg("27167", dup309); + +var msg29273 = msg("27168", dup309); + +var msg29274 = msg("27169", dup321); + +var msg29275 = msg("27170", dup309); + +var msg29276 = msg("27171", dup325); + +var msg29277 = msg("27172", dup325); + +var msg29278 = msg("27173", dup314); + +var msg29279 = msg("27174", dup314); + +var msg29280 = msg("27175", dup314); + +var msg29281 = msg("27176", dup314); + +var msg29282 = msg("27177", dup314); + +var msg29283 = msg("27178", dup321); + +var all56 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup111, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg29284 = msg("27179", all56); + +var msg29285 = msg("27180", dup321); + +var msg29286 = msg("27181", dup321); + +var msg29287 = msg("27182", dup325); + +var msg29288 = msg("27183", dup325); + +var msg29289 = msg("27184", dup325); + +var msg29290 = msg("27185", dup325); + +var msg29291 = msg("27186", dup325); + +var msg29292 = msg("27187", dup325); + +var msg29293 = msg("27188", dup314); + +var msg29294 = msg("27189", dup314); + +var msg29295 = msg("27190", dup314); + +var msg29296 = msg("27191", dup314); + +var msg29297 = msg("27192", dup314); + +var msg29298 = msg("27193", dup324); + +var msg29299 = msg("27194", dup324); + +var msg29300 = msg("27195", dup324); + +var msg29301 = msg("27196", dup314); + +var msg29302 = msg("27197", dup321); + +var msg29303 = msg("27198", dup321); + +var msg29304 = msg("27199", dup321); + +var msg29305 = msg("27200", dup321); + +var msg29306 = msg("27201", dup321); + +var msg29307 = msg("27202", dup310); + +var msg29308 = msg("27203", dup314); + +var msg29309 = msg("27204", dup321); + +var msg29310 = msg("27205", dup309); + +var msg29311 = msg("27206", dup314); + +var msg29312 = msg("27207", dup314); + +var msg29313 = msg("27208", dup309); + +var msg29314 = msg("27209", dup311); + +var msg29315 = msg("27210", dup323); + +var msg29316 = msg("27211", dup309); + +var msg29317 = msg("27212", dup309); + +var msg29318 = msg("27213", dup309); + +var msg29319 = msg("27214", dup309); + +var msg29320 = msg("27215", dup309); + +var msg29321 = msg("27216", dup309); + +var msg29322 = msg("27217", dup309); + +var msg29323 = msg("27218", dup314); + +var msg29324 = msg("27219", dup314); + +var msg29325 = msg("27220", dup311); + +var msg29326 = msg("27221", dup311); + +var msg29327 = msg("27222", dup311); + +var msg29328 = msg("27223", dup314); + +var msg29329 = msg("27224", dup314); + +var msg29330 = msg("27225", dup324); + +var msg29331 = msg("27226", dup314); + +var msg29332 = msg("27227", dup328); + +var msg29333 = msg("27228", dup321); + +var msg29334 = msg("27229", dup311); + +var msg29335 = msg("27230", dup314); + +var msg29336 = msg("27231", dup314); + +var msg29337 = msg("27232", dup309); + +var msg29338 = msg("27233", dup309); + +var msg29339 = msg("27234", dup324); + +var msg29340 = msg("27235", dup311); + +var msg29341 = msg("27236", dup309); + +var msg29342 = msg("27237", dup314); + +var msg29343 = msg("27238", dup314); + +var msg29344 = msg("27239", dup314); + +var msg29345 = msg("27240", dup323); + +var msg29346 = msg("27241", dup311); + +var msg29347 = msg("27242", dup311); + +var msg29348 = msg("27243", dup314); + +var msg29349 = msg("27244", dup314); + +var msg29350 = msg("27245", dup311); + +var msg29351 = msg("27246", dup321); + +var msg29352 = msg("27247", dup321); + +var msg29353 = msg("27248", dup321); + +var msg29354 = msg("27249", dup309); + +var msg29355 = msg("27250", dup309); + +var msg29356 = msg("27251", dup309); + +var msg29357 = msg("27252", dup321); + +var msg29358 = msg("27253", dup321); + +var msg29359 = msg("27254", dup321); + +var msg29360 = msg("27255", dup200); + +var msg29361 = msg("27256", dup321); + +var msg29362 = msg("27257", dup321); + +var msg29363 = msg("27258", dup314); + +var msg29364 = msg("27259", dup314); + +var msg29365 = msg("27260", dup321); + +var msg29366 = msg("27261", dup309); + +var msg29367 = msg("27262", dup309); + +var msg29368 = msg("27263", dup325); + +var msg29369 = msg("27264", dup309); + +var msg29370 = msg("27265", dup309); + +var msg29371 = msg("27266", dup309); + +var msg29372 = msg("27267", dup307); + +var msg29373 = msg("27268", dup307); + +var msg29374 = msg("27269", dup333); + +var msg29375 = msg("27270", dup333); + +var msg29376 = msg("27271", dup311); + +var msg29377 = msg("27272", dup314); + +var msg29378 = msg("27273", dup311); + +var msg29379 = msg("27274", dup311); + +var msg29380 = msg("27275", dup314); + +var msg29381 = msg("27276", dup314); + +var msg29382 = msg("27277", dup314); + +var msg29383 = msg("27278", dup309); + +var msg29384 = msg("27279", dup309); + +var msg29385 = msg("27280", dup309); + +var msg29386 = msg("27281", dup309); + +var msg29387 = msg("27282", dup314); + +var msg29388 = msg("27283", dup314); + +var msg29389 = msg("27284", dup314); + +var msg29390 = msg("27285", dup322); + +var msg29391 = msg("27286", dup322); + +var msg29392 = msg("27287", dup322); + +var msg29393 = msg("27288", dup322); + +var msg29394 = msg("27289", dup321); + +var msg29395 = msg("27290", dup321); + +var msg29396 = msg("27291", dup321); + +var msg29397 = msg("27292", dup321); + +var msg29398 = msg("27293", dup321); + +var msg29399 = msg("27294", dup321); + +var msg29400 = msg("27295", dup321); + +var msg29401 = msg("27296", dup321); + +var msg29402 = msg("27297", dup321); + +var msg29403 = msg("27298", dup321); + +var msg29404 = msg("27299", dup321); + +var msg29405 = msg("27300", dup321); + +var msg29406 = msg("27301", dup321); + +var msg29407 = msg("27302", dup321); + +var msg29408 = msg("27303", dup321); + +var msg29409 = msg("27304", dup321); + +var msg29410 = msg("27305", dup321); + +var msg29411 = msg("27306", dup321); + +var msg29412 = msg("27307", dup321); + +var msg29413 = msg("27308", dup321); + +var msg29414 = msg("27309", dup321); + +var msg29415 = msg("27310", dup321); + +var msg29416 = msg("27311", dup321); + +var msg29417 = msg("27312", dup321); + +var msg29418 = msg("27313", dup321); + +var msg29419 = msg("27314", dup321); + +var msg29420 = msg("27315", dup321); + +var msg29421 = msg("27316", dup321); + +var msg29422 = msg("27317", dup321); + +var msg29423 = msg("27318", dup321); + +var msg29424 = msg("27319", dup321); + +var msg29425 = msg("27320", dup321); + +var msg29426 = msg("27321", dup321); + +var msg29427 = msg("27322", dup321); + +var msg29428 = msg("27323", dup321); + +var msg29429 = msg("27324", dup321); + +var msg29430 = msg("27325", dup321); + +var msg29431 = msg("27326", dup321); + +var msg29432 = msg("27327", dup321); + +var msg29433 = msg("27328", dup321); + +var msg29434 = msg("27329", dup321); + +var msg29435 = msg("27330", dup321); + +var msg29436 = msg("27331", dup321); + +var msg29437 = msg("27332", dup321); + +var msg29438 = msg("27333", dup321); + +var msg29439 = msg("27334", dup321); + +var msg29440 = msg("27335", dup321); + +var msg29441 = msg("27336", dup321); + +var msg29442 = msg("27337", dup321); + +var msg29443 = msg("27338", dup321); + +var msg29444 = msg("27339", dup321); + +var msg29445 = msg("27340", dup321); + +var msg29446 = msg("27341", dup321); + +var msg29447 = msg("27342", dup321); + +var msg29448 = msg("27343", dup321); + +var msg29449 = msg("27344", dup321); + +var msg29450 = msg("27345", dup321); + +var msg29451 = msg("27346", dup321); + +var msg29452 = msg("27347", dup321); + +var msg29453 = msg("27348", dup321); + +var msg29454 = msg("27349", dup321); + +var msg29455 = msg("27350", dup321); + +var msg29456 = msg("27351", dup321); + +var msg29457 = msg("27352", dup321); + +var msg29458 = msg("27353", dup321); + +var msg29459 = msg("27354", dup321); + +var msg29460 = msg("27355", dup321); + +var msg29461 = msg("27356", dup321); + +var msg29462 = msg("27357", dup321); + +var msg29463 = msg("27358", dup321); + +var msg29464 = msg("27359", dup321); + +var msg29465 = msg("27360", dup321); + +var msg29466 = msg("27361", dup321); + +var msg29467 = msg("27362", dup321); + +var msg29468 = msg("27363", dup321); + +var msg29469 = msg("27364", dup321); + +var msg29470 = msg("27365", dup321); + +var msg29471 = msg("27366", dup321); + +var msg29472 = msg("27367", dup321); + +var msg29473 = msg("27368", dup321); + +var msg29474 = msg("27369", dup321); + +var msg29475 = msg("27370", dup321); + +var msg29476 = msg("27371", dup321); + +var msg29477 = msg("27372", dup321); + +var msg29478 = msg("27373", dup321); + +var msg29479 = msg("27374", dup321); + +var msg29480 = msg("27375", dup321); + +var msg29481 = msg("27376", dup321); + +var msg29482 = msg("27377", dup321); + +var msg29483 = msg("27378", dup321); + +var msg29484 = msg("27379", dup321); + +var msg29485 = msg("27380", dup321); + +var msg29486 = msg("27381", dup321); + +var msg29487 = msg("27382", dup321); + +var msg29488 = msg("27383", dup321); + +var msg29489 = msg("27384", dup321); + +var msg29490 = msg("27385", dup321); + +var msg29491 = msg("27386", dup321); + +var msg29492 = msg("27387", dup321); + +var msg29493 = msg("27388", dup321); + +var msg29494 = msg("27389", dup321); + +var msg29495 = msg("27390", dup321); + +var msg29496 = msg("27391", dup321); + +var msg29497 = msg("27392", dup321); + +var msg29498 = msg("27393", dup321); + +var msg29499 = msg("27394", dup321); + +var msg29500 = msg("27395", dup321); + +var msg29501 = msg("27396", dup321); + +var msg29502 = msg("27397", dup321); + +var msg29503 = msg("27398", dup321); + +var msg29504 = msg("27399", dup321); + +var msg29505 = msg("27400", dup321); + +var msg29506 = msg("27401", dup321); + +var msg29507 = msg("27402", dup321); + +var msg29508 = msg("27403", dup321); + +var msg29509 = msg("27404", dup321); + +var msg29510 = msg("27405", dup321); + +var msg29511 = msg("27406", dup321); + +var msg29512 = msg("27407", dup321); + +var msg29513 = msg("27408", dup321); + +var msg29514 = msg("27409", dup321); + +var msg29515 = msg("27410", dup321); + +var msg29516 = msg("27411", dup321); + +var msg29517 = msg("27412", dup321); + +var msg29518 = msg("27413", dup321); + +var msg29519 = msg("27414", dup321); + +var msg29520 = msg("27415", dup321); + +var msg29521 = msg("27416", dup321); + +var msg29522 = msg("27417", dup321); + +var msg29523 = msg("27418", dup321); + +var msg29524 = msg("27419", dup321); + +var msg29525 = msg("27420", dup321); + +var msg29526 = msg("27421", dup321); + +var msg29527 = msg("27422", dup321); + +var msg29528 = msg("27423", dup321); + +var msg29529 = msg("27424", dup321); + +var msg29530 = msg("27425", dup321); + +var msg29531 = msg("27426", dup321); + +var msg29532 = msg("27427", dup321); + +var msg29533 = msg("27428", dup321); + +var msg29534 = msg("27429", dup321); + +var msg29535 = msg("27430", dup321); + +var msg29536 = msg("27431", dup321); + +var msg29537 = msg("27432", dup321); + +var msg29538 = msg("27433", dup321); + +var msg29539 = msg("27434", dup321); + +var msg29540 = msg("27435", dup321); + +var msg29541 = msg("27436", dup321); + +var msg29542 = msg("27437", dup321); + +var msg29543 = msg("27438", dup321); + +var msg29544 = msg("27439", dup321); + +var msg29545 = msg("27440", dup321); + +var msg29546 = msg("27441", dup321); + +var msg29547 = msg("27442", dup321); + +var msg29548 = msg("27443", dup321); + +var msg29549 = msg("27444", dup321); + +var msg29550 = msg("27445", dup321); + +var msg29551 = msg("27446", dup321); + +var msg29552 = msg("27447", dup321); + +var msg29553 = msg("27448", dup321); + +var msg29554 = msg("27449", dup321); + +var msg29555 = msg("27450", dup321); + +var msg29556 = msg("27451", dup321); + +var msg29557 = msg("27452", dup321); + +var msg29558 = msg("27453", dup321); + +var msg29559 = msg("27454", dup321); + +var msg29560 = msg("27455", dup321); + +var msg29561 = msg("27456", dup321); + +var msg29562 = msg("27457", dup321); + +var msg29563 = msg("27458", dup321); + +var msg29564 = msg("27459", dup321); + +var msg29565 = msg("27460", dup321); + +var msg29566 = msg("27461", dup321); + +var msg29567 = msg("27462", dup321); + +var msg29568 = msg("27463", dup321); + +var msg29569 = msg("27464", dup321); + +var msg29570 = msg("27465", dup321); + +var msg29571 = msg("27466", dup321); + +var msg29572 = msg("27467", dup321); + +var msg29573 = msg("27468", dup321); + +var msg29574 = msg("27469", dup321); + +var msg29575 = msg("27470", dup321); + +var msg29576 = msg("27471", dup321); + +var msg29577 = msg("27472", dup321); + +var msg29578 = msg("27473", dup321); + +var msg29579 = msg("27474", dup321); + +var msg29580 = msg("27475", dup321); + +var msg29581 = msg("27476", dup321); + +var msg29582 = msg("27477", dup321); + +var msg29583 = msg("27478", dup321); + +var msg29584 = msg("27479", dup321); + +var msg29585 = msg("27480", dup321); + +var msg29586 = msg("27481", dup321); + +var msg29587 = msg("27482", dup321); + +var msg29588 = msg("27483", dup321); + +var msg29589 = msg("27484", dup321); + +var msg29590 = msg("27485", dup321); + +var msg29591 = msg("27486", dup321); + +var msg29592 = msg("27487", dup321); + +var msg29593 = msg("27488", dup321); + +var msg29594 = msg("27489", dup321); + +var msg29595 = msg("27490", dup321); + +var msg29596 = msg("27491", dup321); + +var msg29597 = msg("27492", dup321); + +var msg29598 = msg("27493", dup321); + +var msg29599 = msg("27494", dup321); + +var msg29600 = msg("27495", dup321); + +var msg29601 = msg("27496", dup321); + +var msg29602 = msg("27497", dup321); + +var msg29603 = msg("27498", dup321); + +var msg29604 = msg("27499", dup321); + +var msg29605 = msg("27500", dup321); + +var msg29606 = msg("27501", dup321); + +var msg29607 = msg("27502", dup321); + +var msg29608 = msg("27503", dup321); + +var msg29609 = msg("27504", dup321); + +var msg29610 = msg("27505", dup321); + +var msg29611 = msg("27506", dup321); + +var msg29612 = msg("27507", dup321); + +var msg29613 = msg("27508", dup321); + +var msg29614 = msg("27509", dup321); + +var msg29615 = msg("27510", dup321); + +var msg29616 = msg("27511", dup321); + +var msg29617 = msg("27512", dup321); + +var msg29618 = msg("27513", dup321); + +var msg29619 = msg("27514", dup321); + +var msg29620 = msg("27515", dup321); + +var msg29621 = msg("27516", dup321); + +var msg29622 = msg("27517", dup321); + +var msg29623 = msg("27518", dup321); + +var msg29624 = msg("27519", dup321); + +var msg29625 = msg("27520", dup321); + +var msg29626 = msg("27521", dup321); + +var msg29627 = msg("27522", dup321); + +var msg29628 = msg("27523", dup321); + +var msg29629 = msg("27524", dup321); + +var msg29630 = msg("27525", dup309); + +var msg29631 = msg("27526", dup309); + +var msg29632 = msg("27527", dup309); + +var msg29633 = msg("27528", dup309); + +var msg29634 = msg("27529", dup309); + +var msg29635 = msg("27530", dup309); + +var msg29636 = msg("27531", dup325); + +var msg29637 = msg("27532", dup311); + +var msg29638 = msg("27533", dup321); + +var msg29639 = msg("27534", dup321); + +var msg29640 = msg("27535", dup321); + +var msg29641 = msg("27536", dup323); + +var msg29642 = msg("27537", dup321); + +var msg29643 = msg("27538", dup321); + +var msg29644 = msg("27539", dup309); + +var msg29645 = msg("27540", dup329); + +var msg29646 = msg("27541", dup329); + +var msg29647 = msg("27542", dup314); + +var msg29648 = msg("27543", dup314); + +var msg29649 = msg("27544", dup321); + +var msg29650 = msg("27545", dup321); + +var msg29651 = msg("27546", dup321); + +var msg29652 = msg("27547", dup321); + +var msg29653 = msg("27548", dup321); + +var msg29654 = msg("27549", dup321); + +var msg29655 = msg("27550", dup311); + +var msg29656 = msg("27551", dup321); + +var msg29657 = msg("27552", dup311); + +var msg29658 = msg("27553", dup311); + +var msg29659 = msg("27554", dup311); + +var msg29660 = msg("27555", dup311); + +var msg29661 = msg("27556", dup311); + +var msg29662 = msg("27557", dup311); + +var msg29663 = msg("27558", dup321); + +var msg29664 = msg("27559", dup321); + +var msg29665 = msg("27560", dup321); + +var msg29666 = msg("27561", dup321); + +var msg29667 = msg("27562", dup321); + +var msg29668 = msg("27563", dup321); + +var msg29669 = msg("27564", dup333); + +var msg29670 = msg("27565", dup311); + +var msg29671 = msg("27566", dup321); + +var msg29672 = msg("27567", dup325); + +var msg29673 = msg("27568", dup311); + +var msg29674 = msg("27569", dup307); + +var msg29675 = msg("27570", dup314); + +var msg29676 = msg("27571", dup309); + +var msg29677 = msg("27572", dup311); + +var msg29678 = msg("27573", dup311); + +var msg29679 = msg("27574", dup311); + +var msg29680 = msg("27575", dup311); + +var msg29681 = msg("27576", dup309); + +var msg29682 = msg("27577", dup321); + +var msg29683 = msg("27578", dup200); + +var msg29684 = msg("27579", dup311); + +var msg29685 = msg("27580", dup307); + +var msg29686 = msg("27581", dup307); + +var msg29687 = msg("27582", dup307); + +var msg29688 = msg("27583", dup307); + +var msg29689 = msg("27584", dup307); + +var msg29690 = msg("27585", dup307); + +var msg29691 = msg("27586", dup307); + +var msg29692 = msg("27587", dup307); + +var msg29693 = msg("27588", dup307); + +var msg29694 = msg("27589", dup307); + +var msg29695 = msg("27590", dup307); + +var msg29696 = msg("27591", dup307); + +var msg29697 = msg("27592", dup311); + +var msg29698 = msg("27593", dup314); + +var msg29699 = msg("27594", dup321); + +var msg29700 = msg("27595", dup321); + +var msg29701 = msg("27596", dup321); + +var msg29702 = msg("27597", dup311); + +var msg29703 = msg("27598", dup316); + +var msg29704 = msg("27599", dup321); + +var msg29705 = msg("27600", dup321); + +var msg29706 = msg("27601", dup321); + +var msg29707 = msg("27602", dup311); + +var msg29708 = msg("27603", dup311); + +var msg29709 = msg("27604", dup326); + +var msg29710 = msg("27605", dup325); + +var msg29711 = msg("27606", dup325); + +var msg29712 = msg("27607", dup325); + +var msg29713 = msg("27608", dup309); + +var msg29714 = msg("27609", dup314); + +var msg29715 = msg("27610", dup334); + +var msg29716 = msg("27611", dup334); + +var msg29717 = msg("27612", dup325); + +var msg29718 = msg("27613", dup325); + +var msg29719 = msg("27614", dup325); + +var msg29720 = msg("27615", dup325); + +var msg29721 = msg("27616", dup325); + +var msg29722 = msg("27617", dup309); + +var msg29723 = msg("27618", dup309); + +var msg29724 = msg("27619", dup309); + +var msg29725 = msg("27620", dup325); + +var msg29726 = msg("27621", dup311); + +var msg29727 = msg("27622", dup311); + +var msg29728 = msg("27623", dup311); + +var msg29729 = msg("27624", dup334); + +var msg29730 = msg("27625", dup321); + +var msg29731 = msg("27626", dup333); + +var msg29732 = msg("27627", dup321); + +var msg29733 = msg("27628", dup321); + +var msg29734 = msg("27629", dup321); + +var msg29735 = msg("27630", dup321); + +var msg29736 = msg("27631", dup321); + +var msg29737 = msg("27632", dup321); + +var msg29738 = msg("27633", dup321); + +var msg29739 = msg("27634", dup309); + +var msg29740 = msg("27635", dup309); + +var msg29741 = msg("27636", dup321); + +var msg29742 = msg("27637", dup321); + +var msg29743 = msg("27638", dup314); + +var msg29744 = msg("27639", dup323); + +var msg29745 = msg("27640", dup321); + +var msg29746 = msg("27641", dup321); + +var msg29747 = msg("27642", dup321); + +var msg29748 = msg("27643", dup321); + +var msg29749 = msg("27644", dup321); + +var msg29750 = msg("27645", dup321); + +var msg29751 = msg("27646", dup309); + +var msg29752 = msg("27647", dup321); + +var msg29753 = msg("27648", dup321); + +var msg29754 = msg("27649", dup321); + +var msg29755 = msg("27650", dup321); + +var msg29756 = msg("27651", dup321); + +var msg29757 = msg("27652", dup321); + +var msg29758 = msg("27653", dup321); + +var msg29759 = msg("27654", dup321); + +var msg29760 = msg("27655", dup321); + +var msg29761 = msg("27656", dup311); + +var msg29762 = msg("27657", dup311); + +var msg29763 = msg("27658", dup311); + +var msg29764 = msg("27659", dup321); + +var msg29765 = msg("27660", dup321); + +var msg29766 = msg("27661", dup321); + +var msg29767 = msg("27662", dup321); + +var msg29768 = msg("27663", dup325); + +var msg29769 = msg("27664", dup321); + +var msg29770 = msg("27665", dup321); + +var msg29771 = msg("27666", dup324); + +var msg29772 = msg("27667", dup314); + +var msg29773 = msg("27668", dup314); + +var msg29774 = msg("27669", dup314); + +var msg29775 = msg("27670", dup321); + +var msg29776 = msg("27671", dup309); + +var msg29777 = msg("27672", dup311); + +var msg29778 = msg("27673", dup311); + +var msg29779 = msg("27674", dup311); + +var msg29780 = msg("27675", dup311); + +var msg29781 = msg("27676", dup311); + +var msg29782 = msg("27677", dup311); + +var msg29783 = msg("27678", dup321); + +var msg29784 = msg("27679", dup321); + +var msg29785 = msg("27680", dup321); + +var msg29786 = msg("27681", dup322); + +var msg29787 = msg("27682", dup322); + +var msg29788 = msg("27683", dup322); + +var msg29789 = msg("27684", dup322); + +var msg29790 = msg("27685", dup322); + +var msg29791 = msg("27686", dup322); + +var msg29792 = msg("27687", dup322); + +var msg29793 = msg("27688", dup314); + +var msg29794 = msg("27689", dup330); + +var msg29795 = msg("27690", dup330); + +var msg29796 = msg("27691", dup309); + +var msg29797 = msg("27692", dup309); + +var msg29798 = msg("27693", dup309); + +var msg29799 = msg("27694", dup309); + +var msg29800 = msg("27695", dup311); + +var msg29801 = msg("27696", dup311); + +var msg29802 = msg("27697", dup311); + +var msg29803 = msg("27698", dup333); + +var msg29804 = msg("27699", dup321); + +var msg29805 = msg("27700", dup327); + +var msg29806 = msg("27701", dup311); + +var msg29807 = msg("27702", dup311); + +var msg29808 = msg("27703", dup311); + +var msg29809 = msg("27704", dup311); + +var msg29810 = msg("27705", dup311); + +var msg29811 = msg("27706", dup311); + +var msg29812 = msg("27707", dup321); + +var msg29813 = msg("27708", dup321); + +var msg29814 = msg("27709", dup325); + +var msg29815 = msg("27710", dup325); + +var msg29816 = msg("27711", dup321); + +var msg29817 = msg("27712", dup311); + +var msg29818 = msg("27713", dup311); + +var msg29819 = msg("27714", dup311); + +var msg29820 = msg("27715", dup311); + +var msg29821 = msg("27716", dup311); + +var msg29822 = msg("27717", dup311); + +var msg29823 = msg("27718", dup309); + +var msg29824 = msg("27719", dup309); + +var msg29825 = msg("27720", dup321); + +var msg29826 = msg("27721", dup311); + +var msg29827 = msg("27722", dup311); + +var msg29828 = msg("27723", dup322); + +var msg29829 = msg("27724", dup322); + +var msg29830 = msg("27725", dup335); + +var msg29831 = msg("27726", dup324); + +var msg29832 = msg("27727", dup324); + +var msg29833 = msg("27728", dup324); + +var msg29834 = msg("27729", dup314); + +var msg29835 = msg("27730", dup314); + +var msg29836 = msg("27731", dup314); + +var msg29837 = msg("27732", dup314); + +var msg29838 = msg("27733", dup307); + +var msg29839 = msg("27734", dup307); + +var msg29840 = msg("27735", dup311); + +var msg29841 = msg("27736", dup311); + +var msg29842 = msg("27737", dup311); + +var msg29843 = msg("27738", dup307); + +var msg29844 = msg("27739", dup307); + +var msg29845 = msg("27740", dup307); + +var msg29846 = msg("27741", dup307); + +var msg29847 = msg("27742", dup309); + +var msg29848 = msg("27743", dup309); + +var msg29849 = msg("27744", dup309); + +var msg29850 = msg("27745", dup309); + +var msg29851 = msg("27746", dup321); + +var msg29852 = msg("27747", dup321); + +var msg29853 = msg("27748", dup322); + +var msg29854 = msg("27749", dup322); + +var msg29855 = msg("27750", dup309); + +var msg29856 = msg("27751", dup309); + +var msg29857 = msg("27752", dup322); + +var msg29858 = msg("27753", dup322); + +var msg29859 = msg("27754", dup309); + +var msg29860 = msg("27755", dup309); + +var msg29861 = msg("27756", dup311); + +var msg29862 = msg("27757", dup314); + +var msg29863 = msg("27758", dup314); + +var msg29864 = msg("27759", dup321); + +var msg29865 = msg("27760", dup314); + +var msg29866 = msg("27761", dup314); + +var msg29867 = msg("27762", dup314); + +var msg29868 = msg("27763", dup314); + +var msg29869 = msg("27764", dup309); + +var msg29870 = msg("27765", dup309); + +var msg29871 = msg("27766", dup314); + +var msg29872 = msg("27767", dup314); + +var msg29873 = msg("27768", dup314); + +var msg29874 = msg("27769", dup309); + +var msg29875 = msg("27770", dup309); + +var msg29876 = msg("27771", dup309); + +var msg29877 = msg("27772", dup309); + +var msg29878 = msg("27773", dup309); + +var msg29879 = msg("27774", dup321); + +var msg29880 = msg("27775", dup321); + +var msg29881 = msg("27776", dup307); + +var msg29882 = msg("27777", dup311); + +var msg29883 = msg("27778", dup307); + +var msg29884 = msg("27779", dup307); + +var msg29885 = msg("27780", dup307); + +var msg29886 = msg("27781", dup314); + +var msg29887 = msg("27782", dup314); + +var msg29888 = msg("27783", dup311); + +var msg29889 = msg("27784", dup311); + +var msg29890 = msg("27785", dup311); + +var msg29891 = msg("27786", dup309); + +var msg29892 = msg("27787", dup309); + +var msg29893 = msg("27788", dup314); + +var msg29894 = msg("27789", dup314); + +var msg29895 = msg("27790", dup314); + +var msg29896 = msg("27791", dup314); + +var msg29897 = msg("27792", dup314); + +var msg29898 = msg("27793", dup314); + +var msg29899 = msg("27794", dup314); + +var msg29900 = msg("27795", dup314); + +var msg29901 = msg("27796", dup322); + +var msg29902 = msg("27797", dup322); + +var msg29903 = msg("27798", dup314); + +var msg29904 = msg("27799", dup314); + +var msg29905 = msg("27800", dup314); + +var msg29906 = msg("27801", dup321); + +var msg29907 = msg("27802", dup321); + +var msg29908 = msg("27803", dup321); + +var msg29909 = msg("27804", dup321); + +var msg29910 = msg("27805", dup321); + +var msg29911 = msg("27806", dup321); + +var msg29912 = msg("27807", dup311); + +var msg29913 = msg("27808", dup311); + +var msg29914 = msg("27809", dup311); + +var msg29915 = msg("27810", dup311); + +var msg29916 = msg("27811", dup321); + +var msg29917 = msg("27812", dup321); + +var msg29918 = msg("27813", dup311); + +var msg29919 = msg("27814", dup311); + +var msg29920 = msg("27815", dup311); + +var msg29921 = msg("27816", dup307); + +var msg29922 = msg("27817", dup321); + +var msg29923 = msg("27818", dup324); + +var msg29924 = msg("27819", dup324); + +var msg29925 = msg("27820", dup309); + +var msg29926 = msg("27821", dup309); + +var msg29927 = msg("27822", dup311); + +var msg29928 = msg("27823", dup325); + +var msg29929 = msg("27824", dup309); + +var msg29930 = msg("27825", dup309); + +var msg29931 = msg("27826", dup311); + +var msg29932 = msg("27827", dup311); + +var msg29933 = msg("27828", dup311); + +var msg29934 = msg("27829", dup325); + +var msg29935 = msg("27830", dup325); + +var msg29936 = msg("27831", dup323); + +var msg29937 = msg("27832", dup323); + +var msg29938 = msg("27833", dup323); + +var msg29939 = msg("27834", dup323); + +var msg29940 = msg("27835", dup325); + +var msg29941 = msg("27836", dup325); + +var msg29942 = msg("27837", dup325); + +var msg29943 = msg("27838", dup325); + +var msg29944 = msg("27839", dup325); + +var msg29945 = msg("27840", dup325); + +var msg29946 = msg("27841", dup325); + +var msg29947 = msg("27842", dup325); + +var msg29948 = msg("27843", dup325); + +var msg29949 = msg("27844", dup325); + +var msg29950 = msg("27845", dup311); + +var msg29951 = msg("27846", dup311); + +var msg29952 = msg("27847", dup314); + +var msg29953 = msg("27848", dup314); + +var msg29954 = msg("27849", dup314); + +var msg29955 = msg("27850", dup309); + +var msg29956 = msg("27851", dup309); + +var msg29957 = msg("27852", dup309); + +var msg29958 = msg("27853", dup309); + +var msg29959 = msg("27854", dup309); + +var msg29960 = msg("27855", dup309); + +var msg29961 = msg("27856", dup309); + +var msg29962 = msg("27857", dup309); + +var msg29963 = msg("27858", dup309); + +var msg29964 = msg("27859", dup309); + +var msg29965 = msg("27860", dup324); + +var msg29966 = msg("27861", dup314); + +var msg29967 = msg("27862", dup323); + +var msg29968 = msg("27863", dup311); + +var msg29969 = msg("27864", dup321); + +var msg29970 = msg("27865", dup311); + +var msg29971 = msg("27866", dup311); + +var msg29972 = msg("27867", dup321); + +var msg29973 = msg("27868", dup325); + +var msg29974 = msg("27869", dup314); + +var msg29975 = msg("27870", dup314); + +var msg29976 = msg("27871", dup314); + +var msg29977 = msg("27872", dup314); + +var msg29978 = msg("27873", dup311); + +var msg29979 = msg("27874", dup311); + +var msg29980 = msg("27875", dup311); + +var msg29981 = msg("27876", dup311); + +var msg29982 = msg("27877", dup311); + +var msg29983 = msg("27878", dup311); + +var msg29984 = msg("27879", dup311); + +var msg29985 = msg("27880", dup311); + +var msg29986 = msg("27881", dup311); + +var msg29987 = msg("27882", dup311); + +var msg29988 = msg("27883", dup311); + +var msg29989 = msg("27884", dup311); + +var msg29990 = msg("27885", dup311); + +var msg29991 = msg("27886", dup311); + +var msg29992 = msg("27887", dup311); + +var msg29993 = msg("27888", dup311); + +var msg29994 = msg("27889", dup311); + +var msg29995 = msg("27890", dup311); + +var msg29996 = msg("27891", dup311); + +var msg29997 = msg("27892", dup311); + +var msg29998 = msg("27893", dup311); + +var msg29999 = msg("27894", dup307); + +var msg30000 = msg("27895", dup307); + +var msg30001 = msg("27896", dup307); + +var msg30002 = msg("27897", dup307); + +var msg30003 = msg("27898", dup307); + +var msg30004 = msg("27899", dup323); + +var msg30005 = msg("27900", dup323); + +var msg30006 = msg("27901", dup311); + +var msg30007 = msg("27902", dup323); + +var msg30008 = msg("27903", dup311); + +var msg30009 = msg("27904", dup323); + +var msg30010 = msg("27905", dup321); + +var msg30011 = msg("27906", dup311); + +var msg30012 = msg("27907", dup311); + +var msg30013 = msg("27908", dup325); + +var msg30014 = msg("27909", dup325); + +var msg30015 = msg("27910", dup321); + +var msg30016 = msg("27911", dup311); + +var msg30017 = msg("27912", dup311); + +var msg30018 = msg("27913", dup321); + +var msg30019 = msg("27914", dup321); + +var msg30020 = msg("27915", dup321); + +var msg30021 = msg("27916", dup321); + +var msg30022 = msg("27917", dup321); + +var msg30023 = msg("27918", dup321); + +var msg30024 = msg("27919", dup321); + +var msg30025 = msg("27920", dup311); + +var msg30026 = msg("27921", dup316); + +var msg30027 = msg("27922", dup314); + +var msg30028 = msg("27923", dup314); + +var msg30029 = msg("27924", dup314); + +var msg30030 = msg("27925", dup314); + +var msg30031 = msg("27926", dup314); + +var msg30032 = msg("27927", dup314); + +var msg30033 = msg("27928", dup314); + +var msg30034 = msg("27929", dup314); + +var msg30035 = msg("27930", dup329); + +var msg30036 = msg("27931", dup329); + +var msg30037 = msg("27932", dup329); + +var msg30038 = msg("27933", dup314); + +var msg30039 = msg("27934", dup314); + +var msg30040 = msg("27935", dup311); + +var msg30041 = msg("27936", dup311); + +var msg30042 = msg("27937", dup314); + +var msg30043 = msg("27938", dup329); + +var msg30044 = msg("27939", dup321); + +var msg30045 = msg("27940", dup324); + +var msg30046 = msg("27941", dup314); + +var msg30047 = msg("27942", dup311); + +var msg30048 = msg("27943", dup311); + +var msg30049 = msg("27944", dup311); + +var msg30050 = msg("27945", dup309); + +var msg30051 = msg("27946", dup321); + +var msg30052 = msg("27947", dup309); + +var msg30053 = msg("27948", dup309); + +var msg30054 = msg("27949", dup321); + +var msg30055 = msg("27950", dup321); + +var msg30056 = msg("27951", dup321); + +var msg30057 = msg("27952", dup321); + +var msg30058 = msg("27953", dup321); + +var msg30059 = msg("27954", dup321); + +var msg30060 = msg("27955", dup321); + +var msg30061 = msg("27956", dup321); + +var msg30062 = msg("27957", dup321); + +var msg30063 = msg("27958", dup321); + +var msg30064 = msg("27959", dup321); + +var msg30065 = msg("27960", dup321); + +var msg30066 = msg("27961", dup321); + +var msg30067 = msg("27962", dup321); + +var msg30068 = msg("27963", dup321); + +var msg30069 = msg("27964", dup321); + +var msg30070 = msg("27965", dup321); + +var msg30071 = msg("27966", dup321); + +var msg30072 = msg("27967", dup321); + +var msg30073 = msg("27968", dup321); + +var msg30074 = msg("27969", dup321); + +var msg30075 = msg("27970", dup321); + +var msg30076 = msg("27971", dup321); + +var msg30077 = msg("27972", dup321); + +var msg30078 = msg("27973", dup321); + +var msg30079 = msg("27974", dup321); + +var msg30080 = msg("27975", dup321); + +var msg30081 = msg("27976", dup321); + +var msg30082 = msg("27977", dup321); + +var msg30083 = msg("27978", dup321); + +var msg30084 = msg("27979", dup321); + +var msg30085 = msg("27980", dup325); + +var msg30086 = msg("27981", dup325); + +var msg30087 = msg("27982", dup311); + +var msg30088 = msg("27983", dup323); + +var msg30089 = msg("27984", dup329); + +var msg30090 = msg("27985", dup329); + +var msg30091 = msg("27986", dup329); + +var msg30092 = msg("27987", dup329); + +var msg30093 = msg("27988", dup329); + +var msg30094 = msg("27989", dup329); + +var msg30095 = msg("27990", dup329); + +var msg30096 = msg("27991", dup329); + +var msg30097 = msg("27992", dup329); + +var msg30098 = msg("27993", dup329); + +var msg30099 = msg("27994", dup329); + +var msg30100 = msg("27995", dup329); + +var msg30101 = msg("27996", dup329); + +var msg30102 = msg("27997", dup329); + +var msg30103 = msg("27998", dup329); + +var msg30104 = msg("27999", dup314); + +var msg30105 = msg("28000", dup311); + +var msg30106 = msg("28001", dup323); + +var msg30107 = msg("28002", dup336); + +var msg30108 = msg("28003", dup336); + +var msg30109 = msg("28004", dup321); + +var msg30110 = msg("28005", dup321); + +var msg30111 = msg("28006", dup321); + +var msg30112 = msg("28007", dup321); + +var msg30113 = msg("28008", dup321); + +var msg30114 = msg("28009", dup321); + +var msg30115 = msg("28010", dup321); + +var msg30116 = msg("28011", dup321); + +var msg30117 = msg("28012", dup321); + +var msg30118 = msg("28013", dup311); + +var msg30119 = msg("28014", dup311); + +var msg30120 = msg("28015", dup337); + +var msg30121 = msg("28016", dup311); + +var msg30122 = msg("28017", dup311); + +var msg30123 = msg("28018", dup311); + +var msg30124 = msg("28019", dup311); + +var msg30125 = msg("28020", dup311); + +var msg30126 = msg("28021", dup311); + +var msg30127 = msg("28022", dup311); + +var msg30128 = msg("28023", dup311); + +var msg30129 = msg("28024", dup307); + +var msg30130 = msg("28025", dup307); + +var msg30131 = msg("28026", dup311); + +var msg30132 = msg("28027", dup311); + +var msg30133 = msg("28028", dup311); + +var msg30134 = msg("28029", dup311); + +var msg30135 = msg("28030", dup311); + +var msg30136 = msg("28031", dup311); + +var msg30137 = msg("28032", dup311); + +var msg30138 = msg("28033", dup321); + +var msg30139 = msg("28034", dup321); + +var msg30140 = msg("28035", dup321); + +var msg30141 = msg("28036", dup321); + +var msg30142 = msg("28037", dup311); + +var msg30143 = msg("28038", dup311); + +var msg30144 = msg("28039", dup337); + +var msg30145 = msg("28040", dup321); + +var msg30146 = msg("28041", dup310); + +var msg30147 = msg("28042", dup321); + +var msg30148 = msg("28043", dup311); + +var msg30149 = msg("28044", dup321); + +var msg30150 = msg("28045", dup321); + +var msg30151 = msg("28046", dup314); + +var msg30152 = msg("28047", dup307); + +var msg30153 = msg("28048", dup311); + +var msg30154 = msg("28049", dup311); + +var msg30155 = msg("28050", dup311); + +var msg30156 = msg("28051", dup311); + +var msg30157 = msg("28052", dup311); + +var msg30158 = msg("28053", dup321); + +var msg30159 = msg("28054", dup307); + +var msg30160 = msg("28055", dup200); + +var msg30161 = msg("28056", dup200); + +var msg30162 = msg("28057", dup200); + +var msg30163 = msg("28058", dup321); + +var msg30164 = msg("28059", dup321); + +var msg30165 = msg("28060", dup321); + +var msg30166 = msg("28061", dup321); + +var msg30167 = msg("28062", dup321); + +var msg30168 = msg("28063", dup321); + +var msg30169 = msg("28064", dup321); + +var msg30170 = msg("28065", dup321); + +var msg30171 = msg("28066", dup321); + +var msg30172 = msg("28067", dup321); + +var msg30173 = msg("28068", dup314); + +var msg30174 = msg("28069", dup321); + +var msg30175 = msg("28070", dup321); + +var msg30176 = msg("28071", dup310); + +var msg30177 = msg("28072", dup321); + +var msg30178 = msg("28073", dup321); + +var msg30179 = msg("28074", dup321); + +var msg30180 = msg("28075", dup321); + +var msg30181 = msg("28076", dup314); + +var msg30182 = msg("28077", dup321); + +var msg30183 = msg("28078", dup321); + +var msg30184 = msg("28079", dup321); + +var msg30185 = msg("28080", dup321); + +var msg30186 = msg("28081", dup200); + +var msg30187 = msg("28082", dup200); + +var msg30188 = msg("28083", dup311); + +var msg30189 = msg("28084", dup321); + +var msg30190 = msg("28085", dup321); + +var msg30191 = msg("28086", dup200); + +var msg30192 = msg("28087", dup200); + +var msg30193 = msg("28088", dup309); + +var msg30194 = msg("28089", dup323); + +var msg30195 = msg("28090", dup323); + +var msg30196 = msg("28093", dup314); + +var msg30197 = msg("28094", dup321); + +var msg30198 = msg("28095", dup321); + +var msg30199 = msg("28096", dup321); + +var msg30200 = msg("28097", dup321); + +var msg30201 = msg("28098", dup322); + +var msg30202 = msg("28099", dup322); + +var msg30203 = msg("28100", dup322); + +var msg30204 = msg("28101", dup322); + +var msg30205 = msg("28102", dup322); + +var msg30206 = msg("28103", dup309); + +var msg30207 = msg("28104", dup321); + +var msg30208 = msg("28105", dup321); + +var msg30209 = msg("28106", dup321); + +var msg30210 = msg("28107", dup321); + +var msg30211 = msg("28108", dup311); + +var msg30212 = msg("28109", dup311); + +var msg30213 = msg("28110", dup311); + +var msg30214 = msg("28111", dup311); + +var msg30215 = msg("28112", dup325); + +var msg30216 = msg("28113", dup309); + +var msg30217 = msg("28114", dup321); + +var msg30218 = msg("28115", dup321); + +var msg30219 = msg("28116", dup321); + +var msg30220 = msg("28117", dup321); + +var msg30221 = msg("28118", dup321); + +var msg30222 = msg("28119", dup321); + +var msg30223 = msg("28120", dup321); + +var msg30224 = msg("28121", dup321); + +var msg30225 = msg("28122", dup321); + +var msg30226 = msg("28123", dup321); + +var msg30227 = msg("28124", dup309); + +var msg30228 = msg("28125", dup321); + +var msg30229 = msg("28126", dup314); + +var msg30230 = msg("28127", dup314); + +var msg30231 = msg("28128", dup309); + +var msg30232 = msg("28129", dup309); + +var msg30233 = msg("28130", dup309); + +var msg30234 = msg("28131", dup309); + +var msg30235 = msg("28132", dup309); + +var msg30236 = msg("28133", dup309); + +var msg30237 = msg("28134", dup321); + +var msg30238 = msg("28135", dup309); + +var msg30239 = msg("28136", dup309); + +var msg30240 = msg("28137", dup309); + +var msg30241 = msg("28138", dup337); + +var msg30242 = msg("28139", dup311); + +var msg30243 = msg("28140", dup321); + +var msg30244 = msg("28141", dup321); + +var msg30245 = msg("28142", dup321); + +var msg30246 = msg("28143", dup321); + +var msg30247 = msg("28144", dup321); + +var msg30248 = msg("28145", dup314); + +var msg30249 = msg("28146", dup321); + +var msg30250 = msg("28147", dup321); + +var msg30251 = msg("28148", dup321); + +var msg30252 = msg("28149", dup314); + +var msg30253 = msg("28150", dup314); + +var msg30254 = msg("28151", dup325); + +var msg30255 = msg("28152", dup321); + +var msg30256 = msg("28153", dup321); + +var msg30257 = msg("28154", dup321); + +var msg30258 = msg("28155", dup321); + +var msg30259 = msg("28156", dup321); + +var msg30260 = msg("28157", dup311); + +var msg30261 = msg("28158", dup325); + +var msg30262 = msg("28159", dup325); + +var msg30263 = msg("28160", dup325); + +var msg30264 = msg("28161", dup324); + +var msg30265 = msg("28162", dup324); + +var msg30266 = msg("28163", dup311); + +var msg30267 = msg("28164", dup321); + +var msg30268 = msg("28165", dup323); + +var msg30269 = msg("28166", dup321); + +var msg30270 = msg("28167", dup321); + +var msg30271 = msg("28168", dup321); + +var msg30272 = msg("28169", dup321); + +var msg30273 = msg("28170", dup321); + +var msg30274 = msg("28171", dup321); + +var msg30275 = msg("28172", dup321); + +var msg30276 = msg("28173", dup321); + +var msg30277 = msg("28174", dup321); + +var msg30278 = msg("28175", dup321); + +var msg30279 = msg("28176", dup321); + +var msg30280 = msg("28177", dup321); + +var msg30281 = msg("28178", dup321); + +var msg30282 = msg("28179", dup321); + +var msg30283 = msg("28180", dup321); + +var msg30284 = msg("28181", dup321); + +var msg30285 = msg("28182", dup321); + +var msg30286 = msg("28183", dup321); + +var msg30287 = msg("28184", dup321); + +var msg30288 = msg("28185", dup321); + +var msg30289 = msg("28186", dup321); + +var msg30290 = msg("28187", dup321); + +var msg30291 = msg("28188", dup321); + +var msg30292 = msg("28189", dup321); + +var msg30293 = msg("28190", dup311); + +var msg30294 = msg("28191", dup325); + +var msg30295 = msg("28192", dup321); + +var msg30296 = msg("28193", dup321); + +var msg30297 = msg("28194", dup311); + +var msg30298 = msg("28195", dup311); + +var msg30299 = msg("28196", dup311); + +var msg30300 = msg("28197", dup311); + +var msg30301 = msg("28198", dup311); + +var msg30302 = msg("28199", dup311); + +var msg30303 = msg("28200", dup311); + +var msg30304 = msg("28201", dup314); + +var msg30305 = msg("28202", dup324); + +var msg30306 = msg("28203", dup324); + +var msg30307 = msg("28204", dup311); + +var msg30308 = msg("28205", dup309); + +var msg30309 = msg("28206", dup309); + +var msg30310 = msg("28207", dup311); + +var msg30311 = msg("28208", dup311); + +var msg30312 = msg("28209", dup321); + +var msg30313 = msg("28210", dup321); + +var msg30314 = msg("28211", dup321); + +var msg30315 = msg("28212", dup321); + +var msg30316 = msg("28213", dup311); + +var msg30317 = msg("28214", dup311); + +var msg30318 = msg("28215", dup311); + +var msg30319 = msg("28216", dup333); + +var msg30320 = msg("28217", dup321); + +var msg30321 = msg("28218", dup321); + +var msg30322 = msg("28219", dup321); + +var msg30323 = msg("28220", dup321); + +var msg30324 = msg("28221", dup321); + +var msg30325 = msg("28222", dup321); + +var msg30326 = msg("28223", dup321); + +var msg30327 = msg("28224", dup321); + +var msg30328 = msg("28225", dup321); + +var msg30329 = msg("28226", dup321); + +var msg30330 = msg("28227", dup309); + +var msg30331 = msg("28228", dup309); + +var msg30332 = msg("28229", dup321); + +var msg30333 = msg("28230", dup321); + +var msg30334 = msg("28231", dup323); + +var msg30335 = msg("28232", dup323); + +var msg30336 = msg("28233", dup311); + +var msg30337 = msg("28234", dup321); + +var msg30338 = msg("28235", dup311); + +var msg30339 = msg("28236", dup311); + +var msg30340 = msg("28237", dup311); + +var msg30341 = msg("28238", dup307); + +var msg30342 = msg("28239", dup321); + +var msg30343 = msg("28240", dup200); + +var msg30344 = msg("28241", dup321); + +var msg30345 = msg("28242", dup321); + +var msg30346 = msg("28243", dup321); + +var msg30347 = msg("28244", dup321); + +var msg30348 = msg("28245", dup314); + +var msg30349 = msg("28246", dup314); + +var msg30350 = msg("28247", dup321); + +var msg30351 = msg("28248", dup321); + +var msg30352 = msg("28249", dup321); + +var msg30353 = msg("28250", dup321); + +var msg30354 = msg("28251", dup322); + +var msg30355 = msg("28252", dup309); + +var msg30356 = msg("28253", dup321); + +var msg30357 = msg("28254", dup321); + +var msg30358 = msg("28255", dup321); + +var msg30359 = msg("28256", dup309); + +var msg30360 = msg("28257", dup311); + +var msg30361 = msg("28258", dup311); + +var msg30362 = msg("28259", dup311); + +var msg30363 = msg("28260", dup311); + +var msg30364 = msg("28261", dup309); + +var msg30365 = msg("28262", dup309); + +var msg30366 = msg("28263", dup309); + +var msg30367 = msg("28264", dup311); + +var msg30368 = msg("28265", dup311); + +var msg30369 = msg("28266", dup309); + +var msg30370 = msg("28267", dup325); + +var msg30371 = msg("28268", dup325); + +var msg30372 = msg("28269", dup325); + +var msg30373 = msg("28270", dup325); + +var msg30374 = msg("28271", dup325); + +var msg30375 = msg("28272", dup325); + +var msg30376 = msg("28273", dup311); + +var msg30377 = msg("28274", dup311); + +var msg30378 = msg("28275", dup311); + +var msg30379 = msg("28276", dup311); + +var msg30380 = msg("28277", dup311); + +var msg30381 = msg("28278", dup322); + +var msg30382 = msg("28279", dup321); + +var msg30383 = msg("28280", dup321); + +var msg30384 = msg("28281", dup321); + +var msg30385 = msg("28282", dup321); + +var msg30386 = msg("28283", dup321); + +var msg30387 = msg("28284", dup311); + +var msg30388 = msg("28285", dup321); + +var msg30389 = msg("28286", dup309); + +var msg30390 = msg("28287", dup311); + +var msg30391 = msg("28288", dup311); + +var msg30392 = msg("28289", dup311); + +var msg30393 = msg("28290", dup311); + +var msg30394 = msg("28291", dup311); + +var msg30395 = msg("28292", dup334); + +var msg30396 = msg("28293", dup324); + +var msg30397 = msg("28294", dup324); + +var msg30398 = msg("28295", dup324); + +var msg30399 = msg("28296", dup324); + +var msg30400 = msg("28297", dup321); + +var msg30401 = msg("28298", dup311); + +var msg30402 = msg("28299", dup322); + +var msg30403 = msg("28300", dup321); + +var msg30404 = msg("28303", dup309); + +var msg30405 = msg("28304", dup311); + +var msg30406 = msg("28305", dup321); + +var msg30407 = msg("28306", dup325); + +var msg30408 = msg("28309", dup311); + +var msg30409 = msg("28315", dup309); + +var msg30410 = msg("28323", dup321); + +var msg30411 = msg("28325", dup321); + +var msg30412 = msg("28326", dup321); + +var msg30413 = msg("28327", dup321); + +var msg30414 = msg("28328", dup321); + +var msg30415 = msg("28329", dup321); + +var msg30416 = msg("28330", dup321); + +var msg30417 = msg("28331", dup309); + +var msg30418 = msg("28332", dup309); + +var msg30419 = msg("28333", dup309); + +var msg30420 = msg("28334", dup309); + +var msg30421 = msg("28335", dup309); + +var msg30422 = msg("28336", dup309); + +var msg30423 = msg("28337", dup309); + +var msg30424 = msg("28338", dup309); + +var msg30425 = msg("28339", dup309); + +var msg30426 = msg("28340", dup309); + +var msg30427 = msg("28341", dup309); + +var msg30428 = msg("28342", dup309); + +var msg30429 = msg("28343", dup309); + +var msg30430 = msg("28344", dup322); + +var msg30431 = msg("28345", dup311); + +var msg30432 = msg("28346", dup311); + +var msg30433 = msg("28347", dup321); + +var msg30434 = msg("28348", dup321); + +var msg30435 = msg("28349", dup314); + +var msg30436 = msg("28350", dup314); + +var msg30437 = msg("28351", dup314); + +var msg30438 = msg("28352", dup311); + +var msg30439 = msg("28353", dup311); + +var msg30440 = msg("28354", dup311); + +var msg30441 = msg("28355", dup311); + +var msg30442 = msg("28356", dup311); + +var msg30443 = msg("28357", dup311); + +var msg30444 = msg("28358", dup311); + +var msg30445 = msg("28359", dup311); + +var msg30446 = msg("28360", dup311); + +var msg30447 = msg("28361", dup311); + +var msg30448 = msg("28362", dup325); + +var msg30449 = msg("28363", dup325); + +var msg30450 = msg("28364", dup325); + +var msg30451 = msg("28365", dup321); + +var msg30452 = msg("28366", dup321); + +var msg30453 = msg("28367", dup314); + +var msg30454 = msg("28368", dup314); + +var msg30455 = msg("28369", dup314); + +var msg30456 = msg("28370", dup314); + +var msg30457 = msg("28371", dup321); + +var msg30458 = msg("28372", dup321); + +var msg30459 = msg("28373", dup321); + +var msg30460 = msg("28374", dup311); + +var msg30461 = msg("28375", dup311); + +var msg30462 = msg("28376", dup311); + +var msg30463 = msg("28377", dup311); + +var msg30464 = msg("28378", dup311); + +var msg30465 = msg("28379", dup311); + +var msg30466 = msg("28380", dup311); + +var msg30467 = msg("28381", dup321); + +var msg30468 = msg("28382", dup314); + +var msg30469 = msg("28383", dup314); + +var msg30470 = msg("28384", dup314); + +var msg30471 = msg("28385", dup311); + +var msg30472 = msg("28386", dup314); + +var msg30473 = msg("28387", dup314); + +var msg30474 = msg("28388", dup311); + +var msg30475 = msg("28389", dup311); + +var msg30476 = msg("28390", dup309); + +var msg30477 = msg("28391", dup309); + +var msg30478 = msg("28392", dup309); + +var msg30479 = msg("28393", dup311); + +var msg30480 = msg("28394", dup311); + +var msg30481 = msg("28395", dup311); + +var msg30482 = msg("28396", dup311); + +var msg30483 = msg("28397", dup311); + +var msg30484 = msg("28398", dup311); + +var msg30485 = msg("28399", dup321); + +var msg30486 = msg("28400", dup321); + +var msg30487 = msg("28401", dup200); + +var msg30488 = msg("28402", dup200); + +var msg30489 = msg("28403", dup200); + +var msg30490 = msg("28404", dup321); + +var msg30491 = msg("28405", dup321); + +var msg30492 = msg("28406", dup321); + +var msg30493 = msg("28407", dup314); + +var msg30494 = msg("28408", dup311); + +var msg30495 = msg("28409", dup311); + +var msg30496 = msg("28410", dup321); + +var msg30497 = msg("28411", dup321); + +var msg30498 = msg("28412", dup311); + +var msg30499 = msg("28413", dup311); + +var msg30500 = msg("28414", dup311); + +var msg30501 = msg("28415", dup321); + +var msg30502 = msg("28416", dup321); + +var msg30503 = msg("28417", dup321); + +var msg30504 = msg("28418", dup321); + +var msg30505 = msg("28419", dup321); + +var msg30506 = msg("28420", dup311); + +var msg30507 = msg("28421", dup311); + +var msg30508 = msg("28422", dup311); + +var msg30509 = msg("28423", dup307); + +var msg30510 = msg("28424", dup311); + +var msg30511 = msg("28425", dup314); + +var msg30512 = msg("28426", dup311); + +var msg30513 = msg("28427", dup311); + +var msg30514 = msg("28428", dup311); + +var msg30515 = msg("28429", dup311); + +var msg30516 = msg("28430", dup307); + +var msg30517 = msg("28431", dup307); + +var msg30518 = msg("28432", dup307); + +var msg30519 = msg("28433", dup307); + +var msg30520 = msg("28434", dup307); + +var msg30521 = msg("28435", dup314); + +var msg30522 = msg("28436", dup314); + +var msg30523 = msg("28437", dup314); + +var msg30524 = msg("28438", dup314); + +var msg30525 = msg("28439", dup321); + +var msg30526 = msg("28440", dup309); + +var msg30527 = msg("28441", dup309); + +var msg30528 = msg("28442", dup309); + +var msg30529 = msg("28443", dup309); + +var msg30530 = msg("28444", dup321); + +var msg30531 = msg("28445", dup321); + +var msg30532 = msg("28446", dup321); + +var msg30533 = msg("28447", dup311); + +var msg30534 = msg("28448", dup314); + +var msg30535 = msg("28449", dup311); + +var msg30536 = msg("28450", dup311); + +var msg30537 = msg("28451", dup311); + +var msg30538 = msg("28452", dup311); + +var msg30539 = msg("28453", dup311); + +var msg30540 = msg("28454", dup311); + +var msg30541 = msg("28455", dup311); + +var msg30542 = msg("28456", dup311); + +var msg30543 = msg("28457", dup311); + +var msg30544 = msg("28458", dup311); + +var msg30545 = msg("28459", dup311); + +var msg30546 = msg("28460", dup311); + +var msg30547 = msg("28461", dup309); + +var msg30548 = msg("28462", dup309); + +var msg30549 = msg("28463", dup309); + +var msg30550 = msg("28464", dup309); + +var msg30551 = msg("28465", dup309); + +var msg30552 = msg("28466", dup309); + +var msg30553 = msg("28467", dup309); + +var msg30554 = msg("28468", dup309); + +var msg30555 = msg("28469", dup309); + +var msg30556 = msg("28470", dup309); + +var msg30557 = msg("28471", dup309); + +var msg30558 = msg("28472", dup309); + +var msg30559 = msg("28473", dup309); + +var msg30560 = msg("28474", dup311); + +var msg30561 = msg("28475", dup311); + +var msg30562 = msg("28476", dup311); + +var msg30563 = msg("28477", dup311); + +var msg30564 = msg("28478", dup311); + +var msg30565 = msg("28479", dup321); + +var msg30566 = msg("28480", dup333); + +var msg30567 = msg("28481", dup321); + +var msg30568 = msg("28482", dup321); + +var msg30569 = msg("28483", dup321); + +var msg30570 = msg("28484", dup321); + +var msg30571 = msg("28485", dup321); + +var msg30572 = msg("28486", dup321); + +var msg30573 = msg("28487", dup311); + +var msg30574 = msg("28488", dup311); + +var msg30575 = msg("28489", dup325); + +var msg30576 = msg("28490", dup311); + +var msg30577 = msg("28491", dup325); + +var msg30578 = msg("28492", dup325); + +var msg30579 = msg("28493", dup321); + +var msg30580 = msg("28494", dup311); + +var msg30581 = msg("28495", dup311); + +var msg30582 = msg("28496", dup325); + +var msg30583 = msg("28497", dup314); + +var msg30584 = msg("28498", dup309); + +var msg30585 = msg("28499", dup309); + +var msg30586 = msg("28500", dup314); + +var msg30587 = msg("28501", dup314); + +var msg30588 = msg("28502", dup309); + +var msg30589 = msg("28503", dup309); + +var msg30590 = msg("28504", dup325); + +var msg30591 = msg("28505", dup314); + +var msg30592 = msg("28506", dup314); + +var msg30593 = msg("28507", dup314); + +var msg30594 = msg("28508", dup314); + +var msg30595 = msg("28509", dup309); + +var msg30596 = msg("28510", dup309); + +var msg30597 = msg("28511", dup309); + +var msg30598 = msg("28512", dup309); + +var msg30599 = msg("28513", dup309); + +var msg30600 = msg("28514", dup309); + +var msg30601 = msg("28515", dup309); + +var msg30602 = msg("28516", dup309); + +var msg30603 = msg("28517", dup309); + +var msg30604 = msg("28518", dup309); + +var msg30605 = msg("28519", dup309); + +var msg30606 = msg("28520", dup309); + +var msg30607 = msg("28521", dup309); + +var msg30608 = msg("28522", dup325); + +var msg30609 = msg("28523", dup325); + +var msg30610 = msg("28524", dup325); + +var msg30611 = msg("28525", dup309); + +var msg30612 = msg("28526", dup309); + +var msg30613 = msg("28527", dup321); + +var msg30614 = msg("28528", dup321); + +var msg30615 = msg("28529", dup321); + +var msg30616 = msg("28530", dup314); + +var msg30617 = msg("28531", dup321); + +var msg30618 = msg("28532", dup324); + +var msg30619 = msg("28533", dup321); + +var msg30620 = msg("28534", dup307); + +var msg30621 = msg("28535", dup307); + +var msg30622 = msg("28536", dup307); + +var msg30623 = msg("28537", dup307); + +var msg30624 = msg("28538", dup321); + +var msg30625 = msg("28539", dup321); + +var msg30626 = msg("28540", dup321); + +var msg30627 = msg("28541", dup321); + +var msg30628 = msg("28542", dup321); + +var msg30629 = msg("28543", dup321); + +var msg30630 = msg("28544", dup309); + +var msg30631 = msg("28545", dup309); + +var msg30632 = msg("28546", dup309); + +var msg30633 = msg("28547", dup321); + +var msg30634 = msg("28548", dup321); + +var msg30635 = msg("28549", dup309); + +var msg30636 = msg("28550", dup309); + +var msg30637 = msg("28551", dup333); + +var msg30638 = msg("28552", dup336); + +var msg30639 = msg("28553", dup321); + +var msg30640 = msg("28554", dup321); + +var msg30641 = msg("28555", dup328); + +var msg30642 = msg("28556", dup329); + +var msg30643 = msg("28557", dup329); + +var msg30644 = msg("28558", dup325); + +var msg30645 = msg("28559", dup321); + +var msg30646 = msg("28560", dup333); + +var msg30647 = msg("28561", dup321); + +var msg30648 = msg("28562", dup321); + +var msg30649 = msg("28563", dup321); + +var msg30650 = msg("28564", dup321); + +var msg30651 = msg("28565", dup321); + +var msg30652 = msg("28566", dup314); + +var msg30653 = msg("28567", dup314); + +var msg30654 = msg("28568", dup311); + +var msg30655 = msg("28569", dup311); + +var msg30656 = msg("28570", dup314); + +var msg30657 = msg("28571", dup314); + +var msg30658 = msg("28572", dup314); + +var msg30659 = msg("28573", dup314); + +var msg30660 = msg("28574", dup314); + +var msg30661 = msg("28575", dup311); + +var msg30662 = msg("28576", dup311); + +var msg30663 = msg("28577", dup314); + +var msg30664 = msg("28578", dup314); + +var msg30665 = msg("28579", dup323); + +var msg30666 = msg("28580", dup323); + +var msg30667 = msg("28581", dup323); + +var msg30668 = msg("28582", dup323); + +var msg30669 = msg("28583", dup323); + +var msg30670 = msg("28584", dup323); + +var msg30671 = msg("28585", dup309); + +var msg30672 = msg("28586", dup309); + +var msg30673 = msg("28587", dup314); + +var msg30674 = msg("28588", dup314); + +var msg30675 = msg("28589", dup311); + +var msg30676 = msg("28590", dup311); + +var msg30677 = msg("28591", dup311); + +var msg30678 = msg("28592", dup311); + +var msg30679 = msg("28593", dup307); + +var msg30680 = msg("28594", dup311); + +var msg30681 = msg("28595", dup311); + +var msg30682 = msg("28596", dup311); + +var msg30683 = msg("28597", dup314); + +var msg30684 = msg("28598", dup314); + +var msg30685 = msg("28599", dup321); + +var msg30686 = msg("28600", dup314); + +var msg30687 = msg("28601", dup314); + +var msg30688 = msg("28602", dup314); + +var msg30689 = msg("28603", dup314); + +var msg30690 = msg("28604", dup321); + +var msg30691 = msg("28605", dup321); + +var msg30692 = msg("28606", dup321); + +var msg30693 = msg("28607", dup321); + +var msg30694 = msg("28608", dup311); + +var msg30695 = msg("28609", dup311); + +var msg30696 = msg("28610", dup311); + +var msg30697 = msg("28611", dup311); + +var msg30698 = msg("28612", dup311); + +var msg30699 = msg("28613", dup311); + +var msg30700 = msg("28614", dup311); + +var msg30701 = msg("28615", dup311); + +var msg30702 = msg("28616", dup311); + +var msg30703 = msg("28617", dup324); + +var msg30704 = msg("28618", dup324); + +var msg30705 = msg("28619", dup311); + +var msg30706 = msg("28620", dup311); + +var msg30707 = msg("28621", dup309); + +var msg30708 = msg("28622", dup311); + +var msg30709 = msg("28623", dup309); + +var msg30710 = msg("28624", dup309); + +var msg30711 = msg("28625", dup309); + +var msg30712 = msg("28626", dup309); + +var msg30713 = msg("28627", dup311); + +var msg30714 = msg("28628", dup311); + +var msg30715 = msg("28629", dup323); + +var msg30716 = msg("28630", dup323); + +var msg30717 = msg("28631", dup309); + +var msg30718 = msg("28632", dup309); + +var msg30719 = msg("28633", dup311); + +var msg30720 = msg("28634", dup309); + +var msg30721 = msg("28635", dup309); + +var msg30722 = msg("28636", dup311); + +var msg30723 = msg("28637", dup311); + +var msg30724 = msg("28638", dup309); + +var msg30725 = msg("28639", dup309); + +var msg30726 = msg("28640", dup309); + +var msg30727 = msg("28641", dup309); + +var msg30728 = msg("28642", dup311); + +var msg30729 = msg("28643", dup311); + +var msg30730 = msg("28644", dup311); + +var msg30731 = msg("28645", dup311); + +var msg30732 = msg("28646", dup311); + +var msg30733 = msg("28647", dup311); + +var msg30734 = msg("28648", dup311); + +var msg30735 = msg("28649", dup311); + +var msg30736 = msg("28650", dup311); + +var msg30737 = msg("28651", dup311); + +var msg30738 = msg("28652", dup311); + +var msg30739 = msg("28653", dup311); + +var msg30740 = msg("28654", dup311); + +var msg30741 = msg("28655", dup311); + +var msg30742 = msg("28656", dup311); + +var msg30743 = msg("28657", dup311); + +var msg30744 = msg("28658", dup314); + +var msg30745 = msg("28659", dup311); + +var msg30746 = msg("28660", dup311); + +var msg30747 = msg("28661", dup311); + +var msg30748 = msg("28662", dup311); + +var msg30749 = msg("28663", dup311); + +var msg30750 = msg("28664", dup309); + +var msg30751 = msg("28665", dup309); + +var msg30752 = msg("28666", dup309); + +var msg30753 = msg("28667", dup311); + +var msg30754 = msg("28668", dup311); + +var msg30755 = msg("28669", dup311); + +var msg30756 = msg("28670", dup311); + +var msg30757 = msg("28671", dup311); + +var msg30758 = msg("28672", dup311); + +var msg30759 = msg("28673", dup311); + +var msg30760 = msg("28674", dup311); + +var msg30761 = msg("28675", dup311); + +var msg30762 = msg("28676", dup311); + +var msg30763 = msg("28677", dup311); + +var msg30764 = msg("28678", dup311); + +var msg30765 = msg("28679", dup311); + +var msg30766 = msg("28680", dup311); + +var msg30767 = msg("28681", dup311); + +var msg30768 = msg("28682", dup311); + +var msg30769 = msg("28683", dup311); + +var msg30770 = msg("28684", dup311); + +var msg30771 = msg("28685", dup311); + +var msg30772 = msg("28686", dup311); + +var msg30773 = msg("28687", dup307); + +var msg30774 = msg("28688", dup307); + +var msg30775 = msg("28689", dup307); + +var msg30776 = msg("28690", dup307); + +var msg30777 = msg("28691", dup311); + +var msg30778 = msg("28692", dup311); + +var msg30779 = msg("28693", dup311); + +var msg30780 = msg("28694", dup311); + +var msg30781 = msg("28695", dup323); + +var msg30782 = msg("28696", dup323); + +var msg30783 = msg("28697", dup323); + +var msg30784 = msg("28698", dup323); + +var msg30785 = msg("28699", dup311); + +var msg30786 = msg("28700", dup311); + +var msg30787 = msg("28701", dup311); + +var msg30788 = msg("28702", dup311); + +var msg30789 = msg("28703", dup311); + +var msg30790 = msg("28704", dup311); + +var msg30791 = msg("28705", dup311); + +var msg30792 = msg("28706", dup311); + +var msg30793 = msg("28707", dup311); + +var msg30794 = msg("28708", dup311); + +var msg30795 = msg("28709", dup311); + +var msg30796 = msg("28710", dup309); + +var msg30797 = msg("28711", dup309); + +var msg30798 = msg("28712", dup309); + +var msg30799 = msg("28713", dup309); + +var msg30800 = msg("28714", dup309); + +var msg30801 = msg("28715", dup309); + +var msg30802 = msg("28716", dup311); + +var msg30803 = msg("28717", dup311); + +var msg30804 = msg("28718", dup311); + +var msg30805 = msg("28719", dup311); + +var msg30806 = msg("28720", dup311); + +var msg30807 = msg("28721", dup311); + +var msg30808 = msg("28722", dup323); + +var msg30809 = msg("28723", dup323); + +var msg30810 = msg("28724", dup321); + +var msg30811 = msg("28725", dup309); + +var msg30812 = msg("28726", dup309); + +var msg30813 = msg("28727", dup309); + +var msg30814 = msg("28728", dup311); + +var msg30815 = msg("28729", dup311); + +var msg30816 = msg("28730", dup311); + +var msg30817 = msg("28731", dup311); + +var msg30818 = msg("28732", dup311); + +var msg30819 = msg("28733", dup311); + +var msg30820 = msg("28734", dup311); + +var msg30821 = msg("28735", dup311); + +var msg30822 = msg("28736", dup311); + +var msg30823 = msg("28737", dup311); + +var msg30824 = msg("28738", dup311); + +var msg30825 = msg("28739", dup311); + +var msg30826 = msg("28740", dup311); + +var msg30827 = msg("28741", dup311); + +var msg30828 = msg("28742", dup311); + +var msg30829 = msg("28743", dup311); + +var msg30830 = msg("28744", dup309); + +var msg30831 = msg("28745", dup309); + +var msg30832 = msg("28746", dup311); + +var msg30833 = msg("28747", dup311); + +var msg30834 = msg("28748", dup311); + +var msg30835 = msg("28749", dup314); + +var msg30836 = msg("28750", dup314); + +var msg30837 = msg("28751", dup314); + +var msg30838 = msg("28752", dup314); + +var msg30839 = msg("28753", dup314); + +var msg30840 = msg("28754", dup314); + +var msg30841 = msg("28755", dup314); + +var msg30842 = msg("28756", dup314); + +var msg30843 = msg("28757", dup314); + +var msg30844 = msg("28758", dup314); + +var msg30845 = msg("28759", dup314); + +var msg30846 = msg("28760", dup314); + +var msg30847 = msg("28761", dup314); + +var msg30848 = msg("28762", dup314); + +var msg30849 = msg("28763", dup314); + +var msg30850 = msg("28764", dup314); + +var msg30851 = msg("28765", dup314); + +var msg30852 = msg("28766", dup314); + +var msg30853 = msg("28767", dup314); + +var msg30854 = msg("28768", dup314); + +var msg30855 = msg("28769", dup314); + +var msg30856 = msg("28770", dup314); + +var msg30857 = msg("28771", dup314); + +var msg30858 = msg("28772", dup314); + +var msg30859 = msg("28773", dup314); + +var msg30860 = msg("28774", dup314); + +var msg30861 = msg("28775", dup314); + +var msg30862 = msg("28776", dup314); + +var msg30863 = msg("28777", dup314); + +var msg30864 = msg("28778", dup314); + +var msg30865 = msg("28779", dup314); + +var msg30866 = msg("28780", dup314); + +var msg30867 = msg("28781", dup314); + +var msg30868 = msg("28782", dup314); + +var msg30869 = msg("28783", dup314); + +var msg30870 = msg("28784", dup314); + +var msg30871 = msg("28785", dup314); + +var msg30872 = msg("28786", dup314); + +var msg30873 = msg("28787", dup314); + +var msg30874 = msg("28788", dup314); + +var msg30875 = msg("28789", dup314); + +var msg30876 = msg("28790", dup311); + +var msg30877 = msg("28791", dup314); + +var msg30878 = msg("28792", dup314); + +var msg30879 = msg("28793", dup314); + +var msg30880 = msg("28794", dup309); + +var msg30881 = msg("28795", dup311); + +var msg30882 = msg("28796", dup311); + +var msg30883 = msg("28797", dup307); + +var msg30884 = msg("28798", dup307); + +var msg30885 = msg("28799", dup321); + +var msg30886 = msg("28800", dup321); + +var msg30887 = msg("28801", dup321); + +var msg30888 = msg("28802", dup321); + +var msg30889 = msg("28803", dup321); + +var msg30890 = msg("28804", dup321); + +var msg30891 = msg("28805", dup321); + +var msg30892 = msg("28806", dup321); + +var msg30893 = msg("28807", dup321); + +var msg30894 = msg("28808", dup321); + +var msg30895 = msg("28809", dup321); + +var msg30896 = msg("28810", dup321); + +var msg30897 = msg("28811", dup311); + +var msg30898 = msg("28812", dup311); + +var msg30899 = msg("28813", dup321); + +var msg30900 = msg("28814", dup321); + +var msg30901 = msg("28815", dup321); + +var msg30902 = msg("28816", dup321); + +var msg30903 = msg("28817", dup321); + +var msg30904 = msg("28818", dup307); + +var msg30905 = msg("28819", dup307); + +var msg30906 = msg("28820", dup323); + +var msg30907 = msg("28821", dup314); + +var msg30908 = msg("28822", dup314); + +var msg30909 = msg("28823", dup314); + +var msg30910 = msg("28824", dup314); + +var msg30911 = msg("28825", dup314); + +var msg30912 = msg("28826", dup314); + +var msg30913 = msg("28827", dup314); + +var msg30914 = msg("28828", dup321); + +var msg30915 = msg("28829", dup321); + +var msg30916 = msg("28830", dup321); + +var msg30917 = msg("28831", dup311); + +var msg30918 = msg("28832", dup311); + +var msg30919 = msg("28833", dup307); + +var msg30920 = msg("28834", dup307); + +var msg30921 = msg("28835", dup307); + +var msg30922 = msg("28836", dup311); + +var msg30923 = msg("28837", dup311); + +var msg30924 = msg("28838", dup311); + +var msg30925 = msg("28839", dup307); + +var msg30926 = msg("28840", dup307); + +var msg30927 = msg("28841", dup307); + +var msg30928 = msg("28842", dup311); + +var msg30929 = msg("28843", dup323); + +var msg30930 = msg("28844", dup323); + +var msg30931 = msg("28845", dup323); + +var msg30932 = msg("28846", dup323); + +var msg30933 = msg("28847", dup323); + +var msg30934 = msg("28848", dup323); + +var msg30935 = msg("28849", dup308); + +var msg30936 = msg("28850", dup311); + +var msg30937 = msg("28851", dup311); + +var msg30938 = msg("28852", dup325); + +var msg30939 = msg("28853", dup323); + +var msg30940 = msg("28854", dup311); + +var msg30941 = msg("28855", dup311); + +var msg30942 = msg("28856", dup321); + +var msg30943 = msg("28857", dup321); + +var msg30944 = msg("28858", dup321); + +var msg30945 = msg("28859", dup325); + +var msg30946 = msg("28860", dup325); + +var msg30947 = msg("28861", dup321); + +var msg30948 = msg("28862", dup325); + +var msg30949 = msg("28863", dup325); + +var msg30950 = msg("28864", dup321); + +var msg30951 = msg("28865", dup325); + +var msg30952 = msg("28866", dup325); + +var msg30953 = msg("28867", dup314); + +var msg30954 = msg("28868", dup314); + +var msg30955 = msg("28869", dup314); + +var msg30956 = msg("28870", dup314); + +var msg30957 = msg("28871", dup314); + +var msg30958 = msg("28872", dup314); + +var msg30959 = msg("28873", dup325); + +var msg30960 = msg("28874", dup325); + +var msg30961 = msg("28875", dup325); + +var msg30962 = msg("28876", dup325); + +var msg30963 = msg("28877", dup325); + +var msg30964 = msg("28878", dup325); + +var msg30965 = msg("28879", dup321); + +var msg30966 = msg("28880", dup311); + +var msg30967 = msg("28881", dup325); + +var msg30968 = msg("28882", dup325); + +var msg30969 = msg("28883", dup321); + +var msg30970 = msg("28884", dup321); + +var msg30971 = msg("28885", dup321); + +var msg30972 = msg("28886", dup321); + +var msg30973 = msg("28887", dup311); + +var msg30974 = msg("28888", dup311); + +var msg30975 = msg("28889", dup311); + +var msg30976 = msg("28890", dup311); + +var msg30977 = msg("28891", dup321); + +var msg30978 = msg("28892", dup321); + +var msg30979 = msg("28893", dup314); + +var msg30980 = msg("28894", dup314); + +var msg30981 = msg("28895", dup314); + +var msg30982 = msg("28896", dup314); + +var msg30983 = msg("28897", dup314); + +var msg30984 = msg("28898", dup314); + +var msg30985 = msg("28899", dup314); + +var msg30986 = msg("28900", dup314); + +var msg30987 = msg("28901", dup314); + +var msg30988 = msg("28902", dup309); + +var msg30989 = msg("28903", dup309); + +var msg30990 = msg("28904", dup309); + +var msg30991 = msg("28905", dup309); + +var msg30992 = msg("28906", dup309); + +var msg30993 = msg("28907", dup309); + +var msg30994 = msg("28908", dup322); + +var msg30995 = msg("28909", dup314); + +var msg30996 = msg("28910", dup311); + +var msg30997 = msg("28911", dup311); + +var msg30998 = msg("28912", dup314); + +var msg30999 = msg("28913", dup321); + +var msg31000 = msg("28914", dup321); + +var msg31001 = msg("28915", dup309); + +var msg31002 = msg("28916", dup309); + +var msg31003 = msg("28917", dup314); + +var msg31004 = msg("28918", dup321); + +var msg31005 = msg("28919", dup321); + +var msg31006 = msg("28920", dup311); + +var msg31007 = msg("28921", dup311); + +var msg31008 = msg("28922", dup311); + +var msg31009 = msg("28923", dup311); + +var msg31010 = msg("28924", dup311); + +var msg31011 = msg("28925", dup311); + +var msg31012 = msg("28926", dup309); + +var msg31013 = msg("28927", dup309); + +var msg31014 = msg("28928", dup321); + +var msg31015 = msg("28929", dup321); + +var msg31016 = msg("28930", dup321); + +var msg31017 = msg("28931", dup325); + +var msg31018 = msg("28932", dup325); + +var msg31019 = msg("28933", dup321); + +var msg31020 = msg("28934", dup321); + +var msg31021 = msg("28935", dup321); + +var msg31022 = msg("28936", dup314); + +var msg31023 = msg("28937", dup311); + +var msg31024 = msg("28938", dup321); + +var msg31025 = msg("28939", dup321); + +var msg31026 = msg("28940", dup325); + +var msg31027 = msg("28941", dup311); + +var msg31028 = msg("28942", dup314); + +var msg31029 = msg("28943", dup314); + +var msg31030 = msg("28944", dup314); + +var msg31031 = msg("28945", dup314); + +var msg31032 = msg("28946", dup311); + +var msg31033 = msg("28947", dup321); + +var msg31034 = msg("28948", dup321); + +var msg31035 = msg("28949", dup321); + +var msg31036 = msg("28950", dup325); + +var msg31037 = msg("28951", dup325); + +var msg31038 = msg("28952", dup311); + +var msg31039 = msg("28953", dup311); + +var msg31040 = msg("28954", dup321); + +var msg31041 = msg("28955", dup310); + +var msg31042 = msg("28956", dup314); + +var msg31043 = msg("28957", dup314); + +var msg31044 = msg("28958", dup321); + +var msg31045 = msg("28959", dup321); + +var msg31046 = msg("28960", dup321); + +var msg31047 = msg("28961", dup309); + +var msg31048 = msg("28962", dup309); + +var msg31049 = msg("28963", dup311); + +var msg31050 = msg("28964", dup307); + +var msg31051 = msg("28965", dup307); + +var msg31052 = msg("28966", dup311); + +var msg31053 = msg("28967", dup311); + +var msg31054 = msg("28968", dup311); + +var msg31055 = msg("28969", dup311); + +var msg31056 = msg("28970", dup314); + +var msg31057 = msg("28971", dup314); + +var msg31058 = msg("28972", dup311); + +var msg31059 = msg("28973", dup311); + +var msg31060 = msg("28974", dup311); + +var msg31061 = msg("28975", dup311); + +var msg31062 = msg("28976", dup321); + +var msg31063 = msg("28977", dup321); + +var msg31064 = msg("28978", dup321); + +var msg31065 = msg("28979", dup321); + +var msg31066 = msg("28980", dup321); + +var msg31067 = msg("28981", dup321); + +var msg31068 = msg("28982", dup321); + +var msg31069 = msg("28983", dup311); + +var msg31070 = msg("28984", dup311); + +var msg31071 = msg("28985", dup311); + +var msg31072 = msg("28986", dup321); + +var msg31073 = msg("28987", dup321); + +var msg31074 = msg("28988", dup321); + +var msg31075 = msg("28989", dup321); + +var msg31076 = msg("28990", dup321); + +var msg31077 = msg("28991", dup333); + +var msg31078 = msg("28992", dup321); + +var msg31079 = msg("28993", dup323); + +var msg31080 = msg("28994", dup321); + +var msg31081 = msg("28995", dup321); + +var msg31082 = msg("28996", dup321); + +var msg31083 = msg("28997", dup325); + +var msg31084 = msg("28998", dup314); + +var msg31085 = msg("28999", dup314); + +var msg31086 = msg("29000", dup314); + +var msg31087 = msg("29001", dup311); + +var msg31088 = msg("29002", dup311); + +var msg31089 = msg("29003", dup311); + +var msg31090 = msg("29004", dup311); + +var msg31091 = msg("29005", dup309); + +var msg31092 = msg("29006", dup314); + +var msg31093 = msg("29007", dup314); + +var msg31094 = msg("29008", dup314); + +var msg31095 = msg("29009", dup309); + +var msg31096 = msg("29010", dup309); + +var msg31097 = msg("29011", dup321); + +var msg31098 = msg("29012", dup321); + +var msg31099 = msg("29013", dup321); + +var msg31100 = msg("29014", dup309); + +var msg31101 = msg("29015", dup321); + +var msg31102 = msg("29016", dup321); + +var msg31103 = msg("29017", dup314); + +var msg31104 = msg("29018", dup322); + +var msg31105 = msg("29019", dup314); + +var msg31106 = msg("29020", dup321); + +var msg31107 = msg("29021", dup321); + +var msg31108 = msg("29022", dup321); + +var msg31109 = msg("29023", dup311); + +var msg31110 = msg("29024", dup311); + +var msg31111 = msg("29025", dup311); + +var msg31112 = msg("29026", dup321); + +var msg31113 = msg("29027", dup311); + +var msg31114 = msg("29028", dup328); + +var msg31115 = msg("29029", dup328); + +var msg31116 = msg("29030", dup321); + +var msg31117 = msg("29031", dup321); + +var msg31118 = msg("29032", dup309); + +var msg31119 = msg("29033", dup309); + +var msg31120 = msg("29034", dup325); + +var msg31121 = msg("29035", dup325); + +var msg31122 = msg("29036", dup311); + +var msg31123 = msg("29037", dup325); + +var msg31124 = msg("29038", dup321); + +var msg31125 = msg("29039", dup321); + +var msg31126 = msg("29040", dup311); + +var msg31127 = msg("29041", dup314); + +var msg31128 = msg("29042", dup314); + +var msg31129 = msg("29043", dup321); + +var msg31130 = msg("29044", dup321); + +var msg31131 = msg("29045", dup321); + +var msg31132 = msg("29046", dup325); + +var msg31133 = msg("29047", dup311); + +var msg31134 = msg("29048", dup311); + +var msg31135 = msg("29049", dup311); + +var msg31136 = msg("29050", dup311); + +var msg31137 = msg("29051", dup311); + +var msg31138 = msg("29052", dup311); + +var msg31139 = msg("29053", dup311); + +var msg31140 = msg("29054", dup311); + +var msg31141 = msg("29055", dup321); + +var msg31142 = msg("29056", dup321); + +var msg31143 = msg("29057", dup321); + +var msg31144 = msg("29058", dup321); + +var msg31145 = msg("29059", dup314); + +var msg31146 = msg("29060", dup314); + +var msg31147 = msg("29061", dup311); + +var msg31148 = msg("29062", dup314); + +var msg31149 = msg("29063", dup314); + +var msg31150 = msg("29064", dup314); + +var msg31151 = msg("29065", dup314); + +var msg31152 = msg("29066", dup311); + +var msg31153 = msg("29067", dup321); + +var msg31154 = msg("29068", dup321); + +var msg31155 = msg("29069", dup321); + +var msg31156 = msg("29070", dup321); + +var msg31157 = msg("29071", dup321); + +var msg31158 = msg("29072", dup321); + +var msg31159 = msg("29073", dup321); + +var msg31160 = msg("29074", dup321); + +var msg31161 = msg("29075", dup321); + +var msg31162 = msg("29076", dup321); + +var msg31163 = msg("29077", dup321); + +var msg31164 = msg("29078", dup321); + +var msg31165 = msg("29079", dup321); + +var msg31166 = msg("29080", dup333); + +var msg31167 = msg("29081", dup321); + +var msg31168 = msg("29082", dup321); + +var msg31169 = msg("29083", dup321); + +var msg31170 = msg("29084", dup321); + +var msg31171 = msg("29085", dup321); + +var msg31172 = msg("29086", dup321); + +var msg31173 = msg("29087", dup321); + +var msg31174 = msg("29088", dup321); + +var msg31175 = msg("29089", dup321); + +var msg31176 = msg("29090", dup311); + +var msg31177 = msg("29091", dup321); + +var msg31178 = msg("29092", dup314); + +var msg31179 = msg("29093", dup321); + +var msg31180 = msg("29094", dup321); + +var msg31181 = msg("29095", dup333); + +var msg31182 = msg("29096", dup333); + +var msg31183 = msg("29097", dup314); + +var msg31184 = msg("29098", dup314); + +var msg31185 = msg("29099", dup314); + +var msg31186 = msg("29100", dup314); + +var msg31187 = msg("29101", dup314); + +var msg31188 = msg("29102", dup314); + +var msg31189 = msg("29103", dup321); + +var msg31190 = msg("29104", dup321); + +var msg31191 = msg("29105", dup314); + +var msg31192 = msg("29106", dup321); + +var msg31193 = msg("29107", dup321); + +var msg31194 = msg("29108", dup321); + +var msg31195 = msg("29109", dup321); + +var msg31196 = msg("29110", dup314); + +var msg31197 = msg("29111", dup321); + +var msg31198 = msg("29112", dup321); + +var msg31199 = msg("29113", dup321); + +var msg31200 = msg("29114", dup321); + +var msg31201 = msg("29115", dup321); + +var msg31202 = msg("29116", dup321); + +var msg31203 = msg("29117", dup321); + +var msg31204 = msg("29118", dup314); + +var msg31205 = msg("29119", dup321); + +var msg31206 = msg("29120", dup321); + +var msg31207 = msg("29121", dup321); + +var msg31208 = msg("29122", dup321); + +var msg31209 = msg("29123", dup321); + +var msg31210 = msg("29124", dup321); + +var msg31211 = msg("29125", dup321); + +var msg31212 = msg("29126", dup321); + +var msg31213 = msg("29127", dup321); + +var msg31214 = msg("29128", dup311); + +var msg31215 = msg("29129", dup311); + +var msg31216 = msg("29130", dup311); + +var msg31217 = msg("29131", dup311); + +var msg31218 = msg("29132", dup321); + +var msg31219 = msg("29133", dup321); + +var msg31220 = msg("29134", dup321); + +var msg31221 = msg("29135", dup324); + +var msg31222 = msg("29136", dup321); + +var msg31223 = msg("29137", dup321); + +var msg31224 = msg("29138", dup321); + +var msg31225 = msg("29139", dup325); + +var msg31226 = msg("29140", dup321); + +var msg31227 = msg("29141", dup314); + +var msg31228 = msg("29142", dup314); + +var msg31229 = msg("29143", dup325); + +var msg31230 = msg("29144", dup321); + +var msg31231 = msg("29145", dup321); + +var msg31232 = msg("29146", dup321); + +var msg31233 = msg("29147", dup321); + +var msg31234 = msg("29148", dup321); + +var msg31235 = msg("29149", dup321); + +var msg31236 = msg("29150", dup311); + +var msg31237 = msg("29151", dup321); + +var msg31238 = msg("29152", dup321); + +var msg31239 = msg("29153", dup321); + +var msg31240 = msg("29154", dup321); + +var msg31241 = msg("29155", dup321); + +var msg31242 = msg("29156", dup321); + +var msg31243 = msg("29157", dup311); + +var msg31244 = msg("29158", dup311); + +var msg31245 = msg("29159", dup311); + +var msg31246 = msg("29160", dup311); + +var msg31247 = msg("29161", dup321); + +var msg31248 = msg("29162", dup314); + +var msg31249 = msg("29163", dup311); + +var msg31250 = msg("29164", dup311); + +var msg31251 = msg("29165", dup311); + +var msg31252 = msg("29166", dup311); + +var msg31253 = msg("29167", dup311); + +var msg31254 = msg("29168", dup311); + +var msg31255 = msg("29169", dup311); + +var msg31256 = msg("29170", dup314); + +var msg31257 = msg("29171", dup321); + +var msg31258 = msg("29172", dup321); + +var msg31259 = msg("29173", dup321); + +var msg31260 = msg("29174", dup325); + +var msg31261 = msg("29175", dup321); + +var msg31262 = msg("29176", dup321); + +var msg31263 = msg("29177", dup321); + +var msg31264 = msg("29178", dup321); + +var msg31265 = msg("29179", dup321); + +var msg31266 = msg("29180", dup325); + +var msg31267 = msg("29181", dup321); + +var msg31268 = msg("29182", dup309); + +var msg31269 = msg("29183", dup309); + +var msg31270 = msg("29184", dup309); + +var msg31271 = msg("29185", dup309); + +var msg31272 = msg("29186", dup311); + +var msg31273 = msg("29187", dup311); + +var msg31274 = msg("29188", dup311); + +var msg31275 = msg("29189", dup311); + +var msg31276 = msg("29190", dup307); + +var msg31277 = msg("29191", dup311); + +var msg31278 = msg("29192", dup311); + +var msg31279 = msg("29193", dup311); + +var msg31280 = msg("29194", dup309); + +var msg31281 = msg("29195", dup309); + +var msg31282 = msg("29196", dup309); + +var msg31283 = msg("29197", dup309); + +var msg31284 = msg("29198", dup309); + +var msg31285 = msg("29199", dup309); + +var msg31286 = msg("29200", dup314); + +var msg31287 = msg("29201", dup309); + +var msg31288 = msg("29202", dup309); + +var msg31289 = msg("29203", dup314); + +var msg31290 = msg("29204", dup314); + +var msg31291 = msg("29205", dup314); + +var msg31292 = msg("29206", dup314); + +var msg31293 = msg("29207", dup309); + +var msg31294 = msg("29208", dup309); + +var msg31295 = msg("29209", dup309); + +var msg31296 = msg("29210", dup309); + +var msg31297 = msg("29211", dup309); + +var msg31298 = msg("29212", dup309); + +var msg31299 = msg("29213", dup314); + +var msg31300 = msg("29214", dup311); + +var msg31301 = msg("29215", dup309); + +var msg31302 = msg("29216", dup321); + +var msg31303 = msg("29217", dup321); + +var msg31304 = msg("29218", dup311); + +var msg31305 = msg("29219", dup311); + +var msg31306 = msg("29220", dup321); + +var msg31307 = msg("29221", dup325); + +var msg31308 = msg("29222", dup325); + +var msg31309 = msg("29223", dup325); + +var msg31310 = msg("29224", dup314); + +var msg31311 = msg("29225", dup314); + +var msg31312 = msg("29226", dup325); + +var msg31313 = msg("29227", dup325); + +var msg31314 = msg("29228", dup325); + +var msg31315 = msg("29229", dup325); + +var msg31316 = msg("29230", dup325); + +var msg31317 = msg("29231", dup325); + +var msg31318 = msg("29232", dup325); + +var msg31319 = msg("29233", dup325); + +var msg31320 = msg("29234", dup325); + +var msg31321 = msg("29235", dup325); + +var msg31322 = msg("29236", dup325); + +var msg31323 = msg("29237", dup325); + +var msg31324 = msg("29238", dup325); + +var msg31325 = msg("29239", dup325); + +var msg31326 = msg("29240", dup325); + +var msg31327 = msg("29241", dup325); + +var msg31328 = msg("29242", dup325); + +var msg31329 = msg("29243", dup325); + +var msg31330 = msg("29244", dup325); + +var msg31331 = msg("29245", dup325); + +var msg31332 = msg("29246", dup325); + +var msg31333 = msg("29247", dup325); + +var msg31334 = msg("29248", dup325); + +var msg31335 = msg("29249", dup325); + +var msg31336 = msg("29250", dup325); + +var msg31337 = msg("29251", dup325); + +var msg31338 = msg("29252", dup325); + +var msg31339 = msg("29253", dup325); + +var msg31340 = msg("29254", dup325); + +var msg31341 = msg("29255", dup325); + +var msg31342 = msg("29256", dup325); + +var msg31343 = msg("29257", dup325); + +var msg31344 = msg("29258", dup314); + +var msg31345 = msg("29259", dup321); + +var msg31346 = msg("29260", dup321); + +var msg31347 = msg("29261", dup321); + +var msg31348 = msg("29262", dup321); + +var msg31349 = msg("29263", dup321); + +var msg31350 = msg("29264", dup309); + +var msg31351 = msg("29265", dup311); + +var msg31352 = msg("29266", dup314); + +var msg31353 = msg("29267", dup311); + +var msg31354 = msg("29268", dup309); + +var msg31355 = msg("29269", dup309); + +var msg31356 = msg("29270", dup311); + +var msg31357 = msg("29271", dup311); + +var msg31358 = msg("29272", dup311); + +var msg31359 = msg("29273", dup311); + +var msg31360 = msg("29274", dup314); + +var msg31361 = msg("29275", dup314); + +var msg31362 = msg("29276", dup314); + +var msg31363 = msg("29277", dup309); + +var msg31364 = msg("29278", dup309); + +var msg31365 = msg("29279", dup309); + +var msg31366 = msg("29280", dup309); + +var msg31367 = msg("29281", dup311); + +var msg31368 = msg("29282", dup311); + +var msg31369 = msg("29283", dup311); + +var msg31370 = msg("29284", dup311); + +var msg31371 = msg("29285", dup311); + +var msg31372 = msg("29286", dup311); + +var msg31373 = msg("29287", dup311); + +var msg31374 = msg("29288", dup311); + +var msg31375 = msg("29289", dup321); + +var msg31376 = msg("29290", dup321); + +var msg31377 = msg("29291", dup321); + +var msg31378 = msg("29292", dup321); + +var msg31379 = msg("29293", dup321); + +var msg31380 = msg("29294", dup321); + +var msg31381 = msg("29295", dup321); + +var msg31382 = msg("29296", dup314); + +var msg31383 = msg("29297", dup314); + +var msg31384 = msg("29298", dup321); + +var msg31385 = msg("29299", dup321); + +var msg31386 = msg("29300", dup321); + +var msg31387 = msg("29301", dup321); + +var msg31388 = msg("29302", dup321); + +var msg31389 = msg("29303", dup321); + +var msg31390 = msg("29304", dup321); + +var msg31391 = msg("29305", dup321); + +var msg31392 = msg("29306", dup321); + +var msg31393 = msg("29307", dup321); + +var msg31394 = msg("29313", dup321); + +var msg31395 = msg("29314", dup336); + +var msg31396 = msg("29315", dup336); + +var msg31397 = msg("29316", dup336); + +var msg31398 = msg("29317", dup314); + +var msg31399 = msg("29318", dup314); + +var msg31400 = msg("29319", dup314); + +var msg31401 = msg("29320", dup314); + +var msg31402 = msg("29321", dup314); + +var msg31403 = msg("29322", dup314); + +var msg31404 = msg("29323", dup329); + +var msg31405 = msg("29324", dup321); + +var msg31406 = msg("29325", dup321); + +var msg31407 = msg("29326", dup309); + +var msg31408 = msg("29327", dup309); + +var msg31409 = msg("29328", dup309); + +var msg31410 = msg("29329", dup309); + +var msg31411 = msg("29330", dup321); + +var msg31412 = msg("29331", dup321); + +var msg31413 = msg("29332", dup321); + +var msg31414 = msg("29333", dup321); + +var msg31415 = msg("29334", dup321); + +var msg31416 = msg("29335", dup321); + +var msg31417 = msg("29336", dup321); + +var msg31418 = msg("29337", dup321); + +var msg31419 = msg("29338", dup321); + +var msg31420 = msg("29339", dup321); + +var msg31421 = msg("29340", dup321); + +var msg31422 = msg("29341", dup325); + +var msg31423 = msg("29342", dup321); + +var msg31424 = msg("29343", dup321); + +var msg31425 = msg("29344", dup321); + +var msg31426 = msg("29345", dup321); + +var msg31427 = msg("29346", dup311); + +var msg31428 = msg("29347", dup321); + +var msg31429 = msg("29348", dup321); + +var msg31430 = msg("29349", dup321); + +var msg31431 = msg("29350", dup321); + +var msg31432 = msg("29351", dup321); + +var msg31433 = msg("29352", dup321); + +var msg31434 = msg("29353", dup321); + +var msg31435 = msg("29354", dup336); + +var msg31436 = msg("29355", dup321); + +var msg31437 = msg("29356", dup321); + +var all57 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup123, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg31438 = msg("29357", all57); + +var msg31439 = msg("29358", dup325); + +var msg31440 = msg("29359", dup321); + +var msg31441 = msg("29360", dup311); + +var msg31442 = msg("29361", dup311); + +var msg31443 = msg("29362", dup324); + +var msg31444 = msg("29363", dup321); + +var msg31445 = msg("29364", dup321); + +var msg31446 = msg("29365", dup321); + +var msg31447 = msg("29366", dup321); + +var msg31448 = msg("29367", dup321); + +var msg31449 = msg("29368", dup321); + +var msg31450 = msg("29369", dup321); + +var msg31451 = msg("29370", dup321); + +var msg31452 = msg("29371", dup325); + +var msg31453 = msg("29372", dup321); + +var msg31454 = msg("29373", dup321); + +var msg31455 = msg("29374", dup324); + +var msg31456 = msg("29375", dup324); + +var msg31457 = msg("29376", dup321); + +var msg31458 = msg("29377", dup321); + +var msg31459 = msg("29378", dup321); + +var msg31460 = msg("29379", dup321); + +var msg31461 = msg("29380", dup321); + +var msg31462 = msg("29381", dup329); + +var msg31463 = msg("29382", dup329); + +var msg31464 = msg("29383", dup329); + +var msg31465 = msg("29384", dup314); + +var msg31466 = msg("29385", dup314); + +var msg31467 = msg("29386", dup314); + +var msg31468 = msg("29387", dup311); + +var msg31469 = msg("29388", dup321); + +var msg31470 = msg("29389", dup321); + +var msg31471 = msg("29390", dup314); + +var msg31472 = msg("29391", dup314); + +var msg31473 = msg("29392", dup314); + +var msg31474 = msg("29393", dup324); + +var msg31475 = msg("29394", dup309); + +var msg31476 = msg("29395", dup321); + +var msg31477 = msg("29396", dup311); + +var msg31478 = msg("29397", dup311); + +var msg31479 = msg("29398", dup311); + +var msg31480 = msg("29399", dup311); + +var msg31481 = msg("29400", dup314); + +var msg31482 = msg("29401", dup311); + +var msg31483 = msg("29402", dup311); + +var msg31484 = msg("29403", dup311); + +var msg31485 = msg("29404", dup309); + +var msg31486 = msg("29405", dup314); + +var msg31487 = msg("29406", dup314); + +var msg31488 = msg("29407", dup314); + +var msg31489 = msg("29408", dup321); + +var msg31490 = msg("29409", dup323); + +var msg31491 = msg("29410", dup323); + +var msg31492 = msg("29411", dup311); + +var msg31493 = msg("29412", dup311); + +var msg31494 = msg("29413", dup311); + +var msg31495 = msg("29414", dup311); + +var msg31496 = msg("29415", dup321); + +var msg31497 = msg("29416", dup321); + +var msg31498 = msg("29417", dup321); + +var msg31499 = msg("29418", dup314); + +var msg31500 = msg("29419", dup314); + +var msg31501 = msg("29420", dup333); + +var msg31502 = msg("29421", dup333); + +var msg31503 = msg("29422", dup321); + +var msg31504 = msg("29423", dup324); + +var msg31505 = msg("29424", dup321); + +var msg31506 = msg("29425", dup321); + +var msg31507 = msg("29426", dup321); + +var msg31508 = msg("29427", dup321); + +var msg31509 = msg("29428", dup321); + +var msg31510 = msg("29429", dup321); + +var msg31511 = msg("29430", dup321); + +var msg31512 = msg("29431", dup325); + +var msg31513 = msg("29432", dup321); + +var msg31514 = msg("29433", dup314); + +var msg31515 = msg("29434", dup309); + +var msg31516 = msg("29435", dup311); + +var msg31517 = msg("29436", dup311); + +var msg31518 = msg("29437", dup314); + +var msg31519 = msg("29438", dup314); + +var msg31520 = msg("29439", dup314); + +var msg31521 = msg("29440", dup321); + +var msg31522 = msg("29442", dup311); + +var msg31523 = msg("29443", dup311); + +var msg31524 = msg("29444", dup311); + +var msg31525 = msg("29445", dup311); + +var msg31526 = msg("29446", dup311); + +var msg31527 = msg("29447", dup307); + +var msg31528 = msg("29448", dup311); + +var msg31529 = msg("29449", dup311); + +var msg31530 = msg("29450", dup311); + +var msg31531 = msg("29451", dup311); + +var msg31532 = msg("29452", dup311); + +var msg31533 = msg("29453", dup311); + +var msg31534 = msg("29454", dup334); + +var msg31535 = msg("29455", dup334); + +var msg31536 = msg("29456", dup334); + +var msg31537 = msg("29457", dup334); + +var msg31538 = msg("29458", dup321); + +var msg31539 = msg("29459", dup321); + +var msg31540 = msg("29460", dup321); + +var msg31541 = msg("29461", dup321); + +var msg31542 = msg("29462", dup325); + +var msg31543 = msg("29463", dup321); + +var msg31544 = msg("29464", dup321); + +var msg31545 = msg("29465", dup309); + +var msg31546 = msg("29466", dup309); + +var msg31547 = msg("29467", dup309); + +var msg31548 = msg("29468", dup309); + +var msg31549 = msg("29469", dup321); + +var msg31550 = msg("29470", dup321); + +var msg31551 = msg("29471", dup321); + +var msg31552 = msg("29472", dup321); + +var msg31553 = msg("29473", dup321); + +var msg31554 = msg("29474", dup321); + +var msg31555 = msg("29475", dup321); + +var msg31556 = msg("29476", dup321); + +var msg31557 = msg("29477", dup321); + +var msg31558 = msg("29478", dup321); + +var msg31559 = msg("29479", dup321); + +var msg31560 = msg("29480", dup321); + +var msg31561 = msg("29481", dup321); + +var msg31562 = msg("29482", dup321); + +var msg31563 = msg("29483", dup321); + +var msg31564 = msg("29484", dup321); + +var msg31565 = msg("29485", dup314); + +var msg31566 = msg("29486", dup314); + +var msg31567 = msg("29487", dup314); + +var msg31568 = msg("29488", dup314); + +var msg31569 = msg("29489", dup321); + +var msg31570 = msg("29490", dup309); + +var msg31571 = msg("29491", dup309); + +var msg31572 = msg("29492", dup321); + +var msg31573 = msg("29493", dup321); + +var msg31574 = msg("29494", dup321); + +var msg31575 = msg("29495", dup321); + +var msg31576 = msg("29496", dup321); + +var msg31577 = msg("29497", dup321); + +var msg31578 = msg("29498", dup314); + +var msg31579 = msg("29499", dup314); + +var msg31580 = msg("29500", dup321); + +var msg31581 = msg("29501", dup311); + +var msg31582 = msg("29502", dup309); + +var msg31583 = msg("29503", dup314); + +var msg31584 = msg("29504", dup314); + +var msg31585 = msg("29505", dup311); + +var msg31586 = msg("29506", dup314); + +var msg31587 = msg("29507", dup314); + +var msg31588 = msg("29508", dup314); + +var msg31589 = msg("29509", dup323); + +var msg31590 = msg("29510", dup323); + +var msg31591 = msg("29511", dup309); + +var msg31592 = msg("29512", dup314); + +var msg31593 = msg("29513", dup309); + +var msg31594 = msg("29514", dup314); + +var msg31595 = msg("29515", dup309); + +var msg31596 = msg("29516", dup314); + +var msg31597 = msg("29517", dup314); + +var msg31598 = msg("29518", dup311); + +var msg31599 = msg("29519", dup314); + +var msg31600 = msg("29520", dup311); + +var msg31601 = msg("29521", dup311); + +var msg31602 = msg("29522", dup307); + +var msg31603 = msg("29523", dup309); + +var msg31604 = msg("29524", dup314); + +var msg31605 = msg("29525", dup314); + +var msg31606 = msg("29526", dup309); + +var msg31607 = msg("29527", dup309); + +var msg31608 = msg("29528", dup309); + +var msg31609 = msg("29529", dup309); + +var msg31610 = msg("29530", dup309); + +var msg31611 = msg("29531", dup309); + +var msg31612 = msg("29532", dup309); + +var msg31613 = msg("29533", dup314); + +var msg31614 = msg("29534", dup314); + +var msg31615 = msg("29535", dup307); + +var msg31616 = msg("29536", dup306); + +var msg31617 = msg("29537", dup314); + +var msg31618 = msg("29538", dup314); + +var msg31619 = msg("29539", dup309); + +var msg31620 = msg("29540", dup309); + +var msg31621 = msg("29541", dup309); + +var msg31622 = msg("29542", dup309); + +var msg31623 = msg("29543", dup309); + +var msg31624 = msg("29544", dup309); + +var msg31625 = msg("29545", dup309); + +var msg31626 = msg("29546", dup309); + +var msg31627 = msg("29547", dup311); + +var msg31628 = msg("29548", dup311); + +var msg31629 = msg("29549", dup316); + +var msg31630 = msg("29550", dup321); + +var msg31631 = msg("29551", dup311); + +var msg31632 = msg("29552", dup311); + +var msg31633 = msg("29553", dup311); + +var msg31634 = msg("29554", dup311); + +var msg31635 = msg("29555", dup321); + +var msg31636 = msg("29556", dup321); + +var msg31637 = msg("29557", dup321); + +var msg31638 = msg("29558", dup321); + +var msg31639 = msg("29559", dup321); + +var msg31640 = msg("29560", dup321); + +var msg31641 = msg("29561", dup321); + +var msg31642 = msg("29562", dup321); + +var msg31643 = msg("29563", dup321); + +var msg31644 = msg("29564", dup321); + +var msg31645 = msg("29565", dup321); + +var msg31646 = msg("29566", dup321); + +var msg31647 = msg("29567", dup321); + +var msg31648 = msg("29568", dup321); + +var msg31649 = msg("29569", dup321); + +var msg31650 = msg("29570", dup309); + +var msg31651 = msg("29571", dup309); + +var msg31652 = msg("29572", dup309); + +var msg31653 = msg("29573", dup309); + +var msg31654 = msg("29574", dup309); + +var msg31655 = msg("29575", dup309); + +var msg31656 = msg("29576", dup309); + +var msg31657 = msg("29577", dup309); + +var msg31658 = msg("29578", dup329); + +var msg31659 = msg("29579", dup311); + +var msg31660 = msg("29580", dup311); + +var msg31661 = msg("29581", dup308); + +var msg31662 = msg("29582", dup311); + +var msg31663 = msg("29583", dup314); + +var msg31664 = msg("29584", dup322); + +var msg31665 = msg("29585", dup309); + +var msg31666 = msg("29586", dup309); + +var msg31667 = msg("29587", dup309); + +var msg31668 = msg("29588", dup309); + +var msg31669 = msg("29589", dup309); + +var msg31670 = msg("29590", dup309); + +var msg31671 = msg("29591", dup309); + +var msg31672 = msg("29592", dup311); + +var msg31673 = msg("29593", dup323); + +var msg31674 = msg("29594", dup323); + +var msg31675 = msg("29595", dup323); + +var msg31676 = msg("29596", dup311); + +var msg31677 = msg("29597", dup311); + +var msg31678 = msg("29598", dup323); + +var msg31679 = msg("29599", dup323); + +var msg31680 = msg("29600", dup323); + +var msg31681 = msg("29601", dup323); + +var msg31682 = msg("29602", dup311); + +var msg31683 = msg("29603", dup311); + +var msg31684 = msg("29604", dup324); + +var msg31685 = msg("29605", dup309); + +var msg31686 = msg("29606", dup309); + +var msg31687 = msg("29607", dup307); + +var msg31688 = msg("29608", dup322); + +var msg31689 = msg("29609", dup322); + +var msg31690 = msg("29610", dup309); + +var msg31691 = msg("29611", dup309); + +var msg31692 = msg("29612", dup314); + +var msg31693 = msg("29613", dup314); + +var msg31694 = msg("29614", dup314); + +var msg31695 = msg("29615", dup321); + +var msg31696 = msg("29616", dup321); + +var msg31697 = msg("29617", dup314); + +var msg31698 = msg("29618", dup314); + +var msg31699 = msg("29619", dup314); + +var msg31700 = msg("29620", dup309); + +var msg31701 = msg("29621", dup307); + +var msg31702 = msg("29622", dup311); + +var msg31703 = msg("29623", dup311); + +var msg31704 = msg("29624", dup309); + +var msg31705 = msg("29625", dup309); + +var msg31706 = msg("29626", dup307); + +var msg31707 = msg("29627", dup307); + +var msg31708 = msg("29628", dup307); + +var msg31709 = msg("29629", dup307); + +var msg31710 = msg("29630", dup311); + +var msg31711 = msg("29631", dup314); + +var msg31712 = msg("29632", dup314); + +var msg31713 = msg("29633", dup314); + +var msg31714 = msg("29634", dup314); + +var msg31715 = msg("29635", dup321); + +var msg31716 = msg("29636", dup321); + +var msg31717 = msg("29637", dup321); + +var msg31718 = msg("29638", dup321); + +var msg31719 = msg("29639", dup311); + +var msg31720 = msg("29640", dup309); + +var msg31721 = msg("29641", dup309); + +var msg31722 = msg("29642", dup309); + +var msg31723 = msg("29643", dup309); + +var msg31724 = msg("29644", dup321); + +var msg31725 = msg("29645", dup325); + +var msg31726 = msg("29646", dup311); + +var msg31727 = msg("29647", dup311); + +var msg31728 = msg("29648", dup311); + +var msg31729 = msg("29649", dup314); + +var msg31730 = msg("29650", dup325); + +var msg31731 = msg("29651", dup325); + +var msg31732 = msg("29652", dup325); + +var msg31733 = msg("29653", dup321); + +var msg31734 = msg("29654", dup321); + +var msg31735 = msg("29655", dup325); + +var msg31736 = msg("29656", dup321); + +var msg31737 = msg("29657", dup321); + +var msg31738 = msg("29658", dup321); + +var msg31739 = msg("29659", dup321); + +var msg31740 = msg("29660", dup324); + +var msg31741 = msg("29661", dup324); + +var msg31742 = msg("29662", dup333); + +var msg31743 = msg("29663", dup321); + +var msg31744 = msg("29664", dup321); + +var msg31745 = msg("29665", dup321); + +var msg31746 = msg("29666", dup321); + +var msg31747 = msg("29667", dup325); + +var msg31748 = msg("29668", dup325); + +var msg31749 = msg("29669", dup311); + +var msg31750 = msg("29670", dup321); + +var msg31751 = msg("29671", dup325); + +var msg31752 = msg("29672", dup325); + +var msg31753 = msg("29673", dup325); + +var msg31754 = msg("29674", dup325); + +var msg31755 = msg("29675", dup325); + +var msg31756 = msg("29676", dup325); + +var msg31757 = msg("29677", dup325); + +var msg31758 = msg("29678", dup325); + +var msg31759 = msg("29679", dup325); + +var msg31760 = msg("29680", dup314); + +var msg31761 = msg("29681", dup314); + +var msg31762 = msg("29682", dup314); + +var msg31763 = msg("29683", dup314); + +var msg31764 = msg("29684", dup314); + +var msg31765 = msg("29685", dup314); + +var msg31766 = msg("29686", dup314); + +var msg31767 = msg("29687", dup314); + +var msg31768 = msg("29688", dup314); + +var msg31769 = msg("29689", dup314); + +var msg31770 = msg("29690", dup314); + +var msg31771 = msg("29691", dup314); + +var msg31772 = msg("29692", dup314); + +var msg31773 = msg("29693", dup314); + +var msg31774 = msg("29694", dup314); + +var msg31775 = msg("29695", dup314); + +var msg31776 = msg("29696", dup314); + +var msg31777 = msg("29697", dup314); + +var msg31778 = msg("29698", dup314); + +var msg31779 = msg("29699", dup314); + +var msg31780 = msg("29700", dup314); + +var msg31781 = msg("29701", dup314); + +var msg31782 = msg("29702", dup314); + +var msg31783 = msg("29703", dup314); + +var msg31784 = msg("29704", dup314); + +var msg31785 = msg("29705", dup314); + +var msg31786 = msg("29706", dup325); + +var msg31787 = msg("29707", dup325); + +var msg31788 = msg("29708", dup325); + +var msg31789 = msg("29709", dup311); + +var msg31790 = msg("29710", dup311); + +var msg31791 = msg("29711", dup325); + +var msg31792 = msg("29712", dup325); + +var msg31793 = msg("29713", dup311); + +var msg31794 = msg("29714", dup311); + +var msg31795 = msg("29715", dup324); + +var msg31796 = msg("29716", dup311); + +var msg31797 = msg("29717", dup325); + +var msg31798 = msg("29718", dup325); + +var msg31799 = msg("29719", dup325); + +var msg31800 = msg("29720", dup325); + +var msg31801 = msg("29721", dup325); + +var msg31802 = msg("29722", dup325); + +var msg31803 = msg("29723", dup309); + +var msg31804 = msg("29724", dup309); + +var msg31805 = msg("29725", dup309); + +var msg31806 = msg("29726", dup309); + +var msg31807 = msg("29727", dup325); + +var msg31808 = msg("29728", dup325); + +var msg31809 = msg("29729", dup325); + +var msg31810 = msg("29730", dup325); + +var msg31811 = msg("29731", dup325); + +var msg31812 = msg("29732", dup325); + +var msg31813 = msg("29733", dup311); + +var msg31814 = msg("29734", dup311); + +var msg31815 = msg("29735", dup325); + +var msg31816 = msg("29736", dup325); + +var msg31817 = msg("29737", dup325); + +var msg31818 = msg("29738", dup325); + +var msg31819 = msg("29739", dup321); + +var msg31820 = msg("29740", dup321); + +var msg31821 = msg("29741", dup311); + +var msg31822 = msg("29742", dup311); + +var msg31823 = msg("29743", dup325); + +var msg31824 = msg("29744", dup325); + +var msg31825 = msg("29745", dup314); + +var msg31826 = msg("29746", dup314); + +var msg31827 = msg("29747", dup314); + +var msg31828 = msg("29748", dup314); + +var msg31829 = msg("29749", dup314); + +var msg31830 = msg("29750", dup330); + +var msg31831 = msg("29751", dup330); + +var msg31832 = msg("29752", dup330); + +var msg31833 = msg("29753", dup311); + +var msg31834 = msg("29754", dup311); + +var msg31835 = msg("29755", dup311); + +var msg31836 = msg("29756", dup322); + +var msg31837 = msg("29757", dup311); + +var msg31838 = msg("29758", dup311); + +var msg31839 = msg("29759", dup324); + +var msg31840 = msg("29760", dup325); + +var msg31841 = msg("29761", dup321); + +var msg31842 = msg("29762", dup321); + +var msg31843 = msg("29763", dup321); + +var msg31844 = msg("29764", dup321); + +var msg31845 = msg("29765", dup321); + +var msg31846 = msg("29766", dup333); + +var msg31847 = msg("29767", dup321); + +var msg31848 = msg("29768", dup321); + +var msg31849 = msg("29769", dup321); + +var msg31850 = msg("29770", dup321); + +var msg31851 = msg("29771", dup321); + +var msg31852 = msg("29772", dup321); + +var msg31853 = msg("29773", dup321); + +var msg31854 = msg("29774", dup321); + +var msg31855 = msg("29775", dup321); + +var msg31856 = msg("29776", dup321); + +var msg31857 = msg("29777", dup321); + +var msg31858 = msg("29778", dup321); + +var msg31859 = msg("29779", dup321); + +var msg31860 = msg("29780", dup321); + +var msg31861 = msg("29781", dup333); + +var msg31862 = msg("29782", dup333); + +var msg31863 = msg("29783", dup321); + +var msg31864 = msg("29784", dup321); + +var msg31865 = msg("29785", dup321); + +var msg31866 = msg("29786", dup321); + +var msg31867 = msg("29787", dup321); + +var msg31868 = msg("29788", dup321); + +var msg31869 = msg("29789", dup321); + +var msg31870 = msg("29790", dup321); + +var msg31871 = msg("29791", dup321); + +var msg31872 = msg("29792", dup307); + +var msg31873 = msg("29793", dup307); + +var msg31874 = msg("29794", dup323); + +var msg31875 = msg("29795", dup323); + +var msg31876 = msg("29796", dup325); + +var msg31877 = msg("29797", dup325); + +var msg31878 = msg("29798", dup314); + +var msg31879 = msg("29799", dup314); + +var msg31880 = msg("29800", dup311); + +var msg31881 = msg("29801", dup311); + +var msg31882 = msg("29802", dup311); + +var msg31883 = msg("29803", dup311); + +var msg31884 = msg("29804", dup311); + +var msg31885 = msg("29805", dup311); + +var msg31886 = msg("29806", dup311); + +var msg31887 = msg("29807", dup314); + +var msg31888 = msg("29808", dup311); + +var msg31889 = msg("29809", dup314); + +var msg31890 = msg("29810", dup314); + +var msg31891 = msg("29811", dup314); + +var msg31892 = msg("29812", dup314); + +var msg31893 = msg("29813", dup314); + +var msg31894 = msg("29814", dup324); + +var msg31895 = msg("29815", dup316); + +var msg31896 = msg("29816", dup321); + +var msg31897 = msg("29817", dup321); + +var msg31898 = msg("29818", dup321); + +var msg31899 = msg("29819", dup325); + +var msg31900 = msg("29820", dup325); + +var msg31901 = msg("29821", dup325); + +var msg31902 = msg("29822", dup325); + +var msg31903 = msg("29823", dup311); + +var msg31904 = msg("29824", dup325); + +var msg31905 = msg("29825", dup321); + +var msg31906 = msg("29826", dup321); + +var msg31907 = msg("29827", dup321); + +var msg31908 = msg("29828", dup321); + +var msg31909 = msg("29829", dup311); + +var msg31910 = msg("29830", dup311); + +var msg31911 = msg("29831", dup311); + +var msg31912 = msg("29832", dup321); + +var msg31913 = msg("29833", dup321); + +var msg31914 = msg("29834", dup314); + +var msg31915 = msg("29835", dup323); + +var msg31916 = msg("29836", dup323); + +var msg31917 = msg("29837", dup321); + +var msg31918 = msg("29838", dup321); + +var msg31919 = msg("29839", dup321); + +var msg31920 = msg("29840", dup321); + +var msg31921 = msg("29841", dup321); + +var msg31922 = msg("29842", dup321); + +var msg31923 = msg("29843", dup321); + +var msg31924 = msg("29844", dup321); + +var msg31925 = msg("29845", dup321); + +var msg31926 = msg("29846", dup321); + +var msg31927 = msg("29847", dup321); + +var msg31928 = msg("29848", dup321); + +var msg31929 = msg("29849", dup321); + +var msg31930 = msg("29850", dup321); + +var msg31931 = msg("29851", dup321); + +var msg31932 = msg("29852", dup321); + +var msg31933 = msg("29853", dup321); + +var msg31934 = msg("29854", dup321); + +var msg31935 = msg("29855", dup321); + +var msg31936 = msg("29856", dup321); + +var msg31937 = msg("29857", dup321); + +var msg31938 = msg("29858", dup321); + +var msg31939 = msg("29859", dup314); + +var msg31940 = msg("29860", dup321); + +var msg31941 = msg("29861", dup321); + +var msg31942 = msg("29862", dup321); + +var msg31943 = msg("29863", dup321); + +var msg31944 = msg("29864", dup311); + +var msg31945 = msg("29865", dup321); + +var msg31946 = msg("29866", dup324); + +var msg31947 = msg("29867", dup321); + +var msg31948 = msg("29868", dup321); + +var msg31949 = msg("29869", dup311); + +var msg31950 = msg("29870", dup310); + +var msg31951 = msg("29871", dup311); + +var msg31952 = msg("29872", dup321); + +var msg31953 = msg("29873", dup321); + +var msg31954 = msg("29874", dup321); + +var msg31955 = msg("29875", dup321); + +var msg31956 = msg("29876", dup324); + +var msg31957 = msg("29877", dup324); + +var msg31958 = msg("29878", dup322); + +var msg31959 = msg("29879", dup322); + +var msg31960 = msg("29880", dup322); + +var msg31961 = msg("29881", dup322); + +var msg31962 = msg("29882", dup321); + +var msg31963 = msg("29883", dup321); + +var msg31964 = msg("29884", dup321); + +var msg31965 = msg("29885", dup321); + +var msg31966 = msg("29886", dup321); + +var msg31967 = msg("29887", dup325); + +var msg31968 = msg("29888", dup324); + +var msg31969 = msg("29889", dup324); + +var msg31970 = msg("29890", dup311); + +var msg31971 = msg("29891", dup321); + +var msg31972 = msg("29892", dup321); + +var msg31973 = msg("29893", dup321); + +var msg31974 = msg("29894", dup321); + +var msg31975 = msg("29895", dup321); + +var msg31976 = msg("29896", dup324); + +var msg31977 = msg("29897", dup325); + +var msg31978 = msg("29898", dup321); + +var msg31979 = msg("29899", dup321); + +var msg31980 = msg("29900", dup321); + +var msg31981 = msg("29901", dup321); + +var msg31982 = msg("29902", dup314); + +var msg31983 = msg("29903", dup314); + +var msg31984 = msg("29904", dup314); + +var msg31985 = msg("29905", dup314); + +var msg31986 = msg("29906", dup324); + +var msg31987 = msg("29907", dup324); + +var msg31988 = msg("29909", dup311); + +var msg31989 = msg("29910", dup321); + +var msg31990 = msg("29911", dup321); + +var msg31991 = msg("29912", dup321); + +var msg31992 = msg("29913", dup321); + +var msg31993 = msg("29914", dup321); + +var msg31994 = msg("29915", dup321); + +var msg31995 = msg("29916", dup321); + +var msg31996 = msg("29917", dup321); + +var msg31997 = msg("29918", dup321); + +var msg31998 = msg("29919", dup321); + +var msg31999 = msg("29920", dup321); + +var msg32000 = msg("29921", dup321); + +var msg32001 = msg("29922", dup321); + +var msg32002 = msg("29923", dup321); + +var msg32003 = msg("29924", dup321); + +var msg32004 = msg("29925", dup321); + +var msg32005 = msg("29926", dup309); + +var msg32006 = msg("29927", dup309); + +var msg32007 = msg("29928", dup314); + +var msg32008 = msg("29929", dup314); + +var msg32009 = msg("29930", dup314); + +var msg32010 = msg("29931", dup314); + +var msg32011 = msg("29932", dup325); + +var msg32012 = msg("29933", dup325); + +var msg32013 = msg("29934", dup309); + +var msg32014 = msg("29935", dup324); + +var msg32015 = msg("29936", dup311); + +var msg32016 = msg("29937", dup309); + +var msg32017 = msg("29938", dup309); + +var msg32018 = msg("29939", dup309); + +var msg32019 = msg("29940", dup309); + +var msg32020 = msg("29941", dup309); + +var msg32021 = msg("29942", dup309); + +var msg32022 = msg("29943", dup311); + +var msg32023 = msg("29944", dup307); + +var msg32024 = msg("29945", dup307); + +var msg32025 = msg("29946", dup309); + +var msg32026 = msg("29947", dup309); + +var msg32027 = msg("29948", dup309); + +var msg32028 = msg("29949", dup316); + +var msg32029 = msg("29950", dup324); + +var msg32030 = msg("29951", dup309); + +var msg32031 = msg("29952", dup309); + +var msg32032 = msg("29953", dup309); + +var msg32033 = msg("29954", dup309); + +var msg32034 = msg("29955", dup311); + +var msg32035 = msg("29956", dup311); + +var msg32036 = msg("29957", dup309); + +var msg32037 = msg("29958", dup309); + +var msg32038 = msg("29959", dup309); + +var msg32039 = msg("29960", dup324); + +var msg32040 = msg("29961", dup324); + +var msg32041 = msg("29962", dup324); + +var msg32042 = msg("29963", dup324); + +var msg32043 = msg("29964", dup314); + +var msg32044 = msg("29965", dup324); + +var msg32045 = msg("29966", dup309); + +var msg32046 = msg("29967", dup309); + +var msg32047 = msg("29968", dup309); + +var msg32048 = msg("29969", dup311); + +var msg32049 = msg("29970", dup311); + +var msg32050 = msg("29971", dup311); + +var msg32051 = msg("29972", dup311); + +var msg32052 = msg("29973", dup321); + +var msg32053 = msg("29974", dup321); + +var msg32054 = msg("29975", dup321); + +var msg32055 = msg("29976", dup321); + +var msg32056 = msg("29977", dup321); + +var msg32057 = msg("29978", dup321); + +var msg32058 = msg("29979", dup311); + +var msg32059 = msg("29980", dup321); + +var msg32060 = msg("29981", dup321); + +var msg32061 = msg("29982", dup321); + +var msg32062 = msg("29983", dup325); + +var msg32063 = msg("29984", dup325); + +var msg32064 = msg("29985", dup321); + +var msg32065 = msg("29986", dup321); + +var msg32066 = msg("29987", dup321); + +var msg32067 = msg("29988", dup325); + +var msg32068 = msg("29989", dup325); + +var msg32069 = msg("29990", dup321); + +var msg32070 = msg("29991", dup321); + +var msg32071 = msg("29992", dup309); + +var msg32072 = msg("29993", dup321); + +var msg32073 = msg("29994", dup321); + +var msg32074 = msg("29995", dup321); + +var msg32075 = msg("29996", dup321); + +var msg32076 = msg("29997", dup321); + +var msg32077 = msg("29998", dup321); + +var msg32078 = msg("29999", dup325); + +var msg32079 = msg("30000", dup311); + +var msg32080 = msg("30001", dup311); + +var msg32081 = msg("30002", dup311); + +var msg32082 = msg("30003", dup311); + +var msg32083 = msg("30004", dup311); + +var msg32084 = msg("30005", dup311); + +var msg32085 = msg("30006", dup311); + +var msg32086 = msg("30007", dup311); + +var msg32087 = msg("30008", dup311); + +var msg32088 = msg("30009", dup311); + +var msg32089 = msg("30010", dup314); + +var msg32090 = msg("30011", dup311); + +var msg32091 = msg("30012", dup314); + +var msg32092 = msg("30013", dup314); + +var msg32093 = msg("30014", dup314); + +var msg32094 = msg("30015", dup314); + +var msg32095 = msg("30016", dup314); + +var msg32096 = msg("30017", dup314); + +var msg32097 = msg("30018", dup314); + +var msg32098 = msg("30019", dup309); + +var msg32099 = msg("30020", dup309); + +var msg32100 = msg("30021", dup309); + +var msg32101 = msg("30022", dup309); + +var msg32102 = msg("30023", dup309); + +var msg32103 = msg("30024", dup309); + +var msg32104 = msg("30025", dup309); + +var msg32105 = msg("30026", dup309); + +var msg32106 = msg("30027", dup309); + +var msg32107 = msg("30028", dup309); + +var msg32108 = msg("30029", dup309); + +var msg32109 = msg("30030", dup309); + +var msg32110 = msg("30031", dup309); + +var msg32111 = msg("30032", dup309); + +var msg32112 = msg("30033", dup314); + +var msg32113 = msg("30034", dup321); + +var msg32114 = msg("30035", dup321); + +var msg32115 = msg("30036", dup321); + +var msg32116 = msg("30037", dup321); + +var msg32117 = msg("30038", dup314); + +var msg32118 = msg("30039", dup321); + +var msg32119 = msg("30040", dup322); + +var msg32120 = msg("30041", dup322); + +var msg32121 = msg("30042", dup316); + +var msg32122 = msg("30043", dup321); + +var msg32123 = msg("30044", dup321); + +var msg32124 = msg("30045", dup321); + +var msg32125 = msg("30046", dup321); + +var msg32126 = msg("30047", dup321); + +var msg32127 = msg("30048", dup309); + +var msg32128 = msg("30049", dup309); + +var msg32129 = msg("30050", dup314); + +var msg32130 = msg("30051", dup314); + +var msg32131 = msg("30052", dup309); + +var msg32132 = msg("30053", dup309); + +var msg32133 = msg("30054", dup333); + +var msg32134 = msg("30055", dup333); + +var msg32135 = msg("30056", dup321); + +var msg32136 = msg("30057", dup321); + +var msg32137 = msg("30058", dup333); + +var msg32138 = msg("30059", dup321); + +var msg32139 = msg("30060", dup321); + +var msg32140 = msg("30061", dup321); + +var msg32141 = msg("30062", dup321); + +var msg32142 = msg("30063", dup321); + +var msg32143 = msg("30064", dup321); + +var msg32144 = msg("30065", dup314); + +var msg32145 = msg("30066", dup325); + +var msg32146 = msg("30067", dup321); + +var msg32147 = msg("30068", dup321); + +var msg32148 = msg("30069", dup321); + +var msg32149 = msg("30070", dup321); + +var msg32150 = msg("30071", dup321); + +var msg32151 = msg("30072", dup321); + +var msg32152 = msg("30073", dup321); + +var msg32153 = msg("30074", dup321); + +var msg32154 = msg("30075", dup321); + +var msg32155 = msg("30076", dup321); + +var msg32156 = msg("30077", dup321); + +var msg32157 = msg("30078", dup321); + +var msg32158 = msg("30079", dup325); + +var msg32159 = msg("30080", dup325); + +var msg32160 = msg("30081", dup325); + +var msg32161 = msg("30082", dup325); + +var msg32162 = msg("30083", dup321); + +var msg32163 = msg("30084", dup321); + +var msg32164 = msg("30085", dup321); + +var msg32165 = msg("30086", dup321); + +var msg32166 = msg("30087", dup321); + +var msg32167 = msg("30088", dup321); + +var msg32168 = msg("30089", dup321); + +var msg32169 = msg("30090", dup321); + +var msg32170 = msg("30091", dup321); + +var msg32171 = msg("30092", dup314); + +var msg32172 = msg("30093", dup314); + +var msg32173 = msg("30094", dup309); + +var msg32174 = msg("30095", dup309); + +var msg32175 = msg("30096", dup309); + +var msg32176 = msg("30097", dup309); + +var msg32177 = msg("30098", dup333); + +var msg32178 = msg("30099", dup321); + +var msg32179 = msg("30100", dup333); + +var msg32180 = msg("30101", dup333); + +var msg32181 = msg("30102", dup325); + +var msg32182 = msg("30103", dup325); + +var msg32183 = msg("30104", dup325); + +var msg32184 = msg("30105", dup325); + +var msg32185 = msg("30106", dup325); + +var msg32186 = msg("30107", dup325); + +var msg32187 = msg("30108", dup325); + +var msg32188 = msg("30109", dup325); + +var msg32189 = msg("30110", dup325); + +var msg32190 = msg("30111", dup325); + +var msg32191 = msg("30112", dup325); + +var msg32192 = msg("30113", dup325); + +var msg32193 = msg("30114", dup309); + +var msg32194 = msg("30115", dup309); + +var msg32195 = msg("30116", dup325); + +var msg32196 = msg("30117", dup325); + +var msg32197 = msg("30118", dup325); + +var msg32198 = msg("30119", dup325); + +var msg32199 = msg("30120", dup325); + +var msg32200 = msg("30121", dup325); + +var msg32201 = msg("30122", dup311); + +var msg32202 = msg("30123", dup325); + +var msg32203 = msg("30124", dup325); + +var msg32204 = msg("30125", dup325); + +var msg32205 = msg("30126", dup325); + +var msg32206 = msg("30127", dup311); + +var msg32207 = msg("30128", dup311); + +var msg32208 = msg("30129", dup325); + +var msg32209 = msg("30130", dup325); + +var msg32210 = msg("30131", dup325); + +var msg32211 = msg("30132", dup325); + +var msg32212 = msg("30133", dup311); + +var msg32213 = msg("30134", dup311); + +var msg32214 = msg("30135", dup311); + +var msg32215 = msg("30136", dup311); + +var msg32216 = msg("30137", dup321); + +var msg32217 = msg("30138", dup321); + +var msg32218 = msg("30139", dup314); + +var msg32219 = msg("30140", dup325); + +var msg32220 = msg("30141", dup325); + +var msg32221 = msg("30142", dup325); + +var msg32222 = msg("30143", dup325); + +var msg32223 = msg("30144", dup309); + +var msg32224 = msg("30145", dup309); + +var msg32225 = msg("30146", dup314); + +var msg32226 = msg("30147", dup314); + +var msg32227 = msg("30148", dup314); + +var msg32228 = msg("30149", dup314); + +var msg32229 = msg("30150", dup311); + +var msg32230 = msg("30151", dup311); + +var msg32231 = msg("30152", dup311); + +var msg32232 = msg("30153", dup309); + +var msg32233 = msg("30154", dup309); + +var msg32234 = msg("30155", dup309); + +var msg32235 = msg("30156", dup309); + +var msg32236 = msg("30157", dup309); + +var msg32237 = msg("30158", dup309); + +var msg32238 = msg("30159", dup309); + +var msg32239 = msg("30160", dup309); + +var msg32240 = msg("30161", dup309); + +var msg32241 = msg("30162", dup309); + +var msg32242 = msg("30163", dup309); + +var msg32243 = msg("30164", dup309); + +var msg32244 = msg("30165", dup309); + +var msg32245 = msg("30166", dup309); + +var msg32246 = msg("30167", dup321); + +var msg32247 = msg("30168", dup321); + +var msg32248 = msg("30169", dup325); + +var msg32249 = msg("30170", dup321); + +var msg32250 = msg("30171", dup321); + +var msg32251 = msg("30172", dup321); + +var msg32252 = msg("30173", dup321); + +var msg32253 = msg("30174", dup321); + +var msg32254 = msg("30175", dup321); + +var msg32255 = msg("30176", dup321); + +var msg32256 = msg("30177", dup321); + +var msg32257 = msg("30178", dup321); + +var msg32258 = msg("30179", dup321); + +var msg32259 = msg("30180", dup321); + +var msg32260 = msg("30181", dup321); + +var msg32261 = msg("30182", dup321); + +var msg32262 = msg("30183", dup321); + +var msg32263 = msg("30184", dup321); + +var msg32264 = msg("30185", dup321); + +var msg32265 = msg("30186", dup321); + +var msg32266 = msg("30187", dup321); + +var msg32267 = msg("30188", dup321); + +var msg32268 = msg("30189", dup321); + +var msg32269 = msg("30190", dup321); + +var msg32270 = msg("30191", dup321); + +var msg32271 = msg("30192", dup321); + +var msg32272 = msg("30193", dup321); + +var msg32273 = msg("30194", dup311); + +var msg32274 = msg("30195", dup314); + +var msg32275 = msg("30196", dup321); + +var msg32276 = msg("30197", dup321); + +var msg32277 = msg("30198", dup321); + +var msg32278 = msg("30199", dup324); + +var msg32279 = msg("30200", dup324); + +var msg32280 = msg("30201", dup325); + +var msg32281 = msg("30202", dup309); + +var msg32282 = msg("30203", dup321); + +var msg32283 = msg("30204", dup321); + +var msg32284 = msg("30205", dup309); + +var msg32285 = msg("30206", dup309); + +var msg32286 = msg("30207", dup309); + +var msg32287 = msg("30208", dup321); + +var msg32288 = msg("30209", dup324); + +var msg32289 = msg("30210", dup325); + +var msg32290 = msg("30211", dup321); + +var msg32291 = msg("30212", dup309); + +var msg32292 = msg("30213", dup309); + +var msg32293 = msg("30214", dup321); + +var msg32294 = msg("30215", dup309); + +var msg32295 = msg("30216", dup321); + +var msg32296 = msg("30217", dup311); + +var msg32297 = msg("30218", dup311); + +var msg32298 = msg("30219", dup311); + +var msg32299 = msg("30220", dup311); + +var msg32300 = msg("30221", dup316); + +var msg32301 = msg("30222", dup316); + +var msg32302 = msg("30223", dup316); + +var msg32303 = msg("30224", dup316); + +var msg32304 = msg("30225", dup316); + +var msg32305 = msg("30226", dup316); + +var msg32306 = msg("30227", dup316); + +var msg32307 = msg("30228", dup316); + +var msg32308 = msg("30229", dup316); + +var msg32309 = msg("30230", dup311); + +var msg32310 = msg("30231", dup321); + +var msg32311 = msg("30232", dup311); + +var msg32312 = msg("30233", dup311); + +var msg32313 = msg("30234", dup321); + +var msg32314 = msg("30235", dup321); + +var msg32315 = msg("30236", dup311); + +var msg32316 = msg("30237", dup321); + +var msg32317 = msg("30238", dup321); + +var msg32318 = msg("30239", dup321); + +var msg32319 = msg("30240", dup324); + +var msg32320 = msg("30241", dup324); + +var msg32321 = msg("30242", dup309); + +var msg32322 = msg("30243", dup309); + +var msg32323 = msg("30244", dup338); + +var msg32324 = msg("30245", dup309); + +var msg32325 = msg("30246", dup309); + +var msg32326 = msg("30247", dup338); + +var msg32327 = msg("30248", dup338); + +var msg32328 = msg("30249", dup314); + +var msg32329 = msg("30250", dup325); + +var msg32330 = msg("30251", dup321); + +var msg32331 = msg("30252", dup314); + +var msg32332 = msg("30253", dup314); + +var msg32333 = msg("30254", dup314); + +var msg32334 = msg("30255", dup310); + +var msg32335 = msg("30256", dup310); + +var msg32336 = msg("30257", dup325); + +var msg32337 = msg("30258", dup321); + +var msg32338 = msg("30259", dup321); + +var msg32339 = msg("30260", dup321); + +var msg32340 = msg("30261", dup321); + +var msg32341 = msg("30262", dup321); + +var msg32342 = msg("30263", dup314); + +var msg32343 = msg("30264", dup314); + +var msg32344 = msg("30265", dup314); + +var msg32345 = msg("30266", dup314); + +var msg32346 = msg("30267", dup314); + +var msg32347 = msg("30268", dup314); + +var msg32348 = msg("30269", dup321); + +var msg32349 = msg("30270", dup321); + +var msg32350 = msg("30271", dup321); + +var msg32351 = msg("30272", dup321); + +var msg32352 = msg("30273", dup321); + +var msg32353 = msg("30274", dup311); + +var msg32354 = msg("30275", dup321); + +var msg32355 = msg("30276", dup321); + +var msg32356 = msg("30277", dup321); + +var msg32357 = msg("30278", dup321); + +var msg32358 = msg("30279", dup321); + +var msg32359 = msg("30280", dup311); + +var msg32360 = msg("30281", dup311); + +var msg32361 = msg("30282", dup323); + +var msg32362 = msg("30283", dup323); + +var msg32363 = msg("30284", dup321); + +var msg32364 = msg("30285", dup321); + +var msg32365 = msg("30286", dup321); + +var msg32366 = msg("30287", dup307); + +var msg32367 = msg("30288", dup321); + +var msg32368 = msg("30289", dup325); + +var msg32369 = msg("30290", dup325); + +var msg32370 = msg("30291", dup309); + +var msg32371 = msg("30292", dup309); + +var msg32372 = msg("30293", dup309); + +var msg32373 = msg("30294", dup322); + +var msg32374 = msg("30295", dup322); + +var msg32375 = msg("30296", dup322); + +var msg32376 = msg("30297", dup314); + +var msg32377 = msg("30298", dup321); + +var msg32378 = msg("30299", dup321); + +var msg32379 = msg("30300", dup321); + +var msg32380 = msg("30301", dup325); + +var msg32381 = msg("30302", dup321); + +var msg32382 = msg("30303", dup321); + +var msg32383 = msg("30304", dup321); + +var msg32384 = msg("30305", dup311); + +var msg32385 = msg("30306", dup311); + +var msg32386 = msg("30307", dup314); + +var msg32387 = msg("30308", dup325); + +var msg32388 = msg("30309", dup325); + +var msg32389 = msg("30310", dup321); + +var msg32390 = msg("30311", dup321); + +var msg32391 = msg("30312", dup311); + +var msg32392 = msg("30313", dup311); + +var msg32393 = msg("30314", dup325); + +var msg32394 = msg("30315", dup325); + +var msg32395 = msg("30316", dup311); + +var msg32396 = msg("30317", dup311); + +var msg32397 = msg("30318", dup311); + +var msg32398 = msg("30319", dup311); + +var msg32399 = msg("30320", dup321); + +var msg32400 = msg("30321", dup321); + +var msg32401 = msg("30322", dup321); + +var msg32402 = msg("30323", dup321); + +var msg32403 = msg("30324", dup311); + +var msg32404 = msg("30325", dup311); + +var msg32405 = msg("30326", dup324); + +var msg32406 = msg("30327", dup325); + +var msg32407 = msg("30328", dup325); + +var msg32408 = msg("30329", dup314); + +var msg32409 = msg("30330", dup314); + +var msg32410 = msg("30331", dup325); + +var msg32411 = msg("30332", dup321); + +var msg32412 = msg("30333", dup321); + +var msg32413 = msg("30334", dup321); + +var msg32414 = msg("30335", dup321); + +var msg32415 = msg("30336", dup321); + +var msg32416 = msg("30337", dup324); + +var msg32417 = msg("30338", dup309); + +var all58 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup96, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg32418 = msg("30339", all58); + +var msg32419 = msg("30340", dup324); + +var msg32420 = msg("30341", dup309); + +var msg32421 = msg("30342", dup310); + +var msg32422 = msg("30343", dup322); + +var msg32423 = msg("30344", dup325); + +var msg32424 = msg("30345", dup325); + +var msg32425 = msg("30347", dup309); + +var msg32426 = msg("30348", dup309); + +var msg32427 = msg("30349", dup309); + +var msg32428 = msg("30350", dup316); + +var msg32429 = msg("30351", dup316); + +var msg32430 = msg("30352", dup316); + +var msg32431 = msg("30353", dup316); + +var msg32432 = msg("30354", dup316); + +var msg32433 = msg("30355", dup316); + +var msg32434 = msg("30356", dup316); + +var msg32435 = msg("30357", dup316); + +var msg32436 = msg("30358", dup316); + +var msg32437 = msg("30359", dup316); + +var msg32438 = msg("30360", dup316); + +var msg32439 = msg("30361", dup316); + +var msg32440 = msg("30362", dup316); + +var msg32441 = msg("30363", dup316); + +var msg32442 = msg("30364", dup316); + +var msg32443 = msg("30365", dup316); + +var msg32444 = msg("30366", dup316); + +var msg32445 = msg("30367", dup316); + +var msg32446 = msg("30368", dup316); + +var msg32447 = msg("30369", dup316); + +var msg32448 = msg("30370", dup316); + +var msg32449 = msg("30371", dup316); + +var msg32450 = msg("30372", dup316); + +var msg32451 = msg("30373", dup316); + +var msg32452 = msg("30374", dup316); + +var msg32453 = msg("30375", dup316); + +var msg32454 = msg("30376", dup316); + +var msg32455 = msg("30377", dup316); + +var msg32456 = msg("30378", dup316); + +var msg32457 = msg("30379", dup316); + +var msg32458 = msg("30380", dup316); + +var msg32459 = msg("30381", dup316); + +var msg32460 = msg("30382", dup316); + +var msg32461 = msg("30383", dup316); + +var msg32462 = msg("30384", dup316); + +var msg32463 = msg("30385", dup316); + +var msg32464 = msg("30386", dup316); + +var msg32465 = msg("30387", dup316); + +var msg32466 = msg("30388", dup316); + +var msg32467 = msg("30389", dup316); + +var msg32468 = msg("30390", dup316); + +var msg32469 = msg("30391", dup316); + +var msg32470 = msg("30392", dup316); + +var msg32471 = msg("30393", dup316); + +var msg32472 = msg("30394", dup316); + +var msg32473 = msg("30395", dup316); + +var msg32474 = msg("30396", dup316); + +var msg32475 = msg("30397", dup316); + +var msg32476 = msg("30398", dup316); + +var msg32477 = msg("30399", dup316); + +var msg32478 = msg("30400", dup316); + +var msg32479 = msg("30401", dup316); + +var msg32480 = msg("30402", dup316); + +var msg32481 = msg("30403", dup316); + +var msg32482 = msg("30404", dup316); + +var msg32483 = msg("30405", dup316); + +var msg32484 = msg("30406", dup316); + +var msg32485 = msg("30407", dup316); + +var msg32486 = msg("30408", dup316); + +var msg32487 = msg("30409", dup316); + +var msg32488 = msg("30410", dup316); + +var msg32489 = msg("30411", dup316); + +var msg32490 = msg("30412", dup316); + +var msg32491 = msg("30413", dup316); + +var msg32492 = msg("30414", dup316); + +var msg32493 = msg("30415", dup316); + +var msg32494 = msg("30416", dup316); + +var msg32495 = msg("30417", dup316); + +var msg32496 = msg("30418", dup316); + +var msg32497 = msg("30419", dup316); + +var msg32498 = msg("30420", dup316); + +var msg32499 = msg("30421", dup316); + +var msg32500 = msg("30422", dup316); + +var msg32501 = msg("30423", dup316); + +var msg32502 = msg("30424", dup316); + +var msg32503 = msg("30425", dup316); + +var msg32504 = msg("30426", dup316); + +var msg32505 = msg("30427", dup316); + +var msg32506 = msg("30428", dup316); + +var msg32507 = msg("30429", dup316); + +var msg32508 = msg("30430", dup316); + +var msg32509 = msg("30431", dup316); + +var msg32510 = msg("30432", dup316); + +var msg32511 = msg("30433", dup316); + +var msg32512 = msg("30434", dup316); + +var msg32513 = msg("30435", dup316); + +var msg32514 = msg("30436", dup316); + +var msg32515 = msg("30437", dup316); + +var msg32516 = msg("30438", dup316); + +var msg32517 = msg("30439", dup316); + +var msg32518 = msg("30440", dup316); + +var msg32519 = msg("30441", dup316); + +var msg32520 = msg("30442", dup316); + +var msg32521 = msg("30443", dup316); + +var msg32522 = msg("30444", dup316); + +var msg32523 = msg("30445", dup316); + +var msg32524 = msg("30446", dup316); + +var msg32525 = msg("30447", dup316); + +var msg32526 = msg("30448", dup316); + +var msg32527 = msg("30449", dup316); + +var msg32528 = msg("30450", dup316); + +var msg32529 = msg("30451", dup316); + +var msg32530 = msg("30452", dup316); + +var msg32531 = msg("30453", dup316); + +var msg32532 = msg("30454", dup316); + +var msg32533 = msg("30455", dup316); + +var msg32534 = msg("30456", dup316); + +var msg32535 = msg("30457", dup316); + +var msg32536 = msg("30458", dup316); + +var msg32537 = msg("30459", dup316); + +var msg32538 = msg("30460", dup316); + +var msg32539 = msg("30461", dup316); + +var msg32540 = msg("30462", dup316); + +var msg32541 = msg("30463", dup316); + +var msg32542 = msg("30464", dup316); + +var msg32543 = msg("30465", dup316); + +var msg32544 = msg("30466", dup316); + +var msg32545 = msg("30467", dup316); + +var msg32546 = msg("30468", dup316); + +var msg32547 = msg("30469", dup316); + +var msg32548 = msg("30470", dup316); + +var msg32549 = msg("30471", dup316); + +var msg32550 = msg("30472", dup316); + +var msg32551 = msg("30473", dup316); + +var msg32552 = msg("30474", dup316); + +var msg32553 = msg("30475", dup316); + +var msg32554 = msg("30476", dup316); + +var msg32555 = msg("30477", dup316); + +var msg32556 = msg("30478", dup316); + +var msg32557 = msg("30479", dup316); + +var msg32558 = msg("30480", dup316); + +var msg32559 = msg("30481", dup321); + +var msg32560 = msg("30482", dup321); + +var msg32561 = msg("30483", dup321); + +var msg32562 = msg("30484", dup321); + +var msg32563 = msg("30485", dup314); + +var msg32564 = msg("30486", dup314); + +var msg32565 = msg("30487", dup309); + +var msg32566 = msg("30488", dup309); + +var msg32567 = msg("30489", dup309); + +var msg32568 = msg("30490", dup311); + +var msg32569 = msg("30491", dup311); + +var msg32570 = msg("30492", dup321); + +var msg32571 = msg("30493", dup321); + +var msg32572 = msg("30494", dup321); + +var msg32573 = msg("30495", dup321); + +var msg32574 = msg("30496", dup321); + +var msg32575 = msg("30497", dup325); + +var msg32576 = msg("30498", dup325); + +var msg32577 = msg("30499", dup311); + +var msg32578 = msg("30500", dup311); + +var msg32579 = msg("30501", dup325); + +var msg32580 = msg("30502", dup325); + +var msg32581 = msg("30503", dup325); + +var msg32582 = msg("30504", dup325); + +var msg32583 = msg("30505", dup325); + +var msg32584 = msg("30506", dup325); + +var msg32585 = msg("30507", dup309); + +var msg32586 = msg("30508", dup325); + +var msg32587 = msg("30509", dup325); + +var msg32588 = msg("30510", dup316); + +var msg32589 = msg("30511", dup316); + +var msg32590 = msg("30512", dup316); + +var msg32591 = msg("30513", dup316); + +var msg32592 = msg("30514", dup316); + +var msg32593 = msg("30515", dup316); + +var msg32594 = msg("30516", dup316); + +var msg32595 = msg("30517", dup316); + +var msg32596 = msg("30518", dup325); + +var msg32597 = msg("30519", dup321); + +var msg32598 = msg("30520", dup309); + +var msg32599 = msg("30521", dup309); + +var msg32600 = msg("30522", dup309); + +var msg32601 = msg("30523", dup309); + +var all59 = all_match({ + processors: [ + dup66, + dup179, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg32602 = msg("30524", all59); + +var msg32603 = msg("30525", dup309); + +var msg32604 = msg("30526", dup311); + +var msg32605 = msg("30527", dup311); + +var msg32606 = msg("30528", dup323); + +var msg32607 = msg("30529", dup323); + +var msg32608 = msg("30530", dup309); + +var msg32609 = msg("30531", dup309); + +var msg32610 = msg("30532", dup314); + +var msg32611 = msg("30533", dup309); + +var msg32612 = msg("30534", dup309); + +var msg32613 = msg("30535", dup314); + +var msg32614 = msg("30536", dup314); + +var msg32615 = msg("30537", dup314); + +var msg32616 = msg("30538", dup314); + +var msg32617 = msg("30539", dup314); + +var msg32618 = msg("30540", dup314); + +var msg32619 = msg("30541", dup321); + +var msg32620 = msg("30542", dup321); + +var msg32621 = msg("30543", dup321); + +var msg32622 = msg("30544", dup321); + +var msg32623 = msg("30545", dup321); + +var msg32624 = msg("30546", dup321); + +var msg32625 = msg("30547", dup321); + +var msg32626 = msg("30548", dup321); + +var msg32627 = msg("30549", dup311); + +var msg32628 = msg("30550", dup321); + +var msg32629 = msg("30551", dup325); + +var msg32630 = msg("30552", dup325); + +var msg32631 = msg("30553", dup314); + +var msg32632 = msg("30554", dup314); + +var msg32633 = msg("30555", dup314); + +var msg32634 = msg("30556", dup314); + +var msg32635 = msg("30562", dup309); + +var msg32636 = msg("30566", dup321); + +var msg32637 = msg("30570", dup321); + +var msg32638 = msg("30711", dup309); + +var msg32639 = msg("30712", dup309); + +var msg32640 = msg("30713", dup309); + +var msg32641 = msg("30714", dup309); + +var msg32642 = msg("30715", dup309); + +var msg32643 = msg("30716", dup309); + +var msg32644 = msg("30717", dup309); + +var msg32645 = msg("30718", dup309); + +var msg32646 = msg("30719", dup314); + +var msg32647 = msg("30720", dup314); + +var msg32648 = msg("30721", dup314); + +var msg32649 = msg("30722", dup314); + +var msg32650 = msg("30723", dup314); + +var msg32651 = msg("30724", dup314); + +var msg32652 = msg("30725", dup314); + +var msg32653 = msg("30726", dup314); + +var msg32654 = msg("30727", dup309); + +var msg32655 = msg("30728", dup309); + +var msg32656 = msg("30729", dup309); + +var msg32657 = msg("30730", dup309); + +var msg32658 = msg("30731", dup309); + +var msg32659 = msg("30732", dup309); + +var msg32660 = msg("30733", dup309); + +var msg32661 = msg("30734", dup309); + +var msg32662 = msg("30735", dup314); + +var msg32663 = msg("30736", dup314); + +var msg32664 = msg("30737", dup314); + +var msg32665 = msg("30738", dup314); + +var msg32666 = msg("30739", dup314); + +var msg32667 = msg("30740", dup314); + +var msg32668 = msg("30741", dup314); + +var msg32669 = msg("30742", dup314); + +var msg32670 = msg("30743", dup321); + +var msg32671 = msg("30744", dup321); + +var msg32672 = msg("30745", dup321); + +var msg32673 = msg("30746", dup321); + +var msg32674 = msg("30747", dup321); + +var msg32675 = msg("30748", dup321); + +var msg32676 = msg("30749", dup321); + +var msg32677 = msg("30750", dup321); + +var msg32678 = msg("30751", dup321); + +var msg32679 = msg("30752", dup321); + +var msg32680 = msg("30753", dup321); + +var msg32681 = msg("30754", dup311); + +var msg32682 = msg("30755", dup311); + +var msg32683 = msg("30756", dup314); + +var msg32684 = msg("30757", dup314); + +var msg32685 = msg("30758", dup314); + +var msg32686 = msg("30759", dup314); + +var msg32687 = msg("30760", dup314); + +var msg32688 = msg("30761", dup309); + +var msg32689 = msg("30762", dup309); + +var msg32690 = msg("30763", dup309); + +var msg32691 = msg("30764", dup309); + +var msg32692 = msg("30765", dup314); + +var msg32693 = msg("30766", dup311); + +var msg32694 = msg("30767", dup311); + +var msg32695 = msg("30768", dup311); + +var msg32696 = msg("30777", dup314); + +var msg32697 = msg("30778", dup314); + +var msg32698 = msg("30779", dup314); + +var msg32699 = msg("30780", dup314); + +var msg32700 = msg("30781", dup314); + +var msg32701 = msg("30782", dup314); + +var msg32702 = msg("30783", dup314); + +var msg32703 = msg("30784", dup314); + +var msg32704 = msg("30785", dup314); + +var msg32705 = msg("30786", dup314); + +var msg32706 = msg("30787", dup314); + +var msg32707 = msg("30788", dup314); + +var msg32708 = msg("30789", dup311); + +var msg32709 = msg("30790", dup314); + +var msg32710 = msg("30791", dup314); + +var msg32711 = msg("30792", dup314); + +var msg32712 = msg("30793", dup314); + +var msg32713 = msg("30794", dup325); + +var msg32714 = msg("30795", dup321); + +var msg32715 = msg("30796", dup321); + +var msg32716 = msg("30797", dup309); + +var msg32717 = msg("30798", dup309); + +var msg32718 = msg("30799", dup309); + +var msg32719 = msg("30800", dup309); + +var msg32720 = msg("30801", dup309); + +var msg32721 = msg("30802", dup309); + +var msg32722 = msg("30803", dup325); + +var msg32723 = msg("30804", dup321); + +var msg32724 = msg("30805", dup321); + +var msg32725 = msg("30806", dup321); + +var msg32726 = msg("30807", dup321); + +var msg32727 = msg("30808", dup321); + +var msg32728 = msg("30809", dup321); + +var msg32729 = msg("30810", dup321); + +var msg32730 = msg("30811", dup321); + +var msg32731 = msg("30812", dup321); + +var msg32732 = msg("30813", dup321); + +var msg32733 = msg("30814", dup321); + +var msg32734 = msg("30815", dup321); + +var msg32735 = msg("30816", dup314); + +var msg32736 = msg("30817", dup314); + +var msg32737 = msg("30818", dup314); + +var msg32738 = msg("30819", dup314); + +var msg32739 = msg("30820", dup314); + +var msg32740 = msg("30821", dup314); + +var msg32741 = msg("30822", dup314); + +var msg32742 = msg("30823", dup314); + +var msg32743 = msg("30824", dup321); + +var msg32744 = msg("30825", dup321); + +var msg32745 = msg("30826", dup321); + +var msg32746 = msg("30827", dup321); + +var msg32747 = msg("30828", dup321); + +var msg32748 = msg("30829", dup321); + +var msg32749 = msg("30830", dup321); + +var msg32750 = msg("30831", dup321); + +var msg32751 = msg("30832", dup321); + +var msg32752 = msg("30833", dup321); + +var msg32753 = msg("30834", dup321); + +var msg32754 = msg("30835", dup321); + +var msg32755 = msg("30836", dup321); + +var msg32756 = msg("30837", dup321); + +var msg32757 = msg("30838", dup321); + +var msg32758 = msg("30839", dup321); + +var msg32759 = msg("30840", dup321); + +var msg32760 = msg("30841", dup321); + +var msg32761 = msg("30842", dup321); + +var msg32762 = msg("30843", dup311); + +var msg32763 = msg("30844", dup311); + +var msg32764 = msg("30845", dup307); + +var msg32765 = msg("30846", dup307); + +var msg32766 = msg("30847", dup325); + +var msg32767 = msg("30848", dup325); + +var msg32768 = msg("30849", dup325); + +var msg32769 = msg("30850", dup325); + +var msg32770 = msg("30851", dup325); + +var msg32771 = msg("30852", dup311); + +var msg32772 = msg("30853", dup329); + +var msg32773 = msg("30854", dup329); + +var msg32774 = msg("30855", dup329); + +var msg32775 = msg("30856", dup329); + +var msg32776 = msg("30857", dup329); + +var msg32777 = msg("30858", dup329); + +var msg32778 = msg("30859", dup329); + +var msg32779 = msg("30860", dup329); + +var msg32780 = msg("30861", dup329); + +var msg32781 = msg("30862", dup329); + +var msg32782 = msg("30863", dup329); + +var msg32783 = msg("30864", dup329); + +var msg32784 = msg("30865", dup329); + +var msg32785 = msg("30866", dup329); + +var msg32786 = msg("30867", dup329); + +var msg32787 = msg("30868", dup329); + +var msg32788 = msg("30869", dup329); + +var msg32789 = msg("30870", dup329); + +var msg32790 = msg("30871", dup329); + +var msg32791 = msg("30872", dup329); + +var msg32792 = msg("30873", dup329); + +var msg32793 = msg("30874", dup329); + +var msg32794 = msg("30875", dup329); + +var msg32795 = msg("30876", dup309); + +var msg32796 = msg("30877", dup309); + +var msg32797 = msg("30878", dup311); + +var msg32798 = msg("30879", dup321); + +var msg32799 = msg("30880", dup200); + +var msg32800 = msg("30881", dup329); + +var msg32801 = msg("30882", dup321); + +var msg32802 = msg("30883", dup321); + +var msg32803 = msg("30884", dup324); + +var msg32804 = msg("30885", dup307); + +var msg32805 = msg("30886", dup307); + +var msg32806 = msg("30887", dup316); + +var msg32807 = msg("30888", dup316); + +var msg32808 = msg("30889", dup309); + +var msg32809 = msg("30890", dup309); + +var msg32810 = msg("30891", dup321); + +var msg32811 = msg("30892", dup325); + +var msg32812 = msg("30893", dup325); + +var msg32813 = msg("30894", dup325); + +var msg32814 = msg("30895", dup325); + +var msg32815 = msg("30896", dup321); + +var msg32816 = msg("30897", dup321); + +var msg32817 = msg("30898", dup314); + +var msg32818 = msg("30899", dup321); + +var msg32819 = msg("30900", dup321); + +var msg32820 = msg("30901", dup325); + +var msg32821 = msg("30902", dup311); + +var msg32822 = msg("30903", dup311); + +var msg32823 = msg("30904", dup311); + +var msg32824 = msg("30905", dup311); + +var msg32825 = msg("30906", dup311); + +var msg32826 = msg("30907", dup311); + +var msg32827 = msg("30908", dup311); + +var msg32828 = msg("30909", dup311); + +var msg32829 = msg("30910", dup314); + +var msg32830 = msg("30911", dup314); + +var msg32831 = msg("30912", dup311); + +var msg32832 = msg("30913", dup311); + +var msg32833 = msg("30914", dup321); + +var msg32834 = msg("30915", dup321); + +var msg32835 = msg("30916", dup333); + +var msg32836 = msg("30917", dup321); + +var msg32837 = msg("30918", dup325); + +var msg32838 = msg("30919", dup321); + +var msg32839 = msg("30920", dup307); + +var msg32840 = msg("30921", dup311); + +var msg32841 = msg("30922", dup311); + +var msg32842 = msg("30923", dup321); + +var msg32843 = msg("30924", dup321); + +var msg32844 = msg("30925", dup321); + +var msg32845 = msg("30926", dup321); + +var msg32846 = msg("30927", dup321); + +var msg32847 = msg("30928", dup314); + +var msg32848 = msg("30929", dup310); + +var msg32849 = msg("30930", dup321); + +var msg32850 = msg("30931", dup310); + +var msg32851 = msg("30932", dup311); + +var msg32852 = msg("30933", dup311); + +var msg32853 = msg("30934", dup311); + +var msg32854 = msg("30935", dup311); + +var msg32855 = msg("30936", dup311); + +var msg32856 = msg("30937", dup311); + +var msg32857 = msg("30938", dup321); + +var msg32858 = msg("30939", dup311); + +var msg32859 = msg("30940", dup311); + +var msg32860 = msg("30941", dup309); + +var msg32861 = msg("30942", dup311); + +var msg32862 = msg("30943", dup311); + +var msg32863 = msg("30944", dup314); + +var msg32864 = msg("30945", dup333); + +var msg32865 = msg("30946", dup321); + +var msg32866 = msg("30947", dup321); + +var msg32867 = msg("30948", dup321); + +var msg32868 = msg("30949", dup321); + +var msg32869 = msg("30950", dup311); + +var msg32870 = msg("30951", dup314); + +var msg32871 = msg("30952", dup321); + +var msg32872 = msg("30953", dup321); + +var msg32873 = msg("30954", dup321); + +var msg32874 = msg("30955", dup321); + +var msg32875 = msg("30956", dup311); + +var msg32876 = msg("30957", dup311); + +var msg32877 = msg("30958", dup311); + +var msg32878 = msg("30959", dup311); + +var msg32879 = msg("30960", dup311); + +var msg32880 = msg("30961", dup325); + +var msg32881 = msg("30962", dup325); + +var msg32882 = msg("30963", dup325); + +var msg32883 = msg("30964", dup325); + +var msg32884 = msg("30965", dup311); + +var msg32885 = msg("30966", dup311); + +var msg32886 = msg("30967", dup311); + +var msg32887 = msg("30968", dup311); + +var msg32888 = msg("30969", dup311); + +var msg32889 = msg("30970", dup311); + +var msg32890 = msg("30971", dup311); + +var msg32891 = msg("30972", dup311); + +var msg32892 = msg("30973", dup311); + +var msg32893 = msg("30974", dup307); + +var msg32894 = msg("30975", dup311); + +var msg32895 = msg("30976", dup311); + +var msg32896 = msg("30977", dup321); + +var msg32897 = msg("30978", dup321); + +var msg32898 = msg("30979", dup321); + +var msg32899 = msg("30980", dup321); + +var msg32900 = msg("30981", dup321); + +var msg32901 = msg("30982", dup321); + +var msg32902 = msg("30983", dup321); + +var msg32903 = msg("30984", dup321); + +var msg32904 = msg("30985", dup321); + +var msg32905 = msg("30986", dup321); + +var msg32906 = msg("30987", dup321); + +var msg32907 = msg("30988", dup321); + +var msg32908 = msg("30989", dup321); + +var msg32909 = msg("30990", dup311); + +var msg32910 = msg("30991", dup311); + +var msg32911 = msg("30992", dup314); + +var msg32912 = msg("30993", dup314); + +var msg32913 = msg("30994", dup314); + +var msg32914 = msg("30995", dup314); + +var msg32915 = msg("30996", dup314); + +var msg32916 = msg("30997", dup321); + +var msg32917 = msg("30998", dup321); + +var msg32918 = msg("30999", dup321); + +var msg32919 = msg("31000", dup321); + +var msg32920 = msg("31001", dup321); + +var msg32921 = msg("31002", dup321); + +var msg32922 = msg("31003", dup321); + +var msg32923 = msg("31004", dup321); + +var msg32924 = msg("31005", dup321); + +var msg32925 = msg("31006", dup321); + +var msg32926 = msg("31007", dup323); + +var msg32927 = msg("31008", dup309); + +var msg32928 = msg("31009", dup309); + +var msg32929 = msg("31010", dup321); + +var msg32930 = msg("31011", dup314); + +var msg32931 = msg("31012", dup314); + +var msg32932 = msg("31013", dup314); + +var msg32933 = msg("31014", dup321); + +var msg32934 = msg("31015", dup309); + +var msg32935 = msg("31016", dup309); + +var msg32936 = msg("31017", dup325); + +var msg32937 = msg("31018", dup325); + +var msg32938 = msg("31019", dup321); + +var msg32939 = msg("31020", dup321); + +var msg32940 = msg("31021", dup311); + +var msg32941 = msg("31022", dup311); + +var msg32942 = msg("31023", dup311); + +var msg32943 = msg("31024", dup311); + +var msg32944 = msg("31025", dup311); + +var msg32945 = msg("31026", dup311); + +var msg32946 = msg("31027", dup309); + +var msg32947 = msg("31028", dup309); + +var msg32948 = msg("31029", dup309); + +var msg32949 = msg("31030", dup309); + +var msg32950 = msg("31031", dup309); + +var msg32951 = msg("31032", dup309); + +var msg32952 = msg("31033", dup321); + +var msg32953 = msg("31034", dup321); + +var msg32954 = msg("31035", dup321); + +var msg32955 = msg("31036", dup321); + +var msg32956 = msg("31037", dup309); + +var msg32957 = msg("31038", dup309); + +var msg32958 = msg("31039", dup309); + +var msg32959 = msg("31040", dup309); + +var msg32960 = msg("31041", dup309); + +var msg32961 = msg("31042", dup321); + +var msg32962 = msg("31043", dup314); + +var msg32963 = msg("31044", dup314); + +var msg32964 = msg("31045", dup330); + +var msg32965 = msg("31046", dup311); + +var msg32966 = msg("31048", dup321); + +var msg32967 = msg("31049", dup321); + +var msg32968 = msg("31050", dup321); + +var msg32969 = msg("31051", dup321); + +var msg32970 = msg("31052", dup321); + +var msg32971 = msg("31053", dup321); + +var msg32972 = msg("31054", dup321); + +var msg32973 = msg("31055", dup321); + +var msg32974 = msg("31056", dup315); + +var msg32975 = msg("31057", dup315); + +var msg32976 = msg("31058", dup315); + +var msg32977 = msg("31059", dup315); + +var msg32978 = msg("31060", dup325); + +var msg32979 = msg("31061", dup325); + +var msg32980 = msg("31062", dup325); + +var msg32981 = msg("31063", dup333); + +var msg32982 = msg("31064", dup321); + +var msg32983 = msg("31065", dup321); + +var msg32984 = msg("31066", dup321); + +var msg32985 = msg("31067", dup322); + +var msg32986 = msg("31068", dup307); + +var msg32987 = msg("31069", dup307); + +var msg32988 = msg("31070", dup321); + +var msg32989 = msg("31071", dup335); + +var msg32990 = msg("31072", dup321); + +var msg32991 = msg("31073", dup321); + +var msg32992 = msg("31074", dup321); + +var msg32993 = msg("31075", dup325); + +var msg32994 = msg("31076", dup314); + +var msg32995 = msg("31077", dup321); + +var msg32996 = msg("31078", dup321); + +var msg32997 = msg("31079", dup321); + +var msg32998 = msg("31080", dup321); + +var msg32999 = msg("31081", dup321); + +var msg33000 = msg("31082", dup323); + +var msg33001 = msg("31083", dup321); + +var msg33002 = msg("31084", dup321); + +var msg33003 = msg("31085", dup314); + +var msg33004 = msg("31086", dup314); + +var msg33005 = msg("31087", dup311); + +var msg33006 = msg("31088", dup311); + +var msg33007 = msg("31089", dup321); + +var msg33008 = msg("31090", dup325); + +var msg33009 = msg("31091", dup321); + +var msg33010 = msg("31092", dup311); + +var msg33011 = msg("31093", dup311); + +var msg33012 = msg("31094", dup311); + +var msg33013 = msg("31095", dup315); + +var msg33014 = msg("31096", dup315); + +var msg33015 = msg("31097", dup315); + +var msg33016 = msg("31098", dup315); + +var msg33017 = msg("31099", dup315); + +var msg33018 = msg("31100", dup315); + +var msg33019 = msg("31101", dup314); + +var msg33020 = msg("31102", dup321); + +var msg33021 = msg("31103", dup309); + +var msg33022 = msg("31104", dup309); + +var msg33023 = msg("31105", dup309); + +var msg33024 = msg("31106", dup309); + +var msg33025 = msg("31107", dup321); + +var msg33026 = msg("31108", dup321); + +var msg33027 = msg("31109", dup321); + +var msg33028 = msg("31110", dup321); + +var msg33029 = msg("31111", dup321); + +var msg33030 = msg("31112", dup321); + +var msg33031 = msg("31113", dup321); + +var msg33032 = msg("31114", dup321); + +var msg33033 = msg("31115", dup321); + +var msg33034 = msg("31116", dup321); + +var msg33035 = msg("31117", dup321); + +var msg33036 = msg("31118", dup321); + +var msg33037 = msg("31119", dup321); + +var msg33038 = msg("31120", dup321); + +var msg33039 = msg("31121", dup321); + +var msg33040 = msg("31122", dup325); + +var msg33041 = msg("31123", dup321); + +var msg33042 = msg("31124", dup321); + +var msg33043 = msg("31125", dup309); + +var msg33044 = msg("31126", dup309); + +var msg33045 = msg("31127", dup309); + +var msg33046 = msg("31128", dup333); + +var msg33047 = msg("31129", dup311); + +var msg33048 = msg("31130", dup311); + +var msg33049 = msg("31131", dup321); + +var msg33050 = msg("31132", dup321); + +var msg33051 = msg("31133", dup321); + +var msg33052 = msg("31134", dup321); + +var msg33053 = msg("31135", dup321); + +var msg33054 = msg("31136", dup321); + +var msg33055 = msg("31137", dup321); + +var msg33056 = msg("31138", dup321); + +var msg33057 = msg("31139", dup321); + +var msg33058 = msg("31140", dup321); + +var msg33059 = msg("31141", dup321); + +var msg33060 = msg("31142", dup321); + +var msg33061 = msg("31143", dup314); + +var msg33062 = msg("31144", dup321); + +var msg33063 = msg("31145", dup321); + +var msg33064 = msg("31146", dup321); + +var msg33065 = msg("31167", dup321); + +var msg33066 = msg("31176", dup309); + +var msg33067 = msg("31177", dup309); + +var msg33068 = msg("31178", dup309); + +var msg33069 = msg("31179", dup309); + +var msg33070 = msg("31180", dup324); + +var msg33071 = msg("31181", dup324); + +var msg33072 = msg("31182", dup309); + +var msg33073 = msg("31183", dup321); + +var msg33074 = msg("31184", dup321); + +var msg33075 = msg("31185", dup321); + +var msg33076 = msg("31186", dup321); + +var msg33077 = msg("31187", dup321); + +var msg33078 = msg("31188", dup309); + +var msg33079 = msg("31189", dup309); + +var msg33080 = msg("31190", dup325); + +var msg33081 = msg("31191", dup325); + +var msg33082 = msg("31192", dup325); + +var msg33083 = msg("31193", dup325); + +var msg33084 = msg("31194", dup325); + +var msg33085 = msg("31195", dup314); + +var msg33086 = msg("31196", dup325); + +var msg33087 = msg("31197", dup325); + +var msg33088 = msg("31198", dup325); + +var msg33089 = msg("31199", dup325); + +var msg33090 = msg("31200", dup325); + +var msg33091 = msg("31201", dup325); + +var msg33092 = msg("31202", dup325); + +var msg33093 = msg("31203", dup325); + +var msg33094 = msg("31204", dup325); + +var msg33095 = msg("31205", dup325); + +var msg33096 = msg("31206", dup325); + +var msg33097 = msg("31207", dup325); + +var msg33098 = msg("31208", dup325); + +var msg33099 = msg("31209", dup325); + +var msg33100 = msg("31210", dup309); + +var msg33101 = msg("31211", dup309); + +var msg33102 = msg("31212", dup310); + +var msg33103 = msg("31213", dup310); + +var msg33104 = msg("31214", dup321); + +var msg33105 = msg("31215", dup325); + +var msg33106 = msg("31216", dup325); + +var msg33107 = msg("31217", dup314); + +var msg33108 = msg("31218", dup321); + +var msg33109 = msg("31219", dup325); + +var msg33110 = msg("31220", dup325); + +var msg33111 = msg("31221", dup321); + +var msg33112 = msg("31222", dup321); + +var msg33113 = msg("31223", dup321); + +var msg33114 = msg("31224", dup321); + +var msg33115 = msg("31225", dup325); + +var msg33116 = msg("31226", dup321); + +var msg33117 = msg("31227", dup321); + +var msg33118 = msg("31228", dup321); + +var msg33119 = msg("31229", dup311); + +var msg33120 = msg("31230", dup311); + +var msg33121 = msg("31231", dup311); + +var msg33122 = msg("31232", dup311); + +var msg33123 = msg("31233", dup321); + +var msg33124 = msg("31234", dup321); + +var msg33125 = msg("31235", dup321); + +var msg33126 = msg("31236", dup321); + +var msg33127 = msg("31237", dup311); + +var msg33128 = msg("31238", dup311); + +var msg33129 = msg("31239", dup321); + +var msg33130 = msg("31240", dup324); + +var msg33131 = msg("31241", dup324); + +var msg33132 = msg("31242", dup321); + +var msg33133 = msg("31243", dup321); + +var msg33134 = msg("31244", dup321); + +var msg33135 = msg("31245", dup311); + +var msg33136 = msg("31246", dup311); + +var msg33137 = msg("31247", dup321); + +var msg33138 = msg("31248", dup321); + +var msg33139 = msg("31249", dup321); + +var msg33140 = msg("31250", dup321); + +var msg33141 = msg("31251", dup321); + +var msg33142 = msg("31252", dup321); + +var msg33143 = msg("31253", dup321); + +var msg33144 = msg("31254", dup321); + +var msg33145 = msg("31255", dup321); + +var msg33146 = msg("31256", dup321); + +var msg33147 = msg("31257", dup321); + +var msg33148 = msg("31258", dup321); + +var msg33149 = msg("31259", dup314); + +var msg33150 = msg("31260", dup310); + +var msg33151 = msg("31261", dup321); + +var msg33152 = msg("31262", dup321); + +var msg33153 = msg("31263", dup321); + +var msg33154 = msg("31264", dup321); + +var msg33155 = msg("31265", dup321); + +var msg33156 = msg("31266", dup321); + +var msg33157 = msg("31267", dup321); + +var msg33158 = msg("31268", dup321); + +var msg33159 = msg("31269", dup321); + +var msg33160 = msg("31270", dup321); + +var msg33161 = msg("31271", dup321); + +var msg33162 = msg("31272", dup321); + +var msg33163 = msg("31273", dup321); + +var msg33164 = msg("31274", dup311); + +var msg33165 = msg("31275", dup311); + +var msg33166 = msg("31276", dup311); + +var msg33167 = msg("31277", dup311); + +var msg33168 = msg("31278", dup311); + +var msg33169 = msg("31279", dup311); + +var msg33170 = msg("31280", dup311); + +var msg33171 = msg("31281", dup314); + +var msg33172 = msg("31282", dup314); + +var msg33173 = msg("31283", dup325); + +var msg33174 = msg("31284", dup325); + +var msg33175 = msg("31285", dup325); + +var msg33176 = msg("31286", dup325); + +var msg33177 = msg("31287", dup321); + +var msg33178 = msg("31288", dup321); + +var msg33179 = msg("31289", dup314); + +var msg33180 = msg("31290", dup321); + +var msg33181 = msg("31291", dup311); + +var msg33182 = msg("31292", dup311); + +var msg33183 = msg("31293", dup321); + +var msg33184 = msg("31294", dup321); + +var msg33185 = msg("31295", dup321); + +var msg33186 = msg("31296", dup325); + +var msg33187 = msg("31297", dup324); + +var msg33188 = msg("31298", dup311); + +var msg33189 = msg("31299", dup321); + +var msg33190 = msg("31300", dup322); + +var msg33191 = msg("31301", dup311); + +var msg33192 = msg("31302", dup314); + +var msg33193 = msg("31303", dup321); + +var msg33194 = msg("31304", dup314); + +var msg33195 = msg("31305", dup314); + +var msg33196 = msg("31306", dup321); + +var msg33197 = msg("31307", dup321); + +var msg33198 = msg("31308", dup311); + +var msg33199 = msg("31309", dup311); + +var msg33200 = msg("31310", dup309); + +var msg33201 = msg("31311", dup309); + +var msg33202 = msg("31312", dup309); + +var msg33203 = msg("31313", dup321); + +var msg33204 = msg("31314", dup321); + +var msg33205 = msg("31315", dup321); + +var msg33206 = msg("31316", dup321); + +var msg33207 = msg("31317", dup321); + +var msg33208 = msg("31318", dup321); + +var msg33209 = msg("31319", dup321); + +var msg33210 = msg("31320", dup307); + +var msg33211 = msg("31321", dup307); + +var msg33212 = msg("31322", dup307); + +var msg33213 = msg("31323", dup311); + +var msg33214 = msg("31324", dup311); + +var msg33215 = msg("31325", dup311); + +var msg33216 = msg("31326", dup321); + +var msg33217 = msg("31327", dup321); + +var msg33218 = msg("31328", dup321); + +var msg33219 = msg("31329", dup321); + +var msg33220 = msg("31330", dup316); + +var msg33221 = msg("31331", dup311); + +var msg33222 = msg("31332", dup311); + +var msg33223 = msg("31333", dup314); + +var msg33224 = msg("31334", dup314); + +var msg33225 = msg("31335", dup314); + +var msg33226 = msg("31336", dup314); + +var msg33227 = msg("31337", dup311); + +var msg33228 = msg("31338", dup309); + +var msg33229 = msg("31339", dup314); + +var msg33230 = msg("31340", dup314); + +var msg33231 = msg("31341", dup314); + +var msg33232 = msg("31342", dup314); + +var msg33233 = msg("31343", dup321); + +var msg33234 = msg("31344", dup321); + +var msg33235 = msg("31345", dup321); + +var msg33236 = msg("31346", dup321); + +var msg33237 = msg("31347", dup311); + +var msg33238 = msg("31348", dup311); + +var msg33239 = msg("31349", dup311); + +var msg33240 = msg("31350", dup311); + +var msg33241 = msg("31351", dup311); + +var msg33242 = msg("31352", dup311); + +var msg33243 = msg("31353", dup311); + +var msg33244 = msg("31354", dup311); + +var msg33245 = msg("31355", dup321); + +var msg33246 = msg("31356", dup311); + +var msg33247 = msg("31357", dup321); + +var msg33248 = msg("31358", dup321); + +var msg33249 = msg("31359", dup321); + +var msg33250 = msg("31360", dup311); + +var msg33251 = msg("31361", dup309); + +var msg33252 = msg("31362", dup311); + +var msg33253 = msg("31363", dup314); + +var msg33254 = msg("31364", dup323); + +var msg33255 = msg("31365", dup311); + +var msg33256 = msg("31366", dup314); + +var msg33257 = msg("31367", dup314); + +var msg33258 = msg("31368", dup311); + +var msg33259 = msg("31369", dup311); + +var msg33260 = msg("31370", dup311); + +var msg33261 = msg("31371", dup311); + +var msg33262 = msg("31372", dup311); + +var msg33263 = msg("31373", dup309); + +var msg33264 = msg("31374", dup309); + +var msg33265 = msg("31375", dup309); + +var msg33266 = msg("31376", dup314); + +var msg33267 = msg("31377", dup314); + +var msg33268 = msg("31378", dup309); + +var msg33269 = msg("31379", dup309); + +var msg33270 = msg("31380", dup311); + +var msg33271 = msg("31381", dup311); + +var msg33272 = msg("31382", dup325); + +var msg33273 = msg("31383", dup325); + +var msg33274 = msg("31384", dup325); + +var msg33275 = msg("31385", dup325); + +var msg33276 = msg("31386", dup325); + +var msg33277 = msg("31387", dup325); + +var msg33278 = msg("31388", dup311); + +var msg33279 = msg("31389", dup311); + +var msg33280 = msg("31390", dup325); + +var msg33281 = msg("31391", dup325); + +var msg33282 = msg("31392", dup311); + +var msg33283 = msg("31393", dup311); + +var msg33284 = msg("31394", dup311); + +var msg33285 = msg("31395", dup311); + +var msg33286 = msg("31396", dup311); + +var msg33287 = msg("31397", dup311); + +var msg33288 = msg("31398", dup311); + +var msg33289 = msg("31399", dup314); + +var msg33290 = msg("31400", dup314); + +var msg33291 = msg("31401", dup314); + +var msg33292 = msg("31402", dup311); + +var msg33293 = msg("31403", dup325); + +var msg33294 = msg("31404", dup325); + +var all60 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg33295 = msg("31405", all60); + +var msg33296 = msg("31406", dup324); + +var msg33297 = msg("31407", dup314); + +var msg33298 = msg("31408", dup314); + +var msg33299 = msg("31409", dup314); + +var msg33300 = msg("31410", dup314); + +var msg33301 = msg("31411", dup311); + +var msg33302 = msg("31412", dup311); + +var msg33303 = msg("31413", dup311); + +var msg33304 = msg("31414", dup311); + +var msg33305 = msg("31415", dup311); + +var msg33306 = msg("31416", dup311); + +var msg33307 = msg("31417", dup325); + +var msg33308 = msg("31418", dup321); + +var msg33309 = msg("31419", dup311); + +var msg33310 = msg("31420", dup309); + +var msg33311 = msg("31421", dup309); + +var msg33312 = msg("31422", dup325); + +var msg33313 = msg("31423", dup321); + +var msg33314 = msg("31424", dup321); + +var msg33315 = msg("31425", dup314); + +var msg33316 = msg("31426", dup322); + +var msg33317 = msg("31427", dup311); + +var msg33318 = msg("31428", dup311); + +var msg33319 = msg("31429", dup311); + +var msg33320 = msg("31433", dup321); + +var msg33321 = msg("31434", dup309); + +var msg33322 = msg("31435", dup309); + +var msg33323 = msg("31436", dup309); + +var msg33324 = msg("31437", dup309); + +var msg33325 = msg("31438", dup311); + +var msg33326 = msg("31439", dup309); + +var msg33327 = msg("31440", dup309); + +var msg33328 = msg("31441", dup309); + +var msg33329 = msg("31442", dup321); + +var msg33330 = msg("31443", dup309); + +var msg33331 = msg("31444", dup321); + +var msg33332 = msg("31445", dup321); + +var msg33333 = msg("31446", dup321); + +var msg33334 = msg("31447", dup321); + +var msg33335 = msg("31448", dup321); + +var msg33336 = msg("31449", dup321); + +var msg33337 = msg("31450", dup321); + +var msg33338 = msg("31451", dup311); + +var msg33339 = msg("31452", dup321); + +var msg33340 = msg("31453", dup321); + +var msg33341 = msg("31454", dup321); + +var msg33342 = msg("31455", dup311); + +var msg33343 = msg("31456", dup321); + +var msg33344 = msg("31457", dup321); + +var msg33345 = msg("31458", dup321); + +var msg33346 = msg("31459", dup321); + +var msg33347 = msg("31460", dup309); + +var msg33348 = msg("31461", dup309); + +var msg33349 = msg("31462", dup309); + +var msg33350 = msg("31463", dup321); + +var msg33351 = msg("31464", dup321); + +var msg33352 = msg("31465", dup321); + +var msg33353 = msg("31466", dup321); + +var msg33354 = msg("31467", dup321); + +var msg33355 = msg("31468", dup321); + +var msg33356 = msg("31469", dup325); + +var msg33357 = msg("31470", dup325); + +var msg33358 = msg("31471", dup325); + +var msg33359 = msg("31472", dup321); + +var msg33360 = msg("31473", dup309); + +var msg33361 = msg("31474", dup309); + +var msg33362 = msg("31475", dup309); + +var msg33363 = msg("31476", dup309); + +var msg33364 = msg("31477", dup307); + +var msg33365 = msg("31478", dup307); + +var msg33366 = msg("31479", dup307); + +var msg33367 = msg("31480", dup307); + +var msg33368 = msg("31481", dup307); + +var msg33369 = msg("31482", dup307); + +var msg33370 = msg("31483", dup307); + +var msg33371 = msg("31484", dup307); + +var msg33372 = msg("31485", dup325); + +var msg33373 = msg("31486", dup325); + +var msg33374 = msg("31487", dup311); + +var msg33375 = msg("31488", dup311); + +var msg33376 = msg("31489", dup314); + +var msg33377 = msg("31490", dup314); + +var msg33378 = msg("31491", dup314); + +var msg33379 = msg("31492", dup314); + +var msg33380 = msg("31493", dup314); + +var msg33381 = msg("31494", dup314); + +var msg33382 = msg("31495", dup325); + +var msg33383 = msg("31496", dup325); + +var msg33384 = msg("31497", dup314); + +var msg33385 = msg("31498", dup314); + +var msg33386 = msg("31499", dup314); + +var msg33387 = msg("31500", dup314); + +var msg33388 = msg("31501", dup314); + +var msg33389 = msg("31502", dup314); + +var msg33390 = msg("31503", dup314); + +var msg33391 = msg("31504", dup311); + +var msg33392 = msg("31505", dup316); + +var msg33393 = msg("31506", dup316); + +var msg33394 = msg("31507", dup321); + +var msg33395 = msg("31508", dup321); + +var msg33396 = msg("31509", dup321); + +var msg33397 = msg("31510", dup321); + +var msg33398 = msg("31511", dup311); + +var msg33399 = msg("31512", dup311); + +var msg33400 = msg("31513", dup323); + +var msg33401 = msg("31514", dup321); + +var msg33402 = msg("31515", dup321); + +var msg33403 = msg("31516", dup321); + +var msg33404 = msg("31517", dup321); + +var msg33405 = msg("31518", dup321); + +var msg33406 = msg("31519", dup309); + +var msg33407 = msg("31520", dup309); + +var msg33408 = msg("31521", dup309); + +var msg33409 = msg("31522", dup309); + +var msg33410 = msg("31523", dup309); + +var msg33411 = msg("31524", dup309); + +var msg33412 = msg("31525", dup314); + +var msg33413 = msg("31526", dup314); + +var msg33414 = msg("31527", dup321); + +var msg33415 = msg("31528", dup321); + +var msg33416 = msg("31529", dup307); + +var msg33417 = msg("31530", dup321); + +var msg33418 = msg("31531", dup314); + +var msg33419 = msg("31532", dup314); + +var msg33420 = msg("31533", dup325); + +var msg33421 = msg("31534", dup309); + +var msg33422 = msg("31535", dup309); + +var msg33423 = msg("31536", dup309); + +var msg33424 = msg("31537", dup309); + +var msg33425 = msg("31538", dup314); + +var msg33426 = msg("31539", dup314); + +var msg33427 = msg("31540", dup309); + +var msg33428 = msg("31541", dup309); + +var msg33429 = msg("31542", dup307); + +var msg33430 = msg("31543", dup325); + +var msg33431 = msg("31544", dup321); + +var msg33432 = msg("31545", dup321); + +var msg33433 = msg("31546", dup307); + +var msg33434 = msg("31547", dup321); + +var msg33435 = msg("31548", dup321); + +var msg33436 = msg("31549", dup314); + +var msg33437 = msg("31550", dup314); + +var msg33438 = msg("31551", dup314); + +var msg33439 = msg("31552", dup314); + +var msg33440 = msg("31553", dup314); + +var msg33441 = msg("31554", dup314); + +var msg33442 = msg("31555", dup311); + +var msg33443 = msg("31556", dup310); + +var msg33444 = msg("31557", dup325); + +var msg33445 = msg("31558", dup321); + +var msg33446 = msg("31559", dup321); + +var msg33447 = msg("31560", dup314); + +var msg33448 = msg("31561", dup314); + +var msg33449 = msg("31562", dup309); + +var msg33450 = msg("31563", dup321); + +var msg33451 = msg("31564", dup333); + +var msg33452 = msg("31565", dup314); + +var msg33453 = msg("31566", dup314); + +var msg33454 = msg("31567", dup316); + +var msg33455 = msg("31568", dup314); + +var msg33456 = msg("31569", dup311); + +var msg33457 = msg("31570", dup322); + +var msg33458 = msg("31571", dup309); + +var msg33459 = msg("31572", dup309); + +var msg33460 = msg("31573", dup309); + +var msg33461 = msg("31574", dup309); + +var msg33462 = msg("31575", dup309); + +var msg33463 = msg("31576", dup309); + +var msg33464 = msg("31577", dup315); + +var msg33465 = msg("31578", dup315); + +var msg33466 = msg("31579", dup309); + +var msg33467 = msg("31580", dup311); + +var msg33468 = msg("31581", dup311); + +var msg33469 = msg("31582", dup311); + +var msg33470 = msg("31583", dup311); + +var msg33471 = msg("31584", dup323); + +var msg33472 = msg("31585", dup323); + +var msg33473 = msg("31586", dup321); + +var msg33474 = msg("31587", dup314); + +var msg33475 = msg("31588", dup307); + +var msg33476 = msg("31589", dup309); + +var msg33477 = msg("31590", dup309); + +var msg33478 = msg("31591", dup309); + +var msg33479 = msg("31592", dup309); + +var msg33480 = msg("31593", dup321); + +var msg33481 = msg("31594", dup314); + +var msg33482 = msg("31595", dup314); + +var msg33483 = msg("31596", dup314); + +var msg33484 = msg("31597", dup314); + +var msg33485 = msg("31598", dup314); + +var msg33486 = msg("31599", dup314); + +var all61 = all_match({ + processors: [ + dup66, + dup179, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg33487 = msg("31600", all61); + +var msg33488 = msg("31601", dup321); + +var msg33489 = msg("31602", dup321); + +var msg33490 = msg("31603", dup321); + +var msg33491 = msg("31604", dup321); + +var msg33492 = msg("31605", dup321); + +var msg33493 = msg("31606", dup321); + +var msg33494 = msg("31607", dup321); + +var msg33495 = msg("31608", dup311); + +var msg33496 = msg("31609", dup311); + +var msg33497 = msg("31610", dup311); + +var msg33498 = msg("31611", dup311); + +var msg33499 = msg("31612", dup324); + +var msg33500 = msg("31613", dup324); + +var msg33501 = msg("31614", dup314); + +var msg33502 = msg("31615", dup324); + +var msg33503 = msg("31616", dup324); + +var msg33504 = msg("31617", dup325); + +var msg33505 = msg("31618", dup325); + +var msg33506 = msg("31619", dup325); + +var msg33507 = msg("31620", dup325); + +var msg33508 = msg("31621", dup325); + +var msg33509 = msg("31622", dup325); + +var msg33510 = msg("31623", dup325); + +var msg33511 = msg("31624", dup325); + +var msg33512 = msg("31625", dup325); + +var msg33513 = msg("31626", dup325); + +var msg33514 = msg("31627", dup325); + +var msg33515 = msg("31628", dup325); + +var msg33516 = msg("31629", dup325); + +var msg33517 = msg("31630", dup325); + +var msg33518 = msg("31631", dup321); + +var msg33519 = msg("31632", dup321); + +var msg33520 = msg("31633", dup321); + +var msg33521 = msg("31634", dup309); + +var msg33522 = msg("31635", dup309); + +var msg33523 = msg("31636", dup322); + +var msg33524 = msg("31637", dup323); + +var msg33525 = msg("31638", dup314); + +var msg33526 = msg("31639", dup321); + +var msg33527 = msg("31640", dup321); + +var msg33528 = msg("31641", dup321); + +var msg33529 = msg("31642", dup321); + +var msg33530 = msg("31643", dup321); + +var msg33531 = msg("31644", dup321); + +var msg33532 = msg("31645", dup325); + +var msg33533 = msg("31646", dup325); + +var msg33534 = msg("31647", dup316); + +var msg33535 = msg("31648", dup316); + +var msg33536 = msg("31649", dup321); + +var msg33537 = msg("31650", dup311); + +var msg33538 = msg("31651", dup316); + +var msg33539 = msg("31652", dup316); + +var msg33540 = msg("31653", dup321); + +var msg33541 = msg("31654", dup321); + +var msg33542 = msg("31655", dup321); + +var msg33543 = msg("31656", dup321); + +var msg33544 = msg("31657", dup321); + +var msg33545 = msg("31658", dup321); + +var msg33546 = msg("31659", dup321); + +var msg33547 = msg("31660", dup321); + +var msg33548 = msg("31661", dup321); + +var msg33549 = msg("31662", dup321); + +var msg33550 = msg("31663", dup321); + +var msg33551 = msg("31664", dup328); + +var msg33552 = msg("31665", dup328); + +var msg33553 = msg("31666", dup328); + +var msg33554 = msg("31667", dup328); + +var msg33555 = msg("31668", dup311); + +var msg33556 = msg("31669", dup321); + +var msg33557 = msg("31670", dup309); + +var msg33558 = msg("31671", dup309); + +var msg33559 = msg("31672", dup324); + +var msg33560 = msg("31673", dup311); + +var msg33561 = msg("31674", dup311); + +var msg33562 = msg("31675", dup311); + +var msg33563 = msg("31676", dup311); + +var msg33564 = msg("31677", dup311); + +var msg33565 = msg("31678", dup314); + +var msg33566 = msg("31679", dup314); + +var msg33567 = msg("31680", dup321); + +var msg33568 = msg("31681", dup321); + +var msg33569 = msg("31682", dup321); + +var msg33570 = msg("31683", dup321); + +var msg33571 = msg("31684", dup314); + +var msg33572 = msg("31685", dup314); + +var msg33573 = msg("31686", dup309); + +var msg33574 = msg("31687", dup309); + +var msg33575 = msg("31688", dup325); + +var msg33576 = msg("31689", dup321); + +var msg33577 = msg("31690", dup333); + +var msg33578 = msg("31691", dup321); + +var msg33579 = msg("31692", dup311); + +var msg33580 = msg("31693", dup321); + +var msg33581 = msg("31694", dup311); + +var msg33582 = msg("31695", dup311); + +var msg33583 = msg("31696", dup314); + +var msg33584 = msg("31697", dup314); + +var msg33585 = msg("31698", dup314); + +var msg33586 = msg("31699", dup311); + +var msg33587 = msg("31700", dup311); + +var msg33588 = msg("31701", dup311); + +var msg33589 = msg("31702", dup314); + +var msg33590 = msg("31703", dup314); + +var msg33591 = msg("31704", dup311); + +var msg33592 = msg("31705", dup329); + +var msg33593 = msg("31706", dup321); + +var msg33594 = msg("31707", dup314); + +var msg33595 = msg("31708", dup314); + +var msg33596 = msg("31709", dup314); + +var msg33597 = msg("31710", dup321); + +var msg33598 = msg("31711", dup333); + +var msg33599 = msg("31712", dup321); + +var msg33600 = msg("31713", dup321); + +var msg33601 = msg("31714", dup321); + +var msg33602 = msg("31715", dup321); + +var msg33603 = msg("31716", dup321); + +var msg33604 = msg("31717", dup321); + +var msg33605 = msg("31718", dup321); + +var msg33606 = msg("31719", dup307); + +var msg33607 = msg("31720", dup321); + +var msg33608 = msg("31721", dup321); + +var msg33609 = msg("31722", dup321); + +var msg33610 = msg("31723", dup314); + +var msg33611 = msg("31724", dup314); + +var msg33612 = msg("31725", dup314); + +var msg33613 = msg("31726", dup314); + +var msg33614 = msg("31727", dup314); + +var msg33615 = msg("31728", dup322); + +var msg33616 = msg("31729", dup322); + +var msg33617 = msg("31730", dup322); + +var msg33618 = msg("31731", dup322); + +var msg33619 = msg("31732", dup314); + +var msg33620 = msg("31733", dup314); + +var msg33621 = msg("31734", dup311); + +var msg33622 = msg("31735", dup325); + +var msg33623 = msg("31736", dup325); + +var msg33624 = msg("31737", dup321); + +var msg33625 = msg("31738", dup329); + +var msg33626 = msg("31739", dup314); + +var msg33627 = msg("31740", dup314); + +var msg33628 = msg("31741", dup316); + +var msg33629 = msg("31742", dup333); + +var msg33630 = msg("31743", dup311); + +var msg33631 = msg("31744", dup321); + +var msg33632 = msg("31745", dup316); + +var msg33633 = msg("31746", dup321); + +var msg33634 = msg("31747", dup316); + +var msg33635 = msg("31748", dup321); + +var msg33636 = msg("31749", dup323); + +var msg33637 = msg("31750", dup323); + +var msg33638 = msg("31751", dup309); + +var msg33639 = msg("31752", dup309); + +var msg33640 = msg("31753", dup321); + +var msg33641 = msg("31754", dup321); + +var msg33642 = msg("31755", dup321); + +var msg33643 = msg("31756", dup314); + +var msg33644 = msg("31757", dup314); + +var msg33645 = msg("31758", dup314); + +var msg33646 = msg("31759", dup314); + +var msg33647 = msg("31760", dup325); + +var msg33648 = msg("31761", dup325); + +var msg33649 = msg("31762", dup325); + +var msg33650 = msg("31763", dup325); + +var msg33651 = msg("31764", dup324); + +var msg33652 = msg("31765", dup324); + +var msg33653 = msg("31766", dup314); + +var msg33654 = msg("31767", dup311); + +var msg33655 = msg("31768", dup321); + +var msg33656 = msg("31769", dup311); + +var msg33657 = msg("31770", dup311); + +var msg33658 = msg("31771", dup314); + +var msg33659 = msg("31772", dup321); + +var msg33660 = msg("31773", dup314); + +var msg33661 = msg("31774", dup314); + +var msg33662 = msg("31775", dup314); + +var msg33663 = msg("31776", dup314); + +var msg33664 = msg("31777", dup309); + +var msg33665 = msg("31778", dup309); + +var msg33666 = msg("31779", dup309); + +var msg33667 = msg("31780", dup309); + +var msg33668 = msg("31781", dup321); + +var msg33669 = msg("31782", dup325); + +var msg33670 = msg("31783", dup325); + +var msg33671 = msg("31784", dup325); + +var msg33672 = msg("31785", dup325); + +var msg33673 = msg("31786", dup325); + +var msg33674 = msg("31787", dup325); + +var msg33675 = msg("31788", dup325); + +var msg33676 = msg("31789", dup325); + +var msg33677 = msg("31790", dup325); + +var msg33678 = msg("31791", dup325); + +var msg33679 = msg("31792", dup325); + +var msg33680 = msg("31793", dup325); + +var msg33681 = msg("31794", dup325); + +var msg33682 = msg("31795", dup325); + +var msg33683 = msg("31796", dup325); + +var msg33684 = msg("31797", dup325); + +var msg33685 = msg("31798", dup314); + +var msg33686 = msg("31799", dup311); + +var msg33687 = msg("31800", dup311); + +var msg33688 = msg("31801", dup325); + +var msg33689 = msg("31802", dup325); + +var msg33690 = msg("31803", dup321); + +var msg33691 = msg("31804", dup321); + +var msg33692 = msg("31805", dup321); + +var msg33693 = msg("31806", dup321); + +var msg33694 = msg("31807", dup321); + +var msg33695 = msg("31808", dup323); + +var msg33696 = msg("31809", dup309); + +var msg33697 = msg("31810", dup309); + +var msg33698 = msg("31811", dup325); + +var msg33699 = msg("31812", dup325); + +var msg33700 = msg("31813", dup325); + +var msg33701 = msg("31814", dup321); + +var msg33702 = msg("31815", dup321); + +var msg33703 = msg("31816", dup321); + +var msg33704 = msg("31817", dup321); + +var msg33705 = msg("31818", dup314); + +var msg33706 = msg("31819", dup314); + +var msg33707 = msg("31820", dup321); + +var msg33708 = msg("31821", dup307); + +var msg33709 = msg("31822", dup307); + +var msg33710 = msg("31823", dup316); + +var msg33711 = msg("31824", dup321); + +var msg33712 = msg("31825", dup321); + +var msg33713 = msg("31826", dup310); + +var msg33714 = msg("31827", dup321); + +var msg33715 = msg("31828", dup321); + +var msg33716 = msg("31829", dup321); + +var msg33717 = msg("31830", dup333); + +var msg33718 = msg("31831", dup333); + +var msg33719 = msg("31832", dup321); + +var msg33720 = msg("31833", dup321); + +var msg33721 = msg("31834", dup321); + +var msg33722 = msg("31835", dup321); + +var msg33723 = msg("31836", dup321); + +var msg33724 = msg("31837", dup321); + +var msg33725 = msg("31838", dup314); + +var msg33726 = msg("31839", dup314); + +var msg33727 = msg("31840", dup314); + +var msg33728 = msg("31841", dup314); + +var msg33729 = msg("31842", dup314); + +var msg33730 = msg("31843", dup309); + +var msg33731 = msg("31844", dup309); + +var msg33732 = msg("31845", dup309); + +var msg33733 = msg("31846", dup332); + +var msg33734 = msg("31847", dup309); + +var msg33735 = msg("31848", dup309); + +var msg33736 = msg("31849", dup309); + +var msg33737 = msg("31850", dup309); + +var msg33738 = msg("31851", dup315); + +var msg33739 = msg("31852", dup315); + +var msg33740 = msg("31853", dup315); + +var msg33741 = msg("31854", dup315); + +var msg33742 = msg("31855", dup315); + +var msg33743 = msg("31856", dup315); + +var msg33744 = msg("31857", dup311); + +var msg33745 = msg("31858", dup311); + +var msg33746 = msg("31859", dup311); + +var msg33747 = msg("31860", dup311); + +var msg33748 = msg("31861", dup314); + +var msg33749 = msg("31862", dup314); + +var msg33750 = msg("31863", dup321); + +var msg33751 = msg("31864", dup321); + +var msg33752 = msg("31865", dup314); + +var msg33753 = msg("31866", dup314); + +var msg33754 = msg("31867", dup314); + +var msg33755 = msg("31868", dup314); + +var msg33756 = msg("31869", dup314); + +var msg33757 = msg("31870", dup314); + +var msg33758 = msg("31871", dup314); + +var msg33759 = msg("31872", dup321); + +var msg33760 = msg("31873", dup314); + +var msg33761 = msg("31874", dup314); + +var msg33762 = msg("31875", dup309); + +var msg33763 = msg("31876", dup309); + +var msg33764 = msg("31877", dup311); + +var msg33765 = msg("31878", dup311); + +var msg33766 = msg("31879", dup311); + +var msg33767 = msg("31880", dup311); + +var msg33768 = msg("31881", dup311); + +var msg33769 = msg("31882", dup311); + +var msg33770 = msg("31883", dup321); + +var msg33771 = msg("31884", dup321); + +var msg33772 = msg("31885", dup321); + +var msg33773 = msg("31886", dup311); + +var msg33774 = msg("31887", dup311); + +var msg33775 = msg("31888", dup311); + +var msg33776 = msg("31889", dup316); + +var msg33777 = msg("31890", dup316); + +var msg33778 = msg("31891", dup311); + +var msg33779 = msg("31892", dup311); + +var msg33780 = msg("31893", dup321); + +var msg33781 = msg("31894", dup321); + +var msg33782 = msg("31895", dup321); + +var msg33783 = msg("31896", dup321); + +var msg33784 = msg("31897", dup321); + +var msg33785 = msg("31898", dup311); + +var msg33786 = msg("31899", dup316); + +var msg33787 = msg("31900", dup316); + +var msg33788 = msg("31901", dup316); + +var msg33789 = msg("31902", dup307); + +var msg33790 = msg("31903", dup307); + +var msg33791 = msg("31904", dup321); + +var msg33792 = msg("31905", dup314); + +var msg33793 = msg("31906", dup314); + +var msg33794 = msg("31907", dup321); + +var msg33795 = msg("31908", dup321); + +var msg33796 = msg("31909", dup321); + +var msg33797 = msg("31910", dup321); + +var msg33798 = msg("31911", dup321); + +var msg33799 = msg("31912", dup311); + +var msg33800 = msg("31913", dup321); + +var msg33801 = msg("31914", dup311); + +var msg33802 = msg("31915", dup321); + +var msg33803 = msg("31916", dup321); + +var msg33804 = msg("31917", dup321); + +var msg33805 = msg("31918", dup321); + +var msg33806 = msg("31919", dup321); + +var msg33807 = msg("31920", dup321); + +var msg33808 = msg("31921", dup321); + +var msg33809 = msg("31922", dup321); + +var msg33810 = msg("31923", dup310); + +var msg33811 = msg("31924", dup321); + +var msg33812 = msg("31925", dup321); + +var msg33813 = msg("31926", dup309); + +var msg33814 = msg("31927", dup309); + +var msg33815 = msg("31928", dup321); + +var msg33816 = msg("31929", dup321); + +var msg33817 = msg("31930", dup321); + +var msg33818 = msg("31931", dup321); + +var msg33819 = msg("31932", dup321); + +var msg33820 = msg("31933", dup321); + +var msg33821 = msg("31934", dup321); + +var msg33822 = msg("31935", dup321); + +var msg33823 = msg("31936", dup321); + +var msg33824 = msg("31937", dup321); + +var msg33825 = msg("31938", dup321); + +var msg33826 = msg("31939", dup314); + +var msg33827 = msg("31940", dup314); + +var msg33828 = msg("31941", dup321); + +var msg33829 = msg("31942", dup314); + +var msg33830 = msg("31943", dup314); + +var msg33831 = msg("31944", dup321); + +var msg33832 = msg("31945", dup316); + +var msg33833 = msg("31946", dup311); + +var msg33834 = msg("31947", dup325); + +var msg33835 = msg("31948", dup325); + +var msg33836 = msg("31949", dup325); + +var msg33837 = msg("31950", dup321); + +var msg33838 = msg("31951", dup321); + +var msg33839 = msg("31952", dup321); + +var msg33840 = msg("31953", dup321); + +var msg33841 = msg("31954", dup321); + +var msg33842 = msg("31955", dup321); + +var msg33843 = msg("31956", dup316); + +var msg33844 = msg("31957", dup321); + +var msg33845 = msg("31958", dup321); + +var msg33846 = msg("31959", dup321); + +var msg33847 = msg("31960", dup325); + +var msg33848 = msg("31961", dup321); + +var msg33849 = msg("31962", dup321); + +var msg33850 = msg("31963", dup321); + +var msg33851 = msg("31964", dup321); + +var msg33852 = msg("31965", dup311); + +var msg33853 = msg("31966", dup311); + +var msg33854 = msg("31967", dup311); + +var msg33855 = msg("31968", dup311); + +var msg33856 = msg("31969", dup311); + +var msg33857 = msg("31970", dup311); + +var msg33858 = msg("31971", dup307); + +var msg33859 = msg("31972", dup311); + +var msg33860 = msg("31973", dup321); + +var msg33861 = msg("31974", dup321); + +var msg33862 = msg("31975", dup311); + +var msg33863 = msg("31976", dup311); + +var msg33864 = msg("31977", dup337); + +var msg33865 = msg("31978", dup337); + +var msg33866 = msg("31979", dup323); + +var msg33867 = msg("31980", dup324); + +var msg33868 = msg("31981", dup324); + +var msg33869 = msg("31982", dup329); + +var msg33870 = msg("31983", dup309); + +var msg33871 = msg("31984", dup324); + +var msg33872 = msg("31985", dup311); + +var msg33873 = msg("31986", dup309); + +var msg33874 = msg("31987", dup309); + +var msg33875 = msg("31988", dup311); + +var msg33876 = msg("31989", dup321); + +var msg33877 = msg("31990", dup325); + +var msg33878 = msg("31991", dup325); + +var msg33879 = msg("31992", dup200); + +var msg33880 = msg("31993", dup200); + +var msg33881 = msg("31994", dup200); + +var msg33882 = msg("31995", dup200); + +var msg33883 = msg("31996", dup200); + +var msg33884 = msg("31997", dup200); + +var msg33885 = msg("31998", dup200); + +var msg33886 = msg("31999", dup200); + +var msg33887 = msg("32000", dup200); + +var msg33888 = msg("32001", dup200); + +var msg33889 = msg("32002", dup321); + +var msg33890 = msg("32003", dup324); + +var msg33891 = msg("32004", dup324); + +var msg33892 = msg("32005", dup321); + +var msg33893 = msg("32006", dup321); + +var msg33894 = msg("32007", dup332); + +var msg33895 = msg("32008", dup311); + +var msg33896 = msg("32009", dup309); + +var msg33897 = msg("32010", dup309); + +var msg33898 = msg("32011", dup309); + +var msg33899 = msg("32012", dup323); + +var msg33900 = msg("32013", dup321); + +var msg33901 = msg("32014", dup311); + +var msg33902 = msg("32015", dup321); + +var msg33903 = msg("32016", dup321); + +var msg33904 = msg("32017", dup321); + +var msg33905 = msg("32018", dup321); + +var msg33906 = msg("32019", dup325); + +var msg33907 = msg("32020", dup321); + +var msg33908 = msg("32021", dup309); + +var msg33909 = msg("32022", dup309); + +var msg33910 = msg("32023", dup321); + +var msg33911 = msg("32024", dup314); + +var msg33912 = msg("32025", dup314); + +var msg33913 = msg("32026", dup314); + +var msg33914 = msg("32027", dup314); + +var msg33915 = msg("32028", dup321); + +var msg33916 = msg("32029", dup314); + +var msg33917 = msg("32030", dup325); + +var msg33918 = msg("32031", dup321); + +var msg33919 = msg("32032", dup321); + +var msg33920 = msg("32033", dup321); + +var msg33921 = msg("32034", dup321); + +var msg33922 = msg("32035", dup321); + +var msg33923 = msg("32036", dup321); + +var msg33924 = msg("32037", dup321); + +var msg33925 = msg("32038", dup311); + +var msg33926 = msg("32039", dup311); + +var msg33927 = msg("32040", dup321); + +var msg33928 = msg("32041", dup311); + +var msg33929 = msg("32042", dup311); + +var msg33930 = msg("32043", dup311); + +var msg33931 = msg("32044", dup314); + +var msg33932 = msg("32045", dup324); + +var msg33933 = msg("32046", dup324); + +var msg33934 = msg("32047", dup324); + +var msg33935 = msg("32048", dup321); + +var msg33936 = msg("32049", dup324); + +var msg33937 = msg("32050", dup321); + +var msg33938 = msg("32051", dup321); + +var msg33939 = msg("32052", dup314); + +var msg33940 = msg("32053", dup321); + +var msg33941 = msg("32054", dup321); + +var msg33942 = msg("32055", dup321); + +var msg33943 = msg("32056", dup314); + +var msg33944 = msg("32057", dup323); + +var msg33945 = msg("32058", dup321); + +var msg33946 = msg("32059", dup309); + +var msg33947 = msg("32060", dup325); + +var msg33948 = msg("32061", dup321); + +var msg33949 = msg("32062", dup309); + +var msg33950 = msg("32063", dup309); + +var msg33951 = msg("32064", dup309); + +var msg33952 = msg("32065", dup321); + +var msg33953 = msg("32066", dup321); + +var msg33954 = msg("32067", dup321); + +var msg33955 = msg("32068", dup314); + +var msg33956 = msg("32069", dup311); + +var msg33957 = msg("32070", dup321); + +var msg33958 = msg("32071", dup321); + +var msg33959 = msg("32072", dup321); + +var msg33960 = msg("32073", dup321); + +var msg33961 = msg("32074", dup321); + +var msg33962 = msg("32075", dup321); + +var msg33963 = msg("32076", dup314); + +var msg33964 = msg("32077", dup314); + +var msg33965 = msg("32078", dup321); + +var msg33966 = msg("32079", dup321); + +var msg33967 = msg("32080", dup321); + +var msg33968 = msg("32081", dup321); + +var msg33969 = msg("32082", dup309); + +var msg33970 = msg("32083", dup309); + +var msg33971 = msg("32084", dup309); + +var msg33972 = msg("32085", dup309); + +var msg33973 = msg("32086", dup321); + +var msg33974 = msg("32087", dup309); + +var msg33975 = msg("32088", dup309); + +var msg33976 = msg("32089", dup309); + +var msg33977 = msg("32090", dup321); + +var msg33978 = msg("32091", dup321); + +var msg33979 = msg("32092", dup325); + +var msg33980 = msg("32093", dup321); + +var msg33981 = msg("32094", dup309); + +var msg33982 = msg("32095", dup309); + +var msg33983 = msg("32096", dup321); + +var msg33984 = msg("32097", dup309); + +var msg33985 = msg("32098", dup309); + +var msg33986 = msg("32099", dup309); + +var msg33987 = msg("32100", dup309); + +var msg33988 = msg("32101", dup311); + +var msg33989 = msg("32102", dup311); + +var msg33990 = msg("32103", dup311); + +var msg33991 = msg("32104", dup311); + +var msg33992 = msg("32105", dup311); + +var msg33993 = msg("32106", dup316); + +var msg33994 = msg("32107", dup314); + +var msg33995 = msg("32108", dup314); + +var msg33996 = msg("32109", dup309); + +var msg33997 = msg("32110", dup324); + +var msg33998 = msg("32111", dup324); + +var msg33999 = msg("32112", dup324); + +var msg34000 = msg("32113", dup324); + +var msg34001 = msg("32114", dup308); + +var msg34002 = msg("32115", dup328); + +var msg34003 = msg("32116", dup328); + +var msg34004 = msg("32117", dup321); + +var msg34005 = msg("32118", dup321); + +var msg34006 = msg("32119", dup321); + +var msg34007 = msg("32120", dup321); + +var msg34008 = msg("32121", dup321); + +var msg34009 = msg("32122", dup309); + +var msg34010 = msg("32123", dup321); + +var msg34011 = msg("32124", dup200); + +var msg34012 = msg("32125", dup325); + +var msg34013 = msg("32126", dup321); + +var msg34014 = msg("32127", dup316); + +var msg34015 = msg("32128", dup316); + +var msg34016 = msg("32129", dup321); + +var msg34017 = msg("32130", dup321); + +var msg34018 = msg("32131", dup309); + +var msg34019 = msg("32132", dup309); + +var msg34020 = msg("32133", dup309); + +var msg34021 = msg("32134", dup314); + +var msg34022 = msg("32135", dup314); + +var msg34023 = msg("32136", dup307); + +var msg34024 = msg("32137", dup325); + +var msg34025 = msg("32138", dup325); + +var msg34026 = msg("32139", dup325); + +var msg34027 = msg("32140", dup325); + +var msg34028 = msg("32141", dup311); + +var msg34029 = msg("32142", dup311); + +var msg34030 = msg("32143", dup311); + +var msg34031 = msg("32144", dup311); + +var msg34032 = msg("32145", dup311); + +var msg34033 = msg("32146", dup311); + +var msg34034 = msg("32147", dup309); + +var msg34035 = msg("32148", dup309); + +var msg34036 = msg("32149", dup311); + +var msg34037 = msg("32150", dup311); + +var msg34038 = msg("32151", dup311); + +var msg34039 = msg("32152", dup311); + +var msg34040 = msg("32153", dup325); + +var msg34041 = msg("32154", dup325); + +var msg34042 = msg("32155", dup325); + +var msg34043 = msg("32156", dup325); + +var msg34044 = msg("32157", dup325); + +var msg34045 = msg("32158", dup325); + +var msg34046 = msg("32159", dup325); + +var msg34047 = msg("32160", dup325); + +var msg34048 = msg("32161", dup323); + +var msg34049 = msg("32162", dup323); + +var msg34050 = msg("32163", dup314); + +var msg34051 = msg("32164", dup314); + +var msg34052 = msg("32165", dup314); + +var msg34053 = msg("32166", dup311); + +var msg34054 = msg("32167", dup311); + +var msg34055 = msg("32168", dup325); + +var msg34056 = msg("32169", dup325); + +var msg34057 = msg("32170", dup309); + +var msg34058 = msg("32171", dup309); + +var msg34059 = msg("32172", dup321); + +var msg34060 = msg("32173", dup321); + +var msg34061 = msg("32174", dup321); + +var msg34062 = msg("32175", dup321); + +var msg34063 = msg("32176", dup321); + +var msg34064 = msg("32177", dup321); + +var msg34065 = msg("32178", dup321); + +var msg34066 = msg("32179", dup321); + +var msg34067 = msg("32180", dup321); + +var msg34068 = msg("32181", dup321); + +var msg34069 = msg("32182", dup311); + +var msg34070 = msg("32183", dup311); + +var msg34071 = msg("32184", dup311); + +var msg34072 = msg("32185", dup311); + +var msg34073 = msg("32186", dup314); + +var msg34074 = msg("32187", dup314); + +var msg34075 = msg("32188", dup321); + +var msg34076 = msg("32189", dup321); + +var msg34077 = msg("32190", dup311); + +var msg34078 = msg("32191", dup311); + +var msg34079 = msg("32192", dup321); + +var msg34080 = msg("32193", dup321); + +var msg34081 = msg("32194", dup321); + +var msg34082 = msg("32195", dup321); + +var msg34083 = msg("32196", dup321); + +var msg34084 = msg("32197", dup321); + +var msg34085 = msg("32198", dup321); + +var msg34086 = msg("32199", dup314); + +var msg34087 = msg("32200", dup321); + +var msg34088 = msg("32201", dup321); + +var msg34089 = msg("32202", dup321); + +var msg34090 = msg("32203", dup316); + +var msg34091 = msg("32204", dup314); + +var msg34092 = msg("32205", dup314); + +var msg34093 = msg("32206", dup309); + +var msg34094 = msg("32207", dup309); + +var msg34095 = msg("32208", dup309); + +var msg34096 = msg("32209", dup309); + +var msg34097 = msg("32210", dup309); + +var msg34098 = msg("32211", dup309); + +var msg34099 = msg("32212", dup309); + +var msg34100 = msg("32213", dup309); + +var msg34101 = msg("32214", dup309); + +var msg34102 = msg("32215", dup309); + +var msg34103 = msg("32216", dup309); + +var msg34104 = msg("32217", dup307); + +var msg34105 = msg("32218", dup307); + +var msg34106 = msg("32219", dup321); + +var msg34107 = msg("32220", dup321); + +var msg34108 = msg("32221", dup321); + +var msg34109 = msg("32222", dup321); + +var msg34110 = msg("32223", dup309); + +var msg34111 = msg("32224", dup309); + +var msg34112 = msg("32225", dup321); + +var msg34113 = msg("32226", dup309); + +var msg34114 = msg("32227", dup309); + +var msg34115 = msg("32228", dup309); + +var msg34116 = msg("32229", dup309); + +var msg34117 = msg("32230", dup311); + +var msg34118 = msg("32231", dup311); + +var msg34119 = msg("32232", dup311); + +var msg34120 = msg("32233", dup311); + +var msg34121 = msg("32234", dup311); + +var msg34122 = msg("32235", dup311); + +var msg34123 = msg("32236", dup311); + +var msg34124 = msg("32237", dup311); + +var msg34125 = msg("32238", dup311); + +var msg34126 = msg("32239", dup311); + +var msg34127 = msg("32240", dup314); + +var msg34128 = msg("32241", dup321); + +var msg34129 = msg("32242", dup321); + +var msg34130 = msg("32243", dup321); + +var msg34131 = msg("32244", dup323); + +var msg34132 = msg("32245", dup307); + +var msg34133 = msg("32246", dup307); + +var msg34134 = msg("32247", dup311); + +var msg34135 = msg("32248", dup321); + +var msg34136 = msg("32249", dup321); + +var msg34137 = msg("32250", dup321); + +var msg34138 = msg("32251", dup314); + +var msg34139 = msg("32252", dup314); + +var msg34140 = msg("32253", dup314); + +var msg34141 = msg("32254", dup314); + +var msg34142 = msg("32255", dup314); + +var msg34143 = msg("32256", dup314); + +var msg34144 = msg("32257", dup314); + +var msg34145 = msg("32258", dup314); + +var msg34146 = msg("32259", dup321); + +var msg34147 = msg("32260", dup321); + +var msg34148 = msg("32261", dup316); + +var msg34149 = msg("32262", dup325); + +var msg34150 = msg("32263", dup325); + +var msg34151 = msg("32264", dup314); + +var msg34152 = msg("32265", dup314); + +var msg34153 = msg("32266", dup325); + +var msg34154 = msg("32267", dup325); + +var msg34155 = msg("32268", dup316); + +var msg34156 = msg("32269", dup316); + +var msg34157 = msg("32270", dup321); + +var msg34158 = msg("32271", dup321); + +var msg34159 = msg("32272", dup321); + +var msg34160 = msg("32273", dup321); + +var msg34161 = msg("32274", dup314); + +var msg34162 = msg("32275", dup314); + +var msg34163 = msg("32276", dup311); + +var msg34164 = msg("32277", dup314); + +var msg34165 = msg("32278", dup321); + +var msg34166 = msg("32279", dup321); + +var msg34167 = msg("32280", dup321); + +var msg34168 = msg("32281", dup321); + +var msg34169 = msg("32282", dup321); + +var msg34170 = msg("32283", dup321); + +var msg34171 = msg("32284", dup321); + +var msg34172 = msg("32285", dup321); + +var msg34173 = msg("32286", dup321); + +var msg34174 = msg("32287", dup321); + +var msg34175 = msg("32288", dup321); + +var msg34176 = msg("32289", dup321); + +var msg34177 = msg("32290", dup321); + +var msg34178 = msg("32291", dup321); + +var msg34179 = msg("32292", dup321); + +var msg34180 = msg("32293", dup321); + +var msg34181 = msg("32294", dup325); + +var msg34182 = msg("32295", dup325); + +var msg34183 = msg("32296", dup325); + +var msg34184 = msg("32297", dup321); + +var msg34185 = msg("32298", dup321); + +var msg34186 = msg("32299", dup321); + +var msg34187 = msg("32300", dup321); + +var msg34188 = msg("32301", dup324); + +var msg34189 = msg("32302", dup324); + +var msg34190 = msg("32303", dup324); + +var msg34191 = msg("32304", dup324); + +var msg34192 = msg("32305", dup324); + +var msg34193 = msg("32306", dup324); + +var msg34194 = msg("32307", dup324); + +var msg34195 = msg("32308", dup324); + +var msg34196 = msg("32309", dup333); + +var msg34197 = msg("32310", dup321); + +var msg34198 = msg("32311", dup321); + +var msg34199 = msg("32312", dup321); + +var msg34200 = msg("32313", dup314); + +var msg34201 = msg("32314", dup314); + +var msg34202 = msg("32315", dup314); + +var msg34203 = msg("32316", dup314); + +var msg34204 = msg("32319", dup314); + +var msg34205 = msg("32320", dup314); + +var msg34206 = msg("32334", dup321); + +var msg34207 = msg("32335", dup311); + +var msg34208 = msg("32336", dup311); + +var msg34209 = msg("32337", dup311); + +var msg34210 = msg("32338", dup321); + +var msg34211 = msg("32342", dup316); + +var msg34212 = msg("32343", dup321); + +var msg34213 = msg("32344", dup321); + +var msg34214 = msg("32345", dup314); + +var msg34215 = msg("32346", dup314); + +var msg34216 = msg("32347", dup314); + +var msg34217 = msg("32348", dup314); + +var msg34218 = msg("32349", dup314); + +var msg34219 = msg("32350", dup323); + +var msg34220 = msg("32351", dup323); + +var msg34221 = msg("32352", dup316); + +var msg34222 = msg("32353", dup322); + +var msg34223 = msg("32354", dup321); + +var msg34224 = msg("32355", dup314); + +var msg34225 = msg("32356", dup308); + +var msg34226 = msg("32357", dup321); + +var msg34227 = msg("32358", dup311); + +var msg34228 = msg("32359", dup314); + +var msg34229 = msg("32360", dup314); + +var msg34230 = msg("32361", dup309); + +var msg34231 = msg("32362", dup325); + +var msg34232 = msg("32363", dup325); + +var msg34233 = msg("32364", dup311); + +var msg34234 = msg("32365", dup311); + +var msg34235 = msg("32366", dup311); + +var msg34236 = msg("32367", dup321); + +var msg34237 = msg("32368", dup321); + +var msg34238 = msg("32369", dup309); + +var msg34239 = msg("32370", dup309); + +var msg34240 = msg("32371", dup309); + +var msg34241 = msg("32372", dup321); + +var msg34242 = msg("32373", dup321); + +var msg34243 = msg("32374", dup321); + +var msg34244 = msg("32375", dup314); + +var msg34245 = msg("32376", dup309); + +var msg34246 = msg("32377", dup309); + +var msg34247 = msg("32378", dup314); + +var msg34248 = msg("32379", dup321); + +var msg34249 = msg("32380", dup314); + +var msg34250 = msg("32381", dup309); + +var msg34251 = msg("32382", dup309); + +var msg34252 = msg("32383", dup325); + +var msg34253 = msg("32384", dup325); + +var msg34254 = msg("32385", dup321); + +var msg34255 = msg("32386", dup311); + +var msg34256 = msg("32387", dup311); + +var msg34257 = msg("32388", dup311); + +var msg34258 = msg("32389", dup311); + +var msg34259 = msg("32390", dup311); + +var msg34260 = msg("32391", dup321); + +var msg34261 = msg("32392", dup321); + +var msg34262 = msg("32393", dup321); + +var msg34263 = msg("32394", dup321); + +var msg34264 = msg("32395", dup321); + +var msg34265 = msg("32396", dup321); + +var msg34266 = msg("32397", dup321); + +var msg34267 = msg("32398", dup314); + +var msg34268 = msg("32399", dup311); + +var msg34269 = msg("32400", dup321); + +var msg34270 = msg("32401", dup321); + +var msg34271 = msg("32402", dup325); + +var msg34272 = msg("32403", dup309); + +var msg34273 = msg("32404", dup314); + +var msg34274 = msg("32405", dup314); + +var msg34275 = msg("32406", dup314); + +var msg34276 = msg("32407", dup314); + +var msg34277 = msg("32408", dup314); + +var msg34278 = msg("32409", dup314); + +var msg34279 = msg("32410", dup314); + +var msg34280 = msg("32411", dup314); + +var msg34281 = msg("32412", dup314); + +var msg34282 = msg("32413", dup314); + +var msg34283 = msg("32414", dup309); + +var msg34284 = msg("32415", dup309); + +var msg34285 = msg("32416", dup309); + +var msg34286 = msg("32417", dup309); + +var msg34287 = msg("32418", dup309); + +var msg34288 = msg("32419", dup309); + +var msg34289 = msg("32420", dup309); + +var msg34290 = msg("32421", dup309); + +var msg34291 = msg("32422", dup309); + +var msg34292 = msg("32423", dup314); + +var msg34293 = msg("32424", dup311); + +var msg34294 = msg("32425", dup311); + +var msg34295 = msg("32426", dup325); + +var msg34296 = msg("32427", dup325); + +var msg34297 = msg("32428", dup309); + +var msg34298 = msg("32429", dup309); + +var msg34299 = msg("32430", dup311); + +var msg34300 = msg("32431", dup311); + +var msg34301 = msg("32432", dup309); + +var msg34302 = msg("32433", dup309); + +var msg34303 = msg("32434", dup309); + +var msg34304 = msg("32435", dup309); + +var msg34305 = msg("32436", dup325); + +var msg34306 = msg("32437", dup325); + +var msg34307 = msg("32438", dup325); + +var msg34308 = msg("32439", dup325); + +var msg34309 = msg("32440", dup325); + +var msg34310 = msg("32441", dup325); + +var msg34311 = msg("32442", dup325); + +var msg34312 = msg("32443", dup325); + +var msg34313 = msg("32444", dup314); + +var msg34314 = msg("32445", dup314); + +var msg34315 = msg("32446", dup321); + +var msg34316 = msg("32447", dup321); + +var msg34317 = msg("32448", dup321); + +var msg34318 = msg("32449", dup321); + +var msg34319 = msg("32450", dup321); + +var msg34320 = msg("32451", dup321); + +var msg34321 = msg("32452", dup321); + +var msg34322 = msg("32453", dup321); + +var msg34323 = msg("32454", dup321); + +var msg34324 = msg("32455", dup325); + +var msg34325 = msg("32456", dup321); + +var msg34326 = msg("32457", dup321); + +var msg34327 = msg("32458", dup323); + +var msg34328 = msg("32459", dup323); + +var msg34329 = msg("32460", dup311); + +var msg34330 = msg("32461", dup311); + +var msg34331 = msg("32462", dup307); + +var msg34332 = msg("32463", dup321); + +var msg34333 = msg("32464", dup321); + +var msg34334 = msg("32465", dup324); + +var msg34335 = msg("32466", dup324); + +var msg34336 = msg("32467", dup324); + +var msg34337 = msg("32468", dup324); + +var msg34338 = msg("32469", dup321); + +var msg34339 = msg("32470", dup309); + +var msg34340 = msg("32471", dup309); + +var msg34341 = msg("32472", dup309); + +var msg34342 = msg("32473", dup309); + +var msg34343 = msg("32474", dup311); + +var msg34344 = msg("32475", dup311); + +var msg34345 = msg("32476", dup309); + +var msg34346 = msg("32477", dup309); + +var msg34347 = msg("32478", dup325); + +var msg34348 = msg("32479", dup325); + +var msg34349 = msg("32480", dup314); + +var msg34350 = msg("32481", dup314); + +var msg34351 = msg("32482", dup325); + +var msg34352 = msg("32483", dup325); + +var msg34353 = msg("32484", dup325); + +var msg34354 = msg("32485", dup325); + +var msg34355 = msg("32486", dup321); + +var msg34356 = msg("32487", dup321); + +var msg34357 = msg("32488", dup325); + +var msg34358 = msg("32489", dup323); + +var msg34359 = msg("32490", dup323); + +var msg34360 = msg("32491", dup325); + +var msg34361 = msg("32492", dup325); + +var msg34362 = msg("32493", dup321); + +var msg34363 = msg("32494", dup321); + +var msg34364 = msg("32495", dup325); + +var msg34365 = msg("32496", dup325); + +var msg34366 = msg("32497", dup325); + +var msg34367 = msg("32498", dup325); + +var msg34368 = msg("32499", dup325); + +var msg34369 = msg("32500", dup325); + +var msg34370 = msg("32501", dup314); + +var msg34371 = msg("32502", dup314); + +var msg34372 = msg("32503", dup325); + +var msg34373 = msg("32504", dup321); + +var msg34374 = msg("32505", dup321); + +var msg34375 = msg("32506", dup321); + +var msg34376 = msg("32507", dup325); + +var msg34377 = msg("32508", dup309); + +var msg34378 = msg("32509", dup309); + +var msg34379 = msg("32510", dup321); + +var msg34380 = msg("32511", dup321); + +var msg34381 = msg("32512", dup321); + +var msg34382 = msg("32513", dup321); + +var msg34383 = msg("32514", dup309); + +var msg34384 = msg("32515", dup309); + +var msg34385 = msg("32516", dup309); + +var msg34386 = msg("32517", dup309); + +var msg34387 = msg("32518", dup311); + +var msg34388 = msg("32519", dup311); + +var msg34389 = msg("32520", dup314); + +var msg34390 = msg("32521", dup321); + +var msg34391 = msg("32522", dup321); + +var msg34392 = msg("32523", dup316); + +var msg34393 = msg("32524", dup316); + +var msg34394 = msg("32525", dup333); + +var msg34395 = msg("32526", dup314); + +var msg34396 = msg("32527", dup314); + +var msg34397 = msg("32528", dup314); + +var msg34398 = msg("32529", dup321); + +var msg34399 = msg("32530", dup309); + +var msg34400 = msg("32531", dup321); + +var msg34401 = msg("32532", dup311); + +var msg34402 = msg("32533", dup311); + +var msg34403 = msg("32534", dup324); + +var msg34404 = msg("32535", dup324); + +var msg34405 = msg("32536", dup324); + +var msg34406 = msg("32537", dup324); + +var msg34407 = msg("32538", dup324); + +var msg34408 = msg("32539", dup324); + +var msg34409 = msg("32540", dup324); + +var msg34410 = msg("32541", dup324); + +var msg34411 = msg("32542", dup324); + +var msg34412 = msg("32543", dup324); + +var msg34413 = msg("32544", dup324); + +var msg34414 = msg("32545", dup324); + +var msg34415 = msg("32546", dup307); + +var msg34416 = msg("32547", dup307); + +var msg34417 = msg("32548", dup321); + +var msg34418 = msg("32549", dup321); + +var msg34419 = msg("32550", dup321); + +var msg34420 = msg("32551", dup321); + +var msg34421 = msg("32552", dup324); + +var msg34422 = msg("32553", dup324); + +var msg34423 = msg("32554", dup311); + +var msg34424 = msg("32555", dup311); + +var msg34425 = msg("32556", dup321); + +var msg34426 = msg("32557", dup321); + +var msg34427 = msg("32558", dup311); + +var msg34428 = msg("32559", dup311); + +var msg34429 = msg("32560", dup311); + +var msg34430 = msg("32561", dup311); + +var msg34431 = msg("32562", dup309); + +var msg34432 = msg("32563", dup314); + +var msg34433 = msg("32564", dup309); + +var msg34434 = msg("32565", dup309); + +var msg34435 = msg("32566", dup314); + +var msg34436 = msg("32567", dup309); + +var msg34437 = msg("32568", dup309); + +var msg34438 = msg("32569", dup309); + +var msg34439 = msg("32570", dup309); + +var msg34440 = msg("32571", dup309); + +var msg34441 = msg("32572", dup309); + +var msg34442 = msg("32573", dup309); + +var msg34443 = msg("32574", dup309); + +var msg34444 = msg("32575", dup309); + +var msg34445 = msg("32576", dup309); + +var msg34446 = msg("32577", dup321); + +var msg34447 = msg("32578", dup321); + +var msg34448 = msg("32579", dup314); + +var msg34449 = msg("32580", dup314); + +var msg34450 = msg("32581", dup311); + +var msg34451 = msg("32582", dup311); + +var msg34452 = msg("32583", dup321); + +var msg34453 = msg("32584", dup321); + +var msg34454 = msg("32585", dup321); + +var msg34455 = msg("32586", dup321); + +var msg34456 = msg("32587", dup309); + +var msg34457 = msg("32588", dup309); + +var msg34458 = msg("32589", dup309); + +var msg34459 = msg("32590", dup314); + +var msg34460 = msg("32591", dup314); + +var msg34461 = msg("32592", dup314); + +var msg34462 = msg("32593", dup314); + +var msg34463 = msg("32594", dup314); + +var msg34464 = msg("32595", dup314); + +var msg34465 = msg("32596", dup314); + +var msg34466 = msg("32597", dup314); + +var msg34467 = msg("32598", dup323); + +var msg34468 = msg("32599", dup321); + +var msg34469 = msg("32600", dup323); + +var msg34470 = msg("32601", dup309); + +var msg34471 = msg("32602", dup314); + +var msg34472 = msg("32603", dup314); + +var msg34473 = msg("32604", dup321); + +var msg34474 = msg("32605", dup321); + +var msg34475 = msg("32606", dup321); + +var msg34476 = msg("32607", dup310); + +var msg34477 = msg("32608", dup310); + +var msg34478 = msg("32609", dup321); + +var msg34479 = msg("32610", dup321); + +var msg34480 = msg("32611", dup314); + +var msg34481 = msg("32612", dup321); + +var msg34482 = msg("32613", dup321); + +var msg34483 = msg("32614", dup321); + +var msg34484 = msg("32615", dup316); + +var msg34485 = msg("32616", dup314); + +var msg34486 = msg("32617", dup314); + +var msg34487 = msg("32618", dup314); + +var msg34488 = msg("32619", dup309); + +var msg34489 = msg("32620", dup309); + +var msg34490 = msg("32621", dup321); + +var msg34491 = msg("32622", dup321); + +var msg34492 = msg("32623", dup321); + +var msg34493 = msg("32624", dup321); + +var msg34494 = msg("32625", dup309); + +var msg34495 = msg("32626", dup314); + +var msg34496 = msg("32627", dup314); + +var msg34497 = msg("32628", dup309); + +var msg34498 = msg("32629", dup309); + +var msg34499 = msg("32630", dup309); + +var msg34500 = msg("32631", dup309); + +var msg34501 = msg("32632", dup314); + +var msg34502 = msg("32633", dup314); + +var msg34503 = msg("32634", dup314); + +var msg34504 = msg("32635", dup314); + +var msg34505 = msg("32636", dup311); + +var msg34506 = msg("32637", dup331); + +var msg34507 = msg("32638", dup311); + +var msg34508 = msg("32639", dup311); + +var msg34509 = msg("32640", dup311); + +var msg34510 = msg("32641", dup311); + +var msg34511 = msg("32642", dup314); + +var msg34512 = msg("32643", dup309); + +var msg34513 = msg("32644", dup309); + +var msg34514 = msg("32645", dup325); + +var msg34515 = msg("32646", dup321); + +var msg34516 = msg("32647", dup328); + +var msg34517 = msg("32648", dup328); + +var msg34518 = msg("32649", dup328); + +var msg34519 = msg("32650", dup328); + +var msg34520 = msg("32651", dup328); + +var msg34521 = msg("32652", dup321); + +var msg34522 = msg("32653", dup321); + +var msg34523 = msg("32654", dup321); + +var msg34524 = msg("32655", dup321); + +var msg34525 = msg("32656", dup321); + +var msg34526 = msg("32657", dup321); + +var msg34527 = msg("32658", dup321); + +var msg34528 = msg("32659", dup321); + +var msg34529 = msg("32660", dup321); + +var msg34530 = msg("32661", dup321); + +var msg34531 = msg("32662", dup321); + +var msg34532 = msg("32663", dup321); + +var msg34533 = msg("32664", dup321); + +var msg34534 = msg("32665", dup321); + +var msg34535 = msg("32666", dup321); + +var msg34536 = msg("32667", dup321); + +var msg34537 = msg("32668", dup314); + +var msg34538 = msg("32669", dup314); + +var msg34539 = msg("32670", dup321); + +var msg34540 = msg("32671", dup309); + +var msg34541 = msg("32672", dup333); + +var msg34542 = msg("32673", dup311); + +var msg34543 = msg("32674", dup321); + +var msg34544 = msg("32675", dup325); + +var msg34545 = msg("32676", dup321); + +var msg34546 = msg("32677", dup321); + +var msg34547 = msg("32678", dup321); + +var msg34548 = msg("32679", dup325); + +var msg34549 = msg("32680", dup325); + +var msg34550 = msg("32681", dup311); + +var msg34551 = msg("32682", dup311); + +var msg34552 = msg("32683", dup309); + +var msg34553 = msg("32684", dup309); + +var msg34554 = msg("32685", dup325); + +var msg34555 = msg("32686", dup325); + +var msg34556 = msg("32687", dup309); + +var msg34557 = msg("32688", dup309); + +var msg34558 = msg("32689", dup325); + +var msg34559 = msg("32690", dup325); + +var msg34560 = msg("32691", dup325); + +var msg34561 = msg("32692", dup325); + +var msg34562 = msg("32693", dup309); + +var msg34563 = msg("32694", dup309); + +var msg34564 = msg("32695", dup325); + +var msg34565 = msg("32696", dup325); + +var msg34566 = msg("32697", dup325); + +var msg34567 = msg("32698", dup325); + +var msg34568 = msg("32699", dup325); + +var msg34569 = msg("32700", dup325); + +var msg34570 = msg("32701", dup325); + +var msg34571 = msg("32702", dup325); + +var msg34572 = msg("32703", dup323); + +var msg34573 = msg("32704", dup323); + +var msg34574 = msg("32705", dup314); + +var msg34575 = msg("32706", dup321); + +var msg34576 = msg("32707", dup309); + +var msg34577 = msg("32708", dup309); + +var msg34578 = msg("32709", dup323); + +var msg34579 = msg("32710", dup325); + +var msg34580 = msg("32711", dup309); + +var msg34581 = msg("32712", dup309); + +var msg34582 = msg("32713", dup311); + +var msg34583 = msg("32714", dup311); + +var msg34584 = msg("32715", dup311); + +var msg34585 = msg("32716", dup311); + +var msg34586 = msg("32717", dup311); + +var msg34587 = msg("32718", dup309); + +var msg34588 = msg("32719", dup309); + +var msg34589 = msg("32720", dup325); + +var msg34590 = msg("32721", dup325); + +var msg34591 = msg("32722", dup325); + +var msg34592 = msg("32723", dup325); + +var msg34593 = msg("32724", dup325); + +var msg34594 = msg("32725", dup325); + +var msg34595 = msg("32726", dup321); + +var msg34596 = msg("32727", dup321); + +var msg34597 = msg("32728", dup321); + +var msg34598 = msg("32729", dup314); + +var msg34599 = msg("32730", dup311); + +var msg34600 = msg("32731", dup309); + +var msg34601 = msg("32732", dup309); + +var msg34602 = msg("32733", dup321); + +var msg34603 = msg("32734", dup321); + +var msg34604 = msg("32735", dup321); + +var msg34605 = msg("32736", dup321); + +var msg34606 = msg("32737", dup322); + +var msg34607 = msg("32738", dup307); + +var msg34608 = msg("32739", dup307); + +var msg34609 = msg("32740", dup314); + +var msg34610 = msg("32741", dup314); + +var msg34611 = msg("32742", dup311); + +var msg34612 = msg("32743", dup321); + +var msg34613 = msg("32744", dup314); + +var msg34614 = msg("32745", dup314); + +var msg34615 = msg("32746", dup314); + +var msg34616 = msg("32747", dup321); + +var msg34617 = msg("32748", dup309); + +var msg34618 = msg("32749", dup311); + +var msg34619 = msg("32750", dup311); + +var msg34620 = msg("32751", dup311); + +var msg34621 = msg("32752", dup311); + +var msg34622 = msg("32753", dup311); + +var msg34623 = msg("32754", dup328); + +var msg34624 = msg("32755", dup314); + +var msg34625 = msg("32756", dup314); + +var msg34626 = msg("32757", dup314); + +var msg34627 = msg("32758", dup314); + +var msg34628 = msg("32759", dup314); + +var msg34629 = msg("32760", dup314); + +var msg34630 = msg("32761", dup322); + +var msg34631 = msg("32762", dup325); + +var msg34632 = msg("32763", dup325); + +var msg34633 = msg("32764", dup323); + +var msg34634 = msg("32765", dup323); + +var msg34635 = msg("32766", dup323); + +var msg34636 = msg("32767", dup323); + +var msg34637 = msg("32768", dup322); + +var msg34638 = msg("32769", dup321); + +var msg34639 = msg("32770", dup321); + +var msg34640 = msg("32771", dup321); + +var msg34641 = msg("32772", dup321); + +var msg34642 = msg("32773", dup311); + +var msg34643 = msg("32774", dup200); + +var msg34644 = msg("32775", dup314); + +var msg34645 = msg("32776", dup321); + +var msg34646 = msg("32777", dup325); + +var msg34647 = msg("32778", dup325); + +var msg34648 = msg("32779", dup321); + +var msg34649 = msg("32780", dup321); + +var msg34650 = msg("32781", dup321); + +var msg34651 = msg("32782", dup309); + +var msg34652 = msg("32783", dup309); + +var msg34653 = msg("32784", dup309); + +var msg34654 = msg("32785", dup309); + +var msg34655 = msg("32786", dup311); + +var msg34656 = msg("32787", dup307); + +var msg34657 = msg("32788", dup307); + +var msg34658 = msg("32789", dup307); + +var msg34659 = msg("32790", dup307); + +var msg34660 = msg("32791", dup321); + +var msg34661 = msg("32792", dup321); + +var msg34662 = msg("32793", dup309); + +var msg34663 = msg("32794", dup309); + +var msg34664 = msg("32795", dup314); + +var msg34665 = msg("32796", dup314); + +var msg34666 = msg("32797", dup314); + +var msg34667 = msg("32798", dup314); + +var msg34668 = msg("32799", dup314); + +var msg34669 = msg("32800", dup314); + +var msg34670 = msg("32801", dup314); + +var msg34671 = msg("32802", dup314); + +var msg34672 = msg("32803", dup311); + +var msg34673 = msg("32804", dup311); + +var msg34674 = msg("32805", dup309); + +var msg34675 = msg("32806", dup309); + +var msg34676 = msg("32807", dup309); + +var msg34677 = msg("32808", dup309); + +var msg34678 = msg("32809", dup309); + +var msg34679 = msg("32810", dup309); + +var msg34680 = msg("32811", dup309); + +var msg34681 = msg("32812", dup309); + +var msg34682 = msg("32813", dup314); + +var msg34683 = msg("32814", dup314); + +var msg34684 = msg("32815", dup311); + +var msg34685 = msg("32816", dup311); + +var msg34686 = msg("32817", dup324); + +var msg34687 = msg("32818", dup324); + +var msg34688 = msg("32819", dup311); + +var msg34689 = msg("32820", dup311); + +var msg34690 = msg("32821", dup325); + +var msg34691 = msg("32822", dup325); + +var msg34692 = msg("32823", dup321); + +var msg34693 = msg("32824", dup321); + +var msg34694 = msg("32825", dup321); + +var msg34695 = msg("32826", dup321); + +var msg34696 = msg("32827", dup321); + +var msg34697 = msg("32828", dup309); + +var msg34698 = msg("32829", dup309); + +var msg34699 = msg("32830", dup309); + +var msg34700 = msg("32831", dup309); + +var msg34701 = msg("32832", dup309); + +var msg34702 = msg("32833", dup309); + +var msg34703 = msg("32834", dup309); + +var msg34704 = msg("32835", dup309); + +var msg34705 = msg("32836", dup309); + +var msg34706 = msg("32837", dup309); + +var msg34707 = msg("32838", dup314); + +var msg34708 = msg("32839", dup314); + +var msg34709 = msg("32840", dup314); + +var msg34710 = msg("32841", dup314); + +var msg34711 = msg("32842", dup314); + +var msg34712 = msg("32843", dup325); + +var msg34713 = msg("32844", dup311); + +var msg34714 = msg("32845", dup314); + +var msg34715 = msg("32846", dup314); + +var msg34716 = msg("32847", dup314); + +var msg34717 = msg("32848", dup314); + +var msg34718 = msg("32849", dup314); + +var msg34719 = msg("32850", dup314); + +var msg34720 = msg("32851", dup314); + +var msg34721 = msg("32852", dup321); + +var msg34722 = msg("32853", dup321); + +var msg34723 = msg("32854", dup321); + +var msg34724 = msg("32855", dup314); + +var msg34725 = msg("32856", dup314); + +var msg34726 = msg("32857", dup309); + +var msg34727 = msg("32858", dup309); + +var msg34728 = msg("32859", dup309); + +var msg34729 = msg("32860", dup309); + +var msg34730 = msg("32861", dup309); + +var msg34731 = msg("32862", dup309); + +var msg34732 = msg("32863", dup309); + +var msg34733 = msg("32864", dup306); + +var msg34734 = msg("32865", dup329); + +var msg34735 = msg("32866", dup314); + +var msg34736 = msg("32867", dup314); + +var msg34737 = msg("32868", dup314); + +var msg34738 = msg("32869", dup311); + +var msg34739 = msg("32870", dup311); + +var msg34740 = msg("32871", dup307); + +var msg34741 = msg("32872", dup309); + +var msg34742 = msg("32873", dup314); + +var msg34743 = msg("32874", dup314); + +var msg34744 = msg("32875", dup321); + +var msg34745 = msg("32876", dup311); + +var msg34746 = msg("32877", dup311); + +var msg34747 = msg("32878", dup311); + +var msg34748 = msg("32879", dup311); + +var msg34749 = msg("32880", dup311); + +var msg34750 = msg("32881", dup321); + +var msg34751 = msg("32882", dup321); + +var msg34752 = msg("32883", dup314); + +var msg34753 = msg("32884", dup314); + +var msg34754 = msg("32885", dup311); + +var msg34755 = msg("32886", dup311); + +var msg34756 = msg("32887", dup307); + +var msg34757 = msg("32888", dup321); + +var msg34758 = msg("32889", dup307); + +var msg34759 = msg("32890", dup309); + +var msg34760 = msg("32891", dup321); + +var msg34761 = msg("32892", dup321); + +var msg34762 = msg("32893", dup321); + +var msg34763 = msg("32894", dup314); + +var msg34764 = msg("32895", dup314); + +var msg34765 = msg("32896", dup314); + +var msg34766 = msg("32897", dup314); + +var msg34767 = msg("32898", dup309); + +var msg34768 = msg("32899", dup309); + +var msg34769 = msg("32900", dup314); + +var msg34770 = msg("32901", dup309); + +var msg34771 = msg("32902", dup309); + +var msg34772 = msg("32903", dup309); + +var msg34773 = msg("32904", dup309); + +var msg34774 = msg("32905", dup311); + +var msg34775 = msg("32906", dup311); + +var msg34776 = msg("32907", dup314); + +var msg34777 = msg("32908", dup321); + +var msg34778 = msg("32909", dup321); + +var msg34779 = msg("32910", dup321); + +var msg34780 = msg("32911", dup323); + +var msg34781 = msg("32912", dup323); + +var msg34782 = msg("32913", dup323); + +var msg34783 = msg("32914", dup323); + +var msg34784 = msg("32915", dup323); + +var msg34785 = msg("32916", dup323); + +var msg34786 = msg("32917", dup323); + +var msg34787 = msg("32918", dup323); + +var msg34788 = msg("32919", dup323); + +var msg34789 = msg("32920", dup323); + +var msg34790 = msg("32921", dup323); + +var msg34791 = msg("32922", dup323); + +var msg34792 = msg("32923", dup323); + +var msg34793 = msg("32924", dup323); + +var msg34794 = msg("32925", dup323); + +var msg34795 = msg("32926", dup323); + +var msg34796 = msg("32927", dup323); + +var msg34797 = msg("32928", dup323); + +var msg34798 = msg("32929", dup323); + +var msg34799 = msg("32930", dup323); + +var msg34800 = msg("32931", dup323); + +var msg34801 = msg("32932", dup323); + +var msg34802 = msg("32933", dup323); + +var msg34803 = msg("32934", dup323); + +var msg34804 = msg("32935", dup323); + +var msg34805 = msg("32936", dup323); + +var msg34806 = msg("32937", dup323); + +var msg34807 = msg("32938", dup323); + +var msg34808 = msg("32939", dup311); + +var msg34809 = msg("32940", dup309); + +var msg34810 = msg("32941", dup309); + +var msg34811 = msg("32942", dup309); + +var msg34812 = msg("32943", dup309); + +var msg34813 = msg("32944", dup325); + +var msg34814 = msg("32945", dup311); + +var msg34815 = msg("32946", dup311); + +var msg34816 = msg("32947", dup311); + +var msg34817 = msg("32948", dup311); + +var msg34818 = msg("32949", dup311); + +var msg34819 = msg("32950", dup321); + +var msg34820 = msg("32951", dup311); + +var msg34821 = msg("32952", dup314); + +var msg34822 = msg("32953", dup311); + +var msg34823 = msg("32954", dup311); + +var msg34824 = msg("32955", dup311); + +var msg34825 = msg("32956", dup321); + +var msg34826 = msg("32957", dup321); + +var msg34827 = msg("32958", dup321); + +var msg34828 = msg("32959", dup309); + +var msg34829 = msg("32960", dup309); + +var msg34830 = msg("32961", dup309); + +var msg34831 = msg("32962", dup314); + +var msg34832 = msg("32963", dup314); + +var msg34833 = msg("32964", dup314); + +var msg34834 = msg("32965", dup330); + +var msg34835 = msg("32966", dup330); + +var msg34836 = msg("32967", dup314); + +var msg34837 = msg("32968", dup323); + +var msg34838 = msg("32969", dup323); + +var msg34839 = msg("32970", dup323); + +var msg34840 = msg("32971", dup307); + +var msg34841 = msg("32972", dup321); + +var msg34842 = msg("32973", dup321); + +var msg34843 = msg("32974", dup314); + +var msg34844 = msg("32975", dup314); + +var msg34845 = msg("32976", dup321); + +var msg34846 = msg("32977", dup321); + +var msg34847 = msg("32978", dup325); + +var msg34848 = msg("32979", dup325); + +var msg34849 = msg("32980", dup325); + +var msg34850 = msg("32981", dup321); + +var msg34851 = msg("32982", dup321); + +var msg34852 = msg("32983", dup321); + +var msg34853 = msg("32984", dup321); + +var msg34854 = msg("32985", dup321); + +var msg34855 = msg("32986", dup321); + +var msg34856 = msg("32987", dup321); + +var msg34857 = msg("32988", dup321); + +var msg34858 = msg("32989", dup321); + +var msg34859 = msg("32990", dup321); + +var msg34860 = msg("32991", dup311); + +var msg34861 = msg("32992", dup311); + +var msg34862 = msg("32993", dup314); + +var msg34863 = msg("32994", dup314); + +var msg34864 = msg("32995", dup311); + +var msg34865 = msg("32996", dup309); + +var msg34866 = msg("32997", dup311); + +var msg34867 = msg("32998", dup311); + +var msg34868 = msg("32999", dup311); + +var msg34869 = msg("33000", dup311); + +var msg34870 = msg("33001", dup311); + +var msg34871 = msg("33002", dup311); + +var msg34872 = msg("33003", dup314); + +var msg34873 = msg("33004", dup314); + +var msg34874 = msg("33005", dup309); + +var msg34875 = msg("33006", dup309); + +var msg34876 = msg("33007", dup309); + +var msg34877 = msg("33008", dup309); + +var msg34878 = msg("33009", dup309); + +var msg34879 = msg("33010", dup309); + +var msg34880 = msg("33011", dup309); + +var msg34881 = msg("33012", dup309); + +var msg34882 = msg("33013", dup314); + +var msg34883 = msg("33014", dup314); + +var msg34884 = msg("33015", dup311); + +var msg34885 = msg("33016", dup309); + +var msg34886 = msg("33017", dup309); + +var msg34887 = msg("33018", dup309); + +var msg34888 = msg("33019", dup309); + +var msg34889 = msg("33020", dup309); + +var msg34890 = msg("33021", dup309); + +var msg34891 = msg("33022", dup309); + +var msg34892 = msg("33023", dup309); + +var msg34893 = msg("33024", dup311); + +var msg34894 = msg("33025", dup311); + +var msg34895 = msg("33026", dup314); + +var msg34896 = msg("33027", dup314); + +var msg34897 = msg("33028", dup314); + +var msg34898 = msg("33029", dup309); + +var msg34899 = msg("33030", dup309); + +var msg34900 = msg("33031", dup309); + +var msg34901 = msg("33032", dup309); + +var msg34902 = msg("33033", dup309); + +var msg34903 = msg("33034", dup309); + +var msg34904 = msg("33035", dup309); + +var msg34905 = msg("33036", dup309); + +var msg34906 = msg("33037", dup309); + +var msg34907 = msg("33038", dup309); + +var msg34908 = msg("33039", dup309); + +var msg34909 = msg("33040", dup309); + +var msg34910 = msg("33041", dup309); + +var msg34911 = msg("33042", dup309); + +var msg34912 = msg("33043", dup307); + +var msg34913 = msg("33044", dup314); + +var msg34914 = msg("33045", dup314); + +var msg34915 = msg("33046", dup314); + +var msg34916 = msg("33047", dup325); + +var msg34917 = msg("33048", dup314); + +var msg34918 = msg("33049", dup314); + +var msg34919 = msg("33050", dup309); + +var msg34920 = msg("33051", dup314); + +var msg34921 = msg("33052", dup314); + +var msg34922 = msg("33053", dup324); + +var msg34923 = msg("33054", dup321); + +var msg34924 = msg("33055", dup321); + +var msg34925 = msg("33056", dup321); + +var msg34926 = msg("33057", dup321); + +var msg34927 = msg("33058", dup321); + +var msg34928 = msg("33059", dup321); + +var msg34929 = msg("33060", dup321); + +var msg34930 = msg("33061", dup321); + +var msg34931 = msg("33062", dup333); + +var msg34932 = msg("33063", dup333); + +var msg34933 = msg("33064", dup321); + +var msg34934 = msg("33065", dup321); + +var msg34935 = msg("33066", dup321); + +var msg34936 = msg("33067", dup321); + +var msg34937 = msg("33068", dup321); + +var msg34938 = msg("33069", dup321); + +var msg34939 = msg("33070", dup333); + +var msg34940 = msg("33071", dup333); + +var msg34941 = msg("33072", dup333); + +var msg34942 = msg("33073", dup333); + +var msg34943 = msg("33074", dup323); + +var msg34944 = msg("33075", dup323); + +var msg34945 = msg("33076", dup323); + +var msg34946 = msg("33077", dup324); + +var msg34947 = msg("33078", dup324); + +var msg34948 = msg("33079", dup324); + +var msg34949 = msg("33080", dup324); + +var msg34950 = msg("33081", dup321); + +var msg34951 = msg("33082", dup321); + +var msg34952 = msg("33083", dup321); + +var msg34953 = msg("33084", dup321); + +var msg34954 = msg("33085", dup325); + +var msg34955 = msg("33086", dup325); + +var msg34956 = msg("33087", dup309); + +var msg34957 = msg("33088", dup311); + +var msg34958 = msg("33089", dup311); + +var msg34959 = msg("33090", dup311); + +var msg34960 = msg("33091", dup311); + +var msg34961 = msg("33092", dup311); + +var msg34962 = msg("33093", dup325); + +var msg34963 = msg("33094", dup325); + +var msg34964 = msg("33095", dup325); + +var msg34965 = msg("33096", dup325); + +var msg34966 = msg("33097", dup325); + +var msg34967 = msg("33098", dup325); + +var msg34968 = msg("33099", dup325); + +var msg34969 = msg("33100", dup314); + +var msg34970 = msg("33101", dup314); + +var msg34971 = msg("33102", dup314); + +var msg34972 = msg("33103", dup314); + +var msg34973 = msg("33104", dup323); + +var msg34974 = msg("33105", dup336); + +var msg34975 = msg("33106", dup336); + +var msg34976 = msg("33107", dup336); + +var msg34977 = msg("33108", dup336); + +var msg34978 = msg("33109", dup314); + +var msg34979 = msg("33110", dup314); + +var msg34980 = msg("33111", dup314); + +var msg34981 = msg("33112", dup314); + +var msg34982 = msg("33113", dup311); + +var msg34983 = msg("33114", dup311); + +var msg34984 = msg("33115", dup309); + +var msg34985 = msg("33116", dup309); + +var msg34986 = msg("33117", dup321); + +var msg34987 = msg("33118", dup321); + +var msg34988 = msg("33119", dup321); + +var msg34989 = msg("33120", dup321); + +var msg34990 = msg("33121", dup321); + +var msg34991 = msg("33122", dup321); + +var msg34992 = msg("33123", dup321); + +var msg34993 = msg("33124", dup321); + +var msg34994 = msg("33125", dup321); + +var msg34995 = msg("33126", dup321); + +var msg34996 = msg("33127", dup321); + +var msg34997 = msg("33128", dup321); + +var msg34998 = msg("33129", dup321); + +var msg34999 = msg("33130", dup321); + +var msg35000 = msg("33131", dup321); + +var msg35001 = msg("33132", dup321); + +var msg35002 = msg("33133", dup321); + +var msg35003 = msg("33134", dup321); + +var msg35004 = msg("33135", dup321); + +var msg35005 = msg("33136", dup321); + +var msg35006 = msg("33137", dup321); + +var msg35007 = msg("33138", dup321); + +var msg35008 = msg("33139", dup321); + +var msg35009 = msg("33140", dup321); + +var msg35010 = msg("33141", dup321); + +var msg35011 = msg("33142", dup321); + +var msg35012 = msg("33143", dup321); + +var msg35013 = msg("33144", dup321); + +var msg35014 = msg("33145", dup321); + +var msg35015 = msg("33146", dup321); + +var msg35016 = msg("33147", dup335); + +var msg35017 = msg("33148", dup335); + +var msg35018 = msg("33149", dup321); + +var msg35019 = msg("33150", dup321); + +var msg35020 = msg("33151", dup321); + +var msg35021 = msg("33152", dup321); + +var msg35022 = msg("33153", dup321); + +var msg35023 = msg("33154", dup321); + +var msg35024 = msg("33155", dup314); + +var msg35025 = msg("33156", dup314); + +var msg35026 = msg("33157", dup307); + +var msg35027 = msg("33158", dup307); + +var msg35028 = msg("33159", dup324); + +var msg35029 = msg("33160", dup324); + +var msg35030 = msg("33161", dup321); + +var msg35031 = msg("33162", dup325); + +var msg35032 = msg("33163", dup325); + +var msg35033 = msg("33164", dup309); + +var msg35034 = msg("33165", dup321); + +var msg35035 = msg("33166", dup311); + +var msg35036 = msg("33167", dup311); + +var msg35037 = msg("33168", dup311); + +var msg35038 = msg("33169", dup311); + +var msg35039 = msg("33170", dup333); + +var msg35040 = msg("33171", dup333); + +var msg35041 = msg("33172", dup333); + +var msg35042 = msg("33173", dup333); + +var msg35043 = msg("33174", dup333); + +var msg35044 = msg("33175", dup333); + +var msg35045 = msg("33176", dup311); + +var msg35046 = msg("33177", dup311); + +var msg35047 = msg("33178", dup309); + +var msg35048 = msg("33179", dup309); + +var msg35049 = msg("33180", dup309); + +var msg35050 = msg("33181", dup309); + +var msg35051 = msg("33182", dup311); + +var msg35052 = msg("33183", dup311); + +var msg35053 = msg("33184", dup311); + +var msg35054 = msg("33185", dup311); + +var msg35055 = msg("33186", dup311); + +var msg35056 = msg("33187", dup311); + +var msg35057 = msg("33188", dup321); + +var msg35058 = msg("33189", dup316); + +var msg35059 = msg("33190", dup316); + +var msg35060 = msg("33191", dup325); + +var msg35061 = msg("33192", dup325); + +var msg35062 = msg("33193", dup325); + +var msg35063 = msg("33194", dup325); + +var msg35064 = msg("33195", dup325); + +var msg35065 = msg("33196", dup325); + +var msg35066 = msg("33197", dup314); + +var msg35067 = msg("33198", dup309); + +var msg35068 = msg("33199", dup321); + +var msg35069 = msg("33200", dup321); + +var msg35070 = msg("33201", dup311); + +var msg35071 = msg("33202", dup311); + +var msg35072 = msg("33203", dup311); + +var msg35073 = msg("33204", dup311); + +var msg35074 = msg("33205", dup311); + +var msg35075 = msg("33206", dup311); + +var msg35076 = msg("33207", dup325); + +var msg35077 = msg("33208", dup321); + +var msg35078 = msg("33209", dup321); + +var msg35079 = msg("33210", dup321); + +var msg35080 = msg("33211", dup321); + +var msg35081 = msg("33212", dup333); + +var msg35082 = msg("33213", dup311); + +var msg35083 = msg("33214", dup311); + +var msg35084 = msg("33215", dup321); + +var msg35085 = msg("33216", dup321); + +var msg35086 = msg("33217", dup321); + +var msg35087 = msg("33218", dup321); + +var msg35088 = msg("33219", dup321); + +var msg35089 = msg("33220", dup321); + +var msg35090 = msg("33221", dup321); + +var msg35091 = msg("33222", dup321); + +var msg35092 = msg("33223", dup321); + +var msg35093 = msg("33224", dup200); + +var msg35094 = msg("33225", dup309); + +var msg35095 = msg("33226", dup309); + +var msg35096 = msg("33227", dup321); + +var msg35097 = msg("33228", dup321); + +var msg35098 = msg("33229", dup311); + +var msg35099 = msg("33230", dup325); + +var msg35100 = msg("33231", dup325); + +var msg35101 = msg("33232", dup325); + +var msg35102 = msg("33233", dup325); + +var msg35103 = msg("33234", dup325); + +var msg35104 = msg("33235", dup325); + +var msg35105 = msg("33236", dup325); + +var msg35106 = msg("33237", dup325); + +var msg35107 = msg("33238", dup325); + +var msg35108 = msg("33239", dup325); + +var msg35109 = msg("33240", dup325); + +var msg35110 = msg("33241", dup325); + +var msg35111 = msg("33242", dup325); + +var msg35112 = msg("33243", dup325); + +var msg35113 = msg("33244", dup325); + +var msg35114 = msg("33245", dup325); + +var msg35115 = msg("33246", dup325); + +var msg35116 = msg("33247", dup325); + +var msg35117 = msg("33248", dup325); + +var msg35118 = msg("33249", dup325); + +var msg35119 = msg("33250", dup325); + +var msg35120 = msg("33251", dup325); + +var msg35121 = msg("33252", dup325); + +var msg35122 = msg("33253", dup325); + +var msg35123 = msg("33254", dup325); + +var msg35124 = msg("33255", dup325); + +var msg35125 = msg("33256", dup325); + +var msg35126 = msg("33257", dup325); + +var msg35127 = msg("33258", dup325); + +var msg35128 = msg("33259", dup325); + +var msg35129 = msg("33260", dup325); + +var msg35130 = msg("33261", dup314); + +var msg35131 = msg("33262", dup314); + +var msg35132 = msg("33263", dup314); + +var msg35133 = msg("33264", dup314); + +var msg35134 = msg("33265", dup314); + +var msg35135 = msg("33266", dup314); + +var msg35136 = msg("33267", dup314); + +var msg35137 = msg("33268", dup314); + +var msg35138 = msg("33269", dup314); + +var msg35139 = msg("33270", dup314); + +var msg35140 = msg("33271", dup311); + +var msg35141 = msg("33272", dup311); + +var msg35142 = msg("33273", dup311); + +var msg35143 = msg("33274", dup311); + +var msg35144 = msg("33275", dup309); + +var msg35145 = msg("33276", dup316); + +var msg35146 = msg("33277", dup316); + +var msg35147 = msg("33278", dup316); + +var msg35148 = msg("33279", dup311); + +var msg35149 = msg("33280", dup321); + +var msg35150 = msg("33281", dup321); + +var msg35151 = msg("33282", dup321); + +var msg35152 = msg("33283", dup321); + +var msg35153 = msg("33284", dup321); + +var msg35154 = msg("33285", dup321); + +var msg35155 = msg("33286", dup311); + +var msg35156 = msg("33287", dup325); + +var msg35157 = msg("33288", dup325); + +var msg35158 = msg("33289", dup321); + +var msg35159 = msg("33290", dup314); + +var msg35160 = msg("33291", dup314); + +var msg35161 = msg("33292", dup311); + +var msg35162 = msg("33293", dup314); + +var msg35163 = msg("33294", dup314); + +var msg35164 = msg("33295", dup309); + +var msg35165 = msg("33296", dup309); + +var msg35166 = msg("33297", dup309); + +var msg35167 = msg("33298", dup309); + +var msg35168 = msg("33299", dup321); + +var msg35169 = msg("33300", dup324); + +var msg35170 = msg("33301", dup324); + +var msg35171 = msg("33302", dup324); + +var msg35172 = msg("33303", dup324); + +var msg35173 = msg("33304", dup321); + +var msg35174 = msg("33305", dup321); + +var msg35175 = msg("33306", dup321); + +var msg35176 = msg("33307", dup311); + +var msg35177 = msg("33308", dup311); + +var msg35178 = msg("33309", dup309); + +var msg35179 = msg("33310", dup309); + +var msg35180 = msg("33311", dup321); + +var msg35181 = msg("33312", dup311); + +var msg35182 = msg("33313", dup311); + +var msg35183 = msg("33314", dup325); + +var msg35184 = msg("33315", dup325); + +var msg35185 = msg("33316", dup325); + +var msg35186 = msg("33317", dup325); + +var msg35187 = msg("33318", dup325); + +var msg35188 = msg("33319", dup325); + +var msg35189 = msg("33320", dup325); + +var msg35190 = msg("33321", dup325); + +var msg35191 = msg("33322", dup325); + +var msg35192 = msg("33323", dup311); + +var msg35193 = msg("33324", dup325); + +var msg35194 = msg("33325", dup325); + +var msg35195 = msg("33326", dup321); + +var msg35196 = msg("33327", dup321); + +var msg35197 = msg("33328", dup321); + +var msg35198 = msg("33329", dup321); + +var msg35199 = msg("33330", dup321); + +var msg35200 = msg("33331", dup325); + +var msg35201 = msg("33332", dup325); + +var msg35202 = msg("33333", dup325); + +var msg35203 = msg("33334", dup325); + +var msg35204 = msg("33335", dup325); + +var msg35205 = msg("33336", dup325); + +var msg35206 = msg("33337", dup325); + +var msg35207 = msg("33338", dup325); + +var msg35208 = msg("33339", dup316); + +var msg35209 = msg("33340", dup325); + +var msg35210 = msg("33341", dup325); + +var msg35211 = msg("33342", dup321); + +var msg35212 = msg("33343", dup314); + +var msg35213 = msg("33344", dup314); + +var msg35214 = msg("33345", dup325); + +var msg35215 = msg("33346", dup325); + +var msg35216 = msg("33347", dup325); + +var msg35217 = msg("33348", dup325); + +var msg35218 = msg("33349", dup325); + +var msg35219 = msg("33350", dup309); + +var msg35220 = msg("33351", dup309); + +var msg35221 = msg("33352", dup311); + +var msg35222 = msg("33353", dup325); + +var msg35223 = msg("33354", dup325); + +var msg35224 = msg("33355", dup314); + +var msg35225 = msg("33356", dup325); + +var msg35226 = msg("33357", dup325); + +var msg35227 = msg("33358", dup325); + +var msg35228 = msg("33359", dup325); + +var msg35229 = msg("33360", dup325); + +var msg35230 = msg("33361", dup325); + +var msg35231 = msg("33362", dup309); + +var msg35232 = msg("33363", dup314); + +var msg35233 = msg("33364", dup314); + +var msg35234 = msg("33365", dup325); + +var msg35235 = msg("33366", dup325); + +var msg35236 = msg("33367", dup314); + +var msg35237 = msg("33368", dup314); + +var msg35238 = msg("33369", dup314); + +var msg35239 = msg("33370", dup314); + +var msg35240 = msg("33371", dup314); + +var msg35241 = msg("33372", dup314); + +var msg35242 = msg("33373", dup314); + +var msg35243 = msg("33374", dup314); + +var msg35244 = msg("33375", dup314); + +var msg35245 = msg("33376", dup314); + +var msg35246 = msg("33377", dup314); + +var msg35247 = msg("33378", dup314); + +var msg35248 = msg("33379", dup314); + +var msg35249 = msg("33380", dup314); + +var msg35250 = msg("33381", dup314); + +var msg35251 = msg("33382", dup314); + +var msg35252 = msg("33383", dup314); + +var msg35253 = msg("33384", dup314); + +var msg35254 = msg("33385", dup314); + +var msg35255 = msg("33386", dup314); + +var msg35256 = msg("33387", dup314); + +var msg35257 = msg("33388", dup314); + +var msg35258 = msg("33389", dup314); + +var msg35259 = msg("33390", dup314); + +var msg35260 = msg("33391", dup314); + +var msg35261 = msg("33392", dup314); + +var msg35262 = msg("33393", dup314); + +var msg35263 = msg("33394", dup314); + +var msg35264 = msg("33395", dup314); + +var msg35265 = msg("33396", dup314); + +var msg35266 = msg("33397", dup314); + +var msg35267 = msg("33398", dup314); + +var msg35268 = msg("33399", dup314); + +var msg35269 = msg("33400", dup314); + +var msg35270 = msg("33401", dup314); + +var msg35271 = msg("33402", dup314); + +var msg35272 = msg("33403", dup314); + +var msg35273 = msg("33404", dup314); + +var msg35274 = msg("33405", dup314); + +var msg35275 = msg("33406", dup314); + +var msg35276 = msg("33407", dup314); + +var msg35277 = msg("33408", dup314); + +var msg35278 = msg("33409", dup314); + +var msg35279 = msg("33410", dup314); + +var msg35280 = msg("33411", dup321); + +var msg35281 = msg("33412", dup311); + +var msg35282 = msg("33413", dup325); + +var msg35283 = msg("33414", dup325); + +var msg35284 = msg("33415", dup325); + +var msg35285 = msg("33416", dup325); + +var msg35286 = msg("33417", dup325); + +var msg35287 = msg("33418", dup325); + +var msg35288 = msg("33419", dup325); + +var msg35289 = msg("33420", dup325); + +var msg35290 = msg("33421", dup311); + +var msg35291 = msg("33422", dup311); + +var msg35292 = msg("33423", dup325); + +var msg35293 = msg("33424", dup325); + +var msg35294 = msg("33425", dup325); + +var msg35295 = msg("33426", dup325); + +var msg35296 = msg("33427", dup325); + +var msg35297 = msg("33428", dup325); + +var msg35298 = msg("33429", dup311); + +var msg35299 = msg("33430", dup314); + +var msg35300 = msg("33431", dup321); + +var msg35301 = msg("33432", dup321); + +var msg35302 = msg("33433", dup321); + +var msg35303 = msg("33434", dup321); + +var msg35304 = msg("33435", dup321); + +var msg35305 = msg("33436", dup309); + +var msg35306 = msg("33437", dup309); + +var msg35307 = msg("33438", dup321); + +var msg35308 = msg("33439", dup321); + +var msg35309 = msg("33440", dup311); + +var msg35310 = msg("33441", dup309); + +var msg35311 = msg("33442", dup309); + +var msg35312 = msg("33443", dup321); + +var msg35313 = msg("33444", dup321); + +var msg35314 = msg("33445", dup323); + +var msg35315 = msg("33446", dup316); + +var msg35316 = msg("33447", dup316); + +var msg35317 = msg("33448", dup316); + +var msg35318 = msg("33449", dup323); + +var msg35319 = msg("33450", dup321); + +var msg35320 = msg("33451", dup309); + +var msg35321 = msg("33452", dup314); + +var msg35322 = msg("33453", dup321); + +var msg35323 = msg("33454", dup309); + +var msg35324 = msg("33455", dup309); + +var msg35325 = msg("33456", dup321); + +var msg35326 = msg("33457", dup321); + +var msg35327 = msg("33458", dup311); + +var msg35328 = msg("33459", dup311); + +var msg35329 = msg("33460", dup311); + +var msg35330 = msg("33461", dup311); + +var msg35331 = msg("33462", dup311); + +var msg35332 = msg("33463", dup311); + +var msg35333 = msg("33464", dup321); + +var msg35334 = msg("33465", dup309); + +var msg35335 = msg("33466", dup309); + +var msg35336 = msg("33467", dup309); + +var msg35337 = msg("33468", dup309); + +var msg35338 = msg("33469", dup311); + +var msg35339 = msg("33470", dup311); + +var msg35340 = msg("33471", dup311); + +var msg35341 = msg("33472", dup311); + +var msg35342 = msg("33473", dup311); + +var msg35343 = msg("33474", dup311); + +var msg35344 = msg("33475", dup314); + +var msg35345 = msg("33476", dup314); + +var msg35346 = msg("33477", dup314); + +var msg35347 = msg("33478", dup314); + +var msg35348 = msg("33564", dup309); + +var msg35349 = msg("33565", dup311); + +var msg35350 = msg("33566", dup309); + +var msg35351 = msg("33567", dup309); + +var msg35352 = msg("33568", dup309); + +var msg35353 = msg("33569", dup311); + +var msg35354 = msg("33570", dup311); + +var msg35355 = msg("33571", dup311); + +var msg35356 = msg("33572", dup311); + +var msg35357 = msg("33573", dup323); + +var msg35358 = msg("33574", dup323); + +var msg35359 = msg("33575", dup311); + +var msg35360 = msg("33576", dup311); + +var msg35361 = msg("33577", dup311); + +var msg35362 = msg("33578", dup311); + +var msg35363 = msg("33579", dup314); + +var msg35364 = msg("33580", dup321); + +var msg35365 = msg("33581", dup314); + +var msg35366 = msg("33582", dup309); + +var msg35367 = msg("33583", dup324); + +var msg35368 = msg("33584", dup311); + +var msg35369 = msg("33585", dup311); + +var msg35370 = msg("33586", dup311); + +var msg35371 = msg("33587", dup309); + +var msg35372 = msg("33588", dup309); + +var msg35373 = msg("33589", dup309); + +var msg35374 = msg("33590", dup309); + +var msg35375 = msg("33591", dup309); + +var msg35376 = msg("33592", dup309); + +var msg35377 = msg("33593", dup309); + +var msg35378 = msg("33594", dup321); + +var msg35379 = msg("33595", dup309); + +var msg35380 = msg("33596", dup309); + +var msg35381 = msg("33597", dup314); + +var msg35382 = msg("33598", dup314); + +var msg35383 = msg("33599", dup314); + +var msg35384 = msg("33600", dup321); + +var msg35385 = msg("33601", dup311); + +var msg35386 = msg("33602", dup311); + +var msg35387 = msg("33603", dup311); + +var msg35388 = msg("33604", dup311); + +var msg35389 = msg("33605", dup325); + +var msg35390 = msg("33606", dup325); + +var msg35391 = msg("33607", dup314); + +var msg35392 = msg("33608", dup314); + +var msg35393 = msg("33609", dup310); + +var msg35394 = msg("33610", dup310); + +var msg35395 = msg("33611", dup310); + +var msg35396 = msg("33612", dup314); + +var msg35397 = msg("33613", dup314); + +var msg35398 = msg("33614", dup314); + +var msg35399 = msg("33615", dup311); + +var msg35400 = msg("33618", dup321); + +var msg35401 = msg("33619", dup321); + +var msg35402 = msg("33620", dup321); + +var msg35403 = msg("33621", dup321); + +var msg35404 = msg("33622", dup324); + +var msg35405 = msg("33623", dup324); + +var msg35406 = msg("33624", dup324); + +var msg35407 = msg("33625", dup324); + +var msg35408 = msg("33626", dup324); + +var msg35409 = msg("33627", dup324); + +var msg35410 = msg("33628", dup324); + +var msg35411 = msg("33629", dup324); + +var msg35412 = msg("33630", dup324); + +var msg35413 = msg("33631", dup324); + +var msg35414 = msg("33632", dup316); + +var msg35415 = msg("33633", dup325); + +var msg35416 = msg("33634", dup324); + +var msg35417 = msg("33635", dup324); + +var msg35418 = msg("33636", dup308); + +var msg35419 = msg("33637", dup322); + +var msg35420 = msg("33638", dup324); + +var msg35421 = msg("33639", dup324); + +var msg35422 = msg("33640", dup314); + +var msg35423 = msg("33641", dup314); + +var msg35424 = msg("33642", dup314); + +var msg35425 = msg("33643", dup309); + +var msg35426 = msg("33644", dup309); + +var msg35427 = msg("33645", dup321); + +var msg35428 = msg("33646", dup324); + +var msg35429 = msg("33647", dup324); + +var msg35430 = msg("33648", dup324); + +var msg35431 = msg("33649", dup325); + +var msg35432 = msg("33650", dup321); + +var msg35433 = msg("33651", dup322); + +var msg35434 = msg("33652", dup322); + +var msg35435 = msg("33653", dup322); + +var all62 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup122, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg35436 = msg("33654", all62); + +var msg35437 = msg("33655", dup310); + +var msg35438 = msg("33656", dup321); + +var msg35439 = msg("33657", dup307); + +var msg35440 = msg("33658", dup307); + +var msg35441 = msg("33659", dup307); + +var msg35442 = msg("33660", dup321); + +var msg35443 = msg("33661", dup314); + +var msg35444 = msg("33662", dup314); + +var msg35445 = msg("33663", dup311); + +var msg35446 = msg("33664", dup314); + +var msg35447 = msg("33665", dup316); + +var msg35448 = msg("33666", dup314); + +var msg35449 = msg("33667", dup314); + +var msg35450 = msg("33668", dup314); + +var msg35451 = msg("33669", dup311); + +var msg35452 = msg("33670", dup324); + +var msg35453 = msg("33671", dup324); + +var msg35454 = msg("33672", dup324); + +var msg35455 = msg("33673", dup321); + +var msg35456 = msg("33674", dup321); + +var msg35457 = msg("33675", dup321); + +var msg35458 = msg("33676", dup316); + +var msg35459 = msg("33677", dup321); + +var msg35460 = msg("33678", dup321); + +var msg35461 = msg("33679", dup324); + +var msg35462 = msg("33680", dup324); + +var msg35463 = msg("33681", dup321); + +var msg35464 = msg("33682", dup314); + +var msg35465 = msg("33683", dup314); + +var msg35466 = msg("33684", dup311); + +var msg35467 = msg("33685", dup311); + +var msg35468 = msg("33686", dup323); + +var msg35469 = msg("33687", dup323); + +var msg35470 = msg("33688", dup323); + +var msg35471 = msg("33689", dup323); + +var msg35472 = msg("33690", dup323); + +var msg35473 = msg("33691", dup323); + +var msg35474 = msg("33692", dup323); + +var msg35475 = msg("33693", dup323); + +var msg35476 = msg("33694", dup323); + +var msg35477 = msg("33695", dup323); + +var msg35478 = msg("33696", dup323); + +var msg35479 = msg("33697", dup323); + +var msg35480 = msg("33698", dup323); + +var msg35481 = msg("33699", dup323); + +var msg35482 = msg("33700", dup323); + +var msg35483 = msg("33701", dup323); + +var msg35484 = msg("33702", dup323); + +var msg35485 = msg("33703", dup323); + +var msg35486 = msg("33704", dup321); + +var msg35487 = msg("33705", dup309); + +var msg35488 = msg("33706", dup309); + +var msg35489 = msg("33707", dup325); + +var msg35490 = msg("33708", dup325); + +var msg35491 = msg("33709", dup323); + +var msg35492 = msg("33710", dup323); + +var msg35493 = msg("33711", dup314); + +var msg35494 = msg("33712", dup314); + +var msg35495 = msg("33713", dup309); + +var msg35496 = msg("33714", dup309); + +var msg35497 = msg("33715", dup309); + +var msg35498 = msg("33716", dup309); + +var msg35499 = msg("33717", dup314); + +var msg35500 = msg("33718", dup311); + +var msg35501 = msg("33719", dup311); + +var msg35502 = msg("33720", dup325); + +var msg35503 = msg("33721", dup325); + +var msg35504 = msg("33722", dup309); + +var msg35505 = msg("33723", dup309); + +var msg35506 = msg("33724", dup311); + +var msg35507 = msg("33725", dup311); + +var msg35508 = msg("33726", dup325); + +var msg35509 = msg("33727", dup325); + +var msg35510 = msg("33728", dup314); + +var msg35511 = msg("33729", dup314); + +var msg35512 = msg("33730", dup325); + +var msg35513 = msg("33731", dup325); + +var msg35514 = msg("33732", dup314); + +var msg35515 = msg("33733", dup314); + +var msg35516 = msg("33734", dup309); + +var msg35517 = msg("33735", dup309); + +var msg35518 = msg("33736", dup325); + +var msg35519 = msg("33737", dup325); + +var msg35520 = msg("33738", dup325); + +var msg35521 = msg("33739", dup325); + +var msg35522 = msg("33740", dup314); + +var msg35523 = msg("33741", dup325); + +var msg35524 = msg("33742", dup325); + +var msg35525 = msg("33743", dup309); + +var msg35526 = msg("33744", dup309); + +var msg35527 = msg("33745", dup321); + +var msg35528 = msg("33746", dup321); + +var msg35529 = msg("33747", dup321); + +var msg35530 = msg("33748", dup321); + +var msg35531 = msg("33749", dup321); + +var msg35532 = msg("33750", dup321); + +var msg35533 = msg("33751", dup321); + +var msg35534 = msg("33752", dup321); + +var msg35535 = msg("33753", dup321); + +var msg35536 = msg("33754", dup321); + +var msg35537 = msg("33755", dup321); + +var msg35538 = msg("33756", dup321); + +var msg35539 = msg("33757", dup321); + +var msg35540 = msg("33758", dup321); + +var msg35541 = msg("33759", dup321); + +var msg35542 = msg("33760", dup325); + +var msg35543 = msg("33761", dup325); + +var msg35544 = msg("33762", dup311); + +var msg35545 = msg("33763", dup325); + +var msg35546 = msg("33764", dup325); + +var msg35547 = msg("33765", dup323); + +var msg35548 = msg("33766", dup323); + +var msg35549 = msg("33767", dup314); + +var msg35550 = msg("33768", dup314); + +var msg35551 = msg("33769", dup314); + +var msg35552 = msg("33770", dup314); + +var msg35553 = msg("33771", dup314); + +var msg35554 = msg("33772", dup314); + +var msg35555 = msg("33773", dup314); + +var msg35556 = msg("33774", dup314); + +var msg35557 = msg("33775", dup325); + +var msg35558 = msg("33776", dup325); + +var msg35559 = msg("33777", dup323); + +var msg35560 = msg("33778", dup323); + +var msg35561 = msg("33779", dup323); + +var msg35562 = msg("33780", dup323); + +var msg35563 = msg("33781", dup323); + +var msg35564 = msg("33782", dup323); + +var msg35565 = msg("33783", dup323); + +var msg35566 = msg("33784", dup323); + +var msg35567 = msg("33785", dup323); + +var msg35568 = msg("33786", dup323); + +var msg35569 = msg("33787", dup323); + +var msg35570 = msg("33788", dup323); + +var msg35571 = msg("33789", dup323); + +var msg35572 = msg("33790", dup323); + +var msg35573 = msg("33791", dup323); + +var msg35574 = msg("33792", dup323); + +var msg35575 = msg("33793", dup323); + +var msg35576 = msg("33794", dup323); + +var msg35577 = msg("33795", dup323); + +var msg35578 = msg("33796", dup323); + +var msg35579 = msg("33797", dup323); + +var msg35580 = msg("33798", dup323); + +var msg35581 = msg("33799", dup323); + +var msg35582 = msg("33800", dup323); + +var msg35583 = msg("33801", dup323); + +var msg35584 = msg("33802", dup323); + +var msg35585 = msg("33803", dup323); + +var msg35586 = msg("33804", dup323); + +var msg35587 = msg("33805", dup323); + +var msg35588 = msg("33806", dup323); + +var msg35589 = msg("33807", dup316); + +var msg35590 = msg("33808", dup314); + +var msg35591 = msg("33809", dup314); + +var msg35592 = msg("33810", dup311); + +var msg35593 = msg("33811", dup314); + +var msg35594 = msg("33812", dup311); + +var msg35595 = msg("33813", dup310); + +var msg35596 = msg("33814", dup307); + +var msg35597 = msg("33815", dup321); + +var msg35598 = msg("33816", dup321); + +var msg35599 = msg("33817", dup310); + +var msg35600 = msg("33818", dup321); + +var msg35601 = msg("33819", dup321); + +var msg35602 = msg("33820", dup321); + +var msg35603 = msg("33821", dup321); + +var msg35604 = msg("33822", dup321); + +var msg35605 = msg("33823", dup321); + +var msg35606 = msg("33824", dup311); + +var msg35607 = msg("33825", dup314); + +var msg35608 = msg("33826", dup324); + +var msg35609 = msg("33827", dup311); + +var msg35610 = msg("33828", dup311); + +var msg35611 = msg("33829", dup311); + +var msg35612 = msg("33830", dup307); + +var msg35613 = msg("33831", dup325); + +var msg35614 = msg("33832", dup316); + +var msg35615 = msg("33833", dup321); + +var msg35616 = msg("33834", dup321); + +var msg35617 = msg("33835", dup321); + +var msg35618 = msg("33836", dup321); + +var msg35619 = msg("33837", dup321); + +var msg35620 = msg("33838", dup321); + +var msg35621 = msg("33839", dup321); + +var msg35622 = msg("33840", dup321); + +var msg35623 = msg("33841", dup321); + +var msg35624 = msg("33842", dup321); + +var msg35625 = msg("33843", dup321); + +var msg35626 = msg("33844", dup321); + +var msg35627 = msg("33845", dup321); + +var msg35628 = msg("33846", dup321); + +var msg35629 = msg("33847", dup321); + +var msg35630 = msg("33848", dup321); + +var msg35631 = msg("33849", dup321); + +var msg35632 = msg("33850", dup321); + +var msg35633 = msg("33851", dup321); + +var msg35634 = msg("33852", dup321); + +var msg35635 = msg("33853", dup307); + +var msg35636 = msg("33854", dup321); + +var msg35637 = msg("33855", dup325); + +var msg35638 = msg("33856", dup314); + +var msg35639 = msg("33857", dup321); + +var msg35640 = msg("33858", dup314); + +var msg35641 = msg("33859", dup321); + +var msg35642 = msg("33860", dup321); + +var msg35643 = msg("33861", dup321); + +var msg35644 = msg("33862", dup321); + +var msg35645 = msg("33863", dup321); + +var msg35646 = msg("33864", dup321); + +var msg35647 = msg("33865", dup321); + +var msg35648 = msg("33866", dup321); + +var msg35649 = msg("33867", dup321); + +var msg35650 = msg("33868", dup321); + +var msg35651 = msg("33869", dup323); + +var msg35652 = msg("33870", dup323); + +var msg35653 = msg("33871", dup332); + +var msg35654 = msg("33872", dup321); + +var msg35655 = msg("33873", dup321); + +var msg35656 = msg("33874", dup321); + +var msg35657 = msg("33875", dup314); + +var msg35658 = msg("33876", dup321); + +var msg35659 = msg("33877", dup321); + +var msg35660 = msg("33878", dup321); + +var msg35661 = msg("33879", dup321); + +var msg35662 = msg("33880", dup321); + +var msg35663 = msg("33881", dup321); + +var msg35664 = msg("33882", dup321); + +var msg35665 = msg("33883", dup321); + +var msg35666 = msg("33884", dup325); + +var msg35667 = msg("33885", dup321); + +var msg35668 = msg("33886", dup321); + +var msg35669 = msg("33887", dup316); + +var msg35670 = msg("33888", dup316); + +var msg35671 = msg("33889", dup316); + +var msg35672 = msg("33890", dup316); + +var msg35673 = msg("33891", dup321); + +var msg35674 = msg("33892", dup321); + +var msg35675 = msg("33893", dup321); + +var msg35676 = msg("33894", dup311); + +var msg35677 = msg("33895", dup311); + +var msg35678 = msg("33896", dup311); + +var msg35679 = msg("33897", dup307); + +var msg35680 = msg("33898", dup307); + +var msg35681 = msg("33899", dup311); + +var msg35682 = msg("33900", dup311); + +var msg35683 = msg("33901", dup311); + +var msg35684 = msg("33902", dup311); + +var msg35685 = msg("33903", dup307); + +var msg35686 = msg("33904", dup307); + +var msg35687 = msg("33905", dup311); + +var msg35688 = msg("33906", dup311); + +var msg35689 = msg("33907", dup325); + +var msg35690 = msg("33908", dup309); + +var msg35691 = msg("33909", dup309); + +var msg35692 = msg("33910", dup324); + +var msg35693 = msg("33911", dup324); + +var msg35694 = msg("33912", dup321); + +var msg35695 = msg("33913", dup321); + +var msg35696 = msg("33914", dup325); + +var msg35697 = msg("33915", dup314); + +var msg35698 = msg("33916", dup314); + +var msg35699 = msg("33917", dup314); + +var msg35700 = msg("33918", dup314); + +var msg35701 = msg("33919", dup314); + +var msg35702 = msg("33920", dup314); + +var msg35703 = msg("33921", dup314); + +var msg35704 = msg("33922", dup307); + +var msg35705 = msg("33923", dup309); + +var msg35706 = msg("33924", dup309); + +var msg35707 = msg("33925", dup309); + +var msg35708 = msg("33926", dup309); + +var msg35709 = msg("33927", dup334); + +var msg35710 = msg("33928", dup324); + +var msg35711 = msg("33929", dup324); + +var msg35712 = msg("33930", dup321); + +var msg35713 = msg("33931", dup321); + +var msg35714 = msg("33932", dup321); + +var msg35715 = msg("33933", dup321); + +var msg35716 = msg("33934", dup314); + +var msg35717 = msg("33935", dup314); + +var msg35718 = msg("33936", dup316); + +var msg35719 = msg("33937", dup316); + +var msg35720 = msg("33938", dup316); + +var msg35721 = msg("33939", dup311); + +var msg35722 = msg("33940", dup311); + +var msg35723 = msg("33941", dup311); + +var msg35724 = msg("33942", dup311); + +var msg35725 = msg("33943", dup311); + +var msg35726 = msg("33944", dup309); + +var msg35727 = msg("33945", dup309); + +var msg35728 = msg("33946", dup309); + +var msg35729 = msg("33947", dup309); + +var msg35730 = msg("33948", dup309); + +var msg35731 = msg("33949", dup309); + +var msg35732 = msg("33950", dup309); + +var msg35733 = msg("33951", dup309); + +var msg35734 = msg("33952", dup309); + +var msg35735 = msg("33953", dup309); + +var msg35736 = msg("33954", dup309); + +var msg35737 = msg("33955", dup309); + +var msg35738 = msg("33956", dup309); + +var msg35739 = msg("33957", dup309); + +var msg35740 = msg("33958", dup309); + +var msg35741 = msg("33959", dup309); + +var msg35742 = msg("33960", dup311); + +var msg35743 = msg("33961", dup311); + +var msg35744 = msg("33962", dup314); + +var msg35745 = msg("33963", dup314); + +var msg35746 = msg("33964", dup314); + +var msg35747 = msg("33965", dup321); + +var msg35748 = msg("33966", dup321); + +var msg35749 = msg("33967", dup311); + +var msg35750 = msg("33968", dup311); + +var msg35751 = msg("33969", dup311); + +var msg35752 = msg("33970", dup311); + +var msg35753 = msg("33971", dup314); + +var msg35754 = msg("33972", dup314); + +var msg35755 = msg("33973", dup314); + +var msg35756 = msg("33974", dup314); + +var msg35757 = msg("33975", dup314); + +var msg35758 = msg("33976", dup314); + +var msg35759 = msg("33977", dup314); + +var msg35760 = msg("33978", dup314); + +var msg35761 = msg("33979", dup309); + +var msg35762 = msg("33980", dup309); + +var msg35763 = msg("33981", dup311); + +var msg35764 = msg("33982", dup311); + +var msg35765 = msg("33983", dup311); + +var msg35766 = msg("33984", dup316); + +var msg35767 = msg("33985", dup321); + +var msg35768 = msg("33986", dup314); + +var msg35769 = msg("33987", dup311); + +var msg35770 = msg("33988", dup321); + +var msg35771 = msg("33989", dup321); + +var msg35772 = msg("33990", dup321); + +var msg35773 = msg("33991", dup321); + +var msg35774 = msg("33992", dup321); + +var msg35775 = msg("33993", dup321); + +var msg35776 = msg("33994", dup321); + +var msg35777 = msg("33995", dup321); + +var msg35778 = msg("33996", dup321); + +var msg35779 = msg("33997", dup321); + +var msg35780 = msg("33998", dup311); + +var msg35781 = msg("33999", dup311); + +var msg35782 = msg("34000", dup311); + +var msg35783 = msg("34001", dup321); + +var msg35784 = msg("34002", dup321); + +var msg35785 = msg("34003", dup321); + +var msg35786 = msg("34004", dup325); + +var msg35787 = msg("34005", dup325); + +var msg35788 = msg("34006", dup325); + +var msg35789 = msg("34007", dup325); + +var msg35790 = msg("34008", dup325); + +var msg35791 = msg("34009", dup325); + +var msg35792 = msg("34010", dup325); + +var msg35793 = msg("34011", dup325); + +var msg35794 = msg("34012", dup325); + +var msg35795 = msg("34013", dup321); + +var msg35796 = msg("34014", dup314); + +var msg35797 = msg("34015", dup314); + +var msg35798 = msg("34016", dup314); + +var msg35799 = msg("34017", dup314); + +var msg35800 = msg("34018", dup316); + +var msg35801 = msg("34019", dup316); + +var msg35802 = msg("34020", dup311); + +var msg35803 = msg("34021", dup311); + +var msg35804 = msg("34022", dup323); + +var msg35805 = msg("34023", dup323); + +var msg35806 = msg("34024", dup314); + +var msg35807 = msg("34025", dup321); + +var msg35808 = msg("34026", dup321); + +var msg35809 = msg("34027", dup309); + +var msg35810 = msg("34028", dup321); + +var msg35811 = msg("34029", dup321); + +var msg35812 = msg("34030", dup321); + +var msg35813 = msg("34031", dup321); + +var msg35814 = msg("34032", dup321); + +var msg35815 = msg("34033", dup321); + +var msg35816 = msg("34034", dup321); + +var msg35817 = msg("34035", dup321); + +var msg35818 = msg("34036", dup321); + +var msg35819 = msg("34037", dup321); + +var msg35820 = msg("34038", dup321); + +var msg35821 = msg("34039", dup321); + +var msg35822 = msg("34040", dup321); + +var msg35823 = msg("34041", dup321); + +var msg35824 = msg("34042", dup321); + +var msg35825 = msg("34043", dup321); + +var msg35826 = msg("34044", dup321); + +var msg35827 = msg("34045", dup321); + +var msg35828 = msg("34046", dup325); + +var msg35829 = msg("34047", dup321); + +var msg35830 = msg("34048", dup324); + +var msg35831 = msg("34049", dup321); + +var msg35832 = msg("34050", dup321); + +var msg35833 = msg("34051", dup324); + +var msg35834 = msg("34052", dup321); + +var msg35835 = msg("34053", dup314); + +var msg35836 = msg("34054", dup314); + +var msg35837 = msg("34055", dup314); + +var msg35838 = msg("34056", dup314); + +var msg35839 = msg("34057", dup309); + +var msg35840 = msg("34058", dup309); + +var msg35841 = msg("34059", dup325); + +var msg35842 = msg("34060", dup325); + +var msg35843 = msg("34061", dup309); + +var msg35844 = msg("34062", dup309); + +var msg35845 = msg("34063", dup309); + +var msg35846 = msg("34064", dup325); + +var msg35847 = msg("34065", dup325); + +var msg35848 = msg("34066", dup309); + +var msg35849 = msg("34067", dup309); + +var msg35850 = msg("34068", dup325); + +var msg35851 = msg("34069", dup325); + +var msg35852 = msg("34070", dup325); + +var msg35853 = msg("34071", dup325); + +var msg35854 = msg("34072", dup325); + +var msg35855 = msg("34073", dup325); + +var msg35856 = msg("34074", dup325); + +var msg35857 = msg("34075", dup325); + +var msg35858 = msg("34076", dup325); + +var msg35859 = msg("34077", dup325); + +var msg35860 = msg("34078", dup311); + +var msg35861 = msg("34079", dup311); + +var msg35862 = msg("34080", dup311); + +var msg35863 = msg("34081", dup311); + +var msg35864 = msg("34082", dup311); + +var msg35865 = msg("34083", dup311); + +var msg35866 = msg("34084", dup325); + +var msg35867 = msg("34085", dup325); + +var msg35868 = msg("34086", dup309); + +var msg35869 = msg("34087", dup309); + +var msg35870 = msg("34088", dup314); + +var msg35871 = msg("34089", dup325); + +var msg35872 = msg("34090", dup325); + +var msg35873 = msg("34091", dup311); + +var msg35874 = msg("34092", dup311); + +var msg35875 = msg("34093", dup309); + +var msg35876 = msg("34094", dup309); + +var msg35877 = msg("34095", dup314); + +var msg35878 = msg("34096", dup314); + +var msg35879 = msg("34097", dup311); + +var msg35880 = msg("34098", dup311); + +var msg35881 = msg("34099", dup314); + +var msg35882 = msg("34100", dup309); + +var msg35883 = msg("34101", dup309); + +var msg35884 = msg("34102", dup309); + +var msg35885 = msg("34103", dup309); + +var msg35886 = msg("34104", dup314); + +var msg35887 = msg("34105", dup314); + +var msg35888 = msg("34106", dup314); + +var msg35889 = msg("34107", dup321); + +var msg35890 = msg("34108", dup321); + +var msg35891 = msg("34109", dup307); + +var msg35892 = msg("34110", dup307); + +var msg35893 = msg("34111", dup321); + +var msg35894 = msg("34112", dup324); + +var msg35895 = msg("34113", dup321); + +var msg35896 = msg("34114", dup324); + +var msg35897 = msg("34115", dup321); + +var msg35898 = msg("34116", dup321); + +var msg35899 = msg("34117", dup321); + +var msg35900 = msg("34118", dup323); + +var msg35901 = msg("34119", dup321); + +var msg35902 = msg("34120", dup321); + +var msg35903 = msg("34121", dup321); + +var msg35904 = msg("34122", dup321); + +var msg35905 = msg("34123", dup314); + +var msg35906 = msg("34124", dup314); + +var msg35907 = msg("34125", dup321); + +var msg35908 = msg("34126", dup321); + +var msg35909 = msg("34127", dup321); + +var msg35910 = msg("34128", dup321); + +var msg35911 = msg("34129", dup321); + +var msg35912 = msg("34130", dup321); + +var msg35913 = msg("34131", dup309); + +var msg35914 = msg("34132", dup321); + +var msg35915 = msg("34133", dup309); + +var msg35916 = msg("34134", dup309); + +var msg35917 = msg("34135", dup314); + +var msg35918 = msg("34136", dup328); + +var msg35919 = msg("34137", dup321); + +var msg35920 = msg("34138", dup321); + +var msg35921 = msg("34139", dup314); + +var msg35922 = msg("34140", dup321); + +var msg35923 = msg("34141", dup309); + +var msg35924 = msg("34142", dup309); + +var msg35925 = msg("34143", dup321); + +var msg35926 = msg("34144", dup321); + +var msg35927 = msg("34145", dup321); + +var msg35928 = msg("34146", dup321); + +var msg35929 = msg("34147", dup314); + +var msg35930 = msg("34148", dup314); + +var msg35931 = msg("34149", dup314); + +var msg35932 = msg("34150", dup314); + +var msg35933 = msg("34151", dup314); + +var msg35934 = msg("34152", dup314); + +var msg35935 = msg("34153", dup314); + +var msg35936 = msg("34154", dup314); + +var msg35937 = msg("34155", dup321); + +var msg35938 = msg("34156", dup311); + +var msg35939 = msg("34157", dup311); + +var msg35940 = msg("34158", dup311); + +var msg35941 = msg("34159", dup311); + +var msg35942 = msg("34160", dup324); + +var msg35943 = msg("34161", dup321); + +var msg35944 = msg("34162", dup309); + +var msg35945 = msg("34163", dup309); + +var msg35946 = msg("34164", dup309); + +var msg35947 = msg("34165", dup309); + +var msg35948 = msg("34166", dup314); + +var msg35949 = msg("34167", dup314); + +var msg35950 = msg("34168", dup314); + +var msg35951 = msg("34169", dup314); + +var msg35952 = msg("34170", dup311); + +var msg35953 = msg("34171", dup311); + +var msg35954 = msg("34172", dup314); + +var msg35955 = msg("34173", dup314); + +var msg35956 = msg("34174", dup314); + +var msg35957 = msg("34175", dup314); + +var msg35958 = msg("34176", dup314); + +var msg35959 = msg("34177", dup314); + +var msg35960 = msg("34178", dup314); + +var msg35961 = msg("34179", dup314); + +var msg35962 = msg("34180", dup311); + +var msg35963 = msg("34181", dup321); + +var msg35964 = msg("34182", dup321); + +var msg35965 = msg("34183", dup321); + +var msg35966 = msg("34184", dup311); + +var msg35967 = msg("34185", dup311); + +var msg35968 = msg("34186", dup311); + +var msg35969 = msg("34187", dup311); + +var msg35970 = msg("34188", dup311); + +var msg35971 = msg("34189", dup311); + +var msg35972 = msg("34190", dup314); + +var msg35973 = msg("34191", dup314); + +var msg35974 = msg("34192", dup314); + +var msg35975 = msg("34193", dup314); + +var msg35976 = msg("34194", dup314); + +var msg35977 = msg("34195", dup325); + +var msg35978 = msg("34196", dup325); + +var msg35979 = msg("34197", dup325); + +var msg35980 = msg("34198", dup325); + +var msg35981 = msg("34199", dup325); + +var msg35982 = msg("34200", dup325); + +var msg35983 = msg("34201", dup325); + +var msg35984 = msg("34202", dup325); + +var msg35985 = msg("34203", dup325); + +var msg35986 = msg("34204", dup325); + +var msg35987 = msg("34205", dup325); + +var msg35988 = msg("34206", dup325); + +var msg35989 = msg("34207", dup325); + +var msg35990 = msg("34208", dup325); + +var msg35991 = msg("34209", dup325); + +var msg35992 = msg("34210", dup325); + +var msg35993 = msg("34211", dup325); + +var msg35994 = msg("34212", dup325); + +var msg35995 = msg("34213", dup324); + +var msg35996 = msg("34214", dup321); + +var msg35997 = msg("34215", dup311); + +var msg35998 = msg("34216", dup321); + +var msg35999 = msg("34217", dup321); + +var msg36000 = msg("34218", dup321); + +var msg36001 = msg("34219", dup321); + +var msg36002 = msg("34220", dup316); + +var msg36003 = msg("34221", dup316); + +var msg36004 = msg("34222", dup316); + +var msg36005 = msg("34223", dup321); + +var msg36006 = msg("34224", dup316); + +var msg36007 = msg("34225", dup333); + +var msg36008 = msg("34226", dup323); + +var msg36009 = msg("34227", dup323); + +var msg36010 = msg("34228", dup311); + +var msg36011 = msg("34229", dup311); + +var msg36012 = msg("34230", dup311); + +var msg36013 = msg("34231", dup311); + +var msg36014 = msg("34232", dup314); + +var msg36015 = msg("34233", dup314); + +var msg36016 = msg("34234", dup314); + +var msg36017 = msg("34235", dup314); + +var msg36018 = msg("34236", dup321); + +var msg36019 = msg("34237", dup321); + +var msg36020 = msg("34238", dup307); + +var msg36021 = msg("34239", dup307); + +var msg36022 = msg("34240", dup314); + +var msg36023 = msg("34241", dup314); + +var msg36024 = msg("34242", dup314); + +var msg36025 = msg("34243", dup314); + +var msg36026 = msg("34244", dup314); + +var msg36027 = msg("34245", dup314); + +var msg36028 = msg("34246", dup321); + +var msg36029 = msg("34247", dup314); + +var msg36030 = msg("34248", dup314); + +var msg36031 = msg("34249", dup314); + +var msg36032 = msg("34250", dup314); + +var msg36033 = msg("34251", dup324); + +var msg36034 = msg("34252", dup324); + +var msg36035 = msg("34253", dup324); + +var msg36036 = msg("34254", dup324); + +var msg36037 = msg("34255", dup314); + +var msg36038 = msg("34256", dup314); + +var msg36039 = msg("34257", dup314); + +var msg36040 = msg("34258", dup314); + +var msg36041 = msg("34259", dup314); + +var msg36042 = msg("34260", dup314); + +var msg36043 = msg("34261", dup324); + +var msg36044 = msg("34262", dup324); + +var msg36045 = msg("34263", dup324); + +var msg36046 = msg("34264", dup309); + +var msg36047 = msg("34265", dup309); + +var msg36048 = msg("34266", dup309); + +var msg36049 = msg("34267", dup309); + +var msg36050 = msg("34268", dup309); + +var msg36051 = msg("34269", dup309); + +var msg36052 = msg("34270", dup309); + +var msg36053 = msg("34271", dup309); + +var msg36054 = msg("34272", dup314); + +var msg36055 = msg("34273", dup314); + +var msg36056 = msg("34274", dup314); + +var msg36057 = msg("34275", dup314); + +var msg36058 = msg("34276", dup309); + +var msg36059 = msg("34277", dup309); + +var msg36060 = msg("34278", dup309); + +var msg36061 = msg("34279", dup309); + +var msg36062 = msg("34280", dup321); + +var msg36063 = msg("34281", dup321); + +var msg36064 = msg("34282", dup321); + +var msg36065 = msg("34283", dup321); + +var msg36066 = msg("34284", dup311); + +var msg36067 = msg("34285", dup311); + +var msg36068 = msg("34286", dup321); + +var msg36069 = msg("34287", dup314); + +var msg36070 = msg("34288", dup324); + +var msg36071 = msg("34289", dup321); + +var msg36072 = msg("34290", dup321); + +var msg36073 = msg("34291", dup325); + +var msg36074 = msg("34292", dup321); + +var msg36075 = msg("34293", dup309); + +var msg36076 = msg("34294", dup309); + +var msg36077 = msg("34295", dup322); + +var msg36078 = msg("34296", dup321); + +var msg36079 = msg("34297", dup321); + +var msg36080 = msg("34298", dup314); + +var msg36081 = msg("34299", dup325); + +var msg36082 = msg("34300", dup307); + +var msg36083 = msg("34301", dup314); + +var msg36084 = msg("34302", dup311); + +var msg36085 = msg("34303", dup311); + +var msg36086 = msg("34304", dup311); + +var msg36087 = msg("34305", dup311); + +var msg36088 = msg("34306", dup310); + +var msg36089 = msg("34307", dup321); + +var msg36090 = msg("34308", dup321); + +var msg36091 = msg("34309", dup321); + +var msg36092 = msg("34310", dup321); + +var msg36093 = msg("34311", dup321); + +var msg36094 = msg("34312", dup321); + +var msg36095 = msg("34313", dup321); + +var msg36096 = msg("34314", dup321); + +var msg36097 = msg("34315", dup321); + +var msg36098 = msg("34316", dup321); + +var msg36099 = msg("34317", dup321); + +var msg36100 = msg("34318", dup321); + +var msg36101 = msg("34319", dup321); + +var msg36102 = msg("34320", dup325); + +var msg36103 = msg("34321", dup325); + +var msg36104 = msg("34322", dup321); + +var msg36105 = msg("34323", dup321); + +var msg36106 = msg("34324", dup321); + +var msg36107 = msg("34325", dup321); + +var msg36108 = msg("34326", dup321); + +var msg36109 = msg("34327", dup321); + +var msg36110 = msg("34328", dup314); + +var msg36111 = msg("34329", dup321); + +var msg36112 = msg("34330", dup311); + +var msg36113 = msg("34331", dup311); + +var msg36114 = msg("34332", dup311); + +var msg36115 = msg("34333", dup311); + +var msg36116 = msg("34334", dup311); + +var msg36117 = msg("34335", dup311); + +var msg36118 = msg("34336", dup321); + +var msg36119 = msg("34337", dup321); + +var msg36120 = msg("34338", dup321); + +var msg36121 = msg("34339", dup321); + +var msg36122 = msg("34340", dup314); + +var msg36123 = msg("34341", dup314); + +var msg36124 = msg("34342", dup314); + +var msg36125 = msg("34343", dup309); + +var msg36126 = msg("34344", dup309); + +var msg36127 = msg("34345", dup314); + +var msg36128 = msg("34346", dup321); + +var msg36129 = msg("34347", dup321); + +var msg36130 = msg("34348", dup311); + +var msg36131 = msg("34349", dup309); + +var msg36132 = msg("34350", dup309); + +var msg36133 = msg("34351", dup309); + +var msg36134 = msg("34352", dup309); + +var msg36135 = msg("34353", dup309); + +var msg36136 = msg("34354", dup311); + +var msg36137 = msg("34355", dup311); + +var msg36138 = msg("34356", dup311); + +var msg36139 = msg("34357", dup311); + +var msg36140 = msg("34358", dup311); + +var msg36141 = msg("34359", dup314); + +var msg36142 = msg("34360", dup314); + +var msg36143 = msg("34361", dup314); + +var msg36144 = msg("34362", dup321); + +var msg36145 = msg("34363", dup322); + +var msg36146 = msg("34364", dup314); + +var msg36147 = msg("34365", dup311); + +var msg36148 = msg("34366", dup321); + +var msg36149 = msg("34367", dup321); + +var msg36150 = msg("34368", dup321); + +var msg36151 = msg("34369", dup316); + +var msg36152 = msg("34370", dup321); + +var msg36153 = msg("34371", dup311); + +var msg36154 = msg("34372", dup311); + +var msg36155 = msg("34373", dup307); + +var msg36156 = msg("34374", dup307); + +var msg36157 = msg("34375", dup307); + +var msg36158 = msg("34376", dup307); + +var msg36159 = msg("34377", dup314); + +var msg36160 = msg("34378", dup314); + +var msg36161 = msg("34379", dup325); + +var msg36162 = msg("34380", dup325); + +var msg36163 = msg("34381", dup325); + +var msg36164 = msg("34382", dup325); + +var msg36165 = msg("34383", dup311); + +var msg36166 = msg("34384", dup311); + +var msg36167 = msg("34385", dup311); + +var msg36168 = msg("34386", dup311); + +var msg36169 = msg("34387", dup314); + +var msg36170 = msg("34388", dup314); + +var msg36171 = msg("34389", dup314); + +var msg36172 = msg("34390", dup314); + +var msg36173 = msg("34391", dup325); + +var msg36174 = msg("34392", dup325); + +var msg36175 = msg("34393", dup323); + +var msg36176 = msg("34394", dup323); + +var msg36177 = msg("34395", dup314); + +var msg36178 = msg("34396", dup314); + +var msg36179 = msg("34397", dup314); + +var msg36180 = msg("34398", dup314); + +var msg36181 = msg("34399", dup311); + +var msg36182 = msg("34400", dup311); + +var msg36183 = msg("34401", dup311); + +var msg36184 = msg("34402", dup311); + +var msg36185 = msg("34403", dup314); + +var msg36186 = msg("34404", dup314); + +var msg36187 = msg("34405", dup325); + +var msg36188 = msg("34406", dup325); + +var msg36189 = msg("34407", dup325); + +var msg36190 = msg("34408", dup325); + +var msg36191 = msg("34409", dup325); + +var msg36192 = msg("34410", dup325); + +var msg36193 = msg("34411", dup325); + +var msg36194 = msg("34412", dup325); + +var msg36195 = msg("34413", dup314); + +var msg36196 = msg("34414", dup314); + +var msg36197 = msg("34415", dup325); + +var msg36198 = msg("34416", dup325); + +var msg36199 = msg("34417", dup325); + +var msg36200 = msg("34418", dup325); + +var msg36201 = msg("34419", dup325); + +var msg36202 = msg("34420", dup325); + +var msg36203 = msg("34421", dup325); + +var msg36204 = msg("34422", dup325); + +var msg36205 = msg("34423", dup325); + +var msg36206 = msg("34424", dup325); + +var msg36207 = msg("34425", dup325); + +var msg36208 = msg("34426", dup314); + +var msg36209 = msg("34427", dup314); + +var msg36210 = msg("34428", dup309); + +var msg36211 = msg("34429", dup309); + +var msg36212 = msg("34430", dup325); + +var msg36213 = msg("34431", dup325); + +var msg36214 = msg("34432", dup325); + +var msg36215 = msg("34433", dup325); + +var msg36216 = msg("34434", dup324); + +var msg36217 = msg("34435", dup324); + +var msg36218 = msg("34436", dup325); + +var msg36219 = msg("34437", dup325); + +var msg36220 = msg("34438", dup309); + +var msg36221 = msg("34439", dup309); + +var msg36222 = msg("34440", dup314); + +var msg36223 = msg("34441", dup314); + +var msg36224 = msg("34442", dup314); + +var msg36225 = msg("34443", dup314); + +var msg36226 = msg("34444", dup325); + +var msg36227 = msg("34445", dup325); + +var msg36228 = msg("34446", dup321); + +var msg36229 = msg("34447", dup333); + +var msg36230 = msg("34448", dup314); + +var msg36231 = msg("34449", dup314); + +var msg36232 = msg("34450", dup314); + +var msg36233 = msg("34451", dup314); + +var msg36234 = msg("34452", dup321); + +var msg36235 = msg("34453", dup321); + +var msg36236 = msg("34454", dup314); + +var msg36237 = msg("34455", dup314); + +var msg36238 = msg("34456", dup314); + +var msg36239 = msg("34457", dup314); + +var msg36240 = msg("34458", dup321); + +var msg36241 = msg("34459", dup321); + +var msg36242 = msg("34460", dup321); + +var msg36243 = msg("34461", dup321); + +var msg36244 = msg("34462", dup321); + +var msg36245 = msg("34463", dup314); + +var msg36246 = msg("34464", dup311); + +var msg36247 = msg("34465", dup325); + +var msg36248 = msg("34466", dup311); + +var msg36249 = msg("34467", dup311); + +var msg36250 = msg("34468", dup321); + +var msg36251 = msg("34469", dup321); + +var msg36252 = msg("34470", dup321); + +var msg36253 = msg("34471", dup314); + +var msg36254 = msg("34472", dup322); + +var msg36255 = msg("34473", dup314); + +var msg36256 = msg("34474", dup314); + +var all63 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup87, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg36257 = msg("34475", all63); + +var msg36258 = msg("34476", dup323); + +var msg36259 = msg("34477", dup314); + +var msg36260 = msg("34478", dup314); + +var msg36261 = msg("34479", dup311); + +var msg36262 = msg("34480", dup311); + +var msg36263 = msg("34481", dup309); + +var msg36264 = msg("34482", dup309); + +var msg36265 = msg("34483", dup309); + +var msg36266 = msg("34484", dup309); + +var msg36267 = msg("34485", dup309); + +var msg36268 = msg("34486", dup309); + +var msg36269 = msg("34487", dup309); + +var msg36270 = msg("34488", dup309); + +var msg36271 = msg("34489", dup321); + +var msg36272 = msg("34490", dup321); + +var msg36273 = msg("34491", dup321); + +var msg36274 = msg("34492", dup314); + +var msg36275 = msg("34493", dup314); + +var msg36276 = msg("34494", dup314); + +var msg36277 = msg("34495", dup314); + +var msg36278 = msg("34496", dup327); + +var msg36279 = msg("34497", dup327); + +var msg36280 = msg("34498", dup314); + +var msg36281 = msg("34499", dup314); + +var msg36282 = msg("34500", dup321); + +var msg36283 = msg("34501", dup321); + +var msg36284 = msg("34502", dup311); + +var msg36285 = msg("34503", dup311); + +var msg36286 = msg("34504", dup311); + +var msg36287 = msg("34505", dup311); + +var msg36288 = msg("34506", dup311); + +var msg36289 = msg("34507", dup311); + +var msg36290 = msg("34508", dup311); + +var msg36291 = msg("34509", dup311); + +var msg36292 = msg("34510", dup311); + +var msg36293 = msg("34511", dup311); + +var msg36294 = msg("34512", dup311); + +var msg36295 = msg("34513", dup311); + +var msg36296 = msg("34514", dup314); + +var msg36297 = msg("34515", dup314); + +var msg36298 = msg("34516", dup314); + +var msg36299 = msg("34517", dup314); + +var msg36300 = msg("34518", dup311); + +var msg36301 = msg("34519", dup311); + +var msg36302 = msg("34520", dup311); + +var msg36303 = msg("34521", dup311); + +var msg36304 = msg("34522", dup311); + +var msg36305 = msg("34523", dup311); + +var msg36306 = msg("34524", dup311); + +var msg36307 = msg("34525", dup311); + +var msg36308 = msg("34526", dup311); + +var msg36309 = msg("34527", dup311); + +var msg36310 = msg("34528", dup314); + +var msg36311 = msg("34529", dup314); + +var msg36312 = msg("34530", dup323); + +var msg36313 = msg("34531", dup323); + +var msg36314 = msg("34532", dup325); + +var msg36315 = msg("34533", dup325); + +var msg36316 = msg("34534", dup314); + +var msg36317 = msg("34535", dup314); + +var msg36318 = msg("34536", dup314); + +var msg36319 = msg("34537", dup314); + +var msg36320 = msg("34538", dup314); + +var msg36321 = msg("34539", dup314); + +var msg36322 = msg("34540", dup321); + +var msg36323 = msg("34541", dup321); + +var msg36324 = msg("34542", dup314); + +var msg36325 = msg("34543", dup314); + +var msg36326 = msg("34544", dup314); + +var msg36327 = msg("34545", dup314); + +var msg36328 = msg("34546", dup314); + +var msg36329 = msg("34547", dup314); + +var msg36330 = msg("34548", dup314); + +var msg36331 = msg("34549", dup314); + +var msg36332 = msg("34550", dup307); + +var msg36333 = msg("34551", dup307); + +var msg36334 = msg("34552", dup311); + +var msg36335 = msg("34553", dup309); + +var msg36336 = msg("34554", dup309); + +var msg36337 = msg("34555", dup309); + +var msg36338 = msg("34556", dup309); + +var msg36339 = msg("34557", dup307); + +var msg36340 = msg("34558", dup307); + +var msg36341 = msg("34559", dup314); + +var msg36342 = msg("34560", dup314); + +var msg36343 = msg("34561", dup311); + +var msg36344 = msg("34562", dup311); + +var msg36345 = msg("34563", dup311); + +var msg36346 = msg("34564", dup311); + +var msg36347 = msg("34565", dup311); + +var msg36348 = msg("34566", dup309); + +var msg36349 = msg("34567", dup321); + +var msg36350 = msg("34568", dup314); + +var msg36351 = msg("34569", dup314); + +var msg36352 = msg("34570", dup321); + +var msg36353 = msg("34571", dup321); + +var msg36354 = msg("34572", dup321); + +var msg36355 = msg("34573", dup314); + +var msg36356 = msg("34574", dup314); + +var msg36357 = msg("34575", dup314); + +var msg36358 = msg("34576", dup314); + +var msg36359 = msg("34577", dup314); + +var msg36360 = msg("34578", dup314); + +var msg36361 = msg("34579", dup314); + +var msg36362 = msg("34580", dup314); + +var msg36363 = msg("34581", dup321); + +var msg36364 = msg("34582", dup314); + +var msg36365 = msg("34583", dup314); + +var msg36366 = msg("34584", dup314); + +var msg36367 = msg("34585", dup314); + +var msg36368 = msg("34586", dup314); + +var msg36369 = msg("34587", dup314); + +var msg36370 = msg("34588", dup314); + +var msg36371 = msg("34589", dup314); + +var msg36372 = msg("34590", dup314); + +var msg36373 = msg("34591", dup314); + +var msg36374 = msg("34592", dup314); + +var msg36375 = msg("34593", dup314); + +var msg36376 = msg("34594", dup314); + +var msg36377 = msg("34595", dup314); + +var msg36378 = msg("34596", dup339); + +var msg36379 = msg("34597", dup339); + +var msg36380 = msg("34598", dup339); + +var msg36381 = msg("34599", dup339); + +var msg36382 = msg("34600", dup339); + +var msg36383 = msg("34601", dup339); + +var msg36384 = msg("34602", dup340); + +var msg36385 = msg("34603", dup341); + +var msg36386 = msg("34604", dup340); + +var msg36387 = msg("34605", dup340); + +var msg36388 = msg("34606", dup340); + +var msg36389 = msg("34607", dup342); + +var msg36390 = msg("34608", dup339); + +var msg36391 = msg("34609", dup339); + +var msg36392 = msg("34610", dup339); + +var msg36393 = msg("34611", dup339); + +var msg36394 = msg("34612", dup343); + +var msg36395 = msg("34613", dup343); + +var msg36396 = msg("34614", dup339); + +var msg36397 = msg("34615", dup344); + +var msg36398 = msg("34616", dup344); + +var msg36399 = msg("34617", dup344); + +var msg36400 = msg("34618", dup344); + +var msg36401 = msg("34619", dup340); + +var msg36402 = msg("34620", dup340); + +var msg36403 = msg("34621", dup340); + +var msg36404 = msg("34622", dup339); + +var msg36405 = msg("34623", dup341); + +var msg36406 = msg("34624", dup339); + +var msg36407 = msg("34625", dup343); + +var msg36408 = msg("34626", dup343); + +var msg36409 = msg("34627", dup343); + +var msg36410 = msg("34628", dup343); + +var msg36411 = msg("34629", dup340); + +var msg36412 = msg("34630", dup340); + +var msg36413 = msg("34631", dup340); + +var msg36414 = msg("34632", dup341); + +var msg36415 = msg("34633", dup340); + +var msg36416 = msg("34634", dup340); + +var msg36417 = msg("34635", dup340); + +var msg36418 = msg("34636", dup339); + +var msg36419 = msg("34637", dup339); + +var msg36420 = msg("34638", dup340); + +var msg36421 = msg("34639", dup340); + +var msg36422 = msg("34640", dup340); + +var msg36423 = msg("34641", dup345); + +var msg36424 = msg("34642", dup345); + +var msg36425 = msg("34643", dup340); + +var msg36426 = msg("34644", dup340); + +var msg36427 = msg("34645", dup341); + +var msg36428 = msg("34646", dup346); + +var msg36429 = msg("34647", dup346); + +var msg36430 = msg("34648", dup346); + +var msg36431 = msg("34649", dup345); + +var msg36432 = msg("34650", dup341); + +var msg36433 = msg("34651", dup341); + +var msg36434 = msg("34652", dup340); + +var msg36435 = msg("34653", dup340); + +var msg36436 = msg("34654", dup339); + +var msg36437 = msg("34655", dup339); + +var msg36438 = msg("34656", dup339); + +var msg36439 = msg("34657", dup339); + +var msg36440 = msg("34658", dup339); + +var msg36441 = msg("34659", dup339); + +var msg36442 = msg("34660", dup339); + +var msg36443 = msg("34661", dup339); + +var msg36444 = msg("34662", dup339); + +var msg36445 = msg("34663", dup339); + +var msg36446 = msg("34664", dup339); + +var msg36447 = msg("34665", dup339); + +var msg36448 = msg("34666", dup339); + +var msg36449 = msg("34667", dup339); + +var msg36450 = msg("34668", dup339); + +var msg36451 = msg("34669", dup339); + +var msg36452 = msg("34670", dup339); + +var msg36453 = msg("34671", dup339); + +var msg36454 = msg("34672", dup339); + +var msg36455 = msg("34673", dup339); + +var msg36456 = msg("34674", dup339); + +var msg36457 = msg("34675", dup339); + +var msg36458 = msg("34676", dup339); + +var msg36459 = msg("34677", dup339); + +var msg36460 = msg("34678", dup339); + +var msg36461 = msg("34679", dup339); + +var msg36462 = msg("34680", dup339); + +var msg36463 = msg("34681", dup339); + +var msg36464 = msg("34682", dup339); + +var msg36465 = msg("34683", dup339); + +var msg36466 = msg("34684", dup339); + +var msg36467 = msg("34685", dup339); + +var msg36468 = msg("34686", dup339); + +var msg36469 = msg("34687", dup339); + +var msg36470 = msg("34688", dup339); + +var msg36471 = msg("34689", dup339); + +var msg36472 = msg("34690", dup339); + +var msg36473 = msg("34691", dup339); + +var msg36474 = msg("34692", dup339); + +var msg36475 = msg("34693", dup339); + +var msg36476 = msg("34694", dup339); + +var msg36477 = msg("34695", dup339); + +var msg36478 = msg("34696", dup339); + +var msg36479 = msg("34697", dup339); + +var msg36480 = msg("34698", dup339); + +var msg36481 = msg("34699", dup339); + +var msg36482 = msg("34700", dup339); + +var msg36483 = msg("34701", dup339); + +var msg36484 = msg("34702", dup339); + +var msg36485 = msg("34703", dup339); + +var msg36486 = msg("34704", dup339); + +var msg36487 = msg("34705", dup339); + +var msg36488 = msg("34706", dup339); + +var msg36489 = msg("34707", dup339); + +var msg36490 = msg("34708", dup339); + +var msg36491 = msg("34709", dup345); + +var msg36492 = msg("34710", dup347); + +var msg36493 = msg("34711", dup339); + +var msg36494 = msg("34712", dup339); + +var msg36495 = msg("34713", dup339); + +var msg36496 = msg("34714", dup341); + +var msg36497 = msg("34715", dup341); + +var msg36498 = msg("34716", dup340); + +var msg36499 = msg("34717", dup340); + +var msg36500 = msg("34718", dup340); + +var msg36501 = msg("34719", dup347); + +var msg36502 = msg("34720", dup347); + +var msg36503 = msg("34721", dup342); + +var msg36504 = msg("34722", dup342); + +var msg36505 = msg("34723", dup342); + +var msg36506 = msg("34724", dup342); + +var msg36507 = msg("34725", dup342); + +var msg36508 = msg("34726", dup342); + +var msg36509 = msg("34727", dup342); + +var msg36510 = msg("34728", dup342); + +var msg36511 = msg("34729", dup347); + +var msg36512 = msg("34730", dup347); + +var msg36513 = msg("34731", dup341); + +var msg36514 = msg("34732", dup341); + +var msg36515 = msg("34733", dup342); + +var msg36516 = msg("34734", dup342); + +var msg36517 = msg("34735", dup342); + +var msg36518 = msg("34736", dup342); + +var msg36519 = msg("34737", dup341); + +var msg36520 = msg("34738", dup341); + +var msg36521 = msg("34739", dup341); + +var msg36522 = msg("34740", dup341); + +var msg36523 = msg("34741", dup340); + +var msg36524 = msg("34742", dup340); + +var msg36525 = msg("34743", dup341); + +var msg36526 = msg("34744", dup341); + +var msg36527 = msg("34745", dup342); + +var msg36528 = msg("34746", dup342); + +var msg36529 = msg("34747", dup342); + +var msg36530 = msg("34748", dup342); + +var msg36531 = msg("34749", dup342); + +var msg36532 = msg("34750", dup342); + +var msg36533 = msg("34751", dup342); + +var msg36534 = msg("34752", dup342); + +var msg36535 = msg("34753", dup342); + +var msg36536 = msg("34754", dup342); + +var msg36537 = msg("34755", dup347); + +var msg36538 = msg("34756", dup347); + +var msg36539 = msg("34757", dup347); + +var msg36540 = msg("34758", dup347); + +var msg36541 = msg("34759", dup342); + +var msg36542 = msg("34760", dup342); + +var msg36543 = msg("34761", dup343); + +var msg36544 = msg("34762", dup343); + +var msg36545 = msg("34763", dup341); + +var msg36546 = msg("34764", dup341); + +var msg36547 = msg("34765", dup342); + +var msg36548 = msg("34766", dup342); + +var msg36549 = msg("34767", dup342); + +var msg36550 = msg("34768", dup342); + +var msg36551 = msg("34769", dup347); + +var msg36552 = msg("34770", dup340); + +var msg36553 = msg("34771", dup340); + +var msg36554 = msg("34772", dup342); + +var msg36555 = msg("34773", dup342); + +var msg36556 = msg("34774", dup347); + +var msg36557 = msg("34775", dup347); + +var msg36558 = msg("34776", dup340); + +var msg36559 = msg("34777", dup340); + +var msg36560 = msg("34778", dup342); + +var msg36561 = msg("34779", dup342); + +var msg36562 = msg("34780", dup347); + +var msg36563 = msg("34781", dup347); + +var msg36564 = msg("34782", dup340); + +var msg36565 = msg("34783", dup340); + +var msg36566 = msg("34784", dup340); + +var msg36567 = msg("34785", dup340); + +var msg36568 = msg("34786", dup347); + +var msg36569 = msg("34787", dup347); + +var msg36570 = msg("34788", dup340); + +var msg36571 = msg("34789", dup340); + +var msg36572 = msg("34790", dup342); + +var msg36573 = msg("34791", dup342); + +var msg36574 = msg("34792", dup340); + +var msg36575 = msg("34793", dup340); + +var msg36576 = msg("34794", dup347); + +var msg36577 = msg("34795", dup347); + +var msg36578 = msg("34796", dup347); + +var msg36579 = msg("34797", dup347); + +var msg36580 = msg("34798", dup341); + +var msg36581 = msg("34799", dup348); + +var msg36582 = msg("34800", dup346); + +var msg36583 = msg("34801", dup346); + +var msg36584 = msg("34802", dup345); + +var msg36585 = msg("34803", dup340); + +var msg36586 = msg("34804", dup340); + +var msg36587 = msg("34805", dup340); + +var msg36588 = msg("34806", dup340); + +var msg36589 = msg("34807", dup347); + +var msg36590 = msg("34808", dup347); + +var msg36591 = msg("34809", dup347); + +var msg36592 = msg("34810", dup347); + +var msg36593 = msg("34811", dup340); + +var msg36594 = msg("34812", dup340); + +var msg36595 = msg("34813", dup340); + +var msg36596 = msg("34814", dup340); + +var msg36597 = msg("34815", dup340); + +var msg36598 = msg("34816", dup347); + +var msg36599 = msg("34817", dup347); + +var msg36600 = msg("34818", dup339); + +var msg36601 = msg("34819", dup340); + +var msg36602 = msg("34820", dup340); + +var msg36603 = msg("34821", dup340); + +var msg36604 = msg("34822", dup340); + +var msg36605 = msg("34823", dup340); + +var msg36606 = msg("34824", dup342); + +var msg36607 = msg("34825", dup342); + +var msg36608 = msg("34826", dup339); + +var msg36609 = msg("34827", dup339); + +var msg36610 = msg("34828", dup339); + +var msg36611 = msg("34829", dup339); + +var msg36612 = msg("34830", dup339); + +var msg36613 = msg("34831", dup339); + +var msg36614 = msg("34832", dup339); + +var msg36615 = msg("34833", dup339); + +var all64 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg36616 = msg("34834", all64); + +var msg36617 = msg("34835", dup339); + +var msg36618 = msg("34836", dup347); + +var msg36619 = msg("34837", dup347); + +var msg36620 = msg("34838", dup347); + +var msg36621 = msg("34839", dup347); + +var msg36622 = msg("34840", dup347); + +var msg36623 = msg("34841", dup347); + +var msg36624 = msg("34842", dup347); + +var msg36625 = msg("34843", dup342); + +var msg36626 = msg("34844", dup339); + +var msg36627 = msg("34845", dup340); + +var msg36628 = msg("34846", dup340); + +var msg36629 = msg("34847", dup339); + +var msg36630 = msg("34848", dup341); + +var msg36631 = msg("34849", dup341); + +var msg36632 = msg("34850", dup341); + +var msg36633 = msg("34851", dup341); + +var msg36634 = msg("34852", dup339); + +var msg36635 = msg("34853", dup340); + +var msg36636 = msg("34854", dup340); + +var msg36637 = msg("34855", dup340); + +var msg36638 = msg("34856", dup340); + +var msg36639 = msg("34857", dup339); + +var msg36640 = msg("34858", dup340); + +var msg36641 = msg("34859", dup340); + +var msg36642 = msg("34860", dup340); + +var msg36643 = msg("34861", dup340); + +var msg36644 = msg("34862", dup339); + +var msg36645 = msg("34863", dup339); + +var msg36646 = msg("34864", dup340); + +var msg36647 = msg("34865", dup339); + +var msg36648 = msg("34866", dup339); + +var msg36649 = msg("34867", dup339); + +var msg36650 = msg("34868", dup339); + +var msg36651 = msg("34869", dup339); + +var msg36652 = msg("34870", dup339); + +var msg36653 = msg("34871", dup339); + +var msg36654 = msg("34872", dup339); + +var msg36655 = msg("34873", dup342); + +var msg36656 = msg("34874", dup342); + +var msg36657 = msg("34875", dup340); + +var msg36658 = msg("34876", dup339); + +var msg36659 = msg("34877", dup339); + +var msg36660 = msg("34878", dup342); + +var msg36661 = msg("34879", dup342); + +var msg36662 = msg("34880", dup342); + +var msg36663 = msg("34881", dup340); + +var msg36664 = msg("34882", dup340); + +var msg36665 = msg("34883", dup340); + +var msg36666 = msg("34884", dup343); + +var msg36667 = msg("34885", dup343); + +var msg36668 = msg("34886", dup339); + +var msg36669 = msg("34887", dup339); + +var msg36670 = msg("34888", dup339); + +var msg36671 = msg("34889", dup341); + +var msg36672 = msg("34890", dup347); + +var msg36673 = msg("34891", dup347); + +var msg36674 = msg("34892", dup347); + +var msg36675 = msg("34893", dup347); + +var msg36676 = msg("34894", dup347); + +var msg36677 = msg("34895", dup347); + +var msg36678 = msg("34896", dup347); + +var msg36679 = msg("34897", dup347); + +var msg36680 = msg("34898", dup347); + +var msg36681 = msg("34899", dup347); + +var msg36682 = msg("34900", dup347); + +var msg36683 = msg("34901", dup347); + +var msg36684 = msg("34902", dup344); + +var msg36685 = msg("34903", dup347); + +var msg36686 = msg("34904", dup347); + +var msg36687 = msg("34905", dup347); + +var msg36688 = msg("34906", dup347); + +var msg36689 = msg("34907", dup347); + +var msg36690 = msg("34908", dup347); + +var msg36691 = msg("34909", dup344); + +var msg36692 = msg("34910", dup344); + +var msg36693 = msg("34911", dup347); + +var msg36694 = msg("34912", dup347); + +var msg36695 = msg("34913", dup347); + +var msg36696 = msg("34914", dup347); + +var msg36697 = msg("34915", dup349); + +var msg36698 = msg("34916", dup349); + +var msg36699 = msg("34917", dup339); + +var msg36700 = msg("34918", dup340); + +var msg36701 = msg("34919", dup340); + +var msg36702 = msg("34920", dup340); + +var msg36703 = msg("34921", dup340); + +var msg36704 = msg("34922", dup340); + +var msg36705 = msg("34923", dup340); + +var msg36706 = msg("34924", dup341); + +var msg36707 = msg("34925", dup341); + +var msg36708 = msg("34926", dup339); + +var msg36709 = msg("34927", dup339); + +var msg36710 = msg("34928", dup339); + +var msg36711 = msg("34929", dup339); + +var msg36712 = msg("34930", dup339); + +var msg36713 = msg("34931", dup339); + +var msg36714 = msg("34932", dup339); + +var msg36715 = msg("34933", dup347); + +var msg36716 = msg("34934", dup339); + +var msg36717 = msg("34935", dup339); + +var msg36718 = msg("34936", dup339); + +var msg36719 = msg("34937", dup341); + +var msg36720 = msg("34938", dup341); + +var msg36721 = msg("34939", dup341); + +var msg36722 = msg("34940", dup341); + +var msg36723 = msg("34941", dup341); + +var msg36724 = msg("34942", dup341); + +var msg36725 = msg("34943", dup341); + +var msg36726 = msg("34944", dup340); + +var msg36727 = msg("34945", dup339); + +var msg36728 = msg("34946", dup340); + +var msg36729 = msg("34947", dup340); + +var msg36730 = msg("34948", dup347); + +var msg36731 = msg("34949", dup347); + +var msg36732 = msg("34950", dup339); + +var msg36733 = msg("34951", dup340); + +var msg36734 = msg("34952", dup345); + +var msg36735 = msg("34953", dup345); + +var msg36736 = msg("34954", dup345); + +var msg36737 = msg("34955", dup345); + +var msg36738 = msg("34956", dup345); + +var msg36739 = msg("34957", dup339); + +var msg36740 = msg("34958", dup339); + +var msg36741 = msg("34959", dup339); + +var msg36742 = msg("34960", dup340); + +var msg36743 = msg("34961", dup340); + +var msg36744 = msg("34962", dup340); + +var msg36745 = msg("34963", dup339); + +var msg36746 = msg("34964", dup339); + +var msg36747 = msg("34965", dup339); + +var msg36748 = msg("34966", dup339); + +var msg36749 = msg("34967", dup341); + +var msg36750 = msg("34968", dup340); + +var msg36751 = msg("34969", dup347); + +var msg36752 = msg("34970", dup347); + +var msg36753 = msg("34971", dup340); + +var msg36754 = msg("34972", dup340); + +var msg36755 = msg("34973", dup341); + +var msg36756 = msg("34974", dup341); + +var msg36757 = msg("34975", dup341); + +var msg36758 = msg("34976", dup340); + +var msg36759 = msg("34977", dup340); + +var msg36760 = msg("34978", dup340); + +var msg36761 = msg("34979", dup340); + +var msg36762 = msg("34980", dup340); + +var msg36763 = msg("34981", dup340); + +var msg36764 = msg("34982", dup339); + +var msg36765 = msg("34983", dup340); + +var msg36766 = msg("34984", dup341); + +var msg36767 = msg("34985", dup341); + +var msg36768 = msg("34986", dup341); + +var msg36769 = msg("34987", dup341); + +var msg36770 = msg("34988", dup341); + +var msg36771 = msg("34989", dup341); + +var msg36772 = msg("34990", dup347); + +var msg36773 = msg("34991", dup347); + +var msg36774 = msg("34992", dup347); + +var msg36775 = msg("34993", dup339); + +var msg36776 = msg("34994", dup339); + +var msg36777 = msg("34995", dup339); + +var msg36778 = msg("34996", dup339); + +var msg36779 = msg("34997", dup350); + +var msg36780 = msg("34998", dup339); + +var msg36781 = msg("34999", dup346); + +var msg36782 = msg("35000", dup346); + +var msg36783 = msg("35001", dup340); + +var msg36784 = msg("35002", dup340); + +var msg36785 = msg("35003", dup339); + +var msg36786 = msg("35004", dup339); + +var msg36787 = msg("35005", dup339); + +var msg36788 = msg("35006", dup347); + +var msg36789 = msg("35007", dup347); + +var msg36790 = msg("35008", dup347); + +var msg36791 = msg("35009", dup347); + +var msg36792 = msg("35010", dup347); + +var msg36793 = msg("35011", dup347); + +var msg36794 = msg("35012", dup342); + +var msg36795 = msg("35013", dup342); + +var msg36796 = msg("35014", dup346); + +var msg36797 = msg("35015", dup346); + +var msg36798 = msg("35016", dup346); + +var msg36799 = msg("35017", dup346); + +var msg36800 = msg("35018", dup341); + +var msg36801 = msg("35019", dup341); + +var msg36802 = msg("35020", dup341); + +var msg36803 = msg("35021", dup341); + +var msg36804 = msg("35022", dup340); + +var msg36805 = msg("35023", dup340); + +var msg36806 = msg("35024", dup348); + +var msg36807 = msg("35025", dup348); + +var msg36808 = msg("35026", dup348); + +var msg36809 = msg("35027", dup342); + +var msg36810 = msg("35028", dup339); + +var msg36811 = msg("35029", dup339); + +var msg36812 = msg("35030", dup339); + +var msg36813 = msg("35031", dup339); + +var msg36814 = msg("35032", dup340); + +var msg36815 = msg("35033", dup340); + +var msg36816 = msg("35034", dup339); + +var msg36817 = msg("35035", dup339); + +var msg36818 = msg("35036", dup339); + +var msg36819 = msg("35037", dup339); + +var msg36820 = msg("35038", dup340); + +var msg36821 = msg("35039", dup339); + +var msg36822 = msg("35040", dup347); + +var msg36823 = msg("35041", dup347); + +var msg36824 = msg("35042", dup340); + +var msg36825 = msg("35043", dup340); + +var msg36826 = msg("35044", dup347); + +var msg36827 = msg("35045", dup347); + +var msg36828 = msg("35046", dup339); + +var msg36829 = msg("35047", dup339); + +var msg36830 = msg("35048", dup340); + +var msg36831 = msg("35049", dup340); + +var msg36832 = msg("35050", dup339); + +var msg36833 = msg("35051", dup340); + +var msg36834 = msg("35052", dup340); + +var msg36835 = msg("35053", dup342); + +var msg36836 = msg("35062", dup339); + +var msg36837 = msg("35063", dup339); + +var msg36838 = msg("35064", dup339); + +var msg36839 = msg("35065", dup339); + +var msg36840 = msg("35066", dup339); + +var msg36841 = msg("35067", dup339); + +var msg36842 = msg("35068", dup339); + +var msg36843 = msg("35069", dup339); + +var msg36844 = msg("35070", dup340); + +var msg36845 = msg("35071", dup340); + +var msg36846 = msg("35072", dup340); + +var msg36847 = msg("35073", dup340); + +var msg36848 = msg("35074", dup340); + +var msg36849 = msg("35075", dup340); + +var msg36850 = msg("35076", dup339); + +var msg36851 = msg("35077", dup346); + +var msg36852 = msg("35078", dup346); + +var msg36853 = msg("35079", dup346); + +var msg36854 = msg("35080", dup339); + +var msg36855 = msg("35081", dup339); + +var msg36856 = msg("35082", dup339); + +var msg36857 = msg("35083", dup339); + +var msg36858 = msg("35084", dup347); + +var msg36859 = msg("35085", dup347); + +var msg36860 = msg("35086", dup347); + +var msg36861 = msg("35087", dup347); + +var msg36862 = msg("35088", dup347); + +var msg36863 = msg("35089", dup347); + +var msg36864 = msg("35090", dup341); + +var msg36865 = msg("35091", dup341); + +var msg36866 = msg("35092", dup341); + +var msg36867 = msg("35093", dup341); + +var msg36868 = msg("35094", dup343); + +var msg36869 = msg("35095", dup347); + +var msg36870 = msg("35096", dup347); + +var msg36871 = msg("35097", dup343); + +var msg36872 = msg("35098", dup343); + +var msg36873 = msg("35099", dup339); + +var msg36874 = msg("35100", dup339); + +var msg36875 = msg("35101", dup339); + +var msg36876 = msg("35102", dup339); + +var msg36877 = msg("35103", dup339); + +var msg36878 = msg("35104", dup339); + +var msg36879 = msg("35105", dup340); + +var msg36880 = msg("35106", dup340); + +var msg36881 = msg("35107", dup340); + +var msg36882 = msg("35108", dup340); + +var msg36883 = msg("35109", dup347); + +var msg36884 = msg("35110", dup347); + +var msg36885 = msg("35111", dup340); + +var msg36886 = msg("35112", dup343); + +var msg36887 = msg("35113", dup343); + +var msg36888 = msg("35114", dup347); + +var msg36889 = msg("35115", dup347); + +var msg36890 = msg("35116", dup342); + +var msg36891 = msg("35117", dup342); + +var msg36892 = msg("35118", dup340); + +var msg36893 = msg("35119", dup342); + +var msg36894 = msg("35120", dup342); + +var msg36895 = msg("35121", dup342); + +var msg36896 = msg("35122", dup342); + +var msg36897 = msg("35123", dup342); + +var msg36898 = msg("35124", dup342); + +var msg36899 = msg("35125", dup342); + +var msg36900 = msg("35126", dup342); + +var msg36901 = msg("35127", dup342); + +var msg36902 = msg("35128", dup342); + +var msg36903 = msg("35129", dup341); + +var msg36904 = msg("35130", dup341); + +var msg36905 = msg("35131", dup340); + +var msg36906 = msg("35132", dup340); + +var msg36907 = msg("35133", dup342); + +var msg36908 = msg("35134", dup342); + +var msg36909 = msg("35135", dup347); + +var msg36910 = msg("35136", dup347); + +var msg36911 = msg("35137", dup341); + +var msg36912 = msg("35138", dup341); + +var msg36913 = msg("35139", dup342); + +var msg36914 = msg("35140", dup342); + +var msg36915 = msg("35141", dup341); + +var msg36916 = msg("35142", dup341); + +var msg36917 = msg("35143", dup341); + +var msg36918 = msg("35144", dup341); + +var msg36919 = msg("35145", dup342); + +var msg36920 = msg("35146", dup342); + +var msg36921 = msg("35147", dup342); + +var msg36922 = msg("35148", dup342); + +var msg36923 = msg("35149", dup340); + +var msg36924 = msg("35150", dup340); + +var msg36925 = msg("35151", dup341); + +var msg36926 = msg("35152", dup342); + +var msg36927 = msg("35153", dup342); + +var msg36928 = msg("35154", dup342); + +var msg36929 = msg("35155", dup342); + +var msg36930 = msg("35156", dup342); + +var msg36931 = msg("35157", dup342); + +var msg36932 = msg("35158", dup342); + +var msg36933 = msg("35159", dup342); + +var msg36934 = msg("35160", dup341); + +var msg36935 = msg("35161", dup341); + +var msg36936 = msg("35162", dup341); + +var msg36937 = msg("35163", dup341); + +var msg36938 = msg("35164", dup342); + +var msg36939 = msg("35165", dup342); + +var msg36940 = msg("35166", dup341); + +var msg36941 = msg("35167", dup341); + +var msg36942 = msg("35168", dup341); + +var msg36943 = msg("35169", dup341); + +var msg36944 = msg("35170", dup342); + +var msg36945 = msg("35171", dup342); + +var msg36946 = msg("35172", dup342); + +var msg36947 = msg("35173", dup342); + +var msg36948 = msg("35174", dup351); + +var msg36949 = msg("35175", dup351); + +var msg36950 = msg("35176", dup341); + +var msg36951 = msg("35177", dup341); + +var msg36952 = msg("35178", dup342); + +var msg36953 = msg("35179", dup342); + +var msg36954 = msg("35180", dup340); + +var msg36955 = msg("35181", dup340); + +var msg36956 = msg("35182", dup342); + +var msg36957 = msg("35183", dup342); + +var msg36958 = msg("35184", dup342); + +var msg36959 = msg("35185", dup342); + +var msg36960 = msg("35186", dup342); + +var msg36961 = msg("35187", dup342); + +var msg36962 = msg("35188", dup342); + +var msg36963 = msg("35189", dup342); + +var msg36964 = msg("35190", dup341); + +var msg36965 = msg("35191", dup341); + +var msg36966 = msg("35192", dup342); + +var msg36967 = msg("35193", dup342); + +var msg36968 = msg("35194", dup342); + +var msg36969 = msg("35195", dup342); + +var msg36970 = msg("35196", dup342); + +var msg36971 = msg("35197", dup342); + +var msg36972 = msg("35198", dup346); + +var msg36973 = msg("35199", dup342); + +var msg36974 = msg("35200", dup342); + +var msg36975 = msg("35201", dup341); + +var msg36976 = msg("35202", dup341); + +var msg36977 = msg("35203", dup342); + +var msg36978 = msg("35204", dup342); + +var msg36979 = msg("35205", dup342); + +var msg36980 = msg("35206", dup342); + +var msg36981 = msg("35207", dup342); + +var msg36982 = msg("35208", dup342); + +var msg36983 = msg("35209", dup342); + +var msg36984 = msg("35210", dup342); + +var msg36985 = msg("35211", dup342); + +var msg36986 = msg("35212", dup342); + +var msg36987 = msg("35213", dup343); + +var msg36988 = msg("35214", dup343); + +var msg36989 = msg("35215", dup347); + +var msg36990 = msg("35216", dup347); + +var msg36991 = msg("35217", dup340); + +var msg36992 = msg("35218", dup340); + +var msg36993 = msg("35219", dup340); + +var msg36994 = msg("35220", dup340); + +var msg36995 = msg("35221", dup339); + +var msg36996 = msg("35222", dup342); + +var msg36997 = msg("35223", dup340); + +var msg36998 = msg("35224", dup340); + +var msg36999 = msg("35225", dup340); + +var msg37000 = msg("35226", dup340); + +var msg37001 = msg("35227", dup340); + +var msg37002 = msg("35228", dup340); + +var msg37003 = msg("35229", dup340); + +var msg37004 = msg("35230", dup340); + +var msg37005 = msg("35231", dup340); + +var msg37006 = msg("35232", dup340); + +var msg37007 = msg("35233", dup340); + +var msg37008 = msg("35234", dup340); + +var msg37009 = msg("35235", dup340); + +var msg37010 = msg("35236", dup340); + +var msg37011 = msg("35237", dup340); + +var msg37012 = msg("35238", dup340); + +var msg37013 = msg("35239", dup340); + +var msg37014 = msg("35240", dup340); + +var msg37015 = msg("35241", dup340); + +var msg37016 = msg("35242", dup340); + +var msg37017 = msg("35243", dup348); + +var msg37018 = msg("35244", dup348); + +var msg37019 = msg("35245", dup348); + +var msg37020 = msg("35246", dup348); + +var msg37021 = msg("35247", dup340); + +var msg37022 = msg("35248", dup340); + +var msg37023 = msg("35249", dup340); + +var msg37024 = msg("35250", dup340); + +var msg37025 = msg("35251", dup341); + +var msg37026 = msg("35252", dup341); + +var msg37027 = msg("35253", dup340); + +var msg37028 = msg("35254", dup339); + +var msg37029 = msg("35255", dup339); + +var msg37030 = msg("35256", dup347); + +var msg37031 = msg("35257", dup348); + +var msg37032 = msg("35258", dup348); + +var msg37033 = msg("35259", dup348); + +var msg37034 = msg("35260", dup348); + +var msg37035 = msg("35261", dup347); + +var msg37036 = msg("35262", dup347); + +var msg37037 = msg("35263", dup347); + +var msg37038 = msg("35264", dup347); + +var msg37039 = msg("35265", dup347); + +var msg37040 = msg("35266", dup347); + +var msg37041 = msg("35267", dup340); + +var msg37042 = msg("35268", dup340); + +var msg37043 = msg("35269", dup340); + +var msg37044 = msg("35270", dup340); + +var msg37045 = msg("35271", dup340); + +var msg37046 = msg("35272", dup340); + +var msg37047 = msg("35273", dup340); + +var msg37048 = msg("35274", dup340); + +var msg37049 = msg("35275", dup340); + +var msg37050 = msg("35276", dup340); + +var msg37051 = msg("35277", dup340); + +var msg37052 = msg("35278", dup340); + +var msg37053 = msg("35279", dup346); + +var msg37054 = msg("35280", dup346); + +var msg37055 = msg("35281", dup346); + +var msg37056 = msg("35282", dup340); + +var msg37057 = msg("35283", dup340); + +var msg37058 = msg("35284", dup340); + +var msg37059 = msg("35285", dup340); + +var msg37060 = msg("35286", dup340); + +var msg37061 = msg("35287", dup340); + +var msg37062 = msg("35288", dup340); + +var msg37063 = msg("35289", dup340); + +var msg37064 = msg("35290", dup340); + +var msg37065 = msg("35291", dup340); + +var msg37066 = msg("35292", dup340); + +var msg37067 = msg("35293", dup340); + +var msg37068 = msg("35294", dup340); + +var msg37069 = msg("35295", dup340); + +var msg37070 = msg("35296", dup340); + +var msg37071 = msg("35297", dup340); + +var msg37072 = msg("35298", dup340); + +var msg37073 = msg("35299", dup340); + +var msg37074 = msg("35300", dup339); + +var msg37075 = msg("35301", dup339); + +var msg37076 = msg("35302", dup340); + +var msg37077 = msg("35303", dup339); + +var msg37078 = msg("35304", dup341); + +var msg37079 = msg("35305", dup341); + +var msg37080 = msg("35306", dup339); + +var msg37081 = msg("35307", dup340); + +var msg37082 = msg("35308", dup341); + +var msg37083 = msg("35309", dup341); + +var msg37084 = msg("35310", dup348); + +var msg37085 = msg("35311", dup348); + +var msg37086 = msg("35312", dup339); + +var msg37087 = msg("35313", dup339); + +var msg37088 = msg("35314", dup350); + +var msg37089 = msg("35315", dup339); + +var msg37090 = msg("35316", dup342); + +var msg37091 = msg("35317", dup339); + +var msg37092 = msg("35318", dup339); + +var msg37093 = msg("35319", dup340); + +var msg37094 = msg("35320", dup340); + +var msg37095 = msg("35321", dup340); + +var msg37096 = msg("35322", dup340); + +var msg37097 = msg("35323", dup340); + +var msg37098 = msg("35324", dup340); + +var msg37099 = msg("35325", dup341); + +var msg37100 = msg("35326", dup341); + +var msg37101 = msg("35327", dup340); + +var msg37102 = msg("35328", dup340); + +var msg37103 = msg("35329", dup340); + +var msg37104 = msg("35330", dup340); + +var msg37105 = msg("35331", dup343); + +var msg37106 = msg("35332", dup343); + +var msg37107 = msg("35333", dup347); + +var msg37108 = msg("35334", dup347); + +var msg37109 = msg("35335", dup347); + +var msg37110 = msg("35336", dup352); + +var msg37111 = msg("35337", dup352); + +var msg37112 = msg("35338", dup352); + +var msg37113 = msg("35339", dup352); + +var msg37114 = msg("35340", dup352); + +var msg37115 = msg("35341", dup352); + +var msg37116 = msg("35342", dup352); + +var msg37117 = msg("35343", dup352); + +var msg37118 = msg("35344", dup339); + +var msg37119 = msg("35345", dup347); + +var msg37120 = msg("35346", dup347); + +var msg37121 = msg("35347", dup340); + +var msg37122 = msg("35348", dup339); + +var msg37123 = msg("35349", dup340); + +var msg37124 = msg("35350", dup340); + +var msg37125 = msg("35351", dup340); + +var msg37126 = msg("35352", dup340); + +var msg37127 = msg("35353", dup339); + +var msg37128 = msg("35354", dup346); + +var msg37129 = msg("35355", dup339); + +var msg37130 = msg("35356", dup344); + +var msg37131 = msg("35357", dup344); + +var msg37132 = msg("35358", dup340); + +var msg37133 = msg("35359", dup346); + +var msg37134 = msg("35360", dup341); + +var msg37135 = msg("35361", dup341); + +var msg37136 = msg("35362", dup341); + +var msg37137 = msg("35363", dup341); + +var msg37138 = msg("35364", dup340); + +var msg37139 = msg("35365", dup340); + +var msg37140 = msg("35366", dup340); + +var msg37141 = msg("35367", dup340); + +var msg37142 = msg("35368", dup339); + +var msg37143 = msg("35369", dup339); + +var msg37144 = msg("35370", dup339); + +var msg37145 = msg("35371", dup339); + +var msg37146 = msg("35372", dup348); + +var msg37147 = msg("35373", dup348); + +var msg37148 = msg("35374", dup348); + +var msg37149 = msg("35375", dup348); + +var msg37150 = msg("35376", dup340); + +var msg37151 = msg("35377", dup340); + +var msg37152 = msg("35378", dup340); + +var msg37153 = msg("35379", dup340); + +var msg37154 = msg("35380", dup343); + +var msg37155 = msg("35381", dup343); + +var msg37156 = msg("35382", dup343); + +var msg37157 = msg("35383", dup343); + +var msg37158 = msg("35384", dup339); + +var msg37159 = msg("35385", dup339); + +var msg37160 = msg("35386", dup339); + +var msg37161 = msg("35387", dup339); + +var msg37162 = msg("35388", dup339); + +var msg37163 = msg("35389", dup339); + +var msg37164 = msg("35390", dup339); + +var msg37165 = msg("35391", dup339); + +var msg37166 = msg("35392", dup339); + +var msg37167 = msg("35393", dup339); + +var msg37168 = msg("35394", dup339); + +var msg37169 = msg("35395", dup340); + +var msg37170 = msg("35396", dup340); + +var msg37171 = msg("35397", dup340); + +var msg37172 = msg("35398", dup340); + +var msg37173 = msg("35399", dup348); + +var msg37174 = msg("35400", dup339); + +var msg37175 = msg("35401", dup340); + +var msg37176 = msg("35402", dup340); + +var msg37177 = msg("35403", dup340); + +var msg37178 = msg("35404", dup340); + +var msg37179 = msg("35405", dup340); + +var msg37180 = msg("35406", dup341); + +var msg37181 = msg("35407", dup340); + +var msg37182 = msg("35408", dup340); + +var msg37183 = msg("35409", dup340); + +var msg37184 = msg("35410", dup340); + +var msg37185 = msg("35411", dup348); + +var msg37186 = msg("35412", dup348); + +var msg37187 = msg("35413", dup344); + +var msg37188 = msg("35414", dup344); + +var msg37189 = msg("35415", dup339); + +var msg37190 = msg("35416", dup339); + +var msg37191 = msg("35417", dup324); + +var msg37192 = msg("35418", dup324); + +var msg37193 = msg("35419", dup309); + +var msg37194 = msg("35420", dup309); + +var msg37195 = msg("35421", dup309); + +var msg37196 = msg("35422", dup309); + +var msg37197 = msg("35423", dup314); + +var msg37198 = msg("35424", dup324); + +var msg37199 = msg("35425", dup324); + +var msg37200 = msg("35426", dup321); + +var msg37201 = msg("35427", dup322); + +var msg37202 = msg("35428", dup322); + +var msg37203 = msg("35429", dup322); + +var msg37204 = msg("35430", dup314); + +var msg37205 = msg("35431", dup314); + +var msg37206 = msg("35432", dup314); + +var msg37207 = msg("35433", dup314); + +var msg37208 = msg("35434", dup309); + +var msg37209 = msg("35435", dup309); + +var msg37210 = msg("35436", dup321); + +var msg37211 = msg("35437", dup321); + +var msg37212 = msg("35438", dup307); + +var msg37213 = msg("35439", dup307); + +var msg37214 = msg("35440", dup309); + +var msg37215 = msg("35441", dup309); + +var msg37216 = msg("35442", dup309); + +var msg37217 = msg("35443", dup309); + +var msg37218 = msg("35444", dup314); + +var msg37219 = msg("35445", dup314); + +var msg37220 = msg("35446", dup314); + +var msg37221 = msg("35447", dup314); + +var msg37222 = msg("35448", dup321); + +var msg37223 = msg("35449", dup314); + +var msg37224 = msg("35450", dup314); + +var msg37225 = msg("35451", dup314); + +var msg37226 = msg("35452", dup314); + +var msg37227 = msg("35453", dup314); + +var msg37228 = msg("35454", dup314); + +var msg37229 = msg("35455", dup314); + +var msg37230 = msg("35456", dup314); + +var msg37231 = msg("35457", dup314); + +var msg37232 = msg("35458", dup314); + +var msg37233 = msg("35459", dup314); + +var msg37234 = msg("35460", dup311); + +var msg37235 = msg("35461", dup311); + +var msg37236 = msg("35462", dup321); + +var msg37237 = msg("35463", dup314); + +var msg37238 = msg("35464", dup314); + +var msg37239 = msg("35465", dup314); + +var msg37240 = msg("35466", dup314); + +var msg37241 = msg("35467", dup314); + +var msg37242 = msg("35468", dup314); + +var msg37243 = msg("35469", dup314); + +var msg37244 = msg("35470", dup321); + +var msg37245 = msg("35471", dup321); + +var msg37246 = msg("35472", dup321); + +var msg37247 = msg("35473", dup325); + +var msg37248 = msg("35474", dup325); + +var msg37249 = msg("35475", dup325); + +var msg37250 = msg("35476", dup325); + +var msg37251 = msg("35477", dup325); + +var msg37252 = msg("35478", dup325); + +var msg37253 = msg("35479", dup311); + +var msg37254 = msg("35480", dup311); + +var msg37255 = msg("35481", dup325); + +var msg37256 = msg("35482", dup325); + +var msg37257 = msg("35483", dup311); + +var msg37258 = msg("35484", dup311); + +var msg37259 = msg("35485", dup311); + +var msg37260 = msg("35486", dup311); + +var msg37261 = msg("35487", dup314); + +var msg37262 = msg("35488", dup314); + +var msg37263 = msg("35489", dup311); + +var msg37264 = msg("35490", dup311); + +var msg37265 = msg("35491", dup311); + +var msg37266 = msg("35492", dup311); + +var msg37267 = msg("35493", dup325); + +var msg37268 = msg("35494", dup325); + +var msg37269 = msg("35495", dup311); + +var msg37270 = msg("35496", dup311); + +var msg37271 = msg("35497", dup309); + +var msg37272 = msg("35498", dup309); + +var msg37273 = msg("35499", dup309); + +var msg37274 = msg("35500", dup309); + +var msg37275 = msg("35501", dup309); + +var msg37276 = msg("35502", dup309); + +var msg37277 = msg("35503", dup309); + +var msg37278 = msg("35504", dup309); + +var msg37279 = msg("35505", dup309); + +var msg37280 = msg("35506", dup309); + +var msg37281 = msg("35507", dup311); + +var msg37282 = msg("35508", dup311); + +var msg37283 = msg("35509", dup309); + +var msg37284 = msg("35510", dup309); + +var msg37285 = msg("35511", dup309); + +var msg37286 = msg("35512", dup309); + +var msg37287 = msg("35513", dup314); + +var msg37288 = msg("35514", dup314); + +var msg37289 = msg("35515", dup314); + +var msg37290 = msg("35516", dup314); + +var msg37291 = msg("35517", dup314); + +var msg37292 = msg("35518", dup314); + +var msg37293 = msg("35519", dup314); + +var msg37294 = msg("35520", dup314); + +var msg37295 = msg("35521", dup309); + +var msg37296 = msg("35522", dup309); + +var msg37297 = msg("35523", dup314); + +var msg37298 = msg("35524", dup314); + +var msg37299 = msg("35525", dup314); + +var msg37300 = msg("35526", dup314); + +var msg37301 = msg("35527", dup314); + +var msg37302 = msg("35528", dup314); + +var msg37303 = msg("35529", dup311); + +var msg37304 = msg("35530", dup311); + +var msg37305 = msg("35531", dup310); + +var msg37306 = msg("35532", dup310); + +var msg37307 = msg("35533", dup322); + +var msg37308 = msg("35534", dup322); + +var msg37309 = msg("35535", dup322); + +var msg37310 = msg("35536", dup311); + +var msg37311 = msg("35537", dup311); + +var msg37312 = msg("35538", dup314); + +var msg37313 = msg("35539", dup314); + +var msg37314 = msg("35540", dup322); + +var msg37315 = msg("35541", dup322); + +var msg37316 = msg("35542", dup311); + +var msg37317 = msg("35543", dup311); + +var msg37318 = msg("35544", dup311); + +var msg37319 = msg("35545", dup311); + +var msg37320 = msg("35546", dup311); + +var msg37321 = msg("35547", dup311); + +var msg37322 = msg("35548", dup311); + +var msg37323 = msg("35549", dup321); + +var msg37324 = msg("35550", dup311); + +var msg37325 = msg("35551", dup321); + +var msg37326 = msg("35552", dup311); + +var msg37327 = msg("35553", dup311); + +var msg37328 = msg("35554", dup311); + +var msg37329 = msg("35555", dup311); + +var msg37330 = msg("35556", dup314); + +var msg37331 = msg("35557", dup314); + +var msg37332 = msg("35558", dup314); + +var msg37333 = msg("35559", dup314); + +var msg37334 = msg("35560", dup314); + +var msg37335 = msg("35561", dup311); + +var msg37336 = msg("35562", dup311); + +var msg37337 = msg("35563", dup314); + +var msg37338 = msg("35564", dup314); + +var msg37339 = msg("35565", dup314); + +var msg37340 = msg("35566", dup314); + +var msg37341 = msg("35567", dup314); + +var msg37342 = msg("35568", dup314); + +var msg37343 = msg("35569", dup325); + +var msg37344 = msg("35570", dup321); + +var msg37345 = msg("35571", dup314); + +var msg37346 = msg("35572", dup314); + +var msg37347 = msg("35573", dup322); + +var msg37348 = msg("35574", dup314); + +var msg37349 = msg("35575", dup314); + +var msg37350 = msg("35576", dup314); + +var msg37351 = msg("35577", dup314); + +var msg37352 = msg("35578", dup309); + +var msg37353 = msg("35579", dup309); + +var msg37354 = msg("35580", dup309); + +var msg37355 = msg("35581", dup309); + +var msg37356 = msg("35582", dup311); + +var msg37357 = msg("35583", dup311); + +var msg37358 = msg("35584", dup314); + +var msg37359 = msg("35585", dup314); + +var msg37360 = msg("35586", dup314); + +var msg37361 = msg("35587", dup314); + +var msg37362 = msg("35588", dup314); + +var msg37363 = msg("35589", dup314); + +var msg37364 = msg("35590", dup314); + +var msg37365 = msg("35591", dup314); + +var msg37366 = msg("35592", dup309); + +var msg37367 = msg("35593", dup309); + +var msg37368 = msg("35594", dup309); + +var msg37369 = msg("35595", dup321); + +var msg37370 = msg("35596", dup321); + +var msg37371 = msg("35597", dup321); + +var msg37372 = msg("35598", dup314); + +var msg37373 = msg("35599", dup314); + +var msg37374 = msg("35600", dup314); + +var msg37375 = msg("35601", dup314); + +var msg37376 = msg("35602", dup314); + +var msg37377 = msg("35603", dup314); + +var msg37378 = msg("35604", dup314); + +var msg37379 = msg("35605", dup314); + +var msg37380 = msg("35606", dup314); + +var msg37381 = msg("35607", dup314); + +var msg37382 = msg("35608", dup314); + +var msg37383 = msg("35609", dup314); + +var msg37384 = msg("35610", dup314); + +var msg37385 = msg("35611", dup314); + +var msg37386 = msg("35612", dup314); + +var msg37387 = msg("35613", dup314); + +var msg37388 = msg("35614", dup311); + +var msg37389 = msg("35615", dup311); + +var msg37390 = msg("35616", dup311); + +var msg37391 = msg("35617", dup311); + +var msg37392 = msg("35618", dup323); + +var msg37393 = msg("35619", dup323); + +var msg37394 = msg("35620", dup323); + +var msg37395 = msg("35621", dup323); + +var msg37396 = msg("35622", dup323); + +var msg37397 = msg("35623", dup323); + +var msg37398 = msg("35628", dup309); + +var msg37399 = msg("35629", dup309); + +var msg37400 = msg("35630", dup324); + +var msg37401 = msg("35631", dup324); + +var msg37402 = msg("35632", dup314); + +var msg37403 = msg("35633", dup314); + +var msg37404 = msg("35634", dup314); + +var msg37405 = msg("35635", dup314); + +var msg37406 = msg("35636", dup309); + +var msg37407 = msg("35637", dup309); + +var msg37408 = msg("35638", dup314); + +var msg37409 = msg("35639", dup314); + +var msg37410 = msg("35640", dup314); + +var msg37411 = msg("35641", dup314); + +var msg37412 = msg("35642", dup314); + +var msg37413 = msg("35643", dup314); + +var msg37414 = msg("35644", dup314); + +var msg37415 = msg("35645", dup314); + +var msg37416 = msg("35646", dup314); + +var msg37417 = msg("35647", dup314); + +var msg37418 = msg("35648", dup314); + +var msg37419 = msg("35649", dup314); + +var msg37420 = msg("35650", dup314); + +var msg37421 = msg("35651", dup314); + +var msg37422 = msg("35652", dup314); + +var msg37423 = msg("35653", dup314); + +var msg37424 = msg("35654", dup314); + +var msg37425 = msg("35655", dup314); + +var msg37426 = msg("35656", dup314); + +var msg37427 = msg("35657", dup314); + +var msg37428 = msg("35658", dup314); + +var msg37429 = msg("35659", dup314); + +var msg37430 = msg("35660", dup314); + +var msg37431 = msg("35661", dup314); + +var msg37432 = msg("35662", dup314); + +var msg37433 = msg("35663", dup314); + +var msg37434 = msg("35664", dup314); + +var msg37435 = msg("35665", dup314); + +var msg37436 = msg("35666", dup311); + +var msg37437 = msg("35667", dup311); + +var msg37438 = msg("35668", dup311); + +var msg37439 = msg("35669", dup311); + +var msg37440 = msg("35670", dup314); + +var msg37441 = msg("35671", dup314); + +var msg37442 = msg("35672", dup314); + +var msg37443 = msg("35673", dup314); + +var msg37444 = msg("35674", dup314); + +var msg37445 = msg("35675", dup314); + +var msg37446 = msg("35676", dup314); + +var msg37447 = msg("35677", dup314); + +var msg37448 = msg("35678", dup314); + +var msg37449 = msg("35679", dup314); + +var msg37450 = msg("35680", dup314); + +var msg37451 = msg("35681", dup330); + +var msg37452 = msg("35682", dup314); + +var msg37453 = msg("35683", dup314); + +var msg37454 = msg("35684", dup314); + +var msg37455 = msg("35685", dup314); + +var msg37456 = msg("35686", dup314); + +var msg37457 = msg("35687", dup311); + +var msg37458 = msg("35691", dup314); + +var msg37459 = msg("35692", dup314); + +var msg37460 = msg("35693", dup314); + +var msg37461 = msg("35694", dup314); + +var msg37462 = msg("35695", dup314); + +var msg37463 = msg("35696", dup314); + +var msg37464 = msg("35697", dup314); + +var msg37465 = msg("35698", dup314); + +var msg37466 = msg("35699", dup314); + +var msg37467 = msg("35700", dup314); + +var msg37468 = msg("35701", dup322); + +var msg37469 = msg("35702", dup322); + +var msg37470 = msg("35703", dup322); + +var msg37471 = msg("35704", dup314); + +var msg37472 = msg("35705", dup314); + +var msg37473 = msg("35706", dup314); + +var msg37474 = msg("35707", dup314); + +var msg37475 = msg("35708", dup314); + +var msg37476 = msg("35709", dup314); + +var msg37477 = msg("35710", dup325); + +var msg37478 = msg("35719", dup311); + +var msg37479 = msg("35720", dup311); + +var msg37480 = msg("35723", dup311); + +var msg37481 = msg("35724", dup311); + +var msg37482 = msg("35731", dup311); + +var msg37483 = msg("35732", dup321); + +var msg37484 = msg("35733", dup321); + +var msg37485 = msg("35734", dup330); + +var msg37486 = msg("35735", dup314); + +var msg37487 = msg("35736", dup314); + +var msg37488 = msg("35737", dup307); + +var msg37489 = msg("35738", dup307); + +var msg37490 = msg("35739", dup307); + +var msg37491 = msg("35740", dup307); + +var msg37492 = msg("35741", dup314); + +var msg37493 = msg("35742", dup314); + +var msg37494 = msg("35743", dup314); + +var msg37495 = msg("35744", dup314); + +var msg37496 = msg("35745", dup311); + +var msg37497 = msg("35746", dup321); + +var msg37498 = msg("35747", dup325); + +var msg37499 = msg("35748", dup325); + +var msg37500 = msg("35749", dup321); + +var msg37501 = msg("35750", dup321); + +var msg37502 = msg("35751", dup309); + +var msg37503 = msg("35752", dup309); + +var msg37504 = msg("35753", dup314); + +var msg37505 = msg("35754", dup314); + +var msg37506 = msg("35755", dup314); + +var msg37507 = msg("35756", dup314); + +var msg37508 = msg("35757", dup314); + +var msg37509 = msg("35758", dup314); + +var msg37510 = msg("35759", dup314); + +var msg37511 = msg("35760", dup314); + +var msg37512 = msg("35761", dup314); + +var msg37513 = msg("35762", dup314); + +var msg37514 = msg("35763", dup324); + +var msg37515 = msg("35764", dup324); + +var msg37516 = msg("35765", dup324); + +var msg37517 = msg("35766", dup324); + +var msg37518 = msg("35767", dup314); + +var msg37519 = msg("35768", dup314); + +var msg37520 = msg("35769", dup321); + +var msg37521 = msg("35770", dup321); + +var msg37522 = msg("35771", dup325); + +var msg37523 = msg("35772", dup325); + +var msg37524 = msg("35779", dup314); + +var msg37525 = msg("35780", dup314); + +var msg37526 = msg("35781", dup314); + +var msg37527 = msg("35782", dup314); + +var msg37528 = msg("35783", dup321); + +var msg37529 = msg("35784", dup314); + +var msg37530 = msg("35785", dup314); + +var msg37531 = msg("35786", dup314); + +var msg37532 = msg("35787", dup314); + +var msg37533 = msg("35788", dup321); + +var msg37534 = msg("35789", dup321); + +var msg37535 = msg("35790", dup321); + +var msg37536 = msg("35791", dup321); + +var msg37537 = msg("35792", dup321); + +var msg37538 = msg("35793", dup321); + +var msg37539 = msg("35794", dup321); + +var msg37540 = msg("35795", dup314); + +var msg37541 = msg("35796", dup314); + +var msg37542 = msg("35797", dup314); + +var msg37543 = msg("35798", dup311); + +var msg37544 = msg("35799", dup311); + +var msg37545 = msg("35800", dup321); + +var msg37546 = msg("35801", dup321); + +var msg37547 = msg("35802", dup321); + +var msg37548 = msg("35803", dup321); + +var msg37549 = msg("35804", dup321); + +var msg37550 = msg("35805", dup311); + +var msg37551 = msg("35806", dup311); + +var msg37552 = msg("35807", dup314); + +var msg37553 = msg("35808", dup314); + +var msg37554 = msg("35809", dup323); + +var msg37555 = msg("35810", dup323); + +var msg37556 = msg("35811", dup323); + +var msg37557 = msg("35812", dup323); + +var msg37558 = msg("35813", dup314); + +var msg37559 = msg("35814", dup314); + +var msg37560 = msg("35815", dup314); + +var msg37561 = msg("35816", dup314); + +var msg37562 = msg("35817", dup314); + +var msg37563 = msg("35818", dup314); + +var msg37564 = msg("35819", dup322); + +var msg37565 = msg("35820", dup314); + +var msg37566 = msg("35821", dup314); + +var msg37567 = msg("35822", dup314); + +var msg37568 = msg("35823", dup314); + +var msg37569 = msg("35824", dup314); + +var msg37570 = msg("35825", dup314); + +var msg37571 = msg("35826", dup314); + +var msg37572 = msg("35827", dup314); + +var msg37573 = msg("35831", dup307); + +var msg37574 = msg("35836", dup325); + +var msg37575 = msg("35837", dup325); + +var msg37576 = msg("35838", dup321); + +var msg37577 = msg("35839", dup321); + +var msg37578 = msg("35840", dup321); + +var msg37579 = msg("35841", dup321); + +var msg37580 = msg("35842", dup321); + +var msg37581 = msg("35843", dup314); + +var msg37582 = msg("35844", dup314); + +var msg37583 = msg("35845", dup311); + +var msg37584 = msg("35846", dup311); + +var msg37585 = msg("35847", dup314); + +var msg37586 = msg("35848", dup309); + +var msg37587 = msg("35849", dup314); + +var msg37588 = msg("35850", dup314); + +var msg37589 = msg("35851", dup311); + +var msg37590 = msg("35852", dup314); + +var msg37591 = msg("35853", dup309); + +var msg37592 = msg("35854", dup309); + +var msg37593 = msg("35855", dup309); + +var msg37594 = msg("35856", dup309); + +var msg37595 = msg("35857", dup311); + +var msg37596 = msg("35858", dup311); + +var msg37597 = msg("35859", dup314); + +var msg37598 = msg("35860", dup314); + +var msg37599 = msg("35861", dup314); + +var msg37600 = msg("35862", dup314); + +var msg37601 = msg("35863", dup314); + +var msg37602 = msg("35864", dup314); + +var msg37603 = msg("35865", dup311); + +var msg37604 = msg("35866", dup311); + +var msg37605 = msg("35867", dup311); + +var msg37606 = msg("35868", dup325); + +var msg37607 = msg("35869", dup325); + +var msg37608 = msg("35870", dup325); + +var msg37609 = msg("35871", dup325); + +var msg37610 = msg("35872", dup314); + +var msg37611 = msg("35873", dup314); + +var msg37612 = msg("35874", dup314); + +var msg37613 = msg("35875", dup314); + +var msg37614 = msg("35876", dup311); + +var msg37615 = msg("35877", dup323); + +var msg37616 = msg("35878", dup323); + +var msg37617 = msg("35879", dup323); + +var msg37618 = msg("35880", dup323); + +var msg37619 = msg("35881", dup314); + +var msg37620 = msg("35882", dup314); + +var msg37621 = msg("35883", dup307); + +var msg37622 = msg("35884", dup314); + +var msg37623 = msg("35885", dup314); + +var msg37624 = msg("35886", dup314); + +var msg37625 = msg("35887", dup322); + +var msg37626 = msg("35888", dup314); + +var msg37627 = msg("35889", dup311); + +var msg37628 = msg("35890", dup322); + +var msg37629 = msg("35891", dup322); + +var msg37630 = msg("35892", dup314); + +var msg37631 = msg("35893", dup314); + +var msg37632 = msg("35894", dup316); + +var msg37633 = msg("35895", dup309); + +var msg37634 = msg("35896", dup309); + +var msg37635 = msg("35897", dup316); + +var msg37636 = msg("35898", dup309); + +var msg37637 = msg("35899", dup309); + +var msg37638 = msg("35900", dup309); + +var msg37639 = msg("35901", dup309); + +var msg37640 = msg("35902", dup316); + +var msg37641 = msg("35903", dup309); + +var msg37642 = msg("35904", dup309); + +var msg37643 = msg("35905", dup314); + +var msg37644 = msg("35906", dup309); + +var msg37645 = msg("35907", dup314); + +var msg37646 = msg("35908", dup309); + +var msg37647 = msg("35909", dup309); + +var msg37648 = msg("35910", dup314); + +var msg37649 = msg("35911", dup309); + +var msg37650 = msg("35912", dup309); + +var msg37651 = msg("35913", dup314); + +var msg37652 = msg("35914", dup314); + +var msg37653 = msg("35915", dup314); + +var msg37654 = msg("35916", dup314); + +var msg37655 = msg("35917", dup314); + +var msg37656 = msg("35918", dup309); + +var msg37657 = msg("35919", dup311); + +var msg37658 = msg("35920", dup314); + +var msg37659 = msg("35921", dup325); + +var msg37660 = msg("35922", dup309); + +var msg37661 = msg("35923", dup314); + +var msg37662 = msg("35924", dup311); + +var msg37663 = msg("35925", dup311); + +var msg37664 = msg("35926", dup330); + +var msg37665 = msg("35927", dup311); + +var msg37666 = msg("35928", dup311); + +var msg37667 = msg("35929", dup322); + +var msg37668 = msg("35930", dup322); + +var msg37669 = msg("35931", dup322); + +var msg37670 = msg("35932", dup322); + +var msg37671 = msg("35933", dup314); + +var msg37672 = msg("35934", dup314); + +var msg37673 = msg("35935", dup314); + +var msg37674 = msg("35936", dup314); + +var msg37675 = msg("35937", dup314); + +var msg37676 = msg("35938", dup314); + +var msg37677 = msg("35939", dup309); + +var msg37678 = msg("35940", dup309); + +var msg37679 = msg("35941", dup314); + +var msg37680 = msg("35942", dup324); + +var msg37681 = msg("35943", dup324); + +var msg37682 = msg("35944", dup309); + +var msg37683 = msg("35945", dup311); + +var msg37684 = msg("35946", dup311); + +var msg37685 = msg("35947", dup311); + +var msg37686 = msg("35948", dup311); + +var msg37687 = msg("35949", dup311); + +var msg37688 = msg("35950", dup311); + +var msg37689 = msg("35951", dup311); + +var msg37690 = msg("35952", dup311); + +var msg37691 = msg("35953", dup311); + +var msg37692 = msg("35954", dup311); + +var msg37693 = msg("35955", dup314); + +var msg37694 = msg("35956", dup314); + +var msg37695 = msg("35957", dup314); + +var msg37696 = msg("35958", dup314); + +var msg37697 = msg("35959", dup323); + +var msg37698 = msg("35960", dup323); + +var msg37699 = msg("35961", dup311); + +var msg37700 = msg("35962", dup311); + +var msg37701 = msg("35963", dup325); + +var msg37702 = msg("35964", dup325); + +var msg37703 = msg("35965", dup311); + +var msg37704 = msg("35966", dup311); + +var msg37705 = msg("35967", dup314); + +var msg37706 = msg("35968", dup314); + +var msg37707 = msg("35969", dup325); + +var msg37708 = msg("35970", dup325); + +var msg37709 = msg("35971", dup325); + +var msg37710 = msg("35972", dup325); + +var msg37711 = msg("35973", dup314); + +var msg37712 = msg("35974", dup314); + +var msg37713 = msg("35975", dup325); + +var msg37714 = msg("35976", dup325); + +var msg37715 = msg("35977", dup314); + +var msg37716 = msg("35978", dup314); + +var msg37717 = msg("35979", dup314); + +var msg37718 = msg("35980", dup314); + +var msg37719 = msg("35981", dup314); + +var msg37720 = msg("35982", dup311); + +var msg37721 = msg("35983", dup311); + +var msg37722 = msg("35984", dup324); + +var msg37723 = msg("35985", dup324); + +var msg37724 = msg("35986", dup314); + +var msg37725 = msg("35987", dup314); + +var msg37726 = msg("35988", dup309); + +var msg37727 = msg("35989", dup309); + +var msg37728 = msg("35990", dup311); + +var msg37729 = msg("35991", dup311); + +var msg37730 = msg("35992", dup325); + +var msg37731 = msg("35993", dup325); + +var msg37732 = msg("35994", dup314); + +var msg37733 = msg("35995", dup314); + +var msg37734 = msg("35996", dup309); + +var msg37735 = msg("35997", dup309); + +var msg37736 = msg("35998", dup311); + +var msg37737 = msg("35999", dup311); + +var msg37738 = msg("36000", dup309); + +var msg37739 = msg("36001", dup309); + +var msg37740 = msg("36002", dup309); + +var msg37741 = msg("36003", dup309); + +var msg37742 = msg("36004", dup325); + +var msg37743 = msg("36005", dup325); + +var msg37744 = msg("36006", dup325); + +var msg37745 = msg("36007", dup325); + +var msg37746 = msg("36008", dup325); + +var msg37747 = msg("36009", dup325); + +var msg37748 = msg("36010", dup314); + +var msg37749 = msg("36011", dup314); + +var msg37750 = msg("36012", dup314); + +var msg37751 = msg("36013", dup314); + +var msg37752 = msg("36014", dup309); + +var msg37753 = msg("36015", dup309); + +var msg37754 = msg("36016", dup314); + +var msg37755 = msg("36017", dup314); + +var msg37756 = msg("36018", dup325); + +var msg37757 = msg("36019", dup325); + +var msg37758 = msg("36020", dup325); + +var msg37759 = msg("36021", dup325); + +var msg37760 = msg("36022", dup314); + +var msg37761 = msg("36023", dup314); + +var msg37762 = msg("36024", dup314); + +var msg37763 = msg("36025", dup314); + +var msg37764 = msg("36026", dup309); + +var msg37765 = msg("36027", dup309); + +var msg37766 = msg("36028", dup314); + +var msg37767 = msg("36029", dup314); + +var msg37768 = msg("36030", dup316); + +var msg37769 = msg("36031", dup316); + +var msg37770 = msg("36032", dup316); + +var msg37771 = msg("36033", dup316); + +var msg37772 = msg("36034", dup314); + +var msg37773 = msg("36035", dup314); + +var msg37774 = msg("36036", dup314); + +var msg37775 = msg("36037", dup311); + +var msg37776 = msg("36038", dup311); + +var msg37777 = msg("36039", dup311); + +var msg37778 = msg("36040", dup311); + +var msg37779 = msg("36041", dup322); + +var msg37780 = msg("36042", dup322); + +var msg37781 = msg("36043", dup322); + +var msg37782 = msg("36044", dup321); + +var msg37783 = msg("36045", dup321); + +var msg37784 = msg("36046", dup321); + +var msg37785 = msg("36047", dup321); + +var msg37786 = msg("36048", dup321); + +var msg37787 = msg("36049", dup322); + +var msg37788 = msg("36050", dup322); + +var msg37789 = msg("36051", dup322); + +var msg37790 = msg("36052", dup314); + +var msg37791 = msg("36053", dup316); + +var msg37792 = msg("36054", dup321); + +var msg37793 = msg("36055", dup329); + +var msg37794 = msg("36056", dup329); + +var msg37795 = msg("36057", dup314); + +var msg37796 = msg("36058", dup314); + +var msg37797 = msg("36059", dup324); + +var msg37798 = msg("36060", dup321); + +var msg37799 = msg("36061", dup322); + +var msg37800 = msg("36062", dup314); + +var msg37801 = msg("36063", dup314); + +var msg37802 = msg("36064", dup321); + +var msg37803 = msg("36065", dup321); + +var msg37804 = msg("36066", dup321); + +var msg37805 = msg("36067", dup307); + +var msg37806 = msg("36068", dup309); + +var msg37807 = msg("36069", dup309); + +var msg37808 = msg("36070", dup314); + +var msg37809 = msg("36071", dup311); + +var msg37810 = msg("36072", dup324); + +var msg37811 = msg("36073", dup324); + +var msg37812 = msg("36074", dup324); + +var msg37813 = msg("36075", dup324); + +var msg37814 = msg("36076", dup324); + +var msg37815 = msg("36077", dup324); + +var msg37816 = msg("36078", dup324); + +var msg37817 = msg("36079", dup324); + +var msg37818 = msg("36080", dup324); + +var msg37819 = msg("36081", dup324); + +var msg37820 = msg("36082", dup324); + +var msg37821 = msg("36083", dup324); + +var msg37822 = msg("36084", dup324); + +var msg37823 = msg("36085", dup324); + +var msg37824 = msg("36086", dup324); + +var msg37825 = msg("36087", dup324); + +var msg37826 = msg("36088", dup324); + +var msg37827 = msg("36089", dup324); + +var msg37828 = msg("36090", dup324); + +var msg37829 = msg("36091", dup324); + +var msg37830 = msg("36092", dup324); + +var msg37831 = msg("36093", dup324); + +var msg37832 = msg("36094", dup324); + +var msg37833 = msg("36095", dup324); + +var msg37834 = msg("36096", dup324); + +var msg37835 = msg("36097", dup322); + +var msg37836 = msg("36098", dup322); + +var msg37837 = msg("36099", dup322); + +var msg37838 = msg("36100", dup314); + +var msg37839 = msg("36101", dup325); + +var msg37840 = msg("36102", dup325); + +var msg37841 = msg("36103", dup321); + +var msg37842 = msg("36104", dup314); + +var msg37843 = msg("36105", dup321); + +var msg37844 = msg("36106", dup321); + +var msg37845 = msg("36107", dup321); + +var msg37846 = msg("36108", dup321); + +var msg37847 = msg("36109", dup314); + +var msg37848 = msg("36110", dup314); + +var msg37849 = msg("36111", dup314); + +var msg37850 = msg("36112", dup314); + +var msg37851 = msg("36113", dup309); + +var msg37852 = msg("36114", dup309); + +var msg37853 = msg("36115", dup321); + +var msg37854 = msg("36116", dup314); + +var msg37855 = msg("36117", dup314); + +var msg37856 = msg("36118", dup314); + +var msg37857 = msg("36119", dup314); + +var msg37858 = msg("36120", dup309); + +var msg37859 = msg("36121", dup309); + +var msg37860 = msg("36122", dup309); + +var msg37861 = msg("36123", dup309); + +var msg37862 = msg("36124", dup314); + +var msg37863 = msg("36125", dup314); + +var msg37864 = msg("36126", dup314); + +var msg37865 = msg("36127", dup314); + +var msg37866 = msg("36128", dup314); + +var msg37867 = msg("36129", dup314); + +var msg37868 = msg("36130", dup329); + +var msg37869 = msg("36131", dup325); + +var msg37870 = msg("36132", dup321); + +var msg37871 = msg("36133", dup321); + +var msg37872 = msg("36134", dup321); + +var msg37873 = msg("36135", dup311); + +var msg37874 = msg("36136", dup311); + +var msg37875 = msg("36137", dup311); + +var msg37876 = msg("36138", dup311); + +var msg37877 = msg("36139", dup311); + +var msg37878 = msg("36140", dup311); + +var msg37879 = msg("36141", dup311); + +var msg37880 = msg("36142", dup311); + +var msg37881 = msg("36143", dup311); + +var msg37882 = msg("36144", dup311); + +var msg37883 = msg("36145", dup311); + +var msg37884 = msg("36146", dup311); + +var msg37885 = msg("36147", dup309); + +var msg37886 = msg("36148", dup309); + +var msg37887 = msg("36149", dup311); + +var msg37888 = msg("36150", dup311); + +var msg37889 = msg("36151", dup311); + +var msg37890 = msg("36152", dup311); + +var msg37891 = msg("36153", dup309); + +var msg37892 = msg("36154", dup314); + +var msg37893 = msg("36155", dup314); + +var msg37894 = msg("36156", dup314); + +var msg37895 = msg("36157", dup314); + +var msg37896 = msg("36158", dup311); + +var msg37897 = msg("36159", dup311); + +var msg37898 = msg("36160", dup309); + +var msg37899 = msg("36161", dup309); + +var msg37900 = msg("36162", dup309); + +var msg37901 = msg("36163", dup309); + +var msg37902 = msg("36164", dup309); + +var msg37903 = msg("36165", dup309); + +var msg37904 = msg("36166", dup309); + +var msg37905 = msg("36167", dup309); + +var msg37906 = msg("36168", dup309); + +var msg37907 = msg("36169", dup309); + +var msg37908 = msg("36170", dup309); + +var msg37909 = msg("36171", dup309); + +var msg37910 = msg("36172", dup309); + +var msg37911 = msg("36173", dup309); + +var msg37912 = msg("36174", dup309); + +var msg37913 = msg("36175", dup309); + +var msg37914 = msg("36176", dup309); + +var msg37915 = msg("36177", dup309); + +var msg37916 = msg("36178", dup316); + +var msg37917 = msg("36179", dup316); + +var msg37918 = msg("36180", dup316); + +var msg37919 = msg("36181", dup316); + +var msg37920 = msg("36182", dup311); + +var msg37921 = msg("36183", dup309); + +var msg37922 = msg("36184", dup311); + +var msg37923 = msg("36185", dup321); + +var msg37924 = msg("36186", dup321); + +var msg37925 = msg("36187", dup314); + +var msg37926 = msg("36188", dup314); + +var msg37927 = msg("36189", dup314); + +var msg37928 = msg("36190", dup314); + +var msg37929 = msg("36191", dup309); + +var msg37930 = msg("36192", dup309); + +var msg37931 = msg("36193", dup311); + +var msg37932 = msg("36194", dup309); + +var msg37933 = msg("36195", dup309); + +var msg37934 = msg("36196", dup309); + +var msg37935 = msg("36197", dup316); + +var msg37936 = msg("36198", dup321); + +var msg37937 = msg("36199", dup321); + +var msg37938 = msg("36200", dup321); + +var msg37939 = msg("36201", dup311); + +var msg37940 = msg("36202", dup321); + +var msg37941 = msg("36203", dup309); + +var msg37942 = msg("36204", dup309); + +var msg37943 = msg("36205", dup321); + +var msg37944 = msg("36206", dup321); + +var msg37945 = msg("36207", dup321); + +var msg37946 = msg("36208", dup314); + +var msg37947 = msg("36209", dup314); + +var msg37948 = msg("36224", dup323); + +var msg37949 = msg("36231", dup321); + +var msg37950 = msg("36232", dup321); + +var msg37951 = msg("36233", dup321); + +var msg37952 = msg("36234", dup321); + +var msg37953 = msg("36235", dup325); + +var msg37954 = msg("36236", dup325); + +var msg37955 = msg("36237", dup325); + +var msg37956 = msg("36238", dup325); + +var msg37957 = msg("36239", dup314); + +var msg37958 = msg("36240", dup314); + +var msg37959 = msg("36241", dup321); + +var msg37960 = msg("36242", dup314); + +var msg37961 = msg("36243", dup314); + +var msg37962 = msg("36244", dup309); + +var msg37963 = msg("36245", dup309); + +var msg37964 = msg("36246", dup323); + +var msg37965 = msg("36247", dup311); + +var msg37966 = msg("36248", dup311); + +var msg37967 = msg("36249", dup311); + +var msg37968 = msg("36250", dup309); + +var msg37969 = msg("36251", dup311); + +var msg37970 = msg("36252", dup324); + +var msg37971 = msg("36253", dup314); + +var msg37972 = msg("36254", dup311); + +var msg37973 = msg("36255", dup311); + +var msg37974 = msg("36256", dup314); + +var msg37975 = msg("36257", dup309); + +var msg37976 = msg("36258", dup309); + +var msg37977 = msg("36259", dup309); + +var msg37978 = msg("36260", dup309); + +var msg37979 = msg("36261", dup324); + +var msg37980 = msg("36262", dup324); + +var msg37981 = msg("36263", dup314); + +var msg37982 = msg("36264", dup314); + +var msg37983 = msg("36265", dup314); + +var msg37984 = msg("36266", dup314); + +var msg37985 = msg("36267", dup321); + +var msg37986 = msg("36268", dup321); + +var msg37987 = msg("36269", dup321); + +var msg37988 = msg("36270", dup316); + +var msg37989 = msg("36271", dup311); + +var msg37990 = msg("36272", dup314); + +var msg37991 = msg("36273", dup321); + +var msg37992 = msg("36274", dup321); + +var msg37993 = msg("36275", dup321); + +var msg37994 = msg("36276", dup321); + +var msg37995 = msg("36277", dup323); + +var msg37996 = msg("36278", dup323); + +var msg37997 = msg("36279", dup323); + +var msg37998 = msg("36280", dup323); + +var msg37999 = msg("36281", dup311); + +var msg38000 = msg("36282", dup314); + +var msg38001 = msg("36283", dup322); + +var msg38002 = msg("36284", dup322); + +var msg38003 = msg("36285", dup322); + +var msg38004 = msg("36286", dup311); + +var msg38005 = msg("36287", dup314); + +var msg38006 = msg("36288", dup314); + +var msg38007 = msg("36289", dup314); + +var msg38008 = msg("36290", dup314); + +var msg38009 = msg("36291", dup314); + +var msg38010 = msg("36292", dup314); + +var msg38011 = msg("36293", dup321); + +var msg38012 = msg("36294", dup321); + +var msg38013 = msg("36295", dup311); + +var msg38014 = msg("36296", dup311); + +var msg38015 = msg("36297", dup314); + +var msg38016 = msg("36298", dup314); + +var msg38017 = msg("36299", dup314); + +var msg38018 = msg("36300", dup314); + +var msg38019 = msg("36301", dup314); + +var msg38020 = msg("36302", dup314); + +var msg38021 = msg("36303", dup321); + +var msg38022 = msg("36304", dup321); + +var msg38023 = msg("36305", dup309); + +var msg38024 = msg("36306", dup309); + +var msg38025 = msg("36307", dup309); + +var msg38026 = msg("36308", dup309); + +var msg38027 = msg("36309", dup309); + +var msg38028 = msg("36310", dup309); + +var msg38029 = msg("36311", dup314); + +var msg38030 = msg("36312", dup314); + +var msg38031 = msg("36313", dup314); + +var msg38032 = msg("36314", dup314); + +var msg38033 = msg("36315", dup311); + +var msg38034 = msg("36316", dup314); + +var msg38035 = msg("36317", dup314); + +var msg38036 = msg("36318", dup314); + +var msg38037 = msg("36319", dup314); + +var msg38038 = msg("36320", dup314); + +var msg38039 = msg("36321", dup314); + +var msg38040 = msg("36322", dup314); + +var msg38041 = msg("36323", dup314); + +var msg38042 = msg("36324", dup314); + +var msg38043 = msg("36325", dup321); + +var msg38044 = msg("36326", dup321); + +var msg38045 = msg("36327", dup321); + +var msg38046 = msg("36328", dup321); + +var msg38047 = msg("36329", dup321); + +var msg38048 = msg("36330", dup314); + +var msg38049 = msg("36331", dup321); + +var msg38050 = msg("36332", dup311); + +var msg38051 = msg("36333", dup314); + +var msg38052 = msg("36334", dup314); + +var msg38053 = msg("36335", dup314); + +var msg38054 = msg("36336", dup314); + +var msg38055 = msg("36337", dup314); + +var msg38056 = msg("36338", dup310); + +var msg38057 = msg("36339", dup311); + +var msg38058 = msg("36340", dup311); + +var msg38059 = msg("36341", dup311); + +var msg38060 = msg("36342", dup311); + +var msg38061 = msg("36343", dup311); + +var msg38062 = msg("36344", dup311); + +var msg38063 = msg("36345", dup311); + +var msg38064 = msg("36346", dup311); + +var msg38065 = msg("36347", dup311); + +var msg38066 = msg("36348", dup311); + +var msg38067 = msg("36349", dup314); + +var msg38068 = msg("36350", dup314); + +var msg38069 = msg("36351", dup314); + +var msg38070 = msg("36352", dup314); + +var msg38071 = msg("36353", dup314); + +var msg38072 = msg("36354", dup314); + +var msg38073 = msg("36355", dup314); + +var msg38074 = msg("36356", dup314); + +var msg38075 = msg("36357", dup314); + +var msg38076 = msg("36358", dup314); + +var msg38077 = msg("36359", dup311); + +var msg38078 = msg("36360", dup311); + +var msg38079 = msg("36361", dup311); + +var msg38080 = msg("36362", dup311); + +var msg38081 = msg("36363", dup311); + +var msg38082 = msg("36364", dup311); + +var msg38083 = msg("36365", dup311); + +var msg38084 = msg("36366", dup311); + +var msg38085 = msg("36367", dup309); + +var msg38086 = msg("36368", dup309); + +var msg38087 = msg("36369", dup309); + +var msg38088 = msg("36370", dup309); + +var msg38089 = msg("36371", dup311); + +var msg38090 = msg("36372", dup311); + +var msg38091 = msg("36373", dup311); + +var msg38092 = msg("36374", dup311); + +var msg38093 = msg("36375", dup310); + +var msg38094 = msg("36376", dup309); + +var msg38095 = msg("36377", dup324); + +var msg38096 = msg("36378", dup324); + +var msg38097 = msg("36379", dup327); + +var msg38098 = msg("36380", dup314); + +var msg38099 = msg("36381", dup321); + +var msg38100 = msg("36382", dup321); + +var msg38101 = msg("36383", dup314); + +var msg38102 = msg("36384", dup314); + +var msg38103 = msg("36389", dup321); + +var msg38104 = msg("36390", dup321); + +var msg38105 = msg("36391", dup321); + +var msg38106 = msg("36392", dup321); + +var msg38107 = msg("36393", dup321); + +var msg38108 = msg("36394", dup321); + +var msg38109 = msg("36395", dup321); + +var msg38110 = msg("36396", dup321); + +var msg38111 = msg("36397", dup321); + +var msg38112 = msg("36398", dup311); + +var msg38113 = msg("36399", dup311); + +var msg38114 = msg("36400", dup311); + +var msg38115 = msg("36401", dup325); + +var msg38116 = msg("36402", dup325); + +var msg38117 = msg("36403", dup314); + +var msg38118 = msg("36404", dup314); + +var msg38119 = msg("36405", dup314); + +var msg38120 = msg("36406", dup314); + +var msg38121 = msg("36407", dup311); + +var msg38122 = msg("36408", dup311); + +var msg38123 = msg("36409", dup311); + +var msg38124 = msg("36410", dup311); + +var msg38125 = msg("36411", dup325); + +var msg38126 = msg("36412", dup325); + +var msg38127 = msg("36413", dup325); + +var msg38128 = msg("36414", dup325); + +var msg38129 = msg("36415", dup311); + +var msg38130 = msg("36416", dup311); + +var msg38131 = msg("36417", dup325); + +var msg38132 = msg("36418", dup325); + +var msg38133 = msg("36419", dup314); + +var msg38134 = msg("36420", dup314); + +var msg38135 = msg("36421", dup314); + +var msg38136 = msg("36422", dup314); + +var msg38137 = msg("36423", dup325); + +var msg38138 = msg("36424", dup325); + +var msg38139 = msg("36425", dup309); + +var msg38140 = msg("36426", dup309); + +var msg38141 = msg("36427", dup309); + +var msg38142 = msg("36428", dup309); + +var msg38143 = msg("36429", dup309); + +var msg38144 = msg("36430", dup309); + +var msg38145 = msg("36431", dup311); + +var msg38146 = msg("36432", dup311); + +var msg38147 = msg("36433", dup325); + +var msg38148 = msg("36434", dup325); + +var msg38149 = msg("36435", dup314); + +var msg38150 = msg("36436", dup325); + +var msg38151 = msg("36437", dup325); + +var msg38152 = msg("36438", dup325); + +var msg38153 = msg("36439", dup325); + +var msg38154 = msg("36440", dup325); + +var msg38155 = msg("36441", dup311); + +var msg38156 = msg("36442", dup311); + +var msg38157 = msg("36443", dup325); + +var msg38158 = msg("36444", dup325); + +var msg38159 = msg("36445", dup314); + +var msg38160 = msg("36446", dup314); + +var msg38161 = msg("36447", dup309); + +var msg38162 = msg("36448", dup309); + +var msg38163 = msg("36449", dup308); + +var msg38164 = msg("36450", dup325); + +var msg38165 = msg("36451", dup325); + +var msg38166 = msg("36452", dup311); + +var msg38167 = msg("36453", dup311); + +var msg38168 = msg("36454", dup311); + +var msg38169 = msg("36455", dup311); + +var msg38170 = msg("36456", dup309); + +var msg38171 = msg("36457", dup311); + +var msg38172 = msg("36458", dup323); + +var msg38173 = msg("36459", dup323); + +var msg38174 = msg("36460", dup321); + +var msg38175 = msg("36461", dup309); + +var msg38176 = msg("36462", dup309); + +var msg38177 = msg("36463", dup309); + +var msg38178 = msg("36464", dup321); + +var msg38179 = msg("36465", dup321); + +var msg38180 = msg("36466", dup321); + +var msg38181 = msg("36467", dup321); + +var msg38182 = msg("36468", dup321); + +var msg38183 = msg("36469", dup321); + +var msg38184 = msg("36470", dup321); + +var msg38185 = msg("36471", dup321); + +var msg38186 = msg("36472", dup314); + +var msg38187 = msg("36473", dup314); + +var msg38188 = msg("36474", dup314); + +var msg38189 = msg("36475", dup314); + +var msg38190 = msg("36476", dup314); + +var msg38191 = msg("36477", dup314); + +var msg38192 = msg("36478", dup314); + +var msg38193 = msg("36479", dup314); + +var msg38194 = msg("36480", dup314); + +var msg38195 = msg("36481", dup314); + +var msg38196 = msg("36482", dup314); + +var msg38197 = msg("36483", dup314); + +var msg38198 = msg("36484", dup314); + +var msg38199 = msg("36485", dup314); + +var msg38200 = msg("36486", dup314); + +var msg38201 = msg("36487", dup314); + +var msg38202 = msg("36488", dup314); + +var msg38203 = msg("36489", dup314); + +var msg38204 = msg("36490", dup314); + +var msg38205 = msg("36491", dup314); + +var msg38206 = msg("36492", dup311); + +var msg38207 = msg("36493", dup309); + +var msg38208 = msg("36494", dup323); + +var msg38209 = msg("36495", dup314); + +var msg38210 = msg("36496", dup314); + +var msg38211 = msg("36497", dup321); + +var msg38212 = msg("36498", dup309); + +var msg38213 = msg("36499", dup309); + +var msg38214 = msg("36500", dup309); + +var msg38215 = msg("36501", dup309); + +var msg38216 = msg("36502", dup314); + +var msg38217 = msg("36503", dup314); + +var msg38218 = msg("36504", dup314); + +var msg38219 = msg("36505", dup314); + +var msg38220 = msg("36506", dup321); + +var msg38221 = msg("36507", dup323); + +var msg38222 = msg("36508", dup323); + +var msg38223 = msg("36509", dup323); + +var msg38224 = msg("36510", dup323); + +var msg38225 = msg("36511", dup314); + +var msg38226 = msg("36512", dup314); + +var msg38227 = msg("36513", dup314); + +var msg38228 = msg("36514", dup314); + +var msg38229 = msg("36515", dup314); + +var msg38230 = msg("36516", dup314); + +var msg38231 = msg("36517", dup314); + +var msg38232 = msg("36518", dup321); + +var msg38233 = msg("36519", dup321); + +var msg38234 = msg("36520", dup321); + +var msg38235 = msg("36521", dup321); + +var msg38236 = msg("36522", dup321); + +var msg38237 = msg("36523", dup311); + +var msg38238 = msg("36524", dup309); + +var msg38239 = msg("36525", dup309); + +var msg38240 = msg("36526", dup321); + +var msg38241 = msg("36527", dup311); + +var msg38242 = msg("36528", dup311); + +var msg38243 = msg("36529", dup311); + +var msg38244 = msg("36530", dup311); + +var msg38245 = msg("36531", dup314); + +var msg38246 = msg("36532", dup311); + +var msg38247 = msg("36533", dup314); + +var msg38248 = msg("36534", dup314); + +var msg38249 = msg("36535", dup311); + +var msg38250 = msg("36536", dup309); + +var msg38251 = msg("36537", dup321); + +var msg38252 = msg("36538", dup321); + +var msg38253 = msg("36539", dup321); + +var msg38254 = msg("36540", dup321); + +var msg38255 = msg("36541", dup314); + +var msg38256 = msg("36542", dup309); + +var msg38257 = msg("36543", dup311); + +var msg38258 = msg("36544", dup323); + +var msg38259 = msg("36545", dup311); + +var msg38260 = msg("36546", dup311); + +var msg38261 = msg("36547", dup311); + +var msg38262 = msg("36548", dup311); + +var msg38263 = msg("36549", dup314); + +var msg38264 = msg("36550", dup314); + +var msg38265 = msg("36551", dup314); + +var msg38266 = msg("36552", dup314); + +var msg38267 = msg("36553", dup314); + +var msg38268 = msg("36554", dup314); + +var msg38269 = msg("36555", dup314); + +var msg38270 = msg("36556", dup314); + +var msg38271 = msg("36557", dup324); + +var msg38272 = msg("36558", dup324); + +var msg38273 = msg("36559", dup311); + +var msg38274 = msg("36560", dup311); + +var msg38275 = msg("36561", dup314); + +var msg38276 = msg("600009", dup196); + +var msg38277 = msg("600010", dup265); + +var msg38278 = msg("600015", dup265); + +var msg38279 = msg("6000022", dup353); + +var msg38280 = msg("600023", dup196); + +var msg38281 = msg("6000025", dup353); + +var msg38282 = msg("1000001", dup246); + +var msg38283 = msg("1000002", dup246); + +var msg38284 = msg("1000003", dup196); + +var all65 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var msg38285 = msg("1000003:01", all65); + +var select2443 = linear_select([ + msg38284, + msg38285, +]); + +var msg38286 = msg("1000004", dup196); + +var msg38287 = msg("1000005", dup196); + +var msg38288 = msg("1000007", dup265); + +var msg38289 = msg("1000010", dup230); + +var msg38290 = msg("1000012", dup196); + +var msg38291 = msg("1000014", dup265); + +var msg38292 = msg("1000015", dup297); + +var msg38293 = msg("1000016", dup242); + +var msg38294 = msg("1000020", dup192); + +var msg38295 = msg("1000021", dup276); + +var msg38296 = msg("1000022", dup276); + +var msg38297 = msg("1000023", dup196); + +var msg38298 = msg("1000024", dup196); + +var msg38299 = msg("1000026", dup192); + +var msg38300 = msg("1000028", dup196); + +var msg38301 = msg("1000029", dup265); + +var msg38302 = msg("1000030", dup196); + +var msg38303 = msg("1000031", dup265); + +var msg38304 = msg("1000032", dup285); + +var msg38305 = msg("1000033", dup265); + +var msg38306 = msg("1000034", dup265); + +var msg38307 = msg("1000035", dup265); + +var msg38308 = msg("1000036", dup196); + +var msg38309 = msg("1000037", dup196); + +var msg38310 = msg("1000038", dup196); + +var msg38311 = msg("1000039", dup265); + +var msg38312 = msg("1000040", dup265); + +var msg38313 = msg("1000041", dup196); + +var msg38314 = msg("1000043", dup265); + +var msg38315 = msg("1000044", dup196); + +var msg38316 = msg("1000045", dup196); + +var msg38317 = msg("1000046", dup196); + +var msg38318 = msg("1000047", dup196); + +var msg38319 = msg("1000048", dup196); + +var msg38320 = msg("1000049", dup265); + +var msg38321 = msg("1000050", dup265); + +var msg38322 = msg("1000054", dup196); + +var msg38323 = msg("1000055", dup196); + +var msg38324 = msg("1000056", dup196); + +var msg38325 = msg("1000057", dup196); + +var msg38326 = msg("2000480", dup230); + +var msg38327 = msg("2000538", dup194); + +var msg38328 = msg("2000540", dup194); + +var msg38329 = msg("2000562", dup263); + +var msg38330 = msg("2000648", dup196); + +var msg38331 = msg("2000716", dup248); + +var msg38332 = msg("2000969", dup265); + +var msg38333 = msg("2000971", dup265); + +var msg38334 = msg("2000974", dup265); + +var msg38335 = msg("2000976", dup265); + +var msg38336 = msg("2000977", dup265); + +var msg38337 = msg("2000987", dup265); + +var msg38338 = msg("2000990", dup265); + +var msg38339 = msg("2000993", dup265); + +var msg38340 = msg("2000997", dup265); + +var msg38341 = msg("2001002", dup265); + +var msg38342 = msg("2001010", dup265); + +var msg38343 = msg("2001012", dup265); + +var msg38344 = msg("2001013", dup265); + +var msg38345 = msg("2001023", dup265); + +var msg38346 = msg("2001025", dup265); + +var msg38347 = msg("2001030", dup265); + +var msg38348 = msg("2001040", dup265); + +var msg38349 = msg("2001042", dup196); + +var msg38350 = msg("2001244", dup265); + +var msg38351 = msg("2001245", dup265); + +var msg38352 = msg("2001286", dup265); + +var msg38353 = msg("2001287", dup265); + +var msg38354 = msg("2001288", dup265); + +var msg38355 = msg("2001367", dup265); + +var msg38356 = msg("2001400", dup265); + +var msg38357 = msg("2001402", dup265); + +var msg38358 = msg("2001411", dup242); + +var msg38359 = msg("2001417", dup242); + +var msg38360 = msg("2001419", dup242); + +var msg38361 = msg("2001567", dup265); + +var msg38362 = msg("2001568", dup265); + +var msg38363 = msg("2001569", dup194); + +var msg38364 = msg("2001579", dup194); + +var msg38365 = msg("2001581", dup194); + +var msg38366 = msg("2001726", dup265); + +var msg38367 = msg("2001801", dup267); + +var msg38368 = msg("2001852", dup265); + +var msg38369 = msg("2001893", dup242); + +var msg38370 = msg("2001904", dup194); + +var msg38371 = msg("2001945", dup265); + +var msg38372 = msg("2001970", dup297); + +var msg38373 = msg("2001972", dup194); + +var msg38374 = msg("2002032", dup192); + +var msg38375 = msg("2002134", dup265); + +var msg38376 = msg("2002170", dup196); + +var msg38377 = msg("2002176", dup265); + +var msg38378 = msg("2002190", dup265); + +var msg38379 = msg("2002196", dup196); + +var msg38380 = msg("2002200", dup265); + +var msg38381 = msg("2002205", dup303); + +var msg38382 = msg("2002910", dup194); + +var msg38383 = msg("2002911", dup194); + +var msg38384 = msg("2002992", dup194); + +var msg38385 = msg("2002993", dup194); + +var msg38386 = msg("2002994", dup194); + +var msg38387 = msg("2003157", dup192); + +var msg38388 = msg("2003183", dup192); + +var msg38389 = msg("2003380", dup192); + +var msg38390 = msg("2003642", dup192); + +var msg38391 = msg("2003870", dup194); + +var msg38392 = msg("2007142", dup192); + +var msg38393 = msg("2007585", dup192); + +var msg38394 = msg("2007588", dup192); + +var msg38395 = msg("2007594", dup192); + +var msg38396 = msg("2007688", dup192); + +var msg38397 = msg("2007702", dup192); + +var msg38398 = msg("2007724", dup192); + +var msg38399 = msg("2007920", dup192); + +var msg38400 = msg("2007962", dup192); + +var msg38401 = msg("2007963", dup265); + +var msg38402 = msg("2007964", dup192); + +var msg38403 = msg("2008010", dup192); + +var msg38404 = msg("2008056", dup192); + +var msg38405 = msg("2008059", dup192); + +var msg38406 = msg("2008082", dup192); + +var msg38407 = msg("2008109", dup192); + +var msg38408 = msg("2008124", dup192); + +var msg38409 = msg("2008143", dup192); + +var msg38410 = msg("2008182", dup192); + +var msg38411 = msg("2008194", dup192); + +var msg38412 = msg("2008335", dup192); + +var msg38413 = msg("2008373", dup196); + +var msg38414 = msg("2008384", dup192); + +var msg38415 = msg("2008386", dup192); + +var msg38416 = msg("2008420", dup192); + +var msg38417 = msg("2008475", dup196); + +var msg38418 = msg("2008480", dup192); + +var msg38419 = msg("2008505", dup196); + +var msg38420 = msg("2404003", dup196); + +var msg38421 = msg("2404011", dup196); + +var msg38422 = msg("2404013", dup196); + +var msg38423 = msg("2404015", dup196); + +var msg38424 = msg("2404016", dup196); + +var msg38425 = msg("3000005", dup194); + +var msg38426 = msg("3404269", dup194); + +var msg38427 = msg("3404272", dup194); + +var msg38428 = msg("8888888", dup314); + +var msg38429 = msg("8888889", dup314); + +var msg38430 = msg("100000121", dup265); + +var msg38431 = msg("100000122", dup267); + +var msg38432 = msg("100000137", dup287); + +var msg38433 = msg("100000138", dup265); + +var msg38434 = msg("100000160", dup197); + +var msg38435 = msg("100000161", dup287); + +var msg38436 = msg("100000185", dup265); + +var msg38437 = msg("100000211", dup265); + +var msg38438 = msg("100000213", dup265); + +var msg38439 = msg("100000219", dup250); + +var msg38440 = msg("100000241", dup196); + +var msg38441 = msg("100000262", dup196); + +var msg38442 = msg("100000266", dup196); + +var msg38443 = msg("100000272", dup196); + +var msg38444 = msg("100000273", dup196); + +var msg38445 = msg("100000274", dup194); + +var msg38446 = msg("100000275", dup194); + +var msg38447 = msg("100000277", dup196); + +var msg38448 = msg("100000278", dup196); + +var msg38449 = msg("100000550", dup265); + +var msg38450 = msg("100000687", dup198); + +var msg38451 = msg("100000689", dup250); + +var all66 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup127, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg38452 = msg("snort-sid-template", all66); + +var part13 = // "Pattern{Constant('PORTSCAN DETECTED from '), Field(p0,false)}" +match("MESSAGE#38452:spp_portscan/0", "nwparser.payload", "PORTSCAN DETECTED from %{p0}"); + +var part14 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(')(THRESHOLD '), Field(p0,false)}" +match("MESSAGE#38452:spp_portscan/1_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src})(THRESHOLD %{p0}"); + +var part15 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,false), Constant('(THRESHOLD '), Field(p0,false)}" +match("MESSAGE#38452:spp_portscan/1_1", "nwparser.p0", "%{saddr}:%{sport}(THRESHOLD %{p0}"); + +var part16 = // "Pattern{Field(saddr,false), Constant('(THRESHOLD '), Field(p0,false)}" +match("MESSAGE#38452:spp_portscan/1_2", "nwparser.p0", "%{saddr}(THRESHOLD %{p0}"); + +var select2444 = linear_select([ + part14, + part15, + part16, +]); + +var part17 = // "Pattern{Field(dclass_counter1,true), Constant(' connections exceeded in '), Field(duration,true), Constant(' seconds)')}" +match("MESSAGE#38452:spp_portscan/2", "nwparser.p0", "%{dclass_counter1->} connections exceeded in %{duration->} seconds)"); + +var all67 = all_match({ + processors: [ + part13, + select2444, + part17, + ], + on_success: processor_chain([ + dup61, + dup31, + dup128, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var msg38453 = msg("spp_portscan", all67); + +var part18 = // "Pattern{Constant('portscan status from '), Field(saddr,false), Constant(': '), Field(dclass_counter1,true), Constant(' connections across '), Field(fld1,true), Constant(' hosts: '), Field(fld2,false), Constant(', '), Field(fld3,false)}" +match("MESSAGE#38453:spp_portscan:01", "nwparser.payload", "portscan status from %{saddr}: %{dclass_counter1->} connections across %{fld1->} hosts: %{fld2}, %{fld3}", processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup128, +])); + +var msg38454 = msg("spp_portscan:01", part18); + +var part19 = // "Pattern{Constant('End of portscan from '), Field(saddr,false), Constant(': TOTAL time('), Field(fld1,false), Constant(') hosts('), Field(fld2,false), Constant(') '), Field(fld3,true), Constant(' '), Field(fld4,false)}" +match("MESSAGE#38454:spp_portscan:02", "nwparser.payload", "End of portscan from %{saddr}: TOTAL time(%{fld1}) hosts(%{fld2}) %{fld3->} %{fld4}", processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, +])); + +var msg38455 = msg("spp_portscan:02", part19); + +var msg38456 = msg("spp_portscan:03", dup194); + +var select2445 = linear_select([ + msg38453, + msg38454, + msg38455, + msg38456, +]); + +var part20 = // "Pattern{Constant('Portscan detected from '), Field(saddr,true), Constant(' Talker('), Field(fld1,false), Constant(') Scanner('), Field(fld2,false), Constant(')')}" +match("MESSAGE#38456:Portscan", "nwparser.payload", "Portscan detected from %{saddr->} Talker(%{fld1}) Scanner(%{fld2})", processor_chain([ + dup61, + dup31, + dup32, +])); + +var msg38457 = msg("Portscan", part20); + +var part21 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Hops: '), Field(result,false)}" +match("MESSAGE#38457:Hops_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Hops: %{result}", processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38458 = msg("Hops_Change", part21); + +var msg38459 = msg("MAC_Information_Change", dup354); + +var msg38460 = msg("Additional_MAC_Detected_for", dup354); + +var part22 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' NETBIOS Name: '), Field(result,false)}" +match("MESSAGE#38460:NETBIOS_Name_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} NETBIOS Name: %{result}", processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38461 = msg("NETBIOS_Name_Change", part22); + +var part23 = // "Pattern{Constant('MAC Address: '), Field(smacaddr,true), Constant(' Host Type: '), Field(p0,false)}" +match("MESSAGE#38461:New_Host/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Host Type: %{p0}"); + +var part24 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Host Type: '), Field(p0,false)}" +match("MESSAGE#38461:New_Host/1_1", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{p0}"); + +var select2446 = linear_select([ + part23, + part24, +]); + +var part25 = // "Pattern{Field(fld7,false)}" +match_copy("MESSAGE#38461:New_Host/2", "nwparser.p0", "fld7"); + +var all68 = all_match({ + processors: [ + dup133, + select2446, + part25, + ], + on_success: processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var msg38462 = msg("New_Host", all68); + +var part26 = // "Pattern{Constant('MAC Address: '), Field(smacaddr,true), Constant(' Network Protocol: '), Field(p0,false)}" +match("MESSAGE#38462:New_Network_Protocol/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Network Protocol: %{p0}"); + +var part27 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Network Protocol: '), Field(p0,false)}" +match("MESSAGE#38462:New_Network_Protocol/1_1", "nwparser.p0", "IP Address: %{saddr->} Network Protocol: %{p0}"); + +var select2447 = linear_select([ + part26, + part27, +]); + +var all69 = all_match({ + processors: [ + dup133, + select2447, + dup134, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var msg38463 = msg("New_Network_Protocol", all69); + +var part28 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(protocol,false)}" +match("MESSAGE#38463:New_UDP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{protocol}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38464 = msg("New_UDP_Service", part28); + +var part29 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Transport Protocol: '), Field(protocol,false)}" +match("MESSAGE#38464:New_Transport_Protocol", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Transport Protocol: %{protocol}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38465 = msg("New_Transport_Protocol", part29); + +var msg38466 = msg("OS_Confidence_Update", dup183); + +var msg38467 = msg("OS_Information_Update", dup183); + +var msg38468 = msg("TCP_Service_Confidence_Update", dup184); + +var part30 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" +match("MESSAGE#38468:TCP_Service_Information_Update/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); + +var all70 = all_match({ + processors: [ + part30, + dup185, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var msg38469 = msg("TCP_Service_Information_Update", all70); + +var part31 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> MAC Address: '), Field(saddr,true), Constant(' VLAN ID: '), Field(sport,true), Constant(' Type: '), Field(protocol,true), Constant(' Priority: '), Field(threat_val,false)}" +match("MESSAGE#38469:VLAN_Tag_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> MAC Address: %{saddr->} VLAN ID: %{sport->} Type: %{protocol->} Priority: %{threat_val}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, + dup45, +])); + +var msg38470 = msg("VLAN_Tag_Information_Update", part31); + +var part32 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(p0,false)}" +match("MESSAGE#38470:New_OS/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{p0}"); + +var part33 = // "Pattern{Field(os,true), Constant(' Device Info: '), Field(fld7,false)}" +match("MESSAGE#38470:New_OS/1_0", "nwparser.p0", "%{os->} Device Info: %{fld7}"); + +var part34 = // "Pattern{Field(os,false)}" +match_copy("MESSAGE#38470:New_OS/1_1", "nwparser.p0", "os"); + +var select2448 = linear_select([ + part33, + part34, +]); + +var all71 = all_match({ + processors: [ + part32, + select2448, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var msg38471 = msg("New_OS", all71); + +var msg38472 = msg("New_Client_Application", dup186); + +var msg38473 = msg("Client_Application_Update", dup186); + +var msg38474 = msg("New_TCP_Service", dup187); + +var msg38475 = msg("TCP_Port_Closed", dup187); + +var msg38476 = msg("TCP_Port_Timeout", dup188); + +var part35 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' web browser '), Field(application,false)}" +match("MESSAGE#38476:Client_Application_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} web browser %{application}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38477 = msg("Client_Application_Timeout", part35); + +var msg38478 = msg("Host_Timeout", dup188); + +var part36 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS'), Field(os,false)}" +match("MESSAGE#38478:Identity_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS%{os}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38479 = msg("Identity_Timeout", part36); + +var part37 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Serv'), Field(p0,false)}" +match("MESSAGE#38479:Identity_Timeout:01/0", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Serv%{p0}"); + +var part38 = // "Pattern{Constant('ice'), Field(p0,false)}" +match("MESSAGE#38479:Identity_Timeout:01/1_0", "nwparser.p0", "ice%{p0}"); + +var part39 = // "Pattern{Constant('er'), Field(p0,false)}" +match("MESSAGE#38479:Identity_Timeout:01/1_1", "nwparser.p0", "er%{p0}"); + +var select2449 = linear_select([ + part38, + part39, +]); + +var part40 = // "Pattern{Field(,false), Constant('port: '), Field(sport,false), Constant('/'), Field(protocol,true), Constant(' '), Field(network_service,false)}" +match("MESSAGE#38479:Identity_Timeout:01/2", "nwparser.p0", "%{}port: %{sport}/%{protocol->} %{network_service}"); + +var all72 = all_match({ + processors: [ + part37, + select2449, + part40, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var msg38480 = msg("Identity_Timeout:01", all72); + +var select2450 = linear_select([ + msg38479, + msg38480, +]); + +var msg38481 = msg("UDP_Port_Timeout", dup188); + +var msg38482 = msg("UDP_Service_Confidence_Update", dup184); + +var part41 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,true), Constant(' Subtypes: '), Field(fld1,false)}" +match("MESSAGE#38482:UDP_Service_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result->} Subtypes: %{fld1}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var msg38483 = msg("UDP_Service_Information_Update", part41); + +var msg38484 = msg("UDP_Service_Information_Update:01", dup184); + +var select2451 = linear_select([ + msg38483, + msg38484, +]); + +var part42 = // "Pattern{Field(context,true), Constant(' ['), Field(p0,false)}" +match("MESSAGE#38484:EmergingThreats/0", "nwparser.payload", "%{context->} [%{p0}"); + +var part43 = // "Pattern{Constant('Impact: '), Field(result,false), Constant('] From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(p0,false)}" +match("MESSAGE#38484:EmergingThreats/1_0", "nwparser.p0", "Impact: %{result}] From \"%{sensor}\" at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{p0}"); + +var part44 = // "Pattern{Constant('Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(p0,false)}" +match("MESSAGE#38484:EmergingThreats/1_1", "nwparser.p0", "Classification: %{sigtype}] [Priority: %{p0}"); + +var part45 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(p0,false)}" +match("MESSAGE#38484:EmergingThreats/1_2", "nwparser.p0", "%{info}] [Priority: %{p0}"); + +var select2452 = linear_select([ + part43, + part44, + part45, +]); + +var part46 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" +match("MESSAGE#38484:EmergingThreats/2", "nwparser.p0", "%{threat_val->} ]%{p0}"); + +var all73 = all_match({ + processors: [ + part42, + select2452, + part46, + dup178, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + setf("sigid","hsigid"), + dup51, + dup76, + dup56, + ]), +}); + +var msg38485 = msg("EmergingThreats", all73); + +var part47 = // "Pattern{Constant('Pruned session from cache that was using '), Field(bytes,true), Constant(' bytes ('), Field(result,false), Constant('). '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' --> '), Field(daddr,true), Constant(' '), Field(fld2,true), Constant(' ('), Field(fld3,false), Constant(') : '), Field(info,false)}" +match("MESSAGE#38485:S5", "nwparser.payload", "Pruned session from cache that was using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ + dup127, + dup31, + dup32, +])); + +var msg38486 = msg("S5", part47); + +var part48 = // "Pattern{Constant('Session exceeded configured max bytes to queue '), Field(fld4,true), Constant(' using '), Field(bytes,true), Constant(' bytes ('), Field(result,false), Constant('). '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' --> '), Field(daddr,true), Constant(' '), Field(fld2,true), Constant(' ('), Field(fld3,false), Constant(') : '), Field(info,false)}" +match("MESSAGE#38486:S5:01", "nwparser.payload", "Session exceeded configured max bytes to queue %{fld4->} using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ + dup127, + dup31, + dup32, +])); + +var msg38487 = msg("S5:01", part48); + +var select2453 = linear_select([ + msg38486, + msg38487, +]); + +var part49 = // "Pattern{Constant('Login, Login Success'), Field(,false)}" +match("MESSAGE#38487:SystemSettings:01", "nwparser.payload", "Login, Login Success%{}", processor_chain([ + dup112, + dup31, + dup32, + dup137, + dup138, + dup139, + dup140, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38488 = msg("SystemSettings:01", part49); + +var part50 = // "Pattern{Constant('Logout, Logout Success'), Field(,false)}" +match("MESSAGE#38488:SystemSettings:02", "nwparser.payload", "Logout, Logout Success%{}", processor_chain([ + setc("eventcategory","1802000000"), + dup31, + dup32, + dup137, + dup144, + dup139, + dup140, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38489 = msg("SystemSettings:02", part50); + +var part51 = // "Pattern{Constant('System > '), Field(info,false)}" +match("MESSAGE#38489:SystemSettings:03", "nwparser.payload", "System > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","System"), +])); + +var msg38490 = msg("SystemSettings:03", part51); + +var part52 = // "Pattern{Constant('Policies > '), Field(info,false)}" +match("MESSAGE#38490:SystemSettings:04", "nwparser.payload", "Policies > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Policies"), +])); + +var msg38491 = msg("SystemSettings:04", part52); + +var part53 = // "Pattern{Constant('Object > '), Field(info,false)}" +match("MESSAGE#38491:SystemSettings:05", "nwparser.payload", "Object > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38492 = msg("SystemSettings:05", part53); + +var part54 = // "Pattern{Constant('Overview > '), Field(info,false)}" +match("MESSAGE#38492:SystemSettings:06", "nwparser.payload", "Overview > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38493 = msg("SystemSettings:06", part54); + +var part55 = // "Pattern{Constant('Task Queue, '), Field(info,false)}" +match("MESSAGE#38493:SystemSettings:07", "nwparser.payload", "Task Queue, %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Task Queue"), +])); + +var msg38494 = msg("SystemSettings:07", part55); + +var part56 = // "Pattern{Constant('Intrusion Policy > '), Field(info,false)}" +match("MESSAGE#38494:SystemSettings:08", "nwparser.payload", "Intrusion Policy > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Intrusion Policy"), +])); + +var msg38495 = msg("SystemSettings:08", part56); + +var part57 = // "Pattern{Constant('Analysis & Reporting '), Field(p0,false)}" +match("MESSAGE#38495:SystemSettings:09/0", "nwparser.payload", "Analysis \u0026 Reporting %{p0}"); + +var part58 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#38495:SystemSettings:09/1_1", "nwparser.p0", ",%{p0}"); + +var select2454 = linear_select([ + dup145, + part58, +]); + +var part59 = // "Pattern{Field(,true), Constant(' '), Field(info,false)}" +match("MESSAGE#38495:SystemSettings:09/2", "nwparser.p0", "%{} %{info}"); + +var all74 = all_match({ + processors: [ + part57, + select2454, + part59, + ], + on_success: processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Analysis \u0026 Reporting"), + ]), +}); + +var msg38496 = msg("SystemSettings:09", all74); + +var part60 = // "Pattern{Constant('Heartbeat, '), Field(info,false)}" +match("MESSAGE#38496:SystemSettings:10", "nwparser.payload", "Heartbeat, %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Heartbeat"), +])); + +var msg38497 = msg("SystemSettings:10", part60); + +var part61 = // "Pattern{Constant('FailD, '), Field(info,false)}" +match("MESSAGE#38497:SystemSettings:11", "nwparser.payload", "FailD, %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38498 = msg("SystemSettings:11", part61); + +var part62 = // "Pattern{Constant('Health > '), Field(info,false)}" +match("MESSAGE#38498:SystemSettings:12", "nwparser.payload", "Health > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Health"), +])); + +var msg38499 = msg("SystemSettings:12", part62); + +var part63 = // "Pattern{Constant('Session Expiration, '), Field(info,false)}" +match("MESSAGE#38499:SystemSettings:13", "nwparser.payload", "Session Expiration, %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + dup146, +])); + +var msg38500 = msg("SystemSettings:13", part63); + +var part64 = // "Pattern{Constant('Analysis '), Field(info,false)}" +match("MESSAGE#38500:SystemSettings:14", "nwparser.payload", "Analysis %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + dup146, +])); + +var msg38501 = msg("SystemSettings:14", part64); + +var part65 = // "Pattern{Constant('Devices '), Field(info,false)}" +match("MESSAGE#38501:SystemSettings:15", "nwparser.payload", "Devices %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + dup146, +])); + +var msg38502 = msg("SystemSettings:15", part65); + +var part66 = // "Pattern{Constant('Intrusion Events,'), Field(info,false)}" +match("MESSAGE#38502:SystemSettings:16", "nwparser.payload", "Intrusion Events,%{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, + setc("category","Intrusion Events"), +])); + +var msg38503 = msg("SystemSettings:16", part66); + +var part67 = // "Pattern{Constant('Login, Login Failed'), Field(,false)}" +match("MESSAGE#38503:SystemSettings:17", "nwparser.payload", "Login, Login Failed%{}", processor_chain([ + dup91, + dup31, + dup137, + dup138, + dup139, + setc("ec_outcome","Failure"), + dup32, + dup141, + dup47, + dup142, + dup143, + setc("event_description","Login Failed"), +])); + +var msg38504 = msg("SystemSettings:17", part67); + +var part68 = // "Pattern{Constant('Command Line,'), Field(info,false)}" +match("MESSAGE#38504:SystemSettings:18", "nwparser.payload", "Command Line,%{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38505 = msg("SystemSettings:18", part68); + +var part69 = // "Pattern{Constant('Access Control Policy > '), Field(info,false)}" +match("MESSAGE#38505:SystemSettings:19", "nwparser.payload", "Access Control Policy > %{info}", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38506 = msg("SystemSettings:19", part69); + +var part70 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#38506:SystemSettings:20", "nwparser.payload", "info", processor_chain([ + dup127, + dup31, + dup32, + dup141, + dup47, + dup142, + dup143, +])); + +var msg38507 = msg("SystemSettings:20", part70); + +var select2455 = linear_select([ + msg38488, + msg38489, + msg38490, + msg38491, + msg38492, + msg38493, + msg38494, + msg38495, + msg38496, + msg38497, + msg38498, + msg38499, + msg38500, + msg38501, + msg38502, + msg38503, + msg38504, + msg38505, + msg38506, + msg38507, +]); + +var msg38508 = msg("2100651", dup192); + +var msg38509 = msg("2101384", dup192); + +var msg38510 = msg("2101390", dup192); + +var msg38511 = msg("2101424", dup192); + +var msg38512 = msg("2101432", dup192); + +var msg38513 = msg("2101867", dup192); + +var msg38514 = msg("2101918", dup192); + +var part71 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(sbytes,false), Constant(', Context: '), Field(context,false), Constant(', SSL Rule Name: '), Field(fld9,false), Constant(', SSL Flow Status: '), Field(fld10,false), Constant(', SSL Cipher Suite: '), Field(fld11,false), Constant(', SSL Certificate: '), Field(fld12,false), Constant(', SSL Subject CN: '), Field(fld13,false), Constant(', SSL Subject Country: '), Field(fld14,false), Constant(', SSL Subject OU: '), Field(fld15,false), Constant(', SSL Subject Org: '), Field(fld16,false), Constant(', SSL Issuer CN: '), Field(fld17,false), Constant(', SSL Issuer Country: '), Field(fld18,false), Constant(', SSL Issuer OU: '), Field(fld19,false), Constant(', SSL Issuer Org: '), Field(fld20,false), Constant(', SSL Valid Start Date: '), Field(fld21,false), Constant(', SSL Valid End Date: '), Field(fld22,false), Constant(', SSL Version: '), Field(fld23,false), Constant(', SSL Server Certificate Status: '), Field(fld24,false), Constant(', SSL Actual Action: '), Field(fld25,false), Constant(', SSL Expected Action: '), Field(fld26,false), Constant(', SSL Server Name: '), Field(fld27,false), Constant(', SSL URL Category: '), Field(fld28,false), Constant(', SSL Session ID: '), Field(fld29,false), Constant(', SSL Ticket Id: '), Field(fld30,false), Constant(', {'), Field(protocol,false), Constant('} '), Field(saddr,true), Constant(' -> '), Field(daddr,false), Constant(', type:'), Field(event_type,false), Constant(', code:'), Field(event_description,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{saddr->} -> %{daddr}, type:%{event_type}, code:%{event_description}"); + +var all75 = all_match({ + processors: [ + dup147, + dup189, + part71, + ], + on_success: processor_chain([ + dup150, + dup31, + dup32, + dup47, + dup151, + dup152, + ]), +}); + +var msg38515 = msg("Primary_Detection_Engine", all75); + +var part72 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(sbytes,false), Constant(', Context: '), Field(context,false), Constant(', SSL Rule Name: '), Field(fld9,false), Constant(', SSL Flow Status: '), Field(fld10,false), Constant(', SSL Cipher Suite: '), Field(fld11,false), Constant(', SSL Certificate: '), Field(fld12,false), Constant(', SSL Subject CN: '), Field(fld13,false), Constant(', SSL Subject Country: '), Field(fld14,false), Constant(', SSL Subject OU: '), Field(fld15,false), Constant(', SSL Subject Org: '), Field(fld16,false), Constant(', SSL Issuer CN: '), Field(fld17,false), Constant(', SSL Issuer Country: '), Field(fld18,false), Constant(', SSL Issuer OU: '), Field(fld19,false), Constant(', SSL Issuer Org: '), Field(fld20,false), Constant(', SSL Valid Start Date: '), Field(fld21,false), Constant(', SSL Valid End Date: '), Field(fld22,false), Constant(', SSL Version: '), Field(fld23,false), Constant(', SSL Server Certificate Status: '), Field(fld24,false), Constant(', SSL Actual Action: '), Field(fld25,false), Constant(', SSL Expected Action: '), Field(fld26,false), Constant(', SSL Server Name: '), Field(fld27,false), Constant(', SSL URL Category: '), Field(fld28,false), Constant(', SSL Session ID: '), Field(fld29,false), Constant(', SSL Ticket Id: '), Field(fld30,false), Constant(', {'), Field(protocol,false), Constant('} '), Field(p0,false)}" +match("MESSAGE#38515:Primary_Detection_Engine:01/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{p0}"); + +var all76 = all_match({ + processors: [ + dup147, + dup189, + part72, + dup173, + dup174, + ], + on_success: processor_chain([ + dup150, + dup31, + dup32, + dup47, + dup151, + dup152, + ]), +}); + +var msg38516 = msg("Primary_Detection_Engine:01", all76); + +var part73 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(p0,false)}" +match("MESSAGE#38516:Primary_Detection_Engine:02/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{p0}"); + +var part74 = // "Pattern{Field(sbytes,false), Constant(', Context: '), Field(context,true), Constant(' {'), Field(p0,false)}" +match("MESSAGE#38516:Primary_Detection_Engine:02/3_0", "nwparser.p0", "%{sbytes}, Context: %{context->} {%{p0}"); + +var part75 = // "Pattern{Field(sbytes,true), Constant(' {'), Field(p0,false)}" +match("MESSAGE#38516:Primary_Detection_Engine:02/3_1", "nwparser.p0", "%{sbytes->} {%{p0}"); + +var select2456 = linear_select([ + part74, + part75, +]); + +var all77 = all_match({ + processors: [ + dup147, + dup189, + part73, + select2456, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup150, + dup31, + dup32, + dup47, + dup151, + dup152, + ]), +}); + +var msg38517 = msg("Primary_Detection_Engine:02", all77); + +var part76 = // "Pattern{Constant('"'), Field(context,false), Constant('" [Classification:'), Field(sigtype,false), Constant('] User:'), Field(username,false), Constant(', Application:'), Field(application,false), Constant(', Client:'), Field(fld12,false), Constant(', App Protocol:'), Field(fld14,false), Constant(', Interface Ingress:'), Field(dinterface,false), Constant(', Interface Egress:'), Field(sinterface,false), Constant(', Security Zone Ingress:'), Field(dst_zone,false), Constant(', Security Zone Egress:'), Field(src_zone,false), Constant(', Context:'), Field(fld13,false), Constant(', SSL Flow Status:'), Field(fld1,false), Constant(', SSL Actual Action:'), Field(fld22,false), Constant(', SSL Certificate:'), Field(fld3,false), Constant(', SSL Subject CN:'), Field(fld4,false), Constant(', SSL Subject Country:'), Field(fld5,false), Constant(', SSL Subject OU:'), Field(fld6,false), Constant(', SSL Subject Org:'), Field(fld7,false), Constant(', SSL Issuer CN:'), Field(fld8,false), Constant(', SSL Issuer Country:'), Field(fld9,false), Constant(', SSL Issuer OU:'), Field(fld10,false), Constant(', SSL Issuer Org:'), Field(fld11,false), Constant(', SSL Valid Start Date:'), Field(fld12,false), Constant(', SSL Valid End Date:'), Field(fld13,false), Constant(', [Priority:'), Field(threat_val,false), Constant('] {'), Field(protocol,false), Constant('}'), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,false)}" +match("MESSAGE#38517:Primary_Detection_Engine:03", "nwparser.payload", "\"%{context}\" [Classification:%{sigtype}] User:%{username}, Application:%{application}, Client:%{fld12}, App Protocol:%{fld14}, Interface Ingress:%{dinterface}, Interface Egress:%{sinterface}, Security Zone Ingress:%{dst_zone}, Security Zone Egress:%{src_zone}, Context:%{fld13}, SSL Flow Status:%{fld1}, SSL Actual Action:%{fld22}, SSL Certificate:%{fld3}, SSL Subject CN:%{fld4}, SSL Subject Country:%{fld5}, SSL Subject OU:%{fld6}, SSL Subject Org:%{fld7}, SSL Issuer CN:%{fld8}, SSL Issuer Country:%{fld9}, SSL Issuer OU:%{fld10}, SSL Issuer Org:%{fld11}, SSL Valid Start Date:%{fld12}, SSL Valid End Date:%{fld13}, [Priority:%{threat_val}] {%{protocol}}%{saddr}:%{sport}->%{daddr}:%{dport}", processor_chain([ + dup44, + dup31, + dup32, + dup48, + setf("sigid","id"), + setf("version","hfld3"), + dup45, +])); + +var msg38518 = msg("Primary_Detection_Engine:03", part76); + +var select2457 = linear_select([ + msg38515, + msg38516, + msg38517, + msg38518, +]); + +var part77 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC > Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('>'), Field(daddr,false)}" +match("MESSAGE#38518:Network_Based_Malware", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC > Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}>%{daddr}", processor_chain([ + dup100, + dup31, + dup129, + dup32, + dup47, +])); + +var msg38519 = msg("Network_Based_Malware", part77); + +var part78 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -'), Field(p0,false)}" +match("MESSAGE#38519:Network_Based_Malware:01/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -%{p0}"); + +var part79 = // "Pattern{Constant('*>'), Field(p0,false)}" +match("MESSAGE#38519:Network_Based_Malware:01/1_0", "nwparser.p0", "*>%{p0}"); + +var select2458 = linear_select([ + part79, + dup145, +]); + +var part80 = // "Pattern{Field(,true), Constant(' '), Field(space,false), Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" +match("MESSAGE#38519:Network_Based_Malware:01/2", "nwparser.p0", "%{} %{space}Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); + +var all78 = all_match({ + processors: [ + part78, + select2458, + part80, + ], + on_success: processor_chain([ + dup100, + dup31, + dup129, + dup32, + dup47, + ]), +}); + +var msg38520 = msg("Network_Based_Malware:01", all78); + +var part81 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('->'), Field(daddr,false)}" +match("MESSAGE#38520:Network_Based_Malware:02", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ + dup100, + dup31, + dup129, + dup32, + dup47, +])); + +var msg38521 = msg("Network_Based_Malware:02", part81); + +var select2459 = linear_select([ + msg38519, + msg38520, + msg38521, +]); + +var part82 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC %{p0}"); + +var part83 = // "Pattern{Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/2", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{p0}"); + +var part84 = // "Pattern{Field(saddr,false), Constant('->'), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/3_0", "nwparser.p0", "%{saddr}->%{p0}"); + +var part85 = // "Pattern{Field(saddr,false), Constant('>'), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/3_1", "nwparser.p0", "%{saddr}>%{p0}"); + +var select2460 = linear_select([ + part84, + part85, +]); + +var all79 = all_match({ + processors: [ + part82, + dup190, + part83, + select2460, + dup43, + ], + on_success: processor_chain([ + dup100, + dup31, + dup129, + dup32, + dup47, + ]), +}); + +var msg38522 = msg("Network_Based_Retrospective", all79); + +var part86 = // "Pattern{Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/4", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{p0}"); + +var part87 = // "Pattern{Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/5_0", "nwparser.p0", "%{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); + +var part88 = // "Pattern{Field(threat_name,false)}" +match_copy("MESSAGE#38522:Network_Based_Retrospective:01/5_1", "nwparser.p0", "threat_name"); + +var select2461 = linear_select([ + part87, + part88, +]); + +var all80 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + part86, + select2461, + ], + on_success: processor_chain([ + dup100, + dup31, + dup129, + dup32, + dup47, + ]), +}); + +var msg38523 = msg("Network_Based_Retrospective:01", all80); + +var select2462 = linear_select([ + msg38522, + msg38523, +]); + +var part89 = // "Pattern{Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" +match("MESSAGE#38523:MALWARE:02", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}", processor_chain([ + dup100, + dup32, + dup47, + dup158, +])); + +var msg38524 = msg("MALWARE:02", part89); + +var part90 = // "Pattern{Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('->'), Field(daddr,false)}" +match("MESSAGE#38524:MALWARE:01", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ + dup100, + dup32, + dup47, + dup158, +])); + +var msg38525 = msg("MALWARE:01", part90); + +var part91 = // "Pattern{Field(threat_val,false)}" +match_copy("MESSAGE#38537:MALWARE", "nwparser.payload", "threat_val", processor_chain([ + dup71, + dup31, + dup45, + dup32, +])); + +var msg38526 = msg("MALWARE", part91); + +var select2463 = linear_select([ + msg38524, + msg38525, + msg38526, +]); + +var all81 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var msg38527 = msg("Snort_AlertLog", all81); + +var part92 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(p0,false)}" +match("MESSAGE#38526:New_TCP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{p0}"); + +var part93 = // "Pattern{Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38526:New_TCP_Port/5_0", "nwparser.p0", "%{sport->} Service: %{protocol->} Confidence: %{result}"); + +var part94 = // "Pattern{Field(sport,false)}" +match_copy("MESSAGE#38526:New_TCP_Port/5_1", "nwparser.p0", "sport"); + +var select2464 = linear_select([ + part93, + part94, +]); + +var all82 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + part92, + select2464, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var msg38528 = msg("New_TCP_Port", all82); + +var part95 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" +match("MESSAGE#38527:New_UDP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport}"); + +var all83 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + part95, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var msg38529 = msg("New_UDP_Port", all83); + +var msg38530 = msg("Client_Update", dup355); + +var msg38531 = msg("New_Client", dup355); + +var msg38532 = msg("UDP_Server_Information_Update", dup356); + +var msg38533 = msg("TCP_Server_Information_Update", dup356); + +var part96 = // "Pattern{Constant('From '), Field(sensor,true), Constant(' at '), Field(p0,false)}" +match("MESSAGE#38532:Client_Timeout/1_1", "nwparser.p0", "From %{sensor->} at %{p0}"); + +var select2465 = linear_select([ + dup155, + part96, + dup156, +]); + +var all84 = all_match({ + processors: [ + dup57, + select2465, + dup157, + dup190, + dup159, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var msg38534 = msg("Client_Timeout", all84); + +var part97 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Category: '), Field(category,true), Constant(' Event Type: '), Field(event_type,false)}" +match("MESSAGE#38533:Host_IOC_Set/4", "nwparser.p0", "IP Address: %{saddr->} Category: %{category->} Event Type: %{event_type}"); + +var all85 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + part97, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var msg38535 = msg("Host_IOC_Set", all85); + +var part98 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Host Type: '), Field(fld10,false)}" +match("MESSAGE#38534:Host_Type_Changed/4", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{fld10}"); + +var all86 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + part98, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var msg38536 = msg("Host_Type_Changed", all86); + +var part99 = // "Pattern{Constant('Login Success'), Field(,false)}" +match("MESSAGE#38535:Login", "nwparser.payload", "Login Success%{}", processor_chain([ + dup112, + dup31, + dup32, + dup137, + dup138, + dup139, + dup140, + dup47, +])); + +var msg38537 = msg("Login", part99); + +var part100 = // "Pattern{Constant('Logout Success'), Field(,false)}" +match("MESSAGE#38536:Logout", "nwparser.payload", "Logout Success%{}", processor_chain([ + setc("eventcategory","1401070000"), + dup31, + dup32, + dup137, + dup144, + dup139, + dup140, + dup47, +])); + +var msg38538 = msg("Logout", part100); + +var part101 = tagval("MESSAGE#38538:connection_events", "nwparser.payload", tvm, { + "ACPolicy": "fld44", + "AccessControlRuleAction": "action", + "AccessControlRuleName": "rulename", + "AccessControlRuleReason": "result", + "ApplicationProtocol": "protocol", + "Classification": "risk_info", + "Client": "application", + "ClientVersion": "version", + "ConnectType": "event_state", + "DE": "fld16", + "DNSQuery": "obj_name", + "DNSRecordType": "obj_type", + "DNSResponseType": "fld17", + "DNS_TTL": "fld7", + "DstIP": "daddr", + "DstPort": "dport", + "EgressInterface": "sinterface", + "EgressZone": "src_zone", + "FileCount": "dclass_counter1", + "GID": "fld28", + "HTTPReferer": "web_ref_host", + "HTTPResponse": "resultcode", + "ICMPCode": "resultcode", + "ICMPType": "event_type", + "IPReputationSICategory": "threat_name", + "IngressInterface": "dinterface", + "IngressZone": "dst_zone", + "InitiatorBytes": "sbytes", + "InitiatorPackets": "fld14", + "Message": "fld49", + "NAPPolicy": "policyname", + "OriginalClientIP": "fld1", + "Policy": "policyname", + "Prefilter Policy": "fld2", + "Priority": "threat_val", + "ReferencedHost": "fld3", + "ResponderBytes": "rbytes", + "ResponderPackets": "fld13", + "Revision": "fld46", + "SID": "sid", + "Sinkhole": "fld15", + "SrcIP": "saddr", + "SrcPort": "sport", + "TCPFlags": "fld12", + "URL": "url", + "URLCategory": "category", + "URLReputation": "reputation_num", + "User": "fld48", + "UserAgent": "user_agent", + "UserName": "username", + "WebApplication": "application", +}, processor_chain([ + dup150, + dup31, + dup32, + dup47, + setc("dclass_counter1_string","Number of Files"), + setf("protocol","hprotocol"), + lookup({ + dest: "nwparser.event_cat", + map: map_getEventLegacyCategory, + key: field("sid"), + }), + lookup({ + dest: "nwparser.event_cat_name", + map: map_getEventLegacyCategoryName, + key: field("event_cat"), + }), + call({ + dest: "nwparser.info", + fn: RMQ, + args: [ + field("fld49"), + ], + }), + dup45, + fqdn("fqdn","url"), + path("directory","url"), + page("filename_tmp","url"), + ext("web_extension_tmp","url"), + query("web_query","url"), + call({ + dest: "nwparser.filename", + fn: STRCAT, + args: [ + field("filename_tmp"), + field("web_extension_tmp"), + ], + }), +])); + +var msg38539 = msg("connection_events", part101); + +var part102 = // "Pattern{Constant('SrcIP: '), Field(daddr,false), Constant(', DstIP: '), Field(saddr,false), Constant(', SrcPort: '), Field(dport,false), Constant(', DstPort: '), Field(sport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', FileDirection: Download, FileAction: '), Field(action,false), Constant(', FileSHA256: '), Field(checksum,false), Constant(', SHA_Disposition: '), Field(disposition,false), Constant(', SperoDisposition: '), Field(info,false), Constant(', ThreatName: '), Field(threat_name,false), Constant(', ThreatScore: '), Field(fld1,false), Constant(', FileName: '), Field(filename,false), Constant(', FileType: '), Field(filetype,false), Constant(', FileSize: '), Field(filename_size,false), Constant(', ApplicationProtocol: '), Field(protocol,false), Constant(', Client: '), Field(application,false), Constant(', User: '), Field(username,false), Constant(', FirstPacketSecond: '), Field(fld21,false), Constant(', FilePolicy: '), Field(policyname,false), Constant(', FileSandboxStatus: '), Field(result,false), Constant(', URI: '), Field(url,false)}" +match("MESSAGE#38539:FTD_events_01", "nwparser.payload", "SrcIP: %{daddr}, DstIP: %{saddr}, SrcPort: %{dport}, DstPort: %{sport}, Protocol: %{protocol}, FileDirection: Download, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ + dup150, + dup161, + dup162, + dup163, + dup32, + dup164, + setc("context","Download"), +])); + +var msg38540 = msg("FTD_events_01", part102); + +var part103 = // "Pattern{Constant('SrcIP: '), Field(saddr,false), Constant(', DstIP: '), Field(daddr,false), Constant(', SrcPort: '), Field(sport,false), Constant(', DstPort: '), Field(dport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', FileDirection: Upload, FileAction: '), Field(action,false), Constant(', FileSHA256: '), Field(checksum,false), Constant(', SHA_Disposition: '), Field(disposition,false), Constant(', SperoDisposition: '), Field(info,false), Constant(', ThreatName: '), Field(threat_name,false), Constant(', ThreatScore: '), Field(fld1,false), Constant(', FileName: '), Field(filename,false), Constant(', FileType: '), Field(filetype,false), Constant(', FileSize: '), Field(filename_size,false), Constant(', ApplicationProtocol: '), Field(protocol,false), Constant(', Client: '), Field(application,false), Constant(', User: '), Field(username,false), Constant(', FirstPacketSecond: '), Field(fld21,false), Constant(', FilePolicy: '), Field(policyname,false), Constant(', FileSandboxStatus: '), Field(result,false), Constant(', URI: '), Field(url,false)}" +match("MESSAGE#38540:FTD_events_02", "nwparser.payload", "SrcIP: %{saddr}, DstIP: %{daddr}, SrcPort: %{sport}, DstPort: %{dport}, Protocol: %{protocol}, FileDirection: Upload, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ + dup150, + dup161, + dup162, + dup163, + dup32, + dup164, + setc("context","Upload"), +])); + +var msg38541 = msg("FTD_events_02", part103); + +var part104 = // "Pattern{Constant('User ''), Field(username,false), Constant('' executed the ''), Field(fld1,false), Constant('' command.')}" +match("MESSAGE#38541:FTD_events_03", "nwparser.payload", "User '%{username}' executed the '%{fld1}' command.", processor_chain([ + dup150, + dup162, + dup32, + dup164, +])); + +var msg38542 = msg("FTD_events_03", part104); + +var part105 = // "Pattern{Constant('User ''), Field(username,false), Constant('', running ''), Field(application,false), Constant('' from IP'), Field(hostip,false), Constant(', executed ''), Field(fld1,false), Constant(''')}" +match("MESSAGE#38542:FTD_events_04", "nwparser.payload", "User '%{username}', running '%{application}' from IP%{hostip}, executed '%{fld1}'", processor_chain([ + dup150, + dup162, + dup32, + dup164, +])); + +var msg38543 = msg("FTD_events_04", part105); + +var part106 = // "Pattern{Field(dclass_counter1,false), Constant('in use,'), Field(fld2,false), Constant('most used')}" +match("MESSAGE#38543:FTD_events_05", "nwparser.payload", "%{dclass_counter1}in use,%{fld2}most used", processor_chain([ + dup150, + dup162, + dup32, + dup164, + setc("dclass_counter1_string","Number of Connections in use"), +])); + +var msg38544 = msg("FTD_events_05", part106); + +var part107 = // "Pattern{Constant('Offloaded TCP Flow for connection'), Field(connectionid,false), Constant('from'), Field(dinterface,false), Constant(':'), Field(daddr,false), Constant('/'), Field(dport,false), Constant('('), Field(dtransaddr,false), Constant('/'), Field(dtransport,false), Constant(') to'), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,false), Constant('('), Field(stransaddr,false), Constant('/'), Field(stransport,false), Constant(')')}" +match("MESSAGE#38544:FTD_events_06", "nwparser.payload", "Offloaded TCP Flow for connection%{connectionid}from%{dinterface}:%{daddr}/%{dport}(%{dtransaddr}/%{dtransport}) to%{sinterface}:%{saddr}/%{sport}(%{stransaddr}/%{stransport})", processor_chain([ + dup150, + dup162, + dup32, + dup164, + setc("event_description","Offloaded TCP Flow for connection"), +])); + +var msg38545 = msg("FTD_events_06", part107); + +var part108 = // "Pattern{Constant('Failed to locate egress interface for '), Field(protocol,true), Constant(' from '), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,false)}" +match("MESSAGE#38545:FTD_events_07", "nwparser.payload", "Failed to locate egress interface for %{protocol->} from %{sinterface}:%{saddr}/%{sport->} to %{daddr}/%{dport}", processor_chain([ + setc("eventcategory","1801010000"), + dup162, + dup32, + dup164, + setc("event_description","Failed to locate egress interface"), +])); + +var msg38546 = msg("FTD_events_07", part108); + +var part109 = // "Pattern{Constant('TCP Flow is no longer offloaded for connection '), Field(connectionid,true), Constant(' from '), Field(dinterface,false), Constant(':'), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' ('), Field(dtransaddr,false), Constant('/'), Field(dtransport,false), Constant(') to '), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' ('), Field(stransaddr,false), Constant('/'), Field(stransport,false), Constant(')')}" +match("MESSAGE#38546:FTD_events_08", "nwparser.payload", "TCP Flow is no longer offloaded for connection %{connectionid->} from %{dinterface}:%{daddr}/%{dport->} (%{dtransaddr}/%{dtransport}) to %{sinterface}:%{saddr}/%{sport->} (%{stransaddr}/%{stransport})", processor_chain([ + dup150, + dup162, + dup32, + dup164, + setc("event_description","TCP Flow is no longer offloaded for connection"), +])); + +var msg38547 = msg("FTD_events_08", part109); + +var part110 = // "Pattern{Constant('CLOCK: System clock set, source: '), Field(event_source,false), Constant(', IP: '), Field(hostip,false), Constant(', before: '), Field(change_old,false), Constant(', after: '), Field(change_new,false)}" +match("MESSAGE#38547:FTD_events_09", "nwparser.payload", "CLOCK: System clock set, source: %{event_source}, IP: %{hostip}, before: %{change_old}, after: %{change_new}", processor_chain([ + dup150, + dup162, + dup32, + dup164, + setc("change_attribute","Time"), +])); + +var msg38548 = msg("FTD_events_09", part110); + +var part111 = tagval("MESSAGE#38548:FTD_events", "nwparser.payload", tvm, { + "ACPolicy": "fld44", + "AccessControlRuleAction": "action", + "AccessControlRuleName": "rulename", + "AccessControlRuleReason": "result", + "ApplicationProtocol": "protocol", + "Classification": "risk_info", + "Client": "application", + "ClientVersion": "version", + "ConnectType": "event_state", + "ConnectionDuration": "duration", + "DE": "fld16", + "DNSQuery": "obj_name", + "DNSRecordType": "obj_type", + "DNSResponseType": "fld17", + "DNS_TTL": "fld7", + "DstIP": "daddr", + "DstPort": "dport", + "EgressInterface": "sinterface", + "EgressZone": "src_zone", + "FileAction": "action", + "FileDirection": "context", + "FileName": "filename", + "FilePolicy": "policyname", + "FileSHA256": "checksum", + "FileSandboxStatus": "result", + "FileSize": "filename_size", + "FileType": "filetype", + "FirstPacketSecond": "starttime", + "GID": "fld28", + "HTTPReferer": "web_ref_host", + "HTTPResponse": "resultcode", + "ICMPCode": "resultcode", + "ICMPType": "event_type", + "IPReputationSICategory": "threat_name", + "IngressInterface": "dinterface", + "IngressZone": "dst_zone", + "InitiatorBytes": "sbytes", + "InitiatorPackets": "fld14", + "Message": "fld49", + "NAPPolicy": "policyname", + "OriginalClientIP": "fld1", + "Policy": "policyname", + "Prefilter Policy": "fld2", + "Priority": "threat_val", + "Protocol": "protocol", + "ReferencedHost": "fld3", + "ResponderBytes": "rbytes", + "ResponderPackets": "fld13", + "Revision": "fld46", + "SHA_Disposition": "disposition", + "SID": "sid", + "Sinkhole": "fld15", + "SperoDisposition": "info", + "SrcIP": "saddr", + "SrcPort": "sport", + "TCPFlags": "fld12", + "ThreatName": "threat_name", + "ThreatScore": "fld76", + "URI": "url", + "URL": "url", + "URLCategory": "category", + "URLReputation": "reputation_num", + "User": "username", + "UserAgent": "user_agent", + "UserName": "username", + "WebApplication": "application", +}, processor_chain([ + dup150, + dup161, + dup162, + dup32, + dup164, +])); + +var msg38549 = msg("FTD_events", part111); + +var select2466 = linear_select([ + msg38540, + msg38541, + msg38542, + msg38543, + msg38544, + msg38545, + msg38546, + msg38547, + msg38548, + msg38549, +]); + +var part112 = // "Pattern{Constant('AccessControlRuleAction:'), Field(action,false), Constant(', AccessControlRuleReason:'), Field(result,false), Constant(', SrcIP:'), Field(saddr,false), Constant(', DstIP:'), Field(daddr,false), Constant(', SrcPort:'), Field(sport,false), Constant(', DstPort:'), Field(dport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', IngressInterface: '), Field(dinterface,false), Constant(', IngressZone:'), Field(dst_zone,false), Constant(', ACPolicy:'), Field(fld44,false), Constant(', AccessControlRuleName:'), Field(rulename,false), Constant(', Prefilter Policy:'), Field(fld2,false), Constant(', User:'), Field(fld48,false), Constant(', Client:'), Field(application,false), Constant(', ApplicationProtocol:'), Field(protocol,false), Constant(', InitiatorPackets:'), Field(fld14,false), Constant(', ResponderPackets:'), Field(fld13,false), Constant(', InitiatorBytes:'), Field(sbytes,false), Constant(', ResponderBytes:'), Field(rbytes,false), Constant(', NAPPolicy:'), Field(policyname,false), Constant(', DNSQuery:'), Field(hostname,false), Constant(', DNSRecordType: a host address,'), Field(p0,false)}" +match("MESSAGE#38549:NGIPS_events_01/0", "nwparser.payload", "AccessControlRuleAction:%{action}, AccessControlRuleReason:%{result}, SrcIP:%{saddr}, DstIP:%{daddr}, SrcPort:%{sport}, DstPort:%{dport}, Protocol: %{protocol}, IngressInterface: %{dinterface}, IngressZone:%{dst_zone}, ACPolicy:%{fld44}, AccessControlRuleName:%{rulename}, Prefilter Policy:%{fld2}, User:%{fld48}, Client:%{application}, ApplicationProtocol:%{protocol}, InitiatorPackets:%{fld14}, ResponderPackets:%{fld13}, InitiatorBytes:%{sbytes}, ResponderBytes:%{rbytes}, NAPPolicy:%{policyname}, DNSQuery:%{hostname}, DNSRecordType: a host address,%{p0}"); + +var part113 = // "Pattern{Constant(' DNS_TTL: '), Field(fld7,false), Constant(','), Field(p0,false)}" +match("MESSAGE#38549:NGIPS_events_01/1_0", "nwparser.p0", " DNS_TTL: %{fld7},%{p0}"); + +var select2467 = linear_select([ + part113, + dup59, +]); + +var part114 = // "Pattern{Field(,false), Constant('DNSSICategory:'), Field(category,false)}" +match("MESSAGE#38549:NGIPS_events_01/2", "nwparser.p0", "%{}DNSSICategory:%{category}"); + +var all87 = all_match({ + processors: [ + part112, + select2467, + part114, + ], + on_success: processor_chain([ + dup150, + dup161, + dup32, + dup164, + ]), +}); + +var msg38550 = msg("NGIPS_events_01", all87); + +var part115 = tagval("MESSAGE#38550:NGIPS_events", "nwparser.payload", tvm, { + "ACPolicy": "fld44", + "AccessControlRuleAction": "action", + "AccessControlRuleName": "rulename", + "AccessControlRuleReason": "result", + "ApplicationProtocol": "protocol", + "Classification": "risk_info", + "Client": "application", + "ClientVersion": "version", + "ConnectType": "event_state", + "ConnectionDuration": "duration", + "DE": "fld16", + "DNSQuery": "obj_name", + "DNSRecordType": "obj_type", + "DNSResponseType": "fld17", + "DNSSICategory": "category", + "DNS_TTL": "fld7", + "DstIP": "daddr", + "DstPort": "dport", + "EgressInterface": "sinterface", + "EgressZone": "src_zone", + "GID": "fld28", + "HTTPReferer": "web_ref_host", + "HTTPResponse": "resultcode", + "ICMPCode": "resultcode", + "ICMPType": "event_type", + "IPReputationSICategory": "threat_name", + "IPSCount": "dclass_counter1", + "IngressInterface": "dinterface", + "IngressZone": "dst_zone", + "InitiatorBytes": "sbytes", + "InitiatorPackets": "fld14", + "InlineResult": "action", + "Message": "event_description", + "NAPPolicy": "policyname", + "OriginalClientIP": "fld1", + "Policy": "policyname", + "Prefilter Policy": "fld2", + "Priority": "threat_val", + "Protocol": "protocol", + "ReferencedHost": "fld3", + "ResponderBytes": "rbytes", + "ResponderPackets": "fld13", + "Revision": "fld46", + "SID": "sid", + "Sinkhole": "fld15", + "SrcIP": "saddr", + "SrcPort": "sport", + "TCPFlags": "fld12", + "URL": "url", + "URLCategory": "category", + "URLReputation": "reputation_num", + "URLSICategory": "category", + "User": "fld48", + "UserAgent": "user_agent", + "UserName": "username", + "VLAN_ID": "vlan", + "WebApplication": "application", +}, processor_chain([ + dup150, + dup161, + dup32, + dup164, + setc("dclass_counter1_string"," The number of intrusion events"), + setf("hostname","obj_name"), +])); + +var msg38551 = msg("NGIPS_events", part115); + +var select2468 = linear_select([ + msg38550, + msg38551, +]); + +var chain1 = processor_chain([ + select5, + msgid_select({ + "0": select6, + "1": select7, + "10": msg34, + "1000": select900, + "10000": msg12447, + "1000001": msg38282, + "100000121": msg38430, + "100000122": msg38431, + "100000137": msg38432, + "100000138": msg38433, + "100000160": msg38434, + "100000161": msg38435, + "100000185": msg38436, + "1000002": msg38283, + "100000211": msg38437, + "100000213": msg38438, + "100000219": msg38439, + "100000241": msg38440, + "100000262": msg38441, + "100000266": msg38442, + "100000272": msg38443, + "100000273": msg38444, + "100000274": msg38445, + "100000275": msg38446, + "100000277": msg38447, + "100000278": msg38448, + "1000003": select2443, + "1000004": msg38286, + "1000005": msg38287, + "100000550": msg38449, + "100000687": msg38450, + "100000689": msg38451, + "1000007": msg38288, + "1000010": msg38289, + "1000012": msg38290, + "1000014": msg38291, + "1000015": msg38292, + "1000016": msg38293, + "1000020": msg38294, + "1000021": msg38295, + "1000022": msg38296, + "1000023": msg38297, + "1000024": msg38298, + "1000026": msg38299, + "1000028": msg38300, + "1000029": msg38301, + "1000030": msg38302, + "1000031": msg38303, + "1000032": msg38304, + "1000033": msg38305, + "1000034": msg38306, + "1000035": msg38307, + "1000036": msg38308, + "1000037": msg38309, + "1000038": msg38310, + "1000039": msg38311, + "1000040": msg38312, + "1000041": msg38313, + "1000043": msg38314, + "1000044": msg38315, + "1000045": msg38316, + "1000046": msg38317, + "1000047": msg38318, + "1000048": msg38319, + "1000049": msg38320, + "1000050": msg38321, + "1000054": msg38322, + "1000055": msg38323, + "1000056": msg38324, + "1000057": msg38325, + "10001": msg12448, + "10002": msg12449, + "10003": msg12450, + "10004": msg12451, + "10005": msg12452, + "10006": msg12453, + "10007": msg12454, + "10008": msg12455, + "10009": msg12456, + "1001": select901, + "10010": msg12457, + "10011": msg12458, + "10012": msg12459, + "10013": msg12460, + "10014": msg12461, + "10015": msg12462, + "10016": msg12463, + "10017": msg12464, + "10018": msg12465, + "10019": msg12466, + "1002": select902, + "10020": msg12467, + "10021": msg12468, + "10022": msg12469, + "10023": msg12470, + "10024": msg12471, + "10025": msg12472, + "10026": msg12473, + "10027": msg12474, + "10028": msg12475, + "10029": msg12476, + "1003": select903, + "10030": msg12477, + "10031": msg12478, + "10032": msg12479, + "10033": msg12480, + "10034": msg12481, + "10035": msg12482, + "10036": msg12483, + "10037": msg12484, + "10038": msg12485, + "10039": msg12486, + "1004": select904, + "10040": msg12487, + "10041": msg12488, + "10042": msg12489, + "10043": msg12490, + "10044": msg12491, + "10045": msg12492, + "10046": msg12493, + "10047": msg12494, + "10048": msg12495, + "10049": msg12496, + "1005": select905, + "10050": msg12497, + "10051": msg12498, + "10052": msg12499, + "10053": msg12500, + "10054": msg12501, + "10055": msg12502, + "10056": msg12503, + "10057": msg12504, + "10058": msg12505, + "10059": msg12506, + "10060": msg12507, + "10061": msg12508, + "10062": msg12509, + "10063": msg12510, + "10064": msg12511, + "10065": msg12512, + "10066": msg12513, + "10067": msg12514, + "10068": msg12515, + "10069": msg12516, + "1007": select906, + "10070": msg12517, + "10071": msg12518, + "10072": msg12519, + "10073": msg12520, + "10074": msg12521, + "10075": msg12522, + "10076": msg12523, + "10077": msg12524, + "10078": msg12525, + "10079": msg12526, + "1008": select907, + "10080": msg12527, + "10081": msg12528, + "10082": msg12529, + "10083": msg12530, + "10084": msg12531, + "10085": msg12532, + "10086": msg12533, + "10087": msg12534, + "10088": msg12535, + "10089": msg12536, + "1009": select908, + "10090": msg12537, + "10091": msg12538, + "10092": msg12539, + "10093": msg12540, + "10094": msg12541, + "10095": msg12542, + "10096": msg12543, + "10097": msg12544, + "10098": msg12545, + "10099": msg12546, + "1010": select909, + "10100": msg12547, + "10101": msg12548, + "10102": msg12549, + "10103": msg12550, + "10104": msg12551, + "10105": msg12552, + "10106": msg12553, + "10107": msg12554, + "10108": msg12555, + "10109": msg12556, + "1011": select910, + "10110": msg12557, + "10111": msg12558, + "10112": msg12559, + "10113": msg12560, + "10114": msg12561, + "10115": msg12562, + "10116": msg12563, + "10117": msg12564, + "10118": msg12565, + "10119": msg12566, + "1012": select911, + "10120": msg12567, + "10121": msg12568, + "10122": msg12569, + "10123": msg12570, + "10124": msg12571, + "10125": msg12572, + "10126": msg12573, + "10127": msg12574, + "10128": msg12575, + "10129": msg12576, + "1013": select912, + "10130": msg12577, + "10131": msg12578, + "10132": msg12579, + "10133": msg12580, + "10134": msg12581, + "10135": msg12582, + "10136": msg12583, + "10137": msg12584, + "10138": msg12585, + "10139": msg12586, + "1014": select913, + "10140": msg12587, + "10141": msg12588, + "10142": msg12589, + "10143": msg12590, + "10144": msg12591, + "10145": msg12592, + "10146": msg12593, + "10147": msg12594, + "10148": msg12595, + "10149": msg12596, + "1015": select914, + "10150": msg12597, + "10151": msg12598, + "10152": msg12599, + "10153": msg12600, + "10154": msg12601, + "10155": msg12602, + "10156": msg12603, + "10157": msg12604, + "10158": msg12605, + "10159": msg12606, + "1016": select915, + "10160": msg12607, + "10161": msg12608, + "10162": msg12609, + "10163": msg12610, + "10164": msg12611, + "10165": msg12612, + "10166": msg12613, + "10167": msg12614, + "10168": msg12615, + "10169": msg12616, + "1017": select916, + "10170": msg12617, + "10171": msg12618, + "10172": msg12619, + "10173": msg12620, + "10174": msg12621, + "10175": msg12622, + "10176": msg12623, + "10177": msg12624, + "10178": msg12625, + "10179": msg12626, + "1018": select917, + "10180": msg12627, + "10181": msg12628, + "10182": msg12629, + "10183": msg12630, + "10184": msg12631, + "10185": msg12632, + "10186": msg12633, + "10187": msg12634, + "10188": msg12635, + "10189": msg12636, + "1019": select918, + "10190": msg12637, + "10191": msg12638, + "10192": msg12639, + "10193": msg12640, + "10194": msg12641, + "10195": msg12642, + "10196": msg12643, + "10197": msg12644, + "10198": msg12645, + "10199": msg12646, + "1020": select919, + "10200": msg12647, + "10201": msg12648, + "10202": msg12649, + "10203": msg12650, + "10204": msg12651, + "10205": msg12652, + "10206": msg12653, + "10207": msg12654, + "10208": msg12655, + "10209": msg12656, + "1021": select920, + "10210": msg12657, + "10211": msg12658, + "10212": msg12659, + "10213": msg12660, + "10214": msg12661, + "10215": msg12662, + "10216": msg12663, + "10217": msg12664, + "10218": msg12665, + "10219": msg12666, + "1022": select921, + "10220": msg12667, + "10221": msg12668, + "10222": msg12669, + "10223": msg12670, + "10224": msg12671, + "10225": msg12672, + "10226": msg12673, + "10227": msg12674, + "10228": msg12675, + "10229": msg12676, + "1023": select922, + "10230": msg12677, + "10231": msg12678, + "10232": msg12679, + "10233": msg12680, + "10234": msg12681, + "10235": msg12682, + "10236": msg12683, + "10237": msg12684, + "10238": msg12685, + "10239": msg12686, + "1024": select923, + "10240": msg12687, + "10241": msg12688, + "10242": msg12689, + "10243": msg12690, + "10244": msg12691, + "10245": msg12692, + "10246": msg12693, + "10247": msg12694, + "10248": msg12695, + "10249": msg12696, + "1025": select924, + "10250": msg12697, + "10251": msg12698, + "10252": msg12699, + "10253": msg12700, + "10254": msg12701, + "10255": msg12702, + "10256": msg12703, + "10257": msg12704, + "10258": msg12705, + "10259": msg12706, + "1026": select925, + "10260": msg12707, + "10261": msg12708, + "10262": msg12709, + "10263": msg12710, + "10264": msg12711, + "10265": msg12712, + "10266": msg12713, + "10267": msg12714, + "10268": msg12715, + "10269": msg12716, + "1027": select926, + "10270": msg12717, + "10271": msg12718, + "10272": msg12719, + "10273": msg12720, + "10274": msg12721, + "10275": msg12722, + "10276": msg12723, + "10277": msg12724, + "10278": msg12725, + "10279": msg12726, + "1028": select927, + "10280": msg12727, + "10281": msg12728, + "10282": msg12729, + "10283": msg12730, + "10284": msg12731, + "10285": msg12732, + "10286": msg12733, + "10287": msg12734, + "10288": msg12735, + "10289": msg12736, + "1029": select928, + "10290": msg12737, + "10291": msg12738, + "10292": msg12739, + "10293": msg12740, + "10294": msg12741, + "10295": msg12742, + "10296": msg12743, + "10297": msg12744, + "10298": msg12745, + "10299": msg12746, + "103": select31, + "1030": select929, + "10300": msg12747, + "10301": msg12748, + "10302": msg12749, + "10303": msg12750, + "10304": msg12751, + "10305": msg12752, + "10306": msg12753, + "10307": msg12754, + "10308": msg12755, + "10309": msg12756, + "1031": select930, + "10310": msg12757, + "10311": msg12758, + "10312": msg12759, + "10313": msg12760, + "10314": msg12761, + "10315": msg12762, + "10316": msg12763, + "10317": msg12764, + "10318": msg12765, + "10319": msg12766, + "1032": select931, + "10320": msg12767, + "10321": msg12768, + "10322": msg12769, + "10323": msg12770, + "10324": msg12771, + "10325": msg12772, + "10326": msg12773, + "10327": msg12774, + "10328": msg12775, + "10329": msg12776, + "1033": select932, + "10330": msg12777, + "10331": msg12778, + "10332": msg12779, + "10333": msg12780, + "10334": msg12781, + "10335": msg12782, + "10336": msg12783, + "10337": msg12784, + "10338": msg12785, + "10339": msg12786, + "1034": select933, + "10340": msg12787, + "10341": msg12788, + "10342": msg12789, + "10343": msg12790, + "10344": msg12791, + "10345": msg12792, + "10346": msg12793, + "10347": msg12794, + "10348": msg12795, + "10349": msg12796, + "1035": select934, + "10350": msg12797, + "10351": msg12798, + "10352": msg12799, + "10353": msg12800, + "10354": msg12801, + "10355": msg12802, + "10356": msg12803, + "10357": msg12804, + "10358": msg12805, + "10359": msg12806, + "1036": select935, + "10360": msg12807, + "10361": msg12808, + "10362": msg12809, + "10363": msg12810, + "10364": msg12811, + "10365": msg12812, + "10366": msg12813, + "10367": msg12814, + "10368": msg12815, + "10369": msg12816, + "1037": select936, + "10370": msg12817, + "10371": msg12818, + "10372": msg12819, + "10373": msg12820, + "10374": msg12821, + "10375": msg12822, + "10376": msg12823, + "10377": msg12824, + "10378": msg12825, + "10379": msg12826, + "1038": select937, + "10380": msg12827, + "10381": msg12828, + "10382": msg12829, + "10383": msg12830, + "10384": msg12831, + "10385": msg12832, + "10386": msg12833, + "10387": msg12834, + "10388": msg12835, + "10389": msg12836, + "1039": select938, + "10390": msg12837, + "10391": msg12838, + "10392": msg12839, + "10393": msg12840, + "10394": msg12841, + "10395": msg12842, + "10396": msg12843, + "10397": msg12844, + "10398": msg12845, + "10399": msg12846, + "104": select32, + "1040": select939, + "10400": msg12847, + "10401": msg12848, + "10402": msg12849, + "10403": msg12850, + "10404": msg12851, + "10405": msg12852, + "10406": msg12853, + "10407": msg12854, + "10408": msg12855, + "10409": msg12856, + "1041": select940, + "10410": msg12857, + "10411": msg12858, + "10412": msg12859, + "10413": msg12860, + "10414": msg12861, + "10415": msg12862, + "10416": msg12863, + "10417": msg12864, + "10418": msg12865, + "10419": msg12866, + "1042": select941, + "10420": msg12867, + "10421": msg12868, + "10422": msg12869, + "10423": msg12870, + "10424": msg12871, + "10425": msg12872, + "10426": msg12873, + "10427": msg12874, + "10428": msg12875, + "10429": msg12876, + "1043": select942, + "10430": msg12877, + "10431": msg12878, + "10432": msg12879, + "10433": msg12880, + "10434": msg12881, + "10435": msg12882, + "10436": msg12883, + "10437": msg12884, + "10438": msg12885, + "10439": msg12886, + "1044": select943, + "10440": msg12887, + "10441": msg12888, + "10442": msg12889, + "10443": msg12890, + "10444": msg12891, + "10445": msg12892, + "10446": msg12893, + "10447": msg12894, + "10448": msg12895, + "10449": msg12896, + "1045": select944, + "10450": msg12897, + "10451": msg12898, + "10452": msg12899, + "10453": msg12900, + "10454": msg12901, + "10455": msg12902, + "10456": msg12903, + "10457": msg12904, + "10458": msg12905, + "10459": msg12906, + "1046": select945, + "10460": msg12907, + "10461": msg12908, + "10462": msg12909, + "10463": msg12910, + "10464": msg12911, + "10465": msg12912, + "10466": msg12913, + "10467": msg12914, + "10468": msg12915, + "10469": msg12916, + "1047": select946, + "10470": msg12917, + "10471": msg12918, + "10472": msg12919, + "10473": msg12920, + "10474": msg12921, + "10475": msg12922, + "10476": msg12923, + "10477": msg12924, + "10478": msg12925, + "10479": msg12926, + "1048": select947, + "10480": msg12927, + "10481": msg12928, + "10482": msg12929, + "10483": msg12930, + "10484": msg12931, + "10485": msg12932, + "10486": msg12933, + "10487": msg12934, + "10488": msg12935, + "10489": msg12936, + "1049": select948, + "10490": msg12937, + "10491": msg12938, + "10492": msg12939, + "10493": msg12940, + "10494": msg12941, + "10495": msg12942, + "10496": msg12943, + "10497": msg12944, + "10498": msg12945, + "10499": msg12946, + "105": select33, + "105-1": msg86, + "105-2": msg87, + "105-3": msg88, + "105-4": msg89, + "1050": select949, + "10500": msg12947, + "10501": msg12948, + "10502": msg12949, + "10503": msg12950, + "10504": msg12951, + "10505": msg12952, + "10506": msg12953, + "10507": msg12954, + "10508": msg12955, + "10509": msg12956, + "1051": select950, + "10510": msg12957, + "10511": msg12958, + "10512": msg12959, + "10513": msg12960, + "10514": msg12961, + "10515": msg12962, + "10516": msg12963, + "10517": msg12964, + "10518": msg12965, + "10519": msg12966, + "1052": select951, + "10520": msg12967, + "10521": msg12968, + "10522": msg12969, + "10523": msg12970, + "10524": msg12971, + "10525": msg12972, + "10526": msg12973, + "10527": msg12974, + "10528": msg12975, + "10529": msg12976, + "1053": select952, + "10530": msg12977, + "10531": msg12978, + "10532": msg12979, + "10533": msg12980, + "10534": msg12981, + "10535": msg12982, + "10536": msg12983, + "10537": msg12984, + "10538": msg12985, + "10539": msg12986, + "1054": select953, + "10540": msg12987, + "10541": msg12988, + "10542": msg12989, + "10543": msg12990, + "10544": msg12991, + "10545": msg12992, + "10546": msg12993, + "10547": msg12994, + "10548": msg12995, + "10549": msg12996, + "1055": select954, + "10550": msg12997, + "10551": msg12998, + "10552": msg12999, + "10553": msg13000, + "10554": msg13001, + "10555": msg13002, + "10556": msg13003, + "10557": msg13004, + "10558": msg13005, + "10559": msg13006, + "1056": select955, + "10560": msg13007, + "10561": msg13008, + "10562": msg13009, + "10563": msg13010, + "10564": msg13011, + "10565": msg13012, + "10566": msg13013, + "10567": msg13014, + "10568": msg13015, + "10569": msg13016, + "1057": select956, + "10570": msg13017, + "10571": msg13018, + "10572": msg13019, + "10573": msg13020, + "10574": msg13021, + "10575": msg13022, + "10576": msg13023, + "10577": msg13024, + "10578": msg13025, + "10579": msg13026, + "1058": select957, + "10580": msg13027, + "10581": msg13028, + "10582": msg13029, + "10583": msg13030, + "10584": msg13031, + "10585": msg13032, + "10586": msg13033, + "10587": msg13034, + "10588": msg13035, + "10589": msg13036, + "1059": select958, + "10590": msg13037, + "10591": msg13038, + "10592": msg13039, + "10593": msg13040, + "10594": msg13041, + "10595": msg13042, + "10596": msg13043, + "10597": msg13044, + "10598": msg13045, + "10599": msg13046, + "106": select34, + "106-1": msg92, + "106-2": msg93, + "106-3": msg94, + "106-4": msg95, + "1060": select959, + "10600": msg13047, + "10601": msg13048, + "10602": msg13049, + "10603": msg13050, + "10604": msg13051, + "10605": msg13052, + "10606": msg13053, + "10607": msg13054, + "10608": msg13055, + "10609": msg13056, + "1061": select960, + "10610": msg13057, + "10611": msg13058, + "10612": msg13059, + "10613": msg13060, + "10614": msg13061, + "10615": msg13062, + "10616": msg13063, + "10617": msg13064, + "10618": msg13065, + "10619": msg13066, + "1062": select961, + "10620": msg13067, + "10621": msg13068, + "10622": msg13069, + "10623": msg13070, + "10624": msg13071, + "10625": msg13072, + "10626": msg13073, + "10627": msg13074, + "10628": msg13075, + "10629": msg13076, + "1063": select962, + "10630": msg13077, + "10631": msg13078, + "10632": msg13079, + "10633": msg13080, + "10634": msg13081, + "10635": msg13082, + "10636": msg13083, + "10637": msg13084, + "10638": msg13085, + "10639": msg13086, + "1064": select963, + "10640": msg13087, + "10641": msg13088, + "10642": msg13089, + "10643": msg13090, + "10644": msg13091, + "10645": msg13092, + "10646": msg13093, + "10647": msg13094, + "10648": msg13095, + "10649": msg13096, + "1065": select964, + "10650": msg13097, + "10651": msg13098, + "10652": msg13099, + "10653": msg13100, + "10654": msg13101, + "10655": msg13102, + "10656": msg13103, + "10657": msg13104, + "10658": msg13105, + "10659": msg13106, + "1066": select965, + "10660": msg13107, + "10661": msg13108, + "10662": msg13109, + "10663": msg13110, + "10664": msg13111, + "10665": msg13112, + "10666": msg13113, + "10667": msg13114, + "10668": msg13115, + "10669": msg13116, + "1067": select966, + "10670": msg13117, + "10671": msg13118, + "10672": msg13119, + "10673": msg13120, + "10674": msg13121, + "10675": msg13122, + "10676": msg13123, + "10677": msg13124, + "10678": msg13125, + "10679": msg13126, + "1068": select967, + "10680": msg13127, + "10681": msg13128, + "10682": msg13129, + "10683": msg13130, + "10684": msg13131, + "10685": msg13132, + "10686": msg13133, + "10687": msg13134, + "10688": msg13135, + "10689": msg13136, + "1069": select968, + "10690": msg13137, + "10691": msg13138, + "10692": msg13139, + "10693": msg13140, + "10694": msg13141, + "10695": msg13142, + "10696": msg13143, + "10697": msg13144, + "10698": msg13145, + "10699": msg13146, + "107": select35, + "1070": select969, + "10700": msg13147, + "10701": msg13148, + "10702": msg13149, + "10703": msg13150, + "10704": msg13151, + "10705": msg13152, + "10706": msg13153, + "10707": msg13154, + "10708": msg13155, + "10709": msg13156, + "1071": select970, + "10710": msg13157, + "10711": msg13158, + "10712": msg13159, + "10713": msg13160, + "10714": msg13161, + "10715": msg13162, + "10716": msg13163, + "10717": msg13164, + "10718": msg13165, + "10719": msg13166, + "1072": select971, + "10720": msg13167, + "10721": msg13168, + "10722": msg13169, + "10723": msg13170, + "10724": msg13171, + "10725": msg13172, + "10726": msg13173, + "10727": msg13174, + "10728": msg13175, + "10729": msg13176, + "1073": select972, + "10730": msg13177, + "10731": msg13178, + "10732": msg13179, + "10733": msg13180, + "10734": msg13181, + "10735": msg13182, + "10736": msg13183, + "10737": msg13184, + "10738": msg13185, + "10739": msg13186, + "10740": msg13187, + "10741": msg13188, + "10742": msg13189, + "10743": msg13190, + "10744": msg13191, + "10745": msg13192, + "10746": msg13193, + "10747": msg13194, + "10748": msg13195, + "10749": msg13196, + "1075": select973, + "10750": msg13197, + "10751": msg13198, + "10752": msg13199, + "10753": msg13200, + "10754": msg13201, + "10755": msg13202, + "10756": msg13203, + "10757": msg13204, + "10758": msg13205, + "10759": msg13206, + "1076": select974, + "10760": msg13207, + "10761": msg13208, + "10762": msg13209, + "10763": msg13210, + "10764": msg13211, + "10765": msg13212, + "10766": msg13213, + "10767": msg13214, + "10768": msg13215, + "10769": msg13216, + "1077": select975, + "10770": msg13217, + "10771": msg13218, + "10772": msg13219, + "10773": msg13220, + "10774": msg13221, + "10775": msg13222, + "10776": msg13223, + "10777": msg13224, + "10778": msg13225, + "10779": msg13226, + "1078": select976, + "10780": msg13227, + "10781": msg13228, + "10782": msg13229, + "10783": msg13230, + "10784": msg13231, + "10785": msg13232, + "10786": msg13233, + "10787": msg13234, + "10788": msg13235, + "10789": msg13236, + "1079": select977, + "10790": msg13237, + "10791": msg13238, + "10792": msg13239, + "10793": msg13240, + "10794": msg13241, + "10795": msg13242, + "10796": msg13243, + "10797": msg13244, + "10798": msg13245, + "10799": msg13246, + "108": select36, + "1080": select978, + "10800": msg13247, + "10801": msg13248, + "10802": msg13249, + "10803": msg13250, + "10804": msg13251, + "10805": msg13252, + "10806": msg13253, + "10807": msg13254, + "10808": msg13255, + "10809": msg13256, + "1081": select979, + "10810": msg13257, + "10811": msg13258, + "10812": msg13259, + "10813": msg13260, + "10814": msg13261, + "10815": msg13262, + "10816": msg13263, + "10817": msg13264, + "10818": msg13265, + "10819": msg13266, + "1082": select980, + "10820": msg13267, + "10821": msg13268, + "10822": msg13269, + "10823": msg13270, + "10824": msg13271, + "10825": msg13272, + "10826": msg13273, + "10827": msg13274, + "10828": msg13275, + "10829": msg13276, + "1083": select981, + "10830": msg13277, + "10831": msg13278, + "10832": msg13279, + "10833": msg13280, + "10834": msg13281, + "10835": msg13282, + "10836": msg13283, + "10837": msg13284, + "10838": msg13285, + "10839": msg13286, + "1084": select982, + "10840": msg13287, + "10841": msg13288, + "10842": msg13289, + "10843": msg13290, + "10844": msg13291, + "10845": msg13292, + "10846": msg13293, + "10847": msg13294, + "10848": msg13295, + "10849": msg13296, + "1085": select983, + "10850": msg13297, + "10851": msg13298, + "10852": msg13299, + "10853": msg13300, + "10854": msg13301, + "10855": msg13302, + "10856": msg13303, + "10857": msg13304, + "10858": msg13305, + "10859": msg13306, + "1086": select984, + "10860": msg13307, + "10861": msg13308, + "10862": msg13309, + "10863": msg13310, + "10864": msg13311, + "10865": msg13312, + "10866": msg13313, + "10867": msg13314, + "10868": msg13315, + "10869": msg13316, + "1087": select985, + "10870": msg13317, + "10871": msg13318, + "10872": msg13319, + "10873": msg13320, + "10874": msg13321, + "10875": msg13322, + "10876": msg13323, + "10877": msg13324, + "10878": msg13325, + "10879": msg13326, + "1088": select986, + "10880": msg13327, + "10881": msg13328, + "10882": msg13329, + "10883": msg13330, + "10884": msg13331, + "10885": msg13332, + "10886": msg13333, + "10887": msg13334, + "10888": msg13335, + "10889": msg13336, + "1089": select987, + "10890": msg13337, + "10891": msg13338, + "10892": msg13339, + "10893": msg13340, + "10894": msg13341, + "10895": msg13342, + "10896": msg13343, + "10897": msg13344, + "10898": msg13345, + "10899": msg13346, + "109": select37, + "1090": select988, + "10900": msg13347, + "10901": msg13348, + "10902": msg13349, + "10903": msg13350, + "10904": msg13351, + "10905": msg13352, + "10906": msg13353, + "10907": msg13354, + "10908": msg13355, + "10909": msg13356, + "1091": select989, + "10910": msg13357, + "10911": msg13358, + "10912": msg13359, + "10913": msg13360, + "10914": msg13361, + "10915": msg13362, + "10916": msg13363, + "10917": msg13364, + "10918": msg13365, + "10919": msg13366, + "1092": select990, + "10920": msg13367, + "10921": msg13368, + "10922": msg13369, + "10923": msg13370, + "10924": msg13371, + "10925": msg13372, + "10926": msg13373, + "10927": msg13374, + "10928": msg13375, + "10929": msg13376, + "1093": select991, + "10930": msg13377, + "10931": msg13378, + "10932": msg13379, + "10933": msg13380, + "10934": msg13381, + "10935": msg13382, + "10936": msg13383, + "10937": msg13384, + "10938": msg13385, + "10939": msg13386, + "1094": select992, + "10940": msg13387, + "10941": msg13388, + "10942": msg13389, + "10943": msg13390, + "10944": msg13391, + "10945": msg13392, + "10946": msg13393, + "10947": msg13394, + "10948": msg13395, + "10949": msg13396, + "1095": select993, + "10950": msg13397, + "10951": msg13398, + "10952": msg13399, + "10953": msg13400, + "10954": msg13401, + "10955": msg13402, + "10956": msg13403, + "10957": msg13404, + "10958": msg13405, + "10959": msg13406, + "1096": select994, + "10960": msg13407, + "10961": msg13408, + "10962": msg13409, + "10963": msg13410, + "10964": msg13411, + "10965": msg13412, + "10966": msg13413, + "10967": msg13414, + "10968": msg13415, + "10969": msg13416, + "1097": select995, + "10970": msg13417, + "10971": msg13418, + "10972": msg13419, + "10973": msg13420, + "10974": msg13421, + "10975": msg13422, + "10976": msg13423, + "10977": msg13424, + "10978": msg13425, + "10979": msg13426, + "1098": select996, + "10980": msg13427, + "10981": msg13428, + "10982": msg13429, + "10983": msg13430, + "10984": msg13431, + "10985": msg13432, + "10986": msg13433, + "10987": msg13434, + "10988": msg13435, + "10989": msg13436, + "1099": select997, + "10990": msg13437, + "10991": msg13438, + "10992": msg13439, + "10993": msg13440, + "10994": msg13441, + "10995": msg13442, + "10996": msg13443, + "10997": msg13444, + "10998": msg13445, + "10999": msg13446, + "11": msg35, + "110": select38, + "110-1": msg105, + "110-2": msg106, + "110-3": msg107, + "110-4": msg108, + "1100": select998, + "11000": msg13447, + "11001": msg13448, + "11002": msg13449, + "11003": msg13450, + "11004": msg13451, + "11005": msg13452, + "11006": msg13453, + "11007": msg13454, + "11008": msg13455, + "11009": msg13456, + "1101": select999, + "11010": msg13457, + "11011": msg13458, + "11012": msg13459, + "11013": msg13460, + "11014": msg13461, + "11015": msg13462, + "11016": msg13463, + "11017": msg13464, + "11018": msg13465, + "11019": msg13466, + "1102": select1000, + "11020": msg13467, + "11021": msg13468, + "11022": msg13469, + "11023": msg13470, + "11024": msg13471, + "11025": msg13472, + "11026": msg13473, + "11027": msg13474, + "11028": msg13475, + "11029": msg13476, + "1103": select1001, + "11030": msg13477, + "11031": msg13478, + "11032": msg13479, + "11033": msg13480, + "11034": msg13481, + "11035": msg13482, + "11036": msg13483, + "11037": msg13484, + "11038": msg13485, + "11039": msg13486, + "1104": select1002, + "11040": msg13487, + "11041": msg13488, + "11042": msg13489, + "11043": msg13490, + "11044": msg13491, + "11045": msg13492, + "11046": msg13493, + "11047": msg13494, + "11048": msg13495, + "11049": msg13496, + "1105": select1003, + "11050": msg13497, + "11051": msg13498, + "11052": msg13499, + "11053": msg13500, + "11054": msg13501, + "11055": msg13502, + "11056": msg13503, + "11057": msg13504, + "11058": msg13505, + "11059": msg13506, + "1106": select1004, + "11060": msg13507, + "11061": msg13508, + "11062": msg13509, + "11063": msg13510, + "11064": msg13511, + "11065": msg13512, + "11066": msg13513, + "11067": msg13514, + "11068": msg13515, + "11069": msg13516, + "1107": select1005, + "11070": msg13517, + "11071": msg13518, + "11072": msg13519, + "11073": msg13520, + "11074": msg13521, + "11075": msg13522, + "11076": msg13523, + "11077": msg13524, + "11078": msg13525, + "11079": msg13526, + "1108": select1006, + "11080": msg13527, + "11081": msg13528, + "11082": msg13529, + "11083": msg13530, + "11084": msg13531, + "11085": msg13532, + "11086": msg13533, + "11087": msg13534, + "11088": msg13535, + "11089": msg13536, + "1109": select1007, + "11090": msg13537, + "11091": msg13538, + "11092": msg13539, + "11093": msg13540, + "11094": msg13541, + "11095": msg13542, + "11096": msg13543, + "11097": msg13544, + "11098": msg13545, + "11099": msg13546, + "111": select39, + "111-1": msg111, + "111-10": msg112, + "111-11": msg113, + "111-12": msg114, + "111-13": msg115, + "111-14": msg116, + "111-15": msg117, + "111-16": msg118, + "111-17": msg119, + "111-2": msg120, + "111-3": msg121, + "111-4": msg122, + "111-5": msg123, + "111-6": msg124, + "111-7": msg125, + "111-8": msg126, + "111-9": msg127, + "1110": select1008, + "11100": msg13547, + "11101": msg13548, + "11102": msg13549, + "11103": msg13550, + "11104": msg13551, + "11105": msg13552, + "11106": msg13553, + "11107": msg13554, + "11108": msg13555, + "11109": msg13556, + "1111": select1009, + "11110": msg13557, + "11111": msg13558, + "11112": msg13559, + "11113": msg13560, + "11114": msg13561, + "11115": msg13562, + "11116": msg13563, + "11117": msg13564, + "11118": msg13565, + "11119": msg13566, + "1112": select1010, + "11120": msg13567, + "11121": msg13568, + "11122": msg13569, + "11123": msg13570, + "11124": msg13571, + "11125": msg13572, + "11126": msg13573, + "11127": msg13574, + "11128": msg13575, + "11129": msg13576, + "1113": select1011, + "11130": msg13577, + "11131": msg13578, + "11132": msg13579, + "11133": msg13580, + "11134": msg13581, + "11135": msg13582, + "11136": msg13583, + "11137": msg13584, + "11138": msg13585, + "11139": msg13586, + "1114": select1012, + "11140": msg13587, + "11141": msg13588, + "11142": msg13589, + "11143": msg13590, + "11144": msg13591, + "11145": msg13592, + "11146": msg13593, + "11147": msg13594, + "11148": msg13595, + "11149": msg13596, + "1115": select1013, + "11150": msg13597, + "11151": msg13598, + "11152": msg13599, + "11153": msg13600, + "11154": msg13601, + "11155": msg13602, + "11156": msg13603, + "11157": msg13604, + "11158": msg13605, + "11159": msg13606, + "1116": select1014, + "11160": msg13607, + "11161": msg13608, + "11162": msg13609, + "11163": msg13610, + "11164": msg13611, + "11165": msg13612, + "11166": msg13613, + "11167": msg13614, + "11168": msg13615, + "11169": msg13616, + "1117": select1015, + "11170": msg13617, + "11171": msg13618, + "11172": msg13619, + "11173": msg13620, + "11174": msg13621, + "11175": msg13622, + "11176": msg13623, + "11177": msg13624, + "11178": msg13625, + "11179": msg13626, + "1118": select1016, + "11180": msg13627, + "11181": msg13628, + "11182": msg13629, + "11183": msg13630, + "11184": msg13631, + "11185": msg13632, + "11186": msg13633, + "11187": msg13634, + "11188": msg13635, + "11189": msg13636, + "1119": select1017, + "11190": msg13637, + "11191": msg13638, + "11192": msg13639, + "11193": msg13640, + "11194": msg13641, + "11196": msg13642, + "11197": msg13643, + "11198": msg13644, + "11199": msg13645, + "112": select40, + "112-1": msg130, + "112-2": msg131, + "112-3": msg132, + "112-4": msg133, + "1120": select1018, + "11200": msg13646, + "11201": msg13647, + "11202": msg13648, + "11203": msg13649, + "11204": msg13650, + "11205": msg13651, + "11206": msg13652, + "11207": msg13653, + "11208": msg13654, + "11209": msg13655, + "1121": select1019, + "11210": msg13656, + "11211": msg13657, + "11212": msg13658, + "11213": msg13659, + "11214": msg13660, + "11215": msg13661, + "11216": msg13662, + "11217": msg13663, + "11218": msg13664, + "11219": msg13665, + "1122": select1020, + "11220": msg13666, + "11221": msg13667, + "11222": msg13668, + "11223": msg13669, + "11224": msg13670, + "11225": msg13671, + "11226": msg13672, + "11227": msg13673, + "11228": msg13674, + "11229": msg13675, + "1123": select1021, + "11230": msg13676, + "11231": msg13677, + "11232": msg13678, + "11233": msg13679, + "11234": msg13680, + "11235": msg13681, + "11236": msg13682, + "11237": msg13683, + "11238": msg13684, + "11239": msg13685, + "1124": select1022, + "11240": msg13686, + "11241": msg13687, + "11242": msg13688, + "11243": msg13689, + "11244": msg13690, + "11245": msg13691, + "11246": msg13692, + "11247": msg13693, + "11248": msg13694, + "11249": msg13695, + "1125": select1023, + "11250": msg13696, + "11251": msg13697, + "11252": msg13698, + "11253": msg13699, + "11254": msg13700, + "11255": msg13701, + "11256": msg13702, + "11257": msg13703, + "11258": msg13704, + "11259": msg13705, + "1126": select1024, + "11260": msg13706, + "11261": msg13707, + "11262": msg13708, + "11263": msg13709, + "11264": msg13710, + "11265": msg13711, + "11266": msg13712, + "11267": msg13713, + "11268": msg13714, + "11269": msg13715, + "1127": select1025, + "11270": msg13716, + "11271": msg13717, + "11272": msg13718, + "11273": msg13719, + "11274": msg13720, + "11275": msg13721, + "11276": msg13722, + "11277": msg13723, + "11278": msg13724, + "11279": msg13725, + "1128": select1026, + "11280": msg13726, + "11281": msg13727, + "11282": msg13728, + "11283": msg13729, + "11284": msg13730, + "11285": msg13731, + "11286": msg13732, + "11287": msg13733, + "11288": msg13734, + "11289": msg13735, + "1129": select1027, + "11290": msg13736, + "11291": msg13737, + "11292": msg13738, + "11293": msg13739, + "11294": msg13740, + "11295": msg13741, + "11296": msg13742, + "11297": msg13743, + "11298": msg13744, + "11299": msg13745, + "113": select41, + "1130": select1028, + "11300": msg13746, + "11301": msg13747, + "11302": msg13748, + "11303": msg13749, + "11304": msg13750, + "11305": msg13751, + "11306": msg13752, + "11307": msg13753, + "11308": msg13754, + "11309": msg13755, + "1131": select1029, + "11310": msg13756, + "11311": msg13757, + "11312": msg13758, + "11313": msg13759, + "11314": msg13760, + "11315": msg13761, + "11316": msg13762, + "11317": msg13763, + "11318": msg13764, + "11319": msg13765, + "1132": select1030, + "11320": msg13766, + "11321": msg13767, + "11322": msg13768, + "11323": msg13769, + "11324": msg13770, + "11325": msg13771, + "11326": msg13772, + "11327": msg13773, + "11328": msg13774, + "11329": msg13775, + "1133": select1031, + "11330": msg13776, + "11331": msg13777, + "11332": msg13778, + "11333": msg13779, + "11334": msg13780, + "11335": msg13781, + "11336": msg13782, + "11337": msg13783, + "11338": msg13784, + "11339": msg13785, + "1134": select1032, + "11340": msg13786, + "11341": msg13787, + "11342": msg13788, + "11343": msg13789, + "11344": msg13790, + "11345": msg13791, + "11346": msg13792, + "11347": msg13793, + "11348": msg13794, + "11349": msg13795, + "11350": msg13796, + "11351": msg13797, + "11352": msg13798, + "11353": msg13799, + "11354": msg13800, + "11355": msg13801, + "11356": msg13802, + "11357": msg13803, + "11358": msg13804, + "11359": msg13805, + "1136": select1033, + "11360": msg13806, + "11361": msg13807, + "11362": msg13808, + "11363": msg13809, + "11364": msg13810, + "11365": msg13811, + "11366": msg13812, + "11367": msg13813, + "11368": msg13814, + "11369": msg13815, + "1137": select1034, + "11370": msg13816, + "11371": msg13817, + "11372": msg13818, + "11373": msg13819, + "11374": msg13820, + "11375": msg13821, + "11376": msg13822, + "11377": msg13823, + "11378": msg13824, + "11379": msg13825, + "1138": select1035, + "11380": msg13826, + "11381": msg13827, + "11382": msg13828, + "11383": msg13829, + "11384": msg13830, + "11385": msg13831, + "11386": msg13832, + "11387": msg13833, + "11388": msg13834, + "11389": msg13835, + "1139": select1036, + "11390": msg13836, + "11391": msg13837, + "11392": msg13838, + "11393": msg13839, + "11394": msg13840, + "11395": msg13841, + "11396": msg13842, + "11397": msg13843, + "11398": msg13844, + "11399": msg13845, + "114": select42, + "1140": select1037, + "11400": msg13846, + "11401": msg13847, + "11402": msg13848, + "11403": msg13849, + "11404": msg13850, + "11405": msg13851, + "11406": msg13852, + "11407": msg13853, + "11408": msg13854, + "11409": msg13855, + "1141": select1038, + "11410": msg13856, + "11411": msg13857, + "11412": msg13858, + "11413": msg13859, + "11414": msg13860, + "11415": msg13861, + "11416": msg13862, + "11417": msg13863, + "11418": msg13864, + "11419": msg13865, + "1142": select1039, + "11420": msg13866, + "11421": msg13867, + "11422": msg13868, + "11423": msg13869, + "11424": msg13870, + "11425": msg13871, + "11426": msg13872, + "11427": msg13873, + "11428": msg13874, + "11429": msg13875, + "1143": select1040, + "11430": msg13876, + "11431": msg13877, + "11432": msg13878, + "11433": msg13879, + "11434": msg13880, + "11435": msg13881, + "11436": msg13882, + "11437": msg13883, + "11438": msg13884, + "11439": msg13885, + "1144": select1041, + "11440": msg13886, + "11441": msg13887, + "11442": msg13888, + "11443": msg13889, + "11444": msg13890, + "11445": msg13891, + "11446": msg13892, + "11447": msg13893, + "11448": msg13894, + "11449": msg13895, + "1145": select1042, + "11450": msg13896, + "11451": msg13897, + "11452": msg13898, + "11453": msg13899, + "11454": msg13900, + "11455": msg13901, + "11456": msg13902, + "11457": msg13903, + "11458": msg13904, + "11459": msg13905, + "1146": select1043, + "11460": msg13906, + "11461": msg13907, + "11462": msg13908, + "11463": msg13909, + "11464": msg13910, + "11465": msg13911, + "11466": msg13912, + "11467": msg13913, + "11468": msg13914, + "11469": msg13915, + "1147": select1044, + "11470": msg13916, + "11471": msg13917, + "11472": msg13918, + "11473": msg13919, + "11474": msg13920, + "11475": msg13921, + "11476": msg13922, + "11477": msg13923, + "11478": msg13924, + "11479": msg13925, + "1148": select1045, + "11480": msg13926, + "11481": msg13927, + "11482": msg13928, + "11483": msg13929, + "11484": msg13930, + "11485": msg13931, + "11486": msg13932, + "11487": msg13933, + "11488": msg13934, + "11489": msg13935, + "1149": select1046, + "11490": msg13936, + "11491": msg13937, + "11492": msg13938, + "11493": msg13939, + "11494": msg13940, + "11495": msg13941, + "11496": msg13942, + "11497": msg13943, + "11498": msg13944, + "11499": msg13945, + "115": select43, + "115-1": msg140, + "115-2": msg141, + "115-3": msg142, + "115-4": msg143, + "115-5": msg144, + "1150": select1047, + "11500": msg13946, + "11501": msg13947, + "11502": msg13948, + "11503": msg13949, + "11504": msg13950, + "11505": msg13951, + "11506": msg13952, + "11507": msg13953, + "11508": msg13954, + "11509": msg13955, + "1151": select1048, + "11510": msg13956, + "11511": msg13957, + "11512": msg13958, + "11513": msg13959, + "11514": msg13960, + "11515": msg13961, + "11516": msg13962, + "11517": msg13963, + "11518": msg13964, + "11519": msg13965, + "1152": select1049, + "11520": msg13966, + "11521": msg13967, + "11522": msg13968, + "11523": msg13969, + "11524": msg13970, + "11525": msg13971, + "11526": msg13972, + "11527": msg13973, + "11528": msg13974, + "11529": msg13975, + "1153": select1050, + "11530": msg13976, + "11531": msg13977, + "11532": msg13978, + "11533": msg13979, + "11534": msg13980, + "11535": msg13981, + "11536": msg13982, + "11537": msg13983, + "11538": msg13984, + "11539": msg13985, + "1154": select1051, + "11540": msg13986, + "11541": msg13987, + "11542": msg13988, + "11543": msg13989, + "11544": msg13990, + "11545": msg13991, + "11546": msg13992, + "11547": msg13993, + "11548": msg13994, + "11549": msg13995, + "1155": select1052, + "11550": msg13996, + "11551": msg13997, + "11552": msg13998, + "11553": msg13999, + "11554": msg14000, + "11555": msg14001, + "11556": msg14002, + "11557": msg14003, + "11558": msg14004, + "11559": msg14005, + "1156": select1053, + "11560": msg14006, + "11561": msg14007, + "11562": msg14008, + "11563": msg14009, + "11564": msg14010, + "11565": msg14011, + "11566": msg14012, + "11567": msg14013, + "11568": msg14014, + "11569": msg14015, + "1157": select1054, + "11570": msg14016, + "11571": msg14017, + "11572": msg14018, + "11573": msg14019, + "11574": msg14020, + "11575": msg14021, + "11576": msg14022, + "11577": msg14023, + "11578": msg14024, + "11579": msg14025, + "1158": select1055, + "11580": msg14026, + "11581": msg14027, + "11582": msg14028, + "11583": msg14029, + "11584": msg14030, + "11585": msg14031, + "11586": msg14032, + "11587": msg14033, + "11588": msg14034, + "11589": msg14035, + "1159": select1056, + "11590": msg14036, + "11591": msg14037, + "11592": msg14038, + "11593": msg14039, + "11594": msg14040, + "11595": msg14041, + "11596": msg14042, + "11597": msg14043, + "11598": msg14044, + "11599": msg14045, + "116": select44, + "116-5": msg147, + "1160": select1057, + "11600": msg14046, + "11601": msg14047, + "11602": msg14048, + "11603": msg14049, + "11604": msg14050, + "11605": msg14051, + "11606": msg14052, + "11607": msg14053, + "11608": msg14054, + "11609": msg14055, + "1161": select1058, + "11610": msg14056, + "11611": msg14057, + "11612": msg14058, + "11613": msg14059, + "11614": msg14060, + "11615": msg14061, + "11616": msg14062, + "11617": msg14063, + "11618": msg14064, + "11619": msg14065, + "1162": select1059, + "11620": msg14066, + "11621": msg14067, + "11622": msg14068, + "11623": msg14069, + "11624": msg14070, + "11625": msg14071, + "11626": msg14072, + "11627": msg14073, + "11628": msg14074, + "11629": msg14075, + "1163": select1060, + "11630": msg14076, + "11631": msg14077, + "11632": msg14078, + "11633": msg14079, + "11634": msg14080, + "11635": msg14081, + "11636": msg14082, + "11637": msg14083, + "11638": msg14084, + "11639": msg14085, + "1164": select1061, + "11640": msg14086, + "11641": msg14087, + "11642": msg14088, + "11643": msg14089, + "11644": msg14090, + "11645": msg14091, + "11646": msg14092, + "11647": msg14093, + "11648": msg14094, + "11649": msg14095, + "1165": select1062, + "11650": msg14096, + "11651": msg14097, + "11652": msg14098, + "11653": msg14099, + "11654": msg14100, + "11655": msg14101, + "11656": msg14102, + "11657": msg14103, + "11658": msg14104, + "11659": msg14105, + "1166": select1063, + "11660": msg14106, + "11661": msg14107, + "11662": msg14108, + "11663": msg14109, + "11664": msg14110, + "11665": msg14111, + "11666": msg14112, + "11667": msg14113, + "11668": msg14114, + "11669": msg14115, + "1167": select1064, + "11670": msg14116, + "11671": msg14117, + "11672": msg14118, + "11673": msg14119, + "11674": msg14120, + "11675": msg14121, + "11676": msg14122, + "11677": msg14123, + "11678": msg14124, + "11679": msg14125, + "1168": select1065, + "11680": msg14126, + "11681": msg14127, + "11682": msg14128, + "11683": msg14129, + "11684": msg14130, + "11685": msg14131, + "11686": msg14132, + "11687": msg14133, + "11688": msg14134, + "11689": msg14135, + "11690": msg14136, + "11691": msg14137, + "11692": msg14138, + "11693": msg14139, + "11694": msg14140, + "11695": msg14141, + "11696": msg14142, + "11697": msg14143, + "11698": msg14144, + "11699": msg14145, + "117": select45, + "11700": msg14146, + "11701": msg14147, + "11702": msg14148, + "11703": msg14149, + "11704": msg14150, + "11705": msg14151, + "11706": msg14152, + "11707": msg14153, + "11708": msg14154, + "11709": msg14155, + "1171": select1066, + "11710": msg14156, + "11711": msg14157, + "11712": msg14158, + "11713": msg14159, + "11714": msg14160, + "11715": msg14161, + "11716": msg14162, + "11717": msg14163, + "11718": msg14164, + "11719": msg14165, + "1172": select1067, + "11720": msg14166, + "11721": msg14167, + "11722": msg14168, + "11723": msg14169, + "11724": msg14170, + "11725": msg14171, + "11726": msg14172, + "11727": msg14173, + "11728": msg14174, + "11729": msg14175, + "1173": select1068, + "11730": msg14176, + "11731": msg14177, + "11732": msg14178, + "11733": msg14179, + "11734": msg14180, + "11735": msg14181, + "11736": msg14182, + "11737": msg14183, + "11738": msg14184, + "11739": msg14185, + "1174": select1069, + "11740": msg14186, + "11741": msg14187, + "11742": msg14188, + "11743": msg14189, + "11744": msg14190, + "11745": msg14191, + "11746": msg14192, + "11747": msg14193, + "11748": msg14194, + "11749": msg14195, + "1175": select1070, + "11750": msg14196, + "11751": msg14197, + "11752": msg14198, + "11753": msg14199, + "11754": msg14200, + "11755": msg14201, + "11756": msg14202, + "11757": msg14203, + "11758": msg14204, + "11759": msg14205, + "1176": select1071, + "11760": msg14206, + "11761": msg14207, + "11762": msg14208, + "11763": msg14209, + "11764": msg14210, + "11765": msg14211, + "11766": msg14212, + "11767": msg14213, + "11768": msg14214, + "11769": msg14215, + "1177": select1072, + "11770": msg14216, + "11771": msg14217, + "11772": msg14218, + "11773": msg14219, + "11774": msg14220, + "11775": msg14221, + "11776": msg14222, + "11777": msg14223, + "11778": msg14224, + "11779": msg14225, + "1178": select1073, + "11780": msg14226, + "11781": msg14227, + "11782": msg14228, + "11783": msg14229, + "11784": msg14230, + "11785": msg14231, + "11786": msg14232, + "11787": msg14233, + "11788": msg14234, + "11789": msg14235, + "1179": select1074, + "11790": msg14236, + "11791": msg14237, + "11792": msg14238, + "11793": msg14239, + "11794": msg14240, + "11795": msg14241, + "11796": msg14242, + "11797": msg14243, + "11798": msg14244, + "11799": msg14245, + "118": select46, + "1180": select1075, + "11800": msg14246, + "11801": msg14247, + "11802": msg14248, + "11803": msg14249, + "11804": msg14250, + "11805": msg14251, + "11806": msg14252, + "11807": msg14253, + "11808": msg14254, + "11809": msg14255, + "1181": select1076, + "11810": msg14256, + "11811": msg14257, + "11812": msg14258, + "11813": msg14259, + "11814": msg14260, + "11815": msg14261, + "11816": msg14262, + "11817": msg14263, + "11818": msg14264, + "11819": msg14265, + "1182": select1077, + "11820": msg14266, + "11821": msg14267, + "11822": msg14268, + "11823": msg14269, + "11824": msg14270, + "11825": msg14271, + "11826": msg14272, + "11827": msg14273, + "11828": msg14274, + "11829": msg14275, + "1183": select1078, + "11830": msg14276, + "11831": msg14277, + "11832": msg14278, + "11833": msg14279, + "11834": msg14280, + "11835": msg14281, + "11836": msg14282, + "11837": msg14283, + "11838": msg14284, + "11839": msg14285, + "1184": select1079, + "11840": msg14286, + "11841": msg14287, + "11842": msg14288, + "11843": msg14289, + "11844": msg14290, + "11845": msg14291, + "11846": msg14292, + "11847": msg14293, + "11848": msg14294, + "11849": msg14295, + "1185": select1080, + "11850": msg14296, + "11851": msg14297, + "11852": msg14298, + "11853": msg14299, + "11854": msg14300, + "11855": msg14301, + "11856": msg14302, + "11857": msg14303, + "11858": msg14304, + "11859": msg14305, + "1186": select1081, + "11860": msg14306, + "11861": msg14307, + "11862": msg14308, + "11863": msg14309, + "11864": msg14310, + "11865": msg14311, + "11866": msg14312, + "11867": msg14313, + "11868": msg14314, + "11869": msg14315, + "1187": select1082, + "11870": msg14316, + "11871": msg14317, + "11872": msg14318, + "11873": msg14319, + "11874": msg14320, + "11875": msg14321, + "11876": msg14322, + "11877": msg14323, + "11878": msg14324, + "11879": msg14325, + "1188": select1083, + "11880": msg14326, + "11881": msg14327, + "11882": msg14328, + "11883": msg14329, + "11884": msg14330, + "11885": msg14331, + "11886": msg14332, + "11887": msg14333, + "11888": msg14334, + "11889": msg14335, + "1189": select1084, + "11890": msg14336, + "11891": msg14337, + "11892": msg14338, + "11893": msg14339, + "11894": msg14340, + "11895": msg14341, + "11896": msg14342, + "11897": msg14343, + "11898": msg14344, + "11899": msg14345, + "119": select47, + "119-1": msg154, + "119-10": msg155, + "119-11": msg156, + "119-12": msg157, + "119-13": msg158, + "119-14": msg159, + "119-15": msg160, + "119-16": msg161, + "119-17": msg162, + "119-18": msg163, + "119-2": msg164, + "119-3": msg165, + "119-4": msg166, + "119-5": msg167, + "119-6": msg168, + "119-7": msg169, + "119-8": msg170, + "119-9": msg171, + "1190": select1085, + "11900": msg14346, + "11901": msg14347, + "11902": msg14348, + "11903": msg14349, + "11904": msg14350, + "11905": msg14351, + "11906": msg14352, + "11907": msg14353, + "11908": msg14354, + "11909": msg14355, + "1191": select1086, + "11910": msg14356, + "11911": msg14357, + "11912": msg14358, + "11913": msg14359, + "11914": msg14360, + "11915": msg14361, + "11916": msg14362, + "11917": msg14363, + "11918": msg14364, + "11919": msg14365, + "1192": select1087, + "11920": msg14366, + "11921": msg14367, + "11922": msg14368, + "11923": msg14369, + "11924": msg14370, + "11925": msg14371, + "11926": msg14372, + "11927": msg14373, + "11928": msg14374, + "11929": msg14375, + "1193": select1088, + "11930": msg14376, + "11931": msg14377, + "11932": msg14378, + "11933": msg14379, + "11934": msg14380, + "11935": msg14381, + "11936": msg14382, + "11937": msg14383, + "11938": msg14384, + "11939": msg14385, + "1194": select1089, + "11940": msg14386, + "11941": msg14387, + "11942": msg14388, + "11943": msg14389, + "11944": msg14390, + "11945": msg14391, + "11946": msg14392, + "11947": msg14393, + "11948": msg14394, + "11949": msg14395, + "1195": select1090, + "11950": msg14396, + "11951": msg14397, + "11952": msg14398, + "11953": msg14399, + "11954": msg14400, + "11955": msg14401, + "11956": msg14402, + "11957": msg14403, + "11958": msg14404, + "11959": msg14405, + "1196": select1091, + "11960": msg14406, + "11961": msg14407, + "11962": msg14408, + "11963": msg14409, + "11964": msg14410, + "11965": msg14411, + "11966": msg14412, + "11967": msg14413, + "11968": msg14414, + "11969": msg14415, + "1197": select1092, + "11970": msg14416, + "11971": msg14417, + "11972": msg14418, + "11973": msg14419, + "11974": msg14420, + "11975": msg14421, + "11976": msg14422, + "11977": msg14423, + "11978": msg14424, + "11979": msg14425, + "1198": select1093, + "11980": msg14426, + "11981": msg14427, + "11982": msg14428, + "11983": msg14429, + "11984": msg14430, + "11985": msg14431, + "11986": msg14432, + "11987": msg14433, + "11988": msg14434, + "11989": msg14435, + "1199": select1094, + "11990": msg14436, + "11991": msg14437, + "11992": msg14438, + "11993": msg14439, + "11994": msg14440, + "11995": msg14441, + "11996": msg14442, + "11997": msg14443, + "11998": msg14444, + "11999": msg14445, + "12": select14, + "120": select48, + "120-1": msg174, + "1200": select1095, + "12000": msg14446, + "12001": msg14447, + "12002": msg14448, + "12003": msg14449, + "12004": msg14450, + "12005": msg14451, + "12006": msg14452, + "12007": msg14453, + "12008": msg14454, + "12009": msg14455, + "1201": select1096, + "12010": msg14456, + "12011": msg14457, + "12012": msg14458, + "12013": msg14459, + "12014": msg14460, + "12015": msg14461, + "12016": msg14462, + "12017": msg14463, + "12018": msg14464, + "12019": msg14465, + "1202": select1097, + "12020": msg14466, + "12021": msg14467, + "12022": msg14468, + "12023": msg14469, + "12024": msg14470, + "12025": msg14471, + "12026": msg14472, + "12027": msg14473, + "12028": msg14474, + "12029": msg14475, + "12030": msg14476, + "12031": msg14477, + "12032": msg14478, + "12033": msg14479, + "12034": msg14480, + "12035": msg14481, + "12036": msg14482, + "12037": msg14483, + "12038": msg14484, + "12039": msg14485, + "1204": select1098, + "12040": msg14486, + "12041": msg14487, + "12042": msg14488, + "12043": msg14489, + "12044": msg14490, + "12045": msg14491, + "12046": msg14492, + "12047": msg14493, + "12048": msg14494, + "12049": msg14495, + "1205": select1099, + "12050": msg14496, + "12051": msg14497, + "12052": msg14498, + "12053": msg14499, + "12054": msg14500, + "12055": msg14501, + "12056": msg14502, + "12057": msg14503, + "12058": msg14504, + "12059": msg14505, + "1206": select1100, + "12060": msg14506, + "12061": msg14507, + "12062": msg14508, + "12063": msg14509, + "12064": msg14510, + "12065": msg14511, + "12066": msg14512, + "12067": msg14513, + "12068": msg14514, + "12069": msg14515, + "1207": select1101, + "12070": msg14516, + "12072": msg14517, + "12073": msg14518, + "12074": msg14519, + "12075": msg14520, + "12076": msg14521, + "12077": msg14522, + "12078": msg14523, + "12079": msg14524, + "1208": select1102, + "12080": msg14525, + "12081": msg14526, + "12082": msg14527, + "12083": msg14528, + "12084": msg14529, + "12085": msg14530, + "12086": msg14531, + "12087": msg14532, + "12088": msg14533, + "12089": msg14534, + "1209": select1103, + "12090": msg14535, + "12091": msg14536, + "12092": msg14537, + "12093": msg14538, + "12094": msg14539, + "12095": msg14540, + "12096": msg14541, + "12097": msg14542, + "12098": msg14543, + "12099": msg14544, + "121": select49, + "121-1": msg177, + "121-2": msg178, + "121-3": msg179, + "121-4": msg180, + "12100": msg14545, + "12101": msg14546, + "12102": msg14547, + "12103": msg14548, + "12104": msg14549, + "12105": msg14550, + "12106": msg14551, + "12107": msg14552, + "12108": msg14553, + "12109": msg14554, + "1211": select1104, + "12110": msg14555, + "12111": msg14556, + "12112": msg14557, + "12113": msg14558, + "12114": msg14559, + "12115": msg14560, + "12116": msg14561, + "12117": msg14562, + "12118": msg14563, + "12119": msg14564, + "1212": select1105, + "12120": msg14565, + "12121": msg14566, + "12122": msg14567, + "12123": msg14568, + "12124": msg14569, + "12125": msg14570, + "12126": msg14571, + "12127": msg14572, + "12128": msg14573, + "12129": msg14574, + "1213": select1106, + "12130": msg14575, + "12131": msg14576, + "12132": msg14577, + "12133": msg14578, + "12134": msg14579, + "12135": msg14580, + "12136": msg14581, + "12137": msg14582, + "12138": msg14583, + "12139": msg14584, + "1214": select1107, + "12140": msg14585, + "12141": msg14586, + "12142": msg14587, + "12143": msg14588, + "12144": msg14589, + "12145": msg14590, + "12146": msg14591, + "12147": msg14592, + "12148": msg14593, + "12149": msg14594, + "1215": select1108, + "12150": msg14595, + "12151": msg14596, + "12152": msg14597, + "12153": msg14598, + "12154": msg14599, + "12155": msg14600, + "12156": msg14601, + "12157": msg14602, + "12158": msg14603, + "12159": msg14604, + "1216": select1109, + "12160": msg14605, + "12161": msg14606, + "12162": msg14607, + "12163": msg14608, + "12164": msg14609, + "12165": msg14610, + "12166": msg14611, + "12167": msg14612, + "12168": msg14613, + "12169": msg14614, + "1217": select1110, + "12170": msg14615, + "12171": msg14616, + "12172": msg14617, + "12173": msg14618, + "12174": msg14619, + "12175": msg14620, + "12176": msg14621, + "12177": msg14622, + "12178": msg14623, + "12179": msg14624, + "1218": select1111, + "12180": msg14625, + "12181": msg14626, + "12182": msg14627, + "12183": msg14628, + "12184": msg14629, + "12185": msg14630, + "12186": msg14631, + "12187": msg14632, + "12188": msg14633, + "12189": msg14634, + "1219": select1112, + "12190": msg14635, + "12191": msg14636, + "12192": msg14637, + "12193": msg14638, + "12194": msg14639, + "12195": msg14640, + "12196": msg14641, + "12197": msg14642, + "12198": msg14643, + "12199": msg14644, + "122": select50, + "122-1": msg183, + "122-10": msg184, + "122-11": msg185, + "122-12": msg186, + "122-13": msg187, + "122-14": msg188, + "122-15": msg189, + "122-16": msg190, + "122-17": msg191, + "122-18": msg192, + "122-19": msg193, + "122-2": msg194, + "122-20": msg195, + "122-21": msg196, + "122-22": msg197, + "122-23": msg198, + "122-24": msg199, + "122-25": msg200, + "122-26": msg201, + "122-27": msg202, + "122-3": msg203, + "122-4": msg204, + "122-5": msg205, + "122-6": msg206, + "122-7": msg207, + "122-8": msg208, + "122-9": msg209, + "1220": select1113, + "12200": msg14645, + "12201": msg14646, + "12202": msg14647, + "12203": msg14648, + "12204": msg14649, + "12205": msg14650, + "12206": msg14651, + "12207": msg14652, + "12208": msg14653, + "12209": msg14654, + "1221": select1114, + "12210": msg14655, + "12211": msg14656, + "12212": msg14657, + "12213": msg14658, + "12214": msg14659, + "12215": msg14660, + "12216": msg14661, + "12217": msg14662, + "12218": msg14663, + "12219": msg14664, + "1222": select1115, + "12220": msg14665, + "12221": msg14666, + "12222": msg14667, + "12223": msg14668, + "12224": msg14669, + "12225": msg14670, + "12226": msg14671, + "12227": msg14672, + "12228": msg14673, + "12229": msg14674, + "12230": msg14675, + "12231": msg14676, + "12232": msg14677, + "12233": msg14678, + "12234": msg14679, + "12235": msg14680, + "12236": msg14681, + "12237": msg14682, + "12238": msg14683, + "12239": msg14684, + "1224": select1116, + "12240": msg14685, + "12241": msg14686, + "12242": msg14687, + "12243": msg14688, + "12244": msg14689, + "12245": msg14690, + "12246": msg14691, + "12247": msg14692, + "12248": msg14693, + "12249": msg14694, + "1225": select1117, + "12250": msg14695, + "12251": msg14696, + "12252": msg14697, + "12253": msg14698, + "12254": msg14699, + "12255": msg14700, + "12256": msg14701, + "12257": msg14702, + "12258": msg14703, + "12259": msg14704, + "1226": select1118, + "12260": msg14705, + "12261": msg14706, + "12262": msg14707, + "12263": msg14708, + "12264": msg14709, + "12265": msg14710, + "12266": msg14711, + "12267": msg14712, + "12268": msg14713, + "12269": msg14714, + "1227": select1119, + "12270": msg14715, + "12271": msg14716, + "12272": msg14717, + "12273": msg14718, + "12274": msg14719, + "12275": msg14720, + "12276": msg14721, + "12277": msg14722, + "12278": msg14723, + "12279": msg14724, + "1228": select1120, + "12280": msg14725, + "12281": msg14726, + "12282": msg14727, + "12283": msg14728, + "12284": msg14729, + "12285": msg14730, + "12286": msg14731, + "12287": msg14732, + "12288": msg14733, + "12289": msg14734, + "1229": select1121, + "12290": msg14735, + "12291": msg14736, + "12292": msg14737, + "12293": msg14738, + "12294": msg14739, + "12295": msg14740, + "12296": msg14741, + "12297": msg14742, + "12298": msg14743, + "12299": msg14744, + "123-10": msg210, + "123-9": msg211, + "1230": select1122, + "12300": msg14745, + "12301": msg14746, + "12302": msg14747, + "12303": msg14748, + "12304": msg14749, + "12305": msg14750, + "12306": msg14751, + "12307": msg14752, + "12308": msg14753, + "12309": msg14754, + "1231": select1123, + "12310": msg14755, + "12311": msg14756, + "12312": msg14757, + "12313": msg14758, + "12314": msg14759, + "12315": msg14760, + "12316": msg14761, + "12317": msg14762, + "12318": msg14763, + "12319": msg14764, + "1232": select1124, + "12320": msg14765, + "12321": msg14766, + "12322": msg14767, + "12323": msg14768, + "12324": msg14769, + "12325": msg14770, + "12326": msg14771, + "12327": msg14772, + "12328": msg14773, + "12329": msg14774, + "1233": select1125, + "12330": msg14775, + "12331": msg14776, + "12332": msg14777, + "12333": msg14778, + "12334": msg14779, + "12335": msg14780, + "12336": msg14781, + "12337": msg14782, + "12338": msg14783, + "12339": msg14784, + "1234": select1126, + "12340": msg14785, + "12341": msg14786, + "12342": msg14787, + "12343": msg14788, + "12344": msg14789, + "12345": msg14790, + "12346": msg14791, + "12347": msg14792, + "12348": msg14793, + "12349": msg14794, + "1235": select1127, + "12350": msg14795, + "12351": msg14796, + "12352": msg14797, + "12353": msg14798, + "12354": msg14799, + "12355": msg14800, + "12356": msg14801, + "12357": msg14802, + "12358": msg14803, + "12359": msg14804, + "1236": select1128, + "12360": msg14805, + "12361": msg14806, + "12362": msg14807, + "12363": msg14808, + "12364": msg14809, + "12365": msg14810, + "12366": msg14811, + "12367": msg14812, + "12368": msg14813, + "12369": msg14814, + "1237": select1129, + "12370": msg14815, + "12371": msg14816, + "12372": msg14817, + "12373": msg14818, + "12374": msg14819, + "12375": msg14820, + "12376": msg14821, + "12377": msg14822, + "12378": msg14823, + "12379": msg14824, + "1238": select1130, + "12380": msg14825, + "12381": msg14826, + "12382": msg14827, + "12383": msg14828, + "12384": msg14829, + "12385": msg14830, + "12386": msg14831, + "12387": msg14832, + "12388": msg14833, + "12389": msg14834, + "1239": select1131, + "12390": msg14835, + "12391": msg14836, + "12392": msg14837, + "12393": msg14838, + "12394": msg14839, + "12395": msg14840, + "12396": msg14841, + "12397": msg14842, + "12398": msg14843, + "12399": msg14844, + "124": select51, + "124-1": msg214, + "1240": select1132, + "12400": msg14845, + "12401": msg14846, + "12402": msg14847, + "12403": msg14848, + "12404": msg14849, + "12405": msg14850, + "12406": msg14851, + "12407": msg14852, + "12408": msg14853, + "12409": msg14854, + "1241": select1133, + "12410": msg14855, + "12411": msg14856, + "12412": msg14857, + "12413": msg14858, + "12414": msg14859, + "12415": msg14860, + "12416": msg14861, + "12417": msg14862, + "12418": msg14863, + "12419": msg14864, + "1242": select1134, + "12420": msg14865, + "12421": msg14866, + "12422": msg14867, + "12423": msg14868, + "12424": msg14869, + "12425": msg14870, + "12426": msg14871, + "12427": msg14872, + "12428": msg14873, + "12429": msg14874, + "1243": select1135, + "12430": msg14875, + "12431": msg14876, + "12432": msg14877, + "12433": msg14878, + "12434": msg14879, + "12435": msg14880, + "12436": msg14881, + "12437": msg14882, + "12438": msg14883, + "12439": msg14884, + "1244": select1136, + "12440": msg14885, + "12441": msg14886, + "12442": msg14887, + "12443": msg14888, + "12444": msg14889, + "12445": msg14890, + "12446": msg14891, + "12447": msg14892, + "12448": msg14893, + "12449": msg14894, + "1245": select1137, + "12450": msg14895, + "12451": msg14896, + "12452": msg14897, + "12453": msg14898, + "12454": msg14899, + "12455": msg14900, + "12456": msg14901, + "12457": msg14902, + "12458": msg14903, + "12459": msg14904, + "1246": select1138, + "12460": msg14905, + "12461": msg14906, + "12462": msg14907, + "12463": msg14908, + "12464": msg14909, + "12465": msg14910, + "12466": msg14911, + "12467": msg14912, + "12468": msg14913, + "12469": msg14914, + "1247": select1139, + "12470": msg14915, + "12471": msg14916, + "12472": msg14917, + "12473": msg14918, + "12474": msg14919, + "12475": msg14920, + "12476": msg14921, + "12477": msg14922, + "12478": msg14923, + "12479": msg14924, + "1248": select1140, + "12480": msg14925, + "12481": msg14926, + "12482": msg14927, + "12483": msg14928, + "12484": msg14929, + "12485": msg14930, + "12486": msg14931, + "12487": msg14932, + "12488": msg14933, + "12489": msg14934, + "1249": select1141, + "12490": msg14935, + "12491": msg14936, + "12492": msg14937, + "12493": msg14938, + "12494": msg14939, + "12495": msg14940, + "12496": msg14941, + "12497": msg14942, + "12498": msg14943, + "12499": msg14944, + "125": select52, + "125-3": msg217, + "125-5": msg218, + "125-6": msg219, + "125-8": msg220, + "1250": select1142, + "12500": msg14945, + "12501": msg14946, + "12502": msg14947, + "12503": msg14948, + "12504": msg14949, + "12505": msg14950, + "12506": msg14951, + "12507": msg14952, + "12508": msg14953, + "12509": msg14954, + "1251": select1143, + "12510": msg14955, + "12511": msg14956, + "12512": msg14957, + "12513": msg14958, + "12514": msg14959, + "12515": msg14960, + "12516": msg14961, + "12517": msg14962, + "12518": msg14963, + "12519": msg14964, + "1252": select1144, + "12520": msg14965, + "12521": msg14966, + "12522": msg14967, + "12523": msg14968, + "12524": msg14969, + "12525": msg14970, + "12526": msg14971, + "12527": msg14972, + "12528": msg14973, + "12529": msg14974, + "1253": select1145, + "12530": msg14975, + "12531": msg14976, + "12532": msg14977, + "12533": msg14978, + "12534": msg14979, + "12535": msg14980, + "12536": msg14981, + "12537": msg14982, + "12538": msg14983, + "12539": msg14984, + "1254": select1146, + "12540": msg14985, + "12541": msg14986, + "12542": msg14987, + "12543": msg14988, + "12544": msg14989, + "12545": msg14990, + "12546": msg14991, + "12547": msg14992, + "12548": msg14993, + "12549": msg14994, + "1255": select1147, + "12550": msg14995, + "12551": msg14996, + "12552": msg14997, + "12553": msg14998, + "12554": msg14999, + "12555": msg15000, + "12556": msg15001, + "12557": msg15002, + "12558": msg15003, + "12559": msg15004, + "1256": select1148, + "12560": msg15005, + "12561": msg15006, + "12562": msg15007, + "12563": msg15008, + "12564": msg15009, + "12565": msg15010, + "12566": msg15011, + "12567": msg15012, + "12568": msg15013, + "12569": msg15014, + "1257": select1149, + "12570": msg15015, + "12571": msg15016, + "12572": msg15017, + "12573": msg15018, + "12574": msg15019, + "12575": msg15020, + "12576": msg15021, + "12577": msg15022, + "12578": msg15023, + "12579": msg15024, + "1258": select1150, + "12580": msg15025, + "12581": msg15026, + "12582": msg15027, + "12583": msg15028, + "12584": msg15029, + "12585": msg15030, + "12586": msg15031, + "12587": msg15032, + "12588": msg15033, + "12589": msg15034, + "1259": select1151, + "12590": msg15035, + "12591": msg15036, + "12592": msg15037, + "12593": msg15038, + "12594": msg15039, + "12595": msg15040, + "12596": msg15041, + "12597": msg15042, + "12598": msg15043, + "12599": msg15044, + "126": select53, + "126-1": msg223, + "1260": select1152, + "12600": msg15045, + "12601": msg15046, + "12602": msg15047, + "12603": msg15048, + "12604": msg15049, + "12605": msg15050, + "12606": msg15051, + "12607": msg15052, + "12608": msg15053, + "12609": msg15054, + "1261": select1153, + "12610": msg15055, + "12611": msg15056, + "12612": msg15057, + "12613": msg15058, + "12614": msg15059, + "12615": msg15060, + "12616": msg15061, + "12617": msg15062, + "12618": msg15063, + "12619": msg15064, + "1262": select1154, + "12620": msg15065, + "12621": msg15066, + "12622": msg15067, + "12623": msg15068, + "12624": msg15069, + "12625": msg15070, + "12626": msg15071, + "12627": msg15072, + "12628": msg15073, + "12629": msg15074, + "1263": select1155, + "12630": msg15075, + "12631": msg15076, + "12632": msg15077, + "12633": msg15078, + "12634": msg15079, + "12635": msg15080, + "12636": msg15081, + "12637": msg15082, + "12638": msg15083, + "12639": msg15084, + "1264": select1156, + "12640": msg15085, + "12641": msg15086, + "12642": msg15087, + "12643": msg15088, + "12644": msg15089, + "12645": msg15090, + "12646": msg15091, + "12647": msg15092, + "12648": msg15093, + "12649": msg15094, + "1265": select1157, + "12650": msg15095, + "12651": msg15096, + "12652": msg15097, + "12653": msg15098, + "12654": msg15099, + "12655": msg15100, + "12656": msg15101, + "12657": msg15102, + "12658": msg15103, + "12659": msg15104, + "1266": select1158, + "12660": msg15105, + "12661": msg15106, + "12663": msg15107, + "12664": msg15108, + "12665": msg15109, + "12666": msg15110, + "12667": msg15111, + "12668": msg15112, + "12669": msg15113, + "1267": select1159, + "12670": msg15114, + "12671": msg15115, + "12672": msg15116, + "12673": msg15117, + "12674": msg15118, + "12675": msg15119, + "12676": msg15120, + "12677": msg15121, + "12678": msg15122, + "12679": msg15123, + "1268": select1160, + "12680": msg15124, + "12681": msg15125, + "12682": msg15126, + "12683": msg15127, + "12684": msg15128, + "12685": msg15129, + "12686": msg15130, + "12687": msg15131, + "12688": msg15132, + "12689": msg15133, + "1269": select1161, + "12690": msg15134, + "12691": msg15135, + "12692": msg15136, + "12693": msg15137, + "12694": msg15138, + "12695": msg15139, + "12696": msg15140, + "12697": msg15141, + "12698": msg15142, + "12699": msg15143, + "127": select54, + "1270": select1162, + "12700": msg15144, + "12701": msg15145, + "12702": msg15146, + "12703": msg15147, + "12704": msg15148, + "12705": msg15149, + "12706": msg15150, + "12707": msg15151, + "12708": msg15152, + "12709": msg15153, + "1271": select1163, + "12710": msg15154, + "12711": msg15155, + "12712": msg15156, + "12713": msg15157, + "12714": msg15158, + "12715": msg15159, + "12716": msg15160, + "12717": msg15161, + "12718": msg15162, + "12719": msg15163, + "1272": select1164, + "12720": msg15164, + "12721": msg15165, + "12722": msg15166, + "12723": msg15167, + "12724": msg15168, + "12725": msg15169, + "12726": msg15170, + "12727": msg15171, + "12728": msg15172, + "12729": msg15173, + "1273": select1165, + "12730": msg15174, + "12731": msg15175, + "12732": msg15176, + "12733": msg15177, + "12734": msg15178, + "12735": msg15179, + "12736": msg15180, + "12737": msg15181, + "12738": msg15182, + "12739": msg15183, + "1274": select1166, + "12740": msg15184, + "12741": msg15185, + "12742": msg15186, + "12743": msg15187, + "12744": msg15188, + "12745": msg15189, + "12746": msg15190, + "12747": msg15191, + "12748": msg15192, + "12749": msg15193, + "1275": select1167, + "12750": msg15194, + "12751": msg15195, + "12752": msg15196, + "12753": msg15197, + "12754": msg15198, + "12755": msg15199, + "12756": msg15200, + "12757": msg15201, + "12758": msg15202, + "12759": msg15203, + "1276": select1168, + "12760": msg15204, + "12761": msg15205, + "12762": msg15206, + "12763": msg15207, + "12764": msg15208, + "12765": msg15209, + "12766": msg15210, + "12767": msg15211, + "12768": msg15212, + "12769": msg15213, + "1277": select1169, + "12770": msg15214, + "12771": msg15215, + "12772": msg15216, + "12773": msg15217, + "12774": msg15218, + "12775": msg15219, + "12776": msg15220, + "12777": msg15221, + "12778": msg15222, + "12779": msg15223, + "1278": select1170, + "12780": msg15224, + "12781": msg15225, + "12782": msg15226, + "12783": msg15227, + "12784": msg15228, + "12785": msg15229, + "12786": msg15230, + "12787": msg15231, + "12788": msg15232, + "12789": msg15233, + "1279": select1171, + "12790": msg15234, + "12791": msg15235, + "12792": msg15236, + "12793": msg15237, + "12794": msg15238, + "12795": msg15239, + "12796": msg15240, + "12797": msg15241, + "12798": msg15242, + "12799": msg15243, + "128": select55, + "1280": select1172, + "12800": msg15244, + "12801": msg15245, + "12802": msg15246, + "12803": msg15247, + "12804": msg15248, + "12805": msg15249, + "12806": msg15250, + "12807": msg15251, + "12808": msg15252, + "12809": msg15253, + "1281": select1173, + "12810": msg15254, + "12811": msg15255, + "12812": msg15256, + "12813": msg15257, + "12814": msg15258, + "12815": msg15259, + "12816": msg15260, + "12817": msg15261, + "12818": msg15262, + "12819": msg15263, + "1282": select1174, + "12820": msg15264, + "12821": msg15265, + "12822": msg15266, + "12823": msg15267, + "12824": msg15268, + "12825": msg15269, + "12826": msg15270, + "12827": msg15271, + "12828": msg15272, + "12829": msg15273, + "1283": select1175, + "12830": msg15274, + "12831": msg15275, + "12832": msg15276, + "12833": msg15277, + "12834": msg15278, + "12835": msg15279, + "12836": msg15280, + "12837": msg15281, + "12838": msg15282, + "12839": msg15283, + "1284": select1176, + "12840": msg15284, + "12841": msg15285, + "12842": msg15286, + "12843": msg15287, + "12844": msg15288, + "12845": msg15289, + "12846": msg15290, + "12847": msg15291, + "12848": msg15292, + "12849": msg15293, + "1285": select1177, + "12850": msg15294, + "12851": msg15295, + "12852": msg15296, + "12853": msg15297, + "12854": msg15298, + "12855": msg15299, + "12856": msg15300, + "12857": msg15301, + "12858": msg15302, + "12859": msg15303, + "1286": select1178, + "12860": msg15304, + "12861": msg15305, + "12862": msg15306, + "12863": msg15307, + "12864": msg15308, + "12865": msg15309, + "12866": msg15310, + "12867": msg15311, + "12868": msg15312, + "12869": msg15313, + "1287": select1179, + "12870": msg15314, + "12871": msg15315, + "12872": msg15316, + "12873": msg15317, + "12874": msg15318, + "12875": msg15319, + "12876": msg15320, + "12877": msg15321, + "12878": msg15322, + "12879": msg15323, + "1288": select1180, + "12880": msg15324, + "12881": msg15325, + "12882": msg15326, + "12883": msg15327, + "12884": msg15328, + "12885": msg15329, + "12886": msg15330, + "12887": msg15331, + "12888": msg15332, + "12889": msg15333, + "1289": select1181, + "12890": msg15334, + "12891": msg15335, + "12892": msg15336, + "12893": msg15337, + "12894": msg15338, + "12895": msg15339, + "12896": msg15340, + "12897": msg15341, + "12898": msg15342, + "12899": msg15343, + "129": select56, + "129-2": msg230, + "129-6": msg231, + "1290": select1182, + "12900": msg15344, + "12901": msg15345, + "12902": msg15346, + "12903": msg15347, + "12904": msg15348, + "12905": msg15349, + "12906": msg15350, + "12907": msg15351, + "12908": msg15352, + "12909": msg15353, + "1291": select1183, + "12910": msg15354, + "12911": msg15355, + "12912": msg15356, + "12913": msg15357, + "12914": msg15358, + "12915": msg15359, + "12916": msg15360, + "12917": msg15361, + "12918": msg15362, + "12919": msg15363, + "1292": select1184, + "12920": msg15364, + "12921": msg15365, + "12922": msg15366, + "12923": msg15367, + "12924": msg15368, + "12925": msg15369, + "12926": msg15370, + "12927": msg15371, + "12928": msg15372, + "12929": msg15373, + "1293": select1185, + "12930": msg15374, + "12931": msg15375, + "12932": msg15376, + "12933": msg15377, + "12934": msg15378, + "12935": msg15379, + "12936": msg15380, + "12937": msg15381, + "12938": msg15382, + "12939": msg15383, + "1294": select1186, + "12940": msg15384, + "12941": msg15385, + "12942": msg15386, + "12943": msg15387, + "12944": msg15388, + "12945": msg15389, + "12946": msg15390, + "12947": msg15391, + "12948": msg15392, + "12949": msg15393, + "1295": select1187, + "12950": msg15394, + "12951": msg15395, + "12952": msg15396, + "12953": msg15397, + "12954": msg15398, + "12955": msg15399, + "12956": msg15400, + "12957": msg15401, + "12958": msg15402, + "12959": msg15403, + "1296": select1188, + "12960": msg15404, + "12961": msg15405, + "12962": msg15406, + "12963": msg15407, + "12964": msg15408, + "12965": msg15409, + "12966": msg15410, + "12967": msg15411, + "12968": msg15412, + "12969": msg15413, + "1297": select1189, + "12970": msg15414, + "12971": msg15415, + "12972": msg15416, + "12973": msg15417, + "12974": msg15418, + "12975": msg15419, + "12976": msg15420, + "12977": msg15421, + "12978": msg15422, + "12979": msg15423, + "1298": select1190, + "12980": msg15424, + "12981": msg15425, + "12982": msg15426, + "12983": msg15427, + "12984": msg15428, + "12985": msg15429, + "12986": msg15430, + "12987": msg15431, + "12988": msg15432, + "12989": msg15433, + "1299": select1191, + "12990": msg15434, + "12991": msg15435, + "12992": msg15436, + "12993": msg15437, + "12994": msg15438, + "12995": msg15439, + "12996": msg15440, + "12997": msg15441, + "12998": msg15442, + "12999": msg15443, + "13": select15, + "130": select57, + "1300": select1192, + "13000": msg15444, + "13001": msg15445, + "13002": msg15446, + "13003": msg15447, + "13004": msg15448, + "13005": msg15449, + "13006": msg15450, + "13007": msg15451, + "13008": msg15452, + "13009": msg15453, + "1301": select1193, + "13010": msg15454, + "13011": msg15455, + "13012": msg15456, + "13013": msg15457, + "13014": msg15458, + "13015": msg15459, + "13016": msg15460, + "13017": msg15461, + "13018": msg15462, + "13019": msg15463, + "1302": select1194, + "13020": msg15464, + "13021": msg15465, + "13022": msg15466, + "13023": msg15467, + "13024": msg15468, + "13025": msg15469, + "13026": msg15470, + "13027": msg15471, + "13028": msg15472, + "13029": msg15473, + "1303": select1195, + "13030": msg15474, + "13031": msg15475, + "13032": msg15476, + "13033": msg15477, + "13034": msg15478, + "13035": msg15479, + "13036": msg15480, + "13037": msg15481, + "13038": msg15482, + "13039": msg15483, + "1304": select1196, + "13040": msg15484, + "13041": msg15485, + "13042": msg15486, + "13043": msg15487, + "13044": msg15488, + "13045": msg15489, + "13046": msg15490, + "13047": msg15491, + "13048": msg15492, + "13049": msg15493, + "1305": select1197, + "13050": msg15494, + "13051": msg15495, + "13052": msg15496, + "13053": msg15497, + "13054": msg15498, + "13055": msg15499, + "13056": msg15500, + "13057": msg15501, + "13058": msg15502, + "13059": msg15503, + "1306": select1198, + "13060": msg15504, + "13061": msg15505, + "13062": msg15506, + "13063": msg15507, + "13064": msg15508, + "13065": msg15509, + "13066": msg15510, + "13067": msg15511, + "13068": msg15512, + "13069": msg15513, + "1307": select1199, + "13070": msg15514, + "13071": msg15515, + "13072": msg15516, + "13073": msg15517, + "13074": msg15518, + "13075": msg15519, + "13076": msg15520, + "13077": msg15521, + "13078": msg15522, + "13079": msg15523, + "1308": select1200, + "13080": msg15524, + "13081": msg15525, + "13082": msg15526, + "13083": msg15527, + "13084": msg15528, + "13085": msg15529, + "13086": msg15530, + "13087": msg15531, + "13088": msg15532, + "13089": msg15533, + "1309": select1201, + "13090": msg15534, + "13091": msg15535, + "13092": msg15536, + "13093": msg15537, + "13094": msg15538, + "13095": msg15539, + "13096": msg15540, + "13097": msg15541, + "13098": msg15542, + "13099": msg15543, + "131": select58, + "131-3": msg236, + "1310": select1202, + "13100": msg15544, + "13101": msg15545, + "13102": msg15546, + "13103": msg15547, + "13104": msg15548, + "13105": msg15549, + "13106": msg15550, + "13107": msg15551, + "13108": msg15552, + "13109": msg15553, + "1311": select1203, + "13110": msg15554, + "13111": msg15555, + "13112": msg15556, + "13113": msg15557, + "13114": msg15558, + "13115": msg15559, + "13116": msg15560, + "13117": msg15561, + "13118": msg15562, + "13119": msg15563, + "1312": select1204, + "13120": msg15564, + "13121": msg15565, + "13122": msg15566, + "13123": msg15567, + "13124": msg15568, + "13125": msg15569, + "13126": msg15570, + "13127": msg15571, + "13128": msg15572, + "13129": msg15573, + "1313": select1205, + "13130": msg15574, + "13131": msg15575, + "13132": msg15576, + "13133": msg15577, + "13134": msg15578, + "13135": msg15579, + "13136": msg15580, + "13137": msg15581, + "13138": msg15582, + "13139": msg15583, + "1314": select1206, + "13140": msg15584, + "13141": msg15585, + "13142": msg15586, + "13143": msg15587, + "13144": msg15588, + "13145": msg15589, + "13146": msg15590, + "13147": msg15591, + "13148": msg15592, + "13149": msg15593, + "1315": select1207, + "13150": msg15594, + "13151": msg15595, + "13152": msg15596, + "13153": msg15597, + "13154": msg15598, + "13155": msg15599, + "13156": msg15600, + "13157": msg15601, + "13158": msg15602, + "13159": msg15603, + "1316": select1208, + "13160": msg15604, + "13161": msg15605, + "13162": msg15606, + "13163": msg15607, + "13164": msg15608, + "13165": msg15609, + "13166": msg15610, + "13167": msg15611, + "13168": msg15612, + "13169": msg15613, + "1317": select1209, + "13170": msg15614, + "13171": msg15615, + "13172": msg15616, + "13173": msg15617, + "13174": msg15618, + "13175": msg15619, + "13176": msg15620, + "13177": msg15621, + "13178": msg15622, + "13179": msg15623, + "1318": select1210, + "13180": msg15624, + "13181": msg15625, + "13182": msg15626, + "13183": msg15627, + "13184": msg15628, + "13185": msg15629, + "13186": msg15630, + "13187": msg15631, + "13188": msg15632, + "13189": msg15633, + "1319": select1211, + "13190": msg15634, + "13191": msg15635, + "13192": msg15636, + "13193": msg15637, + "13194": msg15638, + "13195": msg15639, + "13196": msg15640, + "13197": msg15641, + "13198": msg15642, + "13199": msg15643, + "132": select59, + "1320": select1212, + "13200": msg15644, + "13201": msg15645, + "13202": msg15646, + "13203": msg15647, + "13204": msg15648, + "13205": msg15649, + "13206": msg15650, + "13207": msg15651, + "13208": msg15652, + "13209": msg15653, + "1321": select1213, + "13210": msg15654, + "13211": msg15655, + "13212": msg15656, + "13213": msg15657, + "13214": msg15658, + "13215": msg15659, + "13216": msg15660, + "13217": msg15661, + "13218": msg15662, + "13219": msg15663, + "1322": select1214, + "13220": msg15664, + "13221": msg15665, + "13222": msg15666, + "13223": msg15667, + "13224": msg15668, + "13225": msg15669, + "13226": msg15670, + "13227": msg15671, + "13228": msg15672, + "13229": msg15673, + "1323": select1215, + "13230": msg15674, + "13231": msg15675, + "13232": msg15676, + "13233": msg15677, + "13234": msg15678, + "13235": msg15679, + "13236": msg15680, + "13237": msg15681, + "13238": msg15682, + "13239": msg15683, + "1324": select1216, + "13240": msg15684, + "13241": msg15685, + "13242": msg15686, + "13243": msg15687, + "13244": msg15688, + "13245": msg15689, + "13246": msg15690, + "13247": msg15691, + "13248": msg15692, + "13249": msg15693, + "1325": select1217, + "13250": msg15694, + "13251": msg15695, + "13252": msg15696, + "13253": msg15697, + "13254": msg15698, + "13255": msg15699, + "13256": msg15700, + "13257": msg15701, + "13258": msg15702, + "13259": msg15703, + "1326": select1218, + "13260": msg15704, + "13261": msg15705, + "13262": msg15706, + "13263": msg15707, + "13264": msg15708, + "13265": msg15709, + "13266": msg15710, + "13267": msg15711, + "13268": msg15712, + "13269": msg15713, + "1327": select1219, + "13270": msg15714, + "13271": msg15715, + "13272": msg15716, + "13273": msg15717, + "13274": msg15718, + "13275": msg15719, + "13276": msg15720, + "13277": msg15721, + "13278": msg15722, + "13279": msg15723, + "1328": select1220, + "13280": msg15724, + "13281": msg15725, + "13282": msg15726, + "13283": msg15727, + "13284": msg15728, + "13285": msg15729, + "13286": msg15730, + "13287": msg15731, + "13288": msg15732, + "13289": msg15733, + "1329": select1221, + "13290": msg15734, + "13291": msg15735, + "13292": msg15736, + "13293": msg15737, + "13294": msg15738, + "13295": msg15739, + "13296": msg15740, + "13297": msg15741, + "13298": msg15742, + "13299": msg15743, + "133": select60, + "1330": select1222, + "13300": msg15744, + "13301": msg15745, + "13302": msg15746, + "13303": msg15747, + "13304": msg15748, + "13305": msg15749, + "13306": msg15750, + "13307": msg15751, + "13308": msg15752, + "13309": msg15753, + "1331": select1223, + "13310": msg15754, + "13311": msg15755, + "13312": msg15756, + "13313": msg15757, + "13314": msg15758, + "13315": msg15759, + "13316": msg15760, + "13317": msg15761, + "13318": msg15762, + "13319": msg15763, + "1332": select1224, + "13320": msg15764, + "13321": msg15765, + "13322": msg15766, + "13323": msg15767, + "13324": msg15768, + "13325": msg15769, + "13326": msg15770, + "13327": msg15771, + "13328": msg15772, + "13329": msg15773, + "1333": select1225, + "13330": msg15774, + "13331": msg15775, + "13332": msg15776, + "13333": msg15777, + "13334": msg15778, + "13335": msg15779, + "13336": msg15780, + "13337": msg15781, + "13338": msg15782, + "13339": msg15783, + "1334": select1226, + "13340": msg15784, + "13341": msg15785, + "13342": msg15786, + "13343": msg15787, + "13344": msg15788, + "13345": msg15789, + "13346": msg15790, + "13347": msg15791, + "13348": msg15792, + "13349": msg15793, + "1335": select1227, + "13350": msg15794, + "13351": msg15795, + "13352": msg15796, + "13353": msg15797, + "13354": msg15798, + "13355": msg15799, + "13356": msg15800, + "13357": msg15801, + "13358": msg15802, + "13359": msg15803, + "1336": select1228, + "13360": msg15804, + "13361": msg15805, + "13362": msg15806, + "13363": msg15807, + "13364": msg15808, + "13365": msg15809, + "13366": msg15810, + "13367": msg15811, + "13368": msg15812, + "13369": msg15813, + "1337": select1229, + "13370": msg15814, + "13371": msg15815, + "13372": msg15816, + "13373": msg15817, + "13374": msg15818, + "13375": msg15819, + "13376": msg15820, + "13377": msg15821, + "13378": msg15822, + "13379": msg15823, + "1338": select1230, + "13380": msg15824, + "13381": msg15825, + "13382": msg15826, + "13383": msg15827, + "13384": msg15828, + "13385": msg15829, + "13386": msg15830, + "13387": msg15831, + "13388": msg15832, + "13389": msg15833, + "1339": select1231, + "13390": msg15834, + "13391": msg15835, + "13392": msg15836, + "13393": msg15837, + "13394": msg15838, + "13395": msg15839, + "13396": msg15840, + "13397": msg15841, + "13398": msg15842, + "13399": msg15843, + "134": select61, + "1340": select1232, + "13400": msg15844, + "13401": msg15845, + "13402": msg15846, + "13403": msg15847, + "13404": msg15848, + "13405": msg15849, + "13406": msg15850, + "13407": msg15851, + "13408": msg15852, + "13409": msg15853, + "1341": select1233, + "13410": msg15854, + "13411": msg15855, + "13412": msg15856, + "13413": msg15857, + "13414": msg15858, + "13415": msg15859, + "13416": msg15860, + "13417": msg15861, + "13418": msg15862, + "13419": msg15863, + "1342": select1234, + "13420": msg15864, + "13421": msg15865, + "13422": msg15866, + "13423": msg15867, + "13424": msg15868, + "13425": msg15869, + "13426": msg15870, + "13427": msg15871, + "13428": msg15872, + "13429": msg15873, + "1343": select1235, + "13430": msg15874, + "13431": msg15875, + "13432": msg15876, + "13433": msg15877, + "13434": msg15878, + "13435": msg15879, + "13436": msg15880, + "13437": msg15881, + "13438": msg15882, + "13439": msg15883, + "1344": select1236, + "13440": msg15884, + "13441": msg15885, + "13442": msg15886, + "13443": msg15887, + "13444": msg15888, + "13445": msg15889, + "13446": msg15890, + "13447": msg15891, + "13448": msg15892, + "13449": msg15893, + "1345": select1237, + "13450": msg15894, + "13451": msg15895, + "13452": msg15896, + "13453": msg15897, + "13454": msg15898, + "13455": msg15899, + "13456": msg15900, + "13457": msg15901, + "13458": msg15902, + "13459": msg15903, + "1346": select1238, + "13460": msg15904, + "13465": msg15905, + "13466": msg15906, + "13467": msg15907, + "13468": msg15908, + "13469": msg15909, + "1347": select1239, + "13470": msg15910, + "13471": msg15911, + "13472": msg15912, + "13473": msg15913, + "13474": msg15914, + "13475": msg15915, + "13476": msg15916, + "13477": msg15917, + "13478": msg15918, + "13479": msg15919, + "1348": select1240, + "13480": msg15920, + "13481": msg15921, + "13482": msg15922, + "13483": msg15923, + "13484": msg15924, + "13485": msg15925, + "13486": msg15926, + "13487": msg15927, + "13488": msg15928, + "13489": msg15929, + "1349": select1241, + "13490": msg15930, + "13491": msg15931, + "13492": msg15932, + "13493": msg15933, + "13494": msg15934, + "13495": msg15935, + "13496": msg15936, + "13497": msg15937, + "13498": msg15938, + "13499": msg15939, + "135": select62, + "1350": select1242, + "13500": msg15940, + "13501": msg15941, + "13502": msg15942, + "13503": msg15943, + "13504": msg15944, + "13505": msg15945, + "13506": msg15946, + "13507": msg15947, + "13508": msg15948, + "13509": msg15949, + "1351": select1243, + "13510": msg15950, + "13511": msg15951, + "13512": msg15952, + "13513": msg15953, + "13514": msg15954, + "13515": msg15955, + "13516": msg15956, + "13517": msg15957, + "13518": msg15958, + "13519": msg15959, + "1352": select1244, + "13520": msg15960, + "13521": msg15961, + "13522": msg15962, + "13523": msg15963, + "13524": msg15964, + "13525": msg15965, + "13526": msg15966, + "13527": msg15967, + "13528": msg15968, + "13529": msg15969, + "1353": select1245, + "13530": msg15970, + "13531": msg15971, + "13532": msg15972, + "13533": msg15973, + "13534": msg15974, + "13535": msg15975, + "13536": msg15976, + "13537": msg15977, + "13538": msg15978, + "13539": msg15979, + "1354": select1246, + "13540": msg15980, + "13541": msg15981, + "13542": msg15982, + "13543": msg15983, + "13544": msg15984, + "13545": msg15985, + "13546": msg15986, + "13547": msg15987, + "13548": msg15988, + "13549": msg15989, + "1355": select1247, + "13550": msg15990, + "13551": msg15991, + "13552": msg15992, + "13553": msg15993, + "13554": msg15994, + "13555": msg15995, + "13556": msg15996, + "13557": msg15997, + "13558": msg15998, + "13559": msg15999, + "1356": select1248, + "13560": msg16000, + "13561": msg16001, + "13562": msg16002, + "13563": msg16003, + "13564": msg16004, + "13565": msg16005, + "13566": msg16006, + "13567": msg16007, + "13568": msg16008, + "13569": msg16009, + "1357": select1249, + "13570": msg16010, + "13571": msg16011, + "13572": msg16012, + "13573": msg16013, + "1358": select1250, + "13580": msg16014, + "13581": msg16015, + "13582": msg16016, + "13583": msg16017, + "13584": msg16018, + "13585": select2440, + "13586": msg16021, + "13587": msg16022, + "13588": msg16023, + "13589": msg16024, + "1359": select1251, + "13590": msg16025, + "13591": msg16026, + "13592": msg16027, + "13593": select2441, + "13594": msg16030, + "13595": msg16031, + "13596": msg16032, + "13597": msg16033, + "13598": msg16034, + "13599": msg16035, + "136": select63, + "1360": select1252, + "13600": msg16036, + "13601": msg16037, + "13602": msg16038, + "13603": msg16039, + "13604": msg16040, + "13605": msg16041, + "13606": msg16042, + "13607": msg16043, + "13608": msg16044, + "13609": msg16045, + "1361": select1253, + "13610": msg16046, + "13611": msg16047, + "13612": msg16048, + "13613": msg16049, + "13614": msg16050, + "13615": msg16051, + "13616": msg16052, + "13617": msg16053, + "13618": msg16054, + "13619": msg16055, + "1362": select1254, + "13620": msg16056, + "13621": msg16057, + "13622": msg16058, + "13623": msg16059, + "13624": msg16060, + "13625": msg16061, + "13626": msg16062, + "13627": msg16063, + "13628": select2442, + "13629": msg16066, + "1363": select1255, + "13630": msg16067, + "13631": msg16068, + "13632": msg16069, + "13633": msg16070, + "13634": msg16071, + "13635": msg16072, + "13636": msg16073, + "13637": msg16074, + "13638": msg16075, + "13639": msg16076, + "1364": select1256, + "13640": msg16077, + "13641": msg16078, + "13642": msg16079, + "13643": msg16080, + "13644": msg16081, + "13645": msg16082, + "13646": msg16083, + "13647": msg16084, + "13648": msg16085, + "13649": msg16086, + "1365": select1257, + "13650": msg16087, + "13651": msg16088, + "13652": msg16089, + "13653": msg16090, + "13654": msg16091, + "13655": msg16092, + "13656": msg16093, + "13657": msg16094, + "13658": msg16095, + "13659": msg16096, + "1366": select1258, + "13660": msg16097, + "13661": msg16098, + "13662": msg16099, + "13663": msg16100, + "13664": msg16101, + "13665": msg16102, + "13666": msg16103, + "13667": msg16104, + "13668": msg16105, + "13669": msg16106, + "1367": select1259, + "13670": msg16107, + "13671": msg16108, + "13672": msg16109, + "13673": msg16110, + "13674": msg16111, + "13675": msg16112, + "13676": msg16113, + "13677": msg16114, + "13678": msg16115, + "13679": msg16116, + "1368": select1260, + "13680": msg16117, + "13681": msg16118, + "13682": msg16119, + "13683": msg16120, + "13684": msg16121, + "13685": msg16122, + "13686": msg16123, + "13687": msg16124, + "13688": msg16125, + "13689": msg16126, + "1369": select1261, + "13690": msg16127, + "13691": msg16128, + "13692": msg16129, + "13693": msg16130, + "13694": msg16131, + "13695": msg16132, + "13696": msg16133, + "13697": msg16134, + "13698": msg16135, + "13699": msg16136, + "137": select64, + "1370": select1262, + "13700": msg16137, + "13709": msg16138, + "1371": select1263, + "13710": msg16139, + "13711": msg16140, + "13712": msg16141, + "13713": msg16142, + "13714": msg16143, + "13715": msg16144, + "13716": msg16145, + "13717": msg16146, + "13718": msg16147, + "13719": msg16148, + "1372": select1264, + "13720": msg16149, + "13721": msg16150, + "13722": msg16151, + "13723": msg16152, + "13724": msg16153, + "13725": msg16154, + "13726": msg16155, + "13727": msg16156, + "13728": msg16157, + "13729": msg16158, + "1373": select1265, + "13730": msg16159, + "13731": msg16160, + "13732": msg16161, + "13733": msg16162, + "13734": msg16163, + "13735": msg16164, + "13736": msg16165, + "13737": msg16166, + "13738": msg16167, + "13739": msg16168, + "1374": select1266, + "13740": msg16169, + "13741": msg16170, + "13742": msg16171, + "13743": msg16172, + "13744": msg16173, + "13745": msg16174, + "13746": msg16175, + "13747": msg16176, + "13748": msg16177, + "13749": msg16178, + "1375": select1267, + "13750": msg16179, + "13751": msg16180, + "13752": msg16181, + "13753": msg16182, + "13754": msg16183, + "13755": msg16184, + "13756": msg16185, + "13757": msg16186, + "13758": msg16187, + "13759": msg16188, + "1376": select1268, + "13760": msg16189, + "13761": msg16190, + "13762": msg16191, + "13763": msg16192, + "13764": msg16193, + "13765": msg16194, + "13766": msg16195, + "13767": msg16196, + "13768": msg16197, + "13769": msg16198, + "1377": select1269, + "13770": msg16199, + "13771": msg16200, + "13772": msg16201, + "13773": msg16202, + "13774": msg16203, + "13775": msg16204, + "13776": msg16205, + "13777": msg16206, + "13778": msg16207, + "13779": msg16208, + "1378": select1270, + "13780": msg16209, + "13781": msg16210, + "13782": msg16211, + "13783": msg16212, + "13784": msg16213, + "13785": msg16214, + "13786": msg16215, + "13787": msg16216, + "13788": msg16217, + "13789": msg16218, + "1379": select1271, + "13790": msg16219, + "13791": msg16220, + "13797": msg16221, + "13798": msg16222, + "13799": msg16223, + "138": select65, + "1380": select1272, + "13800": msg16224, + "13801": msg16225, + "13802": msg16226, + "13803": msg16227, + "13804": msg16228, + "13805": msg16229, + "13806": msg16230, + "13807": msg16231, + "13808": msg16232, + "13809": msg16233, + "1381": select1273, + "13810": msg16234, + "13811": msg16235, + "13812": msg16236, + "13813": msg16237, + "13814": msg16238, + "13815": msg16239, + "13816": msg16240, + "13817": msg16241, + "13818": msg16242, + "13819": msg16243, + "1382": select1274, + "13820": msg16244, + "13821": msg16245, + "13822": msg16246, + "13823": msg16247, + "13824": msg16248, + "13825": msg16249, + "13826": msg16250, + "13827": msg16251, + "13828": msg16252, + "13829": msg16253, + "1383": select1275, + "13830": msg16254, + "13831": msg16255, + "13832": msg16256, + "13833": msg16257, + "13834": msg16258, + "13835": msg16259, + "13838": msg16260, + "13839": msg16261, + "1384": select1276, + "13840": msg16262, + "13841": msg16263, + "13842": msg16264, + "13843": msg16265, + "13844": msg16266, + "13845": msg16267, + "13846": msg16268, + "13847": msg16269, + "13848": msg16270, + "13849": msg16271, + "1385": select1277, + "13850": msg16272, + "13851": msg16273, + "13852": msg16274, + "13853": msg16275, + "13854": msg16276, + "13855": msg16277, + "13856": msg16278, + "13857": msg16279, + "13858": msg16280, + "13859": msg16281, + "1386": select1278, + "13860": msg16282, + "13861": msg16283, + "13862": msg16284, + "13863": msg16285, + "13864": msg16286, + "13865": msg16287, + "13866": msg16288, + "13867": msg16289, + "13868": msg16290, + "13869": msg16291, + "1387": select1279, + "13870": msg16292, + "13871": msg16293, + "13872": msg16294, + "13873": msg16295, + "13874": msg16296, + "13875": msg16297, + "13876": msg16298, + "13877": msg16299, + "13878": msg16300, + "13879": msg16301, + "1388": select1280, + "13880": msg16302, + "13881": msg16303, + "13882": msg16304, + "13883": msg16305, + "13884": msg16306, + "13885": msg16307, + "13886": msg16308, + "13887": msg16309, + "13888": msg16310, + "13889": msg16311, + "1389": select1281, + "13890": msg16312, + "13891": msg16313, + "13892": msg16314, + "13893": msg16315, + "13894": msg16316, + "13895": msg16317, + "13896": msg16318, + "13897": msg16319, + "13898": msg16320, + "13899": msg16321, + "1390": select1282, + "13900": msg16322, + "13901": msg16323, + "13902": msg16324, + "13903": msg16325, + "13904": msg16326, + "13905": msg16327, + "13906": msg16328, + "13907": msg16329, + "13908": msg16330, + "13909": msg16331, + "1391": select1283, + "13910": msg16332, + "13911": msg16333, + "13912": msg16334, + "13913": msg16335, + "13914": msg16336, + "13915": msg16337, + "13916": msg16338, + "13917": msg16339, + "13918": msg16340, + "13919": msg16341, + "1392": select1284, + "13920": msg16342, + "13921": msg16343, + "13922": msg16344, + "13923": msg16345, + "13924": msg16346, + "13925": msg16347, + "13926": msg16348, + "13927": msg16349, + "13928": msg16350, + "13929": msg16351, + "1393": select1285, + "13930": msg16352, + "13931": msg16353, + "13932": msg16354, + "13933": msg16355, + "13934": msg16356, + "13935": msg16357, + "13936": msg16358, + "13937": msg16359, + "13938": msg16360, + "13939": msg16361, + "1394": select1286, + "13940": msg16362, + "13941": msg16363, + "13942": msg16364, + "13943": msg16365, + "13944": msg16366, + "13945": msg16367, + "13946": msg16368, + "13947": msg16369, + "13948": msg16370, + "13949": msg16371, + "1395": select1287, + "13950": msg16372, + "13951": msg16373, + "13952": msg16374, + "13953": msg16375, + "13954": msg16376, + "13958": msg16377, + "1396": select1288, + "13960": msg16378, + "13961": msg16379, + "13962": msg16380, + "13963": msg16381, + "13964": msg16382, + "13965": msg16383, + "13966": msg16384, + "13967": msg16385, + "13968": msg16386, + "13969": msg16387, + "1397": select1289, + "13970": msg16388, + "13971": msg16389, + "13972": msg16390, + "13973": msg16391, + "13974": msg16392, + "13975": msg16393, + "13976": msg16394, + "13977": msg16395, + "13978": msg16396, + "13979": msg16397, + "1398": select1290, + "13980": msg16398, + "13981": msg16399, + "13982": msg16400, + "13983": msg16401, + "13984": msg16402, + "13985": msg16403, + "13986": msg16404, + "13987": msg16405, + "13988": msg16406, + "13989": msg16407, + "1399": select1291, + "13990": msg16408, + "13991": msg16409, + "13992": msg16410, + "13993": msg16411, + "13994": msg16412, + "13995": msg16413, + "13996": msg16414, + "13997": msg16415, + "13998": msg16416, + "13999": msg16417, + "14": msg40, + "140": select66, + "1400": select1292, + "14000": msg16418, + "14001": msg16419, + "14002": msg16420, + "14003": msg16421, + "14004": msg16422, + "14005": msg16423, + "14006": msg16424, + "14007": msg16425, + "14008": msg16426, + "1401": select1293, + "14013": msg16427, + "14014": msg16428, + "14015": msg16429, + "14016": msg16430, + "14017": msg16431, + "14018": msg16432, + "14019": msg16433, + "1402": select1294, + "14020": msg16434, + "14021": msg16435, + "14022": msg16436, + "14023": msg16437, + "14024": msg16438, + "14025": msg16439, + "14026": msg16440, + "14027": msg16441, + "14028": msg16442, + "14029": msg16443, + "1403": select1295, + "14030": msg16444, + "14031": msg16445, + "14032": msg16446, + "14033": msg16447, + "14034": msg16448, + "14035": msg16449, + "14036": msg16450, + "14037": msg16451, + "14038": msg16452, + "14039": msg16453, + "1404": select1296, + "14040": msg16454, + "14041": msg16455, + "14042": msg16456, + "14043": msg16457, + "14044": msg16458, + "14045": msg16459, + "14046": msg16460, + "14047": msg16461, + "14048": msg16462, + "14049": msg16463, + "1405": select1297, + "14050": msg16464, + "14051": msg16465, + "14052": msg16466, + "14053": msg16467, + "14054": msg16468, + "14055": msg16469, + "14056": msg16470, + "14057": msg16471, + "14058": msg16472, + "14059": msg16473, + "1406": select1298, + "14060": msg16474, + "14061": msg16475, + "14062": msg16476, + "14063": msg16477, + "14064": msg16478, + "14065": msg16479, + "14066": msg16480, + "14067": msg16481, + "14068": msg16482, + "14069": msg16483, + "1407": select1299, + "14070": msg16484, + "14071": msg16485, + "14072": msg16486, + "14073": msg16487, + "14074": msg16488, + "14075": msg16489, + "14076": msg16490, + "14077": msg16491, + "14078": msg16492, + "14079": msg16493, + "1408": select1300, + "14080": msg16494, + "14081": msg16495, + "14082": msg16496, + "14083": msg16497, + "14084": msg16498, + "14085": msg16499, + "14086": msg16500, + "14087": msg16501, + "14088": msg16502, + "14089": msg16503, + "1409": select1301, + "14090": msg16504, + "14091": msg16505, + "14092": msg16506, + "14093": msg16507, + "14094": msg16508, + "14095": msg16509, + "14096": msg16510, + "14097": msg16511, + "14098": msg16512, + "14099": msg16513, + "141": select67, + "1410": select1302, + "14100": msg16514, + "14101": msg16515, + "14102": msg16516, + "14103": msg16517, + "14104": msg16518, + "14105": msg16519, + "14106": msg16520, + "14107": msg16521, + "14108": msg16522, + "14109": msg16523, + "1411": select1303, + "14110": msg16524, + "14111": msg16525, + "14112": msg16526, + "14113": msg16527, + "14114": msg16528, + "14115": msg16529, + "14116": msg16530, + "14117": msg16531, + "14118": msg16532, + "14119": msg16533, + "1412": select1304, + "14120": msg16534, + "14121": msg16535, + "14122": msg16536, + "14123": msg16537, + "14124": msg16538, + "14125": msg16539, + "14126": msg16540, + "14127": msg16541, + "14128": msg16542, + "14129": msg16543, + "1413": select1305, + "14130": msg16544, + "14131": msg16545, + "14132": msg16546, + "14133": msg16547, + "14134": msg16548, + "14135": msg16549, + "14136": msg16550, + "14137": msg16551, + "14138": msg16552, + "14139": msg16553, + "1414": select1306, + "14140": msg16554, + "14141": msg16555, + "14142": msg16556, + "14143": msg16557, + "14144": msg16558, + "14145": msg16559, + "14146": msg16560, + "14147": msg16561, + "14148": msg16562, + "14149": msg16563, + "1415": select1307, + "14150": msg16564, + "14151": msg16565, + "14152": msg16566, + "14153": msg16567, + "14154": msg16568, + "14155": msg16569, + "14156": msg16570, + "14157": msg16571, + "14158": msg16572, + "14159": msg16573, + "1416": select1308, + "14160": msg16574, + "14161": msg16575, + "14162": msg16576, + "14163": msg16577, + "14164": msg16578, + "14165": msg16579, + "14166": msg16580, + "14167": msg16581, + "14168": msg16582, + "14169": msg16583, + "1417": select1309, + "14170": msg16584, + "14171": msg16585, + "14172": msg16586, + "14173": msg16587, + "14174": msg16588, + "14175": msg16589, + "14176": msg16590, + "14177": msg16591, + "14178": msg16592, + "14179": msg16593, + "1418": select1310, + "14180": msg16594, + "14181": msg16595, + "14182": msg16596, + "14183": msg16597, + "14184": msg16598, + "14185": msg16599, + "14186": msg16600, + "14187": msg16601, + "14188": msg16602, + "14189": msg16603, + "1419": select1311, + "14190": msg16604, + "14191": msg16605, + "14192": msg16606, + "14193": msg16607, + "14194": msg16608, + "14195": msg16609, + "14196": msg16610, + "14197": msg16611, + "14198": msg16612, + "14199": msg16613, + "142": select68, + "1420": select1312, + "14200": msg16614, + "14201": msg16615, + "14202": msg16616, + "14203": msg16617, + "14204": msg16618, + "14205": msg16619, + "14206": msg16620, + "14207": msg16621, + "14208": msg16622, + "14209": msg16623, + "1421": select1313, + "14210": msg16624, + "14211": msg16625, + "14212": msg16626, + "14213": msg16627, + "14214": msg16628, + "14215": msg16629, + "14216": msg16630, + "14217": msg16631, + "14218": msg16632, + "14219": msg16633, + "1422": select1314, + "14220": msg16634, + "14221": msg16635, + "14222": msg16636, + "14223": msg16637, + "14224": msg16638, + "14225": msg16639, + "14226": msg16640, + "14227": msg16641, + "14228": msg16642, + "14229": msg16643, + "1423": select1315, + "14230": msg16644, + "14231": msg16645, + "14232": msg16646, + "14233": msg16647, + "14234": msg16648, + "14235": msg16649, + "14236": msg16650, + "14237": msg16651, + "14238": msg16652, + "14239": msg16653, + "1424": select1316, + "14240": msg16654, + "14241": msg16655, + "14242": msg16656, + "14243": msg16657, + "14244": msg16658, + "14245": msg16659, + "14246": msg16660, + "14247": msg16661, + "14248": msg16662, + "14249": msg16663, + "1425": select1317, + "14250": msg16664, + "14251": msg16665, + "14252": msg16666, + "14253": msg16667, + "14254": msg16668, + "14255": msg16669, + "14256": msg16670, + "14257": msg16671, + "14258": msg16672, + "14259": msg16673, + "1426": select1318, + "14260": msg16674, + "14261": msg16675, + "14262": msg16676, + "14263": msg16677, + "14264": msg16678, + "14265": msg16679, + "14266": msg16680, + "14267": msg16681, + "14268": msg16682, + "14269": msg16683, + "1427": select1319, + "14270": msg16684, + "14271": msg16685, + "14272": msg16686, + "14273": msg16687, + "14274": msg16688, + "14275": msg16689, + "14276": msg16690, + "14277": msg16691, + "14278": msg16692, + "14279": msg16693, + "1428": select1320, + "14280": msg16694, + "14281": msg16695, + "14282": msg16696, + "14283": msg16697, + "14284": msg16698, + "14285": msg16699, + "14286": msg16700, + "14287": msg16701, + "14288": msg16702, + "14289": msg16703, + "1429": select1321, + "14290": msg16704, + "14291": msg16705, + "14292": msg16706, + "14293": msg16707, + "14294": msg16708, + "14295": msg16709, + "14296": msg16710, + "14297": msg16711, + "14298": msg16712, + "14299": msg16713, + "143": select69, + "1430": select1322, + "14300": msg16714, + "14301": msg16715, + "14302": msg16716, + "14303": msg16717, + "14304": msg16718, + "14305": msg16719, + "14306": msg16720, + "14307": msg16721, + "14308": msg16722, + "14309": msg16723, + "1431": select1323, + "14310": msg16724, + "14311": msg16725, + "14312": msg16726, + "14313": msg16727, + "14314": msg16728, + "14315": msg16729, + "14316": msg16730, + "14317": msg16731, + "14318": msg16732, + "14319": msg16733, + "1432": select1324, + "14320": msg16734, + "14321": msg16735, + "14322": msg16736, + "14323": msg16737, + "14324": msg16738, + "14325": msg16739, + "14326": msg16740, + "14327": msg16741, + "14328": msg16742, + "14329": msg16743, + "1433": select1325, + "14330": msg16744, + "14331": msg16745, + "14332": msg16746, + "14333": msg16747, + "14334": msg16748, + "14335": msg16749, + "14336": msg16750, + "14337": msg16751, + "14338": msg16752, + "14339": msg16753, + "1434": select1326, + "14340": msg16754, + "14341": msg16755, + "14342": msg16756, + "14343": msg16757, + "14344": msg16758, + "14345": msg16759, + "14346": msg16760, + "14347": msg16761, + "14348": msg16762, + "14349": msg16763, + "1435": select1327, + "14350": msg16764, + "14351": msg16765, + "14352": msg16766, + "14353": msg16767, + "14354": msg16768, + "14355": msg16769, + "14356": msg16770, + "14357": msg16771, + "14358": msg16772, + "14359": msg16773, + "1436": select1328, + "14360": msg16774, + "14361": msg16775, + "14362": msg16776, + "14363": msg16777, + "14364": msg16778, + "14365": msg16779, + "14366": msg16780, + "14367": msg16781, + "14368": msg16782, + "14369": msg16783, + "1437": select1329, + "14370": msg16784, + "14371": msg16785, + "14372": msg16786, + "14373": msg16787, + "14374": msg16788, + "14375": msg16789, + "14376": msg16790, + "14377": msg16791, + "14378": msg16792, + "14379": msg16793, + "1438": select1330, + "14380": msg16794, + "14381": msg16795, + "14382": msg16796, + "14383": msg16797, + "14384": msg16798, + "14385": msg16799, + "14386": msg16800, + "14387": msg16801, + "14388": msg16802, + "14389": msg16803, + "1439": select1331, + "14390": msg16804, + "14391": msg16805, + "14392": msg16806, + "14393": msg16807, + "14394": msg16808, + "14395": msg16809, + "14396": msg16810, + "14397": msg16811, + "14398": msg16812, + "14399": msg16813, + "144": select70, + "1440": select1332, + "14400": msg16814, + "14401": msg16815, + "14402": msg16816, + "14403": msg16817, + "14404": msg16818, + "14405": msg16819, + "14406": msg16820, + "14407": msg16821, + "14408": msg16822, + "14409": msg16823, + "1441": select1333, + "14410": msg16824, + "14411": msg16825, + "14412": msg16826, + "14413": msg16827, + "14414": msg16828, + "14415": msg16829, + "14416": msg16830, + "14417": msg16831, + "14418": msg16832, + "14419": msg16833, + "1442": select1334, + "14420": msg16834, + "14421": msg16835, + "14422": msg16836, + "14423": msg16837, + "14424": msg16838, + "14425": msg16839, + "14426": msg16840, + "14427": msg16841, + "14428": msg16842, + "14429": msg16843, + "1443": select1335, + "14430": msg16844, + "14431": msg16845, + "14432": msg16846, + "14433": msg16847, + "14434": msg16848, + "14435": msg16849, + "14436": msg16850, + "14437": msg16851, + "14438": msg16852, + "14439": msg16853, + "1444": select1336, + "14440": msg16854, + "14441": msg16855, + "14442": msg16856, + "14443": msg16857, + "14444": msg16858, + "14445": msg16859, + "14446": msg16860, + "14447": msg16861, + "14448": msg16862, + "14449": msg16863, + "1445": select1337, + "14450": msg16864, + "14451": msg16865, + "14452": msg16866, + "14453": msg16867, + "14454": msg16868, + "14455": msg16869, + "14456": msg16870, + "14457": msg16871, + "14458": msg16872, + "14459": msg16873, + "1446": select1338, + "14460": msg16874, + "14461": msg16875, + "14462": msg16876, + "14463": msg16877, + "14464": msg16878, + "14465": msg16879, + "14466": msg16880, + "14467": msg16881, + "14468": msg16882, + "14469": msg16883, + "1447": select1339, + "14470": msg16884, + "14471": msg16885, + "14472": msg16886, + "14473": msg16887, + "14474": msg16888, + "14475": msg16889, + "14476": msg16890, + "14477": msg16891, + "14478": msg16892, + "14479": msg16893, + "1448": select1340, + "14480": msg16894, + "14481": msg16895, + "14482": msg16896, + "14483": msg16897, + "14484": msg16898, + "14485": msg16899, + "14486": msg16900, + "14487": msg16901, + "14488": msg16902, + "14489": msg16903, + "1449": select1341, + "14490": msg16904, + "14491": msg16905, + "14492": msg16906, + "14493": msg16907, + "14494": msg16908, + "14495": msg16909, + "14496": msg16910, + "14497": msg16911, + "14498": msg16912, + "14499": msg16913, + "145": select71, + "1450": select1342, + "14500": msg16914, + "14501": msg16915, + "14502": msg16916, + "14503": msg16917, + "14504": msg16918, + "14505": msg16919, + "14506": msg16920, + "14507": msg16921, + "14508": msg16922, + "14509": msg16923, + "1451": select1343, + "14510": msg16924, + "14511": msg16925, + "14512": msg16926, + "14513": msg16927, + "14514": msg16928, + "14515": msg16929, + "14516": msg16930, + "14517": msg16931, + "14518": msg16932, + "14519": msg16933, + "1452": select1344, + "14520": msg16934, + "14521": msg16935, + "14522": msg16936, + "14523": msg16937, + "14524": msg16938, + "14525": msg16939, + "14526": msg16940, + "14527": msg16941, + "14528": msg16942, + "14529": msg16943, + "1453": select1345, + "14530": msg16944, + "14531": msg16945, + "14532": msg16946, + "14533": msg16947, + "14534": msg16948, + "14535": msg16949, + "14536": msg16950, + "14537": msg16951, + "14538": msg16952, + "14539": msg16953, + "1454": select1346, + "14540": msg16954, + "14541": msg16955, + "14542": msg16956, + "14543": msg16957, + "14544": msg16958, + "14545": msg16959, + "14546": msg16960, + "14547": msg16961, + "14548": msg16962, + "14549": msg16963, + "1455": select1347, + "14550": msg16964, + "14551": msg16965, + "14552": msg16966, + "14553": msg16967, + "14554": msg16968, + "14555": msg16969, + "14556": msg16970, + "14557": msg16971, + "14558": msg16972, + "14559": msg16973, + "1456": select1348, + "14560": msg16974, + "14561": msg16975, + "14562": msg16976, + "14563": msg16977, + "14564": msg16978, + "14565": msg16979, + "14566": msg16980, + "14567": msg16981, + "14568": msg16982, + "14569": msg16983, + "1457": select1349, + "14570": msg16984, + "14571": msg16985, + "14572": msg16986, + "14573": msg16987, + "14574": msg16988, + "14575": msg16989, + "14576": msg16990, + "14577": msg16991, + "14578": msg16992, + "14579": msg16993, + "1458": select1350, + "14580": msg16994, + "14581": msg16995, + "14582": msg16996, + "14583": msg16997, + "14584": msg16998, + "14585": msg16999, + "14586": msg17000, + "14587": msg17001, + "14588": msg17002, + "14589": msg17003, + "1459": select1351, + "14590": msg17004, + "14591": msg17005, + "14592": msg17006, + "14593": msg17007, + "14594": msg17008, + "14595": msg17009, + "14596": msg17010, + "14597": msg17011, + "14598": msg17012, + "14599": msg17013, + "146": select72, + "1460": select1352, + "14600": msg17014, + "14601": msg17015, + "14602": msg17016, + "14603": msg17017, + "14604": msg17018, + "14605": msg17019, + "14606": msg17020, + "14607": msg17021, + "14608": msg17022, + "14609": msg17023, + "1461": select1353, + "14610": msg17024, + "14611": msg17025, + "14612": msg17026, + "14613": msg17027, + "14614": msg17028, + "14615": msg17029, + "14616": msg17030, + "14617": msg17031, + "14618": msg17032, + "14619": msg17033, + "1462": select1354, + "14620": msg17034, + "14621": msg17035, + "14622": msg17036, + "14623": msg17037, + "14624": msg17038, + "14625": msg17039, + "14626": msg17040, + "14627": msg17041, + "14628": msg17042, + "14629": msg17043, + "1463": select1355, + "14630": msg17044, + "14631": msg17045, + "14632": msg17046, + "14633": msg17047, + "14634": msg17048, + "14635": msg17049, + "14636": msg17050, + "14637": msg17051, + "14638": msg17052, + "14639": msg17053, + "1464": select1356, + "14640": msg17054, + "14641": msg17055, + "14642": msg17056, + "14643": msg17057, + "14644": msg17058, + "14645": msg17059, + "14646": msg17060, + "14647": msg17061, + "14648": msg17062, + "14649": msg17063, + "1465": select1357, + "14650": msg17064, + "14651": msg17065, + "14652": msg17066, + "14653": msg17067, + "14654": msg17068, + "14655": msg17069, + "14656": msg17070, + "14657": msg17071, + "1466": select1358, + "14661": msg17072, + "14662": msg17073, + "14663": msg17074, + "14664": msg17075, + "14665": msg17076, + "14666": msg17077, + "14667": msg17078, + "14668": msg17079, + "14669": msg17080, + "1467": select1359, + "14670": msg17081, + "14671": msg17082, + "14672": msg17083, + "14673": msg17084, + "14674": msg17085, + "14675": msg17086, + "14676": msg17087, + "14677": msg17088, + "14678": msg17089, + "14679": msg17090, + "1468": select1360, + "14680": msg17091, + "14681": msg17092, + "14682": msg17093, + "14683": msg17094, + "14684": msg17095, + "14685": msg17096, + "14686": msg17097, + "14687": msg17098, + "14688": msg17099, + "14689": msg17100, + "1469": select1361, + "14690": msg17101, + "14691": msg17102, + "14692": msg17103, + "14693": msg17104, + "14694": msg17105, + "14695": msg17106, + "14696": msg17107, + "14697": msg17108, + "14698": msg17109, + "14699": msg17110, + "147": select73, + "1470": select1362, + "14700": msg17111, + "14701": msg17112, + "14702": msg17113, + "14703": msg17114, + "14704": msg17115, + "14705": msg17116, + "14706": msg17117, + "14707": msg17118, + "14708": msg17119, + "14709": msg17120, + "1471": select1363, + "14710": msg17121, + "14711": msg17122, + "14712": msg17123, + "14713": msg17124, + "14714": msg17125, + "14715": msg17126, + "14716": msg17127, + "14717": msg17128, + "14718": msg17129, + "14719": msg17130, + "1472": select1364, + "14720": msg17131, + "14721": msg17132, + "14722": msg17133, + "14723": msg17134, + "14724": msg17135, + "14725": msg17136, + "14726": msg17137, + "14727": msg17138, + "14728": msg17139, + "14729": msg17140, + "1473": select1365, + "14730": msg17141, + "14731": msg17142, + "14732": msg17143, + "14733": msg17144, + "14734": msg17145, + "14735": msg17146, + "14736": msg17147, + "14737": msg17148, + "14738": msg17149, + "14739": msg17150, + "1474": select1366, + "14740": msg17151, + "14741": msg17152, + "14742": msg17153, + "14743": msg17154, + "14744": msg17155, + "14745": msg17156, + "14746": msg17157, + "14747": msg17158, + "14748": msg17159, + "14749": msg17160, + "1475": select1367, + "14750": msg17161, + "14751": msg17162, + "14752": msg17163, + "14753": msg17164, + "14754": msg17165, + "14755": msg17166, + "14756": msg17167, + "14757": msg17168, + "14758": msg17169, + "14759": msg17170, + "1476": select1368, + "14760": msg17171, + "14761": msg17172, + "14762": msg17173, + "14763": msg17174, + "14764": msg17175, + "14765": msg17176, + "14766": msg17177, + "14767": msg17178, + "14768": msg17179, + "14769": msg17180, + "1477": select1369, + "14770": msg17181, + "14771": msg17182, + "14772": msg17183, + "14773": msg17184, + "14774": msg17185, + "14775": msg17186, + "14776": msg17187, + "14777": msg17188, + "14778": msg17189, + "14779": msg17190, + "1478": select1370, + "14780": msg17191, + "14781": msg17192, + "14782": msg17193, + "14783": msg17194, + "14784": msg17195, + "14785": msg17196, + "14786": msg17197, + "14787": msg17198, + "14788": msg17199, + "14789": msg17200, + "1479": select1371, + "14790": msg17201, + "14791": msg17202, + "14792": msg17203, + "14793": msg17204, + "14794": msg17205, + "14795": msg17206, + "14796": msg17207, + "14797": msg17208, + "14798": msg17209, + "14799": msg17210, + "148": select74, + "1480": select1372, + "14800": msg17211, + "14801": msg17212, + "14802": msg17213, + "14803": msg17214, + "14804": msg17215, + "14805": msg17216, + "14806": msg17217, + "14807": msg17218, + "14808": msg17219, + "14809": msg17220, + "1481": select1373, + "14810": msg17221, + "14811": msg17222, + "14812": msg17223, + "14813": msg17224, + "14814": msg17225, + "14815": msg17226, + "14816": msg17227, + "14817": msg17228, + "14818": msg17229, + "14819": msg17230, + "1482": select1374, + "14820": msg17231, + "14821": msg17232, + "14822": msg17233, + "14823": msg17234, + "14824": msg17235, + "14825": msg17236, + "14826": msg17237, + "14827": msg17238, + "14828": msg17239, + "14829": msg17240, + "1483": select1375, + "14830": msg17241, + "14831": msg17242, + "14832": msg17243, + "14833": msg17244, + "14834": msg17245, + "14835": msg17246, + "14836": msg17247, + "14837": msg17248, + "14838": msg17249, + "14839": msg17250, + "1484": select1376, + "14840": msg17251, + "14841": msg17252, + "14842": msg17253, + "14843": msg17254, + "14844": msg17255, + "14845": msg17256, + "14846": msg17257, + "14847": msg17258, + "14848": msg17259, + "14849": msg17260, + "1485": select1377, + "14850": msg17261, + "14851": msg17262, + "14852": msg17263, + "14853": msg17264, + "14854": msg17265, + "14855": msg17266, + "14856": msg17267, + "14857": msg17268, + "14858": msg17269, + "14859": msg17270, + "1486": select1378, + "14860": msg17271, + "14861": msg17272, + "14862": msg17273, + "14863": msg17274, + "14864": msg17275, + "14865": msg17276, + "14866": msg17277, + "14867": msg17278, + "14868": msg17279, + "14869": msg17280, + "1487": select1379, + "14870": msg17281, + "14871": msg17282, + "1488": select1380, + "1489": select1381, + "14896": msg17283, + "14897": msg17284, + "14898": msg17285, + "14899": msg17286, + "149": select75, + "1490": select1382, + "14900": msg17287, + "1491": select1383, + "1492": select1384, + "1493": select1385, + "1494": select1386, + "1495": select1387, + "1496": select1388, + "1497": select1389, + "1498": select1390, + "14986": msg17288, + "14987": msg17289, + "14988": msg17290, + "14989": msg17291, + "1499": select1391, + "14990": msg17292, + "14991": msg17293, + "14992": msg17294, + "14993": msg17295, + "14994": msg17296, + "14995": msg17297, + "14996": msg17298, + "14997": msg17299, + "14998": msg17300, + "14999": msg17301, + "15": select16, + "150": select76, + "1500": select1392, + "15000": msg17302, + "15001": msg17303, + "15002": msg17304, + "15003": msg17305, + "15004": msg17306, + "15005": msg17307, + "15006": msg17308, + "15007": msg17309, + "15008": msg17310, + "15009": msg17311, + "1501": select1393, + "15010": msg17312, + "15011": msg17313, + "15012": msg17314, + "15013": msg17315, + "15014": msg17316, + "15015": msg17317, + "15016": msg17318, + "15017": msg17319, + "15018": msg17320, + "15019": msg17321, + "1502": select1394, + "15020": msg17322, + "15021": msg17323, + "15022": msg17324, + "15023": msg17325, + "15024": msg17326, + "15025": msg17327, + "15026": msg17328, + "15027": msg17329, + "15028": msg17330, + "15029": msg17331, + "1503": select1395, + "15030": msg17332, + "15031": msg17333, + "15032": msg17334, + "15033": msg17335, + "15034": msg17336, + "15035": msg17337, + "15036": msg17338, + "15037": msg17339, + "15038": msg17340, + "15039": msg17341, + "1504": select1396, + "15040": msg17342, + "15041": msg17343, + "15042": msg17344, + "15043": msg17345, + "15044": msg17346, + "15045": msg17347, + "15046": msg17348, + "15047": msg17349, + "15048": msg17350, + "15049": msg17351, + "1505": select1397, + "15050": msg17352, + "15051": msg17353, + "15052": msg17354, + "15053": msg17355, + "15054": msg17356, + "15055": msg17357, + "15056": msg17358, + "15057": msg17359, + "15058": msg17360, + "15059": msg17361, + "1506": select1398, + "15060": msg17362, + "15061": msg17363, + "15062": msg17364, + "15063": msg17365, + "15064": msg17366, + "15065": msg17367, + "15066": msg17368, + "15067": msg17369, + "15068": msg17370, + "15069": msg17371, + "1507": select1399, + "15070": msg17372, + "15071": msg17373, + "15072": msg17374, + "15073": msg17375, + "15074": msg17376, + "15075": msg17377, + "15076": msg17378, + "15077": msg17379, + "15078": msg17380, + "15079": msg17381, + "1508": select1400, + "15080": msg17382, + "15081": msg17383, + "15082": msg17384, + "15083": msg17385, + "15084": msg17386, + "15085": msg17387, + "15086": msg17388, + "15087": msg17389, + "15088": msg17390, + "15089": msg17391, + "1509": select1401, + "15090": msg17392, + "15091": msg17393, + "15092": msg17394, + "15093": msg17395, + "15094": msg17396, + "15095": msg17397, + "15096": msg17398, + "15097": msg17399, + "15098": msg17400, + "15099": msg17401, + "151": select77, + "1510": select1402, + "15100": msg17402, + "15101": msg17403, + "15102": msg17404, + "15103": msg17405, + "15104": msg17406, + "15105": msg17407, + "15106": msg17408, + "15107": msg17409, + "15108": msg17410, + "15109": msg17411, + "1511": select1403, + "15110": msg17412, + "15111": msg17413, + "15112": msg17414, + "15113": msg17415, + "15114": msg17416, + "15115": msg17417, + "15116": msg17418, + "15117": msg17419, + "15118": msg17420, + "15119": msg17421, + "1512": select1404, + "15120": msg17422, + "15121": msg17423, + "15122": msg17424, + "15123": msg17425, + "15124": msg17426, + "15125": msg17427, + "15126": msg17428, + "15127": msg17429, + "15128": msg17430, + "15129": msg17431, + "1513": select1405, + "15130": msg17432, + "15131": msg17433, + "15132": msg17434, + "15133": msg17435, + "15134": msg17436, + "15135": msg17437, + "15136": msg17438, + "15137": msg17439, + "15138": msg17440, + "15139": msg17441, + "1514": select1406, + "15140": msg17442, + "15141": msg17443, + "15142": msg17444, + "15143": msg17445, + "15144": msg17446, + "15145": msg17447, + "15146": msg17448, + "15147": msg17449, + "15148": msg17450, + "15149": msg17451, + "1515": select1407, + "15150": msg17452, + "15151": msg17453, + "15152": msg17454, + "15153": msg17455, + "15154": msg17456, + "15155": msg17457, + "15156": msg17458, + "15157": msg17459, + "15158": msg17460, + "15159": msg17461, + "1516": select1408, + "15160": msg17462, + "15161": msg17463, + "15162": msg17464, + "15163": msg17465, + "15164": msg17466, + "15165": msg17467, + "15166": msg17468, + "15167": msg17469, + "15168": msg17470, + "15169": msg17471, + "1517": select1409, + "15170": msg17472, + "15171": msg17473, + "15172": msg17474, + "15173": msg17475, + "15174": msg17476, + "15175": msg17477, + "15176": msg17478, + "15177": msg17479, + "15178": msg17480, + "15179": msg17481, + "1518": select1410, + "15180": msg17482, + "15181": msg17483, + "15182": msg17484, + "15183": msg17485, + "15184": msg17486, + "15185": msg17487, + "15186": msg17488, + "15187": msg17489, + "15188": msg17490, + "15189": msg17491, + "1519": select1411, + "15190": msg17492, + "15191": msg17493, + "15192": msg17494, + "15193": msg17495, + "15194": msg17496, + "15195": msg17497, + "15196": msg17498, + "15197": msg17499, + "15198": msg17500, + "15199": msg17501, + "152": select78, + "1520": select1412, + "15200": msg17502, + "15201": msg17503, + "15202": msg17504, + "15203": msg17505, + "15204": msg17506, + "15205": msg17507, + "15206": msg17508, + "15207": msg17509, + "15208": msg17510, + "15209": msg17511, + "1521": select1413, + "15210": msg17512, + "15211": msg17513, + "15212": msg17514, + "15213": msg17515, + "15214": msg17516, + "15215": msg17517, + "15216": msg17518, + "15217": msg17519, + "15218": msg17520, + "15219": msg17521, + "1522": select1414, + "15220": msg17522, + "15221": msg17523, + "15222": msg17524, + "15223": msg17525, + "15224": msg17526, + "15225": msg17527, + "15226": msg17528, + "15227": msg17529, + "15228": msg17530, + "15229": msg17531, + "1523": select1415, + "15230": msg17532, + "15231": msg17533, + "15232": msg17534, + "15233": msg17535, + "15234": msg17536, + "15235": msg17537, + "15236": msg17538, + "15237": msg17539, + "15238": msg17540, + "15239": msg17541, + "1524": select1416, + "15240": msg17542, + "15241": msg17543, + "15242": msg17544, + "15243": msg17545, + "15244": msg17546, + "15245": msg17547, + "15246": msg17548, + "15247": msg17549, + "15248": msg17550, + "15249": msg17551, + "1525": select1417, + "15250": msg17552, + "15251": msg17553, + "15252": msg17554, + "15253": msg17555, + "15254": msg17556, + "15255": msg17557, + "15256": msg17558, + "15257": msg17559, + "15258": msg17560, + "15259": msg17561, + "1526": select1418, + "15260": msg17562, + "15261": msg17563, + "15262": msg17564, + "15263": msg17565, + "15264": msg17566, + "15265": msg17567, + "15266": msg17568, + "15267": msg17569, + "15268": msg17570, + "15269": msg17571, + "1527": select1419, + "15270": msg17572, + "15271": msg17573, + "15272": msg17574, + "15273": msg17575, + "15274": msg17576, + "15275": msg17577, + "15276": msg17578, + "15277": msg17579, + "15278": msg17580, + "15279": msg17581, + "1528": select1420, + "15280": msg17582, + "15281": msg17583, + "15282": msg17584, + "15283": msg17585, + "15284": msg17586, + "15285": msg17587, + "15286": msg17588, + "15287": msg17589, + "15288": msg17590, + "15289": msg17591, + "1529": select1421, + "15290": msg17592, + "15291": msg17593, + "15292": msg17594, + "15293": msg17595, + "15294": msg17596, + "15295": msg17597, + "15296": msg17598, + "15297": msg17599, + "15298": msg17600, + "15299": msg17601, + "153": select79, + "1530": select1422, + "15300": msg17602, + "15301": msg17603, + "15302": msg17604, + "15303": msg17605, + "15304": msg17606, + "15305": msg17607, + "15306": msg17608, + "15307": msg17609, + "15308": msg17610, + "15309": msg17611, + "1531": select1423, + "15310": msg17612, + "15311": msg17613, + "15312": msg17614, + "15313": msg17615, + "15314": msg17616, + "15315": msg17617, + "15316": msg17618, + "15317": msg17619, + "15318": msg17620, + "15319": msg17621, + "1532": select1424, + "15320": msg17622, + "15321": msg17623, + "15322": msg17624, + "15323": msg17625, + "15324": msg17626, + "15325": msg17627, + "15326": msg17628, + "15327": msg17629, + "15328": msg17630, + "15329": msg17631, + "1533": select1425, + "15330": msg17632, + "15331": msg17633, + "15332": msg17634, + "15333": msg17635, + "15334": msg17636, + "15335": msg17637, + "15336": msg17638, + "15337": msg17639, + "15338": msg17640, + "15339": msg17641, + "1534": select1426, + "15340": msg17642, + "15341": msg17643, + "15342": msg17644, + "15343": msg17645, + "15344": msg17646, + "15345": msg17647, + "15346": msg17648, + "15347": msg17649, + "15348": msg17650, + "15349": msg17651, + "1535": select1427, + "15350": msg17652, + "15351": msg17653, + "15352": msg17654, + "15353": msg17655, + "15354": msg17656, + "15355": msg17657, + "15356": msg17658, + "15357": msg17659, + "15358": msg17660, + "15359": msg17661, + "1536": select1428, + "15360": msg17662, + "15361": msg17663, + "15362": msg17664, + "15363": msg17665, + "15364": msg17666, + "15365": msg17667, + "15366": msg17668, + "15367": msg17669, + "15368": msg17670, + "15369": msg17671, + "1537": select1429, + "15370": msg17672, + "15371": msg17673, + "15372": msg17674, + "15373": msg17675, + "15374": msg17676, + "15375": msg17677, + "15376": msg17678, + "15377": msg17679, + "15378": msg17680, + "15379": msg17681, + "1538": select1430, + "15380": msg17682, + "15381": msg17683, + "15382": msg17684, + "15383": msg17685, + "15384": msg17686, + "15385": msg17687, + "15386": msg17688, + "15387": msg17689, + "15388": msg17690, + "15389": msg17691, + "1539": select1431, + "15390": msg17692, + "15391": msg17693, + "15392": msg17694, + "15393": msg17695, + "15394": msg17696, + "15395": msg17697, + "15396": msg17698, + "15397": msg17699, + "15398": msg17700, + "15399": msg17701, + "154": select80, + "1540": select1432, + "15400": msg17702, + "15401": msg17703, + "15402": msg17704, + "15403": msg17705, + "15404": msg17706, + "15405": msg17707, + "15406": msg17708, + "15407": msg17709, + "15408": msg17710, + "15409": msg17711, + "1541": select1433, + "15410": msg17712, + "15411": msg17713, + "15412": msg17714, + "15413": msg17715, + "15414": msg17716, + "15415": msg17717, + "15416": msg17718, + "15417": msg17719, + "15418": msg17720, + "1542": select1434, + "15420": msg17721, + "15421": msg17722, + "15422": msg17723, + "15423": msg17724, + "15424": msg17725, + "15425": msg17726, + "15426": msg17727, + "15427": msg17728, + "15428": msg17729, + "15429": msg17730, + "1543": select1435, + "15430": msg17731, + "15431": msg17732, + "15432": msg17733, + "15433": msg17734, + "15434": msg17735, + "15435": msg17736, + "15436": msg17737, + "15437": msg17738, + "15438": msg17739, + "15439": msg17740, + "1544": select1436, + "15440": msg17741, + "15441": msg17742, + "15442": msg17743, + "15443": msg17744, + "15444": msg17745, + "15445": msg17746, + "15446": msg17747, + "15447": msg17748, + "15448": msg17749, + "15449": msg17750, + "1545": select1437, + "15450": msg17751, + "15451": msg17752, + "15452": msg17753, + "15453": msg17754, + "15454": msg17755, + "15455": msg17756, + "15456": msg17757, + "15457": msg17758, + "15458": msg17759, + "15459": msg17760, + "1546": select1438, + "15460": msg17761, + "15461": msg17762, + "15462": msg17763, + "15463": msg17764, + "15464": msg17765, + "15465": msg17766, + "15466": msg17767, + "15467": msg17768, + "15468": msg17769, + "15469": msg17770, + "1547": select1439, + "15470": msg17771, + "15471": msg17772, + "15472": msg17773, + "15473": msg17774, + "15474": msg17775, + "15475": msg17776, + "15476": msg17777, + "15477": msg17778, + "15478": msg17779, + "15479": msg17780, + "1548": select1440, + "15480": msg17781, + "15481": msg17782, + "15482": msg17783, + "15483": msg17784, + "15484": msg17785, + "15485": msg17786, + "15486": msg17787, + "15487": msg17788, + "15488": msg17789, + "15489": msg17790, + "1549": select1441, + "15490": msg17791, + "15491": msg17792, + "15492": msg17793, + "15493": msg17794, + "15494": msg17795, + "15495": msg17796, + "15496": msg17797, + "15497": msg17798, + "15498": msg17799, + "15499": msg17800, + "155": select81, + "1550": select1442, + "15500": msg17801, + "15501": msg17802, + "15502": msg17803, + "15503": msg17804, + "15504": msg17805, + "15505": msg17806, + "15506": msg17807, + "15507": msg17808, + "15508": msg17809, + "15509": msg17810, + "1551": select1443, + "15510": msg17811, + "15511": msg17812, + "15512": msg17813, + "15513": msg17814, + "15514": msg17815, + "15515": msg17816, + "15516": msg17817, + "15517": msg17818, + "15518": msg17819, + "15519": msg17820, + "1552": select1444, + "15520": msg17821, + "15521": msg17822, + "15522": msg17823, + "15523": msg17824, + "15524": msg17825, + "15525": msg17826, + "15526": msg17827, + "15527": msg17828, + "15528": msg17829, + "15529": msg17830, + "1553": select1445, + "15530": msg17831, + "15531": msg17832, + "15532": msg17833, + "15533": msg17834, + "15534": msg17835, + "15535": msg17836, + "15536": msg17837, + "15537": msg17838, + "15538": msg17839, + "15539": msg17840, + "1554": select1446, + "15540": msg17841, + "15541": msg17842, + "15542": msg17843, + "15543": msg17844, + "15544": msg17845, + "15545": msg17846, + "15546": msg17847, + "15547": msg17848, + "15548": msg17849, + "15549": msg17850, + "1555": select1447, + "15550": msg17851, + "15551": msg17852, + "15552": msg17853, + "15553": msg17854, + "15554": msg17855, + "15555": msg17856, + "15556": msg17857, + "15557": msg17858, + "15558": msg17859, + "15559": msg17860, + "1556": select1448, + "15560": msg17861, + "15561": msg17862, + "15562": msg17863, + "15563": msg17864, + "15564": msg17865, + "15565": msg17866, + "15566": msg17867, + "15567": msg17868, + "15568": msg17869, + "15569": msg17870, + "1557": select1449, + "15570": msg17871, + "15571": msg17872, + "15572": msg17873, + "15573": msg17874, + "15574": msg17875, + "15575": msg17876, + "15576": msg17877, + "15577": msg17878, + "15578": msg17879, + "15579": msg17880, + "1558": select1450, + "15580": msg17881, + "15581": msg17882, + "15582": msg17883, + "15583": msg17884, + "15584": msg17885, + "15585": msg17886, + "15586": msg17887, + "15587": msg17888, + "15588": msg17889, + "15589": msg17890, + "1559": select1451, + "15590": msg17891, + "15591": msg17892, + "15592": msg17893, + "15593": msg17894, + "15594": msg17895, + "15595": msg17896, + "15596": msg17897, + "15597": msg17898, + "15598": msg17899, + "15599": msg17900, + "156": select82, + "1560": select1452, + "15600": msg17901, + "15601": msg17902, + "15602": msg17903, + "15603": msg17904, + "15604": msg17905, + "15605": msg17906, + "15606": msg17907, + "15607": msg17908, + "15608": msg17909, + "15609": msg17910, + "1561": select1453, + "15610": msg17911, + "15611": msg17912, + "15612": msg17913, + "15613": msg17914, + "15614": msg17915, + "15615": msg17916, + "15616": msg17917, + "15617": msg17918, + "15618": msg17919, + "15619": msg17920, + "1562": select1454, + "15620": msg17921, + "15621": msg17922, + "15622": msg17923, + "15623": msg17924, + "15624": msg17925, + "15625": msg17926, + "15626": msg17927, + "15627": msg17928, + "15628": msg17929, + "15629": msg17930, + "1563": select1455, + "15630": msg17931, + "15631": msg17932, + "15632": msg17933, + "15633": msg17934, + "15634": msg17935, + "15635": msg17936, + "15636": msg17937, + "15637": msg17938, + "15638": msg17939, + "15639": msg17940, + "1564": select1456, + "15640": msg17941, + "15641": msg17942, + "15642": msg17943, + "15643": msg17944, + "15644": msg17945, + "15645": msg17946, + "15646": msg17947, + "15647": msg17948, + "15648": msg17949, + "15649": msg17950, + "1565": select1457, + "15650": msg17951, + "15651": msg17952, + "15652": msg17953, + "15653": msg17954, + "15654": msg17955, + "15655": msg17956, + "15656": msg17957, + "15657": msg17958, + "15658": msg17959, + "15659": msg17960, + "1566": select1458, + "15660": msg17961, + "15661": msg17962, + "15662": msg17963, + "15663": msg17964, + "15664": msg17965, + "15665": msg17966, + "15666": msg17967, + "15667": msg17968, + "15668": msg17969, + "15669": msg17970, + "1567": select1459, + "15670": msg17971, + "15671": msg17972, + "15672": msg17973, + "15673": msg17974, + "15674": msg17975, + "15675": msg17976, + "15676": msg17977, + "15677": msg17978, + "15678": msg17979, + "15679": msg17980, + "1568": select1460, + "15680": msg17981, + "15681": msg17982, + "15682": msg17983, + "15683": msg17984, + "15684": msg17985, + "15685": msg17986, + "15686": msg17987, + "15687": msg17988, + "15688": msg17989, + "15689": msg17990, + "1569": select1461, + "15690": msg17991, + "15691": msg17992, + "15692": msg17993, + "15693": msg17994, + "15694": msg17995, + "15695": msg17996, + "15696": msg17997, + "15697": msg17998, + "15698": msg17999, + "15699": msg18000, + "157": select83, + "1570": select1462, + "15700": msg18001, + "15701": msg18002, + "15702": msg18003, + "15703": msg18004, + "15704": msg18005, + "15705": msg18006, + "15706": msg18007, + "15707": msg18008, + "15708": msg18009, + "15709": msg18010, + "1571": select1463, + "15710": msg18011, + "15711": msg18012, + "15712": msg18013, + "15713": msg18014, + "15714": msg18015, + "15715": msg18016, + "15716": msg18017, + "15717": msg18018, + "15718": msg18019, + "15719": msg18020, + "1572": select1464, + "15720": msg18021, + "15721": msg18022, + "15722": msg18023, + "15723": msg18024, + "15724": msg18025, + "15725": msg18026, + "15726": msg18027, + "15727": msg18028, + "15728": msg18029, + "15729": msg18030, + "1573": select1465, + "15730": msg18031, + "15731": msg18032, + "15732": msg18033, + "15733": msg18034, + "15734": msg18035, + "1574": select1466, + "1575": select1467, + "1576": select1468, + "1577": select1469, + "1578": select1470, + "1579": select1471, + "158": select84, + "1580": select1472, + "1581": select1473, + "1582": select1474, + "1583": select1475, + "1584": select1476, + "15847": msg18036, + "15848": msg18037, + "15849": msg18038, + "1585": select1477, + "15850": msg18039, + "15851": msg18040, + "15852": msg18041, + "15853": msg18042, + "15854": msg18043, + "15855": msg18044, + "15856": msg18045, + "15857": msg18046, + "15858": msg18047, + "15859": msg18048, + "1586": select1478, + "15860": msg18049, + "15861": msg18050, + "15862": msg18051, + "15863": msg18052, + "15864": msg18053, + "15865": msg18054, + "15866": msg18055, + "15867": msg18056, + "15868": msg18057, + "15869": msg18058, + "1587": select1479, + "15870": msg18059, + "15871": msg18060, + "15872": msg18061, + "15873": msg18062, + "15874": msg18063, + "15875": msg18064, + "15876": msg18065, + "15877": msg18066, + "15878": msg18067, + "15879": msg18068, + "1588": select1480, + "15880": msg18069, + "15881": msg18070, + "15882": msg18071, + "15883": msg18072, + "15884": msg18073, + "15885": msg18074, + "15886": msg18075, + "15887": msg18076, + "15888": msg18077, + "15889": msg18078, + "1589": select1481, + "15890": msg18079, + "15891": msg18080, + "15892": msg18081, + "15893": msg18082, + "15894": msg18083, + "15895": msg18084, + "15896": msg18085, + "15897": msg18086, + "15898": msg18087, + "15899": msg18088, + "159": select85, + "1590": select1482, + "15900": msg18089, + "15901": msg18090, + "15902": msg18091, + "15903": msg18092, + "15904": msg18093, + "15905": msg18094, + "15906": msg18095, + "15907": msg18096, + "15908": msg18097, + "15909": msg18098, + "1591": select1483, + "15910": msg18099, + "15911": msg18100, + "15912": msg18101, + "15913": msg18102, + "15914": msg18103, + "15915": msg18104, + "15916": msg18105, + "15917": msg18106, + "15918": msg18107, + "15919": msg18108, + "1592": select1484, + "15920": msg18109, + "15921": msg18110, + "15922": msg18111, + "15923": msg18112, + "15924": msg18113, + "15925": msg18114, + "15926": msg18115, + "15927": msg18116, + "15928": msg18117, + "15929": msg18118, + "1593": select1485, + "15930": msg18119, + "15931": msg18120, + "15932": msg18121, + "15933": msg18122, + "15934": msg18123, + "15935": msg18124, + "15936": msg18125, + "15937": msg18126, + "15938": msg18127, + "15939": msg18128, + "1594": select1486, + "15940": msg18129, + "15941": msg18130, + "15942": msg18131, + "15943": msg18132, + "15944": msg18133, + "15945": msg18134, + "15946": msg18135, + "15947": msg18136, + "15948": msg18137, + "15949": msg18138, + "1595": select1487, + "15950": msg18139, + "15951": msg18140, + "15952": msg18141, + "15953": msg18142, + "15954": msg18143, + "15955": msg18144, + "15956": msg18145, + "15957": msg18146, + "15958": msg18147, + "15959": msg18148, + "15960": msg18149, + "15961": msg18150, + "15962": msg18151, + "15963": msg18152, + "15964": msg18153, + "15965": msg18154, + "15966": msg18155, + "15967": msg18156, + "15968": msg18157, + "15969": msg18158, + "1597": select1488, + "15970": msg18159, + "15971": msg18160, + "15972": msg18161, + "15973": msg18162, + "15974": msg18163, + "15975": msg18164, + "15976": msg18165, + "15977": msg18166, + "15978": msg18167, + "15979": msg18168, + "1598": select1489, + "15980": msg18169, + "15981": msg18170, + "15982": msg18171, + "15983": msg18172, + "15984": msg18173, + "15985": msg18174, + "15986": msg18175, + "15987": msg18176, + "15988": msg18177, + "15989": msg18178, + "1599": select1490, + "15990": msg18179, + "15991": msg18180, + "15992": msg18181, + "15993": msg18182, + "15994": msg18183, + "15995": msg18184, + "15996": msg18185, + "15997": msg18186, + "15998": msg18187, + "15999": msg18188, + "16": select17, + "160": select86, + "1600": select1491, + "16000": msg18189, + "16001": msg18190, + "16002": msg18191, + "16003": msg18192, + "16004": msg18193, + "16005": msg18194, + "16006": msg18195, + "16007": msg18196, + "16008": msg18197, + "16009": msg18198, + "1601": select1492, + "16010": msg18199, + "16011": msg18200, + "16012": msg18201, + "16013": msg18202, + "16014": msg18203, + "16015": msg18204, + "16016": msg18205, + "16017": msg18206, + "16018": msg18207, + "16019": msg18208, + "1602": select1493, + "16020": msg18209, + "16021": msg18210, + "16022": msg18211, + "16023": msg18212, + "16024": msg18213, + "16025": msg18214, + "16026": msg18215, + "16027": msg18216, + "16028": msg18217, + "16029": msg18218, + "1603": select1494, + "16030": msg18219, + "16031": msg18220, + "16032": msg18221, + "16033": msg18222, + "16034": msg18223, + "16035": msg18224, + "16036": msg18225, + "16037": msg18226, + "16038": msg18227, + "16039": msg18228, + "1604": select1495, + "16040": msg18229, + "16041": msg18230, + "16042": msg18231, + "16043": msg18232, + "16044": msg18233, + "16045": msg18234, + "16046": msg18235, + "16047": msg18236, + "16048": msg18237, + "16049": msg18238, + "1605": select1496, + "16050": msg18239, + "16051": msg18240, + "16052": msg18241, + "16053": msg18242, + "16054": msg18243, + "16055": msg18244, + "16056": msg18245, + "16057": msg18246, + "16058": msg18247, + "16059": msg18248, + "1606": select1497, + "16060": msg18249, + "16061": msg18250, + "16062": msg18251, + "16063": msg18252, + "16064": msg18253, + "16065": msg18254, + "16066": msg18255, + "16067": msg18256, + "16068": msg18257, + "16069": msg18258, + "1607": select1498, + "16070": msg18259, + "16071": msg18260, + "16072": msg18261, + "16073": msg18262, + "16074": msg18263, + "16075": msg18264, + "16076": msg18265, + "16077": msg18266, + "16078": msg18267, + "16079": msg18268, + "1608": select1499, + "16080": msg18269, + "16081": msg18270, + "16082": msg18271, + "16083": msg18272, + "16084": msg18273, + "16085": msg18274, + "16086": msg18275, + "16087": msg18276, + "16089": msg18277, + "1609": select1500, + "16090": msg18278, + "16091": msg18279, + "16092": msg18280, + "16093": msg18281, + "16094": msg18282, + "16095": msg18283, + "16096": msg18284, + "16097": msg18285, + "16098": msg18286, + "16099": msg18287, + "161": select87, + "1610": select1501, + "16100": msg18288, + "16101": msg18289, + "16102": msg18290, + "16103": msg18291, + "16104": msg18292, + "16105": msg18293, + "16106": msg18294, + "16107": msg18295, + "16108": msg18296, + "16109": msg18297, + "1611": select1502, + "16110": msg18298, + "16111": msg18299, + "16112": msg18300, + "16113": msg18301, + "16114": msg18302, + "16115": msg18303, + "16116": msg18304, + "16117": msg18305, + "16118": msg18306, + "16119": msg18307, + "1612": select1503, + "16120": msg18308, + "16121": msg18309, + "16122": msg18310, + "16123": msg18311, + "16124": msg18312, + "16125": msg18313, + "16126": msg18314, + "16127": msg18315, + "16128": msg18316, + "16129": msg18317, + "1613": select1504, + "16130": msg18318, + "16131": msg18319, + "16132": msg18320, + "16133": msg18321, + "16134": msg18322, + "16135": msg18323, + "16136": msg18324, + "16137": msg18325, + "16138": msg18326, + "16139": msg18327, + "1614": select1505, + "16140": msg18328, + "16141": msg18329, + "16142": msg18330, + "16143": msg18331, + "16144": msg18332, + "16145": msg18333, + "16146": msg18334, + "16147": msg18335, + "16148": msg18336, + "16149": msg18337, + "1615": select1506, + "16150": msg18338, + "16151": msg18339, + "16152": msg18340, + "16153": msg18341, + "16154": msg18342, + "16155": msg18343, + "16156": msg18344, + "16157": msg18345, + "16158": msg18346, + "16159": msg18347, + "1616": select1507, + "16160": msg18348, + "16161": msg18349, + "16162": msg18350, + "16163": msg18351, + "16164": msg18352, + "16165": msg18353, + "16166": msg18354, + "16167": msg18355, + "16168": msg18356, + "16169": msg18357, + "1617": select1508, + "16170": msg18358, + "16171": msg18359, + "16172": msg18360, + "16173": msg18361, + "16174": msg18362, + "16175": msg18363, + "16176": msg18364, + "16177": msg18365, + "16178": msg18366, + "16179": msg18367, + "1618": select1509, + "16180": msg18368, + "16181": msg18369, + "16182": msg18370, + "16183": msg18371, + "16184": msg18372, + "16185": msg18373, + "16186": msg18374, + "16187": msg18375, + "16188": msg18376, + "16189": msg18377, + "1619": select1510, + "16190": msg18378, + "16191": msg18379, + "16192": msg18380, + "16193": msg18381, + "16194": msg18382, + "16195": msg18383, + "16196": msg18384, + "16197": msg18385, + "16198": msg18386, + "16199": msg18387, + "162": select88, + "1620": select1511, + "16200": msg18388, + "16201": msg18389, + "16202": msg18390, + "16203": msg18391, + "16204": msg18392, + "16205": msg18393, + "16206": msg18394, + "16207": msg18395, + "16208": msg18396, + "16209": msg18397, + "1621": select1512, + "16210": msg18398, + "16211": msg18399, + "16212": msg18400, + "16213": msg18401, + "16214": msg18402, + "16215": msg18403, + "16216": msg18404, + "16217": msg18405, + "16218": msg18406, + "16219": msg18407, + "1622": select1513, + "16220": msg18408, + "16221": msg18409, + "16222": msg18410, + "16223": msg18411, + "16224": msg18412, + "16225": msg18413, + "16226": msg18414, + "16227": msg18415, + "16228": msg18416, + "16229": msg18417, + "1623": select1514, + "16230": msg18418, + "16231": msg18419, + "16232": msg18420, + "16233": msg18421, + "16234": msg18422, + "16235": msg18423, + "16236": msg18424, + "16237": msg18425, + "16238": msg18426, + "16239": msg18427, + "1624": select1515, + "16240": msg18428, + "16241": msg18429, + "16242": msg18430, + "16243": msg18431, + "16244": msg18432, + "16245": msg18433, + "16246": msg18434, + "16247": msg18435, + "16248": msg18436, + "16249": msg18437, + "1625": select1516, + "16250": msg18438, + "16251": msg18439, + "16252": msg18440, + "16253": msg18441, + "16254": msg18442, + "16255": msg18443, + "16256": msg18444, + "16257": msg18445, + "16258": msg18446, + "16259": msg18447, + "1626": select1517, + "16260": msg18448, + "16261": msg18449, + "16262": msg18450, + "16263": msg18451, + "16264": msg18452, + "16265": msg18453, + "16266": msg18454, + "16267": msg18455, + "16268": msg18456, + "16269": msg18457, + "1627": select1518, + "16270": msg18458, + "16271": msg18459, + "16272": msg18460, + "16273": msg18461, + "16274": msg18462, + "16275": msg18463, + "16276": msg18464, + "16277": msg18465, + "16278": msg18466, + "16279": msg18467, + "1628": select1519, + "16280": msg18468, + "16281": msg18469, + "16282": msg18470, + "16283": msg18471, + "16284": msg18472, + "16285": msg18473, + "16286": msg18474, + "16287": msg18475, + "16288": msg18476, + "16289": msg18477, + "1629": select1520, + "16290": msg18478, + "16291": msg18479, + "16292": msg18480, + "16293": msg18481, + "16294": msg18482, + "16295": msg18483, + "16296": msg18484, + "16297": msg18485, + "16298": msg18486, + "16299": msg18487, + "163": select89, + "1630": select1521, + "16300": msg18488, + "16301": msg18489, + "16302": msg18490, + "16303": msg18491, + "16304": msg18492, + "16305": msg18493, + "16306": msg18494, + "16307": msg18495, + "16308": msg18496, + "16309": msg18497, + "1631": select1522, + "16310": msg18498, + "16311": msg18499, + "16312": msg18500, + "16313": msg18501, + "16314": msg18502, + "16315": msg18503, + "16316": msg18504, + "16317": msg18505, + "16318": msg18506, + "16319": msg18507, + "1632": select1523, + "16320": msg18508, + "16321": msg18509, + "16322": msg18510, + "16323": msg18511, + "16324": msg18512, + "16325": msg18513, + "16326": msg18514, + "16327": msg18515, + "16328": msg18516, + "16329": msg18517, + "1633": select1524, + "16330": msg18518, + "16331": msg18519, + "16332": msg18520, + "16333": msg18521, + "16334": msg18522, + "16335": msg18523, + "16336": msg18524, + "16337": msg18525, + "16338": msg18526, + "16339": msg18527, + "1634": select1525, + "16340": msg18528, + "16341": msg18529, + "16342": msg18530, + "16343": msg18531, + "16344": msg18532, + "16345": msg18533, + "16346": msg18534, + "16347": msg18535, + "16348": msg18536, + "16349": msg18537, + "1635": select1526, + "16350": msg18538, + "16351": msg18539, + "16352": msg18540, + "16353": msg18541, + "16354": msg18542, + "16355": msg18543, + "16356": msg18544, + "16357": msg18545, + "16358": msg18546, + "16359": msg18547, + "1636": select1527, + "16360": msg18548, + "16361": msg18549, + "16362": msg18550, + "16363": msg18551, + "16364": msg18552, + "16365": msg18553, + "16366": msg18554, + "16367": msg18555, + "16368": msg18556, + "16369": msg18557, + "1637": select1528, + "16370": msg18558, + "16371": msg18559, + "16372": msg18560, + "16373": msg18561, + "16374": msg18562, + "16375": msg18563, + "16376": msg18564, + "16377": msg18565, + "16378": msg18566, + "16379": msg18567, + "1638": select1529, + "16380": msg18568, + "16381": msg18569, + "16382": msg18570, + "16383": msg18571, + "16384": msg18572, + "16385": msg18573, + "16386": msg18574, + "16387": msg18575, + "16388": msg18576, + "16389": msg18577, + "1639": select1530, + "16390": msg18578, + "16391": msg18579, + "16392": msg18580, + "16393": msg18581, + "16394": msg18582, + "16395": msg18583, + "16396": msg18584, + "16397": msg18585, + "16398": msg18586, + "16399": msg18587, + "164": select90, + "1640": select1531, + "16400": msg18588, + "16401": msg18589, + "16402": msg18590, + "16403": msg18591, + "16404": msg18592, + "16405": msg18593, + "16406": msg18594, + "16407": msg18595, + "16408": msg18596, + "16409": msg18597, + "1641": select1532, + "16410": msg18598, + "16411": msg18599, + "16412": msg18600, + "16413": msg18601, + "16414": msg18602, + "16415": msg18603, + "16416": msg18604, + "16417": msg18605, + "16418": msg18606, + "16419": msg18607, + "1642": select1533, + "16420": msg18608, + "16421": msg18609, + "16422": msg18610, + "16423": msg18611, + "16424": msg18612, + "16425": msg18613, + "16426": msg18614, + "16427": msg18615, + "16428": msg18616, + "16429": msg18617, + "1643": select1534, + "16430": msg18618, + "16431": msg18619, + "16432": msg18620, + "16433": msg18621, + "16434": msg18622, + "16435": msg18623, + "16436": msg18624, + "16437": msg18625, + "16438": msg18626, + "16439": msg18627, + "1644": select1535, + "16440": msg18628, + "16441": msg18629, + "16442": msg18630, + "16443": msg18631, + "16444": msg18632, + "16445": msg18633, + "16446": msg18634, + "16447": msg18635, + "16448": msg18636, + "16449": msg18637, + "1645": select1536, + "16450": msg18638, + "16451": msg18639, + "16452": msg18640, + "16453": msg18641, + "16454": msg18642, + "16455": msg18643, + "16456": msg18644, + "16457": msg18645, + "16458": msg18646, + "16459": msg18647, + "1646": select1537, + "16460": msg18648, + "16461": msg18649, + "16462": msg18650, + "16463": msg18651, + "16464": msg18652, + "16465": msg18653, + "16466": msg18654, + "16467": msg18655, + "16468": msg18656, + "16469": msg18657, + "1647": select1538, + "16470": msg18658, + "16471": msg18659, + "16472": msg18660, + "16473": msg18661, + "16474": msg18662, + "16475": msg18663, + "16476": msg18664, + "16477": msg18665, + "16478": msg18666, + "16479": msg18667, + "1648": select1539, + "16480": msg18668, + "16481": msg18669, + "16482": msg18670, + "16483": msg18671, + "16484": msg18672, + "16485": msg18673, + "16486": msg18674, + "16487": msg18675, + "16488": msg18676, + "16489": msg18677, + "1649": select1540, + "16490": msg18678, + "16492": msg18679, + "16493": msg18680, + "16494": msg18681, + "16495": msg18682, + "16496": msg18683, + "16497": msg18684, + "16498": msg18685, + "16499": msg18686, + "165": select91, + "1650": select1541, + "16500": msg18687, + "16501": msg18688, + "16502": msg18689, + "16503": msg18690, + "16504": msg18691, + "16505": msg18692, + "16506": msg18693, + "16507": msg18694, + "16508": msg18695, + "16509": msg18696, + "1651": select1542, + "16510": msg18697, + "16511": msg18698, + "16512": msg18699, + "16513": msg18700, + "16514": msg18701, + "16515": msg18702, + "16516": msg18703, + "16517": msg18704, + "16518": msg18705, + "16519": msg18706, + "1652": select1543, + "16520": msg18707, + "16521": msg18708, + "16522": msg18709, + "16523": msg18710, + "16524": msg18711, + "16525": msg18712, + "16526": msg18713, + "16527": msg18714, + "16528": msg18715, + "16529": msg18716, + "1653": select1544, + "16530": msg18717, + "16531": msg18718, + "16532": msg18719, + "16533": msg18720, + "16534": msg18721, + "16535": msg18722, + "16536": msg18723, + "16537": msg18724, + "16538": msg18725, + "16539": msg18726, + "1654": select1545, + "16540": msg18727, + "16541": msg18728, + "16542": msg18729, + "16543": msg18730, + "16544": msg18731, + "16545": msg18732, + "16546": msg18733, + "16547": msg18734, + "16548": msg18735, + "16549": msg18736, + "1655": select1546, + "16550": msg18737, + "16551": msg18738, + "16552": msg18739, + "16553": msg18740, + "16554": msg18741, + "16555": msg18742, + "16556": msg18743, + "16557": msg18744, + "16558": msg18745, + "16559": msg18746, + "1656": select1547, + "16560": msg18747, + "16561": msg18748, + "16562": msg18749, + "16563": msg18750, + "16564": msg18751, + "16565": msg18752, + "16566": msg18753, + "16567": msg18754, + "16568": msg18755, + "16569": msg18756, + "1657": select1548, + "16570": msg18757, + "16571": msg18758, + "16572": msg18759, + "16573": msg18760, + "16574": msg18761, + "16575": msg18762, + "16576": msg18763, + "16577": msg18764, + "16578": msg18765, + "16579": msg18766, + "1658": select1549, + "16580": msg18767, + "16581": msg18768, + "16582": msg18769, + "16583": msg18770, + "16584": msg18771, + "16585": msg18772, + "16586": msg18773, + "16587": msg18774, + "16588": msg18775, + "16589": msg18776, + "1659": select1550, + "16590": msg18777, + "16591": msg18778, + "16592": msg18779, + "16593": msg18780, + "16594": msg18781, + "16595": msg18782, + "16596": msg18783, + "16597": msg18784, + "16598": msg18785, + "16599": msg18786, + "166": select92, + "1660": select1551, + "16600": msg18787, + "16601": msg18788, + "16602": msg18789, + "16603": msg18790, + "16604": msg18791, + "16605": msg18792, + "16606": msg18793, + "16607": msg18794, + "16608": msg18795, + "16609": msg18796, + "1661": select1552, + "16610": msg18797, + "16611": msg18798, + "16612": msg18799, + "16613": msg18800, + "16614": msg18801, + "16615": msg18802, + "16616": msg18803, + "16617": msg18804, + "16618": msg18805, + "16619": msg18806, + "1662": select1553, + "16620": msg18807, + "16621": msg18808, + "16622": msg18809, + "16623": msg18810, + "16624": msg18811, + "16625": msg18812, + "16626": msg18813, + "16627": msg18814, + "16628": msg18815, + "16629": msg18816, + "1663": select1554, + "16630": msg18817, + "16631": msg18818, + "16632": msg18819, + "16633": msg18820, + "16634": msg18821, + "16635": msg18822, + "16636": msg18823, + "16637": msg18824, + "16638": msg18825, + "16639": msg18826, + "1664": select1555, + "16640": msg18827, + "16641": msg18828, + "16642": msg18829, + "16643": msg18830, + "16644": msg18831, + "16645": msg18832, + "16646": msg18833, + "16647": msg18834, + "16648": msg18835, + "16649": msg18836, + "1665": select1556, + "16650": msg18837, + "16651": msg18838, + "16652": msg18839, + "16653": msg18840, + "16654": msg18841, + "16655": msg18842, + "16656": msg18843, + "16657": msg18844, + "16658": msg18845, + "16659": msg18846, + "1666": select1557, + "16660": msg18847, + "16661": msg18848, + "16662": msg18849, + "16663": msg18850, + "16664": msg18851, + "16665": msg18852, + "16666": msg18853, + "16667": msg18854, + "16668": msg18855, + "16669": msg18856, + "1667": select1558, + "16670": msg18857, + "16671": msg18858, + "16672": msg18859, + "16673": msg18860, + "16674": msg18861, + "16675": msg18862, + "16676": msg18863, + "16677": msg18864, + "16678": msg18865, + "16679": msg18866, + "1668": select1559, + "16680": msg18867, + "16681": msg18868, + "16682": msg18869, + "16683": msg18870, + "16684": msg18871, + "16685": msg18872, + "16686": msg18873, + "16687": msg18874, + "16688": msg18875, + "16689": msg18876, + "1669": select1560, + "16690": msg18877, + "16691": msg18878, + "16692": msg18879, + "16693": msg18880, + "16694": msg18881, + "16695": msg18882, + "16696": msg18883, + "16697": msg18884, + "16698": msg18885, + "16699": msg18886, + "167": select93, + "1670": select1561, + "16700": msg18887, + "16701": msg18888, + "16702": msg18889, + "16703": msg18890, + "16704": msg18891, + "16705": msg18892, + "16706": msg18893, + "16707": msg18894, + "16708": msg18895, + "16709": msg18896, + "1671": select1562, + "16710": msg18897, + "16711": msg18898, + "16712": msg18899, + "16713": msg18900, + "16714": msg18901, + "16715": msg18902, + "16716": msg18903, + "16717": msg18904, + "16718": msg18905, + "16719": msg18906, + "1672": select1563, + "16720": msg18907, + "16721": msg18908, + "16722": msg18909, + "16723": msg18910, + "16724": msg18911, + "16725": msg18912, + "16726": msg18913, + "16727": msg18914, + "16728": msg18915, + "16729": msg18916, + "1673": select1564, + "16730": msg18917, + "16731": msg18918, + "16732": msg18919, + "16733": msg18920, + "16734": msg18921, + "16735": msg18922, + "16736": msg18923, + "16737": msg18924, + "16738": msg18925, + "16739": msg18926, + "1674": select1565, + "16740": msg18927, + "16741": msg18928, + "16742": msg18929, + "16743": msg18930, + "16744": msg18931, + "16745": msg18932, + "16746": msg18933, + "16747": msg18934, + "16748": msg18935, + "16749": msg18936, + "1675": select1566, + "16750": msg18937, + "16751": msg18938, + "16752": msg18939, + "16753": msg18940, + "16754": msg18941, + "16755": msg18942, + "16756": msg18943, + "16757": msg18944, + "16758": msg18945, + "16759": msg18946, + "1676": select1567, + "16760": msg18947, + "16761": msg18948, + "16762": msg18949, + "16763": msg18950, + "16764": msg18951, + "16765": msg18952, + "16766": msg18953, + "16767": msg18954, + "16768": msg18955, + "16769": msg18956, + "1677": select1568, + "16770": msg18957, + "16771": msg18958, + "16772": msg18959, + "16773": msg18960, + "16774": msg18961, + "16775": msg18962, + "16776": msg18963, + "16777": msg18964, + "16778": msg18965, + "16779": msg18966, + "1678": select1569, + "16780": msg18967, + "16781": msg18968, + "16782": msg18969, + "16783": msg18970, + "16784": msg18971, + "16785": msg18972, + "16786": msg18973, + "16787": msg18974, + "16788": msg18975, + "16789": msg18976, + "1679": select1570, + "16790": msg18977, + "16791": msg18978, + "16792": msg18979, + "16793": msg18980, + "16794": msg18981, + "16795": msg18982, + "16796": msg18983, + "16797": msg18984, + "16798": msg18985, + "16799": msg18986, + "168": select94, + "1680": select1571, + "16800": msg18987, + "16801": msg18988, + "16802": msg18989, + "16803": msg18990, + "16804": msg18991, + "16805": msg18992, + "16806": msg18993, + "16807": msg18994, + "16808": msg18995, + "16809": msg18996, + "1681": select1572, + "16810": msg18997, + "16811": msg18998, + "16812": msg18999, + "16813": msg19000, + "16814": msg19001, + "16815": msg19002, + "16816": msg19003, + "16817": msg19004, + "16818": msg19005, + "16819": msg19006, + "1682": select1573, + "16820": msg19007, + "16821": msg19008, + "16822": msg19009, + "16823": msg19010, + "16824": msg19011, + "16825": msg19012, + "16826": msg19013, + "16827": msg19014, + "16828": msg19015, + "16829": msg19016, + "1683": select1574, + "16830": msg19017, + "16831": msg19018, + "16832": msg19019, + "16833": msg19020, + "16834": msg19021, + "16835": msg19022, + "16836": msg19023, + "16837": msg19024, + "16838": msg19025, + "16839": msg19026, + "1684": select1575, + "16840": msg19027, + "16841": msg19028, + "16842": msg19029, + "16843": msg19030, + "16844": msg19031, + "16845": msg19032, + "16846": msg19033, + "16847": msg19034, + "16848": msg19035, + "16849": msg19036, + "1685": select1576, + "16850": msg19037, + "16851": msg19038, + "16852": msg19039, + "16853": msg19040, + "16854": msg19041, + "16855": msg19042, + "16856": msg19043, + "16857": msg19044, + "16858": msg19045, + "16859": msg19046, + "1686": select1577, + "16860": msg19047, + "16861": msg19048, + "16862": msg19049, + "16863": msg19050, + "16864": msg19051, + "16865": msg19052, + "16866": msg19053, + "16867": msg19054, + "16868": msg19055, + "16869": msg19056, + "1687": select1578, + "16870": msg19057, + "16871": msg19058, + "16872": msg19059, + "16873": msg19060, + "16874": msg19061, + "16875": msg19062, + "16876": msg19063, + "16877": msg19064, + "16878": msg19065, + "16879": msg19066, + "1688": select1579, + "16880": msg19067, + "16881": msg19068, + "16882": msg19069, + "16883": msg19070, + "16884": msg19071, + "16885": msg19072, + "16886": msg19073, + "16887": msg19074, + "16888": msg19075, + "16889": msg19076, + "1689": select1580, + "16890": msg19077, + "16891": msg19078, + "16892": msg19079, + "16893": msg19080, + "16894": msg19081, + "16895": msg19082, + "16896": msg19083, + "16897": msg19084, + "16898": msg19085, + "16899": msg19086, + "169": select95, + "1690": select1581, + "16900": msg19087, + "16901": msg19088, + "16902": msg19089, + "16903": msg19090, + "16904": msg19091, + "16905": msg19092, + "16906": msg19093, + "16907": msg19094, + "16908": msg19095, + "16909": msg19096, + "1691": select1582, + "16910": msg19097, + "16911": msg19098, + "16912": msg19099, + "16913": msg19100, + "16914": msg19101, + "16915": msg19102, + "16916": msg19103, + "16917": msg19104, + "16918": msg19105, + "16919": msg19106, + "1692": select1583, + "16920": msg19107, + "16921": msg19108, + "16922": msg19109, + "16923": msg19110, + "16924": msg19111, + "16925": msg19112, + "16926": msg19113, + "16927": msg19114, + "16928": msg19115, + "16929": msg19116, + "1693": select1584, + "16930": msg19117, + "16931": msg19118, + "16932": msg19119, + "16933": msg19120, + "16934": msg19121, + "16935": msg19122, + "16936": msg19123, + "16937": msg19124, + "16938": msg19125, + "16939": msg19126, + "1694": select1585, + "16940": msg19127, + "16941": msg19128, + "16942": msg19129, + "16943": msg19130, + "16944": msg19131, + "16945": msg19132, + "16946": msg19133, + "16947": msg19134, + "16948": msg19135, + "16949": msg19136, + "1695": select1586, + "16950": msg19137, + "16951": msg19138, + "16952": msg19139, + "16953": msg19140, + "16954": msg19141, + "16955": msg19142, + "16956": msg19143, + "16957": msg19144, + "16958": msg19145, + "16959": msg19146, + "1696": select1587, + "16960": msg19147, + "16961": msg19148, + "16962": msg19149, + "16963": msg19150, + "16964": msg19151, + "16965": msg19152, + "16966": msg19153, + "16967": msg19154, + "16968": msg19155, + "16969": msg19156, + "1697": select1588, + "16970": msg19157, + "16971": msg19158, + "16972": msg19159, + "16973": msg19160, + "16974": msg19161, + "16975": msg19162, + "16976": msg19163, + "16977": msg19164, + "16978": msg19165, + "16979": msg19166, + "1698": select1589, + "16980": msg19167, + "16981": msg19168, + "16982": msg19169, + "16983": msg19170, + "16984": msg19171, + "16985": msg19172, + "16986": msg19173, + "16987": msg19174, + "16988": msg19175, + "16989": msg19176, + "1699": select1590, + "16990": msg19177, + "16991": msg19178, + "16992": msg19179, + "16993": msg19180, + "16994": msg19181, + "16995": msg19182, + "16996": msg19183, + "16997": msg19184, + "16998": msg19185, + "16999": msg19186, + "17": select18, + "170": select96, + "1700": select1591, + "17000": msg19187, + "17001": msg19188, + "17002": msg19189, + "17003": msg19190, + "17004": msg19191, + "17005": msg19192, + "17006": msg19193, + "17007": msg19194, + "17008": msg19195, + "17009": msg19196, + "1701": select1592, + "17010": msg19197, + "17011": msg19198, + "17012": msg19199, + "17013": msg19200, + "17014": msg19201, + "17015": msg19202, + "17016": msg19203, + "17017": msg19204, + "17018": msg19205, + "17019": msg19206, + "1702": select1593, + "17020": msg19207, + "17021": msg19208, + "17022": msg19209, + "17023": msg19210, + "17024": msg19211, + "17025": msg19212, + "17026": msg19213, + "17027": msg19214, + "17028": msg19215, + "17029": msg19216, + "1703": select1594, + "17030": msg19217, + "17031": msg19218, + "17032": msg19219, + "17033": msg19220, + "17034": msg19221, + "17035": msg19222, + "17036": msg19223, + "17037": msg19224, + "17038": msg19225, + "17039": msg19226, + "1704": select1595, + "17041": msg19227, + "17042": msg19228, + "17043": msg19229, + "17044": msg19230, + "17045": msg19231, + "17046": msg19232, + "17047": msg19233, + "17048": msg19234, + "17049": msg19235, + "1705": select1596, + "17050": msg19236, + "17051": msg19237, + "17052": msg19238, + "17053": msg19239, + "17054": msg19240, + "17055": msg19241, + "17056": msg19242, + "17057": msg19243, + "17058": msg19244, + "17059": msg19245, + "1706": select1597, + "17060": msg19246, + "17061": msg19247, + "17062": msg19248, + "17063": msg19249, + "17064": msg19250, + "17065": msg19251, + "17066": msg19252, + "17067": msg19253, + "17068": msg19254, + "17069": msg19255, + "1707": select1598, + "17070": msg19256, + "17071": msg19257, + "17072": msg19258, + "17073": msg19259, + "17074": msg19260, + "17075": msg19261, + "17076": msg19262, + "17077": msg19263, + "17078": msg19264, + "17079": msg19265, + "1708": select1599, + "17080": msg19266, + "17081": msg19267, + "17082": msg19268, + "17083": msg19269, + "17084": msg19270, + "17085": msg19271, + "17086": msg19272, + "17087": msg19273, + "17088": msg19274, + "17089": msg19275, + "1709": select1600, + "17090": msg19276, + "17091": msg19277, + "17092": msg19278, + "17093": msg19279, + "17094": msg19280, + "17095": msg19281, + "17096": msg19282, + "17097": msg19283, + "17098": msg19284, + "17099": msg19285, + "171": select97, + "1710": select1601, + "17100": msg19286, + "17101": msg19287, + "17102": msg19288, + "17103": msg19289, + "17104": msg19290, + "17105": msg19291, + "17106": msg19292, + "17107": msg19293, + "17108": msg19294, + "17109": msg19295, + "1711": select1602, + "17110": msg19296, + "17111": msg19297, + "17112": msg19298, + "17113": msg19299, + "17114": msg19300, + "17115": msg19301, + "17116": msg19302, + "17117": msg19303, + "17118": msg19304, + "17119": msg19305, + "1712": select1603, + "17120": msg19306, + "17121": msg19307, + "17122": msg19308, + "17123": msg19309, + "17124": msg19310, + "17125": msg19311, + "17126": msg19312, + "17127": msg19313, + "17128": msg19314, + "17129": msg19315, + "1713": select1604, + "17130": msg19316, + "17131": msg19317, + "17132": msg19318, + "17133": msg19319, + "17134": msg19320, + "17135": msg19321, + "17136": msg19322, + "17137": msg19323, + "17138": msg19324, + "17139": msg19325, + "1714": select1605, + "17140": msg19326, + "17141": msg19327, + "17142": msg19328, + "17143": msg19329, + "17144": msg19330, + "17145": msg19331, + "17146": msg19332, + "17147": msg19333, + "17148": msg19334, + "17149": msg19335, + "1715": select1606, + "17150": msg19336, + "17151": msg19337, + "17152": msg19338, + "17153": msg19339, + "17154": msg19340, + "17155": msg19341, + "17156": msg19342, + "17157": msg19343, + "17158": msg19344, + "17159": msg19345, + "1716": select1607, + "17160": msg19346, + "17161": msg19347, + "17162": msg19348, + "17163": msg19349, + "17164": msg19350, + "17165": msg19351, + "17166": msg19352, + "17167": msg19353, + "17168": msg19354, + "17169": msg19355, + "1717": select1608, + "17170": msg19356, + "17171": msg19357, + "17172": msg19358, + "17173": msg19359, + "17174": msg19360, + "17175": msg19361, + "17176": msg19362, + "17177": msg19363, + "17178": msg19364, + "17179": msg19365, + "1718": select1609, + "17180": msg19366, + "17181": msg19367, + "17182": msg19368, + "17183": msg19369, + "17184": msg19370, + "17185": msg19371, + "17186": msg19372, + "17187": msg19373, + "17188": msg19374, + "17189": msg19375, + "1719": select1610, + "17190": msg19376, + "17191": msg19377, + "17192": msg19378, + "17193": msg19379, + "17194": msg19380, + "17195": msg19381, + "17196": msg19382, + "17197": msg19383, + "17198": msg19384, + "17199": msg19385, + "172": select98, + "1720": select1611, + "17200": msg19386, + "17201": msg19387, + "17202": msg19388, + "17203": msg19389, + "17204": msg19390, + "17205": msg19391, + "17206": msg19392, + "17207": msg19393, + "17208": msg19394, + "17209": msg19395, + "1721": select1612, + "17210": msg19396, + "17211": msg19397, + "17212": msg19398, + "17213": msg19399, + "17214": msg19400, + "17215": msg19401, + "17216": msg19402, + "17217": msg19403, + "17218": msg19404, + "17219": msg19405, + "1722": select1613, + "17220": msg19406, + "17221": msg19407, + "17222": msg19408, + "17223": msg19409, + "17224": msg19410, + "17225": msg19411, + "17226": msg19412, + "17227": msg19413, + "17228": msg19414, + "17229": msg19415, + "1723": select1614, + "17230": msg19416, + "17231": msg19417, + "17232": msg19418, + "17233": msg19419, + "17234": msg19420, + "17235": msg19421, + "17236": msg19422, + "17237": msg19423, + "17238": msg19424, + "17239": msg19425, + "1724": select1615, + "17240": msg19426, + "17241": msg19427, + "17242": msg19428, + "17243": msg19429, + "17244": msg19430, + "17245": msg19431, + "17246": msg19432, + "17247": msg19433, + "17248": msg19434, + "17249": msg19435, + "1725": select1616, + "17250": msg19436, + "17251": msg19437, + "17252": msg19438, + "17253": msg19439, + "17254": msg19440, + "17255": msg19441, + "17256": msg19442, + "17257": msg19443, + "17258": msg19444, + "17259": msg19445, + "1726": select1617, + "17260": msg19446, + "17261": msg19447, + "17262": msg19448, + "17263": msg19449, + "17264": msg19450, + "17265": msg19451, + "17266": msg19452, + "17267": msg19453, + "17268": msg19454, + "17269": msg19455, + "1727": select1618, + "17270": msg19456, + "17271": msg19457, + "17272": msg19458, + "17273": msg19459, + "17274": msg19460, + "17275": msg19461, + "17276": msg19462, + "17277": msg19463, + "17278": msg19464, + "17279": msg19465, + "1728": select1619, + "17280": msg19466, + "17281": msg19467, + "17282": msg19468, + "17283": msg19469, + "17284": msg19470, + "17285": msg19471, + "17286": msg19472, + "17287": msg19473, + "17288": msg19474, + "17289": msg19475, + "1729": select1620, + "17290": msg19476, + "17291": msg19477, + "17292": msg19478, + "17293": msg19479, + "17294": msg19480, + "17295": msg19481, + "17296": msg19482, + "17297": msg19483, + "17298": msg19484, + "17299": msg19485, + "173": select99, + "1730": select1621, + "17300": msg19486, + "17301": msg19487, + "17302": msg19488, + "17303": msg19489, + "17304": msg19490, + "17305": msg19491, + "17306": msg19492, + "17307": msg19493, + "17308": msg19494, + "17309": msg19495, + "1731": select1622, + "17310": msg19496, + "17311": msg19497, + "17312": msg19498, + "17313": msg19499, + "17314": msg19500, + "17315": msg19501, + "17316": msg19502, + "17317": msg19503, + "17318": msg19504, + "17319": msg19505, + "1732": select1623, + "17320": msg19506, + "17321": msg19507, + "17322": msg19508, + "17323": msg19509, + "17324": msg19510, + "17325": msg19511, + "17326": msg19512, + "17327": msg19513, + "17328": msg19514, + "17329": msg19515, + "1733": select1624, + "17330": msg19516, + "17331": msg19517, + "17332": msg19518, + "17333": msg19519, + "17334": msg19520, + "17335": msg19521, + "17336": msg19522, + "17337": msg19523, + "17338": msg19524, + "17339": msg19525, + "1734": select1625, + "17340": msg19526, + "17341": msg19527, + "17342": msg19528, + "17343": msg19529, + "17344": msg19530, + "17345": msg19531, + "17346": msg19532, + "17347": msg19533, + "17348": msg19534, + "17349": msg19535, + "1735": select1626, + "17350": msg19536, + "17351": msg19537, + "17352": msg19538, + "17353": msg19539, + "17354": msg19540, + "17355": msg19541, + "17356": msg19542, + "17357": msg19543, + "17358": msg19544, + "17359": msg19545, + "1736": select1627, + "17360": msg19546, + "17361": msg19547, + "17362": msg19548, + "17363": msg19549, + "17364": msg19550, + "17365": msg19551, + "17366": msg19552, + "17367": msg19553, + "17368": msg19554, + "17369": msg19555, + "1737": select1628, + "17370": msg19556, + "17371": msg19557, + "17372": msg19558, + "17373": msg19559, + "17374": msg19560, + "17375": msg19561, + "17376": msg19562, + "17377": msg19563, + "17378": msg19564, + "17379": msg19565, + "1738": select1629, + "17380": msg19566, + "17381": msg19567, + "17382": msg19568, + "17383": msg19569, + "17384": msg19570, + "17385": msg19571, + "17386": msg19572, + "17387": msg19573, + "17388": msg19574, + "17389": msg19575, + "1739": select1630, + "17390": msg19576, + "17391": msg19577, + "17392": msg19578, + "17393": msg19579, + "17394": msg19580, + "17395": msg19581, + "17396": msg19582, + "17397": msg19583, + "17398": msg19584, + "17399": msg19585, + "174": select100, + "1740": select1631, + "17400": msg19586, + "17401": msg19587, + "17402": msg19588, + "17403": msg19589, + "17404": msg19590, + "17405": msg19591, + "17406": msg19592, + "17407": msg19593, + "17408": msg19594, + "17409": msg19595, + "1741": select1632, + "17410": msg19596, + "17411": msg19597, + "17412": msg19598, + "17413": msg19599, + "17414": msg19600, + "17415": msg19601, + "17416": msg19602, + "17417": msg19603, + "17418": msg19604, + "17419": msg19605, + "1742": select1633, + "17420": msg19606, + "17421": msg19607, + "17422": msg19608, + "17423": msg19609, + "17424": msg19610, + "17425": msg19611, + "17426": msg19612, + "17427": msg19613, + "17428": msg19614, + "17429": msg19615, + "1743": select1634, + "17430": msg19616, + "17431": msg19617, + "17432": msg19618, + "17433": msg19619, + "17434": msg19620, + "17435": msg19621, + "17436": msg19622, + "17437": msg19623, + "17438": msg19624, + "17439": msg19625, + "1744": select1635, + "17440": msg19626, + "17441": msg19627, + "17442": msg19628, + "17443": msg19629, + "17444": msg19630, + "17445": msg19631, + "17446": msg19632, + "17447": msg19633, + "17448": msg19634, + "17449": msg19635, + "1745": select1636, + "17450": msg19636, + "17451": msg19637, + "17452": msg19638, + "17453": msg19639, + "17454": msg19640, + "17455": msg19641, + "17456": msg19642, + "17457": msg19643, + "17458": msg19644, + "17459": msg19645, + "1746": select1637, + "17460": msg19646, + "17461": msg19647, + "17462": msg19648, + "17463": msg19649, + "17464": msg19650, + "17465": msg19651, + "17466": msg19652, + "17467": msg19653, + "17468": msg19654, + "17469": msg19655, + "1747": select1638, + "17470": msg19656, + "17471": msg19657, + "17472": msg19658, + "17473": msg19659, + "17474": msg19660, + "17475": msg19661, + "17476": msg19662, + "17477": msg19663, + "17478": msg19664, + "17479": msg19665, + "1748": select1639, + "17480": msg19666, + "17481": msg19667, + "17482": msg19668, + "17483": msg19669, + "17484": msg19670, + "17485": msg19671, + "17486": msg19672, + "17487": msg19673, + "17488": msg19674, + "17489": msg19675, + "1749": select1640, + "17490": msg19676, + "17491": msg19677, + "17492": msg19678, + "17493": msg19679, + "17494": msg19680, + "17495": msg19681, + "17496": msg19682, + "17497": msg19683, + "17498": msg19684, + "17499": msg19685, + "175": select101, + "1750": select1641, + "17500": msg19686, + "17501": msg19687, + "17502": msg19688, + "17503": msg19689, + "17504": msg19690, + "17505": msg19691, + "17506": msg19692, + "17507": msg19693, + "17508": msg19694, + "17509": msg19695, + "1751": select1642, + "17510": msg19696, + "17511": msg19697, + "17512": msg19698, + "17513": msg19699, + "17514": msg19700, + "17515": msg19701, + "17516": msg19702, + "17517": msg19703, + "17518": msg19704, + "17519": msg19705, + "1752": select1643, + "17520": msg19706, + "17521": msg19707, + "17522": msg19708, + "17523": msg19709, + "17524": msg19710, + "17525": msg19711, + "17526": msg19712, + "17527": msg19713, + "17528": msg19714, + "17529": msg19715, + "1753": select1644, + "17530": msg19716, + "17531": msg19717, + "17532": msg19718, + "17533": msg19719, + "17534": msg19720, + "17535": msg19721, + "17536": msg19722, + "17537": msg19723, + "17538": msg19724, + "17539": msg19725, + "1754": select1645, + "17540": msg19726, + "17541": msg19727, + "17542": msg19728, + "17543": msg19729, + "17544": msg19730, + "17545": msg19731, + "17546": msg19732, + "17547": msg19733, + "17548": msg19734, + "17549": msg19735, + "1755": select1646, + "17550": msg19736, + "17551": msg19737, + "17552": msg19738, + "17553": msg19739, + "17554": msg19740, + "17555": msg19741, + "17556": msg19742, + "17557": msg19743, + "17558": msg19744, + "17559": msg19745, + "1756": select1647, + "17560": msg19746, + "17561": msg19747, + "17562": msg19748, + "17563": msg19749, + "17564": msg19750, + "17565": msg19751, + "17566": msg19752, + "17567": msg19753, + "17568": msg19754, + "17569": msg19755, + "1757": select1648, + "17570": msg19756, + "17571": msg19757, + "17572": msg19758, + "17573": msg19759, + "17574": msg19760, + "17575": msg19761, + "17576": msg19762, + "17577": msg19763, + "17578": msg19764, + "17579": msg19765, + "1758": select1649, + "17580": msg19766, + "17581": msg19767, + "17582": msg19768, + "17583": msg19769, + "17584": msg19770, + "17585": msg19771, + "17586": msg19772, + "17587": msg19773, + "17588": msg19774, + "17589": msg19775, + "1759": select1650, + "17590": msg19776, + "17591": msg19777, + "17592": msg19778, + "17593": msg19779, + "17594": msg19780, + "17595": msg19781, + "17596": msg19782, + "17597": msg19783, + "17598": msg19784, + "17599": msg19785, + "176": select102, + "1760": select1651, + "17600": msg19786, + "17601": msg19787, + "17602": msg19788, + "17603": msg19789, + "17604": msg19790, + "17605": msg19791, + "17606": msg19792, + "17607": msg19793, + "17608": msg19794, + "17609": msg19795, + "1761": select1652, + "17610": msg19796, + "17611": msg19797, + "17612": msg19798, + "17613": msg19799, + "17614": msg19800, + "17616": msg19801, + "17618": msg19802, + "17619": msg19803, + "1762": select1653, + "17620": msg19804, + "17621": msg19805, + "17622": msg19806, + "17623": msg19807, + "17624": msg19808, + "17625": msg19809, + "17626": msg19810, + "17628": msg19811, + "17629": msg19812, + "1763": select1654, + "17630": msg19813, + "17631": msg19814, + "17632": msg19815, + "17633": msg19816, + "17634": msg19817, + "17635": msg19818, + "17636": msg19819, + "17637": msg19820, + "17638": msg19821, + "17639": msg19822, + "1764": select1655, + "17640": msg19823, + "17641": msg19824, + "17642": msg19825, + "17643": msg19826, + "17644": msg19827, + "17645": msg19828, + "17646": msg19829, + "17647": msg19830, + "17648": msg19831, + "17649": msg19832, + "1765": select1656, + "17650": msg19833, + "17651": msg19834, + "17652": msg19835, + "17653": msg19836, + "17654": msg19837, + "17655": msg19838, + "17656": msg19839, + "17657": msg19840, + "17658": msg19841, + "17659": msg19842, + "1766": select1657, + "17660": msg19843, + "17661": msg19844, + "17662": msg19845, + "17663": msg19846, + "17664": msg19847, + "17665": msg19848, + "17666": msg19849, + "17667": msg19850, + "17668": msg19851, + "17669": msg19852, + "1767": select1658, + "17670": msg19853, + "17671": msg19854, + "17672": msg19855, + "17673": msg19856, + "17674": msg19857, + "17675": msg19858, + "17676": msg19859, + "17677": msg19860, + "17678": msg19861, + "17679": msg19862, + "1768": select1659, + "17680": msg19863, + "17685": msg19864, + "17686": msg19865, + "17687": msg19866, + "17688": msg19867, + "17689": msg19868, + "1769": select1660, + "17690": msg19869, + "17691": msg19870, + "17692": msg19871, + "17693": msg19872, + "17694": msg19873, + "17695": msg19874, + "17696": msg19875, + "17697": msg19876, + "17698": msg19877, + "17699": msg19878, + "177": select103, + "1770": select1661, + "17700": msg19879, + "17701": msg19880, + "17702": msg19881, + "17703": msg19882, + "17704": msg19883, + "17705": msg19884, + "17706": msg19885, + "17707": msg19886, + "17708": msg19887, + "17709": msg19888, + "1771": select1662, + "17710": msg19889, + "17711": msg19890, + "17712": msg19891, + "17713": msg19892, + "17714": msg19893, + "17715": msg19894, + "17716": msg19895, + "17717": msg19896, + "17718": msg19897, + "17719": msg19898, + "1772": select1663, + "17720": msg19899, + "17721": msg19900, + "17722": msg19901, + "17723": msg19902, + "17724": msg19903, + "17725": msg19904, + "17726": msg19905, + "17727": msg19906, + "17728": msg19907, + "17729": msg19908, + "1773": select1664, + "17730": msg19909, + "17731": msg19910, + "17732": msg19911, + "17733": msg19912, + "17734": msg19913, + "17735": msg19914, + "17736": msg19915, + "17737": msg19916, + "17738": msg19917, + "17739": msg19918, + "1774": select1665, + "17740": msg19919, + "17741": msg19920, + "17742": msg19921, + "17743": msg19922, + "17745": msg19923, + "17746": msg19924, + "17747": msg19925, + "17748": msg19926, + "17749": msg19927, + "1775": select1666, + "17750": msg19928, + "17751": msg19929, + "17752": msg19930, + "17753": msg19931, + "17754": msg19932, + "17755": msg19933, + "17756": msg19934, + "17757": msg19935, + "17758": msg19936, + "17759": msg19937, + "1776": select1667, + "17760": msg19938, + "17762": msg19939, + "17763": msg19940, + "17764": msg19941, + "17765": msg19942, + "17766": msg19943, + "17767": msg19944, + "17768": msg19945, + "17769": msg19946, + "1777": select1668, + "17770": msg19947, + "17771": msg19948, + "17772": msg19949, + "17773": msg19950, + "17774": msg19951, + "17775": msg19952, + "17776": msg19953, + "17777": msg19954, + "17778": msg19955, + "17779": msg19956, + "1778": select1669, + "17780": msg19957, + "17781": msg19958, + "17782": msg19959, + "17783": msg19960, + "17784": msg19961, + "17785": msg19962, + "17786": msg19963, + "17787": msg19964, + "17788": msg19965, + "17789": msg19966, + "1779": select1670, + "17790": msg19967, + "17791": msg19968, + "17792": msg19969, + "17793": msg19970, + "17794": msg19971, + "17795": msg19972, + "17796": msg19973, + "17797": msg19974, + "17798": msg19975, + "17799": msg19976, + "1780": select1671, + "17800": msg19977, + "17801": msg19978, + "17802": msg19979, + "17803": msg19980, + "17804": msg19981, + "17805": msg19982, + "17806": msg19983, + "17807": msg19984, + "17808": msg19985, + "17809": msg19986, + "1781": select1672, + "17810": msg19987, + "17811": msg19988, + "17812": msg19989, + "17813": msg19990, + "17814": msg19991, + "17815": msg19992, + "17816": msg19993, + "17817": msg19994, + "17818": msg19995, + "17819": msg19996, + "1782": select1673, + "17820": msg19997, + "17821": msg19998, + "17822": msg19999, + "17823": msg20000, + "17824": msg20001, + "17825": msg20002, + "17826": msg20003, + "17827": msg20004, + "17828": msg20005, + "17829": msg20006, + "1783": select1674, + "17830": msg20007, + "17831": msg20008, + "17832": msg20009, + "17833": msg20010, + "17834": msg20011, + "17835": msg20012, + "17836": msg20013, + "17837": msg20014, + "17838": msg20015, + "17839": msg20016, + "1784": select1675, + "17840": msg20017, + "17841": msg20018, + "17842": msg20019, + "17843": msg20020, + "17844": msg20021, + "17845": msg20022, + "17846": msg20023, + "17847": msg20024, + "17848": msg20025, + "17849": msg20026, + "1785": select1676, + "17850": msg20027, + "17851": msg20028, + "17852": msg20029, + "17853": msg20030, + "17854": msg20031, + "17855": msg20032, + "17856": msg20033, + "17857": msg20034, + "17858": msg20035, + "17859": msg20036, + "1786": select1677, + "17860": msg20037, + "17861": msg20038, + "17862": msg20039, + "17863": msg20040, + "17864": msg20041, + "17865": msg20042, + "17866": msg20043, + "17867": msg20044, + "17868": msg20045, + "17869": msg20046, + "1787": select1678, + "17870": msg20047, + "17871": msg20048, + "17872": msg20049, + "17873": msg20050, + "17874": msg20051, + "17875": msg20052, + "17876": msg20053, + "17877": msg20054, + "17878": msg20055, + "17879": msg20056, + "1788": select1679, + "17880": msg20057, + "17881": msg20058, + "17882": msg20059, + "17883": msg20060, + "17884": msg20061, + "17885": msg20062, + "17886": msg20063, + "17887": msg20064, + "17888": msg20065, + "17889": msg20066, + "1789": select1680, + "17890": msg20067, + "17891": msg20068, + "17892": msg20069, + "17893": msg20070, + "17894": msg20071, + "17895": msg20072, + "17896": msg20073, + "17897": msg20074, + "17898": msg20075, + "17899": msg20076, + "179": select104, + "1790": select1681, + "17900": msg20077, + "17901": msg20078, + "17902": msg20079, + "17903": msg20080, + "17904": msg20081, + "17905": msg20082, + "17906": msg20083, + "17907": msg20084, + "17908": msg20085, + "17909": msg20086, + "1791": select1682, + "17910": msg20087, + "17911": msg20088, + "17912": msg20089, + "17913": msg20090, + "17914": msg20091, + "17915": msg20092, + "17916": msg20093, + "17917": msg20094, + "17918": msg20095, + "17919": msg20096, + "1792": select1683, + "17920": msg20097, + "17921": msg20098, + "17922": msg20099, + "17923": msg20100, + "17924": msg20101, + "17925": msg20102, + "17926": msg20103, + "17927": msg20104, + "17928": msg20105, + "17929": msg20106, + "1793": select1684, + "17930": msg20107, + "17931": msg20108, + "17932": msg20109, + "17933": msg20110, + "17934": msg20111, + "17935": msg20112, + "17936": msg20113, + "17937": msg20114, + "17938": msg20115, + "17939": msg20116, + "1794": select1685, + "17940": msg20117, + "17941": msg20118, + "17942": msg20119, + "17943": msg20120, + "17944": msg20121, + "17945": msg20122, + "17946": msg20123, + "17947": msg20124, + "17948": msg20125, + "17949": msg20126, + "1795": select1686, + "17950": msg20127, + "17951": msg20128, + "17952": msg20129, + "17953": msg20130, + "17954": msg20131, + "17955": msg20132, + "17956": msg20133, + "17957": msg20134, + "17958": msg20135, + "17959": msg20136, + "1796": select1687, + "17960": msg20137, + "17961": msg20138, + "17962": msg20139, + "17963": msg20140, + "17964": msg20141, + "17965": msg20142, + "17966": msg20143, + "17967": msg20144, + "17968": msg20145, + "17969": msg20146, + "1797": select1688, + "17970": msg20147, + "17971": msg20148, + "17972": msg20149, + "17973": msg20150, + "17974": msg20151, + "17975": msg20152, + "17976": msg20153, + "17977": msg20154, + "17978": msg20155, + "17979": msg20156, + "1798": select1689, + "17980": msg20157, + "17981": msg20158, + "17982": msg20159, + "17983": msg20160, + "17984": msg20161, + "17985": msg20162, + "17986": msg20163, + "17987": msg20164, + "17988": msg20165, + "17989": msg20166, + "1799": select1690, + "17990": msg20167, + "17991": msg20168, + "17992": msg20169, + "17993": msg20170, + "17994": msg20171, + "17995": msg20172, + "17996": msg20173, + "17997": msg20174, + "17998": msg20175, + "17999": msg20176, + "18": select19, + "180": select105, + "1800": select1691, + "18000": msg20177, + "18001": msg20178, + "18002": msg20179, + "18003": msg20180, + "18004": msg20181, + "18005": msg20182, + "18006": msg20183, + "18007": msg20184, + "18008": msg20185, + "18009": msg20186, + "1801": select1692, + "18010": msg20187, + "18011": msg20188, + "18012": msg20189, + "18013": msg20190, + "18014": msg20191, + "18015": msg20192, + "18016": msg20193, + "18017": msg20194, + "18018": msg20195, + "18019": msg20196, + "1802": select1693, + "18020": msg20197, + "18021": msg20198, + "18022": msg20199, + "18023": msg20200, + "18024": msg20201, + "18025": msg20202, + "18026": msg20203, + "18027": msg20204, + "18028": msg20205, + "18029": msg20206, + "1803": select1694, + "18030": msg20207, + "18031": msg20208, + "18032": msg20209, + "18033": msg20210, + "18034": msg20211, + "18035": msg20212, + "18036": msg20213, + "18037": msg20214, + "18038": msg20215, + "18039": msg20216, + "1804": select1695, + "18040": msg20217, + "18041": msg20218, + "18042": msg20219, + "18043": msg20220, + "18044": msg20221, + "18045": msg20222, + "18046": msg20223, + "18047": msg20224, + "18048": msg20225, + "18049": msg20226, + "1805": select1696, + "18050": msg20227, + "18051": msg20228, + "18052": msg20229, + "18053": msg20230, + "18054": msg20231, + "18055": msg20232, + "18056": msg20233, + "18057": msg20234, + "18058": msg20235, + "18059": msg20236, + "1806": select1697, + "18060": msg20237, + "18061": msg20238, + "18062": msg20239, + "18063": msg20240, + "18064": msg20241, + "18065": msg20242, + "18066": msg20243, + "18067": msg20244, + "18068": msg20245, + "18069": msg20246, + "1807": select1698, + "18070": msg20247, + "18071": msg20248, + "18072": msg20249, + "18073": msg20250, + "18074": msg20251, + "18076": msg20252, + "18077": msg20253, + "18078": msg20254, + "18079": msg20255, + "1808": select1699, + "18080": msg20256, + "18081": msg20257, + "18082": msg20258, + "18083": msg20259, + "18084": msg20260, + "18085": msg20261, + "18086": msg20262, + "18087": msg20263, + "18088": msg20264, + "18089": msg20265, + "1809": select1700, + "18090": msg20266, + "18091": msg20267, + "18092": msg20268, + "18093": msg20269, + "18094": msg20270, + "18095": msg20271, + "18096": msg20272, + "18097": msg20273, + "18098": msg20274, + "18099": msg20275, + "181": select106, + "1810": select1701, + "18100": msg20276, + "18101": msg20277, + "18102": msg20278, + "18103": msg20279, + "18104": msg20280, + "18105": msg20281, + "18106": msg20282, + "18107": msg20283, + "18108": msg20284, + "18109": msg20285, + "1811": select1702, + "18110": msg20286, + "18111": msg20287, + "18112": msg20288, + "18113": msg20289, + "18114": msg20290, + "18115": msg20291, + "18116": msg20292, + "18117": msg20293, + "18118": msg20294, + "18119": msg20295, + "1812": select1703, + "18120": msg20296, + "18121": msg20297, + "18122": msg20298, + "18123": msg20299, + "18124": msg20300, + "18125": msg20301, + "18126": msg20302, + "18127": msg20303, + "18128": msg20304, + "18129": msg20305, + "1813": select1704, + "18130": msg20306, + "18131": msg20307, + "18132": msg20308, + "18133": msg20309, + "18134": msg20310, + "18135": msg20311, + "18136": msg20312, + "18137": msg20313, + "18138": msg20314, + "18139": msg20315, + "1814": select1705, + "18140": msg20316, + "18141": msg20317, + "18142": msg20318, + "18143": msg20319, + "18144": msg20320, + "18145": msg20321, + "18146": msg20322, + "18147": msg20323, + "18148": msg20324, + "18149": msg20325, + "1815": select1706, + "18150": msg20326, + "18151": msg20327, + "18152": msg20328, + "18153": msg20329, + "18154": msg20330, + "18155": msg20331, + "18156": msg20332, + "18157": msg20333, + "18158": msg20334, + "18159": msg20335, + "1816": select1707, + "18160": msg20336, + "18161": msg20337, + "18162": msg20338, + "18163": msg20339, + "18164": msg20340, + "18165": msg20341, + "18166": msg20342, + "18167": msg20343, + "18168": msg20344, + "18169": msg20345, + "1817": select1708, + "18170": msg20346, + "18171": msg20347, + "18172": msg20348, + "18173": msg20349, + "18174": msg20350, + "18175": msg20351, + "18176": msg20352, + "18177": msg20353, + "18178": msg20354, + "18179": msg20355, + "1818": select1709, + "18180": msg20356, + "18181": msg20357, + "18182": msg20358, + "18183": msg20359, + "18184": msg20360, + "18185": msg20361, + "18186": msg20362, + "18187": msg20363, + "18188": msg20364, + "18189": msg20365, + "1819": select1710, + "18190": msg20366, + "18191": msg20367, + "18192": msg20368, + "18193": msg20369, + "18194": msg20370, + "18195": msg20371, + "18196": msg20372, + "18197": msg20373, + "18198": msg20374, + "18199": msg20375, + "182": select107, + "1820": select1711, + "18200": msg20376, + "18201": msg20377, + "18202": msg20378, + "18203": msg20379, + "18204": msg20380, + "18205": msg20381, + "18206": msg20382, + "18207": msg20383, + "18208": msg20384, + "18209": msg20385, + "1821": select1712, + "18210": msg20386, + "18211": msg20387, + "18212": msg20388, + "18213": msg20389, + "18214": msg20390, + "18215": msg20391, + "18216": msg20392, + "18217": msg20393, + "18218": msg20394, + "18219": msg20395, + "1822": select1713, + "18220": msg20396, + "18221": msg20397, + "18222": msg20398, + "18223": msg20399, + "18224": msg20400, + "18225": msg20401, + "18226": msg20402, + "18227": msg20403, + "18228": msg20404, + "18229": msg20405, + "1823": select1714, + "18230": msg20406, + "18231": msg20407, + "18232": msg20408, + "18233": msg20409, + "18234": msg20410, + "18235": msg20411, + "18236": msg20412, + "18237": msg20413, + "18238": msg20414, + "18239": msg20415, + "1824": select1715, + "18240": msg20416, + "18241": msg20417, + "18242": msg20418, + "18243": msg20419, + "18244": msg20420, + "18245": msg20421, + "18246": msg20422, + "18247": msg20423, + "18248": msg20424, + "18249": msg20425, + "1825": select1716, + "18250": msg20426, + "18251": msg20427, + "18252": msg20428, + "18253": msg20429, + "18254": msg20430, + "18255": msg20431, + "18256": msg20432, + "18257": msg20433, + "18258": msg20434, + "18259": msg20435, + "1826": select1717, + "18260": msg20436, + "18261": msg20437, + "18262": msg20438, + "18263": msg20439, + "18264": msg20440, + "18265": msg20441, + "18266": msg20442, + "18267": msg20443, + "18268": msg20444, + "18269": msg20445, + "1827": select1718, + "18270": msg20446, + "18271": msg20447, + "18272": msg20448, + "18273": msg20449, + "18274": msg20450, + "18275": msg20451, + "18276": msg20452, + "18277": msg20453, + "18278": msg20454, + "18279": msg20455, + "1828": select1719, + "18280": msg20456, + "18281": msg20457, + "18282": msg20458, + "18283": msg20459, + "18284": msg20460, + "18285": msg20461, + "18286": msg20462, + "18287": msg20463, + "18288": msg20464, + "18289": msg20465, + "1829": select1720, + "18290": msg20466, + "18291": msg20467, + "18292": msg20468, + "18293": msg20469, + "18294": msg20470, + "18295": msg20471, + "18296": msg20472, + "18297": msg20473, + "18298": msg20474, + "18299": msg20475, + "183": select108, + "1830": select1721, + "18300": msg20476, + "18301": msg20477, + "18302": msg20478, + "18303": msg20479, + "18304": msg20480, + "18305": msg20481, + "18306": msg20482, + "18307": msg20483, + "18308": msg20484, + "18309": msg20485, + "1831": select1722, + "18310": msg20486, + "18311": msg20487, + "18312": msg20488, + "18313": msg20489, + "18314": msg20490, + "18315": msg20491, + "18316": msg20492, + "18317": msg20493, + "18318": msg20494, + "18319": msg20495, + "1832": select1723, + "18320": msg20496, + "18321": msg20497, + "18322": msg20498, + "18323": msg20499, + "18324": msg20500, + "18325": msg20501, + "18326": msg20502, + "18327": msg20503, + "18328": msg20504, + "18329": msg20505, + "1833": select1724, + "18330": msg20506, + "18331": msg20507, + "18332": msg20508, + "18333": msg20509, + "18334": msg20510, + "18335": msg20511, + "18336": msg20512, + "18337": msg20513, + "18338": msg20514, + "18339": msg20515, + "1834": select1725, + "18340": msg20516, + "18341": msg20517, + "18342": msg20518, + "18343": msg20519, + "18344": msg20520, + "18345": msg20521, + "18346": msg20522, + "18347": msg20523, + "18348": msg20524, + "18349": msg20525, + "1835": select1726, + "18350": msg20526, + "18351": msg20527, + "18352": msg20528, + "18353": msg20529, + "18354": msg20530, + "18355": msg20531, + "18356": msg20532, + "18357": msg20533, + "18358": msg20534, + "18359": msg20535, + "1836": select1727, + "18360": msg20536, + "18361": msg20537, + "18362": msg20538, + "18363": msg20539, + "18364": msg20540, + "18365": msg20541, + "18366": msg20542, + "18367": msg20543, + "18368": msg20544, + "18369": msg20545, + "1837": select1728, + "18370": msg20546, + "18371": msg20547, + "18372": msg20548, + "18373": msg20549, + "18374": msg20550, + "18375": msg20551, + "18376": msg20552, + "18377": msg20553, + "18378": msg20554, + "18379": msg20555, + "1838": select1729, + "18380": msg20556, + "18381": msg20557, + "18382": msg20558, + "18383": msg20559, + "18384": msg20560, + "18385": msg20561, + "18386": msg20562, + "18387": msg20563, + "18388": msg20564, + "18389": msg20565, + "1839": select1730, + "18390": msg20566, + "18391": msg20567, + "18392": msg20568, + "18393": msg20569, + "18394": msg20570, + "18395": msg20571, + "18396": msg20572, + "18397": msg20573, + "18398": msg20574, + "18399": msg20575, + "184": select109, + "1840": select1731, + "18400": msg20576, + "18401": msg20577, + "18402": msg20578, + "18403": msg20579, + "18404": msg20580, + "18405": msg20581, + "18406": msg20582, + "18407": msg20583, + "18408": msg20584, + "18409": msg20585, + "1841": select1732, + "18410": msg20586, + "18411": msg20587, + "18412": msg20588, + "18413": msg20589, + "18414": msg20590, + "18415": msg20591, + "18416": msg20592, + "18417": msg20593, + "18418": msg20594, + "18419": msg20595, + "1842": select1733, + "18420": msg20596, + "18421": msg20597, + "18422": msg20598, + "18423": msg20599, + "18424": msg20600, + "18425": msg20601, + "18426": msg20602, + "18427": msg20603, + "18428": msg20604, + "18429": msg20605, + "1843": select1734, + "18430": msg20606, + "18431": msg20607, + "18432": msg20608, + "18433": msg20609, + "18434": msg20610, + "18435": msg20611, + "18436": msg20612, + "18437": msg20613, + "18438": msg20614, + "18439": msg20615, + "1844": select1735, + "18440": msg20616, + "18441": msg20617, + "18442": msg20618, + "18443": msg20619, + "18444": msg20620, + "18445": msg20621, + "18446": msg20622, + "18447": msg20623, + "18448": msg20624, + "18449": msg20625, + "1845": select1736, + "18450": msg20626, + "18451": msg20627, + "18452": msg20628, + "18453": msg20629, + "18454": msg20630, + "18455": msg20631, + "18456": msg20632, + "18457": msg20633, + "18458": msg20634, + "18459": msg20635, + "1846": select1737, + "18460": msg20636, + "18461": msg20637, + "18462": msg20638, + "18463": msg20639, + "18464": msg20640, + "18465": msg20641, + "18466": msg20642, + "18467": msg20643, + "18468": msg20644, + "18469": msg20645, + "1847": select1738, + "18470": msg20646, + "18471": msg20647, + "18472": msg20648, + "18473": msg20649, + "18474": msg20650, + "18475": msg20651, + "18476": msg20652, + "18477": msg20653, + "18478": msg20654, + "18479": msg20655, + "1848": select1739, + "18480": msg20656, + "18481": msg20657, + "18482": msg20658, + "18483": msg20659, + "18484": msg20660, + "18485": msg20661, + "18486": msg20662, + "18487": msg20663, + "18488": msg20664, + "18489": msg20665, + "1849": select1740, + "18490": msg20666, + "18491": msg20667, + "18492": msg20668, + "18493": msg20669, + "18494": msg20670, + "18495": msg20671, + "18496": msg20672, + "18497": msg20673, + "18498": msg20674, + "18499": msg20675, + "185": select110, + "1850": select1741, + "18500": msg20676, + "18501": msg20677, + "18502": msg20678, + "18503": msg20679, + "18504": msg20680, + "18505": msg20681, + "18506": msg20682, + "18507": msg20683, + "18508": msg20684, + "18509": msg20685, + "1851": select1742, + "18510": msg20686, + "18511": msg20687, + "18512": msg20688, + "18513": msg20689, + "18514": msg20690, + "18515": msg20691, + "18516": msg20692, + "18517": msg20693, + "18518": msg20694, + "18519": msg20695, + "1852": select1743, + "18520": msg20696, + "18521": msg20697, + "18522": msg20698, + "18523": msg20699, + "18524": msg20700, + "18525": msg20701, + "18526": msg20702, + "18527": msg20703, + "18528": msg20704, + "18529": msg20705, + "1853": select1744, + "18530": msg20706, + "18531": msg20707, + "18532": msg20708, + "18533": msg20709, + "18534": msg20710, + "18535": msg20711, + "18536": msg20712, + "18537": msg20713, + "18538": msg20714, + "18539": msg20715, + "1854": select1745, + "18540": msg20716, + "18541": msg20717, + "18542": msg20718, + "18543": msg20719, + "18544": msg20720, + "18545": msg20721, + "18546": msg20722, + "18547": msg20723, + "18548": msg20724, + "18549": msg20725, + "1855": select1746, + "18550": msg20726, + "18551": msg20727, + "18552": msg20728, + "18553": msg20729, + "18554": msg20730, + "18555": msg20731, + "18556": msg20732, + "18557": msg20733, + "18558": msg20734, + "18559": msg20735, + "1856": select1747, + "18560": msg20736, + "18561": msg20737, + "18562": msg20738, + "18563": msg20739, + "18564": msg20740, + "18565": msg20741, + "18566": msg20742, + "18567": msg20743, + "18568": msg20744, + "18569": msg20745, + "1857": select1748, + "18570": msg20746, + "18571": msg20747, + "18572": msg20748, + "18573": msg20749, + "18574": msg20750, + "18575": msg20751, + "18576": msg20752, + "18577": msg20753, + "18578": msg20754, + "18579": msg20755, + "1858": select1749, + "18580": msg20756, + "18581": msg20757, + "18582": msg20758, + "18583": msg20759, + "18584": msg20760, + "18585": msg20761, + "18586": msg20762, + "18587": msg20763, + "18588": msg20764, + "18589": msg20765, + "1859": select1750, + "18590": msg20766, + "18591": msg20767, + "18592": msg20768, + "18593": msg20769, + "18594": msg20770, + "18595": msg20771, + "18596": msg20772, + "18597": msg20773, + "18598": msg20774, + "18599": msg20775, + "186": select111, + "1860": select1751, + "18600": msg20776, + "18601": msg20777, + "18602": msg20778, + "18603": msg20779, + "18604": msg20780, + "18605": msg20781, + "18606": msg20782, + "18607": msg20783, + "18608": msg20784, + "18609": msg20785, + "1861": select1752, + "18610": msg20786, + "18611": msg20787, + "18612": msg20788, + "18613": msg20789, + "18614": msg20790, + "18615": msg20791, + "18616": msg20792, + "18617": msg20793, + "18618": msg20794, + "18619": msg20795, + "1862": select1753, + "18620": msg20796, + "18621": msg20797, + "18622": msg20798, + "18623": msg20799, + "18624": msg20800, + "18625": msg20801, + "18626": msg20802, + "18627": msg20803, + "18628": msg20804, + "18629": msg20805, + "1863": select1754, + "18630": msg20806, + "18631": msg20807, + "18632": msg20808, + "18633": msg20809, + "18634": msg20810, + "18635": msg20811, + "18636": msg20812, + "18637": msg20813, + "18638": msg20814, + "18639": msg20815, + "1864": select1755, + "18640": msg20816, + "18641": msg20817, + "18642": msg20818, + "18643": msg20819, + "18644": msg20820, + "18645": msg20821, + "18646": msg20822, + "18647": msg20823, + "18648": msg20824, + "18649": msg20825, + "1865": select1756, + "18650": msg20826, + "18651": msg20827, + "18652": msg20828, + "18653": msg20829, + "18654": msg20830, + "18655": msg20831, + "18656": msg20832, + "18657": msg20833, + "18658": msg20834, + "18659": msg20835, + "1866": select1757, + "18660": msg20836, + "18661": msg20837, + "18662": msg20838, + "18663": msg20839, + "18664": msg20840, + "18665": msg20841, + "18666": msg20842, + "18667": msg20843, + "18668": msg20844, + "18669": msg20845, + "1867": select1758, + "18670": msg20846, + "18671": msg20847, + "18672": msg20848, + "18673": msg20849, + "18674": msg20850, + "18675": msg20851, + "18676": msg20852, + "18677": msg20853, + "18678": msg20854, + "18679": msg20855, + "1868": msg3638, + "18680": msg20856, + "18681": msg20857, + "18682": msg20858, + "18683": msg20859, + "18684": msg20860, + "18685": msg20861, + "18686": msg20862, + "18687": msg20863, + "18688": msg20864, + "18689": msg20865, + "1869": msg3639, + "18690": msg20866, + "18691": msg20867, + "187": select112, + "1870": select1759, + "18700": msg20868, + "18701": msg20869, + "18702": msg20870, + "18703": msg20871, + "18704": msg20872, + "18705": msg20873, + "18706": msg20874, + "18707": msg20875, + "18708": msg20876, + "18709": msg20877, + "1871": select1760, + "18710": msg20878, + "18711": msg20879, + "18712": msg20880, + "18713": msg20881, + "18714": msg20882, + "18715": msg20883, + "18716": msg20884, + "18717": msg20885, + "18718": msg20886, + "18719": msg20887, + "1872": select1761, + "18720": msg20888, + "18721": msg20889, + "18722": msg20890, + "18723": msg20891, + "18724": msg20892, + "18725": msg20893, + "18726": msg20894, + "18727": msg20895, + "18728": msg20896, + "18729": msg20897, + "1873": select1762, + "18730": msg20898, + "18731": msg20899, + "18732": msg20900, + "18733": msg20901, + "18734": msg20902, + "18735": msg20903, + "18736": msg20904, + "18737": msg20905, + "18738": msg20906, + "18739": msg20907, + "1874": select1763, + "18740": msg20908, + "18741": msg20909, + "18742": msg20910, + "18743": msg20911, + "18744": msg20912, + "18745": msg20913, + "18746": msg20914, + "18747": msg20915, + "18748": msg20916, + "18749": msg20917, + "1875": select1764, + "18750": msg20918, + "18751": msg20919, + "18752": msg20920, + "18753": msg20921, + "18754": msg20922, + "18755": msg20923, + "18756": msg20924, + "18757": msg20925, + "18758": msg20926, + "18759": msg20927, + "1876": select1765, + "18760": msg20928, + "18761": msg20929, + "18762": msg20930, + "18763": msg20931, + "18764": msg20932, + "18765": msg20933, + "18766": msg20934, + "18767": msg20935, + "18768": msg20936, + "18769": msg20937, + "1877": select1766, + "18770": msg20938, + "18771": msg20939, + "18772": msg20940, + "18773": msg20941, + "18774": msg20942, + "18775": msg20943, + "18776": msg20944, + "18777": msg20945, + "18778": msg20946, + "18779": msg20947, + "1878": select1767, + "18780": msg20948, + "18781": msg20949, + "18782": msg20950, + "18783": msg20951, + "18784": msg20952, + "18785": msg20953, + "18786": msg20954, + "18787": msg20955, + "18788": msg20956, + "18789": msg20957, + "1879": select1768, + "18790": msg20958, + "18791": msg20959, + "18792": msg20960, + "18793": msg20961, + "18794": msg20962, + "18795": msg20963, + "18796": msg20964, + "18797": msg20965, + "18798": msg20966, + "18799": msg20967, + "188": select113, + "1880": select1769, + "18800": msg20968, + "18801": msg20969, + "18802": msg20970, + "18803": msg20971, + "18804": msg20972, + "18805": msg20973, + "18806": msg20974, + "18807": msg20975, + "18808": msg20976, + "18809": msg20977, + "1881": select1770, + "18810": msg20978, + "18811": msg20979, + "18812": msg20980, + "18813": msg20981, + "18814": msg20982, + "18815": msg20983, + "18816": msg20984, + "18817": msg20985, + "18818": msg20986, + "18819": msg20987, + "1882": select1771, + "18820": msg20988, + "18821": msg20989, + "18822": msg20990, + "18823": msg20991, + "18824": msg20992, + "18825": msg20993, + "18826": msg20994, + "18827": msg20995, + "18828": msg20996, + "18829": msg20997, + "1883": select1772, + "18830": msg20998, + "18831": msg20999, + "18832": msg21000, + "18833": msg21001, + "18834": msg21002, + "18835": msg21003, + "18836": msg21004, + "18837": msg21005, + "18838": msg21006, + "18839": msg21007, + "1884": select1773, + "18840": msg21008, + "18841": msg21009, + "18842": msg21010, + "18843": msg21011, + "18844": msg21012, + "18845": msg21013, + "18846": msg21014, + "18847": msg21015, + "18848": msg21016, + "18849": msg21017, + "1885": select1774, + "18850": msg21018, + "18851": msg21019, + "18852": msg21020, + "18853": msg21021, + "18854": msg21022, + "18855": msg21023, + "18856": msg21024, + "18857": msg21025, + "18858": msg21026, + "18859": msg21027, + "1886": select1775, + "18860": msg21028, + "18861": msg21029, + "18862": msg21030, + "18863": msg21031, + "18864": msg21032, + "18865": msg21033, + "18866": msg21034, + "18867": msg21035, + "18868": msg21036, + "18869": msg21037, + "1887": select1776, + "18870": msg21038, + "18871": msg21039, + "18872": msg21040, + "18873": msg21041, + "18874": msg21042, + "18875": msg21043, + "18876": msg21044, + "18877": msg21045, + "18878": msg21046, + "18879": msg21047, + "1888": select1777, + "18880": msg21048, + "18881": msg21049, + "18882": msg21050, + "18883": msg21051, + "18884": msg21052, + "18885": msg21053, + "18886": msg21054, + "18887": msg21055, + "18888": msg21056, + "18889": msg21057, + "1889": select1778, + "18890": msg21058, + "18891": msg21059, + "18892": msg21060, + "18893": msg21061, + "18894": msg21062, + "18895": msg21063, + "18896": msg21064, + "18897": msg21065, + "18898": msg21066, + "18899": msg21067, + "189": select114, + "1890": select1779, + "18900": msg21068, + "18901": msg21069, + "18902": msg21070, + "18903": msg21071, + "18904": msg21072, + "18905": msg21073, + "18906": msg21074, + "18907": msg21075, + "18908": msg21076, + "18909": msg21077, + "1891": select1780, + "18910": msg21078, + "18911": msg21079, + "18912": msg21080, + "18913": msg21081, + "18914": msg21082, + "18915": msg21083, + "18916": msg21084, + "18917": msg21085, + "18918": msg21086, + "18919": msg21087, + "1892": msg3684, + "18920": msg21088, + "18921": msg21089, + "18922": msg21090, + "18923": msg21091, + "18924": msg21092, + "18925": msg21093, + "18926": msg21094, + "18927": msg21095, + "18928": msg21096, + "18929": msg21097, + "1893": select1781, + "18930": msg21098, + "18931": msg21099, + "18932": msg21100, + "18933": msg21101, + "18934": msg21102, + "18935": msg21103, + "18936": msg21104, + "18937": msg21105, + "18938": msg21106, + "18939": msg21107, + "1894": select1782, + "18940": msg21108, + "18941": msg21109, + "18942": msg21110, + "18943": msg21111, + "18944": msg21112, + "18945": msg21113, + "18946": msg21114, + "18947": msg21115, + "18948": msg21116, + "18949": msg21117, + "1895": select1783, + "18950": msg21118, + "18951": msg21119, + "18952": msg21120, + "18953": msg21121, + "18954": msg21122, + "18955": msg21123, + "18956": msg21124, + "18957": msg21125, + "18958": msg21126, + "18959": msg21127, + "1896": select1784, + "18960": msg21128, + "18961": msg21129, + "18962": msg21130, + "18963": msg21131, + "18964": msg21132, + "18965": msg21133, + "18966": msg21134, + "18967": msg21135, + "18968": msg21136, + "18969": msg21137, + "1897": select1785, + "18970": msg21138, + "18971": msg21139, + "18972": msg21140, + "18973": msg21141, + "18974": msg21142, + "18975": msg21143, + "18976": msg21144, + "18977": msg21145, + "18978": msg21146, + "18979": msg21147, + "1898": select1786, + "18980": msg21148, + "18981": msg21149, + "18982": msg21150, + "18983": msg21151, + "18984": msg21152, + "18985": msg21153, + "18986": msg21154, + "18987": msg21155, + "18988": msg21156, + "18989": msg21157, + "1899": select1787, + "18990": msg21158, + "18991": msg21159, + "18992": msg21160, + "18993": msg21161, + "18994": msg21162, + "18995": msg21163, + "18996": msg21164, + "18997": msg21165, + "18998": msg21166, + "18999": msg21167, + "19": select20, + "190": select115, + "1900": select1788, + "19000": msg21168, + "19001": msg21169, + "19002": msg21170, + "19003": msg21171, + "19004": msg21172, + "19005": msg21173, + "19006": msg21174, + "19007": msg21175, + "19008": msg21176, + "19009": msg21177, + "1901": select1789, + "19010": msg21178, + "19011": msg21179, + "19012": msg21180, + "19013": msg21181, + "19014": msg21182, + "19015": msg21183, + "19016": msg21184, + "19017": msg21185, + "19018": msg21186, + "19019": msg21187, + "1902": select1790, + "19020": msg21188, + "19021": msg21189, + "19022": msg21190, + "19023": msg21191, + "19024": msg21192, + "19025": msg21193, + "19026": msg21194, + "19027": msg21195, + "19028": msg21196, + "19029": msg21197, + "1903": select1791, + "19030": msg21198, + "19031": msg21199, + "19032": msg21200, + "19033": msg21201, + "19034": msg21202, + "19035": msg21203, + "19036": msg21204, + "19037": msg21205, + "19038": msg21206, + "19039": msg21207, + "1904": select1792, + "19040": msg21208, + "19041": msg21209, + "19042": msg21210, + "19043": msg21211, + "19044": msg21212, + "19045": msg21213, + "19046": msg21214, + "19047": msg21215, + "19048": msg21216, + "19049": msg21217, + "1905": select1793, + "19050": msg21218, + "19051": msg21219, + "19052": msg21220, + "19053": msg21221, + "19054": msg21222, + "19055": msg21223, + "19056": msg21224, + "19057": msg21225, + "19058": msg21226, + "19059": msg21227, + "1906": select1794, + "19060": msg21228, + "19061": msg21229, + "19062": msg21230, + "19063": msg21231, + "19064": msg21232, + "19065": msg21233, + "19066": msg21234, + "19067": msg21235, + "19068": msg21236, + "19069": msg21237, + "1907": select1795, + "19070": msg21238, + "19071": msg21239, + "19072": msg21240, + "19073": msg21241, + "19074": msg21242, + "19075": msg21243, + "19076": msg21244, + "19077": msg21245, + "19078": msg21246, + "19079": msg21247, + "1908": select1796, + "19080": msg21248, + "19081": msg21249, + "19082": msg21250, + "19083": msg21251, + "19084": msg21252, + "19085": msg21253, + "19086": msg21254, + "19087": msg21255, + "19088": msg21256, + "19089": msg21257, + "1909": select1797, + "19090": msg21258, + "19091": msg21259, + "19092": msg21260, + "19093": msg21261, + "19094": msg21262, + "19095": msg21263, + "19096": msg21264, + "19097": msg21265, + "19098": msg21266, + "19099": msg21267, + "191": select116, + "1910": select1798, + "19100": msg21268, + "19101": msg21269, + "19102": msg21270, + "19103": msg21271, + "19104": msg21272, + "19105": msg21273, + "19106": msg21274, + "19107": msg21275, + "19108": msg21276, + "19109": msg21277, + "1911": select1799, + "19110": msg21278, + "19111": msg21279, + "19112": msg21280, + "19113": msg21281, + "19114": msg21282, + "19115": msg21283, + "19116": msg21284, + "19117": msg21285, + "19118": msg21286, + "19119": msg21287, + "1912": select1800, + "19120": msg21288, + "19121": msg21289, + "19122": msg21290, + "19123": msg21291, + "19124": msg21292, + "19125": msg21293, + "19126": msg21294, + "19127": msg21295, + "19128": msg21296, + "19129": msg21297, + "1913": select1801, + "19130": msg21298, + "19131": msg21299, + "19132": msg21300, + "19133": msg21301, + "19134": msg21302, + "19135": msg21303, + "19136": msg21304, + "19137": msg21305, + "19138": msg21306, + "19139": msg21307, + "1914": select1802, + "19140": msg21308, + "19141": msg21309, + "19142": msg21310, + "19143": msg21311, + "19144": msg21312, + "19145": msg21313, + "19146": msg21314, + "19147": msg21315, + "19148": msg21316, + "19149": msg21317, + "1915": select1803, + "19150": msg21318, + "19151": msg21319, + "19152": msg21320, + "19153": msg21321, + "19154": msg21322, + "19155": msg21323, + "19156": msg21324, + "19157": msg21325, + "19158": msg21326, + "19159": msg21327, + "1916": select1804, + "19160": msg21328, + "19161": msg21329, + "19162": msg21330, + "19163": msg21331, + "19164": msg21332, + "19165": msg21333, + "19166": msg21334, + "19167": msg21335, + "19168": msg21336, + "19169": msg21337, + "1917": select1805, + "19170": msg21338, + "19171": msg21339, + "19172": msg21340, + "19173": msg21341, + "19174": msg21342, + "19175": msg21343, + "19176": msg21344, + "19177": msg21345, + "19178": msg21346, + "19179": msg21347, + "1918": select1806, + "19180": msg21348, + "19181": msg21349, + "19182": msg21350, + "19183": msg21351, + "19184": msg21352, + "19185": msg21353, + "19186": msg21354, + "19187": msg21355, + "19188": msg21356, + "19189": msg21357, + "1919": select1807, + "19190": msg21358, + "19191": msg21359, + "19192": msg21360, + "19193": msg21361, + "19194": msg21362, + "19195": msg21363, + "19196": msg21364, + "19197": msg21365, + "19198": msg21366, + "19199": msg21367, + "192": select117, + "1920": select1808, + "19200": msg21368, + "19201": msg21369, + "19202": msg21370, + "19203": msg21371, + "19204": msg21372, + "19205": msg21373, + "19206": msg21374, + "19207": msg21375, + "19208": msg21376, + "19209": msg21377, + "1921": select1809, + "19210": msg21378, + "19211": msg21379, + "19212": msg21380, + "19213": msg21381, + "19214": msg21382, + "19215": msg21383, + "19216": msg21384, + "19217": msg21385, + "19218": msg21386, + "19219": msg21387, + "1922": select1810, + "19220": msg21388, + "19221": msg21389, + "19222": msg21390, + "19223": msg21391, + "19224": msg21392, + "19225": msg21393, + "19226": msg21394, + "19227": msg21395, + "19228": msg21396, + "19229": msg21397, + "1923": select1811, + "19230": msg21398, + "19231": msg21399, + "19232": msg21400, + "19233": msg21401, + "19234": msg21402, + "19235": msg21403, + "19236": msg21404, + "19237": msg21405, + "19238": msg21406, + "19239": msg21407, + "1924": select1812, + "19240": msg21408, + "19241": msg21409, + "19242": msg21410, + "19243": msg21411, + "19244": msg21412, + "19245": msg21413, + "19246": msg21414, + "19247": msg21415, + "19248": msg21416, + "19249": msg21417, + "1925": select1813, + "19250": msg21418, + "19251": msg21419, + "19252": msg21420, + "19253": msg21421, + "19254": msg21422, + "19255": msg21423, + "19256": msg21424, + "19257": msg21425, + "19258": msg21426, + "19259": msg21427, + "1926": select1814, + "19260": msg21428, + "19261": msg21429, + "19262": msg21430, + "19263": msg21431, + "19264": msg21432, + "19265": msg21433, + "19266": msg21434, + "19267": msg21435, + "19268": msg21436, + "19269": msg21437, + "1927": select1815, + "19270": msg21438, + "19271": msg21439, + "19272": msg21440, + "19273": msg21441, + "19274": msg21442, + "19275": msg21443, + "19276": msg21444, + "19277": msg21445, + "19278": msg21446, + "19279": msg21447, + "1928": select1816, + "19280": msg21448, + "19281": msg21449, + "19282": msg21450, + "19283": msg21451, + "19284": msg21452, + "19285": msg21453, + "19286": msg21454, + "19287": msg21455, + "19288": msg21456, + "19289": msg21457, + "1929": select1817, + "19290": msg21458, + "19291": msg21459, + "19292": msg21460, + "19293": msg21461, + "19294": msg21462, + "19295": msg21463, + "19296": msg21464, + "19297": msg21465, + "19298": msg21466, + "19299": msg21467, + "193": select118, + "1930": select1818, + "19300": msg21468, + "19301": msg21469, + "19302": msg21470, + "19303": msg21471, + "19304": msg21472, + "19305": msg21473, + "19306": msg21474, + "19307": msg21475, + "19308": msg21476, + "19309": msg21477, + "1931": select1819, + "19310": msg21478, + "19311": msg21479, + "19312": msg21480, + "19313": msg21481, + "19314": msg21482, + "19315": msg21483, + "19316": msg21484, + "19317": msg21485, + "19318": msg21486, + "19319": msg21487, + "1932": select1820, + "19320": msg21488, + "19321": msg21489, + "19322": msg21490, + "19323": msg21491, + "19324": msg21492, + "19325": msg21493, + "19326": msg21494, + "19327": msg21495, + "19328": msg21496, + "19329": msg21497, + "1933": select1821, + "19330": msg21498, + "19331": msg21499, + "19332": msg21500, + "19333": msg21501, + "19334": msg21502, + "19335": msg21503, + "19336": msg21504, + "19337": msg21505, + "19338": msg21506, + "19339": msg21507, + "1934": select1822, + "19340": msg21508, + "19341": msg21509, + "19342": msg21510, + "19343": msg21511, + "19344": msg21512, + "19345": msg21513, + "19346": msg21514, + "19347": msg21515, + "19348": msg21516, + "19349": msg21517, + "1935": select1823, + "19350": msg21518, + "19351": msg21519, + "19352": msg21520, + "19353": msg21521, + "19354": msg21522, + "19355": msg21523, + "19356": msg21524, + "19357": msg21525, + "19358": msg21526, + "19359": msg21527, + "1936": select1824, + "19360": msg21528, + "19361": msg21529, + "19362": msg21530, + "19363": msg21531, + "19364": msg21532, + "19365": msg21533, + "19366": msg21534, + "19367": msg21535, + "19368": msg21536, + "19369": msg21537, + "1937": select1825, + "19370": msg21538, + "19371": msg21539, + "19372": msg21540, + "19373": msg21541, + "19374": msg21542, + "19375": msg21543, + "19376": msg21544, + "19377": msg21545, + "19378": msg21546, + "19379": msg21547, + "1938": select1826, + "19380": msg21548, + "19381": msg21549, + "19382": msg21550, + "19383": msg21551, + "19384": msg21552, + "19385": msg21553, + "19386": msg21554, + "19387": msg21555, + "19388": msg21556, + "19389": msg21557, + "1939": select1827, + "19390": msg21558, + "19391": msg21559, + "19392": msg21560, + "19393": msg21561, + "19394": msg21562, + "19395": msg21563, + "19396": msg21564, + "19397": msg21565, + "19398": msg21566, + "19399": msg21567, + "194": select119, + "1940": select1828, + "19400": msg21568, + "19401": msg21569, + "19402": msg21570, + "19403": msg21571, + "19404": msg21572, + "19405": msg21573, + "19406": msg21574, + "19407": msg21575, + "19408": msg21576, + "19409": msg21577, + "1941": select1829, + "19410": msg21578, + "19411": msg21579, + "19412": msg21580, + "19413": msg21581, + "19414": msg21582, + "19415": msg21583, + "19416": msg21584, + "19417": msg21585, + "19418": msg21586, + "19419": msg21587, + "1942": select1830, + "19420": msg21588, + "19421": msg21589, + "19422": msg21590, + "19423": msg21591, + "19424": msg21592, + "19425": msg21593, + "19426": msg21594, + "19427": msg21595, + "19428": msg21596, + "19429": msg21597, + "1943": select1831, + "19430": msg21598, + "19431": msg21599, + "19432": msg21600, + "19433": msg21601, + "19434": msg21602, + "19435": msg21603, + "19436": msg21604, + "19437": msg21605, + "19438": msg21606, + "19439": msg21607, + "1944": select1832, + "19440": msg21608, + "19441": msg21609, + "19442": msg21610, + "19443": msg21611, + "19444": msg21612, + "19445": msg21613, + "19446": msg21614, + "19447": msg21615, + "19448": msg21616, + "19449": msg21617, + "1945": select1833, + "19450": msg21618, + "19451": msg21619, + "19452": msg21620, + "19453": msg21621, + "19454": msg21622, + "19455": msg21623, + "19456": msg21624, + "19457": msg21625, + "19458": msg21626, + "19459": msg21627, + "1946": select1834, + "19460": msg21628, + "19461": msg21629, + "19462": msg21630, + "19463": msg21631, + "19464": msg21632, + "19465": msg21633, + "19466": msg21634, + "19467": msg21635, + "19468": msg21636, + "19469": msg21637, + "1947": select1835, + "19470": msg21638, + "19471": msg21639, + "19472": msg21640, + "19473": msg21641, + "19474": msg21642, + "19475": msg21643, + "19476": msg21644, + "19477": msg21645, + "19478": msg21646, + "19479": msg21647, + "1948": select1836, + "19480": msg21648, + "19481": msg21649, + "19482": msg21650, + "19483": msg21651, + "19484": msg21652, + "19485": msg21653, + "19486": msg21654, + "19487": msg21655, + "19488": msg21656, + "19489": msg21657, + "1949": select1837, + "19490": msg21658, + "19491": msg21659, + "19492": msg21660, + "19493": msg21661, + "19494": msg21662, + "19495": msg21663, + "19496": msg21664, + "19497": msg21665, + "19498": msg21666, + "19499": msg21667, + "195": select120, + "1950": select1838, + "19500": msg21668, + "19501": msg21669, + "19502": msg21670, + "19503": msg21671, + "19504": msg21672, + "19505": msg21673, + "19506": msg21674, + "19507": msg21675, + "19508": msg21676, + "19509": msg21677, + "1951": select1839, + "19510": msg21678, + "19511": msg21679, + "19512": msg21680, + "19513": msg21681, + "19514": msg21682, + "19515": msg21683, + "19516": msg21684, + "19517": msg21685, + "19518": msg21686, + "19519": msg21687, + "1952": select1840, + "19520": msg21688, + "19521": msg21689, + "19522": msg21690, + "19523": msg21691, + "19524": msg21692, + "19525": msg21693, + "19526": msg21694, + "19527": msg21695, + "19528": msg21696, + "19529": msg21697, + "1953": select1841, + "19530": msg21698, + "19531": msg21699, + "19532": msg21700, + "19533": msg21701, + "19534": msg21702, + "19535": msg21703, + "19536": msg21704, + "19537": msg21705, + "19538": msg21706, + "19539": msg21707, + "1954": select1842, + "19540": msg21708, + "19541": msg21709, + "19542": msg21710, + "19543": msg21711, + "19544": msg21712, + "19545": msg21713, + "19546": msg21714, + "19547": msg21715, + "19548": msg21716, + "19549": msg21717, + "1955": select1843, + "19550": msg21718, + "19551": msg21719, + "19552": msg21720, + "19553": msg21721, + "19554": msg21722, + "19555": msg21723, + "19556": msg21724, + "19557": msg21725, + "19558": msg21726, + "19559": msg21727, + "1956": select1844, + "19560": msg21728, + "19561": msg21729, + "19562": msg21730, + "19563": msg21731, + "19564": msg21732, + "19565": msg21733, + "19566": msg21734, + "19567": msg21735, + "19568": msg21736, + "19569": msg21737, + "1957": select1845, + "19570": msg21738, + "19571": msg21739, + "19572": msg21740, + "19573": msg21741, + "19574": msg21742, + "19575": msg21743, + "19576": msg21744, + "19577": msg21745, + "19578": msg21746, + "19579": msg21747, + "1958": select1846, + "19580": msg21748, + "19581": msg21749, + "19582": msg21750, + "19583": msg21751, + "19584": msg21752, + "19585": msg21753, + "19586": msg21754, + "19587": msg21755, + "19588": msg21756, + "19589": msg21757, + "1959": select1847, + "19590": msg21758, + "19591": msg21759, + "19592": msg21760, + "19593": msg21761, + "19594": msg21762, + "19595": msg21763, + "19596": msg21764, + "19597": msg21765, + "19598": msg21766, + "19599": msg21767, + "196": select121, + "1960": select1848, + "19600": msg21768, + "19601": msg21769, + "19602": msg21770, + "19603": msg21771, + "19604": msg21772, + "19605": msg21773, + "19606": msg21774, + "19607": msg21775, + "19608": msg21776, + "19609": msg21777, + "1961": select1849, + "19610": msg21778, + "19611": msg21779, + "19612": msg21780, + "19613": msg21781, + "19614": msg21782, + "19615": msg21783, + "19616": msg21784, + "19617": msg21785, + "19618": msg21786, + "19619": msg21787, + "1962": select1850, + "19620": msg21788, + "19621": msg21789, + "19622": msg21790, + "19623": msg21791, + "19624": msg21792, + "19625": msg21793, + "19626": msg21794, + "19627": msg21795, + "19628": msg21796, + "19629": msg21797, + "1963": select1851, + "19630": msg21798, + "19631": msg21799, + "19632": msg21800, + "19633": msg21801, + "19634": msg21802, + "19635": msg21803, + "19636": msg21804, + "19637": msg21805, + "19638": msg21806, + "19639": msg21807, + "1964": select1852, + "19640": msg21808, + "19641": msg21809, + "19642": msg21810, + "19643": msg21811, + "19644": msg21812, + "19645": msg21813, + "19646": msg21814, + "19647": msg21815, + "19648": msg21816, + "19649": msg21817, + "1965": select1853, + "19650": msg21818, + "19651": msg21819, + "19652": msg21820, + "19653": msg21821, + "19654": msg21822, + "19655": msg21823, + "19656": msg21824, + "19657": msg21825, + "19658": msg21826, + "19659": msg21827, + "1966": select1854, + "19660": msg21828, + "19661": msg21829, + "19662": msg21830, + "19663": msg21831, + "19664": msg21832, + "19665": msg21833, + "19666": msg21834, + "19667": msg21835, + "19668": msg21836, + "19669": msg21837, + "1967": select1855, + "19670": msg21838, + "19671": msg21839, + "19672": msg21840, + "19673": msg21841, + "19674": msg21842, + "19675": msg21843, + "19676": msg21844, + "19677": msg21845, + "19678": msg21846, + "19679": msg21847, + "1968": select1856, + "19680": msg21848, + "19681": msg21849, + "19682": msg21850, + "19683": msg21851, + "19684": msg21852, + "19685": msg21853, + "19686": msg21854, + "19687": msg21855, + "19688": msg21856, + "19689": msg21857, + "1969": select1857, + "19690": msg21858, + "19691": msg21859, + "19692": msg21860, + "19693": msg21861, + "19694": msg21862, + "19695": msg21863, + "19696": msg21864, + "19697": msg21865, + "19698": msg21866, + "19699": msg21867, + "197": select122, + "1970": select1858, + "19700": msg21868, + "19701": msg21869, + "19702": msg21870, + "19703": msg21871, + "19704": msg21872, + "19705": msg21873, + "19706": msg21874, + "19707": msg21875, + "19708": msg21876, + "19709": msg21877, + "1971": select1859, + "19710": msg21878, + "19711": msg21879, + "19712": msg21880, + "19713": msg21881, + "19714": msg21882, + "19715": msg21883, + "19716": msg21884, + "19717": msg21885, + "19718": msg21886, + "19719": msg21887, + "1972": select1860, + "19720": msg21888, + "19721": msg21889, + "19722": msg21890, + "19723": msg21891, + "19724": msg21892, + "19725": msg21893, + "19726": msg21894, + "19727": msg21895, + "19728": msg21896, + "19729": msg21897, + "1973": select1861, + "19730": msg21898, + "19731": msg21899, + "19732": msg21900, + "19733": msg21901, + "19734": msg21902, + "19735": msg21903, + "19736": msg21904, + "19737": msg21905, + "19738": msg21906, + "19739": msg21907, + "1974": select1862, + "19740": msg21908, + "19741": msg21909, + "19742": msg21910, + "19743": msg21911, + "19744": msg21912, + "19745": msg21913, + "19746": msg21914, + "19747": msg21915, + "19748": msg21916, + "19749": msg21917, + "1975": select1863, + "19750": msg21918, + "19751": msg21919, + "19752": msg21920, + "19753": msg21921, + "19754": msg21922, + "19755": msg21923, + "19756": msg21924, + "19757": msg21925, + "19758": msg21926, + "19759": msg21927, + "1976": select1864, + "19760": msg21928, + "19761": msg21929, + "19762": msg21930, + "19763": msg21931, + "19764": msg21932, + "19765": msg21933, + "19766": msg21934, + "19767": msg21935, + "19768": msg21936, + "19769": msg21937, + "1977": select1865, + "19770": msg21938, + "19771": msg21939, + "19772": msg21940, + "19773": msg21941, + "19774": msg21942, + "19775": msg21943, + "19776": msg21944, + "19777": msg21945, + "19778": msg21946, + "19779": msg21947, + "1978": select1866, + "19780": msg21948, + "19781": msg21949, + "19782": msg21950, + "19783": msg21951, + "19784": msg21952, + "19785": msg21953, + "19786": msg21954, + "19787": msg21955, + "19788": msg21956, + "19789": msg21957, + "1979": select1867, + "19790": msg21958, + "19791": msg21959, + "19792": msg21960, + "19793": msg21961, + "19794": msg21962, + "19795": msg21963, + "19796": msg21964, + "19797": msg21965, + "19798": msg21966, + "19799": msg21967, + "198": select123, + "1980": select1868, + "19800": msg21968, + "19801": msg21969, + "19802": msg21970, + "19803": msg21971, + "19804": msg21972, + "19805": msg21973, + "19806": msg21974, + "19807": msg21975, + "19808": msg21976, + "19809": msg21977, + "1981": select1869, + "19810": msg21978, + "19811": msg21979, + "19812": msg21980, + "19813": msg21981, + "19814": msg21982, + "19815": msg21983, + "19816": msg21984, + "19817": msg21985, + "19818": msg21986, + "19819": msg21987, + "1982": select1870, + "19820": msg21988, + "19821": msg21989, + "19822": msg21990, + "19823": msg21991, + "19824": msg21992, + "19825": msg21993, + "19826": msg21994, + "19827": msg21995, + "19828": msg21996, + "19829": msg21997, + "1983": select1871, + "19830": msg21998, + "19831": msg21999, + "19832": msg22000, + "19833": msg22001, + "19834": msg22002, + "19835": msg22003, + "19836": msg22004, + "19837": msg22005, + "19838": msg22006, + "19839": msg22007, + "1984": select1872, + "19840": msg22008, + "19841": msg22009, + "19842": msg22010, + "19843": msg22011, + "19844": msg22012, + "19845": msg22013, + "19846": msg22014, + "19847": msg22015, + "19848": msg22016, + "19849": msg22017, + "1985": select1873, + "19850": msg22018, + "19851": msg22019, + "19852": msg22020, + "19853": msg22021, + "19854": msg22022, + "19855": msg22023, + "19856": msg22024, + "19857": msg22025, + "19858": msg22026, + "19859": msg22027, + "1986": select1874, + "19860": msg22028, + "19861": msg22029, + "19862": msg22030, + "19863": msg22031, + "19864": msg22032, + "19865": msg22033, + "19866": msg22034, + "19867": msg22035, + "19868": msg22036, + "19869": msg22037, + "1987": select1875, + "19870": msg22038, + "19871": msg22039, + "19872": msg22040, + "19873": msg22041, + "19874": msg22042, + "19875": msg22043, + "19876": msg22044, + "19877": msg22045, + "19878": msg22046, + "19879": msg22047, + "1988": select1876, + "19880": msg22048, + "19881": msg22049, + "19882": msg22050, + "19883": msg22051, + "19884": msg22052, + "19885": msg22053, + "19886": msg22054, + "19887": msg22055, + "19888": msg22056, + "19889": msg22057, + "1989": select1877, + "19890": msg22058, + "19891": msg22059, + "19892": msg22060, + "19893": msg22061, + "19894": msg22062, + "19895": msg22063, + "19896": msg22064, + "19897": msg22065, + "19898": msg22066, + "19899": msg22067, + "199": select124, + "1990": select1878, + "19900": msg22068, + "19901": msg22069, + "19902": msg22070, + "19903": msg22071, + "19904": msg22072, + "19905": msg22073, + "19906": msg22074, + "19907": msg22075, + "19908": msg22076, + "19909": msg22077, + "1991": select1879, + "19910": msg22078, + "19911": msg22079, + "19912": msg22080, + "19914": msg22081, + "19915": msg22082, + "19916": msg22083, + "19917": msg22084, + "19918": msg22085, + "19919": msg22086, + "1992": select1880, + "19920": msg22087, + "19921": msg22088, + "19922": msg22089, + "19923": msg22090, + "19924": msg22091, + "19925": msg22092, + "19926": msg22093, + "19927": msg22094, + "19928": msg22095, + "19929": msg22096, + "1993": select1881, + "19930": msg22097, + "19931": msg22098, + "19932": msg22099, + "19933": msg22100, + "19934": msg22101, + "19935": msg22102, + "19936": msg22103, + "19937": msg22104, + "19938": msg22105, + "19939": msg22106, + "1994": select1882, + "19940": msg22107, + "19941": msg22108, + "19942": msg22109, + "19943": msg22110, + "19944": msg22111, + "19945": msg22112, + "19946": msg22113, + "19947": msg22114, + "19948": msg22115, + "19949": msg22116, + "1995": select1883, + "19950": msg22117, + "19951": msg22118, + "19952": msg22119, + "19953": msg22120, + "19954": msg22121, + "19955": msg22122, + "19956": msg22123, + "19957": msg22124, + "19958": msg22125, + "19959": msg22126, + "1996": select1884, + "19960": msg22127, + "19961": msg22128, + "19962": msg22129, + "19963": msg22130, + "19964": msg22131, + "19965": msg22132, + "19966": msg22133, + "19967": msg22134, + "19968": msg22135, + "19969": msg22136, + "1997": select1885, + "19970": msg22137, + "19971": msg22138, + "19972": msg22139, + "19973": msg22140, + "19974": msg22141, + "19975": msg22142, + "19976": msg22143, + "19977": msg22144, + "19978": msg22145, + "19979": msg22146, + "1998": select1886, + "19980": msg22147, + "19981": msg22148, + "19982": msg22149, + "19983": msg22150, + "19984": msg22151, + "19985": msg22152, + "19986": msg22153, + "19987": msg22154, + "19988": msg22155, + "19989": msg22156, + "1999": select1887, + "19990": msg22157, + "19991": msg22158, + "19992": msg22159, + "19993": msg22160, + "19994": msg22161, + "19995": msg22162, + "19996": msg22163, + "19997": msg22164, + "19998": msg22165, + "19999": msg22166, + "2": select8, + "20": select21, + "200": select125, + "2000": select1888, + "20000": msg22167, + "20001": msg22168, + "20002": msg22169, + "20003": msg22170, + "20004": msg22171, + "2000480": msg38326, + "20005": msg22172, + "2000538": msg38327, + "2000540": msg38328, + "2000562": msg38329, + "20006": msg22173, + "2000648": msg38330, + "20007": msg22174, + "2000716": msg38331, + "20008": msg22175, + "20009": msg22176, + "2000969": msg38332, + "2000971": msg38333, + "2000974": msg38334, + "2000976": msg38335, + "2000977": msg38336, + "2000987": msg38337, + "2000990": msg38338, + "2000993": msg38339, + "2000997": msg38340, + "2001": select1889, + "20010": msg22177, + "2001002": msg38341, + "2001010": msg38342, + "2001012": msg38343, + "2001013": msg38344, + "2001023": msg38345, + "2001025": msg38346, + "2001030": msg38347, + "2001040": msg38348, + "2001042": msg38349, + "20011": msg22178, + "20012": msg22179, + "2001244": msg38350, + "2001245": msg38351, + "2001286": msg38352, + "2001287": msg38353, + "2001288": msg38354, + "20013": msg22180, + "2001367": msg38355, + "20014": msg22181, + "2001400": msg38356, + "2001402": msg38357, + "2001411": msg38358, + "2001417": msg38359, + "2001419": msg38360, + "20015": msg22182, + "2001567": msg38361, + "2001568": msg38362, + "2001569": msg38363, + "2001579": msg38364, + "2001581": msg38365, + "20016": msg22183, + "20017": msg22184, + "2001726": msg38366, + "20018": msg22185, + "2001801": msg38367, + "2001852": msg38368, + "2001893": msg38369, + "20019": msg22186, + "2001904": msg38370, + "2001945": msg38371, + "2001970": msg38372, + "2001972": msg38373, + "2002": select1890, + "20020": msg22187, + "2002032": msg38374, + "20021": msg22188, + "2002134": msg38375, + "2002170": msg38376, + "2002176": msg38377, + "2002190": msg38378, + "2002196": msg38379, + "20022": msg22189, + "2002200": msg38380, + "2002205": msg38381, + "20023": msg22190, + "20024": msg22191, + "20025": msg22192, + "20026": msg22193, + "20027": msg22194, + "20028": msg22195, + "20029": msg22196, + "2002910": msg38382, + "2002911": msg38383, + "2002992": msg38384, + "2002993": msg38385, + "2002994": msg38386, + "2003": select1891, + "20030": msg22197, + "20031": msg22198, + "2003157": msg38387, + "2003183": msg38388, + "20032": msg22199, + "20033": msg22200, + "2003380": msg38389, + "20034": msg22201, + "20035": msg22202, + "20036": msg22203, + "2003642": msg38390, + "20037": msg22204, + "20038": msg22205, + "2003870": msg38391, + "20039": msg22206, + "2004": select1892, + "20040": msg22207, + "20041": msg22208, + "20042": msg22209, + "20043": msg22210, + "20044": msg22211, + "20045": msg22212, + "20046": msg22213, + "20047": msg22214, + "20048": msg22215, + "20049": msg22216, + "2005": select1893, + "20050": msg22217, + "20051": msg22218, + "20052": msg22219, + "20053": msg22220, + "20054": msg22221, + "20055": msg22222, + "20056": msg22223, + "20057": msg22224, + "20058": msg22225, + "20059": msg22226, + "2006": select1894, + "20060": msg22227, + "20061": msg22228, + "20062": msg22229, + "20063": msg22230, + "20064": msg22231, + "20065": msg22232, + "20066": msg22233, + "20067": msg22234, + "20068": msg22235, + "20069": msg22236, + "2007": select1895, + "20070": msg22237, + "20071": msg22238, + "2007142": msg38392, + "20072": msg22239, + "20073": msg22240, + "20074": msg22241, + "20075": msg22242, + "2007585": msg38393, + "2007588": msg38394, + "2007594": msg38395, + "20076": msg22243, + "2007688": msg38396, + "20077": msg22244, + "2007702": msg38397, + "2007724": msg38398, + "20078": msg22245, + "20079": msg22246, + "2007920": msg38399, + "2007962": msg38400, + "2007963": msg38401, + "2007964": msg38402, + "2008": select1896, + "20080": msg22247, + "2008010": msg38403, + "2008056": msg38404, + "2008059": msg38405, + "2008082": msg38406, + "20081": msg22248, + "2008109": msg38407, + "2008124": msg38408, + "2008143": msg38409, + "2008182": msg38410, + "2008194": msg38411, + "20082": msg22249, + "20083": msg22250, + "2008335": msg38412, + "2008373": msg38413, + "2008384": msg38414, + "2008386": msg38415, + "20084": msg22251, + "2008420": msg38416, + "2008475": msg38417, + "2008480": msg38418, + "20085": msg22252, + "2008505": msg38419, + "20086": msg22253, + "20087": msg22254, + "20088": msg22255, + "20089": msg22256, + "2009": select1897, + "20090": msg22257, + "20091": msg22258, + "20092": msg22259, + "20093": msg22260, + "20094": msg22261, + "20095": msg22262, + "20096": msg22263, + "20097": msg22264, + "20098": msg22265, + "20099": msg22266, + "201": select126, + "2010": select1898, + "20100": msg22267, + "20101": msg22268, + "20102": msg22269, + "20103": msg22270, + "20104": msg22271, + "20105": msg22272, + "20106": msg22273, + "20107": msg22274, + "20108": msg22275, + "20109": msg22276, + "2011": select1899, + "20110": msg22277, + "20111": msg22278, + "20112": msg22279, + "20113": msg22280, + "20114": msg22281, + "20115": msg22282, + "20116": msg22283, + "20117": msg22284, + "20118": msg22285, + "20119": msg22286, + "2012": select1900, + "20120": msg22287, + "20121": msg22288, + "20122": msg22289, + "20123": msg22290, + "20124": msg22291, + "20125": msg22292, + "20126": msg22293, + "20127": msg22294, + "20128": msg22295, + "20129": msg22296, + "2013": select1901, + "20130": msg22297, + "20131": msg22298, + "20132": msg22299, + "20133": msg22300, + "20134": msg22301, + "20135": msg22302, + "20136": msg22303, + "20137": msg22304, + "20138": msg22305, + "20139": msg22306, + "2014": select1902, + "20140": msg22307, + "20141": msg22308, + "20142": msg22309, + "20143": msg22310, + "20144": msg22311, + "20145": msg22312, + "20146": msg22313, + "20147": msg22314, + "20148": msg22315, + "20149": msg22316, + "2015": select1903, + "20150": msg22317, + "20151": msg22318, + "20152": msg22319, + "20153": msg22320, + "20154": msg22321, + "20155": msg22322, + "20156": msg22323, + "20157": msg22324, + "20158": msg22325, + "20159": msg22326, + "2016": select1904, + "20160": msg22327, + "20161": msg22328, + "20162": msg22329, + "20163": msg22330, + "20164": msg22331, + "20165": msg22332, + "20166": msg22333, + "20167": msg22334, + "20168": msg22335, + "20169": msg22336, + "2017": select1905, + "20170": msg22337, + "20171": msg22338, + "20172": msg22339, + "20173": msg22340, + "20174": msg22341, + "20175": msg22342, + "20176": msg22343, + "20177": msg22344, + "20178": msg22345, + "20179": msg22346, + "2018": select1906, + "20180": msg22347, + "20181": msg22348, + "20182": msg22349, + "20183": msg22350, + "20184": msg22351, + "20185": msg22352, + "20186": msg22353, + "20187": msg22354, + "20188": msg22355, + "20189": msg22356, + "2019": select1907, + "20190": msg22357, + "20191": msg22358, + "20192": msg22359, + "20193": msg22360, + "20194": msg22361, + "20195": msg22362, + "20196": msg22363, + "20197": msg22364, + "20198": msg22365, + "20199": msg22366, + "202": select127, + "2020": select1908, + "20200": msg22367, + "20201": msg22368, + "20202": msg22369, + "20203": msg22370, + "20204": msg22371, + "20205": msg22372, + "20206": msg22373, + "20207": msg22374, + "20208": msg22375, + "20209": msg22376, + "2021": select1909, + "20210": msg22377, + "20211": msg22378, + "20212": msg22379, + "20213": msg22380, + "20214": msg22381, + "20215": msg22382, + "20216": msg22383, + "20217": msg22384, + "20218": msg22385, + "20219": msg22386, + "2022": select1910, + "20220": msg22387, + "20221": msg22388, + "20222": msg22389, + "20223": msg22390, + "20224": msg22391, + "20225": msg22392, + "20226": msg22393, + "20227": msg22394, + "20228": msg22395, + "20229": msg22396, + "2023": select1911, + "20230": msg22397, + "20231": msg22398, + "20232": msg22399, + "20233": msg22400, + "20234": msg22401, + "20235": msg22402, + "20236": msg22403, + "20237": msg22404, + "20238": msg22405, + "20239": msg22406, + "2024": select1912, + "20240": msg22407, + "20241": msg22408, + "20242": msg22409, + "20243": msg22410, + "20244": msg22411, + "20245": msg22412, + "20246": msg22413, + "20247": msg22414, + "20248": msg22415, + "20249": msg22416, + "2025": select1913, + "20250": msg22417, + "20251": msg22418, + "20252": msg22419, + "20253": msg22420, + "20254": msg22421, + "20255": msg22422, + "20256": msg22423, + "20257": msg22424, + "20258": msg22425, + "20259": msg22426, + "2026": select1914, + "20260": msg22427, + "20261": msg22428, + "20262": msg22429, + "20263": msg22430, + "20264": msg22431, + "20265": msg22432, + "20266": msg22433, + "20267": msg22434, + "20268": msg22435, + "20269": msg22436, + "2027": select1915, + "20270": msg22437, + "20271": msg22438, + "20272": msg22439, + "20273": msg22440, + "20274": msg22441, + "20275": msg22442, + "20276": msg22443, + "20277": msg22444, + "20278": msg22445, + "20279": msg22446, + "2028": select1916, + "20280": msg22447, + "20281": msg22448, + "20282": msg22449, + "20283": msg22450, + "20284": msg22451, + "20285": msg22452, + "20286": msg22453, + "20287": msg22454, + "20288": msg22455, + "20289": msg22456, + "2029": select1917, + "20290": msg22457, + "20291": msg22458, + "20292": msg22459, + "20293": msg22460, + "20294": msg22461, + "20295": msg22462, + "20296": msg22463, + "20297": msg22464, + "20298": msg22465, + "20299": msg22466, + "203": select128, + "2030": select1918, + "20300": msg22467, + "20301": msg22468, + "20302": msg22469, + "20303": msg22470, + "20304": msg22471, + "20305": msg22472, + "20306": msg22473, + "20307": msg22474, + "20308": msg22475, + "20309": msg22476, + "2031": select1919, + "20310": msg22477, + "20311": msg22478, + "20312": msg22479, + "20313": msg22480, + "20314": msg22481, + "20315": msg22482, + "20316": msg22483, + "20317": msg22484, + "20318": msg22485, + "20319": msg22486, + "2032": select1920, + "20320": msg22487, + "20321": msg22488, + "20322": msg22489, + "20323": msg22490, + "20324": msg22491, + "20325": msg22492, + "20326": msg22493, + "20327": msg22494, + "20328": msg22495, + "20329": msg22496, + "2033": select1921, + "20330": msg22497, + "20331": msg22498, + "20332": msg22499, + "20333": msg22500, + "20334": msg22501, + "20335": msg22502, + "20336": msg22503, + "20337": msg22504, + "20338": msg22505, + "20339": msg22506, + "2034": select1922, + "20340": msg22507, + "20341": msg22508, + "20342": msg22509, + "20343": msg22510, + "20344": msg22511, + "20345": msg22512, + "20346": msg22513, + "20347": msg22514, + "20348": msg22515, + "20349": msg22516, + "2035": select1923, + "20350": msg22517, + "20351": msg22518, + "20352": msg22519, + "20353": msg22520, + "20354": msg22521, + "20355": msg22522, + "20356": msg22523, + "20357": msg22524, + "20358": msg22525, + "20359": msg22526, + "2036": select1924, + "20360": msg22527, + "20361": msg22528, + "20362": msg22529, + "20363": msg22530, + "20364": msg22531, + "20365": msg22532, + "20366": msg22533, + "20367": msg22534, + "20368": msg22535, + "20369": msg22536, + "2037": select1925, + "20370": msg22537, + "20371": msg22538, + "20372": msg22539, + "20373": msg22540, + "20374": msg22541, + "20375": msg22542, + "20376": msg22543, + "20377": msg22544, + "20378": msg22545, + "20379": msg22546, + "2038": select1926, + "20380": msg22547, + "20381": msg22548, + "20382": msg22549, + "20383": msg22550, + "20384": msg22551, + "20385": msg22552, + "20386": msg22553, + "20387": msg22554, + "20388": msg22555, + "20389": msg22556, + "2039": select1927, + "20390": msg22557, + "20391": msg22558, + "20392": msg22559, + "20393": msg22560, + "20394": msg22561, + "20395": msg22562, + "20396": msg22563, + "20397": msg22564, + "20398": msg22565, + "20399": msg22566, + "204": select129, + "2040": select1928, + "20400": msg22567, + "20401": msg22568, + "20402": msg22569, + "20403": msg22570, + "20404": msg22571, + "20405": msg22572, + "20406": msg22573, + "20407": msg22574, + "20408": msg22575, + "20409": msg22576, + "2041": select1929, + "20410": msg22577, + "20411": msg22578, + "20412": msg22579, + "20413": msg22580, + "20414": msg22581, + "20415": msg22582, + "20416": msg22583, + "20417": msg22584, + "20418": msg22585, + "20419": msg22586, + "2042": select1930, + "20420": msg22587, + "20421": msg22588, + "20422": msg22589, + "20423": msg22590, + "20424": msg22591, + "20425": msg22592, + "20426": msg22593, + "20427": msg22594, + "20428": msg22595, + "20429": msg22596, + "2043": select1931, + "20430": msg22597, + "20431": msg22598, + "20432": msg22599, + "20433": msg22600, + "20434": msg22601, + "20435": msg22602, + "20436": msg22603, + "20437": msg22604, + "20438": msg22605, + "20439": msg22606, + "2044": select1932, + "20440": msg22607, + "20441": msg22608, + "20442": msg22609, + "20443": msg22610, + "20444": msg22611, + "20445": msg22612, + "20446": msg22613, + "20447": msg22614, + "20448": msg22615, + "20449": msg22616, + "2045": select1933, + "20450": msg22617, + "20451": msg22618, + "20452": msg22619, + "20453": msg22620, + "20454": msg22621, + "20455": msg22622, + "20456": msg22623, + "20457": msg22624, + "20458": msg22625, + "20459": msg22626, + "2046": select1934, + "20460": msg22627, + "20461": msg22628, + "20462": msg22629, + "20463": msg22630, + "20464": msg22631, + "20465": msg22632, + "20466": msg22633, + "20467": msg22634, + "20468": msg22635, + "20469": msg22636, + "2047": select1935, + "20470": msg22637, + "20471": msg22638, + "20472": msg22639, + "20473": msg22640, + "20474": msg22641, + "20475": msg22642, + "20476": msg22643, + "20477": msg22644, + "20478": msg22645, + "20479": msg22646, + "2048": select1936, + "20480": msg22647, + "20481": msg22648, + "20482": msg22649, + "20483": msg22650, + "20484": msg22651, + "20485": msg22652, + "20486": msg22653, + "20487": msg22654, + "20488": msg22655, + "20489": msg22656, + "2049": select1937, + "20490": msg22657, + "20491": msg22658, + "20492": msg22659, + "20493": msg22660, + "20494": msg22661, + "20495": msg22662, + "20496": msg22663, + "20497": msg22664, + "20498": msg22665, + "20499": msg22666, + "205": select130, + "2050": select1938, + "20500": msg22667, + "20501": msg22668, + "20502": msg22669, + "20503": msg22670, + "20504": msg22671, + "20505": msg22672, + "20506": msg22673, + "20507": msg22674, + "20508": msg22675, + "20509": msg22676, + "2051": select1939, + "20510": msg22677, + "20511": msg22678, + "20512": msg22679, + "20513": msg22680, + "20514": msg22681, + "20515": msg22682, + "20516": msg22683, + "20517": msg22684, + "20518": msg22685, + "20519": msg22686, + "2052": select1940, + "20520": msg22687, + "20521": msg22688, + "20522": msg22689, + "20523": msg22690, + "20524": msg22691, + "20525": msg22692, + "20526": msg22693, + "20527": msg22694, + "20528": msg22695, + "20529": msg22696, + "2053": select1941, + "20530": msg22697, + "20531": msg22698, + "20532": msg22699, + "20533": msg22700, + "20534": msg22701, + "20535": msg22702, + "20536": msg22703, + "20537": msg22704, + "20538": msg22705, + "20539": msg22706, + "2054": select1942, + "20540": msg22707, + "20541": msg22708, + "20542": msg22709, + "20543": msg22710, + "20544": msg22711, + "20545": msg22712, + "20546": msg22713, + "20547": msg22714, + "20548": msg22715, + "20549": msg22716, + "2055": select1943, + "20550": msg22717, + "20551": msg22718, + "20552": msg22719, + "20553": msg22720, + "20554": msg22721, + "20555": msg22722, + "20556": msg22723, + "20557": msg22724, + "20558": msg22725, + "20559": msg22726, + "2056": select1944, + "20560": msg22727, + "20561": msg22728, + "20562": msg22729, + "20563": msg22730, + "20564": msg22731, + "20565": msg22732, + "20566": msg22733, + "20567": msg22734, + "20568": msg22735, + "20569": msg22736, + "2057": select1945, + "20570": msg22737, + "20571": msg22738, + "20572": msg22739, + "20573": msg22740, + "20574": msg22741, + "20575": msg22742, + "20576": msg22743, + "20577": msg22744, + "20578": msg22745, + "20579": msg22746, + "2058": select1946, + "20580": msg22747, + "20581": msg22748, + "20582": msg22749, + "20583": msg22750, + "20584": msg22751, + "20585": msg22752, + "20586": msg22753, + "20587": msg22754, + "20588": msg22755, + "20589": msg22756, + "2059": select1947, + "20590": msg22757, + "20591": msg22758, + "20592": msg22759, + "20593": msg22760, + "20594": msg22761, + "20595": msg22762, + "20596": msg22763, + "20597": msg22764, + "20598": msg22765, + "20599": msg22766, + "206": select131, + "2060": select1948, + "20600": msg22767, + "20601": msg22768, + "20602": msg22769, + "20603": msg22770, + "20604": msg22771, + "20605": msg22772, + "20606": msg22773, + "20607": msg22774, + "20608": msg22775, + "20609": msg22776, + "2061": select1949, + "20610": msg22777, + "20611": msg22778, + "20612": msg22779, + "20613": msg22780, + "20614": msg22781, + "20615": msg22782, + "20616": msg22783, + "20617": msg22784, + "20618": msg22785, + "20619": msg22786, + "2062": select1950, + "20620": msg22787, + "20621": msg22788, + "20622": msg22789, + "20623": msg22790, + "20624": msg22791, + "20625": msg22792, + "20626": msg22793, + "20627": msg22794, + "20628": msg22795, + "20629": msg22796, + "2063": select1951, + "20630": msg22797, + "20631": msg22798, + "20632": msg22799, + "20633": msg22800, + "20634": msg22801, + "20635": msg22802, + "20636": msg22803, + "20637": msg22804, + "20638": msg22805, + "20639": msg22806, + "2064": select1952, + "20640": msg22807, + "20641": msg22808, + "20642": msg22809, + "20643": msg22810, + "20644": msg22811, + "20645": msg22812, + "20646": msg22813, + "20647": msg22814, + "20648": msg22815, + "20649": msg22816, + "2065": select1953, + "20650": msg22817, + "20651": msg22818, + "20652": msg22819, + "20653": msg22820, + "20654": msg22821, + "20655": msg22822, + "20656": msg22823, + "20657": msg22824, + "20658": msg22825, + "20659": msg22826, + "2066": select1954, + "20660": msg22827, + "20661": msg22828, + "20662": msg22829, + "20663": msg22830, + "20664": msg22831, + "20665": msg22832, + "20666": msg22833, + "20667": msg22834, + "20668": msg22835, + "20669": msg22836, + "2067": select1955, + "20670": msg22837, + "20671": msg22838, + "20672": msg22839, + "20673": msg22840, + "20674": msg22841, + "20675": msg22842, + "20676": msg22843, + "20677": msg22844, + "20678": msg22845, + "20679": msg22846, + "2068": select1956, + "20680": msg22847, + "20681": msg22848, + "20682": msg22849, + "20683": msg22850, + "20684": msg22851, + "20685": msg22852, + "20686": msg22853, + "20687": msg22854, + "20688": msg22855, + "20689": msg22856, + "2069": select1957, + "20690": msg22857, + "20691": msg22858, + "20692": msg22859, + "20693": msg22860, + "20694": msg22861, + "20695": msg22862, + "20696": msg22863, + "20697": msg22864, + "20698": msg22865, + "20699": msg22866, + "207": select132, + "2070": select1958, + "20700": msg22867, + "20701": msg22868, + "20702": msg22869, + "20703": msg22870, + "20704": msg22871, + "20705": msg22872, + "20706": msg22873, + "20707": msg22874, + "20708": msg22875, + "20709": msg22876, + "2071": select1959, + "20710": msg22877, + "20711": msg22878, + "20712": msg22879, + "20713": msg22880, + "20714": msg22881, + "20715": msg22882, + "20716": msg22883, + "20717": msg22884, + "20718": msg22885, + "20719": msg22886, + "2072": select1960, + "20720": msg22887, + "20721": msg22888, + "20722": msg22889, + "20723": msg22890, + "20724": msg22891, + "20725": msg22892, + "20726": msg22893, + "20727": msg22894, + "20728": msg22895, + "20729": msg22896, + "2073": select1961, + "20730": msg22897, + "20731": msg22898, + "20732": msg22899, + "20733": msg22900, + "20734": msg22901, + "20735": msg22902, + "20736": msg22903, + "20737": msg22904, + "20738": msg22905, + "20739": msg22906, + "2074": select1962, + "20740": msg22907, + "20741": msg22908, + "20742": msg22909, + "20743": msg22910, + "20744": msg22911, + "20745": msg22912, + "20746": msg22913, + "20747": msg22914, + "20748": msg22915, + "20749": msg22916, + "2075": select1963, + "20750": msg22917, + "20751": msg22918, + "20752": msg22919, + "20753": msg22920, + "20754": msg22921, + "20755": msg22922, + "20756": msg22923, + "20757": msg22924, + "20758": msg22925, + "20759": msg22926, + "2076": select1964, + "20760": msg22927, + "20761": msg22928, + "20762": msg22929, + "20763": msg22930, + "20764": msg22931, + "20765": msg22932, + "20766": msg22933, + "20767": msg22934, + "20768": msg22935, + "20769": msg22936, + "2077": select1965, + "20770": msg22937, + "20771": msg22938, + "20772": msg22939, + "20773": msg22940, + "20774": msg22941, + "20775": msg22942, + "20776": msg22943, + "20777": msg22944, + "20778": msg22945, + "20779": msg22946, + "2078": select1966, + "20780": msg22947, + "20781": msg22948, + "20782": msg22949, + "20783": msg22950, + "20784": msg22951, + "20785": msg22952, + "20786": msg22953, + "20787": msg22954, + "20788": msg22955, + "20789": msg22956, + "2079": select1967, + "20790": msg22957, + "20791": msg22958, + "20792": msg22959, + "20793": msg22960, + "20794": msg22961, + "20795": msg22962, + "20796": msg22963, + "20797": msg22964, + "20798": msg22965, + "20799": msg22966, + "208": select133, + "2080": select1968, + "20800": msg22967, + "20801": msg22968, + "20802": msg22969, + "20803": msg22970, + "20804": msg22971, + "20805": msg22972, + "20806": msg22973, + "20807": msg22974, + "20808": msg22975, + "20809": msg22976, + "2081": select1969, + "20810": msg22977, + "20811": msg22978, + "20812": msg22979, + "20813": msg22980, + "20814": msg22981, + "20815": msg22982, + "20816": msg22983, + "20817": msg22984, + "20818": msg22985, + "20819": msg22986, + "2082": select1970, + "20820": msg22987, + "20821": msg22988, + "20822": msg22989, + "20823": msg22990, + "20824": msg22991, + "20825": msg22992, + "20826": msg22993, + "20827": msg22994, + "20828": msg22995, + "20829": msg22996, + "2083": select1971, + "20830": msg22997, + "20831": msg22998, + "20832": msg22999, + "20833": msg23000, + "20834": msg23001, + "20835": msg23002, + "20836": msg23003, + "20837": msg23004, + "20838": msg23005, + "20839": msg23006, + "2084": select1972, + "20840": msg23007, + "20841": msg23008, + "20842": msg23009, + "20843": msg23010, + "20844": msg23011, + "20845": msg23012, + "20846": msg23013, + "20847": msg23014, + "20848": msg23015, + "20849": msg23016, + "2085": select1973, + "20850": msg23017, + "20851": msg23018, + "20852": msg23019, + "20853": msg23020, + "20854": msg23021, + "20855": msg23022, + "20856": msg23023, + "20857": msg23024, + "20858": msg23025, + "20859": msg23026, + "2086": select1974, + "20860": msg23027, + "20861": msg23028, + "20862": msg23029, + "20863": msg23030, + "20864": msg23031, + "20865": msg23032, + "20866": msg23033, + "20867": msg23034, + "20868": msg23035, + "20869": msg23036, + "2087": select1975, + "20870": msg23037, + "20871": msg23038, + "20872": msg23039, + "20873": msg23040, + "20874": msg23041, + "20875": msg23042, + "20876": msg23043, + "20877": msg23044, + "20878": msg23045, + "20879": msg23046, + "2088": select1976, + "20880": msg23047, + "20881": msg23048, + "20882": msg23049, + "20883": msg23050, + "20884": msg23051, + "20885": msg23052, + "20886": msg23053, + "20887": msg23054, + "20888": msg23055, + "20889": msg23056, + "2089": select1977, + "20890": msg23057, + "20891": msg23058, + "20892": msg23059, + "20893": msg23060, + "20894": msg23061, + "20895": msg23062, + "20896": msg23063, + "20897": msg23064, + "20898": msg23065, + "20899": msg23066, + "209": select134, + "2090": select1978, + "20900": msg23067, + "20901": msg23068, + "20902": msg23069, + "20903": msg23070, + "20904": msg23071, + "20905": msg23072, + "20906": msg23073, + "20907": msg23074, + "20908": msg23075, + "20909": msg23076, + "2091": select1979, + "20910": msg23077, + "20911": msg23078, + "20912": msg23079, + "20913": msg23080, + "20914": msg23081, + "20915": msg23082, + "20916": msg23083, + "20917": msg23084, + "20918": msg23085, + "20919": msg23086, + "2092": select1980, + "20920": msg23087, + "20921": msg23088, + "20922": msg23089, + "20923": msg23090, + "20924": msg23091, + "20925": msg23092, + "20926": msg23093, + "20927": msg23094, + "20928": msg23095, + "20929": msg23096, + "2093": select1981, + "20930": msg23097, + "20931": msg23098, + "20932": msg23099, + "20933": msg23100, + "20934": msg23101, + "20935": msg23102, + "20936": msg23103, + "20937": msg23104, + "20938": msg23105, + "20939": msg23106, + "2094": select1982, + "20940": msg23107, + "20941": msg23108, + "20942": msg23109, + "20943": msg23110, + "20944": msg23111, + "20945": msg23112, + "20946": msg23113, + "20947": msg23114, + "20948": msg23115, + "20949": msg23116, + "2095": select1983, + "20950": msg23117, + "20951": msg23118, + "20952": msg23119, + "20953": msg23120, + "20954": msg23121, + "20955": msg23122, + "20956": msg23123, + "20957": msg23124, + "20958": msg23125, + "20959": msg23126, + "2096": select1984, + "20960": msg23127, + "20961": msg23128, + "20962": msg23129, + "20963": msg23130, + "20964": msg23131, + "20965": msg23132, + "20966": msg23133, + "20967": msg23134, + "20968": msg23135, + "20969": msg23136, + "2097": select1985, + "20970": msg23137, + "20971": msg23138, + "20972": msg23139, + "20973": msg23140, + "20974": msg23141, + "20975": msg23142, + "20976": msg23143, + "20977": msg23144, + "20978": msg23145, + "20979": msg23146, + "2098": select1986, + "20980": msg23147, + "20981": msg23148, + "20982": msg23149, + "20983": msg23150, + "20984": msg23151, + "20985": msg23152, + "20986": msg23153, + "20987": msg23154, + "20988": msg23155, + "20989": msg23156, + "2099": select1987, + "20990": msg23157, + "20991": msg23158, + "20992": msg23159, + "20993": msg23160, + "20994": msg23161, + "20995": msg23162, + "20996": msg23163, + "20997": msg23164, + "20998": msg23165, + "20999": msg23166, + "21": select22, + "210": select135, + "2100": select1988, + "21000": msg23167, + "21001": msg23168, + "21002": msg23169, + "21003": msg23170, + "21004": msg23171, + "21005": msg23172, + "21006": msg23173, + "2100651": msg38508, + "21007": msg23174, + "21008": msg23175, + "21009": msg23176, + "2101": select1989, + "21010": msg23177, + "21011": msg23178, + "21012": msg23179, + "21013": msg23180, + "2101384": msg38509, + "2101390": msg38510, + "21014": msg23181, + "2101424": msg38511, + "2101432": msg38512, + "21015": msg23182, + "21016": msg23183, + "21017": msg23184, + "21018": msg23185, + "2101867": msg38513, + "21019": msg23186, + "2101918": msg38514, + "2102": select1990, + "21020": msg23187, + "21021": msg23188, + "21022": msg23189, + "21023": msg23190, + "21024": msg23191, + "21025": msg23192, + "21026": msg23193, + "21027": msg23194, + "21028": msg23195, + "21029": msg23196, + "2103": select1991, + "21030": msg23197, + "21031": msg23198, + "21032": msg23199, + "21033": msg23200, + "21034": msg23201, + "21035": msg23202, + "21036": msg23203, + "21037": msg23204, + "21038": msg23205, + "21039": msg23206, + "2104": select1992, + "21040": msg23207, + "21041": msg23208, + "21042": msg23209, + "21043": msg23210, + "21044": msg23211, + "21045": msg23212, + "21046": msg23213, + "21047": msg23214, + "21048": msg23215, + "21049": msg23216, + "2105": select1993, + "21050": msg23217, + "21051": msg23218, + "21052": msg23219, + "21053": msg23220, + "21054": msg23221, + "21055": msg23222, + "21056": msg23223, + "21057": msg23224, + "21058": msg23225, + "21059": msg23226, + "2106": select1994, + "21060": msg23227, + "21061": msg23228, + "21062": msg23229, + "21063": msg23230, + "21064": msg23231, + "21065": msg23232, + "21066": msg23233, + "21067": msg23234, + "21068": msg23235, + "21069": msg23236, + "2107": select1995, + "21070": msg23237, + "21071": msg23238, + "21072": msg23239, + "21073": msg23240, + "21074": msg23241, + "21075": msg23242, + "21076": msg23243, + "21077": msg23244, + "21078": msg23245, + "21079": msg23246, + "2108": select1996, + "21080": msg23247, + "21081": msg23248, + "21082": msg23249, + "21083": msg23250, + "21084": msg23251, + "21085": msg23252, + "21086": msg23253, + "21087": msg23254, + "21088": msg23255, + "21089": msg23256, + "2109": select1997, + "21090": msg23257, + "21091": msg23258, + "21092": msg23259, + "21093": msg23260, + "21094": msg23261, + "21095": msg23262, + "21096": msg23263, + "21097": msg23264, + "21098": msg23265, + "21099": msg23266, + "211": select136, + "2110": select1998, + "21100": msg23267, + "21101": msg23268, + "21102": msg23269, + "21103": msg23270, + "21104": msg23271, + "21105": msg23272, + "21106": msg23273, + "21107": msg23274, + "21108": msg23275, + "21109": msg23276, + "2111": select1999, + "21110": msg23277, + "21111": msg23278, + "21112": msg23279, + "21113": msg23280, + "21114": msg23281, + "21115": msg23282, + "21116": msg23283, + "21117": msg23284, + "21118": msg23285, + "21119": msg23286, + "2112": select2000, + "21120": msg23287, + "21121": msg23288, + "21122": msg23289, + "21123": msg23290, + "21124": msg23291, + "21125": msg23292, + "21126": msg23293, + "21127": msg23294, + "21128": msg23295, + "21129": msg23296, + "2113": select2001, + "21130": msg23297, + "21131": msg23298, + "21132": msg23299, + "21133": msg23300, + "21134": msg23301, + "21135": msg23302, + "21136": msg23303, + "21137": msg23304, + "21138": msg23305, + "21139": msg23306, + "2114": select2002, + "21140": msg23307, + "21141": msg23308, + "21142": msg23309, + "21143": msg23310, + "21144": msg23311, + "21145": msg23312, + "21146": msg23313, + "21147": msg23314, + "21148": msg23315, + "21149": msg23316, + "2115": select2003, + "21150": msg23317, + "21151": msg23318, + "21152": msg23319, + "21153": msg23320, + "21154": msg23321, + "21155": msg23322, + "21156": msg23323, + "21157": msg23324, + "21158": msg23325, + "21159": msg23326, + "2116": select2004, + "21160": msg23327, + "21161": msg23328, + "21162": msg23329, + "21163": msg23330, + "21164": msg23331, + "21165": msg23332, + "21166": msg23333, + "21167": msg23334, + "21168": msg23335, + "21169": msg23336, + "2117": select2005, + "21170": msg23337, + "21171": msg23338, + "21172": msg23339, + "21173": msg23340, + "21174": msg23341, + "21175": msg23342, + "21176": msg23343, + "21177": msg23344, + "21178": msg23345, + "21179": msg23346, + "2118": select2006, + "21180": msg23347, + "21181": msg23348, + "21182": msg23349, + "21183": msg23350, + "21184": msg23351, + "21185": msg23352, + "21186": msg23353, + "21187": msg23354, + "21188": msg23355, + "21189": msg23356, + "2119": select2007, + "21190": msg23357, + "21191": msg23358, + "21192": msg23359, + "21193": msg23360, + "21194": msg23361, + "21195": msg23362, + "21196": msg23363, + "21197": msg23364, + "21198": msg23365, + "21199": msg23366, + "212": select137, + "2120": select2008, + "21200": msg23367, + "21201": msg23368, + "21202": msg23369, + "21203": msg23370, + "21204": msg23371, + "21205": msg23372, + "21206": msg23373, + "21207": msg23374, + "21208": msg23375, + "21209": msg23376, + "2121": select2009, + "21210": msg23377, + "21211": msg23378, + "21212": msg23379, + "21213": msg23380, + "21214": msg23381, + "21215": msg23382, + "21216": msg23383, + "21217": msg23384, + "21218": msg23385, + "21219": msg23386, + "2122": select2010, + "21220": msg23387, + "21221": msg23388, + "21222": msg23389, + "21223": msg23390, + "21224": msg23391, + "21225": msg23392, + "21226": msg23393, + "21227": msg23394, + "21228": msg23395, + "21229": msg23396, + "2123": select2011, + "21230": msg23397, + "21231": msg23398, + "21232": msg23399, + "21233": msg23400, + "21234": msg23401, + "21235": msg23402, + "21236": msg23403, + "21237": msg23404, + "21238": msg23405, + "21239": msg23406, + "2124": select2012, + "21240": msg23407, + "21241": msg23408, + "21242": msg23409, + "21243": msg23410, + "21244": msg23411, + "21245": msg23412, + "21246": msg23413, + "21247": msg23414, + "21248": msg23415, + "21249": msg23416, + "2125": select2013, + "21250": msg23417, + "21251": msg23418, + "21252": msg23419, + "21253": msg23420, + "21254": msg23421, + "21255": msg23422, + "21256": msg23423, + "21257": msg23424, + "21258": msg23425, + "21259": msg23426, + "2126": select2014, + "21260": msg23427, + "21261": msg23428, + "21262": msg23429, + "21263": msg23430, + "21264": msg23431, + "21265": msg23432, + "21266": msg23433, + "21267": msg23434, + "21268": msg23435, + "21269": msg23436, + "2127": select2015, + "21270": msg23437, + "21271": msg23438, + "21272": msg23439, + "21273": msg23440, + "21274": msg23441, + "21275": msg23442, + "21276": msg23443, + "21277": msg23444, + "21278": msg23445, + "21279": msg23446, + "2128": select2016, + "21280": msg23447, + "21281": msg23448, + "21282": msg23449, + "21283": msg23450, + "21284": msg23451, + "21285": msg23452, + "21286": msg23453, + "21287": msg23454, + "21288": msg23455, + "21289": msg23456, + "2129": select2017, + "21290": msg23457, + "21291": msg23458, + "21292": msg23459, + "21293": msg23460, + "21294": msg23461, + "21295": msg23462, + "21296": msg23463, + "21297": msg23464, + "21298": msg23465, + "21299": msg23466, + "213": select138, + "2130": select2018, + "21300": msg23467, + "21301": msg23468, + "21302": msg23469, + "21303": msg23470, + "21304": msg23471, + "21305": msg23472, + "21306": msg23473, + "21307": msg23474, + "21308": msg23475, + "21309": msg23476, + "2131": select2019, + "21310": msg23477, + "21311": msg23478, + "21312": msg23479, + "21313": msg23480, + "21314": msg23481, + "21315": msg23482, + "21316": msg23483, + "21317": msg23484, + "21318": msg23485, + "21319": msg23486, + "2132": select2020, + "21320": msg23487, + "21321": msg23488, + "21322": msg23489, + "21323": msg23490, + "21324": msg23491, + "21325": msg23492, + "21326": msg23493, + "21327": msg23494, + "21328": msg23495, + "21329": msg23496, + "2133": select2021, + "21330": msg23497, + "21331": msg23498, + "21332": msg23499, + "21333": msg23500, + "21334": msg23501, + "21335": msg23502, + "21336": msg23503, + "21337": msg23504, + "21338": msg23505, + "21339": msg23506, + "2134": select2022, + "21340": msg23507, + "21341": msg23508, + "21342": msg23509, + "21343": msg23510, + "21344": msg23511, + "21345": msg23512, + "21346": msg23513, + "21347": msg23514, + "21348": msg23515, + "21349": msg23516, + "2135": select2023, + "21350": msg23517, + "21351": msg23518, + "21352": msg23519, + "21353": msg23520, + "21354": msg23521, + "21355": msg23522, + "21356": msg23523, + "21357": msg23524, + "21358": msg23525, + "21359": msg23526, + "2136": select2024, + "21360": msg23527, + "21361": msg23528, + "21362": msg23529, + "21363": msg23530, + "21364": msg23531, + "21365": msg23532, + "21366": msg23533, + "21367": msg23534, + "21368": msg23535, + "21369": msg23536, + "2137": select2025, + "21370": msg23537, + "21371": msg23538, + "21372": msg23539, + "21373": msg23540, + "21374": msg23541, + "21375": msg23542, + "21376": msg23543, + "21377": msg23544, + "21378": msg23545, + "21379": msg23546, + "2138": select2026, + "21380": msg23547, + "21381": msg23548, + "21382": msg23549, + "21383": msg23550, + "21384": msg23551, + "21385": msg23552, + "21386": msg23553, + "21387": msg23554, + "21388": msg23555, + "21389": msg23556, + "2139": select2027, + "21390": msg23557, + "21391": msg23558, + "21392": msg23559, + "21393": msg23560, + "21394": msg23561, + "21395": msg23562, + "21396": msg23563, + "21397": msg23564, + "21398": msg23565, + "21399": msg23566, + "214": select139, + "2140": select2028, + "21400": msg23567, + "21401": msg23568, + "21402": msg23569, + "21403": msg23570, + "21404": msg23571, + "21405": msg23572, + "21406": msg23573, + "21407": msg23574, + "21408": msg23575, + "21409": msg23576, + "2141": select2029, + "21410": msg23577, + "21411": msg23578, + "21412": msg23579, + "21413": msg23580, + "21414": msg23581, + "21415": msg23582, + "21416": msg23583, + "21417": msg23584, + "21418": msg23585, + "21419": msg23586, + "2142": select2030, + "21420": msg23587, + "21421": msg23588, + "21422": msg23589, + "21423": msg23590, + "21424": msg23591, + "21425": msg23592, + "21426": msg23593, + "21427": msg23594, + "21428": msg23595, + "21429": msg23596, + "2143": select2031, + "21430": msg23597, + "21431": msg23598, + "21432": msg23599, + "21433": msg23600, + "21434": msg23601, + "21435": msg23602, + "21436": msg23603, + "21437": msg23604, + "21438": msg23605, + "21439": msg23606, + "2144": select2032, + "21440": msg23607, + "21441": msg23608, + "21442": msg23609, + "21443": msg23610, + "21444": msg23611, + "21445": msg23612, + "21446": msg23613, + "21447": msg23614, + "21448": msg23615, + "21449": msg23616, + "2145": select2033, + "21450": msg23617, + "21451": msg23618, + "21452": msg23619, + "21453": msg23620, + "21454": msg23621, + "21455": msg23622, + "21456": msg23623, + "21457": msg23624, + "21458": msg23625, + "21459": msg23626, + "2146": select2034, + "21460": msg23627, + "21461": msg23628, + "21462": msg23629, + "21463": msg23630, + "21464": msg23631, + "21465": msg23632, + "21466": msg23633, + "21467": msg23634, + "21468": msg23635, + "21469": msg23636, + "2147": select2035, + "21470": msg23637, + "21471": msg23638, + "21472": msg23639, + "21473": msg23640, + "21474": msg23641, + "21475": msg23642, + "21476": msg23643, + "21477": msg23644, + "21478": msg23645, + "21479": msg23646, + "2148": select2036, + "21480": msg23647, + "21481": msg23648, + "21482": msg23649, + "21483": msg23650, + "21484": msg23651, + "21485": msg23652, + "21486": msg23653, + "21487": msg23654, + "21488": msg23655, + "21489": msg23656, + "2149": select2037, + "21490": msg23657, + "21491": msg23658, + "21492": msg23659, + "21493": msg23660, + "21494": msg23661, + "21495": msg23662, + "21496": msg23663, + "21497": msg23664, + "21498": msg23665, + "21499": msg23666, + "215": select140, + "2150": select2038, + "21500": msg23667, + "21501": msg23668, + "21502": msg23669, + "21503": msg23670, + "21504": msg23671, + "21505": msg23672, + "21506": msg23673, + "21507": msg23674, + "21508": msg23675, + "21509": msg23676, + "2151": select2039, + "21510": msg23677, + "21511": msg23678, + "21512": msg23679, + "21513": msg23680, + "21514": msg23681, + "21515": msg23682, + "21516": msg23683, + "21517": msg23684, + "21518": msg23685, + "21519": msg23686, + "2152": select2040, + "21520": msg23687, + "21521": msg23688, + "21522": msg23689, + "21523": msg23690, + "21524": msg23691, + "21525": msg23692, + "21526": msg23693, + "21527": msg23694, + "21528": msg23695, + "21529": msg23696, + "2153": select2041, + "21530": msg23697, + "21531": msg23698, + "21532": msg23699, + "21533": msg23700, + "21534": msg23701, + "21535": msg23702, + "21536": msg23703, + "21537": msg23704, + "21538": msg23705, + "21539": msg23706, + "2154": select2042, + "21540": msg23707, + "21541": msg23708, + "21542": msg23709, + "21543": msg23710, + "21544": msg23711, + "21545": msg23712, + "21546": msg23713, + "21547": msg23714, + "21548": msg23715, + "21549": msg23716, + "2155": select2043, + "21550": msg23717, + "21551": msg23718, + "21552": msg23719, + "21553": msg23720, + "21554": msg23721, + "21555": msg23722, + "21556": msg23723, + "21557": msg23724, + "21558": msg23725, + "21559": msg23726, + "2156": select2044, + "21560": msg23727, + "21561": msg23728, + "21562": msg23729, + "21563": msg23730, + "21564": msg23731, + "21565": msg23732, + "21566": msg23733, + "21567": msg23734, + "21568": msg23735, + "21569": msg23736, + "2157": select2045, + "21570": msg23737, + "21571": msg23738, + "21572": msg23739, + "21573": msg23740, + "21574": msg23741, + "21575": msg23742, + "21576": msg23743, + "21577": msg23744, + "21578": msg23745, + "21579": msg23746, + "2158": select2046, + "21580": msg23747, + "21581": msg23748, + "21582": msg23749, + "21583": msg23750, + "21584": msg23751, + "21585": msg23752, + "21586": msg23753, + "21587": msg23754, + "21588": msg23755, + "21589": msg23756, + "2159": select2047, + "21590": msg23757, + "21591": msg23758, + "21592": msg23759, + "21593": msg23760, + "21594": msg23761, + "21595": msg23762, + "21596": msg23763, + "21597": msg23764, + "21598": msg23765, + "21599": msg23766, + "216": select141, + "2160": select2048, + "21600": msg23767, + "21601": msg23768, + "21602": msg23769, + "21603": msg23770, + "21604": msg23771, + "21605": msg23772, + "21606": msg23773, + "21607": msg23774, + "21608": msg23775, + "21609": msg23776, + "2161": select2049, + "21610": msg23777, + "21611": msg23778, + "21612": msg23779, + "21613": msg23780, + "21614": msg23781, + "21615": msg23782, + "21616": msg23783, + "21617": msg23784, + "21618": msg23785, + "21619": msg23786, + "2162": select2050, + "21620": msg23787, + "21621": msg23788, + "21622": msg23789, + "21623": msg23790, + "21624": msg23791, + "21625": msg23792, + "21626": msg23793, + "21627": msg23794, + "21628": msg23795, + "21629": msg23796, + "2163": select2051, + "21630": msg23797, + "21631": msg23798, + "21632": msg23799, + "21633": msg23800, + "21634": msg23801, + "21635": msg23802, + "21636": msg23803, + "21637": msg23804, + "21638": msg23805, + "21639": msg23806, + "2164": select2052, + "21640": msg23807, + "21641": msg23808, + "21642": msg23809, + "21643": msg23810, + "21644": msg23811, + "21645": msg23812, + "21646": msg23813, + "21647": msg23814, + "21648": msg23815, + "21649": msg23816, + "2165": select2053, + "21650": msg23817, + "21651": msg23818, + "21652": msg23819, + "21653": msg23820, + "21654": msg23821, + "21655": msg23822, + "21656": msg23823, + "21657": msg23824, + "21658": msg23825, + "21659": msg23826, + "2166": select2054, + "21660": msg23827, + "21661": msg23828, + "21662": msg23829, + "21663": msg23830, + "21664": msg23831, + "21665": msg23832, + "21666": msg23833, + "21667": msg23834, + "21668": msg23835, + "21669": msg23836, + "2167": select2055, + "21670": msg23837, + "21671": msg23838, + "21672": msg23839, + "21673": msg23840, + "21674": msg23841, + "21675": msg23842, + "21676": msg23843, + "21677": msg23844, + "21678": msg23845, + "21679": msg23846, + "2168": select2056, + "21680": msg23847, + "21681": msg23848, + "21682": msg23849, + "21683": msg23850, + "21684": msg23851, + "21685": msg23852, + "21686": msg23853, + "21687": msg23854, + "21688": msg23855, + "21689": msg23856, + "2169": select2057, + "21690": msg23857, + "21691": msg23858, + "21692": msg23859, + "21693": msg23860, + "21694": msg23861, + "21695": msg23862, + "21696": msg23863, + "21697": msg23864, + "21698": msg23865, + "21699": msg23866, + "217": select142, + "2170": select2058, + "21700": msg23867, + "21701": msg23868, + "21702": msg23869, + "21703": msg23870, + "21704": msg23871, + "21705": msg23872, + "21706": msg23873, + "21707": msg23874, + "21708": msg23875, + "21709": msg23876, + "2171": select2059, + "21710": msg23877, + "21711": msg23878, + "21712": msg23879, + "21713": msg23880, + "21714": msg23881, + "21715": msg23882, + "21716": msg23883, + "21717": msg23884, + "21718": msg23885, + "21719": msg23886, + "2172": select2060, + "21720": msg23887, + "21721": msg23888, + "21722": msg23889, + "21723": msg23890, + "21724": msg23891, + "21725": msg23892, + "21726": msg23893, + "21727": msg23894, + "21728": msg23895, + "21729": msg23896, + "2173": select2061, + "21730": msg23897, + "21731": msg23898, + "21732": msg23899, + "21733": msg23900, + "21734": msg23901, + "21735": msg23902, + "21736": msg23903, + "21737": msg23904, + "21738": msg23905, + "21739": msg23906, + "2174": select2062, + "21740": msg23907, + "21741": msg23908, + "21742": msg23909, + "21743": msg23910, + "21744": msg23911, + "21745": msg23912, + "21746": msg23913, + "21747": msg23914, + "21748": msg23915, + "21749": msg23916, + "2175": select2063, + "21750": msg23917, + "21751": msg23918, + "21752": msg23919, + "21753": msg23920, + "21754": msg23921, + "21755": msg23922, + "21756": msg23923, + "21757": msg23924, + "21758": msg23925, + "21759": msg23926, + "2176": select2064, + "21760": msg23927, + "21761": msg23928, + "21762": msg23929, + "21763": msg23930, + "21764": msg23931, + "21765": msg23932, + "21766": msg23933, + "21767": msg23934, + "21768": msg23935, + "21769": msg23936, + "2177": select2065, + "21770": msg23937, + "21771": msg23938, + "21772": msg23939, + "21773": msg23940, + "21774": msg23941, + "21775": msg23942, + "21776": msg23943, + "21777": msg23944, + "21778": msg23945, + "21779": msg23946, + "2178": select2066, + "21780": msg23947, + "21781": msg23948, + "21782": msg23949, + "21783": msg23950, + "21784": msg23951, + "21785": msg23952, + "21786": msg23953, + "21787": msg23954, + "21788": msg23955, + "21789": msg23956, + "2179": select2067, + "21790": msg23957, + "21791": msg23958, + "21792": msg23959, + "21793": msg23960, + "21794": msg23961, + "21795": msg23962, + "21796": msg23963, + "21797": msg23964, + "21798": msg23965, + "21799": msg23966, + "218": select143, + "2180": select2068, + "21800": msg23967, + "21801": msg23968, + "21802": msg23969, + "21803": msg23970, + "21804": msg23971, + "21805": msg23972, + "21806": msg23973, + "21807": msg23974, + "21808": msg23975, + "21809": msg23976, + "2181": select2069, + "21810": msg23977, + "21811": msg23978, + "21812": msg23979, + "21813": msg23980, + "21814": msg23981, + "21815": msg23982, + "21816": msg23983, + "21817": msg23984, + "21818": msg23985, + "21819": msg23986, + "2182": select2070, + "21820": msg23987, + "21821": msg23988, + "21822": msg23989, + "21823": msg23990, + "21824": msg23991, + "21825": msg23992, + "21826": msg23993, + "21827": msg23994, + "21828": msg23995, + "21829": msg23996, + "2183": select2071, + "21830": msg23997, + "21831": msg23998, + "21832": msg23999, + "21833": msg24000, + "21834": msg24001, + "21835": msg24002, + "21836": msg24003, + "21837": msg24004, + "21838": msg24005, + "21839": msg24006, + "2184": select2072, + "21840": msg24007, + "21841": msg24008, + "21842": msg24009, + "21843": msg24010, + "21844": msg24011, + "21845": msg24012, + "21846": msg24013, + "21847": msg24014, + "21848": msg24015, + "21849": msg24016, + "2185": select2073, + "21850": msg24017, + "21851": msg24018, + "21852": msg24019, + "21853": msg24020, + "21854": msg24021, + "21855": msg24022, + "21856": msg24023, + "21857": msg24024, + "21858": msg24025, + "21859": msg24026, + "2186": select2074, + "21860": msg24027, + "21861": msg24028, + "21862": msg24029, + "21863": msg24030, + "21864": msg24031, + "21865": msg24032, + "21866": msg24033, + "21867": msg24034, + "21868": msg24035, + "21869": msg24036, + "2187": select2075, + "21870": msg24037, + "21871": msg24038, + "21872": msg24039, + "21873": msg24040, + "21874": msg24041, + "21875": msg24042, + "21876": msg24043, + "21877": msg24044, + "21878": msg24045, + "21879": msg24046, + "2188": select2076, + "21880": msg24047, + "21881": msg24048, + "21882": msg24049, + "21883": msg24050, + "21884": msg24051, + "21885": msg24052, + "21886": msg24053, + "21887": msg24054, + "21888": msg24055, + "21889": msg24056, + "2189": select2077, + "21890": msg24057, + "21891": msg24058, + "21892": msg24059, + "21893": msg24060, + "21894": msg24061, + "21895": msg24062, + "21896": msg24063, + "21897": msg24064, + "21898": msg24065, + "21899": msg24066, + "219": select144, + "2190": select2078, + "21900": msg24067, + "21901": msg24068, + "21902": msg24069, + "21903": msg24070, + "21904": msg24071, + "21905": msg24072, + "21906": msg24073, + "21907": msg24074, + "21908": msg24075, + "21909": msg24076, + "2191": select2079, + "21910": msg24077, + "21911": msg24078, + "21912": msg24079, + "21913": msg24080, + "21914": msg24081, + "21915": msg24082, + "21916": msg24083, + "21917": msg24084, + "21918": msg24085, + "21919": msg24086, + "2192": select2080, + "21920": msg24087, + "21921": msg24088, + "21922": msg24089, + "21923": msg24090, + "21924": msg24091, + "21925": msg24092, + "21926": msg24093, + "21927": msg24094, + "21928": msg24095, + "21929": msg24096, + "2193": select2081, + "21930": msg24097, + "21931": msg24098, + "21932": msg24099, + "21933": msg24100, + "21934": msg24101, + "21935": msg24102, + "21937": msg24103, + "21938": msg24104, + "21939": msg24105, + "2194": select2082, + "21940": msg24106, + "21941": msg24107, + "21942": msg24108, + "21943": msg24109, + "21944": msg24110, + "21945": msg24111, + "21946": msg24112, + "21947": msg24113, + "21948": msg24114, + "21949": msg24115, + "2195": select2083, + "21950": msg24116, + "21951": msg24117, + "21952": msg24118, + "21953": msg24119, + "21954": msg24120, + "21955": msg24121, + "21956": msg24122, + "21957": msg24123, + "21958": msg24124, + "21959": msg24125, + "2196": select2084, + "21960": msg24126, + "21961": msg24127, + "21962": msg24128, + "21963": msg24129, + "21964": msg24130, + "21965": msg24131, + "21966": msg24132, + "21967": msg24133, + "21968": msg24134, + "21969": msg24135, + "2197": select2085, + "21970": msg24136, + "21971": msg24137, + "21972": msg24138, + "21973": msg24139, + "21974": msg24140, + "21975": msg24141, + "21976": msg24142, + "21977": msg24143, + "21978": msg24144, + "21979": msg24145, + "2198": select2086, + "21980": msg24146, + "21981": msg24147, + "21982": msg24148, + "21983": msg24149, + "21984": msg24150, + "21985": msg24151, + "21986": msg24152, + "21987": msg24153, + "21988": msg24154, + "21989": msg24155, + "2199": select2087, + "21990": msg24156, + "21991": msg24157, + "21992": msg24158, + "21993": msg24159, + "21994": msg24160, + "21995": msg24161, + "21996": msg24162, + "21997": msg24163, + "21998": msg24164, + "21999": msg24165, + "220": select145, + "2200": select2088, + "22000": msg24166, + "22001": msg24167, + "22002": msg24168, + "22003": msg24169, + "22004": msg24170, + "22005": msg24171, + "22006": msg24172, + "22007": msg24173, + "22008": msg24174, + "22009": msg24175, + "2201": select2089, + "22010": msg24176, + "22011": msg24177, + "22012": msg24178, + "22013": msg24179, + "22014": msg24180, + "22015": msg24181, + "22016": msg24182, + "22017": msg24183, + "22018": msg24184, + "22019": msg24185, + "2202": select2090, + "22020": msg24186, + "22021": msg24187, + "22022": msg24188, + "22023": msg24189, + "22024": msg24190, + "22025": msg24191, + "22026": msg24192, + "22027": msg24193, + "22028": msg24194, + "22029": msg24195, + "2203": select2091, + "22030": msg24196, + "22031": msg24197, + "22032": msg24198, + "22033": msg24199, + "22034": msg24200, + "22035": msg24201, + "22036": msg24202, + "22037": msg24203, + "22038": msg24204, + "22039": msg24205, + "2204": select2092, + "22040": msg24206, + "22041": msg24207, + "22042": msg24208, + "22043": msg24209, + "22044": msg24210, + "22045": msg24211, + "22046": msg24212, + "22047": msg24213, + "22048": msg24214, + "22049": msg24215, + "2205": select2093, + "22050": msg24216, + "22051": msg24217, + "22052": msg24218, + "22053": msg24219, + "22054": msg24220, + "22055": msg24221, + "22056": msg24222, + "22057": msg24223, + "22058": msg24224, + "22059": msg24225, + "2206": select2094, + "22060": msg24226, + "22061": msg24227, + "22062": msg24228, + "22063": msg24229, + "22064": msg24230, + "22065": msg24231, + "22066": msg24232, + "22067": msg24233, + "22068": msg24234, + "22069": msg24235, + "2207": select2095, + "22070": msg24236, + "22071": msg24237, + "22072": msg24238, + "22073": msg24239, + "22074": msg24240, + "22075": msg24241, + "22076": msg24242, + "22077": msg24243, + "22078": msg24244, + "22079": msg24245, + "2208": select2096, + "22080": msg24246, + "22081": msg24247, + "22082": msg24248, + "22083": msg24249, + "22084": msg24250, + "22085": msg24251, + "22086": msg24252, + "22087": msg24253, + "22088": msg24254, + "22089": msg24255, + "2209": select2097, + "22090": msg24256, + "22091": msg24257, + "22092": msg24258, + "22093": msg24259, + "22094": msg24260, + "22095": msg24261, + "22096": msg24262, + "22097": msg24263, + "22098": msg24264, + "22099": msg24265, + "221": select146, + "2210": select2098, + "22100": msg24266, + "22101": msg24267, + "22102": msg24268, + "22103": msg24269, + "22104": msg24270, + "22105": msg24271, + "22106": msg24272, + "22107": msg24273, + "22108": msg24274, + "22109": msg24275, + "2211": select2099, + "22110": msg24276, + "22111": msg24277, + "22112": msg24278, + "22113": msg24279, + "22114": msg24280, + "22115": msg24281, + "22116": msg24282, + "22117": msg24283, + "22118": msg24284, + "22119": msg24285, + "2212": select2100, + "22120": msg24286, + "22121": msg24287, + "22122": msg24288, + "22123": msg24289, + "22124": msg24290, + "22125": msg24291, + "22126": msg24292, + "22127": msg24293, + "22128": msg24294, + "22129": msg24295, + "2213": select2101, + "22130": msg24296, + "22131": msg24297, + "22132": msg24298, + "22133": msg24299, + "22134": msg24300, + "22135": msg24301, + "22136": msg24302, + "22137": msg24303, + "22138": msg24304, + "22139": msg24305, + "2214": select2102, + "22140": msg24306, + "22141": msg24307, + "22142": msg24308, + "22143": msg24309, + "22144": msg24310, + "22145": msg24311, + "22146": msg24312, + "22147": msg24313, + "22148": msg24314, + "22149": msg24315, + "2215": select2103, + "22150": msg24316, + "22151": msg24317, + "22152": msg24318, + "22153": msg24319, + "22154": msg24320, + "22155": msg24321, + "22156": msg24322, + "22157": msg24323, + "22158": msg24324, + "22159": msg24325, + "2216": select2104, + "22160": msg24326, + "22161": msg24327, + "22162": msg24328, + "22163": msg24329, + "22164": msg24330, + "22165": msg24331, + "22166": msg24332, + "22167": msg24333, + "22168": msg24334, + "22169": msg24335, + "2217": select2105, + "22170": msg24336, + "22171": msg24337, + "22172": msg24338, + "22173": msg24339, + "22174": msg24340, + "22175": msg24341, + "22176": msg24342, + "22177": msg24343, + "22178": msg24344, + "22179": msg24345, + "2218": select2106, + "22180": msg24346, + "22181": msg24347, + "22182": msg24348, + "22183": msg24349, + "22184": msg24350, + "22185": msg24351, + "22186": msg24352, + "22187": msg24353, + "22188": msg24354, + "22189": msg24355, + "2219": select2107, + "22190": msg24356, + "22191": msg24357, + "22192": msg24358, + "22193": msg24359, + "22194": msg24360, + "22195": msg24361, + "22196": msg24362, + "22197": msg24363, + "22198": msg24364, + "22199": msg24365, + "222": select147, + "2220": select2108, + "22200": msg24366, + "22201": msg24367, + "22202": msg24368, + "22203": msg24369, + "22204": msg24370, + "22205": msg24371, + "22206": msg24372, + "22207": msg24373, + "22208": msg24374, + "22209": msg24375, + "2221": select2109, + "22210": msg24376, + "22211": msg24377, + "22212": msg24378, + "22213": msg24379, + "22214": msg24380, + "22215": msg24381, + "22216": msg24382, + "22217": msg24383, + "22218": msg24384, + "22219": msg24385, + "2222": select2110, + "22220": msg24386, + "22221": msg24387, + "22222": msg24388, + "22223": msg24389, + "22224": msg24390, + "22225": msg24391, + "22226": msg24392, + "22227": msg24393, + "22228": msg24394, + "22229": msg24395, + "2223": select2111, + "22230": msg24396, + "22231": msg24397, + "22232": msg24398, + "22233": msg24399, + "22234": msg24400, + "22235": msg24401, + "22236": msg24402, + "22237": msg24403, + "22238": msg24404, + "22239": msg24405, + "2224": select2112, + "22240": msg24406, + "22241": msg24407, + "22242": msg24408, + "22243": msg24409, + "22244": msg24410, + "22245": msg24411, + "22246": msg24412, + "22247": msg24413, + "22248": msg24414, + "22249": msg24415, + "2225": select2113, + "22250": msg24416, + "22251": msg24417, + "22252": msg24418, + "22253": msg24419, + "22254": msg24420, + "22255": msg24421, + "22256": msg24422, + "22257": msg24423, + "22258": msg24424, + "22259": msg24425, + "2226": select2114, + "22260": msg24426, + "22261": msg24427, + "22262": msg24428, + "22263": msg24429, + "22264": msg24430, + "22265": msg24431, + "22266": msg24432, + "22267": msg24433, + "22268": msg24434, + "22269": msg24435, + "2227": select2115, + "22270": msg24436, + "22271": msg24437, + "22272": msg24438, + "22273": msg24439, + "22274": msg24440, + "22275": msg24441, + "22276": msg24442, + "22277": msg24443, + "22278": msg24444, + "22279": msg24445, + "2228": select2116, + "22280": msg24446, + "22281": msg24447, + "22282": msg24448, + "22283": msg24449, + "22284": msg24450, + "22285": msg24451, + "22286": msg24452, + "22287": msg24453, + "22288": msg24454, + "22289": msg24455, + "2229": select2117, + "22290": msg24456, + "22291": msg24457, + "22292": msg24458, + "22293": msg24459, + "22294": msg24460, + "22295": msg24461, + "22296": msg24462, + "22297": msg24463, + "22298": msg24464, + "22299": msg24465, + "223": select148, + "2230": select2118, + "22300": msg24466, + "22301": msg24467, + "22302": msg24468, + "22303": msg24469, + "22304": msg24470, + "22305": msg24471, + "22306": msg24472, + "22307": msg24473, + "22308": msg24474, + "22309": msg24475, + "2231": select2119, + "22310": msg24476, + "22311": msg24477, + "22312": msg24478, + "22313": msg24479, + "22314": msg24480, + "22315": msg24481, + "22316": msg24482, + "22317": msg24483, + "22318": msg24484, + "22319": msg24485, + "2232": select2120, + "22320": msg24486, + "22321": msg24487, + "22322": msg24488, + "22323": msg24489, + "22324": msg24490, + "22325": msg24491, + "22326": msg24492, + "22327": msg24493, + "22328": msg24494, + "22329": msg24495, + "2233": select2121, + "22330": msg24496, + "22331": msg24497, + "22332": msg24498, + "22333": msg24499, + "22334": msg24500, + "22335": msg24501, + "22336": msg24502, + "22337": msg24503, + "22338": msg24504, + "22339": msg24505, + "2234": select2122, + "22340": msg24506, + "22341": msg24507, + "22342": msg24508, + "22343": msg24509, + "22344": msg24510, + "22345": msg24511, + "22346": msg24512, + "22347": msg24513, + "22348": msg24514, + "22349": msg24515, + "2235": select2123, + "22350": msg24516, + "22351": msg24517, + "22352": msg24518, + "22353": msg24519, + "22354": msg24520, + "22355": msg24521, + "22356": msg24522, + "22357": msg24523, + "22358": msg24524, + "22359": msg24525, + "2236": select2124, + "22360": msg24526, + "22361": msg24527, + "22362": msg24528, + "22363": msg24529, + "22364": msg24530, + "22365": msg24531, + "22366": msg24532, + "22367": msg24533, + "22368": msg24534, + "22369": msg24535, + "2237": select2125, + "22370": msg24536, + "22371": msg24537, + "22372": msg24538, + "22373": msg24539, + "22374": msg24540, + "22375": msg24541, + "22376": msg24542, + "22377": msg24543, + "22378": msg24544, + "22379": msg24545, + "2238": select2126, + "22380": msg24546, + "22381": msg24547, + "22382": msg24548, + "22383": msg24549, + "22384": msg24550, + "22385": msg24551, + "22386": msg24552, + "22387": msg24553, + "22388": msg24554, + "22389": msg24555, + "2239": select2127, + "22390": msg24556, + "22391": msg24557, + "22392": msg24558, + "22393": msg24559, + "22394": msg24560, + "22395": msg24561, + "22396": msg24562, + "22397": msg24563, + "22398": msg24564, + "22399": msg24565, + "224": select149, + "2240": select2128, + "22400": msg24566, + "22401": msg24567, + "22402": msg24568, + "22403": msg24569, + "22404": msg24570, + "22405": msg24571, + "22406": msg24572, + "22407": msg24573, + "22408": msg24574, + "22409": msg24575, + "2241": select2129, + "22410": msg24576, + "22411": msg24577, + "22412": msg24578, + "22413": msg24579, + "22414": msg24580, + "22415": msg24581, + "22416": msg24582, + "22417": msg24583, + "22418": msg24584, + "22419": msg24585, + "2242": select2130, + "22420": msg24586, + "22421": msg24587, + "22422": msg24588, + "22423": msg24589, + "22424": msg24590, + "22425": msg24591, + "22426": msg24592, + "22427": msg24593, + "22428": msg24594, + "22429": msg24595, + "2243": select2131, + "22430": msg24596, + "22431": msg24597, + "22432": msg24598, + "22433": msg24599, + "22434": msg24600, + "22435": msg24601, + "22436": msg24602, + "22437": msg24603, + "22438": msg24604, + "22439": msg24605, + "2244": select2132, + "22440": msg24606, + "22441": msg24607, + "22442": msg24608, + "22443": msg24609, + "22444": msg24610, + "22445": msg24611, + "22446": msg24612, + "22447": msg24613, + "22448": msg24614, + "22449": msg24615, + "2245": select2133, + "22450": msg24616, + "22451": msg24617, + "22452": msg24618, + "22453": msg24619, + "22454": msg24620, + "22455": msg24621, + "22456": msg24622, + "22457": msg24623, + "22458": msg24624, + "22459": msg24625, + "2246": select2134, + "22460": msg24626, + "22461": msg24627, + "22462": msg24628, + "22463": msg24629, + "22464": msg24630, + "22465": msg24631, + "22466": msg24632, + "22467": msg24633, + "22468": msg24634, + "22469": msg24635, + "2247": select2135, + "22470": msg24636, + "22471": msg24637, + "22472": msg24638, + "22473": msg24639, + "22474": msg24640, + "22475": msg24641, + "22476": msg24642, + "22477": msg24643, + "22478": msg24644, + "22479": msg24645, + "2248": select2136, + "22480": msg24646, + "22481": msg24647, + "22482": msg24648, + "22483": msg24649, + "22484": msg24650, + "22485": msg24651, + "22486": msg24652, + "22487": msg24653, + "22488": msg24654, + "22489": msg24655, + "2249": select2137, + "22490": msg24656, + "22491": msg24657, + "22492": msg24658, + "22493": msg24659, + "22494": msg24660, + "22495": msg24661, + "22496": msg24662, + "22497": msg24663, + "22498": msg24664, + "22499": msg24665, + "225": select150, + "2250": select2138, + "22500": msg24666, + "22501": msg24667, + "22502": msg24668, + "22503": msg24669, + "22504": msg24670, + "22505": msg24671, + "22506": msg24672, + "22507": msg24673, + "22508": msg24674, + "22509": msg24675, + "2251": select2139, + "22510": msg24676, + "22511": msg24677, + "22512": msg24678, + "22513": msg24679, + "22514": msg24680, + "22515": msg24681, + "22516": msg24682, + "22517": msg24683, + "22518": msg24684, + "22519": msg24685, + "2252": select2140, + "22520": msg24686, + "22521": msg24687, + "22522": msg24688, + "22523": msg24689, + "22524": msg24690, + "22525": msg24691, + "22526": msg24692, + "22527": msg24693, + "22528": msg24694, + "22529": msg24695, + "2253": select2141, + "22530": msg24696, + "22531": msg24697, + "22532": msg24698, + "22533": msg24699, + "22534": msg24700, + "22535": msg24701, + "22536": msg24702, + "22537": msg24703, + "22538": msg24704, + "22539": msg24705, + "2254": select2142, + "22540": msg24706, + "22541": msg24707, + "22542": msg24708, + "22543": msg24709, + "22544": msg24710, + "22545": msg24711, + "22546": msg24712, + "22547": msg24713, + "22548": msg24714, + "22549": msg24715, + "2255": select2143, + "22550": msg24716, + "22551": msg24717, + "22552": msg24718, + "22553": msg24719, + "22554": msg24720, + "22555": msg24721, + "22556": msg24722, + "22557": msg24723, + "22558": msg24724, + "22559": msg24725, + "2256": select2144, + "22560": msg24726, + "22561": msg24727, + "22562": msg24728, + "22563": msg24729, + "22564": msg24730, + "22565": msg24731, + "22566": msg24732, + "22567": msg24733, + "22568": msg24734, + "22569": msg24735, + "2257": select2145, + "22570": msg24736, + "22571": msg24737, + "22572": msg24738, + "22573": msg24739, + "22574": msg24740, + "22575": msg24741, + "22576": msg24742, + "22577": msg24743, + "22578": msg24744, + "22579": msg24745, + "2258": select2146, + "22580": msg24746, + "22581": msg24747, + "22582": msg24748, + "22583": msg24749, + "22584": msg24750, + "22585": msg24751, + "22586": msg24752, + "22587": msg24753, + "22588": msg24754, + "22589": msg24755, + "2259": select2147, + "22590": msg24756, + "22591": msg24757, + "22592": msg24758, + "22593": msg24759, + "22594": msg24760, + "22595": msg24761, + "22596": msg24762, + "22597": msg24763, + "22598": msg24764, + "22599": msg24765, + "226": select151, + "2260": select2148, + "22600": msg24766, + "22601": msg24767, + "22602": msg24768, + "22603": msg24769, + "22604": msg24770, + "22605": msg24771, + "22606": msg24772, + "22607": msg24773, + "22608": msg24774, + "22609": msg24775, + "2261": select2149, + "22610": msg24776, + "22611": msg24777, + "22612": msg24778, + "22613": msg24779, + "22614": msg24780, + "22615": msg24781, + "22616": msg24782, + "22617": msg24783, + "22618": msg24784, + "22619": msg24785, + "2262": select2150, + "22620": msg24786, + "22621": msg24787, + "22622": msg24788, + "22623": msg24789, + "22624": msg24790, + "22625": msg24791, + "22626": msg24792, + "22627": msg24793, + "22628": msg24794, + "22629": msg24795, + "2263": select2151, + "22630": msg24796, + "22631": msg24797, + "22632": msg24798, + "22633": msg24799, + "22634": msg24800, + "22635": msg24801, + "22636": msg24802, + "22637": msg24803, + "22638": msg24804, + "22639": msg24805, + "2264": select2152, + "22640": msg24806, + "22641": msg24807, + "22642": msg24808, + "22643": msg24809, + "22644": msg24810, + "22645": msg24811, + "22646": msg24812, + "22647": msg24813, + "22648": msg24814, + "22649": msg24815, + "2265": select2153, + "22650": msg24816, + "22651": msg24817, + "22652": msg24818, + "22653": msg24819, + "22654": msg24820, + "22655": msg24821, + "22656": msg24822, + "22657": msg24823, + "22658": msg24824, + "22659": msg24825, + "2266": select2154, + "22660": msg24826, + "22661": msg24827, + "22662": msg24828, + "22663": msg24829, + "22664": msg24830, + "22665": msg24831, + "22666": msg24832, + "22667": msg24833, + "22668": msg24834, + "22669": msg24835, + "2267": select2155, + "22670": msg24836, + "22671": msg24837, + "22672": msg24838, + "22673": msg24839, + "22674": msg24840, + "22675": msg24841, + "22676": msg24842, + "22677": msg24843, + "22678": msg24844, + "22679": msg24845, + "2268": select2156, + "22680": msg24846, + "22681": msg24847, + "22682": msg24848, + "22683": msg24849, + "22684": msg24850, + "22685": msg24851, + "22686": msg24852, + "22687": msg24853, + "22688": msg24854, + "22689": msg24855, + "2269": select2157, + "22690": msg24856, + "22691": msg24857, + "22692": msg24858, + "22693": msg24859, + "22694": msg24860, + "22695": msg24861, + "22696": msg24862, + "22697": msg24863, + "22698": msg24864, + "22699": msg24865, + "227": select152, + "2270": select2158, + "22700": msg24866, + "22701": msg24867, + "22702": msg24868, + "22703": msg24869, + "22704": msg24870, + "22705": msg24871, + "22706": msg24872, + "22707": msg24873, + "22708": msg24874, + "22709": msg24875, + "2271": select2159, + "22710": msg24876, + "22711": msg24877, + "22712": msg24878, + "22713": msg24879, + "22714": msg24880, + "22715": msg24881, + "22716": msg24882, + "22717": msg24883, + "22718": msg24884, + "22719": msg24885, + "2272": select2160, + "22720": msg24886, + "22721": msg24887, + "22722": msg24888, + "22723": msg24889, + "22724": msg24890, + "22725": msg24891, + "22726": msg24892, + "22727": msg24893, + "22728": msg24894, + "22729": msg24895, + "2273": select2161, + "22730": msg24896, + "22731": msg24897, + "22732": msg24898, + "22733": msg24899, + "22734": msg24900, + "22735": msg24901, + "22736": msg24902, + "22737": msg24903, + "22738": msg24904, + "22739": msg24905, + "2274": select2162, + "22740": msg24906, + "22741": msg24907, + "22742": msg24908, + "22743": msg24909, + "22744": msg24910, + "22745": msg24911, + "22746": msg24912, + "22747": msg24913, + "22748": msg24914, + "22749": msg24915, + "2275": select2163, + "22750": msg24916, + "22751": msg24917, + "22752": msg24918, + "22753": msg24919, + "22754": msg24920, + "22755": msg24921, + "22756": msg24922, + "22757": msg24923, + "22758": msg24924, + "22759": msg24925, + "2276": select2164, + "22760": msg24926, + "22761": msg24927, + "22762": msg24928, + "22763": msg24929, + "22764": msg24930, + "22765": msg24931, + "22766": msg24932, + "22767": msg24933, + "22768": msg24934, + "22769": msg24935, + "2277": select2165, + "22770": msg24936, + "22771": msg24937, + "22772": msg24938, + "22773": msg24939, + "22774": msg24940, + "22775": msg24941, + "22776": msg24942, + "22777": msg24943, + "22778": msg24944, + "22779": msg24945, + "2278": select2166, + "22780": msg24946, + "22781": msg24947, + "22782": msg24948, + "22783": msg24949, + "22784": msg24950, + "22785": msg24951, + "22786": msg24952, + "22787": msg24953, + "22788": msg24954, + "22789": msg24955, + "2279": select2167, + "22790": msg24956, + "22791": msg24957, + "22792": msg24958, + "22793": msg24959, + "22794": msg24960, + "22795": msg24961, + "22796": msg24962, + "22797": msg24963, + "22798": msg24964, + "22799": msg24965, + "228": select153, + "2280": select2168, + "22800": msg24966, + "22801": msg24967, + "22802": msg24968, + "22803": msg24969, + "22804": msg24970, + "22805": msg24971, + "22806": msg24972, + "22807": msg24973, + "22808": msg24974, + "22809": msg24975, + "2281": select2169, + "22810": msg24976, + "22811": msg24977, + "22812": msg24978, + "22813": msg24979, + "22814": msg24980, + "22815": msg24981, + "22816": msg24982, + "22817": msg24983, + "22818": msg24984, + "22819": msg24985, + "2282": select2170, + "22820": msg24986, + "22821": msg24987, + "22822": msg24988, + "22823": msg24989, + "22824": msg24990, + "22825": msg24991, + "22826": msg24992, + "22827": msg24993, + "22828": msg24994, + "22829": msg24995, + "2283": select2171, + "22830": msg24996, + "22831": msg24997, + "22832": msg24998, + "22833": msg24999, + "22834": msg25000, + "22835": msg25001, + "22836": msg25002, + "22837": msg25003, + "22838": msg25004, + "22839": msg25005, + "2284": select2172, + "22840": msg25006, + "22841": msg25007, + "22842": msg25008, + "22843": msg25009, + "22844": msg25010, + "22845": msg25011, + "22846": msg25012, + "22847": msg25013, + "22848": msg25014, + "22849": msg25015, + "2285": select2173, + "22850": msg25016, + "22851": msg25017, + "22852": msg25018, + "22853": msg25019, + "22854": msg25020, + "22855": msg25021, + "22856": msg25022, + "22857": msg25023, + "22858": msg25024, + "22859": msg25025, + "2286": select2174, + "22860": msg25026, + "22861": msg25027, + "22862": msg25028, + "22863": msg25029, + "22864": msg25030, + "22865": msg25031, + "22866": msg25032, + "22867": msg25033, + "22868": msg25034, + "22869": msg25035, + "2287": select2175, + "22870": msg25036, + "22871": msg25037, + "22872": msg25038, + "22873": msg25039, + "22874": msg25040, + "22875": msg25041, + "22876": msg25042, + "22877": msg25043, + "22878": msg25044, + "22879": msg25045, + "2288": select2176, + "22880": msg25046, + "22881": msg25047, + "22882": msg25048, + "22883": msg25049, + "22884": msg25050, + "22885": msg25051, + "22886": msg25052, + "22887": msg25053, + "22888": msg25054, + "22889": msg25055, + "2289": select2177, + "22890": msg25056, + "22891": msg25057, + "22892": msg25058, + "22893": msg25059, + "22894": msg25060, + "22895": msg25061, + "22896": msg25062, + "22897": msg25063, + "22898": msg25064, + "22899": msg25065, + "229": select154, + "2290": select2178, + "22900": msg25066, + "22901": msg25067, + "22902": msg25068, + "22903": msg25069, + "22904": msg25070, + "22905": msg25071, + "22906": msg25072, + "22907": msg25073, + "22908": msg25074, + "22909": msg25075, + "2291": select2179, + "22910": msg25076, + "22911": msg25077, + "22912": msg25078, + "22913": msg25079, + "22914": msg25080, + "22915": msg25081, + "22916": msg25082, + "22917": msg25083, + "22918": msg25084, + "22919": msg25085, + "2292": select2180, + "22920": msg25086, + "22921": msg25087, + "22922": msg25088, + "22923": msg25089, + "22924": msg25090, + "22925": msg25091, + "22926": msg25092, + "22927": msg25093, + "22928": msg25094, + "22929": msg25095, + "2293": select2181, + "22930": msg25096, + "22931": msg25097, + "22932": msg25098, + "22933": msg25099, + "22934": msg25100, + "22935": msg25101, + "22936": msg25102, + "22937": msg25103, + "22938": msg25104, + "22939": msg25105, + "2294": select2182, + "22940": msg25106, + "22941": msg25107, + "22942": msg25108, + "22943": msg25109, + "22944": msg25110, + "22945": msg25111, + "22946": msg25112, + "22947": msg25113, + "22948": msg25114, + "22949": msg25115, + "2295": select2183, + "22950": msg25116, + "22951": msg25117, + "22952": msg25118, + "22953": msg25119, + "22954": msg25120, + "22955": msg25121, + "22956": msg25122, + "22957": msg25123, + "22958": msg25124, + "22959": msg25125, + "2296": select2184, + "22960": msg25126, + "22961": msg25127, + "22962": msg25128, + "22963": msg25129, + "22964": msg25130, + "22965": msg25131, + "22966": msg25132, + "22967": msg25133, + "22968": msg25134, + "22969": msg25135, + "2297": select2185, + "22970": msg25136, + "22971": msg25137, + "22972": msg25138, + "22973": msg25139, + "22974": msg25140, + "22975": msg25141, + "22976": msg25142, + "22977": msg25143, + "22978": msg25144, + "22979": msg25145, + "2298": select2186, + "22980": msg25146, + "22981": msg25147, + "22982": msg25148, + "22983": msg25149, + "22984": msg25150, + "22985": msg25151, + "22986": msg25152, + "22987": msg25153, + "22988": msg25154, + "22989": msg25155, + "2299": select2187, + "22990": msg25156, + "22991": msg25157, + "22992": msg25158, + "22993": msg25159, + "22994": msg25160, + "22995": msg25161, + "22996": msg25162, + "22997": msg25163, + "22998": msg25164, + "22999": msg25165, + "23": select23, + "230": select155, + "2300": select2188, + "23000": msg25166, + "23001": msg25167, + "23002": msg25168, + "23003": msg25169, + "23004": msg25170, + "23005": msg25171, + "23006": msg25172, + "23007": msg25173, + "23008": msg25174, + "23009": msg25175, + "2301": select2189, + "23010": msg25176, + "23011": msg25177, + "23012": msg25178, + "23013": msg25179, + "23014": msg25180, + "23015": msg25181, + "23016": msg25182, + "23017": msg25183, + "23018": msg25184, + "23019": msg25185, + "2302": select2190, + "23020": msg25186, + "23021": msg25187, + "23022": msg25188, + "23023": msg25189, + "23024": msg25190, + "23025": msg25191, + "23026": msg25192, + "23027": msg25193, + "23028": msg25194, + "23029": msg25195, + "2303": select2191, + "23030": msg25196, + "23031": msg25197, + "23032": msg25198, + "23033": msg25199, + "23034": msg25200, + "23035": msg25201, + "23036": msg25202, + "23037": msg25203, + "23038": msg25204, + "23039": msg25205, + "2304": select2192, + "23040": msg25206, + "23041": msg25207, + "23042": msg25208, + "23043": msg25209, + "23044": msg25210, + "23045": msg25211, + "23046": msg25212, + "23047": msg25213, + "23048": msg25214, + "23049": msg25215, + "2305": select2193, + "23050": msg25216, + "23051": msg25217, + "23054": msg25218, + "23055": msg25219, + "23056": msg25220, + "23057": msg25221, + "23058": msg25222, + "23059": msg25223, + "2306": select2194, + "23060": msg25224, + "23061": msg25225, + "23062": msg25226, + "23063": msg25227, + "23064": msg25228, + "23065": msg25229, + "23066": msg25230, + "23067": msg25231, + "23068": msg25232, + "23069": msg25233, + "2307": select2195, + "23070": msg25234, + "23071": msg25235, + "23072": msg25236, + "23073": msg25237, + "23074": msg25238, + "23075": msg25239, + "23076": msg25240, + "23077": msg25241, + "23078": msg25242, + "23079": msg25243, + "2308": select2196, + "23080": msg25244, + "23081": msg25245, + "23082": msg25246, + "23083": msg25247, + "23084": msg25248, + "23085": msg25249, + "23086": msg25250, + "23087": msg25251, + "23088": msg25252, + "23089": msg25253, + "2309": select2197, + "23090": msg25254, + "23091": msg25255, + "23092": msg25256, + "23093": msg25257, + "23094": msg25258, + "23095": msg25259, + "23096": msg25260, + "23097": msg25261, + "23098": msg25262, + "23099": msg25263, + "231": select156, + "2310": select2198, + "23100": msg25264, + "23101": msg25265, + "23102": msg25266, + "23103": msg25267, + "23104": msg25268, + "23105": msg25269, + "23106": msg25270, + "23107": msg25271, + "23108": msg25272, + "23109": msg25273, + "2311": select2199, + "23110": msg25274, + "23111": msg25275, + "23112": msg25276, + "23113": msg25277, + "23114": msg25278, + "23115": msg25279, + "23116": msg25280, + "23117": msg25281, + "23118": msg25282, + "23119": msg25283, + "2312": select2200, + "23120": msg25284, + "23121": msg25285, + "23122": msg25286, + "23123": msg25287, + "23124": msg25288, + "23125": msg25289, + "23126": msg25290, + "23127": msg25291, + "23128": msg25292, + "23129": msg25293, + "2313": select2201, + "23130": msg25294, + "23131": msg25295, + "23132": msg25296, + "23133": msg25297, + "23134": msg25298, + "23135": msg25299, + "23136": msg25300, + "23137": msg25301, + "23138": msg25302, + "23139": msg25303, + "2314": select2202, + "23140": msg25304, + "23141": msg25305, + "23142": msg25306, + "23143": msg25307, + "23144": msg25308, + "23145": msg25309, + "23146": msg25310, + "23147": msg25311, + "23148": msg25312, + "23149": msg25313, + "2315": select2203, + "23150": msg25314, + "23151": msg25315, + "23152": msg25316, + "23153": msg25317, + "23154": msg25318, + "23155": msg25319, + "23156": msg25320, + "23157": msg25321, + "23158": msg25322, + "23159": msg25323, + "2316": select2204, + "23160": msg25324, + "23161": msg25325, + "23162": msg25326, + "23163": msg25327, + "23164": msg25328, + "23165": msg25329, + "23166": msg25330, + "23167": msg25331, + "23168": msg25332, + "23169": msg25333, + "2317": select2205, + "23170": msg25334, + "23171": msg25335, + "23172": msg25336, + "23173": msg25337, + "23174": msg25338, + "23175": msg25339, + "23176": msg25340, + "23177": msg25341, + "23178": msg25342, + "23179": msg25343, + "2318": select2206, + "23180": msg25344, + "23181": msg25345, + "23182": msg25346, + "23183": msg25347, + "23184": msg25348, + "23185": msg25349, + "23186": msg25350, + "23187": msg25351, + "23188": msg25352, + "23189": msg25353, + "2319": select2207, + "23190": msg25354, + "23191": msg25355, + "23192": msg25356, + "23193": msg25357, + "23194": msg25358, + "23195": msg25359, + "23196": msg25360, + "23197": msg25361, + "23198": msg25362, + "23199": msg25363, + "232": select157, + "2320": select2208, + "23200": msg25364, + "23201": msg25365, + "23202": msg25366, + "23203": msg25367, + "23204": msg25368, + "23205": msg25369, + "23206": msg25370, + "23207": msg25371, + "23208": msg25372, + "23209": msg25373, + "2321": select2209, + "23210": msg25374, + "23211": msg25375, + "23212": msg25376, + "23213": msg25377, + "23214": msg25378, + "23215": msg25379, + "23216": msg25380, + "23217": msg25381, + "23218": msg25382, + "23219": msg25383, + "2322": select2210, + "23220": msg25384, + "23221": msg25385, + "23222": msg25386, + "23223": msg25387, + "23224": msg25388, + "23225": msg25389, + "23226": msg25390, + "23227": msg25391, + "23228": msg25392, + "23229": msg25393, + "2323": select2211, + "23230": msg25394, + "23231": msg25395, + "23232": msg25396, + "23233": msg25397, + "23234": msg25398, + "23235": msg25399, + "23236": msg25400, + "23237": msg25401, + "23238": msg25402, + "23239": msg25403, + "2324": select2212, + "23240": msg25404, + "23241": msg25405, + "23242": msg25406, + "23243": msg25407, + "23244": msg25408, + "23245": msg25409, + "23246": msg25410, + "23247": msg25411, + "23248": msg25412, + "23249": msg25413, + "2325": select2213, + "23250": msg25414, + "23251": msg25415, + "23252": msg25416, + "23253": msg25417, + "23254": msg25418, + "23255": msg25419, + "23256": msg25420, + "23257": msg25421, + "23258": msg25422, + "23259": msg25423, + "2326": select2214, + "23260": msg25424, + "23261": msg25425, + "23262": msg25426, + "23263": msg25427, + "23264": msg25428, + "23265": msg25429, + "23266": msg25430, + "23267": msg25431, + "23268": msg25432, + "23269": msg25433, + "2327": select2215, + "23270": msg25434, + "23271": msg25435, + "23272": msg25436, + "23273": msg25437, + "23274": msg25438, + "23275": msg25439, + "23276": msg25440, + "23277": msg25441, + "23278": msg25442, + "23279": msg25443, + "2328": select2216, + "23280": msg25444, + "23281": msg25445, + "23282": msg25446, + "23283": msg25447, + "23284": msg25448, + "23285": msg25449, + "23286": msg25450, + "23287": msg25451, + "23288": msg25452, + "23289": msg25453, + "2329": select2217, + "23290": msg25454, + "23291": msg25455, + "23292": msg25456, + "23293": msg25457, + "23294": msg25458, + "23295": msg25459, + "23296": msg25460, + "23297": msg25461, + "23298": msg25462, + "23299": msg25463, + "233": select158, + "2330": select2218, + "23300": msg25464, + "23301": msg25465, + "23302": msg25466, + "23303": msg25467, + "23304": msg25468, + "23305": msg25469, + "23306": msg25470, + "23307": msg25471, + "23308": msg25472, + "23309": msg25473, + "2331": select2219, + "23310": msg25474, + "23311": msg25475, + "23312": msg25476, + "23313": msg25477, + "23314": msg25478, + "23315": msg25479, + "23316": msg25480, + "23317": msg25481, + "23318": msg25482, + "23319": msg25483, + "2332": select2220, + "23320": msg25484, + "23321": msg25485, + "23322": msg25486, + "23323": msg25487, + "23324": msg25488, + "23325": msg25489, + "23326": msg25490, + "23327": msg25491, + "23328": msg25492, + "23329": msg25493, + "2333": select2221, + "23330": msg25494, + "23331": msg25495, + "23332": msg25496, + "23333": msg25497, + "23334": msg25498, + "23335": msg25499, + "23336": msg25500, + "23337": msg25501, + "23338": msg25502, + "23339": msg25503, + "2334": select2222, + "23340": msg25504, + "23341": msg25505, + "23342": msg25506, + "23343": msg25507, + "23344": msg25508, + "23345": msg25509, + "23346": msg25510, + "23347": msg25511, + "23348": msg25512, + "23349": msg25513, + "2335": select2223, + "23350": msg25514, + "23351": msg25515, + "23352": msg25516, + "23353": msg25517, + "23354": msg25518, + "23355": msg25519, + "23356": msg25520, + "23357": msg25521, + "23358": msg25522, + "23359": msg25523, + "2336": select2224, + "23360": msg25524, + "23361": msg25525, + "23362": msg25526, + "23363": msg25527, + "23364": msg25528, + "23365": msg25529, + "23366": msg25530, + "23367": msg25531, + "23368": msg25532, + "23369": msg25533, + "2337": select2225, + "23370": msg25534, + "23371": msg25535, + "23372": msg25536, + "23373": msg25537, + "23374": msg25538, + "23375": msg25539, + "23376": msg25540, + "23377": msg25541, + "23378": msg25542, + "23379": msg25543, + "2338": select2226, + "23380": msg25544, + "23381": msg25545, + "23382": msg25546, + "23383": msg25547, + "23384": msg25548, + "23385": msg25549, + "23386": msg25550, + "23387": msg25551, + "23388": msg25552, + "23389": msg25553, + "2339": select2227, + "23390": msg25554, + "23391": msg25555, + "23392": msg25556, + "23393": msg25557, + "23394": msg25558, + "23395": msg25559, + "23396": msg25560, + "23397": msg25561, + "23398": msg25562, + "23399": msg25563, + "234": select159, + "2340": select2228, + "23400": msg25564, + "23401": msg25565, + "23402": msg25566, + "23403": msg25567, + "23404": msg25568, + "23405": msg25569, + "23406": msg25570, + "23407": msg25571, + "23408": msg25572, + "23409": msg25573, + "2341": select2229, + "23410": msg25574, + "23411": msg25575, + "23412": msg25576, + "23413": msg25577, + "23414": msg25578, + "23415": msg25579, + "23416": msg25580, + "23417": msg25581, + "23418": msg25582, + "23419": msg25583, + "2342": select2230, + "23420": msg25584, + "23421": msg25585, + "23422": msg25586, + "23423": msg25587, + "23424": msg25588, + "23425": msg25589, + "23426": msg25590, + "23427": msg25591, + "23428": msg25592, + "23429": msg25593, + "2343": select2231, + "23430": msg25594, + "23431": msg25595, + "23432": msg25596, + "23433": msg25597, + "23434": msg25598, + "23435": msg25599, + "23436": msg25600, + "23437": msg25601, + "23438": msg25602, + "23439": msg25603, + "2344": select2232, + "23440": msg25604, + "23441": msg25605, + "23442": msg25606, + "23443": msg25607, + "23444": msg25608, + "23445": msg25609, + "23446": msg25610, + "23447": msg25611, + "23448": msg25612, + "23449": msg25613, + "2345": select2233, + "23450": msg25614, + "23451": msg25615, + "23452": msg25616, + "23453": msg25617, + "23454": msg25618, + "23455": msg25619, + "23456": msg25620, + "23457": msg25621, + "23458": msg25622, + "23459": msg25623, + "2346": select2234, + "23460": msg25624, + "23461": msg25625, + "23462": msg25626, + "23463": msg25627, + "23464": msg25628, + "23465": msg25629, + "23466": msg25630, + "23467": msg25631, + "23468": msg25632, + "23469": msg25633, + "2347": select2235, + "23470": msg25634, + "23471": msg25635, + "23472": msg25636, + "23473": msg25637, + "23474": msg25638, + "23475": msg25639, + "23476": msg25640, + "23477": msg25641, + "23478": msg25642, + "23479": msg25643, + "2348": select2236, + "23480": msg25644, + "23481": msg25645, + "23482": msg25646, + "23483": msg25647, + "23484": msg25648, + "23485": msg25649, + "23486": msg25650, + "23487": msg25651, + "23488": msg25652, + "23489": msg25653, + "2349": select2237, + "23490": msg25654, + "23491": msg25655, + "23492": msg25656, + "23493": msg25657, + "23494": msg25658, + "23495": msg25659, + "23496": msg25660, + "23497": msg25661, + "23498": msg25662, + "23499": msg25663, + "235": select160, + "2350": select2238, + "23500": msg25664, + "23501": msg25665, + "23502": msg25666, + "23503": msg25667, + "23504": msg25668, + "23505": msg25669, + "23506": msg25670, + "23507": msg25671, + "23508": msg25672, + "23509": msg25673, + "2351": select2239, + "23510": msg25674, + "23511": msg25675, + "23512": msg25676, + "23513": msg25677, + "23514": msg25678, + "23515": msg25679, + "23516": msg25680, + "23517": msg25681, + "23518": msg25682, + "23519": msg25683, + "2352": select2240, + "23520": msg25684, + "23521": msg25685, + "23522": msg25686, + "23523": msg25687, + "23524": msg25688, + "23525": msg25689, + "23526": msg25690, + "23527": msg25691, + "23528": msg25692, + "23529": msg25693, + "2353": select2241, + "23530": msg25694, + "23531": msg25695, + "23532": msg25696, + "23533": msg25697, + "23534": msg25698, + "23535": msg25699, + "23536": msg25700, + "23537": msg25701, + "23538": msg25702, + "23539": msg25703, + "2354": select2242, + "23540": msg25704, + "23541": msg25705, + "23542": msg25706, + "23543": msg25707, + "23544": msg25708, + "23545": msg25709, + "23546": msg25710, + "23547": msg25711, + "23548": msg25712, + "23549": msg25713, + "2355": select2243, + "23550": msg25714, + "23551": msg25715, + "23552": msg25716, + "23553": msg25717, + "23554": msg25718, + "23555": msg25719, + "23556": msg25720, + "23557": msg25721, + "23558": msg25722, + "23559": msg25723, + "2356": select2244, + "23560": msg25724, + "23561": msg25725, + "23562": msg25726, + "23563": msg25727, + "23564": msg25728, + "23565": msg25729, + "23566": msg25730, + "23567": msg25731, + "23568": msg25732, + "23569": msg25733, + "2357": select2245, + "23570": msg25734, + "23571": msg25735, + "23572": msg25736, + "23573": msg25737, + "23574": msg25738, + "23575": msg25739, + "23576": msg25740, + "23577": msg25741, + "23578": msg25742, + "23579": msg25743, + "2358": select2246, + "23580": msg25744, + "23581": msg25745, + "23582": msg25746, + "23583": msg25747, + "23584": msg25748, + "23585": msg25749, + "23586": msg25750, + "23587": msg25751, + "23588": msg25752, + "23589": msg25753, + "2359": select2247, + "23590": msg25754, + "23591": msg25755, + "23592": msg25756, + "23593": msg25757, + "23594": msg25758, + "23595": msg25759, + "23596": msg25760, + "23597": msg25761, + "23598": msg25762, + "23599": msg25763, + "236": select161, + "2360": select2248, + "23600": msg25764, + "23601": msg25765, + "23602": msg25766, + "23603": msg25767, + "23604": msg25768, + "23605": msg25769, + "23606": msg25770, + "23607": msg25771, + "23608": msg25772, + "23609": msg25773, + "2361": select2249, + "23610": msg25774, + "23611": msg25775, + "23612": msg25776, + "23613": msg25777, + "23614": msg25778, + "23615": msg25779, + "23616": msg25780, + "23617": msg25781, + "23618": msg25782, + "23619": msg25783, + "2362": select2250, + "23620": msg25784, + "23621": msg25785, + "23622": msg25786, + "23623": msg25787, + "23624": msg25788, + "23625": msg25789, + "23626": msg25790, + "23627": msg25791, + "23628": msg25792, + "23629": msg25793, + "2363": select2251, + "23630": msg25794, + "23631": msg25795, + "23632": msg25796, + "23633": msg25797, + "23634": msg25798, + "23635": msg25799, + "23636": msg25800, + "23637": msg25801, + "23638": msg25802, + "23639": msg25803, + "2364": select2252, + "23640": msg25804, + "23641": msg25805, + "23642": msg25806, + "23643": msg25807, + "23644": msg25808, + "23645": msg25809, + "23646": msg25810, + "23647": msg25811, + "23648": msg25812, + "23649": msg25813, + "2365": select2253, + "23650": msg25814, + "23651": msg25815, + "23652": msg25816, + "23653": msg25817, + "23654": msg25818, + "23655": msg25819, + "23656": msg25820, + "23657": msg25821, + "23658": msg25822, + "23659": msg25823, + "2366": select2254, + "23660": msg25824, + "23661": msg25825, + "23662": msg25826, + "23663": msg25827, + "23664": msg25828, + "23665": msg25829, + "23666": msg25830, + "23667": msg25831, + "23668": msg25832, + "23669": msg25833, + "2367": select2255, + "23670": msg25834, + "23671": msg25835, + "23672": msg25836, + "23673": msg25837, + "23674": msg25838, + "23675": msg25839, + "23676": msg25840, + "23677": msg25841, + "23678": msg25842, + "23679": msg25843, + "2368": select2256, + "23680": msg25844, + "23681": msg25845, + "23682": msg25846, + "23683": msg25847, + "23684": msg25848, + "23685": msg25849, + "23686": msg25850, + "23687": msg25851, + "23688": msg25852, + "23689": msg25853, + "2369": select2257, + "23690": msg25854, + "23691": msg25855, + "23692": msg25856, + "23693": msg25857, + "23694": msg25858, + "23695": msg25859, + "23696": msg25860, + "23697": msg25861, + "23698": msg25862, + "23699": msg25863, + "237": select162, + "2370": select2258, + "23700": msg25864, + "23701": msg25865, + "23702": msg25866, + "23703": msg25867, + "23704": msg25868, + "23705": msg25869, + "23706": msg25870, + "23707": msg25871, + "23708": msg25872, + "23709": msg25873, + "2371": select2259, + "23710": msg25874, + "23711": msg25875, + "23712": msg25876, + "23713": msg25877, + "23714": msg25878, + "23715": msg25879, + "23716": msg25880, + "23717": msg25881, + "23718": msg25882, + "23719": msg25883, + "2372": select2260, + "23720": msg25884, + "23721": msg25885, + "23722": msg25886, + "23723": msg25887, + "23724": msg25888, + "23725": msg25889, + "23726": msg25890, + "23727": msg25891, + "23728": msg25892, + "23729": msg25893, + "2373": select2261, + "23730": msg25894, + "23731": msg25895, + "23732": msg25896, + "23733": msg25897, + "23734": msg25898, + "23735": msg25899, + "23736": msg25900, + "23737": msg25901, + "23738": msg25902, + "23739": msg25903, + "2374": select2262, + "23740": msg25904, + "23741": msg25905, + "23742": msg25906, + "23743": msg25907, + "23744": msg25908, + "23745": msg25909, + "23746": msg25910, + "23747": msg25911, + "23748": msg25912, + "23749": msg25913, + "2375": select2263, + "23750": msg25914, + "23751": msg25915, + "23752": msg25916, + "23753": msg25917, + "23754": msg25918, + "23755": msg25919, + "23756": msg25920, + "23757": msg25921, + "23758": msg25922, + "23759": msg25923, + "2376": select2264, + "23760": msg25924, + "23761": msg25925, + "23762": msg25926, + "23763": msg25927, + "23764": msg25928, + "23765": msg25929, + "23766": msg25930, + "23767": msg25931, + "23768": msg25932, + "23769": msg25933, + "2377": select2265, + "23770": msg25934, + "23771": msg25935, + "23772": msg25936, + "23773": msg25937, + "23774": msg25938, + "23775": msg25939, + "23776": msg25940, + "23777": msg25941, + "23778": msg25942, + "23779": msg25943, + "2378": select2266, + "23780": msg25944, + "23781": msg25945, + "23782": msg25946, + "23783": msg25947, + "23784": msg25948, + "23785": msg25949, + "23786": msg25950, + "23787": msg25951, + "23788": msg25952, + "23789": msg25953, + "2379": select2267, + "23790": msg25954, + "23791": msg25955, + "23792": msg25956, + "23793": msg25957, + "23794": msg25958, + "23795": msg25959, + "23796": msg25960, + "23797": msg25961, + "23798": msg25962, + "23799": msg25963, + "238": select163, + "2380": select2268, + "23800": msg25964, + "23801": msg25965, + "23802": msg25966, + "23803": msg25967, + "23804": msg25968, + "23805": msg25969, + "23806": msg25970, + "23807": msg25971, + "23808": msg25972, + "23809": msg25973, + "2381": select2269, + "23810": msg25974, + "23811": msg25975, + "23812": msg25976, + "23813": msg25977, + "23814": msg25978, + "23815": msg25979, + "23816": msg25980, + "23817": msg25981, + "23818": msg25982, + "23819": msg25983, + "2382": select2270, + "23820": msg25984, + "23821": msg25985, + "23822": msg25986, + "23823": msg25987, + "23824": msg25988, + "23825": msg25989, + "23826": msg25990, + "23827": msg25991, + "23828": msg25992, + "23829": msg25993, + "2383": select2271, + "23830": msg25994, + "23831": msg25995, + "23832": msg25996, + "23833": msg25997, + "23834": msg25998, + "23835": msg25999, + "23836": msg26000, + "23837": msg26001, + "23838": msg26002, + "23839": msg26003, + "2384": select2272, + "23840": msg26004, + "23841": msg26005, + "23842": msg26006, + "23843": msg26007, + "23844": msg26008, + "23845": msg26009, + "23846": msg26010, + "23847": msg26011, + "23848": msg26012, + "23849": msg26013, + "2385": select2273, + "23850": msg26014, + "23851": msg26015, + "23852": msg26016, + "23853": msg26017, + "23854": msg26018, + "23855": msg26019, + "23856": msg26020, + "23857": msg26021, + "23858": msg26022, + "23859": msg26023, + "2386": select2274, + "23860": msg26024, + "23861": msg26025, + "23862": msg26026, + "23863": msg26027, + "23864": msg26028, + "23865": msg26029, + "23866": msg26030, + "23867": msg26031, + "23868": msg26032, + "23869": msg26033, + "2387": select2275, + "23870": msg26034, + "23871": msg26035, + "23872": msg26036, + "23873": msg26037, + "23874": msg26038, + "23875": msg26039, + "23876": msg26040, + "23877": msg26041, + "23878": msg26042, + "23879": msg26043, + "2388": select2276, + "23880": msg26044, + "23881": msg26045, + "23882": msg26046, + "23883": msg26047, + "23884": msg26048, + "23885": msg26049, + "23886": msg26050, + "23887": msg26051, + "23888": msg26052, + "23889": msg26053, + "2389": select2277, + "23890": msg26054, + "23891": msg26055, + "23892": msg26056, + "23893": msg26057, + "23894": msg26058, + "23895": msg26059, + "23896": msg26060, + "23897": msg26061, + "23898": msg26062, + "23899": msg26063, + "239": select164, + "2390": select2278, + "23900": msg26064, + "23901": msg26065, + "23902": msg26066, + "23903": msg26067, + "23904": msg26068, + "23905": msg26069, + "23906": msg26070, + "23907": msg26071, + "23908": msg26072, + "23909": msg26073, + "2391": select2279, + "23910": msg26074, + "23911": msg26075, + "23912": msg26076, + "23913": msg26077, + "23914": msg26078, + "23915": msg26079, + "23916": msg26080, + "23917": msg26081, + "23918": msg26082, + "23919": msg26083, + "2392": select2280, + "23920": msg26084, + "23921": msg26085, + "23922": msg26086, + "23923": msg26087, + "23924": msg26088, + "23925": msg26089, + "23926": msg26090, + "23927": msg26091, + "23928": msg26092, + "23929": msg26093, + "2393": select2281, + "23930": msg26094, + "23931": msg26095, + "23932": msg26096, + "23933": msg26097, + "23934": msg26098, + "23935": msg26099, + "23936": msg26100, + "23937": msg26101, + "23938": msg26102, + "23939": msg26103, + "2394": select2282, + "23940": msg26104, + "23941": msg26105, + "23942": msg26106, + "23943": msg26107, + "23944": msg26108, + "23945": msg26109, + "23946": msg26110, + "23947": msg26111, + "23948": msg26112, + "23949": msg26113, + "2395": select2283, + "23950": msg26114, + "23951": msg26115, + "23952": msg26116, + "23953": msg26117, + "23954": msg26118, + "23955": msg26119, + "23956": msg26120, + "23957": msg26121, + "23958": msg26122, + "23959": msg26123, + "2396": select2284, + "23960": msg26124, + "23961": msg26125, + "23962": msg26126, + "23963": msg26127, + "23964": msg26128, + "23965": msg26129, + "23966": msg26130, + "23967": msg26131, + "23968": msg26132, + "23969": msg26133, + "2397": select2285, + "23970": msg26134, + "23971": msg26135, + "23972": msg26136, + "23973": msg26137, + "23974": msg26138, + "23975": msg26139, + "23976": msg26140, + "23977": msg26141, + "23978": msg26142, + "23979": msg26143, + "2398": select2286, + "23980": msg26144, + "23981": msg26145, + "23982": msg26146, + "23983": msg26147, + "23984": msg26148, + "23985": msg26149, + "23986": msg26150, + "23987": msg26151, + "23988": msg26152, + "23989": msg26153, + "2399": select2287, + "23990": msg26154, + "23991": msg26155, + "23992": msg26156, + "23993": msg26157, + "23994": msg26158, + "23995": msg26159, + "23996": msg26160, + "23997": msg26161, + "23998": msg26162, + "23999": msg26163, + "24": msg57, + "240": select165, + "2400": select2288, + "24000": msg26164, + "24001": msg26165, + "24002": msg26166, + "24003": msg26167, + "24004": msg26168, + "24005": msg26169, + "24006": msg26170, + "24007": msg26171, + "24008": msg26172, + "24009": msg26173, + "2401": select2289, + "24010": msg26174, + "24011": msg26175, + "24012": msg26176, + "24013": msg26177, + "24014": msg26178, + "24015": msg26179, + "24016": msg26180, + "24017": msg26181, + "24018": msg26182, + "24019": msg26183, + "2402": select2290, + "24020": msg26184, + "24021": msg26185, + "24022": msg26186, + "24023": msg26187, + "24024": msg26188, + "24025": msg26189, + "24026": msg26190, + "24027": msg26191, + "24028": msg26192, + "24029": msg26193, + "2403": select2291, + "24030": msg26194, + "24031": msg26195, + "24032": msg26196, + "24033": msg26197, + "24034": msg26198, + "24035": msg26199, + "24036": msg26200, + "24037": msg26201, + "24038": msg26202, + "24039": msg26203, + "2404": select2292, + "24040": msg26204, + "2404003": msg38420, + "2404011": msg38421, + "2404013": msg38422, + "2404015": msg38423, + "2404016": msg38424, + "24041": msg26205, + "24042": msg26206, + "24043": msg26207, + "24044": msg26208, + "24045": msg26209, + "24046": msg26210, + "24047": msg26211, + "24048": msg26212, + "24049": msg26213, + "2405": select2293, + "24050": msg26214, + "24051": msg26215, + "24052": msg26216, + "24053": msg26217, + "24054": msg26218, + "24055": msg26219, + "24056": msg26220, + "24057": msg26221, + "24058": msg26222, + "24059": msg26223, + "2406": select2294, + "24060": msg26224, + "24061": msg26225, + "24062": msg26226, + "24063": msg26227, + "24064": msg26228, + "24065": msg26229, + "24066": msg26230, + "24067": msg26231, + "24068": msg26232, + "24069": msg26233, + "2407": select2295, + "24070": msg26234, + "24071": msg26235, + "24072": msg26236, + "24073": msg26237, + "24074": msg26238, + "24075": msg26239, + "24076": msg26240, + "24077": msg26241, + "24078": msg26242, + "24079": msg26243, + "2408": select2296, + "24080": msg26244, + "24081": msg26245, + "24082": msg26246, + "24083": msg26247, + "24084": msg26248, + "24085": msg26249, + "24086": msg26250, + "24087": msg26251, + "24088": msg26252, + "24089": msg26253, + "2409": select2297, + "24090": msg26254, + "24091": msg26255, + "24092": msg26256, + "24093": msg26257, + "24094": msg26258, + "24095": msg26259, + "24096": msg26260, + "24097": msg26261, + "24098": msg26262, + "24099": msg26263, + "241": select166, + "2410": select2298, + "24100": msg26264, + "24101": msg26265, + "24102": msg26266, + "24103": msg26267, + "24104": msg26268, + "24105": msg26269, + "24106": msg26270, + "24107": msg26271, + "24108": msg26272, + "24109": msg26273, + "2411": select2299, + "24110": msg26274, + "24111": msg26275, + "24112": msg26276, + "24113": msg26277, + "24114": msg26278, + "24115": msg26279, + "24116": msg26280, + "24117": msg26281, + "24118": msg26282, + "24119": msg26283, + "2412": select2300, + "24120": msg26284, + "24121": msg26285, + "24122": msg26286, + "24123": msg26287, + "24124": msg26288, + "24125": msg26289, + "24126": msg26290, + "24127": msg26291, + "24128": msg26292, + "24129": msg26293, + "2413": select2301, + "24130": msg26294, + "24131": msg26295, + "24132": msg26296, + "24133": msg26297, + "24134": msg26298, + "24135": msg26299, + "24136": msg26300, + "24137": msg26301, + "24138": msg26302, + "24139": msg26303, + "2414": select2302, + "24140": msg26304, + "24141": msg26305, + "24142": msg26306, + "24143": msg26307, + "24144": msg26308, + "24145": msg26309, + "24146": msg26310, + "24147": msg26311, + "24148": msg26312, + "24149": msg26313, + "2415": select2303, + "24150": msg26314, + "24151": msg26315, + "24152": msg26316, + "24153": msg26317, + "24154": msg26318, + "24155": msg26319, + "24156": msg26320, + "24157": msg26321, + "24158": msg26322, + "24159": msg26323, + "2416": select2304, + "24160": msg26324, + "24161": msg26325, + "24162": msg26326, + "24163": msg26327, + "24164": msg26328, + "24165": msg26329, + "24166": msg26330, + "24167": msg26331, + "24168": msg26332, + "24169": msg26333, + "2417": select2305, + "24170": msg26334, + "24171": msg26335, + "24172": msg26336, + "24173": msg26337, + "24174": msg26338, + "24175": msg26339, + "24176": msg26340, + "24177": msg26341, + "24178": msg26342, + "24179": msg26343, + "2418": select2306, + "24180": msg26344, + "24181": msg26345, + "24182": msg26346, + "24183": msg26347, + "24184": msg26348, + "24185": msg26349, + "24186": msg26350, + "24187": msg26351, + "24188": msg26352, + "24189": msg26353, + "2419": select2307, + "24190": msg26354, + "24191": msg26355, + "24192": msg26356, + "24193": msg26357, + "24194": msg26358, + "24195": msg26359, + "24196": msg26360, + "24197": msg26361, + "24198": msg26362, + "24199": msg26363, + "2420": select2308, + "24200": msg26364, + "24201": msg26365, + "24202": msg26366, + "24203": msg26367, + "24204": msg26368, + "24205": msg26369, + "24206": msg26370, + "24207": msg26371, + "24208": msg26372, + "24209": msg26373, + "2421": select2309, + "24210": msg26374, + "24211": msg26375, + "24212": msg26376, + "24213": msg26377, + "24214": msg26378, + "24215": msg26379, + "24216": msg26380, + "24217": msg26381, + "24218": msg26382, + "24219": msg26383, + "2422": select2310, + "24220": msg26384, + "24221": msg26385, + "24222": msg26386, + "24223": msg26387, + "24224": msg26388, + "24225": msg26389, + "24226": msg26390, + "24227": msg26391, + "24228": msg26392, + "24229": msg26393, + "2423": select2311, + "24230": msg26394, + "24231": msg26395, + "24232": msg26396, + "24233": msg26397, + "24234": msg26398, + "24235": msg26399, + "24236": msg26400, + "24237": msg26401, + "24238": msg26402, + "24239": msg26403, + "2424": select2312, + "24240": msg26404, + "24241": msg26405, + "24242": msg26406, + "24243": msg26407, + "24244": msg26408, + "24245": msg26409, + "24246": msg26410, + "24247": msg26411, + "24248": msg26412, + "24249": msg26413, + "2425": select2313, + "24250": msg26414, + "24251": msg26415, + "24252": msg26416, + "24253": msg26417, + "24254": msg26418, + "24255": msg26419, + "24256": msg26420, + "24257": msg26421, + "24258": msg26422, + "24259": msg26423, + "2426": select2314, + "24260": msg26424, + "24261": msg26425, + "24262": msg26426, + "24263": msg26427, + "24264": msg26428, + "24265": msg26429, + "24266": msg26430, + "24267": msg26431, + "24268": msg26432, + "24269": msg26433, + "2427": select2315, + "24270": msg26434, + "24271": msg26435, + "24272": msg26436, + "24273": msg26437, + "24274": msg26438, + "24275": msg26439, + "24276": msg26440, + "24277": msg26441, + "24278": msg26442, + "24279": msg26443, + "2428": select2316, + "24280": msg26444, + "24281": msg26445, + "24282": msg26446, + "24283": msg26447, + "24284": msg26448, + "24285": msg26449, + "24286": msg26450, + "24287": msg26451, + "24288": msg26452, + "24289": msg26453, + "2429": select2317, + "24290": msg26454, + "24291": msg26455, + "24292": msg26456, + "24293": msg26457, + "24294": msg26458, + "24295": msg26459, + "24296": msg26460, + "24297": msg26461, + "24298": msg26462, + "24299": msg26463, + "243": select167, + "2430": select2318, + "24300": msg26464, + "24301": msg26465, + "24302": msg26466, + "24303": msg26467, + "24304": msg26468, + "24305": msg26469, + "24306": msg26470, + "24307": msg26471, + "24308": msg26472, + "24309": msg26473, + "2431": select2319, + "24310": msg26474, + "24311": msg26475, + "24312": msg26476, + "24313": msg26477, + "24314": msg26478, + "24315": msg26479, + "24316": msg26480, + "24317": msg26481, + "24318": msg26482, + "24319": msg26483, + "2432": select2320, + "24320": msg26484, + "24321": msg26485, + "24322": msg26486, + "24323": msg26487, + "24324": msg26488, + "24325": msg26489, + "24326": msg26490, + "24327": msg26491, + "24328": msg26492, + "24329": msg26493, + "2433": select2321, + "24330": msg26494, + "24331": msg26495, + "24332": msg26496, + "24333": msg26497, + "24334": msg26498, + "24335": msg26499, + "24336": msg26500, + "24337": msg26501, + "24338": msg26502, + "24339": msg26503, + "2434": select2322, + "24340": msg26504, + "24341": msg26505, + "24342": msg26506, + "24343": msg26507, + "24344": msg26508, + "24345": msg26509, + "24346": msg26510, + "24347": msg26511, + "24348": msg26512, + "24349": msg26513, + "2435": select2323, + "24350": msg26514, + "24351": msg26515, + "24352": msg26516, + "24353": msg26517, + "24354": msg26518, + "24355": msg26519, + "24356": msg26520, + "24357": msg26521, + "24358": msg26522, + "24359": msg26523, + "2436": select2324, + "24360": msg26524, + "24361": msg26525, + "24362": msg26526, + "24363": msg26527, + "24364": msg26528, + "24365": msg26529, + "24366": msg26530, + "24367": msg26531, + "24368": msg26532, + "24369": msg26533, + "2437": select2325, + "24370": msg26534, + "24371": msg26535, + "24372": msg26536, + "24373": msg26537, + "24374": msg26538, + "24375": msg26539, + "24376": msg26540, + "24377": msg26541, + "24378": msg26542, + "24379": msg26543, + "2438": select2326, + "24380": msg26544, + "24381": msg26545, + "24382": msg26546, + "24383": msg26547, + "24384": msg26548, + "24385": msg26549, + "24386": msg26550, + "24387": msg26551, + "24388": msg26552, + "24389": msg26553, + "2439": select2327, + "24390": msg26554, + "24391": msg26555, + "24392": msg26556, + "24393": msg26557, + "24394": msg26558, + "24395": msg26559, + "24396": msg26560, + "24397": msg26561, + "24398": msg26562, + "24399": msg26563, + "244": select168, + "2440": select2328, + "24400": msg26564, + "24401": msg26565, + "24402": msg26566, + "24403": msg26567, + "24404": msg26568, + "24405": msg26569, + "24406": msg26570, + "24407": msg26571, + "24408": msg26572, + "24409": msg26573, + "2441": select2329, + "24410": msg26574, + "24411": msg26575, + "24412": msg26576, + "24413": msg26577, + "24414": msg26578, + "24415": msg26579, + "24416": msg26580, + "24417": msg26581, + "24418": msg26582, + "24419": msg26583, + "2442": select2330, + "24420": msg26584, + "24421": msg26585, + "24422": msg26586, + "24423": msg26587, + "24424": msg26588, + "24425": msg26589, + "24426": msg26590, + "24427": msg26591, + "24428": msg26592, + "24429": msg26593, + "2443": select2331, + "24430": msg26594, + "24431": msg26595, + "24432": msg26596, + "24433": msg26597, + "24434": msg26598, + "24435": msg26599, + "24436": msg26600, + "24437": msg26601, + "24438": msg26602, + "24439": msg26603, + "2444": select2332, + "24440": msg26604, + "24441": msg26605, + "24442": msg26606, + "24443": msg26607, + "24444": msg26608, + "24445": msg26609, + "24446": msg26610, + "24447": msg26611, + "24448": msg26612, + "24449": msg26613, + "2445": select2333, + "24450": msg26614, + "24451": msg26615, + "24452": msg26616, + "24453": msg26617, + "24454": msg26618, + "24455": msg26619, + "24456": msg26620, + "24457": msg26621, + "24458": msg26622, + "24459": msg26623, + "2446": select2334, + "24460": msg26624, + "24461": msg26625, + "24462": msg26626, + "24463": msg26627, + "24464": msg26628, + "24465": msg26629, + "24466": msg26630, + "24467": msg26631, + "24468": msg26632, + "24469": msg26633, + "2447": select2335, + "24470": msg26634, + "24471": msg26635, + "24472": msg26636, + "24473": msg26637, + "24474": msg26638, + "24475": msg26639, + "24476": msg26640, + "24477": msg26641, + "24478": msg26642, + "24479": msg26643, + "2448": select2336, + "24480": msg26644, + "24481": msg26645, + "24482": msg26646, + "24483": msg26647, + "24484": msg26648, + "24485": msg26649, + "24486": msg26650, + "24487": msg26651, + "24488": msg26652, + "24489": msg26653, + "2449": select2337, + "24490": msg26654, + "24491": msg26655, + "24492": msg26656, + "24493": msg26657, + "24494": msg26658, + "24495": msg26659, + "24496": msg26660, + "24497": msg26661, + "24498": msg26662, + "24499": msg26663, + "245": select169, + "2450": select2338, + "24500": msg26664, + "24501": msg26665, + "24502": msg26666, + "24503": msg26667, + "24504": msg26668, + "24505": msg26669, + "24506": msg26670, + "24507": msg26671, + "24508": msg26672, + "24509": msg26673, + "2451": select2339, + "24510": msg26674, + "24511": msg26675, + "24512": msg26676, + "24513": msg26677, + "24514": msg26678, + "24515": msg26679, + "24516": msg26680, + "24517": msg26681, + "24518": msg26682, + "24519": msg26683, + "2452": select2340, + "24520": msg26684, + "24521": msg26685, + "24522": msg26686, + "24523": msg26687, + "24524": msg26688, + "24525": msg26689, + "24526": msg26690, + "24527": msg26691, + "24528": msg26692, + "24529": msg26693, + "2453": select2341, + "24530": msg26694, + "24531": msg26695, + "24532": msg26696, + "24533": msg26697, + "24534": msg26698, + "24535": msg26699, + "24536": msg26700, + "24537": msg26701, + "24538": msg26702, + "24539": msg26703, + "2454": select2342, + "24540": msg26704, + "24541": msg26705, + "24542": msg26706, + "24543": msg26707, + "24544": msg26708, + "24545": msg26709, + "24546": msg26710, + "24547": msg26711, + "24548": msg26712, + "24549": msg26713, + "2455": select2343, + "24550": msg26714, + "24551": msg26715, + "24552": msg26716, + "24553": msg26717, + "24554": msg26718, + "24555": msg26719, + "24556": msg26720, + "24557": msg26721, + "24558": msg26722, + "24559": msg26723, + "2456": select2344, + "24560": msg26724, + "24561": msg26725, + "24562": msg26726, + "24563": msg26727, + "24564": msg26728, + "24565": msg26729, + "24566": msg26730, + "24567": msg26731, + "24568": msg26732, + "24569": msg26733, + "2457": select2345, + "24570": msg26734, + "24571": msg26735, + "24572": msg26736, + "24573": msg26737, + "24574": msg26738, + "24575": msg26739, + "24576": msg26740, + "24577": msg26741, + "24578": msg26742, + "24579": msg26743, + "2458": select2346, + "24580": msg26744, + "24581": msg26745, + "24582": msg26746, + "24583": msg26747, + "24584": msg26748, + "24585": msg26749, + "24586": msg26750, + "24587": msg26751, + "24588": msg26752, + "24589": msg26753, + "2459": select2347, + "24590": msg26754, + "24591": msg26755, + "24592": msg26756, + "24593": msg26757, + "24594": msg26758, + "24595": msg26759, + "24596": msg26760, + "24597": msg26761, + "24598": msg26762, + "24599": msg26763, + "246": select170, + "2460": select2348, + "24600": msg26764, + "24601": msg26765, + "24602": msg26766, + "24603": msg26767, + "24604": msg26768, + "24605": msg26769, + "24606": msg26770, + "24607": msg26771, + "24608": msg26772, + "24609": msg26773, + "2461": select2349, + "24610": msg26774, + "24611": msg26775, + "24612": msg26776, + "24613": msg26777, + "24614": msg26778, + "24615": msg26779, + "24616": msg26780, + "24617": msg26781, + "24618": msg26782, + "24619": msg26783, + "2462": select2350, + "24620": msg26784, + "24621": msg26785, + "24622": msg26786, + "24623": msg26787, + "24624": msg26788, + "24625": msg26789, + "24626": msg26790, + "24627": msg26791, + "24628": msg26792, + "24629": msg26793, + "2463": select2351, + "24630": msg26794, + "24631": msg26795, + "24632": msg26796, + "24633": msg26797, + "24634": msg26798, + "24635": msg26799, + "24636": msg26800, + "24637": msg26801, + "24638": msg26802, + "24639": msg26803, + "2464": select2352, + "24640": msg26804, + "24641": msg26805, + "24642": msg26806, + "24643": msg26807, + "24644": msg26808, + "24645": msg26809, + "24646": msg26810, + "24647": msg26811, + "24648": msg26812, + "24649": msg26813, + "2465": select2353, + "24650": msg26814, + "24651": msg26815, + "24652": msg26816, + "24653": msg26817, + "24654": msg26818, + "24655": msg26819, + "24656": msg26820, + "24657": msg26821, + "24658": msg26822, + "24659": msg26823, + "2466": select2354, + "24660": msg26824, + "24661": msg26825, + "24662": msg26826, + "24663": msg26827, + "24664": msg26828, + "24665": msg26829, + "24666": msg26830, + "24667": msg26831, + "24668": msg26832, + "24669": msg26833, + "2467": select2355, + "24670": msg26834, + "24671": msg26835, + "24672": msg26836, + "24673": msg26837, + "24674": msg26838, + "24675": msg26839, + "24676": msg26840, + "24677": msg26841, + "24678": msg26842, + "24679": msg26843, + "2468": select2356, + "24680": msg26844, + "24681": msg26845, + "24682": msg26846, + "24683": msg26847, + "24684": msg26848, + "24685": msg26849, + "24686": msg26850, + "24687": msg26851, + "24688": msg26852, + "24689": msg26853, + "2469": select2357, + "24690": msg26854, + "24691": msg26855, + "24692": msg26856, + "24693": msg26857, + "24694": msg26858, + "24695": msg26859, + "24696": msg26860, + "24697": msg26861, + "24698": msg26862, + "24699": msg26863, + "247": select171, + "2470": select2358, + "24700": msg26864, + "24701": msg26865, + "24702": msg26866, + "24703": msg26867, + "24704": msg26868, + "24705": msg26869, + "24706": msg26870, + "24707": msg26871, + "24708": msg26872, + "24709": msg26873, + "2471": select2359, + "24710": msg26874, + "24711": msg26875, + "24712": msg26876, + "24713": msg26877, + "24714": msg26878, + "24715": msg26879, + "24716": msg26880, + "24717": msg26881, + "24718": msg26882, + "24719": msg26883, + "2472": select2360, + "24720": msg26884, + "24721": msg26885, + "24722": msg26886, + "24723": msg26887, + "24724": msg26888, + "24725": msg26889, + "24726": msg26890, + "24727": msg26891, + "24728": msg26892, + "24729": msg26893, + "2473": select2361, + "24730": msg26894, + "24731": msg26895, + "24732": msg26896, + "24733": msg26897, + "24734": msg26898, + "24735": msg26899, + "24736": msg26900, + "24737": msg26901, + "24738": msg26902, + "24739": msg26903, + "2474": select2362, + "24740": msg26904, + "24741": msg26905, + "24742": msg26906, + "24743": msg26907, + "24744": msg26908, + "24745": msg26909, + "24746": msg26910, + "24747": msg26911, + "24748": msg26912, + "24749": msg26913, + "2475": select2363, + "24750": msg26914, + "24751": msg26915, + "24752": msg26916, + "24753": msg26917, + "24754": msg26918, + "24755": msg26919, + "24756": msg26920, + "24757": msg26921, + "24758": msg26922, + "24759": msg26923, + "2476": select2364, + "24760": msg26924, + "24761": msg26925, + "24762": msg26926, + "24763": msg26927, + "24764": msg26928, + "24765": msg26929, + "24766": msg26930, + "24767": msg26931, + "24768": msg26932, + "24769": msg26933, + "2477": select2365, + "24770": msg26934, + "24771": msg26935, + "24772": msg26936, + "24773": msg26937, + "24774": msg26938, + "24775": msg26939, + "24776": msg26940, + "24777": msg26941, + "24778": msg26942, + "24779": msg26943, + "2478": select2366, + "24780": msg26944, + "24781": msg26945, + "24782": msg26946, + "24783": msg26947, + "24784": msg26948, + "24785": msg26949, + "24786": msg26950, + "24787": msg26951, + "24788": msg26952, + "24789": msg26953, + "2479": select2367, + "24790": msg26954, + "24791": msg26955, + "24792": msg26956, + "24793": msg26957, + "24794": msg26958, + "24795": msg26959, + "24796": msg26960, + "24797": msg26961, + "24798": msg26962, + "24799": msg26963, + "248": select172, + "2480": select2368, + "24800": msg26964, + "24801": msg26965, + "24802": msg26966, + "24803": msg26967, + "24804": msg26968, + "24805": msg26969, + "24806": msg26970, + "24807": msg26971, + "24808": msg26972, + "24809": msg26973, + "2481": select2369, + "24810": msg26974, + "24811": msg26975, + "24812": msg26976, + "24813": msg26977, + "24814": msg26978, + "24815": msg26979, + "24816": msg26980, + "24817": msg26981, + "24818": msg26982, + "24819": msg26983, + "2482": select2370, + "24820": msg26984, + "24821": msg26985, + "24822": msg26986, + "24823": msg26987, + "24824": msg26988, + "24825": msg26989, + "24826": msg26990, + "24827": msg26991, + "24828": msg26992, + "24829": msg26993, + "2483": select2371, + "24830": msg26994, + "24831": msg26995, + "24832": msg26996, + "24833": msg26997, + "24834": msg26998, + "24835": msg26999, + "24836": msg27000, + "24837": msg27001, + "24838": msg27002, + "24839": msg27003, + "2484": select2372, + "24840": msg27004, + "24841": msg27005, + "24842": msg27006, + "24843": msg27007, + "24844": msg27008, + "24845": msg27009, + "24846": msg27010, + "24847": msg27011, + "24848": msg27012, + "24849": msg27013, + "2485": select2373, + "24850": msg27014, + "24851": msg27015, + "24852": msg27016, + "24853": msg27017, + "24854": msg27018, + "24855": msg27019, + "24856": msg27020, + "24857": msg27021, + "24858": msg27022, + "24859": msg27023, + "2486": select2374, + "24860": msg27024, + "24861": msg27025, + "24862": msg27026, + "24863": msg27027, + "24864": msg27028, + "24865": msg27029, + "24866": msg27030, + "24867": msg27031, + "24868": msg27032, + "24869": msg27033, + "2487": select2375, + "24870": msg27034, + "24871": msg27035, + "24872": msg27036, + "24873": msg27037, + "24874": msg27038, + "24875": msg27039, + "24876": msg27040, + "24877": msg27041, + "24878": msg27042, + "24879": msg27043, + "2488": select2376, + "24880": msg27044, + "24881": msg27045, + "24882": msg27046, + "24883": msg27047, + "24884": msg27048, + "24885": msg27049, + "24886": msg27050, + "24887": msg27051, + "24888": msg27052, + "24889": msg27053, + "2489": select2377, + "24890": msg27054, + "24891": msg27055, + "24892": msg27056, + "24893": msg27057, + "24894": msg27058, + "24895": msg27059, + "24896": msg27060, + "24897": msg27061, + "24898": msg27062, + "24899": msg27063, + "249": select173, + "2490": select2378, + "24900": msg27064, + "24901": msg27065, + "24902": msg27066, + "24903": msg27067, + "24904": msg27068, + "24905": msg27069, + "24906": msg27070, + "24907": msg27071, + "24908": msg27072, + "24909": msg27073, + "2491": select2379, + "24910": msg27074, + "24911": msg27075, + "24912": msg27076, + "24913": msg27077, + "24914": msg27078, + "24915": msg27079, + "24916": msg27080, + "24917": msg27081, + "24918": msg27082, + "2492": select2380, + "2493": select2381, + "2494": select2382, + "2495": select2383, + "24955": msg27083, + "24956": msg27084, + "24957": msg27085, + "24958": msg27086, + "24959": msg27087, + "2496": select2384, + "24960": msg27088, + "24961": msg27089, + "24962": msg27090, + "24963": msg27091, + "24964": msg27092, + "24965": msg27093, + "24966": msg27094, + "24967": msg27095, + "24968": msg27096, + "24969": msg27097, + "2497": select2385, + "24970": msg27098, + "24971": msg27099, + "24972": msg27100, + "24973": msg27101, + "24974": msg27102, + "24975": msg27103, + "24976": msg27104, + "24977": msg27105, + "24978": msg27106, + "24979": msg27107, + "2498": select2386, + "24980": msg27108, + "24981": msg27109, + "24982": msg27110, + "24983": msg27111, + "24984": msg27112, + "24985": msg27113, + "24986": msg27114, + "24987": msg27115, + "24988": msg27116, + "24989": msg27117, + "2499": select2387, + "24990": msg27118, + "24991": msg27119, + "24992": msg27120, + "24993": msg27121, + "24994": msg27122, + "24995": msg27123, + "24996": msg27124, + "24997": msg27125, + "24998": msg27126, + "24999": msg27127, + "25": select24, + "250": select174, + "2500": select2388, + "25000": msg27128, + "25001": msg27129, + "25002": msg27130, + "25003": msg27131, + "25004": msg27132, + "25005": msg27133, + "25006": msg27134, + "25007": msg27135, + "25008": msg27136, + "25009": msg27137, + "2501": select2389, + "25010": msg27138, + "25011": msg27139, + "25012": msg27140, + "25013": msg27141, + "25014": msg27142, + "25015": msg27143, + "25016": msg27144, + "25017": msg27145, + "25018": msg27146, + "25019": msg27147, + "2502": select2390, + "25020": msg27148, + "25021": msg27149, + "25022": msg27150, + "25023": msg27151, + "25024": msg27152, + "25025": msg27153, + "25026": msg27154, + "25027": msg27155, + "25028": msg27156, + "25029": msg27157, + "2503": select2391, + "25030": msg27158, + "25031": msg27159, + "25032": msg27160, + "25033": msg27161, + "25034": msg27162, + "25035": msg27163, + "25036": msg27164, + "25037": msg27165, + "25038": msg27166, + "25039": msg27167, + "2504": select2392, + "25040": msg27168, + "25041": msg27169, + "25042": msg27170, + "25043": msg27171, + "25044": msg27172, + "25045": msg27173, + "25046": msg27174, + "25047": msg27175, + "25048": msg27176, + "25049": msg27177, + "2505": select2393, + "25050": msg27178, + "25051": msg27179, + "25052": msg27180, + "25053": msg27181, + "25054": msg27182, + "25055": msg27183, + "25056": msg27184, + "25057": msg27185, + "25058": msg27186, + "25059": msg27187, + "2506": select2394, + "25060": msg27188, + "25061": msg27189, + "25062": msg27190, + "25063": msg27191, + "25064": msg27192, + "25065": msg27193, + "25066": msg27194, + "25067": msg27195, + "25068": msg27196, + "25069": msg27197, + "2507": select2395, + "25070": msg27198, + "25071": msg27199, + "25072": msg27200, + "25073": msg27201, + "25074": msg27202, + "25075": msg27203, + "25076": msg27204, + "25077": msg27205, + "25078": msg27206, + "25079": msg27207, + "2508": select2396, + "25080": msg27208, + "25081": msg27209, + "25082": msg27210, + "25083": msg27211, + "25084": msg27212, + "25085": msg27213, + "25086": msg27214, + "25087": msg27215, + "25088": msg27216, + "25089": msg27217, + "2509": select2397, + "25090": msg27218, + "25091": msg27219, + "25092": msg27220, + "25093": msg27221, + "25094": msg27222, + "25095": msg27223, + "25096": msg27224, + "25097": msg27225, + "25098": msg27226, + "25099": msg27227, + "251": select175, + "2510": select2398, + "25100": msg27228, + "25101": msg27229, + "25102": msg27230, + "25103": msg27231, + "25104": msg27232, + "25105": msg27233, + "25106": msg27234, + "25107": msg27235, + "25108": msg27236, + "25109": msg27237, + "2511": select2399, + "25110": msg27238, + "25111": msg27239, + "25112": msg27240, + "25113": msg27241, + "25114": msg27242, + "25115": msg27243, + "25116": msg27244, + "25117": msg27245, + "25118": msg27246, + "25119": msg27247, + "2512": select2400, + "25120": msg27248, + "25121": msg27249, + "25122": msg27250, + "25123": msg27251, + "25124": msg27252, + "25125": msg27253, + "25126": msg27254, + "25127": msg27255, + "25128": msg27256, + "25129": msg27257, + "2513": select2401, + "25130": msg27258, + "25131": msg27259, + "25132": msg27260, + "25133": msg27261, + "25134": msg27262, + "25135": msg27263, + "25136": msg27264, + "25137": msg27265, + "25138": msg27266, + "25139": msg27267, + "2514": select2402, + "25140": msg27268, + "25141": msg27269, + "25142": msg27270, + "25143": msg27271, + "25144": msg27272, + "25145": msg27273, + "25146": msg27274, + "25147": msg27275, + "25148": msg27276, + "25149": msg27277, + "2515": select2403, + "25150": msg27278, + "25151": msg27279, + "25152": msg27280, + "25153": msg27281, + "25154": msg27282, + "25155": msg27283, + "25156": msg27284, + "25157": msg27285, + "25158": msg27286, + "25159": msg27287, + "2516": select2404, + "25160": msg27288, + "25161": msg27289, + "25162": msg27290, + "25163": msg27291, + "25164": msg27292, + "25165": msg27293, + "25166": msg27294, + "25167": msg27295, + "25168": msg27296, + "25169": msg27297, + "2517": select2405, + "25170": msg27298, + "25171": msg27299, + "25172": msg27300, + "25173": msg27301, + "25174": msg27302, + "25175": msg27303, + "25176": msg27304, + "25177": msg27305, + "25178": msg27306, + "25179": msg27307, + "2518": select2406, + "25180": msg27308, + "25181": msg27309, + "25182": msg27310, + "25183": msg27311, + "25184": msg27312, + "25185": msg27313, + "25186": msg27314, + "25187": msg27315, + "25188": msg27316, + "25189": msg27317, + "2519": select2407, + "25190": msg27318, + "25191": msg27319, + "25192": msg27320, + "25193": msg27321, + "25194": msg27322, + "25195": msg27323, + "25196": msg27324, + "25197": msg27325, + "25198": msg27326, + "25199": msg27327, + "252": select176, + "2520": select2408, + "25200": msg27328, + "25201": msg27329, + "25202": msg27330, + "25203": msg27331, + "25204": msg27332, + "25205": msg27333, + "25206": msg27334, + "25207": msg27335, + "25208": msg27336, + "25209": msg27337, + "2521": select2409, + "25210": msg27338, + "25211": msg27339, + "25212": msg27340, + "25213": msg27341, + "25214": msg27342, + "25215": msg27343, + "25216": msg27344, + "25217": msg27345, + "25218": msg27346, + "25219": msg27347, + "2522": select2410, + "25220": msg27348, + "25221": msg27349, + "25222": msg27350, + "25223": msg27351, + "25224": msg27352, + "25225": msg27353, + "25226": msg27354, + "25227": msg27355, + "25228": msg27356, + "25229": msg27357, + "2523": select2411, + "25230": msg27358, + "25231": msg27359, + "25232": msg27360, + "25233": msg27361, + "25234": msg27362, + "25235": msg27363, + "25236": msg27364, + "25237": msg27365, + "25238": msg27366, + "25239": msg27367, + "2524": select2412, + "25240": msg27368, + "25241": msg27369, + "25242": msg27370, + "25243": msg27371, + "25244": msg27372, + "25245": msg27373, + "25246": msg27374, + "25247": msg27375, + "25248": msg27376, + "25249": msg27377, + "2525": select2413, + "25250": msg27378, + "25251": msg27379, + "25252": msg27380, + "25253": msg27381, + "25254": msg27382, + "25255": msg27383, + "25256": msg27384, + "25257": msg27385, + "25258": msg27386, + "25259": msg27387, + "2526": select2414, + "25260": msg27388, + "25261": msg27389, + "25262": msg27390, + "25263": msg27391, + "25264": msg27392, + "25265": msg27393, + "25266": msg27394, + "25267": msg27395, + "25268": msg27396, + "25269": msg27397, + "2527": select2415, + "25270": msg27398, + "25271": msg27399, + "25272": msg27400, + "25273": msg27401, + "25274": msg27402, + "25275": msg27403, + "25276": msg27404, + "25277": msg27405, + "25278": msg27406, + "25279": msg27407, + "2528": select2416, + "25280": msg27408, + "25281": msg27409, + "25282": msg27410, + "25283": msg27411, + "25284": msg27412, + "25285": msg27413, + "25286": msg27414, + "25287": msg27415, + "25288": msg27416, + "25289": msg27417, + "2529": select2417, + "25290": msg27418, + "25291": msg27419, + "25292": msg27420, + "25293": msg27421, + "25294": msg27422, + "25295": msg27423, + "25296": msg27424, + "25297": msg27425, + "25298": msg27426, + "25299": msg27427, + "253": select177, + "2530": select2418, + "25300": msg27428, + "25301": msg27429, + "25302": msg27430, + "25303": msg27431, + "25304": msg27432, + "25305": msg27433, + "25306": msg27434, + "25307": msg27435, + "25308": msg27436, + "25309": msg27437, + "2531": select2419, + "25310": msg27438, + "25311": msg27439, + "25312": msg27440, + "25313": msg27441, + "25314": msg27442, + "25315": msg27443, + "25316": msg27444, + "25317": msg27445, + "25318": msg27446, + "25319": msg27447, + "2532": select2420, + "25320": msg27448, + "25321": msg27449, + "25322": msg27450, + "25323": msg27451, + "25324": msg27452, + "25325": msg27453, + "25326": msg27454, + "25327": msg27455, + "25328": msg27456, + "25329": msg27457, + "2533": select2421, + "25330": msg27458, + "25331": msg27459, + "25332": msg27460, + "25333": msg27461, + "25334": msg27462, + "25335": msg27463, + "25336": msg27464, + "25337": msg27465, + "25338": msg27466, + "25339": msg27467, + "2534": select2422, + "25340": msg27468, + "25341": msg27469, + "25342": msg27470, + "25343": msg27471, + "25344": msg27472, + "25345": msg27473, + "25346": msg27474, + "25347": msg27475, + "25348": msg27476, + "25349": msg27477, + "2535": select2423, + "25350": msg27478, + "25351": msg27479, + "25352": msg27480, + "25353": msg27481, + "25354": msg27482, + "25355": msg27483, + "25356": msg27484, + "25357": msg27485, + "25358": msg27486, + "25359": msg27487, + "2536": select2424, + "25360": msg27488, + "25361": msg27489, + "25362": msg27490, + "25363": msg27491, + "25364": msg27492, + "25365": msg27493, + "25366": msg27494, + "25367": msg27495, + "25368": msg27496, + "25369": msg27497, + "2537": select2425, + "25370": msg27498, + "25371": msg27499, + "25372": msg27500, + "25373": msg27501, + "25374": msg27502, + "25375": msg27503, + "25376": msg27504, + "25377": msg27505, + "25378": msg27506, + "25379": msg27507, + "2538": select2426, + "25380": msg27508, + "25381": msg27509, + "25382": msg27510, + "25383": msg27511, + "25384": msg27512, + "25385": msg27513, + "25386": msg27514, + "25387": msg27515, + "25388": msg27516, + "25389": msg27517, + "2539": select2427, + "25390": msg27518, + "25391": msg27519, + "25392": msg27520, + "25393": msg27521, + "25394": msg27522, + "25395": msg27523, + "25396": msg27524, + "25397": msg27525, + "25398": msg27526, + "25399": msg27527, + "254": select178, + "2540": select2428, + "25400": msg27528, + "25401": msg27529, + "25402": msg27530, + "25403": msg27531, + "25404": msg27532, + "25405": msg27533, + "25406": msg27534, + "25407": msg27535, + "25408": msg27536, + "25409": msg27537, + "2541": select2429, + "25410": msg27538, + "25411": msg27539, + "25412": msg27540, + "25413": msg27541, + "25414": msg27542, + "25415": msg27543, + "25416": msg27544, + "25417": msg27545, + "25418": msg27546, + "25419": msg27547, + "2542": select2430, + "25420": msg27548, + "25421": msg27549, + "25422": msg27550, + "25423": msg27551, + "25424": msg27552, + "25425": msg27553, + "25426": msg27554, + "25427": msg27555, + "25428": msg27556, + "25429": msg27557, + "2543": select2431, + "25430": msg27558, + "25431": msg27559, + "25432": msg27560, + "25433": msg27561, + "25434": msg27562, + "25435": msg27563, + "25436": msg27564, + "25437": msg27565, + "25438": msg27566, + "25439": msg27567, + "2544": select2432, + "25440": msg27568, + "25441": msg27569, + "25442": msg27570, + "25443": msg27571, + "25444": msg27572, + "25445": msg27573, + "25446": msg27574, + "25447": msg27575, + "25448": msg27576, + "25449": msg27577, + "2545": select2433, + "25450": msg27578, + "25451": msg27579, + "25452": msg27580, + "25453": msg27581, + "25454": msg27582, + "25455": msg27583, + "25456": msg27584, + "25457": msg27585, + "25458": msg27586, + "25459": msg27587, + "2546": select2434, + "25460": msg27588, + "25461": msg27589, + "25462": msg27590, + "25463": msg27591, + "25464": msg27592, + "25465": msg27593, + "25466": msg27594, + "25467": msg27595, + "25468": msg27596, + "25469": msg27597, + "2547": select2435, + "25470": msg27598, + "25471": msg27599, + "25472": msg27600, + "25473": msg27601, + "25474": msg27602, + "25475": msg27603, + "25476": msg27604, + "25477": msg27605, + "25478": msg27606, + "25479": msg27607, + "2548": select2436, + "2549": select2437, + "255": select179, + "2550": select2438, + "25502": msg27608, + "25503": msg27609, + "25504": msg27610, + "25505": msg27611, + "25506": msg27612, + "25507": msg27613, + "25508": msg27614, + "25509": msg27615, + "2551": msg5001, + "25510": msg27616, + "25511": msg27617, + "25512": msg27618, + "25513": msg27619, + "25514": msg27620, + "25515": msg27621, + "25516": msg27622, + "25517": msg27623, + "25518": msg27624, + "25519": msg27625, + "2552": msg5002, + "25520": msg27626, + "25521": msg27627, + "25522": msg27628, + "25523": msg27629, + "25524": msg27630, + "25525": msg27631, + "25526": msg27632, + "25527": msg27633, + "25528": msg27634, + "25529": msg27635, + "2553": msg5003, + "25530": msg27636, + "25531": msg27637, + "25532": msg27638, + "25533": msg27639, + "25534": msg27640, + "25535": msg27641, + "25536": msg27642, + "25537": msg27643, + "25538": msg27644, + "25539": msg27645, + "2554": msg5004, + "25540": msg27646, + "25541": msg27647, + "25542": msg27648, + "25543": msg27649, + "25544": msg27650, + "25545": msg27651, + "25546": msg27652, + "25547": msg27653, + "25548": msg27654, + "25549": msg27655, + "2555": msg5005, + "25550": msg27656, + "25551": msg27657, + "25552": msg27658, + "25553": msg27659, + "25554": msg27660, + "25555": msg27661, + "25556": msg27662, + "25557": msg27663, + "25558": msg27664, + "25559": msg27665, + "2556": msg5006, + "25560": msg27666, + "25561": msg27667, + "25562": msg27668, + "25563": msg27669, + "25564": msg27670, + "25565": msg27671, + "25566": msg27672, + "25567": msg27673, + "25568": msg27674, + "25569": msg27675, + "2557": msg5007, + "25570": msg27676, + "25571": msg27677, + "25572": msg27678, + "25573": msg27679, + "25574": msg27680, + "25575": msg27681, + "25576": msg27682, + "25577": msg27683, + "25578": msg27684, + "25579": msg27685, + "2558": msg5008, + "25580": msg27686, + "25581": msg27687, + "25582": msg27688, + "25583": msg27689, + "25584": msg27690, + "25585": msg27691, + "25586": msg27692, + "25587": msg27693, + "25588": msg27694, + "25589": msg27695, + "2559": msg5009, + "25590": msg27696, + "25591": msg27697, + "25592": msg27698, + "25593": msg27699, + "25594": msg27700, + "25595": msg27701, + "25596": msg27702, + "25597": msg27703, + "25598": msg27704, + "25599": msg27705, + "256": select180, + "2560": msg5010, + "25600": msg27706, + "25601": msg27707, + "25602": msg27708, + "25603": msg27709, + "25604": msg27710, + "25605": msg27711, + "25606": msg27712, + "25607": msg27713, + "25608": msg27714, + "25609": msg27715, + "2561": msg5011, + "25610": msg27716, + "25611": msg27717, + "25612": msg27718, + "25613": msg27719, + "25614": msg27720, + "25615": msg27721, + "25616": msg27722, + "25617": msg27723, + "25618": msg27724, + "25619": msg27725, + "2562": msg5012, + "25620": msg27726, + "25621": msg27727, + "25622": msg27728, + "25623": msg27729, + "25624": msg27730, + "25625": msg27731, + "25626": msg27732, + "25627": msg27733, + "25628": msg27734, + "2563": msg5013, + "25630": msg27735, + "25631": msg27736, + "25632": msg27737, + "25633": msg27738, + "25634": msg27739, + "25635": msg27740, + "25636": msg27741, + "25637": msg27742, + "25638": msg27743, + "25639": msg27744, + "2564": msg5014, + "25640": msg27745, + "25641": msg27746, + "25642": msg27747, + "25643": msg27748, + "25644": msg27749, + "25645": msg27750, + "25646": msg27751, + "25647": msg27752, + "25648": msg27753, + "25649": msg27754, + "2565": msg5015, + "25650": msg27755, + "25651": msg27756, + "25652": msg27757, + "25653": msg27758, + "25654": msg27759, + "25655": msg27760, + "25656": msg27761, + "25657": msg27762, + "25658": msg27763, + "25659": msg27764, + "2566": msg5016, + "25660": msg27765, + "25661": msg27766, + "25662": msg27767, + "25663": msg27768, + "25664": msg27769, + "25665": msg27770, + "25666": msg27771, + "25667": msg27772, + "25668": msg27773, + "25669": msg27774, + "2567": msg5017, + "25670": msg27775, + "25671": msg27776, + "25672": msg27777, + "25673": msg27778, + "25674": msg27779, + "25675": msg27780, + "25676": msg27781, + "25677": msg27782, + "25678": msg27783, + "25679": msg27784, + "2568": msg5018, + "25680": msg27785, + "25681": msg27786, + "25682": msg27787, + "25683": msg27788, + "25684": msg27789, + "25685": msg27790, + "25686": msg27791, + "25687": msg27792, + "25688": msg27793, + "25689": msg27794, + "2569": msg5019, + "25690": msg27795, + "25691": msg27796, + "25692": msg27797, + "25693": msg27798, + "25694": msg27799, + "25695": msg27800, + "25696": msg27801, + "25697": msg27802, + "25698": msg27803, + "25699": msg27804, + "257": select181, + "2570": msg5020, + "25700": msg27805, + "25701": msg27806, + "25702": msg27807, + "25703": msg27808, + "25704": msg27809, + "25705": msg27810, + "25706": msg27811, + "25707": msg27812, + "25708": msg27813, + "25709": msg27814, + "2571": msg5021, + "25710": msg27815, + "25711": msg27816, + "25712": msg27817, + "25713": msg27818, + "25714": msg27819, + "25715": msg27820, + "25716": msg27821, + "25717": msg27822, + "25718": msg27823, + "25719": msg27824, + "2572": msg5022, + "25720": msg27825, + "25721": msg27826, + "25722": msg27827, + "25723": msg27828, + "25724": msg27829, + "25725": msg27830, + "25726": msg27831, + "25727": msg27832, + "25728": msg27833, + "25729": msg27834, + "2573": msg5023, + "25730": msg27835, + "25731": msg27836, + "25732": msg27837, + "25733": msg27838, + "25734": msg27839, + "25735": msg27840, + "25736": msg27841, + "25737": msg27842, + "25738": msg27843, + "25739": msg27844, + "2574": msg5024, + "25740": msg27845, + "25741": msg27846, + "25742": msg27847, + "25743": msg27848, + "25744": msg27849, + "25745": msg27850, + "25746": msg27851, + "25747": msg27852, + "25748": msg27853, + "25749": msg27854, + "2575": msg5025, + "25750": msg27855, + "25751": msg27856, + "25752": msg27857, + "25753": msg27858, + "25754": msg27859, + "25755": msg27860, + "25756": msg27861, + "25757": msg27862, + "25758": msg27863, + "25759": msg27864, + "2576": msg5026, + "25760": msg27865, + "25761": msg27866, + "25762": msg27867, + "25763": msg27868, + "25764": msg27869, + "25765": msg27870, + "25766": msg27871, + "25767": msg27872, + "25768": msg27873, + "25769": msg27874, + "2577": msg5027, + "25770": msg27875, + "25771": msg27876, + "25772": msg27877, + "25773": msg27878, + "25774": msg27879, + "25775": msg27880, + "25776": msg27881, + "25777": msg27882, + "25778": msg27883, + "25779": msg27884, + "2578": msg5028, + "25780": msg27885, + "25781": msg27886, + "25782": msg27887, + "25783": msg27888, + "25784": msg27889, + "25785": msg27890, + "25786": msg27891, + "25787": msg27892, + "25788": msg27893, + "25789": msg27894, + "2579": msg5029, + "25790": msg27895, + "25791": msg27896, + "25792": msg27897, + "25793": msg27898, + "25794": msg27899, + "25795": msg27900, + "25796": msg27901, + "25797": msg27902, + "25798": msg27903, + "25799": msg27904, + "258": select182, + "2580": msg5030, + "25800": msg27905, + "25801": msg27906, + "25802": msg27907, + "25803": msg27908, + "25804": msg27909, + "25805": msg27910, + "25806": msg27911, + "25807": msg27912, + "25808": msg27913, + "25809": msg27914, + "2581": msg5031, + "25810": msg27915, + "25811": msg27916, + "25812": msg27917, + "25813": msg27918, + "25814": msg27919, + "25815": msg27920, + "25816": msg27921, + "25817": msg27922, + "25818": msg27923, + "25819": msg27924, + "2582": msg5032, + "25820": msg27925, + "25821": msg27926, + "25822": msg27927, + "25823": msg27928, + "25824": msg27929, + "25825": msg27930, + "25826": msg27931, + "25827": msg27932, + "25828": msg27933, + "25829": msg27934, + "2583": msg5033, + "25830": msg27935, + "25831": msg27936, + "25832": msg27937, + "25833": msg27938, + "25834": msg27939, + "25835": msg27940, + "25836": msg27941, + "25837": msg27942, + "25838": msg27943, + "25839": msg27944, + "2584": msg5034, + "25840": msg27945, + "25841": msg27946, + "25842": msg27947, + "25843": msg27948, + "25844": msg27949, + "25845": msg27950, + "25846": msg27951, + "25847": msg27952, + "25848": msg27953, + "25849": msg27954, + "2585": msg5035, + "25850": msg27955, + "25851": msg27956, + "25852": msg27957, + "25853": msg27958, + "25854": msg27959, + "25855": msg27960, + "25856": msg27961, + "25857": msg27962, + "25858": msg27963, + "25859": msg27964, + "2586": msg5036, + "25860": msg27965, + "25861": msg27966, + "25862": msg27967, + "25863": msg27968, + "25864": msg27969, + "25865": msg27970, + "25866": msg27971, + "25867": msg27972, + "25868": msg27973, + "25869": msg27974, + "2587": msg5037, + "25870": msg27975, + "25871": msg27976, + "25872": msg27977, + "25873": msg27978, + "25874": msg27979, + "25875": msg27980, + "25876": msg27981, + "25877": msg27982, + "25878": msg27983, + "25879": msg27984, + "2588": msg5038, + "25880": msg27985, + "25881": msg27986, + "25882": msg27987, + "25883": msg27988, + "25884": msg27989, + "25885": msg27990, + "25886": msg27991, + "25887": msg27992, + "25888": msg27993, + "25889": msg27994, + "2589": msg5039, + "25890": msg27995, + "25891": msg27996, + "25892": msg27997, + "25893": msg27998, + "25894": msg27999, + "25895": msg28000, + "25896": msg28001, + "25897": msg28002, + "25898": msg28003, + "25899": msg28004, + "259": select183, + "2590": select2439, + "25900": msg28005, + "25901": msg28006, + "25902": msg28007, + "25903": msg28008, + "25904": msg28009, + "25905": msg28010, + "25906": msg28011, + "25907": msg28012, + "25908": msg28013, + "25909": msg28014, + "2591": msg5042, + "25910": msg28015, + "25911": msg28016, + "25912": msg28017, + "25913": msg28018, + "25914": msg28019, + "25915": msg28020, + "25916": msg28021, + "25917": msg28022, + "25918": msg28023, + "25919": msg28024, + "2592": msg5043, + "25920": msg28025, + "25921": msg28026, + "25922": msg28027, + "25923": msg28028, + "25924": msg28029, + "25925": msg28030, + "25926": msg28031, + "25927": msg28032, + "25928": msg28033, + "25929": msg28034, + "2593": msg5044, + "25930": msg28035, + "25931": msg28036, + "25932": msg28037, + "25933": msg28038, + "25934": msg28039, + "25935": msg28040, + "25936": msg28041, + "25937": msg28042, + "25938": msg28043, + "25939": msg28044, + "2594": msg5045, + "25940": msg28045, + "25941": msg28046, + "25942": msg28047, + "25943": msg28048, + "25944": msg28049, + "25945": msg28050, + "25946": msg28051, + "25947": msg28052, + "25948": msg28053, + "25949": msg28054, + "2595": msg5046, + "25950": msg28055, + "25951": msg28056, + "25952": msg28057, + "25953": msg28058, + "25954": msg28059, + "25955": msg28060, + "25956": msg28061, + "25957": msg28062, + "25958": msg28063, + "25959": msg28064, + "2596": msg5047, + "25960": msg28065, + "25961": msg28066, + "25962": msg28067, + "25963": msg28068, + "25964": msg28069, + "25965": msg28070, + "25966": msg28071, + "25967": msg28072, + "25968": msg28073, + "25969": msg28074, + "2597": msg5048, + "25970": msg28075, + "25971": msg28076, + "25972": msg28077, + "25973": msg28078, + "25974": msg28079, + "25975": msg28080, + "25976": msg28081, + "25977": msg28082, + "25978": msg28083, + "25979": msg28084, + "2598": msg5049, + "25980": msg28085, + "25981": msg28086, + "25982": msg28087, + "25983": msg28088, + "25984": msg28089, + "25985": msg28090, + "25986": msg28091, + "25987": msg28092, + "25988": msg28093, + "25989": msg28094, + "2599": msg5050, + "25990": msg28095, + "25991": msg28096, + "25992": msg28097, + "25993": msg28098, + "25994": msg28099, + "25995": msg28100, + "25996": msg28101, + "25997": msg28102, + "25998": msg28103, + "25999": msg28104, + "26": msg60, + "260": select184, + "2600": msg5051, + "26000": msg28105, + "26001": msg28106, + "26002": msg28107, + "26003": msg28108, + "26004": msg28109, + "26005": msg28110, + "26006": msg28111, + "26007": msg28112, + "26008": msg28113, + "26009": msg28114, + "2601": msg5052, + "26010": msg28115, + "26011": msg28116, + "26012": msg28117, + "26013": msg28118, + "26014": msg28119, + "26015": msg28120, + "26016": msg28121, + "26017": msg28122, + "26018": msg28123, + "26019": msg28124, + "2602": msg5053, + "26020": msg28125, + "26021": msg28126, + "26022": msg28127, + "26023": msg28128, + "26024": msg28129, + "26025": msg28130, + "26026": msg28131, + "26027": msg28132, + "26028": msg28133, + "26029": msg28134, + "2603": msg5054, + "26030": msg28135, + "26031": msg28136, + "26032": msg28137, + "26033": msg28138, + "26034": msg28139, + "26035": msg28140, + "26036": msg28141, + "26037": msg28142, + "26038": msg28143, + "26039": msg28144, + "2604": msg5055, + "26040": msg28145, + "26041": msg28146, + "26042": msg28147, + "26043": msg28148, + "26044": msg28149, + "26045": msg28150, + "26046": msg28151, + "26047": msg28152, + "26048": msg28153, + "26049": msg28154, + "2605": msg5056, + "26050": msg28155, + "26051": msg28156, + "26052": msg28157, + "26053": msg28158, + "26054": msg28159, + "26055": msg28160, + "26056": msg28161, + "26057": msg28162, + "26058": msg28163, + "26059": msg28164, + "2606": msg5057, + "26060": msg28165, + "26061": msg28166, + "26062": msg28167, + "26063": msg28168, + "26064": msg28169, + "26065": msg28170, + "26066": msg28171, + "26067": msg28172, + "26068": msg28173, + "26069": msg28174, + "2607": msg5058, + "26070": msg28175, + "26071": msg28176, + "26072": msg28177, + "26073": msg28178, + "26074": msg28179, + "26075": msg28180, + "26076": msg28181, + "26077": msg28182, + "26078": msg28183, + "26079": msg28184, + "2608": msg5059, + "26080": msg28185, + "26081": msg28186, + "26082": msg28187, + "26083": msg28188, + "26084": msg28189, + "26085": msg28190, + "26086": msg28191, + "26087": msg28192, + "26088": msg28193, + "26089": msg28194, + "2609": msg5060, + "26090": msg28195, + "26091": msg28196, + "26092": msg28197, + "26093": msg28198, + "26094": msg28199, + "26095": msg28200, + "26096": msg28201, + "26097": msg28202, + "26098": msg28203, + "26099": msg28204, + "261": select185, + "2610": msg5061, + "26100": msg28205, + "26101": msg28206, + "26102": msg28207, + "26103": msg28208, + "26104": msg28209, + "26105": msg28210, + "26106": msg28211, + "26107": msg28212, + "26108": msg28213, + "26109": msg28214, + "2611": msg5062, + "26110": msg28215, + "26111": msg28216, + "26112": msg28217, + "26113": msg28218, + "26114": msg28219, + "26115": msg28220, + "26116": msg28221, + "26117": msg28222, + "26118": msg28223, + "26119": msg28224, + "2612": msg5063, + "26120": msg28225, + "26121": msg28226, + "26122": msg28227, + "26123": msg28228, + "26124": msg28229, + "26125": msg28230, + "26126": msg28231, + "26127": msg28232, + "26128": msg28233, + "26129": msg28234, + "2613": msg5064, + "26130": msg28235, + "26131": msg28236, + "26132": msg28237, + "26133": msg28238, + "26134": msg28239, + "26135": msg28240, + "26136": msg28241, + "26137": msg28242, + "26138": msg28243, + "26139": msg28244, + "2614": msg5065, + "26140": msg28245, + "26141": msg28246, + "26142": msg28247, + "26143": msg28248, + "26144": msg28249, + "26145": msg28250, + "26146": msg28251, + "26147": msg28252, + "26148": msg28253, + "26149": msg28254, + "2615": msg5066, + "26150": msg28255, + "26151": msg28256, + "26152": msg28257, + "26153": msg28258, + "26154": msg28259, + "26155": msg28260, + "26156": msg28261, + "26157": msg28262, + "26158": msg28263, + "26159": msg28264, + "2616": msg5067, + "26160": msg28265, + "26161": msg28266, + "26162": msg28267, + "26163": msg28268, + "26164": msg28269, + "26165": msg28270, + "26166": msg28271, + "26167": msg28272, + "26168": msg28273, + "26169": msg28274, + "2617": msg5068, + "26170": msg28275, + "26171": msg28276, + "26172": msg28277, + "26173": msg28278, + "26174": msg28279, + "26175": msg28280, + "26176": msg28281, + "26177": msg28282, + "26178": msg28283, + "26179": msg28284, + "2618": msg5069, + "26180": msg28285, + "26181": msg28286, + "26182": msg28287, + "26183": msg28288, + "26184": msg28289, + "26185": msg28290, + "26186": msg28291, + "26187": msg28292, + "26188": msg28293, + "26189": msg28294, + "2619": msg5070, + "26190": msg28295, + "26191": msg28296, + "26192": msg28297, + "26193": msg28298, + "26194": msg28299, + "26195": msg28300, + "26196": msg28301, + "26197": msg28302, + "26198": msg28303, + "26199": msg28304, + "262": select186, + "2620": msg5071, + "26200": msg28305, + "26201": msg28306, + "26202": msg28307, + "26203": msg28308, + "26204": msg28309, + "26205": msg28310, + "26206": msg28311, + "26207": msg28312, + "26208": msg28313, + "26209": msg28314, + "2621": msg5072, + "26210": msg28315, + "26211": msg28316, + "26212": msg28317, + "26213": msg28318, + "26214": msg28319, + "26215": msg28320, + "26216": msg28321, + "26217": msg28322, + "26218": msg28323, + "26219": msg28324, + "2622": msg5073, + "26220": msg28325, + "26221": msg28326, + "26222": msg28327, + "26223": msg28328, + "26224": msg28329, + "26225": msg28330, + "26226": msg28331, + "26227": msg28332, + "26228": msg28333, + "26229": msg28334, + "2623": msg5074, + "26230": msg28335, + "26231": msg28336, + "26232": msg28337, + "26233": msg28338, + "26234": msg28339, + "26235": msg28340, + "26236": msg28341, + "26237": msg28342, + "26238": msg28343, + "26239": msg28344, + "2624": msg5075, + "26240": msg28345, + "26241": msg28346, + "26242": msg28347, + "26243": msg28348, + "26244": msg28349, + "26245": msg28350, + "26246": msg28351, + "26247": msg28352, + "26248": msg28353, + "26249": msg28354, + "2625": msg5076, + "26250": msg28355, + "26251": msg28356, + "26252": msg28357, + "26253": msg28358, + "26254": msg28359, + "26255": msg28360, + "26256": msg28361, + "26257": msg28362, + "26258": msg28363, + "26259": msg28364, + "2626": msg5077, + "26260": msg28365, + "26261": msg28366, + "26262": msg28367, + "26263": msg28368, + "26264": msg28369, + "26265": msg28370, + "26266": msg28371, + "26267": msg28372, + "26268": msg28373, + "26269": msg28374, + "2627": msg5078, + "26270": msg28375, + "26271": msg28376, + "26272": msg28377, + "26273": msg28378, + "26274": msg28379, + "26275": msg28380, + "26276": msg28381, + "26277": msg28382, + "26278": msg28383, + "26279": msg28384, + "2628": msg5079, + "26280": msg28385, + "26281": msg28386, + "26282": msg28387, + "26283": msg28388, + "26284": msg28389, + "26285": msg28390, + "26286": msg28391, + "26287": msg28392, + "26288": msg28393, + "26289": msg28394, + "2629": msg5080, + "26290": msg28395, + "26291": msg28396, + "26292": msg28397, + "26293": msg28398, + "26294": msg28399, + "26295": msg28400, + "26296": msg28401, + "26297": msg28402, + "26298": msg28403, + "26299": msg28404, + "2630": msg5081, + "26300": msg28405, + "26301": msg28406, + "26302": msg28407, + "26303": msg28408, + "26304": msg28409, + "26305": msg28410, + "26306": msg28411, + "26307": msg28412, + "26308": msg28413, + "26309": msg28414, + "2631": msg5082, + "26310": msg28415, + "26311": msg28416, + "26312": msg28417, + "26313": msg28418, + "26314": msg28419, + "26315": msg28420, + "26316": msg28421, + "26317": msg28422, + "26318": msg28423, + "26319": msg28424, + "2632": msg5083, + "26320": msg28425, + "26321": msg28426, + "26322": msg28427, + "26323": msg28428, + "26324": msg28429, + "26325": msg28430, + "26326": msg28431, + "26327": msg28432, + "26328": msg28433, + "26329": msg28434, + "2633": msg5084, + "26330": msg28435, + "26331": msg28436, + "26332": msg28437, + "26333": msg28438, + "26334": msg28439, + "26335": msg28440, + "26336": msg28441, + "26337": msg28442, + "26338": msg28443, + "26339": msg28444, + "2634": msg5085, + "26340": msg28445, + "26341": msg28446, + "26342": msg28447, + "26343": msg28448, + "26344": msg28449, + "26345": msg28450, + "26346": msg28451, + "26347": msg28452, + "26348": msg28453, + "26349": msg28454, + "2635": msg5086, + "26350": msg28455, + "26351": msg28456, + "26352": msg28457, + "26353": msg28458, + "26354": msg28459, + "26355": msg28460, + "26356": msg28461, + "26357": msg28462, + "26358": msg28463, + "26359": msg28464, + "2636": msg5087, + "26360": msg28465, + "26361": msg28466, + "26362": msg28467, + "26363": msg28468, + "26364": msg28469, + "26365": msg28470, + "26366": msg28471, + "26367": msg28472, + "26368": msg28473, + "26369": msg28474, + "2637": msg5088, + "26370": msg28475, + "26371": msg28476, + "26372": msg28477, + "26373": msg28478, + "26374": msg28479, + "26375": msg28480, + "26376": msg28481, + "26377": msg28482, + "26378": msg28483, + "26379": msg28484, + "2638": msg5089, + "26380": msg28485, + "26381": msg28486, + "26382": msg28487, + "26383": msg28488, + "26384": msg28489, + "26385": msg28490, + "26386": msg28491, + "26387": msg28492, + "26388": msg28493, + "26389": msg28494, + "2639": msg5090, + "26390": msg28495, + "26391": msg28496, + "26392": msg28497, + "26393": msg28498, + "26394": msg28499, + "26395": msg28500, + "26396": msg28501, + "26397": msg28502, + "26398": msg28503, + "26399": msg28504, + "264": select187, + "2640": msg5091, + "26400": msg28505, + "26401": msg28506, + "26402": msg28507, + "26403": msg28508, + "26404": msg28509, + "26405": msg28510, + "26406": msg28511, + "26407": msg28512, + "26408": msg28513, + "26409": msg28514, + "2641": msg5092, + "26410": msg28515, + "26411": msg28516, + "26412": msg28517, + "26413": msg28518, + "26414": msg28519, + "26415": msg28520, + "26416": msg28521, + "26417": msg28522, + "26418": msg28523, + "26419": msg28524, + "2642": msg5093, + "26420": msg28525, + "26421": msg28526, + "26422": msg28527, + "26423": msg28528, + "26424": msg28529, + "26425": msg28530, + "26426": msg28531, + "26427": msg28532, + "26428": msg28533, + "26429": msg28534, + "2643": msg5094, + "26430": msg28535, + "26431": msg28536, + "26432": msg28537, + "26433": msg28538, + "26434": msg28539, + "26435": msg28540, + "26436": msg28541, + "26437": msg28542, + "26438": msg28543, + "26439": msg28544, + "2644": msg5095, + "26440": msg28545, + "26441": msg28546, + "26442": msg28547, + "26443": msg28548, + "26444": msg28549, + "26445": msg28550, + "26446": msg28551, + "26447": msg28552, + "26448": msg28553, + "26449": msg28554, + "2645": msg5096, + "26450": msg28555, + "26451": msg28556, + "26452": msg28557, + "26453": msg28558, + "26454": msg28559, + "26455": msg28560, + "26456": msg28561, + "26457": msg28562, + "26458": msg28563, + "26459": msg28564, + "2646": msg5097, + "26460": msg28565, + "26461": msg28566, + "26462": msg28567, + "26463": msg28568, + "26464": msg28569, + "26465": msg28570, + "26466": msg28571, + "26467": msg28572, + "26468": msg28573, + "26469": msg28574, + "2647": msg5098, + "26470": msg28575, + "26471": msg28576, + "26472": msg28577, + "26473": msg28578, + "26474": msg28579, + "26475": msg28580, + "26476": msg28581, + "26477": msg28582, + "26478": msg28583, + "26479": msg28584, + "2648": msg5099, + "26480": msg28585, + "26481": msg28586, + "26482": msg28587, + "26483": msg28588, + "26484": msg28589, + "26485": msg28590, + "26486": msg28591, + "26487": msg28592, + "26488": msg28593, + "26489": msg28594, + "2649": msg5100, + "26490": msg28595, + "26491": msg28596, + "26492": msg28597, + "26493": msg28598, + "26494": msg28599, + "26495": msg28600, + "26496": msg28601, + "26497": msg28602, + "26498": msg28603, + "26499": msg28604, + "265": select188, + "2650": msg5101, + "26500": msg28605, + "26501": msg28606, + "26502": msg28607, + "26503": msg28608, + "26504": msg28609, + "26505": msg28610, + "26506": msg28611, + "26507": msg28612, + "26508": msg28613, + "26509": msg28614, + "2651": msg5102, + "26510": msg28615, + "26511": msg28616, + "26512": msg28617, + "26513": msg28618, + "26514": msg28619, + "26515": msg28620, + "26516": msg28621, + "26517": msg28622, + "26518": msg28623, + "26519": msg28624, + "2652": msg5103, + "26520": msg28625, + "26521": msg28626, + "26522": msg28627, + "26523": msg28628, + "26524": msg28629, + "26525": msg28630, + "26526": msg28631, + "26527": msg28632, + "26528": msg28633, + "26529": msg28634, + "2653": msg5104, + "26530": msg28635, + "26531": msg28636, + "26532": msg28637, + "26533": msg28638, + "26534": msg28639, + "26535": msg28640, + "26536": msg28641, + "26537": msg28642, + "26538": msg28643, + "26539": msg28644, + "2654": msg5105, + "26540": msg28645, + "26541": msg28646, + "26542": msg28647, + "26543": msg28648, + "26544": msg28649, + "26545": msg28650, + "26546": msg28651, + "26547": msg28652, + "26548": msg28653, + "26549": msg28654, + "2655": msg5106, + "26550": msg28655, + "26551": msg28656, + "26552": msg28657, + "26553": msg28658, + "26554": msg28659, + "26555": msg28660, + "26556": msg28661, + "26557": msg28662, + "26558": msg28663, + "26559": msg28664, + "2656": msg5107, + "26560": msg28665, + "26561": msg28666, + "26562": msg28667, + "26563": msg28668, + "26564": msg28669, + "26565": msg28670, + "26566": msg28671, + "26567": msg28672, + "26568": msg28673, + "26569": msg28674, + "2657": msg5108, + "26570": msg28675, + "26571": msg28676, + "26572": msg28677, + "26573": msg28678, + "26574": msg28679, + "26575": msg28680, + "26576": msg28681, + "26577": msg28682, + "26578": msg28683, + "26579": msg28684, + "2658": msg5109, + "26580": msg28685, + "26581": msg28686, + "26582": msg28687, + "26583": msg28688, + "26584": msg28689, + "26585": msg28690, + "26586": msg28691, + "26587": msg28692, + "26588": msg28693, + "26589": msg28694, + "2659": msg5110, + "26590": msg28695, + "26591": msg28696, + "26592": msg28697, + "26593": msg28698, + "26594": msg28699, + "26595": msg28700, + "26596": msg28701, + "26597": msg28702, + "26598": msg28703, + "26599": msg28704, + "266": select189, + "2660": msg5111, + "26600": msg28705, + "26601": msg28706, + "26602": msg28707, + "26603": msg28708, + "26604": msg28709, + "26605": msg28710, + "26606": msg28711, + "26607": msg28712, + "26608": msg28713, + "26609": msg28714, + "2661": msg5112, + "26610": msg28715, + "26611": msg28716, + "26612": msg28717, + "26613": msg28718, + "26614": msg28719, + "26615": msg28720, + "26616": msg28721, + "26617": msg28722, + "26618": msg28723, + "26619": msg28724, + "2662": msg5113, + "26620": msg28725, + "26621": msg28726, + "26622": msg28727, + "26623": msg28728, + "26624": msg28729, + "26625": msg28730, + "26626": msg28731, + "26627": msg28732, + "26628": msg28733, + "26629": msg28734, + "2663": msg5114, + "26630": msg28735, + "26631": msg28736, + "26632": msg28737, + "26633": msg28738, + "26634": msg28739, + "26635": msg28740, + "26636": msg28741, + "26637": msg28742, + "26638": msg28743, + "26639": msg28744, + "2664": msg5115, + "26640": msg28745, + "26641": msg28746, + "26642": msg28747, + "26643": msg28748, + "26644": msg28749, + "26645": msg28750, + "26646": msg28751, + "26647": msg28752, + "26648": msg28753, + "26649": msg28754, + "2665": msg5116, + "26650": msg28755, + "26651": msg28756, + "26652": msg28757, + "26653": msg28758, + "26654": msg28759, + "26655": msg28760, + "26656": msg28761, + "26657": msg28762, + "26658": msg28763, + "26659": msg28764, + "2666": msg5117, + "26660": msg28765, + "26661": msg28766, + "26662": msg28767, + "26663": msg28768, + "26664": msg28769, + "26665": msg28770, + "26666": msg28771, + "26667": msg28772, + "26668": msg28773, + "26669": msg28774, + "2667": msg5118, + "26670": msg28775, + "26671": msg28776, + "26672": msg28777, + "26673": msg28778, + "26674": msg28779, + "26675": msg28780, + "26676": msg28781, + "26677": msg28782, + "26678": msg28783, + "26679": msg28784, + "2668": msg5119, + "26680": msg28785, + "26681": msg28786, + "26682": msg28787, + "26683": msg28788, + "26684": msg28789, + "26685": msg28790, + "26686": msg28791, + "26687": msg28792, + "26688": msg28793, + "26689": msg28794, + "2669": msg5120, + "26690": msg28795, + "26691": msg28796, + "26692": msg28797, + "26693": msg28798, + "26694": msg28799, + "26695": msg28800, + "26696": msg28801, + "26697": msg28802, + "26698": msg28803, + "26699": msg28804, + "267": select190, + "2670": msg5121, + "26700": msg28805, + "26701": msg28806, + "26702": msg28807, + "26703": msg28808, + "26704": msg28809, + "26705": msg28810, + "26706": msg28811, + "26707": msg28812, + "26708": msg28813, + "26709": msg28814, + "2671": msg5122, + "26710": msg28815, + "26711": msg28816, + "26712": msg28817, + "26713": msg28818, + "26714": msg28819, + "26715": msg28820, + "26716": msg28821, + "26717": msg28822, + "26718": msg28823, + "26719": msg28824, + "2672": msg5123, + "26720": msg28825, + "26721": msg28826, + "26722": msg28827, + "26723": msg28828, + "26724": msg28829, + "26725": msg28830, + "26726": msg28831, + "26727": msg28832, + "26728": msg28833, + "26729": msg28834, + "2673": msg5124, + "26730": msg28835, + "26731": msg28836, + "26732": msg28837, + "26733": msg28838, + "26734": msg28839, + "26735": msg28840, + "26736": msg28841, + "26737": msg28842, + "26738": msg28843, + "26739": msg28844, + "2674": msg5125, + "26740": msg28845, + "26741": msg28846, + "26742": msg28847, + "26743": msg28848, + "26744": msg28849, + "26745": msg28850, + "26746": msg28851, + "26747": msg28852, + "26748": msg28853, + "26749": msg28854, + "2675": msg5126, + "26750": msg28855, + "26751": msg28856, + "26752": msg28857, + "26753": msg28858, + "26754": msg28859, + "26755": msg28860, + "26756": msg28861, + "26757": msg28862, + "26758": msg28863, + "26759": msg28864, + "2676": msg5127, + "26760": msg28865, + "26761": msg28866, + "26762": msg28867, + "26763": msg28868, + "26764": msg28869, + "26765": msg28870, + "26766": msg28871, + "26767": msg28872, + "26768": msg28873, + "26769": msg28874, + "2677": msg5128, + "26770": msg28875, + "26771": msg28876, + "26772": msg28877, + "26773": msg28878, + "26774": msg28879, + "26775": msg28880, + "26776": msg28881, + "26777": msg28882, + "26778": msg28883, + "26779": msg28884, + "2678": msg5129, + "26780": msg28885, + "26781": msg28886, + "26782": msg28887, + "26783": msg28888, + "26784": msg28889, + "26785": msg28890, + "26786": msg28891, + "26787": msg28892, + "26788": msg28893, + "26789": msg28894, + "2679": msg5130, + "26790": msg28895, + "26791": msg28896, + "26792": msg28897, + "26793": msg28898, + "26794": msg28899, + "26795": msg28900, + "26796": msg28901, + "26797": msg28902, + "26798": msg28903, + "26799": msg28904, + "268": select191, + "2680": msg5131, + "26800": msg28905, + "26801": msg28906, + "26802": msg28907, + "26803": msg28908, + "26804": msg28909, + "26805": msg28910, + "26806": msg28911, + "26807": msg28912, + "26808": msg28913, + "26809": msg28914, + "2681": msg5132, + "26810": msg28915, + "26811": msg28916, + "26812": msg28917, + "26813": msg28918, + "26814": msg28919, + "26815": msg28920, + "26816": msg28921, + "26817": msg28922, + "26818": msg28923, + "26819": msg28924, + "2682": msg5133, + "26820": msg28925, + "26821": msg28926, + "26822": msg28927, + "26823": msg28928, + "26824": msg28929, + "26825": msg28930, + "26826": msg28931, + "26827": msg28932, + "26828": msg28933, + "26829": msg28934, + "2683": msg5134, + "26830": msg28935, + "26831": msg28936, + "26832": msg28937, + "26833": msg28938, + "26834": msg28939, + "26835": msg28940, + "26836": msg28941, + "26837": msg28942, + "26838": msg28943, + "26839": msg28944, + "2684": msg5135, + "26840": msg28945, + "26841": msg28946, + "26842": msg28947, + "26843": msg28948, + "26844": msg28949, + "26845": msg28950, + "26846": msg28951, + "26847": msg28952, + "26848": msg28953, + "26849": msg28954, + "2685": msg5136, + "26850": msg28955, + "26851": msg28956, + "26852": msg28957, + "26853": msg28958, + "26854": msg28959, + "26855": msg28960, + "26856": msg28961, + "26857": msg28962, + "26858": msg28963, + "26859": msg28964, + "2686": msg5137, + "26860": msg28965, + "26861": msg28966, + "26862": msg28967, + "26863": msg28968, + "26864": msg28969, + "26865": msg28970, + "26866": msg28971, + "26867": msg28972, + "26868": msg28973, + "26869": msg28974, + "2687": msg5138, + "26870": msg28975, + "26871": msg28976, + "26872": msg28977, + "26873": msg28978, + "26874": msg28979, + "26875": msg28980, + "26876": msg28981, + "26877": msg28982, + "26878": msg28983, + "26879": msg28984, + "2688": msg5139, + "26880": msg28985, + "26881": msg28986, + "26882": msg28987, + "26883": msg28988, + "26884": msg28989, + "26885": msg28990, + "26886": msg28991, + "26887": msg28992, + "26888": msg28993, + "26889": msg28994, + "2689": msg5140, + "26890": msg28995, + "26891": msg28996, + "26892": msg28997, + "26893": msg28998, + "26894": msg28999, + "26895": msg29000, + "26896": msg29001, + "26897": msg29002, + "26898": msg29003, + "26899": msg29004, + "269": select192, + "2690": msg5141, + "26900": msg29005, + "26901": msg29006, + "26902": msg29007, + "26903": msg29008, + "26904": msg29009, + "26905": msg29010, + "26906": msg29011, + "26907": msg29012, + "26908": msg29013, + "26909": msg29014, + "2691": msg5142, + "26910": msg29015, + "26911": msg29016, + "26912": msg29017, + "26913": msg29018, + "26914": msg29019, + "26915": msg29020, + "26916": msg29021, + "26917": msg29022, + "26918": msg29023, + "26919": msg29024, + "2692": msg5143, + "26920": msg29025, + "26921": msg29026, + "26922": msg29027, + "26923": msg29028, + "26924": msg29029, + "26925": msg29030, + "26926": msg29031, + "26927": msg29032, + "26928": msg29033, + "26929": msg29034, + "2693": msg5144, + "26930": msg29035, + "26931": msg29036, + "26932": msg29037, + "26933": msg29038, + "26934": msg29039, + "26935": msg29040, + "26936": msg29041, + "26937": msg29042, + "26938": msg29043, + "26939": msg29044, + "2694": msg5145, + "26940": msg29045, + "26941": msg29046, + "26942": msg29047, + "26943": msg29048, + "26944": msg29049, + "26945": msg29050, + "26946": msg29051, + "26947": msg29052, + "26948": msg29053, + "26949": msg29054, + "2695": msg5146, + "26950": msg29055, + "26951": msg29056, + "26952": msg29057, + "26953": msg29058, + "26954": msg29059, + "26955": msg29060, + "26956": msg29061, + "26957": msg29062, + "26958": msg29063, + "26959": msg29064, + "2696": msg5147, + "26960": msg29065, + "26961": msg29066, + "26962": msg29067, + "26963": msg29068, + "26964": msg29069, + "26965": msg29070, + "26966": msg29071, + "26967": msg29072, + "26968": msg29073, + "26969": msg29074, + "2697": msg5148, + "26970": msg29075, + "26971": msg29076, + "26972": msg29077, + "26973": msg29078, + "26974": msg29079, + "26975": msg29080, + "26976": msg29081, + "26977": msg29082, + "26978": msg29083, + "26979": msg29084, + "2698": msg5149, + "26980": msg29085, + "26981": msg29086, + "26982": msg29087, + "26983": msg29088, + "26984": msg29089, + "26985": msg29090, + "26986": msg29091, + "26987": msg29092, + "26988": msg29093, + "26989": msg29094, + "2699": msg5150, + "26990": msg29095, + "26991": msg29096, + "26992": msg29097, + "26993": msg29098, + "26994": msg29099, + "26995": msg29100, + "26996": msg29101, + "26997": msg29102, + "26998": msg29103, + "26999": msg29104, + "27": msg61, + "270": select193, + "2700": msg5151, + "27000": msg29105, + "27001": msg29106, + "27002": msg29107, + "27003": msg29108, + "27004": msg29109, + "27005": msg29110, + "27006": msg29111, + "27007": msg29112, + "27008": msg29113, + "27009": msg29114, + "2701": msg5152, + "27010": msg29115, + "27011": msg29116, + "27012": msg29117, + "27013": msg29118, + "27014": msg29119, + "27015": msg29120, + "27016": msg29121, + "27017": msg29122, + "27018": msg29123, + "27019": msg29124, + "2702": msg5153, + "27020": msg29125, + "27021": msg29126, + "27022": msg29127, + "27023": msg29128, + "27024": msg29129, + "27025": msg29130, + "27026": msg29131, + "27027": msg29132, + "27028": msg29133, + "27029": msg29134, + "2703": msg5154, + "27030": msg29135, + "27031": msg29136, + "27032": msg29137, + "27033": msg29138, + "27034": msg29139, + "27035": msg29140, + "27036": msg29141, + "27037": msg29142, + "27038": msg29143, + "27039": msg29144, + "2704": msg5155, + "27040": msg29145, + "27041": msg29146, + "27042": msg29147, + "27043": msg29148, + "27044": msg29149, + "27045": msg29150, + "27046": msg29151, + "27047": msg29152, + "27048": msg29153, + "27049": msg29154, + "2705": msg5156, + "27050": msg29155, + "27051": msg29156, + "27052": msg29157, + "27053": msg29158, + "27054": msg29159, + "27055": msg29160, + "27056": msg29161, + "27057": msg29162, + "27058": msg29163, + "27059": msg29164, + "2706": msg5157, + "27060": msg29165, + "27061": msg29166, + "27062": msg29167, + "27063": msg29168, + "27064": msg29169, + "27065": msg29170, + "27066": msg29171, + "27067": msg29172, + "27068": msg29173, + "27069": msg29174, + "2707": msg5158, + "27070": msg29175, + "27071": msg29176, + "27072": msg29177, + "27073": msg29178, + "27074": msg29179, + "27075": msg29180, + "27076": msg29181, + "27077": msg29182, + "27078": msg29183, + "27079": msg29184, + "2708": msg5159, + "27080": msg29185, + "27081": msg29186, + "27082": msg29187, + "27083": msg29188, + "27084": msg29189, + "27085": msg29190, + "27086": msg29191, + "27087": msg29192, + "27088": msg29193, + "27089": msg29194, + "2709": msg5160, + "27090": msg29195, + "27091": msg29196, + "27092": msg29197, + "27093": msg29198, + "27094": msg29199, + "27095": msg29200, + "27096": msg29201, + "27097": msg29202, + "27098": msg29203, + "27099": msg29204, + "271": select194, + "2710": msg5161, + "27100": msg29205, + "27101": msg29206, + "27102": msg29207, + "27103": msg29208, + "27104": msg29209, + "27105": msg29210, + "27106": msg29211, + "27107": msg29212, + "27108": msg29213, + "27109": msg29214, + "2711": msg5162, + "27110": msg29215, + "27111": msg29216, + "27112": msg29217, + "27113": msg29218, + "27114": msg29219, + "27115": msg29220, + "27116": msg29221, + "27117": msg29222, + "27118": msg29223, + "27119": msg29224, + "2712": msg5163, + "27120": msg29225, + "27121": msg29226, + "27122": msg29227, + "27123": msg29228, + "27124": msg29229, + "27125": msg29230, + "27126": msg29231, + "27127": msg29232, + "27128": msg29233, + "27129": msg29234, + "2713": msg5164, + "27130": msg29235, + "27131": msg29236, + "27132": msg29237, + "27133": msg29238, + "27134": msg29239, + "27135": msg29240, + "27136": msg29241, + "27137": msg29242, + "27138": msg29243, + "27139": msg29244, + "2714": msg5165, + "27140": msg29245, + "27141": msg29246, + "27142": msg29247, + "27143": msg29248, + "27144": msg29249, + "27145": msg29250, + "27146": msg29251, + "27147": msg29252, + "27148": msg29253, + "27149": msg29254, + "2715": msg5166, + "27150": msg29255, + "27151": msg29256, + "27152": msg29257, + "27153": msg29258, + "27154": msg29259, + "27155": msg29260, + "27156": msg29261, + "27157": msg29262, + "27158": msg29263, + "27159": msg29264, + "2716": msg5167, + "27160": msg29265, + "27161": msg29266, + "27162": msg29267, + "27163": msg29268, + "27164": msg29269, + "27165": msg29270, + "27166": msg29271, + "27167": msg29272, + "27168": msg29273, + "27169": msg29274, + "2717": msg5168, + "27170": msg29275, + "27171": msg29276, + "27172": msg29277, + "27173": msg29278, + "27174": msg29279, + "27175": msg29280, + "27176": msg29281, + "27177": msg29282, + "27178": msg29283, + "27179": msg29284, + "2718": msg5169, + "27180": msg29285, + "27181": msg29286, + "27182": msg29287, + "27183": msg29288, + "27184": msg29289, + "27185": msg29290, + "27186": msg29291, + "27187": msg29292, + "27188": msg29293, + "27189": msg29294, + "2719": msg5170, + "27190": msg29295, + "27191": msg29296, + "27192": msg29297, + "27193": msg29298, + "27194": msg29299, + "27195": msg29300, + "27196": msg29301, + "27197": msg29302, + "27198": msg29303, + "27199": msg29304, + "272": select195, + "2720": msg5171, + "27200": msg29305, + "27201": msg29306, + "27202": msg29307, + "27203": msg29308, + "27204": msg29309, + "27205": msg29310, + "27206": msg29311, + "27207": msg29312, + "27208": msg29313, + "27209": msg29314, + "2721": msg5172, + "27210": msg29315, + "27211": msg29316, + "27212": msg29317, + "27213": msg29318, + "27214": msg29319, + "27215": msg29320, + "27216": msg29321, + "27217": msg29322, + "27218": msg29323, + "27219": msg29324, + "2722": msg5173, + "27220": msg29325, + "27221": msg29326, + "27222": msg29327, + "27223": msg29328, + "27224": msg29329, + "27225": msg29330, + "27226": msg29331, + "27227": msg29332, + "27228": msg29333, + "27229": msg29334, + "2723": msg5174, + "27230": msg29335, + "27231": msg29336, + "27232": msg29337, + "27233": msg29338, + "27234": msg29339, + "27235": msg29340, + "27236": msg29341, + "27237": msg29342, + "27238": msg29343, + "27239": msg29344, + "2724": msg5175, + "27240": msg29345, + "27241": msg29346, + "27242": msg29347, + "27243": msg29348, + "27244": msg29349, + "27245": msg29350, + "27246": msg29351, + "27247": msg29352, + "27248": msg29353, + "27249": msg29354, + "2725": msg5176, + "27250": msg29355, + "27251": msg29356, + "27252": msg29357, + "27253": msg29358, + "27254": msg29359, + "27255": msg29360, + "27256": msg29361, + "27257": msg29362, + "27258": msg29363, + "27259": msg29364, + "2726": msg5177, + "27260": msg29365, + "27261": msg29366, + "27262": msg29367, + "27263": msg29368, + "27264": msg29369, + "27265": msg29370, + "27266": msg29371, + "27267": msg29372, + "27268": msg29373, + "27269": msg29374, + "2727": msg5178, + "27270": msg29375, + "27271": msg29376, + "27272": msg29377, + "27273": msg29378, + "27274": msg29379, + "27275": msg29380, + "27276": msg29381, + "27277": msg29382, + "27278": msg29383, + "27279": msg29384, + "2728": msg5179, + "27280": msg29385, + "27281": msg29386, + "27282": msg29387, + "27283": msg29388, + "27284": msg29389, + "27285": msg29390, + "27286": msg29391, + "27287": msg29392, + "27288": msg29393, + "27289": msg29394, + "2729": msg5180, + "27290": msg29395, + "27291": msg29396, + "27292": msg29397, + "27293": msg29398, + "27294": msg29399, + "27295": msg29400, + "27296": msg29401, + "27297": msg29402, + "27298": msg29403, + "27299": msg29404, + "273": select196, + "2730": msg5181, + "27300": msg29405, + "27301": msg29406, + "27302": msg29407, + "27303": msg29408, + "27304": msg29409, + "27305": msg29410, + "27306": msg29411, + "27307": msg29412, + "27308": msg29413, + "27309": msg29414, + "2731": msg5182, + "27310": msg29415, + "27311": msg29416, + "27312": msg29417, + "27313": msg29418, + "27314": msg29419, + "27315": msg29420, + "27316": msg29421, + "27317": msg29422, + "27318": msg29423, + "27319": msg29424, + "2732": msg5183, + "27320": msg29425, + "27321": msg29426, + "27322": msg29427, + "27323": msg29428, + "27324": msg29429, + "27325": msg29430, + "27326": msg29431, + "27327": msg29432, + "27328": msg29433, + "27329": msg29434, + "2733": msg5184, + "27330": msg29435, + "27331": msg29436, + "27332": msg29437, + "27333": msg29438, + "27334": msg29439, + "27335": msg29440, + "27336": msg29441, + "27337": msg29442, + "27338": msg29443, + "27339": msg29444, + "2734": msg5185, + "27340": msg29445, + "27341": msg29446, + "27342": msg29447, + "27343": msg29448, + "27344": msg29449, + "27345": msg29450, + "27346": msg29451, + "27347": msg29452, + "27348": msg29453, + "27349": msg29454, + "2735": msg5186, + "27350": msg29455, + "27351": msg29456, + "27352": msg29457, + "27353": msg29458, + "27354": msg29459, + "27355": msg29460, + "27356": msg29461, + "27357": msg29462, + "27358": msg29463, + "27359": msg29464, + "2736": msg5187, + "27360": msg29465, + "27361": msg29466, + "27362": msg29467, + "27363": msg29468, + "27364": msg29469, + "27365": msg29470, + "27366": msg29471, + "27367": msg29472, + "27368": msg29473, + "27369": msg29474, + "2737": msg5188, + "27370": msg29475, + "27371": msg29476, + "27372": msg29477, + "27373": msg29478, + "27374": msg29479, + "27375": msg29480, + "27376": msg29481, + "27377": msg29482, + "27378": msg29483, + "27379": msg29484, + "2738": msg5189, + "27380": msg29485, + "27381": msg29486, + "27382": msg29487, + "27383": msg29488, + "27384": msg29489, + "27385": msg29490, + "27386": msg29491, + "27387": msg29492, + "27388": msg29493, + "27389": msg29494, + "2739": msg5190, + "27390": msg29495, + "27391": msg29496, + "27392": msg29497, + "27393": msg29498, + "27394": msg29499, + "27395": msg29500, + "27396": msg29501, + "27397": msg29502, + "27398": msg29503, + "27399": msg29504, + "274": select197, + "2740": msg5191, + "27400": msg29505, + "27401": msg29506, + "27402": msg29507, + "27403": msg29508, + "27404": msg29509, + "27405": msg29510, + "27406": msg29511, + "27407": msg29512, + "27408": msg29513, + "27409": msg29514, + "2741": msg5192, + "27410": msg29515, + "27411": msg29516, + "27412": msg29517, + "27413": msg29518, + "27414": msg29519, + "27415": msg29520, + "27416": msg29521, + "27417": msg29522, + "27418": msg29523, + "27419": msg29524, + "2742": msg5193, + "27420": msg29525, + "27421": msg29526, + "27422": msg29527, + "27423": msg29528, + "27424": msg29529, + "27425": msg29530, + "27426": msg29531, + "27427": msg29532, + "27428": msg29533, + "27429": msg29534, + "2743": msg5194, + "27430": msg29535, + "27431": msg29536, + "27432": msg29537, + "27433": msg29538, + "27434": msg29539, + "27435": msg29540, + "27436": msg29541, + "27437": msg29542, + "27438": msg29543, + "27439": msg29544, + "2744": msg5195, + "27440": msg29545, + "27441": msg29546, + "27442": msg29547, + "27443": msg29548, + "27444": msg29549, + "27445": msg29550, + "27446": msg29551, + "27447": msg29552, + "27448": msg29553, + "27449": msg29554, + "2745": msg5196, + "27450": msg29555, + "27451": msg29556, + "27452": msg29557, + "27453": msg29558, + "27454": msg29559, + "27455": msg29560, + "27456": msg29561, + "27457": msg29562, + "27458": msg29563, + "27459": msg29564, + "2746": msg5197, + "27460": msg29565, + "27461": msg29566, + "27462": msg29567, + "27463": msg29568, + "27464": msg29569, + "27465": msg29570, + "27466": msg29571, + "27467": msg29572, + "27468": msg29573, + "27469": msg29574, + "2747": msg5198, + "27470": msg29575, + "27471": msg29576, + "27472": msg29577, + "27473": msg29578, + "27474": msg29579, + "27475": msg29580, + "27476": msg29581, + "27477": msg29582, + "27478": msg29583, + "27479": msg29584, + "2748": msg5199, + "27480": msg29585, + "27481": msg29586, + "27482": msg29587, + "27483": msg29588, + "27484": msg29589, + "27485": msg29590, + "27486": msg29591, + "27487": msg29592, + "27488": msg29593, + "27489": msg29594, + "2749": msg5200, + "27490": msg29595, + "27491": msg29596, + "27492": msg29597, + "27493": msg29598, + "27494": msg29599, + "27495": msg29600, + "27496": msg29601, + "27497": msg29602, + "27498": msg29603, + "27499": msg29604, + "275": select198, + "2750": msg5201, + "27500": msg29605, + "27501": msg29606, + "27502": msg29607, + "27503": msg29608, + "27504": msg29609, + "27505": msg29610, + "27506": msg29611, + "27507": msg29612, + "27508": msg29613, + "27509": msg29614, + "2751": msg5202, + "27510": msg29615, + "27511": msg29616, + "27512": msg29617, + "27513": msg29618, + "27514": msg29619, + "27515": msg29620, + "27516": msg29621, + "27517": msg29622, + "27518": msg29623, + "27519": msg29624, + "2752": msg5203, + "27520": msg29625, + "27521": msg29626, + "27522": msg29627, + "27523": msg29628, + "27524": msg29629, + "27525": msg29630, + "27526": msg29631, + "27527": msg29632, + "27528": msg29633, + "27529": msg29634, + "2753": msg5204, + "27530": msg29635, + "27531": msg29636, + "27532": msg29637, + "27533": msg29638, + "27534": msg29639, + "27535": msg29640, + "27536": msg29641, + "27537": msg29642, + "27538": msg29643, + "27539": msg29644, + "2754": msg5205, + "27540": msg29645, + "27541": msg29646, + "27542": msg29647, + "27543": msg29648, + "27544": msg29649, + "27545": msg29650, + "27546": msg29651, + "27547": msg29652, + "27548": msg29653, + "27549": msg29654, + "2755": msg5206, + "27550": msg29655, + "27551": msg29656, + "27552": msg29657, + "27553": msg29658, + "27554": msg29659, + "27555": msg29660, + "27556": msg29661, + "27557": msg29662, + "27558": msg29663, + "27559": msg29664, + "2756": msg5207, + "27560": msg29665, + "27561": msg29666, + "27562": msg29667, + "27563": msg29668, + "27564": msg29669, + "27565": msg29670, + "27566": msg29671, + "27567": msg29672, + "27568": msg29673, + "27569": msg29674, + "2757": msg5208, + "27570": msg29675, + "27571": msg29676, + "27572": msg29677, + "27573": msg29678, + "27574": msg29679, + "27575": msg29680, + "27576": msg29681, + "27577": msg29682, + "27578": msg29683, + "27579": msg29684, + "2758": msg5209, + "27580": msg29685, + "27581": msg29686, + "27582": msg29687, + "27583": msg29688, + "27584": msg29689, + "27585": msg29690, + "27586": msg29691, + "27587": msg29692, + "27588": msg29693, + "27589": msg29694, + "2759": msg5210, + "27590": msg29695, + "27591": msg29696, + "27592": msg29697, + "27593": msg29698, + "27594": msg29699, + "27595": msg29700, + "27596": msg29701, + "27597": msg29702, + "27598": msg29703, + "27599": msg29704, + "276": select199, + "2760": msg5211, + "27600": msg29705, + "27601": msg29706, + "27602": msg29707, + "27603": msg29708, + "27604": msg29709, + "27605": msg29710, + "27606": msg29711, + "27607": msg29712, + "27608": msg29713, + "27609": msg29714, + "2761": msg5212, + "27610": msg29715, + "27611": msg29716, + "27612": msg29717, + "27613": msg29718, + "27614": msg29719, + "27615": msg29720, + "27616": msg29721, + "27617": msg29722, + "27618": msg29723, + "27619": msg29724, + "2762": msg5213, + "27620": msg29725, + "27621": msg29726, + "27622": msg29727, + "27623": msg29728, + "27624": msg29729, + "27625": msg29730, + "27626": msg29731, + "27627": msg29732, + "27628": msg29733, + "27629": msg29734, + "2763": msg5214, + "27630": msg29735, + "27631": msg29736, + "27632": msg29737, + "27633": msg29738, + "27634": msg29739, + "27635": msg29740, + "27636": msg29741, + "27637": msg29742, + "27638": msg29743, + "27639": msg29744, + "2764": msg5215, + "27640": msg29745, + "27641": msg29746, + "27642": msg29747, + "27643": msg29748, + "27644": msg29749, + "27645": msg29750, + "27646": msg29751, + "27647": msg29752, + "27648": msg29753, + "27649": msg29754, + "2765": msg5216, + "27650": msg29755, + "27651": msg29756, + "27652": msg29757, + "27653": msg29758, + "27654": msg29759, + "27655": msg29760, + "27656": msg29761, + "27657": msg29762, + "27658": msg29763, + "27659": msg29764, + "2766": msg5217, + "27660": msg29765, + "27661": msg29766, + "27662": msg29767, + "27663": msg29768, + "27664": msg29769, + "27665": msg29770, + "27666": msg29771, + "27667": msg29772, + "27668": msg29773, + "27669": msg29774, + "2767": msg5218, + "27670": msg29775, + "27671": msg29776, + "27672": msg29777, + "27673": msg29778, + "27674": msg29779, + "27675": msg29780, + "27676": msg29781, + "27677": msg29782, + "27678": msg29783, + "27679": msg29784, + "2768": msg5219, + "27680": msg29785, + "27681": msg29786, + "27682": msg29787, + "27683": msg29788, + "27684": msg29789, + "27685": msg29790, + "27686": msg29791, + "27687": msg29792, + "27688": msg29793, + "27689": msg29794, + "2769": msg5220, + "27690": msg29795, + "27691": msg29796, + "27692": msg29797, + "27693": msg29798, + "27694": msg29799, + "27695": msg29800, + "27696": msg29801, + "27697": msg29802, + "27698": msg29803, + "27699": msg29804, + "277": select200, + "2770": msg5221, + "27700": msg29805, + "27701": msg29806, + "27702": msg29807, + "27703": msg29808, + "27704": msg29809, + "27705": msg29810, + "27706": msg29811, + "27707": msg29812, + "27708": msg29813, + "27709": msg29814, + "2771": msg5222, + "27710": msg29815, + "27711": msg29816, + "27712": msg29817, + "27713": msg29818, + "27714": msg29819, + "27715": msg29820, + "27716": msg29821, + "27717": msg29822, + "27718": msg29823, + "27719": msg29824, + "2772": msg5223, + "27720": msg29825, + "27721": msg29826, + "27722": msg29827, + "27723": msg29828, + "27724": msg29829, + "27725": msg29830, + "27726": msg29831, + "27727": msg29832, + "27728": msg29833, + "27729": msg29834, + "2773": msg5224, + "27730": msg29835, + "27731": msg29836, + "27732": msg29837, + "27733": msg29838, + "27734": msg29839, + "27735": msg29840, + "27736": msg29841, + "27737": msg29842, + "27738": msg29843, + "27739": msg29844, + "2774": msg5225, + "27740": msg29845, + "27741": msg29846, + "27742": msg29847, + "27743": msg29848, + "27744": msg29849, + "27745": msg29850, + "27746": msg29851, + "27747": msg29852, + "27748": msg29853, + "27749": msg29854, + "2775": msg5226, + "27750": msg29855, + "27751": msg29856, + "27752": msg29857, + "27753": msg29858, + "27754": msg29859, + "27755": msg29860, + "27756": msg29861, + "27757": msg29862, + "27758": msg29863, + "27759": msg29864, + "2776": msg5227, + "27760": msg29865, + "27761": msg29866, + "27762": msg29867, + "27763": msg29868, + "27764": msg29869, + "27765": msg29870, + "27766": msg29871, + "27767": msg29872, + "27768": msg29873, + "27769": msg29874, + "2777": msg5228, + "27770": msg29875, + "27771": msg29876, + "27772": msg29877, + "27773": msg29878, + "27774": msg29879, + "27775": msg29880, + "27776": msg29881, + "27777": msg29882, + "27778": msg29883, + "27779": msg29884, + "2778": msg5229, + "27780": msg29885, + "27781": msg29886, + "27782": msg29887, + "27783": msg29888, + "27784": msg29889, + "27785": msg29890, + "27786": msg29891, + "27787": msg29892, + "27788": msg29893, + "27789": msg29894, + "2779": msg5230, + "27790": msg29895, + "27791": msg29896, + "27792": msg29897, + "27793": msg29898, + "27794": msg29899, + "27795": msg29900, + "27796": msg29901, + "27797": msg29902, + "27798": msg29903, + "27799": msg29904, + "278": select201, + "2780": msg5231, + "27800": msg29905, + "27801": msg29906, + "27802": msg29907, + "27803": msg29908, + "27804": msg29909, + "27805": msg29910, + "27806": msg29911, + "27807": msg29912, + "27808": msg29913, + "27809": msg29914, + "2781": msg5232, + "27810": msg29915, + "27811": msg29916, + "27812": msg29917, + "27813": msg29918, + "27814": msg29919, + "27815": msg29920, + "27816": msg29921, + "27817": msg29922, + "27818": msg29923, + "27819": msg29924, + "2782": msg5233, + "27820": msg29925, + "27821": msg29926, + "27822": msg29927, + "27823": msg29928, + "27824": msg29929, + "27825": msg29930, + "27826": msg29931, + "27827": msg29932, + "27828": msg29933, + "27829": msg29934, + "2783": msg5234, + "27830": msg29935, + "27831": msg29936, + "27832": msg29937, + "27833": msg29938, + "27834": msg29939, + "27835": msg29940, + "27836": msg29941, + "27837": msg29942, + "27838": msg29943, + "27839": msg29944, + "2784": msg5235, + "27840": msg29945, + "27841": msg29946, + "27842": msg29947, + "27843": msg29948, + "27844": msg29949, + "27845": msg29950, + "27846": msg29951, + "27847": msg29952, + "27848": msg29953, + "27849": msg29954, + "2785": msg5236, + "27850": msg29955, + "27851": msg29956, + "27852": msg29957, + "27853": msg29958, + "27854": msg29959, + "27855": msg29960, + "27856": msg29961, + "27857": msg29962, + "27858": msg29963, + "27859": msg29964, + "2786": msg5237, + "27860": msg29965, + "27861": msg29966, + "27862": msg29967, + "27863": msg29968, + "27864": msg29969, + "27865": msg29970, + "27866": msg29971, + "27867": msg29972, + "27868": msg29973, + "27869": msg29974, + "2787": msg5238, + "27870": msg29975, + "27871": msg29976, + "27872": msg29977, + "27873": msg29978, + "27874": msg29979, + "27875": msg29980, + "27876": msg29981, + "27877": msg29982, + "27878": msg29983, + "27879": msg29984, + "2788": msg5239, + "27880": msg29985, + "27881": msg29986, + "27882": msg29987, + "27883": msg29988, + "27884": msg29989, + "27885": msg29990, + "27886": msg29991, + "27887": msg29992, + "27888": msg29993, + "27889": msg29994, + "2789": msg5240, + "27890": msg29995, + "27891": msg29996, + "27892": msg29997, + "27893": msg29998, + "27894": msg29999, + "27895": msg30000, + "27896": msg30001, + "27897": msg30002, + "27898": msg30003, + "27899": msg30004, + "279": select202, + "2790": msg5241, + "27900": msg30005, + "27901": msg30006, + "27902": msg30007, + "27903": msg30008, + "27904": msg30009, + "27905": msg30010, + "27906": msg30011, + "27907": msg30012, + "27908": msg30013, + "27909": msg30014, + "2791": msg5242, + "27910": msg30015, + "27911": msg30016, + "27912": msg30017, + "27913": msg30018, + "27914": msg30019, + "27915": msg30020, + "27916": msg30021, + "27917": msg30022, + "27918": msg30023, + "27919": msg30024, + "2792": msg5243, + "27920": msg30025, + "27921": msg30026, + "27922": msg30027, + "27923": msg30028, + "27924": msg30029, + "27925": msg30030, + "27926": msg30031, + "27927": msg30032, + "27928": msg30033, + "27929": msg30034, + "2793": msg5244, + "27930": msg30035, + "27931": msg30036, + "27932": msg30037, + "27933": msg30038, + "27934": msg30039, + "27935": msg30040, + "27936": msg30041, + "27937": msg30042, + "27938": msg30043, + "27939": msg30044, + "2794": msg5245, + "27940": msg30045, + "27941": msg30046, + "27942": msg30047, + "27943": msg30048, + "27944": msg30049, + "27945": msg30050, + "27946": msg30051, + "27947": msg30052, + "27948": msg30053, + "27949": msg30054, + "2795": msg5246, + "27950": msg30055, + "27951": msg30056, + "27952": msg30057, + "27953": msg30058, + "27954": msg30059, + "27955": msg30060, + "27956": msg30061, + "27957": msg30062, + "27958": msg30063, + "27959": msg30064, + "2796": msg5247, + "27960": msg30065, + "27961": msg30066, + "27962": msg30067, + "27963": msg30068, + "27964": msg30069, + "27965": msg30070, + "27966": msg30071, + "27967": msg30072, + "27968": msg30073, + "27969": msg30074, + "2797": msg5248, + "27970": msg30075, + "27971": msg30076, + "27972": msg30077, + "27973": msg30078, + "27974": msg30079, + "27975": msg30080, + "27976": msg30081, + "27977": msg30082, + "27978": msg30083, + "27979": msg30084, + "2798": msg5249, + "27980": msg30085, + "27981": msg30086, + "27982": msg30087, + "27983": msg30088, + "27984": msg30089, + "27985": msg30090, + "27986": msg30091, + "27987": msg30092, + "27988": msg30093, + "27989": msg30094, + "2799": msg5250, + "27990": msg30095, + "27991": msg30096, + "27992": msg30097, + "27993": msg30098, + "27994": msg30099, + "27995": msg30100, + "27996": msg30101, + "27997": msg30102, + "27998": msg30103, + "27999": msg30104, + "28": msg62, + "280": select203, + "2800": msg5251, + "28000": msg30105, + "28001": msg30106, + "28002": msg30107, + "28003": msg30108, + "28004": msg30109, + "28005": msg30110, + "28006": msg30111, + "28007": msg30112, + "28008": msg30113, + "28009": msg30114, + "2801": msg5252, + "28010": msg30115, + "28011": msg30116, + "28012": msg30117, + "28013": msg30118, + "28014": msg30119, + "28015": msg30120, + "28016": msg30121, + "28017": msg30122, + "28018": msg30123, + "28019": msg30124, + "2802": msg5253, + "28020": msg30125, + "28021": msg30126, + "28022": msg30127, + "28023": msg30128, + "28024": msg30129, + "28025": msg30130, + "28026": msg30131, + "28027": msg30132, + "28028": msg30133, + "28029": msg30134, + "2803": msg5254, + "28030": msg30135, + "28031": msg30136, + "28032": msg30137, + "28033": msg30138, + "28034": msg30139, + "28035": msg30140, + "28036": msg30141, + "28037": msg30142, + "28038": msg30143, + "28039": msg30144, + "2804": msg5255, + "28040": msg30145, + "28041": msg30146, + "28042": msg30147, + "28043": msg30148, + "28044": msg30149, + "28045": msg30150, + "28046": msg30151, + "28047": msg30152, + "28048": msg30153, + "28049": msg30154, + "2805": msg5256, + "28050": msg30155, + "28051": msg30156, + "28052": msg30157, + "28053": msg30158, + "28054": msg30159, + "28055": msg30160, + "28056": msg30161, + "28057": msg30162, + "28058": msg30163, + "28059": msg30164, + "2806": msg5257, + "28060": msg30165, + "28061": msg30166, + "28062": msg30167, + "28063": msg30168, + "28064": msg30169, + "28065": msg30170, + "28066": msg30171, + "28067": msg30172, + "28068": msg30173, + "28069": msg30174, + "2807": msg5258, + "28070": msg30175, + "28071": msg30176, + "28072": msg30177, + "28073": msg30178, + "28074": msg30179, + "28075": msg30180, + "28076": msg30181, + "28077": msg30182, + "28078": msg30183, + "28079": msg30184, + "2808": msg5259, + "28080": msg30185, + "28081": msg30186, + "28082": msg30187, + "28083": msg30188, + "28084": msg30189, + "28085": msg30190, + "28086": msg30191, + "28087": msg30192, + "28088": msg30193, + "28089": msg30194, + "2809": msg5260, + "28090": msg30195, + "28093": msg30196, + "28094": msg30197, + "28095": msg30198, + "28096": msg30199, + "28097": msg30200, + "28098": msg30201, + "28099": msg30202, + "281": select204, + "2810": msg5261, + "28100": msg30203, + "28101": msg30204, + "28102": msg30205, + "28103": msg30206, + "28104": msg30207, + "28105": msg30208, + "28106": msg30209, + "28107": msg30210, + "28108": msg30211, + "28109": msg30212, + "2811": msg5262, + "28110": msg30213, + "28111": msg30214, + "28112": msg30215, + "28113": msg30216, + "28114": msg30217, + "28115": msg30218, + "28116": msg30219, + "28117": msg30220, + "28118": msg30221, + "28119": msg30222, + "2812": msg5263, + "28120": msg30223, + "28121": msg30224, + "28122": msg30225, + "28123": msg30226, + "28124": msg30227, + "28125": msg30228, + "28126": msg30229, + "28127": msg30230, + "28128": msg30231, + "28129": msg30232, + "2813": msg5264, + "28130": msg30233, + "28131": msg30234, + "28132": msg30235, + "28133": msg30236, + "28134": msg30237, + "28135": msg30238, + "28136": msg30239, + "28137": msg30240, + "28138": msg30241, + "28139": msg30242, + "2814": msg5265, + "28140": msg30243, + "28141": msg30244, + "28142": msg30245, + "28143": msg30246, + "28144": msg30247, + "28145": msg30248, + "28146": msg30249, + "28147": msg30250, + "28148": msg30251, + "28149": msg30252, + "2815": msg5266, + "28150": msg30253, + "28151": msg30254, + "28152": msg30255, + "28153": msg30256, + "28154": msg30257, + "28155": msg30258, + "28156": msg30259, + "28157": msg30260, + "28158": msg30261, + "28159": msg30262, + "2816": msg5267, + "28160": msg30263, + "28161": msg30264, + "28162": msg30265, + "28163": msg30266, + "28164": msg30267, + "28165": msg30268, + "28166": msg30269, + "28167": msg30270, + "28168": msg30271, + "28169": msg30272, + "2817": msg5268, + "28170": msg30273, + "28171": msg30274, + "28172": msg30275, + "28173": msg30276, + "28174": msg30277, + "28175": msg30278, + "28176": msg30279, + "28177": msg30280, + "28178": msg30281, + "28179": msg30282, + "2818": msg5269, + "28180": msg30283, + "28181": msg30284, + "28182": msg30285, + "28183": msg30286, + "28184": msg30287, + "28185": msg30288, + "28186": msg30289, + "28187": msg30290, + "28188": msg30291, + "28189": msg30292, + "2819": msg5270, + "28190": msg30293, + "28191": msg30294, + "28192": msg30295, + "28193": msg30296, + "28194": msg30297, + "28195": msg30298, + "28196": msg30299, + "28197": msg30300, + "28198": msg30301, + "28199": msg30302, + "282": select205, + "2820": msg5271, + "28200": msg30303, + "28201": msg30304, + "28202": msg30305, + "28203": msg30306, + "28204": msg30307, + "28205": msg30308, + "28206": msg30309, + "28207": msg30310, + "28208": msg30311, + "28209": msg30312, + "2821": msg5272, + "28210": msg30313, + "28211": msg30314, + "28212": msg30315, + "28213": msg30316, + "28214": msg30317, + "28215": msg30318, + "28216": msg30319, + "28217": msg30320, + "28218": msg30321, + "28219": msg30322, + "2822": msg5273, + "28220": msg30323, + "28221": msg30324, + "28222": msg30325, + "28223": msg30326, + "28224": msg30327, + "28225": msg30328, + "28226": msg30329, + "28227": msg30330, + "28228": msg30331, + "28229": msg30332, + "2823": msg5274, + "28230": msg30333, + "28231": msg30334, + "28232": msg30335, + "28233": msg30336, + "28234": msg30337, + "28235": msg30338, + "28236": msg30339, + "28237": msg30340, + "28238": msg30341, + "28239": msg30342, + "2824": msg5275, + "28240": msg30343, + "28241": msg30344, + "28242": msg30345, + "28243": msg30346, + "28244": msg30347, + "28245": msg30348, + "28246": msg30349, + "28247": msg30350, + "28248": msg30351, + "28249": msg30352, + "2825": msg5276, + "28250": msg30353, + "28251": msg30354, + "28252": msg30355, + "28253": msg30356, + "28254": msg30357, + "28255": msg30358, + "28256": msg30359, + "28257": msg30360, + "28258": msg30361, + "28259": msg30362, + "2826": msg5277, + "28260": msg30363, + "28261": msg30364, + "28262": msg30365, + "28263": msg30366, + "28264": msg30367, + "28265": msg30368, + "28266": msg30369, + "28267": msg30370, + "28268": msg30371, + "28269": msg30372, + "2827": msg5278, + "28270": msg30373, + "28271": msg30374, + "28272": msg30375, + "28273": msg30376, + "28274": msg30377, + "28275": msg30378, + "28276": msg30379, + "28277": msg30380, + "28278": msg30381, + "28279": msg30382, + "2828": msg5279, + "28280": msg30383, + "28281": msg30384, + "28282": msg30385, + "28283": msg30386, + "28284": msg30387, + "28285": msg30388, + "28286": msg30389, + "28287": msg30390, + "28288": msg30391, + "28289": msg30392, + "2829": msg5280, + "28290": msg30393, + "28291": msg30394, + "28292": msg30395, + "28293": msg30396, + "28294": msg30397, + "28295": msg30398, + "28296": msg30399, + "28297": msg30400, + "28298": msg30401, + "28299": msg30402, + "283": select206, + "2830": msg5281, + "28300": msg30403, + "28303": msg30404, + "28304": msg30405, + "28305": msg30406, + "28306": msg30407, + "28309": msg30408, + "2831": msg5282, + "28315": msg30409, + "2832": msg5283, + "28323": msg30410, + "28325": msg30411, + "28326": msg30412, + "28327": msg30413, + "28328": msg30414, + "28329": msg30415, + "2833": msg5284, + "28330": msg30416, + "28331": msg30417, + "28332": msg30418, + "28333": msg30419, + "28334": msg30420, + "28335": msg30421, + "28336": msg30422, + "28337": msg30423, + "28338": msg30424, + "28339": msg30425, + "2834": msg5285, + "28340": msg30426, + "28341": msg30427, + "28342": msg30428, + "28343": msg30429, + "28344": msg30430, + "28345": msg30431, + "28346": msg30432, + "28347": msg30433, + "28348": msg30434, + "28349": msg30435, + "2835": msg5286, + "28350": msg30436, + "28351": msg30437, + "28352": msg30438, + "28353": msg30439, + "28354": msg30440, + "28355": msg30441, + "28356": msg30442, + "28357": msg30443, + "28358": msg30444, + "28359": msg30445, + "2836": msg5287, + "28360": msg30446, + "28361": msg30447, + "28362": msg30448, + "28363": msg30449, + "28364": msg30450, + "28365": msg30451, + "28366": msg30452, + "28367": msg30453, + "28368": msg30454, + "28369": msg30455, + "2837": msg5288, + "28370": msg30456, + "28371": msg30457, + "28372": msg30458, + "28373": msg30459, + "28374": msg30460, + "28375": msg30461, + "28376": msg30462, + "28377": msg30463, + "28378": msg30464, + "28379": msg30465, + "2838": msg5289, + "28380": msg30466, + "28381": msg30467, + "28382": msg30468, + "28383": msg30469, + "28384": msg30470, + "28385": msg30471, + "28386": msg30472, + "28387": msg30473, + "28388": msg30474, + "28389": msg30475, + "2839": msg5290, + "28390": msg30476, + "28391": msg30477, + "28392": msg30478, + "28393": msg30479, + "28394": msg30480, + "28395": msg30481, + "28396": msg30482, + "28397": msg30483, + "28398": msg30484, + "28399": msg30485, + "284": select207, + "2840": msg5291, + "28400": msg30486, + "28401": msg30487, + "28402": msg30488, + "28403": msg30489, + "28404": msg30490, + "28405": msg30491, + "28406": msg30492, + "28407": msg30493, + "28408": msg30494, + "28409": msg30495, + "2841": msg5292, + "28410": msg30496, + "28411": msg30497, + "28412": msg30498, + "28413": msg30499, + "28414": msg30500, + "28415": msg30501, + "28416": msg30502, + "28417": msg30503, + "28418": msg30504, + "28419": msg30505, + "2842": msg5293, + "28420": msg30506, + "28421": msg30507, + "28422": msg30508, + "28423": msg30509, + "28424": msg30510, + "28425": msg30511, + "28426": msg30512, + "28427": msg30513, + "28428": msg30514, + "28429": msg30515, + "2843": msg5294, + "28430": msg30516, + "28431": msg30517, + "28432": msg30518, + "28433": msg30519, + "28434": msg30520, + "28435": msg30521, + "28436": msg30522, + "28437": msg30523, + "28438": msg30524, + "28439": msg30525, + "2844": msg5295, + "28440": msg30526, + "28441": msg30527, + "28442": msg30528, + "28443": msg30529, + "28444": msg30530, + "28445": msg30531, + "28446": msg30532, + "28447": msg30533, + "28448": msg30534, + "28449": msg30535, + "2845": msg5296, + "28450": msg30536, + "28451": msg30537, + "28452": msg30538, + "28453": msg30539, + "28454": msg30540, + "28455": msg30541, + "28456": msg30542, + "28457": msg30543, + "28458": msg30544, + "28459": msg30545, + "2846": msg5297, + "28460": msg30546, + "28461": msg30547, + "28462": msg30548, + "28463": msg30549, + "28464": msg30550, + "28465": msg30551, + "28466": msg30552, + "28467": msg30553, + "28468": msg30554, + "28469": msg30555, + "2847": msg5298, + "28470": msg30556, + "28471": msg30557, + "28472": msg30558, + "28473": msg30559, + "28474": msg30560, + "28475": msg30561, + "28476": msg30562, + "28477": msg30563, + "28478": msg30564, + "28479": msg30565, + "2848": msg5299, + "28480": msg30566, + "28481": msg30567, + "28482": msg30568, + "28483": msg30569, + "28484": msg30570, + "28485": msg30571, + "28486": msg30572, + "28487": msg30573, + "28488": msg30574, + "28489": msg30575, + "2849": msg5300, + "28490": msg30576, + "28491": msg30577, + "28492": msg30578, + "28493": msg30579, + "28494": msg30580, + "28495": msg30581, + "28496": msg30582, + "28497": msg30583, + "28498": msg30584, + "28499": msg30585, + "285": select208, + "2850": msg5301, + "28500": msg30586, + "28501": msg30587, + "28502": msg30588, + "28503": msg30589, + "28504": msg30590, + "28505": msg30591, + "28506": msg30592, + "28507": msg30593, + "28508": msg30594, + "28509": msg30595, + "2851": msg5302, + "28510": msg30596, + "28511": msg30597, + "28512": msg30598, + "28513": msg30599, + "28514": msg30600, + "28515": msg30601, + "28516": msg30602, + "28517": msg30603, + "28518": msg30604, + "28519": msg30605, + "2852": msg5303, + "28520": msg30606, + "28521": msg30607, + "28522": msg30608, + "28523": msg30609, + "28524": msg30610, + "28525": msg30611, + "28526": msg30612, + "28527": msg30613, + "28528": msg30614, + "28529": msg30615, + "2853": msg5304, + "28530": msg30616, + "28531": msg30617, + "28532": msg30618, + "28533": msg30619, + "28534": msg30620, + "28535": msg30621, + "28536": msg30622, + "28537": msg30623, + "28538": msg30624, + "28539": msg30625, + "2854": msg5305, + "28540": msg30626, + "28541": msg30627, + "28542": msg30628, + "28543": msg30629, + "28544": msg30630, + "28545": msg30631, + "28546": msg30632, + "28547": msg30633, + "28548": msg30634, + "28549": msg30635, + "2855": msg5306, + "28550": msg30636, + "28551": msg30637, + "28552": msg30638, + "28553": msg30639, + "28554": msg30640, + "28555": msg30641, + "28556": msg30642, + "28557": msg30643, + "28558": msg30644, + "28559": msg30645, + "2856": msg5307, + "28560": msg30646, + "28561": msg30647, + "28562": msg30648, + "28563": msg30649, + "28564": msg30650, + "28565": msg30651, + "28566": msg30652, + "28567": msg30653, + "28568": msg30654, + "28569": msg30655, + "2857": msg5308, + "28570": msg30656, + "28571": msg30657, + "28572": msg30658, + "28573": msg30659, + "28574": msg30660, + "28575": msg30661, + "28576": msg30662, + "28577": msg30663, + "28578": msg30664, + "28579": msg30665, + "2858": msg5309, + "28580": msg30666, + "28581": msg30667, + "28582": msg30668, + "28583": msg30669, + "28584": msg30670, + "28585": msg30671, + "28586": msg30672, + "28587": msg30673, + "28588": msg30674, + "28589": msg30675, + "2859": msg5310, + "28590": msg30676, + "28591": msg30677, + "28592": msg30678, + "28593": msg30679, + "28594": msg30680, + "28595": msg30681, + "28596": msg30682, + "28597": msg30683, + "28598": msg30684, + "28599": msg30685, + "286": select209, + "2860": msg5311, + "28600": msg30686, + "28601": msg30687, + "28602": msg30688, + "28603": msg30689, + "28604": msg30690, + "28605": msg30691, + "28606": msg30692, + "28607": msg30693, + "28608": msg30694, + "28609": msg30695, + "2861": msg5312, + "28610": msg30696, + "28611": msg30697, + "28612": msg30698, + "28613": msg30699, + "28614": msg30700, + "28615": msg30701, + "28616": msg30702, + "28617": msg30703, + "28618": msg30704, + "28619": msg30705, + "2862": msg5313, + "28620": msg30706, + "28621": msg30707, + "28622": msg30708, + "28623": msg30709, + "28624": msg30710, + "28625": msg30711, + "28626": msg30712, + "28627": msg30713, + "28628": msg30714, + "28629": msg30715, + "2863": msg5314, + "28630": msg30716, + "28631": msg30717, + "28632": msg30718, + "28633": msg30719, + "28634": msg30720, + "28635": msg30721, + "28636": msg30722, + "28637": msg30723, + "28638": msg30724, + "28639": msg30725, + "2864": msg5315, + "28640": msg30726, + "28641": msg30727, + "28642": msg30728, + "28643": msg30729, + "28644": msg30730, + "28645": msg30731, + "28646": msg30732, + "28647": msg30733, + "28648": msg30734, + "28649": msg30735, + "2865": msg5316, + "28650": msg30736, + "28651": msg30737, + "28652": msg30738, + "28653": msg30739, + "28654": msg30740, + "28655": msg30741, + "28656": msg30742, + "28657": msg30743, + "28658": msg30744, + "28659": msg30745, + "2866": msg5317, + "28660": msg30746, + "28661": msg30747, + "28662": msg30748, + "28663": msg30749, + "28664": msg30750, + "28665": msg30751, + "28666": msg30752, + "28667": msg30753, + "28668": msg30754, + "28669": msg30755, + "2867": msg5318, + "28670": msg30756, + "28671": msg30757, + "28672": msg30758, + "28673": msg30759, + "28674": msg30760, + "28675": msg30761, + "28676": msg30762, + "28677": msg30763, + "28678": msg30764, + "28679": msg30765, + "2868": msg5319, + "28680": msg30766, + "28681": msg30767, + "28682": msg30768, + "28683": msg30769, + "28684": msg30770, + "28685": msg30771, + "28686": msg30772, + "28687": msg30773, + "28688": msg30774, + "28689": msg30775, + "2869": msg5320, + "28690": msg30776, + "28691": msg30777, + "28692": msg30778, + "28693": msg30779, + "28694": msg30780, + "28695": msg30781, + "28696": msg30782, + "28697": msg30783, + "28698": msg30784, + "28699": msg30785, + "287": select210, + "2870": msg5321, + "28700": msg30786, + "28701": msg30787, + "28702": msg30788, + "28703": msg30789, + "28704": msg30790, + "28705": msg30791, + "28706": msg30792, + "28707": msg30793, + "28708": msg30794, + "28709": msg30795, + "2871": msg5322, + "28710": msg30796, + "28711": msg30797, + "28712": msg30798, + "28713": msg30799, + "28714": msg30800, + "28715": msg30801, + "28716": msg30802, + "28717": msg30803, + "28718": msg30804, + "28719": msg30805, + "2872": msg5323, + "28720": msg30806, + "28721": msg30807, + "28722": msg30808, + "28723": msg30809, + "28724": msg30810, + "28725": msg30811, + "28726": msg30812, + "28727": msg30813, + "28728": msg30814, + "28729": msg30815, + "2873": msg5324, + "28730": msg30816, + "28731": msg30817, + "28732": msg30818, + "28733": msg30819, + "28734": msg30820, + "28735": msg30821, + "28736": msg30822, + "28737": msg30823, + "28738": msg30824, + "28739": msg30825, + "2874": msg5325, + "28740": msg30826, + "28741": msg30827, + "28742": msg30828, + "28743": msg30829, + "28744": msg30830, + "28745": msg30831, + "28746": msg30832, + "28747": msg30833, + "28748": msg30834, + "28749": msg30835, + "2875": msg5326, + "28750": msg30836, + "28751": msg30837, + "28752": msg30838, + "28753": msg30839, + "28754": msg30840, + "28755": msg30841, + "28756": msg30842, + "28757": msg30843, + "28758": msg30844, + "28759": msg30845, + "2876": msg5327, + "28760": msg30846, + "28761": msg30847, + "28762": msg30848, + "28763": msg30849, + "28764": msg30850, + "28765": msg30851, + "28766": msg30852, + "28767": msg30853, + "28768": msg30854, + "28769": msg30855, + "2877": msg5328, + "28770": msg30856, + "28771": msg30857, + "28772": msg30858, + "28773": msg30859, + "28774": msg30860, + "28775": msg30861, + "28776": msg30862, + "28777": msg30863, + "28778": msg30864, + "28779": msg30865, + "2878": msg5329, + "28780": msg30866, + "28781": msg30867, + "28782": msg30868, + "28783": msg30869, + "28784": msg30870, + "28785": msg30871, + "28786": msg30872, + "28787": msg30873, + "28788": msg30874, + "28789": msg30875, + "2879": msg5330, + "28790": msg30876, + "28791": msg30877, + "28792": msg30878, + "28793": msg30879, + "28794": msg30880, + "28795": msg30881, + "28796": msg30882, + "28797": msg30883, + "28798": msg30884, + "28799": msg30885, + "288": select211, + "2880": msg5331, + "28800": msg30886, + "28801": msg30887, + "28802": msg30888, + "28803": msg30889, + "28804": msg30890, + "28805": msg30891, + "28806": msg30892, + "28807": msg30893, + "28808": msg30894, + "28809": msg30895, + "2881": msg5332, + "28810": msg30896, + "28811": msg30897, + "28812": msg30898, + "28813": msg30899, + "28814": msg30900, + "28815": msg30901, + "28816": msg30902, + "28817": msg30903, + "28818": msg30904, + "28819": msg30905, + "2882": msg5333, + "28820": msg30906, + "28821": msg30907, + "28822": msg30908, + "28823": msg30909, + "28824": msg30910, + "28825": msg30911, + "28826": msg30912, + "28827": msg30913, + "28828": msg30914, + "28829": msg30915, + "2883": msg5334, + "28830": msg30916, + "28831": msg30917, + "28832": msg30918, + "28833": msg30919, + "28834": msg30920, + "28835": msg30921, + "28836": msg30922, + "28837": msg30923, + "28838": msg30924, + "28839": msg30925, + "2884": msg5335, + "28840": msg30926, + "28841": msg30927, + "28842": msg30928, + "28843": msg30929, + "28844": msg30930, + "28845": msg30931, + "28846": msg30932, + "28847": msg30933, + "28848": msg30934, + "28849": msg30935, + "2885": msg5336, + "28850": msg30936, + "28851": msg30937, + "28852": msg30938, + "28853": msg30939, + "28854": msg30940, + "28855": msg30941, + "28856": msg30942, + "28857": msg30943, + "28858": msg30944, + "28859": msg30945, + "2886": msg5337, + "28860": msg30946, + "28861": msg30947, + "28862": msg30948, + "28863": msg30949, + "28864": msg30950, + "28865": msg30951, + "28866": msg30952, + "28867": msg30953, + "28868": msg30954, + "28869": msg30955, + "2887": msg5338, + "28870": msg30956, + "28871": msg30957, + "28872": msg30958, + "28873": msg30959, + "28874": msg30960, + "28875": msg30961, + "28876": msg30962, + "28877": msg30963, + "28878": msg30964, + "28879": msg30965, + "2888": msg5339, + "28880": msg30966, + "28881": msg30967, + "28882": msg30968, + "28883": msg30969, + "28884": msg30970, + "28885": msg30971, + "28886": msg30972, + "28887": msg30973, + "28888": msg30974, + "28889": msg30975, + "2889": msg5340, + "28890": msg30976, + "28891": msg30977, + "28892": msg30978, + "28893": msg30979, + "28894": msg30980, + "28895": msg30981, + "28896": msg30982, + "28897": msg30983, + "28898": msg30984, + "28899": msg30985, + "289": select212, + "2890": msg5341, + "28900": msg30986, + "28901": msg30987, + "28902": msg30988, + "28903": msg30989, + "28904": msg30990, + "28905": msg30991, + "28906": msg30992, + "28907": msg30993, + "28908": msg30994, + "28909": msg30995, + "2891": msg5342, + "28910": msg30996, + "28911": msg30997, + "28912": msg30998, + "28913": msg30999, + "28914": msg31000, + "28915": msg31001, + "28916": msg31002, + "28917": msg31003, + "28918": msg31004, + "28919": msg31005, + "2892": msg5343, + "28920": msg31006, + "28921": msg31007, + "28922": msg31008, + "28923": msg31009, + "28924": msg31010, + "28925": msg31011, + "28926": msg31012, + "28927": msg31013, + "28928": msg31014, + "28929": msg31015, + "2893": msg5344, + "28930": msg31016, + "28931": msg31017, + "28932": msg31018, + "28933": msg31019, + "28934": msg31020, + "28935": msg31021, + "28936": msg31022, + "28937": msg31023, + "28938": msg31024, + "28939": msg31025, + "2894": msg5345, + "28940": msg31026, + "28941": msg31027, + "28942": msg31028, + "28943": msg31029, + "28944": msg31030, + "28945": msg31031, + "28946": msg31032, + "28947": msg31033, + "28948": msg31034, + "28949": msg31035, + "2895": msg5346, + "28950": msg31036, + "28951": msg31037, + "28952": msg31038, + "28953": msg31039, + "28954": msg31040, + "28955": msg31041, + "28956": msg31042, + "28957": msg31043, + "28958": msg31044, + "28959": msg31045, + "2896": msg5347, + "28960": msg31046, + "28961": msg31047, + "28962": msg31048, + "28963": msg31049, + "28964": msg31050, + "28965": msg31051, + "28966": msg31052, + "28967": msg31053, + "28968": msg31054, + "28969": msg31055, + "2897": msg5348, + "28970": msg31056, + "28971": msg31057, + "28972": msg31058, + "28973": msg31059, + "28974": msg31060, + "28975": msg31061, + "28976": msg31062, + "28977": msg31063, + "28978": msg31064, + "28979": msg31065, + "2898": msg5349, + "28980": msg31066, + "28981": msg31067, + "28982": msg31068, + "28983": msg31069, + "28984": msg31070, + "28985": msg31071, + "28986": msg31072, + "28987": msg31073, + "28988": msg31074, + "28989": msg31075, + "2899": msg5350, + "28990": msg31076, + "28991": msg31077, + "28992": msg31078, + "28993": msg31079, + "28994": msg31080, + "28995": msg31081, + "28996": msg31082, + "28997": msg31083, + "28998": msg31084, + "28999": msg31085, + "29": msg63, + "290": select213, + "2900": msg5351, + "29000": msg31086, + "29001": msg31087, + "29002": msg31088, + "29003": msg31089, + "29004": msg31090, + "29005": msg31091, + "29006": msg31092, + "29007": msg31093, + "29008": msg31094, + "29009": msg31095, + "2901": msg5352, + "29010": msg31096, + "29011": msg31097, + "29012": msg31098, + "29013": msg31099, + "29014": msg31100, + "29015": msg31101, + "29016": msg31102, + "29017": msg31103, + "29018": msg31104, + "29019": msg31105, + "2902": msg5353, + "29020": msg31106, + "29021": msg31107, + "29022": msg31108, + "29023": msg31109, + "29024": msg31110, + "29025": msg31111, + "29026": msg31112, + "29027": msg31113, + "29028": msg31114, + "29029": msg31115, + "2903": msg5354, + "29030": msg31116, + "29031": msg31117, + "29032": msg31118, + "29033": msg31119, + "29034": msg31120, + "29035": msg31121, + "29036": msg31122, + "29037": msg31123, + "29038": msg31124, + "29039": msg31125, + "2904": msg5355, + "29040": msg31126, + "29041": msg31127, + "29042": msg31128, + "29043": msg31129, + "29044": msg31130, + "29045": msg31131, + "29046": msg31132, + "29047": msg31133, + "29048": msg31134, + "29049": msg31135, + "2905": msg5356, + "29050": msg31136, + "29051": msg31137, + "29052": msg31138, + "29053": msg31139, + "29054": msg31140, + "29055": msg31141, + "29056": msg31142, + "29057": msg31143, + "29058": msg31144, + "29059": msg31145, + "2906": msg5357, + "29060": msg31146, + "29061": msg31147, + "29062": msg31148, + "29063": msg31149, + "29064": msg31150, + "29065": msg31151, + "29066": msg31152, + "29067": msg31153, + "29068": msg31154, + "29069": msg31155, + "2907": msg5358, + "29070": msg31156, + "29071": msg31157, + "29072": msg31158, + "29073": msg31159, + "29074": msg31160, + "29075": msg31161, + "29076": msg31162, + "29077": msg31163, + "29078": msg31164, + "29079": msg31165, + "2908": msg5359, + "29080": msg31166, + "29081": msg31167, + "29082": msg31168, + "29083": msg31169, + "29084": msg31170, + "29085": msg31171, + "29086": msg31172, + "29087": msg31173, + "29088": msg31174, + "29089": msg31175, + "2909": msg5360, + "29090": msg31176, + "29091": msg31177, + "29092": msg31178, + "29093": msg31179, + "29094": msg31180, + "29095": msg31181, + "29096": msg31182, + "29097": msg31183, + "29098": msg31184, + "29099": msg31185, + "291": select214, + "2910": msg5361, + "29100": msg31186, + "29101": msg31187, + "29102": msg31188, + "29103": msg31189, + "29104": msg31190, + "29105": msg31191, + "29106": msg31192, + "29107": msg31193, + "29108": msg31194, + "29109": msg31195, + "2911": msg5362, + "29110": msg31196, + "29111": msg31197, + "29112": msg31198, + "29113": msg31199, + "29114": msg31200, + "29115": msg31201, + "29116": msg31202, + "29117": msg31203, + "29118": msg31204, + "29119": msg31205, + "2912": msg5363, + "29120": msg31206, + "29121": msg31207, + "29122": msg31208, + "29123": msg31209, + "29124": msg31210, + "29125": msg31211, + "29126": msg31212, + "29127": msg31213, + "29128": msg31214, + "29129": msg31215, + "2913": msg5364, + "29130": msg31216, + "29131": msg31217, + "29132": msg31218, + "29133": msg31219, + "29134": msg31220, + "29135": msg31221, + "29136": msg31222, + "29137": msg31223, + "29138": msg31224, + "29139": msg31225, + "2914": msg5365, + "29140": msg31226, + "29141": msg31227, + "29142": msg31228, + "29143": msg31229, + "29144": msg31230, + "29145": msg31231, + "29146": msg31232, + "29147": msg31233, + "29148": msg31234, + "29149": msg31235, + "2915": msg5366, + "29150": msg31236, + "29151": msg31237, + "29152": msg31238, + "29153": msg31239, + "29154": msg31240, + "29155": msg31241, + "29156": msg31242, + "29157": msg31243, + "29158": msg31244, + "29159": msg31245, + "2916": msg5367, + "29160": msg31246, + "29161": msg31247, + "29162": msg31248, + "29163": msg31249, + "29164": msg31250, + "29165": msg31251, + "29166": msg31252, + "29167": msg31253, + "29168": msg31254, + "29169": msg31255, + "2917": msg5368, + "29170": msg31256, + "29171": msg31257, + "29172": msg31258, + "29173": msg31259, + "29174": msg31260, + "29175": msg31261, + "29176": msg31262, + "29177": msg31263, + "29178": msg31264, + "29179": msg31265, + "2918": msg5369, + "29180": msg31266, + "29181": msg31267, + "29182": msg31268, + "29183": msg31269, + "29184": msg31270, + "29185": msg31271, + "29186": msg31272, + "29187": msg31273, + "29188": msg31274, + "29189": msg31275, + "2919": msg5370, + "29190": msg31276, + "29191": msg31277, + "29192": msg31278, + "29193": msg31279, + "29194": msg31280, + "29195": msg31281, + "29196": msg31282, + "29197": msg31283, + "29198": msg31284, + "29199": msg31285, + "292": select215, + "29200": msg31286, + "29201": msg31287, + "29202": msg31288, + "29203": msg31289, + "29204": msg31290, + "29205": msg31291, + "29206": msg31292, + "29207": msg31293, + "29208": msg31294, + "29209": msg31295, + "2921": msg5371, + "29210": msg31296, + "29211": msg31297, + "29212": msg31298, + "29213": msg31299, + "29214": msg31300, + "29215": msg31301, + "29216": msg31302, + "29217": msg31303, + "29218": msg31304, + "29219": msg31305, + "2922": msg5372, + "29220": msg31306, + "29221": msg31307, + "29222": msg31308, + "29223": msg31309, + "29224": msg31310, + "29225": msg31311, + "29226": msg31312, + "29227": msg31313, + "29228": msg31314, + "29229": msg31315, + "2923": msg5373, + "29230": msg31316, + "29231": msg31317, + "29232": msg31318, + "29233": msg31319, + "29234": msg31320, + "29235": msg31321, + "29236": msg31322, + "29237": msg31323, + "29238": msg31324, + "29239": msg31325, + "2924": msg5374, + "29240": msg31326, + "29241": msg31327, + "29242": msg31328, + "29243": msg31329, + "29244": msg31330, + "29245": msg31331, + "29246": msg31332, + "29247": msg31333, + "29248": msg31334, + "29249": msg31335, + "2925": msg5375, + "29250": msg31336, + "29251": msg31337, + "29252": msg31338, + "29253": msg31339, + "29254": msg31340, + "29255": msg31341, + "29256": msg31342, + "29257": msg31343, + "29258": msg31344, + "29259": msg31345, + "2926": msg5376, + "29260": msg31346, + "29261": msg31347, + "29262": msg31348, + "29263": msg31349, + "29264": msg31350, + "29265": msg31351, + "29266": msg31352, + "29267": msg31353, + "29268": msg31354, + "29269": msg31355, + "2927": msg5377, + "29270": msg31356, + "29271": msg31357, + "29272": msg31358, + "29273": msg31359, + "29274": msg31360, + "29275": msg31361, + "29276": msg31362, + "29277": msg31363, + "29278": msg31364, + "29279": msg31365, + "2928": msg5378, + "29280": msg31366, + "29281": msg31367, + "29282": msg31368, + "29283": msg31369, + "29284": msg31370, + "29285": msg31371, + "29286": msg31372, + "29287": msg31373, + "29288": msg31374, + "29289": msg31375, + "2929": msg5379, + "29290": msg31376, + "29291": msg31377, + "29292": msg31378, + "29293": msg31379, + "29294": msg31380, + "29295": msg31381, + "29296": msg31382, + "29297": msg31383, + "29298": msg31384, + "29299": msg31385, + "293": select216, + "2930": msg5380, + "29300": msg31386, + "29301": msg31387, + "29302": msg31388, + "29303": msg31389, + "29304": msg31390, + "29305": msg31391, + "29306": msg31392, + "29307": msg31393, + "2931": msg5381, + "29313": msg31394, + "29314": msg31395, + "29315": msg31396, + "29316": msg31397, + "29317": msg31398, + "29318": msg31399, + "29319": msg31400, + "2932": msg5382, + "29320": msg31401, + "29321": msg31402, + "29322": msg31403, + "29323": msg31404, + "29324": msg31405, + "29325": msg31406, + "29326": msg31407, + "29327": msg31408, + "29328": msg31409, + "29329": msg31410, + "2933": msg5383, + "29330": msg31411, + "29331": msg31412, + "29332": msg31413, + "29333": msg31414, + "29334": msg31415, + "29335": msg31416, + "29336": msg31417, + "29337": msg31418, + "29338": msg31419, + "29339": msg31420, + "2934": msg5384, + "29340": msg31421, + "29341": msg31422, + "29342": msg31423, + "29343": msg31424, + "29344": msg31425, + "29345": msg31426, + "29346": msg31427, + "29347": msg31428, + "29348": msg31429, + "29349": msg31430, + "2935": msg5385, + "29350": msg31431, + "29351": msg31432, + "29352": msg31433, + "29353": msg31434, + "29354": msg31435, + "29355": msg31436, + "29356": msg31437, + "29357": msg31438, + "29358": msg31439, + "29359": msg31440, + "2936": msg5386, + "29360": msg31441, + "29361": msg31442, + "29362": msg31443, + "29363": msg31444, + "29364": msg31445, + "29365": msg31446, + "29366": msg31447, + "29367": msg31448, + "29368": msg31449, + "29369": msg31450, + "2937": msg5387, + "29370": msg31451, + "29371": msg31452, + "29372": msg31453, + "29373": msg31454, + "29374": msg31455, + "29375": msg31456, + "29376": msg31457, + "29377": msg31458, + "29378": msg31459, + "29379": msg31460, + "2938": msg5388, + "29380": msg31461, + "29381": msg31462, + "29382": msg31463, + "29383": msg31464, + "29384": msg31465, + "29385": msg31466, + "29386": msg31467, + "29387": msg31468, + "29388": msg31469, + "29389": msg31470, + "2939": msg5389, + "29390": msg31471, + "29391": msg31472, + "29392": msg31473, + "29393": msg31474, + "29394": msg31475, + "29395": msg31476, + "29396": msg31477, + "29397": msg31478, + "29398": msg31479, + "29399": msg31480, + "2940": msg5390, + "29400": msg31481, + "29401": msg31482, + "29402": msg31483, + "29403": msg31484, + "29404": msg31485, + "29405": msg31486, + "29406": msg31487, + "29407": msg31488, + "29408": msg31489, + "29409": msg31490, + "2941": msg5391, + "29410": msg31491, + "29411": msg31492, + "29412": msg31493, + "29413": msg31494, + "29414": msg31495, + "29415": msg31496, + "29416": msg31497, + "29417": msg31498, + "29418": msg31499, + "29419": msg31500, + "2942": msg5392, + "29420": msg31501, + "29421": msg31502, + "29422": msg31503, + "29423": msg31504, + "29424": msg31505, + "29425": msg31506, + "29426": msg31507, + "29427": msg31508, + "29428": msg31509, + "29429": msg31510, + "2943": msg5393, + "29430": msg31511, + "29431": msg31512, + "29432": msg31513, + "29433": msg31514, + "29434": msg31515, + "29435": msg31516, + "29436": msg31517, + "29437": msg31518, + "29438": msg31519, + "29439": msg31520, + "2944": msg5394, + "29440": msg31521, + "29442": msg31522, + "29443": msg31523, + "29444": msg31524, + "29445": msg31525, + "29446": msg31526, + "29447": msg31527, + "29448": msg31528, + "29449": msg31529, + "2945": msg5395, + "29450": msg31530, + "29451": msg31531, + "29452": msg31532, + "29453": msg31533, + "29454": msg31534, + "29455": msg31535, + "29456": msg31536, + "29457": msg31537, + "29458": msg31538, + "29459": msg31539, + "2946": msg5396, + "29460": msg31540, + "29461": msg31541, + "29462": msg31542, + "29463": msg31543, + "29464": msg31544, + "29465": msg31545, + "29466": msg31546, + "29467": msg31547, + "29468": msg31548, + "29469": msg31549, + "2947": msg5397, + "29470": msg31550, + "29471": msg31551, + "29472": msg31552, + "29473": msg31553, + "29474": msg31554, + "29475": msg31555, + "29476": msg31556, + "29477": msg31557, + "29478": msg31558, + "29479": msg31559, + "2948": msg5398, + "29480": msg31560, + "29481": msg31561, + "29482": msg31562, + "29483": msg31563, + "29484": msg31564, + "29485": msg31565, + "29486": msg31566, + "29487": msg31567, + "29488": msg31568, + "29489": msg31569, + "2949": msg5399, + "29490": msg31570, + "29491": msg31571, + "29492": msg31572, + "29493": msg31573, + "29494": msg31574, + "29495": msg31575, + "29496": msg31576, + "29497": msg31577, + "29498": msg31578, + "29499": msg31579, + "295": select217, + "2950": msg5400, + "29500": msg31580, + "29501": msg31581, + "29502": msg31582, + "29503": msg31583, + "29504": msg31584, + "29505": msg31585, + "29506": msg31586, + "29507": msg31587, + "29508": msg31588, + "29509": msg31589, + "2951": msg5401, + "29510": msg31590, + "29511": msg31591, + "29512": msg31592, + "29513": msg31593, + "29514": msg31594, + "29515": msg31595, + "29516": msg31596, + "29517": msg31597, + "29518": msg31598, + "29519": msg31599, + "2952": msg5402, + "29520": msg31600, + "29521": msg31601, + "29522": msg31602, + "29523": msg31603, + "29524": msg31604, + "29525": msg31605, + "29526": msg31606, + "29527": msg31607, + "29528": msg31608, + "29529": msg31609, + "2953": msg5403, + "29530": msg31610, + "29531": msg31611, + "29532": msg31612, + "29533": msg31613, + "29534": msg31614, + "29535": msg31615, + "29536": msg31616, + "29537": msg31617, + "29538": msg31618, + "29539": msg31619, + "2954": msg5404, + "29540": msg31620, + "29541": msg31621, + "29542": msg31622, + "29543": msg31623, + "29544": msg31624, + "29545": msg31625, + "29546": msg31626, + "29547": msg31627, + "29548": msg31628, + "29549": msg31629, + "2955": msg5405, + "29550": msg31630, + "29551": msg31631, + "29552": msg31632, + "29553": msg31633, + "29554": msg31634, + "29555": msg31635, + "29556": msg31636, + "29557": msg31637, + "29558": msg31638, + "29559": msg31639, + "2956": msg5406, + "29560": msg31640, + "29561": msg31641, + "29562": msg31642, + "29563": msg31643, + "29564": msg31644, + "29565": msg31645, + "29566": msg31646, + "29567": msg31647, + "29568": msg31648, + "29569": msg31649, + "2957": msg5407, + "29570": msg31650, + "29571": msg31651, + "29572": msg31652, + "29573": msg31653, + "29574": msg31654, + "29575": msg31655, + "29576": msg31656, + "29577": msg31657, + "29578": msg31658, + "29579": msg31659, + "2958": msg5408, + "29580": msg31660, + "29581": msg31661, + "29582": msg31662, + "29583": msg31663, + "29584": msg31664, + "29585": msg31665, + "29586": msg31666, + "29587": msg31667, + "29588": msg31668, + "29589": msg31669, + "2959": msg5409, + "29590": msg31670, + "29591": msg31671, + "29592": msg31672, + "29593": msg31673, + "29594": msg31674, + "29595": msg31675, + "29596": msg31676, + "29597": msg31677, + "29598": msg31678, + "29599": msg31679, + "296": select218, + "2960": msg5410, + "29600": msg31680, + "29601": msg31681, + "29602": msg31682, + "29603": msg31683, + "29604": msg31684, + "29605": msg31685, + "29606": msg31686, + "29607": msg31687, + "29608": msg31688, + "29609": msg31689, + "2961": msg5411, + "29610": msg31690, + "29611": msg31691, + "29612": msg31692, + "29613": msg31693, + "29614": msg31694, + "29615": msg31695, + "29616": msg31696, + "29617": msg31697, + "29618": msg31698, + "29619": msg31699, + "2962": msg5412, + "29620": msg31700, + "29621": msg31701, + "29622": msg31702, + "29623": msg31703, + "29624": msg31704, + "29625": msg31705, + "29626": msg31706, + "29627": msg31707, + "29628": msg31708, + "29629": msg31709, + "2963": msg5413, + "29630": msg31710, + "29631": msg31711, + "29632": msg31712, + "29633": msg31713, + "29634": msg31714, + "29635": msg31715, + "29636": msg31716, + "29637": msg31717, + "29638": msg31718, + "29639": msg31719, + "2964": msg5414, + "29640": msg31720, + "29641": msg31721, + "29642": msg31722, + "29643": msg31723, + "29644": msg31724, + "29645": msg31725, + "29646": msg31726, + "29647": msg31727, + "29648": msg31728, + "29649": msg31729, + "2965": msg5415, + "29650": msg31730, + "29651": msg31731, + "29652": msg31732, + "29653": msg31733, + "29654": msg31734, + "29655": msg31735, + "29656": msg31736, + "29657": msg31737, + "29658": msg31738, + "29659": msg31739, + "2966": msg5416, + "29660": msg31740, + "29661": msg31741, + "29662": msg31742, + "29663": msg31743, + "29664": msg31744, + "29665": msg31745, + "29666": msg31746, + "29667": msg31747, + "29668": msg31748, + "29669": msg31749, + "2967": msg5417, + "29670": msg31750, + "29671": msg31751, + "29672": msg31752, + "29673": msg31753, + "29674": msg31754, + "29675": msg31755, + "29676": msg31756, + "29677": msg31757, + "29678": msg31758, + "29679": msg31759, + "2968": msg5418, + "29680": msg31760, + "29681": msg31761, + "29682": msg31762, + "29683": msg31763, + "29684": msg31764, + "29685": msg31765, + "29686": msg31766, + "29687": msg31767, + "29688": msg31768, + "29689": msg31769, + "2969": msg5419, + "29690": msg31770, + "29691": msg31771, + "29692": msg31772, + "29693": msg31773, + "29694": msg31774, + "29695": msg31775, + "29696": msg31776, + "29697": msg31777, + "29698": msg31778, + "29699": msg31779, + "297": select219, + "2970": msg5420, + "29700": msg31780, + "29701": msg31781, + "29702": msg31782, + "29703": msg31783, + "29704": msg31784, + "29705": msg31785, + "29706": msg31786, + "29707": msg31787, + "29708": msg31788, + "29709": msg31789, + "2971": msg5421, + "29710": msg31790, + "29711": msg31791, + "29712": msg31792, + "29713": msg31793, + "29714": msg31794, + "29715": msg31795, + "29716": msg31796, + "29717": msg31797, + "29718": msg31798, + "29719": msg31799, + "2972": msg5422, + "29720": msg31800, + "29721": msg31801, + "29722": msg31802, + "29723": msg31803, + "29724": msg31804, + "29725": msg31805, + "29726": msg31806, + "29727": msg31807, + "29728": msg31808, + "29729": msg31809, + "2973": msg5423, + "29730": msg31810, + "29731": msg31811, + "29732": msg31812, + "29733": msg31813, + "29734": msg31814, + "29735": msg31815, + "29736": msg31816, + "29737": msg31817, + "29738": msg31818, + "29739": msg31819, + "2974": msg5424, + "29740": msg31820, + "29741": msg31821, + "29742": msg31822, + "29743": msg31823, + "29744": msg31824, + "29745": msg31825, + "29746": msg31826, + "29747": msg31827, + "29748": msg31828, + "29749": msg31829, + "2975": msg5425, + "29750": msg31830, + "29751": msg31831, + "29752": msg31832, + "29753": msg31833, + "29754": msg31834, + "29755": msg31835, + "29756": msg31836, + "29757": msg31837, + "29758": msg31838, + "29759": msg31839, + "2976": msg5426, + "29760": msg31840, + "29761": msg31841, + "29762": msg31842, + "29763": msg31843, + "29764": msg31844, + "29765": msg31845, + "29766": msg31846, + "29767": msg31847, + "29768": msg31848, + "29769": msg31849, + "2977": msg5427, + "29770": msg31850, + "29771": msg31851, + "29772": msg31852, + "29773": msg31853, + "29774": msg31854, + "29775": msg31855, + "29776": msg31856, + "29777": msg31857, + "29778": msg31858, + "29779": msg31859, + "2978": msg5428, + "29780": msg31860, + "29781": msg31861, + "29782": msg31862, + "29783": msg31863, + "29784": msg31864, + "29785": msg31865, + "29786": msg31866, + "29787": msg31867, + "29788": msg31868, + "29789": msg31869, + "2979": msg5429, + "29790": msg31870, + "29791": msg31871, + "29792": msg31872, + "29793": msg31873, + "29794": msg31874, + "29795": msg31875, + "29796": msg31876, + "29797": msg31877, + "29798": msg31878, + "29799": msg31879, + "298": select220, + "2980": msg5430, + "29800": msg31880, + "29801": msg31881, + "29802": msg31882, + "29803": msg31883, + "29804": msg31884, + "29805": msg31885, + "29806": msg31886, + "29807": msg31887, + "29808": msg31888, + "29809": msg31889, + "2981": msg5431, + "29810": msg31890, + "29811": msg31891, + "29812": msg31892, + "29813": msg31893, + "29814": msg31894, + "29815": msg31895, + "29816": msg31896, + "29817": msg31897, + "29818": msg31898, + "29819": msg31899, + "2982": msg5432, + "29820": msg31900, + "29821": msg31901, + "29822": msg31902, + "29823": msg31903, + "29824": msg31904, + "29825": msg31905, + "29826": msg31906, + "29827": msg31907, + "29828": msg31908, + "29829": msg31909, + "2983": msg5433, + "29830": msg31910, + "29831": msg31911, + "29832": msg31912, + "29833": msg31913, + "29834": msg31914, + "29835": msg31915, + "29836": msg31916, + "29837": msg31917, + "29838": msg31918, + "29839": msg31919, + "2984": msg5434, + "29840": msg31920, + "29841": msg31921, + "29842": msg31922, + "29843": msg31923, + "29844": msg31924, + "29845": msg31925, + "29846": msg31926, + "29847": msg31927, + "29848": msg31928, + "29849": msg31929, + "2985": msg5435, + "29850": msg31930, + "29851": msg31931, + "29852": msg31932, + "29853": msg31933, + "29854": msg31934, + "29855": msg31935, + "29856": msg31936, + "29857": msg31937, + "29858": msg31938, + "29859": msg31939, + "2986": msg5436, + "29860": msg31940, + "29861": msg31941, + "29862": msg31942, + "29863": msg31943, + "29864": msg31944, + "29865": msg31945, + "29866": msg31946, + "29867": msg31947, + "29868": msg31948, + "29869": msg31949, + "2987": msg5437, + "29870": msg31950, + "29871": msg31951, + "29872": msg31952, + "29873": msg31953, + "29874": msg31954, + "29875": msg31955, + "29876": msg31956, + "29877": msg31957, + "29878": msg31958, + "29879": msg31959, + "2988": msg5438, + "29880": msg31960, + "29881": msg31961, + "29882": msg31962, + "29883": msg31963, + "29884": msg31964, + "29885": msg31965, + "29886": msg31966, + "29887": msg31967, + "29888": msg31968, + "29889": msg31969, + "2989": msg5439, + "29890": msg31970, + "29891": msg31971, + "29892": msg31972, + "29893": msg31973, + "29894": msg31974, + "29895": msg31975, + "29896": msg31976, + "29897": msg31977, + "29898": msg31978, + "29899": msg31979, + "299": select221, + "2990": msg5440, + "29900": msg31980, + "29901": msg31981, + "29902": msg31982, + "29903": msg31983, + "29904": msg31984, + "29905": msg31985, + "29906": msg31986, + "29907": msg31987, + "29909": msg31988, + "2991": msg5441, + "29910": msg31989, + "29911": msg31990, + "29912": msg31991, + "29913": msg31992, + "29914": msg31993, + "29915": msg31994, + "29916": msg31995, + "29917": msg31996, + "29918": msg31997, + "29919": msg31998, + "2992": msg5442, + "29920": msg31999, + "29921": msg32000, + "29922": msg32001, + "29923": msg32002, + "29924": msg32003, + "29925": msg32004, + "29926": msg32005, + "29927": msg32006, + "29928": msg32007, + "29929": msg32008, + "2993": msg5443, + "29930": msg32009, + "29931": msg32010, + "29932": msg32011, + "29933": msg32012, + "29934": msg32013, + "29935": msg32014, + "29936": msg32015, + "29937": msg32016, + "29938": msg32017, + "29939": msg32018, + "2994": msg5444, + "29940": msg32019, + "29941": msg32020, + "29942": msg32021, + "29943": msg32022, + "29944": msg32023, + "29945": msg32024, + "29946": msg32025, + "29947": msg32026, + "29948": msg32027, + "29949": msg32028, + "2995": msg5445, + "29950": msg32029, + "29951": msg32030, + "29952": msg32031, + "29953": msg32032, + "29954": msg32033, + "29955": msg32034, + "29956": msg32035, + "29957": msg32036, + "29958": msg32037, + "29959": msg32038, + "2996": msg5446, + "29960": msg32039, + "29961": msg32040, + "29962": msg32041, + "29963": msg32042, + "29964": msg32043, + "29965": msg32044, + "29966": msg32045, + "29967": msg32046, + "29968": msg32047, + "29969": msg32048, + "2997": msg5447, + "29970": msg32049, + "29971": msg32050, + "29972": msg32051, + "29973": msg32052, + "29974": msg32053, + "29975": msg32054, + "29976": msg32055, + "29977": msg32056, + "29978": msg32057, + "29979": msg32058, + "2998": msg5448, + "29980": msg32059, + "29981": msg32060, + "29982": msg32061, + "29983": msg32062, + "29984": msg32063, + "29985": msg32064, + "29986": msg32065, + "29987": msg32066, + "29988": msg32067, + "29989": msg32068, + "2999": msg5449, + "29990": msg32069, + "29991": msg32070, + "29992": msg32071, + "29993": msg32072, + "29994": msg32073, + "29995": msg32074, + "29996": msg32075, + "29997": msg32076, + "29998": msg32077, + "29999": msg32078, + "3": select9, + "3-10126": msg23, + "3-10127": msg10, + "3-10161": msg11, + "3-10480": msg12, + "3-10481": msg13, + "3-11619": msg14, + "3-11672": msg15, + "3-12028": msg16, + "3-12636": msg17, + "3-12692": msg18, + "3-7019": msg19, + "3-7196": msg20, + "3-8092": msg21, + "3-8351": msg22, + "30": msg64, + "300": select222, + "3000": msg5450, + "30000": msg32079, + "3000005": msg38425, + "30001": msg32080, + "30002": msg32081, + "30003": msg32082, + "30004": msg32083, + "30005": msg32084, + "30006": msg32085, + "30007": msg32086, + "30008": msg32087, + "30009": msg32088, + "3001": msg5451, + "30010": msg32089, + "30011": msg32090, + "30012": msg32091, + "30013": msg32092, + "30014": msg32093, + "30015": msg32094, + "30016": msg32095, + "30017": msg32096, + "30018": msg32097, + "30019": msg32098, + "3002": msg5452, + "30020": msg32099, + "30021": msg32100, + "30022": msg32101, + "30023": msg32102, + "30024": msg32103, + "30025": msg32104, + "30026": msg32105, + "30027": msg32106, + "30028": msg32107, + "30029": msg32108, + "3003": msg5453, + "30030": msg32109, + "30031": msg32110, + "30032": msg32111, + "30033": msg32112, + "30034": msg32113, + "30035": msg32114, + "30036": msg32115, + "30037": msg32116, + "30038": msg32117, + "30039": msg32118, + "3004": msg5454, + "30040": msg32119, + "30041": msg32120, + "30042": msg32121, + "30043": msg32122, + "30044": msg32123, + "30045": msg32124, + "30046": msg32125, + "30047": msg32126, + "30048": msg32127, + "30049": msg32128, + "3005": msg5455, + "30050": msg32129, + "30051": msg32130, + "30052": msg32131, + "30053": msg32132, + "30054": msg32133, + "30055": msg32134, + "30056": msg32135, + "30057": msg32136, + "30058": msg32137, + "30059": msg32138, + "3006": msg5456, + "30060": msg32139, + "30061": msg32140, + "30062": msg32141, + "30063": msg32142, + "30064": msg32143, + "30065": msg32144, + "30066": msg32145, + "30067": msg32146, + "30068": msg32147, + "30069": msg32148, + "3007": msg5457, + "30070": msg32149, + "30071": msg32150, + "30072": msg32151, + "30073": msg32152, + "30074": msg32153, + "30075": msg32154, + "30076": msg32155, + "30077": msg32156, + "30078": msg32157, + "30079": msg32158, + "3008": msg5458, + "30080": msg32159, + "30081": msg32160, + "30082": msg32161, + "30083": msg32162, + "30084": msg32163, + "30085": msg32164, + "30086": msg32165, + "30087": msg32166, + "30088": msg32167, + "30089": msg32168, + "3009": msg5459, + "30090": msg32169, + "30091": msg32170, + "30092": msg32171, + "30093": msg32172, + "30094": msg32173, + "30095": msg32174, + "30096": msg32175, + "30097": msg32176, + "30098": msg32177, + "30099": msg32178, + "301": select223, + "3010": msg5460, + "30100": msg32179, + "30101": msg32180, + "30102": msg32181, + "30103": msg32182, + "30104": msg32183, + "30105": msg32184, + "30106": msg32185, + "30107": msg32186, + "30108": msg32187, + "30109": msg32188, + "3011": msg5461, + "30110": msg32189, + "30111": msg32190, + "30112": msg32191, + "30113": msg32192, + "30114": msg32193, + "30115": msg32194, + "30116": msg32195, + "30117": msg32196, + "30118": msg32197, + "30119": msg32198, + "3012": msg5462, + "30120": msg32199, + "30121": msg32200, + "30122": msg32201, + "30123": msg32202, + "30124": msg32203, + "30125": msg32204, + "30126": msg32205, + "30127": msg32206, + "30128": msg32207, + "30129": msg32208, + "3013": msg5463, + "30130": msg32209, + "30131": msg32210, + "30132": msg32211, + "30133": msg32212, + "30134": msg32213, + "30135": msg32214, + "30136": msg32215, + "30137": msg32216, + "30138": msg32217, + "30139": msg32218, + "3014": msg5464, + "30140": msg32219, + "30141": msg32220, + "30142": msg32221, + "30143": msg32222, + "30144": msg32223, + "30145": msg32224, + "30146": msg32225, + "30147": msg32226, + "30148": msg32227, + "30149": msg32228, + "3015": msg5465, + "30150": msg32229, + "30151": msg32230, + "30152": msg32231, + "30153": msg32232, + "30154": msg32233, + "30155": msg32234, + "30156": msg32235, + "30157": msg32236, + "30158": msg32237, + "30159": msg32238, + "3016": msg5466, + "30160": msg32239, + "30161": msg32240, + "30162": msg32241, + "30163": msg32242, + "30164": msg32243, + "30165": msg32244, + "30166": msg32245, + "30167": msg32246, + "30168": msg32247, + "30169": msg32248, + "3017": msg5467, + "30170": msg32249, + "30171": msg32250, + "30172": msg32251, + "30173": msg32252, + "30174": msg32253, + "30175": msg32254, + "30176": msg32255, + "30177": msg32256, + "30178": msg32257, + "30179": msg32258, + "3018": msg5468, + "30180": msg32259, + "30181": msg32260, + "30182": msg32261, + "30183": msg32262, + "30184": msg32263, + "30185": msg32264, + "30186": msg32265, + "30187": msg32266, + "30188": msg32267, + "30189": msg32268, + "3019": msg5469, + "30190": msg32269, + "30191": msg32270, + "30192": msg32271, + "30193": msg32272, + "30194": msg32273, + "30195": msg32274, + "30196": msg32275, + "30197": msg32276, + "30198": msg32277, + "30199": msg32278, + "302": select224, + "3020": msg5470, + "30200": msg32279, + "30201": msg32280, + "30202": msg32281, + "30203": msg32282, + "30204": msg32283, + "30205": msg32284, + "30206": msg32285, + "30207": msg32286, + "30208": msg32287, + "30209": msg32288, + "3021": msg5471, + "30210": msg32289, + "30211": msg32290, + "30212": msg32291, + "30213": msg32292, + "30214": msg32293, + "30215": msg32294, + "30216": msg32295, + "30217": msg32296, + "30218": msg32297, + "30219": msg32298, + "3022": msg5472, + "30220": msg32299, + "30221": msg32300, + "30222": msg32301, + "30223": msg32302, + "30224": msg32303, + "30225": msg32304, + "30226": msg32305, + "30227": msg32306, + "30228": msg32307, + "30229": msg32308, + "3023": msg5473, + "30230": msg32309, + "30231": msg32310, + "30232": msg32311, + "30233": msg32312, + "30234": msg32313, + "30235": msg32314, + "30236": msg32315, + "30237": msg32316, + "30238": msg32317, + "30239": msg32318, + "3024": msg5474, + "30240": msg32319, + "30241": msg32320, + "30242": msg32321, + "30243": msg32322, + "30244": msg32323, + "30245": msg32324, + "30246": msg32325, + "30247": msg32326, + "30248": msg32327, + "30249": msg32328, + "3025": msg5475, + "30250": msg32329, + "30251": msg32330, + "30252": msg32331, + "30253": msg32332, + "30254": msg32333, + "30255": msg32334, + "30256": msg32335, + "30257": msg32336, + "30258": msg32337, + "30259": msg32338, + "3026": msg5476, + "30260": msg32339, + "30261": msg32340, + "30262": msg32341, + "30263": msg32342, + "30264": msg32343, + "30265": msg32344, + "30266": msg32345, + "30267": msg32346, + "30268": msg32347, + "30269": msg32348, + "3027": msg5477, + "30270": msg32349, + "30271": msg32350, + "30272": msg32351, + "30273": msg32352, + "30274": msg32353, + "30275": msg32354, + "30276": msg32355, + "30277": msg32356, + "30278": msg32357, + "30279": msg32358, + "3028": msg5478, + "30280": msg32359, + "30281": msg32360, + "30282": msg32361, + "30283": msg32362, + "30284": msg32363, + "30285": msg32364, + "30286": msg32365, + "30287": msg32366, + "30288": msg32367, + "30289": msg32368, + "3029": msg5479, + "30290": msg32369, + "30291": msg32370, + "30292": msg32371, + "30293": msg32372, + "30294": msg32373, + "30295": msg32374, + "30296": msg32375, + "30297": msg32376, + "30298": msg32377, + "30299": msg32378, + "303": select225, + "3030": msg5480, + "30300": msg32379, + "30301": msg32380, + "30302": msg32381, + "30303": msg32382, + "30304": msg32383, + "30305": msg32384, + "30306": msg32385, + "30307": msg32386, + "30308": msg32387, + "30309": msg32388, + "3031": msg5481, + "30310": msg32389, + "30311": msg32390, + "30312": msg32391, + "30313": msg32392, + "30314": msg32393, + "30315": msg32394, + "30316": msg32395, + "30317": msg32396, + "30318": msg32397, + "30319": msg32398, + "3032": msg5482, + "30320": msg32399, + "30321": msg32400, + "30322": msg32401, + "30323": msg32402, + "30324": msg32403, + "30325": msg32404, + "30326": msg32405, + "30327": msg32406, + "30328": msg32407, + "30329": msg32408, + "3033": msg5483, + "30330": msg32409, + "30331": msg32410, + "30332": msg32411, + "30333": msg32412, + "30334": msg32413, + "30335": msg32414, + "30336": msg32415, + "30337": msg32416, + "30338": msg32417, + "30339": msg32418, + "3034": msg5484, + "30340": msg32419, + "30341": msg32420, + "30342": msg32421, + "30343": msg32422, + "30344": msg32423, + "30345": msg32424, + "30347": msg32425, + "30348": msg32426, + "30349": msg32427, + "3035": msg5485, + "30350": msg32428, + "30351": msg32429, + "30352": msg32430, + "30353": msg32431, + "30354": msg32432, + "30355": msg32433, + "30356": msg32434, + "30357": msg32435, + "30358": msg32436, + "30359": msg32437, + "3036": msg5486, + "30360": msg32438, + "30361": msg32439, + "30362": msg32440, + "30363": msg32441, + "30364": msg32442, + "30365": msg32443, + "30366": msg32444, + "30367": msg32445, + "30368": msg32446, + "30369": msg32447, + "3037": msg5487, + "30370": msg32448, + "30371": msg32449, + "30372": msg32450, + "30373": msg32451, + "30374": msg32452, + "30375": msg32453, + "30376": msg32454, + "30377": msg32455, + "30378": msg32456, + "30379": msg32457, + "3038": msg5488, + "30380": msg32458, + "30381": msg32459, + "30382": msg32460, + "30383": msg32461, + "30384": msg32462, + "30385": msg32463, + "30386": msg32464, + "30387": msg32465, + "30388": msg32466, + "30389": msg32467, + "3039": msg5489, + "30390": msg32468, + "30391": msg32469, + "30392": msg32470, + "30393": msg32471, + "30394": msg32472, + "30395": msg32473, + "30396": msg32474, + "30397": msg32475, + "30398": msg32476, + "30399": msg32477, + "304": select226, + "3040": msg5490, + "30400": msg32478, + "30401": msg32479, + "30402": msg32480, + "30403": msg32481, + "30404": msg32482, + "30405": msg32483, + "30406": msg32484, + "30407": msg32485, + "30408": msg32486, + "30409": msg32487, + "3041": msg5491, + "30410": msg32488, + "30411": msg32489, + "30412": msg32490, + "30413": msg32491, + "30414": msg32492, + "30415": msg32493, + "30416": msg32494, + "30417": msg32495, + "30418": msg32496, + "30419": msg32497, + "3042": msg5492, + "30420": msg32498, + "30421": msg32499, + "30422": msg32500, + "30423": msg32501, + "30424": msg32502, + "30425": msg32503, + "30426": msg32504, + "30427": msg32505, + "30428": msg32506, + "30429": msg32507, + "3043": msg5493, + "30430": msg32508, + "30431": msg32509, + "30432": msg32510, + "30433": msg32511, + "30434": msg32512, + "30435": msg32513, + "30436": msg32514, + "30437": msg32515, + "30438": msg32516, + "30439": msg32517, + "3044": msg5494, + "30440": msg32518, + "30441": msg32519, + "30442": msg32520, + "30443": msg32521, + "30444": msg32522, + "30445": msg32523, + "30446": msg32524, + "30447": msg32525, + "30448": msg32526, + "30449": msg32527, + "3045": msg5495, + "30450": msg32528, + "30451": msg32529, + "30452": msg32530, + "30453": msg32531, + "30454": msg32532, + "30455": msg32533, + "30456": msg32534, + "30457": msg32535, + "30458": msg32536, + "30459": msg32537, + "3046": msg5496, + "30460": msg32538, + "30461": msg32539, + "30462": msg32540, + "30463": msg32541, + "30464": msg32542, + "30465": msg32543, + "30466": msg32544, + "30467": msg32545, + "30468": msg32546, + "30469": msg32547, + "3047": msg5497, + "30470": msg32548, + "30471": msg32549, + "30472": msg32550, + "30473": msg32551, + "30474": msg32552, + "30475": msg32553, + "30476": msg32554, + "30477": msg32555, + "30478": msg32556, + "30479": msg32557, + "3048": msg5498, + "30480": msg32558, + "30481": msg32559, + "30482": msg32560, + "30483": msg32561, + "30484": msg32562, + "30485": msg32563, + "30486": msg32564, + "30487": msg32565, + "30488": msg32566, + "30489": msg32567, + "3049": msg5499, + "30490": msg32568, + "30491": msg32569, + "30492": msg32570, + "30493": msg32571, + "30494": msg32572, + "30495": msg32573, + "30496": msg32574, + "30497": msg32575, + "30498": msg32576, + "30499": msg32577, + "305": select227, + "3050": msg5500, + "30500": msg32578, + "30501": msg32579, + "30502": msg32580, + "30503": msg32581, + "30504": msg32582, + "30505": msg32583, + "30506": msg32584, + "30507": msg32585, + "30508": msg32586, + "30509": msg32587, + "3051": msg5501, + "30510": msg32588, + "30511": msg32589, + "30512": msg32590, + "30513": msg32591, + "30514": msg32592, + "30515": msg32593, + "30516": msg32594, + "30517": msg32595, + "30518": msg32596, + "30519": msg32597, + "3052": msg5502, + "30520": msg32598, + "30521": msg32599, + "30522": msg32600, + "30523": msg32601, + "30524": msg32602, + "30525": msg32603, + "30526": msg32604, + "30527": msg32605, + "30528": msg32606, + "30529": msg32607, + "3053": msg5503, + "30530": msg32608, + "30531": msg32609, + "30532": msg32610, + "30533": msg32611, + "30534": msg32612, + "30535": msg32613, + "30536": msg32614, + "30537": msg32615, + "30538": msg32616, + "30539": msg32617, + "3054": msg5504, + "30540": msg32618, + "30541": msg32619, + "30542": msg32620, + "30543": msg32621, + "30544": msg32622, + "30545": msg32623, + "30546": msg32624, + "30547": msg32625, + "30548": msg32626, + "30549": msg32627, + "3055": msg5505, + "30550": msg32628, + "30551": msg32629, + "30552": msg32630, + "30553": msg32631, + "30554": msg32632, + "30555": msg32633, + "30556": msg32634, + "3056": msg5506, + "30562": msg32635, + "30566": msg32636, + "3057": msg5507, + "30570": msg32637, + "3058": msg5508, + "3059": msg5509, + "306": select228, + "3060": msg5510, + "3061": msg5511, + "3062": msg5512, + "3063": msg5513, + "3064": msg5514, + "3065": msg5515, + "3066": msg5516, + "3067": msg5517, + "3068": msg5518, + "3069": msg5519, + "307": select229, + "3070": msg5520, + "3071": msg5521, + "30711": msg32638, + "30712": msg32639, + "30713": msg32640, + "30714": msg32641, + "30715": msg32642, + "30716": msg32643, + "30717": msg32644, + "30718": msg32645, + "30719": msg32646, + "3072": msg5522, + "30720": msg32647, + "30721": msg32648, + "30722": msg32649, + "30723": msg32650, + "30724": msg32651, + "30725": msg32652, + "30726": msg32653, + "30727": msg32654, + "30728": msg32655, + "30729": msg32656, + "3073": msg5523, + "30730": msg32657, + "30731": msg32658, + "30732": msg32659, + "30733": msg32660, + "30734": msg32661, + "30735": msg32662, + "30736": msg32663, + "30737": msg32664, + "30738": msg32665, + "30739": msg32666, + "3074": msg5524, + "30740": msg32667, + "30741": msg32668, + "30742": msg32669, + "30743": msg32670, + "30744": msg32671, + "30745": msg32672, + "30746": msg32673, + "30747": msg32674, + "30748": msg32675, + "30749": msg32676, + "3075": msg5525, + "30750": msg32677, + "30751": msg32678, + "30752": msg32679, + "30753": msg32680, + "30754": msg32681, + "30755": msg32682, + "30756": msg32683, + "30757": msg32684, + "30758": msg32685, + "30759": msg32686, + "3076": msg5526, + "30760": msg32687, + "30761": msg32688, + "30762": msg32689, + "30763": msg32690, + "30764": msg32691, + "30765": msg32692, + "30766": msg32693, + "30767": msg32694, + "30768": msg32695, + "3077": msg5527, + "30777": msg32696, + "30778": msg32697, + "30779": msg32698, + "3078": msg5528, + "30780": msg32699, + "30781": msg32700, + "30782": msg32701, + "30783": msg32702, + "30784": msg32703, + "30785": msg32704, + "30786": msg32705, + "30787": msg32706, + "30788": msg32707, + "30789": msg32708, + "3079": msg5529, + "30790": msg32709, + "30791": msg32710, + "30792": msg32711, + "30793": msg32712, + "30794": msg32713, + "30795": msg32714, + "30796": msg32715, + "30797": msg32716, + "30798": msg32717, + "30799": msg32718, + "308": select230, + "3080": msg5530, + "30800": msg32719, + "30801": msg32720, + "30802": msg32721, + "30803": msg32722, + "30804": msg32723, + "30805": msg32724, + "30806": msg32725, + "30807": msg32726, + "30808": msg32727, + "30809": msg32728, + "3081": msg5531, + "30810": msg32729, + "30811": msg32730, + "30812": msg32731, + "30813": msg32732, + "30814": msg32733, + "30815": msg32734, + "30816": msg32735, + "30817": msg32736, + "30818": msg32737, + "30819": msg32738, + "3082": msg5532, + "30820": msg32739, + "30821": msg32740, + "30822": msg32741, + "30823": msg32742, + "30824": msg32743, + "30825": msg32744, + "30826": msg32745, + "30827": msg32746, + "30828": msg32747, + "30829": msg32748, + "3083": msg5533, + "30830": msg32749, + "30831": msg32750, + "30832": msg32751, + "30833": msg32752, + "30834": msg32753, + "30835": msg32754, + "30836": msg32755, + "30837": msg32756, + "30838": msg32757, + "30839": msg32758, + "3084": msg5534, + "30840": msg32759, + "30841": msg32760, + "30842": msg32761, + "30843": msg32762, + "30844": msg32763, + "30845": msg32764, + "30846": msg32765, + "30847": msg32766, + "30848": msg32767, + "30849": msg32768, + "3085": msg5535, + "30850": msg32769, + "30851": msg32770, + "30852": msg32771, + "30853": msg32772, + "30854": msg32773, + "30855": msg32774, + "30856": msg32775, + "30857": msg32776, + "30858": msg32777, + "30859": msg32778, + "3086": msg5536, + "30860": msg32779, + "30861": msg32780, + "30862": msg32781, + "30863": msg32782, + "30864": msg32783, + "30865": msg32784, + "30866": msg32785, + "30867": msg32786, + "30868": msg32787, + "30869": msg32788, + "3087": msg5537, + "30870": msg32789, + "30871": msg32790, + "30872": msg32791, + "30873": msg32792, + "30874": msg32793, + "30875": msg32794, + "30876": msg32795, + "30877": msg32796, + "30878": msg32797, + "30879": msg32798, + "3088": msg5538, + "30880": msg32799, + "30881": msg32800, + "30882": msg32801, + "30883": msg32802, + "30884": msg32803, + "30885": msg32804, + "30886": msg32805, + "30887": msg32806, + "30888": msg32807, + "30889": msg32808, + "3089": msg5539, + "30890": msg32809, + "30891": msg32810, + "30892": msg32811, + "30893": msg32812, + "30894": msg32813, + "30895": msg32814, + "30896": msg32815, + "30897": msg32816, + "30898": msg32817, + "30899": msg32818, + "309": select231, + "3090": msg5540, + "30900": msg32819, + "30901": msg32820, + "30902": msg32821, + "30903": msg32822, + "30904": msg32823, + "30905": msg32824, + "30906": msg32825, + "30907": msg32826, + "30908": msg32827, + "30909": msg32828, + "3091": msg5541, + "30910": msg32829, + "30911": msg32830, + "30912": msg32831, + "30913": msg32832, + "30914": msg32833, + "30915": msg32834, + "30916": msg32835, + "30917": msg32836, + "30918": msg32837, + "30919": msg32838, + "3092": msg5542, + "30920": msg32839, + "30921": msg32840, + "30922": msg32841, + "30923": msg32842, + "30924": msg32843, + "30925": msg32844, + "30926": msg32845, + "30927": msg32846, + "30928": msg32847, + "30929": msg32848, + "3093": msg5543, + "30930": msg32849, + "30931": msg32850, + "30932": msg32851, + "30933": msg32852, + "30934": msg32853, + "30935": msg32854, + "30936": msg32855, + "30937": msg32856, + "30938": msg32857, + "30939": msg32858, + "3094": msg5544, + "30940": msg32859, + "30941": msg32860, + "30942": msg32861, + "30943": msg32862, + "30944": msg32863, + "30945": msg32864, + "30946": msg32865, + "30947": msg32866, + "30948": msg32867, + "30949": msg32868, + "3095": msg5545, + "30950": msg32869, + "30951": msg32870, + "30952": msg32871, + "30953": msg32872, + "30954": msg32873, + "30955": msg32874, + "30956": msg32875, + "30957": msg32876, + "30958": msg32877, + "30959": msg32878, + "3096": msg5546, + "30960": msg32879, + "30961": msg32880, + "30962": msg32881, + "30963": msg32882, + "30964": msg32883, + "30965": msg32884, + "30966": msg32885, + "30967": msg32886, + "30968": msg32887, + "30969": msg32888, + "3097": msg5547, + "30970": msg32889, + "30971": msg32890, + "30972": msg32891, + "30973": msg32892, + "30974": msg32893, + "30975": msg32894, + "30976": msg32895, + "30977": msg32896, + "30978": msg32897, + "30979": msg32898, + "3098": msg5548, + "30980": msg32899, + "30981": msg32900, + "30982": msg32901, + "30983": msg32902, + "30984": msg32903, + "30985": msg32904, + "30986": msg32905, + "30987": msg32906, + "30988": msg32907, + "30989": msg32908, + "3099": msg5549, + "30990": msg32909, + "30991": msg32910, + "30992": msg32911, + "30993": msg32912, + "30994": msg32913, + "30995": msg32914, + "30996": msg32915, + "30997": msg32916, + "30998": msg32917, + "30999": msg32918, + "310": select232, + "3100": msg5550, + "31000": msg32919, + "31001": msg32920, + "31002": msg32921, + "31003": msg32922, + "31004": msg32923, + "31005": msg32924, + "31006": msg32925, + "31007": msg32926, + "31008": msg32927, + "31009": msg32928, + "3101": msg5551, + "31010": msg32929, + "31011": msg32930, + "31012": msg32931, + "31013": msg32932, + "31014": msg32933, + "31015": msg32934, + "31016": msg32935, + "31017": msg32936, + "31018": msg32937, + "31019": msg32938, + "3102": msg5552, + "31020": msg32939, + "31021": msg32940, + "31022": msg32941, + "31023": msg32942, + "31024": msg32943, + "31025": msg32944, + "31026": msg32945, + "31027": msg32946, + "31028": msg32947, + "31029": msg32948, + "3103": msg5553, + "31030": msg32949, + "31031": msg32950, + "31032": msg32951, + "31033": msg32952, + "31034": msg32953, + "31035": msg32954, + "31036": msg32955, + "31037": msg32956, + "31038": msg32957, + "31039": msg32958, + "3104": msg5554, + "31040": msg32959, + "31041": msg32960, + "31042": msg32961, + "31043": msg32962, + "31044": msg32963, + "31045": msg32964, + "31046": msg32965, + "31048": msg32966, + "31049": msg32967, + "3105": msg5555, + "31050": msg32968, + "31051": msg32969, + "31052": msg32970, + "31053": msg32971, + "31054": msg32972, + "31055": msg32973, + "31056": msg32974, + "31057": msg32975, + "31058": msg32976, + "31059": msg32977, + "3106": msg5556, + "31060": msg32978, + "31061": msg32979, + "31062": msg32980, + "31063": msg32981, + "31064": msg32982, + "31065": msg32983, + "31066": msg32984, + "31067": msg32985, + "31068": msg32986, + "31069": msg32987, + "3107": msg5557, + "31070": msg32988, + "31071": msg32989, + "31072": msg32990, + "31073": msg32991, + "31074": msg32992, + "31075": msg32993, + "31076": msg32994, + "31077": msg32995, + "31078": msg32996, + "31079": msg32997, + "3108": msg5558, + "31080": msg32998, + "31081": msg32999, + "31082": msg33000, + "31083": msg33001, + "31084": msg33002, + "31085": msg33003, + "31086": msg33004, + "31087": msg33005, + "31088": msg33006, + "31089": msg33007, + "3109": msg5559, + "31090": msg33008, + "31091": msg33009, + "31092": msg33010, + "31093": msg33011, + "31094": msg33012, + "31095": msg33013, + "31096": msg33014, + "31097": msg33015, + "31098": msg33016, + "31099": msg33017, + "311": select233, + "3110": msg5560, + "31100": msg33018, + "31101": msg33019, + "31102": msg33020, + "31103": msg33021, + "31104": msg33022, + "31105": msg33023, + "31106": msg33024, + "31107": msg33025, + "31108": msg33026, + "31109": msg33027, + "3111": msg5561, + "31110": msg33028, + "31111": msg33029, + "31112": msg33030, + "31113": msg33031, + "31114": msg33032, + "31115": msg33033, + "31116": msg33034, + "31117": msg33035, + "31118": msg33036, + "31119": msg33037, + "3112": msg5562, + "31120": msg33038, + "31121": msg33039, + "31122": msg33040, + "31123": msg33041, + "31124": msg33042, + "31125": msg33043, + "31126": msg33044, + "31127": msg33045, + "31128": msg33046, + "31129": msg33047, + "3113": msg5563, + "31130": msg33048, + "31131": msg33049, + "31132": msg33050, + "31133": msg33051, + "31134": msg33052, + "31135": msg33053, + "31136": msg33054, + "31137": msg33055, + "31138": msg33056, + "31139": msg33057, + "3114": msg5564, + "31140": msg33058, + "31141": msg33059, + "31142": msg33060, + "31143": msg33061, + "31144": msg33062, + "31145": msg33063, + "31146": msg33064, + "3115": msg5565, + "3116": msg5566, + "31167": msg33065, + "3117": msg5567, + "31176": msg33066, + "31177": msg33067, + "31178": msg33068, + "31179": msg33069, + "3118": msg5568, + "31180": msg33070, + "31181": msg33071, + "31182": msg33072, + "31183": msg33073, + "31184": msg33074, + "31185": msg33075, + "31186": msg33076, + "31187": msg33077, + "31188": msg33078, + "31189": msg33079, + "3119": msg5569, + "31190": msg33080, + "31191": msg33081, + "31192": msg33082, + "31193": msg33083, + "31194": msg33084, + "31195": msg33085, + "31196": msg33086, + "31197": msg33087, + "31198": msg33088, + "31199": msg33089, + "312": select234, + "3120": msg5570, + "31200": msg33090, + "31201": msg33091, + "31202": msg33092, + "31203": msg33093, + "31204": msg33094, + "31205": msg33095, + "31206": msg33096, + "31207": msg33097, + "31208": msg33098, + "31209": msg33099, + "3121": msg5571, + "31210": msg33100, + "31211": msg33101, + "31212": msg33102, + "31213": msg33103, + "31214": msg33104, + "31215": msg33105, + "31216": msg33106, + "31217": msg33107, + "31218": msg33108, + "31219": msg33109, + "3122": msg5572, + "31220": msg33110, + "31221": msg33111, + "31222": msg33112, + "31223": msg33113, + "31224": msg33114, + "31225": msg33115, + "31226": msg33116, + "31227": msg33117, + "31228": msg33118, + "31229": msg33119, + "3123": msg5573, + "31230": msg33120, + "31231": msg33121, + "31232": msg33122, + "31233": msg33123, + "31234": msg33124, + "31235": msg33125, + "31236": msg33126, + "31237": msg33127, + "31238": msg33128, + "31239": msg33129, + "3124": msg5574, + "31240": msg33130, + "31241": msg33131, + "31242": msg33132, + "31243": msg33133, + "31244": msg33134, + "31245": msg33135, + "31246": msg33136, + "31247": msg33137, + "31248": msg33138, + "31249": msg33139, + "3125": msg5575, + "31250": msg33140, + "31251": msg33141, + "31252": msg33142, + "31253": msg33143, + "31254": msg33144, + "31255": msg33145, + "31256": msg33146, + "31257": msg33147, + "31258": msg33148, + "31259": msg33149, + "3126": msg5576, + "31260": msg33150, + "31261": msg33151, + "31262": msg33152, + "31263": msg33153, + "31264": msg33154, + "31265": msg33155, + "31266": msg33156, + "31267": msg33157, + "31268": msg33158, + "31269": msg33159, + "3127": msg5577, + "31270": msg33160, + "31271": msg33161, + "31272": msg33162, + "31273": msg33163, + "31274": msg33164, + "31275": msg33165, + "31276": msg33166, + "31277": msg33167, + "31278": msg33168, + "31279": msg33169, + "3128": msg5578, + "31280": msg33170, + "31281": msg33171, + "31282": msg33172, + "31283": msg33173, + "31284": msg33174, + "31285": msg33175, + "31286": msg33176, + "31287": msg33177, + "31288": msg33178, + "31289": msg33179, + "3129": msg5579, + "31290": msg33180, + "31291": msg33181, + "31292": msg33182, + "31293": msg33183, + "31294": msg33184, + "31295": msg33185, + "31296": msg33186, + "31297": msg33187, + "31298": msg33188, + "31299": msg33189, + "313": select235, + "3130": msg5580, + "31300": msg33190, + "31301": msg33191, + "31302": msg33192, + "31303": msg33193, + "31304": msg33194, + "31305": msg33195, + "31306": msg33196, + "31307": msg33197, + "31308": msg33198, + "31309": msg33199, + "3131": msg5581, + "31310": msg33200, + "31311": msg33201, + "31312": msg33202, + "31313": msg33203, + "31314": msg33204, + "31315": msg33205, + "31316": msg33206, + "31317": msg33207, + "31318": msg33208, + "31319": msg33209, + "3132": msg5582, + "31320": msg33210, + "31321": msg33211, + "31322": msg33212, + "31323": msg33213, + "31324": msg33214, + "31325": msg33215, + "31326": msg33216, + "31327": msg33217, + "31328": msg33218, + "31329": msg33219, + "3133": msg5583, + "31330": msg33220, + "31331": msg33221, + "31332": msg33222, + "31333": msg33223, + "31334": msg33224, + "31335": msg33225, + "31336": msg33226, + "31337": msg33227, + "31338": msg33228, + "31339": msg33229, + "3134": msg5584, + "31340": msg33230, + "31341": msg33231, + "31342": msg33232, + "31343": msg33233, + "31344": msg33234, + "31345": msg33235, + "31346": msg33236, + "31347": msg33237, + "31348": msg33238, + "31349": msg33239, + "3135": msg5585, + "31350": msg33240, + "31351": msg33241, + "31352": msg33242, + "31353": msg33243, + "31354": msg33244, + "31355": msg33245, + "31356": msg33246, + "31357": msg33247, + "31358": msg33248, + "31359": msg33249, + "3136": msg5586, + "31360": msg33250, + "31361": msg33251, + "31362": msg33252, + "31363": msg33253, + "31364": msg33254, + "31365": msg33255, + "31366": msg33256, + "31367": msg33257, + "31368": msg33258, + "31369": msg33259, + "3137": msg5587, + "31370": msg33260, + "31371": msg33261, + "31372": msg33262, + "31373": msg33263, + "31374": msg33264, + "31375": msg33265, + "31376": msg33266, + "31377": msg33267, + "31378": msg33268, + "31379": msg33269, + "3138": msg5588, + "31380": msg33270, + "31381": msg33271, + "31382": msg33272, + "31383": msg33273, + "31384": msg33274, + "31385": msg33275, + "31386": msg33276, + "31387": msg33277, + "31388": msg33278, + "31389": msg33279, + "3139": msg5589, + "31390": msg33280, + "31391": msg33281, + "31392": msg33282, + "31393": msg33283, + "31394": msg33284, + "31395": msg33285, + "31396": msg33286, + "31397": msg33287, + "31398": msg33288, + "31399": msg33289, + "314": select236, + "3140": msg5590, + "31400": msg33290, + "31401": msg33291, + "31402": msg33292, + "31403": msg33293, + "31404": msg33294, + "31405": msg33295, + "31406": msg33296, + "31407": msg33297, + "31408": msg33298, + "31409": msg33299, + "3141": msg5591, + "31410": msg33300, + "31411": msg33301, + "31412": msg33302, + "31413": msg33303, + "31414": msg33304, + "31415": msg33305, + "31416": msg33306, + "31417": msg33307, + "31418": msg33308, + "31419": msg33309, + "3142": msg5592, + "31420": msg33310, + "31421": msg33311, + "31422": msg33312, + "31423": msg33313, + "31424": msg33314, + "31425": msg33315, + "31426": msg33316, + "31427": msg33317, + "31428": msg33318, + "31429": msg33319, + "3143": msg5593, + "31433": msg33320, + "31434": msg33321, + "31435": msg33322, + "31436": msg33323, + "31437": msg33324, + "31438": msg33325, + "31439": msg33326, + "3144": msg5594, + "31440": msg33327, + "31441": msg33328, + "31442": msg33329, + "31443": msg33330, + "31444": msg33331, + "31445": msg33332, + "31446": msg33333, + "31447": msg33334, + "31448": msg33335, + "31449": msg33336, + "3145": msg5595, + "31450": msg33337, + "31451": msg33338, + "31452": msg33339, + "31453": msg33340, + "31454": msg33341, + "31455": msg33342, + "31456": msg33343, + "31457": msg33344, + "31458": msg33345, + "31459": msg33346, + "3146": msg5596, + "31460": msg33347, + "31461": msg33348, + "31462": msg33349, + "31463": msg33350, + "31464": msg33351, + "31465": msg33352, + "31466": msg33353, + "31467": msg33354, + "31468": msg33355, + "31469": msg33356, + "3147": msg5597, + "31470": msg33357, + "31471": msg33358, + "31472": msg33359, + "31473": msg33360, + "31474": msg33361, + "31475": msg33362, + "31476": msg33363, + "31477": msg33364, + "31478": msg33365, + "31479": msg33366, + "3148": msg5598, + "31480": msg33367, + "31481": msg33368, + "31482": msg33369, + "31483": msg33370, + "31484": msg33371, + "31485": msg33372, + "31486": msg33373, + "31487": msg33374, + "31488": msg33375, + "31489": msg33376, + "3149": msg5599, + "31490": msg33377, + "31491": msg33378, + "31492": msg33379, + "31493": msg33380, + "31494": msg33381, + "31495": msg33382, + "31496": msg33383, + "31497": msg33384, + "31498": msg33385, + "31499": msg33386, + "315": select237, + "3150": msg5600, + "31500": msg33387, + "31501": msg33388, + "31502": msg33389, + "31503": msg33390, + "31504": msg33391, + "31505": msg33392, + "31506": msg33393, + "31507": msg33394, + "31508": msg33395, + "31509": msg33396, + "3151": msg5601, + "31510": msg33397, + "31511": msg33398, + "31512": msg33399, + "31513": msg33400, + "31514": msg33401, + "31515": msg33402, + "31516": msg33403, + "31517": msg33404, + "31518": msg33405, + "31519": msg33406, + "3152": msg5602, + "31520": msg33407, + "31521": msg33408, + "31522": msg33409, + "31523": msg33410, + "31524": msg33411, + "31525": msg33412, + "31526": msg33413, + "31527": msg33414, + "31528": msg33415, + "31529": msg33416, + "3153": msg5603, + "31530": msg33417, + "31531": msg33418, + "31532": msg33419, + "31533": msg33420, + "31534": msg33421, + "31535": msg33422, + "31536": msg33423, + "31537": msg33424, + "31538": msg33425, + "31539": msg33426, + "3154": msg5604, + "31540": msg33427, + "31541": msg33428, + "31542": msg33429, + "31543": msg33430, + "31544": msg33431, + "31545": msg33432, + "31546": msg33433, + "31547": msg33434, + "31548": msg33435, + "31549": msg33436, + "3155": msg5605, + "31550": msg33437, + "31551": msg33438, + "31552": msg33439, + "31553": msg33440, + "31554": msg33441, + "31555": msg33442, + "31556": msg33443, + "31557": msg33444, + "31558": msg33445, + "31559": msg33446, + "3156": msg5606, + "31560": msg33447, + "31561": msg33448, + "31562": msg33449, + "31563": msg33450, + "31564": msg33451, + "31565": msg33452, + "31566": msg33453, + "31567": msg33454, + "31568": msg33455, + "31569": msg33456, + "3157": msg5607, + "31570": msg33457, + "31571": msg33458, + "31572": msg33459, + "31573": msg33460, + "31574": msg33461, + "31575": msg33462, + "31576": msg33463, + "31577": msg33464, + "31578": msg33465, + "31579": msg33466, + "3158": msg5608, + "31580": msg33467, + "31581": msg33468, + "31582": msg33469, + "31583": msg33470, + "31584": msg33471, + "31585": msg33472, + "31586": msg33473, + "31587": msg33474, + "31588": msg33475, + "31589": msg33476, + "3159": msg5609, + "31590": msg33477, + "31591": msg33478, + "31592": msg33479, + "31593": msg33480, + "31594": msg33481, + "31595": msg33482, + "31596": msg33483, + "31597": msg33484, + "31598": msg33485, + "31599": msg33486, + "316": select238, + "3160": msg5610, + "31600": msg33487, + "31601": msg33488, + "31602": msg33489, + "31603": msg33490, + "31604": msg33491, + "31605": msg33492, + "31606": msg33493, + "31607": msg33494, + "31608": msg33495, + "31609": msg33496, + "3161": msg5611, + "31610": msg33497, + "31611": msg33498, + "31612": msg33499, + "31613": msg33500, + "31614": msg33501, + "31615": msg33502, + "31616": msg33503, + "31617": msg33504, + "31618": msg33505, + "31619": msg33506, + "3162": msg5612, + "31620": msg33507, + "31621": msg33508, + "31622": msg33509, + "31623": msg33510, + "31624": msg33511, + "31625": msg33512, + "31626": msg33513, + "31627": msg33514, + "31628": msg33515, + "31629": msg33516, + "3163": msg5613, + "31630": msg33517, + "31631": msg33518, + "31632": msg33519, + "31633": msg33520, + "31634": msg33521, + "31635": msg33522, + "31636": msg33523, + "31637": msg33524, + "31638": msg33525, + "31639": msg33526, + "3164": msg5614, + "31640": msg33527, + "31641": msg33528, + "31642": msg33529, + "31643": msg33530, + "31644": msg33531, + "31645": msg33532, + "31646": msg33533, + "31647": msg33534, + "31648": msg33535, + "31649": msg33536, + "3165": msg5615, + "31650": msg33537, + "31651": msg33538, + "31652": msg33539, + "31653": msg33540, + "31654": msg33541, + "31655": msg33542, + "31656": msg33543, + "31657": msg33544, + "31658": msg33545, + "31659": msg33546, + "3166": msg5616, + "31660": msg33547, + "31661": msg33548, + "31662": msg33549, + "31663": msg33550, + "31664": msg33551, + "31665": msg33552, + "31666": msg33553, + "31667": msg33554, + "31668": msg33555, + "31669": msg33556, + "3167": msg5617, + "31670": msg33557, + "31671": msg33558, + "31672": msg33559, + "31673": msg33560, + "31674": msg33561, + "31675": msg33562, + "31676": msg33563, + "31677": msg33564, + "31678": msg33565, + "31679": msg33566, + "3168": msg5618, + "31680": msg33567, + "31681": msg33568, + "31682": msg33569, + "31683": msg33570, + "31684": msg33571, + "31685": msg33572, + "31686": msg33573, + "31687": msg33574, + "31688": msg33575, + "31689": msg33576, + "3169": msg5619, + "31690": msg33577, + "31691": msg33578, + "31692": msg33579, + "31693": msg33580, + "31694": msg33581, + "31695": msg33582, + "31696": msg33583, + "31697": msg33584, + "31698": msg33585, + "31699": msg33586, + "317": select239, + "3170": msg5620, + "31700": msg33587, + "31701": msg33588, + "31702": msg33589, + "31703": msg33590, + "31704": msg33591, + "31705": msg33592, + "31706": msg33593, + "31707": msg33594, + "31708": msg33595, + "31709": msg33596, + "3171": msg5621, + "31710": msg33597, + "31711": msg33598, + "31712": msg33599, + "31713": msg33600, + "31714": msg33601, + "31715": msg33602, + "31716": msg33603, + "31717": msg33604, + "31718": msg33605, + "31719": msg33606, + "3172": msg5622, + "31720": msg33607, + "31721": msg33608, + "31722": msg33609, + "31723": msg33610, + "31724": msg33611, + "31725": msg33612, + "31726": msg33613, + "31727": msg33614, + "31728": msg33615, + "31729": msg33616, + "3173": msg5623, + "31730": msg33617, + "31731": msg33618, + "31732": msg33619, + "31733": msg33620, + "31734": msg33621, + "31735": msg33622, + "31736": msg33623, + "31737": msg33624, + "31738": msg33625, + "31739": msg33626, + "3174": msg5624, + "31740": msg33627, + "31741": msg33628, + "31742": msg33629, + "31743": msg33630, + "31744": msg33631, + "31745": msg33632, + "31746": msg33633, + "31747": msg33634, + "31748": msg33635, + "31749": msg33636, + "3175": msg5625, + "31750": msg33637, + "31751": msg33638, + "31752": msg33639, + "31753": msg33640, + "31754": msg33641, + "31755": msg33642, + "31756": msg33643, + "31757": msg33644, + "31758": msg33645, + "31759": msg33646, + "3176": msg5626, + "31760": msg33647, + "31761": msg33648, + "31762": msg33649, + "31763": msg33650, + "31764": msg33651, + "31765": msg33652, + "31766": msg33653, + "31767": msg33654, + "31768": msg33655, + "31769": msg33656, + "3177": msg5627, + "31770": msg33657, + "31771": msg33658, + "31772": msg33659, + "31773": msg33660, + "31774": msg33661, + "31775": msg33662, + "31776": msg33663, + "31777": msg33664, + "31778": msg33665, + "31779": msg33666, + "3178": msg5628, + "31780": msg33667, + "31781": msg33668, + "31782": msg33669, + "31783": msg33670, + "31784": msg33671, + "31785": msg33672, + "31786": msg33673, + "31787": msg33674, + "31788": msg33675, + "31789": msg33676, + "3179": msg5629, + "31790": msg33677, + "31791": msg33678, + "31792": msg33679, + "31793": msg33680, + "31794": msg33681, + "31795": msg33682, + "31796": msg33683, + "31797": msg33684, + "31798": msg33685, + "31799": msg33686, + "318": select240, + "3180": msg5630, + "31800": msg33687, + "31801": msg33688, + "31802": msg33689, + "31803": msg33690, + "31804": msg33691, + "31805": msg33692, + "31806": msg33693, + "31807": msg33694, + "31808": msg33695, + "31809": msg33696, + "3181": msg5631, + "31810": msg33697, + "31811": msg33698, + "31812": msg33699, + "31813": msg33700, + "31814": msg33701, + "31815": msg33702, + "31816": msg33703, + "31817": msg33704, + "31818": msg33705, + "31819": msg33706, + "3182": msg5632, + "31820": msg33707, + "31821": msg33708, + "31822": msg33709, + "31823": msg33710, + "31824": msg33711, + "31825": msg33712, + "31826": msg33713, + "31827": msg33714, + "31828": msg33715, + "31829": msg33716, + "3183": msg5633, + "31830": msg33717, + "31831": msg33718, + "31832": msg33719, + "31833": msg33720, + "31834": msg33721, + "31835": msg33722, + "31836": msg33723, + "31837": msg33724, + "31838": msg33725, + "31839": msg33726, + "3184": msg5634, + "31840": msg33727, + "31841": msg33728, + "31842": msg33729, + "31843": msg33730, + "31844": msg33731, + "31845": msg33732, + "31846": msg33733, + "31847": msg33734, + "31848": msg33735, + "31849": msg33736, + "3185": msg5635, + "31850": msg33737, + "31851": msg33738, + "31852": msg33739, + "31853": msg33740, + "31854": msg33741, + "31855": msg33742, + "31856": msg33743, + "31857": msg33744, + "31858": msg33745, + "31859": msg33746, + "3186": msg5636, + "31860": msg33747, + "31861": msg33748, + "31862": msg33749, + "31863": msg33750, + "31864": msg33751, + "31865": msg33752, + "31866": msg33753, + "31867": msg33754, + "31868": msg33755, + "31869": msg33756, + "3187": msg5637, + "31870": msg33757, + "31871": msg33758, + "31872": msg33759, + "31873": msg33760, + "31874": msg33761, + "31875": msg33762, + "31876": msg33763, + "31877": msg33764, + "31878": msg33765, + "31879": msg33766, + "3188": msg5638, + "31880": msg33767, + "31881": msg33768, + "31882": msg33769, + "31883": msg33770, + "31884": msg33771, + "31885": msg33772, + "31886": msg33773, + "31887": msg33774, + "31888": msg33775, + "31889": msg33776, + "3189": msg5639, + "31890": msg33777, + "31891": msg33778, + "31892": msg33779, + "31893": msg33780, + "31894": msg33781, + "31895": msg33782, + "31896": msg33783, + "31897": msg33784, + "31898": msg33785, + "31899": msg33786, + "319": select241, + "3190": msg5640, + "31900": msg33787, + "31901": msg33788, + "31902": msg33789, + "31903": msg33790, + "31904": msg33791, + "31905": msg33792, + "31906": msg33793, + "31907": msg33794, + "31908": msg33795, + "31909": msg33796, + "3191": msg5641, + "31910": msg33797, + "31911": msg33798, + "31912": msg33799, + "31913": msg33800, + "31914": msg33801, + "31915": msg33802, + "31916": msg33803, + "31917": msg33804, + "31918": msg33805, + "31919": msg33806, + "3192": msg5642, + "31920": msg33807, + "31921": msg33808, + "31922": msg33809, + "31923": msg33810, + "31924": msg33811, + "31925": msg33812, + "31926": msg33813, + "31927": msg33814, + "31928": msg33815, + "31929": msg33816, + "3193": msg5643, + "31930": msg33817, + "31931": msg33818, + "31932": msg33819, + "31933": msg33820, + "31934": msg33821, + "31935": msg33822, + "31936": msg33823, + "31937": msg33824, + "31938": msg33825, + "31939": msg33826, + "3194": msg5644, + "31940": msg33827, + "31941": msg33828, + "31942": msg33829, + "31943": msg33830, + "31944": msg33831, + "31945": msg33832, + "31946": msg33833, + "31947": msg33834, + "31948": msg33835, + "31949": msg33836, + "3195": msg5645, + "31950": msg33837, + "31951": msg33838, + "31952": msg33839, + "31953": msg33840, + "31954": msg33841, + "31955": msg33842, + "31956": msg33843, + "31957": msg33844, + "31958": msg33845, + "31959": msg33846, + "3196": msg5646, + "31960": msg33847, + "31961": msg33848, + "31962": msg33849, + "31963": msg33850, + "31964": msg33851, + "31965": msg33852, + "31966": msg33853, + "31967": msg33854, + "31968": msg33855, + "31969": msg33856, + "3197": msg5647, + "31970": msg33857, + "31971": msg33858, + "31972": msg33859, + "31973": msg33860, + "31974": msg33861, + "31975": msg33862, + "31976": msg33863, + "31977": msg33864, + "31978": msg33865, + "31979": msg33866, + "3198": msg5648, + "31980": msg33867, + "31981": msg33868, + "31982": msg33869, + "31983": msg33870, + "31984": msg33871, + "31985": msg33872, + "31986": msg33873, + "31987": msg33874, + "31988": msg33875, + "31989": msg33876, + "3199": msg5649, + "31990": msg33877, + "31991": msg33878, + "31992": msg33879, + "31993": msg33880, + "31994": msg33881, + "31995": msg33882, + "31996": msg33883, + "31997": msg33884, + "31998": msg33885, + "31999": msg33886, + "320": select242, + "3200": msg5650, + "32000": msg33887, + "32001": msg33888, + "32002": msg33889, + "32003": msg33890, + "32004": msg33891, + "32005": msg33892, + "32006": msg33893, + "32007": msg33894, + "32008": msg33895, + "32009": msg33896, + "3201": msg5651, + "32010": msg33897, + "32011": msg33898, + "32012": msg33899, + "32013": msg33900, + "32014": msg33901, + "32015": msg33902, + "32016": msg33903, + "32017": msg33904, + "32018": msg33905, + "32019": msg33906, + "3202": msg5652, + "32020": msg33907, + "32021": msg33908, + "32022": msg33909, + "32023": msg33910, + "32024": msg33911, + "32025": msg33912, + "32026": msg33913, + "32027": msg33914, + "32028": msg33915, + "32029": msg33916, + "3203": msg5653, + "32030": msg33917, + "32031": msg33918, + "32032": msg33919, + "32033": msg33920, + "32034": msg33921, + "32035": msg33922, + "32036": msg33923, + "32037": msg33924, + "32038": msg33925, + "32039": msg33926, + "3204": msg5654, + "32040": msg33927, + "32041": msg33928, + "32042": msg33929, + "32043": msg33930, + "32044": msg33931, + "32045": msg33932, + "32046": msg33933, + "32047": msg33934, + "32048": msg33935, + "32049": msg33936, + "3205": msg5655, + "32050": msg33937, + "32051": msg33938, + "32052": msg33939, + "32053": msg33940, + "32054": msg33941, + "32055": msg33942, + "32056": msg33943, + "32057": msg33944, + "32058": msg33945, + "32059": msg33946, + "3206": msg5656, + "32060": msg33947, + "32061": msg33948, + "32062": msg33949, + "32063": msg33950, + "32064": msg33951, + "32065": msg33952, + "32066": msg33953, + "32067": msg33954, + "32068": msg33955, + "32069": msg33956, + "3207": msg5657, + "32070": msg33957, + "32071": msg33958, + "32072": msg33959, + "32073": msg33960, + "32074": msg33961, + "32075": msg33962, + "32076": msg33963, + "32077": msg33964, + "32078": msg33965, + "32079": msg33966, + "3208": msg5658, + "32080": msg33967, + "32081": msg33968, + "32082": msg33969, + "32083": msg33970, + "32084": msg33971, + "32085": msg33972, + "32086": msg33973, + "32087": msg33974, + "32088": msg33975, + "32089": msg33976, + "3209": msg5659, + "32090": msg33977, + "32091": msg33978, + "32092": msg33979, + "32093": msg33980, + "32094": msg33981, + "32095": msg33982, + "32096": msg33983, + "32097": msg33984, + "32098": msg33985, + "32099": msg33986, + "321": select243, + "3210": msg5660, + "32100": msg33987, + "32101": msg33988, + "32102": msg33989, + "32103": msg33990, + "32104": msg33991, + "32105": msg33992, + "32106": msg33993, + "32107": msg33994, + "32108": msg33995, + "32109": msg33996, + "3211": msg5661, + "32110": msg33997, + "32111": msg33998, + "32112": msg33999, + "32113": msg34000, + "32114": msg34001, + "32115": msg34002, + "32116": msg34003, + "32117": msg34004, + "32118": msg34005, + "32119": msg34006, + "3212": msg5662, + "32120": msg34007, + "32121": msg34008, + "32122": msg34009, + "32123": msg34010, + "32124": msg34011, + "32125": msg34012, + "32126": msg34013, + "32127": msg34014, + "32128": msg34015, + "32129": msg34016, + "3213": msg5663, + "32130": msg34017, + "32131": msg34018, + "32132": msg34019, + "32133": msg34020, + "32134": msg34021, + "32135": msg34022, + "32136": msg34023, + "32137": msg34024, + "32138": msg34025, + "32139": msg34026, + "3214": msg5664, + "32140": msg34027, + "32141": msg34028, + "32142": msg34029, + "32143": msg34030, + "32144": msg34031, + "32145": msg34032, + "32146": msg34033, + "32147": msg34034, + "32148": msg34035, + "32149": msg34036, + "3215": msg5665, + "32150": msg34037, + "32151": msg34038, + "32152": msg34039, + "32153": msg34040, + "32154": msg34041, + "32155": msg34042, + "32156": msg34043, + "32157": msg34044, + "32158": msg34045, + "32159": msg34046, + "3216": msg5666, + "32160": msg34047, + "32161": msg34048, + "32162": msg34049, + "32163": msg34050, + "32164": msg34051, + "32165": msg34052, + "32166": msg34053, + "32167": msg34054, + "32168": msg34055, + "32169": msg34056, + "3217": msg5667, + "32170": msg34057, + "32171": msg34058, + "32172": msg34059, + "32173": msg34060, + "32174": msg34061, + "32175": msg34062, + "32176": msg34063, + "32177": msg34064, + "32178": msg34065, + "32179": msg34066, + "3218": msg5668, + "32180": msg34067, + "32181": msg34068, + "32182": msg34069, + "32183": msg34070, + "32184": msg34071, + "32185": msg34072, + "32186": msg34073, + "32187": msg34074, + "32188": msg34075, + "32189": msg34076, + "3219": msg5669, + "32190": msg34077, + "32191": msg34078, + "32192": msg34079, + "32193": msg34080, + "32194": msg34081, + "32195": msg34082, + "32196": msg34083, + "32197": msg34084, + "32198": msg34085, + "32199": msg34086, + "322": select244, + "3220": msg5670, + "32200": msg34087, + "32201": msg34088, + "32202": msg34089, + "32203": msg34090, + "32204": msg34091, + "32205": msg34092, + "32206": msg34093, + "32207": msg34094, + "32208": msg34095, + "32209": msg34096, + "3221": msg5671, + "32210": msg34097, + "32211": msg34098, + "32212": msg34099, + "32213": msg34100, + "32214": msg34101, + "32215": msg34102, + "32216": msg34103, + "32217": msg34104, + "32218": msg34105, + "32219": msg34106, + "3222": msg5672, + "32220": msg34107, + "32221": msg34108, + "32222": msg34109, + "32223": msg34110, + "32224": msg34111, + "32225": msg34112, + "32226": msg34113, + "32227": msg34114, + "32228": msg34115, + "32229": msg34116, + "3223": msg5673, + "32230": msg34117, + "32231": msg34118, + "32232": msg34119, + "32233": msg34120, + "32234": msg34121, + "32235": msg34122, + "32236": msg34123, + "32237": msg34124, + "32238": msg34125, + "32239": msg34126, + "3224": msg5674, + "32240": msg34127, + "32241": msg34128, + "32242": msg34129, + "32243": msg34130, + "32244": msg34131, + "32245": msg34132, + "32246": msg34133, + "32247": msg34134, + "32248": msg34135, + "32249": msg34136, + "3225": msg5675, + "32250": msg34137, + "32251": msg34138, + "32252": msg34139, + "32253": msg34140, + "32254": msg34141, + "32255": msg34142, + "32256": msg34143, + "32257": msg34144, + "32258": msg34145, + "32259": msg34146, + "3226": msg5676, + "32260": msg34147, + "32261": msg34148, + "32262": msg34149, + "32263": msg34150, + "32264": msg34151, + "32265": msg34152, + "32266": msg34153, + "32267": msg34154, + "32268": msg34155, + "32269": msg34156, + "3227": msg5677, + "32270": msg34157, + "32271": msg34158, + "32272": msg34159, + "32273": msg34160, + "32274": msg34161, + "32275": msg34162, + "32276": msg34163, + "32277": msg34164, + "32278": msg34165, + "32279": msg34166, + "3228": msg5678, + "32280": msg34167, + "32281": msg34168, + "32282": msg34169, + "32283": msg34170, + "32284": msg34171, + "32285": msg34172, + "32286": msg34173, + "32287": msg34174, + "32288": msg34175, + "32289": msg34176, + "3229": msg5679, + "32290": msg34177, + "32291": msg34178, + "32292": msg34179, + "32293": msg34180, + "32294": msg34181, + "32295": msg34182, + "32296": msg34183, + "32297": msg34184, + "32298": msg34185, + "32299": msg34186, + "323": select245, + "3230": msg5680, + "32300": msg34187, + "32301": msg34188, + "32302": msg34189, + "32303": msg34190, + "32304": msg34191, + "32305": msg34192, + "32306": msg34193, + "32307": msg34194, + "32308": msg34195, + "32309": msg34196, + "3231": msg5681, + "32310": msg34197, + "32311": msg34198, + "32312": msg34199, + "32313": msg34200, + "32314": msg34201, + "32315": msg34202, + "32316": msg34203, + "32319": msg34204, + "3232": msg5682, + "32320": msg34205, + "3233": msg5683, + "32334": msg34206, + "32335": msg34207, + "32336": msg34208, + "32337": msg34209, + "32338": msg34210, + "3234": msg5684, + "32342": msg34211, + "32343": msg34212, + "32344": msg34213, + "32345": msg34214, + "32346": msg34215, + "32347": msg34216, + "32348": msg34217, + "32349": msg34218, + "3235": msg5685, + "32350": msg34219, + "32351": msg34220, + "32352": msg34221, + "32353": msg34222, + "32354": msg34223, + "32355": msg34224, + "32356": msg34225, + "32357": msg34226, + "32358": msg34227, + "32359": msg34228, + "3236": msg5686, + "32360": msg34229, + "32361": msg34230, + "32362": msg34231, + "32363": msg34232, + "32364": msg34233, + "32365": msg34234, + "32366": msg34235, + "32367": msg34236, + "32368": msg34237, + "32369": msg34238, + "3237": msg5687, + "32370": msg34239, + "32371": msg34240, + "32372": msg34241, + "32373": msg34242, + "32374": msg34243, + "32375": msg34244, + "32376": msg34245, + "32377": msg34246, + "32378": msg34247, + "32379": msg34248, + "3238": msg5688, + "32380": msg34249, + "32381": msg34250, + "32382": msg34251, + "32383": msg34252, + "32384": msg34253, + "32385": msg34254, + "32386": msg34255, + "32387": msg34256, + "32388": msg34257, + "32389": msg34258, + "3239": msg5689, + "32390": msg34259, + "32391": msg34260, + "32392": msg34261, + "32393": msg34262, + "32394": msg34263, + "32395": msg34264, + "32396": msg34265, + "32397": msg34266, + "32398": msg34267, + "32399": msg34268, + "324": select246, + "3240": msg5690, + "32400": msg34269, + "32401": msg34270, + "32402": msg34271, + "32403": msg34272, + "32404": msg34273, + "32405": msg34274, + "32406": msg34275, + "32407": msg34276, + "32408": msg34277, + "32409": msg34278, + "3241": msg5691, + "32410": msg34279, + "32411": msg34280, + "32412": msg34281, + "32413": msg34282, + "32414": msg34283, + "32415": msg34284, + "32416": msg34285, + "32417": msg34286, + "32418": msg34287, + "32419": msg34288, + "3242": msg5692, + "32420": msg34289, + "32421": msg34290, + "32422": msg34291, + "32423": msg34292, + "32424": msg34293, + "32425": msg34294, + "32426": msg34295, + "32427": msg34296, + "32428": msg34297, + "32429": msg34298, + "3243": msg5693, + "32430": msg34299, + "32431": msg34300, + "32432": msg34301, + "32433": msg34302, + "32434": msg34303, + "32435": msg34304, + "32436": msg34305, + "32437": msg34306, + "32438": msg34307, + "32439": msg34308, + "3244": msg5694, + "32440": msg34309, + "32441": msg34310, + "32442": msg34311, + "32443": msg34312, + "32444": msg34313, + "32445": msg34314, + "32446": msg34315, + "32447": msg34316, + "32448": msg34317, + "32449": msg34318, + "3245": msg5695, + "32450": msg34319, + "32451": msg34320, + "32452": msg34321, + "32453": msg34322, + "32454": msg34323, + "32455": msg34324, + "32456": msg34325, + "32457": msg34326, + "32458": msg34327, + "32459": msg34328, + "3246": msg5696, + "32460": msg34329, + "32461": msg34330, + "32462": msg34331, + "32463": msg34332, + "32464": msg34333, + "32465": msg34334, + "32466": msg34335, + "32467": msg34336, + "32468": msg34337, + "32469": msg34338, + "3247": msg5697, + "32470": msg34339, + "32471": msg34340, + "32472": msg34341, + "32473": msg34342, + "32474": msg34343, + "32475": msg34344, + "32476": msg34345, + "32477": msg34346, + "32478": msg34347, + "32479": msg34348, + "3248": msg5698, + "32480": msg34349, + "32481": msg34350, + "32482": msg34351, + "32483": msg34352, + "32484": msg34353, + "32485": msg34354, + "32486": msg34355, + "32487": msg34356, + "32488": msg34357, + "32489": msg34358, + "3249": msg5699, + "32490": msg34359, + "32491": msg34360, + "32492": msg34361, + "32493": msg34362, + "32494": msg34363, + "32495": msg34364, + "32496": msg34365, + "32497": msg34366, + "32498": msg34367, + "32499": msg34368, + "325": select247, + "3250": msg5700, + "32500": msg34369, + "32501": msg34370, + "32502": msg34371, + "32503": msg34372, + "32504": msg34373, + "32505": msg34374, + "32506": msg34375, + "32507": msg34376, + "32508": msg34377, + "32509": msg34378, + "3251": msg5701, + "32510": msg34379, + "32511": msg34380, + "32512": msg34381, + "32513": msg34382, + "32514": msg34383, + "32515": msg34384, + "32516": msg34385, + "32517": msg34386, + "32518": msg34387, + "32519": msg34388, + "3252": msg5702, + "32520": msg34389, + "32521": msg34390, + "32522": msg34391, + "32523": msg34392, + "32524": msg34393, + "32525": msg34394, + "32526": msg34395, + "32527": msg34396, + "32528": msg34397, + "32529": msg34398, + "3253": msg5703, + "32530": msg34399, + "32531": msg34400, + "32532": msg34401, + "32533": msg34402, + "32534": msg34403, + "32535": msg34404, + "32536": msg34405, + "32537": msg34406, + "32538": msg34407, + "32539": msg34408, + "3254": msg5704, + "32540": msg34409, + "32541": msg34410, + "32542": msg34411, + "32543": msg34412, + "32544": msg34413, + "32545": msg34414, + "32546": msg34415, + "32547": msg34416, + "32548": msg34417, + "32549": msg34418, + "3255": msg5705, + "32550": msg34419, + "32551": msg34420, + "32552": msg34421, + "32553": msg34422, + "32554": msg34423, + "32555": msg34424, + "32556": msg34425, + "32557": msg34426, + "32558": msg34427, + "32559": msg34428, + "3256": msg5706, + "32560": msg34429, + "32561": msg34430, + "32562": msg34431, + "32563": msg34432, + "32564": msg34433, + "32565": msg34434, + "32566": msg34435, + "32567": msg34436, + "32568": msg34437, + "32569": msg34438, + "3257": msg5707, + "32570": msg34439, + "32571": msg34440, + "32572": msg34441, + "32573": msg34442, + "32574": msg34443, + "32575": msg34444, + "32576": msg34445, + "32577": msg34446, + "32578": msg34447, + "32579": msg34448, + "3258": msg5708, + "32580": msg34449, + "32581": msg34450, + "32582": msg34451, + "32583": msg34452, + "32584": msg34453, + "32585": msg34454, + "32586": msg34455, + "32587": msg34456, + "32588": msg34457, + "32589": msg34458, + "3259": msg5709, + "32590": msg34459, + "32591": msg34460, + "32592": msg34461, + "32593": msg34462, + "32594": msg34463, + "32595": msg34464, + "32596": msg34465, + "32597": msg34466, + "32598": msg34467, + "32599": msg34468, + "326": select248, + "3260": msg5710, + "32600": msg34469, + "32601": msg34470, + "32602": msg34471, + "32603": msg34472, + "32604": msg34473, + "32605": msg34474, + "32606": msg34475, + "32607": msg34476, + "32608": msg34477, + "32609": msg34478, + "3261": msg5711, + "32610": msg34479, + "32611": msg34480, + "32612": msg34481, + "32613": msg34482, + "32614": msg34483, + "32615": msg34484, + "32616": msg34485, + "32617": msg34486, + "32618": msg34487, + "32619": msg34488, + "3262": msg5712, + "32620": msg34489, + "32621": msg34490, + "32622": msg34491, + "32623": msg34492, + "32624": msg34493, + "32625": msg34494, + "32626": msg34495, + "32627": msg34496, + "32628": msg34497, + "32629": msg34498, + "3263": msg5713, + "32630": msg34499, + "32631": msg34500, + "32632": msg34501, + "32633": msg34502, + "32634": msg34503, + "32635": msg34504, + "32636": msg34505, + "32637": msg34506, + "32638": msg34507, + "32639": msg34508, + "3264": msg5714, + "32640": msg34509, + "32641": msg34510, + "32642": msg34511, + "32643": msg34512, + "32644": msg34513, + "32645": msg34514, + "32646": msg34515, + "32647": msg34516, + "32648": msg34517, + "32649": msg34518, + "3265": msg5715, + "32650": msg34519, + "32651": msg34520, + "32652": msg34521, + "32653": msg34522, + "32654": msg34523, + "32655": msg34524, + "32656": msg34525, + "32657": msg34526, + "32658": msg34527, + "32659": msg34528, + "3266": msg5716, + "32660": msg34529, + "32661": msg34530, + "32662": msg34531, + "32663": msg34532, + "32664": msg34533, + "32665": msg34534, + "32666": msg34535, + "32667": msg34536, + "32668": msg34537, + "32669": msg34538, + "3267": msg5717, + "32670": msg34539, + "32671": msg34540, + "32672": msg34541, + "32673": msg34542, + "32674": msg34543, + "32675": msg34544, + "32676": msg34545, + "32677": msg34546, + "32678": msg34547, + "32679": msg34548, + "3268": msg5718, + "32680": msg34549, + "32681": msg34550, + "32682": msg34551, + "32683": msg34552, + "32684": msg34553, + "32685": msg34554, + "32686": msg34555, + "32687": msg34556, + "32688": msg34557, + "32689": msg34558, + "3269": msg5719, + "32690": msg34559, + "32691": msg34560, + "32692": msg34561, + "32693": msg34562, + "32694": msg34563, + "32695": msg34564, + "32696": msg34565, + "32697": msg34566, + "32698": msg34567, + "32699": msg34568, + "327": select249, + "3270": msg5720, + "32700": msg34569, + "32701": msg34570, + "32702": msg34571, + "32703": msg34572, + "32704": msg34573, + "32705": msg34574, + "32706": msg34575, + "32707": msg34576, + "32708": msg34577, + "32709": msg34578, + "3271": msg5721, + "32710": msg34579, + "32711": msg34580, + "32712": msg34581, + "32713": msg34582, + "32714": msg34583, + "32715": msg34584, + "32716": msg34585, + "32717": msg34586, + "32718": msg34587, + "32719": msg34588, + "3272": msg5722, + "32720": msg34589, + "32721": msg34590, + "32722": msg34591, + "32723": msg34592, + "32724": msg34593, + "32725": msg34594, + "32726": msg34595, + "32727": msg34596, + "32728": msg34597, + "32729": msg34598, + "3273": msg5723, + "32730": msg34599, + "32731": msg34600, + "32732": msg34601, + "32733": msg34602, + "32734": msg34603, + "32735": msg34604, + "32736": msg34605, + "32737": msg34606, + "32738": msg34607, + "32739": msg34608, + "3274": msg5724, + "32740": msg34609, + "32741": msg34610, + "32742": msg34611, + "32743": msg34612, + "32744": msg34613, + "32745": msg34614, + "32746": msg34615, + "32747": msg34616, + "32748": msg34617, + "32749": msg34618, + "3275": msg5725, + "32750": msg34619, + "32751": msg34620, + "32752": msg34621, + "32753": msg34622, + "32754": msg34623, + "32755": msg34624, + "32756": msg34625, + "32757": msg34626, + "32758": msg34627, + "32759": msg34628, + "3276": msg5726, + "32760": msg34629, + "32761": msg34630, + "32762": msg34631, + "32763": msg34632, + "32764": msg34633, + "32765": msg34634, + "32766": msg34635, + "32767": msg34636, + "32768": msg34637, + "32769": msg34638, + "3277": msg5727, + "32770": msg34639, + "32771": msg34640, + "32772": msg34641, + "32773": msg34642, + "32774": msg34643, + "32775": msg34644, + "32776": msg34645, + "32777": msg34646, + "32778": msg34647, + "32779": msg34648, + "3278": msg5728, + "32780": msg34649, + "32781": msg34650, + "32782": msg34651, + "32783": msg34652, + "32784": msg34653, + "32785": msg34654, + "32786": msg34655, + "32787": msg34656, + "32788": msg34657, + "32789": msg34658, + "3279": msg5729, + "32790": msg34659, + "32791": msg34660, + "32792": msg34661, + "32793": msg34662, + "32794": msg34663, + "32795": msg34664, + "32796": msg34665, + "32797": msg34666, + "32798": msg34667, + "32799": msg34668, + "328": select250, + "3280": msg5730, + "32800": msg34669, + "32801": msg34670, + "32802": msg34671, + "32803": msg34672, + "32804": msg34673, + "32805": msg34674, + "32806": msg34675, + "32807": msg34676, + "32808": msg34677, + "32809": msg34678, + "3281": msg5731, + "32810": msg34679, + "32811": msg34680, + "32812": msg34681, + "32813": msg34682, + "32814": msg34683, + "32815": msg34684, + "32816": msg34685, + "32817": msg34686, + "32818": msg34687, + "32819": msg34688, + "3282": msg5732, + "32820": msg34689, + "32821": msg34690, + "32822": msg34691, + "32823": msg34692, + "32824": msg34693, + "32825": msg34694, + "32826": msg34695, + "32827": msg34696, + "32828": msg34697, + "32829": msg34698, + "3283": msg5733, + "32830": msg34699, + "32831": msg34700, + "32832": msg34701, + "32833": msg34702, + "32834": msg34703, + "32835": msg34704, + "32836": msg34705, + "32837": msg34706, + "32838": msg34707, + "32839": msg34708, + "3284": msg5734, + "32840": msg34709, + "32841": msg34710, + "32842": msg34711, + "32843": msg34712, + "32844": msg34713, + "32845": msg34714, + "32846": msg34715, + "32847": msg34716, + "32848": msg34717, + "32849": msg34718, + "3285": msg5735, + "32850": msg34719, + "32851": msg34720, + "32852": msg34721, + "32853": msg34722, + "32854": msg34723, + "32855": msg34724, + "32856": msg34725, + "32857": msg34726, + "32858": msg34727, + "32859": msg34728, + "3286": msg5736, + "32860": msg34729, + "32861": msg34730, + "32862": msg34731, + "32863": msg34732, + "32864": msg34733, + "32865": msg34734, + "32866": msg34735, + "32867": msg34736, + "32868": msg34737, + "32869": msg34738, + "3287": msg5737, + "32870": msg34739, + "32871": msg34740, + "32872": msg34741, + "32873": msg34742, + "32874": msg34743, + "32875": msg34744, + "32876": msg34745, + "32877": msg34746, + "32878": msg34747, + "32879": msg34748, + "3288": msg5738, + "32880": msg34749, + "32881": msg34750, + "32882": msg34751, + "32883": msg34752, + "32884": msg34753, + "32885": msg34754, + "32886": msg34755, + "32887": msg34756, + "32888": msg34757, + "32889": msg34758, + "3289": msg5739, + "32890": msg34759, + "32891": msg34760, + "32892": msg34761, + "32893": msg34762, + "32894": msg34763, + "32895": msg34764, + "32896": msg34765, + "32897": msg34766, + "32898": msg34767, + "32899": msg34768, + "329": select251, + "3290": msg5740, + "32900": msg34769, + "32901": msg34770, + "32902": msg34771, + "32903": msg34772, + "32904": msg34773, + "32905": msg34774, + "32906": msg34775, + "32907": msg34776, + "32908": msg34777, + "32909": msg34778, + "3291": msg5741, + "32910": msg34779, + "32911": msg34780, + "32912": msg34781, + "32913": msg34782, + "32914": msg34783, + "32915": msg34784, + "32916": msg34785, + "32917": msg34786, + "32918": msg34787, + "32919": msg34788, + "3292": msg5742, + "32920": msg34789, + "32921": msg34790, + "32922": msg34791, + "32923": msg34792, + "32924": msg34793, + "32925": msg34794, + "32926": msg34795, + "32927": msg34796, + "32928": msg34797, + "32929": msg34798, + "3293": msg5743, + "32930": msg34799, + "32931": msg34800, + "32932": msg34801, + "32933": msg34802, + "32934": msg34803, + "32935": msg34804, + "32936": msg34805, + "32937": msg34806, + "32938": msg34807, + "32939": msg34808, + "3294": msg5744, + "32940": msg34809, + "32941": msg34810, + "32942": msg34811, + "32943": msg34812, + "32944": msg34813, + "32945": msg34814, + "32946": msg34815, + "32947": msg34816, + "32948": msg34817, + "32949": msg34818, + "3295": msg5745, + "32950": msg34819, + "32951": msg34820, + "32952": msg34821, + "32953": msg34822, + "32954": msg34823, + "32955": msg34824, + "32956": msg34825, + "32957": msg34826, + "32958": msg34827, + "32959": msg34828, + "3296": msg5746, + "32960": msg34829, + "32961": msg34830, + "32962": msg34831, + "32963": msg34832, + "32964": msg34833, + "32965": msg34834, + "32966": msg34835, + "32967": msg34836, + "32968": msg34837, + "32969": msg34838, + "3297": msg5747, + "32970": msg34839, + "32971": msg34840, + "32972": msg34841, + "32973": msg34842, + "32974": msg34843, + "32975": msg34844, + "32976": msg34845, + "32977": msg34846, + "32978": msg34847, + "32979": msg34848, + "3298": msg5748, + "32980": msg34849, + "32981": msg34850, + "32982": msg34851, + "32983": msg34852, + "32984": msg34853, + "32985": msg34854, + "32986": msg34855, + "32987": msg34856, + "32988": msg34857, + "32989": msg34858, + "3299": msg5749, + "32990": msg34859, + "32991": msg34860, + "32992": msg34861, + "32993": msg34862, + "32994": msg34863, + "32995": msg34864, + "32996": msg34865, + "32997": msg34866, + "32998": msg34867, + "32999": msg34868, + "330": select252, + "3300": msg5750, + "33000": msg34869, + "33001": msg34870, + "33002": msg34871, + "33003": msg34872, + "33004": msg34873, + "33005": msg34874, + "33006": msg34875, + "33007": msg34876, + "33008": msg34877, + "33009": msg34878, + "3301": msg5751, + "33010": msg34879, + "33011": msg34880, + "33012": msg34881, + "33013": msg34882, + "33014": msg34883, + "33015": msg34884, + "33016": msg34885, + "33017": msg34886, + "33018": msg34887, + "33019": msg34888, + "3302": msg5752, + "33020": msg34889, + "33021": msg34890, + "33022": msg34891, + "33023": msg34892, + "33024": msg34893, + "33025": msg34894, + "33026": msg34895, + "33027": msg34896, + "33028": msg34897, + "33029": msg34898, + "3303": msg5753, + "33030": msg34899, + "33031": msg34900, + "33032": msg34901, + "33033": msg34902, + "33034": msg34903, + "33035": msg34904, + "33036": msg34905, + "33037": msg34906, + "33038": msg34907, + "33039": msg34908, + "3304": msg5754, + "33040": msg34909, + "33041": msg34910, + "33042": msg34911, + "33043": msg34912, + "33044": msg34913, + "33045": msg34914, + "33046": msg34915, + "33047": msg34916, + "33048": msg34917, + "33049": msg34918, + "3305": msg5755, + "33050": msg34919, + "33051": msg34920, + "33052": msg34921, + "33053": msg34922, + "33054": msg34923, + "33055": msg34924, + "33056": msg34925, + "33057": msg34926, + "33058": msg34927, + "33059": msg34928, + "3306": msg5756, + "33060": msg34929, + "33061": msg34930, + "33062": msg34931, + "33063": msg34932, + "33064": msg34933, + "33065": msg34934, + "33066": msg34935, + "33067": msg34936, + "33068": msg34937, + "33069": msg34938, + "3307": msg5757, + "33070": msg34939, + "33071": msg34940, + "33072": msg34941, + "33073": msg34942, + "33074": msg34943, + "33075": msg34944, + "33076": msg34945, + "33077": msg34946, + "33078": msg34947, + "33079": msg34948, + "3308": msg5758, + "33080": msg34949, + "33081": msg34950, + "33082": msg34951, + "33083": msg34952, + "33084": msg34953, + "33085": msg34954, + "33086": msg34955, + "33087": msg34956, + "33088": msg34957, + "33089": msg34958, + "3309": msg5759, + "33090": msg34959, + "33091": msg34960, + "33092": msg34961, + "33093": msg34962, + "33094": msg34963, + "33095": msg34964, + "33096": msg34965, + "33097": msg34966, + "33098": msg34967, + "33099": msg34968, + "331": select253, + "3310": msg5760, + "33100": msg34969, + "33101": msg34970, + "33102": msg34971, + "33103": msg34972, + "33104": msg34973, + "33105": msg34974, + "33106": msg34975, + "33107": msg34976, + "33108": msg34977, + "33109": msg34978, + "3311": msg5761, + "33110": msg34979, + "33111": msg34980, + "33112": msg34981, + "33113": msg34982, + "33114": msg34983, + "33115": msg34984, + "33116": msg34985, + "33117": msg34986, + "33118": msg34987, + "33119": msg34988, + "3312": msg5762, + "33120": msg34989, + "33121": msg34990, + "33122": msg34991, + "33123": msg34992, + "33124": msg34993, + "33125": msg34994, + "33126": msg34995, + "33127": msg34996, + "33128": msg34997, + "33129": msg34998, + "3313": msg5763, + "33130": msg34999, + "33131": msg35000, + "33132": msg35001, + "33133": msg35002, + "33134": msg35003, + "33135": msg35004, + "33136": msg35005, + "33137": msg35006, + "33138": msg35007, + "33139": msg35008, + "3314": msg5764, + "33140": msg35009, + "33141": msg35010, + "33142": msg35011, + "33143": msg35012, + "33144": msg35013, + "33145": msg35014, + "33146": msg35015, + "33147": msg35016, + "33148": msg35017, + "33149": msg35018, + "3315": msg5765, + "33150": msg35019, + "33151": msg35020, + "33152": msg35021, + "33153": msg35022, + "33154": msg35023, + "33155": msg35024, + "33156": msg35025, + "33157": msg35026, + "33158": msg35027, + "33159": msg35028, + "3316": msg5766, + "33160": msg35029, + "33161": msg35030, + "33162": msg35031, + "33163": msg35032, + "33164": msg35033, + "33165": msg35034, + "33166": msg35035, + "33167": msg35036, + "33168": msg35037, + "33169": msg35038, + "3317": msg5767, + "33170": msg35039, + "33171": msg35040, + "33172": msg35041, + "33173": msg35042, + "33174": msg35043, + "33175": msg35044, + "33176": msg35045, + "33177": msg35046, + "33178": msg35047, + "33179": msg35048, + "3318": msg5768, + "33180": msg35049, + "33181": msg35050, + "33182": msg35051, + "33183": msg35052, + "33184": msg35053, + "33185": msg35054, + "33186": msg35055, + "33187": msg35056, + "33188": msg35057, + "33189": msg35058, + "3319": msg5769, + "33190": msg35059, + "33191": msg35060, + "33192": msg35061, + "33193": msg35062, + "33194": msg35063, + "33195": msg35064, + "33196": msg35065, + "33197": msg35066, + "33198": msg35067, + "33199": msg35068, + "332": select254, + "3320": msg5770, + "33200": msg35069, + "33201": msg35070, + "33202": msg35071, + "33203": msg35072, + "33204": msg35073, + "33205": msg35074, + "33206": msg35075, + "33207": msg35076, + "33208": msg35077, + "33209": msg35078, + "3321": msg5771, + "33210": msg35079, + "33211": msg35080, + "33212": msg35081, + "33213": msg35082, + "33214": msg35083, + "33215": msg35084, + "33216": msg35085, + "33217": msg35086, + "33218": msg35087, + "33219": msg35088, + "3322": msg5772, + "33220": msg35089, + "33221": msg35090, + "33222": msg35091, + "33223": msg35092, + "33224": msg35093, + "33225": msg35094, + "33226": msg35095, + "33227": msg35096, + "33228": msg35097, + "33229": msg35098, + "3323": msg5773, + "33230": msg35099, + "33231": msg35100, + "33232": msg35101, + "33233": msg35102, + "33234": msg35103, + "33235": msg35104, + "33236": msg35105, + "33237": msg35106, + "33238": msg35107, + "33239": msg35108, + "3324": msg5774, + "33240": msg35109, + "33241": msg35110, + "33242": msg35111, + "33243": msg35112, + "33244": msg35113, + "33245": msg35114, + "33246": msg35115, + "33247": msg35116, + "33248": msg35117, + "33249": msg35118, + "3325": msg5775, + "33250": msg35119, + "33251": msg35120, + "33252": msg35121, + "33253": msg35122, + "33254": msg35123, + "33255": msg35124, + "33256": msg35125, + "33257": msg35126, + "33258": msg35127, + "33259": msg35128, + "3326": msg5776, + "33260": msg35129, + "33261": msg35130, + "33262": msg35131, + "33263": msg35132, + "33264": msg35133, + "33265": msg35134, + "33266": msg35135, + "33267": msg35136, + "33268": msg35137, + "33269": msg35138, + "3327": msg5777, + "33270": msg35139, + "33271": msg35140, + "33272": msg35141, + "33273": msg35142, + "33274": msg35143, + "33275": msg35144, + "33276": msg35145, + "33277": msg35146, + "33278": msg35147, + "33279": msg35148, + "3328": msg5778, + "33280": msg35149, + "33281": msg35150, + "33282": msg35151, + "33283": msg35152, + "33284": msg35153, + "33285": msg35154, + "33286": msg35155, + "33287": msg35156, + "33288": msg35157, + "33289": msg35158, + "3329": msg5779, + "33290": msg35159, + "33291": msg35160, + "33292": msg35161, + "33293": msg35162, + "33294": msg35163, + "33295": msg35164, + "33296": msg35165, + "33297": msg35166, + "33298": msg35167, + "33299": msg35168, + "333": select255, + "3330": msg5780, + "33300": msg35169, + "33301": msg35170, + "33302": msg35171, + "33303": msg35172, + "33304": msg35173, + "33305": msg35174, + "33306": msg35175, + "33307": msg35176, + "33308": msg35177, + "33309": msg35178, + "3331": msg5781, + "33310": msg35179, + "33311": msg35180, + "33312": msg35181, + "33313": msg35182, + "33314": msg35183, + "33315": msg35184, + "33316": msg35185, + "33317": msg35186, + "33318": msg35187, + "33319": msg35188, + "3332": msg5782, + "33320": msg35189, + "33321": msg35190, + "33322": msg35191, + "33323": msg35192, + "33324": msg35193, + "33325": msg35194, + "33326": msg35195, + "33327": msg35196, + "33328": msg35197, + "33329": msg35198, + "3333": msg5783, + "33330": msg35199, + "33331": msg35200, + "33332": msg35201, + "33333": msg35202, + "33334": msg35203, + "33335": msg35204, + "33336": msg35205, + "33337": msg35206, + "33338": msg35207, + "33339": msg35208, + "3334": msg5784, + "33340": msg35209, + "33341": msg35210, + "33342": msg35211, + "33343": msg35212, + "33344": msg35213, + "33345": msg35214, + "33346": msg35215, + "33347": msg35216, + "33348": msg35217, + "33349": msg35218, + "3335": msg5785, + "33350": msg35219, + "33351": msg35220, + "33352": msg35221, + "33353": msg35222, + "33354": msg35223, + "33355": msg35224, + "33356": msg35225, + "33357": msg35226, + "33358": msg35227, + "33359": msg35228, + "3336": msg5786, + "33360": msg35229, + "33361": msg35230, + "33362": msg35231, + "33363": msg35232, + "33364": msg35233, + "33365": msg35234, + "33366": msg35235, + "33367": msg35236, + "33368": msg35237, + "33369": msg35238, + "3337": msg5787, + "33370": msg35239, + "33371": msg35240, + "33372": msg35241, + "33373": msg35242, + "33374": msg35243, + "33375": msg35244, + "33376": msg35245, + "33377": msg35246, + "33378": msg35247, + "33379": msg35248, + "3338": msg5788, + "33380": msg35249, + "33381": msg35250, + "33382": msg35251, + "33383": msg35252, + "33384": msg35253, + "33385": msg35254, + "33386": msg35255, + "33387": msg35256, + "33388": msg35257, + "33389": msg35258, + "3339": msg5789, + "33390": msg35259, + "33391": msg35260, + "33392": msg35261, + "33393": msg35262, + "33394": msg35263, + "33395": msg35264, + "33396": msg35265, + "33397": msg35266, + "33398": msg35267, + "33399": msg35268, + "334": select256, + "3340": msg5790, + "33400": msg35269, + "33401": msg35270, + "33402": msg35271, + "33403": msg35272, + "33404": msg35273, + "33405": msg35274, + "33406": msg35275, + "33407": msg35276, + "33408": msg35277, + "33409": msg35278, + "3341": msg5791, + "33410": msg35279, + "33411": msg35280, + "33412": msg35281, + "33413": msg35282, + "33414": msg35283, + "33415": msg35284, + "33416": msg35285, + "33417": msg35286, + "33418": msg35287, + "33419": msg35288, + "3342": msg5792, + "33420": msg35289, + "33421": msg35290, + "33422": msg35291, + "33423": msg35292, + "33424": msg35293, + "33425": msg35294, + "33426": msg35295, + "33427": msg35296, + "33428": msg35297, + "33429": msg35298, + "3343": msg5793, + "33430": msg35299, + "33431": msg35300, + "33432": msg35301, + "33433": msg35302, + "33434": msg35303, + "33435": msg35304, + "33436": msg35305, + "33437": msg35306, + "33438": msg35307, + "33439": msg35308, + "3344": msg5794, + "33440": msg35309, + "33441": msg35310, + "33442": msg35311, + "33443": msg35312, + "33444": msg35313, + "33445": msg35314, + "33446": msg35315, + "33447": msg35316, + "33448": msg35317, + "33449": msg35318, + "3345": msg5795, + "33450": msg35319, + "33451": msg35320, + "33452": msg35321, + "33453": msg35322, + "33454": msg35323, + "33455": msg35324, + "33456": msg35325, + "33457": msg35326, + "33458": msg35327, + "33459": msg35328, + "3346": msg5796, + "33460": msg35329, + "33461": msg35330, + "33462": msg35331, + "33463": msg35332, + "33464": msg35333, + "33465": msg35334, + "33466": msg35335, + "33467": msg35336, + "33468": msg35337, + "33469": msg35338, + "3347": msg5797, + "33470": msg35339, + "33471": msg35340, + "33472": msg35341, + "33473": msg35342, + "33474": msg35343, + "33475": msg35344, + "33476": msg35345, + "33477": msg35346, + "33478": msg35347, + "3348": msg5798, + "3349": msg5799, + "335": select257, + "3350": msg5800, + "3351": msg5801, + "3352": msg5802, + "3353": msg5803, + "3354": msg5804, + "3355": msg5805, + "3356": msg5806, + "33564": msg35348, + "33565": msg35349, + "33566": msg35350, + "33567": msg35351, + "33568": msg35352, + "33569": msg35353, + "3357": msg5807, + "33570": msg35354, + "33571": msg35355, + "33572": msg35356, + "33573": msg35357, + "33574": msg35358, + "33575": msg35359, + "33576": msg35360, + "33577": msg35361, + "33578": msg35362, + "33579": msg35363, + "3358": msg5808, + "33580": msg35364, + "33581": msg35365, + "33582": msg35366, + "33583": msg35367, + "33584": msg35368, + "33585": msg35369, + "33586": msg35370, + "33587": msg35371, + "33588": msg35372, + "33589": msg35373, + "3359": msg5809, + "33590": msg35374, + "33591": msg35375, + "33592": msg35376, + "33593": msg35377, + "33594": msg35378, + "33595": msg35379, + "33596": msg35380, + "33597": msg35381, + "33598": msg35382, + "33599": msg35383, + "336": select258, + "3360": msg5810, + "33600": msg35384, + "33601": msg35385, + "33602": msg35386, + "33603": msg35387, + "33604": msg35388, + "33605": msg35389, + "33606": msg35390, + "33607": msg35391, + "33608": msg35392, + "33609": msg35393, + "3361": msg5811, + "33610": msg35394, + "33611": msg35395, + "33612": msg35396, + "33613": msg35397, + "33614": msg35398, + "33615": msg35399, + "33618": msg35400, + "33619": msg35401, + "3362": msg5812, + "33620": msg35402, + "33621": msg35403, + "33622": msg35404, + "33623": msg35405, + "33624": msg35406, + "33625": msg35407, + "33626": msg35408, + "33627": msg35409, + "33628": msg35410, + "33629": msg35411, + "3363": msg5813, + "33630": msg35412, + "33631": msg35413, + "33632": msg35414, + "33633": msg35415, + "33634": msg35416, + "33635": msg35417, + "33636": msg35418, + "33637": msg35419, + "33638": msg35420, + "33639": msg35421, + "3364": msg5814, + "33640": msg35422, + "33641": msg35423, + "33642": msg35424, + "33643": msg35425, + "33644": msg35426, + "33645": msg35427, + "33646": msg35428, + "33647": msg35429, + "33648": msg35430, + "33649": msg35431, + "3365": msg5815, + "33650": msg35432, + "33651": msg35433, + "33652": msg35434, + "33653": msg35435, + "33654": msg35436, + "33655": msg35437, + "33656": msg35438, + "33657": msg35439, + "33658": msg35440, + "33659": msg35441, + "3366": msg5816, + "33660": msg35442, + "33661": msg35443, + "33662": msg35444, + "33663": msg35445, + "33664": msg35446, + "33665": msg35447, + "33666": msg35448, + "33667": msg35449, + "33668": msg35450, + "33669": msg35451, + "3367": msg5817, + "33670": msg35452, + "33671": msg35453, + "33672": msg35454, + "33673": msg35455, + "33674": msg35456, + "33675": msg35457, + "33676": msg35458, + "33677": msg35459, + "33678": msg35460, + "33679": msg35461, + "3368": msg5818, + "33680": msg35462, + "33681": msg35463, + "33682": msg35464, + "33683": msg35465, + "33684": msg35466, + "33685": msg35467, + "33686": msg35468, + "33687": msg35469, + "33688": msg35470, + "33689": msg35471, + "3369": msg5819, + "33690": msg35472, + "33691": msg35473, + "33692": msg35474, + "33693": msg35475, + "33694": msg35476, + "33695": msg35477, + "33696": msg35478, + "33697": msg35479, + "33698": msg35480, + "33699": msg35481, + "337": select259, + "3370": msg5820, + "33700": msg35482, + "33701": msg35483, + "33702": msg35484, + "33703": msg35485, + "33704": msg35486, + "33705": msg35487, + "33706": msg35488, + "33707": msg35489, + "33708": msg35490, + "33709": msg35491, + "3371": msg5821, + "33710": msg35492, + "33711": msg35493, + "33712": msg35494, + "33713": msg35495, + "33714": msg35496, + "33715": msg35497, + "33716": msg35498, + "33717": msg35499, + "33718": msg35500, + "33719": msg35501, + "3372": msg5822, + "33720": msg35502, + "33721": msg35503, + "33722": msg35504, + "33723": msg35505, + "33724": msg35506, + "33725": msg35507, + "33726": msg35508, + "33727": msg35509, + "33728": msg35510, + "33729": msg35511, + "3373": msg5823, + "33730": msg35512, + "33731": msg35513, + "33732": msg35514, + "33733": msg35515, + "33734": msg35516, + "33735": msg35517, + "33736": msg35518, + "33737": msg35519, + "33738": msg35520, + "33739": msg35521, + "3374": msg5824, + "33740": msg35522, + "33741": msg35523, + "33742": msg35524, + "33743": msg35525, + "33744": msg35526, + "33745": msg35527, + "33746": msg35528, + "33747": msg35529, + "33748": msg35530, + "33749": msg35531, + "3375": msg5825, + "33750": msg35532, + "33751": msg35533, + "33752": msg35534, + "33753": msg35535, + "33754": msg35536, + "33755": msg35537, + "33756": msg35538, + "33757": msg35539, + "33758": msg35540, + "33759": msg35541, + "3376": msg5826, + "33760": msg35542, + "33761": msg35543, + "33762": msg35544, + "33763": msg35545, + "33764": msg35546, + "33765": msg35547, + "33766": msg35548, + "33767": msg35549, + "33768": msg35550, + "33769": msg35551, + "3377": msg5827, + "33770": msg35552, + "33771": msg35553, + "33772": msg35554, + "33773": msg35555, + "33774": msg35556, + "33775": msg35557, + "33776": msg35558, + "33777": msg35559, + "33778": msg35560, + "33779": msg35561, + "3378": msg5828, + "33780": msg35562, + "33781": msg35563, + "33782": msg35564, + "33783": msg35565, + "33784": msg35566, + "33785": msg35567, + "33786": msg35568, + "33787": msg35569, + "33788": msg35570, + "33789": msg35571, + "3379": msg5829, + "33790": msg35572, + "33791": msg35573, + "33792": msg35574, + "33793": msg35575, + "33794": msg35576, + "33795": msg35577, + "33796": msg35578, + "33797": msg35579, + "33798": msg35580, + "33799": msg35581, + "338": select260, + "3380": msg5830, + "33800": msg35582, + "33801": msg35583, + "33802": msg35584, + "33803": msg35585, + "33804": msg35586, + "33805": msg35587, + "33806": msg35588, + "33807": msg35589, + "33808": msg35590, + "33809": msg35591, + "3381": msg5831, + "33810": msg35592, + "33811": msg35593, + "33812": msg35594, + "33813": msg35595, + "33814": msg35596, + "33815": msg35597, + "33816": msg35598, + "33817": msg35599, + "33818": msg35600, + "33819": msg35601, + "3382": msg5832, + "33820": msg35602, + "33821": msg35603, + "33822": msg35604, + "33823": msg35605, + "33824": msg35606, + "33825": msg35607, + "33826": msg35608, + "33827": msg35609, + "33828": msg35610, + "33829": msg35611, + "3383": msg5833, + "33830": msg35612, + "33831": msg35613, + "33832": msg35614, + "33833": msg35615, + "33834": msg35616, + "33835": msg35617, + "33836": msg35618, + "33837": msg35619, + "33838": msg35620, + "33839": msg35621, + "3384": msg5834, + "33840": msg35622, + "33841": msg35623, + "33842": msg35624, + "33843": msg35625, + "33844": msg35626, + "33845": msg35627, + "33846": msg35628, + "33847": msg35629, + "33848": msg35630, + "33849": msg35631, + "3385": msg5835, + "33850": msg35632, + "33851": msg35633, + "33852": msg35634, + "33853": msg35635, + "33854": msg35636, + "33855": msg35637, + "33856": msg35638, + "33857": msg35639, + "33858": msg35640, + "33859": msg35641, + "3386": msg5836, + "33860": msg35642, + "33861": msg35643, + "33862": msg35644, + "33863": msg35645, + "33864": msg35646, + "33865": msg35647, + "33866": msg35648, + "33867": msg35649, + "33868": msg35650, + "33869": msg35651, + "3387": msg5837, + "33870": msg35652, + "33871": msg35653, + "33872": msg35654, + "33873": msg35655, + "33874": msg35656, + "33875": msg35657, + "33876": msg35658, + "33877": msg35659, + "33878": msg35660, + "33879": msg35661, + "3388": msg5838, + "33880": msg35662, + "33881": msg35663, + "33882": msg35664, + "33883": msg35665, + "33884": msg35666, + "33885": msg35667, + "33886": msg35668, + "33887": msg35669, + "33888": msg35670, + "33889": msg35671, + "3389": msg5839, + "33890": msg35672, + "33891": msg35673, + "33892": msg35674, + "33893": msg35675, + "33894": msg35676, + "33895": msg35677, + "33896": msg35678, + "33897": msg35679, + "33898": msg35680, + "33899": msg35681, + "339": select261, + "3390": msg5840, + "33900": msg35682, + "33901": msg35683, + "33902": msg35684, + "33903": msg35685, + "33904": msg35686, + "33905": msg35687, + "33906": msg35688, + "33907": msg35689, + "33908": msg35690, + "33909": msg35691, + "3391": msg5841, + "33910": msg35692, + "33911": msg35693, + "33912": msg35694, + "33913": msg35695, + "33914": msg35696, + "33915": msg35697, + "33916": msg35698, + "33917": msg35699, + "33918": msg35700, + "33919": msg35701, + "3392": msg5842, + "33920": msg35702, + "33921": msg35703, + "33922": msg35704, + "33923": msg35705, + "33924": msg35706, + "33925": msg35707, + "33926": msg35708, + "33927": msg35709, + "33928": msg35710, + "33929": msg35711, + "3393": msg5843, + "33930": msg35712, + "33931": msg35713, + "33932": msg35714, + "33933": msg35715, + "33934": msg35716, + "33935": msg35717, + "33936": msg35718, + "33937": msg35719, + "33938": msg35720, + "33939": msg35721, + "3394": msg5844, + "33940": msg35722, + "33941": msg35723, + "33942": msg35724, + "33943": msg35725, + "33944": msg35726, + "33945": msg35727, + "33946": msg35728, + "33947": msg35729, + "33948": msg35730, + "33949": msg35731, + "3395": msg5845, + "33950": msg35732, + "33951": msg35733, + "33952": msg35734, + "33953": msg35735, + "33954": msg35736, + "33955": msg35737, + "33956": msg35738, + "33957": msg35739, + "33958": msg35740, + "33959": msg35741, + "3396": msg5846, + "33960": msg35742, + "33961": msg35743, + "33962": msg35744, + "33963": msg35745, + "33964": msg35746, + "33965": msg35747, + "33966": msg35748, + "33967": msg35749, + "33968": msg35750, + "33969": msg35751, + "3397": msg5847, + "33970": msg35752, + "33971": msg35753, + "33972": msg35754, + "33973": msg35755, + "33974": msg35756, + "33975": msg35757, + "33976": msg35758, + "33977": msg35759, + "33978": msg35760, + "33979": msg35761, + "3398": msg5848, + "33980": msg35762, + "33981": msg35763, + "33982": msg35764, + "33983": msg35765, + "33984": msg35766, + "33985": msg35767, + "33986": msg35768, + "33987": msg35769, + "33988": msg35770, + "33989": msg35771, + "3399": msg5849, + "33990": msg35772, + "33991": msg35773, + "33992": msg35774, + "33993": msg35775, + "33994": msg35776, + "33995": msg35777, + "33996": msg35778, + "33997": msg35779, + "33998": msg35780, + "33999": msg35781, + "34": msg65, + "340": select262, + "3400": msg5850, + "34000": msg35782, + "34001": msg35783, + "34002": msg35784, + "34003": msg35785, + "34004": msg35786, + "34005": msg35787, + "34006": msg35788, + "34007": msg35789, + "34008": msg35790, + "34009": msg35791, + "3401": msg5851, + "34010": msg35792, + "34011": msg35793, + "34012": msg35794, + "34013": msg35795, + "34014": msg35796, + "34015": msg35797, + "34016": msg35798, + "34017": msg35799, + "34018": msg35800, + "34019": msg35801, + "3402": msg5852, + "34020": msg35802, + "34021": msg35803, + "34022": msg35804, + "34023": msg35805, + "34024": msg35806, + "34025": msg35807, + "34026": msg35808, + "34027": msg35809, + "34028": msg35810, + "34029": msg35811, + "3403": msg5853, + "34030": msg35812, + "34031": msg35813, + "34032": msg35814, + "34033": msg35815, + "34034": msg35816, + "34035": msg35817, + "34036": msg35818, + "34037": msg35819, + "34038": msg35820, + "34039": msg35821, + "3404": msg5854, + "34040": msg35822, + "34041": msg35823, + "34042": msg35824, + "3404269": msg38426, + "3404272": msg38427, + "34043": msg35825, + "34044": msg35826, + "34045": msg35827, + "34046": msg35828, + "34047": msg35829, + "34048": msg35830, + "34049": msg35831, + "3405": msg5855, + "34050": msg35832, + "34051": msg35833, + "34052": msg35834, + "34053": msg35835, + "34054": msg35836, + "34055": msg35837, + "34056": msg35838, + "34057": msg35839, + "34058": msg35840, + "34059": msg35841, + "3406": msg5856, + "34060": msg35842, + "34061": msg35843, + "34062": msg35844, + "34063": msg35845, + "34064": msg35846, + "34065": msg35847, + "34066": msg35848, + "34067": msg35849, + "34068": msg35850, + "34069": msg35851, + "3407": msg5857, + "34070": msg35852, + "34071": msg35853, + "34072": msg35854, + "34073": msg35855, + "34074": msg35856, + "34075": msg35857, + "34076": msg35858, + "34077": msg35859, + "34078": msg35860, + "34079": msg35861, + "3408": msg5858, + "34080": msg35862, + "34081": msg35863, + "34082": msg35864, + "34083": msg35865, + "34084": msg35866, + "34085": msg35867, + "34086": msg35868, + "34087": msg35869, + "34088": msg35870, + "34089": msg35871, + "3409": msg5859, + "34090": msg35872, + "34091": msg35873, + "34092": msg35874, + "34093": msg35875, + "34094": msg35876, + "34095": msg35877, + "34096": msg35878, + "34097": msg35879, + "34098": msg35880, + "34099": msg35881, + "341": select263, + "3410": msg5860, + "34100": msg35882, + "34101": msg35883, + "34102": msg35884, + "34103": msg35885, + "34104": msg35886, + "34105": msg35887, + "34106": msg35888, + "34107": msg35889, + "34108": msg35890, + "34109": msg35891, + "3411": msg5861, + "34110": msg35892, + "34111": msg35893, + "34112": msg35894, + "34113": msg35895, + "34114": msg35896, + "34115": msg35897, + "34116": msg35898, + "34117": msg35899, + "34118": msg35900, + "34119": msg35901, + "3412": msg5862, + "34120": msg35902, + "34121": msg35903, + "34122": msg35904, + "34123": msg35905, + "34124": msg35906, + "34125": msg35907, + "34126": msg35908, + "34127": msg35909, + "34128": msg35910, + "34129": msg35911, + "3413": msg5863, + "34130": msg35912, + "34131": msg35913, + "34132": msg35914, + "34133": msg35915, + "34134": msg35916, + "34135": msg35917, + "34136": msg35918, + "34137": msg35919, + "34138": msg35920, + "34139": msg35921, + "3414": msg5864, + "34140": msg35922, + "34141": msg35923, + "34142": msg35924, + "34143": msg35925, + "34144": msg35926, + "34145": msg35927, + "34146": msg35928, + "34147": msg35929, + "34148": msg35930, + "34149": msg35931, + "3415": msg5865, + "34150": msg35932, + "34151": msg35933, + "34152": msg35934, + "34153": msg35935, + "34154": msg35936, + "34155": msg35937, + "34156": msg35938, + "34157": msg35939, + "34158": msg35940, + "34159": msg35941, + "3416": msg5866, + "34160": msg35942, + "34161": msg35943, + "34162": msg35944, + "34163": msg35945, + "34164": msg35946, + "34165": msg35947, + "34166": msg35948, + "34167": msg35949, + "34168": msg35950, + "34169": msg35951, + "3417": msg5867, + "34170": msg35952, + "34171": msg35953, + "34172": msg35954, + "34173": msg35955, + "34174": msg35956, + "34175": msg35957, + "34176": msg35958, + "34177": msg35959, + "34178": msg35960, + "34179": msg35961, + "3418": msg5868, + "34180": msg35962, + "34181": msg35963, + "34182": msg35964, + "34183": msg35965, + "34184": msg35966, + "34185": msg35967, + "34186": msg35968, + "34187": msg35969, + "34188": msg35970, + "34189": msg35971, + "3419": msg5869, + "34190": msg35972, + "34191": msg35973, + "34192": msg35974, + "34193": msg35975, + "34194": msg35976, + "34195": msg35977, + "34196": msg35978, + "34197": msg35979, + "34198": msg35980, + "34199": msg35981, + "342": select264, + "3420": msg5870, + "34200": msg35982, + "34201": msg35983, + "34202": msg35984, + "34203": msg35985, + "34204": msg35986, + "34205": msg35987, + "34206": msg35988, + "34207": msg35989, + "34208": msg35990, + "34209": msg35991, + "3421": msg5871, + "34210": msg35992, + "34211": msg35993, + "34212": msg35994, + "34213": msg35995, + "34214": msg35996, + "34215": msg35997, + "34216": msg35998, + "34217": msg35999, + "34218": msg36000, + "34219": msg36001, + "3422": msg5872, + "34220": msg36002, + "34221": msg36003, + "34222": msg36004, + "34223": msg36005, + "34224": msg36006, + "34225": msg36007, + "34226": msg36008, + "34227": msg36009, + "34228": msg36010, + "34229": msg36011, + "3423": msg5873, + "34230": msg36012, + "34231": msg36013, + "34232": msg36014, + "34233": msg36015, + "34234": msg36016, + "34235": msg36017, + "34236": msg36018, + "34237": msg36019, + "34238": msg36020, + "34239": msg36021, + "3424": msg5874, + "34240": msg36022, + "34241": msg36023, + "34242": msg36024, + "34243": msg36025, + "34244": msg36026, + "34245": msg36027, + "34246": msg36028, + "34247": msg36029, + "34248": msg36030, + "34249": msg36031, + "3425": msg5875, + "34250": msg36032, + "34251": msg36033, + "34252": msg36034, + "34253": msg36035, + "34254": msg36036, + "34255": msg36037, + "34256": msg36038, + "34257": msg36039, + "34258": msg36040, + "34259": msg36041, + "3426": msg5876, + "34260": msg36042, + "34261": msg36043, + "34262": msg36044, + "34263": msg36045, + "34264": msg36046, + "34265": msg36047, + "34266": msg36048, + "34267": msg36049, + "34268": msg36050, + "34269": msg36051, + "3427": msg5877, + "34270": msg36052, + "34271": msg36053, + "34272": msg36054, + "34273": msg36055, + "34274": msg36056, + "34275": msg36057, + "34276": msg36058, + "34277": msg36059, + "34278": msg36060, + "34279": msg36061, + "3428": msg5878, + "34280": msg36062, + "34281": msg36063, + "34282": msg36064, + "34283": msg36065, + "34284": msg36066, + "34285": msg36067, + "34286": msg36068, + "34287": msg36069, + "34288": msg36070, + "34289": msg36071, + "3429": msg5879, + "34290": msg36072, + "34291": msg36073, + "34292": msg36074, + "34293": msg36075, + "34294": msg36076, + "34295": msg36077, + "34296": msg36078, + "34297": msg36079, + "34298": msg36080, + "34299": msg36081, + "343": select265, + "3430": msg5880, + "34300": msg36082, + "34301": msg36083, + "34302": msg36084, + "34303": msg36085, + "34304": msg36086, + "34305": msg36087, + "34306": msg36088, + "34307": msg36089, + "34308": msg36090, + "34309": msg36091, + "3431": msg5881, + "34310": msg36092, + "34311": msg36093, + "34312": msg36094, + "34313": msg36095, + "34314": msg36096, + "34315": msg36097, + "34316": msg36098, + "34317": msg36099, + "34318": msg36100, + "34319": msg36101, + "3432": msg5882, + "34320": msg36102, + "34321": msg36103, + "34322": msg36104, + "34323": msg36105, + "34324": msg36106, + "34325": msg36107, + "34326": msg36108, + "34327": msg36109, + "34328": msg36110, + "34329": msg36111, + "3433": msg5883, + "34330": msg36112, + "34331": msg36113, + "34332": msg36114, + "34333": msg36115, + "34334": msg36116, + "34335": msg36117, + "34336": msg36118, + "34337": msg36119, + "34338": msg36120, + "34339": msg36121, + "3434": msg5884, + "34340": msg36122, + "34341": msg36123, + "34342": msg36124, + "34343": msg36125, + "34344": msg36126, + "34345": msg36127, + "34346": msg36128, + "34347": msg36129, + "34348": msg36130, + "34349": msg36131, + "3435": msg5885, + "34350": msg36132, + "34351": msg36133, + "34352": msg36134, + "34353": msg36135, + "34354": msg36136, + "34355": msg36137, + "34356": msg36138, + "34357": msg36139, + "34358": msg36140, + "34359": msg36141, + "3436": msg5886, + "34360": msg36142, + "34361": msg36143, + "34362": msg36144, + "34363": msg36145, + "34364": msg36146, + "34365": msg36147, + "34366": msg36148, + "34367": msg36149, + "34368": msg36150, + "34369": msg36151, + "3437": msg5887, + "34370": msg36152, + "34371": msg36153, + "34372": msg36154, + "34373": msg36155, + "34374": msg36156, + "34375": msg36157, + "34376": msg36158, + "34377": msg36159, + "34378": msg36160, + "34379": msg36161, + "3438": msg5888, + "34380": msg36162, + "34381": msg36163, + "34382": msg36164, + "34383": msg36165, + "34384": msg36166, + "34385": msg36167, + "34386": msg36168, + "34387": msg36169, + "34388": msg36170, + "34389": msg36171, + "3439": msg5889, + "34390": msg36172, + "34391": msg36173, + "34392": msg36174, + "34393": msg36175, + "34394": msg36176, + "34395": msg36177, + "34396": msg36178, + "34397": msg36179, + "34398": msg36180, + "34399": msg36181, + "344": select266, + "3440": msg5890, + "34400": msg36182, + "34401": msg36183, + "34402": msg36184, + "34403": msg36185, + "34404": msg36186, + "34405": msg36187, + "34406": msg36188, + "34407": msg36189, + "34408": msg36190, + "34409": msg36191, + "3441": msg5891, + "34410": msg36192, + "34411": msg36193, + "34412": msg36194, + "34413": msg36195, + "34414": msg36196, + "34415": msg36197, + "34416": msg36198, + "34417": msg36199, + "34418": msg36200, + "34419": msg36201, + "3442": msg5892, + "34420": msg36202, + "34421": msg36203, + "34422": msg36204, + "34423": msg36205, + "34424": msg36206, + "34425": msg36207, + "34426": msg36208, + "34427": msg36209, + "34428": msg36210, + "34429": msg36211, + "3443": msg5893, + "34430": msg36212, + "34431": msg36213, + "34432": msg36214, + "34433": msg36215, + "34434": msg36216, + "34435": msg36217, + "34436": msg36218, + "34437": msg36219, + "34438": msg36220, + "34439": msg36221, + "3444": msg5894, + "34440": msg36222, + "34441": msg36223, + "34442": msg36224, + "34443": msg36225, + "34444": msg36226, + "34445": msg36227, + "34446": msg36228, + "34447": msg36229, + "34448": msg36230, + "34449": msg36231, + "3445": msg5895, + "34450": msg36232, + "34451": msg36233, + "34452": msg36234, + "34453": msg36235, + "34454": msg36236, + "34455": msg36237, + "34456": msg36238, + "34457": msg36239, + "34458": msg36240, + "34459": msg36241, + "3446": msg5896, + "34460": msg36242, + "34461": msg36243, + "34462": msg36244, + "34463": msg36245, + "34464": msg36246, + "34465": msg36247, + "34466": msg36248, + "34467": msg36249, + "34468": msg36250, + "34469": msg36251, + "3447": msg5897, + "34470": msg36252, + "34471": msg36253, + "34472": msg36254, + "34473": msg36255, + "34474": msg36256, + "34475": msg36257, + "34476": msg36258, + "34477": msg36259, + "34478": msg36260, + "34479": msg36261, + "3448": msg5898, + "34480": msg36262, + "34481": msg36263, + "34482": msg36264, + "34483": msg36265, + "34484": msg36266, + "34485": msg36267, + "34486": msg36268, + "34487": msg36269, + "34488": msg36270, + "34489": msg36271, + "3449": msg5899, + "34490": msg36272, + "34491": msg36273, + "34492": msg36274, + "34493": msg36275, + "34494": msg36276, + "34495": msg36277, + "34496": msg36278, + "34497": msg36279, + "34498": msg36280, + "34499": msg36281, + "345": select267, + "3450": msg5900, + "34500": msg36282, + "34501": msg36283, + "34502": msg36284, + "34503": msg36285, + "34504": msg36286, + "34505": msg36287, + "34506": msg36288, + "34507": msg36289, + "34508": msg36290, + "34509": msg36291, + "3451": msg5901, + "34510": msg36292, + "34511": msg36293, + "34512": msg36294, + "34513": msg36295, + "34514": msg36296, + "34515": msg36297, + "34516": msg36298, + "34517": msg36299, + "34518": msg36300, + "34519": msg36301, + "3452": msg5902, + "34520": msg36302, + "34521": msg36303, + "34522": msg36304, + "34523": msg36305, + "34524": msg36306, + "34525": msg36307, + "34526": msg36308, + "34527": msg36309, + "34528": msg36310, + "34529": msg36311, + "3453": msg5903, + "34530": msg36312, + "34531": msg36313, + "34532": msg36314, + "34533": msg36315, + "34534": msg36316, + "34535": msg36317, + "34536": msg36318, + "34537": msg36319, + "34538": msg36320, + "34539": msg36321, + "3454": msg5904, + "34540": msg36322, + "34541": msg36323, + "34542": msg36324, + "34543": msg36325, + "34544": msg36326, + "34545": msg36327, + "34546": msg36328, + "34547": msg36329, + "34548": msg36330, + "34549": msg36331, + "3455": msg5905, + "34550": msg36332, + "34551": msg36333, + "34552": msg36334, + "34553": msg36335, + "34554": msg36336, + "34555": msg36337, + "34556": msg36338, + "34557": msg36339, + "34558": msg36340, + "34559": msg36341, + "3456": msg5906, + "34560": msg36342, + "34561": msg36343, + "34562": msg36344, + "34563": msg36345, + "34564": msg36346, + "34565": msg36347, + "34566": msg36348, + "34567": msg36349, + "34568": msg36350, + "34569": msg36351, + "3457": msg5907, + "34570": msg36352, + "34571": msg36353, + "34572": msg36354, + "34573": msg36355, + "34574": msg36356, + "34575": msg36357, + "34576": msg36358, + "34577": msg36359, + "34578": msg36360, + "34579": msg36361, + "3458": msg5908, + "34580": msg36362, + "34581": msg36363, + "34582": msg36364, + "34583": msg36365, + "34584": msg36366, + "34585": msg36367, + "34586": msg36368, + "34587": msg36369, + "34588": msg36370, + "34589": msg36371, + "3459": msg5909, + "34590": msg36372, + "34591": msg36373, + "34592": msg36374, + "34593": msg36375, + "34594": msg36376, + "34595": msg36377, + "34596": msg36378, + "34597": msg36379, + "34598": msg36380, + "34599": msg36381, + "346": select268, + "3460": msg5910, + "34600": msg36382, + "34601": msg36383, + "34602": msg36384, + "34603": msg36385, + "34604": msg36386, + "34605": msg36387, + "34606": msg36388, + "34607": msg36389, + "34608": msg36390, + "34609": msg36391, + "3461": msg5911, + "34610": msg36392, + "34611": msg36393, + "34612": msg36394, + "34613": msg36395, + "34614": msg36396, + "34615": msg36397, + "34616": msg36398, + "34617": msg36399, + "34618": msg36400, + "34619": msg36401, + "3462": msg5912, + "34620": msg36402, + "34621": msg36403, + "34622": msg36404, + "34623": msg36405, + "34624": msg36406, + "34625": msg36407, + "34626": msg36408, + "34627": msg36409, + "34628": msg36410, + "34629": msg36411, + "3463": msg5913, + "34630": msg36412, + "34631": msg36413, + "34632": msg36414, + "34633": msg36415, + "34634": msg36416, + "34635": msg36417, + "34636": msg36418, + "34637": msg36419, + "34638": msg36420, + "34639": msg36421, + "3464": msg5914, + "34640": msg36422, + "34641": msg36423, + "34642": msg36424, + "34643": msg36425, + "34644": msg36426, + "34645": msg36427, + "34646": msg36428, + "34647": msg36429, + "34648": msg36430, + "34649": msg36431, + "3465": msg5915, + "34650": msg36432, + "34651": msg36433, + "34652": msg36434, + "34653": msg36435, + "34654": msg36436, + "34655": msg36437, + "34656": msg36438, + "34657": msg36439, + "34658": msg36440, + "34659": msg36441, + "3466": msg5916, + "34660": msg36442, + "34661": msg36443, + "34662": msg36444, + "34663": msg36445, + "34664": msg36446, + "34665": msg36447, + "34666": msg36448, + "34667": msg36449, + "34668": msg36450, + "34669": msg36451, + "3467": msg5917, + "34670": msg36452, + "34671": msg36453, + "34672": msg36454, + "34673": msg36455, + "34674": msg36456, + "34675": msg36457, + "34676": msg36458, + "34677": msg36459, + "34678": msg36460, + "34679": msg36461, + "3468": msg5918, + "34680": msg36462, + "34681": msg36463, + "34682": msg36464, + "34683": msg36465, + "34684": msg36466, + "34685": msg36467, + "34686": msg36468, + "34687": msg36469, + "34688": msg36470, + "34689": msg36471, + "3469": msg5919, + "34690": msg36472, + "34691": msg36473, + "34692": msg36474, + "34693": msg36475, + "34694": msg36476, + "34695": msg36477, + "34696": msg36478, + "34697": msg36479, + "34698": msg36480, + "34699": msg36481, + "347": select269, + "3470": msg5920, + "34700": msg36482, + "34701": msg36483, + "34702": msg36484, + "34703": msg36485, + "34704": msg36486, + "34705": msg36487, + "34706": msg36488, + "34707": msg36489, + "34708": msg36490, + "34709": msg36491, + "3471": msg5921, + "34710": msg36492, + "34711": msg36493, + "34712": msg36494, + "34713": msg36495, + "34714": msg36496, + "34715": msg36497, + "34716": msg36498, + "34717": msg36499, + "34718": msg36500, + "34719": msg36501, + "3472": msg5922, + "34720": msg36502, + "34721": msg36503, + "34722": msg36504, + "34723": msg36505, + "34724": msg36506, + "34725": msg36507, + "34726": msg36508, + "34727": msg36509, + "34728": msg36510, + "34729": msg36511, + "3473": msg5923, + "34730": msg36512, + "34731": msg36513, + "34732": msg36514, + "34733": msg36515, + "34734": msg36516, + "34735": msg36517, + "34736": msg36518, + "34737": msg36519, + "34738": msg36520, + "34739": msg36521, + "3474": msg5924, + "34740": msg36522, + "34741": msg36523, + "34742": msg36524, + "34743": msg36525, + "34744": msg36526, + "34745": msg36527, + "34746": msg36528, + "34747": msg36529, + "34748": msg36530, + "34749": msg36531, + "3475": msg5925, + "34750": msg36532, + "34751": msg36533, + "34752": msg36534, + "34753": msg36535, + "34754": msg36536, + "34755": msg36537, + "34756": msg36538, + "34757": msg36539, + "34758": msg36540, + "34759": msg36541, + "3476": msg5926, + "34760": msg36542, + "34761": msg36543, + "34762": msg36544, + "34763": msg36545, + "34764": msg36546, + "34765": msg36547, + "34766": msg36548, + "34767": msg36549, + "34768": msg36550, + "34769": msg36551, + "3477": msg5927, + "34770": msg36552, + "34771": msg36553, + "34772": msg36554, + "34773": msg36555, + "34774": msg36556, + "34775": msg36557, + "34776": msg36558, + "34777": msg36559, + "34778": msg36560, + "34779": msg36561, + "3478": msg5928, + "34780": msg36562, + "34781": msg36563, + "34782": msg36564, + "34783": msg36565, + "34784": msg36566, + "34785": msg36567, + "34786": msg36568, + "34787": msg36569, + "34788": msg36570, + "34789": msg36571, + "3479": msg5929, + "34790": msg36572, + "34791": msg36573, + "34792": msg36574, + "34793": msg36575, + "34794": msg36576, + "34795": msg36577, + "34796": msg36578, + "34797": msg36579, + "34798": msg36580, + "34799": msg36581, + "348": select270, + "3480": msg5930, + "34800": msg36582, + "34801": msg36583, + "34802": msg36584, + "34803": msg36585, + "34804": msg36586, + "34805": msg36587, + "34806": msg36588, + "34807": msg36589, + "34808": msg36590, + "34809": msg36591, + "3481": msg5931, + "34810": msg36592, + "34811": msg36593, + "34812": msg36594, + "34813": msg36595, + "34814": msg36596, + "34815": msg36597, + "34816": msg36598, + "34817": msg36599, + "34818": msg36600, + "34819": msg36601, + "3482": msg5932, + "34820": msg36602, + "34821": msg36603, + "34822": msg36604, + "34823": msg36605, + "34824": msg36606, + "34825": msg36607, + "34826": msg36608, + "34827": msg36609, + "34828": msg36610, + "34829": msg36611, + "3483": msg5933, + "34830": msg36612, + "34831": msg36613, + "34832": msg36614, + "34833": msg36615, + "34834": msg36616, + "34835": msg36617, + "34836": msg36618, + "34837": msg36619, + "34838": msg36620, + "34839": msg36621, + "3484": msg5934, + "34840": msg36622, + "34841": msg36623, + "34842": msg36624, + "34843": msg36625, + "34844": msg36626, + "34845": msg36627, + "34846": msg36628, + "34847": msg36629, + "34848": msg36630, + "34849": msg36631, + "3485": msg5935, + "34850": msg36632, + "34851": msg36633, + "34852": msg36634, + "34853": msg36635, + "34854": msg36636, + "34855": msg36637, + "34856": msg36638, + "34857": msg36639, + "34858": msg36640, + "34859": msg36641, + "3486": msg5936, + "34860": msg36642, + "34861": msg36643, + "34862": msg36644, + "34863": msg36645, + "34864": msg36646, + "34865": msg36647, + "34866": msg36648, + "34867": msg36649, + "34868": msg36650, + "34869": msg36651, + "3487": msg5937, + "34870": msg36652, + "34871": msg36653, + "34872": msg36654, + "34873": msg36655, + "34874": msg36656, + "34875": msg36657, + "34876": msg36658, + "34877": msg36659, + "34878": msg36660, + "34879": msg36661, + "3488": msg5938, + "34880": msg36662, + "34881": msg36663, + "34882": msg36664, + "34883": msg36665, + "34884": msg36666, + "34885": msg36667, + "34886": msg36668, + "34887": msg36669, + "34888": msg36670, + "34889": msg36671, + "3489": msg5939, + "34890": msg36672, + "34891": msg36673, + "34892": msg36674, + "34893": msg36675, + "34894": msg36676, + "34895": msg36677, + "34896": msg36678, + "34897": msg36679, + "34898": msg36680, + "34899": msg36681, + "349": select271, + "3490": msg5940, + "34900": msg36682, + "34901": msg36683, + "34902": msg36684, + "34903": msg36685, + "34904": msg36686, + "34905": msg36687, + "34906": msg36688, + "34907": msg36689, + "34908": msg36690, + "34909": msg36691, + "3491": msg5941, + "34910": msg36692, + "34911": msg36693, + "34912": msg36694, + "34913": msg36695, + "34914": msg36696, + "34915": msg36697, + "34916": msg36698, + "34917": msg36699, + "34918": msg36700, + "34919": msg36701, + "3492": msg5942, + "34920": msg36702, + "34921": msg36703, + "34922": msg36704, + "34923": msg36705, + "34924": msg36706, + "34925": msg36707, + "34926": msg36708, + "34927": msg36709, + "34928": msg36710, + "34929": msg36711, + "3493": msg5943, + "34930": msg36712, + "34931": msg36713, + "34932": msg36714, + "34933": msg36715, + "34934": msg36716, + "34935": msg36717, + "34936": msg36718, + "34937": msg36719, + "34938": msg36720, + "34939": msg36721, + "3494": msg5944, + "34940": msg36722, + "34941": msg36723, + "34942": msg36724, + "34943": msg36725, + "34944": msg36726, + "34945": msg36727, + "34946": msg36728, + "34947": msg36729, + "34948": msg36730, + "34949": msg36731, + "3495": msg5945, + "34950": msg36732, + "34951": msg36733, + "34952": msg36734, + "34953": msg36735, + "34954": msg36736, + "34955": msg36737, + "34956": msg36738, + "34957": msg36739, + "34958": msg36740, + "34959": msg36741, + "3496": msg5946, + "34960": msg36742, + "34961": msg36743, + "34962": msg36744, + "34963": msg36745, + "34964": msg36746, + "34965": msg36747, + "34966": msg36748, + "34967": msg36749, + "34968": msg36750, + "34969": msg36751, + "3497": msg5947, + "34970": msg36752, + "34971": msg36753, + "34972": msg36754, + "34973": msg36755, + "34974": msg36756, + "34975": msg36757, + "34976": msg36758, + "34977": msg36759, + "34978": msg36760, + "34979": msg36761, + "3498": msg5948, + "34980": msg36762, + "34981": msg36763, + "34982": msg36764, + "34983": msg36765, + "34984": msg36766, + "34985": msg36767, + "34986": msg36768, + "34987": msg36769, + "34988": msg36770, + "34989": msg36771, + "3499": msg5949, + "34990": msg36772, + "34991": msg36773, + "34992": msg36774, + "34993": msg36775, + "34994": msg36776, + "34995": msg36777, + "34996": msg36778, + "34997": msg36779, + "34998": msg36780, + "34999": msg36781, + "350": select272, + "3500": msg5950, + "35000": msg36782, + "35001": msg36783, + "35002": msg36784, + "35003": msg36785, + "35004": msg36786, + "35005": msg36787, + "35006": msg36788, + "35007": msg36789, + "35008": msg36790, + "35009": msg36791, + "3501": msg5951, + "35010": msg36792, + "35011": msg36793, + "35012": msg36794, + "35013": msg36795, + "35014": msg36796, + "35015": msg36797, + "35016": msg36798, + "35017": msg36799, + "35018": msg36800, + "35019": msg36801, + "3502": msg5952, + "35020": msg36802, + "35021": msg36803, + "35022": msg36804, + "35023": msg36805, + "35024": msg36806, + "35025": msg36807, + "35026": msg36808, + "35027": msg36809, + "35028": msg36810, + "35029": msg36811, + "3503": msg5953, + "35030": msg36812, + "35031": msg36813, + "35032": msg36814, + "35033": msg36815, + "35034": msg36816, + "35035": msg36817, + "35036": msg36818, + "35037": msg36819, + "35038": msg36820, + "35039": msg36821, + "3504": msg5954, + "35040": msg36822, + "35041": msg36823, + "35042": msg36824, + "35043": msg36825, + "35044": msg36826, + "35045": msg36827, + "35046": msg36828, + "35047": msg36829, + "35048": msg36830, + "35049": msg36831, + "3505": msg5955, + "35050": msg36832, + "35051": msg36833, + "35052": msg36834, + "35053": msg36835, + "3506": msg5956, + "35062": msg36836, + "35063": msg36837, + "35064": msg36838, + "35065": msg36839, + "35066": msg36840, + "35067": msg36841, + "35068": msg36842, + "35069": msg36843, + "3507": msg5957, + "35070": msg36844, + "35071": msg36845, + "35072": msg36846, + "35073": msg36847, + "35074": msg36848, + "35075": msg36849, + "35076": msg36850, + "35077": msg36851, + "35078": msg36852, + "35079": msg36853, + "3508": msg5958, + "35080": msg36854, + "35081": msg36855, + "35082": msg36856, + "35083": msg36857, + "35084": msg36858, + "35085": msg36859, + "35086": msg36860, + "35087": msg36861, + "35088": msg36862, + "35089": msg36863, + "3509": msg5959, + "35090": msg36864, + "35091": msg36865, + "35092": msg36866, + "35093": msg36867, + "35094": msg36868, + "35095": msg36869, + "35096": msg36870, + "35097": msg36871, + "35098": msg36872, + "35099": msg36873, + "351": select273, + "3510": msg5960, + "35100": msg36874, + "35101": msg36875, + "35102": msg36876, + "35103": msg36877, + "35104": msg36878, + "35105": msg36879, + "35106": msg36880, + "35107": msg36881, + "35108": msg36882, + "35109": msg36883, + "3511": msg5961, + "35110": msg36884, + "35111": msg36885, + "35112": msg36886, + "35113": msg36887, + "35114": msg36888, + "35115": msg36889, + "35116": msg36890, + "35117": msg36891, + "35118": msg36892, + "35119": msg36893, + "3512": msg5962, + "35120": msg36894, + "35121": msg36895, + "35122": msg36896, + "35123": msg36897, + "35124": msg36898, + "35125": msg36899, + "35126": msg36900, + "35127": msg36901, + "35128": msg36902, + "35129": msg36903, + "3513": msg5963, + "35130": msg36904, + "35131": msg36905, + "35132": msg36906, + "35133": msg36907, + "35134": msg36908, + "35135": msg36909, + "35136": msg36910, + "35137": msg36911, + "35138": msg36912, + "35139": msg36913, + "3514": msg5964, + "35140": msg36914, + "35141": msg36915, + "35142": msg36916, + "35143": msg36917, + "35144": msg36918, + "35145": msg36919, + "35146": msg36920, + "35147": msg36921, + "35148": msg36922, + "35149": msg36923, + "3515": msg5965, + "35150": msg36924, + "35151": msg36925, + "35152": msg36926, + "35153": msg36927, + "35154": msg36928, + "35155": msg36929, + "35156": msg36930, + "35157": msg36931, + "35158": msg36932, + "35159": msg36933, + "3516": msg5966, + "35160": msg36934, + "35161": msg36935, + "35162": msg36936, + "35163": msg36937, + "35164": msg36938, + "35165": msg36939, + "35166": msg36940, + "35167": msg36941, + "35168": msg36942, + "35169": msg36943, + "3517": msg5967, + "35170": msg36944, + "35171": msg36945, + "35172": msg36946, + "35173": msg36947, + "35174": msg36948, + "35175": msg36949, + "35176": msg36950, + "35177": msg36951, + "35178": msg36952, + "35179": msg36953, + "3518": msg5968, + "35180": msg36954, + "35181": msg36955, + "35182": msg36956, + "35183": msg36957, + "35184": msg36958, + "35185": msg36959, + "35186": msg36960, + "35187": msg36961, + "35188": msg36962, + "35189": msg36963, + "3519": msg5969, + "35190": msg36964, + "35191": msg36965, + "35192": msg36966, + "35193": msg36967, + "35194": msg36968, + "35195": msg36969, + "35196": msg36970, + "35197": msg36971, + "35198": msg36972, + "35199": msg36973, + "352": select274, + "3520": msg5970, + "35200": msg36974, + "35201": msg36975, + "35202": msg36976, + "35203": msg36977, + "35204": msg36978, + "35205": msg36979, + "35206": msg36980, + "35207": msg36981, + "35208": msg36982, + "35209": msg36983, + "3521": msg5971, + "35210": msg36984, + "35211": msg36985, + "35212": msg36986, + "35213": msg36987, + "35214": msg36988, + "35215": msg36989, + "35216": msg36990, + "35217": msg36991, + "35218": msg36992, + "35219": msg36993, + "3522": msg5972, + "35220": msg36994, + "35221": msg36995, + "35222": msg36996, + "35223": msg36997, + "35224": msg36998, + "35225": msg36999, + "35226": msg37000, + "35227": msg37001, + "35228": msg37002, + "35229": msg37003, + "3523": msg5973, + "35230": msg37004, + "35231": msg37005, + "35232": msg37006, + "35233": msg37007, + "35234": msg37008, + "35235": msg37009, + "35236": msg37010, + "35237": msg37011, + "35238": msg37012, + "35239": msg37013, + "3524": msg5974, + "35240": msg37014, + "35241": msg37015, + "35242": msg37016, + "35243": msg37017, + "35244": msg37018, + "35245": msg37019, + "35246": msg37020, + "35247": msg37021, + "35248": msg37022, + "35249": msg37023, + "3525": msg5975, + "35250": msg37024, + "35251": msg37025, + "35252": msg37026, + "35253": msg37027, + "35254": msg37028, + "35255": msg37029, + "35256": msg37030, + "35257": msg37031, + "35258": msg37032, + "35259": msg37033, + "3526": msg5976, + "35260": msg37034, + "35261": msg37035, + "35262": msg37036, + "35263": msg37037, + "35264": msg37038, + "35265": msg37039, + "35266": msg37040, + "35267": msg37041, + "35268": msg37042, + "35269": msg37043, + "3527": msg5977, + "35270": msg37044, + "35271": msg37045, + "35272": msg37046, + "35273": msg37047, + "35274": msg37048, + "35275": msg37049, + "35276": msg37050, + "35277": msg37051, + "35278": msg37052, + "35279": msg37053, + "3528": msg5978, + "35280": msg37054, + "35281": msg37055, + "35282": msg37056, + "35283": msg37057, + "35284": msg37058, + "35285": msg37059, + "35286": msg37060, + "35287": msg37061, + "35288": msg37062, + "35289": msg37063, + "3529": msg5979, + "35290": msg37064, + "35291": msg37065, + "35292": msg37066, + "35293": msg37067, + "35294": msg37068, + "35295": msg37069, + "35296": msg37070, + "35297": msg37071, + "35298": msg37072, + "35299": msg37073, + "353": select275, + "3530": msg5980, + "35300": msg37074, + "35301": msg37075, + "35302": msg37076, + "35303": msg37077, + "35304": msg37078, + "35305": msg37079, + "35306": msg37080, + "35307": msg37081, + "35308": msg37082, + "35309": msg37083, + "3531": msg5981, + "35310": msg37084, + "35311": msg37085, + "35312": msg37086, + "35313": msg37087, + "35314": msg37088, + "35315": msg37089, + "35316": msg37090, + "35317": msg37091, + "35318": msg37092, + "35319": msg37093, + "3532": msg5982, + "35320": msg37094, + "35321": msg37095, + "35322": msg37096, + "35323": msg37097, + "35324": msg37098, + "35325": msg37099, + "35326": msg37100, + "35327": msg37101, + "35328": msg37102, + "35329": msg37103, + "3533": msg5983, + "35330": msg37104, + "35331": msg37105, + "35332": msg37106, + "35333": msg37107, + "35334": msg37108, + "35335": msg37109, + "35336": msg37110, + "35337": msg37111, + "35338": msg37112, + "35339": msg37113, + "3534": msg5984, + "35340": msg37114, + "35341": msg37115, + "35342": msg37116, + "35343": msg37117, + "35344": msg37118, + "35345": msg37119, + "35346": msg37120, + "35347": msg37121, + "35348": msg37122, + "35349": msg37123, + "3535": msg5985, + "35350": msg37124, + "35351": msg37125, + "35352": msg37126, + "35353": msg37127, + "35354": msg37128, + "35355": msg37129, + "35356": msg37130, + "35357": msg37131, + "35358": msg37132, + "35359": msg37133, + "3536": msg5986, + "35360": msg37134, + "35361": msg37135, + "35362": msg37136, + "35363": msg37137, + "35364": msg37138, + "35365": msg37139, + "35366": msg37140, + "35367": msg37141, + "35368": msg37142, + "35369": msg37143, + "3537": msg5987, + "35370": msg37144, + "35371": msg37145, + "35372": msg37146, + "35373": msg37147, + "35374": msg37148, + "35375": msg37149, + "35376": msg37150, + "35377": msg37151, + "35378": msg37152, + "35379": msg37153, + "3538": msg5988, + "35380": msg37154, + "35381": msg37155, + "35382": msg37156, + "35383": msg37157, + "35384": msg37158, + "35385": msg37159, + "35386": msg37160, + "35387": msg37161, + "35388": msg37162, + "35389": msg37163, + "3539": msg5989, + "35390": msg37164, + "35391": msg37165, + "35392": msg37166, + "35393": msg37167, + "35394": msg37168, + "35395": msg37169, + "35396": msg37170, + "35397": msg37171, + "35398": msg37172, + "35399": msg37173, + "354": select276, + "3540": msg5990, + "35400": msg37174, + "35401": msg37175, + "35402": msg37176, + "35403": msg37177, + "35404": msg37178, + "35405": msg37179, + "35406": msg37180, + "35407": msg37181, + "35408": msg37182, + "35409": msg37183, + "3541": msg5991, + "35410": msg37184, + "35411": msg37185, + "35412": msg37186, + "35413": msg37187, + "35414": msg37188, + "35415": msg37189, + "35416": msg37190, + "35417": msg37191, + "35418": msg37192, + "35419": msg37193, + "3542": msg5992, + "35420": msg37194, + "35421": msg37195, + "35422": msg37196, + "35423": msg37197, + "35424": msg37198, + "35425": msg37199, + "35426": msg37200, + "35427": msg37201, + "35428": msg37202, + "35429": msg37203, + "3543": msg5993, + "35430": msg37204, + "35431": msg37205, + "35432": msg37206, + "35433": msg37207, + "35434": msg37208, + "35435": msg37209, + "35436": msg37210, + "35437": msg37211, + "35438": msg37212, + "35439": msg37213, + "3544": msg5994, + "35440": msg37214, + "35441": msg37215, + "35442": msg37216, + "35443": msg37217, + "35444": msg37218, + "35445": msg37219, + "35446": msg37220, + "35447": msg37221, + "35448": msg37222, + "35449": msg37223, + "3545": msg5995, + "35450": msg37224, + "35451": msg37225, + "35452": msg37226, + "35453": msg37227, + "35454": msg37228, + "35455": msg37229, + "35456": msg37230, + "35457": msg37231, + "35458": msg37232, + "35459": msg37233, + "3546": msg5996, + "35460": msg37234, + "35461": msg37235, + "35462": msg37236, + "35463": msg37237, + "35464": msg37238, + "35465": msg37239, + "35466": msg37240, + "35467": msg37241, + "35468": msg37242, + "35469": msg37243, + "3547": msg5997, + "35470": msg37244, + "35471": msg37245, + "35472": msg37246, + "35473": msg37247, + "35474": msg37248, + "35475": msg37249, + "35476": msg37250, + "35477": msg37251, + "35478": msg37252, + "35479": msg37253, + "3548": msg5998, + "35480": msg37254, + "35481": msg37255, + "35482": msg37256, + "35483": msg37257, + "35484": msg37258, + "35485": msg37259, + "35486": msg37260, + "35487": msg37261, + "35488": msg37262, + "35489": msg37263, + "3549": msg5999, + "35490": msg37264, + "35491": msg37265, + "35492": msg37266, + "35493": msg37267, + "35494": msg37268, + "35495": msg37269, + "35496": msg37270, + "35497": msg37271, + "35498": msg37272, + "35499": msg37273, + "355": select277, + "3550": msg6000, + "35500": msg37274, + "35501": msg37275, + "35502": msg37276, + "35503": msg37277, + "35504": msg37278, + "35505": msg37279, + "35506": msg37280, + "35507": msg37281, + "35508": msg37282, + "35509": msg37283, + "3551": msg6001, + "35510": msg37284, + "35511": msg37285, + "35512": msg37286, + "35513": msg37287, + "35514": msg37288, + "35515": msg37289, + "35516": msg37290, + "35517": msg37291, + "35518": msg37292, + "35519": msg37293, + "3552": msg6002, + "35520": msg37294, + "35521": msg37295, + "35522": msg37296, + "35523": msg37297, + "35524": msg37298, + "35525": msg37299, + "35526": msg37300, + "35527": msg37301, + "35528": msg37302, + "35529": msg37303, + "3553": msg6003, + "35530": msg37304, + "35531": msg37305, + "35532": msg37306, + "35533": msg37307, + "35534": msg37308, + "35535": msg37309, + "35536": msg37310, + "35537": msg37311, + "35538": msg37312, + "35539": msg37313, + "3554": msg6004, + "35540": msg37314, + "35541": msg37315, + "35542": msg37316, + "35543": msg37317, + "35544": msg37318, + "35545": msg37319, + "35546": msg37320, + "35547": msg37321, + "35548": msg37322, + "35549": msg37323, + "3555": msg6005, + "35550": msg37324, + "35551": msg37325, + "35552": msg37326, + "35553": msg37327, + "35554": msg37328, + "35555": msg37329, + "35556": msg37330, + "35557": msg37331, + "35558": msg37332, + "35559": msg37333, + "3556": msg6006, + "35560": msg37334, + "35561": msg37335, + "35562": msg37336, + "35563": msg37337, + "35564": msg37338, + "35565": msg37339, + "35566": msg37340, + "35567": msg37341, + "35568": msg37342, + "35569": msg37343, + "3557": msg6007, + "35570": msg37344, + "35571": msg37345, + "35572": msg37346, + "35573": msg37347, + "35574": msg37348, + "35575": msg37349, + "35576": msg37350, + "35577": msg37351, + "35578": msg37352, + "35579": msg37353, + "3558": msg6008, + "35580": msg37354, + "35581": msg37355, + "35582": msg37356, + "35583": msg37357, + "35584": msg37358, + "35585": msg37359, + "35586": msg37360, + "35587": msg37361, + "35588": msg37362, + "35589": msg37363, + "3559": msg6009, + "35590": msg37364, + "35591": msg37365, + "35592": msg37366, + "35593": msg37367, + "35594": msg37368, + "35595": msg37369, + "35596": msg37370, + "35597": msg37371, + "35598": msg37372, + "35599": msg37373, + "356": select278, + "3560": msg6010, + "35600": msg37374, + "35601": msg37375, + "35602": msg37376, + "35603": msg37377, + "35604": msg37378, + "35605": msg37379, + "35606": msg37380, + "35607": msg37381, + "35608": msg37382, + "35609": msg37383, + "3561": msg6011, + "35610": msg37384, + "35611": msg37385, + "35612": msg37386, + "35613": msg37387, + "35614": msg37388, + "35615": msg37389, + "35616": msg37390, + "35617": msg37391, + "35618": msg37392, + "35619": msg37393, + "3562": msg6012, + "35620": msg37394, + "35621": msg37395, + "35622": msg37396, + "35623": msg37397, + "35628": msg37398, + "35629": msg37399, + "3563": msg6013, + "35630": msg37400, + "35631": msg37401, + "35632": msg37402, + "35633": msg37403, + "35634": msg37404, + "35635": msg37405, + "35636": msg37406, + "35637": msg37407, + "35638": msg37408, + "35639": msg37409, + "3564": msg6014, + "35640": msg37410, + "35641": msg37411, + "35642": msg37412, + "35643": msg37413, + "35644": msg37414, + "35645": msg37415, + "35646": msg37416, + "35647": msg37417, + "35648": msg37418, + "35649": msg37419, + "3565": msg6015, + "35650": msg37420, + "35651": msg37421, + "35652": msg37422, + "35653": msg37423, + "35654": msg37424, + "35655": msg37425, + "35656": msg37426, + "35657": msg37427, + "35658": msg37428, + "35659": msg37429, + "3566": msg6016, + "35660": msg37430, + "35661": msg37431, + "35662": msg37432, + "35663": msg37433, + "35664": msg37434, + "35665": msg37435, + "35666": msg37436, + "35667": msg37437, + "35668": msg37438, + "35669": msg37439, + "3567": msg6017, + "35670": msg37440, + "35671": msg37441, + "35672": msg37442, + "35673": msg37443, + "35674": msg37444, + "35675": msg37445, + "35676": msg37446, + "35677": msg37447, + "35678": msg37448, + "35679": msg37449, + "3568": msg6018, + "35680": msg37450, + "35681": msg37451, + "35682": msg37452, + "35683": msg37453, + "35684": msg37454, + "35685": msg37455, + "35686": msg37456, + "35687": msg37457, + "3569": msg6019, + "35691": msg37458, + "35692": msg37459, + "35693": msg37460, + "35694": msg37461, + "35695": msg37462, + "35696": msg37463, + "35697": msg37464, + "35698": msg37465, + "35699": msg37466, + "357": select279, + "3570": msg6020, + "35700": msg37467, + "35701": msg37468, + "35702": msg37469, + "35703": msg37470, + "35704": msg37471, + "35705": msg37472, + "35706": msg37473, + "35707": msg37474, + "35708": msg37475, + "35709": msg37476, + "3571": msg6021, + "35710": msg37477, + "35719": msg37478, + "3572": msg6022, + "35720": msg37479, + "35723": msg37480, + "35724": msg37481, + "3573": msg6023, + "35731": msg37482, + "35732": msg37483, + "35733": msg37484, + "35734": msg37485, + "35735": msg37486, + "35736": msg37487, + "35737": msg37488, + "35738": msg37489, + "35739": msg37490, + "3574": msg6024, + "35740": msg37491, + "35741": msg37492, + "35742": msg37493, + "35743": msg37494, + "35744": msg37495, + "35745": msg37496, + "35746": msg37497, + "35747": msg37498, + "35748": msg37499, + "35749": msg37500, + "3575": msg6025, + "35750": msg37501, + "35751": msg37502, + "35752": msg37503, + "35753": msg37504, + "35754": msg37505, + "35755": msg37506, + "35756": msg37507, + "35757": msg37508, + "35758": msg37509, + "35759": msg37510, + "3576": msg6026, + "35760": msg37511, + "35761": msg37512, + "35762": msg37513, + "35763": msg37514, + "35764": msg37515, + "35765": msg37516, + "35766": msg37517, + "35767": msg37518, + "35768": msg37519, + "35769": msg37520, + "3577": msg6027, + "35770": msg37521, + "35771": msg37522, + "35772": msg37523, + "35779": msg37524, + "3578": msg6028, + "35780": msg37525, + "35781": msg37526, + "35782": msg37527, + "35783": msg37528, + "35784": msg37529, + "35785": msg37530, + "35786": msg37531, + "35787": msg37532, + "35788": msg37533, + "35789": msg37534, + "3579": msg6029, + "35790": msg37535, + "35791": msg37536, + "35792": msg37537, + "35793": msg37538, + "35794": msg37539, + "35795": msg37540, + "35796": msg37541, + "35797": msg37542, + "35798": msg37543, + "35799": msg37544, + "358": select280, + "3580": msg6030, + "35800": msg37545, + "35801": msg37546, + "35802": msg37547, + "35803": msg37548, + "35804": msg37549, + "35805": msg37550, + "35806": msg37551, + "35807": msg37552, + "35808": msg37553, + "35809": msg37554, + "3581": msg6031, + "35810": msg37555, + "35811": msg37556, + "35812": msg37557, + "35813": msg37558, + "35814": msg37559, + "35815": msg37560, + "35816": msg37561, + "35817": msg37562, + "35818": msg37563, + "35819": msg37564, + "3582": msg6032, + "35820": msg37565, + "35821": msg37566, + "35822": msg37567, + "35823": msg37568, + "35824": msg37569, + "35825": msg37570, + "35826": msg37571, + "35827": msg37572, + "3583": msg6033, + "35831": msg37573, + "35836": msg37574, + "35837": msg37575, + "35838": msg37576, + "35839": msg37577, + "3584": msg6034, + "35840": msg37578, + "35841": msg37579, + "35842": msg37580, + "35843": msg37581, + "35844": msg37582, + "35845": msg37583, + "35846": msg37584, + "35847": msg37585, + "35848": msg37586, + "35849": msg37587, + "3585": msg6035, + "35850": msg37588, + "35851": msg37589, + "35852": msg37590, + "35853": msg37591, + "35854": msg37592, + "35855": msg37593, + "35856": msg37594, + "35857": msg37595, + "35858": msg37596, + "35859": msg37597, + "3586": msg6036, + "35860": msg37598, + "35861": msg37599, + "35862": msg37600, + "35863": msg37601, + "35864": msg37602, + "35865": msg37603, + "35866": msg37604, + "35867": msg37605, + "35868": msg37606, + "35869": msg37607, + "3587": msg6037, + "35870": msg37608, + "35871": msg37609, + "35872": msg37610, + "35873": msg37611, + "35874": msg37612, + "35875": msg37613, + "35876": msg37614, + "35877": msg37615, + "35878": msg37616, + "35879": msg37617, + "3588": msg6038, + "35880": msg37618, + "35881": msg37619, + "35882": msg37620, + "35883": msg37621, + "35884": msg37622, + "35885": msg37623, + "35886": msg37624, + "35887": msg37625, + "35888": msg37626, + "35889": msg37627, + "3589": msg6039, + "35890": msg37628, + "35891": msg37629, + "35892": msg37630, + "35893": msg37631, + "35894": msg37632, + "35895": msg37633, + "35896": msg37634, + "35897": msg37635, + "35898": msg37636, + "35899": msg37637, + "359": select281, + "3590": msg6040, + "35900": msg37638, + "35901": msg37639, + "35902": msg37640, + "35903": msg37641, + "35904": msg37642, + "35905": msg37643, + "35906": msg37644, + "35907": msg37645, + "35908": msg37646, + "35909": msg37647, + "3591": msg6041, + "35910": msg37648, + "35911": msg37649, + "35912": msg37650, + "35913": msg37651, + "35914": msg37652, + "35915": msg37653, + "35916": msg37654, + "35917": msg37655, + "35918": msg37656, + "35919": msg37657, + "3592": msg6042, + "35920": msg37658, + "35921": msg37659, + "35922": msg37660, + "35923": msg37661, + "35924": msg37662, + "35925": msg37663, + "35926": msg37664, + "35927": msg37665, + "35928": msg37666, + "35929": msg37667, + "3593": msg6043, + "35930": msg37668, + "35931": msg37669, + "35932": msg37670, + "35933": msg37671, + "35934": msg37672, + "35935": msg37673, + "35936": msg37674, + "35937": msg37675, + "35938": msg37676, + "35939": msg37677, + "3594": msg6044, + "35940": msg37678, + "35941": msg37679, + "35942": msg37680, + "35943": msg37681, + "35944": msg37682, + "35945": msg37683, + "35946": msg37684, + "35947": msg37685, + "35948": msg37686, + "35949": msg37687, + "3595": msg6045, + "35950": msg37688, + "35951": msg37689, + "35952": msg37690, + "35953": msg37691, + "35954": msg37692, + "35955": msg37693, + "35956": msg37694, + "35957": msg37695, + "35958": msg37696, + "35959": msg37697, + "3596": msg6046, + "35960": msg37698, + "35961": msg37699, + "35962": msg37700, + "35963": msg37701, + "35964": msg37702, + "35965": msg37703, + "35966": msg37704, + "35967": msg37705, + "35968": msg37706, + "35969": msg37707, + "3597": msg6047, + "35970": msg37708, + "35971": msg37709, + "35972": msg37710, + "35973": msg37711, + "35974": msg37712, + "35975": msg37713, + "35976": msg37714, + "35977": msg37715, + "35978": msg37716, + "35979": msg37717, + "3598": msg6048, + "35980": msg37718, + "35981": msg37719, + "35982": msg37720, + "35983": msg37721, + "35984": msg37722, + "35985": msg37723, + "35986": msg37724, + "35987": msg37725, + "35988": msg37726, + "35989": msg37727, + "3599": msg6049, + "35990": msg37728, + "35991": msg37729, + "35992": msg37730, + "35993": msg37731, + "35994": msg37732, + "35995": msg37733, + "35996": msg37734, + "35997": msg37735, + "35998": msg37736, + "35999": msg37737, + "360": select282, + "3600": msg6050, + "36000": msg37738, + "36001": msg37739, + "36002": msg37740, + "36003": msg37741, + "36004": msg37742, + "36005": msg37743, + "36006": msg37744, + "36007": msg37745, + "36008": msg37746, + "36009": msg37747, + "3601": msg6051, + "36010": msg37748, + "36011": msg37749, + "36012": msg37750, + "36013": msg37751, + "36014": msg37752, + "36015": msg37753, + "36016": msg37754, + "36017": msg37755, + "36018": msg37756, + "36019": msg37757, + "3602": msg6052, + "36020": msg37758, + "36021": msg37759, + "36022": msg37760, + "36023": msg37761, + "36024": msg37762, + "36025": msg37763, + "36026": msg37764, + "36027": msg37765, + "36028": msg37766, + "36029": msg37767, + "3603": msg6053, + "36030": msg37768, + "36031": msg37769, + "36032": msg37770, + "36033": msg37771, + "36034": msg37772, + "36035": msg37773, + "36036": msg37774, + "36037": msg37775, + "36038": msg37776, + "36039": msg37777, + "3604": msg6054, + "36040": msg37778, + "36041": msg37779, + "36042": msg37780, + "36043": msg37781, + "36044": msg37782, + "36045": msg37783, + "36046": msg37784, + "36047": msg37785, + "36048": msg37786, + "36049": msg37787, + "3605": msg6055, + "36050": msg37788, + "36051": msg37789, + "36052": msg37790, + "36053": msg37791, + "36054": msg37792, + "36055": msg37793, + "36056": msg37794, + "36057": msg37795, + "36058": msg37796, + "36059": msg37797, + "3606": msg6056, + "36060": msg37798, + "36061": msg37799, + "36062": msg37800, + "36063": msg37801, + "36064": msg37802, + "36065": msg37803, + "36066": msg37804, + "36067": msg37805, + "36068": msg37806, + "36069": msg37807, + "3607": msg6057, + "36070": msg37808, + "36071": msg37809, + "36072": msg37810, + "36073": msg37811, + "36074": msg37812, + "36075": msg37813, + "36076": msg37814, + "36077": msg37815, + "36078": msg37816, + "36079": msg37817, + "3608": msg6058, + "36080": msg37818, + "36081": msg37819, + "36082": msg37820, + "36083": msg37821, + "36084": msg37822, + "36085": msg37823, + "36086": msg37824, + "36087": msg37825, + "36088": msg37826, + "36089": msg37827, + "3609": msg6059, + "36090": msg37828, + "36091": msg37829, + "36092": msg37830, + "36093": msg37831, + "36094": msg37832, + "36095": msg37833, + "36096": msg37834, + "36097": msg37835, + "36098": msg37836, + "36099": msg37837, + "361": select283, + "3610": msg6060, + "36100": msg37838, + "36101": msg37839, + "36102": msg37840, + "36103": msg37841, + "36104": msg37842, + "36105": msg37843, + "36106": msg37844, + "36107": msg37845, + "36108": msg37846, + "36109": msg37847, + "3611": msg6061, + "36110": msg37848, + "36111": msg37849, + "36112": msg37850, + "36113": msg37851, + "36114": msg37852, + "36115": msg37853, + "36116": msg37854, + "36117": msg37855, + "36118": msg37856, + "36119": msg37857, + "3612": msg6062, + "36120": msg37858, + "36121": msg37859, + "36122": msg37860, + "36123": msg37861, + "36124": msg37862, + "36125": msg37863, + "36126": msg37864, + "36127": msg37865, + "36128": msg37866, + "36129": msg37867, + "3613": msg6063, + "36130": msg37868, + "36131": msg37869, + "36132": msg37870, + "36133": msg37871, + "36134": msg37872, + "36135": msg37873, + "36136": msg37874, + "36137": msg37875, + "36138": msg37876, + "36139": msg37877, + "3614": msg6064, + "36140": msg37878, + "36141": msg37879, + "36142": msg37880, + "36143": msg37881, + "36144": msg37882, + "36145": msg37883, + "36146": msg37884, + "36147": msg37885, + "36148": msg37886, + "36149": msg37887, + "3615": msg6065, + "36150": msg37888, + "36151": msg37889, + "36152": msg37890, + "36153": msg37891, + "36154": msg37892, + "36155": msg37893, + "36156": msg37894, + "36157": msg37895, + "36158": msg37896, + "36159": msg37897, + "3616": msg6066, + "36160": msg37898, + "36161": msg37899, + "36162": msg37900, + "36163": msg37901, + "36164": msg37902, + "36165": msg37903, + "36166": msg37904, + "36167": msg37905, + "36168": msg37906, + "36169": msg37907, + "3617": msg6067, + "36170": msg37908, + "36171": msg37909, + "36172": msg37910, + "36173": msg37911, + "36174": msg37912, + "36175": msg37913, + "36176": msg37914, + "36177": msg37915, + "36178": msg37916, + "36179": msg37917, + "3618": msg6068, + "36180": msg37918, + "36181": msg37919, + "36182": msg37920, + "36183": msg37921, + "36184": msg37922, + "36185": msg37923, + "36186": msg37924, + "36187": msg37925, + "36188": msg37926, + "36189": msg37927, + "3619": msg6069, + "36190": msg37928, + "36191": msg37929, + "36192": msg37930, + "36193": msg37931, + "36194": msg37932, + "36195": msg37933, + "36196": msg37934, + "36197": msg37935, + "36198": msg37936, + "36199": msg37937, + "362": select284, + "3620": msg6070, + "36200": msg37938, + "36201": msg37939, + "36202": msg37940, + "36203": msg37941, + "36204": msg37942, + "36205": msg37943, + "36206": msg37944, + "36207": msg37945, + "36208": msg37946, + "36209": msg37947, + "3621": msg6071, + "3622": msg6072, + "36224": msg37948, + "3623": msg6073, + "36231": msg37949, + "36232": msg37950, + "36233": msg37951, + "36234": msg37952, + "36235": msg37953, + "36236": msg37954, + "36237": msg37955, + "36238": msg37956, + "36239": msg37957, + "3624": msg6074, + "36240": msg37958, + "36241": msg37959, + "36242": msg37960, + "36243": msg37961, + "36244": msg37962, + "36245": msg37963, + "36246": msg37964, + "36247": msg37965, + "36248": msg37966, + "36249": msg37967, + "3625": msg6075, + "36250": msg37968, + "36251": msg37969, + "36252": msg37970, + "36253": msg37971, + "36254": msg37972, + "36255": msg37973, + "36256": msg37974, + "36257": msg37975, + "36258": msg37976, + "36259": msg37977, + "3626": msg6076, + "36260": msg37978, + "36261": msg37979, + "36262": msg37980, + "36263": msg37981, + "36264": msg37982, + "36265": msg37983, + "36266": msg37984, + "36267": msg37985, + "36268": msg37986, + "36269": msg37987, + "3627": msg6077, + "36270": msg37988, + "36271": msg37989, + "36272": msg37990, + "36273": msg37991, + "36274": msg37992, + "36275": msg37993, + "36276": msg37994, + "36277": msg37995, + "36278": msg37996, + "36279": msg37997, + "3628": msg6078, + "36280": msg37998, + "36281": msg37999, + "36282": msg38000, + "36283": msg38001, + "36284": msg38002, + "36285": msg38003, + "36286": msg38004, + "36287": msg38005, + "36288": msg38006, + "36289": msg38007, + "3629": msg6079, + "36290": msg38008, + "36291": msg38009, + "36292": msg38010, + "36293": msg38011, + "36294": msg38012, + "36295": msg38013, + "36296": msg38014, + "36297": msg38015, + "36298": msg38016, + "36299": msg38017, + "363": select285, + "3630": msg6080, + "36300": msg38018, + "36301": msg38019, + "36302": msg38020, + "36303": msg38021, + "36304": msg38022, + "36305": msg38023, + "36306": msg38024, + "36307": msg38025, + "36308": msg38026, + "36309": msg38027, + "3631": msg6081, + "36310": msg38028, + "36311": msg38029, + "36312": msg38030, + "36313": msg38031, + "36314": msg38032, + "36315": msg38033, + "36316": msg38034, + "36317": msg38035, + "36318": msg38036, + "36319": msg38037, + "3632": msg6082, + "36320": msg38038, + "36321": msg38039, + "36322": msg38040, + "36323": msg38041, + "36324": msg38042, + "36325": msg38043, + "36326": msg38044, + "36327": msg38045, + "36328": msg38046, + "36329": msg38047, + "3633": msg6083, + "36330": msg38048, + "36331": msg38049, + "36332": msg38050, + "36333": msg38051, + "36334": msg38052, + "36335": msg38053, + "36336": msg38054, + "36337": msg38055, + "36338": msg38056, + "36339": msg38057, + "3634": msg6084, + "36340": msg38058, + "36341": msg38059, + "36342": msg38060, + "36343": msg38061, + "36344": msg38062, + "36345": msg38063, + "36346": msg38064, + "36347": msg38065, + "36348": msg38066, + "36349": msg38067, + "3635": msg6085, + "36350": msg38068, + "36351": msg38069, + "36352": msg38070, + "36353": msg38071, + "36354": msg38072, + "36355": msg38073, + "36356": msg38074, + "36357": msg38075, + "36358": msg38076, + "36359": msg38077, + "3636": msg6086, + "36360": msg38078, + "36361": msg38079, + "36362": msg38080, + "36363": msg38081, + "36364": msg38082, + "36365": msg38083, + "36366": msg38084, + "36367": msg38085, + "36368": msg38086, + "36369": msg38087, + "3637": msg6087, + "36370": msg38088, + "36371": msg38089, + "36372": msg38090, + "36373": msg38091, + "36374": msg38092, + "36375": msg38093, + "36376": msg38094, + "36377": msg38095, + "36378": msg38096, + "36379": msg38097, + "3638": msg6088, + "36380": msg38098, + "36381": msg38099, + "36382": msg38100, + "36383": msg38101, + "36384": msg38102, + "36389": msg38103, + "3639": msg6089, + "36390": msg38104, + "36391": msg38105, + "36392": msg38106, + "36393": msg38107, + "36394": msg38108, + "36395": msg38109, + "36396": msg38110, + "36397": msg38111, + "36398": msg38112, + "36399": msg38113, + "364": select286, + "3640": msg6090, + "36400": msg38114, + "36401": msg38115, + "36402": msg38116, + "36403": msg38117, + "36404": msg38118, + "36405": msg38119, + "36406": msg38120, + "36407": msg38121, + "36408": msg38122, + "36409": msg38123, + "3641": msg6091, + "36410": msg38124, + "36411": msg38125, + "36412": msg38126, + "36413": msg38127, + "36414": msg38128, + "36415": msg38129, + "36416": msg38130, + "36417": msg38131, + "36418": msg38132, + "36419": msg38133, + "3642": msg6092, + "36420": msg38134, + "36421": msg38135, + "36422": msg38136, + "36423": msg38137, + "36424": msg38138, + "36425": msg38139, + "36426": msg38140, + "36427": msg38141, + "36428": msg38142, + "36429": msg38143, + "3643": msg6093, + "36430": msg38144, + "36431": msg38145, + "36432": msg38146, + "36433": msg38147, + "36434": msg38148, + "36435": msg38149, + "36436": msg38150, + "36437": msg38151, + "36438": msg38152, + "36439": msg38153, + "3644": msg6094, + "36440": msg38154, + "36441": msg38155, + "36442": msg38156, + "36443": msg38157, + "36444": msg38158, + "36445": msg38159, + "36446": msg38160, + "36447": msg38161, + "36448": msg38162, + "36449": msg38163, + "3645": msg6095, + "36450": msg38164, + "36451": msg38165, + "36452": msg38166, + "36453": msg38167, + "36454": msg38168, + "36455": msg38169, + "36456": msg38170, + "36457": msg38171, + "36458": msg38172, + "36459": msg38173, + "3646": msg6096, + "36460": msg38174, + "36461": msg38175, + "36462": msg38176, + "36463": msg38177, + "36464": msg38178, + "36465": msg38179, + "36466": msg38180, + "36467": msg38181, + "36468": msg38182, + "36469": msg38183, + "3647": msg6097, + "36470": msg38184, + "36471": msg38185, + "36472": msg38186, + "36473": msg38187, + "36474": msg38188, + "36475": msg38189, + "36476": msg38190, + "36477": msg38191, + "36478": msg38192, + "36479": msg38193, + "3648": msg6098, + "36480": msg38194, + "36481": msg38195, + "36482": msg38196, + "36483": msg38197, + "36484": msg38198, + "36485": msg38199, + "36486": msg38200, + "36487": msg38201, + "36488": msg38202, + "36489": msg38203, + "3649": msg6099, + "36490": msg38204, + "36491": msg38205, + "36492": msg38206, + "36493": msg38207, + "36494": msg38208, + "36495": msg38209, + "36496": msg38210, + "36497": msg38211, + "36498": msg38212, + "36499": msg38213, + "365": select287, + "3650": msg6100, + "36500": msg38214, + "36501": msg38215, + "36502": msg38216, + "36503": msg38217, + "36504": msg38218, + "36505": msg38219, + "36506": msg38220, + "36507": msg38221, + "36508": msg38222, + "36509": msg38223, + "3651": msg6101, + "36510": msg38224, + "36511": msg38225, + "36512": msg38226, + "36513": msg38227, + "36514": msg38228, + "36515": msg38229, + "36516": msg38230, + "36517": msg38231, + "36518": msg38232, + "36519": msg38233, + "3652": msg6102, + "36520": msg38234, + "36521": msg38235, + "36522": msg38236, + "36523": msg38237, + "36524": msg38238, + "36525": msg38239, + "36526": msg38240, + "36527": msg38241, + "36528": msg38242, + "36529": msg38243, + "3653": msg6103, + "36530": msg38244, + "36531": msg38245, + "36532": msg38246, + "36533": msg38247, + "36534": msg38248, + "36535": msg38249, + "36536": msg38250, + "36537": msg38251, + "36538": msg38252, + "36539": msg38253, + "3654": msg6104, + "36540": msg38254, + "36541": msg38255, + "36542": msg38256, + "36543": msg38257, + "36544": msg38258, + "36545": msg38259, + "36546": msg38260, + "36547": msg38261, + "36548": msg38262, + "36549": msg38263, + "3655": msg6105, + "36550": msg38264, + "36551": msg38265, + "36552": msg38266, + "36553": msg38267, + "36554": msg38268, + "36555": msg38269, + "36556": msg38270, + "36557": msg38271, + "36558": msg38272, + "36559": msg38273, + "3656": msg6106, + "36560": msg38274, + "36561": msg38275, + "3657": msg6107, + "3658": msg6108, + "3659": msg6109, + "366": select288, + "3660": msg6110, + "3661": msg6111, + "3662": msg6112, + "3663": msg6113, + "3664": msg6114, + "3665": msg6115, + "3666": msg6116, + "3667": msg6117, + "3668": msg6118, + "3669": msg6119, + "3670": msg6120, + "3671": msg6121, + "3672": msg6122, + "3673": msg6123, + "3674": msg6124, + "3675": msg6125, + "3676": msg6126, + "3677": msg6127, + "3678": msg6128, + "3679": msg6129, + "368": select289, + "3680": msg6130, + "3681": msg6131, + "3682": msg6132, + "3683": msg6133, + "3684": msg6134, + "3685": msg6135, + "3686": msg6136, + "3687": msg6137, + "3688": msg6138, + "3689": msg6139, + "369": select290, + "3690": msg6140, + "3691": msg6141, + "3692": msg6142, + "3693": msg6143, + "3694": msg6144, + "3695": msg6145, + "3696": msg6146, + "3697": msg6147, + "3698": msg6148, + "3699": msg6149, + "370": select291, + "3700": msg6150, + "3701": msg6151, + "3702": msg6152, + "3703": msg6153, + "3704": msg6154, + "3705": msg6155, + "3706": msg6156, + "3707": msg6157, + "3708": msg6158, + "3709": msg6159, + "371": select292, + "3710": msg6160, + "3711": msg6161, + "3712": msg6162, + "3713": msg6163, + "3714": msg6164, + "3715": msg6165, + "3716": msg6166, + "3717": msg6167, + "3718": msg6168, + "3719": msg6169, + "372": select293, + "3720": msg6170, + "3721": msg6171, + "3722": msg6172, + "3723": msg6173, + "3724": msg6174, + "3725": msg6175, + "3726": msg6176, + "3727": msg6177, + "3728": msg6178, + "3729": msg6179, + "373": select294, + "3730": msg6180, + "3731": msg6181, + "3732": msg6182, + "3733": msg6183, + "3734": msg6184, + "3735": msg6185, + "3736": msg6186, + "3737": msg6187, + "3738": msg6188, + "3739": msg6189, + "374": select295, + "3740": msg6190, + "3741": msg6191, + "3742": msg6192, + "3743": msg6193, + "3744": msg6194, + "3745": msg6195, + "3746": msg6196, + "3747": msg6197, + "3748": msg6198, + "3749": msg6199, + "375": select296, + "3750": msg6200, + "3751": msg6201, + "3752": msg6202, + "3753": msg6203, + "3754": msg6204, + "3755": msg6205, + "3756": msg6206, + "3757": msg6207, + "3758": msg6208, + "3759": msg6209, + "376": select297, + "3760": msg6210, + "3761": msg6211, + "3762": msg6212, + "3763": msg6213, + "3764": msg6214, + "3765": msg6215, + "3766": msg6216, + "3767": msg6217, + "3768": msg6218, + "3769": msg6219, + "377": select298, + "3770": msg6220, + "3771": msg6221, + "3772": msg6222, + "3773": msg6223, + "3774": msg6224, + "3775": msg6225, + "3776": msg6226, + "3777": msg6227, + "3778": msg6228, + "3779": msg6229, + "378": select299, + "3780": msg6230, + "3781": msg6231, + "3782": msg6232, + "3783": msg6233, + "3784": msg6234, + "3785": msg6235, + "3786": msg6236, + "3787": msg6237, + "3788": msg6238, + "3789": msg6239, + "379": select300, + "3790": msg6240, + "3791": msg6241, + "3792": msg6242, + "3793": msg6243, + "3794": msg6244, + "3795": msg6245, + "3796": msg6246, + "3797": msg6247, + "3798": msg6248, + "3799": msg6249, + "380": select301, + "3800": msg6250, + "3801": msg6251, + "3802": msg6252, + "3803": msg6253, + "3804": msg6254, + "3805": msg6255, + "3806": msg6256, + "3807": msg6257, + "3808": msg6258, + "3809": msg6259, + "381": select302, + "3810": msg6260, + "3811": msg6261, + "3812": msg6262, + "3813": msg6263, + "3814": msg6264, + "3815": msg6265, + "3816": msg6266, + "3817": msg6267, + "3818": msg6268, + "3819": msg6269, + "382": select303, + "3820": msg6270, + "3821": msg6271, + "3822": msg6272, + "3823": msg6273, + "3824": msg6274, + "3825": msg6275, + "3826": msg6276, + "3827": msg6277, + "3828": msg6278, + "3829": msg6279, + "3830": msg6280, + "3831": msg6281, + "3832": msg6282, + "3833": msg6283, + "3834": msg6284, + "3835": msg6285, + "3836": msg6286, + "3837": msg6287, + "3838": msg6288, + "3839": msg6289, + "384": select304, + "3840": msg6290, + "3841": msg6291, + "3842": msg6292, + "3843": msg6293, + "3844": msg6294, + "3845": msg6295, + "3846": msg6296, + "3847": msg6297, + "3848": msg6298, + "3849": msg6299, + "385": select305, + "3850": msg6300, + "3851": msg6301, + "3852": msg6302, + "3853": msg6303, + "3854": msg6304, + "3855": msg6305, + "3856": msg6306, + "3857": msg6307, + "3858": msg6308, + "3859": msg6309, + "386": select306, + "3860": msg6310, + "3861": msg6311, + "3862": msg6312, + "3863": msg6313, + "3864": msg6314, + "3865": msg6315, + "3866": msg6316, + "3867": msg6317, + "3868": msg6318, + "3869": msg6319, + "387": select307, + "3870": msg6320, + "3871": msg6321, + "3872": msg6322, + "3873": msg6323, + "3874": msg6324, + "3875": msg6325, + "3876": msg6326, + "3877": msg6327, + "3878": msg6328, + "3879": msg6329, + "388": select308, + "3880": msg6330, + "3881": msg6331, + "3882": msg6332, + "3883": msg6333, + "3884": msg6334, + "3885": msg6335, + "3886": msg6336, + "3887": msg6337, + "3888": msg6338, + "3889": msg6339, + "389": select309, + "3890": msg6340, + "3891": msg6341, + "3892": msg6342, + "3893": msg6343, + "3894": msg6344, + "3895": msg6345, + "3896": msg6346, + "3897": msg6347, + "3898": msg6348, + "3899": msg6349, + "390": select310, + "3900": msg6350, + "3901": msg6351, + "3902": msg6352, + "3903": msg6353, + "3904": msg6354, + "3905": msg6355, + "3906": msg6356, + "3907": msg6357, + "3908": msg6358, + "3909": msg6359, + "391": select311, + "3910": msg6360, + "3911": msg6361, + "3912": msg6362, + "3913": msg6363, + "3914": msg6364, + "3915": msg6365, + "3916": msg6366, + "3917": msg6367, + "3918": msg6368, + "3919": msg6369, + "392": select312, + "3920": msg6370, + "3921": msg6371, + "3922": msg6372, + "3923": msg6373, + "3924": msg6374, + "3925": msg6375, + "3926": msg6376, + "3927": msg6377, + "3928": msg6378, + "3929": msg6379, + "393": select313, + "3930": msg6380, + "3931": msg6381, + "3932": msg6382, + "3933": msg6383, + "3934": msg6384, + "3935": msg6385, + "3936": msg6386, + "3937": msg6387, + "3938": msg6388, + "3939": msg6389, + "394": select314, + "3940": msg6390, + "3941": msg6391, + "3942": msg6392, + "3943": msg6393, + "3944": msg6394, + "3945": msg6395, + "3946": msg6396, + "3947": msg6397, + "3948": msg6398, + "3949": msg6399, + "395": select315, + "3950": msg6400, + "3951": msg6401, + "3952": msg6402, + "3953": msg6403, + "3954": msg6404, + "3955": msg6405, + "3956": msg6406, + "3957": msg6407, + "3958": msg6408, + "3959": msg6409, + "396": select316, + "3960": msg6410, + "3961": msg6411, + "3962": msg6412, + "3963": msg6413, + "3964": msg6414, + "3965": msg6415, + "3966": msg6416, + "3967": msg6417, + "3968": msg6418, + "3969": msg6419, + "397": select317, + "3970": msg6420, + "3971": msg6421, + "3972": msg6422, + "3973": msg6423, + "3974": msg6424, + "3975": msg6425, + "3976": msg6426, + "3977": msg6427, + "3978": msg6428, + "3979": msg6429, + "398": select318, + "3980": msg6430, + "3981": msg6431, + "3982": msg6432, + "3983": msg6433, + "3984": msg6434, + "3985": msg6435, + "3986": msg6436, + "3987": msg6437, + "3988": msg6438, + "3989": msg6439, + "399": select319, + "3990": msg6440, + "3991": msg6441, + "3992": msg6442, + "3993": msg6443, + "3994": msg6444, + "3995": msg6445, + "3996": msg6446, + "3997": msg6447, + "3998": msg6448, + "3999": msg6449, + "4": select10, + "400": select320, + "4000": msg6450, + "4001": msg6451, + "4002": msg6452, + "4003": msg6453, + "4004": msg6454, + "4005": msg6455, + "4006": msg6456, + "4007": msg6457, + "4008": msg6458, + "4009": msg6459, + "401": select321, + "4010": msg6460, + "4011": msg6461, + "4012": msg6462, + "4013": msg6463, + "4014": msg6464, + "4015": msg6465, + "4016": msg6466, + "4017": msg6467, + "4018": msg6468, + "4019": msg6469, + "402": select322, + "4020": msg6470, + "4021": msg6471, + "4022": msg6472, + "4023": msg6473, + "4024": msg6474, + "4025": msg6475, + "4026": msg6476, + "4027": msg6477, + "4028": msg6478, + "4029": msg6479, + "403": select323, + "4030": msg6480, + "4031": msg6481, + "4032": msg6482, + "4033": msg6483, + "4034": msg6484, + "4035": msg6485, + "4036": msg6486, + "4037": msg6487, + "4038": msg6488, + "4039": msg6489, + "404": select324, + "4040": msg6490, + "4041": msg6491, + "4042": msg6492, + "4043": msg6493, + "4044": msg6494, + "4045": msg6495, + "4046": msg6496, + "4047": msg6497, + "4048": msg6498, + "4049": msg6499, + "405": select325, + "4050": msg6500, + "4051": msg6501, + "4052": msg6502, + "4053": msg6503, + "4054": msg6504, + "4055": msg6505, + "4056": msg6506, + "4057": msg6507, + "4058": msg6508, + "4059": msg6509, + "406": select326, + "4060": msg6510, + "4061": msg6511, + "4062": msg6512, + "4063": msg6513, + "4064": msg6514, + "4065": msg6515, + "4066": msg6516, + "4067": msg6517, + "4068": msg6518, + "4069": msg6519, + "407": select327, + "4070": msg6520, + "4071": msg6521, + "4072": msg6522, + "4073": msg6523, + "4074": msg6524, + "4075": msg6525, + "4076": msg6526, + "4077": msg6527, + "4078": msg6528, + "4079": msg6529, + "408": select328, + "4080": msg6530, + "4081": msg6531, + "4082": msg6532, + "4083": msg6533, + "4084": msg6534, + "4085": msg6535, + "4086": msg6536, + "4087": msg6537, + "4088": msg6538, + "4089": msg6539, + "409": select329, + "4090": msg6540, + "4091": msg6541, + "4092": msg6542, + "4093": msg6543, + "4094": msg6544, + "4095": msg6545, + "4096": msg6546, + "4097": msg6547, + "4098": msg6548, + "4099": msg6549, + "410": select330, + "4100": msg6550, + "4101": msg6551, + "4102": msg6552, + "4103": msg6553, + "4104": msg6554, + "4105": msg6555, + "4106": msg6556, + "4107": msg6557, + "4108": msg6558, + "4109": msg6559, + "411": select331, + "4110": msg6560, + "4111": msg6561, + "4112": msg6562, + "4113": msg6563, + "4114": msg6564, + "4115": msg6565, + "4116": msg6566, + "4117": msg6567, + "4118": msg6568, + "4119": msg6569, + "412": select332, + "4120": msg6570, + "4121": msg6571, + "4122": msg6572, + "4123": msg6573, + "4124": msg6574, + "4125": msg6575, + "4126": msg6576, + "4127": msg6577, + "4128": msg6578, + "4129": msg6579, + "413": select333, + "4130": msg6580, + "4131": msg6581, + "4132": msg6582, + "4133": msg6583, + "4134": msg6584, + "4135": msg6585, + "4136": msg6586, + "414": select334, + "4140": msg6587, + "4141": msg6588, + "4142": msg6589, + "4143": msg6590, + "4144": msg6591, + "4145": msg6592, + "4146": msg6593, + "4147": msg6594, + "4148": msg6595, + "4149": msg6596, + "415": select335, + "4150": msg6597, + "4151": msg6598, + "4152": msg6599, + "4153": msg6600, + "4154": msg6601, + "4155": msg6602, + "4156": msg6603, + "4157": msg6604, + "4158": msg6605, + "4159": msg6606, + "416": select336, + "4160": msg6607, + "4161": msg6608, + "4162": msg6609, + "4163": msg6610, + "4164": msg6611, + "4165": msg6612, + "4166": msg6613, + "4167": msg6614, + "4168": msg6615, + "4169": msg6616, + "417": select337, + "4170": msg6617, + "4171": msg6618, + "4172": msg6619, + "4173": msg6620, + "4174": msg6621, + "4175": msg6622, + "4176": msg6623, + "4177": msg6624, + "4178": msg6625, + "4179": msg6626, + "418": select338, + "4180": msg6627, + "4181": msg6628, + "4182": msg6629, + "4183": msg6630, + "4184": msg6631, + "4185": msg6632, + "4186": msg6633, + "4187": msg6634, + "4188": msg6635, + "4189": msg6636, + "419": select339, + "4190": msg6637, + "4191": msg6638, + "4192": msg6639, + "4193": msg6640, + "4194": msg6641, + "4195": msg6642, + "4196": msg6643, + "4197": msg6644, + "4198": msg6645, + "4199": msg6646, + "420": select340, + "4200": msg6647, + "4201": msg6648, + "4202": msg6649, + "4203": msg6650, + "4204": msg6651, + "4205": msg6652, + "4206": msg6653, + "4207": msg6654, + "4208": msg6655, + "4209": msg6656, + "421": select341, + "4210": msg6657, + "4211": msg6658, + "4212": msg6659, + "4213": msg6660, + "4214": msg6661, + "4215": msg6662, + "4216": msg6663, + "4217": msg6664, + "4218": msg6665, + "4219": msg6666, + "422": select342, + "4220": msg6667, + "4221": msg6668, + "4222": msg6669, + "4223": msg6670, + "4224": msg6671, + "4225": msg6672, + "4226": msg6673, + "4227": msg6674, + "4228": msg6675, + "4229": msg6676, + "423": select343, + "4230": msg6677, + "4231": msg6678, + "4232": msg6679, + "4233": msg6680, + "4234": msg6681, + "4235": msg6682, + "4236": msg6683, + "4237": msg6684, + "4238": msg6685, + "4239": msg6686, + "424": select344, + "4240": msg6687, + "4241": msg6688, + "4242": msg6689, + "4243": msg6690, + "4244": msg6691, + "4245": msg6692, + "4246": msg6693, + "4247": msg6694, + "4248": msg6695, + "4249": msg6696, + "425": select345, + "4250": msg6697, + "4251": msg6698, + "4252": msg6699, + "4253": msg6700, + "4254": msg6701, + "4255": msg6702, + "4256": msg6703, + "4257": msg6704, + "4258": msg6705, + "4259": msg6706, + "426": select346, + "4260": msg6707, + "4261": msg6708, + "4262": msg6709, + "4263": msg6710, + "4264": msg6711, + "4265": msg6712, + "4266": msg6713, + "4267": msg6714, + "4268": msg6715, + "4269": msg6716, + "427": select347, + "4270": msg6717, + "4271": msg6718, + "4272": msg6719, + "4273": msg6720, + "4274": msg6721, + "4275": msg6722, + "4276": msg6723, + "4277": msg6724, + "4278": msg6725, + "4279": msg6726, + "428": select348, + "4280": msg6727, + "4281": msg6728, + "4282": msg6729, + "4283": msg6730, + "4284": msg6731, + "4285": msg6732, + "4286": msg6733, + "4287": msg6734, + "4288": msg6735, + "4289": msg6736, + "429": select349, + "4290": msg6737, + "4291": msg6738, + "4292": msg6739, + "4293": msg6740, + "4294": msg6741, + "4295": msg6742, + "4296": msg6743, + "4297": msg6744, + "4298": msg6745, + "4299": msg6746, + "430": select350, + "4300": msg6747, + "4301": msg6748, + "4302": msg6749, + "4303": msg6750, + "4304": msg6751, + "4305": msg6752, + "4306": msg6753, + "4307": msg6754, + "4308": msg6755, + "4309": msg6756, + "431": select351, + "4310": msg6757, + "4311": msg6758, + "4312": msg6759, + "4313": msg6760, + "4314": msg6761, + "4315": msg6762, + "4316": msg6763, + "4317": msg6764, + "4318": msg6765, + "4319": msg6766, + "432": select352, + "4320": msg6767, + "4321": msg6768, + "4322": msg6769, + "4323": msg6770, + "4324": msg6771, + "4325": msg6772, + "4326": msg6773, + "4327": msg6774, + "4328": msg6775, + "4329": msg6776, + "433": select353, + "4330": msg6777, + "4331": msg6778, + "4332": msg6779, + "4333": msg6780, + "4334": msg6781, + "4335": msg6782, + "4336": msg6783, + "4337": msg6784, + "4338": msg6785, + "4339": msg6786, + "4340": msg6787, + "4341": msg6788, + "4342": msg6789, + "4343": msg6790, + "4344": msg6791, + "4345": msg6792, + "4346": msg6793, + "4347": msg6794, + "4348": msg6795, + "4349": msg6796, + "4350": msg6797, + "4351": msg6798, + "4352": msg6799, + "4353": msg6800, + "4354": msg6801, + "4355": msg6802, + "4356": msg6803, + "4357": msg6804, + "4358": msg6805, + "4359": msg6806, + "436": select354, + "4360": msg6807, + "4361": msg6808, + "4362": msg6809, + "4363": msg6810, + "4364": msg6811, + "4365": msg6812, + "4366": msg6813, + "4367": msg6814, + "4368": msg6815, + "4369": msg6816, + "437": select355, + "4370": msg6817, + "4371": msg6818, + "4372": msg6819, + "4373": msg6820, + "4374": msg6821, + "4375": msg6822, + "4376": msg6823, + "4377": msg6824, + "4378": msg6825, + "4379": msg6826, + "438": select356, + "4380": msg6827, + "4381": msg6828, + "4382": msg6829, + "4383": msg6830, + "4384": msg6831, + "4385": msg6832, + "4386": msg6833, + "4387": msg6834, + "4388": msg6835, + "4389": msg6836, + "439": select357, + "4390": msg6837, + "4391": msg6838, + "4392": msg6839, + "4393": msg6840, + "4394": msg6841, + "4395": msg6842, + "4396": msg6843, + "4397": msg6844, + "4398": msg6845, + "4399": msg6846, + "440": select358, + "4400": msg6847, + "4401": msg6848, + "4402": msg6849, + "4403": msg6850, + "4404": msg6851, + "4405": msg6852, + "4406": msg6853, + "4407": msg6854, + "4408": msg6855, + "4409": msg6856, + "441": select359, + "4410": msg6857, + "4411": msg6858, + "4412": msg6859, + "4413": msg6860, + "4414": msg6861, + "4415": msg6862, + "4416": msg6863, + "4417": msg6864, + "4418": msg6865, + "4419": msg6866, + "4420": msg6867, + "4421": msg6868, + "4422": msg6869, + "4423": msg6870, + "4424": msg6871, + "4425": msg6872, + "4426": msg6873, + "4427": msg6874, + "4428": msg6875, + "4429": msg6876, + "443": select360, + "4430": msg6877, + "4431": msg6878, + "4432": msg6879, + "4433": msg6880, + "4434": msg6881, + "4435": msg6882, + "4436": msg6883, + "4437": msg6884, + "4438": msg6885, + "4439": msg6886, + "4440": msg6887, + "4441": msg6888, + "4442": msg6889, + "4443": msg6890, + "4444": msg6891, + "4445": msg6892, + "4446": msg6893, + "4447": msg6894, + "4448": msg6895, + "4449": msg6896, + "445": select361, + "4450": msg6897, + "4451": msg6898, + "4452": msg6899, + "4453": msg6900, + "4454": msg6901, + "4455": msg6902, + "4456": msg6903, + "4457": msg6904, + "4458": msg6905, + "4459": msg6906, + "446": select362, + "4460": msg6907, + "4461": msg6908, + "4462": msg6909, + "4463": msg6910, + "4464": msg6911, + "4465": msg6912, + "4466": msg6913, + "4467": msg6914, + "4468": msg6915, + "4469": msg6916, + "4470": msg6917, + "4471": msg6918, + "4472": msg6919, + "4473": msg6920, + "4474": msg6921, + "4475": msg6922, + "4476": msg6923, + "4477": msg6924, + "4478": msg6925, + "4479": msg6926, + "448": select363, + "4480": msg6927, + "4481": msg6928, + "4482": msg6929, + "4483": msg6930, + "4484": msg6931, + "4485": msg6932, + "4486": msg6933, + "4487": msg6934, + "4488": msg6935, + "4489": msg6936, + "449": select364, + "4490": msg6937, + "4491": msg6938, + "4492": msg6939, + "4493": msg6940, + "4494": msg6941, + "4495": msg6942, + "4496": msg6943, + "4497": msg6944, + "4498": msg6945, + "4499": msg6946, + "45": msg66, + "450": select365, + "4500": msg6947, + "4501": msg6948, + "4502": msg6949, + "4503": msg6950, + "4504": msg6951, + "4505": msg6952, + "4506": msg6953, + "4507": msg6954, + "4508": msg6955, + "4509": msg6956, + "451": select366, + "4510": msg6957, + "4511": msg6958, + "4512": msg6959, + "4513": msg6960, + "4514": msg6961, + "4515": msg6962, + "4516": msg6963, + "4517": msg6964, + "4518": msg6965, + "4519": msg6966, + "452": select367, + "4520": msg6967, + "4521": msg6968, + "4522": msg6969, + "4523": msg6970, + "4524": msg6971, + "4525": msg6972, + "4526": msg6973, + "4527": msg6974, + "4528": msg6975, + "4529": msg6976, + "453": select368, + "4530": msg6977, + "4531": msg6978, + "4532": msg6979, + "4533": msg6980, + "4534": msg6981, + "4535": msg6982, + "4536": msg6983, + "4537": msg6984, + "4538": msg6985, + "4539": msg6986, + "454": select369, + "4540": msg6987, + "4541": msg6988, + "4542": msg6989, + "4543": msg6990, + "4544": msg6991, + "4545": msg6992, + "4546": msg6993, + "4547": msg6994, + "4548": msg6995, + "4549": msg6996, + "455": select370, + "4550": msg6997, + "4551": msg6998, + "4552": msg6999, + "4553": msg7000, + "4554": msg7001, + "4555": msg7002, + "4556": msg7003, + "4557": msg7004, + "4558": msg7005, + "4559": msg7006, + "456": select371, + "4560": msg7007, + "4561": msg7008, + "4562": msg7009, + "4563": msg7010, + "4564": msg7011, + "4565": msg7012, + "4566": msg7013, + "4567": msg7014, + "4568": msg7015, + "4569": msg7016, + "457": select372, + "4570": msg7017, + "4571": msg7018, + "4572": msg7019, + "4573": msg7020, + "4574": msg7021, + "4575": msg7022, + "4576": msg7023, + "4577": msg7024, + "4578": msg7025, + "4579": msg7026, + "458": select373, + "4580": msg7027, + "4581": msg7028, + "4582": msg7029, + "4583": msg7030, + "4584": msg7031, + "4585": msg7032, + "4586": msg7033, + "4587": msg7034, + "4588": msg7035, + "4589": msg7036, + "459": select374, + "4590": msg7037, + "4591": msg7038, + "4592": msg7039, + "4593": msg7040, + "4594": msg7041, + "4595": msg7042, + "4596": msg7043, + "4597": msg7044, + "4598": msg7045, + "4599": msg7046, + "46": select25, + "460": select375, + "4600": msg7047, + "4601": msg7048, + "4602": msg7049, + "4603": msg7050, + "4604": msg7051, + "4605": msg7052, + "4606": msg7053, + "4607": msg7054, + "4608": msg7055, + "4609": msg7056, + "461": select376, + "4610": msg7057, + "4611": msg7058, + "4612": msg7059, + "4613": msg7060, + "4614": msg7061, + "4615": msg7062, + "4616": msg7063, + "4617": msg7064, + "4618": msg7065, + "4619": msg7066, + "462": select377, + "4620": msg7067, + "4621": msg7068, + "4622": msg7069, + "4623": msg7070, + "4624": msg7071, + "4625": msg7072, + "4626": msg7073, + "4627": msg7074, + "4628": msg7075, + "4629": msg7076, + "463": select378, + "4630": msg7077, + "4631": msg7078, + "4632": msg7079, + "4633": msg7080, + "4634": msg7081, + "4635": msg7082, + "4636": msg7083, + "4637": msg7084, + "4638": msg7085, + "4639": msg7086, + "4640": msg7087, + "4641": msg7088, + "4642": msg7089, + "4643": msg7090, + "4644": msg7091, + "4645": msg7092, + "4646": msg7093, + "4647": msg7094, + "4648": msg7095, + "4649": msg7096, + "465": select379, + "4650": msg7097, + "4651": msg7098, + "4652": msg7099, + "4653": msg7100, + "4654": msg7101, + "4655": msg7102, + "4656": msg7103, + "4657": msg7104, + "4658": msg7105, + "4659": msg7106, + "466": select380, + "4660": msg7107, + "4661": msg7108, + "4662": msg7109, + "4663": msg7110, + "4664": msg7111, + "4665": msg7112, + "4666": msg7113, + "4667": msg7114, + "4668": msg7115, + "4669": msg7116, + "467": select381, + "4670": msg7117, + "4671": msg7118, + "4672": msg7119, + "4673": msg7120, + "4674": msg7121, + "4675": msg7122, + "4676": msg7123, + "4677": msg7124, + "4678": msg7125, + "4679": msg7126, + "4680": msg7127, + "4681": msg7128, + "4682": msg7129, + "4683": msg7130, + "4684": msg7131, + "4685": msg7132, + "4686": msg7133, + "4687": msg7134, + "4688": msg7135, + "4689": msg7136, + "469": select382, + "4690": msg7137, + "4691": msg7138, + "4692": msg7139, + "4693": msg7140, + "4694": msg7141, + "4695": msg7142, + "4696": msg7143, + "4697": msg7144, + "4698": msg7145, + "4699": msg7146, + "47": select26, + "4700": msg7147, + "4701": msg7148, + "4702": msg7149, + "4703": msg7150, + "4704": msg7151, + "4705": msg7152, + "4706": msg7153, + "4707": msg7154, + "4708": msg7155, + "4709": msg7156, + "471": select383, + "4710": msg7157, + "4711": msg7158, + "4712": msg7159, + "4713": msg7160, + "4714": msg7161, + "4715": msg7162, + "4716": msg7163, + "4717": msg7164, + "4718": msg7165, + "4719": msg7166, + "472": select384, + "4720": msg7167, + "4721": msg7168, + "4722": msg7169, + "4723": msg7170, + "4724": msg7171, + "4725": msg7172, + "4726": msg7173, + "4727": msg7174, + "4728": msg7175, + "4729": msg7176, + "473": select385, + "4730": msg7177, + "4731": msg7178, + "4732": msg7179, + "4733": msg7180, + "4734": msg7181, + "4735": msg7182, + "4736": msg7183, + "4737": msg7184, + "4738": msg7185, + "4739": msg7186, + "474": select386, + "4740": msg7187, + "4741": msg7188, + "4742": msg7189, + "4743": msg7190, + "4744": msg7191, + "4745": msg7192, + "4746": msg7193, + "4747": msg7194, + "4748": msg7195, + "4749": msg7196, + "475": select387, + "4750": msg7197, + "4751": msg7198, + "4752": msg7199, + "4753": msg7200, + "4754": msg7201, + "4755": msg7202, + "4756": msg7203, + "4757": msg7204, + "4758": msg7205, + "4759": msg7206, + "476": select388, + "4760": msg7207, + "4761": msg7208, + "4762": msg7209, + "4763": msg7210, + "4764": msg7211, + "4765": msg7212, + "4766": msg7213, + "4767": msg7214, + "4768": msg7215, + "4769": msg7216, + "477": select389, + "4770": msg7217, + "4771": msg7218, + "4772": msg7219, + "4773": msg7220, + "4774": msg7221, + "4775": msg7222, + "4776": msg7223, + "4777": msg7224, + "4778": msg7225, + "4779": msg7226, + "478": select390, + "4780": msg7227, + "4781": msg7228, + "4782": msg7229, + "4783": msg7230, + "4784": msg7231, + "4785": msg7232, + "4786": msg7233, + "4787": msg7234, + "4788": msg7235, + "4789": msg7236, + "4790": msg7237, + "4791": msg7238, + "4792": msg7239, + "4793": msg7240, + "4794": msg7241, + "4795": msg7242, + "4796": msg7243, + "4797": msg7244, + "4798": msg7245, + "4799": msg7246, + "480": select391, + "4800": msg7247, + "4801": msg7248, + "4802": msg7249, + "4803": msg7250, + "4804": msg7251, + "4805": msg7252, + "4806": msg7253, + "4807": msg7254, + "4808": msg7255, + "4809": msg7256, + "481": select392, + "4810": msg7257, + "4811": msg7258, + "4812": msg7259, + "4813": msg7260, + "4814": msg7261, + "4815": msg7262, + "4816": msg7263, + "4817": msg7264, + "4818": msg7265, + "4819": msg7266, + "482": select393, + "4820": msg7267, + "4821": msg7268, + "4822": msg7269, + "4823": msg7270, + "4824": msg7271, + "4825": msg7272, + "4826": msg7273, + "4827": msg7274, + "4828": msg7275, + "4829": msg7276, + "483": select394, + "4830": msg7277, + "4831": msg7278, + "4832": msg7279, + "4833": msg7280, + "4834": msg7281, + "4835": msg7282, + "4836": msg7283, + "4837": msg7284, + "4838": msg7285, + "4839": msg7286, + "484": select395, + "4840": msg7287, + "4841": msg7288, + "4842": msg7289, + "4843": msg7290, + "4844": msg7291, + "4845": msg7292, + "4846": msg7293, + "4847": msg7294, + "4848": msg7295, + "4849": msg7296, + "485": select396, + "4850": msg7297, + "4851": msg7298, + "4852": msg7299, + "4853": msg7300, + "4854": msg7301, + "4855": msg7302, + "4856": msg7303, + "4857": msg7304, + "4858": msg7305, + "4859": msg7306, + "486": select397, + "4860": msg7307, + "4861": msg7308, + "4862": msg7309, + "4863": msg7310, + "4864": msg7311, + "4865": msg7312, + "4866": msg7313, + "4867": msg7314, + "4868": msg7315, + "4869": msg7316, + "487": select398, + "4870": msg7317, + "4871": msg7318, + "4872": msg7319, + "4873": msg7320, + "4874": msg7321, + "4875": msg7322, + "4876": msg7323, + "4877": msg7324, + "4878": msg7325, + "4879": msg7326, + "488": select399, + "4880": msg7327, + "4881": msg7328, + "4882": msg7329, + "4883": msg7330, + "4884": msg7331, + "4885": msg7332, + "4886": msg7333, + "4887": msg7334, + "4888": msg7335, + "4889": msg7336, + "489": select400, + "4890": msg7337, + "4891": msg7338, + "4892": msg7339, + "4893": msg7340, + "4894": msg7341, + "4895": msg7342, + "4896": msg7343, + "4897": msg7344, + "4898": msg7345, + "4899": msg7346, + "490": select401, + "4900": msg7347, + "4901": msg7348, + "4902": msg7349, + "4903": msg7350, + "4904": msg7351, + "4905": msg7352, + "4906": msg7353, + "4907": msg7354, + "4908": msg7355, + "4909": msg7356, + "491": msg923, + "4910": msg7357, + "4911": msg7358, + "4912": msg7359, + "4913": msg7360, + "4914": msg7361, + "4915": msg7362, + "4916": msg7363, + "4917": msg7364, + "4918": msg7365, + "4919": msg7366, + "492": select402, + "4920": msg7367, + "4921": msg7368, + "4922": msg7369, + "4923": msg7370, + "4924": msg7371, + "4925": msg7372, + "4926": msg7373, + "4927": msg7374, + "4928": msg7375, + "4929": msg7376, + "493": select403, + "4930": msg7377, + "4931": msg7378, + "4932": msg7379, + "4933": msg7380, + "4934": msg7381, + "4935": msg7382, + "4936": msg7383, + "4937": msg7384, + "4938": msg7385, + "4939": msg7386, + "494": select404, + "4940": msg7387, + "4941": msg7388, + "4942": msg7389, + "4943": msg7390, + "4944": msg7391, + "4945": msg7392, + "4946": msg7393, + "4947": msg7394, + "4948": msg7395, + "4949": msg7396, + "495": select405, + "4950": msg7397, + "4951": msg7398, + "4952": msg7399, + "4953": msg7400, + "4954": msg7401, + "4955": msg7402, + "4956": msg7403, + "4957": msg7404, + "4958": msg7405, + "4959": msg7406, + "496": select406, + "4960": msg7407, + "4961": msg7408, + "4962": msg7409, + "4963": msg7410, + "4964": msg7411, + "4965": msg7412, + "4966": msg7413, + "4967": msg7414, + "4968": msg7415, + "4969": msg7416, + "497": select407, + "4970": msg7417, + "4971": msg7418, + "4972": msg7419, + "4973": msg7420, + "4974": msg7421, + "4975": msg7422, + "4976": msg7423, + "4977": msg7424, + "4978": msg7425, + "4979": msg7426, + "498": select408, + "4980": msg7427, + "4981": msg7428, + "4982": msg7429, + "4983": msg7430, + "4984": msg7431, + "4985": msg7432, + "4986": msg7433, + "4987": msg7434, + "4988": msg7435, + "4989": msg7436, + "499": select409, + "4990": msg7437, + "4991": msg7438, + "4992": msg7439, + "4993": msg7440, + "4994": msg7441, + "4995": msg7442, + "4996": msg7443, + "4997": msg7444, + "4998": msg7445, + "4999": msg7446, + "5": msg26, + "500": select410, + "5000": msg7447, + "5001": msg7448, + "5002": msg7449, + "5003": msg7450, + "5004": msg7451, + "5005": msg7452, + "5006": msg7453, + "5007": msg7454, + "5008": msg7455, + "5009": msg7456, + "501": select411, + "5010": msg7457, + "5011": msg7458, + "5012": msg7459, + "5013": msg7460, + "5014": msg7461, + "5015": msg7462, + "5016": msg7463, + "5017": msg7464, + "5018": msg7465, + "5019": msg7466, + "502": select412, + "5020": msg7467, + "5021": msg7468, + "5022": msg7469, + "5023": msg7470, + "5024": msg7471, + "5025": msg7472, + "5026": msg7473, + "5027": msg7474, + "5028": msg7475, + "5029": msg7476, + "503": select413, + "5030": msg7477, + "5031": msg7478, + "5032": msg7479, + "5033": msg7480, + "5034": msg7481, + "5035": msg7482, + "5036": msg7483, + "5037": msg7484, + "5038": msg7485, + "5039": msg7486, + "504": select414, + "5040": msg7487, + "5041": msg7488, + "5042": msg7489, + "5043": msg7490, + "5044": msg7491, + "5045": msg7492, + "5046": msg7493, + "5047": msg7494, + "5048": msg7495, + "5049": msg7496, + "505": select415, + "5050": msg7497, + "5051": msg7498, + "5052": msg7499, + "5053": msg7500, + "5054": msg7501, + "5055": msg7502, + "5056": msg7503, + "5057": msg7504, + "5058": msg7505, + "5059": msg7506, + "506": select416, + "5060": msg7507, + "5061": msg7508, + "5062": msg7509, + "5063": msg7510, + "5064": msg7511, + "5065": msg7512, + "5066": msg7513, + "5067": msg7514, + "5068": msg7515, + "5069": msg7516, + "507": select417, + "5070": msg7517, + "5071": msg7518, + "5072": msg7519, + "5073": msg7520, + "5074": msg7521, + "5075": msg7522, + "5076": msg7523, + "5077": msg7524, + "5078": msg7525, + "5079": msg7526, + "508": select418, + "5080": msg7527, + "5081": msg7528, + "5082": msg7529, + "5083": msg7530, + "5084": msg7531, + "5085": msg7532, + "5086": msg7533, + "5087": msg7534, + "5088": msg7535, + "5089": msg7536, + "509": select419, + "5090": msg7537, + "5091": msg7538, + "5092": msg7539, + "5093": msg7540, + "5094": msg7541, + "5095": msg7542, + "5096": msg7543, + "5097": msg7544, + "5098": msg7545, + "5099": msg7546, + "510": select420, + "5100": msg7547, + "5101": msg7548, + "5102": msg7549, + "5103": msg7550, + "5104": msg7551, + "5105": msg7552, + "5106": msg7553, + "5107": msg7554, + "5108": msg7555, + "5109": msg7556, + "511": select421, + "5110": msg7557, + "5111": msg7558, + "5112": msg7559, + "5113": msg7560, + "5114": msg7561, + "5115": msg7562, + "5116": msg7563, + "5117": msg7564, + "5118": msg7565, + "5119": msg7566, + "512": select422, + "5120": msg7567, + "5121": msg7568, + "5122": msg7569, + "5123": msg7570, + "5124": msg7571, + "5125": msg7572, + "5126": msg7573, + "5127": msg7574, + "5128": msg7575, + "5129": msg7576, + "513": select423, + "5130": msg7577, + "5131": msg7578, + "5132": msg7579, + "5133": msg7580, + "5134": msg7581, + "5135": msg7582, + "5136": msg7583, + "5137": msg7584, + "5138": msg7585, + "5139": msg7586, + "514": select424, + "5140": msg7587, + "5141": msg7588, + "5142": msg7589, + "5143": msg7590, + "5144": msg7591, + "5145": msg7592, + "5146": msg7593, + "5147": msg7594, + "5148": msg7595, + "5149": msg7596, + "5150": msg7597, + "5151": msg7598, + "5152": msg7599, + "5153": msg7600, + "5154": msg7601, + "5155": msg7602, + "5156": msg7603, + "5157": msg7604, + "5158": msg7605, + "5159": msg7606, + "516": select425, + "5160": msg7607, + "5161": msg7608, + "5162": msg7609, + "5163": msg7610, + "5164": msg7611, + "5165": msg7612, + "5166": msg7613, + "5167": msg7614, + "5168": msg7615, + "5169": msg7616, + "517": select426, + "5170": msg7617, + "5171": msg7618, + "5172": msg7619, + "5173": msg7620, + "5174": msg7621, + "5175": msg7622, + "5176": msg7623, + "5177": msg7624, + "5178": msg7625, + "5179": msg7626, + "518": select427, + "5180": msg7627, + "5181": msg7628, + "5182": msg7629, + "5183": msg7630, + "5184": msg7631, + "5185": msg7632, + "5186": msg7633, + "5187": msg7634, + "5188": msg7635, + "5189": msg7636, + "519": select428, + "5190": msg7637, + "5191": msg7638, + "5192": msg7639, + "5193": msg7640, + "5194": msg7641, + "5195": msg7642, + "5196": msg7643, + "5197": msg7644, + "5198": msg7645, + "5199": msg7646, + "520": select429, + "5200": msg7647, + "5201": msg7648, + "5202": msg7649, + "5203": msg7650, + "5204": msg7651, + "5205": msg7652, + "5206": msg7653, + "5207": msg7654, + "5208": msg7655, + "5209": msg7656, + "521": select430, + "5210": msg7657, + "5211": msg7658, + "5212": msg7659, + "5213": msg7660, + "5214": msg7661, + "5215": msg7662, + "5216": msg7663, + "5217": msg7664, + "5218": msg7665, + "5219": msg7666, + "522": select431, + "5220": msg7667, + "5221": msg7668, + "5222": msg7669, + "5223": msg7670, + "5224": msg7671, + "5225": msg7672, + "5226": msg7673, + "5227": msg7674, + "5228": msg7675, + "5229": msg7676, + "523": select432, + "5230": msg7677, + "5231": msg7678, + "5232": msg7679, + "5233": msg7680, + "5234": msg7681, + "5235": msg7682, + "5236": msg7683, + "5237": msg7684, + "5238": msg7685, + "5239": msg7686, + "524": select433, + "5240": msg7687, + "5241": msg7688, + "5242": msg7689, + "5243": msg7690, + "5244": msg7691, + "5245": msg7692, + "5246": msg7693, + "5247": msg7694, + "5248": msg7695, + "5249": msg7696, + "525": select434, + "5250": msg7697, + "5251": msg7698, + "5252": msg7699, + "5253": msg7700, + "5254": msg7701, + "5255": msg7702, + "5256": msg7703, + "5257": msg7704, + "5258": msg7705, + "5259": msg7706, + "526": select435, + "5260": msg7707, + "5261": msg7708, + "5262": msg7709, + "5263": msg7710, + "5264": msg7711, + "5265": msg7712, + "5266": msg7713, + "5267": msg7714, + "5268": msg7715, + "5269": msg7716, + "527": select436, + "5270": msg7717, + "5271": msg7718, + "5272": msg7719, + "5273": msg7720, + "5274": msg7721, + "5275": msg7722, + "5276": msg7723, + "5277": msg7724, + "5278": msg7725, + "5279": msg7726, + "528": select437, + "5280": msg7727, + "5281": msg7728, + "5282": msg7729, + "5283": msg7730, + "5284": msg7731, + "5285": msg7732, + "5286": msg7733, + "5287": msg7734, + "5288": msg7735, + "5289": msg7736, + "529": select438, + "5290": msg7737, + "5291": msg7738, + "5292": msg7739, + "5293": msg7740, + "5294": msg7741, + "5295": msg7742, + "5296": msg7743, + "5297": msg7744, + "5298": msg7745, + "5299": msg7746, + "530": select439, + "5300": msg7747, + "5301": msg7748, + "5302": msg7749, + "5303": msg7750, + "5304": msg7751, + "5305": msg7752, + "5306": msg7753, + "5307": msg7754, + "5308": msg7755, + "5309": msg7756, + "5310": msg7757, + "5311": msg7758, + "5312": msg7759, + "5313": msg7760, + "5314": msg7761, + "5315": msg7762, + "5316": msg7763, + "5317": msg7764, + "5318": msg7765, + "5319": msg7766, + "532": select440, + "5320": msg7767, + "5321": msg7768, + "5322": msg7769, + "5323": msg7770, + "5324": msg7771, + "5325": msg7772, + "5326": msg7773, + "5327": msg7774, + "5328": msg7775, + "5329": msg7776, + "533": select441, + "5330": msg7777, + "5331": msg7778, + "5332": msg7779, + "5333": msg7780, + "5334": msg7781, + "5335": msg7782, + "5336": msg7783, + "5337": msg7784, + "5338": msg7785, + "5339": msg7786, + "534": select442, + "5340": msg7787, + "5341": msg7788, + "5342": msg7789, + "5343": msg7790, + "5344": msg7791, + "5345": msg7792, + "5346": msg7793, + "5347": msg7794, + "5348": msg7795, + "5349": msg7796, + "535": select443, + "5350": msg7797, + "5351": msg7798, + "5352": msg7799, + "5353": msg7800, + "5354": msg7801, + "5355": msg7802, + "5356": msg7803, + "5357": msg7804, + "5358": msg7805, + "5359": msg7806, + "536": select444, + "5360": msg7807, + "5361": msg7808, + "5362": msg7809, + "5363": msg7810, + "5364": msg7811, + "5365": msg7812, + "5366": msg7813, + "5367": msg7814, + "5368": msg7815, + "5369": msg7816, + "537": select445, + "5370": msg7817, + "5371": msg7818, + "5372": msg7819, + "5373": msg7820, + "5374": msg7821, + "5375": msg7822, + "5376": msg7823, + "5377": msg7824, + "5378": msg7825, + "5379": msg7826, + "538": select446, + "5380": msg7827, + "5381": msg7828, + "5382": msg7829, + "5383": msg7830, + "5384": msg7831, + "5385": msg7832, + "5386": msg7833, + "5387": msg7834, + "5388": msg7835, + "5389": msg7836, + "539": select447, + "5390": msg7837, + "5391": msg7838, + "5392": msg7839, + "5393": msg7840, + "5394": msg7841, + "5395": msg7842, + "5396": msg7843, + "5397": msg7844, + "5398": msg7845, + "5399": msg7846, + "54": select27, + "540": select448, + "5400": msg7847, + "5401": msg7848, + "5402": msg7849, + "5403": msg7850, + "5404": msg7851, + "5405": msg7852, + "5406": msg7853, + "5407": msg7854, + "5408": msg7855, + "5409": msg7856, + "541": select449, + "5410": msg7857, + "5411": msg7858, + "5412": msg7859, + "5413": msg7860, + "5414": msg7861, + "5415": msg7862, + "5416": msg7863, + "5417": msg7864, + "5418": msg7865, + "5419": msg7866, + "542": select450, + "5420": msg7867, + "5421": msg7868, + "5422": msg7869, + "5423": msg7870, + "5424": msg7871, + "5425": msg7872, + "5426": msg7873, + "5427": msg7874, + "5428": msg7875, + "5429": msg7876, + "543": select451, + "5430": msg7877, + "5431": msg7878, + "5432": msg7879, + "5433": msg7880, + "5434": msg7881, + "5435": msg7882, + "5436": msg7883, + "5437": msg7884, + "5438": msg7885, + "5439": msg7886, + "544": select452, + "5440": msg7887, + "5441": msg7888, + "5442": msg7889, + "5443": msg7890, + "5444": msg7891, + "5445": msg7892, + "5446": msg7893, + "5447": msg7894, + "5448": msg7895, + "5449": msg7896, + "545": select453, + "5450": msg7897, + "5451": msg7898, + "5452": msg7899, + "5453": msg7900, + "5454": msg7901, + "5455": msg7902, + "5456": msg7903, + "5457": msg7904, + "5458": msg7905, + "5459": msg7906, + "546": select454, + "5460": msg7907, + "5461": msg7908, + "5462": msg7909, + "5463": msg7910, + "5464": msg7911, + "5465": msg7912, + "5466": msg7913, + "5467": msg7914, + "5468": msg7915, + "5469": msg7916, + "547": select455, + "5470": msg7917, + "5471": msg7918, + "5472": msg7919, + "5473": msg7920, + "5474": msg7921, + "5475": msg7922, + "5476": msg7923, + "5477": msg7924, + "5478": msg7925, + "5479": msg7926, + "548": select456, + "5480": msg7927, + "5481": msg7928, + "5482": msg7929, + "5483": msg7930, + "5484": msg7931, + "5485": msg7932, + "5486": msg7933, + "5487": msg7934, + "5488": msg7935, + "5489": msg7936, + "549": select457, + "5490": msg7937, + "5491": msg7938, + "5492": msg7939, + "5493": msg7940, + "5494": msg7941, + "5495": msg7942, + "5496": msg7943, + "5497": msg7944, + "5498": msg7945, + "5499": msg7946, + "55": select28, + "550": select458, + "5500": msg7947, + "5501": msg7948, + "5502": msg7949, + "5503": msg7950, + "5504": msg7951, + "5505": msg7952, + "5506": msg7953, + "5507": msg7954, + "5508": msg7955, + "5509": msg7956, + "551": select459, + "5510": msg7957, + "5511": msg7958, + "5512": msg7959, + "5513": msg7960, + "5514": msg7961, + "5515": msg7962, + "5516": msg7963, + "5517": msg7964, + "5518": msg7965, + "5519": msg7966, + "552": select460, + "5520": msg7967, + "5521": msg7968, + "5522": msg7969, + "5523": msg7970, + "5524": msg7971, + "5525": msg7972, + "5526": msg7973, + "5527": msg7974, + "5528": msg7975, + "5529": msg7976, + "553": select461, + "5530": msg7977, + "5531": msg7978, + "5532": msg7979, + "5533": msg7980, + "5534": msg7981, + "5535": msg7982, + "5536": msg7983, + "5537": msg7984, + "5538": msg7985, + "5539": msg7986, + "554": select462, + "5540": msg7987, + "5541": msg7988, + "5542": msg7989, + "5543": msg7990, + "5544": msg7991, + "5545": msg7992, + "5546": msg7993, + "5547": msg7994, + "5548": msg7995, + "5549": msg7996, + "555": select463, + "5550": msg7997, + "5551": msg7998, + "5552": msg7999, + "5553": msg8000, + "5554": msg8001, + "5555": msg8002, + "5556": msg8003, + "5557": msg8004, + "5558": msg8005, + "5559": msg8006, + "556": select464, + "5560": msg8007, + "5561": msg8008, + "5562": msg8009, + "5563": msg8010, + "5564": msg8011, + "5565": msg8012, + "5566": msg8013, + "5567": msg8014, + "5568": msg8015, + "5569": msg8016, + "557": select465, + "5570": msg8017, + "5571": msg8018, + "5572": msg8019, + "5573": msg8020, + "5574": msg8021, + "5575": msg8022, + "5576": msg8023, + "5577": msg8024, + "5578": msg8025, + "5579": msg8026, + "558": select466, + "5580": msg8027, + "5581": msg8028, + "5582": msg8029, + "5583": msg8030, + "5584": msg8031, + "5585": msg8032, + "5586": msg8033, + "5587": msg8034, + "5588": msg8035, + "5589": msg8036, + "559": select467, + "5590": msg8037, + "5591": msg8038, + "5592": msg8039, + "5593": msg8040, + "5594": msg8041, + "5595": msg8042, + "5596": msg8043, + "5597": msg8044, + "5598": msg8045, + "5599": msg8046, + "560": select468, + "5600": msg8047, + "5601": msg8048, + "5602": msg8049, + "5603": msg8050, + "5604": msg8051, + "5605": msg8052, + "5606": msg8053, + "5607": msg8054, + "5608": msg8055, + "5609": msg8056, + "561": select469, + "5610": msg8057, + "5611": msg8058, + "5612": msg8059, + "5613": msg8060, + "5614": msg8061, + "5615": msg8062, + "5616": msg8063, + "5617": msg8064, + "5618": msg8065, + "5619": msg8066, + "562": select470, + "5620": msg8067, + "5621": msg8068, + "5622": msg8069, + "5623": msg8070, + "5624": msg8071, + "5625": msg8072, + "5626": msg8073, + "5627": msg8074, + "5628": msg8075, + "5629": msg8076, + "563": select471, + "5630": msg8077, + "5631": msg8078, + "5632": msg8079, + "5633": msg8080, + "5634": msg8081, + "5635": msg8082, + "5636": msg8083, + "5637": msg8084, + "5638": msg8085, + "5639": msg8086, + "564": select472, + "5640": msg8087, + "5641": msg8088, + "5642": msg8089, + "5643": msg8090, + "5644": msg8091, + "5645": msg8092, + "5646": msg8093, + "5647": msg8094, + "5648": msg8095, + "5649": msg8096, + "565": select473, + "5650": msg8097, + "5651": msg8098, + "5652": msg8099, + "5653": msg8100, + "5654": msg8101, + "5655": msg8102, + "5656": msg8103, + "5657": msg8104, + "5658": msg8105, + "5659": msg8106, + "566": select474, + "5660": msg8107, + "5661": msg8108, + "5662": msg8109, + "5663": msg8110, + "5664": msg8111, + "5665": msg8112, + "5666": msg8113, + "5667": msg8114, + "5668": msg8115, + "5669": msg8116, + "567": select475, + "5670": msg8117, + "5671": msg8118, + "5672": msg8119, + "5673": msg8120, + "5674": msg8121, + "5675": msg8122, + "5676": msg8123, + "5677": msg8124, + "5678": msg8125, + "5679": msg8126, + "568": select476, + "5680": msg8127, + "5681": msg8128, + "5682": msg8129, + "5683": msg8130, + "5684": msg8131, + "5685": msg8132, + "5686": msg8133, + "5687": msg8134, + "5688": msg8135, + "5689": msg8136, + "569": select477, + "5690": msg8137, + "5691": msg8138, + "5692": msg8139, + "5693": msg8140, + "5694": msg8141, + "5695": msg8142, + "5696": msg8143, + "5697": msg8144, + "5698": msg8145, + "5699": msg8146, + "570": select478, + "5700": msg8147, + "5701": msg8148, + "5702": msg8149, + "5703": msg8150, + "5704": msg8151, + "5705": msg8152, + "5706": msg8153, + "5707": msg8154, + "5708": msg8155, + "5709": msg8156, + "571": select479, + "5710": msg8157, + "5711": msg8158, + "5712": msg8159, + "5713": msg8160, + "5714": msg8161, + "5715": msg8162, + "5716": msg8163, + "5717": msg8164, + "5718": msg8165, + "5719": msg8166, + "572": select480, + "5720": msg8167, + "5721": msg8168, + "5722": msg8169, + "5723": msg8170, + "5724": msg8171, + "5725": msg8172, + "5726": msg8173, + "5727": msg8174, + "5728": msg8175, + "5729": msg8176, + "573": select481, + "5730": msg8177, + "5731": msg8178, + "5732": msg8179, + "5733": msg8180, + "5734": msg8181, + "5735": msg8182, + "5736": msg8183, + "5737": msg8184, + "5738": msg8185, + "5739": msg8186, + "574": select482, + "5740": msg8187, + "5741": msg8188, + "5742": msg8189, + "5743": msg8190, + "5744": msg8191, + "5745": msg8192, + "5746": msg8193, + "5747": msg8194, + "5748": msg8195, + "5749": msg8196, + "575": select483, + "5750": msg8197, + "5751": msg8198, + "5752": msg8199, + "5753": msg8200, + "5754": msg8201, + "5755": msg8202, + "5756": msg8203, + "5757": msg8204, + "5758": msg8205, + "5759": msg8206, + "576": select484, + "5760": msg8207, + "5761": msg8208, + "5762": msg8209, + "5763": msg8210, + "5764": msg8211, + "5765": msg8212, + "5766": msg8213, + "5767": msg8214, + "5768": msg8215, + "5769": msg8216, + "577": select485, + "5770": msg8217, + "5771": msg8218, + "5772": msg8219, + "5773": msg8220, + "5774": msg8221, + "5775": msg8222, + "5776": msg8223, + "5777": msg8224, + "5778": msg8225, + "5779": msg8226, + "578": select486, + "5780": msg8227, + "5781": msg8228, + "5782": msg8229, + "5783": msg8230, + "5784": msg8231, + "5785": msg8232, + "5786": msg8233, + "5787": msg8234, + "5788": msg8235, + "5789": msg8236, + "579": select487, + "5790": msg8237, + "5791": msg8238, + "5792": msg8239, + "5793": msg8240, + "5794": msg8241, + "5795": msg8242, + "5796": msg8243, + "5797": msg8244, + "5798": msg8245, + "5799": msg8246, + "58": select29, + "580": select488, + "5800": msg8247, + "5801": msg8248, + "5802": msg8249, + "5803": msg8250, + "5804": msg8251, + "5805": msg8252, + "5806": msg8253, + "5807": msg8254, + "5808": msg8255, + "5809": msg8256, + "581": select489, + "5810": msg8257, + "5811": msg8258, + "5812": msg8259, + "5813": msg8260, + "5814": msg8261, + "5815": msg8262, + "5816": msg8263, + "5817": msg8264, + "5818": msg8265, + "5819": msg8266, + "582": select490, + "5820": msg8267, + "5821": msg8268, + "5822": msg8269, + "5823": msg8270, + "5824": msg8271, + "5825": msg8272, + "5826": msg8273, + "5827": msg8274, + "5828": msg8275, + "5829": msg8276, + "583": select491, + "5830": msg8277, + "5831": msg8278, + "5832": msg8279, + "5833": msg8280, + "5834": msg8281, + "5835": msg8282, + "5836": msg8283, + "5837": msg8284, + "5838": msg8285, + "5839": msg8286, + "584": select492, + "5840": msg8287, + "5841": msg8288, + "5842": msg8289, + "5843": msg8290, + "5844": msg8291, + "5845": msg8292, + "5846": msg8293, + "5847": msg8294, + "5848": msg8295, + "5849": msg8296, + "585": select493, + "5850": msg8297, + "5851": msg8298, + "5852": msg8299, + "5853": msg8300, + "5854": msg8301, + "5855": msg8302, + "5856": msg8303, + "5857": msg8304, + "5858": msg8305, + "5859": msg8306, + "586": select494, + "5860": msg8307, + "5861": msg8308, + "5862": msg8309, + "5863": msg8310, + "5864": msg8311, + "5865": msg8312, + "5866": msg8313, + "5867": msg8314, + "5868": msg8315, + "5869": msg8316, + "587": select495, + "5870": msg8317, + "5871": msg8318, + "5872": msg8319, + "5873": msg8320, + "5874": msg8321, + "5875": msg8322, + "5876": msg8323, + "5877": msg8324, + "5878": msg8325, + "5879": msg8326, + "588": select496, + "5880": msg8327, + "5881": msg8328, + "5882": msg8329, + "5883": msg8330, + "5884": msg8331, + "5885": msg8332, + "5886": msg8333, + "5887": msg8334, + "5888": msg8335, + "5889": msg8336, + "589": select497, + "5890": msg8337, + "5891": msg8338, + "5892": msg8339, + "5893": msg8340, + "5894": msg8341, + "5895": msg8342, + "5896": msg8343, + "5897": msg8344, + "5898": msg8345, + "5899": msg8346, + "590": select498, + "5900": msg8347, + "5901": msg8348, + "5902": msg8349, + "5903": msg8350, + "5904": msg8351, + "5905": msg8352, + "5906": msg8353, + "5907": msg8354, + "5908": msg8355, + "5909": msg8356, + "591": select499, + "5910": msg8357, + "5911": msg8358, + "5912": msg8359, + "5913": msg8360, + "5914": msg8361, + "5915": msg8362, + "5916": msg8363, + "5917": msg8364, + "5918": msg8365, + "5919": msg8366, + "592": select500, + "5920": msg8367, + "5921": msg8368, + "5922": msg8369, + "5923": msg8370, + "5924": msg8371, + "5925": msg8372, + "5926": msg8373, + "5927": msg8374, + "5928": msg8375, + "5929": msg8376, + "593": select501, + "5930": msg8377, + "5931": msg8378, + "5932": msg8379, + "5933": msg8380, + "5934": msg8381, + "5935": msg8382, + "5936": msg8383, + "5937": msg8384, + "5938": msg8385, + "5939": msg8386, + "594": select502, + "5940": msg8387, + "5941": msg8388, + "5942": msg8389, + "5943": msg8390, + "5944": msg8391, + "5945": msg8392, + "5946": msg8393, + "5947": msg8394, + "5948": msg8395, + "5949": msg8396, + "595": select503, + "5950": msg8397, + "5951": msg8398, + "5952": msg8399, + "5953": msg8400, + "5954": msg8401, + "5955": msg8402, + "5956": msg8403, + "5957": msg8404, + "5958": msg8405, + "5959": msg8406, + "596": select504, + "5960": msg8407, + "5961": msg8408, + "5962": msg8409, + "5963": msg8410, + "5964": msg8411, + "5965": msg8412, + "5966": msg8413, + "5967": msg8414, + "5968": msg8415, + "5969": msg8416, + "597": select505, + "5970": msg8417, + "5971": msg8418, + "5972": msg8419, + "5973": msg8420, + "5974": msg8421, + "5975": msg8422, + "5976": msg8423, + "5977": msg8424, + "5978": msg8425, + "5979": msg8426, + "598": select506, + "5980": msg8427, + "5981": msg8428, + "5982": msg8429, + "5983": msg8430, + "5984": msg8431, + "5985": msg8432, + "5986": msg8433, + "5987": msg8434, + "5988": msg8435, + "5989": msg8436, + "599": select507, + "5990": msg8437, + "5991": msg8438, + "5992": msg8439, + "5993": msg8440, + "5994": msg8441, + "5995": msg8442, + "5996": msg8443, + "5997": msg8444, + "5998": msg8445, + "5999": msg8446, + "6": select11, + "600": select508, + "6000": msg8447, + "6000022": msg38279, + "6000025": msg38281, + "600009": msg38276, + "600010": msg38277, + "600015": msg38278, + "600023": msg38280, + "6001": msg8448, + "6002": msg8449, + "6003": msg8450, + "6004": msg8451, + "6005": msg8452, + "6006": msg8453, + "6007": msg8454, + "6008": msg8455, + "6009": msg8456, + "601": select509, + "6010": msg8457, + "6011": msg8458, + "6012": msg8459, + "6013": msg8460, + "6014": msg8461, + "6015": msg8462, + "6016": msg8463, + "6017": msg8464, + "6018": msg8465, + "6019": msg8466, + "602": select510, + "6020": msg8467, + "6021": msg8468, + "6022": msg8469, + "6023": msg8470, + "6024": msg8471, + "6025": msg8472, + "6026": msg8473, + "6027": msg8474, + "6028": msg8475, + "6029": msg8476, + "603": select511, + "6030": msg8477, + "6031": msg8478, + "6032": msg8479, + "6033": msg8480, + "6034": msg8481, + "6035": msg8482, + "6036": msg8483, + "6037": msg8484, + "6038": msg8485, + "6039": msg8486, + "604": select512, + "6040": msg8487, + "6041": msg8488, + "6042": msg8489, + "6043": msg8490, + "6044": msg8491, + "6045": msg8492, + "6046": msg8493, + "6047": msg8494, + "6048": msg8495, + "6049": msg8496, + "605": select513, + "6050": msg8497, + "6051": msg8498, + "6052": msg8499, + "6053": msg8500, + "6054": msg8501, + "6055": msg8502, + "6056": msg8503, + "6057": msg8504, + "6058": msg8505, + "6059": msg8506, + "606": select514, + "6060": msg8507, + "6061": msg8508, + "6062": msg8509, + "6063": msg8510, + "6064": msg8511, + "6065": msg8512, + "6066": msg8513, + "6067": msg8514, + "6068": msg8515, + "6069": msg8516, + "607": select515, + "6070": msg8517, + "6071": msg8518, + "6072": msg8519, + "6073": msg8520, + "6074": msg8521, + "6075": msg8522, + "6076": msg8523, + "6077": msg8524, + "6078": msg8525, + "6079": msg8526, + "608": select516, + "6080": msg8527, + "6081": msg8528, + "6082": msg8529, + "6083": msg8530, + "6084": msg8531, + "6085": msg8532, + "6086": msg8533, + "6087": msg8534, + "6088": msg8535, + "6089": msg8536, + "609": select517, + "6090": msg8537, + "6091": msg8538, + "6092": msg8539, + "6093": msg8540, + "6094": msg8541, + "6095": msg8542, + "6096": msg8543, + "6097": msg8544, + "6098": msg8545, + "6099": msg8546, + "610": select518, + "6100": msg8547, + "6101": msg8548, + "6102": msg8549, + "6103": msg8550, + "6104": msg8551, + "6105": msg8552, + "6106": msg8553, + "6107": msg8554, + "6108": msg8555, + "6109": msg8556, + "611": select519, + "6110": msg8557, + "6111": msg8558, + "6112": msg8559, + "6113": msg8560, + "6114": msg8561, + "6115": msg8562, + "6116": msg8563, + "6117": msg8564, + "6118": msg8565, + "6119": msg8566, + "612": select520, + "6120": msg8567, + "6121": msg8568, + "6122": msg8569, + "6123": msg8570, + "6124": msg8571, + "6125": msg8572, + "6126": msg8573, + "6127": msg8574, + "6128": msg8575, + "6129": msg8576, + "613": select521, + "6130": msg8577, + "6131": msg8578, + "6132": msg8579, + "6133": msg8580, + "6134": msg8581, + "6135": msg8582, + "6136": msg8583, + "6137": msg8584, + "6138": msg8585, + "6139": msg8586, + "614": select522, + "6140": msg8587, + "6141": msg8588, + "6142": msg8589, + "6143": msg8590, + "6144": msg8591, + "6145": msg8592, + "6146": msg8593, + "6147": msg8594, + "6148": msg8595, + "6149": msg8596, + "615": select523, + "6150": msg8597, + "6151": msg8598, + "6152": msg8599, + "6153": msg8600, + "6154": msg8601, + "6155": msg8602, + "6156": msg8603, + "6157": msg8604, + "6158": msg8605, + "6159": msg8606, + "616": select524, + "6160": msg8607, + "6161": msg8608, + "6162": msg8609, + "6163": msg8610, + "6164": msg8611, + "6165": msg8612, + "6166": msg8613, + "6167": msg8614, + "6168": msg8615, + "6169": msg8616, + "617": select525, + "6170": msg8617, + "6171": msg8618, + "6172": msg8619, + "6173": msg8620, + "6174": msg8621, + "6175": msg8622, + "6176": msg8623, + "6177": msg8624, + "6178": msg8625, + "6179": msg8626, + "618": select526, + "6180": msg8627, + "6181": msg8628, + "6182": msg8629, + "6183": msg8630, + "6184": msg8631, + "6185": msg8632, + "6186": msg8633, + "6187": msg8634, + "6188": msg8635, + "6189": msg8636, + "619": select527, + "6190": msg8637, + "6191": msg8638, + "6192": msg8639, + "6193": msg8640, + "6194": msg8641, + "6195": msg8642, + "6196": msg8643, + "6197": msg8644, + "6198": msg8645, + "6199": msg8646, + "620": select528, + "6200": msg8647, + "6201": msg8648, + "6202": msg8649, + "6203": msg8650, + "6204": msg8651, + "6205": msg8652, + "6206": msg8653, + "6207": msg8654, + "6208": msg8655, + "6209": msg8656, + "621": select529, + "6210": msg8657, + "6211": msg8658, + "6212": msg8659, + "6213": msg8660, + "6214": msg8661, + "6215": msg8662, + "6216": msg8663, + "6217": msg8664, + "6218": msg8665, + "6219": msg8666, + "622": select530, + "6220": msg8667, + "6221": msg8668, + "6222": msg8669, + "6223": msg8670, + "6224": msg8671, + "6225": msg8672, + "6226": msg8673, + "6227": msg8674, + "6228": msg8675, + "6229": msg8676, + "623": select531, + "6230": msg8677, + "6231": msg8678, + "6232": msg8679, + "6233": msg8680, + "6234": msg8681, + "6235": msg8682, + "6236": msg8683, + "6237": msg8684, + "6238": msg8685, + "6239": msg8686, + "624": select532, + "6240": msg8687, + "6241": msg8688, + "6242": msg8689, + "6243": msg8690, + "6244": msg8691, + "6245": msg8692, + "6246": msg8693, + "6247": msg8694, + "6248": msg8695, + "6249": msg8696, + "625": select533, + "6250": msg8697, + "6251": msg8698, + "6252": msg8699, + "6253": msg8700, + "6254": msg8701, + "6255": msg8702, + "6256": msg8703, + "6257": msg8704, + "6258": msg8705, + "6259": msg8706, + "626": select534, + "6260": msg8707, + "6261": msg8708, + "6262": msg8709, + "6263": msg8710, + "6264": msg8711, + "6265": msg8712, + "6266": msg8713, + "6267": msg8714, + "6268": msg8715, + "6269": msg8716, + "627": select535, + "6270": msg8717, + "6271": msg8718, + "6272": msg8719, + "6273": msg8720, + "6274": msg8721, + "6275": msg8722, + "6276": msg8723, + "6277": msg8724, + "6278": msg8725, + "6279": msg8726, + "628": select536, + "6280": msg8727, + "6281": msg8728, + "6282": msg8729, + "6283": msg8730, + "6284": msg8731, + "6285": msg8732, + "6286": msg8733, + "6287": msg8734, + "6288": msg8735, + "6289": msg8736, + "629": select537, + "6290": msg8737, + "6291": msg8738, + "6292": msg8739, + "6293": msg8740, + "6294": msg8741, + "6295": msg8742, + "6296": msg8743, + "6297": msg8744, + "6298": msg8745, + "6299": msg8746, + "630": select538, + "6300": msg8747, + "6301": msg8748, + "6302": msg8749, + "6303": msg8750, + "6304": msg8751, + "6305": msg8752, + "6306": msg8753, + "6307": msg8754, + "6308": msg8755, + "6309": msg8756, + "631": select539, + "6310": msg8757, + "6311": msg8758, + "6312": msg8759, + "6313": msg8760, + "6314": msg8761, + "6315": msg8762, + "6316": msg8763, + "6317": msg8764, + "6318": msg8765, + "6319": msg8766, + "632": select540, + "6320": msg8767, + "6321": msg8768, + "6322": msg8769, + "6323": msg8770, + "6324": msg8771, + "6325": msg8772, + "6326": msg8773, + "6327": msg8774, + "6328": msg8775, + "6329": msg8776, + "6330": msg8777, + "6331": msg8778, + "6332": msg8779, + "6333": msg8780, + "6334": msg8781, + "6335": msg8782, + "6336": msg8783, + "6337": msg8784, + "6338": msg8785, + "6339": msg8786, + "634": select541, + "6340": msg8787, + "6341": msg8788, + "6342": msg8789, + "6343": msg8790, + "6344": msg8791, + "6345": msg8792, + "6346": msg8793, + "6347": msg8794, + "6348": msg8795, + "6349": msg8796, + "635": select542, + "6350": msg8797, + "6351": msg8798, + "6352": msg8799, + "6353": msg8800, + "6354": msg8801, + "6355": msg8802, + "6356": msg8803, + "6357": msg8804, + "6358": msg8805, + "6359": msg8806, + "636": select543, + "6360": msg8807, + "6361": msg8808, + "6362": msg8809, + "6363": msg8810, + "6364": msg8811, + "6365": msg8812, + "6366": msg8813, + "6367": msg8814, + "6368": msg8815, + "6369": msg8816, + "637": select544, + "6370": msg8817, + "6371": msg8818, + "6372": msg8819, + "6373": msg8820, + "6374": msg8821, + "6375": msg8822, + "6376": msg8823, + "6377": msg8824, + "6378": msg8825, + "6379": msg8826, + "638": select545, + "6380": msg8827, + "6381": msg8828, + "6382": msg8829, + "6383": msg8830, + "6384": msg8831, + "6385": msg8832, + "6386": msg8833, + "6387": msg8834, + "6388": msg8835, + "6389": msg8836, + "639": select546, + "6390": msg8837, + "6391": msg8838, + "6392": msg8839, + "6393": msg8840, + "6394": msg8841, + "6395": msg8842, + "6396": msg8843, + "6397": msg8844, + "6398": msg8845, + "6399": msg8846, + "640": select547, + "6400": msg8847, + "6401": msg8848, + "6402": msg8849, + "6403": msg8850, + "6404": msg8851, + "6405": msg8852, + "6406": msg8853, + "6407": msg8854, + "6408": msg8855, + "6409": msg8856, + "641": select548, + "6410": msg8857, + "6411": msg8858, + "6412": msg8859, + "6413": msg8860, + "6414": msg8861, + "6415": msg8862, + "6416": msg8863, + "6417": msg8864, + "6418": msg8865, + "6419": msg8866, + "642": select549, + "6420": msg8867, + "6421": msg8868, + "6422": msg8869, + "6423": msg8870, + "6424": msg8871, + "6425": msg8872, + "6426": msg8873, + "6427": msg8874, + "6428": msg8875, + "6429": msg8876, + "643": select550, + "6430": msg8877, + "6431": msg8878, + "6432": msg8879, + "6433": msg8880, + "6434": msg8881, + "6435": msg8882, + "6436": msg8883, + "6437": msg8884, + "6438": msg8885, + "6439": msg8886, + "644": select551, + "6440": msg8887, + "6441": msg8888, + "6442": msg8889, + "6443": msg8890, + "6444": msg8891, + "6445": msg8892, + "6446": msg8893, + "6447": msg8894, + "6448": msg8895, + "6449": msg8896, + "645": select552, + "6450": msg8897, + "6451": msg8898, + "6452": msg8899, + "6453": msg8900, + "6454": msg8901, + "6455": msg8902, + "6456": msg8903, + "6457": msg8904, + "6458": msg8905, + "6459": msg8906, + "646": select553, + "6460": msg8907, + "6461": msg8908, + "6462": msg8909, + "6463": msg8910, + "6464": msg8911, + "6465": msg8912, + "6466": msg8913, + "6467": msg8914, + "6468": msg8915, + "6469": msg8916, + "647": select554, + "6470": msg8917, + "6471": msg8918, + "6472": msg8919, + "6473": msg8920, + "6474": msg8921, + "6475": msg8922, + "6476": msg8923, + "6477": msg8924, + "6478": msg8925, + "6479": msg8926, + "648": select555, + "6480": msg8927, + "6481": msg8928, + "6482": msg8929, + "6483": msg8930, + "6484": msg8931, + "6485": msg8932, + "6486": msg8933, + "6487": msg8934, + "6488": msg8935, + "6489": msg8936, + "649": select556, + "6490": msg8937, + "6491": msg8938, + "6492": msg8939, + "6493": msg8940, + "6494": msg8941, + "6495": msg8942, + "6496": msg8943, + "6497": msg8944, + "6498": msg8945, + "6499": msg8946, + "650": select557, + "6500": msg8947, + "6501": msg8948, + "6502": msg8949, + "6503": msg8950, + "6504": msg8951, + "6505": msg8952, + "6506": msg8953, + "6507": msg8954, + "6508": msg8955, + "6509": msg8956, + "651": select558, + "6510": msg8957, + "6511": msg8958, + "6512": msg8959, + "6513": msg8960, + "6514": msg8961, + "6515": msg8962, + "6516": msg8963, + "6517": msg8964, + "6518": msg8965, + "6519": msg8966, + "652": select559, + "6520": msg8967, + "6521": msg8968, + "6522": msg8969, + "6523": msg8970, + "6524": msg8971, + "6525": msg8972, + "6526": msg8973, + "6527": msg8974, + "6528": msg8975, + "6529": msg8976, + "653": select560, + "6530": msg8977, + "6531": msg8978, + "6532": msg8979, + "6533": msg8980, + "6534": msg8981, + "6535": msg8982, + "6536": msg8983, + "6537": msg8984, + "6538": msg8985, + "6539": msg8986, + "654": select561, + "6540": msg8987, + "6541": msg8988, + "6542": msg8989, + "6543": msg8990, + "6544": msg8991, + "6545": msg8992, + "6546": msg8993, + "6547": msg8994, + "6548": msg8995, + "6549": msg8996, + "655": select562, + "6550": msg8997, + "6551": msg8998, + "6552": msg8999, + "6553": msg9000, + "6554": msg9001, + "6555": msg9002, + "6556": msg9003, + "6557": msg9004, + "6558": msg9005, + "6559": msg9006, + "656": select563, + "6560": msg9007, + "6561": msg9008, + "6562": msg9009, + "6563": msg9010, + "6564": msg9011, + "6565": msg9012, + "6566": msg9013, + "6567": msg9014, + "6568": msg9015, + "6569": msg9016, + "657": select564, + "6570": msg9017, + "6571": msg9018, + "6572": msg9019, + "6573": msg9020, + "6574": msg9021, + "6575": msg9022, + "6576": msg9023, + "6577": msg9024, + "6578": msg9025, + "6579": msg9026, + "658": select565, + "6580": msg9027, + "6581": msg9028, + "6582": msg9029, + "6583": msg9030, + "6584": msg9031, + "6585": msg9032, + "6586": msg9033, + "6587": msg9034, + "6588": msg9035, + "6589": msg9036, + "659": select566, + "6590": msg9037, + "6591": msg9038, + "6592": msg9039, + "6593": msg9040, + "6594": msg9041, + "6595": msg9042, + "6596": msg9043, + "6597": msg9044, + "6598": msg9045, + "6599": msg9046, + "660": select567, + "6600": msg9047, + "6601": msg9048, + "6602": msg9049, + "6603": msg9050, + "6604": msg9051, + "6605": msg9052, + "6606": msg9053, + "6607": msg9054, + "6608": msg9055, + "6609": msg9056, + "661": select568, + "6610": msg9057, + "6611": msg9058, + "6612": msg9059, + "6613": msg9060, + "6614": msg9061, + "6615": msg9062, + "6616": msg9063, + "6617": msg9064, + "6618": msg9065, + "6619": msg9066, + "662": select569, + "6620": msg9067, + "6621": msg9068, + "6622": msg9069, + "6623": msg9070, + "6624": msg9071, + "6625": msg9072, + "6626": msg9073, + "6627": msg9074, + "6628": msg9075, + "6629": msg9076, + "663": select570, + "6630": msg9077, + "6631": msg9078, + "6632": msg9079, + "6633": msg9080, + "6634": msg9081, + "6635": msg9082, + "6636": msg9083, + "6637": msg9084, + "6638": msg9085, + "6639": msg9086, + "664": select571, + "6640": msg9087, + "6641": msg9088, + "6642": msg9089, + "6643": msg9090, + "6644": msg9091, + "6645": msg9092, + "6646": msg9093, + "6647": msg9094, + "6648": msg9095, + "6649": msg9096, + "665": select572, + "6650": msg9097, + "6651": msg9098, + "6652": msg9099, + "6653": msg9100, + "6654": msg9101, + "6655": msg9102, + "6656": msg9103, + "6657": msg9104, + "6658": msg9105, + "6659": msg9106, + "666": select573, + "6660": msg9107, + "6661": msg9108, + "6662": msg9109, + "6663": msg9110, + "6664": msg9111, + "6665": msg9112, + "6666": msg9113, + "6667": msg9114, + "6668": msg9115, + "6669": msg9116, + "667": select574, + "6670": msg9117, + "6671": msg9118, + "6672": msg9119, + "6673": msg9120, + "6674": msg9121, + "6675": msg9122, + "6676": msg9123, + "6677": msg9124, + "6678": msg9125, + "6679": msg9126, + "668": select575, + "6680": msg9127, + "6681": msg9128, + "6682": msg9129, + "6683": msg9130, + "6684": msg9131, + "6685": msg9132, + "6686": msg9133, + "6687": msg9134, + "6688": msg9135, + "6689": msg9136, + "669": select576, + "6690": msg9137, + "6691": msg9138, + "6692": msg9139, + "6693": msg9140, + "6694": msg9141, + "6695": msg9142, + "6696": msg9143, + "6697": msg9144, + "6698": msg9145, + "6699": msg9146, + "670": select577, + "6700": msg9147, + "6701": msg9148, + "6702": msg9149, + "6703": msg9150, + "6704": msg9151, + "6705": msg9152, + "6706": msg9153, + "6707": msg9154, + "6708": msg9155, + "6709": msg9156, + "671": select578, + "6710": msg9157, + "6711": msg9158, + "6712": msg9159, + "6713": msg9160, + "6714": msg9161, + "6715": msg9162, + "6716": msg9163, + "6717": msg9164, + "6718": msg9165, + "6719": msg9166, + "672": select579, + "6720": msg9167, + "6721": msg9168, + "6722": msg9169, + "6723": msg9170, + "6724": msg9171, + "6725": msg9172, + "6726": msg9173, + "6727": msg9174, + "6728": msg9175, + "6729": msg9176, + "673": select580, + "6730": msg9177, + "6731": msg9178, + "6732": msg9179, + "6733": msg9180, + "6734": msg9181, + "6735": msg9182, + "6736": msg9183, + "6737": msg9184, + "6738": msg9185, + "6739": msg9186, + "674": select581, + "6740": msg9187, + "6741": msg9188, + "6742": msg9189, + "6743": msg9190, + "6744": msg9191, + "6745": msg9192, + "6746": msg9193, + "6747": msg9194, + "6748": msg9195, + "6749": msg9196, + "675": select582, + "6750": msg9197, + "6751": msg9198, + "6752": msg9199, + "6753": msg9200, + "6754": msg9201, + "6755": msg9202, + "6756": msg9203, + "6757": msg9204, + "6758": msg9205, + "6759": msg9206, + "676": select583, + "6760": msg9207, + "6761": msg9208, + "6762": msg9209, + "6763": msg9210, + "6764": msg9211, + "6765": msg9212, + "6766": msg9213, + "6767": msg9214, + "6768": msg9215, + "6769": msg9216, + "677": select584, + "6770": msg9217, + "6771": msg9218, + "6772": msg9219, + "6773": msg9220, + "6774": msg9221, + "6775": msg9222, + "6776": msg9223, + "6777": msg9224, + "6778": msg9225, + "6779": msg9226, + "678": select585, + "6780": msg9227, + "6781": msg9228, + "6782": msg9229, + "6783": msg9230, + "6784": msg9231, + "6785": msg9232, + "6786": msg9233, + "6787": msg9234, + "6788": msg9235, + "6789": msg9236, + "679": select586, + "6790": msg9237, + "6791": msg9238, + "6792": msg9239, + "6793": msg9240, + "6794": msg9241, + "6795": msg9242, + "6796": msg9243, + "6797": msg9244, + "6798": msg9245, + "6799": msg9246, + "680": select587, + "6800": msg9247, + "6801": msg9248, + "6802": msg9249, + "6803": msg9250, + "6804": msg9251, + "6805": msg9252, + "6806": msg9253, + "6807": msg9254, + "6808": msg9255, + "6809": msg9256, + "681": select588, + "6810": msg9257, + "6811": msg9258, + "6812": msg9259, + "6813": msg9260, + "6814": msg9261, + "6815": msg9262, + "6816": msg9263, + "6817": msg9264, + "6818": msg9265, + "6819": msg9266, + "682": select589, + "6820": msg9267, + "6821": msg9268, + "6822": msg9269, + "6823": msg9270, + "6824": msg9271, + "6825": msg9272, + "6826": msg9273, + "6827": msg9274, + "6828": msg9275, + "6829": msg9276, + "683": select590, + "6830": msg9277, + "6831": msg9278, + "6832": msg9279, + "6833": msg9280, + "6834": msg9281, + "6835": msg9282, + "6836": msg9283, + "6837": msg9284, + "6838": msg9285, + "6839": msg9286, + "684": select591, + "6840": msg9287, + "6841": msg9288, + "6842": msg9289, + "6843": msg9290, + "6844": msg9291, + "6845": msg9292, + "6846": msg9293, + "6847": msg9294, + "6848": msg9295, + "6849": msg9296, + "685": select592, + "6850": msg9297, + "6851": msg9298, + "6852": msg9299, + "6853": msg9300, + "6854": msg9301, + "6855": msg9302, + "6856": msg9303, + "6857": msg9304, + "6858": msg9305, + "6859": msg9306, + "686": select593, + "6860": msg9307, + "6861": msg9308, + "6862": msg9309, + "6863": msg9310, + "6864": msg9311, + "6865": msg9312, + "6866": msg9313, + "6867": msg9314, + "6868": msg9315, + "6869": msg9316, + "687": select594, + "6870": msg9317, + "6871": msg9318, + "6872": msg9319, + "6873": msg9320, + "6874": msg9321, + "6875": msg9322, + "6876": msg9323, + "6877": msg9324, + "6878": msg9325, + "6879": msg9326, + "688": select595, + "6880": msg9327, + "6881": msg9328, + "6882": msg9329, + "6883": msg9330, + "6884": msg9331, + "6885": msg9332, + "6886": msg9333, + "6887": msg9334, + "6888": msg9335, + "6889": msg9336, + "689": select596, + "6890": msg9337, + "6891": msg9338, + "6892": msg9339, + "6893": msg9340, + "6894": msg9341, + "6895": msg9342, + "6896": msg9343, + "6897": msg9344, + "6898": msg9345, + "6899": msg9346, + "690": select597, + "6900": msg9347, + "6901": msg9348, + "6902": msg9349, + "6903": msg9350, + "6904": msg9351, + "6905": msg9352, + "6906": msg9353, + "6907": msg9354, + "6908": msg9355, + "6909": msg9356, + "691": select598, + "6910": msg9357, + "6911": msg9358, + "6912": msg9359, + "6913": msg9360, + "6914": msg9361, + "6915": msg9362, + "6916": msg9363, + "6917": msg9364, + "6918": msg9365, + "6919": msg9366, + "692": select599, + "6920": msg9367, + "6921": msg9368, + "6922": msg9369, + "6923": msg9370, + "6924": msg9371, + "6925": msg9372, + "6926": msg9373, + "6927": msg9374, + "6928": msg9375, + "6929": msg9376, + "693": select600, + "6930": msg9377, + "6931": msg9378, + "6932": msg9379, + "6933": msg9380, + "6934": msg9381, + "6935": msg9382, + "6936": msg9383, + "6937": msg9384, + "6938": msg9385, + "6939": msg9386, + "694": select601, + "6940": msg9387, + "6941": msg9388, + "6942": msg9389, + "6943": msg9390, + "6944": msg9391, + "6945": msg9392, + "6946": msg9393, + "6947": msg9394, + "6948": msg9395, + "6949": msg9396, + "695": select602, + "6950": msg9397, + "6951": msg9398, + "6952": msg9399, + "6953": msg9400, + "6954": msg9401, + "6955": msg9402, + "6956": msg9403, + "6957": msg9404, + "6958": msg9405, + "6959": msg9406, + "696": select603, + "6960": msg9407, + "6961": msg9408, + "6962": msg9409, + "6963": msg9410, + "6964": msg9411, + "6965": msg9412, + "6966": msg9413, + "6967": msg9414, + "6968": msg9415, + "6969": msg9416, + "697": select604, + "6970": msg9417, + "6971": msg9418, + "6972": msg9419, + "6973": msg9420, + "6974": msg9421, + "6975": msg9422, + "6976": msg9423, + "6977": msg9424, + "6978": msg9425, + "6979": msg9426, + "698": select605, + "6980": msg9427, + "6981": msg9428, + "6982": msg9429, + "6983": msg9430, + "6984": msg9431, + "6985": msg9432, + "6986": msg9433, + "6987": msg9434, + "6988": msg9435, + "6989": msg9436, + "699": select606, + "6990": msg9437, + "6991": msg9438, + "6992": msg9439, + "6993": msg9440, + "6994": msg9441, + "6995": msg9442, + "6996": msg9443, + "6997": msg9444, + "6998": msg9445, + "6999": msg9446, + "7": select12, + "700": select607, + "7000": msg9447, + "7001": msg9448, + "7002": msg9449, + "7003": msg9450, + "7004": msg9451, + "7005": msg9452, + "7006": msg9453, + "7007": msg9454, + "7008": msg9455, + "7009": msg9456, + "701": select608, + "7010": msg9457, + "7011": msg9458, + "7012": msg9459, + "7013": msg9460, + "7014": msg9461, + "7015": msg9462, + "7016": msg9463, + "7017": msg9464, + "7018": msg9465, + "7019": msg9466, + "702": select609, + "7020": msg9467, + "7021": msg9468, + "7022": msg9469, + "7023": msg9470, + "7024": msg9471, + "7025": msg9472, + "7026": msg9473, + "7027": msg9474, + "7028": msg9475, + "7029": msg9476, + "703": select610, + "7030": msg9477, + "7031": msg9478, + "7032": msg9479, + "7033": msg9480, + "7034": msg9481, + "7035": msg9482, + "7036": msg9483, + "7037": msg9484, + "7038": msg9485, + "7039": msg9486, + "704": select611, + "7040": msg9487, + "7041": msg9488, + "7042": msg9489, + "7043": msg9490, + "7044": msg9491, + "7045": msg9492, + "7046": msg9493, + "7047": msg9494, + "7048": msg9495, + "7049": msg9496, + "705": select612, + "7050": msg9497, + "7051": msg9498, + "7052": msg9499, + "7053": msg9500, + "7054": msg9501, + "7055": msg9502, + "7056": msg9503, + "7057": msg9504, + "7058": msg9505, + "7059": msg9506, + "706": select613, + "7060": msg9507, + "7061": msg9508, + "7062": msg9509, + "7063": msg9510, + "7064": msg9511, + "7065": msg9512, + "7066": msg9513, + "7067": msg9514, + "7068": msg9515, + "7069": msg9516, + "707": select614, + "7070": msg9517, + "7071": msg9518, + "7072": msg9519, + "7073": msg9520, + "7074": msg9521, + "7075": msg9522, + "7076": msg9523, + "7077": msg9524, + "7078": msg9525, + "7079": msg9526, + "708": select615, + "7080": msg9527, + "7081": msg9528, + "7082": msg9529, + "7083": msg9530, + "7084": msg9531, + "7085": msg9532, + "7086": msg9533, + "7087": msg9534, + "7088": msg9535, + "7089": msg9536, + "709": select616, + "7090": msg9537, + "7091": msg9538, + "7092": msg9539, + "7093": msg9540, + "7094": msg9541, + "7095": msg9542, + "7096": msg9543, + "7097": msg9544, + "7098": msg9545, + "7099": msg9546, + "710": select617, + "7100": msg9547, + "7101": msg9548, + "7102": msg9549, + "7103": msg9550, + "7104": msg9551, + "7105": msg9552, + "7106": msg9553, + "7107": msg9554, + "7108": msg9555, + "7109": msg9556, + "711": select618, + "7110": msg9557, + "7111": msg9558, + "7112": msg9559, + "7113": msg9560, + "7114": msg9561, + "7115": msg9562, + "7116": msg9563, + "7117": msg9564, + "7118": msg9565, + "7119": msg9566, + "712": select619, + "7120": msg9567, + "7121": msg9568, + "7122": msg9569, + "7123": msg9570, + "7124": msg9571, + "7125": msg9572, + "7126": msg9573, + "7127": msg9574, + "7128": msg9575, + "7129": msg9576, + "713": select620, + "7130": msg9577, + "7131": msg9578, + "7132": msg9579, + "7133": msg9580, + "7134": msg9581, + "7135": msg9582, + "7136": msg9583, + "7137": msg9584, + "7138": msg9585, + "7139": msg9586, + "714": select621, + "7140": msg9587, + "7141": msg9588, + "7142": msg9589, + "7143": msg9590, + "7144": msg9591, + "7145": msg9592, + "7146": msg9593, + "7147": msg9594, + "7148": msg9595, + "7149": msg9596, + "715": select622, + "7150": msg9597, + "7151": msg9598, + "7152": msg9599, + "7153": msg9600, + "7154": msg9601, + "7155": msg9602, + "7156": msg9603, + "7157": msg9604, + "7158": msg9605, + "7159": msg9606, + "716": select623, + "7160": msg9607, + "7161": msg9608, + "7162": msg9609, + "7163": msg9610, + "7164": msg9611, + "7165": msg9612, + "7166": msg9613, + "7167": msg9614, + "7168": msg9615, + "7169": msg9616, + "717": select624, + "7170": msg9617, + "7171": msg9618, + "7172": msg9619, + "7173": msg9620, + "7174": msg9621, + "7175": msg9622, + "7176": msg9623, + "7177": msg9624, + "7178": msg9625, + "7179": msg9626, + "718": select625, + "7180": msg9627, + "7181": msg9628, + "7182": msg9629, + "7183": msg9630, + "7184": msg9631, + "7185": msg9632, + "7186": msg9633, + "7187": msg9634, + "7188": msg9635, + "7189": msg9636, + "719": select626, + "7190": msg9637, + "7191": msg9638, + "7192": msg9639, + "7193": msg9640, + "7194": msg9641, + "7195": msg9642, + "7196": msg9643, + "7197": msg9644, + "7198": msg9645, + "7199": msg9646, + "720": select627, + "7200": msg9647, + "7201": msg9648, + "7202": msg9649, + "7203": msg9650, + "7204": msg9651, + "7205": msg9652, + "7206": msg9653, + "7207": msg9654, + "7208": msg9655, + "7209": msg9656, + "721": select628, + "7210": msg9657, + "7211": msg9658, + "7212": msg9659, + "7213": msg9660, + "7214": msg9661, + "7215": msg9662, + "7216": msg9663, + "7217": msg9664, + "7218": msg9665, + "7219": msg9666, + "722": select629, + "7220": msg9667, + "7221": msg9668, + "7222": msg9669, + "7223": msg9670, + "7224": msg9671, + "7225": msg9672, + "7226": msg9673, + "7227": msg9674, + "7228": msg9675, + "7229": msg9676, + "723": select630, + "7230": msg9677, + "7231": msg9678, + "7232": msg9679, + "7233": msg9680, + "7234": msg9681, + "7235": msg9682, + "7236": msg9683, + "7237": msg9684, + "7238": msg9685, + "7239": msg9686, + "724": select631, + "7240": msg9687, + "7241": msg9688, + "7242": msg9689, + "7243": msg9690, + "7244": msg9691, + "7245": msg9692, + "7246": msg9693, + "7247": msg9694, + "7248": msg9695, + "7249": msg9696, + "725": select632, + "7250": msg9697, + "7251": msg9698, + "7252": msg9699, + "7253": msg9700, + "7254": msg9701, + "7255": msg9702, + "7256": msg9703, + "7257": msg9704, + "7258": msg9705, + "7259": msg9706, + "726": select633, + "7260": msg9707, + "7261": msg9708, + "7262": msg9709, + "7263": msg9710, + "7264": msg9711, + "7265": msg9712, + "7266": msg9713, + "7267": msg9714, + "7268": msg9715, + "7269": msg9716, + "727": select634, + "7270": msg9717, + "7271": msg9718, + "7272": msg9719, + "7273": msg9720, + "7274": msg9721, + "7275": msg9722, + "7276": msg9723, + "7277": msg9724, + "7278": msg9725, + "7279": msg9726, + "728": select635, + "7280": msg9727, + "7281": msg9728, + "7282": msg9729, + "7283": msg9730, + "7284": msg9731, + "7285": msg9732, + "7286": msg9733, + "7287": msg9734, + "7288": msg9735, + "7289": msg9736, + "729": select636, + "7290": msg9737, + "7291": msg9738, + "7292": msg9739, + "7293": msg9740, + "7294": msg9741, + "7295": msg9742, + "7296": msg9743, + "7297": msg9744, + "7298": msg9745, + "7299": msg9746, + "730": select637, + "7300": msg9747, + "7301": msg9748, + "7302": msg9749, + "7303": msg9750, + "7304": msg9751, + "7305": msg9752, + "7306": msg9753, + "7307": msg9754, + "7308": msg9755, + "7309": msg9756, + "731": select638, + "7310": msg9757, + "7311": msg9758, + "7312": msg9759, + "7313": msg9760, + "7314": msg9761, + "7315": msg9762, + "7316": msg9763, + "7317": msg9764, + "7318": msg9765, + "7319": msg9766, + "732": select639, + "7320": msg9767, + "7321": msg9768, + "7322": msg9769, + "7323": msg9770, + "7324": msg9771, + "7325": msg9772, + "7326": msg9773, + "7327": msg9774, + "7328": msg9775, + "7329": msg9776, + "733": select640, + "7330": msg9777, + "7331": msg9778, + "7332": msg9779, + "7333": msg9780, + "7334": msg9781, + "7335": msg9782, + "7336": msg9783, + "7337": msg9784, + "7338": msg9785, + "7339": msg9786, + "734": select641, + "7340": msg9787, + "7341": msg9788, + "7342": msg9789, + "7343": msg9790, + "7344": msg9791, + "7345": msg9792, + "7346": msg9793, + "7347": msg9794, + "7348": msg9795, + "7349": msg9796, + "735": select642, + "7350": msg9797, + "7351": msg9798, + "7352": msg9799, + "7353": msg9800, + "7354": msg9801, + "7355": msg9802, + "7356": msg9803, + "7357": msg9804, + "7358": msg9805, + "7359": msg9806, + "736": select643, + "7360": msg9807, + "7361": msg9808, + "7362": msg9809, + "7363": msg9810, + "7364": msg9811, + "7365": msg9812, + "7366": msg9813, + "7367": msg9814, + "7368": msg9815, + "7369": msg9816, + "737": select644, + "7370": msg9817, + "7371": msg9818, + "7372": msg9819, + "7373": msg9820, + "7374": msg9821, + "7375": msg9822, + "7376": msg9823, + "7377": msg9824, + "7378": msg9825, + "7379": msg9826, + "738": select645, + "7380": msg9827, + "7381": msg9828, + "7382": msg9829, + "7383": msg9830, + "7384": msg9831, + "7385": msg9832, + "7386": msg9833, + "7387": msg9834, + "7388": msg9835, + "7389": msg9836, + "739": select646, + "7390": msg9837, + "7391": msg9838, + "7392": msg9839, + "7393": msg9840, + "7394": msg9841, + "7395": msg9842, + "7396": msg9843, + "7397": msg9844, + "7398": msg9845, + "7399": msg9846, + "740": select647, + "7400": msg9847, + "7401": msg9848, + "7402": msg9849, + "7403": msg9850, + "7404": msg9851, + "7405": msg9852, + "7406": msg9853, + "7407": msg9854, + "7408": msg9855, + "7409": msg9856, + "741": select648, + "7410": msg9857, + "7411": msg9858, + "7412": msg9859, + "7413": msg9860, + "7414": msg9861, + "7415": msg9862, + "7416": msg9863, + "7417": msg9864, + "7418": msg9865, + "7419": msg9866, + "742": select649, + "7420": msg9867, + "7421": msg9868, + "7422": msg9869, + "7423": msg9870, + "7424": msg9871, + "7425": msg9872, + "7426": msg9873, + "7427": msg9874, + "7428": msg9875, + "7429": msg9876, + "743": select650, + "7430": msg9877, + "7431": msg9878, + "7432": msg9879, + "7433": msg9880, + "7434": msg9881, + "7435": msg9882, + "7436": msg9883, + "7437": msg9884, + "7438": msg9885, + "7439": msg9886, + "744": select651, + "7440": msg9887, + "7441": msg9888, + "7442": msg9889, + "7443": msg9890, + "7444": msg9891, + "7445": msg9892, + "7446": msg9893, + "7447": msg9894, + "7448": msg9895, + "7449": msg9896, + "745": select652, + "7450": msg9897, + "7451": msg9898, + "7452": msg9899, + "7453": msg9900, + "7454": msg9901, + "7455": msg9902, + "7456": msg9903, + "7457": msg9904, + "7458": msg9905, + "7459": msg9906, + "746": select653, + "7460": msg9907, + "7461": msg9908, + "7462": msg9909, + "7463": msg9910, + "7464": msg9911, + "7465": msg9912, + "7466": msg9913, + "7467": msg9914, + "7468": msg9915, + "7469": msg9916, + "747": select654, + "7470": msg9917, + "7471": msg9918, + "7472": msg9919, + "7473": msg9920, + "7474": msg9921, + "7475": msg9922, + "7476": msg9923, + "7477": msg9924, + "7478": msg9925, + "7479": msg9926, + "748": select655, + "7480": msg9927, + "7481": msg9928, + "7482": msg9929, + "7483": msg9930, + "7484": msg9931, + "7485": msg9932, + "7486": msg9933, + "7487": msg9934, + "7488": msg9935, + "7489": msg9936, + "749": select656, + "7490": msg9937, + "7491": msg9938, + "7492": msg9939, + "7493": msg9940, + "7494": msg9941, + "7495": msg9942, + "7496": msg9943, + "7497": msg9944, + "7498": msg9945, + "7499": msg9946, + "7500": msg9947, + "7501": msg9948, + "7502": msg9949, + "7503": msg9950, + "7504": msg9951, + "7505": msg9952, + "7506": msg9953, + "7507": msg9954, + "7508": msg9955, + "7509": msg9956, + "751": select657, + "7510": msg9957, + "7511": msg9958, + "7512": msg9959, + "7513": msg9960, + "7514": msg9961, + "7515": msg9962, + "7516": msg9963, + "7517": msg9964, + "7518": msg9965, + "7519": msg9966, + "752": select658, + "7520": msg9967, + "7521": msg9968, + "7522": msg9969, + "7523": msg9970, + "7524": msg9971, + "7525": msg9972, + "7526": msg9973, + "7527": msg9974, + "7528": msg9975, + "7529": msg9976, + "753": select659, + "7530": msg9977, + "7531": msg9978, + "7532": msg9979, + "7533": msg9980, + "7534": msg9981, + "7535": msg9982, + "7536": msg9983, + "7537": msg9984, + "7538": msg9985, + "7539": msg9986, + "754": select660, + "7540": msg9987, + "7541": msg9988, + "7542": msg9989, + "7543": msg9990, + "7544": msg9991, + "7545": msg9992, + "7546": msg9993, + "7547": msg9994, + "7548": msg9995, + "7549": msg9996, + "755": select661, + "7550": msg9997, + "7551": msg9998, + "7552": msg9999, + "7553": msg10000, + "7554": msg10001, + "7555": msg10002, + "7556": msg10003, + "7557": msg10004, + "7558": msg10005, + "7559": msg10006, + "756": select662, + "7560": msg10007, + "7561": msg10008, + "7562": msg10009, + "7563": msg10010, + "7564": msg10011, + "7565": msg10012, + "7566": msg10013, + "7567": msg10014, + "7568": msg10015, + "7569": msg10016, + "757": select663, + "7570": msg10017, + "7571": msg10018, + "7572": msg10019, + "7573": msg10020, + "7574": msg10021, + "7575": msg10022, + "7576": msg10023, + "7577": msg10024, + "7578": msg10025, + "7579": msg10026, + "758": select664, + "7580": msg10027, + "7581": msg10028, + "7582": msg10029, + "7583": msg10030, + "7584": msg10031, + "7585": msg10032, + "7586": msg10033, + "7587": msg10034, + "7588": msg10035, + "7589": msg10036, + "759": select665, + "7590": msg10037, + "7591": msg10038, + "7592": msg10039, + "7593": msg10040, + "7594": msg10041, + "7595": msg10042, + "7596": msg10043, + "7597": msg10044, + "7598": msg10045, + "7599": msg10046, + "760": select666, + "7600": msg10047, + "7601": msg10048, + "7602": msg10049, + "7603": msg10050, + "7604": msg10051, + "7605": msg10052, + "7606": msg10053, + "7607": msg10054, + "7608": msg10055, + "7609": msg10056, + "761": select667, + "7610": msg10057, + "7611": msg10058, + "7612": msg10059, + "7613": msg10060, + "7614": msg10061, + "7615": msg10062, + "7616": msg10063, + "7617": msg10064, + "7618": msg10065, + "7619": msg10066, + "762": select668, + "7620": msg10067, + "7621": msg10068, + "7622": msg10069, + "7623": msg10070, + "7624": msg10071, + "7625": msg10072, + "7626": msg10073, + "7627": msg10074, + "7628": msg10075, + "7629": msg10076, + "763": select669, + "7630": msg10077, + "7631": msg10078, + "7632": msg10079, + "7633": msg10080, + "7634": msg10081, + "7635": msg10082, + "7636": msg10083, + "7637": msg10084, + "7638": msg10085, + "7639": msg10086, + "764": select670, + "7640": msg10087, + "7641": msg10088, + "7642": msg10089, + "7643": msg10090, + "7644": msg10091, + "7645": msg10092, + "7646": msg10093, + "7647": msg10094, + "7648": msg10095, + "7649": msg10096, + "765": select671, + "7650": msg10097, + "7651": msg10098, + "7652": msg10099, + "7653": msg10100, + "7654": msg10101, + "7655": msg10102, + "7656": msg10103, + "7657": msg10104, + "7658": msg10105, + "7659": msg10106, + "766": select672, + "7660": msg10107, + "7661": msg10108, + "7662": msg10109, + "7663": msg10110, + "7664": msg10111, + "7665": msg10112, + "7666": msg10113, + "7667": msg10114, + "7668": msg10115, + "7669": msg10116, + "767": select673, + "7670": msg10117, + "7671": msg10118, + "7672": msg10119, + "7673": msg10120, + "7674": msg10121, + "7675": msg10122, + "7676": msg10123, + "7677": msg10124, + "7678": msg10125, + "7679": msg10126, + "768": select674, + "7680": msg10127, + "7681": msg10128, + "7682": msg10129, + "7683": msg10130, + "7684": msg10131, + "7685": msg10132, + "7686": msg10133, + "7687": msg10134, + "7688": msg10135, + "7689": msg10136, + "769": select675, + "7690": msg10137, + "7691": msg10138, + "7692": msg10139, + "7693": msg10140, + "7694": msg10141, + "7695": msg10142, + "7696": msg10143, + "7697": msg10144, + "7698": msg10145, + "7699": msg10146, + "770": select676, + "7700": msg10147, + "7701": msg10148, + "7702": msg10149, + "7703": msg10150, + "7704": msg10151, + "7705": msg10152, + "7706": msg10153, + "7707": msg10154, + "7708": msg10155, + "7709": msg10156, + "771": select677, + "7710": msg10157, + "7711": msg10158, + "7712": msg10159, + "7713": msg10160, + "7714": msg10161, + "7715": msg10162, + "7716": msg10163, + "7717": msg10164, + "7718": msg10165, + "7719": msg10166, + "772": select678, + "7720": msg10167, + "7721": msg10168, + "7722": msg10169, + "7723": msg10170, + "7724": msg10171, + "7725": msg10172, + "7726": msg10173, + "7727": msg10174, + "7728": msg10175, + "7729": msg10176, + "773": select679, + "7730": msg10177, + "7731": msg10178, + "7732": msg10179, + "7733": msg10180, + "7734": msg10181, + "7735": msg10182, + "7736": msg10183, + "7737": msg10184, + "7738": msg10185, + "7739": msg10186, + "774": select680, + "7740": msg10187, + "7741": msg10188, + "7742": msg10189, + "7743": msg10190, + "7744": msg10191, + "7745": msg10192, + "7746": msg10193, + "7747": msg10194, + "7748": msg10195, + "7749": msg10196, + "775": select681, + "7750": msg10197, + "7751": msg10198, + "7752": msg10199, + "7753": msg10200, + "7754": msg10201, + "7755": msg10202, + "7756": msg10203, + "7757": msg10204, + "7758": msg10205, + "7759": msg10206, + "776": select682, + "7760": msg10207, + "7761": msg10208, + "7762": msg10209, + "7763": msg10210, + "7764": msg10211, + "7765": msg10212, + "7766": msg10213, + "7767": msg10214, + "7768": msg10215, + "7769": msg10216, + "777": select683, + "7770": msg10217, + "7771": msg10218, + "7772": msg10219, + "7773": msg10220, + "7774": msg10221, + "7775": msg10222, + "7776": msg10223, + "7777": msg10224, + "7778": msg10225, + "7779": msg10226, + "778": select684, + "7780": msg10227, + "7781": msg10228, + "7782": msg10229, + "7783": msg10230, + "7784": msg10231, + "7785": msg10232, + "7786": msg10233, + "7787": msg10234, + "7788": msg10235, + "7789": msg10236, + "779": select685, + "7790": msg10237, + "7791": msg10238, + "7792": msg10239, + "7793": msg10240, + "7794": msg10241, + "7795": msg10242, + "7796": msg10243, + "7797": msg10244, + "7798": msg10245, + "7799": msg10246, + "780": select686, + "7800": msg10247, + "7801": msg10248, + "7802": msg10249, + "7803": msg10250, + "7804": msg10251, + "7805": msg10252, + "7806": msg10253, + "7807": msg10254, + "7808": msg10255, + "7809": msg10256, + "781": select687, + "7810": msg10257, + "7811": msg10258, + "7812": msg10259, + "7813": msg10260, + "7814": msg10261, + "7815": msg10262, + "7816": msg10263, + "7817": msg10264, + "7818": msg10265, + "7819": msg10266, + "782": select688, + "7820": msg10267, + "7821": msg10268, + "7822": msg10269, + "7823": msg10270, + "7824": msg10271, + "7825": msg10272, + "7826": msg10273, + "7827": msg10274, + "7828": msg10275, + "7829": msg10276, + "783": select689, + "7830": msg10277, + "7831": msg10278, + "7832": msg10279, + "7833": msg10280, + "7834": msg10281, + "7835": msg10282, + "7836": msg10283, + "7837": msg10284, + "7838": msg10285, + "7839": msg10286, + "784": select690, + "7840": msg10287, + "7841": msg10288, + "7842": msg10289, + "7843": msg10290, + "7844": msg10291, + "7845": msg10292, + "7846": msg10293, + "7847": msg10294, + "7848": msg10295, + "7849": msg10296, + "785": select691, + "7850": msg10297, + "7851": msg10298, + "7852": msg10299, + "7853": msg10300, + "7854": msg10301, + "7855": msg10302, + "7856": msg10303, + "7857": msg10304, + "7858": msg10305, + "7859": msg10306, + "786": select692, + "7860": msg10307, + "7861": msg10308, + "7862": msg10309, + "7863": msg10310, + "7864": msg10311, + "7865": msg10312, + "7866": msg10313, + "7867": msg10314, + "7868": msg10315, + "7869": msg10316, + "787": select693, + "7870": msg10317, + "7871": msg10318, + "7872": msg10319, + "7873": msg10320, + "7874": msg10321, + "7875": msg10322, + "7876": msg10323, + "7877": msg10324, + "7878": msg10325, + "7879": msg10326, + "788": select694, + "7880": msg10327, + "7881": msg10328, + "7882": msg10329, + "7883": msg10330, + "7884": msg10331, + "7885": msg10332, + "7886": msg10333, + "7887": msg10334, + "7888": msg10335, + "7889": msg10336, + "789": select695, + "7890": msg10337, + "7891": msg10338, + "7892": msg10339, + "7893": msg10340, + "7894": msg10341, + "7895": msg10342, + "7896": msg10343, + "7897": msg10344, + "7898": msg10345, + "7899": msg10346, + "790": select696, + "7900": msg10347, + "7901": msg10348, + "7902": msg10349, + "7903": msg10350, + "7904": msg10351, + "7905": msg10352, + "7906": msg10353, + "7907": msg10354, + "7908": msg10355, + "7909": msg10356, + "791": select697, + "7910": msg10357, + "7911": msg10358, + "7912": msg10359, + "7913": msg10360, + "7914": msg10361, + "7915": msg10362, + "7916": msg10363, + "7917": msg10364, + "7918": msg10365, + "7919": msg10366, + "792": select698, + "7920": msg10367, + "7921": msg10368, + "7922": msg10369, + "7923": msg10370, + "7924": msg10371, + "7925": msg10372, + "7926": msg10373, + "7927": msg10374, + "7928": msg10375, + "7929": msg10376, + "793": select699, + "7930": msg10377, + "7931": msg10378, + "7932": msg10379, + "7933": msg10380, + "7934": msg10381, + "7935": msg10382, + "7936": msg10383, + "7937": msg10384, + "7938": msg10385, + "7939": msg10386, + "794": select700, + "7940": msg10387, + "7941": msg10388, + "7942": msg10389, + "7943": msg10390, + "7944": msg10391, + "7945": msg10392, + "7946": msg10393, + "7947": msg10394, + "7948": msg10395, + "7949": msg10396, + "795": select701, + "7950": msg10397, + "7951": msg10398, + "7952": msg10399, + "7953": msg10400, + "7954": msg10401, + "7955": msg10402, + "7956": msg10403, + "7957": msg10404, + "7958": msg10405, + "7959": msg10406, + "796": select702, + "7960": msg10407, + "7961": msg10408, + "7962": msg10409, + "7963": msg10410, + "7964": msg10411, + "7965": msg10412, + "7966": msg10413, + "7967": msg10414, + "7968": msg10415, + "7969": msg10416, + "797": select703, + "7970": msg10417, + "7971": msg10418, + "7972": msg10419, + "7973": msg10420, + "7974": msg10421, + "7975": msg10422, + "7976": msg10423, + "7977": msg10424, + "7978": msg10425, + "7979": msg10426, + "798": select704, + "7980": msg10427, + "7981": msg10428, + "7982": msg10429, + "7983": msg10430, + "7984": msg10431, + "7985": msg10432, + "7986": msg10433, + "7987": msg10434, + "7988": msg10435, + "7989": msg10436, + "799": select705, + "7990": msg10437, + "7991": msg10438, + "7992": msg10439, + "7993": msg10440, + "7994": msg10441, + "7995": msg10442, + "7996": msg10443, + "7997": msg10444, + "7998": msg10445, + "7999": msg10446, + "8": select13, + "800": select706, + "8000": msg10447, + "8001": msg10448, + "8002": msg10449, + "8003": msg10450, + "8004": msg10451, + "8005": msg10452, + "8006": msg10453, + "8007": msg10454, + "8008": msg10455, + "8009": msg10456, + "801": select707, + "8010": msg10457, + "8011": msg10458, + "8012": msg10459, + "8013": msg10460, + "8014": msg10461, + "8015": msg10462, + "8016": msg10463, + "8017": msg10464, + "8018": msg10465, + "8019": msg10466, + "802": select708, + "8020": msg10467, + "8021": msg10468, + "8022": msg10469, + "8023": msg10470, + "8024": msg10471, + "8025": msg10472, + "8026": msg10473, + "8027": msg10474, + "8028": msg10475, + "8029": msg10476, + "803": select709, + "8030": msg10477, + "8031": msg10478, + "8032": msg10479, + "8033": msg10480, + "8034": msg10481, + "8035": msg10482, + "8036": msg10483, + "8037": msg10484, + "8038": msg10485, + "8039": msg10486, + "804": select710, + "8040": msg10487, + "8041": msg10488, + "8042": msg10489, + "8043": msg10490, + "8044": msg10491, + "8045": msg10492, + "8046": msg10493, + "8047": msg10494, + "8048": msg10495, + "8049": msg10496, + "805": select711, + "8050": msg10497, + "8051": msg10498, + "8052": msg10499, + "8053": msg10500, + "8054": msg10501, + "8055": msg10502, + "8056": msg10503, + "8057": msg10504, + "8058": msg10505, + "8059": msg10506, + "806": select712, + "8060": msg10507, + "8061": msg10508, + "8062": msg10509, + "8063": msg10510, + "8064": msg10511, + "8065": msg10512, + "8066": msg10513, + "8067": msg10514, + "8068": msg10515, + "8069": msg10516, + "807": select713, + "8070": msg10517, + "8071": msg10518, + "8072": msg10519, + "8073": msg10520, + "8074": msg10521, + "8075": msg10522, + "8076": msg10523, + "8077": msg10524, + "8078": msg10525, + "8079": msg10526, + "808": select714, + "8080": msg10527, + "8081": msg10528, + "8082": msg10529, + "8083": msg10530, + "8084": msg10531, + "8085": msg10532, + "8086": msg10533, + "8087": msg10534, + "8088": msg10535, + "8089": msg10536, + "809": select715, + "8090": msg10537, + "8091": msg10538, + "8092": msg10539, + "8093": msg10540, + "8094": msg10541, + "8095": msg10542, + "8096": msg10543, + "8097": msg10544, + "8098": msg10545, + "8099": msg10546, + "810": select716, + "8100": msg10547, + "8101": msg10548, + "8102": msg10549, + "8103": msg10550, + "8104": msg10551, + "8105": msg10552, + "8106": msg10553, + "8107": msg10554, + "8108": msg10555, + "8109": msg10556, + "811": select717, + "8110": msg10557, + "8111": msg10558, + "8112": msg10559, + "8113": msg10560, + "8114": msg10561, + "8115": msg10562, + "8116": msg10563, + "8117": msg10564, + "8118": msg10565, + "8119": msg10566, + "812": select718, + "8120": msg10567, + "8121": msg10568, + "8122": msg10569, + "8123": msg10570, + "8124": msg10571, + "8125": msg10572, + "8126": msg10573, + "8127": msg10574, + "8128": msg10575, + "8129": msg10576, + "813": select719, + "8130": msg10577, + "8131": msg10578, + "8132": msg10579, + "8133": msg10580, + "8134": msg10581, + "8135": msg10582, + "8136": msg10583, + "8137": msg10584, + "8138": msg10585, + "8139": msg10586, + "8140": msg10587, + "8141": msg10588, + "8142": msg10589, + "8143": msg10590, + "8144": msg10591, + "8145": msg10592, + "8146": msg10593, + "8147": msg10594, + "8148": msg10595, + "8149": msg10596, + "815": select720, + "8150": msg10597, + "8151": msg10598, + "8152": msg10599, + "8153": msg10600, + "8154": msg10601, + "8155": msg10602, + "8156": msg10603, + "8157": msg10604, + "8158": msg10605, + "8159": msg10606, + "8160": msg10607, + "8161": msg10608, + "8162": msg10609, + "8163": msg10610, + "8164": msg10611, + "8165": msg10612, + "8166": msg10613, + "8167": msg10614, + "8168": msg10615, + "8169": msg10616, + "817": select721, + "8170": msg10617, + "8171": msg10618, + "8172": msg10619, + "8173": msg10620, + "8174": msg10621, + "8175": msg10622, + "8176": msg10623, + "8177": msg10624, + "8178": msg10625, + "8179": msg10626, + "818": select722, + "8180": msg10627, + "8181": msg10628, + "8182": msg10629, + "8183": msg10630, + "8184": msg10631, + "8185": msg10632, + "8186": msg10633, + "8187": msg10634, + "8188": msg10635, + "8189": msg10636, + "819": select723, + "8190": msg10637, + "8191": msg10638, + "8192": msg10639, + "8193": msg10640, + "8194": msg10641, + "8195": msg10642, + "8196": msg10643, + "8197": msg10644, + "8198": msg10645, + "8199": msg10646, + "820": select724, + "8200": msg10647, + "8201": msg10648, + "8202": msg10649, + "8203": msg10650, + "8204": msg10651, + "8205": msg10652, + "8206": msg10653, + "8207": msg10654, + "8208": msg10655, + "8209": msg10656, + "821": select725, + "8210": msg10657, + "8211": msg10658, + "8212": msg10659, + "8213": msg10660, + "8214": msg10661, + "8215": msg10662, + "8216": msg10663, + "8217": msg10664, + "8218": msg10665, + "8219": msg10666, + "8220": msg10667, + "8221": msg10668, + "8222": msg10669, + "8223": msg10670, + "8224": msg10671, + "8225": msg10672, + "8226": msg10673, + "8227": msg10674, + "8228": msg10675, + "8229": msg10676, + "823": select726, + "8230": msg10677, + "8231": msg10678, + "8232": msg10679, + "8233": msg10680, + "8234": msg10681, + "8235": msg10682, + "8236": msg10683, + "8237": msg10684, + "8238": msg10685, + "8239": msg10686, + "824": select727, + "8240": msg10687, + "8241": msg10688, + "8242": msg10689, + "8243": msg10690, + "8244": msg10691, + "8245": msg10692, + "8246": msg10693, + "8247": msg10694, + "8248": msg10695, + "8249": msg10696, + "825": select728, + "8250": msg10697, + "8251": msg10698, + "8252": msg10699, + "8253": msg10700, + "8254": msg10701, + "8255": msg10702, + "8256": msg10703, + "8257": msg10704, + "8258": msg10705, + "8259": msg10706, + "826": select729, + "8260": msg10707, + "8261": msg10708, + "8262": msg10709, + "8263": msg10710, + "8264": msg10711, + "8265": msg10712, + "8266": msg10713, + "8267": msg10714, + "8268": msg10715, + "8269": msg10716, + "827": select730, + "8270": msg10717, + "8271": msg10718, + "8272": msg10719, + "8273": msg10720, + "8274": msg10721, + "8275": msg10722, + "8276": msg10723, + "8277": msg10724, + "8278": msg10725, + "8279": msg10726, + "828": select731, + "8280": msg10727, + "8281": msg10728, + "8282": msg10729, + "8283": msg10730, + "8284": msg10731, + "8285": msg10732, + "8286": msg10733, + "8287": msg10734, + "8288": msg10735, + "8289": msg10736, + "829": select732, + "8290": msg10737, + "8291": msg10738, + "8292": msg10739, + "8293": msg10740, + "8294": msg10741, + "8295": msg10742, + "8296": msg10743, + "8297": msg10744, + "8298": msg10745, + "8299": msg10746, + "830": select733, + "8300": msg10747, + "8301": msg10748, + "8302": msg10749, + "8303": msg10750, + "8304": msg10751, + "8305": msg10752, + "8306": msg10753, + "8307": msg10754, + "8308": msg10755, + "8309": msg10756, + "8310": msg10757, + "8311": msg10758, + "8312": msg10759, + "8313": msg10760, + "8314": msg10761, + "8315": msg10762, + "8316": msg10763, + "8317": msg10764, + "8318": msg10765, + "8319": msg10766, + "832": select734, + "8320": msg10767, + "8321": msg10768, + "8322": msg10769, + "8323": msg10770, + "8324": msg10771, + "8325": msg10772, + "8326": msg10773, + "8327": msg10774, + "8328": msg10775, + "8329": msg10776, + "833": select735, + "8330": msg10777, + "8331": msg10778, + "8332": msg10779, + "8333": msg10780, + "8334": msg10781, + "8335": msg10782, + "8336": msg10783, + "8337": msg10784, + "8338": msg10785, + "8339": msg10786, + "834": select736, + "8340": msg10787, + "8341": msg10788, + "8342": msg10789, + "8343": msg10790, + "8344": msg10791, + "8345": msg10792, + "8346": msg10793, + "8347": msg10794, + "8348": msg10795, + "8349": msg10796, + "835": select737, + "8350": msg10797, + "8351": msg10798, + "8352": msg10799, + "8353": msg10800, + "8354": msg10801, + "8355": msg10802, + "8356": msg10803, + "8357": msg10804, + "8358": msg10805, + "8359": msg10806, + "836": select738, + "8360": msg10807, + "8361": msg10808, + "8362": msg10809, + "8363": msg10810, + "8364": msg10811, + "8365": msg10812, + "8366": msg10813, + "8367": msg10814, + "8368": msg10815, + "8369": msg10816, + "837": select739, + "8370": msg10817, + "8371": msg10818, + "8372": msg10819, + "8373": msg10820, + "8374": msg10821, + "8375": msg10822, + "8376": msg10823, + "8377": msg10824, + "8378": msg10825, + "8379": msg10826, + "838": select740, + "8380": msg10827, + "8381": msg10828, + "8382": msg10829, + "8383": msg10830, + "8384": msg10831, + "8385": msg10832, + "8386": msg10833, + "8387": msg10834, + "8388": msg10835, + "8389": msg10836, + "839": select741, + "8390": msg10837, + "8391": msg10838, + "8392": msg10839, + "8393": msg10840, + "8394": msg10841, + "8395": msg10842, + "8396": msg10843, + "8397": msg10844, + "8398": msg10845, + "8399": msg10846, + "840": select742, + "8400": msg10847, + "8401": msg10848, + "8402": msg10849, + "8403": msg10850, + "8404": msg10851, + "8405": msg10852, + "8406": msg10853, + "8407": msg10854, + "8408": msg10855, + "8409": msg10856, + "841": select743, + "8410": msg10857, + "8411": msg10858, + "8412": msg10859, + "8413": msg10860, + "8414": msg10861, + "8415": msg10862, + "8416": msg10863, + "8417": msg10864, + "8418": msg10865, + "8419": msg10866, + "842": select744, + "8420": msg10867, + "8421": msg10868, + "8422": msg10869, + "8423": msg10870, + "8424": msg10871, + "8425": msg10872, + "8426": msg10873, + "8427": msg10874, + "8428": msg10875, + "8429": msg10876, + "843": select745, + "8430": msg10877, + "8431": msg10878, + "8432": msg10879, + "8433": msg10880, + "8434": msg10881, + "8435": msg10882, + "8436": msg10883, + "8437": msg10884, + "8438": msg10885, + "8439": msg10886, + "844": select746, + "8440": msg10887, + "8441": msg10888, + "8442": msg10889, + "8443": msg10890, + "8444": msg10891, + "8445": msg10892, + "8446": msg10893, + "8447": msg10894, + "8448": msg10895, + "8449": msg10896, + "845": select747, + "8450": msg10897, + "8451": msg10898, + "8452": msg10899, + "8453": msg10900, + "8454": msg10901, + "8455": msg10902, + "8456": msg10903, + "8457": msg10904, + "8458": msg10905, + "8459": msg10906, + "846": select748, + "8460": msg10907, + "8461": msg10908, + "8462": msg10909, + "8463": msg10910, + "8464": msg10911, + "8465": msg10912, + "8466": msg10913, + "8467": msg10914, + "8468": msg10915, + "8469": msg10916, + "847": select749, + "8470": msg10917, + "8471": msg10918, + "8472": msg10919, + "8473": msg10920, + "8474": msg10921, + "8475": msg10922, + "8476": msg10923, + "8477": msg10924, + "8478": msg10925, + "8479": msg10926, + "848": select750, + "8480": msg10927, + "8481": msg10928, + "8482": msg10929, + "8483": msg10930, + "8484": msg10931, + "8485": msg10932, + "8486": msg10933, + "8487": msg10934, + "8488": msg10935, + "8489": msg10936, + "849": select751, + "8490": msg10937, + "8491": msg10938, + "8492": msg10939, + "8493": msg10940, + "8494": msg10941, + "8495": msg10942, + "8496": msg10943, + "8497": msg10944, + "8498": msg10945, + "8499": msg10946, + "850": select752, + "8500": msg10947, + "8501": msg10948, + "8502": msg10949, + "8503": msg10950, + "8504": msg10951, + "8505": msg10952, + "8506": msg10953, + "8507": msg10954, + "8508": msg10955, + "8509": msg10956, + "851": select753, + "8510": msg10957, + "8511": msg10958, + "8512": msg10959, + "8513": msg10960, + "8514": msg10961, + "8515": msg10962, + "8516": msg10963, + "8517": msg10964, + "8518": msg10965, + "8519": msg10966, + "852": select754, + "8520": msg10967, + "8521": msg10968, + "8522": msg10969, + "8523": msg10970, + "8524": msg10971, + "8525": msg10972, + "8526": msg10973, + "8527": msg10974, + "8528": msg10975, + "8529": msg10976, + "853": select755, + "8530": msg10977, + "8531": msg10978, + "8532": msg10979, + "8533": msg10980, + "8534": msg10981, + "8535": msg10982, + "8536": msg10983, + "8537": msg10984, + "8538": msg10985, + "8539": msg10986, + "854": select756, + "8540": msg10987, + "8541": msg10988, + "8542": msg10989, + "8543": msg10990, + "8544": msg10991, + "8545": msg10992, + "8546": msg10993, + "8547": msg10994, + "8548": msg10995, + "8549": msg10996, + "855": select757, + "8550": msg10997, + "8551": msg10998, + "8552": msg10999, + "8553": msg11000, + "8554": msg11001, + "8555": msg11002, + "8556": msg11003, + "8557": msg11004, + "8558": msg11005, + "8559": msg11006, + "856": select758, + "8560": msg11007, + "8561": msg11008, + "8562": msg11009, + "8563": msg11010, + "8564": msg11011, + "8565": msg11012, + "8566": msg11013, + "8567": msg11014, + "8568": msg11015, + "8569": msg11016, + "857": select759, + "8570": msg11017, + "8571": msg11018, + "8572": msg11019, + "8573": msg11020, + "8574": msg11021, + "8575": msg11022, + "8576": msg11023, + "8577": msg11024, + "8578": msg11025, + "8579": msg11026, + "858": select760, + "8580": msg11027, + "8581": msg11028, + "8582": msg11029, + "8583": msg11030, + "8584": msg11031, + "8585": msg11032, + "8586": msg11033, + "8587": msg11034, + "8588": msg11035, + "8589": msg11036, + "859": select761, + "8590": msg11037, + "8591": msg11038, + "8592": msg11039, + "8593": msg11040, + "8594": msg11041, + "8595": msg11042, + "8596": msg11043, + "8597": msg11044, + "8598": msg11045, + "8599": msg11046, + "860": select762, + "8600": msg11047, + "8601": msg11048, + "8602": msg11049, + "8603": msg11050, + "8604": msg11051, + "8605": msg11052, + "8606": msg11053, + "8607": msg11054, + "8608": msg11055, + "8609": msg11056, + "861": select763, + "8610": msg11057, + "8611": msg11058, + "8612": msg11059, + "8613": msg11060, + "8614": msg11061, + "8615": msg11062, + "8616": msg11063, + "8617": msg11064, + "8618": msg11065, + "8619": msg11066, + "862": select764, + "8620": msg11067, + "8621": msg11068, + "8622": msg11069, + "8623": msg11070, + "8624": msg11071, + "8625": msg11072, + "8626": msg11073, + "8627": msg11074, + "8628": msg11075, + "8629": msg11076, + "863": select765, + "8630": msg11077, + "8631": msg11078, + "8632": msg11079, + "8633": msg11080, + "8634": msg11081, + "8635": msg11082, + "8636": msg11083, + "8637": msg11084, + "8638": msg11085, + "8639": msg11086, + "864": select766, + "8640": msg11087, + "8641": msg11088, + "8642": msg11089, + "8643": msg11090, + "8644": msg11091, + "8645": msg11092, + "8646": msg11093, + "8647": msg11094, + "8648": msg11095, + "8649": msg11096, + "865": select767, + "8650": msg11097, + "8651": msg11098, + "8652": msg11099, + "8653": msg11100, + "8654": msg11101, + "8655": msg11102, + "8656": msg11103, + "8657": msg11104, + "8658": msg11105, + "8659": msg11106, + "866": select768, + "8660": msg11107, + "8661": msg11108, + "8662": msg11109, + "8663": msg11110, + "8664": msg11111, + "8665": msg11112, + "8666": msg11113, + "8667": msg11114, + "8668": msg11115, + "8669": msg11116, + "867": select769, + "8670": msg11117, + "8671": msg11118, + "8672": msg11119, + "8673": msg11120, + "8674": msg11121, + "8675": msg11122, + "8676": msg11123, + "8677": msg11124, + "8678": msg11125, + "8679": msg11126, + "868": select770, + "8680": msg11127, + "8681": msg11128, + "8682": msg11129, + "8683": msg11130, + "8684": msg11131, + "8685": msg11132, + "8686": msg11133, + "8687": msg11134, + "8688": msg11135, + "8689": msg11136, + "869": select771, + "8690": msg11137, + "8691": msg11138, + "8692": msg11139, + "8693": msg11140, + "8694": msg11141, + "8695": msg11142, + "8696": msg11143, + "8697": msg11144, + "8698": msg11145, + "8699": msg11146, + "870": select772, + "8700": msg11147, + "8701": msg11148, + "8702": msg11149, + "8703": msg11150, + "8704": msg11151, + "8705": msg11152, + "8706": msg11153, + "8707": msg11154, + "8708": msg11155, + "8709": msg11156, + "871": select773, + "8710": msg11157, + "8711": msg11158, + "8712": msg11159, + "8713": msg11160, + "8714": msg11161, + "8715": msg11162, + "8716": msg11163, + "8717": msg11164, + "8718": msg11165, + "8719": msg11166, + "872": select774, + "8720": msg11167, + "8721": msg11168, + "8722": msg11169, + "8723": msg11170, + "8724": msg11171, + "8725": msg11172, + "8726": msg11173, + "8727": msg11174, + "8728": msg11175, + "8729": msg11176, + "873": select775, + "8730": msg11177, + "8731": msg11178, + "8732": msg11179, + "8733": msg11180, + "8734": msg11181, + "8735": msg11182, + "8736": msg11183, + "8737": msg11184, + "8738": msg11185, + "8739": msg11186, + "874": select776, + "8740": msg11187, + "8741": msg11188, + "8742": msg11189, + "8743": msg11190, + "8744": msg11191, + "8745": msg11192, + "8746": msg11193, + "8747": msg11194, + "8748": msg11195, + "8749": msg11196, + "875": select777, + "8750": msg11197, + "8751": msg11198, + "8752": msg11199, + "8753": msg11200, + "8754": msg11201, + "8755": msg11202, + "8756": msg11203, + "8757": msg11204, + "8758": msg11205, + "8759": msg11206, + "876": select778, + "8760": msg11207, + "8761": msg11208, + "8762": msg11209, + "8763": msg11210, + "8764": msg11211, + "8765": msg11212, + "8766": msg11213, + "8767": msg11214, + "8768": msg11215, + "8769": msg11216, + "877": select779, + "8770": msg11217, + "8771": msg11218, + "8772": msg11219, + "8773": msg11220, + "8774": msg11221, + "8775": msg11222, + "8776": msg11223, + "8777": msg11224, + "8778": msg11225, + "8779": msg11226, + "878": select780, + "8780": msg11227, + "8781": msg11228, + "8782": msg11229, + "8783": msg11230, + "8784": msg11231, + "8785": msg11232, + "8786": msg11233, + "8787": msg11234, + "8788": msg11235, + "8789": msg11236, + "879": select781, + "8790": msg11237, + "8791": msg11238, + "8792": msg11239, + "8793": msg11240, + "8794": msg11241, + "8795": msg11242, + "8796": msg11243, + "8797": msg11244, + "8798": msg11245, + "8799": msg11246, + "880": select782, + "8800": msg11247, + "8801": msg11248, + "8802": msg11249, + "8803": msg11250, + "8804": msg11251, + "8805": msg11252, + "8806": msg11253, + "8807": msg11254, + "8808": msg11255, + "8809": msg11256, + "881": select783, + "8810": msg11257, + "8811": msg11258, + "8812": msg11259, + "8813": msg11260, + "8814": msg11261, + "8815": msg11262, + "8816": msg11263, + "8817": msg11264, + "8818": msg11265, + "8819": msg11266, + "882": select784, + "8820": msg11267, + "8821": msg11268, + "8822": msg11269, + "8823": msg11270, + "8824": msg11271, + "8825": msg11272, + "8826": msg11273, + "8827": msg11274, + "8828": msg11275, + "8829": msg11276, + "883": select785, + "8830": msg11277, + "8831": msg11278, + "8832": msg11279, + "8833": msg11280, + "8834": msg11281, + "8835": msg11282, + "8836": msg11283, + "8837": msg11284, + "8838": msg11285, + "8839": msg11286, + "884": select786, + "8840": msg11287, + "8841": msg11288, + "8842": msg11289, + "8843": msg11290, + "8844": msg11291, + "8845": msg11292, + "8846": msg11293, + "8847": msg11294, + "8848": msg11295, + "8849": msg11296, + "885": select787, + "8850": msg11297, + "8851": msg11298, + "8852": msg11299, + "8853": msg11300, + "8854": msg11301, + "8855": msg11302, + "8856": msg11303, + "8857": msg11304, + "8858": msg11305, + "8859": msg11306, + "886": select788, + "8860": msg11307, + "8861": msg11308, + "8862": msg11309, + "8863": msg11310, + "8864": msg11311, + "8865": msg11312, + "8866": msg11313, + "8867": msg11314, + "8868": msg11315, + "8869": msg11316, + "887": select789, + "8870": msg11317, + "8871": msg11318, + "8872": msg11319, + "8873": msg11320, + "8874": msg11321, + "8875": msg11322, + "8876": msg11323, + "8877": msg11324, + "8878": msg11325, + "8879": msg11326, + "888": select790, + "8880": msg11327, + "8881": msg11328, + "8882": msg11329, + "8883": msg11330, + "8884": msg11331, + "8885": msg11332, + "8886": msg11333, + "8887": msg11334, + "8888": msg11335, + "8888888": msg38428, + "8888889": msg38429, + "8889": msg11336, + "889": select791, + "8890": msg11337, + "8891": msg11338, + "8892": msg11339, + "8893": msg11340, + "8894": msg11341, + "8895": msg11342, + "8896": msg11343, + "8897": msg11344, + "8898": msg11345, + "8899": msg11346, + "890": select792, + "8900": msg11347, + "8901": msg11348, + "8902": msg11349, + "8903": msg11350, + "8904": msg11351, + "8905": msg11352, + "8906": msg11353, + "8907": msg11354, + "8908": msg11355, + "8909": msg11356, + "891": select793, + "8910": msg11357, + "8911": msg11358, + "8912": msg11359, + "8913": msg11360, + "8914": msg11361, + "8915": msg11362, + "8916": msg11363, + "8917": msg11364, + "8918": msg11365, + "8919": msg11366, + "892": select794, + "8920": msg11367, + "8921": msg11368, + "8922": msg11369, + "8923": msg11370, + "8924": msg11371, + "8925": msg11372, + "8926": msg11373, + "8927": msg11374, + "8928": msg11375, + "8929": msg11376, + "893": select795, + "8930": msg11377, + "8931": msg11378, + "8932": msg11379, + "8933": msg11380, + "8934": msg11381, + "8935": msg11382, + "8936": msg11383, + "8937": msg11384, + "8938": msg11385, + "8939": msg11386, + "894": select796, + "8940": msg11387, + "8941": msg11388, + "8942": msg11389, + "8943": msg11390, + "8944": msg11391, + "8945": msg11392, + "8946": msg11393, + "8947": msg11394, + "8948": msg11395, + "8949": msg11396, + "895": select797, + "8950": msg11397, + "8951": msg11398, + "8952": msg11399, + "8953": msg11400, + "8954": msg11401, + "8955": msg11402, + "8956": msg11403, + "8957": msg11404, + "8958": msg11405, + "8959": msg11406, + "896": select798, + "8960": msg11407, + "8961": msg11408, + "8962": msg11409, + "8963": msg11410, + "8964": msg11411, + "8965": msg11412, + "8966": msg11413, + "8967": msg11414, + "8968": msg11415, + "8969": msg11416, + "897": select799, + "8970": msg11417, + "8971": msg11418, + "8972": msg11419, + "8973": msg11420, + "8974": msg11421, + "8975": msg11422, + "8976": msg11423, + "8977": msg11424, + "8978": msg11425, + "8979": msg11426, + "898": select800, + "8980": msg11427, + "8981": msg11428, + "8982": msg11429, + "8983": msg11430, + "8984": msg11431, + "8985": msg11432, + "8986": msg11433, + "8987": msg11434, + "8988": msg11435, + "8989": msg11436, + "899": select801, + "8990": msg11437, + "8991": msg11438, + "8992": msg11439, + "8993": msg11440, + "8994": msg11441, + "8995": msg11442, + "8996": msg11443, + "8997": msg11444, + "8998": msg11445, + "8999": msg11446, + "9": msg33, + "900": select802, + "9000": msg11447, + "9001": msg11448, + "9002": msg11449, + "9003": msg11450, + "9004": msg11451, + "9005": msg11452, + "9006": msg11453, + "9007": msg11454, + "9008": msg11455, + "9009": msg11456, + "901": select803, + "9010": msg11457, + "9011": msg11458, + "9012": msg11459, + "9013": msg11460, + "9014": msg11461, + "9015": msg11462, + "9016": msg11463, + "9017": msg11464, + "9018": msg11465, + "9019": msg11466, + "902": select804, + "9020": msg11467, + "9021": msg11468, + "9022": msg11469, + "9023": msg11470, + "9024": msg11471, + "9025": msg11472, + "9026": msg11473, + "9027": msg11474, + "9028": msg11475, + "9029": msg11476, + "903": select805, + "9030": msg11477, + "9031": msg11478, + "9032": msg11479, + "9033": msg11480, + "9034": msg11481, + "9035": msg11482, + "9036": msg11483, + "9037": msg11484, + "9038": msg11485, + "9039": msg11486, + "904": select806, + "9040": msg11487, + "9041": msg11488, + "9042": msg11489, + "9043": msg11490, + "9044": msg11491, + "9045": msg11492, + "9046": msg11493, + "9047": msg11494, + "9048": msg11495, + "9049": msg11496, + "905": select807, + "9050": msg11497, + "9051": msg11498, + "9052": msg11499, + "9053": msg11500, + "9054": msg11501, + "9055": msg11502, + "9056": msg11503, + "9057": msg11504, + "9058": msg11505, + "9059": msg11506, + "906": select808, + "9060": msg11507, + "9061": msg11508, + "9062": msg11509, + "9063": msg11510, + "9064": msg11511, + "9065": msg11512, + "9066": msg11513, + "9067": msg11514, + "9068": msg11515, + "9069": msg11516, + "907": select809, + "9070": msg11517, + "9071": msg11518, + "9072": msg11519, + "9073": msg11520, + "9074": msg11521, + "9075": msg11522, + "9076": msg11523, + "9077": msg11524, + "9078": msg11525, + "9079": msg11526, + "908": select810, + "9080": msg11527, + "9081": msg11528, + "9082": msg11529, + "9083": msg11530, + "9084": msg11531, + "9085": msg11532, + "9086": msg11533, + "9087": msg11534, + "9088": msg11535, + "9089": msg11536, + "909": select811, + "9090": msg11537, + "9091": msg11538, + "9092": msg11539, + "9093": msg11540, + "9094": msg11541, + "9095": msg11542, + "9096": msg11543, + "9097": msg11544, + "9098": msg11545, + "9099": msg11546, + "910": select812, + "9100": msg11547, + "9101": msg11548, + "9102": msg11549, + "9103": msg11550, + "9104": msg11551, + "9105": msg11552, + "9106": msg11553, + "9107": msg11554, + "9108": msg11555, + "9109": msg11556, + "911": select813, + "9110": msg11557, + "9111": msg11558, + "9112": msg11559, + "9113": msg11560, + "9114": msg11561, + "9115": msg11562, + "9116": msg11563, + "9117": msg11564, + "9118": msg11565, + "9119": msg11566, + "912": select814, + "9120": msg11567, + "9121": msg11568, + "9122": msg11569, + "9123": msg11570, + "9124": msg11571, + "9125": msg11572, + "9126": msg11573, + "9127": msg11574, + "9128": msg11575, + "9129": msg11576, + "913": select815, + "9130": msg11577, + "9131": msg11578, + "9132": msg11579, + "9133": msg11580, + "9134": msg11581, + "9135": msg11582, + "9136": msg11583, + "9137": msg11584, + "9138": msg11585, + "9139": msg11586, + "914": select816, + "9140": msg11587, + "9141": msg11588, + "9142": msg11589, + "9143": msg11590, + "9144": msg11591, + "9145": msg11592, + "9146": msg11593, + "9147": msg11594, + "9148": msg11595, + "9149": msg11596, + "915": select817, + "9150": msg11597, + "9151": msg11598, + "9152": msg11599, + "9153": msg11600, + "9154": msg11601, + "9155": msg11602, + "9156": msg11603, + "9157": msg11604, + "9158": msg11605, + "9159": msg11606, + "916": select818, + "9160": msg11607, + "9161": msg11608, + "9162": msg11609, + "9163": msg11610, + "9164": msg11611, + "9165": msg11612, + "9166": msg11613, + "9167": msg11614, + "9168": msg11615, + "9169": msg11616, + "917": select819, + "9170": msg11617, + "9171": msg11618, + "9172": msg11619, + "9173": msg11620, + "9174": msg11621, + "9175": msg11622, + "9176": msg11623, + "9177": msg11624, + "9178": msg11625, + "9179": msg11626, + "918": select820, + "9180": msg11627, + "9181": msg11628, + "9182": msg11629, + "9183": msg11630, + "9184": msg11631, + "9185": msg11632, + "9186": msg11633, + "9187": msg11634, + "9188": msg11635, + "9189": msg11636, + "919": select821, + "9190": msg11637, + "9191": msg11638, + "9192": msg11639, + "9193": msg11640, + "9194": msg11641, + "9195": msg11642, + "9196": msg11643, + "9197": msg11644, + "9198": msg11645, + "9199": msg11646, + "920": select822, + "9200": msg11647, + "9201": msg11648, + "9202": msg11649, + "9203": msg11650, + "9204": msg11651, + "9205": msg11652, + "9206": msg11653, + "9207": msg11654, + "9208": msg11655, + "9209": msg11656, + "921": select823, + "9210": msg11657, + "9211": msg11658, + "9212": msg11659, + "9213": msg11660, + "9214": msg11661, + "9215": msg11662, + "9216": msg11663, + "9217": msg11664, + "9218": msg11665, + "9219": msg11666, + "922": select824, + "9220": msg11667, + "9221": msg11668, + "9222": msg11669, + "9223": msg11670, + "9224": msg11671, + "9225": msg11672, + "9226": msg11673, + "9227": msg11674, + "9228": msg11675, + "9229": msg11676, + "923": select825, + "9230": msg11677, + "9231": msg11678, + "9232": msg11679, + "9233": msg11680, + "9234": msg11681, + "9235": msg11682, + "9236": msg11683, + "9237": msg11684, + "9238": msg11685, + "9239": msg11686, + "924": select826, + "9240": msg11687, + "9241": msg11688, + "9242": msg11689, + "9243": msg11690, + "9244": msg11691, + "9245": msg11692, + "9246": msg11693, + "9247": msg11694, + "9248": msg11695, + "9249": msg11696, + "925": select827, + "9250": msg11697, + "9251": msg11698, + "9252": msg11699, + "9253": msg11700, + "9254": msg11701, + "9255": msg11702, + "9256": msg11703, + "9257": msg11704, + "9258": msg11705, + "9259": msg11706, + "926": select828, + "9260": msg11707, + "9261": msg11708, + "9262": msg11709, + "9263": msg11710, + "9264": msg11711, + "9265": msg11712, + "9266": msg11713, + "9267": msg11714, + "9268": msg11715, + "9269": msg11716, + "927": select829, + "9270": msg11717, + "9271": msg11718, + "9272": msg11719, + "9273": msg11720, + "9274": msg11721, + "9275": msg11722, + "9276": msg11723, + "9277": msg11724, + "9278": msg11725, + "9279": msg11726, + "928": select830, + "9280": msg11727, + "9281": msg11728, + "9282": msg11729, + "9283": msg11730, + "9284": msg11731, + "9285": msg11732, + "9286": msg11733, + "9287": msg11734, + "9288": msg11735, + "9289": msg11736, + "929": select831, + "9290": msg11737, + "9291": msg11738, + "9292": msg11739, + "9293": msg11740, + "9294": msg11741, + "9295": msg11742, + "9296": msg11743, + "9297": msg11744, + "9298": msg11745, + "9299": msg11746, + "930": select832, + "9300": msg11747, + "9301": msg11748, + "9302": msg11749, + "9303": msg11750, + "9304": msg11751, + "9305": msg11752, + "9306": msg11753, + "9307": msg11754, + "9308": msg11755, + "9309": msg11756, + "931": select833, + "9310": msg11757, + "9311": msg11758, + "9312": msg11759, + "9313": msg11760, + "9314": msg11761, + "9315": msg11762, + "9316": msg11763, + "9317": msg11764, + "9318": msg11765, + "9319": msg11766, + "932": select834, + "9320": msg11767, + "9321": msg11768, + "9322": msg11769, + "9323": msg11770, + "9324": msg11771, + "9325": msg11772, + "9326": msg11773, + "9327": msg11774, + "9328": msg11775, + "9329": msg11776, + "933": select835, + "9330": msg11777, + "9331": msg11778, + "9332": msg11779, + "9333": msg11780, + "9334": msg11781, + "9335": msg11782, + "9336": msg11783, + "9337": msg11784, + "9338": msg11785, + "9339": msg11786, + "9340": msg11787, + "9341": msg11788, + "9342": msg11789, + "9343": msg11790, + "9344": msg11791, + "9345": msg11792, + "9346": msg11793, + "9347": msg11794, + "9348": msg11795, + "9349": msg11796, + "935": select836, + "9350": msg11797, + "9351": msg11798, + "9352": msg11799, + "9353": msg11800, + "9354": msg11801, + "9355": msg11802, + "9356": msg11803, + "9357": msg11804, + "9358": msg11805, + "9359": msg11806, + "936": select837, + "9360": msg11807, + "9361": msg11808, + "9362": msg11809, + "9363": msg11810, + "9364": msg11811, + "9365": msg11812, + "9366": msg11813, + "9367": msg11814, + "9368": msg11815, + "9369": msg11816, + "937": select838, + "9370": msg11817, + "9371": msg11818, + "9372": msg11819, + "9373": msg11820, + "9374": msg11821, + "9375": msg11822, + "9376": msg11823, + "9377": msg11824, + "9378": msg11825, + "9379": msg11826, + "9380": msg11827, + "9381": msg11828, + "9382": msg11829, + "9383": msg11830, + "9384": msg11831, + "9385": msg11832, + "9386": msg11833, + "9387": msg11834, + "9388": msg11835, + "9389": msg11836, + "939": select839, + "9390": msg11837, + "9391": msg11838, + "9392": msg11839, + "9393": msg11840, + "9394": msg11841, + "9395": msg11842, + "9396": msg11843, + "9397": msg11844, + "9398": msg11845, + "9399": msg11846, + "940": select840, + "9400": msg11847, + "9401": msg11848, + "9402": msg11849, + "9403": msg11850, + "9404": msg11851, + "9405": msg11852, + "9406": msg11853, + "9407": msg11854, + "9408": msg11855, + "9409": msg11856, + "941": select841, + "9410": msg11857, + "9411": msg11858, + "9412": msg11859, + "9413": msg11860, + "9414": msg11861, + "9415": msg11862, + "9416": msg11863, + "9417": msg11864, + "9418": msg11865, + "9419": msg11866, + "942": select842, + "9420": msg11867, + "9421": msg11868, + "9422": msg11869, + "9423": msg11870, + "9424": msg11871, + "9425": msg11872, + "9426": msg11873, + "9427": msg11874, + "9428": msg11875, + "9429": msg11876, + "943": select843, + "9430": msg11877, + "9431": msg11878, + "9432": msg11879, + "9433": msg11880, + "9434": msg11881, + "9435": msg11882, + "9436": msg11883, + "9437": msg11884, + "9438": msg11885, + "9439": msg11886, + "944": select844, + "9440": msg11887, + "9441": msg11888, + "9442": msg11889, + "9443": msg11890, + "9444": msg11891, + "9445": msg11892, + "9446": msg11893, + "9447": msg11894, + "9448": msg11895, + "9449": msg11896, + "945": select845, + "9450": msg11897, + "9451": msg11898, + "9452": msg11899, + "9453": msg11900, + "9454": msg11901, + "9455": msg11902, + "9456": msg11903, + "9457": msg11904, + "9458": msg11905, + "9459": msg11906, + "946": select846, + "9460": msg11907, + "9461": msg11908, + "9462": msg11909, + "9463": msg11910, + "9464": msg11911, + "9465": msg11912, + "9466": msg11913, + "9467": msg11914, + "9468": msg11915, + "9469": msg11916, + "947": select847, + "9470": msg11917, + "9471": msg11918, + "9472": msg11919, + "9473": msg11920, + "9474": msg11921, + "9475": msg11922, + "9476": msg11923, + "9477": msg11924, + "9478": msg11925, + "9479": msg11926, + "948": select848, + "9480": msg11927, + "9481": msg11928, + "9482": msg11929, + "9483": msg11930, + "9484": msg11931, + "9485": msg11932, + "9486": msg11933, + "9487": msg11934, + "9488": msg11935, + "9489": msg11936, + "949": select849, + "9490": msg11937, + "9491": msg11938, + "9492": msg11939, + "9493": msg11940, + "9494": msg11941, + "9495": msg11942, + "9496": msg11943, + "9497": msg11944, + "9498": msg11945, + "9499": msg11946, + "950": select850, + "9500": msg11947, + "9501": msg11948, + "9502": msg11949, + "9503": msg11950, + "9504": msg11951, + "9505": msg11952, + "9506": msg11953, + "9507": msg11954, + "9508": msg11955, + "9509": msg11956, + "951": select851, + "9510": msg11957, + "9511": msg11958, + "9512": msg11959, + "9513": msg11960, + "9514": msg11961, + "9515": msg11962, + "9516": msg11963, + "9517": msg11964, + "9518": msg11965, + "9519": msg11966, + "952": select852, + "9520": msg11967, + "9521": msg11968, + "9522": msg11969, + "9523": msg11970, + "9524": msg11971, + "9525": msg11972, + "9526": msg11973, + "9527": msg11974, + "9528": msg11975, + "9529": msg11976, + "953": select853, + "9530": msg11977, + "9531": msg11978, + "9532": msg11979, + "9533": msg11980, + "9534": msg11981, + "9535": msg11982, + "9536": msg11983, + "9537": msg11984, + "9538": msg11985, + "9539": msg11986, + "954": select854, + "9540": msg11987, + "9541": msg11988, + "9542": msg11989, + "9543": msg11990, + "9544": msg11991, + "9545": msg11992, + "9546": msg11993, + "9547": msg11994, + "9548": msg11995, + "9549": msg11996, + "955": select855, + "9550": msg11997, + "9551": msg11998, + "9552": msg11999, + "9553": msg12000, + "9554": msg12001, + "9555": msg12002, + "9556": msg12003, + "9557": msg12004, + "9558": msg12005, + "9559": msg12006, + "956": select856, + "9560": msg12007, + "9561": msg12008, + "9562": msg12009, + "9563": msg12010, + "9564": msg12011, + "9565": msg12012, + "9566": msg12013, + "9567": msg12014, + "9568": msg12015, + "9569": msg12016, + "957": select857, + "9570": msg12017, + "9571": msg12018, + "9572": msg12019, + "9573": msg12020, + "9574": msg12021, + "9575": msg12022, + "9576": msg12023, + "9577": msg12024, + "9578": msg12025, + "9579": msg12026, + "958": select858, + "9580": msg12027, + "9581": msg12028, + "9582": msg12029, + "9583": msg12030, + "9584": msg12031, + "9585": msg12032, + "9586": msg12033, + "9587": msg12034, + "9588": msg12035, + "9589": msg12036, + "959": select859, + "9590": msg12037, + "9591": msg12038, + "9592": msg12039, + "9593": msg12040, + "9594": msg12041, + "9595": msg12042, + "9596": msg12043, + "9597": msg12044, + "9598": msg12045, + "9599": msg12046, + "96": msg77, + "960": select860, + "9600": msg12047, + "9601": msg12048, + "9602": msg12049, + "9603": msg12050, + "9604": msg12051, + "9605": msg12052, + "9606": msg12053, + "9607": msg12054, + "9608": msg12055, + "9609": msg12056, + "961": select861, + "9610": msg12057, + "9611": msg12058, + "9612": msg12059, + "9613": msg12060, + "9614": msg12061, + "9615": msg12062, + "9616": msg12063, + "9617": msg12064, + "9618": msg12065, + "9619": msg12066, + "962": select862, + "9620": msg12067, + "9621": msg12068, + "9622": msg12069, + "9623": msg12070, + "9624": msg12071, + "9625": msg12072, + "9626": msg12073, + "9627": msg12074, + "9628": msg12075, + "9629": msg12076, + "963": select863, + "9630": msg12077, + "9631": msg12078, + "9632": msg12079, + "9633": msg12080, + "9634": msg12081, + "9635": msg12082, + "9636": msg12083, + "9637": msg12084, + "9638": msg12085, + "9639": msg12086, + "964": select864, + "9640": msg12087, + "9641": msg12088, + "9642": msg12089, + "9643": msg12090, + "9644": msg12091, + "9645": msg12092, + "9646": msg12093, + "9647": msg12094, + "9648": msg12095, + "9649": msg12096, + "965": select865, + "9650": msg12097, + "9651": msg12098, + "9652": msg12099, + "9653": msg12100, + "9654": msg12101, + "9655": msg12102, + "9656": msg12103, + "9657": msg12104, + "9658": msg12105, + "9659": msg12106, + "966": select866, + "9660": msg12107, + "9661": msg12108, + "9662": msg12109, + "9663": msg12110, + "9664": msg12111, + "9665": msg12112, + "9666": msg12113, + "9667": msg12114, + "9668": msg12115, + "9669": msg12116, + "967": select867, + "9670": msg12117, + "9671": msg12118, + "9672": msg12119, + "9673": msg12120, + "9674": msg12121, + "9675": msg12122, + "9676": msg12123, + "9677": msg12124, + "9678": msg12125, + "9679": msg12126, + "968": select868, + "9680": msg12127, + "9681": msg12128, + "9682": msg12129, + "9683": msg12130, + "9684": msg12131, + "9685": msg12132, + "9686": msg12133, + "9687": msg12134, + "9688": msg12135, + "9689": msg12136, + "969": select869, + "9690": msg12137, + "9691": msg12138, + "9692": msg12139, + "9693": msg12140, + "9694": msg12141, + "9695": msg12142, + "9696": msg12143, + "9697": msg12144, + "9698": msg12145, + "9699": msg12146, + "97": select30, + "970": select870, + "9700": msg12147, + "9701": msg12148, + "9702": msg12149, + "9703": msg12150, + "9704": msg12151, + "9705": msg12152, + "9706": msg12153, + "9707": msg12154, + "9708": msg12155, + "9709": msg12156, + "971": select871, + "9710": msg12157, + "9711": msg12158, + "9712": msg12159, + "9713": msg12160, + "9714": msg12161, + "9715": msg12162, + "9716": msg12163, + "9717": msg12164, + "9718": msg12165, + "9719": msg12166, + "972": select872, + "9720": msg12167, + "9721": msg12168, + "9722": msg12169, + "9723": msg12170, + "9724": msg12171, + "9725": msg12172, + "9726": msg12173, + "9727": msg12174, + "9728": msg12175, + "9729": msg12176, + "973": select873, + "9730": msg12177, + "9731": msg12178, + "9732": msg12179, + "9733": msg12180, + "9734": msg12181, + "9735": msg12182, + "9736": msg12183, + "9737": msg12184, + "9738": msg12185, + "9739": msg12186, + "974": select874, + "9740": msg12187, + "9741": msg12188, + "9742": msg12189, + "9743": msg12190, + "9744": msg12191, + "9745": msg12192, + "9746": msg12193, + "9747": msg12194, + "9748": msg12195, + "9749": msg12196, + "975": select875, + "9750": msg12197, + "9751": msg12198, + "9752": msg12199, + "9753": msg12200, + "9754": msg12201, + "9755": msg12202, + "9756": msg12203, + "9757": msg12204, + "9758": msg12205, + "9759": msg12206, + "976": select876, + "9760": msg12207, + "9761": msg12208, + "9762": msg12209, + "9763": msg12210, + "9764": msg12211, + "9765": msg12212, + "9766": msg12213, + "9767": msg12214, + "9768": msg12215, + "9769": msg12216, + "977": select877, + "9770": msg12217, + "9771": msg12218, + "9772": msg12219, + "9773": msg12220, + "9774": msg12221, + "9775": msg12222, + "9776": msg12223, + "9777": msg12224, + "9778": msg12225, + "9779": msg12226, + "978": select878, + "9780": msg12227, + "9781": msg12228, + "9782": msg12229, + "9783": msg12230, + "9784": msg12231, + "9785": msg12232, + "9786": msg12233, + "9787": msg12234, + "9788": msg12235, + "9789": msg12236, + "979": select879, + "9790": msg12237, + "9791": msg12238, + "9792": msg12239, + "9793": msg12240, + "9794": msg12241, + "9795": msg12242, + "9796": msg12243, + "9797": msg12244, + "9798": msg12245, + "9799": msg12246, + "980": select880, + "9800": msg12247, + "9801": msg12248, + "9802": msg12249, + "9803": msg12250, + "9804": msg12251, + "9805": msg12252, + "9806": msg12253, + "9807": msg12254, + "9808": msg12255, + "9809": msg12256, + "981": select881, + "9810": msg12257, + "9811": msg12258, + "9812": msg12259, + "9813": msg12260, + "9814": msg12261, + "9815": msg12262, + "9816": msg12263, + "9817": msg12264, + "9818": msg12265, + "9819": msg12266, + "982": select882, + "9820": msg12267, + "9821": msg12268, + "9822": msg12269, + "9823": msg12270, + "9824": msg12271, + "9825": msg12272, + "9826": msg12273, + "9827": msg12274, + "9828": msg12275, + "9829": msg12276, + "983": select883, + "9830": msg12277, + "9831": msg12278, + "9832": msg12279, + "9833": msg12280, + "9834": msg12281, + "9835": msg12282, + "9836": msg12283, + "9837": msg12284, + "9838": msg12285, + "9839": msg12286, + "984": select884, + "9840": msg12287, + "9841": msg12288, + "9842": msg12289, + "9843": msg12290, + "9844": msg12291, + "9845": msg12292, + "9846": msg12293, + "9847": msg12294, + "9848": msg12295, + "9849": msg12296, + "985": select885, + "9850": msg12297, + "9851": msg12298, + "9852": msg12299, + "9853": msg12300, + "9854": msg12301, + "9855": msg12302, + "9856": msg12303, + "9857": msg12304, + "9858": msg12305, + "9859": msg12306, + "986": select886, + "9860": msg12307, + "9861": msg12308, + "9862": msg12309, + "9863": msg12310, + "9864": msg12311, + "9865": msg12312, + "9866": msg12313, + "9867": msg12314, + "9868": msg12315, + "9869": msg12316, + "987": select887, + "9870": msg12317, + "9871": msg12318, + "9872": msg12319, + "9873": msg12320, + "9874": msg12321, + "9875": msg12322, + "9876": msg12323, + "9877": msg12324, + "9878": msg12325, + "9879": msg12326, + "988": select888, + "9880": msg12327, + "9881": msg12328, + "9882": msg12329, + "9883": msg12330, + "9884": msg12331, + "9885": msg12332, + "9886": msg12333, + "9887": msg12334, + "9888": msg12335, + "9889": msg12336, + "989": select889, + "9890": msg12337, + "9891": msg12338, + "9892": msg12339, + "9893": msg12340, + "9894": msg12341, + "9895": msg12342, + "9896": msg12343, + "9897": msg12344, + "9898": msg12345, + "9899": msg12346, + "990": select890, + "9900": msg12347, + "9901": msg12348, + "9902": msg12349, + "9903": msg12350, + "9904": msg12351, + "9905": msg12352, + "9906": msg12353, + "9907": msg12354, + "9908": msg12355, + "9909": msg12356, + "991": select891, + "9910": msg12357, + "9911": msg12358, + "9912": msg12359, + "9913": msg12360, + "9914": msg12361, + "9915": msg12362, + "9916": msg12363, + "9917": msg12364, + "9918": msg12365, + "9919": msg12366, + "992": select892, + "9920": msg12367, + "9921": msg12368, + "9922": msg12369, + "9923": msg12370, + "9924": msg12371, + "9925": msg12372, + "9926": msg12373, + "9927": msg12374, + "9928": msg12375, + "9929": msg12376, + "993": select893, + "9930": msg12377, + "9931": msg12378, + "9932": msg12379, + "9933": msg12380, + "9934": msg12381, + "9935": msg12382, + "9936": msg12383, + "9937": msg12384, + "9938": msg12385, + "9939": msg12386, + "994": select894, + "9940": msg12387, + "9941": msg12388, + "9942": msg12389, + "9943": msg12390, + "9944": msg12391, + "9945": msg12392, + "9946": msg12393, + "9947": msg12394, + "9948": msg12395, + "9949": msg12396, + "995": select895, + "9950": msg12397, + "9951": msg12398, + "9952": msg12399, + "9953": msg12400, + "9954": msg12401, + "9955": msg12402, + "9956": msg12403, + "9957": msg12404, + "9958": msg12405, + "9959": msg12406, + "996": select896, + "9960": msg12407, + "9961": msg12408, + "9962": msg12409, + "9963": msg12410, + "9964": msg12411, + "9965": msg12412, + "9966": msg12413, + "9967": msg12414, + "9968": msg12415, + "9969": msg12416, + "997": select897, + "9970": msg12417, + "9971": msg12418, + "9972": msg12419, + "9973": msg12420, + "9974": msg12421, + "9975": msg12422, + "9976": msg12423, + "9977": msg12424, + "9978": msg12425, + "9979": msg12426, + "998": select898, + "9980": msg12427, + "9981": msg12428, + "9982": msg12429, + "9983": msg12430, + "9984": msg12431, + "9985": msg12432, + "9986": msg12433, + "9987": msg12434, + "9988": msg12435, + "9989": msg12436, + "999": select899, + "9990": msg12437, + "9991": msg12438, + "9992": msg12439, + "9993": msg12440, + "9994": msg12441, + "9995": msg12442, + "9996": msg12443, + "9997": msg12444, + "9998": msg12445, + "9999": msg12446, + "Additional_MAC_Detected_for": msg38460, + "Client_Application_Timeout": msg38477, + "Client_Application_Update": msg38473, + "Client_Timeout": msg38534, + "Client_Update": msg38530, + "ET": msg38485, + "FTD_events": select2466, + "HMNOTIFY": msg1, + "Hops_Change": msg38458, + "Host_IOC_Set": msg38535, + "Host_Timeout": msg38478, + "Host_Type_Changed": msg38536, + "Identity_Timeout": select2450, + "Login": msg38537, + "Logout": msg38538, + "MAC_Information_Change": msg38459, + "MALWARE": select2463, + "NETBIOS_Name_Change": msg38461, + "NGIPS_events": select2468, + "Network_Based_Malware": select2459, + "Network_Based_Retrospective": select2462, + "New_Client": msg38531, + "New_Client_Application": msg38472, + "New_Host": msg38462, + "New_Network_Protocol": msg38463, + "New_OS": msg38471, + "New_TCP_Port": msg38528, + "New_TCP_Service": msg38474, + "New_Transport_Protocol": msg38465, + "New_UDP_Port": msg38529, + "New_UDP_Service": msg38464, + "OS_Confidence_Update": msg38466, + "OS_Information_Update": msg38467, + "Portscan": msg38457, + "Primary_Detection_Engine": select2457, + "S5": select2453, + "Snort_AlertLog": msg38527, + "SystemSettings": select2455, + "TCP_Port_Closed": msg38475, + "TCP_Port_Timeout": msg38476, + "TCP_Server_Information_Update": msg38533, + "TCP_Service_Confidence_Update": msg38468, + "TCP_Service_Information_Update": msg38469, + "UDP_Port_Timeout": msg38481, + "UDP_Server_Information_Update": msg38532, + "UDP_Service_Confidence_Update": msg38482, + "UDP_Service_Information_Update": select2451, + "VLAN_Tag_Information_Update": msg38470, + "connection_events": msg38539, + "snort-sid-template": msg38452, + "spp_portscan": select2445, + }), +]); + +var hdr35 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#2:00010/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var part116 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Impact: '), Field(p0,false)}" +match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); + +var part117 = // "Pattern{Field(hfld10,true), Constant(' [Impact: '), Field(p0,false)}" +match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); + +var part118 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var part119 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Classification: '), Field(p0,false)}" +match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); + +var part120 = // "Pattern{Field(hfld10,true), Constant(' [Classification: '), Field(p0,false)}" +match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); + +var part121 = // "Pattern{Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); + +var part122 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" ['), Field(p0,false)}" +match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); + +var part123 = // "Pattern{Field(hfld10,true), Constant(' ['), Field(p0,false)}" +match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); + +var part124 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); + +var hdr36 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var part125 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" +match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); + +var hdr37 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); + +var part126 = // "Pattern{Constant('at'), Field(p0,false)}" +match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); + +var part127 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); + +var part128 = // "Pattern{Constant('['), Field(hpid,false), Constant(']: ['), Field(p0,false)}" +match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); + +var part129 = // "Pattern{Constant(': ['), Field(p0,false)}" +match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); + +var part130 = // "Pattern{Constant(']'), Field(hversion,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hevent_source,true), Constant(' '), Field(payload,false)}" +match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); + +var hdr38 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" +match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); + +var part131 = // "Pattern{Field(threat_val,true), Constant(' ]:alert {'), Field(p0,false)}" +match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); + +var part132 = // "Pattern{Field(threat_val,true), Constant(' ]: '), Field(fld1,true), Constant(' {'), Field(p0,false)}" +match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); + +var part133 = // "Pattern{Field(threat_val,false), Constant(']: {'), Field(p0,false)}" +match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); + +var part134 = // "Pattern{Field(threat_val,true), Constant(' ] {'), Field(p0,false)}" +match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); + +var part135 = // "Pattern{Field(protocol,false), Constant('} '), Field(p0,false)}" +match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); + +var part136 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(') -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); + +var part137 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); + +var part138 = // "Pattern{Field(saddr,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); + +var part139 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(location_dst,false), Constant(')')}" +match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); + +var part140 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false)}" +match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); + +var part141 = // "Pattern{Field(daddr,false)}" +match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); + +var part142 = // "Pattern{Field(context,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); + +var part143 = // "Pattern{Constant('<<'), Field(interface,false), Constant('> '), Field(p0,false)}" +match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); + +var part144 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); + +var part145 = // "Pattern{Constant('{'), Field(protocol,false), Constant('} '), Field(p0,false)}" +match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); + +var part146 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" +match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); + +var part147 = // "Pattern{Constant(' <<'), Field(interface,false), Constant('> '), Field(p0,false)}" +match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); + +var part148 = // "Pattern{Constant(': '), Field(p0,false)}" +match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); + +var part149 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); + +var part150 = // "Pattern{Field(context,true), Constant(' <<'), Field(interface,false), Constant('> '), Field(protocol,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); + +var part151 = // "Pattern{Field(threat_val,true), Constant(' ]:alert '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); + +var part152 = // "Pattern{Field(threat_val,false), Constant(']: '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); + +var part153 = // "Pattern{Field(threat_val,true), Constant(' ] '), Field(p0,false)}" +match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); + +var part154 = // "Pattern{Constant(''), Field(p0,false)}" +match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); + +var part155 = // "Pattern{Constant(':alert '), Field(p0,false)}" +match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); + +var part156 = // "Pattern{Constant(''), Field(saddr,true), Constant(' -> '), Field(p0,false)}" +match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); + +var part157 = // "Pattern{Constant(''), Field(daddr,false)}" +match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); + +var part158 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' MAC: '), Field(smacaddr,true), Constant(' TTL '), Field(p0,false)}" +match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); + +var part159 = // "Pattern{Field(sinterface,true), Constant(' ('), Field(protocol,true), Constant(' detected)')}" +match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); + +var part160 = // "Pattern{Field(sinterface,false)}" +match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); + +var part161 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> '), Field(p0,false)}" +match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); + +var part162 = // "Pattern{Field(protocol,false)}" +match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); + +var part163 = // "Pattern{Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); + +var part164 = // "Pattern{Constant('>'), Field(p0,false)}" +match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); + +var part165 = // "Pattern{Field(fld1,false), Constant(']['), Field(policyname,false), Constant('] Connection Type: '), Field(event_state,false), Constant(', User: '), Field(username,false), Constant(', Client: '), Field(application,false), Constant(', Application Protocol: '), Field(protocol,false), Constant(', Web App: '), Field(application,false), Constant(', Access Control Rule Name: '), Field(rulename,false), Constant(', Access Control Rule Action: '), Field(action,false), Constant(', Access Control Rule Reasons: '), Field(result,false), Constant(', URL Category: '), Field(category,false), Constant(', URL Reputation: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); + +var part166 = // "Pattern{Constant('Risk unknown, URL: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); + +var part167 = // "Pattern{Field(reputation_num,false), Constant(', URL: '), Field(p0,false)}" +match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); + +var part168 = // "Pattern{Constant('-*> '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); + +var part169 = // "Pattern{Constant('> '), Field(p0,false)}" +match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); + +var part170 = // "Pattern{Constant('From "'), Field(sensor,false), Constant('" at '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); + +var part171 = // "Pattern{Constant('at '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); + +var part172 = // "Pattern{Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" +match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); + +var part173 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' '), Field(network_service,false)}" +match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); + +var part174 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" +match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); + +var select2469 = linear_select([ + dup3, + dup4, +]); + +var select2470 = linear_select([ + dup6, + dup7, +]); + +var select2471 = linear_select([ + dup9, + dup10, +]); + +var hdr39 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(p0,false)}" +match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ + dup19, +])); + +var select2472 = linear_select([ + dup26, + dup27, +]); + +var select2473 = linear_select([ + dup33, + dup34, + dup35, + dup36, +]); + +var select2474 = linear_select([ + dup38, + dup39, + dup40, +]); + +var select2475 = linear_select([ + dup41, + dup42, + dup43, +]); + +var select2476 = linear_select([ + dup58, + dup59, +]); + +var select2477 = linear_select([ + dup67, + dup68, + dup69, +]); + +var select2478 = linear_select([ + dup113, + dup114, + dup115, +]); + +var select2479 = linear_select([ + dup68, + dup69, +]); + +var select2480 = linear_select([ + dup67, + dup124, + dup68, + dup69, +]); + +var select2481 = linear_select([ + dup39, + dup125, +]); + +var select2482 = linear_select([ + dup42, + dup126, +]); + +var select2483 = linear_select([ + dup131, + dup132, +]); + +var part175 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(version,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, +])); + +var part176 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" +match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var select2484 = linear_select([ + dup136, + dup134, +]); + +var part177 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' '), Field(product,false)}" +match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var part178 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" +match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var part179 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,false)}" +match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ + dup135, + dup31, + dup32, + dup47, + dup129, +])); + +var select2485 = linear_select([ + dup148, + dup149, +]); + +var select2486 = linear_select([ + dup153, + dup154, +]); + +var select2487 = linear_select([ + dup155, + dup156, +]); + +var all88 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all89 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var all90 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all91 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var all92 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all93 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all94 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all95 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all96 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all97 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all98 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all99 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all100 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all101 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all102 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all103 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all104 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all105 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all106 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all107 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all108 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all109 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup82, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all110 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all111 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup85, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all112 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup85, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all113 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all114 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup86, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all115 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup86, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all116 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all117 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all118 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all119 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all120 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup87, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all121 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup88, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all122 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup88, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all123 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all124 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all125 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all126 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all127 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all128 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all129 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all130 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all131 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all132 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup91, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all133 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup91, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all134 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all135 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all136 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all137 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all138 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all139 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all140 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all141 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup62, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all142 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup95, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all143 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup95, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all144 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup96, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all145 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup96, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all146 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all147 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all148 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all149 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all150 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all151 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all152 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all153 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all154 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all155 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all156 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all157 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all158 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup44, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all159 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all160 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all161 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all162 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all163 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all164 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all165 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all166 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all167 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup103, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all168 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup103, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all169 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all170 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all171 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all172 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all173 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all174 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup106, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all175 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup106, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all176 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup98, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all177 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup107, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all178 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup107, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all179 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all180 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup72, + dup84, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all181 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all182 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all183 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all184 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all185 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all186 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup92, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all187 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all188 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup72, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all189 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all190 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup80, + dup31, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all191 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup109, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all192 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup109, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all193 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup110, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all194 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup111, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all195 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup111, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all196 = all_match({ + processors: [ + dup75, + dup173, + dup174, + ], + on_success: processor_chain([ + dup110, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup76, + dup50, + dup51, + ]), +}); + +var all197 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup112, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all198 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all199 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup117, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all200 = all_match({ + processors: [ + dup177, + dup116, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all201 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup118, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all202 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all203 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all204 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all205 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all206 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all207 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all208 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup119, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all209 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup120, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all210 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all211 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup94, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all212 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all213 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup121, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all214 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup77, + dup73, + dup74, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all215 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup122, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all216 = all_match({ + processors: [ + dup172, + dup37, + dup173, + dup174, + ], + on_success: processor_chain([ + dup123, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all217 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all218 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all219 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all220 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all221 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all222 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup119, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all223 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup121, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all224 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup93, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all225 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup120, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all226 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup108, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all227 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all228 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup90, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all229 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all230 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup89, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all231 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup97, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all232 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup61, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all233 = all_match({ + processors: [ + dup66, + dup179, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all234 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup118, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all235 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup100, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all236 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup71, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all237 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup63, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all238 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup102, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all239 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup79, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all240 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup70, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all241 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup64, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all242 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup99, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all243 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup101, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all244 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup65, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all245 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup105, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all246 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup81, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all247 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup78, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all248 = all_match({ + processors: [ + dup66, + dup176, + dup60, + dup180, + dup181, + ], + on_success: processor_chain([ + dup104, + dup31, + dup45, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + dup52, + dup53, + dup54, + dup55, + dup56, + ]), +}); + +var all249 = all_match({ + processors: [ + dup57, + dup175, + dup60, + dup173, + dup174, + ], + on_success: processor_chain([ + dup83, + dup31, + dup32, + dup46, + dup47, + dup48, + dup49, + dup50, + dup51, + ]), +}); + +var all250 = all_match({ + processors: [ + dup130, + dup182, + ], + on_success: processor_chain([ + dup127, + dup31, + dup32, + dup47, + dup129, + ]), +}); + +var all251 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + dup159, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); + +var all252 = all_match({ + processors: [ + dup57, + dup191, + dup157, + dup190, + dup160, + dup185, + ], + on_success: processor_chain([ + dup135, + dup31, + dup32, + dup47, + ]), +}); diff --git a/x-pack/filebeat/module/snort/log/ingest/pipeline.yml b/x-pack/filebeat/module/snort/log/ingest/pipeline.yml new file mode 100644 index 00000000000..0db6047881b --- /dev/null +++ b/x-pack/filebeat/module/snort/log/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Snort/Sourcefire + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/snort/log/manifest.yml b/x-pack/filebeat/module/snort/log/manifest.yml new file mode 100644 index 00000000000..a02cbe98ed6 --- /dev/null +++ b/x-pack/filebeat/module/snort/log/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["snort.log", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9532 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/snort/log/test/generated.log b/x-pack/filebeat/module/snort/log/test/generated.log new file mode 100644 index 00000000000..8ecab402325 --- /dev/null +++ b/x-pack/filebeat/module/snort/log/test/generated.log @@ -0,0 +1,100 @@ +Jan 29 2016 06:09:59 quid2184.invalid: %FTD-enim-dqu:CLOCK: System clock set, source: veri, IP: 10.202.72.124, before: inv, after: emo +2016-2-12T13:12:33Z inBCSedu5722.internal.lan nimadmin %NGIPS-medium-uam:AccessControlRuleAction:deny, AccessControlRuleReason:success, SrcIP:10.38.77.13, DstIP:10.212.11.114, SrcPort:3971, DstPort:3716, Protocol: tcp, IngressInterface: eth4091, IngressZone:isiu, ACPolicy:nimadmi, AccessControlRuleName:iatisu, Prefilter Policy:iat, User:tevelit, Client:nsequat, ApplicationProtocol:igmp, InitiatorPackets:llam, ResponderPackets:llamcorp, InitiatorBytes:4512, ResponderBytes:3676, NAPPolicy:eataevit, DNSQuery:uptatev4292.www.invalid, DNSRecordType: a host address, DNSSICategory:atat +Feb 26 20:15:08 tlabo6088.www.localdomain Lor: HMNOTIFY: itecto (Sensor erc): Severity:medium: failure +Mar 12 03:17:42 eporroqu4200.domain atquovo: HMNOTIFY: suntinc (Sensor xeac): Severity:medium: success +Mar 26 10:20:16 eirure: conseq557.mail.lan: aaliquaU@ntor, Analysis & Reporting > lpaqui +2016-4-9T17:22:51Z ationemu5040.www.lan utei %NGIPS-low-oei:AccessControlRuleAction:block, AccessControlRuleReason:unknown, SrcIP:10.182.199.231, DstIP:10.24.67.250, SrcPort:4478, DstPort:2026, Protocol: igmp, IngressInterface: enp0s5361, IngressZone:commod, ACPolicy:adol, AccessControlRuleName:doloremi, Prefilter Policy:luptasn, User:hitect, Client:dol, ApplicationProtocol:ipv6-icmp, InitiatorPackets:modocon, ResponderPackets:que, InitiatorBytes:651, ResponderBytes:3365, NAPPolicy:nsecte, DNSQuery:itame189.domain, DNSRecordType: a host address, DNSSICategory:exercit +Apr 24 00:25:25 uscipit: vitaedi1318.corp: temqu@edol, FailD, colab +May 8 07:27:59 nimid: itatione1916.www.host: oluptate@issus, Analysis & Reporting > osamn +May 22 14:30:33 its7829.localhost datatno: [siutali:5979:1.4418] usmodte [Impact: failure] From esciuntN/idunt at ptasnu May 22 14:30:33 2016 UTC [Classification: rQu] [Priority: oremeu ]:alert {ipv6} 10.110.31.190 -> 10.157.18.252:5300 (eeufugia) +Jun 5 21:33:08 aec3673.internal.host ccaeca: HMNOTIFY: niamq (Sensor lapariat): Severity:medium: failure +Jun 20 04:35:42 admin: stenatu inibu2292.www.invalid: isetquas@ute, Login, Login Success +Jul 4 11:38:16 ori1241.www.corp : HMNOTIFY: ercit (Sensor eporroq): Severity:very-high: failure +Jul 18 18:40:50 atuse: ueipsa748.localdomain: aparia@tatnon, Heartbeat, leumiur +Aug 2 01:43:25 oluptat548.www5.invalid edolorin: HMNOTIFY: dolorem (Sensor tem): Severity:very-high: failure +Aug 16 08:45:59 imadmi: isnis loremag6816.www5.lan: inrepreh@quovo, System > urExcep +Aug 30 15:48:33 tionemu5269.internal.localhost : HMNOTIFY: occaec (Sensor acommodi): Severity:medium: failure +Sep 13 22:51:07 isiutali: lumqu onulamco7734.www.local: uptat@unt, Analysis & Reporting , tass +2016-9-28T05:53:42Z luptatem3834.lan edq %NGIPS-medium-tise:AccessControlRuleAction:block,AccessControlRuleName:tnul,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:ess,ConnectType:quiad,DE:ihilmole,DNSResponseType:saquaea,DstIP:10.80.151.37,DstPort:535,ICMPCode:modico,ICMPType:metco,InitiatorBytes:410,InitiatorPackets:porinc,NAPPolicy:riame,Policy:riat,ResponderBytes:181,ResponderPackets:rumSec,Sinkhole:orp,SrcIP:10.213.109.180,SrcPort:6536,TCPFlags:essequam,URLCategory:ueporro,URLReputation:84.488000,UserName:etcon,ClientVersion:1.4438,WebApplication:orum,OriginalClientIP: Bonoru,IngressInterface: lo5284,EgressInterface: enp0s73,IngressZone: emacc,EgressZone: emp,Prefilter Policy: lamcola,UserAgent: Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: ipiscive,URL: https://www.example.org/etdolor/uat.gif?mmod=iti#nimadm,HTTPResponse: nculp,HTTPReferer: asp,IPReputationSICategory: eacom,DNS_TTL: mag,DNSRecordType: gelitse,DNSQuery: oremqu,GID: idex,SID: radip,Revision: upta,Message: tetura,Classification: rumet,User: uptasnul,Priority: antiumdo, ACPolicy: ecill, ConnectionDuration: 56.481000,Protocol: ipv6,VLAN_ID: 3302,IPSCount: 6436,InlineResult: allow, DNSSICategory: nostrud, URLSICategory: cteturad +Oct 12 2016 12:56:16 exercita2068.api.invalid %FTD-veleumi-nsequatu:CLOCK: System clock set, source: nula, IP: 10.169.84.140, before: santi, after: ritati +Oct 26 2016 19:58:50 orumS757.www5.corp: %FTD-eursint-orio:CLOCK: System clock set, source: gna, IP: 10.130.231.129, before: olu, after: iameaque +2016-11-10T03:01:24Z sedquian4212.www5.domain magnaa %NGIPS-medium-eca:AccessControlRuleAction:allow,AccessControlRuleName:tes,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:isi,ConnectType:iaecon,DE:aevitaed,DNSResponseType:byCic,DstIP:10.62.8.123,DstPort:5725,ICMPCode:siarc,ICMPType:fdeFin,InitiatorBytes:4053,InitiatorPackets:tobeata,NAPPolicy:nesciun,Policy:amcolab,ResponderBytes:4306,ResponderPackets:isnisiut,Sinkhole:atatnon,SrcIP:10.143.37.32,SrcPort:209,TCPFlags:uisnos,URLCategory:olores,URLReputation:174.651000,UserName:epo,ClientVersion:1.745,WebApplication:borisnis,OriginalClientIP: onorumet,IngressInterface: enp0s6017,EgressInterface: enp0s2440,IngressZone: ipsumq,EgressZone: evit,Prefilter Policy: tno,UserAgent: Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10,ReferencedHost: psumq,URL: https://internal.example.com/atu/teturad.htm?msequ=nvol#enimadmi,HTTPResponse: tateveli,HTTPReferer: osa,IPReputationSICategory: mini,DNS_TTL: rors,DNSRecordType: ssusci,DNSQuery: ames,GID: inimve,SID: uio,Revision: mexercit,Message: byC,Classification: uae,User: oremip,Priority: its, ACPolicy: uptasnul, ConnectionDuration: 115.011000,Protocol: rdp,VLAN_ID: 7541,IPSCount: 239,InlineResult: deny, DNSSICategory: nse, URLSICategory: miurere +Nov 24 10:03:59 ntor: oinBCSed3444.api.local: smodtem@roquisqu, Logout, Logout Success +Dec 8 17:06:33 apari5002.api.test orum: [nsequat:27813:1.6724] auto [Impact: failure] From sci at periam Dec 8 17:06:33 2016 UTC [Classification: fugiatnu] [Priority: dolor ]: {icmp} 10.182.213.195:7119 (tur) -> 10.9.200.197 +2016-12-23T00:09:07Z audant3412.www.local remeum %NGIPS-medium-animi:AccessControlRuleAction:allow, AccessControlRuleReason:failure, SrcIP:10.210.180.142, DstIP:10.111.33.70, SrcPort:3015, DstPort:3758, Protocol: ggp, IngressInterface: enp0s6049, IngressZone:amcolabo, ACPolicy:orsitvol, AccessControlRuleName:eriam, Prefilter Policy:anonn, User:utpers, Client:num, ApplicationProtocol:tcp, InitiatorPackets:iaturE, ResponderPackets:epor, InitiatorBytes:3465, ResponderBytes:3813, NAPPolicy:amnih, DNSQuery:tper4341.lan, DNSRecordType: a host address, DNSSICategory:nulamc +Jan 6 07:11:41 antiu3533.internal.domain iatquovo: HMNOTIFY: lapari (Sensor Mal): Severity:medium: success +Jan 20 14:14:16 cidu921.internal.lan quamq: Sha256:usan Disposition: Malware Threat name: tdolo IP Addresses: 10.222.183.123<<-10.165.33.19 +Feb 3 21:16:50 unturmag6190.api.lan remeum: [etur:16539:1.890] "Quisa" [Impact: unknown] From dolo at modoco Feb 3 21:16:50 2017 UTC [Classification: Finibus] [Priority: uisautei]: {rdp} 10.52.190.18:4411 -> 10.238.223.171 +Feb 18 04:19:24 conseq6079.www.corp tiu: [wri:26992:1.3902] asper [Impact: unknown] From orem/inibus at secte Feb 18 04:19:24 2017 UTC [Classification: ctobeat] [Priority: onsec ]: {udp} 10.68.233.163 -> 10.160.178.109:1934 +Mar 4 2017 11:21:59 tvol3402.www.local %FTD-ollita-qua:CLOCK: System clock set, source: ionula, IP: 10.162.109.83, before: nderi, after: tem +Mar 18 2017 18:24:33 xcep3783.internal.localhost %FTD-ercitati-atem:User 'serro' executed the 'lumquid' command. +Apr 2 01:27:07 ciatisun7378.www5.invalid didun: HMNOTIFY: riaturEx (Sensor nde): Severity:low: unknown +Apr 16 08:29:41 iqu4858.mail.invalid audant: [obeata:11634:1.6627] "minimve" [Impact: unknown] From "toditau/uiad" at nvolupta Apr 16 08:29:41 2017 UTC [Classification: exercit] [Priority: dexer ]:alert {igmp} 10.116.175.84 -> 10.213.100.153 +Apr 30 15:32:16 lumqui: ectet ionu3320.api.localhost: estq@quasiarc, Command Line,aliquaU +May 14 22:34:50 tvolu: imve ollitan5079.www.lan: deriti@edictasu, Health > eturadi +May 29 05:37:24 nihilmol1849.api.local eporroq: Protocol: tcp, AccessControlRuleAction:block,AccessControlRuleName:iatn,AccessControlRuleReason:unknown,ApplicationProtocol:igmp,Client:eli,ConnectType:rissusci,DE:ectetur,DNSResponseType:dictasun,DstIP:10.26.95.225,DstPort:4196,FileCount:3674,ICMPCode:oluptate,ICMPType:ntut,InitiatorBytes:5153,InitiatorPackets:scipit,NAPPolicy:litess,Policy:tore,ResponderBytes:5269,ResponderPackets:quunturm,Sinkhole:quovo,SrcIP:10.143.219.250,SrcPort:1444,TCPFlags:conse,URLCategory:aturve,URLReputation:8.942000,UserName:fdeFin,ClientVersion:1.2871,WebApplication:psu,OriginalClientIP: strud,IngressInterface: eth6386,EgressInterface: lo7421,IngressZone: ratv,EgressZone: veni,Prefilter Policy: metM,UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0],ReferencedHost: tate,URL: https://internal.example.com/uun/amrem.gif?umq=ita#ipsaquae,HTTPResponse: olu,HTTPReferer: exerci,IPReputationSICategory: isnostru,DNS_TTL: iad,DNSRecordType: ngelits,DNSQuery: volupt,GID: billoi,SID: 38352,Revision: utaliqui,Message: uov,Classification: pariat,User: icaboNe,Priority: boreetd, ACPolicy: uir +Jun 12 12:39:58 ipsu: [oremip] ota4562.local: epteurs@itse, Task Queue, rever +Jun 26 19:42:33 eiu: [maliquam] gnama5033.www5.home: ction@emveleum, Object > siuta +Jul 11 02:45:07 sum6106.www.home ulamc: HMNOTIFY: doe (Sensor eiusm): Severity:very-high: failure +Jul 25 09:47:41 ugiatn: squa2763.www.lan: trude@snulap, Task Queue, onsequat +2017-8-8T16:50:15Z aturvel1847.mail.localdomain sedquia %NGIPS-high-ostrudex:AccessControlRuleAction:cancel, AccessControlRuleReason:unknown, SrcIP:10.240.144.78, DstIP:10.251.159.118, SrcPort:2998, DstPort:2795, Protocol: ipv6, IngressInterface: lo6367, IngressZone:ptatems, ACPolicy:tenima, AccessControlRuleName:emagnam, Prefilter Policy:iaco, User:urQuisa, Client:ipi, ApplicationProtocol:ipv6-icmp, InitiatorPackets:amali, ResponderPackets:onula, InitiatorBytes:1580, ResponderBytes:4902, NAPPolicy:por, DNSQuery:stiae3403.internal.localhost, DNSRecordType: a host address, DNSSICategory:Ute +Aug 22 23:52:50 setq5996.corp : HMNOTIFY: odi (Sensor tper): Severity:medium: success +Sep 6 06:55:24 quiano3025.api.localhost oluptat: HMNOTIFY: sequatD (Sensor emap): Severity:very-high: unknown +Sep 20 13:57:58 qui7797.www.host : HMNOTIFY: umet (Sensor psaquaea): Severity:low: failure +2017-10-4T21:00:32Z Utenim3707.www5.host iamquisn %NGIPS-low-lor:AccessControlRuleAction:cancel, AccessControlRuleReason:success, SrcIP:10.140.209.249, DstIP:10.201.132.114, SrcPort:1801, DstPort:639, Protocol: ggp, IngressInterface: lo3580, IngressZone:eacommo, ACPolicy:litani, AccessControlRuleName:temse, Prefilter Policy:samvo, User:itsedd, Client:icta, ApplicationProtocol:igmp, InitiatorPackets:labori, ResponderPackets:ditau, InitiatorBytes:470, ResponderBytes:5413, NAPPolicy:olest, DNSQuery:urau1660.www.lan, DNSRecordType: a host address, DNSSICategory:Neq +Oct 19 04:03:07 Nequepor: [aUten] edutpers3482.www5.corp: mnisis@onsequa, Access Control Policy > sunt +Nov 2 11:05:41 nofde7732.internal.test emp: [emoeni:13228:1.2633] taliqui [Impact: failure] From labo at ssecill Nov 2 11:05:41 2017 UTC [Classification: umquam] [Priority: onev ]: atu {ipv6} 10.198.44.231 -> 10.36.122.169:6751 (ariatu) +2017-11-16T18:08:15Z byCicero7475.www.localhost abillo %NGIPS-medium-eav:AccessControlRuleAction:block, AccessControlRuleReason:failure, SrcIP:10.77.86.215, DstIP:10.144.162.122, SrcPort:5913, DstPort:2080, Protocol: udp, IngressInterface: lo5079, IngressZone:sequine, ACPolicy:minimv, AccessControlRuleName:ffici, Prefilter Policy:rsintoc, User:boreetd, Client:rehende, ApplicationProtocol:icmp, InitiatorPackets:erspic, ResponderPackets:orincidi, InitiatorBytes:3273, ResponderBytes:6430, NAPPolicy:quipe, DNSQuery:evita850.localdomain, DNSRecordType: a host address, DNSSICategory:tiu +Dec 1 01:10:49 acons: [enbyCic] aturau3002.api.corp: sci@psamvolu, itsedqui +2017-12-15T08:13:24Z ntiumt238.internal.corp isc %NGIPS-high-odite:AccessControlRuleAction:cancel,AccessControlRuleName:ostr,AccessControlRuleReason:unknown,ApplicationProtocol:tcp,Client:itan,ConnectType:olorin,DE:oluptat,DNSResponseType:olors,DstIP:10.85.61.13,DstPort:6593,ICMPCode:quian,ICMPType:xerci,InitiatorBytes:5178,InitiatorPackets:upt,NAPPolicy:uovolu,Policy:itten,ResponderBytes:4805,ResponderPackets:abo,Sinkhole:orisnis,SrcIP:10.212.37.178,SrcPort:76,TCPFlags:aconseq,URLCategory:isnos,URLReputation:132.397000,UserName:lit,ClientVersion:1.4,WebApplication:odic,OriginalClientIP: ono,IngressInterface: eth1462,EgressInterface: enp0s3976,IngressZone: ine,EgressZone: hend,Prefilter Policy: rcit,UserAgent: Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30,ReferencedHost: nsecte,URL: https://api.example.org/tat/pitlabor.gif?rrorsi=loremqu#busBono,HTTPResponse: mnisiut,HTTPReferer: eabil,IPReputationSICategory: olu,DNS_TTL: uaUte,DNSRecordType: empor,DNSQuery: ate,GID: eca,SID: inre,Revision: aliqu,Message: orem,Classification: dquian,User: isaute,Priority: rumetMa, ACPolicy: utfugit, ConnectionDuration: 95.196000,Protocol: ggp,VLAN_ID: 5189,IPSCount: 1350,InlineResult: allow, DNSSICategory: ntocca, URLSICategory: emquelau +Dec 29 15:15:58 atu2951.test : HMNOTIFY: pitlab (Sensor riosamn): Severity:medium: success +Jan 12 22:18:32 mini: tutl uipe5295.api.localhost: mwrit@dminimve, Access Control Policy > madminim +2018-1-27T05:21:06Z tatiset5041.www5.local tevelit %NGIPS-low-Utenim:AccessControlRuleAction:deny,AccessControlRuleName:uisa,AccessControlRuleReason:unknown,ApplicationProtocol:ggp,Client:siutal,ConnectType:umetMalo,DE:onevolu,DNSResponseType:itautfug,DstIP:10.236.221.212,DstPort:5294,ICMPCode:nsequatD,ICMPType:amcorp,InitiatorBytes:1539,InitiatorPackets:idolor,NAPPolicy:umdo,Policy:sequatu,ResponderBytes:7142,ResponderPackets:ecillu,Sinkhole:ipsaqu,SrcIP:10.31.46.127,SrcPort:7526,TCPFlags:magn,URLCategory:amcola,URLReputation:173.477000,UserName:sno,ClientVersion:1.6406,WebApplication:ntiu,OriginalClientIP: tametco,IngressInterface: lo6910,EgressInterface: eth6946,IngressZone: non,EgressZone: pta,Prefilter Policy: asnul,UserAgent: Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91,ReferencedHost: todit,URL: https://www.example.com/fug/ulpaq.gif?piscivel=ueporr#udex,HTTPResponse: ipexeac,HTTPReferer: uin,IPReputationSICategory: isci,DNS_TTL: archi,DNSRecordType: rsitame,DNSQuery: qui,GID: umdolo,SID: tate,Revision: sintocca,Message: ugiat,Classification: asuntex,User: uovolup,Priority: expl, ACPolicy: animi, ConnectionDuration: 63.677000,Protocol: ipv6,VLAN_ID: 3389,IPSCount: 1457,InlineResult: cancel, DNSSICategory: taliqui, URLSICategory: doloremi +Feb 10 12:23:41 atevel: [oloremeu] esse2198.mail.example: uaturvel@quisqua, System > sedquian +Feb 24 2018 19:26:15 pitlab5165.localdomain %FTD-uptate-tevelite:CLOCK: System clock set, source: cto, IP: 10.17.172.91, before: agn, after: dip +Mar 11 02:28:49 acomm: [edquia] uinesci6041.api.local: pers@lpaquiof, Analysis isisten +Mar 25 09:31:24 uovol2459.www5.invalid volup: [nimi:5155:1.2115] lillum [Impact: success] From suntin at consequa Mar 25 09:31:24 2018 UTC [Classification: tionu] [Priority: umqua ]:alert {tcp} 10.28.105.106 -> 10.60.137.215:3266 (icons) +Apr 8 16:33:58 ptate7215.www5.home mquiado: HMNOTIFY: ssequa (Sensor nisist): Severity:low: failure +Apr 22 23:36:32 metc7395.lan ataevit: Protocol: rdp, AccessControlRuleAction:deny,AccessControlRuleName:toditaut,AccessControlRuleReason:success,ApplicationProtocol:ipv6-icmp,Client:didu,ConnectType:emporain,DE:ovo,DNSResponseType:aeabillo,DstIP:10.53.0.68,DstPort:7066,FileCount:4405,ICMPCode:rehen,ICMPType:sitasp,InitiatorBytes:933,InitiatorPackets:exeacom,NAPPolicy:teir,Policy:suntin,ResponderBytes:4053,ResponderPackets:upta,Sinkhole:iaeconse,SrcIP:10.235.102.51,SrcPort:1905,TCPFlags:uscip,URLCategory:ptasn,URLReputation:163.091000,UserName:san,ClientVersion:1.1124,WebApplication:amqui,OriginalClientIP: itatise,IngressInterface: lo6252,EgressInterface: enp0s6516,IngressZone: liqu,EgressZone: cons,Prefilter Policy: apar,UserAgent: Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: umtota,URL: https://internal.example.com/xplic/isn.html?ame=tenat#etur,HTTPResponse: uisnost,HTTPReferer: snul,IPReputationSICategory: quasia,DNS_TTL: ihilmol,DNSRecordType: seosqui,DNSQuery: tiset,GID: ciade,SID: 31978,Revision: equ,Message: rror,Classification: Exce,User: uae,Priority: tut, ACPolicy: umdol +May 7 2018 06:39:06 Loremips5368.www5.corp: %FTD-ficiade-nemull:Offloaded TCP Flow for connectiontrumexfromenp0s484:10.49.190.163/4220(10.20.167.114/6975) tolo7626:10.166.40.137/5279(10.65.144.119/6233) +May 21 13:41:41 mexer1548.www5.example uidexea: Sha256:emu Disposition: Malware Threat name: asia IP Addresses: 10.162.128.87<<-10.104.78.147 +Jun 4 20:44:15 emulla6625.www5.corp oditaut: Sha256:oloremqu Disposition: Malware Threat name: untNeque IP Addresses: 10.82.180.46<<-10.237.43.87 +Jun 19 03:46:49 magn3657.api.invalid tquiine: [ill:5315:1.4189] "mquisn" [Impact: success] From nby/uames at dolo Jun 19 03:46:49 2018 UTC [Classification: mnihil] [Priority: aturQui ]: umqua {icmp} 10.234.234.205:5714 (eos) -> 10.180.28.156:4665 (quovol) +Jul 3 10:49:23 nis3942.mail.example edutpe: HMNOTIFY: architec (Sensor incul): Severity:high: success +2018-7-17T17:51:58Z iscing6960.api.invalid emipsu %NGIPS-very-high-temUte:AccessControlRuleAction:block, AccessControlRuleReason:success, SrcIP:10.40.250.209, DstIP:10.166.10.187, SrcPort:3941, DstPort:793, Protocol: udp, IngressInterface: lo2032, IngressZone:nculpaq, ACPolicy:mides, AccessControlRuleName:iconseq, Prefilter Policy:nidolo, User:runtmoll, Client:tuserror, ApplicationProtocol:igmp, InitiatorPackets:adipis, ResponderPackets:tet, InitiatorBytes:1259, ResponderBytes:4280, NAPPolicy:inv, DNSQuery:upta788.invalid, DNSRecordType: a host address, DNS_TTL: olupta, DNSSICategory:raincidu +Aug 1 00:54:32 consequu3962.api.localdomain Maloru: Protocol: ggp, AccessControlRuleAction:cancel,AccessControlRuleName:equat,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:estlab,ConnectType:vol,DE:paqui,DNSResponseType:eiusmo,DstIP:10.33.37.252,DstPort:3192,FileCount:2960,ICMPCode:itseddoe,ICMPType:tnulapa,InitiatorBytes:6405,InitiatorPackets:ngelitse,NAPPolicy:Utenim,Policy:llitan,ResponderBytes:2517,ResponderPackets:urs,Sinkhole:uepor,SrcIP:10.52.109.149,SrcPort:1416,TCPFlags:piciati,URLCategory:mipsum,URLReputation:7.706000,UserName:ditaut,ClientVersion:1.91,WebApplication:niamquis,OriginalClientIP: lapariat,IngressInterface: lo5184,EgressInterface: lo62,IngressZone: mpo,EgressZone: deritinv,Prefilter Policy: ten,UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36,ReferencedHost: temporai,URL: https://example.com/emeumf/res.txt?ptasn=ima#emUte,HTTPResponse: atnonp,HTTPReferer: imaven,IPReputationSICategory: cia,DNS_TTL: doconseq,DNSRecordType: quia,DNSQuery: veleum,GID: emUten,SID: 31978,Revision: proiden,Message: cita,Classification: iac,User: ntincul,Priority: mnisiste, ACPolicy: uptas +Aug 15 07:57:06 ita7851.localhost dictas: Sha256:equaturv Disposition: Malware Threat name: rsi IP Addresses: 10.78.180.219<<-10.198.202.72 +Aug 29 14:59:40 laparia5374.api.domain norumet: [tconse:26152:1.2390] "tam" [Impact: success] From "inc/riaturEx" at eleumiur Aug 29 14:59:40 2018 UTC [Classification: eufugi] [Priority: ionu ] < {ggp} 10.147.155.100 -> 10.232.67.182:2086 (maccusan) +Sep 12 22:02:15 onse3711.api.domain aliquaUt: [boreet:9193:1.1034] vol [Impact: unknown] From "nof/boNe" at ovolu Sep 12 22:02:15 2018 UTC [Classification: cid] [Priority: periam ] {ggp} 10.4.147.70:3210 -> 10.95.152.78:1267 +Sep 27 05:04:49 elite: nde iac7016.api.lan: antiu@llumquid, FailD, paq +Oct 11 12:07:23 sit: tte4006.www5.test: lors@isautem, Intrusion Events,metco +2018-10-25T19:09:57Z equatD1241.www5.host rpo %NGIPS-low-econs:AccessControlRuleAction:cancel,AccessControlRuleName:bor,AccessControlRuleReason:success,ApplicationProtocol:udp,Client:ten,ConnectType:ssec,DE:snulapar,DNSResponseType:maccusan,DstIP:10.54.49.229,DstPort:1089,ICMPCode:iset,ICMPType:piciatis,InitiatorBytes:3781,InitiatorPackets:dolor,NAPPolicy:tur,Policy:sBo,ResponderBytes:1426,ResponderPackets:rehende,Sinkhole:iaeco,SrcIP:10.204.18.92,SrcPort:4216,TCPFlags:psamvolu,URLCategory:odte,URLReputation:12.264000,UserName:aparia,ClientVersion:1.2692,WebApplication:reetd,OriginalClientIP: nos,IngressInterface: enp0s6783,EgressInterface: enp0s2434,IngressZone: urveli,EgressZone: agnaa,Prefilter Policy: olu,UserAgent: Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36,ReferencedHost: atae,URL: https://www5.example.net/boNemo/duntutla.html?tmollit=ptat#nnumqu,HTTPResponse: billoi,HTTPReferer: ciatisu,IPReputationSICategory: evelites,DNS_TTL: vol,DNSRecordType: ommodi,DNSQuery: ritat,GID: dipi,SID: asnulapa,Revision: atev,Message: onsequa,Classification: seddoe,User: quisnost,Priority: tionu, ACPolicy: ciades, ConnectionDuration: 116.537000,Protocol: icmp,VLAN_ID: 764,IPSCount: 5618,InlineResult: accept, DNSSICategory: nvolupt, URLSICategory: stia +Nov 9 02:12:32 essequ121.localdomain uaturQui: Sha256:emi Disposition: Malware Threat name: mipsumq IP Addresses: 10.216.14.36<<-10.224.250.83 +Nov 23 09:15:06 borios1685.www.localhost umfu: [inesc:10329:1.6298] "olupt" [Impact: failure] From otamr/nonnu at riamea Nov 23 09:15:06 2018 UTC [Classification: taliquip] [Priority: upt ]:alert {ggp} 10.38.22.60:653 (ipi) -> 10.231.10.63 +2018-12-7T16:17:40Z odt2318.localdomain dut %NGIPS-high-remape:AccessControlRuleAction:cancel, AccessControlRuleReason:failure, SrcIP:10.46.57.181, DstIP:10.29.231.11, SrcPort:3760, DstPort:2231, Protocol: ggp, IngressInterface: eth1891, IngressZone:orsitam, ACPolicy:olupt, AccessControlRuleName:tlab, Prefilter Policy:str, User:sit, Client:atat, ApplicationProtocol:tcp, InitiatorPackets:isnos, ResponderPackets:emp, InitiatorBytes:42, ResponderBytes:560, NAPPolicy:sciveli, DNSQuery:Bonoru5658.mail.invalid, DNSRecordType: a host address, DNSSICategory:omm +Dec 21 23:20:14 dolores: oin ueipsa6797.mail.home: agnaal@itaut, Access Control Policy > Bonoru +Jan 5 06:22:49 ntinculp: uptatemU iono5161.www5.localhost: ita@olupt, System > orisnisi +Jan 19 13:25:23 untut3537.domain sit: Protocol: ggp, AccessControlRuleAction:cancel,AccessControlRuleName:uia,AccessControlRuleReason:unknown,ApplicationProtocol:ipv6-icmp,Client:nostrume,ConnectType:corpori,DE:unti,DNSResponseType:tena,DstIP:10.199.173.109,DstPort:1531,FileCount:4238,ICMPCode:rmagni,ICMPType:tiono,InitiatorBytes:7625,InitiatorPackets:imipsamv,NAPPolicy:eroin,Policy:xplicabo,ResponderBytes:4308,ResponderPackets:cidu,Sinkhole:tquo,SrcIP:10.20.64.209,SrcPort:5294,TCPFlags:mrem,URLCategory:maliquam,URLReputation:112.060000,UserName:eiusmo,ClientVersion:1.3720,WebApplication:its,OriginalClientIP: prehende,IngressInterface: eth685,EgressInterface: lo919,IngressZone: uiration,EgressZone: secte,Prefilter Policy: ulapari,UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: vol,URL: https://api.example.com/non/quaturQu.gif?etura=taedi#edi,HTTPResponse: quiacon,HTTPReferer: udexerc,IPReputationSICategory: volu,DNS_TTL: tassit,DNSRecordType: metconse,DNSQuery: remeum,GID: equaturQ,SID: 38469,Revision: mollita,Message: eserun,Classification: sBono,User: icab,Priority: iquaUten, ACPolicy: oluptasn +2019-2-2T20:27:57Z atio5250.api.localhost idolo %NGIPS-low-ritat:AccessControlRuleAction:block, AccessControlRuleReason:success, SrcIP:10.107.144.80, DstIP:10.135.250.25, SrcPort:703, DstPort:1306, Protocol: icmp, IngressInterface: lo3342, IngressZone:emquiavo, ACPolicy:nsequ, AccessControlRuleName:Secti, Prefilter Policy:utlabore, User:suscipi, Client:tlabor, ApplicationProtocol:ggp, InitiatorPackets:dolore, ResponderPackets:xer, InitiatorBytes:4673, ResponderBytes:1881, NAPPolicy:msequine, DNSQuery:reetd7201.invalid, DNSRecordType: a host address, DNS_TTL: ugiatquo, DNSSICategory:ende +Feb 17 03:30:32 tnula4380.mail.test edolo: HMNOTIFY: olupta (Sensor volu): Severity:low: failure +Mar 3 10:33:06 ugiat: [quiin] apar2567.www.localhost: iscing@ser, Policies > nama +Mar 17 2019 17:35:40 onsecte5119.www.invalid %FTD-dolore-iineavol:Failed to locate egress interface for icmp from enp0s3923:10.198.207.31/579 to 10.5.88.183/7518 +Apr 1 00:38:14 uis: [oluptat] iutali3143.host: ect@fdeFi, Analysis & Reporting , eritat +Apr 15 07:40:49 prehende: [spern] orro7466.www5.lan: issu@accusant, rrorsitv +Apr 29 14:43:23 quii: [dantiu] epre7710.www.domain: aria@ugi, Heartbeat, econ +May 13 21:45:57 tio: [tlabori] nsequatu2799.www5.invalid: mape@aboree, Task Queue, eumiurer +2019-5-28T04:48:31Z scingel1634.api.home orsit %NGIPS-high-meaq:AccessControlRuleAction:block,AccessControlRuleName:uaUten,AccessControlRuleReason:failure,ApplicationProtocol:icmp,Client:aec,ConnectType:issus,DE:ica,DNSResponseType:scingeli,DstIP:10.10.40.136,DstPort:6091,ICMPCode:idu,ICMPType:neavolup,InitiatorBytes:694,InitiatorPackets:giatquov,NAPPolicy:ovolupta,Policy:oen,ResponderBytes:7141,ResponderPackets:mtot,Sinkhole:entorev,SrcIP:10.34.89.14,SrcPort:4988,TCPFlags:quisnost,URLCategory:chitecto,URLReputation:124.035000,UserName:quelauda,ClientVersion:1.992,WebApplication:mquia,OriginalClientIP: saquaeab,IngressInterface: lo2474,EgressInterface: eth6425,IngressZone: deFini,EgressZone: radip,Prefilter Policy: odiconse,UserAgent: Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36,ReferencedHost: untu,URL: https://mail.example.net/quunturm/upta.gif?exer=mvolup#litseddo,HTTPResponse: ccaeca,HTTPReferer: snostr,IPReputationSICategory: ratvol,DNS_TTL: olaboris,DNSRecordType: smodite,DNSQuery: eataevi,GID: conseq,SID: quo,Revision: texplica,Message: urQuis,Classification: umetMa,User: tisetqua,Priority: lore, ACPolicy: taedicta, ConnectionDuration: 141.678000,Protocol: udp,VLAN_ID: 2110,IPSCount: 7554,InlineResult: cancel, DNSSICategory: tmollita, URLSICategory: turQuis +2019-6-11T11:51:06Z inBCSe364.www.corp ntore %NGIPS-very-high-tsedquia:AccessControlRuleAction:deny,AccessControlRuleName:mea,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:illoinv,ConnectType:euf,DE:turveli,DNSResponseType:onofdeFi,DstIP:10.197.182.37,DstPort:4472,ICMPCode:quaUte,ICMPType:ercitati,InitiatorBytes:6085,InitiatorPackets:rehe,NAPPolicy:hilmole,Policy:etura,ResponderBytes:540,ResponderPackets:eumiure,Sinkhole:exe,SrcIP:10.182.121.165,SrcPort:4822,TCPFlags:tate,URLCategory:tev,URLReputation:46.627000,UserName:uira,ClientVersion:1.2734,WebApplication:ncididu,OriginalClientIP: numqu,IngressInterface: enp0s1059,EgressInterface: enp0s3789,IngressZone: uscipitl,EgressZone: utfugit,Prefilter Policy: utali,UserAgent: Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;],ReferencedHost: peria,URL: https://api.example.com/uscip/uptatem.txt?eetd=orin#remag,HTTPResponse: conse,HTTPReferer: ate,IPReputationSICategory: iamq,DNS_TTL: tationul,DNSRecordType: qui,DNSQuery: porissu,GID: one,SID: mqu,Revision: iofficia,Message: uisnostr,Classification: lit,User: stlabo,Priority: uaer, ACPolicy: ectob, ConnectionDuration: 159.885000,Protocol: rdp,VLAN_ID: 350,IPSCount: 7423,InlineResult: allow, DNSSICategory: orema, URLSICategory: enderit +2019-6-25T18:53:40Z uaeratv2083.internal.localhost essecil %NGIPS-medium-uptate:AccessControlRuleAction:allow, AccessControlRuleReason:unknown, SrcIP:10.154.87.98, DstIP:10.186.68.87, SrcPort:2632, DstPort:2129, Protocol: igmp, IngressInterface: eth2658, IngressZone:suscipi, ACPolicy:eirure, AccessControlRuleName:itsed, Prefilter Policy:fugiat, User:ore, Client:labo, ApplicationProtocol:ipv6-icmp, InitiatorPackets:nisi, ResponderPackets:pidatatn, InitiatorBytes:2005, ResponderBytes:4560, NAPPolicy:odico, DNSQuery:onofdeFi1149.www5.domain, DNSRecordType: a host address, DNSSICategory:ioffici +2019-7-10T01:56:14Z nvo2629.example onsequ %NGIPS-medium-itess:AccessControlRuleAction:allow, AccessControlRuleReason:unknown, SrcIP:10.35.59.140, DstIP:10.67.211.63, SrcPort:1832, DstPort:7478, Protocol: udp, IngressInterface: eth3613, IngressZone:temqu, ACPolicy:emse, AccessControlRuleName:dantiu, Prefilter Policy:oluptate, User:onnu, Client:Ciceroin, ApplicationProtocol:udp, InitiatorPackets:itempora, ResponderPackets:uovol, InitiatorBytes:4338, ResponderBytes:584, NAPPolicy:bore, DNSQuery:lumdol5252.internal.test, DNSRecordType: a host address, DNS_TTL: seosq, DNSSICategory:orain +Jul 24 08:58:48 quianonn2762.api.localhost : HMNOTIFY: eeufugia (Sensor mquis): Severity:very-high: unknown +Aug 7 16:01:23 ver: [quaturv] atn2219.api.invalid: radip@ipsum, Heartbeat, itesse +Aug 21 23:03:57 equu1159.internal.localhost psumdol: HMNOTIFY: atcup (Sensor urautodi): Severity:medium: failure +Sep 5 06:06:31 dexer: [tionofde] urQuisau2442.mail.invalid: uptate@itesse, Login, Login Success +Sep 19 13:09:05 cididu3187.home asperna: Sha256:llumdolo Disposition: Malware Threat name: sequines IP Addresses: 10.14.46.141->10.179.27.185 +Oct 3 20:11:40 lorem: aliqua4025.www.localdomain: deFinibu@pitlab, Logout, Logout Success +Oct 18 03:14:14 ntutlab: aecatcup citati1297.api.domain: emp@uptate, Policies > olupta +Nov 1 10:16:48 nreprehe2138.www5.domain : HMNOTIFY: eursi (Sensor aute): Severity:medium: success +Nov 15 17:19:22 pari: [ent] idolore6589.api.localdomain: ctobea@audanti, Logout, Logout Success +Nov 30 2019 00:21:57 erunt3957.internal.lan %FTD-aut-iono:TCP Flow is no longer offloaded for connection runtmo from lo2571:10.118.103.185/1333 (10.240.77.10/2226) to lo5895:10.125.130.61/6154 (10.32.195.34/135) +Dec 14 07:24:31 ntNe7144.api.lan oremips: Sha256:numqu Disposition: Malware Threat name: sed IP Addresses: 10.111.130.177<<-10.188.88.133 diff --git a/x-pack/filebeat/module/snort/log/test/generated.log-expected.json b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json new file mode 100644 index 00000000000..62a15952dd8 --- /dev/null +++ b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json @@ -0,0 +1,3607 @@ +[ + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 29 2016 06:09:59 quid2184.invalid: %FTD-enim-dqu:CLOCK: System clock set, source: veri, IP: 10.202.72.124, before: inv, after: emo", + "fileset.name": "log", + "host.ip": "10.202.72.124", + "host.name": "quid2184.invalid", + "input.type": "log", + "log.offset": 0, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.202.72.124" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "dqu", + "rsa.misc.change_attrib": "Time", + "rsa.misc.change_new": "emo", + "rsa.misc.change_old": "inv", + "rsa.misc.event_source": "veri", + "rsa.network.alias_host": [ + "quid2184.invalid" + ], + "rsa.time.day": "29", + "rsa.time.month": "Jan", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 3676, + "destination.ip": [ + "10.212.11.114" + ], + "destination.port": 3716, + "event.action": "deny", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2016-2-12T13:12:33Z inBCSedu5722.internal.lan nimadmin %NGIPS-medium-uam:AccessControlRuleAction:deny, AccessControlRuleReason:success, SrcIP:10.38.77.13, DstIP:10.212.11.114, SrcPort:3971, DstPort:3716, Protocol: tcp, IngressInterface: eth4091, IngressZone:isiu, ACPolicy:nimadmi, AccessControlRuleName:iatisu, Prefilter Policy:iat, User:tevelit, Client:nsequat, ApplicationProtocol:igmp, InitiatorPackets:llam, ResponderPackets:llamcorp, InitiatorBytes:4512, ResponderBytes:3676, NAPPolicy:eataevit, DNSQuery:uptatev4292.www.invalid, DNSRecordType: a host address, DNSSICategory:atat", + "fileset.name": "log", + "host.name": "uptatev4292.www.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 135, + "network.application": "nsequat", + "network.protocol": "igmp", + "observer.egress.interface.name": "eth4091", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.212.11.114", + "10.38.77.13" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "uam", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.category": "atat", + "rsa.misc.policy_name": "eataevit", + "rsa.misc.result": "success", + "rsa.misc.rule_name": "iatisu", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "uptatev4292.www.invalid" + ], + "rsa.network.dinterface": "eth4091", + "rsa.network.zone_dst": "isiu", + "rsa.time.day": "12", + "rule.name": "iatisu", + "service.type": "snort", + "source.bytes": 4512, + "source.ip": [ + "10.38.77.13" + ], + "source.port": 3971, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "itecto", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 26 20:15:08 tlabo6088.www.localdomain Lor: HMNOTIFY: itecto (Sensor erc): Severity:medium: failure", + "fileset.name": "log", + "host.name": "tlabo6088.www.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 721, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "itecto", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "erc", + "rsa.misc.severity": "medium", + "rsa.time.day": "26", + "rsa.time.month": "Feb", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "suntinc", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 12 03:17:42 eporroqu4200.domain atquovo: HMNOTIFY: suntinc (Sensor xeac): Severity:medium: success", + "fileset.name": "log", + "host.name": "eporroqu4200.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 824, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "suntinc", + "rsa.misc.result": "success", + "rsa.misc.sensor": "xeac", + "rsa.misc.severity": "medium", + "rsa.time.day": "12", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 26 10:20:16 eirure: conseq557.mail.lan: aaliquaU@ntor, Analysis & Reporting > lpaqui", + "file.name": "eirure", + "fileset.name": "log", + "host.name": "conseq557.mail.lan", + "input.type": "log", + "log.offset": 927, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "aaliquaU" + ], + "rsa.db.index": "lpaqui", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Analysis & Reporting", + "rsa.network.alias_host": [ + "conseq557.mail.lan" + ], + "rsa.time.day": "26", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "aaliquaU" + }, + { + "destination.bytes": 3365, + "destination.ip": [ + "10.24.67.250" + ], + "destination.port": 2026, + "event.action": "block", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2016-4-9T17:22:51Z ationemu5040.www.lan utei %NGIPS-low-oei:AccessControlRuleAction:block, AccessControlRuleReason:unknown, SrcIP:10.182.199.231, DstIP:10.24.67.250, SrcPort:4478, DstPort:2026, Protocol: igmp, IngressInterface: enp0s5361, IngressZone:commod, ACPolicy:adol, AccessControlRuleName:doloremi, Prefilter Policy:luptasn, User:hitect, Client:dol, ApplicationProtocol:ipv6-icmp, InitiatorPackets:modocon, ResponderPackets:que, InitiatorBytes:651, ResponderBytes:3365, NAPPolicy:nsecte, DNSQuery:itame189.domain, DNSRecordType: a host address, DNSSICategory:exercit", + "fileset.name": "log", + "host.name": "itame189.domain", + "input.type": "log", + "log.level": "low", + "log.offset": 1016, + "network.application": "dol", + "network.protocol": "ipv6-icmp", + "observer.egress.interface.name": "enp0s5361", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.182.199.231", + "10.24.67.250" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "oei", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "exercit", + "rsa.misc.policy_name": "nsecte", + "rsa.misc.result": "unknown", + "rsa.misc.rule_name": "doloremi", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "itame189.domain" + ], + "rsa.network.dinterface": "enp0s5361", + "rsa.network.zone_dst": "commod", + "rsa.time.day": "9", + "rule.name": "doloremi", + "service.type": "snort", + "source.bytes": 651, + "source.ip": [ + "10.182.199.231" + ], + "source.port": 4478, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 24 00:25:25 uscipit: vitaedi1318.corp: temqu@edol, FailD, colab", + "file.name": "uscipit", + "fileset.name": "log", + "host.name": "vitaedi1318.corp", + "input.type": "log", + "log.offset": 1590, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "temqu" + ], + "rsa.db.index": "colab", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "vitaedi1318.corp" + ], + "rsa.time.day": "24", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "temqu" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 8 07:27:59 nimid: itatione1916.www.host: oluptate@issus, Analysis & Reporting > osamn", + "file.name": "nimid", + "fileset.name": "log", + "host.name": "itatione1916.www.host", + "input.type": "log", + "log.offset": 1658, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "oluptate" + ], + "rsa.db.index": "osamn", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Analysis & Reporting", + "rsa.network.alias_host": [ + "itatione1916.www.host" + ], + "rsa.time.day": "8", + "rsa.time.month": "May", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "oluptate" + }, + { + "destination.geo.country_name": "eeufugia", + "destination.ip": [ + "10.157.18.252" + ], + "destination.port": 5300, + "event.code": "5979", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 22 14:30:33 its7829.localhost datatno: [siutali:5979:1.4418] usmodte [Impact: failure] From esciuntN/idunt at ptasnu May 22 14:30:33 2016 UTC [Classification: rQu] [Priority: oremeu ]:alert {ipv6} 10.110.31.190 -> 10.157.18.252:5300 (eeufugia)", + "fileset.name": "log", + "host.name": "its7829.localhost", + "input.type": "log", + "log.level": "oremeu", + "log.offset": 1748, + "network.protocol": "ipv6", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.4418", + "related.ip": [ + "10.110.31.190", + "10.157.18.252" + ], + "rsa.crypto.sig_type": "rQu", + "rsa.internal.messageid": "5979", + "rsa.misc.context": "usmodte", + "rsa.misc.event_log": "datatno", + "rsa.misc.group_object": "esciuntN", + "rsa.misc.policy_name": "usmodte", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "idunt", + "rsa.misc.severity": "oremeu", + "rsa.misc.sig_id": 5979, + "rsa.misc.version": "1.4418", + "rsa.network.alias_host": [ + "its7829.localhost" + ], + "rsa.threat.threat_desc": "oremeu", + "rsa.time.day": "22", + "rsa.time.event_time_str": "May 22 14:30:33 2016 UTC", + "rsa.time.month": "May", + "service.type": "snort", + "source.ip": [ + "10.110.31.190" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "niamq", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 5 21:33:08 aec3673.internal.host ccaeca: HMNOTIFY: niamq (Sensor lapariat): Severity:medium: failure", + "fileset.name": "log", + "host.name": "aec3673.internal.host", + "input.type": "log", + "log.level": "medium", + "log.offset": 1996, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "niamq", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "lapariat", + "rsa.misc.severity": "medium", + "rsa.time.day": "5", + "rsa.time.month": "Jun", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 20 04:35:42 admin: stenatu inibu2292.www.invalid: isetquas@ute, Login, Login Success", + "event.outcome": "success", + "file.name": "admin", + "fileset.name": "log", + "host.name": "inibu2292.www.invalid", + "input.type": "log", + "log.offset": 2101, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "isetquas" + ], + "rsa.internal.messageid": "SystemSettings", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.network.alias_host": [ + "inibu2292.www.invalid" + ], + "rsa.time.day": "20", + "rsa.time.month": "Jun", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "isetquas" + }, + { + "event.action": "ercit", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 4 11:38:16 ori1241.www.corp : HMNOTIFY: ercit (Sensor eporroq): Severity:very-high: failure", + "fileset.name": "log", + "host.name": "ori1241.www.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 2190, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "ercit", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "eporroq", + "rsa.misc.severity": "very-high", + "rsa.time.day": "4", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 18 18:40:50 atuse: ueipsa748.localdomain: aparia@tatnon, Heartbeat, leumiur", + "file.name": "atuse", + "fileset.name": "log", + "host.name": "ueipsa748.localdomain", + "input.type": "log", + "log.offset": 2286, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "aparia" + ], + "rsa.db.index": "leumiur", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Heartbeat", + "rsa.network.alias_host": [ + "ueipsa748.localdomain" + ], + "rsa.time.day": "18", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "aparia" + }, + { + "event.action": "dolorem", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 2 01:43:25 oluptat548.www5.invalid edolorin: HMNOTIFY: dolorem (Sensor tem): Severity:very-high: failure", + "fileset.name": "log", + "host.name": "oluptat548.www5.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 2366, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "dolorem", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "tem", + "rsa.misc.severity": "very-high", + "rsa.time.day": "2", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 16 08:45:59 imadmi: isnis loremag6816.www5.lan: inrepreh@quovo, System > urExcep", + "file.name": "imadmi", + "fileset.name": "log", + "host.name": "loremag6816.www5.lan", + "input.type": "log", + "log.offset": 2475, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "inrepreh" + ], + "rsa.db.index": "urExcep", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "System", + "rsa.network.alias_host": [ + "loremag6816.www5.lan" + ], + "rsa.time.day": "16", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "inrepreh" + }, + { + "event.action": "occaec", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 30 15:48:33 tionemu5269.internal.localhost : HMNOTIFY: occaec (Sensor acommodi): Severity:medium: failure", + "fileset.name": "log", + "host.name": "tionemu5269.internal.localhost", + "input.type": "log", + "log.level": "medium", + "log.offset": 2560, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "occaec", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "acommodi", + "rsa.misc.severity": "medium", + "rsa.time.day": "30", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 13 22:51:07 isiutali: lumqu onulamco7734.www.local: uptat@unt, Analysis & Reporting , tass", + "file.name": "isiutali", + "fileset.name": "log", + "host.name": "onulamco7734.www.local", + "input.type": "log", + "log.offset": 2670, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "uptat" + ], + "rsa.db.index": "tass", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Analysis & Reporting", + "rsa.network.alias_host": [ + "onulamco7734.www.local" + ], + "rsa.time.day": "13", + "rsa.time.month": "Sep", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "uptat" + }, + { + "event.action": "block,AccessControlRuleName:tnul,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:ess,ConnectType:quiad,DE:ihilmole,DNSResponseType:saquaea,DstIP:10.80.151.37,DstPort:535,ICMPCode:modico,ICMPType:metco,InitiatorBytes:410,InitiatorPackets:porinc,NAPPolicy:riame,Policy:riat,ResponderBytes:181,ResponderPackets:rumSec,Sinkhole:orp,SrcIP:10.213.109.180,SrcPort:6536,TCPFlags:essequam,URLCategory:ueporro,URLReputation:84.488000,UserName:etcon,ClientVersion:1.4438,WebApplication:orum,OriginalClientIP: Bonoru,IngressInterface: lo5284,EgressInterface: enp0s73,IngressZone: emacc,EgressZone: emp,Prefilter Policy: lamcola,UserAgent: Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2016-9-28T05:53:42Z luptatem3834.lan edq %NGIPS-medium-tise:AccessControlRuleAction:block,AccessControlRuleName:tnul,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:ess,ConnectType:quiad,DE:ihilmole,DNSResponseType:saquaea,DstIP:10.80.151.37,DstPort:535,ICMPCode:modico,ICMPType:metco,InitiatorBytes:410,InitiatorPackets:porinc,NAPPolicy:riame,Policy:riat,ResponderBytes:181,ResponderPackets:rumSec,Sinkhole:orp,SrcIP:10.213.109.180,SrcPort:6536,TCPFlags:essequam,URLCategory:ueporro,URLReputation:84.488000,UserName:etcon,ClientVersion:1.4438,WebApplication:orum,OriginalClientIP: Bonoru,IngressInterface: lo5284,EgressInterface: enp0s73,IngressZone: emacc,EgressZone: emp,Prefilter Policy: lamcola,UserAgent: Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: ipiscive,URL: https://www.example.org/etdolor/uat.gif?mmod=iti#nimadm,HTTPResponse: nculp,HTTPReferer: asp,IPReputationSICategory: eacom,DNS_TTL: mag,DNSRecordType: gelitse,DNSQuery: oremqu,GID: idex,SID: radip,Revision: upta,Message: tetura,Classification: rumet,User: uptasnul,Priority: antiumdo, ACPolicy: ecill, ConnectionDuration: 56.481000,Protocol: ipv6,VLAN_ID: 3302,IPSCount: 6436,InlineResult: allow, DNSSICategory: nostrud, URLSICategory: cteturad", + "fileset.name": "log", + "host.name": "luptatem3834.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 2765, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "tise", + "rsa.misc.action": [ + "block,AccessControlRuleName:tnul,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:ess,ConnectType:quiad,DE:ihilmole,DNSResponseType:saquaea,DstIP:10.80.151.37,DstPort:535,ICMPCode:modico,ICMPType:metco,InitiatorBytes:410,InitiatorPackets:porinc,NAPPolicy:riame,Policy:riat,ResponderBytes:181,ResponderPackets:rumSec,Sinkhole:orp,SrcIP:10.213.109.180,SrcPort:6536,TCPFlags:essequam,URLCategory:ueporro,URLReputation:84.488000,UserName:etcon,ClientVersion:1.4438,WebApplication:orum,OriginalClientIP: Bonoru,IngressInterface: lo5284,EgressInterface: enp0s73,IngressZone: emacc,EgressZone: emp,Prefilter Policy: lamcola,UserAgent: Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML" + ], + "rsa.misc.category": "cteturad", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "luptatem3834.lan" + ], + "rsa.time.day": "28", + "rsa.time.duration_time": 56.481, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 12 2016 12:56:16 exercita2068.api.invalid %FTD-veleumi-nsequatu:CLOCK: System clock set, source: nula, IP: 10.169.84.140, before: santi, after: ritati", + "fileset.name": "log", + "host.ip": "10.169.84.140", + "host.name": "exercita2068.api.invalid", + "input.type": "log", + "log.offset": 4085, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.169.84.140" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "nsequatu", + "rsa.misc.change_attrib": "Time", + "rsa.misc.change_new": "ritati", + "rsa.misc.change_old": "santi", + "rsa.misc.event_source": "nula", + "rsa.network.alias_host": [ + "exercita2068.api.invalid" + ], + "rsa.time.day": "12", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 26 2016 19:58:50 orumS757.www5.corp: %FTD-eursint-orio:CLOCK: System clock set, source: gna, IP: 10.130.231.129, before: olu, after: iameaque", + "fileset.name": "log", + "host.ip": "10.130.231.129", + "host.name": "orumS757.www5.corp", + "input.type": "log", + "log.offset": 4240, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.130.231.129" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "orio", + "rsa.misc.change_attrib": "Time", + "rsa.misc.change_new": "iameaque", + "rsa.misc.change_old": "olu", + "rsa.misc.event_source": "gna", + "rsa.network.alias_host": [ + "orumS757.www5.corp" + ], + "rsa.time.day": "26", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "allow,AccessControlRuleName:tes,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:isi,ConnectType:iaecon,DE:aevitaed,DNSResponseType:byCic,DstIP:10.62.8.123,DstPort:5725,ICMPCode:siarc,ICMPType:fdeFin,InitiatorBytes:4053,InitiatorPackets:tobeata,NAPPolicy:nesciun,Policy:amcolab,ResponderBytes:4306,ResponderPackets:isnisiut,Sinkhole:atatnon,SrcIP:10.143.37.32,SrcPort:209,TCPFlags:uisnos,URLCategory:olores,URLReputation:174.651000,UserName:epo,ClientVersion:1.745,WebApplication:borisnis,OriginalClientIP: onorumet,IngressInterface: enp0s6017,EgressInterface: enp0s2440,IngressZone: ipsumq,EgressZone: evit,Prefilter Policy: tno,UserAgent: Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10,ReferencedHost: psumq,URL: https://internal.example.com/atu/teturad.htm?msequ=nvol#enimadmi,HTTPResponse: tateveli,HTTPReferer: osa,IPReputationSICategory: mini,DNS_TTL: rors,DNSRecordType: ssusci,DNSQuery: ames,GID: inimve,SID: uio,Revision: mexercit,Message: byC,Classification: uae,User: oremip,Priority: its", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2016-11-10T03:01:24Z sedquian4212.www5.domain magnaa %NGIPS-medium-eca:AccessControlRuleAction:allow,AccessControlRuleName:tes,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:isi,ConnectType:iaecon,DE:aevitaed,DNSResponseType:byCic,DstIP:10.62.8.123,DstPort:5725,ICMPCode:siarc,ICMPType:fdeFin,InitiatorBytes:4053,InitiatorPackets:tobeata,NAPPolicy:nesciun,Policy:amcolab,ResponderBytes:4306,ResponderPackets:isnisiut,Sinkhole:atatnon,SrcIP:10.143.37.32,SrcPort:209,TCPFlags:uisnos,URLCategory:olores,URLReputation:174.651000,UserName:epo,ClientVersion:1.745,WebApplication:borisnis,OriginalClientIP: onorumet,IngressInterface: enp0s6017,EgressInterface: enp0s2440,IngressZone: ipsumq,EgressZone: evit,Prefilter Policy: tno,UserAgent: Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10,ReferencedHost: psumq,URL: https://internal.example.com/atu/teturad.htm?msequ=nvol#enimadmi,HTTPResponse: tateveli,HTTPReferer: osa,IPReputationSICategory: mini,DNS_TTL: rors,DNSRecordType: ssusci,DNSQuery: ames,GID: inimve,SID: uio,Revision: mexercit,Message: byC,Classification: uae,User: oremip,Priority: its, ACPolicy: uptasnul, ConnectionDuration: 115.011000,Protocol: rdp,VLAN_ID: 7541,IPSCount: 239,InlineResult: deny, DNSSICategory: nse, URLSICategory: miurere", + "fileset.name": "log", + "host.name": "sedquian4212.www5.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 4386, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "eca", + "rsa.misc.action": [ + "allow,AccessControlRuleName:tes,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:isi,ConnectType:iaecon,DE:aevitaed,DNSResponseType:byCic,DstIP:10.62.8.123,DstPort:5725,ICMPCode:siarc,ICMPType:fdeFin,InitiatorBytes:4053,InitiatorPackets:tobeata,NAPPolicy:nesciun,Policy:amcolab,ResponderBytes:4306,ResponderPackets:isnisiut,Sinkhole:atatnon,SrcIP:10.143.37.32,SrcPort:209,TCPFlags:uisnos,URLCategory:olores,URLReputation:174.651000,UserName:epo,ClientVersion:1.745,WebApplication:borisnis,OriginalClientIP: onorumet,IngressInterface: enp0s6017,EgressInterface: enp0s2440,IngressZone: ipsumq,EgressZone: evit,Prefilter Policy: tno,UserAgent: Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10,ReferencedHost: psumq,URL: https://internal.example.com/atu/teturad.htm?msequ=nvol#enimadmi,HTTPResponse: tateveli,HTTPReferer: osa,IPReputationSICategory: mini,DNS_TTL: rors,DNSRecordType: ssusci,DNSQuery: ames,GID: inimve,SID: uio,Revision: mexercit,Message: byC,Classification: uae,User: oremip,Priority: its" + ], + "rsa.misc.category": "miurere", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "sedquian4212.www5.domain" + ], + "rsa.time.day": "10", + "rsa.time.duration_time": 115.011, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 24 10:03:59 ntor: oinBCSed3444.api.local: smodtem@roquisqu, Logout, Logout Success", + "event.outcome": "success", + "file.name": "ntor", + "fileset.name": "log", + "host.name": "oinBCSed3444.api.local", + "input.type": "log", + "log.offset": 5754, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "smodtem" + ], + "rsa.internal.messageid": "SystemSettings", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.network.alias_host": [ + "oinBCSed3444.api.local" + ], + "rsa.time.day": "24", + "rsa.time.month": "Nov", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "smodtem" + }, + { + "destination.ip": [ + "10.9.200.197" + ], + "event.code": "27813", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Dec 8 17:06:33 apari5002.api.test orum: [nsequat:27813:1.6724] auto [Impact: failure] From sci at periam Dec 8 17:06:33 2016 UTC [Classification: fugiatnu] [Priority: dolor ]: {icmp} 10.182.213.195:7119 (tur) -> 10.9.200.197", + "fileset.name": "log", + "host.name": "apari5002.api.test", + "input.type": "log", + "log.level": "dolor", + "log.offset": 5841, + "network.protocol": "icmp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.6724", + "related.ip": [ + "10.9.200.197", + "10.182.213.195" + ], + "rsa.crypto.sig_type": "fugiatnu", + "rsa.internal.messageid": "27813", + "rsa.misc.context": "auto", + "rsa.misc.event_log": "orum", + "rsa.misc.policy_name": "auto", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "sci", + "rsa.misc.severity": "dolor", + "rsa.misc.sig_id": 27813, + "rsa.misc.version": "1.6724", + "rsa.network.alias_host": [ + "apari5002.api.test" + ], + "rsa.threat.threat_desc": "dolor", + "rsa.time.day": "8", + "rsa.time.event_time_str": "Dec 8 17:06:33 2016 UTC", + "rsa.time.month": "Dec", + "service.type": "snort", + "source.geo.country_name": "tur", + "source.ip": [ + "10.182.213.195" + ], + "source.port": 7119, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 3813, + "destination.ip": [ + "10.111.33.70" + ], + "destination.port": 3758, + "event.action": "allow", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2016-12-23T00:09:07Z audant3412.www.local remeum %NGIPS-medium-animi:AccessControlRuleAction:allow, AccessControlRuleReason:failure, SrcIP:10.210.180.142, DstIP:10.111.33.70, SrcPort:3015, DstPort:3758, Protocol: ggp, IngressInterface: enp0s6049, IngressZone:amcolabo, ACPolicy:orsitvol, AccessControlRuleName:eriam, Prefilter Policy:anonn, User:utpers, Client:num, ApplicationProtocol:tcp, InitiatorPackets:iaturE, ResponderPackets:epor, InitiatorBytes:3465, ResponderBytes:3813, NAPPolicy:amnih, DNSQuery:tper4341.lan, DNSRecordType: a host address, DNSSICategory:nulamc", + "fileset.name": "log", + "host.name": "tper4341.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 6066, + "network.application": "num", + "network.protocol": "tcp", + "observer.egress.interface.name": "enp0s6049", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.210.180.142", + "10.111.33.70" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "animi", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "nulamc", + "rsa.misc.policy_name": "amnih", + "rsa.misc.result": "failure", + "rsa.misc.rule_name": "eriam", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "tper4341.lan" + ], + "rsa.network.dinterface": "enp0s6049", + "rsa.network.zone_dst": "amcolabo", + "rsa.time.day": "23", + "rule.name": "eriam", + "service.type": "snort", + "source.bytes": 3465, + "source.ip": [ + "10.210.180.142" + ], + "source.port": 3015, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "lapari", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 6 07:11:41 antiu3533.internal.domain iatquovo: HMNOTIFY: lapari (Sensor Mal): Severity:medium: success", + "fileset.name": "log", + "host.name": "antiu3533.internal.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 6639, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "lapari", + "rsa.misc.result": "success", + "rsa.misc.sensor": "Mal", + "rsa.misc.severity": "medium", + "rsa.time.day": "6", + "rsa.time.month": "Jan", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.222.183.123" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 20 14:14:16 cidu921.internal.lan quamq: Sha256:usan Disposition: Malware Threat name: tdolo IP Addresses: 10.222.183.123<<-10.165.33.19", + "fileset.name": "log", + "host.name": "cidu921.internal.lan", + "input.type": "log", + "log.offset": 6746, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.222.183.123", + "10.165.33.19" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "usan", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "cidu921.internal.lan" + ], + "rsa.threat.threat_category": "tdolo", + "rsa.time.day": "20", + "rsa.time.month": "Jan", + "service.type": "snort", + "source.ip": [ + "10.165.33.19" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.238.223.171" + ], + "event.code": "16539", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 3 21:16:50 unturmag6190.api.lan remeum: [etur:16539:1.890] \"Quisa\" [Impact: unknown] From dolo at modoco Feb 3 21:16:50 2017 UTC [Classification: Finibus] [Priority: uisautei]: {rdp} 10.52.190.18:4411 -> 10.238.223.171", + "fileset.name": "log", + "host.name": "unturmag6190.api.lan", + "input.type": "log", + "log.level": "uisautei", + "log.offset": 6886, + "network.protocol": "rdp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.890", + "related.ip": [ + "10.238.223.171", + "10.52.190.18" + ], + "rsa.crypto.sig_type": "Finibus", + "rsa.internal.messageid": "16539", + "rsa.misc.context": "Quisa", + "rsa.misc.event_log": "remeum", + "rsa.misc.policy_name": "Quisa", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "dolo", + "rsa.misc.severity": "uisautei", + "rsa.misc.sig_id": 16539, + "rsa.misc.version": "1.890", + "rsa.network.alias_host": [ + "unturmag6190.api.lan" + ], + "rsa.threat.threat_desc": "uisautei", + "rsa.time.day": "3", + "rsa.time.event_time_str": "Feb 3 21:16:50 2017 UTC", + "rsa.time.month": "Feb", + "service.type": "snort", + "source.ip": [ + "10.52.190.18" + ], + "source.port": 4411, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.160.178.109" + ], + "destination.port": 1934, + "event.code": "26992", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 18 04:19:24 conseq6079.www.corp tiu: [wri:26992:1.3902] asper [Impact: unknown] From orem/inibus at secte Feb 18 04:19:24 2017 UTC [Classification: ctobeat] [Priority: onsec ]: {udp} 10.68.233.163 -> 10.160.178.109:1934", + "fileset.name": "log", + "host.name": "conseq6079.www.corp", + "input.type": "log", + "log.level": "onsec", + "log.offset": 7109, + "network.protocol": "udp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.3902", + "related.ip": [ + "10.68.233.163", + "10.160.178.109" + ], + "rsa.crypto.sig_type": "ctobeat", + "rsa.internal.messageid": "26992", + "rsa.misc.context": "asper", + "rsa.misc.event_log": "tiu", + "rsa.misc.group_object": "orem", + "rsa.misc.policy_name": "asper", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "inibus", + "rsa.misc.severity": "onsec", + "rsa.misc.sig_id": 26992, + "rsa.misc.version": "1.3902", + "rsa.network.alias_host": [ + "conseq6079.www.corp" + ], + "rsa.threat.threat_desc": "onsec", + "rsa.time.day": "18", + "rsa.time.event_time_str": "Feb 18 04:19:24 2017 UTC", + "rsa.time.month": "Feb", + "service.type": "snort", + "source.ip": [ + "10.68.233.163" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 4 2017 11:21:59 tvol3402.www.local %FTD-ollita-qua:CLOCK: System clock set, source: ionula, IP: 10.162.109.83, before: nderi, after: tem", + "fileset.name": "log", + "host.ip": "10.162.109.83", + "host.name": "tvol3402.www.local", + "input.type": "log", + "log.offset": 7333, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.162.109.83" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "qua", + "rsa.misc.change_attrib": "Time", + "rsa.misc.change_new": "tem", + "rsa.misc.change_old": "nderi", + "rsa.misc.event_source": "ionula", + "rsa.network.alias_host": [ + "tvol3402.www.local" + ], + "rsa.time.day": "4", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 18 2017 18:24:33 xcep3783.internal.localhost %FTD-ercitati-atem:User 'serro' executed the 'lumquid' command.", + "fileset.name": "log", + "host.name": "xcep3783.internal.localhost", + "input.type": "log", + "log.offset": 7474, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "serro" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "atem", + "rsa.network.alias_host": [ + "xcep3783.internal.localhost" + ], + "rsa.time.day": "18", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "serro" + }, + { + "event.action": "riaturEx", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 2 01:27:07 ciatisun7378.www5.invalid didun: HMNOTIFY: riaturEx (Sensor nde): Severity:low: unknown", + "fileset.name": "log", + "host.name": "ciatisun7378.www5.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 7587, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "riaturEx", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "nde", + "rsa.misc.severity": "low", + "rsa.time.day": "2", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.213.100.153" + ], + "event.code": "11634", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 16 08:29:41 iqu4858.mail.invalid audant: [obeata:11634:1.6627] \"minimve\" [Impact: unknown] From \"toditau/uiad\" at nvolupta Apr 16 08:29:41 2017 UTC [Classification: exercit] [Priority: dexer ]:alert {igmp} 10.116.175.84 -> 10.213.100.153", + "fileset.name": "log", + "host.name": "iqu4858.mail.invalid", + "input.type": "log", + "log.level": "dexer", + "log.offset": 7690, + "network.protocol": "igmp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.6627", + "related.ip": [ + "10.116.175.84", + "10.213.100.153" + ], + "rsa.crypto.sig_type": "exercit", + "rsa.internal.messageid": "11634", + "rsa.misc.context": "minimve", + "rsa.misc.event_log": "audant", + "rsa.misc.group_object": "toditau", + "rsa.misc.policy_name": "minimve", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "uiad", + "rsa.misc.severity": "dexer", + "rsa.misc.sig_id": 11634, + "rsa.misc.version": "1.6627", + "rsa.network.alias_host": [ + "iqu4858.mail.invalid" + ], + "rsa.threat.threat_desc": "dexer", + "rsa.time.day": "16", + "rsa.time.event_time_str": "Apr 16 08:29:41 2017 UTC", + "rsa.time.month": "Apr", + "service.type": "snort", + "source.ip": [ + "10.116.175.84" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 30 15:32:16 lumqui: ectet ionu3320.api.localhost: estq@quasiarc, Command Line,aliquaU", + "file.name": "lumqui", + "fileset.name": "log", + "host.name": "ionu3320.api.localhost", + "input.type": "log", + "log.offset": 7932, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "estq" + ], + "rsa.db.index": "aliquaU", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "ionu3320.api.localhost" + ], + "rsa.time.day": "30", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "estq" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 14 22:34:50 tvolu: imve ollitan5079.www.lan: deriti@edictasu, Health > eturadi", + "file.name": "tvolu", + "fileset.name": "log", + "host.name": "ollitan5079.www.lan", + "input.type": "log", + "log.offset": 8022, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "deriti" + ], + "rsa.db.index": "eturadi", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Health", + "rsa.network.alias_host": [ + "ollitan5079.www.lan" + ], + "rsa.time.day": "14", + "rsa.time.month": "May", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "deriti" + }, + { + "event.action": "block,AccessControlRuleName:iatn,AccessControlRuleReason:unknown,ApplicationProtocol:igmp,Client:eli,ConnectType:rissusci,DE:ectetur,DNSResponseType:dictasun,DstIP:10.26.95.225,DstPort:4196,FileCount:3674,ICMPCode:oluptate,ICMPType:ntut,InitiatorBytes:5153,InitiatorPackets:scipit,NAPPolicy:litess,Policy:tore,ResponderBytes:5269,ResponderPackets:quunturm,Sinkhole:quovo,SrcIP:10.143.219.250,SrcPort:1444,TCPFlags:conse,URLCategory:aturve,URLReputation:8.942000,UserName:fdeFin,ClientVersion:1.2871,WebApplication:psu,OriginalClientIP: strud,IngressInterface: eth6386,EgressInterface: lo7421,IngressZone: ratv,EgressZone: veni,Prefilter Policy: metM,UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML", + "event.code": "connection_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 29 05:37:24 nihilmol1849.api.local eporroq: Protocol: tcp, AccessControlRuleAction:block,AccessControlRuleName:iatn,AccessControlRuleReason:unknown,ApplicationProtocol:igmp,Client:eli,ConnectType:rissusci,DE:ectetur,DNSResponseType:dictasun,DstIP:10.26.95.225,DstPort:4196,FileCount:3674,ICMPCode:oluptate,ICMPType:ntut,InitiatorBytes:5153,InitiatorPackets:scipit,NAPPolicy:litess,Policy:tore,ResponderBytes:5269,ResponderPackets:quunturm,Sinkhole:quovo,SrcIP:10.143.219.250,SrcPort:1444,TCPFlags:conse,URLCategory:aturve,URLReputation:8.942000,UserName:fdeFin,ClientVersion:1.2871,WebApplication:psu,OriginalClientIP: strud,IngressInterface: eth6386,EgressInterface: lo7421,IngressZone: ratv,EgressZone: veni,Prefilter Policy: metM,UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0],ReferencedHost: tate,URL: https://internal.example.com/uun/amrem.gif?umq=ita#ipsaquae,HTTPResponse: olu,HTTPReferer: exerci,IPReputationSICategory: isnostru,DNS_TTL: iad,DNSRecordType: ngelits,DNSQuery: volupt,GID: billoi,SID: 38352,Revision: utaliqui,Message: uov,Classification: pariat,User: icaboNe,Priority: boreetd, ACPolicy: uir", + "fileset.name": "log", + "host.name": "nihilmol1849.api.local", + "input.type": "log", + "log.offset": 8105, + "network.protocol": "tcp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": "Number of Files", + "rsa.internal.messageid": "connection_events", + "rsa.misc.action": [ + "block,AccessControlRuleName:iatn,AccessControlRuleReason:unknown,ApplicationProtocol:igmp,Client:eli,ConnectType:rissusci,DE:ectetur,DNSResponseType:dictasun,DstIP:10.26.95.225,DstPort:4196,FileCount:3674,ICMPCode:oluptate,ICMPType:ntut,InitiatorBytes:5153,InitiatorPackets:scipit,NAPPolicy:litess,Policy:tore,ResponderBytes:5269,ResponderPackets:quunturm,Sinkhole:quovo,SrcIP:10.143.219.250,SrcPort:1444,TCPFlags:conse,URLCategory:aturve,URLReputation:8.942000,UserName:fdeFin,ClientVersion:1.2871,WebApplication:psu,OriginalClientIP: strud,IngressInterface: eth6386,EgressInterface: lo7421,IngressZone: ratv,EgressZone: veni,Prefilter Policy: metM,UserAgent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML" + ], + "rsa.network.alias_host": [ + "nihilmol1849.api.local" + ], + "rsa.time.day": "29", + "rsa.time.month": "May", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 12 12:39:58 ipsu: [oremip] ota4562.local: epteurs@itse, Task Queue, rever", + "file.name": "ipsu", + "fileset.name": "log", + "host.name": "ota4562.local", + "input.type": "log", + "log.offset": 9464, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "epteurs" + ], + "rsa.db.index": "rever", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Task Queue", + "rsa.network.alias_host": [ + "ota4562.local" + ], + "rsa.time.day": "12", + "rsa.time.month": "Jun", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "epteurs" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 26 19:42:33 eiu: [maliquam] gnama5033.www5.home: ction@emveleum, Object > siuta", + "file.name": "eiu", + "fileset.name": "log", + "host.name": "gnama5033.www5.home", + "input.type": "log", + "log.offset": 9542, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "ction" + ], + "rsa.db.index": "siuta", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "gnama5033.www5.home" + ], + "rsa.time.day": "26", + "rsa.time.month": "Jun", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "ction" + }, + { + "event.action": "doe", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 11 02:45:07 sum6106.www.home ulamc: HMNOTIFY: doe (Sensor eiusm): Severity:very-high: failure", + "fileset.name": "log", + "host.name": "sum6106.www.home", + "input.type": "log", + "log.level": "very-high", + "log.offset": 9626, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "doe", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "eiusm", + "rsa.misc.severity": "very-high", + "rsa.time.day": "11", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 25 09:47:41 ugiatn: squa2763.www.lan: trude@snulap, Task Queue, onsequat", + "file.name": "ugiatn", + "fileset.name": "log", + "host.name": "squa2763.www.lan", + "input.type": "log", + "log.offset": 9724, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "trude" + ], + "rsa.db.index": "onsequat", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Task Queue", + "rsa.network.alias_host": [ + "squa2763.www.lan" + ], + "rsa.time.day": "25", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "trude" + }, + { + "destination.bytes": 4902, + "destination.ip": [ + "10.251.159.118" + ], + "destination.port": 2795, + "event.action": "cancel", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2017-8-8T16:50:15Z aturvel1847.mail.localdomain sedquia %NGIPS-high-ostrudex:AccessControlRuleAction:cancel, AccessControlRuleReason:unknown, SrcIP:10.240.144.78, DstIP:10.251.159.118, SrcPort:2998, DstPort:2795, Protocol: ipv6, IngressInterface: lo6367, IngressZone:ptatems, ACPolicy:tenima, AccessControlRuleName:emagnam, Prefilter Policy:iaco, User:urQuisa, Client:ipi, ApplicationProtocol:ipv6-icmp, InitiatorPackets:amali, ResponderPackets:onula, InitiatorBytes:1580, ResponderBytes:4902, NAPPolicy:por, DNSQuery:stiae3403.internal.localhost, DNSRecordType: a host address, DNSSICategory:Ute", + "fileset.name": "log", + "host.name": "stiae3403.internal.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 9801, + "network.application": "ipi", + "network.protocol": "ipv6-icmp", + "observer.egress.interface.name": "lo6367", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.240.144.78", + "10.251.159.118" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "ostrudex", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "Ute", + "rsa.misc.policy_name": "por", + "rsa.misc.result": "unknown", + "rsa.misc.rule_name": "emagnam", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "stiae3403.internal.localhost" + ], + "rsa.network.dinterface": "lo6367", + "rsa.network.zone_dst": "ptatems", + "rsa.time.day": "8", + "rule.name": "emagnam", + "service.type": "snort", + "source.bytes": 1580, + "source.ip": [ + "10.240.144.78" + ], + "source.port": 2998, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "odi", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 22 23:52:50 setq5996.corp : HMNOTIFY: odi (Sensor tper): Severity:medium: success", + "fileset.name": "log", + "host.name": "setq5996.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 10398, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "odi", + "rsa.misc.result": "success", + "rsa.misc.sensor": "tper", + "rsa.misc.severity": "medium", + "rsa.time.day": "22", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "sequatD", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 6 06:55:24 quiano3025.api.localhost oluptat: HMNOTIFY: sequatD (Sensor emap): Severity:very-high: unknown", + "fileset.name": "log", + "host.name": "quiano3025.api.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 10484, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "sequatD", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "emap", + "rsa.misc.severity": "very-high", + "rsa.time.day": "6", + "rsa.time.month": "Sep", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "umet", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 20 13:57:58 qui7797.www.host : HMNOTIFY: umet (Sensor psaquaea): Severity:low: failure", + "fileset.name": "log", + "host.name": "qui7797.www.host", + "input.type": "log", + "log.level": "low", + "log.offset": 10594, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "umet", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "psaquaea", + "rsa.misc.severity": "low", + "rsa.time.day": "20", + "rsa.time.month": "Sep", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 5413, + "destination.ip": [ + "10.201.132.114" + ], + "destination.port": 639, + "event.action": "cancel", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2017-10-4T21:00:32Z Utenim3707.www5.host iamquisn %NGIPS-low-lor:AccessControlRuleAction:cancel, AccessControlRuleReason:success, SrcIP:10.140.209.249, DstIP:10.201.132.114, SrcPort:1801, DstPort:639, Protocol: ggp, IngressInterface: lo3580, IngressZone:eacommo, ACPolicy:litani, AccessControlRuleName:temse, Prefilter Policy:samvo, User:itsedd, Client:icta, ApplicationProtocol:igmp, InitiatorPackets:labori, ResponderPackets:ditau, InitiatorBytes:470, ResponderBytes:5413, NAPPolicy:olest, DNSQuery:urau1660.www.lan, DNSRecordType: a host address, DNSSICategory:Neq", + "fileset.name": "log", + "host.name": "urau1660.www.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 10685, + "network.application": "icta", + "network.protocol": "igmp", + "observer.egress.interface.name": "lo3580", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.201.132.114", + "10.140.209.249" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "lor", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "Neq", + "rsa.misc.policy_name": "olest", + "rsa.misc.result": "success", + "rsa.misc.rule_name": "temse", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "urau1660.www.lan" + ], + "rsa.network.dinterface": "lo3580", + "rsa.network.zone_dst": "eacommo", + "rsa.time.day": "4", + "rule.name": "temse", + "service.type": "snort", + "source.bytes": 470, + "source.ip": [ + "10.140.209.249" + ], + "source.port": 1801, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 19 04:03:07 Nequepor: [aUten] edutpers3482.www5.corp: mnisis@onsequa, Access Control Policy > sunt", + "file.name": "Nequepor", + "fileset.name": "log", + "host.name": "edutpers3482.www5.corp", + "input.type": "log", + "log.offset": 11253, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "mnisis" + ], + "rsa.db.index": "sunt", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "edutpers3482.www5.corp" + ], + "rsa.time.day": "19", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "mnisis" + }, + { + "destination.geo.country_name": "ariatu", + "destination.ip": [ + "10.36.122.169" + ], + "destination.port": 6751, + "event.code": "13228", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 2 11:05:41 nofde7732.internal.test emp: [emoeni:13228:1.2633] taliqui [Impact: failure] From labo at ssecill Nov 2 11:05:41 2017 UTC [Classification: umquam] [Priority: onev ]: atu {ipv6} 10.198.44.231 -> 10.36.122.169:6751 (ariatu)", + "fileset.name": "log", + "host.name": "nofde7732.internal.test", + "input.type": "log", + "log.level": "onev", + "log.offset": 11356, + "network.protocol": "ipv6", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.2633", + "related.ip": [ + "10.198.44.231", + "10.36.122.169" + ], + "rsa.crypto.sig_type": "umquam", + "rsa.internal.messageid": "13228", + "rsa.misc.context": "taliqui", + "rsa.misc.event_log": "emp", + "rsa.misc.policy_name": "taliqui", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "labo", + "rsa.misc.severity": "onev", + "rsa.misc.sig_id": 13228, + "rsa.misc.version": "1.2633", + "rsa.network.alias_host": [ + "nofde7732.internal.test" + ], + "rsa.threat.threat_desc": "onev", + "rsa.time.day": "2", + "rsa.time.event_time_str": "Nov 2 11:05:41 2017 UTC", + "rsa.time.month": "Nov", + "service.type": "snort", + "source.ip": [ + "10.198.44.231" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 6430, + "destination.ip": [ + "10.144.162.122" + ], + "destination.port": 2080, + "event.action": "block", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2017-11-16T18:08:15Z byCicero7475.www.localhost abillo %NGIPS-medium-eav:AccessControlRuleAction:block, AccessControlRuleReason:failure, SrcIP:10.77.86.215, DstIP:10.144.162.122, SrcPort:5913, DstPort:2080, Protocol: udp, IngressInterface: lo5079, IngressZone:sequine, ACPolicy:minimv, AccessControlRuleName:ffici, Prefilter Policy:rsintoc, User:boreetd, Client:rehende, ApplicationProtocol:icmp, InitiatorPackets:erspic, ResponderPackets:orincidi, InitiatorBytes:3273, ResponderBytes:6430, NAPPolicy:quipe, DNSQuery:evita850.localdomain, DNSRecordType: a host address, DNSSICategory:tiu", + "fileset.name": "log", + "host.name": "evita850.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 11593, + "network.application": "rehende", + "network.protocol": "icmp", + "observer.egress.interface.name": "lo5079", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.144.162.122", + "10.77.86.215" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "eav", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "tiu", + "rsa.misc.policy_name": "quipe", + "rsa.misc.result": "failure", + "rsa.misc.rule_name": "ffici", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "evita850.localdomain" + ], + "rsa.network.dinterface": "lo5079", + "rsa.network.zone_dst": "sequine", + "rsa.time.day": "16", + "rule.name": "ffici", + "service.type": "snort", + "source.bytes": 3273, + "source.ip": [ + "10.77.86.215" + ], + "source.port": 5913, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Dec 1 01:10:49 acons: [enbyCic] aturau3002.api.corp: sci@psamvolu, itsedqui", + "file.name": "acons", + "fileset.name": "log", + "host.name": "aturau3002.api.corp", + "input.type": "log", + "log.offset": 12181, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "sci" + ], + "rsa.db.index": "itsedqui", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "aturau3002.api.corp" + ], + "rsa.time.day": "1", + "rsa.time.month": "Dec", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "sci" + }, + { + "event.action": "cancel,AccessControlRuleName:ostr,AccessControlRuleReason:unknown,ApplicationProtocol:tcp,Client:itan,ConnectType:olorin,DE:oluptat,DNSResponseType:olors,DstIP:10.85.61.13,DstPort:6593,ICMPCode:quian,ICMPType:xerci,InitiatorBytes:5178,InitiatorPackets:upt,NAPPolicy:uovolu,Policy:itten,ResponderBytes:4805,ResponderPackets:abo,Sinkhole:orisnis,SrcIP:10.212.37.178,SrcPort:76,TCPFlags:aconseq,URLCategory:isnos,URLReputation:132.397000,UserName:lit,ClientVersion:1.4,WebApplication:odic,OriginalClientIP: ono,IngressInterface: eth1462,EgressInterface: enp0s3976,IngressZone: ine,EgressZone: hend,Prefilter Policy: rcit,UserAgent: Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2017-12-15T08:13:24Z ntiumt238.internal.corp isc %NGIPS-high-odite:AccessControlRuleAction:cancel,AccessControlRuleName:ostr,AccessControlRuleReason:unknown,ApplicationProtocol:tcp,Client:itan,ConnectType:olorin,DE:oluptat,DNSResponseType:olors,DstIP:10.85.61.13,DstPort:6593,ICMPCode:quian,ICMPType:xerci,InitiatorBytes:5178,InitiatorPackets:upt,NAPPolicy:uovolu,Policy:itten,ResponderBytes:4805,ResponderPackets:abo,Sinkhole:orisnis,SrcIP:10.212.37.178,SrcPort:76,TCPFlags:aconseq,URLCategory:isnos,URLReputation:132.397000,UserName:lit,ClientVersion:1.4,WebApplication:odic,OriginalClientIP: ono,IngressInterface: eth1462,EgressInterface: enp0s3976,IngressZone: ine,EgressZone: hend,Prefilter Policy: rcit,UserAgent: Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30,ReferencedHost: nsecte,URL: https://api.example.org/tat/pitlabor.gif?rrorsi=loremqu#busBono,HTTPResponse: mnisiut,HTTPReferer: eabil,IPReputationSICategory: olu,DNS_TTL: uaUte,DNSRecordType: empor,DNSQuery: ate,GID: eca,SID: inre,Revision: aliqu,Message: orem,Classification: dquian,User: isaute,Priority: rumetMa, ACPolicy: utfugit, ConnectionDuration: 95.196000,Protocol: ggp,VLAN_ID: 5189,IPSCount: 1350,InlineResult: allow, DNSSICategory: ntocca, URLSICategory: emquelau", + "fileset.name": "log", + "host.name": "ntiumt238.internal.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 12257, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "odite", + "rsa.misc.action": [ + "cancel,AccessControlRuleName:ostr,AccessControlRuleReason:unknown,ApplicationProtocol:tcp,Client:itan,ConnectType:olorin,DE:oluptat,DNSResponseType:olors,DstIP:10.85.61.13,DstPort:6593,ICMPCode:quian,ICMPType:xerci,InitiatorBytes:5178,InitiatorPackets:upt,NAPPolicy:uovolu,Policy:itten,ResponderBytes:4805,ResponderPackets:abo,Sinkhole:orisnis,SrcIP:10.212.37.178,SrcPort:76,TCPFlags:aconseq,URLCategory:isnos,URLReputation:132.397000,UserName:lit,ClientVersion:1.4,WebApplication:odic,OriginalClientIP: ono,IngressInterface: eth1462,EgressInterface: enp0s3976,IngressZone: ine,EgressZone: hend,Prefilter Policy: rcit,UserAgent: Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML" + ], + "rsa.misc.category": "emquelau", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ntiumt238.internal.corp" + ], + "rsa.time.day": "15", + "rsa.time.duration_time": 95.196, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "pitlab", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Dec 29 15:15:58 atu2951.test : HMNOTIFY: pitlab (Sensor riosamn): Severity:medium: success", + "fileset.name": "log", + "host.name": "atu2951.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 13585, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "pitlab", + "rsa.misc.result": "success", + "rsa.misc.sensor": "riosamn", + "rsa.misc.severity": "medium", + "rsa.time.day": "29", + "rsa.time.month": "Dec", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 12 22:18:32 mini: tutl uipe5295.api.localhost: mwrit@dminimve, Access Control Policy > madminim", + "file.name": "mini", + "fileset.name": "log", + "host.name": "uipe5295.api.localhost", + "input.type": "log", + "log.offset": 13676, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "mwrit" + ], + "rsa.db.index": "madminim", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "uipe5295.api.localhost" + ], + "rsa.time.day": "12", + "rsa.time.month": "Jan", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "mwrit" + }, + { + "event.action": "deny,AccessControlRuleName:uisa,AccessControlRuleReason:unknown,ApplicationProtocol:ggp,Client:siutal,ConnectType:umetMalo,DE:onevolu,DNSResponseType:itautfug,DstIP:10.236.221.212,DstPort:5294,ICMPCode:nsequatD,ICMPType:amcorp,InitiatorBytes:1539,InitiatorPackets:idolor,NAPPolicy:umdo,Policy:sequatu,ResponderBytes:7142,ResponderPackets:ecillu,Sinkhole:ipsaqu,SrcIP:10.31.46.127,SrcPort:7526,TCPFlags:magn,URLCategory:amcola,URLReputation:173.477000,UserName:sno,ClientVersion:1.6406,WebApplication:ntiu,OriginalClientIP: tametco,IngressInterface: lo6910,EgressInterface: eth6946,IngressZone: non,EgressZone: pta,Prefilter Policy: asnul,UserAgent: Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2018-1-27T05:21:06Z tatiset5041.www5.local tevelit %NGIPS-low-Utenim:AccessControlRuleAction:deny,AccessControlRuleName:uisa,AccessControlRuleReason:unknown,ApplicationProtocol:ggp,Client:siutal,ConnectType:umetMalo,DE:onevolu,DNSResponseType:itautfug,DstIP:10.236.221.212,DstPort:5294,ICMPCode:nsequatD,ICMPType:amcorp,InitiatorBytes:1539,InitiatorPackets:idolor,NAPPolicy:umdo,Policy:sequatu,ResponderBytes:7142,ResponderPackets:ecillu,Sinkhole:ipsaqu,SrcIP:10.31.46.127,SrcPort:7526,TCPFlags:magn,URLCategory:amcola,URLReputation:173.477000,UserName:sno,ClientVersion:1.6406,WebApplication:ntiu,OriginalClientIP: tametco,IngressInterface: lo6910,EgressInterface: eth6946,IngressZone: non,EgressZone: pta,Prefilter Policy: asnul,UserAgent: Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91,ReferencedHost: todit,URL: https://www.example.com/fug/ulpaq.gif?piscivel=ueporr#udex,HTTPResponse: ipexeac,HTTPReferer: uin,IPReputationSICategory: isci,DNS_TTL: archi,DNSRecordType: rsitame,DNSQuery: qui,GID: umdolo,SID: tate,Revision: sintocca,Message: ugiat,Classification: asuntex,User: uovolup,Priority: expl, ACPolicy: animi, ConnectionDuration: 63.677000,Protocol: ipv6,VLAN_ID: 3389,IPSCount: 1457,InlineResult: cancel, DNSSICategory: taliqui, URLSICategory: doloremi", + "fileset.name": "log", + "host.name": "tatiset5041.www5.local", + "input.type": "log", + "log.level": "low", + "log.offset": 13776, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "Utenim", + "rsa.misc.action": [ + "deny,AccessControlRuleName:uisa,AccessControlRuleReason:unknown,ApplicationProtocol:ggp,Client:siutal,ConnectType:umetMalo,DE:onevolu,DNSResponseType:itautfug,DstIP:10.236.221.212,DstPort:5294,ICMPCode:nsequatD,ICMPType:amcorp,InitiatorBytes:1539,InitiatorPackets:idolor,NAPPolicy:umdo,Policy:sequatu,ResponderBytes:7142,ResponderPackets:ecillu,Sinkhole:ipsaqu,SrcIP:10.31.46.127,SrcPort:7526,TCPFlags:magn,URLCategory:amcola,URLReputation:173.477000,UserName:sno,ClientVersion:1.6406,WebApplication:ntiu,OriginalClientIP: tametco,IngressInterface: lo6910,EgressInterface: eth6946,IngressZone: non,EgressZone: pta,Prefilter Policy: asnul,UserAgent: Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML" + ], + "rsa.misc.category": "doloremi", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "tatiset5041.www5.local" + ], + "rsa.time.day": "27", + "rsa.time.duration_time": 63.677, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 10 12:23:41 atevel: [oloremeu] esse2198.mail.example: uaturvel@quisqua, System > sedquian", + "file.name": "atevel", + "fileset.name": "log", + "host.name": "esse2198.mail.example", + "input.type": "log", + "log.offset": 15178, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "uaturvel" + ], + "rsa.db.index": "sedquian", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "System", + "rsa.network.alias_host": [ + "esse2198.mail.example" + ], + "rsa.time.day": "10", + "rsa.time.month": "Feb", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "uaturvel" + }, + { + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 24 2018 19:26:15 pitlab5165.localdomain %FTD-uptate-tevelite:CLOCK: System clock set, source: cto, IP: 10.17.172.91, before: agn, after: dip", + "fileset.name": "log", + "host.ip": "10.17.172.91", + "host.name": "pitlab5165.localdomain", + "input.type": "log", + "log.offset": 15272, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.17.172.91" + ], + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "tevelite", + "rsa.misc.change_attrib": "Time", + "rsa.misc.change_new": "dip", + "rsa.misc.change_old": "agn", + "rsa.misc.event_source": "cto", + "rsa.network.alias_host": [ + "pitlab5165.localdomain" + ], + "rsa.time.day": "24", + "rsa.time.month": "Feb", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 11 02:28:49 acomm: [edquia] uinesci6041.api.local: pers@lpaquiof, Analysis isisten", + "file.name": "acomm", + "fileset.name": "log", + "host.name": "uinesci6041.api.local", + "input.type": "log", + "log.offset": 15417, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "pers" + ], + "rsa.db.index": "isisten", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Session Expiration", + "rsa.network.alias_host": [ + "uinesci6041.api.local" + ], + "rsa.time.day": "11", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "pers" + }, + { + "destination.geo.country_name": "icons", + "destination.ip": [ + "10.60.137.215" + ], + "destination.port": 3266, + "event.code": "5155", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 25 09:31:24 uovol2459.www5.invalid volup: [nimi:5155:1.2115] lillum [Impact: success] From suntin at consequa Mar 25 09:31:24 2018 UTC [Classification: tionu] [Priority: umqua ]:alert {tcp} 10.28.105.106 -> 10.60.137.215:3266 (icons)", + "fileset.name": "log", + "host.name": "uovol2459.www5.invalid", + "input.type": "log", + "log.level": "umqua", + "log.offset": 15504, + "network.protocol": "tcp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.2115", + "related.ip": [ + "10.60.137.215", + "10.28.105.106" + ], + "rsa.crypto.sig_type": "tionu", + "rsa.internal.messageid": "5155", + "rsa.misc.context": "lillum", + "rsa.misc.event_log": "volup", + "rsa.misc.policy_name": "lillum", + "rsa.misc.result": "success", + "rsa.misc.sensor": "suntin", + "rsa.misc.severity": "umqua", + "rsa.misc.sig_id": 5155, + "rsa.misc.version": "1.2115", + "rsa.network.alias_host": [ + "uovol2459.www5.invalid" + ], + "rsa.threat.threat_desc": "umqua", + "rsa.time.day": "25", + "rsa.time.event_time_str": "Mar 25 09:31:24 2018 UTC", + "rsa.time.month": "Mar", + "service.type": "snort", + "source.ip": [ + "10.28.105.106" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "ssequa", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 8 16:33:58 ptate7215.www5.home mquiado: HMNOTIFY: ssequa (Sensor nisist): Severity:low: failure", + "fileset.name": "log", + "host.name": "ptate7215.www5.home", + "input.type": "log", + "log.level": "low", + "log.offset": 15742, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "ssequa", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "nisist", + "rsa.misc.severity": "low", + "rsa.time.day": "8", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "deny,AccessControlRuleName:toditaut,AccessControlRuleReason:success,ApplicationProtocol:ipv6-icmp,Client:didu,ConnectType:emporain,DE:ovo,DNSResponseType:aeabillo,DstIP:10.53.0.68,DstPort:7066,FileCount:4405,ICMPCode:rehen,ICMPType:sitasp,InitiatorBytes:933,InitiatorPackets:exeacom,NAPPolicy:teir,Policy:suntin,ResponderBytes:4053,ResponderPackets:upta,Sinkhole:iaeconse,SrcIP:10.235.102.51,SrcPort:1905,TCPFlags:uscip,URLCategory:ptasn,URLReputation:163.091000,UserName:san,ClientVersion:1.1124,WebApplication:amqui,OriginalClientIP: itatise,IngressInterface: lo6252,EgressInterface: enp0s6516,IngressZone: liqu,EgressZone: cons,Prefilter Policy: apar,UserAgent: Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML", + "event.code": "connection_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 22 23:36:32 metc7395.lan ataevit: Protocol: rdp, AccessControlRuleAction:deny,AccessControlRuleName:toditaut,AccessControlRuleReason:success,ApplicationProtocol:ipv6-icmp,Client:didu,ConnectType:emporain,DE:ovo,DNSResponseType:aeabillo,DstIP:10.53.0.68,DstPort:7066,FileCount:4405,ICMPCode:rehen,ICMPType:sitasp,InitiatorBytes:933,InitiatorPackets:exeacom,NAPPolicy:teir,Policy:suntin,ResponderBytes:4053,ResponderPackets:upta,Sinkhole:iaeconse,SrcIP:10.235.102.51,SrcPort:1905,TCPFlags:uscip,URLCategory:ptasn,URLReputation:163.091000,UserName:san,ClientVersion:1.1124,WebApplication:amqui,OriginalClientIP: itatise,IngressInterface: lo6252,EgressInterface: enp0s6516,IngressZone: liqu,EgressZone: cons,Prefilter Policy: apar,UserAgent: Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: umtota,URL: https://internal.example.com/xplic/isn.html?ame=tenat#etur,HTTPResponse: uisnost,HTTPReferer: snul,IPReputationSICategory: quasia,DNS_TTL: ihilmol,DNSRecordType: seosqui,DNSQuery: tiset,GID: ciade,SID: 31978,Revision: equ,Message: rror,Classification: Exce,User: uae,Priority: tut, ACPolicy: umdol", + "fileset.name": "log", + "host.name": "metc7395.lan", + "input.type": "log", + "log.offset": 15842, + "network.protocol": "rdp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": "Number of Files", + "rsa.internal.messageid": "connection_events", + "rsa.misc.action": [ + "deny,AccessControlRuleName:toditaut,AccessControlRuleReason:success,ApplicationProtocol:ipv6-icmp,Client:didu,ConnectType:emporain,DE:ovo,DNSResponseType:aeabillo,DstIP:10.53.0.68,DstPort:7066,FileCount:4405,ICMPCode:rehen,ICMPType:sitasp,InitiatorBytes:933,InitiatorPackets:exeacom,NAPPolicy:teir,Policy:suntin,ResponderBytes:4053,ResponderPackets:upta,Sinkhole:iaeconse,SrcIP:10.235.102.51,SrcPort:1905,TCPFlags:uscip,URLCategory:ptasn,URLReputation:163.091000,UserName:san,ClientVersion:1.1124,WebApplication:amqui,OriginalClientIP: itatise,IngressInterface: lo6252,EgressInterface: enp0s6516,IngressZone: liqu,EgressZone: cons,Prefilter Policy: apar,UserAgent: Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML" + ], + "rsa.network.alias_host": [ + "metc7395.lan" + ], + "rsa.time.day": "22", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.49.190.163" + ], + "destination.nat.ip": "10.20.167.114", + "destination.nat.port": 6975, + "destination.port": 4220, + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 7 2018 06:39:06 Loremips5368.www5.corp: %FTD-ficiade-nemull:Offloaded TCP Flow for connectiontrumexfromenp0s484:10.49.190.163/4220(10.20.167.114/6975) tolo7626:10.166.40.137/5279(10.65.144.119/6233)", + "fileset.name": "log", + "host.name": "Loremips5368.www5.corp", + "input.type": "log", + "log.offset": 17035, + "observer.egress.interface.name": "enp0s484", + "observer.ingress.interface.name": "lo7626", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.20.167.114", + "10.49.190.163", + "10.166.40.137", + "10.65.144.119" + ], + "rsa.internal.event_desc": "Offloaded TCP Flow for connection", + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "nemull", + "rsa.misc.connection_id": "trumex", + "rsa.network.alias_host": [ + "Loremips5368.www5.corp" + ], + "rsa.network.dinterface": "enp0s484", + "rsa.network.sinterface": "lo7626", + "rsa.time.day": "7", + "rsa.time.month": "May", + "service.type": "snort", + "source.ip": [ + "10.166.40.137" + ], + "source.nat.ip": "10.65.144.119", + "source.nat.port": 6233, + "source.port": 5279, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.162.128.87" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 21 13:41:41 mexer1548.www5.example uidexea: Sha256:emu Disposition: Malware Threat name: asia IP Addresses: 10.162.128.87<<-10.104.78.147", + "fileset.name": "log", + "host.name": "mexer1548.www5.example", + "input.type": "log", + "log.offset": 17238, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.162.128.87", + "10.104.78.147" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "emu", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "mexer1548.www5.example" + ], + "rsa.threat.threat_category": "asia", + "rsa.time.day": "21", + "rsa.time.month": "May", + "service.type": "snort", + "source.ip": [ + "10.104.78.147" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.82.180.46" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 4 20:44:15 emulla6625.www5.corp oditaut: Sha256:oloremqu Disposition: Malware Threat name: untNeque IP Addresses: 10.82.180.46<<-10.237.43.87", + "fileset.name": "log", + "host.name": "emulla6625.www5.corp", + "input.type": "log", + "log.offset": 17380, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.237.43.87", + "10.82.180.46" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "oloremqu", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "emulla6625.www5.corp" + ], + "rsa.threat.threat_category": "untNeque", + "rsa.time.day": "4", + "rsa.time.month": "Jun", + "service.type": "snort", + "source.ip": [ + "10.237.43.87" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.geo.country_name": "quovol", + "destination.ip": [ + "10.180.28.156" + ], + "destination.port": 4665, + "event.code": "5315", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jun 19 03:46:49 magn3657.api.invalid tquiine: [ill:5315:1.4189] \"mquisn\" [Impact: success] From nby/uames at dolo Jun 19 03:46:49 2018 UTC [Classification: mnihil] [Priority: aturQui ]: umqua {icmp} 10.234.234.205:5714 (eos) -> 10.180.28.156:4665 (quovol)", + "fileset.name": "log", + "host.name": "magn3657.api.invalid", + "input.type": "log", + "log.level": "aturQui", + "log.offset": 17526, + "network.protocol": "icmp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.4189", + "related.ip": [ + "10.180.28.156", + "10.234.234.205" + ], + "rsa.crypto.sig_type": "mnihil", + "rsa.internal.messageid": "5315", + "rsa.misc.context": "mquisn", + "rsa.misc.event_log": "tquiine", + "rsa.misc.group_object": "nby", + "rsa.misc.policy_name": "mquisn", + "rsa.misc.result": "success", + "rsa.misc.sensor": "uames", + "rsa.misc.severity": "aturQui", + "rsa.misc.sig_id": 5315, + "rsa.misc.version": "1.4189", + "rsa.network.alias_host": [ + "magn3657.api.invalid" + ], + "rsa.threat.threat_desc": "aturQui", + "rsa.time.day": "19", + "rsa.time.event_time_str": "Jun 19 03:46:49 2018 UTC", + "rsa.time.month": "Jun", + "service.type": "snort", + "source.geo.country_name": "eos", + "source.ip": [ + "10.234.234.205" + ], + "source.port": 5714, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "architec", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 3 10:49:23 nis3942.mail.example edutpe: HMNOTIFY: architec (Sensor incul): Severity:high: success", + "fileset.name": "log", + "host.name": "nis3942.mail.example", + "input.type": "log", + "log.level": "high", + "log.offset": 17782, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "architec", + "rsa.misc.result": "success", + "rsa.misc.sensor": "incul", + "rsa.misc.severity": "high", + "rsa.time.day": "3", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 4280, + "destination.ip": [ + "10.166.10.187" + ], + "destination.port": 793, + "event.action": "block", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2018-7-17T17:51:58Z iscing6960.api.invalid emipsu %NGIPS-very-high-temUte:AccessControlRuleAction:block, AccessControlRuleReason:success, SrcIP:10.40.250.209, DstIP:10.166.10.187, SrcPort:3941, DstPort:793, Protocol: udp, IngressInterface: lo2032, IngressZone:nculpaq, ACPolicy:mides, AccessControlRuleName:iconseq, Prefilter Policy:nidolo, User:runtmoll, Client:tuserror, ApplicationProtocol:igmp, InitiatorPackets:adipis, ResponderPackets:tet, InitiatorBytes:1259, ResponderBytes:4280, NAPPolicy:inv, DNSQuery:upta788.invalid, DNSRecordType: a host address, DNS_TTL: olupta, DNSSICategory:raincidu", + "fileset.name": "log", + "host.name": "upta788.invalid", + "input.type": "log", + "log.level": "very", + "log.offset": 17884, + "network.application": "tuserror", + "network.protocol": "igmp", + "observer.egress.interface.name": "lo2032", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.40.250.209", + "10.166.10.187" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "high-temUte", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "raincidu", + "rsa.misc.policy_name": "inv", + "rsa.misc.result": "success", + "rsa.misc.rule_name": "iconseq", + "rsa.misc.severity": "very", + "rsa.network.alias_host": [ + "upta788.invalid" + ], + "rsa.network.dinterface": "lo2032", + "rsa.network.zone_dst": "nculpaq", + "rsa.time.day": "17", + "rule.name": "iconseq", + "service.type": "snort", + "source.bytes": 1259, + "source.ip": [ + "10.40.250.209" + ], + "source.port": 3941, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "cancel,AccessControlRuleName:equat,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:estlab,ConnectType:vol,DE:paqui,DNSResponseType:eiusmo,DstIP:10.33.37.252,DstPort:3192,FileCount:2960,ICMPCode:itseddoe,ICMPType:tnulapa,InitiatorBytes:6405,InitiatorPackets:ngelitse,NAPPolicy:Utenim,Policy:llitan,ResponderBytes:2517,ResponderPackets:urs,Sinkhole:uepor,SrcIP:10.52.109.149,SrcPort:1416,TCPFlags:piciati,URLCategory:mipsum,URLReputation:7.706000,UserName:ditaut,ClientVersion:1.91,WebApplication:niamquis,OriginalClientIP: lapariat,IngressInterface: lo5184,EgressInterface: lo62,IngressZone: mpo,EgressZone: deritinv,Prefilter Policy: ten,UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML", + "event.code": "connection_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 1 00:54:32 consequu3962.api.localdomain Maloru: Protocol: ggp, AccessControlRuleAction:cancel,AccessControlRuleName:equat,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:estlab,ConnectType:vol,DE:paqui,DNSResponseType:eiusmo,DstIP:10.33.37.252,DstPort:3192,FileCount:2960,ICMPCode:itseddoe,ICMPType:tnulapa,InitiatorBytes:6405,InitiatorPackets:ngelitse,NAPPolicy:Utenim,Policy:llitan,ResponderBytes:2517,ResponderPackets:urs,Sinkhole:uepor,SrcIP:10.52.109.149,SrcPort:1416,TCPFlags:piciati,URLCategory:mipsum,URLReputation:7.706000,UserName:ditaut,ClientVersion:1.91,WebApplication:niamquis,OriginalClientIP: lapariat,IngressInterface: lo5184,EgressInterface: lo62,IngressZone: mpo,EgressZone: deritinv,Prefilter Policy: ten,UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36,ReferencedHost: temporai,URL: https://example.com/emeumf/res.txt?ptasn=ima#emUte,HTTPResponse: atnonp,HTTPReferer: imaven,IPReputationSICategory: cia,DNS_TTL: doconseq,DNSRecordType: quia,DNSQuery: veleum,GID: emUten,SID: 31978,Revision: proiden,Message: cita,Classification: iac,User: ntincul,Priority: mnisiste, ACPolicy: uptas", + "fileset.name": "log", + "host.name": "consequu3962.api.localdomain", + "input.type": "log", + "log.offset": 18484, + "network.protocol": "ggp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": "Number of Files", + "rsa.internal.messageid": "connection_events", + "rsa.misc.action": [ + "cancel,AccessControlRuleName:equat,AccessControlRuleReason:unknown,ApplicationProtocol:rdp,Client:estlab,ConnectType:vol,DE:paqui,DNSResponseType:eiusmo,DstIP:10.33.37.252,DstPort:3192,FileCount:2960,ICMPCode:itseddoe,ICMPType:tnulapa,InitiatorBytes:6405,InitiatorPackets:ngelitse,NAPPolicy:Utenim,Policy:llitan,ResponderBytes:2517,ResponderPackets:urs,Sinkhole:uepor,SrcIP:10.52.109.149,SrcPort:1416,TCPFlags:piciati,URLCategory:mipsum,URLReputation:7.706000,UserName:ditaut,ClientVersion:1.91,WebApplication:niamquis,OriginalClientIP: lapariat,IngressInterface: lo5184,EgressInterface: lo62,IngressZone: mpo,EgressZone: deritinv,Prefilter Policy: ten,UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML" + ], + "rsa.network.alias_host": [ + "consequu3962.api.localdomain" + ], + "rsa.time.day": "1", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.78.180.219" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 15 07:57:06 ita7851.localhost dictas: Sha256:equaturv Disposition: Malware Threat name: rsi IP Addresses: 10.78.180.219<<-10.198.202.72", + "fileset.name": "log", + "host.name": "ita7851.localhost", + "input.type": "log", + "log.offset": 19724, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.198.202.72", + "10.78.180.219" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "equaturv", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "ita7851.localhost" + ], + "rsa.threat.threat_category": "rsi", + "rsa.time.day": "15", + "rsa.time.month": "Aug", + "service.type": "snort", + "source.ip": [ + "10.198.202.72" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.geo.country_name": "maccusan", + "destination.ip": [ + "10.232.67.182" + ], + "destination.port": 2086, + "event.code": "26152", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 29 14:59:40 laparia5374.api.domain norumet: [tconse:26152:1.2390] \"tam\" [Impact: success] From \"inc/riaturEx\" at eleumiur Aug 29 14:59:40 2018 UTC [Classification: eufugi] [Priority: ionu ] < {ggp} 10.147.155.100 -> 10.232.67.182:2086 (maccusan)", + "fileset.name": "log", + "host.name": "laparia5374.api.domain", + "input.type": "log", + "log.level": "ionu", + "log.offset": 19864, + "network.interface.name": "enp0s2413", + "network.protocol": "ggp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.2390", + "related.ip": [ + "10.147.155.100", + "10.232.67.182" + ], + "rsa.crypto.sig_type": "eufugi", + "rsa.internal.messageid": "26152", + "rsa.misc.context": "tam", + "rsa.misc.event_log": "norumet", + "rsa.misc.group_object": "inc", + "rsa.misc.policy_name": "tam", + "rsa.misc.result": "success", + "rsa.misc.sensor": "riaturEx", + "rsa.misc.severity": "ionu", + "rsa.misc.sig_id": 26152, + "rsa.misc.version": "1.2390", + "rsa.network.alias_host": [ + "laparia5374.api.domain" + ], + "rsa.network.interface": "enp0s2413", + "rsa.threat.threat_desc": "ionu", + "rsa.time.day": "29", + "rsa.time.event_time_str": "Aug 29 14:59:40 2018 UTC", + "rsa.time.month": "Aug", + "service.type": "snort", + "source.ip": [ + "10.147.155.100" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.95.152.78" + ], + "destination.port": 1267, + "event.code": "9193", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 12 22:02:15 onse3711.api.domain aliquaUt: [boreet:9193:1.1034] vol [Impact: unknown] From \"nof/boNe\" at ovolu Sep 12 22:02:15 2018 UTC [Classification: cid] [Priority: periam ] {ggp} 10.4.147.70:3210 -> 10.95.152.78:1267", + "fileset.name": "log", + "host.name": "onse3711.api.domain", + "input.type": "log", + "log.level": "periam", + "log.offset": 20125, + "network.protocol": "ggp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.1034", + "related.ip": [ + "10.95.152.78", + "10.4.147.70" + ], + "rsa.crypto.sig_type": "cid", + "rsa.internal.messageid": "9193", + "rsa.misc.context": "vol", + "rsa.misc.event_log": "aliquaUt", + "rsa.misc.group_object": "nof", + "rsa.misc.policy_name": "vol", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "boNe", + "rsa.misc.severity": "periam", + "rsa.misc.sig_id": 9193, + "rsa.misc.version": "1.1034", + "rsa.network.alias_host": [ + "onse3711.api.domain" + ], + "rsa.threat.threat_desc": "periam", + "rsa.time.day": "12", + "rsa.time.event_time_str": "Sep 12 22:02:15 2018 UTC", + "rsa.time.month": "Sep", + "service.type": "snort", + "source.ip": [ + "10.4.147.70" + ], + "source.port": 3210, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 27 05:04:49 elite: nde iac7016.api.lan: antiu@llumquid, FailD, paq", + "file.name": "elite", + "fileset.name": "log", + "host.name": "iac7016.api.lan", + "input.type": "log", + "log.offset": 20350, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "antiu" + ], + "rsa.db.index": "paq", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "iac7016.api.lan" + ], + "rsa.time.day": "27", + "rsa.time.month": "Sep", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "antiu" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 11 12:07:23 sit: tte4006.www5.test: lors@isautem, Intrusion Events,metco", + "file.name": "sit", + "fileset.name": "log", + "host.name": "tte4006.www5.test", + "input.type": "log", + "log.offset": 20421, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "lors" + ], + "rsa.db.index": "metco", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Intrusion Events", + "rsa.network.alias_host": [ + "tte4006.www5.test" + ], + "rsa.time.day": "11", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "lors" + }, + { + "event.action": "cancel,AccessControlRuleName:bor,AccessControlRuleReason:success,ApplicationProtocol:udp,Client:ten,ConnectType:ssec,DE:snulapar,DNSResponseType:maccusan,DstIP:10.54.49.229,DstPort:1089,ICMPCode:iset,ICMPType:piciatis,InitiatorBytes:3781,InitiatorPackets:dolor,NAPPolicy:tur,Policy:sBo,ResponderBytes:1426,ResponderPackets:rehende,Sinkhole:iaeco,SrcIP:10.204.18.92,SrcPort:4216,TCPFlags:psamvolu,URLCategory:odte,URLReputation:12.264000,UserName:aparia,ClientVersion:1.2692,WebApplication:reetd,OriginalClientIP: nos,IngressInterface: enp0s6783,EgressInterface: enp0s2434,IngressZone: urveli,EgressZone: agnaa,Prefilter Policy: olu,UserAgent: Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2018-10-25T19:09:57Z equatD1241.www5.host rpo %NGIPS-low-econs:AccessControlRuleAction:cancel,AccessControlRuleName:bor,AccessControlRuleReason:success,ApplicationProtocol:udp,Client:ten,ConnectType:ssec,DE:snulapar,DNSResponseType:maccusan,DstIP:10.54.49.229,DstPort:1089,ICMPCode:iset,ICMPType:piciatis,InitiatorBytes:3781,InitiatorPackets:dolor,NAPPolicy:tur,Policy:sBo,ResponderBytes:1426,ResponderPackets:rehende,Sinkhole:iaeco,SrcIP:10.204.18.92,SrcPort:4216,TCPFlags:psamvolu,URLCategory:odte,URLReputation:12.264000,UserName:aparia,ClientVersion:1.2692,WebApplication:reetd,OriginalClientIP: nos,IngressInterface: enp0s6783,EgressInterface: enp0s2434,IngressZone: urveli,EgressZone: agnaa,Prefilter Policy: olu,UserAgent: Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36,ReferencedHost: atae,URL: https://www5.example.net/boNemo/duntutla.html?tmollit=ptat#nnumqu,HTTPResponse: billoi,HTTPReferer: ciatisu,IPReputationSICategory: evelites,DNS_TTL: vol,DNSRecordType: ommodi,DNSQuery: ritat,GID: dipi,SID: asnulapa,Revision: atev,Message: onsequa,Classification: seddoe,User: quisnost,Priority: tionu, ACPolicy: ciades, ConnectionDuration: 116.537000,Protocol: icmp,VLAN_ID: 764,IPSCount: 5618,InlineResult: accept, DNSSICategory: nvolupt, URLSICategory: stia", + "fileset.name": "log", + "host.name": "equatD1241.www5.host", + "input.type": "log", + "log.level": "low", + "log.offset": 20498, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "econs", + "rsa.misc.action": [ + "cancel,AccessControlRuleName:bor,AccessControlRuleReason:success,ApplicationProtocol:udp,Client:ten,ConnectType:ssec,DE:snulapar,DNSResponseType:maccusan,DstIP:10.54.49.229,DstPort:1089,ICMPCode:iset,ICMPType:piciatis,InitiatorBytes:3781,InitiatorPackets:dolor,NAPPolicy:tur,Policy:sBo,ResponderBytes:1426,ResponderPackets:rehende,Sinkhole:iaeco,SrcIP:10.204.18.92,SrcPort:4216,TCPFlags:psamvolu,URLCategory:odte,URLReputation:12.264000,UserName:aparia,ClientVersion:1.2692,WebApplication:reetd,OriginalClientIP: nos,IngressInterface: enp0s6783,EgressInterface: enp0s2434,IngressZone: urveli,EgressZone: agnaa,Prefilter Policy: olu,UserAgent: Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML" + ], + "rsa.misc.category": "stia", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "equatD1241.www5.host" + ], + "rsa.time.day": "25", + "rsa.time.duration_time": 116.537, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.216.14.36" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 9 02:12:32 essequ121.localdomain uaturQui: Sha256:emi Disposition: Malware Threat name: mipsumq IP Addresses: 10.216.14.36<<-10.224.250.83", + "fileset.name": "log", + "host.name": "essequ121.localdomain", + "input.type": "log", + "log.offset": 21841, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.216.14.36", + "10.224.250.83" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "emi", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "essequ121.localdomain" + ], + "rsa.threat.threat_category": "mipsumq", + "rsa.time.day": "9", + "rsa.time.month": "Nov", + "service.type": "snort", + "source.ip": [ + "10.224.250.83" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.231.10.63" + ], + "event.code": "10329", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 23 09:15:06 borios1685.www.localhost umfu: [inesc:10329:1.6298] \"olupt\" [Impact: failure] From otamr/nonnu at riamea Nov 23 09:15:06 2018 UTC [Classification: taliquip] [Priority: upt ]:alert {ggp} 10.38.22.60:653 (ipi) -> 10.231.10.63", + "fileset.name": "log", + "host.name": "borios1685.www.localhost", + "input.type": "log", + "log.level": "upt", + "log.offset": 21984, + "network.protocol": "ggp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "observer.version": "1.6298", + "related.ip": [ + "10.231.10.63", + "10.38.22.60" + ], + "rsa.crypto.sig_type": "taliquip", + "rsa.internal.messageid": "10329", + "rsa.misc.context": "olupt", + "rsa.misc.event_log": "umfu", + "rsa.misc.group_object": "otamr", + "rsa.misc.policy_name": "olupt", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "nonnu", + "rsa.misc.severity": "upt", + "rsa.misc.sig_id": 10329, + "rsa.misc.version": "1.6298", + "rsa.network.alias_host": [ + "borios1685.www.localhost" + ], + "rsa.threat.threat_desc": "upt", + "rsa.time.day": "23", + "rsa.time.event_time_str": "Nov 23 09:15:06 2018 UTC", + "rsa.time.month": "Nov", + "service.type": "snort", + "source.geo.country_name": "ipi", + "source.ip": [ + "10.38.22.60" + ], + "source.port": 653, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 560, + "destination.ip": [ + "10.29.231.11" + ], + "destination.port": 2231, + "event.action": "cancel", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2018-12-7T16:17:40Z odt2318.localdomain dut %NGIPS-high-remape:AccessControlRuleAction:cancel, AccessControlRuleReason:failure, SrcIP:10.46.57.181, DstIP:10.29.231.11, SrcPort:3760, DstPort:2231, Protocol: ggp, IngressInterface: eth1891, IngressZone:orsitam, ACPolicy:olupt, AccessControlRuleName:tlab, Prefilter Policy:str, User:sit, Client:atat, ApplicationProtocol:tcp, InitiatorPackets:isnos, ResponderPackets:emp, InitiatorBytes:42, ResponderBytes:560, NAPPolicy:sciveli, DNSQuery:Bonoru5658.mail.invalid, DNSRecordType: a host address, DNSSICategory:omm", + "fileset.name": "log", + "host.name": "Bonoru5658.mail.invalid", + "input.type": "log", + "log.level": "high", + "log.offset": 22224, + "network.application": "atat", + "network.protocol": "tcp", + "observer.egress.interface.name": "eth1891", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.46.57.181", + "10.29.231.11" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "remape", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.category": "omm", + "rsa.misc.policy_name": "sciveli", + "rsa.misc.result": "failure", + "rsa.misc.rule_name": "tlab", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "Bonoru5658.mail.invalid" + ], + "rsa.network.dinterface": "eth1891", + "rsa.network.zone_dst": "orsitam", + "rsa.time.day": "7", + "rule.name": "tlab", + "service.type": "snort", + "source.bytes": 42, + "source.ip": [ + "10.46.57.181" + ], + "source.port": 3760, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Dec 21 23:20:14 dolores: oin ueipsa6797.mail.home: agnaal@itaut, Access Control Policy > Bonoru", + "file.name": "dolores", + "fileset.name": "log", + "host.name": "ueipsa6797.mail.home", + "input.type": "log", + "log.offset": 22784, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "agnaal" + ], + "rsa.db.index": "Bonoru", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "ueipsa6797.mail.home" + ], + "rsa.time.day": "21", + "rsa.time.month": "Dec", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "agnaal" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 5 06:22:49 ntinculp: uptatemU iono5161.www5.localhost: ita@olupt, System > orisnisi", + "file.name": "ntinculp", + "fileset.name": "log", + "host.name": "iono5161.www5.localhost", + "input.type": "log", + "log.offset": 22880, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "ita" + ], + "rsa.db.index": "orisnisi", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "System", + "rsa.network.alias_host": [ + "iono5161.www5.localhost" + ], + "rsa.time.day": "5", + "rsa.time.month": "Jan", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "ita" + }, + { + "event.action": "cancel,AccessControlRuleName:uia,AccessControlRuleReason:unknown,ApplicationProtocol:ipv6-icmp,Client:nostrume,ConnectType:corpori,DE:unti,DNSResponseType:tena,DstIP:10.199.173.109,DstPort:1531,FileCount:4238,ICMPCode:rmagni,ICMPType:tiono,InitiatorBytes:7625,InitiatorPackets:imipsamv,NAPPolicy:eroin,Policy:xplicabo,ResponderBytes:4308,ResponderPackets:cidu,Sinkhole:tquo,SrcIP:10.20.64.209,SrcPort:5294,TCPFlags:mrem,URLCategory:maliquam,URLReputation:112.060000,UserName:eiusmo,ClientVersion:1.3720,WebApplication:its,OriginalClientIP: prehende,IngressInterface: eth685,EgressInterface: lo919,IngressZone: uiration,EgressZone: secte,Prefilter Policy: ulapari,UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML", + "event.code": "connection_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jan 19 13:25:23 untut3537.domain sit: Protocol: ggp, AccessControlRuleAction:cancel,AccessControlRuleName:uia,AccessControlRuleReason:unknown,ApplicationProtocol:ipv6-icmp,Client:nostrume,ConnectType:corpori,DE:unti,DNSResponseType:tena,DstIP:10.199.173.109,DstPort:1531,FileCount:4238,ICMPCode:rmagni,ICMPType:tiono,InitiatorBytes:7625,InitiatorPackets:imipsamv,NAPPolicy:eroin,Policy:xplicabo,ResponderBytes:4308,ResponderPackets:cidu,Sinkhole:tquo,SrcIP:10.20.64.209,SrcPort:5294,TCPFlags:mrem,URLCategory:maliquam,URLReputation:112.060000,UserName:eiusmo,ClientVersion:1.3720,WebApplication:its,OriginalClientIP: prehende,IngressInterface: eth685,EgressInterface: lo919,IngressZone: uiration,EgressZone: secte,Prefilter Policy: ulapari,UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36,ReferencedHost: vol,URL: https://api.example.com/non/quaturQu.gif?etura=taedi#edi,HTTPResponse: quiacon,HTTPReferer: udexerc,IPReputationSICategory: volu,DNS_TTL: tassit,DNSRecordType: metconse,DNSQuery: remeum,GID: equaturQ,SID: 38469,Revision: mollita,Message: eserun,Classification: sBono,User: icab,Priority: iquaUten, ACPolicy: oluptasn", + "fileset.name": "log", + "host.name": "untut3537.domain", + "input.type": "log", + "log.offset": 22968, + "network.protocol": "ggp", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": "Number of Files", + "rsa.internal.messageid": "connection_events", + "rsa.misc.action": [ + "cancel,AccessControlRuleName:uia,AccessControlRuleReason:unknown,ApplicationProtocol:ipv6-icmp,Client:nostrume,ConnectType:corpori,DE:unti,DNSResponseType:tena,DstIP:10.199.173.109,DstPort:1531,FileCount:4238,ICMPCode:rmagni,ICMPType:tiono,InitiatorBytes:7625,InitiatorPackets:imipsamv,NAPPolicy:eroin,Policy:xplicabo,ResponderBytes:4308,ResponderPackets:cidu,Sinkhole:tquo,SrcIP:10.20.64.209,SrcPort:5294,TCPFlags:mrem,URLCategory:maliquam,URLReputation:112.060000,UserName:eiusmo,ClientVersion:1.3720,WebApplication:its,OriginalClientIP: prehende,IngressInterface: eth685,EgressInterface: lo919,IngressZone: uiration,EgressZone: secte,Prefilter Policy: ulapari,UserAgent: Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML" + ], + "rsa.network.alias_host": [ + "untut3537.domain" + ], + "rsa.time.day": "19", + "rsa.time.month": "Jan", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 1881, + "destination.ip": [ + "10.135.250.25" + ], + "destination.port": 1306, + "event.action": "block", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2019-2-2T20:27:57Z atio5250.api.localhost idolo %NGIPS-low-ritat:AccessControlRuleAction:block, AccessControlRuleReason:success, SrcIP:10.107.144.80, DstIP:10.135.250.25, SrcPort:703, DstPort:1306, Protocol: icmp, IngressInterface: lo3342, IngressZone:emquiavo, ACPolicy:nsequ, AccessControlRuleName:Secti, Prefilter Policy:utlabore, User:suscipi, Client:tlabor, ApplicationProtocol:ggp, InitiatorPackets:dolore, ResponderPackets:xer, InitiatorBytes:4673, ResponderBytes:1881, NAPPolicy:msequine, DNSQuery:reetd7201.invalid, DNSRecordType: a host address, DNS_TTL: ugiatquo, DNSSICategory:ende", + "fileset.name": "log", + "host.name": "reetd7201.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 24183, + "network.application": "tlabor", + "network.protocol": "ggp", + "observer.egress.interface.name": "lo3342", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.135.250.25", + "10.107.144.80" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "ritat", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.category": "ende", + "rsa.misc.policy_name": "msequine", + "rsa.misc.result": "success", + "rsa.misc.rule_name": "Secti", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "reetd7201.invalid" + ], + "rsa.network.dinterface": "lo3342", + "rsa.network.zone_dst": "emquiavo", + "rsa.time.day": "2", + "rule.name": "Secti", + "service.type": "snort", + "source.bytes": 4673, + "source.ip": [ + "10.107.144.80" + ], + "source.port": 703, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "olupta", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Feb 17 03:30:32 tnula4380.mail.test edolo: HMNOTIFY: olupta (Sensor volu): Severity:low: failure", + "fileset.name": "log", + "host.name": "tnula4380.mail.test", + "input.type": "log", + "log.level": "low", + "log.offset": 24777, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "olupta", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "volu", + "rsa.misc.severity": "low", + "rsa.time.day": "17", + "rsa.time.month": "Feb", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 3 10:33:06 ugiat: [quiin] apar2567.www.localhost: iscing@ser, Policies > nama", + "file.name": "ugiat", + "fileset.name": "log", + "host.name": "apar2567.www.localhost", + "input.type": "log", + "log.offset": 24874, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "iscing" + ], + "rsa.db.index": "nama", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Policies", + "rsa.network.alias_host": [ + "apar2567.www.localhost" + ], + "rsa.time.day": "3", + "rsa.time.month": "Mar", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "iscing" + }, + { + "destination.ip": [ + "10.5.88.183" + ], + "destination.port": 7518, + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Mar 17 2019 17:35:40 onsecte5119.www.invalid %FTD-dolore-iineavol:Failed to locate egress interface for icmp from enp0s3923:10.198.207.31/579 to 10.5.88.183/7518", + "fileset.name": "log", + "host.name": "onsecte5119.www.invalid", + "input.type": "log", + "log.offset": 24956, + "network.protocol": "icmp", + "observer.ingress.interface.name": "enp0s3923", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.198.207.31", + "10.5.88.183" + ], + "rsa.internal.event_desc": "Failed to locate egress interface", + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "iineavol", + "rsa.network.alias_host": [ + "onsecte5119.www.invalid" + ], + "rsa.network.sinterface": "enp0s3923", + "rsa.time.day": "17", + "rsa.time.month": "Mar", + "service.type": "snort", + "source.ip": [ + "10.198.207.31" + ], + "source.port": 579, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 1 00:38:14 uis: [oluptat] iutali3143.host: ect@fdeFi, Analysis & Reporting , eritat", + "file.name": "uis", + "fileset.name": "log", + "host.name": "iutali3143.host", + "input.type": "log", + "log.offset": 25118, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "ect" + ], + "rsa.db.index": "eritat", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Analysis & Reporting", + "rsa.network.alias_host": [ + "iutali3143.host" + ], + "rsa.time.day": "1", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "ect" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 15 07:40:49 prehende: [spern] orro7466.www5.lan: issu@accusant, rrorsitv", + "file.name": "prehende", + "fileset.name": "log", + "host.name": "orro7466.www5.lan", + "input.type": "log", + "log.offset": 25206, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "issu" + ], + "rsa.db.index": "rrorsitv", + "rsa.internal.messageid": "SystemSettings", + "rsa.network.alias_host": [ + "orro7466.www5.lan" + ], + "rsa.time.day": "15", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "issu" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Apr 29 14:43:23 quii: [dantiu] epre7710.www.domain: aria@ugi, Heartbeat, econ", + "file.name": "quii", + "fileset.name": "log", + "host.name": "epre7710.www.domain", + "input.type": "log", + "log.offset": 25283, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "aria" + ], + "rsa.db.index": "econ", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Heartbeat", + "rsa.network.alias_host": [ + "epre7710.www.domain" + ], + "rsa.time.day": "29", + "rsa.time.month": "Apr", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "aria" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "May 13 21:45:57 tio: [tlabori] nsequatu2799.www5.invalid: mape@aboree, Task Queue, eumiurer", + "file.name": "tio", + "fileset.name": "log", + "host.name": "nsequatu2799.www5.invalid", + "input.type": "log", + "log.offset": 25361, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "mape" + ], + "rsa.db.index": "eumiurer", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Task Queue", + "rsa.network.alias_host": [ + "nsequatu2799.www5.invalid" + ], + "rsa.time.day": "13", + "rsa.time.month": "May", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "mape" + }, + { + "event.action": "block,AccessControlRuleName:uaUten,AccessControlRuleReason:failure,ApplicationProtocol:icmp,Client:aec,ConnectType:issus,DE:ica,DNSResponseType:scingeli,DstIP:10.10.40.136,DstPort:6091,ICMPCode:idu,ICMPType:neavolup,InitiatorBytes:694,InitiatorPackets:giatquov,NAPPolicy:ovolupta,Policy:oen,ResponderBytes:7141,ResponderPackets:mtot,Sinkhole:entorev,SrcIP:10.34.89.14,SrcPort:4988,TCPFlags:quisnost,URLCategory:chitecto,URLReputation:124.035000,UserName:quelauda,ClientVersion:1.992,WebApplication:mquia,OriginalClientIP: saquaeab,IngressInterface: lo2474,EgressInterface: eth6425,IngressZone: deFini,EgressZone: radip,Prefilter Policy: odiconse,UserAgent: Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2019-5-28T04:48:31Z scingel1634.api.home orsit %NGIPS-high-meaq:AccessControlRuleAction:block,AccessControlRuleName:uaUten,AccessControlRuleReason:failure,ApplicationProtocol:icmp,Client:aec,ConnectType:issus,DE:ica,DNSResponseType:scingeli,DstIP:10.10.40.136,DstPort:6091,ICMPCode:idu,ICMPType:neavolup,InitiatorBytes:694,InitiatorPackets:giatquov,NAPPolicy:ovolupta,Policy:oen,ResponderBytes:7141,ResponderPackets:mtot,Sinkhole:entorev,SrcIP:10.34.89.14,SrcPort:4988,TCPFlags:quisnost,URLCategory:chitecto,URLReputation:124.035000,UserName:quelauda,ClientVersion:1.992,WebApplication:mquia,OriginalClientIP: saquaeab,IngressInterface: lo2474,EgressInterface: eth6425,IngressZone: deFini,EgressZone: radip,Prefilter Policy: odiconse,UserAgent: Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36,ReferencedHost: untu,URL: https://mail.example.net/quunturm/upta.gif?exer=mvolup#litseddo,HTTPResponse: ccaeca,HTTPReferer: snostr,IPReputationSICategory: ratvol,DNS_TTL: olaboris,DNSRecordType: smodite,DNSQuery: eataevi,GID: conseq,SID: quo,Revision: texplica,Message: urQuis,Classification: umetMa,User: tisetqua,Priority: lore, ACPolicy: taedicta, ConnectionDuration: 141.678000,Protocol: udp,VLAN_ID: 2110,IPSCount: 7554,InlineResult: cancel, DNSSICategory: tmollita, URLSICategory: turQuis", + "fileset.name": "log", + "host.name": "scingel1634.api.home", + "input.type": "log", + "log.level": "high", + "log.offset": 25453, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "meaq", + "rsa.misc.action": [ + "block,AccessControlRuleName:uaUten,AccessControlRuleReason:failure,ApplicationProtocol:icmp,Client:aec,ConnectType:issus,DE:ica,DNSResponseType:scingeli,DstIP:10.10.40.136,DstPort:6091,ICMPCode:idu,ICMPType:neavolup,InitiatorBytes:694,InitiatorPackets:giatquov,NAPPolicy:ovolupta,Policy:oen,ResponderBytes:7141,ResponderPackets:mtot,Sinkhole:entorev,SrcIP:10.34.89.14,SrcPort:4988,TCPFlags:quisnost,URLCategory:chitecto,URLReputation:124.035000,UserName:quelauda,ClientVersion:1.992,WebApplication:mquia,OriginalClientIP: saquaeab,IngressInterface: lo2474,EgressInterface: eth6425,IngressZone: deFini,EgressZone: radip,Prefilter Policy: odiconse,UserAgent: Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML" + ], + "rsa.misc.category": "turQuis", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "scingel1634.api.home" + ], + "rsa.time.day": "28", + "rsa.time.duration_time": 141.678, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "deny,AccessControlRuleName:mea,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:illoinv,ConnectType:euf,DE:turveli,DNSResponseType:onofdeFi,DstIP:10.197.182.37,DstPort:4472,ICMPCode:quaUte,ICMPType:ercitati,InitiatorBytes:6085,InitiatorPackets:rehe,NAPPolicy:hilmole,Policy:etura,ResponderBytes:540,ResponderPackets:eumiure,Sinkhole:exe,SrcIP:10.182.121.165,SrcPort:4822,TCPFlags:tate,URLCategory:tev,URLReputation:46.627000,UserName:uira,ClientVersion:1.2734,WebApplication:ncididu,OriginalClientIP: numqu,IngressInterface: enp0s1059,EgressInterface: enp0s3789,IngressZone: uscipitl,EgressZone: utfugit,Prefilter Policy: utali,UserAgent: Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2019-6-11T11:51:06Z inBCSe364.www.corp ntore %NGIPS-very-high-tsedquia:AccessControlRuleAction:deny,AccessControlRuleName:mea,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:illoinv,ConnectType:euf,DE:turveli,DNSResponseType:onofdeFi,DstIP:10.197.182.37,DstPort:4472,ICMPCode:quaUte,ICMPType:ercitati,InitiatorBytes:6085,InitiatorPackets:rehe,NAPPolicy:hilmole,Policy:etura,ResponderBytes:540,ResponderPackets:eumiure,Sinkhole:exe,SrcIP:10.182.121.165,SrcPort:4822,TCPFlags:tate,URLCategory:tev,URLReputation:46.627000,UserName:uira,ClientVersion:1.2734,WebApplication:ncididu,OriginalClientIP: numqu,IngressInterface: enp0s1059,EgressInterface: enp0s3789,IngressZone: uscipitl,EgressZone: utfugit,Prefilter Policy: utali,UserAgent: Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;],ReferencedHost: peria,URL: https://api.example.com/uscip/uptatem.txt?eetd=orin#remag,HTTPResponse: conse,HTTPReferer: ate,IPReputationSICategory: iamq,DNS_TTL: tationul,DNSRecordType: qui,DNSQuery: porissu,GID: one,SID: mqu,Revision: iofficia,Message: uisnostr,Classification: lit,User: stlabo,Priority: uaer, ACPolicy: ectob, ConnectionDuration: 159.885000,Protocol: rdp,VLAN_ID: 350,IPSCount: 7423,InlineResult: allow, DNSSICategory: orema, URLSICategory: enderit", + "fileset.name": "log", + "host.name": "inBCSe364.www.corp", + "input.type": "log", + "log.level": "very", + "log.offset": 26810, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.counters.dclass_c1_str": " The number of intrusion events", + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "high-tsedquia", + "rsa.misc.action": [ + "deny,AccessControlRuleName:mea,AccessControlRuleReason:success,ApplicationProtocol:rdp,Client:illoinv,ConnectType:euf,DE:turveli,DNSResponseType:onofdeFi,DstIP:10.197.182.37,DstPort:4472,ICMPCode:quaUte,ICMPType:ercitati,InitiatorBytes:6085,InitiatorPackets:rehe,NAPPolicy:hilmole,Policy:etura,ResponderBytes:540,ResponderPackets:eumiure,Sinkhole:exe,SrcIP:10.182.121.165,SrcPort:4822,TCPFlags:tate,URLCategory:tev,URLReputation:46.627000,UserName:uira,ClientVersion:1.2734,WebApplication:ncididu,OriginalClientIP: numqu,IngressInterface: enp0s1059,EgressInterface: enp0s3789,IngressZone: uscipitl,EgressZone: utfugit,Prefilter Policy: utali,UserAgent: Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML" + ], + "rsa.misc.category": "enderit", + "rsa.misc.severity": "very", + "rsa.network.alias_host": [ + "inBCSe364.www.corp" + ], + "rsa.time.day": "11", + "rsa.time.duration_time": 159.885, + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 4560, + "destination.ip": [ + "10.186.68.87" + ], + "destination.port": 2129, + "event.action": "allow", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2019-6-25T18:53:40Z uaeratv2083.internal.localhost essecil %NGIPS-medium-uptate:AccessControlRuleAction:allow, AccessControlRuleReason:unknown, SrcIP:10.154.87.98, DstIP:10.186.68.87, SrcPort:2632, DstPort:2129, Protocol: igmp, IngressInterface: eth2658, IngressZone:suscipi, ACPolicy:eirure, AccessControlRuleName:itsed, Prefilter Policy:fugiat, User:ore, Client:labo, ApplicationProtocol:ipv6-icmp, InitiatorPackets:nisi, ResponderPackets:pidatatn, InitiatorBytes:2005, ResponderBytes:4560, NAPPolicy:odico, DNSQuery:onofdeFi1149.www5.domain, DNSRecordType: a host address, DNSSICategory:ioffici", + "fileset.name": "log", + "host.name": "onofdeFi1149.www5.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 28227, + "network.application": "labo", + "network.protocol": "ipv6-icmp", + "observer.egress.interface.name": "eth2658", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.154.87.98", + "10.186.68.87" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "uptate", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "ioffici", + "rsa.misc.policy_name": "odico", + "rsa.misc.result": "unknown", + "rsa.misc.rule_name": "itsed", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "onofdeFi1149.www5.domain" + ], + "rsa.network.dinterface": "eth2658", + "rsa.network.zone_dst": "suscipi", + "rsa.time.day": "25", + "rule.name": "itsed", + "service.type": "snort", + "source.bytes": 2005, + "source.ip": [ + "10.154.87.98" + ], + "source.port": 2632, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.bytes": 584, + "destination.ip": [ + "10.67.211.63" + ], + "destination.port": 7478, + "event.action": "allow", + "event.code": "NGIPS_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "2019-7-10T01:56:14Z nvo2629.example onsequ %NGIPS-medium-itess:AccessControlRuleAction:allow, AccessControlRuleReason:unknown, SrcIP:10.35.59.140, DstIP:10.67.211.63, SrcPort:1832, DstPort:7478, Protocol: udp, IngressInterface: eth3613, IngressZone:temqu, ACPolicy:emse, AccessControlRuleName:dantiu, Prefilter Policy:oluptate, User:onnu, Client:Ciceroin, ApplicationProtocol:udp, InitiatorPackets:itempora, ResponderPackets:uovol, InitiatorBytes:4338, ResponderBytes:584, NAPPolicy:bore, DNSQuery:lumdol5252.internal.test, DNSRecordType: a host address, DNS_TTL: seosq, DNSSICategory:orain", + "fileset.name": "log", + "host.name": "lumdol5252.internal.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 28825, + "network.application": "Ciceroin", + "network.protocol": "udp", + "observer.egress.interface.name": "eth3613", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.35.59.140", + "10.67.211.63" + ], + "rsa.internal.messageid": "NGIPS_events", + "rsa.internal.msg_id": "itess", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.category": "orain", + "rsa.misc.policy_name": "bore", + "rsa.misc.result": "unknown", + "rsa.misc.rule_name": "dantiu", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "lumdol5252.internal.test" + ], + "rsa.network.dinterface": "eth3613", + "rsa.network.zone_dst": "temqu", + "rsa.time.day": "10", + "rule.name": "dantiu", + "service.type": "snort", + "source.bytes": 4338, + "source.ip": [ + "10.35.59.140" + ], + "source.port": 1832, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.action": "eeufugia", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Jul 24 08:58:48 quianonn2762.api.localhost : HMNOTIFY: eeufugia (Sensor mquis): Severity:very-high: unknown", + "fileset.name": "log", + "host.name": "quianonn2762.api.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 29416, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "eeufugia", + "rsa.misc.result": "unknown", + "rsa.misc.sensor": "mquis", + "rsa.misc.severity": "very-high", + "rsa.time.day": "24", + "rsa.time.month": "Jul", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 7 16:01:23 ver: [quaturv] atn2219.api.invalid: radip@ipsum, Heartbeat, itesse", + "file.name": "ver", + "fileset.name": "log", + "host.name": "atn2219.api.invalid", + "input.type": "log", + "log.offset": 29524, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "radip" + ], + "rsa.db.index": "itesse", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Heartbeat", + "rsa.network.alias_host": [ + "atn2219.api.invalid" + ], + "rsa.time.day": "7", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "radip" + }, + { + "event.action": "atcup", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Aug 21 23:03:57 equu1159.internal.localhost psumdol: HMNOTIFY: atcup (Sensor urautodi): Severity:medium: failure", + "fileset.name": "log", + "host.name": "equu1159.internal.localhost", + "input.type": "log", + "log.level": "medium", + "log.offset": 29606, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "atcup", + "rsa.misc.result": "failure", + "rsa.misc.sensor": "urautodi", + "rsa.misc.severity": "medium", + "rsa.time.day": "21", + "rsa.time.month": "Aug", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 5 06:06:31 dexer: [tionofde] urQuisau2442.mail.invalid: uptate@itesse, Login, Login Success", + "event.outcome": "success", + "file.name": "dexer", + "fileset.name": "log", + "host.name": "urQuisau2442.mail.invalid", + "input.type": "log", + "log.offset": 29719, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "uptate" + ], + "rsa.internal.messageid": "SystemSettings", + "rsa.investigations.ec_activity": "Logon", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.network.alias_host": [ + "urQuisau2442.mail.invalid" + ], + "rsa.time.day": "5", + "rsa.time.month": "Sep", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "uptate" + }, + { + "destination.ip": [ + "10.179.27.185" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Sep 19 13:09:05 cididu3187.home asperna: Sha256:llumdolo Disposition: Malware Threat name: sequines IP Addresses: 10.14.46.141->10.179.27.185", + "fileset.name": "log", + "host.name": "cididu3187.home", + "input.type": "log", + "log.offset": 29815, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.179.27.185", + "10.14.46.141" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "llumdolo", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "cididu3187.home" + ], + "rsa.threat.threat_category": "sequines", + "rsa.time.day": "19", + "rsa.time.month": "Sep", + "service.type": "snort", + "source.ip": [ + "10.14.46.141" + ], + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 3 20:11:40 lorem: aliqua4025.www.localdomain: deFinibu@pitlab, Logout, Logout Success", + "event.outcome": "success", + "file.name": "lorem", + "fileset.name": "log", + "host.name": "aliqua4025.www.localdomain", + "input.type": "log", + "log.offset": 29957, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "deFinibu" + ], + "rsa.internal.messageid": "SystemSettings", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.network.alias_host": [ + "aliqua4025.www.localdomain" + ], + "rsa.time.day": "3", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "deFinibu" + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Oct 18 03:14:14 ntutlab: aecatcup citati1297.api.domain: emp@uptate, Policies > olupta", + "file.name": "ntutlab", + "fileset.name": "log", + "host.name": "citati1297.api.domain", + "input.type": "log", + "log.offset": 30047, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "emp" + ], + "rsa.db.index": "olupta", + "rsa.internal.messageid": "SystemSettings", + "rsa.misc.category": "Policies", + "rsa.network.alias_host": [ + "citati1297.api.domain" + ], + "rsa.time.day": "18", + "rsa.time.month": "Oct", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "emp" + }, + { + "event.action": "eursi", + "event.code": "HMNOTIFY", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 1 10:16:48 nreprehe2138.www5.domain : HMNOTIFY: eursi (Sensor aute): Severity:medium: success", + "fileset.name": "log", + "host.name": "nreprehe2138.www5.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 30134, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "rsa.internal.messageid": "HMNOTIFY", + "rsa.misc.event_type": "eursi", + "rsa.misc.result": "success", + "rsa.misc.sensor": "aute", + "rsa.misc.severity": "medium", + "rsa.time.day": "1", + "rsa.time.month": "Nov", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "event.code": "SystemSettings", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 15 17:19:22 pari: [ent] idolore6589.api.localdomain: ctobea@audanti, Logout, Logout Success", + "event.outcome": "success", + "file.name": "pari", + "fileset.name": "log", + "host.name": "idolore6589.api.localdomain", + "input.type": "log", + "log.offset": 30232, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.user": [ + "ctobea" + ], + "rsa.internal.messageid": "SystemSettings", + "rsa.investigations.ec_activity": "Logoff", + "rsa.investigations.ec_outcome": "Success", + "rsa.investigations.ec_subject": "User", + "rsa.investigations.ec_theme": "Authentication", + "rsa.network.alias_host": [ + "idolore6589.api.localdomain" + ], + "rsa.time.day": "15", + "rsa.time.month": "Nov", + "service.type": "snort", + "tags": [ + "snort.log", + "forwarded" + ], + "user.name": "ctobea" + }, + { + "destination.ip": [ + "10.118.103.185" + ], + "destination.nat.ip": "10.240.77.10", + "destination.nat.port": 2226, + "destination.port": 1333, + "event.code": "FTD_events", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Nov 30 2019 00:21:57 erunt3957.internal.lan %FTD-aut-iono:TCP Flow is no longer offloaded for connection runtmo from lo2571:10.118.103.185/1333 (10.240.77.10/2226) to lo5895:10.125.130.61/6154 (10.32.195.34/135)", + "fileset.name": "log", + "host.name": "erunt3957.internal.lan", + "input.type": "log", + "log.offset": 30328, + "observer.egress.interface.name": "lo2571", + "observer.ingress.interface.name": "lo5895", + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.118.103.185", + "10.32.195.34", + "10.240.77.10", + "10.125.130.61" + ], + "rsa.internal.event_desc": "TCP Flow is no longer offloaded for connection", + "rsa.internal.messageid": "FTD_events", + "rsa.internal.msg_id": "iono", + "rsa.misc.connection_id": "runtmo", + "rsa.network.alias_host": [ + "erunt3957.internal.lan" + ], + "rsa.network.dinterface": "lo2571", + "rsa.network.sinterface": "lo5895", + "rsa.time.day": "30", + "rsa.time.month": "Nov", + "service.type": "snort", + "source.ip": [ + "10.125.130.61" + ], + "source.nat.ip": "10.32.195.34", + "source.nat.port": 135, + "source.port": 6154, + "tags": [ + "snort.log", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.111.130.177" + ], + "event.code": "MALWARE", + "event.dataset": "snort.log", + "event.module": "snort", + "event.original": "Dec 14 07:24:31 ntNe7144.api.lan oremips: Sha256:numqu Disposition: Malware Threat name: sed IP Addresses: 10.111.130.177<<-10.188.88.133", + "fileset.name": "log", + "host.name": "ntNe7144.api.lan", + "input.type": "log", + "log.offset": 30540, + "observer.product": "IDS", + "observer.type": "IDS", + "observer.vendor": "Snort", + "related.ip": [ + "10.188.88.133", + "10.111.130.177" + ], + "rsa.internal.messageid": "MALWARE", + "rsa.misc.checksum": "numqu", + "rsa.misc.disposition": "Malware", + "rsa.network.alias_host": [ + "ntNe7144.api.lan" + ], + "rsa.threat.threat_category": "sed", + "rsa.time.day": "14", + "rsa.time.month": "Dec", + "service.type": "snort", + "source.ip": [ + "10.188.88.133" + ], + "tags": [ + "snort.log", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc b/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc index 6b882920797..9b6620f4e77 100644 --- a/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/sonicwall/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/sophos/_meta/config.yml b/x-pack/filebeat/module/sophos/_meta/config.yml index f733b9eb08c..5388cbdfcbc 100644 --- a/x-pack/filebeat/module/sophos/_meta/config.yml +++ b/x-pack/filebeat/module/sophos/_meta/config.yml @@ -22,3 +22,22 @@ #- serial_number: "1234234590678557" # hostname: "b.host.local" + + utm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9533 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/sophos/_meta/docs.asciidoc b/x-pack/filebeat/module/sophos/_meta/docs.asciidoc index 13bf99beb1d..58d9add8037 100644 --- a/x-pack/filebeat/module/sophos/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/sophos/_meta/docs.asciidoc @@ -5,7 +5,11 @@ == Sophos module -This is a module for Sophos Products, currently it supports XG SFOS logs sent in the syslog format. +This is a module for Sophos Products, currently it accepts +logs in syslog format or from a file for the following devices: + +- `xg` fileset: supports Sophos XG SFOS logs. +- `utm` fileset: supports Sophos UTM logs. To configure a remote syslog destination, please reference the https://community.sophos.com/kb/en-us/123184[SophosXG/SFOS Documentation]. @@ -136,4 +140,49 @@ This is a list of SophosXG fields that are mapped to ECS. :fileset_ex!: +[float] +==== `utm` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "astarosg" device revision 123. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9533` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + :modulename!: diff --git a/x-pack/filebeat/module/sophos/_meta/fields.yml b/x-pack/filebeat/module/sophos/_meta/fields.yml index ea0412ba5ca..6e703a48600 100644 --- a/x-pack/filebeat/module/sophos/_meta/fields.yml +++ b/x-pack/filebeat/module/sophos/_meta/fields.yml @@ -3,7 +3,3 @@ description: > sophos Module fields: - - name: sophos - type: group - description: > - fields: diff --git a/x-pack/filebeat/module/sophos/fields.go b/x-pack/filebeat/module/sophos/fields.go index 11b91b9dd6d..b8320ff3f9b 100644 --- a/x-pack/filebeat/module/sophos/fields.go +++ b/x-pack/filebeat/module/sophos/fields.go @@ -19,5 +19,5 @@ func init() { // AssetSophos returns asset data. // This is the base64 encoded gzipped contents of module/sophos. func AssetSophos() string { - return "eJzUXMFy4zYSvc9XoJLLpCrj3dmjD1vl2J4dV40nWklOjiwIbJFYgwADgJLl0/zDXpOfmy/ZAkjKpAQKtNRKZj0nUZrXj92N7kY3yHfkETaXxKgyV+YNIZZbAZfku/rCd28IScEwzUvLlbwk/3xDCGl+Te5VWgl4Q8iSg0jNpf/uHZG0gA6i+7ObEi5JplVVNlcCqH2cLtZTtr0UwnJ/GgRQA5dkAZZ2rqewpJWwiYe+JEsqDPS+DtCo/+q7I0ulSUm14TJr7ukpI2ZjhMouOr/fpd6ln8KKM+h91d7GI2zWSqc73x1gVX/dwwvLpDYsMfBFRNwNtUDebjabzbuieJemP5B1DpLYHAisQFqiGKu0hvQwI8sLeFYSUQ9zXgB5m+eXRXFpzJG0amUm7gMes3uVgiCyKhagiVp6UqOsVpPhu+JOoDIDzekxXITKUIk8SP5bBeT9PwjLqabMgjaEqRTI27+/d//e/xAn5OQjOtCmBKeS2l/gIrsgS65hTYWor8UJMVWUSnZ/ejKr6xaSaDClkoYvmjgkVJa5OOSZfmiZ6joIR4iaaoGrvFm18P99q8DDHPJFkgMVNsdj8BGotguglhhLbWUOEyg1V5rbDebSWoFDJAJWIPza0nS55OwwkR2yJ9N4EJYXLkbXwB0e5OuX/5IrIdQaUqI0uQHJo/Gw0tRJCvITSmavTB6VpgsunJY6vN4aYEqmJrLil+vEOfdQGOLSQgb6dYS2y2bqsvvdDVnnnOWEG0LLUnCnqDqJjLJlZUAj5459yGHJu1XQiaL/5eA8PrGqUYxThZNFFuCsH1lknCLSuZMWtARLrhgDY0ipBGcbZ7NjTMVLk9QIqP50N5mdSKwhhRudJzUlH6BbUlaNJ0XLcsmFBX0OnV05QsyHGfLBS2lVeIz+6Ata0uP8f0AYz+BdivHo0dUZbvg6nofm5hGPx5SbxyYxU2N4Jl8WQEj/UXYWWC6VUBliATHfYraF+VHUGLWQKY1IrGtEblwdqsQKUrLYEKdKaisNrqAwG8lyrSR/hvRV3FvExTejzYSbhAlVIe54drR43UMP5yiZuPiklxSzX3DXQvpNBJdMFW4X0cSqH/124kcyUdqSq8P8VGXPT1BVNlNDBH+K1NaaJTxcguxdjpD6WfOMSyqIUZVmQO4mhKapdoXI6Epfs6SgDE9Ru5zur66PIsVUJa3eJG77jblxTaFdeo2Efh35oslRxWRqLLoxUzCWy3pNHmFRR+kvUt4O81EaLLWyiimBWFc2iN2G0livK5UOt0mOqsl214JDd3Tm1xNCZUoebibjbXomal2bHc2Ps6JE3h3cXd9Pts2b+sNoJrhu74WzxvfHMzEgbVI+2nAb5fVtirmyvSZpSdkjWOPlHGaigQFfQfpnsGlljdDNYmPhXHQ89jjVrP4EIuO0YjWVJnFhaD95HJdT5g5RUAtpoEQIFTJjCeIGo32aPhIdSxAxKXeYDaTlU0ieTYt7Qf31LI1mz0rCeaYZjZWdgLZ0/nT1eRQhPDKfabFLJpqFz6eSrsm6evk1ppeGFb5edhlFaHCdpNwg9lbnE59THDIw96MLMlGmHjWtqKjAXH798rvS2dcvf/xIvn75XUMpNu2Hr1/+OEyYKSn7Q6GTGd/WQ125LYm5IUJlbmedgQTt1macFGofsxlp8hSk5UteJyV/6yzec1ih07neSiZ3N+1eoqDGgh7Niqfl+bvkJ41cOgxxO5cdjn4Ewi/gYu/iSdS3vTPMwfps25C7uxkrvjC7ldcpY9AtgQKMMTSLBDMmqDF8id4Bf+ExICFcpFYCEvzZ8KRB9NuarQ8dplIKapdKF4gsGsQ2GDReehExEHo/2WngpXHc4kdoWKozQEwgxynDZzHMczBX84nPZWCjCxbKpKowZd/KtFRcWvLwEJNtcw3UIs+G5pMQbjhY+cLx2+nldgq2b6wnKVTGZVKZvZx8oqU8LunhDq8Q3Lrdia8PZfVww+KfgFV+DlZSzNNFnkOLTXrYQR50dZ6y5J6KNdVADKNSuh0mWjmy1KpIoKBcJI3PISZjkClo4tHJLno44KhzcZmCCyTg4t4r+Jhq8R9gmBsYL3sXNijb/dLw57AXHVWA7yGG9yRcY55M83AjTgF8mE+SSiNOKT7MJ+Rh+sl7eLNGai5rakiq1lIomsa2i47VdnuMx+2mhXQB3hH1Lasl6EvyUDpe/qRewzGygLkAXDeZ8eftFMqhE5tT6zaPlnIJ6Y6DDJLCjcQTavMeqYaPC4YjCeGG5A+OhI+/1BjFuG8LrrnNX06fRyjZkqmioBKxtnOu1IC6pJ3Wx+Ff3H6pKhnxJ9Q1ePL6S1VBucS13I3HPI3XbxXVVFqO2Rb0Lu4s1zprz99fJMZGP5ol51Bbk81r6BEBPTX2LDym9ajnFUw0UIMZvacej6zzjTePBqZ0WrsPWGAuEFBDTEmLvxVUcMZVLDxpWILGrN2nO4BhTylpQZEz26ykBbka0WR0xQjmtnYHL7JqE2yf+PcWetfdwqr3x/SR5+iz+ux/DzQoXa1Aa55CYtUjICrh5waX9HGDHJj6hvrwW4XQyuZK82fMtbjVSgA8vAtyxWC9MBFXyPwFtTMauPrFbyojDbDKF6WJS0TIp1CacreuM6P7/C4P3KzS5RHPKLm1ZfNgFgyu4defbWjPwHyczyftg1+jHgH5k5//GNk7PtOTei08qXxBUlNcw8JwC2RJhYgdKWxqvHO4c7tnG+vQ8MTAg+HtuD9xY7eHCHNgj8ZJEVVan91ew6IjNWZJJS16Y6+1Y33K0QsYGZ1xl/w2Lo94RIFZvuJ2g0vgV1hsHyFpBNR77YJalrsqUqaEUb+Rc8pqfqvBVMJGLNd3cuwNVNfJR7Txc/reVIgjrdnHq/eNb1fbUQ63UJAFcJkRKqnYPMc2SgX4QSXqA873NWZ0quMKE0y5vbH/qNtGv+dIoPNt3TP1U2dj+ql+IeA2pXwPKD4VSI2t96qIS7AzLrrpYw/fPG6b0N/8LNpO7hSzqCutX84e5tAUB6iRuwc4rHP8pmM83vqk+mSTUsOSP6EGGZesyaSPG4753MIZHkqbuRrvehf2oBZMtcTXwpMlsz5ueOVz76BUYw8Eb7bA/jRhvHrB7HXUp/DGNHlwB9IP0TF0a3NfQOGb/L4HO2Dx8w2LIlaubJ4wwVEPXF5VNifXfdBh6QWwnEpuEEs9T2Afd7CoqjWFu9iuw7hBDhoKZUGCXSuN+CRzGDbIQChGRUYtrCli4P0UQh2Wj66ATyHUiBfgbluvw7hBDkqkK9AGNQz8vI8ZlC1hjS778z5mUDYv0Q9u3O1Bhq3uY1RS5hvDGT3DAZI6CJJWwLjzIw2rXBmLXAA0dBzymAkYXScp7b0U70T5U7omPcSg3HvU+cZ9dLBhwBjcrjmZ7UGGJVuqreUDJn79C/dme3gH0g3Ww1hTj0buJoeFOlrG0iIs9PX3uo8XFDvbmE8qS2a3019up8nnq/tbRCt7bFJjkx52kMuCsseqTApU//7Jg5Ii7ub+BCvi3ffxBpaWXmEW87M+XlCmi254Ej920QZWUz1yGVzHrx/pTEOQA3WLeuSIRt3BC8r8rQK9MVbzvds6QXAINCgdnqxGTEl9uKDEycfJ7HY26/SLTpa6DzmcHxLsBEHiblWfzMaTW2/+x2SmFLXfN729ifb5FppKliNXWj950BFtlqp02kyRcvE+WrjiTgUkrKyCMpdC0d0AGhHr8Mj330eceWMsFJhia8SIfg3ov0Am4hmVHlpYnuSIGa+HFi7llKUiKaAY6tIe96C8f0fDfR81KH+pAXEk0UML36+m0hTcWkhBa6URN4gdaLKDPRAg61dWYPNocV9F4nHB0d5csiXQB43ZA5NC1xavY5FqVZ6DRR/3oC0wKWxtMUI+U0JwM3gW5ZjjTHuA4RyG/za5fcig5Gsllzw79LbjI/JKGDQon0yhVHrA7Y8QvYcXlLp9SBpL7D5gUO4cBloGR4jsYQ2WC4hhtQ8XLosMZsHbQwvKw3zPMo1os+5kmsS/sAL3RhvoTuO+vvf/BQAA//8gM69j" + return "eJzsvd1yGzmWLnrfT4FTE3HK7nDJZVd1zWmfnjmhllRdOmO5NJLsmtjRERkgcpFECwmkASQp+qrfYd/OvFw/yQ78ZDJ/kCRFApQ8e/dETJRFcuHDArCwsH6/Q/eweoeUKOdC/Q4hTTWDd+gb94dvfodQDopIWmoq+Dv0r79DCPlvoyuRVwx+h9CUAsvVO/uZ+d93iOMC3iEOeink/QnlGuQUEzgxf2++hpBYgFxKquEd0rJqf6JXJbwz2JZC5q2/5zDFFdOZHfIdmmKmoPPxAGz9vw+4ACSmSM+hBoYaYGg5Bwn2My3xdEoJmmOFJgAciYkCuYD8ZDA/qfAjJjOToip3n0qfqethLWqOWWd646OPjR8aYj1IoWadv28eYXzBBqtyN6fKfA9RhSoFOdICEVzqyvNf4iUqQCk8M//GGhFRgDKTFubzHmmE3osZOgcicpDhiThatA9q3+nUdGEBXGdmapEJe8CJue9ZrizPieAauFbmfFCuNOa6hqGCGDUt9gGYY93/YIiOOkxmCIQ1Ws4pmSOMFChFBUdzqhXC6APo36jmoFS9+ieDrdFMVs1FxXLEYQESTaDZdyWWCtAVaGygYTSVomgN9eK9mKnX15jcg1YvB+TPqQSi2eoV0h43RjfghIXb4bwF8yTISAYLYHtwkgneP58dTp5DKYFg7ZHkMKUcciQ4s7A0njBABS7DqAo1y6IdmA1rfOXP+eX5G7TArPInnubANZ1SvzvhARONmJi59ZKDhbCzo4a83y32e2Y5Siw1JRXD0v7eL+zJ6M4YkN5rp4R2xoDy+E4ZXZLFcdfk7f9Zk81rYkZNsyCHHV8x+VtmJ9JflmeDboH3EXrJoUlQopIk0d17ONtSnf/DkCmNNRTA9XMEh6uc6oww3DvDzwQecC1XzxHY3OhUzxEY5fsBS6sx1ZLj+e60HPA+0iMt26YAecw31IheE3pntr5YmwUMmoEeMlASDntF9PSQAfUtr4hxLvZMK0fiIm9ZVYLsc+waTDMS+1CAg49mHzmGWl1x+rmCtRotm/n7P626j9ozwYm5HLAWz/1lOyJuFjStOGxz98wMQ6eU4PZ5fi9m6GIBXKNbK5xRxXOQ5gkiwQuqwdSn9AFypEAbIp0fd8dQ4w+WehEGtA9+sDSLMCD9qEUZWgLj25f225iDeT2CJ4/jwVyoRPpqe1/+IpRui0jW35EKeE75rP5QhbZNy4b09fCX7rPBBj8aZezl9eJHhPNcGlk5dtz7zB3MXouvlbmLn1Kz96f/fdlruJVeNvTlgjOkta1lOcJoRhfAGyPZ16sIGBbtZ79I+wLJn6Py93V4NEYNGqJcZRI+J1jrtvPQLrCd92RluXzhhkbX9iC98tZsjdHdqgRE8FCCTAAB1XOQ6OMl129+QkKin5nA+oe3aIKV3UW1g2xKZ5W0qt+Wee+j7n7F87Zu0HSPzwj2BfPrmUhlZtv0Oq5H/uoNDEIuscyTKXUtidaadpuTl9efOvoeRhIY7i8pQmqlNBT+EvWwDbU5uJ2qHPPMv4WkM8oxq3/T1Va28CGV/rUhMOLy+tNPARZ4+ANOHM6CBtGQyzFun/VGHSqO+94+c8A5yKP4rn+xQ6HL80O8pA5v21lqyeznK33WRjZGsuR2NlwrWpdrRcseFPN0OROMAdFCfo0C2HDvCWJuzJ6jChHHOsgN0o6i+l701Ra0gdHP8MVXkMlzUVULoWywWyE4mqwGi4aQhM8VKG0IKlqUbOXXyXzZCHoEmMyRojmgF98jPZcVevuHP7xES6yQAuDNKBs48SyU1x04oUrBFaRjBflqdgURFdeNTaEqJk7omaOsghTQCzwRC2gxg/JgZGUt3pSWgIvR80O+mm3zxKyCnFZ9PS0Go74JaY6NYYFOEdV/rd5+/+aPyon016UVoDXovw5m81fzHnyPVyDRW3TBCS5VxZxnxTwpHyXXQ9QPdH4EYitDo/zwFv2Lme4r9MMP6F8QEdLoy3YWftBX6P9m+v81X6QKdZnyTXAJucjh2b51+RIyghmbYHKfVgN24LjQ9thg7d4VhonA81JQru3TREM4wNlujgykFIni09b6oCqBUMwsYotUaSGNZs1XTuswHywwo7nbGCFQCE1FxXNzwzCw4CmfeeVoa/Bi90QMKMfwBfrjsMFtNLIKKyZw/lzuOQ8HKfoFUAFaUhJ4dfincPvL9i3srvtaCJtrH+u1Rium9bKdoF/E0izN8M1JORLSPMa0QPcA5RamPYsb7ythmhQElMoWNM/yVF7Xi1ryzICDxNoe8txwsPUuXFCpK8zMo71je+cBEwctqHl2W1+5ZYabhT/ql+dIGmmtrEHFMg3LGejma1s5oWSioKcn54SLhNvMCZnEFTQU/Jfnte31BgqhAd36/U4k2It2shoTlOZ/tSPmK3C8+JEyVTKaMrLhWT/nFR2o/c9CNzMyN+F+t6fO3AF+r9e7rn61+Cvkv4eH0YmXKWVP4KM3o5rH0fXZ6bXXfQnmhj20KIXsa7zIXpFfXRhE9TzMHx/dVWUf4vbpHjKldp/y1fon6we703Psy/wEvf3DT2hp+V4A5ggzFrYVWKO+VZPW9iO0BAmOLNaIAVYaCd5LF+ky8cnVxK+biYGzmsJt63n3m5C5ZZyNagIy54KJ2arviJtSOdBiEfoDInMsMdGOieZQryx+azTnqOI+pod1bOajGbWxE7qdoz6lE2GD79K+KAqjZApeuxEkXo7KNCtZe2olJlZjdT4K7m0OgpBK1hSVxjzHMkdcyAIz+iUU3ytkEeRP7qMc9maRqCaDK+lRTFqjbsC8ZnQKdsaBB74CIng+omCvlztTOqWdZcOEKCeiKBno4AYYNaJiq8BrSXtisJVvJvUTbeRbM3ZwO49t5e7OHN1+heB6HmmZ1vmpsWJe1lFO+RMx/oLnKdhuSH4RPHW1hQ1i0Yxeq5guvPauz+GBiEp2ok+RhgftDx9agFStdIp8UxxYYH0P3WwrwLGmuU7TI0LmkKe7B32Qjb+mVDNirWPUkTbNF9v+9eFtJUVxYqlWNilfEeBYUuHU+qJimn6nKUiEy5LV2S/rWjYF5ngWSs1FiFn3Tv1edKAcVoWo/lYhseTOM6ZxUfYtgx6xGc1AHJ4+rRCZU/O6ETmoE3RVKW2fSW2i5lRiPRKXizXsuUgbBdh0anAv4BiakF3kekDHOwlTkMCJ2xDYqNY5XdDcaDZ2P4QF2W0tyO56zAtP8qGk8mgzXK+n8wU9mJ1INVu5ySoj9Iy+ZkDZDbrZNhpx0UdNOK+MNG7k2clgyCacTFSxJVAxUOQOpdjwP/ZRsRrk5wqqo20ls7vdLlrLxyVWyILIR/aNBfcmNlMjKgUdhiaQabNCJ7h9Z0UKrGWWAGqZpdCey5iiqEv0bXSqCXSl1i3yNE/I3vMxeMcMrstH3Tn7is1tcm0fZ8H6guhVQ4htCMJkoMTHUKxVxVK7nUZeUaLSRBTw2mFoHi82KltMBzsEc8+CzgNyZIPAAiTVKVNHNkysHt0nAbY8O5tMPmmTFwe1A90t3WS6GGrW71QCoVO6fviEtVvnzBmrqeJ15fTRTIEFaEyMNF8nTNQmqtw7WYK4/bP5WIvwqftKb78EhUS/3vrQWKrqgIC+Xc2OX6/QWJakKoWiEQXHTnvLPqd57ipM2VD++uyOVuGpmM7SlS56pCjiVQGSksfKouDcjpDFtmFi7Uy25mQ4seTO92BqC+C5kD5gduPMxORvT1C9pnbtisnfgITf0QZY+lzwAbuNBN0MzEn6lLXqvhkeSJ/178WMt3LNcRNbzIVGGM19xYtwAC0Ts6wOVHkSoV5vxEcL9WPUTOnIvr/YcCtbtdqKj7DiLxglq9SnZ4NcuLYAfHFtzlYjcrliKeOmwwy8qRhYYGFxKriGh9QaawPokjt73boeKs5zZf6fvVQxqwGFCsBsuZzJHPMZZByWqWXBmOMSli1Xv1VCtJZ0UmloSYhhjL5y0I223r7+wqJDlTiasGs4x2iyspWbmGYfgv34Igemrb8FHrc2A8wwrC44qNYxX3IB8gTdgluUSoE8wTOwpbx9pPtUyBrDgHZNxuntxP4eud+36lYIiSZSLM1n9V+9rumeXaP1pC/zayx1bDNdQzi2RcWfKTHIDj3WmRIsb9TGVEdKlOAdiqnu4lOOMAOpm+giuR7U/825t7z4aBUBsEFIAYU5R1zw7ySUYF8ym6If7LPhmFcOqaQ0B6Z5r9iVtHrca+o8bLX7ZzCzJdVzryw7WY/O7YATm23CkeDfzYT57w03gVVSsoDimHDeuOUMfG0BGJBiiox00BTUCbpdy5R+Y4N2ZlUaxGcuna9S5hHjUkZdsE3uxa9nPEaEVUrXG9L/Y7BM9idUmZX0OdHevmEUX/vpuAp0dO3HnbDwi96VZUqnlH277eFlUJ5bFAgrJQi19lKzGsH3pF2w9/Qe3iGMyvlKUYIZyqm6f4VKaXuivEKgybdhRRlLvE/u5SMvepdnI3EBGqRCJVa2ipeyhRxcLQIiisJIMdFx2g9Ta0CTjeqeuw+eSuNrrWGCi8mJbyKKshqewQTLhtGS8lwsfTwtEZxAqV81kRSjzBhMc1oxtkKfK8yc8TMXBabcSw3eGoiJkaurbfWMpS5tmLpRCd9Tfg+5zwWqA9GxstYp/0Axn3zTQDuh+aaFY4OqEElFXbuzkzNL9AHU8H69fSpcv5be8opuh+V6GqczyIL2GzulNrH6MS1at/83a9o/RNa0p5SlP+PNlH+2ozXHWEJeEUC15wjC5jYFkmKWBW7TZJfIrR2yVpv792PrAjQ3zKhdAMi92qvkQAyLsR/dXHRzrObNCTVqYSDLsCJzF/lb59g0aYZnNaVeiTAzkWaYEyWJ+VXz72GmKTLynCNqY+4qThhgaf5kC+GtofkEQm/tlHVi53bvgxN+1bDO07O+sYgoJpQ3dbPbF5ZPG5WPuL0WVFbq2Ja+tjZiAYxb/I7jIA0ciTM3uqvJOG4pdS+45Kbxhn3Oynx5jj44SfPCF25ArtueT/o12F6G9WpngH4KW37L/Hx5blnqU94aMTG0HnQ9ci4M0E3hxG0iIwuWVIUfqQu1SlnLvuvV9QnaTl3YaMfm7vF9xF1jWH/WDIwuz7dqsrHsc1s0WQPsLc/XGu0JOnP5mb7eKXMfbNZmLUDZ/cabb7w5blLpJnNT6OYyqjgD5Tgj3IWyFGiBJcUTNsgCdEUZKEclwyOCQAFXSeujdBa0raq6kU+MpDIaRp1fSM06376+vO7r0MiXjHUWhbG87D0bCu6cC7n2tDiQ6JJrdEtnHFthMbJFSyFTFq/9diC/zCa9rnU3Yas62v80QFpn2e6yXAQ2zodf7xDlhFU5GHHmG9man5+gFxcPuCgZvEPXziDiyFrpfRK2i1jP3NF9m9Y4tb5awsioujcq9x64HpGK1zJjfvBXww1V9xtcrlrS2QxkuhZ2YZZ9avsCPAarnc4lqLlgudk97q0+0mm043o/gmVh6Hv3UvnFjdMxXjbFOC7Pw2kkO3vniSjK7MhxV3ZVfOyVbePq7Huqmnxn4Ahu81Ontt2MyCsy9krzaukTRY21kTfSUkhbecDI9RrfSJc4LPMllk8ToTesqm+kK/YXkZnESGnkF0aIYnSFSV1POazcGhF01HeM4N/VCqrcLIXcWzN6U2sJWEWPDVYa6yqW4tzYozBlT/bsMINPxAOi+evx+8vcrNUxEBpEHweFj91ZMCjCR7e+xxJ33xts8vNh3719rjPKRRXLx9nKI1Gz6GfKSNKYRoeBRfbHyIRTV2bsbIlTxozcQ6oiBJSaVgxdmPERETkosyXqYr/hlwXlOTxEZgCjSu+neR4oW+zA9ikmaxATkNa/WWBJmY3gCVjwnP+dzxC2TPzO/DY4M55gH4qJKy70RBqxHx29aOI5S5Cq9Em3TsIMWOZVhHVAfF3h6eVIkqEzcw3v49QBJU75aoK8vK3Kfdt8iClXKAeNKQsYGSai0q3fjUxNsKPHZtYWW9zEsVkc4xephqJkyaJ5TlEOU+xdQL7yZe3D99GaRitegGR4ZRO5tPCXK3oROJHmA/vq9r+GaZ0F7mz1SlNd2cKMKDix9dtgWLDp0OMa1YvVsu8QHBtpAllFRFGY85RmG5056oi2gn1LKRY0d/azuopcAWo0ECoXZH9H4+OtZT9TttYaSTsuL6waPJQ26OlpZH09elpZ/zcx2dPutPf0/n8x8Q6Y8OkqabrCuec2oNit/O31JbocKFRtGMmq1vrsks0IIiZ2Ndmws6gP6cfYw3xsdVi5dyIim4g8dcbXIOOur3R4LMhgGVGP5vGrJTiXwREyz1smYJ867AJoG38IndG8ceWMGPGK2K/GQRp4hJs/npLXzLusUl5TdXfv64+uek7tiLLBGg9AqrYVwYV+TSCU3lpXYdoUuHEEQ0jQKp53DSJNdiVeYMrw0JGBGlM4svmVU5BypNOCO0P72Prj+d38Y6XwBaCcA3YwJR9uoOjsZEQi0iKbVHm+im6foUUWNQ+oRbdSsF+h841WqvgUJRURqxz0UuwyVR0jIYGqdvSqq7mKq5zqJrNuXRfNIwo1tltnbDhRsnYvbJ6kixKLzcHF0V7lZ58u0AufK/GpYkZXnlBmEzhsHNjFQymU+eZL9N3Q0MD7Xph7Lpa88xBSQCpbzGLRpT7SaZPgI5jg+mGhZ3WW+wefmvQeZpis0MfR5xqjE4mfIinfD9xhMeWowJRPJS5gYzhGiaXt2pu+TkJHuby2w6IPInfB0euygK2oswAotEX7sqEChhGpXkjdunEfYIl+qbh9Sl6JHBh6Qfni5PevEBXkFZqY/wfm/2GO2UpRdfL7sH9RkzKbMjzonB9bh+pq+GfXyA5qbV1WTq7q5ldiurFQgxZJkbq/TjzOugyCAmk2chDQoogrd3vIPl39hiWgOxcA/Pvff7r67fTm4ve/dzG3CywxHd2TSyHvY6Ysbz1gv9UDtj1so0YwzGMrET5nJ26VkuY6wMRcF6sET5ipkMAVJTEFSMuUlABxEd8KEvAPxCKaLTEdNic+2Dpga5/HJmqOT+wUdVVNEh0KPcmVlrEz322+djKDWPsujXaP1jkf6Yyk+ya7rBuDDVQan2yyznvx+S6GxJSOGprqqSYzxO471WA1osA0++k9YaG8dz3BxxsuDHiv/98MR12rzK7z35Nssbxlo/dANoJ8ks1R+3E34RPiCEFbnZVtvUtf6CaivY6ys3UyX1qz22DnbvdM1yWr6TH8YTbpa4opM7yui7lce5lxed7ObbOVuMxzUMMsUMJgPKqwjrnOjIq4x3z2Cby24dY+++hMFEXF+5aoATq+X+GmQ9F9gAf9Fwjr1A02tZ9mfSi2W8zzP4uw12yNTWNN95EMB6MbDtwBpypVUkJFtCjRY73gLfollnzodHju0BUvykykEsa3H66u0a/OjroOSg0D+XzUUILbf3+PPlcgR2q3VoxnEvqVOtMGN7QMoit0UyedBcO6Gi2dRLxI20RF7DYChmi5l+FoG1UdcI4dTDeP36ABMyyLBKtlyCYwL+AyYgJyQ7TKo3Wl7dCMW+2qQzrHuq8VHkp3ApzMCyxjpZU0dFclHrQvPtj7hMkgnCoKzWwefS8QmMZNoGoIT2e21FICsmLytwRUSxy9E4arOBV9e1mne0ZjXzi+clsBRvWMDppnmNjGKPHTTwxtxSM+3luEJ7Ny8SN/0PPo9zvhGdEyy1XUuust6obyfp6nHQgvGI4uMXgGfEZ5xKTIIekUsdE8m2ZqSTWJLj94NmViqXARP3alTZvrRTrqCbwuhGeUpxQnlJcgi8kqWsD7gHZJ7tMQX2CWYq/QMiul0CKL75Ky1Bc/ZtbiGJ82S3Y2mZhleQpmG8Lx498Izwr8kGkdy2zQJWx2NIMEl0JBeSLQlKcDXTKVsQnLYrtFO7S/T0g8emXwFu3YtRDbtGNn9bZp/yEh7Z8S0v7nhLT/n4S0/5iGthYlwxNIIVIa6vGfZzwrKmaV78kqwT1ZEy/vE+glRcXorCjTaN9Gy8RsFjsIyVOmKZQSBZ9JfNsIz5QLSEywgkqSNK9JQzjNa1KtVFUm6EVKeJNWneSpqoU2Tw94SCBCtNDmYZaKtn3WJCFecfrAMRcKSIJNuPjJcCXRpbD4SZR6DjhPYFYTRZkRlsCGbQgncJJYunKy0vHNooaySkK5rLIEPg0iqaYEswQJRCrDM+BkFTHqqk2bY7b6AvkkBe5FZsuAJqHsysGkQe0Ca5NQn8zKxU9pbNAqm1D9xySFxojK4vaK6xGWIrqoVkmOuaUKRMbPclPOxh+t11aLMOi5s/PHN4444lbtS0LcVZOPV0GuRXtKGaR4w6hsmmIR6TRmcnaXcArdQGW0tEGKWRJRR8vFj7nS5aCYfyTaSpIktBmdQopnjLKG5gJyGi1htEub8jS7pBB5xUARkYLbnjidJZBNolRLrKP2/G9RD0WQRyEsYUaVlji+JWRNO4HGJ6FMxWqZjNfKViKXieSri8x3WzwBdS0BFwkUSZcKlAp2OuV6ORdUZa7DbHzqKyxxkg2ejyTCxqC8cP3tY9OlSmMevc9xrvSkkrGaBdZUwfUKSkG1io41vh5d5yTHJms7N0zjN7vet9LAJpoznOexzwDNY7tV69JBCe4iWmREClEkqUpkCCd4ptEiSxMc6SsepWBzeR+9PFOp4pcspaUqJY1MlGFNdRU9+oxRDvFK7KypqqgddRq6Nvk2vlmLCVf1NJsyEf06b4gnCPk3b97oUscQTSBxzBs6AdTosQlMzJJsXT5LcoBLIWMLsGJSzVIcs4IqkkIsFCrJhk3RB4KDtsWVotONLsNdAejYEX+OauxwPL5cxn6BJMkoE64BdPSXqIivGQlJZ1mgH9fBdJccZPw7q8xcU97oZKN2pl6TdS1ek2yyBImbvidObGHgycaWBmXmDEnR4WKlzIcZmcfK8x+QhoeSRncElCCLmcRcD2ruxqC8TEI4/tXrKpF9/NjrAhqBsBSzDKsyYsOANmmJY1OVgFkK/U4CsXxwVUcTEY/PZEM5bgnXFmUh8wSI4xsyVQLbsHK24QTxAApiBwK4hscJHicKPsffAKECrdGoJnhKKTpLIHhVGdvKpiRJcQ4kyaMr0kqSUFXcCIR1vBZbbZqVil5Vc0F47ESJYLfYQ4m6Ip2xp69nOv62ckTje/Sanp6x6a7K6NVaq3ySJA69kizBXVgpkFlOY2e9J2lbUXuGUrBBE6VxEdsavMgoVxpPE2gGCyp1CjV8UfIEpZu0kBWPaWYNlUULVBQ9rbRANxVHg6Gb6JGEzfI+YUZzdCYhpxqdYZn7aobKln8Pw3GdsxJyaaxDqCVjm+gjW9+ACIZCqTpNPATl6Th3UZRMrGDQWHAr/6aiilbUe8c9ZnjobEa235mEGTygAvcLLax9sXxW9ZuBJAfJqLLNGerR/dLbAkpIVWUppEbDwqMILedYI6pRKWE6thUOCMt9TBOKEOP9q6OBgCj3ld1H6kIzylN35G9BNaO1cSqkxQz0HOTJ+vtqLqrBjYYQhwXIph2RFqjEUgG6Ao1tR3B3VnHDghfvxUy9vnZpry/RuW/x9QrpeaBLkS0GfAO+9bGFzdEH0L9RzUGF13m4qZMwb2pbdjenyA7uJqsASzI/oZwG8dmeu0eor90Tn7YXhg2GeM1wxW2v31ll+7jWRdzDBdx79do3zCl9Oe5mTk0Rbt+/eOSxbxYii5jTtFvlVTssuoMHbU/FmLngGN2oRwTSunHdB9uhmrORjpe2em7CduC2fq4CjSR8rkDpDUW7949WfnytfKcy2LY8blQnsfsWqSbutGtO2YTJIbK+sc7fbYV29S4485i9/7f3NzSDXZ7XQsGOHd4b9tUQL4j3kVvYXC4TrAC5cO0GDRqcqmaV/C+eBi9vWsE3yIV05euDbEQIK6QAbLszvLlflcRcYXKE9r6DCtNuaG7V3vWmIZW0HdA2gS5BFtSpG8cCvR7SNeagC8pgBojBAhjCStEZdwu37tcf3vq2JPMTym87/oadPnmSTs8GWcXp5wr6bRJx+PC18O5XMXG/Lii1RkNzdyCJ4BxsbAVaUj0fExQIBTJDGo1dwl7pRY9+Whh2WnnSXFFMzCjBDBkEI08fi+Jp0dmhRto0Ph3vyvlKheG1wtmWohfVGvuCx4xilc1F8jeBe8Q1zzXbS2Xd1MhIxXYLnnA9AOQOjUFr7zTfiIUwwPLklClhHuKd83ZuneXoF/+LE3TKV82/BtS1fcsrrhHOT4goykqDDIvhJGZ8M7F0z7Nv+mtheyx2FoTqv1Zvv3/zR/P2PW8tR82xb4Kw/T7N4nrMdjXc4BVI9M+NTU699jAsuPCpj53/k37P8zXmzq7fuB57Bi9vk23f9hummHFO0Idf7y7M3EGCM55Ye2lOFZFQYk5WRqv06hnrx4Igy6FX6O7qHbrk+oe3r9Dlh/OL/3iHPl5y/dOP6MVyvkIcqJ6DRGQulG+VJqQEou233vz0//1fL78NcgT0PKGM6/PDytSTAofb8ajEu++Rx/zW7cXLGlT4iOfPC3RbNm1BvmfBuJ0v+BDenmK6fp18olJXmKH3px+CYL8IDulsWfvtjP8hOJyEeWvgfjUi1E5ku/C0S/Ac7+AN6zDDGpb4CVqk2919jU7zXFo7rdvlITjN1UuKcl8/56G+kMuzq2t3K426xwqsjuj96BiVnKbq7250eW2gjFi/DA/37AQRhYdm7HEe1ppY5rprHVdAtODiPKfmy5itHbatXv7he+6IG8A8Ce0BF/6En3e3wADKOtY6iV6365WG0QeP8FpI3YjkgdDNrYPNLgDVq+2SVx2Z924+lM/qy6Se1tUY4zmE3o3HsuJ6dPbli5UShBqV09mNBjoOMnJZYj6Dk+bpRASf0lklIUeTlaUJPLdRQ2E5U+5ZemCQNDqiLQcHnSaod8Ai6v7tFK7oBgAJhdCQ+cju+HFG8Vmbc5XhzIXiJyBdapmG+DTBlpgmyBZmKY5DqvonZQKm4jyrLXHp1PL+C97M46Q/WtuY8AQa7IWeg+Sg0d2qhFfoY32NvbcGsB/QdW0AG9wEv45panWrniMoEyNP4xq0t4u/QpixoDJRrr9oA9ywtIF5C5DmDqRcC6S0vcwpRx8vRwUKsQGyyeRVdJFtiIoyQds3Q1iCih3Ra8gmSHFxN2LsUHRrb0+A1rVWyBjwWfROkRazUT4SaqEjGqhTeTBrOWA4IjacYIow+lnIJZb5sE83QqczG+wlETYn/sHG0k1ALwF4WPWMXDXxsT5uoTFru+ocGGRLxtvIiMEMKfdxrjYsoaDaiCXfYiM8xQXD/Bh+/B0MlHWASMtEOZhg12S59qQszAt2Zh+w3ZsntqcSiK1CsIhXD243jz2WmpKKYYlsvWhUg3hx8fDuvZiJ6TTc/R1IpueQfHk7YO/MgO40tnBfGNwG7mml58C1DxYfha2qmJUTdgvocUOOQ/+oQI4CFpUm4ric9kOOA76tCAGlRjDbyuP7FUfbL/DE4kJGxZ0JuUKBxIQBtmMIpw5G6GE0Usk6+FQpuLlXjNwKKYfND9FAUerOahGvHt3IvYmRq1pqcwYYhbyZj7fD9PRhypGiugrIT2STC8CLaE91jhXCuSjN7aLnQCUSS75eMsc4jR8EF8VIXK3tyaGoK1F/XCXCKPeU50b+CKkaBmD0M2WATj2wkwEbdjH28mZi7kyOBow383+ScIVRFtz6qIW4XAjNMcCImPnuBzDCxevd+nyN2JwYDwidiJTZA4HJT2COF1RUVrskoiilKOhIhCIcG9wFxxNmk8im6GwzNsoXjdhJCLKPsKN1oiCADsKozWX2ABgYv8GXenVbt+z6vI1uu3WaZcV1P50ttkaf2zTwjOzzrN9JC7L38Qw4SErqKVmG2EC/fmgB1XN71YZ6uyEP9oS8OVFajjs/6zntU3bryeb0dvOcvHrhxko4r+DTtHmEa1qAMnLdaXsSShh1IvlViFYUYutC2MKDBy6D3HFr7VO7+8m21g+7zelNpqI1Od15at5gvG2Gg7nZGa8Fwg7C4Oud3duts5NHXTt30KLMTW5fuWi1VI8jQLbI8UaAfL3b8YftSxartcFxlmw3+SiPKkFinrEd5MdRt2PMuQ02Y6PU2xS0np06euZOpedZAXounsBLgjuWZORg+K+NLritpSRFUqvTBq/OjWDeXmuAbNiXiSwh/3Hyh++/Ry/en59ev0TnVGnKZxVVc8htKnwQCxMzkbwu0CZPmI2WnTocfpntF0cixqRIbFXclP9pVjWEoDkx1iIfrenzY44LsWH/Td5vy/BnMYV8ppiHyqSvI8Uwi1WdrjeRG5zTSrkRkJBI0YIyLJ14MmLTnCFi7/VwepU954rmx6w00o6U/2g2Qm1F7NXFXB/ydHkWp3zTWbduDZ9p2LL/eiOR/WSwF7zhBlppGXnYlClkysCAgcvGslrIGeb0y4aoap5uK+zK7D043d5TI+yeUhnMJU1U9ednM5y9LVyJL1e7qBPV/AtgpucES0ClhFwUlONgwl1LPF1jTYFrtTU8nuFjzvY9ftLJutKPUCbauObofGsEV4mltsWQ1lPdLFaPWOzIC5tdJOoUcpBYQ55FCyrbsD+M8Pm5HrFxnl1LsaB5UzzMfw+XJfOa6mBj+OI/5lrr6rRhBWc9SZofaZbNkL7Wn16NTDPYPNRGTi6o857P+4r7SAm4RumM2RT8sZonPFidqfWjVib0LDBRp6NajRUrpLSQTuIbagVobEf71n7rxHzr2/DsC5rnDI4n5a7seLvKucDytuTeXnKubo9xnOle+9FaFYb4qvbOvkIlw2bJzP0sJAJO5Kocs/LbUMgjvCd3iKCTzdvyF6E0usJkTvnIky7HiSTHN31ef+Q20r+UYMSH0Y9ckTN1gt7nuESf7D+cfpQL7vJO/zq8PNEcL8BoTgywRJ8rkCtkaxCqUnAFtUYVTk41883sb44jL30NPGIoS1pXgeRu+q4u3zjOekpHgLreQDe+OOquSG2Xp7QGs/4er0tLd4oYmbehv3ipQrLiPPiOVa+am8d5nl0ZqZEcO08x8y/M9AuB0ZLyXCwVUiUQOqXEfPIqlCfo42SHB8RMz+Fdx9ygF7YiLHCyvoas6/Jli1uo4vYefw8zTFboo+oWvm08sEU/kTZ6dK0Z4QgP9pHbvv3UslBsrprdZOZGHHC8qQMQyP7vZJradJ4h+7rTTq9Qj1Xndep1YMZ2hsGN5n+zx2SPE9c7NlUf4etN77Wsu7BTH68COpzNcQx2jcOguzbrgEy3DIMVChek2J78bNMGYrYEHM1ws1POYUq5t9Vb4WSr+hW4HCk6aNHtlSiWCNvaANNT/2ILxsZmm3ruvpbSSG3KxoatNSbz4sgl8NejWoajweuovRxJmrxMKI/XQSzq2TBTtkmFaS/PgJBqp+3YZXFltNfp/YGunQPUae++LahLLOs9Zf78aj2V5ZwOSqkjczrMW9YFv+80PR29Z4krayHkKt2C/0mVmP/r1ooxNZBuFfVaPQ9dTYYtf3ptqW+Z25OpRINZ1fXWN89qdBdkwLUU5T6iIxfVZGBc2GmP+zHNaxu2pCNYjC6747jn8EwUJear5jzaY2fb6bv3ygKkuYYyyqcirBRgdZ86R2iL/Oi9ImtkS0hbFX36OVWMwM8VYyv07xVmdEohR+c279kZB4NQljDJiBD39Imc7r/BBLnx1+9nzMa0+ejVZtfu8LLSVuXes4Xp9rN+0wzhu+x4c7SzyZ+gu1Xppr62HBjmuBUcXzwJ0yxqMdkebIPBGSLktypUtrYP5himuka57KJzlsVSyNrab13MN+9HlrxVKyfydqp5UabtQ7SBFWbkrZb7GqYUIpEm0gVlxjHrgUqsw6ZJwjOsYnr7W4SlT6ePTLmSLOIyt6hGXJXmMZpVMpY1pEVTgczwLN6bck06+vXUJR01/LFL2u/6BIIFHjRwq1rFf5wY+tF2c6PozSX0QmVia1RuiGPkEnZk7p0d1qpXr/1/n3kIr/1/+LimkNkfM5Dh6Dw/nSf0nrvJtJ3n1uLaarU2mE7uG6KZJxXlU5ByxO86nPdR5tVW/LeyPmiePQLIui7xtLUMgSNl3doi6ZEKDHG07Xfh/PZm293ZCGLZ/tO/wTBAa7zhJy3nII9jjzA6u494enFmWz++RGd2/DA0kPpIxVJG+HwG0jf/hE4U5obivJDUddxiZGvBzaDfqlal6I0rTb/sa5V8fGmU8GqjW/olbK2h94lkyuW/XSAOM6GpW8ByjtVIByhFjl1WqLWUbvDx5oJmqZN1gBoEuPT2WF04vc6/CQekKDo7RkZFt75R0/XwbrTRspEmVKkqutJpKdtgqXTWusN8KBYhSJnUBjpYlLb0vDCDo1vrnN4knY4SIdFUBvde5Be3NrRz82XUkp77gXy89NyAcVyEKsWyRcobve9S9YbsIJg8M1sPV9HLNKpUhOk9+Bd1ouIG36zblbQvJCtbf0TK+uuERJe3p/92dY2uzT2FfuUj3VfWaBNlUu+D9m4pwmitGCJzIPdqLyPybkI4bQ2yUNO5pl5nUyLMhoH6FoRrKbhBywVJB0Uhn0DJdTiaqiCjjwaLWWNdHa3DZxvlAjOau40YANEXhEerar1JEFqO3cNK9cV2pJ1fB5BGpj3XulQZtT1ok5C2S5mCIQQ/g9NEZ7zOfBGS6tWWE0VEUSStE7cjbofDG4TCKfhLKoH1X5qxTSxLhnmm1FM1vDUjOxn+m59tnaMVROtSjbNS0GOEVYcAOwTIIrCgwq8By1Yyx5wPCmekLjflR7VARny2Ryrb3Fwsvufhb+9PP/h773Vv+OZC0UL2bf/Ra7ZRdZ8tBKtSMeC07uPMfZ+bpjN23c634lQr9MKBUC9ttQ6b2Ft31O2RRxZ0cDasSiTN3nusHznVPlzgpJt0sABpIwWmFUNEcAKlNg/lW7eGI+UVlsuU0tcx3jzY6xbaBmgppEbC8PeXP5+GQnCDbI+974ScHT/Asp9g0DGxTrArdhIsFPOXi1+vL6/RFX4oKM+btt7hZTVzO3oYZqeJ4si0/DQGs9s0rUZ9CqcsRg/PdlmO2fR4CZtPnYRfTzm52tExlnmpfHnuq/R6FBsRsuMtyhPXCqhnXPy3zxtuEnN4PtQkY59uay8xT+gnim707artK75x6hYuufcVUlUgRB0r9CelpeCzf50wTO4ZVRryP732f3vVfEr5FEj4oymVsMQsqMjgCWv9BmGeIyXQyLaUMKNKy5V52R9TWJRYz32x/gYD6mMYgLRGqWPBdInQLl+LCNmqQt7okw1y4LoVk9Ko26Kci/YjIbzDOzjaYffDjV9TfpjtdHLMmw8reIcmoLvWhBymuGI6s0O8Q1PMeinNo6DM/65EXjGwAqTEUrkOmWauDzOkVoqJ2cnWE9x6MUCgyv7mpduCz32hQ3Vs7KHkaAJ+Qx9tHfbcyIEXq9Vq9V1RfJfnL9eZqK4ssSBWZuTbkGlaQKB99sF8uaMFoBfz+buieKfU3vAce0Pv3IMRXokc2s2V1s2PdwQ10HsOhnTbtSo/BhMTswSAPjpl681bROZYYqJBKtd1+cX3b8z/vXm5C7CAl/vwDeYrArr9BCezE1RfV+5vuwAjoigFHwacHozurCZcF6egEy/JmJjNjCSziH+uEcuK7bTEqpqkYOZtNXEFa2qGbsMyn2TuYRUbyS+ApZ4A1n2PxQiQUlJrMY5/FBdgLdEMFsDsWZR4OqVkG6Cgt+fwg8g0Layp3JJv4UH/+Pv/RKeMiaV5Lkt0DpzuIFcrGa5DNWq63OVSqiSeUNtku4XvhQIieK62SorpMjPHYFyMjRVc2gqsOWY3Rp+4PHdZndb+5ZsjeTvDjmtsA9VT3ElDwpsQDDWxCBD+Yog6o6cWnlFNVdMJmJ2x9VDSQWWhg2Fdcu26zp7WtntGycqs5X5LSEuVORoJ9tvl9e3BAD24FNL+2kGzAr8G5x9JO4LDZTmlTINMx8PTdbE89LMdq2bpfvxsFd/LOti/IuCxN0Ib6i5Sp83DFOLvEDyy71uJgOeGqnuvALQdQGO1HHdAqYHMuWBiFl1huWsoN7kJ+0EcyX2JurhUGb1YsIWrEaGaqFQhkVpxMpeC0y+QP3IONc3Js+NuRlVGmKiiv9B6XD3rjDF29/FsrPN+nHvaELaPHcqJKGzJTyfrXtlnzyt0LaRGp9twikofC6io9EyMAf3zVp1fkoyOqTyBD7aC+7XucO09Y5fX66pcu79EJMkK3HfnHcy4Prar07M9wdlCdXKVBbrKR3iA542h3I/T1WfXnN1Rqc2VTrTIbdfuXittoD0pM3sz2JGjpRRaEDF0Lxyq33q6bUPa7ruyFIOkwoN1wv6ZcbEMU3R3dm09Jx/Prx+z1kkhttfyAJyUFGWS18vl2dV1Y6xy/3gEohTHw4Ig/ow8BpECrrPyflBK4DAzzJ3QHSOyL1dgR9uGSAIBuoD8eKjqEXfi1WSlB21T4sKyI+zKqsXRAO3KJVcg0Yix0JW0/111Z+gym1Y1VElCCtTuQFMIsyFcK8n2Bxr98m8hHLn+DwObmKuDS2IftEqSL4JDSu+QX30zTK3Svz/9sCOw2KA++MIBLVA73PapWdReyjafftvOJ48uFZ/6yLbCoTLL6aDrx+GcurZ3lS9MQQU/QddCOZeeC99494+//6eQs3/8/b9eoX/8/T8llGxV/+Mff/+vbcCJ4LzrdouE/MI523mjqlOFmJghqlxd4U7j4g3gEth3vWu5CfH1vcA5B7KLTWWRCNZZgwCtM/oKrDTIR6CjeXks78KBrqwW0hQW3RZW61KiJ3Ay+OOBU2ish/EDINbp8q1mQ1thFGqo9x3qjm6AFKBUpzr/2LFlWCmXqJTAc7DGMzLOmNJcMchS+eyvPV37DGv22DZIJcN6KmQ/z/ZwNJ5uU4PH7eaTrQuXyP5uOLI2tNejbIXjivk+F+bYWzJ+nNPp3bW9K0HvcNChzKoqPoYLH8iMPn7cjsEVdErig7u7DlEfE3pWlX1+tu+W6vhMbbZMzCi36cgpVtBSRx3qm05UiveFgeGC8zrUx2A8AKms/3FQ0zMWlnqEbtXQETx4kVItusJsiSUgRbBrvxNRHZpKUWSunwwOVLmKgP4WeA6y25Fkq8ASaTHdgBFDYOTno3CFy6YdLswthj7xEQzmu4F6Bwc/FAZ0x95SVMaPWLREd4ri+PnuOlBO9mAAP99d2xrBtt6kO1MO0xIrlIslZwLn25+/Bl3z8I+N8bwmbC4OA9ga8KYg36GPpcFnIzo91q0HnzJIsY1u6Zdee4851rajELa1tbrbZwO4FJL9Gut5B5zHZYTqzsBSiPif6/40CCslCLVm0yXV83UWxFZouiSiKDCPrmuareZJ+1yjOfDW8ZiKim/dbwnObITz6uqwp1hR3wPhQHyfKywx1/2unBHw2aNgVrTe0p1zsR53u6tNkiwdG7324AbY6YLIlU6I58a51h6FSAJW8W+DG0sVLecrn7BIhMzd9gJtczRtQ+ESF68LzCihYrt4C5cPjwC1S3ZsJ5W4CHRHigDgtsQFOt3JGGvUoPjP9R7Vrac9S7Nn/r0ZoL8px5bEJpAkiYO4dbkpHdIjKMQCpKQ5ZFrch/pLHhii5qmjLvURLEQ8Q/9GwyBfE+tL/DPccCkwxNgrzqin7kBHP1F3a9ot18vpJ/tI3moYrKy6nNkuVimsGV4dd/rvDvaMNp4Ut1Ybzy431lzrsm4qveHs7xezUsc+/XJ3d40GravHOGRTmJ4kf2lnG3zSzNWmCKbtveyhLmGiqAY0xYxtD0n1Wme6bV+/PXff+PBAwBKMbVF4T5VuglBtbVQzFqtyl0OwhElr7O0rLLhOZPis19dFy9phdpb2KURFI+d3Sqkhmi6oXqUA8htMmlQoP4yzJRRYk7nRbnmOCHYFUOZQf1fatvRbV7R7GNI8ANuHYSf3yBy/GZbwPVzR+uX0DarrA9dbjWoo0ARsHU2O2erL9odeAdaVnKBwwJWjvIM3zahE8cfvhHHsyIZEPNgqMF3r95R26Nvd7ND24KQw0llb2C5el1zpYB+9w49uy1133h1hEzNSmFMtM253MMu3lO0EJ7Srbm/D4tWSBDdCh+ymtUhlpN1Fjvv2+VkpYUofEggroySg6y71sTuFakiWpHlrdM+zPvEtXFHVNBVXHjS67VIfkxzUbmUs0zhszxvyNjp1Fy0qvq3HRXPuZvRKEVjwcYdwgnpPWJUu1Za46hAf3RGpnXZbd0Gl5xlhg/KUETCcVnqOzrqkN6EogMwxpyq6KmqBDKlvUPYc71Ic0rMw9REsrm8vB70UMnrlgDDxESRMEMxmWMMSRxfo70O0N+FIxJD3Idpbd0mK5/lZmPoIFsHyULuKCDh+HVIewcBhmQjDhyHlEQy0TBS4czkgPLYrrLTL6irfqQKJnFBtionvGkfk0Y11N4sFy9DfzUOJl1mOdb+5x+GOP7xEHboj418l8C9d7eBY8k1lU9Rm7BMeQ6Cx1JqOboH9Cn7eDqhuvNbiJiveWJqoVYF9ZHADUGk8aCd92NyHVEeGv12p92KW3V7cfLq4yT6cXl1E3wV2BORGQJ0RRjBNMLmvyqxIcB7+bEmjYpdjEWpDfDg3ulRHj6RcxH+M3Hapjoxt5GXskX9p0xw9hc4JtkEO7OdquwkRHtWjAg3vD55+j+rI2J8rkCs1bGMZAUCI9AgKeNAy+hXYJToy8vUv17cXt7cty1qk0YeEN91DWZqLCO2y/VxmQezxnRFkt5swT2A3vbk438FeOpGYk3kSTfDPlvROZqiqNDzOo+oCQ5pjL4acQUbKamTsKROD/pM7DG+oon/6p62bf6U0FPGHd3S38l2BfMKxo8cydWiOjctp9Ju2Q3NM5RQas6yAYtwavn/BC1uL5apLewTHVEJ0V1GH5tj8JeaqoFpDbhtXR38QtwZAvRFGBa8rVpMGT039kWDuJzRyRaMGSJf09nWKD6W9Ro9Fk0tRpkPTpb5ljeJDadZoJxxEMEbVhtilfcPjBmTH7sxU1S6HhEcQnAk+pbPN1eH3vL/CpEdwoBsohRw9JntCGFAdGb0pbxB3+CHZkfHvYNSEsufQHYob1Jbo4rpLdExdG/auPXjgDs2RcePXqcdbuewsxSqzBWxSTNwP0HKjOF78rwAAAP//MgoL8g==" } diff --git a/x-pack/filebeat/module/sophos/utm/_meta/fields.yml b/x-pack/filebeat/module/sophos/utm/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/sophos/utm/config/input.yml b/x-pack/filebeat/module/sophos/utm/config/input.yml new file mode 100644 index 00000000000..c2774be9846 --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Sophos" + product: "UTM" + type: "Firewall" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/sophos/utm/config/liblogparser.js + - ${path.home}/module/sophos/utm/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/sophos/utm/config/liblogparser.js b/x-pack/filebeat/module/sophos/utm/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{messageid}[%{process_id}]: %{payload}", processor_chain([ + setc("header_id","0001"), +])); + +var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' '), Field(messageid,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" +match("HEADER#1:0002", "message", "%{hfld1->} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ + setc("header_id","0002"), +])); + +var hdr3 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' reverseproxy: '), Field(payload,false)}" +match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ + setc("header_id","0003"), + setc("messageid","reverseproxy"), +])); + +var hdr4 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' '), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ + setc("header_id","0005"), +])); + +var hdr5 = // "Pattern{Field(hfld1,true), Constant(' '), Field(id,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" +match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ + setc("header_id","0004"), + setc("messageid","astarosg_TVM"), +])); + +var hdr6 = // "Pattern{Constant('device="'), Field(product,false), Constant('" date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' timezone="'), Field(timezone,false), Constant('" device_name="'), Field(device,false), Constant('" device_id='), Field(hardware_id,true), Constant(' log_id='), Field(id,true), Constant(' '), Field(payload,false)}" +match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ + setc("header_id","0006"), + setc("messageid","Sophos_Firewall"), +])); + +var select1 = linear_select([ + hdr1, + hdr2, + hdr3, + hdr4, + hdr5, + hdr6, +]); + +var part1 = // "Pattern{Constant('received control channel command ''), Field(action,false), Constant(''')}" +match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ + dup1, + dup2, + dup3, +])); + +var msg1 = msg("named:01", part1); + +var part2 = // "Pattern{Constant('flushing caches in all views '), Field(disposition,false)}" +match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ + dup1, + dup2, + dup3, +])); + +var msg2 = msg("named:02", part2); + +var part3 = // "Pattern{Constant('error ('), Field(result,false), Constant(') resolving ''), Field(dhost,false), Constant('': '), Field(daddr,false), Constant('#'), Field(dport,false)}" +match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ + dup4, + dup2, + dup3, +])); + +var msg3 = msg("named:03", part3); + +var part4 = // "Pattern{Constant('received '), Field(action,true), Constant(' signal to '), Field(fld3,false)}" +match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ + dup5, + dup2, + dup3, +])); + +var msg4 = msg("named:04", part4); + +var part5 = // "Pattern{Constant('loading configuration from ''), Field(filename,false), Constant(''')}" +match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ + dup6, + dup2, + dup3, +])); + +var msg5 = msg("named:05", part5); + +var part6 = // "Pattern{Constant('no '), Field(protocol,true), Constant(' interfaces found')}" +match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ + setc("eventcategory","1804000000"), + dup2, + dup3, +])); + +var msg6 = msg("named:06", part6); + +var part7 = // "Pattern{Constant('sizing zone task pool based on '), Field(fld3,true), Constant(' zones')}" +match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ + dup7, + dup2, + dup3, +])); + +var msg7 = msg("named:07", part7); + +var part8 = // "Pattern{Constant('automatic empty zone: view '), Field(fld3,false), Constant(': '), Field(dns_ptr_record,false)}" +match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ + dup8, + dup2, + dup3, +])); + +var msg8 = msg("named:08", part8); + +var part9 = // "Pattern{Constant('reloading '), Field(obj_type,true), Constant(' '), Field(disposition,false)}" +match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ + dup7, + dup2, + dup3, + setc("action","reloading"), +])); + +var msg9 = msg("named:09", part9); + +var part10 = // "Pattern{Constant('zone '), Field(dhost,false), Constant('/'), Field(fld3,false), Constant(': loaded serial '), Field(operation_id,false)}" +match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ + dup7, + dup9, + dup2, + dup3, +])); + +var msg10 = msg("named:10", part10); + +var part11 = // "Pattern{Constant('all zones loaded'), Field(,false)}" +match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ + dup7, + dup9, + dup2, + dup3, + setc("action","all zones loaded"), +])); + +var msg11 = msg("named:11", part11); + +var part12 = // "Pattern{Constant('running'), Field(,false)}" +match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ + dup7, + setc("disposition","running"), + dup2, + dup3, + setc("action","running"), +])); + +var msg12 = msg("named:12", part12); + +var part13 = // "Pattern{Constant('using built-in root key for view '), Field(fld3,false)}" +match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ + dup7, + setc("context","built-in root key"), + dup2, + dup3, +])); + +var msg13 = msg("named:13", part13); + +var part14 = // "Pattern{Constant('zone '), Field(dns_ptr_record,false), Constant('/'), Field(fld3,false), Constant(': ('), Field(username,false), Constant(') '), Field(action,false)}" +match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ + dup8, + dup2, + dup3, +])); + +var msg14 = msg("named:14", part14); + +var part15 = // "Pattern{Constant('too many timeouts resolving ''), Field(fld3,false), Constant('' ('), Field(fld4,false), Constant('): disabling EDNS')}" +match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ + dup10, + setc("event_description","named:too many timeouts resolving DNS."), + dup11, + dup2, +])); + +var msg15 = msg("named:15", part15); + +var part16 = // "Pattern{Constant('FORMERR resolving ''), Field(hostname,false), Constant('': '), Field(saddr,false), Constant('#'), Field(fld3,false)}" +match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ + dup10, + setc("event_description","named:FORMERR resolving DNS."), + dup11, + dup2, +])); + +var msg16 = msg("named:16", part16); + +var part17 = // "Pattern{Constant('unexpected RCODE (SERVFAIL) resolving ''), Field(hostname,false), Constant('': '), Field(saddr,false), Constant('#'), Field(fld3,false)}" +match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ + dup10, + setc("event_description","named:unexpected RCODE (SERVFAIL) resolving DNS."), + dup11, + dup2, +])); + +var msg17 = msg("named:17", part17); + +var select2 = linear_select([ + msg1, + msg2, + msg3, + msg4, + msg5, + msg6, + msg7, + msg8, + msg9, + msg10, + msg11, + msg12, + msg13, + msg14, + msg15, + msg16, + msg17, +]); + +var part18 = // "Pattern{Constant('Integrated HTTP-Proxy '), Field(version,false)}" +match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ + dup12, + setc("event_description","httpproxy:Integrated HTTP-Proxy."), + dup11, + dup2, +])); + +var msg18 = msg("httpproxy:09", part18); + +var part19 = // "Pattern{Constant('['), Field(fld2,false), Constant('] parse_address ('), Field(fld3,false), Constant(') getaddrinfo: passthrough.fw-notify.net: Name or service not known')}" +match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ + dup10, + setc("event_description","httpproxy:Name or service not known."), + dup11, + dup2, +])); + +var msg19 = msg("httpproxy:10", part19); + +var part20 = // "Pattern{Constant('['), Field(fld2,false), Constant('] confd_config_filter ('), Field(fld3,false), Constant(') failed to resolve passthrough.fw-notify.net, using '), Field(saddr,false)}" +match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ + dup10, + setc("event_description","httpproxy:failed to resolve passthrough."), + dup11, + dup2, +])); + +var msg20 = msg("httpproxy:11", part20); + +var part21 = // "Pattern{Constant('['), Field(fld2,false), Constant('] ssl_log_errors ('), Field(fld3,false), Constant(') '), Field(fld4,false), Constant('ssl handshake failure'), Field(fld5,false)}" +match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ + dup10, + setc("event_description","httpproxy:ssl handshake failure."), + dup11, + dup2, +])); + +var msg21 = msg("httpproxy:12", part21); + +var part22 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_decrypt ('), Field(fld3,false), Constant(') EVP_DecryptFinal failed')}" +match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ + dup10, + setc("event_description","httpproxy:EVP_DecryptFinal failed."), + dup11, + dup2, +])); + +var msg22 = msg("httpproxy:13", part22); + +var part23 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_server_cmd ('), Field(fld3,false), Constant(') decrypt failed')}" +match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ + dup10, + setc("event_description","httpproxy:decrypt failed."), + dup11, + dup2, +])); + +var msg23 = msg("httpproxy:14", part23); + +var part24 = // "Pattern{Constant('['), Field(fld2,false), Constant('] clamav_reload ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:reloading av pattern"), + dup11, + dup2, +])); + +var msg24 = msg("httpproxy:15", part24); + +var part25 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_check_servers ('), Field(fld3,false), Constant(') server ''), Field(hostname,false), Constant('' access time: '), Field(fld4,false)}" +match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ + dup12, + setc("event_description","httpproxy:sc_check_servers.Server checked."), + dup11, + dup2, +])); + +var msg25 = msg("httpproxy:16", part25); + +var part26 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') shutdown finished, exiting')}" +match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ + dup12, + setc("event_description","httpproxy:shutdown finished, exiting."), + dup11, + dup2, +])); + +var msg26 = msg("httpproxy:17", part26); + +var part27 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') reading configuration')}" +match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ + dup12, + setc("event_description","httpproxy:"), + dup11, + dup2, +])); + +var msg27 = msg("httpproxy:18", part27); + +var part28 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') reading profiles')}" +match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ + dup12, + setc("event_description","httpproxy:reading profiles"), + dup11, + dup2, +])); + +var msg28 = msg("httpproxy:19", part28); + +var part29 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') finished startup')}" +match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ + dup12, + setc("event_description","httpproxy:finished startup"), + dup11, + dup2, +])); + +var msg29 = msg("httpproxy:20", part29); + +var part30 = // "Pattern{Constant('['), Field(fld2,false), Constant('] read_request_headers ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:read_request_headers related message."), + dup11, + dup2, +])); + +var msg30 = msg("httpproxy:21", part30); + +var part31 = // "Pattern{Constant('['), Field(fld2,false), Constant('] epoll_loop ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:epoll_loop related message."), + dup11, + dup2, +])); + +var msg31 = msg("httpproxy:22", part31); + +var part32 = // "Pattern{Constant('['), Field(fld2,false), Constant('] scan_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:scan_exit related message."), + dup11, + dup2, +])); + +var msg32 = msg("httpproxy:23", part32); + +var part33 = // "Pattern{Constant('['), Field(fld2,false), Constant('] epoll_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:epoll_exit related message."), + dup11, + dup2, +])); + +var msg33 = msg("httpproxy:24", part33); + +var part34 = // "Pattern{Constant('['), Field(fld2,false), Constant('] disk_cache_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:disk_cache_exit related message."), + dup11, + dup2, +])); + +var msg34 = msg("httpproxy:25", part34); + +var part35 = // "Pattern{Constant('['), Field(fld2,false), Constant('] disk_cache_zap ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:disk_cache_zap related message."), + dup11, + dup2, +])); + +var msg35 = msg("httpproxy:26", part35); + +var part36 = // "Pattern{Constant('['), Field(fld2,false), Constant('] scanner_init ('), Field(fld3,false), Constant(') '), Field(info,false)}" +match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ + dup12, + setc("event_description","httpproxy:scanner_init related message."), + dup11, + dup2, +])); + +var msg36 = msg("httpproxy:27", part36); + +var part37 = tagval("MESSAGE#36:httpproxy:01", "nwparser.payload", tvm, { + "action": "action", + "ad_domain": "fld1", + "app-id": "fld18", + "application": "fld17", + "auth": "fld10", + "authtime": "fld4", + "avscantime": "fld7", + "cached": "fld2", + "category": "policy_id", + "categoryname": "info", + "cattime": "fld6", + "content-type": "content_type", + "device": "fld9", + "dnstime": "fld5", + "dstip": "daddr", + "error": "result", + "exceptions": "fld12", + "extension": "fld13", + "file": "filename", + "filename": "filename", + "filteraction": "fld3", + "fullreqtime": "fld8", + "function": "action", + "group": "group", + "id": "rule", + "line": "fld14", + "message": "context", + "method": "web_method", + "name": "event_description", + "profile": "policyname", + "reason": "rule_group", + "referer": "web_referer", + "reputation": "fld16", + "request": "connectionid", + "severity": "severity", + "size": "rbytes", + "srcip": "saddr", + "statuscode": "resultcode", + "sub": "network_service", + "sys": "vsys", + "time": "fld15", + "ua": "fld11", + "url": "url", + "user": "username", +}, processor_chain([ + dup13, + dup11, + dup2, + dup45, + dup46, +])); + +var msg37 = msg("httpproxy:01", part37); + +var select3 = linear_select([ + msg18, + msg19, + msg20, + msg21, + msg22, + msg23, + msg24, + msg25, + msg26, + msg27, + msg28, + msg29, + msg30, + msg31, + msg32, + msg33, + msg34, + msg35, + msg36, + msg37, +]); + +var part38 = // "Pattern{Constant('T='), Field(fld3,true), Constant(' ------ 1 - [exit] '), Field(action,false), Constant(': '), Field(disposition,false)}" +match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ + dup16, + dup2, + dup3, +])); + +var msg38 = msg("URID:01", part38); + +var part39 = tagval("MESSAGE#38:ulogd:01", "nwparser.payload", tvm, { + "action": "action", + "code": "fld30", + "dstip": "daddr", + "dstmac": "dmacaddr", + "dstport": "dport", + "fwrule": "policy_id", + "id": "rule", + "info": "context", + "initf": "sinterface", + "length": "fld25", + "name": "event_description", + "outitf": "dinterface", + "prec": "fld27", + "proto": "fld24", + "seq": "fld23", + "severity": "severity", + "srcip": "saddr", + "srcmac": "smacaddr", + "srcport": "sport", + "sub": "network_service", + "sys": "vsys", + "tcpflags": "fld29", + "tos": "fld26", + "ttl": "fld28", + "type": "fld31", +}, processor_chain([ + dup13, + setc("ec_subject","NetworkComm"), + setc("ec_activity","Scan"), + setc("ec_theme","TEV"), + dup11, + dup2, + dup45, + dup46, +])); + +var msg39 = msg("ulogd:01", part39); + +var part40 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity for Apache/'), Field(fld5,true), Constant(' ('), Field(fld6,false), Constant(') configured.')}" +match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ + dup6, + setc("disposition","configured"), + dup2, + dup3, +])); + +var msg40 = msg("reverseproxy:01", part40); + +var part41 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity: '), Field(fld5,true), Constant(' compiled version="'), Field(fld6,false), Constant('"; loaded version="'), Field(fld7,false), Constant('"')}" +match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ + dup17, + dup2, + dup3, +])); + +var msg41 = msg("reverseproxy:02", part41); + +var part42 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity: '), Field(fld5,true), Constant(' compiled version="'), Field(fld6,false), Constant('"')}" +match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ + dup17, + dup2, + dup3, +])); + +var msg42 = msg("reverseproxy:03", part42); + +var part43 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] '), Field(fld5,true), Constant(' configured -- '), Field(disposition,true), Constant(' normal operations')}" +match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ + dup17, + setc("event_id","AH00292"), + dup2, + dup3, +])); + +var msg43 = msg("reverseproxy:04", part43); + +var part44 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ['), Field(fld5,false), Constant('] Hostname in '), Field(network_service,true), Constant(' request ('), Field(fld6,false), Constant(') does not match the server name ('), Field(ddomain,false), Constant(')')}" +match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ + setc("eventcategory","1805010000"), + dup18, + dup2, + dup3, +])); + +var msg44 = msg("reverseproxy:06", part44); + +var part45 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00297: '), Field(action,true), Constant(' received. Doing'), Field(p0,false)}" +match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); + +var select4 = linear_select([ + dup19, +]); + +var part46 = // "Pattern{Field(,false), Constant('graceful '), Field(disposition,false)}" +match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); + +var all1 = all_match({ + processors: [ + part45, + select4, + part46, + ], + on_success: processor_chain([ + dup5, + setc("event_id","AH00297"), + dup2, + dup3, + ]), +}); + +var msg45 = msg("reverseproxy:07", all1); + +var part47 = // "Pattern{Constant('AH00112: Warning: DocumentRoot ['), Field(web_root,false), Constant('] does not exist')}" +match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ + dup4, + setc("event_id","AH00112"), + dup2, + dup3, +])); + +var msg46 = msg("reverseproxy:08", part47); + +var part48 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00094: Command line: ''), Field(web_root,false), Constant(''')}" +match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ + setc("eventcategory","1605010000"), + setc("event_id","AH00094"), + dup2, + dup3, +])); + +var msg47 = msg("reverseproxy:09", part48); + +var part49 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00291: long lost child came home! (pid '), Field(fld5,false), Constant(')')}" +match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ + dup12, + setc("event_id","AH00291"), + dup2, + dup3, +])); + +var msg48 = msg("reverseproxy:10", part49); + +var part50 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH02572: Failed to configure at least one certificate and key for '), Field(fld5,false), Constant(':'), Field(fld6,false)}" +match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ + dup20, + setc("event_id","AH02572"), + dup2, + dup3, +])); + +var msg49 = msg("reverseproxy:11", part50); + +var part51 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] SSL Library Error: error:'), Field(resultcode,false), Constant(':'), Field(result,false)}" +match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ + dup20, + setc("context","SSL Library Error"), + dup2, + dup3, +])); + +var msg50 = msg("reverseproxy:12", part51); + +var part52 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH02312: Fatal error initialising mod_ssl, '), Field(disposition,false), Constant('.')}" +match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ + dup20, + setc("result","Fatal error"), + setc("event_id","AH02312"), + dup2, + dup3, +])); + +var msg51 = msg("reverseproxy:13", part52); + +var part53 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00020: Configuration Failed, '), Field(disposition,false)}" +match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ + dup20, + setc("result","Configuration Failed"), + setc("event_id","AH00020"), + dup2, + dup3, +])); + +var msg52 = msg("reverseproxy:14", part53); + +var part54 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00098: pid file '), Field(filename,true), Constant(' overwritten -- Unclean shutdown of previous Apache run?')}" +match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ + setc("eventcategory","1609000000"), + setc("context","Unclean shutdown"), + setc("event_id","AH00098"), + dup2, + dup3, +])); + +var msg53 = msg("reverseproxy:15", part54); + +var part55 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00295: caught '), Field(action,false), Constant(', '), Field(disposition,false)}" +match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ + dup16, + setc("event_id","AH00295"), + dup2, + dup3, +])); + +var msg54 = msg("reverseproxy:16", part55); + +var part56 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(result,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"]'), Field(p0,false)}" +match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); + +var part57 = // "Pattern{Constant(' [rev "'), Field(fld6,false), Constant('"]'), Field(p0,false)}" +match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); + +var select5 = linear_select([ + part57, + dup19, +]); + +var part58 = // "Pattern{Field(,false), Constant('[msg "'), Field(comments,false), Constant('"] [data "'), Field(daddr,false), Constant('"] [severity "'), Field(severity,false), Constant('"] [ver "'), Field(policyname,false), Constant('"] [maturity "'), Field(fld7,false), Constant('"] [accuracy "'), Field(fld8,false), Constant('"] '), Field(context,true), Constant(' [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); + +var all2 = all_match({ + processors: [ + part56, + select5, + part58, + ], + on_success: processor_chain([ + dup21, + dup2, + dup3, + ]), +}); + +var msg55 = msg("reverseproxy:17", all2); + +var part59 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] No signature found, cookie: '), Field(fld5,false)}" +match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ + dup4, + dup22, + dup2, + dup3, +])); + +var msg56 = msg("reverseproxy:18", part59); + +var part60 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] '), Field(disposition,true), Constant(' ''), Field(fld5,false), Constant('' from request due to missing/invalid signature')}" +match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ + dup23, + dup22, + dup2, + dup3, +])); + +var msg57 = msg("reverseproxy:19", part60); + +var part61 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"] [msg "'), Field(comments,false), Constant('"] [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ + dup21, + dup2, + dup3, +])); + +var msg58 = msg("reverseproxy:20", part61); + +var part62 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH01909: '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(':'), Field(fld5,true), Constant(' server certificate does NOT include an ID which matches the server name')}" +match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ + dup20, + dup18, + setc("event_id","AH01909"), + dup2, + dup3, +])); + +var msg59 = msg("reverseproxy:21", part62); + +var part63 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH01915: Init: ('), Field(daddr,false), Constant(':'), Field(dport,false), Constant(') You configured '), Field(network_service,false), Constant('('), Field(fld5,false), Constant(') on the '), Field(fld6,false), Constant('('), Field(fld7,false), Constant(') port!')}" +match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ + dup20, + setc("comments","Invalid port configuration"), + dup2, + dup3, +])); + +var msg60 = msg("reverseproxy:22", part63); + +var part64 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Rule '), Field(rulename,true), Constant(' [id "'), Field(rule,false), Constant('"][file "'), Field(filename,false), Constant('"][line "'), Field(fld5,false), Constant('"] - Execution error - PCRE limits exceeded ('), Field(fld6,false), Constant('): ('), Field(fld7,false), Constant('). [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ + dup21, + dup2, + dup3, +])); + +var msg61 = msg("reverseproxy:23", part64); + +var part65 = // "Pattern{Constant('rManage\\x22,\\x22manageLiveSystemSettings\\x22,\\x22accessViewJobs\\x22,\\x22exportList\\..."] [ver "'), Field(policyname,false), Constant('"] [maturity "'), Field(fld3,false), Constant('"] [accuracy "'), Field(fld4,false), Constant('"] '), Field(context,true), Constant(' [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ + dup21, + dup2, + dup3, +])); + +var msg62 = msg("reverseproxy:24", part65); + +var part66 = // "Pattern{Constant('ARGS:userPermissions: [\\x22dashletAccessAlertingRecentAlertsPanel\\x22,\\x22dashletAccessAlerterTopAlertsDashlet\\x22,\\x22accessViewRules\\x22,\\x22deployLiveResources\\x22,\\x22vi..."] [severity [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ + dup21, + dup2, + dup3, +])); + +var msg63 = msg("reverseproxy:25", part66); + +var part67 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: '), Field(disposition,true), Constant(' with code '), Field(resultcode,true), Constant(' ('), Field(fld5,false), Constant('). '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld6,false), Constant('"] [id "'), Field(rule,false), Constant('"]'), Field(p0,false)}" +match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); + +var part68 = // "Pattern{Constant(' [rev "'), Field(fld7,false), Constant('"]'), Field(p0,false)}" +match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); + +var select6 = linear_select([ + part68, + dup19, +]); + +var part69 = // "Pattern{Field(,false), Constant('[msg "'), Field(comments,false), Constant('"] [data "Last Matched Data: '), Field(p0,false)}" +match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); + +var part70 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false), Constant('"] [hostname "'), Field(p0,false)}" +match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); + +var part71 = // "Pattern{Field(daddr,false), Constant('"] [hostname "'), Field(p0,false)}" +match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); + +var select7 = linear_select([ + part70, + part71, +]); + +var part72 = // "Pattern{Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" +match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); + +var all3 = all_match({ + processors: [ + part67, + select6, + part69, + select7, + part72, + ], + on_success: processor_chain([ + dup24, + dup2, + dup3, + ]), +}); + +var msg64 = msg("reverseproxy:26", all3); + +var part73 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] '), Field(disposition,true), Constant(' while reading reply from cssd, referer: '), Field(web_referer,false)}" +match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ + dup25, + dup2, + dup3, +])); + +var msg65 = msg("reverseproxy:27", part73); + +var part74 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon error found in request '), Field(web_root,false), Constant(', referer: '), Field(web_referer,false)}" +match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ + dup26, + setc("result","virus daemon error"), + dup2, + dup3, +])); + +var msg66 = msg("reverseproxy:28", part74); + +var part75 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] mod_avscan_input_filter: virus found, referer: '), Field(web_referer,false)}" +match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ + dup27, + setc("result","virus found"), + dup2, + dup3, +])); + +var msg67 = msg("reverseproxy:29", part75); + +var part76 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (13)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] AH01095: prefetch request body failed to '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld5,false), Constant(') from '), Field(fld6,true), Constant(' (), referer: '), Field(web_referer,false)}" +match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ + dup24, + dup28, + dup2, + dup3, +])); + +var msg68 = msg("reverseproxy:30", part76); + +var part77 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot read reply: Operation now in progress (115), referer: '), Field(web_referer,false)}" +match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ + dup25, + setc("result","Cannot read reply"), + dup2, + dup3, +])); + +var msg69 = msg("reverseproxy:31", part77); + +var part78 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot connect: '), Field(result,true), Constant(' (111), referer: '), Field(web_referer,false)}" +match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ + dup25, + dup2, + dup3, +])); + +var msg70 = msg("reverseproxy:32", part78); + +var part79 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot connect: '), Field(result,true), Constant(' (111)')}" +match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ + dup25, + dup2, + dup3, +])); + +var msg71 = msg("reverseproxy:33", part79); + +var part80 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon connection problem found in request '), Field(url,false), Constant(', referer: '), Field(web_referer,false)}" +match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ + dup26, + dup29, + dup2, + dup3, +])); + +var msg72 = msg("reverseproxy:34", part80); + +var part81 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon connection problem found in request '), Field(url,false)}" +match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ + dup26, + dup29, + dup2, + dup3, +])); + +var msg73 = msg("reverseproxy:35", part81); + +var part82 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] mod_avscan_input_filter: virus found')}" +match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ + dup27, + setc("result","Virus found"), + dup2, + dup3, +])); + +var msg74 = msg("reverseproxy:36", part82); + +var part83 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (13)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] AH01095: prefetch request body failed to '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld5,false), Constant(') from '), Field(fld6,true), Constant(' ()')}" +match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ + dup24, + dup28, + dup2, + dup3, +])); + +var msg75 = msg("reverseproxy:37", part83); + +var part84 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] Invalid signature, cookie: JSESSIONID')}" +match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ + dup25, + dup2, + dup3, +])); + +var msg76 = msg("reverseproxy:38", part84); + +var part85 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] Form validation failed: Received unhardened form data, referer: '), Field(web_referer,false)}" +match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ + dup23, + setc("result","Form validation failed"), + dup2, + dup3, +])); + +var msg77 = msg("reverseproxy:39", part85); + +var part86 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] sending trickle failed: 103')}" +match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ + dup25, + setc("result","Sending trickle failed"), + dup2, + dup3, +])); + +var msg78 = msg("reverseproxy:40", part86); + +var part87 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] client requesting '), Field(web_root,true), Constant(' has '), Field(disposition,false)}" +match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ + dup30, + dup2, + dup3, +])); + +var msg79 = msg("reverseproxy:41", part87); + +var part88 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] mod_avscan_check_file_single_part() called with parameter filename='), Field(filename,false)}" +match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ + setc("eventcategory","1603050000"), + dup2, + dup3, +])); + +var msg80 = msg("reverseproxy:42", part88); + +var part89 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (70007)The '), Field(disposition,true), Constant(' specified has expired: [client '), Field(gateway,false), Constant('] AH01110: error reading response')}" +match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ + dup30, + setc("event_id","AH01110"), + setc("result","Error reading response"), + dup2, + dup3, +])); + +var msg81 = msg("reverseproxy:43", part89); + +var part90 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (22)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] No form context found when parsing '), Field(fld5,true), Constant(' tag, referer: '), Field(web_referer,false)}" +match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ + setc("eventcategory","1601020000"), + setc("result","No form context found"), + dup2, + dup3, +])); + +var msg82 = msg("reverseproxy:44", part90); + +var part91 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (111)'), Field(result,false), Constant(': AH00957: '), Field(network_service,false), Constant(': attempt to connect to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld5,false), Constant(') failed')}" +match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ + dup25, + setc("event_id","AH00957"), + dup2, + dup3, +])); + +var msg83 = msg("reverseproxy:45", part91); + +var part92 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00959: ap_proxy_connect_backend disabling worker for ('), Field(daddr,false), Constant(') for '), Field(processing_time,false), Constant('s')}" +match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ + dup16, + setc("event_id","AH00959"), + setc("result","disabling worker"), + dup2, + dup3, +])); + +var msg84 = msg("reverseproxy:46", part92); + +var part93 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] not all the file sent to the client: '), Field(fld6,false), Constant(', referer: '), Field(web_referer,false)}" +match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ + setc("eventcategory","1801000000"), + setc("context","Not all file sent to client"), + dup2, + dup3, +])); + +var msg85 = msg("reverseproxy:47", part93); + +var part94 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] AH01114: '), Field(network_service,false), Constant(': failed to make connection to backend: '), Field(daddr,false), Constant(', referer: '), Field(web_referer,false)}" +match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ + dup25, + dup31, + dup32, + dup2, + dup3, +])); + +var msg86 = msg("reverseproxy:48", part94); + +var part95 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] AH01114: '), Field(network_service,false), Constant(': failed to make connection to backend: '), Field(daddr,false)}" +match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ + dup25, + dup31, + dup32, + dup2, + dup3, +])); + +var msg87 = msg("reverseproxy:49", part95); + +var part96 = tagval("MESSAGE#87:reverseproxy:05", "nwparser.payload", tvm, { + "cookie": "web_cookie", + "exceptions": "policy_waiver", + "extra": "info", + "host": "dhost", + "id": "policy_id", + "localip": "fld3", + "method": "web_method", + "reason": "comments", + "referer": "web_referer", + "server": "daddr", + "set-cookie": "fld5", + "size": "fld4", + "srcip": "saddr", + "statuscode": "resultcode", + "time": "processing_time", + "url": "web_root", + "user": "username", +}, processor_chain([ + setc("eventcategory","1802000000"), + dup2, + dup3, +])); + +var msg88 = msg("reverseproxy:05", part96); + +var select8 = linear_select([ + msg40, + msg41, + msg42, + msg43, + msg44, + msg45, + msg46, + msg47, + msg48, + msg49, + msg50, + msg51, + msg52, + msg53, + msg54, + msg55, + msg56, + msg57, + msg58, + msg59, + msg60, + msg61, + msg62, + msg63, + msg64, + msg65, + msg66, + msg67, + msg68, + msg69, + msg70, + msg71, + msg72, + msg73, + msg74, + msg75, + msg76, + msg77, + msg78, + msg79, + msg80, + msg81, + msg82, + msg83, + msg84, + msg85, + msg86, + msg87, + msg88, +]); + +var part97 = tagval("MESSAGE#88:confd-sync", "nwparser.payload", tvm, { + "id": "fld5", + "name": "event_description", + "severity": "severity", + "sub": "service", + "sys": "fld2", +}, processor_chain([ + dup1, + dup11, + dup2, +])); + +var msg89 = msg("confd-sync", part97); + +var part98 = tagval("MESSAGE#89:confd:01", "nwparser.payload", tvm, { + "account": "logon_id", + "attributes": "obj_name", + "class": "group_object", + "client": "fld3", + "count": "fld4", + "facility": "logon_type", + "id": "fld1", + "name": "event_description", + "node": "node", + "object": "fld6", + "severity": "severity", + "srcip": "saddr", + "storage": "directory", + "sub": "service", + "sys": "fld2", + "type": "obj_type", + "user": "username", + "version": "version", +}, processor_chain([ + dup1, + dup11, + dup2, +])); + +var msg90 = msg("confd:01", part98); + +var part99 = // "Pattern{Constant('Frox started'), Field(,false)}" +match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ + dup12, + setc("event_description","frox:FTP Proxy Frox started."), + dup11, + dup2, +])); + +var msg91 = msg("frox", part99); + +var part100 = // "Pattern{Constant('Listening on '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ + dup12, + setc("event_description","frox:FTP Proxy listening on port."), + dup11, + dup2, +])); + +var msg92 = msg("frox:01", part100); + +var part101 = // "Pattern{Constant('Dropped privileges'), Field(,false)}" +match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ + dup12, + setc("event_description","frox:FTP Proxy dropped priveleges."), + dup11, + dup2, +])); + +var msg93 = msg("frox:02", part101); + +var select9 = linear_select([ + msg91, + msg92, + msg93, +]); + +var part102 = // "Pattern{Constant('Classifier configuration reloaded successfully'), Field(,false)}" +match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ + dup12, + setc("event_description","afcd: IM/P2P Classifier configuration reloaded successfully."), + dup11, + dup2, +])); + +var msg94 = msg("afcd", part102); + +var part103 = // "Pattern{Constant('Starting strongSwan '), Field(fld2,true), Constant(' IPsec [starter]...')}" +match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ + dup12, + setc("event_description","ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]..."), + dup11, + dup2, +])); + +var msg95 = msg("ipsec_starter", part103); + +var part104 = // "Pattern{Constant('IP address or index of physical interface changed -> reinit of ipsec interface'), Field(,false)}" +match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ + dup12, + setc("event_description","ipsec_starter: IP address or index of physical interface changed."), + dup11, + dup2, +])); + +var msg96 = msg("ipsec_starter:01", part104); + +var select10 = linear_select([ + msg95, + msg96, +]); + +var part105 = // "Pattern{Constant('Starting Pluto ('), Field(info,false), Constant(')')}" +match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ + dup12, + setc("event_description","pluto: Starting Pluto."), + dup11, + dup2, +])); + +var msg97 = msg("pluto", part105); + +var part106 = // "Pattern{Constant('including NAT-Traversal patch ('), Field(info,false), Constant(')')}" +match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ + dup12, + setc("event_description","pluto: including NAT-Traversal patch."), + dup11, + dup2, +])); + +var msg98 = msg("pluto:01", part106); + +var part107 = // "Pattern{Constant('ike_alg: Activating '), Field(info,true), Constant(' encryption: Ok')}" +match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ + dup33, + setc("event_description","pluto: Activating encryption algorithm."), + dup11, + dup2, +])); + +var msg99 = msg("pluto:02", part107); + +var part108 = // "Pattern{Constant('ike_alg: Activating '), Field(info,true), Constant(' hash: Ok')}" +match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ + dup33, + setc("event_description","pluto: Activating hash algorithm."), + dup11, + dup2, +])); + +var msg100 = msg("pluto:03", part108); + +var part109 = // "Pattern{Constant('Testing registered IKE encryption algorithms:'), Field(,false)}" +match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ + dup12, + setc("event_description","pluto: Testing registered IKE encryption algorithms"), + dup11, + dup2, +])); + +var msg101 = msg("pluto:04", part109); + +var part110 = // "Pattern{Field(info,true), Constant(' self-test not available')}" +match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ + dup12, + setc("event_description","pluto: Algorithm self-test not available."), + dup11, + dup2, +])); + +var msg102 = msg("pluto:05", part110); + +var part111 = // "Pattern{Field(info,true), Constant(' self-test passed')}" +match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ + dup12, + setc("event_description","pluto: Algorithm self-test passed."), + dup11, + dup2, +])); + +var msg103 = msg("pluto:06", part111); + +var part112 = // "Pattern{Constant('Using KLIPS IPsec interface code'), Field(,false)}" +match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ + dup12, + setc("event_description","pluto: Using KLIPS IPsec interface code"), + dup11, + dup2, +])); + +var msg104 = msg("pluto:07", part112); + +var part113 = // "Pattern{Constant('adding interface '), Field(interface,true), Constant(' '), Field(saddr,false), Constant(':'), Field(sport,false)}" +match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ + dup12, + setc("event_description","pluto: adding interface"), + dup11, + dup2, +])); + +var msg105 = msg("pluto:08", part113); + +var part114 = // "Pattern{Constant('loading secrets from "'), Field(filename,false), Constant('"')}" +match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ + dup34, + setc("event_description","pluto: loading secrets"), + dup11, + dup2, +])); + +var msg106 = msg("pluto:09", part114); + +var part115 = // "Pattern{Constant('loaded private key file ''), Field(filename,false), Constant('' ('), Field(filename_size,true), Constant(' bytes)')}" +match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ + dup34, + setc("event_description","pluto: loaded private key file"), + dup11, + dup2, +])); + +var msg107 = msg("pluto:10", part115); + +var part116 = // "Pattern{Constant('added connection description "'), Field(fld2,false), Constant('"')}" +match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ + dup12, + setc("event_description","pluto: added connection description"), + dup11, + dup2, +])); + +var msg108 = msg("pluto:11", part116); + +var part117 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': initiating Main Mode')}" +match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ + dup12, + dup35, + dup11, + dup2, +])); + +var msg109 = msg("pluto:12", part117); + +var part118 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': max number of retransmissions ('), Field(fld4,false), Constant(') reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message')}" +match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ + dup10, + dup36, + dup11, + dup2, +])); + +var msg110 = msg("pluto:13", part118); + +var part119 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': starting keying attempt '), Field(fld4,true), Constant(' of an unlimited number')}" +match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ + dup12, + dup37, + dup11, + dup2, +])); + +var msg111 = msg("pluto:14", part119); + +var part120 = // "Pattern{Constant('forgetting secrets'), Field(,false)}" +match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ + dup12, + setc("event_description","pluto:forgetting secrets"), + dup11, + dup2, +])); + +var msg112 = msg("pluto:15", part120); + +var part121 = // "Pattern{Constant('Changing to directory ''), Field(directory,false), Constant(''')}" +match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ + dup12, + setc("event_description","pluto:Changing to directory"), + dup11, + dup2, +])); + +var msg113 = msg("pluto:17", part121); + +var part122 = // "Pattern{Constant('| *time to handle event'), Field(,false)}" +match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ + dup12, + setc("event_description","pluto:*time to handle event"), + dup11, + dup2, +])); + +var msg114 = msg("pluto:18", part122); + +var part123 = // "Pattern{Constant('| *received kernel message'), Field(,false)}" +match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ + dup12, + setc("event_description","pluto:*received kernel message"), + dup11, + dup2, +])); + +var msg115 = msg("pluto:19", part123); + +var part124 = // "Pattern{Constant('| rejected packet:'), Field(,false)}" +match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ + dup25, + setc("event_description","pluto:rejected packet"), + dup11, + dup2, +])); + +var msg116 = msg("pluto:20", part124); + +var part125 = // "Pattern{Constant('| next event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds for #'), Field(fld3,false)}" +match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg117 = msg("pluto:21", part125); + +var part126 = // "Pattern{Constant('| next event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds')}" +match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg118 = msg("pluto:22", part126); + +var part127 = // "Pattern{Constant('| inserting event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds for #'), Field(fld3,false)}" +match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg119 = msg("pluto:23", part127); + +var part128 = // "Pattern{Constant('| event after this is '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds')}" +match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg120 = msg("pluto:24", part128); + +var part129 = // "Pattern{Constant('| recent '), Field(action,true), Constant(' activity '), Field(fld2,true), Constant(' seconds ago, '), Field(info,false)}" +match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg121 = msg("pluto:25", part129); + +var part130 = // "Pattern{Constant('| *received '), Field(rbytes,true), Constant(' bytes from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' on '), Field(dinterface,false)}" +match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg122 = msg("pluto:26", part130); + +var part131 = // "Pattern{Constant('| received '), Field(action,true), Constant(' notification '), Field(msg,true), Constant(' with seqno = '), Field(fld2,false)}" +match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg123 = msg("pluto:27", part131); + +var part132 = // "Pattern{Constant('| sent '), Field(action,true), Constant(' notification '), Field(msg,true), Constant(' with seqno = '), Field(fld2,false)}" +match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg124 = msg("pluto:28", part132); + +var part133 = // "Pattern{Constant('| inserting event '), Field(event_type,false), Constant(', timeout in '), Field(fld2,true), Constant(' seconds')}" +match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg125 = msg("pluto:29", part133); + +var part134 = // "Pattern{Constant('| handling event '), Field(event_type,true), Constant(' for '), Field(saddr,true), Constant(' "'), Field(fld2,false), Constant('" #'), Field(fld3,false)}" +match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg126 = msg("pluto:30", part134); + +var part135 = // "Pattern{Constant('| '), Field(event_description,false)}" +match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg127 = msg("pluto:31", part135); + +var part136 = // "Pattern{Field(fld2,false), Constant(': asynchronous network error report on '), Field(interface,true), Constant(' for message to '), Field(daddr,true), Constant(' port '), Field(dport,false), Constant(', complainant '), Field(saddr,false), Constant(': Connection refused [errno '), Field(fld4,false), Constant(', origin ICMP type '), Field(icmptype,true), Constant(' code '), Field(icmpcode,true), Constant(' (not authenticated)]')}" +match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ + dup12, + setc("event_description","not authenticated"), + dup11, + dup2, +])); + +var msg128 = msg("pluto:32", part136); + +var part137 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': initiating Main Mode')}" +match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ + dup12, + dup35, + dup11, + dup2, +])); + +var msg129 = msg("pluto:33", part137); + +var part138 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': max number of retransmissions ('), Field(fld5,false), Constant(') reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message')}" +match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ + dup12, + dup36, + dup11, + dup2, +])); + +var msg130 = msg("pluto:34", part138); + +var part139 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': starting keying attempt '), Field(fld5,true), Constant(' of an unlimited number')}" +match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ + dup12, + dup37, + dup11, + dup2, +])); + +var msg131 = msg("pluto:35", part139); + +var select11 = linear_select([ + msg97, + msg98, + msg99, + msg100, + msg101, + msg102, + msg103, + msg104, + msg105, + msg106, + msg107, + msg108, + msg109, + msg110, + msg111, + msg112, + msg113, + msg114, + msg115, + msg116, + msg117, + msg118, + msg119, + msg120, + msg121, + msg122, + msg123, + msg124, + msg125, + msg126, + msg127, + msg128, + msg129, + msg130, + msg131, +]); + +var part140 = // "Pattern{Constant('This binary does not support kernel L2TP.'), Field(,false)}" +match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ + setc("eventcategory","1607000000"), + setc("event_description","xl2tpd:This binary does not support kernel L2TP."), + dup11, + dup2, +])); + +var msg132 = msg("xl2tpd", part140); + +var part141 = // "Pattern{Constant('xl2tpd version '), Field(version,true), Constant(' started on PID:'), Field(fld2,false)}" +match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ + dup12, + setc("event_description","xl2tpd:xl2tpd started."), + dup11, + dup2, +])); + +var msg133 = msg("xl2tpd:01", part141); + +var part142 = // "Pattern{Constant('Written by '), Field(info,false)}" +match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ + dup12, + dup38, + dup11, + dup2, +])); + +var msg134 = msg("xl2tpd:02", part142); + +var part143 = // "Pattern{Constant('Forked by '), Field(info,false)}" +match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ + dup12, + dup38, + dup11, + dup2, +])); + +var msg135 = msg("xl2tpd:03", part143); + +var part144 = // "Pattern{Constant('Inherited by '), Field(info,false)}" +match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ + dup12, + dup38, + dup11, + dup2, +])); + +var msg136 = msg("xl2tpd:04", part144); + +var part145 = // "Pattern{Constant('Listening on IP address '), Field(saddr,false), Constant(', port '), Field(sport,false)}" +match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ + dup12, + dup38, + dup11, + dup2, +])); + +var msg137 = msg("xl2tpd:05", part145); + +var select12 = linear_select([ + msg132, + msg133, + msg134, + msg135, + msg136, + msg137, +]); + +var part146 = // "Pattern{Constant('Exiting'), Field(,false)}" +match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ + dup12, + setc("event_description","barnyard: Exiting"), + dup11, + dup2, +])); + +var msg138 = msg("barnyard:01", part146); + +var part147 = // "Pattern{Constant('Initializing daemon mode'), Field(,false)}" +match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ + dup12, + setc("event_description","barnyard:Initializing daemon mode"), + dup11, + dup2, +])); + +var msg139 = msg("barnyard:02", part147); + +var part148 = // "Pattern{Constant('Opened spool file ''), Field(filename,false), Constant(''')}" +match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ + dup12, + setc("event_description","barnyard:Opened spool file."), + dup11, + dup2, +])); + +var msg140 = msg("barnyard:03", part148); + +var part149 = // "Pattern{Constant('Waiting for new data'), Field(,false)}" +match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ + dup12, + setc("event_description","barnyard:Waiting for new data"), + dup11, + dup2, +])); + +var msg141 = msg("barnyard:04", part149); + +var select13 = linear_select([ + msg138, + msg139, + msg140, + msg141, +]); + +var part150 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP connection from localhost ('), Field(hostname,false), Constant(') ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' closed by QUIT')}" +match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ + dup12, + setc("event_description","exim:SMTP connection from localhost closed by QUIT"), + dup11, + dup2, +])); + +var msg142 = msg("exim:01", part150); + +var part151 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' ['), Field(saddr,false), Constant('] F=<<'), Field(from,false), Constant('> R=<<'), Field(to,false), Constant('> Accepted: '), Field(info,false)}" +match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ + setc("eventcategory","1207010000"), + setc("event_description","exim:e-mail accepted from relay."), + dup11, + dup2, +])); + +var msg143 = msg("exim:02", part151); + +var part152 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' <<= '), Field(from,true), Constant(' H=localhost ('), Field(hostname,false), Constant(') ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' P='), Field(protocol,true), Constant(' S='), Field(fld9,true), Constant(' id='), Field(info,false)}" +match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ + setc("eventcategory","1207000000"), + setc("event_description","exim: e-mail sent."), + dup11, + dup2, +])); + +var msg144 = msg("exim:03", part152); + +var part153 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' == '), Field(from,true), Constant(' R=dnslookup defer ('), Field(fld9,false), Constant('): host lookup did not complete')}" +match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ + dup39, + setc("event_description","exim: e-mail host lookup did not complete in DNS."), + dup11, + dup2, +])); + +var msg145 = msg("exim:04", part153); + +var part154 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' == '), Field(from,true), Constant(' routing defer ('), Field(fld9,false), Constant('): retry time not reached')}" +match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ + dup39, + setc("event_description","exim: e-mail routing defer:retry time not reached."), + dup11, + dup2, +])); + +var msg146 = msg("exim:05", part154); + +var part155 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' exim '), Field(version,true), Constant(' daemon started: pid='), Field(fld8,false), Constant(', no queue runs, listening for SMTP on port '), Field(sport,true), Constant(' ('), Field(info,false), Constant(') port '), Field(fld9,true), Constant(' ('), Field(fld10,false), Constant(') and for SMTPS on port '), Field(fld11,true), Constant(' ('), Field(fld12,false), Constant(')')}" +match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ + dup12, + setc("event_description","exim: exim daemon started."), + dup11, + dup2, +])); + +var msg147 = msg("exim:06", part155); + +var part156 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' Start queue run: pid='), Field(fld8,false)}" +match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ + dup12, + setc("event_description","exim: Start queue run."), + dup11, + dup2, +])); + +var msg148 = msg("exim:07", part156); + +var part157 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' pid '), Field(fld8,false), Constant(': SIGHUP received: re-exec daemon')}" +match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ + dup12, + setc("event_description","exim: SIGHUP received: re-exec daemon."), + dup11, + dup2, +])); + +var msg149 = msg("exim:08", part157); + +var part158 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP connection from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" +match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ + dup12, + setc("event_description","exim: SMTP connection from host."), + dup11, + dup2, +])); + +var msg150 = msg("exim:09", part158); + +var part159 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' rejected EHLO from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" +match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ + dup12, + setc("event_description","exim:rejected EHLO from host."), + dup11, + dup2, +])); + +var msg151 = msg("exim:10", part159); + +var part160 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP protocol synchronization error ('), Field(result,false), Constant('): '), Field(fld8,true), Constant(' H=['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" +match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ + dup12, + setc("event_description","exim:SMTP protocol synchronization error rejected connection from host."), + dup11, + dup2, +])); + +var msg152 = msg("exim:11", part160); + +var part161 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' TLS error on connection from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" +match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ + dup12, + setc("event_description","exim:TLS error on connection from host."), + dup11, + dup2, +])); + +var msg153 = msg("exim:12", part161); + +var part162 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld10,true), Constant(' == '), Field(hostname,true), Constant(' R='), Field(fld8,true), Constant(' T='), Field(fld9,false), Constant(': '), Field(info,false)}" +match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ + dup12, + dup40, + dup11, + dup2, +])); + +var msg154 = msg("exim:13", part162); + +var part163 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld10,true), Constant(' '), Field(hostname,true), Constant(' ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" +match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ + dup12, + dup40, + dup11, + dup2, +])); + +var msg155 = msg("exim:14", part163); + +var part164 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' End queue run: '), Field(info,false)}" +match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ + dup12, + dup40, + dup11, + dup2, +])); + +var msg156 = msg("exim:15", part164); + +var part165 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,false)}" +match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ + dup12, + dup11, + dup2, +])); + +var msg157 = msg("exim:16", part165); + +var select14 = linear_select([ + msg142, + msg143, + msg144, + msg145, + msg146, + msg147, + msg148, + msg149, + msg150, + msg151, + msg152, + msg153, + msg154, + msg155, + msg156, + msg157, +]); + +var part166 = // "Pattern{Constant('QMGR['), Field(fld2,false), Constant(']: '), Field(fld3,true), Constant(' moved to work queue')}" +match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ + dup12, + setc("event_description","smtpd: Process moved to work queue."), + dup11, + dup2, +])); + +var msg158 = msg("smtpd:01", part166); + +var part167 = // "Pattern{Constant('SCANNER['), Field(fld3,false), Constant(']: id="1000" severity="'), Field(severity,false), Constant('" sys="'), Field(fld4,false), Constant('" sub="'), Field(service,false), Constant('" name="'), Field(event_description,false), Constant('" srcip="'), Field(saddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" queueid="'), Field(fld5,false), Constant('" size="'), Field(rbytes,false), Constant('"')}" +match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ + setc("eventcategory","1207010100"), + dup11, + dup2, +])); + +var msg159 = msg("smtpd:02", part167); + +var part168 = // "Pattern{Constant('SCANNER['), Field(fld3,false), Constant(']: Nothing to do, exiting.')}" +match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ + dup12, + setc("event_description","smtpd: SCANNER: Nothing to do,exiting."), + dup11, + dup2, +])); + +var msg160 = msg("smtpd:03", part168); + +var part169 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: QR globally disabled, status two set to 'disabled'')}" +match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ + dup12, + setc("event_description","smtpd: MASTER:QR globally disabled, status two set to disabled."), + dup11, + dup2, +])); + +var msg161 = msg("smtpd:04", part169); + +var part170 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: QR globally disabled, status one set to 'disabled'')}" +match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ + dup12, + setc("event_description","smtpd: MASTER:QR globally disabled, status one set to disabled."), + dup11, + dup2, +])); + +var msg162 = msg("smtpd:07", part170); + +var part171 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: (Re-)loading configuration from Confd')}" +match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ + dup12, + setc("event_description","smtpd: MASTER:(Re-)loading configuration from Confd."), + dup11, + dup2, +])); + +var msg163 = msg("smtpd:05", part171); + +var part172 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: Sending QR one')}" +match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ + dup12, + setc("event_description","smtpd: MASTER:Sending QR one."), + dup11, + dup2, +])); + +var msg164 = msg("smtpd:06", part172); + +var select15 = linear_select([ + msg158, + msg159, + msg160, + msg161, + msg162, + msg163, + msg164, +]); + +var part173 = // "Pattern{Constant('Did not receive identification string from '), Field(fld18,false)}" +match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ + dup10, + setc("event_description","sshd: Did not receive identification string."), + dup11, + dup2, +])); + +var msg165 = msg("sshd:01", part173); + +var part174 = // "Pattern{Constant('Received SIGHUP; restarting.'), Field(,false)}" +match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ + dup12, + setc("event_description","sshd:Received SIGHUP restarting."), + dup11, + dup2, +])); + +var msg166 = msg("sshd:02", part174); + +var part175 = // "Pattern{Constant('Server listening on '), Field(saddr,true), Constant(' port '), Field(sport,false), Constant('.')}" +match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ + dup12, + setc("event_description","sshd:Server listening; restarting."), + dup11, + dup2, +])); + +var msg167 = msg("sshd:03", part175); + +var part176 = // "Pattern{Constant('Invalid user admin from '), Field(fld18,false)}" +match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ + dup41, + setc("event_description","sshd:Invalid user admin."), + dup11, + dup2, +])); + +var msg168 = msg("sshd:04", part176); + +var part177 = // "Pattern{Constant('Failed none for invalid user admin from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" +match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ + dup41, + setc("event_description","sshd:Failed none for invalid user admin."), + dup11, + dup2, +])); + +var msg169 = msg("sshd:05", part177); + +var part178 = // "Pattern{Constant('error: Could not get shadow information for NOUSER'), Field(,false)}" +match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ + dup10, + setc("event_description","sshd:error:Could not get shadow information for NOUSER"), + dup11, + dup2, +])); + +var msg170 = msg("sshd:06", part178); + +var part179 = // "Pattern{Constant('Failed password for root from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" +match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ + dup41, + setc("event_description","sshd:Failed password for root."), + dup11, + dup2, +])); + +var msg171 = msg("sshd:07", part179); + +var part180 = // "Pattern{Constant('Accepted password for loginuser from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" +match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ + setc("eventcategory","1302000000"), + setc("event_description","sshd:Accepted password for loginuser."), + dup11, + dup2, +])); + +var msg172 = msg("sshd:08", part180); + +var part181 = // "Pattern{Constant('subsystem request for sftp failed, subsystem not found'), Field(,false)}" +match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ + dup10, + setc("event_description","sshd:subsystem request for sftp failed,subsystem not found."), + dup11, + dup2, +])); + +var msg173 = msg("sshd:09", part181); + +var select16 = linear_select([ + msg165, + msg166, + msg167, + msg168, + msg169, + msg170, + msg171, + msg172, + msg173, +]); + +var part182 = tagval("MESSAGE#173:aua:01", "nwparser.payload", tvm, { + "caller": "fld4", + "engine": "fld5", + "id": "fld1", + "name": "event_description", + "severity": "severity", + "srcip": "saddr", + "sub": "service", + "sys": "fld2", + "user": "username", +}, processor_chain([ + dup13, + dup11, + dup2, + dup45, + dup46, +])); + +var msg174 = msg("aua:01", part182); + +var part183 = // "Pattern{Constant('created new negotiatorchild'), Field(,false)}" +match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ + dup12, + setc("event_description","sockd: created new negotiatorchild."), + dup11, + dup2, +])); + +var msg175 = msg("sockd:01", part183); + +var part184 = // "Pattern{Constant('dante/server '), Field(version,true), Constant(' running')}" +match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ + dup12, + setc("event_description","sockd:dante/server running."), + dup11, + dup2, +])); + +var msg176 = msg("sockd:02", part184); + +var part185 = // "Pattern{Constant('sockdexit(): terminating on signal '), Field(fld2,false)}" +match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ + dup12, + setc("event_description","sockd:sockdexit():terminating on signal."), + dup11, + dup2, +])); + +var msg177 = msg("sockd:03", part185); + +var select17 = linear_select([ + msg175, + msg176, + msg177, +]); + +var part186 = // "Pattern{Constant('Master started'), Field(,false)}" +match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ + dup12, + setc("event_description","pop3proxy:Master started."), + dup11, + dup2, +])); + +var msg178 = msg("pop3proxy", part186); + +var part187 = tagval("MESSAGE#178:astarosg_TVM", "nwparser.payload", tvm, { + "account": "logon_id", + "action": "action", + "ad_domain": "fld5", + "app-id": "fld20", + "application": "fld19", + "attributes": "obj_name", + "auth": "fld15", + "authtime": "fld9", + "avscantime": "fld12", + "cached": "fld7", + "caller": "fld30", + "category": "policy_id", + "categoryname": "info", + "cattime": "fld11", + "class": "group_object", + "client": "fld3", + "content-type": "content_type", + "cookie": "web_cookie", + "count": "fld4", + "device": "fld14", + "dnstime": "fld10", + "dstip": "daddr", + "dstmac": "dmacaddr", + "dstport": "dport", + "engine": "fld31", + "error": "comments", + "exceptions": "fld17", + "extension": "web_extension", + "extra": "info", + "facility": "logon_type", + "file": "filename", + "filename": "filename", + "filteraction": "policyname", + "fullreqtime": "fld13", + "function": "action", + "fwrule": "policy_id", + "group": "group", + "host": "dhost", + "id": "rule", + "info": "context", + "initf": "sinterface", + "length": "fld25", + "line": "fld22", + "localip": "fld31", + "message": "context", + "method": "web_method", + "name": "event_description", + "node": "node", + "object": "fld6", + "outitf": "dinterface", + "prec": "fld30", + "profile": "owner", + "proto": "fld24", + "reason": "comments", + "referer": "web_referer", + "reputation": "fld18", + "request": "fld8", + "seq": "fld23", + "server": "daddr", + "set-cookie": "fld32", + "severity": "severity", + "size": "filename_size", + "srcip": "saddr", + "srcmac": "smacaddr", + "srcport": "sport", + "statuscode": "resultcode", + "storage": "directory", + "sub": "service", + "sys": "vsys", + "tcpflags": "fld29", + "time": "fld21", + "tos": "fld26", + "ttl": "fld28", + "type": "obj_type", + "ua": "fld16", + "url": "url", + "user": "username", + "version": "version", +}, processor_chain([ + dup12, + dup11, + dup2, + dup45, + dup46, +])); + +var msg179 = msg("astarosg_TVM", part187); + +var part188 = tagval("MESSAGE#179:httpd", "nwparser.payload", tvm, { + "account": "logon_id", + "action": "action", + "ad_domain": "fld5", + "app-id": "fld20", + "application": "fld19", + "attributes": "obj_name", + "auth": "fld15", + "authtime": "fld9", + "avscantime": "fld12", + "cached": "fld7", + "caller": "fld30", + "category": "policy_id", + "categoryname": "info", + "cattime": "fld11", + "class": "group_object", + "client": "fld3", + "content-type": "content_type", + "cookie": "web_cookie", + "count": "fld4", + "device": "fld14", + "dnstime": "fld10", + "dstip": "daddr", + "dstmac": "dmacaddr", + "dstport": "dport", + "engine": "fld31", + "error": "comments", + "exceptions": "fld17", + "extension": "web_extension", + "extra": "info", + "facility": "logon_type", + "file": "filename", + "filename": "filename", + "filteraction": "policyname", + "fullreqtime": "fld13", + "function": "action", + "fwrule": "policy_id", + "group": "group", + "host": "dhost", + "id": "rule", + "info": "context", + "initf": "sinterface", + "length": "fld25", + "line": "fld22", + "localip": "fld31", + "message": "context", + "method": "web_method", + "name": "event_description", + "node": "node", + "object": "fld6", + "outitf": "dinterface", + "port": "network_port", + "prec": "fld30", + "profile": "owner", + "proto": "fld24", + "query": "web_query", + "reason": "comments", + "referer": "web_referer", + "reputation": "fld18", + "request": "fld8", + "seq": "fld23", + "server": "daddr", + "set-cookie": "fld32", + "severity": "severity", + "size": "filename_size", + "srcip": "saddr", + "srcmac": "smacaddr", + "srcport": "sport", + "statuscode": "resultcode", + "storage": "directory", + "sub": "service", + "sys": "vsys", + "tcpflags": "fld29", + "time": "fld21", + "tos": "fld26", + "ttl": "fld28", + "type": "obj_type", + "ua": "fld16", + "uid": "uid", + "url": "url", + "user": "username", + "version": "version", +}, processor_chain([ + dup12, + dup11, + dup2, + dup45, + dup46, +])); + +var msg180 = msg("httpd", part188); + +var part189 = // "Pattern{Constant('['), Field(event_log,false), Constant(':'), Field(result,false), Constant('] [pid '), Field(fld3,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"] [rev "'), Field(fld2,false), Constant('"] [msg "'), Field(event_description,false), Constant('"] [severity "'), Field(severity,false), Constant('"] [ver "'), Field(version,false), Constant('"] [maturity "'), Field(fld22,false), Constant('"] [accuracy "'), Field(fld23,false), Constant('"] [tag "'), Field(fld24,false), Constant('"] [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]'), Field(fld25,false)}" +match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ + setc("eventcategory","1502000000"), + dup2, + dup3, +])); + +var msg181 = msg("httpd:01", part189); + +var select18 = linear_select([ + msg180, + msg181, +]); + +var part190 = tagval("MESSAGE#181:Sophos_Firewall", "nwparser.payload", tvm, { + "activityname": "fld9", + "appfilter_policy_id": "fld10", + "application": "application", + "application_category": "fld23", + "application_risk": "risk_num", + "application_technology": "fld11", + "appresolvedby": "fld22", + "category": "fld4", + "category_type": "fld5", + "connevent": "fld19", + "connid": "connectionid", + "contenttype": "content_type", + "dir_disp": "fld18", + "domain": "fqdn", + "dst_country_code": "location_dst", + "dst_ip": "daddr", + "dst_port": "dport", + "dstzone": "dst_zone", + "dstzonetype": "fld17", + "duration": "duration", + "exceptions": "fld8", + "fw_rule_id": "rule_uid", + "hb_health": "fld21", + "httpresponsecode": "fld7", + "iap": "id1", + "in_interface": "sinterface", + "ips_policy_id": "policy_id", + "log_component": "event_source", + "log_subtype": "category", + "log_type": "event_type", + "message": "info", + "out_interface": "dinterface", + "override_token": "fld6", + "policy_type": "fld23", + "priority": "severity", + "protocol": "protocol", + "reason": "result", + "recv_bytes": "rbytes", + "recv_pkts": "fld15", + "referer": "web_referer", + "sent_bytes": "sbytes", + "sent_pkts": "fld14", + "src_country_code": "location_src", + "src_ip": "saddr", + "src_mac": "smacaddr", + "src_port": "sport", + "srczone": "src_zone", + "srczonetype": "fld16", + "status": "event_state", + "status_code": "resultcode", + "tran_dst_ip": "dtransaddr", + "tran_dst_port": "dtransport", + "tran_src_ip": "stransaddr", + "tran_src_port": "stransport", + "transactionid": "id2", + "url": "url", + "user_agent": "user_agent", + "user_gp": "group", + "user_name": "username", + "vconnid": "fld20", +}, processor_chain([ + setc("eventcategory","1204000000"), + dup2, + date_time({ + dest: "event_time", + args: ["hdate","htime"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dS], + ], + }), +])); + +var msg182 = msg("Sophos_Firewall", part190); + +var chain1 = processor_chain([ + select1, + msgid_select({ + "Sophos_Firewall": msg182, + "URID": msg38, + "afcd": msg94, + "astarosg_TVM": msg179, + "aua": msg174, + "barnyard": select13, + "confd": msg90, + "confd-sync": msg89, + "exim": select14, + "frox": select9, + "httpd": select18, + "httpproxy": select3, + "ipsec_starter": select10, + "named": select2, + "pluto": select11, + "pop3proxy": msg178, + "reverseproxy": select8, + "smtpd": select15, + "sockd": select17, + "sshd": select16, + "ulogd": msg39, + "xl2tpd": select12, + }), +]); + +var part191 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); diff --git a/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml b/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml new file mode 100644 index 00000000000..777046121c7 --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Astaro Security Gateway + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/sophos/utm/manifest.yml b/x-pack/filebeat/module/sophos/utm/manifest.yml new file mode 100644 index 00000000000..bdf9d503458 --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["sophos.utm", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9533 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/sophos/utm/test/generated.log b/x-pack/filebeat/module/sophos/utm/test/generated.log new file mode 100644 index 00000000000..65a20d4f428 --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/test/generated.log @@ -0,0 +1,100 @@ +2016:1:29-06:09:59 smtpd[905]: MASTER[nnumqua]: QR globally disabled, status one set to 'disabled' +2016:2:12-13:12:33 astarosg_TVM[5716]: id=ommod severity=medium sys=inima sub=tlabo name=web request blocked, forbidden application detectedaction=accept method=ugiatnu client=stiae facility=nofdeF user=sunt srcip=10.57.170.140 dstip=10.213.231.72 version=1.5102 storage=emips ad_domain=imadmi object=ostrume class=molest type=upt attributes=uiineavocount=tisetq node=irati account=icistatuscode=giatquov cached=eritquii profile=dexeac filteraction=iscinge size=6992 request=oreseos url=https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu referer=https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac error=nidolo authtime=tatn dnstime=eli cattime=nnu avscantime=dolo fullreqtime=Loremip device=idolor auth=emeumfu ua=CSed exceptions=lupt group=psaquae category=oinBCSe categoryname=mnisist content-type=sedd reputation=uatD application=iunt app-id=temveleu reason=colabo filename=eme file=numqu extension=qui time=civeli function=block line=agnaali message=gnam fwrule=tat seq=ipitla initf=enp0s7281 outitf=enp0s7084 dstmac=01:00:5e:de:94:f6 srcmac=01:00:5e:1d:c1:c0 proto=den length=tutla tos=olorema prec=;iades ttl=siarchi srcport=2289 dstport=3920 tcpflags=mqu info=apariat prec=tlabore caller=untmolli engine=remi localip=saute host=ercit2385.internal.home extra=run server=10.47.202.102 cookie=quirat set-cookie=llu +2016:2:26-20:15:08 eirure7587.internal.localhost reverseproxy: [mpori] [aaliquaU:medium] [pid 3905:lpaqui] (22)No form context found: [client sitame] No form context found when parsing iadese tag, referer: https://api.example.com/utla/utei.htm?oei=tlabori#oin +2016:3:12-03:17:42 data4478.api.lan confd: id=iquipex severity=very-high sys=uradip sub=wri name=bor client=occa facility=stquidol user=itquiin srcip=10.106.239.55 version=1.3129 storage=atevel object=nsecte class=itame type=eumfug attributes=litcount=asun node=estia account=eaq +2016:3:26-10:20:16 ctetura3009.www5.corp reverseproxy: [lita] [adeseru:medium] [pid 7692:eaq] amest configured -- corp normal operations +2016:4:9-17:22:51 smtpd[1411]: MASTER[inculpa]: QR globally disabled, status one set to 'disabled' +2016:4:24-00:25:25 httpproxy[176]: [nse] disk_cache_zap (non) paquioff +2016:5:8-07:27:59 ptasnu6684.mail.lan reverseproxy: [orumSe] [boree:low] [pid 945:rQuisau] AH01915: Init: (10.18.13.211:205) You configured ofdeFini(irat) on the onev(aturauto) port! +2016:5:22-14:30:33 ssecillu7166.internal.lan barnyard: Initializing daemon mode +2016:6:5-21:33:08 ore5643.api.lan reverseproxy: [metco] [acom:high] [pid 2164:nim] ModSecurity: utaliqu compiled version="rsi"; loaded version="taliqui" +2016:6:20-04:35:42 ciun39.localdomain reverseproxy: [iatqu] [inBCSedu:high] [pid 4006:rorsit] AH00098: pid file tionemu overwritten -- Unclean shutdown of previous Apache run? +2016:7:4-11:38:16 atatnon6064.www.invalid reverseproxy: [magnid] [adol:low] [pid 1263:roide] AH00291: long lost child came home! (pid tem) +2016:7:18-18:40:50 gitse2463.www5.invalid aua: id=tvolup severity=low sys=sci sub=col name=web request blocked srcip=10.42.252.243 user=agnaaliq caller=est engine=mquisno +2016:8:2-01:43:25 httpproxy[2078]: [mol] sc_server_cmd (umdolors) decrypt failed +2016:8:16-08:45:59 oriosam6277.mail.localdomain frox: Listening on 10.169.5.162:6676 +2016:8:30-15:48:33 ptate3830.internal.localhost reverseproxy: [quamqua] [ntut:high] [pid 5996:meum] AH02572: Failed to configure at least one certificate and key for mini:Loremip +2016:9:13-22:51:07 nvo6105.invalid reverseproxy: [amquaer] [aqui:medium] [pid 3340:lpa] AH00020: Configuration Failed, isn +2016:9:28-05:53:42 afcd[2492]: Classifier configuration reloaded successfully +2016:10:12-12:56:16 edic2758.api.domain confd: id=olabori severity=medium sys=atatnon sub=lica name=secil client=uisnos facility=olores user=scipit srcip=10.54.169.175 version=1.5889 storage=onorumet object=ptatema class=eavolup type=ipsumq attributes=evitcount=tno node=iss account=taspe +2016:10:26-19:58:50 aua[32]: id=mmo severity=high sys=tlaboru sub=aeabillo name=checking if admin is enabled srcip=10.26.228.145 user=eruntmo caller=nimve engine=usanti +2016:11:10-03:01:24 sshd[2051]: Server listening on 10.59.215.207 port 6195. +2016:11:24-10:03:59 ectobeat3157.mail.local reverseproxy: [uasiarch] [Malor:low] [pid 170:cillumdo] AH02312: Fatal error initialising mod_ssl, ditau. +2016:12:8-17:06:33 ident2323.internal.corp reverseproxy: [hend] [remagna:high] [pid 873:aparia] AH01909: 10.144.21.112:90:epteurs server certificate does NOT include an ID which matches the server name +2016:12:23-00:09:07 ttenb4581.www.host httpproxy: [rem] main (exer) shutdown finished, exiting +2017:1:6-07:11:41 lapari5763.api.invalid frox: Listening on 10.103.2.48:4713 +2017:1:20-14:14:16 elites4713.www.localhost ulogd: id=serr severity=very-high sys=olore sub=onemul name=portscan detected action=deny fwrule=remeum seq=etur initf=lo6086 outitf=lo272 dstmac=01:00:5e:51:b9:4d srcmac=01:00:5e:15:3a:74 srcip=10.161.51.135 dstip=10.52.190.18 proto=isni length=quid tos=aUten prec=Duis ttl=uisq srcport=7807 dstport=165 tcpflags=accus info=CSed code=tiu type=wri +2017:2:3-21:16:50 sam1795.invalid reverseproxy: [lorese] [olupta:low] [pid 3338:iqui] AH02312: Fatal error initialising mod_ssl, animide. +2017:2:18-04:19:24 confd[10]: id=arch severity=high sys=data sub=ugits name=ittenb client=tobeatae facility=ntut user=llum srcip=10.232.108.32 version=1.5240 storage=idolo object=mqu class=mquido type=ende attributes=ntmollitcount=tisu node=ionofdeF account=rsp +2017:3:4-11:21:59 nostrum6305.internal.localhost astarosg_TVM: id=llitani severity=high sys=itametco sub=etcons name=web request blocked, forbidden url detectedaction=allow method=iuntN client=utfugi facility=ursintoc user=tio srcip=10.89.41.97 dstip=10.231.116.175 version=1.5146 storage=lup ad_domain=mipsamv object=exeacomm class=sequines type=cto attributes=cusacount=nderi node=tem account=tcustatuscode=eumiu cached=nim profile=pteurs filteraction=ercitati size=835 request=ptat url=https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn referer=https://example.com/taliqui/idi.txt?undeomn=ape#itaspe error=ari authtime=umtot dnstime=onemulla cattime=atquo avscantime=borio fullreqtime=equatD device=uidol auth=inculpa ua=ruredol exceptions=iadeseru group=loremagn category=acons categoryname=nimadmi content-type=lapa reputation=emoenimi application=iquipex app-id=mqu reason=onorume filename=abill file=ametcon extension=ofdeFini time=tasnu function=deny line=tionev message=uasiarch fwrule=velites seq=uredolor initf=lo1543 outitf=lo6683 dstmac=01:00:5e:8c:f2:06 srcmac=01:00:5e:6f:71:02 proto=plica length=asiarc tos=lor prec=;nvolupt ttl=dquia srcport=5334 dstport=1525 tcpflags=umfugiat info=quisnos prec=utf caller=dolor engine=dexe localip=nemul host=Duis583.api.local extra=eavolupt server=10.17.51.153 cookie=aperiame set-cookie=stenat +2017:3:18-18:24:33 xeaco7887.www.localdomain aua: id=hite severity=very-high sys=ugitsed sub=dminimve name=Packet accepted srcip=10.137.165.144 user=uptate caller=tot engine=reme +2017:4:2-01:27:07 reverseproxy[5430]: ARGS:userPermissions: [\\x22dashletAccessAlertingRecentAlertsPanel\\x22,\\x22dashletAccessAlerterTopAlertsDashlet\\x22,\\x22accessViewRules\\x22,\\x22deployLiveResources\\x22,\\x22vi..."] [severity [hostname "iscivel3512.invalid"] [uri "atcupi"] [unique_id "eriti"] +2017:4:16-08:29:41 sockd[6181]: dante/server 1.202 running +2017:4:30-15:32:16 dolor5799.home afcd: Classifier configuration reloaded successfully +2017:5:14-22:34:50 oreseosq1859.api.lan reverseproxy: [mmodic] [essequam:low] [pid 6691:ficiade] [client uiinea] [uianonn] virus daemon connection problem found in request https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure, referer: https://example.com/adeser/mSe.gif?aute=rchite#rcit +2017:5:29-05:37:24 confd-sync[6908]: id=smoditem severity=very-high sys=tev sub=oNemoeni name=luptatem +2017:6:12-12:39:58 autodit272.www.localhost reverseproxy: [oriss] [imadmin:very-high] [pid 1121:urve] ModSecurity: sBonoru compiled version="everi"; loaded version="squ" +2017:6:26-19:42:33 rporis6787.www5.localdomain reverseproxy: [quasiarc] [pta:low] [pid 3705:liqu] [client ipsu] AH01114: siarch: failed to make connection to backend: 10.148.21.7 +2017:7:11-02:45:07 reprehe5661.www.lan reverseproxy: rManage\\x22,\\x22manageLiveSystemSettings\\x22,\\x22accessViewJobs\\x22,\\x22exportList\\..."] [ver "olor"] [maturity "corpo"] [accuracy "commod"] iumd [hostname "ntore4333.api.invalid"] [uri "sitv"] [unique_id "equam"] +2017:7:25-09:47:41 exim[2384]: aeca-ugitse-ameiu utei:caecat:lumquid oluptat sequatD163.internal.example [10.151.206.38]:5794 lits +2017:8:8-16:50:15 elillu5777.www5.lan pluto: "elaudant"[olup] 10.230.4.70 #ncu: starting keying attempt quaturve of an unlimited number +2017:8:22-23:52:50 ecatcup3022.mail.invalid xl2tpd: Inherited by nproide +2017:9:6-06:55:24 qui7797.www.host ipsec_starter: Starting strongSwan umet IPsec [starter]... +2017:9:20-13:57:58 nofdeFin2037.mail.example reverseproxy: [quatD] [nevol:high] [pid 3994:Sectio] [client tiumdol] [laud] cannot read reply: Operation now in progress (115), referer: https://example.org/tquov/natu.jpg?uianonnu=por#nve +2017:10:4-21:00:32 sockd[7264]: dante/server 1.3714 running +2017:10:19-04:03:07 eFinib2403.api.example reverseproxy: [utaliq] [sun:high] [pid 4074:uredol] [client quatD] [enimad] ecatcu while reading reply from cssd, referer: https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse +2017:11:2-11:05:41 confd[4939]: id=acons severity=high sys=adipisc sub=omnisist name=orroqui client=sci facility=psamvolu user=itsedqui srcip=10.244.96.61 version=1.2707 storage=onevol object=ese class=reprehen type=Exce attributes=toccacount=tinvolu node=ecatc account=iumt +2017:11:16-18:08:15 named[1900]: reloading eddoei iono +2017:12:1-01:10:49 obeatae2042.www.domain reverseproxy: [dquian] [isaute:low] [pid 1853:utfugit] (70007)The ula specified has expired: [client quaUteni] AH01110: error reading response +2017:12:15-08:13:24 aerat1267.www5.example pop3proxy: Master started +2017:12:29-15:15:58 writt2238.internal.localdomain reverseproxy: [uaer] [aed:low] [pid 478:ain] [client scingeli] [uatDuis] mod_avscan_check_file_single_part() called with parameter filename=imip +2018:1:12-22:18:32 siutaliq4937.api.lan reverseproxy: [siutaliq] [urvel:very-high] [pid 7721:ntium] [imadmi] Hostname in dquiac request (liquide) does not match the server name (uatD) +2018:1:27-05:21:06 URID[7596]: T=BCSedut ------ 1 - [exit] accept: ametco +2018:2:10-12:23:41 astarosg_TVM[1090]: id=udex severity=low sys=iam sub=animi name=UDP flood detectedaction=allow method=nsectetu client=spici facility=untutl user=hen srcip=10.214.167.164 dstip=10.76.98.53 version=1.3726 storage=uovolup ad_domain=expl object=animi class=mdoloree type=mullamco attributes=tnulcount=ons node=radip account=amremapstatuscode=dolorsit cached=atisund profile=isnostru filteraction=quepo size=5693 request=nisi url=https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi referer=https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi error=nculp authtime=quamnihi dnstime=nimadmi cattime=mquiado avscantime=agn fullreqtime=dip device=urmag auth=nim ua=laboreet exceptions=tutlabo group=incid category=der categoryname=totamrem content-type=eaqu reputation=itani application=mni app-id=runtmol reason=uaer filename=nor file=saut extension=olest time=volu function=block line=osam message=ncid fwrule=loremagn seq=uisau initf=lo1255 outitf=eth965 dstmac=01:00:5e:2f:c3:3e srcmac=01:00:5e:65:2d:fe proto=ictasun length=iumto tos=ciun prec=;prehe ttl=essec srcport=4562 dstport=2390 tcpflags=uaera info=nsequa prec=yCicero caller=orporis engine=oluptate localip=tesseq host=tenbyCi4371.www5.localdomain extra=spernatu server=10.98.126.206 cookie=tion set-cookie=tNeque +2018:2:24-19:26:15 ulogd[6722]: id=persp severity=medium sys=orev sub=lapa name=Packet logged action=allow fwrule=adminim seq=isiutali initf=lo7088 outitf=eth6357 dstmac=01:00:5e:9a:fe:91 srcmac=01:00:5e:78:1a:5a srcip=10.203.157.250 dstip=10.32.236.117 proto=turm length=quamei tos=nvento prec=nama ttl=ema srcport=6585 dstport=5550 tcpflags=xeacomm info=oriosa code=erspici type=oreeu +2018:3:11-02:28:49 ectob5542.www5.corp reverseproxy: [agni] [ivelit:high] [pid 7755:uovol] AH00959: ap_proxy_connect_backend disabling worker for (10.231.77.26) for volups +2018:3:25-09:31:24 iusmo901.www.home httpd: id=scivelit severity=high sys=untut sub=siu name=Authentication successfulaction=allow method=icons client=hende facility=umdol user=Sedutper srcip=10.2.24.156 dstip=10.113.78.101 version=1.2707 storage=amqua ad_domain=nsequatu object=aboNemoe class=mqu type=tse attributes=ntiumdcount=ueip node=amvo account=dolorsistatuscode=acc cached=quinesc profile=ulpaq filteraction=usa size=5474 request=tob url=https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru referer=https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo error=avolup authtime=litse dnstime=archit cattime=nde avscantime=tNequepo fullreqtime=byCicer device=imvenia auth=ipit ua=tdolorem exceptions=nderitin group=mquiado category=ssequa categoryname=nisist content-type=temvele reputation=ofd application=quam app-id=umdol reason=porincid filename=tisetqu file=pici extension=erit time=ehenderi function=block line=fugiatqu message=Duisaute fwrule=uptat seq=hende initf=lo3680 outitf=lo4358 dstmac=01:00:5e:0a:8f:6c srcmac=01:00:5e:34:8c:d2 proto=mnis length=ainci tos=aturve prec=;tiumdol ttl=mporain srcport=6938 dstport=6939 tcpflags=dut info=aecons prec=tionemu caller=edictasu engine=quipexea localip=orsit host=tenima5715.api.example extra=snisiut server=10.92.93.236 cookie=amr set-cookie=mfug port=7174 query=exerc uid=ntoccae +2018:4:8-16:33:58 astarosg_TVM[6463]: id=user severity=low sys=sequamn sub=adeseru name=File extension warned and proceededaction=accept method=mquisn client=ulamcol facility=nulamcol user=atatno srcip=10.180.169.49 dstip=10.206.69.71 version=1.3155 storage=risni ad_domain=ccaecat object=dtemp class=onproid type=ica attributes=mnisiscount=edolor node=nonnumqu account=iscivelistatuscode=urve cached=sundeomn profile=tasu filteraction=equunt size=3144 request=ilmo url=https://mail.example.net/isqua/deF.html?iameaq=orainci#adm referer=https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria error=tessec authtime=cupida dnstime=ciade cattime=busBonor avscantime=enima fullreqtime=emseq device=osamni auth=umetMa ua=equatDui exceptions=its group=setquas category=nti categoryname=osamnis content-type=atisetqu reputation=ciduntut application=atisu app-id=edutpe reason=architec filename=incul file=tevelit extension=emse time=eipsaqua function=cancel line=suntincu message=lore fwrule=equatu seq=enbyCi initf=enp0s566 outitf=lo2179 dstmac=01:00:5e:2c:9d:65 srcmac=01:00:5e:1a:03:f5 proto=orema length=iusmo tos=uunturm prec=;mSect ttl=avolupta srcport=3308 dstport=1402 tcpflags=dolo info=tsed prec=corpori caller=cillumd engine=umdol localip=turmagn host=mni4032.lan extra=amrem server=10.202.65.2 cookie=queporr set-cookie=oide +2018:4:22-23:36:32 iscing6960.api.invalid reverseproxy: [emipsu] [incidu:very-high] [pid 5350:itation] SSL Library Error: error:itasper:failure +2018:5:7-06:39:06 httpd[793]: [ruredo:success] [pid nculpaq:mides] [client iconseq] ModSecurity: Warning. nidolo [file "runtmoll"] [line "tuserror"] [id "utlabo"] [rev "scip"] [msg "imvenia"] [severity "low"] [ver "1.6420"] [maturity "nisi"] [accuracy "seq"] [tag "ors"] [hostname "olupta3647.host"] [uri "uaUteni"] [unique_id "gitsedqu"]amqu +2018:5:21-13:41:41 named[6633]: FORMERR resolving 'iavolu7814.www5.localhost': 10.194.12.83#elit +2018:6:4-20:44:15 astarosg_TVM[5792]: id=elitess severity=low sys=amqua sub=mavenia name=checking if admin is enabledaction=cancel method=doc client=teurs facility=eturadi user=eturadip srcip=10.33.138.154 dstip=10.254.28.41 version=1.4256 storage=volupta ad_domain=dolor object=dolorsit class=tfugits type=lor attributes=oremcount=utper node=ueips account=umqustatuscode=ntexpli cached=siuta profile=porincid filteraction=itame size=1026 request=fugiat url=https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf referer=https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol error=emul authtime=ariatu dnstime=luptate cattime=umdolore avscantime=iutaliq fullreqtime=oriosamn device=oluptate auth=tcu ua=mmodo exceptions=rauto group=lup category=orem categoryname=tutl content-type=iusmo reputation=uiavolu application=eri app-id=pis reason=riosam filename=isa file=nonnum extension=Nemoenim time=itati function=cancel line=nes message=atvolupt fwrule=umwritt seq=uae initf=enp0s3792 outitf=lo2114 dstmac=01:00:5e:24:b8:9f srcmac=01:00:5e:a1:a3:9f proto=bil length=itten tos=icer prec=;dolo ttl=siutaliq srcport=1455 dstport=6937 tcpflags=pexeaco info=ercitati prec=dexea caller=tasnul engine=onu localip=orisnisi host=obea2960.mail.corp extra=dolor server=10.45.12.53 cookie=etdo set-cookie=edictas +2018:6:19-03:46:49 frox[7744]: Listening on 10.99.134.49:2274 +2018:7:3-10:49:23 olli5982.www.test reverseproxy: [asp] [uatDui:medium] [pid 212:unde] [client raut] [suscip] virus daemon error found in request ectetu, referer: https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid +2018:7:17-17:51:58 nsecte3644.internal.test reverseproxy: [tutla] [isund:high] [pid 3136:uidex] [client uptate] Invalid signature, cookie: JSESSIONID +2018:8:1-00:54:32 confd[4157]: id=onseq severity=very-high sys=siutaliq sub=aliqu name=serro client=ctet facility=umiurere user=antium srcip=10.32.85.21 version=1.7852 storage=eaco object=onp class=ectetur type=ione attributes=utlaborecount=nci node=acommodi account=etconsec +2018:8:15-07:57:06 econseq7119.www.home sshd: error: Could not get shadow information for NOUSER +2018:8:29-14:59:40 ant2543.www5.lan reverseproxy: [uaturve] [lapa:high] [pid 3669:idu] [client sed] [utem] cannot read reply: Operation now in progress (115), referer: https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo +2018:9:12-22:02:15 pluto[7138]: | sent accept notification olore with seqno = urEx +2018:9:27-05:04:49 httpd[6562]: id=iurere severity=medium sys=erc sub=atu name=http accessaction=accept method=odte client=uis facility=sedquia user=reetd srcip=10.210.175.52 dstip=10.87.14.186 version=1.7641 storage=tasu ad_domain=mquae object=CSedu class=atae type=aeconseq attributes=boNemocount=duntutla node=mqu account=inimastatuscode=emipsum cached=venia profile=Loremi filteraction=uisnostr size=849 request=vol url=https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq referer=https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid error=mipsa authtime=teturad dnstime=nimide cattime=spernat avscantime=nevolu fullreqtime=itectobe device=rroq auth=itessequ ua=uunt exceptions=pic group=unt category=emUt categoryname=eiru content-type=sauteir reputation=pic application=caecatc app-id=iarc reason=emquia filename=duntutl file=idi extension=reetdo time=pidatatn function=cancel line=ncul message=mcorpor fwrule=ofd seq=lapariat initf=eth65 outitf=lo3615 dstmac=01:00:5e:b3:e3:90 srcmac=01:00:5e:0e:b3:8e proto=consequ length=min tos=riame prec=;gnaal ttl=nti srcport=1125 dstport=605 tcpflags=utlab info=colabo prec=ditem caller=did engine=BCS localip=idex host=nisiuta4810.api.test extra=apa server=10.85.200.58 cookie=esse set-cookie=idexeac port=2294 query=iatquovo uid=rExce +2018:10:11-12:07:23 itametc1599.api.test ulogd: id=itaedi severity=low sys=ore sub=ips name=Authentication successful action=block fwrule=iamqu seq=aboN initf=eth2679 outitf=enp0s1164 dstmac=01:00:5e:c3:8a:24 srcmac=01:00:5e:5a:9d:a9 srcip=10.133.45.45 dstip=10.115.166.48 proto=utaliq length=icer tos=essequ prec=oeiu ttl=nsequa srcport=4180 dstport=4884 tcpflags=squa info=etM code=eve type=iru +2018:10:25-19:09:57 tiumt5462.mail.localhost sshd: Invalid user admin from runt +2018:11:9-02:12:32 vol1450.internal.host sshd: Server listening on 10.71.184.162 port 3506. +2018:11:23-09:15:06 ipsec_starter[178]: IP address or index of physical interface changed -> reinit of ipsec interface +2018:12:7-16:17:40 rporissu573.api.test reverseproxy: [exercita] [emaperi:very-high] [pid 5943:ddoei] AH02312: Fatal error initialising mod_ssl, nihi. +2018:12:21-23:20:14 nostru774.corp URID: T=tatnonp ------ 1 - [exit] allow: natuserr +2019:1:5-06:22:49 ipsec_starter[6226]: IP address or index of physical interface changed -> reinit of ipsec interface +2019:1:19-13:25:23 httpd[5037]: [iadese:unknown] [pid isundeo:emq] [client rehender] ModSecurity: Warning. uat [file "apa"] [line "tani"] [id "per"] [rev "ngelitse"] [msg "olorsita"] [severity "medium"] [ver "1.7102"] [maturity "apariat"] [accuracy "iuntNequ"] [tag "rExc"] [hostname "lorsita2216.www5.example"] [uri "turvelil"] [unique_id "velitsed"]rau +2019:2:2-20:27:57 sum2208.host reverseproxy: [eir] [nia:medium] [pid 4346:mco] [client ritinvol] [quioffi] mod_avscan_check_file_single_part() called with parameter filename=quamquae +2019:2:17-03:30:32 ore6843.local reverseproxy: [usmodite] [aveniam:medium] [pid 5126:xplicab] [client taev] No signature found, cookie: dictasu +2019:3:3-10:33:06 Sedu1610.mail.corp reverseproxy: [audant] [porr:medium] [pid 7442:tation] [client uunturma] AH01114: cons: failed to make connection to backend: 10.177.35.133 +2019:3:17-17:35:40 corpo6737.example reverseproxy: [officiad] [aliquide:very-high] [pid 6600:errorsi] [client raincidu] [orincidi] cannot connect: failure (111) +2019:4:1-00:38:14 pop3proxy[6854]: Master started +2019:4:15-07:40:49 eratvol314.www.home pop3proxy: Master started +2019:4:29-14:43:23 utemvele1838.mail.test reverseproxy: [xplicabo] [aco:high] [pid 2389:ratione] [client nrepr] ModSecurity: Warning. uipex [file "alorumw"] [line "nibus"] [id "eiusmo"] [msg "rci"] [hostname "seosquir715.local"] [uri "ercitati"] [unique_id "uiration"] +2019:5:13-21:45:57 ulapari2656.local reverseproxy: [itessec] [non:very-high] [pid 2237:licaboN] [client nvol] [moenimip] cannot connect: failure (111) +2019:5:28-04:48:31 reverseproxy[4278]: [ritat] [iscinge:very-high] [pid 4264:rroquisq] [client tnonpro] [nimv] erunt while reading reply from cssd, referer: https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor +2019:6:11-11:51:06 URID[7418]: T=xer ------ 1 - [exit] cancel: onemul +2019:6:25-18:53:40 pluto[7201]: | handling event ips for 10.165.217.56 "econse" #otamr +2019:7:10-01:56:14 stla2856.host reverseproxy: [onpro] [adolo:very-high] [pid 7766:siste] ModSecurity for Apache/nisiut (ostr) configured. +2019:7:24-08:58:48 peri6748.www5.domain reverseproxy: [cingeli] [esseq:high] [pid 2404:aquae] AH00098: pid file otamrema overwritten -- Unclean shutdown of previous Apache run? +2019:8:7-16:01:23 tnon5442.internal.test reverseproxy: [ive] [tquido:very-high] [pid 6108:taliquip] AH00295: caught accept, ectetu +2019:8:21-23:03:57 ariatu2606.www.host reverseproxy: [quamestq] [umquid:very-high] [pid 7690:rem] [client its] [inv] not all the file sent to the client: rin, referer: https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati +2019:9:5-06:06:31 imv1805.api.host ulogd: id=oenim severity=very-high sys=iaturExc sub=orsit name=ICMP flood detected action=cancel fwrule=eos seq=quameius initf=lo4665 outitf=lo3422 dstmac=01:00:5e:d6:f3:bc srcmac=01:00:5e:87:02:08 srcip=10.96.243.231 dstip=10.248.62.55 proto=ugiat length=quiin tos=apar prec=eleumiur ttl=chite srcport=5632 dstport=4206 tcpflags=tevelit info=etc code=lorem type=temvele +2019:9:19-13:09:05 rita600.www5.localdomain reverseproxy: [ini] [elite:high] [pid 7650:mnisiut] AH00959: ap_proxy_connect_backend disabling worker for (10.132.101.158) for cipitlabs +2019:10:3-20:11:40 sshd[2014]: Did not receive identification string from rroq +2019:10:18-03:14:14 admini1122.www.local reverseproxy: [ritte] [umwritte:very-high] [pid 1817:atu] (13)failure: [client vol] AH01095: prefetch request body failed to 10.96.193.132:5342 (orumwr) from bori () +2019:11:1-10:16:48 confd[2475]: id=utaliqu severity=low sys=xplicabo sub=quamni name=dol client=sisten facility=remeumf user=acommod srcip=10.96.200.83 version=1.7416 storage=sper object=asia class=roident type=olorem attributes=teursintcount=evelites node=nostr account=lapariat +2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud +2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico +2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER diff --git a/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json new file mode 100644 index 00000000000..d820157c77c --- /dev/null +++ b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json @@ -0,0 +1,3504 @@ +[ + { + "@timestamp": "2016-01-29T08:09:59.000Z", + "event.code": "smtpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:1:29-06:09:59 smtpd[905]: MASTER[nnumqua]: QR globally disabled, status one set to 'disabled'", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 0, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 905, + "rsa.internal.event_desc": "smtpd: MASTER:QR globally disabled, status one set to disabled.", + "rsa.internal.messageid": "smtpd", + "rsa.time.event_time": "2016-01-29T08:09:59.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-12T15:12:33.000Z", + "destination.address": "ercit2385.internal.home", + "destination.ip": [ + "10.47.202.102" + ], + "destination.mac": "01:00:5e:de:94:f6", + "destination.port": 3920, + "event.action": "block", + "event.code": "astarosg_TVM", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:2:12-13:12:33 astarosg_TVM[5716]: id=ommod severity=medium sys=inima sub=tlabo name=web request blocked, forbidden application detectedaction=accept method=ugiatnu client=stiae facility=nofdeF user=sunt srcip=10.57.170.140 dstip=10.213.231.72 version=1.5102 storage=emips ad_domain=imadmi object=ostrume class=molest type=upt attributes=uiineavocount=tisetq node=irati account=icistatuscode=giatquov cached=eritquii profile=dexeac filteraction=iscinge size=6992 request=oreseos url=https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu referer=https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac error=nidolo authtime=tatn dnstime=eli cattime=nnu avscantime=dolo fullreqtime=Loremip device=idolor auth=emeumfu ua=CSed exceptions=lupt group=psaquae category=oinBCSe categoryname=mnisist content-type=sedd reputation=uatD application=iunt app-id=temveleu reason=colabo filename=eme file=numqu extension=qui time=civeli function=block line=agnaali message=gnam fwrule=tat seq=ipitla initf=enp0s7281 outitf=enp0s7084 dstmac=01:00:5e:de:94:f6 srcmac=01:00:5e:1d:c1:c0 proto=den length=tutla tos=olorema prec=;iades ttl=siarchi srcport=2289 dstport=3920 tcpflags=mqu info=apariat prec=tlabore caller=untmolli engine=remi localip=saute host=ercit2385.internal.home extra=run server=10.47.202.102 cookie=quirat set-cookie=llu", + "file.directory": "emips", + "file.extension": "qui", + "file.name": "numqu", + "file.size": 6992, + "fileset.name": "utm", + "group.name": "psaquae", + "http.request.referrer": "https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac", + "input.type": "log", + "log.level": "medium", + "log.offset": 99, + "observer.egress.interface.name": "enp0s7084", + "observer.ingress.interface.name": "enp0s7281", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.5102", + "process.pid": 5716, + "related.ip": [ + "10.47.202.102", + "10.57.170.140" + ], + "related.user": [ + "dexeac", + "sunt", + "icistatuscode=giatquov" + ], + "rsa.db.index": "run", + "rsa.identity.logon_type": "nofdeF", + "rsa.internal.event_desc": "web", + "rsa.internal.messageid": "astarosg_TVM", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block", + "ugiatnu" + ], + "rsa.misc.comments": "colabo", + "rsa.misc.content_type": "sedd", + "rsa.misc.context": "apariat", + "rsa.misc.group": "psaquae", + "rsa.misc.group_object": "molest", + "rsa.misc.node": "irati", + "rsa.misc.obj_name": "uiineavocount=tisetq", + "rsa.misc.obj_type": "upt", + "rsa.misc.policy_id": "tat", + "rsa.misc.policy_name": "iscinge", + "rsa.misc.rule": "ommod", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5102", + "rsa.misc.vsys": "inima", + "rsa.network.dinterface": "enp0s7084", + "rsa.network.host_dst": "ercit2385.internal.home", + "rsa.network.sinterface": "enp0s7281", + "rsa.time.event_time": "2016-02-12T15:12:33.000Z", + "rsa.web.web_cookie": "quirat", + "service.name": "tlabo", + "service.type": "sophos", + "source.ip": [ + "10.57.170.140" + ], + "source.mac": "01:00:5e:1d:c1:c0", + "source.port": 2289, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu", + "user.name": "sunt" + }, + { + "@timestamp": "2016-02-26T22:15:08.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:2:26-20:15:08 eirure7587.internal.localhost reverseproxy: [mpori] [aaliquaU:medium] [pid 3905:lpaqui] (22)No form context found: [client sitame] No form context found when parsing iadese tag, referer: https://api.example.com/utla/utei.htm?oei=tlabori#oin", + "fileset.name": "utm", + "host.name": "eirure7587.internal.localhost", + "http.request.referrer": "https://api.example.com/utla/utei.htm?oei=tlabori#oin", + "input.type": "log", + "log.level": "medium", + "log.offset": 1448, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3905, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "aaliquaU", + "rsa.misc.result": "No form context found", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "eirure7587.internal.localhost" + ], + "rsa.network.gateway": "sitame", + "rsa.time.event_time": "2016-02-26T22:15:08.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-03-12T05:17:42.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:3:12-03:17:42 data4478.api.lan confd: id=iquipex severity=very-high sys=uradip sub=wri name=bor client=occa facility=stquidol user=itquiin srcip=10.106.239.55 version=1.3129 storage=atevel object=nsecte class=itame type=eumfug attributes=litcount=asun node=estia account=eaq", + "file.directory": "atevel", + "fileset.name": "utm", + "host.name": "data4478.api.lan", + "input.type": "log", + "log.level": "very-high", + "log.offset": 1708, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.3129", + "related.ip": [ + "10.106.239.55" + ], + "related.user": [ + "eaq", + "itquiin" + ], + "rsa.identity.logon_type": "stquidol", + "rsa.internal.event_desc": "bor", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "itame", + "rsa.misc.node": "estia", + "rsa.misc.obj_name": "litcount=asun", + "rsa.misc.obj_type": "eumfug", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.3129", + "rsa.network.alias_host": [ + "data4478.api.lan" + ], + "rsa.time.event_time": "2016-03-12T05:17:42.000Z", + "service.name": "wri", + "service.type": "sophos", + "source.ip": [ + "10.106.239.55" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "itquiin" + }, + { + "@timestamp": "2016-03-26T12:20:16.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:3:26-10:20:16 ctetura3009.www5.corp reverseproxy: [lita] [adeseru:medium] [pid 7692:eaq] amest configured -- corp normal operations", + "fileset.name": "utm", + "host.name": "ctetura3009.www5.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 1988, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7692, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "corp", + "rsa.misc.event_id": "AH00292", + "rsa.misc.event_log": "adeseru", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "ctetura3009.www5.corp" + ], + "rsa.time.event_time": "2016-03-26T12:20:16.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-04-09T19:22:51.000Z", + "event.code": "smtpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:4:9-17:22:51 smtpd[1411]: MASTER[inculpa]: QR globally disabled, status one set to 'disabled'", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 2125, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1411, + "rsa.internal.event_desc": "smtpd: MASTER:QR globally disabled, status one set to disabled.", + "rsa.internal.messageid": "smtpd", + "rsa.time.event_time": "2016-04-09T19:22:51.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-04-24T02:25:25.000Z", + "event.code": "httpproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:4:24-00:25:25 httpproxy[176]: [nse] disk_cache_zap (non) paquioff", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 2224, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 176, + "rsa.db.index": "paquioff", + "rsa.internal.event_desc": "httpproxy:disk_cache_zap related message.", + "rsa.internal.messageid": "httpproxy", + "rsa.time.event_time": "2016-04-24T02:25:25.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-05-08T09:27:59.000Z", + "destination.ip": [ + "10.18.13.211" + ], + "destination.port": 205, + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:5:8-07:27:59 ptasnu6684.mail.lan reverseproxy: [orumSe] [boree:low] [pid 945:rQuisau] AH01915: Init: (10.18.13.211:205) You configured ofdeFini(irat) on the onev(aturauto) port!", + "fileset.name": "utm", + "host.name": "ptasnu6684.mail.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 2295, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 945, + "related.ip": [ + "10.18.13.211" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.comments": "Invalid port configuration", + "rsa.misc.event_log": "boree", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "ptasnu6684.mail.lan" + ], + "rsa.network.network_service": "ofdeFini", + "rsa.time.event_time": "2016-05-08T09:27:59.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-05-22T16:30:33.000Z", + "event.code": "barnyard", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:5:22-14:30:33 ssecillu7166.internal.lan barnyard: Initializing daemon mode", + "fileset.name": "utm", + "host.name": "ssecillu7166.internal.lan", + "input.type": "log", + "log.offset": 2478, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "barnyard:Initializing daemon mode", + "rsa.internal.messageid": "barnyard", + "rsa.network.alias_host": [ + "ssecillu7166.internal.lan" + ], + "rsa.time.event_time": "2016-05-22T16:30:33.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-06-05T23:33:08.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:6:5-21:33:08 ore5643.api.lan reverseproxy: [metco] [acom:high] [pid 2164:nim] ModSecurity: utaliqu compiled version=\"rsi\"; loaded version=\"taliqui\"", + "fileset.name": "utm", + "host.name": "ore5643.api.lan", + "input.type": "log", + "log.level": "high", + "log.offset": 2558, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2164, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "acom", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ore5643.api.lan" + ], + "rsa.time.event_time": "2016-06-05T23:33:08.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-06-20T06:35:42.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:6:20-04:35:42 ciun39.localdomain reverseproxy: [iatqu] [inBCSedu:high] [pid 4006:rorsit] AH00098: pid file tionemu overwritten -- Unclean shutdown of previous Apache run?", + "file.name": "tionemu", + "fileset.name": "utm", + "host.name": "ciun39.localdomain", + "input.type": "log", + "log.level": "high", + "log.offset": 2711, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 4006, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.context": "Unclean shutdown", + "rsa.misc.event_id": "AH00098", + "rsa.misc.event_log": "inBCSedu", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ciun39.localdomain" + ], + "rsa.time.event_time": "2016-06-20T06:35:42.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-07-04T13:38:16.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:7:4-11:38:16 atatnon6064.www.invalid reverseproxy: [magnid] [adol:low] [pid 1263:roide] AH00291: long lost child came home! (pid tem)", + "fileset.name": "utm", + "host.name": "atatnon6064.www.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 2887, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1263, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH00291", + "rsa.misc.event_log": "adol", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "atatnon6064.www.invalid" + ], + "rsa.time.event_time": "2016-07-04T13:38:16.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-07-18T20:40:50.000Z", + "event.code": "aua", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:7:18-18:40:50 gitse2463.www5.invalid aua: id=tvolup severity=low sys=sci sub=col name=web request blocked srcip=10.42.252.243 user=agnaaliq caller=est engine=mquisno", + "fileset.name": "utm", + "host.name": "gitse2463.www5.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 3026, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.user": [ + "agnaaliq" + ], + "rsa.internal.event_desc": "web", + "rsa.internal.messageid": "aua", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "gitse2463.www5.invalid" + ], + "rsa.time.event_time": "2016-07-18T20:40:50.000Z", + "service.name": "col", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "agnaaliq" + }, + { + "@timestamp": "2016-08-02T03:43:25.000Z", + "event.code": "httpproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:8:2-01:43:25 httpproxy[2078]: [mol] sc_server_cmd (umdolors) decrypt failed", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 3197, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2078, + "rsa.internal.event_desc": "httpproxy:decrypt failed.", + "rsa.internal.messageid": "httpproxy", + "rsa.time.event_time": "2016-08-02T03:43:25.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-16T10:45:59.000Z", + "event.code": "frox", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:8:16-08:45:59 oriosam6277.mail.localdomain frox: Listening on 10.169.5.162:6676", + "fileset.name": "utm", + "host.name": "oriosam6277.mail.localdomain", + "input.type": "log", + "log.offset": 3278, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.169.5.162" + ], + "rsa.internal.event_desc": "frox:FTP Proxy listening on port.", + "rsa.internal.messageid": "frox", + "rsa.network.alias_host": [ + "oriosam6277.mail.localdomain" + ], + "rsa.time.event_time": "2016-08-16T10:45:59.000Z", + "service.type": "sophos", + "source.ip": [ + "10.169.5.162" + ], + "source.port": 6676, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-08-30T17:48:33.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:8:30-15:48:33 ptate3830.internal.localhost reverseproxy: [quamqua] [ntut:high] [pid 5996:meum] AH02572: Failed to configure at least one certificate and key for mini:Loremip", + "fileset.name": "utm", + "host.name": "ptate3830.internal.localhost", + "input.type": "log", + "log.level": "high", + "log.offset": 3363, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5996, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH02572", + "rsa.misc.event_log": "ntut", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ptate3830.internal.localhost" + ], + "rsa.time.event_time": "2016-08-30T17:48:33.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-14T00:51:07.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:9:13-22:51:07 nvo6105.invalid reverseproxy: [amquaer] [aqui:medium] [pid 3340:lpa] AH00020: Configuration Failed, isn", + "fileset.name": "utm", + "host.name": "nvo6105.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 3542, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3340, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "isn", + "rsa.misc.event_id": "AH00020", + "rsa.misc.event_log": "aqui", + "rsa.misc.result": "Configuration Failed", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "nvo6105.invalid" + ], + "rsa.time.event_time": "2016-09-14T00:51:07.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-28T07:53:42.000Z", + "event.code": "afcd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:9:28-05:53:42 afcd[2492]: Classifier configuration reloaded successfully", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 3665, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2492, + "rsa.internal.event_desc": "afcd: IM/P2P Classifier configuration reloaded successfully.", + "rsa.internal.messageid": "afcd", + "rsa.time.event_time": "2016-09-28T07:53:42.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-10-12T14:56:16.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:10:12-12:56:16 edic2758.api.domain confd: id=olabori severity=medium sys=atatnon sub=lica name=secil client=uisnos facility=olores user=scipit srcip=10.54.169.175 version=1.5889 storage=onorumet object=ptatema class=eavolup type=ipsumq attributes=evitcount=tno node=iss account=taspe", + "file.directory": "onorumet", + "fileset.name": "utm", + "host.name": "edic2758.api.domain", + "input.type": "log", + "log.level": "medium", + "log.offset": 3743, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.5889", + "related.ip": [ + "10.54.169.175" + ], + "related.user": [ + "taspe", + "scipit" + ], + "rsa.identity.logon_type": "olores", + "rsa.internal.event_desc": "secil", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "eavolup", + "rsa.misc.node": "iss", + "rsa.misc.obj_name": "evitcount=tno", + "rsa.misc.obj_type": "ipsumq", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.5889", + "rsa.network.alias_host": [ + "edic2758.api.domain" + ], + "rsa.time.event_time": "2016-10-12T14:56:16.000Z", + "service.name": "lica", + "service.type": "sophos", + "source.ip": [ + "10.54.169.175" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "scipit" + }, + { + "@timestamp": "2016-10-26T21:58:50.000Z", + "event.code": "aua", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:10:26-19:58:50 aua[32]: id=mmo severity=high sys=tlaboru sub=aeabillo name=checking if admin is enabled srcip=10.26.228.145 user=eruntmo caller=nimve engine=usanti", + "fileset.name": "utm", + "input.type": "log", + "log.level": "high", + "log.offset": 4032, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 32, + "related.user": [ + "eruntmo" + ], + "rsa.internal.event_desc": "checking", + "rsa.internal.messageid": "aua", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.severity": "high", + "rsa.time.event_time": "2016-10-26T21:58:50.000Z", + "service.name": "aeabillo", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "eruntmo" + }, + { + "@timestamp": "2016-11-10T05:01:24.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:11:10-03:01:24 sshd[2051]: Server listening on 10.59.215.207 port 6195.", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 4201, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2051, + "related.ip": [ + "10.59.215.207" + ], + "rsa.internal.event_desc": "sshd:Server listening; restarting.", + "rsa.internal.messageid": "sshd", + "rsa.time.event_time": "2016-11-10T05:01:24.000Z", + "service.type": "sophos", + "source.ip": [ + "10.59.215.207" + ], + "source.port": 6195, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-11-24T12:03:59.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:11:24-10:03:59 ectobeat3157.mail.local reverseproxy: [uasiarch] [Malor:low] [pid 170:cillumdo] AH02312: Fatal error initialising mod_ssl, ditau.", + "fileset.name": "utm", + "host.name": "ectobeat3157.mail.local", + "input.type": "log", + "log.level": "low", + "log.offset": 4278, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 170, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "ditau", + "rsa.misc.event_id": "AH02312", + "rsa.misc.event_log": "Malor", + "rsa.misc.result": "Fatal error", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "ectobeat3157.mail.local" + ], + "rsa.time.event_time": "2016-11-24T12:03:59.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-12-08T19:06:33.000Z", + "destination.ip": [ + "10.144.21.112" + ], + "destination.port": 90, + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:12:8-17:06:33 ident2323.internal.corp reverseproxy: [hend] [remagna:high] [pid 873:aparia] AH01909: 10.144.21.112:90:epteurs server certificate does NOT include an ID which matches the server name", + "fileset.name": "utm", + "host.name": "ident2323.internal.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 4428, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 873, + "related.ip": [ + "10.144.21.112" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.comments": "server certificate has a different hostname from actual hostname", + "rsa.misc.event_id": "AH01909", + "rsa.misc.event_log": "remagna", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ident2323.internal.corp" + ], + "rsa.time.event_time": "2016-12-08T19:06:33.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2016-12-23T02:09:07.000Z", + "event.code": "httpproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2016:12:23-00:09:07 ttenb4581.www.host httpproxy: [rem] main (exer) shutdown finished, exiting", + "fileset.name": "utm", + "host.name": "ttenb4581.www.host", + "input.type": "log", + "log.offset": 4630, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "httpproxy:shutdown finished, exiting.", + "rsa.internal.messageid": "httpproxy", + "rsa.network.alias_host": [ + "ttenb4581.www.host" + ], + "rsa.time.event_time": "2016-12-23T02:09:07.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-01-06T09:11:41.000Z", + "event.code": "frox", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:1:6-07:11:41 lapari5763.api.invalid frox: Listening on 10.103.2.48:4713", + "fileset.name": "utm", + "host.name": "lapari5763.api.invalid", + "input.type": "log", + "log.offset": 4725, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.103.2.48" + ], + "rsa.internal.event_desc": "frox:FTP Proxy listening on port.", + "rsa.internal.messageid": "frox", + "rsa.network.alias_host": [ + "lapari5763.api.invalid" + ], + "rsa.time.event_time": "2017-01-06T09:11:41.000Z", + "service.type": "sophos", + "source.ip": [ + "10.103.2.48" + ], + "source.port": 4713, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-01-20T16:14:16.000Z", + "destination.ip": [ + "10.52.190.18" + ], + "destination.mac": "01:00:5e:51:b9:4d", + "destination.port": 165, + "event.code": "ulogd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:1:20-14:14:16 elites4713.www.localhost ulogd: id=serr severity=very-high sys=olore sub=onemul name=portscan detected action=deny fwrule=remeum seq=etur initf=lo6086 outitf=lo272 dstmac=01:00:5e:51:b9:4d srcmac=01:00:5e:15:3a:74 srcip=10.161.51.135 dstip=10.52.190.18 proto=isni length=quid tos=aUten prec=Duis ttl=uisq srcport=7807 dstport=165 tcpflags=accus info=CSed code=tiu type=wri", + "fileset.name": "utm", + "host.name": "elites4713.www.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 4802, + "observer.egress.interface.name": "lo272", + "observer.ingress.interface.name": "lo6086", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.161.51.135", + "10.52.190.18" + ], + "rsa.internal.event_desc": "portscan", + "rsa.internal.messageid": "ulogd", + "rsa.investigations.ec_activity": "Scan", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "TEV", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.context": "CSed", + "rsa.misc.policy_id": "remeum", + "rsa.misc.rule": "serr", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "olore", + "rsa.network.alias_host": [ + "elites4713.www.localhost" + ], + "rsa.network.dinterface": "lo272", + "rsa.network.network_service": "onemul", + "rsa.network.sinterface": "lo6086", + "rsa.time.event_time": "2017-01-20T16:14:16.000Z", + "service.type": "sophos", + "source.ip": [ + "10.161.51.135" + ], + "source.mac": "01:00:5e:15:3a:74", + "source.port": 7807, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-02-03T23:16:50.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:2:3-21:16:50 sam1795.invalid reverseproxy: [lorese] [olupta:low] [pid 3338:iqui] AH02312: Fatal error initialising mod_ssl, animide.", + "fileset.name": "utm", + "host.name": "sam1795.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 5194, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3338, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "animide", + "rsa.misc.event_id": "AH02312", + "rsa.misc.event_log": "olupta", + "rsa.misc.result": "Fatal error", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "sam1795.invalid" + ], + "rsa.time.event_time": "2017-02-03T23:16:50.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-02-18T06:19:24.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:2:18-04:19:24 confd[10]: id=arch severity=high sys=data sub=ugits name=ittenb client=tobeatae facility=ntut user=llum srcip=10.232.108.32 version=1.5240 storage=idolo object=mqu class=mquido type=ende attributes=ntmollitcount=tisu node=ionofdeF account=rsp", + "file.directory": "idolo", + "fileset.name": "utm", + "input.type": "log", + "log.level": "high", + "log.offset": 5332, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.5240", + "process.pid": 10, + "related.ip": [ + "10.232.108.32" + ], + "related.user": [ + "rsp", + "llum" + ], + "rsa.identity.logon_type": "ntut", + "rsa.internal.event_desc": "ittenb", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "mquido", + "rsa.misc.node": "ionofdeF", + "rsa.misc.obj_name": "ntmollitcount=tisu", + "rsa.misc.obj_type": "ende", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5240", + "rsa.time.event_time": "2017-02-18T06:19:24.000Z", + "service.name": "ugits", + "service.type": "sophos", + "source.ip": [ + "10.232.108.32" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "llum" + }, + { + "@timestamp": "2017-03-04T13:21:59.000Z", + "destination.address": "Duis583.api.local", + "destination.ip": [ + "10.17.51.153" + ], + "destination.mac": "01:00:5e:8c:f2:06", + "destination.port": 1525, + "event.action": "deny", + "event.code": "astarosg_TVM", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:3:4-11:21:59 nostrum6305.internal.localhost astarosg_TVM: id=llitani severity=high sys=itametco sub=etcons name=web request blocked, forbidden url detectedaction=allow method=iuntN client=utfugi facility=ursintoc user=tio srcip=10.89.41.97 dstip=10.231.116.175 version=1.5146 storage=lup ad_domain=mipsamv object=exeacomm class=sequines type=cto attributes=cusacount=nderi node=tem account=tcustatuscode=eumiu cached=nim profile=pteurs filteraction=ercitati size=835 request=ptat url=https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn referer=https://example.com/taliqui/idi.txt?undeomn=ape#itaspe error=ari authtime=umtot dnstime=onemulla cattime=atquo avscantime=borio fullreqtime=equatD device=uidol auth=inculpa ua=ruredol exceptions=iadeseru group=loremagn category=acons categoryname=nimadmi content-type=lapa reputation=emoenimi application=iquipex app-id=mqu reason=onorume filename=abill file=ametcon extension=ofdeFini time=tasnu function=deny line=tionev message=uasiarch fwrule=velites seq=uredolor initf=lo1543 outitf=lo6683 dstmac=01:00:5e:8c:f2:06 srcmac=01:00:5e:6f:71:02 proto=plica length=asiarc tos=lor prec=;nvolupt ttl=dquia srcport=5334 dstport=1525 tcpflags=umfugiat info=quisnos prec=utf caller=dolor engine=dexe localip=nemul host=Duis583.api.local extra=eavolupt server=10.17.51.153 cookie=aperiame set-cookie=stenat", + "file.directory": "lup", + "file.extension": "ofdeFini", + "file.name": "ametcon", + "file.size": 835, + "fileset.name": "utm", + "group.name": "loremagn", + "host.name": "nostrum6305.internal.localhost", + "http.request.referrer": "https://example.com/taliqui/idi.txt?undeomn=ape#itaspe", + "input.type": "log", + "log.level": "high", + "log.offset": 5594, + "observer.egress.interface.name": "lo6683", + "observer.ingress.interface.name": "lo1543", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.5146", + "related.ip": [ + "10.17.51.153", + "10.89.41.97" + ], + "related.user": [ + "tio", + "tcustatuscode=eumiu", + "pteurs" + ], + "rsa.db.index": "eavolupt", + "rsa.identity.logon_type": "ursintoc", + "rsa.internal.event_desc": "web", + "rsa.internal.messageid": "astarosg_TVM", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "iuntN", + "deny" + ], + "rsa.misc.comments": "onorume", + "rsa.misc.content_type": "lapa", + "rsa.misc.context": "quisnos", + "rsa.misc.group": "loremagn", + "rsa.misc.group_object": "sequines", + "rsa.misc.node": "tem", + "rsa.misc.obj_name": "cusacount=nderi", + "rsa.misc.obj_type": "cto", + "rsa.misc.policy_id": "velites", + "rsa.misc.policy_name": "ercitati", + "rsa.misc.rule": "llitani", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.5146", + "rsa.misc.vsys": "itametco", + "rsa.network.alias_host": [ + "nostrum6305.internal.localhost" + ], + "rsa.network.dinterface": "lo6683", + "rsa.network.host_dst": "Duis583.api.local", + "rsa.network.sinterface": "lo1543", + "rsa.time.event_time": "2017-03-04T13:21:59.000Z", + "rsa.web.web_cookie": "aperiame", + "service.name": "etcons", + "service.type": "sophos", + "source.ip": [ + "10.89.41.97" + ], + "source.mac": "01:00:5e:6f:71:02", + "source.port": 5334, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn", + "user.name": "tio" + }, + { + "@timestamp": "2017-03-18T20:24:33.000Z", + "event.code": "aua", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:3:18-18:24:33 xeaco7887.www.localdomain aua: id=hite severity=very-high sys=ugitsed sub=dminimve name=Packet accepted srcip=10.137.165.144 user=uptate caller=tot engine=reme", + "fileset.name": "utm", + "host.name": "xeaco7887.www.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 6963, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.user": [ + "uptate" + ], + "rsa.internal.event_desc": "Packet", + "rsa.internal.messageid": "aua", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "xeaco7887.www.localdomain" + ], + "rsa.time.event_time": "2017-03-18T20:24:33.000Z", + "service.name": "dminimve", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "uptate" + }, + { + "@timestamp": "2017-04-02T03:27:07.000Z", + "destination.address": "iscivel3512.invalid", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:4:2-01:27:07 reverseproxy[5430]: ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"iscivel3512.invalid\"] [uri \"atcupi\"] [unique_id \"eriti\"]", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 7142, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5430, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.operation_id": "eriti", + "rsa.network.host_dst": "iscivel3512.invalid", + "rsa.time.event_time": "2017-04-02T03:27:07.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "atcupi" + }, + { + "@timestamp": "2017-04-16T10:29:41.000Z", + "event.code": "sockd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:4:16-08:29:41 sockd[6181]: dante/server 1.202 running", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 7446, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.202", + "process.pid": 6181, + "rsa.internal.event_desc": "sockd:dante/server running.", + "rsa.internal.messageid": "sockd", + "rsa.misc.version": "1.202", + "rsa.time.event_time": "2017-04-16T10:29:41.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-04-30T17:32:16.000Z", + "event.code": "afcd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:4:30-15:32:16 dolor5799.home afcd: Classifier configuration reloaded successfully", + "fileset.name": "utm", + "host.name": "dolor5799.home", + "input.type": "log", + "log.offset": 7505, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "afcd: IM/P2P Classifier configuration reloaded successfully.", + "rsa.internal.messageid": "afcd", + "rsa.network.alias_host": [ + "dolor5799.home" + ], + "rsa.time.event_time": "2017-04-30T17:32:16.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-05-15T00:34:50.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:5:14-22:34:50 oreseosq1859.api.lan reverseproxy: [mmodic] [essequam:low] [pid 6691:ficiade] [client uiinea] [uianonn] virus daemon connection problem found in request https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure, referer: https://example.com/adeser/mSe.gif?aute=rchite#rcit", + "fileset.name": "utm", + "host.name": "oreseosq1859.api.lan", + "http.request.referrer": "https://example.com/adeser/mSe.gif?aute=rchite#rcit", + "input.type": "log", + "log.level": "low", + "log.offset": 7592, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6691, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "essequam", + "rsa.misc.result": "Virus daemon connection problem", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "oreseosq1859.api.lan" + ], + "rsa.network.gateway": "uiinea", + "rsa.time.event_time": "2017-05-15T00:34:50.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure" + }, + { + "@timestamp": "2017-05-29T07:37:24.000Z", + "event.code": "confd-sync", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:5:29-05:37:24 confd-sync[6908]: id=smoditem severity=very-high sys=tev sub=oNemoeni name=luptatem", + "fileset.name": "utm", + "input.type": "log", + "log.level": "very-high", + "log.offset": 7885, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6908, + "rsa.internal.event_desc": "luptatem", + "rsa.internal.messageid": "confd-sync", + "rsa.misc.severity": "very-high", + "rsa.time.event_time": "2017-05-29T07:37:24.000Z", + "service.name": "oNemoeni", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-06-12T14:39:58.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:6:12-12:39:58 autodit272.www.localhost reverseproxy: [oriss] [imadmin:very-high] [pid 1121:urve] ModSecurity: sBonoru compiled version=\"everi\"; loaded version=\"squ\"", + "fileset.name": "utm", + "host.name": "autodit272.www.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 7988, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1121, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "imadmin", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "autodit272.www.localhost" + ], + "rsa.time.event_time": "2017-06-12T14:39:58.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-06-26T21:42:33.000Z", + "destination.ip": [ + "10.148.21.7" + ], + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:6:26-19:42:33 rporis6787.www5.localdomain reverseproxy: [quasiarc] [pta:low] [pid 3705:liqu] [client ipsu] AH01114: siarch: failed to make connection to backend: 10.148.21.7", + "fileset.name": "utm", + "host.name": "rporis6787.www5.localdomain", + "input.type": "log", + "log.level": "low", + "log.offset": 8158, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3705, + "related.ip": [ + "10.148.21.7" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH01114", + "rsa.misc.event_log": "pta", + "rsa.misc.result": "Backend connection failed", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "rporis6787.www5.localdomain" + ], + "rsa.network.gateway": "ipsu", + "rsa.network.network_service": "siarch", + "rsa.time.event_time": "2017-06-26T21:42:33.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-07-11T04:45:07.000Z", + "destination.address": "ntore4333.api.invalid", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:7:11-02:45:07 reprehe5661.www.lan reverseproxy: rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"olor\"] [maturity \"corpo\"] [accuracy \"commod\"] iumd [hostname \"ntore4333.api.invalid\"] [uri \"sitv\"] [unique_id \"equam\"]", + "fileset.name": "utm", + "host.name": "reprehe5661.www.lan", + "input.type": "log", + "log.offset": 8337, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.context": "iumd", + "rsa.misc.operation_id": "equam", + "rsa.misc.policy_name": "olor", + "rsa.network.alias_host": [ + "reprehe5661.www.lan" + ], + "rsa.network.host_dst": "ntore4333.api.invalid", + "rsa.time.event_time": "2017-07-11T04:45:07.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "sitv" + }, + { + "@timestamp": "2017-07-25T11:47:41.000Z", + "event.code": "exim", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:7:25-09:47:41 exim[2384]: aeca-ugitse-ameiu utei:caecat:lumquid oluptat sequatD163.internal.example [10.151.206.38]:5794 lits", + "fileset.name": "utm", + "host.name": "sequatD163.internal.example", + "input.type": "log", + "log.offset": 8611, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2384, + "related.ip": [ + "10.151.206.38" + ], + "rsa.db.index": "lits", + "rsa.internal.event_desc": "exim:connection service message.", + "rsa.internal.messageid": "exim", + "rsa.network.alias_host": [ + "sequatD163.internal.example" + ], + "rsa.time.event_time": "2017-07-25T11:47:41.000Z", + "service.type": "sophos", + "source.ip": [ + "10.151.206.38" + ], + "source.port": 5794, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-08-08T18:50:15.000Z", + "event.code": "pluto", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:8:8-16:50:15 elillu5777.www5.lan pluto: \"elaudant\"[olup] 10.230.4.70 #ncu: starting keying attempt quaturve of an unlimited number", + "fileset.name": "utm", + "host.name": "elillu5777.www5.lan", + "input.type": "log", + "log.offset": 8742, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.230.4.70" + ], + "rsa.internal.event_desc": "pluto: starting keying attempt of an unlimited number", + "rsa.internal.messageid": "pluto", + "rsa.network.alias_host": [ + "elillu5777.www5.lan" + ], + "rsa.time.event_time": "2017-08-08T18:50:15.000Z", + "service.type": "sophos", + "source.ip": [ + "10.230.4.70" + ], + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-08-23T01:52:50.000Z", + "event.code": "xl2tpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:8:22-23:52:50 ecatcup3022.mail.invalid xl2tpd: Inherited by nproide", + "fileset.name": "utm", + "host.name": "ecatcup3022.mail.invalid", + "input.type": "log", + "log.offset": 8878, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.db.index": "nproide", + "rsa.internal.event_desc": "xl2tpd:xl2tpd Software copyright.", + "rsa.internal.messageid": "xl2tpd", + "rsa.network.alias_host": [ + "ecatcup3022.mail.invalid" + ], + "rsa.time.event_time": "2017-08-23T01:52:50.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-09-06T08:55:24.000Z", + "event.code": "ipsec_starter", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:9:6-06:55:24 qui7797.www.host ipsec_starter: Starting strongSwan umet IPsec [starter]...", + "fileset.name": "utm", + "host.name": "qui7797.www.host", + "input.type": "log", + "log.offset": 8951, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]...", + "rsa.internal.messageid": "ipsec_starter", + "rsa.network.alias_host": [ + "qui7797.www.host" + ], + "rsa.time.event_time": "2017-09-06T08:55:24.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-09-20T15:57:58.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:9:20-13:57:58 nofdeFin2037.mail.example reverseproxy: [quatD] [nevol:high] [pid 3994:Sectio] [client tiumdol] [laud] cannot read reply: Operation now in progress (115), referer: https://example.org/tquov/natu.jpg?uianonnu=por#nve", + "fileset.name": "utm", + "host.name": "nofdeFin2037.mail.example", + "http.request.referrer": "https://example.org/tquov/natu.jpg?uianonnu=por#nve", + "input.type": "log", + "log.level": "high", + "log.offset": 9045, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3994, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "nevol", + "rsa.misc.result": "Cannot read reply", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "nofdeFin2037.mail.example" + ], + "rsa.network.gateway": "tiumdol", + "rsa.time.event_time": "2017-09-20T15:57:58.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-10-04T23:00:32.000Z", + "event.code": "sockd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:10:4-21:00:32 sockd[7264]: dante/server 1.3714 running", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 9280, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.3714", + "process.pid": 7264, + "rsa.internal.event_desc": "sockd:dante/server running.", + "rsa.internal.messageid": "sockd", + "rsa.misc.version": "1.3714", + "rsa.time.event_time": "2017-10-04T23:00:32.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-10-19T06:03:07.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:10:19-04:03:07 eFinib2403.api.example reverseproxy: [utaliq] [sun:high] [pid 4074:uredol] [client quatD] [enimad] ecatcu while reading reply from cssd, referer: https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse", + "fileset.name": "utm", + "host.name": "eFinib2403.api.example", + "http.request.referrer": "https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse", + "input.type": "log", + "log.level": "high", + "log.offset": 9340, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 4074, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "ecatcu", + "rsa.misc.event_log": "sun", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "eFinib2403.api.example" + ], + "rsa.network.gateway": "quatD", + "rsa.time.event_time": "2017-10-19T06:03:07.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-11-02T13:05:41.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:11:2-11:05:41 confd[4939]: id=acons severity=high sys=adipisc sub=omnisist name=orroqui client=sci facility=psamvolu user=itsedqui srcip=10.244.96.61 version=1.2707 storage=onevol object=ese class=reprehen type=Exce attributes=toccacount=tinvolu node=ecatc account=iumt", + "file.directory": "onevol", + "fileset.name": "utm", + "input.type": "log", + "log.level": "high", + "log.offset": 9571, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.2707", + "process.pid": 4939, + "related.ip": [ + "10.244.96.61" + ], + "related.user": [ + "iumt", + "itsedqui" + ], + "rsa.identity.logon_type": "psamvolu", + "rsa.internal.event_desc": "orroqui", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "reprehen", + "rsa.misc.node": "ecatc", + "rsa.misc.obj_name": "toccacount=tinvolu", + "rsa.misc.obj_type": "Exce", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2707", + "rsa.time.event_time": "2017-11-02T13:05:41.000Z", + "service.name": "omnisist", + "service.type": "sophos", + "source.ip": [ + "10.244.96.61" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "itsedqui" + }, + { + "@timestamp": "2017-11-16T20:08:15.000Z", + "event.action": "reloading", + "event.code": "named", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:11:16-18:08:15 named[1900]: reloading eddoei iono", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 9846, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1900, + "rsa.internal.messageid": "named", + "rsa.misc.action": [ + "reloading" + ], + "rsa.misc.disposition": "iono", + "rsa.misc.obj_type": "eddoei", + "rsa.time.event_time": "2017-11-16T20:08:15.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-01T03:10:49.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:12:1-01:10:49 obeatae2042.www.domain reverseproxy: [dquian] [isaute:low] [pid 1853:utfugit] (70007)The ula specified has expired: [client quaUteni] AH01110: error reading response", + "fileset.name": "utm", + "host.name": "obeatae2042.www.domain", + "input.type": "log", + "log.level": "low", + "log.offset": 9901, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1853, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "ula", + "rsa.misc.event_id": "AH01110", + "rsa.misc.event_log": "isaute", + "rsa.misc.result": "Error reading response", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "obeatae2042.www.domain" + ], + "rsa.network.gateway": "quaUteni", + "rsa.time.event_time": "2017-12-01T03:10:49.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-15T10:13:24.000Z", + "event.code": "pop3proxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:12:15-08:13:24 aerat1267.www5.example pop3proxy: Master started", + "fileset.name": "utm", + "host.name": "aerat1267.www5.example", + "input.type": "log", + "log.offset": 10086, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "pop3proxy:Master started.", + "rsa.internal.messageid": "pop3proxy", + "rsa.network.alias_host": [ + "aerat1267.www5.example" + ], + "rsa.time.event_time": "2017-12-15T10:13:24.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2017-12-29T17:15:58.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2017:12:29-15:15:58 writt2238.internal.localdomain reverseproxy: [uaer] [aed:low] [pid 478:ain] [client scingeli] [uatDuis] mod_avscan_check_file_single_part() called with parameter filename=imip", + "file.name": "imip", + "fileset.name": "utm", + "host.name": "writt2238.internal.localdomain", + "input.type": "log", + "log.level": "low", + "log.offset": 10155, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 478, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "aed", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "writt2238.internal.localdomain" + ], + "rsa.network.gateway": "scingeli", + "rsa.time.event_time": "2017-12-29T17:15:58.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-01-13T00:18:32.000Z", + "destination.domain": "uatD", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:1:12-22:18:32 siutaliq4937.api.lan reverseproxy: [siutaliq] [urvel:very-high] [pid 7721:ntium] [imadmi] Hostname in dquiac request (liquide) does not match the server name (uatD)", + "fileset.name": "utm", + "host.name": "siutaliq4937.api.lan", + "input.type": "log", + "log.level": "very-high", + "log.offset": 10351, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7721, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.comments": "server certificate has a different hostname from actual hostname", + "rsa.misc.event_log": "urvel", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "siutaliq4937.api.lan" + ], + "rsa.network.network_service": "dquiac", + "rsa.time.event_time": "2018-01-13T00:18:32.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-01-27T07:21:06.000Z", + "event.action": "accept", + "event.code": "URID", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:1:27-05:21:06 URID[7596]: T=BCSedut ------ 1 - [exit] accept: ametco", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 10535, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7596, + "rsa.internal.messageid": "URID", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "ametco", + "rsa.time.event_time": "2018-01-27T07:21:06.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-02-10T14:23:41.000Z", + "destination.address": "tenbyCi4371.www5.localdomain", + "destination.ip": [ + "10.98.126.206" + ], + "destination.mac": "01:00:5e:2f:c3:3e", + "destination.port": 2390, + "event.action": "block", + "event.code": "astarosg_TVM", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:2:10-12:23:41 astarosg_TVM[1090]: id=udex severity=low sys=iam sub=animi name=UDP flood detectedaction=allow method=nsectetu client=spici facility=untutl user=hen srcip=10.214.167.164 dstip=10.76.98.53 version=1.3726 storage=uovolup ad_domain=expl object=animi class=mdoloree type=mullamco attributes=tnulcount=ons node=radip account=amremapstatuscode=dolorsit cached=atisund profile=isnostru filteraction=quepo size=5693 request=nisi url=https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi referer=https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi error=nculp authtime=quamnihi dnstime=nimadmi cattime=mquiado avscantime=agn fullreqtime=dip device=urmag auth=nim ua=laboreet exceptions=tutlabo group=incid category=der categoryname=totamrem content-type=eaqu reputation=itani application=mni app-id=runtmol reason=uaer filename=nor file=saut extension=olest time=volu function=block line=osam message=ncid fwrule=loremagn seq=uisau initf=lo1255 outitf=eth965 dstmac=01:00:5e:2f:c3:3e srcmac=01:00:5e:65:2d:fe proto=ictasun length=iumto tos=ciun prec=;prehe ttl=essec srcport=4562 dstport=2390 tcpflags=uaera info=nsequa prec=yCicero caller=orporis engine=oluptate localip=tesseq host=tenbyCi4371.www5.localdomain extra=spernatu server=10.98.126.206 cookie=tion set-cookie=tNeque", + "file.directory": "uovolup", + "file.extension": "olest", + "file.name": "saut", + "file.size": 5693, + "fileset.name": "utm", + "group.name": "incid", + "http.request.referrer": "https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi", + "input.type": "log", + "log.level": "low", + "log.offset": 10609, + "observer.egress.interface.name": "eth965", + "observer.ingress.interface.name": "lo1255", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.3726", + "process.pid": 1090, + "related.ip": [ + "10.98.126.206", + "10.214.167.164" + ], + "related.user": [ + "hen", + "amremapstatuscode=dolorsit", + "isnostru" + ], + "rsa.db.index": "spernatu", + "rsa.identity.logon_type": "untutl", + "rsa.internal.event_desc": "UDP", + "rsa.internal.messageid": "astarosg_TVM", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "nsectetu", + "block" + ], + "rsa.misc.comments": "uaer", + "rsa.misc.content_type": "eaqu", + "rsa.misc.context": "nsequa", + "rsa.misc.group": "incid", + "rsa.misc.group_object": "mdoloree", + "rsa.misc.node": "radip", + "rsa.misc.obj_name": "tnulcount=ons", + "rsa.misc.obj_type": "mullamco", + "rsa.misc.policy_id": "loremagn", + "rsa.misc.policy_name": "quepo", + "rsa.misc.rule": "udex", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3726", + "rsa.misc.vsys": "iam", + "rsa.network.dinterface": "eth965", + "rsa.network.host_dst": "tenbyCi4371.www5.localdomain", + "rsa.network.sinterface": "lo1255", + "rsa.time.event_time": "2018-02-10T14:23:41.000Z", + "rsa.web.web_cookie": "tion", + "service.name": "animi", + "service.type": "sophos", + "source.ip": [ + "10.214.167.164" + ], + "source.mac": "01:00:5e:65:2d:fe", + "source.port": 4562, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi", + "user.name": "hen" + }, + { + "@timestamp": "2018-02-24T21:26:15.000Z", + "destination.ip": [ + "10.32.236.117" + ], + "destination.mac": "01:00:5e:9a:fe:91", + "destination.port": 5550, + "event.code": "ulogd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:2:24-19:26:15 ulogd[6722]: id=persp severity=medium sys=orev sub=lapa name=Packet logged action=allow fwrule=adminim seq=isiutali initf=lo7088 outitf=eth6357 dstmac=01:00:5e:9a:fe:91 srcmac=01:00:5e:78:1a:5a srcip=10.203.157.250 dstip=10.32.236.117 proto=turm length=quamei tos=nvento prec=nama ttl=ema srcport=6585 dstport=5550 tcpflags=xeacomm info=oriosa code=erspici type=oreeu", + "fileset.name": "utm", + "input.type": "log", + "log.level": "medium", + "log.offset": 11911, + "observer.egress.interface.name": "eth6357", + "observer.ingress.interface.name": "lo7088", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6722, + "related.ip": [ + "10.32.236.117", + "10.203.157.250" + ], + "rsa.internal.event_desc": "Packet", + "rsa.internal.messageid": "ulogd", + "rsa.investigations.ec_activity": "Scan", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "TEV", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.context": "oriosa", + "rsa.misc.policy_id": "adminim", + "rsa.misc.rule": "persp", + "rsa.misc.severity": "medium", + "rsa.misc.vsys": "orev", + "rsa.network.dinterface": "eth6357", + "rsa.network.network_service": "lapa", + "rsa.network.sinterface": "lo7088", + "rsa.time.event_time": "2018-02-24T21:26:15.000Z", + "service.type": "sophos", + "source.ip": [ + "10.203.157.250" + ], + "source.mac": "01:00:5e:78:1a:5a", + "source.port": 6585, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-03-11T04:28:49.000Z", + "destination.ip": [ + "10.231.77.26" + ], + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:3:11-02:28:49 ectob5542.www5.corp reverseproxy: [agni] [ivelit:high] [pid 7755:uovol] AH00959: ap_proxy_connect_backend disabling worker for (10.231.77.26) for volups", + "fileset.name": "utm", + "host.name": "ectob5542.www5.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 12298, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7755, + "related.ip": [ + "10.231.77.26" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH00959", + "rsa.misc.event_log": "ivelit", + "rsa.misc.result": "disabling worker", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ectob5542.www5.corp" + ], + "rsa.time.event_time": "2018-03-11T04:28:49.000Z", + "rsa.time.process_time": "volup", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-03-25T11:31:24.000Z", + "destination.address": "tenima5715.api.example", + "destination.ip": [ + "10.92.93.236" + ], + "destination.mac": "01:00:5e:0a:8f:6c", + "destination.port": 6939, + "event.action": "block", + "event.code": "httpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:3:25-09:31:24 iusmo901.www.home httpd: id=scivelit severity=high sys=untut sub=siu name=Authentication successfulaction=allow method=icons client=hende facility=umdol user=Sedutper srcip=10.2.24.156 dstip=10.113.78.101 version=1.2707 storage=amqua ad_domain=nsequatu object=aboNemoe class=mqu type=tse attributes=ntiumdcount=ueip node=amvo account=dolorsistatuscode=acc cached=quinesc profile=ulpaq filteraction=usa size=5474 request=tob url=https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru referer=https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo error=avolup authtime=litse dnstime=archit cattime=nde avscantime=tNequepo fullreqtime=byCicer device=imvenia auth=ipit ua=tdolorem exceptions=nderitin group=mquiado category=ssequa categoryname=nisist content-type=temvele reputation=ofd application=quam app-id=umdol reason=porincid filename=tisetqu file=pici extension=erit time=ehenderi function=block line=fugiatqu message=Duisaute fwrule=uptat seq=hende initf=lo3680 outitf=lo4358 dstmac=01:00:5e:0a:8f:6c srcmac=01:00:5e:34:8c:d2 proto=mnis length=ainci tos=aturve prec=;tiumdol ttl=mporain srcport=6938 dstport=6939 tcpflags=dut info=aecons prec=tionemu caller=edictasu engine=quipexea localip=orsit host=tenima5715.api.example extra=snisiut server=10.92.93.236 cookie=amr set-cookie=mfug port=7174 query=exerc uid=ntoccae", + "file.directory": "amqua", + "file.extension": "erit", + "file.name": "pici", + "file.size": 5474, + "fileset.name": "utm", + "group.name": "mquiado", + "host.name": "iusmo901.www.home", + "http.request.referrer": "https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo", + "input.type": "log", + "log.level": "high", + "log.offset": 12470, + "observer.egress.interface.name": "lo4358", + "observer.ingress.interface.name": "lo3680", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.2707", + "related.ip": [ + "10.2.24.156", + "10.92.93.236" + ], + "related.user": [ + "ulpaq", + "ntoccae", + "dolorsistatuscode=acc", + "Sedutper" + ], + "rsa.db.index": "snisiut", + "rsa.identity.logon_type": "umdol", + "rsa.internal.event_desc": "Authentication", + "rsa.internal.messageid": "httpd", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "block", + "icons" + ], + "rsa.misc.comments": "porincid", + "rsa.misc.content_type": "temvele", + "rsa.misc.context": "aecons", + "rsa.misc.group": "mquiado", + "rsa.misc.group_object": "mqu", + "rsa.misc.node": "amvo", + "rsa.misc.obj_name": "ntiumdcount=ueip", + "rsa.misc.obj_type": "tse", + "rsa.misc.policy_id": "uptat", + "rsa.misc.policy_name": "usa", + "rsa.misc.rule": "scivelit", + "rsa.misc.severity": "high", + "rsa.misc.version": "1.2707", + "rsa.misc.vsys": "untut", + "rsa.network.alias_host": [ + "iusmo901.www.home" + ], + "rsa.network.dinterface": "lo4358", + "rsa.network.host_dst": "tenima5715.api.example", + "rsa.network.network_port": 7174, + "rsa.network.sinterface": "lo3680", + "rsa.time.event_time": "2018-03-25T11:31:24.000Z", + "rsa.web.web_cookie": "amr", + "service.name": "siu", + "service.type": "sophos", + "source.ip": [ + "10.2.24.156" + ], + "source.mac": "01:00:5e:34:8c:d2", + "source.port": 6938, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru", + "url.query": "exerc", + "user.name": "Sedutper" + }, + { + "@timestamp": "2018-04-08T18:33:58.000Z", + "destination.address": "mni4032.lan", + "destination.ip": [ + "10.202.65.2" + ], + "destination.mac": "01:00:5e:2c:9d:65", + "destination.port": 1402, + "event.action": "cancel", + "event.code": "astarosg_TVM", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:4:8-16:33:58 astarosg_TVM[6463]: id=user severity=low sys=sequamn sub=adeseru name=File extension warned and proceededaction=accept method=mquisn client=ulamcol facility=nulamcol user=atatno srcip=10.180.169.49 dstip=10.206.69.71 version=1.3155 storage=risni ad_domain=ccaecat object=dtemp class=onproid type=ica attributes=mnisiscount=edolor node=nonnumqu account=iscivelistatuscode=urve cached=sundeomn profile=tasu filteraction=equunt size=3144 request=ilmo url=https://mail.example.net/isqua/deF.html?iameaq=orainci#adm referer=https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria error=tessec authtime=cupida dnstime=ciade cattime=busBonor avscantime=enima fullreqtime=emseq device=osamni auth=umetMa ua=equatDui exceptions=its group=setquas category=nti categoryname=osamnis content-type=atisetqu reputation=ciduntut application=atisu app-id=edutpe reason=architec filename=incul file=tevelit extension=emse time=eipsaqua function=cancel line=suntincu message=lore fwrule=equatu seq=enbyCi initf=enp0s566 outitf=lo2179 dstmac=01:00:5e:2c:9d:65 srcmac=01:00:5e:1a:03:f5 proto=orema length=iusmo tos=uunturm prec=;mSect ttl=avolupta srcport=3308 dstport=1402 tcpflags=dolo info=tsed prec=corpori caller=cillumd engine=umdol localip=turmagn host=mni4032.lan extra=amrem server=10.202.65.2 cookie=queporr set-cookie=oide", + "file.directory": "risni", + "file.extension": "emse", + "file.name": "tevelit", + "file.size": 3144, + "fileset.name": "utm", + "group.name": "setquas", + "http.request.referrer": "https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria", + "input.type": "log", + "log.level": "low", + "log.offset": 13825, + "observer.egress.interface.name": "lo2179", + "observer.ingress.interface.name": "enp0s566", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.3155", + "process.pid": 6463, + "related.ip": [ + "10.180.169.49", + "10.202.65.2" + ], + "related.user": [ + "tasu", + "iscivelistatuscode=urve", + "atatno" + ], + "rsa.db.index": "amrem", + "rsa.identity.logon_type": "nulamcol", + "rsa.internal.event_desc": "File", + "rsa.internal.messageid": "astarosg_TVM", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "mquisn", + "cancel" + ], + "rsa.misc.comments": "architec", + "rsa.misc.content_type": "atisetqu", + "rsa.misc.context": "tsed", + "rsa.misc.group": "setquas", + "rsa.misc.group_object": "onproid", + "rsa.misc.node": "nonnumqu", + "rsa.misc.obj_name": "mnisiscount=edolor", + "rsa.misc.obj_type": "ica", + "rsa.misc.policy_id": "equatu", + "rsa.misc.policy_name": "equunt", + "rsa.misc.rule": "user", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.3155", + "rsa.misc.vsys": "sequamn", + "rsa.network.dinterface": "lo2179", + "rsa.network.host_dst": "mni4032.lan", + "rsa.network.sinterface": "enp0s566", + "rsa.time.event_time": "2018-04-08T18:33:58.000Z", + "rsa.web.web_cookie": "queporr", + "service.name": "adeseru", + "service.type": "sophos", + "source.ip": [ + "10.180.169.49" + ], + "source.mac": "01:00:5e:1a:03:f5", + "source.port": 3308, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://mail.example.net/isqua/deF.html?iameaq=orainci#adm", + "user.name": "atatno" + }, + { + "@timestamp": "2018-04-23T01:36:32.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:4:22-23:36:32 iscing6960.api.invalid reverseproxy: [emipsu] [incidu:very-high] [pid 5350:itation] SSL Library Error: error:itasper:failure", + "fileset.name": "utm", + "host.name": "iscing6960.api.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 15157, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5350, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.context": "SSL Library Error", + "rsa.misc.event_log": "incidu", + "rsa.misc.result": "failure", + "rsa.misc.result_code": "itasper", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "iscing6960.api.invalid" + ], + "rsa.time.event_time": "2018-04-23T01:36:32.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-05-07T08:39:06.000Z", + "destination.address": "olupta3647.host", + "event.code": "httpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:5:7-06:39:06 httpd[793]: [ruredo:success] [pid nculpaq:mides] [client iconseq] ModSecurity: Warning. nidolo [file \"runtmoll\"] [line \"tuserror\"] [id \"utlabo\"] [rev \"scip\"] [msg \"imvenia\"] [severity \"low\"] [ver \"1.6420\"] [maturity \"nisi\"] [accuracy \"seq\"] [tag \"ors\"] [hostname \"olupta3647.host\"] [uri \"uaUteni\"] [unique_id \"gitsedqu\"]amqu", + "file.name": "runtmoll", + "fileset.name": "utm", + "input.type": "log", + "log.level": "low", + "log.offset": 15301, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.6420", + "process.pid": 793, + "rsa.internal.event_desc": "imvenia", + "rsa.internal.messageid": "httpd", + "rsa.misc.event_log": "ruredo", + "rsa.misc.operation_id": "gitsedqu", + "rsa.misc.result": "success", + "rsa.misc.rule": "utlabo", + "rsa.misc.rule_name": "nidolo", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.6420", + "rsa.network.gateway": "iconseq", + "rsa.network.host_dst": "olupta3647.host", + "rsa.time.event_time": "2018-05-07T08:39:06.000Z", + "rule.name": "nidolo", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "uaUteni" + }, + { + "@timestamp": "2018-05-21T15:41:41.000Z", + "event.code": "named", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:5:21-13:41:41 named[6633]: FORMERR resolving 'iavolu7814.www5.localhost': 10.194.12.83#elit", + "fileset.name": "utm", + "host.name": "iavolu7814.www5.localhost", + "input.type": "log", + "log.offset": 15644, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6633, + "related.ip": [ + "10.194.12.83" + ], + "rsa.internal.event_desc": "named:FORMERR resolving DNS.", + "rsa.internal.messageid": "named", + "rsa.network.alias_host": [ + "iavolu7814.www5.localhost" + ], + "rsa.time.event_time": "2018-05-21T15:41:41.000Z", + "service.type": "sophos", + "source.ip": [ + "10.194.12.83" + ], + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-06-04T22:44:15.000Z", + "destination.address": "obea2960.mail.corp", + "destination.ip": [ + "10.45.12.53" + ], + "destination.mac": "01:00:5e:24:b8:9f", + "destination.port": 6937, + "event.action": "cancel", + "event.code": "astarosg_TVM", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:6:4-20:44:15 astarosg_TVM[5792]: id=elitess severity=low sys=amqua sub=mavenia name=checking if admin is enabledaction=cancel method=doc client=teurs facility=eturadi user=eturadip srcip=10.33.138.154 dstip=10.254.28.41 version=1.4256 storage=volupta ad_domain=dolor object=dolorsit class=tfugits type=lor attributes=oremcount=utper node=ueips account=umqustatuscode=ntexpli cached=siuta profile=porincid filteraction=itame size=1026 request=fugiat url=https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf referer=https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol error=emul authtime=ariatu dnstime=luptate cattime=umdolore avscantime=iutaliq fullreqtime=oriosamn device=oluptate auth=tcu ua=mmodo exceptions=rauto group=lup category=orem categoryname=tutl content-type=iusmo reputation=uiavolu application=eri app-id=pis reason=riosam filename=isa file=nonnum extension=Nemoenim time=itati function=cancel line=nes message=atvolupt fwrule=umwritt seq=uae initf=enp0s3792 outitf=lo2114 dstmac=01:00:5e:24:b8:9f srcmac=01:00:5e:a1:a3:9f proto=bil length=itten tos=icer prec=;dolo ttl=siutaliq srcport=1455 dstport=6937 tcpflags=pexeaco info=ercitati prec=dexea caller=tasnul engine=onu localip=orisnisi host=obea2960.mail.corp extra=dolor server=10.45.12.53 cookie=etdo set-cookie=edictas", + "file.directory": "volupta", + "file.extension": "Nemoenim", + "file.name": "nonnum", + "file.size": 1026, + "fileset.name": "utm", + "group.name": "lup", + "http.request.referrer": "https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol", + "input.type": "log", + "log.level": "low", + "log.offset": 15741, + "observer.egress.interface.name": "lo2114", + "observer.ingress.interface.name": "enp0s3792", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.4256", + "process.pid": 5792, + "related.ip": [ + "10.33.138.154", + "10.45.12.53" + ], + "related.user": [ + "umqustatuscode=ntexpli", + "porincid", + "eturadip" + ], + "rsa.db.index": "dolor", + "rsa.identity.logon_type": "eturadi", + "rsa.internal.event_desc": "checking", + "rsa.internal.messageid": "astarosg_TVM", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "doc", + "cancel" + ], + "rsa.misc.comments": "riosam", + "rsa.misc.content_type": "iusmo", + "rsa.misc.context": "ercitati", + "rsa.misc.group": "lup", + "rsa.misc.group_object": "tfugits", + "rsa.misc.node": "ueips", + "rsa.misc.obj_name": "oremcount=utper", + "rsa.misc.obj_type": "lor", + "rsa.misc.policy_id": "umwritt", + "rsa.misc.policy_name": "itame", + "rsa.misc.rule": "elitess", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.4256", + "rsa.misc.vsys": "amqua", + "rsa.network.dinterface": "lo2114", + "rsa.network.host_dst": "obea2960.mail.corp", + "rsa.network.sinterface": "enp0s3792", + "rsa.time.event_time": "2018-06-04T22:44:15.000Z", + "rsa.web.web_cookie": "etdo", + "service.name": "mavenia", + "service.type": "sophos", + "source.ip": [ + "10.33.138.154" + ], + "source.mac": "01:00:5e:a1:a3:9f", + "source.port": 1455, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf", + "user.name": "eturadip" + }, + { + "@timestamp": "2018-06-19T05:46:49.000Z", + "event.code": "frox", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:6:19-03:46:49 frox[7744]: Listening on 10.99.134.49:2274", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 17056, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7744, + "related.ip": [ + "10.99.134.49" + ], + "rsa.internal.event_desc": "frox:FTP Proxy listening on port.", + "rsa.internal.messageid": "frox", + "rsa.time.event_time": "2018-06-19T05:46:49.000Z", + "service.type": "sophos", + "source.ip": [ + "10.99.134.49" + ], + "source.port": 2274, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-03T12:49:23.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:7:3-10:49:23 olli5982.www.test reverseproxy: [asp] [uatDui:medium] [pid 212:unde] [client raut] [suscip] virus daemon error found in request ectetu, referer: https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid", + "fileset.name": "utm", + "host.name": "olli5982.www.test", + "http.request.referrer": "https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid", + "input.type": "log", + "log.level": "medium", + "log.offset": 17118, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 212, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "uatDui", + "rsa.misc.result": "virus daemon error", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "olli5982.www.test" + ], + "rsa.network.gateway": "raut", + "rsa.time.event_time": "2018-07-03T12:49:23.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "ectetu" + }, + { + "@timestamp": "2018-07-17T19:51:58.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:7:17-17:51:58 nsecte3644.internal.test reverseproxy: [tutla] [isund:high] [pid 3136:uidex] [client uptate] Invalid signature, cookie: JSESSIONID", + "fileset.name": "utm", + "host.name": "nsecte3644.internal.test", + "input.type": "log", + "log.level": "high", + "log.offset": 17338, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3136, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "isund", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "nsecte3644.internal.test" + ], + "rsa.network.gateway": "uptate", + "rsa.time.event_time": "2018-07-17T19:51:58.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-01T02:54:32.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:8:1-00:54:32 confd[4157]: id=onseq severity=very-high sys=siutaliq sub=aliqu name=serro client=ctet facility=umiurere user=antium srcip=10.32.85.21 version=1.7852 storage=eaco object=onp class=ectetur type=ione attributes=utlaborecount=nci node=acommodi account=etconsec", + "file.directory": "eaco", + "fileset.name": "utm", + "input.type": "log", + "log.level": "very-high", + "log.offset": 17488, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.7852", + "process.pid": 4157, + "related.ip": [ + "10.32.85.21" + ], + "related.user": [ + "etconsec", + "antium" + ], + "rsa.identity.logon_type": "umiurere", + "rsa.internal.event_desc": "serro", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "ectetur", + "rsa.misc.node": "acommodi", + "rsa.misc.obj_name": "utlaborecount=nci", + "rsa.misc.obj_type": "ione", + "rsa.misc.severity": "very-high", + "rsa.misc.version": "1.7852", + "rsa.time.event_time": "2018-08-01T02:54:32.000Z", + "service.name": "aliqu", + "service.type": "sophos", + "source.ip": [ + "10.32.85.21" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "antium" + }, + { + "@timestamp": "2018-08-15T09:57:06.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:8:15-07:57:06 econseq7119.www.home sshd: error: Could not get shadow information for NOUSER", + "fileset.name": "utm", + "host.name": "econseq7119.www.home", + "input.type": "log", + "log.offset": 17764, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "sshd:error:Could not get shadow information for NOUSER", + "rsa.internal.messageid": "sshd", + "rsa.network.alias_host": [ + "econseq7119.www.home" + ], + "rsa.time.event_time": "2018-08-15T09:57:06.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-08-29T16:59:40.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:8:29-14:59:40 ant2543.www5.lan reverseproxy: [uaturve] [lapa:high] [pid 3669:idu] [client sed] [utem] cannot read reply: Operation now in progress (115), referer: https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo", + "fileset.name": "utm", + "host.name": "ant2543.www5.lan", + "http.request.referrer": "https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo", + "input.type": "log", + "log.level": "high", + "log.offset": 17861, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 3669, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "lapa", + "rsa.misc.result": "Cannot read reply", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ant2543.www5.lan" + ], + "rsa.network.gateway": "sed", + "rsa.time.event_time": "2018-08-29T16:59:40.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-09-13T00:02:15.000Z", + "event.action": "accept", + "event.code": "pluto", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:9:12-22:02:15 pluto[7138]: | sent accept notification olore with seqno = urEx", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 18090, + "log.original": "olore", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7138, + "rsa.internal.messageid": "pluto", + "rsa.internal.msg": "olore", + "rsa.misc.action": [ + "accept" + ], + "rsa.time.event_time": "2018-09-13T00:02:15.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-09-27T07:04:49.000Z", + "destination.address": "nisiuta4810.api.test", + "destination.ip": [ + "10.85.200.58" + ], + "destination.mac": "01:00:5e:b3:e3:90", + "destination.port": 605, + "event.action": "cancel", + "event.code": "httpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:9:27-05:04:49 httpd[6562]: id=iurere severity=medium sys=erc sub=atu name=http accessaction=accept method=odte client=uis facility=sedquia user=reetd srcip=10.210.175.52 dstip=10.87.14.186 version=1.7641 storage=tasu ad_domain=mquae object=CSedu class=atae type=aeconseq attributes=boNemocount=duntutla node=mqu account=inimastatuscode=emipsum cached=venia profile=Loremi filteraction=uisnostr size=849 request=vol url=https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq referer=https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid error=mipsa authtime=teturad dnstime=nimide cattime=spernat avscantime=nevolu fullreqtime=itectobe device=rroq auth=itessequ ua=uunt exceptions=pic group=unt category=emUt categoryname=eiru content-type=sauteir reputation=pic application=caecatc app-id=iarc reason=emquia filename=duntutl file=idi extension=reetdo time=pidatatn function=cancel line=ncul message=mcorpor fwrule=ofd seq=lapariat initf=eth65 outitf=lo3615 dstmac=01:00:5e:b3:e3:90 srcmac=01:00:5e:0e:b3:8e proto=consequ length=min tos=riame prec=;gnaal ttl=nti srcport=1125 dstport=605 tcpflags=utlab info=colabo prec=ditem caller=did engine=BCS localip=idex host=nisiuta4810.api.test extra=apa server=10.85.200.58 cookie=esse set-cookie=idexeac port=2294 query=iatquovo uid=rExce", + "file.directory": "tasu", + "file.extension": "reetdo", + "file.name": "idi", + "file.size": 849, + "fileset.name": "utm", + "group.name": "unt", + "http.request.referrer": "https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid", + "input.type": "log", + "log.level": "medium", + "log.offset": 18173, + "observer.egress.interface.name": "lo3615", + "observer.ingress.interface.name": "eth65", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.7641", + "process.pid": 6562, + "related.ip": [ + "10.210.175.52", + "10.85.200.58" + ], + "related.user": [ + "reetd", + "inimastatuscode=emipsum", + "Loremi", + "rExce" + ], + "rsa.db.index": "apa", + "rsa.identity.logon_type": "sedquia", + "rsa.internal.event_desc": "http", + "rsa.internal.messageid": "httpd", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.action": [ + "cancel", + "odte" + ], + "rsa.misc.comments": "emquia", + "rsa.misc.content_type": "sauteir", + "rsa.misc.context": "colabo", + "rsa.misc.group": "unt", + "rsa.misc.group_object": "atae", + "rsa.misc.node": "mqu", + "rsa.misc.obj_name": "boNemocount=duntutla", + "rsa.misc.obj_type": "aeconseq", + "rsa.misc.policy_id": "ofd", + "rsa.misc.policy_name": "uisnostr", + "rsa.misc.rule": "iurere", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7641", + "rsa.misc.vsys": "erc", + "rsa.network.dinterface": "lo3615", + "rsa.network.host_dst": "nisiuta4810.api.test", + "rsa.network.network_port": 2294, + "rsa.network.sinterface": "eth65", + "rsa.time.event_time": "2018-09-27T07:04:49.000Z", + "rsa.web.web_cookie": "esse", + "service.name": "atu", + "service.type": "sophos", + "source.ip": [ + "10.210.175.52" + ], + "source.mac": "01:00:5e:0e:b3:8e", + "source.port": 1125, + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.original": "https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq", + "url.query": "iatquovo", + "user.name": "reetd" + }, + { + "@timestamp": "2018-10-11T14:07:23.000Z", + "destination.ip": [ + "10.115.166.48" + ], + "destination.mac": "01:00:5e:c3:8a:24", + "destination.port": 4884, + "event.code": "ulogd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:10:11-12:07:23 itametc1599.api.test ulogd: id=itaedi severity=low sys=ore sub=ips name=Authentication successful action=block fwrule=iamqu seq=aboN initf=eth2679 outitf=enp0s1164 dstmac=01:00:5e:c3:8a:24 srcmac=01:00:5e:5a:9d:a9 srcip=10.133.45.45 dstip=10.115.166.48 proto=utaliq length=icer tos=essequ prec=oeiu ttl=nsequa srcport=4180 dstport=4884 tcpflags=squa info=etM code=eve type=iru", + "fileset.name": "utm", + "host.name": "itametc1599.api.test", + "input.type": "log", + "log.level": "low", + "log.offset": 19485, + "observer.egress.interface.name": "enp0s1164", + "observer.ingress.interface.name": "eth2679", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.115.166.48", + "10.133.45.45" + ], + "rsa.internal.event_desc": "Authentication", + "rsa.internal.messageid": "ulogd", + "rsa.investigations.ec_activity": "Scan", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "TEV", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.context": "etM", + "rsa.misc.policy_id": "iamqu", + "rsa.misc.rule": "itaedi", + "rsa.misc.severity": "low", + "rsa.misc.vsys": "ore", + "rsa.network.alias_host": [ + "itametc1599.api.test" + ], + "rsa.network.dinterface": "enp0s1164", + "rsa.network.network_service": "ips", + "rsa.network.sinterface": "eth2679", + "rsa.time.event_time": "2018-10-11T14:07:23.000Z", + "service.type": "sophos", + "source.ip": [ + "10.133.45.45" + ], + "source.mac": "01:00:5e:5a:9d:a9", + "source.port": 4180, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-25T21:09:57.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:10:25-19:09:57 tiumt5462.mail.localhost sshd: Invalid user admin from runt", + "fileset.name": "utm", + "host.name": "tiumt5462.mail.localhost", + "input.type": "log", + "log.offset": 19882, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "sshd:Invalid user admin.", + "rsa.internal.messageid": "sshd", + "rsa.network.alias_host": [ + "tiumt5462.mail.localhost" + ], + "rsa.time.event_time": "2018-10-25T21:09:57.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-11-09T04:12:32.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:11:9-02:12:32 vol1450.internal.host sshd: Server listening on 10.71.184.162 port 3506.", + "fileset.name": "utm", + "host.name": "vol1450.internal.host", + "input.type": "log", + "log.offset": 19962, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.71.184.162" + ], + "rsa.internal.event_desc": "sshd:Server listening; restarting.", + "rsa.internal.messageid": "sshd", + "rsa.network.alias_host": [ + "vol1450.internal.host" + ], + "rsa.time.event_time": "2018-11-09T04:12:32.000Z", + "service.type": "sophos", + "source.ip": [ + "10.71.184.162" + ], + "source.port": 3506, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-11-23T11:15:06.000Z", + "event.code": "ipsec_starter", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:11:23-09:15:06 ipsec_starter[178]: IP address or index of physical interface changed -> reinit of ipsec interface", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 20054, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 178, + "rsa.internal.event_desc": "ipsec_starter: IP address or index of physical interface changed.", + "rsa.internal.messageid": "ipsec_starter", + "rsa.time.event_time": "2018-11-23T11:15:06.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-12-07T18:17:40.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:12:7-16:17:40 rporissu573.api.test reverseproxy: [exercita] [emaperi:very-high] [pid 5943:ddoei] AH02312: Fatal error initialising mod_ssl, nihi.", + "fileset.name": "utm", + "host.name": "rporissu573.api.test", + "input.type": "log", + "log.level": "very-high", + "log.offset": 20173, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5943, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "nihi", + "rsa.misc.event_id": "AH02312", + "rsa.misc.event_log": "emaperi", + "rsa.misc.result": "Fatal error", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "rporissu573.api.test" + ], + "rsa.time.event_time": "2018-12-07T18:17:40.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2018-12-22T01:20:14.000Z", + "event.action": "allow", + "event.code": "URID", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2018:12:21-23:20:14 nostru774.corp URID: T=tatnonp ------ 1 - [exit] allow: natuserr", + "fileset.name": "utm", + "host.name": "nostru774.corp", + "input.type": "log", + "log.offset": 20324, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.messageid": "URID", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.disposition": "natuserr", + "rsa.network.alias_host": [ + "nostru774.corp" + ], + "rsa.time.event_time": "2018-12-22T01:20:14.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-05T08:22:49.000Z", + "event.code": "ipsec_starter", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:1:5-06:22:49 ipsec_starter[6226]: IP address or index of physical interface changed -> reinit of ipsec interface", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 20409, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6226, + "rsa.internal.event_desc": "ipsec_starter: IP address or index of physical interface changed.", + "rsa.internal.messageid": "ipsec_starter", + "rsa.time.event_time": "2019-01-05T08:22:49.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-01-19T15:25:23.000Z", + "destination.address": "lorsita2216.www5.example", + "event.code": "httpd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:1:19-13:25:23 httpd[5037]: [iadese:unknown] [pid isundeo:emq] [client rehender] ModSecurity: Warning. uat [file \"apa\"] [line \"tani\"] [id \"per\"] [rev \"ngelitse\"] [msg \"olorsita\"] [severity \"medium\"] [ver \"1.7102\"] [maturity \"apariat\"] [accuracy \"iuntNequ\"] [tag \"rExc\"] [hostname \"lorsita2216.www5.example\"] [uri \"turvelil\"] [unique_id \"velitsed\"]rau", + "file.name": "apa", + "fileset.name": "utm", + "input.type": "log", + "log.level": "medium", + "log.offset": 20527, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.7102", + "process.pid": 5037, + "rsa.internal.event_desc": "olorsita", + "rsa.internal.messageid": "httpd", + "rsa.misc.event_log": "iadese", + "rsa.misc.operation_id": "velitsed", + "rsa.misc.result": "unknown", + "rsa.misc.rule": "per", + "rsa.misc.rule_name": "uat", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.7102", + "rsa.network.gateway": "rehender", + "rsa.network.host_dst": "lorsita2216.www5.example", + "rsa.time.event_time": "2019-01-19T15:25:23.000Z", + "rule.name": "uat", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "turvelil" + }, + { + "@timestamp": "2019-02-02T22:27:57.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:2:2-20:27:57 sum2208.host reverseproxy: [eir] [nia:medium] [pid 4346:mco] [client ritinvol] [quioffi] mod_avscan_check_file_single_part() called with parameter filename=quamquae", + "file.name": "quamquae", + "fileset.name": "utm", + "host.name": "sum2208.host", + "input.type": "log", + "log.level": "medium", + "log.offset": 20882, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 4346, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "nia", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "sum2208.host" + ], + "rsa.network.gateway": "ritinvol", + "rsa.time.event_time": "2019-02-02T22:27:57.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-02-17T05:30:32.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:2:17-03:30:32 ore6843.local reverseproxy: [usmodite] [aveniam:medium] [pid 5126:xplicab] [client taev] No signature found, cookie: dictasu", + "fileset.name": "utm", + "host.name": "ore6843.local", + "input.type": "log", + "log.level": "medium", + "log.offset": 21065, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5126, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.comments": "No signature on cookie", + "rsa.misc.event_log": "aveniam", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "ore6843.local" + ], + "rsa.network.gateway": "taev", + "rsa.time.event_time": "2019-02-17T05:30:32.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-03T12:33:06.000Z", + "destination.ip": [ + "10.177.35.133" + ], + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:3:3-10:33:06 Sedu1610.mail.corp reverseproxy: [audant] [porr:medium] [pid 7442:tation] [client uunturma] AH01114: cons: failed to make connection to backend: 10.177.35.133", + "fileset.name": "utm", + "host.name": "Sedu1610.mail.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 21209, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7442, + "related.ip": [ + "10.177.35.133" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH01114", + "rsa.misc.event_log": "porr", + "rsa.misc.result": "Backend connection failed", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "Sedu1610.mail.corp" + ], + "rsa.network.gateway": "uunturma", + "rsa.network.network_service": "cons", + "rsa.time.event_time": "2019-03-03T12:33:06.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-03-17T19:35:40.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:3:17-17:35:40 corpo6737.example reverseproxy: [officiad] [aliquide:very-high] [pid 6600:errorsi] [client raincidu] [orincidi] cannot connect: failure (111)", + "fileset.name": "utm", + "host.name": "corpo6737.example", + "input.type": "log", + "log.level": "very-high", + "log.offset": 21386, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6600, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "aliquide", + "rsa.misc.result": "failure", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "corpo6737.example" + ], + "rsa.network.gateway": "raincidu", + "rsa.time.event_time": "2019-03-17T19:35:40.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-01T02:38:14.000Z", + "event.code": "pop3proxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:4:1-00:38:14 pop3proxy[6854]: Master started", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 21547, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6854, + "rsa.internal.event_desc": "pop3proxy:Master started.", + "rsa.internal.messageid": "pop3proxy", + "rsa.time.event_time": "2019-04-01T02:38:14.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-15T09:40:49.000Z", + "event.code": "pop3proxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:4:15-07:40:49 eratvol314.www.home pop3proxy: Master started", + "fileset.name": "utm", + "host.name": "eratvol314.www.home", + "input.type": "log", + "log.offset": 21597, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "pop3proxy:Master started.", + "rsa.internal.messageid": "pop3proxy", + "rsa.network.alias_host": [ + "eratvol314.www.home" + ], + "rsa.time.event_time": "2019-04-15T09:40:49.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-29T16:43:23.000Z", + "destination.address": "seosquir715.local", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:4:29-14:43:23 utemvele1838.mail.test reverseproxy: [xplicabo] [aco:high] [pid 2389:ratione] [client nrepr] ModSecurity: Warning. uipex [file \"alorumw\"] [line \"nibus\"] [id \"eiusmo\"] [msg \"rci\"] [hostname \"seosquir715.local\"] [uri \"ercitati\"] [unique_id \"uiration\"]", + "file.name": "alorumw", + "fileset.name": "utm", + "host.name": "utemvele1838.mail.test", + "input.type": "log", + "log.level": "high", + "log.offset": 21662, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2389, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.comments": "rci", + "rsa.misc.event_log": "aco", + "rsa.misc.operation_id": "uiration", + "rsa.misc.result": "high", + "rsa.misc.rule": "eiusmo", + "rsa.misc.rule_name": "uipex", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "utemvele1838.mail.test" + ], + "rsa.network.gateway": "nrepr", + "rsa.network.host_dst": "seosquir715.local", + "rsa.time.event_time": "2019-04-29T16:43:23.000Z", + "rule.name": "uipex", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ], + "url.path": "ercitati" + }, + { + "@timestamp": "2019-05-13T23:45:57.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:5:13-21:45:57 ulapari2656.local reverseproxy: [itessec] [non:very-high] [pid 2237:licaboN] [client nvol] [moenimip] cannot connect: failure (111)", + "fileset.name": "utm", + "host.name": "ulapari2656.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 21931, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2237, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_log": "non", + "rsa.misc.result": "failure", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "ulapari2656.local" + ], + "rsa.network.gateway": "nvol", + "rsa.time.event_time": "2019-05-13T23:45:57.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-05-28T06:48:31.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:5:28-04:48:31 reverseproxy[4278]: [ritat] [iscinge:very-high] [pid 4264:rroquisq] [client tnonpro] [nimv] erunt while reading reply from cssd, referer: https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor", + "fileset.name": "utm", + "http.request.referrer": "https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor", + "input.type": "log", + "log.level": "very-high", + "log.offset": 22082, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 4264, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "erunt", + "rsa.misc.event_log": "iscinge", + "rsa.misc.severity": "very-high", + "rsa.network.gateway": "tnonpro", + "rsa.time.event_time": "2019-05-28T06:48:31.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-11T13:51:06.000Z", + "event.action": "cancel", + "event.code": "URID", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:6:11-11:51:06 URID[7418]: T=xer ------ 1 - [exit] cancel: onemul", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 22301, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7418, + "rsa.internal.messageid": "URID", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.disposition": "onemul", + "rsa.time.event_time": "2019-06-11T13:51:06.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-06-25T20:53:40.000Z", + "event.action": "ips", + "event.code": "pluto", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:6:25-18:53:40 pluto[7201]: | handling event ips for 10.165.217.56 \"econse\" #otamr", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 22371, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7201, + "related.ip": [ + "10.165.217.56" + ], + "rsa.internal.messageid": "pluto", + "rsa.misc.event_type": "ips", + "rsa.time.event_time": "2019-06-25T20:53:40.000Z", + "service.type": "sophos", + "source.ip": [ + "10.165.217.56" + ], + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-10T03:56:14.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:7:10-01:56:14 stla2856.host reverseproxy: [onpro] [adolo:very-high] [pid 7766:siste] ModSecurity for Apache/nisiut (ostr) configured.", + "fileset.name": "utm", + "host.name": "stla2856.host", + "input.type": "log", + "log.level": "very-high", + "log.offset": 22458, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7766, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.disposition": "configured", + "rsa.misc.event_log": "adolo", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "stla2856.host" + ], + "rsa.time.event_time": "2019-07-10T03:56:14.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-07-24T10:58:48.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:7:24-08:58:48 peri6748.www5.domain reverseproxy: [cingeli] [esseq:high] [pid 2404:aquae] AH00098: pid file otamrema overwritten -- Unclean shutdown of previous Apache run?", + "file.name": "otamrema", + "fileset.name": "utm", + "host.name": "peri6748.www5.domain", + "input.type": "log", + "log.level": "high", + "log.offset": 22597, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2404, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.context": "Unclean shutdown", + "rsa.misc.event_id": "AH00098", + "rsa.misc.event_log": "esseq", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "peri6748.www5.domain" + ], + "rsa.time.event_time": "2019-07-24T10:58:48.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-08-07T18:01:23.000Z", + "event.action": "accept", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:8:7-16:01:23 tnon5442.internal.test reverseproxy: [ive] [tquido:very-high] [pid 6108:taliquip] AH00295: caught accept, ectetu", + "fileset.name": "utm", + "host.name": "tnon5442.internal.test", + "input.type": "log", + "log.level": "very-high", + "log.offset": 22774, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 6108, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "ectetu", + "rsa.misc.event_id": "AH00295", + "rsa.misc.event_log": "tquido", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "tnon5442.internal.test" + ], + "rsa.time.event_time": "2019-08-07T18:01:23.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-08-22T01:03:57.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:8:21-23:03:57 ariatu2606.www.host reverseproxy: [quamestq] [umquid:very-high] [pid 7690:rem] [client its] [inv] not all the file sent to the client: rin, referer: https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati", + "fileset.name": "utm", + "host.name": "ariatu2606.www.host", + "http.request.referrer": "https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati", + "input.type": "log", + "log.level": "very-high", + "log.offset": 22905, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7690, + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.context": "Not all file sent to client", + "rsa.misc.event_log": "umquid", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "ariatu2606.www.host" + ], + "rsa.network.gateway": "its", + "rsa.time.event_time": "2019-08-22T01:03:57.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-09-05T08:06:31.000Z", + "destination.ip": [ + "10.248.62.55" + ], + "destination.mac": "01:00:5e:d6:f3:bc", + "destination.port": 4206, + "event.code": "ulogd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:9:5-06:06:31 imv1805.api.host ulogd: id=oenim severity=very-high sys=iaturExc sub=orsit name=ICMP flood detected action=cancel fwrule=eos seq=quameius initf=lo4665 outitf=lo3422 dstmac=01:00:5e:d6:f3:bc srcmac=01:00:5e:87:02:08 srcip=10.96.243.231 dstip=10.248.62.55 proto=ugiat length=quiin tos=apar prec=eleumiur ttl=chite srcport=5632 dstport=4206 tcpflags=tevelit info=etc code=lorem type=temvele", + "fileset.name": "utm", + "host.name": "imv1805.api.host", + "input.type": "log", + "log.level": "very-high", + "log.offset": 23130, + "observer.egress.interface.name": "lo3422", + "observer.ingress.interface.name": "lo4665", + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "related.ip": [ + "10.248.62.55", + "10.96.243.231" + ], + "rsa.internal.event_desc": "ICMP", + "rsa.internal.messageid": "ulogd", + "rsa.investigations.ec_activity": "Scan", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "TEV", + "rsa.investigations.event_cat": 1901000000, + "rsa.investigations.event_cat_name": "Other.Default", + "rsa.misc.context": "etc", + "rsa.misc.policy_id": "eos", + "rsa.misc.rule": "oenim", + "rsa.misc.severity": "very-high", + "rsa.misc.vsys": "iaturExc", + "rsa.network.alias_host": [ + "imv1805.api.host" + ], + "rsa.network.dinterface": "lo3422", + "rsa.network.network_service": "orsit", + "rsa.network.sinterface": "lo4665", + "rsa.time.event_time": "2019-09-05T08:06:31.000Z", + "service.type": "sophos", + "source.ip": [ + "10.96.243.231" + ], + "source.mac": "01:00:5e:87:02:08", + "source.port": 5632, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-09-19T15:09:05.000Z", + "destination.ip": [ + "10.132.101.158" + ], + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:9:19-13:09:05 rita600.www5.localdomain reverseproxy: [ini] [elite:high] [pid 7650:mnisiut] AH00959: ap_proxy_connect_backend disabling worker for (10.132.101.158) for cipitlabs", + "fileset.name": "utm", + "host.name": "rita600.www5.localdomain", + "input.type": "log", + "log.level": "high", + "log.offset": 23536, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 7650, + "related.ip": [ + "10.132.101.158" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH00959", + "rsa.misc.event_log": "elite", + "rsa.misc.result": "disabling worker", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "rita600.www5.localdomain" + ], + "rsa.time.event_time": "2019-09-19T15:09:05.000Z", + "rsa.time.process_time": "cipitlab", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-03T22:11:40.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:10:3-20:11:40 sshd[2014]: Did not receive identification string from rroq", + "fileset.name": "utm", + "input.type": "log", + "log.offset": 23718, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 2014, + "rsa.internal.event_desc": "sshd: Did not receive identification string.", + "rsa.internal.messageid": "sshd", + "rsa.time.event_time": "2019-10-03T22:11:40.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-10-18T05:14:14.000Z", + "event.code": "reverseproxy", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:10:18-03:14:14 admini1122.www.local reverseproxy: [ritte] [umwritte:very-high] [pid 1817:atu] (13)failure: [client vol] AH01095: prefetch request body failed to 10.96.193.132:5342 (orumwr) from bori ()", + "fileset.name": "utm", + "host.name": "admini1122.www.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 23797, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 1817, + "related.ip": [ + "10.96.193.132" + ], + "rsa.internal.messageid": "reverseproxy", + "rsa.misc.event_id": "AH01095", + "rsa.misc.event_log": "umwritte", + "rsa.misc.result": "failure", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "admini1122.www.local" + ], + "rsa.network.gateway": "vol", + "rsa.time.event_time": "2019-10-18T05:14:14.000Z", + "service.type": "sophos", + "source.ip": [ + "10.96.193.132" + ], + "source.port": 5342, + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-01T12:16:48.000Z", + "event.code": "confd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:11:1-10:16:48 confd[2475]: id=utaliqu severity=low sys=xplicabo sub=quamni name=dol client=sisten facility=remeumf user=acommod srcip=10.96.200.83 version=1.7416 storage=sper object=asia class=roident type=olorem attributes=teursintcount=evelites node=nostr account=lapariat", + "file.directory": "sper", + "fileset.name": "utm", + "input.type": "log", + "log.level": "low", + "log.offset": 24004, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "observer.version": "1.7416", + "process.pid": 2475, + "related.ip": [ + "10.96.200.83" + ], + "related.user": [ + "acommod", + "lapariat" + ], + "rsa.identity.logon_type": "remeumf", + "rsa.internal.event_desc": "dol", + "rsa.internal.messageid": "confd", + "rsa.misc.group_object": "roident", + "rsa.misc.node": "nostr", + "rsa.misc.obj_name": "teursintcount=evelites", + "rsa.misc.obj_type": "olorem", + "rsa.misc.severity": "low", + "rsa.misc.version": "1.7416", + "rsa.time.event_time": "2019-11-01T12:16:48.000Z", + "service.name": "quamni", + "service.type": "sophos", + "source.ip": [ + "10.96.200.83" + ], + "tags": [ + "sophos.utm", + "forwarded" + ], + "user.name": "acommod" + }, + { + "@timestamp": "2019-11-15T19:19:22.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud", + "fileset.name": "utm", + "host.name": "emvel4391.localhost", + "input.type": "log", + "log.offset": 24284, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "sshd: Did not receive identification string.", + "rsa.internal.messageid": "sshd", + "rsa.network.alias_host": [ + "emvel4391.localhost" + ], + "rsa.time.event_time": "2019-11-15T19:19:22.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-30T02:21:57.000Z", + "event.code": "confd-sync", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico", + "fileset.name": "utm", + "input.type": "log", + "log.level": "high", + "log.offset": 24381, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "process.pid": 5454, + "rsa.internal.event_desc": "ico", + "rsa.internal.messageid": "confd-sync", + "rsa.misc.severity": "high", + "rsa.time.event_time": "2019-11-30T02:21:57.000Z", + "service.name": "rnatu", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + }, + { + "@timestamp": "2019-12-14T09:24:31.000Z", + "event.code": "sshd", + "event.dataset": "sophos.utm", + "event.module": "sophos", + "event.original": "2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER", + "fileset.name": "utm", + "host.name": "untinc5531.www5.test", + "input.type": "log", + "log.offset": 24475, + "observer.product": "UTM", + "observer.type": "Firewall", + "observer.vendor": "Sophos", + "rsa.internal.event_desc": "sshd:error:Could not get shadow information for NOUSER", + "rsa.internal.messageid": "sshd", + "rsa.network.alias_host": [ + "untinc5531.www5.test" + ], + "rsa.time.event_time": "2019-12-14T09:24:31.000Z", + "service.type": "sophos", + "tags": [ + "sophos.utm", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/sophos/xg/_meta/fields.yml b/x-pack/filebeat/module/sophos/xg/_meta/fields.yml index efb17a6a7b8..dca81ddc4e6 100644 --- a/x-pack/filebeat/module/sophos/xg/_meta/fields.yml +++ b/x-pack/filebeat/module/sophos/xg/_meta/fields.yml @@ -1,936 +1,940 @@ -- name: xg +- name: sophos type: group - release: beta - default_field: false description: > - Module for parsing sophosxg syslog. fields: - - name: device - type: keyword - description: > - device - - - name: date - type: date - description: > - Date (yyyy-mm-dd) when the event occurred - - - name: timezone - type: keyword - description: > - Time (hh:mm:ss) when the event occurred - - - name: device_name - type: keyword - description: > - Model number of the device - - - name: device_id - type: keyword - description: > - Serial number of the device - - - name: log_id - type: keyword - description: > - Unique 12 characters code (0101011) - - - name: log_type - type: keyword - description: > - Type of event e.g. firewall event - - - name: log_component - type: keyword - description: > - Component responsible for logging e.g. Firewall rule - - - name: log_subtype - type: keyword - description: > - Sub type of event - - - name: hb_health - type: keyword - description: > - Heartbeat status - - - name: priority - type: keyword - description: > - Severity level of traffic - - - name: status - type: keyword - description: > - Ultimate status of traffic – Allowed or Denied - - - name: duration - type: long - description: > - Durability of traffic (seconds) - - - name: fw_rule_id - type: integer - description: > - Firewall Rule ID which is applied on the traffic - - - name: user_name - type: keyword - description: > - user_name - - - name: user_group - type: keyword - description: > - Group name to which the user belongs - - - name: iap - type: keyword - description: > - Internet Access policy ID applied on the traffic - - - name: ips_policy_id - type: integer - description: > - IPS policy ID applied on the traffic - - - name: policy_type - type: keyword - description: > - Policy type applied to the traffic - - - name: appfilter_policy_id - type: integer - description: > - Application Filter policy applied on the traffic - - - name: application_filter_policy - type: integer - description: > - Application Filter policy applied on the traffic - - - name: application - type: keyword - description: > - Application name - - - name: application_name - type: keyword - description: > - Application name - - - name: application_risk - type: keyword - description: > - Risk level assigned to the application - - - name: application_technology - type: keyword - description: > - Technology of the application - - - name: application_category - type: keyword - description: > - Application is resolved by signature or synchronized application - - - name: appresolvedby - type: keyword - description: > - Technology of the application - - - name: app_is_cloud - type: keyword - description: > - Application is Cloud - - - name: in_interface - type: keyword - description: > - Interface for incoming traffic, e.g., Port A - - - name: out_interface - type: keyword - description: > - Interface for outgoing traffic, e.g., Port B - - - name: src_ip - type: ip - description: > - Original source IP address of traffic - - - name: src_mac - type: keyword - description: > - Original source MAC address of traffic - - - name: src_country_code - type: keyword - description: > - Code of the country to which the source IP belongs - - - name: dst_ip - type: ip - description: > - Original destination IP address of traffic - - - name: dst_country_code - type: keyword - description: > - Code of the country to which the destination IP belongs - - - name: protocol - type: keyword - description: > - Protocol number of traffic - - - name: src_port - type: integer - description: > - Original source port of TCP and UDP traffic - - - name: dst_port - type: integer - description: > - Original destination port of TCP and UDP traffic - - - name: icmp_type - type: keyword - description: > - ICMP type of ICMP traffic - - - name: icmp_code - type: keyword - description: > - ICMP code of ICMP traffic - - - name: sent_pkts - type: long - description: > - Total number of packets sent - - - name: received_pkts - type: long - description: > - Total number of packets received - - - name: sent_bytes - type: long - description: > - Total number of bytes sent - - - name: recv_bytes - type: long - description: > - Total number of bytes received - - - name: trans_src_ ip - type: ip - description: > - Translated source IP address for outgoing traffic - - - name: trans_src_port - type: integer - description: > - Translated source port for outgoing traffic - - - name: trans_dst_ip - type: ip - description: > - Translated destination IP address for outgoing traffic - - - name: trans_dst_port - type: integer - description: > - Translated destination port for outgoing traffic - - - name: srczonetype - type: keyword - description: > - Type of source zone, e.g., LAN - - - name: srczone - type: keyword - description: > - Name of source zone - - - name: dstzonetype - type: keyword - description: > - Type of destination zone, e.g., WAN - - - name: dstzone - type: keyword - description: > - Name of destination zone - - - name: dir_disp - type: keyword - description: > - TPacket direction. Possible values:“org”, “reply”, “” - - - name: connevent - type: keyword - description: > - Event on which this log is generated - - - name: conn_id - type: integer - description: > - Unique identifier of connection - - - name: vconn_id - type: integer - description: > - Connection ID of the master connection - - - name: idp_policy_id - type: integer - description: > - IPS policy ID which is applied on the traffic - - - name: idp_policy_name - type: keyword - description: > - IPS policy name i.e. IPS policy name which is applied on the traffic - - - name: signature_id - type: keyword - description: > - Signature ID - - - name: signature_msg - type: keyword - description: > - Signature messsage - - - name: classification - type: keyword - description: > - Signature classification - - - name: rule_priority - type: keyword - description: > - Priority of IPS policy - - - name: platform - type: keyword - description: > - Platform of the traffic. - - - name: category - type: keyword - description: > - IPS signature category. - - - name: target - type: keyword - description: > - Platform of the traffic. - - - name: eventid - type: keyword - description: > - ATP Evenet ID - - - name: ep_uuid - type: keyword - description: > - Endpoint UUID - - - name: threatname - type: keyword - description: > - ATP threatname - - - name: sourceip - type: ip - description: > - Original source IP address of traffic - - - name: destinationip - type: ip - description: > - Original destination IP address of traffic - - - name: login_user - type: keyword - description: > - ATP login user - - - name: eventtype - type: keyword - description: > - ATP event type - - - name: execution_path - type: keyword - description: > - ATP execution path - - - name: av_policy_name - type: keyword - description: > - Malware scanning policy name which is applied on the traffic - - - name: from_email_address - type: keyword - description: > - Sender email address - - - name: to_email_address - type: keyword - description: > - Receipeint email address - - - name: subject - type: keyword - description: > - Email subject - - - name: mailsize - type: integer - description: > - mailsize - - - name: virus - type: keyword - description: > - virus name - - - name: FTP_url - type: keyword - description: > - FTP URL from which virus was downloaded - - - name: FTP_direction - type: keyword - description: > - Direction of FTP transfer: Upload or Download - - - name: filesize - type: integer - description: > - Size of the file that contained virus - - - name: filepath - type: keyword - description: > - Path of the file containing virus - - - name: filename - type: keyword - description: > - File name associated with the event - - - name: ftpcommand - type: keyword - description: > - FTP command used when virus was found - - - name: url - type: keyword - description: > - URL from which virus was downloaded - - - name: domainname - type: keyword - description: > - Domain from which virus was downloaded - - - name: quarantine - type: keyword - description: > - Path and filename of the file quarantined - - - name: src_domainname - type: keyword - description: > - Sender domain name - - - name: dst_domainname - type: keyword - description: > - Receiver domain name - - - name: reason - type: keyword - description: > - Reason why the record was detected as spam/malicious - - - name: referer - type: keyword - description: > - Referer - - - name: spamaction - type: keyword - description: > - Spam Action - - - name: mailid - type: keyword - description: > - mailid - - - name: quarantine_reason - type: keyword - description: > - Quarantine reason - - - name: status_code - type: keyword - description: > - Status code - - - name: override_token - type: keyword - description: > - Override token - - - name: con_id - type: integer - description: > - Unique identifier of connection - - - name: override_authorizer - type: keyword - description: > - Override authorizer - - - name: transactionid - type: keyword - description: > - Transaction ID of the AV scan. - - - name: upload_file_type - type: keyword - description: > - Upload file type - - - name: upload_file_name - type: keyword - description: > - Upload file name - - - name: httpresponsecode - type: long - description: > - code of HTTP response - - - name: user_gp - type: keyword - description: > - Group name to which the user belongs. - - - name: category_type - type: keyword - description: > - Type of category under which website falls - - - name: download_file_type - type: keyword - description: > - Download file type - - - name: exceptions - type: keyword - description: > - List of the checks excluded by web exceptions. - - - name: contenttype - type: keyword - description: > - Type of the content - - - name: override_name - type: keyword - description: > - Override name - - - name: activityname - type: keyword - description: > - Web policy activity that matched and caused the policy result. - - - name: download_file_name - type: keyword - description: > - Download file name - - - name: sha1sum - type: keyword - description: > - SHA1 checksum of the item being analyzed - - - name: message_id - type: keyword - description: > - Message ID - - - name: connid - type: keyword - description: > - Connection ID - - - name: message - type: keyword - description: > - Message - - - name: email_subject - type: keyword - description: > - Email Subject - - - name: file_path - type: keyword - description: > - File path - - - name: dstdomain - type: keyword - description: > - Destination Domain - - - name: file_size - type: integer - description: > - File Size - - - name: transaction_id - type: keyword - description: > - Transaction ID - - - name: website - type: keyword - description: > - Website - - - name: file_name - type: keyword - description: > - Filename - - - name: context_prefix - type: keyword - description: > - Content Prefix - - - name: site_category - type: keyword - description: > - Site Category - - - name: context_suffix - type: keyword - description: > - Context Suffix - - - name: dictionary_name - type: keyword - description: > - Dictionary Name - - - name: action - type: keyword - description: > - Event Action - - - name: user - type: keyword - description: > - User - - - name: context_match - type: keyword - description: > - Context Match - - - name: direction - type: keyword - description: > - Direction - - - name: auth_client - type: keyword - description: > - Auth Client - - - name: auth_mechanism - type: keyword - description: > - Auth mechanism - - - name: connectionname - type: keyword - description: > - Connectionname - - - name: remotenetwork - type: keyword - description: > - remotenetwork - - - name: localgateway - type: keyword - description: > - Localgateway - - - name: localnetwork - type: keyword - description: > - Localnetwork - - - name: connectiontype - type: keyword - description: > - Connectiontype - - - name: oldversion - type: keyword - description: > - Oldversion - - - name: newversion - type: keyword - description: > - Newversion - - - name: ipaddress - type: keyword - description: > - Ipaddress - - - name: client_physical_address - type: keyword - description: > - Client physical address - - - name: client_host_name - type: keyword - description: > - Client host name - - - name: raw_data - type: keyword - description: > - Raw data - - - name: Mode - type: keyword - description: > - Mode - - - name: sessionid - type: keyword - description: > - Sessionid - - - name: starttime - type: date - description: > - Starttime - - - name: remote_ip - type: ip - description: > - Remote IP - - - name: timestamp - type: date - description: > - timestamp - - - name: SysLog_SERVER_NAME - type: keyword - description: > - SysLog SERVER NAME - - - name: backup_mode - type: keyword - description: > - Backup mode - - - name: source - type: keyword - description: > - Source - - - name: server - type: keyword - description: > - Server - - - name: host - type: keyword - description: > - Host - - - name: responsetime - type: long - description: > - Responsetime - - - name: cookie - type: keyword - description: > - cookie - - - name: querystring - type: keyword - description: > - querystring - - - name: extra - type: keyword - description: > - extra - - - name: PHPSESSID - type: keyword - description: > - PHPSESSID - - - name: start_time - type: date - description: > - Start time - - - name: eventtime - type: date - description: > - Event time - - - name: red_id - type: keyword - description: > - RED ID - - - name: branch_name - type: keyword - description: > - Branch Name - - - name: updatedip - type: ip - description: > - updatedip - - - name: idle_cpu - type: float - description: > - idle ## - - - name: system_cpu - type: float - description: > - system - - - name: user_cpu - type: float - description: > - system - - - name: used - type: integer - description: > - used - - - name: unit - type: keyword - description: > - unit - - - name: total_memory - type: integer - description: > - Total Memory - - - name: free - type: integer - description: > - free - - - name: transmittederrors - type: keyword - description: > - transmitted errors - - - name: receivederrors - type: keyword - description: > - received errors - - - name: receivedkbits - type: long - description: > - received kbits - - - name: transmittedkbits - type: long - description: > - transmitted kbits - - - name: transmitteddrops - type: long - description: > - transmitted drops - - - name: receiveddrops - type: long - description: > - received drops - - - name: collisions - type: long - description: > - collisions - - - name: interface - type: keyword - description: > - interface - - - name: Configuration - type: float - description: > - Configuration - - - name: Reports - type: float - description: > - Reports - - - name: Signature - type: float - description: > - Signature - - - name: Temp - type: float - description: > - Temp - - - name: users - type: keyword - description: > - users - - - name: ssid - type: keyword - description: > - ssid - - - name: ap - type: keyword - description: > - ap - - - name: clients_conn_ssid - type: keyword - description: > - clients connection ssid + - name: xg + type: group + release: beta + default_field: false + description: > + Module for parsing sophosxg syslog. + fields: + - name: device + type: keyword + description: > + device + + - name: date + type: date + description: > + Date (yyyy-mm-dd) when the event occurred + + - name: timezone + type: keyword + description: > + Time (hh:mm:ss) when the event occurred + + - name: device_name + type: keyword + description: > + Model number of the device + + - name: device_id + type: keyword + description: > + Serial number of the device + + - name: log_id + type: keyword + description: > + Unique 12 characters code (0101011) + + - name: log_type + type: keyword + description: > + Type of event e.g. firewall event + + - name: log_component + type: keyword + description: > + Component responsible for logging e.g. Firewall rule + + - name: log_subtype + type: keyword + description: > + Sub type of event + + - name: hb_health + type: keyword + description: > + Heartbeat status + + - name: priority + type: keyword + description: > + Severity level of traffic + + - name: status + type: keyword + description: > + Ultimate status of traffic – Allowed or Denied + + - name: duration + type: long + description: > + Durability of traffic (seconds) + + - name: fw_rule_id + type: integer + description: > + Firewall Rule ID which is applied on the traffic + + - name: user_name + type: keyword + description: > + user_name + + - name: user_group + type: keyword + description: > + Group name to which the user belongs + + - name: iap + type: keyword + description: > + Internet Access policy ID applied on the traffic + + - name: ips_policy_id + type: integer + description: > + IPS policy ID applied on the traffic + + - name: policy_type + type: keyword + description: > + Policy type applied to the traffic + + - name: appfilter_policy_id + type: integer + description: > + Application Filter policy applied on the traffic + + - name: application_filter_policy + type: integer + description: > + Application Filter policy applied on the traffic + + - name: application + type: keyword + description: > + Application name + + - name: application_name + type: keyword + description: > + Application name + + - name: application_risk + type: keyword + description: > + Risk level assigned to the application + + - name: application_technology + type: keyword + description: > + Technology of the application + + - name: application_category + type: keyword + description: > + Application is resolved by signature or synchronized application + + - name: appresolvedby + type: keyword + description: > + Technology of the application + + - name: app_is_cloud + type: keyword + description: > + Application is Cloud + + - name: in_interface + type: keyword + description: > + Interface for incoming traffic, e.g., Port A + + - name: out_interface + type: keyword + description: > + Interface for outgoing traffic, e.g., Port B + + - name: src_ip + type: ip + description: > + Original source IP address of traffic + + - name: src_mac + type: keyword + description: > + Original source MAC address of traffic + + - name: src_country_code + type: keyword + description: > + Code of the country to which the source IP belongs + + - name: dst_ip + type: ip + description: > + Original destination IP address of traffic + + - name: dst_country_code + type: keyword + description: > + Code of the country to which the destination IP belongs + + - name: protocol + type: keyword + description: > + Protocol number of traffic + + - name: src_port + type: integer + description: > + Original source port of TCP and UDP traffic + + - name: dst_port + type: integer + description: > + Original destination port of TCP and UDP traffic + + - name: icmp_type + type: keyword + description: > + ICMP type of ICMP traffic + + - name: icmp_code + type: keyword + description: > + ICMP code of ICMP traffic + + - name: sent_pkts + type: long + description: > + Total number of packets sent + + - name: received_pkts + type: long + description: > + Total number of packets received + + - name: sent_bytes + type: long + description: > + Total number of bytes sent + + - name: recv_bytes + type: long + description: > + Total number of bytes received + + - name: trans_src_ ip + type: ip + description: > + Translated source IP address for outgoing traffic + + - name: trans_src_port + type: integer + description: > + Translated source port for outgoing traffic + + - name: trans_dst_ip + type: ip + description: > + Translated destination IP address for outgoing traffic + + - name: trans_dst_port + type: integer + description: > + Translated destination port for outgoing traffic + + - name: srczonetype + type: keyword + description: > + Type of source zone, e.g., LAN + + - name: srczone + type: keyword + description: > + Name of source zone + + - name: dstzonetype + type: keyword + description: > + Type of destination zone, e.g., WAN + + - name: dstzone + type: keyword + description: > + Name of destination zone + + - name: dir_disp + type: keyword + description: > + TPacket direction. Possible values:“org”, “reply”, “” + + - name: connevent + type: keyword + description: > + Event on which this log is generated + + - name: conn_id + type: integer + description: > + Unique identifier of connection + + - name: vconn_id + type: integer + description: > + Connection ID of the master connection + + - name: idp_policy_id + type: integer + description: > + IPS policy ID which is applied on the traffic + + - name: idp_policy_name + type: keyword + description: > + IPS policy name i.e. IPS policy name which is applied on the traffic + + - name: signature_id + type: keyword + description: > + Signature ID + + - name: signature_msg + type: keyword + description: > + Signature messsage + + - name: classification + type: keyword + description: > + Signature classification + + - name: rule_priority + type: keyword + description: > + Priority of IPS policy + + - name: platform + type: keyword + description: > + Platform of the traffic. + + - name: category + type: keyword + description: > + IPS signature category. + + - name: target + type: keyword + description: > + Platform of the traffic. + + - name: eventid + type: keyword + description: > + ATP Evenet ID + + - name: ep_uuid + type: keyword + description: > + Endpoint UUID + + - name: threatname + type: keyword + description: > + ATP threatname + + - name: sourceip + type: ip + description: > + Original source IP address of traffic + + - name: destinationip + type: ip + description: > + Original destination IP address of traffic + + - name: login_user + type: keyword + description: > + ATP login user + + - name: eventtype + type: keyword + description: > + ATP event type + + - name: execution_path + type: keyword + description: > + ATP execution path + + - name: av_policy_name + type: keyword + description: > + Malware scanning policy name which is applied on the traffic + + - name: from_email_address + type: keyword + description: > + Sender email address + + - name: to_email_address + type: keyword + description: > + Receipeint email address + + - name: subject + type: keyword + description: > + Email subject + + - name: mailsize + type: integer + description: > + mailsize + + - name: virus + type: keyword + description: > + virus name + + - name: FTP_url + type: keyword + description: > + FTP URL from which virus was downloaded + + - name: FTP_direction + type: keyword + description: > + Direction of FTP transfer: Upload or Download + + - name: filesize + type: integer + description: > + Size of the file that contained virus + + - name: filepath + type: keyword + description: > + Path of the file containing virus + + - name: filename + type: keyword + description: > + File name associated with the event + + - name: ftpcommand + type: keyword + description: > + FTP command used when virus was found + + - name: url + type: keyword + description: > + URL from which virus was downloaded + + - name: domainname + type: keyword + description: > + Domain from which virus was downloaded + + - name: quarantine + type: keyword + description: > + Path and filename of the file quarantined + + - name: src_domainname + type: keyword + description: > + Sender domain name + + - name: dst_domainname + type: keyword + description: > + Receiver domain name + + - name: reason + type: keyword + description: > + Reason why the record was detected as spam/malicious + + - name: referer + type: keyword + description: > + Referer + + - name: spamaction + type: keyword + description: > + Spam Action + + - name: mailid + type: keyword + description: > + mailid + + - name: quarantine_reason + type: keyword + description: > + Quarantine reason + + - name: status_code + type: keyword + description: > + Status code + + - name: override_token + type: keyword + description: > + Override token + + - name: con_id + type: integer + description: > + Unique identifier of connection + + - name: override_authorizer + type: keyword + description: > + Override authorizer + + - name: transactionid + type: keyword + description: > + Transaction ID of the AV scan. + + - name: upload_file_type + type: keyword + description: > + Upload file type + + - name: upload_file_name + type: keyword + description: > + Upload file name + + - name: httpresponsecode + type: long + description: > + code of HTTP response + + - name: user_gp + type: keyword + description: > + Group name to which the user belongs. + + - name: category_type + type: keyword + description: > + Type of category under which website falls + + - name: download_file_type + type: keyword + description: > + Download file type + + - name: exceptions + type: keyword + description: > + List of the checks excluded by web exceptions. + + - name: contenttype + type: keyword + description: > + Type of the content + + - name: override_name + type: keyword + description: > + Override name + + - name: activityname + type: keyword + description: > + Web policy activity that matched and caused the policy result. + + - name: download_file_name + type: keyword + description: > + Download file name + + - name: sha1sum + type: keyword + description: > + SHA1 checksum of the item being analyzed + + - name: message_id + type: keyword + description: > + Message ID + + - name: connid + type: keyword + description: > + Connection ID + + - name: message + type: keyword + description: > + Message + + - name: email_subject + type: keyword + description: > + Email Subject + + - name: file_path + type: keyword + description: > + File path + + - name: dstdomain + type: keyword + description: > + Destination Domain + + - name: file_size + type: integer + description: > + File Size + + - name: transaction_id + type: keyword + description: > + Transaction ID + + - name: website + type: keyword + description: > + Website + + - name: file_name + type: keyword + description: > + Filename + + - name: context_prefix + type: keyword + description: > + Content Prefix + + - name: site_category + type: keyword + description: > + Site Category + + - name: context_suffix + type: keyword + description: > + Context Suffix + + - name: dictionary_name + type: keyword + description: > + Dictionary Name + + - name: action + type: keyword + description: > + Event Action + + - name: user + type: keyword + description: > + User + + - name: context_match + type: keyword + description: > + Context Match + + - name: direction + type: keyword + description: > + Direction + + - name: auth_client + type: keyword + description: > + Auth Client + + - name: auth_mechanism + type: keyword + description: > + Auth mechanism + + - name: connectionname + type: keyword + description: > + Connectionname + + - name: remotenetwork + type: keyword + description: > + remotenetwork + + - name: localgateway + type: keyword + description: > + Localgateway + + - name: localnetwork + type: keyword + description: > + Localnetwork + + - name: connectiontype + type: keyword + description: > + Connectiontype + + - name: oldversion + type: keyword + description: > + Oldversion + + - name: newversion + type: keyword + description: > + Newversion + + - name: ipaddress + type: keyword + description: > + Ipaddress + + - name: client_physical_address + type: keyword + description: > + Client physical address + + - name: client_host_name + type: keyword + description: > + Client host name + + - name: raw_data + type: keyword + description: > + Raw data + + - name: Mode + type: keyword + description: > + Mode + + - name: sessionid + type: keyword + description: > + Sessionid + + - name: starttime + type: date + description: > + Starttime + + - name: remote_ip + type: ip + description: > + Remote IP + + - name: timestamp + type: date + description: > + timestamp + + - name: SysLog_SERVER_NAME + type: keyword + description: > + SysLog SERVER NAME + + - name: backup_mode + type: keyword + description: > + Backup mode + + - name: source + type: keyword + description: > + Source + + - name: server + type: keyword + description: > + Server + + - name: host + type: keyword + description: > + Host + + - name: responsetime + type: long + description: > + Responsetime + + - name: cookie + type: keyword + description: > + cookie + + - name: querystring + type: keyword + description: > + querystring + + - name: extra + type: keyword + description: > + extra + + - name: PHPSESSID + type: keyword + description: > + PHPSESSID + + - name: start_time + type: date + description: > + Start time + + - name: eventtime + type: date + description: > + Event time + + - name: red_id + type: keyword + description: > + RED ID + + - name: branch_name + type: keyword + description: > + Branch Name + + - name: updatedip + type: ip + description: > + updatedip + + - name: idle_cpu + type: float + description: > + idle ## + + - name: system_cpu + type: float + description: > + system + + - name: user_cpu + type: float + description: > + system + + - name: used + type: integer + description: > + used + + - name: unit + type: keyword + description: > + unit + + - name: total_memory + type: integer + description: > + Total Memory + + - name: free + type: integer + description: > + free + + - name: transmittederrors + type: keyword + description: > + transmitted errors + + - name: receivederrors + type: keyword + description: > + received errors + + - name: receivedkbits + type: long + description: > + received kbits + + - name: transmittedkbits + type: long + description: > + transmitted kbits + + - name: transmitteddrops + type: long + description: > + transmitted drops + + - name: receiveddrops + type: long + description: > + received drops + + - name: collisions + type: long + description: > + collisions + + - name: interface + type: keyword + description: > + interface + + - name: Configuration + type: float + description: > + Configuration + + - name: Reports + type: float + description: > + Reports + + - name: Signature + type: float + description: > + Signature + + - name: Temp + type: float + description: > + Temp + + - name: users + type: keyword + description: > + users + + - name: ssid + type: keyword + description: > + ssid + + - name: ap + type: keyword + description: > + ap + + - name: clients_conn_ssid + type: keyword + description: > + clients connection ssid diff --git a/x-pack/filebeat/module/squid/_meta/docs.asciidoc b/x-pack/filebeat/module/squid/_meta/docs.asciidoc index 798af71b303..dcb5161fda7 100644 --- a/x-pack/filebeat/module/squid/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/squid/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/symantec/README.md b/x-pack/filebeat/module/symantec/README.md new file mode 100644 index 00000000000..d90bb91be55 --- /dev/null +++ b/x-pack/filebeat/module/symantec/README.md @@ -0,0 +1,7 @@ +# symantec module + +This is a module for Symantec AntiVirus/Endpoint Protection logs. + +Autogenerated from RSA NetWitness log parser 2.0 XML symantecav version 134 +at 2020-09-01 14:18:50.728147 +0000 UTC. + diff --git a/x-pack/filebeat/module/symantec/_meta/config.yml b/x-pack/filebeat/module/symantec/_meta/config.yml new file mode 100644 index 00000000000..482804f3f94 --- /dev/null +++ b/x-pack/filebeat/module/symantec/_meta/config.yml @@ -0,0 +1,19 @@ +- module: symantec + endpointprotection: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9534 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/module/symantec/_meta/docs.asciidoc b/x-pack/filebeat/module/symantec/_meta/docs.asciidoc new file mode 100644 index 00000000000..b73aa478f51 --- /dev/null +++ b/x-pack/filebeat/module/symantec/_meta/docs.asciidoc @@ -0,0 +1,66 @@ +[role="xpack"] + +:modulename: symantec +:has-dashboards: false + +== Symantec module + +experimental[] + +This is a module for receiving Symantec AntiVirus/Endpoint Protection logs over Syslog or a file. + +include::../include/gs-link.asciidoc[] + +include::../include/configuring-intro.asciidoc[] + +:fileset_ex: endpointprotection + +include::../include/config-option-intro.asciidoc[] + +[float] +==== `endpointprotection` fileset settings + +experimental[] + +NOTE: This was converted from RSA NetWitness log parser XML "symantecav" device revision 134. + +*`var.input`*:: + +The input from which messages are read. One of `file`, `tcp` or `udp`. + +*`var.syslog_host`*:: + +The address to listen to UDP or TCP based syslog traffic. +Defaults to `localhost`. +Set to `0.0.0.0` to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to `9534` + +NOTE: Ports below 1024 require Filebeat to run as root. + +*`var.tz_offset`*:: + +By default, datetimes in the logs will be interpreted as relative to +the timezone configured in the host where {beatname_uc} is running. If ingesting +logs from a host on a different timezone, use this field to set the timezone +offset so that datetimes are correctly parsed. Valid values are in the form +±HH:mm, for example, `-07:00` for `UTC-7`. + +*`var.rsa_fields`*:: + +Flag to control the addition of non-ECS fields to the event. Defaults to true, +which causes both ECS and custom fields under `rsa` to be added. + +*`var.keep_raw_fields`*:: + +Flag to control the addition of the raw parser fields to the event. This fields +will be found under `rsa.raw`. The default is false. + +:has-dashboards!: + +:fileset_ex!: + +:modulename!: + diff --git a/x-pack/filebeat/module/symantec/_meta/fields.yml b/x-pack/filebeat/module/symantec/_meta/fields.yml new file mode 100644 index 00000000000..bd9d0428f06 --- /dev/null +++ b/x-pack/filebeat/module/symantec/_meta/fields.yml @@ -0,0 +1,5 @@ +- key: symantec + title: Symantec AntiVirus/Endpoint Protection + description: > + symantec fields. + fields: diff --git a/x-pack/filebeat/module/symantec/endpointprotection/_meta/fields.yml b/x-pack/filebeat/module/symantec/endpointprotection/_meta/fields.yml new file mode 100644 index 00000000000..ecf61b431da --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/_meta/fields.yml @@ -0,0 +1,2637 @@ +- name: network.interface.name + overwrite: true + type: keyword + default_field: false + description: > + Name of the network interface where the traffic has been observed. +- name: rsa + overwrite: true + type: group + default_field: false + fields: + - name: internal + overwrite: true + type: group + fields: + - name: msg + overwrite: true + type: keyword + description: This key is used to capture the raw message that comes into the + Log Decoder + - name: messageid + overwrite: true + type: keyword + - name: event_desc + overwrite: true + type: keyword + - name: message + overwrite: true + type: keyword + description: This key captures the contents of instant messages + - name: time + overwrite: true + type: date + description: This is the time at which a session hits a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness. + - name: level + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: msg_id + overwrite: true + type: keyword + description: This is the Message ID1 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: msg_vid + overwrite: true + type: keyword + description: This is the Message ID2 value that identifies the exact log parser + definition which parses a particular log session. This key should never be + used to parse Meta data from a session (Logs/Packets) Directly, this is a + Reserved key in NetWitness + - name: data + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_server + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_val + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: resource + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: obj_id + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: statement + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: audit_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: entry + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: hcode + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: inode + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: resource_class + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: dead + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: feed_desc + overwrite: true + type: keyword + description: This is used to capture the description of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: feed_name + overwrite: true + type: keyword + description: This is used to capture the name of the feed. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: cid + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Concentrator. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_class + overwrite: true + type: keyword + description: This is the Classification of the Log Event Source under a predefined + fixed set of Event Source Classifications. This key should never be used to + parse Meta data from a session (Logs/Packets) Directly, this is a Reserved + key in NetWitness + - name: device_group + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_host + overwrite: true + type: keyword + description: This is the Hostname of the log Event Source sending the logs to + NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ip + overwrite: true + type: ip + description: This is the IPv4 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_ipv6 + overwrite: true + type: ip + description: This is the IPv6 address of the Log Event Source sending the logs + to NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: device_type + overwrite: true + type: keyword + description: This is the name of the log parser which parsed a given session. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: device_type_id + overwrite: true + type: long + description: Deprecated key defined only in table map. + - name: did + overwrite: true + type: keyword + description: This is the unique identifier used to identify a NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: entropy_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: entropy_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the Meta Type can + be either UInt16 or Float32 based on the configuration + - name: event_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: feed_category + overwrite: true + type: keyword + description: This is used to capture the category of the feed. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: forward_ip + overwrite: true + type: ip + description: This key should be used to capture the IPV4 address of a relay + system which forwarded the events from the original system to NetWitness. + - name: forward_ipv6 + overwrite: true + type: ip + description: This key is used to capture the IPV6 address of a relay system + which forwarded the events from the original system to NetWitness. This key + should never be used to parse Meta data from a session (Logs/Packets) Directly, + this is a Reserved key in NetWitness + - name: header_id + overwrite: true + type: keyword + description: This is the Header ID value that identifies the exact log parser + header definition that parses a particular log session. This key should never + be used to parse Meta data from a session (Logs/Packets) Directly, this is + a Reserved key in NetWitness + - name: lc_cid + overwrite: true + type: keyword + description: This is a unique Identifier of a Log Collector. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: lc_ctime + overwrite: true + type: date + description: This is the time at which a log is collected in a NetWitness Log + Collector. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: mcb_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + request is simply which byte for each side (0 thru 255) was seen the most + - name: mcb_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + response is simply which byte for each side (0 thru 255) was seen the most + - name: mcbc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: mcbc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the most common byte + count is the number of times the most common byte (above) was seen in the + session streams + - name: medium + overwrite: true + type: long + description: "This key is used to identify if it\u2019s a log/packet session\ + \ or Layer 2 Encapsulation Type. This key should never be used to parse Meta\ + \ data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness.\ + \ 32 = log, 33 = correlation session, < 32 is packet session" + - name: node_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: nwe_callback_id + overwrite: true + type: keyword + description: This key denotes that event is endpoint related + - name: parse_error + overwrite: true + type: keyword + description: This is a special key that stores any Meta key validation error + found while parsing a log session. This key should never be used to parse + Meta data from a session (Logs/Packets) Directly, this is a Reserved key in + NetWitness + - name: payload_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: payload_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, the payload size metrics + are the payload sizes of each session side at the time of parsing. However, + in order to keep + - name: process_vid_dst + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the target process. + - name: process_vid_src + overwrite: true + type: keyword + description: Endpoint generates and uses a unique virtual ID to identify any + similar group of process. This ID represents the source process. + - name: rid + overwrite: true + type: long + description: This is a special ID of the Remote Session created by NetWitness + Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: session_split + overwrite: true + type: keyword + description: This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: site + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: size + overwrite: true + type: long + description: This is the size of the session as seen by the NetWitness Decoder. + This key should never be used to parse Meta data from a session (Logs/Packets) + Directly, this is a Reserved key in NetWitness + - name: sourcefile + overwrite: true + type: keyword + description: This is the name of the log file or PCAPs that can be imported + into NetWitness. This key should never be used to parse Meta data from a session + (Logs/Packets) Directly, this is a Reserved key in NetWitness + - name: ubc_req + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: ubc_res + overwrite: true + type: long + description: This key is only used by the Entropy Parser, Unique byte count + is the number of unique bytes seen in each stream. 256 would mean all byte + values of 0 thru 255 were seen at least once + - name: word + overwrite: true + type: keyword + description: This is used by the Word Parsing technology to capture the first + 5 character of every word in an unparsed log + - name: time + overwrite: true + type: group + fields: + - name: event_time + overwrite: true + type: date + description: This key is used to capture the time mentioned in a raw session + that represents the actual time an event occured in a standard normalized + form + - name: duration_time + overwrite: true + type: double + description: This key is used to capture the normalized duration/lifetime in + seconds. + - name: event_time_str + overwrite: true + type: keyword + description: This key is used to capture the incomplete time mentioned in a + session as a string + - name: starttime + overwrite: true + type: date + description: This key is used to capture the Start time mentioned in a session + in a standard form + - name: month + overwrite: true + type: keyword + - name: day + overwrite: true + type: keyword + - name: endtime + overwrite: true + type: date + description: This key is used to capture the End time mentioned in a session + in a standard form + - name: timezone + overwrite: true + type: keyword + description: This key is used to capture the timezone of the Event Time + - name: duration_str + overwrite: true + type: keyword + description: A text string version of the duration + - name: date + overwrite: true + type: keyword + - name: year + overwrite: true + type: keyword + - name: recorded_time + overwrite: true + type: date + description: The event time as recorded by the system the event is collected + from. The usage scenario is a multi-tier application where the management + layer of the system records it's own timestamp at the time of collection from + its child nodes. Must be in timestamp format. + - name: datetime + overwrite: true + type: keyword + - name: effective_time + overwrite: true + type: date + description: This key is the effective time referenced by an individual event + in a Standard Timestamp format + - name: expire_time + overwrite: true + type: date + description: This key is the timestamp that explicitly refers to an expiration. + - name: process_time + overwrite: true + type: keyword + description: Deprecated, use duration.time + - name: hour + overwrite: true + type: keyword + - name: min + overwrite: true + type: keyword + - name: timestamp + overwrite: true + type: keyword + - name: event_queue_time + overwrite: true + type: date + description: This key is the Time that the event was queued. + - name: p_time1 + overwrite: true + type: keyword + - name: tzone + overwrite: true + type: keyword + - name: eventtime + overwrite: true + type: keyword + - name: gmtdate + overwrite: true + type: keyword + - name: gmttime + overwrite: true + type: keyword + - name: p_date + overwrite: true + type: keyword + - name: p_month + overwrite: true + type: keyword + - name: p_time + overwrite: true + type: keyword + - name: p_time2 + overwrite: true + type: keyword + - name: p_year + overwrite: true + type: keyword + - name: expire_time_str + overwrite: true + type: keyword + description: This key is used to capture incomplete timestamp that explicitly + refers to an expiration. + - name: stamp + overwrite: true + type: date + description: Deprecated key defined only in table map. + - name: misc + overwrite: true + type: group + fields: + - name: action + overwrite: true + type: keyword + - name: result + overwrite: true + type: keyword + description: This key is used to capture the outcome/result string value of + an action in a session. + - name: severity + overwrite: true + type: keyword + description: This key is used to capture the severity given the session + - name: event_type + overwrite: true + type: keyword + description: This key captures the event category type as specified by the event + source. + - name: reference_id + overwrite: true + type: keyword + description: This key is used to capture an event id from the session directly + - name: version + overwrite: true + type: keyword + description: This key captures Version of the application or OS which is generating + the event. + - name: disposition + overwrite: true + type: keyword + description: This key captures the The end state of an action. + - name: result_code + overwrite: true + type: keyword + description: This key is used to capture the outcome/result numeric value of + an action in a session + - name: category + overwrite: true + type: keyword + description: This key is used to capture the category of an event given by the + vendor in the session + - name: obj_name + overwrite: true + type: keyword + description: This is used to capture name of object + - name: obj_type + overwrite: true + type: keyword + description: This is used to capture type of object + - name: event_source + overwrite: true + type: keyword + description: "This key captures Source of the event that\u2019s not a hostname" + - name: log_session_id + overwrite: true + type: keyword + description: This key is used to capture a sessionid from the session directly + - name: group + overwrite: true + type: keyword + description: This key captures the Group Name value + - name: policy_name + overwrite: true + type: keyword + description: This key is used to capture the Policy Name only. + - name: rule_name + overwrite: true + type: keyword + description: This key captures the Rule Name + - name: context + overwrite: true + type: keyword + description: This key captures Information which adds additional context to + the event. + - name: change_new + overwrite: true + type: keyword + description: "This key is used to capture the new values of the attribute that\u2019\ + s changing in a session" + - name: space + overwrite: true + type: keyword + - name: client + overwrite: true + type: keyword + description: This key is used to capture only the name of the client application + requesting resources of the server. See the user.agent meta key for capture + of the specific user agent identifier or browser identification string. + - name: msgIdPart1 + overwrite: true + type: keyword + - name: msgIdPart2 + overwrite: true + type: keyword + - name: change_old + overwrite: true + type: keyword + description: "This key is used to capture the old value of the attribute that\u2019\ + s changing in a session" + - name: operation_id + overwrite: true + type: keyword + description: An alert number or operation number. The values should be unique + and non-repeating. + - name: event_state + overwrite: true + type: keyword + description: This key captures the current state of the object/item referenced + within the event. Describing an on-going event. + - name: group_object + overwrite: true + type: keyword + description: This key captures a collection/grouping of entities. Specific usage + - name: node + overwrite: true + type: keyword + description: Common use case is the node name within a cluster. The cluster + name is reflected by the host name. + - name: rule + overwrite: true + type: keyword + description: This key captures the Rule number + - name: device_name + overwrite: true + type: keyword + description: 'This is used to capture name of the Device associated with the + node Like: a physical disk, printer, etc' + - name: param + overwrite: true + type: keyword + description: This key is the parameters passed as part of a command or application, + etc. + - name: change_attrib + overwrite: true + type: keyword + description: "This key is used to capture the name of the attribute that\u2019\ + s changing in a session" + - name: event_computer + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + fully qualified domain name in a windows log. + - name: reference_id1 + overwrite: true + type: keyword + description: This key is for Linked ID to be used as an addition to "reference.id" + - name: event_log + overwrite: true + type: keyword + description: This key captures the Name of the event log + - name: OS + overwrite: true + type: keyword + description: This key captures the Name of the Operating System + - name: terminal + overwrite: true + type: keyword + description: This key captures the Terminal Names only + - name: msgIdPart3 + overwrite: true + type: keyword + - name: filter + overwrite: true + type: keyword + description: This key captures Filter used to reduce result set + - name: serial_number + overwrite: true + type: keyword + description: This key is the Serial number associated with a physical asset. + - name: checksum + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the entity + such as a file or process. Checksum should be used over checksum.src or checksum.dst + when it is unclear whether the entity is a source or target of an action. + - name: event_user + overwrite: true + type: keyword + description: This key is a windows only concept, where this key is used to capture + combination of domain name and username in a windows log. + - name: virusname + overwrite: true + type: keyword + description: This key captures the name of the virus + - name: content_type + overwrite: true + type: keyword + description: This key is used to capture Content Type only. + - name: group_id + overwrite: true + type: keyword + description: This key captures Group ID Number (related to the group name) + - name: policy_id + overwrite: true + type: keyword + description: This key is used to capture the Policy ID only, this should be + a numeric value, use policy.name otherwise + - name: vsys + overwrite: true + type: keyword + description: This key captures Virtual System Name + - name: connection_id + overwrite: true + type: keyword + description: This key captures the Connection ID + - name: reference_id2 + overwrite: true + type: keyword + description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" + or "reference.id1" value but should not be used unless the other two variables + are in play. + - name: sensor + overwrite: true + type: keyword + description: This key captures Name of the sensor. Typically used in IDS/IPS + based devices + - name: sig_id + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID + - name: port_name + overwrite: true + type: keyword + description: 'This key is used for Physical or logical port connection but does + NOT include a network port. (Example: Printer port name).' + - name: rule_group + overwrite: true + type: keyword + description: This key captures the Rule group name + - name: risk_num + overwrite: true + type: double + description: This key captures a Numeric Risk value + - name: trigger_val + overwrite: true + type: keyword + description: This key captures the Value of the trigger or threshold condition. + - name: log_session_id1 + overwrite: true + type: keyword + description: This key is used to capture a Linked (Related) Session ID from + the session directly + - name: comp_version + overwrite: true + type: keyword + description: This key captures the Version level of a sub-component of a product. + - name: content_version + overwrite: true + type: keyword + description: This key captures Version level of a signature or database content. + - name: hardware_id + overwrite: true + type: keyword + description: This key is used to capture unique identifier for a device or system + (NOT a Mac address) + - name: risk + overwrite: true + type: keyword + description: This key captures the non-numeric risk value + - name: event_id + overwrite: true + type: keyword + - name: reason + overwrite: true + type: keyword + - name: status + overwrite: true + type: keyword + - name: mail_id + overwrite: true + type: keyword + description: This key is used to capture the mailbox id/name + - name: rule_uid + overwrite: true + type: keyword + description: This key is the Unique Identifier for a rule. + - name: trigger_desc + overwrite: true + type: keyword + description: This key captures the Description of the trigger or threshold condition. + - name: inout + overwrite: true + type: keyword + - name: p_msgid + overwrite: true + type: keyword + - name: data_type + overwrite: true + type: keyword + - name: msgIdPart4 + overwrite: true + type: keyword + - name: error + overwrite: true + type: keyword + description: This key captures All non successful Error codes or responses + - name: index + overwrite: true + type: keyword + - name: listnum + overwrite: true + type: keyword + description: This key is used to capture listname or listnumber, primarily for + collecting access-list + - name: ntype + overwrite: true + type: keyword + - name: observed_val + overwrite: true + type: keyword + description: This key captures the Value observed (from the perspective of the + device generating the log). + - name: policy_value + overwrite: true + type: keyword + description: This key captures the contents of the policy. This contains details + about the policy + - name: pool_name + overwrite: true + type: keyword + description: This key captures the name of a resource pool + - name: rule_template + overwrite: true + type: keyword + description: A default set of parameters which are overlayed onto a rule (or + rulename) which efffectively constitutes a template + - name: count + overwrite: true + type: keyword + - name: number + overwrite: true + type: keyword + - name: sigcat + overwrite: true + type: keyword + - name: type + overwrite: true + type: keyword + - name: comments + overwrite: true + type: keyword + description: Comment information provided in the log message + - name: doc_number + overwrite: true + type: long + description: This key captures File Identification number + - name: expected_val + overwrite: true + type: keyword + description: This key captures the Value expected (from the perspective of the + device generating the log). + - name: job_num + overwrite: true + type: keyword + description: This key captures the Job Number + - name: spi_dst + overwrite: true + type: keyword + description: Destination SPI Index + - name: spi_src + overwrite: true + type: keyword + description: Source SPI Index + - name: code + overwrite: true + type: keyword + - name: agent_id + overwrite: true + type: keyword + description: This key is used to capture agent id + - name: message_body + overwrite: true + type: keyword + description: This key captures the The contents of the message body. + - name: phone + overwrite: true + type: keyword + - name: sig_id_str + overwrite: true + type: keyword + description: This key captures a string object of the sigid variable. + - name: cmd + overwrite: true + type: keyword + - name: misc + overwrite: true + type: keyword + - name: name + overwrite: true + type: keyword + - name: cpu + overwrite: true + type: long + description: This key is the CPU time used in the execution of the event being + recorded. + - name: event_desc + overwrite: true + type: keyword + description: This key is used to capture a description of an event available + directly or inferred + - name: sig_id1 + overwrite: true + type: long + description: This key captures IDS/IPS Int Signature ID. This must be linked + to the sig.id + - name: im_buddyid + overwrite: true + type: keyword + - name: im_client + overwrite: true + type: keyword + - name: im_userid + overwrite: true + type: keyword + - name: pid + overwrite: true + type: keyword + - name: priority + overwrite: true + type: keyword + - name: context_subject + overwrite: true + type: keyword + description: This key is to be used in an audit context where the subject is + the object being identified + - name: context_target + overwrite: true + type: keyword + - name: cve + overwrite: true + type: keyword + description: This key captures CVE (Common Vulnerabilities and Exposures) - + an identifier for known information security vulnerabilities. + - name: fcatnum + overwrite: true + type: keyword + description: This key captures Filter Category Number. Legacy Usage + - name: library + overwrite: true + type: keyword + description: This key is used to capture library information in mainframe devices + - name: parent_node + overwrite: true + type: keyword + description: This key captures the Parent Node Name. Must be related to node + variable. + - name: risk_info + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: tcp_flags + overwrite: true + type: long + description: This key is captures the TCP flags set in any packet of session + - name: tos + overwrite: true + type: long + description: This key describes the type of service + - name: vm_target + overwrite: true + type: keyword + description: VMWare Target **VMWARE** only varaible. + - name: workspace + overwrite: true + type: keyword + description: This key captures Workspace Description + - name: command + overwrite: true + type: keyword + - name: event_category + overwrite: true + type: keyword + - name: facilityname + overwrite: true + type: keyword + - name: forensic_info + overwrite: true + type: keyword + - name: jobname + overwrite: true + type: keyword + - name: mode + overwrite: true + type: keyword + - name: policy + overwrite: true + type: keyword + - name: policy_waiver + overwrite: true + type: keyword + - name: second + overwrite: true + type: keyword + - name: space1 + overwrite: true + type: keyword + - name: subcategory + overwrite: true + type: keyword + - name: tbdstr2 + overwrite: true + type: keyword + - name: alert_id + overwrite: true + type: keyword + description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: checksum_dst + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the the target + entity such as a process or file. + - name: checksum_src + overwrite: true + type: keyword + description: This key is used to capture the checksum or hash of the source + entity such as a file or process. + - name: fresult + overwrite: true + type: long + description: This key captures the Filter Result + - name: payload_dst + overwrite: true + type: keyword + description: This key is used to capture destination payload + - name: payload_src + overwrite: true + type: keyword + description: This key is used to capture source payload + - name: pool_id + overwrite: true + type: keyword + description: This key captures the identifier (typically numeric field) of a + resource pool + - name: process_id_val + overwrite: true + type: keyword + description: This key is a failure key for Process ID when it is not an integer + value + - name: risk_num_comm + overwrite: true + type: double + description: This key captures Risk Number Community + - name: risk_num_next + overwrite: true + type: double + description: This key captures Risk Number NextGen + - name: risk_num_sand + overwrite: true + type: double + description: This key captures Risk Number SandBox + - name: risk_num_static + overwrite: true + type: double + description: This key captures Risk Number Static + - name: risk_suspicious + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: risk_warning + overwrite: true + type: keyword + description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) + - name: snmp_oid + overwrite: true + type: keyword + description: SNMP Object Identifier + - name: sql + overwrite: true + type: keyword + description: This key captures the SQL query + - name: vuln_ref + overwrite: true + type: keyword + description: This key captures the Vulnerability Reference details + - name: acl_id + overwrite: true + type: keyword + - name: acl_op + overwrite: true + type: keyword + - name: acl_pos + overwrite: true + type: keyword + - name: acl_table + overwrite: true + type: keyword + - name: admin + overwrite: true + type: keyword + - name: alarm_id + overwrite: true + type: keyword + - name: alarmname + overwrite: true + type: keyword + - name: app_id + overwrite: true + type: keyword + - name: audit + overwrite: true + type: keyword + - name: audit_object + overwrite: true + type: keyword + - name: auditdata + overwrite: true + type: keyword + - name: benchmark + overwrite: true + type: keyword + - name: bypass + overwrite: true + type: keyword + - name: cache + overwrite: true + type: keyword + - name: cache_hit + overwrite: true + type: keyword + - name: cefversion + overwrite: true + type: keyword + - name: cfg_attr + overwrite: true + type: keyword + - name: cfg_obj + overwrite: true + type: keyword + - name: cfg_path + overwrite: true + type: keyword + - name: changes + overwrite: true + type: keyword + - name: client_ip + overwrite: true + type: keyword + - name: clustermembers + overwrite: true + type: keyword + - name: cn_acttimeout + overwrite: true + type: keyword + - name: cn_asn_src + overwrite: true + type: keyword + - name: cn_bgpv4nxthop + overwrite: true + type: keyword + - name: cn_ctr_dst_code + overwrite: true + type: keyword + - name: cn_dst_tos + overwrite: true + type: keyword + - name: cn_dst_vlan + overwrite: true + type: keyword + - name: cn_engine_id + overwrite: true + type: keyword + - name: cn_engine_type + overwrite: true + type: keyword + - name: cn_f_switch + overwrite: true + type: keyword + - name: cn_flowsampid + overwrite: true + type: keyword + - name: cn_flowsampintv + overwrite: true + type: keyword + - name: cn_flowsampmode + overwrite: true + type: keyword + - name: cn_inacttimeout + overwrite: true + type: keyword + - name: cn_inpermbyts + overwrite: true + type: keyword + - name: cn_inpermpckts + overwrite: true + type: keyword + - name: cn_invalid + overwrite: true + type: keyword + - name: cn_ip_proto_ver + overwrite: true + type: keyword + - name: cn_ipv4_ident + overwrite: true + type: keyword + - name: cn_l_switch + overwrite: true + type: keyword + - name: cn_log_did + overwrite: true + type: keyword + - name: cn_log_rid + overwrite: true + type: keyword + - name: cn_max_ttl + overwrite: true + type: keyword + - name: cn_maxpcktlen + overwrite: true + type: keyword + - name: cn_min_ttl + overwrite: true + type: keyword + - name: cn_minpcktlen + overwrite: true + type: keyword + - name: cn_mpls_lbl_1 + overwrite: true + type: keyword + - name: cn_mpls_lbl_10 + overwrite: true + type: keyword + - name: cn_mpls_lbl_2 + overwrite: true + type: keyword + - name: cn_mpls_lbl_3 + overwrite: true + type: keyword + - name: cn_mpls_lbl_4 + overwrite: true + type: keyword + - name: cn_mpls_lbl_5 + overwrite: true + type: keyword + - name: cn_mpls_lbl_6 + overwrite: true + type: keyword + - name: cn_mpls_lbl_7 + overwrite: true + type: keyword + - name: cn_mpls_lbl_8 + overwrite: true + type: keyword + - name: cn_mpls_lbl_9 + overwrite: true + type: keyword + - name: cn_mplstoplabel + overwrite: true + type: keyword + - name: cn_mplstoplabip + overwrite: true + type: keyword + - name: cn_mul_dst_byt + overwrite: true + type: keyword + - name: cn_mul_dst_pks + overwrite: true + type: keyword + - name: cn_muligmptype + overwrite: true + type: keyword + - name: cn_sampalgo + overwrite: true + type: keyword + - name: cn_sampint + overwrite: true + type: keyword + - name: cn_seqctr + overwrite: true + type: keyword + - name: cn_spackets + overwrite: true + type: keyword + - name: cn_src_tos + overwrite: true + type: keyword + - name: cn_src_vlan + overwrite: true + type: keyword + - name: cn_sysuptime + overwrite: true + type: keyword + - name: cn_template_id + overwrite: true + type: keyword + - name: cn_totbytsexp + overwrite: true + type: keyword + - name: cn_totflowexp + overwrite: true + type: keyword + - name: cn_totpcktsexp + overwrite: true + type: keyword + - name: cn_unixnanosecs + overwrite: true + type: keyword + - name: cn_v6flowlabel + overwrite: true + type: keyword + - name: cn_v6optheaders + overwrite: true + type: keyword + - name: comp_class + overwrite: true + type: keyword + - name: comp_name + overwrite: true + type: keyword + - name: comp_rbytes + overwrite: true + type: keyword + - name: comp_sbytes + overwrite: true + type: keyword + - name: cpu_data + overwrite: true + type: keyword + - name: criticality + overwrite: true + type: keyword + - name: cs_agency_dst + overwrite: true + type: keyword + - name: cs_analyzedby + overwrite: true + type: keyword + - name: cs_av_other + overwrite: true + type: keyword + - name: cs_av_primary + overwrite: true + type: keyword + - name: cs_av_secondary + overwrite: true + type: keyword + - name: cs_bgpv6nxthop + overwrite: true + type: keyword + - name: cs_bit9status + overwrite: true + type: keyword + - name: cs_context + overwrite: true + type: keyword + - name: cs_control + overwrite: true + type: keyword + - name: cs_data + overwrite: true + type: keyword + - name: cs_datecret + overwrite: true + type: keyword + - name: cs_dst_tld + overwrite: true + type: keyword + - name: cs_eth_dst_ven + overwrite: true + type: keyword + - name: cs_eth_src_ven + overwrite: true + type: keyword + - name: cs_event_uuid + overwrite: true + type: keyword + - name: cs_filetype + overwrite: true + type: keyword + - name: cs_fld + overwrite: true + type: keyword + - name: cs_if_desc + overwrite: true + type: keyword + - name: cs_if_name + overwrite: true + type: keyword + - name: cs_ip_next_hop + overwrite: true + type: keyword + - name: cs_ipv4dstpre + overwrite: true + type: keyword + - name: cs_ipv4srcpre + overwrite: true + type: keyword + - name: cs_lifetime + overwrite: true + type: keyword + - name: cs_log_medium + overwrite: true + type: keyword + - name: cs_loginname + overwrite: true + type: keyword + - name: cs_modulescore + overwrite: true + type: keyword + - name: cs_modulesign + overwrite: true + type: keyword + - name: cs_opswatresult + overwrite: true + type: keyword + - name: cs_payload + overwrite: true + type: keyword + - name: cs_registrant + overwrite: true + type: keyword + - name: cs_registrar + overwrite: true + type: keyword + - name: cs_represult + overwrite: true + type: keyword + - name: cs_rpayload + overwrite: true + type: keyword + - name: cs_sampler_name + overwrite: true + type: keyword + - name: cs_sourcemodule + overwrite: true + type: keyword + - name: cs_streams + overwrite: true + type: keyword + - name: cs_targetmodule + overwrite: true + type: keyword + - name: cs_v6nxthop + overwrite: true + type: keyword + - name: cs_whois_server + overwrite: true + type: keyword + - name: cs_yararesult + overwrite: true + type: keyword + - name: description + overwrite: true + type: keyword + - name: devvendor + overwrite: true + type: keyword + - name: distance + overwrite: true + type: keyword + - name: dstburb + overwrite: true + type: keyword + - name: edomain + overwrite: true + type: keyword + - name: edomaub + overwrite: true + type: keyword + - name: euid + overwrite: true + type: keyword + - name: facility + overwrite: true + type: keyword + - name: finterface + overwrite: true + type: keyword + - name: flags + overwrite: true + type: keyword + - name: gaddr + overwrite: true + type: keyword + - name: id3 + overwrite: true + type: keyword + - name: im_buddyname + overwrite: true + type: keyword + - name: im_croomid + overwrite: true + type: keyword + - name: im_croomtype + overwrite: true + type: keyword + - name: im_members + overwrite: true + type: keyword + - name: im_username + overwrite: true + type: keyword + - name: ipkt + overwrite: true + type: keyword + - name: ipscat + overwrite: true + type: keyword + - name: ipspri + overwrite: true + type: keyword + - name: latitude + overwrite: true + type: keyword + - name: linenum + overwrite: true + type: keyword + - name: list_name + overwrite: true + type: keyword + - name: load_data + overwrite: true + type: keyword + - name: location_floor + overwrite: true + type: keyword + - name: location_mark + overwrite: true + type: keyword + - name: log_id + overwrite: true + type: keyword + - name: log_type + overwrite: true + type: keyword + - name: logid + overwrite: true + type: keyword + - name: logip + overwrite: true + type: keyword + - name: logname + overwrite: true + type: keyword + - name: longitude + overwrite: true + type: keyword + - name: lport + overwrite: true + type: keyword + - name: mbug_data + overwrite: true + type: keyword + - name: misc_name + overwrite: true + type: keyword + - name: msg_type + overwrite: true + type: keyword + - name: msgid + overwrite: true + type: keyword + - name: netsessid + overwrite: true + type: keyword + - name: num + overwrite: true + type: keyword + - name: number1 + overwrite: true + type: keyword + - name: number2 + overwrite: true + type: keyword + - name: nwwn + overwrite: true + type: keyword + - name: object + overwrite: true + type: keyword + - name: operation + overwrite: true + type: keyword + - name: opkt + overwrite: true + type: keyword + - name: orig_from + overwrite: true + type: keyword + - name: owner_id + overwrite: true + type: keyword + - name: p_action + overwrite: true + type: keyword + - name: p_filter + overwrite: true + type: keyword + - name: p_group_object + overwrite: true + type: keyword + - name: p_id + overwrite: true + type: keyword + - name: p_msgid1 + overwrite: true + type: keyword + - name: p_msgid2 + overwrite: true + type: keyword + - name: p_result1 + overwrite: true + type: keyword + - name: password_chg + overwrite: true + type: keyword + - name: password_expire + overwrite: true + type: keyword + - name: permgranted + overwrite: true + type: keyword + - name: permwanted + overwrite: true + type: keyword + - name: pgid + overwrite: true + type: keyword + - name: policyUUID + overwrite: true + type: keyword + - name: prog_asp_num + overwrite: true + type: keyword + - name: program + overwrite: true + type: keyword + - name: real_data + overwrite: true + type: keyword + - name: rec_asp_device + overwrite: true + type: keyword + - name: rec_asp_num + overwrite: true + type: keyword + - name: rec_library + overwrite: true + type: keyword + - name: recordnum + overwrite: true + type: keyword + - name: ruid + overwrite: true + type: keyword + - name: sburb + overwrite: true + type: keyword + - name: sdomain_fld + overwrite: true + type: keyword + - name: sec + overwrite: true + type: keyword + - name: sensorname + overwrite: true + type: keyword + - name: seqnum + overwrite: true + type: keyword + - name: session + overwrite: true + type: keyword + - name: sessiontype + overwrite: true + type: keyword + - name: sigUUID + overwrite: true + type: keyword + - name: spi + overwrite: true + type: keyword + - name: srcburb + overwrite: true + type: keyword + - name: srcdom + overwrite: true + type: keyword + - name: srcservice + overwrite: true + type: keyword + - name: state + overwrite: true + type: keyword + - name: status1 + overwrite: true + type: keyword + - name: svcno + overwrite: true + type: keyword + - name: system + overwrite: true + type: keyword + - name: tbdstr1 + overwrite: true + type: keyword + - name: tgtdom + overwrite: true + type: keyword + - name: tgtdomain + overwrite: true + type: keyword + - name: threshold + overwrite: true + type: keyword + - name: type1 + overwrite: true + type: keyword + - name: udb_class + overwrite: true + type: keyword + - name: url_fld + overwrite: true + type: keyword + - name: user_div + overwrite: true + type: keyword + - name: userid + overwrite: true + type: keyword + - name: username_fld + overwrite: true + type: keyword + - name: utcstamp + overwrite: true + type: keyword + - name: v_instafname + overwrite: true + type: keyword + - name: virt_data + overwrite: true + type: keyword + - name: vpnid + overwrite: true + type: keyword + - name: autorun_type + overwrite: true + type: keyword + description: This is used to capture Auto Run type + - name: cc_number + overwrite: true + type: long + description: Valid Credit Card Numbers only + - name: content + overwrite: true + type: keyword + description: This key captures the content type from protocol headers + - name: ein_number + overwrite: true + type: long + description: Employee Identification Numbers only + - name: found + overwrite: true + type: keyword + description: This is used to capture the results of regex match + - name: language + overwrite: true + type: keyword + description: This is used to capture list of languages the client support and + what it prefers + - name: lifetime + overwrite: true + type: long + description: This key is used to capture the session lifetime in seconds. + - name: link + overwrite: true + type: keyword + description: This key is used to link the sessions together. This key should + never be used to parse Meta data from a session (Logs/Packets) Directly, this + is a Reserved key in NetWitness + - name: match + overwrite: true + type: keyword + description: This key is for regex match name from search.ini + - name: param_dst + overwrite: true + type: keyword + description: This key captures the command line/launch argument of the target + process or file + - name: param_src + overwrite: true + type: keyword + description: This key captures source parameter + - name: search_text + overwrite: true + type: keyword + description: This key captures the Search Text used + - name: sig_name + overwrite: true + type: keyword + description: This key is used to capture the Signature Name only. + - name: snmp_value + overwrite: true + type: keyword + description: SNMP set request value + - name: streams + overwrite: true + type: long + description: This key captures number of streams in session + - name: db + overwrite: true + type: group + fields: + - name: index + overwrite: true + type: keyword + description: This key captures IndexID of the index. + - name: instance + overwrite: true + type: keyword + description: This key is used to capture the database server instance name + - name: database + overwrite: true + type: keyword + description: This key is used to capture the name of a database or an instance + as seen in a session + - name: transact_id + overwrite: true + type: keyword + description: This key captures the SQL transantion ID of the current session + - name: permissions + overwrite: true + type: keyword + description: This key captures permission or privilege level assigned to a resource. + - name: table_name + overwrite: true + type: keyword + description: This key is used to capture the table name + - name: db_id + overwrite: true + type: keyword + description: This key is used to capture the unique identifier for a database + - name: db_pid + overwrite: true + type: long + description: This key captures the process id of a connection with database + server + - name: lread + overwrite: true + type: long + description: This key is used for the number of logical reads + - name: lwrite + overwrite: true + type: long + description: This key is used for the number of logical writes + - name: pread + overwrite: true + type: long + description: This key is used for the number of physical writes + - name: network + overwrite: true + type: group + fields: + - name: alias_host + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a hostname is not clear.Also it captures the Device Hostname. Any Hostname + that isnt ad.computer. + - name: domain + overwrite: true + type: keyword + - name: host_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Hostname" + - name: network_service + overwrite: true + type: keyword + description: This is used to capture layer 7 protocols/service names + - name: interface + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of an interface is not clear + - name: network_port + overwrite: true + type: long + description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently + used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' + - name: eth_host + overwrite: true + type: keyword + description: Deprecated, use alias.mac + - name: sinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Interface" + - name: dinterface + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Interface" + - name: vlan + overwrite: true + type: long + description: This key should only be used to capture the ID of the Virtual LAN + - name: zone_src + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Source Zone." + - name: zone + overwrite: true + type: keyword + description: This key should be used when the source or destination context + of a Zone is not clear + - name: zone_dst + overwrite: true + type: keyword + description: "This key should only be used when it\u2019s a Destination Zone." + - name: gateway + overwrite: true + type: keyword + description: This key is used to capture the IP Address of the gateway + - name: icmp_type + overwrite: true + type: long + description: This key is used to capture the ICMP type only + - name: mask + overwrite: true + type: keyword + description: This key is used to capture the device network IPmask. + - name: icmp_code + overwrite: true + type: long + description: This key is used to capture the ICMP code only + - name: protocol_detail + overwrite: true + type: keyword + description: This key should be used to capture additional protocol information + - name: dmask + overwrite: true + type: keyword + description: This key is used for Destionation Device network mask + - name: port + overwrite: true + type: long + description: This key should only be used to capture a Network Port when the + directionality is not clear + - name: smask + overwrite: true + type: keyword + description: This key is used for capturing source Network Mask + - name: netname + overwrite: true + type: keyword + description: This key is used to capture the network name associated with an + IP range. This is configured by the end user. + - name: paddr + overwrite: true + type: ip + description: Deprecated + - name: faddr + overwrite: true + type: keyword + - name: lhost + overwrite: true + type: keyword + - name: origin + overwrite: true + type: keyword + - name: remote_domain_id + overwrite: true + type: keyword + - name: addr + overwrite: true + type: keyword + - name: dns_a_record + overwrite: true + type: keyword + - name: dns_ptr_record + overwrite: true + type: keyword + - name: fhost + overwrite: true + type: keyword + - name: fport + overwrite: true + type: keyword + - name: laddr + overwrite: true + type: keyword + - name: linterface + overwrite: true + type: keyword + - name: phost + overwrite: true + type: keyword + - name: ad_computer_dst + overwrite: true + type: keyword + description: Deprecated, use host.dst + - name: eth_type + overwrite: true + type: long + description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols + Only + - name: ip_proto + overwrite: true + type: long + description: This key should be used to capture the Protocol number, all the + protocol nubers are converted into string in UI + - name: dns_cname_record + overwrite: true + type: keyword + - name: dns_id + overwrite: true + type: keyword + - name: dns_opcode + overwrite: true + type: keyword + - name: dns_resp + overwrite: true + type: keyword + - name: dns_type + overwrite: true + type: keyword + - name: domain1 + overwrite: true + type: keyword + - name: host_type + overwrite: true + type: keyword + - name: packet_length + overwrite: true + type: keyword + - name: host_orig + overwrite: true + type: keyword + description: This is used to capture the original hostname in case of a Forwarding + Agent or a Proxy in between. + - name: rpayload + overwrite: true + type: keyword + description: This key is used to capture the total number of payload bytes seen + in the retransmitted packets. + - name: vlan_name + overwrite: true + type: keyword + description: This key should only be used to capture the name of the Virtual + LAN + - name: investigations + overwrite: true + type: group + fields: + - name: ec_activity + overwrite: true + type: keyword + description: This key captures the particular event activity(Ex:Logoff) + - name: ec_theme + overwrite: true + type: keyword + description: This key captures the Theme of a particular Event(Ex:Authentication) + - name: ec_subject + overwrite: true + type: keyword + description: This key captures the Subject of a particular Event(Ex:User) + - name: ec_outcome + overwrite: true + type: keyword + description: This key captures the outcome of a particular Event(Ex:Success) + - name: event_cat + overwrite: true + type: long + description: This key captures the Event category number + - name: event_cat_name + overwrite: true + type: keyword + description: This key captures the event category name corresponding to the + event cat code + - name: event_vcat + overwrite: true + type: keyword + description: This is a vendor supplied category. This should be used in situations + where the vendor has adopted their own event_category taxonomy. + - name: analysis_file + overwrite: true + type: keyword + description: This is used to capture all indicators used in a File Analysis. + This key should be used to capture an analysis of a file + - name: analysis_service + overwrite: true + type: keyword + description: This is used to capture all indicators used in a Service Analysis. + This key should be used to capture an analysis of a service + - name: analysis_session + overwrite: true + type: keyword + description: This is used to capture all indicators used for a Session Analysis. + This key should be used to capture an analysis of a session + - name: boc + overwrite: true + type: keyword + description: This is used to capture behaviour of compromise + - name: eoc + overwrite: true + type: keyword + description: This is used to capture Enablers of Compromise + - name: inv_category + overwrite: true + type: keyword + description: This used to capture investigation category + - name: inv_context + overwrite: true + type: keyword + description: This used to capture investigation context + - name: ioc + overwrite: true + type: keyword + description: This is key capture indicator of compromise + - name: counters + overwrite: true + type: group + fields: + - name: dclass_c1 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c1.str only + - name: dclass_c2 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c2.str only + - name: event_counter + overwrite: true + type: long + description: This is used to capture the number of times an event repeated + - name: dclass_r1 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r1.str only + - name: dclass_c3 + overwrite: true + type: long + description: This is a generic counter key that should be used with the label + dclass.c3.str only + - name: dclass_c1_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c1 only + - name: dclass_c2_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c2 only + - name: dclass_r1_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r1 only + - name: dclass_r2 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r2.str only + - name: dclass_c3_str + overwrite: true + type: keyword + description: This is a generic counter string key that should be used with the + label dclass.c3 only + - name: dclass_r3 + overwrite: true + type: keyword + description: This is a generic ratio key that should be used with the label + dclass.r3.str only + - name: dclass_r2_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r2 only + - name: dclass_r3_str + overwrite: true + type: keyword + description: This is a generic ratio string key that should be used with the + label dclass.r3 only + - name: identity + overwrite: true + type: group + fields: + - name: auth_method + overwrite: true + type: keyword + description: This key is used to capture authentication methods used only + - name: user_role + overwrite: true + type: keyword + description: This key is used to capture the Role of a user only + - name: dn + overwrite: true + type: keyword + description: X.500 (LDAP) Distinguished Name + - name: logon_type + overwrite: true + type: keyword + description: This key is used to capture the type of logon method used. + - name: profile + overwrite: true + type: keyword + description: This key is used to capture the user profile + - name: accesses + overwrite: true + type: keyword + description: This key is used to capture actual privileges used in accessing + an object + - name: realm + overwrite: true + type: keyword + description: Radius realm or similar grouping of accounts + - name: user_sid_dst + overwrite: true + type: keyword + description: This key captures Destination User Session ID + - name: dn_src + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that is used in a context that + indicates a Source dn + - name: org + overwrite: true + type: keyword + description: This key captures the User organization + - name: dn_dst + overwrite: true + type: keyword + description: An X.500 (LDAP) Distinguished name that used in a context that + indicates a Destination dn + - name: firstname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: lastname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: user_dept + overwrite: true + type: keyword + description: User's Department Names only + - name: user_sid_src + overwrite: true + type: keyword + description: This key captures Source User Session ID + - name: federated_sp + overwrite: true + type: keyword + description: This key is the Federated Service Provider. This is the application + requesting authentication. + - name: federated_idp + overwrite: true + type: keyword + description: This key is the federated Identity Provider. This is the server + providing the authentication. + - name: logon_type_desc + overwrite: true + type: keyword + description: This key is used to capture the textual description of an integer + logon type as stored in the meta key 'logon.type'. + - name: middlename + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: password + overwrite: true + type: keyword + description: This key is for Passwords seen in any session, plain text or encrypted + - name: host_role + overwrite: true + type: keyword + description: This key should only be used to capture the role of a Host Machine + - name: ldap + overwrite: true + type: keyword + description: "This key is for Uninterpreted LDAP values. Ldap Values that don\u2019\ + t have a clear query or response context" + - name: ldap_query + overwrite: true + type: keyword + description: This key is the Search criteria from an LDAP search + - name: ldap_response + overwrite: true + type: keyword + description: This key is to capture Results from an LDAP search + - name: owner + overwrite: true + type: keyword + description: This is used to capture username the process or service is running + as, the author of the task + - name: service_account + overwrite: true + type: keyword + description: This key is a windows specific key, used for capturing name of + the account a service (referenced in the event) is running under. Legacy Usage + - name: email + overwrite: true + type: group + fields: + - name: email_dst + overwrite: true + type: keyword + description: This key is used to capture the Destination email address only, + when the destination context is not clear use email + - name: email_src + overwrite: true + type: keyword + description: This key is used to capture the source email address only, when + the source context is not clear use email + - name: subject + overwrite: true + type: keyword + description: This key is used to capture the subject string from an Email only. + - name: email + overwrite: true + type: keyword + description: This key is used to capture a generic email address where the source + or destination context is not clear + - name: trans_from + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: trans_to + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: file + overwrite: true + type: group + fields: + - name: privilege + overwrite: true + type: keyword + description: Deprecated, use permissions + - name: attachment + overwrite: true + type: keyword + description: This key captures the attachment file name + - name: filesystem + overwrite: true + type: keyword + - name: binary + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: filename_dst + overwrite: true + type: keyword + description: This is used to capture name of the file targeted by the action + - name: filename_src + overwrite: true + type: keyword + description: This is used to capture name of the parent filename, the file which + performed the action + - name: filename_tmp + overwrite: true + type: keyword + - name: directory_dst + overwrite: true + type: keyword + description: This key is used to capture the directory of the target process + or file + - name: directory_src + overwrite: true + type: keyword + description: This key is used to capture the directory of the source process + or file + - name: file_entropy + overwrite: true + type: double + description: This is used to capture entropy vale of a file + - name: file_vendor + overwrite: true + type: keyword + description: This is used to capture Company name of file located in version_info + - name: task_name + overwrite: true + type: keyword + description: This is used to capture name of the task + - name: web + overwrite: true + type: group + fields: + - name: fqdn + overwrite: true + type: keyword + description: Fully Qualified Domain Names + - name: web_cookie + overwrite: true + type: keyword + description: This key is used to capture the Web cookies specifically. + - name: alias_host + overwrite: true + type: keyword + - name: reputation_num + overwrite: true + type: double + description: Reputation Number of an entity. Typically used for Web Domains + - name: web_ref_domain + overwrite: true + type: keyword + description: Web referer's domain + - name: web_ref_query + overwrite: true + type: keyword + description: This key captures Web referer's query portion of the URL + - name: remote_domain + overwrite: true + type: keyword + - name: web_ref_page + overwrite: true + type: keyword + description: This key captures Web referer's page information + - name: web_ref_root + overwrite: true + type: keyword + description: Web referer's root URL path + - name: cn_asn_dst + overwrite: true + type: keyword + - name: cn_rpackets + overwrite: true + type: keyword + - name: urlpage + overwrite: true + type: keyword + - name: urlroot + overwrite: true + type: keyword + - name: p_url + overwrite: true + type: keyword + - name: p_user_agent + overwrite: true + type: keyword + - name: p_web_cookie + overwrite: true + type: keyword + - name: p_web_method + overwrite: true + type: keyword + - name: p_web_referer + overwrite: true + type: keyword + - name: web_extension_tmp + overwrite: true + type: keyword + - name: web_page + overwrite: true + type: keyword + - name: threat + overwrite: true + type: group + fields: + - name: threat_category + overwrite: true + type: keyword + description: This key captures Threat Name/Threat Category/Categorization of + alert + - name: threat_desc + overwrite: true + type: keyword + description: This key is used to capture the threat description from the session + directly or inferred + - name: alert + overwrite: true + type: keyword + description: This key is used to capture name of the alert + - name: threat_source + overwrite: true + type: keyword + description: This key is used to capture source of the threat + - name: crypto + overwrite: true + type: group + fields: + - name: crypto + overwrite: true + type: keyword + description: This key is used to capture the Encryption Type or Encryption Key + only + - name: cipher_src + overwrite: true + type: keyword + description: This key is for Source (Client) Cipher + - name: cert_subject + overwrite: true + type: keyword + description: This key is used to capture the Certificate organization only + - name: peer + overwrite: true + type: keyword + description: This key is for Encryption peer's IP Address + - name: cipher_size_src + overwrite: true + type: long + description: This key captures Source (Client) Cipher Size + - name: ike + overwrite: true + type: keyword + description: IKE negotiation phase. + - name: scheme + overwrite: true + type: keyword + description: This key captures the Encryption scheme used + - name: peer_id + overwrite: true + type: keyword + description: "This key is for Encryption peer\u2019s identity" + - name: sig_type + overwrite: true + type: keyword + description: This key captures the Signature Type + - name: cert_issuer + overwrite: true + type: keyword + - name: cert_host_name + overwrite: true + type: keyword + description: Deprecated key defined only in table map. + - name: cert_error + overwrite: true + type: keyword + description: This key captures the Certificate Error String + - name: cipher_dst + overwrite: true + type: keyword + description: This key is for Destination (Server) Cipher + - name: cipher_size_dst + overwrite: true + type: long + description: This key captures Destination (Server) Cipher Size + - name: ssl_ver_src + overwrite: true + type: keyword + description: Deprecated, use version + - name: d_certauth + overwrite: true + type: keyword + - name: s_certauth + overwrite: true + type: keyword + - name: ike_cookie1 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase One" + - name: ike_cookie2 + overwrite: true + type: keyword + description: "ID of the negotiation \u2014 sent for ISAKMP Phase Two" + - name: cert_checksum + overwrite: true + type: keyword + - name: cert_host_cat + overwrite: true + type: keyword + description: This key is used for the hostname category value of a certificate + - name: cert_serial + overwrite: true + type: keyword + description: This key is used to capture the Certificate serial number only + - name: cert_status + overwrite: true + type: keyword + description: This key captures Certificate validation status + - name: ssl_ver_dst + overwrite: true + type: keyword + description: Deprecated, use version + - name: cert_keysize + overwrite: true + type: keyword + - name: cert_username + overwrite: true + type: keyword + - name: https_insact + overwrite: true + type: keyword + - name: https_valid + overwrite: true + type: keyword + - name: cert_ca + overwrite: true + type: keyword + description: This key is used to capture the Certificate signing authority only + - name: cert_common + overwrite: true + type: keyword + description: This key is used to capture the Certificate common name only + - name: wireless + overwrite: true + type: group + fields: + - name: wlan_ssid + overwrite: true + type: keyword + description: This key is used to capture the ssid of a Wireless Session + - name: access_point + overwrite: true + type: keyword + description: This key is used to capture the access point name. + - name: wlan_channel + overwrite: true + type: long + description: This is used to capture the channel names + - name: wlan_name + overwrite: true + type: keyword + description: This key captures either WLAN number/name + - name: storage + overwrite: true + type: group + fields: + - name: disk_volume + overwrite: true + type: keyword + description: A unique name assigned to logical units (volumes) within a physical + disk + - name: lun + overwrite: true + type: keyword + description: Logical Unit Number.This key is a very useful concept in Storage. + - name: pwwn + overwrite: true + type: keyword + description: This uniquely identifies a port on a HBA. + - name: physical + overwrite: true + type: group + fields: + - name: org_dst + overwrite: true + type: keyword + description: This is used to capture the destination organization based on the + GEOPIP Maxmind database. + - name: org_src + overwrite: true + type: keyword + description: This is used to capture the source organization based on the GEOPIP + Maxmind database. + - name: healthcare + overwrite: true + type: group + fields: + - name: patient_fname + overwrite: true + type: keyword + description: This key is for First Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_id + overwrite: true + type: keyword + description: This key captures the unique ID for a patient + - name: patient_lname + overwrite: true + type: keyword + description: This key is for Last Names only, this is used for Healthcare predominantly + to capture Patients information + - name: patient_mname + overwrite: true + type: keyword + description: This key is for Middle Names only, this is used for Healthcare + predominantly to capture Patients information + - name: endpoint + overwrite: true + type: group + fields: + - name: host_state + overwrite: true + type: keyword + description: This key is used to capture the current state of the machine, such + as blacklisted, infected, firewall + disabled and so on + - name: registry_key + overwrite: true + type: keyword + description: This key captures the path to the registry key + - name: registry_value + overwrite: true + type: keyword + description: This key captures values or decorators used within a registry entry diff --git a/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml b/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml new file mode 100644 index 00000000000..a735b86e766 --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml @@ -0,0 +1,45 @@ +{{ if eq .input "file" }} + +type: log +paths: + {{ range $i, $path := .paths }} +- {{$path}} + {{ end }} +exclude_files: [".gz$"] + +{{ else }} + +type: {{.input}} +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +fields_under_root: true +fields: + observer: + vendor: "Symantec" + product: "Endpoint" + type: "Anti-Virus" + +processors: +- script: + lang: javascript + params: + ecs: true + rsa: {{.rsa_fields}} + tz_offset: {{.tz_offset}} + keep_raw: {{.keep_raw_fields}} + debug: {{.debug}} + files: + - ${path.home}/module/symantec/endpointprotection/config/liblogparser.js + - ${path.home}/module/symantec/endpointprotection/config/pipeline.js +{{ if .community_id }} +- community_id: ~ +{{ end }} +- add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/symantec/endpointprotection/config/liblogparser.js b/x-pack/filebeat/module/symantec/endpointprotection/config/liblogparser.js new file mode 100644 index 00000000000..6cdb48abb26 --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/config/liblogparser.js @@ -0,0 +1,2510 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +/* jshint -W014,-W016,-W097,-W116 */ + +var processor = require("processor"); +var console = require("console"); + +var FLAG_FIELD = "log.flags"; +var FIELDS_OBJECT = "nwparser"; +var FIELDS_PREFIX = FIELDS_OBJECT + "."; + +var defaults = { + debug: false, + ecs: true, + rsa: false, + keep_raw: false, + tz_offset: "local", + strip_priority: true +}; + +var saved_flags = null; +var debug; +var map_ecs; +var map_rsa; +var keep_raw; +var device; +var tz_offset; +var strip_priority; + +// Register params from configuration. +function register(params) { + debug = params.debug !== undefined ? params.debug : defaults.debug; + map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; + map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; + keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; + tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); + strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; + device = new DeviceProcessor(); +} + +function parse_tz_offset(offset) { + var date; + var m; + switch(offset) { + // local uses the tz offset from the JS VM. + case "local": + date = new Date(); + // Reversing the sign as we the offset from UTC, not to UTC. + return parse_local_tz_offset(-date.getTimezoneOffset()); + // event uses the tz offset from event.timezone (add_locale processor). + case "event": + return offset; + // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. + default: + m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); + if (m === null || m.length !== 4) { + throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); + } + return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); + } +} + +function parse_local_tz_offset(minutes) { + var neg = minutes < 0; + minutes = Math.abs(minutes); + var min = minutes % 60; + var hours = Math.floor(minutes / 60); + var pad2digit = function(n) { + if (n < 10) { return "0" + n;} + return "" + n; + }; + return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); +} + +function process(evt) { + // Function register is only called by the processor when `params` are set + // in the processor config. + if (device === undefined) { + register(defaults); + } + return device.process(evt); +} + +function processor_chain(subprocessors) { + var builder = new processor.Chain(); + subprocessors.forEach(builder.Add); + return builder.Build().Run; +} + +function linear_select(subprocessors) { + return function (evt) { + var flags = evt.Get(FLAG_FIELD); + var i; + for (i = 0; i < subprocessors.length; i++) { + evt.Delete(FLAG_FIELD); + if (debug) console.warn("linear_select trying entry " + i); + subprocessors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) == null) break; + if (debug) console.warn("linear_select failed entry " + i); + } + if (flags !== null) { + evt.Put(FLAG_FIELD, flags); + } + if (debug) { + if (i < subprocessors.length) { + console.warn("linear_select matched entry " + i); + } else { + console.warn("linear_select didn't match"); + } + } + }; +} + +function conditional(opt) { + return function(evt) { + if (opt.if(evt)) { + opt.then(evt); + } else if (opt.else) { + opt.else(evt); + } + }; +} + +var strip_syslog_priority = (function() { + var isEnabled = function() { return strip_priority === true; }; + var fetchPRI = field("_pri"); + var fetchPayload = field("payload"); + var removePayload = remove(["payload"]); + var cleanup = remove(["_pri", "payload"]); + var onMatch = function(evt) { + var pri, priStr = fetchPRI(evt); + if (priStr != null + && 0 < priStr.length && priStr.length < 4 + && !isNaN((pri = Number(priStr))) + && 0 <= pri && pri < 192) { + var severity = pri & 7, + facility = pri >> 3; + setc("_severity", "" + severity)(evt); + setc("_facility", "" + facility)(evt); + // Replace message with priority stripped. + evt.Put("message", fetchPayload(evt)); + removePayload(evt); + } else { + // not a valid syslog PRI, cleanup. + cleanup(evt); + } + }; + return conditional({ + if: isEnabled, + then: cleanup_flags(match( + "STRIP_PRI", + "message", + "<%{_pri}>%{payload}", + onMatch + )) + }); +})(); + +function match(id, src, pattern, on_success) { + var dissect = new processor.Dissect({ + field: src, + tokenizer: pattern, + target_prefix: FIELDS_OBJECT, + ignore_failure: true, + overwrite_keys: true, + trim_values: "right" + }); + return function (evt) { + var msg = evt.Get(src); + dissect.Run(evt); + var failed = evt.Get(FLAG_FIELD) != null; + if (debug) { + if (failed) { + console.debug("dissect fail: " + id + " field:" + src); + } else { + console.debug("dissect OK: " + id + " field:" + src); + } + console.debug(" expr: <<" + pattern + ">>"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null && !failed) { + on_success(evt); + } + }; +} + +function match_copy(id, src, dst, on_success) { + dst = FIELDS_PREFIX + dst; + if (dst === FIELDS_PREFIX || dst === src) { + return function (evt) { + if (debug) { + console.debug("noop OK: " + id + " field:" + src); + console.debug(" input: <<" + evt.Get(src) + ">>"); + } + if (on_success != null) on_success(evt); + } + } + return function (evt) { + var msg = evt.Get(src); + evt.Put(dst, msg); + if (debug) { + console.debug("copy OK: " + id + " field:" + src); + console.debug(" target: '" + dst + "'"); + console.debug(" input: <<" + msg + ">>"); + } + if (on_success != null) on_success(evt); + } +} + +function cleanup_flags(processor) { + return function(evt) { + processor(evt); + evt.Delete(FLAG_FIELD); + }; +} + +function all_match(opts) { + return function (evt) { + var i; + for (i = 0; i < opts.processors.length; i++) { + evt.Delete(FLAG_FIELD); + opts.processors[i](evt); + // Dissect processor succeeded? + if (evt.Get(FLAG_FIELD) != null) { + if (debug) console.warn("all_match failure at " + i); + if (opts.on_failure != null) opts.on_failure(evt); + return; + } + if (debug) console.warn("all_match success at " + i); + } + if (opts.on_success != null) opts.on_success(evt); + }; +} + +function msgid_select(mapping) { + return function (evt) { + var msgid = evt.Get(FIELDS_PREFIX + "messageid"); + if (msgid == null) { + if (debug) console.warn("msgid_select: no messageid captured!"); + return; + } + var next = mapping[msgid]; + if (next === undefined) { + if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); + return; + } + if (debug) console.info("msgid_select: matched key=" + msgid); + return next(evt); + }; +} + +function msg(msg_id, match) { + return function (evt) { + match(evt); + if (evt.Get(FLAG_FIELD) == null) { + evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); + } + }; +} + +var start; + +function save_flags(evt) { + saved_flags = evt.Get(FLAG_FIELD); + evt.Put("event.original", evt.Get("message")); +} + +function restore_flags(evt) { + if (saved_flags !== null) { + evt.Put(FLAG_FIELD, saved_flags); + } + evt.Delete("message"); +} + +function constant(value) { + return function (evt) { + return value; + }; +} + +function field(name) { + var fullname = FIELDS_PREFIX + name; + return function (evt) { + return evt.Get(fullname); + }; +} + +function STRCAT(args) { + var s = ""; + var i; + for (i = 0; i < args.length; i++) { + s += args[i]; + } + return s; +} + +// TODO: Implement +function DIRCHK(args) { + unimplemented("DIRCHK"); +} + +function strictToInt(str) { + return str * 1; +} + +function CALC(args) { + if (args.length !== 3) { + console.warn("skipped call to CALC with " + args.length + " arguments."); + return; + } + var a = strictToInt(args[0]); + var b = strictToInt(args[2]); + if (isNaN(a) || isNaN(b)) { + console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); + return; + } + var result; + switch (args[1]) { + case "+": + result = a + b; + break; + case "-": + result = a - b; + break; + case "*": + result = a * b; + break; + default: + // Only * and + seen in the parsers. + console.warn("unknown CALC operation '" + args[1] + "'."); + return; + } + // Always return a string + return result !== undefined ? "" + result : result; +} + +var quoteChars = "\"'`"; +function RMQ(args) { + if(args.length !== 1) { + console.warn("RMQ: only one argument expected"); + return; + } + var value = args[0].trim(); + var n = value.length; + var char; + return n > 1 + && (char=value.charAt(0)) === value.charAt(n-1) + && quoteChars.indexOf(char) !== -1? + value.substr(1, n-2) + : value; +} + +function call(opts) { + var args = new Array(opts.args.length); + return function (evt) { + for (var i = 0; i < opts.args.length; i++) + if ((args[i] = opts.args[i](evt)) == null) return; + var result = opts.fn(args); + if (result != null) { + evt.Put(opts.dest, result); + } + }; +} + +function nop(evt) { +} + +function appendErrorMsg(evt, msg) { + var value = evt.Get("error.message"); + if (value == null) { + value = [msg]; + } else if (msg instanceof Array) { + value.push(msg); + } else { + value = [value, msg]; + } + evt.Put("error.message", value); +} + +function unimplemented(name) { + appendErrorMsg("unimplemented feature: " + name); +} + +function lookup(opts) { + return function (evt) { + var key = opts.key(evt); + if (key == null) return; + var value = opts.map.keyvaluepairs[key]; + if (value === undefined) { + value = opts.map.default; + } + if (value !== undefined) { + evt.Put(opts.dest, value(evt)); + } + }; +} + +function set(fields) { + return new processor.AddFields({ + target: FIELDS_OBJECT, + fields: fields, + }); +} + +function setf(dst, src) { + return function (evt) { + var val = evt.Get(FIELDS_PREFIX + src); + if (val != null) evt.Put(FIELDS_PREFIX + dst, val); + }; +} + +function setc(dst, value) { + return function (evt) { + evt.Put(FIELDS_PREFIX + dst, value); + }; +} + +function set_field(opts) { + return function (evt) { + var val = opts.value(evt); + if (val != null) evt.Put(opts.dest, val); + }; +} + +function dump(label) { + return function (evt) { + console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); + }; +} + +function date_time_join_args(evt, arglist) { + var str = ""; + for (var i = 0; i < arglist.length; i++) { + var fname = FIELDS_PREFIX + arglist[i]; + var val = evt.Get(fname); + if (val != null) { + if (str !== "") str += " "; + str += val; + } else { + if (debug) console.warn("in date_time: input arg " + fname + " is not set"); + } + } + return str; +} + +function to2Digit(num) { + return num? (num < 10? "0" + num : num) : "00"; +} + +// Make two-digit dates 00-69 interpreted as 2000-2069 +// and dates 70-99 translated to 1970-1999. +var twoDigitYearEpoch = 70; +var twoDigitYearCentury = 2000; + +// This is to accept dates up to 2 days in the future, only used when +// no year is specified in a date. 2 days should be enough to account for +// time differences between systems and different tz offsets. +var maxFutureDelta = 2*24*60*60*1000; + +// DateContainer stores date fields and then converts those fields into +// a Date. Necessary because building a Date using its set() methods gives +// different results depending on the order of components. +function DateContainer(tzOffset) { + this.offset = tzOffset === undefined? "Z" : tzOffset; +} + +DateContainer.prototype = { + setYear: function(v) {this.year = v;}, + setMonth: function(v) {this.month = v;}, + setDay: function(v) {this.day = v;}, + setHours: function(v) {this.hours = v;}, + setMinutes: function(v) {this.minutes = v;}, + setSeconds: function(v) {this.seconds = v;}, + + setUNIX: function(v) {this.unix = v;}, + + set2DigitYear: function(v) { + this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; + }, + + toDate: function() { + if (this.unix !== undefined) { + return new Date(this.unix * 1000); + } + if (this.day === undefined || this.month === undefined) { + // Can't make a date from this. + return undefined; + } + if (this.year === undefined) { + // A date without a year. Set current year, or previous year + // if date would be in the future. + var now = new Date(); + this.year = now.getFullYear(); + var date = this.toDate(); + if (date.getTime() - now.getTime() > maxFutureDelta) { + date.setFullYear(now.getFullYear() - 1); + } + return date; + } + var MM = to2Digit(this.month); + var DD = to2Digit(this.day); + var hh = to2Digit(this.hours); + var mm = to2Digit(this.minutes); + var ss = to2Digit(this.seconds); + return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); + } +} + +function date_time_try_pattern(fmt, str, tzOffset) { + var date = new DateContainer(tzOffset); + var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); + return pos !== undefined? date.toDate() : undefined; +} + +function date_time_try_pattern_at_pos(fmt, str, pos, date) { + var len = str.length; + for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { + pos = fmt[proc](str, pos, date); + } + return pos; +} + +function date_time(opts) { + return function (evt) { + var tzOffset = opts.tz || tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); + if (date !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, date); + return; + } + } + if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); + }; +} + +var uA = 60 * 60 * 24; +var uD = 60 * 60 * 24; +var uF = 60 * 60; +var uG = 60 * 60 * 24 * 30; +var uH = 60 * 60; +var uI = 60 * 60; +var uJ = 60 * 60 * 24; +var uM = 60 * 60 * 24 * 30; +var uN = 60 * 60; +var uO = 1; +var uS = 1; +var uT = 60; +var uU = 60; +var uc = dc; + +function duration(opts) { + return function(evt) { + var str = date_time_join_args(evt, opts.args); + for (var i = 0; i < opts.fmts.length; i++) { + var seconds = duration_try_pattern(opts.fmts[i], str); + if (seconds !== undefined) { + evt.Put(FIELDS_PREFIX + opts.dest, seconds); + return; + } + } + if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); + }; +} + +function duration_try_pattern(fmt, str) { + var secs = 0; + var pos = 0; + for (var i=0; i [ month_id , how many chars to skip if month in long form ] + "Jan": [0, 4], + "Feb": [1, 5], + "Mar": [2, 2], + "Apr": [3, 2], + "May": [4, 0], + "Jun": [5, 1], + "Jul": [6, 1], + "Aug": [7, 3], + "Sep": [8, 6], + "Oct": [9, 4], + "Nov": [10, 5], + "Dec": [11, 4], + "jan": [0, 4], + "feb": [1, 5], + "mar": [2, 2], + "apr": [3, 2], + "may": [4, 0], + "jun": [5, 1], + "jul": [6, 1], + "aug": [7, 3], + "sep": [8, 6], + "oct": [9, 4], + "nov": [10, 5], + "dec": [11, 4], +}; + +// var dC = undefined; +var dR = dateMonthName(true); +var dB = dateMonthName(false); +var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); +var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); +var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); +var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); +var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); +var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 +var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); +var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); +var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); +var dP = parseAMPM; // AM|PM +var dQ = parseAMPM; // A.M.|P.M +var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); +var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); +var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); +var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); +var dZ = parseHMS; +var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); + +// parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. +// Only works if this modifier appears after the hour has been read from logs +// which is always the case in the 300 devices. +function parseAMPM(str, pos, date) { + var n = str.length; + var start = skipws(str, pos); + if (start + 2 > n) return; + var head = str.substr(start, 2).toUpperCase(); + var isPM = false; + var skip = false; + switch (head) { + case "A.": + skip = true; + /* falls through */ + case "AM": + break; + case "P.": + skip = true; + /* falls through */ + case "PM": + isPM = true; + break; + default: + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); + return; + } + pos = start + 2; + if (skip) { + if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { + if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); + return; + } + pos += 2; + } + var hh = date.hours; + if (isPM) { + // Accept existing hour in 24h format. + if (hh < 12) hh += 12; + } else { + if (hh === 12) hh = 0; + } + date.setHours(hh); + return pos; +} + +function parseHMS(str, pos, date) { + return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); +} + +function skipws(str, pos) { + for ( var n = str.length; + pos < n && str.charAt(pos) === " "; + pos++) + ; + return pos; +} + +function skipdigits(str, pos) { + var c; + for (var n = str.length; + pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; + pos++) + ; + return pos; +} + +function dSkip(str, pos, date) { + var chr; + for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} + return pos < str.length? pos : undefined; +} + +function dateVariableWidthNumber(fmtChar, min, max, setter) { + return function (str, pos, date) { + var start = skipws(str, pos); + pos = skipdigits(str, start); + var s = str.substr(start, pos - start); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos; + } + return; + }; +} + +function dateFixedWidthNumber(fmtChar, width, min, max, setter) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + width > n) return; + var s = str.substr(pos, width); + var value = parseInt(s, 10); + if (value >= min && value <= max) { + setter.call(date, value); + return pos + width; + } + return; + }; +} + +// Short month name (Jan..Dec). +function dateMonthName(long) { + return function (str, pos, date) { + pos = skipws(str, pos); + var n = str.length; + if (pos + 3 > n) return; + var mon = str.substr(pos, 3); + var idx = shortMonths[mon]; + if (idx === undefined) { + idx = shortMonths[mon.toLowerCase()]; + } + if (idx === undefined) { + //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); + return; + } + date.setMonth(idx[0]+1); + return pos + 3 + (long ? idx[1] : 0); + }; +} + +function url_wrapper(dst, src, fn) { + return function(evt) { + var value = evt.Get(FIELDS_PREFIX + src), result; + if (value != null && (result = fn(value))!== undefined) { + evt.Put(FIELDS_PREFIX + dst, result); + } else { + console.error(fn.name + " failed for '" + value + "'"); + } + }; +} + +// The following regular expression for parsing URLs from: +// https://github.com/wizard04wsu/URI_Parsing +// +// The MIT License (MIT) +// +// Copyright (c) 2014 Andrew Harrison +// +// Permission is hereby granted, free of charge, to any person obtaining a copy of +// this software and associated documentation files (the "Software"), to deal in +// the Software without restriction, including without limitation the rights to +// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +// the Software, and to permit persons to whom the Software is furnished to do so, +// subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in all +// copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +// FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +// COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +// IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +// CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; + +var uriScheme = 1; +var uriDomain = 5; +var uriPort = 6; +var uriPath = 7; +var uriPathAlt = 9; +var uriQuery = 11; + +function domain(dst, src) { + return url_wrapper(dst, src, extract_domain); +} + +function split_url(value) { + var m = value.match(uriRegExp); + if (m && m[uriDomain]) return m; + // Support input in the form "www.example.net/path", but not "/path". + m = ("null://" + value).match(uriRegExp); + if (m) return m; +} + +function extract_domain(value) { + var m = split_url(value); + if (m && m[uriDomain]) return m[uriDomain]; +} + +var extFromPage = /\.[^.]+$/; +function extract_ext(value) { + var page = extract_page(value); + if (page) { + var m = page.match(extFromPage); + if (m) return m[0]; + } +} + +function ext(dst, src) { + return url_wrapper(dst, src, extract_ext); +} + +function fqdn(dst, src) { + // TODO: fqdn and domain(eTLD+1) are currently the same. + return domain(dst, src); +} + +var pageFromPathRegExp = /\/([^\/]+)$/; +var pageName = 1; + +function extract_page(value) { + value = extract_path(value); + if (!value) return undefined; + var m = value.match(pageFromPathRegExp); + if (m) return m[pageName]; +} + +function page(dst, src) { + return url_wrapper(dst, src, extract_page); +} + +function extract_path(value) { + var m = split_url(value); + return m? m[uriPath] || m[uriPathAlt] : undefined; +} + +function path(dst, src) { + return url_wrapper(dst, src, extract_path); +} + +// Map common schemes to their default port. +// port has to be a string (will be converted at a later stage). +var schemePort = { + "ftp": "21", + "ssh": "22", + "http": "80", + "https": "443", +}; + +function extract_port(value) { + var m = split_url(value); + if (!m) return undefined; + if (m[uriPort]) return m[uriPort]; + if (m[uriScheme]) { + return schemePort[m[uriScheme]]; + } +} + +function port(dst, src) { + return url_wrapper(dst, src, extract_port); +} + +function extract_query(value) { + var m = split_url(value); + if (m && m[uriQuery]) return m[uriQuery]; +} + +function query(dst, src) { + return url_wrapper(dst, src, extract_query); +} + +function extract_root(value) { + var m = split_url(value); + if (m && m[uriDomain] && m[uriDomain]) { + var scheme = m[uriScheme] && m[uriScheme] !== "null"? + m[uriScheme] + "://" : ""; + var port = m[uriPort]? ":" + m[uriPort] : ""; + return scheme + m[uriDomain] + port; + } +} + +function root(dst, src) { + return url_wrapper(dst, src, extract_root); +} + +function tagval(id, src, cfg, keys, on_success) { + var fail = function(evt) { + evt.Put(FLAG_FIELD, "tagval_parsing_error"); + } + if (cfg.kv_separator.length !== 1) { + throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); + } + var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? + cfg.open_quote.length + cfg.close_quote.length : 0; + var kv_regex = new RegExp('^*([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + '*(.*)*$'); + return function(evt) { + var msg = evt.Get(src); + if (msg === undefined) { + console.warn("tagval: input field is missing"); + return fail(evt); + } + var pairs = msg.split(cfg.pair_separator); + var i; + var success = false; + var prev = ""; + for (i=0; i 0 && + value.length >= cfg.open_quote.length + cfg.close_quote.length && + value.substr(0, cfg.open_quote.length) === cfg.open_quote && + value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { + value = value.substr(cfg.open_quote.length, value.length - quotes_len); + } + evt.Put(FIELDS_PREFIX + field, value); + success = true; + } + if (!success) { + return fail(evt); + } + if (on_success != null) { + on_success(evt); + } + } +} + +var ecs_mappings = { + "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, + "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, + "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, + "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, + "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, + "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, + "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, + "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, + "application": {to:[{field: "network.application", setter: fld_set}]}, + "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, + "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, + "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, + "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, + "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, + "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, + "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, + "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, + "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, + "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, + "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, + "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, + "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, + "dhost": {to:[{field: "destination.address", setter: fld_set}]}, + "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, + "direction": {to:[{field: "network.direction", setter: fld_set}]}, + "directory": {to:[{field: "file.directory", setter: fld_set}]}, + "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, + "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, + "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, + "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, + "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0}]}, + "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, + "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, + "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, + "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, + "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, + "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, + "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, + "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, + "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, + "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, + "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, + "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, + "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, + "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, + "filepath": {to:[{field: "file.path", setter: fld_set}]}, + "filetype": {to:[{field: "file.type", setter: fld_set}]}, + "group": {to:[{field: "group.name", setter: fld_set}]}, + "groupid": {to:[{field: "group.id", setter: fld_set}]}, + "host": {to:[{field: "host.name", setter: fld_prio, prio: 1}]}, + "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, + "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, + "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, + "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, + "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, + "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, + "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, + "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, + "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, + "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, + "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, + "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, + "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, + "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, + "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, + "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, + "method": {to:[{field: "http.request.method", setter: fld_set}]}, + "msg": {to:[{field: "log.original", setter: fld_set}]}, + "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, + "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, + "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, + "parent_pid": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 0}]}, + "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, + "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, + "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, + "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, + "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, + "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, + "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, + "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, + "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, + "process_id_src": {convert: to_long, to:[{field: "process.ppid", setter: fld_prio, prio: 1}]}, + "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, + "product": {to:[{field: "observer.product", setter: fld_set}]}, + "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, + "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, + "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, + "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, + "rulename": {to:[{field: "rule.name", setter: fld_set}]}, + "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_append},{field: "related.ip", setter: fld_append}]}, + "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, + "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, + "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, + "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, + "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, + "severity": {to:[{field: "log.level", setter: fld_set}]}, + "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set}]}, + "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, + "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, + "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, + "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, + "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, + "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, + "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, + "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, + "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, + "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, + "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, + "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, + "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, + "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, + "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, + "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, + "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, + "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, + "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, + "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, + "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, + "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, + "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, + "version": {to:[{field: "observer.version", setter: fld_set}]}, + "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1}]}, + "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, + "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, + "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, + "web_root": {to:[{field: "url.path", setter: fld_set}]}, + "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, +}; + +var rsa_mappings = { + "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, + "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, + "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, + "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, + "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, + "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, + "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, + "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, + "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, + "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, + "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, + "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, + "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, + "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, + "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, + "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, + "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, + "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, + "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, + "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, + "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, + "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, + "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, + "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, + "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, + "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, + "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, + "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, + "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, + "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, + "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, + "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, + "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, + "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, + "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, + "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, + "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, + "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, + "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, + "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, + "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, + "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, + "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, + "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, + "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, + "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, + "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, + "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, + "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, + "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, + "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, + "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, + "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, + "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, + "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, + "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, + "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, + "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, + "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, + "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, + "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, + "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, + "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, + "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, + "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, + "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, + "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, + "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, + "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, + "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, + "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, + "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, + "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, + "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, + "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, + "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, + "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, + "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, + "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, + "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, + "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, + "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, + "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, + "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, + "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, + "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, + "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, + "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, + "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, + "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, + "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, + "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, + "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, + "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, + "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, + "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, + "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, + "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, + "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, + "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, + "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, + "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, + "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, + "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, + "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, + "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, + "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, + "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, + "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, + "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, + "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, + "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, + "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, + "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, + "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, + "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, + "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, + "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, + "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, + "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, + "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, + "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, + "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, + "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, + "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, + "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, + "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, + "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, + "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, + "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, + "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, + "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, + "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, + "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, + "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, + "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, + "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, + "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, + "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, + "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, + "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, + "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, + "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, + "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, + "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, + "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, + "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, + "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, + "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, + "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, + "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, + "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, + "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, + "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, + "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, + "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, + "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, + "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, + "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, + "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, + "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, + "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, + "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, + "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, + "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, + "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, + "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, + "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, + "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, + "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, + "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, + "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, + "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, + "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, + "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, + "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, + "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, + "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, + "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, + "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, + "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, + "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, + "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, + "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, + "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, + "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, + "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, + "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, + "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, + "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, + "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, + "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, + "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, + "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, + "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, + "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, + "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, + "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, + "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, + "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, + "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, + "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, + "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, + "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, + "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, + "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, + "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, + "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, + "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, + "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, + "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, + "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, + "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, + "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, + "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, + "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, + "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, + "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, + "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, + "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, + "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, + "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, + "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, + "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, + "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, + "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, + "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, + "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, + "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, + "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, + "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, + "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, + "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, + "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, + "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, + "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, + "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, + "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, + "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, + "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, + "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, + "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, + "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, + "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, + "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, + "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, + "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, + "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, + "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, + "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, + "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, + "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, + "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, + "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, + "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, + "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, + "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, + "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, + "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, + "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, + "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, + "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, + "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, + "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, + "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, + "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, + "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, + "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, + "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, + "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, + "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, + "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, + "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, + "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, + "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, + "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, + "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, + "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, + "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, + "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, + "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, + "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, + "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, + "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, + "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, + "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, + "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, + "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, + "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, + "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, + "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, + "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, + "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, + "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, + "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, + "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, + "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, + "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, + "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, + "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, + "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, + "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, + "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, + "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, + "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, + "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, + "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, + "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, + "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, + "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, + "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, + "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, + "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, + "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, + "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, + "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, + "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, + "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, + "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, + "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, + "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, + "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, + "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, + "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, + "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, + "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, + "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, + "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, + "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, + "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, + "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, + "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, + "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, + "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, + "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, + "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, + "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, + "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, + "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, + "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, + "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, + "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, + "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, + "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, + "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, + "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, + "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, + "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, + "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, + "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, + "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, + "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, + "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, + "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, + "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, + "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, + "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, + "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, + "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, + "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, + "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, + "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, + "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, + "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, + "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, + "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, + "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, + "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, + "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, + "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, + "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, + "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, + "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, + "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, + "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, + "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, + "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, + "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, + "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, + "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, + "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, + "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, + "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, + "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, + "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, + "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, + "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, + "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, + "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, + "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, + "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, + "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, + "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, + "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, + "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, + "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, + "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, + "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, + "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, + "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, + "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, + "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, + "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, + "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, + "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, + "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, + "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, + "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, + "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, + "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, + "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, + "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, + "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, + "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, + "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, + "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, + "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, + "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, + "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, + "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, + "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, + "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, + "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, + "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, + "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, + "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, + "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, + "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, + "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, + "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, + "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, + "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, + "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, + "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, + "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, + "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, + "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, + "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, + "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, + "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, + "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, + "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, + "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, + "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, + "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, + "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, + "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, + "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, + "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, + "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, + "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, + "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, + "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, + "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, + "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, + "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, + "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, + "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, + "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, + "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, + "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, + "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, + "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, + "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, + "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, + "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, + "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, + "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, + "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, + "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, + "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, + "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, + "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, + "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, + "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, + "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, + "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, + "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, + "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, + "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, + "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, + "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, + "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, + "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, + "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, + "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, + "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, + "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, + "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, + "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, + "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, + "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, + "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, + "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, + "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, + "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, + "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, + "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, + "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, + "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, + "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, + "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, + "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, + "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, + "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, + "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, + "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, + "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, + "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, + "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, + "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, + "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, + "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, + "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, + "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, + "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, + "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, + "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, + "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, + "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, + "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, + "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, + "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, + "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, + "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, + "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, + "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, + "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, + "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, + "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, + "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, + "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, + "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, + "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, + "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, + "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, + "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, + "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, + "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, + "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, + "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, + "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, + "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, + "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, + "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, + "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, + "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, + "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, + "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, + "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, + "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, + "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, + "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, + "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, + "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, + "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, + "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, + "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, + "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, + "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, + "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, + "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, + "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, + "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, + "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, + "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, + "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, + "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, + "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, + "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, + "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, + "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, + "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, + "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, + "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, + "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, + "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, + "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, + "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, + "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, + "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, + "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, + "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, + "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, + "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, + "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, + "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, + "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, + "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, + "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, + "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, + "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, + "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, + "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, + "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, + "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, + "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, + "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, + "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, + "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, + "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, + "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, + "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, + "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, + "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, + "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, + "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, + "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, + "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, + "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, + "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, + "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, + "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, + "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, + "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, + "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, + "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, + "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, + "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, + "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, + "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, + "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, + "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, + "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, + "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, + "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, + "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, + "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, + "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, + "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, + "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, + "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, + "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, + "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, + "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, + "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, + "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, + "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, + "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, + "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, + "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, + "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, + "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, + "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, + "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, + "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, + "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, + "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, + "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, + "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, + "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, + "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, + "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, + "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, + "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, + "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, + "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, + "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, + "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, + "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, + "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, + "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, + "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, + "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, + "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, + "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, + "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, + "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, + "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, + "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, + "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, + "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, + "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, + "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, + "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, + "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, + "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, + "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, + "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, + "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, + "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, + "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, + "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, +}; + +function to_date(value) { + switch (typeof (value)) { + case "object": + // This is a Date. But as it was obtained from evt.Get(), the VM + // doesn't see it as a JS Date anymore, thus value instanceof Date === false. + // Have to trust that any object here is a valid Date for Go. + return value; + case "string": + var asDate = new Date(value); + if (!isNaN(asDate)) return asDate; + } +} + +// ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. +var maxSafeInt = Math.pow(2, 53) - 1; +var minSafeInt = -maxSafeInt; + +function to_long(value) { + var num = parseInt(value); + // Better not to index a number if it's not safe (above 53 bits). + return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; +} + +function to_ip(value) { + if (value.indexOf(":") === -1) + return to_ipv4(value); + return to_ipv6(value); +} + +var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; +var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; + +function to_ipv4(value) { + var result = ipv4_regex.exec(value); + if (result == null || result.length !== 5) return; + for (var i = 1; i < 5; i++) { + var num = strictToInt(result[i]); + if (isNaN(num) || num < 0 || num > 255) return; + } + return value; +} + +function to_ipv6(value) { + var sqEnd = value.indexOf("]"); + if (sqEnd > -1) { + if (value.charAt(0) !== "[") return; + value = value.substr(1, sqEnd - 1); + } + var zoneOffset = value.indexOf("%"); + if (zoneOffset > -1) { + value = value.substr(0, zoneOffset); + } + var parts = value.split(":"); + if (parts == null || parts.length < 3 || parts.length > 8) return; + var numEmpty = 0; + var innerEmpty = 0; + for (var i = 0; i < parts.length; i++) { + if (parts[i].length === 0) { + numEmpty++; + if (i > 0 && i + 1 < parts.length) innerEmpty++; + } else if (!parts[i].match(ipv6_hex_regex) && + // Accept an IPv6 with a valid IPv4 at the end. + ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { + return; + } + } + return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; +} + +function to_double(value) { + return parseFloat(value); +} + +function to_mac(value) { + // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. + return value; +} + +function to_lowercase(value) { + // to_lowercase is used against keyword fields, which can accept + // any other type (numbers, dates). + return typeof(value) === "string"? value.toLowerCase() : value; +} + +function fld_set(dst, value) { + dst[this.field] = { v: value }; +} + +function fld_append(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: [value] }; + } else { + var base = dst[this.field]; + if (base.v.indexOf(value)===-1) base.v.push(value); + } +} + +function fld_prio(dst, value) { + if (dst[this.field] === undefined) { + dst[this.field] = { v: value, prio: this.prio}; + } else if(this.prio < dst[this.field].prio) { + dst[this.field].v = value; + dst[this.field].prio = this.prio; + } +} + +var valid_ecs_outcome = { + 'failure': true, + 'success': true, + 'unknown': true +}; + +function fld_ecs_outcome(dst, value) { + value = value.toLowerCase(); + if (valid_ecs_outcome[value] === undefined) { + value = 'unknown'; + } + if (dst[this.field] === undefined) { + dst[this.field] = { v: value }; + } else if (dst[this.field].v === 'unknown') { + dst[this.field] = { v: value }; + } +} + +function map_all(evt, targets, value) { + for (var i = 0; i < targets.length; i++) { + evt.Put(targets[i], value); + } +} + +function populate_fields(evt) { + var base = evt.Get(FIELDS_OBJECT); + if (base === null) return; + alternate_datetime(evt); + if (map_ecs) { + do_populate(evt, base, ecs_mappings); + } + if (map_rsa) { + do_populate(evt, base, rsa_mappings); + } + if (keep_raw) { + evt.Put("rsa.raw", base); + } + evt.Delete(FIELDS_OBJECT); +} + +var datetime_alt_components = [ + {field: "day", fmts: [[dF]]}, + {field: "year", fmts: [[dW]]}, + {field: "month", fmts: [[dB],[dG]]}, + {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, + {field: "hour", fmts: [[dN]]}, + {field: "min", fmts: [[dU]]}, + {field: "secs", fmts: [[dO]]}, + {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, +]; + +function alternate_datetime(evt) { + if (evt.Get(FIELDS_PREFIX + "event_time") != null) { + return; + } + var tzOffset = tz_offset; + if (tzOffset === "event") { + tzOffset = evt.Get("event.timezone"); + } + var container = new DateContainer(tzOffset); + for (var i=0; i} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var dup82 = setc("result","Traffic has not been blocked from application."); + +var dup83 = setc("result","Traffic has been blocked from application."); + +var dup84 = setc("eventcategory","1002000000"); + +var dup85 = setc("event_description","Denial of Service 'Smurf' attack detected."); + +var dup86 = setc("eventcategory","1603000000"); + +var dup87 = setf("hostip","hhostip"); + +var dup88 = setc("event_description","Host Integrity check passed"); + +var dup89 = setc("event_description","Host Integrity check failed."); + +var dup90 = // "Pattern{Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); + +var dup91 = // "Pattern{}" +match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); + +var dup92 = setc("eventcategory","1702010000"); + +var dup93 = date_time({ + dest: "event_time", + args: ["fld17","fld18"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup94 = setf("hostip","hhost"); + +var dup95 = setc("eventcategory","1701010000"); + +var dup96 = setc("ec_activity","Create"); + +var dup97 = setc("ec_theme","Configuration"); + +var dup98 = // "Pattern{Constant('"Location: '), Field(p0,false)}" +match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); + +var dup99 = // "Pattern{Constant('Location: '), Field(p0,false)}" +match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); + +var dup100 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); + +var dup101 = // "Pattern{Field(fld4,false), Constant(',MD-5:'), Field(fld5,false), Constant(',Local:'), Field(p0,false)}" +match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); + +var dup102 = // "Pattern{Constant('Local:'), Field(p0,false)}" +match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); + +var dup103 = setc("event_description","Active Response"); + +var dup104 = setc("dclass_counter1_string","Occurrences"); + +var dup105 = // "Pattern{Constant('Rule: '), Field(rulename,false), Constant(',Location: '), Field(p0,false)}" +match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); + +var dup106 = // "Pattern{Constant(' "Rule: '), Field(rulename,false), Constant('",Location: '), Field(p0,false)}" +match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); + +var dup107 = // "Pattern{Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" +match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); + +var dup108 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); + +var dup109 = // "Pattern{Constant(' Domain: '), Field(domain,false)}" +match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); + +var dup110 = setc("eventcategory","1003010000"); + +var dup111 = call({ + dest: "nwparser.sigid_string", + fn: STRCAT, + args: [ + field("fld28"), + constant("CVE-"), + field("cve"), + ], +}); + +var dup112 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(p0,false)}" +match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); + +var dup113 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(p0,false)}" +match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); + +var dup114 = // "Pattern{Field(fld25,false)}" +match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); + +var dup115 = setc("ec_subject","Virus"); + +var dup116 = setc("ec_activity","Detect"); + +var dup117 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var dup118 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var dup119 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); + +var dup120 = setc("eventcategory","1801000000"); + +var dup121 = setc("eventcategory","1401010000"); + +var dup122 = setf("shost","hsource"); + +var dup123 = setc("event_description","File Read Begin."); + +var dup124 = setc("ec_subject","File"); + +var dup125 = setc("action","Read"); + +var dup126 = setc("event_description","Create Process."); + +var dup127 = setc("event_description","File Write."); + +var dup128 = setc("action","Write"); + +var dup129 = setf("saddr","hsaddr"); + +var dup130 = setc("event_description","File Read."); + +var dup131 = setc("action","Delete"); + +var dup132 = setf("process","filename"); + +var dup133 = setc("event_description","File Write Begin."); + +var dup134 = date_time({ + dest: "starttime", + args: ["fld2","fld3"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup135 = date_time({ + dest: "endtime", + args: ["fld4","fld5"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup136 = setc("eventcategory","1701020000"); + +var dup137 = setf("domain","hdomain"); + +var dup138 = setc("event_description","The client has downloaded file successfully."); + +var dup139 = // "Pattern{Constant('The client will block traffic from IP address '), Field(fld14,true), Constant(' for the next '), Field(duration_string,true), Constant(' (from '), Field(fld13,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); + +var dup140 = // "Pattern{Constant('.,'), Field(p0,false)}" +match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); + +var dup141 = // "Pattern{Constant(' . ,'), Field(p0,false)}" +match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); + +var dup142 = setf("shost","hclient"); + +var dup143 = setc("event_description","The client will block traffic."); + +var dup144 = setc("event_description","The client has successfully downloaded and applied a license file"); + +var dup145 = // "Pattern{Constant('Commercial application detected,Computer name: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); + +var dup146 = // "Pattern{Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); + +var dup147 = // "Pattern{Field(shost,false), Constant(',Detection type: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); + +var dup148 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var dup149 = // "Pattern{Constant('"'), Field(filename,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); + +var dup150 = // "Pattern{Field(filename,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); + +var dup151 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var dup152 = setf("threat_name","virusname"); + +var dup153 = date_time({ + dest: "recorded_time", + args: ["fld19"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup154 = date_time({ + dest: "endtime", + args: ["fld51"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup155 = setc("event_description","Commercial application detected"); + +var dup156 = setc("eventcategory","1701030000"); + +var dup157 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); + +var dup158 = setf("administrator","husername"); + +var dup159 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(p0,false)}" +match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); + +var dup160 = // "Pattern{Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); + +var dup161 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(','), Field(fld53,false), Constant(',Permitted application reason: '), Field(fld54,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var dup162 = setc("event_description","Security risk found"); + +var dup163 = date_time({ + dest: "event_time", + args: ["fld5","fld6"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup164 = date_time({ + dest: "recorded_time", + args: ["fld12"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup165 = setc("eventcategory","1701000000"); + +var dup166 = date_time({ + dest: "event_time", + args: ["fld5","fld6"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup167 = setc("event_description","Could not start service engine."); + +var dup168 = setc("eventcategory","1603040000"); + +var dup169 = setc("event_description","Disconnected from Symantec Endpoint Protection Manager."); + +var dup170 = setc("eventcategory","1402020200"); + +var dup171 = setc("eventcategory","1402020100"); + +var dup172 = setc("ec_activity","Enable"); + +var dup173 = setc("event_description","Failed to connect to the server."); + +var dup174 = setc("eventcategory","1301000000"); + +var dup175 = setc("event_description","Failed to Login to Remote Site"); + +var dup176 = // "Pattern{Constant('"'), Field(,false)}" +match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); + +var dup177 = setc("ec_subject","Group"); + +var dup178 = setc("ec_theme","UserGroup"); + +var dup179 = setc("eventcategory","1701070000"); + +var dup180 = setc("event_description","Host Integrity check is disabled."); + +var dup181 = setc("event_description","Host Integrity failed but reported as pass"); + +var dup182 = // "Pattern{Constant(' Domain:'), Field(p0,false)}" +match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); + +var dup183 = // "Pattern{Constant('is '), Field(p0,false)}" +match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); + +var dup184 = setc("event_description","LiveUpdate"); + +var dup185 = setc("event_description","Submitting information to Symantec failed."); + +var dup186 = // "Pattern{Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); + +var dup187 = setc("ec_outcome","Error"); + +var dup188 = setc("event_description","LiveUpdate encountered an error."); + +var dup189 = setf("hostid","hhost"); + +var dup190 = setc("event_description","The latest SONAR Definitions update failed to load."); + +var dup191 = // "Pattern{Constant('",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); + +var dup192 = date_time({ + dest: "event_time", + args: ["fld5","fld6"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dN,dc(":"),dU,dc(":"),dO,dP], + ], +}); + +var dup193 = setc("event_description","Virus Found"); + +var dup194 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); + +var dup195 = setc("event_description","Virus Definition File Update"); + +var dup196 = setf("event_description","hfld1"); + +var dup197 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); + +var dup198 = // "Pattern{Constant('"'), Field(fld1,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); + +var dup199 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); + +var dup200 = setc("event_description","Virus found"); + +var dup201 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(p0,false)}" +match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); + +var dup202 = // "Pattern{Constant('Source: '), Field(p0,false)}" +match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); + +var dup203 = // "Pattern{Constant('"Group: '), Field(group,false), Constant('",Server: '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); + +var dup204 = // "Pattern{Constant('Group: '), Field(group,false), Constant(',Server: '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); + +var dup205 = // "Pattern{Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); + +var dup206 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" +match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); + +var dup207 = // "Pattern{Field(filename_size,false)}" +match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); + +var dup208 = // "Pattern{Constant('Virus found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); + +var dup209 = // "Pattern{Constant('"'), Field(info,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); + +var dup210 = // "Pattern{Field(info,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); + +var dup211 = // "Pattern{Constant(''), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); + +var dup212 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); + +var dup213 = setc("eventcategory","1701060000"); + +var dup214 = setc("event_description","Network Audit Search Unagented Hosts From NST Finished Abnormally."); + +var dup215 = setc("event_description","Network Intrusion Prevention is malfunctioning"); + +var dup216 = // "Pattern{Constant(' by policy'), Field(,false)}" +match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); + +var dup217 = setc("event_description","Generic Exploit Mitigation"); + +var dup218 = setc("event_description","No objects got swept."); + +var dup219 = setc("event_description","Organization importing finished successfully."); + +var dup220 = setc("event_description","Organization importing started."); + +var dup221 = setc("event_description","Number of Group Update Providers"); + +var dup222 = setf("shost","hhostid"); + +var dup223 = setc("ec_theme","Policy"); + +var dup224 = setc("event_description","Policy has been added"); + +var dup225 = setc("event_description","Policy has been edited"); + +var dup226 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); + +var dup227 = setc("event_description","Potential risk found"); + +var dup228 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(p0,false)}" +match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); + +var dup229 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var dup230 = date_time({ + dest: "recorded_time", + args: ["fld20"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup231 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was denied by user'), Field(fld6,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); + +var dup232 = setc("eventcategory","1606000000"); + +var dup233 = setc("event_description","Retry."); + +var dup234 = setc("event_description","Successfully deleted the client install package"); + +var dup235 = setc("event_description","Risk Repair Failed"); + +var dup236 = setc("event_description","Risk Repaired"); + +var dup237 = setc("event_description","Scan Start/Stop"); + +var dup238 = setc("event_description","Scan Start"); + +var dup239 = setc("dclass_counter1_string","Infected Count."); + +var dup240 = setc("dclass_counter2_string","Total File Count."); + +var dup241 = setc("dclass_counter3_string","Threat Count."); + +var dup242 = date_time({ + dest: "starttime", + args: ["fld1"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], +}); + +var dup243 = setc("event_description","Scan"); + +var dup244 = setc("dclass_counter1_string","Infected"); + +var dup245 = setc("dclass_counter2_string","Files scanned"); + +var dup246 = setc("dclass_counter3_string","Threats"); + +var dup247 = setc("dclass_counter1_string","Risk Count."); + +var dup248 = setc("dclass_counter2_string","Scan Count."); + +var dup249 = // "Pattern{Constant('''), Field(context,false), Constant('','), Field(p0,false)}" +match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); + +var dup250 = // "Pattern{Constant('Security risk found,Computer name: '), Field(p0,false)}" +match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); + +var dup251 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); + +var dup252 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false)}" +match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); + +var dup253 = setc("event_description","Compressed File"); + +var dup254 = setc("event_description","Stop serving as the Group Update Provider (proxy server)."); + +var dup255 = setc("event_description","Symantec AntiVirus Startup/Shutdown"); + +var dup256 = setc("eventcategory","1611000000"); + +var dup257 = setc("eventcategory","1610000000"); + +var dup258 = setc("event_description","services failed to start"); + +var dup259 = setc("eventcategory","1608010000"); + +var dup260 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); + +var dup261 = // "Pattern{Constant('[Antivirus'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); + +var dup262 = // "Pattern{Constant('"[Antivirus'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); + +var dup263 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); + +var dup264 = // "Pattern{Constant('detection'), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); + +var dup265 = // "Pattern{Constant('advanced heuristic detection'), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); + +var dup266 = // "Pattern{Constant(' Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); + +var dup267 = // "Pattern{Constant('Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); + +var dup268 = setc("ec_theme","Communication"); + +var dup269 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); + +var dup270 = setc("event_description","Traffic from IP address is blocked."); + +var dup271 = // "Pattern{Constant(''), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); + +var dup272 = setc("event_description","Unexpected server error."); + +var dup273 = setc("event_description","Unsolicited incoming ARP reply detected."); + +var dup274 = setc("event_description","Windows Version info."); + +var dup275 = // "Pattern{Constant('"'), Field(filename,false), Constant('",User: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); + +var dup276 = // "Pattern{Field(filename,false), Constant(',User: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); + +var dup277 = setc("event_description","File Write"); + +var dup278 = // "Pattern{Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); + +var dup279 = setc("event_description","File Delete"); + +var dup280 = setc("event_description","File Delete Begin."); + +var dup281 = // "Pattern{Constant('""'), Field(action,true), Constant(' . Description: '), Field(p0,false)}" +match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); + +var dup282 = // "Pattern{Field(action,true), Constant(' . Description: '), Field(p0,false)}" +match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); + +var dup283 = setc("dclass_counter1_string","Virus Count."); + +var dup284 = date_time({ + dest: "event_time", + args: ["fld1","fld2","fld3"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dY,dN,dc(":"),dU,dP], + ], +}); + +var dup285 = setc("event_description","Backup succeeded and finished."); + +var dup286 = setc("event_description","Backup started."); + +var dup287 = date_time({ + dest: "event_time", + args: ["fld8"], + fmts: [ + [dX], + ], +}); + +var dup288 = setc("ec_subject","Configuration"); + +var dup289 = setc("eventcategory","1801030000"); + +var dup290 = // "Pattern{Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); + +var dup291 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); + +var dup292 = // "Pattern{Field(event_description,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); + +var dup293 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); + +var dup294 = setc("eventcategory","1803000000"); + +var dup295 = setc("ec_subject","NetworkComm"); + +var dup296 = field("fld17"); + +var dup297 = setc("event_description","Block all other IP traffic and log"); + +var dup298 = setc("rulename","Block all other IP traffic and log"); + +var dup299 = field("fld13"); + +var dup300 = date_time({ + dest: "starttime", + args: ["fld15"], + fmts: [ + [dX], + ], +}); + +var dup301 = date_time({ + dest: "endtime", + args: ["fld16"], + fmts: [ + [dX], + ], +}); + +var dup302 = setc("dclass_counter1_string","No. of attacks"); + +var dup303 = setc("event_description","Block Local File Sharing to external computers"); + +var dup304 = setc("event_description","Block all other traffic"); + +var dup305 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); + +var dup306 = field("fld11"); + +var dup307 = setc("dclass_counter1_string","No. of events repeated"); + +var dup308 = setf("filename","parent_process"); + +var dup309 = constant("Allow"); + +var dup310 = constant("Deny"); + +var dup311 = linear_select([ + dup9, + dup10, +]); + +var dup312 = lookup({ + dest: "nwparser.direction", + map: map_Direction, + key: dup49, +}); + +var dup313 = linear_select([ + dup50, + dup10, +]); + +var dup314 = linear_select([ + dup59, + dup60, + dup61, +]); + +var dup315 = linear_select([ + dup63, + dup64, +]); + +var dup316 = linear_select([ + dup76, + dup77, +]); + +var dup317 = linear_select([ + dup79, + dup80, +]); + +var dup318 = linear_select([ + dup90, + dup91, +]); + +var dup319 = linear_select([ + dup98, + dup99, +]); + +var dup320 = linear_select([ + dup101, + dup102, +]); + +var dup321 = linear_select([ + dup105, + dup106, +]); + +var dup322 = linear_select([ + dup108, + dup109, +]); + +var dup323 = linear_select([ + dup112, + dup113, +]); + +var dup324 = linear_select([ + dup140, + dup141, +]); + +var dup325 = linear_select([ + dup146, + dup147, +]); + +var dup326 = linear_select([ + dup149, + dup150, +]); + +var dup327 = linear_select([ + dup159, + dup160, +]); + +var dup328 = linear_select([ + dup198, + dup199, +]); + +var dup329 = linear_select([ + dup201, + dup202, +]); + +var dup330 = linear_select([ + dup203, + dup204, +]); + +var dup331 = linear_select([ + dup206, + dup207, +]); + +var dup332 = linear_select([ + dup209, + dup210, +]); + +var dup333 = linear_select([ + dup211, + dup212, +]); + +var dup334 = linear_select([ + dup216, + dup91, +]); + +var dup335 = linear_select([ + dup249, + dup226, +]); + +var dup336 = linear_select([ + dup252, + dup207, +]); + +var dup337 = linear_select([ + dup262, + dup261, +]); + +var dup338 = linear_select([ + dup264, + dup265, +]); + +var dup339 = linear_select([ + dup266, + dup191, + dup267, + dup176, + dup91, +]); + +var dup340 = linear_select([ + dup275, + dup276, +]); + +var dup341 = linear_select([ + dup281, + dup282, +]); + +var dup342 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" +match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ + dup53, + dup15, +])); + +var dup343 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" +match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ + dup43, + dup15, +])); + +var dup344 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup43, + dup15, + dup287, +])); + +var dup345 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup43, + dup15, + dup287, +])); + +var dup346 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup74, + dup15, + dup287, +])); + +var dup347 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup74, + dup15, + dup287, +])); + +var dup348 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup168, + dup15, + dup287, +])); + +var dup349 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup168, + dup15, + dup287, +])); + +var dup350 = linear_select([ + dup290, + dup291, + dup292, +]); + +var dup351 = lookup({ + dest: "nwparser.ec_activity", + map: map_Activity, + key: dup296, +}); + +var dup352 = lookup({ + dest: "nwparser.protocol", + map: map_Protocol, + key: dup299, +}); + +var dup353 = lookup({ + dest: "nwparser.protocol", + map: map_Protocol, + key: dup49, +}); + +var dup354 = lookup({ + dest: "nwparser.direction", + map: map_Direction, + key: dup299, +}); + +var dup355 = lookup({ + dest: "nwparser.action", + map: map_Action, + key: dup306, +}); + +var dup356 = lookup({ + dest: "nwparser.ec_activity", + map: map_Activity, + key: dup306, +}); + +var dup357 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var dup358 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var dup359 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup43, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var dup360 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" +match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ + dup43, + dup15, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); + +var dup361 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" +match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ + dup43, + dup15, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); + +var hdr1 = // "Pattern{Constant('%SYMANTECAV '), Field(p0,false)}" +match("HEADER#0:0001/0", "message", "%SYMANTECAV %{p0}"); + +var part1 = // "Pattern{Constant('Delete '), Field(p0,false)}" +match("HEADER#0:0001/1_0", "nwparser.p0", "Delete %{p0}"); + +var part2 = // "Pattern{Constant('Leave Alone '), Field(p0,false)}" +match("HEADER#0:0001/1_1", "nwparser.p0", "Leave Alone %{p0}"); + +var part3 = // "Pattern{Constant('Quarantine '), Field(p0,false)}" +match("HEADER#0:0001/1_2", "nwparser.p0", "Quarantine %{p0}"); + +var part4 = // "Pattern{Constant('Undefined '), Field(p0,false)}" +match("HEADER#0:0001/1_3", "nwparser.p0", "Undefined %{p0}"); + +var select1 = linear_select([ + part1, + part2, + part3, + part4, +]); + +var part5 = // "Pattern{Field(,false), Constant('..Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" +match("HEADER#0:0001/2", "nwparser.p0", "%{}..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ + dup1, +])); + +var all1 = all_match({ + processors: [ + hdr1, + select1, + part5, + ], + on_success: processor_chain([ + setc("header_id","0001"), + ]), +}); + +var hdr2 = // "Pattern{Constant('%SYMANTECAV Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" +match("HEADER#1:0002", "message", "%SYMANTECAV Alert: %{messageid->} %{data}..%{p0}", processor_chain([ + setc("header_id","0002"), + dup1, +])); + +var hdr3 = // "Pattern{Constant('%SYMANTECAV ..'), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" +match("HEADER#2:0003", "message", "%SYMANTECAV ..%{messageid->} %{data}..%{p0}", processor_chain([ + setc("header_id","0003"), + dup1, +])); + +var hdr4 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' ..'), Field(messageid,true), Constant(' '), Field(hfld2,false), Constant('.. '), Field(p0,false)}" +match("HEADER#3:0004", "message", "%SYMANTECAV %{hfld1->} ..%{messageid->} %{hfld2}.. %{p0}", processor_chain([ + setc("header_id","0004"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(" "), + field("hfld2"), + constant(".. "), + field("p0"), + ], + }), +])); + +var hdr5 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(messageid,true), Constant(' Found '), Field(p0,false)}" +match("HEADER#4:0005", "message", "%SYMANTECAV %{hfld1->} %{messageid->} Found %{p0}", processor_chain([ + setc("header_id","0005"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(" Found "), + field("p0"), + ], + }), +])); + +var hdr6 = // "Pattern{Constant('%SYMANTECAV '), Field(messageid,true), Constant(' '), Field(hfld1,false), Constant('..'), Field(p0,false)}" +match("HEADER#5:0006", "message", "%SYMANTECAV %{messageid->} %{hfld1}..%{p0}", processor_chain([ + setc("header_id","0006"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant(" "), + field("hfld1"), + constant(".."), + field("p0"), + ], + }), +])); + +var hdr7 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#6:00081", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00081"), + dup2, +])); + +var hdr8 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#7:0008", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ + setc("header_id","0008"), + dup2, +])); + +var hdr9 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#8:00091", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","00091"), + dup2, +])); + +var hdr10 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#9:0009", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","0009"), + dup2, +])); + +var hdr11 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#10:00421", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","00421"), + dup2, +])); + +var hdr12 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#11:0042", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","0042"), + dup2, +])); + +var hdr13 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#12:99991", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ + setc("header_id","99991"), + dup2, +])); + +var hdr14 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#13:9999", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ + setc("header_id","9999"), + dup2, +])); + +var hdr15 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#14:00101", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","00101"), + dup2, +])); + +var hdr16 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#15:0010", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","0010"), + dup2, +])); + +var hdr17 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("HEADER#16:00111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ + setc("header_id","00111"), + dup3, +])); + +var hdr18 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("HEADER#17:0011", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ + setc("header_id","0011"), + dup3, +])); + +var hdr19 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#18:00121", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00121"), + dup2, +])); + +var hdr20 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#19:0012", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ + setc("header_id","0012"), + dup2, +])); + +var hdr21 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(fld20,true), Constant(' '), Field(fld21,true), Constant(' '), Field(fld23,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#20:11111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","11111"), + dup2, +])); + +var hdr22 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(fld20,true), Constant(' '), Field(fld21,true), Constant(' '), Field(fld23,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#21:1111", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","1111"), + dup2, +])); + +var hdr23 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#22:13131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","13131"), + dup2, +])); + +var hdr24 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#23:1313", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","1313"), + dup2, +])); + +var hdr25 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#24:00131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00131"), + dup2, +])); + +var hdr26 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#25:0013", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ + setc("header_id","0013"), + dup2, +])); + +var hdr27 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#26:13142", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ + setc("header_id","13142"), + dup2, +])); + +var hdr28 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#27:13141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ + setc("header_id","13141"), + dup2, +])); + +var hdr29 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#28:1314", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ + setc("header_id","1314"), + dup2, +])); + +var hdr30 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',[SID: '), Field(hdata,false), Constant('] '), Field(hfld1,false), Constant('. Traffic has been '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#29:00141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ + setc("header_id","00141"), + dup4, +])); + +var hdr31 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',[SID: '), Field(hdata,false), Constant('] '), Field(hfld1,false), Constant('. Traffic has been '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#30:0014", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ + setc("header_id","0014"), + dup4, +])); + +var hdr32 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#31:00161", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{messageid->} %{p0}", processor_chain([ + setc("header_id","00161"), + dup2, +])); + +var hdr33 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#32:0016", "message", "%{htime->} SymantecServer %{hhost}: %{messageid->} %{p0}", processor_chain([ + setc("header_id","0016"), + dup2, +])); + +var hdr34 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#33:29292", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{fld1->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","29292"), + dup5, +])); + +var hdr35 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#34:29291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","29291"), + dup5, +])); + +var hdr36 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#35:2929", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","2929"), + dup5, +])); + +var hdr37 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#36:00291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{fld1->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","00291"), + dup5, +])); + +var hdr38 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#37:0029", "message", "%{htime->} SymantecServer %{hhost}: %{fld1->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","0029"), + dup5, +])); + +var hdr39 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhostip,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#38:00173", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhostip->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00173"), + dup2, +])); + +var hdr40 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#39:00172", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00172"), + dup2, +])); + +var hdr41 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#40:00171", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00171"), + dup2, +])); + +var hdr42 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#41:0017", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid->} %{p0}", processor_chain([ + setc("header_id","0017"), + dup2, +])); + +var hdr43 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hname,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#42:00151", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00151"), + dup6, +])); + +var hdr44 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(hname,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#43:0015", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ + setc("header_id","0015"), + dup6, +])); + +var hdr45 = // "Pattern{Constant('%SYMANTECAV Actual Name: '), Field(hfld1,true), Constant(' ..Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" +match("HEADER#44:0018", "message", "%SYMANTECAV Actual Name: %{hfld1->} ..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ + setc("header_id","0018"), + dup1, +])); + +var hdr46 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(messageid,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(p0,false)}" +match("HEADER#45:0021", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{messageid->} %{hfld3->} %{p0}", processor_chain([ + setc("header_id","0021"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld1"), + constant(" "), + field("hfld2"), + constant(" "), + field("messageid"), + constant(" "), + field("hfld3"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr47 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(messageid,true), Constant(' '), Field(hfld4,true), Constant(' '), Field(p0,false)}" +match("HEADER#46:0022", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{hfld3->} %{messageid->} %{hfld4->} %{p0}", processor_chain([ + setc("header_id","0022"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld1"), + constant(" "), + field("hfld2"), + constant(" "), + field("hfld3"), + constant(" "), + field("messageid"), + constant(" "), + field("hfld4"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr48 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(fld40,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#47:00191", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","00191"), + dup7, +])); + +var hdr49 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(fld40,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#48:0019", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ + setc("header_id","0019"), + dup7, +])); + +var hdr50 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#49:00201", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","00201"), + dup2, +])); + +var hdr51 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#50:0020", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ + setc("header_id","0020"), + dup2, +])); + +var hdr52 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#51:00231", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","00231"), + dup2, +])); + +var hdr53 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#52:0023", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{messageid->} %{p0}", processor_chain([ + setc("header_id","0023"), + dup2, +])); + +var hdr54 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" +match("HEADER#53:00241", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid},%{payload}", processor_chain([ + setc("header_id","00241"), +])); + +var hdr55 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" +match("HEADER#54:0024", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid},%{payload}", processor_chain([ + setc("header_id","0024"), +])); + +var hdr56 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' """"'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" +match("HEADER#55:00261", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ + setc("header_id","00261"), +])); + +var hdr57 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' """"'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" +match("HEADER#56:0026", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ + setc("header_id","0026"), +])); + +var hdr58 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' ""'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" +match("HEADER#57:00371", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ + setc("header_id","00371"), +])); + +var hdr59 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' ""'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" +match("HEADER#58:0037", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ + setc("header_id","0037"), +])); + +var hdr60 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hsite,false), Constant(','), Field(messageid,false), Constant(': '), Field(p0,false)}" +match("HEADER#59:00271", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ + setc("header_id","00271"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hhost"), + constant(" SymantecServer: Site: "), + field("hsite"), + constant(","), + field("messageid"), + constant(": "), + field("p0"), + ], + }), +])); + +var hdr61 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hsite,false), Constant(','), Field(messageid,false), Constant(': '), Field(p0,false)}" +match("HEADER#60:0027", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ + setc("header_id","0027"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hhost"), + constant(": Site: "), + field("hsite"), + constant(","), + field("messageid"), + constant(": "), + field("p0"), + ], + }), +])); + +var hdr62 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#61:00301", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid}: %{payload}", processor_chain([ + setc("header_id","00301"), +])); + +var hdr63 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(': '), Field(payload,false)}" +match("HEADER#62:0030", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid}: %{payload}", processor_chain([ + setc("header_id","0030"), +])); + +var hdr64 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" +match("HEADER#63:00242", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ + setc("header_id","00242"), +])); + +var hdr65 = // "Pattern{Field(htime,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#64:00243", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{hfld1},%{messageid->} %{p0}", processor_chain([ + setc("header_id","00243"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld1"), + constant(","), + field("messageid"), + constant(" "), + field("p0"), + ], + }), +])); + +var hdr66 = // "Pattern{Field(htime,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" +match("HEADER#65:00244", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ + setc("header_id","00244"), +])); + +var hdr67 = // "Pattern{Constant('%SymantecEP: '), Field(messageid,false), Constant('^^'), Field(hhost,false), Constant('^^'), Field(p0,false)}" +match("HEADER#66:0031", "message", "%SymantecEP: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ + setc("header_id","0031"), + dup8, +])); + +var hdr68 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(messageid,true), Constant(' '), Field(p0,false)}" +match("HEADER#67:0032", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid->} %{p0}", processor_chain([ + setc("header_id","0032"), + dup2, +])); + +var hdr69 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#68:0040", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0040"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("hfld5"), + constant("^^"), + field("hfld6"), + constant("^^"), + field("hfld7"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr70 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" +match("HEADER#69:0033", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid}.%{fld2->} %{p0}", processor_chain([ + setc("header_id","0033"), + dup3, +])); + +var hdr71 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#70:0034", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0034"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr72 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(messageid,false), Constant('^^'), Field(hhost,false), Constant('^^'), Field(p0,false)}" +match("HEADER#71:0035", "message", "%SymantecEP-%{hfld1}: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ + setc("header_id","0035"), + dup8, +])); + +var hdr73 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#72:0038", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0038"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("hfld5"), + constant("^^"), + field("hfld6"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr74 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#73:0041", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0041"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr75 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#74:0043", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0043"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("hfld7"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr76 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(hfld8,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#75:0039", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0039"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("hfld5"), + constant("^^"), + field("hfld6"), + constant("^^"), + field("hfld7"), + constant("^^"), + field("hfld8"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr77 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(hfld8,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" +match("HEADER#76:0044", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ + setc("header_id","0044"), + call({ + dest: "nwparser.payload", + fn: STRCAT, + args: [ + field("hfld2"), + constant("^^"), + field("hfld3"), + constant("^^"), + field("hfld4"), + constant("^^"), + field("hfld7"), + constant("^^"), + field("hfld8"), + constant("^^"), + field("messageid"), + constant("^^"), + field("p0"), + ], + }), +])); + +var hdr78 = // "Pattern{Constant('%NICWIN-4-'), Field(msgIdPart1,false), Constant('_'), Field(msgIdPart2,false), Constant('_Symantec: '), Field(payload,false)}" +match("HEADER#77:0045", "message", "%NICWIN-4-%{msgIdPart1}_%{msgIdPart2}_Symantec: %{payload}", processor_chain([ + setc("header_id","0045"), + call({ + dest: "nwparser.messageid", + fn: STRCAT, + args: [ + field("msgIdPart1"), + constant("_"), + field("msgIdPart2"), + ], + }), +])); + +var hdr79 = // "Pattern{Constant('%NICWIN-4-'), Field(messageid,false), Constant('_'), Field(hfld2,false), Constant('_Symantec AntiVirus: '), Field(payload,false)}" +match("HEADER#78:0046", "message", "%NICWIN-4-%{messageid}_%{hfld2}_Symantec AntiVirus: %{payload}", processor_chain([ + setc("header_id","0046"), +])); + +var select2 = linear_select([ + all1, + hdr2, + hdr3, + hdr4, + hdr5, + hdr6, + hdr7, + hdr8, + hdr9, + hdr10, + hdr11, + hdr12, + hdr13, + hdr14, + hdr15, + hdr16, + hdr17, + hdr18, + hdr19, + hdr20, + hdr21, + hdr22, + hdr23, + hdr24, + hdr25, + hdr26, + hdr27, + hdr28, + hdr29, + hdr30, + hdr31, + hdr32, + hdr33, + hdr34, + hdr35, + hdr36, + hdr37, + hdr38, + hdr39, + hdr40, + hdr41, + hdr42, + hdr43, + hdr44, + hdr45, + hdr46, + hdr47, + hdr48, + hdr49, + hdr50, + hdr51, + hdr52, + hdr53, + hdr54, + hdr55, + hdr56, + hdr57, + hdr58, + hdr59, + hdr60, + hdr61, + hdr62, + hdr63, + hdr64, + hdr65, + hdr66, + hdr67, + hdr68, + hdr69, + hdr70, + hdr71, + hdr72, + hdr73, + hdr74, + hdr75, + hdr76, + hdr77, + hdr78, + hdr79, +]); + +var part6 = // "Pattern{Constant('Active Response that started at '), Field(fld1,true), Constant(' is disengaged. The traffic from IP address '), Field(hostip,true), Constant(' was blocked for '), Field(fld2,true), Constant(' second(s).,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(','), Field(direction,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" +match("MESSAGE#0:Active/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{fld2->} second(s).,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); + +var all2 = all_match({ + processors: [ + part6, + dup311, + ], + on_success: processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup15, + dup16, + dup17, + dup18, + dup19, + ]), +}); + +var msg1 = msg("Active", all2); + +var part7 = // "Pattern{Constant('Active Response that started at '), Field(fld1,true), Constant(' is disengaged. The traffic from IP address '), Field(hostip,true), Constant(' was blocked for '), Field(duration,true), Constant(' second(s). ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(','), Field(direction,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" +match("MESSAGE#1:Active:01/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{duration->} second(s). ,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); + +var all3 = all_match({ + processors: [ + part7, + dup311, + ], + on_success: processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup15, + dup16, + dup17, + dup18, + dup19, + ]), +}); + +var msg2 = msg("Active:01", all3); + +var select3 = linear_select([ + msg1, + msg2, +]); + +var part8 = // "Pattern{Constant('Administrator logout'), Field(,false)}" +match("MESSAGE#2:Administrator", "nwparser.payload", "Administrator logout%{}", processor_chain([ + setc("eventcategory","1401070000"), + dup12, + dup13, + dup20, + setc("ec_activity","Logoff"), + dup21, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Administrator logout."), +])); + +var msg3 = msg("Administrator", part8); + +var part9 = // "Pattern{Constant('Administrator'), Field(space,false), Constant('log on failed')}" +match("MESSAGE#3:Administrator:01", "nwparser.payload", "Administrator%{space}log on failed", processor_chain([ + setc("eventcategory","1401030000"), + dup12, + dup13, + dup20, + dup24, + dup21, + dup25, + dup14, + dup15, + dup23, + setc("event_description","Administrator log on failed."), +])); + +var msg4 = msg("Administrator:01", part9); + +var part10 = // "Pattern{Constant('Administrator'), Field(space,false), Constant('log on succeeded')}" +match("MESSAGE#4:Administrator:02", "nwparser.payload", "Administrator%{space}log on succeeded", processor_chain([ + setc("eventcategory","1401060000"), + dup12, + dup13, + dup20, + dup24, + dup21, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Administrator log on succeeded."), +])); + +var msg5 = msg("Administrator:02", part10); + +var select4 = linear_select([ + msg3, + msg4, + msg5, +]); + +var part11 = // "Pattern{Constant('password of System administrator ''), Field(username,false), Constant('' has been changed.')}" +match("MESSAGE#5:Administrator:03", "nwparser.payload", "password of System administrator '%{username}' has been changed.", processor_chain([ + dup26, + dup12, + dup13, + dup20, + dup27, + dup28, + dup22, + dup14, + dup15, + dup23, + dup29, +])); + +var msg6 = msg("Administrator:03", part11); + +var part12 = // "Pattern{Constant('password of administrator "'), Field(c_username,false), Constant('" was changed')}" +match("MESSAGE#290:password", "nwparser.payload", "password of administrator \"%{c_username}\" was changed", processor_chain([ + dup26, + dup12, + dup13, + dup20, + dup30, + dup31, + dup22, + dup14, + dup15, + setc("event_description","Password of administrator changed."), + dup23, +])); + +var msg7 = msg("password", part12); + +var part13 = // "Pattern{Constant('password of System administrator "'), Field(c_username,false), Constant('" has been changed')}" +match("MESSAGE#291:password:01", "nwparser.payload", "password of System administrator \"%{c_username}\" has been changed", processor_chain([ + dup26, + dup12, + dup13, + dup20, + dup30, + dup31, + dup22, + dup14, + dup15, + dup29, + dup23, +])); + +var msg8 = msg("password:01", part13); + +var select5 = linear_select([ + msg6, + msg7, + msg8, +]); + +var part14 = // "Pattern{Field(fld6,true), Constant(' detected. Traffic has been allowed from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#6:allowed", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup15, + dup16, + dup17, + dup33, + dup19, + dup34, +])); + +var msg9 = msg("allowed", part14); + +var part15 = // "Pattern{Field(fld6,true), Constant(' detected. Traffic has been allowed from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#7:allowed:11", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup15, + dup16, + dup17, + dup33, + dup19, + dup35, +])); + +var msg10 = msg("allowed:11", part15); + +var select6 = linear_select([ + msg9, + msg10, +]); + +var part16 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(dport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(sport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',"!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant('",!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld33,false)}" +match("MESSAGE#8:Malicious", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ + dup36, + dup12, + dup13, + dup37, + dup38, + dup14, + dup15, + dup16, + dup17, + dup39, + dup19, + dup34, +])); + +var msg11 = msg("Malicious", part16); + +var part17 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(sport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(dport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',"!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant('",!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld33,false)}" +match("MESSAGE#9:Malicious:01", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ + dup36, + dup12, + dup13, + dup37, + dup38, + dup14, + dup15, + dup16, + dup17, + dup39, + dup19, + dup35, +])); + +var msg12 = msg("Malicious:01", part17); + +var part18 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(p0,false)}" +match("MESSAGE#10:Malicious:02/0", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Inbound,%{p0}"); + +var part19 = // "Pattern{Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(p0,false)}" +match("MESSAGE#10:Malicious:02/1_0", "nwparser.p0", "%{protocol},Intrusion ID:%{fld23},Begin: %{p0}"); + +var part20 = // "Pattern{Field(protocol,false), Constant(',Begin: '), Field(p0,false)}" +match("MESSAGE#10:Malicious:02/1_1", "nwparser.p0", "%{protocol},Begin: %{p0}"); + +var select7 = linear_select([ + part19, + part20, +]); + +var part21 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',"CIDS Signature string: '), Field(sigid_string,false), Constant('",CIDS Signature SubID: '), Field(fld29,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#10:Malicious:02/2", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},\"CIDS Signature string: %{sigid_string}\",CIDS Signature SubID: %{fld29},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}"); + +var all4 = all_match({ + processors: [ + part18, + select7, + part21, + ], + on_success: processor_chain([ + dup36, + dup12, + dup13, + dup40, + dup41, + dup42, + dup15, + dup19, + dup34, + setc("event_description","Malicious Site: Malicious Web Site, Domain, or URL attcak blocked"), + ]), +}); + +var msg13 = msg("Malicious:02", all4); + +var select8 = linear_select([ + msg11, + msg12, + msg13, +]); + +var part22 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' failed to update.')}" +match("MESSAGE#11:Antivirus", "nwparser.payload", "%{product->} definitions %{info->} failed to update.", processor_chain([ + dup43, + dup12, + dup13, + dup44, + dup45, + dup30, + dup25, + dup14, + dup15, + setc("event_description","Product definition failed to update."), +])); + +var msg14 = msg("Antivirus", part22); + +var part23 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' is up-to-date.')}" +match("MESSAGE#12:Antivirus:01", "nwparser.payload", "%{product->} definitions %{info->} is up-to-date.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Product definitions are up-to-date."), +])); + +var msg15 = msg("Antivirus:01", part23); + +var part24 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' was successfully updated.')}" +match("MESSAGE#13:Antivirus:02", "nwparser.payload", "%{product->} definitions %{info->} was successfully updated.", processor_chain([ + dup43, + dup44, + dup45, + dup30, + dup22, + dup15, + setc("event_description","Product definitions was successfully updated."), +])); + +var msg16 = msg("Antivirus:02", part24); + +var select9 = linear_select([ + msg14, + msg15, + msg16, +]); + +var part25 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',1,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" +match("MESSAGE#14:Somebody/0", "nwparser.payload", "%{event_description}\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},1,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); + +var all5 = all_match({ + processors: [ + part25, + dup311, + ], + on_success: processor_chain([ + dup46, + dup12, + dup13, + dup16, + dup17, + dup15, + dup47, + dup48, + dup312, + dup14, + ]), +}); + +var msg17 = msg("Somebody", all5); + +var part26 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',0,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" +match("MESSAGE#15:Somebody:01/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},0,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); + +var all6 = all_match({ + processors: [ + part26, + dup313, + ], + on_success: processor_chain([ + dup46, + dup12, + dup13, + dup16, + dup17, + dup15, + dup47, + dup51, + dup312, + dup14, + ]), +}); + +var msg18 = msg("Somebody:01", all6); + +var part27 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',2,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" +match("MESSAGE#16:Somebody:02/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},2,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); + +var all7 = all_match({ + processors: [ + part27, + dup313, + ], + on_success: processor_chain([ + dup46, + dup12, + dup13, + dup16, + dup17, + dup15, + dup47, + dup52, + dup312, + dup14, + ]), +}); + +var msg19 = msg("Somebody:02", all7); + +var select10 = linear_select([ + msg17, + msg18, + msg19, +]); + +var part28 = // "Pattern{Field(fld44,false), Constant(',Application and Device Control is ready,'), Field(fld8,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(p0,false)}" +match("MESSAGE#17:Application/0", "nwparser.payload", "%{fld44},Application and Device Control is ready,%{fld8},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{p0}"); + +var part29 = // "Pattern{Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#17:Application/1_0", "nwparser.p0", "%{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); + +var select11 = linear_select([ + part29, + dup10, +]); + +var all8 = all_match({ + processors: [ + part28, + select11, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup41, + dup42, + dup15, + dup54, + ]), +}); + +var msg20 = msg("Application", all8); + +var part30 = // "Pattern{Field(fld44,false), Constant(',Application and Device Control engine is not verified,'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#18:Application:01", "nwparser.payload", "%{fld44},Application and Device Control engine is not verified,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + setc("event_description","Application and Device Control engine is not verified."), +])); + +var msg21 = msg("Application:01", part30); + +var part31 = // "Pattern{Field(fld44,false), Constant('Blocked,['), Field(fld5,false), Constant('] '), Field(event_description,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld45,false)}" +match("MESSAGE#19:Application:02", "nwparser.payload", "%{fld44}Blocked,[%{fld5}] %{event_description->} - Caller MD5=%{fld6},Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld45}", processor_chain([ + dup53, + dup12, + dup13, + dup37, + dup14, + dup41, + dup42, + dup15, +])); + +var msg22 = msg("Application:02", part31); + +var part32 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(event_description,false), Constant(',, Scan Complete: Risks: '), Field(fld7,true), Constant(' Scanned: '), Field(fld8,true), Constant(' Omitted: '), Field(fld9,true), Constant(' Trusted Files Skipped: '), Field(fld10,false)}" +match("MESSAGE#683:Application:03", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, Scan Complete: Risks: %{fld7->} Scanned: %{fld8->} Omitted: %{fld9->} Trusted Files Skipped: %{fld10}", processor_chain([ + dup43, + dup15, + dup55, +])); + +var msg23 = msg("Application:03", part32); + +var part33 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(event_description,false), Constant(',, '), Field(info,false), Constant('.')}" +match("MESSAGE#684:Application:04", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, %{info}.", processor_chain([ + dup43, + dup15, + dup55, +])); + +var msg24 = msg("Application:04", part33); + +var part34 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(fld22,false), Constant(',,'), Field(space,false), Constant('Proactive Threat Protection has been disabled')}" +match("MESSAGE#685:Application:05", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{fld22},,%{space}Proactive Threat Protection has been disabled", processor_chain([ + dup43, + dup56, + dup15, + dup57, + dup55, +])); + +var msg25 = msg("Application:05", part34); + +var select12 = linear_select([ + msg20, + msg21, + msg22, + msg23, + msg24, + msg25, +]); + +var part35 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"Application has changed since the last time you opened it, process id:'), Field(process_id,true), Constant(' Filename: '), Field(fld8,true), Constant(' The change was denied by user.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld11,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#20:Application:07", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id:%{process_id->} Filename: %{fld8->} The change was denied by user.\",Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld11},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup53, + dup34, + dup58, + dup12, + dup13, + dup41, + dup42, + dup15, + dup54, + dup47, +])); + +var msg26 = msg("Application:07", part35); + +var part36 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' '), Field(fld1,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#27:Application:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} %{fld1}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all9 = all_match({ + processors: [ + part36, + dup314, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup35, + dup58, + ]), +}); + +var msg27 = msg("Application:06", all9); + +var part37 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',REMEDIATION WAS NEEDED - '), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#28:REMEDIATION/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},REMEDIATION WAS NEEDED - %{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all10 = all_match({ + processors: [ + part37, + dup314, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + ]), +}); + +var msg28 = msg("REMEDIATION", all10); + +var part38 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#29:blocked:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all11 = all_match({ + processors: [ + part38, + dup314, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup62, + dup19, + dup34, + ]), +}); + +var msg29 = msg("blocked:06", all11); + +var part39 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#30:blocked:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all12 = all_match({ + processors: [ + part39, + dup314, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup16, + dup17, + dup15, + dup62, + dup19, + dup35, + dup40, + ]), +}); + +var msg30 = msg("blocked:16", all12); + +var part40 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,"Somebody is scanning your computer. Your computer's TCP ports: '), Field(fld60,false), Constant(', '), Field(fld61,false), Constant(', '), Field(fld62,false), Constant(', '), Field(fld63,true), Constant(' and '), Field(fld64,true), Constant(' have been scanned from '), Field(fld65,false), Constant('.",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#31:scanning:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all13 = all_match({ + processors: [ + part40, + dup315, + ], + on_success: processor_chain([ + dup65, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup66, + dup35, + ]), +}); + +var msg31 = msg("scanning:01", all13); + +var part41 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,"Somebody is scanning your computer. Your computer's TCP ports: '), Field(fld60,false), Constant(', '), Field(fld61,false), Constant(', '), Field(fld62,false), Constant(', '), Field(fld63,true), Constant(' and '), Field(fld64,true), Constant(' have been scanned from '), Field(fld65,false), Constant('.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#32:scanning/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all14 = all_match({ + processors: [ + part41, + dup315, + ], + on_success: processor_chain([ + dup65, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup66, + dup34, + ]), +}); + +var msg32 = msg("scanning", all14); + +var part42 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Informational: File Download Hash,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" +match("MESSAGE#33:Informational/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},%{p0}"); + +var part43 = // "Pattern{Constant(' Domain: '), Field(p0,false)}" +match("MESSAGE#33:Informational/1_0", "nwparser.p0", " Domain: %{p0}"); + +var select13 = linear_select([ + part43, + dup67, +]); + +var part44 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#33:Informational/2", "nwparser.p0", "%{} %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all15 = all_match({ + processors: [ + part42, + select13, + part44, + dup315, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup68, + dup34, + ]), +}); + +var msg33 = msg("Informational", all15); + +var part45 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Informational: File Download Hash,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#34:Informational:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all16 = all_match({ + processors: [ + part45, + dup315, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup68, + dup35, + ]), +}); + +var msg34 = msg("Informational:01", all16); + +var part46 = // "Pattern{Field(shost,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',CCD Notification: REMEDIATION NOT REQUIRED,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote:'), Field(fld2,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application:'), Field(fld6,false), Constant(',Location: '), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string:'), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:')}" +match("MESSAGE#35:SHA-256::01", "nwparser.payload", "%{shost}, SHA-256:%{checksum},MD-5:%{checksum},CCD Notification: REMEDIATION NOT REQUIRED,Local: %{saddr},Local: %{fld1},Remote:%{fld2},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application:%{fld6},Location: %{fld7},User: %{username}, Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string:%{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:", processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup41, + dup42, + dup15, + dup19, + setc("event_description","CCD Notification: REMEDIATION NOT REQUIRED"), + setc("direction","Unknown"), +])); + +var msg35 = msg("SHA-256::01", part46); + +var part47 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#36:Web_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all17 = all_match({ + processors: [ + part47, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup70, + dup34, + ]), +}); + +var msg36 = msg("Web_Attack", all17); + +var part48 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Fake Flash Player Download '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#37:Web_Attack:13/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Flash Player Download %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all18 = all_match({ + processors: [ + part48, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Web Attack : Fake Flash Player Download"), + dup34, + ]), +}); + +var msg37 = msg("Web_Attack:13", all18); + +var part49 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] Web Attack'), Field(p0,false)}" +match("MESSAGE#38:Web_Attack:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack%{p0}"); + +var part50 = // "Pattern{Constant(' : '), Field(p0,false)}" +match("MESSAGE#38:Web_Attack:16/1_0", "nwparser.p0", " : %{p0}"); + +var select14 = linear_select([ + part50, + dup71, +]); + +var part51 = // "Pattern{Field(,false), Constant('JSCoinminer Download '), Field(fld21,true), Constant(' attack blocked. Traffic has been blocked for this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#38:Web_Attack:16/2", "nwparser.p0", "%{}JSCoinminer Download %{fld21->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); + +var all19 = all_match({ + processors: [ + part49, + select14, + part51, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","JSCoinminer Download attack blocked."), + dup34, + ]), +}); + +var msg38 = msg("Web_Attack:16", all19); + +var part52 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,[SID: '), Field(fld26,false), Constant('] Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked. '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#39:Web_Attack:03", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,[SID: %{fld26}] Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked. %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked."), + dup35, +])); + +var msg39 = msg("Web_Attack:03", part52); + +var part53 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] Web Attack : Malvertisement Website Redirect '), Field(fld2,true), Constant(' attack blocked. Traffic has been blocked for this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#40:Web_Attack:15", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack : Malvertisement Website Redirect %{fld2->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Malvertisement Website Redirect "), + dup34, +])); + +var msg40 = msg("Web_Attack:15", part53); + +var part54 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#41:Web_Attack:11/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all20 = all_match({ + processors: [ + part54, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup70, + dup35, + ]), +}); + +var msg41 = msg("Web_Attack:11", all20); + +var part55 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#42:Web_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all21 = all_match({ + processors: [ + part55, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup72, + dup34, + ]), +}); + +var msg42 = msg("Web_Attack:01", all21); + +var part56 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#43:Web_Attack:12/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all22 = all_match({ + processors: [ + part56, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup72, + dup35, + ]), +}); + +var msg43 = msg("Web_Attack:12", all22); + +var part57 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#44:Web_Attack:14/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all23 = all_match({ + processors: [ + part57, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Web Attack : Mass Injection Website"), + dup34, + ]), +}); + +var msg44 = msg("Web_Attack:14", all23); + +var part58 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#45:Web_Attack:17/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all24 = all_match({ + processors: [ + part58, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Web Attack: Malvertisement Website Redirect."), + dup34, + ]), +}); + +var msg45 = msg("Web_Attack:17", all24); + +var part59 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Fake Tech Support Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#46:Web_Attack:18/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Tech Support Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all25 = all_match({ + processors: [ + part59, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + setc("event_description","Web Attack: Fake Tech Support Website"), + dup34, + ]), +}); + +var msg46 = msg("Web_Attack:18", all25); + +var part60 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#47:App_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all26 = all_match({ + processors: [ + part60, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup73, + dup35, + ]), +}); + +var msg47 = msg("App_Attack", all26); + +var part61 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#48:App_Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all27 = all_match({ + processors: [ + part61, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup73, + dup35, + ]), +}); + +var msg48 = msg("App_Attack:02", all27); + +var part62 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#49:App_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Fake App Attack: Misleading Application Website%{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all28 = all_match({ + processors: [ + part62, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup73, + dup34, + ]), +}); + +var msg49 = msg("App_Attack:01", all28); + +var part63 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#50:Host_Integrity/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all29 = all_match({ + processors: [ + part63, + dup315, + ], + on_success: processor_chain([ + dup74, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup75, + ]), +}); + +var msg50 = msg("Host_Integrity", all29); + +var part64 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"'), Field(p0,false)}" +match("MESSAGE#307:process:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"%{p0}"); + +var part65 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile'), Field(fld6,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#307:process:12/2", "nwparser.p0", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile%{fld6}\"%{p0}"); + +var all30 = all_match({ + processors: [ + part64, + dup316, + part65, + dup316, + dup78, + dup317, + dup81, + dup315, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup16, + dup17, + dup15, + dup19, + dup34, + dup40, + ]), +}); + +var msg51 = msg("process:12", all30); + +var part66 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('attack detected but not blocked. Application path:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#461:Audit:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all31 = all_match({ + processors: [ + part66, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup82, + dup19, + dup34, + ]), +}); + +var msg52 = msg("Audit:01", all31); + +var part67 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('attack detected but not blocked. Application path:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#462:Audit:11/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all32 = all_match({ + processors: [ + part67, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup16, + dup17, + dup15, + dup82, + dup19, + dup35, + dup40, + ]), +}); + +var msg53 = msg("Audit:11", all32); + +var part68 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('. Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(','), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#463:Audit:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all33 = all_match({ + processors: [ + part68, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup83, + dup19, + dup34, + ]), +}); + +var msg54 = msg("Audit:02", all33); + +var part69 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('. Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(','), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#464:Audit:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all34 = all_match({ + processors: [ + part69, + dup315, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup16, + dup17, + dup15, + dup83, + dup19, + dup35, + dup40, + ]), +}); + +var msg55 = msg("Audit:12", all34); + +var part70 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld111,false), Constant('] '), Field(category,false), Constant(':'), Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#507:Attack:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all35 = all_match({ + processors: [ + part70, + dup314, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup34, + ]), +}); + +var msg56 = msg("Attack:03", all35); + +var part71 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld111,false), Constant('] '), Field(category,false), Constant(':'), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#508:Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all36 = all_match({ + processors: [ + part71, + dup314, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup35, + ]), +}); + +var msg57 = msg("Attack:02", all36); + +var part72 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Auto-Block Event,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#710:Auto-block/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Auto-Block Event,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all37 = all_match({ + processors: [ + part72, + dup314, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup34, + ]), +}); + +var msg58 = msg("Auto-block", all37); + +var part73 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Denial of Service 'Smurf' attack detected. Description: '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#711:Denial/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all38 = all_match({ + processors: [ + part73, + dup314, + ], + on_success: processor_chain([ + dup84, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup35, + dup85, + ]), +}); + +var msg59 = msg("Denial", all38); + +var part74 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Denial of Service 'Smurf' attack detected. Description: '), Field(info,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#712:Denial:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all39 = all_match({ + processors: [ + part74, + dup314, + ], + on_success: processor_chain([ + dup84, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup34, + dup85, + ]), +}); + +var msg60 = msg("Denial:01", all39); + +var part75 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Denial of Service ''Smurf'' attack detected. Description: '), Field(info,false), Constant('',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#713:Denial:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all40 = all_match({ + processors: [ + part75, + dup314, + ], + on_success: processor_chain([ + dup84, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup35, + dup85, + ]), +}); + +var msg61 = msg("Denial:02", all40); + +var part76 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Denial of Service ''Smurf'' attack detected. Description: '), Field(info,false), Constant('',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#714:Denial:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all41 = all_match({ + processors: [ + part76, + dup314, + ], + on_success: processor_chain([ + dup84, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup34, + dup85, + ]), +}); + +var msg62 = msg("Denial:03", all41); + +var part77 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Host Integrity check passed'), Field(space,false), Constant('Requirement: '), Field(fld11,true), Constant(' passed ',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#715:Host:18", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check passed%{space}Requirement: %{fld11->} passed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup86, + dup87, + dup12, + dup13, + dup22, + dup14, + dup15, + dup88, + dup19, +])); + +var msg63 = msg("Host:18", part77); + +var part78 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Host Integrity check failed Requirement: '''), Field(fld11,false), Constant(''' passed Requirement: '''), Field(fld12,false), Constant(''' failed ',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#716:Host:19", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check failed Requirement: ''%{fld11}'' passed Requirement: ''%{fld12}'' failed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup86, + dup12, + dup13, + dup25, + dup14, + dup15, + dup89, + dup19, +])); + +var msg64 = msg("Host:19", part78); + +var part79 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',DLP version is latest,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#719:DLP_version", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},DLP version is latest,Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup53, + dup12, + dup13, + dup40, + dup41, + dup42, + dup15, + dup19, + dup34, + setc("event_description","DLP version is latest"), +])); + +var msg65 = msg("DLP_version", part79); + +var part80 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Brute force remote login,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld27,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#720:Brute_force/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Brute force remote login,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld27},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all42 = all_match({ + processors: [ + part80, + dup314, + ], + on_success: processor_chain([ + setc("eventcategory","1101010000"), + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup34, + setc("event_description","Brute force remote login"), + ]), +}); + +var msg66 = msg("Brute_force", all42); + +var select15 = linear_select([ + msg26, + msg27, + msg28, + msg29, + msg30, + msg31, + msg32, + msg33, + msg34, + msg35, + msg36, + msg37, + msg38, + msg39, + msg40, + msg41, + msg42, + msg43, + msg44, + msg45, + msg46, + msg47, + msg48, + msg49, + msg50, + msg51, + msg52, + msg53, + msg54, + msg55, + msg56, + msg57, + msg58, + msg59, + msg60, + msg61, + msg62, + msg63, + msg64, + msg65, + msg66, +]); + +var part81 = // "Pattern{Constant('Applied new policy with '), Field(info,false), Constant('successfully.'), Field(p0,false)}" +match("MESSAGE#21:Applied/0", "nwparser.payload", "Applied new policy with %{info}successfully.%{p0}"); + +var all43 = all_match({ + processors: [ + part81, + dup318, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Applied new policy successfully."), + ]), +}); + +var msg67 = msg("Applied", all43); + +var part82 = // "Pattern{Constant('Applied new profile with serial number '), Field(fld23,true), Constant(' successfully.')}" +match("MESSAGE#700:Smc:04", "nwparser.payload", "Applied new profile with serial number %{fld23->} successfully.", processor_chain([ + dup53, + dup94, + dup13, + dup14, + dup15, + setc("event_description","Applied new profile successfully."), +])); + +var msg68 = msg("Smc:04", part82); + +var select16 = linear_select([ + msg67, + msg68, +]); + +var part83 = // "Pattern{Constant('Add shared policy upon system install,LiveUpdate Settings policy'), Field(,false)}" +match("MESSAGE#22:Add", "nwparser.payload", "Add shared policy upon system install,LiveUpdate Settings policy%{}", processor_chain([ + dup95, + dup12, + dup13, + dup96, + dup97, + dup14, + dup15, + dup23, + setc("event_description","Add shared policy upon system install,LiveUpdate Settings policy."), +])); + +var msg69 = msg("Add", part83); + +var part84 = // "Pattern{Constant('System Infected: '), Field(threat_name,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#23:blocked:01/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part85 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#23:blocked:01/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); + +var all44 = all_match({ + processors: [ + part84, + dup319, + part85, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup35, + ]), +}); + +var msg70 = msg("blocked:01", all44); + +var part86 = // "Pattern{Constant('System Infected: '), Field(threat_name,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#24:blocked:12/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part87 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#24:blocked:12/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); + +var all45 = all_match({ + processors: [ + part86, + dup319, + part87, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup34, + ]), +}); + +var msg71 = msg("blocked:12", all45); + +var part88 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#25:blocked:05/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{daddr},Remote: %{fld15},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part89 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#25:blocked:05/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var all46 = all_match({ + processors: [ + part88, + dup319, + part89, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup35, + ]), +}); + +var msg72 = msg("blocked:05", all46); + +var part90 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#26:blocked:15/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{saddr},Remote: %{fld15},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part91 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#26:blocked:15/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var all47 = all_match({ + processors: [ + part90, + dup319, + part91, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup34, + ]), +}); + +var msg73 = msg("blocked:15", all47); + +var part92 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#52:blocked/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var all48 = all_match({ + processors: [ + part92, + dup319, + dup100, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup35, + ]), +}); + +var msg74 = msg("blocked", all48); + +var part93 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#53:blocked:11/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var all49 = all_match({ + processors: [ + part93, + dup319, + dup100, + ], + on_success: processor_chain([ + dup32, + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + dup62, + dup19, + dup34, + ]), +}); + +var msg75 = msg("blocked:11", all49); + +var select17 = linear_select([ + msg70, + msg71, + msg72, + msg73, + msg74, + msg75, +]); + +var part94 = // "Pattern{Constant('The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#51:Host_Integrity:01/0", "nwparser.payload", "The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all50 = all_match({ + processors: [ + part94, + dup315, + ], + on_success: processor_chain([ + dup74, + dup12, + dup13, + dup40, + dup16, + dup17, + dup15, + dup19, + dup75, + ]), +}); + +var msg76 = msg("Host_Integrity:01", all50); + +var part95 = // "Pattern{Field(,true), Constant(' '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Inbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Rule: '), Field(rulename,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#190:Local::01/1", "nwparser.p0", "%{} %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); + +var all51 = all_match({ + processors: [ + dup320, + part95, + ], + on_success: processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup103, + dup104, + dup34, + ]), +}); + +var msg77 = msg("Local::01", all51); + +var part96 = // "Pattern{Field(,true), Constant(' '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Outbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Rule: '), Field(rulename,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#191:Local::13/1", "nwparser.p0", "%{} %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); + +var all52 = all_match({ + processors: [ + dup320, + part96, + ], + on_success: processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup103, + dup104, + dup35, + ]), +}); + +var msg78 = msg("Local::13", all52); + +var part97 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Outbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(','), Field(p0,false)}" +match("MESSAGE#192:Local:/0", "nwparser.payload", "Local: %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); + +var all53 = all_match({ + processors: [ + part97, + dup321, + dup107, + dup322, + ], + on_success: processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup103, + dup104, + dup35, + ]), +}); + +var msg79 = msg("Local:", all53); + +var part98 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Inbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(','), Field(p0,false)}" +match("MESSAGE#193:Local:11/0", "nwparser.payload", "Local: %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); + +var all54 = all_match({ + processors: [ + part98, + dup321, + dup107, + dup322, + ], + on_success: processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup103, + dup104, + dup34, + ]), +}); + +var msg80 = msg("Local:11", all54); + +var part99 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,true), Constant(' CVE-'), Field(cve,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#194:Local::09", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup111, + dup34, +])); + +var msg81 = msg("Local::09", part99); + +var part100 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,true), Constant(' CVE-'), Field(cve,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#195:Local::20", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup111, + dup35, +])); + +var msg82 = msg("Local::20", part100); + +var part101 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#196:Local::08", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, +])); + +var msg83 = msg("Local::08", part101); + +var part102 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#197:Local::18", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, +])); + +var msg84 = msg("Local::18", part102); + +var part103 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#198:Local::04/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all55 = all_match({ + processors: [ + part103, + dup323, + dup114, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, + ]), +}); + +var msg85 = msg("Local::04", all55); + +var part104 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" +match("MESSAGE#199:Local::17/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); + +var all56 = all_match({ + processors: [ + part104, + dup323, + dup114, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, + ]), +}); + +var msg86 = msg("Local::17", all56); + +var part105 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant('Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(dport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(sport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant(',!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld23,false)}" +match("MESSAGE#200:Local::06", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol}Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, +])); + +var msg87 = msg("Local::06", part105); + +var part106 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(sport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(dport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant(',!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld23,false)}" +match("MESSAGE#201:Local::16", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, +])); + +var msg88 = msg("Local::16", part106); + +var part107 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',0,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#202:Local::02", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},0,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup51, + dup312, +])); + +var msg89 = msg("Local::02", part107); + +var part108 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',1,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#203:Local::22", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},%{protocol},1,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup48, + dup312, +])); + +var msg90 = msg("Local::22", part108); + +var part109 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',2,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#204:Local::23", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},2,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup52, + dup312, +])); + +var msg91 = msg("Local::23", part109); + +var part110 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(': '), Field(fld22,true), Constant(' CVE-'), Field(cve,true), Constant(' '), Field(fld26,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#205:Local::07/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var all57 = all_match({ + processors: [ + dup117, + dup319, + part110, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, + ]), +}); + +var msg92 = msg("Local::07", all57); + +var part111 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(': '), Field(fld22,true), Constant(' CVE-'), Field(cve,true), Constant(' '), Field(fld26,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#206:Local::19/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var all58 = all_match({ + processors: [ + dup118, + dup319, + part111, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, + ]), +}); + +var msg93 = msg("Local::19", all58); + +var part112 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#207:Local::05/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); + +var all59 = all_match({ + processors: [ + dup117, + dup319, + part112, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, + ]), +}); + +var msg94 = msg("Local::05", all59); + +var part113 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#208:Local::15/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); + +var all60 = all_match({ + processors: [ + dup118, + dup319, + part113, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, + ]), +}); + +var msg95 = msg("Local::15", all60); + +var all61 = all_match({ + processors: [ + dup117, + dup319, + dup119, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup34, + ]), +}); + +var msg96 = msg("Local::03", all61); + +var all62 = all_match({ + processors: [ + dup118, + dup319, + dup119, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup115, + dup116, + dup38, + dup15, + dup16, + dup17, + dup14, + dup104, + dup35, + ]), +}); + +var msg97 = msg("Local::14", all62); + +var part114 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Inbound,Application: '), Field(application,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#211:Local::10", "nwparser.payload", "Local: %{daddr},Local: %{dport},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Inbound,Application: %{application},Action: %{action}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup40, + dup103, + dup34, +])); + +var msg98 = msg("Local::10", part114); + +var part115 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Outbound,Application: '), Field(application,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#212:Local::21", "nwparser.payload", "Local: %{saddr},Local: %{sport},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Outbound,Application: %{application},Action: %{action}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup103, + dup35, + dup40, +])); + +var msg99 = msg("Local::21", part115); + +var part116 = // "Pattern{Constant('Event Description: '), Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local Host MAC: '), Field(dmacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(saddr,false), Constant(',Remote Host MAC: '), Field(smacaddr,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: 0,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(dport,false), Constant(',Remote Port: '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" +match("MESSAGE#213:Local::24", "nwparser.payload", "Event Description: %{event_description},Local: %{daddr},Local Host MAC: %{dmacaddr},Remote Host Name: %{fld3},Remote Host IP: %{saddr},Remote Host MAC: %{smacaddr},Inbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{dport},Remote Port: %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ + dup120, + dup12, + dup13, + dup15, + dup34, + dup40, +])); + +var msg100 = msg("Local::24", part116); + +var part117 = // "Pattern{Constant('Event Description: '), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local Host MAC: '), Field(smacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(daddr,false), Constant(',Remote Host MAC: '), Field(dmacaddr,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: 0,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(sport,false), Constant(',Remote Port: '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" +match("MESSAGE#214:Local::25", "nwparser.payload", "Event Description: %{event_description},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},Outbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ + dup36, + dup12, + dup13, + dup15, + dup35, + dup40, +])); + +var msg101 = msg("Local::25", part117); + +var part118 = // "Pattern{Constant('Event Description: '), Field(event_description,true), Constant(' [Volume]: '), Field(disk_volume,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant(',Local: '), Field(saddr,false), Constant(',Local Host MAC: '), Field(smacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(daddr,false), Constant(',Remote Host MAC: '), Field(dmacaddr,false), Constant(','), Field(direction,false), Constant(','), Field(fld2,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(sport,false), Constant(',Remote Port: '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" +match("MESSAGE#215:Local::26", "nwparser.payload", "Event Description: %{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},%{direction},%{fld2},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ + dup53, + dup12, + dup13, + dup15, + dup40, +])); + +var msg102 = msg("Local::26", part118); + +var select18 = linear_select([ + msg76, + msg77, + msg78, + msg79, + msg80, + msg81, + msg82, + msg83, + msg84, + msg85, + msg86, + msg87, + msg88, + msg89, + msg90, + msg91, + msg92, + msg93, + msg94, + msg95, + msg96, + msg97, + msg98, + msg99, + msg100, + msg101, + msg102, +]); + +var part119 = // "Pattern{Constant('Blocked Attack: Memory Heap Spray attack against '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#54:Blocked:13/0", "nwparser.payload", "Blocked Attack: Memory Heap Spray attack against %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all63 = all_match({ + processors: [ + part119, + dup315, + ], + on_success: processor_chain([ + setc("eventcategory","1001020300"), + dup12, + dup13, + dup14, + dup16, + dup17, + dup15, + setc("event_description","Attack: Memory Heap Spray attack"), + dup19, + dup34, + ]), +}); + +var msg103 = msg("Blocked:13", all63); + +var part120 = // "Pattern{Constant('"'), Field(fld23,false), Constant(',",File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#483:File:01", "nwparser.payload", "\"%{fld23},\",File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + dup123, + dup124, + dup125, +])); + +var msg104 = msg("File:01", part120); + +var part121 = // "Pattern{Constant('"'), Field(info,false), Constant('",Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld1,false), Constant(','), Field(process,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#484:File:11", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup126, +])); + +var msg105 = msg("File:11", part121); + +var part122 = // "Pattern{Constant('"'), Field(info,false), Constant('",Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld1,false), Constant(','), Field(process,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#485:File:02", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup126, +])); + +var msg106 = msg("File:02", part122); + +var part123 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#486:File:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup127, + dup124, + dup128, +])); + +var msg107 = msg("File:03", part123); + +var part124 = // "Pattern{Field(info,false), Constant('.'), Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#487:Blocked:04", "nwparser.payload", "%{info}.%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup129, + dup14, + dup41, + dup42, + dup122, + dup130, + dup124, + dup125, +])); + +var msg108 = msg("Blocked:04", part124); + +var part125 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" +match("MESSAGE#488:File:05", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup130, + dup124, + dup125, +])); + +var msg109 = msg("File:05", part125); + +var part126 = // "Pattern{Constant('"'), Field(fld23,false), Constant('",,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#489:File:04", "nwparser.payload", "\"%{fld23}\",,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + dup123, +])); + +var msg110 = msg("File:04", part126); + +var part127 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',"Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#490:File:06", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup127, + dup124, + dup128, +])); + +var msg111 = msg("File:06", part127); + +var part128 = // "Pattern{Constant('''), Field(fld23,false), Constant('',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#491:File:07", "nwparser.payload", "'%{fld23}',,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + dup123, +])); + +var msg112 = msg("File:07", part128); + +var part129 = // "Pattern{Field(fld23,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#492:File:12", "nwparser.payload", "%{fld23},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{process_id},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup41, + dup42, + dup15, +])); + +var msg113 = msg("File:12", part129); + +var part130 = // "Pattern{Field(fld1,false), Constant(','), Field(fld7,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',"Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#493:File:08", "nwparser.payload", "%{fld1},%{fld7},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup127, +])); + +var msg114 = msg("File:08", part130); + +var part131 = // "Pattern{Field(fld1,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#494:File:09", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + setc("event_description","File Delete."), + dup124, + dup131, +])); + +var msg115 = msg("File:09", part131); + +var part132 = // "Pattern{Constant('Unauthorized NT call rejected by protection driver.,'), Field(fld22,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(fld23,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#496:Blocked", "nwparser.payload", "Unauthorized NT call rejected by protection driver.,%{fld22},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{fld23},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup132, + dup122, + setc("event_description","Unauthorized NT call rejected by protection driver."), +])); + +var msg116 = msg("Blocked", part132); + +var part133 = // "Pattern{Constant(',Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" +match("MESSAGE#497:Blocked:01", "nwparser.payload", ",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, +])); + +var msg117 = msg("Blocked:01", part133); + +var part134 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',Registry Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#498:Blocked:02", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},Registry Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup133, +])); + +var msg118 = msg("Blocked:02", part134); + +var part135 = // "Pattern{Field(fld21,true), Constant(' - Caller MD5='), Field(fld22,false), Constant(',Create Process'), Field(p0,false)}" +match("MESSAGE#499:Blocked:03/0_0", "nwparser.payload", "%{fld21->} - Caller MD5=%{fld22},Create Process%{p0}"); + +var part136 = // "Pattern{Field(fld23,false), Constant(',Load Dll'), Field(p0,false)}" +match("MESSAGE#499:Blocked:03/0_1", "nwparser.payload", "%{fld23},Load Dll%{p0}"); + +var select19 = linear_select([ + part135, + part136, +]); + +var part137 = // "Pattern{Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld24,false), Constant(','), Field(process,false), Constant(','), Field(fld25,false), Constant(','), Field(fld26,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" +match("MESSAGE#499:Blocked:03/1", "nwparser.p0", ",Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld24},%{process},%{fld25},%{fld26},%{filename},User: %{username},Domain: %{domain},Action Type: %{fld8},File size (bytes):%{filename_size},Device ID:%{device}"); + +var all64 = all_match({ + processors: [ + select19, + part137, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + setc("event_description","Block from loading other DLLs/processes."), + ]), +}); + +var msg119 = msg("Blocked:03", all64); + +var part138 = // "Pattern{Field(event_description,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(sdomain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID:')}" +match("MESSAGE#500:Blocked:05", "nwparser.payload", "%{event_description->} - Caller MD5=%{checksum},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{sdomain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID:", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup15, + dup134, + dup135, +])); + +var msg120 = msg("Blocked:05", part138); + +var part139 = // "Pattern{Constant('['), Field(id,false), Constant('] '), Field(event_description,true), Constant(' - '), Field(fld11,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#501:Blocked:06", "nwparser.payload", "[%{id}] %{event_description->} - %{fld11},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup40, + dup15, + dup134, + dup135, +])); + +var msg121 = msg("Blocked:06", part139); + +var part140 = // "Pattern{Constant('['), Field(id,false), Constant('] '), Field(event_description,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#502:Blocked:07", "nwparser.payload", "[%{id}] %{event_description},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup15, + dup134, + dup135, +])); + +var msg122 = msg("Blocked:07", part140); + +var part141 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('/service''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_0", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}/service'%{fld33->} ,Create Process,Begin: %{p0}"); + +var part142 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('chrome-extension:'), Field(fld99,false), Constant('''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_1", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}chrome-extension:%{fld99}'%{fld33->} ,Create Process,Begin: %{p0}"); + +var part143 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('-ServerName:'), Field(hostid,false), Constant('''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_2", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}'%{fld33->} ,Create Process,Begin: %{p0}"); + +var part144 = // "Pattern{Constant('- Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('-ServerName:'), Field(hostid,false), Constant('' ,Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_3", "nwparser.payload", "- Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}' ,Create Process,Begin: %{p0}"); + +var part145 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_4", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7->} ,Create Process,Begin: %{p0}"); + +var part146 = // "Pattern{Constant('- Target MD5='), Field(fld6,false), Constant(',Create Process,Begin: '), Field(p0,false)}" +match("MESSAGE#504:Blocked:09/0_5", "nwparser.payload", "- Target MD5=%{fld6},Create Process,Begin: %{p0}"); + +var select20 = linear_select([ + part141, + part142, + part143, + part144, + part145, + part146, +]); + +var part147 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,true), Constant(' ,File size ('), Field(fld10,false), Constant('):'), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#504:Blocked:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44->} ,File size (%{fld10}):%{filename_size},Device ID: %{device}"); + +var all65 = all_match({ + processors: [ + select20, + part147, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup129, + dup14, + dup41, + dup42, + dup15, + ]), +}); + +var msg123 = msg("Blocked:09", all65); + +var select21 = linear_select([ + msg103, + msg104, + msg105, + msg106, + msg107, + msg108, + msg109, + msg110, + msg111, + msg112, + msg113, + msg114, + msg115, + msg116, + msg117, + msg118, + msg119, + msg120, + msg121, + msg122, + msg123, +]); + +var part148 = // "Pattern{Constant('Changed value ''), Field(change_attribute,false), Constant('' from ''), Field(change_old,false), Constant('' to ''), Field(change_new,false), Constant('''), Field(p0,false)}" +match("MESSAGE#55:Changed/0", "nwparser.payload", "Changed value '%{change_attribute}' from '%{change_old}' to '%{change_new}'%{p0}"); + +var all66 = all_match({ + processors: [ + part148, + dup318, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup137, + setc("event_description","Changed value"), + dup15, + dup93, + ]), +}); + +var msg124 = msg("Changed", all66); + +var part149 = // "Pattern{Constant('Cleaned up '), Field(dclass_counter1,true), Constant(' LiveUpdate downloaded content')}" +match("MESSAGE#56:Cleaned", "nwparser.payload", "Cleaned up %{dclass_counter1->} LiveUpdate downloaded content", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Cleaned up downloaded content."), + setc("dclass_counter1_string","Number of Virus Cleaned."), +])); + +var msg125 = msg("Cleaned", part149); + +var part150 = // "Pattern{Constant('Client has downloaded the issued Command,'), Field(username,false)}" +match("MESSAGE#57:Client", "nwparser.payload", "Client has downloaded the issued Command,%{username}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup137, + dup15, + setc("event_description","Client has downloaded the issued command."), +])); + +var msg126 = msg("Client", part150); + +var part151 = // "Pattern{Field(event_description,false), Constant(', type SymDelta version'), Field(version,true), Constant(' filesize'), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#58:Client:01/0_0", "nwparser.payload", "%{event_description}, type SymDelta version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); + +var part152 = // "Pattern{Field(event_description,false), Constant(', type full version'), Field(version,true), Constant(' filesize'), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#58:Client:01/0_1", "nwparser.payload", "%{event_description}, type full version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); + +var part153 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#58:Client:01/0_2", "nwparser.payload", "event_description"); + +var select22 = linear_select([ + part151, + part152, + part153, +]); + +var all67 = all_match({ + processors: [ + select22, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup93, + ]), +}); + +var msg127 = msg("Client:01", all67); + +var select23 = linear_select([ + msg126, + msg127, +]); + +var part154 = // "Pattern{Constant('client has downloaded the '), Field(p0,false)}" +match("MESSAGE#59:client/0", "nwparser.payload", "client has downloaded the %{p0}"); + +var part155 = // "Pattern{Constant('content package'), Field(p0,false)}" +match("MESSAGE#59:client/1_0", "nwparser.p0", "content package%{p0}"); + +var part156 = // "Pattern{Constant('policy'), Field(p0,false)}" +match("MESSAGE#59:client/1_1", "nwparser.p0", "policy%{p0}"); + +var part157 = // "Pattern{Constant('Intrusion Prevention policy'), Field(p0,false)}" +match("MESSAGE#59:client/1_2", "nwparser.p0", "Intrusion Prevention policy%{p0}"); + +var select24 = linear_select([ + part155, + part156, + part157, +]); + +var part158 = // "Pattern{Field(,false), Constant('successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#59:client/2", "nwparser.p0", "%{}successfully,%{shost},%{username},%{group}"); + +var all68 = all_match({ + processors: [ + part154, + select24, + part158, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client has downloaded the policy successfully."), + ]), +}); + +var msg128 = msg("client", all68); + +var part159 = // "Pattern{Constant('client has reconnected with the management server,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#60:client:01", "nwparser.payload", "client has reconnected with the management server,%{shost},%{username},%{group}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client has reconnected with the management server."), +])); + +var msg129 = msg("client:01", part159); + +var part160 = // "Pattern{Constant('client has downloaded '), Field(filename,true), Constant(' successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#61:client:02", "nwparser.payload", "client has downloaded %{filename->} successfully,%{shost},%{username},%{group}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup138, +])); + +var msg130 = msg("client:02", part160); + +var part161 = // "Pattern{Constant('client registered with the management server successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#62:client:03", "nwparser.payload", "client registered with the management server successfully,%{shost},%{username},%{group}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client registered with the management server successfully"), +])); + +var msg131 = msg("client:03", part161); + +var part162 = // "Pattern{Constant('client has downloaded '), Field(filename,false), Constant(','), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#63:client:04", "nwparser.payload", "client has downloaded %{filename},%{shost},%{username},%{group}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup138, +])); + +var msg132 = msg("client:04", part162); + +var part163 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" +match("MESSAGE#64:client:05/2", "nwparser.p0", "Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); + +var all69 = all_match({ + processors: [ + dup139, + dup324, + part163, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup142, + dup19, + dup143, + dup34, + ]), +}); + +var msg133 = msg("client:05", all69); + +var part164 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" +match("MESSAGE#65:client:15/2", "nwparser.p0", "Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); + +var all70 = all_match({ + processors: [ + dup139, + dup324, + part164, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup142, + dup19, + dup143, + dup35, + ]), +}); + +var msg134 = msg("client:15", all70); + +var part165 = // "Pattern{Constant('client computer has been added to the group,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#66:client:06", "nwparser.payload", "client computer has been added to the group,%{shost},%{username},%{group}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Client computer has been added to the group."), +])); + +var msg135 = msg("client:06", part165); + +var part166 = // "Pattern{Constant('client computer has been renamed,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(sdomain,false)}" +match("MESSAGE#67:client:07", "nwparser.payload", "client computer has been renamed,%{shost},%{username},%{sdomain}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client computer has been renamed"), +])); + +var msg136 = msg("client:07", part166); + +var part167 = // "Pattern{Constant('The client does not have a paid license. The current license cannot be used to obtain a client authentication token.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#68:client:08", "nwparser.payload", "The client does not have a paid license. The current license cannot be used to obtain a client authentication token.,Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client does not have a paid license"), +])); + +var msg137 = msg("client:08", part167); + +var part168 = // "Pattern{Constant('The client has successfully downloaded and applied a license from the server.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#69:client:09", "nwparser.payload", "The client has successfully downloaded and applied a license from the server.,Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + date_time({ + dest: "event_time", + args: ["event_time_string"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dO], + ], + }), + dup15, + setc("event_description","The client has successfully downloaded and applied a license from the server"), +])); + +var msg138 = msg("client:09", part168); + +var part169 = // "Pattern{Constant('The client opted to download a full definitions package for AV definitions from the management server or GUP '), Field(p0,false)}" +match("MESSAGE#693:SYLINK:01/0", "nwparser.payload", "The client opted to download a full definitions package for AV definitions from the management server or GUP %{p0}"); + +var part170 = // "Pattern{Constant('because LiveUpdate had no AV updates available'), Field(p0,false)}" +match("MESSAGE#693:SYLINK:01/1_0", "nwparser.p0", "because LiveUpdate had no AV updates available%{p0}"); + +var part171 = // "Pattern{Constant('rather than download a large package from LiveUpdate'), Field(p0,false)}" +match("MESSAGE#693:SYLINK:01/1_1", "nwparser.p0", "rather than download a large package from LiveUpdate%{p0}"); + +var select25 = linear_select([ + part170, + part171, +]); + +var part172 = // "Pattern{Constant('.'), Field(p0,false)}" +match("MESSAGE#693:SYLINK:01/2", "nwparser.p0", ".%{p0}"); + +var all71 = all_match({ + processors: [ + part169, + select25, + part172, + dup318, + ], + on_success: processor_chain([ + dup43, + dup15, + dup93, + setc("event_description","The client opted to download a full definitions package for AV definitions from the management server or GUP"), + ]), +}); + +var msg139 = msg("SYLINK:01", all71); + +var part173 = // "Pattern{Constant('The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the management server or GUP.'), Field(,false)}" +match("MESSAGE#694:SYLINK:02", "nwparser.payload", "The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the management server or GUP.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","The client opted to download an update for AV definitions from LiveUpdate"), +])); + +var msg140 = msg("SYLINK:02", part173); + +var part174 = // "Pattern{Constant('The client has obtained an invalid license file ('), Field(filename,false), Constant(') from the server.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#695:SYLINK:04", "nwparser.payload", "The client has obtained an invalid license file (%{filename}) from the server.,Event time:%{fld17->} %{fld18}", processor_chain([ + dup121, + dup12, + dup13, + dup15, + dup93, + setc("event_description","The client has obtained an invalid license file from the server."), +])); + +var msg141 = msg("SYLINK:04", part174); + +var part175 = // "Pattern{Constant('The client has successfully downloaded a license file ('), Field(filename,false), Constant(') from the server.')}" +match("MESSAGE#697:Smc", "nwparser.payload", "The client has successfully downloaded a license file (%{filename}) from the server.", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The client has successfully downloaded a license file"), +])); + +var msg142 = msg("Smc", part175); + +var part176 = // "Pattern{Constant('The client has successfully downloaded and applied a license file ('), Field(filename,false), Constant(') from the server.'), Field(p0,false)}" +match("MESSAGE#698:Smc:01/0", "nwparser.payload", "The client has successfully downloaded and applied a license file (%{filename}) from the server.%{p0}"); + +var all72 = all_match({ + processors: [ + part176, + dup318, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup15, + dup93, + dup144, + ]), +}); + +var msg143 = msg("Smc:01", all72); + +var part177 = // "Pattern{Constant('"The client has successfully downloaded and applied a license file ('), Field(filename,false), Constant(', Serial: '), Field(serial_number,false), Constant(') from the server."'), Field(p0,false)}" +match("MESSAGE#701:Smc:05/0", "nwparser.payload", "\"The client has successfully downloaded and applied a license file (%{filename}, Serial: %{serial_number}) from the server.\"%{p0}"); + +var all73 = all_match({ + processors: [ + part177, + dup318, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup93, + dup144, + ]), +}); + +var msg144 = msg("Smc:05", all73); + +var select26 = linear_select([ + msg128, + msg129, + msg130, + msg131, + msg132, + msg133, + msg134, + msg135, + msg136, + msg137, + msg138, + msg139, + msg140, + msg141, + msg142, + msg143, + msg144, +]); + +var all74 = all_match({ + processors: [ + dup145, + dup325, + dup148, + dup326, + dup151, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup132, + dup93, + dup153, + dup154, + dup155, + dup15, + dup19, + ]), +}); + +var msg145 = msg("Commercial", all74); + +var part178 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Application name: '), Field(p0,false)}" +match("MESSAGE#71:Commercial:02/2_0", "nwparser.p0", "%{severity},First Seen: %{fld50},Application name: %{p0}"); + +var part179 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(p0,false)}" +match("MESSAGE#71:Commercial:02/2_1", "nwparser.p0", "%{severity},Application name: %{p0}"); + +var select27 = linear_select([ + part178, + part179, +]); + +var part180 = // "Pattern{Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(',Detection Submissions No,Permitted application reason: '), Field(fld42,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#71:Commercial:02/3", "nwparser.p0", "%{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var all75 = all_match({ + processors: [ + dup145, + dup325, + select27, + part180, + dup326, + dup151, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup132, + dup93, + dup153, + dup154, + dup155, + dup15, + dup19, + ]), +}); + +var msg146 = msg("Commercial:02", all75); + +var part181 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',"Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#72:Commercial:01/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all76 = all_match({ + processors: [ + dup145, + dup325, + dup148, + dup326, + part181, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup132, + dup93, + dup153, + dup154, + dup155, + dup15, + dup19, + ]), +}); + +var msg147 = msg("Commercial:01", all76); + +var select28 = linear_select([ + msg145, + msg146, + msg147, +]); + +var part182 = // "Pattern{Constant('Computer has been deleted'), Field(,false)}" +match("MESSAGE#73:Computer:deleted", "nwparser.payload", "Computer has been deleted%{}", processor_chain([ + dup156, + dup12, + dup13, + dup27, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Computer has been deleted."), +])); + +var msg148 = msg("Computer:deleted", part182); + +var part183 = // "Pattern{Constant('Computer has been moved'), Field(,false)}" +match("MESSAGE#74:Computer:moved", "nwparser.payload", "Computer has been moved%{}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Computer has been moved."), +])); + +var msg149 = msg("Computer:moved", part183); + +var part184 = // "Pattern{Constant('Computer properties have been changed'), Field(,false)}" +match("MESSAGE#75:Computer:propertieschanged", "nwparser.payload", "Computer properties have been changed%{}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Computer properties have been changed."), +])); + +var msg150 = msg("Computer:propertieschanged", part184); + +var part185 = // "Pattern{Constant('"'), Field(filename,false), Constant('","'), Field(p0,false)}" +match("MESSAGE#76:Computer/1_0", "nwparser.p0", "\"%{filename}\",\"%{p0}"); + +var part186 = // "Pattern{Field(filename,false), Constant(',"'), Field(p0,false)}" +match("MESSAGE#76:Computer/1_1", "nwparser.p0", "%{filename},\"%{p0}"); + +var select29 = linear_select([ + part185, + part186, +]); + +var part187 = // "Pattern{Field(fld1,false), Constant('",Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" +match("MESSAGE#76:Computer/2", "nwparser.p0", "%{fld1}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); + +var all77 = all_match({ + processors: [ + dup157, + select29, + part187, + ], + on_success: processor_chain([ + dup136, + dup12, + dup132, + dup14, + dup15, + dup158, + ]), +}); + +var msg151 = msg("Computer", all77); + +var part188 = // "Pattern{Constant('"'), Field(filename,false), Constant('",''), Field(p0,false)}" +match("MESSAGE#77:Computer:01/1_0", "nwparser.p0", "\"%{filename}\",'%{p0}"); + +var part189 = // "Pattern{Field(filename,false), Constant(',''), Field(p0,false)}" +match("MESSAGE#77:Computer:01/1_1", "nwparser.p0", "%{filename},'%{p0}"); + +var select30 = linear_select([ + part188, + part189, +]); + +var part190 = // "Pattern{Field(fld1,false), Constant('',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" +match("MESSAGE#77:Computer:01/2", "nwparser.p0", "%{fld1}',Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); + +var all78 = all_match({ + processors: [ + dup157, + select30, + part190, + ], + on_success: processor_chain([ + dup136, + dup12, + dup132, + dup14, + dup15, + dup158, + ]), +}); + +var msg152 = msg("Computer:01", all78); + +var part191 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Intensive Protection Level: '), Field(fld55,false), Constant(',Certificate issuer: '), Field(cert_subject,false), Constant(',Certificate signer: '), Field(fld68,false), Constant(',Certificate thumbprint: '), Field(fld57,false), Constant(',Signing timestamp: '), Field(fld69,false), Constant(',Certificate serial number: '), Field(cert.serial,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#78:Computer:03/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Intensive Protection Level: %{fld55},Certificate issuer: %{cert_subject},Certificate signer: %{fld68},Certificate thumbprint: %{fld57},Signing timestamp: %{fld69},Certificate serial number: %{cert.serial},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); + +var part192 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(','), Field(fld67,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false), Constant(',Location:'), Field(fld65,false)}" +match("MESSAGE#78:Computer:03/2", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},%{fld67},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type},Location:%{fld65}"); + +var all79 = all_match({ + processors: [ + part191, + dup327, + part192, + ], + on_success: processor_chain([ + setc("eventcategory","1003000000"), + dup12, + dup132, + dup15, + dup93, + dup47, + ]), +}); + +var msg153 = msg("Computer:03", all79); + +var part193 = // "Pattern{Constant('Computer name: '), Field(p0,false)}" +match("MESSAGE#79:Computer:02/0", "nwparser.payload", "Computer name: %{p0}"); + +var all80 = all_match({ + processors: [ + part193, + dup325, + dup161, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup132, + dup152, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, + ]), +}); + +var msg154 = msg("Computer:02", all80); + +var select31 = linear_select([ + msg148, + msg149, + msg150, + msg151, + msg152, + msg153, + msg154, +]); + +var part194 = // "Pattern{Constant('Configuration Change..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Description: '), Field(event_description,true), Constant(' ..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#80:Configuration", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{event_description->} ..Severity: %{severity}..Source: %{product}", processor_chain([ + dup165, + dup166, + dup15, +])); + +var msg155 = msg("Configuration", part194); + +var part195 = // "Pattern{Constant('Configuration Change..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('........'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..')}" +match("MESSAGE#81:Configuration:01", "nwparser.payload", "Configuration Change..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6->} %{fld7}..", processor_chain([ + dup165, + dup166, + setc("event_description","Configuration Change"), + dup15, +])); + +var msg156 = msg("Configuration:01", part195); + +var part196 = // "Pattern{Constant('Configuration Change..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#82:Configuration:02", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup165, + dup166, + dup15, +])); + +var msg157 = msg("Configuration:02", part196); + +var select32 = linear_select([ + msg155, + msg156, + msg157, +]); + +var part197 = // "Pattern{Constant('Connected to Symantec Endpoint Protection Manager '), Field(p0,false)}" +match("MESSAGE#83:Connected/0", "nwparser.payload", "Connected to Symantec Endpoint Protection Manager %{p0}"); + +var part198 = // "Pattern{Field(fld11,true), Constant(' ,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#83:Connected/1_0", "nwparser.p0", "%{fld11->} ,Event time: %{fld17->} %{fld18}"); + +var part199 = // "Pattern{Constant(''), Field(fld11,false)}" +match("MESSAGE#83:Connected/1_1", "nwparser.p0", "%{fld11}"); + +var select33 = linear_select([ + part198, + part199, +]); + +var all81 = all_match({ + processors: [ + part197, + select33, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup93, + dup15, + setc("event_description","Connected to Symantec Endpoint Protection Manager"), + ]), +}); + +var msg158 = msg("Connected", all81); + +var part200 = // "Pattern{Constant('Connected to Management Server '), Field(hostip,false), Constant('.')}" +match("MESSAGE#686:Connected:01", "nwparser.payload", "Connected to Management Server %{hostip}.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Connected to Management Server"), +])); + +var msg159 = msg("Connected:01", part200); + +var select34 = linear_select([ + msg158, + msg159, +]); + +var part201 = // "Pattern{Constant('Connection reset'), Field(,false)}" +match("MESSAGE#84:Connection", "nwparser.payload", "Connection reset%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Connection reset."), +])); + +var msg160 = msg("Connection", part201); + +var part202 = // "Pattern{Constant('Could '), Field(space,false), Constant('not start Service Engine err='), Field(resultcode,false)}" +match("MESSAGE#85:Could", "nwparser.payload", "Could %{space}not start Service Engine err=%{resultcode}", processor_chain([ + dup86, + dup12, + dup13, + dup14, + dup15, + dup167, +])); + +var msg161 = msg("Could", part202); + +var part203 = // "Pattern{Constant('Could not scan '), Field(dclass_counter1,true), Constant(' files inside '), Field(directory,true), Constant(' due to extraction errors encountered by the Decomposer Engines.')}" +match("MESSAGE#86:Could:01", "nwparser.payload", "Could not scan %{dclass_counter1->} files inside %{directory->} due to extraction errors encountered by the Decomposer Engines.", processor_chain([ + dup86, + dup12, + dup13, + dup14, + dup15, + setc("dclass_counter1_string","Number of Files"), + dup167, +])); + +var msg162 = msg("Could:01", part203); + +var select35 = linear_select([ + msg161, + msg162, +]); + +var part204 = // "Pattern{Constant('Create trident engine failed.'), Field(,false)}" +match("MESSAGE#87:Create", "nwparser.payload", "Create trident engine failed.%{}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Create trident engine failed."), +])); + +var msg163 = msg("Create", part204); + +var part205 = // "Pattern{Constant('Database Maintenance Finished Successfully'), Field(,false)}" +match("MESSAGE#88:Database", "nwparser.payload", "Database Maintenance Finished Successfully%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Database Maintenance Finished Successfully"), +])); + +var msg164 = msg("Database", part205); + +var part206 = // "Pattern{Constant('Database maintenance started.'), Field(,false)}" +match("MESSAGE#89:Database:01", "nwparser.payload", "Database maintenance started.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","Database maintenance started."), +])); + +var msg165 = msg("Database:01", part206); + +var part207 = // "Pattern{Constant('Database maintenance finished successfully.'), Field(,false)}" +match("MESSAGE#90:Database:02", "nwparser.payload", "Database maintenance finished successfully.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","Database maintenance finished successfully."), +])); + +var msg166 = msg("Database:02", part207); + +var part208 = // "Pattern{Constant('Database properties are changed'), Field(,false)}" +match("MESSAGE#91:Database:03", "nwparser.payload", "Database properties are changed%{}", processor_chain([ + dup43, + dup15, + setc("event_description","Database properties are changed"), +])); + +var msg167 = msg("Database:03", part208); + +var select36 = linear_select([ + msg164, + msg165, + msg166, + msg167, +]); + +var part209 = // "Pattern{Constant('Disconnected from Symantec Endpoint Protection Manager. --- server address : '), Field(hostid,false)}" +match("MESSAGE#92:Disconnected", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager. --- server address : %{hostid}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup169, +])); + +var msg168 = msg("Disconnected", part209); + +var part210 = // "Pattern{Constant('Disconnected from Symantec Endpoint Protection Manager ('), Field(hostip,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#93:Disconnected:01/0", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager (%{hostip})%{p0}"); + +var all82 = all_match({ + processors: [ + part210, + dup318, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup14, + dup15, + dup93, + dup169, + ]), +}); + +var msg169 = msg("Disconnected:01", all82); + +var part211 = // "Pattern{Constant('Disconnected to Management Server '), Field(hostip,false), Constant('.')}" +match("MESSAGE#687:Disconnected:02", "nwparser.payload", "Disconnected to Management Server %{hostip}.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Disconnected to Management Server"), +])); + +var msg170 = msg("Disconnected:02", part211); + +var select37 = linear_select([ + msg168, + msg169, + msg170, +]); + +var part212 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#94:Decomposer", "nwparser.payload", "event_description", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, +])); + +var msg171 = msg("Decomposer", part212); + +var part213 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was added')}" +match("MESSAGE#95:Domain:added", "nwparser.payload", "Domain \"%{domain}\" was added", processor_chain([ + dup95, + dup12, + dup13, + dup96, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Domain was added."), +])); + +var msg172 = msg("Domain:added", part213); + +var part214 = // "Pattern{Constant('Domain "'), Field(change_old,false), Constant('" was renamed to "'), Field(change_new,false), Constant('"')}" +match("MESSAGE#96:Domain:renamed", "nwparser.payload", "Domain \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Domain was renamed."), + setc("change_attribute","domain name"), +])); + +var msg173 = msg("Domain:renamed", part214); + +var part215 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was deleted!')}" +match("MESSAGE#97:Domain:deleted", "nwparser.payload", "Domain \"%{domain}\" was deleted!", processor_chain([ + dup156, + dup12, + dup13, + dup27, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Domain was deleted."), +])); + +var msg174 = msg("Domain:deleted", part215); + +var part216 = // "Pattern{Constant('Domain administrator "'), Field(username,false), Constant('" was added')}" +match("MESSAGE#98:Domain:administratoradded", "nwparser.payload", "Domain administrator \"%{username}\" was added", processor_chain([ + dup170, + dup12, + dup13, + dup20, + dup96, + dup28, + dup22, + dup14, + dup15, + dup158, + setc("event_description","Domain administrator was added."), +])); + +var msg175 = msg("Domain:administratoradded", part216); + +var part217 = // "Pattern{Constant('Domain administrator "'), Field(username,false), Constant('" was deleted')}" +match("MESSAGE#99:Domain:administratordeleted", "nwparser.payload", "Domain administrator \"%{username}\" was deleted", processor_chain([ + dup171, + dup12, + dup13, + dup20, + dup27, + dup28, + dup22, + dup14, + dup15, + dup158, + setc("event_description","Domain administrator deleted."), +])); + +var msg176 = msg("Domain:administratordeleted", part217); + +var part218 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was disabled')}" +match("MESSAGE#100:Domain:disabled", "nwparser.payload", "Domain \"%{domain}\" was disabled", processor_chain([ + dup136, + dup12, + dup13, + dup56, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Domain disabled"), +])); + +var msg177 = msg("Domain:disabled", part218); + +var part219 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was enabled')}" +match("MESSAGE#101:Domain:enabled", "nwparser.payload", "Domain \"%{domain}\" was enabled", processor_chain([ + dup136, + dup12, + dup13, + dup172, + dup97, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Domain enabled"), +])); + +var msg178 = msg("Domain:enabled", part219); + +var select38 = linear_select([ + msg172, + msg173, + msg174, + msg175, + msg176, + msg177, + msg178, +]); + +var part220 = // "Pattern{Constant('Failed to connect to the server. '), Field(action,false), Constant('. ErrorCode: '), Field(resultcode,false)}" +match("MESSAGE#102:Failed", "nwparser.payload", "Failed to connect to the server. %{action}. ErrorCode: %{resultcode}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + dup173, +])); + +var msg179 = msg("Failed", part220); + +var part221 = // "Pattern{Constant('Failed to contact server for more than '), Field(p0,false)}" +match("MESSAGE#103:Failed:01/0", "nwparser.payload", "Failed to contact server for more than %{p0}"); + +var part222 = // "Pattern{Constant(''), Field(fld1,true), Constant(' times.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#103:Failed:01/1_0", "nwparser.p0", "%{fld1->} times.,Event time:%{fld17->} %{fld18}"); + +var part223 = // "Pattern{Field(fld1,true), Constant(' times.')}" +match("MESSAGE#103:Failed:01/1_1", "nwparser.p0", "%{fld1->} times."); + +var select39 = linear_select([ + part222, + part223, +]); + +var all83 = all_match({ + processors: [ + part221, + select39, + ], + on_success: processor_chain([ + dup74, + dup12, + dup13, + dup14, + dup15, + dup93, + dup173, + ]), +}); + +var msg180 = msg("Failed:01", all83); + +var part224 = // "Pattern{Constant('Failed to disable Windows firewall'), Field(,false)}" +match("MESSAGE#104:Failed:02", "nwparser.payload", "Failed to disable Windows firewall%{}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Failed to disable Windows firewall."), +])); + +var msg181 = msg("Failed:02", part224); + +var part225 = // "Pattern{Constant('Failed to install teefer driver'), Field(,false)}" +match("MESSAGE#105:Failed:03", "nwparser.payload", "Failed to install teefer driver%{}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Failed to install teefer driver."), +])); + +var msg182 = msg("Failed:03", part225); + +var part226 = // "Pattern{Constant('Failed to connect to '), Field(fld22,false), Constant('. Make sure the server can ping or resolve this domain. ErrorCode: '), Field(resultcode,false)}" +match("MESSAGE#106:Failed:04", "nwparser.payload", "Failed to connect to %{fld22}. Make sure the server can ping or resolve this domain. ErrorCode: %{resultcode}", processor_chain([ + dup168, + dup14, + dup15, + setc("event_description","Failed to connect."), +])); + +var msg183 = msg("Failed:04", part226); + +var part227 = // "Pattern{Constant('Failed to download new client upgrade package from the management server. New Version: '), Field(version,true), Constant(' Package size: '), Field(filename_size,true), Constant(' bytes. Package url: '), Field(url,false)}" +match("MESSAGE#107:Failed:05", "nwparser.payload", "Failed to download new client upgrade package from the management server. New Version: %{version->} Package size: %{filename_size->} bytes. Package url: %{url}", processor_chain([ + dup168, + dup12, + dup13, + setc("ec_subject","Agent"), + dup97, + dup25, + dup14, + dup15, + setc("event_description","Failed to download new client upgrade package from the management server."), +])); + +var msg184 = msg("Failed:05", part227); + +var part228 = // "Pattern{Constant('Failed to import server policy.'), Field(,false)}" +match("MESSAGE#108:Failed:06", "nwparser.payload", "Failed to import server policy.%{}", processor_chain([ + dup168, + dup12, + dup13, + dup97, + dup25, + dup14, + dup15, + setc("event_description","Failed to import server policy."), +])); + +var msg185 = msg("Failed:06", part228); + +var part229 = // "Pattern{Constant('Failed to load plugin:'), Field(filename,false)}" +match("MESSAGE#109:Failed:07", "nwparser.payload", "Failed to load plugin:%{filename}", processor_chain([ + dup168, + dup12, + dup13, + dup97, + dup25, + dup14, + dup15, + setc("event_description","Failed to load plugin"), +])); + +var msg186 = msg("Failed:07", part229); + +var part230 = // "Pattern{Constant('Failed to clean up LiveUpdate downloaded content'), Field(,false)}" +match("MESSAGE#110:Failed:08", "nwparser.payload", "Failed to clean up LiveUpdate downloaded content%{}", processor_chain([ + dup168, + dup12, + dup13, + dup97, + dup25, + dup14, + dup15, + setc("event_description","Failed to clean up LiveUpdate downloaded content"), +])); + +var msg187 = msg("Failed:08", part230); + +var part231 = // "Pattern{Constant('Failed to Login to Remote Site ['), Field(node,false), Constant('] Failed to connect to the server. Make sure that the server is running and your session has not timed out. If you can reach the server but cannot log on, make sure that you provided the correct parameters. If you are experiencing network issues, contact your system administrator.')}" +match("MESSAGE#111:Failed:09", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Failed to connect to the server. Make sure that the server is running and your session has not timed out. If you can reach the server but cannot log on, make sure that you provided the correct parameters. If you are experiencing network issues, contact your system administrator.", processor_chain([ + dup174, + dup12, + dup13, + dup97, + dup25, + dup14, + dup15, + dup175, +])); + +var msg188 = msg("Failed:09", part231); + +var part232 = // "Pattern{Constant('Failed to Login to Remote Site ['), Field(node,false), Constant('] Replication partnership has been deleted from remote site.')}" +match("MESSAGE#112:Failed:10", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Replication partnership has been deleted from remote site.", processor_chain([ + dup174, + dup12, + dup13, + dup97, + dup25, + dup14, + dup15, + dup175, +])); + +var msg189 = msg("Failed:10", part232); + +var part233 = // "Pattern{Constant('Failed to import new policy.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#113:Failed:11", "nwparser.payload", "Failed to import new policy.,Event time: %{event_time_string}", processor_chain([ + setc("eventcategory","1601000000"), + dup12, + dup13, + dup15, + setc("event_description","Failed to import new policy."), +])); + +var msg190 = msg("Failed:11", part233); + +var part234 = // "Pattern{Constant('Failed to set a custom action for IPS signature '), Field(sigid,true), Constant(' (errcode=0x'), Field(resultcode,false), Constant('). Most probably, this IPS signature was removed from the IPS content.'), Field(p0,false)}" +match("MESSAGE#250:Network:24/0", "nwparser.payload", "Failed to set a custom action for IPS signature %{sigid->} (errcode=0x%{resultcode}). Most probably, this IPS signature was removed from the IPS content.%{p0}"); + +var select40 = linear_select([ + dup176, + dup91, +]); + +var all84 = all_match({ + processors: [ + part234, + select40, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Failed to set a custom action for IPS signature"), + ]), +}); + +var msg191 = msg("Network:24", all84); + +var part235 = // "Pattern{Constant('Failed to connect to all GUPs, now trying to connect SEPM"'), Field(,false)}" +match("MESSAGE#696:SYLINK:03", "nwparser.payload", "Failed to connect to all GUPs, now trying to connect SEPM\"%{}", processor_chain([ + dup74, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Failed to connect to all GUPs."), +])); + +var msg192 = msg("SYLINK:03", part235); + +var select41 = linear_select([ + msg179, + msg180, + msg181, + msg182, + msg183, + msg184, + msg185, + msg186, + msg187, + msg188, + msg189, + msg190, + msg191, + msg192, +]); + +var part236 = // "Pattern{Constant('Firewall driver failed to '), Field(info,false)}" +match("MESSAGE#114:Firewall", "nwparser.payload", "Firewall driver failed to %{info}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Firewall driver failed."), +])); + +var msg193 = msg("Firewall", part236); + +var part237 = // "Pattern{Constant('Firewall is enabled,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#115:Firewall:01", "nwparser.payload", "Firewall is enabled,Event time: %{event_time_string}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Firewall is enabled"), +])); + +var msg194 = msg("Firewall:01", part237); + +var part238 = // "Pattern{Constant('Firewall is disabled by policy,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#116:Firewall:02", "nwparser.payload", "Firewall is disabled by policy,Event time: %{event_time_string}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Firewall is disabled by policy"), +])); + +var msg195 = msg("Firewall:02", part238); + +var part239 = // "Pattern{Constant('Firewall is disabled,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#117:Firewall:03", "nwparser.payload", "Firewall is disabled,Event time: %{event_time_string}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Firewall is disabled"), +])); + +var msg196 = msg("Firewall:03", part239); + +var select42 = linear_select([ + msg193, + msg194, + msg195, + msg196, +]); + +var part240 = // "Pattern{Constant('Group has been created'), Field(,false)}" +match("MESSAGE#118:Group:created", "nwparser.payload", "Group has been created%{}", processor_chain([ + dup95, + dup12, + dup13, + dup177, + dup96, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group has been created"), +])); + +var msg197 = msg("Group:created", part240); + +var part241 = // "Pattern{Constant('Group has been deleted'), Field(,false)}" +match("MESSAGE#119:Group:deleted", "nwparser.payload", "Group has been deleted%{}", processor_chain([ + dup156, + dup12, + dup13, + dup177, + dup27, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group has been deleted"), +])); + +var msg198 = msg("Group:deleted", part241); + +var part242 = // "Pattern{Constant('Group ''), Field(group,false), Constant('' was deleted')}" +match("MESSAGE#120:Group:deleted_01", "nwparser.payload", "Group '%{group}' was deleted", processor_chain([ + dup156, + dup12, + dup13, + dup177, + dup27, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group was deleted"), +])); + +var msg199 = msg("Group:deleted_01", part242); + +var part243 = // "Pattern{Constant('Group has been moved'), Field(,false)}" +match("MESSAGE#121:Group:moved", "nwparser.payload", "Group has been moved%{}", processor_chain([ + dup136, + dup12, + dup13, + dup177, + dup30, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group has been moved"), +])); + +var msg200 = msg("Group:moved", part243); + +var part244 = // "Pattern{Constant('Group has been renamed'), Field(,false)}" +match("MESSAGE#122:Group:renamed", "nwparser.payload", "Group has been renamed%{}", processor_chain([ + dup136, + dup12, + dup13, + dup177, + dup30, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group has been renamed"), +])); + +var msg201 = msg("Group:renamed", part244); + +var part245 = // "Pattern{Constant('Group ''), Field(group,false), Constant('' was added')}" +match("MESSAGE#123:Group:added", "nwparser.payload", "Group '%{group}' was added", processor_chain([ + dup95, + dup12, + dup13, + dup177, + dup30, + dup178, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Group was added"), +])); + +var msg202 = msg("Group:added", part245); + +var select43 = linear_select([ + msg197, + msg198, + msg199, + msg200, + msg201, + msg202, +]); + +var part246 = // "Pattern{Constant('Host Integrity check is disabled. '), Field(info,true), Constant(' by the '), Field(username,false)}" +match("MESSAGE#124:Host", "nwparser.payload", "Host Integrity check is disabled. %{info->} by the %{username}", processor_chain([ + dup179, + dup12, + dup13, + dup56, + dup97, + dup22, + dup14, + dup15, + dup180, +])); + +var msg203 = msg("Host", part246); + +var part247 = // "Pattern{Field(info,true), Constant(' up-to-date')}" +match("MESSAGE#125:Host:01", "nwparser.payload", "%{info->} up-to-date", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Component is up-to-date"), +])); + +var msg204 = msg("Host:01", part247); + +var part248 = // "Pattern{Constant('Host Integrity check failed Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" failed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" passed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#126:Host:02", "nwparser.payload", "Host Integrity check failed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" failed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ + dup179, + dup12, + dup13, + dup25, + dup14, + dup15, + dup89, +])); + +var msg205 = msg("Host:02", part248); + +var part249 = // "Pattern{Constant('Host Integrity failed but reported as pass Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" passed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" failed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#127:Host:05", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" failed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup12, + dup13, + dup25, + dup14, + dup15, + dup181, +])); + +var msg206 = msg("Host:05", part249); + +var part250 = // "Pattern{Constant('Host Integrity failed but reported as pass Requirement: "'), Field(fld11,false), Constant('" '), Field(fld18,true), Constant(' Requirement: "'), Field(fld12,false), Constant('" '), Field(fld17,true), Constant(' Requirement: "'), Field(fld13,false), Constant('" '), Field(fld16,true), Constant(' Requirement: "'), Field(fld14,false), Constant('" '), Field(fld15,true), Constant(' '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#128:Host:06", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" %{fld18->} Requirement: \"%{fld12}\" %{fld17->} Requirement: \"%{fld13}\" %{fld16->} Requirement: \"%{fld14}\" %{fld15->} %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup12, + dup13, + dup25, + dup14, + dup15, + dup181, +])); + +var msg207 = msg("Host:06", part250); + +var part251 = // "Pattern{Constant('Host Integrity check failed '), Field(result,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#129:Host:04", "nwparser.payload", "Host Integrity check failed %{result},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup12, + dup13, + dup25, + dup14, + dup15, + setc("event_description","Host Integrity check failed"), +])); + +var msg208 = msg("Host:04", part251); + +var part252 = // "Pattern{Constant('Host Integrity check passed Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" passed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" passed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#130:Host:03", "nwparser.payload", "Host Integrity check passed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup12, + dup13, + dup22, + dup14, + dup15, + dup88, +])); + +var msg209 = msg("Host:03", part252); + +var part253 = // "Pattern{Constant('Host Integrity check passed'), Field(space,false), Constant('Requirement: ''), Field(fld11,false), Constant('' passed '), Field(fld12,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#132:Host:07", "nwparser.payload", "Host Integrity check passed%{space}Requirement: '%{fld11}' passed %{fld12},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup87, + dup12, + dup13, + dup22, + dup14, + dup15, + dup88, +])); + +var msg210 = msg("Host:07", part253); + +var part254 = // "Pattern{Field(shost,false), Constant(', Host Integrity check passed '), Field(p0,false)}" +match("MESSAGE#133:Host:08/0_0", "nwparser.payload", "%{shost}, Host Integrity check passed %{p0}"); + +var part255 = // "Pattern{Constant('Host Integrity check passed'), Field(p0,false)}" +match("MESSAGE#133:Host:08/0_1", "nwparser.payload", "Host Integrity check passed%{p0}"); + +var select44 = linear_select([ + part254, + part255, +]); + +var part256 = // "Pattern{Field(,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#133:Host:08/1", "nwparser.p0", "%{},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); + +var all85 = all_match({ + processors: [ + select44, + part256, + ], + on_success: processor_chain([ + dup53, + dup12, + dup22, + dup15, + dup88, + dup40, + dup41, + dup42, + dup47, + ]), +}); + +var msg211 = msg("Host:08", all85); + +var part257 = // "Pattern{Field(shost,false), Constant(', Host Integrity check pass.'), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" +match("MESSAGE#134:Host:09/0", "nwparser.payload", "%{shost}, Host Integrity check pass.%{info},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); + +var select45 = linear_select([ + dup67, + dup182, +]); + +var part258 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#134:Host:09/2", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); + +var all86 = all_match({ + processors: [ + part257, + select45, + part258, + ], + on_success: processor_chain([ + dup179, + dup12, + dup15, + dup40, + dup41, + dup42, + dup47, + ]), +}); + +var msg212 = msg("Host:09", all86); + +var part259 = // "Pattern{Constant('Host Integrity check is disabled. Only do Host Integrity checking when connected to the Symantec Endpoint Protection Manager is checked.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#702:Smc:06", "nwparser.payload", "Host Integrity check is disabled. Only do Host Integrity checking when connected to the Symantec Endpoint Protection Manager is checked.,Event time: %{fld17->} %{fld18}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup93, + dup180, +])); + +var msg213 = msg("Smc:06", part259); + +var select46 = linear_select([ + msg203, + msg204, + msg205, + msg206, + msg207, + msg208, + msg209, + msg210, + msg211, + msg212, + msg213, +]); + +var part260 = // "Pattern{Field(fld31,true), Constant(' ??????????????? ??: "'), Field(fld11,false), Constant('"?? ??: "'), Field(fld12,false), Constant('"?? ??: "'), Field(fld13,false), Constant('"?? ??: "'), Field(fld14,false), Constant('"??,??????????? ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#131:??:", "nwparser.payload", "%{fld31->} ??????????????? ??: \"%{fld11}\"?? ??: \"%{fld12}\"?? ??: \"%{fld13}\"?? ??: \"%{fld14}\"??,??????????? ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ + dup179, + dup12, + dup13, + dup14, + dup15, +])); + +var msg214 = msg("??:", part260); + +var part261 = // "Pattern{Field(info,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#135:Intrusion/0", "nwparser.payload", "%{info->} %{p0}"); + +var part262 = // "Pattern{Constant('was '), Field(p0,false)}" +match("MESSAGE#135:Intrusion/1_1", "nwparser.p0", "was %{p0}"); + +var select47 = linear_select([ + dup183, + part262, +]); + +var part263 = // "Pattern{Constant(''), Field(action,false)}" +match("MESSAGE#135:Intrusion/2", "nwparser.p0", "%{action}"); + +var all87 = all_match({ + processors: [ + part261, + select47, + part263, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + setc("event_description","Intrusion Prevention signatures is up-to-date."), + dup15, + ]), +}); + +var msg215 = msg("Intrusion", all87); + +var part264 = // "Pattern{Field(info,true), Constant(' failed to update')}" +match("MESSAGE#136:Intrusion:01", "nwparser.payload", "%{info->} failed to update", processor_chain([ + dup92, + dup12, + dup13, + dup14, + setc("event_description"," Failed to update Signature"), + dup15, +])); + +var msg216 = msg("Intrusion:01", part264); + +var select48 = linear_select([ + msg215, + msg216, +]); + +var part265 = // "Pattern{Constant('Invalid log record:'), Field(info,false)}" +match("MESSAGE#137:Invalid", "nwparser.payload", "Invalid log record:%{info}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Invalid log record"), +])); + +var msg217 = msg("Invalid", part265); + +var part266 = // "Pattern{Constant('Limited Administrator administrator "'), Field(change_old,false), Constant('" was renamed to "'), Field(change_new,false), Constant('"')}" +match("MESSAGE#138:Limited", "nwparser.payload", "Limited Administrator administrator \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ + setc("eventcategory","1402020300"), + dup12, + dup13, + dup30, + dup22, + dup14, + dup15, + setc("event_description","Limited Administrator renamed"), + dup23, + setc("change_attribute","limited administrator username."), +])); + +var msg218 = msg("Limited", part266); + +var part267 = // "Pattern{Constant('LiveUpdate will start next on '), Field(info,true), Constant(' on '), Field(product,false)}" +match("MESSAGE#139:LiveUpdate:08", "nwparser.payload", "LiveUpdate will start next on %{info->} on %{product}", processor_chain([ + dup43, + dup15, + dup184, +])); + +var msg219 = msg("LiveUpdate:08", part267); + +var part268 = // "Pattern{Constant('LiveUpdate '), Field(info,true), Constant(' on '), Field(product,false), Constant('"')}" +match("MESSAGE#140:LiveUpdate:01", "nwparser.payload", "LiveUpdate %{info->} on %{product}\"", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup184, +])); + +var msg220 = msg("LiveUpdate:01", part268); + +var part269 = // "Pattern{Constant('LiveUpdate failed.'), Field(,false)}" +match("MESSAGE#141:LiveUpdate", "nwparser.payload", "LiveUpdate failed.%{}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","LiveUpdate failed."), +])); + +var msg221 = msg("LiveUpdate", part269); + +var part270 = // "Pattern{Constant('LiveUpdate encountered one or more errors. Return code = '), Field(resultcode,false)}" +match("MESSAGE#142:LiveUpdate:04", "nwparser.payload", "LiveUpdate encountered one or more errors. Return code = %{resultcode}", processor_chain([ + dup168, + dup15, + setc("event_description","LiveUpdate encountered one or more errors"), +])); + +var msg222 = msg("LiveUpdate:04", part270); + +var part271 = // "Pattern{Constant('LiveUpdate succeeded'), Field(,false)}" +match("MESSAGE#143:LiveUpdate:02", "nwparser.payload", "LiveUpdate succeeded%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","LiveUpdate succeeded"), +])); + +var msg223 = msg("LiveUpdate:02", part271); + +var part272 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,[LiveUpdate error submission] Submitting information to Symantec failed.')}" +match("MESSAGE#144:LiveUpdate:09", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Submitting information to Symantec failed.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup185, +])); + +var msg224 = msg("LiveUpdate:09", part272); + +var part273 = // "Pattern{Constant('LiveUpdate encountered an error: Failed to connect to the LiveUpdate server ('), Field(resultcode,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#145:LiveUpdate:10/0", "nwparser.payload", "LiveUpdate encountered an error: Failed to connect to the LiveUpdate server (%{resultcode})%{p0}"); + +var select49 = linear_select([ + dup186, + dup91, +]); + +var all88 = all_match({ + processors: [ + part273, + select49, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Failed to connect to the LiveUpdate server"), + ]), +}); + +var msg225 = msg("LiveUpdate:10", all88); + +var part274 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"An update for '), Field(application,true), Constant(' failed to install. Error: '), Field(resultcode,false), Constant(', DuResult:'), Field(fld23,false), Constant('."'), Field(p0,false)}" +match("MESSAGE#146:LiveUpdate:11/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"An update for %{application->} failed to install. Error: %{resultcode}, DuResult:%{fld23}.\"%{p0}"); + +var all89 = all_match({ + processors: [ + part274, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","An update failed to install"), + ]), +}); + +var msg226 = msg("LiveUpdate:11", all89); + +var part275 = // "Pattern{Constant('LiveUpdate re-run triggered by the download of content catalog.'), Field(,false)}" +match("MESSAGE#147:LiveUpdate:12", "nwparser.payload", "LiveUpdate re-run triggered by the download of content catalog.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","LiveUpdate re-run triggered by the download of content catalog."), +])); + +var msg227 = msg("LiveUpdate:12", part275); + +var part276 = // "Pattern{Constant('LiveUpdate cannot be run because all licenses have expired.'), Field(,false)}" +match("MESSAGE#148:LiveUpdate:13", "nwparser.payload", "LiveUpdate cannot be run because all licenses have expired.%{}", processor_chain([ + dup43, + dup14, + dup15, + setc("event_description","LiveUpdate cannot be run because all licenses have expired."), +])); + +var msg228 = msg("LiveUpdate:13", part276); + +var part277 = // "Pattern{Constant('LiveUpdate started.'), Field(,false)}" +match("MESSAGE#149:LiveUpdate::05", "nwparser.payload", "LiveUpdate started.%{}", processor_chain([ + dup43, + dup15, + setc("action","LiveUpdate started."), +])); + +var msg229 = msg("LiveUpdate::05", part277); + +var part278 = // "Pattern{Constant('LiveUpdate retry started.'), Field(,false)}" +match("MESSAGE#150:LiveUpdate::06", "nwparser.payload", "LiveUpdate retry started.%{}", processor_chain([ + dup43, + dup15, + setc("action","LiveUpdate retry started."), +])); + +var msg230 = msg("LiveUpdate::06", part278); + +var part279 = // "Pattern{Constant('LiveUpdate retry succeeded.'), Field(,false)}" +match("MESSAGE#151:LiveUpdate::07", "nwparser.payload", "LiveUpdate retry succeeded.%{}", processor_chain([ + dup43, + dup15, + setc("action","LiveUpdate retry succeeded."), +])); + +var msg231 = msg("LiveUpdate::07", part279); + +var part280 = // "Pattern{Constant('LiveUpdate retry failed. Will try again.'), Field(,false)}" +match("MESSAGE#152:LiveUpdate::08", "nwparser.payload", "LiveUpdate retry failed. Will try again.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("action","LiveUpdate retry failed."), +])); + +var msg232 = msg("LiveUpdate::08", part280); + +var part281 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Centralized Reputation Settings from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#153:LiveUpdate:14", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Centralized Reputation Settings from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","An update for Centralized Reputation Settings from LiveUpdate failed to install."), +])); + +var msg233 = msg("LiveUpdate:14", part281); + +var part282 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#154:LiveUpdate:15", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install."), +])); + +var msg234 = msg("LiveUpdate:15", part282); + +var part283 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Intrusion Prevention Signatures from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#155:LiveUpdate:16", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Intrusion Prevention Signatures from LiveUpdate failed to install."), +])); + +var msg235 = msg("LiveUpdate:16", part283); + +var part284 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Revocation Data from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#156:LiveUpdate:17", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Revocation Data from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","An update for Revocation Data from LiveUpdate failed to install."), +])); + +var msg236 = msg("LiveUpdate:17", part284); + +var part285 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for SONAR Definitions from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#157:LiveUpdate:18/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for SONAR Definitions from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); + +var all90 = all_match({ + processors: [ + part285, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","An update for SONAR Definitions from LiveUpdate failed to install."), + ]), +}); + +var msg237 = msg("LiveUpdate:18", all90); + +var part286 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Symantec Whitelist from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#158:LiveUpdate:19/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Symantec Whitelist from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); + +var all91 = all_match({ + processors: [ + part286, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","An update for Symantec Whitelist from LiveUpdate failed to install."), + ]), +}); + +var msg238 = msg("LiveUpdate:19", all91); + +var part287 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#159:LiveUpdate:20", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install."), +])); + +var msg239 = msg("LiveUpdate:20", part287); + +var part288 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#160:LiveUpdate:21", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install."), +])); + +var msg240 = msg("LiveUpdate:21", part288); + +var part289 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#161:LiveUpdate:22", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup12, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install."), +])); + +var msg241 = msg("LiveUpdate:22", part289); + +var part290 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#162:LiveUpdate:23", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ + dup43, + dup94, + dup13, + dup45, + dup38, + dup25, + dup14, + dup15, + setc("event_description","An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install."), +])); + +var msg242 = msg("LiveUpdate:23", part290); + +var part291 = // "Pattern{Constant('LiveUpdate encountered an error: '), Field(result,true), Constant(' ('), Field(resultcode,false), Constant(').'), Field(p0,false)}" +match("MESSAGE#163:LiveUpdate:24/0", "nwparser.payload", "LiveUpdate encountered an error: %{result->} (%{resultcode}).%{p0}"); + +var all92 = all_match({ + processors: [ + part291, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup38, + dup187, + dup14, + dup15, + dup93, + dup188, + ]), +}); + +var msg243 = msg("LiveUpdate:24", all92); + +var part292 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated.')}" +match("MESSAGE#164:LiveUpdate:25", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated."), +])); + +var msg244 = msg("LiveUpdate:25", part292); + +var part293 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated.')}" +match("MESSAGE#165:LiveUpdate:26", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated."), +])); + +var msg245 = msg("LiveUpdate:26", part293); + +var part294 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,A LiveUpdate session encountered errors. '), Field(fld1,true), Constant(' update(s) were available. '), Field(fld2,true), Constant(' update(s) installed successfully. '), Field(fld3,true), Constant(' update(s) failed to install.'), Field(p0,false)}" +match("MESSAGE#166:LiveUpdate:27/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,A LiveUpdate session encountered errors. %{fld1->} update(s) were available. %{fld2->} update(s) installed successfully. %{fld3->} update(s) failed to install.%{p0}"); + +var all93 = all_match({ + processors: [ + part294, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","LiveUpdate session encountered errors"), + ]), +}); + +var msg246 = msg("LiveUpdate:27", all93); + +var part295 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Revocation Data update failed to load. The component will continue to use its previous content.'), Field(p0,false)}" +match("MESSAGE#167:LiveUpdate:28/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component will continue to use its previous content.%{p0}"); + +var all94 = all_match({ + processors: [ + part295, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","The latest Revocation Data update failed to load."), + ]), +}); + +var msg247 = msg("LiveUpdate:28", all94); + +var part296 = // "Pattern{Field(fld11,false), Constant(': Impossible de se connecter au serveur LiveUpdate '), Field(fld12,false), Constant('.')}" +match("MESSAGE#168:LiveUpdate:29", "nwparser.payload", "%{fld11}: Impossible de se connecter au serveur LiveUpdate %{fld12}.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","LiveUpdate a rencontr� une erreur"), +])); + +var msg248 = msg("LiveUpdate:29", part296); + +var part297 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' was successfully installed.'), Field(space,false), Constant('The new sequence number is '), Field(fld23,false), Constant('.'), Field(p0,false)}" +match("MESSAGE#169:LiveUpdate:30/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} was successfully installed.%{space}The new sequence number is %{fld23}.%{p0}"); + +var part298 = // "Pattern{Field(space,false), Constant('Content was downloaded from '), Field(url,true), Constant(' ('), Field(sport,false), Constant(').,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#169:LiveUpdate:30/1_0", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport}).,Event time:%{fld17->} %{fld18}"); + +var part299 = // "Pattern{Field(space,false), Constant('Content was downloaded from '), Field(url,true), Constant(' ('), Field(sport,false), Constant(').')}" +match("MESSAGE#169:LiveUpdate:30/1_1", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport})."); + +var select50 = linear_select([ + part298, + part299, + dup90, + dup91, +]); + +var all95 = all_match({ + processors: [ + part297, + select50, + ], + on_success: processor_chain([ + dup43, + dup189, + dup13, + dup14, + dup15, + dup93, + setc("event_description","An update from LiveUpdate Manager installed successfully"), + ]), +}); + +var msg249 = msg("LiveUpdate:30", all95); + +var part300 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest '), Field(application,true), Constant(' update failed to load. The component will continue to use its previous content.'), Field(p0,false)}" +match("MESSAGE#170:LiveUpdate:31/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest %{application->} update failed to load. The component will continue to use its previous content.%{p0}"); + +var all96 = all_match({ + processors: [ + part300, + dup318, + ], + on_success: processor_chain([ + dup43, + dup189, + dup13, + dup14, + dup15, + dup93, + setc("event_description","The latest update from LiveUpdate Manager failed to load."), + ]), +}); + +var msg250 = msg("LiveUpdate:31", all96); + +var part301 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,Scheduled LiveUpdate switched to '), Field(change_new,false), Constant('.')}" +match("MESSAGE#171:LiveUpdate:32", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate switched to %{change_new}.", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","Scheduled LiveUpdate interval switched."), +])); + +var msg251 = msg("LiveUpdate:32", part301); + +var part302 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' from LiveUpdate failed to install. Error: '), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#172:LiveUpdate:33/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from LiveUpdate failed to install. Error: %{result}(%{resultcode})%{p0}"); + +var all97 = all_match({ + processors: [ + part302, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","An update from LiveUpdate Manager failed to install."), + ]), +}); + +var msg252 = msg("LiveUpdate:33", all97); + +var part303 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' from Intelligent Updater was already installed.')}" +match("MESSAGE#173:LiveUpdate:34", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from Intelligent Updater was already installed.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","An update from Intelligent Updater already installed."), +])); + +var msg253 = msg("LiveUpdate:34", part303); + +var part304 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,'), Field(p0,false)}" +match("MESSAGE#174:LiveUpdate:35/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,%{p0}"); + +var part305 = // "Pattern{Constant('A '), Field(p0,false)}" +match("MESSAGE#174:LiveUpdate:35/1_0", "nwparser.p0", "A %{p0}"); + +var part306 = // "Pattern{Constant(' The'), Field(p0,false)}" +match("MESSAGE#174:LiveUpdate:35/1_1", "nwparser.p0", " The%{p0}"); + +var select51 = linear_select([ + part305, + part306, +]); + +var part307 = // "Pattern{Field(,false), Constant('LiveUpdate session '), Field(p0,false)}" +match("MESSAGE#174:LiveUpdate:35/2", "nwparser.p0", "%{}LiveUpdate session %{p0}"); + +var part308 = // "Pattern{Constant('was'), Field(p0,false)}" +match("MESSAGE#174:LiveUpdate:35/3_1", "nwparser.p0", "was%{p0}"); + +var select52 = linear_select([ + dup183, + part308, +]); + +var part309 = // "Pattern{Field(,false), Constant('cancelled.')}" +match("MESSAGE#174:LiveUpdate:35/4", "nwparser.p0", "%{}cancelled."); + +var all98 = all_match({ + processors: [ + part304, + select51, + part307, + select52, + part309, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","A LiveUpdate session from LiveUpdate Manager was cancelled."), + ]), +}); + +var msg254 = msg("LiveUpdate:35", all98); + +var part310 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"A LiveUpdate session is already running, so the scheduled LiveUpdate was skipped."'), Field(p0,false)}" +match("MESSAGE#175:LiveUpdate:36/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"A LiveUpdate session is already running, so the scheduled LiveUpdate was skipped.\"%{p0}"); + +var all99 = all_match({ + processors: [ + part310, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","A LiveUpdate session from LiveUpdate Manager is running, LiveUpdate skipped."), + ]), +}); + +var msg255 = msg("LiveUpdate:36", all99); + +var part311 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,Scheduled LiveUpdate keep trying to connect to Server for '), Field(fld23,true), Constant(' times.')}" +match("MESSAGE#176:LiveUpdate:37", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate keep trying to connect to Server for %{fld23->} times.", processor_chain([ + dup43, + dup94, + dup13, + dup14, + dup15, + setc("event_description","LiveUpdate is trying to connect to Server."), +])); + +var msg256 = msg("LiveUpdate:37", part311); + +var part312 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,A LiveUpdate session ran successfully. '), Field(p0,false)}" +match("MESSAGE#177:LiveUpdate:38/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,A LiveUpdate session ran successfully. %{p0}"); + +var part313 = // "Pattern{Constant(''), Field(fld23,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#177:LiveUpdate:38/1_0", "nwparser.p0", "%{fld23},Event time:%{fld17->} %{fld18}"); + +var part314 = // "Pattern{Field(fld23,false)}" +match_copy("MESSAGE#177:LiveUpdate:38/1_1", "nwparser.p0", "fld23"); + +var select53 = linear_select([ + part313, + part314, +]); + +var all100 = all_match({ + processors: [ + part312, + select53, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup93, + dup15, + setc("event_description","A LiveUpdate session from LiveUpdate Manager ran successfully."), + ]), +}); + +var msg257 = msg("LiveUpdate:38", all100); + +var part315 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,[LiveUpdate error submission] Information submitted to Symantec.'), Field(p0,false)}" +match("MESSAGE#178:LiveUpdate:39/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Information submitted to Symantec.%{p0}"); + +var all101 = all_match({ + processors: [ + part315, + dup318, + ], + on_success: processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","LiveUpdate error submission to Symantec."), + ]), +}); + +var msg258 = msg("LiveUpdate:39", all101); + +var part316 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Submission Control Thresholds update failed to load. The component has no valid content and will not function correctly until it is updated.')}" +match("MESSAGE#180:LiveUpdate:41", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Submission Control Thresholds update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The latest Submission Control Thresholds update failed to load."), +])); + +var msg259 = msg("LiveUpdate:41", part316); + +var part317 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest SONAR Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.')}" +match("MESSAGE#181:LiveUpdate:42", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest SONAR Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup190, +])); + +var msg260 = msg("LiveUpdate:42", part317); + +var part318 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Endpoint Detection and Response update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#182:LiveUpdate:43", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Endpoint Detection and Response update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup190, +])); + +var msg261 = msg("LiveUpdate:43", part318); + +var part319 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"[LiveUpdate error submission] Submitting information to Symantec failed. Network error : ''), Field(result,false), Constant('''), Field(fld23,false), Constant('",Event time: '), Field(event_time_string,false)}" +match("MESSAGE#183:LiveUpdate:44", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"[LiveUpdate error submission] Submitting information to Symantec failed. Network error : '%{result}'%{fld23}\",Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup185, +])); + +var msg262 = msg("LiveUpdate:44", part319); + +var part320 = // "Pattern{Constant('LiveUpdate encountered an error.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#184:LiveUpdate:45", "nwparser.payload", "LiveUpdate encountered an error.,Event time: %{fld17->} %{fld18}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + dup188, + dup93, +])); + +var msg263 = msg("LiveUpdate:45", part320); + +var part321 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest AP Portal List update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#185:LiveUpdate:46", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest AP Portal List update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","The latest AP Portal List update failed to load."), +])); + +var msg264 = msg("LiveUpdate:46", part321); + +var part322 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Centralized Reputation Settings update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#186:LiveUpdate:47", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Centralized Reputation Settings update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","The latest Centralized Reputation Settings update failed to load."), +])); + +var msg265 = msg("LiveUpdate:47", part322); + +var part323 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Power Eraser Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#187:LiveUpdate:48", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Power Eraser Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","The latest Power Eraser Definitions update failed to load."), +])); + +var msg266 = msg("LiveUpdate:48", part323); + +var part324 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Common Network Transport Library and Configuration update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#188:LiveUpdate:49", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Common Network Transport Library and Configuration update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","The latest Common Network Transport Library and Configuration update failed to load."), +])); + +var msg267 = msg("LiveUpdate:49", part324); + +var part325 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Extended File Attributes and Signatures update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#189:LiveUpdate:50", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Extended File Attributes and Signatures update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","The latest Extended File Attributes and Signatures update failed to load."), +])); + +var msg268 = msg("LiveUpdate:50", part325); + +var select54 = linear_select([ + msg219, + msg220, + msg221, + msg222, + msg223, + msg224, + msg225, + msg226, + msg227, + msg228, + msg229, + msg230, + msg231, + msg232, + msg233, + msg234, + msg235, + msg236, + msg237, + msg238, + msg239, + msg240, + msg241, + msg242, + msg243, + msg244, + msg245, + msg246, + msg247, + msg248, + msg249, + msg250, + msg251, + msg252, + msg253, + msg254, + msg255, + msg256, + msg257, + msg258, + msg259, + msg260, + msg261, + msg262, + msg263, + msg264, + msg265, + msg266, + msg267, + msg268, +]); + +var part326 = // "Pattern{Constant('Virus and Spyware Definitions were updated recently, so the scheduled LiveUpdate was skipped.'), Field(p0,false)}" +match("MESSAGE#179:LiveUpdate:40/0", "nwparser.payload", "Virus and Spyware Definitions were updated recently, so the scheduled LiveUpdate was skipped.%{p0}"); + +var select55 = linear_select([ + dup191, + dup91, +]); + +var all102 = all_match({ + processors: [ + part326, + select55, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","The scheduled LiveUpdate from LiveUpdate Manager was skipped."), + ]), +}); + +var msg269 = msg("LiveUpdate:40", all102); + +var part327 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Virus Name: '), Field(virusname,false), Constant('..Path: '), Field(filename,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#430:Virus", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Virus Name: %{virusname}..Path: %{filename}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup192, + dup15, + dup193, +])); + +var msg270 = msg("Virus", part327); + +var part328 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#431:Virus:01", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup110, + dup192, + dup15, + dup193, +])); + +var msg271 = msg("Virus:01", part328); + +var part329 = // "Pattern{Constant('Virus Definition File Update..'), Field(fld4,false), Constant('..'), Field(fld5,false), Constant('..Update to computer '), Field(shost,true), Constant(' of virus definition file '), Field(fld6,true), Constant(' failed. Status '), Field(fld7,true), Constant(' ..'), Field(p0,false)}" +match("MESSAGE#432:Virus:02/0", "nwparser.payload", "Virus Definition File Update..%{fld4}..%{fld5}..Update to computer %{shost->} of virus definition file %{fld6->} failed. Status %{fld7->} ..%{p0}"); + +var part330 = // "Pattern{Constant('. '), Field(p0,false)}" +match("MESSAGE#432:Virus:02/1_0", "nwparser.p0", ". %{p0}"); + +var select56 = linear_select([ + part330, + dup194, +]); + +var part331 = // "Pattern{Constant(''), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld8,false)}" +match("MESSAGE#432:Virus:02/2", "nwparser.p0", "%{severity}..%{product}..%{fld8}"); + +var all103 = all_match({ + processors: [ + part329, + select56, + part331, + ], + on_success: processor_chain([ + dup43, + dup44, + dup45, + dup30, + dup25, + date_time({ + dest: "event_time", + args: ["fld5","fld8"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dN,dc(":"),dU,dc(":"),dO,dP], + ], + }), + dup15, + dup195, + ]), +}); + +var msg272 = msg("Virus:02", all103); + +var part332 = // "Pattern{Constant('Virus Definition File Update..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" +match("MESSAGE#433:Virus:03", "nwparser.payload", "Virus Definition File Update..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ + dup43, + dup44, + dup45, + dup30, + dup22, + dup192, + dup15, + dup195, +])); + +var msg273 = msg("Virus:03", part332); + +var part333 = // "Pattern{Constant('Virus Found..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('.....'), Field(info,false), Constant('..'), Field(action,false), Constant('....'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" +match("MESSAGE#434:Virus:09", "nwparser.payload", "Virus Found..%{shost}..%{fld5}..%{filename}.....%{info}..%{action}....%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup192, + dup15, + dup196, +])); + +var msg274 = msg("Virus:09", part333); + +var part334 = // "Pattern{Constant('Virus Found..'), Field(fld12,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" +match("MESSAGE#435:Virus:04", "nwparser.payload", "Virus Found..%{fld12}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup192, + dup15, + dup196, +])); + +var msg275 = msg("Virus:04", part334); + +var part335 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(',0,Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" +match("MESSAGE#436:Virus:12/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); + +var all104 = all_match({ + processors: [ + dup197, + dup328, + part335, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg276 = msg("Virus:12", all104); + +var part336 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#437:Virus:15/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); + +var part337 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#437:Virus:15/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); + +var part338 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(url,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(filename,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" +match("MESSAGE#437:Virus:15/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{url},Web domain: %{fld45},Downloaded by: %{filename},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); + +var all105 = all_match({ + processors: [ + part336, + dup329, + part337, + dup328, + part338, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg277 = msg("Virus:15", all105); + +var part339 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" +match("MESSAGE#438:Virus:13/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},%{p0}"); + +var all106 = all_match({ + processors: [ + dup197, + dup328, + part339, + dup330, + dup205, + dup331, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg278 = msg("Virus:13", all106); + +var part340 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" +match("MESSAGE#439:Virus:10/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}"); + +var all107 = all_match({ + processors: [ + dup197, + dup328, + part340, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg279 = msg("Virus:10", all107); + +var part341 = // "Pattern{Constant('"'), Field(fld22,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#440:Virus:14/1_0", "nwparser.p0", "\"%{fld22}\",Actual action: %{p0}"); + +var part342 = // "Pattern{Field(fld22,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#440:Virus:14/1_1", "nwparser.p0", "%{fld22},Actual action: %{p0}"); + +var select57 = linear_select([ + part341, + part342, +]); + +var part343 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" +match("MESSAGE#440:Virus:14/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); + +var all108 = all_match({ + processors: [ + dup208, + select57, + part343, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg280 = msg("Virus:14", all108); + +var all109 = all_match({ + processors: [ + dup208, + dup332, + dup151, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg281 = msg("Virus:05", all109); + +var part344 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',"Group: '), Field(group,false), Constant('",Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#442:Virus:11/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group}\",Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all110 = all_match({ + processors: [ + dup208, + dup332, + part344, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup93, + dup153, + dup154, + dup15, + dup47, + dup200, + ]), +}); + +var msg282 = msg("Virus:11", all110); + +var part345 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..'), Field(p0,false)}" +match("MESSAGE#443:Virus:06/0", "nwparser.payload", "Virus Found..Computer: %{shost}..%{p0}"); + +var part346 = // "Pattern{Constant('Date: '), Field(fld5,false), Constant('..File Path:'), Field(p0,false)}" +match("MESSAGE#443:Virus:06/1_0", "nwparser.p0", "Date: %{fld5}..File Path:%{p0}"); + +var part347 = // "Pattern{Field(fld5,false), Constant('..File Path:'), Field(p0,false)}" +match("MESSAGE#443:Virus:06/1_1", "nwparser.p0", "%{fld5}..File Path:%{p0}"); + +var select58 = linear_select([ + part346, + part347, +]); + +var part348 = // "Pattern{Field(filename,false), Constant('..'), Field(info,false), Constant('..Requested Action:'), Field(action,false), Constant('..Severity:'), Field(severity,false), Constant('..Source:'), Field(product,false), Constant('..Time:'), Field(fld6,false), Constant('..User:'), Field(username,false)}" +match("MESSAGE#443:Virus:06/2", "nwparser.p0", "%{filename}..%{info}..Requested Action:%{action}..Severity:%{severity}..Source:%{product}..Time:%{fld6}..User:%{username}"); + +var all111 = all_match({ + processors: [ + part345, + select58, + part348, + ], + on_success: processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup192, + dup15, + dup196, + ]), +}); + +var msg283 = msg("Virus:06", all111); + +var part349 = // "Pattern{Field(fld1,true), Constant(' Virus Found '), Field(shost,true), Constant(' '), Field(fld5,true), Constant(' '), Field(filename,true), Constant(' Forward from '), Field(info,true), Constant(' '), Field(action,true), Constant(' '), Field(severity,true), Constant(' '), Field(product,true), Constant(' Edition '), Field(version,true), Constant(' '), Field(virusname,false)}" +match("MESSAGE#444:Virus:07", "nwparser.payload", "%{fld1->} Virus Found %{shost->} %{fld5->} %{filename->} Forward from %{info->} %{action->} %{severity->} %{product->} Edition %{version->} %{virusname}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup15, + dup132, + dup196, +])); + +var msg284 = msg("Virus:07", part349); + +var part350 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,false)}" +match("MESSAGE#445:Virus:08", "nwparser.payload", "%{product->} definitions %{info}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Product successfully updated."), +])); + +var msg285 = msg("Virus:08", part350); + +var select59 = linear_select([ + msg269, + msg270, + msg271, + msg272, + msg273, + msg274, + msg275, + msg276, + msg277, + msg278, + msg279, + msg280, + msg281, + msg282, + msg283, + msg284, + msg285, +]); + +var part351 = // "Pattern{Field(shost,false), Constant(', Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#216:Local:01", "nwparser.payload", "%{shost}, Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup53, + dup12, + dup15, + dup40, +])); + +var msg286 = msg("Local:01", part351); + +var part352 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#217:Local:02", "nwparser.payload", "Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup53, + dup12, + dup13, + dup15, + dup40, +])); + +var msg287 = msg("Local:02", part352); + +var select60 = linear_select([ + msg286, + msg287, +]); + +var part353 = // "Pattern{Constant('Location has been '), Field(p0,false)}" +match("MESSAGE#218:Location/0", "nwparser.payload", "Location has been %{p0}"); + +var part354 = // "Pattern{Constant('changed '), Field(p0,false)}" +match("MESSAGE#218:Location/1_0", "nwparser.p0", "changed %{p0}"); + +var part355 = // "Pattern{Constant('switched'), Field(p0,false)}" +match("MESSAGE#218:Location/1_1", "nwparser.p0", "switched%{p0}"); + +var select61 = linear_select([ + part354, + part355, +]); + +var part356 = // "Pattern{Field(,false), Constant('to '), Field(p0,false)}" +match("MESSAGE#218:Location/2", "nwparser.p0", "%{}to %{p0}"); + +var all112 = all_match({ + processors: [ + part353, + select61, + part356, + dup333, + ], + on_success: processor_chain([ + dup136, + dup94, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + dup93, + setc("event_description","Location has been changed or switched"), + ]), +}); + +var msg288 = msg("Location", all112); + +var part357 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#219:LUALL", "nwparser.payload", "event_description", processor_chain([ + dup43, + dup12, + dup13, + dup15, +])); + +var msg289 = msg("LUALL", part357); + +var part358 = // "Pattern{Constant('Management server started up successfully'), Field(,false)}" +match("MESSAGE#220:Management", "nwparser.payload", "Management server started up successfully%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Management server started up successfully."), +])); + +var msg290 = msg("Management", part358); + +var part359 = // "Pattern{Constant('Management server shut down gracefully'), Field(,false)}" +match("MESSAGE#221:Management:01", "nwparser.payload", "Management server shut down gracefully%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Management server shut down gracefully"), +])); + +var msg291 = msg("Management:01", part359); + +var part360 = // "Pattern{Constant('Management Server has detected and ignored one or more duplicate entries.Please check the following entries in your directory server:'), Field(fld12,false)}" +match("MESSAGE#222:Management:02", "nwparser.payload", "Management Server has detected and ignored one or more duplicate entries.Please check the following entries in your directory server:%{fld12}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Management Server has detected and ignored one or more duplicate entries."), +])); + +var msg292 = msg("Management:02", part360); + +var select62 = linear_select([ + msg290, + msg291, + msg292, +]); + +var part361 = // "Pattern{Constant('management server received the client log successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#223:management", "nwparser.payload", "management server received the client log successfully,%{shost},%{username},%{group}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The management server received the client log successfully."), +])); + +var msg293 = msg("management", part361); + +var part362 = // "Pattern{Constant('management server received a report that the client computer changed its hardware identity,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" +match("MESSAGE#224:management:01", "nwparser.payload", "management server received a report that the client computer changed its hardware identity,%{shost},%{username},%{group}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The management server received a report that the client computer changed its hardware identity."), +])); + +var msg294 = msg("management:01", part362); + +var select63 = linear_select([ + msg293, + msg294, +]); + +var part363 = // "Pattern{Constant('Network Threat Protection --'), Field(p0,false)}" +match("MESSAGE#225:Network/0", "nwparser.payload", "Network Threat Protection --%{p0}"); + +var part364 = // "Pattern{Constant('-- Engine version'), Field(p0,false)}" +match("MESSAGE#225:Network/1_0", "nwparser.p0", "-- Engine version%{p0}"); + +var part365 = // "Pattern{Constant(' Engine version'), Field(p0,false)}" +match("MESSAGE#225:Network/1_1", "nwparser.p0", " Engine version%{p0}"); + +var select64 = linear_select([ + part364, + part365, +]); + +var part366 = // "Pattern{Field(,false), Constant(': '), Field(version,true), Constant(' Windows Version info: Operating System: '), Field(os,true), Constant(' Network info:'), Field(info,false)}" +match("MESSAGE#225:Network/2", "nwparser.p0", "%{}: %{version->} Windows Version info: Operating System: %{os->} Network info:%{info}"); + +var all113 = all_match({ + processors: [ + part363, + select64, + part366, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Threat Protection information."), + ]), +}); + +var msg295 = msg("Network", all113); + +var part367 = // "Pattern{Constant('Network Threat Protection has been activated'), Field(,false)}" +match("MESSAGE#226:Network:01", "nwparser.payload", "Network Threat Protection has been activated%{}", processor_chain([ + dup213, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","Network Threat Protection has been activated"), +])); + +var msg296 = msg("Network:01", part367); + +var part368 = // "Pattern{Constant('Network Threat Protection applied a new IPS '), Field(p0,false)}" +match("MESSAGE#227:Network:02/0", "nwparser.payload", "Network Threat Protection applied a new IPS %{p0}"); + +var part369 = // "Pattern{Constant('Library'), Field(p0,false)}" +match("MESSAGE#227:Network:02/1_0", "nwparser.p0", "Library%{p0}"); + +var part370 = // "Pattern{Constant('library'), Field(p0,false)}" +match("MESSAGE#227:Network:02/1_1", "nwparser.p0", "library%{p0}"); + +var select65 = linear_select([ + part369, + part370, +]); + +var part371 = // "Pattern{Field(,false), Constant('.')}" +match("MESSAGE#227:Network:02/2", "nwparser.p0", "%{}."); + +var all114 = all_match({ + processors: [ + part368, + select65, + part371, + ], + on_success: processor_chain([ + dup110, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Threat Protection applied a new IPS Library."), + ]), +}); + +var msg297 = msg("Network:02", all114); + +var part372 = // "Pattern{Constant('The Network Threat Protection already has the newest policy.'), Field(,false)}" +match("MESSAGE#228:Network:03", "nwparser.payload", "The Network Threat Protection already has the newest policy.%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The Network Threat Protection already has the newest policy."), +])); + +var msg298 = msg("Network:03", part372); + +var part373 = // "Pattern{Constant('The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.'), Field(,false)}" +match("MESSAGE#229:Network:04", "nwparser.payload", "The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager."), +])); + +var msg299 = msg("Network:04", part373); + +var part374 = // "Pattern{Constant('Network Threat Protection's firewall and Intrusion Prevention features are disabled'), Field(,false)}" +match("MESSAGE#230:Network:05", "nwparser.payload", "Network Threat Protection's firewall and Intrusion Prevention features are disabled%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Threat Protection's firewall and Intrusion Prevention features are disabled"), +])); + +var msg300 = msg("Network:05", part374); + +var part375 = // "Pattern{Constant('The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager.'), Field(,false)}" +match("MESSAGE#231:Network:06", "nwparser.payload", "The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager."), +])); + +var msg301 = msg("Network:06", part375); + +var part376 = // "Pattern{Constant('Network Audit Search Unagented Hosts Started'), Field(,false)}" +match("MESSAGE#232:Network:07", "nwparser.payload", "Network Audit Search Unagented Hosts Started%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Audit Search Unagented Hosts Started."), +])); + +var msg302 = msg("Network:07", part376); + +var part377 = // "Pattern{Constant('Network Audit Search Unagented Hosts From NST Finished Abnormally'), Field(,false)}" +match("MESSAGE#233:Network:08", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Abnormally%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup214, +])); + +var msg303 = msg("Network:08", part377); + +var part378 = // "Pattern{Constant('Network Audit Search Unagented Hosts From NST Finished Normally'), Field(,false)}" +match("MESSAGE#234:Network:09", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Normally%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup214, +])); + +var msg304 = msg("Network:09", part378); + +var part379 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Started'), Field(,false)}" +match("MESSAGE#235:Network:10", "nwparser.payload", "Network Audit Client Remote Pushing Install Started%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Audit Client Remote Pushing Install Started."), +])); + +var msg305 = msg("Network:10", part379); + +var part380 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Finished Normally'), Field(,false)}" +match("MESSAGE#236:Network:11", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Normally%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Audit Client Remote Pushing Install Finished Normally."), +])); + +var msg306 = msg("Network:11", part380); + +var part381 = // "Pattern{Constant('Network Intrusion Prevention is malfunctioning, '), Field(result,false), Constant('"')}" +match("MESSAGE#237:Network:12", "nwparser.payload", "Network Intrusion Prevention is malfunctioning, %{result}\"", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + dup215, +])); + +var msg307 = msg("Network:12", part381); + +var part382 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',Network Intrusion Protection Sys,Browser Intrusion Prevention is malfunctioning. Browser type: '), Field(obj_name,false), Constant('.Try to update the signatures Browser path: '), Field(filename,false)}" +match("MESSAGE#238:Network:13", "nwparser.payload", "Category: %{fld11},Network Intrusion Protection Sys,Browser Intrusion Prevention is malfunctioning. Browser type: %{obj_name}.Try to update the signatures Browser path: %{filename}", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + setc("event_description","Browser Intrusion Prevention is malfunctioning."), +])); + +var msg308 = msg("Network:13", part382); + +var part383 = // "Pattern{Constant('Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed. The IPS content is going to be installed automatically'), Field(,false)}" +match("MESSAGE#241:Network:16", "nwparser.payload", "Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed. The IPS content is going to be installed automatically%{}", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + setc("event_description","Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed."), +])); + +var msg309 = msg("Network:16", part383); + +var part384 = // "Pattern{Constant('Network Intrusion Prevention is malfunctioning'), Field(,false)}" +match("MESSAGE#242:Network:17", "nwparser.payload", "Network Intrusion Prevention is malfunctioning%{}", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + dup215, +])); + +var msg310 = msg("Network:17", part384); + +var part385 = // "Pattern{Constant('Network Intrusion Prevention is not protecting machine because its driver was unloaded'), Field(,false)}" +match("MESSAGE#243:Network:18", "nwparser.payload", "Network Intrusion Prevention is not protecting machine because its driver was unloaded%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Intrusion Prevention is not protecting machine because its driver was unloaded"), +])); + +var msg311 = msg("Network:18", part385); + +var part386 = // "Pattern{Constant('Network Threat Protection's firewall is disabled by policy'), Field(,false)}" +match("MESSAGE#244:Network:19", "nwparser.payload", "Network Threat Protection's firewall is disabled by policy%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Threat Protection's firewall is disabled"), +])); + +var msg312 = msg("Network:19", part386); + +var part387 = // "Pattern{Field(service,true), Constant(' has been restored and '), Field(result,false)}" +match("MESSAGE#246:Network:21", "nwparser.payload", "%{service->} has been restored and %{result}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Intrusion Prevention has been restored"), +])); + +var msg313 = msg("Network:21", part387); + +var part388 = // "Pattern{Field(service,true), Constant(' is not protecting machine because its driver was disabled,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#247:Network:33", "nwparser.payload", "%{service->} is not protecting machine because its driver was disabled,Event time: %{event_time_string}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","Network Intrusion Prevention is not protecting machine because its driver was disabled"), +])); + +var msg314 = msg("Network:33", part388); + +var part389 = // "Pattern{Constant('Network Threat Protection's firewall is enabled'), Field(p0,false)}" +match("MESSAGE#251:Network:25/0", "nwparser.payload", "Network Threat Protection's firewall is enabled%{p0}"); + +var all115 = all_match({ + processors: [ + part389, + dup318, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Network Threat Protection's firewall is enabled"), + ]), +}); + +var msg315 = msg("Network:25", all115); + +var part390 = // "Pattern{Constant('Network Intrusion Prevention disabled'), Field(p0,false)}" +match("MESSAGE#253:Network:27/0", "nwparser.payload", "Network Intrusion Prevention disabled%{p0}"); + +var all116 = all_match({ + processors: [ + part390, + dup334, + ], + on_success: processor_chain([ + dup92, + dup94, + dup13, + dup14, + dup15, + setc("event_description","Network Intrusion Prevention disabled"), + ]), +}); + +var msg316 = msg("Network:27", all116); + +var part391 = // "Pattern{Constant('Network Intrusion Prevention enabled'), Field(p0,false)}" +match("MESSAGE#254:Network:28/0", "nwparser.payload", "Network Intrusion Prevention enabled%{p0}"); + +var all117 = all_match({ + processors: [ + part391, + dup318, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Network Intrusion Prevention enabled"), + ]), +}); + +var msg317 = msg("Network:28", all117); + +var part392 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage'), Field(,false)}" +match("MESSAGE#257:Network:30", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage%{}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage"), +])); + +var msg318 = msg("Network:30", part392); + +var select66 = linear_select([ + msg295, + msg296, + msg297, + msg298, + msg299, + msg300, + msg301, + msg302, + msg303, + msg304, + msg305, + msg306, + msg307, + msg308, + msg309, + msg310, + msg311, + msg312, + msg313, + msg314, + msg315, + msg316, + msg317, + msg318, +]); + +var part393 = // "Pattern{Constant('Firefox Browser Intrusion Prevention is malfunctioning'), Field(,false)}" +match("MESSAGE#239:Network:14", "nwparser.payload", "Firefox Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + setc("event_description","Firefox Browser Intrusion Prevention is malfunctioning."), +])); + +var msg319 = msg("Network:14", part393); + +var part394 = // "Pattern{Constant('Firefox Browser Intrusion Prevention disabled'), Field(p0,false)}" +match("MESSAGE#245:Network:20/0", "nwparser.payload", "Firefox Browser Intrusion Prevention disabled%{p0}"); + +var all118 = all_match({ + processors: [ + part394, + dup334, + ], + on_success: processor_chain([ + dup92, + dup94, + dup13, + dup14, + dup15, + setc("event_description","Firefox Browser Intrusion Prevention disabled"), + ]), +}); + +var msg320 = msg("Network:20", all118); + +var part395 = // "Pattern{Constant('Firefox Browser Intrusion Prevention enabled'), Field(p0,false)}" +match("MESSAGE#252:Network:26/0", "nwparser.payload", "Firefox Browser Intrusion Prevention enabled%{p0}"); + +var all119 = all_match({ + processors: [ + part395, + dup318, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Firefox Browser Intrusion Prevention enabled"), + ]), +}); + +var msg321 = msg("Network:26", all119); + +var select67 = linear_select([ + msg319, + msg320, + msg321, +]); + +var part396 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention is malfunctioning'), Field(,false)}" +match("MESSAGE#240:Network:15", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ + dup92, + dup12, + dup13, + dup187, + dup14, + dup15, + setc("event_description","Internet Explorer Browser Intrusion Prevention is malfunctioning."), +])); + +var msg322 = msg("Network:15", part396); + +var part397 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention enabled'), Field(p0,false)}" +match("MESSAGE#248:Network:22/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention enabled%{p0}"); + +var all120 = all_match({ + processors: [ + part397, + dup318, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Internet Explorer Browser Intrusion Prevention enabled"), + ]), +}); + +var msg323 = msg("Network:22", all120); + +var part398 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention disabled'), Field(p0,false)}" +match("MESSAGE#249:Network:23/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention disabled%{p0}"); + +var all121 = all_match({ + processors: [ + part398, + dup334, + ], + on_success: processor_chain([ + dup92, + dup94, + dup13, + dup14, + dup15, + setc("event_description","Internet Explorer Browser Intrusion Prevention disabled"), + ]), +}); + +var msg324 = msg("Network:23", all121); + +var select68 = linear_select([ + msg322, + msg323, + msg324, +]); + +var part399 = // "Pattern{Constant('Generic Exploit Mitigation '), Field(p0,false)}" +match("MESSAGE#255:Network:29/0", "nwparser.payload", "Generic Exploit Mitigation %{p0}"); + +var part400 = // "Pattern{Constant('enabled'), Field(p0,false)}" +match("MESSAGE#255:Network:29/1_0", "nwparser.p0", "enabled%{p0}"); + +var part401 = // "Pattern{Constant('disabled'), Field(p0,false)}" +match("MESSAGE#255:Network:29/1_1", "nwparser.p0", "disabled%{p0}"); + +var part402 = // "Pattern{Constant('is malfunctioning'), Field(p0,false)}" +match("MESSAGE#255:Network:29/1_2", "nwparser.p0", "is malfunctioning%{p0}"); + +var select69 = linear_select([ + part400, + part401, + part402, +]); + +var part403 = // "Pattern{Constant(',Event time: '), Field(event_time_string,false)}" +match("MESSAGE#255:Network:29/2", "nwparser.p0", ",Event time: %{event_time_string}"); + +var all122 = all_match({ + processors: [ + part399, + select69, + part403, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup217, + ]), +}); + +var msg325 = msg("Network:29", all122); + +var part404 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Generic Exploit Mitigation Syste,Already running process (PID:'), Field(process_id,false), Constant(') ''), Field(process,false), Constant('' is affected by a change to the application rules.,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#256:Network:31", "nwparser.payload", "Category: %{fld22},Generic Exploit Mitigation Syste,Already running process (PID:%{process_id}) '%{process}' is affected by a change to the application rules.,Event time: %{event_time_string}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup217, +])); + +var msg326 = msg("Network:31", part404); + +var select70 = linear_select([ + msg325, + msg326, +]); + +var part405 = // "Pattern{Field(event_description,false), Constant(',Event time: '), Field(event_time_string,false)}" +match("MESSAGE#258:Network:32", "nwparser.payload", "%{event_description},Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, +])); + +var msg327 = msg("Network:32", part405); + +var part406 = // "Pattern{Constant('New virus definition file loaded. Version: '), Field(p0,false)}" +match("MESSAGE#259:New/0", "nwparser.payload", "New virus definition file loaded. Version: %{p0}"); + +var part407 = // "Pattern{Field(version,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#259:New/1_0", "nwparser.p0", "%{version},Event time:%{fld17->} %{fld18}"); + +var part408 = // "Pattern{Field(version,false)}" +match_copy("MESSAGE#259:New/1_1", "nwparser.p0", "version"); + +var select71 = linear_select([ + part407, + part408, +]); + +var all123 = all_match({ + processors: [ + part406, + select71, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup44, + dup45, + dup30, + dup22, + dup14, + dup15, + dup93, + setc("event_description","New virus definition file loaded."), + ]), +}); + +var msg328 = msg("New", all123); + +var part409 = // "Pattern{Constant('New Value ''), Field(change_attribute,false), Constant('' = ''), Field(change_new,false), Constant('''), Field(p0,false)}" +match("MESSAGE#260:New:01/0", "nwparser.payload", "New Value '%{change_attribute}' = '%{change_new}'%{p0}"); + +var all124 = all_match({ + processors: [ + part409, + dup318, + ], + on_success: processor_chain([ + dup95, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup137, + dup15, + dup93, + setc("event_description","New value"), + ]), +}); + +var msg329 = msg("New:01", all124); + +var part410 = // "Pattern{Constant('New AgentGUID = '), Field(fld22,false)}" +match("MESSAGE#261:New:02", "nwparser.payload", "New AgentGUID = %{fld22}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup137, + dup15, + setc("event_description","New AgentGUID"), +])); + +var msg330 = msg("New:02", part410); + +var part411 = // "Pattern{Constant('New policy has been imported.'), Field(,false)}" +match("MESSAGE#262:New:03", "nwparser.payload", "New policy has been imported.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup137, + dup15, + setc("event_description","New policy has been imported."), +])); + +var msg331 = msg("New:03", part411); + +var part412 = // "Pattern{Constant('New content update failed to download from the management server. Remote file path: '), Field(p0,false)}" +match("MESSAGE#263:New:04/0", "nwparser.payload", "New content update failed to download from the management server. Remote file path: %{p0}"); + +var part413 = // "Pattern{Field(url,false), Constant(',Event time: '), Field(event_time_string,false)}" +match("MESSAGE#263:New:04/1_0", "nwparser.p0", "%{url},Event time: %{event_time_string}"); + +var select72 = linear_select([ + part413, + dup64, +]); + +var all125 = all_match({ + processors: [ + part412, + select72, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup137, + dup15, + setc("event_description","New content update failed to download from the management server"), + ]), +}); + +var msg332 = msg("New:04", all125); + +var part414 = // "Pattern{Constant('New content update failed to download from Group Update Provider. Remote file path: '), Field(url,false)}" +match("MESSAGE#264:New:05", "nwparser.payload", "New content update failed to download from Group Update Provider. Remote file path: %{url}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup137, + dup15, + setc("event_description","New content update failed to download from Group Update Provider"), +])); + +var msg333 = msg("New:05", part414); + +var select73 = linear_select([ + msg328, + msg329, + msg330, + msg331, + msg332, + msg333, +]); + +var part415 = // "Pattern{Constant('No '), Field(virusname,true), Constant(' virus found events got swept.')}" +match("MESSAGE#265:No", "nwparser.payload", "No %{virusname->} virus found events got swept.", processor_chain([ + dup43, + dup12, + dup13, + dup152, + dup14, + dup15, + setc("event_description","No virus found events got swept."), +])); + +var msg334 = msg("No", part415); + +var part416 = // "Pattern{Constant('No clients got swept.'), Field(,false)}" +match("MESSAGE#266:No:01", "nwparser.payload", "No clients got swept.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","No clients got swept."), +])); + +var msg335 = msg("No:01", part416); + +var part417 = // "Pattern{Constant('No objects got swept.'), Field(,false)}" +match("MESSAGE#267:No:02", "nwparser.payload", "No objects got swept.%{}", processor_chain([ + dup43, + dup15, + dup218, +])); + +var msg336 = msg("No:02", part417); + +var part418 = // "Pattern{Constant('No clients got swept [Domain: '), Field(sdomain,false), Constant('].')}" +match("MESSAGE#268:No:06", "nwparser.payload", "No clients got swept [Domain: %{sdomain}].", processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup218, +])); + +var msg337 = msg("No:06", part418); + +var part419 = // "Pattern{Constant('No old risk events got swept.'), Field(,false)}" +match("MESSAGE#269:No:03", "nwparser.payload", "No old risk events got swept.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","No old risk events got swept."), +])); + +var msg338 = msg("No:03", part419); + +var part420 = // "Pattern{Constant('No physical files got swept.'), Field(,false)}" +match("MESSAGE#270:No:04", "nwparser.payload", "No physical files got swept.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","No physical files got swept."), +])); + +var msg339 = msg("No:04", part420); + +var part421 = // "Pattern{Constant('No risk events from deleted clients got swept.'), Field(,false)}" +match("MESSAGE#271:No:05", "nwparser.payload", "No risk events from deleted clients got swept.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","No risk events from deleted clients got swept."), +])); + +var msg340 = msg("No:05", part421); + +var part422 = // "Pattern{Constant('No updates found for '), Field(application,false), Constant('.')}" +match("MESSAGE#272:No:07", "nwparser.payload", "No updates found for %{application}.", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","No updates found."), +])); + +var msg341 = msg("No:07", part422); + +var select74 = linear_select([ + msg334, + msg335, + msg336, + msg337, + msg338, + msg339, + msg340, + msg341, +]); + +var part423 = // "Pattern{Constant('Organization Unit or Container importing finished successfully'), Field(,false)}" +match("MESSAGE#273:Organization:03", "nwparser.payload", "Organization Unit or Container importing finished successfully%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Organization Unit or Container importing finished successfully"), +])); + +var msg342 = msg("Organization:03", part423); + +var part424 = // "Pattern{Constant('Organization Unit or Container importing started'), Field(,false)}" +match("MESSAGE#274:Organization:02", "nwparser.payload", "Organization Unit or Container importing started%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Organization Unit or Container importing started."), +])); + +var msg343 = msg("Organization:02", part424); + +var part425 = // "Pattern{Constant('Organization importing finished successfully'), Field(,false)}" +match("MESSAGE#275:Organization:01", "nwparser.payload", "Organization importing finished successfully%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup219, +])); + +var msg344 = msg("Organization:01", part425); + +var part426 = // "Pattern{Constant('Organization importing started'), Field(,false)}" +match("MESSAGE#276:Organization", "nwparser.payload", "Organization importing started%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup220, +])); + +var msg345 = msg("Organization", part426); + +var select75 = linear_select([ + msg342, + msg343, + msg344, + msg345, +]); + +var part427 = // "Pattern{Constant('Number of '), Field(virusname,true), Constant(' virus found events swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#277:Number:01", "nwparser.payload", "Number of %{virusname->} virus found events swept: %{dclass_counter1}", processor_chain([ + dup43, + dup152, + dup15, + setc("event_description","Number of virus found events swept."), + setc("dclass_counter1_string","Virus found events swept count."), +])); + +var msg346 = msg("Number:01", part427); + +var part428 = // "Pattern{Constant('Number of virus definition records swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#278:Number", "nwparser.payload", "Number of virus definition records swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Number of virus definition records swept."), + setc("dclass_counter1_string","Virus definition records swept."), +])); + +var msg347 = msg("Number", part428); + +var part429 = // "Pattern{Constant('Number of scan events swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#279:Number:02", "nwparser.payload", "Number of scan events swept: %{dclass_counter1}", processor_chain([ + dup43, + dup15, + setc("event_description","Number of scan events swept."), + setc("dclass_counter1_string","scan events swept"), +])); + +var msg348 = msg("Number:02", part429); + +var part430 = // "Pattern{Constant('Number of clients swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#280:Number:04", "nwparser.payload", "Number of clients swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of clients swept."), + setc("dclass_counter1_string","clients swept"), +])); + +var msg349 = msg("Number:04", part430); + +var part431 = // "Pattern{Constant('Number of old risk events swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#281:Number:05", "nwparser.payload", "Number of old risk events swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of old risk events swept."), + setc("dclass_counter1_string","old risk events swept"), +])); + +var msg350 = msg("Number:05", part431); + +var part432 = // "Pattern{Constant('Number of unacknowledged notifications swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#282:Number:06", "nwparser.payload", "Number of unacknowledged notifications swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of unacknowledged notification swept."), + setc("dclass_counter1_string","unacknowledged notifications swept"), +])); + +var msg351 = msg("Number:06", part432); + +var part433 = // "Pattern{Constant('Number of objects swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#283:Number:07", "nwparser.payload", "Number of objects swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of objects swept."), + setc("dclass_counter1_string","Number of objects swept"), +])); + +var msg352 = msg("Number:07", part433); + +var part434 = // "Pattern{Constant('Number of risk events from deleted clients swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#284:Number:08", "nwparser.payload", "Number of risk events from deleted clients swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of risk events swept."), + setc("dclass_counter1_string","Deleted clients swept"), +])); + +var msg353 = msg("Number:08", part434); + +var part435 = // "Pattern{Constant('Number of old risk events compressed: '), Field(dclass_counter1,false)}" +match("MESSAGE#285:Number:09", "nwparser.payload", "Number of old risk events compressed: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of old risk events compressed."), + setc("dclass_counter1_string","old risk events compressed"), +])); + +var msg354 = msg("Number:09", part435); + +var part436 = // "Pattern{Constant('Number of compressed risk events swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#286:Number:10", "nwparser.payload", "Number of compressed risk events swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Number of compressed risk events swept."), + setc("dclass_counter1_string","compressed risk events swept"), +])); + +var msg355 = msg("Number:10", part436); + +var part437 = // "Pattern{Constant('Number of '), Field(info,true), Constant(' in the policy: '), Field(p0,false)}" +match("MESSAGE#287:Number:11/0", "nwparser.payload", "Number of %{info->} in the policy: %{p0}"); + +var part438 = // "Pattern{Field(dclass_counter1,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#287:Number:11/1_0", "nwparser.p0", "%{dclass_counter1},Event time:%{fld17->} %{fld18}"); + +var part439 = // "Pattern{Field(dclass_counter1,false)}" +match_copy("MESSAGE#287:Number:11/1_1", "nwparser.p0", "dclass_counter1"); + +var select76 = linear_select([ + part438, + part439, +]); + +var all126 = all_match({ + processors: [ + part437, + select76, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup221, + setc("dclass_counter1_string","Group Update Providers"), + dup93, + ]), +}); + +var msg356 = msg("Number:11", all126); + +var part440 = // "Pattern{Constant('Number of physical files swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#288:Number:12", "nwparser.payload", "Number of physical files swept: %{dclass_counter1}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup221, + setc("dclass_counter1_string","Number of physical files swept"), +])); + +var msg357 = msg("Number:12", part440); + +var part441 = // "Pattern{Constant('Number of '), Field(fld1,true), Constant(' swept: '), Field(dclass_counter1,false)}" +match("MESSAGE#289:Number:13", "nwparser.payload", "Number of %{fld1->} swept: %{dclass_counter1}", processor_chain([ + dup43, + dup15, + dup12, + dup222, + setc("a","Number of "), + call({ + dest: "nwparser.event_description", + fn: STRCAT, + args: [ + constant("a"), + field("fld1"), + constant("\t"), + field("swept."), + ], + }), + call({ + dest: "nwparser.dclass_counter1_string", + fn: STRCAT, + args: [ + field("fld1"), + constant("\t"), + field("swept"), + ], + }), +])); + +var msg358 = msg("Number:13", part441); + +var select77 = linear_select([ + msg346, + msg347, + msg348, + msg349, + msg350, + msg351, + msg352, + msg353, + msg354, + msg355, + msg356, + msg357, + msg358, +]); + +var part442 = // "Pattern{Constant('Policy has been added,'), Field(info,false)}" +match("MESSAGE#292:Policy:added", "nwparser.payload", "Policy has been added,%{info}", processor_chain([ + dup95, + dup12, + dup13, + dup96, + dup223, + dup22, + dup14, + dup15, + dup23, + dup224, +])); + +var msg359 = msg("Policy:added", part442); + +var part443 = // "Pattern{Constant('Policy has been added:'), Field(info,false)}" +match("MESSAGE#293:Policy:added_01", "nwparser.payload", "Policy has been added:%{info}", processor_chain([ + dup95, + dup12, + dup13, + dup96, + dup223, + dup22, + dup14, + dup15, + dup23, + dup224, +])); + +var msg360 = msg("Policy:added_01", part443); + +var part444 = // "Pattern{Constant('Policy has been edited,'), Field(info,false)}" +match("MESSAGE#294:Policy:edited", "nwparser.payload", "Policy has been edited,%{info}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup223, + dup22, + dup14, + dup15, + dup23, + dup225, +])); + +var msg361 = msg("Policy:edited", part444); + +var part445 = // "Pattern{Constant('Policy has been edited:'), Field(info,false), Constant(','), Field(fld1,false)}" +match("MESSAGE#295:Policy:edited_01", "nwparser.payload", "Policy has been edited:%{info},%{fld1}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup223, + dup22, + dup14, + dup15, + dup23, + dup225, +])); + +var msg362 = msg("Policy:edited_01", part445); + +var part446 = // "Pattern{Constant('Policy has been deleted'), Field(p0,false)}" +match("MESSAGE#296:Policy:deleted/0", "nwparser.payload", "Policy has been deleted%{p0}"); + +var select78 = linear_select([ + dup226, + dup71, +]); + +var all127 = all_match({ + processors: [ + part446, + select78, + dup212, + ], + on_success: processor_chain([ + dup156, + dup12, + dup13, + dup27, + dup223, + dup22, + dup14, + dup15, + dup23, + setc("event_description","Policy has been deleted"), + ]), +}); + +var msg363 = msg("Policy:deleted", all127); + +var select79 = linear_select([ + msg359, + msg360, + msg361, + msg362, + msg363, +]); + +var part447 = // "Pattern{Constant('Potential risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld53,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld100,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false), Constant(',Location:'), Field(fld55,false)}" +match("MESSAGE#297:Potential:03", "nwparser.payload", "Potential risk found,IP Address: %{saddr},Computer name: %{shost},Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld53},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld100},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{vendor_event_cat},Location:%{fld55}", processor_chain([ + dup110, + dup12, + dup152, + dup132, + dup93, + dup153, + dup154, + dup227, + dup15, + dup19, +])); + +var msg364 = msg("Potential:03", part447); + +var part448 = // "Pattern{Field(severity,false), Constant(',First Seen:'), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(',Detection Submissions No,Permitted application reason: '), Field(fld42,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#298:Potential:02/2", "nwparser.p0", "%{severity},First Seen:%{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); + +var part449 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#298:Potential:02/4", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all128 = all_match({ + processors: [ + dup228, + dup325, + part448, + dup327, + part449, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup132, + dup93, + dup153, + dup154, + dup227, + dup15, + dup19, + ]), +}); + +var msg365 = msg("Potential:02", all128); + +var part450 = // "Pattern{Field(fld23,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#299:Potential/2", "nwparser.p0", "%{fld23},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var all129 = all_match({ + processors: [ + dup228, + dup325, + part450, + dup326, + dup229, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup132, + dup230, + dup154, + dup15, + dup227, + dup19, + ]), +}); + +var msg366 = msg("Potential", all129); + +var part451 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#300:Potential:01/0", "nwparser.payload", "Potential risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var all130 = all_match({ + processors: [ + part451, + dup326, + dup229, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup93, + dup230, + dup154, + dup132, + dup15, + dup227, + dup19, + ]), +}); + +var msg367 = msg("Potential:01", all130); + +var select80 = linear_select([ + msg364, + msg365, + msg366, + msg367, +]); + +var part452 = // "Pattern{Constant('Previous virus definition file loaded. Version: '), Field(version,false)}" +match("MESSAGE#301:Previous", "nwparser.payload", "Previous virus definition file loaded. Version: %{version}", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Previous virus definition file loaded."), +])); + +var msg368 = msg("Previous", part452); + +var part453 = // "Pattern{Constant('Proactive Threat Scan '), Field(info,true), Constant(' failed to update.')}" +match("MESSAGE#302:Proactive", "nwparser.payload", "Proactive Threat Scan %{info->} failed to update.", processor_chain([ + setc("eventcategory","1703020000"), + dup12, + dup13, + dup14, + dup15, + setc("event_description","Proactive Threat Scan failed to update."), +])); + +var msg369 = msg("Proactive", part453); + +var part454 = // "Pattern{Constant('Proactive Threat Scan whitelist '), Field(info,true), Constant(' is up-to-date.')}" +match("MESSAGE#303:Proactive:01", "nwparser.payload", "Proactive Threat Scan whitelist %{info->} is up-to-date.", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Proactive Threat Scan whitelist is up-to-date."), +])); + +var msg370 = msg("Proactive:01", part454); + +var part455 = // "Pattern{Constant('Proactive Threat Protection has been enabled'), Field(p0,false)}" +match("MESSAGE#399:Symantec:38/0", "nwparser.payload", "Proactive Threat Protection has been enabled%{p0}"); + +var all131 = all_match({ + processors: [ + part455, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","Proactive Threat Protection has been enabled"), + ]), +}); + +var msg371 = msg("Symantec:38", all131); + +var part456 = // "Pattern{Constant('Proactive Threat Protection has been disabled'), Field(,false)}" +match("MESSAGE#400:Symantec:42", "nwparser.payload", "Proactive Threat Protection has been disabled%{}", processor_chain([ + dup43, + dup56, + dup12, + dup13, + dup15, + dup57, +])); + +var msg372 = msg("Symantec:42", part456); + +var select81 = linear_select([ + msg369, + msg370, + msg371, + msg372, +]); + +var part457 = // "Pattern{Constant('process '), Field(process,true), Constant(' can not lock the process status table. The process status has been locked by the server '), Field(info,true), Constant(' since '), Field(fld50,false), Constant('.')}" +match("MESSAGE#304:process", "nwparser.payload", "process %{process->} can not lock the process status table. The process status has been locked by the server %{info->} since %{fld50}.", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Cannot lock process status table since it has been locked by server."), +])); + +var msg373 = msg("process", part457); + +var part458 = // "Pattern{Constant('"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile.",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" +match("MESSAGE#305:process:01", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ + dup168, + dup12, + dup13, + dup40, + dup41, + dup42, + dup15, + dup142, + dup19, + dup35, +])); + +var msg374 = msg("process:01", part458); + +var part459 = // "Pattern{Constant('"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" +match("MESSAGE#306:process:11", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ + dup168, + dup12, + dup13, + dup41, + dup42, + dup15, + dup142, + dup19, + dup34, + dup40, +])); + +var msg375 = msg("process:11", part459); + +var part460 = // "Pattern{Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(','), Field(p0,false)}" +match("MESSAGE#308:process:03/2", "nwparser.p0", ",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{p0}"); + +var part461 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#308:process:03/4", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var all132 = all_match({ + processors: [ + dup231, + dup316, + part460, + dup317, + part461, + dup315, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup16, + dup17, + dup15, + dup19, + dup35, + dup40, + ]), +}); + +var msg376 = msg("process:03", all132); + +var all133 = all_match({ + processors: [ + dup231, + dup316, + dup78, + dup317, + dup81, + dup315, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup16, + dup17, + dup15, + dup19, + dup34, + dup40, + ]), +}); + +var msg377 = msg("process:13", all133); + +var select82 = linear_select([ + msg373, + msg374, + msg375, + msg376, + msg377, +]); + +var part462 = // "Pattern{Constant('properties of domain '), Field(p0,false)}" +match("MESSAGE#310:properties/0", "nwparser.payload", "properties of domain %{p0}"); + +var part463 = // "Pattern{Constant('"'), Field(domain,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#310:properties/1_0", "nwparser.p0", "\"%{domain}\"%{p0}"); + +var part464 = // "Pattern{Constant('''), Field(domain,false), Constant('''), Field(p0,false)}" +match("MESSAGE#310:properties/1_1", "nwparser.p0", "'%{domain}'%{p0}"); + +var select83 = linear_select([ + part463, + part464, +]); + +var part465 = // "Pattern{Field(,false), Constant('were changed')}" +match("MESSAGE#310:properties/2", "nwparser.p0", "%{}were changed"); + +var all134 = all_match({ + processors: [ + part462, + select83, + part465, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","The properties of domain were changed"), + ]), +}); + +var msg378 = msg("properties", all134); + +var part466 = // "Pattern{Constant('properties for system administrator '), Field(p0,false)}" +match("MESSAGE#311:properties:01/0", "nwparser.payload", "properties for system administrator %{p0}"); + +var part467 = // "Pattern{Constant('"'), Field(c_username,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#311:properties:01/1_0", "nwparser.p0", "\"%{c_username}\"%{p0}"); + +var part468 = // "Pattern{Constant('''), Field(c_username,false), Constant('''), Field(p0,false)}" +match("MESSAGE#311:properties:01/1_1", "nwparser.p0", "'%{c_username}'%{p0}"); + +var select84 = linear_select([ + part467, + part468, +]); + +var part469 = // "Pattern{Field(,false), Constant('have been changed')}" +match("MESSAGE#311:properties:01/2", "nwparser.p0", "%{}have been changed"); + +var all135 = all_match({ + processors: [ + part466, + select84, + part469, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","The properties of system administrator have been changed"), + ]), +}); + +var msg379 = msg("properties:01", all135); + +var select85 = linear_select([ + msg378, + msg379, +]); + +var part470 = // "Pattern{Constant('PTS has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(info,false)}" +match("MESSAGE#312:PTS", "nwparser.payload", "PTS has generated an error: code %{resultcode}: description: %{info}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","PTS has generated an error"), +])); + +var msg380 = msg("PTS", part470); + +var part471 = // "Pattern{Constant('Received a new policy with '), Field(p0,false)}" +match("MESSAGE#313:Received/0", "nwparser.payload", "Received a new policy with %{p0}"); + +var part472 = // "Pattern{Field(info,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#313:Received/1_0", "nwparser.p0", "%{info},Event time: %{fld17->} %{fld18}"); + +var select86 = linear_select([ + part472, + dup212, +]); + +var all136 = all_match({ + processors: [ + part471, + select86, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Received a new policy."), + ]), +}); + +var msg381 = msg("Received", all136); + +var part473 = // "Pattern{Constant('Received a new profile with serial number '), Field(fld23,true), Constant(' from Symantec Endpoint Protection Manager.')}" +match("MESSAGE#699:Smc:03", "nwparser.payload", "Received a new profile with serial number %{fld23->} from Symantec Endpoint Protection Manager.", processor_chain([ + dup53, + dup94, + dup13, + dup14, + dup15, + setc("event_description","Received a new profile from Symantec Endpoint Protection Manager."), +])); + +var msg382 = msg("Smc:03", part473); + +var select87 = linear_select([ + msg381, + msg382, +]); + +var part474 = // "Pattern{Constant('Reconfiguring Symantec Management Client....'), Field(,false)}" +match("MESSAGE#314:Reconfiguring", "nwparser.payload", "Reconfiguring Symantec Management Client....%{}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","Reconfiguring Symantec Management Client."), +])); + +var msg383 = msg("Reconfiguring", part474); + +var part475 = // "Pattern{Constant('Reconnected to server after server was unreacheable.'), Field(p0,false)}" +match("MESSAGE#315:Reconnected/0", "nwparser.payload", "Reconnected to server after server was unreacheable.%{p0}"); + +var all137 = all_match({ + processors: [ + part475, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Reconnected to server after server was unreachable."), + ]), +}); + +var msg384 = msg("Reconnected", all137); + +var part476 = // "Pattern{Constant('Please restart your computer to enable '), Field(info,true), Constant(' changes.'), Field(p0,false)}" +match("MESSAGE#316:restart/0", "nwparser.payload", "Please restart your computer to enable %{info->} changes.%{p0}"); + +var all138 = all_match({ + processors: [ + part476, + dup318, + ], + on_success: processor_chain([ + dup232, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Please restart your computer to enable changes."), + ]), +}); + +var msg385 = msg("restart", all138); + +var part477 = // "Pattern{Constant('Retry '), Field(info,false), Constant('"')}" +match("MESSAGE#317:Retry", "nwparser.payload", "Retry %{info}\"", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup233, +])); + +var msg386 = msg("Retry", part477); + +var part478 = // "Pattern{Constant('Retry timestamp is equal or over the next schedule time, switching to regular schedule run.'), Field(,false)}" +match("MESSAGE#318:Retry:01", "nwparser.payload", "Retry timestamp is equal or over the next schedule time, switching to regular schedule run.%{}", processor_chain([ + dup43, + dup15, + setc("action","Retry timestamp is equal or over the next schedule time, switching to regular schedule run."), +])); + +var msg387 = msg("Retry:01", part478); + +var part479 = // "Pattern{Constant('Retry timestamp is over the maximum retry window, switching to regular schedule run.'), Field(,false)}" +match("MESSAGE#319:Retry:02", "nwparser.payload", "Retry timestamp is over the maximum retry window, switching to regular schedule run.%{}", processor_chain([ + dup43, + dup233, + dup15, +])); + +var msg388 = msg("Retry:02", part479); + +var select88 = linear_select([ + msg386, + msg387, + msg388, +]); + +var part480 = // "Pattern{Constant('Successfully downloaded the '), Field(application,true), Constant(' security definitions from LiveUpdate. The security definitions are now available for deployment.')}" +match("MESSAGE#320:Successfully", "nwparser.payload", "Successfully downloaded the %{application->} security definitions from LiveUpdate. The security definitions are now available for deployment.", processor_chain([ + dup43, + setc("event_description","Successfully Downloaded."), + dup15, +])); + +var msg389 = msg("Successfully", part480); + +var part481 = // "Pattern{Constant('Successfully deleted the client install package ''), Field(info,false), Constant(''.')}" +match("MESSAGE#321:Successfully:01", "nwparser.payload", "Successfully deleted the client install package '%{info}'.", processor_chain([ + dup43, + dup234, + dup15, +])); + +var msg390 = msg("Successfully:01", part481); + +var part482 = // "Pattern{Constant('Successfully imported the Symantec Endpoint Protection version '), Field(version,true), Constant(' for '), Field(fld3,true), Constant(' package during the server upgrade. This package is now available for deployment.')}" +match("MESSAGE#322:Successfully:02", "nwparser.payload", "Successfully imported the Symantec Endpoint Protection version %{version->} for %{fld3->} package during the server upgrade. This package is now available for deployment.", processor_chain([ + dup43, + dup234, + dup15, +])); + +var msg391 = msg("Successfully:02", part482); + +var select89 = linear_select([ + msg389, + msg390, + msg391, +]); + +var part483 = // "Pattern{Constant('Risk Repair Failed..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,true), Constant(' ..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#323:Risk:01", "nwparser.payload", "Risk Repair Failed..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7->} ..Severity: %{severity}..Source: %{product}", processor_chain([ + dup110, + dup166, + dup15, + dup235, +])); + +var msg392 = msg("Risk:01", part483); + +var part484 = // "Pattern{Constant('Risk Repair Failed..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" +match("MESSAGE#324:Risk:02", "nwparser.payload", "Risk Repair Failed..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ + dup110, + dup152, + dup166, + dup15, + dup235, +])); + +var msg393 = msg("Risk:02", part484); + +var part485 = // "Pattern{Constant('Risk Repaired..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#325:Risk:03", "nwparser.payload", "Risk Repaired..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup110, + dup166, + dup15, + dup236, +])); + +var msg394 = msg("Risk:03", part485); + +var part486 = // "Pattern{Constant('Risk Repaired..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" +match("MESSAGE#326:Risk:04", "nwparser.payload", "Risk Repaired..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ + dup110, + dup152, + dup166, + dup15, + dup236, +])); + +var msg395 = msg("Risk:04", part486); + +var part487 = // "Pattern{Constant('Risk sample submitted to Symantec,Computer name: '), Field(p0,false)}" +match("MESSAGE#327:Risk:05/0", "nwparser.payload", "Risk sample submitted to Symantec,Computer name: %{p0}"); + +var part488 = // "Pattern{Field(event_type,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#327:Risk:05/2", "nwparser.p0", "%{event_type},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var part489 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld16,true), Constant(' '), Field(fld17,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#327:Risk:05/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld16->} %{fld17},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all139 = all_match({ + processors: [ + part487, + dup325, + part488, + dup326, + part489, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup132, + date_time({ + dest: "event_time", + args: ["fld16","fld17"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + dup230, + dup154, + dup15, + dup19, + setc("event_description","Risk sample submitted to Symantec."), + ]), +}); + +var msg396 = msg("Risk:05", all139); + +var select90 = linear_select([ + msg392, + msg393, + msg394, + msg395, + msg396, +]); + +var part490 = // "Pattern{Constant('Scan Start/Stop..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(fld22,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" +match("MESSAGE#328:Scan", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{filename}..%{info}..%{fld22}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ + dup43, + dup152, + dup166, + dup15, + dup237, +])); + +var msg397 = msg("Scan", part490); + +var part491 = // "Pattern{Constant('Scan Start/Stop..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(info,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false)}" +match("MESSAGE#329:Scan:01", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{info}..%{severity}..%{product}..%{fld6}..%{username}", processor_chain([ + dup43, + dup166, + dup15, + dup237, +])); + +var msg398 = msg("Scan:01", part491); + +var part492 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(',"'), Field(info,false), Constant('","'), Field(context,false), Constant('",Command: Not a command scan (),Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant('Domain: '), Field(domain,false), Constant('Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#330:Scan:02", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},\"%{info}\",\"%{context}\",Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr}Domain: %{domain}Group: %{group},Server: %{hostid}", processor_chain([ + dup43, + dup12, + dup14, + dup238, + dup41, + dup15, + dup239, + dup240, + dup241, +])); + +var msg399 = msg("Scan:02", part492); + +var part493 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld1,false), Constant(',End: '), Field(fld2,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(','), Field(fld22,false), Constant(',,Command: '), Field(fld4,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(fld5,false), Constant(',Omitted: '), Field(fld21,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',"Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#331:Scan:09", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{fld22},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},\"Group: %{group},Server: %{hostid}", processor_chain([ + dup43, + dup12, + dup14, + dup242, + dup15, + dup243, + dup244, + dup245, + dup246, +])); + +var msg400 = msg("Scan:09", part493); + +var part494 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld22,false), Constant(','), Field(info,false), Constant(',Command: Not a command scan (),Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld21,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" +match("MESSAGE#332:Scan:03/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld22},%{info},Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld21}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},%{p0}"); + +var part495 = // "Pattern{Field(hostid,false)}" +match_copy("MESSAGE#332:Scan:03/2", "nwparser.p0", "hostid"); + +var all140 = all_match({ + processors: [ + part494, + dup330, + part495, + ], + on_success: processor_chain([ + dup43, + dup12, + dup14, + dup41, + dup15, + dup243, + setc("dclass_counter1_string","Infected Count"), + setc("dclass_counter2_string","Total File Count"), + setc("dclass_counter3_string","Total Threat Count"), + ]), +}); + +var msg401 = msg("Scan:03", all140); + +var part496 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld1,false), Constant(',End: '), Field(fld2,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(',Files scanned: '), Field(dclass_counter2,false), Constant(',,Command: '), Field(fld4,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(fld5,false), Constant(',Omitted: '), Field(fld21,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#333:Scan:08", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},Files scanned: %{dclass_counter2},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}", processor_chain([ + dup43, + dup12, + dup14, + dup242, + dup15, + dup243, + dup244, + dup245, + dup246, +])); + +var msg402 = msg("Scan:08", part496); + +var part497 = // "Pattern{Constant('Scan Delayed: Risks: '), Field(dclass_counter1,true), Constant(' Scanned: '), Field(dclass_counter2,true), Constant(' Files/Folders/Drives Omitted: '), Field(p0,false)}" +match("MESSAGE#334:Scan:04/0", "nwparser.payload", "Scan Delayed: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{p0}"); + +var part498 = // "Pattern{Field(dclass_counter3,true), Constant(' Trusted Files Skipped: '), Field(fld1,false)}" +match("MESSAGE#334:Scan:04/1_0", "nwparser.p0", "%{dclass_counter3->} Trusted Files Skipped: %{fld1}"); + +var part499 = // "Pattern{Field(dclass_counter3,false)}" +match_copy("MESSAGE#334:Scan:04/1_1", "nwparser.p0", "dclass_counter3"); + +var select91 = linear_select([ + part498, + part499, +]); + +var all141 = all_match({ + processors: [ + part497, + select91, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup14, + dup15, + setc("event_description","Scan Delayed."), + dup247, + dup248, + setc("dclass_counter3_string","Omitted Count."), + ]), +}); + +var msg403 = msg("Scan:04", all141); + +var part500 = // "Pattern{Field(action,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant(': Risks: '), Field(dclass_counter1,true), Constant(' Scanned: '), Field(dclass_counter2,true), Constant(' Files/Folders/Drives Omitted: '), Field(dclass_counter3,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld4,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#335:Scan:05", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{dclass_counter3}..Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup43, + dup166, + dup15, + dup247, + dup248, + setc("dclass_counter3_string","Ommitted count."), +])); + +var msg404 = msg("Scan:05", part500); + +var part501 = // "Pattern{Field(action,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant('...Time: '), Field(fld6,true), Constant(' '), Field(fld4,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#336:Scan:06", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}...Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup43, + dup166, + dup15, +])); + +var msg405 = msg("Scan:06", part501); + +var part502 = // "Pattern{Constant('Scan started on all drives and all extensions.'), Field(,false)}" +match("MESSAGE#337:Scan:07", "nwparser.payload", "Scan started on all drives and all extensions.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Scan started on all drives and all extensions."), +])); + +var msg406 = msg("Scan:07", part502); + +var part503 = // "Pattern{Constant('Scan Suspended: '), Field(info,false)}" +match("MESSAGE#338:Scan:11", "nwparser.payload", "Scan Suspended: %{info}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Scan Suspended."), +])); + +var msg407 = msg("Scan:11", part503); + +var part504 = // "Pattern{Constant('Scan resumed on all drives and all extensions.'), Field(,false)}" +match("MESSAGE#339:Scan:10", "nwparser.payload", "Scan resumed on all drives and all extensions.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Scan resumed on all drives and all extensions."), +])); + +var msg408 = msg("Scan:10", part504); + +var part505 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(uid,false), Constant(',User2: '), Field(fld3,false), Constant(',''), Field(info,false), Constant('','), Field(p0,false)}" +match("MESSAGE#340:Scan:12/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2: %{fld3},'%{info}',%{p0}"); + +var part506 = // "Pattern{Constant('Command: Update Content and Scan Active,Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#340:Scan:12/2", "nwparser.p0", "Command: Update Content and Scan Active,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); + +var all142 = all_match({ + processors: [ + part505, + dup335, + part506, + ], + on_success: processor_chain([ + dup43, + dup94, + dup14, + dup238, + dup41, + dup15, + dup239, + dup240, + dup241, + ]), +}); + +var msg409 = msg("Scan:12", all142); + +var part507 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End:'), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(uid,false), Constant(',User2:'), Field(fld3,false), Constant(',''), Field(info,false), Constant('','), Field(p0,false)}" +match("MESSAGE#341:Scan:13/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End:%{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2:%{fld3},'%{info}',%{p0}"); + +var part508 = // "Pattern{Constant('Command: Full Scan,Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#341:Scan:13/2", "nwparser.p0", "Command: Full Scan,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); + +var all143 = all_match({ + processors: [ + part507, + dup335, + part508, + ], + on_success: processor_chain([ + dup43, + dup94, + dup14, + dup238, + dup41, + dup15, + dup239, + dup240, + dup241, + ]), +}); + +var msg410 = msg("Scan:13", all143); + +var part509 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(','), Field(p0,false)}" +match("MESSAGE#342:Scan:14/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{p0}"); + +var part510 = // "Pattern{Field(info,false), Constant('","'), Field(p0,false)}" +match("MESSAGE#342:Scan:14/2_0", "nwparser.p0", "%{info}\",\"%{p0}"); + +var part511 = // "Pattern{Field(info,false), Constant(','), Field(p0,false)}" +match("MESSAGE#342:Scan:14/2_1", "nwparser.p0", "%{info},%{p0}"); + +var select92 = linear_select([ + part510, + part511, +]); + +var part512 = // "Pattern{Field(context,false), Constant('",'), Field(p0,false)}" +match("MESSAGE#342:Scan:14/3_0", "nwparser.p0", "%{context}\",%{p0}"); + +var part513 = // "Pattern{Field(context,false), Constant(','), Field(p0,false)}" +match("MESSAGE#342:Scan:14/3_1", "nwparser.p0", "%{context},%{p0}"); + +var select93 = linear_select([ + part512, + part513, +]); + +var part514 = // "Pattern{Constant('Command: '), Field(fld10,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" +match("MESSAGE#342:Scan:14/4", "nwparser.p0", "Command: %{fld10},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); + +var all144 = all_match({ + processors: [ + part509, + dup316, + select92, + select93, + part514, + ], + on_success: processor_chain([ + dup43, + dup12, + dup14, + setf("event_description","fld10"), + dup41, + dup15, + dup239, + dup240, + dup241, + ]), +}); + +var msg411 = msg("Scan:14", all144); + +var select94 = linear_select([ + msg397, + msg398, + msg399, + msg400, + msg401, + msg402, + msg403, + msg404, + msg405, + msg406, + msg407, + msg408, + msg409, + msg410, + msg411, +]); + +var part515 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#343:Security:03/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all145 = all_match({ + processors: [ + dup250, + dup325, + part515, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup132, + dup152, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, + ]), +}); + +var msg412 = msg("Security:03", all145); + +var all146 = all_match({ + processors: [ + dup250, + dup325, + dup161, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup132, + dup152, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, + ]), +}); + +var msg413 = msg("Security:06", all146); + +var part516 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Cookie:'), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Last update time: '), Field(fld57,false), Constant(',Domain: '), Field(domain,true), Constant(' ,'), Field(p0,false)}" +match("MESSAGE#345:Security:05/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie:%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain->} ,%{p0}"); + +var part517 = // "Pattern{Constant('" '), Field(p0,false)}" +match("MESSAGE#345:Security:05/3_0", "nwparser.p0", "\" %{p0}"); + +var select95 = linear_select([ + part517, + dup194, +]); + +var part518 = // "Pattern{Constant('Group: '), Field(group,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#345:Security:05/4", "nwparser.p0", "Group: %{group->} %{p0}"); + +var part519 = // "Pattern{Constant('", '), Field(p0,false)}" +match("MESSAGE#345:Security:05/5_0", "nwparser.p0", "\", %{p0}"); + +var part520 = // "Pattern{Constant(', '), Field(p0,false)}" +match("MESSAGE#345:Security:05/5_1", "nwparser.p0", ", %{p0}"); + +var select96 = linear_select([ + part519, + part520, +]); + +var part521 = // "Pattern{Constant('Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(', File size (bytes): '), Field(p0,false)}" +match("MESSAGE#345:Security:05/6", "nwparser.p0", "Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); + +var all147 = all_match({ + processors: [ + dup251, + dup329, + part516, + select95, + part518, + select96, + part521, + dup336, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, + ]), +}); + +var msg414 = msg("Security:05", all147); + +var part522 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(',0,Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" +match("MESSAGE#346:Security:04", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}", processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, +])); + +var msg415 = msg("Security:04", part522); + +var part523 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Last update time: '), Field(fld57,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(', File size (bytes): '), Field(p0,false)}" +match("MESSAGE#347:Security:07/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); + +var all148 = all_match({ + processors: [ + dup251, + dup329, + part523, + dup336, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup132, + dup162, + dup163, + dup164, + dup154, + dup15, + dup19, + ]), +}); + +var msg416 = msg("Security:07", all148); + +var part524 = // "Pattern{Constant('Security risk found,Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#348:Security:13/0", "nwparser.payload", "Security risk found,Computer name: %{shost},%{p0}"); + +var part525 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(','), Field(p0,false)}" +match("MESSAGE#348:Security:13/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},%{p0}"); + +var select97 = linear_select([ + part525, + dup77, +]); + +var part526 = // "Pattern{Constant('IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(severity,false), Constant(',First Seen: '), Field(fld1,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,true), Constant(' ,Hash type: '), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld3,true), Constant(' ,File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld4,false), Constant(',Detection score: '), Field(fld5,false), Constant(',COH Engine Version: '), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',Permitted application reason: '), Field(fld8,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld10,false), Constant(',Web domain:'), Field(fld11,true), Constant(' ,Downloaded by: '), Field(fld12,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld15,false), Constant(',Risk Level: '), Field(fld16,false), Constant(',Risk type: '), Field(fld17,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name:'), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld18,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld19,true), Constant(' '), Field(fld20,false), Constant(',Inserted: '), Field(fld21,false), Constant(',End: '), Field(fld22,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld23,false), Constant(',Source IP: '), Field(fld24,false)}" +match("MESSAGE#348:Security:13/2", "nwparser.p0", "IP Address: %{saddr},Detection type: %{severity},First Seen: %{fld1},Application name: %{application},Application type: %{obj_type},Application version:%{version->} ,Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld3->} ,File size (bytes): %{filename_size},Sensitivity: %{fld4},Detection score: %{fld5},COH Engine Version: %{fld6},%{fld7},Permitted application reason: %{fld8},Disposition: %{result},Download site: %{fld10},Web domain:%{fld11->} ,Downloaded by: %{fld12},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld15},Risk Level: %{fld16},Risk type: %{fld17},Source: %{event_source},Risk name:%{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld18},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld19->} %{fld20},Inserted: %{fld21},End: %{fld22},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld23},Source IP: %{fld24}"); + +var all149 = all_match({ + processors: [ + part524, + select97, + part526, + ], + on_success: processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup162, + date_time({ + dest: "event_time", + args: ["fld19","fld20"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + date_time({ + dest: "recorded_time", + args: ["fld21"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + date_time({ + dest: "endtime", + args: ["fld22"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + dup15, + dup19, + ]), +}); + +var msg417 = msg("Security:13", all149); + +var part527 = // "Pattern{Constant('Security risk found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#349:Security", "nwparser.payload", "Security risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup162, + dup132, + dup163, + dup164, + dup154, + dup15, + dup19, +])); + +var msg418 = msg("Security", part527); + +var part528 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Cookie: '), Field(fld1,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" +match("MESSAGE#350:Security:01", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie: %{fld1},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup163, + dup164, + dup154, + dup15, + dup47, + dup162, +])); + +var msg419 = msg("Security:01", part528); + +var part529 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" +match("MESSAGE#351:Security:02", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ + dup110, + dup12, + dup115, + dup116, + dup38, + dup152, + dup162, + dup132, + dup163, + dup164, + dup154, + dup15, + dup19, +])); + +var msg420 = msg("Security:02", part529); + +var select98 = linear_select([ + msg412, + msg413, + msg414, + msg415, + msg416, + msg417, + msg418, + msg419, + msg420, +]); + +var part530 = // "Pattern{Constant('Compressed File,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#352:Compressed", "nwparser.payload", "Compressed File,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ + dup110, + dup12, + dup152, + dup163, + dup164, + dup132, + dup154, + dup15, + dup253, + dup19, +])); + +var msg421 = msg("Compressed", part530); + +var part531 = // "Pattern{Constant('Compressed File,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#353:Compressed:02/0", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},%{p0}"); + +var part532 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" +match("MESSAGE#353:Compressed:02/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},%{p0}"); + +var all150 = all_match({ + processors: [ + part531, + dup329, + part532, + dup330, + dup205, + dup331, + ], + on_success: processor_chain([ + dup110, + dup12, + dup152, + dup163, + dup164, + dup132, + dup154, + dup15, + dup253, + dup19, + ]), +}); + +var msg422 = msg("Compressed:02", all150); + +var part533 = // "Pattern{Constant('Compressed File,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" +match("MESSAGE#354:Compressed:01", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ + dup110, + dup12, + dup152, + dup163, + dup164, + dup132, + dup154, + dup15, + dup253, + dup19, +])); + +var msg423 = msg("Compressed:01", part533); + +var select99 = linear_select([ + msg421, + msg422, + msg423, +]); + +var part534 = // "Pattern{Constant('Stop serving as the Group Update Provider (proxy server)'), Field(,false)}" +match("MESSAGE#355:Stop", "nwparser.payload", "Stop serving as the Group Update Provider (proxy server)%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup254, +])); + +var msg424 = msg("Stop", part534); + +var part535 = // "Pattern{Constant('Stop Symantec Network Access Control client.'), Field(,false)}" +match("MESSAGE#356:Stop:01", "nwparser.payload", "Stop Symantec Network Access Control client.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup254, +])); + +var msg425 = msg("Stop:01", part535); + +var part536 = // "Pattern{Constant('Stop using Group Update Provider (proxy server) @ '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" +match("MESSAGE#357:Stop:02", "nwparser.payload", "Stop using Group Update Provider (proxy server) @ %{saddr}:%{sport}.", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Stop using Group Update Provider (proxy server)."), +])); + +var msg426 = msg("Stop:02", part536); + +var select100 = linear_select([ + msg424, + msg425, + msg426, +]); + +var part537 = // "Pattern{Constant('Stopping Symantec Management Client....'), Field(p0,false)}" +match("MESSAGE#358:Stopping/0", "nwparser.payload", "Stopping Symantec Management Client....%{p0}"); + +var all151 = all_match({ + processors: [ + part537, + dup318, + ], + on_success: processor_chain([ + dup136, + dup12, + dup13, + setc("ec_activity","Stop"), + dup97, + dup22, + dup14, + dup15, + dup93, + setc("event_description","Stopping Symantec Management Client"), + ]), +}); + +var msg427 = msg("Stopping", all151); + +var part538 = // "Pattern{Constant('Submission Control signatures '), Field(version,true), Constant(' is up-to-date.')}" +match("MESSAGE#359:Submission", "nwparser.payload", "Submission Control signatures %{version->} is up-to-date.", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Submission Control signatures is up to date"), +])); + +var msg428 = msg("Submission", part538); + +var part539 = // "Pattern{Constant('Switched to server control.'), Field(,false)}" +match("MESSAGE#360:Switched", "nwparser.payload", "Switched to server control.%{}", processor_chain([ + dup136, + dup12, + dup13, + dup30, + dup97, + dup22, + dup14, + dup15, + setc("event_description","Switched to server control."), +])); + +var msg429 = msg("Switched", part539); + +var part540 = // "Pattern{Constant('Symantec Endpoint Protection Manager Content Catalog '), Field(version,true), Constant(' is up-to-date.')}" +match("MESSAGE#361:Symantec:18", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} is up-to-date.", processor_chain([ + dup86, + dup15, + setc("event_description","Symantec Endpoint Protection Manager Content Catalog is up to date."), +])); + +var msg430 = msg("Symantec:18", part540); + +var part541 = // "Pattern{Constant('Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list '), Field(application,false), Constant('.')}" +match("MESSAGE#362:Symantec:33", "nwparser.payload", "Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list %{application}.", processor_chain([ + dup43, + dup15, + setc("event_description","Symantec Endpoint Protection Manager could not update TruScan proactive threat scan."), +])); + +var msg431 = msg("Symantec:33", part541); + +var part542 = // "Pattern{Constant('Symantec Endpoint Protection '), Field(application,true), Constant(' '), Field(version,true), Constant(' ('), Field(info,false), Constant(') is up-to-date.')}" +match("MESSAGE#363:Symantec:17", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) is up-to-date.", processor_chain([ + dup86, + dup15, + setc("event_description","Symantec Endpoint Protection is up to date."), +])); + +var msg432 = msg("Symantec:17", part542); + +var part543 = // "Pattern{Constant('Symantec Endpoint Protection '), Field(application,true), Constant(' '), Field(version,true), Constant(' ('), Field(info,false), Constant(') failed to update.')}" +match("MESSAGE#364:Symantec:20", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) failed to update.", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","Symantec Endpoint Protection failed to update."), +])); + +var msg433 = msg("Symantec:20", part543); + +var part544 = // "Pattern{Constant('Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled'), Field(p0,false)}" +match("MESSAGE#365:Symantec:16/0", "nwparser.payload", "Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled%{p0}"); + +var all152 = all_match({ + processors: [ + part544, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup93, + setc("event_description","Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled"), + ]), +}); + +var msg434 = msg("Symantec:16", all152); + +var part545 = // "Pattern{Constant('Symantec Network Access Control client started.'), Field(,false)}" +match("MESSAGE#366:Symantec:15", "nwparser.payload", "Symantec Network Access Control client started.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + setc("event_description","Symantec Network Access Control client started."), +])); + +var msg435 = msg("Symantec:15", part545); + +var part546 = // "Pattern{Constant('Symantec Endpoint Protection Tamper Protection Disabled'), Field(,false)}" +match("MESSAGE#367:Symantec:11", "nwparser.payload", "Symantec Endpoint Protection Tamper Protection Disabled%{}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Tamper Protection disabled"), +])); + +var msg436 = msg("Symantec:11", part546); + +var part547 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Description: '), Field(info,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#368:Symantec", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{info}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup43, + dup166, + dup15, + dup255, +])); + +var msg437 = msg("Symantec", part547); + +var part548 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('........'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" +match("MESSAGE#369:Symantec:01", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6}", processor_chain([ + dup43, + dup166, + dup15, + dup255, +])); + +var msg438 = msg("Symantec:01", part548); + +var part549 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" +match("MESSAGE#370:Symantec:02", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ + dup43, + dup166, + dup15, + dup255, +])); + +var msg439 = msg("Symantec:02", part549); + +var part550 = // "Pattern{Constant('Symantec Endpoint Protection Manager Content Catalog '), Field(version,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#371:Symantec:03/0", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} %{p0}"); + +var part551 = // "Pattern{Constant('is up-to-date '), Field(p0,false)}" +match("MESSAGE#371:Symantec:03/1_0", "nwparser.p0", "is up-to-date %{p0}"); + +var part552 = // "Pattern{Constant('was successfully updated '), Field(p0,false)}" +match("MESSAGE#371:Symantec:03/1_1", "nwparser.p0", "was successfully updated %{p0}"); + +var select101 = linear_select([ + part551, + part552, +]); + +var part553 = // "Pattern{Constant('.'), Field(,false)}" +match("MESSAGE#371:Symantec:03/2", "nwparser.p0", ".%{}"); + +var all153 = all_match({ + processors: [ + part550, + select101, + part553, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Symantec Endpoint Protection Manager Content Catalog is up to date or successfully updated."), + ]), +}); + +var msg440 = msg("Symantec:03", all153); + +var part554 = // "Pattern{Constant('Symantec Endpoint Protection services shutdown was successful.'), Field(p0,false)}" +match("MESSAGE#372:Symantec:04/0", "nwparser.payload", "Symantec Endpoint Protection services shutdown was successful.%{p0}"); + +var all154 = all_match({ + processors: [ + part554, + dup318, + ], + on_success: processor_chain([ + dup256, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Symantec Endpoint Protection services shutdown was successful."), + ]), +}); + +var msg441 = msg("Symantec:04", all154); + +var part555 = // "Pattern{Constant('Symantec Endpoint Protection services startup was successful.'), Field(p0,false)}" +match("MESSAGE#373:Symantec:05/0", "nwparser.payload", "Symantec Endpoint Protection services startup was successful.%{p0}"); + +var all155 = all_match({ + processors: [ + part555, + dup318, + ], + on_success: processor_chain([ + dup257, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Symantec Endpoint Protection services startup was successful."), + ]), +}); + +var msg442 = msg("Symantec:05", all155); + +var part556 = // "Pattern{Constant('Symantec Management Client is stopped.'), Field(p0,false)}" +match("MESSAGE#374:Symantec:06/0", "nwparser.payload", "Symantec Management Client is stopped.%{p0}"); + +var all156 = all_match({ + processors: [ + part556, + dup318, + ], + on_success: processor_chain([ + dup256, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Symantec Management Client is stopped."), + ]), +}); + +var msg443 = msg("Symantec:06", all156); + +var part557 = // "Pattern{Constant('Symantec Management Client has been '), Field(p0,false)}" +match("MESSAGE#375:Symantec:07/0", "nwparser.payload", "Symantec Management Client has been %{p0}"); + +var part558 = // "Pattern{Constant('started'), Field(p0,false)}" +match("MESSAGE#375:Symantec:07/1_0", "nwparser.p0", "started%{p0}"); + +var part559 = // "Pattern{Constant('activated'), Field(p0,false)}" +match("MESSAGE#375:Symantec:07/1_1", "nwparser.p0", "activated%{p0}"); + +var select102 = linear_select([ + part558, + part559, +]); + +var part560 = // "Pattern{Constant(' .'), Field(,false)}" +match("MESSAGE#375:Symantec:07/2_1", "nwparser.p0", " .%{}"); + +var select103 = linear_select([ + dup186, + part560, +]); + +var all157 = all_match({ + processors: [ + part557, + select102, + select103, + ], + on_success: processor_chain([ + dup257, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Symantec Management Client has been started or activated."), + ]), +}); + +var msg444 = msg("Symantec:07", all157); + +var part561 = // "Pattern{Constant('Symantec Management Client has been '), Field(info,false)}" +match("MESSAGE#376:Symantec:08", "nwparser.payload", "Symantec Management Client has been %{info}", processor_chain([ + dup257, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Symantec Management Client has been activated."), +])); + +var msg445 = msg("Symantec:08", part561); + +var part562 = // "Pattern{Constant('Symantec Endpoint Protection Auto-Protect failed to load.'), Field(,false)}" +match("MESSAGE#377:Symantec:09", "nwparser.payload", "Symantec Endpoint Protection Auto-Protect failed to load.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Symantec Endpoint Protection Auto-Protect failed to load."), +])); + +var msg446 = msg("Symantec:09", part562); + +var part563 = // "Pattern{Constant('Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. '), Field(p0,false)}" +match("MESSAGE#378:Symantec:10/0", "nwparser.payload", "Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. %{p0}"); + +var all158 = all_match({ + processors: [ + part563, + dup333, + ], + on_success: processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","virus definitions are missing on this computer"), + ]), +}); + +var msg447 = msg("Symantec:10", all158); + +var part564 = // "Pattern{Constant('Symantec AntiVirus services startup was successful'), Field(,false)}" +match("MESSAGE#379:Symantec:12", "nwparser.payload", "Symantec AntiVirus services startup was successful%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","services startup was successful"), +])); + +var msg448 = msg("Symantec:12", part564); + +var part565 = // "Pattern{Constant('Symantec AntiVirus services shutdown was successful'), Field(,false)}" +match("MESSAGE#380:Symantec:13", "nwparser.payload", "Symantec AntiVirus services shutdown was successful%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","services shutdown was successful"), +])); + +var msg449 = msg("Symantec:13", part565); + +var part566 = // "Pattern{Constant('Symantec AntiVirus services failed to start. '), Field(space,true), Constant(' ('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#381:Symantec:14", "nwparser.payload", "Symantec AntiVirus services failed to start. %{space->} (%{resultcode})", processor_chain([ + dup86, + dup12, + dup13, + dup14, + dup15, + dup258, +])); + +var msg450 = msg("Symantec:14", part566); + +var part567 = // "Pattern{Constant('Symantec Endpoint Protection services failed to start. '), Field(space,true), Constant(' ('), Field(resultcode,false), Constant(')')}" +match("MESSAGE#382:Symantec:19", "nwparser.payload", "Symantec Endpoint Protection services failed to start. %{space->} (%{resultcode})", processor_chain([ + dup86, + dup12, + dup13, + dup14, + dup15, + dup258, +])); + +var msg451 = msg("Symantec:19", part567); + +var part568 = // "Pattern{Constant('Symantec Endpoint Protection Manager server started with trial license.'), Field(,false)}" +match("MESSAGE#383:Symantec:21", "nwparser.payload", "Symantec Endpoint Protection Manager server started with trial license.%{}", processor_chain([ + dup43, + dup15, + setc("event_description","Symantec Endpoint Protection Manager server started with trial license."), +])); + +var msg452 = msg("Symantec:21", part568); + +var part569 = // "Pattern{Constant('Symantec trial license has expired.'), Field(,false)}" +match("MESSAGE#384:Symantec:22", "nwparser.payload", "Symantec trial license has expired.%{}", processor_chain([ + dup259, + dup15, + setc("event_description","Symantec trial license has expired."), +])); + +var msg453 = msg("Symantec:22", part569); + +var part570 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,"Reputation check timed out during unproven file evaluation, likely due to network delays."')}" +match("MESSAGE#385:Symantec:23", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,\"Reputation check timed out during unproven file evaluation, likely due to network delays.\"", processor_chain([ + dup259, + dup12, + dup13, + dup15, + setc("event_description","Reputation check timed out"), +])); + +var msg454 = msg("Symantec:23", part570); + +var part571 = // "Pattern{Constant('Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled'), Field(,false)}" +match("MESSAGE#386:Symantec:24", "nwparser.payload", "Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled"), +])); + +var msg455 = msg("Symantec:24", part571); + +var part572 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,[Antivirus advanced heuristic detection submission] Submitting file to Symantec failed. File : ''), Field(filename,false), Constant(''.')}" +match("MESSAGE#387:Symantec:25", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,[Antivirus advanced heuristic detection submission] Submitting file to Symantec failed. File : '%{filename}'.", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Submitting file to Symantec failed"), +])); + +var msg456 = msg("Symantec:25", part572); + +var select104 = linear_select([ + dup261, + dup262, +]); + +var part573 = // "Pattern{Field(,false), Constant('advanced heuristic detection submission] Submitting information to Symantec about file failed. File : ''), Field(filename,false), Constant(''.'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/2", "nwparser.p0", "%{}advanced heuristic detection submission] Submitting information to Symantec about file failed. File : '%{filename}'.%{p0}"); + +var part574 = // "Pattern{Constant(' Network error : ''), Field(fld56,false), Constant(''.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#388:Symantec:26/3_0", "nwparser.p0", " Network error : '%{fld56}'.,Event time: %{fld17->} %{fld18}"); + +var select105 = linear_select([ + part574, + dup176, + dup91, +]); + +var all159 = all_match({ + processors: [ + dup260, + select104, + part573, + select105, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","Submitting information to Symantec about file failed"), + ]), +}); + +var msg457 = msg("Symantec:26", all159); + +var part575 = // "Pattern{Field(,false), Constant('submission] Information submitted to Symantec about file. File : ''), Field(filename,false), Constant('','), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/4", "nwparser.p0", "%{}submission] Information submitted to Symantec about file. File : '%{filename}',%{p0}"); + +var all160 = all_match({ + processors: [ + dup260, + dup337, + dup263, + dup338, + part575, + dup339, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","Information submitted to Symantec about file."), + ]), +}); + +var msg458 = msg("Symantec:39", all160); + +var part576 = // "Pattern{Field(,false), Constant('submission] File submitted to Symantec for analysis. File : ''), Field(filename,false), Constant('','), Field(p0,false)}" +match("MESSAGE#390:Symantec:40/4", "nwparser.p0", "%{}submission] File submitted to Symantec for analysis. File : '%{filename}',%{p0}"); + +var all161 = all_match({ + processors: [ + dup260, + dup337, + dup263, + dup338, + part576, + dup339, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","File submitted to Symantec for analysis."), + ]), +}); + +var msg459 = msg("Symantec:40", all161); + +var part577 = // "Pattern{Constant('Symantec Endpoint Protection Manager server started with paid license.'), Field(,false)}" +match("MESSAGE#391:Symantec:27", "nwparser.payload", "Symantec Endpoint Protection Manager server started with paid license.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Symantec Endpoint Protection Manager server started with paid license."), +])); + +var msg460 = msg("Symantec:27", part577); + +var part578 = // "Pattern{Constant('Uninstalling Symantec Management Client....'), Field(,false)}" +match("MESSAGE#392:Symantec:28", "nwparser.payload", "Uninstalling Symantec Management Client....%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Uninstalling Symantec Management Client"), +])); + +var msg461 = msg("Symantec:28", part578); + +var part579 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SONAR has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(result,false)}" +match("MESSAGE#393:Symantec:29", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has generated an error: code %{resultcode}: description: %{result}", processor_chain([ + dup43, + dup12, + dup13, + dup187, + dup15, + setc("event_description","SONAR has generated an error"), +])); + +var msg462 = msg("Symantec:29", part579); + +var part580 = // "Pattern{Constant('Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager. '), Field(result,false), Constant('.')}" +match("MESSAGE#394:Symantec:30", "nwparser.payload", "Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager. %{result}.", processor_chain([ + dup43, + dup12, + dup13, + dup268, + dup187, + dup15, + setc("event_description","Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager."), +])); + +var msg463 = msg("Symantec:30", part580); + +var part581 = // "Pattern{Constant('The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager.'), Field(,false)}" +match("MESSAGE#395:Symantec:31", "nwparser.payload", "The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup268, + dup187, + dup15, + setc("event_description","The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager."), +])); + +var msg464 = msg("Symantec:31", part581); + +var part582 = // "Pattern{Constant('The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.'), Field(,false)}" +match("MESSAGE#396:Symantec:32", "nwparser.payload", "The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager."), +])); + +var msg465 = msg("Symantec:32", part582); + +var part583 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SymELAM Protection has been enabled'), Field(p0,false)}" +match("MESSAGE#397:Symantec:36/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SymELAM Protection has been enabled%{p0}"); + +var all162 = all_match({ + processors: [ + part583, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","SymELAM Protection has been enabled"), + ]), +}); + +var msg466 = msg("Symantec:36", all162); + +var part584 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SONAR has been enabled'), Field(p0,false)}" +match("MESSAGE#398:Symantec:37/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has been enabled%{p0}"); + +var all163 = all_match({ + processors: [ + part584, + dup318, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, + setc("event_description","SONAR has been enabled"), + ]), +}); + +var msg467 = msg("Symantec:37", all163); + +var part585 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,SONAR has been disabled')}" +match("MESSAGE#401:Symantec:41", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,SONAR has been disabled", processor_chain([ + dup43, + dup56, + dup12, + dup13, + dup15, + setc("event_description","SONAR has been disabled"), +])); + +var msg468 = msg("Symantec:41", part585); + +var part586 = // "Pattern{Constant('Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled,Event time: '), Field(event_time_string,false)}" +match("MESSAGE#403:Symantec:44", "nwparser.payload", "Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled,Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled"), +])); + +var msg469 = msg("Symantec:44", part586); + +var part587 = // "Pattern{Constant('Symantec Network Access Control is overdeployed'), Field(,false)}" +match("MESSAGE#511:Server:02", "nwparser.payload", "Symantec Network Access Control is overdeployed%{}", processor_chain([ + dup86, + dup12, + dup222, + dup14, + dup15, +])); + +var msg470 = msg("Server:02", part587); + +var part588 = // "Pattern{Constant('Symantec Endpoint Protection is overdeployed'), Field(,false)}" +match("MESSAGE#513:Server:04", "nwparser.payload", "Symantec Endpoint Protection is overdeployed%{}", processor_chain([ + dup86, + dup12, + dup222, + setc("event_description","Symantec Endpoint Protection is overdeployed"), + dup40, + dup15, +])); + +var msg471 = msg("Server:04", part588); + +var part589 = // "Pattern{Constant('Symantec Endpoint Protection Manager could not update '), Field(application,false), Constant('.')}" +match("MESSAGE#688:Symantec:34", "nwparser.payload", "Symantec Endpoint Protection Manager could not update %{application}.", processor_chain([ + dup43, + dup14, + dup15, + setc("event_description","Symantec Endpoint Protection Manager could not update."), +])); + +var msg472 = msg("Symantec:34", part589); + +var part590 = // "Pattern{Field(event_description,false), Constant('. File : '), Field(filename,false), Constant(', Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#689:Symantec:35/0_0", "nwparser.payload", "%{event_description}. File : %{filename}, Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); + +var part591 = // "Pattern{Field(event_description,false), Constant('. File : '), Field(filename,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#689:Symantec:35/0_1", "nwparser.payload", "%{event_description}. File : %{filename},Event time:%{fld17->} %{fld18}"); + +var part592 = // "Pattern{Field(event_description,false), Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#689:Symantec:35/0_2", "nwparser.payload", "%{event_description}.,Event time:%{fld17->} %{fld18}"); + +var part593 = // "Pattern{Field(event_description,false), Constant('Operating System: '), Field(os,false), Constant('Network info:'), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#689:Symantec:35/0_3", "nwparser.payload", "%{event_description}Operating System: %{os}Network info:%{info},Event time:%{fld17->} %{fld18}"); + +var part594 = // "Pattern{Field(event_description,false), Constant('.')}" +match("MESSAGE#689:Symantec:35/0_4", "nwparser.payload", "%{event_description}."); + +var select106 = linear_select([ + part590, + part591, + part592, + part593, + part594, +]); + +var all164 = all_match({ + processors: [ + select106, + ], + on_success: processor_chain([ + dup43, + dup94, + dup13, + dup14, + dup15, + dup93, + ]), +}); + +var msg473 = msg("Symantec:35", all164); + +var part595 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,'), Field(event_description,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#690:Symantec:45", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,%{event_description},Event time:%{fld17->} %{fld18}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + dup93, +])); + +var msg474 = msg("Symantec:45", part595); + +var part596 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#691:Server:05", "nwparser.payload", "event_description", processor_chain([ + dup53, + dup12, + dup222, + dup40, + dup15, +])); + +var msg475 = msg("Server:05", part596); + +var select107 = linear_select([ + msg430, + msg431, + msg432, + msg433, + msg434, + msg435, + msg436, + msg437, + msg438, + msg439, + msg440, + msg441, + msg442, + msg443, + msg444, + msg445, + msg446, + msg447, + msg448, + msg449, + msg450, + msg451, + msg452, + msg453, + msg454, + msg455, + msg456, + msg457, + msg458, + msg459, + msg460, + msg461, + msg462, + msg463, + msg464, + msg465, + msg466, + msg467, + msg468, + msg469, + msg470, + msg471, + msg472, + msg473, + msg474, + msg475, +]); + +var part597 = // "Pattern{Constant('Suspicious Behavior Detection has been '), Field(fld2,false), Constant(',Event time: '), Field(event_time_string,false)}" +match("MESSAGE#402:Symantec:43", "nwparser.payload", "Suspicious Behavior Detection has been %{fld2},Event time: %{event_time_string}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("a","Suspicious Behavior Detection has been "), + call({ + dest: "nwparser.event_description", + fn: STRCAT, + args: [ + constant("a"), + field("fld2"), + ], + }), +])); + +var msg476 = msg("Symantec:43", part597); + +var part598 = // "Pattern{Constant('System has been restarted '), Field(info,false), Constant('.')}" +match("MESSAGE#404:System", "nwparser.payload", "System has been restarted %{info}.", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","System has been restarted"), +])); + +var msg477 = msg("System", part598); + +var part599 = // "Pattern{Constant('System client-server activity logs have been swept.'), Field(,false)}" +match("MESSAGE#405:System:01", "nwparser.payload", "System client-server activity logs have been swept.%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","System client-server activity logs have been swept."), +])); + +var msg478 = msg("System:01", part599); + +var part600 = // "Pattern{Constant('System server activity logs have been swept.'), Field(,false)}" +match("MESSAGE#406:System:02", "nwparser.payload", "System server activity logs have been swept.%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","System server activity logs have been swept."), +])); + +var msg479 = msg("System:02", part600); + +var part601 = // "Pattern{Constant('System administrative logs have been swept.'), Field(,false)}" +match("MESSAGE#407:System:03", "nwparser.payload", "System administrative logs have been swept.%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","System administrative logs have been swept."), +])); + +var msg480 = msg("System:03", part601); + +var part602 = // "Pattern{Constant('System enforcer activity logs have been swept.'), Field(,false)}" +match("MESSAGE#408:System:04", "nwparser.payload", "System enforcer activity logs have been swept.%{}", processor_chain([ + dup53, + dup14, + dup15, + setc("event_description","System enforcer activity logs have been swept."), +])); + +var msg481 = msg("System:04", part602); + +var part603 = // "Pattern{Constant('System administrator "'), Field(username,false), Constant('" was added')}" +match("MESSAGE#409:System:05", "nwparser.payload", "System administrator \"%{username}\" was added", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, +])); + +var msg482 = msg("System:05", part603); + +var select108 = linear_select([ + msg477, + msg478, + msg479, + msg480, + msg481, + msg482, +]); + +var part604 = // "Pattern{Constant('- Caller MD5='), Field(fld6,false), Constant(','), Field(p0,false)}" +match("MESSAGE#410:Terminated/0_0", "nwparser.payload", "- Caller MD5=%{fld6},%{p0}"); + +var select109 = linear_select([ + part604, + dup269, +]); + +var part605 = // "Pattern{Field(action,false), Constant(',Begin:'), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End:'), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule:'), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User:'), Field(username,false), Constant(',Domain:'), Field(domain,false), Constant(',Action Type:'), Field(fld45,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" +match("MESSAGE#410:Terminated/1", "nwparser.p0", "%{action},Begin:%{fld50->} %{fld52},End:%{fld51->} %{fld53},Rule:%{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User:%{username},Domain:%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); + +var all165 = all_match({ + processors: [ + select109, + part605, + ], + on_success: processor_chain([ + dup36, + dup12, + dup13, + dup129, + dup37, + dup14, + dup41, + dup42, + dup15, + setc("event_state","Terminated"), + ]), +}); + +var msg483 = msg("Terminated", all165); + +var part606 = // "Pattern{Constant('Compliance '), Field(p0,false)}" +match("MESSAGE#411:Compliance/0", "nwparser.payload", "Compliance %{p0}"); + +var part607 = // "Pattern{Constant('server '), Field(p0,false)}" +match("MESSAGE#411:Compliance/1_0", "nwparser.p0", "server %{p0}"); + +var part608 = // "Pattern{Constant('client '), Field(p0,false)}" +match("MESSAGE#411:Compliance/1_1", "nwparser.p0", "client %{p0}"); + +var part609 = // "Pattern{Constant('traffic '), Field(p0,false)}" +match("MESSAGE#411:Compliance/1_2", "nwparser.p0", "traffic %{p0}"); + +var part610 = // "Pattern{Constant('criteria '), Field(p0,false)}" +match("MESSAGE#411:Compliance/1_3", "nwparser.p0", "criteria %{p0}"); + +var select110 = linear_select([ + part607, + part608, + part609, + part610, +]); + +var part611 = // "Pattern{Constant('logs have been swept.'), Field(,false)}" +match("MESSAGE#411:Compliance/2", "nwparser.p0", "logs have been swept.%{}"); + +var all166 = all_match({ + processors: [ + part606, + select110, + part611, + ], + on_success: processor_chain([ + dup53, + dup14, + dup15, + setc("event_description","Compliance logs have been swept."), + ]), +}); + +var msg484 = msg("Compliance", all166); + +var part612 = // "Pattern{Constant('Download started.'), Field(,false)}" +match("MESSAGE#412:Download", "nwparser.payload", "Download started.%{}", processor_chain([ + dup43, + dup14, + dup15, + setc("event_description","Download started."), +])); + +var msg485 = msg("Download", part612); + +var part613 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld14,true), Constant(' to '), Field(fld15,false), Constant('.,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Inbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld10,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#413:Traffic", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup270, + dup19, + dup34, +])); + +var msg486 = msg("Traffic", part613); + +var part614 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld14,true), Constant(' to '), Field(fld15,false), Constant('.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Outbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld10,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#414:Traffic:11", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup270, + dup19, + dup35, +])); + +var msg487 = msg("Traffic:11", part614); + +var part615 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',1,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#415:Traffic:01", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},1,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup270, + dup19, +])); + +var msg488 = msg("Traffic:01", part615); + +var part616 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#416:Traffic:02/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{daddr},Local: %{fld3},Remote: %{fld4},Remote: %{saddr},Remote: %{fld5},Inbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var all167 = all_match({ + processors: [ + part616, + dup319, + dup271, + ], + on_success: processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup270, + dup19, + dup34, + ]), +}); + +var msg489 = msg("Traffic:02", all167); + +var part617 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Outbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#417:Traffic:12/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Outbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var all168 = all_match({ + processors: [ + part617, + dup319, + dup271, + ], + on_success: processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup270, + dup19, + dup35, + ]), +}); + +var msg490 = msg("Traffic:12", all168); + +var part618 = // "Pattern{Field(fld1,true), Constant(' Traffic Redirection disabled.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#717:Traffic:13", "nwparser.payload", "%{fld1->} Traffic Redirection disabled.,Event time: %{fld17->} %{fld18}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","Traffic Redirection disabled."), + dup93, +])); + +var msg491 = msg("Traffic:13", part618); + +var part619 = // "Pattern{Field(fld1,true), Constant(' Traffic Redirection is malfunctioning.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#718:Traffic:14", "nwparser.payload", "%{fld1->} Traffic Redirection is malfunctioning.,Event time: %{fld17->} %{fld18}", processor_chain([ + dup86, + dup12, + dup13, + dup15, + setc("event_description","Traffic Redirection is malfunctioning."), + dup93, +])); + +var msg492 = msg("Traffic:14", part619); + +var select111 = linear_select([ + msg486, + msg487, + msg488, + msg489, + msg490, + msg491, + msg492, +]); + +var part620 = // "Pattern{Constant('TruScan has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(info,false)}" +match("MESSAGE#418:TruScan", "nwparser.payload", "TruScan has generated an error: code %{resultcode}: description: %{info}", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","TruScan has generated an error"), +])); + +var msg493 = msg("TruScan", part620); + +var part621 = // "Pattern{Constant('Forced TruScan proactive threat detected,Computer name: '), Field(p0,false)}" +match("MESSAGE#419:TruScan:01/0", "nwparser.payload", "Forced TruScan proactive threat detected,Computer name: %{p0}"); + +var part622 = // "Pattern{Field(fld1,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version: '), Field(version,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld13,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score: '), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(',"'), Field(fld12,false), Constant('",Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld15,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#419:TruScan:01/2", "nwparser.p0", "%{fld1},Application name: %{application},Application type: %{obj_type},Application version: %{version},Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld13},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score: %{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},\"%{fld12}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld15},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var all169 = all_match({ + processors: [ + part621, + dup325, + part622, + ], + on_success: processor_chain([ + setc("eventcategory","1001030200"), + dup12, + dup152, + dup93, + date_time({ + dest: "recorded_time", + args: ["fld15"], + fmts: [ + [dW,dc("-"),dG,dc("-"),dF,dN,dc(":"),dU,dc(":"),dO], + ], + }), + dup132, + dup154, + dup15, + setc("event_description"," TruScan proactive threat detected"), + dup19, + ]), +}); + +var msg494 = msg("TruScan:01", all169); + +var part623 = // "Pattern{Constant('TruScan '), Field(info,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#420:TruScan:update/0", "nwparser.payload", "TruScan %{info->} %{p0}"); + +var part624 = // "Pattern{Constant('was successfully updated'), Field(,false)}" +match("MESSAGE#420:TruScan:update/1_0", "nwparser.p0", "was successfully updated%{}"); + +var part625 = // "Pattern{Constant('is up-to-date'), Field(,false)}" +match("MESSAGE#420:TruScan:update/1_1", "nwparser.p0", "is up-to-date%{}"); + +var select112 = linear_select([ + part624, + part625, +]); + +var all170 = all_match({ + processors: [ + part623, + select112, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Truscan was successfully updated or is up-to-date."), + ]), +}); + +var msg495 = msg("TruScan:update", all170); + +var part626 = // "Pattern{Constant('TruScan '), Field(info,true), Constant(' failed to update.')}" +match("MESSAGE#421:TruScan:updatefailed", "nwparser.payload", "TruScan %{info->} failed to update.", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Truscan failed to update."), +])); + +var msg496 = msg("TruScan:updatefailed", part626); + +var select113 = linear_select([ + msg493, + msg494, + msg495, + msg496, +]); + +var part627 = // "Pattern{Constant('Unexpected server error. ErrorCode: '), Field(resultcode,false)}" +match("MESSAGE#422:Unexpected", "nwparser.payload", "Unexpected server error. ErrorCode: %{resultcode}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup272, +])); + +var msg497 = msg("Unexpected", part627); + +var part628 = // "Pattern{Constant('Unexpected server error.'), Field(,false)}" +match("MESSAGE#423:Unexpected:01", "nwparser.payload", "Unexpected server error.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + dup272, +])); + +var msg498 = msg("Unexpected:01", part628); + +var select114 = linear_select([ + msg497, + msg498, +]); + +var part629 = // "Pattern{Constant('Unsolicited incoming ARP reply detected,'), Field(info,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Inbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld20,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#424:Unsolicited", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup273, + dup19, + dup34, +])); + +var msg499 = msg("Unsolicited", part629); + +var part630 = // "Pattern{Constant('Unsolicited incoming ARP reply detected,'), Field(info,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Outbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld20,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#425:Unsolicited:01", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ + dup11, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup273, + dup19, + dup35, +])); + +var msg500 = msg("Unsolicited:01", part630); + +var select115 = linear_select([ + msg499, + msg500, +]); + +var part631 = // "Pattern{Constant('User is attempting to terminate Symantec Management Client'), Field(p0,false)}" +match("MESSAGE#426:User/0", "nwparser.payload", "User is attempting to terminate Symantec Management Client%{p0}"); + +var part632 = // "Pattern{Constant('....,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#426:User/1_0", "nwparser.p0", "....,Event time:%{fld17->} %{fld18}"); + +var select116 = linear_select([ + part632, + dup91, +]); + +var all171 = all_match({ + processors: [ + part631, + select116, + ], + on_success: processor_chain([ + setc("eventcategory","1401040000"), + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","User is attempting to terminate Symantec Management Client."), + ]), +}); + +var msg501 = msg("User", all171); + +var part633 = // "Pattern{Field(fld44,false), Constant(',User - Kernel Hook Error,'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#427:User:01", "nwparser.payload", "%{fld44},User - Kernel Hook Error,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ + dup171, + dup12, + dup13, + dup20, + dup97, + dup187, + dup14, + dup41, + dup42, + dup15, + setc("event_description"," User - Kernel Hook Error"), +])); + +var msg502 = msg("User:01", part633); + +var part634 = // "Pattern{Constant('User has been created'), Field(,false)}" +match("MESSAGE#428:User:created", "nwparser.payload", "User has been created%{}", processor_chain([ + dup170, + dup12, + dup13, + dup20, + dup96, + dup28, + dup22, + dup14, + dup15, + dup23, + setc("event_description","User has been created."), +])); + +var msg503 = msg("User:created", part634); + +var part635 = // "Pattern{Constant('User has been deleted'), Field(,false)}" +match("MESSAGE#429:User:deleted", "nwparser.payload", "User has been deleted%{}", processor_chain([ + dup171, + dup12, + dup13, + dup20, + dup27, + dup28, + dup22, + dup14, + dup15, + dup23, + setc("event_description","User has been deleted."), +])); + +var msg504 = msg("User:deleted", part635); + +var select117 = linear_select([ + msg501, + msg502, + msg503, + msg504, +]); + +var part636 = // "Pattern{Constant('Windows Version info: Operating System: '), Field(os,true), Constant(' Network info:'), Field(p0,false)}" +match("MESSAGE#446:Windows/0", "nwparser.payload", "Windows Version info: Operating System: %{os->} Network info:%{p0}"); + +var part637 = // "Pattern{Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#446:Windows/1_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); + +var select118 = linear_select([ + part637, + dup212, +]); + +var all172 = all_match({ + processors: [ + part636, + select118, + ], + on_success: processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup93, + dup274, + ]), +}); + +var msg505 = msg("Windows", all172); + +var part638 = // "Pattern{Constant('Windows Host Integrity Content '), Field(version,true), Constant(' was successfully updated.')}" +match("MESSAGE#447:Windows:01", "nwparser.payload", "Windows Host Integrity Content %{version->} was successfully updated.", processor_chain([ + dup92, + dup12, + dup13, + dup14, + dup15, + dup274, +])); + +var msg506 = msg("Windows:01", part638); + +var select119 = linear_select([ + msg505, + msg506, +]); + +var part639 = // "Pattern{Constant('"=======EXCEPTION:'), Field(event_description,false), Constant('"')}" +match("MESSAGE#448:\"=======EXCEPTION:", "nwparser.payload", "\"=======EXCEPTION:%{event_description}\"", processor_chain([ + dup168, + dup12, + dup13, + dup14, + dup15, +])); + +var msg507 = msg("\"=======EXCEPTION:", part639); + +var part640 = // "Pattern{Constant('Sysfer exception: '), Field(info,false), Constant(',Sysfer exception,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(event_description,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#449:Allowed:08", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup132, + dup15, +])); + +var msg508 = msg("Allowed:08", part640); + +var part641 = // "Pattern{Constant('Sysfer exception: '), Field(info,false), Constant(',Sysfer exception,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(event_description,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#450:Allowed", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup132, + dup15, +])); + +var msg509 = msg("Allowed", part641); + +var part642 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" +match("MESSAGE#451:Allowed:05", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, +])); + +var msg510 = msg("Allowed:05", part642); + +var part643 = // "Pattern{Constant('"'), Field(filename,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" +match("MESSAGE#452:Allowed:06", "nwparser.payload", "\"%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, +])); + +var msg511 = msg("Allowed:06", part643); + +var part644 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#453:Allowed:01", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, +])); + +var msg512 = msg("Allowed:01", part644); + +var part645 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(p0,false)}" +match("MESSAGE#454:Allowed:02/0", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{p0}"); + +var part646 = // "Pattern{Field(domain,false), Constant(',Action Type:'), Field(fld45,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" +match("MESSAGE#454:Allowed:02/1_0", "nwparser.p0", "%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); + +var select120 = linear_select([ + part646, + dup10, +]); + +var all173 = all_match({ + processors: [ + part645, + select120, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup14, + setc("event_description","File Read"), + dup41, + dup42, + dup132, + dup15, + dup124, + dup125, + ]), +}); + +var msg513 = msg("Allowed:02", all173); + +var part647 = // "Pattern{Constant('- Caller MD5='), Field(checksum,false), Constant(',File Write,Begin: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/0_0", "nwparser.payload", "- Caller MD5=%{checksum},File Write,Begin: %{p0}"); + +var part648 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/0_1", "nwparser.payload", "%{fld1},File Write,Begin: %{p0}"); + +var select121 = linear_select([ + part647, + part648, +]); + +var part649 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); + +var part650 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#455:Allowed:09/3", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); + +var all174 = all_match({ + processors: [ + select121, + part649, + dup340, + part650, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup129, + dup41, + dup42, + dup277, + dup15, + dup124, + dup128, + ]), +}); + +var msg514 = msg("Allowed:09", all174); + +var part651 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" +match("MESSAGE#456:Allowed:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup277, + dup132, + dup15, + dup124, + dup128, +])); + +var msg515 = msg("Allowed:03", part651); + +var part652 = // "Pattern{Constant('- Caller MD5='), Field(checksum,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" +match("MESSAGE#457:Allowed:10/0", "nwparser.payload", "- Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); + +var part653 = // "Pattern{Constant('User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(p0,false)}" +match("MESSAGE#457:Allowed:10/2", "nwparser.p0", "User: %{username},Domain: %{domain},Action Type:%{p0}"); + +var part654 = // "Pattern{Field(fld46,false)}" +match_copy("MESSAGE#457:Allowed:10/3_1", "nwparser.p0", "fld46"); + +var select122 = linear_select([ + dup278, + part654, +]); + +var all175 = all_match({ + processors: [ + part652, + dup327, + part653, + select122, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup124, + dup27, + dup14, + dup41, + dup42, + dup279, + dup15, + dup131, + ]), +}); + +var msg516 = msg("Allowed:10", all175); + +var part655 = // "Pattern{Field(fld1,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" +match("MESSAGE#458:Allowed:04", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ + dup121, + dup12, + dup13, + dup124, + dup27, + dup14, + dup41, + dup42, + dup132, + dup279, + dup15, + dup131, +])); + +var msg517 = msg("Allowed:04", part655); + +var part656 = // "Pattern{Field(filename,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" +match("MESSAGE#459:Allowed:07", "nwparser.payload", "%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, +])); + +var msg518 = msg("Allowed:07", part656); + +var select123 = linear_select([ + msg508, + msg509, + msg510, + msg511, + msg512, + msg513, + msg514, + msg515, + msg516, + msg517, + msg518, +]); + +var part657 = // "Pattern{Constant('Audit logs have been swept.'), Field(,false)}" +match("MESSAGE#460:Audit", "nwparser.payload", "Audit logs have been swept.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Audit logs have been swept."), +])); + +var msg519 = msg("Audit", part657); + +var part658 = // "Pattern{Field(fld24,false), Constant(','), Field(fld1,false), Constant(',FATAL: '), Field(event_description,false)}" +match("MESSAGE#465:Category", "nwparser.payload", "%{fld24},%{fld1},FATAL: %{event_description}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, +])); + +var msg520 = msg("Category", part658); + +var part659 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(','), Field(event_description,true), Constant(' Remote file path:'), Field(p0,false)}" +match("MESSAGE#466:Category:03/0", "nwparser.payload", "%{fld1},%{fld2},%{event_description->} Remote file path:%{p0}"); + +var part660 = // "Pattern{Field(url,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#466:Category:03/1_0", "nwparser.p0", "%{url},Event time:%{fld17->} %{fld18}"); + +var select124 = linear_select([ + part660, + dup64, +]); + +var all176 = all_match({ + processors: [ + part659, + select124, + ], + on_success: processor_chain([ + dup43, + fqdn("daddr","url"), + port("dport","url"), + dup12, + dup13, + dup14, + dup93, + dup15, + ]), +}); + +var msg521 = msg("Category:03", all176); + +var part661 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(',Downloaded content from GUP '), Field(daddr,false), Constant(': '), Field(p0,false)}" +match("MESSAGE#467:Category:02/0", "nwparser.payload", "%{fld1},%{fld2},Downloaded content from GUP %{daddr}: %{p0}"); + +var part662 = // "Pattern{Field(dport,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#467:Category:02/1_0", "nwparser.p0", "%{dport},Event time:%{fld17->} %{fld18}"); + +var part663 = // "Pattern{Field(dport,false)}" +match_copy("MESSAGE#467:Category:02/1_1", "nwparser.p0", "dport"); + +var select125 = linear_select([ + part662, + part663, +]); + +var all177 = all_match({ + processors: [ + part661, + select125, + ], + on_success: processor_chain([ + dup43, + setc("event_description","Downloaded content from GUP"), + dup12, + dup13, + dup14, + dup15, + dup93, + ]), +}); + +var msg522 = msg("Category:02", all177); + +var part664 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(','), Field(p0,false)}" +match("MESSAGE#468:Category:01/0", "nwparser.payload", "%{fld1},%{fld2},%{p0}"); + +var part665 = // "Pattern{Field(event_description,false), Constant('. File : ''), Field(filename,false), Constant('',",Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#468:Category:01/1_0", "nwparser.p0", "%{event_description}. File : '%{filename}',\",Event time: %{fld17->} %{fld18}"); + +var part666 = // "Pattern{Field(event_description,false), Constant('Size (bytes): '), Field(filename_size,false), Constant('.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#468:Category:01/1_1", "nwparser.p0", "%{event_description}Size (bytes): %{filename_size}.,Event time: %{fld17->} %{fld18}"); + +var part667 = // "Pattern{Field(event_description,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#468:Category:01/1_2", "nwparser.p0", "%{event_description},Event time: %{fld17->} %{fld18}"); + +var part668 = // "Pattern{Field(event_description,false), Constant('. Size (bytes):'), Field(filename_size,false), Constant('.')}" +match("MESSAGE#468:Category:01/1_3", "nwparser.p0", "%{event_description}. Size (bytes):%{filename_size}."); + +var part669 = // "Pattern{Field(event_description,false), Constant('. '), Field(space,true), Constant(' File : ''), Field(filename,false), Constant('',"')}" +match("MESSAGE#468:Category:01/1_4", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}',\""); + +var part670 = // "Pattern{Field(event_description,false), Constant('. '), Field(space,true), Constant(' File : ''), Field(filename,false), Constant(''')}" +match("MESSAGE#468:Category:01/1_5", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}'"); + +var part671 = // "Pattern{Field(event_description,false)}" +match_copy("MESSAGE#468:Category:01/1_6", "nwparser.p0", "event_description"); + +var select126 = linear_select([ + part665, + part666, + part667, + part668, + part669, + part670, + part671, +]); + +var all178 = all_match({ + processors: [ + part664, + select126, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup93, + dup15, + ]), +}); + +var msg523 = msg("Category:01", all178); + +var select127 = linear_select([ + msg520, + msg521, + msg522, + msg523, +]); + +var part672 = // "Pattern{Constant('Default '), Field(info,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld2,false), Constant('..Failed Alert Name: '), Field(action,false), Constant('..Time: '), Field(fld3,true), Constant(' '), Field(fld1,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" +match("MESSAGE#469:Default", "nwparser.payload", "Default %{info}..Computer: %{shost}..Date: %{fld2}..Failed Alert Name: %{action}..Time: %{fld3->} %{fld1}..Severity: %{severity}..Source: %{product}", processor_chain([ + dup43, + date_time({ + dest: "event_time", + args: ["fld2","fld3","fld1"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dW,dN,dc(":"),dU,dc(":"),dO,dP], + ], + }), + setc("event_description","Default Alert"), + dup15, +])); + +var msg524 = msg("Default", part672); + +var part673 = // "Pattern{Constant('Default Group blocks new clients. The client cannot register with the Default Group.'), Field(,false)}" +match("MESSAGE#470:Default:01", "nwparser.payload", "Default Group blocks new clients. The client cannot register with the Default Group.%{}", processor_chain([ + dup43, + dup12, + dup13, + dup15, + setc("event_description","Default Group blocks new clients. The client cannot register with the Default Group."), +])); + +var msg525 = msg("Default:01", part673); + +var select128 = linear_select([ + msg524, + msg525, +]); + +var part674 = // "Pattern{Field(action,false), Constant('. '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(','), Field(direction,false), Constant(','), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" +match("MESSAGE#471:Device:01", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup142, + dup19, +])); + +var msg526 = msg("Device:01", part674); + +var part675 = // "Pattern{Field(action,false), Constant('. '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(','), Field(direction,false), Constant(','), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(','), Field(p0,false)}" +match("MESSAGE#472:Device/0", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},%{p0}"); + +var part676 = // "Pattern{Constant('"User:'), Field(username,false), Constant('",Domain:'), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld26,false)}" +match("MESSAGE#472:Device/1_0", "nwparser.p0", "\"User:%{username}\",Domain:%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld26}"); + +var part677 = // "Pattern{Constant(' User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#472:Device/1_1", "nwparser.p0", " User: %{username},Domain: %{domain}"); + +var select129 = linear_select([ + part676, + part677, +]); + +var all179 = all_match({ + processors: [ + part675, + select129, + ], + on_success: processor_chain([ + dup43, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup142, + dup19, + ]), +}); + +var msg527 = msg("Device", all179); + +var select130 = linear_select([ + msg526, + msg527, +]); + +var part678 = // "Pattern{Constant('Email sending failed'), Field(,false)}" +match("MESSAGE#473:Email", "nwparser.payload", "Email sending failed%{}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + setc("event_description","Email sending failed"), +])); + +var msg528 = msg("Email", part678); + +var part679 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" +match("MESSAGE#474:FileWrite:02/0", "nwparser.payload", "%{fld5->} - Caller MD5=%{checksum},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); + +var part680 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(p0,false)}" +match("MESSAGE#474:FileWrite:02/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{p0}"); + +var part681 = // "Pattern{Field(fld44,false)}" +match_copy("MESSAGE#474:FileWrite:02/3_1", "nwparser.p0", "fld44"); + +var select131 = linear_select([ + dup278, + part681, +]); + +var all180 = all_match({ + processors: [ + part679, + dup340, + part680, + select131, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup133, + dup124, + dup128, + ]), +}); + +var msg529 = msg("FileWrite:02", all180); + +var part682 = // "Pattern{Constant('[AC5-1.1] Log files written to Removable Media,File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#475:FileWrite:01", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup133, + dup124, + dup128, +])); + +var msg530 = msg("FileWrite:01", part682); + +var part683 = // "Pattern{Field(fld5,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#476:FileWrite:03", "nwparser.payload", "%{fld5},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup133, + dup124, + dup128, +])); + +var msg531 = msg("FileWrite:03", part683); + +var part684 = // "Pattern{Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#477:FileWrite", "nwparser.payload", ",File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup133, + dup124, + dup128, +])); + +var msg532 = msg("FileWrite", part684); + +var part685 = // "Pattern{Constant('[AC5-1.1] Log files written to Removable Media,File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#478:FileDelete", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup280, + dup124, + dup131, +])); + +var msg533 = msg("FileDelete", part685); + +var part686 = // "Pattern{Field(info,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" +match("MESSAGE#479:Continue/0", "nwparser.payload", "%{info->} - Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); + +var part687 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#479:Continue/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld44},File size (bytes): %{filename_size},Device ID: %{device}"); + +var all181 = all_match({ + processors: [ + part686, + dup340, + part687, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup129, + dup14, + dup41, + dup42, + dup15, + dup280, + dup124, + dup131, + ]), +}); + +var msg534 = msg("Continue", all181); + +var part688 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#480:FileDelete:01", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup280, + dup124, + dup131, +])); + +var msg535 = msg("FileDelete:01", part688); + +var part689 = // "Pattern{Field(fld5,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#481:FileDelete:02", "nwparser.payload", "%{fld5},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup280, + dup124, + dup131, +])); + +var msg536 = msg("FileDelete:02", part689); + +var part690 = // "Pattern{Field(fld5,false), Constant(',System,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld6,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" +match("MESSAGE#482:System:06", "nwparser.payload", "%{fld5},System,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld6},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, +])); + +var msg537 = msg("System:06", part690); + +var part691 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#495:File:10", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ + dup121, + dup12, + dup13, + dup14, + dup41, + dup42, + dup122, + dup130, + dup124, + dup125, +])); + +var msg538 = msg("File:10", part691); + +var part692 = // "Pattern{Field(fld11,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(','), Field(p0,false)}" +match("MESSAGE#503:Blocked:08/0_0", "nwparser.payload", "%{fld11->} - Caller MD5=%{fld6},%{p0}"); + +var select132 = linear_select([ + part692, + dup269, +]); + +var part693 = // "Pattern{Field(action,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#503:Blocked:08/1", "nwparser.p0", "%{action},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}"); + +var all182 = all_match({ + processors: [ + select132, + part693, + ], + on_success: processor_chain([ + dup121, + dup12, + dup13, + dup129, + dup15, + dup134, + dup135, + ]), +}); + +var msg539 = msg("Blocked:08", all182); + +var select133 = linear_select([ + msg529, + msg530, + msg531, + msg532, + msg533, + msg534, + msg535, + msg536, + msg537, + msg538, + msg539, +]); + +var part694 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(fld7,false)}" +match("MESSAGE#505:Ping/1", "nwparser.p0", "%{event_description}\",Local: %{daddr},Local: %{fld1},Remote: %{fld9},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); + +var all183 = all_match({ + processors: [ + dup341, + part694, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + dup19, + dup34, + ]), +}); + +var msg540 = msg("Ping", all183); + +var part695 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(fld7,false)}" +match("MESSAGE#506:Ping:01/1", "nwparser.p0", "%{event_description}\",Local: %{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); + +var all184 = all_match({ + processors: [ + dup341, + part695, + ], + on_success: processor_chain([ + dup69, + dup12, + dup13, + dup14, + dup41, + dup42, + dup15, + dup122, + dup19, + dup35, + ]), +}); + +var msg541 = msg("Ping:01", all184); + +var select134 = linear_select([ + msg540, + msg541, +]); + +var part696 = // "Pattern{Field(fld1,false), Constant(': Site: '), Field(fld2,false), Constant(',Server: '), Field(hostid,false), Constant(','), Field(directory,true), Constant(' '), Field(event_description,false)}" +match("MESSAGE#509:Server", "nwparser.payload", "%{fld1}: Site: %{fld2},Server: %{hostid},%{directory->} %{event_description}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, +])); + +var msg542 = msg("Server", part696); + +var part697 = // "Pattern{Constant('Server returned HTTP response code: '), Field(resultcode,true), Constant(' for URL: '), Field(url,false)}" +match("MESSAGE#510:Server:01", "nwparser.payload", "Server returned HTTP response code: %{resultcode->} for URL: %{url}", processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, +])); + +var msg543 = msg("Server:01", part697); + +var part698 = // "Pattern{Constant('Server security validation failed.'), Field(,false)}" +match("MESSAGE#512:Server:03", "nwparser.payload", "Server security validation failed.%{}", processor_chain([ + dup174, + dup94, + setf("saddr","hhostid"), + dup14, + dup15, +])); + +var msg544 = msg("Server:03", part698); + +var select135 = linear_select([ + msg542, + msg543, + msg544, +]); + +var part699 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#514:1", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup200, + dup15, + dup283, +])); + +var msg545 = msg("1", part699); + +var part700 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#515:2", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup162, + dup15, + dup283, +])); + +var msg546 = msg("2", part700); + +var part701 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#516:3", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","FW Violation Event"), + dup15, + dup283, +])); + +var msg547 = msg("3", part701); + +var part702 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#517:4", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","IDS Event"), + dup15, + dup283, +])); + +var msg548 = msg("4", part702); + +var part703 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#518:5", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","CAL Event"), + dup15, + dup283, +])); + +var msg549 = msg("5", part703); + +var part704 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#519:6", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","Forced Detection Event"), + dup15, + dup283, +])); + +var msg550 = msg("6", part704); + +var part705 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#520:7", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","Detection Whitelisted"), + dup15, + dup283, +])); + +var msg551 = msg("7", part705); + +var part706 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#521:8", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup227, + dup15, + dup283, +])); + +var msg552 = msg("8", part706); + +var part707 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#522:9", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + setc("event_description","Risk submitted"), + dup15, + dup283, +])); + +var msg553 = msg("9", part707); + +var part708 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" +match("MESSAGE#523:10", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ + dup110, + dup115, + dup116, + dup38, + dup152, + dup253, + dup15, + dup283, +])); + +var msg554 = msg("10", part708); + +var msg555 = msg("1281", dup342); + +var msg556 = msg("257", dup342); + +var msg557 = msg("259", dup342); + +var part709 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Organization importing started')}" +match("MESSAGE#527:264", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing started", processor_chain([ + dup53, + dup284, + dup15, + dup220, +])); + +var msg558 = msg("264", part709); + +var part710 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Organization importing finished successfully')}" +match("MESSAGE#528:265", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing finished successfully", processor_chain([ + dup53, + dup284, + dup15, + dup219, +])); + +var msg559 = msg("265", part710); + +var msg560 = msg("273", dup342); + +var part711 = // "Pattern{Field(id,false), Constant('^^The process '), Field(process,true), Constant(' can not lock the process status table. The process status has been locked by the server '), Field(shost,true), Constant(' ('), Field(fld22,false), Constant(') since '), Field(recorded_time,false), Constant('.')}" +match("MESSAGE#530:275", "nwparser.payload", "%{id}^^The process %{process->} can not lock the process status table. The process status has been locked by the server %{shost->} (%{fld22}) since %{recorded_time}.", processor_chain([ + dup53, + dup15, + setc("event_description","The process can not lock the process status table"), +])); + +var msg561 = msg("275", part711); + +var msg562 = msg("769", dup342); + +var msg563 = msg("772", dup342); + +var msg564 = msg("773", dup342); + +var msg565 = msg("778", dup342); + +var msg566 = msg("779", dup342); + +var msg567 = msg("782", dup342); + +var part712 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Backup succeeded and finished at '), Field(fld4,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant('. The backup file resides at the following location on the server '), Field(shost,false), Constant(': '), Field(directory,false)}" +match("MESSAGE#537:1029", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup succeeded and finished at %{fld4->} %{fld5->} %{fld6}. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ + dup53, + dup284, + date_time({ + dest: "recorded_time", + args: ["fld4","fld5","fld6"], + fmts: [ + [dG,dc("/"),dF,dc("/"),dY,dN,dc(":"),dU,dP], + ], + }), + dup15, + dup285, +])); + +var msg568 = msg("1029", part712); + +var part713 = // "Pattern{Field(id,false), Constant('^^Backup succeeded and finished. The backup file resides at the following location on the server '), Field(shost,false), Constant(': '), Field(directory,false)}" +match("MESSAGE#538:1029:01", "nwparser.payload", "%{id}^^Backup succeeded and finished. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ + dup53, + dup15, + dup285, +])); + +var msg569 = msg("1029:01", part713); + +var select136 = linear_select([ + msg568, + msg569, +]); + +var part714 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Backup started')}" +match("MESSAGE#539:1030", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup started", processor_chain([ + dup53, + dup284, + dup15, + dup286, +])); + +var msg570 = msg("1030", part714); + +var part715 = // "Pattern{Field(id,false), Constant('^^Backup started')}" +match("MESSAGE#540:1030:01", "nwparser.payload", "%{id}^^Backup started", processor_chain([ + dup53, + dup15, + dup286, +])); + +var msg571 = msg("1030:01", part715); + +var select137 = linear_select([ + msg570, + msg571, +]); + +var msg572 = msg("4097", dup342); + +var msg573 = msg("4353", dup342); + +var msg574 = msg("5121", dup342); + +var msg575 = msg("5122", dup342); + +var part716 = // "Pattern{Field(id,false), Constant('^^Sending Email Failed for following email address ['), Field(user_address,false), Constant('].')}" +match("MESSAGE#545:4609", "nwparser.payload", "%{id}^^Sending Email Failed for following email address [%{user_address}].", processor_chain([ + setc("eventcategory","1207010200"), + setc("event_description","Sending Email Failed"), + dup15, +])); + +var msg576 = msg("4609", part716); + +var msg577 = msg("4868", dup343); + +var msg578 = msg("5377", dup343); + +var msg579 = msg("5378", dup343); + +var msg580 = msg("302449153", dup344); + +var msg581 = msg("302449153:01", dup345); + +var select138 = linear_select([ + msg580, + msg581, +]); + +var msg582 = msg("302449154", dup344); + +var msg583 = msg("302449154:01", dup345); + +var select139 = linear_select([ + msg582, + msg583, +]); + +var msg584 = msg("302449155", dup346); + +var msg585 = msg("302449155:01", dup347); + +var select140 = linear_select([ + msg584, + msg585, +]); + +var msg586 = msg("302449156", dup346); + +var msg587 = msg("302449156:01", dup347); + +var select141 = linear_select([ + msg586, + msg587, +]); + +var msg588 = msg("302449158", dup344); + +var msg589 = msg("302449158:01", dup345); + +var select142 = linear_select([ + msg588, + msg589, +]); + +var part717 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#559:302449166", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup165, + dup15, + dup287, +])); + +var msg590 = msg("302449166", part717); + +var part718 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#560:302449166:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup165, + dup15, + dup287, +])); + +var msg591 = msg("302449166:01", part718); + +var select143 = linear_select([ + msg590, + msg591, +]); + +var part719 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#561:302449168", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup136, + dup288, + dup56, + dup22, + dup15, + dup287, +])); + +var msg592 = msg("302449168", part719); + +var part720 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#562:302449168:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup136, + dup288, + dup56, + dup22, + dup15, + dup287, +])); + +var msg593 = msg("302449168:01", part720); + +var select144 = linear_select([ + msg592, + msg593, +]); + +var msg594 = msg("302449169", dup344); + +var msg595 = msg("302449169:01", dup345); + +var select145 = linear_select([ + msg594, + msg595, +]); + +var part721 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#565:302449176", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup213, + dup288, + dup172, + dup22, + dup15, + dup287, +])); + +var msg596 = msg("302449176", part721); + +var part722 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#566:302449176:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup213, + dup288, + dup172, + dup22, + dup15, + dup287, +])); + +var msg597 = msg("302449176:01", part722); + +var select146 = linear_select([ + msg596, + msg597, +]); + +var part723 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#567:302449178", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup256, + dup15, + dup287, +])); + +var msg598 = msg("302449178", part723); + +var part724 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#568:302449178:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup256, + dup15, + dup287, +])); + +var msg599 = msg("302449178:01", part724); + +var select147 = linear_select([ + msg598, + msg599, +]); + +var msg600 = msg("302449409", dup344); + +var msg601 = msg("302449409:01", dup345); + +var select148 = linear_select([ + msg600, + msg601, +]); + +var msg602 = msg("302449410", dup346); + +var msg603 = msg("302449410:01", dup347); + +var select149 = linear_select([ + msg602, + msg603, +]); + +var part725 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#573:302449412", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup289, + dup15, + dup287, +])); + +var msg604 = msg("302449412", part725); + +var part726 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#574:302449412:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup289, + dup15, + dup287, +])); + +var msg605 = msg("302449412:01", part726); + +var select150 = linear_select([ + msg604, + msg605, +]); + +var part727 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#575:302449413", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup232, + dup15, + dup287, +])); + +var msg606 = msg("302449413", part727); + +var part728 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#576:302449413:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup232, + dup15, + dup287, +])); + +var msg607 = msg("302449413:01", part728); + +var select151 = linear_select([ + msg606, + msg607, +]); + +var msg608 = msg("302449414", dup344); + +var msg609 = msg("302449414:01", dup345); + +var select152 = linear_select([ + msg608, + msg609, +]); + +var msg610 = msg("302449415", dup344); + +var msg611 = msg("302449415:01", dup345); + +var select153 = linear_select([ + msg610, + msg611, +]); + +var msg612 = msg("302449418", dup344); + +var msg613 = msg("302449418:01", dup345); + +var select154 = linear_select([ + msg612, + msg613, +]); + +var msg614 = msg("302449420", dup344); + +var msg615 = msg("302449420:01", dup345); + +var select155 = linear_select([ + msg614, + msg615, +]); + +var msg616 = msg("302450432", dup348); + +var msg617 = msg("302450432:01", dup349); + +var select156 = linear_select([ + msg616, + msg617, +]); + +var msg618 = msg("302450688", dup344); + +var msg619 = msg("302450688:01", dup345); + +var select157 = linear_select([ + msg618, + msg619, +]); + +var msg620 = msg("302450944", dup344); + +var msg621 = msg("302450944:01", dup345); + +var select158 = linear_select([ + msg620, + msg621, +]); + +var msg622 = msg("302452736", dup344); + +var msg623 = msg("302452736:01", dup345); + +var select159 = linear_select([ + msg622, + msg623, +]); + +var msg624 = msg("302452743", dup344); + +var msg625 = msg("302452743:01", dup345); + +var select160 = linear_select([ + msg624, + msg625, +]); + +var msg626 = msg("302452758", dup348); + +var msg627 = msg("302452758:01", dup349); + +var select161 = linear_select([ + msg626, + msg627, +]); + +var msg628 = msg("302452801", dup348); + +var msg629 = msg("302452801:01", dup349); + +var select162 = linear_select([ + msg628, + msg629, +]); + +var msg630 = msg("302452802", dup344); + +var msg631 = msg("302452802:01", dup345); + +var select163 = linear_select([ + msg630, + msg631, +]); + +var msg632 = msg("302452807", dup344); + +var msg633 = msg("302452807:01", dup345); + +var select164 = linear_select([ + msg632, + msg633, +]); + +var msg634 = msg("302452808", dup348); + +var msg635 = msg("302452808:01", dup349); + +var select165 = linear_select([ + msg634, + msg635, +]); + +var msg636 = msg("302452816", dup344); + +var msg637 = msg("302452816:01", dup345); + +var select166 = linear_select([ + msg636, + msg637, +]); + +var msg638 = msg("302452817", dup344); + +var msg639 = msg("302452817:01", dup345); + +var select167 = linear_select([ + msg638, + msg639, +]); + +var msg640 = msg("302452819", dup344); + +var msg641 = msg("302452819:01", dup345); + +var select168 = linear_select([ + msg640, + msg641, +]); + +var msg642 = msg("302710785", dup348); + +var msg643 = msg("302710785:01", dup349); + +var select169 = linear_select([ + msg642, + msg643, +]); + +var msg644 = msg("302710786", dup344); + +var msg645 = msg("302710786:01", dup345); + +var select170 = linear_select([ + msg644, + msg645, +]); + +var msg646 = msg("302710790", dup344); + +var msg647 = msg("302710790:01", dup345); + +var select171 = linear_select([ + msg646, + msg647, +]); + +var msg648 = msg("302710791", dup348); + +var msg649 = msg("302710791:01", dup349); + +var select172 = linear_select([ + msg648, + msg649, +]); + +var msg650 = msg("302776321", dup348); + +var msg651 = msg("302776321:01", dup349); + +var select173 = linear_select([ + msg650, + msg651, +]); + +var msg652 = msg("302776322", dup348); + +var msg653 = msg("302776322:01", dup349); + +var select174 = linear_select([ + msg652, + msg653, +]); + +var msg654 = msg("302776576", dup344); + +var msg655 = msg("302776576:01", dup345); + +var select175 = linear_select([ + msg654, + msg655, +]); + +var msg656 = msg("302776834", dup344); + +var msg657 = msg("302776834:01", dup345); + +var select176 = linear_select([ + msg656, + msg657, +]); + +var msg658 = msg("303077785", dup348); + +var msg659 = msg("303077785:01", dup349); + +var select177 = linear_select([ + msg658, + msg659, +]); + +var msg660 = msg("303169538", dup348); + +var msg661 = msg("303169538:01", dup349); + +var select178 = linear_select([ + msg660, + msg661, +]); + +var msg662 = msg("303235073", dup348); + +var msg663 = msg("303235073:01", dup349); + +var select179 = linear_select([ + msg662, + msg663, +]); + +var msg664 = msg("303235074", dup348); + +var msg665 = msg("303235074:01", dup349); + +var select180 = linear_select([ + msg664, + msg665, +]); + +var msg666 = msg("303235075", dup344); + +var msg667 = msg("303235075:01", dup345); + +var select181 = linear_select([ + msg666, + msg667, +]); + +var msg668 = msg("303235079", dup344); + +var msg669 = msg("303235079:01", dup345); + +var select182 = linear_select([ + msg668, + msg669, +]); + +var part729 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); + +var all185 = all_match({ + processors: [ + part729, + dup350, + dup293, + ], + on_success: processor_chain([ + dup43, + dup15, + dup287, + ]), +}); + +var msg670 = msg("303235080", all185); + +var part730 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#640:303235080:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); + +var all186 = all_match({ + processors: [ + part730, + dup350, + dup293, + ], + on_success: processor_chain([ + dup43, + dup15, + dup287, + ]), +}); + +var msg671 = msg("303235080:01", all186); + +var select183 = linear_select([ + msg670, + msg671, +]); + +var msg672 = msg("303235081", dup344); + +var msg673 = msg("303235081:01", dup345); + +var select184 = linear_select([ + msg672, + msg673, +]); + +var msg674 = msg("303235082", dup344); + +var msg675 = msg("303235082:01", dup345); + +var select185 = linear_select([ + msg674, + msg675, +]); + +var msg676 = msg("303235083", dup344); + +var msg677 = msg("303235083:01", dup345); + +var select186 = linear_select([ + msg676, + msg677, +]); + +var msg678 = msg("302452762", dup344); + +var msg679 = msg("303235076", dup344); + +var msg680 = msg("303235076:01", dup345); + +var select187 = linear_select([ + msg679, + msg680, +]); + +var msg681 = msg("302448900", dup345); + +var part731 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#651:301", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup351, + dup268, + dup297, + dup298, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg682 = msg("301", part731); + +var part732 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#652:301:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup351, + dup268, + dup297, + dup298, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg683 = msg("301:01", part732); + +var part733 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#653:301:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup120, + dup295, + dup268, + dup351, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg684 = msg("301:02", part733); + +var select188 = linear_select([ + msg682, + msg683, + msg684, +]); + +var part734 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#654:302", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup303, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg685 = msg("302", part734); + +var part735 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#655:302:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup303, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg686 = msg("302:01", part735); + +var select189 = linear_select([ + msg685, + msg686, +]); + +var part736 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#656:306", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup297, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg687 = msg("306", part736); + +var part737 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#657:306:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup297, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg688 = msg("306:01", part737); + +var select190 = linear_select([ + msg687, + msg688, +]); + +var part738 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#658:307", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup304, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg689 = msg("307", part738); + +var part739 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#659:307:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup304, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg690 = msg("307:01", part739); + +var select191 = linear_select([ + msg689, + msg690, +]); + +var part740 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#660:308", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup297, + dup298, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg691 = msg("308", part740); + +var part741 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#661:308:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup297, + dup298, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg692 = msg("308:01", part741); + +var part742 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#662:308:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup120, + dup295, + dup351, + dup268, + dup15, + dup352, + dup312, + dup287, + dup300, + dup301, + dup302, +])); + +var msg693 = msg("308:02", part742); + +var select192 = linear_select([ + msg691, + msg692, + msg693, +]); + +var part743 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#663:202", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup36, + dup295, + setc("ec_activity","Scan"), + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var msg694 = msg("202", part743); + +var msg695 = msg("206", dup357); + +var msg696 = msg("206:01", dup358); + +var select193 = linear_select([ + msg695, + msg696, +]); + +var msg697 = msg("207", dup357); + +var msg698 = msg("207:01", dup358); + +var select194 = linear_select([ + msg697, + msg698, +]); + +var part744 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#668:208", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup36, + dup295, + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var msg699 = msg("208", part744); + +var msg700 = msg("210", dup359); + +var part745 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#670:210:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup43, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var msg701 = msg("210:01", part745); + +var select195 = linear_select([ + msg700, + msg701, +]); + +var msg702 = msg("211", dup357); + +var msg703 = msg("211:01", dup358); + +var select196 = linear_select([ + msg702, + msg703, +]); + +var msg704 = msg("221", dup359); + +var part746 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#674:238/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); + +var all187 = all_match({ + processors: [ + dup305, + dup350, + part746, + ], + on_success: processor_chain([ + dup43, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, + ]), +}); + +var msg705 = msg("238", all187); + +var part747 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#675:238:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); + +var part748 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#675:238:01/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); + +var all188 = all_match({ + processors: [ + part747, + dup350, + part748, + ], + on_success: processor_chain([ + dup43, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, + ]), +}); + +var msg706 = msg("238:01", all188); + +var select197 = linear_select([ + msg705, + msg706, +]); + +var msg707 = msg("501", dup360); + +var msg708 = msg("501:01", dup361); + +var select198 = linear_select([ + msg707, + msg708, +]); + +var part749 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" +match("MESSAGE#678:502", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ + dup43, + dup15, + dup356, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); + +var msg709 = msg("502", part749); + +var part750 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" +match("MESSAGE#679:502:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ + dup43, + dup15, + dup356, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); + +var msg710 = msg("502:01", part750); + +var select199 = linear_select([ + msg709, + msg710, +]); + +var msg711 = msg("999", dup360); + +var msg712 = msg("999:01", dup361); + +var select200 = linear_select([ + msg711, + msg712, +]); + +var part751 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,SYSTEM,Information,'), Field(shost,false), Constant(','), Field(event_description,false), Constant('. string-data=[ Scan type: '), Field(event_type,true), Constant(' Event: '), Field(result,true), Constant(' Security risk detected: '), Field(directory,true), Constant(' File: '), Field(filename,true), Constant(' Location: '), Field(fld7,true), Constant(' Computer: '), Field(fld8,true), Constant(' User: '), Field(username,true), Constant(' Action taken:'), Field(action,true), Constant(' Date found: '), Field(fld9,false), Constant(']')}" +match("MESSAGE#682:Application_45", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,SYSTEM,Information,%{shost},%{event_description}. string-data=[ Scan type: %{event_type->} Event: %{result->} Security risk detected: %{directory->} File: %{filename->} Location: %{fld7->} Computer: %{fld8->} User: %{username->} Action taken:%{action->} Date found: %{fld9}]", processor_chain([ + dup43, + dup15, + dup55, +])); + +var msg713 = msg("Application_45", part751); + +var part752 = // "Pattern{Constant('Using Group Update Provider type: '), Field(p0,false)}" +match("MESSAGE#692:SYLINK/0", "nwparser.payload", "Using Group Update Provider type: %{p0}"); + +var part753 = // "Pattern{Constant('Single Group Update Provider,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#692:SYLINK/1_0", "nwparser.p0", "Single Group Update Provider,Event time:%{fld17->} %{fld18}"); + +var part754 = // "Pattern{Constant('Multiple Group Update Providers,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#692:SYLINK/1_1", "nwparser.p0", "Multiple Group Update Providers,Event time:%{fld17->} %{fld18}"); + +var part755 = // "Pattern{Constant('Mapped Group Update Providers,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#692:SYLINK/1_2", "nwparser.p0", "Mapped Group Update Providers,Event time:%{fld17->} %{fld18}"); + +var part756 = // "Pattern{Constant('Single Group Update Provider'), Field(,false)}" +match("MESSAGE#692:SYLINK/1_3", "nwparser.p0", "Single Group Update Provider%{}"); + +var part757 = // "Pattern{Constant('Multiple Group Update Providers'), Field(,false)}" +match("MESSAGE#692:SYLINK/1_4", "nwparser.p0", "Multiple Group Update Providers%{}"); + +var part758 = // "Pattern{Constant('Mapped Group Update Providers'), Field(,false)}" +match("MESSAGE#692:SYLINK/1_5", "nwparser.p0", "Mapped Group Update Providers%{}"); + +var select201 = linear_select([ + part753, + part754, + part755, + part756, + part757, + part758, +]); + +var all189 = all_match({ + processors: [ + part752, + select201, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup14, + dup15, + dup93, + setc("event_description","Using Group Update Provider."), + ]), +}); + +var msg714 = msg("SYLINK", all189); + +var part759 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#703:242", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup53, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var msg715 = msg("242", part759); + +var part760 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' ['), Field(p0,false)}" +match("MESSAGE#704:242:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [%{p0}"); + +var part761 = // "Pattern{Constant('Device]: '), Field(device,true), Constant(' [guid]: '), Field(hardware_id,true), Constant(' [Volume]:'), Field(p0,false)}" +match("MESSAGE#704:242:01/1_0", "nwparser.p0", "Device]: %{device->} [guid]: %{hardware_id->} [Volume]:%{p0}"); + +var part762 = // "Pattern{Constant('Volume]:'), Field(p0,false)}" +match("MESSAGE#704:242:01/1_1", "nwparser.p0", "Volume]:%{p0}"); + +var select202 = linear_select([ + part761, + part762, +]); + +var part763 = // "Pattern{Field(,true), Constant(' '), Field(disk_volume,true), Constant(' [Vendor]:'), Field(devvendor,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#704:242:01/2", "nwparser.p0", "%{} %{disk_volume->} [Vendor]:%{devvendor->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); + +var all190 = all_match({ + processors: [ + part760, + select202, + part763, + ], + on_success: processor_chain([ + dup53, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, + ]), +}); + +var msg716 = msg("242:01", all190); + +var part764 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' [Volume]: '), Field(disk_volume,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#705:242:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup53, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var msg717 = msg("242:02", part764); + +var part765 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#706:242:03/1_0", "nwparser.p0", "%{event_description}. %{info->} [Access]: %{accesses}^^%{p0}"); + +var part766 = // "Pattern{Constant(' '), Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#706:242:03/1_1", "nwparser.p0", " %{event_description}. %{info}^^%{p0}"); + +var part767 = // "Pattern{Constant(' '), Field(event_description,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#706:242:03/1_2", "nwparser.p0", " %{event_description}^^%{p0}"); + +var select203 = linear_select([ + part765, + part766, + part767, +]); + +var part768 = // "Pattern{Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#706:242:03/2", "nwparser.p0", "%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); + +var all191 = all_match({ + processors: [ + dup305, + select203, + part768, + ], + on_success: processor_chain([ + dup53, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, + ]), +}); + +var msg718 = msg("242:03", all191); + +var select204 = linear_select([ + msg715, + msg716, + msg717, + msg718, +]); + +var part769 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#707:303169540", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + setc("eventcategory","1801010000"), + dup15, + dup287, +])); + +var msg719 = msg("303169540", part769); + +var part770 = // "Pattern{Field(shost,false), Constant(', Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#708:Remote::01", "nwparser.payload", "%{shost}, Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}", processor_chain([ + dup53, + dup12, + dup15, + dup40, + dup41, + dup42, + dup47, +])); + +var msg720 = msg("Remote::01", part770); + +var part771 = // "Pattern{Constant('"'), Field(info,false), Constant('",Local: '), Field(p0,false)}" +match("MESSAGE#709:Notification::01/0_0", "nwparser.payload", "\"%{info}\",Local: %{p0}"); + +var part772 = // "Pattern{Field(info,false), Constant(',Local: '), Field(p0,false)}" +match("MESSAGE#709:Notification::01/0_1", "nwparser.payload", "%{info},Local: %{p0}"); + +var select205 = linear_select([ + part771, + part772, +]); + +var part773 = // "Pattern{Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" +match("MESSAGE#709:Notification::01/1", "nwparser.p0", "%{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); + +var select206 = linear_select([ + dup182, + dup67, +]); + +var part774 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#709:Notification::01/3", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var all192 = all_match({ + processors: [ + select205, + part773, + select206, + part774, + ], + on_success: processor_chain([ + dup53, + dup12, + dup13, + dup15, + dup14, + dup40, + dup41, + dup42, + dup47, + ]), +}); + +var msg721 = msg("Notification::01", all192); + +var chain1 = processor_chain([ + select2, + msgid_select({ + "\"=======EXCEPTION:": msg507, + "1": msg545, + "10": msg554, + "1029": select136, + "1030": select137, + "1281": msg555, + "2": msg546, + "202": msg694, + "206": select193, + "207": select194, + "208": msg699, + "210": select195, + "211": select196, + "221": msg704, + "238": select197, + "242": select204, + "257": msg556, + "259": msg557, + "264": msg558, + "265": msg559, + "273": msg560, + "275": msg561, + "3": msg547, + "301": select188, + "302": select189, + "302448900": msg681, + "302449153": select138, + "302449154": select139, + "302449155": select140, + "302449156": select141, + "302449158": select142, + "302449166": select143, + "302449168": select144, + "302449169": select145, + "302449176": select146, + "302449178": select147, + "302449409": select148, + "302449410": select149, + "302449412": select150, + "302449413": select151, + "302449414": select152, + "302449415": select153, + "302449418": select154, + "302449420": select155, + "302450432": select156, + "302450688": select157, + "302450944": select158, + "302452736": select159, + "302452743": select160, + "302452758": select161, + "302452762": msg678, + "302452801": select162, + "302452802": select163, + "302452807": select164, + "302452808": select165, + "302452816": select166, + "302452817": select167, + "302452819": select168, + "302710785": select169, + "302710786": select170, + "302710790": select171, + "302710791": select172, + "302776321": select173, + "302776322": select174, + "302776576": select175, + "302776834": select176, + "303077785": select177, + "303169538": select178, + "303169540": msg719, + "303235073": select179, + "303235074": select180, + "303235075": select181, + "303235076": select187, + "303235079": select182, + "303235080": select183, + "303235081": select184, + "303235082": select185, + "303235083": select186, + "306": select190, + "307": select191, + "308": select192, + "4": msg548, + "4097": msg572, + "4353": msg573, + "4609": msg576, + "4868": msg577, + "5": msg549, + "501": select198, + "502": select199, + "5121": msg574, + "5122": msg575, + "5377": msg578, + "5378": msg579, + "6": msg550, + "7": msg551, + "769": msg562, + "772": msg563, + "773": msg564, + "778": msg565, + "779": msg566, + "782": msg567, + "8": msg552, + "9": msg553, + "999": select200, + "??:": msg214, + "Active": select3, + "Add": msg69, + "Administrator": select4, + "Allowed": select123, + "Antivirus": select9, + "Application": select12, + "Application_45": msg713, + "Applied": select16, + "Audit": msg519, + "Blocked": select21, + "Category": select127, + "Changed": msg124, + "Cleaned": msg125, + "Client": select23, + "Commercial": select28, + "Compliance": msg484, + "Compressed": select99, + "Computer": select31, + "Configuration": select32, + "Connected": select34, + "Connection": msg160, + "Continue": select133, + "Could": select35, + "Create": msg163, + "Database": select36, + "Decomposer": msg171, + "Default": select128, + "Device": select130, + "Disconnected": select37, + "Domain": select38, + "Download": msg485, + "Email": msg528, + "Failed": select41, + "Firefox": select67, + "Firewall": select42, + "Generic": select70, + "Group": select43, + "Host": select46, + "Internet": select68, + "Intrusion": select48, + "Invalid": msg217, + "LUALL": msg289, + "Limited": msg218, + "LiveUpdate": select54, + "Local": select60, + "Local:": select18, + "Location": msg288, + "Malicious": select8, + "Management": select62, + "Memory": msg327, + "Network": select66, + "New": select73, + "No": select74, + "Notification:": msg721, + "Number": select77, + "Organization": select75, + "PTS": msg380, + "Ping": select134, + "Policy": select79, + "Potential": select80, + "Previous": msg368, + "Proactive": select81, + "Received": select87, + "Reconfiguring": msg383, + "Reconnected": msg384, + "Remote:": msg720, + "Retry": select88, + "Risk": select90, + "SHA-256:": select15, + "Scan": select94, + "Security": select98, + "Server": select135, + "Somebody": select10, + "Stop": select100, + "Stopping": msg427, + "Submission": msg428, + "Successfully": select89, + "Suspicious": msg476, + "Switched": msg429, + "Symantec": select107, + "System": select108, + "Terminated": msg483, + "Traffic": select111, + "TruScan": select113, + "Unexpected": select114, + "Unsolicited": select115, + "User": select117, + "Using": msg714, + "Virus": select59, + "Windows": select119, + "allowed": select6, + "blocked": select17, + "client": select26, + "management": select63, + "password": select5, + "process": select82, + "properties": select85, + "restart": msg385, + }), +]); + +var part775 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#0:Active/1_0", "nwparser.p0", "%{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var part776 = // "Pattern{Field(domain,false)}" +match_copy("MESSAGE#0:Active/1_1", "nwparser.p0", "domain"); + +var part777 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#15:Somebody:01/1_0", "nwparser.p0", "%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var part778 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#27:Application:06/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); + +var part779 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#27:Application:06/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); + +var part780 = // "Pattern{Constant('Intrusion URL: '), Field(url,false)}" +match("MESSAGE#27:Application:06/1_2", "nwparser.p0", "Intrusion URL: %{url}"); + +var part781 = // "Pattern{Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" +match("MESSAGE#31:scanning:01/1_0", "nwparser.p0", "%{url},Intrusion Payload URL:%{fld25}"); + +var part782 = // "Pattern{Field(url,false)}" +match_copy("MESSAGE#31:scanning:01/1_1", "nwparser.p0", "url"); + +var part783 = // "Pattern{Constant('Domain:'), Field(p0,false)}" +match("MESSAGE#33:Informational/1_1", "nwparser.p0", "Domain:%{p0}"); + +var part784 = // "Pattern{Constant(':'), Field(p0,false)}" +match("MESSAGE#38:Web_Attack:16/1_1", "nwparser.p0", ":%{p0}"); + +var part785 = // "Pattern{Constant('"'), Field(p0,false)}" +match("MESSAGE#307:process:12/1_0", "nwparser.p0", "\"%{p0}"); + +var part786 = // "Pattern{Field(p0,false)}" +match_copy("MESSAGE#307:process:12/1_1", "nwparser.p0", "p0"); + +var part787 = // "Pattern{Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(','), Field(p0,false)}" +match("MESSAGE#307:process:12/4", "nwparser.p0", ",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{p0}"); + +var part788 = // "Pattern{Constant('Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" +match("MESSAGE#307:process:12/5_0", "nwparser.p0", "Intrusion ID: %{fld33},Begin: %{p0}"); + +var part789 = // "Pattern{Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" +match("MESSAGE#307:process:12/5_1", "nwparser.p0", "%{fld33},Begin: %{p0}"); + +var part790 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" +match("MESSAGE#307:process:12/6", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); + +var part791 = // "Pattern{Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); + +var part792 = // "Pattern{}" +match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); + +var part793 = // "Pattern{Constant('"Location: '), Field(p0,false)}" +match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); + +var part794 = // "Pattern{Constant('Location: '), Field(p0,false)}" +match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); + +var part795 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); + +var part796 = // "Pattern{Field(fld4,false), Constant(',MD-5:'), Field(fld5,false), Constant(',Local:'), Field(p0,false)}" +match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); + +var part797 = // "Pattern{Constant('Local:'), Field(p0,false)}" +match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); + +var part798 = // "Pattern{Constant('Rule: '), Field(rulename,false), Constant(',Location: '), Field(p0,false)}" +match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); + +var part799 = // "Pattern{Constant(' "Rule: '), Field(rulename,false), Constant('",Location: '), Field(p0,false)}" +match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); + +var part800 = // "Pattern{Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" +match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); + +var part801 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" +match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); + +var part802 = // "Pattern{Constant(' Domain: '), Field(domain,false)}" +match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); + +var part803 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(p0,false)}" +match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); + +var part804 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(p0,false)}" +match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); + +var part805 = // "Pattern{Field(fld25,false)}" +match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); + +var part806 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part807 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" +match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); + +var part808 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); + +var part809 = // "Pattern{Constant('The client will block traffic from IP address '), Field(fld14,true), Constant(' for the next '), Field(duration_string,true), Constant(' (from '), Field(fld13,false), Constant(')'), Field(p0,false)}" +match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); + +var part810 = // "Pattern{Constant('.,'), Field(p0,false)}" +match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); + +var part811 = // "Pattern{Constant(' . ,'), Field(p0,false)}" +match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); + +var part812 = // "Pattern{Constant('Commercial application detected,Computer name: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); + +var part813 = // "Pattern{Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); + +var part814 = // "Pattern{Field(shost,false), Constant(',Detection type: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); + +var part815 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); + +var part816 = // "Pattern{Constant('"'), Field(filename,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); + +var part817 = // "Pattern{Field(filename,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); + +var part818 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var part819 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" +match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); + +var part820 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(p0,false)}" +match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); + +var part821 = // "Pattern{Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); + +var part822 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(','), Field(fld53,false), Constant(',Permitted application reason: '), Field(fld54,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var part823 = // "Pattern{Constant('"'), Field(,false)}" +match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); + +var part824 = // "Pattern{Constant(' Domain:'), Field(p0,false)}" +match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); + +var part825 = // "Pattern{Constant('is '), Field(p0,false)}" +match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); + +var part826 = // "Pattern{Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); + +var part827 = // "Pattern{Constant('",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); + +var part828 = // "Pattern{Constant(' '), Field(p0,false)}" +match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); + +var part829 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); + +var part830 = // "Pattern{Constant('"'), Field(fld1,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); + +var part831 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); + +var part832 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(p0,false)}" +match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); + +var part833 = // "Pattern{Constant('Source: '), Field(p0,false)}" +match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); + +var part834 = // "Pattern{Constant('"Group: '), Field(group,false), Constant('",Server: '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); + +var part835 = // "Pattern{Constant('Group: '), Field(group,false), Constant(',Server: '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); + +var part836 = // "Pattern{Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(p0,false)}" +match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); + +var part837 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" +match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); + +var part838 = // "Pattern{Field(filename_size,false)}" +match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); + +var part839 = // "Pattern{Constant('Virus found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" +match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); + +var part840 = // "Pattern{Constant('"'), Field(info,false), Constant('",Actual action: '), Field(p0,false)}" +match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); + +var part841 = // "Pattern{Field(info,false), Constant(',Actual action: '), Field(p0,false)}" +match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); + +var part842 = // "Pattern{Constant(''), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); + +var part843 = // "Pattern{Field(info,false)}" +match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); + +var part844 = // "Pattern{Constant(' by policy'), Field(,false)}" +match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); + +var part845 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); + +var part846 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(p0,false)}" +match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); + +var part847 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" +match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); + +var part848 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was denied by user'), Field(fld6,false), Constant('"'), Field(p0,false)}" +match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); + +var part849 = // "Pattern{Constant('''), Field(context,false), Constant('','), Field(p0,false)}" +match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); + +var part850 = // "Pattern{Constant('Security risk found,Computer name: '), Field(p0,false)}" +match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); + +var part851 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" +match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); + +var part852 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false)}" +match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); + +var part853 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); + +var part854 = // "Pattern{Constant('[Antivirus'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); + +var part855 = // "Pattern{Constant('"[Antivirus'), Field(p0,false)}" +match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); + +var part856 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); + +var part857 = // "Pattern{Constant('detection'), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); + +var part858 = // "Pattern{Constant('advanced heuristic detection'), Field(p0,false)}" +match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); + +var part859 = // "Pattern{Constant(' Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); + +var part860 = // "Pattern{Constant('Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" +match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); + +var part861 = // "Pattern{Constant(','), Field(p0,false)}" +match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); + +var part862 = // "Pattern{Constant(''), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" +match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); + +var part863 = // "Pattern{Constant('"'), Field(filename,false), Constant('",User: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); + +var part864 = // "Pattern{Field(filename,false), Constant(',User: '), Field(p0,false)}" +match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); + +var part865 = // "Pattern{Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" +match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); + +var part866 = // "Pattern{Constant('""'), Field(action,true), Constant(' . Description: '), Field(p0,false)}" +match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); + +var part867 = // "Pattern{Field(action,true), Constant(' . Description: '), Field(p0,false)}" +match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); + +var part868 = // "Pattern{Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); + +var part869 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); + +var part870 = // "Pattern{Field(event_description,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); + +var part871 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); + +var part872 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" +match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); + +var select207 = linear_select([ + dup9, + dup10, +]); + +var select208 = linear_select([ + dup50, + dup10, +]); + +var select209 = linear_select([ + dup59, + dup60, + dup61, +]); + +var select210 = linear_select([ + dup63, + dup64, +]); + +var select211 = linear_select([ + dup76, + dup77, +]); + +var select212 = linear_select([ + dup79, + dup80, +]); + +var select213 = linear_select([ + dup90, + dup91, +]); + +var select214 = linear_select([ + dup98, + dup99, +]); + +var select215 = linear_select([ + dup101, + dup102, +]); + +var select216 = linear_select([ + dup105, + dup106, +]); + +var select217 = linear_select([ + dup108, + dup109, +]); + +var select218 = linear_select([ + dup112, + dup113, +]); + +var select219 = linear_select([ + dup140, + dup141, +]); + +var select220 = linear_select([ + dup146, + dup147, +]); + +var select221 = linear_select([ + dup149, + dup150, +]); + +var select222 = linear_select([ + dup159, + dup160, +]); + +var select223 = linear_select([ + dup198, + dup199, +]); + +var select224 = linear_select([ + dup201, + dup202, +]); + +var select225 = linear_select([ + dup203, + dup204, +]); + +var select226 = linear_select([ + dup206, + dup207, +]); + +var select227 = linear_select([ + dup209, + dup210, +]); + +var select228 = linear_select([ + dup211, + dup212, +]); + +var select229 = linear_select([ + dup216, + dup91, +]); + +var select230 = linear_select([ + dup249, + dup226, +]); + +var select231 = linear_select([ + dup252, + dup207, +]); + +var select232 = linear_select([ + dup262, + dup261, +]); + +var select233 = linear_select([ + dup264, + dup265, +]); + +var select234 = linear_select([ + dup266, + dup191, + dup267, + dup176, + dup91, +]); + +var select235 = linear_select([ + dup275, + dup276, +]); + +var select236 = linear_select([ + dup281, + dup282, +]); + +var part873 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" +match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ + dup53, + dup15, +])); + +var part874 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" +match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ + dup43, + dup15, +])); + +var part875 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup43, + dup15, + dup287, +])); + +var part876 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup43, + dup15, + dup287, +])); + +var part877 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup74, + dup15, + dup287, +])); + +var part878 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup74, + dup15, + dup287, +])); + +var part879 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup168, + dup15, + dup287, +])); + +var part880 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup168, + dup15, + dup287, +])); + +var select237 = linear_select([ + dup290, + dup291, + dup292, +]); + +var part881 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var part882 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" +match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ + dup294, + dup295, + dup37, + dup268, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var part883 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" +match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ + dup43, + dup15, + dup353, + dup354, + dup287, + dup300, + dup301, + dup302, +])); + +var part884 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" +match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ + dup43, + dup15, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); + +var part885 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" +match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ + dup43, + dup15, + dup355, + dup287, + dup300, + dup301, + dup307, + dup308, +])); diff --git a/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml b/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml new file mode 100644 index 00000000000..26f7511d6c8 --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for Symantec AntiVirus/Endpoint Protection + +processors: + # ECS event.ingested + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # User agent + - user_agent: + field: user_agent.original + ignore_missing: true + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/x-pack/filebeat/module/symantec/endpointprotection/manifest.yml b/x-pack/filebeat/module/symantec/endpointprotection/manifest.yml new file mode 100644 index 00000000000..84ea3fb0f0c --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/manifest.yml @@ -0,0 +1,31 @@ +module_version: "1.0" + +var: + - name: paths + - name: tags + default: ["symantec.endpointprotection", "forwarded"] + - name: syslog_host + default: localhost + - name: syslog_port + default: 9534 + - name: input + default: udp + - name: community_id + default: true + - name: tz_offset + default: local + - name: rsa_fields + default: true + - name: keep_raw_fields + default: false + - name: debug + default: false + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip +- name: user_agent + plugin: ingest-user_agent diff --git a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log new file mode 100644 index 00000000000..b184d76ca14 --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log @@ -0,0 +1,100 @@ +06:09:59 SymantecServer proident2802.home: Site: https://www.example.com/tia/oloremqu.txt?quis=orisn#cca,Server: dolo1720.api.example,Domain: roinBCS1133.lan,Admin: eataevi,302776834 ^^byC4864.www.host^^nevolu^^equat^^atemsequ^^nci^^1454047799^^high^^eFini^^amco^^exe7309.internal.local^^orsitame^^reprehe^^rsitam^^ommodic^^mipsu^^consec^^taliquip^^psumq^^atcup^^snos^^iquaUte^^tconsec^^nsequat^^taev +%SymantecEP: 303235083^^reetdolo2451.www.example^^rumet5772.mail.corp^^nido^^llam2073.internal.localdomain^^iqu^^ollit^^usan^^aper^^1455282753^^very-high^^olo^^uaera^^sitas4259.mail.corp^^atquovo^^iumto^^aboreetd^^sun^^essecill^^Duisau^^psum^^eriame^^lorema^^avol^^labor^^atuse^^ddoeiu^^enb +February 26 20:15:08 luptat6494.www.example SymantecServer: Site: https://example.org/umdolo/onproide.jpg?oloremi=pitla#ccu,Server: urE6771.www5.example,Domain: agna7678.internal.host,The 302450432 ^^equa3653.internal.host^^errorsi^^des^^rehe^^ume^^1456517708^^medium^^ono^^stru^^olupt3702.www.localhost^^tinvol^^tectobe^^colabor^^iusmodt^^etdolo^^inv^^agnaali^^llitani^^inima^^tlabo^^suntexp^^ugiatnu^^stiae^^nofdeF +03:17:42 SymantecServer onse254.www5.localdomain: tat6349.internal.lan,"[SID: upt] Invalid log record:uiineavo +March 26 10:20:16 emeumfu7783.www5.localhost SymantecServer: utlabore5937.api.localhost,Category: mnisist,sedd,782 ^^uatD +%SymantecEP: 302449409^^rehend1098.host^^numqu3768.internal.lan^^equi^^agnaali^^gnam^^tat^^1460222571^^medium^^lumqui^^itinvo^^mdolore2062.mail.host^^iavolu^^den^^tutla^^olorema^^iades^^siarchi^^datatn^^mqu^^apariat^^tlabore^^untmolli^^remi^^saute^^ercit +%NICWIN-4-Application_45_Symantec: Application,rn=mveleu cid=nofdeFin eid=sequam,temvel Apr 24 00:25:25 2016,ris,Symantec AntiVirus,SYSTEM,Information,nisi6901.mail.home,ecte. string-data=[ Scan type: tinvolu Event: unknown Security risk detected: ntiumdo File: autfu Location: gnaaliq Computer: mni User: rem Action taken:block Date found: icabo] +May 8 07:27:59 uamei2389.internal.example SymantecServer: Site: https://www.example.net/eFi/mexe.html?rpori=ice#oles,Server: edic1626.internal.domain,Domain: ame6223.www5.localhost,Admin: meius,303235076 ^^billo2947.internal.localhost^^umdolo^^uptate^^amc^^cusant^^1462692479^^medium^^orsitam^^siutaliq^^dutp6197.www.test^^nts^^siut^^tconsect^^aquae^^boreetdo^^aturve^^ditemp^^edqui^^nre^^veli^^volupta^^rnatu^^elitse^^ima +14:30:33 SymantecServer tdol6162.internal.localdomain: 302449410 ^^nea2083.www5.localhost^^ncididun^^umSe1918.local^^itau^^apariat^^vitaedi^^lorsita^^1463927433^^medium^^dolore^^onsecte^^nBCSedut1502.www5.example^^gitsed^^fugia^^oditautf^^quatu^^veli^^tenim^^rumet^^verita^^sectet^^etdo^^par^^lorin^^pitl^^por +June 5 21:33:08 niamq2003.mail.local SymantecServer: 302449169 ^^oreetd7668.www5.localdomain^^moenimi^^olupt2189.lan^^con^^preh^^ercit^^etMal^^1465162388^^low^^qui^^ritin^^temporin7150.mail.local^^miu^^rationev^^rem^^asper^^idunt^^luptat^^eveli^^plicab^^oremq^^dicta^^taedicta^^ritt^^iaeco^^equaturv +%NICWIN-4-Application_45_Symantec: Application,rn=liquaUte cid=alorum eid=obeataev,tempor Jun 20 04:35:42 2016,mUten,Symantec AntiVirus,SYSTEM,Information,emq6633.domain,naaliq. string-data=[ Scan type: remeu Event: failure Security risk detected: dtempo File: tin Location: fugitse Computer: imad User: tinvolup Action taken:block Date found: Sedutpe] +11:38:16 SymantecServer rcit2807.mail.invalid: Site: https://www5.example.net/tempor/citatio.jpg?incidid=rure#asiarchi,Server: eaqueips6396.internal.lan,"302452736 ^^utfug7095.api.corp^^iumtot^^lupta^^rsintoc^^reetdo^^1467632296^^high^^mnisiut^^avolu^^Except6889.www.corp^^umetMal^^asper^^umq^^naal^^equun^^sitvo^^temquiav^^obeata^^tatemU^^mad^^onse^^redol^^gnaa^^mod +18:40:50 SymantecServer toditaut7889.internal.invalid: Site: https://api.example.org/eprehend/asnu.htm?mveleum=tamet#perspici,Server: ationul7731.internal.home,Domain: uto5324.lan,Admin: ccae,302452802 ^^orroqu472.www.localhost^^ver^^erc^^umf^^quames^^1468867250^^medium^^esseq^^aincidun^^quatD1370.invalid^^oloreseo^^iruredol^^veniamqu^^licaboN^^atquo^^cupi^^strude^^eritin^^udan^^yCic^^nder^^mdolore^^Cic^^olorema +August 2 01:43:25 oluptat548.www5.invalid SymantecServer: edolorin2164.example,SHA-256:utaliqu,MD-5:rsi,"[SID: taliqui] 303235080 ^^mides4759.api.local^^tcu^^iatqu6203.mail.corp^^urExcep^^ema^^suntex^^iacons^^1470102205^^medium^^esci^^uov^^quaeab2653.mail.localdomain^^dipiscin^^olup^^aco [name]:inimav [class]:acomm [guid]:iutali [deviceID]:itat^^stlaboru^^ate^^mporainc^^xea^^taed^^umdolo^^ntiu^^radipisc^^Cice^^taedi^^tquido +August 16 08:45:59 uptate1049.www.corp SymantecServer: Site: https://www.example.org/tetura/imadmini.jpg?eavol=osamnis#temaccu,Server: scipitl1247.www5.host,Domain: caboNem1043.internal.home,The 302450688 ^^litesseq6785.host^^tob^^dolores^^equamnih^^taliqui^^1471337159^^low^^itempo^^orumw^^redol124.mail.invalid^^radipis^^ctetu^^orinrep^^quiavol^^nrepreh^^ratv^^alorum^^mquisn^^atq^^erspi^^iqu^^niamqu^^equamnih^^icab +15:48:33 SymantecServer tobeatae2512.api.local: Site: https://www.example.org/luptat/deriti.gif?uradi=velitsed#magnaali,Server: mwrit4009.www.localdomain,Domain: equatDu1710.internal.host,303169538 ^^prehe1037.api.example^^eiusmod^^itation^^veleum^^piciatis^^1472572113^^low^^henderi^^iusmodt^^enim5999.mail.localhost^^ersp^^iame^^orroquis^^aquio^^riatu^^loinve^^tanimid^^isnostru^^nofdeFi^^aquioff^^saqu^^remips^^illoi^^reetdolo +September 13 22:51:07 otamrem6743.www5.domain SymantecServer: Site: https://internal.example.com/consecte/pteurs.gif?onulamco=ons#tiaecon,Server: uaturve3425.www.lan,Domain: tiumdol6695.internal.local,The 302449410 ^^CSe4501.example^^nculpaq^^reseosqu1629.mail.lan^^utemvel^^epteur^^ommo^^iame^^1473807067^^medium^^busBonor^^stquido^^rsitvolu3596.www.test^^uameiusm^^adm^^gelitsed^^tiumto^^cor^^odoco^^oin^^itseddoe^^elites^^rum^^erc^^ehende^^tutla^^licaboNe +September 28 05:53:42 nat4367.www5.example SymantecServer: atiset4383.mail.localhost,SHA-256:isiut,MD-5:dtemp,"[SID: ici] 303235081 ^^nisiuta7623.www.local^^dtempo^^atnula^^ditautf^^itametc^^1475042022^^high^^olup^^remipsu^^tan3170.api.example^^doconse^^etdol^^dolorsi^^nturmag^^tura^^osquirat^^equat^^aliquid^^usantiu^^idunt^^atqu^^naturau^^olorsita^^lor +12:56:16 SymantecServer eseruntm4247.mail.local: magnaal5792.www5.domain,Category: nula,quiacons,Cleaned up 7519 LiveUpdate downloaded content +19:58:50 SymantecServer luptatem3834.lan: edq5397.www.test,"[SID: ntut] 302452801 ^^emullam7151.lan^^quiad^^ihilmole^^saquaea^^ons^^1477511930^^high^^quas^^gia^^itatio6735.api.example^^eddoei^^rsin^^rumSec^^orp^^iaturE^^imve^^essequam^^ueporro^^aliqu^^upt^^orum^^Bonoru^^madminim^^ents +November 10 03:01:24 veli578.www.localhost SymantecServer: etdolor1236.mail.invalid,"[SID: mmod] 302449166 ^^iti7029.www.test^^lorsitam^^tanimid^^onpr^^litseddo^^1478746884^^high^^oremqu^^idex^^radip163.mail.invalid^^eiusmo^^ainc^^miurerep^^lestia^^nde^^snu^^inibusB^^nostrud^^cteturad^^ore^^esse^^veniam^^edquian^^sus +10:03:59 SymantecServer vol866.api.domain: bore5546.www.local,Category: labo,lpaquiof,"Active Response that started at quu is disengaged. The traffic from IP address 10.207.125.114 was blocked for 150.301000 second(s). ,Local: 10.175.83.138,Local: scip,Remote: Finibus,Remote: 10.7.164.113,Remote: ncididun,tcp,outbound,,Begin: 2016-11-24 10:03:59,End: 2016-11-24 10:03:59,Occurrences: 1901,Application: est,Location: ali,User: remip, Domain: rere228.invalid +December 8 17:06:33 ent4487.api.test SymantecServer: Site: https://example.org/ulamc/cept.html?radip=rchitect#Dui,Server: iameaqu2429.api.invalid,"302452817 ^^asnulap2567.www5.invalid^^ender^^inc5923.www.test^^oluptat^^roinBCSe^^maperiam^^mSec^^1481216793^^medium^^nseq^^borumSec^^tatemseq5797.home^^tam^^oremip^^eufugi^^dunt^^ames^^amni^^tatio^^amquisno^^modoc^^magnam^^uinesc^^cid^^emi^^Bonorum +00:09:07 SymantecServer enima7673.api.localhost: sequ6424.www.invalid,Category: its,dolor,Local: ,Local: 10.217.91.49,Local: mquis,Remote: lab,Remote: 10.139.207.36,Remote: mwrit,ipv6-icmp,1,Intrusion ID: itse,Begin: 2016-12-23 12:09:07,End: 2016-12-23 12:09:07,Occurrences: 4319,Application: conse,Location: nimadmin,User: lumqui,Domain: quiavolu6301.www5.localhost +January 6 07:11:41 ames645.mail.localhost SymantecServer: Site: https://example.org/tmo/onofdeF.txt?oremip=its#uptasnul,Server: aliqui7541.www5.localdomain,Domain: nse4444.www5.test,Admin: tlabo,501 ^^tatemse4493.mail.local^^lamco^^tion^^10.249.243.41^^ven^^mquisnos^^tnulapa7580.www.domain^^adeser^^uasiarc^^doeiu^^1483686701^^very-high^^uian^^atuserro^^madminim6826.www.host^^3^^onnumqua^^quioff^^iuntN^^ipis^^1483686701^^1483686701^^itautfu^^nesci^^5040^^mquis^^lorsi^^tetura^^eeufug^^edutper^^tevelite^^tocca^^orsitvol^^ntor^^oinBCSed^^oid^^rchit^^tasu^^obeatae^^1886^^midestl^^quatu^^1016^^mqu^^pteursi +January 20 14:14:16 laboree3880.api.invalid SymantecServer: Site: https://www5.example.com/stiaecon/usBono.html?itl=ttenb#olor,Server: quiav6648.lan,302449415 ^^eumfu2149.internal.home^^upidata^^ici182.invalid^^con^^tore^^sequatD^^ercitati^^1484921656^^low^^rinrep^^temse^^caecat4678.www.home^^tatemac^^quisn^^rem^^ulamcola^^remagnaa^^lamcolab^^ceroinB^^umqui^^citation^^temsequi^^mquia^^omnisi^^etMalor^^mco +21:16:50 SymantecServer scipit730.api.example: eruntmo2894.mail.localdomain,"[SID: natus] 302449410 ^^boreet2051.internal.localdomain^^iavo^^ore^^aincidu^^xerc^^1486156610^^very-high^^macc^^ria^^beat2952.internal.localhost^^uisau^^qua^^iarchite^^emsequi^^ueporroq^^ute^^mexer^^iam^^Bonoru^^rcitati^^nula^^ameaquei^^gnama^^esciun +%SymantecEP: 302776321^^eleumi4584.www5.example^^imip7160.www.invalid^^uptateve^^ured3428.www.corp^^abo^^etMa^^cul^^iinea^^1487391564^^very-high^^ditau^^moenimip^^uames7663.internal.local^^lor^^oreeu^^taspe^^eritqui^^atquovol^^evel^^edol^^sequuntu^^quameius^^litse^^san^^apari^^iarchit^^sBonorum +11:21:59 SymantecServer iutal3376.api.corp: Site: https://example.com/idexeac/ntu.txt?ctionofd=mpori#olupt,Server: ola3373.www5.domain,"302449153 ^^qua948.mail.local^^tlaboru^^tec^^itaspe^^con^^1488626519^^high^^amremap^^antiu^^velillum6639.www5.local^^lapari^^Mal^^itinvo^^snulap^^cidu^^hilmol^^oluptate^^todi^^emvel^^pta^^dolo^^itaedi^^hend^^remagna +March 18 18:24:33 dolo5649.www.corp SymantecServer: Site: https://example.org/tMal/porin.gif?isni=quid#aUten,Server: Duis3517.www5.invalid,Domain: conseq6079.www.corp,303235079 ^^tiu3570.www.invalid^^asper^^dictasun3408.internal.invalid^^secte^^ctobeat^^onsec^^idestl^^1489861473^^medium^^pid^^itanimi^^onoru5767.internal.domain^^eosqui^^dipisciv^^uam^^quis^^exe^^naa^^equat^^estiaec^^pitlabo^^tas^^rcitat^^ree^^itten^^quipexea +April 2 01:27:07 ruredol1763.www.local SymantecServer: numq601.api.localhost,"[SID: lapa] 1281 ^^emoenimi +08:29:41 SymantecServer olorsit6165.example: Site: https://www5.example.com/nturm/seq.html?dquia=ora#umfugiat,Server: quisnos7704.api.invalid,Domain: ite5245.mail.lan,The 306 ^^Duis583.api.local^^eavolupt^^uipe6805.www5.domain^^stenat^^uianonnu^^2001:db8::b810cc6d:451c392b^^2001:db8::4f2735dc:6d3ce756^^10.185.64.46^^10.209.205.25^^ptat^^saq^^1492331381^^high^^quame^^orumwri^^atisu6579.test^^rad^^iat^^tqui1142.www5.domain^^4^^2250^^4616^^2^^1492331381^^1492331381^^2536^^niam^^ivelitse^^tatis^^nula^^ptate^^volupta^^01:00:5e:2d:45:c3^^01:00:5e:e5:88:35^^uaerat^^iduntu^^samvol^^equa^^apari^^tsunt^^caecat^^uel^^fficiad^^teirured^^nostru^^rcit +%SymantecEP: 773^^catcupid^^ritquiin +May 14 22:34:50 eumfugia5915.internal.corp SymantecServer: Site: https://internal.example.net/uptat/toditau.htm?quuntur=olup#aeab,Server: uradipis4058.www.domain,Domain: uira3387.internal.localhost,242 ^^quinesc4724.www5.host^^ali^^udexerci6630.mail.test^^osqu^^ptatemse^^itationu^^setquas^^10.202.55.203^^10.35.89.51^^01:00:5e:5f:46:e1^^01:00:5e:14:33:0e^^ameaq^^Quis^^lupta^^1494801290^^very-high^^iav^^umiure^^isiut4530.localdomain^^imvenia^^culp^^deomn904.www.home^^2^^3^^eetdolor^^1494801290^^1494801290^^735^^tla^^iaconseq [Volume]: sed [Model]: sedd [Access]: atione^^tvolup^^oremeu^^lab^^lla^^urau^^aeca^^oNem^^itaedict^^eroi^^onemull^^mdo^^labore^^2001:db8::b54ff32d:af0de540^^2001:db8::11b63689:727d1f3e^^5757^^3320^^7756^^des^^4965^^https://www5.example.org/aliquaU/lits.html?atisetqu=squir#gnaaliq^^https://www.example.com/deriti/edictasu.htm?utlabore=edquiano#mSecti^^henderi^^1.7457^^uel +05:37:24 SymantecServer niamqui7696.mail.test: taliqu701.www.localhost,Category: umfugi,abor,"Traffic Traffic Redirection disabled.,Event time: 2017-5-29 5:37:24 +June 12 12:39:58 aturve1922.internal.test SymantecServer: Site: https://internal.example.com/ore/lors.htm?fdeFi=ratv#veni,Server: metM4820.www.local,Domain: udanti6912.api.localhost,999 ^^cteturad6288.api.home^^nge^^psum^^10.139.89.148^^isnostru^^iad^^ngelits6213.internal.test^^orissusc^^utaliqui^^uov^^1497271198^^medium^^dipisc^^litsed^^lumd4298.mail.localdomain^^3^^iamquisn^^tamrem^^doloremi^^imadm^^1497271198^^1497271198^^ibus^^lumdol^^724^^onnu^^reprehe^^metMa^^emoen^^ptate^^mipsumqu^^turad^^dol^^ntutla^^des^^iciatis^^agn^^cul^^tate^^133^^ipisc^^iatnulap^^7662^^idents^^uine +19:42:33 SymantecServer ction491.www5.local: Site: https://mail.example.net/ate/epteur.htm?ill=imveniam#sunte,Server: exerc121.www5.invalid,Domain: eir4356.www5.host,Admin: undeom,Retry timestamp is equal or over the next schedule time, switching to regular schedule run. +July 11 02:45:07 issu1852.mail.local SymantecServer: atuse559.www.home,Category: tvo,ema,"207 ^^uaera2917.internal.test^^iqua^^ciunt^^exea^^ostrumex^^10.247.21.74^^10.87.92.95^^01:00:5e:80:64:29^^01:00:5e:2c:5b:14^^nim^^Sedutper^^ati^^1499741107^^low^^teturad^^ritq^^tuserror810.www5.corp^^equamni^^fugia^^uptate5787.api.local^^0^^2^^suntincu^^1499741107^^1499741107^^7120^^isiutali^^mdolo^^nof^^usantiu^^periam^^remip^^dexea^^aturExc^^antiumto^^cto^^quamqua^^ulapari^^rittenby^^smoditem +%NICWIN-4-303235080_hen_Symantec AntiVirus: riameaqu^^etd4695.mail.lan^^conse^^ruredolo7392.internal.host^^olors^^roid^^lorum^^iin^^1500976061^^very-high^^lorsita^^naturaut^^mipsu3757.www5.home^^llu^^quaUt^^labor. oris^^tatemse^^uta^^tsun^^samvolu^^dip^^iquaUte^^remi^^modic^^uptatem^^olo^^tametc +16:50:15 SymantecServer iquam1090.api.local: Site: https://example.net/orumSect/preh.txt?iatisund=rnatu#atnonpro,Server: isu3102.mail.test,"5378 ^^sed +23:52:50 SymantecServer prehen4320.api.home: umdolo988.api.corp,Category: eaco,empor,302449158 ^^mvele7557.corp^^Nequepor^^luptate^^aturvel^^ostrumex^^1503445970^^high^^sedquia^^litesse^^ntmo4076.lan^^olore^^ationula^^doconse^^volupta^^ptat^^oreverit^^nimides^^remipsum^^elit^^ites^^uptatema^^amali^^onula^^ostru +September 6 06:55:24 commod6637.api.host SymantecServer: Site: https://example.org/amestqu/aliqua.gif?teirure=dolorsi#dipisciv,Server: nsequun300.internal.lan,Domain: ngelitse7535.internal.lan,The 5377 ^^icta +13:57:58 SymantecServer lup5199.api.example: tectobe1414.www5.localhost,Category: illoin,rinre,"302710785 ^^henderit3374.internal.invalid^^mquae^^amni48.internal.localdomain^^con^^enimadmi^^elit^^uia^^1505915878^^high^^oditautf^^nula^^alo6036.www5.local^^ntiumt^^mdolore^^ita^^aeratvol^^odite^^atn^^sectet^^boreetd^^ueporro^^cto^^essequa^^gnidolor^^itlabori^^amestqui +%NICWIN-4-303235082_turmag_Symantec AntiVirus: dutper^^ingelit3629.mail.domain^^ntin^^tenatus4129.www.local^^intocca^^equuntu^^ntutlab^^eaq^^1507150832^^high^^rcit^^secte^^uredo4613.home^^pitlabor^^upi^^olupta^^ape^^amestqu^^luptas^^ariatu^^psumqui^^trude^^ccusa^^ndeomni^^chite^^obeatae^^rehen +October 19 04:03:07 yCiceroi166.test SymantecServer: Site: https://www5.example.org/colab/itte.html?orumS=tesseq#exeacomm,Server: uptat982.localdomain,Domain: ptatema5373.www5.test,273 ^^tat +%SymantecEP: 302452819^^ptassita3664.api.test^^uovo5035.api.example^^tNequ^^eca^^nev^^sequatu^^1509620741^^high^^iduntut^^admini^^mini3181.api.test^^iamqu^^ommodoc^^mwrit^^dminimve^^madminim^^onse^^ulap^^itaspe^^remagn^^iatisun^^lupta^^stena^^tquid^^liquaUt +18:08:15 SymantecServer rsitam2337.mail.localdomain: tquidolo6928.internal.corp,Category: eetdolo,issuscip,"Commercial application detected,Computer name: iduntu7302.www.invalid,Detection type: medium,Application name: queip,Application type: nsequunt,Application version:1.3638,Hash type:ercitati,Application hash: lapa,Company name: enia,File size (bytes): 7843,Sensitivity: deserun,Detection score:ugia,Submission recommendation: isiuta,Permitted application reason: eFi,Source: elitsedd,Risk name: isqu,Occurrences: 7744,eumfu,"remap",Actual action: accept,Requested action: yCicero,Secondary action: dqui,Event time: 2017-11-16 6:08:15,Inserted: 2017-11-16 6:08:15,End: 2017-11-16 6:08:15,Domain: ema7531.api.example,"Group: eiusm,Server: assit1598.www5.invalid,User: archite,Source computer: eruntm,Source IP: 10.8.143.229 +December 1 01:10:49 acomm6048.internal.host SymantecServer: liquid1981.www.home,"[SID: sequatu] 302449178 ^^icero1297.internal.domain^^asun^^rsitam^^magn^^amcola^^1512090649^^medium^^sno^^stiaeco^^equu7361.www5.localdomain^^nto^^non^^pta^^asnul^^uirati^^chitect^^uam^^tisunde^^porr^^piscivel^^ueporr^^udex^^ipexeac^^uin +08:13:24 SymantecServer nsectetu3212.test: umdolo4405.local,Category: econ,equat,501 ^^bor5601.www.invalid^^animi^^mdoloree^^10.137.5.67^^taliqui^^doloremi^^uisno4545.www5.corp^^atisund^^isnostru^^quepo^^1513325604^^very-high^^nisi^^onsecte^^iono5777.invalid^^1^^Nequepo^^veleum^^eturad^^tor^^1513325604^^1513325604^^hender^^moditemp^^885^^ipsum^^com^^uptate^^tevelite^^cto^^borisn^^assitasp^^nima^^abore^^tur^^tlaboru^^erun^^mquid^^imipsamv^^3758^^totamrem^^eaqu^^5072^^uunturma^^namaliqu +15:15:58 SymantecServer upidatat5004.internal.test: Site: https://example.com/tatem/umexe.gif?lor=busBo#turm,Server: quamei7815.api.home,Domain: qua6831.internal.test,Admin: xeacomm,5122 ^^oriosa +22:18:32 SymantecServer ecatcup2068.invalid: quinesc2102.www.invalid,Category: asiarch,tob,4609 ^^Sending Email Failed for following email address [tiae]. +January 27 05:21:06 ainci5661.internal.local SymantecServer: ntu1279.mail.lan,SHA-256:dut,MD-5:aecons,"[SID: tionemu] 207 ^^edictasu3521.invalid^^eFini^^mnis^^tametco^^snisiut^^10.92.93.236^^10.66.203.117^^01:00:5e:54:c0:38^^01:00:5e:94:22:bc^^oloremag^^uisa^^umquidol^^1517030466^^medium^^erit^^uaea^^adminima6097.corp^^sitvolup^^tionem^^agnamali3222.example^^2^^2^^onsequ^^1517030466^^1517030466^^3168^^ehen^^remap^^mUt^^admi^^siarch^^oloremi^^ididu^^uov^^ncidid^^audantiu^^lmolest^^miurerep^^orsitame^^Sed +February 10 12:23:41 cons4129.api.corp SymantecServer: Site: https://internal.example.org/ssecil/xplic.htm?cipitl=ame#tenat,Server: etur5170.mail.localdomain,Domain: oquisq4993.api.domain,302452807 ^^seosqui7376.internal.home^^edolori^^equ2353.internal.local^^utlab^^entoreve^^lmolest^^ser^^1518265421^^low^^autodita^^loreme^^eratv6521.example^^meaqu^^tlaboree^^dolorsi^^etdolore^^taevita^^rationev^^catcup^^ectetur^^cons^^spiciati^^upidata^^utlabo^^lillumq^^erc +19:26:15 SymantecServer nonnumqu2938.mail.localdomain: Site: https://www5.example.net/uasiarch/tru.txt?eetdolo=erro#uptat,Server: con594.www5.home,Domain: ididu284.api.home,302776321 ^^pre865.www5.home^^prehe^^bori7611.invalid^^neavolu^^mexe^^xcep^^uscipi^^1519500375^^very-high^^tNeq^^nimi^^iset1992.internal.example^^sequu^^ffic^^imadmini^^isnostru^^ostr^^tinvo^^lorumwr^^iaco^^sumdol^^riat^^nim^^imven^^isci^^iusmo +%NICWIN-4-No_bill_Symantec AntiVirus: No old risk events got swept. +09:31:24 SymantecServer tsed6598.mail.test: scipit581.api.example,Category: mni,nti,302449413 ^^iste5901.mail.localhost^^exer^^paqui^^Cice^^liqui^^1521970284^^very-high^^Dui^^tam^^ntin2655.www.localdomain^^itation^^itasper^^epo^^mmodico^^moll^^meaqueip^^nculpaq^^mides^^iconseq^^nidolo^^runtmoll^^tuserror^^utlabo^^scip +16:33:58 SymantecServer utfugi6811.mail.host: Site: https://www.example.org/amqua/mavenia.txt?atnu=ssuscipi#evita,Server: tconsect7649.internal.domain,Domain: lors1204.corp,Admin: volupta,302449414 ^^dolor1769.lan^^dminimav^^odtem^^tati^^suscip^^1523205238^^high^^umqu^^ntexpli^^siuta395.home^^lorumwr^^fugiat^^iumdolor^^etcons^^aecatc^^agnaa^^minimven^^pisciv^^equamnih^^rationev^^etco^^usanti^^itessec^^dat +23:36:32 SymantecServer nimadmi5274.api.localdomain: Configuration Change..umdolore5014.api.lan..4/22/2018........low..oluptate..11:36:32 tcu.. +06:39:06 SymantecServer ept2114.corp: tiumdo6437.internal.invalid,Category: ssusci,snostrud,"2 ^^tisund4302.www5.local^^obeata796.www.localhost^^olo^^vel1911.lan^^10.147.225.53^^itaspern^^lupta^^dolor^^tNeque^^accept^^2018-05-07T06:39:06Z^^etdo^^edictas^^1554^^corpor^^urerepr +%SymantecEP-ctetura: equamn6846.www5.invalid^^3210^^ssecillu^^773 ^^oeius +20:44:15 SymantecServer pisci6637.www.test: Site: https://www.example.org/dolo/orem.html?elite=nde#iac,Server: turve824.mail.corp,Domain: llumquid5568.internal.host,5377 ^^adolors +03:46:49 SymantecServer nemulla5602.mail.localhost: 303169540 ^^emipsum4052.internal.invalid^^ciatisu^^evelites2448.www.host^^uid^^Bono^^citatio^^aliquide^^1529380009^^medium^^onsequa^^seddoe^^quisnost7124.api.domain^^tla^^uidexea^^odtem^^nvolupt^^stia^^neavolu^^tsedqui^^ueporroq^^writ^^ema^^ioffici^^agni^^tat^^metconse +10:49:23 SymantecServer riame5318.www5.example: Site: https://internal.example.com/itinvolu/urerepre.jpg?ditem=did#BCS,Server: idex58.api.host,Domain: iaturEx4974.api.localdomain,207 ^^ita2191.www5.invalid^^amquis^^iatquovo4868.test^^uraut^^reetdol^^umtotam^^itaedi^^10.72.200.11^^10.132.171.142^^01:00:5e:ef:6c:af^^01:00:5e:5b:b9:9d^^tsunti^^ero^^iusmodi^^1530614963^^high^^caecat^^oreetd^^madmi2948.internal.lan^^eleumiur^^ididun^^edi6108.internal.domain^^1^^3^^squa^^1530614963^^1530614963^^4662^^atisetq^^emagnama^^stqui^^itemp^^ipsa^^ipsumqui^^tisu^^nse^^sci^^itse^^tco^^nnumqua^^erit^^lorsitam^^2001:db8::325d4a06:86d5f940^^2001:db8::d5c0e730:7529c510^^4574^^1953^^7096^^quaera^^5100^^https://mail.example.com/ulamc/ncid.jpg?emipsu=icaboNem#Except^^https://internal.example.org/maliquam/mav.gif?ecill=ventore#imi^^uptatemU^^1.132^^liqua +%NICWIN-4-Application_45_Symantec: Application,rn=nesciu cid=cer eid=molestia,volu Jul 17 17:51:58 2018,occ,Symantec AntiVirus,SYSTEM,Information,reverita794.mail.domain,ten. string-data=[ Scan type: cola Event: success Security risk detected: ame File: que Location: sect Computer: ing User: nis Action taken:cancel Date found: billoinv] +August 1 00:54:32 col6521.mail.domain SymantecServer: Site: https://mail.example.com/enby/teveli.html?dolor=CSedut#atatn,Server: utal7661.www.test,Domain: caecatcu5496.www.test,The 302452743 ^^tec4011.mail.home^^ate^^uptatem^^siarchi^^dminim^^1533084872^^very-high^^Nemo^^itse^^lillumq4387.www5.localhost^^Qui^^turExce^^sse^^quine^^utemvel^^exercita^^emaperi^^aspernat^^ddoei^^nihi^^umfu^^inesc^^uiavolu^^loremagn +%NICWIN-4-Application_45_Symantec: Application,rn=nostru cid=edd eid=nisi,sciun Aug 15 07:57:06 2018,natuserr,Symantec AntiVirus,SYSTEM,Information,ipi563.api.lan,asnulap. string-data=[ Scan type: atnula Event: failure Security risk detected: dutpe File: modtem Location: eriameaq Computer: irured User: anti Action taken:accept Date found: tani] +14:59:40 SymantecServer uptatemU1147.mail.corp: mqu3327.internal.host,Category: plic,oremq,"Connection reset +22:02:15 SymantecServer remape5128.internal.home: Site: https://www5.example.org/eosq/tanimi.htm?lumdolo=volu#eser,Server: quisn1387.invalid,302452736 ^^sit3373.api.localdomain^^isnos^^emp42.mail.test^^ipisc^^roinB^^olori^^omm^^1536789735^^medium^^rissus^^abo^^ecatcupi4759.internal.local^^atevelit^^tenb^^ritati^^architec^^era^^ptatem^^remaperi^^isi^^ssecill^^tisetq^^mmodico^^mquae^^sunde^^sum +September 27 05:04:49 tatema826.www.localhost SymantecServer: mco1751.www.localdomain,SHA-256:tation,MD-5:tot,"[SID: veleumi] 5377 ^^iumt +October 11 12:07:23 sciun6000.www.test SymantecServer: dictasu7340.internal.invalid,"[SID: Cicero] 302450944 ^^antiu4203.www.host^^asnulapa^^hende^^olesti^^ntmolli^^1539259643^^low^^eufu^^tame^^ipsu7538.www5.host^^acom^^lamc^^squa^^Cic^^aturveli^^lica^^Exc^^amvolup^^velill^^oidentsu^^uaea^^rehender^^rep^^iusmod +19:09:57 SymantecServer aevitaed6618.localhost: labor3547.www5.localhost,"[SID: erci] 257 ^^quovolup +November 9 02:12:32 tlaborio5210.www5.lan SymantecServer: seq3479.internal.domain,SHA-256:uto,MD-5:eetdo,"[SID: untincul] 301 ^^upta3770.internal.localhost^^ore^^onse^^10.40.133.90^^10.171.13.85^^tateveli^^sequatu^^1541729552^^medium^^dex^^rsintocc^^iusmo5734.internal.invalid^^tion^^itae^^dita2048.www5.home^^4^^1467^^5002^^1^^1541729552^^1541729552^^5934^^usci^^3^^rittenby^^Block all other IP traffic and log^^gni^^ritq^^01:00:5e:57:68:87^^01:00:5e:31:f2:97^^mqu^^bor^^piscinge^^ectobe^^uisaute^^orema^^poris^^uptat^^colabor^^bor^^sequ^^noru +November 23 09:15:06 cons392.domain SymantecServer: Site: https://www.example.com/aecatcu/sed.html?eroi=snu#tconsect,Server: stru3362.corp,"Retry timestamp is over the maximum retry window, switching to regular schedule run. +16:17:40 SymantecServer tionevol7606.www.localhost: Site: https://api.example.net/sunti/dipiscin.htm?ovolup=olest#veniamq,Server: uisno561.internal.home,"302452816 ^^omm3591.internal.invalid^^edq^^ngelits2743.www5.host^^incidunt^^tatnonp^^abi^^nimave^^1544199460^^high^^idexeaco^^siu^^inrepr7369.www.domain^^ore^^lore^^tatemac^^tamet^^laparia^^quid^^ehen^^eseru^^aperiam^^uioffic^^atis^^ectobe^^rehender^^corpori +December 21 23:20:14 cons7043.api.lan SymantecServer: Site: https://api.example.net/utlab/hilm.txt?lor=untutla#ons,Server: uam6380.internal.lan,302452808 ^^sed1665.internal.local^^rainci^^olupt717.invalid^^iano^^dexerci^^fdeFi^^tlabori^^1545434414^^very-high^^ritquiin^^untutl^^alorum1804.mail.test^^sequatur^^psum^^ano^^ame^^cipitlab^^venia^^rroquis^^tisu^^ratione^^aturvel^^Neque^^ueipsa^^assit^^ffici +%NICWIN-4-Application_45_Symantec: Application,rn=itquii cid=umdolore eid=iuntNequ,corp Jan 5 06:22:49 2019,trudexe,Symantec AntiVirus,SYSTEM,Information,queporr7029.internal.test,quidex. string-data=[ Scan type: iatqu Event: unknown Security risk detected: ips File: modo Location: ela Computer: con User: unti Action taken:block Date found: tcupidat] +13:25:23 SymantecServer veli765.www.corp: Site: https://www.example.net/queip/antiu.txt?nisiuta=cipitla#ditautf,Server: oluptasn909.www5.example,Domain: imadm2803.api.local,Admin: eet,5121 ^^onpro +%SymantecEP: 302^^exea6833.www.example^^ictas1247.www5.example^^incul^^iadol^^10.31.231.57^^10.155.163.6^^que^^urQui^^1549139277^^low^^taliquip^^maliquam^^upidat1328.internal.localhost^^odico^^sistenat^^urExcep6087.www5.localhost^^1^^6324^^558^^1^^1549139277^^1549139277^^2952^^mqu^^doloremq^^velil^^mdolo^^poris^^amvo^^01:00:5e:fc:5b:c7^^01:00:5e:e9:19:80^^imv^^norumetM^^iac^^itessequ^^iaturExc^^orsit^^tamrema^^eos^^quameius^^ciati^^nemullam^^sequu +%SymantecEP-eleumiur: chite5632.test^^1981^^etc^^4097 ^^lorem +10:33:06 SymantecServer mveleum2688.api.host: 302452816 ^^nisiut1750.internal.invalid^^oen^^tsunti^^alorum^^aeratvo^^1551609186^^high^^les^^paquioff^^tesseci33.internal.example^^Bonorum^^met^^nost^^sequa^^dquiaco^^mmodoco^^emagn^^susci^^eursin^^siutali^^osa^^olabor^^ent^^secil +17:35:40 SymantecServer stiaecon2284.www5.host: Site: https://internal.example.net/agnama/commodi.gif?snost=nsequun#quovo,Server: amquaera63.www5.lan,Domain: audant2228.invalid,302452736 ^^ptasnula2158.internal.host^^uptasnul^^redol^^esciu^^dolorinr^^1552844140^^very-high^^auto^^edquian^^alo7567.www5.test^^umquid^^proident^^quisnos^^umet^^nima^^aria^^ugi^^econ^^aaliquaU^^sitvol^^temse^^henderi^^Sedu^^dolore +00:38:14 SymantecServer metMal6112.mail.test: Site: https://api.example.net/orsit/ntium.html?rudexer=Exc#atvol,Server: onse3264.example,Domain: scingeli5972.invalid,The 275 ^^The process sumq.exe can not lock the process status table. The process status has been locked by the server idest4209.api.domain (mdolorem) since 2019-04-01T00:38:14Z. +April 15 07:40:49 amqu4988.www5.example SymantecServer: Site: https://www5.example.net/scinge/ofde.html?oinvento=amcorpor#sumqu,Server: sundeomn1396.mail.corp,Domain: odiconse1995.www.home,The 301 ^^emvel4391.localhost^^quelaud^^exer3621.www5.test^^uaerat^^animid^^2001:db8::dc285270:4466123b^^2001:db8::3d31ae1d:efe5bf87^^10.216.134.62^^10.134.6.246^^rnatu^^ico^^1555314049^^medium^^urQuis^^umetMa^^tisetqua6007.api.home^^dun^^nonpro^^its1301.www.test^^1^^6252^^998^^2^^1555314049^^1555314049^^4304^^quuntu^^0^^uaera^^iatisund^^ist^^equatur^^01:00:5e:78:f9:ee^^01:00:5e:db:43:45^^oin^^ntexpl^^oquisqua^^ovo^^lupta^^stenatus^^tiumtota^^itation^^eturad^^rumS^^nihil^^psu +Apr 29 2:43:23 ventorev7571.www5.corp SymantecServer: Site: https://www5.example.com/quamni/ents.gif?leum=olabor#modte,Server: uianonn4552.internal.invalid,Domain: quaUteni2026.lan,Remote: , Remote: untmoll,Remote: 10.202.96.232,Remote: ngeli,Unknown,OTHERS,,Begin: 2019-4-29 2:43:23,End: 2019-4-29 2:43:23,Occurrences: 569,Application: exerc,Location: boNemo,User: nat,Domain: atnu2000.internal.corp,Local Port 4012,Remote Port 5074,CIDS Signature ID: 5057,CIDS Signature string: tobe,CIDS Signature SubID: equep,Intrusion URL:https://internal.example.com/umiu/veritat.jpg?conse=equamni#ursin,Intrusion Payload URL:orissus +21:45:57 SymantecServer uelaud897.mail.example: Site: https://example.org/etcon/its.html?imven=eddoeius#eniamqu,Server: mdoloree4076.lan,"302449156 ^^uamestqu7272.internal.host^^ectetur^^umSectio5136.www.local^^omn^^imidestl^^sequat^^lmol^^1557783957^^very-high^^olorinre^^quiacons^^untexpli391.internal.domain^^Finibus^^num^^ipitlabo^^sumqu^^epreh^^urs^^stquidol^^doconse^^taspern^^cit^^isautemv^^tatemse^^uradi^^velit +04:48:31 SymantecServer reetdo5853.test: entsun4896.www5.localdomain,Category: uepo,eomni,"308 ^^cepteur6876.internal.host^^iutaliq^^quide2790.mail.invalid^^epre^^quis^^2001:db8::7d97d66e:3eeaa2cc^^2001:db8::81638ee3:4962a1e4^^10.56.95.160^^10.29.149.77^^siutaliq^^liquaUt^^1559018911^^low^^modo^^sequ^^eniamqu1863.api.lan^^utal^^maccusa^^quipex2615.www5.localhost^^3^^2305^^5823^^1^^1559018911^^1559018911^^3992^^Section^^ididunt^^luptatem^^Block all other IP traffic and log^^onofdeFi^^xeacom^^01:00:5e:9f:99:04^^01:00:5e:96:a7:ec^^aveni^^rema^^nby^^nofde^^ritinvol^^mSecti^^tionula^^adolors^^cididunt^^dolore^^sunte^^imadm +11:51:06 SymantecServer uscipitl2176.api.test: Site: https://mail.example.com/peria/nculpaq.gif?roquisqu=acommod#eetd,Server: orin7130.www5.test,Domain: ratione4963.www.example,301 ^^tationul5346.internal.localdomain^^edquiano^^ugia146.www5.corp^^uisnostr^^lit^^2001:db8::f3063373:92b97c88^^2001:db8::5b387f17:aa0c6698^^10.70.185.238^^10.173.98.74^^orsitame^^quame^^1560253866^^high^^tempora^^liquip^^tionul7555.www5.lan^^cin^^itsedqu^^remipsum5485.api.local^^2^^1775^^5161^^2^^1560253866^^1560253866^^2128^^lupta^^0^^reetdo^^Block all other IP traffic and log^^gnaal^^ntsunt^^01:00:5e:a7:37:7d^^01:00:5e:f3:43:d1^^nvo^^tenby^^aaliqu^^quaeabil^^umq^^ptate^^ade^^eip^^entor^^turExce^^ncidid^^modi +%NICWIN-4-Application_45_Symantec: Application,rn=nisiutal cid=ptassi eid=mtota,lit Jun 25 18:53:40 2019,odite,Symantec AntiVirus,SYSTEM,Information,ilmoles4582.api.lan,tqui. string-data=[ Scan type: tautfug Event: success Security risk detected: metMalo File: uatur Location: uia Computer: upid User: dolor Action taken:allow Date found: itsed] +01:56:14 SymantecServer giatquo3267.www.lan: quiado6095.mail.localhost,Category: ioffici,proide,"Connected to Management Server 10.8.24.150. +July 24 08:58:48 aut1615.mail.example SymantecServer: tatis3791.www5.test,SHA-256:iceroinB,MD-5:lab,"[SID: tobe] 2 ^^odite7850.internal.corp^^asnula6304.internal.example^^elitse^^cidun7605.www5.example^^10.201.112.171^^rinrepre^^modicons^^uidolor^^tenatu^^deny^^2019-07-24T08:58:48Z^^rrorsit^^eprehen^^1470^^diconseq^^runtm +%SymantecEP: 302448900^^tion595.internal.corp^^laboru6211.mail.local^^emporai^^mqu^^ationu^^gna^^1565193683^^medium^^temUt^^quaturQ^^ssitasp7492.test^^veri^^ssitaspe^^eserun^^niamqu^^quianonn^^uines^^rat^^mSect^^perspic^^mulla^^vol^^consect^^iqu^^uptate +23:03:57 SymantecServer ntsun948.home: ima1551.www.invalid,"[SID: atemse] 302452802 ^^ntiumtot6232.api.corp^^npro^^estq2131.api.localdomain^^atn^^luptasnu^^tasu^^exeac^^1566428637^^very-high^^itesse^^gitse^^rem6392.internal.domain^^amea^^upt^^did^^rspiciat^^iaec^^lab^^nimi^^uscipit^^tuserror^^ionul^^exercit^^tetur^^ion^^olu +06:06:31 SymantecServer ididuntu2165.api.host: Site: https://internal.example.net/ommo/ddoeius.htm?ten=turadipi#liquide,Server: remipsum2332.api.domain,Domain: gel3984.mail.example,The 303235079 ^^ree4785.internal.localdomain^^edolori^^giatq7007.www.domain^^ntinc^^ptatev^^orumSec^^totamr^^1567663591^^very-high^^pidatat^^perna^^upi3.www.home^^temUten^^iquaUt^^caecatc^^ationula^^abo^^onofde^^eriame^^sunde^^otamrema^^madminim^^orsitam^^tiumto^^psumdol^^atcup +%SymantecEP-orem: 10.90.66.238^^itess2258.api.lan^^eprehend3993.internal.test^^nulap^^ianonnu4387.www.domain^^10.59.140.108^^5^^^^llumdolo^^sequines^^reprehe^^block^^2019-09-19T13:09:05Z^^agna^^laud^^5043^^abor^^esse +October 3 20:11:40 identsu4913.mail.localdomain SymantecServer: Site: https://api.example.com/uptatemq/ctionof.jpg?risni=ovolupt#tionu,Server: ntium1347.www.test,Domain: econse4373.www.invalid,221 ^^tdo6940.mail.local^^fugiat^^epteur5858.www5.local^^rissus^^consequa^^idolor^^ratvo^^10.38.136.160^^10.45.116.216^^01:00:5e:b5:7b:f4^^01:00:5e:38:9e:75^^psu^^epr^^citat^^1570133500^^low^^imad^^vol^^rin5257.www5.test^^psa^^sumquia^^ess3012.mail.test^^1^^1^^mnisiste^^1570133500^^1570133500^^490^^elitess^^emeumfu^^tMalorum^^oremip^^orsitvo^^eacomm^^iuntNeq^^uiadolor^^emUt^^epreh^^eritq^^uaeratv^^quiaco^^todi^^2001:db8::655ca99c:30b2c2da^^2001:db8::16767bb2:194dacee^^4364^^7638^^1297^^osam^^2852^^https://mail.example.com/quaeabil/uredolo.htm?atnul=eroinB#beataev^^https://internal.example.org/aaliqua/atiset.txt?tat=uamestq#eri^^amv^^1.6400^^mveni +October 18 03:14:14 quiadolo7345.www5.example SymantecServer: Site: https://www.example.com/cte/ntu.gif?ercitati=dolo#iutaliq,Server: inimv3115.api.local,"302449409 ^^eumfug6647.home^^equ^^ptatemse^^onulamc^^itanim^^1571368454^^low^^metco^^oremeumf^^aed3193.api.lan^^animid^^sunti^^equa^^rure^^quat^^inim^^corp^^inBCSedu^^ptassita^^ritt^^magna^^tatemq^^sequ^^quii +November 1 10:16:48 eritin5441.api.example SymantecServer: Site: https://www5.example.org/cid/aturauto.gif?ciduntut=ita#identsu,Server: uep5156.mail.invalid,257 ^^atemq +November 15 17:19:22 udexerci658.mail.test SymantecServer: aveniamq3804.api.corp,Category: quaturQ,tenat,"302449166 ^^lillumqu7256.www5.invalid^^audantiu^^pici^^deFinibu^^pitlab^^1573838362^^low^^sum^^tamre^^rumSec5271.home^^erspi^^evolupt^^unt^^emaper^^nse^^temUt^^onseq^^icia^^amnihilm^^isquames^^evelite^^eumfugia^^roquis^^porinci +%NICWIN-4-Application_45_Symantec: Application,rn=eaco cid=piscing eid=reseosqu,acommo Nov 30 00:21:57 2019,tiaecons,Symantec AntiVirus,SYSTEM,Information,volu7499.www5.localhost,edutpe. string-data=[ Scan type: uip Event: unknown Security risk detected: redolori File: Uteni Location: sitamet Computer: duntu User: sedqui Action taken:block Date found: rnatu] +07:24:31 SymantecServer seosq1937.internal.localdomain: Site: https://internal.example.net/eca/uidolor.gif?nostru=tatemacc#cididu,Server: hil1908.mail.localdomain,Domain: porissu4165.example,Admin: dolore,302449409 ^^mol400.domain^^aud^^oNem5850.www.example^^yCiceroi^^atis^^esciuntN^^tNequepo^^1576308271^^very-high^^mnisi^^emporai^^gnama2349.mail.domain^^eritinvo^^ntiu^^ccusan^^ura^^pida^^remeumf^^ipexeaco^^itvo^^psumquia^^nisisten^^quamqu^^ecillumd^^tatisetq^^con diff --git a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json new file mode 100644 index 00000000000..c35bd2dbb66 --- /dev/null +++ b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json @@ -0,0 +1,3458 @@ +[ + { + "event.code": "atemsequ", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "06:09:59 SymantecServer proident2802.home: Site: https://www.example.com/tia/oloremqu.txt?quis=orisn#cca,Server: dolo1720.api.example,Domain: roinBCS1133.lan,Admin: eataevi,302776834 ^^byC4864.www.host^^nevolu^^equat^^atemsequ^^nci^^1454047799^^high^^eFini^^amco^^exe7309.internal.local^^orsitame^^reprehe^^rsitam^^ommodic^^mipsu^^consec^^taliquip^^psumq^^atcup^^snos^^iquaUte^^tconsec^^nsequat^^taev", + "fileset.name": "endpointprotection", + "host.hostname": "exe7309.internal.local", + "input.type": "log", + "log.level": "high", + "log.offset": 0, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "rsitam", + "rsa.internal.messageid": "302776834", + "rsa.misc.event_source": "reprehe", + "rsa.misc.reference_id": "atemsequ", + "rsa.misc.severity": "high", + "rsa.network.domain": "byC4864.www.host", + "server.domain": "byC4864.www.host", + "service.type": "symantec", + "source.address": "exe7309.internal.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "usan", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 303235083^^reetdolo2451.www.example^^rumet5772.mail.corp^^nido^^llam2073.internal.localdomain^^iqu^^ollit^^usan^^aper^^1455282753^^very-high^^olo^^uaera^^sitas4259.mail.corp^^atquovo^^iumto^^aboreetd^^sun^^essecill^^Duisau^^psum^^eriame^^lorema^^avol^^labor^^atuse^^ddoeiu^^enb", + "fileset.name": "endpointprotection", + "group.name": "iqu", + "host.hostname": "sitas4259.mail.corp", + "host.name": "llam2073.internal.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 401, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "aboreetd", + "rsa.internal.messageid": "303235083", + "rsa.misc.event_source": "iumto", + "rsa.misc.group": "iqu", + "rsa.misc.reference_id": "usan", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "llam2073.internal.localdomain" + ], + "rsa.network.domain": "rumet5772.mail.corp", + "server.domain": "rumet5772.mail.corp", + "service.type": "symantec", + "source.address": "sitas4259.mail.corp", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "rehe", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "February 26 20:15:08 luptat6494.www.example SymantecServer: Site: https://example.org/umdolo/onproide.jpg?oloremi=pitla#ccu,Server: urE6771.www5.example,Domain: agna7678.internal.host,The 302450432 ^^equa3653.internal.host^^errorsi^^des^^rehe^^ume^^1456517708^^medium^^ono^^stru^^olupt3702.www.localhost^^tinvol^^tectobe^^colabor^^iusmodt^^etdolo^^inv^^agnaali^^llitani^^inima^^tlabo^^suntexp^^ugiatnu^^stiae^^nofdeF", + "fileset.name": "endpointprotection", + "host.hostname": "olupt3702.www.localhost", + "input.type": "log", + "log.level": "medium", + "log.offset": 692, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "colabor", + "rsa.internal.messageid": "302450432", + "rsa.misc.event_source": "tectobe", + "rsa.misc.reference_id": "rehe", + "rsa.misc.severity": "medium", + "rsa.network.domain": "equa3653.internal.host", + "server.domain": "equa3653.internal.host", + "service.type": "symantec", + "source.address": "olupt3702.www.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "Invalid", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "03:17:42 SymantecServer onse254.www5.localdomain: tat6349.internal.lan,\"[SID: upt] Invalid log record:uiineavo", + "fileset.name": "endpointprotection", + "host.hostname": "tat6349.internal.lan", + "host.name": "onse254.www5.localdomain", + "input.type": "log", + "log.offset": 1109, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.db.index": "uiineavo", + "rsa.internal.event_desc": "Invalid log record", + "rsa.internal.messageid": "Invalid", + "rsa.network.alias_host": [ + "onse254.www5.localdomain" + ], + "rsa.time.event_time_str": "03:17:42", + "service.type": "symantec", + "source.address": "tat6349.internal.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "782", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "March 26 10:20:16 emeumfu7783.www5.localhost SymantecServer: utlabore5937.api.localhost,Category: mnisist,sedd,782 ^^uatD", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 1220, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "uatD", + "rsa.internal.messageid": "782", + "rsa.misc.reference_id": "782", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "gnam", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 302449409^^rehend1098.host^^numqu3768.internal.lan^^equi^^agnaali^^gnam^^tat^^1460222571^^medium^^lumqui^^itinvo^^mdolore2062.mail.host^^iavolu^^den^^tutla^^olorema^^iades^^siarchi^^datatn^^mqu^^apariat^^tlabore^^untmolli^^remi^^saute^^ercit", + "fileset.name": "endpointprotection", + "host.hostname": "mdolore2062.mail.host", + "input.type": "log", + "log.level": "medium", + "log.offset": 1342, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "tutla", + "rsa.internal.messageid": "302449409", + "rsa.misc.event_source": "den", + "rsa.misc.reference_id": "gnam", + "rsa.misc.severity": "medium", + "rsa.network.domain": "numqu3768.internal.lan", + "server.domain": "numqu3768.internal.lan", + "service.type": "symantec", + "source.address": "mdolore2062.mail.host", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=mveleu cid=nofdeFin eid=sequam,temvel Apr 24 00:25:25 2016,ris,Symantec AntiVirus,SYSTEM,Information,nisi6901.mail.home,ecte. string-data=[ Scan type: tinvolu Event: unknown Security risk detected: ntiumdo File: autfu Location: gnaaliq Computer: mni User: rem Action taken:block Date found: icabo]", + "file.directory": "ntiumdo", + "file.name": "autfu", + "fileset.name": "endpointprotection", + "host.hostname": "nisi6901.mail.home", + "input.type": "log", + "log.offset": 1597, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "rem" + ], + "rsa.internal.event_desc": "ecte", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.event_type": "tinvolu", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "unknown", + "service.type": "symantec", + "source.address": "nisi6901.mail.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "rem" + }, + { + "event.code": "amc", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "May 8 07:27:59 uamei2389.internal.example SymantecServer: Site: https://www.example.net/eFi/mexe.html?rpori=ice#oles,Server: edic1626.internal.domain,Domain: ame6223.www5.localhost,Admin: meius,303235076 ^^billo2947.internal.localhost^^umdolo^^uptate^^amc^^cusant^^1462692479^^medium^^orsitam^^siutaliq^^dutp6197.www.test^^nts^^siut^^tconsect^^aquae^^boreetdo^^aturve^^ditemp^^edqui^^nre^^veli^^volupta^^rnatu^^elitse^^ima", + "fileset.name": "endpointprotection", + "host.hostname": "dutp6197.www.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 1945, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "tconsect", + "rsa.internal.messageid": "303235076", + "rsa.misc.event_source": "siut", + "rsa.misc.reference_id": "amc", + "rsa.misc.severity": "medium", + "rsa.network.domain": "billo2947.internal.localhost", + "server.domain": "billo2947.internal.localhost", + "service.type": "symantec", + "source.address": "dutp6197.www.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "vitaedi", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "14:30:33 SymantecServer tdol6162.internal.localdomain: 302449410 ^^nea2083.www5.localhost^^ncididun^^umSe1918.local^^itau^^apariat^^vitaedi^^lorsita^^1463927433^^medium^^dolore^^onsecte^^nBCSedut1502.www5.example^^gitsed^^fugia^^oditautf^^quatu^^veli^^tenim^^rumet^^verita^^sectet^^etdo^^par^^lorin^^pitl^^por", + "fileset.name": "endpointprotection", + "group.name": "itau", + "host.hostname": "nBCSedut1502.www5.example", + "host.name": "umSe1918.local", + "input.type": "log", + "log.level": "medium", + "log.offset": 2368, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "oditautf", + "rsa.internal.messageid": "302449410", + "rsa.misc.event_source": "fugia", + "rsa.misc.group": "itau", + "rsa.misc.reference_id": "vitaedi", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "umSe1918.local" + ], + "rsa.network.domain": "nea2083.www5.localhost", + "server.domain": "nea2083.www5.localhost", + "service.type": "symantec", + "source.address": "nBCSedut1502.www5.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "ercit", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "June 5 21:33:08 niamq2003.mail.local SymantecServer: 302449169 ^^oreetd7668.www5.localdomain^^moenimi^^olupt2189.lan^^con^^preh^^ercit^^etMal^^1465162388^^low^^qui^^ritin^^temporin7150.mail.local^^miu^^rationev^^rem^^asper^^idunt^^luptat^^eveli^^plicab^^oremq^^dicta^^taedicta^^ritt^^iaeco^^equaturv", + "fileset.name": "endpointprotection", + "group.name": "con", + "host.hostname": "temporin7150.mail.local", + "host.name": "olupt2189.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 2678, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "rem", + "rsa.internal.messageid": "302449169", + "rsa.misc.event_source": "rationev", + "rsa.misc.group": "con", + "rsa.misc.reference_id": "ercit", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "olupt2189.lan" + ], + "rsa.network.domain": "oreetd7668.www5.localdomain", + "server.domain": "oreetd7668.www5.localdomain", + "service.type": "symantec", + "source.address": "temporin7150.mail.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=liquaUte cid=alorum eid=obeataev,tempor Jun 20 04:35:42 2016,mUten,Symantec AntiVirus,SYSTEM,Information,emq6633.domain,naaliq. string-data=[ Scan type: remeu Event: failure Security risk detected: dtempo File: tin Location: fugitse Computer: imad User: tinvolup Action taken:block Date found: Sedutpe]", + "file.directory": "dtempo", + "file.name": "tin", + "fileset.name": "endpointprotection", + "host.hostname": "emq6633.domain", + "input.type": "log", + "log.offset": 2978, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "tinvolup" + ], + "rsa.internal.event_desc": "naaliq", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.event_type": "remeu", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "failure", + "service.type": "symantec", + "source.address": "emq6633.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "tinvolup" + }, + { + "event.code": "rsintoc", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "11:38:16 SymantecServer rcit2807.mail.invalid: Site: https://www5.example.net/tempor/citatio.jpg?incidid=rure#asiarchi,Server: eaqueips6396.internal.lan,\"302452736 ^^utfug7095.api.corp^^iumtot^^lupta^^rsintoc^^reetdo^^1467632296^^high^^mnisiut^^avolu^^Except6889.www.corp^^umetMal^^asper^^umq^^naal^^equun^^sitvo^^temquiav^^obeata^^tatemU^^mad^^onse^^redol^^gnaa^^mod", + "fileset.name": "endpointprotection", + "host.hostname": "Except6889.www.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 3331, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "umq", + "rsa.internal.messageid": "302452736", + "rsa.misc.event_source": "asper", + "rsa.misc.reference_id": "rsintoc", + "rsa.misc.severity": "high", + "rsa.network.domain": "utfug7095.api.corp", + "server.domain": "utfug7095.api.corp", + "service.type": "symantec", + "source.address": "Except6889.www.corp", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "umf", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "18:40:50 SymantecServer toditaut7889.internal.invalid: Site: https://api.example.org/eprehend/asnu.htm?mveleum=tamet#perspici,Server: ationul7731.internal.home,Domain: uto5324.lan,Admin: ccae,302452802 ^^orroqu472.www.localhost^^ver^^erc^^umf^^quames^^1468867250^^medium^^esseq^^aincidun^^quatD1370.invalid^^oloreseo^^iruredol^^veniamqu^^licaboN^^atquo^^cupi^^strude^^eritin^^udan^^yCic^^nder^^mdolore^^Cic^^olorema", + "fileset.name": "endpointprotection", + "host.hostname": "quatD1370.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 3699, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "veniamqu", + "rsa.internal.messageid": "302452802", + "rsa.misc.event_source": "iruredol", + "rsa.misc.reference_id": "umf", + "rsa.misc.severity": "medium", + "rsa.network.domain": "orroqu472.www.localhost", + "server.domain": "orroqu472.www.localhost", + "service.type": "symantec", + "source.address": "quatD1370.invalid", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "suntex", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "August 2 01:43:25 oluptat548.www5.invalid SymantecServer: edolorin2164.example,SHA-256:utaliqu,MD-5:rsi,\"[SID: taliqui] 303235080 ^^mides4759.api.local^^tcu^^iatqu6203.mail.corp^^urExcep^^ema^^suntex^^iacons^^1470102205^^medium^^esci^^uov^^quaeab2653.mail.localdomain^^dipiscin^^olup^^aco [name]:inimav [class]:acomm [guid]:iutali [deviceID]:itat^^stlaboru^^ate^^mporainc^^xea^^taed^^umdolo^^ntiu^^radipisc^^Cice^^taedi^^tquido", + "fileset.name": "endpointprotection", + "group.name": "urExcep", + "host.hostname": "quaeab2653.mail.localdomain", + "host.name": "iatqu6203.mail.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 4115, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.db.index": "itat", + "rsa.internal.event_desc": "aco", + "rsa.internal.messageid": "303235080", + "rsa.misc.checksum": "rsi", + "rsa.misc.event_source": "olup", + "rsa.misc.group": "urExcep", + "rsa.misc.hardware_id": "iutali", + "rsa.misc.obj_name": "inimav", + "rsa.misc.obj_type": "acomm", + "rsa.misc.reference_id": "suntex", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "iatqu6203.mail.corp" + ], + "rsa.network.domain": "mides4759.api.local", + "server.domain": "mides4759.api.local", + "service.type": "symantec", + "source.address": "quaeab2653.mail.localdomain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "equamnih", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "August 16 08:45:59 uptate1049.www.corp SymantecServer: Site: https://www.example.org/tetura/imadmini.jpg?eavol=osamnis#temaccu,Server: scipitl1247.www5.host,Domain: caboNem1043.internal.home,The 302450688 ^^litesseq6785.host^^tob^^dolores^^equamnih^^taliqui^^1471337159^^low^^itempo^^orumw^^redol124.mail.invalid^^radipis^^ctetu^^orinrep^^quiavol^^nrepreh^^ratv^^alorum^^mquisn^^atq^^erspi^^iqu^^niamqu^^equamnih^^icab", + "fileset.name": "endpointprotection", + "host.hostname": "redol124.mail.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 4543, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "orinrep", + "rsa.internal.messageid": "302450688", + "rsa.misc.event_source": "ctetu", + "rsa.misc.reference_id": "equamnih", + "rsa.misc.severity": "low", + "rsa.network.domain": "litesseq6785.host", + "server.domain": "litesseq6785.host", + "service.type": "symantec", + "source.address": "redol124.mail.invalid", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "veleum", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "15:48:33 SymantecServer tobeatae2512.api.local: Site: https://www.example.org/luptat/deriti.gif?uradi=velitsed#magnaali,Server: mwrit4009.www.localdomain,Domain: equatDu1710.internal.host,303169538 ^^prehe1037.api.example^^eiusmod^^itation^^veleum^^piciatis^^1472572113^^low^^henderi^^iusmodt^^enim5999.mail.localhost^^ersp^^iame^^orroquis^^aquio^^riatu^^loinve^^tanimid^^isnostru^^nofdeFi^^aquioff^^saqu^^remips^^illoi^^reetdolo", + "fileset.name": "endpointprotection", + "host.hostname": "enim5999.mail.localhost", + "input.type": "log", + "log.level": "low", + "log.offset": 4962, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "orroquis", + "rsa.internal.messageid": "303169538", + "rsa.misc.event_source": "iame", + "rsa.misc.reference_id": "veleum", + "rsa.misc.severity": "low", + "rsa.network.domain": "prehe1037.api.example", + "server.domain": "prehe1037.api.example", + "service.type": "symantec", + "source.address": "enim5999.mail.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "ommo", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "September 13 22:51:07 otamrem6743.www5.domain SymantecServer: Site: https://internal.example.com/consecte/pteurs.gif?onulamco=ons#tiaecon,Server: uaturve3425.www.lan,Domain: tiumdol6695.internal.local,The 302449410 ^^CSe4501.example^^nculpaq^^reseosqu1629.mail.lan^^utemvel^^epteur^^ommo^^iame^^1473807067^^medium^^busBonor^^stquido^^rsitvolu3596.www.test^^uameiusm^^adm^^gelitsed^^tiumto^^cor^^odoco^^oin^^itseddoe^^elites^^rum^^erc^^ehende^^tutla^^licaboNe", + "fileset.name": "endpointprotection", + "group.name": "utemvel", + "host.hostname": "rsitvolu3596.www.test", + "host.name": "reseosqu1629.mail.lan", + "input.type": "log", + "log.level": "medium", + "log.offset": 5392, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "gelitsed", + "rsa.internal.messageid": "302449410", + "rsa.misc.event_source": "adm", + "rsa.misc.group": "utemvel", + "rsa.misc.reference_id": "ommo", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "reseosqu1629.mail.lan" + ], + "rsa.network.domain": "CSe4501.example", + "server.domain": "CSe4501.example", + "service.type": "symantec", + "source.address": "rsitvolu3596.www.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "ditautf", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "September 28 05:53:42 nat4367.www5.example SymantecServer: atiset4383.mail.localhost,SHA-256:isiut,MD-5:dtemp,\"[SID: ici] 303235081 ^^nisiuta7623.www.local^^dtempo^^atnula^^ditautf^^itametc^^1475042022^^high^^olup^^remipsu^^tan3170.api.example^^doconse^^etdol^^dolorsi^^nturmag^^tura^^osquirat^^equat^^aliquid^^usantiu^^idunt^^atqu^^naturau^^olorsita^^lor", + "fileset.name": "endpointprotection", + "host.hostname": "tan3170.api.example", + "input.type": "log", + "log.level": "high", + "log.offset": 5851, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "dolorsi", + "rsa.internal.messageid": "303235081", + "rsa.misc.checksum": "dtemp", + "rsa.misc.event_source": "etdol", + "rsa.misc.reference_id": "ditautf", + "rsa.misc.severity": "high", + "rsa.network.domain": "nisiuta7623.www.local", + "server.domain": "nisiuta7623.www.local", + "service.type": "symantec", + "source.address": "tan3170.api.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "Cleaned", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "12:56:16 SymantecServer eseruntm4247.mail.local: magnaal5792.www5.domain,Category: nula,quiacons,Cleaned up 7519 LiveUpdate downloaded content", + "fileset.name": "endpointprotection", + "host.hostname": "magnaal5792.www5.domain", + "host.name": "eseruntm4247.mail.local", + "input.type": "log", + "log.offset": 6207, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.counters.dclass_c1": 7519, + "rsa.counters.dclass_c1_str": "Number of Virus Cleaned.", + "rsa.internal.event_desc": "Cleaned up downloaded content.", + "rsa.internal.messageid": "Cleaned", + "rsa.network.alias_host": [ + "eseruntm4247.mail.local" + ], + "rsa.time.event_time_str": "12:56:16", + "service.type": "symantec", + "source.address": "magnaal5792.www5.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "saquaea", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "19:58:50 SymantecServer luptatem3834.lan: edq5397.www.test,\"[SID: ntut] 302452801 ^^emullam7151.lan^^quiad^^ihilmole^^saquaea^^ons^^1477511930^^high^^quas^^gia^^itatio6735.api.example^^eddoei^^rsin^^rumSec^^orp^^iaturE^^imve^^essequam^^ueporro^^aliqu^^upt^^orum^^Bonoru^^madminim^^ents", + "fileset.name": "endpointprotection", + "host.hostname": "itatio6735.api.example", + "input.type": "log", + "log.level": "high", + "log.offset": 6350, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "rumSec", + "rsa.internal.messageid": "302452801", + "rsa.misc.event_source": "rsin", + "rsa.misc.reference_id": "saquaea", + "rsa.misc.severity": "high", + "rsa.network.domain": "emullam7151.lan", + "server.domain": "emullam7151.lan", + "service.type": "symantec", + "source.address": "itatio6735.api.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "onpr", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "November 10 03:01:24 veli578.www.localhost SymantecServer: etdolor1236.mail.invalid,\"[SID: mmod] 302449166 ^^iti7029.www.test^^lorsitam^^tanimid^^onpr^^litseddo^^1478746884^^high^^oremqu^^idex^^radip163.mail.invalid^^eiusmo^^ainc^^miurerep^^lestia^^nde^^snu^^inibusB^^nostrud^^cteturad^^ore^^esse^^veniam^^edquian^^sus", + "fileset.name": "endpointprotection", + "host.hostname": "radip163.mail.invalid", + "input.type": "log", + "log.level": "high", + "log.offset": 6636, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "miurerep", + "rsa.internal.messageid": "302449166", + "rsa.misc.event_source": "ainc", + "rsa.misc.reference_id": "onpr", + "rsa.misc.severity": "high", + "rsa.network.domain": "iti7029.www.test", + "server.domain": "iti7029.www.test", + "service.type": "symantec", + "source.address": "radip163.mail.invalid", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.7.164.113" + ], + "event.code": "Active", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "10:03:59 SymantecServer vol866.api.domain: bore5546.www.local,Category: labo,lpaquiof,\"Active Response that started at quu is disengaged. The traffic from IP address 10.207.125.114 was blocked for 150.301000 second(s). ,Local: 10.175.83.138,Local: scip,Remote: Finibus,Remote: 10.7.164.113,Remote: ncididun,tcp,outbound,,Begin: 2016-11-24 10:03:59,End: 2016-11-24 10:03:59,Occurrences: 1901,Application: est,Location: ali,User: remip, Domain: rere228.invalid", + "fileset.name": "endpointprotection", + "host.hostname": "bore5546.www.local", + "host.ip": "10.207.125.114", + "host.name": "vol866.api.domain", + "input.type": "log", + "log.offset": 6955, + "network.application": "est", + "network.direction": "outbound", + "network.protocol": "tcp", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.7.164.113", + "10.207.125.114", + "10.175.83.138" + ], + "related.user": [ + "remip" + ], + "rsa.counters.dclass_c1": 1901, + "rsa.counters.dclass_c1_str": "Occurences.", + "rsa.internal.event_desc": "Traffic from IP address blocked.", + "rsa.internal.messageid": "Active", + "rsa.network.alias_host": [ + "vol866.api.domain" + ], + "rsa.network.domain": "rere228.invalid", + "rsa.time.duration_time": 150.301, + "rsa.time.endtime": "2016-11-24T12:03:59.000Z", + "rsa.time.event_time_str": "10:03:59", + "rsa.time.starttime": "2016-11-24T12:03:59.000Z", + "server.domain": "rere228.invalid", + "service.type": "symantec", + "source.address": "bore5546.www.local", + "source.ip": [ + "10.175.83.138" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "remip" + }, + { + "event.code": "maperiam", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "December 8 17:06:33 ent4487.api.test SymantecServer: Site: https://example.org/ulamc/cept.html?radip=rchitect#Dui,Server: iameaqu2429.api.invalid,\"302452817 ^^asnulap2567.www5.invalid^^ender^^inc5923.www.test^^oluptat^^roinBCSe^^maperiam^^mSec^^1481216793^^medium^^nseq^^borumSec^^tatemseq5797.home^^tam^^oremip^^eufugi^^dunt^^ames^^amni^^tatio^^amquisno^^modoc^^magnam^^uinesc^^cid^^emi^^Bonorum", + "fileset.name": "endpointprotection", + "group.name": "oluptat", + "host.hostname": "tatemseq5797.home", + "host.name": "inc5923.www.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 7414, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "eufugi", + "rsa.internal.messageid": "302452817", + "rsa.misc.event_source": "oremip", + "rsa.misc.group": "oluptat", + "rsa.misc.reference_id": "maperiam", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "inc5923.www.test" + ], + "rsa.network.domain": "asnulap2567.www5.invalid", + "server.domain": "asnulap2567.www5.invalid", + "service.type": "symantec", + "source.address": "tatemseq5797.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.ip": [ + "10.217.91.49" + ], + "event.code": "Local:", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "00:09:07 SymantecServer enima7673.api.localhost: sequ6424.www.invalid,Category: its,dolor,Local: ,Local: 10.217.91.49,Local: mquis,Remote: lab,Remote: 10.139.207.36,Remote: mwrit,ipv6-icmp,1,Intrusion ID: itse,Begin: 2016-12-23 12:09:07,End: 2016-12-23 12:09:07,Occurrences: 4319,Application: conse,Location: nimadmin,User: lumqui,Domain: quiavolu6301.www5.localhost", + "fileset.name": "endpointprotection", + "host.hostname": "sequ6424.www.invalid", + "host.name": "enima7673.api.localhost", + "input.type": "log", + "log.offset": 7811, + "network.application": "conse", + "network.direction": "inbound", + "network.protocol": "ipv6-icmp", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.217.91.49", + "10.139.207.36" + ], + "related.user": [ + "lumqui" + ], + "rsa.counters.dclass_c1": 4319, + "rsa.counters.dclass_c1_str": "Occurrences", + "rsa.internal.event_desc": "Local:", + "rsa.internal.messageid": "Local:", + "rsa.network.alias_host": [ + "enima7673.api.localhost" + ], + "rsa.network.domain": "quiavolu6301.www5.localhost", + "rsa.time.endtime": "2016-12-23T14:09:07.000Z", + "rsa.time.event_time_str": "00:09:07", + "rsa.time.starttime": "2016-12-23T14:09:07.000Z", + "server.domain": "quiavolu6301.www5.localhost", + "service.type": "symantec", + "source.address": "sequ6424.www.invalid", + "source.ip": [ + "10.139.207.36" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "lumqui" + }, + { + "event.action": "Continue", + "event.code": "tion", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "January 6 07:11:41 ames645.mail.localhost SymantecServer: Site: https://example.org/tmo/onofdeF.txt?oremip=its#uptasnul,Server: aliqui7541.www5.localdomain,Domain: nse4444.www5.test,Admin: tlabo,501 ^^tatemse4493.mail.local^^lamco^^tion^^10.249.243.41^^ven^^mquisnos^^tnulapa7580.www.domain^^adeser^^uasiarc^^doeiu^^1483686701^^very-high^^uian^^atuserro^^madminim6826.www.host^^3^^onnumqua^^quioff^^iuntN^^ipis^^1483686701^^1483686701^^itautfu^^nesci^^5040^^mquis^^lorsi^^tetura^^eeufug^^edutper^^tevelite^^tocca^^orsitvol^^ntor^^oinBCSed^^oid^^rchit^^tasu^^obeatae^^1886^^midestl^^quatu^^1016^^mqu^^pteursi", + "file.name": "mquis", + "file.size": 1016, + "fileset.name": "endpointprotection", + "group.name": "adeser", + "host.hostname": "madminim6826.www.host", + "host.name": "tnulapa7580.www.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 8178, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "process.parent.name": "mquis", + "process.ppid": 5040, + "related.ip": [ + "10.249.243.41" + ], + "related.user": [ + "ven" + ], + "rsa.counters.dclass_c1": 1886, + "rsa.counters.dclass_c1_str": "No. of events repeated", + "rsa.internal.event_desc": "quioff", + "rsa.internal.messageid": "501", + "rsa.misc.action": [ + "Continue" + ], + "rsa.misc.group": "adeser", + "rsa.misc.param": "eeufug", + "rsa.misc.reference_id": "tion", + "rsa.misc.rule": "itautfu", + "rsa.misc.rule_name": "nesci", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "tnulapa7580.www.domain" + ], + "rsa.network.domain": "tatemse4493.mail.local", + "rsa.time.endtime": "2017-01-06T07:11:41.000Z", + "rsa.time.starttime": "2017-01-06T07:11:41.000Z", + "rule.name": "nesci", + "server.domain": "tatemse4493.mail.local", + "service.type": "symantec", + "source.address": "madminim6826.www.host", + "source.domain": "mquisnos", + "source.ip": [ + "10.249.243.41" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "ven" + }, + { + "event.code": "sequatD", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "January 20 14:14:16 laboree3880.api.invalid SymantecServer: Site: https://www5.example.com/stiaecon/usBono.html?itl=ttenb#olor,Server: quiav6648.lan,302449415 ^^eumfu2149.internal.home^^upidata^^ici182.invalid^^con^^tore^^sequatD^^ercitati^^1484921656^^low^^rinrep^^temse^^caecat4678.www.home^^tatemac^^quisn^^rem^^ulamcola^^remagnaa^^lamcolab^^ceroinB^^umqui^^citation^^temsequi^^mquia^^omnisi^^etMalor^^mco", + "fileset.name": "endpointprotection", + "group.name": "con", + "host.hostname": "caecat4678.www.home", + "host.name": "ici182.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 8786, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "rem", + "rsa.internal.messageid": "302449415", + "rsa.misc.event_source": "quisn", + "rsa.misc.group": "con", + "rsa.misc.reference_id": "sequatD", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "ici182.invalid" + ], + "rsa.network.domain": "eumfu2149.internal.home", + "server.domain": "eumfu2149.internal.home", + "service.type": "symantec", + "source.address": "caecat4678.www.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "aincidu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "21:16:50 SymantecServer scipit730.api.example: eruntmo2894.mail.localdomain,\"[SID: natus] 302449410 ^^boreet2051.internal.localdomain^^iavo^^ore^^aincidu^^xerc^^1486156610^^very-high^^macc^^ria^^beat2952.internal.localhost^^uisau^^qua^^iarchite^^emsequi^^ueporroq^^ute^^mexer^^iam^^Bonoru^^rcitati^^nula^^ameaquei^^gnama^^esciun", + "fileset.name": "endpointprotection", + "host.hostname": "beat2952.internal.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 9195, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "iarchite", + "rsa.internal.messageid": "302449410", + "rsa.misc.event_source": "qua", + "rsa.misc.reference_id": "aincidu", + "rsa.misc.severity": "very-high", + "rsa.network.domain": "boreet2051.internal.localdomain", + "server.domain": "boreet2051.internal.localdomain", + "service.type": "symantec", + "source.address": "beat2952.internal.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "cul", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 302776321^^eleumi4584.www5.example^^imip7160.www.invalid^^uptateve^^ured3428.www.corp^^abo^^etMa^^cul^^iinea^^1487391564^^very-high^^ditau^^moenimip^^uames7663.internal.local^^lor^^oreeu^^taspe^^eritqui^^atquovol^^evel^^edol^^sequuntu^^quameius^^litse^^san^^apari^^iarchit^^sBonorum", + "fileset.name": "endpointprotection", + "group.name": "abo", + "host.hostname": "uames7663.internal.local", + "host.name": "ured3428.www.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 9524, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "taspe", + "rsa.internal.messageid": "302776321", + "rsa.misc.event_source": "oreeu", + "rsa.misc.group": "abo", + "rsa.misc.reference_id": "cul", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "ured3428.www.corp" + ], + "rsa.network.domain": "imip7160.www.invalid", + "server.domain": "imip7160.www.invalid", + "service.type": "symantec", + "source.address": "uames7663.internal.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "itaspe", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "11:21:59 SymantecServer iutal3376.api.corp: Site: https://example.com/idexeac/ntu.txt?ctionofd=mpori#olupt,Server: ola3373.www5.domain,\"302449153 ^^qua948.mail.local^^tlaboru^^tec^^itaspe^^con^^1488626519^^high^^amremap^^antiu^^velillum6639.www5.local^^lapari^^Mal^^itinvo^^snulap^^cidu^^hilmol^^oluptate^^todi^^emvel^^pta^^dolo^^itaedi^^hend^^remagna", + "fileset.name": "endpointprotection", + "host.hostname": "velillum6639.www5.local", + "input.type": "log", + "log.level": "high", + "log.offset": 9820, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "itinvo", + "rsa.internal.messageid": "302449153", + "rsa.misc.event_source": "Mal", + "rsa.misc.reference_id": "itaspe", + "rsa.misc.severity": "high", + "rsa.network.domain": "qua948.mail.local", + "server.domain": "qua948.mail.local", + "service.type": "symantec", + "source.address": "velillum6639.www5.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "onsec", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "March 18 18:24:33 dolo5649.www.corp SymantecServer: Site: https://example.org/tMal/porin.gif?isni=quid#aUten,Server: Duis3517.www5.invalid,Domain: conseq6079.www.corp,303235079 ^^tiu3570.www.invalid^^asper^^dictasun3408.internal.invalid^^secte^^ctobeat^^onsec^^idestl^^1489861473^^medium^^pid^^itanimi^^onoru5767.internal.domain^^eosqui^^dipisciv^^uam^^quis^^exe^^naa^^equat^^estiaec^^pitlabo^^tas^^rcitat^^ree^^itten^^quipexea", + "fileset.name": "endpointprotection", + "group.name": "secte", + "host.hostname": "onoru5767.internal.domain", + "host.name": "dictasun3408.internal.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 10172, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "uam", + "rsa.internal.messageid": "303235079", + "rsa.misc.event_source": "dipisciv", + "rsa.misc.group": "secte", + "rsa.misc.reference_id": "onsec", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "dictasun3408.internal.invalid" + ], + "rsa.network.domain": "tiu3570.www.invalid", + "server.domain": "tiu3570.www.invalid", + "service.type": "symantec", + "source.address": "onoru5767.internal.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "1281", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "April 2 01:27:07 ruredol1763.www.local SymantecServer: numq601.api.localhost,\"[SID: lapa] 1281 ^^emoenimi", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 10600, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "emoenimi", + "rsa.internal.messageid": "1281", + "rsa.misc.reference_id": "1281", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "tqui1142.www5.domain", + "destination.ip": [ + "10.209.205.25" + ], + "destination.mac": "01:00:5e:e5:88:35", + "destination.port": 4616, + "event.code": "uianonnu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "08:29:41 SymantecServer olorsit6165.example: Site: https://www5.example.com/nturm/seq.html?dquia=ora#umfugiat,Server: quisnos7704.api.invalid,Domain: ite5245.mail.lan,The 306 ^^Duis583.api.local^^eavolupt^^uipe6805.www5.domain^^stenat^^uianonnu^^2001:db8::b810cc6d:451c392b^^2001:db8::4f2735dc:6d3ce756^^10.185.64.46^^10.209.205.25^^ptat^^saq^^1492331381^^high^^quame^^orumwri^^atisu6579.test^^rad^^iat^^tqui1142.www5.domain^^4^^2250^^4616^^2^^1492331381^^1492331381^^2536^^niam^^ivelitse^^tatis^^nula^^ptate^^volupta^^01:00:5e:2d:45:c3^^01:00:5e:e5:88:35^^uaerat^^iduntu^^samvol^^equa^^apari^^tsunt^^caecat^^uel^^fficiad^^teirured^^nostru^^rcit", + "fileset.name": "endpointprotection", + "group.name": "stenat", + "host.hostname": "atisu6579.test", + "host.name": "uipe6805.www5.domain", + "input.type": "log", + "log.level": "high", + "log.offset": 10706, + "network.application": "niam", + "network.direction": "outbound", + "network.protocol": "ICMP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.209.205.25", + "10.185.64.46" + ], + "related.user": [ + "iduntu" + ], + "rsa.counters.dclass_c1": 2536, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "Block all other IP traffic and log", + "rsa.internal.messageid": "306", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.group": "stenat", + "rsa.misc.reference_id": "uianonnu", + "rsa.misc.rule": "tatis", + "rsa.misc.rule_name": "nula", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "uipe6805.www5.domain" + ], + "rsa.network.domain": "Duis583.api.local", + "rsa.network.host_dst": "tqui1142.www5.domain", + "rsa.network.zone": "uaerat", + "rsa.time.endtime": "2017-04-16T08:29:41.000Z", + "rsa.time.starttime": "2017-04-16T08:29:41.000Z", + "rule.name": "nula", + "server.domain": "Duis583.api.local", + "service.type": "symantec", + "source.address": "atisu6579.test", + "source.domain": "samvol", + "source.ip": [ + "10.185.64.46" + ], + "source.mac": "01:00:5e:2d:45:c3", + "source.port": 2250, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "iduntu" + }, + { + "event.code": "catcupid", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 773^^catcupid^^ritquiin", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 11352, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ritquiin", + "rsa.internal.messageid": "773", + "rsa.misc.reference_id": "catcupid", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "deomn904.www.home", + "destination.ip": [ + "10.35.89.51" + ], + "destination.mac": "01:00:5e:14:33:0e", + "destination.port": 3320, + "event.code": "setquas", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "May 14 22:34:50 eumfugia5915.internal.corp SymantecServer: Site: https://internal.example.net/uptat/toditau.htm?quuntur=olup#aeab,Server: uradipis4058.www.domain,Domain: uira3387.internal.localhost,242 ^^quinesc4724.www5.host^^ali^^udexerci6630.mail.test^^osqu^^ptatemse^^itationu^^setquas^^10.202.55.203^^10.35.89.51^^01:00:5e:5f:46:e1^^01:00:5e:14:33:0e^^ameaq^^Quis^^lupta^^1494801290^^very-high^^iav^^umiure^^isiut4530.localdomain^^imvenia^^culp^^deomn904.www.home^^2^^3^^eetdolor^^1494801290^^1494801290^^735^^tla^^iaconseq [Volume]: sed [Model]: sedd [Access]: atione^^tvolup^^oremeu^^lab^^lla^^urau^^aeca^^oNem^^itaedict^^eroi^^onemull^^mdo^^labore^^2001:db8::b54ff32d:af0de540^^2001:db8::11b63689:727d1f3e^^5757^^3320^^7756^^des^^4965^^https://www5.example.org/aliquaU/lits.html?atisetqu=squir#gnaaliq^^https://www.example.com/deriti/edictasu.htm?utlabore=edquiano#mSecti^^henderi^^1.7457^^uel", + "fileset.name": "endpointprotection", + "group.name": "osqu", + "host.hostname": "isiut4530.localdomain", + "host.name": "udexerci6630.mail.test", + "http.request.referrer": "https://www.example.com/deriti/edictasu.htm?utlabore=edquiano#mSecti", + "input.type": "log", + "log.level": "very-high", + "log.offset": 11389, + "network.application": "tla", + "network.direction": "outbound", + "network.protocol": "UDP", + "observer.product": "sedd", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "observer.version": "1.7457", + "related.ip": [ + "10.35.89.51", + "10.202.55.203" + ], + "related.user": [ + "Quis" + ], + "rsa.counters.dclass_c1": 735, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.identity.accesses": "atione", + "rsa.internal.event_desc": "iaconseq", + "rsa.internal.messageid": "242", + "rsa.misc.group": "osqu", + "rsa.misc.policy_id": "uel", + "rsa.misc.reference_id": "setquas", + "rsa.misc.severity": "very-high", + "rsa.misc.sig_id": 7756, + "rsa.misc.sig_id1": 4965, + "rsa.misc.sig_id_str": "des", + "rsa.misc.version": "1.7457", + "rsa.network.alias_host": [ + "udexerci6630.mail.test" + ], + "rsa.network.domain": "quinesc4724.www5.host", + "rsa.network.host_dst": "deomn904.www.home", + "rsa.network.zone": "ameaq", + "rsa.storage.disk_volume": "sed", + "rsa.time.endtime": "2017-05-14T22:34:50.000Z", + "rsa.time.starttime": "2017-05-14T22:34:50.000Z", + "server.domain": "quinesc4724.www5.host", + "service.type": "symantec", + "source.address": "isiut4530.localdomain", + "source.domain": "lupta", + "source.ip": [ + "10.202.55.203" + ], + "source.mac": "01:00:5e:5f:46:e1", + "source.port": 5757, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "url.original": "https://www5.example.org/aliquaU/lits.html?atisetqu=squir#gnaaliq", + "user.name": "Quis" + }, + { + "event.code": "Traffic", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "05:37:24 SymantecServer niamqui7696.mail.test: taliqu701.www.localhost,Category: umfugi,abor,\"Traffic Traffic Redirection disabled.,Event time: 2017-5-29 5:37:24", + "fileset.name": "endpointprotection", + "host.hostname": "taliqu701.www.localhost", + "host.name": "niamqui7696.mail.test", + "input.type": "log", + "log.offset": 12291, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "Traffic Redirection disabled.", + "rsa.internal.messageid": "Traffic", + "rsa.network.alias_host": [ + "niamqui7696.mail.test" + ], + "service.type": "symantec", + "source.address": "taliqu701.www.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "Continue", + "event.code": "psum", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "June 12 12:39:58 aturve1922.internal.test SymantecServer: Site: https://internal.example.com/ore/lors.htm?fdeFi=ratv#veni,Server: metM4820.www.local,Domain: udanti6912.api.localhost,999 ^^cteturad6288.api.home^^nge^^psum^^10.139.89.148^^isnostru^^iad^^ngelits6213.internal.test^^orissusc^^utaliqui^^uov^^1497271198^^medium^^dipisc^^litsed^^lumd4298.mail.localdomain^^3^^iamquisn^^tamrem^^doloremi^^imadm^^1497271198^^1497271198^^ibus^^lumdol^^724^^onnu^^reprehe^^metMa^^emoen^^ptate^^mipsumqu^^turad^^dol^^ntutla^^des^^iciatis^^agn^^cul^^tate^^133^^ipisc^^iatnulap^^7662^^idents^^uine", + "file.name": "onnu", + "file.size": 7662, + "fileset.name": "endpointprotection", + "group.name": "orissusc", + "host.hostname": "lumd4298.mail.localdomain", + "host.name": "ngelits6213.internal.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 12453, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "process.parent.name": "onnu", + "process.ppid": 724, + "related.ip": [ + "10.139.89.148" + ], + "related.user": [ + "isnostru" + ], + "rsa.counters.dclass_c1": 133, + "rsa.counters.dclass_c1_str": "No. of events repeated", + "rsa.internal.event_desc": "tamrem", + "rsa.internal.messageid": "999", + "rsa.misc.action": [ + "Continue" + ], + "rsa.misc.group": "orissusc", + "rsa.misc.param": "emoen", + "rsa.misc.reference_id": "psum", + "rsa.misc.rule": "ibus", + "rsa.misc.rule_name": "lumdol", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "ngelits6213.internal.test" + ], + "rsa.network.domain": "cteturad6288.api.home", + "rsa.time.endtime": "2017-06-12T12:39:58.000Z", + "rsa.time.starttime": "2017-06-12T12:39:58.000Z", + "rule.name": "lumdol", + "server.domain": "cteturad6288.api.home", + "service.type": "symantec", + "source.address": "lumd4298.mail.localdomain", + "source.domain": "iad", + "source.ip": [ + "10.139.89.148" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "isnostru" + }, + { + "event.action": "Retry timestamp is equal or over the next schedule time, switching to regular schedule run.", + "event.code": "Retry", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "19:42:33 SymantecServer ction491.www5.local: Site: https://mail.example.net/ate/epteur.htm?ill=imveniam#sunte,Server: exerc121.www5.invalid,Domain: eir4356.www5.host,Admin: undeom,Retry timestamp is equal or over the next schedule time, switching to regular schedule run.", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 13038, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.messageid": "Retry", + "rsa.misc.action": [ + "Retry timestamp is equal or over the next schedule time, switching to regular schedule run." + ], + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "uptate5787.api.local", + "destination.ip": [ + "10.87.92.95" + ], + "destination.mac": "01:00:5e:2c:5b:14", + "event.code": "ostrumex", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "July 11 02:45:07 issu1852.mail.local SymantecServer: atuse559.www.home,Category: tvo,ema,\"207 ^^uaera2917.internal.test^^iqua^^ciunt^^exea^^ostrumex^^10.247.21.74^^10.87.92.95^^01:00:5e:80:64:29^^01:00:5e:2c:5b:14^^nim^^Sedutper^^ati^^1499741107^^low^^teturad^^ritq^^tuserror810.www5.corp^^equamni^^fugia^^uptate5787.api.local^^0^^2^^suntincu^^1499741107^^1499741107^^7120^^isiutali^^mdolo^^nof^^usantiu^^periam^^remip^^dexea^^aturExc^^antiumto^^cto^^quamqua^^ulapari^^rittenby^^smoditem", + "fileset.name": "endpointprotection", + "host.hostname": "tuserror810.www5.corp", + "input.type": "log", + "log.level": "low", + "log.offset": 13310, + "network.application": "isiutali", + "network.direction": "Unknown", + "network.protocol": "TCP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.87.92.95", + "10.247.21.74" + ], + "related.user": [ + "Sedutper" + ], + "rsa.counters.dclass_c1": 7120, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "mdolo", + "rsa.internal.messageid": "207", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.reference_id": "ostrumex", + "rsa.misc.severity": "low", + "rsa.network.domain": "uaera2917.internal.test", + "rsa.network.host_dst": "uptate5787.api.local", + "rsa.network.zone": "nim", + "rsa.time.endtime": "2017-07-11T02:45:07.000Z", + "rsa.time.starttime": "2017-07-11T02:45:07.000Z", + "server.domain": "uaera2917.internal.test", + "service.type": "symantec", + "source.address": "tuserror810.www5.corp", + "source.domain": "ati", + "source.ip": [ + "10.247.21.74" + ], + "source.mac": "01:00:5e:80:64:29", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "Sedutper" + }, + { + "event.code": "lorum", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-303235080_hen_Symantec AntiVirus: riameaqu^^etd4695.mail.lan^^conse^^ruredolo7392.internal.host^^olors^^roid^^lorum^^iin^^1500976061^^very-high^^lorsita^^naturaut^^mipsu3757.www5.home^^llu^^quaUt^^labor. oris^^tatemse^^uta^^tsun^^samvolu^^dip^^iquaUte^^remi^^modic^^uptatem^^olo^^tametc", + "fileset.name": "endpointprotection", + "group.name": "olors", + "host.hostname": "mipsu3757.www5.home", + "host.name": "ruredolo7392.internal.host", + "input.type": "log", + "log.level": "very-high", + "log.offset": 13798, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.db.index": "oris", + "rsa.internal.event_desc": "labor", + "rsa.internal.messageid": "303235080", + "rsa.misc.event_source": "quaUt", + "rsa.misc.group": "olors", + "rsa.misc.reference_id": "lorum", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "ruredolo7392.internal.host" + ], + "rsa.network.domain": "etd4695.mail.lan", + "server.domain": "etd4695.mail.lan", + "service.type": "symantec", + "source.address": "mipsu3757.www5.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "5378", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "16:50:15 SymantecServer iquam1090.api.local: Site: https://example.net/orumSect/preh.txt?iatisund=rnatu#atnonpro,Server: isu3102.mail.test,\"5378 ^^sed", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 14095, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "sed", + "rsa.internal.messageid": "5378", + "rsa.misc.reference_id": "5378", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "aturvel", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "23:52:50 SymantecServer prehen4320.api.home: umdolo988.api.corp,Category: eaco,empor,302449158 ^^mvele7557.corp^^Nequepor^^luptate^^aturvel^^ostrumex^^1503445970^^high^^sedquia^^litesse^^ntmo4076.lan^^olore^^ationula^^doconse^^volupta^^ptat^^oreverit^^nimides^^remipsum^^elit^^ites^^uptatema^^amali^^onula^^ostru", + "fileset.name": "endpointprotection", + "host.hostname": "ntmo4076.lan", + "input.type": "log", + "log.level": "high", + "log.offset": 14246, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "doconse", + "rsa.internal.messageid": "302449158", + "rsa.misc.event_source": "ationula", + "rsa.misc.reference_id": "aturvel", + "rsa.misc.severity": "high", + "rsa.network.domain": "mvele7557.corp", + "server.domain": "mvele7557.corp", + "service.type": "symantec", + "source.address": "ntmo4076.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "5377", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "September 6 06:55:24 commod6637.api.host SymantecServer: Site: https://example.org/amestqu/aliqua.gif?teirure=dolorsi#dipisciv,Server: nsequun300.internal.lan,Domain: ngelitse7535.internal.lan,The 5377 ^^icta", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 14559, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "icta", + "rsa.internal.messageid": "5377", + "rsa.misc.reference_id": "5377", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "elit", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "13:57:58 SymantecServer lup5199.api.example: tectobe1414.www5.localhost,Category: illoin,rinre,\"302710785 ^^henderit3374.internal.invalid^^mquae^^amni48.internal.localdomain^^con^^enimadmi^^elit^^uia^^1505915878^^high^^oditautf^^nula^^alo6036.www5.local^^ntiumt^^mdolore^^ita^^aeratvol^^odite^^atn^^sectet^^boreetd^^ueporro^^cto^^essequa^^gnidolor^^itlabori^^amestqui", + "fileset.name": "endpointprotection", + "group.name": "con", + "host.hostname": "alo6036.www5.local", + "host.name": "amni48.internal.localdomain", + "input.type": "log", + "log.level": "high", + "log.offset": 14768, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ita", + "rsa.internal.messageid": "302710785", + "rsa.misc.event_source": "mdolore", + "rsa.misc.group": "con", + "rsa.misc.reference_id": "elit", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "amni48.internal.localdomain" + ], + "rsa.network.domain": "henderit3374.internal.invalid", + "server.domain": "henderit3374.internal.invalid", + "service.type": "symantec", + "source.address": "alo6036.www5.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "ntutlab", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-303235082_turmag_Symantec AntiVirus: dutper^^ingelit3629.mail.domain^^ntin^^tenatus4129.www.local^^intocca^^equuntu^^ntutlab^^eaq^^1507150832^^high^^rcit^^secte^^uredo4613.home^^pitlabor^^upi^^olupta^^ape^^amestqu^^luptas^^ariatu^^psumqui^^trude^^ccusa^^ndeomni^^chite^^obeatae^^rehen", + "fileset.name": "endpointprotection", + "group.name": "intocca", + "host.hostname": "uredo4613.home", + "host.name": "tenatus4129.www.local", + "input.type": "log", + "log.level": "high", + "log.offset": 15136, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "olupta", + "rsa.internal.messageid": "303235082", + "rsa.misc.event_source": "upi", + "rsa.misc.group": "intocca", + "rsa.misc.reference_id": "ntutlab", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "tenatus4129.www.local" + ], + "rsa.network.domain": "ingelit3629.mail.domain", + "server.domain": "ingelit3629.mail.domain", + "service.type": "symantec", + "source.address": "uredo4613.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "273", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "October 19 04:03:07 yCiceroi166.test SymantecServer: Site: https://www5.example.org/colab/itte.html?orumS=tesseq#exeacomm,Server: uptat982.localdomain,Domain: ptatema5373.www5.test,273 ^^tat", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 15431, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "tat", + "rsa.internal.messageid": "273", + "rsa.misc.reference_id": "273", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "nev", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 302452819^^ptassita3664.api.test^^uovo5035.api.example^^tNequ^^eca^^nev^^sequatu^^1509620741^^high^^iduntut^^admini^^mini3181.api.test^^iamqu^^ommodoc^^mwrit^^dminimve^^madminim^^onse^^ulap^^itaspe^^remagn^^iatisun^^lupta^^stena^^tquid^^liquaUt", + "fileset.name": "endpointprotection", + "host.hostname": "mini3181.api.test", + "input.type": "log", + "log.level": "high", + "log.offset": 15622, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "mwrit", + "rsa.internal.messageid": "302452819", + "rsa.misc.event_source": "ommodoc", + "rsa.misc.reference_id": "nev", + "rsa.misc.severity": "high", + "rsa.network.domain": "uovo5035.api.example", + "server.domain": "uovo5035.api.example", + "service.type": "symantec", + "source.address": "mini3181.api.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "Commercial", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "18:08:15 SymantecServer rsitam2337.mail.localdomain: tquidolo6928.internal.corp,Category: eetdolo,issuscip,\"Commercial application detected,Computer name: iduntu7302.www.invalid,Detection type: medium,Application name: queip,Application type: nsequunt,Application version:1.3638,Hash type:ercitati,Application hash: lapa,Company name: enia,File size (bytes): 7843,Sensitivity: deserun,Detection score:ugia,Submission recommendation: isiuta,Permitted application reason: eFi,Source: elitsedd,Risk name: isqu,Occurrences: 7744,eumfu,\"remap\",Actual action: accept,Requested action: yCicero,Secondary action: dqui,Event time: 2017-11-16 6:08:15,Inserted: 2017-11-16 6:08:15,End: 2017-11-16 6:08:15,Domain: ema7531.api.example,\"Group: eiusm,Server: assit1598.www5.invalid,User: archite,Source computer: eruntm,Source IP: 10.8.143.229", + "file.name": "remap", + "file.size": 7843, + "fileset.name": "endpointprotection", + "group.name": "eiusm", + "host.hostname": "iduntu7302.www.invalid", + "host.name": "rsitam2337.mail.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 15880, + "network.application": "queip", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "observer.version": "1.3638", + "process.name": "remap", + "related.ip": [ + "10.8.143.229" + ], + "related.user": [ + "archite" + ], + "rsa.counters.dclass_c1": 7744, + "rsa.counters.dclass_c1_str": "Occurences.", + "rsa.crypto.crypto": "ercitati", + "rsa.internal.event_desc": "Commercial application detected", + "rsa.internal.messageid": "Commercial", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.checksum": "lapa", + "rsa.misc.disposition": "yCicero", + "rsa.misc.event_source": "elitsedd", + "rsa.misc.event_state": "dqui", + "rsa.misc.group": "eiusm", + "rsa.misc.obj_type": "nsequunt", + "rsa.misc.severity": "medium", + "rsa.misc.version": "1.3638", + "rsa.misc.virusname": "isqu", + "rsa.network.alias_host": [ + "rsitam2337.mail.localdomain", + "assit1598.www5.invalid" + ], + "rsa.network.domain": "ema7531.api.example", + "rsa.threat.threat_category": "isqu", + "rsa.time.endtime": "2017-11-16T08:08:15.000Z", + "rsa.time.recorded_time": "2017-11-16T08:08:15.000Z", + "server.domain": "ema7531.api.example", + "service.type": "symantec", + "source.address": "iduntu7302.www.invalid", + "source.ip": [ + "10.8.143.229" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "archite" + }, + { + "event.code": "magn", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "December 1 01:10:49 acomm6048.internal.host SymantecServer: liquid1981.www.home,\"[SID: sequatu] 302449178 ^^icero1297.internal.domain^^asun^^rsitam^^magn^^amcola^^1512090649^^medium^^sno^^stiaeco^^equu7361.www5.localdomain^^nto^^non^^pta^^asnul^^uirati^^chitect^^uam^^tisunde^^porr^^piscivel^^ueporr^^udex^^ipexeac^^uin", + "fileset.name": "endpointprotection", + "host.hostname": "equu7361.www5.localdomain", + "input.type": "log", + "log.level": "medium", + "log.offset": 16709, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "pta", + "rsa.internal.messageid": "302449178", + "rsa.misc.event_source": "non", + "rsa.misc.reference_id": "magn", + "rsa.misc.severity": "medium", + "rsa.network.domain": "icero1297.internal.domain", + "server.domain": "icero1297.internal.domain", + "service.type": "symantec", + "source.address": "equu7361.www5.localdomain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "Block", + "event.code": "mdoloree", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "08:13:24 SymantecServer nsectetu3212.test: umdolo4405.local,Category: econ,equat,501 ^^bor5601.www.invalid^^animi^^mdoloree^^10.137.5.67^^taliqui^^doloremi^^uisno4545.www5.corp^^atisund^^isnostru^^quepo^^1513325604^^very-high^^nisi^^onsecte^^iono5777.invalid^^1^^Nequepo^^veleum^^eturad^^tor^^1513325604^^1513325604^^hender^^moditemp^^885^^ipsum^^com^^uptate^^tevelite^^cto^^borisn^^assitasp^^nima^^abore^^tur^^tlaboru^^erun^^mquid^^imipsamv^^3758^^totamrem^^eaqu^^5072^^uunturma^^namaliqu", + "file.name": "ipsum", + "file.size": 5072, + "fileset.name": "endpointprotection", + "group.name": "atisund", + "host.hostname": "iono5777.invalid", + "host.name": "uisno4545.www5.corp", + "input.type": "log", + "log.level": "very-high", + "log.offset": 17029, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "process.parent.name": "ipsum", + "process.ppid": 885, + "related.ip": [ + "10.137.5.67" + ], + "related.user": [ + "taliqui" + ], + "rsa.counters.dclass_c1": 3758, + "rsa.counters.dclass_c1_str": "No. of events repeated", + "rsa.internal.event_desc": "veleum", + "rsa.internal.messageid": "501", + "rsa.misc.action": [ + "Block" + ], + "rsa.misc.group": "atisund", + "rsa.misc.param": "tevelite", + "rsa.misc.reference_id": "mdoloree", + "rsa.misc.rule": "hender", + "rsa.misc.rule_name": "moditemp", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "uisno4545.www5.corp" + ], + "rsa.network.domain": "bor5601.www.invalid", + "rsa.time.endtime": "2017-12-15T08:13:24.000Z", + "rsa.time.starttime": "2017-12-15T08:13:24.000Z", + "rule.name": "moditemp", + "server.domain": "bor5601.www.invalid", + "service.type": "symantec", + "source.address": "iono5777.invalid", + "source.domain": "doloremi", + "source.ip": [ + "10.137.5.67" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "taliqui" + }, + { + "event.code": "5122", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "15:15:58 SymantecServer upidatat5004.internal.test: Site: https://example.com/tatem/umexe.gif?lor=busBo#turm,Server: quamei7815.api.home,Domain: qua6831.internal.test,Admin: xeacomm,5122 ^^oriosa", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 17519, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "oriosa", + "rsa.internal.messageid": "5122", + "rsa.misc.reference_id": "5122", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "4609", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "22:18:32 SymantecServer ecatcup2068.invalid: quinesc2102.www.invalid,Category: asiarch,tob,4609 ^^Sending Email Failed for following email address [tiae].", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 17715, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.email.email": [ + "tiae" + ], + "rsa.internal.event_desc": "Sending Email Failed", + "rsa.internal.messageid": "4609", + "rsa.misc.reference_id": "4609", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "agnamali3222.example", + "destination.ip": [ + "10.66.203.117" + ], + "destination.mac": "01:00:5e:94:22:bc", + "event.code": "snisiut", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "January 27 05:21:06 ainci5661.internal.local SymantecServer: ntu1279.mail.lan,SHA-256:dut,MD-5:aecons,\"[SID: tionemu] 207 ^^edictasu3521.invalid^^eFini^^mnis^^tametco^^snisiut^^10.92.93.236^^10.66.203.117^^01:00:5e:54:c0:38^^01:00:5e:94:22:bc^^oloremag^^uisa^^umquidol^^1517030466^^medium^^erit^^uaea^^adminima6097.corp^^sitvolup^^tionem^^agnamali3222.example^^2^^2^^onsequ^^1517030466^^1517030466^^3168^^ehen^^remap^^mUt^^admi^^siarch^^oloremi^^ididu^^uov^^ncidid^^audantiu^^lmolest^^miurerep^^orsitame^^Sed", + "fileset.name": "endpointprotection", + "host.hostname": "adminima6097.corp", + "input.type": "log", + "log.level": "medium", + "log.offset": 17870, + "network.application": "ehen", + "network.direction": "outbound", + "network.protocol": "TCP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.66.203.117", + "10.92.93.236" + ], + "related.user": [ + "uisa" + ], + "rsa.counters.dclass_c1": 3168, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "remap", + "rsa.internal.messageid": "207", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.checksum": "aecons", + "rsa.misc.reference_id": "snisiut", + "rsa.misc.severity": "medium", + "rsa.network.domain": "edictasu3521.invalid", + "rsa.network.host_dst": "agnamali3222.example", + "rsa.network.zone": "oloremag", + "rsa.time.endtime": "2018-01-27T05:21:06.000Z", + "rsa.time.starttime": "2018-01-27T05:21:06.000Z", + "server.domain": "edictasu3521.invalid", + "service.type": "symantec", + "source.address": "adminima6097.corp", + "source.domain": "umquidol", + "source.ip": [ + "10.92.93.236" + ], + "source.mac": "01:00:5e:54:c0:38", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "uisa" + }, + { + "event.code": "lmolest", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "February 10 12:23:41 cons4129.api.corp SymantecServer: Site: https://internal.example.org/ssecil/xplic.htm?cipitl=ame#tenat,Server: etur5170.mail.localdomain,Domain: oquisq4993.api.domain,302452807 ^^seosqui7376.internal.home^^edolori^^equ2353.internal.local^^utlab^^entoreve^^lmolest^^ser^^1518265421^^low^^autodita^^loreme^^eratv6521.example^^meaqu^^tlaboree^^dolorsi^^etdolore^^taevita^^rationev^^catcup^^ectetur^^cons^^spiciati^^upidata^^utlabo^^lillumq^^erc", + "fileset.name": "endpointprotection", + "group.name": "utlab", + "host.hostname": "eratv6521.example", + "host.name": "equ2353.internal.local", + "input.type": "log", + "log.level": "low", + "log.offset": 18379, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "dolorsi", + "rsa.internal.messageid": "302452807", + "rsa.misc.event_source": "tlaboree", + "rsa.misc.group": "utlab", + "rsa.misc.reference_id": "lmolest", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "equ2353.internal.local" + ], + "rsa.network.domain": "seosqui7376.internal.home", + "server.domain": "seosqui7376.internal.home", + "service.type": "symantec", + "source.address": "eratv6521.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "xcep", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "19:26:15 SymantecServer nonnumqu2938.mail.localdomain: Site: https://www5.example.net/uasiarch/tru.txt?eetdolo=erro#uptat,Server: con594.www5.home,Domain: ididu284.api.home,302776321 ^^pre865.www5.home^^prehe^^bori7611.invalid^^neavolu^^mexe^^xcep^^uscipi^^1519500375^^very-high^^tNeq^^nimi^^iset1992.internal.example^^sequu^^ffic^^imadmini^^isnostru^^ostr^^tinvo^^lorumwr^^iaco^^sumdol^^riat^^nim^^imven^^isci^^iusmo", + "fileset.name": "endpointprotection", + "group.name": "neavolu", + "host.hostname": "iset1992.internal.example", + "host.name": "bori7611.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 18842, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "imadmini", + "rsa.internal.messageid": "302776321", + "rsa.misc.event_source": "ffic", + "rsa.misc.group": "neavolu", + "rsa.misc.reference_id": "xcep", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "bori7611.invalid" + ], + "rsa.network.domain": "pre865.www5.home", + "server.domain": "pre865.www5.home", + "service.type": "symantec", + "source.address": "iset1992.internal.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "No", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-No_bill_Symantec AntiVirus: No old risk events got swept.", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 19260, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "No old risk events got swept.", + "rsa.internal.messageid": "No", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "Cice", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "09:31:24 SymantecServer tsed6598.mail.test: scipit581.api.example,Category: mni,nti,302449413 ^^iste5901.mail.localhost^^exer^^paqui^^Cice^^liqui^^1521970284^^very-high^^Dui^^tam^^ntin2655.www.localdomain^^itation^^itasper^^epo^^mmodico^^moll^^meaqueip^^nculpaq^^mides^^iconseq^^nidolo^^runtmoll^^tuserror^^utlabo^^scip", + "fileset.name": "endpointprotection", + "host.hostname": "ntin2655.www.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 19328, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "epo", + "rsa.internal.messageid": "302449413", + "rsa.misc.event_source": "itasper", + "rsa.misc.reference_id": "Cice", + "rsa.misc.severity": "very-high", + "rsa.network.domain": "iste5901.mail.localhost", + "server.domain": "iste5901.mail.localhost", + "service.type": "symantec", + "source.address": "ntin2655.www.localdomain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "tati", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "16:33:58 SymantecServer utfugi6811.mail.host: Site: https://www.example.org/amqua/mavenia.txt?atnu=ssuscipi#evita,Server: tconsect7649.internal.domain,Domain: lors1204.corp,Admin: volupta,302449414 ^^dolor1769.lan^^dminimav^^odtem^^tati^^suscip^^1523205238^^high^^umqu^^ntexpli^^siuta395.home^^lorumwr^^fugiat^^iumdolor^^etcons^^aecatc^^agnaa^^minimven^^pisciv^^equamnih^^rationev^^etco^^usanti^^itessec^^dat", + "fileset.name": "endpointprotection", + "host.hostname": "siuta395.home", + "input.type": "log", + "log.level": "high", + "log.offset": 19648, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "iumdolor", + "rsa.internal.messageid": "302449414", + "rsa.misc.event_source": "fugiat", + "rsa.misc.reference_id": "tati", + "rsa.misc.severity": "high", + "rsa.network.domain": "dolor1769.lan", + "server.domain": "dolor1769.lan", + "service.type": "symantec", + "source.address": "siuta395.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "Configuration", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "23:36:32 SymantecServer nimadmi5274.api.localdomain: Configuration Change..umdolore5014.api.lan..4/22/2018........low..oluptate..11:36:32 tcu..", + "fileset.name": "endpointprotection", + "host.hostname": "umdolore5014.api.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 20057, + "observer.product": "oluptate", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "Configuration Change", + "rsa.internal.messageid": "Configuration", + "rsa.misc.severity": "low", + "service.type": "symantec", + "source.address": "umdolore5014.api.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "2", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "06:39:06 SymantecServer ept2114.corp: tiumdo6437.internal.invalid,Category: ssusci,snostrud,\"2 ^^tisund4302.www5.local^^obeata796.www.localhost^^olo^^vel1911.lan^^10.147.225.53^^itaspern^^lupta^^dolor^^tNeque^^accept^^2018-05-07T06:39:06Z^^etdo^^edictas^^1554^^corpor^^urerepr", + "file.name": "corpor", + "fileset.name": "endpointprotection", + "host.hostname": "vel1911.lan", + "host.name": "tisund4302.www5.local", + "input.type": "log", + "log.offset": 20201, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.147.225.53" + ], + "related.user": [ + "olo" + ], + "rsa.counters.dclass_c1": 1554, + "rsa.counters.dclass_c1_str": "Virus Count.", + "rsa.db.index": "dolor", + "rsa.internal.event_desc": "Security risk found", + "rsa.internal.messageid": "2", + "rsa.investigations.ec_activity": "Detect", + "rsa.investigations.ec_subject": "Virus", + "rsa.investigations.ec_theme": "TEV", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.disposition": "tNeque", + "rsa.misc.event_source": "itaspern", + "rsa.misc.virusname": "lupta", + "rsa.network.alias_host": [ + "tisund4302.www5.local" + ], + "rsa.network.domain": "obeata796.www.localhost", + "rsa.threat.threat_category": "lupta", + "rsa.time.recorded_time": "2018-05-07T06:39:06.000Z", + "server.domain": "obeata796.www.localhost", + "service.type": "symantec", + "source.address": "vel1911.lan", + "source.ip": [ + "10.147.225.53" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "olo" + }, + { + "event.code": "773", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP-ctetura: equamn6846.www5.invalid^^3210^^ssecillu^^773 ^^oeius", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 20478, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "oeius", + "rsa.internal.messageid": "773", + "rsa.misc.reference_id": "773", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "5377", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "20:44:15 SymantecServer pisci6637.www.test: Site: https://www.example.org/dolo/orem.html?elite=nde#iac,Server: turve824.mail.corp,Domain: llumquid5568.internal.host,5377 ^^adolors", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 20552, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "adolors", + "rsa.internal.messageid": "5377", + "rsa.misc.reference_id": "5377", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "citatio", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "03:46:49 SymantecServer nemulla5602.mail.localhost: 303169540 ^^emipsum4052.internal.invalid^^ciatisu^^evelites2448.www.host^^uid^^Bono^^citatio^^aliquide^^1529380009^^medium^^onsequa^^seddoe^^quisnost7124.api.domain^^tla^^uidexea^^odtem^^nvolupt^^stia^^neavolu^^tsedqui^^ueporroq^^writ^^ema^^ioffici^^agni^^tat^^metconse", + "fileset.name": "endpointprotection", + "group.name": "uid", + "host.hostname": "quisnost7124.api.domain", + "host.name": "evelites2448.www.host", + "input.type": "log", + "log.level": "medium", + "log.offset": 20732, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "odtem", + "rsa.internal.messageid": "303169540", + "rsa.misc.event_source": "uidexea", + "rsa.misc.group": "uid", + "rsa.misc.reference_id": "citatio", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "evelites2448.www.host" + ], + "rsa.network.domain": "emipsum4052.internal.invalid", + "server.domain": "emipsum4052.internal.invalid", + "service.type": "symantec", + "source.address": "quisnost7124.api.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "edi6108.internal.domain", + "destination.ip": [ + "10.132.171.142" + ], + "destination.mac": "01:00:5e:5b:b9:9d", + "destination.port": 1953, + "event.code": "itaedi", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "10:49:23 SymantecServer riame5318.www5.example: Site: https://internal.example.com/itinvolu/urerepre.jpg?ditem=did#BCS,Server: idex58.api.host,Domain: iaturEx4974.api.localdomain,207 ^^ita2191.www5.invalid^^amquis^^iatquovo4868.test^^uraut^^reetdol^^umtotam^^itaedi^^10.72.200.11^^10.132.171.142^^01:00:5e:ef:6c:af^^01:00:5e:5b:b9:9d^^tsunti^^ero^^iusmodi^^1530614963^^high^^caecat^^oreetd^^madmi2948.internal.lan^^eleumiur^^ididun^^edi6108.internal.domain^^1^^3^^squa^^1530614963^^1530614963^^4662^^atisetq^^emagnama^^stqui^^itemp^^ipsa^^ipsumqui^^tisu^^nse^^sci^^itse^^tco^^nnumqua^^erit^^lorsitam^^2001:db8::325d4a06:86d5f940^^2001:db8::d5c0e730:7529c510^^4574^^1953^^7096^^quaera^^5100^^https://mail.example.com/ulamc/ncid.jpg?emipsu=icaboNem#Except^^https://internal.example.org/maliquam/mav.gif?ecill=ventore#imi^^uptatemU^^1.132^^liqua", + "fileset.name": "endpointprotection", + "group.name": "uraut", + "host.hostname": "madmi2948.internal.lan", + "host.name": "iatquovo4868.test", + "http.request.referrer": "https://internal.example.org/maliquam/mav.gif?ecill=ventore#imi", + "input.type": "log", + "log.level": "high", + "log.offset": 21054, + "network.application": "atisetq", + "network.direction": "inbound", + "network.protocol": "UDP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "observer.version": "1.132", + "related.ip": [ + "10.72.200.11", + "10.132.171.142" + ], + "related.user": [ + "ero" + ], + "rsa.counters.dclass_c1": 4662, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "emagnama", + "rsa.internal.messageid": "207", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.group": "uraut", + "rsa.misc.policy_id": "liqua", + "rsa.misc.reference_id": "itaedi", + "rsa.misc.severity": "high", + "rsa.misc.sig_id": 7096, + "rsa.misc.sig_id1": 5100, + "rsa.misc.sig_id_str": "quaera", + "rsa.misc.version": "1.132", + "rsa.network.alias_host": [ + "iatquovo4868.test" + ], + "rsa.network.domain": "ita2191.www5.invalid", + "rsa.network.host_dst": "edi6108.internal.domain", + "rsa.network.zone": "tsunti", + "rsa.time.endtime": "2018-07-03T10:49:23.000Z", + "rsa.time.starttime": "2018-07-03T10:49:23.000Z", + "server.domain": "ita2191.www5.invalid", + "service.type": "symantec", + "source.address": "madmi2948.internal.lan", + "source.domain": "iusmodi", + "source.ip": [ + "10.72.200.11" + ], + "source.mac": "01:00:5e:ef:6c:af", + "source.port": 4574, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "url.original": "https://mail.example.com/ulamc/ncid.jpg?emipsu=icaboNem#Except", + "user.name": "ero" + }, + { + "event.action": "cancel", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=nesciu cid=cer eid=molestia,volu Jul 17 17:51:58 2018,occ,Symantec AntiVirus,SYSTEM,Information,reverita794.mail.domain,ten. string-data=[ Scan type: cola Event: success Security risk detected: ame File: que Location: sect Computer: ing User: nis Action taken:cancel Date found: billoinv]", + "file.directory": "ame", + "file.name": "que", + "fileset.name": "endpointprotection", + "host.hostname": "reverita794.mail.domain", + "input.type": "log", + "log.offset": 21897, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "nis" + ], + "rsa.internal.event_desc": "ten", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "cancel" + ], + "rsa.misc.event_type": "cola", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "success", + "service.type": "symantec", + "source.address": "reverita794.mail.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "nis" + }, + { + "event.code": "siarchi", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "August 1 00:54:32 col6521.mail.domain SymantecServer: Site: https://mail.example.com/enby/teveli.html?dolor=CSedut#atatn,Server: utal7661.www.test,Domain: caecatcu5496.www.test,The 302452743 ^^tec4011.mail.home^^ate^^uptatem^^siarchi^^dminim^^1533084872^^very-high^^Nemo^^itse^^lillumq4387.www5.localhost^^Qui^^turExce^^sse^^quine^^utemvel^^exercita^^emaperi^^aspernat^^ddoei^^nihi^^umfu^^inesc^^uiavolu^^loremagn", + "fileset.name": "endpointprotection", + "host.hostname": "lillumq4387.www5.localhost", + "input.type": "log", + "log.level": "very-high", + "log.offset": 22236, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "sse", + "rsa.internal.messageid": "302452743", + "rsa.misc.event_source": "turExce", + "rsa.misc.reference_id": "siarchi", + "rsa.misc.severity": "very-high", + "rsa.network.domain": "tec4011.mail.home", + "server.domain": "tec4011.mail.home", + "service.type": "symantec", + "source.address": "lillumq4387.www5.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "accept", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=nostru cid=edd eid=nisi,sciun Aug 15 07:57:06 2018,natuserr,Symantec AntiVirus,SYSTEM,Information,ipi563.api.lan,asnulap. string-data=[ Scan type: atnula Event: failure Security risk detected: dutpe File: modtem Location: eriameaq Computer: irured User: anti Action taken:accept Date found: tani]", + "file.directory": "dutpe", + "file.name": "modtem", + "fileset.name": "endpointprotection", + "host.hostname": "ipi563.api.lan", + "input.type": "log", + "log.offset": 22650, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "anti" + ], + "rsa.internal.event_desc": "asnulap", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "accept" + ], + "rsa.misc.event_type": "atnula", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "failure", + "service.type": "symantec", + "source.address": "ipi563.api.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "anti" + }, + { + "event.code": "Connection", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "14:59:40 SymantecServer uptatemU1147.mail.corp: mqu3327.internal.host,Category: plic,oremq,\"Connection reset", + "fileset.name": "endpointprotection", + "host.hostname": "mqu3327.internal.host", + "host.name": "uptatemU1147.mail.corp", + "input.type": "log", + "log.offset": 22997, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "Connection reset.", + "rsa.internal.messageid": "Connection", + "rsa.network.alias_host": [ + "uptatemU1147.mail.corp" + ], + "rsa.time.event_time_str": "14:59:40", + "service.type": "symantec", + "source.address": "mqu3327.internal.host", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "olori", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "22:02:15 SymantecServer remape5128.internal.home: Site: https://www5.example.org/eosq/tanimi.htm?lumdolo=volu#eser,Server: quisn1387.invalid,302452736 ^^sit3373.api.localdomain^^isnos^^emp42.mail.test^^ipisc^^roinB^^olori^^omm^^1536789735^^medium^^rissus^^abo^^ecatcupi4759.internal.local^^atevelit^^tenb^^ritati^^architec^^era^^ptatem^^remaperi^^isi^^ssecill^^tisetq^^mmodico^^mquae^^sunde^^sum", + "fileset.name": "endpointprotection", + "group.name": "ipisc", + "host.hostname": "ecatcupi4759.internal.local", + "host.name": "emp42.mail.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 23106, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ritati", + "rsa.internal.messageid": "302452736", + "rsa.misc.event_source": "tenb", + "rsa.misc.group": "ipisc", + "rsa.misc.reference_id": "olori", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "emp42.mail.test" + ], + "rsa.network.domain": "sit3373.api.localdomain", + "server.domain": "sit3373.api.localdomain", + "service.type": "symantec", + "source.address": "ecatcupi4759.internal.local", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "5377", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "September 27 05:04:49 tatema826.www.localhost SymantecServer: mco1751.www.localdomain,SHA-256:tation,MD-5:tot,\"[SID: veleumi] 5377 ^^iumt", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 23502, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "iumt", + "rsa.internal.messageid": "5377", + "rsa.misc.checksum": "tot", + "rsa.misc.reference_id": "5377", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "olesti", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "October 11 12:07:23 sciun6000.www.test SymantecServer: dictasu7340.internal.invalid,\"[SID: Cicero] 302450944 ^^antiu4203.www.host^^asnulapa^^hende^^olesti^^ntmolli^^1539259643^^low^^eufu^^tame^^ipsu7538.www5.host^^acom^^lamc^^squa^^Cic^^aturveli^^lica^^Exc^^amvolup^^velill^^oidentsu^^uaea^^rehender^^rep^^iusmod", + "fileset.name": "endpointprotection", + "host.hostname": "ipsu7538.www5.host", + "input.type": "log", + "log.level": "low", + "log.offset": 23640, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "squa", + "rsa.internal.messageid": "302450944", + "rsa.misc.event_source": "lamc", + "rsa.misc.reference_id": "olesti", + "rsa.misc.severity": "low", + "rsa.network.domain": "antiu4203.www.host", + "server.domain": "antiu4203.www.host", + "service.type": "symantec", + "source.address": "ipsu7538.www5.host", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "257", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "19:09:57 SymantecServer aevitaed6618.localhost: labor3547.www5.localhost,\"[SID: erci] 257 ^^quovolup", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 23953, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "quovolup", + "rsa.internal.messageid": "257", + "rsa.misc.reference_id": "257", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "dita2048.www5.home", + "destination.ip": [ + "10.171.13.85" + ], + "destination.mac": "01:00:5e:31:f2:97", + "destination.port": 5002, + "event.code": "onse", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "November 9 02:12:32 tlaborio5210.www5.lan SymantecServer: seq3479.internal.domain,SHA-256:uto,MD-5:eetdo,\"[SID: untincul] 301 ^^upta3770.internal.localhost^^ore^^onse^^10.40.133.90^^10.171.13.85^^tateveli^^sequatu^^1541729552^^medium^^dex^^rsintocc^^iusmo5734.internal.invalid^^tion^^itae^^dita2048.www5.home^^4^^1467^^5002^^1^^1541729552^^1541729552^^5934^^usci^^3^^rittenby^^Block all other IP traffic and log^^gni^^ritq^^01:00:5e:57:68:87^^01:00:5e:31:f2:97^^mqu^^bor^^piscinge^^ectobe^^uisaute^^orema^^poris^^uptat^^colabor^^bor^^sequ^^noru", + "fileset.name": "endpointprotection", + "host.hostname": "iusmo5734.internal.invalid", + "input.type": "log", + "log.level": "medium", + "log.offset": 24054, + "network.application": "usci", + "network.direction": "inbound", + "network.protocol": "ICMP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.40.133.90", + "10.171.13.85" + ], + "related.user": [ + "bor" + ], + "rsa.counters.dclass_c1": 5934, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "Block all other IP traffic and log", + "rsa.internal.messageid": "301", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.checksum": "eetdo", + "rsa.misc.reference_id": "onse", + "rsa.misc.rule": "rittenby", + "rsa.misc.rule_name": "Block all other IP traffic and log", + "rsa.misc.severity": "medium", + "rsa.network.domain": "upta3770.internal.localhost", + "rsa.network.host_dst": "dita2048.www5.home", + "rsa.network.zone": "mqu", + "rsa.time.endtime": "2018-11-09T02:12:32.000Z", + "rsa.time.starttime": "2018-11-09T02:12:32.000Z", + "rule.name": "Block all other IP traffic and log", + "server.domain": "upta3770.internal.localhost", + "service.type": "symantec", + "source.address": "iusmo5734.internal.invalid", + "source.domain": "piscinge", + "source.ip": [ + "10.40.133.90" + ], + "source.mac": "01:00:5e:57:68:87", + "source.port": 1467, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "bor" + }, + { + "event.code": "Retry", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "November 23 09:15:06 cons392.domain SymantecServer: Site: https://www.example.com/aecatcu/sed.html?eroi=snu#tconsect,Server: stru3362.corp,\"Retry timestamp is over the maximum retry window, switching to regular schedule run.", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 24599, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "Retry.", + "rsa.internal.messageid": "Retry", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "abi", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "16:17:40 SymantecServer tionevol7606.www.localhost: Site: https://api.example.net/sunti/dipiscin.htm?ovolup=olest#veniamq,Server: uisno561.internal.home,\"302452816 ^^omm3591.internal.invalid^^edq^^ngelits2743.www5.host^^incidunt^^tatnonp^^abi^^nimave^^1544199460^^high^^idexeaco^^siu^^inrepr7369.www.domain^^ore^^lore^^tatemac^^tamet^^laparia^^quid^^ehen^^eseru^^aperiam^^uioffic^^atis^^ectobe^^rehender^^corpori", + "fileset.name": "endpointprotection", + "group.name": "incidunt", + "host.hostname": "inrepr7369.www.domain", + "host.name": "ngelits2743.www5.host", + "input.type": "log", + "log.level": "high", + "log.offset": 24824, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "tatemac", + "rsa.internal.messageid": "302452816", + "rsa.misc.event_source": "lore", + "rsa.misc.group": "incidunt", + "rsa.misc.reference_id": "abi", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ngelits2743.www5.host" + ], + "rsa.network.domain": "omm3591.internal.invalid", + "server.domain": "omm3591.internal.invalid", + "service.type": "symantec", + "source.address": "inrepr7369.www.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "fdeFi", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "December 21 23:20:14 cons7043.api.lan SymantecServer: Site: https://api.example.net/utlab/hilm.txt?lor=untutla#ons,Server: uam6380.internal.lan,302452808 ^^sed1665.internal.local^^rainci^^olupt717.invalid^^iano^^dexerci^^fdeFi^^tlabori^^1545434414^^very-high^^ritquiin^^untutl^^alorum1804.mail.test^^sequatur^^psum^^ano^^ame^^cipitlab^^venia^^rroquis^^tisu^^ratione^^aturvel^^Neque^^ueipsa^^assit^^ffici", + "fileset.name": "endpointprotection", + "group.name": "iano", + "host.hostname": "alorum1804.mail.test", + "host.name": "olupt717.invalid", + "input.type": "log", + "log.level": "very-high", + "log.offset": 25237, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ano", + "rsa.internal.messageid": "302452808", + "rsa.misc.event_source": "psum", + "rsa.misc.group": "iano", + "rsa.misc.reference_id": "fdeFi", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "olupt717.invalid" + ], + "rsa.network.domain": "sed1665.internal.local", + "server.domain": "sed1665.internal.local", + "service.type": "symantec", + "source.address": "alorum1804.mail.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=itquii cid=umdolore eid=iuntNequ,corp Jan 5 06:22:49 2019,trudexe,Symantec AntiVirus,SYSTEM,Information,queporr7029.internal.test,quidex. string-data=[ Scan type: iatqu Event: unknown Security risk detected: ips File: modo Location: ela Computer: con User: unti Action taken:block Date found: tcupidat]", + "file.directory": "ips", + "file.name": "modo", + "fileset.name": "endpointprotection", + "host.hostname": "queporr7029.internal.test", + "input.type": "log", + "log.offset": 25641, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "unti" + ], + "rsa.internal.event_desc": "quidex", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.event_type": "iatqu", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "unknown", + "service.type": "symantec", + "source.address": "queporr7029.internal.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "unti" + }, + { + "event.code": "5121", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "13:25:23 SymantecServer veli765.www.corp: Site: https://www.example.net/queip/antiu.txt?nisiuta=cipitla#ditautf,Server: oluptasn909.www5.example,Domain: imadm2803.api.local,Admin: eet,5121 ^^onpro", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 25994, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "onpro", + "rsa.internal.messageid": "5121", + "rsa.misc.reference_id": "5121", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "urExcep6087.www5.localhost", + "destination.ip": [ + "10.155.163.6" + ], + "destination.mac": "01:00:5e:e9:19:80", + "destination.port": 558, + "event.code": "iadol", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 302^^exea6833.www.example^^ictas1247.www5.example^^incul^^iadol^^10.31.231.57^^10.155.163.6^^que^^urQui^^1549139277^^low^^taliquip^^maliquam^^upidat1328.internal.localhost^^odico^^sistenat^^urExcep6087.www5.localhost^^1^^6324^^558^^1^^1549139277^^1549139277^^2952^^mqu^^doloremq^^velil^^mdolo^^poris^^amvo^^01:00:5e:fc:5b:c7^^01:00:5e:e9:19:80^^imv^^norumetM^^iac^^itessequ^^iaturExc^^orsit^^tamrema^^eos^^quameius^^ciati^^nemullam^^sequu", + "fileset.name": "endpointprotection", + "host.hostname": "upidat1328.internal.localhost", + "input.type": "log", + "log.level": "low", + "log.offset": 26191, + "network.application": "mqu", + "network.direction": "inbound", + "network.protocol": "Others", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.31.231.57", + "10.155.163.6" + ], + "related.user": [ + "norumetM" + ], + "rsa.counters.dclass_c1": 2952, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "Block Local File Sharing to external computers", + "rsa.internal.messageid": "302", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.reference_id": "iadol", + "rsa.misc.rule": "velil", + "rsa.misc.rule_name": "mdolo", + "rsa.misc.severity": "low", + "rsa.network.domain": "ictas1247.www5.example", + "rsa.network.host_dst": "urExcep6087.www5.localhost", + "rsa.network.zone": "imv", + "rsa.time.endtime": "2019-02-02T20:27:57.000Z", + "rsa.time.starttime": "2019-02-02T20:27:57.000Z", + "rule.name": "mdolo", + "server.domain": "ictas1247.www5.example", + "service.type": "symantec", + "source.address": "upidat1328.internal.localhost", + "source.domain": "iac", + "source.ip": [ + "10.31.231.57" + ], + "source.mac": "01:00:5e:fc:5b:c7", + "source.port": 6324, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "norumetM" + }, + { + "event.code": "4097", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP-eleumiur: chite5632.test^^1981^^etc^^4097 ^^lorem", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 26643, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "lorem", + "rsa.internal.messageid": "4097", + "rsa.misc.reference_id": "4097", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "alorum", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "10:33:06 SymantecServer mveleum2688.api.host: 302452816 ^^nisiut1750.internal.invalid^^oen^^tsunti^^alorum^^aeratvo^^1551609186^^high^^les^^paquioff^^tesseci33.internal.example^^Bonorum^^met^^nost^^sequa^^dquiaco^^mmodoco^^emagn^^susci^^eursin^^siutali^^osa^^olabor^^ent^^secil", + "fileset.name": "endpointprotection", + "host.hostname": "tesseci33.internal.example", + "input.type": "log", + "log.level": "high", + "log.offset": 26705, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "nost", + "rsa.internal.messageid": "302452816", + "rsa.misc.event_source": "met", + "rsa.misc.reference_id": "alorum", + "rsa.misc.severity": "high", + "rsa.network.domain": "nisiut1750.internal.invalid", + "server.domain": "nisiut1750.internal.invalid", + "service.type": "symantec", + "source.address": "tesseci33.internal.example", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "esciu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "17:35:40 SymantecServer stiaecon2284.www5.host: Site: https://internal.example.net/agnama/commodi.gif?snost=nsequun#quovo,Server: amquaera63.www5.lan,Domain: audant2228.invalid,302452736 ^^ptasnula2158.internal.host^^uptasnul^^redol^^esciu^^dolorinr^^1552844140^^very-high^^auto^^edquian^^alo7567.www5.test^^umquid^^proident^^quisnos^^umet^^nima^^aria^^ugi^^econ^^aaliquaU^^sitvol^^temse^^henderi^^Sedu^^dolore", + "fileset.name": "endpointprotection", + "host.hostname": "alo7567.www5.test", + "input.type": "log", + "log.level": "very-high", + "log.offset": 26983, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "quisnos", + "rsa.internal.messageid": "302452736", + "rsa.misc.event_source": "proident", + "rsa.misc.reference_id": "esciu", + "rsa.misc.severity": "very-high", + "rsa.network.domain": "ptasnula2158.internal.host", + "server.domain": "ptasnula2158.internal.host", + "service.type": "symantec", + "source.address": "alo7567.www5.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "275", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "00:38:14 SymantecServer metMal6112.mail.test: Site: https://api.example.net/orsit/ntium.html?rudexer=Exc#atvol,Server: onse3264.example,Domain: scingeli5972.invalid,The 275 ^^The process sumq.exe can not lock the process status table. The process status has been locked by the server idest4209.api.domain (mdolorem) since 2019-04-01T00:38:14Z.", + "fileset.name": "endpointprotection", + "host.hostname": "idest4209.api.domain", + "input.type": "log", + "log.offset": 27394, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "process.name": "sumq.exe", + "rsa.internal.event_desc": "The process can not lock the process status table", + "rsa.internal.messageid": "275", + "rsa.misc.reference_id": "275", + "rsa.time.recorded_time": "2019-04-01T00:38:14.000Z", + "service.type": "symantec", + "source.address": "idest4209.api.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "its1301.www.test", + "destination.ip": [ + "10.134.6.246" + ], + "destination.mac": "01:00:5e:db:43:45", + "destination.port": 998, + "event.code": "animid", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "April 15 07:40:49 amqu4988.www5.example SymantecServer: Site: https://www5.example.net/scinge/ofde.html?oinvento=amcorpor#sumqu,Server: sundeomn1396.mail.corp,Domain: odiconse1995.www.home,The 301 ^^emvel4391.localhost^^quelaud^^exer3621.www5.test^^uaerat^^animid^^2001:db8::dc285270:4466123b^^2001:db8::3d31ae1d:efe5bf87^^10.216.134.62^^10.134.6.246^^rnatu^^ico^^1555314049^^medium^^urQuis^^umetMa^^tisetqua6007.api.home^^dun^^nonpro^^its1301.www.test^^1^^6252^^998^^2^^1555314049^^1555314049^^4304^^quuntu^^0^^uaera^^iatisund^^ist^^equatur^^01:00:5e:78:f9:ee^^01:00:5e:db:43:45^^oin^^ntexpl^^oquisqua^^ovo^^lupta^^stenatus^^tiumtota^^itation^^eturad^^rumS^^nihil^^psu", + "fileset.name": "endpointprotection", + "group.name": "uaerat", + "host.hostname": "tisetqua6007.api.home", + "host.name": "exer3621.www5.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 27738, + "network.application": "quuntu", + "network.direction": "outbound", + "network.protocol": "Others", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.216.134.62", + "10.134.6.246" + ], + "related.user": [ + "ntexpl" + ], + "rsa.counters.dclass_c1": 4304, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.messageid": "301", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.group": "uaerat", + "rsa.misc.reference_id": "animid", + "rsa.misc.rule": "uaera", + "rsa.misc.rule_name": "iatisund", + "rsa.misc.severity": "medium", + "rsa.network.alias_host": [ + "exer3621.www5.test" + ], + "rsa.network.domain": "emvel4391.localhost", + "rsa.network.host_dst": "its1301.www.test", + "rsa.network.zone": "oin", + "rsa.time.endtime": "2019-04-15T07:40:49.000Z", + "rsa.time.starttime": "2019-04-15T07:40:49.000Z", + "rule.name": "iatisund", + "server.domain": "emvel4391.localhost", + "service.type": "symantec", + "source.address": "tisetqua6007.api.home", + "source.domain": "oquisqua", + "source.ip": [ + "10.216.134.62" + ], + "source.mac": "01:00:5e:78:f9:ee", + "source.port": 6252, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "ntexpl" + }, + { + "destination.ip": [ + "10.202.96.232" + ], + "destination.port": 5074, + "event.code": "Remote:", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "Apr 29 2:43:23 ventorev7571.www5.corp SymantecServer: Site: https://www5.example.com/quamni/ents.gif?leum=olabor#modte,Server: uianonn4552.internal.invalid,Domain: quaUteni2026.lan,Remote: , Remote: untmoll,Remote: 10.202.96.232,Remote: ngeli,Unknown,OTHERS,,Begin: 2019-4-29 2:43:23,End: 2019-4-29 2:43:23,Occurrences: 569,Application: exerc,Location: boNemo,User: nat,Domain: atnu2000.internal.corp,Local Port 4012,Remote Port 5074,CIDS Signature ID: 5057,CIDS Signature string: tobe,CIDS Signature SubID: equep,Intrusion URL:https://internal.example.com/umiu/veritat.jpg?conse=equamni#ursin,Intrusion Payload URL:orissus", + "fileset.name": "endpointprotection", + "host.hostname": "Remote:", + "host.name": "ventorev7571.www5.corp", + "input.type": "log", + "log.offset": 28408, + "network.application": "exerc", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.202.96.232" + ], + "related.user": [ + "nat" + ], + "rsa.counters.dclass_c1": 569, + "rsa.counters.dclass_c1_str": "Occurences", + "rsa.internal.messageid": "Remote:", + "rsa.misc.sig_id": 5057, + "rsa.misc.sig_id_str": "tobe", + "rsa.network.alias_host": [ + "ventorev7571.www5.corp" + ], + "rsa.network.domain": "atnu2000.internal.corp", + "rsa.time.endtime": "2019-04-29T04:43:23.000Z", + "rsa.time.starttime": "2019-04-29T04:43:23.000Z", + "server.domain": "atnu2000.internal.corp", + "service.type": "symantec", + "source.address": "Remote:", + "source.port": 4012, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "url.original": "https://internal.example.com/umiu/veritat.jpg?conse=equamni#ursin", + "user.name": "nat" + }, + { + "event.code": "sequat", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "21:45:57 SymantecServer uelaud897.mail.example: Site: https://example.org/etcon/its.html?imven=eddoeius#eniamqu,Server: mdoloree4076.lan,\"302449156 ^^uamestqu7272.internal.host^^ectetur^^umSectio5136.www.local^^omn^^imidestl^^sequat^^lmol^^1557783957^^very-high^^olorinre^^quiacons^^untexpli391.internal.domain^^Finibus^^num^^ipitlabo^^sumqu^^epreh^^urs^^stquidol^^doconse^^taspern^^cit^^isautemv^^tatemse^^uradi^^velit", + "fileset.name": "endpointprotection", + "group.name": "omn", + "host.hostname": "untexpli391.internal.domain", + "host.name": "umSectio5136.www.local", + "input.type": "log", + "log.level": "very-high", + "log.offset": 29032, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ipitlabo", + "rsa.internal.messageid": "302449156", + "rsa.misc.event_source": "num", + "rsa.misc.group": "omn", + "rsa.misc.reference_id": "sequat", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "umSectio5136.www.local" + ], + "rsa.network.domain": "uamestqu7272.internal.host", + "server.domain": "uamestqu7272.internal.host", + "service.type": "symantec", + "source.address": "untexpli391.internal.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "destination.address": "quipex2615.www5.localhost", + "destination.ip": [ + "10.29.149.77" + ], + "destination.mac": "01:00:5e:96:a7:ec", + "destination.port": 5823, + "event.code": "quis", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "04:48:31 SymantecServer reetdo5853.test: entsun4896.www5.localdomain,Category: uepo,eomni,\"308 ^^cepteur6876.internal.host^^iutaliq^^quide2790.mail.invalid^^epre^^quis^^2001:db8::7d97d66e:3eeaa2cc^^2001:db8::81638ee3:4962a1e4^^10.56.95.160^^10.29.149.77^^siutaliq^^liquaUt^^1559018911^^low^^modo^^sequ^^eniamqu1863.api.lan^^utal^^maccusa^^quipex2615.www5.localhost^^3^^2305^^5823^^1^^1559018911^^1559018911^^3992^^Section^^ididunt^^luptatem^^Block all other IP traffic and log^^onofdeFi^^xeacom^^01:00:5e:9f:99:04^^01:00:5e:96:a7:ec^^aveni^^rema^^nby^^nofde^^ritinvol^^mSecti^^tionula^^adolors^^cididunt^^dolore^^sunte^^imadm", + "fileset.name": "endpointprotection", + "group.name": "epre", + "host.hostname": "eniamqu1863.api.lan", + "host.name": "quide2790.mail.invalid", + "input.type": "log", + "log.level": "low", + "log.offset": 29452, + "network.application": "Section", + "network.direction": "inbound", + "network.protocol": "UDP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.56.95.160", + "10.29.149.77" + ], + "related.user": [ + "rema" + ], + "rsa.counters.dclass_c1": 3992, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "Block all other IP traffic and log", + "rsa.internal.messageid": "308", + "rsa.investigations.ec_activity": "Deny", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.group": "epre", + "rsa.misc.reference_id": "quis", + "rsa.misc.rule": "luptatem", + "rsa.misc.rule_name": "Block all other IP traffic and log", + "rsa.misc.severity": "low", + "rsa.network.alias_host": [ + "quide2790.mail.invalid" + ], + "rsa.network.domain": "cepteur6876.internal.host", + "rsa.network.host_dst": "quipex2615.www5.localhost", + "rsa.network.zone": "aveni", + "rsa.time.endtime": "2019-05-28T04:48:31.000Z", + "rsa.time.starttime": "2019-05-28T04:48:31.000Z", + "rule.name": "Block all other IP traffic and log", + "server.domain": "cepteur6876.internal.host", + "service.type": "symantec", + "source.address": "eniamqu1863.api.lan", + "source.domain": "nby", + "source.ip": [ + "10.56.95.160" + ], + "source.mac": "01:00:5e:9f:99:04", + "source.port": 2305, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "rema" + }, + { + "destination.address": "remipsum5485.api.local", + "destination.ip": [ + "10.173.98.74" + ], + "destination.mac": "01:00:5e:f3:43:d1", + "destination.port": 5161, + "event.code": "lit", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "11:51:06 SymantecServer uscipitl2176.api.test: Site: https://mail.example.com/peria/nculpaq.gif?roquisqu=acommod#eetd,Server: orin7130.www5.test,Domain: ratione4963.www.example,301 ^^tationul5346.internal.localdomain^^edquiano^^ugia146.www5.corp^^uisnostr^^lit^^2001:db8::f3063373:92b97c88^^2001:db8::5b387f17:aa0c6698^^10.70.185.238^^10.173.98.74^^orsitame^^quame^^1560253866^^high^^tempora^^liquip^^tionul7555.www5.lan^^cin^^itsedqu^^remipsum5485.api.local^^2^^1775^^5161^^2^^1560253866^^1560253866^^2128^^lupta^^0^^reetdo^^Block all other IP traffic and log^^gnaal^^ntsunt^^01:00:5e:a7:37:7d^^01:00:5e:f3:43:d1^^nvo^^tenby^^aaliqu^^quaeabil^^umq^^ptate^^ade^^eip^^entor^^turExce^^ncidid^^modi", + "fileset.name": "endpointprotection", + "group.name": "uisnostr", + "host.hostname": "tionul7555.www5.lan", + "host.name": "ugia146.www5.corp", + "input.type": "log", + "log.level": "high", + "log.offset": 30078, + "network.application": "lupta", + "network.direction": "outbound", + "network.protocol": "TCP", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.173.98.74", + "10.70.185.238" + ], + "related.user": [ + "tenby" + ], + "rsa.counters.dclass_c1": 2128, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "Block all other IP traffic and log", + "rsa.internal.messageid": "301", + "rsa.investigations.ec_subject": "NetworkComm", + "rsa.investigations.ec_theme": "Communication", + "rsa.misc.group": "uisnostr", + "rsa.misc.reference_id": "lit", + "rsa.misc.rule": "reetdo", + "rsa.misc.rule_name": "Block all other IP traffic and log", + "rsa.misc.severity": "high", + "rsa.network.alias_host": [ + "ugia146.www5.corp" + ], + "rsa.network.domain": "tationul5346.internal.localdomain", + "rsa.network.host_dst": "remipsum5485.api.local", + "rsa.network.zone": "nvo", + "rsa.time.endtime": "2019-06-11T11:51:06.000Z", + "rsa.time.starttime": "2019-06-11T11:51:06.000Z", + "rule.name": "Block all other IP traffic and log", + "server.domain": "tationul5346.internal.localdomain", + "service.type": "symantec", + "source.address": "tionul7555.www5.lan", + "source.domain": "aaliqu", + "source.ip": [ + "10.70.185.238" + ], + "source.mac": "01:00:5e:a7:37:7d", + "source.port": 1775, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "tenby" + }, + { + "event.action": "allow", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=nisiutal cid=ptassi eid=mtota,lit Jun 25 18:53:40 2019,odite,Symantec AntiVirus,SYSTEM,Information,ilmoles4582.api.lan,tqui. string-data=[ Scan type: tautfug Event: success Security risk detected: metMalo File: uatur Location: uia Computer: upid User: dolor Action taken:allow Date found: itsed]", + "file.directory": "metMalo", + "file.name": "uatur", + "fileset.name": "endpointprotection", + "host.hostname": "ilmoles4582.api.lan", + "input.type": "log", + "log.offset": 30774, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "dolor" + ], + "rsa.internal.event_desc": "tqui", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "allow" + ], + "rsa.misc.event_type": "tautfug", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "success", + "service.type": "symantec", + "source.address": "ilmoles4582.api.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "dolor" + }, + { + "event.code": "Connected", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "01:56:14 SymantecServer giatquo3267.www.lan: quiado6095.mail.localhost,Category: ioffici,proide,\"Connected to Management Server 10.8.24.150.", + "fileset.name": "endpointprotection", + "host.hostname": "quiado6095.mail.localhost", + "host.name": "giatquo3267.www.lan", + "input.type": "log", + "log.offset": 31120, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "Connected to Management Server", + "rsa.internal.messageid": "Connected", + "rsa.network.alias_host": [ + "giatquo3267.www.lan" + ], + "rsa.time.event_time_str": "01:56:14", + "service.type": "symantec", + "source.address": "quiado6095.mail.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "deny", + "event.code": "2", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "July 24 08:58:48 aut1615.mail.example SymantecServer: tatis3791.www5.test,SHA-256:iceroinB,MD-5:lab,\"[SID: tobe] 2 ^^odite7850.internal.corp^^asnula6304.internal.example^^elitse^^cidun7605.www5.example^^10.201.112.171^^rinrepre^^modicons^^uidolor^^tenatu^^deny^^2019-07-24T08:58:48Z^^rrorsit^^eprehen^^1470^^diconseq^^runtm", + "file.name": "diconseq", + "fileset.name": "endpointprotection", + "host.hostname": "cidun7605.www5.example", + "host.name": "odite7850.internal.corp", + "input.type": "log", + "log.offset": 31261, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.201.112.171" + ], + "related.user": [ + "elitse" + ], + "rsa.counters.dclass_c1": 1470, + "rsa.counters.dclass_c1_str": "Virus Count.", + "rsa.db.index": "uidolor", + "rsa.internal.event_desc": "Security risk found", + "rsa.internal.messageid": "2", + "rsa.investigations.ec_activity": "Detect", + "rsa.investigations.ec_subject": "Virus", + "rsa.investigations.ec_theme": "TEV", + "rsa.misc.action": [ + "deny" + ], + "rsa.misc.checksum": "lab", + "rsa.misc.disposition": "tenatu", + "rsa.misc.event_source": "rinrepre", + "rsa.misc.virusname": "modicons", + "rsa.network.alias_host": [ + "odite7850.internal.corp" + ], + "rsa.network.domain": "asnula6304.internal.example", + "rsa.threat.threat_category": "modicons", + "rsa.time.recorded_time": "2019-07-24T08:58:48.000Z", + "server.domain": "asnula6304.internal.example", + "service.type": "symantec", + "source.address": "cidun7605.www5.example", + "source.ip": [ + "10.201.112.171" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "elitse" + }, + { + "event.code": "ationu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP: 302448900^^tion595.internal.corp^^laboru6211.mail.local^^emporai^^mqu^^ationu^^gna^^1565193683^^medium^^temUt^^quaturQ^^ssitasp7492.test^^veri^^ssitaspe^^eserun^^niamqu^^quianonn^^uines^^rat^^mSect^^perspic^^mulla^^vol^^consect^^iqu^^uptate", + "fileset.name": "endpointprotection", + "host.hostname": "ssitasp7492.test", + "input.type": "log", + "log.level": "medium", + "log.offset": 31585, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "eserun", + "rsa.internal.messageid": "302448900", + "rsa.misc.event_source": "ssitaspe", + "rsa.misc.reference_id": "ationu", + "rsa.misc.severity": "medium", + "rsa.network.domain": "laboru6211.mail.local", + "server.domain": "laboru6211.mail.local", + "service.type": "symantec", + "source.address": "ssitasp7492.test", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "tasu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "23:03:57 SymantecServer ntsun948.home: ima1551.www.invalid,\"[SID: atemse] 302452802 ^^ntiumtot6232.api.corp^^npro^^estq2131.api.localdomain^^atn^^luptasnu^^tasu^^exeac^^1566428637^^very-high^^itesse^^gitse^^rem6392.internal.domain^^amea^^upt^^did^^rspiciat^^iaec^^lab^^nimi^^uscipit^^tuserror^^ionul^^exercit^^tetur^^ion^^olu", + "fileset.name": "endpointprotection", + "group.name": "atn", + "host.hostname": "rem6392.internal.domain", + "host.name": "estq2131.api.localdomain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 31839, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "did", + "rsa.internal.messageid": "302452802", + "rsa.misc.event_source": "upt", + "rsa.misc.group": "atn", + "rsa.misc.reference_id": "tasu", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "estq2131.api.localdomain" + ], + "rsa.network.domain": "ntiumtot6232.api.corp", + "server.domain": "ntiumtot6232.api.corp", + "service.type": "symantec", + "source.address": "rem6392.internal.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "orumSec", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "06:06:31 SymantecServer ididuntu2165.api.host: Site: https://internal.example.net/ommo/ddoeius.htm?ten=turadipi#liquide,Server: remipsum2332.api.domain,Domain: gel3984.mail.example,The 303235079 ^^ree4785.internal.localdomain^^edolori^^giatq7007.www.domain^^ntinc^^ptatev^^orumSec^^totamr^^1567663591^^very-high^^pidatat^^perna^^upi3.www.home^^temUten^^iquaUt^^caecatc^^ationula^^abo^^onofde^^eriame^^sunde^^otamrema^^madminim^^orsitam^^tiumto^^psumdol^^atcup", + "fileset.name": "endpointprotection", + "group.name": "ntinc", + "host.hostname": "upi3.www.home", + "host.name": "giatq7007.www.domain", + "input.type": "log", + "log.level": "very-high", + "log.offset": 32165, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "caecatc", + "rsa.internal.messageid": "303235079", + "rsa.misc.event_source": "iquaUt", + "rsa.misc.group": "ntinc", + "rsa.misc.reference_id": "orumSec", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "giatq7007.www.domain" + ], + "rsa.network.domain": "ree4785.internal.localdomain", + "server.domain": "ree4785.internal.localdomain", + "service.type": "symantec", + "source.address": "upi3.www.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "reprehe", + "event.code": "5", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%SymantecEP-orem: 10.90.66.238^^itess2258.api.lan^^eprehend3993.internal.test^^nulap^^ianonnu4387.www.domain^^10.59.140.108^^5^^^^llumdolo^^sequines^^reprehe^^block^^2019-09-19T13:09:05Z^^agna^^laud^^5043^^abor^^esse", + "file.name": "5043", + "fileset.name": "endpointprotection", + "host.hostname": "ianonnu4387.www.domain", + "host.ip": "10.90.66.238", + "host.name": "itess2258.api.lan", + "input.type": "log", + "log.offset": 32625, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.ip": [ + "10.59.140.108", + "10.90.66.238" + ], + "related.user": [ + "nulap" + ], + "rsa.counters.dclass_c1_str": "Virus Count.", + "rsa.db.index": "llumdolo", + "rsa.internal.event_desc": "CAL Event", + "rsa.internal.messageid": "5", + "rsa.investigations.ec_activity": "Detect", + "rsa.investigations.ec_subject": "Virus", + "rsa.investigations.ec_theme": "TEV", + "rsa.misc.action": [ + "reprehe" + ], + "rsa.misc.disposition": "sequines", + "rsa.misc.event_source": "5", + "rsa.misc.virusname": "", + "rsa.network.alias_host": [ + "itess2258.api.lan" + ], + "rsa.network.domain": "eprehend3993.internal.test", + "rsa.threat.threat_category": "", + "server.domain": "eprehend3993.internal.test", + "service.type": "symantec", + "source.address": "ianonnu4387.www.domain", + "source.ip": [ + "10.59.140.108" + ], + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "nulap" + }, + { + "destination.address": "ess3012.mail.test", + "destination.ip": [ + "10.45.116.216" + ], + "destination.mac": "01:00:5e:38:9e:75", + "destination.port": 7638, + "event.code": "ratvo", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "October 3 20:11:40 identsu4913.mail.localdomain SymantecServer: Site: https://api.example.com/uptatemq/ctionof.jpg?risni=ovolupt#tionu,Server: ntium1347.www.test,Domain: econse4373.www.invalid,221 ^^tdo6940.mail.local^^fugiat^^epteur5858.www5.local^^rissus^^consequa^^idolor^^ratvo^^10.38.136.160^^10.45.116.216^^01:00:5e:b5:7b:f4^^01:00:5e:38:9e:75^^psu^^epr^^citat^^1570133500^^low^^imad^^vol^^rin5257.www5.test^^psa^^sumquia^^ess3012.mail.test^^1^^1^^mnisiste^^1570133500^^1570133500^^490^^elitess^^emeumfu^^tMalorum^^oremip^^orsitvo^^eacomm^^iuntNeq^^uiadolor^^emUt^^epreh^^eritq^^uaeratv^^quiaco^^todi^^2001:db8::655ca99c:30b2c2da^^2001:db8::16767bb2:194dacee^^4364^^7638^^1297^^osam^^2852^^https://mail.example.com/quaeabil/uredolo.htm?atnul=eroinB#beataev^^https://internal.example.org/aaliqua/atiset.txt?tat=uamestq#eri^^amv^^1.6400^^mveni", + "fileset.name": "endpointprotection", + "group.name": "rissus", + "host.hostname": "rin5257.www5.test", + "host.name": "epteur5858.www5.local", + "http.request.referrer": "https://internal.example.org/aaliqua/atiset.txt?tat=uamestq#eri", + "input.type": "log", + "log.level": "low", + "log.offset": 32842, + "network.application": "elitess", + "network.direction": "inbound", + "network.protocol": "Others", + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "observer.version": "1.6400", + "related.ip": [ + "10.38.136.160", + "10.45.116.216" + ], + "related.user": [ + "epr" + ], + "rsa.counters.dclass_c1": 490, + "rsa.counters.dclass_c1_str": "No. of attacks", + "rsa.internal.event_desc": "emeumfu", + "rsa.internal.messageid": "221", + "rsa.misc.group": "rissus", + "rsa.misc.policy_id": "mveni", + "rsa.misc.reference_id": "ratvo", + "rsa.misc.severity": "low", + "rsa.misc.sig_id": 1297, + "rsa.misc.sig_id1": 2852, + "rsa.misc.sig_id_str": "osam", + "rsa.misc.version": "1.6400", + "rsa.network.alias_host": [ + "epteur5858.www5.local" + ], + "rsa.network.domain": "tdo6940.mail.local", + "rsa.network.host_dst": "ess3012.mail.test", + "rsa.network.zone": "psu", + "rsa.time.endtime": "2019-10-03T20:11:40.000Z", + "rsa.time.starttime": "2019-10-03T20:11:40.000Z", + "server.domain": "tdo6940.mail.local", + "service.type": "symantec", + "source.address": "rin5257.www5.test", + "source.domain": "citat", + "source.ip": [ + "10.38.136.160" + ], + "source.mac": "01:00:5e:b5:7b:f4", + "source.port": 4364, + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "url.original": "https://mail.example.com/quaeabil/uredolo.htm?atnul=eroinB#beataev", + "user.name": "epr" + }, + { + "event.code": "onulamc", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "October 18 03:14:14 quiadolo7345.www5.example SymantecServer: Site: https://www.example.com/cte/ntu.gif?ercitati=dolo#iutaliq,Server: inimv3115.api.local,\"302449409 ^^eumfug6647.home^^equ^^ptatemse^^onulamc^^itanim^^1571368454^^low^^metco^^oremeumf^^aed3193.api.lan^^animid^^sunti^^equa^^rure^^quat^^inim^^corp^^inBCSedu^^ptassita^^ritt^^magna^^tatemq^^sequ^^quii", + "fileset.name": "endpointprotection", + "host.hostname": "aed3193.api.lan", + "input.type": "log", + "log.level": "low", + "log.offset": 33690, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "equa", + "rsa.internal.messageid": "302449409", + "rsa.misc.event_source": "sunti", + "rsa.misc.reference_id": "onulamc", + "rsa.misc.severity": "low", + "rsa.network.domain": "eumfug6647.home", + "server.domain": "eumfug6647.home", + "service.type": "symantec", + "source.address": "aed3193.api.lan", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "257", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "November 1 10:16:48 eritin5441.api.example SymantecServer: Site: https://www5.example.org/cid/aturauto.gif?ciduntut=ita#identsu,Server: uep5156.mail.invalid,257 ^^atemq", + "fileset.name": "endpointprotection", + "input.type": "log", + "log.offset": 34054, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "atemq", + "rsa.internal.messageid": "257", + "rsa.misc.reference_id": "257", + "service.type": "symantec", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.code": "deFinibu", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "November 15 17:19:22 udexerci658.mail.test SymantecServer: aveniamq3804.api.corp,Category: quaturQ,tenat,\"302449166 ^^lillumqu7256.www5.invalid^^audantiu^^pici^^deFinibu^^pitlab^^1573838362^^low^^sum^^tamre^^rumSec5271.home^^erspi^^evolupt^^unt^^emaper^^nse^^temUt^^onseq^^icia^^amnihilm^^isquames^^evelite^^eumfugia^^roquis^^porinci", + "fileset.name": "endpointprotection", + "host.hostname": "rumSec5271.home", + "input.type": "log", + "log.level": "low", + "log.offset": 34223, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "unt", + "rsa.internal.messageid": "302449166", + "rsa.misc.event_source": "evolupt", + "rsa.misc.reference_id": "deFinibu", + "rsa.misc.severity": "low", + "rsa.network.domain": "lillumqu7256.www5.invalid", + "server.domain": "lillumqu7256.www5.invalid", + "service.type": "symantec", + "source.address": "rumSec5271.home", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + }, + { + "event.action": "block", + "event.code": "Application_45", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "%NICWIN-4-Application_45_Symantec: Application,rn=eaco cid=piscing eid=reseosqu,acommo Nov 30 00:21:57 2019,tiaecons,Symantec AntiVirus,SYSTEM,Information,volu7499.www5.localhost,edutpe. string-data=[ Scan type: uip Event: unknown Security risk detected: redolori File: Uteni Location: sitamet Computer: duntu User: sedqui Action taken:block Date found: rnatu]", + "file.directory": "redolori", + "file.name": "Uteni", + "fileset.name": "endpointprotection", + "host.hostname": "volu7499.www5.localhost", + "input.type": "log", + "log.offset": 34557, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "related.user": [ + "sedqui" + ], + "rsa.internal.event_desc": "edutpe", + "rsa.internal.messageid": "Application_45", + "rsa.misc.action": [ + "block" + ], + "rsa.misc.event_type": "uip", + "rsa.misc.msgIdPart1": "Application", + "rsa.misc.msgIdPart2": "45", + "rsa.misc.result": "unknown", + "service.type": "symantec", + "source.address": "volu7499.www5.localhost", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ], + "user.name": "sedqui" + }, + { + "event.code": "esciuntN", + "event.dataset": "symantec.endpointprotection", + "event.module": "symantec", + "event.original": "07:24:31 SymantecServer seosq1937.internal.localdomain: Site: https://internal.example.net/eca/uidolor.gif?nostru=tatemacc#cididu,Server: hil1908.mail.localdomain,Domain: porissu4165.example,Admin: dolore,302449409 ^^mol400.domain^^aud^^oNem5850.www.example^^yCiceroi^^atis^^esciuntN^^tNequepo^^1576308271^^very-high^^mnisi^^emporai^^gnama2349.mail.domain^^eritinvo^^ntiu^^ccusan^^ura^^pida^^remeumf^^ipexeaco^^itvo^^psumquia^^nisisten^^quamqu^^ecillumd^^tatisetq^^con", + "fileset.name": "endpointprotection", + "group.name": "yCiceroi", + "host.hostname": "gnama2349.mail.domain", + "host.name": "oNem5850.www.example", + "input.type": "log", + "log.level": "very-high", + "log.offset": 34918, + "observer.product": "Endpoint", + "observer.type": "Anti-Virus", + "observer.vendor": "Symantec", + "rsa.internal.event_desc": "ccusan", + "rsa.internal.messageid": "302449409", + "rsa.misc.event_source": "ntiu", + "rsa.misc.group": "yCiceroi", + "rsa.misc.reference_id": "esciuntN", + "rsa.misc.severity": "very-high", + "rsa.network.alias_host": [ + "oNem5850.www.example" + ], + "rsa.network.domain": "mol400.domain", + "server.domain": "mol400.domain", + "service.type": "symantec", + "source.address": "gnama2349.mail.domain", + "tags": [ + "symantec.endpointprotection", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/symantec/fields.go b/x-pack/filebeat/module/symantec/fields.go new file mode 100644 index 00000000000..d3b0ee3cbca --- /dev/null +++ b/x-pack/filebeat/module/symantec/fields.go @@ -0,0 +1,23 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package symantec + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("filebeat", "symantec", asset.ModuleFieldsPri, AssetSymantec); err != nil { + panic(err) + } +} + +// AssetSymantec returns asset data. +// This is the base64 encoded gzipped contents of module/symantec. +func AssetSymantec() string { + return "eJzsfe9zGzey4Pf9K3D5cLZTDp04id+tb9+78pOUjW5tR8+ynVdXWzUFYpokIgwwBjCkmL/+Cg3McMjBUBIFUPK72w9bsUg2uhtAo3/3d+QK1q+JWVdUWmB/IcRyK+A1uQx/IW+k5Z+5bsyLM1nWiktLLrSywCxX8i+ElGCY5rX712vyb38hhHTQyIyDKM3kLyT812v82P3vOyJpBa+JBLtS+mrCpQU9owwm7u/d1whRS9ArzS28JlY3/U/suobXDv2V0mXv7yXMaCNsgUu+JjMqDGx9PMC3/d97WgFRM2IX0CJGOsTIagEa8DOr6WzGGVlQQ6YAkqipAb2EcjKgTxt6B2LmWjX17UnZZepmWcRaUrFF3vjqY+vHltgsUpn51t/3rzC+YYNd+bjgxn2PcEMaAyWxijBa2ybwX9MVqcAYOnf/ppYwVYFxRCv3+Q5oQt6qOTkFpkrQcUI8LL6L1KHktHBhCdIWjrTEgAPCmbkfWG6Q50xJC9Iadz+4NJZK26JhojhaXh2CYEnt7gdD7LjHyS1BqCWrBWcLQokBY7iSZMGtIZS8B/s7txKMaXd/MjgaHbFmoRpREglL0GQK3bmrqTZA3oGlDjVKZlpVvaWevlVz8+KCsiuw5tkA/CnXwKxYPyc24E3JB/DCwp9w2UNzEmWkgCWIAzgplNy9n1ucPIVaA6M2YFLCjEsoiZIC0bJ0KoBUtI5jVZl5kezC7Nnjd+Gen5/+QJZUNOHG8xKk5TMeTidcU2aJUHO/X3qwEUgdd+DDacHvue2oqbacNYJq/H3Y2MnoyRiAPuikxE7GAPL4SRndkuVx9+Tl/9+T/XviVs2zIfe7vmr6R4GE7G7Lo8FuSQ8RetlR02BUo1mmt/f+bMt1/++HmbHUQgXSPkbkaFNyWzBBd+7wI0EPpNXrx4jYwulUjxExLg9DLK/G1EqOx3vSSqCHSI+8bJsBlCltqBG9JmZn9r7YugUcNgM9ZKAk3M+K2NFDBtBvsCLGubjjWjkSF2XPqxJln2fXgMxE7CMRDt6ZfewYanUj+ZcGNmq07ugPf1pvG7UnSjL3OFCrHrtlOyJuljyvOOxz98Qtw2ec0f59fqvm5GwJ0pJLFM6kkSVoZ4JoCIJqQPqMX0NJDFgHZOvH22uYcYOl3YQB7HsbLN0mDEDfaVOGnsD0/qXDDuaArjvw5G48WCiTSV/tn8tflbF9ESl2T6QBWXI5bz80sWPT8yF9PfzlhxywwY9GGXt+sfyJ0LLUTlaOXfdd5g6ot+prZe7yVW72vvp/l72OW/llw65c8I60vresJJTM+RJk5yT7ehUBx6LD/Bd5LZDyMSp/X0dEY9Shoep1oeFLhr3uBw9xg5Hu6Rq5fOaXJhd4kZ4Hb7al5OO6BsLoUIJMgQC3C9Dk07m0P7wiSpNfhKL2x5dkSg2eojZANuPzRlO7K4iGdB+i7n7FdGMYNJ/xmcC/4H49V7ncbPus43blr97BoPSK6jKbUteTaD2y+5w8v/i8pe9RokHQ3S0lxKyNhSo8ogFtB20B/qQazzz3b6X5nEsq2t9says38CGX/rUnMeL84vOrCAsC+gNO3J8FHUZDLqd4fTYHdag4Hvr6LICWoI8Su/4VlyLnp/eJknp8+8FSBHNYrPRRO9kEK7L72WiraJ1vFC28KM50OVFCALNKf40C2HHvAXJu3JnjhjDPOigdpluK6lu1q7aQPYx+hBZfxaaPRVWtlMFkt0pJMl0PNo0QDV8aMNYBNLyqxTrsk/uyE/QEKFsQw0sgT78ndqEb8vLnn5+RFTXEAMhulT2ceBTK6y04YWolDeRjBftqTgVTjbSdT6Gppl7ouatsohDIUzpVS+gxg8toZmUr3ozVQKvR+8O+mmPzwKyCkje7eloKRn0T0xw7xwKfEW7/2bz8/oe/Gi/SX9QoQFuk/zmg5p/OHnxL16DJS3ImGa1NI3xkxZmUd5LrMej3DH5Ecitjq/z4kvyrI/c5+fFH8q+EKe30ZaQiLPqc/Hdh/6f7IjdkmynfRLdQqhIera0rV1AwKsSUsqu8GrBHTiqL14Zab1c4JkJbRYCshniCMx6OArRWmfLTNvqgqYFxKhBjxNRYpZ1mLdde63AfLKngpT8YMaQImalGlu6FEYDIczkPytGNyYvbN2IAOUUsMFyHPWGjkV1YC0XLx/LOBXSI4X8CqcBqziJWRzCF+19GW9g/960Qds8+tRuNVs3abZuQX9XKbc3Q5uSSKO2MMavIFUB9A9MexYv3lTBNKwbGFEteFmWuqGtXvzQHCZpavOSl42DPLlxybRsqnNG+5XuXERcHr7gzuzFWjszwVISrfn5KtJPWBh0qyDSq52C7r93ICaMzJT09OCd8Jtx+TugsoaCh4D8/bX2vH6BSFshlOO9MAz600/WYoHT/awMxX0HgJaxUmFrwnJkNj9qcN3yg9j8K3czJ3IznHW+dewPCWW9PXWu1hCfkv0aE0YuXGRcPEKN3qzrj6OLkzUXQfRmVjj28qpXe1XgJPpFfXRpE8zjcH5/8U4WGOJruMVfqtinfbH6yMdi9noOW+YS8/PkVWSHfK6CSUCHivgJ06qOatPEfkRVo8GCpJQKosUTJnXKRbSY+uJr4dTMxcldzhG0D735XukTGYVYTsIVUQs3Xu4G4GdcDLZaQnwlbUE2Z9Ux0l3qN+KPTXJJGhpweseUzH62oTV3Q7QP1OYMIe2KXaFFUTslUsg0jaLoalWkoWXfUSspQY/UxChl8DoqxRrcQjaWypLokUumKCv5nLL9X6SrKnzJkORzMItVMB0/SnZi0wbpD5oXgM0CKIwa+AaZkOaJgb7a7MDann2UPQVwyVdUCbPQAjDpRKSrwVvMdMdirN9P2gQ7ypVs7epzHjvL2yRw9fpWSdpFomzb1qalyXjZZTuUDMf5MljnY7kD+qWTubgt7xKJbvVUxfXrtx10OD0RUthv9hli4tuHykSVo0yunKPflgUX2976HbQ00FZmbMj2mdAllvncwJNmEZ8p0K7Y6Rptp032xH18fvlZaVROE2mBRvmEgqebKq/VVIyz/znLQhNa1aKtfNr1sKirpPFaaS4jA8E5rL3qkPK6GcPvEELWSPjJmaVXvegYDxm41h+Lw9llD2II760aVYCbkXWMsmkl9oO5WUjuSl0stHLhJewXYbObwXsIxNCHc5HZBzzsNM9AgmT8Q1KnWJV/y0mk2eB7iguyyFWQfd5gXJ/K65vpoFG7208eCrt1J5FasPbHGCT2nrzmk8IDu940m3PRRF85zJ407eTYZLNmlk6kmtQSqBorcfSF2/E99VVCD/NJAc7Sj5E63P0Ub+biihiAS5ci5QeR+SM3UhErBFkMzyLR5ZTO8vvMqB651kQHVusihPdcpRdE20JfJoWbQlXqvyMOYkDvmY/SNGTyXd3pzDhWbN8m1Q4IFmwdipxtCakcQZQMlPoVibRqRO+w0YkWpxjJVwQuPQ2e8YFa2mg1OCJWBBVsG5MgBgSVobnOWjuwhrF09FAH2Ijv7XD55ixcHvQP9K91VujhoGHeqgfEZ3xg+ce3WB3PGeqoEXTl/NlNkAzoXIy83BROti6oMQZYo3sFsPtYmfN620vuWoNLkt8uQGstNmxCw61fD9dsdGquSNLUyPKHguNXZQnNalr7DFKbyt3d3tAtPI2yRr3XRHUWRbCrQnN1VFkVpO0IV2x7C+pVs3c3wYsnf7wFpS5Cl0iFhdi9lavrHA3SvaUO7avoHsLgd7RDLXws+YLeToPsR85I+Z6+6b4YXMlT9BzETvFwL2uUWS2UJJYvQ8SKeQCvUvGgTVR5EqLcH8c5C/Rg9U7Zk398x3Qq7VqP4iCv+SnC2zn179siFC0QgNNeWYj0ilxuRM286zsAPjQBELC5OlbRwnVtj7RA6l95ft+mHSsvSuP/DR5WKFqFYA5gbHme2oHIOhYRVblkwFriEVS/Uj0qItZpPGws9CTHM0Tcedaet95+/uOgwNU0m7DrOCZ6tbeU+pqEhuJtf5JHp628R4xYrwBzD2oaDZpPzpZegJ+QS/KY0BvSEzgFbeYdM95nSLQ4D2C0Yr7cz/D3xv+/1rVCaTLVauc/avwZd05tdo/2kz8sLqm1qN10HOLVHJdwpNagOPdadUqLs1MZcV0rVEAKKud7iN5JQAdp22UV6s2j4mw9vBfHRawKASUgRhbkkUsnvNNSAlsy+7Ac0G4755LBGa3dhOnsFdxL1uBfcR9ja8M+AshW3i6Ase1lPTnHBKVabSKLkd3Pl/nvPS4BKShFRHDPSTXvBwBeIgENSzYiTDpaDmZDLjUzZHWzQr6zKg/GJL+drjDNifMmoT7Ypg/gNjKeEicbY9kCGfwy2CX/CjdvJUBMd/BtO8cVPx1Wgo2s//obFLXrflimfUvbkJsPLYXmKWBBqjGIc/aVuN6L2JG7YW34Frwkl9WJtOKOClNxcPSe1xpkozwlY9iSuKFNND6m9vOND7+tsNK3Agjakpga7eBls5OB7ETBVVU6Kqa2g/bC0Bizbq+759+ChNL7eHmZ4mLz4Zqqqm+EdzLBtlKy4LNUq5NMyJRnU9nmXSTHKjAGZs0aINfnSUOGdn6WqKJdBasjeQkKNPF19r2cqdWkP6U4lfMvlFZShFqhNRKcGvVPBQHGffNOhNuHlvo0Tg64QWUVdf7KTd0vsItCi99vlQ+H1Wx08r+Ry2K6nCzqDrvjuYKfcLtawJmLrz/9+TfvHxJr2jIv8d7wj+RdcrbvGGsqGAWkjRxB3txnQnIoi8ppme0QucclWbd59H3sPoHthRv0CwK7MQS0HUniMw+ruoVtQs+huqFMLI1WGDVv4zN+2xqYrMzxpIe20CHOEdMtMjGbuV92/h5WmxMlzSTjm3DWSCaDa/Qkb4W1QCwWEwdup28LOm6MPXvg1wz5Pj/rFYqqactn1ze4/WKFsVN/h9Vpy3Zhje/r62ggiMO7xO06ANHIlTvzqvifjuKfUW3DZXeMd+7yX+fyUvPeS5mlo3ED8tL1Q9OtwexbXq70D+iF8+T338/kpsjSUvHViYug92I7I+TRAT8LEHyInC1bcxI3UpVnn7GW/HdUNBdpeXdjrx5be+D7iqXGsP+kWJuenN2qyqfxzN2iyDrGXstxotBNy4uszQ79T4T/Yr80ignr7Gz98E9xx08Z2lZvKdo9RIwUYzxnlH5SVIkuqOZ2KQRWgb8rAJakFHREEBqTJ2h9la0P7qqpfeeIkldMw2vpC7vb58sX5xa4OTULLWO9RGKvLPnCg4K1rITeRFo8kOZeWXPK5pCgsRo5orXTO5rVPBvLLHdKLVndT2NUR/9Mh0rvLeMpKFTk473/7SLhkoinBibMwyNb9fEKenl3Tqhbwmlx4h4gHi9J7EveLYGTu6LFNdE5tnpY4ZtxcOZX7ALzuUIrXc2O+D0/DB26u9oRcrebzOeh8I+ziLPvcjwUEHFA7XWgwCyVKd3q8rT4yaXQr9H4Ez8Iw9h6k8tMPXsd41jXjOD+Nl5HcOjrPVFUXR867wl0JuVc4xtX790wz/c6hoyTWp85w3IwqGzZmpQW19IGyxvqYd9JSaew84OR6i9/IlDiqyxXVD5OhN+yq76QrDQ+RI2KkNfJTJ0QpeUdZ2085rtw6EXRUO0bJ71oFVe+XQt7WTD7UWgM1yXODjaW2SaU4d/4oysWDmR1u8am6Jrx8Mf5+uZe1OQaGDqNPg8bH/i44LOJXt33HMk/fGxzy0+HcvUOeMy5VkyrG2asjMfPkd8pJ0pROh4FH9qfEgHN3Ztw6Em+EcHKPmIYxMGbWCHLm1idMlWDckWib/cYtCy5LuE7MAMGNPUzzvKdswYXRFNMtElPQGN+sqOYCM3giHjwff5dzQpGJ37nfRimTGc6hmvrmQg+kEYfVydMun7MGbepQdOslzIBlQUXYJMS3HZ6ejRQZejfX8D3OnVDila8uySv4qvy33YeUS0NKsJSLiJNhqhrb+90IaUocPTez9djSLo8N8Rh/SC1UtciWzfOGlDCjIQQUOl+2MfyQrem04iVoQddYyGVVeFzJ08iNdB+g1R1+DbO2Ctz76o3ltsHGjCRK2MY2GDZsuu91TRrF6vl3GE2NaQZZxVRVufuU5xideOiE95J9a62WvPT+s7aLXAVmNBGqVOzwQOPdvWW/cLHRGlk/Ly+uGlzXmPT0MLK+XT2vrP9DTQ/0Ox1M3v9W0xCAid+umudrnHuKCcV+5y8vzsn5QKHqo5Gta22oLtmPQcLCrq4adp7UkL6LPyzkVseVey8iiqkqc1d8DSrudpWOgAtxuIyoR4v03RJ8yOAIlec9F3AoHfYJtF08hM952YVyRpx4VWqrcVAGnuDlT6fkdXTXTc5nqp3uffHJd89pA1GYrHENrOl7EXzq1xRi5a1tF6Z9iRtHcIREveLltkOkq66kS8oFHQYySOcKJ1hfOQOtRyYt+Dt0iK8/XdwtGCtVaADlA7ADkkK6geHzyYhE5FUxbcpyndw/w6siaR1QD25j4LBG53u9VOkhaq4SdjnYKbErTHOMggRu+tmrvucqbUpuu8q6TV+0gFFssN2mYsOLkk14YT+RPkssNQeXR7PKTz6fkaehVuJzI5yuPOUCCzgwD+zsulbGffMZ+W7oaJC7UZgrqVZyyxAywBpsZrHchj4yaZPRI7jgdtNCT9oq9/ehNOktzClbk0+j5prgU00foig/LLzFYi5JRbmcaVrB3nSMmmqc2pu/T8KWcnmBy5L3qvTJ0Zu2gL2sswhS5AbtC1MFHCNyWUjbfePew4r82kg0Jd+pEgR5yuVy8u1zwhV7Tqbu/8D9H5VUrA03k2/j8UXL6mIm6GByfmodalvDP7kguCj6ulBOrtvhV2q2t1GDVVkx9X+dBjzbNggGtDvIUYSWVVq5u4PZ53e/Uw3ko08A/vbbz+9+f/Ph7Ntvfc7tkmrKR8/kSumrlCXLN16w39sF+xG2UScYlamViFCzk7ZLSfccUOaei3UGE2amNEjDWUoB0nMlZcC4Su8FicQHUgEtVpQPhxPf2zuAvc9TA3XXJ3WJummmmS6FnZbG6tSV71ivnc0h1n9Lk72jbc1HPifpocUum8FgA5UmFJts6l5CvYsDMeOjjqaW1GyO2ENJjXYjipC5W94TF8oH9xO8u+PCIR/0/w/DVTcqs5/89yBHrOz56AMie5F8kMPRxnH34afUEZK2tna2Z5c+tV1Ge5tlh30yn6HbbXByb45Mty2r+THiYVj0NaNcOF63zVwugsw4P+3XtmEnLmcOWphHWhiMZxW2OdeFUxEPoOeQxGtMtw7VRyeqqhq564kaYCcPa9x0X+zew7X9O8R16g43c5hmfV/cLqks/13Fo2Yb3Cy1/BDJcG/shgtvIWcaU3PGVbIs0WNZ8Ij9imo5DDo8dtSNrOpC5RLGl+/fXZDfvB91k5QaR+TLUVMJLv/jLfnSgB7p3doIWWjY7dSZN7mh5xBdkw9t0Vk0ravT0lnCh7QPVKUeI+CA1gc5jm6CaiPBsXvDLdMPaKCC6irDbjmwGdwLtE5YgNwBbcpkU2m3YKbtdrUFuqR2Vyu8L9wpSLaoqE5VVtLBXdd0ML743tEnygbpVElgFovkZ4HBLG0BVQd4NsdWSxnAqukfGaDWNPkkDN9xKvnxwqB7wVM/OKFzWwVO9UyOtCwow8Eo6ctPHGwjExrvPcDTeb38SV7bRfL3ncmCWV2UJmnf9R50B/mwyNMtAC8FTS4xZAFyzmXCosgh6By50bKYFWbFLUsuP2QxE2plaJU+d6UPW9plPugZoi5MFlzmFCdc1qCr6TpZwvsAds2u8gBfUpHjrPC6qLWyqkgfkkLoy58K9Dimhy2y3U2h5kWZg9kOcPr8NyaLil4X1qZyG2wDdidaQIZHoeIyE9Jc5kO6FqYQU1GkDotuwf4+I/DkncF7sFP3QuzDTl3V24f9c0bYrzLC/peMsP9HRth/zQPbqlrQKeQQKR309OaZLKpGoPI9XWd4J1vg9VUGvaRqBJ9XdR7t22mZVMxTJyEFyDyHUmLgC0vvG5GF8QmJGXbQaJbHmnSA81iTZm2aOsMsUia7suospqpV1pkecJ1BhFhlnWGWCzaaNVmAN5JfSyqVAZbhEC5fOa5kehSWr1RtF0DLDG41VdUFExl82A5whiAJwtXTtU3vFnWQTRbIdVNkiGkwzS1nVGQoIDIFnYNk64RZV33Ykor1n1BOc+C9LLANaBbIvh1MHqx9Ym0W6NN5vXyVxwdtiim3f83SaIyZIu2suB3AWiUX1SbLNUeowHT6KjfjffzJZm31AINdeD9/eueIB45qXxbgvpt8ug5yPdgzLiCHDWOKWY5N5LOUxdnbgHPoBqbgNSYpFllEHa+XP5XG1oNm/olgG82ywBZ8BjnMGIOO5gpKnqxgdBs2l3lOSaXKRoBhKge3A3A+zyCbVG1W1Cad+d+DHssgTwJYw5wbq2l6T8gGdgaNT0Odi9U6G68NdiLXmeSrz8z3RzwDdKuBVhkUSV8KlAvtfMr1aqG4KfyE2fTQ11TTLAe8HCmETQF56efbp4bLjaUy+Zzj0thpo1MNC2yhgp8VlANqkxzX9Hp0W5OcGixObpilH3Z9aKeBfTDntCxT3wFepg6rtq2DMrxFvCqYVqrK0pXIAc5gpvGqyJMcGToe5WBzfZW8PVNt0rcs5bWpNU8MVFDLbZM8+0xwCela7GygmqQTdTq4WHyb3q0llO96WsyESv6cd8AzpPw7mze51HFAM0gcZ0NnQDV5boJQ8yxHV86zXOBa6dQCrJo28xzXrOKG5RALlclyYHPMgZBgsblScrjJZbhvAJ06489DTZ2OJ1er1BZIlooy5QdAJ7dEVXrNSGk+LyLzuO4NdyVBp3+z6sIP5U0ONulk6g1YP+I1yyHLULgZZuKkFgYBbGppUBfekZQcXWqM+7Bgi1R1/gPQcF3z5IGAGnQ111TaQc/dFJBXWQCnf3p9J7JPn3amgCYArNW8oKZOODCgD1rT1FA1UJFDv9PAkA++62gm4OmZ7CCnbeHag6x0mQHj9I5Mk8E3bLxvOEM+gIHUiQB+4HEG48TAl/QHINagNRnUDKaU4fMMgtfUqb1sRrMc90CzMrkibTSLdcVNANimG7HVh9mY5F01l0ymLpSITou9L1DfpDM1+XZu0x8rDzR9RK+b6Zka7rpO3q21KadZ8tAbLTK8hY0BXZQ8ddV7lrEVbWQoBxssM5ZWqb3By4JLY+ksg2aw5NrmUMOXtczQuskq3ciUbtZYW7RIR9E3jVXkQyPJYOkueyTjsLzPVPCSnGgouSUnVJehm6HB9u9xdPzkrIxcGpsQimBwiD7B/gZMCRIr1enyIbjMx7mzqhZqDYPBgjfyb6aaZE29b3nGHA+9zwjnnWmYwzWp6G6jhU0sVs6b3WEg2ZEU3OBwhnb1sPXYQImYpq6VtmTYeJSQ1YJawi2pNczGjsI90nLvMoQixvhgdXQoEC5DZ/eRvtCCy9wT+XuoutX6eBpi1RzsAvRk832zUM3gRSNEwhJ0N47IKlJTbYC8A0txIri/q7RjwdO3am5eXPiy12fkNIz4ek7sIjKlCJsBf4Aw+hjRluQ92N+5lWDi+zw81FmYN8OR3d0twsU9sQaoZosJlzyKH87cPUJ/7R3xibMwMBnihaCNxFm/8wbnuLZN3OMN3Hf6te+hKX877o6mrgl3mF88Yuy7jSgS1jTdrvMqLks+wrXFWzHmLjjGNOoRgbQZXPceJ1RLMTLxErvnZhwHjv1zDVii4UsDxu5p2n14tvLde+V7lQHH8vhVvcTe9Uh1eafb7pR9OHmMMDa29Xfs0G5eRylPOfv/5vmGbrHz01Yo4Nrxs4FWQ7ok3jseYfe4TKkB4tO1O2zI4FZ1uxR+8TD4ym4UfIe50r59fZSNhFBDDACOO6P751VpKg1lRxjvO+gw7ZeWqPZuDg1rNE5A24d0DbriXt04FtKbJf1gDr7kAuZABCxBEGoMn0u/cZt5/fGjjy2ZH1B+4/p7Tvr0QSY9O8wayb80sDsmkcYvXw/fwzomHjYFpdVoeOkvJFNSAuZWkBW3izFBQUikMqTT2DUcVF50Z9PCsRPlSfdECTXnjAriMBgxfRCLh8UOlxoZ0/hwvKsXaxNHr5fOtlI7Wa2pH3gqODXFQmW3CbwR15lrOEtlM9TIScX+CJ54PwDiL43DFt+0MIiFCaB68kYY5Qzxrft2isFy8mv4xYS8kevuXwPoFm15Iy2h5YSpqm4s6LgYzuLGd4TlM8++2d0LnLG4tSHc/rN5+f0Pf3W272lvO1qOfRNFO5zTIm3E7LaOG7oGTf6l88mZFwENRC5+61PX/+Q/83KD89ap37sfByYv3yTbnuwOTHHrTMj73z6eOdpBg3eeoL+05IZpqKlka6dVBvVM7OaCEOTQc/Lx3WtyLu2PL5+T8/enZ//5mnw6l/bVT+TparEmErhdgCZsoUwYlaa0BmbxWz+8+l//7dmTKEfALjLKuF1+oEydVDQ+jsdkPn13vOaX/iyet0jFr3j5uJDuy6YbMD+wYdytH/gYvjuK6cY6+cy1baggb9+8jyL7p5KQz5d12Mn4P0rCJM5bh+5XI0KRkJuFJ27BY3yD9+zDnFpY0QcYkY6n+4K8KUuNflp/ymPodE8vq+pD45z3jYWcn7y78K/SaHisouaI0Y8tp5LXVMPbTc4vHCoj3i/HwwMnQSThoVt7nIetJlb46VrHFRA9dGlZcvdlKjYB294s//g7d8QD4ExCvOAq3PDT7SMwQGWTa51Fr7vtk0bJ+4DhhdK2E8kDoVtigA03gNv1zZLXHJn3nh4u5+1j0pL1bozxEmJ247G8uAE7tHypMYpxp3J6v9FAxyFOLmsq5zDpTCem5IzPGw0lma4RJsgSs4bicqY+sPXAoGh0RFuOLjrL0O9AJNT9+yVcyR0AGiploQiZ3enzjNKztpSmoIVPxc8AurY6D/BZhiMxy1AtLHJch1z9T+oMTKVl0Xri8qnluxa8o2Oyu1rfmfAAGuyZXYCWYMnHdQ3Pyaf2GXuLDrAfyUXrABu8BL+NaWrtqJ4jKBMjpnGLdPCLPydUiKgyUW++iAluVGNi3hK0ewO5tIoYi485l+TT+ahAYZggm01eJRfZDqiqM4x9c4A1mNQZvQ5shhIX/yKmTkVHf3sGbP1ohUKAnCefFIk4O+UjoxY6ooF6lYeKXgBGEobpBDNCyS9Kr6guh3O6CXkzx2QvTai78deYSzcFuwKQcdUzcdfEu8a4laWiH6rzyBBsGY+ZEQMKuQx5rpiWUHHrxFIYsREncSmoPEYc/xYOyjZBpOeiHBC47bLcRFKWzoKdowG7/fKkjlQCwy4Ey3T94G4XsafactYIqgn2iyYtEk/Prl+/VXM1m8WnvwMr7AKyb+8Wsh/dgv429vA+c3g7dN80dgHShmTxUbRNk7Jzwu0SevyS46h/MqBHEVaNZeq4nA5LjiN82TAGxozgjJ3HD2uOdljiCeJFnIo7V3pNIoUJA9yOIZy2cIQdHJ1UwgCfqZV074qTWzHlsPshGShK21Qt0/WjG3k3KfFdS7FmQHAoO3qCH2ZHH+aSGG6biPwkWFwAQUQHqAtqCC1V7V4XuwCuiVrJzZZ5xll6raSqRvJqcSaH4b5F/XGVCKfcc1k6+aO06RhAyS9cAHkTEJsM2HAbZ6/sCPN3cjRhvKP/QdIVRllwGbIW0nIhRmOEESnr3e/BCJ+vdxnqNVJzYjwhdKpyVg9EiJ/Cgi65alC7ZKqqtar4SIYiHBu5M0mnAovIZuRkP25cLjuxkxHJXQy3tE4SRWALw6TDZQ5AMLJ+h1/u3e29spv7NnrsNmWWjbS75WypNfoSy8ALdohZfystCN/jOUjQnLUkIUMw0W83tYDbBT61sdluJCA7YT9MjNXjwc+WpkPabj0YTS/30xTUC79WRrqipmlnhFtegXFy3Wt7GmoYDSKFXUjWFOLGjcDGg/fcBn3Lo3VI7+4HO1o/3o6mHwqTbMjprUkLDuObKBzQhhRvBMIthMHXS93LG6nTR907f9GS0KZv3rlkvVSPI0BukOOdAPl6j+OPN29ZqtEGx9my28lHfVQJkvKO3UJ+HPU4pqRtcBg7pR5L0Hb81Mkrdxq7KCqwC/UAURK65UkmHo3wtdENx15KWmX1Ou2J6nxQIvhrHSJ7zmUmT8h/Tn7+/nvy9O3pm4tn5JQby+W84WYBJZbCR3ERaq6y9wXaFwnDbNmZxyNsM35xJGNMq8xexX31n25XYxh0NwY98smGPt/lujBM++/qfnuOP8QpFjOlMtYmfZMpRkWq7nQ7hHygJW+MX4EoTQyvuKDaiycnNt0dYviux8ur8J4bXh6z00g/U/6TOwitF3GnL+bmkuers3gj9911DGuESsOe/zc4ifCTwVkIjhvolWWUcVem0jkTAwYhG2S10nMq+Z97sqplvqNwW2YfwOn+mRph94zraC1ppq4/v7jl8LXwLb5876KtrOZfgQq7YFQDqTWUquKSRgvueuLpgloO0pob0+MFPSa1b+mDEutbP0Kd6eC6q/PECa6aaovNkDak7herR2x2FITNbSTqDErQ1EJZJEsq23M+nPD5pV2xC55daLXkZdc8LHyP1rUImurgYITmP+5Z29Zp4wrOhkheHonKbsnQ68+uR8iMDg/FzMkl99Hzxa7iPtICrlM6Uw4Fv6vmCdeoM/V+1KuEnkcI9ToqaqzUEGOV9hLfQavAUlztCX5r4r71JE59xctSwPGk3Dtc77ZyLrK9Pbl3kJxrx2Mch9yLsFqvw5Bct9HZ56QW1G2Ze5+VJiCZXtdjXn5MhTyCPXmLDDrd2Za/KmPJO8oWXI6YdCXNJDm+2eX1J4mZ/rUGJz6cfuSbnJkJeVvSmnzGf3j9qFTS153+c/h4kgVdgtOcBFBNvjSg1wR7EJpaSQOtRhUvTnX0Fvib48jL0AOPOciat10gpSff9+Ubx7Ml6Qiobg7Qh9Ac9baY4pSnvA6z3TPetpbeamLkbMPw8HJDdCNl1I41z7uXx0eefRupkRq7ALEIFmb+jaBkxWWpVoaYGhifceY+eR6rEwx5ssML4sjz+G5ybshT7AgLkm2eIQxdPutxizQS3/G3MKdsTT6Z7ca3XQS22i2kTZ5d61Y4gsE+8tr3TS1EBWvV8JC5F3HA8a4PQKT6f6vSFMt5huzbJju/Qj3Wnder1xGKkcLoQQu/OYDY4+T1jpEaMnyD672VdWdI+ngX0CE1x3HYdQGD7b3ZJGT6bRjsULwhxc3Fz1g2kHIk4GiFG5JcwozL4KtH4YRd/SpajzQdROwOKhTLhNvGAbOj/qUWjJ3PNjftoZfSSG/KzodtLWWL6sgt8DerIsPJwDrqb0eWIS9TLtNNEEt6NxzJWFSY9/GMCKl+2Q5ui2+jvSnvj0ztHGCd9+27Aeua6vZMuT8/35CyWvBBK3XiboezZX3y+63Is8lnlvi2Fkqv823430xN5b/d2DGmRWS7i3qrnseeJseWv71A6DfQ9mAq0YCqtt/6fqpGT0EB0mpVHyI6StVMB86FW53xsKaztuGGcgTE0Vd3HPcenqiqpnLd3Ue8djhO39srS9DuGSq4nKm4UkDNVe4aoRvkx44V2WK2grxd0WdfcuUI/NIIsSb/0VDBZxxKcop1z945GEVlBdOCKXXFHyjo/jtMiV9/Yz9TMabNJ+82uwmH141FlfvAEaY33/UP3RJhyk5wR3uf/IR8XNee9I3nwDHH7+D45mmYFUmbye6g7XDwjgj9xMTa1u4icwxXXadcbmPnPYu10q23H0PMH96ObHmvV07i49Tyos47h2gPK9zKN3ruWzS1Upk0kW2k3DpuP0hNbdw1yWRBTcpofw+wDuX0iSE3WiTc5h7UhLvSGaNFo1N5Q3owDeiCztPZlBvQyZ+nbdBJ0x+3QYdTn0GwwLUFiapVeuPEwU92mjtFb6FhJ1UmtUbllzhGLeGWzP2Iy6J69SL890lA4UX4j5DXFHP7UwE6np0XyHnA6Lknph88R49rb9TagJwyDERzJhWXM9B6JO46pPsodPUV/xtZH3XPHgHJti/xrLcNkSuFYW2V9UpFljja8TvzcXt37D5iBrHu/+kfMEzQGh/4yesF6OP4I5zOHjKenp7g6Mdn5ATXj6MG2h6pWcoIn09Ah+GfsJWFuac5L2QNHfcY2dtwt+gT0+sUvXen+Z+HeiXv3holvtvkkv8Z99bwq0wy5fwfZ0TCXFnuN7BeUDMyAcqwY7cV6m2lX3x8uKDb6mwToAYJLjtnrG2c3tbfxBNSDJ8fo6Jiu79RN/Xw4+igZSdNuDFNcqUTIWOyVD5v3f1iKIghaJ3VBzrYlL70PHOLk0sMTu+TTkfJkOg6g4co8tNLTO3c/xj1pOdhSN5deu7BcVyEGiOKZc4XfTekGhzZUWTKwh092iRv02hyAeZXECzqTM0NvtmMK+k/SChbfyIG43VKk/PLN/94d0Eu3DtFfpMj01c22GaqpD4E248rFccWxRBbALsyBzmRbyeE8/Ygiw2d6/p1di3CMA00jCDcSME9Wi5oPmgK+QBKrsej6woyajQgzpba5mgTPvtYLqngpT+IESR2BeHRulrvE4TIsStYm12xnejktwmkiWEvrK1NwXEGbRbQuJU5GMLoI7hNfC7byheluV3fcKOYqqqsfeJuibfHIziE4iX4K65B7FqaqV0sK0FlYcxDDbx1K3sZ/nugtq3RimLrS42LWvFjpFXHEPYYEMQAkYpbA8hWtqBSDhpn5G43FVZFREZitkdq29w9LGHm4e9v37wP796LneW7B8Uqvev7T96zjZurYqlEk4sBb9o5zjLMuekmY7fjfBvJrSFPPRLmGXbrwMLedqLuDniCSEepEU0mafY24PpJchvSBSbbRQdL0JgpMGsEYUoyqK0zlC/9Ho60V1itckpfz3hnsLcjtB2itdKWKMffX//9TSwFN8r21OdO6fnxEyx3Cwy2XKxT6pudRBvF/P3st4vzC/KOXldclt1Y7/i2OtqOnoa5NURxhKxAxoC6fWR16lO8ZDF5eravcixmxyvYfOgi/Jbk7GrHlrMsSOXz09ClN2CxF0NxvE154F4BLcXVf/m64a4wR5ZDTTL17UZ/iTOhHyi7MYyrRiu+C+pWvrj3OTFNJEWdGvI3Y7WS83+bCsquBDcWyr+9CH973n3K5QxY/KMZ17CiIqrI0Kno/YZQWRKjyMix1DDnxuq1s+yPKSxqahehWX+HA9nFYYAkOqWOhaYvhPb1WkzpXhfyTp/sMAdp9fov/zcAAP//XljEyg==" +} diff --git a/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc b/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc index c68f663b190..985a8925a84 100644 --- a/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/tomcat/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc b/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc index 48199b9c7f3..2528f83da67 100644 --- a/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/zscaler/_meta/docs.asciidoc @@ -51,7 +51,7 @@ offset so that datetimes are correctly parsed. Valid values are in the form *`var.rsa_fields`*:: Flag to control the addition of non-ECS fields to the event. Defaults to true, -which causes both ECS and custom fields under `rsa` to be are added. +which causes both ECS and custom fields under `rsa` to be added. *`var.keep_raw_fields`*:: diff --git a/x-pack/filebeat/modules.d/barracuda.yml.disabled b/x-pack/filebeat/modules.d/barracuda.yml.disabled index a10208c0533..20552d4c503 100644 --- a/x-pack/filebeat/modules.d/barracuda.yml.disabled +++ b/x-pack/filebeat/modules.d/barracuda.yml.disabled @@ -20,3 +20,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + spamfirewall: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9524 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/cisco.yml.disabled b/x-pack/filebeat/modules.d/cisco.yml.disabled index 4f398958101..a2795fac8fc 100644 --- a/x-pack/filebeat/modules.d/cisco.yml.disabled +++ b/x-pack/filebeat/modules.d/cisco.yml.disabled @@ -73,3 +73,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + meraki: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9525 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/citrix.yml.disabled b/x-pack/filebeat/modules.d/citrix.yml.disabled new file mode 100644 index 00000000000..f530eeafb14 --- /dev/null +++ b/x-pack/filebeat/modules.d/citrix.yml.disabled @@ -0,0 +1,22 @@ +# Module: citrix +# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-citrix.html + +- module: citrix + netscaler: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9526 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/cyberark.yml.disabled b/x-pack/filebeat/modules.d/cyberark.yml.disabled new file mode 100644 index 00000000000..b4a887b686f --- /dev/null +++ b/x-pack/filebeat/modules.d/cyberark.yml.disabled @@ -0,0 +1,22 @@ +# Module: cyberark +# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-cyberark.html + +- module: cyberark + corepas: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9527 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/f5.yml.disabled b/x-pack/filebeat/modules.d/f5.yml.disabled index 5016213bea3..fdf357dae44 100644 --- a/x-pack/filebeat/modules.d/f5.yml.disabled +++ b/x-pack/filebeat/modules.d/f5.yml.disabled @@ -20,3 +20,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + bigipafm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9528 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/fortinet.yml.disabled b/x-pack/filebeat/modules.d/fortinet.yml.disabled index a1197485d81..12f4b4dcdea 100644 --- a/x-pack/filebeat/modules.d/fortinet.yml.disabled +++ b/x-pack/filebeat/modules.d/fortinet.yml.disabled @@ -33,3 +33,41 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + fortimail: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9529 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local + + fortimanager: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9530 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/juniper.yml.disabled b/x-pack/filebeat/modules.d/juniper.yml.disabled index 3118b60ac28..e3359756d90 100644 --- a/x-pack/filebeat/modules.d/juniper.yml.disabled +++ b/x-pack/filebeat/modules.d/juniper.yml.disabled @@ -20,3 +20,22 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + netscreen: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9523 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/proofpoint.yml.disabled b/x-pack/filebeat/modules.d/proofpoint.yml.disabled new file mode 100644 index 00000000000..b0f94ac3022 --- /dev/null +++ b/x-pack/filebeat/modules.d/proofpoint.yml.disabled @@ -0,0 +1,22 @@ +# Module: proofpoint +# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-proofpoint.html + +- module: proofpoint + emailsecurity: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9531 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/snort.yml.disabled b/x-pack/filebeat/modules.d/snort.yml.disabled new file mode 100644 index 00000000000..b8abbd3e370 --- /dev/null +++ b/x-pack/filebeat/modules.d/snort.yml.disabled @@ -0,0 +1,22 @@ +# Module: snort +# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-snort.html + +- module: snort + log: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9532 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/sophos.yml.disabled b/x-pack/filebeat/modules.d/sophos.yml.disabled index 5a16ebab9d3..d0a7b23c632 100644 --- a/x-pack/filebeat/modules.d/sophos.yml.disabled +++ b/x-pack/filebeat/modules.d/sophos.yml.disabled @@ -25,3 +25,22 @@ #- serial_number: "1234234590678557" # hostname: "b.host.local" + + utm: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9533 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local diff --git a/x-pack/filebeat/modules.d/symantec.yml.disabled b/x-pack/filebeat/modules.d/symantec.yml.disabled new file mode 100644 index 00000000000..133ee297662 --- /dev/null +++ b/x-pack/filebeat/modules.d/symantec.yml.disabled @@ -0,0 +1,22 @@ +# Module: symantec +# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-symantec.html + +- module: symantec + endpointprotection: + enabled: true + + # Set which input to use between udp (default), tcp or file. + # var.input: udp + # var.syslog_host: localhost + # var.syslog_port: 9534 + + # Set paths for the log files when file input is used. + # var.paths: + + # Toggle output of non-ECS fields (default true). + # var.rsa_fields: true + + # Set custom timezone offset. + # "local" (default) for system timezone. + # "+02:00" for GMT+02:00 + # var.tz_offset: local From f017e2405c3b119335496972b85d48e7e4e1a6de Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 16 Sep 2020 12:34:46 -0400 Subject: [PATCH 008/216] [Elastic Agent] Add docker composable dynamic provider. (#20842) * Add docker provider. * Add changelog. * Update docker start message to info. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + x-pack/elastic-agent/pkg/agent/cmd/include.go | 1 + .../pkg/composable/providers/docker/config.go | 24 +++ .../pkg/composable/providers/docker/docker.go | 157 ++++++++++++++++++ .../providers/docker/docker_test.go | 64 +++++++ x-pack/elastic-agent/pkg/config/config.go | 5 + 6 files changed, 252 insertions(+) create mode 100644 x-pack/elastic-agent/pkg/composable/providers/docker/config.go create mode 100644 x-pack/elastic-agent/pkg/composable/providers/docker/docker.go create mode 100644 x-pack/elastic-agent/pkg/composable/providers/docker/docker_test.go diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index d50f72369cd..d9475d35be3 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -17,6 +17,7 @@ - Add restart CLI cmd {pull}20359[20359] - Add new `synthetics/*` inputs to run Heartbeat {pull}20387[20387] - Users of the Docker image can now pass `FLEET_ENROLL_INSECURE=1` to include the `--insecure` flag with the `elastic-agent enroll` command {issue}20312[20312] {pull}20713[20713] +- Add `docker` composable dynamic provider. {pull}20842[20842] - Add support for dynamic inputs with providers and `{{variable|"default"}}` substitution. {pull}20839[20839] - Add support for EQL based condition on inputs {pull}20994[20994] - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] diff --git a/x-pack/elastic-agent/pkg/agent/cmd/include.go b/x-pack/elastic-agent/pkg/agent/cmd/include.go index a28d47490d5..87506b88415 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/include.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/include.go @@ -7,6 +7,7 @@ package cmd import ( // include the composable providers _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/agent" + _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/docker" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/env" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/host" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/local" diff --git a/x-pack/elastic-agent/pkg/composable/providers/docker/config.go b/x-pack/elastic-agent/pkg/composable/providers/docker/config.go new file mode 100644 index 00000000000..adb5e01f037 --- /dev/null +++ b/x-pack/elastic-agent/pkg/composable/providers/docker/config.go @@ -0,0 +1,24 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package docker + +import ( + "time" + + "github.com/elastic/beats/v7/libbeat/common/docker" +) + +// Config for docker provider +type Config struct { + Host string `config:"host"` + TLS *docker.TLSConfig `config:"ssl"` + CleanupTimeout time.Duration `config:"cleanup_timeout" validate:"positive"` +} + +// InitDefaults initializes the default values for the config. +func (c *Config) InitDefaults() { + c.Host = "unix:///var/run/docker.sock" + c.CleanupTimeout = 60 * time.Second +} diff --git a/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go b/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go new file mode 100644 index 00000000000..333728ee578 --- /dev/null +++ b/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go @@ -0,0 +1,157 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package docker + +import ( + "fmt" + "time" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/bus" + "github.com/elastic/beats/v7/libbeat/common/docker" + "github.com/elastic/beats/v7/libbeat/common/safemapstr" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" +) + +func init() { + composable.Providers.AddDynamicProvider("docker", DynamicProviderBuilder) +} + +type dockerContainerData struct { + container *docker.Container + mapping map[string]interface{} + processors []map[string]interface{} +} +type dynamicProvider struct { + logger *logger.Logger + config *Config +} + +// Run runs the environment context provider. +func (c *dynamicProvider) Run(comm composable.DynamicProviderComm) error { + watcher, err := docker.NewWatcher(c.logger, c.config.Host, c.config.TLS, false) + if err != nil { + // info only; return nil (do nothing) + c.logger.Infof("Docker provider skipped, unable to connect: %s", err) + return nil + } + startListener := watcher.ListenStart() + stopListener := watcher.ListenStop() + stoppers := map[string]*time.Timer{} + stopTrigger := make(chan *dockerContainerData) + + if err := watcher.Start(); err != nil { + // info only; return nil (do nothing) + c.logger.Infof("Docker provider skipped, unable to connect: %s", err) + return nil + } + + go func() { + for { + select { + case <-comm.Done(): + startListener.Stop() + stopListener.Stop() + + // Stop all timers before closing the channel + for _, stopper := range stoppers { + stopper.Stop() + } + close(stopTrigger) + return + case event := <-startListener.Events(): + data, err := generateData(event) + if err != nil { + c.logger.Errorf("%s", err) + continue + } + if stopper, ok := stoppers[data.container.ID]; ok { + c.logger.Debugf("container %s is restarting, aborting pending stop", data.container.ID) + stopper.Stop() + delete(stoppers, data.container.ID) + return + } + comm.AddOrUpdate(data.container.ID, data.mapping, data.processors) + case event := <-stopListener.Events(): + data, err := generateData(event) + if err != nil { + c.logger.Errorf("%s", err) + continue + } + stopper := time.AfterFunc(c.config.CleanupTimeout, func() { + stopTrigger <- data + }) + stoppers[data.container.ID] = stopper + case data := <-stopTrigger: + if _, ok := stoppers[data.container.ID]; ok { + delete(stoppers, data.container.ID) + } + comm.Remove(data.container.ID) + } + } + }() + + return nil +} + +// DynamicProviderBuilder builds the dynamic provider. +func DynamicProviderBuilder(c *config.Config) (composable.DynamicProvider, error) { + logger, err := logger.New("composable.providers.docker") + if err != nil { + return nil, err + } + var cfg Config + if c == nil { + c = config.New() + } + err = c.Unpack(&cfg) + if err != nil { + return nil, errors.New(err, "failed to unpack configuration") + } + return &dynamicProvider{logger, &cfg}, nil +} + +func generateData(event bus.Event) (*dockerContainerData, error) { + container, ok := event["container"].(*docker.Container) + if !ok { + return nil, fmt.Errorf("unable to get container from watcher event") + } + + labelMap := common.MapStr{} + processorLabelMap := common.MapStr{} + for k, v := range container.Labels { + safemapstr.Put(labelMap, k, v) + processorLabelMap.Put(common.DeDot(k), v) + } + + data := &dockerContainerData{ + container: container, + mapping: map[string]interface{}{ + "container": map[string]interface{}{ + "id": container.ID, + "name": container.Name, + "image": container.Image, + "labels": labelMap, + }, + }, + processors: []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "id": container.ID, + "name": container.Name, + "image": container.Image, + "labels": processorLabelMap, + }, + "to": "container", + }, + }, + }, + } + return data, nil +} diff --git a/x-pack/elastic-agent/pkg/composable/providers/docker/docker_test.go b/x-pack/elastic-agent/pkg/composable/providers/docker/docker_test.go new file mode 100644 index 00000000000..55cf2f3a238 --- /dev/null +++ b/x-pack/elastic-agent/pkg/composable/providers/docker/docker_test.go @@ -0,0 +1,64 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package docker + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/bus" + "github.com/elastic/beats/v7/libbeat/common/docker" +) + +func TestGenerateData(t *testing.T) { + container := &docker.Container{ + ID: "abc", + Name: "foobar", + Labels: map[string]string{ + "do.not.include": "true", + "co.elastic.logs/disable": "true", + }, + } + event := bus.Event{ + "container": container, + } + + data, err := generateData(event) + require.NoError(t, err) + mapping := map[string]interface{}{ + "container": map[string]interface{}{ + "id": container.ID, + "name": container.Name, + "image": container.Image, + "labels": common.MapStr{ + "do": common.MapStr{"not": common.MapStr{"include": "true"}}, + "co": common.MapStr{"elastic": common.MapStr{"logs/disable": "true"}}, + }, + }, + } + processors := []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "id": container.ID, + "name": container.Name, + "image": container.Image, + "labels": common.MapStr{ + "do_not_include": "true", + "co_elastic_logs/disable": "true", + }, + }, + "to": "container", + }, + }, + } + + assert.Equal(t, container, data.container) + assert.Equal(t, mapping, data.mapping) + assert.Equal(t, processors, data.processors) +} diff --git a/x-pack/elastic-agent/pkg/config/config.go b/x-pack/elastic-agent/pkg/config/config.go index 35bdac74aae..d2d366e526c 100644 --- a/x-pack/elastic-agent/pkg/config/config.go +++ b/x-pack/elastic-agent/pkg/config/config.go @@ -36,6 +36,11 @@ func LoadYAML(path string, opts ...ucfg.Option) (*Config, error) { return newConfigFrom(config), nil } +// New creates a new empty config. +func New() *Config { + return newConfigFrom(ucfg.New()) +} + // NewConfigFrom takes a interface and read the configuration like it was YAML. func NewConfigFrom(from interface{}, opts ...ucfg.Option) (*Config, error) { if len(opts) == 0 { From 949e1231108a336b269095a7ea97103a924d4ce6 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 16 Sep 2020 15:58:34 -0400 Subject: [PATCH 009/216] Fix docker provider builder. (#21118) --- .../pkg/composable/providers/docker/docker.go | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go b/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go index 333728ee578..dee8b96bb88 100644 --- a/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go +++ b/x-pack/elastic-agent/pkg/composable/providers/docker/docker.go @@ -100,16 +100,12 @@ func (c *dynamicProvider) Run(comm composable.DynamicProviderComm) error { } // DynamicProviderBuilder builds the dynamic provider. -func DynamicProviderBuilder(c *config.Config) (composable.DynamicProvider, error) { - logger, err := logger.New("composable.providers.docker") - if err != nil { - return nil, err - } +func DynamicProviderBuilder(logger *logger.Logger, c *config.Config) (composable.DynamicProvider, error) { var cfg Config if c == nil { c = config.New() } - err = c.Unpack(&cfg) + err := c.Unpack(&cfg) if err != nil { return nil, errors.New(err, "failed to unpack configuration") } From fd0fe73e15139516ec52ba78392b2b396b0022db Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Wed, 16 Sep 2020 15:06:59 -0700 Subject: [PATCH 010/216] Update users.asciidoc (#20802) (#21108) Adding note of clarity as users will not see a proper indice name if they have not previously run the {beatname_uc} setup command. Co-authored-by: Aaron M. Schifman <66136604+aschifman@users.noreply.github.com> --- libbeat/docs/security/users.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/docs/security/users.asciidoc b/libbeat/docs/security/users.asciidoc index 5886b2a68fc..62d1749eff9 100644 --- a/libbeat/docs/security/users.asciidoc +++ b/libbeat/docs/security/users.asciidoc @@ -81,7 +81,7 @@ endif::has_ml_jobs[] Omit any privileges that aren't relevant in your environment. + NOTE: These instructions assume that you are using the default name for -{beatname_uc} indices. If you are using a custom name, modify the privileges to +{beatname_uc} indices. If +{beat_default_index_prefix}-*+ is not listed, or you are using a custom name, enter it manually and modify the privileges to match your index naming pattern. . Assign the *setup role*, along with the following built-in roles, to users who From bdfff666edc019ef569782a432384aee7a0c13ce Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Thu, 17 Sep 2020 11:44:03 +0200 Subject: [PATCH 011/216] Handling missing counters in application_pool metricset (#21071) * mofidy doc * fix * changelog --- CHANGELOG.next.asciidoc | 1 + .../module/iis/application_pool/application_pool.go | 1 - x-pack/metricbeat/module/iis/application_pool/reader.go | 4 ++-- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1f33bf618e7..70a269be6a0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -342,6 +342,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Update fields.yml in the azure module, missing metrics field. {pull}20918[20918] - The `elasticsearch/index` metricset only requests wildcard expansion for hidden indices if the monitored Elasticsearch cluster supports it. {pull}20938[20938] - Disable Kafka metricsets based on Jolokia by default. They require a different configuration. {pull}20989[20989] +- Handle missing counters in the application_pool metricset. {pull}21071[21071] *Packetbeat* diff --git a/x-pack/metricbeat/module/iis/application_pool/application_pool.go b/x-pack/metricbeat/module/iis/application_pool/application_pool.go index 508e7b465e0..9c92894fb29 100644 --- a/x-pack/metricbeat/module/iis/application_pool/application_pool.go +++ b/x-pack/metricbeat/module/iis/application_pool/application_pool.go @@ -84,7 +84,6 @@ func (m *MetricSet) Fetch(report mb.ReporterV2) error { break } } - return nil } diff --git a/x-pack/metricbeat/module/iis/application_pool/reader.go b/x-pack/metricbeat/module/iis/application_pool/reader.go index c4285c270c0..32c0c2d7ec3 100644 --- a/x-pack/metricbeat/module/iis/application_pool/reader.go +++ b/x-pack/metricbeat/module/iis/application_pool/reader.go @@ -101,10 +101,10 @@ func (r *Reader) initAppPools() error { if err == pdh.PDH_CSTATUS_NO_COUNTER || err == pdh.PDH_CSTATUS_NO_COUNTERNAME || err == pdh.PDH_CSTATUS_NO_INSTANCE || err == pdh.PDH_CSTATUS_NO_OBJECT { r.log.Infow("Ignoring non existent counter", "error", err, logp.Namespace("application pool"), "query", value) - continue } else { - return errors.Wrapf(err, `failed to expand counter (query="%v")`, value) + r.log.Error(err, `failed to expand counter path (query= "%v")`, value) } + continue } newQueries = append(newQueries, childQueries...) // check if the pdhexpandcounterpath/pdhexpandwildcardpath functions have expanded the counter successfully. From 9cf36b73029e113d6ba133204237080eee860b37 Mon Sep 17 00:00:00 2001 From: Eric Davis Date: Thu, 17 Sep 2020 10:24:02 -0400 Subject: [PATCH 012/216] Agent info docs and ci test pr (#19805) --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 29c9c20d48c..03bf4b2a4a4 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,10 @@ on the [elastic.co site](https://www.elastic.co/guide/): * [Packetbeat](https://www.elastic.co/guide/en/beats/packetbeat/current/index.html) * [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html) +## Documentation and Getting Started information for the Elastic Agent + +You can find the documentation and getting started guides for the Elastic Agent +on the [elastic.co site](https://www.elastic.co/downloads/elastic-agent) ## Getting Help From 568fbff61742d82b185bf37b3333077bbc2855bd Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Thu, 17 Sep 2020 09:42:31 -0600 Subject: [PATCH 013/216] Fix index out of range error when getting AWS account name (#21101) * Fix index out of range error when getting AWS account name --- CHANGELOG.next.asciidoc | 1 + x-pack/metricbeat/module/aws/aws.go | 49 ++++++++++++++++++----------- 2 files changed, 31 insertions(+), 19 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 70a269be6a0..ea288f1c2f3 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -342,6 +342,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Update fields.yml in the azure module, missing metrics field. {pull}20918[20918] - The `elasticsearch/index` metricset only requests wildcard expansion for hidden indices if the monitored Elasticsearch cluster supports it. {pull}20938[20938] - Disable Kafka metricsets based on Jolokia by default. They require a different configuration. {pull}20989[20989] +- Fix panic index out of range error when getting AWS account name. {pull}21101[21101] {issue}21095[21095] - Handle missing counters in the application_pool metricset. {pull}21071[21071] *Packetbeat* diff --git a/x-pack/metricbeat/module/aws/aws.go b/x-pack/metricbeat/module/aws/aws.go index a49e04c010b..f7b744c27cb 100644 --- a/x-pack/metricbeat/module/aws/aws.go +++ b/x-pack/metricbeat/module/aws/aws.go @@ -12,6 +12,7 @@ import ( "github.com/aws/aws-sdk-go-v2/service/ec2" "github.com/aws/aws-sdk-go-v2/service/ec2/ec2iface" "github.com/aws/aws-sdk-go-v2/service/iam" + "github.com/aws/aws-sdk-go-v2/service/iam/iamiface" "github.com/aws/aws-sdk-go-v2/service/rds" "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi" "github.com/aws/aws-sdk-go-v2/service/sts" @@ -105,25 +106,6 @@ func NewMetricSet(base mb.BaseMetricSet) (*MetricSet, error) { awsConfig.Region = "us-east-1" } - svcIam := iam.New(awscommon.EnrichAWSConfigWithEndpoint( - config.AWSConfig.Endpoint, "iam", "", awsConfig)) - req := svcIam.ListAccountAliasesRequest(&iam.ListAccountAliasesInput{}) - output, err := req.Send(context.TODO()) - if err != nil { - base.Logger().Warn("failed to list account aliases, please check permission setting: ", err) - metricSet.AccountName = metricSet.AccountID - } else { - // When there is no account alias, account ID will be used as cloud.account.name - if len(output.AccountAliases) == 0 { - metricSet.AccountName = metricSet.AccountID - } - - // There can be more than one aliases for each account, for now we are only - // collecting the first one. - metricSet.AccountName = output.AccountAliases[0] - base.Logger().Debug("AWS Credentials belong to account name: ", metricSet.AccountName) - } - // Get IAM account id svcSts := sts.New(awscommon.EnrichAWSConfigWithEndpoint( config.AWSConfig.Endpoint, "sts", "", awsConfig)) @@ -136,6 +118,11 @@ func NewMetricSet(base mb.BaseMetricSet) (*MetricSet, error) { base.Logger().Debug("AWS Credentials belong to account ID: ", metricSet.AccountID) } + // Get account name/alias + svcIam := iam.New(awscommon.EnrichAWSConfigWithEndpoint( + config.AWSConfig.Endpoint, "iam", "", awsConfig)) + metricSet.AccountName = getAccountName(svcIam, base, metricSet) + // Construct MetricSet with a full regions list if config.Regions == nil { svcEC2 := ec2.New(awscommon.EnrichAWSConfigWithEndpoint( @@ -170,6 +157,30 @@ func getRegions(svc ec2iface.ClientAPI) (completeRegionsList []string, err error return } +func getAccountName(svc iamiface.ClientAPI, base mb.BaseMetricSet, metricSet MetricSet) string { + req := svc.ListAccountAliasesRequest(&iam.ListAccountAliasesInput{}) + output, err := req.Send(context.TODO()) + + accountName := metricSet.AccountID + if err != nil { + base.Logger().Warn("failed to list account aliases, please check permission setting: ", err) + return accountName + } + + // When there is no account alias, account ID will be used as cloud.account.name + if len(output.AccountAliases) == 0 { + accountName = metricSet.AccountID + base.Logger().Debug("AWS Credentials belong to account ID: ", metricSet.AccountID) + return accountName + } + + // There can be more than one aliases for each account, for now we are only + // collecting the first one. + accountName = output.AccountAliases[0] + base.Logger().Debug("AWS Credentials belong to account name: ", metricSet.AccountName) + return accountName +} + // StringInSlice checks if a string is already exists in list and its location func StringInSlice(str string, list []string) (bool, int) { for idx, v := range list { From 6c47e5bb42700810fb852be2089767e3989da436 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Thu, 17 Sep 2020 10:46:24 -0700 Subject: [PATCH 014/216] docs: link to APM privs for API keys (#20911) --- libbeat/docs/command-reference.asciidoc | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) diff --git a/libbeat/docs/command-reference.asciidoc b/libbeat/docs/command-reference.asciidoc index 4a600650209..a00a2baed24 100644 --- a/libbeat/docs/command-reference.asciidoc +++ b/libbeat/docs/command-reference.asciidoc @@ -156,18 +156,7 @@ Create an API Key with the specified privilege(s). No required flags. + The user requesting to create an API Key needs to have APM privileges used by the APM Server. A superuser, by default, has these privileges. For other users, -you can create them. Create a role that is then assigned to the user: -+ -["source","sh",subs="attributes"] ----- -PUT /_security/role/apm-privileges { - "applications": [{ - "application": "apm", - "privileges": ["sourcemap:write", "event:write", "config_agent:read"], - "resources": ["*"] - }] -} ----- +you can create them. See <> for required privileges. *`info`*:: Query API Key(s). `--id` or `--name` required. @@ -252,7 +241,7 @@ the credentials required by your cloud service provider. ---- *`FUNCTION_NAME`*:: -Specifies the name of the function to deploy. +Specifies the name of the function to deploy. *FLAGS* @@ -498,7 +487,7 @@ ifeval::["{beatname_lc}"=="functionbeat"] [[package-command]] ==== `package` command -{package-command-short-desc}. +{package-command-short-desc}. *SYNOPSIS* @@ -513,7 +502,7 @@ ifeval::["{beatname_lc}"=="functionbeat"] Shows help for the `package` command. *`-o, --output`*:: -Specifies the full path pattern to use when creating the packages. +Specifies the full path pattern to use when creating the packages. {global-flags} @@ -538,7 +527,7 @@ the credentials required by your cloud service provider. ---- *`FUNCTION_NAME`*:: -Specifies the name of the function to remove. +Specifies the name of the function to remove. *FLAGS* @@ -941,7 +930,7 @@ the credentials required by your cloud service provider. ---- *`FUNCTION_NAME`*:: -Specifies the name of the function to update. +Specifies the name of the function to update. *FLAGS* From 71e67d38e12ce1f67fdb1a894843e801002ee175 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Thu, 17 Sep 2020 10:47:07 -0700 Subject: [PATCH 015/216] docs: add beat specific install widget (#21050) --- .../install-widget-filebeat.asciidoc | 114 ++++++++++++++++++ .../install-widget-heartbeat.asciidoc | 114 ++++++++++++++++++ .../install-widget-metricbeat.asciidoc | 114 ++++++++++++++++++ 3 files changed, 342 insertions(+) create mode 100644 libbeat/docs/tab-widgets/install-widget-filebeat.asciidoc create mode 100644 libbeat/docs/tab-widgets/install-widget-heartbeat.asciidoc create mode 100644 libbeat/docs/tab-widgets/install-widget-metricbeat.asciidoc diff --git a/libbeat/docs/tab-widgets/install-widget-filebeat.asciidoc b/libbeat/docs/tab-widgets/install-widget-filebeat.asciidoc new file mode 100644 index 00000000000..8c293b4c9a6 --- /dev/null +++ b/libbeat/docs/tab-widgets/install-widget-filebeat.asciidoc @@ -0,0 +1,114 @@ +:beatname_uc: Filebeat +:beatname_lc: filebeat +++++ +

+
+ + + + + + +
+
+++++ + +include::install.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ diff --git a/libbeat/docs/tab-widgets/install-widget-heartbeat.asciidoc b/libbeat/docs/tab-widgets/install-widget-heartbeat.asciidoc new file mode 100644 index 00000000000..34cace94017 --- /dev/null +++ b/libbeat/docs/tab-widgets/install-widget-heartbeat.asciidoc @@ -0,0 +1,114 @@ +:beatname_uc: Heartbeat +:beatname_lc: heartbeat +++++ +
+
+ + + + + + +
+
+++++ + +include::install.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ diff --git a/libbeat/docs/tab-widgets/install-widget-metricbeat.asciidoc b/libbeat/docs/tab-widgets/install-widget-metricbeat.asciidoc new file mode 100644 index 00000000000..5a4a46e8e9e --- /dev/null +++ b/libbeat/docs/tab-widgets/install-widget-metricbeat.asciidoc @@ -0,0 +1,114 @@ +:beatname_uc: Metricbeat +:beatname_lc: metricbeat +++++ +
+
+ + + + + + +
+
+++++ + +include::install.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ From 4dcf1598099576c3b7396a2400659824bd5cf2e9 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Thu, 17 Sep 2020 20:14:11 +0200 Subject: [PATCH 016/216] [Ingest Manager] Fixed input types for filebeat (#21131) --- x-pack/elastic-agent/pkg/agent/program/supported.go | 2 +- x-pack/elastic-agent/spec/filebeat.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/program/supported.go b/x-pack/elastic-agent/pkg/agent/program/supported.go index d7b59f59363..3b314bfa3f4 100644 --- a/x-pack/elastic-agent/pkg/agent/program/supported.go +++ b/x-pack/elastic-agent/pkg/agent/program/supported.go @@ -21,7 +21,7 @@ func init() { // spec/filebeat.yml // spec/heartbeat.yml // spec/metricbeat.yml - unpacked := packer.MustUnpack("eJy8WUtzozoW3s/P6O2dmuERZy5TdRc2KQTYIW2SSEI7JNmALTAT8AOm5r9PCTAPJ+m+PT3Viy63sZCOzuM733fy7y9FvmF/32Q8PyRZ+bcqFV/++YWmVkleDpGPZnsGjJxm6+hVgzuO3Zzb+2WgqfunZCFo6p+pJo7cVGuCPJWlQtms85hlfk5Sa8cfDhEZ9igJgJqZeYJlJA+013vnIdCfHqJloMUi0MptiGY1B1ZBHw7L1fNCbADcYY3kFLzem8k8cszFOcD+4SmZJ+N92WBb0q2LWcrrp+gQOeY8Wj3PE57CKkRk5nTPOBAlQYYqbXys50sGjJpbcj9PCdCleIoOpQPgHUHelqSiIC+HpXzPsRcxB9G9Y7of3//ZadcBqyL6Y2f3vHRMt9/bGdm1elZVBngVIF/cPK8I9k4cuzuCH5PRPp+cO1l/3KTi/NFdvd38bGaLikBDpak4Mt2PKTjfm4kSERyLQDXSEF3E1XcMWEr4cIicFB6JvTiFaKassCcCHVYh9nt/BtjNWN356OpzNHt35/e2uCoFsG79TfKNZdTcdkWAlHvHLg2ze05tXzBhaAG6qARf/bqoCbqIQPdPbHeIQjQ7c+zX3W9vBO/vHdufMfDaxY7E1IZisFMZ5+ey8UEqCg5ghfWbtbYnKIA7DozqKVnkNFuo3H7sYl2KzUuT63GQXgSZd3dNrYIjOMrDhcIyKJo7Xfdrcs4/9f7WYEGQp1DdrZ+SBSVyP7w+BsjbEezVWLPOITTk3QoHkIIgqKzSMg9S6xhAZZqj/e/WOVw3NVUGeH5TS4uUAih4ZzPLYDH4d146tisoMjTSnnl93vwLNTh7ShZxoHmC6d42wIsca6XYrPv7VgSpJ57CbbO2u+PYZ6EmkgDN4kmcd+99PolZ65P++zTu89IBhsrthXq9U2MHJjnTxIlGhyXXYkF3h4gCeCS6f1ia/j/aPX1j+Tz/zXmYRwGa7R1wETTlSmhG+40mjsyGCtOV3Hm4ix7NRUzTdRQCq37W4EzuQXWoyDXb53PkarAIsKeEyKsJsqpAi7Ll+vDHl7+2kLtNxIZuwneQK6EGuSLA6yvMNuUYpDDm87yFtWRBnUS1nOQcOZknuA3Pq1QU9HkmaGolFMD9VyTT1xPNmtu1mS8oXhQB9sUqhccAuQVBa4OkVsG012RlzpPVa/tJkXUMEBcUwSM3ZyXVfPEVRyUD1i6s1DZ1TKdwTKf0n+WnW8pwEg2WRELFaH9uuyp5nqwtqMazEM2yVXoRPIXFV+SLIIOZI5RlgF0lRCQO9PW9A6RP/HrVtAOYEGQp34WOpEmNf8lywpo4EgDvrinIbXGW/qbAyNi5KY2cprmEki3T/Yogq8T6oqJtap/6lATGEWveiaakCJGntFAgW5q/DRBRCO7gv4WdewdcTkR/bKCFIut8C6s3kFVxdJnAU6AZ5w00YgouWw6MLQWi5g8DzDrmQqH1IbrazM7jEntn65FqxnlcwgTHO4IXSpNTmaewFMYUPzaxD9G6+exhrYmze2ap0UCRhCgZpxtbFaoaRYg9ZVruQiFNXEY+zR7/13sMPk9hSnW3g1TZGps66mJFKqop9w7oSvd8bUG/D8/0/s7LrgUqTFIXq70D1qTdav1Z3G7tDbEv6Mv7e0zOPH8KxdO2Yvf5PbSP1Doy7RLznhLNJ3Y1eb0e+06Nmb0YILV/fjmRjlo1/x/7u8kLImi2PnXUp6mT8XmOuZD1euSmUXPg5xJOme7vQ3R3cw7UGhzQ/R2T9gHv/Mk+KrHn944N92w+tUWevdL8U6CV8h4RAcYu1GB1s09BNXZiKdyH2Nsy7XLi2uVEZE41zx7f378y6g325Hv3ju3N5DtXP/yZ1sWxJ7D2Qav5znsEWEoAe6zq64elsKQ6EU0LfZnUeEtlgB9zYPX4tEpnMUWwllhMfqDl3px/bL5jT1IAmZey3ygEu9tb+jJQE+ddTXVUQNnghehy+oaqybZs6UzzCqrDPdcsJdCiATtwrrIUtrkAYjUYcn5HgaESQE5cUrVsP8abIwdWTtM+F0oHdHkyvJ9RzcgogGeO3JojZ6ANtq8wyxjo9BDDA7f9c5h5ki5cn70FiLwFg59l3vR7UWwpo/ePBPspBYY+2PV77e1gzJGfT3PFz9mQc/Xj6P9NXQ3nX3O1P3NUS+W4blbPC0nt74bfeE7TJrd/Nr49v/g0xrZfcfTaYGnTD/4UFo96+g/RwIEr9XHoKNjg91JscEOnhZnxA0F391NaN5y9Sn+e4q3MedbhTbZq4sHbvHlmhWNyyXekxK1Dk+Vm9EdPB+NN+FZ+wAefAZRyuvVN6pVE9p7Js1ZmOlbRczamQYXj+TFEl/J7/O66lgNYMtD0lWPf7x/UNECX+oaz3fA79UTAq7Ex1XOAvLcVaiXHhHemakxTKyNIlT1lvH8jh6ZrZV+S+cqOtOkdZ4MAmHDEEnwzWmg4sf14mvgjG/fMJkfu8LXHvxyijd7g7QeS0ttyTSihZVQEcbGx50N/veL9pLcuKhkfnHkzmvkHgv080B9Pq6TocfvzevqGzPxOHQ69oI9r/95tPfc4IXn3enrusGYkobPHCadoOPGYj5gfy6seTzU4Y3Kf9PVDiXXlTNvnffQ1mZ8dYB2JuTgE2FsRvD+4dnni2JdrDFlHBF1ipku/eiLA7i40mxpqMbNihbTV1cqYpGXsVrIeJdf2ZC87uNV+ea2tdFO+JeyD4npBUGGp2HXiakeRFBqq4LabB1onwtq5RoSqvgBqgn2VmbOcAuV7xXJdK0nkmQJLId8TaTfFQpGxJy/q3QpLnV2Unfb9lkgb9scNGE/XAiMjUgxVs6IheQ/qniBXJZXLJZhwINKgJdlNQbHKKAn2qxB5XYEtTkz3J7O6Nila0jGZlU3mR+qJ2M1s4UjMhnhJQXDcILWfDUkRIP1N8PpeAg3V/KaYV+n6xHRRS5BaZaKk5kySvKsoWQ4zi48LfizuQjTbExxdiXdDWJ6SxfWOdduAxDFMm9lMR5LULbPdU6DBmmlGXzxUm20lCSHpJW9FqjgyDVbcMmKS+T0J6cVml2+dAKhk7lDUzzZTlhrlexHgn4Zn3tWezk41Zg83c8kPhM0nYmJH9cUMa1ZBrU9EW3v2cOYIHN7ffXai+nxMWsUGeILZ66Y59YKoauoi78Rkn6vtgGIiDhO8vrFV909Yu+RMX0/nUFfRNYrRRED+0D36GCYEkQbMfrEwfEfQsM5zDuItS2FGcNwPET4g3W1TSu7eVlqHY/rj/puz0p+dr942og9mrF0D+j+IXvh5k/6WCLZdWeOb5YOx/toOZn5bJUX+3kddI5VnPBwidzw7bgXaMUCqmIqqjthO1g4DDYnfHF3EQEjVONTgNsBuFdzOU7sc6XFC64nsKFeuNntiaMx/RjyO3vsRsXoz0/61Arf5Xo9nvb9KJN+I++UVg65rSeaeZKxuaqKL+ZhXfBPrJ721FyATbOj75uTvEx/+vWComWnP/nwu/kaw7KtGJevzI9I2uUs7AG7q82dIXEPcdFcQIOqWuH2DxP3nL/8NAAD//4zwrRg=") + unpacked := packer.MustUnpack("eJzEWEtz47rR3X8/Y7b3q4QER06YqixEufiSRI9oGwCxIwCJpARSuuZDolL57ymQFB+yPXMnt2qymNIIhoDuRvfpc/pfX/LTlv11m/HTMcmKv9Sp+PKPLzQ1C/JyjHw0OzBLP9FsE70CuOfYPXH7sAyAenhKDEFT/0yBKPlCvRLkqSwVynZzilnmn0hq7vnjMSLDGQWxIFhknmAZOQXg9cF5DLSnx2gZgFgEoNiFaHbllpnTx+Ny9WyIrQX3GJATtV4fFsk8chbGOcD+8SmZJ+Nz2WBb0u2LWcqvT9ExchbzaPU8T3gK6xCRmdOtcUsUBOmqtHF9nS+ZpV+5Kc/zlABd8qfoWDgW/EqQtyOpyMnLcSl/59hGzK3owVm4H/v/7LT7LLMm2rqze144C7c/2xnZtXpWVWbxOkC+uFuvCfYqjt09wetkdM4n9072l9tUnD/y1dvPz4vMqAnUVZqKkml+TK3zwyJRIoJjEah6GqKLuMWOWaYSPh4jJ4UlsY0qRDNlhT0RaLAOsd/HM8Buxq5djG4xR7N3Pr+3xVWpBa9tvMlpa+pXbrsiQMqDYxf6olunti+Y0EGALirBt7gaV4IuItD8iu2PUYhmZ479a/e3N4IPD47tz5j12r0diakNxWCnMs7PZRODVOTcgjXW7vbanqAW3HNLr58S40QzQ+X2unvrQmxfmlyPg/QiyLzzNTVzjuAoDw2FZVA0Pt3Oa3LOr/p4A5gT5ClUc69PiUGJPA9vygB5e4K9KwbmOYS69C13LJITBJVVWpyC1CwDqExztP+7eQ43TU0VAZ7f1ZKRUgsK3tnMMpgP8Z0Xju0KinRA2jtv682/EMDZU2LEAfAE07xdgI0TBoXYbnp/a4LUiqdw1+ztfBzHLAQiCdAsnrzz/n3MJ2/WxqT/Pn33eeFYusptQ7351NiByYkBUdHouOQgFnR/jKgFS6L5x+XC/1t7pq8vn+e/OY/zKECzg2NdBE25Ei6iwxaIktlQYZpych6/RuuFEdN0E4WWeX0GcCbPoBpU5J7d8zlyAcwD7Ckh8q4EmXUAomy5Of7zy/+3kLtLxJZuw3eQK6EGuSLAmxvMNuUYpDDm81MLa4lBnUQ1neQcOZknuA3Pq1Tk9HkmaGom1IKHb0imryeaPfd7M19QbOQB9sUqhWWA3JygjU5SM2fgNVkt5snqtf2kyCwDxAVFsOSLWUGBL77hqGCWuQ9rtU2dhZM7C6fwn+WnW8jnJAAWRELF6Hxuuyp5nuzNKeBZiGbZKr0InsL8G/JFkMHMEcoywK4SIhIH2ubBsWRM/OuqaQcwIchUfggdSZMav8tywkCUxIJfbynIbXGW8aaWnrFzUxonmp4klOyY5tcEmQXWjJq2qV31KWnpJQZeRVOSh8hTWiiQLc3fBYgoBHfw38LOg2NdKqKtG2ihyDzfw+odZNUcXSbwFAD9vIV6TK3Ljlv6jlriyh8HmHUWhkKvx+hmMzuPS+ydrSUF+nlcwgTHe4INpcmpzFNYCmOK183bh2jTfPaw1ryze2ap3kCRhCj5Tne2KlTV8xB7yrTchUKadxnFNFv/t34MMU9hSjW3g1TZGps66t6K1BQoD47Vle751oL+Pqxpvc/LrgUqTFIXs/UBA2m3ev3s3e7tDbEv6Mt7PyZ3nj+F4mlbsfv8HtpHapYMXGLeU6L5xK4mrzfj2Kkxs40BUvv1S0U6atX8fxzvJi+IoNmm6qhPUyfj+5yFIeu15Av9yi3/JOGUaf4hRF/v7oGgwQHN3zNpn+WdPzlHJfb8wbHhgc2ntsi7V8CvAlBIPyJi6fsQwPrunJwCVrEUHkLs7Ri4VBxcKiJzqllbv/e/1q9b7MnfPTi2N5O/ucXhj7Qujj2BwQet5ge/I5apBLDHqr5+WAoLqhHRtNCXSY23VMbyY26ZPT6t0llMEbxKLCY/0XLv7i+b79iTFEDmpew3CsHu7p6+DNTEeVdTHRVQttgQXU7fUTXZlk2NAS+nGjxwYCoBiAbswCeVpa9Fm3f+kSNnhCuXiiM/pZqkoO5sOM+raObHIZoJNtTIgQLvrcdhSReAXhFwEStsqEHmqcGw98ht/4zBQG2Hs2OF28bvDOjlsFbEJC3i4fskXwqG/dHvZ4JbJKca6+2g1zXwkKkSSyhjekUsMVAXez36v6cQS5Sj7/c5qgTavD+fI/887IVliIf4ciDKpob/LJ22+n7+KaVu+nxLN/dUM/ocJJlbSWy8O7fBfTLiPWMa/iEtHt5vxI36tYpj/8zH9BDAGZM+pa+fUL/+7vJm2+75EH1L5mfHMkuyMI4B9lYEH46uXXTn+/pqMc8IusRM80+B5okAu/twwXJnwWuC/BOrWS59dEGbN24taaHkA56st6NbH5Y3Ohhvw7fiAz74bEEpp1u+k3oFkb1nstbKTMfMe87GAFQ4npchuhQ/4ne3vdyCBbOavlL2/f5RTQN0ud5xtjt+p1bEetW3C/UcIO9thVrJMeGdqRrT1MwIUmVPGZ/fyKHpXtmX+ImmrKRN7zjrxIIJRyzBd6OF5t3tdTWJRzbumU0efcW3Hv9yjLZag7cf1IC340AooanXBHGxtedDf73h/aS3GrV8H5x5M4lXBMscWFerJO9x+3O8/I7M/AHOflqHH8jNu3qc3DvsGdV8tp5wioYTj/nI4mN59Ufr7H9VW+m2eEvYB8X1gqDCUrHvxNWeIik0VMFt9xSAToS1c40I1X0BXAn2VbaYnail/KhYbnsliTxTy1TIj0TaXbFQpB/Ii/p1haXOzotO+35PpA3nY7/m6E7QWXpGpBiqZ3nTbB/VA0GuSmqXSzDhlkiDlmQ3BcVqvSDYr0PkdQVmVEzzJ7O6Nila0jGZlU3mR2pF7Ga2UJJFQ7ykICi3SO1nQ7IZyHgTvHmQQEOB3xTzKt1UTBNXCVKrTBR0MZMk7yZKlsPM4uOCH4u7EM0OBEe3htcQlqfEuPl4bRukKMO0mc10JEndMdutAgCvDOh98VAw2wVAL0l6ObUiVZQMwJqbekwyvyclvdjs8q0TALXMHYr62WbKUr14LwL8aljzbvZ0dqoxe7ybS34gbD4RE01zxsDMqfmJaGvvHu4cgcN732cV7clIS+y3lieYvWmaUy+I6qYuTp2Y7HO1HVBMxGGCN3e2an6FweXEtM10DnUTXaM3mgjIn/Kjf8OEINKA2S8Whu8IONb4iVvxjqUwIzjuhwgfkO62KSVf31agwzFtffguufu1hPBPil74eZP+ngi2XVnj2+WjvvnWDmZ+WyX56X2MukYq73g8Ru54dtwKtDJAqpiKqm7IMNk7EFuJ3xxdxCAM1DgEcBdgtw7u56ldjvQ4AaAysavJlZvNnhga8x8Rj6Pf/YxYvZtp/1qB23y/jme9v0ok34n7nxIzdMIrvov1k966Sj8aVPV982eE0bRnfz4XfyNY9lW9lvX5EWmb+NIOgJv6/DMkriFuWit8W+L2HRL37//7TwAAAP//S6KvFQ==") SupportedMap = make(map[string]Spec) for f, v := range unpacked { diff --git a/x-pack/elastic-agent/spec/filebeat.yml b/x-pack/elastic-agent/spec/filebeat.yml index a461ab1a1c8..1b184b10098 100644 --- a/x-pack/elastic-agent/spec/filebeat.yml +++ b/x-pack/elastic-agent/spec/filebeat.yml @@ -60,11 +60,11 @@ rules: key: type values: - awscloudwatch - - azureeventhub + - azure-eventhub - cloudfoundry - container - docker - - googlepubsub + - google-pubsub - http_endpoint - httpjson - kafka From 62b0d973c5569580cc4d6d9f5a5b7cef01405674 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Thu, 17 Sep 2020 15:11:19 -0700 Subject: [PATCH 017/216] Remove redirects page (#19574) --- auditbeat/docs/index.asciidoc | 2 +- filebeat/docs/index.asciidoc | 2 +- heartbeat/docs/index.asciidoc | 2 +- journalbeat/docs/index.asciidoc | 2 +- libbeat/docs/shared/redirects.asciidoc | 34 ------------------------- metricbeat/docs/index.asciidoc | 2 +- packetbeat/docs/index.asciidoc | 2 +- winlogbeat/docs/index.asciidoc | 2 +- x-pack/functionbeat/docs/index.asciidoc | 2 +- 9 files changed, 8 insertions(+), 42 deletions(-) delete mode 100644 libbeat/docs/shared/redirects.asciidoc diff --git a/auditbeat/docs/index.asciidoc b/auditbeat/docs/index.asciidoc index b236e1a6eee..56f3d7cc756 100644 --- a/auditbeat/docs/index.asciidoc +++ b/auditbeat/docs/index.asciidoc @@ -53,4 +53,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/filebeat/docs/index.asciidoc b/filebeat/docs/index.asciidoc index d427d5d8a39..30e0ec38f46 100644 --- a/filebeat/docs/index.asciidoc +++ b/filebeat/docs/index.asciidoc @@ -64,4 +64,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/heartbeat/docs/index.asciidoc b/heartbeat/docs/index.asciidoc index 6da2775949f..35debec2659 100644 --- a/heartbeat/docs/index.asciidoc +++ b/heartbeat/docs/index.asciidoc @@ -51,4 +51,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/journalbeat/docs/index.asciidoc b/journalbeat/docs/index.asciidoc index 390b5134e3e..4ace63c41fc 100644 --- a/journalbeat/docs/index.asciidoc +++ b/journalbeat/docs/index.asciidoc @@ -44,4 +44,4 @@ include::./troubleshooting.asciidoc[] include::./faq.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/libbeat/docs/shared/redirects.asciidoc b/libbeat/docs/shared/redirects.asciidoc deleted file mode 100644 index dc9ca1d0d74..00000000000 --- a/libbeat/docs/shared/redirects.asciidoc +++ /dev/null @@ -1,34 +0,0 @@ -["appendix",role="exclude",id="redirects"] -= Deleted pages - -The following pages have moved or been deleted. - -[role="exclude",id="{beatname_lc}-configuration"] -=== Configure {beatname_uc} - -See <>. - -[role="exclude",id="{beatname_lc}-installation"] -=== Install {beatname_uc} - -See <<{beatname_lc}-installation-configuration>>. - -[role="exclude",id="view-kibana-dashboards"] -=== View the sample {kib} dashboards - -See <<{beatname_lc}-installation-configuration>>. - -[role="exclude",id="{beatname_lc}-getting-started"] -=== Get started with {beatname_uc} - -See <<{beatname_lc}-installation-configuration>>. - -ifeval::["{beatname_lc}"=="filebeat"] - -[role="exclude",id="{beatname_lc}-modules-quickstart"] -=== Quick start: modules for common log formats - -See <<{beatname_lc}-installation-configuration>>. - -//TODO: Remove any internal cross references that point to these IDs, set up -//redirects, then delete this file. diff --git a/metricbeat/docs/index.asciidoc b/metricbeat/docs/index.asciidoc index fc3972a4b21..42a00fe97af 100644 --- a/metricbeat/docs/index.asciidoc +++ b/metricbeat/docs/index.asciidoc @@ -65,4 +65,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/packetbeat/docs/index.asciidoc b/packetbeat/docs/index.asciidoc index 5f1da41e677..7ff9a667c6d 100644 --- a/packetbeat/docs/index.asciidoc +++ b/packetbeat/docs/index.asciidoc @@ -57,4 +57,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/winlogbeat/docs/index.asciidoc b/winlogbeat/docs/index.asciidoc index e92cdcc3df6..d953f0d641c 100644 --- a/winlogbeat/docs/index.asciidoc +++ b/winlogbeat/docs/index.asciidoc @@ -50,4 +50,4 @@ include::./faq.asciidoc[] include::{libbeat-dir}/contributing-to-beats.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + diff --git a/x-pack/functionbeat/docs/index.asciidoc b/x-pack/functionbeat/docs/index.asciidoc index a26eca95a12..2fc5cdc9853 100644 --- a/x-pack/functionbeat/docs/index.asciidoc +++ b/x-pack/functionbeat/docs/index.asciidoc @@ -58,4 +58,4 @@ include::./troubleshooting.asciidoc[] include::./faq.asciidoc[] -include::{libbeat-dir}/shared/redirects.asciidoc[] + From 9e4ba21c0bc3968d32a39c4c3207b8ee218d5944 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Thu, 17 Sep 2020 16:27:20 -0700 Subject: [PATCH 018/216] Update input-log.asciidoc (#20965) (#21153) Co-authored-by: Louis Ong <26863726+louisong@users.noreply.github.com> --- filebeat/docs/inputs/input-log.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/filebeat/docs/inputs/input-log.asciidoc b/filebeat/docs/inputs/input-log.asciidoc index 6ebaf38733e..8d4ef24a55a 100644 --- a/filebeat/docs/inputs/input-log.asciidoc +++ b/filebeat/docs/inputs/input-log.asciidoc @@ -73,7 +73,7 @@ of the file. To solve this problem you can configure `file_identity` option. Pos values besides the default `inode_deviceid` are `path` and `inode_marker`. Selecting `path` instructs {beatname_uc} to identify files based on their -paths. This is a quick way to aviod rereading files if inode and device ids +paths. This is a quick way to avoid rereading files if inode and device ids might change. However, keep in mind if the files are rotated (renamed), they will be reread and resubmitted. From 5332b2d97cf5b680cd257b880ad3fb9bc65153aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?= Date: Fri, 18 Sep 2020 10:41:44 +0100 Subject: [PATCH 019/216] [Metricbeat][Kibana] Apply backoff when errored at getting usage stats (#20772) Co-authored-by: Shaunak Kashyap --- CHANGELOG.next.asciidoc | 1 + metricbeat/module/kibana/stats/stats.go | 14 +++++-- metricbeat/module/kibana/stats/stats_test.go | 44 ++++++++++++++++++-- 3 files changed, 52 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index ea288f1c2f3..b8574deded0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -339,6 +339,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix SQL module mapping NULL values as string {pull}18955[18955] {issue}18898[18898 - Fix ec2 disk and network metrics to use Sum statistic method. {pull}20680[20680] - Fill cloud.account.name with accountID if account alias doesn't exist. {pull}20736[20736] +- The Kibana collector applies backoff when errored at getting usage stats {pull}20772[20772] - Update fields.yml in the azure module, missing metrics field. {pull}20918[20918] - The `elasticsearch/index` metricset only requests wildcard expansion for hidden indices if the monitored Elasticsearch cluster supports it. {pull}20938[20938] - Disable Kafka metricsets based on Jolokia by default. They require a different configuration. {pull}20989[20989] diff --git a/metricbeat/module/kibana/stats/stats.go b/metricbeat/module/kibana/stats/stats.go index 526a525951c..a6e19d50f42 100644 --- a/metricbeat/module/kibana/stats/stats.go +++ b/metricbeat/module/kibana/stats/stats.go @@ -38,9 +38,10 @@ func init() { } const ( - statsPath = "api/stats" - settingsPath = "api/settings" - usageCollectionPeriod = 24 * time.Hour + statsPath = "api/stats" + settingsPath = "api/settings" + usageCollectionPeriod = 24 * time.Hour + usageCollectionBackoff = 1 * time.Hour ) var ( @@ -57,6 +58,7 @@ type MetricSet struct { statsHTTP *helper.HTTP settingsHTTP *helper.HTTP usageLastCollectedOn time.Time + usageNextCollectOn time.Time isUsageExcludable bool } @@ -165,6 +167,10 @@ func (m *MetricSet) fetchStats(r mb.ReporterV2, now time.Time) error { content, err = m.statsHTTP.FetchContent() if err != nil { + if shouldCollectUsage { + // When errored in collecting the usage stats it may be counterproductive to try again on the next poll, try to collect the stats again after usageCollectionBackoff + m.usageNextCollectOn = now.Add(usageCollectionBackoff) + } return err } @@ -215,5 +221,5 @@ func (m *MetricSet) calculateIntervalMs() int64 { } func (m *MetricSet) shouldCollectUsage(now time.Time) bool { - return now.Sub(m.usageLastCollectedOn) > usageCollectionPeriod + return now.Sub(m.usageLastCollectedOn) > usageCollectionPeriod && now.Sub(m.usageNextCollectOn) > 0 } diff --git a/metricbeat/module/kibana/stats/stats_test.go b/metricbeat/module/kibana/stats/stats_test.go index b6757e5ecb2..56cbfc17e1f 100644 --- a/metricbeat/module/kibana/stats/stats_test.go +++ b/metricbeat/module/kibana/stats/stats_test.go @@ -23,6 +23,7 @@ import ( "net/http" "net/http/httptest" "testing" + "time" "github.com/stretchr/testify/require" @@ -48,12 +49,12 @@ func TestFetchUsage(t *testing.T) { w.WriteHeader(503) case 1: // second call - // Make sure exclude_usage is still false since first call failed - require.Equal(t, "false", excludeUsage) + // Make sure exclude_usage is true since first call failed and it should not try again until usageCollectionBackoff time has passed + require.Equal(t, "true", excludeUsage) w.WriteHeader(200) case 2: // third call - // Make sure exclude_usage is now true since second call succeeded + // Make sure exclude_usage is still true require.Equal(t, "true", excludeUsage) w.WriteHeader(200) } @@ -76,3 +77,40 @@ func TestFetchUsage(t *testing.T) { // Third fetch mbtest.ReportingFetchV2Error(f) } + +func TestShouldCollectUsage(t *testing.T) { + now := time.Now() + + cases := map[string]struct { + usageLastCollectedOn time.Time + usageNextCollectOn time.Time + expectedResult bool + }{ + "within_usage_collection_period": { + usageLastCollectedOn: now.Add(-1 * usageCollectionPeriod), + expectedResult: false, + }, + "after_usage_collection_period_but_before_next_scheduled_collection": { + usageLastCollectedOn: now.Add(-2 * usageCollectionPeriod), + usageNextCollectOn: now.Add(3 * time.Hour), + expectedResult: false, + }, + "after_usage_collection_period_and_after_next_scheduled_collection": { + usageLastCollectedOn: now.Add(-2 * usageCollectionPeriod), + usageNextCollectOn: now.Add(-1 * time.Hour), + expectedResult: true, + }, + } + + for name, test := range cases { + t.Run(name, func(t *testing.T) { + m := MetricSet{ + usageLastCollectedOn: test.usageLastCollectedOn, + usageNextCollectOn: test.usageNextCollectOn, + } + + actualResult := m.shouldCollectUsage(now) + require.Equal(t, test.expectedResult, actualResult) + }) + } +} From 82a670c17af44fbaeb3ee712362d767867f37e7f Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Fri, 18 Sep 2020 11:47:03 +0200 Subject: [PATCH 020/216] Add Cloud Foundry dashboards for metricbeat (#21124) Adapt and include dashboards provided by Stephen Brown. Co-Authored-By: Stephen Brown --- CHANGELOG.next.asciidoc | 1 + .../metricbeat-cloudfoundry-overview.png | Bin 0 -> 230735 bytes ...etricbeat-cloudfoundry-platform-health.png | Bin 0 -> 170697 bytes metricbeat/docs/modules/cloudfoundry.asciidoc | 16 + metricbeat/docs/modules_list.asciidoc | 2 +- .../module/cloudfoundry/_meta/docs.asciidoc | 16 + .../Metricbeat-cloudfoundry-overview.json | 3992 +++++++++++++++ ...tricbeat-cloudfoundry-platform-health.json | 4385 +++++++++++++++++ 8 files changed, 8411 insertions(+), 1 deletion(-) create mode 100644 metricbeat/docs/images/metricbeat-cloudfoundry-overview.png create mode 100644 metricbeat/docs/images/metricbeat-cloudfoundry-platform-health.png create mode 100644 x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-overview.json create mode 100644 x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-platform-health.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index b8574deded0..0c18d59e009 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -701,6 +701,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add billing metricset into googlecloud module. {pull}20812[20812] {issue}20738[20738] - Move `compute_vm_scaleset` to light metricset. {pull}21038[21038] {issue}20985[20985] - Sanitize `event.host`. {pull}21022[21022] +- Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] *Packetbeat* diff --git a/metricbeat/docs/images/metricbeat-cloudfoundry-overview.png b/metricbeat/docs/images/metricbeat-cloudfoundry-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..8ac90f6e3574b81f6b04e782d3a93f152370c6ff GIT binary patch literal 230735 zcmcF~bzGE9+bAM}NGTv4f~0gvEg?usNl15hH!L9~-CZgrCBo8;G%O&^vUCb8EFrnT zp2g>T-tRr<|1-q?cJ7I*=E}LF-mA#rJ)wAlhK7cxATOI2hEQBE2SdH?gdy)*^YgY6=(>yCzoLv;W504+P04AqI{p`a{-wTb!@|2*ZTWb) zWSU3|thYj|MWK;B$wWKPXnJuT;=U|vWm?r>US+IvC!A$9rREi5+#73*SJ7`3(N~h; z&>CHjWDk@cCfG+rTIk=AQ<|AG!*>enWI8+*=YUId#p6KW;eHFA^;o{@OZxw-r9`Mj zzLEa#X5pqrul?U0(iX{C;?ps^9^-Z+n79#Nj7Xn7d)CZP?)I@j>30gvpKBYId_q)L z9~-@!@EO~lhIEM$`{xEW-Ye+gpAftT>kSVI?jpLSPP&*+pFSB3PwpNrqm?t~??n~6 znHMK<1{14Bp&qP1f7Wbp{rrrTUW1F|J@k2&h~u2gHtfp7`R%Axp#OqxwnGnNo@1?D z6AA&hp-9c52M;lMkwdbQ?WXUM08Ipzd35PL+{e+M48(7vuZfe&NO8U$L@QM_0K^(6 zN~Ubb^5ENf7vc=Q+f>%$d2>9^pFK+&S$IBGYMRfJr(4jOy*m|4hMTBDfM4#mQFgkt zxYw;di>*X;N{#sMW)Sxs-_CvW<*1-u&(6~;2j0dVr{;XdPm}FP|Blw2m74*C zLCS@2he>-h3K)@3C|r5J-^0ChDc4Ixds=KSkuYKNzKx!KW1;$+>a#4rn&9;ZNo5eP zzuYaIvTbRdl3r2ZK7B=G{KKfYkQuc?a^dL`!KIKd34&d*^Yg0>I&M#!Cysi^=Gld!)Fxk)wzvpT7R8HL`_9Rwr7Ce5i|9V| zdstZ)yyA8}to#nIJOr1PY-44`y7cae`x!;14OsJOuBx|n2H`$J-$~T-FhFoBRxe&2 z^_*$>kL_QQ)BQKeM;q*W(Ux|dTE_P!XHj_2lTHG~mAzXiaTBk&9{yhfp$3c|OpST; zUi1a84D|a1T2ZT~3u;|y*$U=-Ub0%`|4MPzA2!*-d-);3`Agit0B7@OSyQ6W{xmq) z(%Pypb&>mIP~2MfI2F~!f}+?+k+E6gL=bze#HGsfy{thWl%eC_L^{WYfcyW zyhD8DoH!ufqPgf##Iz(>R#ytzPZfS^t5`y(K zH6Qa+?JNy$@4+BWJN8Kk*jq3lG-n%-rSI`jFimvO{Z9To0UQ7OZzRN>G%(NKOJFLC zh;kH~iU2P7Eb?Ut%Ul>O@{m0{V{5;aw_;jhIM5J}DierUaCZd3d_`mzxx3e9RJMr& zLg8L-_VXhlm%rOZA-UJE>N$&_<{@iFIg^gwv9fcR5oD@OndU?uC6@z~- z6=ctwGC=fcXl8X(zIk5T>#VxLc!Tax&ap@jnjLZHM{;H+L*6_q>8sO2+VjoZ45buz zNqVZ|5g;9%+At}Nk6y?MDyTab4^+a<u9nus)qBl3pbG>rCp4!sq+)QWO=c^gk?|4LPDf6o8~W#~ zXVE(nVEZ=%HPn?Si(QMbyf5vR)C@8M-I2|XUs9S+JNw1(fFQqCJpvcw@#B*lVQ9Qe zZIGht-Vw>6p2tIX9NwS`5h`+i%FF4)YLFQc&;^CHn{$p_$X?%(0fyWw_z+%cu+@5% zyi1gRNYNg14oV`LtM&I?q}}gS_!_sPb)=qohL*6i9MyhGvQ50$ z1-ygx4;)%L9a8@$jZX1{|8dx9wrsA5w=f4?sce$~)1U&Pghpy*}=wX{U>QO+8vD6-ub-GN5Hw;P-K%lxE!u$HW!1R>u4dxQE@aqUN*aT98Z~ z;H|-wpSjbV0mnbifwov<$(g-xx_*St9N0DS5~;Mhs`tb<=dEgcE+2@YAi4a0GJwkQ z+vh~SIx1V54RA^~2+RwL?RfVA=hsaCg~0v69Y<*pyu~^*td4ww-+NJU+q~8$u_+Gw zlq;_wKQFujLxmr?>v{^gh8)v8J7XnnRVBY$_-b9>>qg`3!+m-YZd`g|;*UHRf|2b# zItL()@}d6DR+b_6JTHz5g#?-|*G392@?66k9d`;gUbTey<1@=Q(0s1ltbp+B}zYqg&%h7HRbv?RnTfD6g%-KRIpAE>Q;CK8`t>~gtH1Fqss)AER zJyXk{H*#0oaJp}={5(BVdeS!YZ*SD=P~l+AWd#;kqaC?vrC}^lVeE- zTZ=*5%*|vzS#R09G#uzjzL}p5TmR1NOqFRMJ{a&mx~%EYXt*83sUunH%Vs1o8}+P& z2BfN}*B!E3FXhiEJg+vpjeb;=ZM=Gy)_SQshP~+b`;i__`j5(A(hTnhZeKI=<@H>< zdC?@O)m_uga`C#Fjki}qb3g&IpX1?P#2bdms;^E&W^xL4i2EuReJHQc!W(Ov_f(== z;%gmya4v~(bdZ<$v!nw;wYQR94Y;p4pkI>}}&!VON+Bkw5 z@MQn;*%r(}p}TCS86HAvThDGewQ=!-j=t;*;rIn7q;t4P8=cvW-lG;0WN;0){u zzZqySwKjfTsHkd@{=QaL*hJR_ab~#q8v?*FJD@IUzB~O`dsqfQb z$C{oZ#-oM4Qg~5&>htkxzu|p5eZgSTfKGdR76a?@d>~g&!p)N>8S5N&))yTOk^{Db zsFT?|2pnel&Y@mC^@FypB7;xjj13>SZXcUt!Bx{4~AxYi9yGE2;K1aHoWi6tBbgVZY#Wp9j&5KkdeL+k}=)ScEdc)Kl&?NK;H6qksyvUl`)N z{w*(eK(lO1KSCOHFkdemK3dpe2~>o}Q+<9Ngv|!;%=<~y+SIxIf&Qvu{%Z3rdr?;2 zzV|9+qNFl@qv7)V4eSE$0{+Q)42$tAQrjqqP8}F8a_@+_f4;R%9y`Az}z#m(oXChMzvk zDlnWZ0jFY_&h1p|29YqOmWDq5zmOy4?bN(3*RBwB=18HE-`%i|eXh;b4OX{lk6S`?s_yUkW(h7F ze)U3XZMzdreFZ?EG@F_y;%#gs8t+eECEY-EK>f-_J0W00LMEbyk7iE5Jz8CY%!ph@ z4>rBkSTRLN{eGqLV>LwEc7CP*AtPkP>q5(Dxjk1@CAsmp$~mS{ z_lhSeoB#L6ddA&z_$7?`kc(+U@U|0sDG3PV$X}SrWhA6RF{wa-qG0&*0RNSjVCKG` z(;SuaNMJyo_wgviJV=!(Kd1X^xnBn`GMv*p_7OpwioIgk*qF9Z(#M~O&YqCbzF)!# zt$tc6SqD~@3Uo7a%e~vWBgX6_s5sd<_To=c)uKEllw@gaSsqZD%)L?xQbirwI+27p zt3~VQs&MFVT#-)Z<*WU8e)l7W#kOzOTs&sjU8&=+K-Z5^AFui#$Q8b9^0mP!eH%eW zp)Cm&0N=eohrZlqW4ZT^0gcEiChkT?QTV9;WiU!wkHoLcRh$$}>18%IbNFEdlY!-V zWK8i?{*>&EYVJq6hl7g85xeQIXj`!X+sxzqaEgp)%}u~z`8g7?14kN4FNu+dGQV`m zx^Jrr)&Z0Kg%BX_>xk@NHCSUNo~l^4AP)MEBPR--ccUExO*Q762Z9o^igIDo-_H3G zl<_21LtySWq*sB%C8^jNucYi@&neI)MHc9PI5gQe!#qDDo*6ASMnmdO7i*yrZTM6j z)5^CtZmYeqJw*f~POgZ3?yda5s z5DpBI@BjU&m>Y5uRWBDzPE2fxG)h$c@<`9jc?#k#QEW>>f;Oe36g*_njhi_dI>+3& zwPT&qe?<%pmXH13Xzsxf{L_~>6BH8YD*lvVGVAM(*TWb_kTE-nQkFZ78IReU^3$V zfW7k^K^C0y>J|xe61Z0U>>i7vUBD+ijwDzZ7)_ZrR6=g<89}8 zH#m~W^75K%q@usalVP*ZKk+m2k4%5dHHn_-aH`{ld^ugo6_(y{5uhiyf+VxoYjkm0 zd0RP;rL$dIxu<(x$;#knfpsxMRm|aqnc`@*l9P-rLi8q(PR2K@mgG4pI((C=^vi(1 z^d|iUD`^wW5El2AMq>L|wqasIctP@~Gvy#kl(l=EeQQSNUS{^w0=;%)F;fXx*i^Wn zIzG?y1|w)R)B!-ukenUTXGZV&W%>J#$d7N_(Bf?Ze`=wCf;somGbRpZzLl~UL6zf= zIV_YtAKfXByZ_d=7skjuAqCl9fJA?A3pg~(w)G&QJtV)Jss-4u{&G{rZ^0>~ z%3G+nZS$GkJ9-Cz`asLJhzV048_mX5Y5E1CDX9SjOm0-as z6x(IO^l>|a^k@{F=;_+(bv3Al{2j$z+ClhL7t|xyF48jm*My2cI!o?p)b;dynO6%7 z6Bk59AA=h*m}6epg)SY~SH?h`rIBkFgT^;h01S~X9gV=_PJ^v?-9q@p(&%k#)q00& zfXx;kMaN%KvG}5Ee8ofNb2y0pL5H3%4OQjD$kpTMf5H2-20158;2aLPuz2+-U5Xyj z(S5j0Hj*EZCdP(iTh$Ss4D?ISLD>t9crw{F@R7c~ATa2O=aQN&;|P zBH}fYl-eNAhYaQk+Sb+c?_;m8Ad~@M1{m={b62O!$V|E?o!giS^hrlet)Z$Aghw#I ztA&rxR?n;ECZ5!WYguY_-VowwsM&e^@b0UL2|Eun<>^i8>}E3f2_-eNZ4?>_&g}q? zKjEt=7@kX6;KLz9;@Z11+8;xhH7RnChBfSX$Djyv#zyzc3HX#&Q~KKuxh9B5>W4Xr zWL=C=ham=kvu7e8wg8VhIoa3CFX>5}RhzrcJ`ub~)7?6XzxtKcKK82ZeZM(Bf;z6| zaHp3~^MJriPfc$1xOg6&pw?uRjZ`QxE0D|W)s6@^@1K`m5eKJQ4x>&yk(T=;zgpnW z&z=180r)F(LC;@m2&ARRCt`r3q{l!KL<|m%8tyI}0%mpB1*RK?)wQ5&7B)ewNRGKr zb3O%|ei|k6qQBe^#61voTLeh`Y*Js~FQ;T|ou*^mY}&>|8wrKCXQ42$x=?0q_8l(S zX2a3098}rn_PN>3x;DBx|c*;2Iy?nMVOj zx7yRxwp2D@RC5juxG4p-iPl50#%GI4NwLzO;>;Wr`khb;{v`e6w=5~MossovRpYPs zxdcfKV8bY!h9i!IC`g_+sB*iM%KuvOFs51Iis08zCDDoub?#Yd)245SYKeNW#RtzR;_Fg64`{Ev8qx+-@;7z%WX@^)C^LmUW^~xQaxT5Z!8dyYI%TK& zD7Qp?Sh3z6c3Ca-Eb3SPt9O+Vf)8hTWUz`u-UPs7gVSs`GiR zS}da1$Z8{-xN*#B6t06TF2NQREu`@0C<#Q@Xkf2j%%vA$M6*J20QE54J#GrHj zSdg7ipJn%n*h}$bZ$B2o!TC~nplrst)7y^POwG-wNl&DAiFtL3ck+C+_(~)GG^GnIPK_tZmHq zz_1l2S*sTt#m!nV{j}fpW?STFTQj)lt$4g!nE1HTc@`+#M^L;!TPJu%F8_<&ih8`$ zU^8~{FPWrWM6OV6xM$OsGoP{A`ezigD`SU)qVEKjM}Nw*x0P4nX_nC6qKU zAnp)9GM&H6hq+U##ICp9?{?!!A&~l3LA**X{^CsIWh_T~Gm`UlJ`ZpFEeF%K^S7Pf zDc&1Hk>?FB4mLqHXPof@i*KKG!L~$!E?8{QM3)z|T?H&f7W!iTTH8Tixw4FF)Aa!f z?nN9j9jzb502zFgM5lstAmm-2&VrE@{EGm);%qH^)n*pSxyf}t3-XPMO21Y8;f_>L zQlzm$YIqy^^t&vp(^R#@Nd@*L-B$my)9=e)vOms5hXFm<{Gkr)tw;b&S2zNIW5s2y z+Jpbj;TgWfEr$OsE6I2N^qo0U^*Sdu%0*OUy705%7CSwyDPn2##xvoERX4j?NFjgj zr{6G=XV0>VqG!cM@@E81qxjvw2}d|8JVKm*|B5zvD%u~ib7)1!EZl@-p}uOYF?9yQ z-IIB1)MS_hM95#Rw5N-Onq`^^94yHw)P&2Qs_C5^S}Bj2&!40_7F+d+vPY#*0Uofy z#|=eniiFA%Q67A5)PtOaDe=yauW_!;dMPXRA&pKCSdpi&O5ZGvt45GJ-2APm)B03f z>CTJq>sQQht1rcQ=7 z|C;&1dmqXf|3Ab=E&t#hoX?@%g)Nx)sBCOA!U=YE%iiybhX5>l~ zUhc8i%0!g(DE=9~dIjZXftmJNJ$qPN^DVrlx;-Zem|BXPD_?op$uzIMn! zDncyZbo3*}U1_5_kU>^$h~!+NBegAQ`1Shh<-T&PtkmN!`2+XZ&SGD0(f*Ed=#P5Z z&({;yLLoV4{+(0KN?RYHcoeFa#8*X0{Y+1^YOF7o*z0tK)ij?%`_}c^@sJ6@;u=K3jBJWptFeO|)P%O5dG*Nh&E$4Ez~wEAog7j$uUHix()BX{83yJ4w{ zwZ_@*;V&l2`1xe)(I= z12&CI{nrRmbL_UkB#g}rc3F1=RMo}8tjNc)hoe$_5+u3{rGgM)Oey=2yozF@|7tIq zq^P~q?e7}2?|H8_Y#~$&`0YwzS*h$(p%q*WyNTq{(xHi{NQIs>U8V4wEg?%w~n+41S*AY>D8F!5@>cx~~C?dwG%JWO0N zJeOiyOn4jeOMLWwfeH=o4Ft!sm6-Een3cjntR5yPqW;q?49NI2-1#0R&sJC;socC2 zSwSR%cE)2n(<%75C1WlOh7mkmbfL~yrFuh;0# z6YDYyHg?cZjRt2B=Lh9a1MDt3t* zD1sUKY@_bf!`s_BrD+NBz?%BUxC&F2(_s8LWi8}S$FX_O4@J@KF_yiu9)4S1q{0PE z0ku5}QMILaC}$+E?0q2}-@^-3X&<$f89x~}Mcm8T8WfTLX@h;-Vi(4-vM-l*`3((e zT}6D;PnU)lRkWsJF~KElmp9;XQ|@!{V+zr4iz(dlrBfc>Z*O`MJ~ZBM5WT0>uhWRC z`H%kD&0=s8$@66o|99a}gFe~Ijj`t0r@Q<~zyIDaI60W(24>5$GFQ0owE7C(J)5{7 zycr{{BHQ)XTIsSrFP_S3iR)i4*Pp5ScF(MW&rU&G{Og#2oq)Cz^@?{~S|II|Vp6nGCY)9~6s9h(2bEN-~e zfs!rVIfJ}1WyZhd^8cYcIbY~-mL-jZ2r$B)U3>4F65ZS;Fg`)0-~rhQdB0e7nbU{H zuPx7KssgTCM&oiOZ8@Si{v$aX1M?vMRn!fGoiT4dWddN1dWkBZ+xepJSZV7J`1>Iu zXHV-N#tdK1Rs9#8xXpqOQTGydUegPwc^0TnT1U87SS|MZ|{^6 z_lG|7vr4nk8`8AmCW|mwRr9R4$MKt!<;^}SGX0;nX_m8m3hS5{V{eAbQFP?mtlVwj z%qf@LVa^t#Ag%ZZjDC<)TIRi${Z}na(>?w7+uzSDgVaIPC7AzeSr-5QdP?@6{)f;? zco(;WpF_FBoRO}2Sd!C%-wdO_9h4gyyYavLe{UcC*L@_;WTEa7zwD34<41t7nT&qYhJPCFCI7i2UN&eOXw^!js{3fm39-s?>pA`U z3R@-w=JhCb%=ll>S(McFrH zbtB_Y?=Yq$T*S8ud-|vGp^*3~eOb#a%6;ZVr>-2E^0F^H#8|C4(dF+%g-3-njTJnb zQd{f@?CRZgW3X(?D@s|(7~{z!r{3zy2*14%HJWwQjxzX{dsouQYcK9hKG}$3YXLYL z{Ra=$=_Eql3-O^jH*B~xy8sT_A08c>5Gk877auY_2oeystl#kPbva`iN)F4Wz!q+6 z8l^)I;dbq^^Imsrb=8r(`HJySQff^|0rb3LDFk}(a~ZV%tw5HxsZHx^$cwcm^2k!$ zgtwjn%~6rS>6vMwciFCI5>bz*wbY1ytaDTsE#jLRi=BO#d9NSpJukV#(y{k$Ps&Sl zD=k%*j^<=SQ(vL!YrLK6N)+XVwuUZczpkES+DNu8eqBkjjpd=20(yPgGzN8Qy7qdl z6#p-2pz`yHJ-t_k+ht3o(r+=)C4U|>WLC{nb1pg!Jbt+C`ZENr+a(pOPbIYEWN?0W zEBni6L1KdXZ0fh-I_Jgu?}{6+wcG|n&AN-fOSys)x>~@8wCRC7pOIItkWq%W%F}b& zYRc5F+aU`=ra@x$o|4I=<;~v`_R9U%zw^GTpn8h;OVjx6hq~;AciP5oK6OyMr%vU? zN$PtP?Y)$2W#y+EdkQyUdu6A(W#3vglbawbR;^g1bm(7L6e{NpokThLOgjrqgj5Lm zyhLds zHr#w!>$7?6v!^YY7j+aY&50wS;V&sDjs}=0ZWTmlW;88Qia9eLx_@9iJ9{Ad;qVJq zL}=VJR+W#veVL1ev3sj46m?3fnSYmonPT5g&tcVM%&HsaFa6s3Dan|2b`~a@mNl)p zsH*WIsWeH4&_cg8lpDw&evmq=sWCehVZd2A z;Z`0H_;pzw)_eRRO@p*y!%c(-ORmxZ9R&#W*0h!{sPh4*!8yb8nKS;hSt|)^lsve; zk}I6gD!dV#*F40wTF9EJ@Y`?6DtY3? zgHGDccHHWo*d9yfRRW^^i3|tj2<*P@H7^U~j9iLDRL{YeX(vW<0>UG~HNFf>ZK+R0 z4tDgPh*Zn4TFJkDLA!gC%ivX?H?&-rvv-`MSXRbbSZxbc(3<^4{Ar!WBXW8R>U9=- zuP2fe<^BBuEtr$-#uP;o3GKU8eTGppeml378Fp|-?B8p=cao6w85X{KyYIweqcZBbAgFlW;!8W zN?i-)=wU<4l2D2yy4clvVuHzHRO2+yD!|vZKlD-xxYJo$>DG0@ZQcl_qhS^fN2Hp( zz{Mvh&d(L^+wYf5{r&zC4i>g_Ra0A*mwh9^rA6^r_@OO35bMBBg zJ`Pa4Zl^{fyhl+f3{<$GGx5(K&&;iXwBGMFV~n#`5G9O+%sBKNdTi86P44v`)L9$3 z`?x^pD8}lPKs`~R++T8gGI1k6<>U#0utaI%KQ2WrDma64TN`9s{cPwMIlXsw!QO;NU6lLUgSurC`|Dzh*qEIel+n-6rN`vO) z&YO`=i*0b$&3@+{8ydU=!O5(W`?|4y25;MMpS}DdPbHNJa zH6I%StJ_$qytWgLG%nDEARRZ1m2LFLIs8YeypJT0NQv~$3pkICQ0oVtY(2X1Lwv_Z zz}$~H?@$BJ&RNwa=y>3)CERBlP+$vTuB|55Igf%_Gq+o$x-7;n z37dQ#-GddN#mGjP4G5c*S3=ghBy(My4rd%_>qKj3*1D(&E>zd&sUL1bbXfK1$6OnJ&`45k2YS0pzxO+Ih~?QS{Q{TGOm0-sa{9icsKNn|*xnVe@@Y z9{Q+|w2;$)ZQOcA)z`Ml)X7?uy`#kLpYg()M8%+}mhmY;;*KoXzPgFqSGpX8bOgREnj)Tq(_HWd zJ-vD4Xpi)VcLtH&Fy3?aB(l?~8+JL_6clKG^{_W*1#Q(pl;?|O!t2{aW9Oi+#tV*i*cmyE=97ljNizz z8iE=;_xz}MINB8nTbZ6cV?!YB3jU-6>2JUqKd-(Mpvgx7d_aDr+xt(N8g9m!i(u6C zE4y=;;*amlq=xfxkxc#|Db)Ve9cz9L#X%y61xTwiW9#dT+}Z+sWJHe2HEPN|3fnjS zSV*laZ3AFW!1v>uiKd{t&JW_l&d8mW3pRgykx@KlJfagyz8^56D@wjy#*|>+!6NNL zrEeCz!agrZ(b%l`dN;CeasAB4#=t<@4B(Jxua%WNQ)FgbCPNmO9c~~ot)6oZPOP?r9++OT=C zg{^1xQAZM<&8X9QzBk%xVL+s=*)w8movxnSH<&SrMnHzL0?od4^x0{_xqVUQE<=M9 zgL{L$qGT9>J^5;gWdi2>>+^L(HXYSCd$GvEL4?Dl%5eEU%RZ1!8aP_qTy#>p<|4w4 zkdjWpryAm3YkF=y_J9}AmfG?VL+U|5w?&DB$GMmwAd83@m-5pfgX5U%`jAja%d6yB z_2G))8m70G6qIG(qct@2c`jYaGhCrF|6{Itcf>D*Q30`Y`xyx;gqoezYH8sGr4vSB zki;-D`_w1PGjI;?oHMwRcFgwvoXbZ0w8h{xpfL{qrt5u!t+?zw(6VXuB4sf<(LTX} z@S=j*c!S_>%^xiwQQ0ZJF(2YHcQ=RpnS23lzK*!cjbRp|z8h@{I&b#Tb|$&P+j<`y?GFf6Q;k`l3X3 zI@=CR)7w_Y>e{jxdZ>xi&o6F~F{g&KCLNpwjPOQ{qhCS$+O!+Ut1PeEv{Kp))K-)F z=TVt?z9Ki2V|_&TqI5sM9(mUJ$3Bwi!}&VtUAn}LCr)B>h$+1U6ouCP^Gd*-g%koZ z1`|eNA&Z?xYI*8|uJHs?a8hyJ;{v6dYp&V?xBG_|(!3%HGIy$mD>mN&d@ zV%BMK$E+J;BFuF{dcwW4KGj|@jH4DwKjgC(y6BEXyOFz%*)TfS{3F5V_!~^#GM>9D zHqKNI6D#m$(m(%`#Ru^VdXRz|a|3aDdS3F#10PsH@;zg0T6S1fHxGx9QlhB!&AV{xErpsg!Xxh%|>AVB2l|bQ=5;w&F%~-G zZU5d-*7K+NYinmRG8S^?c+Vs77XvSXw0fFX>!x2_*}Nj3^F6S$;}g`8@=Aa2<$H8@ zH7|7RV+EO){24brjlu0-QI@@jO%I}ud@bCh8WnkjwJszYnxWkQfUOcdiw3xE5lc|u zrtn`dgz+jYYzC8$9=qgr5YMv80Y_q&mtfgZZAR#+;n!czo*#U?7cfC(W5*gSPS-E}a-+IwP5jxes21Mitw z@{BoXXH0#|vC#fEoQSS{E$FEF-*=}r3Eh@F=hW1abeGREI&T>B^0Gp_WBMim0MgGD z6*2b)v~by3RQzTs(KqP&bxYvo_)S6e5(JTb@SPBraC70x1y4Jqj1nwZ4MlRvpS})n zuMV=^(Ndaw9*fxNL~uzk9dDp@=ho_XHdsgvi<>XQ37y3y+paJq?#!&B916GWP8!8T z=`0g&j|#3XNjuk#osa%>c#Y0E=OosuBB%kShqokoT(rffTZQeG$jLEecb(|SQ*G^GuUKY9uE^@j&8FSpX7O=WDmENLXfA*>7F?|xko zNNg_pA1}M(cLgFv94fR?FcygUrw?w_draR^Q`ZO0>7TD$(GnyetV@^oKA+MC4rVnL z-VO&I^dqirPAoU>u1d|}PnS;7JC_?`jGaeBb1vLFC7h)eps$@hkH$=CX~R{{_N{|T z_vlVYRzy*jc&$t@iuzK#Qx9RX;@tv7)hB=@7f8mA->R6m{owrIt-4Z7HkFLf#1&PI zuDB7?zFb@)Tv^08H$T9&Rf_)#cxlL)>%}+Z^U35z?9A?g#A7P~B7)1uO$I_>h4r-; zAwS3?t-IXWs$4&cODJRzRR}8xk-bQ*+wdX~OLq2dt`WSlJz;chg=G#M0#bX|JXa?Q z|7?Eb9S>ExejDa`p-8}h5~7!4imz#UN#)m1T55L21aKZTTUA9Jq>-4WRD5!{agq>yotnVtd9yF z$8sV)Uk-doMWgN9Y3jYuP1{9^koevPY z^K-YC;t64Yymi+S#gI+n8y2O-ji0u!t?$HewY1OY0R~N#${6m5;P;7%vkRFwuy`<@ zdXL!Z&&q}z#lN|%B*j4lymS2ZoI%e3Z4mfAPWj=ntBw{O69Z{#|D`#Kt*9{Ky*``Qnz zBnGhk{1EgWoY5%u6I@NKGI*SSaRa(RlvK5O{~?ndnE`X&PGPgP-i~cCGzP{XZ4g|{H&v#xKH#uzp ziB2GMj%^7bYUk6#XS73&^qU+;(i0khOr8e=)KGSk8%3fo{xq9~1&yZHlTs*rQUkm(^@ao*`j=9_?0ztQFYcal702!e3sDn9DezG z$1$^dWCt~7?$p&ilbWV2A1%b>X%Ne4fNBObRQQ)Pi#4F4B2^t!@MbW9>v3k4(4x_z z3Zjd8-SzE@)gDqT&`kW)Mz@%W$()1tMoq*KRsdutUF0|wKffxY)!4Z#(&UAF7bzH* zT#vd*)XCu8`Y?;|A}1^^F#DsWW{aOn1It~>Qz152JnuWkp36N7Y`y)my;0fzW5H_$ zkrCI6&5~T2#aX)mWz)8;_~pjPoPe-Or{P>-L@d^~s_)FOZ=V|`fxAj%_5LhpnAjK} zFM(p?J%8Ts(Kumyu#HWsgHgG_-~H_B8Ia4IdLG!Kn>#~xJ;p^svUgZd> zu$lx%0nT7Z_yBgja^P1dXJ>pNa)+O^^&75${)VN;e(9D~r#d0r6GB1;S(ID`Du6S! zQL4VZE>k?hIuWe#7H|LKMB9}w76O4TzOEO`7^Zz&XI9r}oe3shv)>1vmkd=m@HL0Z zGt)3nU)}UB34`1=0t4t=(g8DG?qtbj?z^Wut-|i->`6%2`gOGdV4d<1ktE3s!9bkT zCba!o<3ipxZU*rrkZT)s*V)SALSDTqmHb-}_*-+^&~C&G4e<~W+rFk&9Y~W|LW>+lK#yIp~D>rknPryRW?~en6pg%D{c}b;i5L$-igpFjun>GT=GYKNj0?+5WhAq(&9(7oEWikl9yPHR{#N-9gz)#bd{ zf?hwbH(i|ZgoHUKzj2i5ya)%z@na%7xh~qrCf(XN`G!zoQpwZ!VUcqGbQP6|vg-1$ ztb0Y3lh7bCh{M3Ho57#n!>+(blfkCy7pxofd!-YkG)&n0T^fg1N*Zn{HO@^e2fXB; z8@@)MB%yISW(5D(CAdUZ!qt0bHHZACXR3BMYemJb@(sRS#v0SB3JL`gMOHRXvv^FK z$_u>Z6`MxNci-}d_qdBaXDqUvse(KoDUVUujZ|KivmFWB_giYMXp(mh(pUtX1%j7P zVj87nr&Ze%#@m#Q$~*T-4=w~2Ig4H{L@J99y&h=7HU? zbz3}a;p~ecBwR+|^}ZO-#J}~AesFYaZF>2&9tEZSF=O|ki-wU#$XpUA3la@+=v!>< zZ)%1E&+0G9wt>Mj8p?Q{(}J^VPz<45pI7$Z27z~u->{8^urX{avGFhCIbTs$9NT=D zI5zd(;PAvdl>^Zf1B}2=Ex^}C+wgkNSc%M5>Ze_POrd=;%Vb;-*(IwK!E7nXG;oOK;CQRs$ia?jH8mk$v zOfMT(lU0sOYw@E!t5?2HyqR93Zd7IXI0lC6U5UR)Lx8{Ew{)S2 zBBa}w2Grbt3wbA5wJq;hy$x;H_)v0`D`J3pppmomR`=@ipta2)QiqdTmKy!vdd%O? zq#+r;zZED>y88P1fSVy?TFAe50geaIP?8_9|GhQ7-hK}K=spQ6xa{*Vw7cs*d~v%y zo7)e*zZCGdDXG8vC&ZC@#m453M6MujS5CLMg2;otSAZEr%qs77brpECEG`b0ZkFM< z%a&IL8vlZlRQ5)Z?eE+7AII{=Mv%9i$c+2>Sf8t^;`XaMX;Oxyjf`j>J$jTY;`t8i z{x#*l%_8|Eka3D?F2>T6vQkPlHpSvZy`}o`A^S`5|nOOg+wsA^!n>@`J zc@0~c+O5M+{uhHmh7#+4P%yh!8_4nH*2n=@L#%uW{$rNl7w;M5zt|*?e09`i)Z-ap zgK#oF`(VzdFfiMjrYmth!cgGP8x;-~%2`$-yzucpI2UrwzGiv{Fi(K;%{s89EY;Yz;SiuBWpL^5;*tn}x4AEQ;^X2P)Ps9_G5GlS^m*Y< zR09sshPa`jAr8pJ_O?}aPEMo6ioTxSe1ju2eVR`LmB^@to12>(bOdBco9(xgiiwB} z!(i;n%F6oR;reQwIE|d0=QH}+m=XwlU)}dl1qz*>LP#(qn|wdfX+On~e2QV3a(v(% zl+$|HVjm@WcC^+bdUv@Y`sdf%*n|Z4>p!;YWz#MDi_PvkA4YKT@p%D&k@Ev+^vBuRS&q32X?jU__tSL#Rc1nLJw3gKqGzpTWl;?c4IH+Ek8GTsSCS(ZeW^R2 z<29oYI|-(H{PD&8@6U*r5e6t2B%g*UN9_2DUap2J#-IK9W1>rvAa+iMT0Rn`#Itdo z_jz={&M@abyt|T;lJKBO@7>lvhS!|Hm0Td{tYVmU+0)UQk1c67P zcnP#(eyN3W3B!1Vf9bRFo|srhG6|^t7tl>zsi)t`c{ZQ?Gv}ZG)%elz2fy8D!<41N z^k2RIeig>Uk{y+DSm7U6S*TW2GAo-1)^_VK9ryJm*HLh!GnYl2=49#cc*c8ch`{M8r(g&JB>61cZbH^-Ce%U zIrrTA?*INbdcYW6)wR28ZCP{9wf3qZk_@>DjjT^gH?e9%6KWxnNf%^E@Bz|5^_(4; zfN!?yWK%w5*Y)MT4hs3|WoxkSDe=XaMafNabj^S!xQYY2RFCh?aeU^H8(g>R^ag(- z5r%OQyw~zboSQtf0Dc8(>d6C^JNGf?Z36HdVg9_x^_)FeHj)*_QZ0CJZb>Jpq~Fhj1d0`|`K3xWmScEf!6)3_pA;I>SVZq^#Ax zC`b6vR3WZV`9_wbn$~9kcKL$2+18MrhSVD7^OARvP#lM6 >o7tG*6Y}O&(pi@aut)^$U3sfYQXN z`<}OS;iZ!rXdT)w6Ekpt-mD_!QDYD#)GGp0pSErLvoAu*ZC0_;+w~JJl zOsXx>iYO4Bmy6e^5K%V#yxLW+5<(R0QP|sGu5>NfXiW? z);~OC+zDc%o_Qmxw-79494B>f9SOoVc?)Tet--;XDDZylsG(1SCtBP3)R@%Os3 zvo8O#C4bjV!T*~=;9ipden8&wWCT4NZFD#i^^wrr3kW#3G@*@^gno-A5Svn!a8^REJ~~-dQ8YJ? zu^nW9L%O8-Cb8CeQ?1^C7T)q?&;vi7O2z01gw-3SbM!_ago)NkLkqT{7`=&p!lq2Q zfl$+$7ASY-{}im#hT zZ4{jf7i3gBw^f*o+JLjx{JTEE>RW+D07zU!W(_9Wvgn&0wG!a5e=g15)B;Cx=&Le7 z1v>;?s-R{B^vUT5Y_MQ;07Rc}NH{GNSHO?`h z*fr*Wm_Op5RfqjU`;~Niw>baBd;W`<=qk5U-8ZnXu9yhkl7g1mL%= zsp9BjmwInx18!Uu?*e>7atUZAp(um=#Uwt}w7f$or~S*FR>5#OY`nW&azeAQv8k)C zcUbFy()GPJIRQP|0=fQLc(i%WwdI;&3ChE2W=)s^=(l4R*UE%=^~5Zy9NMkpILToF z8X9tnitr(Ng2XsUp`qucU!GtKXMo%RW|iWmYZkADv^P1nbp5Rhmg?aZ^LpE5$fg)qqBFl~vn}`MB5c z4KenV(pmePN*y;U#B1yU8gpRU#isQ%`1ARweLzKnTyvv`Rhy6Dup?!Xfb8CZd{Xz zuG4oSX-~t#nl-V4=pefs`mz7=d2`0`Lne^uPLRRbs2eB_f~|srg7!{Mbg#}zm|0oL zIHdn}jKYfFnyVpuR|17q-l$;q%@Sk+c9D8ekd>VJ;sYlUMWmx=hD5t5)i^4tUAok; z^vWZ?+fv|O+|qNEhdqwX=I|?aN>FI^>yMzc8Q@czBF#y# z^SHtS%7}o}KgDIH;Wo>XZz|9?SrI^U{JgI!6ZJYArW93tgECY-jxSk>*bTm=g~~P; z<3naZ4}=0~df1i?)a#-TU!pOtZawZRfUP&P7RSvJ!#?M;yt5&(@d(?NnZ&H1?-S;rNOCO6Y zn^EgSBovbZWFzvvnfsQiO({AY8d&23h~Qo@&=6(8**lx!y%?lcdobN$Q56-1Xy=3c zBK&L|LXC7+KxV;r2eF8xou4Y~M3A&hCZV%a2Vh7~mSno+EaL}1LgDn*SYdq%Q+;?5 zQA8g0N)ew%{Nl|gYmjr%WZSQ9Fs#6fZ6QpL|Sp#nb$P$*vnf2*eV(5{f5&4ZrR ztIV}53JWty3&2iFE!|L$b-Gj)uYc&*vdCp5Q(|=nK($La&|}>X0t<36SXr^eCUQg2 z59!?4cDibCY^JNkNc1{Uj8sTP$q)6dRne4Wg}X>20Er@UnMht0dD^$NB7`vSV#1gj z=}S|iOf2u}?Oo)h*Aq460WcesmaI)8MUmTvNJIaz{#5iFP_G0sYnLDl>*;y*mG6y? zjt&HE)5jAK5^jz1oNBwZK|@2U(XnuG4M5<1d3m|k38>Fu7(xRYj91n6^Cv{6NS-8z3k;I+}%#ukFhtKRbKx@Gx?yh@tciQFd{$#n83R#UO|GK?kGDlV)U? zmB9hE6yci3`oc$r=FoiAB7jwLfq%hQ!h3hyH$gv)sIu|Yo5kx@f7jDGqil@#U2f(R z*g3fXXQIweua5Xs?BH`dz;;)n1j^t-P<5Sm9->St&!b7Phcd?RY z6v>X`t7=SYRAm%OA>g(lCzq~O8-4weBrIpO7dGO$-^j?PrUA7n$`cUxi%6+rrpN;I z1`x>GNvC#(ZS^~x;n zCT?qlwM=f&(v&Ga5-m8xNJr39&N@t?CEjCChz0I(Ds{hpm%C?*VHM*b4Dt12J(neS zOq3=5CTVxrb|cMLfIb<`Zw5?M)}H|EbvnNBW~U-GUOQA5tpTEo@(+b_X;9GbD>NZXA0_;c{-&P-!zNGs-&L9m;>|ub5rJ`fTjYK zs$y(JlRLT1NlVZMwb@@Dt4cKx=ie5`N6Lk0Q7NLJJk(r2H7U}G>ydN}Vh3W10Y39cTVl#I z*P9%BUJuM1*wEIdW_*@iZfV#OEtNqGSDEZ^o=h%1c=we}qCk{p>5Q#kE~adYavQNq z0;D}dp456_+2aVTo206<{zLn=@hEeofe>OIo~M_Bdq~rW7~WMgIs%Y|0i$)OoIjzD z%pt$zSyg(J7{syKKGk-69$?!VI0x71kYIgOL2^B`IBtlrrQ8Cp?AMVyWA_*dIC<~Z&a13?Sw5S^$wXy0=}{lGON{7B6Jqal&Pn@ zomcXA1b$_Mm2H&ReUv!(+%jYlMp0nKpqFXjXc@-x{A0;!cZH4NuD+6efN)Wt|1qjw znA2xB-|6V|xS;-zZ@?H92c~Age9-#)CD^O#e%;#u8JY9*^Hv{MM+Uvkw=;O$Y=IC5 z(`q721Mwqv^W%e?o10qfbr*AUbBQSByxiQ)e@;b2SVK;Ab#)!hRc|)jRd5`5Ts&%{$d+DvqLMeeC4*FfE**V8{#KE$NYf<(l_K;u382dAVH|ASL}^78T^IE9U^2Ld@TF)_7HeC1_i zsvz!(&SEYlIa%M-)KnUui=3Rip$y7TceD|5=F1}ppr@M*c7fbaK-y5H&-F~)?=g^( zs%_P$5L@&N$PL>gk^HB(_NNN}m=hu;dPDZTZAI~%yjlA{TqXc;U1E|;Y3S;j7!?&o z=eCL&`tIMVCBzO8Mb*N>Vm{W#&cY%G=wbCzW@%-$2vIBN=QS1<7aM<(xIwJ?=hDMK z`hTonHSurp6!RRSjHeJk?}?LPAfSHa?H_x68iO96n)+d)!Fw}j1UdTA_imle!X5Kp z=3ICE+*zsu?+n+cLUK{8%Ew3)8}zwR9Nm_i$u~cukn0!i^^6^TnPNq+`aao%W@^{J zgvKVSx+|5a|olq`%AZcPXG~~-ULib0StLWm2i7L zSatamlE#l%!jkHnXLw zReCOk4Y62RB&jnDL-%Ma>57zSRqcPkW1*0ye2%M8b+@Z%T&f8#+PaK?hGz{2S;Klw zxSdOXaP${uG7E1ks!G6BS#tDutOxBBHwR9E-2gwHRO5C2fl&YI7O(_gd~W4@a&<6) zNOwu#CSK9kEwKIbH^#SED9fzX$dUKuz+MtGXv=*3IScEy7p^ziV#V)DxNtSGKcSv! zqX~qBU}FQOs%bH8K>k%?KtxleFV1}5B?KFlLyRiVAjN(!Qg}g$WC;%ASnyUR5be?d z^wqNd9y>@ROprRQQ{7ozk*(qgEm+0rLl`J1WAvvI$wjFO;)m~`jnB|FB6vOKuEaj! zZb^y?*NdxUSa2WN#wa2T71(5kG*u0&Gu83%-hz9OgmTpdXIPPkOp9&!$gi}u1wN&6 z#A@OD_5>PRPKZ5kG=EieK_2Ry?w&f`k&8fY)Xr82SAQ?hQTB5rF?0mWM+2G-wFn@! zRZB8&2wOTa9td!p$B2R0d4|NfIR3)8i!d+(SfyItvUH)LNu|)6qb`S$z+xQEHtf+A zt(U6~*r%~&C$*K?1KTfudziG-pU085c2v`9fy#XYzJ~7%!Gi%zG0}ww9nd*bsreXw z(@eoYe8BJs;=C%F9oc0CmUO? zOpxUa#f%wiVjSgLKp*qSj1#w~iBzUkjY75^=%?K%qb(g-kSKSappJjA zRyq1SYD0icn`G10l*b>;0a!BMpU>9(q7a8wGn(%G0k1$RnO?!gh}P@Asi!F)!#}g& zr|f8CduVab)wYyM`h61ftX7481-vk8-b-$*<=$G5$hR>0Vs+7Dnwt6a-OY}k8RubR zj4!C?I?-G=j_Q`p{7G9D<(}bLwqs7D3&S>TOK_%aMQdg0Y7G6p8)XyBd;p@ z&~i@|L%FzpcpXqmNd+fa?GuMU9dE_tN-w^;q-mPUEyXTeyk%%s4%<6hPSb*r!t^gc z7rdM46(vsW6K~Bvw70hx=Jfxkm~y3xPBM?HU;|(vl4$sN8CgT|A4$|8uFmE2YELv+ zuRgcvnm0M@dkJ-TtB1~8WWv7AaW>ZF4o7Qe@76CUlz6Tf%3uWm_Ixe2?zywuMSQpq zEgP6xEkjEY{d-B}{%_1csA|iKGki5VB+?uE=lk!9KFS_b9`T}gx^Fx&`k2SrP-HnI zArvTRsiO-8Fl?+d%O=}b6*s3DunTj|TpfKVZtjY)m^>wIilG&JXX&DWDoOMfOp5Wo zNmBg^dnjJoW6~5_r-JhO+OSx?g5D0oOQE|oEbξIxqJm)8~s*(R}5#rC{Jy5H%( zDG5Tn%l{0hj~+Hf_OIBRYXE*~X(-PVff95^v1-gUT9AyD#MCMEI!bK_#SebBPCYWJ zVT%nA)QREM>XBJMy09jvWBvS{5vRI&;9Z4u_B^MwuEb1J5flGY%2)iPj8)tDI^j|bp1p}F-j>7 z&pq4|DYfmc$a;V+v&0)>-*<5?Kaq5R!Io{c4^)ez?54q`3g(uZRIgXZ>+Pv&ov_e+qdmkNVqGnu*y_N3SB_9t9Qon?)%ASQ zrGW-Z8Vf^3u7&htz9nV16N7Y_+i}HE1!A|N2p;S^->e**sGH0N;A-Tz5hZETkjuSpPP&R zsUS-Wi%yb#GmgesGHIu8_*2H%I6g9o=Rdgsj1TUF7^CHqG=%|gf2V^VJ%`vH9<68phj1{oLu#%z#{8U$GkK(!b?Jk!7s?%y>J7dxEe_rYaVH|F3rrI}!X3cYu6pPvN2%lNE>EO1bD|6+lsw+?>-$RuE)5D*UtJ*b zV6*i9o*-jD8xW0Flqi(4*O{2Oyx2j?u|_~4&@=Gin=b0{@#b+$nD@3}`*7|^{nq5_ zt3xIMl)2IC3hk}S122bTdD=Dgf?W7{%qH?kzYcbQRYKQ!&S&}CtP%$F!4{845L!nu z1t+H3U8xf$$K99I8JDl8E40Bp(VJ0aw-;)Uk2cKYR=iFJ#mzab_wctTL-wavefMJC z>9}(DGVPiVEDpG{AhOM84{9UKpL^S*Z9Yr#nY-PbE$e?VnEUhd(sptt2&XtYI+8`2 z_qMz{Z3r2 zMhH>ayfGrXkK$LnV)N#(@6sRzzxPfq&eqa}+L!Rvv(H4f*@>y^VzYef(+fr~VFY=N4gxPpZz&iVTgPNM;NZ z`Ue$tv!`q&=VMRs1nBRT>ibZ#^qH6~%Wg37`>kGqn;{QkeIG{zjrhK>3ZF@w7SDGTQU`+kc>}v`4p%u9$@F;#okfT5Ew1Hg68r)d=b$C3V`9wkB_#oIr->cuf7B)$WmxC;5OD!5<6giks zkrj_iRBaco>SnJForPa}-3nLNxcPdy)k?l&$}AeX%IdU_(|Lb0{Yd6ANHww;I(ppq z#3?;F{v0dd(1hC;(e18l2|VAM!Z|QDJfywxDfqTvZdKb)pMPF&C*S=ohMR-2UfA;p zlXCUg*V5jesjST{86%yxS;Li>kd)M*W{v`sY9TeNj&o&srj>i&lS3wR@}L3gu?(J3 z_rs^#@M_d~nMlFL+=-|@q{6IRy_@A(yuD5DywxooK5=t?0;kpA&9{d=fLY-^Q$IUm zac-=F0-uLMmxbWy^{8=mJqF*sJ()=s?VbHhE zI|N;@i?i_Q@!53r-9d_Yib-NH+6z5h=naa^>hWtkUOIm`@RF~!cz4;_ZhwCK2GXDm zWVQuGJ#Noai51YF^(br5%RYU3bbXyd;V{>YkUw926cE?S{gK6W=4ag`^9pA1AU6#H zzDDWgh;!BD*klpEe)MyDL1^}?%W^x6u4&5;-YJ-strYJoU^p-LM`TEURdz)sTzgsZ z1LYjck90q6qwx>Y*0w&gy@plHM!GO~SXA}i24`++{eZPwd0s)W;Q{f=T*Gmhf4>FY zuw1z=iCP&x2Kff3-FFTiH*%Qir|>6eCZt*znj<=FZ33Z6VzlS3lvs(dqcummn4RP2 z`Yu&Hmx{vPf`SRYRqUH1nimAB7AqF_s+;n`>0!Ay`9@?;SF?S9T?b5xD@p`3e7>zQ zIG~*Q*26yEBck}Oq}kQBtv~OeH(3%%R>zq2iqAWOh9qt?gi=*Ch@kB_Qjj{RcoS@? zqK%}irnvED3<-=HSdyl08K_wwWPxvvh{O%oRlF+!K&D;J(=1)n#A$|g*xS56pIl^D zOVTR;Zjwvo)cobmGCMedfT=8@7?#?VS|ba|AkvZTYrPT~3Jko%5Wu^q(*e1g{YeVp zOn98gCC!b9_(S{jT1Sh2NNd(ap~l|eeaw9oq&K$83%t_c)jJlC-avv zT#gfi_aoyWR{X!2?<1hI?CISu1|{oUOm1(6Vt6poN9UX=^ov+V))T46(!FE$y9J{N zC7jHjs7BwkXbNWvJY#J-8N{6`N6lQS)>*RN?s|}Cew%f>oN7bE$OOd-=KyJXa`qAR zxMt9<9Phq{@$?N(JBLnMB#}iv;W*5_bnXKXIh5GL_o_B!Ao(oHyuM75? z<9GLC5ENEMT2Lvq-=((TA08wXB+;+6dGYtQ+`Ji~j)-?R1&ss@j(0FE4RAe=C!J|Yd zr*c;s$H1J?gmm~5rmL)?5?54p&raVZ%Pro5mMv0Qu)!(>)&!FS8mae;4;d%X82zq_58}YIjw6Z9TDX?{tajI{B z5&YD1>lZ#c8_Du(l({Saj`nryI{HHIWxdh;0gl+j+45V|j*fG~iK&+~+Ml+v9>MdI zYjfJbL$>ab(b37j<5Dg<0uCO=*AAKK#HUEoy}p*@1$id8i)k$$_OGu}$HRql6E)Qz z!;Gfh->#hdf?U=a?!r%B$!$h52xf1(x0#aLhTGcOJ6OzKza7)Hu-BcED(`YNpX!}0 zp}j)C-rPM$$m`^CO*AvMR}44OTw0x1-vj3w$}bD{y7uP>urJGUqBLB~@;q>DMi%e; zf_;-1d|vakLtg!DWC?ELJe?0dFAwUnZri@JE5GvaEZ*20IjyS*ocbQ0UcQ2!($b0e z-Gd1Heq#%k^Qq9;=KvhS9&HZP9eO|isTjn;}?o+q^KIo9UNE>#p2{K%WOf5r!( zDX2KpgqoO#BN;3*v4Qh&-2Vj8wB98wOg5L1scLtX&cGu>vJ+>WV!7Ef57$-OfV`gE z1vUnQDhowz{x-zSnm1(4IjX&RCmw2Yz!T|6ztpS#V8L4}>tozLa)K)FPZA zcgxT+Ha$g=a&1!f$zgGuC`*_Jsd2Sox8BWLaAaIpz0`SYFH^mH(f>dyf9e)d$Otw zl04U}!NHvtBu0h2esh)6{t>GEV4)n3ePFKV+EQhcX7@))i)s&EgRHufgB4VBMz8KE zT?QuDJ=B}p$Ym$lf0vjrVaEn zq=6B;kvW^tt)*%v=FA0O-e0yk$=jRqaa7(5(z125*&krDt=2zw@mBE}nrr5m^lk?_ z=_L{Nb430)Qgg0bL7U>KjKd_+F~6dQTIJzjdJT_fiMuv&WYc+`j8$l6dfrV6QfqIg zSxX@~U^t^~ZDs0Dq0DaFv>{Y=_SBqtkZQQwjuPDtCKuMk!bTT9VSB~W6!oJg8pFL` zQST=BW@>`%!*{XqfN#yVcg(oQceWnrl4GKomm&eXiSKbUZ+4&7eoqh-9886UxCF_) zZr$ZO%_%H|8>(?Xs_v5@!{B{7>jK-jYel}|yzqz4+dRc(WEop?TbjG;3@N-Vv$S4X z_6_-=b6d_R)xZI!*gxBfc0VBI?-XBokX>l7Sv`ByeSTqz$Pno9fh3Hq+n{wr>G9vU zcyIK*8vMrN;dXHVbWMLHWM$Q7qtFDKoauO%eVG^y=Jye>Yd-Y#-Q4AGF>NXRFgj~_ z8x_SfzhXEs-|QvXGT1=$CY^xqx0>Hsu=mr;=`xmw*M;8`?5WQ)@%e*}0C3#~PS`Kl z>m>Sq?wP_?YW4N5rG1!z_(d7jxvjY3o*|kxV!uDO8uaybFI+lmgkTq!V55P7rPqZ% z4KqCYd8K{q3_SM4Hbc?=+hil~LA8!)er<00%@hk}>FDW6LtAUXWoFRjdwo;a)YqqF zy={(_Cq1CiV+MimYP-vN_>=us%hQT{`qEhgg<0=id;6o+)2NT1xZ7fH8UpC!3qo9y zxJ3JTw0}PA{r$CxZz~+dsDta)BF)a`-gHMZ3MhOx&u?MdP5L!G`sD(XaOHLLqN>_` zb6V1<%u$uiI<|L#t*ALLPfMEPW^#W!pV8XPgeNS@;xM_Ce|+KBB(qd!WX7c`b!aAC z%t+v`SR6>Q#w>Nb<$F_d!0IGQsWHo!4dYB9O*rTDc**i)QrtobP5gIkgC@8$qw9N@ zPVAC{6+aoaC<`C~R`Q}msz>}{Z^z$w`3tD3U&NWzJ~`4lf9WhuEDnJ6X|(cPGVvq< z$}m)kfcNH5t^#boX!y=woKMLT_*74Z@bY3ME|`N$XtGsH-j@|%#!=A@k+j`uj&y1` ze(iCdEIp)O$Dfeoa=9Oj?X7l>2QJNE%lC{f7JXHLWJ1GNIf^nDd{2FQJH~nv@3B@XEJx=N|rSu-dxhiU+cd{S#5HmoaV} zJvQr?-Mbc-dUlcA@lb~3HgBJlOLhhoRk z8VM|{7TkMxcX4LQ-v@cjLdusuRC+vDJub}j4`-Y;;=ws4ooSq%&~P?Eu$Ji`OPK0L z^xKiAP~3Oe_fl^X+dfUG`<=*lSE(0N2!euoNj12*9)q8HWrvdH^Y&;SKy4;qHZKeMn+T$a$NlKH^vD_O(`#sW zcn@B=>zByUVi6IjEX>@UckVJ)P6Vf3hvE+Hk0vYU-k2kys@x53;}f8aic#BUZnxZ% zxvmQONWNt_&bjB!r3s(2AosV>N6Ws+daaKFD|HU9Tzr0AdLin!rz;hWxo&OO1=r7f z!ThpXT8o{lHjCUAi?fo^xs@$Z+nLn@PZLzWcX`C<>8~Wa46Xh5NV|W+x|2PEunbX* zgpn*h9tF|dZfS6ZYxDGRQA_jOOl{n9i(75sE^6J1&(Y$gnC@lj zk0K(sGWYju&Aw6WY?qnBSp{uv&jm}j9LFzQD|L^%wo;4bp{Offdo0#=%f8ABerY%1 z(vTuZ^^?oZNhh;y_9%K5)eev%VH%x#Sh%BEBzP}4Ke~2-th^m(=G}XHjHE_J-A0(s zHA#K^S0=u@Q?JPkPb;_P^9}dHp-A7W7T%_lXMrgbO5%~~Jy*n*I|ob;S2pZ>x~yUd zvJ;16)uiI7O%P}BSczy7NRN}lkt-2Z3%)j}WNT9^WR&t`oRR|FJpeMy_k;;bp_UV0 zgalb=neXcYp0$nih9Fxdu%M^LCsYDC5zqOeCDV!!yo(Ti*PaGYO#>oX%OzGKtl zr;&520?!CJ#9p3O@>ef|z5 zPC`fH-S??uL}sbFsHe4foVW4ruQs2AaZ8a2ojIM)ozf$G=B%c$`FhZ8u1=;u;8%1+ z^s3a#;r4xyA~b##@{UcWQc1<^h=|xN&1Fr+PL4XfXaXDfy-hyngiw3rdJsw}IM;;S z)Urw&%?$M?XMao^4)m_Jr>6_Z?L?y&)2?d)a|3mccf6E^4Vn&tbH2Ty@$|}AMB0j@ z4qx3%M)O*4pKT~J-F9Zk*Y3oYb_ zk#@ZwD6V0irAkHZN;}cfD+)@%*`>n42+`P*zNsz?g*utUB|~)uMRgH_>TNat{GDxH z&ZAcXzYX*DEgzipId|;Af=%{_7;fi5sMul#o@_pC>b~M7$b>Qu#$_Gn)d&(-j%Id< zHk@P9aUY?}ArFUoaEX!^a@u_aGAMRo2l_1PAIo0eU!=_^ej9rht6L{g78eu08@GF9 z;eQqPlXAN371;2-5qO4jTlPqHdzl`yb6?zr^X)$MJ_6s%zgGNF7zS-h2OMCrI@gbpLU&^t74f)EwdKLp*9M=Aesn!y;iO9_uF_;8g;&CCq#U}G#pZDApCt|8a1 za4d6Uv+sp1>oxCnw_y13sQupMWuAfe`@NCf{8__mpY-bbs^1IRy<6YMb}FCOr1od1 zm$B7*K3%Uf6q->T$Q~?ze<(;Idz1ZoXR|7Oy%l`g81WN@kx9EkhT;iPg_>9GF zW>G$oXT3zfCawzHNH$QoGL#<%6$rlxoLJ6RX=eJ{x;6(=Zm?H5V%%$%(K za7x71?!NAc2`1ze9wVwV!J3nl{ zE;a1NwngB7L>-v-W>LH%^8u3ilwvEyZAlGmtK}^EY#o70rz;Heoz(YBu~{6LVF*7& zT}MGSB1s-KyR)@t@<}O9utK)BHSpGlm8{h0j%f*Un9KP){s^tqpsJZYDE^^BBV637 zl*n?w)okp`x1DJC6O!iYJwcWtq$Hw*J`3ClJ(>lgAOpE?KR)3FA1*2&BPY7=7%pSl zdlq$v&hoGLO5_J7`(J*Ek{9M-#G)bOzccW}K-}#50%B)ZTXybfn(UK5RkTP!;BX1Rs$&QE1KyX@}J6wi!Kv14??-R^ucv?H$mftU8qwkxPIVdA{NW=EH+oJmQILbn+lb`$L}HR!|A7(MzQ9Z$IB8p zMXogx?q;bcb1kAV(5F?IEJNJ(}2N=_|plaHDOirAvq#u`<5{}Eg_AQRHZRB~%M{L5K8SLMa(+dfV%fA!p z7`g+EW$rhgZRllg$dl6yIZ`!3KhFR5b$tWJ{Vl4Q#M;oY^@Z=T?*k{x=={K?jLge7 zcf$yG%kz__O;ph5{UcF{&MmH2i-g?Imdu4?KX1Uc)L&9mLrg( zS-6>d=Ol*r&hRkL$%rzJtxv5Boy6f5-Rf$6PF^!Iu3xR}_SRf@bjNOvZ)wx5u0D4z zLCQc9+uI(%rSq~4R&dBT&NV05!TR;Q@aV!J)*b%OXD9jHPS~#M+A_hEh&DPztae&;UzjytIhN46 zWSmUpHle()OINpFI9?gN>z!luUZ^xKA)6a*$LP>drd-K>RsYEzTXYB~aD3!)IPf#N zE|bSh2cA)lYMWO9nRI)O{Yrkby)R_o9XLlCI^goMrkB~%@8a&uGvXz^+@5(fSb;>t zw61O;pr&wF01ZMngH)rQdyx9vJq^+;BChYocila6S|JjEfui~LAMG%cG@T!JqIPP> z{;j4aASlSwg5sB70YCpUX<@cTVII%Gx@6MsEMtV6Y=F}}yKpZCzEod}$B@z zcTW*AcLWx_-IOE{XmFtCwx#-oEQgU(VQqf^Av;p|@x|}vgikK2MCR$$j6CjF>`%!r zP=#+pi{TM^+O{;|4H2lHF%nj=e~GGz#SrK9FKm>%Ff@Q|9NH(3N|2jaDhLL$M$~2clp-uc}sxm`KYmOyt5sG!#H=#8c)E_S)Q{9Ri%MI@zLFe z*TJ~Pf3Vg*FNNc>YU(p(cadqe|HoHt-a=DL>we9I zc-@Hj<;r*Ybu}O3XrVs5Sh?`{wuS+?tET-LNnoB6D6c!ZfrIc*F2FMk{bLKw&Ebn$ zxu&SJG!iDc%ufOkx)3}`0J>qjWt{S-fH_j1_dJ?_WJ{LD#(p2Z#pIcD$(`ybT~^aZ zA^BHhQ=)>cVzuqbfohNswpt zB*D4O^D~Ouu2QKxv6630E#jVSHA~q|P{nc2O$emi@Wb8C%gQKL?!*_PU66gH8ONPm zESMTa^wf0WhW9A2{gj@0Omf(`)H#W_K<>im(4ullGg;!)*(z6n&JvSc&w!&&VYdD0 z7vpINt6AgkDAm1X?Ja-x(XekrvBZXpH^~Ten0FodYA28~d1J)HTSj1=-*%_XX6<8u z$AMCoqa|S6CQe2_&!`{Rm*Elm^_0Q;AzWwadI}N?^K3t2c0E}duqe#vg=`OPTfIHy zygkpi^FCqwpn1OvawY})o^(A)-xLm~m7aoqG*@K|@n-c1PGMu0 z&!JBlms;%`7*FY?MyP^O35QPWWQhd41)- z8UU9S&eFQz2t2He>DJb?AL^VMUTh6i4uGO3cR;3>n{U03vo2(J6_<%|hnj5~x57#;L9O1;Mkg~F^;*@~J<8hk`A%7}G}u8V!mEdmzlAcI zm+Z}JCX!wYx1E*M=0Ry?;z!^=_I$k!Nqb+Y7V6>rj%$vT-$)GQ-Xhmn4oHIAx*Wt6s;0 zEGinWp1w(|&DOCzclgxKFHVD?fg?%8EAcC97mbFBZv;6Kfj^rPni855nz8?0RI={oh_!AW*zKD2 zlhV~mP}ds-7v4aAx;@dS&?Qv4l%yhFm5(;XTpSMfil&=_jr-2SCuCeazXuB^8V}=yxWAf(Mxh8Xm0o!b=5chEp@PC!_9# zZ<0!QRZi#}9`#0dwEXC*pv==Ujn{wq*WTjLPh-mL(_FT&p-obN{!x_K3=Qo9#5%8t(C{0&eVkUNdYQw-0^zvwSr#?4JJm1WYUo;A_ri z5j_s*4n|d#SVcZX-D7+ix25bD&M>Qr*tDKn#s(&N`1}2bD7$cV5Ov>yFEII+t>~kH z+F29_ndSAoIkVF)c2k{jrIou1x9P7Y^X9-CV+y~L>zc(MCJCiL6?sM%s}ynFSs~XREmz&c7cSpyHB^4I zvI>3`*gdbGJ!A1!U99X^YwL9B%*y32Jf_D}^9RBv-(1SH(cWU-vx>q9BqY-5?+(-6<*E-6`GO-O}CN-5pAUNO!lign*R4Gd`auzV9FJ zaOuUx408|nIeVWSYp*561|Ozb3chO3q%ye@&8CY8;*9x^YkE_dj7Lb+!7!gQg>06m zSd!PkXB??CmV+4D`){etW)>FQWTSi*bF>svDYjxsk3V}+iVF*O!LzSF;*+qulL(9K zD10;iAyFt+q~K_Lk?^p3BNZLM^xHB`iCTm@ks_V`4dPK3<|d{?0k>j-0u|SEYfB(-mY?4tyg9W>TvLycA@KXb`gt9ywx=E#rVfvx;MGl?bQdmYupCO zyY%iAt7@MXub-=CEDTqC@}ZPvhxNF%a&omd)xJ(pU(MdQRe{QMQ+!wNc+Zw%K8sX) zSl?lyxb5zRJjy;uo01Fl>hcpVDlhB@8zlp$?qPp%@iiZFd)ve@a+T}MufN^>ulYiz zm~TcsjDkY^lIsIeafs!PNSf%?ogCCR=j7Yz^!BWV3XwP|61WA$prxb?|+685n`97 z70TE5kEZN#;`L`B6%}c={JfBhk6jQa>a>_L;b8aZO9?B&T=O2OdqF27PwI1T&qHeg!{t7%MR3%!sc9wZ=)ix0{bXI`^V~e!l<6p(vQa8Uq5-W8N$Ql zCmmr%+2jh_P`)6nkSBlNw18JQAWM6et5^^-hPHoEaP@i)LBfbhq(-5DnM;^&*T7E- z^P=^+#;-J&OEdc{nL6gkQo$cdlsim;i#%raxHvjlQgbhu#Z5FIOe_k1mTUl3FHE#w z%z^wUagW-cQ)1c{W_&Q~ieUSSZUHm=Y%7E@JeJJ3w0DU}WOhOtL9#k}=F`cDSS_FFKX&2HCGh(0;2 zGC^+xgOhQ>8Jb~e>QKJYMUPY*i!y1oFx7-O#aNpI{suaJ4L8mDo3eG1iUJumqU_)x zV{=M0=leVJFJmS{t<+)PSu$~-?>-9}iHr?o`)VFydfZhMw$k;!xyDuUSBN~Rp{VxJ zN;5C^F@X|Rpgui5e`Q_nH5IO~g=u;L5?{VVihU+E3}kPNGJ=eU(l#_C*naR(A-XBZ_aqUw?y#1r+d?55ufBi2n;UWjrG9U!d$oiUpS-i5&Y$kDNAvgY+kU@O5nH3X?IB zI3X}W-V`JuywRE<$rzTPtj+(GKGD_? zX<8 zc`oVJ0Sw5t8&@aG!gr;c^*kEv?Gf^Fr(RALi_FtI|zk+st}T$P83#%U#X?|#Qg z8ZDIwbBH7l9p`a#-x4p@A+@#FIVQ*NpdGsMeMuOB4!73VoON{|kcgG0&Yjn}c&UZ5 z+90Mut&~loyp-))^9b*yRV-{&D2AQLD%32zsCu}BK{S7!-av!uj$8|Fg;J;|&wSx= zNr9!6EJDz}a7nO;fnK(Cn1Yr#M;PPJOGjgTgVnDy+PL@I?gNxh@8t`d_p0eO6poNX<$O8l8x zi1l$)L~YH|A*}D(Zb=H!Ki>Qlm$BNMyf!E|lWt*}w=}d6sam3k{ z3(e`4%P$)IYqu&s!F(IVVDd={c#cv{Mv7N3Z%ePOqH#TDe~DaO!BhtPYJWHS6*sBM zm4>D`tN*wuR9aJ|ry{+@AZ;+Ndrbr-K6R=oQb+um_{ytN&40ydXMKECSh?y{$L3Sd zrG*sn!=oZ>C>YUS@+QkMic!G2i<_CY`77Fn&a_$mew~*2mGDPlKDk^e&kDiaO_Bb) z5+7$gH#%t8VWVxnt-OH!^uz+0jZIPNPxiLj($hIweU*|s)M;VH=|38Eyr`QnCxzrriV%SHBEO2Fv1ui=HN=w}QRMn@$5_KKI( zl9V2*5v|@kH@$92q}dCV;@oiJjdL%rG8LAc77?>qj?%}C38hXpu3+=U6#X#bPzGtI zpY44UYAR)&+el7BFNyee>m)77bT%ViC*C%|UKgg5g;LIV*}T3N-DrEBrj2K1kTcf& z1~$kVj=re|J!}=a67I6U#<1GvTyc0uR5@$jL?BI7S6IPcO zQ7}?E(WE^N*F`50%v@dsRGg}R2^LR2ubRi>d9wq*{3o(p*6B9zH&iy)=_PG~L_!P3 zKViJV`b!}}md_-zycpUa-;utA20TBalOf2G71KX?tn@U6f;E(!I>n!fh*;b*kiIlj z${*%ykdTcSp%aut!sWi9{BajU$Pum~xitWWN1opb^o7Ddvoj47>@Z;OmwT7WAgU$R z97h&RhGQ_^|8WpoO`27V>^(01J?c7=ykqAbgNBGQ$;;sHPdKlizqUjDyw1tK9Yd@z zf#@X`inkCpaG6&oq~Tw4VIVTi_7<6@w?3F;Qf!ok6Th-nUqBfnbX(Qdo7K_FwB0lZ z4K)x=&``1UbkLRL^$XXk zt^7*yP+_XmD{*LjQuSbL9+pAgm>Lm}!rs7(KJRI-GZfbG+o=6gLdvY{uG*S24iVFo zBjT}3-0-h>yE#$=$vJ1<@gH=+G<=ZYmWDN4du z@kbH1k~{IhcJu4fzLbks%S3`1g1HClwddv5syawP`qII9N^#H^d_y`INmGs({t}I8 z+D0GKh}eFb!{v`X(Y`BiVak<;I0`m_8pfgK)#;V1h{?tBy( zA$)qr;d}V)ja9tkC%dy4xIV6>gf9^}#V$y4sq1IPv`f%Sj-Q&pECp{WzhlNWE^w1=q zU!{`ASNT`phFlR+cNGt@is+I~Z*BjrF&t66FkrR*jmL#P66eR+km|U5QLu%&P9;BN z5<1N}HK&$!5uD(_sYNc{G>U)j9@W9KDCj#mE1g$WpPDoj6M3=o3a71&X1>GPDely9 z7$fmK-MQpBpZo(@Q9&eW=~bWf&=;qvQaW%7>=s%Fl?9XPLF z5bi4YNl{QFOA?~?suIlzQAayRM;UJU8JYc%a~5LZ76;=24muu%Ic!?ayX}1oI%4u; zWbnK>TK0BYl}skr*jo-m%_w>LIGyHk@;XasaB{%pauYq+eqSLzFpPbgoWM4ht;tb| z^PSZ!`{TK2XjSPF`{n$E8F${Ip40noBl)s1{o!?#9-oa)jDbq`V7AJ-2+D+x7jb9T zpgv5Ee!eQ_z%Uo{&RtR)MsJ0-YE{OdN;(3TmegPYP6LrMj`(U>hy0Z0R&4T(=i-;M zUDcme`Hm|5iN?m-!6lKyzF+&`72wdC1rJsJrqsvGX~CkQL@a#XkpaF?i6f!?iGQMl zk^bOLF^puY92jFiM_f$e57w7fW|1a&^%h;Z@+znD=_5}|Q<()SEDNEv)PybZYk9;n zeHO%Z{GiyG8xmQ8StrL{(#gcP76FQsuaBKOU$STCax)x^I7jjPF_0rmc92I?XX+&+ zEXOXT4KnaM^~^dIjP<1O!xhOn+;$mK5fM@~6!aNV|LmDj$4#b^-pK!2e+B!p4DC(7 z9l2e;S&8&g$qx*qkJ{o={qihEnqy5fmf3u-aoZ?j8&pei+pP7LsF)UIKIe#iF;jRK z9?mr(>1Y}#>clHJ*tT*y19*VAcBV5yO59dQ{t$4GnM0Yw_}t(bKU5lzA ziXpw_u)Zdg-jJL4Dl}Bi;*wJGSmkpxr@by+U5CpCTtGdR79&TW!LnwHm@LDDK#7e* z>^lqb3=j1##xiYu2i@%51Pvr0hWq>A3*6Kr@~C?g>*`|#r@Blw>`~U(`NB0x_i=Jf zd>e*g`H?kdH}(XaRBGy`(7WW;C9(P(q#rlxZFhTLvYb5XEE~U9zQ}B_8L1;%Qu=Kg zA-Pb^a8^RQKQ8O=K=#9JF>%e~fA#=ExSw%ZpbX9+!pq*6o@yRfWu)??nkgv+)(c8* zLILd8LD1HV#QKbb-_#WK_>I-8l=}uu|jtX^2x*|utL5*fWY|DFB z7P$>=5N2I-1-0z+GRFAYG))A9?iW3Lu!9m$U+0Nqd$HA>vj<|Mm znPi);K%{DYZxk<_H&bb9fM+r9XumwiVsl!P$}ST06#6TDl;=W9^!A(J0E3R%pQi+nfo!FO=D9D{aM=2My7hDJDNYQBvj-!idI;o29Y=^wknC9e=wuHGL51EjdG2pzG;DC@{c{Ht1 z;)eVszZ#P;m}X&lrT-F6QbL!tcI@Rm)pq~vy>;GcS9u!QG4`MX)xB??z8YJR>VQq? z?sM@*+~USFH1T731JUL;*oA1;i$aoVC1qh&gNbLjeyWei`mbl!H_Fe=7ARtm z$WYh0_mXHYct6Bv?TuIbpQtV>CsI3_0_%R78uM9dKyNPvgp$2~?`Akoi8rpdR*gR1 ztfTaR%IX*6WbJ_+K<_q((i;N^VEz~_HH^G){Kh!=v+Jf4#n+&AC|;It80Z)Lo+;*Y znn-*c_jzKLOrkCI^8WGy%XUuPq}F1duIqmFtj<`{SnDEQhAYga>oT*Up#lG=@p_{L zR` zmJ2n0KEIQFO10aon~o)u>5PZt$OG18-Q8RE(kxQgZPo;IuL0T9MTG8ye{r^VT2d0` z+T*E9JwUM8$)Dk|Tkq`i1HdgWFQg2uMBNXH%psNCX44eb?I&#R?(P#TkvH9c9wC<= zOJ{djwrZ|*KGBfje{`hly4`}Qs$5nz)@^g7@_E=MIygInD24nbIQ&T9Gy|=C9eXMS zK39IDAKbeaZx@Fr8e+{C$efcU6_Ace5MIb2N<2Pfy=pVdPj^BPAtW5p8|N9LnB|<> zJV_DFOvG^DzNpVh9q)+6mK(Y_M@=;x zS3Sy4NTuhd&zJpTIpn)~9!W%Fs^XuZ{3msC0rQ8m6#;Llp*ZS^m%D#~I%)R!2PSp# zn2&riwSm>-LliUSh@TEd;M5kar;7Y%Qw2xShd#Yk5Qiamq{76nVRoX|`0UjB8WC}H z$x2n1LT*yY_7O@7V;qHsw;knK8mnuxWPxbcC3TyKAQ2k8`+kf^V_mwMHD*4wN?kq4 zfYK@{r;)CE{DO)S5=|^F<2b5O1!9;ud*C!_LEA^fCM(ea?J1U^**v4&CljG0BB_5xJnb~GIO_ko=6(EoJ zb^dtflMM_h&JZxo`_kXPk>&Yv_v`5QRWbkA_e}2A&0su^gMxStKt?>M~q2A@mS*Q?Z zQPsNVOMNePldGzEJ-PHj{+%Ob(p#44itq7QZ+;V6=j1HI$j(ut{C~Lbq^~+BW8Wj& zh9k#X>*Hz|(~U9oI0&J?^^=Nxmo~*cyvy<`h^fCr=y{?}b}AxOxw}4fVw8s630I`8 zB;9LN&effa0crDLp4CjQTk;VBL|1eNA&;!|f(UiX7ZdSD4zE^M$uAaBl?dLZl4RG# z@MUdH9)z;s@5a0+)1ow5^RuZJNw?ibIODdsKso_hu$l5yD<- zV#m+m6iC^-Qi=HNFRihTR_(F6HQna3Y<%tmXtf`SC2#Z+k&gJjAsvZwCuvf?Zx=C; z0qISc=HI^Ca=`Zr^?In_Uzn@F-$HqLd0pMy)Ef>W15PmLg<3LkB)>&08^ z0ow*;xK1{kud}Jr?<6v$uDPM1#$jLP?*9JZ=qSIiuyD@9roxziB67yiwxP}jC_03_ zc^AdWc;H4@WJW00S#x8&IA5tb2v8-`0DZvx>Dvc+^tlT4UjG*e$hURffX}UQZ4d#A z4#?&FhJSo~1iOeW;W6x87ICW7Guyj^VuwKjm!EUZT^J(r6Hb}nY|vlPz672XX8z>| zpFe(_!;fHB#Ez^@O??HFvF0c-qSWo!Z^tO~0RgBc&Opq_&xqj6o*6hy1qL*D1Hk|J zFtQR79$utQ_TKP}tQ?(y+ibIi&w8;Exw`_?pcKw~9Hw8i?{K*zQMvn9S^8JSV#>WS zLI}G<5!;a@b8gmWmaa`8yksnJfGOS( zf#bLrA${rxKjjvtO#*uwtzv>%u4v%mvb1CH`fq#Qkk#o>2{1L!>-zA-WO0-43wVnNH@}$vgKl+#c!v8JX|8W`*E;me-%0KYdH7{b+o4cDAp% zeuoKgQ5zW!-*MP`BcoKV&%Dk&wA>F08ws28XStQoTF-p`+z*bi{xKirGx?66<+=s` zonsr3&3a|1&FLsK&r}Ntd1Y|YYBnJ*H>o#S;(!ITT&xQMOvQ)8>^je@d?JDy<7@`~XRTUM)!x6#EdfK#Ox;-(0V;-heJ)0b z0*e$k=iS6m_1%YHlyh20|6i!bbej34oo}pg)!$AIc0Ca6s0Y$!e3z-?3|@DR*4>ZJ zTJ!yNwBI@RGc>Bdsn>rx|2^)L1=`HDAkeYy{H4No(>l&*HdPSNbqt9%Ofu|XA$MWT z<7^ku?U`a5+(8^$b8|A$pW8vm-S2q%Rn5OK`n2LOUh8zE0%T>L!oX!6rhy!U?WQ1$ zG@ip^b?3Flr|%iV!AN+wn4Lk7Z`b$QuVa@VwfPGc!eYT(^VF$7Q{So+SZsTK)?&Z#;g=LP*npKOQk zoGU=ey0?kdcmy5uy+$86Nf_zST7ir)2LdK7MEC|+D<-X4&r+ksB#YHI<7`d`3OVr$ zBAE8r;` zSELxL#Y+X|h~Y;6|ZQsVI50=1KP29Z9^pzK+sxF1cFp0JEk8+N3wL zNnZEYCzh*i7`}y)$y0N4Y+D@_aA{dtSxXN+kay(-yA8~c%_l#C6W;J(s<5#x8!Xv& zSEf&+u@4w$wQ$(x0~$8pz;bDk*?pwB2j@AkJ9Vqp*bzPrZsNan<3QBvz^kEu!IFBP z3-nkuuZr5((1VY*0Rmdyd2JUU{6_$+p40QDeI5AlAWnxpTVOCyKLMy>eoq3)-_=QiH@29Va_2F5cWpm+^O=;{lE1~Wj2 zjm-aGyLP{J^9(SH@&oOOg*GP|U|u~eV=#2J>4 z8}0L82pqVmrY4?ArW58MzQZ>VMMIR-fs|o3h`{5=_c;OWWb00xr0DzmRhM<`^mon$ zbwY*gHz4~+<@LCR#yPt$JMQf4^aRFH3@kV*3Yo6^;lfVw8iXTBx=$C$AUx8?h6N|( zvc=I%^5a(o`kgsVn|?cdh$n>vA~{U&9O;q`0qq-jX|3fVQ&q=>1Q!<<@?9NJd3&M{ z67&OqCB)R>_e9#1kr4ZgKC;=6YD`l3h9iYK=?`}-K0aT~`qf?1tF+-XIma3!jN3t8;H`Z9lwOedD(r!54O0$~`p7(#=V`2yYkMw954 zmef|egP1HFLrJ=~#uC>-jxl$C>ke8TG5nJr;JO?R5-vOSbA4?3hwCz-Q!Th{8(uJP zBx(W)VRR{TEhT21Q9l0f1ip)KeX#=U0w$`%Y1!~H#+2oA zDx>;@+8?5gKmBw2HjhcUVnKI#nRd{Si(LlOOf!j2SR7oNS^Nb0*3h5>Xr;5AwSuLFU>PX-oJbu3&IINw z)ckwJs5fLGPQ{oW-^QmC?LwUp6kX2o4##qL1{MwwGm{h|Bw0_%bnU~weHxy^Zk8jS z;2t(XoAn3>RGW^*2nlg8^ui#!rcf2e&cjK>f>IKKV<&s2fhE{OAjdc?Lq8)8N&Y{AQOxVm-%uX;e%{U!@o3w(3;rXN!fqe3SltE_RO%d0OrXz zf0-u}|Ir9~{*Ojb&m76xYEuOnJcN64DZ*F|34uGckIhj@S!DV>EkPbJaZ; zt^=tbk=cjTuO>_8z0d=54)brirY#jRsc;=aHOS?0kgc^O_b8oRCR3`Ek+ZV08GkhK z7I=l8Yj@*XP`4S!i>V~ZD)LIdce-0kB+)<=!?-Sj^ zAhV-^tHg$<)fQ1!Qd%X`KLGr!^hkZ>CXR9R36y)&3x^Xl+JiEM;%rwP$`dR|c_nW5 z_#PaD*y8DTEbRsqwT)2oNY|FFpEfK0kCf1lq6+8OBwDa}QN;e^*RErqp1fZLJsUPc z1AG(9%WDJOPe1%h^o=Y_Wy*419&E!;OFU!g$6Sk36-s-yhI2yTRxe01&WKZd4%lEp>08pf&%xso7C7-NO^YgmvJ*xRe%>XE%9tXB zA|!Z4VHGOX}URWGk*6+G{vNF18>unbd{jB0Wu7ej%)Mz9j5;4u!4hWbCp zgHB;r7aw3c{p02Y)EqA_v;SoDqVQ)JF^TKy5{-j;!pY4#$apA|M^OYQI%&BHbrTYkpqPOd0Ijpy|#*fSKo zuQ4!!7_Smm1DN`9L$=*#TiGy_l=r&OKgbd5M%7G(y$+EIe#t_>t1@{)ht?)|oJ@u3 zVDuI7_h(i?g?C>M=r%0G?N#c_$Ha_DLGOI$sgsudFnPzH$1{MWeKCG{`{N`32+%_WOz02CCj8qSm*3x} zkFgz_oGdjyJnZuqgA^1p8kEXx!u9|Zt+Gu($rWnF^KuN5;{4skcR%u1-1akp|3K!x z20`23eg2WqEf7S~3;?_fDW7&-BvwQH1o9B)oo8Or7&IyjAiV%eFg#D^M1NvIrUnhF z0`xy2PeOhZQhb_`|M-`U{EZBU9|L0R`2gPUQQap0a!z66$6C;7Dfd;f-NF83@ zqBz>!hdQhU@Fc_KMfds#FF?Yy@3f zC@}BKtq6LwK}H}e^zd}kZ349J)ROx1qrudyDi(q^M#G(rd`}$#UDnX~ho0j!qa^ z$;>5U@g}@`o^K?}q8&m>s-UFg^piiRtrd}#AkkNEsA#*#CgnzDnl-dc2!Ec)9}87A z+NL^zBs^4Za_lZQ)9|a@fHI#^KjG>kPu7|Ug;i&szJfB1U+ME(>1PzQCc_B^6^@@0 zbedk3RpsMhhE?IK<7Ehj>2+i;Q(`mGx=U@q<){P?N9LzsBMDU>+2MsG3Y%BjO-x{W zTj%%W9`!4!09+t%q?CBaP*Q)A$6z*QvY=_WL}#Hx*Kna ze!onWg7xi>z=BB>ChvL2cMh*miVn#wp_*5nmusv*RhWMRI3X@o9k<<@b*q(@*Ck}0 z%F4Uoo|^!JgOrSUK=m5*aiD#{G~e7@DwFXmsH6F68+X8l*7<>)(-Y*)7n9N634*y$ zJ((_R!%+m>t{`O{17V4N*Uun&NX6&0^F}Aj>sp=AbpzU;SPv{R#KApW^8aDxznhHa z00s8n;LP~;w?q*MDOQ6KGEj5_x&Ol!R<|ifFzEf5@ZYQR0rvqNAilp2%5P8|CssDw zkOCS1!zK#e2<&VwvLEEsQIzFPr1w6LXuPBk#I{jFRD|@`?;s8TmV{N?ncT!lX~2s` z#qBB}h7C?jq1K%ZWS&VCMB4vA1(MIV2SWCM7?r5&uDz2cP%X>D_q9$n6swA?MJx+0 z627hah#D-c@4KIHj(frO+Pd~bE=!7KR0mp+pqXte0B=*uU68hV4mA2Iu!RWuTYhRF zNj$2GqBN*zBy5G@eU*Mw6`5bd)OUj#T$&&FrG#GLGs3IqGTKty#u;*7Y7o&sOtL6F z)0%&W`1WhhAXR%Lyk&n6lagTZ=j|7X&I1m%8NO;(S)Phl&zq3_wrAojBz_g54W7UJ zS~AD?*>)lU?s`|%9f>A5NPblvKYAy+8NdOEt0Ij%2?8 z^*!jHpj&95cJT|SrBscLd0b6?WG7QwURp9g0$Nttb8{p2U7+#>RgxJE4Orq?ph5_o z)p{Abfulm|Rz(j2TEc8sbf<@hTfnbUumAq;0%dAtwF`PP8)+6*u?PyGc4DBt-4t=; z#^DWC+ia22x|FT&z?NE+DQv6F)f$H$79C?%N-s4)oMueM076tZ5G^2&M7!Ka@0M>Z zDev?xFsPKuqZScY|&%OnG% z*zZnragO;2ltt67&RM75znme}9&PkXnJp5*7b~!!37Y!nHObG0~sn5P#ZnIRl5!5D9J z-(lvRI@H4HAN&I+FgzfsPFaB6kwnf-Ea{g&PP7$7TAsSGY?Wt0F2zR`%}Gxbt~WD9 z|B5K4ABov)new+x?qub173jnrGf+u#*!!jre(1UNCVK+}hUM?O zA&rhD*gt`|DY7nPpzrWJ2h_hnMaNeo&hc=j6jYrUL1+4J00L@(c3_uWg0d$RI0y2I zmU#|K@>@=tmR-;LvD6#QF+kxugwQ<{q89-8>Ct>$I<^V4Ko<*X&RI+AK^rXRlI%Y%6So>Uhh}~_P zUN%9o*rJGUNgfo*p_ga5t!S|AYYBS2{%CaEp<4#ZXdiM7P#g90@ex0M*-K#XGhZfY z5P#*O@Z}V1!4U)Tpa&IK*7w?0Jes%OQAg~^8|VGF)7S%_qT;nVuY1AlxCrm#{2#a5 zW}ka@J*tULh<45DO;Zie6)4XuLPZhsjsV`xuDow&Pp4;S&!Hi1@b{@p_b5cj=bRm| zK6U)6v@r%{vcm+@+G z&b*HKRyI+?lxLip9lX1-M4`7aOTAFZSLrNTxuuWuLY4EEmGQe_ zm#wCzz?}?^JFqiv>z>OB8Fp8?d`Q(jL@{6b={k?;C5`hpx=N*b>r@H^{$Ucy4}{9*>^L=VsU}V z9XsSe^eRC2@ldtL)u-9KafJ6~rI)??w{+J1%6=Vyb9mqO5?w_9xs49gAKFdUjj~!U zFdKnr+e6SIkkT#?e4jrLSMBh}0vCdmj`u2UylC28&h|hN^(-|rbJwZbV^yi!rcgnj z0sCiTwO1tIBa1IO*t(cPSUZn$(MzMCcb|;laQuOKd3pJ5Y^?HSOho7h0VaG@Jme}v z!&F$2tk^!r)&oM1vtGJwr=oeiKH6Tn+nGtpX7<{}8tu@S3ghUy(C zZ7`izHNKM3v_8R0r!8GEq-tI3vzZCwes3kIlj6Q_%8a!ehX2#gprMlPm z!J29Tg(yhy0kZ*a5W%i}YWL%E_ik1DDbRVsTy82=DcAIlU?RnbUsf zC1|FSM2Z?R1~ktfO&VH69+{c-0N|T(KvObC77e zpim|0{>%!))7QRm`5$aJi0QHxTDZYeD93)XAOn_$Ggr@{z{ z{v1V^xjzidsYf<@BQ9C1<=~C=L)(*|SCQ9CpM4L0{j(SC95#ce6+`xyg2|F~-Roibg^#i_Hv$nN<2;OsSx*810X#bDhZB4qsk`HhV8 zgxG&Mj=$am{AV95Ppm5ZzmFZn{0~+C=L$nOq8>Zp|NfEX8+Px`tA_0RVbw^-XCf?s z)e80XqUitc8_W17)U3agl3k_QoAiBR$ekF*n#{=K6cHBw{_NF%-}>(*GV~ih{`dMr z2~#y6eXwJVUZeoCmFe8lv%ahNT(WM6N@2vQ$L*TP6&W50{Xw{Sj%0=S*L2m*50%Pc zS$wIpe-`XTa3_wC!lv*M5sDS^)i38h zZ<~!)x}){Vgb2h1>`t1po>vxz#Cyj(YZT63PnKZB8vf6H%1R=Y49!bnq3>a+wZs|+ znqQ2W@uIKo(ipwNBe&gJl4|AN4%>dPR91y8tcwwl+nA+Uh)^!vp8szDO3HG4&<(d+ zC@WA{oC~=Mhob3dn|qJKnAQ@Y4QLUa{2XM!q4kR?!#p#|P@#Y%z&qV}EmyOi-Bm?& z!hC9+fVz>Q%2*s1FI$@}Ly;emSCv6^%`{a-2Vr#Q%{Up1j= zk8P9mVq4A^8{nY33F0H+C=_zR?^Wqi5D(EP@k%~!WW=E%8h(>Vz80LAbF%x)7WouY zGS{bhV+P$jlec76kA38%{jEZV=H)Q8GOd*5y!I<msA&B|Ux)<|K zaU`8EoZ5OrS5^nUzn3lDyj{;^HOM+X;#+fiD++85y)RP zQ9F?tIB3|NI~Y+9-fcg9|_Axx6CfHk&RMU zk_uoL8G4n@%9y}HF(S2M{=&r`X1UJto52Uv{+%XvCn)L&1E%R*4ZC;awKbLjwy1Hk z_cZA6@)?G|8w-7-jrDO!U_WX z?zSi__PV5bii${+_hvAVkwZFrSGS*Wg}Q5&EL_37iPx*uNi9hvsc+|Y$L`f$i!S*i zq2FRoF=bV#rGR?zhkyHvrh*|c2bj@XRYG=xhwwr7FkAIBzXJdgHK3gzpk$gV%_rwn z*U?)lzaeX^1p_VV#zqSqizd49))aS2+foS*H+p zE*h3|A>&}4rpd5A@eIXTTI|m0tKuo)OqI-;^|M6=N4J82N>P$JVrY)??SI@})2BFh zQ)}a0g;xxbjqFQEZvq?W`cN*>eoilY1^)_af8mRFC9m7KfVm4(eGc58+h+U++L_x7w;>!&GkO$ z)KFZh@1SE3B8Fg&S}+monh-3X*P8jffC)F4)*Em62Cfp7Jjp5r_J*08a4~PePYsq1 zvpi-B@B9eG9V79fob{r_<^z@t)<=E<x5*s$*1aEk6Q?|y`N>W~Uu}Vc_PJ8Hr*W=l zKW-^Sl9?RYa9Jmf;*=vocYv{eY+QwVy&EoCV7w*Y=vPur#Ue391*!M#?sPN;?k9A$ zt2wh7-t;QHb+uMl)l&u2S3~}UUk))eB0|3~^j6K;vPXy(!Ej~1%%3W1T!j%f>CGTr zE~rjTLGaM1j@utq(NAewsioCb;6ylJJDM?P#XTVj>v~5_swns0Gp%W;@0X>RP_VvW znz50Y6smB6n%dFoYLhk(^E>2cTP$x!72-_AV*F29Bm5XfYl$OXZY9u;i*5VbDx(ix zXjPEnbn7I=7Q#<5P^?SPj@tgjkEca^xt%~eDz+WNAVr0Ft-*rNURu>j6}+ceZ{->PAB?z9rKZ z>pC*FPwk+6#kp%*(@GKAT_;riWFNc3SDok?t4X4(5~dt>saZl&d#V5R*6Mt-;Ss5W zfdU^;i}dc5Xs%(|o24_%G1h}wUcK~>;b69-QTFsWzzIH4w3E8vAj1ysYmGdsY}2>q zP%7hNTij`U^J;Lgxj8A()E%QNOFTC4xxj~%ofMtKvUa8D1C>GJDe+W}!7HFPZY;po ztG6o}K5!dddu(FZp;V7)xOQs))j3_@bkcGjE8urJ-`m3}Q)hUU{?l+Wl75ZUMeRPs zU@DcyU=vFt`2s)tnm*%vzpsar$CS20xJCnJpfI z{3{cd`@Y7FNUuM)ufw;T|I*XvL|aFz=n*=^X!cJm1Wd|J197y!x($!Ve0%<=JSufT z=f(1Jg9>f6pp^(t$WmIFWk>kfNLkqo)|w0^)5|HO>z>B*BR)3RqHRSxwm-bl$^#c= zGo2W4B~=`HTPjB_hfK>_GT?4Uez9w+(cf{`U#@?oH$xl<2lV9tCu~RlK@D3pwtHfb>yD(^jjm=JaF74w~ z<%6vUbRJKxOt}g!ED18dhLDz7+NgBeKTfm$JY=m<$#&*0R&ipe3l;F;AxsWl`%k*~ zS^UjtAf@;h*06ZXjQ4b;_K5$p0Tu@@N-VKanZ9SyigG%Irx4?tOo((MPnPlRHp8)K z>%}Fi(>gNs<}X??AEUs-X$Ny+HwCDk$yIZV-Wf>w#ONuv;hAhx{NIE|mnu6=(Mb6+ z1v@ybwnoZdyKtKE$FJZkE*J*O42cM5FXiBSaEKz$49AV|CN)*Fo#Q!e$wVxnN)@-A zW3dSfC;cn9+Tlo$AQ#Pd(-SULnt}%l7R$VK_gpmoD4r>Q@&`We8`vVZYmo-N-(|5} zzs-&m_)cWZ@mdK7P51PStT3 zW9+S(I97^UJycB69L`84*${~v2_85LL8bc==%B*7uLOK^85xC9CAu8mu8 zNpN@91Pu_}9fE5k!QG{Cg4^9B&wHNtJLlZ{>-HGXgJyU4+H2RUHLGgwSbhr4tz?6qmb`97yl%8v?IvNhIQ^vm`dV#Fed3rf4ti! zccM&udqRq5ulxNDlh25P@8t*6Z2+eC)13Z_b+3Bj?*?aIbAUa1-Q!IY`(~*Aj?sH$ z|LwDP=l4eN1SbxCq)q;+V^n{G=yQ`!b))%cwY`%F^E_Ot8QI2w%5#2~bnsUdMn&3W z>g43henOD9>7Sw7NdGf*cDzWONQvQu4-sbODcRXOslA9hBR|J)Zcaxg16!T3ZS!bF zCB!&CD!s`Jv347;$6UEEE+yI7`{$3aUA*f91j5JclV$3i?oYL zqE3_;j*!TxH--bc91jl@nX(I|ElLpz7v)9Z00ZG+nIXy@-@G->_`=7>)+O6GEZZp7 zsFTHC;Pi>J=@g<+ZYXp^s~a3qa_%h}$b?C!w{tPIXDb1-`%m!Aga6O_{pczB5{67=^3l%oPve3k zl8)sHn~Q;Ib8JasNat^y)|ka`Wyj0hCb5<0Cy1L@EiQZQE`r*R7((gQE``L-(Rx!6D@NI>+$ zGtdyByO^2Z+M%KSd7pN{zwufIK~SWA?I)tmA4x$1w_PC=bR9LP#h>;u;hd_eOhvUu zpd_5$FF=RvPV)xz-1Z!LMB7fK-6vomc_8|w{CLsjSo90;7r!!q6Kl^ZM%n+GU2n94{l>Q!msLwk6S&^;yBEFp*Tp$1cuZCN zMh-k%TQg*ZBC)*z4kAg|23ieS^~GW`vnZYA8w&`1juX^m@@!{6J8I|&z|ba0;@`p^tt$pwmPD%m2;1C7 zd(aC2F<$h2U&zB)P=UzlU{qO1wNH{+xq_M&_*5^fQf_JECeVkY%F0B+;3>YMzRv)Uy0@{{=A^okPy!57V9DvuMOjC zEXkCF5`I~?vjJqturLB~VGL~4)bTK2L>=41>=ba_1~7j1cVE&rARJTSD5+SwO`jQ| zRc@@SGa$+?ea0qvhtr#q$aom|wG^_BV}tiVs#rRZ#=QAe+9}4+lhGxK-m|;gMfYH8 z>&}~XsBn)7F)GGTWtB_&mw@pp$4HL6D^6_l0vEUQ^e~O%%dJa>cw52OQvlJE65jnhSs9y4zWbHx66Ir(aQAy z7NXsvqQ%nu&6Ya8q+jGGjFceA%-%W8eu#Ub&061WxqM#PvGG;~I_tQ-$c%2w)ilXN z2{O!hiSmxjTvVaT6?7`txtUm))dtMNT*FFak)f;@^;(*U6&gu_XaEv?J5&EnDkP3z zsGI>t{>K|i(V)}H{VJAlDB-v93(L+>r7sV{+Akl(UfWJ--s;jvhneSojG||$r2DjA z)_V5c#waElI;Mm-Lf2-pJS{~+tUf8mj(1q(pCC^3e+F^Z3r_A>BQ%a8eJLyZ8|jo1 z^SR41>YToBW3?WOWdYQ^K6V_~9T;5SbpDpb5K(^8-2G?Sn%Ze8rDB3o_2J%7X;&3} z6$ND#j`p772Txm3=};wxi5&Hx(RQKO(d z!?ZW+gZrcY>P2NdX%ep+x2kPl7P5GAy7E2;frnf8erd>7`mE%ktcVM}^JRr+)@i`v zV;zo^_Yh7p!KtgJj9;=RpeLI^Y?(qa+iQA&vL;v{kz(!0YFp$zu=KYq{E#~jw~#x2 z#u6`R!%##|rr`hA`Sum5&@wQ7yRX*2Pg??eV>OSM?{`1%=`<{S%0%WHNixsp-<*9; zFY`|RNUt$oMbs(teWIcDWz9Q39$7(gX>*ZeKklvR(T3Uc}G}| zfyE&!%UX4TSK8mtJaedC0D7Mmoh+PHx7d_Thg|CtJ-_}Xz(?{qsGV$?o}qb$7VfuL zRSr8leM7WQx9wS*H`oUN9SJaV4)Z^ z7b%RYD|%OoPTxK%{y<8TjlvDjN9tE6!cQKeVJ?Vn$AU~LMnFEIs@IW4@74sr)e8@D z^%_re<|bj~pMTuusdHb2zSTZH@9j~OKdS;ICC>p+ z1eVoI)_C?``y-XJNb zJ7!6=qgO26ZIEK9Zq<-3jxq_ADIcH+nw&p^%K2xWnUSc^KDneZIy%b!KuYEU&pi0O z&te){1}3?Z;*SsBGd3e#GRxE|mB=(P&p)Q=lw`c6jIt8NV~s$cpeO%8?nk}AA3o)BI-I}^A37NUM3C_@1~}*pi{qRG z{0k&V!D7-9NeY7$J%j1nb>ZgQ-NMX8bnilgUeU~E@p+Ssd}h~Clf*$agN@oDIH&Z+ zLf*ad&wsCs#kza-8tZt}T+CnaVQuhpY=(_e&>=D@=6vafjuLLa9~28??TC_f^=B7P zsUr^1OlCES_V0rfWp=6z8Q3Ia#k|*h#gbv{q+PvwcJP|WoVcfHcJO%=pf6h*8$K*H zjdJgPdqSDzhT3fhv=S9984Y{}t~^-l4OC9) zI$f7V*T@oB7_d;n8OH8{qXn*Ye?m=Ksoc*b@bDW1lcgUu>)w`bsh{e`(<8$NK`9!o z-j+bq#5Y+}ehTbP1#UrGU(klPN@Z*_k7f7;aBxowr29A`RPo*LHiUYsvXPh(8HPMA z2VXDPz&1)&>k3IcWs9J(;S^|0;Vnyi+CuvqL-H&itg!WKvJ_g#bLU%wdj>^l+SBFt3RtJz{8e4yp>#^@h#tk8vn#+a$>uab?VChN-+_!|dITCf{+ zhupY}I{`MZ`8z#3+nin5j2%#AOO4g(s1cy8t3NZSjjF!(kJK+O_rdx<3Y=;TiH(}N zG=@St@kO;C+kpzFI|tUXZvM9IwO$5h`y~2MiPDuC!Plns&!O6-8^zjL`HnfZ;kJl+ zUH%kgS_ho4NgGD^@3F=#FKK8An?8A-<8?tPu8se&{aE%tYK&!;YYmrm$OpDhJmOA2 zX-w6N?npD`@pJWhs^7$|eKxdIgt&!wo&i8;x4`X?NN%R1WTryPd;Ty(YpS!K4E6!_ z9_xds-Mk~dhK5q(jzVuXp6z#1=vH07xndFm%d*md^>`9o$k3WQ_LDI8>No3v*OCwfcNxDZot=8u)4 znoD|Lt#Riv?tcnVyJWt<{9J$lXb*-PUpA&Zl5`e3bB*@O1-$}6btCeg7Q^YL`E#}@ z32+oL;!V z+BDWef2zuJjLttSk-L}3Y?#d9d^K5Qdmo5|7P~cb*|SETn=85FepXb-eKJYau=x(# z_BH^&U2j5@uLlS~N3Is`Mz4H+E+e=&EJqOz4<}$J%i;YWRh|iMeAn;5_G@*o zYc~D0wTEDC{`%yha!Y$F2vUpl4Eq%s(MEXo4Ik0U9iFY*VNW{KP;FwB_QfuooBLKZ zLDMCI*OfP1IyNZAx+^G^Hvsp7r$NW+zO0-t}lpS3>Tj zcQ=p{y%EAY{VwyiC%m@%umyMc)y^yX(+^Ln%|s6fj7`VTHAfA>!Iw|ym-j#il;6U< zTm*Tw@^dS`Wb5TC7f^x^tFAo#wv27X!aH40@yUnxgV�UC%4A1v`R|eImL%`IkTK z6kf*CWrL;1HQKPHzW zb0N>heedjbW4p!RPSUndJA4-2Wa}M^`HS|Gf_~cV9i3J}L#{#|JxZBt%{PaT_U>gX ze4XDXJB`thYnf|#7oQvG8eYIS{3~|W>24)PcX=OcQ9>t zYyRmOlhMj+%quJ3m#K(0o*FMWj}VQK34Ay`nY^KopLP#bke7p8yPyeRi9Da^+#Rmf z`5lw{a$T2u?*z|Dq6q^8?#fn!fG=2JTFGr=0#@grhcX@HPg)>DtA`xr0~T_@nj9fzN-hW z@#^7tH7a<9W{A{Jd!?7~ig-QWt}*hm)|1En7|wn2j+lUn4Hos{T3@IsWf0So$7?mc zX63H^M)2f1*=~a&`w1 zw|D(%(kRzl`?*os>D5VO^inlQAbRP}ooLAu#;#?L;{eHSqp9Bai{uV)zS?EmfpBfz z3^OaeTv-|(zHnDMofk7l8{^=`u1A`Mtx&mr@81~5tF2dpy^E^#r?GD|W)T&X*xfW;>$3qjH&W+!a^6N7wy)jS+B-8$l?j{NMha z+R1dnV-RzW%7mWR!d$}x*1RJ@HgV+kRGp=^;zHQGn!MwJAYm}EP&eu7dTR+Q`&G;5 z^DofB$POtZNxMr!$NG0Ndb94Ip*{6SE@nIrJnqj4Ud}eg3ox~$tUT?iH$u(w)CcQ& zswcweUB~)v#$FMcQ3dmy^rKua>ayImw`cpyE>C80jkQ96c_lw+xxeu8@EyJi@3KGk zCotlgS(z(zx{=R1S^47HwPJIo$F#kz;2S37zGm3gd3;jPe04ti*p>0rbH~$dTh@C1 zl<)a`^m5SEB^>7u)1$EVRl4lPI9&otw;^@z&mZn4iFXwA;Csa38n1)OPa1b!mfe6a zT8CLY8CN)c9QxXDkD9Fa+ZSZM)P;PO=dk3@W0J1x+J%CgVXdJw zQsT#qpQUzf>Gwa?_I8_k%bgqG20=I!0-c+VPU3U!3MbnrhT|HKM|?Ls$kYMf?-z#< zeK01|-La0lXml`2srohZO8XVGj{429&V7}-d z<1*JM#d573Q#un4e_t8T=gi@eNIKf2DW^FRK;OO|B;drf*u{up#Ua4x&CK^B_bU?}(ISRQ&*D1-3#3rCUw`2Nph&d>3mBxMP`oq4{a z`(o4(YwNH7Wo7l^ZK64i0Gyl`+62w#n=7j?kna*+Jy%XUf0u1r?Xj*27oxd1-H_WIaKJe z^jL`YHN$vj(Y*ueQh}_$=L@v*ban9gRR-KWCztQ(af1-fQ|r}` z{<`tZeZ6s8dn98PG zW6XQ=?>@9x=RJSAsH^S>VPHi0)HcA-{=|1*9)8u?Dd~355r5Fq(CJye1l`-CQ-gi9 z@Z@gmHDt)h_ts(M>|j3A>0t3S|Cy$i>%rQC9d8Fi;)1&yxTNu>K>g=N@aJ=G-<7Od zQ@hlIA&LB2JRzJAnTT8XrB{ zoi(OI>__y7TCW~yAakL<4^sz?PanKaqrg8^nYK^wJQg4N3Ans&h}~z_@9vDlN-oR1 zeABZgNA@2)%bM<@8!yYcbS?{A9S_@xPr3~az(kjL2E!wj7_+`tHZ69?hb`ekJNxxQ z9rDK`i(VtPKF;t4DAl|4yiU+LA|KM3@;UJ-6q)$5Eb z_n6!I$a9ssQk7d=G;XAM-|rrwoGp(&5H$V1@H%j+KWF_sgx~U%wqmyP1-Mkr#9wB7 zV!$*#i%_4FWp(jl6+=Vtj*sFjwaMVD7Fm=cLro7+xMqlS7!@SbCkG{H^En$dGDB|Bu zLvJDJxmJRfi$);83yxP1==qW@*!hmB@gvo73i5e(G_s=`SZ|c;bFfgykp7(}vhFi} zP(1E#9nK|Q-AauASPo=0aQFFE?p}K`&GxwSxiGUS>*)xK&Cr=gm%LHlZeS()Y6<%kys;QzT@k`cR-C`HM!kAE_I>9~9}3H#5GTPMrND{mSRRYYz<%l!w(P zp2Yw(eYWU%HGrrk0E|!p{A@)>yl(i%cf&jG$NtRqS4w3MCxLAYNRS~nlgO1GJVIovmc$*2rsSfN{HWFBKvSp(TI*%qp#Q4W z*nKdJ$hO7GwuQds=zca^yz~8^@BePIl~-5Fuj}d7Gm^djC0*fcsO7iI(l;^}i$U%Y1MdLr*tys$o8S3|?5%~yVrIC{)bEmrN zlZfPjrq!TCy#@7x`VfLidU}fNg#W!_LSw-${boXUXwsZr8VhfQpOK}lk-xg3W#g7B z@juh~tIqLkK@ITAn~Mp5NK&!b1}U6TJ8N37G3b|~Z^|WlG=12-FHT4HHS}ZOi7CqR z`n*g!Tz9`LPG94Z<}R!600L?+s(0`mC3nh{QNT_Hy*4P)Y8x% znS#=WtF~IK`75?)tIBrM6_I}I1Y>sf{k#Hrqe?4LymC!Na{1HU9HiltTl2bjM=r;i zFq-J-;xs%48pv74m1LCadEJV#aocZ$LP2wGSwmqUa)rKgv83po7el=l{0A2~W}4k3 zQq(VgLU|(|$k>Rlmi8O@F;mjLnEZKhFSkR(qY6!*GkJiTE?6spIYcehMf#wYo-_Ha zY1}0H|C;rW%C1}7ALl<{{VHSkk(8JnbRn`B_|;~j5Icq4;|)MAayG+$G$)11*I`tq zjZ9&ROvW_nt{Ns;YUKA$V%XpYB?k)JO5~0g{GIK;XwqllnW~pzRmDs)EUQ!QXCsm& z79jjtv2;C!vku8HPKkSTV&sUOwC88Gm?>wu@e;NvP99EO@Np`RxCDA2BAe?RQ4-I9 zy_AYZgAdFQb$@&cv!4+{{YW)HlfaqH3bsoHXj*S!Ur9t3=e~#{(B`$6ATXKD3eS9( zjvW>Jsz|PMB@bv`5CwU!R!H2NT`6$P1fhjhTX@7fLTagFOm92qrNt80I6zD}b=&cuIR|l*&x~{g>B|DJDyI zl@hFRW(wDm>!>e)I8p|xIFMiI&nb)NYx80)-{l|m0yU8M5D+Htj0Nzibu5ejnj2K;8klkBghA67~YGeVZZVV0i-Zh0^LzE_4X&~Y@bi&MslybCa~h~G z{4Sv^KpQW8x7p|6XIQqc4jWW?CPg5&TASq8urV46R0y(>s75MI9|D<7H8dnfNu;Em zuxA4Jqof?ZtF`8{)(Nw~hhn&9?AgsWw1paK$FowF>Bk@&O(4=+wJO`uKhChLMcZQ3 zuQQp!Xk+%@l7iG$ErgaPzmv$ZAr`jbbnD`9WgWlgqUbdqvD_Ay#qpoi!TrVc|4JiM zp!y#)G6PSbavbi9T@|QCoV|Tqg~tW-y`)W)3HMDlZ(OlklUi6IRXWz>RMM1dC1mdgdZCt! zAR1)=N38-YTgY&>0m}pg8^QLCIa3w46}HaCW{-<~IFQ6vILq7wBof!<_MjSD#5+DX zJUY^#N~`v>0y}2=1rKPW%8O}23KS;+X7*%GK%DYY%yAae{#agj)kF>%} zvQt+jI8Tv-;uPQFhU*$N(!cBasf!U%?_ljuKTxM;OXyN7oJbmJnW<(yX>pzMoRh50 zs|v9m35!@fjr)SYMUQL#&7w$>2O&b@e1k}bmSrx;(ZPLq>%nJZ$I3dSH>fwzLPz#0 zl@ypN$Fhq1H$HDM`k*ul&!cNj@W6))F1MPl;_H0>E~+;8LjeF4F=_scL) z!00WQw%)+uIR!XSQ#rfNT+0~F3$xYD4u&h0~cNeH8;ufF;8pd~@&4@bGggzd4ZNVNd#)0Shz) zpc(=^+{@2oRB~iF7E%_!G&OE!oe731-i;7OP;^zas@^FRHAjgDL2dp>ex)9f%e7$? z4?Toj%HS+Zqll_JD>zl$>Xs`Q4U5QD+mi9hU95hIytahBM6fP3KIoa7OIZD3h)q)p z4(yn&Rv%h#&7_+IdvBQPi4ud zeZ&DxP~QP!uY2`@&rx+sCXF&}r-h1^ld+z$C_CqL6jCI@c!S0h+jEg(b5SYg9nCCq z5)=-=KaMRFjiWbrFxH&xWHFB8_FL@MbinW&l>>OAaIg;8?YJ$8Hr1wSoyi+ zIQf&+D2}?>Dp%!j#Dd4fHo!qD;%~r^_?3w1`X*YdRMO2ry8al zYZ9sfpvgv{k42H{q||Yr zg%ga`Ew7V2?qB2cNWV|uyUvOPF?gR+hGV=L>e91&uYt@7<)HOZm*{}%oiqZyZ&k!2 zz&T4CJ7%CS%D|}e%(G4RSt7IM+C|cB;?PE-Axo!aT3I<+1^f2EfIT_EY}rNlXO3zM zEPP!zz~4Y{;CQmrt_9p^af9R@i8MZ|!N*+({1sO7+Np27?dpW|G0U)lV_7NcCLlg(+J*#Jk3qTza3 zEr$wAucwca6!B${u&h~=TZwWZqVbej>R(DCG-B7-V^h_h8>^f@nVgimK-@c;z{(g+ z?nhQ=hxavPw5jN?Xo5Bzr~BZM(q*RlSd;(_5_pmIftE^C5)OjwFsrye(oSX)nKuM0 ze7%h<_Fly45!8qwlcg<%1MC$>i_s`}L)&4e#5~`sLVW5KQkeME#1Q=uhpuMy{X6YX z38jKahp-nI*GUb{BKv0525pQ0TP_enJ~8K+E%W~p3ehl0O}fL1HKrr7;)e)q-D?7w{E4)-@=8)X{13*)KrMHOsz*+1lu|y?I&WZIG|`8 zlohFeRj3)|e$ez37b%}3WB0PGm0oq2rIND2TSCT!Y=WPQ6SrJroSFEeWjv(c zR;)2r70YilOalA?2zMxN>@c_fZ*?jqq8=(xIsY&5QHbP9%Q<~{0^7fUq5eo4GHG3? z;%U>{{AM%Y5LUDhpz@&C;J=dJ$urq3b7iQgn8-TP53w$XTmzB?2S2MmOKwNA3JFah zx$_hrq-3rYkxTOMrkP8+yHv?;PY5}3aEcilgZ?^$-oMVEDvFG1$SIB*=I$-5LwEu} z+Fu|lGd9G7aZf^*#0^r$HQ&-C0;sUUFhNQ0lj7~-dH^~lXR}P9@x(C-t~0b_M-4%X zM6gGX-X(vqL}BCr)1@}S%zWSxa7@me!U`9%=OXl~g=K@N>4%Uv9|k!;~u>;3bS z>%nN!=kXT#n0^Z)nJv>fRq{xrSWM$w{)mT4+bLE8 z847Qy_Wik5BeP=-sFC3pLTt|;_xB;6H#fj=Q&cSj+?{2sJNN`%UXrYLSaEIh#dy`Z zhQW=_;AA2_JyvC+A+J8EQ7aLqOl~_Z5x?}tefM?sUg_Mn*-*jEYbPgLMGDxG*a8~rysF^;(d_%TVdr`;nebnE%l`;6J-=tsfZ`ubzkiPu3Bixh$NKVL zhv9b}KYcY@vU%E{**5v|n)D8KjtZW%81@YOcXM_{Wm`mj)Yf7*hYc%#c{A z=0qVjiVcT2Tm`I1Ky*{v@6~_3d0lriCagzl9(@>|lu=ai<69WjSaD#0>(eAN|6_n5 zC2JJBhoQN@yZ6{;EGI-=hxH!h-^tpwz+rSmjW5M_Xf8`cGNVEy;5xeYAvr>=XWekQ zR1*3ct&Pd`IT%s<6USnhV0l)Y4{@X1ZqybM0i$K|vWKkExUvRwjMRAFq^JZkDfd4e%?ryO-*(p3I}YLr_8L(#eWi$TOmWcSW1VP99iq6A_+b z7conT(P{-dPGG6^G9D|`pc*QZ$5$8_W|QA#A`M87E#UXD@$MZVee>Wf5{r1$3tsLd z8lF{>1aY$b zG2CfI_IL}GE}1<0Nb0q*^_U`gTIoSWmSOlNEuS(K)=>0FMg)t1hQ|Xp6afdgCHAq* z;e7lO(ughhymT^<|2Sr;%Df+>>Fa(`#>rZ6gJ86e&UR|YiK4t7&F`uqKo)jf)=vU zF~;9?XGD<$?Yyr(VVhX`%VA6emiB9qa|JCGUo0tSir66$1^uzHNXVx+tN*sClH4Hp zbl&3Pua;XY4hMnX3^7MK5G6y?c+-m2<}D1EK+4j#n5x36+b9jqvr)l#tSrt*s#9Yl z@Z(ZAy2w7^_@9Xm$+4o@#_-oH&jk3;s7h0uC9wEvtoXj}Cznk)Ey-NmjbPC>nM`o* zqUD&u>rRe2`%7swJI7cRRuW*6qj!!0Dr{75qfn=HCP2-Ly+a13IyLqI_EM6Q?9SvO z8ih?V9<`uUMKa!5H9YmEhe&B);np_ssu><0_J4?%5v9f}C@xqEL7%p!A8M;|DFL+4 zsN#Ejy5twWT7G{|$tk6DSRknc^kBw}`EQ>Abf%grM#(C9^JdxTBcSc8*A=Z{sOwr z61if0p1a|iQ!~S#hPvSRP6a)9`9dZ5_V#f}K%V%X?jFc>C0_%RbbqNJ>9SJ062R4r zRndCG0Q?q*!J$zH`!RTi^q6Ax;O(fx&v;sjr{%c3VLJvN;ygtsy3m}dIt|E_eah`^ zeth9hvP9Rl(J}4o74Fg)uXGk^@{4yU`>|ws{`Qbk#_z}iyA_mqbi}-WA2TSxnpcIo zKG;7t_^;btPdnrP9#I;RSk=$Hg|DKjtMtheq{S^VD-$nIHK6f1=NmqyA+EZnwY^J~ zPUHf%=6tg5n6tBjIEpLAIA)7%oLft_USaYVy=wHw?^{-DmXzaCRJ5FGWTOUlOtw$+ zqOGsRqZHKX)Uh@&Mhxs_W(c7X)Oq`(g#;b6W-y| zKO0IzC~)I8paDe)h{*=89Pf0(5pRxt6Mez|@O!f5@fLFJCHO4a4oD0~f7I3<>h6A} zAaL=PoSgh%r9HbV7^R%|5TKdF=1NAha&q>z->L&$&I>4C04h29CxBdm!|A#>9zOm} zkNNLiEe$3fC`rL2(p!GIkw4-J=cIwQ&J|8N01O4~{o zM|(tL$6wg~lA~plTKNoP#?=~&nzm!`&bZt2?j!7Nh{f?E|0qfkKQ&Dm>N@RzOoA)* zS#Hb=5G32K&VHaTQVFx>M0ijAcKw6?ExPY@ux~#wV?ux)9n|-dk_|uzeQU<|VTOrk z=~-^;xv9k~|IXqC=r1qYFSOfxo^`i!#;JiBPWbWadEaLy9{m1o%qRq*VH9s8-eby_ zI~8$sf;0^&KITmn`9^wJ3ntfMmzEpX zbMEDkeNl4Rp2tm7XP8#mb@{!zJ+>=NT2xqMtMx=yW>M2oX@S+MSwHt(EoYi+d zXdy=mnbKiI@79wng_LlKdGFw`@B`QjIL5^>#|F7wX>8dRnL0` z?99we=c{-9QmOT*Muh*%zP=aB0D{;rMn*=S)xkqUU%$9KT#&S}VW_RGeU^)hh>lKf z@1uRwRJL)Y?@^ItvrtzF=)hstuK@q7sjX$W&jRlN0=reLz=VWoX9X2}Nw1SyKn8B} zEsW1gDx~;s0i0xb#G#5GCJL2ttgMy^0rt$Niqf|rbAWQQn?-$~7XP48_gv)a#F?=~9fIhm72 zi|&zPq;Nr2@|kgcgMr4 zi@N4K#L7+zOIH-bsdpUQAvV9!!%@)RjT-z+Ql$=PpnvW7M^x8VX$PFW18DUDLLIsL zmp~U51)nnvk#A!hzN5~(tz{oI7Bv<{LZk1OcsL(+Chtd4Bu&2n0I0$2xBXjXr-8gU zia45yvLMj@kQPnAPeW&dA1ZM*NMDV_$Z(29c~ePZrHpuJCAhDvala(tiRQzj+91{B;Kz{}zn~_qcU+7vy~2u9iBK&@sK~;U zvBhuPTb=z9at(*uB}?m<-VLJ^En=uaVfSUCWU5BQ1Z{9vy$M83ekVEm2XNbpOioUE zou{vC8WZ2)TwGir)PqMxPKVjR6|Tp6fLOk}TsF}1Vr3H$z=O)Z88$E5bqEwO)IIbP zlT3puJKQnc+2Q_rw*6JF%8L>Dxo29*|+NG_b`X1^gVx zJZx%85|XDPm`WB13_^=yY>xVlivKx2ubwIhd(Zr(;rwhRG#)Fq?&z1`bD5UDHGn3lEe1UbP2CV5DDTXm0i7~gGP{D66Nh#$!XGP+Ej|D>nd)yK(=At^L4Ou$ z=j9Ja>=gruffVkyJ@*;_b`~P{%~-43jNIH@{)=DAUi-?~BC6%q4PASCd!K4k)6<*R zL3S$2%F5JXj!Po`#2H0Ij0Yt`BbBv2$i|a=PoE53T#~#56^xBH7%FYgZ}J0o?CdQY z!bhQ%xPo^R)C=kN{Ih!CCp33i=(~>Ml$R#3bVqm-cn{QIDz*SO(tZpxWjvc9DBdF?e z?X<-nU1|a=gLkka2YE9GI-c-x(~$JOu`yJkJ3xotX&X^8nh0j~WUcGD%fYjlQf^UED4^N<0tnpN9)yS=s;b5Wq{E)cFPLa25sfJ62Rw*NfvUL@W54PFFA>r2dMbe?j+5n94sP zmqYyiT{dI;Z!Yue%`!@#lW+CJ>x`eiw`M(^eOYk3FkVQZ8L4FRN$ZQs0D4FI(Yryt zH*yPGZqHuFZ%>H}{4=l5zjR=V{w6H`e*nOzrw&;j`!tS?1Zf4Q0}4KI?+s3Qi!d-S z?&q=}aN$shHUZ$5n0U(QVP+8qZsQ*$K0u0l_!Z^)yRnX1@Nv^8QK(UW3%`)@?2ai? zX{TiEw3WfjQ9b@ggm!{}<|etXYuSAtxDbT&3w3FZ8bRVeX`F_a|HSQ!CW6E!r@WNxqNS59~6*!(w%XKl-4uy9A-Zpn2Y5qzPLPI0YA&x29jL;DpF?WuNqoR;ZMYvXx%vjn?@=EggAju6i1 zv|mz}Xc7U}s=b(7 z=jpm0CU~K+*dB^-qnSmRwXIL!ip!MXX7E9vUFo$8@vM^Xk^(>Agd+E^d@Ihy#_ zVtm!vV-)*GB+S)k$CcaVAcg)KaxgGV@x0R7xf@c;2^YOYM;2_tqN$ck&bmES+it?c z?>mQbe@*{7x%OtbuYT9Xh@zjdrHA|JiZEA5;OEIE{R`-AO5~-o1n9YsPh6_LJ$nj(?`a$@%@ZT4ro@YfH*d`5a{vhuEbo3X}XcseOv13*P4FZ)3UE5!zBK zp3)(DyLcRM22bU-msbP1i2Z;Zn|N^L07V~|kX&7>X*o$nJdxiqkX>|VJtHG7jDxhB z&)mZ!&CcgM-Rr=ZSQ}m+3Q$mU1LQzwn_ZdsT#t0FegiK|-`}-AT|JFLqwv2M?V2J~ zX?HtaH(eN3zgec8YP<0w$_596>sVC1@&>-oLM7DbQI0a{~ELNrx zXJ)SnnNhmmZz&44=&sF85;dms_|$sG?L3`s12s0RH!xm;D`7VKS_AUQIBncRW1IA% z7~+pRyTc+O2q*c(x~l@k*@tpIbsV>|(;7qG+K}1l@AUWHdx{n2hAv6>2U|P&P;Osq z1C(fE!0K>SBOP7ZUi>ZMP=nctK}@5L_xFf>k_h(*o^czw;zzbcTaR_TK3jD!?iTKG z(jm69pS0<*fB-9b(blf6jh~P2Ly<}oBX|c(=HAiBVKby%5NEUARkxk(ec2480AFBz@rX5eBc%SIUOp2q@qaxEaNf^VB4Dg=zRJ8FoQQ+*F70* zps;aqn^s)m9WO0<1V2f4WM!_P4TvRM_ppodq%i9E`wz`HYT2m|tnHY?a%(aw<&F{? z9Z$;>&Aka_>(l6;pfaYYN*(l20wGAuwU;J0O)A*`jMrlbXt)gPA$t~rcRT5X17xT@ zi;n;;@3vs@&c^e0m;)LO?!58Jy1n%PdB7FIU36{89|r z(UXxI*`hnz_AkGvX~q5Z>lgjKJ|h=&G_ezI7X8^1e?zGLd`+d`1o15TD&WD419^zN zANd;x$C`zPv971_iP~#R){=DVAr6)BqVeJf1DebIBg|fv-S`+=?S})JTKkr>b1Fl+ z!a^QS48#qhYjEc0IzL{OKV7y86Sddx1$ni4IJxicL_@;8R|{=p)g{cY#~b;du8L@U zJPd>G7WM&u^7$e0v#a_Cn<;1D;-1A$O->$#3AVcUae?G(5W=;>@^Y=LQkKPBpZb}Wci5LW7kcP?iZiVliE<2IO=WLQ zx|-Q(+{CTt-px(E16NdXyz?k`$L(+#;A~CW&7u1Lg>5ak|6<$D<144*)+^vrmfP=+ zkwy^yhF66z}kO=53=YieV?F^#TA$r|}3I2=xyaMIgb4s-bTS0EY4u z005l3ezW7G4&M|*g4_1*x9R(9#?5NS%1#|)VzJ*s$?Q~ol6(eH zjNs@|%3zV{*SnE?%_&9JEfI@efrlcE;{whGdt&s%F0fIolg0iCtDfFX>zN5nql^Tycnm0F0Pv*$wXYNl|QQO?V^b~9hRFHKM z^3RR~9j|$n({l4iC7C~pR*b6OEJ;?B73^Qxj0hef{ZgO*rDCgp?`?~GDRj3j5_r?z z>WkqD^U%VgxEZMvYwVK6MM>#yoFmm*9@Ol&WwTi()8MH-1};nDJ+dxqE#4xV@x>OQ zZ~JC0)eS4HflTx!4L84;PG*<&U78CmkRu`6aQkWzFifqhYxuj^>5TBlEXk=#kYhFK z+Nf=ltj&$AK@VIg)nuXzZ0x8luUruZW<9lMOj#DiQL$^W7_5;qWUAi7C9bpcRnlQn z{lIg5Xgkaja`Asuh^%{4HBh`=5<1%|R9q2A89(^xkaEVXo4hGx8P3|~o*T%ALwBia zRyAff7q*`(jO&0pT0u9I%$0$TNw4B|KLQ24`D{mgyfP)OTNjP(nCSm~km~v*3Y9#$ z7-*B0L7U=Sv(yz@UCz*$+on^*XUc-kj9udB4d>>j9x%Q}McZjdw_pb`(YFfuN^JH9 zSKib(BZb&<))mFGUSe+Yd*aSqHLwIg5@B?OwT%x7?z71qX)JT~(p2!91#tudciz1+ z;pesPPE>bXxUU{QX2>{ry}h)Zn140wI}<)>EUS;V%k1#Njehy>^U z|6%GapxWw!c44egTHIZVySo*4N|EC3?ykjMihC*U9^BobNN{&8?(iSp?|%3GSs_^~ zBxj%Gj65@Y<{6l$WjRhb4C*Cg$!!9cP#T#=Y!U6;++5Q4nQ9JuW4Hk8@29TK-q7Z| zHLnN2c1kKMqXQHDAaFvuLj|u%WeR|8wwJN7F-3YTkDEEQ_kp7FUS53fbfOOcmAVu# zr0N}4t^;#Dr3#c*90m#bfq4*IH?{1q#~GP8bU9yc_Tf0Eud+8O6Eu_8uNfBA>6`SY)ia)R0{5)Z78( zyR#`>j;m@s9`XQCh2z0(uAbaQNo$5$5U4kypF-H?VSh6Vab*rIKd;|UH5W9E)pSNh z)@G!qZ?&;;dIKOoB6G+Q$cJ~;dbh3@#+9Wn*ySvOKHokA4qVv{J;r^-$=N#h8^wv| z>&~k@od|e14Go(vshZBN49S{`&di7t{9s;LM)P(Jo>F<>@oR0|xpHDw?5#RCSEul2 z2yH|J|KlAzj9n2vDh~zLH#YZKqf;yGWMS#WZ~h{=K5|t7X1esW4PjHRlkHih5VqSr z*IylZkVp7-kykfEuyB-ObyazbIW(-VVPOr178jpElvD2P`)Pr_Tni*WcS8@}_aQUB z)$y~2b6YTI63Xz6(e?B+>Vg@C8n?G{|6~}5s9oT#$bF(S+HUgy^9SFcXH=>A zh!d~HKtF^Xx8ot%2>tk&EL>Xc8#W$NiTitk=k+J!b;F~2Y3v$ghGKmrk+P`6Uvfj} zYhI#2pZJm6t+}+=7$+(b^{2_bS8>t{v)^fBYi5~sRJR+e+EyDF z%ANPnmYZcwhnvj-n4!r2NXO z8b}Fn#wn%e#NzX>m`*W!SUae1?=cg;BFs1St`!JZ+7a)?C@d9jJ=;^uSLXj|a5J*y z8#|b)+mWH-P9I0HIX8aVNr*~ZS_Iqn1pkype$aB{5y&nyvPwPe0OOD^3ZZ#C-+Z-Mq!dgQ@%%+?r%&C0wC}@x z${O;c66lbG00T>iwFH;TtrhvpYf|86}6UEG>Wf26P&RFx77)XHzh+k84-R2h_f zJzLq@7t=%ZyWajx;6(@2rUCt&1=-MzDSm5Zwr%K86J8XrzV%-{fqQwE-%}{f@3tzB z>ESD;7(I2=7S1Oh_PM#KALn_^m6b;zQ$H8|W$k?}wT+h!V9mEnYR||VNGG<m?!gdT{-!5RP7zSGg)E4etwM-jglr6s*W%hdwF7XbO#Q|lM@%)S-I*tjXeHx zYMlAIe81C-dI^kl0Y9R>G!dEh1y5|~_V^JzPGGNnvBN38fX@A+#I~X+Z|*lYPnXnpv-7_L1?cLc?f0?|GA3rp@zd-x zd@f7gadg5g*!xMzg13$5MwYxiwt5lR6MDV}TU*8vxrWGI8Ctj{Dp#<921}7xli!2~ zDTwgPm2>0v>bVq9aYhBC4M}rV;U5hw`N!2+^s@KszWp03FfEMRy7#`Zyx>rXGCeRy zM%{riIx#w@j6PXh3yxSn94@MX;w4^lj8==WqiSsovY^u>(5u61%+?1yJ)VHXgfTVL ztA9l24l`?7!AFet^Q)ecb6GQNkua+hhAI`LIY)8d?++SC3#O^rSw?EIgslO-XGo6^ zT|a`c*D@*jbOg0%O1Uo56hGT`1Zk;13-R-ehS#J8cQWmmjdt$KMoo@Y;NB;Tt|#5i z&36T^X9-Q4qgCW4FI24!^fMUQmQ+BKq@}Kg*8b^f8ftKD#A(Mm8$jd)WZ02O`i;Ju`=?w} z%xhKq5&46kBD+t`e?FfObZVDWzy6DXwY1t0dfWN}(b@3ycvDijI__=g#o*hS)6x=+ z83vy3I{TfoDlAl1;FI^DL@~<%*E)%ynxny^he{8j{WlrWGxb1(B2z+4RZ0UXrl{^q zO2dqLOayAQz6z4QReH=(zqF=>_NulU#ICvp0f!j7p$bu6?%}5rcgyHp4z*2_>c5Pd zO-?Lg^Xw`V!6vQlq?jfh(TmdD^$QZpN`1;$xMVU?BaU`yf_4Sg%wA>CI2>}b1o=WH zn-X8Ft_?njYs`OF!4&`bkfAd;pp01hNfvUB9ln1{9hX@If_HO*NJKTM@l$%?&(kfN z>;CePkN8RG!XlIs0|QDTk(mEHaYQ5IYjvhLFa&}WBBBsIO%^>|Vb$PS{IY|AN|LnH z+!5zF=J?`3uFij_>=tTdD;A6=jm~6Hwo!=;0)Baye;v?367_@SzJqsv^Z%k8!K?LO zN1#%a-{@;_X0>#@{%=_bMN|ezn4we6#4wP2&K8ye7%HU=`5x$-f1**47hhC@+eNsMj*>>~=i}0xHdOoE^)~Uw6wJTmR5N}mds;l)@+1YJ? z8<~(C9!DOam^zd8JD0E@dWn}Kznv3`P-(*PlpiW{ z6QK>ZxhiKuN!7O<@-EKU&&?wzuuci~zhgbG2CC#rLxDlb zv(uv*^N-v}NRJUR`l`t2(Uaoos)drM4!Eamo}gUHQ{QmZ(b1Q|MRhG0Hs_jt zg>1=VnUZhu>Mc&g@%gW+h*k>7eTF3LU%RJ2HA*b_o=H1ers|XSM+U2c4!R(L5MH`B zv42V|JvTrW3EFAUQVmh5>95nFlWjx|h`Ke&%%fk8Xzk&ChgJM4~rGDoJSnJ1_) z=wRXR=!+J;E`e{lHN0apm9!jaW{p6^iglqeFTqEdMVH&@4{ddO02xBr8t0X(n)rLR z4UR_@Vrro^FN2dwwd3`llCnegsOj$=mcT)0mQHKls*4dtrlLd?n`lyy-I1YP>uAZ0 zUh_2yxG~d{*Y(=Tj|IeReG9b?oc7%C>>`uCe8#6 zcga;5o{wAByPB;;dT$TpLhXthie3+RtwQb0qJ~Y{CU--GpZtvLf2f+j{XtuJ^x;UV z2CWnkEon}kpIPhy{-r{VWvl_fxcBYy!1lI=0hfPr3!b2RXb;@EIzPABH!PmpA3u%u zFZtP=-=AfX|1dAfoKSkx!CeRTJsl;nzm| z%~x$k<`OHlbdk1_53b!4p~0B#!m3zjdN*uen^FW@Q#xL4(XLi?WB-C1aSo^@FqBWp z=7~j5V+_qV@)P=C8Tboohby|Jkx-nRTRfw+ob(9)e*cwrDFu-oeOelntin(08B}ax zU_$@P0$FidBocge3z0Z?D_?74r=Es$5hY`+pA=8T4_8!+tmmQyTD@c*I<{$Cx}qcH zeS$sI&LlN_`A;E^+D3)X1lKxSBhyro+U#uKl!=hYr7{I2E>1h7c7bFynK>k;-?YJw zh_?gIJcsrA<6ym>dw`lu?4?xe=;zTrGWTWTt0BtN?9Q6Fz57KoCMV{%OT2*2!Co7@ z-%}`x)L0|nsj+CJe}<%Eq05{7n`Tuf{*NXw8OR$syaNkKW37I~PfKLh$caM5dz5Gd z0&h#px@v|#d!Za_==@zOWip&r6?pcX>>-QVau?5O6h0CxC4!-C*)g{YOGSolsj>RD z0%M1{EbayzX3a=M);bM!=ij~d!%UjuS(6>qh#RGC z5vRrR!cS%fXD@@c6;X!$^soijU)90eeMPn=La}o;&--N=A1kEl25fx-E`{~Z7xIK# ze{CLxb7Q|+V{rU;V0mg@x{L0{aT(q^lH+|@_wQ1Rh{@#Yd1Gvgs%U@xntJRz{PT-< zd0vUO>avpC9GC|SKV?n3L*c@^^QU9O9k65W`)`l^?JOvgjYA9bglIu&a;X1{j^xBP zmdte{Jogn(xMQ2 ze5B*zc7oZoO~kh}k1Uok3UlqFYI;10XJiKFsS&XsJ#1N#>t|{zG6Kh6+PG=pj;dk} z6r%aOo7z7|U@?`~tQ37l688&R9mk?7;y;2Sy#;05`%G*pkSz4SL~~Xl5E|tl*q0WB z1~wLW*b;(=gZas@=?mRl4YuqZ4;ox}sd=8{I|ryaF(Nm*)ifsR4_y^oA=LRL49E?4?1&yKn*VG3 zvC658SJWhts+}2i6#*W6(IPf9zaMG|topq)PL`pqkSWcqVsD|+<4hgLw=bopx7&L^ zl-Oh2kd<5WVDC-Usx{KcboO*tV<#JQ>YLhau}(amy9^3{E-mfId!c+;Kno{94I4b_`ZB5aK6mik}i@m#v1Qu=tk zq6kz9@&7=6kl`$<)zi~>XvbSuaJ4%%j_qtajmpOFOaIHVERP38gnT~5?eM5kTgJ!~ z920Dki!vrSEM3JKTam;>^dWM4k!+3%>fyE`Rq(W3mNwL-_CqkpUqW~46RI!ah{NWe?fYmt!7m9mklC+u^Ck>?{!qb( zP{A1+H*05s>x(RsqN4F7B_$cYFB20Jzb5r^Cgb2VH@{jDrqw{KnwfN!?t~2* zaijfL{FYW$Tq_)oRr3|Kb3 zo7FM368Mv#n(x?^-88o03b9a4XCruRjwZKwbE~!y>TLw|w_~B)Eeh26f7b=R(&Oeb zvHDFPFbhB%wCLaigW;VqKSaJlDyo&h48+W=+vSQq9<&!ge~FH(j2lwV7r>q?CURYE zVB?NZkWz;DpvuK^jUYYPFDgnGJKko!zGI+gc%bb7J=!Ooui67`glz+w+kC!j5OpzApAXYZZ1qLQ8_&nv7;);Pf4X!l~oYx;NU_soX!h(XuF zzsE9lXoEGq5~O+1D+?h7J`|pC=jfDqdI(k^XQ#x4VJ305U-Xw7>$R2sSF8p!L2_>2 z*M?FO_bVHL6IJ#jkZ*X%G^B3Y*vyo7YM>1)qF^dbKEN@sDC~(5;2W!L@anIXoXhqt zk!}+z)Wf)JG_qH6WHOInuUCsecc`?@uMFh=uOo5qAkA!a29cm^1uu6TF40;c^M#k} z!y-4+^8O0OB8U-hAfa62m2c}6!KJ&z_pi%yj8>DHlIpidnXoBO4U znQB7QdVRXTV;DfE{17VcH5mKvnds(NPb?r2Ot^FXMSswa2B!zzVmJ-RYK~351z4j09XV zq8tC%Fq=a_tDHp0DAixth4IZFF^`z)b4{ldA(Y_kQSSIPQf? z7UxHJiHHrmR~Wdttf)*TzY^RgW@sT>OcfIpD!`mrQpr3m(3zreuZKZsRDXVMb$h&EL zGnj2Rp?F?XSJZ5)o=F4ibx$Gck(>!3WxX}vXy4<_wDqwsR<&?l_eQsn+4E6aA@OLj zqaw%W=g*O6!i~)=1J3&lm->D1wn8=pLy zR*@5{YM#T1W3E;*B7dHIdmBCy{kIl%{PN>)6m6$cqMzA?br>T&F&vdvZ=KDiz+sko z&l0ZC1zK5NpCUmY&s?T}bplqvnx4QOEP|I0AZcdj50eTBpfb8`_L;AdT8UHzdG3s^ zyn$X68p&uq2qsebzw!|R;|e!;aQ|B1Bjh=f2nAWtTWy<4X>nRo*V;p@N%u=H(QZyi z@pQQ=^(AnYE=rThx+yrtPFR?Pl zDC>k8fqMG_y>g&t+awGT=&v~Wb%fu?`55M6k^k6&D~E$n&XXtd@%t@cxF|w%KY#L? zb5+QiggQN0%x7g!H+U+1Xr3)@#o2zSTXZa#ocOrxq-WL_9lyHRzqUd$qlHkrSVfPI z1j+*Whi+H25$%>}KfJb|l1fbY7HG3zx`%}}5}7*RFVelSu3IarNyWGBu&V~R;CA>u zYDCNe7^sl|R$DbUSVmNE_-c{qK{ujRxKf>%x zM?>h#IJBy2ozXrV_u`bO=q+6)y&}>VP;ndYGt8pW?uJKeUHM<`(XvGZWV#l)ej&cQ$ObZtID2^3WLJB7ykX-3%XFA zrbD94a)g<-m7z2y733>T-ht0WF${by_CfpK2sIo@u)q1_ zdg86k@VgzM!7)4fb+f4!6ly3Sy$Dj3X(Boq9(=Z%w6aJ|Fzcv2VUf-5j z&!(r&;|CZk$Jb$*4Jt-I42JPIY=du30`vJjG4gn1`wGl;78fIAGYK@cGGR!nR13e+ zuf5ozjEs3)ILFDBJr{MQE?-7<>s+Y#G@X~yJ>Byw921Zue!8YQmaQvd25zX-D*gQ2 zKV0PDP|J^4jhj}=uQqL3kMU<3j{eZkhJn-(yF<5RXM)WYI0HqSDWWN6w+Uiu#o{Xy z+R$jGy5cqjHk+)}MvW*rQ|>G+AL`wP6txBrR^WKVKrbIQCpmTLeRDvIefFE*Z{vqzcP7sk-j+c_ipX~LnmO)TZ*`MHWiNESU(p4N^ zTM`WZ6m|@B+W`I<6>B3Zxd)?4A3gP*j1v*9c=gMHOc@8SZ+VmJ*4?;$J-@^fu_-2n;lX zs);7x8I_T@L<&E;-Q08vyrp85v1$eSWRhLHNN}^WGCBQJ>)0H$r>ZE0IPW&9hG$4% z3aL>br{4VOB01c4{v1yG=hKngMC_xUa$1&#SHIgc0mc#5x3_z%5CfdVgx`=v-F@oy zEl)2LUeyT=WrP@wattqp^WSn4jF+}5 z(E=DY;MI{FaSU)mHtz?KaMc#fVP+^?n1n$NAyp3;w7&eNWp{3;`7DXgf&Qe`b= zGKml%K1Psyp^hy7eK3&+*++pEd)$^_WOdeC6W-Sxcr4sUN!clo1qX~7i6_*YpN1of|SS6}RmSRl=s*Sm8+rx8G< z2K;L%y1J-=)=!@jO-oA5v4mHgPta49ldB?C)VfEstoY@aL6b1gu6dQl$PdMI4*-CF^s?tN4jVKmR8-O0NBpOgm=!z5Pr|T75_12iQ!~yUEyn$ zIxOr2Np4Q`i4jx$IW_5BVsr+S$S`9a%Awv@UxW6tf<-54TgJwoA5o1IALUSkcxM*p z2&~-}K>upw36(o^x^p9OttPg z_ic$`k<_K4*s@Ma=`XE5|2xG5cYNG#eja0>yzBdPSBzTkk#io5O3+|&a$lyV zwcb6^BNyN$jy_M7_I;0Dka1<&VBx&3xQY`z`|I!QxdG10+4{cwv{J;l8p=FfI%?oA zb7~!h!jKzm)c7lU&OW)dS;eEHqmKv(iort^{b*RS-b&V7RT3yUnJWfqbRY3h!A2!P z{S>TutGv@=2P!Hs4&kWvOtj%U$*UF<5e+V_b{As$q}06GeFxdGS8~U|d*cbfwvf`N zSTLv=iE`!XV;>l(S<>!LW!)X5X+gLbLEq&(m+%~WwzNVe2PA$RX(t;?#9eNoZS`)Y zp?0S2mVB1ZiWk!sL&4I5JhZUL*V9rw9< zPgu-1%eUA552v!>Hcq~%$STs0>8C0ZRBU;oqNQ?rJu9Y;8jggyYhbA!>w;cQINeegm^_p<_SpZ1H#H zE|E*zfB1DwEbB6-L_pr8hxAdiE7o&A&S%6W5LebPH1FW-SQ>u!mLx>Wd&tTw0qp+a zyD#UZ6{HtsT9&Ql44&AT@F+nuWv2#tkV*?{RFpuHg#}k<(eS;FT6y%=Urb}o&cG0( z>+a3+qLy2yS}P$ct_^H*7(~*}a+FYxgce~37%(iV;i&N&?mnZli9St9sK>vJo{ogJq1D==w{)dRGS@QCljl5dWRq! ziwSdN3R?b{qd&U@=WHo8kQ&}AMn7yx2Q3+*5OGC(rAd*X!Vz+QmON8jp4_nOceg%h zpH-WD2Q$V097y3lb4IM-U;8y&SvOYCST#)gdlCk!9QQ0YDRg;0P9sCyMT$RuuXktJ zAzB+ny({|{v>E*j_#7#uE(>~ovZS~H6$Mw)9~FEvGV6GDTGEj|IX%AEyUXzbCa4cx zu{F?=3I;|%CWIGc-%w`8yrKF_MM4432QDP0(^JPm)S1_e7jI%YaF75OKCrM=et_I;P zQ*vTGMW3FM#X2W#BpuDfa6UJ6I(dITqt1ur#Y_`YTWRdYCI+8clhmLv@?@sQe_N3m z9u6J=|3;XC_Rz1Gv>UTlU8;9k)4&pYUNNpsW-=Zy{TQL}WjAVC9~Jc*{0&*4y=(fP!m+u9*oF1JDjvmFHQ=9mV%8rYhF1W@A#pHQuc5$)L#p8b% z$>XOY8WOp?xk$1hmT!@It#rFnNu_5o3mm)l(%D$Ygu+_V_Y5SmG4uc$wZ&wH1ORIWX&<^yyIur-^D24sSz_L25F;Mp0uVR_qLy~%dV`W zN04gGM!neRGyEy;uG5QIWXIMYQhSuO^CWR{+nf;xv-|}TtOvExzK|`bHG!5N1A2F| zWsI$N3KFTM>uSyPoC=B>0HyjP0)EK8H9xI}@&U#719+h;4n@?zVuG#CnRr z_-|}m{F(a4Pc8RfG?`Xb@?&qkKSfYj7|==!l%ol7CDk{da(>~Y30}x&!&1<`MBDo1 zrB1;aTt80pNT7*fR_o&h2_ud|>}P?@<};jw|HU+}#X|xtK*t!&VL@1lf*PJr|Be4D zX@?$sY>!34!%=ayRV}8Zgg$2{zLV)LM}qCe`_RYMW+`99^B^!gxgjYOcvS>F7|Mfo?d-D*h`Aua1{WyT6Ifg^VzA&>mLxba$>LacZ zg{UL-3mz}C2@3x#s@yY14U>65NqP-8RGM+~>vvv<&B%=7;}d9%FODT8RBsCr^G@0~ zvZs4ij5LqPcU>1q$FQ!N%UPD%v~OLY^w@0I@N(~7~&?up9m&yEE8Z#B?5*Vt1M(AbXv*x>RvX^YE zf>ZA)7HDX9akuaa^{nsc<2+6~mi<2@M*ltSC>bkZ4mHvxrV2ZSJDb+-2Zgj^{6~lM ze;ytvF@|1<8b<%Ln>HOV2edov|KiaV66%yKWw<+CzWc@Vqi!*3(YnJphKqz`=%j3;Vzxsd2 z>2MqQZ+zzeJDUq&_%$Z#q#=Qb$^n7|Oh4-s7lK~ihtL@b8y`rD`BMVgMY-$>-5YXj zqEVQwo&=mTV)-zdkLaAG$E?Fl@?>=<5OeGGok3J=l+?-0Im~hk#brzz?k;#<5w40` z2Od{LL#r#8h7K>^8$;BP+r@$fY5w2hvA@6CVtc=wZAj)yi#;8U{@FFk}6h6a0eMqu6p<5CTzoH+l8QbbkZ4Lqr=S{q+@!P3U7gJz|Zfx|g z;KobYht@#JNqmOvn1;ER0F;{%b9Zzxu~QV1s#zZfhRM`a>x6kW|f68orrz4^{b`9C*z zYQ%~a1(JBt*O8Tj;HV>XdH>-6cxK$*kBD+Rg_{=q1Ux^T(&2|3;oNkRB$V90K>GwT z<3i>gOL)oMqY7w(x@myJ5Z{xd%{MtCJg?cRJVq=>b2Tg7KU5f+wdqZ>y@ z`F|xzOpHIxb`yk3kS(Lsc`(mzV#Y#ItX>zKd?|9wA$+cuNJGZN- zq!!M1ID#=68^T0-gwQ+<>4VMM(a2h~160v#j$QvdU=00e&u!zJly80{ka8F=G+Pa| zwOOhE{JU=+&Oh^m@tYMa-CgwVoyPD9uj*o<{G`6j!Jx{r>qt(Ml~Rq7uRb%u)T!ia*Aq(}$aby*fAP5jf-Od{r$X~3m z>#N*-NJDQjvA4eJShVN9aTxC3`80s6(AU`e_ei;3(HHsM}2~KdQ(;F$h1kSxH_I!WipYpu%i6&RSGR$CmCI8HZJ(g zr;JgjC%eVY-oKD847WZNPO@$CdD`oKE)}Sa(U}|@(h#GWR+}JGR&*@N)gvrY_BcL9 zBycOj{Nd2HBjkRpt`K^%!YmQ2p!lQGy?m-`VLlWiQ{#k==A?Q6@-}I&z8R+<)k07- z*Y^U!G9fxct2Xd9CD`*)rm>NcO#)>X%pcTQ_v>hehk)suk(n#&vcmt2Zv^-Xf!kII z#*hssGxMLD*qP|mhce!6?UM{9F4T~h-?TTX}ts7KDWa#rs%&n;PC-(o2su1f7q>207 zg(5Om;Wj}C%2W_-62aUBaXR6qlWFerpF~iUj~{=)a7(&29?e~Okwk$ctgDVfZ=(6q z!IM$;>m+Y<*e%=YHWB%Ipc2l)r8Hmdf}b^fMl3y5UFiZQKeGh0rTHi5Ig}kQw-52J zgnxd-$kkS?R`~g!l#U?1Z$}-gGlJRR>c0qM- zq-UgTEZ_YrYdodDVVk_aXoYZx&k6vN)>uJ{C0h|itlgG8{%-c>INN`oGf8$%lP{GI+i1} zP8M^w9V=uynJu8AqEc->{pHRVJUa`#CuGjD03ZVhN2hX}Q&n?WdX45W;&+1YB_Ro?eDv{V+OCV*;Tr3w=R za0if=^L|e6CF? z>)u!6&;LS&^6Tpp=gQO?Uy({GO#bFe%cU}J{;?h{QpnmmZCo#GX-U^@_hc~|KzO`9 z+^(^CIIik6J)W-s&Wu^V3*w!->5ir0<_4@+XE8$wP%(u^M^liJ<_>yZ_kmUx7KZrF z+j^(-Bw26}R$P~D#Kgs2mO5%`;v3g}GoGKly?uPrc$_FxbX;-e<>kvY8$OlI-Q@2j zsp$?^G_FN->vLBPF0VFhSuY!^s$v4`<^d;EUCnGdkr}>deFpmWKI0%P%v<@>jwfv= zhAq4W5*}aOf&+bEi=B!h#qJHK`2;r-VN>Stn#Ioij-ry5)LJ;^P6=q&nAG(QyN|rz zA8$1wB_(}6F%#;w=2TWy6}Pmc1t=l10)p46?Ck8&(9qs{6$=UqPIbKiDNJKE`6L>O zv>VCPp$~N6^WSd-W{oi8ML$1+I|YwDo2Hg8gW%Dd4hu7u7>>bJIju-QPFcOi@B^7d zRFnDgCCFwOhsTlJXfTF?k1qpYOLBO7xyu0?omMh%ad6c5zIYP(-Wvciy4d1E=XG~x z0m=inBeQMqj>MYxk;IKIOmYLswB#tMk0E z%y!>`j~clB7XI>b?l-t;Uv0lBQd?K&@%{}2yf|S4e`?g3Zl0gV_HJ(Mrsz>}ai!2z zHf^;L*|~uu>TDvH8||n#Ig^2DC$%oeKLlT{m2KND25g_|{}YHIt^xu=2T|@Vg8jOdxa$4(G^dM`{u&~?Ex7f3h2?5F8j3`?m2OoD zx$#bGBrYyK3vTV0xqo_Ued>P@l*~HRoYv8@wzTXqwen#;E34`-ygrzQh{9zXcv*a( zK>?`oa$@}FucW)K_}8u`73uV-F#kM4n-QSl59jcPTo#;KvX85SEBqZvF#JFE(0?6# zQchMES@FYAUVCnxYP9>5x6(;tgAyn5E60lrYUz0m;j@l{QjSavCWDC|SG-B+4RTv@ zmbkV%S}(K_Jcq`LNt(A&I4;WQzYX@a$0K9{w^9z^B>0YKK$xQXSG~f5(?Phoe|kMQ z7li(d_cvwm%qt4X0Z{+Xh0W*c2U{jG2m^QNVoo!J}LJj?i+oVWVm*SxRfOG`^rd0l9+ zBKwVE-Hv8Uo^PuB`bS4UCk*$sd0asZO-z`+y}poBQ9)P!zCQPR^J;5r!{M^kZZ(i@ zEerkJ%-{!jh?CXUl-HLhr>E0KbPSBy%JTAZdP5^4rXvsm5zz!7f?=_-`v74dca}o= z535%HYAPR)L|%MPj|eO>(HQXm;?mNi+2pd)QXsEw{lbBZbAaTpD+QQ`hoiEprrRYe z9+x8wKweaS`~XB`Zf@>ua#Wug1qJ1+iwg%36GCqQW;E~5p8!B0(t-X^uj>ofIjr`! zHuVl~p3!6mC%9uR2_fL%&W%6o4rl%cQtXTTTrnLibF{w>cTtr(7yCnxzp#F5+QL&K zZ;v@r=H!{JFrO@511%yCf%QeyH>~9G%5_=nHqvTb!g(id{n>X-H<^=I4kh>J#W>{V zgtylq>fCZjN!!!cN-ICsp|MF4^e!BkVmFk?7j${kvFWZYt{v5b!YX)34{)e3eKy~T> zbIZ!c79JUCw9@2o_FKo^p7}Et{cpGPH3A;TAg*=qgraQEk*qAw+;@tV@87?Z1G`Gl zweRwDad~M7IPEitp+p*G;0NrpZM_x&NE-H%F&s2Lbc0HhIx!_s3E z*i7vA%;L80!=O${T)sypGJ_ZndU> z^1bic=na|Q_vS&~ZN_|I zo(8BVbCOim%y4QCGaH?p90Y7W4o=v#xp7|@>KOv4!{@1`E*$`V?Ou1V`hcZ}frV89 z6tJ7{9AMMz9*QS}RQo!w&)ihk0*gd&Fme0o)2AMN=8f&`UI12d`?g&*4*0%20`7Nx z*DCvWZtl;M6YIOSR5e|Xf~UIE)mAP8g9_!0dITPP0s=WXxu~bqi9#aAdeF)KekcG! z0Sn=USq8Q0yNy*)H6tUaRiTSJ>sNJvQje_hbeKu7n+UWVPkrhU^>6BQn-@kgiq ziQS7qVza5=!e<6m?^jqOT~$?;D9ylo03TL@tZ~&9zw^GIDV4(ti-UvXY};lzd6~!# zU~g+h(7CfS)YA(=CZ15!^VzK#T-MRLzPxmdeV+Q8trZeuo8jYAD9G@i>2Rz}j9>0a z>z1T)3?rD$%w6J3gELAfE-vc>bNyM>22qHY7&kW45D}!0=mcuxs)s{XK_VE6sm98J3z|r z-CeD$XuG*C4<}HuWQ<>*E~h9LDZHbuVdJg)i|tHamxzsxjn9|vPEJm^-1Z~@%AB2> zYlbHF@bEw&;6~BY)02^vJp@+~BZUS+!yz?6ivw?gfq?-;Nz}rEhDsrmgq*yOEOu^r z8NY5(PFNTc(8p83<)b4@T3TAbdi<`ei~*?ho}ZtqH7f`Ny;GO%I#+$#bmn@4SCU6Z zMn1yBck44(+pTvf3_6n{ls((j?*bq8ygQ5T*57!!Tio~XwPteq_Zo|24* zhX*j8Q1;`{ZGLaQm7TAi0RQN|uJ8YoI3NX)_lG=qJXz(}BgdqGIl`AFx8(vF?0^8M`3fybfY>V(nRqV{S#TqqDw_nb{eX(sSkBP`xD@!6qwu+q>`k5< z#`@J26}td)Y|ono#6pe$o^K6B_kFnm)6mlc6)VZ_j1F???BP~b?Y97$mym#ccQk-X z=NA?__G7BqgLT|4wu#?T0kjkOer?$C(l~9>y;A>HXf?L%W3E;k02NTG0QL+)#Fy~) z=7;F-?+4tSUv5neDlyQr*ZJb=#(Dg(<;<%AKnUO>18xP0khiZFSxC;@oci6pWpLU6 zgInU?BU_s#c5vfdkH}ry9{`-ZQxXHUFn~PVZzB5*RU7m|v{bxfrSrwQP`~GGVqn?F z+tcGpbbAvPVnAB?&YF6S9?#t7lD}ngcNfZM*mD!S2R;^m^RIl%1sZmlI_?92KPdnI zkG!vNiz@2+B?P3U8>B(HK~gD^5>dL5kQlmKQc|Q_1wo{{8A7_GW9aUfq4S%(n<}=`M%>)MQ|H}RumP^B1p@nzVPTtP)Z%3v zljGw@&^|78O-*@Vq(G;P60fvsTMxib_67)eeOd$lu32KxpDr?bqBv^40^kPlMnmo% z9(WWKJ9xOv&Td7U#T+v>f+Hg%TGcjW2J1@R7CLH{p&+51hr}$ zSX$XQo7h<{x+@UTXSaFHF6P}0*$->J^j{GF70iskMf1!bk8<#3uQjj8oAQvGas78i zsm$CL&|s{yDu-Pe47()fJxi>f4|Er`rAAjA~>1-rGo)GiaAFjgUXPLv0(*SXwJY; zu%g5gjnSgE8H*As!FMGfN%<#7FqXfNZ|E&FdB3^LL3ndXSht&x!3EP98ju$9B>~(P zegT24EB|hkDYt}JNU#-<#ag!&zQW!mv$=W_Xgk-m&(3i0>ov4FVaoxd=h})rWurc2 zg&QsU1`X}_C_FD;uf4fmW*MkgP4UdLw~G(94Yuy7K@P$vYyQ+j^`Z7vOEVpc!y1xt z-(x<>mGr@d@dQPWy}s{rC5Pa~W=gJW9x&IKJbdrVKgaS%!fv8iSm7t}u4)24v0;Hw zOTLAcx>=WTJ^PuKsgp+)<7@f5!=D!aT>$)a#N+*mA+zf3^oDD#h(N?y1@x9NW# z*e%n$WjgtJbplzP@oa3B+yJl&t?2AJW9YK=YQy*b$guWebhk$c)gOee0*`~>6C)D zGrs^If2L`2d%Qrz=aL^+@|qhCS&HuU0U(|VV7dTXzcvZJ6}URxGu@x9E7YxtUR{0H zZ|;<5D{;PvY~Xugrjjlk0627jX=h+$3f*+R{JVDy zY#N1+g@v`E{^puEJ;`;n@0ns1Yh-kE3ozM$3S8aT;PbonR>^oO3&18Z;-{pduDgps zd}k0N;)hrdj*#d%J1bA#; zs9h2A<;&xJ@SSgXc=&xRrJ{m^aL|0k89~fJ2LN0EnB~}xEo8qt#e*>Ku|bu{q1y>~ zX7J}C0M?RxNDQXb-~&hdQc_Z8?c1^8{@K{r8(@(TTRt-?p0CEK!o3t=Q5vtIeS6h6 z%Mo1eKsTkMv$G9==azt|ti!6x^{3_^xsHuU;C1|y^Bue=$5LCczcn=kzyMtLW@Ld_ z6KG<)1{frZ)(a2fhHFMfbz~k5)%@Drw$i4hJ>I};-CTi9TXbM=e+p}=+cY_geq|B3&enc zfz9;2e2;{LbO;DaFo}T?01~k4*T196cS?S&D}Aq%&tEd;7!KzxZ0 z4Acz3Kx`J8GvFv}k)*IP)9rbeBt9u=H_#s+7Yc=T_w}_eEM%!l-Vpl3TjtBi$w2`g zfVN?B)z;Xe8(m#q@&dxUyt0xa=_i32_ze5?AN9hC4%bWYBmJ4XyL*G5g_+qA0H{!; z4WPD68u|?Y_&mhc39!fFPbs-?9;zm0QxG%-{=5_wV<+gadB}3^jAKDkL`F=75R6An_VKO{!1+_QUm}b zSIT%=HRlS*7{WgL0-!L;PtbCD#`deayI&vxm`r3+5=m546d@5&6{Mu4Me6Jp0qy|n z=wSG_8rh?L3B{(E07-U6Q}qGf!wXN(deN|Xz%|J9yY&D_KE}R|kfiwv;F)UKat?r`067Ol%`c*ok_#t+ zqhptG6}C*aVBZ@A&Bt{>YNL;{p->;8)(ir;{%3$64=Db&Q~_(aq__hap89m@KP3q= zt0vh}#rKQcO$LOl(9x{hcwnaq92$wp4wI!$3cDP@^8!MiPk=iN*JuDHtpWr%Sw5#^ zcPEB-E-D9bkp~*uw%5Dtluq01&Nor`v#RGJ0O2lfDF9Ie`dG%yj1lOPD~XUS;$+?+ zWfK83j0BX#Ado#70>YDZoMKcI6g&VLGcln9@a>HfzZ*6HRL{=M4FMFeJ>0r@9$Nyr zj~*Z&H2~;*W*lm2z(hB){4xP`2ivU}g2Fe(SZqOTzJ@Bc2zWayqJmTbd8!3` z+Y8{&=L2@W?X?ao?m!EANKsr$N{=E})2|I3;Xb+O7N+a;%kAkRU_-8U5Q2{*) z$foPT{N7-*ZBM7qQZR{Dl@-y|*@4B`{#;N{5H~P3RBUo*fD-2Yq;MfN@Hu%42WQ&a z+RiVA{04z&4YxLg$9KPO1AZwP8QB9AlvqIF13I{YeW5b9TKJobfjD(GVnf<-LGB20h;>dVBq1! zx_{^Y`AIDop!bIj{(a*96On(n3HyKf zV1MtnZ2Zr^`FEQm?tl99-+lhS8xED0g5S1avCp}!itmmYg!SBrND^#8zS7BTzmfsd zN=;NAxGNvKoYgNJV!53-tG*4CojuR;(szMo@zotv(JvS*)fLpS?K2hI-rCLnN)fBH z5k)zno}jcU_c+L4@8t}u)@{A5Boe!9q1^X!$MYLx$!%7Kh^CaK8cGU=UQs6xl^8-G z7s=Z(3PL!CQ=r=eu!ORbtMi3q$1_X-vyNaf_uq+S^;` zv5iP>z%Xam>G6v?ZqGbJFVJK+0$pI-@^YbO*=ZGv+o4&5k4@KuN)LXR-_)+RdYq@B z`89Olr1VfwtlOhV4d4lK>a^GykaecPLOfKmpA0Q$VCRJ;lPemk+TE3K7;Pm9mAg+< zwiS6@z{*j?Ho&QOq_(-Yi&nmwI{p1-eeQHQ$+#MYizJ1M18DkLTRq}CS~tCNuIni& zjuvhQulhStBBn%45QlPba=jrh6LVV*48b)QeEsW9niJ)&y2P^WT$AVuem` zZ8*lVls>KXRL4uhv}P@R3j8vqr`0!}77lzHtWQtvry`8ZYF`#z3XF*sBxz2)+Slvx zJ<}m-OyZ4VmMldg@~(E2s8Llink|BzgCQEQP4R+ri>?nl6h ztE&OL+M@|=u?rmyC)b>UYYRi&p6oNFmClcR9?owy ztk>Tu6I*Adc0{cZyzn+c5sld0pBtL13{L`AX3COH@AbNK6)_f^VO@vvtPPT?tW&v| z#ZFKfulNnpI+!@EL#wlkroRtdrMU0#gZzxhC=9KAVs6;Xp_`&a`zETn11rS|(*qC} zL-T>w8V_i|`&r>5L3|pmPA?Q!7SE(C$?C+w-~%X3*W${edZhGdZEW>>x&jjs$$A@-S%UjilS)?c8MLjAPGAtyPm{L)a%~WBV>%dL0 z&b4wBE8f`A8db=p`fjOlC+s2mN-Ek0-)LiOC6_Mb<6ZZAv5HNmYnPY!e^gZL9V0zI zqB3Aa#zXYV_4dG3T+Y|JGCtYp*~344X-7H)+T(I|^S_Mj?^ZUB>@%1RO`}4dyjak9 zcD<@a$HcgJ){29JEW^OvW5*?mD_EjYk%a4LnvB2E)#H|UblggsIb9j3Dm0LHhXxU` zJovWR#&vGdjjcrS9t0M)?B&FXN+gZ zQJeTlA!6!A5;N>9-~;Z&XKLOEu#H#D9K||8xh7-rH{uVim^p4MP3zVW|lj zeThfUy2a)%Ezxv+-8c+Ez2A14wwoi5i6W+EawEklPE8~uQcFri+9s5zgJiHf^Xk&w zt~U-ltEp@ZMWQY>iH|k{Ij-tHMABlq@AwHqK~_k0kim6v&nGYz3Qe0|cV*+dw};~M z$$Rph^721$!5NYgk`b}eppBTjibTWcAiw7F58~3qhZCU(WjE%cuLG)FKJ z9w&Ee-P?^MjW&5y^dT16E>7(!P1=j=Zti~ZMrrMRyh8dC7qbPV zN1dCozN^$W)DsZNkaLAehv09ubl-qV-fvgPbj!w*zCJXM>bS3pW7lQ*-=8bi1qlcY zzs0?`$Ado7aAREGZ0`Qym`=B*gzAT-aKrOnNn`7QC?ztSpxIxQhfOx(54n@i6?}Iu zS`wzUVZ$Itd1mejaB`%rJejB$vF0VRM0>Kx73%Z)ClH;0aY;h33fDOvzDaKGtY=6D z--4?Vkre2TFWE;ak#~%5{r!YPt5NybUvcEgS-8t`(VV%7AiK5o* z9STaY>*S{q!%prUo=IzoB_W=j!PdD4r=BeIPNXrFtShmgJ_L+OCqEcvosd#$mnT?6 zjL$3C%WyqMPu`H`@MG=Au7e{})lR%gYqU@vYu8A&hh&aa75kJErU)Y^Ur$~!A-MKp z#=O?R^Q;MT_SxH5O^G`L^!$!En#AZzF9rWqwIFcWyQ`hHc*ZcQg7OJonLDZQE{O3Ty?y z2h?mi?L@_-R!irTKtWZye7i8`eTr=oI(7ci&mUwv16jq6$1w@Ox&LJ zBzn`Ze*^Je{$eS{|z#Y{ZAhVj_#mD8bZrv3#rT9J8MJDN0#ZAiVq ziYe$u$Xsu_a00{Xy8WS@x`Dep>8fiL-&~T~zT`Q3-;CjF{N)^?e_YKFZ3nK`jQYgn;CTt z_5mezv*Ri6x)?Y$k48(@;{{fn`OwA@y77X$@5;e*?M{r$*+-pi8wcBz?>OC)3^``{ z1o|`_6}#&atOe7`bRioOkiNb1ZEenh9n)H-YgEvYZp)x}lKLCc_Az0;M@oKR z42&l&R6J~4UmFXSL-qO+CK7DKgd+^AsSN5YNpzh;9U{C^GA0~8?2S$7B3s;a4KCG~ zZb@s7P=1_R3=DP)yxGOY|_JfRC1_$#_%VA2P2PBbx1Bl^P_GqCI;o(Dj z(uc5i@H)cU$#48=b}q>@I4s6({HtccmJIt=1NCj8d;Fj+Jfd zsUzd)bFpliG4Hz1hB-4Hs~56*3l3Sml1r1Ag80y}m((;{Zi8l_SY(km+4S*vqu1OY z5@y>l+L(j47+C43i}Let?DXP#!m@`y_9zND$mUo?%P}*>m33VqKg|nscg^~aj)e+W zMXvx=#01pLSt1zH@R{ZDvnT64Re3vZaw=%dUwip%N8e-et+J2wn9$5AcHU+14?|~< zfkVoC(?Im&{cC&KFEs&UWfrkz+NBXi6Iz{emD=kxeL-&Z(YUVWoQ|W7L1l-GmfVaCPh~E9l1I0>O_GT|9NGQL5q1Kx&chy-2 z3!p8S-y~V^C>GthD3N6h%xs*!Mja#BGuf-owh#c@LU@^?`pr++w8s!mWV1>=M`J6V zwEMLwrm3K3)5{AZPbeEs9-HHKE)u;QuecCtze1B@Y3tr;d>fTCQG4x^L^)1)6ZVq z8n=EuoEY!OX3uZsv^+V#u=s6NSU1_*H{&A^ll`Mx|3Ox|%z2BnV;`wir2PiDz*eGR z0i(y=LrU6f?{D>uzqbzmNR5lo2+WT4)6`-u5K}g?b8`AwU%*xQznh%!hmr)^>Q_!( zMus8h9z4H>B1BQIJ_}Sy;`!$Cf&APdI975oE8(t+fpzBI++NjYYPiQ)fJUs#ux6?r z~Nnipz6Y_;zLl#kl1zF_X~X zJA!REttIunNEePX^cD^)%T5!bmWc9jkk|IKKw4oMT&jaUARclxTe*zP>S4c&665#4 z6SZzj=JjJb)imb;UE7Kslk4$8ZJtN@&X!x^#f59|_;@3^iJhRB9yH?IIb9NdsIwiW z>s&8dJv~C7JsQi4OsDip3>Y--cef|KGW1G9x(+iejbxQAsP%J1TG`i=^E_8Fk2={g zm(*RzK3Me-qb?7uivyWnmY0x{P4fDIaLq3Dx(d5cW7Ec@~5<9 zf$83#UgqV_F)8RV1HT&IQ-1_J)pT%L*ad9RBW(FVj^}{gD>zVATkLGnHj*N%r4|^} zc~;gd+-q0@QDdB2WTaVzj$wlnbFm9cgKDrGu9Obji zaiyv@f(H}mmM>;}lW-3O)Lpmv8P^1a$uoXZ;%zOveTrKyw|eqZWn}{byFtuQmk|RG zZ38KxV2B&`X-H=-03eZ5M)C6tTiOekPCP9Y5_UE<;MAFC;_9Dgy7o*t6ihih6%W(^gS~o*u4{$gi6C6wzM|Vp@yKEoSt^} z^-X!xcmLjMXl!5ll3N{6e~Fqt$OL3KDp$<-jgEL$79c@AJN;*9&MJ6E*AfNIY>vjK z`f)q!rUV9Z$jVGy=_<@k9CH0kT;v(3si|lxZe~Y8-%D&8%w>?Oj&WRZK+r;Mv_>vau2B7-9gP zmJ!i2bxV@U>Mu863KQxV2*q{lGe-t`HHrpPA$cR9(;gLD&+P`?eOoqh?P)77y(013 z?ZO!gY-j_|{yOd{`#YwBPJ0CTM{+@Aq~^_j{aD{V7+XD)IH*ZO;d8o4K0EQ%pG@0v zX<9hYZ7vFjM&Y;m*FGc)3_C8$RY|hF;HFdhy${Rh;IdlSKKR0Uhr>(GxeiwtPtji3 zMQK-|5jKptnNAX(xB9m(GWQ?gN|cewCFfIthiLR3b7zArjbkM|=wMfYE_42^mMw(D za>>Ill860=EwP&2_Ip&zXv3oh%f8k=>VOlhK>s?~&;0cf*x|tTu9NjLj{nlt_vrj? zd7IK!@WYO;w`j+Zn8K3cNu?Zvh>GjsJsfk*l6+KoE^2_wo-LXxmleB!3AS!bE!I|OVx7>d>6mK$z0}RJNePBe`K5m#^6Hmbu(Uw=4^;1#z zA@4RzEOXze42_cF;}MIyR|2j-yZl=h%$g2-Jvu^I1PMvL)&5S0r$M30?+<=(aM9IE zK6b3?EHu%~vFj*S=wSK_L;<1t$u_4kYz<%J>yox?j@>W#DMEZ16sun&?c|xX^taY1 z9E@QoR;8^{_Q`kAoZA^YH^H2d;n-?6ESxe9!*Kw37Z!0!Gr@F$Mfv~%4yXK(el zSxC6=58X!h6v1ab#t)a+-M?AND+>yrgwatN()>zvZMPHK3CxI z)-O7WXg;ufIvRGia&~o8eI=~65Y#ZPm{y~2_GID3QZ6?;9@Dbvl_>@vDzlqVI>}@B zaMEe+@8|3@0MAEm?LDnogZM~9PiB1Un3HQzU17NgExpIvB2no$mKc6vw^;68HfOW) z+o)`YT$kPDGt+_)7G8!i%@XFmjr#)gc;gi!1wA^+NB-+EfE1xsK?s2$jkC30y7FLR@pa-J@H(zFRPS-GBir5CpR zZRZb-?I!Cu4BepoM`bq(VH95&?vc&zN#Jn|z{tynZ+=({&#n2$XD=LdZD3**jP8QW zz6iWzWY&xV2Ij8Q{B^%>&zD9bizZvGNpW=>4}_6D08wdJAfXhjhSAjDQ=j7hpnlVyL|f$c z$NTj22t{&R5h=@3%It}y8Ody5I{4*C19k%#bsgm;n)7+`uOf~pa$1jL^v1D zm>XU9VvUOZ11{7)6;#>PjqnA1abR2G=CCkKn2KAO*YtAzP669@OV^<3B4Wq&%WW0~ zCY%(`(NQgNS8(3`$BRwP-d7#6(;-A+XO|kMZ)*>=)VtH{aU~6%NhW3ehRa1$vUp-R zGJhZ7X{qz3lpbm)st)~fWHs#89}JnSaS$`ZcgodUt`Da+TP<`en?K|9N{p^wlxK^W zH*!iz86MqV&V6Qhz$1PQwT;xjRp>e}x8~JGIV(M`^Ae3#URj@x^xTvd!!l~yo@?Z3 z^~`;UYiG7KLS$2Ohs=DGv!Svc`#pw-vAxhAj`eIY?zslGKH9uT^59gW8_}NLo>uZ* zRStjhn2|5exgzkJiz=_}C2ZH_%${)~Rw>z4bQDA0*ooR`g}y@j&2n8OmD8R@J2ZhE zq7}Wt#vap4#im{D%_vIQv_blPb$+n&eO$MqLz!J)MZfnURWusL$8S-mMi=Sd-UViK z{(c@Msx9n;XdRKEB|q02q{lY6EaYKyi7#PaFb~%d$4oE(3%l>0Ca;0cLXq7IO|?#2 zLGuexw0W-Sft^vu7e`am<&vN1Y}mchLNQ@vDLfxyJtR$Tw{I-)LlCOV#GnNv?ptej zMmtVINX#tLYQ9TmbGmhGrYt=K^I!1&F?{)qS$fDMO+`gh{6^#A5eOya%qOzF5$tCN z?e-g@(j)P(sC+QpIM{F)_@#HA=(RcV!N^jNhOVp2uS)hf;ZLQKA2;ac$rn-KHamemfR zE4y=c#w0b?zMY1I8~c2(aZM;tW6mUUf=axH=?hxmn@xTiAA7bZ)}V(N_Skg2qVc%E z5O%t5$Txt>c_sLgJfPD=a7vfr_A605ST&ZQKbWi3Y30eh)*1DIn9xV` z?3S%p<0SCaSC0R$_mE>NYR|w!61YDR6&dx7R(KdmlT1t1#QB`I>}aH&EGLR9GL4eVzr>KbEMhls79|sQw;i-e z+;jfSHdO}f(1OxL!#6Sc87e=Q7C@%=P2msDNhJQ!!=oWpmM&)EOcP3^c> zj~L`?%vKw!olWPD7@1iYB;p}R9+7B2DGkoc=$}dvnrgUq%lUo zPAt2Kd8%e#EfcbYNZBZ8EvQ%{T&i3fu~lb&TBO_3)YsR;Mj4Snu*-qId$oiwibL1U z*1y)4t(_&#;J6a)#(E@mS&1ShOiQNcDo9d?WS6`8$qZF>7{=~>K_$WB6f3ba*?4q` zsWkLz?ho~po*)5KjO7{vN{7#`{977{;1bmI)d%U;=<1hyENmIoJ-WdjF@?3d1v7ME zy_lv^%H#0nSoQ!Ged4xj|7`u6A#6Kvi<^(EOIh`GC5Sm;R2_+?P^;&BEWtv z=!i(Oslr(w@eF6F1?#oZ4C(76a18yLhWS7*WBsnj#J*jJ;2z2Z2USGy(JNOrt`e`L z@)Y{Oh`Cm_w5+vUOywWeJ!V^{;@7jLox2XN)@M6)t`MK}QOT&*1-2D#Xg4hMZ@xd{ zW$bG|y{cY*9QwV$Z{Q|>anSy=hy|PV-VpR50^TZzPJ4lRA^-YQvXkGT@q12Ey$ywP z3*jPX+Vj2_IH(TH*-6E#^l6xy`wY-R$duZ`%cctGzO*7ma??=%tgjaiywq#a%lLa!-=oxCPvG^6OqoSh@S?JzjJX@ zA&{s$(od;f(=vA167Jb`q>Fz10IFYk8t&Jn(_*7+?!1JbDB*?{NWNfP(L~h$s&36A z6DG`!oVjdED4=5gk{_!#ZHPj2eFao#WH{W=*yzn@O_LfSuyO~LNqi1}X*Q?k)gS8M zlVPD^k#ds?Si`Hzjz3g?9456)(`&P&O;oGlooS5v#=&;6hn#(`VD(f;nY+Tc2swoEAY)m~Yr%iKgTt8p^zOwOcO76(+GF1d0mYXAJ z5(TvSX9%a0OlhZKQy6i2XV%bkV>PZHEeb-qjr@kd&OI2!MWX&5GcR|CqPooQ$g<6C zcR<-#<+2D{Vzo;sxes8KpqS82LW;~uu)7~sD4Xyg3#wXcNC(>miy6MEm~i5UHobn) zvx*xczAG`jRifxUbFH<97{2Pg5cNSa4UcxgmtqKaMty7a&w$UToO*LnSY$o`;kW4a3g!#sLp_Pu3x9=nmo)7t7nqdjBJ#zMxpNWzvQLD+$ATl;8Y z>Gb$}Gjld`zS28oVh*--_ldoJa-smIu9v=bWy!dL#YVTskd*5Fd1bqq{RjBT#l6V8 zkR#NHM50lTieU}5R~@HjG38&eFwB)ZJDF{?PMOjo!aZz{B-Mr2EDBw`pV9Hxf~l|g zW*rvri3idLzPTKf54|^g^e98HtU~ZQ@MmueIJ~OH zG&|uNM~4;+^lSa6Nf&*M!%lzQtSF4wyx9O{T?s>u?cVbnNn`nw5>!A+(L+X!L=7vK z`MqeRQ3j{0W^r>_if`h>$Pg(AgYa2-Yi~Y1Z|&dkusG3w zhk%vZA3>36tdkq@&BacA^<~~+zCa^>D$N;tO23B@mbrxSNrdS8#>Mh2vGW3XWC+K+ zg6xEtdDM30&&?yTvQ3SViy)4jYPEHhjoWc+EwPFIW*4qfn>pWpQyR0ml6~P(zFKDJ zdYQL5&iajA>EV{G7DiXx{MKIK6}9Qa5BK!bqCyUbNBW2C2iH&)-gHszCT|qc^pyU~ zHFDyZ+i%z?XKvmY#mjC}r8MQ{5t&Yko zRZr1&WL7i6#woE$8-iHVeCHmGY`>Kd-Bl^fW-4>vd*b`~r!YMCwxx^(ikV!P-_Ncp z!j`wCpTtqDUqpi4y?d3fkOkcyAi2#xImmh&_xX{sjJvS0vD|Zd)r*@iKp@$fGWBp4 zf%iU4>kvS0*?_H_RIk{=UaK$sYT0C2Hn}v$7kOjf9Cr_z1@Xc=*dh2e^%RM0qM>PGo%crGEQ+ZwW94JULwagF72BLgd4F@(V0EAO(V$ebi4`=L?>p_X&Xv z+EIIFR&~5JYL3+=h`;YQRF}&7hig7w`$_`)2?1AwS+TN)nE|7#&rJc4y zKsi6#>%*Mejees)m#MdQc1~wOvJGEUzciMkUt*${3&e|KW&h2DUM=FRvSs?@w4&}D zLB$%UBC)CE_}LRUd1DJw@c&GJ#XfNCFB*Xpfd3bbXpG%P3w$PS0=Fj6O7UyJh|~W@ zp8OwxL|*x}Q~5gVcIn~?8k{nSe>|u;#cYfdaP~z_)|aj4ylT^!hLN?tQ`{LeVrL++^Y@J?BTH1#V(77SRP?u*sODX z!4tSK`#DT3#*W9iS21`iS)1v}%`q zZw3Sy18|Jg{9UD#Ajc|S@Lglp&3Qr_5Q)Y1jc86&kT=e^|X!UkYf|=@t0AJ_{n)lTMmR+QvO7cUH@3( zc{@|+=i02hAq7-9`Pk3GkJOXZP~iGnGrnd{9^g8O5{aIgI1?UnbS9@^?!No6`Xv8- zayJm=VSUy66GwlH*~=YoC~NLlllH0S0XICPe;5&OYiI19VypNM@N0d& zn_KQwYbtqvljr}rY!(nCm72=TaY6K`zr7uNV*Wmfh2O@wVIdS4Q?i;eJMff??Uc62 zN)O2Uv#SsEAwQJviGRsEX9n*>nBoDo7iG+KjP5o7@IJf6d@Z0d0?__+zG?KpF5@t^D#oO6{T^wd#INZYG|ytIfc+ju6?sMI}jvw4zxrEM>3!lms51RHbjiZ7F323=A*U4&m=r&%WeE zAaWl!PWCl3uIAt{iX3yTpmr+hw%MK4J(YNU+MCVpZNdp=KlOGoTzBUw5kIE~^^>>$ zjUz34Z9gmHkp_LE;7rF>ikbkw&mgvc!?&o^CVH)ZNO*1Pgr#%+mV{>2p*yX<1 zaih73DRN=CS8%<)mhtB2PXG>>VZL9>k*?%758&SneQAOlI@}~}| zRbvF>PFgV872O<0wP2bRTwQLwe#>Ij!mX*Fr4t7_mTn+gg4U9ulg(X1WAOm%h7><|XQpe3O-udGupTanOd)*_@n8=fjZb=HLdv=C7#5o^jB+4PLqXL-V@0 zo!2$U@9D{`eSGO_Z?{$)`ITYFJ99z8or0cE?i1ghhr|;|&$l)Tq$}SAh($>1ZJUon znehyRK{0|DBsnE@NZm}F3-@fPh&?rNs2jN2VvX-&0~ z3`xJK29tZQq{`j-}#IU-=Xlb|+#Lrtu?AObd>sK)EkaTWa@1<(KJ#P^QS> zD7L93ERLK+ugIDj zJJXHwqbd8tne=IP$QFa?I@0c4W?5)|jcTW$F}>Zvfns!-tUd5jM1nlkGwFKvz$3VhY9Y^NB`yAYwAu4|vQQsJ zT=s$-wK@NeGqL|SWho1tddlmII@j*e|!`0wy{Z=AUb9>IxREjf&We6+&ONkipj+` z^F=_1bO3YKdx{0)q8pxKwujh|-CtWs{j6BzV;))kIp$`lzU*F^Rad%Y%3c93id`ng zV)1jmeLM5tZ3Z(8uTN0dc$>I0zU$rw6fIKkXMIAF)%WIH!$|~RlWLo3^fDFyQY-bJ zOp5BNm~Qj?6jbiURmv3;OEh~HiC)9!Ih__?JCee?fm7T*_>DRt6fGu?sNbl1 zy0+M!r~?zRf(SFNy8>h?ADgj)t8?+=2U35X5^L#m`=5reAZG2ef-7Xi(l@(khYukYAtME1fWzLc9U);%o?otN9f z2ey8p*9y){Uv{d98oQi&yRT((cbTGaBUO zyt&2}lyJnQKy>OQ^}U6bcvw1f{+|J#${di;ZjmspLY>$|w}Ft&y2{x@CI>tdcitS` z>v6y$cQ5!$|nV}!sO_>@sjVF}Hnhn;PqeVb%YNt>9IX{zbKgGtpRF1(*{ z%FnDFH5oH&V-M{^le0MWtT_c)%TmNed8Q&eJ0$q*yRJAVE(s@uAD%xWpUj7VM7WA8IlDnXL6MfYUYcCSwiho9F2|cN5dLZh zJdwXv)Q~{42R7@Kg&k9o?sHXOpAyPzv8A7bWJZ<6tIloBTb*%GZakgFZOqc;R`_nk zm(5A=V127m;aw{3tJ~$FCYsBmWGf2e-@PgISV4bL7ph&i zUUAB}6Tr+m%NxV7v(He&63U(yQGRpRBFj5UyztB_F-|*s-e@a2;d;bXG+U%4#N}Y6 z+lTt9ewNzDP_Z=Bs-u%pECI@(D(~0xp|Ac1>B><)4_60SJWAZv_XH-yE$O0(+t=PY zBNFF6&GWe}*o}8)=@*KYx@~g6W~0JtisZYl`V9B}?Bv%*JFO~NBE*;$&(uQV_9)I4 z$*Y2r2r>SPn^CgE;mvPWt(S#cqB9QE-|V+0dWrT4UI*mKrwv_cIk#3c!umve?DyZD zK#6wk&3Si{fJleDyEa0|*Mm8`h-g=le&oFLqCXl}yTL&+%CLUXv!07p$xtk&k&xu7y0IrZJTpmWF+s<@(i}`q?mJb~gw$i!lKEZm;+5ZBVQPGk zC0$!PIwqgVLk$No&7b54#UdIO9G=$;vF==32RSb?1dmy^==Zlz&b7-y#9WERCvLpU z92HJE2l5V2p2$g_(dt@!{{fIbXL7S>@7~+OtE+Ww1frkcz3|oXnOPD_7CX{@VpGGr z5x}Fh2R4nse2vldsd%LBde+q!wg@ZaC`N)s^{4*L+W=Dt(^i47 z1zGMiHqt!}b||V`y&d0x%l~gt%e|D;@&0l6wpLy4n1b$ZCa`U`Q zu^C3qcc#}mWf-9cipAM?bE_1S6_B;9Wo16}BUrZ}&G$x6Ski)=Dw!RF!@Zd+DFa+_^Fz2$osN-tm zld^W)smA&0@AJJeLrpfJ;lK$!#4n?-GcTh_(Bjf0(h_^~SZ$l8hzz7bGgyU10+mLz zvzjsrF033)NAJe&K%Fu+7Meb`St5F|JWf3z{otmH*OT#5uG=!(Kj-VA8~GAX7%ybY z#rr%CWcH?yc!gs}hBSP7oMKag&ZpmFe;@qlvvJKUvCkq}peWiToV+t) zPOyQUL6773#S`r$mo-wADqwO>Ds32vLpDC0MSN!_;qx`!bZ&NS<0Fu>x|^f;cjc(0 z_Z9@CiDI#dRvkg`^}0XwnwlqMKsI-@wW+imy^+~HPAJu%Uc6jY+f7IVcT&JW+uItb z1Ow(KD;u#E`t2ail{JVAOm}zJm@dD_gP`FlW9oMyIWwI0Y~O`gO8yhB$HSZJ-AVdc zlhI99Xq+wNVE^48BM~peQWX?4pXrV#sLpt$&6`YmK(4o|@5Xno=d4(ZycJ#UFlBI9 z9-sb738geC5|McgTbs1VP$q^P$5F>rM3&UHo8c1>ggk*E8*!PuCj(6WIO^=i-M(gDc?(l3&W?zbUx>t3spLp@Y&bhpZrhlO2kj~~(8955}^vL1d4FvGaG*^B4j;O*yq@VRqDPd~C|l*e(r z=<67jw7Jz6A;Yx1&BFQh36O-fZ4sh6)>39*Z5w`>oYoJg;%~ErQ@$T-zL=&JMe$hJ zE&wlw8_a%^(tp~N5knD;Vw#Ief+q5&DUZHq(&Ng-#oGQjOWqt7E=Bib8`LR_V#@UN zjYX^46|uZdwt_-(t382#nsk-j(&iZU@Vk`fnH+fDpqa1$jSuw5>H4k>a|C3PkMsD&^dfU7SQ#)ZNU(m1TmFPHc!NGkqTlHq-eYFpSXf%MEzJKCSE4o}cpQP-o zgJ`>tI-_EjSLyP=qnh%t?)~YrN(+L9ZR@gAaN2GF@nP^_5-8;RAbs%~OHkLNjsT+) zV?NeaYppcA?R0AvH>Y)h*|D*r4ZgDuafUS)nhuH#_uIPc?*S}vWSbzLD$4u<<3<;5 zev${p3MW+ou}?mK$=QDVJ|FhNrs!+Y4Z`;m>>NfVhC$LWzEBv)6J_=8N`~hngfmtV zVM-X$*Y*=9O##wX;I1WXy@u2|P@6JOP>qd=+YQe>EO7tPtkB#nQ_PsOnMk+Yge{z` z{L=wfUeC3SK+eeO3FFVZhpDRjEmmHX>T}>S2)4}JfGzTnc1#H|$)hxGBK5iOmJPac zg$RH8le8aON$nPMSP9e1Iz#&tor_WHluF7VZoyaDRGTS;6yV3dk*j(#UDBycv)oD5B$+4Nls*-0>5o2pXVIOm7`LwuKX0QG-BfLpl+XK`+<_G zYTGuyN=v)N`Z_hUb06pU^-KOl$6uP#9w$%qnx$~_jT22yT@3(Po1Zal4QhM%2Fz^X*5JZv(y-OE(GO%C3#LLK$}lsFm>0sdj!^yGIN) ze!ZC@n2K?#F|?)iYI*kZ=jkG2YUL_fjzH13vb(w+rN?WH(8iZl(+CxS`92kG^BdlWLsJ2^TGiFM6!I*nK8{6eUn?{!y59xTuMoCM45^&sc`LZNp2;)l4D zSFO%xWO6t=vo%Y4C!C_zF_k8yMl7DjzVonf2{5gj=|Po`6xu~@Jj5&A5m%z#;R^S5 zC3FBR!6%(PmKpdRWWgj_6@^m7eGC;ezLO8s3*{b_~t+aU+f@H`}CDnYOB3qS;0@@NWe;k z2iy{n?PE42DuZ4lR<+KbixZIvAjMe_aOaE`nB!k{ymA|X1y2gKnQ|TmNVT1Y;c_#* zQm+YtYN#4{B3L8ItJvhuiU%ET4+wh?V_|00m{=G+y|CK_p#qCGn5eAmvN&_1ZTm&6 z0!@|S>n(>B+~bOEHX6-UrWA93q5_Z>!SU)4%4TF;W#^jQ`Ax&=Fem}My*y)UkHON#b?T*JZnUMBllo(a0s*- z=thlI>AVmaf4wdycunL9kn_JlPJ>X8qnG3`ZpF>>gV}mn{7L-e_QHNK1>-8;9iE`e zz2KvMh;>K)tSf!^>r)D|vPFy&)HC1S*oq0Nz;TkN^6vIk{Cf5=q7zXm-C-Z3R2A8^ zq6FsBy$Q-Lab6Q&4~#G4NQ~L9i&j_FqYLSO|2jp-%n){8I1WpE>D2gQ=E7d^&S#mR-|GX|?Pa8U76{R`@tN{bgSpqDBeedOxgav!oz zsvCF^C&EZm(*lq7MLT1eN;{eGMU0+Y#0Dg_HxyZH7$nKr`)ngMcFGhI9vPe2esOsu z5PNNeRgeT1D&EeqbTy8CB$~*`MQ()`T0_Cp8_)$$im~i&AZ2B zLAtxUJERfm1|>Gq-QCh9-MQ)RJU8E8yyyMToH=t2GcbEZ_TJC4?^x?v>%Kk{tB@h{ zZZj@%(+T26@WKjIdVCkc_Q%N~5os?YXiZItKBc(6jQTs~hiCroFPo=aU6NP?!Dq{J zn(tSnZ@2Sw+RyFs+BS-RL1;z_da;-jsY`n z$MSY8`lC9nklK(YRD37=je7c$#v&z;Wgg2Ph;O+#n$QcanrE^)J}mY%VNk7ABGe~b$#;NSe1Ua&pfHf}K3UWMX=w~|*lOPJWtqQ|sS?8OCSxv?>=Z_?no z2UKH;{PWc1TOr4HHcwJrb_qTc>5&iw6uX+5h_Xhf*9>LSxVwP=jF_0%%IUBG)%*7$ zz;N!#m}Bhk-%cXu`A=?c+`!H24!CW-WOeoA_d1EmV6s{Mh}{ef?OI`>lzS7_u(CVz zLV5N`u3{BROk~=h_9hx4qbyTCry2$$t<#=Vy|a_Lw=Yd!^xA~4I3yKG6ba2s98N|X ziD!z7?`zd?uBw_76I1)hZ*??gIo#w1rIe4sVJg;_ZfC5$-m6{wR83P?&!0o*wyhnl3me_sCD*eG4Q5Z7%#S74oD25&>hZ5hcv`jGfd*)jmMlc zs(JMNn#5bLvPMEaCGwcq;QpxC{_F$+-o32aFYggKu*TAODg=Kl+L(ndGlk1e-TA1@ z7t-QgBC#05^!9ZRg9+mm>2P-4s(Jdlk!;um0B6EBr{|{#Kno7@OYAGtxha zTUfE6^vT+GSYS?=@33)jNFZUNu2&+B;5SDz8GmteYiiHbi6W%-^ z@C-)1qA!k%?HV?kUv9-rS)3%>o9OY;2ipd}gbr5FD?$Y8Q`p&P$SOC^@5uA>IWd&3 zgi$HOef2cAdnfLpUVE`qkn_~RDGc9yhW4i}UzZ1CI1ARCpUJl1g-f8^X{~AaPc?;* zAF}|0)9*{mh?LTX;k?~6x0%%{1^GGC`(}Cm;(lF?cDB9z-L^6&%IJ931Wv{Pf?o&g zeIHMf$-Z|E8hO~kF))q@lTA$+1O>cU7vUJ$l-R4SonmAEk>SCym@k!9e7HLtONBz1 zzu?Pph5JwC<4lu)!z#P6F?D)cWpf~D{P^a{^7P>(q2;K^+A|Co?&|3c9qKyXUD+B9 zBz^)8Ay1A#P7P@Y#4a#F9c|wCQ{GYO=|jNEsFS{Cz8!dcnp#`;fKL0#dutPu*2Bxo zr1jEaXjV?nH(>2~p2Tf;b7l&BSQ%+XA01Czc)@9BGP0X)4_#oQ;lfJ{99?cC(@f0F zGJ)+qE^;7$S&LN-0XYB6ZTmtoox7nTA#2;(6Cw?2{^-Pu9NpNbZcUX{Rp@wlGsZ)h zz&?J*MW>L_#MHFS;KO+cciGBFhlgz4Gat>2md=VLflTgWZ01@%EpPXR$jNGU!m0=j z9=dJ6R|AjZ${xR1DRpvi63~JZTWf3aoz826M!Nba1!l%Z3GxMjL{b5CvnHdZ-7wIM z-0od?e_vrHkC7Sj5{-&(K=e2L)}>&{ca&=kXbeHG%<3Jkvc(xSdn+0))|&+1_hhhY z=Eu({cQv|krz#45$-S`0)?|5#O^aij|7smydsxg>NBF`aL}z5kC@5eWRU`qs`OvU1 zE{`jw%O&qe)&3{bCGW>e?nGgzJGW^t)pJX zOWb}=EVEtz`VdoHv|=%!O-JWrC+R`2S{PTMc1ba&__~%V_~z<=u;a_fn4LSmW$a1c z!xT)u%;6qY;#t&T8o4!AV?}w(q6@#${BamUUd3~!oD{6V+plth`9)T_L0nAZdiI+L zmW}6U@J;4jE>>)=sUK;a}OB+S|v3`Ix|R+>~0GBC@wZ=W+m+vaJJ*o zq}mapj+#@}V^Hk&q>v+?UAnlq(9)#JPk9`w&XSRvvNLiRu+bOLS`-M$GiCfS>#bNK zP;>6sBoH-MkKn$MUSgu3V?3NiFm{L2!1^{rbZL{p=(0>N&i@RFUaG~|Ii~N^KVwE3 zcwYhE%GJ~BCs#Iqc$8<$zznLht4o&&_X?O*iAhS{jm`ZoC?E$W-&a>IJG;AiMMe9z zWHnSAK7t|No1<}2C>n3&$v7%on)pVqR0Ww)(pfmL(hiWmr#-w9EOPaPgx{*AZPAM5 zj5J?#eK?R3m$A^hH$KHPOzFNmwBRcV7u?|eaDnrsd$GN^@6C+DEl$Ok#@?D6&AHv3 zfKih@7RUC(r=umeibSXrAQ(I`z=i$gR&yLbJ|V?!h;Ed zDmGZWE@$rFUADx}v1nztyld8NgP{4~2j27U!e4XokLj@x)F8*Z6 z71*Xj3N98ngxyP6>mM#Q-Q6F0Qvvs$tt}I)rt?W+M)NY2<|7ucnzSq}8N1zIdGI%C zS!e9zVBwpU*HGF;)<5(?Lc1!fIhZNWVK1hv-nCC>Sj-tL7O9A~9C1P*0zEpr=S_Bx zf_%cadf?V@Y|PEgG2=&oTjj2vW>ZaQv_K`$Wx`~;ypE?1kM6ApS28}tU-sFnYv&66w_@XA=mnhmoUU(x zEnE^XzJ8HF#H0fQoV&NK?yKjlcCThkSWh}JWnh@R?p(SfNlMz|`-^WJxE@_y(9aL_ z*K-Fb2HnVEmcm*vU%unD60Hvl4UD|9yl(0gMl}+@VH7=h)Wl8~MFR&j?NJFI;V{RD zjf2kv!?gIzmP8M3hvx2bZk&1Ld4DuiEUq>jf1^=}dSz3sSh{h9@jd)hW9 z%;rhDT@WbUJ;iR6R}&4Zk^4qB)^)x=*fPADPa1UqH-=*<2D&-oawV}tTO;PJi* z?YhvGLxLZ_Z%NuhZbgf7C(3=4g58&=xgnO7e0ibM8tsmt3hMRF?3sSF5fh!;OSvzt z>Vi^hPJ2q$w%Jt$aUhvVlG2igHH``p!vB@CK`nwmDJ!oed0$7uq1EB&|0asV=4DiE zo+nQogU;}kBPb4H~nJt>qY{wzMvdw{Frb3elC#No=_gg01P87CP^U^m$o98UPjXx%Qb z$HEwRhMgu|4tOC;sQ1?T;;2c_akame&oX9lRDmn;KDqt4N~ia%28G_IUbr#$U9rZe zGBImA=aXRj9V=k(!^q5QMA34)PS2nLhY-VMK~W>z<6xzwyRZDw>I*|hTA0i3G;!lX zr@`#9uyJ%PSrY|=-T@_}u3k?E%Hm`eAy-{GT7i@7;qLatHGX*vG>RxqP$S@l2TCn? zAF@r+O~tbeYj4?&;9aYq$-@T_lbQWIh)w$dO}2`E(y)Mvbx?V&b~W4)Hlt7x&)j?J zLh61>QDoiOnu5oCWYo7)eY)CA!o&;lX%E+C8cEG;k1v>=Lx9@V>T=Yedd0@laz4Li zgL_rGdGpN4v)RwP$~(xtd@`DwR0QE;F?aE#8oM&x${|&CR0i*5bcwYlo{98|NJl#K zRKeY~!h*8*z9PwM5D7kD&H<+RIpDdGBWiGz2iK9~MB%ym=K9h(vzUrfhp2Z%?c`W+ zHwJ4uBEW@Euf4Qm!AXmIS>4Sb5Yu^1Y;ZU#41SwBHf{wY8HJe?%U-RZ=knYXj?O2I zD1%`=O(x#{4+7*5AqEWYfTL-c=&2Rh1G;vSsFkJvK7)LVu5I>@%}{r~9n?45VSA$? zY%wNJ`8=j}F@ArKzcER3eP&Ehu)k4$T8dJcryZ$c<7kGyT1yLmq# zAio_mfu&0%`@%%0`~K3?87~Q)PbI<-$yuWz@VFZAIq4E%VweM`VKMPIJop5}hWMfH z3rzxZiqI@L+@62UdVz@}2@%48mquZ*k3fz5rv?cYxnh;};V^wfmP8dMGpa23`>paK z9$G6h`<7dT)yy%KhXewZ+ur+BGrr=_2?awz-<6Xdso?HA*6OIt_pzl`o!AfNUR~+V zVm8V-z1bDGe?#=L&MeicU~S+3)YWL%IhdX5L}!S-**wKVxaN8vc8Zy2x8~giLGL&P z`SoyU7x!yzKa9FJT~d|{PJ|0*zs1FpKlw3V)#V4d=9(d7uwhkP{^6}oLw;Aog#Ckn zfJj4+X-15zjo^fBkIwx3z%O*c_$w4%2N&N}VnG&_^P0T7iz7EP!Txu2 zWIUgH{)H@C|LjDl*?lK~XKKaMn>F?5?ZJ4QQ8HcKOdybiU|)@4DZQ?}uUhzc_BOc* zh5O}6g!1SW`lDG(ydYJWsz*mp!uh9=bn#&PAwJcXE<&8H4&kpCB#-{6;U4-`E(F*2 zzcP-!`SHIz9{Ju$43YGfN!^QIuJ9Z`q6rXG`F}k$CBBJCBJ1hrW_t6#p!%HF@FJlrs1*>S=kTVG&rizw`2*GvKPM% zF&_oo0nI_!k-_UuU1@=Dp~9N!)m&>S3UU|{`Wekn3vpS+&bE}WL?Qoob&0s-2?XA4 z>t>RTA^0&SLdaj1C+Y~b`}ApGM@`tO82R8CX}jlbT#7J`!*%e(jd$F-rhC=b zn{VeUKoymy+=udp@jDVOx#nmtSm?-K;fg*^Kd-Jg_u=z!vf${bM=?-5!1)5Z3@Ja8 z`u=5jZ77_M=KH|rz1xg=CLc1j!pd-@l}AjPlxw)1FTD}gf@_$kZdMEn&WH9Fr5VF$^uNk_RBqCo(z3P| z+!4nW#srtPIPWz-UAlZf7`?2h-7;9jMgY84{1c}DatLg>a=a`S$+_4KD@h!DbN zNukSkKefl}+{s(klza#?Ul(G2jLZ4o-6ckScJgSEDB=z8uZ}Us-pj621j9$JQ=ebH z4S4-IH3|4a#(^YRQ7H$Y0_N@d=}nTqczJ;%Yb8`PecHCiz~&j+M_Us69CQERUa$pP z)czuT%MIbQ<(L_%@5Sx@iYA1)v7Z&G@9WXh<4%{-LUTvuo=91N{Dy`D196tGVM9w# zRG{Yk^sTW&#DVkZ)OKhk9`g2wZ*1BE;tx@8lK8eL^!DDDR|w_4x3~7bXG#gv){z{( zO?19qV!Yvw7-|fQ+Gd%t*)n~wU9K6xJz^D9$n6{AMlp?Y4|F($O_rW%XG^=%QPEhE z={g=Iy)^zsu);19-y$5Zuk%xweCyy|k(fimu;W2i_B}s@>q^me-AZfrmQy{lNFQ3Z z(fBxFp+)0sezS?bR2eWqfnX36;>2$ku;DyxO!eHA2LC&JAV!FDYPR{hthwE9$3p=I zA2**YE9b2m`F3|!=lOwbWN(Q@NNDa=>7r-gE^nx=*n?d*2XD{nBf((I9A!nhUQ0_j z#h_8Cq9r;sU$`sP(W1aQDMNs9iHHW155q0(PBIz`8NPu_vA$S%#w=fJXtCAx4-QLy z-DkOb?hAM%S-Vw>8?O5%{?4AoHf&#{H*SC=%4;gO-G$91kvM7jVL>xwT5&`v_fd6! zff&jIXN4N4^z`Yzd^_9T>I>((^()Bbs14!CxHCqEA2EV}#RwV1)H=Xx7^4$=pW*Q+ zjQ2`cIW)iKq+`V#Z(RT21mKD7W&^^QQ4S16ZzGcf=%$C6$H zU>|R^Tzn4}8tj3s?}rZ`aM{eT%%_TTnwy{8Yh%*Vq{PG!3%*`A^s!3C00LZ8Z0x%b zMwscZH#F8B=dbzJ7@>25@fi9N2TZ%{A3Q0^$BoN3jwJ4u@2Rc!?pc~=jDPL1qDMI? zJ*4F{w1~8HGT#|=1`)Yw-co4wH}*dc383+JkgFpwyN_sZV+(wC$_&PZ9F8D zd#7K&G_}&NA+LxAxqQ?{oy0y`{m!$E?u^F*&ns2Pr{uJ0`|ih_QO>)gJvD6EG$FzM zlucbt?N$4r&Epr&emlIjNxE%wN3GMx8X>QeVpp@bcE4eD@%K94gd^=wf6_eJx;$t7 z`gQUTKZa%UlIJgvo#De3dV~&IV%Fq?7=|p@o3E(SzYgbFliM2kGj=gjeNtBaWy%gM zZa%Ts$jjQsE^3aoF(-wtaUv#;(xf(2L!4*zzYg=KN z8X5z@RT&`1ClhY1Cw&(`v$%ofZVsN>b-;1;pePFN0MtZTYbm<-|{o? zu!TRjn;Y<=;T;)%Fo_7B$&ox_`Yj**CRXMrl8SEXDPqDJ~*%hq-pUri9$ zoR!=Odj=(US#W4JPpxud(EUYp^*Pj?=Lc~diJejUvYfvV_r`hiyPDIz9g45ZP~)?C z9)d5;YhCqn9n$%t;aLe}a@W)oZ}DCc#`I$&%PRte_Il+5;d&O?x;9?%qBqOp#r^nU zuRcEd3@?Oa3sXJY&JM_wh1(`>N4bhurWWf-tCXH)yA~S$WWNbOLZydmYU{(QzRF;!I5b#=Z89a= z4NKRz)@K_n8?P-syg###*hqfZEIa)ZbKXxJPVa*J*3A6qJl#ZQRJhn5fKC&<$7I6z|=V%a}zig zQ;?Ix`3ww50tSgJ);I6~fa+lW^!4ch)fqVBN2R1li1#H4oR;S0ZC8#1^@py%eK#UJ z%y66)$gk)X&26lctSCx+k5nD|1v7uXu*bxAZ|BYT&-zBtQN zt#e(!WQxGHhi#m7m`kRR=Ze}K?at5q!{*W2O3G|i<2Mqj*)TwDX^RJ1T!OF#D-k87 zCwF)tKB}cn8JSxp{G=A&s>r1NmEuS)@_k)>=>~^AC88_rO@;U41B(_%2b1(|IUVh) zRvSTA!q^S*@7sVSZ+>6rP_J$_Jp05+=+rM#D|HsBiUmI>B$~%~TQmW}8)6ZB=accl z_ZD>5{_7zxU0~6xnxXa{w~cr75ANn@JB^0(90rcm!E@=eJRezj&v7x&(VzhINJ@}KLdPbJy3#>;) zB9vyWF0j9Mj*?VEe9!;wKfM6!)xTE9C}JV=GRa7$3+eiheXi<>Ix(^2!L5K+O`Agm z3lv9t4JOR2)E3z+g^$`l4G@LX9d3*VbY*o8x0EEV8soky_AcPqSq{h{Iq`pv z+HMIsgp*CHRrC?^-t9WFviW90ek;C|{edFVAoXnblu$uDzLevK^X-fLU`1l}q2>{R z6W4*A43Xq(*u#T6Mklw+Bh_uIz;oPSDWW0Ad#`W1f4FJ>%7q_r(PJgfy060}&+2_k ztEgjfX7Bx|FtJ8Q>lP+{PhI6!YEx&*t;#X-IaT_no^d8hiv`}e9pQ4NGQSm8U$x;R)AJl=lZoZPE_1kS zQi<=XvDc>TPPc2DadG5BAdKv&R-FHhh zk!aIGC)?&+Id>yB^OPFzG^$9mO?NqLwRX8J2*O*~XCS`m#)*A3{}n)mJ@~a7pt?Lx zl$S{|anRR?Bp%7$#9q;O_uev*wJXqADzY@Ng+|{hEzS#ss(OA|A&WXNJ>5>n(V}s# z*e>XS<5;>+rg>A&t&6xMDb@o)HBgD{!Nc(yojs$pCZ2ZDBc*jCt}!r>vo&BpY8{IVEw+Ly%Y(!FyJidj4Z2XD>#{bI zJ_0>>A0ws!>qytJiaD*SC1|+)d9p{KCpJLHqPR?B+}Og!H?z`#f7ic_=~Cj(aZaMB z@DEHeL45!%;m3}(JKZVuA_T96{_9db{Bd~N@pSl! zbO`7je*hn5y4jN_G!qQfK1)DI9BNVc7kq7mH6kG3Ii+MGX^1!CZ<|BoiRK{c;>TF# zg~KfC)v7c*9wIa3smt1oQM`(4*d94IYF;ssj~y)ckn^`fxEVtB zr9*exEbku@;Hu_aYv zOlQgqwps}n_1{jtL&-&$i2cgjV`eH$F)Owa)u1|W^JdCG65=e0!!Xb4>ZG9993YiL zQsrW0WxI_L8ngN1;MT`-Vz6k;`Jg|Gec!8Cj7Yei7CmJfQoRl5M6B8l*@3gHt$rxK zsOjbk7bliLQ`Y-gxDWa5=DKSr6;uTCHr>$O?Rf;h5E0m|3;Feg=d1I-ry2n$p?`E5#Y+b(8-1Z`=%i}nzS+L*6 z6Y#U%;AO=7T$$oce8Xpr%|CEdJbpFYKe;xdkzl}m7E02#P{(*GeBE%@LVsTinY&Dk zzb}w5y2Y*$sX^}O+&z`kP!qIj30D}hS%Mc9j|`?B*7DxrA93E}`FvUVoY09U8G^AF z(oz1gFYrhCs0MrMGpzS-ah#H20=hgY^lZ#8F zAT|1M-KdI(Lsx~e7HU<2m&%%om4Z27Mzd3WVz_OO^|u=5hZHG2S0uV-_ZSZ)QNoT8 zN2L7d5uUq5LTS;>$ATi;4u+tuDNA;83?MYc;pWRKYBZ$MQ|!KH%h9Mj=MsDhLNc5F zocDc`)6|SGR0T{d;m(_6h#2S;07!Q9m~Ma@tko!1a4OnkBT%h6e9O;OA6~|{`Ju4C zGOW6pKjX2@=uJicU$bFd_JqdPsKB)O)O%{>>_N`$%0S)aW0&CX-@hmF%4uuM0IX`K zL(!g719`Fe#`s1^2MUjiA(XF^TRv%eH$sO#TX1%S-hOg0VPr zy5GSLgqAz*DmSHny3$g5ee`Nz>+#)`Q$xx4ddOt)8n$p0P8}G3LUYHms`ti=MGq{8 z=}xnJ77O-p>grAM52=1|0-4L<1nrZuYS-ZRcc)y%m#`OcyzR{xGyeaK+|R*(jy9Da zy8;DeSgLz8HZ>p8-@W{S8`m4l{}?HL`N{j$LZ(RV`&+p{?M|4QE#CNp=E$bFLzcWt zL5D~pO2lW#haV!|<|(KsoKdGp;IOzKX^VyT#Ri~5Efjh)TyG09m`M$JFOgM!`{PMN z#zG5N4mbP4y^TA3sa&leAMJX4a`B>X2BjOCF#cfw>mB_QR|*BN-9836Bav**9@x9u zbW)1_`1+2=-A>_xk!w=%Pq(1=`a;S5@W`N4og9WpYLyhlaD~MsA*CVMKm_B({0K!9 z_9XW!eq_!@y6k23<4v6g&Hp%Gie_4^{OaBG0|g<2tShPOXKaXv!@A)Og?4{U5FL4U zIvt_|K6_VNc45$O2a@$egvW#y5*I%_IIpGmw8^5R%Kr>Emiykt$`E?>YFSm)Ucj&< z+~F?)GRj7Of`Yboq@ij!i9kBQ=A<)uOG%*sV0IQ@Y@VGt07_6u$4V;`^4DSwF*!MO zhJ>&r7UQuhb7e7`e=_}-qXvIp3rcntKL+~CoP1pwzWQ<_`LIhcXAqR`%TR1#wSCDc zLg0M5=u72NGeR;#l*pU@r78KoY7Q5JPYgr6GXM7ldHg|r0+7!J0JMqvkN$>qj`LmI z-Ez6}jN%c+o-egZ4=Y91VG5^MD@0bkBLFblR&41mD)T$UIUcgZ{1}UnLurTZsYRP^hPFdV9EmzPn;~2VMBfGLF^O#+B zw{_y}bmgdZfBu=D-qSz*I3Ws$2YkR@64HI|9!|^8Iaw3-{#L{i^ZnQc+h6nzql#wb z4{Ueuft5f;7}56wtKP*7(L(i|Y&#Q$3>u=Uf^W0x?-6+VlojM3U&NGe#^5YyV{FlB zjNfb7HO#m6H3?9%SiP*U!x7o5wkUB)adUn_UcVq+Nq-!@RKq_m1@7pVCc}@_ZOUR< zCDCr$T<6W9Bej&;*eGt;f!pM>>B0T!!4eX!h7zr&V69C4+%Fw=!1!tY^e?T~yQLw| zZ;X9Q8!LAf-3~2ik)wawk{`2_+p*^tAA5rr*b&$NQH31H03qD`++A4i$gK&+rAZ4g z($v$eriwKsQ#QQ=Cxg++Rm${U094glKVu8>g6Lpx?+Sog^{gESSXKJ9OdP&qZ2Sl) zQCxt52&hlt_-vsdk(1Zf9tNLg@6Zq=J3BzB;47?7GG&F)Aldu(VovGc!?q3KRPAE% zVb<@qS#X?k+&W*fGeA7_IJbv^TzCe6&}G=%6=L{Po!DVK%*t&<3N3J>>kTgdLxpZ2 ziu!}A2ZX8=8OVJ^$uc#(SYNGwwKtLYG%1lBHTc;I&0)&Pev*@wmBYq9LZc1!gP8oJ z)}f&mpLP)zMocN*Xz=EK@mNVi^L3in%tniXi5@&U1h(Z7ZrJ9bUa+kz-TMaJs2g*2 zV}k}Mcgn#;?conHr#p*}$ezk8i^C-Xcv6`xn7R0o{lt+9VLhf{9j0MDc~uVwMdnfD7-c{4$i0=8H4(> z(F>tRW@Zil&)u^BFAn`^8oKi^^k=4 z+|9pj21Kc5W@a$Ii;7TQcw-B{1)W2)vugDYrmFgtg@xgbjl2Nks9I@)4(O1EfKdth z(7*`6FR!TR1=AG(!q(TF}u(Gwa?VWz}jvy{T8G_czNQ@%i5h^Fa;cRM>{Alj8MiAd?4JV?=M;#;H0Xu z-lJON!$~>*)IDvXb+X7OQYs5VnJdjhRkRo!r*+EQW1dz-s4D*Oooyeb$lGbmM59`W zZoISoSy%f9DM`AQjgtLB$7t6j6Iib>3tZEe9Uvi@SGlJMfvx53@#d;3@pu{-&*ObD z*fp0g{W_}B$8fgO@K{v*YAxwlC=*HwP6aae4el{% zHD_OD#y{FZaT#!%cOwei?l27N_|?5y-h&AqQgS+@lM6W@|r{abY9k+6^ny^szapXADd@RF-B{8kc; z0F5s!e*6Dodr2RD}8@yLOx{oV@=}lb%*i^Kt3@d z=!hR?oDTB85*$y8_Zn+-$Zy0+H^}o!Lg}W9OK5aobiO)Cjy~DX8ow7L;^!ni8W+zk#1&IEBj4sNWoz%bSg;eYrv&WGs(m>lbt-2+ zs}n2vK5ZE_|1=3++9HBUfB?1^eSjQ|jg2jJ*p`37AhJrCH%HlOd}O;j&FlUq@sE1i z;q6b&5>r{piY5HSa?Q`DfdQygl@>2Pz?1}R!szH|yY9KszkeORjDNFEcx}9v(Zh=B zes>Ms|A4!BvMNuZ8BqJzG?@|_|H|NWbI{}NxW~ZA$ZlMUBP!8FPxnDbt}(e$ zjhcbBcm%Tcf4TED>YS0F~pMRIU9jed-g3o^vxtm4eHC=<%F{e{!U zKu-*pw%@b(Z245*dTgtRl7-<-#&$Pv@wr<8ta3j|;uwl|Y2TZdYDw|m1Bn`NuxUE- z_0W_cFXQD>Fz7nI%XT4p8@_Va;pd@Ye{}Y}#_~o%fLSHl20;a(@Mvk?18HogiHWaH zJ{YT5^dsd9B-2O{uU-sT_)hMsQD0%FLg)#9)9Y+3A{-^3pGgo(_>l`Di4(}l)|Fij zUrm&u|2kZxzaatXub9KQzv=ZeKK$u2T2$6S-@r%0Ori{g4x0VvwC7g>b8>LkGF^d? zs}}p|Oj`_+zKREX`F{IYoVzp~!=J5OX1h@dGj{8Y54?nNZI^+K-%as;CMH6BePQFb zOAK`I6G0&b@3)7Jo~~XpH$+cQ^&#|SyrIr&#uAb=3BQ1m3HK|^g}-l)(sZ|RAsk0M z@PVc}FXAm#;Cqsh)Uz9gEy%jKQU|7g3C&^H%wpP@J`f{Vw)QL zYfcTe+-Y0&iz}z?D16@C;6%)-%@v$pROwLLuA;CUS!SbV{D-u87m_F4FRqzAvn+2^ zs31>AAj3Y?ch02M7+xKQW0h^^7#D@ma(?23H_SKCpIY6*UWaYkjBg~lsZRbI5j}39 zytKvOqSgluLEzNnEM!{dLB2L*&m*0>H~s18N*C5rfxTWBZEbO0>2Cw=Hbx3Ix*>zg z!O*&Zp2%ycXzq|ZmJh7hTH;@OFH%`^^GhT?=qji;i1;-TKny>Sx)LTnFdUbCqQ%A0bNlpPl>(OzM7lkORI60rnd3Eo4cZphIb(Pn;xW@C(2h1LXA+nEI)S zzRe#2j>%+%6bT9GPj9a-h!zbD3{vfNiZV0(0JKNLv=LaQ zdGbh&H~z$a%@DsVl{(a%Hgb0bJKEend%R|piNujn=>u_# zHrCW{x*`QRJUrAM@Mn&vn2P7_JLkrSOC%Go)Um2#{{FUroZk`U=j+wXk&{iERA_Ym z)+DE7!l!d)PoXF4TOjg${L>>6AGQ2P=VKqIMQ!W5k$sOI$y3;4%uz=o9yua@?dcGs zFBc>xCMGYHAmIUxd#Be-$Z!n{UZYbRk~B;Rv@$|{b*QcKuBIpEeo9dUbGfS(zN>e`@xZ~PjXn*mUCa+Zt4)shH_V@ zlPa5wi;KHWxyd0^-jXUS*P~lT~+6S*#q_n~Of_xZS=NB-P>_#J} zk$Dbx8x>9E*Onxj{}a2A^9`bFri3CR<(V6dk`no*>+gRGbV3^;uappL>4%4-&cZc1 zn2tat(UI>LUeu!t)_=1Y{qAtxfkb91kBsQ(_Eau=wKQWuy#BQUjxIMp-XCVTtQ458 zZ)~KU)U2(pCURJ7ZJoxxSNPnKpZ~;Qhj}8JgYJGq;}BF`bCkO*!h?NSO_?!?^D~F( zrFFCmEgZBM1&W1$*Q*|>g{w3FhdP^fTcMG&n)pxsVGH@+%k0~L+ILNg&qnd@=x)!( zjp~+LZd#XUmq$PU=?}0-$o>U7o5Db9n!@c!0}fR1Z8XZ;O8%o*Xo&y&8Ad}aX8)Hw z;Kn}C@^H?0a(c=v6$7doRxS4zUmH*g^YV0O$_)Vv8US{O0D;|>lMpwstuK!DJq=C! zh8?s0rewX-J`ExRnS80Er4~GL1W$u2Rd#Fe^Q$>sQQKCc?dbIXN+u>G`R{z6E=34B z3V6Yw_DlSf6MAF-AsWs5N^o;HL&nL8-F&jp)bYV_caquT%7)l&>#e-J{B)x$3(Wr{ z<3OWs1<5#l2tC=@jhzb=_pb492Eo=p+JdQu>ddLl-+lSfj6(BY{UqQOM=!F4i~o6L zs<9&Vny)P+oHjZpwa$l&03w__u?@iGU6rQeFu2Tm&jB1>XTH|f<9Z`O!*wGL2ILAy zpbu;f$ZVmZNQ3Ii%02%-5>pdptMMfyXC1n`QsX(gQvyWa$vP1ob(DdD08XhfwSPXI zryrJr&z|(MfY%9$mUGonF){Y-ms%xnNU>6-L`8o>An-l_IWJ2K#(QvNWG+x`7&PlE zRlcaI;<>uIf+|#n$tYR1)k5EVo&9?T2BX1bHUnehn2e0!tK+ra-rhDQWV-(7G_u(V zsN>PBTx|`)nO*gMxzh3yi;fK3UG>ZEcOA6`V)p-ppHDwh1^zt|G(JByb%3gT?fIm- z46d`s|B62UUu*Z`eRw4;!%&`m*7{;N9o#RuiwSL{S2?9=ZBunBs*qLol{cOPttYd_ ze7D>yD~m@~b?unKG%WS_4$fM&`;Ceh#@S3#nB%NG_fBf@j$#(ZHW{H83E;YJ&UXdl z`iff~Ze$}#|25P!LjMzwgiP1jQ-LIKW6}LkcwBn#k>cT-%|l6`@GHVitpW$Mg3ax=x^%S48}yB;#( z2aAkb)9?J*yh~#n9(5jgN6I#RS>q+?{_-OiUi$C%XwXmX(O>FIL1wk>8PZT>%Pqm?fF2Q#2tNXo_*2li4LTH5#Y^n7a{t@QL(O>^_W zB3n+EnU%$J&VTL(YKM+Pw{PV^rv-8c=i8<9z96O2D*R2uPkw{2oD5ssm+)SxFe&+p z#I$8BEO78W>2AcDQ)M$2K**ME5r1 zK|duae8Z>$Ji=A<@BD00*Tul8n<~Nx8U^xa>D!j%LkEjsZ;l^_w?6V6#%G zcX&_YaRdt@P_UCB`T*rA6*PbnyYDfBD}VY6t`hxEpJ0I##m8}05UwUN>H6()jvC=$ z3o0YrRbF;!Czwa;7(Aonc{XRJV?@b`H6sENHJTI->&>-DAiJ@|q*&GGO^9nerCl2v zPp2z0g~O)n9ck^MLpimziEQSRKS0MCXfs{wiKGHwXPnReHQmS}p4n!k6OLXc@yj?X=%tdro&($QKne%rnQLF{`(L_BN~)zgurQ#@ z!CPFRc`^UsRHtf*P`r(gY|~N5uwpoC?0nDTA1zCv-=BJs_i(p$;W;U42G4N4Br= z=KU_AY0rviLR)cA&dMsA770 z(`%~)^m2e`W_rhAW!Ug57R8w=n8s4~QRE_H4bIjVdovxYz*-92Q#^sbU*+W|mE%B; zoVVg|YTzRqW4{VN0q0j51lvYMUwce?X7h5)Ga-Z0cIQTjj%ws{;z$IkaWYDoLW+u9^3oSbVD`QU4a4Z9}N3sh3F}uMh%tM_RnS z!Qk|22XHnvI`!&sAXNc*3XC;M)F8MHCY3rn3SnX4S`7xEzKel?mqM;fSgD}nw2O(1 z7;+ID?%2$Rf?B`ANb#_I5TR)xfb>>K*435k{rmUSq3s}40$p_iP(!8vqxT@)mXw2y z?YweaQCWGd9h-TWy@u`;xR3+YJ?UH)y=Sa#DMwKl^Jwt(r z#^1?Q+NTF+Baze>>*Kr_f}+0?h_7PnOc3 z@aTKmfLd0|neuP@b2VAiNO^gAPmwCLvCz-&nbY31FT@nQ4<_CA=VChlOf7WKf%#7* zz!vdpD=V`0W~V?*R1}8vecm|}v{hWtyoPFE;)I046Z#+JKi+LA^LpVU-B zE$@3rUSgTBdLq}l+>Pha-Q!L|) zj`&aQkg+mF*~MHInF)%%-2{}tDqo_Qq*|qj3 zj+ui^{_@{vhrY_O@C?|Qe_P$BjiIXifkk5oDbG++OT^4tK1S*K4nJG)o9NMTPkWSq zpylu=K`=p@#(Hdkd{h^ZDlQ#uNsHrubowq?dvtyEgCJetc@3n)&^9g0f^wR)>tMJ5 zh8UB08qOBK)9kgm`86@-gQm{3BQX!a>#g{wh2)NZ_%d#G02;0DuuneWrB~ouih%d(ZcIcY*HSSi%_ksPoYP)R^tMmiYg3!aN#gKySipmA6q9ZP#XjN z-hS=>`3G^Wy#F!Pm zDe3NSUGBZ_XFuP#-yiRvcMQiKdt6*`p6i@z&SM_)m~-W7+`sjg0*X}>(G&Jq=R10C zltO29(lS@?w#7r3QYo&xi{fUhQXl<$Re=Ni6L=-_U{7~*#F@!x)cGOiGR>K1RxxwN zEEZWJSGBJ1&aa*_@MM@p|J=oRuqMJ@n8w^eF&?=)u-9!TC(N@tM4g6jIZ2>|bCh{@ z?H?8)e`j(Ni{Y6v9OgH>IOoZ8*P8#6osFe%rCW`@dlw8@cBX$|ca9+9U)=m&M)}*; zXQ|1p7U7|JTE`<((fY}8E-BORXUOyI{yxj|N`c&ir)}oWGqA1mrH`ePauEmNHV&OSV@8qxIF)7_XRR4(y35aXk-&0g5mAqx5B zNQ)-R=fUaLg!MjPo^H?QsT6gsKU!6Ov>o)FtER55icLqGCK%(ohzc=hI|AeX#HMiq7fIbMV^8B|Ae{b68?qNE z>-mLepC&hy&PDD>HTc2sdbv5rdtUZXjmAFjYvM}H3yG$Z5jQ3N8O>h^PZ*>;nJ{V5 zSgXr)e=5GduCqzlAu?+Jku#>JT75fCqq}=inuBw^c%S3pzDH;oR?MY~M<;@SbWN4+ zxcC_J=^JxZRB8Qd0r*_h@C#MhgOKOs3G-z$azBsYljWG`9(aGIo_&XaN$$-BRQIgU z%xnFzB%%*b5uTf={=VSKW4{~bEt#bE_+l5@0Lj}m*r=psqE+tPJQ;1zw<#*(O6-Ey z9(;;a2Cw}nCu78zidDVf!7z_?hejz!A}D+8BMoc9y^T~%aFDm2+U4VVQ!&2Vl97Ng zOj=`K&rB+bew$q556g3T5<=}3S0^L7sJs=!->Y7@QC-qKm3qYU(t-Rp*7>aet84u1 z>)bGfa4=1TH&w{bho7eq@0NP&`+CYHBC<%Q5w(+)U~6&a%9|H%4c^n<6q4x-WtQ5K zZErixJ`W$u90(z-TaceN7hJ+N-3Pz8uYx3&S(gSCu)-VBiy%BT!t$oyDwfSgn5+<7 z_KQ$>d_eP3ea0=}v0+1T=d$bK;`>n36+~JMho|Ok`e7KCMZN^CFLsM)H0!hw3s0W} zqriiu&zUh(|22Mi!7i_FN|!IyrB5wP{jyT8--brHF-E3V>Zg?pMmI8^ID1c6v>D>) zhiUr-OGn|NLPIqt-W1I64TAXjJ&+M7vay(2U%A~U5c#9OV&nfXj(paGDejz6ZHCc{ zX%S0lrxnXPI^;}p>j@Dv!hvfjsWo9#-y2*z5*~1dz2(c?ZXlF%CXo*}Nq5yUU7zmw z`u2~5>mdJlxYFhZDtu5g1>7*G=m`#IFM@>a?&hNVQzgiKg#Z#)(Xz(^0!w}HW*B5# z)<6*9K^&Q>Hp2!rVfvH^S9Vate-BC^AgKXcL_$(>m^0GVO=YN9+{Cy!(JHNyZ;d~slZ*1j}*Bf>L^FcT|_p12l3U~G7P%pmq z=|!F@(KLD0Luxv9e;T*7=V-}WAh5}$&s6jOJe*r)Ozz3PDxDysu`E+agYUL9fsc|h zIXS;ipS)aJURhpJujwJM=$_L0YRSLC-sEjTVGt?*H~iRlU+AytJV|G^OPsrG*QaL% zyPtR+3b<`{!$F7Irw{24p@hue;N6R>YXY z@XrcP9TMK2KD`Tu!IR1s=Dec}5I!ij$x+PK6!Dui! z`M*!TB>#WOmtdk*Y5UK*kMCL$n3*_xmj@vgKq2;JFE3!uS68!c>0_sVF*DyOn&*^L*ts($I5toQ`S0~Nso6P zn6EkDAdD+5NocUo13K^38C9}GNBPcwJi+tC#lGiw_;EW~OBVttYb14ceXofSSy4=$ zHk8++=M3v-T~}lF1X|OiJDNLxBv_*3Re`F@A9sJgM|dr)mtx(xC@dx>_Q86&f{s-x zB<^GV@Mb$xD9D7`b|c>-tS96IEm}szec$rCj~IK2i-!mFwkYkdfi>$r&LoU@xT1-Q z`6HnHlM*sK3eK?Zr?0Kzw)|i0BU4z;U+g0Xm=^PYWFL8yu0M&26PlIUxt9fCM|6*y zsw}N8)GPM%*B!QU5zl4~Y0Jo)%jZfjdrC6B5`^t7hgkp3Jv_77R}}v{LH#>OK_k_c z>fea^uhjMLzYu_yng5V(|NJGxC+e>)|F4gu3EDCJZ9D(`4)pDT&qe>Hzy4x!{-piS zM%(_DHU0ZVVs4zozt}|Itq&k~XAIi2tJjR}a1a#{LC3>KcAfN=y#5NYG0 zG?32<7u#lO1ppx3>-nPolNnGOXy2zwrf|}mME%Jr{<+UTSNH#R1^(vd{#vHLu0t4J zpJ)D6O7qeeMNGjye>8c9|F!Ia4rKKI?GcrKeyR$x@qA(iwfkElI;8t+lo&&aSu}a} zAASA>1#vlFk%+?uj8tQ)c&%h~+|RHMT5cG`A_zBzcn%D}@Sb!VsMZ2dGB9@AV}3mQ zbv}S-dU-;`=kgU~6aH~=I55}ed;OrI2cz2J#sz9YZ{Jq z&QKg???kJXda0W63OeY-Hz4;x{T@jyRCm;c$2e!x)LetP@=ZlMJumN>)HqDt&3^u!+SQN01AnZ zSI%6vCkwG1m)#w6=Z63V1Vmq9V9*t~3qZb+R#`FnM-wm(+3_JEAvuFlq)f;@P<5Ee zSk^e<8uyrkvXTBIEbEi;{@c}~b1m_Y^9#oxfNuw;duDe*iAh<@jOz@>s{BdkQoFLfl#kN#R`~*9 z>c-itm}w(bd3N8gVVM2?z?e5yJ0L%gc4Fo;HBiE|3nltQ6ASb5%EIxv^nh$~V6Mg8 zb?c_9OLP|u>?#M|nZCcG2*@Wjz!h=p-h<^;9Ts?SE9_^WqpNyOz-@51@7UV7H9tEs zVSt5&r3U!Gnk6vYlYMar@ICz%bp4wrYM!@iM8$ykbnM%MmKQ)xGvj%bl}rtwN7ZBm z?y8hjRgKkR4BdhBVoH*+d18mf zm^$e&H9f82uj~8kp`GX+t$h9!oon0nlJh3P?%l<5EnR;FyVa7p#Y|bckY=gkB&#Y| zrvANA`UsWS-EY!P%{CPqDF@EKDu?+i?X+saKW(=o5i_7AwWw$TJ6YM#F#8N}E$Vu%ThjWi^OWaQfX({;PG&UEoL%il+fREA1*Z zN$8wGUt%ItbHKgBHV-%CcwWAlhrzEk!DtdfGQVy${j{aW}l#>?bD zZ{1hDOf*pcjkM)S2S z@6l)fZ1R!E+X)vDRq1{VujyZ0-|)($2K-{E-#lMf<^%sWW##1scc+RUQBhN;S5;Ll zxi34dg;jwaFaA}bSUGci`_`&S=RH?{Umq0%Ly6;ZdV2c3yK|{E>TwsHk%GJi7p+oE zZe87_N^B*NWNI}!XpIskg((g75q5uTHf?Y`7(x}ewHA5EVe1TO2p``)1Jx54z!_(Y zguFDaR{ttN?tXJ_cyqpI-&L2RDD4F{*GRDjhbNaU1VY8g*t!C#F`evtfNQbxjV-KA zg5h!8&jRxrV4$4eJp|FjN^|I3RO_ag`aVS?!t4Y?B2zPRo>0~hAUfHj><>r_3sHcMF_7B38D4!GYe*hFN z_)aiWE?v2Bw$^Id*M`^z5K2)P)N96pAvI&#(}AV&}ebKzql(fB*TB@>$+br zHg|;bdITx$5Csj~4;AA@hGL(O_$cq!uQBK^aNbVtdIfV*P5VchWnNeRq`$b+C_y5g z?!3A{wz;Y{pT(%09RM{@xqL+sw>t%zra(tFxKk9z1siyn*4twwP=d(-wb;19PnLB* z{mn9xxVX5W4cv8gbuRr}Mnm|ZW?a7!qXCMe4WIf!T_s39U$}Jojoam+I+3Q9I4Gb0 zTy$I}fBo9)`}emLQVELsT>bt1&LF%YJbU(WB<%kQ5yoGGDDFD zEFDoYkK-q>b|~l8+3C9$7TwNZ`XoSZ(7~{vrVf_)suslO6M?#VbzxD_3LrT6K!FKr zH)((-12G+#07G38=;TDfW0zG|@AE~#ESZBS^Vb#NJJ8e76{+9d?i7|nYs&=Ob}OK$ zW)Z1-?OVlxOLDIqCW#G61@*Cwn}b#(013ienkb@!JnwdOK>UsdVB2*3DV=JW7nr2! zC7sMY>6|J6bjk;<5B$L5K7tSAP3}-=Q9`xkWxDOS27$f(ljn6w7DbZ9nBbO#vgMC{ zC0aqpX~ijuEwgsKBMNwRfs&z%v9$0LVYv{sy1Mf zC$O>5`91zp=_Fp~F;8SfKkunx4O^fP>|b&y`eRV6+3XfVRkJkiV2(O4xysRq3;7-4 zMu$Cy-G^PqD(D9*)RRYyS;7Bcc!6+d4G<2ygm)`f%^K{H_v5D$PpiObK);=cr$u}v z%(PgMx@D3?v0enq|7?7I_&B&SUbCLvR})XE1f{R7FmhM0$6junPe{`N_{ZNQ?{UD^G!v%(b z_5lfr(?Rpa7Y zCSVa;C|!2KCCRipK>+*&8yItixT#D8)dQ%MtOHs4razwLYcjGY+49bE8?3ltIANkK z5BIKM>BY>=e=DgC+4d`)T>$JF4;~Xb8roZ+WB@_I5Y*xz<1y!=(Sfa-+NJi3Mj+*e zHe9HbYJ(k@Ef?Vk93Lnt5LC|omg%`aEA@nK6<}50J%{sl`IpP}#d4$)yGAp`u2y_d zw*Y#`B)4U(mIk65MyeNxcH9Iv7YD60`@OM^VfOj<89@J>>UkfZo8l4-_8UOK_4n7i z+jG^sSjABL0ugK$bpHWzQL06HqQ+gJ7_)kD8Bem+;|^NI0RUbob95wI68qsosTk9~ znwr6AzPyBeuiic*zsiKMdQjN}ya!BiY#P;3HwAND>+f|u^X*pwRcQ|DG2KL-n!q0k z=gWF!tbWd-5bk8YpblThmX}wjpm(qtq@ku?d+$Nqy^#CNEV}@QWZaQH2}KoR@vNSG zsF{7e0S%%x;WmsGy9~fpsCqF49UXGEyf~N#d1nP%YcW6d@GDCqI|HcxVeEFN!hkyr z2O(eTYbAKaxOxtW!6@VHt(*S=CV^yT(AP12kO$lXq|Zpk-Rn{X15mRH&mg1T_gh*K=8A zWe260%43xKKHdF-b7}Adh^eTaWy|-bz4PI8I!s$A%WfVuShbpT(Oh=_1&mW9Ul9U8 zI>$A$6wU%1?$=3Cnpb7*fgrY!)G?1$RjVEZ}5S}|~l}{5) zf1CfrZ;WG8w~?KmnpbP!2s3x1t*P$Q)2DE0h=^HQi7`~LU#Y$#e(gKimGEZ>2jh5L!hoy494G{o8-00X-53W6+oY zv9+z=Z`g%S)CFj$sX%WZn4rmI0T!@lkSTn^4% zoYj?FCMG8jf=o9kEUcOC#Lms2XEp`;^$s-;RJ)MRdZ0GnS{FKtE; z@<{;ji17URudUHcaHvNl7{EuNK?z2E>>La>fV3Qhz{Nb$7pxt8SCHCrhH7aj3Ig*# z01AADjJyuYS)XRgbXA(9CmbW{G&75VDd(BpnGRgJ-|gVdayi7687 z_!JdNm$RKt;Cr`cD=7gS1WWK`Wo3nS%%P|lil{&U+{><+^|-$>;=emp0P>DLcuqoIK9(%?eX?DUb?{yfI%iM%~Ge%N#$y<6Cdxa|B~ zmIeXwbZ{+A{wX?6+9_p00e@VqnNSHzJ$r!;9z?6h9)wnl>8D_{iGrs5kI(ItTjPB4 zLq@PbLhJ^nRY4sQaNmMLLh(Sw2cum0Z7`7oJn_KL(Dl#ogs%Y>{6?#Cy%{$PECf0V z2>>3j+pUNBF4CrVA3>uh)E(r?q*8!_JQ!FI0-};u6eK1#77SIA5D#K3sWBe)2Kmd^ z^S$|L^&ujU%QgWHDT@tWhu=8Rpvq;x^WxE?M_^pCKMI~hr`~)0ZH&($RWC#?wkez}(A0e+{sI;rctVU7XW-PIJ{0wLjK708HUC5+7k{*z~l@g4`j6R`5or$H$(+P$vo2n7lsxWSJ1`QSpsoszv)EU10*c0+uU;b zEKxULxG(FrD@4D#9Jf%~%c@SXa57jheFXqT%Shqy(L{wMjgWs8$ z$|+W-+~F>nyLXVP9*jvzk+!rfX$|<~1o?F_KUX+SN($FzX@tq zBcPUI=Q$mgD5Bw@z4ek8e+!U;09EjbfA3$8{l1!b+Anf9yO<|S^Tp8jg$^|?QQ*Czb}`QOa1G1X@!&wTEj8hN$RwXD9fNtO>e zb?VdwiU!NZ@k_Y7?tAn9^I>9JOr(E(m?8Bo*V7EHJo@z0T}-KOLOt3y1r+o&0fT%O zCm}a@Nj%F1WH%+rW|>!-*#Ek8pnuXYjOjT;!OqLOZ8WqY03qlPXxQ7EM<8J;@OjxF>yzoi2?@}7+0p!g8}6zOG|*))TCm2n$55~d9}HYt!3>gjgsI0KWjbbKgRyG zCLL`xAwv;n3BrXg7^pL>u`g*z^#V)a?=?msPNxU;U% zS0KWA2M~GSRI3jH7@%5VAYQ$PiqH8S5dE*1KEh1vc-}eRELRvJ!2pE!3);E?YU9v` zegF|*%RuWC$S|RgWpAz;778h0zzr34>3e|dR|D;U9E*0CP?6}$_s_qVTZz1&*&;Y( z0GiD1Hy-eVl^O)U1Z};2L`6fh+Dn-Vdb;>Qt^yjiMbU6^`#>ss^@q&*G8VNK&Bw&^KhFT8}a(T22TLCZ>$TuE2ZD+?86dyq9 zZ&4FrK(?c@>%;wBKvUb=nh7Y+$bkWX1`GsnY7A%^LO?}@UjaG)y#)ZtX zGgSNd@pV*G)bGW{Sdd(eR~pGYTmx_g62xoI(xf-V>>xG1s4jVd_#g@ShWZ2Kl;QyO z%2K_+=YseGmpEEup#i2sAiM>1a@fu9nQ~I7Z2=z25PUy)Ruy0nCbW|Ypw2&q%6j0n z3J7YoOLIZ-(hIC*5b$l6u1iDQs3bTa+a0f?E?}3e6ta1Y@m4spc28Q z0kZ;$prVEmAWT*1UY;K;4+A_2-KEez_XxgooOkcu$y5I+zC)J+?4D;fgU`Myy#70A zwnE!?u2w@BF9C7%2&&D6LFK=E4KBd|bof9uIABI62roi_Apz>vmX*5;Ff#*$ljFVG zj zuxt#3f-up{bYQfA-~0kx29$!>BhLF1@&9ZNU$p7RL7)DHLr1hyps6i16dB|%(8;pE zGjqa#z$yy%CI|_~plp>0axuWPfyyZM9YJZ+F(R}h4)|dkLV(u< zmIx+XAReA!KxORc3UH#L4Oh`CR{B)-03Vit)aBsooj#^KuFui72xdB zKw^xoI0XnIAWmjH1Zh?!sQf~^t3YP-JfOWbT)T7=lXQ=^h5xf!V6XU1;OeXph zt)Lia8s9HBZvrTJrESC!;Gd_a$y~hW0@w|y!d-?Tc`hIwB*(AciW}ba>^=pU?iqk3 zfo5tC_jlBcj7H!(tE`r_r329f=fK~H|Jsed#v^}{0_t4Re@hhpSY*OW@xSJT{QED$ zn54G3EUX~a1t*6{Pl0E20sNp^H-km?=SK-)+75b>I|t+vi~A} z2#ON^M|1l>-@(fKPuB6bnLw{2kb**1x{a-8@4Kn(>QSAI^Mo;*DXR;nX!5n5qwnJC zTQl~I;>(V;9+Lia(M&km%uzh|n={U`xd|L8?xDMvv4h@{R$XaP0%2$v0Sqk9o$*!8 zO$R8nzC~2@Kwbqgn-o65rHyAt`DF}?VfsI}2>wqKi7d*Mer$_5{%oZ}&*l}=bksZh zd3w&OPoZ;2i}kq0ZJ~_0t6jR~t0QrvW~XrLHK}!86vHH)=PNRYRjnpy#D{XrwQY$Rq8fraI82V{0rc{CZEGaYmdqATNPT$AL0ua5bt8F#^fj-8S_`cZS2Ps8d{)QDe6oQjepD#hbJZ8(p% zPFJkGwFBn1;l3NzX0j(Rn|0una1ljFy^&XIw$g zC>?TNX7>7Sdk644td+TrY_m@CpBPKU4SWj4rDUh{f@|i&^_dTzB=MuC}Cu`Qam?7!PR8PlMZX?yKOLKHKljSM2PP7?KS?9rl6ze_GCicj6{3Wi z4oENIlakG1P1|W3f4_7i*kRq0^6IZG88Y}`SiZ^{pT}5A;#&u|jl5N?OecLf7*z=S zwh*?kGkmV7^*g8HyG*g&@|97uw&{SWT7k^xxs%>c-xe41t6V(o?zXjRGPUDIRc?Hq z*}?di%ld2o8pnW14fComQZnSN)YP~-$;t6K-Msl1NjFMg`_{dlzgQp3cgHD6d;R$F zSE?5+!_C@}btENR(zMDE=+W9N^%xgqf92nQ{3`fPRk*)kQCc z@Y5>es!3(*wK9W9lkzp|`lGaWxf~zE!`sbACdvdTrv~Wg9C)N-@lZ{xxM6d)a5BQU zC#r!15rk-RpEranS&(qOdF1m@Xbxb#ZY7V6^V{M{J*F-+OnqUMacr(PfigWmo*ED2 z8+7cN@x^r1+2OY^cA}+9SEwnB2djQr6R%aVQ@BVK;CWey83F(MB_4w0;4BwvVCV#9fNrSAcAI%rUj@H1?bD`&&0rmV3$Ombk1CVtRTwEtC-aZ5uN61$&Q5 zetw?`Q=87PaZ}=Pz4o7WKjB!_`QS2xj4Kh6b4+JqoJjt?Agg`R!j_~E9t(q<+^a8j zY!F>>Y0kvFQwzUwOY%j__Lr#=6>2JmQDIdbiba#$=`Pk><_0-))!Jz z(vX6uM&E=^>XK$E`Sg{SAcQ%PL=*(1zL2{htQUkE$SoTf7?KZAz9FZD1?}=D@iT?o~%UOh=idlu*-t< zO?&Y8T3bq#Xbf@KRxoldA89j5P@$+*IB8dw*q+13-huBsrz-<}-*J;A!jd)EL{~A` zHYwHl99YI_F>2I{8RK`#qkhV)nlg8Ee4P3`{zW`z(XZQtoUQ%6s5d$rLj}faueJ7% zUWj@RL=>}>=RzNe?LawVn3 zw>U*Sd+Dov2PHB{b=>M2bMgsAfO=+OIR}H+P}19spSR78#oJl)3tqTkIV{w>U0+<- zg9@i`nQ&3ISS^zr@YoxXBD&vwg5Wls3WwqXA<@5ABmqi-(y*y#q8E<`-!&l@z)Hqc z>amd`d*!Rxt~5gnt{Tne8s`zNV)@FNA06h>kKZ8ADPF6U`OV;VP)q z4wy$5YasZp;HW45Y_tqr*62rGxo&a3O3A#I4WB794hjw{cBKw%m#xn$hp{nQ?UYdw zO#Pxj#B*epJH~;INOk+VUt63>uMo&SaUD6C8>nmHWL8h=)pcMJ7t9S8V9Up~+6bUy z{yMoQT{LYi9Zv2{n&etXA1cnwJzUMYugZ=a&I#+}*28+hf$Xz)s^*5RTH#3+c;fR1 zpRy^`Rk!uahuSW>X{(ie-g8D9b*GBfN%^rD)sijZ%vJPWe6=`o+wBPQ;BujSxCcKF zSM4iR-|6c>)Yq}CfPnh92_T9^~Os-6AFV-~qVqcwblr_qVWHHz1HM;cu((JiomYi`MVm?c*3FYYa z)j6Ey(eQ7!Co)?4bRW+eD^s&6B+R()0pT8A%C@Kz&>!{S*I-H|XUFbDU&P_k#aO#e zQ3&Tnk`dsHE$*BQkIX|jads4z-s>mari*QYdQzB~x+AmS%Xi<$W%!rH% znQ~qK34e8xO2~h3Ql08PG`0bqx$x_vwb4iH9>+&M|H=1+JM#DkwYGeP-1@az*elxw zCm?v)S(Juaiy(ef*>ou5U@c$zPLxM3ZbHc~x|pCcl^w~;I#5cvFD+I`Kt zh2fag7>~8=Kw)zx_#wTzw8qQ^o`y#xRuTyO*V-7`MaK4GY>__U~IvKjNyL8}RQ-B2SU_f+lXfD5~ zXkU5y3)Sr>7*8@$sqaWX!e@q)6dq+*+*V&J8uoXBDt zX8>2kfXF1}txC#!A%gDs;o~ed^Mm9cV^5o(Ej5Q4VSMS?YKi3361qi4D$gM+C(|Pd zLUKWGaz}Wh{oecO$txB62lP)%s#Ybq18T=xFB}|EOI_pt#PDW71RnqT;iz`9?c#D4 zdhAI!)xb72tfHjBaV{f+hGl;r5>6|i-R>FV(P0~;04+ej(Yc}oBAGb&?#N18>`HC- zWY4A~aI7h3rH;FgXY-8}g>+!CEe{j|u`+(?v7p1XSQLL2+b=Lsu3XAvl>WT=WzkUO zZgQhPAHBbUnIS|tYzRl{gC@RzNZjk%UmXERv4wiArUdGP^_^qsT|w}u46#Tf8Kd{t zDOl>6uZr0)6T8DZe{~s5!B`flwLGbuLkk;C4(fDHcRl?m6GAGzcT+pR_o({0{)bSj zEz|sXU~ScK7JTJBdj(F>o%*Dt#eI)+3Cvs`OB>PTA7OKEIu0^sdo@b%j_Z%8L|~-^ z8&s%gzC+2IG!3F$Er`{5Y@4(~EpRh?gfZiao3q0}7q79t@IC3PpIZ%O>PpXj2ZfZ8 zW>5F6$q$km>>r_{Ydz9xKO|vITL@K(rjBRkKiQ?jz)|E5>Ny_GF6DRL@c*iZ$NrLB zDCpSDiIJ;vPUg3=5_}d6Q9ah>cO*y2p|>_()cn+RN8Wf6jIhTN*DF3=uK_RHGu2t? zL~i@W**FN7B`P)tH3!z7krr{Ud;M#9T!vfk95`Pjvw!u#`Z2+^wBD?kY!w57t;4qr ztlx%LMQU_ad%15X| zGrs5^c&{dW-l9hmRvubBCg(UUW=4%0)lrv+_WFr}AYCeNU9i+spL(9EzAI~W)v8>9 zX!)wQ#EC3>3#aRXAEIbL^Y9!U$;Ib_mWoGdB%Cv~^ZL87k&A}-58>V!i!bGk=zlbn zq6s!KL)0-m305SHr)x2HgCDWNVQl7| zscj^Vj(cU=CeGaQMy}FZDn#{%>JknbM6SPP2)A3KK+e~rF?g?jWFv~2_hm(l^TBK{ z{TPdZ3&!yC(Z>u$m7ka?T^XPHqOs|5mrAjq(fkw#KC_PIYnjegU;Vv#~LQc9yWbMn_3!FPBS$oUM`P9e*2)e4nrHw0;BQ>GV1QHP%D% zzyS&hjI|AT!)bq+qgJbn3i4YuH=J)kxXZYbu#fJl$@vSAu?v(_Q-$-d<8vRuy`02h zRyluCl7u;J(zbdCgBv<3%D^u58_)}li!E75Ufn^9rfsHPI*ub5Y! zFKD;4f1}0ljHXX_>C|sMEWWcFZ~FMa*E)uBaC5gO!0BR7_1dmJmSbuBbE5J?&mvOH$z;RT2W0Ke6O%-0P9u))DMmf5bxysT zytJO7F9U8L#6vFi?jU1g>u-$O;1Ip^3l-v`7UN_2HT$uNC~O?}-BN}Z4(7!O`n^d} z;%HpcUv5;g*<#hZU!yDS1_9Se8${k#ertB7&ffIq`I4mWPs`U8MDDW#!BST*b<-OuE4IhV~tBqM!2+_IH!+zxw8)5jm8KqaTQn_Wya+pjTFe)^j8Lq+9IQI zYN}JEKUfNh<`rI6ROhv@OxPza;*9X5$|$c}BU8;-{ET*Q#u>@g-EnCWX=rri`QYY?5Q9pI(ZCtRbps7g z{c6_`j+z|$pYUl^uEhC`@JC%@g_o>NkOx!Nh-P`w)TVikVxg?9nFK{ zTI{3Cjyl}fJBLFUPnL7Ql^1E%e%3&4vC;6bwI!;txJhXbhya>rU&B3@>qQsI=6Ps6 zH^Vtfc>kMx_NGeMHq1i++lAO0G6Qg6g@~vN2{RlUVJxhfI!k^Hl4QwL%H@cn zhs>F`vJ=*r{`mA=5Fr z**#v($fIcYh-aoe*q(UpJ^pCCY}%d|b<@qcuq8^%ci0}D4@-nd@va`-1E|v#x^0|- z0up+n=d&F;sqp&DB6+V>L$-Tuge}$kQ76MK7(-qj81?w3x1=Ps!QEd=Bd%Th$|^?6 zyt95*ut3z?-r0b4^NPtZqg2ewn4?P?=R;e=Abx@EtlCf~<}229k5!cb%$uyz3#%|h z_LJV)MJGC4CIW9_PM}SvPmwgoUOoy-9Eq12KQJmA9e}OWM2=G&t+{rfpN(3JbBSf_ zopbmutaq)vUlq5ihm}4#RE(%(P3)(%X+Bt8X05RHh8o!d^b{wqa`?Asc<&=tlL--rtN0?pc4K6Gf zH~}oDQ6euQQhFBAQ52?;j*qETIZ|sOH_Xf?h!JP@M^n+%ZZRs|?6WO|wV3dE45n%u z%c73cvMx_x(VOe4B{|*qcSNYr<{F6_yxopz9$@?gRtM;PS1daQQ}$C`)u6C)n$YY# z_Q{hcOx7!V_9YzK`9_zE$rtj9io&Pvq%d3PlVE^fXlN6o|MH?UA=aoQwD=UF$> zYz`}BHv1BPD;$kKlIq;;N{AQDnN)E~?se-WJ;<*X#n3};S-0yv925*JBxQG5IMXSu zZv85cK5X~xXn>>Ck=(trpGi$ED2_&1u8__C`3BvQu;y9QS*d(vqKsTtjrtfP>kkft z!}=BvU7Wj6AzBZ;_{}GZG>SB^n7Jq-*obWn=^xy)@W9+JidRa)!piZUtb&s8$GwGL z>Ue7`(RWF@n9F4h1qc1?_wBkO2)i$R)#wJ6WNesUL=C6ky77zSbRO&%U5b}Qs<!ukF&g7mGtdMTjXWQ&_cmU1cPJ;u za>k+Ur?3Wnj-t`|a@{NE`^mHI9Eo9Gn`L=vI8uz}%f_Evr<(}ByBYJ#d#$F<)WecS zWP5z0sN@Oi{-C&&w%8gJw<|de_bDZr9i4*J9ywkfLn@B#2Akcu?GJm2?O)7Q=*Udlw=m@}%$-1#t1Ctt!e zr$e+QC}T{c$Ca<{nyx4qw+%kB+_a4A*Xmweo?EeVe8{L%Z`G?M)Ap@9PBI`@?5OOZ zE8v4Tat{p=mE>E!oNLgQIAV?q#X1@YW8=fz@D zn)oD1&mP!ad)-_ag(%|gg4#2F`wh(8<9+(XpgYTB>ue$T5G-uON${gOR9vGId$;hm zi6e^8p26pFZZZ*sHiGuaVx(%9?|ko)LVpkf0%g^A5zB7|#&YlYpNgzhS>&vQ+k^%q zK2ogOa}`)?*eu(h|A9MXL>vG?x?9GZB==oh-YWi*o zi`h=3&8fKUrmLS2x&tW^h!&!4MF=@3G(b(KF%~_DWXm&KzkN`jo~?br4i0uJ-e$L8 z{otbaSjXM4efR9x?@Y3bk25AP(AwL_$N6;F(;(X74Piv?&>oa~8*O?|auGa=PM{UV zdN}i5Qo3EQQnxZID(TZnHsS<#MkZ}#c1uTo_gb6&@M|tM%)&wc!7t(vQ$rGvl;o9C zqRV-%3hA>bT!9g1@#`OG*%QAFtQ)W-W9{M$#<8L}va?dWxu$_HnM&pJ4_Ry5t6H<> zwC4OhQ}ik;Xa24^(4IS4k&igx?d|yPWQ)_U9x}E;@5Sv7-F`Bz!5vpQ5sU8z6JGP8 z>TbxR%m@aY1xC8NuGCLqgph5pgsNPV;>o%wzW^MptPE$;dqk$#1z#P76Rixu+|HsS zL7tiMV*WP(=5}~OiLWH%YKKJ7t*X1Rw?2xV_v&iT#p2U=KhE{zvN|yO z{>-OU;ySLlCEu6V2hO$-q=rS@IJ=67_Z;1og>2*acIj$Y@i#6|F=`ZwaAhFvP zJqw0#Fs(&VH&vsOG}z_L)C3PFwXFXt-y^EjbLG@(2$-wEo`BbmAJ)Z3OLGw(kt*`!hOQ z44eZBHskc%DC;A&Xk*Iq%WAmgnvtssjSOV$>dn+DdTX`hQj!NIZ${6y7hc=*)g3Sa zAT^Y+hXtQtrYlzy+|o59Ta{WmJzIF{+kCoIhrKfrOudkLOy2GF@mugm#k4OoWWbIz z&6>1Jtt=P1@9mZg8VdIT%H>Al@jhL3|M_V8P#$p|P`NTwwn(~99Gzfa=(Y}W`MF)ra!P~9hw;$J76QElYO z(cP^p`JsFNe5K0p%csH?fiU9mCzXsh+kGEi^N$D3#l8QOG1@xxl$?J;bQN=eQ-Pk7 z&+>P?i6TLnTJf7`G%Ml7NJ=4#ALbvrEzd5)2hG=~e+3c5_mX{@I>fr>)C-kA@HIv} zwLyp@$X87wOq#O$QaqXQs_XK}az6<>EqiQ0ANr%!({GHm6A$tdB3YeDk%4b!FSH12 zVa;OJl2+14xw+E2V#UZ(0t=;_&^}DI^^scVtu6*UH`T%5;N5!cfM))2XF*k7A?KrX zZ@_!laz;w#L&41+a^J>i`5wvm{#3Cn*|eR3NQ6o!hxgA~J{t+)ur$!7l80_wX$G=( zvAoF_Xt`bXh+$mn_o9q0AfNDt?_jalNA!Hf9O@lu85+u*Hm@RA!z|vU$Qe5!z|f(F zFK9sYMj_f|vax6{kW9Nju|G*n>?qbPaBC?wE;bqmOU||a!+3O0GFxnb7@5*n+Mr%J zG<-I{>62g4+=lpXAR%)0+ntLF@^Sc2KYrXPvKe?E-!bwPq`lz4d9tM6eTzGUtCQ3L z&K}pQzc%v0MIM`ueO$iksXkP8;LsEJ?XWazhZEfqQeWw`5s}$L|D1BCM7-(9fKg|7 z+NDo9ve{QgQU6M1(!hD^V~+H7@Fr!b-t(WQulT;UpmQ1R3TqkW?QxP0G+jdY^KB`a z?XGQ})u(8Peb}6ggG)#ttr8ffaPNL2ULGeWr0ph>5qgHdyDS)fBjJF0&L>~SqP31NrUE;}q$ zgo+TQ9iVqc%kWC9o>G%Fb4I(0^1lUo4O}Ul(g8PguU;AH_3T%r*26vUKxzE+kpy|A zwm6VQOw}jW^PyCahcPV8dwBWO4`>V-bzt$kq5EOhG-W9(q1O=a<_M%ea z!W9R--o6e~+ZDUUqrpce-#>;^%w?TW3K0CMuNY^JzmFJKaxYF;%ra+k55Ug(x--)aLrS$DQRJnJt-mQ}M?uCo@z%nStZX(5u7 z#Vi_o?Q4zF&*2_FtCLLc494Gy<;!56MQ=ye6sthloZ~`{@v2^^ zake0P-kvLDdx9TXNfzzVBMBNE4#VuK8dT53cKm?>q@1TGnz4tCvS_GsAkPcD; z1PGlSzQ6L{-TU6>d+oKkBti(uCo^ZxoS8Z2{o3lU3f0;q887K^H@@n%L;TKvgr1Y2 z@;}Pbhnml)t*p~pgB=iMFBkN(7QZ9C_xGD^AC-XA@=H}L}>6f6yW zk*z}+EWLhP^G@4(8g{X7ZPp{>HP3gsQ>L*Wf~{cu@Tk1Gnd)2R8Lt?t2H8s^qbLPZ zkNGo@>X!Zed-C3%@H$tK-9P(^2Io8PgPzfcBJAR@?I2XP9=y!fu_m7d7*=ipd10l0 zW%_fh4r0#i?GsgoMql#m6sE5oS)U z2_5saeoNDvT5Mb#%PDOwPX`0d$zgCqcNU0>ipmoX4)k?q%>n6^6G~^TS-7eLK2kd8 z4gJeAmW-NFJ(OxhU16)-Yz;xJ7q83Ri!xFQu5-5{MZV}@Pp0)rx%PB^KQ~K`x!~-X zby|)aw}YR$14Mya)sU;o1NsdA?*s2WW^dcjXE{`_Dj{rVQ&=4sowo^aWuii^w7X;&kiep;G{ zJQb_@P@+Fk zqNlqyWCGVnvIEIsyqR7N8Htp=sj-U*!E_fQ4U@@Isf&}ixG5Q#pWyg`{5(YQ#B1z& zyxsu_Q*!8*EH-o%d<2_jjUEnAcaM85-dWVz_SZbv@0}4@I5~EYX-fvacDO0<{k7~BY7s)+b2Ud4K`n64|C)1XY4d0F zSj`qewawSHGA$MX7B7nyOOSne<%@+~bh2GV;I=id9s5rSf=%sBQV>xn9;mkRJL! zNjZWKucs5*Q(mE=Sy@lqQCWt#M~=pzO8>`iYjUB{h$ED?q|~WPW@c>PQHJ=z?kvi7 z;Yxg>RBzY`o9MgCxm*ZXi+n7T^rq6=i7#Ri=qFe`jM{IO6DYYkhthT%93dXxG`>y)y1FHc&uUK0*T z8+4UQd7sj`>a`4r8!v2LPdB0K*|sjOucOHcF=?=bdKtgpatKSz=d{=D7A8tC!*QxtpFAjFbrJ1PK3Xw=iR^NF z*q{58bUH0&UB5sLqe5s2A%M*OQTOyFiKO!~0G?2$$#!upE1UYkmA!%D=6|_p-Q?EvxWLIq}w4 zIiIU;-R86t5hML8eo9giRGEWB^FqVV zuRJGj?&y%caM;;0nB)Kn{0F!oeGlC$hjFpo`T9z5CmJMhhJoDXJ!7q_r*CK4wl0eM z3&(Ns!x}PvU(fb*5~)jXd5KXG)*??ts;tymLH6%(hIpm)qFSRHZs)>6R`1mzvBs6( z^-%i){_-mG0CZb}sBudGg~#boW_I{J2GmCf_uyyimVJ*q(ti1A8j;;od6Pm5>-gF8 zzUT-f4EgofyLe7~U$1d;_%r^E=kwvbmwhec1+ua&bFA@lxicEnelt#Lb3}tC>r3b{ z)}~|l_bu{k&65a|>(2r(virXqhBu?L*h=~E`JbM9kYQY0UfQgminI@eC&kn*nRcAsg#rOTpE#)Qp%5_#(3|u#(3d*fjTm(19Et^7mPtNYS%nFf}rUj z@>+7G|F*zSf?-=TQ4INe3)UB$3@ak;>I)Te68%(`Lh}-d#!o*rFvDQ5H#0`7zSsMD z(R(Mwitl{ta&zO=sU=K!A2%aYK76p5D}0Di^6Z%??BXN3>f*yQaSt1$LzjDl!3Bo{ zD_Wy@@;sw>+o`XH#_aU^>TcYV&$NV87DuV>7|#_x3V7Ia#*i%Lm#8>ofm-Cp*BCN0 zb#{s-CK!P*(xKrDT63vG(z&u0EdMWbadj27+C{`S)?;g1;Q4+TRPQe%Y1``-eBq!2 zp;-d6ZN{``M>|6z3owlkLNa!c7yLUhA!&?rs-;y^s&qBKGo&RegN?h#hIbTHzhgwv z46&|<&?ZCr_j+5r>ry1qeB}F4Sdd7m@N(MD7L~sLa02Cn6*? z+xudSTAYYx5T%p)F25P$@@6+qsQ)wp<|U*$2?6l$SUu`KPAxDx>5#Hb?*V*`^!k72M-^P zl<4ciPMM>#{C?(CR>lU(ti5u(5H)Q22vM_O3Sc26CpZ2BX*fCCasrwd%=LP_7;;$G zsYvwBdV2sZ7&1WqI|~6BF!}HS5m`-(d|`b^T{kj_x@7NkqVA8%Xeyr#2jVd|PIkF2 z)2rBS4irvh!5WjicPR|bGeHdsGdAHBPW#s^LcoW{Z=VyrhWqWbZ@Rt11{E?f15sWp zVgK#}r5qcQUx`hn&;T9>eKt;4^dUa(cAtBqrXb2md;JiYt!ks+?b*?*q0E+)YWwLA zGF>;B((MZiwBf6T;_EJx8J^`_I|~9UGKZee2lyO2 zhR)NYGVBSvImq$#Q}D{TL`WU;%n-k;ps;(abB!L0Qx&&i;)eoBTFnSTi)`+|{{V#=AyDn4br%?gf$8th9RHaa7)Ei#J$LUs zRr)l2ZUk1cx;3_j%ih2ys-3JggF?Zx7ynPA`Ck?lt@%G*@&6T%@O{8@HsyW%nvwxB zjHp<)pb|T(`M%33DOPYTu`?t}Kn|~TuJ=HQGiQy34Jw2x^aMmgO0bV6{L|c?&A1%WEuQzVM zKX{M9$jxigZsTvFMW=WWUDWeDSN$}o`wrHLxnRBdC+i4qbQZW?gASK6y_a-%kIl4` z!G(a!3+fgmy7#*EpALoSt?Zi!K5qYW`b9hZY1D&sI^>i~KSz3@7>Sq~G$^jwyjSd% z^M}uC0hx|hyP~h;UF4sauGCu-60Rs+;ljk;=4Nt(7aCPMeZee4Tj5%~cZcgkLfJo^ zY#}tKK;I8LvYd~;GnS9tp$lK?&Vs#`dwVc|N9-dq0Mars{oU; zXf62X0Da?E*JKrLUtT)vP&h+ra+h|yx0JUD3K1Mb1+0FMyUtKQA9SmevlBK88t#A5Ek!cIr}mtJ*_e;w<}KMg9{^AJ zBpQ9#=ML}QbX#(3bk@;%wdl4~=muqR4p?02Vt@oO2Xa3$X*c0D;icFE@)U5JE;!sj zD=TZgN^2?h9}9Z&j}852@FFGWU+V0-X=|(*az7e=kt7k?yXw0zwp;X;tYN8MQY8Fw zGhB=RF~JErL8inr^)^xGzw)=cAChPyv=G2`ldS%0Z1yk1xuVf!XNua4E_Z76${^{}m-Z|};UHzDInEZ1p zV&ZITLmk7BKA^ohe@=i^=tx}9D3u;H%3=Bf2H6o_27~`y zQ^J=CELYW&23E5xM}v0WkaTneR6C3t)UYztR8mVs#?`A6M~@v-r1N z_nofq_Y^YCuR>h1b0a3!OvaNx{Vs4<5>Sti*OUr=eGU8r2{6w8>3j$bD(OG63h{)y zH?jktv1I+*S)AdOh@TAO>O=MP(iiwxf$MrIj{loa{Nvy~Bi45}?N^&_1$oa`(zV46 zUpKOMVC-H$e)+$=4LwxyF@b;4s{}@d^)mL-$M~5t|5)OU9cuo|r7)~#^aiezH*g!g z)?rV36yvH3&W6L|mTNHomwBt9Tyh>qo2vTL4pHr+Ejw4 z%Ol--wC`17yxP}yMv|bC*gA|xnnXAC8K>AHNWCd!=^1zQ355uAX^QY?rLW8N99ZT-0=RMlip-hpU*3|YzCU$ zDHr~z^s_UB1#0^#y!8Q!;hekNUdT*&ChiaiZ$0lM!mGPp+I1AZ_ccMpymOOEI5hH+ zvxwYof72$_M8bHxwBQUb9)^Q7x;W(}*EZ|2BV=w5`UoZFtEEjcsQ{-jLRXcXMRM9X|`(rt7$qS9>rtj+tYn3^i(in z$9*E7@6*}Qn%fXTJ(adszI*uTRH`bjIQ}-2l68cUGu?E+6$86z4L=(grWMlTbIo7n zHOWgRo_yW86tPd_9L5&g?Yke*%?TkQR#n!kOjzh`_4jQ}P~o9DAD}813~wLvB`C;{?YU|zLamZJ2HF^Ik-Z}VWcd_RYH7}&gBkX$W*B*^zeFK zxwDt5^0(?lQP+t}Otzu7@Q5i&Tp~Qy=7kbOowJ0HBUznwmA%<`twffCb#q+vne?x; zG_x!V^9l0ZZ0^B7Lr>~P87n1x&DJZ2{)!H?-fMV*YT(JM%Qx`c+v|@Iz_)ZX-#VlO zBPgu`cOrGG2I*@RP5C^!&siKz)wQ9QhL9^xY=!&AEV@Nyz|*RBzi3!^dUZ+mrFrkn zLml-uqKYy!^dA+SSHb3Rqqm3tgrcVZw#d)+>%iS^dSFn3BH)ujgA05tu6jL?Q~#7s zIC3og;+qZt*r*7aN?E}tCs+t6LZ%AB)y*!+l=f-NDUZcP#r zTdyBIgXWt{NpBiY_#A~X*KG25V4>f_jh7nuNFG>~SSxJPq4}VH=H^|KfNL{BG%~i+ z>qOyNAHJ}oUZ<=vq%DA5sOMMzt=HR0PL1CZE!%ohLlcNsbvk?4)KFku-_*QZNZSN= z=GFzIqKgSvid7NNR4qJWhEAIjZ5T`0WmB<|d#i_(K>4LeWN@@-+a#88jFK?Fy^%C+( zW!z~(CvbXXB$DcJBy2foEUaosHT3(pn1b->Ys>E1ol)cs&2$wwP-ve&O@!iTSx2!9 zo)HQxuT_@x+jJcESK8CqXkfazu72%!ln9u zvWY)M?U^igBwy+LxyJcEsqS_=jd*Iki>7F8nd!{o z_%_OCEpu1eN^Lt_%JLRzewL9g1BAI-is;Q*hz+}*%uB+m zq+G4HS)#AXPTxRX|1y!~&EQaqq}1DxdXr`?wf1Ti&EdO#Tyfw0*cD-QR=qhWK!~hqWtp}{&=*sKrft; zuUB<2{%2RRs}jud{+RIFiZ02g1`AKWFki9^TmF5j!nIE64n|cJgY_a)Uhz}_<6r5# zsI4t<=NBXOZQV=i+p)RxM3`bqTzVw5%OG)(CQ591uwle@)OdXe!KOfn+if~0dyzga zL<@hJtp3)6{CUJ`3<+7gtZ62J)}U6g`kR4R7m}A{&1)8!F-;<*lqUQsd>LcaLS^O| zcGL}z+5$gXU}Kuof}*kF%V!`?%Dt72{?(rcBYnJ?+}rP-HYMVSLpf>rtV^!zXts+A zPVn)$y46_bh^VR+RV|h3lP%?nwa*EdALaRchuMUC985hB9`;erd2n(S3DM5I!GNwo zpFnwY6FVcPyj%t1x)Wxa(7~Q+&j%bOI*_kMovq1=gXY~oY_>IZ&ZIAKrSe<)NB7BU z#k>UgMuNw6TopXhsCmb@i>;RJmEJs{*Iu~wCBiopm6Aaiq*uT++b(JG08`FnOa8Rr zb|{q#(Ir`_X`R#uKCRwS+P~BO)E&uUsK51yQR02&NNNf~uk764A%C^heS``-u zTk1(k7Vm)RkCpOR%h_koyjU8hb&yw1VVS*ot2wyzfu94=<@~;Qwm~C8>dABGPidEQ zTl;A{zX*;h{QiwrRx)n?MWW5e7`Rf+XhPEy8(GHB-_^lARuZA_nMY&n;VH?NQVu%7 zZ690puBuhDT<(l#Ti?pIDwS`R#Su!b+2wnoDxo5Ia=S&vFPUS4T6l4404s0Ed~d8a zY9l%j2HZ|;b4Db2xf_BqH`>{RKY+_xqG{5BzBjS6briprc^4bSM&{rX8Y4?+ma`W3 znIPyJITOon$fuC^4&z#fU9vL0bUh{BAtg}r24lJMaD%TdWiK9#J!4n zdZh5~A)J79eeLe{P|Xs?{b35l>@AtBVrnLfcvFgl2U}!O%pWzA%@ismEir9_Iztav zUSV2aXQ;VkD(LhQb8ZQjb8umwt(9{%;h#mBZKRkbSqg>=w|4!a!{&S4t&UyRJz-5l z-V8Nz5qx_N!u*rs=6HhKDf)NEMa{xew^=-Tyik&(6W`1bi9s*at&d;B`P_lNoXa%dCzsGPB_+Qwnar`HcsHv_2sf#19VW|%L9%Dq zgw~g(`52_`nM-eaD&6KJyTOMj1)Z**R=BFHzK*s4)&`chluv;Ia=dv&9u_@gJ3>DBqio281J z*tPXaYWAnJslWudgUM>)rTstv3_dSsF`V}<#TRS9dWhNd9JXEEW$*E_rS6^5AZ7&q z+_MigIA_ud2JkA@_&j2?TOJ+UF7EuAOduT;K&e@g%KCR&+`i41g7CyoRb^@KCj@Oe*g+;sU1?vjx@|NMf@=3d{Z7Pm0!3HrL0=pT5w{iG&2WC|>)7ve?^=6(?Hq>;*{5l)% zwd%x5?qnz|k)vCg>Z{Qj-PRMS zLVIaP#-P?Ado1mwvvae84F+48znkO)b`-wGwI z&N|@xoH9ZnGS+kTsndq0{S>utJM3+7$tjik8h`0Xdzu%|xsLPkz+oLb!BXbg6)zQL z4#rut6kpY6Oq*koN*(@;gX6G#PPR05W%HCduktv!I{0}=h0FxqnUyZG-YB4|EcXAoG@n$ogSo>Q@RTUe3GwW&4%!$pD#2MGO$hy*;$hXE zDCam{^{uMJnp?LZ<8yNUn>Mbv2nWhH{M--pdnhsu6MXrf9cJ8w4BG`LsPO9V9uov;}l)&6H8vDQ`KwXVx0adxxKJN+kKDlr?L~T&)wE3Eu*F5shh8Ul_ zyngGLc=rRyE~T2 zA*v?Nn^NU28%dvI*GAyKqN040@*ZbTQm#%gup6(=qzcj580q^)8bZUdEJBj>egXQ3 zwc7ZO)p6W0B5+ViBrXB62sbAPgGS_s zI^*XSPXDN#MJ#iua6kJQJ!=|OQmSb=3SBUBQf`*^+{}vTsNv-emhH=Yv;9tbCn=zjHGr zCwDFIKT(e)esrhhbG^vPJ*uwYI_2!dnR=BX2BGoh>P(h);N2~44yXzMNWFj&e#&r{^G}PP0qSwI*+wGXL=61NB62s3L8I~&UOuoV$021#>KzA zleidx#5-5@@9b%9nVn9)AmpejDlFh}S^lB?rXncCxvyww=O>a3M1-zRBznbdQvOEf~e6W1pxK+Ii zO?RU5eQ^#p4o`|b7+HADMp$z>q46OOBch`dRY{3ms&3J$rXt=76nZC2Qp>cc>Wa)w zpJgf(7KkG}(o^PQ#F&_A0)AnC3Ku5%E1I*w~gNb81Bp4iW%N^L38e1Z^8xEg+M%+)=3{uI1Pke+d^ z!p4AT@EHGBD)j2u#wO$|iLnT7*-C#}CTI@302uRSM* zXyj$WG3^vsbhOwodxx0$Ob=|~9}0Y_pOMR~(_;nCOs6#m$ESOhJ~PF7LJk&K0`sP; zg+j#!HNjn+-X(3Ch68w^dhKVHq#KG@l#?wQjvKsrWd=poIelWTL_8EqZBvWmyYqyW z7WTA-!Q{*~IOf@N1P}9UJeQvtx~vsrNq1$3`tn*9Tdle35=aG)%-eE z!2Y9xOnX?jxkgi!B$L&xG^5O?xm*be;YRe`Wb%jsyOgmqEBt!sF=ZDKQAj!n^BIz* z_c`l$LgsqIR*8tsUs$h>q28o8n08f*yy0uLV!{h+j+WQ*GO2VhJ$9YlC&YjHph~Cp znSrr{t;!lnmOUfC2lrMcEsS4UG1Bs#g|PAyF=D=mlLS<~Sl^FiF;{XDQ^wPV2F_WL zWWEvBfd$v$w>oO%5zMR!A6M)LM~KSJPAwStMr2@IMR|waF}0~d;ldR>ZV&KuxlL?7 z*V@H!i0o#Bhd)$&cDmeOGe}PJ!tuaM*y<_Vg{Sgrb+KmtknDj}*kf06LhR>V_%i1L zXW6^v?=(2{wJKen<68|M+{Gs-K>m9P``b}aMR?fS0E{m8E#)dj;`8mdIuV}Hsw1xb zT3tsD;ar!#_dO)ui7klMHGf@CuPIIwe(ZY8qQhckPIG`!BrGj|{l&E<^VKZhRM$|| zWF@cg2SnH1LB05}7NiuXa`HM%@WN)gUHn|Sj zsp4lG6Km%2k0v$`XO7O~w?NlaRCi{{6o)-(9}=3M)&F{1dh3Y>I8`9ozZ?8YF=$}3 zIJdZ&YKtf6urV*^o&58^t3^m6(i!QG?fw`S7ZH!~chQF2FAetjz9C(W%X*c zEshc&Y9dJgSnzB(=Q&-*69D|ya?(ubaQfU@aI?m%}`=c)12_4i87XZi$&}X zw~cPHsfPadOe;M|^I!QHkam-6oKPTm$NlIhF&7fQEyrhF|YT`;`OyPNv@#G(y2s<|82YR04Hga42@ebZhZC zdL@68Y0zh>CI$IV)<>@9jWVKYrsQcv*5w5X4n%hUtgo;8A^}KXd%h)&T)=7%Fi&FB z(^a9+2KHAs$7$Sl@A@1}DBIFHig!w&Cs|lV*Gt@xaDMH7W*h52>`(qo%@Ubp%%&n( z@u|GeZy7M(jjTj`$W57FrP1?#v??Q{KCF{`AFkoodh?Wv=6W7xV~5sazvY80{!^%n zF(iw3Z!D{9bE67?;~ zB8~g>U6qEt{#|7ON-m?beqrB&rEiR^JF)iqN#5y>s*8(@cd)UuS~D69ZYU{0gSw>W z9Dvae|BmCu{d^8&<4sLXw`c1#9{%$&l7t9K5dK%E%dcuzTbFz<8yo~CvQ^10&akzk zJ{f!-%JLm@MLOpEdHzIY$#Hp@((AXF+J(gRQVDfR^*fp_Zvoa{L!*Tg$VcgHmTQef z(-+f|U56Vz-c>BW8zKe+L!i4E4!OR*{=Etcq<(NNf=cf7{-nuO$eAI9xnZs&!13A7 zRO15rC4fKGqvySC=NjE3kyG}5pXJvqPG ztiM8T#g++cd9cN)!v*b!bq>a@wrMl$?b)xN#N{~2Jnhx<-Lo6psYFQo>5&8$RTE=a zU){Q=wY+aPm#~J(BD4XCzVf}l8X|+;uKl(>6h2{wPxy5_`5Qr#49n1;E^DXplOYb3 zdp793S}a3H&}%}qT#D)xwL+dkC&D{@$~kmUt4N14(BB(}heQO8Y7)`Ze>P@`{;+d> zuW-2Q_E*ihOoGxa!@+L1E5+|ulf%OugD~T*(rPNn9MihZcl(v^(i|h+>m^el^(KBg zG%iiu5+Cfh`L&vP;U#Zm})9nrL~E7ID3KK%+I<{Lj!wz zWmY!}s4)AjjzDI`qv;5Qh_aAnvsiS@TjT6eOvZBA1yOdYNb%p{umX35h zxtAomo4VDu-q_dfodyXF0i361luo{W9~Rtr%eN;z1w;9-kE-rcNgUjQ4VA9{>~I2) z_?=v`@E^BD4g89*4rUc;;O~`hd-2FsBtehwZSTW`hIu~mJ|6)AM_9wpwO%mZo@UJ= zJpV?uSmFB4%>DduC{4vB)jl$cY49*NPMSo_PvHJlM+f6B-Xa_bXbmgWV%FZy^cESq zT*BeJbbh3QY-^dY6-J(>)=2P6US9}Jz5ljWCuRtJG1)!gRG%ThGfH2))Ndbw{$ZM1N42{%y`n3ISQcIy`c3}($vgYdp zzl7&$Sfy2kMusJ3NxzCGGpLLZ*ucVo`yiNk`mzSGCUOxlVV-y}5casA$WLAVDqx^8 zpgkro7?@()gyE(rN8FF!@54M=KQOYEbWlQyC|o3@E-}A}*;1YR5xw;IzUWPo=mlG@ zjhpXmQ>#c>_M@yhi)wB472k_>pb>(cHRG-JeYJ`oHrvQxk|# z^J|ZOSU*$!t-8(1EPj^+GU8tqB0Krtpp?G`2rY$eXaueT}X(=iSoxW!hPKPGXhgC~ih+s6)_G!<+&WsT0^uBy9I zv+D!trlHQ$G%O0G_#;oQ^SFB4keDXwZF#1?VD3p?YxGSFm z0`%FRLLmGgM-e1+0zr6{8`0+}z%mEWwI3$D&gVOIV*n}@-nb12u?F0eww^vl_+mj# z8}n;*qJ~G_9x6a~8RX{9XL2WvhLW=45EAy-G*{<1gJdCq^pFKuD{g3pXofl!VF=o+ zR?ru`ljnkO60P3_Nnl4im@pgGQtdEKvaU~Qk*$wGDGaHG@Y6t#9E!R%jME$G;C zq~kL4$F7t}I6lG6BIT%3E5+_e6ssM;UQy#(nt7+B8R3$lAcZQa^` zcjwGAW-0IquG7R|Cy#XtsI5nMbi0J#>b?C~^n2HVSbTq4U&yOOIQPJ~wP!!@oS}u$ z+Pl+9UwhzE3@_bseloH~E$Q+ExAc`n=_}8OE2zstkDlYMA7X3A_G#ICP6fU8RBNa9 zyWR@8ufQj%qXvo=QA+z7m2hXVFmM$k8?!n=I}+^o{2=Sqr`Qw@v+S3Q|JN(DA=b8F_ew(uXxPygX?<^F` zPwSHYB`$wZFovJjGm&&hSKI0Y84+C|XmReA!eKyY@}+JN?pKj!vaBm@JZX-R)8S7# z1$AaLrcpmQ<@a0@#Ztxa@m#55sZeV&Se<|Dz)>q4$}hqGqWyPu6bJLFJh9DQV%sLQ zF1x#dE!|y9LKx{rl&4^fm-Nw_srb{^a*n`|a}**OfJXNXYU=mz*Sl@kFijt*aA#clKwW3KJs_iNCO{;W(vkS1&-kUVjDI>7bax zv~Cs(2nQ)bc4P`UBsn7+J2g6U-?l5T%Apf?dYYRvKU=XFU3Pv4&VGBofLdVER|&~Y z{r-GpVO(sRt34xJmF%1WtQFeszQn4c}hyk;ihY4$UINm#WR4Hvoq`g zLC_uwmGk9`KR~2`(jD#>(}CVmUzs>U8J#XB&W%u%SHJe;g7Uh|uQ$YAw0cFymd#_f zm$~bTOSyhA)rf7I8H}m%)O2y94Y@)*#E^T5b5+6vH{dJRqQ#e`uYVB*oqU9lI;Ut< z+=cU?zh3OEPw8Y(J^8ZwrYjn|npRpFT~&B#^E?fQO%F)~bov{n`2Zf{cb{xEYFSF3W3y*BNP}lH8pRj zA^=mA020k_P-h^<+>$~9uE6Bk>8E+r>0WryW5aI5xDzan{OxJUp(3x&gRyJfvD880 zWIIop4;34CE*bMsCZy!IT}NsQOs>O(6E!8rJ_ffJa}IX#oM25{dqCpYP_aC<6>Itu zMA!X&VX|lu5DPJL#Z;0mEKU~l@XQ@sfu{uX=-FG4Pu2?xnr#(-Rxqy*+LlU)Y zZHCPQlY~;fCZKnXWxstTCn9(|VG*nYW*qm>2Mq*gHdr@&N$d2VkB-Ont+E z0vG{hO-+)zh27RYAST~VAcA-rP4fu(!Ab6@&oEOgl_%Q1!^9aam^QlQfaUi6GP}uZ zB~x7r;yb3hK+96?ixY6`*2yV(kz+*X>TTmtj-v_y9}suj__M>;bRz~|zf4%#diD+w zirWzl`LxLsrG^6lhN1zmkHezyNh9yb8&C_kVdH0zM*)Zy03S6hZ?|pJSMM%{WR#be z2Za=)>;2jW1`$6k8o$r>cK>k}#o$d*RT>NR_Grq;&1C|ll^y^_8G2;w(*ZE=!|(A+ zii=m^epdp3{js-8$C%jzhwa z2WS*a#wm8k-4cbCrvqO#3~SF{+UoGvj+?jtaeQMB>tuSS&?RyL8Sv}R!{EoK4( zOmNHHI>$l(R9S%S>RpxR>^mtd+Z_B1!#{eZ0@rjm1FF^4HphNUKGRxV0!4Hm#9Z`@ zOO(xg4-p~?5AwRSU?(V*Mu(cmyagRj#NTOnd`;6@AMEpgF?V{q&`>QKqJ5l6>erZ< zO${Wsbhh|ZC@s@k?+=gNzkeU_9_aup74W-0n05y9nY8;;EI`*%tdnK@TG6Rppeawl zJiR^&q%Nw+`w5&HMWpU^F{)9$1)r>Nbr)I>Uv^POubssCRqt0t(-WNSrtXG94 zBO?R;JVn}9{7)+#`ThG#mqwsEwtRL+Eqkdc^&B-m!sYLM7(%<7q@t$ zGmk!ufq+L5#8vN@ssYP&9iZ+3av<}Dtpc!VATFhSX#_iCWB@=QS%9Mud%tJW0>W^j z(D&k)w>;Z|MmD=F_=RSI_~o2A-bU)putoCZ-yNbMtM8hBH29lSED zsvTp<>5S2#=dxxbk@8mokpt}%Vq?n=$MK&f>xpY7eC3tH7#B9Yo(WD!u}GTnO2(WiI+hY<48ykgf5_2l zx*J$D$du*y&Pw3yIhFJigIa=RErJFBHMF=m**Eassk!kJOw3>l`^U$z)^+jT5Vnc+ z^Mr(ibs=P1vShS9%WCcJc!*6secK-^XV z`~WDvmj~dY7EjHq8&(bAI^PUM08hQ)7=a>49rH5*5HTk6nm&u9u>(koBgYLgg&h$}pno>OOv{}VJ~}!oz+D8e;egzkF?M(S3_-6y zPI>WSboJ-!O-WHq@FS9Awk84OOF2i(sjPGMmNLWA zu$z`!6(DE;L*iz&2zXUA{#&I@U@UoH>}E2LdpkWKBb%tl(MtkskBQTaLV8T@V_xiq zNA{j&(NNCoNA<}$->^@X_H-Bq1Bb=c0P7P3|{Q&=10J5Sq4?A~2eij4l z+Qr7LQWR|6$?rT3O+pOnfNsD$>u%{q8a}9?v^okclPQb{E{Q*bGD<1#L;+tfd79ka z)@XAPjo5(&%(4J3JIoF?0Y`CCMVf-wh8X%J8WTKpBVPv@Fr5Z%KHkeofIe+0T?89@ z={#AseFQi-bb!!_iA{LJZ*M){mEa`9!}x!i?hCO}W?oBSubM?6GxXzepQe2&t+spk zV&T}ciVOXaAMc8`MPkllViQDGK5OI+Sb>YNGK}bwZRK2A7@mJg$aR|j4=dhXT@`LU z=wSq6Km#xbLFWrP&8Gw4+8-oR1B7XyG_hmTZ4?xi0pja0Xet$Zd(K~bQWG~i6v+Bj zyV>lqO;7>@XGN0$d`#7ODUWnoUZJFyg5%gI0JnM_Zn(^xXNbEW2rucZ8o{N{x5?K> znmnBVC(E}7P6InJ)rMf&&ZE%}cHTVu`3Px{NYDU`_V$-)ch9X}GGMN@&lgRjW8=;X zDIh%A=?Gn1D3A=cI!^lJi9eeM(5H)y=YwMCwQx7e5hXeNyh%kl9 zlD`pNh`G;{Ge4v(7M+>~P4ss;d>mCq6LmFGYKP_(5Kr64;>Ds-Wr%OjJufg#xz4|T zSjoO2W|sL~asZ+caFg>AxlMD9tn~D^LOKK5+GK7ZU|@JZ?L@yJ1;tz%d+unU>x9e7 zFH8(MM?4>c|L5c(vhY&7Zhy5d8j@{6I~2&MP59id63BzRJ>a5;lH0&WP46F~_K9|4x~qf4KH*AO5rY@_IW1>Jz^@ z-d2|KlRw3x@|keovp2VsKR?I$VAg(Lh=JkW+uZt^cPa~ECIvOMz7Cf)6FSDlFTc&0 zJ&b2iVV-zeA|IIe?I92eV>VS*diLxYzn=9^`!<l}Vl4bD7#F?`qWFzJB&M`DQtLBQY?4@u z+!9HnuC)wimz+sl^0=FmK>Y2%pv^#4pB;{s5{-L!$;X1z`t;AIErZR3p_-7rXq7hm z87sS@9Mp=@1DNcc$Tl@`ed0T^#CJ^nm6hN8*pK5-)-ZfBT>m^uw}gpVHrwT{Eb+$x z+16CA&yb89>D`78%fIWfF{WJq61co<^U>=&4l{ObhKgWl%Klt>uoz~wX^KalRqzw> zsB5${QQ9HyRGC#T%kBPtKxm13tucS^lH87r_?;OBJw&soGrFy@ISIl({Og53co$sqcQ`K%wDT zU>XL_i=@zq4|F)-U!d%ZA30QIM$A#pn7!(y7P&YL;L#r#i>%yxRKvgfhd&wk4{kKr za~mt{r}!KuS_#4ym%h^^Q(R-v>Xf#dIIOjp%V0h&xhDb7|L}_xY^2<9yFkFqqLDcW z&|~oP%K@IYl}M5KKVL&=Am7xalL#n|IB<$! zWJCiP(IE278QU}{NN|Nf0HG;tcIHSSVf+ZG-OIHtI#y+4RoyWXRrb8{Je-pW>&PcU zK|nBT9GS{R$mhI?gPwGzj;J+g8c==BLz2TvV0_v1eSCN$T0#@ee_2pHgvFN2WhC5l zrz7c?YO><_t}gEbCzkCsV*}xxvqI_8Tx~MY#a^(<8K62~3<|C>0LKgg0xE#V`uq3q zo0@kIJ32Zrz_T74F3zmxGco{Fm<9-zo+!Sg@| z0Bje)Wdlw;M!C%h!+laxTRXeu)AcNCu+8dNgv=l>G_j786HMcK-mPLQWjs8~>5Q6J zpBa9a7aph0Nik6si`J`(bfUdrzdxo`;DnvSRWy2`M6fH?y~pv8Oh;FId$jP+oN^0# zE)ZLMdNQmUgjC6NC-(z#S_Amm?xQw4-%#}LQHuAh&svO$n2KNF-fN@#y=p&QbazR2cfGaGx%d9>-f`dW&@miGJ+Qx6-&%9dH5Uvo<38VR_{%L& z_FC>iME=?DPKtSrYb{xdp|3U-%st@HGJfz5UV9vOU|yL$7el}k`IqHnJ;zzzV}iHm z1MMwxZt^dSU39AlI&MzaA3CJh)FdDWIN~qUZbyfP*2C}B1veqxC_5Z8JXtU5rauo2 z3l-GX){b0&0ci7!ixr1y;JLzTAXj>pulyWbRFmFSNT-g)ko=a$utwRQGmqgN)V`Rn zKyh)M5Y&wdz2%whkfRmzQvrK6@587TOQ~@7se&q^*7(gyYojp}olA7quD&X}0zo+w zd$4^$^-Yb6>9G8jMYCoSJmWHuxD8l6~bI#nKuv^!jiqv!2(*G4G^anovFwugN)x{24Ks@%@X3 zA&oB!oOusaArCdoS;=f}?$qqySSBm_ZE^^{gaNq1nPE*@c>JaYKaVAOQHEPCFMAQy*^p=;Gp@%;a#<>CRa+5=NYHUnpcX!v}p#?+ZN`JcgSq0YG zaGqG2T<^pLkdl@%nG=!B>=R@zVIP}KN^!6sPNW+%3*lCUjMjS3loyEC7#*cF{Vg9$ z6QJu+o$c(XnGU5ddBO5EM<3z5bxSNpQ=#^B;YjIVYbb^wYX-4na}6zg-`cw)K!N#X zi7Qz#{m&N+shpQ2_!-;!wfm(n+|9~U-XtzzS@@NzkqT~(I@HFX@1P22w*5A_Fix)7D{yz{^^9b_&u+hB{+>_c!|SupbI43nHq1gO@6f#P>mj?*@Kq-R3?`?i>&Awz@i!VzH}dhC^N(>WYgZi18RNHO zpe2!74&vHZ6K52#VGT>nI&D_0(HpT7!TfLDv%`(K)3rPrm>*Aeb=(5AwB`P?EHZ&k zu=|S+_7JDV($yN%XB;fC1*1k$l1~zM!ka$UeMbC{p>_JB>(}&GzIUk0e0FJxD^YI4 zhU-aKri4#=elS5X5ouaxxyMXWuZCV}+o#n%d!8g4>!JRheWsO^>2-?$z)onx#S;np zm1Vx_eJ!aqrx)shrd^Vvp_Q)yd17Qi2JIPr};LyXx*vDml%P zZm!u4_P4-bLdW5+)_Qt0Z{ED&KA!oC;&i%_4$L{xH^Dln&|gbP?5U)$zUX8neCD<( z|LiLzovrCc?7tz6)NF{5l!TWgK$D|EkU7HuDuCR4)etqT8Yvr_5((u_NQo=2Yta9v z7J!-gL2Re!+qd@(hkl_Z!D)f(hnz7e8b~~ve$m|6C?hW~Bq@0hvPvX43^YfFu4SY( zOfvQM^Mls+!frtmRaMnQ4U=^nF0jT-;U!L2G)rmb1WBZHuUe*Mug31?*2aEW7K^~SsHWj|mg|VwA@YJBUOE5! z_RZK0D)pyH)IMOHwqGJq@{Mb57KM4B4KSV+Dv_%5-FBF1>X5Um>0H9QxxBrCr$%GB ztTvFvm^JQ~@%dRr(u`x8WquvDb1VT5-mk#hde|1+3R4TN9BQ$m<#QZuGSi)oJi!YXYBxHe}smG zwY9fHj)RA4A|sf(($VrRJWe@wpzK_&H1j~_Oddhd!vr7H~4u>uC31Z zvYJi{8qV6RULA7eO=QBG&v`A&oW6G@A;0#4~_47W5UZ~0o4%?IX`x~^e?Kd$=T zJG;kdUSMrlv+%4Mrh8|{CwL(c1Q%bb2d;K(qoft?w~q9EdMkiSC_3JSS>bJ(khCyo z99R$@CAjTjWVKZ*)Us5W>3sS0-I!TWpn7%D zoId3xV{AXiug=gHPgSz6j%0)GWZ8uEQvdZ_nDp6c|0szomU%L0QNOpjtxq<5wLp#H zUX<5j!j!_7AL&{9%Swa_bN-<419tnhx^oUQUzQSs4)o64wt+`N|QA4pg1# zU(TpQm@js!>YT$7$o-U+mG%1d>)*OX<}fN5=EkabbExDz0+28(JG*zqN?26%(7v{= zt~xT+T=ek`nAq!I3p0Tgvj@|S6f@r;18d=^E_gkULXfVU3~c(iGPKA<84+45B(hk> zhcb1*J2X1F67G`AeZc%uQ}b(LR<^Me- z)3NFvysc-7*_0m^Ez0xkSi1OeHJhI`XaY-{X7H9Y z2M{fVOIeGCU~GxRb^6-~FKlKyf4#o3wP3tq_>j%0>4Sl;^6Q(jtDiVIIq`9rz6ND$ zSez(hIcT>>ynu1?gfIsD{AAD3+1~W?X9_;PX=?pns-=M-aDeHq07pE3Ib}x)QX+qR zCiki;Zg!&)elf9IFo>7x$&=88gw3&G80D-kC}v~B{^pIdbU>zJwxfCrLDMTN%>4JW zGJVPOKa;C#zr&Ilv8yI-(3xz_UkZbX2~Xmk4pp+_PF(8=XEGsMn&;qM5SSPp1`22FJ2XSvKn9sJG-1_G3t-3|=dDhkdjzs=w zhU>u%8N17}RoOZG!wx!?yQNwi>!~MOTW*2^%T_m{vN-mdxALv&CS4{V3Gw79x-;i& zk1u`*NU8SNQNyrQ6WyOj1x-Ne*Kf%L}d_6_k(p9CnlXmfY)Mre@yo}^a zVtsyw1}963`?n51=4O+k$PQxAdSBGZ>lgl%u|Np<<7Y6Da9Xk#1YP<^VD1$}`?Ka= z;n*=B{IoQp_Wv-#lC59+f=Jad+fdT+wCoQ*TSLP8CLgb*kGXkib9<9ZB5sbWWxgnE z=-rngr+j%ym*GpxzqmQc-Ff)??&ekIMn?Sf{8Fo7Vmt6V*Y&_Y=&)eYL@Zebi`$&8 zA>qi!`%j+Z=$x(7Iu-V;+lpo200J2L;A2=1QL7H+-Zlqz6{M_`y) z@1cqPo|JiT4-FtHEE)`M;kxR0}TsGxcXMbx+=+PANNKXPB#z9N;Xay%6^l!95?5Z zj!!+g2#AvUF7MKUh?0uG&d)^|lr&&fO48DI`fBJjfR;@g|8!&PgR$YyojliO-Q^_s zUoyR9M?sU%E4gG~_%hlN`BHBNOX)GW`S+HTC)QgRxR&boX%d~T5C1}Ob^Sr+)B(A} zI0CI<7LCp4(&wUm@6Moj_ zG>wfpO+{fuJA55a>8SM28P@ncWsvH$`LLtn3Cgt=HIXQ$6Q}hTI zHze9#3wvPPFk+yX?D{g>fvG!t*lX(t0nK;b;7;6c((9+wi=&)(kcd~SP9wNaxI#7S z`CekCm||MAX!XVfwjlvp)ebuM|{fMSQ!Ik+JT+_!P;<&T&BK>3DiNaO#Ge%U2X*=xhsW2HQ#o&1%M)!Dri4q5Fv!Z~wY3dS~>L z5ev*!RLUAyo8)DFHa1K%UgBd^AiY6;yqZZ>UDlP;!m$@wj=%cYXb2NM`tLDqUZ1Bt zGC`d?ZMjdg(u5$*V_P9h$5%OJz@g@n_lG#c~I zAU^J4rjo9}l`k1D@0(fG-G}0(@>H3NCup|&yl$?A?d4G7%b$bVxfDC4uDi!0as~|< z7qyAnoc0rJKf^TD)^^6KRtH$K5?%JIn0U^k`Rtq|y`~ub<}jySE)Oi)t}y-_Fs~+f z`JDCU@$i;Nv2uQPT=P3BhZDf-1$FApYj1mQ7e7{#wOw@n=+*JaOUe7d!*2j%fJ*zZzWMJ(;`FR9t-j12L ztGB53jagK550=o95_WjwfK{5GG0cPlrESHv!ihZ?5C?I>%QoRA?x1x(M#i4>)hD-= zZboa}aZ%sAe8Vb|W5Y~MsDw4~2e@T%AQ~B}_a9J-`jb;prH-E+rv&ke3kzR=`}Qp| z1C5HphfJ?qH9a%aXIRsfq-YdobI`+cit=2oEV!{zcx-&!ej!{5ITs#y3}=^;vYD?d zY%KVfk;eGh&t&PsJpzd5%$ctL=Hm@1xB+j;Q&e(tUM>E>>;caZmHcUiGugEJTnvAn z=~vBtjag}|EkFz=4>VV7jJ#pUwI;zct31|zNyJEOBl)LaGHOeO6zZAV)mjnRfqF8Z zV_LqkyLrDl!eUmwoa7zRY0b+LUZlHm5=>A_7 ze=%`2?e>26pJ5rM&XG_t-#?DRsMdOvBHyp3?U2+Q!O7P7EH5(QQ)A*Dk3;pt>jL)mgWzzv_=t^f7z z!NZ5FGlC}e4ScArzU4SMihl6WWxfMaTu`Os?K)?5jBns%ahat zTMpHv2$i=WX|lJs2ar`UPa{Ao-7>!A)vH&M(acSH7aY980`^`cMI;mN|CD4jiRwnl z-OM5{3+d^RQOc?h48#DqbK2N>+uQp#3I!!40iO%^;NTz?4Gj(sju6ztOiWCWjutwd zSOD6{7~83Shz*|wA{S7!&W|h{+kgG=C6VHPcMtNY<0HA@iJWfkv3!9u4%g&4y7RBM z#VgT-+A5bZF9L!MYx&4qtZ#WXY@uRtSlkqUJ8xfmUr}7{>bMaVJFZH{$bK&Bko7BD z$tOw8OKpipRRJt|B~Q_**E=E9#cQ=x!Yqo!yKIv2)~xKV;x?zE=AKAUQ{QfKcyF_h zPE16EN$1Z)#b3&G0Q>$~A1&&}ahUufI7_PY%4WJDi1A=dYUwZXZt0tIcJ3cV> zOif|%!|MR4xcOjXJcts=T#g?j5P??lHkBkPy(1e1pm1PgV{?9FjtXYHju+C*@=o7$ z-6_$$FK2WU3sp7O^OeGQr8#B)Az|wLkR(h&*fSX8YWC|h^;7f*0nd=B61@gq$XP38 zkX0o&4UHERg?YC6(YaV|vtu2+rYvlmsO*sp+TEEiTe;Io*TcnA3fxx@DF(9gO)ipm z?&?_`Tm6Z(mHYXOm@$!!@Y(T!YawGCZqSu7cVwnHrrGpyZEJX=L}p%|-tqPv4H`IsL3q<~wGCzEqPVtpa7h{P4G1 zZEV8`ex_zLHK#Hjr8zTvMuZToGJI9Qns^NdcB|%${*m9e0__%yxqz3~0$JNY@Q=i7 zAk_m+r&rsj`tI%^!`yOD00U7OLGB4K>qx#98VL!BhlfXSRMcw+hl(|Pppvb1h+Dh5 zo;-c}hIs3-du|Mx+sa7G$o^aPAF9>Zm7{J2#lLqZBA7J)Yf%Z9oS3$p=es=y!f7A6 z{0+9`aIv5+osWC;Z^ZGPh@X_SJ`;ek6y+$appct%x033{>pw5kSHB_VyzAPT+-? z(xj)r%bCo19~(Zs7pX&r<{7W^sa0uaRJYE>=|RRjx|rBl5IzMe4OG`W1gQ97ITOW^ zBu$hNqvQ*1SiH6}^Ev#NCTfujJ3BkDV8m|ld<@rCQc_aF&@+D%SJf)J0uFl=+3TNW zgW|vKv>W4NTm;M*lI}Xh254TQRW|YS_aRJj){qAYe%g5g;Hzg?$4lSE(cUJX$MXCz zHsf90zx0kwNWF(iYF5r|_=u1_5!P<=n&PEN>DC92qjJ!$gsaPT^7zc=?*FNXN7IdD zF+P0xAY!-35F;3i8QV=%=o>5nH792be4awxPC^aW3+umgbKQQv@yt4RpjLZmxzx4L zfXP?2Jjcq$wo`wXVLNvE+!G4Q4usQe{kQXFF}}Yvd?)B2L|JDqJd)ElF-%XZPSG5H zH!yH;#?b{>Itg~UbMo%HEfz(R-ZF6|)tK=yo~ej1!~x#q<>kJF>v$iYYk3g^&uGM# zdv);QUmE~}=gz-KwT*WY9#X#}+>pzO9gSh}}CI-5}H1PTf6qX|pouPV@wEFU-w zn#cI#Mai_r%!1lqkcm@U!aoX92gVe;9Cx`0pqoY5jr-%Cd5ASe@k-q-&&XH2-!|lC6(`(zYVzmudPJ4$M zNA}%ewLfR3uO2_AimJU_OqXmIUo*dmIK;?xoMDn08VtiH>hvsZpUQ$wW*JN)C zje24)OtZgls&0KPJ^%8hw7S{k)j&3Wp6Al#IR@W*gf9Ph;aWiC?Yk@XipH*Ef9Dr$ zchg?rjYiBLD`Oa)m7Ag058tl%V}3~xLN?XNUa^jO^3}Eyk-|tmcJX*mVwt zxe4P}OD!Yk6lFUkHw5r{Dr>o2`f#bwFVh{%R~)5(DBiNF+{D|kp}4?}K#e1hum3vxc;6A=d-Dn%-S9?0a2`Zl|7A z4=D<*oQ=G=dF~}GjQbc7hNO}1hJ}Xq84pq93^8f7nUrcHRMg*x0|@g*LV^-xH@|=L zLl(v1u&-ZAO?_RU%-a%5ejVIe?8kUwtR}v~b9Z15G~92On>0o{l=2;z$LpWhM?bLT zb2OZumzkUPL4R)}a+=Rz5FUTeDt-b8Wj~h7F26I9k80kotVcnvLN{w7i*(u_NhR_I zsO0Ego}XO5#YKUKNy6DkWLot_Fc}Q`-A$d>RNaJ*fj+Pu3{)#MA%Qdq?s0Yn^-QgG95B54JRBln*jdP1}pJ`yD5K@)?`& z_An$wmZ%A;QbGOTV5bUPH_VtdGIE%l%(+=Dg^1ILd&A@xgoCbFwtY<%>dw1z5OaSL_k#Z$iM~wm-Sv7 zk%h@yB&J_$V~%5WnJ6od44eK+8_pED3Vgb!G+pjZFv=rF(h^A6-hK2=-~byx;m>*H zmOIO3l#z{Ys*UT}i18g=2?Xkx>TM!EpV9tw8`meJv-1Wxm{OSYIVsZ%BN1Or+edC& z2aWF|UMz)Lr57*AjWM$uhN=}`pS`BfyeV3$!{pgl>uBwubCFymXmT3gXMhX}B9_DI zwt&>yU0ocFmYR}58Ri^my>8=pwJEzaFjkGFTSO4s>Dl&amq7FV^GCph-T79ZZd9WD zJXhaP^Y<(IxG;n>DuBGevMHVJG?s12YwS=c1)Me{jT$pYBNL+Hxk#m|*B{T1&a6rP zZ{7{XnVxC!1-ojFA~0>zqrYTmPo297B|CJBq(|4XkC5pmeA!IP?T?$!rYtaztk0{A z$&JQK0zl!G1jI{cr_Szt+yBD4(TQ>P(_!9iE7RBNCJ6YPU!0%wm!L#}yP+_fuO{QR zrem{*_(~^P4(`1#nqH7sHMJ$9Eupm7%ZZok(DwNSiYI|B=q-pV#yZ1 zI+;`6m|u=nU7~X#t{-0_X31g$r+b+G-Kw<7v+v?S59NMVU>96WRV^w zzy;hV^I;Ib$HvA`^o@)@K{MZT^@@iny{#bbk^KBQOX=yA)R!$e3Vps@2XwdD$L~i9 zf1zH>?BDE>r5>ibMIO=>+7@)U439yMTv?d?z~vp;V~&H`WYThhFgB=!sz(0 zp_nk?w7$_W`pcxro>zBvhM`UB%e(tW+JhTmGQ9`dt${b6iE+-Hwb7A|+XSyRN1&QY zG-JK}_XbcHmlv0)#bQ0CDJ9?MmpSEz#TC%38h!Rn&AEW`B2KrSd*wMS#_SJxt|&m5 z7u(tV1?`r1VBpOUApAvw6B83^P_qCv28>lw_nCFX=nA^tLpfk5x{oC?-+e@=IRDWN z7yl-gx&JiQn4JjNVz?I|$#@>&GR_UbpDkTe=Uv~fKtW|uk!8=hn*C}wRin$@w=!4m zB5^K<2>sviW+eLFEFLvFh8jSPHAyfTe}Hz+uV8q1^IMIbW`PPxG+&;_*`E({9sD!x zcJaZLX0w7yF%R@M!utB;K)egmS1NdWJUp%=8-yT1u4+D9wQ2EMo_&l*GtWusFzAwe zz8`bpq=xVf(2>Z^h(!D?G6-imeLRnhXdqYmWAzPPGEOUR(EcV3ugPX3%k{9xNH5V8t%KFUWh>6%gXd7aJ(d4imZN^fLKzkgfIP_+;1K8jTPUhFL8AzJP*0c}Gf*<_W7^lvE&b<%$} zI=nH+3uBiSy^})XmiJqX3K*Yi(c0c$yPU0%(VIQAyJ3qVZ*C0F9dE7PsHR^wA0SI2?a2LId?>}Wgy+*$C?cJ$2>gpt*;QL$9LJB$B&T4jEXiSVaNO6Tc@6Gm#kx|2Zp&;H< zZ>ZP`%x3H9&srh2HhNC!|4(*_;|C?)3l-syA1REDjk&MR_ax&u zdX32lZ4f6+&tKheb43WWNAl#E77N5DMrgHRB(Db{w#_BF#|LcPIW1@#D7>!aA2SNy z;`dGr6~h>PJzy1Y;2@0I+dz_OZun&@(!C-UJ<~P2$b1sZRmurH5phpL)!|2;@hd!o z_B4c!9!>`--EgkN|4K7=t3$^a^Tx&oN@{vKi{a37C1XTgTn2?2ej0m(TchDJ_X(N5 z=0m&i51% zOk0r^PY(}9t7RDo@Gze_IX^!b!rDh|ZB#MN>^EUgtPQ=IK0XH7g7#Az&+EVAnRxR0 zKY4a{M_(~Zp;sHD=U2Eym|+K z$?2U@X6m1@@ zXE=P>&*#E_#H}TBDv~!0i9e6V-0bfaTh!P0V)}A0L3rd)U32CovB4@Hdza(g5o(yH z-R4|!QKI(OKG4mPONB}0Tw>jlHrD&Jd|<*Q#n101J@|H87xrPa#Fz+xo#V4JWII;A zRzt!l3S1ID!#B!ku~ zrg0p&n7-UGA^dynxL|iIA3mpi)Ckh*b0xh6BB6J=CHumnw7)XkZ2Tz2iz`c<;{A-< z$J32cZ$7i5k~QzW`0G=0UQq8lq*+($`SjK&|AQv_WZTuXwQ`t%go@AOz-n53@Q6J& zryX3#1}ioTmZU=We)`Y}DzOsS_MTq`F@B$S3|BuD!g#C{Mt^`*TEj*=#XrV=DdY4B zJ%@za<7T@0;Rah&RxiS(c^=(0tP2nRMioY0R)`}g_GMw|zz&0!fx*_9pBNBg5J^3L z`4aDI9lwGC?%hYvm-k$16QuIF-~d1w3No{!@y)RGqiezVHU}ccuJqdO>7hxTjWDAq zEis^eHQXrom@FZt%C+YdB4cX`nLbefZd@N;isCo(&TUhh%D_D|OWR8lKGw*-#cOn& zHY_|V*g>NPFQZUyqk9Xd^akU{h`^5PJr|3@ilb4&VW9f|upl5$y@P_bm?N&BM+Ukd z%J#ar7|!`k8MlX2O_@xms!aUKUjilsdLrm#h9sAoi;Kt&_?}Qe{s3altJ=MT><^}+ z%Q9uaz9|$`OG7)8&a^QCRqr_^W31!!5<;cL6=meN(VBDYt&hZ4sJYsy1~cDui55*T zvTi02o1_&Lg#oHyvN1ONiH7pw@FC^-?CAGAm!nUriw0vopApWSo`iOE1+F&gMyiDm z?jyCbg_-mfn%un+SCR9#=k9M~g6h(VOKN4v2SbSyFaRJ3qrfo6?08!XH~|Q^9-f{y z?`@lWaRJ{72@h|A78$p?#0-jke>w{EtK;V#=@=h4&PfH7Iti>|C24H546`jq*v~(& zQ2n#}9_?-+=n_bHGI~y#QC z5UElbD^%3#^`C*~3JKBtb{-xPQE0oRL25rAa@Q9NfKI5XnT^L-<>ckn+qFM_%*f1q z{N#yeYwPO>22CljY$^S#3-&XxfRJe%zHddSBwUxR%zZA#ag1qXsl{7)ftnt+2mGgo@VjJ5)^@PJ(&ivBSUY`U5(kB3l zd-~(&`^cVnMto%e10b0NT}r}HCC!s8NK<*^vzh7X{UH}tks{$oX2%|CLOY8^Hj~ux zl*l64-7GqobzRH1J%aJEHMMx!X`#s)bVih0i~3nrAThsiyYOHlV&V>fGAA}nfz+9w zpSMfHG3>fi4j|xUg(m150lN5#cQnlp>l_NYWAw3(b`z|Kl{;Vj@))>ftS#Vfp=2m% z<<8YBUCWz^hx39>K!BWU3OzJhD}8AwaUACEptINm*gr|p^+53Be_>3ZhDVA;fuQcE z&RK@8gwZl{N?6RsrY7il2i@G{7>uieMPC_adkzHTur+iU;pM!<&PQx58x0Vwf3;D!cQ2lDiV^l&FUi! z6wnKe)VjI`5eT`vyW_Ly-qUp2xd93r(!`9up`oF4%X*@21yg}AbG#Q<#{{0CIT~8h zV!b!L)N!c(!Aqg`UJw?qe-NmU^U10YC(@Yc*=G&P$CobO#qGCnk>L%8&%7=zxsrPbY+K3Fl^6loJuwe1*s;1(@O>9e-RBDCZ z6z-3PDaqH4#eb8y9A34@+WzsGX+qi`!I;$)#q4P4b(QD<)hedGv9ZozmI90g6y2@f zat`|W^9eWyAt6;7skj+GhMFY6S)rv11!<#U3E>ubwEib2v7EJcKi_6U<@}sDa&&#& z2>RpbiE4E{=w6L{rhNA6s(!9ck%%Dql9}U1oltQ}$pd0yf5GGr|HUPlPYH(~9@>DK z3tG1D@7)AkEt=DsZsx>?&iSc*^6*-B_V_cW4OEw9{B!NxdZ$yyW`@!fQpfhB(LVd# z+L5tUna|qjuVX0w^WYLNK?TOeSGidD$RY?@c(^V|R*WFD)EQzwK6+p-8s@+(ceu$^ z3ybyo?U}$7-{sv+(!I0xX4hLp#359Ggu1-BX8kXQEf2(pwqP#Hw?n{J^EoMgQVzah zC3uzzvdiZwX$-gMA1++M%H@s!2Qx9TQ_pNc)y;D>apNdH1PKF)me#(|s5&k@G}Mi9 z|1osw_qsb6H)#~wD5^A1*o6x3FVrJIz zvHFLr81xQy^x^o{I!pR!=RtAw1m|CaJ5uMNh%`(M_NNh;|H6LV)u|WI9l=9LvbMg| zJKJBmF98L!(wI)&*$BcA4?F~#bc>kmcR&4DHGNJ&dyZi}E7M*5R~YDbOX`LZq-^_fJK{ z#qR_J1R&Ql`Z*I*NJPXV=xn%0Av@d8q-s@Mf`>!MJX>fGS!Wj-QG(WpF-aGX2--SBu5WACeb1}>Y8ZQ=K*0y<|9d8f`7}r936S5Bg0MriXKml?;GQhOq zoV;FB;9IimM-y2;;dubn%lu}3ITCk2)$1q1WYtVlsFC0lf;7R53!Y!_N`ou4rlP2z z&;BO6>AT{*;1iU(*N>bR91Q zKWQq*6@+VUbk0L<=1W)-3J1RX#8`V&jyKn#?cm7Z0uS22CPOvsLEI0&i;gZE$YJM_ z*LPLV54vNqUn$>%SLFxlI!{b8DFBb=nkcEiLFtA=L?i*)Y`13>hl2VDmEYL$hNZ65 zDvusLf{txun=FcWS}2rg>f30-Fn>{eVS)Ms#8Zxuk2J3`wy;ZXsct-f8{(}7G0hh1 zJ8#fXP=b)=J_h!l2Eq2+njbsodK9DPzbo+!L_9FBkp-GvAugk|e46-wbX(X=_pO0E z)reiYXcUlI-nnOfP40uAHx4F;#*vUO??K=?F<#d%)fx-ZXvrtwKfqwGSs?32d$}vy z9B7A{M$wvL6D#?XH*q+!ekUt@!pb;IwaYfF%>zKPOs2`vQFJ%)wB4t%If~Ezfy)$W zA1*n|??c@GADC}X{89Lq8m}`>jf4FiNQ}XG41IXU8GHtO{QS^n`lb1Fjy5MDk<;yr z5m8YYOBz>Y<3BL(rWTLyfD@b#bu}E{PaW1QPV`NM@{MnMbj_R1U{j-yg09?KXdY?w zx$wNF86F*$nmwGjl*z7VRE`0y)V-)AhW#B8%KyP$-y>rGHGTHJ;NuNYE`bn_Nw)(Z z1&El*wVI(k%^(P=<>er@SUesGC}-g4e>P1zeq>CAK*pN0+pnWM|#WHS@q00=9^#Ip|qTtFou59e)}Az2_;=ua-jf+8PY2obnIRxY_La zzA5BwOO0NY=}ag53Nz#|w6zs923g_mV*EP*i{+x^(69GGa8`i^!DC}t z+i4+d`M{WOGRcY5lS@i+ZyiByf#kyBnFr|v_ynNk1E7g)VKg;e3Rlw58px0p77-J*?K@?mmkdSBO=8C5GmovXOSV=4TqNUPPq|xO6|HW?~m5y>dG&0}0 zVhJ%%aaokDcecC zUR`6uu-|m%JNWrV*^jMfXx~`SzA((;obdlITp=yIfJE;qvu-`67;cM`t^Ip-xL{T> zCn06)g#J50-gJ9_?N*ga2hVUxx@}N%u33l8eT%TprJqVR>A`FMyChScye+~VNw9Z= z#v;7YtEUz;TwLSSzZRF4j@Cr3)c$*F3cgDJvrWj|WNii@A}l;SFcZ^B{5D}}xS?@7 zrPsStm#EmQZUE)RnYB2ix|Q7CRyH;^(VdrxH>nK>0oA}S-T`p8dbjBhOtUOduG+lu z=OjtHK$+VCX`PVhh>dgI^f9e-f>0|@S%`Nz!~Kbaf%jy#fV;y>1-Lu19{KO&D^|$gNbWBW;G+Fl; zZ@ih7B0?i`4LKqtV zy#4*>2QuZqfB&9uWzaoWug@w6uM&92!QqFH3sVxmfVQ)^_&bz7*BAlvL0WZykPYe? zsO|klwM)-f|F3qOc!a%Uee^UREv>$cQ!L^2PDK{oD{{f^@>o!4eizrltE^#EF6R^! zkm;F0&wS*k({nzE(-j>!^<sxJG%A1q13Ed2ScU?A!;I z#s!o)yJf0rILMUJ@9#e#Xu16F3(o(NA!}hF1zLD5F01{5n-J;YF%9VgIU|a4H9t)Ru}Av@CtV(Y?g_L&=DMKi};Y?l!kQMv&#O%n8UA;tO-LAyvwJRy~=fC zeYXfmLto8gRx-RSF&eFh7yx`jMw_ASlT+Q_FKHMDO=mywHrL|TUl9Qfs_zXZ2%H;we!>~p#!ExhniBd35CdU?G&O5rw5$pWUKXDujNn_*j>Qiq0 z^rl6f20;vIUJpE;VZS})9<#0Wud!=)yIoFl>+%kNkAh|62{Qj6zpaENJ3FjhP~6+6 zC>(|9lGjJ{Oy8JKcs+PLl?4fnCDvtoOl+HZkrRT?VCtK&V@P~aZvV>#A~Yl(%W1V-r!(K8_}{PfX?f!Ed-bd3Q{J%dI?o(r1%b(T zZdTeJ78Yi|nwehlJSZqg?__rYT%*+)R#yfwTlssHn8oob7jI{c! z^Mn>>42tSzq;}(8mj(lYkt%x@xXYj^1t}vxSQAGcAe(Q%ghVAL0*sO4kH(XQyrA;= ze@IZ@azIDA)}QZB{~iknv(!DEH=#H$S>kcwt}fy=src6@08|`(uaRaDS>c}oTql=| zBK48!Rvq3B-Q&{as3h%lF3JNBj1*39n^U zGN;k_PL= z;m6JOqAlpbY>!CL2Mu>AJL+~Mr7bqN3d|P2h@|o?c`qHmv6hW~=gum-@p?u+abSs) zU>L%mc4PlC(Od7VqE1-~(%6(iCiBOwerqImuK`BDXS~WIQU3-_|AJi5N=;y!<9}-> zQXh)twr2)TPaA$My~z7FL7xEsCm6#+T(xao z7xc0*Q$|`xcsS^MZE=#OjhaRgHZm6EHjPn zhLm#awJGU%M?;z1rSPmaF5{nl^YTr{l?kZx$?{uU?3=s z7Th_Zy$wPL=LC!*7R(+LKiNRRVxPrOsl8-)?l_Dy>E)w#Wu$g7GMd4v^}r4sUj)6| zWpu{`1Mwr7=;k!P>UOkzRt!!!$D&inAm)cZ7obj>D!*LNyiDsK_x1IqrK2OYS>C-zaSijhwxJ><3h$VRYapS`0 zPpg8Lmj{hW;`5|z^mAENK?^hJk3DX4TA<5ezGF8@u2X#bojt@qLy#`E( zd`^?!&1`fwoL(^{a@zFNuKFLkXP#$|qws5x1@tTVmc>+CyCyfQjXfLZ9w=7uvDA~J zaPpZTv>X-LO7FEH#@*hZ=jp>Mjf~^8_62%=dqg`3^z!u}AQO<1!T|UZ?$oWw_9j!8 zJtA-&I|kF?lhJOMp~Xu8p&+1P5fJ#aFZ`8uJ;j0K4S<%{E4`Kjzsp|Zo^@z6i`gV( zyf8l8mVO$#jQxXe!m9r*lHXR+bPmU+6ve{EHt%K8B_brW12 z5*Wgiw6t%aK8pYK>p5s;sgKcKCt6a{si)@c@3cAVhc+Lb@^UZAb7VPhh}1VvQV8I| zGJ2Frt`z$;wy3rHu&li%wNd&VRGK?`w|+lU7+jR!GuYz?f>Z_6wQ*e`)~$@0QX#V_pT+6in)5 z)zv3Agf~Zv^eWX_)(+_Kn!Gnz=BK3AHf{6QFM^kOU(c)jak}{4&^$$<6aEcLP^}PN zEO0`514slUM`eZQUom-+^fB~cgVLz%;&42Cm2AA!bP0ME1k>c0fIx?SKrW<>^oHxJ5rW*970jW1(pN}K*#oVoPetK@H+ybQLW_gPMS zMVKMpy>I+p$8D|e5vq*E=lgoUZu#`46@Hjd#jCD%FvR6A)osNHYE3Cg^Z(QQ0xzz5 z9NV>R1&lUCQij^Yaw6fqDFj0g5c)wkIWecz>!*01nWMimr@#pXVT$Av95AypE{z8y zsjsK!H@ry%&^|<-Ce|HEmh*F9UW=E6CaaS^qsXz1^)&@VN*IoL8xs?(OOQ?K;JxE7 zo>mXt%dCW;_o$h(C6g_X)4>}{w)FD`c*db_4(~4%+5TP=z#!Xp4 zV^kksyy6+Wkp{4TTQYKT zg3wKHaB#3bQ647Z_XzZO%7DMakFU9_Ay{=3yo-br35qeDj^2TB`1y0i%0XHtPif3s zjb7=)EpQK|vT!74V@~WXc)6`Uho>A@Gg{t2xf>OF{@X3E9g9#XjyL|MDx0XK!S9HL zN$XwXq^&=6XWC3$d#`>{@%^sd!2dF7T=T(nJQu$^TrUu_eR=3ac3jT0S8Z%g*u<5p zoIwl{Vx(1v-ol@7D6OGuEBt){pCpzVtrpV%@dHBTJ(wqfD7m<}n7#B!WJNZzeQ<%( zq_ncr^_I9vnb%vrvA~uq%n#BylHP>J=GW}F6Ws8{#9EkTS_a9MqEvDe9i;svlvGvQ zTgY7f+ZT`$;t8{c`+p1v!Ei>o%8m&I>@9y(R1o?#)rV3`l!3W5Ewn#_N~I%;=_?%L zp0P1xYng$8fj`;R#l3FZDSNRMR1Fy!Kwlk7TWDG;wmbqVZz$;Fcgdfb4=Oz1w0gHy z?V>`MPj;Zrs^1#k{S4NUUR_uB3GBp1#L~jT)2l>iD7Um^K>_Uxv|a&S+p}T?Mhq6f za{}u`S@-Z`QbJ4S-B+L0ni~tQNb59zZVqJgrX8y2eKGmLB|JXgGSH7HW?P{Mx zYgkE+V%H#FLB9V%l+VN^ZMIX5owH}?L~g0V)1pkrKMuKZHny8vYhhl z46hW;!<1hAPftWld1+ewSGI3;&d-0M_PI;D5Xlu989BTtHn7KYx}5T09_3MlEN8`%N!at{R1Q}K#5A-1vICm{r6aX8Fw7>nWWKG3+dR8I^{aPTrK>v<~ zM*Cs~^^ioZ^*Bz)!}I#0UL$3*&V)m?JVpfEmLzJQ2~s+qJ#;!;wXoeHw>N*?^Q1SY ziik3dChEVZ-nzzY(o@SKbS)6cZBRG@ z7l;H8p^dEjhe*xtIAj7y=n%3=PtcJDfB)_wm2N2SP@I-_1FT&EcU8;|_w_{@;a=N! zUg?EaAMlI+{P~VIZ|F@lk8l5nvbTV$YVF!U!2kn6@hE}_VxW?uNSCdkprka4NJw{s zA_^*?(rqEq-7QF$G?Ge*bT`~*>G%C{|8I;t?it516lJsbTJL(_IiH$sy0;Eq`?f-z z1&@DaCQB^Gr;@1C2gpRO4_oGJPM`QB8M!m_QoNIp=;$H#C)-q>Zns*d&eF;YDeuZz z@0^byPJg%jp*dT{0!LxIm9f<6t5O}OLB?{l;zT5#ip*_kh@Gb~%n9hRxWp~B%W z&Bc0Pv2Lf6T#$wh!(7?d>fwrlx6^IXS3a$OQb^a%==i3WmX{p&doSxXDaSimleq~% z44U*TZiP0k@62$C+7(dzqj1c!Z_4_yUNws^%V#BW{?OXD4=w(AIl(F#vhC;utHTNd z!|0~z#xiKD+aOAj@MF6jX8(V7{uKw6M?z)|;g@2${I~YIw=in?I(_DS(;@Gl@I=On zI(EIpQOa)Lig)LkgBeD|NC^0X>GIU-kO+l6mb~{lYdmqhuqh^QL2y3Gv7M>x!g`P& zqe9h%jQiNJCkTF+o^hy4%jXcL)1Us(*lI}wHoC}4H5OjOYZA-+g7Y_ir(H5MiWXTCQ1D#4M)`(Vf%}c!J7ppzzaao+Q2Yr1 zd;(*Hb_tX)L0{lM$GX)OZEc)YJ2L~l*N@$ks#>0Zw$2eV+Iq0Uz)2`aa3wo3?|EGT zpV)HWya(ZVDjvYHsSXv)=$f99@S>zWb1AT>W6vpJTQ#=#vOa;i)si|+%7GOUYCf|i ze?Di!lRbWRf-P%|nx~W{`e)Tur+MO59B4v^ljAQMxOpGm$@JuxjBIkFa@X2IPlR^m~~l){s$@ zRBEUSQ(e4x(Z!JGt$4)mG{wQSbKM$toD`)C`!YHl#?Q%iD=aHHrFo7t*4aI>JYo+e zCDOrCYNqjsp^yOS1?bp2D5w(oZ7UA;>(rT#?qnaZ-~M1xy@ar^iPm7T-f`2-AvE=QupPBseMOw_g{@UbuNul=CvzcVH?w>1mcupm5(K8y5kalICvkI_1&Erties5gbOS2eg!pn z#Vum?_CiRFgBIEc0Us_XsK~p#mM&1p2maaX_utYK&{MgBMu?w}IDgf|YRcJ9onktB zHbvFw8b%74o2O1&K{AOzs-7|hd78GfCuEM!L>Zha*5TOoc|C9QZTWUi!3T6i8E>|S zYic2T?E2$#IKlI@c{RBG&m4~$nOnO)E|$k9<~CmGB|Viu{@tI6^_)$GmmgdF?hCV# zi6*?8d->MSG0dE5dhJe=$DYvja!jy?>etgLt82zMfo6l2W`?XXS6yk;e$9&D0r+R% zzUz}uww*TlrqDOvrh8_BnR&XBlu;^XZrg*Z^VC1JD~k4@UY^~={Q6Iq6z_5S-?KQkCsK;4Ezlc{Tgpg(2U?UL%c+-1xtN_4wce^%v8+T~8Z`T?%j)Z) zY#UO3E=a=HV7C8&zRye2_RxRI^T9AZ9n?`~nZ6M5U{Cs31_So{}xe>0w z8zBB6gzXqV@@7Wej35fIhXuc>06o|TJ$lK#Bp}We<>eYUdht(Tr9H2y`Jv%x#^=v& zU%q@fe{d+)c;AUJHKne%qDD5lDbH3tbG%kX1x6PO)F4%}; zkL%0qJ*_Iz7w({w*nNS*@Td%p>FnZ}_yY^`&RzqbO=yqGXz}23yA?5MP-hV_N3)tz4$_xKep> z?x)!>(3l~Gg5`Y}Y-JD944|`d&AHY@WIN%h3xo-g5c2|?h3p`qc+4J|bT}u|Y}g6& z79IzJr$wFpbIN)V!F9U&`Xw5tNsN0O7C~%~No~I{;E($tY%-9!F|B&}{&>@K27- zrxzC&qtWS`>YcI{Fc4Dfo}?w&`>d;bsHOsC4z5LDMXT!3RBsZUM1?+S<Xc`}g*WrHJo0 zCd|FBLPKl7SiC6f)1}z}84tcY6FTztT$_|+dkBNk0DA`ne5TI;&pTH!bMj9A)u>Yj z^QqVS{ep!0uU5Hk$Kvflx4Xl6t!+ci+(s**@p)P&?@?a+pDNp<2_WG~=G)i0JNfUa zT&Z=_CfBF9>XGm|a9V=@0RE25qh8~{{r}p^{=s!bdvC`b6DK$l-K;0eBKNGK5!>pn zc|G*K`6U|aj6U_Z2GpgN?7oC0k5BlD5LFJ8d}^|rDu3!pSF%Xm$n1O1;1%9FB3Ih5 z_x8JsZjF(R8Zm<(EkvV)PkMLih*F9@;mEIXlw;Y4+P^XBV;Jj@{g-5~yFZQ!cCF_x z7myfV{u%N0ig~TZ>C>8}6l(TUm;dN>hi?R&CUyP~P>au{gdUJ&g#Nxmm>itzU&v(x zIkI~J&&$Z{MZTznmv%dO@T$(f<2Tg`TlX$J*~QIrAlldLw%huBo?x&@yMQBF=c(aP z^li&QO&XZF=ZX_7wKGC7Zw*UBNt9%qFnoYFj3C&kyg*uODbzK3`WID>!(P* zH&sZ>EB@If%uk)QU{W8aKU?VDsdXbTQ<3s1Hi+{_HBzqDiEh{j7rgijd%a5X30vB- z%~RwPHcWMMskUx;`JopbPna_1D@S{Ys@2L^iaKj9oyD17v?)FX09yeWZ zw7%`GQq@gGsvh`&*nhV%WxsExxU18-t0}}W+~ZA<$POFn^qw%4sXcy(^Se0-SH z=JDJ+6x)!IxqHsfJ)q?^q$j6h_y{#T0E5B0a4NBf4_SMlB+NN8igXEp3T`xN)};Pb zuFZM_n6~%;VH*HoZYe8E0F415N8AvPgS-f!@9;PZ+a=a5qS10f%f}3lKN1sPAGlha zzu)VOU4AF^mnYYx#Eze6*0T_+eMz}%7fRe?y`_VUQtDn3z_549bCxxRKe6JYA7k0& zoRDh|2@k;a$+S$!nNR%df<4X6(OI3`Gx}_U9CdCQQ+&t5oIqR~i+$W>ilv2Xr*Yh) zxXE~VL$y4=vW)!LYrCe*m#?F|D$e6CxISMylCg8hpPb)C;*-6 z8TbiE0JC7MB8W2{qi({td^^fM<*LUOA`9(LCJ=IgNFc=y!BtAuDB47Vw&K50l;Ou` zH6Z~3tR)=Hf-@bPxafB)D2cF*s-3AE!k8s2`}BKi30hi_Z@V^Jx% zU-_^d-BnrN?Vrq#%TV$XV~uQ(L}bE8Pb6@TwZNxxAFKrwhVQ@W@R|R5CC#CRCC8w5 zkv_Zn$mrFKyIl)=ekiQPb}XbhEGXo1um*h;x^S=YcmS@TZ5Lu&F(vC5jHN&!R21`( zltB!Kxp;9itogB~MPuM*t&y?rQ;-6542LI>uq^>?zb@ov>Ynl4y;rW@XvH9n{(ZCQ zle<%A`wwHsI3NoE(pBsfRj2CIG6nWoJl;(m(PXjuMu)$$pF6|oaE*H|J=(CWL^PNu z;+dB3S{aFbL?C2H~KC zhMA<3zSp~v5`p-R{ND7dFAoq?VD4b!1D1&0;gz3X>EcwMuSGY~B_mYy&z~n99(LJy zHo1CoUqp@Cm6D556;%^gt8PdzEqAQ1tq@ixR9Q_eEz@9sr~196(yyme9^`q6eIv}5 zRpEWJ9@J~&#_|U0KAtpdRj2P#&VT4g998Z4a4BAE!nS8^X7Ji>q6~G1Tn_e1-mhO5U8E8|Rq1Gpkem4_Z1yAK>qZJ{XW~i;V=Mx+2Rq8C& zZJ*XN9f`VgVU+CUU<0YdKV(Xs(nn|bn^My{xROGGU)v>J|1}z*D<0m-SljQHT)FlT z=JOljB6(fYT$-h)A5;fe5|pFhjh~+)BBp+Q@Jd(o^Y_21rl$66W$j0{|BF?fa}mtE zXEo&x#Hn3zl^}3IjCA>8kg?S5gb*yxzY?F!%ycb_odg&&3NXf}VuX#i{rq?}vuVmLrZW&kGjEMb(!3cA)w>h(T8Hk7X!#%W3Uqy3{Li zGuO+3oaU$bx%b;W#-0h=^2?`$C?_mjo5Z!F5NN26-MKzpSaeHXaVe3z(7|+bRBUqi z#-ar;^SMC@)<}nUB3U??C>|``W~r>c_2B8M&h?)=xOU%z)I2tJ3)&n?0F@BN!?cHj z`_#xeZf+9dVJ6^^eF`e1i{fQOAsZrOL;Y4cqR;NkL0&et*eWOK+8i3u(W}hwZ?euh zTr8o+fSHZzCMgkv+V!?Khf16RN&(tV}HFa_GFvJ-wvsTbLCHm z6kT1q4_gpl#mml}Cxv;<&a{d5dOi=WE!8ZLd-HmYeRtLE1#af`_4KK`G*+E!73O_Z z^Cz@?ziRl?M0|>E$1d8lv6E@J2N=5|1S2_C6IbHo&4xm)sOjh`k*@LG$8!T7Y<`Dj zZri*tD6meh4K8P!=c3LwJ%s(cb;Q@DU4mloc!`NUO-tU$_Hc72{}JWNT3@+Z|9lrb z^qa0iV^Od^mjFe`5ZIht>ytv)lC4rUY>qk@zLE2LY4D02V^<=iw>Af; zawt5D6W-*zkvr)`MoFfYK$FuYqCs>06SL44zc)$uk8OOqx{%T_*5#I`O$QRyykO@0Ga5VT$aDzM{qapO!gE_@Q(3 z^uHE-C2XjuEJ^2v`@E$@exRh>d>HahLJZ?lL{bRR%o03(x1waLgU-F^?Cca_luGm~ zoU0=fZc4Qfn`d+z_-se#jY_ZZ@(E>`BlasZC!V;hg;2lGp*DXjUDR5m_xvfs$(hJ5 zpjh-0n!c7ZAj)>g>D{`iw1A^ASAW;#M(u(xN>l!Zz6$B1EA>_d+Zz~(e!3SrV{y|H ztgJ7PdtDnQECG*P#&}OCW5mFPGfcKpIy!6@`waWwnGzXr;>Q>S9s$Wm5Mp6dw^Vyk{b zn}tqy8}|Kg6a|~K$1?7)iWHxo>XvLxJG4rl&^4MPWg50c3Lmf#u4v*ofa+gQPmlNm z2M12y1qH^e-5YGjLM3UqO@K0Gc8$NKGlP>uFHPWc>FAX8q_xoba}PikR1MJ8b7^Y} z)polS96PFYK4YTKn9r7burE^nmG4x)vxuZqh>HQwTi}M#?amBd&+6;z-v;mcEFEPl zRAv9R?4bUH>)*vd+V2p-xX8MDONz6tmHW$=vXa|2+$nC|zI`5Pk4^D0xSR>+`{5CR2eT`|;9sQ>JvY&Oh9lB0* z7$wn{=*2v^)9H1*4bLH2ob$s`LM#Z{5h!<`w&)5i3A495K9*J}VqR`A%Y=Js4pn40 z7Y50F-<#i%Zj_mhWbh{bt$@51q=xt@E17UeN_g8A#AxF*}75gZ28jhH&I1 z4O4;8uHSP_>T2<_CZFYYu`G%{>l6z5b(q^{-y!w7)sj7I(doe-3MNNzfcPqAS9heW{LVgRd~s9iR&R{-IcCwNZEyVeIOr#1`{6=WKv zpGzLPtaRs{sj?HcG@O+eE^@9>j1{M3`^j-i4!*spA8mmz-z?Qx|_qzN){)O;@wk z`vuueHWJY8+#L^1Y(hvb{rYLg?x>caKwA}Y;E>ZHe3CEQtMVl?w9Hl>IGwm;ZlC0= z6j$0eW&V&2WanptQ<~~|6CptYt0x-BrHNjB^9672uvcy7ogU41szi_Lcd}O+%xelx z21vc5d~uQYC*8kqWM197cU;FPvuOLG78R${*?rD@4%x{Y zVlUkb$fv2~cnnGHx3_io&Sy?-!Z!RP=p8BTUZU|;5&3eW`^B)6T4DA=F^{{-NLG91 zQ}=%Z4zu}S+I<`rbP|r4deQm64qbmpKtFC(kDH9wy6&g<{96m~C^=h-M18x;MV%YB zME!iWsW&91N5o1kn3YOzcNRGo#OELYTT|uHy&~Jo0~Wn!&ap?_QMoy0xWGB$ff?6d zH-{vTUbPsXkk>w>&fs)8>^`x`51hW+=b+`yz9MRvl50`7l3yqGUvKPDz~}3qo9O6* ztkfDTtK-NMzw6P`DX^VK#b=`UitMTAE!$FmXNvju%-&#!Xe#$l-SVzqo10F!4};iW z?OJ3Zky6Pze)2)cgR&caw;JX3sw2ic&1$mRtMW`%twQY&I_JL2F#B%$N+xcfPqV|9 zIo%ii?#$S8>o6^c(3(T+sFvUlB@^?FfckX@y;cqk93m}5uoMKuc0QK>{C^rfhE0}U(PoMEa>j&+ zj;5cVvR-wUbE@d=PLFR`&>H!)XM=%T%SDD`H&L&VOx>l;OE0*}Y+vHl7`Ew`@%}_? zJ>P=U4ZA9#RJF!zLd8T4Ql#qL&apr?4<;h>i*78{5x_LK72~OD^UKv;i=f+5c(INWbBr?ao44aGhx?Ec3<~kdy_~3wXdRf(v6X_lFv$8>0-ODUgr39OvidQ&gfZ(w<$Xpw=!u zUz9aqcI?mRyopbTb70Jmicus4?5|}N9(eeTkuHJBa5pio3GJYt*p5B=b!$zo^!)jw z@5k**GGA89270hQ+5L0+NQ7_QhID=E9_Q6}8M}hYd>XEvH61aKBbX49{VyF@Ki`{n z2=AQFb6KmBw!LdP_1MH{%5rIQTW3vX=loj27593MrG}D#g zrug5Osrb?W{+(4os&LQ$QlPoMdbNAI{qAoMRN{OTc#Kx4umggX|8=$QRWF|DZFm0G zRRa@$>MHLoSKJPtJ!8P+)Dc!0@Va1P%E604y)?}`U4rP~Rpfyug+==%kdz<11%XzvBV!gFZgoJ zN|DXa(1C2qTBvPo{;j)9)xeiAOXOLDIOp(Z{T!XWSocC>`Q>jECLLoq&`1sjdfuJN zFs{yg(|>m%Er*axH|uq)Rg96(bwXP@ui*SY#uuY~QXHf;RPlAR~H6qc=and<~@hM@ojtfhmPWvw<3J0Z+~P zlC3urTF2d5wRcBKmHpQH(k3zBTOhQ)1H4=PvrFV-6pfyhtSePg5J8NjtsS_anaS11 z`=$gN&o?7+al$&k)jnc70D5@n4O;juM-QNLMwQ*9cMfip4^Y@R19AeuM2a$86EbWd z^Y4lo%>PQvPA!a$`}@YPZ|(3e)#&Fl88>@ZxlpI5%yOO}59^^|`)>b9*U)f0(e;vc zu9{KC`gW$}ZnqyBUy{Cy&i@i=KB0a>cxi}Q2oJD-sB`wq(f_MBW2J@}surq2SMi8@ z*yk&$eEjtc29B&7+RH6<{M6UL@5dSDD&O*#pW3s;-4-3Cdn&L0SlZX-S%>QbCPs6W z)y_f3Xn&X|CDX0@yRLjlo9_P6^N@95Vk4 z>SQ_F@*m}2>JW)w0uL0f*~0mlW)d%Ibcb#Fq8?*1WBcO|dgLT}4ittD_d;l-!*26p z@-g`_F)Xl64gZnGTKh|5iSE1}*|_zl3ho1;{V1iUrhcpx2cq6ih(U-!>Xt|Q$lOoU ztWBoX0$p-C7m9V$94@NNHt}TeWB=3S$?)ql4rAhHI<5R@v5#Iqg%qXbts1gfYatLg zWL^4VzT(Y4*k;5Sj1u!`$of{EcZ`WF*q(&)qelJF;ef5ON30;ZLU~8-4CT}_qzPjl z9TA0#F`jHnsoRhQ1qc$N`C(t0vCtFUn|jmtaGEsby5wn#-fgYOAeTGB`#%Wm;fC}% z$*(Q|J8v8?eRykudcN+Ja8st7qP$U@^v~m{dbY$6>8NP|x)4qd#n&lTg+Gd~ z>@6a0ZInh+4tJ|VN)yA4evF1|YX~p$s_c@ZrpMY_djQY7tbzg@OLs6XmbcS*Gd2(X zu54e(Vl{YziP&*a7Q|qYlCm z`<@3zQUBb_Yv}b=2HgxHe*VC(FKAeupiB;h6~<~gaCEg!YshZ)+tuUc=OqO(f2iDM z@bKKk+FsA>Vv^6rAD_G79j~8tLW-%sR4|W+Zli#q4c>9n2l2xf+zQVL{V<%D<0u*D z^N)#)>#m+cO1yN!CFhFmHl=AzmFl59<_s`5#<}*`d?QKH!9@J)e*y5R66htTsN2`ahm2GiQS?BmN^cE_b^EvV2ya_ zti-+x2d+Pz3P~N++!(I&-SWWdkBI8r!RWAvZu!e^?h3UY6Z$?e1<@Uj1~v9zA6lDT z_%Nouqy8`5gQAXQKN~Jpo1FUFkA}~^+O~cB?MgYKQn@h8BX@_QI6Uf0>exQ|vh)v! zOxX8qrF#1Zhr-{#XC(0NgbwcmXQ!7WTM0Jzc9A5}ow!xW7izr#$MOh${H53D{F=(`C6(q)z9dTx zQ*|8DOA9*sX-r>m>MF^2m128LUv@y|tl#aV#--pX8$IR9L>v3FxfZ`qQoQ3*^}HA- zzo1A@#*$B5?M(a6U+%f(Pw{X6b7#;Lykpu!!DvZSCbi0|TS1kcvv$9$tmMkR-Jc|0 zYoK1vwC~~Etb6)@2$OD}c{tjZ6swZ;2IV?-T_DFCIjFT%JsI;kX7U?v!DhwecoqyjmvEiVR8jZ3}EWR|3HDh{ZHD}9p;2B!% z5O)BGfkk>R14Hdj&Rh~=LOMJFs2sx39{6#nK1bpz#&P8--CHnyWg9PL=#dp$Wx*cL z9JXQmzTxbCv8^93-=ve};(AhgTIh(^cfT{1VfH(n7ZWM?761M7@lJk`e|x?3`@DC0N5G|cXkn={51sncW?u7byFBeL6R&&f>rcIG zjip{Xvs36DpVnJH@L1#(NpRfb-FK|)X3y!n<)i2K`QwJ;MxG=L0l6XIy8}OSZRRD=^j$zNhl5p_}GnSk%vmQ4z5Gp@-wYf?Wm9ty)z{EL&0P%2+Fn)qJh;4csL>`d1%ZarA2!{F3Y_yFF(x6NflC(Vf0m)+t`O7;nc@+VVD1^p*&Gd00Fp+hq zS6T7j^kt<;ud!z<3$}R>`Kb(F#ld0?>*#T;>bca?ilhcc0>#0we@Sy_Jn(-p3klR(_f9m?`PyI?}lRc1N;T=!u>Z({75c zqIV$O#9$2yK*SEK- znBB}VxPSltWc@{|G-Z+hAu8`P(dDKiEI*PVeCJhFRf9W-8-pMuqNPF9pgo9ELfA8w z{!TuI7y~ERxeh*4M-K~&bEejOKJ#B~n^X=f=&PdQMqZnC7EWchVuZn|ANoXc#m`UM@H4=4jH_&EN04ZexM zI9^dV(f+Up^b|%h8Dy-2`hH2zPYtn$xj8|6{r;^-g29gHeVt)IiO-!DCjom~4C)nK z%74`#Mj!qma1m>o(+N7OhqG!%XyC-dgpkcs;{ds|y zMl9tx?QL1LvD{kl23~gzHh&0bFy*bu%!;#^G_~myjez!|?Ia*@je2U4M(nEoN zmGIjDcKCbLd5V--?NWdHg?GkM^-m@5kG`QX()QHRG`c|DL#zrCO<$7-f#i$)L69-V_iR5q;rddsUA+op^&cYrsp4t00< z9^+V~?lxJTJs+65zo_Crwf64;E8}vqxceYJ-f?Y2oj96NIolxD!Wzb55RVQ#={O0@ zaA<(pFUIUhVoC-MxuXaUfHjw8WNq5NfEYx9{zpDukIMa#0kZ|s#4 zdep2(s+o9V|hYeDA zRY)MOZtU!g?dBGhM8L+yL=)>on?USifwY}VS+kyi!k;=Ti<)wZ#M~&Ue%m~? zSowzuo_)qM9I^4t6z`H&N963RCkijxw@z*?qbp$I%$}jXX_#>^r>k4rOAgUiUOz6F z;B20?%{#N#6d6$TLe{TPYCWZ(eIFaytmpgD0O~Z14+#;rlMhsFrAhFIVzm>&>VJIJ z2&yIB&A<>p8@I`aHUomJmxl!Xf`aIT7>H17Vp?kD%>ircb!gKp)aAsY~dhCRu zE@&jdQz1j<;mk#;8!som>qH z-^X!>kDd}*&|7OQBjy6=ZX5*oKXP^}sBkFU%1eOX6`JE)4&&R>7kp>xsGO8DHQ>!L zOI0!`oSPr1NqXs#<^KE=Ce+rXRmOIdB&ys?)1~P|B+d@E%*C?$;J!&C2}bJ6cdq?Y zJj-uiM$^^pHT&qFH6jLa?+Hnmwx0i)XeJ$)WdmIbo)Tmdze`Gb4Wu2sSX5LL{&4$x z>D*S2D=zXe5%AUH^yKL~6L!1!3IFp*YBrn2qC_=cDRFld-vHo zp<>KAYGzeG{2y>1v>N#<# zzMfbgNY&HWSYHFC^0|w@rF~slNy%6sl(5#PDMi6+4}be~{~@tZUm8($r2N7#6|0)# z2eb*>MCM$JG7dkOYLxhS1ye8_7wSqBa6j>(htmQ_{xoa3OPm}Ko*-wNpk!Yt{aHWu z&suf3VJ~{SlFz79plz{mr#xWA4|ge=Yo#pe!anmMi?^$e0&QiT-mNoY)bIrr9nhvt z$)&L@Re!`0a2<%fQe1isTk<1dP$+WpY@4eLKCDwk&W{sHjGC^OfGNUXsy7exrD4(s z#Z%IaM=efiSB)6L^}GI=_5H@(7NeLuw(>*)UE9`$KGQ6~2BaqOZbct(OCjdPmEuQ| z0+FIfjG+P{dLvZ87o&jzzFrd-zlZ!_XQRQW0w-N$x?+@74@#^juC6B7{*g~XdI!c1 zNH>w8N2m^V@pitg&L6FPRzv7GAsnn4c%Pda623kg3HhZlzGnvMM17VyP&5+L%SeC( zu?m~sWZnyt;TO!Shq_2kLG`k{ynI4QY)aWVBHSoWxeN;c7!dIt0M#14f3JjK(1#(5 z(SDK?djXzmm}Ub+K>CegD?vu04`;q`5(E;Ur5^niNH8Jz95N*sCYKt+*Pk@&9cN;C zWHU2(YGDaE9(XMU6_c&RL|e!!;BnAuG5bIIZS%|8+Cv8lafp?pNP)5fpxsp)2f+>c z5&aFk4I)dBh**R=8f`3+<)=R~{8>&Ld7XVz1incO`UHhbc+iLz{pmqNos>A7lHK+* zH$j6#WncNQ>_54(?Z!5zmi1+Q9ttNI@W(v>;@S`i52*HBkNu2?DbrwtTJHDIiOKyh z@VxGo?O9lp>w2vF$sPVPy)>5V%NnSS5#%QRHA({gnLNk?Wnf^CJ$o5Np(Xzc?)A^nK995>N5Q zQusy%Hlxjjm@fl7|k6Yd!A-XP-m?jy|Xt9wVr{};Fir!bFmsn;6i2k^Gn4>efXv5>yECSO9KuO zRw8AHwh4S~mv!C4M^Sp{AiVNUInlD4a4Oxa{}r2?S@WP+hx<)v=uNCoPyjTkv6I>^O*t`x_}d^$a%qBxqL zI{52$SXbUb@5bx+a`A_&DT}%H9n{-pWr{a4?08FC}7z96s zG$!odf94$1yPmpXyxwuMvu9TZI&JlbByUKbASs{|%~!7-Ui0t}N;C*ImF)2jte8m1 zd|y`=M|>^E&MLUID&zU{<$(~9jk#pex?!h|ykJpAp|*(xemrN`ARR|Wg+ z1jV3-gYkiW>9n70;$m~hl)7`9IgNBVe8++Y@|`7o?!9MzED`VK#`ai0xss=9g6iik z>TLvCs|yZwi9he9Nn4Km)of9y2glR#ljYHvD75##;lhGT4adx1J_ z$<{W=r(+(J$0=<1G@fu|yv36?5Glp#k~vsCT%MX5W42sK>OEvGeto;wc>9Nb^SKF& z`yM?HWoY;8lVgo6kP`pt-9vt`CQx}LIl1~xqtiI2)T+oU1JCv8M!K@*khOu4sj0N( zs@A?fezgyxAkzMnc$ z&%5v`$d<@(aSdkGlE@bJoj-qLC*`M+!J0G%UW=SiRh2d#C7ZxIJ*s?b{D(hKoc*a+|ZxT4BIsx5jB3L%E&i=JzM+-))Ikym(hDqTSJ7 zKUJyL>)_P_gO2Jm_3~Zu;t@wI+fJ*!@X}UR3Q{y%_EyU~86Dfdo1)VjyP#`Y2RBJPJRqj-(X%mZ-OdU({Z?={oaJ%!znXczotA=(Lp}fHix)3K6soNcB}hlz*VX!S!%-tC-?=5LSmFBf-kawyNUH@7 zn+k}ApLKP064Ky)yq$bobPs<@?90vV?Y}&(%-GlWhoRYY$?kO^tcP&;%danEST~f_;t5xA&TQP}W z6pox>VW|#jkmFaqrFkVW>%O1g8&x&KmI<1}Nr|r(J3HyRp1Z>ru$EF)=~h!wr1PmW zn&D&%Eky`B+sDa;PSZ@+=iPsot($T%MgJet!;SfFq8F8Dh-h7(-2#i3$HI)}?K=V2 zJL0+<&oZ;V2kC;o5G332 z>E=K3@+@PUN+=l(r`Oza^uJ$H@~GQ6iI=NbxOHgHzOU=CY@b>J287cLl)HJR)^nTf zY~uy2ByHHLyFxwIR)SNzny+79ohc;!X=>)HIi~qgqI2>GvjOj5!|^L?vwQu;B?2?; zGTt;m8%S@GO^^5# zlvg06eCrl#Ms>6Lps#@2Yd7%_b!)s${77#_v(hmw zcIVC=Zuf|nq_MHFLDkaq2n_$+%(LLUtvzQk#tXj6h z_`immj%;Z$@g!Sy|Jc*jd?5wL%Uki~g>;=F{K!7TpAXyQEiJ_jo2!RCnbkO|zcsw! zh>!p1<8yLM(xAidb$-56M@alQ=S~(@lf=~fue`hzm#bb4);t`Tt@+J4VesuSjBlxD zrrtR5rWE*$?2FoU&QCrjFT#&@E2O%26cxLqxq6z%bhxYL&aOaI!`-&g8!;)RMN?v%g`)0AvDH(!Fz}$$p z1@785*9%Uph4FVjUugufwc9lB$lvNA^L6V~@>RkdT(A|$B$A72P{CDHSC`b*dZPY1 zW7IA5R_~S$G0hVgA|{YDyt_ya$1^{|WKNJnT>f8G2-79+kA4>q18kLl*Esy!eznW0 zM+?FWj6@-_)|cnUBrGk{r&qxX7y)E({_x=_20{)34HjCPZG^A8f{@((_v?K-Rsk{p zlikeU^6acI!>UebhC(@ApJ+WC*OsR+?2~0ho``~nk>?Ezy*W98nx!v6!E8qd<4Mo| zg+Qmgyr^8rcKt+`@fK_{;Ui4@j!}o2W8c&G`1mIA7Qd}ZtxRg&zn=)B9|`6ecm@X_ zMAqXmVrD#MCt<$xKy(}2kVK>r23fzy?x?M;oozW5T|FsmJ9`ol6F<zyGW>?&_S4(peFttl7`+I;s5Rh2KC?jzY|WUDgW|Y`C^)%{ zHsc?~s^tZNoCJ)zwz4n;vg7lNHXLnuo9E-?iNx`NDR=}uKw-GED#UAOX}KmOaN-($ zDJ^{pT-J1HT1(65J%-xWf4EA;KlwlINTTd?d_rP$#;(xoJQ!&L<#n1|>RS zd_YC(fy?L3eDfZlN5ZmAA~ainv2vslWhjg70y&E0OU(EFQe2F6@Bxr{ zW>yve?90~He7GJTZwB*-Q^Y7FJb;YkpZ)ty`^)$Eu`8E?j;jCMOwqLZblt!f{%oy+Hji5A7Rp&M!_WjnH)x+A$8*Yz??&$<_b+>2N!E zjSMdJ3js|q{cvJ6ih}_prmmuiK{SOopoqg=jXRc&ZQWDr51#4 zmHKTKBQ3WT6)Qg9{$LGN2D*0`?+IZcBI40@9*2ShYE1$#j!*?OiH!t}OmSnQH^iHS zft#2e4(%z?x^w1EKBg{)e5xE>57CBW_?SFdDCQxP{^}_ZCHAk_*q7)xK{&k6O^=PG zAW=|I!2S0jRW-4LTL}M=z&~<(!b)95r5a2IEuZmWVBIndJ$N-d1PZ2Vaq^9rVIt52 z?aEzUU3Vq+9E<HCh&4-pBOZPlPPHu>nEHZ1zxlFF&i z^1_0xwYBl`)y;Mr@}fp~T)n)c;@ZE$wwenVjc6o4)4BbLx{Q?af0DavcC5o67VZ!* zC^85g1{AL}RCoE(rPIc}g)wAzIaRZtWMo*m7{n^2?SOg_*b0@gXt(>MPq$ zL2W-FU z1x>05wG}BT>0I}L|30voo-Fp1|6NEyI4lT#!bEo-5ed7+89x&0B>R?l)vC3H9xt_o zA!Ha3uS|FW3!FgS;Vfi^Py?u1@9*E0*lSEIEC%9p#=l@!A>B+y98cJ@rsn6FIXEa0 z<&9lmb;u4icnHoN93^h9u3G_lk?`^J6UQy_lknIXTUwTW`}P_a!f|PU1{yUY(HNf) zz13NhpO*xz#;Y;tA%M^12pH~?j*j5jS#$VwpU1=yib7iev43cO=aXg=(m`YhC#M>MguwRP|4Xf>`1j+M8`$)+C7)2j+IAML3>VSq{pXKRuen)i=k{Bn>4;0l$J<#Q4;(gtPvl%$8k8Co3dVyq_O!&$x31`LcHRavc z?oQn%Q3)9@O|wx?Nj>PB>HTrEizHLf{NAN!QxEFc%?8c!S}lwY>J`H)fG{MEv~%lRj4sd~g_`-w>gxMQrEUBEebesUyNR=n4z_}4*jkGj1WJrSJnJ(BQ)#jERR^|!i!SPa5NhSo9S4XpN-xP5k0%&et zS`H#s0wGXFx1EqTA2huL0Vwg}SUq^j<%Nkl3|KK~9w}IxSFQ~gO{o55gFSv~din^I z9nck?6jgwb5S5E=d$LwuQj--ur+R)h>cLZNY$#%$LgR5uktgjF*d*d9$H^5I7DfbP zV8Sb&P(W$}5M$tQfnH`yXIIyV#|IpAzz7k`as`Lg!#BtOmYBQ3#dCT9fz6#INMZ{j1=i<)BbBv zqxLv$2&3>}SBl%OuCA^{@>?kvsfD?S+8^!6ph{D^iHarg+(W-)-d{-Rd6|}WPIP1S zELJ8k@@ZV~mK>|k1qGrw)^XIKz{S!$A|#{|Sd^pReg-AN6+9at_pm{7>9?JJt4B74 z3UCqbc79ZW*#1*>zHQ>=L*0o(?#>S^{P5NO>xbWc{0=>Ur2lk<@`Z-ZkQQ;1uGxq56+S*U4ssE6Z zlLHaBcJt*kQlXjWYNr54k5`SwAZPfi~z%tp!%6e#iM872&y(P@lvZWKz`CCf`%4by8+AKWUk zY;roTxg%+9t%r8|#BRC#;(nLts(XXIa`TJ>f*e_so@mUnO_v|c`7>^0x(_dW4ah6# zOt#`Gwq<->q!P7DRR-V+UG!}gqiSO9pmcsD05K#pb>^U z|A5v=Xb`>-*=eq)t4jns-&9kGnh?zG4v0aXNwRhw!#YMes;Bu@cz9+dS>!F>TaWqP zSMxF}U+EY@s$t8;nDf8m4yt##XPs)6O5hzFi4*0WpW{vT%HMNt23`kj7S3QBF}bJH zVWEpzG=V$425a6G5B@vpr~_y2Z$sXV*xH1|3gEKXJG(72Q>gv_JeJX7}We0w* zP~t`PaIXik(EHs_gz1=f%{X~1*_Qd|hOT<~=y0EEazQUHlQf1g;4!Vl< zYl|p?RvzX_xU2`_VZ!@FI9X~--~TC=LurnXAYy$|&Q8v9xWN?_Fo|4>KGB|`{Ba@n z90Zm?n#zRGNbeI;)L7i$zvFG!P*tL#!XWjRampExG!$cgRWTG7@DZU)dxn3TjC@o= z)n(h4n3$;1Tlh#N*ZOw5Rr2zC!jj%c%=@USdV%jYo$NgiZd5N1vK&I;O_b``u85<* zsHiB_uqy~V?5WMtc({qlA=Z-`OAnPgE%7bC4}}~eN|+bHL12He0o?lV-PpwB2gX=M zE!Ze4E2}xo$>CS?mAoFJ+&TSreUrY9&dDmjX7xmKD=Y2s&MXU&*7uiD{eCWR-WU?e z#&)1^=o#{dx%qm9F;=0SYJrCbKavnPV&(kR@W8VHr^r1tWeWQO*Q@L5qym>zkq#Fc zdI;@A^xW0oXz=6yd4yW#%1BGx!9(g7UD@P{%HBS@@PbM9H>)w%rMuPY)zc1JnS~!5 z-zuo1x!opcz3ooMm*_<^rQd!j_UdNd>2^tn-D~|^`wu)ev7oK=?Ub5q3eo8HIy;q^ zc1|_t>ymlPN7JtwULIAlre^X#-dFS%cWsoERg~Qy8}##S{IPIeCA5!i$Bb2Ptiac> z#u<~(6z7JM;u%Wj%nzN{wV~U3`Pt%FHQSEoo&l*{JEMZ9(wsMqIdG@wxywxrS^KU% z8(6tvr+L%zJpCbdrn22HLoZ6jJ{OJj)jK$Gxxm@Qb>7Io(O+Er*GJ)~esf8~E%Cn_ zV}%xXu+y*IY%vV%c22MrBpI;udaYnh!8yl7dAzz$rG>-W5htdE*ygPLM{mF_jD{DpB<_Dp5a<$Wo6!eH%gBuBsjQhnY^E|<4>$fD34|FHME7Vt8jFe8HR2 zj8*!m=>?AW7NrFS2baMS1t;7dj7V{WO*!7XkWFn{=7 z6dfCTF5<>=&qtq?l@*uFL$|cGVEBTlhWrqYK)#nFS~zMO6v0b)=HWq&t0@h8PK~TK zKI=~O4aC1Sr+{I^(HnrrN6^KE(R|P}w=pm*_$TKMig+TuFAZh9ckdo?mPTh8`8xSd zC8c9WrUz+au}etrjL=U(%Q$LtImNKvlhmrPNEu@eMk9P~VL?4LuNzQ;tHew!rr(gE zriqE%$SQ!QAVb021~eq(uUHUp3T89d=L`-G4u{8n+b>gRQOcq^x&ukkmS4XVX#G`C z*Z1u+LAyQRq_J{bv9Q(PIZ%)X9akk*hp9c(d}uz;g|V$U*!(8cyf*Ue2Yo%Ruqdb6 z^A6+5a}G3`(_V&&^0cqH=GK^&9r8&H)_(s^$))u=3pIJ;=5y|CuHgD zqvR|xI+$|rx0Hlg|D5gRGA^^;B~_oazR37b%uFou8F}gw#aj_1#T> zXJW>VCs7fbEX%IRt(!0#s9X+h?`!V2{V{Sz)_L32=>%58^hDlW zL8mj*_;$Vw5%-AL|5s%-i*&usQdrHy^`^|ZhJRfO^j@;oIw~Js#=7b`?_|`GBtCSE zQ>^mp;?hKtG`EAxd@F9jby`i0NuIR912s;??$NJ5#)N8XMOa9N&K095i2nBo0 zoV=#zzE9VNGw!rJn;;;^;*`Tb1wuKgg_RR=bfL?ep-Gu(RoHSZm|q(N=0iBl&_H<( zgtqFVjueg_^SgIr({qiY#Xr3cFr2BHE^LWc6G;x=!l;s9dQ{gkd`s{G-B~E|&+^m{ zzh!(%-+}Dz4bT&uuR%T87CBv)Wm=6>mBO%32!;u)vaq`P1wjXFt{|PL&bG7E(f^r>3%ACn0IHT$(c{Q$?|^aqxy)Oic7Cf;&XUd~hhIblls({JErL z6R;T=rhfxSP@0gZu5tYxrZ$tB7j6*Y@HR!S_KG?K#rB5+CI~#X(9a4}UK#|y(sF7i8PHOw~HhZbeJJI4*01A(XnrLdiw%8v5 z&8wN&tHi`@0s`rV6}tfmp$xrK8@(I%^;(l4ZYSt)z+NBXk@h&mc=n(QEX}KrRU&L) zAT1_lx{C9c627D^l|*WeGcNGNU+KQt6nix36iEvf=$}>6$RA zm@MqBhZi<1_+)IWOwXe_qhZZ-grAOGxVp|X_EKKggQ+dtH!3POGyw{mUT#uOFD#xq z?UR;uP?Ik$sNfv4{kqU5W`$ShOs~EksX?12Z|RWPi#a|n%M(^xI0qj@A2E9L;x)Z) zXNdTz>!bCK$w$^0pJ#f1TCdTADke9wjHC44LB&Cusq?=nVvjq=mFmm6Ub1W|-F#H! ziJNe!=?v954eR^83`cp>xCh3#UDM_aTT-t%>0@wKhP5|{ z|7p?J*qQ-BXe%+Qnb)obe*$&SJ@vNg6}XLZZYxa5`L{Yi**N>Q>IX1WWhwfgtoR!m z-xcCjuMgg!E@Wb4e3qBDO1)QciEX-ent_q;r<#M&W}dUHsoyYO^#lVogxqVR^kZ~N4|=O9v|ujSamH!x0n|4xVvk`H%bcZ zvIH^(jE{=pM8Esi?z%plY$ipS<3TGcS)rVDkV_NcDAY2f;Ktq~zU215`%fpR=e+cZ zPEO|I%K5z`EiDZt95E_}1!Q4fw(PhvvPo~q4%O{?cEbaP)Ot9rZ0+sqp7sEYe}x!? zX+Lk?zD2rBP5KOgiQXWUM>(uv!w$#8BPiQWyRG*Q3#$N__$QCPa{|OrdHQuZC{__v z-l540An_g$o1Z}j&J&&IU5Av_wE@f;HKja3*1SzZLIU6kWGXlqComjijZ4cDD6jGu z?MIc-93dmhAY}ou7KP`9%;v)O_Pn-xza-KHu+4E!<308O-(La`=&=B3{ssRoKMuhJF8P0+o76evr%9|-A71a zvLV|>p;r2~np_qwm78r(?n73Ix@R^;awBponLB^Vx%Hb;D{C%TzkR0vLB-RlkmlOi z__pB1tZd^+Cuxq9D@+oL?B@^5Ic(AA_k571;%+#Vi(ORy!zcC~kD&gQGt)Y6nzJ4R z+g_@B&~lEZa3sETU^12Bok6&ke7KEFSdF2}lZ2+2nc0?4x9GkyQtm+}C%!Oow^lv% z6N_)lf?oSpnOv`dk96b57q`;*ikz0^zb3H~AAts`$C1$o-#3`^uWXKvwr)-d)1F-6 zJ#KzP>5_J|MVVr)sjpD3QRIq+hMdd1gM`y*{xF46ekYeqqvEjWklc@#2e=Ak97766 zWEnqg=c$jqz9jb@5DgIMYVg?^d25Ce!0qLF&M4rC$3Th{_zK$gzkU=S9V0sRo$rKc zTS#`cD4c=sJ$m%$s^nxfw3-^`^j0g^uPI%q^}T(LQ02q)PP(&ac~&#M z;<-@g3e;!$hJ8>S%cw?;ss60lVBahOc94wOY`)w7;~qq?q=}@ersf--oRV^r(}HsC zTC=-%fgkp{hu!kpD}teeEC6KUaX8{IaQ^1EdUH5`-3_`P(-A@3D-vRfSkR!%Q2&o@74Ff2p1hb*s4*&Ae&f% zVY3p(GH3Om2y3*zbiCcH>+qMZvdzIELZxW0$|QwuO(ouIbgE z9o1oyb_)3#BG@vrJW%^4res4CMN>-9L;uB%7Mx>6XNDfUbvk-dK9|)r-Q_dIj-X;o zUOpPvnJ_ibaZYot5uD8x651<1elD&hNI$YA$gch5n;kYUUNBx|^RJ*1kj?s)v&W3v zDy7l#6U>$>;^K8n<5t#Ce$)5<-Zmv+5z#p*Gr(0ISo2v<$T)uGMhkQ5YsT%!uL?B^ zv(c&oh(@_SK-`OsjZMgI@*VFGFlkSK9DUKBHZLWy$0H^}$#8^&Bd#vYzBfAN#IEEE zZ$I#7WyS|kucri>PQbQPwL7Xw&kQXJQA~+teU|n5Q=3NN@X(No=}6T}21ZM#)Qggm zl9j96%j zrB8NqE0DA5{`~p#gm(f& z=>%w>Fc7^) z3Ny6rz?Y`L0#?m+oOidG11ugQVnc&*bx?~zFmbt9ozD+bk$Wm!iGksf(qd+Z=Yaar z*kmG&aYe<3)oj0XAD^9@Hp!L6>FDXnDl13d-Gyv00vpGUCfbi#(Ej(GIG?ntJKdPN zQt!0?hN9y8VYfs)7_?2}hdr)YntH=mcRMX@6q7#~j5l`|H>E2uOF%P;>Sub?Yf%B+ z0;-!F^yBc=W|OKwdlR!&scyvqVP*5u%4n7d?(n zu63E~xDS~fI=fafNaxy{pcoInWy=d>LLD*W`x9EPJ2dFy*yD zz8_#%7cuy(vAsPUvOk#*^^g+cU_S3d(<$F4sb-Z^^p$G5p4rs;du?TYZR$7NrN1$z z8P8KfBAgTtTzai92cznDSUOGj1@YATQ&Q)w=zeVp2ogGlH8?qi^EnDIG>)<9R3$zL z-r@Kx(?d&A)*p-}F`Ow27^MeP^PuhPLVyywc zY4(J>1?TUnsV;PmPYmocnV!fFGmi*1=gi&{{m~-ydV;{U>q?iJBG#T+n`1KnY!Yp9 zf~JFzg@B2IlyER8(9j{RM^xAZcgE=rCU+4Ilb6$jFn;+C=#86>iXiPkitf9)t(k)s zEW_;AS|n)sAb0=@zM5&-qpSsVjL`GZCZYgf<(qZNpa|oy_u%JYY4)YI*4O)>q&k0( zGhCd}RA&nosy~9V8CWD*2Z_naZ_yYAAnlH$hu~4rWg%Q5i8;0@8Cz=Q+mM|qDk?hY0SF=y9=*re*l;zt<|$zBUB7fA zX7$?7j+VFDD2yabgQQT~RCXB7lhlkS0a}y*l`BDpvxXd(-%3l*pjixz5{)kqnakS; zw{~>t@r_TIeXaho*5iWA^nB%=2YD)aAkb8g1y%w`;AZeh)iwCjPmWhGscpKZ&42SP z2`&6j|AZDIpqTe|?;d18G0{q8ByFUSLeWwK;U ztp!>)Rq3W0KJ^428hVzgs}_y*Z4XBW!nihR_!y5(prMwK#3K+1oJec^VBC4Maml<@ zXv8o-673+c=Pk}^nOvT(8S=>dztbNxLKZIk{4N110Fc!OzP`J`NzT$-JR)#c{X+td ze@cY)M|ivl`Do3`&xj->+xx;fwu6 z-6JqoBs~Vx25O2(1_j=p%yIjKF1h2i?Uwssw)q#h*MB>Y)g7jUdFB2GstJGY+eY&& z4N$eCn+^X%BK+U3YR2w=x~l*CZ`;nC;87M@_lKSG=2*s?GCkuj$xIbZrvh_bxf6~( z-=zH5qpqZTK(t3m18}5!O!>hs#PJ_amFqBQ-E-|FZBm5v z`mR08+mCr~eo}}`D)Z1U{=kxvyc7CaDn4z8I+t3My)qT&C#@5vSdC{d&Rp7^W0ykJEqiW z&!#LL>AJsSSZ$prEcB3)UZd8Y{k@$=*hqHSyOEWblNxnlPIbdVp=NdhTe`+F7v^S# zO(#RbR)<1yj}66Ee(q(I7Vnt3{G7{9ht@#sB&*r}W##e(l^K7DL*KO&1|Ov|PbF>X z@y((^hiI8zV{*DgGGUObeblP$om>5f^OAG3`6A_EHUBcyzK%rYidpFV-_l9A6fh%O zyJlIh|7!Qk!%36BedyNs1~!d#pM0^n+sb_DuexabfbhNf7c*N#XOj@r; zqO9Y#`bT9t$8;Cf*7D=t2gF@6wK(D6rj*xJd^Yz;o@l6*UO1m&R;wt>8?VX}D`P(- zzBk1uXm4fSs#MOnxR#sFO4l%5ILd$T-u%X;JIPdaWz$dp;bo-zFRZuF`IltdopB;2 zh{qtp`j+$TGgf26k|(DR?H(y?&!v@TaELuY^KxK|ZH!^iB|Up%X=m@8K&f$?{wJwL zYqk#E;#3#9V4HPuEz@E^Y-|6sXN@m-H*f{dP^5euDxJvYXz5$#TA$`vczc9(&#-3W zhy8*|_S$jguO7-s;vNljE^OPmR-9+RMs(42FU6?*>6EmrXLRBPHNp=XLuml9q<1xY zYj{76vJwdiPL*eN$&*Y{vS_N$6{%y`5PM>Vys=SFC)?&W&5zbL?<)F=f7{&Asozau z+AMOBy`kXctFium(eJlMR{YW*ChTDCFxmY$wdfwjBk`|(PKJ{qSGa_VzO>t~w3#+^ znYKTB+sHVcK2~0{H!b*ZRBPLZS&?3uf}ZMm-awUu^FNw;V?`wRMJ zgviY`$@Qf8LkGHCh~D_F%vtFPJ(U-9xr_zp^G zwT@rDc)Y31{avHc#UN_eWI4kYrW~0jlMS%X-!|dMFjrj{Ll;KVdUs-+JI>2&lS?84l-AUydr(Tn` zuEFmE*K8UO{&S}`YBK+Sh`|m*$Im>zP*TcPlwSdck(+W{bn4CUe~J5p9m0=Mt?YWK z_lD1}rofO_+im69!=}=ABMS|WZs;F9nB09rSX+oZfY%*5f+wdC;=C+L*XW1KKnL%)cO%O0@+9LV4lEo+aE5UE`ep?Qk%U$u>vXB6>vHj|3&~nd98ja)2 z??2!YzZN$6hg9D_oX)Jj8c|}Y91n&xIoUFne_HM3a_D~AT>U?6UYFGsi&OD#!#Rg= zkX~I7lg&W(e&KCZH(y!M<{b5_FvUmrHoe@&5oO8n$Vioesn=ik(cnivwxO}Hbx$}n zlrLcA6caOK>{EjR8p)EjzP_D`W7~fz{u#!(T|nqsT3Wj8iME>C2hc8z9i&m05%xg0 z>&E>nGq=4|Un9YEggBgx;laooz)t;*$w#Jot5lz9Wb^{s?28{ZaXMf;t7)1Tx+b&I*;Qi|wnraL*(ZC6q=4!XwZK zF(S&zVaE;pU&b3~Wfb6*)!U0Ak;mYK5TJPWGsBnA+#zg=BS$v4A_pfkeE^Z+_X(gF z=mQ-387x3({7dic28ntT{Ws$SsK-13j0Wn3X@Yl(3h_sRh6JfYke#pp46cYGh5(^h z1j!Ya26V9fL}uIxT7l@q*PU~7bKGECInVvt0Q3I>5Kon2Lg54mLf11lH%d$|+6&|* zVcHP`QbeqWDQ>}73=~!}+<;K%h`tkxCH`p+I5pq^TK50g4=f&#c_f-+rBv;htNs!5 z!Qcqy29Ar>i*z^~TyrPZvO)6M?_o*43TF1K+{Ia@EdG2v{cO z5rqEu5iRxtb;bpBG{N@m1m+Ll9QRkR_K}_g_^iHNGZ3v`yLs~~#Fg<+(doZOn5;mA zFen4r?k)6T;Jkc&2kEE%`xMrEhTNGH9{tVfTrhz^>Pa3bakl_1XwA2OI8mVApq*C% zj#56dRB(_Ek4uV8B^5JwL6rziaS+n_j*$_ym^iddU*aJWt5dvJYdLnPJE_48!j#Dg z;BVyCfKo?>smVr4f3Pfj#Nx8#4NUd{NN}h=#wR8;QO?{Qs`CJ0SbTAq559nKQ_HWc z^nzry=4~;HLxE{?ng?nCi(g;@g|C06dm2rKL|HFmwgp5?}W}9PHA< z(=ue%JHf}k^Hu)HvN0u)Fbc^vf(|q67v65Sv9Zxv4M%xQ0e6T%VQqCRSTtwv4mWs% z^YH@2LYRZB{fzZR<_*9PkP0@V_;%uaP7Fd`8JI?(n-v7OOiNQUA7FA)dis(7GOy=B zvcP74E$PL~B<>i1J&htwfz6#vL)x|Lfxka3(GG)MMnMFbAb!2@_CB3%(n@Bwqe1k3 zx{2&}*onXaWh)ty4ayAmsPFAve+q(s{!k?YG6|H5I>-WKQL=LZfW-b3wi#~7Cq*CL zRwG`Kn8%_Z{xHo9BCx=p9YvExpnD!0Zfj1 zf&M7uXkb%-MaKY+t8|!XAeeWZ-Q8bN$x#r&0HLBGaKRM;T??u(yI%S~jJ4W04Tlka z6lWW^Y76?%#;T>Kt`>g(u4(4?qJ5|{a@QXzJD{;!gvT5;G+t{*2CX` z{KN6_7M?By0}QV8e7fl15F&YWi{>;;nQHC52v-}}vT*wD&mtEA<#Ndk4LbyG7p%d(wdjPh{gdLre!@%dDPrD5p2~iAO1;*6b z+4i8>B+F;?4O*1f1g7pKxvR*P93LzY9=`g6^Pd_0{ z``g%-!)-ai;FGe^^1|4Q;`dm4I0k!Plb0_-6gYP5*mZRkdHMCO;IX1FOQz~zv0vo< zqv-li#EG}S01jRNaIXwlnn5xks2I*XX^bv1Zc6!u;c#pB!Cn*R9^?Uqlv_n#Wf$YM z6Bznqk4Z?dyl41^6YVHkH#(3Uz)f7;e&BF~yo%b@xcFad5%g8%SmHs3h^l#Ab%&7c z07~JQ(9+kx1V$wI>1Q#B8tNJ*CMLo|8mNvS0RtWj3W3*7fVofDMz5mXw*bJFpcrql ztR$>nu*K>44R&D>Cdd`k8l*acn2ENk1w2U53@gL^Ao~mkJg)E@+lZKf9zs4WAARfP z>tA7pjy^i9q(=*vrt=XuE}el~sP6W@^d}#fDW?B_6W@JxjvBO;+;nBpP+|To~rKu;>8>AOA(Tl-HIWAw=)J8$ye;a($W&e z%dYEjpu$riQK@|@1l?iX6d`TQ&HW5gV}f^uifK+EHpIQ?<)g&W2_)3R`~S5xBhNMU zX1z(w>MG9C+d4YOteS9$L4vWWobW+CKN0wTD}zx17?XfvNyLLf=rn?a-DqZCL$cmh z($PaOy{)ImX4NuifApq|;yfRy)+A@ZjeKqNM9R5M7%jjGMwb6~ymE5EIsLn%)hSO(7`axH4pt$w2}(tu*k;H%^a| zoi2Zv{wyf@pvi{gzR?w(zuJ|oPET4_fy9%y)I2p7xnL@Vr@Hoi>WB(*KnirfO09Ad z5=`R)-@6J)*db8F%#_$vWPy@eSwR||ySiyQ1DV+wtH{d%maO%3MDtU(F5FlX! zxuDhPe)b33Txfa!ZvIL*7RZIkY-tJ@2Ce-JvQZ$;45Vp2D~n^23H6pU!%BcN2U@di z-nL6%umVoWoh&S546zx+0buhISp{&yUm$;gM~HKH19TzKo9(2feFV}Ua=rK|F@G+I z<7=X@Mu=bq+OSuH@ksz-6Rk&-(cgAM-v&G^^wh_}2PO8@U@(qPPZJRjMu1djTIvz* zK2p2^WcF=sZAh*8Fue=w3R6SR#MJUaBz3{54R~)7tXvKpJP73ieppFK{ZkV-m*y50 zZ$R!ww?T`W4y=#&R+|5p^5H8AVv-Vkk{WhO$omsNe(VIaonKV6o`r=4&UlR}`a2Pi z_b04K%lyj)!0JU5o4_P@4OvD|I(6Yh13k-Aq-jX=|N0Dx#n#Wn$Q{{mBkZ)`9>OGI zP35|2C+knU0y!Mn=v+mhxq`>V<`#n!8m9xvx`|^mt%f6M@*h2Zyc5Xm@8L!t+;&1$ z$5~s9$;m`jiI{{ak&HYV{;Xwa3>JX&{u$b%Cth9~qW!!~zEhh*4MBdGyip7pC8sOw zyOf6XK;Qk019jl%hn+@7;o&Cej=*$B?eq8Y?*C^0SPBY6x&`w~Y>Q*brZIY5K&M}VpcDZ2G(6acpxuF$ z7m1xz|C1;M0tHN&Vcgh(A}Jr@GAtjWpnPRO-$l}1@`G?c10^H?qhevlb1rl&3TN@` ztR8|sM0fz-&xVUT1&BGEq)5n~+zgq*x%1~qHymZ`o%YIO3H=Ae;q@S$ z=*;({egM&W4x5w=Pe8Fv@;d~alM7S15R4J)cI2k$;FUtRp_uEKIhhSrB*F-xf}$u6 z5-_d6{|tsYq5^fH{r|Lky5F~~!=8sxK7<2=0>HG*TuRXSBqhsMNp=qQA9sG<^m1bK z*tZO1a6#SG4!#57JQs1QUy(aXs;+xkP z3uV_n?hdc#*6o$WZjwR;Ocj|GeV;1$!-rJsGdH+mVc$?zhF$emD0xDA1Dcz-;F^eZ z2J@ueB6>@Q3h#DtS=|%v0$+%%I z7)fhx30n+*0S`VTH6AQZy4mDkqrYQ#0ZGtaBT^g zorN&r2m@ACi;~0Oq*$Oc^~oc&f}zG?W>~X5*9j8>`9K3X*)@S;OA`tKbn}VhE@?#C zV&o+m{kR6Z5vtSC*Ek?UPezI`_z-{tPx}{6!#PANFv#+6-ANXMH5xvI6d1nk#%FI9 z52%(=i*SKYZ8WohbE+ZDm=QZ(&|lSJ6Y|L}(9*OKB{|Zz)6rc7ZSz?@!WaRE6!V;& zqJ(?XW(-lJlbVeTgCyVtnwXff_o$j}i;-UzV$~gH5Sy zIG&lr>|Y`=TDV{M8?y_4iH^bR4~H*~pI2A**5IfjCXIv}gqK`d%v;T>z1NbaB`hG| z4|X|@W;8|j<1ZS^g9^A~vt#XEttNVH*>+5rQwrb$r_`e;y{U)sNNJp4S42_@ymx{S zAU>wii-ht=g291OVJqJEQMFHZf02o2$R9XNPGNBN8~6aC;-&7xx+!uq?zx}!}7L#9pMY*>A7yn zuAw0i0VS}2%GFKp+@T;-F%}l=Aa?X(1*CVLd+l#O0LpPwu;sk zWJFnZkemC5P(jK;9yJApKGE5|nkR!Ze^*Nl0BDHv)Ze<*YwGC$1XoW%f?D$<&&36k zC4|qbrtGdEIa}UbA=mi$_$%ZI1OtLHcn^;gFe8)9o;?)Ap_rZc5XO}^48-y*qf9l& zd{6*S9ymZDvk=2_GuU2(TaSKr*T@Lbmu1d086IO}qx@W4Tui^y%E~Ge5t;b+a+ji=D2!+2qZB_h0WD8%2W{UHxQ( z+T*#Hp%vbfX+ujc7MXiwL9yJ;n=quk809s9oM;M2VB(#s17w&Uh>w-WBS8ZTp>)Fy zdIN*zprD{D4%raX5>Wyi&xoNW5*R7H>`z6%p_>hLYr?t#Ug*|U?6o@F#O~ta0%j#S zeqjsDBxLc`E<2uQ#6FwCU(H%6xl0YAa-4(g&;?+s>?c_kOBJ30h8h{l2AQ%Wv&fMM z9M(D`jfIJ&sd`6WhurGSemD;!K8vDEK)FfOnaHZ>kc8nVx2d3-LP887GB*56WSP*y zmJ@r4{9AL4d#6YmMr1}L1;@5B&6(bVQl16tuS+0r-eYRkc{Z!ve7?tDR!!}X^qrXU z-MY1p0s&MTcCU^okb$Itxl^z2HH)N^sH})72CVxDssKr*7j_T9oQba<1sR)7{3Vfw zA&W_dX)b(>U99`s)TA}QWUuHl9?QUnIL67T3n5XccqCkU2HNu^uztGn+;72Knz;Xt znMq5YJ2zgZVmhI*I;}y%4xLBQp0Zswta$Zb(CBLcTUNDh)PbhFJ~J<#r}czLR!QLM zN@m7nDH|r}h}dEi!n)x1XlpZh2u_iFUbCZFW5jnGxz1Fj%ZktH?COd}lvrrb2Pw`buH$2Vd=MNIgpzLG;!dj zlyBGoPQva_L-7R=c)x-j2hMl$QFEu;na4Onkx(Gs~|$EmQJC}tBBAs zG%$eeMxtdRSubYdZd15%??@a3OeGuMMKE$iAnX|3v*BK|rkFhsg>wif zQd%d28!<AP$4mU_695Oong zLEr^M<%T1$9qGp-tpyTqFpvo&xGf5(1q8zxTa~mIu*mQuF2C?u)v8vGKLoJY;;g*s17R3_e zwS5R&Ur-Gqd|L9$;v;#OYY7I3&`t;&A?g$KmUz!KcE5p5e22rYLB_E?ZNoY?pAqXVz2a`G@}dE9VUdSk(je76*9$qGF*f zE;yzlXk?r#an_xG<@s~Xg`JFo4Rb41!|Pbn8p0VYdflfKbC=m|-aQBzKH$l}GIhsf zhpet?=h15cJIV?gYfo)*`6S>;OVdy}Z)+SO^6h)V-O-`=zmlXi9@QOm#rgMd396;3yKRTFE%;rUFkMzn0!H>d~0%W_W1FZ!=~5HRv7uWR3s)* zWeRu{jF@D+$kE^Q{K@66eevznvUY;UU;H|FFmUqL@n-f>0m~C2-p4*1HqJKe8*e%k z>A6L3Zdk^|Gw(4iYp6L@K@soL6PqNfLweW${_<7xm#FWUg{|D-+Z7)A^41N49J+jX}U2@8q%G9|apXBuBUckKwd zeZk$DJv7b2xm+7+I_Y@Xlk76(M*6NMYt!@bhVbZx1^M@JVl4Nxo;*G`8k%Fv zZMtouBm%x}$<$d2iHUD+_;se%CpkwwEK|bTT5NmU0cLmU%MpnaLC$6)12Y}*6+-@v~(}uokj2pik^f@p;-BhYOQr;%V%A6|^Hjpg) z?f58D7e}bUzVyL&f&LQDwerJ;6chV|)mONmM*H+8H(i*YVcJ~z-Zib0J@|gBsvlm#55dZpJX5Xj0Uo8bI-{g6%6;7;_edFNU5kPzeB*GMivce0u;vq1b@d&U9DXNsIoJ#in?yJ2US@6HR>CJG{oTto)l#-0(lHDX z=$joQ+F%g*5tDI1AHGOlw0Q#)8?VfkLW2TbECak?_JJ-8XDN&Y@3_ded$&0ltOU3w zZFoM=mVp3d?s4e@Ua5zinB@8ZgL*5&D~Z1_JcyavIXL!UuFK}nYzf(4fSzU|i-CVU znhvRLg(=FU$i>bi$uz;@B$j?{t(cXV>!4(Ip3@{7n9F5eO5OI?U%9I*4t+~t^!c|)$3IQ!92vL+XCW~_EUH`)#ston8f)c zckzbp$@GQnnUd_|_XZ-x8l2RoSbbkAEZ={S>X8}hBw}l-wwAKR_}dKU)$@nFHF-Mg zW6jGtl6KchUo5#@JSwfuq>*3!7vq(_zblmKgX`sXq_IB|V~hL|Q{KMiS4q0fxXFrN zQ8+a_gPqXn*URH3V^GJE z%CK_?rkAWsqtq8&S^qUBs30u+M5mKQP)`kwuIU$M-y+Wu)(eZOk9j`{dhUtU{55>e zuh;j-pwnDj_v80X`Cl@Xw)uW_;kdLfR@6gMxqQ1CQ*V&+n>3eltD)SEPgWY+QkMf7DYuaC(Dqoi$6D z%&!5;Wm^linm%cda1pPWxVN!~yWg?$u-WbWOH#RALB(8HYPNCWgOHky@rE0Ax6kvx zeIcD4u*=g)j(5wHOVFCvELVaWS2cIpIm90{t+X0m<$lU?CG2dWA-}cry1hB-X$>rt zZ~cv|o;>2np8o36LA%8A`>)u)K8S`6Nqu4TwBKo1*1?lLU3BHw$3xX|o&l|s7uK$s z_ei3pt8{mYTCK>klX^mv;rHs6#;fN&SKr+bW)GaUQ&9>ReNertWSwp1Ec{}Jx9`{uBmKBhIUk=F_ZpjBTb&nJ z!wU2-v5T7>+{$rDvugRmNeORhzlY(fQS{&9g!Of+BuskU658J(T1ETliq9>`>{;&W z^|a}wuHSLn(LYu<`O3(y_*Sp0tA=U}<3(A1tmk=kRjF!djSR94KLix3)7D1ehm@hRENYvC&D(bV~F!(fs9>^qiiyB;ftIm78Xt zLX0AUZ3kEA+`XRP9^A=zbmV5bc;hiuZ+D>sRT19NuWxlZ-`72|edqAi1lN0C4;|k2 zGW@*rvokTT5;L||@m<(P*HP&T2|Ufwx8sjrtR>k8Z7CpR;`|5Pg-}7VQDajO$dQ<+ z0JHEUh#x7FK`wa_7}z*G1-c5lY)WK)z({I+TEhygem0y!B|6tS=3ES@GXQQ#i?brS zLVJZQU}LnNj8uxx=-f=Po|>V1uG%?cT1b<49RmKLVipaUo3k~^Ted!aoJrueGivhh zLHy4kC;giU--smD*SCkMKef>a(<6gXNx)K10q+|$sb7Fldl5^?4?wsWpV`X*EV+oZ zrho?#T}9AH0SuxxZQe`-AaCCM!Gb7&wkc+q?cek4A&OwsBOOeKOb9oPWLDrsok5!l zO>0M>=$kKiyKL_ZUp;m}q(1!73)UU|lx@!YzbpBjaeSXYpYzE~j#u``Lq0t3tx?$y z!kYRVozq8{_}W<8!oQp>8(6yD@%+Te9L)nK6X!dMs*Y>eFQ(=mk(>&$*y}BA$NkV) z_p`&g%Dm8gwoPZv_G+ihQ)zl0^A6Z|u#JwMTRbG!@9Le|$A*_}olMxZ5$`ARUl!53 z9bOt}JM@tw+*?e*Z$SUBiG`Yn{xMU4R39HcKX~?u*QBX{p1Ik1hQfn8pA3ynTHIO7 zcrtQA`dqlK9dAtgHRj87Ql_TkG<27LUpyEg88m4a*B8_zy(W+?@zDj|{huk?R-St@ zJWa}`+G1@TsAX$EJG(1Ex}&0zk(*L-s)j+2t%%#oMA#wb&fDir;&qeRH;dWh%*{nV zM)!y4+NM|fUw^{dyUyl>Pv8s#I5)b zg{rb;_{wbRf>iN(ODW55X@%S_O{W|w!aF`JnV&!KmT}0xJllGT8FN6N@m83j>k`^ z#@8&JdCWZKm6?%a{pLmX@a8W&Ix`9@Co<U#K$iXFK;uL-0P&B=S_PQJjLl3TDFvUy)RmQ?Cm1G{HE4s&ii+FBAHl=MB2 z=Wq2k&jnGgH}2(`I(>I#?mEbrL|y%+{@ zHo0lreYm}?INO_3AhPkPVzA*MPW|KQ>*jXQ`F&oRsJ*T0KOsAGf--Z}(w6gxL7wr% z!jmS``S1cuk&N9gtdi94Y(vXhCF*QS#D9AAKdw3QUH%hRG#HE?Ox7k>k9bP&F^yg4 z82C5cBTY5otXONBgv)&$-_CWqDa&`>?-ZA2cIh?x=`5Ofz<0xaPObdEq<>Yib#5FL zc_@J$Hs&TW9{71tF{iS}#5-4kXWm)TO}C=#mcIs*OL@6w-=}j+7P2Kr{~Ehq5_^^5 ze*4^Q>)g<;`NxW$OFBd?i?QyZ58t=0$1|igjuXO~U)#)Tz zs%2XS@9i^LtnE%H&EFIH#cxE&=o0;zq+_i-Y|ZjttKUfnco%uL3S~1*(+Atwghf0u zE*xOzpwU~&DewBW9{v^eCpWm|+;`&`UFt99$oDlWvs5*UEfi^x7yCPLsYsM6)F6WRBmD&J$1lnVbtL(9ZXsyDe4MJRiv2^H`~<;A#=0U6#~V}4B_6nMbG=tpqJ(t%m}W_!krI#ZsVN3# zjXFU#GY8?y-&~zaHG4d(K0a^a?A?*JH^ck9NAkMG-oOe6cN;_dM>4nXCQ7)|^gSMa z$^3rboq#f-ar%pjr|377aXGh!s$45ipIO+G;9{7dXL5S6M@Q_2JI9Yx_m1WBT<>Z- z#LK?2Zh<0ghu@J1+1;UEB3o7Fn^iSFzNl$1q`b^$E1deGB1 zaq)|{jw8{FcyLDqeXxUgzG18a9cP>K`hlY)PR7{8c0T=#6+c zf4u83s+@H#R4uRAN#jkB#j{X1wywa2jF82L%FazneQPDR(bsLwtKNoO^-ElySNQ%`StyS`*}nLu*Nw)s7+{V{sbz?v6H9s7 z>k}tlT<7Gk7U>sPSK3p_;cOi%$4}=-rC7>HdHB}msW-Oie`|mfbi;C8MPt@YZ6(g{bk%)f?>{>dj&|J3jXf z;23GSuG?DK>*Qp6XXcu{om+bQwchW;XY-39bxfBwJ!2TW^KIz@_x=n9%XuaCgf8pF zTxnZQkG_Ko9mX+{r6!+?)t_Xp7fkeBa#ig0m@Q`P-@T_Y<;RsB;~qAK4-d=exY|r{ zNoaO$xRK2pnj_~C`dx>9SHnod2uI#gkD$GeW}_d`iSULb@g9*bw9I9o=`9m` z3!8)CZA4hxCK&wb)1_yE zV@p?S{crAV{L*w#TQS9iO+@}{XL6E$Noi4_%99DInKh0J+xaZl)nzX;rH<-N-Mja- z+`9WnHf7Nc+S(22Th1|@c`Wl(uflS`sHCjB@Vf6i{==_x&dx2zuxhz^G{n{_=6KMt zhhM9$7!6h^a=nu@4bc|Yr=Jv?i{=j&JgW<|M?_mSqV1CtA(3c z;pxgTN!>a(xQ}{IH(M%-rEmR<)knLe^sG=fy>=i=)drSV3W^63;-2^IF%=A1EjYq%TvO9hFqzd(;WZ4qI`(-g?Jylqch=4ZJxI5aQ*a8PBcs=MpV z@63*u^zPd!sd`65NMD88nrbeiSH$T#U81bEWqq#Nx?bw+zndS~C7&HPvF7=ZZ@}N7 zZIoMi!631T%Oppvw>QWk`>i(Ts8+E|tCh-CVKZvuY5PVKc7bCDwdMYLtGYo!t@-W! zn_+FVU$W_!TYd)Ld%iV>mCtI+qd03Lzh(BT4zw|?ZAOQGYG(y+rQ3PJy=wT@eA5ok z#$hIrME8hH-xG&tE1j1L%lR9P!{3K~H0o8OQ40tiG1b!CC1Q-BdYrY~VIaQrFIotFGmqLmYc4-)QykO?vQlcI9ES z3gfP+lbzb{Uq^2?69_O|eH?LJTWK>LmH$pbc0XF5N1ZY?GW0XyDXLyQQ6Dqz9(^Y7 zF6dUHoPCe>hUL+Co^9KHY>3uhjei+r5be0Itz+_;_!=kfn{op3x82GLzf-s;i&~^N zr)yWrbUlUqrv`OWDxxdUjLOS^Dvn<-KJeh_A`7Uu#hC zj)2zzRy>F+ZiI+}{&p3ZqT&nvpndLpKW(Q9IwgS9SW;p~!U&&mE->+xl*q6&p#BW| zwG60Jf=6b-RqAkDKTbvko5Pf%Z@3*Tygoe`Sz%0d@qfJc1;u`}z5{O{Zd9da@&{qL zP=JQwh&Fz?vmRRCWS$08N#yshj6agVWXgPEQjJFO?w1EvzX-ov<)P!IJM-8@D^|Os zNRNF=*GT8G$@aACxlFK=nQFP1mg&rTYjYh#;=-Ij8OOSHb8cBm+~Q7jBOf1(chGN= zu8`4f_FlJsgThBPe&64%yBi#rH~o&uH<>k^ZH&0bSKY|>cD<#u@YN%c9qGpdtDJYv zPt82xaISy4CY(aUe~q+@{f3{{nw0BOLRD!S8nbw}ET-)8?<<|zKU2%3RoU*<8WzJ0A63DAt%EcG9D}Cw=FpZ&!59?F6~{+KO-G zG0^BmjnB34ugf)Oxu?gR7Qry}X6efFe~CM5I?GN(oAlYNJKzCG_5rCZZrhf}j$LG^I-q1nDS93nU^fRH*?W z^xpSG=be3bX20yt?CkS_Pdw*2!#Uh@&VB!`>uwb8MtUqRc(AWCth5pmdaBvBJ8G~@ z{+uL2fzQ4B%OErFA8<^!AVy7#ga?;fQGd7(lRuqNYJE;m`fCk`(X$XV)Z?oWTmH#%zQUNLj7v zbJA*W^a*iT2t#9dSp{q+P#d?Fk@Hj_c!cmKz6|Q|4}MqL=V>oNC>=_wl=Mkv`b0_V zY{e6&Gfg9~-v2sd17ld?{8%bRblukb5$zUc=(KBVdST!EqsxWJuO^==Yql0!4K(`W zxDIS`ZniKwbzxhF&0B3|Hws*nxdYH#yZEfJ>KN|NS&P+C!;Y~1fgc9ND8nHaT9%XLomP7>_7VepjH6}^_B z_vfQEJ-8*7?jDq#j2Dw|pMC8RxOd-rEII>*WLx#|)sZQ-*eidJbBVN=Mw4Jt&xL#k ztSf^)GU3Wx3q@SrJ(r%iwvuf7mfe4$B&5s_RH$VRM@#&Oh}ZDldd-Wp8^_@I?Q>56C_bJ(nNjJ|AJQAqi4f-TPD8eMqT zi}hA>x0K~zH@HypVH~WkS@M~`h+L>y)rh3GpA{={{PK;9Ib_!!(S3nufd*CpS@Jto5U*JfENhy; zP+YTUxHw)~u6eaKNkf}L3Do`I5Dp46vs%&jT&K7Mb2yMsZZ-Yv;CC9^VVcp8j2&amR=td5ppum)6I4@m@O)Fl<9iKGTa#dDEqnvPok>Yhhhmkib*5(8k zkgQdwqOwxp2l<)=gC%V4gX4JN5@HUzWC!Z!?EIR~|49-~Pj@)EEGbGNfYI9RnU#UX zcrN6l;rF*8C)Fyeo+gaO9;e&4_i7@aJTbdmRA-E`!aRXa&SGSZ3gZq&m_;HK%}G8e zly8KtqFhQJAao8&16g7U*WpL6cNmCC)NA_)xt$<%p&qD^Mvw37vXf}ct(Cm!EL<~n z&8uP>r9Jq9gX>Rr-J7VeUla%q;(g>NKG|s~>^42+#=tx%^1gS6{_FC`UfS)OA79kh zze5?GK+L#&PA8ClISsZ(!M&7Z$MPZF^8uIZ7jwQG?(J2!vD}!sWkg(Qe4>x|ioXDb znjw>fLt7F(F`7t&L6aq2yM+UNG}c6fU8v+_^V%$86}M=un4mm&s1wHEBNFeB?*1S@ zKkn0x)Yy2v%U-mDC~m|RZ!%ckFUBP*_H|6Qxm2X05?a|AeHmgY@Es$#;o|(}*OO*q zkeP@1b`afTkG+{LrqXl8ZPOY)H;8QeGDNlr<_k0UQGb332RmU-8Rp&r^_Ea6T1R>D ze&#cxN7{44EiS{F1n+dlZqA5XTirE`EK7_6eC~`{JC6u9a@`SMgM=Y&&G)Q(JfSgx z&#IOYIj*ERw|yVV$7B5ajkXC*TXfHWv9i3C=G(zIFTT3ZK9-mXh}yWFJ^R)($wC~dKH*l^&yH<6 zm|CTnf>G^Qq1OE+_7W251}h}CJy;HAHxz2t+sx{_a5EJ;Pitq?7yMJUTE2i#7MaBv zlxQU-8Df1}%P_v&!!R@!)Pl_6QupB(EQ<0c5~^MmoVwaC72eJ5r&fe7QUBJ-E??&W zB?`&)=SyL-GT(fMeWa;aQ^;z75=XeXFri&#VbP=Kb3SLrFe&S+?rUAD@p>e!^Bb1K z&oq3&36qV#xy0)5)<=6$+vo3J7?~LsvgqzP*+}-u?aOwP8Z)g0Go3kNC6v1TDj$#F5?8xmv9s&jxT%>{M>awV4*X~hbQNz(wGH*-n7~@!6 zrv^A>4NXnnYu8=@DwtdDO4F=lhz1_QBY4>gRBT0~%3i30Q?DCDE~P8l{7y)tdE@X= z9Ur&FXY1j7?k`$c0t0-djpa9~0fwzbX-FFZfuBuDlU>kr8hnA zE_v#R?lKd8wS^**x$xbY)SfO3r!b1;@k?xHnUFzN95=JBKTEON&6Ah+?P15`oFeMt zoIhhAYbN@tB4&?Oe)!$Jhka5TIWx$Qj8#Y=&r!}>)(Qqc1q2( zPMp#N{TWCM5y5`$WH`$f3*EHXKkHex1MvfssU`|A*8X6z4mps6ir0=O8km2_bsxz5 zWTdn9NN^RtS*sTu6msk34YsqACp>!ErG`1ztskEw$ax$MMP}s}iljR8qRU%KM=SEI z_f(`VuWV#%4ZusVKX>NP=M!PyzNN?tdX>9WJ2(coV6)+kkE;8dt*}1km|H_>-@I?0 zqZv_uU=;R3(Q0>niCb**so>k7h?R(umeAs7oTtm3_|c6Ik1+YX{X~PaY$HA?JZH}% zeO;119dPi_8**_BZt?x9-9LNoK?@PV&xO9Z6);epqPJNWOHsM_0{V&fKu{f7Os|$HkJf)MW4>9bOhwW!B`{2FHbxIq)Ss7er2S?uehOcn#%&sV^EaA6)nWYUD=vwU0^ZX;s3gxTBA}J|@ z_mU1om06`+bOQ=6`rrZ|=jD?XHi58|pEvp%{1jl$Q@ z6-cd;hNKDzHw|jT8>aWA91@OWOnqHL#9C*PYTh@Dg^1pk?it)2p{)%HmjeGR(cW;R zvx~3 zUXid(i+nsKy?Q!TeWWCq%Zqgk92_xgq`Fcr_4et+t)s0_5h;d1<-X7ew$hKQ74@YD z&L;A2S*!#lzDtgrq-?Te=XP@Q39h@_!i;j99AM&EnO1v?O^H-f6G+U})R-`2YA4VI z(I(qZCO%Y4-z&fw>o3WNPgj>SBD84B>kgSZwFpf;(tM9!i+_D+b$V0Seq`b-F{`=k z$Gb+@+mvS(tIfzY{)V0)#P#tD1ib%%#(3wI$+);gML{Ya(%Ey^C_!WkO8K#T@}t{# z>}X>tb^WfcvZSVRYlX)!69v0;4JP5lLdt)iSV}nlqmWIHPfZU{k zMDV=~g#sw)<&9qrK$Jr6j0Fldb3e9#Aq@FmKNLvT`~vW`s%sm_6E%UC4q-k3u&Xuz z(RB{q0+H5XYZ)lwD^zcecn_F3#|uKJ@t{5Axj^3Ik2vVDmGzynNFiOJhDZsE>l+rm zo##@WjE~U1UQ+np%(9&$uTCF6%C9VmD3W@kj`}^KorjQbjCM=SGK{E7pOsGNN;{MA zOYNPabMUwRJW~oUeGI| zDO%z;q>@y`9PW-Uo2_DU@zg0~mzR6#kA37XFGL?Ts-$$x)GVqsz12^h_k3yU`=GtZ zJtVyJRNx*1znHyKtA{7flHu|#5??A(^SjgbOnmN@qqES3tWZY*P@Z$7=G7{A@t zA=(6S=B3KL1ofrquP@c6t$h=->X6FEdkv|&o$Plo#umT#Y*gZ%KQ{Y=q@A1lNshW} zua~+;o;$qG=N{ZYYet3r7I<35=hF9)gdC#}an0}EIkXnwXX9ScQP5hLI&eklL~6_E zD=X2u&}=HFr>j$V!K>@@JR2xzK4j(rwVEe3Nc3 zf;(F4^@Lo|O?#O1uTgqgxGnZvlmug17Z=jAXm zifDLE`zCu#fHbwWhls{PQOX>5N+*wqph&Ik2O+LmzlSeEb7`c<0v#(-ljh@`VVbzW5$3x)Wcd_1Cj%E%XH zY(r?~ew*XdZrQko`jocu8@S(d)7G8Ydf73@R6bJ(ZFLFB2KQ%#q_lP$W$pFBFJhbi z8G^B;*&Km;F_&=f2!5YJj~|<{;B)Rz*Ncpn*A%AAqepcKbc&crwGR3=z7v`6e3htCArURiIwx5B0s^Aei*NAnCQJi4sed(TM{pw+dn2 zwPN+f)V7A04CRPNW@h(YT*M4byx*TuQRy{ficLcnQhy%(F+W96$@Cl;wenG>S*zjw znU`Nw!BLap8C?m|gy|7;Kwd%(z$l7-I}RN!n+bRU(|*# zp5NQ~nV4VnFX$Xs0`i3CpOe#+;5o>Y*FQ;)NdNhyME&bm{{rFvZ+!Z{rj!!>znBo} zB~2~`1y!_$%56QS{{wjbe>S<)9~3emvzzhrY%H2+CwH%s&-TbjMP-pp%D&qB%k_Ks z9QxUPh#jW*@gtp?ITk(eL&>o)V(2{6!x{nbwU0-CB?2D;pkqBvO+bLYveGMr<@MN- zmsj9+euXs|bpUdJ|2iZvn8H(2Ft(Z`0-xgE{=UzdDw!q~-kZP{cycIQMn>i+*My0w zB0xw2?45@pWKE%p3a*NWaa@DSZ#*=I#%tMTe0U0)+YH|8`*qluHA?6A6f*Rt<$5(2 z^zZl1kR@|q-;$r$^|{utoCq2}nfmT2W~$cu-Bj_<1=Z5JDo?!gF{vF^t$9aF0nsQn zj+|Y&q1dZ`M;KE0_phUQT%q~{010l)8@hEbB|i&;VO?O%fmq0?1_gy_K2%BiJ^A~# ztSglw>ghz^_oyP1y1Dtjtihy3ivMo7I-X@9n^sa*rZSONuv?kG6BML?@>zKP^`H6q z1$(=|H?OT&U9DQjlwa;I6FbF2)?CxS`mb?&|7v2Q0dM@CpNY(g5HK}0;c~ufHT>h8 z0Qkt_yWCM-uqxHrk$+b2WBn(P^f!anyQ>vh34`QSZ{PI?hGzGjO}Obd=@C436fr$K ztg#_zoVha9IFRnsTui;_=l%N*C^1%ht)_#_J7PJdTP*L-VmNG*SK*K>Xa>^e+2GoU zLp_r)N89?0jL_;m>bnA|)UykSsd^!JY=|5^LN>||l9n?)@%#3L`!OwYcb;6O!D%!9 zUDy9I)aDev2>dZNpgLiVz|+9bPv*h$M8c33m6)$(KA-s7GNA-AM9XNKJU&Rs1$$%M zWs?=es*gVR|7@y%lePHb+MF@$C}hn-M0q)~t$}A?)=6eGBZ#=b?U33FBq&1)6#@UY gXZKdQms*cQqCI5SItSAc6yVWNy{A%i$Nc$!0Nt7{rvLx| literal 0 HcmV?d00001 diff --git a/metricbeat/docs/images/metricbeat-cloudfoundry-platform-health.png b/metricbeat/docs/images/metricbeat-cloudfoundry-platform-health.png new file mode 100644 index 0000000000000000000000000000000000000000..64d3e438e84735444484236a642b047356dfd24c GIT binary patch literal 170697 zcmZsC1z42b);5ZOlA?49NOw1=bW3+PLw66L(jlO9Hw@j~DJ9a~4BcJxKX}gjo$vhD zH`m25JnY%??6uck>%Q-`Cgiic1R62{G8`Nnnv|rd5*!?oI~*Lm#Y;rs3b`S_I`Hd- z(r&hO@GrnX{XrqbZ!Zt(}c2qm!|tsj01#g`M*ee47v)+&efa z(T^(bDf^3F-s2Z7*C*<8fAVnW>}kKskX0kV7rYQfMdh@8DH!@08;{N^^-wm*)?Fe` z!u8y3W60@8L!ou-fDiU(lx@_;;gtv;OmZaY7s!T;uL-nTTc}&!w+a9Gv1Fm_Ddl%{ z=HQw$K)rm#f8=W^yz$@z7Ao3J;v@a^lI-j2|9a}w6D@%M?@Lc3Fo|f7k^ld(-3a7# z2_J>@4Y19z=~O{cC{F`)QdA`x>NW(Y^_DhHw)*Lw9V*UN;Z+KbVfqgY z1%?C@)#Dih^rk|Te4F>Bf(?gHL&n%m(ir}};DrjOTh)BwW*IoW@t*K#!NU2exLKMx zLNAm3WTUk|IQW_5YKvk151wx^G5w_xg!Bgo;)e1?)ls(QV)x{q24#}}b7!wyg%C=d zj}hZOzLKqcbXi07iCNpu522=G%aT~~`)h*wqLMSE9F@;GDlA5l!sO&CXoI;ax<>L_ z%2|6gZvQOybId;$d$FY~ZAsaMcwyrrg#CN>&9G29M%i=_q&|FR#^M&V=0)ZB*D5Gq zA@xKGE{qR%?>Q2!5&FHQo#Si&Suds)n*z?$es8B-ZYjgb*+!h*c%#KKq>oC7sdD;w z_FZbU|8)o4P$4M?6%~)9p;Q8x0&q`F)vgB~Eqebl8z#(1W?lJ zpaD;A_O<>u;5~Fdhw?>7k#)QYUM9sI6S6`#pFWRjZ->wft*2&UE1cZ|Upt1&>B&MQ^aN+iQ~DWhQ=P9kNnwIn z1U0@S8+i<=^U0rRO)s4oz?-IV zZKpDM@1KW=W|82o4`DAh8yF?c09!uS|fs%=0slkc@eth=Chehq1^9O zB(vu1;oIEegXeVT)`;$w-Th0LB(;yZrc#e8Z1$GRZJVPwBCB?O4oC0_1+jrn27yn) zu-3kNXQ@)#;!j7f@><=;CpT3h=M!DtuyJIt);RI2uTOM0)Yr?xi+f(m>#|r_h z{_Gv}v}HX%!uHem*~&@{hZVwS_d2k>GRmZk>^j5c3(5vB7X%{?QS%rx8kO)Z?33&JhgsaQT&0t}m>&H1|B<-M=- z?n`S{)JQ3UBXishgB+1hw|Y9%x1s#2w}IV55aZapJ>Un(!xtRXY6)0fR3qkj*?%_v z^;)M=eS`#5urIG!RQ3w?LfME!8=TrR%8ipkTxBi@k_jJ5=1)s#R?xU@NAcdY_5S`` zXwid+<+we2I#vZ{@n<7n!|u^9N+_u>_jDU7gfC9$O8{fK*!|43|eZ?@= znjuU^a{(5J9qx8A6L9jw795R$!ae>Obm84QS3*KH>iNA%E+ir{X^-mPhNO;~fd1tOVmn>J{Fu zUvwN=Q>8NqZ=gw&rfH+Y^Lxgbg5qSB{sWb+l|QQbZ;BoccoW=>%z{>ZOuDn?5e6b zB4#mO^giJdT(1AdCrmV@&ClN@{W#}t<@bbN;XP$1y$rZFxqcvoab-0QPcc*v1eWT@7F3H8_L}M+O7B<& zOCArn6FAAH~+UII?jDw;kgMqGY}`(fJUn$=b-Uw=QHxO z8*-z5j(5B+N0EH*@If{^8+9{qK*XK)3bf=o`D;Hu{Qa}T#kSSBS-V*7EzRP2=tLA} z`8nk3+7elg5}gdQe;&qpw>ZtNhPH8J==SV;f}~Mw2kS-drV`knV_-aIMduR%M)N62 z6y+DtC|8>PHQPM+LA!ReWmJD#wmJ4^*|Mg7_2tTCH;Vyk!o2Jc;lO|{4=f`SI0Pal zo+czaM=iFM&hvYH4Ypa*p!s$GZjKmaA^3I|o~Spy-#11m>fnNEO6@RD_YJqk+Dn7(vMPZU8euPXWQC*SGndb!eh6gf}-g7xj6 zcfwaMnJ{vO8)IL|AyUT*)e7%docw}sd&k`3r{MMixtZj$%>l`2+9RQSC4NYb|5FH( zq`X;yr-0k2wCVUSoBJcekRcM~P}5CBSGHIeeZfiBtUu;4(X|27CCn_)M|jy2joFxK zo~SEBtxFjOday_+l<$p`u))EUK%fweEPaCcN~duhVT<8Dsp5vTY5*Z*+?-7lO`9O{ zP1i<~o#A%hQKf?+&XA-TEN}Fc+a7CeFtt`U+w3ebtiZiF7Vlx;4Hod=zpma8#~DHE zChYpr197)hBe+S{+ekDeRpxti)ziHrQpfC4l~J!aeLQhz0B_}*Ci4n7Q!%$(kaKeg ze?&2M-!EBa0m+gh@YkNG{_$bp5a%9PCj{vms5w5<*7HfMV<4egfDwRw-<25l|JJ;6 z5LxZB9=>3ixPE8X>?{)&U=_0?HU)c>rz#JM*sF~eJ_nFZO_8C3L5%}dUbmG1i6pyR ze%HmK{H6iTS(?Z90TG$mmJ6F&Xbra>aFSnwpIDpz3QGED&?u6Ni(V1PiiStEbCUw; z8=KG*Yzr>0Ir=RXh%QUssLo7ILGiipK57u40Cii_B-e01b=;md;3W!KI(1W>!}Mlb zcg!Wj)PZp3P0=rM$vA3!pR1<#OE4yVX5!_?YcA~Le9h?!X9YTxVX*PQ3{%Kw;NA5W zHC*XR2vn;7o!(xOH4Xw0r~2H6!OM@ej$I+N>1o&V2mUJw0;9wp4>4wJ8U0w#l^T_EEe{bDafurPSo4_@Hm(%B>QU-yxPC0`#S0gs}M*c z{cp_jGzq{y-{rK^|9gsmU3t2U`|`iD!`}hj2%r8dEdG7}O9%h&{{@BqnKtVavER0) zsi~>;Ou2tRz;i13l>YtMDiPwC|Am|W4knjWT50J%-<=G@XE(E7>wcxfq+ZbVml3_j z%`~v1JHPS1zbFHnj;0BUii)z>%yCf3C3UZM1>GEXVH6e=yklaD)T}a#PD+~VI{MEd z$OWYQuij*^O4YnbvnYn_Wk=j+9W zmG}iKtJ?(RTzT))|5!8l?0x$8VD!S`VpJ;~6B83|i8m>BLPGuO^ZRf!3=%h6v0rpN z7LUL8{&+Zrrtqqwx7P~a$FeF1e&rw;P`q1ON|5R1mIy)Y7wp&r&-TIBMW9;BuEtR` zM9xw3TIrt=9o(Et_J@rCa>DxA4Uf|n>fPl51wVgscef}TJNwRbnSQJTS29|vJavyQ z8DD1q!OHmk^7G?V`k>a`)gi(ffo{dWdIjJ$Jo=}!QZH52)Yi^!f}^4^TxdQ5tok4l z*vfY3S>~99=ew+0RaF)4o7*S_aJY0XvLXlLCaJ(Mh4K=zC8|({gZO(1##Fq8_>PFy zNB4+`qepXz{xwS`BFFdBig)iN4nS!XWZgZ(&@)AKbqN&}tSF&dnkLr+qqD8y`+aj^ z5S|m@W{;0oZD-@@kJTc5r4R_nO;%NP(qpt|aBwgLxT)my^~uS}Yi}VVBco5m((r(h ze*OBjz1ZXyl>%8%Uf9?JZ@_T&1}5=pu8fGBnML0AuAaEVG0hSobgiFcC=~`rMxwjW z_`#qSVqyrdUcJgh&-Dj9!nQ8CzhBbxVs~#s zEhI2d52ZV`&cC+pQ|#3h4)|8~)wf~v$c-2p(FY6V6H2;K&?CfIv@8?8R3A_z#L)~J z@VQZTMyEzkjZ?5qn%TJdN`qY$*vBf&nWi1sb1C_>ncw$l@M5wrIY$(Ex+%VH3jwZw zez=%SUt0g%4|oc&nXly(&{t9E2K=smue6EJd)+`vN~+1&TZmMzEIv3mI1(We)^!8C zD8KpMl9z{AHXSy-hvq_q*2yU0|J<&Avml>u{7ynwT)J~|BOWZGqoV)DlTumZLNFcY zK28C}SH`HULuE3REP%!=M_|z93(lpa&cV(A5dy{MX4EaJn6#C%8-mbptDWm7uQ4&n zc&$WM8cRz`4vs-y7rWS8Jx+hmFs2p|*Bb-lWdEZW)gXZYwt=&l};S~nLyLx;D=W6=iVe&N$ zX$VGFW_+;fxWuc}0ZT2k#9OB33z&Cy7*Yr`pEGc&>&0Q>wURB(zWk;g`RMVdP4q11 zH8}4QCoKg zZti%+Y;jC%?4CGAZ9EnOxL9fhv*lJF@5dXc!1-?xAUvJ)2|q?_+qL|hm^f^h&1QFU z*patM2i!^U;m+2@7H29J(qKL`FH7=6%r`LtyusY3mhh$Na9oRAo?jd zOzbQf`RZtS*``}38rNgR*Q$au(vLLF8#BsX1WxMXuZhdr!;yqNA;PH$O zttqT%);%Y{C5WC!PqXjHY4F;|7GGqYyn$UX&4XgCp$OIkW)FF3M>#1pMZ#pR>*Ij? z4yvL0lH$!L9qYNqLi?RRxoF_Xs3<#^QX!vP=RAe0brzk=?wi_gRck0^|18Z?oct@l1K}EMsJk+0!GU&XL;3#w_mmV_ zO-+1Y*(MA14ruE@sKA*J(vBeJvG*Gql7)N9^LcW~T3GH;q{1U!M=eO#O|K6dplRh= zt{N}Le12JZ3tWsE!97mT#4oj|{Aid5FMjnMlikK0u7unjPtsx}6aQ>>$_WVg#phd9 z_hWgV(bU8U>r8pQft``0Wou0@PUdTT6mpUKodIuhq*|>zQ|-F;=O<3PCV{Fo6`O9F#bPl4HS(2tFNLDNL7N-`7$QTPwyP3h?$^2=21ShCA>V8 z3^TX25;%hXtXR84PO)VMmd@rTsuN7{B$6`O5~2%CY=E>4(S-?W3$#Z)j>8fB$X>0F z@S54*|AgC!pKavC`5QWcr&PC(SniObB8@s*;<{yDFA+r?An#UqoSF58<98jec4;@4 z+AX&VJe-er_w_kl9~(}U>5nQa2u@~w_A2cxkl=I~`D+ifCrwbCKJ^-Zb=DmW3Mn+Qc&9zONdV2B!IWI-XC#mBL68y@EdvHid zW=_u6oSYn-vbNh@2tKRPi)AoOkY2siWU1L>+qp4gO${q|k=4b;rC@S5BhoFiu&BsN zDIBAwsECf7qATA3XPdkX0zq+jZ!Q%%ayt;o4kzHPNz|1EDkv^~*2pBGeAhk^QgQEV z!~ho58_qMf6=FC(u7M<#>Gm*G;y4}n=?xK`+icrf z9CreeacXf#H!B9W+#;#S6I@$*`cbAa9bMhwg^qGQ-cV-U8i9K;GBC^KVcd0qsy4lh z2ykBN%T=f7_FZf;E7dyoAU!d#yTHyv$>9r~DK`RAA`f)ZlB1CM$>+q)HrTO2Q*Ku{ z4a6!_bb__q<^LR?NR++jWz&1654RWL1e~EEZ>hOFZ2KaKQ}|p$fs>E>bJsdQdj5b) zSU5eJLc(!t2;cMSP!7Oj2nYx%yiS3wK6lSqJkKp!A1<}?WD`3}b(`?`U9H2;aIvw+ z+Q8u3t0M&JlS<@ds!_HD75)hTqka zS5##s+uGWiMzw`vERpNC?d|Pyy5p&diLa^x&sMQwH~Q^{SEXASOLM`pFPLTbMP$pW zz}$@#5_NgK_MoD+gv-+GP`606)9L5j>9|wJ9)@U9-thP$6Zh_-M2TI-JByIb&asHM{tyXdKI~(pA4*R#dU`k@4Orih{il5H3Yvd1~4!6>jz`jNq zQ=2>PcknrsdNO)DP^=%bp4C+vIvSx1ktDO+TK{HXwm^Iq^gO3QLMK|eK3U&iXn5;4 zTV>7;SXStEn__K!U9;929}ciovTb9?+L}?V^=#)`1p)uARRiE415gRTM~U2adLn)M z;rQ$tZN7pyVc!7nuhT+(xSY3}t+OMIj*fm$N$Id2!Hr1lRi@W6N35)@JZ^e-d+RN< zz{U{QmR2nGEp&do6M9DloQg(ri5?PW2*%H<+t0kq*y)UcW~dRA zpd4`GkpY5{R7BVoOm5%$(7!Z&)3rTiL>F zGc(%-bKtYrj>+{wYT&w$|M^3JTtA$;cLG@RtoyA39E06hGH?6_H;ugROB4|^ z+;P0dtll15l{d*-_j4;ZhyTCvQ%<{A1>f|aQ6M`I33~pJAo2KG zP(Y(rtnpD=8rjm)QjjR~_3CB^a~Rz9=FF1LSpEa$lt`wX>bFCx+wEc!;p%=y82q(M!mf)t(2{Wn9x1jSp_K$=v=owgaI)?doUg|P~Sz!sE0O+}9H zH~HAtr2uHtfu5fJ2@YdnVX-)@iJFb3E$-F>8i&LA_E_NN+ELSy5F#4E*HP&D!__jh zKbivIy`{~kztrkfFv*D?*7XMqi&XI@p|?&rZt#HoU?|v-^u?TEQEdec%k8cxs7~;; zq{8VkCk=6P7H9Ttf@CPkC#eeuIQbti{a^r-zH|_xGgClwc?nc6Ki$VMe*;Kxtw90vK$0Phl-{a#YL`7c!#A3m7ucYMA^7;mvem1GDpQ%(> zzmu0-e}6jo4BWQ|fKM7mMlr~wV;`~GYhs^OS6WI+N<}55KgTXoQm;ZnLP{bDfpiVf zZ@6$G-k7)4@-K8(80qM&+`{|TJN7ORYcL!X0Nvq3E^<0uLf<;`(B#BKHG3sg=NGTm z(Q$dzZ;>_&Yz6(Pu+!61wZ3o4kz8^S<`-ldzQ4Z=u5WTTDV&`t?tTu!R^tsoIXas2 zx|u8%UfVK;&bp6#N;u{-1vZHn;J<-9_nuHy{e7!C=TNe_J)o#)%|kTcn;Qsibv-$s znPKA7wl9J}yw1Hp1(!}k)S1nO5;}lvYTuw^6WMZi*aRq8awPorD{x|BVgirX>l2fc zC%cd`#~y5T7WeW6XYx*Mz+Ht;!6@xR6S)VGb~-BurMb57y73PajTyZdQh0qQr$>z~ z5DlFK#O~Z|6;cU=dx$kI7&h&wnfI?+a`5Yyd(WBMt1ZXz0E=yIZZ==efpT(lS?yOo zoO=p7Z4Es$7*68!J{#u7i|C~)1FUES9Z6--s(x8FKfG7gHewpDD-NUvmj8?Oybi6K zp#*$P)YO!cS|QD(-R~Ko1_mXvn?HXPa2Fs!#2^{k9?QM~L^u1UMNu)aC)Y%G5qVK% zZU^k7PG zyna{cLc|P<3^e?(V}7MSn|T;#6R-sn6A}3ciiCsEQ$h(R2&(zu z#j{Hv)_E9<*|Th3fX+TJKst8~Kquyl zjV==t6F_3U4wMfDcQ_-)hv&7zJm`Hyy0JvVSrs7+%lgt&=3@KxnuMnb zfX)>GBea5`|2(S$tFlQ!vMQ$rcSW#gWJX*^mRKa^rutuOg$GkG6`30esYiyx8(sG# zEH%ez_X_gM8>ey>NUT{h;sD|#BcPoI2fqYP7Wbm_TOj^zUwB>~%=d*cw@L!AmV3#a z0-zz8=&He7*bT(q?&s5RL&P-#1=HPPmIQoe7-&&wgi2aslmyGuFu4vL9XExG{30 zC&Sl`bbH5^KC&`uF>aV>SMYy;z}p*Wns#JPWsDa&R4?Jok9eeH48H5a>yL{=t@%_t z8>u@s9t{vvv}AZ^{KOaN`IAICdnbb~);+hG&S7`C0-q z&T^)vppX-7Hv{z#pndngs;7=d#eFk1Q>Z}=|1(BDV=6$G+Md7m-|yG!&ay^oEXHOS zwO;3LHljA4q#II0lK%i{&dA@x>_Sw z+t*LNPLd3+*0*isCS-%lm}?oE86pSQS`PH8R+F+V40VY};6&xu_N`mdOJKGq_rAA%^kP*2>khS9Qb>gy zJ%VK7EO6HTU}}_5Q&9y1K;aZ{6u5G?BR%nOypI6C2Es`=9%}&b$UtcZFvCIQ$&EME z=dC&5TSDo~)@norg@pk830zD&Tm6v@I3XZj)opIeUbK~`>7cb^)F>$G=`9_C=;-J^ z7pmyQv3yauVO+-bA(+_XD_U5G-DMPoSe{+`H`o_j!NDPHF1yGG5M%Z$DijpauL`?H zz!}_C#7l+}^-d0;B!!>23lspQj>Mx|@74?OenmX4PWTW}Z>w zAkvB1@IV-lCaS%4I&3QpP#EHi+5hlxKA!V@p5Oy>yTGG)e!+qC_`~b&$&l6c*90t< zRx5c=8YQJq^89{xHW6b~wWhMyZ&9$+of9Wm&B;U^fUfzwdQ`h(5q!15Z0fZIv&0jwONx#f+cK!0j*+<2Cw-+c5tlF{a zJ;GsDco~r^)9Y_Vh~@JaS!e>i#*H*n)q9v9HG6yaHc7_pl{As&73v8aUEgM_Sl72= zba`cH%xMY}U=8b1OcV?6Zgr$mdh?Xn6^H<0^@<}va5=4>JQfJ%F|o0QB_*3pN39^5 z6)O$`bRwSinrS^5KuZ9MvajA!z3_=Ns8t2zwNB_+>hw~p|MWNQ6SkDg6pT6|pri)T zcB;Oa0mIuzT#^J{;uBARn)R4ZPEK_2)1M)&h;HhsuyS^bxf}=_O3vcK>G0BI4?Fl9 zDK96C6;Q+$6sg)vG=6GSad;;oxO$yvm*jm=R8hy{rlO)UgYE85G8nx#@eIy62|_U9 zA$K1&t9y?7SY|Z#_HvUX$S$ z{BbQw`F%Bd`ICC*PCDhN^-(3&#D{ zx~(d{)Q++B`;#|o2X&ZO2hSQgiLCczr6OBs(++{EE$lOBsw=~tK@F~1^_&)y5n;bF z#t2xFP%Y*gc}Al1^Nfi!4s1EZjYZDoLFi^p1gT@eQjm_4nF_6;gvqmk{Tm!xKy;L( z)u=3?2}IJYn3y=G@38n&wbqea%wk^2kiB_ie->)J(0h|WG&?iT*UX4iCDM1V8upS% z-0t@m_Apg5LX6!n`aOk^uP*-6dl!|y51!%?1U=m$Z<7V;jQh~#Q~7#Yu9oIEMBwY@ z<$QgGC?q0Hh7wqdbsAzU$MY0bRmFgdXV6h30{~@u-yPHe<*jeJO|Go2`!hIDW;(ho zFzoUCXgM7a$$-hQo&C8Jzyd02YI@aTOHW$jtzRLa^cSzadYPZVluJZAsTa4;^kQXG z%4Y|cbb+^1P@*k0Cj7?znfBSDHNRqC3Z{b~iA+6|M#aq6IrKrAxG+SKfe?3aVX(7I za!xH$FP#tWEads)VX>LAFC)s_Y*}MfXYRVlONU3mbN^GoygXVS1*rLGyFdJFy#qy* z@FP!)*VR_4+Y%s6zW}mwBWhy?eg4~$7f}RL%$a+WyuHL=w62SJgQur52LEE!L*gwEXA7J&E zawCZ@H&(tE-y&P`>yE(#^LW$XOUmSIgRko@&W6h6n#39G(X$r#i>MIc%o2FXa)#ewPwxowH2 zh!(8idr=v!>fSaD2lDpG_1>#F{`ME3b=9sq)P)JPP_-OdbJz9;E1LK1+pkQyc{3XU z(6+?Ez^#7FoU;vIGHM{htZ*_kCVFgxx2HKkRh}XYhtQs3*cOJxX!}Mv+qUhZZXP%Y zR{(8(B24RjQB^<}2^=8q3_mgH?d&L^xx#$5($o(olK$Vy@5eUZ2Nr?|K;fZ(>Zk#@ zeIWmPb3k;sz1XYJU_d1iNO%&}d0;?!Xb=!0fg1J`SOvu03g}XEy~S*3k;es0y6~h^ zc|C^Z93_fBnVGU}F4ul;-SpHC?+_nf$j#ABO{qFmSZ_XkHXZBqcf8oWMR}4C>jAi( zv2nT$tk}IQU%x~8wqyCx=G{Xf&_hEUhgGr`L3+O42eUs3OYJd1jmT}&DrF?=ZV(d{ zEjJm6QA^iubhhkDC-uEvRqF#p0?vg5TG4t?^VQ*vYg6Q|u@S&>0J5|5=ega-hsP!g z&S^KEG?8EE=xG(sgRSkWG)&SWN<;5L7h%uqO_tmwR3?{Me&6#&h5cbUs@#0yN2-@i z3E#c>$6XZMESPu01|%f(*Y=b_c=Oy}l9khsPD{PV!skOo6tg*ZlY~mgjIEqj1A1k+ zkqVxe_V%(b_JXZ5{u$xHRgs7c7cUTlebxotYqpaZH;bos#xzQJQZhhFubhqRZuq5> zUB`>YrZAl8kwdjR4xCq*#cp|1<$n_-G4|=e_>$jJ^Sv~ZjkT{vWMjLi$3_TR4DGS* zO&Gfr`gYN=BI;IKudR^H&bec)YR#K)@W`a^*JwIJQ%> zVoe>%1yqe5iyJ4!x6EIJLbR&2(6+2m)S5C))op%zI2u&ZS|lBe6;Hj0i*n7TLADj^ zDCGc`JR$6{j4{9A)tsFebY%1(*p*dm4+$2^p!zH;gOScz@DHvKmW`+j(ET>6;stTH(2>WG z!1DxjV(qAFJ9|D=LvxEG2VKwcK#OnlXa$xf6;(C_=Xpaoi#5CLQ8JtvW7&37d4*$p zpXXC~uzz#Sjn~%rm~p}lH%X^*S&x_z=fctOFkCE_`DtZ;9N(9_X$mbdDXXkK^__TB zMqtmIH71B4-~hB6wA~bMg~eCVfW#h*2~aVZC}gHDj;QdSDgkRo)ot|z$6%}Dve2a8h)%C= zubAcGkNXprbY`#C7S6UWXdkXO>XU)Kk9u}S{~eKybhONJva$fmru*10ZoUaaU&AuA zVG7fi#uIt#_nVRkZn=F)^5HeS6p6C20bGe17IofKoMW^6RDkXkLINd#F&Of`~9 ze;(N>r+t2L;t}``jBZ+8OMGpGPF1hI9O|j$;fK_QF%esE{P)Hko}l4KZIE>ZZmCg~ zfkOeS*^tEY=R#)#J(t>Vs%ROk99p4`15GDxU5KoR_qv_c?y$!-dU*tH8{Bu37dMvd zBB5^)&;qx9s@LF@AQsCboL@i{@B6HhI`g6|stL;Z6@PQ;dMZ0)Wr&Rz%UtO+pf?{G zv^EhBj?W(I>c*a+7n>2zNOhmb6+War}q%U$(bV?z*mk?xH0y%m+|XS@2LxnD~8wrURk-V-bLV28V?i1B?bJ zA_l&jlTq-9h|(6K&6&zao^Ydey_<2%3mm-DN%_`me+K=s2_SYeKfVCm(%rYa_Kk92 zmltJnhl7j!@@MVPd|npwmnVvqZORI_=Q+tu43EjLmQw!2YX|BQefw-<{T{|%$SizU z8I06Mv(}zM_WnEuBm=Y<SfF9f}O0`x9nG@N8obwoae#okyC3*-C;)Yw~@ud zO5sd7-{dyC)?q^t4YGw?L}=582c;N)5epZ-avB;dx!9`>H6oge>;Qat`C>D6d0ncr zWN*BZ73W6nqdXgVh*%hQQ`e%2hgFYZ$L?=Kww=$@M-lUtWK+w}N(#ZL!e;!gV#@`1 zd%cEkpR$z-#q-5%oD7@@c;|T_26en2=Zg#G#7jT!9Zl5CJM0k%9@QE<1x&g7dhn@V zF@**MAf{$I7|tCC2Lg$NDet2&m=>}{&qIuCao<)&JZttFZ%=)?yu#=kw%k@_Rhz;> zitej*BBEJHc>%jdD+grNEs|-_PrfBsjJ~phkW_Rz)vg5Fu+4u7s8MKCn!FN*-HZZg z1?Vt8ggcS60ix=zF66zf9qlIeDqpkqUKRIz1?LF51DSy{R!uMeH~x0)g$b)OzLu* z;BPzjA+v)1h4K&n`1aNoU3>)|6o#mWt{-CUxsxqK;q5Lg)e)c_ptS1XHRsqa5m8rZ z{v1UFlMW_fqkfqlA&roXE=0$T>P(M@n2k<^dpc$+~}uP;Ky&$7|? zw}=>Ak>vB?n<$a0x+115EE=O23CffA`gk2?7!pd53BFV)j*UfhS@o5$axmUbja${M zRNq8p@;J+$FReNr@L{JYRW!?ApZ2yK~ACK4e?D~PPz zzhuPkW3~Z%@}9A)L0v*cQ!=*nUK=&K6Z+KcQOK}$Z_$K4{Ku`i(w#Fmu=vn zu29~-(5x|IYnlnS_X_gXt_Tqwzl~xDn=@auBvpW}DnVN!9Cn;0aK3H{lf6h>z~Z53Nm<)iuWd(B zy@Ls}k*^sQ;3Os^`l69tFb%UUr6ES&-*hvn@)M15!cZ4PVyhm1iWkBuU5#JVv&S+D z_4O(Ks~92@h`KXTfkDLc!OV;b4k%8V05NsJz6(vRmq^$*1!!l%fGe9G6uepxNf%n3 zy>L6-kOEpY9^QU3==}O>f4(jXXoBa)|65K016mGHf_j6EJr&=HQ1bg=GY}(ngN_qW zq`Muf;yT7$?j;Gk)Jq8-cZ#;6Q+tY=FW2TVxKbEqb2C)D8XCbISCQ7UCtz03yW7WY zZer+FgDHcg!b;Kxir3Eol#W6==5ZlDG0O;`Iv;F2JGpwppIxPCKtJnx4$Yh74z$JWOGI*8g^OL7_v4!L(^&rku^SRQRn{@ zG4dm1z^ccr%E0xDR<@YkukM*FN{ufaIbD_&Mr!w7G4q(hTBDlT3Jq&N zf(ZE_+VNnf{-zn)BvuWDS=d6k^^dP#&R=PztCzn%UOSOo0po5Yr zzxLd zu8Y)faa1It8jym50-e~GGYqpPnx;9$;gC#|-R$RM0!h=@Ke}G=FE>`z!2B0M(B&0zL z1(4A5#$PT?X)xftms0A{6?V+bd)3862({Xm1-{%I+JyOWVwzvMzQyNEGOtCqTVH;v zoQ*eSJ~#MTt-HHpPII&{Ng3kGB;i}cnWRT!S<%;{qhXt?3cqej3%|y?UDz0hOJC_! z@M~OR5Q^2vE#$m1o{#DF=Nhn+jP4K+=8mIAS1SO?04lxMX41NXgl)cT1sfGx1nKVM zR+R%qfLO0+o}!A=jQNHBo|b6C(gc$0)av3kj!+PL>9&gc#Hon`X8wi`7P^r`(-hO$ z)PMvJHK~c?g4})BrD@v;vU~?o$(k*mHQGNezSh_Cq`9xX z0xBmR01E}=5)?pPb4SXorC(KxdGC6(G`u+&pU7&Acyf{^p)q%GNixsD&HeWEN;*e{ zV8|FQvz`g?#Uz2_c6hyry*GVL*@cC#nil1Kd|K3v?_zsKD$ z*0BD1n_9W^x{aMo;}@aFZWY^9?v1StC+9^=-8h8Z_FTW7P@v!3TyE7c!7yzH`-DI!|G zgnZr)iz9wgJKyT9Of2|J1l@UZy!;t>t|k=U2r~PYMs8dvDcZi1&>Xh=&%o{o{wxMByQdW;bP>%m8VGIwat zVm8+Sq;+wOdj1No{QUgy5bd&p5}Az97#J8LqoczkBcZ>#x^io2X%VDp0MjpLOk^Ym zU|w5+q`xbk*(8*-H@!9==y6QP7Zw5uZ^(0n?kP8bfProwJtiuu)NWt?sOjF^0p3(9 zH$Q*BRDz%Xjepwvyq=Z0xjDC>79JW_n{7|!PqWT1WscRPKSJUMn4>B<9IpB zA%(JFhg&gfcXz)r^Lkm1%P1MPQ$VhKE{(3jyK3xliwi> zjuD#iVYeLP$0__I9ViGd=Fl$7+v$B`)(!-eI@ojbYT@B8o~4ydY%2Jk;1$a-HK z8+}pKueO~grl%t!BL(d2n1Oxd#oJ<@I*-Qz*6+F{8w#|R^dvPBA|lzRPk9}Fdx{;$NqWD#%=%a&*`nLt%=&feL-CA}W>33LKY(HHwAjtdMf6g{q;oWZZNQ4!f-H)C7q%UPO6t8~|R3X?4 zLBpQ3nx)5~;*FWzuWqE{t*z!V#XWPV_J$zM-?p*M0X=q^h$z@kma;$$K2@j!J{jGi zMD_yZ%Di#=1Xhc!g<2bE81^r*3l7V!z{gNG$kzOLXc5Qj&OQahXo zwq}P3 zTJwLgLI2j9c(6Rt;hjXGFL*v(u5eRU;Cbmw?ZjBPJ&5~>yZm$lGx>2Wj+@9}_PhQS z;SrK>astWO6#Mqv-JyaU7f1Q|0V?>Arm={Khzb--y#lc5fox{XZ2s8ox?asZ4J-l* zpfGkT8F7ZsqkUNR^PR)LzZlcsGG;8II@P8u1I3mhYGtj%?om*t0Wt#vYE=bXjsV_z6N zHr2W}(^#|rJU)-zDK(hVRv?o?uynzZ0PC?frvtqrUh8^ZQ#k-h@@rpRF@S^!n^T_T z!yWtUB3*0KW>yNM-xDw1NT>dr`57eoBjIX;xuR5Og86?>R1wa^>tnzS zDmA;gW~b09SNs(W;5hmyAu767+Wqm3=GDRMKr(mz_){9?8L$yMa6X@H_A52H)W*mo z<42H7tYz~)8u_jxVAI()e>C1^ikxvPie`pzKs4RxnZu{eFB-BfF>y zb@`IHRC2tNxM`VKCqTldve<}nF~C^KXC;4M!tCwMibeK$Jt=_evUXrE5>-6-;{@;P zx7-lbpFIyfO3Uo`S1~7(qrWtvA{Cu`A0P;J+fa) z46VI`V40qXuDITL2-I4Cg#FCO6;=PE{6WW%+TSGPmE}lPRQ#VG<|!90c&kNIbl{ij zEFLxARAg%LJ$TG2!xr}UWVBmuX5H?L>jtI)I@Ch+nV5aDYxKy9WphTm{b*Fm|1_zN zUrD49@`~UGUbT=+y9yW|1ewi=2R4QAXR5F(X`Q9C%>VG6O*q{S8G1Qpf+G(!gHnzY zA~5f3e3lrd=i*+SL;1{7X2Q$OVE|F`HQy4IWglN_6eCcSHe3C^i=_@z|aSnrxBL|7SyFCQZIBB~qQz;kJOKvRnlDwTs^W41akaqjb>|aL? zdwoPrU}ytm0Do}itIXDaW2>(Kn%QQ0rE31L0r*PaG%=J;(UpTw$K1-n>P*T}$UD>xOrs}SrBojDG4?B z)tQD+Hkc=TF4#4cLjTJY}fO$>5_$aNBaCO@2is(9&LW%MaH)*Eg*B}@mO z72F<;w(%bB5n@v6&^02`ZN)>Hqo7)r3LKfQY*GgGw`c9Ru4fNksm1(nP5$)B+nbL- zo1~v{zS<%ijB6_^npkwIJ-}xVHPh_g%(-|n?EYjU6u9%SdiV5r4}dr+kO#N|9Hx4} ziUtLU_cG9I<>lp#7&5us&o7fRF;y%NN$A~#+Ew@q^VsqDI9+jsX$%~x?9B%Spt0S^ zqe3+D6l8a=!WE<@EK4dpeM-JQ*#x^o+7Owa&hdyXk{jEy$q*k_6`7HxWXH>$#bnIT z`=89${TEvsBZN=-d6v%Ge`9ZToh{ue^OQ}V&-vjVrC6I~3o6LSoCZcwE1&_TD(Lqt znr_JHP*=3`8Y1cUXviF7SV$M|} z72aKt@df*`{s$|{NBl({+fB->B{Y;ZrG8YTH-~F; zDs+?-y|}4ZWZ2dua94X*x95Ks&)6xdr1olF>M6Dj7Xhr0=cl0jupIO>EbFQ}9r%1& zH@~#Q0zg&EL-d_%-(SpU7Fsm8&q4J1I)=xU6>H~ zua>F~ovIk0PqkIi8!KG@ZrdB0{^7jV*7Zhm)c$G5JfY5re&zm)w#xrB_n;jy{G0=$ z?g2Wl@bK_&5)z2?jTdMy@Yh6+jCkzl7em(xFg%y`H-Y>JaEg}NA1Y%At^$GN8^ALV zk&^l>EU4OY5CA2|3*Yd07U$4jIzK2bIQr)U;A4)o*H^y(!Z(3XA7a zGIJ>2U5lyyh*ydy4Rwu(f0`H6{SH;U9NBWVAjWlP#7^BU`1zA+<1?rYb;1})$gAyb zZLwbrkYJHNLjMDfG=5*C(^go>KguDv?2!@a5OgbRFZPeD*mRnpgXVa%=JV9D*&0OnvZ^8M;BVYeN2(baIuZIkWIS5%y z@u|a8^z|RA;gJ1PMXB@_vDevD>^z9smuX9Eg*78Q-WXgQ(XJ=!iT6Qk{?74e9JyMokIPY(~M`1p7ib1{>>_)oKTM@mqPCorrEp{@_^j7Dy@fyo*{V;?m4M!Ju<8%ux?BTlQeW5#Ey}Fn2 zJDI&{kE1}ACuC*%!b%i*|6>xaZK#Ha zArc}Lu$HMaxlmmk>Au8h{7(Xx(d9fPrl;6cSKkzlyv3Su2?Y5<>7!65jmNITi%YtUG8!7klllWC zB_$u{YoPyLy`Im_YcyLj$awNR9i6UZ$HK=Kx3v8H>ebNla96i#x2z3v>Ct%a5sQYx z!G%hPvU7Ywf)yKnlK=0=!QH%&xrUJU0q6BovaqRcKHHc$Z)nNj}T$ZJD&2_#nGBS9G1T;#i?2=E$_AqyDtVLiZCw zO8U8=|0#<3x5t;))3VR?0{vHq;H*k4dVo_|lpzlY;KI%4gf~GtpUq^wxmin@!+)+; zI!42uV`<}{(#DGRZzg8Ny3r#@%4dgSBcYoQDGt(j{dF{|{b(4hMQ}Ww+{Z6jZCULd zFn(EU+O10eqI&IWT;K^-;%%KaMY-_Ok*tbp0*rQhmy_*Mp(~T~#$iM9@r9O73ucNr ziX|!rhEMydi&=KE4KwUqfox33gX^H`n)%pYCGMdpHtp9?f(pTorqegE`*4W<+TSi* zn!X%LP1{Dp{aOh@E|QokvbiuA@Ws@y$03L2z0wa7L&hy8*2y zuooYUJV!|JXn{O{7lReZ7QruS#{F63)THxCuRo3&YJ-NLH}AAb3Ubp?V7Nq|r!y@0 z+xa@`Y-mg%Wtd@sO>wLxk4ZOYD4oMoqDM$ctmCbjsQngJFam_^jST4Gs<#Xf!8xbqRsx zrQ!a_e7)?>3--_&kT7omttuFz{hOaIi^16sYF|r+NCaSndE%DQJ*#tb{aRYSe*5-q z4j&n=26q#aB2XA_c{B@j72ul-z`T?bD)LvWx91WDifMd8%hY|>7$@k6Ujx#&?@!HDfAdQq$ zMRzH0{l!}-*1+3j4VQgo;UyIG@E+N7p7q@~Xq$abLzDPBOa!Kxi&Q7%0vV26zSP#$ zuJ;=|vtYsfEuVyZp|#3YxH{sh4@O2{LBU7q+v)j$@zb48O^jPj!IsGbCwd?U6`k|K zA@g6ODf;vQ6adqQYQ4ef8>d7y-9Z3^8MSOdVi+=L zJK6`=r^>+SZOVNM_3YHn?tll@;NzpBsso0H)o8hMA~i!B)yXG`D5kfnr<9qtg=$%; zxwvKv+HwnW0G0iMe0c7LzSbX5_MqwaQWixuaL`^`0MiNp6!d`#_ak?~E_}?_dG(w_ z(V8eyKaiPYb9<%-Ol^EFE-uB}N5}wzXa^!+Fexu{k!wzJ2StlsiCy7;#nHOvWOao90?6-nEY|oqE-r6i-qU;=Nlk-yeNF;Qx#Tda>WkSYY;EoGPw}+>p*v1Q^PF=9P(t zh!|5@wdNbA&e^0n1$hIQ6F-!VGg-dM>q^6Cr>ABk(;}FEc@O-rUnk;GjG+bXpee{o zyZ!~kcIHV8lQxzmGsoC;P1oTbZZ`rN0CTAdcHJ6p!Vf7RuU59KOt_oedSy6#{^1x% z=ydMMz8aCccQU0P)?gj$2^%9&q}#qxU0HOpPjU_hgG8-K>Ncjqy-QKDWoD`Ul=)Gd z2m`BC-5E*9zF7Ubo<_&Q5&}(L!gmd9o9!V0ocsoT;K`gxaVdyXAr(0@JOU=3kMnH!NW{c0 z=(8J^Y>q&-3*tnaaoDX%>6;%IfsW*KeSRt$9uaYqbNLnt$h`re!(y>C@MV~59UV_u zRz-z#1r@rm)_PMk0WLs2NXx;pyXg}TRV6wBT1!2vAOroJq=ZD!w9e!-=RPzu3yb}{ zB$Rpzq?c7f?t!g1a8^b_Jm^&FkWk~MC&qD)1iLsTcl)~_2?Nn9u1v(ENxNOY)T8vP zfe_E*EVu?M$yL~U`cfmlWs~p7tPoEdvqIiARVj-loWYruU&h9J&O4LL?W4knO3d)l zf$*#CVnGiZEqZRe)Aevx3R#Gt%11qQkx4Is8N0Ys&C;I+dEfr*q8n}d(;$H75k;*= zrfYoUp+J?Yby`p!lEdGS-jxS6;ej~NiTbE+B#4Q_#0$$H0)Ntuv~M*W-@^^tk82bB zwr5pJJln}Qb1M4@h@sT9O|sw zURIoGFH!d=EvCJl=E((xyV)3P9&#HVmV`hr4@x6ooBiGxt31T2GgPe|fr%o(6pqxW zzBhGUM&^qj5Sa5td!o`T7lgv9&?uV06B3GYT>PTNeeU%84_i>xd2j4l4cc^Cm8#JA z_&$(W!LQZU0`+IvX(O0!KHL)irmJW+$AaE-f;Lr9bj@?0c z(_40cqOh-D+`cpfh8SSUJ;`t}GdDkq;0BOjwX09o&Dkug(jTK;Nq4@8yTM1hMjjgK4KT3?9nO*_B2|`w@MYE7ElWlYSAU zl{X;3vHG89qn>90{&cnNdi$WTJAKZ2cM50c;`0~Mk_Fh^KfVbeb=vFNp1Brky6Z~6 z?<*JHDti7=RcW# zRV0Cz*TSh2qAdv~R<#>;aia~v=kIwGz`QBR~TS2f&v#cix+3-tPgb7R#QX`*0i;;?X zQQ&9}EYp_K5wIB zq<>l@h97|^;t$tmoA9T1)b%{BA4|&Ymzz1wGtJMENY;~{Y|I90@8j{`*PX&oAlZf6 zNm>Z-ALidEucdaKF^nBp5al3tzj3fy0DgKhcujxa(yfzwu?joag~{BQG;-l zGrZ8}fqqS>dcF}Mbvg%sHK&GyHhrBob=`h;m2yVFUAJ!mE&vl#V?;qKllwe^@nwbt zfCYfC7fT9b6cufJcnNBgIO+!qeB{i0rbbu4yke7Etq1y@aQxt?!!6l)EZq3KMl6R` zsvn*2)~OVR9H>|})og>=skJ8mHQ9r=RPiZ5B!E^|*jru7nluaAEc+7APS_HMRy{=* zfuE}*u8RwfSU|I3OyXyi<|Yr*Kc=XZC?`Ikzx12i_f*VNEmTe^!z63msE%q+=L-Hi zQ>MJNQ?!a#LeQ5A8Kzo6Ul=RtM_0~;4bA`q$9BN)=`gLd?O=b8$WBdBuny4PbFJ35 z(Sa&rj?&$xW=&mWUQ$@tP74O6y2=Sn+^hcoLS$r_@^fm!&dMaR^%ebP}hJ8fcExWvC*e!Ov#76!`m8dACtVSXle_E6;ir4jRDU>Qno7eHFTs zvr-Iaiml$%?wi&+VEgyqI{e2+e%%Y}M5aOL>dJy_TyLDM+50QhZps#9@ifdSZcx9i zY~cj46Cg!udDkESi&lFyEx4JBf{g5RMkl0pdD(VcVgY;+%=xADv?KE_96kWB+u-(W zQ(c*xZHMY^cdawvB`pBhbe;#!I&wdkG~ z8YTMyS3dCFwmn1u4G9)0n(3sOA`vyZcq#UC%hY=b`Cx=?Nh+`Eg35>c?9B%I^_3#l zB}ihik#;99oy_#cibl4;*-gQYCyUYdvy%$SB{sG87tC-ibijQ$fWR;U49h<`GKg2c&CErEl}ue*+MP9<3;e*)pUupN0GO5Cp2MT- zy0Cn(pwwtY)aMIlHvE?+gD!$lHt9k42FGVYRR9hY9gU0}Gsy48Z5J%HLj)VB+%@7O z(ZMq%WAm7j9ixo&?2Di7*ojXzW^ka<{LE;ZCuIh;J@?dIt8p&as{;Mi*SS~r0h4M! zz|eB>yG}p%Hs0y2?(beTlKMxdtS;Pz(L>JRqV=L)`a9jBIhMhRXumB^|_ zVV8APZf6}a+=SZ+%0I}x35`Q-e_a$NQNj(mAELDE4(F4ESujRel&=mn(WFl9j*2LB zs`Be+ZU1=%L`vnvS|egTwTG<6Ju|u^JIsf~?#$oAzcx+!r%l>_#4G?p<}}8Yo?0bc zmE9+2PE^EGUOVoWoCk$t~)%o@-E%e)dW zZao=eYHog2Gn_+sQ_d3~_!zZNUhG4kj)sGdI^&?Dyb~1i;Frx)_ndAG^~B8V)w^oH zw|C%HZj^J^gYIUt2nQzib$SYu9vtkpwy;JqJ|29RpEAn>;ftG*Q>+om7(!F5#4dNP zEch-Ph{Z!8`diMK4_o=4j&RU@hP*GX?CYP8bY42nE6`fj!Za?yQzwmbV3yFQ;lRF* z`L~5;uPPG>!EEvx+jyuagz8Cb${jx!3u3O>kGYatv779$V<58^DekuRlh|4dA|S2; zs~lrW5yeaUt=Xd*Hs}fJkBs+&py^6`6Aasq6vG>$BQVMPqRs^>e;N7u^eHJIEW=_Q3z_hFcA<>S4NjSjz9hVj2^0oEy+ z^cmW-gJ*CW9j5WS&Y^_s?$o|qrpbm2x;{8&WkP1ck)|Uf0(eLoBX;_SWD4{LaNnu@ z;_%WYSvGBrq*g8T%vWUCj4gqeEFEK(G7tXt>(56-k8tp(4@&9$DRgR;WC}#w?O$R2 z)YH2SCp3o`i1q_i z2N)3pLNyY${n>cy(8~`Q)vD4mW5midv9!4F>!L9R^%3Oxh}En^CWsxyb}n|mr_J(?rQrZT#W1~Qq^fFe|uECc{yb|nEicV4 zAkK-8WNczWMMtL(G7w&b+rY<(W(i++d3g!4$Yj*iB<$^392Tr#K~RSJFy6-{8&}Et z#o+c;%k1`#?|poH9QB67&V-^5>CzioTQA?GKDau)9wllLquoRM(QrAs_m0SAc&bN3 za?<+R^Apm-UOn&6#>=qg(+**G9;JSTG6DvsPz`sIKcOhg@0OAnFkCmNbiNVp-zgs5 z*CfK8<=yOE$ux>)bK<+$cJqp{sf-WUou)R_k|v`-vN1m*@tnOiqj@m4XX1S>^M@T^ zR+JAqC=C&_m4DH;Ay=iiKzq#paN8ZXZ2%pD1BTL4r)kPm#{u#ZS8a473?5WA+ql|= zZsO;n@pbSQf+LSk{APYCEwkLN4)~}zbIUtiny6Lkz?vK`Ue&Om;Zx17VmX=|Ho3Ni zg5hkMRgv?t00;s%gmsK;RbQQm4azF`6lPy0suV9Oslg2;XBgP8DtGJI$%kxRV=3&Z zd6fL?;R%Y0Hq@Q2HJC5(ZCa^2Zg(x=Bclb5A1_3Jpn;LndA<)LpA*qe;c`sHKxW3t zp1>janZJ1Z+$SxXX-bEr5xt1JkbV*G)$N?XH;a*~9wXd}w{Juxk+8}U3tQWJ4EWkc zI2MZu%W0?m<)%{6`Kn?|)6C@fC*#l*XZ72{i*4XTynKcTiNDi&Q4@1`d)XzxqM`bQhosILlDs$@B0qszZ;=CrJCba ze|OWOZM}n3W$ES@c!>pUyQaR?{mo$ghf3xUS((H7uY6OpvTtYZ!#YNE60a~!Q1S)R zr9+Zel|(uP{~iwYLA-1}dM|6jXTP_$;crp#ZuP$mrAA3Q1LPB6pG=Hf3T3_1`e**H z%Bt)pC5OF>P5CikOxaCJWABFBuE4m7tqFiykTeP8U+rS_jU7P1@ZydKK{-3N99zRF z!$V1&>>vjUC^(KrG{Q3^$5EW;+;dO>QVQJfvmn1BC@2W%8t`&6XF5*TyTLA81sORM z^zrLCN)%MgO{K*jQUWLc{t@CMb^r61Mu3Mun@N7G`X&EV?vp13%S!R? z!R+>X%5;#avGMDjD4;{*e|=A{woxAb)=evSwU)if@9k-q@FSnpf1~9rkpak7-0BQR zS$#&tq*z^n6+@NCoHenzlo0F=&lYC<3noK3D24C`4|RoQ`n6QS8VKN=nS=9%s@yIb7mKO^u%=a;*q&V_F%UdR zNP8Bo4o)V(<1=>pqhPF8rgT-oHE>VH*qfQ3$bW6x8u@;hrZX>C{pohY^vk$CLZA=P z_{vZLr6H49x|ks1>nbb;$u47Al*&1K)Eu<%x8f{#hGbvAlCaat=zdTNlQET#T=M^w zmSrYDPn-tDQcL#sXJn|4i>W+J#cTO|L_Qq>-yr;aMACPi`utd=7v}BGCOQf{Bmcyt zENn8IHM|BRC5kE+bL+;w&KJyt7Wvl~4U@eaT@#-zKz)@Ery7At%Kf&m>w{mSMOS!4 zfTp-GbzN4pA-j^U5?^$oqMkGdyONAa3ndk0S&&OWTq1s^*+l7N;OwU~R{IofrHQPF zqS()IHoXk>2h%zuD!r9(#ur5|a3Y}qgTcAKAiusm2XXCU6=rAasRWN>@@EGxO8+B_ zwwHKHa`GQQzSscwI>G7~t>kxSiwxW#BXZ;-@e@SSf_C z8I6&?xQ6W6ngB$3y`QS8P{Vs8tVIA2=l3mnR;wE{`|M){&8S|l9UXSRZyiu>H6tki z0J>#R#Cshflh^5?9Dd`E{ua59^>bv?p{+t~-+lnvh&jD>`}CxXvo`58$YURP>$*8A zMeTU)LR*^Z>0%l12bvG_gKIC|ALycfs;xMFMicTtP3wz)Pnf{ctQRYrr8w()#EM_? z_~GAlrKQ#@9RJx6k+V4*^*3Xs$jW z!oAImYWU(;!IZ6hGfOdB0!RJAHdF0mP=1yrIACo3gdCuY>C@=AiHH?1>SGT?BUG~# zoiRp*LSm1Cb8MmTLiEbc4>-VZx{dXVJGXg1xn8fS4R=^pz*!XNM@4l$K!ps=4rj#v z=DyhZpkQpy(XHpN1O^NIU z@-N5Do5GAJTqnz^diD85bUMhT5VXVPZf;Wr{qL*Qz!4={c|NF2!3qr0_gz=3<=;3{ z%jyk)LwYUnWZ>waJN{2}MLnZ@#JloJGQ?uay9Xl6dD%%qBf@F@H-#R9mKa~<*vpq6takqx9by0grIBcxf zQrIwHhY8mw(JYo$zT$1~EaS3IueROPGNu5u%)uO2E7d;|;}Jt>>*_cLmC6h;uW|Bn zOg;nKfbJ2e_w;avw!6AJ7`g_l8Un9$#dzS-KAq&f6nz#9gks$U)GuY& z{RHeIAhVv>n4|dGu52m`ZcCs&>M4RX%Zao+X!qiGONkzi?i4@XWh4e7i?O+F$C`)+ za=g%YQWH=odqLjU9EiY609^`T7~TQu?fNV<$t7m}e-eAx>UVYV%LIkQT$CQo#W=mB zaxNF_ zs~)%pFjclMsR|pez-DG}ca;E8d(jcr zW1UO;E!i>fQbklta<>757+`A-(8rc&-l|672>G1h7LBYsm%se>G8wDF1NOi#t6!rT9Plidiotz`GC~d6jonP&5D1n6^$@ zyiM$Ygw0wc{R*s>;uca)Lsd%)^YG9V-Ix3VB#O#wd6M@POFpZ;*CIcAC>?@!+R50D zC>=D$V*WZ!EALS~RC!mEFNQ2~#*UIkmh}N0#A;5fmwtKTQ6hzcx&+T>ReB{LY1^tjA%x zz%JSk&in5uP>8?Mn{)=XeXs}=g`)W;>@W_Q!{OvVd_XZHw;p6+dP}k!E~Y3~vZ2`P za4nOlQ_1>$0a+U|F2Q4K3wJrIXigizw;R17to(WGGA(4@CF(*udgwRON>*AL( zs!76ok2&BKc1ghEjcESIhZu-r|JMw`{Gx~VnJV&`{$EGLiz@kg*=}^8gAAC)T&BnO<&^4xvm#%UcMS`w-R_NTgi@I zPq3<;?#>)q3Hf&cr^^JnT|qG@jQ9-=ao#bk_Ze5lfPYilPKH_0T9iDRdMcIjil#m* zX5DrJP;gP^UI^uW1y*V|0IC@~`@qTmO*-)YMjDh#U3o8Al>YkI!=hbW2p!@-xu(v_ zVAaa+_3csm&Z9HFp95Y00+G~avQaTQMPPQ?(`${GCvT{K-)cv6HZlTqc?D0E={Wb_ z+*`|fib31@dAYV?x*j8Fofb{d0R5Ksw*f?&?{z5^(ag>@q`n8mUwWVJI1d18tPqTI zJ5iN6&cM^K^1yR4p^?hBYPRHVUFu+zTAxlYGnA}KJslr{-sQ~w#Oyn{hq1gc(^LHk zPP_hRYom}rI%=qywOGggq&ua8`%_=pdt5W>RSW|)RjI5UGc9?MZ{9&J<(Nt&l^KcA zp-hY{VmvHN6+f-^(}QSvdWJ2gr~Z(!Vh0p6nFhT@WMs)KOcCVclaIu*nouH9tg1}; z$ye1&$Tm($T?X8~g%hGbbC^ffB@d+?c94-|1?{wk!POf=g3*Olt!}U*u*&JwrBdGn8$w;^7G^-d$Rxs z^ZO6S?neEhx)z`iYL9R_-+JLrt1On6%s55D9alVIAGF)oHd1PSx8rrW4Aa}x{Ds4M zVF3ZP5#6w6nj)-e2C!oSr@G^{W2d`2dN3sxs_DOI^|M12oK;i;4XslE+B?tzBYG9a3tYS31yW+*cU*0XYo&f$~j z5G1MhVKffFoTY8PMDCq${lR5l+up{YuS5u~zwez|6c$#i+-Xu~!dsGOdbH;;C{hL-03=w75x+xrh z*MV+$O>vgDlymPU?}A&M-I^2VS{DtjYsD^(4;_9=U1m<+)vFWsDOyWVa?qyz)2xi` zRbbk=Y(gJr;^2zfr>$0OcSn2YG0hYnLiIkC+QG z5yzenZXhT#g;%Flye$-J)s;n2Nh%gX3maq^!I=|i`(>O?2^VV7Y6>Gll8UPA5^6!r zihaTH&J#%<7;z0@uR@ex2UwMqLrCJOsCGUO(3IVltk|ci4aKhp zOldYB3A>$Ilu{I5fSb;3MG5@^f5iPdaq&Z*evKGUkv>9d>h-)E&c8TZQn8$=|1X|% z&V>au97qHl9YCsk1H6@Sz(%p+VyP}I-Llae0mfNEAkzW58xV^4@`8@8X#S~?ikkYx z-|XW9-Phk=Yr7lX{koW<&Ft&fuOViCJ^|;8kI(z$p1#n~P|3sFTWq<4=RT^VCw)mK z-nfsG^j9@Lkxh4$M9@|ABATs5{SOEIxY0rHgt3?F<8#$+4gc*72r7eUZf*`3V6yv17e7B=W$v`ADo##WIVZuAuaWiQsIK zqhU#q$DG3+VrL)MyGH!dQKPGHkN`C0KNrLrM)Ds~+{3F1tbDB-!Fwm={E5mi&9a&t z*;f|eA4#NK76YaR1}z;fEMB$IIAHNyV0_yCIKM~$dZ$;hQ6+ub3GhF35CN~$^&@34NWrue1%YVG>TH?8H6fgZ@5CcRh*K<;* zUK3`nMwL%R+i;Iv=Q=rKD(#E8yw%&6T_x+5x{s1|3I8j9OS!puvmbjQ{JC$Tzura9s4WZFo2K3d0 zkW5OjI)fHNT#0dz?oMYuPl@8^?X7e|LSxeRyT4L+Zm=$e0@HfUNd6j&S08Wx>IgUkn!f+&ef3&XuZ0|cOWh{-p_4zA4Z+VNa2EArcX-Z#3S+z?POEwZd zD?z2|@ibOBpsu7LrOUMFmTC4?vUQJt_&zOSR{VS9tXRSzb@D#?`^M7D%Q=;{h8lh< zQuh83X--_Xa9Hqsg@dsoo{#FNjS$-r96H@Eu*;`U#PsyY9&-8e4B+-1`2xjO&_#WY z69>3uDXTX5*sK}A!^1m*`>XuGwJO})Nx)#463naLQQ&s3#sy|U z)Mts{=*OUC7dMjS_#0}pwxn&FvNnO!C>JEPxh*$dCDo15b{8=bB!vULBismJ2b-AN zRQJPr67|JLrMbdMo%#rV2-e3M&fY4qTMF=x)NGs6&G!IjG-y{e_DVS zvk89iDrVz;TSU&!80lp>0aNS9;B9j*DJ8XSZDoa;IV?5ywWQI-75|3mpbJ+~OSOJw zHn~x!y=7Kl9_Zh!ewE#_z*B}*+)?M8s z!dcq*m>*Td;Gb_QNBO_;{ndx>0jcvav!xckCUnLk*JBp{88_64MZX_D`(QEueG$>9 z^x;z~mVMMsQqn%8-v9hQJOlnem|r}RE$niC+Tkva(x2<$q@5u6e+k`JpPjEvK?>cW z-18KTMpGiNPdgh`_DQdBX8ov2w3RZ`p#3b4E_tjo;SfpXDZiXt7pQRTUqkk3qi#oB~mf>1^5WZixGW znp-9XS8jw(^}La}c~)uZsL4H$r2-69U2o$ZyyesTsC|T4+XLsX(`#o-UNJXU8@zU$ z>RN+ZEN)36P=tcJxs?jmwMT5nNl!5O6i-t+^-w^mzL*;~-p%bT6uU&-T#;27Lf*O1 zVbF(%Prv9b1a4~W?F4d_d8y}Eu}TU{ww35pUJ4FF@f5RH3py3c0=8Le=+`E&gZR|9 z9=&U6Jj2`X=)fVTbUI|X;Q>`6effJ@Xa3M$)6%TM_%Qv&EC9?S{R%^&XioguhiYD1 zJ~_YDlHK7*8r0WE`E=kA0)>q7HqN5H1j5H|Y{pe&f>N%iLqzjAp8cJ}^)CW8{9wsx z8PN?y9~dE7MV(f8SAR#ow4&VbV$o$Ci&ZfUwOU*m_Y7O%?DLq3WEesw!anMI)%~9N zKs};BOLYZUALt-W!L#v#?{4uxv~@nVN_J$Q`U+Kjc6?44SBryJ^4?f&~Y1(`+9kC zQKzK8)ZLe7jT#!7&-Mw=P*$1YB4r}KhTUfC{c+Ph9k^EqT*M@q9{vinBu)V61M%79 z#Kc~eCeuj!wxfr&cGr4OGK#{E(opUyJmCouZ^vn8ovW4;dj_iM&yH@D)p?cLT_176 z79jtrNT0KUbivRnV!^o(2drYlW7>{KmSn&PrnhX?l&`@gy>QF-P9u`}GZjZ{bMXny zWrhE-5<6XD{SV?7qhO`eW`mYAt2sb`RLPi_CTO=LLU(&U z;<Vh14-ho}W{x)RUQ)S1tD0Mff`<8HIlklTDj(BWTl>MceN>B!fwXqe zS>h(pEg$CiEUdVs4|Z{M;c{@&#pzZ}ztg>c{fSQHZvTNhwK7DTzx$Q6vU8CvUjKfQ zk$L;;^bd!=`)n+XK|m8vRmi;^+;U6{sS*ep7QK;AIk5GMNeV*!h$i9ciurtbYZ@*z z(59T^PzkA-_HTccaDIGz;<_%1n25nJPK~E_-B|pPg2tX=A@!uO#C-c^76 z`-%siEIeh8M{m5>`L=9BVn_k9;d05R{jEzI=bWV2l-d+kgF$g> zfoFH;K*b1FI>{eW=SLf1&>Ck_tE+D${J?)HeeGBbNp|yN^Y~*tv7J@0^DN^y0jrz^%?7*b&PxkGA3X+EMj-#7S_G5rFPNH-+nH4I6jq_a#(-X*k#}zg@S2g7i_Ua@p^-W z@mU<_lBrKXKKr^L;YoM?&^7(s-sRH1E%9lDT`&o~y7p4OMRGx&z_^wh2Bk+qQ(yx{ zlBM9ckh0+~(c&tRqGJeIs!>8!WR=M3qYKxa2MCi(X>ew~-T0+(JZx~7Y8-tzrdr9p z+B7_L;wD1CU%}vF>z(}cgBe$beh|0kIeMb>$dQ&8C#KJ9HKq%ZRYt^0I@W@pK`+8= z&(lgbQU0u8NFO2oPbou!#18%5^j=52fpAJhP-*%jB@+CZShs$4@ddlm!$5x8>)dz`?hWL*^K-8yUJ|OS;zcR;{hz-Dot8aL zKyF(*rg1{&oR5*f;j(y#yS~nE;e|hE@c?tkYsurFUzfTB-VPmh(7@(2!bNWJ%E@-; z0v1XfudGI89aj_ohBjEiY~9CzB5RfP57+i-ozro?T%t^3tnbp~mUR6fL4hN($1I7P zt&ADsLdA$R!~lch=nf4E_o1?N<0vvvF!rs%7dvSd;ZFsT)0n4A3i&tSa{$JpGjBh4 zq@(r7Z84~>_lbTiM{PqSK|)=MoO?@jW_WZ$(P6y$7PBg?-5QgoBx3g( z*cHd?a`PStA*f6e^JoyrFy>qwRN~oz$z<2~qy%e2;2vwC@X)T9a4eDMfA>_=S;-_l zTGcO_F4Tnm&n0cK+|Df1svv|I2*O`(i3aKba2>|Wjf4prgupf56->YhjGqgR>p?(p zd+SwoO#MIQ^INe+9ii3bq(V7}YnFevg}2O-+#QPAHe;7 zG-Z9Xq#Uf%Yx$%8vv18#?EGp=;dr_on`OelMbA$n4)odCESr1#^$H~_nu+ivvxB(x z$_W>B`c6KrCUhNhtUp`(I})*j->q5OmK@g+K^%!^_xfsXcCt2zs002oZ(t>Sks1Lh zoE1ls=~Bao=4B~xgO*qf-QhWQwQyFPqn5gy?|z{87Y5?V4jX5h$cY)Jy=TewCMtIW z-FQE+*oU8OKH8}}e6F2exJ-{e7gTyByr?pBG1(_Cva!Xb&RTq=^8Wwf?k&8sTATNA zFpmnTAT21OAQB2lmr6^C(y4TJr-F2YbSWXy-Q6PH-QC^wo6R}rec#Vo-@o9umassc zXFq%2G55?hGuQP}a!aJCD7kS?pD0}84Pj(kxT&eOE1T#?0}*{aRwh5$K~jC~X7uoL zw`IPwA|X>;{-9-k>ZFwFdN*>1TBlB~(qF~A@tswVFL%6Tx0biD$>`#%bV{kg=zq|( zaxM}$)wS`mgd#b6J9xOEI@je@H+xlOamJ&SLkR`_dG9H;&lYBxt*JWqvp(Bq+E6Bl ze0jVRd^*25LVSx&Xq!2nx!CZ}IO?x$M*Hi_%Z|8{-s^^+-Znhi3$AodaZ26mxZ3)O z7?0K3YN^M|SG?#j@iKM|-FXJ0N%K`pNP^r76_V&;z_!M~z5 zcGzw`vom>H?NIRL*fM4|Q8qf$!h?@%T=Gk4b-TCsm9_G%E&_{^=ZACOudKy}H3(f# zEnd&1*E_NpCm1?Ne{}oyx(-41#Om^OW65)&^=p0=OBu!#X>3xp{7LtS2NkQm>`yo- zS&NNXtF^Mf=VO1g49{L*k=|UY`xfLv;?HC{{QJ2?#4`nKT#Hon(q?oy4!&IC!roq1 z?IALvYq>YbUfu_4<&On&B(%w2x`0$Mm-EB175Fcy=oP- zyaAV5o!T|_em>_Lxq}^SP0KfVz)fK~e1 z!;SleS(zt9o~f()WLB0TbDNn0YW{57&KY-yHKN++b1n%S zZuVUAmC&0`C*3#Ane)Oh^u7VB+$_)(}>=s~m7IOigk;W8`w4kwLHIkZC=xH@|BrChceu%Cwb4 z%7AiW(f8TCaNgwHdW(?NmAr9F$(V@Hx1Xi3&;0WEaRS=svSNIy`x!n~ku&5w z^ZU8i{qLntCOY>Hi1x>)=sUW4(3r3oY5Cxp%X#y0(75Gl7x#S@T(6mwh)7?$;(UX{ zV8z9S*<8cK#I&iE7BRZJ0++F)q$p|1pIA|qH&-8O6dM=sgqfN&wYD~VB}z??l$)}c z?34f9*7T$?tyY`5?nkbFbP%^e0cv5ZE4Q|eb9|L2w=NkQQ|L(4PoAvazP-;KZ_M0g zn2ByX)OuPkD84*mzbAbj6wyHUeu~a&gRsvch=EC+@rkAqmlYGS;ez$jW{GU6A#Gpa zIHpx$Z^KVZ=7g2{n-W3SQmEu@;Os_OC5z*kx6_^35@7n#cm>n<%b$kNq}WnRWd^QE zqN~|&ca~f;ozMHVUV3*cHZqTzk9<31&UGE*ebaInDb7XVK(pdd@znOZR!Y&DV6N-j z)~)T(5eC}K+OR8uWkUmIp1Lb1*5^dOp4HXwtOj7Qs@k2iRCnG%wui0kYqw#$lS~E) z#wec4MLM?&-nJ%V}+hmSWa+UhXHXAwC#bMFmLZw&C2oi+;+}eRg%(*^&m*X zt;7xLZy*+{o398&eL$U=@RQO0@IKJxgT(8UCuPP$k1<=&Oh#sAMZ3|tyQIC8HeYiWjtx5L#we^rC<94FDq)e3&;6x)<4|7_=qe+r9f|BX;^&-YQcI zo1d~E&t`4fG5rRHESs*DfnVY5d&^|>){znSmssE`Jk2O@iz?*cV5hI@qU_%|sxDoO zW%iWMkm+4gC|~`EEs%}h4ncB1h^+@%NiE2dhJJPTMUyC56q@p6`Q>`oQri))*m9$M<1RXFPB25(v>9pYN`B8F3VK4Fwv~#FSqlp> zI;{>3=DfH(anZAYN*tyQYgy6|vE?GoHw@=26x4D0B`=wcnXwhx*ta66%~`O~`1C*2 z^lQ{kGOE14UzB%En6)bTyVmXx5217nqSeP%qZT)}E@4Z`nO!55m5q*c?El#GCVMa& zN5&W!Az!L8MvG1C4fLc&4;X(y&2*ACejhfkwVC$gbR_@I=ts2(3TCkcM#g9s(zVqd z3rmrf>E!mL&8AAFs>~y;4eJ5fBl7RbH@7kbiKKVUlU_}wCy?cBbxoUZD|M!PjC9cw zn~2i4Ccc`YVoO&I3y((nb`cQ-AsUqwETWB)_)OQ_*v4cd8aH~9NrFq*#AdJVWBUY7 zn+dlSd9;gWpwm!l2MAY6FvQlL^xAt_Pb`Var%ywOQY>7pQs3X6zJEX_e<9Lprr1LcD#*_>E6-SSHQVR@P-b3flOF2>(l_9f);Sye z>~MONpQ1y=WT22#7z-!>*50*-246~adrsw0tTJltmjnjo zyHd~>zz_T!;8Wfz*zNei{SDXytu|Glr8SJrlID5E!6Q&W0MXMI1|vlV+T5lNl@DUu z`&W-wJ@3jLjJeCa&*u?|ytKNoxR(|l&;WZ?k88AQ`aEq0_d{*_Cqnef+~?2APFBCx zm|ky}mLaRJ_s3Z#CvY(Dyc0iXv&^ouxS0Cka3Y~b*^`}$DEhZgZM*Ws(kdPWC$_vS zX>7E?M}ApSwq^oxyL7{$;z!hsIu4d5#4h`%Esr^$8>%@b`pp*PDkO>3y?n71|9VH= zv-ZodKW|2&EN|Md=$GCv!&-0Lh~r;Z&zZ%WmUiH`OU5tdX<;)NJS<9#%ZqL43IA=t z*l4ia@N&GQz9P@YJA}#`#S=^S6N!`}jjZb}t85OzB;F(jm8Jk4#k=@iF>dGsYVQ_kd%Lm6u$YnoM6yyaT>xhAuD)OJutE{AjsDUR`>v9alzNa? z)v$b>KK=W*b4N$&Tl`7J(G{zze9!of+ZeYj#Hk$*Q$k23)7{*O!U+f&DodMp*>wan zUGn=eX8Qb^5B%CwWwO+mwKqld7Z>p)8B+92DfB2L4_20KEMhQ-I*};Y>66?XMsL@1 zPSK>Bp8J^axr%J zF5d&)9@dt*s*O56@1aY27MEqoIOIl{S1?8tMGSRz7w)lHggWtN@){2r7roNe(@83? z@*Mu=QvdyGo*8qBsbM!ht=6sVL39~mo4lt*D^hx%9xEZ6*l})V>h5hnC>s15EeX!6 zRwnn&q=RT=K3a{wa_R?rBe;1B<*pE`SH%}yP5_R}R-O#=fv$6M$61*SO~Tp#ERe9cU4Bu%1xOUY(8mn!PZ>~~Nb_6uLo zwcZOHAsTCK8vPu?RCOh=ywfh@!mhag_FTGRC@y{%VGo47`Gqn&uNMx8Og=_Y#%wp=m|=BST~Uf+_hdECTujK3RwsY&eKg~y~3}uotlm2XZL#Kq7 zvBJ{(bI!eMvcAa>m%Y_VjO(;SZyI5z^AM>wXWwyb-&$H}yZyF_fbs3D~3N17H*f0M=t36ZoPtJE4{h9gV*QwyS#95Y<^x>qV z=GJ@UzldeeTkz39v$>v8mECeJt>DsD+D$F<1s_=%G(|Rvb}di0QH}VA?LL9+Qm*j!KWSX-X!sd_@Qfv% z8UGi<1^^!@AL75;6c)>Jo3gzBR4;YJbut&*A8>zor<^Pz)$;N+9rRFrmClz>Bdtk+ zKgCmdBKSEDt?@+R;Y!bgPL#PHmc|foa?p`)Rz2qaebV)$R~h9$HbJbr!^(k5NK#T< za^vviN+#LJ%?VA8oqI~hFfrMnDv+MeGYL6&dqju2bJ1SvrjI?d*K^9KxoY%~UyzJb|UQ-vSc_E%z#z$Xvve zMQTI%AMp_dY(MSkH+RSwk$IyY|0g7Jr=^!%$;{hV(z^YL>GI&xduAmfxn7QEPeNF1 zU@qn67O=v#n0`Pz;{iNU5Gp5~tZ-q{(W}3w#~+GX?_VY9A|N1mCz;>6zXkCO z#M}Tq?(5Y2Ovke>GjJ$KV+M5lsM7qX(t>ZMMon3_ z#u_Vfee}#JsuK*f6&KjE8g>pony)F8Gg@8#Tx7P0sS?(uTtXg@G(kmGr=9nab^+yT z=;#-D&2KDPE(@w)XLv-+^}zU`4s}LJie~M3)xY|{J2ERr@w7z4&QZwd>2Lxw5scR5 zy!iNnuFXGZ<2MC2h?5VBhB3?HG#@uEIyEVNF2d6%@Q2a6vtNB%^*@c6I>h4dephfr={k^OI5q z8YP>>#0kYiP|i??zLg8UzE8E+5Wc?UU4#Ku+|(`k4##Ua8sIFV)eQ3b+n-noD5j2P zQ0jY-I-8!UBafcMrfc-5P@QbMoR$JjD1>J;aRPy|xTI>`0LmI(o!j(Sbxd1fS8QjL z<``BGF@HUK&Y1H1_chR>#spZ3ps1(@ zv>}UsprtIKp+6;Pdqxg1P|&?l8q;;pTZ}K7P>j~@>l{gVhD72GnMgMHoXl<!0zD)^`s!FU^|^w&GSFTE_4Gyb5dU&0lwk;yA0>Oy`6V!L|k;Lg!`) z$ytO1iJ$A}E`Yu2;5FJo1w~5)Lu&8dHRmt3>*a;LTmLVla(6-Z?xQY^+k$Gdy{uAa z-K|r8f0&JyUj$CmoV`iTZD@{c)U{rwyuFu;PSUQ(_Bdde?n4nZy=-7f=r1ni(CVT> z(XGf+NxVFYljEMBOB<}Qe|$5S+a(wJRM`~8qMw_&XR~m(NzW_6TYIdEjh^%Lbl_*J z5t5GH?BuU+Y|MosMUYG6m6eq(T`p0e88NW@-5Q~k8EU@Vhwx(nFwYH{HZdmIoxtg} zc9agSj{=_JDVFtDZ$;5-24hvfZPXIoz~~{cQkzpM2uV|4b5{?{TPB5+46blPqzwrL z*E`);gps1r{Y31Uv!~)0r)wVh5*8G1c~7>4(~~r_6W>PRc4KVqrZpI02I}4}4JW23 z7{-9;(H_BAm~2qx(+i&9u-a zH7#^Gc&3yiC+BnJ-kg15t@oB~{yaE@3Geq!XxUjp&gmJVl~1}`PfK;J7h;LYmZk=W z9}UK0CVi@YL2c^B_{3~}DPGfo38s2fD76kt8f zOh9ljFCgIP=puq{b#*^y-q_gKL=LYHWIG>j&(lNPYsdKjU_iN~%;Jv8t-3_*a`ihO z&MZ958+B!wA9=7f{xs8J)AR|gw40q=jgzwoEfig%VUbQ|lYsRUou?68xa$yHu1T;E zi&tyTo!>$n_*{vrG{~TY13*e| zy`^>yyf6Ck_ODJ_zsA}O#nK`uWsu{T-#&Z_1c7JA z>*O>vzEHtHXEGy@Q8eW#x;i|+ZC>O%zP@e}%dnwDOl^8exkY!8Vp1i~ZiqZ>v@p!j z=R{1{Imb4=wex>~EZGv_P9Ll?Mj ze|A39sik_9FUKF>$29r<8K6Q3ZAS95Ea@hG@Q5j z-fH-j*VaCKo-z*{To$qD<*#(`G21QqwPjyE`trqNzCtEt*K9wNjX{ zHqq(zHn|E0_V7s8JJ{=}fbXHO__6j43=C|(edEsAK5JsUw;~&3zbE^hg5nq$qc(u^ z%Nsy)I(m9R5s|AAKh;>E5;h5|Y?5zZo5rZKGM$i@E$-<}*ka-H3DBJM*u6UQ4RtG}B zy;+6u8j;#5K_MY8vky*yx;~s2*W~GTnQi_uEH3c+3n-6yG^c;p%12yzGJ4rTS-j^K zJwo*!=~ofe0tYLVq2=B6Ce|ug&j`@66wfDz*#iGyAc=n2qLe6Mb#@u zC#yGh>Pxp`?hnw&VU~TFQGZz;$}jH?p;kN%Ul;j;j6Cg@)#&|S1NZC{;#M9#nN2G1 zih&}8mjog`j|VRGW5unq2jb;FXJiZ+7?6RtafgsIB*dkFU}nlDpJe3UkmZiY(Uo-& zPOXL<;f57E`)mh?oq9mZDZW#*tsK`6x15Y zG`)We)j}%ZTWRHsgx=R_*tlF`H#-hrQg`d`OXogfswA zz4c~2Zl~5uM7Y^_y20F*jgXL#t+!G?IU|E6#kC3Tu~mGc3Pv0~Uq|s|sjZNrqN0Q( z_Fgbvboz62>y=%b(jChY>@Rq{Ldv3&lF$HB@)Gm4*bNC5A@7=75-f!)j)s&D!Bz5e zKRjE%Nk{82RGI;2p~UX+-?KTRML=L*jrson72DPE4i)GVvRSTO`3Nd9JInpIKSMWP zR9Dw~9BMhU*T<>p>8nQ3ubh}7D$II%dv}kF239w1%73L0VAIOkrhVbBWRLZCtc|Mk z;U;xl=YLuM^i^BDub?+88SRn`popLr=3z$9s(#-2o)1lsoP;xGU?6OQw|HS)tT;PE zp@E>ZYcplx1+{YR+h&*E#%I3lQfX9GgC5*k=!0nr(O%i}4q;BVUhbrWttNjTMcBoj5EsD{9Y zOh@HP=YAm$P4zK(<396(!}EiK&~72QCstUPm~qbvRu@Z8)ev*%zR)4%m~v>j@>|oG z$1ei7ltG<%vEbBv&MUrgnuL>+Go?Z;Bskby=U2s;2`%>}i$Z>ln)%=)>v?5!DuUp; z=%8zWK)f>hKf?!}X+oq?lPPY7hQ8NKMw?c(3S*opTNaL72+(}En28Z?HK$Cq)F1_$FR2IbPgr~cmbfr2ahuyTLzt%a6nvJ#HsNe! z_nJL}UPO#Io`Y=Kn zVr!ys1l2T24h#ILXn)S?wo7AaLRFV?vuCgi^JNip9Dl=R4HsEg9VA`IGfoRWYEVBb z=_uO8!PUtx;IvPN1$r5ze(acw8i?2a=)Inl-kOGAzJ^KY)xgsEg%&D#jfR3D9O0^x zbeDlpd|GoW6x_a=jw?ANnumuo21bK)Ir_~_mND|*2PpE2n{+}Z&E?Xo>!?5XeQVyr z;pWv9Y5tu*AY;u*=u_U|s#4HVd@s|fSxVpwi2Y60B|d!$r^pVTk48>TE^TvJ#l^r~ ze0$_s$5VoO@nhUR^Xi`eOln^guY7%mT<#OI;;E{&l{(ZB>VEn__0GcVI8?9tJ2`dg zx?_yE7PbQTFZjG%3iv!2)!oQ`VY?CWlSgD>!G9n04UgwztG{co2n|L^tlv_z+80f_nJ>t*&s&&3YFe~#kt$t6*OwY) zB&vBOpr1Kx&sn`}F^vJ-WIqg3?-VUQT;Rr-`dRxkh7j}UFQwJ!%^x?E(iu+_ zil}2hw4n#2aqOS_2b-_9B@gE;71aJLQT%a3tvsA+`;aQTt;`#{8GS%uUaHHrmF9nj zu`~5C;4+A-O2fr!|G|XKf5sdqOT))EN)LHQCLJF~9iMi6gji@v8!# z8S6ut`eBpbbML5iwenYkkFV`z>WlB&W?&Y!Qp-y%>X^?{8p}(bm1t)^Wy({L_F`Nq z>i8lltQKiLkp2bqnA3G-_4S98G+(H^#G{p^k`X?#NOijy_VpY^~>Ysf) za@UBBdp^H+v8}x+wcAB%;F*B}&G*)TKt<}gkzUn>tYkT1;HmLun30X94s5(>kVF*O z?b{k57E@i5gWa6{`)TV`l()CH022uh#6by>9dGmM1vu9)juZev5+d)s0pp|S4ZPo^ zqhIfUon9LAgY?v+(JL1tW_-il!|d|K6Y&^!e(G`4pdhl)3^ONUeiPHB`qC`UxA)^? zHHN~={9(^Ng_6F^PU$6#oHazpm2K!&8sIZ)@mzf5VdTEM;5fAJ2RafO~ z1*cwX*_kl8vavlf)W1tE zF7{Ad=&lZ_>zfUL{eb zTc#zDTjRX|U@pG7kCER{Le`3Vvp0<{OS4|HYZP2#kFR4TadWy;X^aWccH z+n|1M&R2LQ<2MG89Ls%G3>Gp<-PL)5g@T|$y3n#0smm=aGOYQk|J~vwHX&%8AaxD; z?t`75WQ!waaqN$|@paK+IS@WF|7q<(Tj?Heh&a=QrG!%4oZR z@5!?BN+Tpw>2=5tXQD-6D*1A!G*R+T=4$COf};HBJYHjYpaIg7=j((l(2M2z^-lTo zy=-Onik#Uul9HQ;rxLw=^j06`u0%XR{(kpVG&cQ*atab6sHnWudO08Kb#^B4?Amr~ z3)ABF2Cw(ieBxzR`Eq8Y4JtWQlj9GLEDacc78K`Oqxqht3pw-wmKmOp)Cp|BP zWGO?HvsMkX-7C-(`VOWL+$zAc}nWn zrp@bAZZ4peda}RK!Oaq8hRe(>qHrx}e%yP||0cstrNo~U*Wifcdoid+avb9(6GP9k z6j(~#4v7#>qp=(Clv5@hg~xwG;sO0qj&HluJ|t>u?IeG>o{|!mGO>NAt)-VRv;3CK zkB}h1^}<5)l%Dbn;nO~j{(4{qinSofoxt_PMy}cPw!|ya`DkSH;+%GZ{yvmMCErDU{R6g?V2@J&<|P} z$iD2uSL?$x_8W47wvYKhhHM)2glcC^Hc!_bV^cFqQd;eyyfo+kVCf)N$3w-}+uMtj zN<*Rra?NdVyk1W2ywCXHs;VG_f@F@7*w@OJ{~6yGi~hd8z^JGe%ZhCxz+b0uLt2)R@wBPO@1T@#Ibw7g8sjT&xlcXp6|h4cDKP&2D5SHa za0HUz4;)Wu!HtEXsyH59r?WfQAodV1+Ky+DltlU`Ky?gtA|*9rs)5juC%)6n)_drf zP{*rw@*yx**{&74L7}1r@~Ox&r0eQf_;8tP7hOp*c|RpT=30JSj@0SaZwg6;G3ZrJ zuwjQpkmT;PAD2{rCL*+wa&+pj3&P)0LPA24vF%9}J6%F4-HWhD&(;H( zJo{I?ye>xoLqgSl3JmZP2qq*0j13nv@6S+NDluP%O1Iw2*D-!M9@IXlSxd^xlTfU5 zC_nm5>i3H?Rt#P^3Oqwcn~e`F2V6sF82J(t6PMN<&yS^=N%7;E#;mxhpFPvbFDq3| zNJ+6dIWW#IDw45ZE1s`0P*zgP-~=j*l(?rU!>dxUc3Xn^KYsk+S22U)V<3u=7|r_R zTw*w0k#+pLyx|4mtvWGBssr7tg%#xnI8nyE2mrgLW>!R;9`9f77#MKxUq)Y>2CY9>@bs|PCUW))4E;otNa^XZ z5SjUF=mdxkBnsT%1mXC>H590K{0^iOFjNwfyyD*`I3*;J+|3B+c;jM4d|z`Hmw$vG zzlKA@hXOGF4bFarZ9F1&D}Sg^gYqH)sDvct_niSel>;*#_42jv{ma}9IoIXt7ocEB z!G5lRTMNgyo&ryVog^m zRX*n4ptaPK4A2lJAz?H8?Tyk0X$3uROiWCtUELvuNx1ZJS4YlWl%`Md*&VgQ`Mh6aLBs3}F+uqn4Ym~=w~z%T}-ZHFzT ztgTs~Pv84K3+88N8i6v3>n}xKj%F%Db#e*aV$0AJWgx0Q@MT=A^Sm4E=#ty2q) z#!JFmG={wiln82}61G`{Y4od9s*ja7qru4U=Z=R$NSjB!$_<*z0lXU|Jf_s+UbVZC zD4@zXZoJe(@%^+yUEaRzR_9=QD)hL(dEjc{H!OahNMAxgx=>u9zKxg9e-zSHsOJaU zr>_@pP>(UjW{Cp$H7k)ivxi&roggpN2s)UMkoA7R#aYCTNy`edL|~r)L3^SWz2+Wp z;mQ={HQg_Z`@ngAVhVk52WysvrW(tK^I;0~YFoMqAY2Ty*(l!MZmX94KvT zOfMWGD7({T^59D&s4zS@+i-i;9a^ebYGFKXzn?!e4^o?u>A40ucckCehmgr+y?o!I zL`2c2^E2w@gTr=5(YJ4J!ttjHMZri_=BmLszM{|FDoBG0!@fXAM=yg+nI15Q8rm<* zbHGeQH2z97%3korbLnR1o1FTK!;zSwU&*^>F&!_Tyo;9AeCZw>ImQF3dluf1PlbbB z11hdS*_6Ot&)fC(gEruo76$!SLPouhP?(iou(*mh3hu zMCdM;7nQdk4;z&Fymr2pKU|2`-?-coRcQ1nRvLElCkX0Ri3`j7yODd|Q5esO$73M3 z7h05eB}FWmuy>0FJ(TePVbUhx&?fzgmia?J3srX}oNvDe+9d#mUqewCXy16sc#qld zk7CTvyWH~oXFhfWuVyZEKzb0Uj*vv!Lb1-cec&0 zPMQ=YAdfS!p!F?}eW939$??=2$t(v;E8#1Q*~O-$Tw8DP^YKB)n4U2yW(KIao%5I~ zRXVd_etQ!VA7J?ebabA9dIoq0MyvV#CR;O2N*?0S(E=orDBeVDA&?dU-U3n_Qmqsf z=*t4aJvzu~LKuls!f~-rkSa-huNZf6=2q2vMecX-oU#r_djmYhnc>S8j35jx^z&VV zY@P4KmO$fz^KH(DfX}NXIBPNcA%;~>jsP@3?)u$Dq}!3QNemH7TCf%FAwxFLG5QTJ zfe^wK4-b#kJ?h%sP1fl*T$vEp!s32)P@!%MZix5Y9pUjDSPXyf3om3}D9(4nN<^sa zIb)w!PTg|h=@Sv$>|#%f}!5DVh3sIsqMpoQcJ_EKg&?=UhO5#buxKdHe2N? zXz5m|WP?je1;XR~YkR8zt0F2$aA|t`qaFWwGSR5tP}}wSCrg?u2GLvaH#uYdz~Mj< z=|u;U2$?Jq*hI(<0pk7-N=n3KlotDIqt#w&97KrZ%ESwE7&f3Ke*wLb?)86tPfJ77 zI@&s^$5pOc%JAXn z;Zc=a1yNFQ}njE_@Y6zJHpz)>l%|`ZRzGk!AV5@H?b>H~9F8}7> zOh~NZuaZhbd>X#hfC}}-1j9kvMR|)fYs7rwN7-7ASJ*>l5h{@gv+;U+dZ5D=^`#{0 z19q#8xZ@C9tazxCBX&I5oX`}2)HZ-FNMo0x?>~FV?gF(pR)X_cvU+~IyJJA0sXthl znCWHUD%RZsP#1*0LT6kZBxMZJz9>k(7@W6p$VaFR6CAKv5ZksU*B)vxrn7}7a%E<|Yg9ZsjxZ-HHV4*6NM*#Q_ zsdeC4K3U-BQu*yqa@VU97)=H$?AgF!h7UBE4VKPPYYKF)UvNC%cZ39pP*%!~2_%P2 zO-=m>xeoi*Z&IMPy|TW;6fTT3b;30eh3(_@O277bQfN*>A`i&6J~VOEMWQ-HKM(S( zV7wzh-Z3aDYGf9ikN*=`{-q!keD-ZY`yzwk6J?3}t9*aT=#=a;h_A#ThWjol-`AB) z>+zg&P9@utE$iLcP~{v*ikg_34s#%Gs958#(&LcTdV!-5kpx2udm(qb@tmwIe-7I{ z;E7roujGO`y-8ME%7*wgbF|MuH+r|HI>O47p<2O27cnUj@*+O;Ye|> zg5{_=7|eoZT2Hbru?t)WN|Se!BF2AH`~#NI1m2Q<^!{%E(_M?~Ki;ai6XL4=8~*-- zFhHjI4d&l?(Et7g!PhS^*8lxalB2)=0XhFSnC5vv^7jY-?|*(>ApI9X{r7{AKO>`p?~Hctt~-}j@?1%n(8l{cW1DxMJe z=%07uQqgpw16)*5Wl#vt$$p;P8L)kuHd7axHPgDH;nzS=j8Ch=Q@C=w3d%w(*A!5o z5#z0iiAmw=-{tx{iV#skI3DffbV-2*7h*^S(^iI)tNvWvG{xl>Y>^@3y$a+a<0iy%kd}F)agvh|H4D= zILL=BnbfHp7Z@9n*RMIx0*X@#8RolYp-D1yA=A(7Sfyx9`1`Zf&Yin4MCNP{Y zpn%6=H&xjf!be1f2vRR^goTB(s9_l+%GbB7?U_c5E+h4PAh05!*&JpUda;(JwJlK234#ttTsNvX;1@R zmM>rYkCKuI@>sh-U^Dsv^wr?uL5-bFRvh=mnlq~e$7*W-xES=34`I2y1|J@QRBm&f zynq88Wp!`z(rF`XSAWoGmp3f0hg`30v5ER`V{kAK&9BA&%m;|-E<`-Htt%klg8ca9 zjiuB~r0;R9d|zpAZM0eW{0R7YP37~;hwM%6N&iRJUfL5Ji`E!Lm=f%$mAP)wv!YlOorkBkDd!j z`?a!dQH=Y{Rq!T!E(i9?quxyLK&p#Q&-N>mU=W@Nh2-g+Lj~o*Zl+@^ylV5%4rwxm zr(zgb|7UZ%YdtcBWW-S!D1;hAolH({E~Ely59ebwL9ZSK31L9__DA>Pg;+f`^(>gu z#z~{EE7Rb?&H#vmNDhO;<-*Yi1!Z9jx;RYZcJwfXKQb~hYWLC=OG98aK@Fod)DRvH zwmURH3<#0by?ggI01~k{IMQPzgl3nYP*%dA+xJyM`fCuNG$xxmO@U8lW@ey51cZN3 zQ>D`5;6PwoFT+ZgYDR(y=##op1tHhrLcCwmQc7yk{+KNSsU7rJp7l=BURaL0dfWX` z%i_%jLU0QnA~g+2SM)14`=ZZ)T%8^DSJHtm1dXVJI_ISptCzkjS2~P1o}U79c_iCf zku&V!`=3DzD=y_3#61|kGW1X}j{@^Jq7gZ~%mwHLL=DiY zXo4GvM#OrrbhK?KUl)}bdS;P_hlPgJYM9O=Q+_9B6$$0Qzd3BPtf*DA9Ic19gF?aD zjG^#9rqw1?;$mKb2G0TR3I_G-`1(9F(vm{(LoBUmj{U%H0~OAC<+H6&s1ooyIIvQ( zp2Z%s+ZK^Zm%|=u1b1>U>(gb>3;X0puTu9HnQ++W_IXu+CDY^!eIp_W&W6mmt^DT1V_%uyJV zTcGILn~7s<;+Ns&`w{u{wyUR+r^C9`6>vo78c*|8?3b_8g1pbx_V!`3@>vbksWt-U z7>!ft=jS(%RN=s>Fk|R=Oo#+sU|q@?=v!fibt0C?64NEpJtkJwA#3rLg8_f&5Vf$Nbm>J7YtwhkgT ziy1M;qYt&mQqt17c84b5^dUhM1TLg_Xj?ECfmd(gywGgBkJPX*^n3yy2cXT${v;83 zq_%VGc^OL8lTd}4%eUF95L<=Jd$uZnZGp1g=2etvR`W;n^g*<$4J(_~V(^%PIznVt zPx5WyQ}v1_B^+4HT9NJjsS7?imeGKiKk%2+4gwcuw zFDn*6YwgS%V-RRuGMe%r&w{{Fm0DCTn!Fciqa#8k89+aBN4dOyLSO-;Q zcfmJCMJ!o)^Rj$_-lW&_iV48mW*|maJ3BdqMy3bu==cW+H!nccE8VsNfsYrfdK&Yz zwY6VSCCe!)mcuNJNrRch2`YV6>)!(A9ud%k4T3~bXJ9pRL7EZRu)ip(wjEtD0E3^a zzDD7Y=GTl!CWC#p7|a0A@sn9Zrv0jJ>Eqz(>1o1(Re&IBxqYCjm32d1Sbkks`Iuls zy+uKJ-VqFSDHRulnaqIWTQ2(8b&D_|p`5B8$F(}*??}h-;NT$j3HB2h*W}f(iQt|! zs9oG_B9Ard5+r9p>$ccxBJWNV!hL9AI`_kkSSPFyZGc*E&`Q=6U;-pe-P|mVVZ8jM zN@*Dv7q_svM5K8jvSFFYzVfKff|vJdl|gL}!`h&{y!`NnDZJdp#bv~#nc5C4f}xc? zVD%8lnf{?j+Sut9+lCeE4BiB>)dZ?khC)*WgYLp`;krYwGEDk$5;&tD#5jWC1rI|c zeEj^zbKKvuSFjmg?<<)0DuCp*8OYVfJ1W-W{g^rFc zg4$GUQ`KI96Dq2Z-MadI9n4q|KxZh(3;^h}?TS|jEhwLc!90WJ%8hHz2;x>1dSk<8 z*VyvIZmqE4XbHAE$Gt$y1P*0HWL;Texl3sf$5{ zQ0)cu#lbyTLERQ=5diQklV7p$pyc@$4%I~E`Eh0Ogwrh`^_hU}It5IliZL%P#QI%54}d$E?X=o2q~} zWVY1f0r%pECCdDTgxfU>D&i5dCCV~;4~#l5^L>q-h0fNHL*?^bW$FgM@$<8NYry|y zD(qOG0WivH3bIMxHsCRl_KKtZbuoaypky9#Y}M4&#R02i=vSx(@1UI`DXIoe{DV$E z2OemfN5<8|&kxi$0*>=45iheZO}1>K<`!~Cz?kOxDP?)oW;s2|tV_^rbtqVj>+~BW zW<{ANzn(fUe}Jh9#JFCWETFTG+$&A#3LSzV!e%_IzU|Oq z_LI%-Qhi~?Zu+T>AJ{OY=?4K<0jWhgM!JNatB({JyMZSBAQBWK3vA4Ko(RDtX(8zZ ztl}PueaOsw_$iFYQlp&2o^LxMYOd8E{WW8(UAfLS{a|+lK}F+!<+(jd8}l?8!b1)y zCPL~4;cBEoNpd|gAz~6aU>~z@)?xL)LW85yplp-xb9sZ&@ie$g^RRKJ0LuYeYywUY zz426?tF@-%rkAqO$!24&S`#L+m)FP2krqs2rJ?eAKiE9X$k+3-jY|OnU-R-_@_FN- z*4f+_1MzHV)ZIW^lTFq64(%`JGg@=wvoK7@|I3mGKnG!F<5Z-S#QM~rk2%&1`3B#!$^ znn&L`rVpP7-;bX^Lw>hK>x~?V(b*=fYTF9x(ChYRsDtAYWwVrA+Tuqk=+<01$G7*3X2(`Nb$|%V2eN6OXT1_x8!MR(3 zz4rjMXM(sO7#77p|A<}-Zy@{m?|<*vChwO84yA(ww2h2}z9KqeKqWz#DJMPkA@VAn z>nqii|9QLM>em}e|NTve{Qq9PnXUVnIm-9tb7Y8G2(u! zTPxT#QcA3<=j)rA6n$5Y-#7Th%}6gqDSOnMt+1^&`C5X9KVF~mr_u3D@QR6hNV>X) z14h3B!xus_QH{NlKR5+rHM(MRrqlV;MRRlP4y8pi&C_P1FEfhNp5iLVoEu)Ll)+(1 zIPNNtt6a^Dco{-C|80HvPh#fAu*Wo>#pFAhA~hBsrX>2~F* z&tz&^)aB(e9jJdjJ)qnlXZQ7be*e$aQ19sm!CO|DXLS-Ud?*R(*Kif+eC3nU)Cf`T z;*8RMlgDN9`60FCC1et&Sa58s9~0D?b&~I9<|sAmH`jMaUGK*FRPsqnTf3%(xDaL9 z%$gAY3Z|+uXL5LZsTpda5~~xT1_Nt_kn|Q0@}O*A2-m`D;^N|27(-#%B&dF{lb8M| z=J_nO$=aSxw^>D5z&7b?*hnVn;^gTsi~6@Q;~l{*9YR#kN}QIv<+GiBWSS0-P2OTc&NZ_{1-pO*V7$9Ng3)Ebsvs9yg`T-A5{YeL(g+?qst+Vo)k zWbG^EO<6{JI<6+44Y%ab?yKL2WzG&-uGn0XOr*44@wHnMjIEBZt+l04;16o0jL{g{ z8KfGzGnErSohDJ>((2)Cb>ecr%^*9$WKJaFwYZ9Vf`B4sp$_%FSd{RfWbp_SXK;!+ zeG#Q59YwCmqH5MtWMA|9kQQ7w6jx`MZ=;@Vua6a%kQIU79BIzHP3J@2OURbD&q|b4 z_{ZHM-&hXFva%Lboa`>rm{F5rNRwDmU0r zD%eR9=ib^o*Isri{%|n5^!EE#@{H)JQ8Cde*MRuqgD$-_<$@UA!$Ae(MJ-pw$o4Wm zF;hb&Mi)YU-w7unKGXU-?Xo^$G1Po9!SMLv=Z1Gm6Q19i+q6@=V>yTRUGpv7;^o}K z-6z2`zRpnVGt!4ef5b&E`wmtm!FYkp2t zT_5T@+d!c^oRFkAICpampUo>@h$|s2&nc(tW*^O|zimTXoZdES&o9AY!y!V;|Bt+{ zV2ZP8+QotfCrAkH9z1x0OK^90cUj!s-8HzoI|O%kx5eGhCeQQ9`wLFhIaSnF0r!qv z-P6-Oece6RWfm35Z5?N0_mg*FNjCTOdHU_l>o z#a7w5ood~p&NXF!1GS}e7RdyfH>crV^rUoqAB#&&;O^gTXtA`v#p^2XG1lf#IFprT zj_!m?1le5{>@?X<(`ZNfPi}X7!O5zPr2A_iQfe4No6aNbT~7$SegVUXhdU^@%e`Jw zp4Y!6f&O);)sSHTQ+H=||oW@Y@ zQLU~!?>p}=_9H4?&VqZRn|9amEi%kczz!ijHEmCpUs%=*>YWRy?sv*F=FjM*oxlKf z#VYSsuWyNA3^?8WB=!%dp;y8qZ^I17+c7jCYYZU*#~~PtlN>iemjX~JxFH#il_oJn zF11kSPQeM^X+Xf`Aw+?jI%wfO`!bhyQ>WmDgg+*<#jk|XsI>NX2NUrnVe96y72?Pe zG;;>L#);CQD+70Ae#O^1cyeGNo=ZM$=J;bV?DBZunWI*!Y0Ab*x<#mU zmEyfGJL&hZ$GSRR{nA3K)zzYeKXrV16sIypmt?G+KIl6nP@Mb@FXT8ve4Du6JK_qA`QX^wfLDaJPLB(^62tgOjDGeXrTcUXfxsmNBeAFbl># z+=;x>lShGVRBcKhR`w6BtZZhqnmh!@%{l*RI#jl^7WoM2B+b4bahJ$9Z; z?p_~DI{{unpAVqlRsrCEmUXf_J<-l#27*-sgb~c787~(GG%DS@{3X&g?uaC<^g)8b zAk~I86zKg+i?c>iob*8nhFv>ZVnB!o2}YS8+>CL}W(piBPs(6#f1azunMG!MBUdSY z%F<|W)`@C$1x*s76=$fFb43&2F|(H7Ry_HB?Tvn zQuWgFz(1Z?F(O_y+U-QMXCR+4z%caSEQqyvyY?V(EOkq zEh!YVq&{4%zXW_`N}IybB}}Ouj3O!BR8(5IJv*G+(SsIFyjV=U>dC^jSx{-V#JMI(a9H$c=E?X+fm+SfR1yEDi5IlSfbiEi~{nR{05 zw74j6{1$niiM0H24ynLbF-=XQp?VVx-_#_bfq+>5L4{r%;fJ0wJ??r~&33F2+Fo&Z zGD|>~ar;F23!J;P0b8TAYd~)MZAG!l&~<6+bzTVMVJvKjso%qGTpZ2g;talzh}AXvNJb@me_(l4;(usk3brJRa>}~lI)qTFZeAL%C*QpPC4!n zV|ZOqc+h>~wQi0Qf9`K;Rl7WuS;uI}N~zA6TPu=%iup?QeAAy}6<3q+Vx>f6jBL>n z2?NY1 z#up#%OL9r8h^MC~GB?mhqcX5Jq+a{%B__oYfziPB4jtp{>JpiiX#HPYfL%g-X#SkY z{CnIH>pNYos@g%&yU@ohXU$IVhE(m?+`K{R(DR74xbWw9r1#y9ghkd$uiM~v9}FKzC_`01mP zy%gwTNBxF7A~S^!G-BVMHsMyMtIp&SO+vDc5g$nzel;Fhi39y)ScflbM zyFA`8a0xPQj+`fYPf61HLPwuIYFwffybi>qz)mJqKQ6^fX7qGQF;K)adfTGc;>1)x z2RKSsTf?_%B{`QX1HD@N4?=Wf`4i$3y79A+=rV_ppT?ljU<2fjn3F3+JZEW$nNp_Q)Y3mS=styWU0?J0tg!Ye3xiwhggRWBVu&qgHf;#CZj8vv#}= zj`$rA>Im{d`oy@iI8vsbtCWL4XPHbm?9$tvgZT}*bPg(t3GzyFX)C|RcMlvHKJlbT ziW|*rd6HPrAll2WV+ilgwbxm}D?2=Mt_4?>n;_&n7Rav&i)|SME1=~Z)j|#3;KYr1 zMHHWW;AV^pY8~6(fWcqKmBjIo+A23BU~2`|Wj-edt_rL~)xR*Tc;=T)xn>76WOY;~ zFsP5TIqK4XUd$jRWGvtk7>LrjtGAZ>Zt*r{w854BQ?6eE8tIPpm(&QPmXQ7ds z@?Dixn*-p|j?|qkqpF%+5X6kh1eVawvT6c|I1+rD}j>lH^P-< zw?;a{;+fib;Bq+MzKzzv7|TSn#`A`N72gn~kJcPbTxxxgQS1RyB-N#FuEkkt=Z&-k z&{9Wy7b2=PZkJP*A`3gi9z3yttPz3#wOY)ibkdEF}=?fAsOR)2s+sc%UrKc-}c`pK^vbSRRwTVc;f~!2aoG5`wgs`oIaP9fMDWw;&pGO zReD#Hw`;x}x&^Ezk?j55)4YxzVF&v&npRFgpT9eA+zklC7q4$CJd^jQo8waCS4~{@ zOA=PS6p^Gc1ievm@);O@IV;DU@GpuoW_id-Fa(aS7n9e?>GULl*@oA>}Ev~x1 z-qqSSJ;24UpdD4N5(ISR_}T{UMEs+SFWWJ1L-|4XTBrB>4Ee+~jYBh+LpRM|Q>d;N z^i2p$<-YKqyY^Pu_UX<#oS={k zZ;V!dcjVJS!!lp&SJRG-7%h?{L{DcBaWsEiih6883JEWL92=8&A+)ANj^~$a>BMl?{&>Ev|kQ zQ;cTgP6~n^Xo=N`j~glBvcqvQ4JIWfMI7B?AG--WVse4V)6VKcrXMQwHDC%lu+x6; z&3cqLitVd3iu@A=Tu%Y2Ih>_WmO>aCz0%_8VfgS}3%8b5uiSXq5i`Z)_P-9?o{X<_ zWiG$9cvQT6Jp)w5K2scAwYQz3oc$E;MCFcWr)5ju#$SKVUF8<1klcsqy)J@vG~9e> zYtemovtQY@<&Mtkt$MK&JsE2PThQFz3B=xw?F0L3oSLA;dvE+RsNYSgA_Q>P7qdgF z7r#XW`3qw>Txj28xGb{tj{C|i@W-+SdgbjOwceayvxKv{Ik-LTH!zKVQl)v}Zlu2N zo#!B&>kj!rHd#(5E!_3hb%ZywN1;-IK{nAnE1rGk^9>Rsx8EhKk(*yo%w}(t{5-Pu zxb$&2Dtg`;LLY{_7Wn-gf7x0ntkC9tJ8bCCi}k42zS+_dpB*tvj8Xv(HZ$&#CdmJq7UNbYEuuk!{-HInIq?@-2ho<;^NlH=N~x(s z{CmdeouiWuvf&OksbPf>J`5tfym~<At)R5#*P_rW%Ug@g$}e4pb}vY{_#S34^Bk}Y-ef=gx9!+P@VpKO>CNR2+CR> z6byNsvj{gj^8ESZ={|5Zr7d-3zCQZzGiF>!Q-8OgKfVm<|EI_5PGT3(5a5LHf+wD! zFkm{9B_b=l(4mQiciy*~5Z@UjAW=PyKLS2vS@C0sM~T2+PX(n>>P4m~$AlyYxXfwMJR%)6B%^*Z;{<|l5fkg9 zjfP&Z6a}6%AvPh(N0g6eyp741@oFoXkvuytVzIOHcbF6+c!ePFis$;+J%~O>{K-ur zKnD*D%BrhN1nq3Y_6tZ_TGC>dW~o>3e!Ujs77G%afeIzXW4gW1g78rpMGwyK+xGo| zw(SQ6`2$opMUPQl^XKfte!}JK+w~Xi1F$HbC@!(`A^VzqOgzDVCSR@Y%Z_RD0TwE^ zPbkkH4ebwcmA)g;#Ilb5YZyP_X51g?7hx53+6rk(59xS6G<^egvF!`)+pV)!L%xD7 zeMESAUVUIo0m^q4LWabFWIfC2Byqw23h4sAy}bqWu> zQl+}Ec}F=|mQm}^u+YKg*j5#fX-XhXa(VUwx~~3R&|TXGpe2ddW`y2$u}4V*%3^*e z6t^T~+l8MRus6ak06mnanWwvVte5lD+?P9bh;OZiBYm{_W%1wPL_tRV8IFUE+Ruxg zifer+KS$~H51krklUATfnP8b^&pIgpuq?@>}Hnz1}3WyZ?nc_Ae;FY%-6_vY4CC;X{Wr~?u!T_{l zKsxJV&e*N~jz{-7;_S{ozDRp*c3j95n}-q%9HN!GAK&t(z@U-N5|^_CPi3V_^YCz= zRlu?zB+&WY+n;jgTo>1&prIg1)xxbm>Ck?Tkds#*88rOl{?;#LW`<`cCQ{g>%I_6Ja~+^H@rZ9xlM&Uv83p9WQS{-eQ_g?}1cw*ob|m2lkImSC|iHHhBXQ(TM} z5`}<&2QMBZ;3!FFm<7zvci_^TiG_nMekSJ6)BO!<^bS~Vxk&FodzG5gu+5<=XMW{I zUR-}V;wl6}tXv;tBVNaHOfZHU&a>t1lBFmdO~P8lf+XEFzTWwp5`JHz;5wXT{7G1K zf`zgY7%2oW{{vjue**Vx_Xjw+lf}K5l|`&Z%KG~1_wxsC{=xj6l@hCI-G$4(%Br2~ z63yiwJ6;Wlc%`Z4xS)#npoV7tvmv?+We|3=Zce!J#h#1tsU~!PY!3%8Hj?Pl_J@sy070_zKahC-orL)kSvPL5hZl+3ig0~QB;oDG554RDMYepmTT2q` zI!)2r|LiYff(8Vn8PC|qsV`*W7WfQDDvBUu5wCd=Tx}`Z+K9LkunUss;D0NK`B@wB zADcM^gyO8GIB~C&8m#zEI0@YR0h-eZ2pQ0vPX4oxe_(OA*v5TF1LV@PEsS^YYC2!n zgal=)P3JH>Zjt~r3m+S*ye#zx@1eh#d@5j@+G3~#I%W)5lFY~TI_2c8yfuVDwi}7U zZ0k%6v7Q4)6gidpJS@)-0_K}CUA1B&@nHU)zexkk|4K(6{nr0~G?Bf%(gFdJ+%n(F zJe|&bSpco3rl{#7609?6xjMtsNBrT%7)ViRi#8`XX$=66JR7ii)QX+2+kU~((sQfE zo&L8+$ZsnIG}uDNJ)oxm4*MJYQ~s9=`qLm-iF54kiNte%{2kZ3;!-ibFV_FE2Jndf z5(s9kEOd|Z;WRkjei*eqVD|5E1%t&5pJH@gQ`_S|eo~GcHFWAeD_#`Pr${I`uhlzK zuxg2=*Iyzn_Y=AGGbXw6FCacowD-i(FxDp+<0o0%pl z4c|3v_$tW-I8?0>zvi*P#GfHHap)-nw`im0>}E9kKA%xr>lP=+nAnB_`)Ra_Et#LiPg(K+XnS!8C>t9ZX2z`(V$dxjKQ5w_y z&Ip!)laN#^VaHA`IKj9S&Q;26YMPPL6g?JHV5G}bdwg(4S6KG~7DlDsbGooT0BNsn zsA)>ujH?GzaNagt)@JeMIP6xEYK88ah2y+?aS?Vdr`C*4%tg6&K`n1r)9mHA=X3rC ztv`T4)&5yR)2NmHjSH4hugPrQBTNExWeXW6UVL#U>eS>l3Aw&KYv=_z2GcWfY3D?( z%BbS(7RApTKc~T+(&D2#a21KCiIoi(RzGM${KqQ_BA%DI&2XOH{k|4 zTuRU$v&C~!ME#N$_xF92Z+cI0E;gWM9}mI~-EH>c7+!yvt!Ky3%LH z(>kMr$u)}p>xU)BYbUSvBblM+5LICK1;As z{IZ+Ei+db#5fzsrH*NfQv(UU3qanQT`eT~;ic;N~6}b~KCfAv2;J=tGk-UFdEOk*% zHQ$_3!qPyrsF5@51(S-k*Em;QZMl8=eA+8aWDTxFAyp5K)(s8=!@FP7!U*kQajkL9 z5)E7lR!4Z78F(ngtL=p~|H6v#mkZ<2CqYj4ff7cXFBb!;%-AgIlKXjfF2B)ePLz<& z9A(F9+{nS`!COKMnAPjG+szY)B`4FIFgJ2g?e@rR1eUXFkDZVC*(FxwbvJkU!NnzxV544qxRWd{nT88 zx1pXk7$a6{y!%jy_~|}ov|){rYYW_b$sEZFJg92c;Q_IljpvS)RjXe##YZ;ul(g`v zq@{MAZv58a{t-;ECPIVb2T;Ft&K|-@dAMNeDRF!O3&W`us5vI%2Kef4^e5}CNuj$H zK?ZM2HsZ?DGp(_iiQ-9hiLtFj{5dU94ytekpCT|7%Z(kU&KxT#sdrE3Xk0Bd$uybV zm>u&KND!T;<&a_*K(Aixz+DXbVZJQz$Y?1<|i74QDbsU zn#o|@;zTAvFtne!;LQK<#R@>0Rh^<+wA`~&i8b%|a4MQqx9>(L@y`kw#QaN#I^|F1 zZH{}8Bu#4F_Y%y%B1z<7&M=gmhcD3V%80Z7##by!y_7w2QT@^LN|}~EsAf;T+4OOC z(RUXCJH0-(ztovcjVpzSJxYK4_^7PZJuGNYd%QOXia#a;F^{8ABYDif3`MHqALE;^ zpCP~k>c1YhSRd z@FVBXR78ZcF;=g__8TChC$a8v+ZSHy`Z5Ig-Lad#=qcpH-$b%D-r~*Z8g&Wu^E|Z(~y5*|Z{7_8eWQ*Xr1RXz4DV`f0H&@L?50mC! zdPMyXBbjn>5sK+l1WpHI{3iOj1ikl2dJ-`h9ya5L@l+SHU$0w9u!)jFm}`6$x|0+ zyndS_V0YypO6fW>MqN1P_QjhZ_B7$(I%xY*CwaUW+R*XcVEl=kArLlwHR1a}bKfmc zcr*MwdXh0AqxL;Z?7t~~4t@4WT4GhT=_cJH3h%duxv1IKu6-HP^9h^^#DaYE`F9D% zOB~MuD$;wA#xY-ul+~4g#@-3|hlbiUC@RR!%`1X@z-)_`~2U%^-P0FApHw;M?pRw&qtfuzM2k=44)x*5h|&B?aVnPigaqhRnECE3$D zu0kc1DX4hYw$}qg#6CO{>K7-jYHgC)w_Di~_WJ#|ibA&^@Njt(BsK#9eHm?;slVFO zz@^TlH1?aJq@_U6VWbT@0~n`#SrsbHHQp7rE1$u;kxi)RH$E1sKox}As6}2JAjJ>~{yy09XaUF+x&<0LXEEIGUW;O1p0=D4SGA{`Q2xx;XNP!gLFIhi z6Yl*X66~oV&O(IBNj})Hr1kkk@#pU3$DEf-+*x-U`b%T~kP)ENSZt3lf&kQbYpj1+ z-BU&&UVH5o(1p`5(>FC8vjY zHF}i2#UrS8oBi_Yxw5*t|8`r9&ye)BQ*K;c=)KqN0BsH&4plVR&?b-T^DQsWQCr}y z)s0_LvF9FQF4u7)Sw0#&P&=5b9{193oQ%m>GVe+*1os96g;utkSe{k~#VxVtVgVGF zSK7mM=+ff=rVaw@^_w8#P+!EO@-{!J*~SC<90C5YN2H9p%tzxJZ~0c#?2D1+Am$GB zq}2!%%~y!IQiQbPch|nG#+-^b6c202sj_R>ba%{d|J&KKdCa(wkzlg$yp#F5ch|_3 zn67Mfu|u3?k01H5hj)5r3vEBfg7$(s^`7&3n@Kh9@gSaO@?LMwQ9sW^QvPy#svY|h zXGw9Fq9Dh7jXcZZ@lBA9(s*k2Lp+27?m%)G`JlrbrdAqPoa(jmmD8mX_0e~6HRmT} zg0ZGj=;+MFpD{2slC{JbbZOn^nXUnIAJi$s{6)o1q~-(i9;Y7mheJRFhav8-ub<$> zN&Kf8ufUEptu~_;c!{hC+P9_>!$i8?!zoE@A z*>HLu<8BogTzr=A*RzfE5d?4u=n0bgjyH%>zVqiT@GX5G1N6^!yooq<$Tk69Hx|LZ zZ{Fauqzm)91}&F=FT%Cu>22*?5aWS$f+p^tZBurIbrJ?(616x&))UOW(~!6D@MmAE z_8~rl!}+z~ca)Ic5WfvJqJLg~1!F@(9bHX2?SYy&bpqRKOf=XQUXwZu+SseoG>dW) zLP)OXbYePYbEo9NWw6NsU2X?P2qq@@L!neXXNkSy@7beVuDO0Z@45PU1^3jIq8fZ8HkYl>&}5Z53X=$P>tNJ41(6r1b^I`@Q4- z>vM^;=o5FZw84iqlx@v2j~~>bx5Q~Qpvkv!J_W!Cw~vJ zv8Y&;A1^s+Udi8;W|L{X<=*BjMCE%DH&d$2x$BM94DzzFMvH}W2tNf7=5-uc#l61S zAlApQ_+|i5ou^ZU1t!SRxp`6+t0u{UYUh{J@B$PVT!Z|lj8R8{@M-Y(9g^w@1*l0e zKTlIZb?Fe1F%BtZhgud+BFAJHo^DL)ip?!}ZJ3&cPTR26Bf}*B$SQMne@nWG`^2@FhBIx}CCgSpx#t+j$$YeXkM;L-YKwFa#k@c3* z_@*l5IAgah^-H<1(*8*~mV=iUzl4VJxh%Som)?Ss`LQ&K@g{%ggza!38^4-}d8C1R zA~#fk58>hxZ+tg>*MT!A_CdTVb)sW&ctHAXT>X>e9YqC~!1%W$bZYIL=ILK?T=>#a zGxR%YIeJ>2UWOLDn@_iVngdyU96r{Ws~PeFVlu5E3t?LNdFbH{$T8x%D-wS^uCbOx zv?yH&oCCClS{k1?d079u0%aWzRs?OruiJ9Ic&(`Sr&fI)xWV!0Ybrk_yFZ&n`Ey8f zkm zk&9Ut2t593{4?AInd__67Tu1x5Zv3!zPYG5uYr5GSL|%}jf31*9mM*K39`j&S_pG3 zt1X}KioV;Qfv4v(we2vr#&t4E{M6mo<0NO{R@G0!!y%qcKB;pI@~sk@$NK~Oh)(04 zL0zsJL>0zrWee|ja%Re%KOMW11X^LBR|R{PZhPaignFVTAPArMqH1fik2dH833pcd z3^RnP^gZzAW!5g(<$uCiV}Zio77xn>4oe9M%5tu9gPW7J{6@>*Oh`c7-RyJx6>6#0 z2ERsGgE2efyZT;0DG<^Z{aJ#vi_)dD{F(jTQ^@9q7R%>Ygq-DBbum0a7p}d~z zj7>`=w4*`|{`bm00m~2SyeopLmfRHX1fzEg#3h`)3^_3Y?NRB(L&7D9Uj? z+m@suNw>1&wV?BDPpfPPh|=P`=#ow0?SWipk`_GQB(JO{q%n)uyy#=qDD-ayT-}*G zu$dZ3q+BE^56t5cx7eBY?|0mzz?^wT*2K*ZwIZp7hfnrg-P&)tu*T;jT@ z;{Aq;@ETBA?n3Jfc`vUw5##!4=fuBoZ9BrIzO{QSc)obq5=}jx1Gv<&*Xm2#ac!in z2x>>n_yn=Q*f8f(M-kg?IKqGvlb<#P>nk9$4?lap%|c|puayFU@Hz}?qhzJ@dl1S9 z@3zdZjDi);w zP}SwZ+MAbS&&x_e+o#OLPMhh!JWFylz1WQ;krHv54I|mIl19&os7&^k5i4ntg3Wer zKsmD@`WVCEm4vMr$(*R8xhA=}^vgE#(z7~`o{9SS$TA8(c3-c(47wlxyR}EkWMX2U zcu(8(ZqTU(KdzQ9r#_KcH)c<})$El;Hi4zF^VMtL4V8+C|0A9zg%*tXnD}fN*b|7j zi}uxb3YRzZ_%i#;m(pxSGX{}*B_Hw$!>utp;j@cqbFi8!WGW!U^DHA>fm4R#8-6ZK)pJvGE$skhDIc z%&RqK@r=Ty<(X{FSM@CD2l1|>bM>5z4a5z#NRsr76ib5?VS5}HB=E`cgw~}M9k1Lz zPAhGC>KhPfyX`%{Qb|g~#czs37(g^Xji<{%U^ox#BD!mUlo(tQ`M1geNQZ)%S2(_0 z?91#|=tjb?``n>lp9coM_gN$DM&}@+t$cHh_RwOGNN>jA)ZO^%J!dlXlW%QMAD0~v z#d?v>E@)CR9I1e%C`6D;dj!okZa=_KE4NKe9_QKMEE3cTMpAcc)tjL@!M&gdAJyS% z=TmFVZY|LSNVLnrSoR^RTNvxn4DXs}^AUg!nnY$p``n=4I`1df1U5I1flHi0{eh+` ze#Pf)@ov^th*I@?cE-g%=C#gnX09dWn!oz9thr{<^{T(6Fe@2P>-O?`=nVfnL|GEO zpe`)kv14}UTNad4iwK&+PnAaLbn>)u8 z^G`Mgu|Mr}EFujCwJMc0XuvZwf3-^a1Pe~|54t?=tAEB=Sa zrT*$u>_J7*kQw+6Db7*;5A8|qgCfaEC%Kd0Ja0qVnqOI5t}HYAk7&RQmWafHOBGyX z#yX_4oXM1=sl*5Ep|shH)$kfACy>|xoVZd_T8Q(ktioY?kd>&BAez1GL7gtzsA1kb zEsN;{x3KkEkk-kM;-c=@Mw9@sr*X|`D<`!jSq7~zChj|CRgR(n`tXv)4fIfJu`dK? z%RoxzePOl4l?Ym@;A$^xzW8{(=2^e>MU1&fm(X5Ku)xXGW!*7;S_w@PN&SUl1==4( z-VMyIhE+_Jvx~o2huC1$CzUaBFeU;r==4V*Uk}M4d2W1u5N=>&Gjv016{$c zBs3`+rPI@2fTCTTf*aXlUB?8u3{1jZnWy6GcFoqz8*gXAPiE(vZzr{`TW4I4OKg{##rRTL`ybv(p-!N{4B;;EIFuJ2NY0jB+V z$+M1`e)IzdmSM$*_;2>#CQ>9SQeW6ypEnFzuLWo)v<3>6MqmS>kFIYgcPx$1ZTNEX z0aDTPLy69Bf+Ew1W$~Z9(!-eYFjbktQMjVH-SI9XzFW~ZD{YcOXxXxz2%q5fFp=Oo z_9qmjY5%}Q)VH9YT^^~Tm1Mdh1RD;wh{qx5Uw#Jg1M>LS+e)f!>h+a1ZqHDjrocw4 zaOt!G5!8Ljla4jQz0C#qv!TR0FFX-Y?1KRsy{9H3-AwvKi4x|M+SZ>D>aX_oE;S+x z4ASipf&3?zI#e3I1z%u+B!+g!K5OO9$5L0lMnOXcyaFB#J&O^gbt<6stDO+bR1*a~+a;yTJxS^LNBX zQ#9^Q;`7D>5f=oQDy`Zf?~#Yz9fRgiRImIDLO|nb&{N4G;+>^&-H6lDbn`bfWN?S; z7w7kgz%Ce2L6eHSvUhfOfI14MXC%Svu6#VA)qZBwD>EWuWzF@v8NH|*>;K-=|H>L* z0NE*FAE{cZkCT+B5L+4e?d&9HaAo927M683L1k@X)Tcg4gQEMH=|>0{y#9CtEcxW4 zo{V-d=R1fJi037@q7Wpi1$5(Y9wQ?r9|&0YN7|j>polkSS0YlWJXSF4LPx?e`=&Ux ziR$uTSD3Jl4cT?IQNI)5`<7W?07%KWTEZsx6PxfLO(Z1`$?)U(k>_!Fx=@yxkx^4c zPZoNj^g3VjsMtgqJLzBj+1YcoPJd8!epG)nj2Xl$Ui^52Ze_u*xg{pszas5ojFs3! zyff%esGja7;GgA6*`UVt!SINps+^LQe{MjTQCU17tzno=qY&jB{bR(>f!f;+{k8_hvky;3Uu^y(S=dX zwAA%K04Oa;Q)fY;=%%I!d=H0ME)4`giL=ckkqZ60kXNKjAOjoj^?eJykz)BP=^f+4 z>n1jj^HP9@+!F%6c~Hd$PqzfSR}zg>`18?0!65tOhpsR5C28hQzn3##i0&=x<=@u; z%`LEtfcPI>S}aM#-e1^-9=kSWdR$n%bR3X$aPKT!+yCdnis0G}4%CZZ41TU35_U`d zfTu1gjly~-*5y!(Vy5CZ!V z2VC>Ovu<9~1d=Lpp*3KWSyRQ#Tt*@^{815PC}HkUtt4+< zO@B9lg%x51I-|Pn_xnE<%GV$Ka^_Pz_hbRnD8kYXaa2W||MU!Nk-7Y6aGUWwndB;C zj@dOJP$VHiG%4g#D8_16w?!mXr@)qmwVY_FK;wKPrhYjSn6cbK?PAFVrRHLer6J4J zQW4tuu=pkO_1qZ_=$5>4cD$7s#X!L~Ifg6E+g;o0>m5S>oq=RmK%`{k3r|7)*Z9N{g2hxOF@rO3*qe2PHPdXRg{;q zkN0n(m3&nh=}~KgeC45azT*s}Fec}mf><(ai;~I&(HR+&+s&1wd}tRfl*38?X{AXw zBVv98!b7=z`xd*X!NJFDJO8b8EI=JErANjsP$ zrC_x7w2+Lbl}<<22-@US7UY42%Pgh}(D!LIZugLFq-EyZp}XyhP&fzcfEQGhp`UuCFM-~uRh*XyUC|3c?AooM24#zxpJD7!@-rgN8dxx#( zTN-cZl3h1hM6O4WDl2_hWpA=yS$nZq_^PR%wbfBR(Fas_cx-n+4_t&_hC83RC7-b3 zg6~?F#9ab3PSLyW51#D-xX$-SIz5uUKbO8dtSjqB>NB*bo_pvcGVc&XcLoG?USb2T zEBA9+>AxUYUo-5MsNr%o@(l1e1C8!n76?!xkxHypEWQOBAsFS9S%KV z8VJ14elsMxl5G}4-ye2?Gn8!@@Xq(0`poS}hJZbAZWaswR{vXzX*QPeYR?dIjq`hQ@Pzh(=iDmx@ZUnlW9MV^*8gwL<3Arb=c$3wLmM zE465QBnQGGWpA7KswV2^Pp04if~- z+~qqF)^AmLE){)DB%VRdDwVIK)X%Uy&Aj9~iu-gdCG9XzdIvR#V9cR1CLAFPgD7h9 zTxF`kx5vbUV`i7@^?6yKz$kPB6c}*}4YW;_Q!raQbh&6aVVU9kkD;M3 zGCn5R>96%#04$R$7T9Wb&OXrMY96R`l_PVH=5FwI$8`cS@J>Z=h{JLN=4Rjf>0ZVL zF-a9VrChRd!$QL9Mh$mJOZmVo51F(@Rmi23NS5J{gB!L~PLtcy3jfWqk9nPD@kT$O+ z_vg%a`Pw3Xm2|s|7~DD>1@G0;g&C{L;B0P`V_iTSmI+9Il|j@J^fWZ)BxJcUa<{G} zzS^&$&=4pz_6*vaVqoo`>7(U)29Y@09?Ic^+7iV=TIZWNEy7Y0 zLHEj`aa>~H=*s9Z*zQstbK($VU2o@pDA{l)G$GCXd;LucbDZ929auUPwd%Jz%5Mkx z%yC$1kg0G9ACu{-tXKX!vTo!w^Q;sVy&>yj9OR6WsaVtVN7Yd)!Ar=Rh@8M>V+vb) z1y3eA0h8$Z+=% z5uLccSc=!GwGmkEjF>EVV%*kD=u}#YoFIPJ;x)?|Nj7%tC9OR0C#uUhl~D=ZTV9cg zLds?3m2A2uRWHw)scGJg#8s`k#R8r#cj+TGUgSLitLKo|30k(ScpZAzjtK1dpPQPu zvj}$JXB?e|kKa?z7v3FHDaQAG0a=?9_vES>+GFMKS6>@{aSE=aSum477*3TSsPXCeojo+r&CQHE9G-{Fo-u%UZogw%RtsgV%v zxtx!MP|`t54R(Wh>Sx34Rn7N?R5f-pV%|J*>UfasCgA4iG0eO|%P_f@KV>Pj(B40 zFy$yMnKmNoN7tjfvz!8FFNJ>K;hmR3t=b68Rp^lOGAt*vjzRRjbnsh;vdfUNSVC!d z?5N(=9Lk^v50IxO=+y7EZ*U}Mi|_InF!IgIi0W)qPrU9&3(UHKxffpmsBQ;JKTW|PaNlk5aUqNBg`SD~rfHL5*=);mf*I){P zO1_d4o_6z_V#mWQ(fU(AI7mzT}CZLFWF;lNuKRo(RJ ziMEuj<162hnH&Slm#@?f>0`Fw)})hVDyDKN`(Hcqt#3NsKb4QAWfx+Pb3v2`b!%EG zz(pyoL@4bxhjq)N1Ii)K1*r#Kgdc$PK~IlE;|4{P?7mSxv3>fE2dOYyR1?h0c8idM zPPhvvqpbXhYT*sPA(Iur-Ex|jTtP zTNOJ4{xeafTNxxcw%?cZwD5_Pn!}5ERIccPiqC4eIk+|y&CnueH^_P+9nj7pmqCX< zoJd8US(&}UanI^J2v?tTblDYt!4CdYP}!w3eGc5(f|uV5Qaah7 znuG-Kf7mj1N=gVyw{#5Mozfs7T>{eGNJ~jKL(b6ML(Twm zM}6P-e!u_0{oy{(!1KVFbN1P5ueElqy*~4cEzB$V)BcA_2Exh5vlkFI*mPS~zvGf{ zjsPGFb(IR#Gq>haMbOqG;^FHdyMFGT!?d0J`5H3S!KV}W#If=ht5gj#>O@>)K43}8 zqbfwZ2*nq2k1C+zQiTKsX<{H^WA8Uy1qk<_S=en8K_?CTDUL4r1ZnK(ZgOu?r=bUM z`R9X<^)c6p_2vTeF;`G1U*)%))5I6si=bNxRJZgBjNB8S_|-8|qAHfjw71o}_dlXvQx4Gl3WX+?kL`;ap%wtEqC-5wVj|n5@XBNApW4Ni zVwS7aL+;NeEZ{0MjDIF?DHSqz*ri{KjhV+~c=$FS@hq8F5 zN^5)Jn&0?uEI?*N$C!>gCBR0kMW(vFhG1+sON-d@+HRwz)$F@tr$7ff_l3$_UCm&H5=CI~ZW7rhe4<&$1yu8KZfLS3SVIEpwM zw^)=zdDLM`fw8}yV{plQ-(Bw|8C>CzncwNbINCtB?X_R>=xUB_)9$yaWgoPuJ_;{qsLgZ|3+Yf zs0Dq{gM<i}H}6aM{LS^90VIaHD|&V_IX9kIz0R+z97#4Bm6-+AjMW zUTk;`q@q1HUVV3W8OU91>b{vRJ*VlB+b+bj%H#x27)1fkVZ``tKp5lZz4u4>#evLT zDu46;rfrntB9e%&CsEqbU4(lgF^AxPDn+&Q-8VL%s5R!&H{lViN_F$wz&iPfDaySh z*nPG8xMgFcYQgy9d#_3bKb%)g8pI1L7;(~ZlY>fPf?LIBm10%P#a9#!7J~Rrg;&tc$D3gulPWVVEj+tA)nLEe~|QWHJ=85j5Mk2X;Z9U*|so9ldkf@hf}m|;<|>eq>;Zwv%Yog4Hcz7Z@n@|x-s#5o zHYUM(OkQ{ij$=GO1YHtu$S0RE#CT)IX^Utm60v*9cEdwj*@$}d$#x#LV}0GAt8Zba z&|e#N9yk;_OaefAo1z-{ZfBJ>A9)os{z*w- zF(8jk0YVa|UID$6`EK6BbXuVxHn8piJdR#!+Nma>5S`2PC`ayeTtSi4^>KK%#;Z+I zQNE19yC^ENJL!g$xfS0jYrm@m7sVWxj@+?W#du}G^!bTdUG($t$@jqW3a1tVZXHDS-LSS5nLc;30=l*pyllDLoytJnyx6VEpf=KIg~6oj zPE@;yCyx>8`D4k0MpFi7>NFbHGMu8irbxKbw;7D_O-wV!*X^r%w`37_bvJ;=y%Epk zG{T#^yi$NwhLWP2CM_69id5wL=-Q!4mEY?pyOxNu&BmP41Vwu;gMf=3H9t~FPk&>X zP5-fM1G<+%xTv7wDRngc!p;PD)ue{dxUt@w_CcfPhG7J`oQ7$6Q?7K^KmzraBP5lU zNjE<_*3toSkup+Qbre~^^vYAx<3}j@fF1g{9{tBnimEWDKa@j9um2X6xwoD;f4hI# z|1AFOuDYnll35hGRX>gFX{DixTQ6B=l9}AtBIB^+JC8vkn^MuiN{Hds1x2Z8eU-oM zfq<@#qj5>Eq1Ato9e$Q7=wsA zjG?Bj2BW%Z1_fEvM3y5 zJv|BY{3IzEL$Dd65uhoZ3EK;>XNfzgXbsA4>{!+&)^&i4R1iYen8Rk{<3 zliMY^UyRPITYGF7E+U(~AQ?J2p1yfECYoWUL*%}S2Md{C6 zGvkfnL^dlaZTf3mqGCNa8qX-4 z^$LleeoUrRcLEsXuRAtq2XH^$;Z77J^2v%&w*Z92uFz)DxuF2rz{YNFZdZW;;-EJ}~L)p!>b19Z^c=w<87pUtSJ zi^Wq?VIQ!Re#T)>GGWyw05L~)gdA#AqPjCE0z5_;_@XI(skIZvwj22{rQrx8J8UXD z;18G21MeaR){*F(*OfP^8F(j*u?t^%gE!U5zXAcOC@)wwq*iuKE-0%)k47gn651$3 z7VgEmvAl69Pc}Z7bs5)(fGZNDf%S!a^aCDJf!hR(3+gVq}&yR487{ zX$v`YdBn2zFZd}KTEus?)(mgxgUyYTz=dr3e#u9e z?jI;Un0d6iH`~Dvu{EQ+2OSkCi`;0Q(bgv~w^}-@#~XNn=d9|X6;+WR1Gm%b zA74{Ix)4?nAkRYKncaGC60DSoyW#rfP)ET+dOI+tgEZdLShmNo33yX3Y+PT~WxSCc zbG_&kz-@o~^w)478QEI6Z!}8&Ku)iioH-2HAtj@8z}H|y&kPddnWC8@Y4Z{Ixy>oR z!QD54Ac(na+bvmA`|du*atS9!cIqygyka}%$2gG{mqe*;4Z)D+&9`qatV6-g1D=fi z8#=8|GQ*6=pNdueZMzG4;(ypG;n&hz3ctJuZV3HMOgk3Z2=j+n_Lf`r92myZgeV9% z`_xNktAc)-TLL~G`I)47YnUFdG@D@aQGWGej!nb*PF9JjOQt87JdRB2P|FIkOSMWTl$OqHRc@?-j)Q>n}?#vclXs(UfE`^!?% zj7XA%bNL0^frClyW6$27aF=!fXw_CpE6ZsHJFCwg`1X25_!UHqtsCOu=?W-@apAP{AO3Ny6T z{Y{y~S;O)?#^r2(4JBo_=BFv>GV<_nO!qU-SsCK%E|Gr8pe@a`CIv2C+mVu$FE$|y z9XcleClt_Vgdj*>aw{%vA89aq*AvNbLub zm~?=>;?C@sxsfAmTy zk5cpJm{GYXu+sB(P2hrO)kU8Q%?d%bd-h#){nPc{r48H=)!CXIW)^H@4;>z{;b)JF%M)$7w9mu-QZNAUTn3=?O>de0@`CU6lgC*zg*sM8zlA`Q(~ln+%XoqF#|3CBy(I>iZ}Co3 z&9I?lIO)tjcrO<}HN`x9v2oF8?qD6Xcx(DazGpX=N_JC7p2y+)7!hT1zjN|iw4Zzk zx6__6@;u?kSDCPoORl#MI9j%-eTfM+*iXDlCsU)^YSH#7W9-nx>BbL+_|Rwnc*k(w z1VW6@myD)m`7-B4{M z>6PIVtwAUt)^?)!CAHbdSi^%fRS-mW#& zPCQ>r{G)c<`e0a>AkS8jdSqmcz9UXDgiDfxH82{RjQsV1XWVHlQ&2{>tbY?=Xq>Ir zip_>Ic{Zn4M>AMwRjTIk1p1Fjw+_W!e?x|4A-)w&mj4^+fuQIzWPV4se<5h#BFJ_a zVFOx$Q~6CSNJNQkcW6&e>rP+WnT2%U3!R!x9<#!z9sn6Km7d_zUQog);5=^Q>yrLMV=Z580{rq zv+9&=Va`yg0We+EM|?&Gb^9Y*UPI9ydY!!mPv;7PK_6Vlo{d%AJ<8$urPT7310p4^ z3t((Mas=TPiszN>ekdQNY~4PNH9Ql+bRSpP&trYo1P<2eU>T+QIKw#mD*2;H=h`$X zHC*W1=M*MizX8&YAOwQRDhqfusQW&0XBD1eU+C*IEPYwC#)O3tRqg2`_RQd>0Aeihw+~6r*uo&Bpi$sh=c1@3zZtzm zRra{w>ab5?wGkmEv_!S zp94wuwj8?RGZ;gZGd1{X=sj_zTF}?yhwEJHtJ-% zaiPy7aO-U`r}%qMK|_{oxnJI_<7qwT2^3>d1_iFQo;%mKFyQgp3D_rO^i9pyj~(Kf zI?+m^V=_|LuQV2u5k%M3p5u^u`4XV^fFA@fF98YdZTyvJbpMMY6MUyxt(3cIpk4#^ z3fp4^0Ntdx;IXH%fWo6xD#3dktpR`cR}WWgUor$6jV$ruDjg{g{7;Zs$~xm9!zua7 zrTHN!!|61uZ9BCWL2J?n)#|;t$rFtaZ1hcfL#M95m*-tJmXmBp@2V@bzubAe>kKzh z+KZsM1W3@GLQM+=5l!o;pw$^7Y&bx8DJxdxl9}~{7H07DnzH!2EIlkPH~Cn`RU$m0 z{VqxG$A2!4>G%-S1MuC)ba2JT*zHcQHqrRI=@`JLvCB1KV9;nXXsOvzM)+%U(M_fT z`7q?u$xO{L_*~DBi{2|dKAuXn39b|?ZJ*1T%PQYpRd!0GM+!{86|x%jnXB==;HuX5 zo=&2kt}Q3o5d$mu!}js=n$4Nm@kF6W^oFfO@J=`qSi+A0uA=m4Aybc?=FVYgLszq^ z?>rE%j~ya$;XeV3EAWkxs=lDkbf3w(kf^m@0Xq0KS}z|Zeb1hEew>aW-b@X6j@0c} zA0t86+(YAi_?>@yt)>DEc2rZ5hBB3oAkizEd}pcaNN_8{KswBkO`HDw{ZxFWT==Pt zfvG=pWCJ1Nfxyg9^BEzPT*bVlNc?rh&4B3f{HJY^!q+VOqKJ$e`Nhr|@39_m`h-Ba z@vj;iSa|)Tgo}n>&Fvy3ntF5b;gau=n4uLH9Iw|{MGYn2?HK1~ZKjtRhc<@; zx=m1X{DsX`cV}^S+w~)0nw&~rwtZrhvdbpe0MF2gLlK4wRWZai8EfwdJ z^QGRLL@Inb@!l(G-F!yz`erHC=?yTy*xf6W9BOc}jLSVa={s?wt>3vkX>N{%G zGM~o3T`{*dQ4ZY|pV})}qEDk~q|^$LQ!!hWg>o&t{>JUJEUR<@|;zj%G1r6m-X@Ja_K}QVHxD?b1^9m9a;rd2(%xG;hSB?o&`G=&UEP&5pL$ zYS2kc;ViM(%15NYbU92%En@E0>Lt~%F2-Zsn$4sbfA#@@R^*Ch7L9Dmn{elkk zrqXY1EpEG{i`93EmYJ6CEMnpJI~e?JrXj6JI%E}F03UEm*y@M4LUDN+rYjq`)3S|f zZ7osqo&m%?P@K=Q)<1c#vC+m}O23WW+G52LBAV%eO`A|VYt(9PoFI_q8{!9T!d&A- z%Hmpw56}=OjF=(6PhJTDOg=RzBG)Cp;_~IGE*cpYWxeh_jcD!waoAc>ko+g$Gaa?>N|bPMiD`4dq_`&G=c;NM&DJ zxAvD{K<8a`goKG)y~_fsBr|ze33DSm z*h~EK4=6O>+&jZg!r&P61BrG-H?v$A08hqC&$;rbl3f1piuc8j8+>T5D8-5D*l%DK zn1XQ6p>f7Br*~DoJUu>NJC6JwRTUL~KJtz4+E9{zG)u>xGRv^QEh*LdI57}^D7yK{ zoze4sJ-3;RPR@!n#F~Ee<{KK&m;Qif=%#ahxKdBVL)>n-!?Tkam%~BMY&s)cmv%|z zLx@9Ww7q*hexwTK1~ZRnpf&uKCw{2+zceRd;xTioGBpDa* za-s(m9a(anov)Vqq~97enQ@;x`XNsCw!QE(`m1G#Xx1MA*YjP&cRov1R%suHw7MQw zGH~R)@t&U-GsqYs03CZIich-=kc{aWO%Ztuk73?G_u?`P-LuPHxn&$8V9y4$^d7$X z#U6q*nn6vd`AM!Fp>ak47;3kwn+4|-ISNc;2{5s#-MU0 zuZ{#YsnpWptB2zZBP#Er-K;PSQD|KfkT!(8VJvZzW=>pc+?M=$*xeVxg-NC4beKMz z@Q`0|-9K8Ts}{^ysI?OMgT;cd6>AhdbxL5u0-coqKo$QMWX_1w6Q7)Q$6wRxP~0bkYOq4!Q)5eT|93%8*- zb}o%}*l`?%UzNQexnu&m=K<3_{@=mPE6uDkWc&A&Yx8FUZmyjp8>8Sg$|b|xK8eBL z1(KIs(?04BMwBqcozw{4=9nXKh<=Dq={g&Lp@I9rkhcT!o@Ge^~>~^E>!M5~v$3j=*Q{c4nvbW-966vPTSact%>? zsHT_mWC%9k6@{Go)rtQ!?_{iYc`jShh@%TB{BEnCk72>L zxp=YPXzXLP^GwSlpo7Q@XU1pwmT#EaXX|5jgS|h+Z8g(6+By841-?}%?8~xpsuxNXQY<#l_!xU1TdEO^lX__6`&Uw9uX$v66e{cRA!&v(yW-h)WkdL4Z`$SOS{y`* z;F-*04mVAAg9~+}UqaGBk5UYgaCW1;AU0#kd(>Y;GFc*A zd;6!2f|GHKSJe&v+xCOaC&pym#O=v0DG)% zLy7Dw69PJ!?&W5#o`GGeJq^u3&=R$7jCT;q_viBO{I7_7PJv9Yw2;;tObK`ustBS} zM>rb77sM=~*L@n(p@O+IDu;P=A+LHKFMisYa|My?ArTEYiCMd8FG~q#TIPLB))L2; z<7Q!)dDiqCua60WK!5%=J8lBPQ<=eEikVf@t9>GYv8JE^!NK%rP8%I}IkC>Mdlm;{ z@YTHsQy4{12i4vF(SQdV%kTQ9X|vqcB~$_V5c7W~H$^3S(J}G;%-W~0Fig=0XUIKC zPTb`bn`+sZpgzsbRu4YU5DQffTqG$?mAJ!?ro$h`X}NbHP5QGpnlAC>Y_7ZFbG{>h z$|ALpXBXCC8x8n6hd#5G=;HYr{GQ@rKzBr!R{~Kk!l^H7M5^7Of3P^E!(Y0{~C zNrl%9oiRs{(-zNt8}lP(bQWR>P{Sa<&Lfea5bWd(NF?gKD?M%|85YMVvc$~C>CGl( zE|!-m{L44VjLSHgCQkFsU3jLkCI2hr7|F7vYXZRV*|Z@ z(?6We99YZJ6yQ^a!^h=2AY!%mK$HPqdL0*waMS1|#|tlj2Vt$Wd}o>gpjqS>IudM; zrC(g*wckBThS=218OC1;y{WQiLUeD))jqp~SwUSD38v^G@%x)1@zq&t{G5cK;W`}4*)*VAp(9sz0(aI3Pq6 zGckSr1io^u5D6&YhqTD0#pgJ+&n=0SY*>rwmyFx+xZ8=s<2r*uvk^y$O#$ia(v?=I z{`V|_%n#GAuA+T19gi}4l|boaVtC%xbS z!q*AK-^KfNI#WYhN)rnb_gTkw)12s-(H%42hHN-K$nyKvfs+f#UJ{Vl6b*RpOg)lwax=fwu?TlI1+un zjcy$MJHQC9m+zuvOuZP!ItZ~#Qg29aRQUXymP5cUE7nbn(w_7S&u zN~^PF-kGthW3L*9HBf#=m(c9(s6l(k5+&RK|<`iEzHKYzV zsoXYKqJ6`(C82UE44v5>kl$}LTJCY&?Km#X?r0*Cbm)UPyisn02p?GmZ-9M%8;!*) z*p6xxwNwPG;T_HG6CEI4{2Z=SCJH-sQgm%iPJ`I)KvSIhcD4hx>A+ZL84Qkp`GN9> zJ<_2`7E)5QYnKcJV%|5pRmM;GA?eR39D{aB;P|k7hw$Xg)G%`=A;a%AZA;o?L3L5V~HdOeV6JcVaEt zzZng;+c*yXhNCJ0Gxm6MC>wT!Hgov1*QCTo)rr-FWUqsH%lYp~&2Y?w0KuW~D&|3K zZt~_twBob!r%X#42SxOiyhkpXynsfm+p?z>Y0g*@gUshs8Emu3zCwb@PZiIldh5@M z>=OCoHHKWm`yhe(cKdQur_@p6jt_xy>Ab*X`pwyayT# z`Ef@A=K0t;^X3A|Y-L2|yBXx~HtIjk&e`Pl^vlYqCqH z96oV^dFXn@f__vx4g4lw`xe-$^$+RV&KOuD5fKBKUgYpl9hWkzB8y0QmV~xr$ks0?e zJWFc6BY?H!MmT>r%v-HebEPj)_}Bxs7Yvf85)53it2d8LpVmCFWInwK=FV8Cgt0yI zzaH&%0ES$im;Jigfq_#zgZk2r@z>gYx68~usx=BGrIY zy6(C9eVB{9tUq-gNJQ40F)TAjdt{0xL_qIkoJ)|`k4-_eox(SbX)0F4AL>RYK{AN%N+Z|IZ0tA7` z8#Mo2?AsB*^f0-Yn#$RfV4YLobd3XkdKHGXZ6MdN_k-Z-vXMYROPp%wnXHeEIhe-t z6Z~O*;}upo;K|B3C~#h(lHkPe(>apfri#;$2Dex}s50r`>z%fdlA2g{kWP~D>MX8O zqat_m{q~aTc2W!nM%dZ?jR-#3L4FyhI1S9u&rWJUos_G`ZyKyP$RAl3)%cwN^0UyV z9B7by_wEv7YbvAKlv(Ji5t#5yd9Ult#_bnK z;hntv^o?S?^d1|D=p1rBf@&G8>TwoNJMr3K?VAVc#I9@W5meKkUUL{GIVGNocq7Ko zb<>&t$c<%{QQ9OP=baNEs~GL=n~SVmrsN?T^lKt7SCq9vLE5An@!E=Z;(Pxm=mSO&%Pv87T~yN=ujkyR@52hI(^94EXj<2d-QANu|*glRjR* z(o5U%_`e6b)@^g`Wlt*J9<&hyPVsiXA=Bs1`s{XB><)BD-K_A`cf?pdD@TWNN{Q6t z9?d)N1|AbttX#hTvkZXPHx;(CSkIsQ6Xz3xpU(h@5aC_XFv~jgR4T!L;WX!*7ALUzZ^q*Lo%q=w3kM`mo@jf}fOd z{@!hI-~(IAYZ>#YORsV7mwc%%zB;wFjy`(_xzT+piy(c(MjImVT0s>PF%1h@2_BbF zS|ydBYTafW9=rkh_ddf@@ADcYM$NgO9n>#-HC&JHQ;2y$#m}^6fjhSZr?NHd>vZ%# zES1jbI&0u!tN_ir-z7}E#adF*<*lMYOz|;jd&%Xzv5&F_`oVU&pHEE}@3Cmdko``@ zJ|BDATKgGdSISDzb$b7uL!J4>2MBg!*i(6=z0=p^9WU=#=m>Ca0I$)5#Okp%WokM0*Rh!TIphO7a9lIO=hV7wKecNR8V!RM~+71fYdj z>iYZ<_5Hqn)g8*T#?bpwn=f(o+ElIY6I8gnd2T71E)=+*e zF5NJ|sBBFkw)=fZ&Mk8gQ3Z(KX0(mFgCA1tcL8d?b!8JR=B9Tc$<^o`onBhvK>l}6 z{g1CuM8Wh(+}-mDk^KRKOL$*XQ>mv3-aP1jRgn7fltM07B;t7lH78d^E>`f$6JG++ zX)+*;wS3yZ{BSPYu5X%E?8nS^S0|t;RwC^Gk&%I68HM}wzC2W;^vdt5j%ys$y5E!oc0R?#D^81(@QXBC z%D@x1qT#4pF)lKXojp4{9%43GAuNIZM+7FAF?)LZQ?M(KEr3W+8aw1*5Ml}V&gBX zy}9}}V~@mu6=B@+C@9xd%^wwDH%*70cb6z=o_NxE=g6PndhVx~A|gREBLMYTeF=#p zf93-y7N+T=G*49cJpgtg7aLz(D&FSxH(8u~f>$Uq=zg&q20u{sBV8CF=wl#KYP+Az zzdMfl+#{#3Ogg-Is>bU+KSG&vGQIK223u3PEeEXZ86C!ak3L2@;Tp@KJ4bz$+66VY zyiM7`yYYN(&m!awCw&xrO|*%FHVBPtN^rDWKpwX8b?u`q@;a8kf_pM=e!lLgF%hW& zkBO|G7v#s^9q3(&UV!E6pA9Z^6SAF{j<zNtJYP;k)s}k;vSL$bkkln0jWS*}( zIdRee8&b~3nk;=GmNb9B1i#Z{QemRBq1Oj5LS;Qy?}^)*VDG(q8*A?mo{+TPBaPdM zjY!($u=A!k<1zC)Gb`nAZH$ZH0Z^yrR*3H)pGU*gd3~K39yD
_uzLuslHs&>sHUp(Aq zgO-X4T~Zn=Mxwy)+eB7_Y!6kJ5Ax>iEXvy3haU?@Z2~Yv z)Nws4v6{>1uztj6@}#h8T&MfpIG`QKgTo)5q%(2aDPGoPx=c27vJ2&Co|ZTr{$=e| zV(`jK0uXnf0nuTFncSSB=}!2Q3+r@2ww%a+Cx`zdiF)&x>Dsa$Cx;;S$62#mgQyyu z;I-{|P=ui`e`0@P?XBnN3ag{xF>bCYiu~EPC&`)v?xs zV5rr;cLUbD{=8wis3^OQTkPQLv5AP;EDv^Dy9}+oe(iZp(le$e6e$IY(X8W0WbOb_uvpe$LCxQa*=xmQV`qhm*(#(b!OGYdIfcYYU5d zLg)l@t8?1Hu8If*+WEj>XYks%u+qIu5gJ%R!gV6Zn~mVv-!#^ZjLr=%jAm0RIjzd* zXqGq`NhwNId6XP}`-XQKc-8lPgU@<9gwMJ!C1_0_`$7hgA{tN?24} z%Q%1lG6UK4M@NLCZ$~mAs~SMO9oD4}s*FW-Hx9f6t#APFAXhqWQ<(tXaeHdIiWvv` zurLU=eJ65rldo#D;JNW*s2xtEIdNmvw@?1L^mAanOOw)=rGXIx;I`{&3dbAPt05Fx zKmcDE>$e;jo(*HJIdFM9=CMY63^bN_mqWB&|6kbcU2wPxGajWCD~bx zG{k?Q|InzIvO(bye25#-%K!wI^ib_{jzuqK7^w~jvb{joJu%qKh=d;QpmQ3w?$yB}LckeF zNzg>@@U!Hq@X}*F+hf5?PQB6xlKTtOK_?Mk)J;98;zms8bvDNi9A}D=x`vj!1rB0X zfLDGBw4;?(?;h%-^P9mAO)y3j7Pyv7zOm(^wTr@y@G#)G4INUkh1j}Or_lp_az_^_ zJQDF?eBPx@O!p2CPe~P<68=~K-1Tz*So4OrU@Gc6^ES7EJN4=#(uW&2mZ-f7ece}X zzgRotKC4^6ahvFcjOde#H=l%Gkw0@mmnrPQnVa{Y_=H)FiLiAP#9N8ptcqU~7aEG? zpYITv=QqbqN?!9GQANm#kepb0O@x=1moEaY2H72ZLx~4;s7q`5a?8Yb5*7GRDQukjifl+VPkv|Ol6i@8oPcHaL5ua7wBAR- zZ;8PF0?!x&n-k*|M{0?XINi^`PM5NbWXjU$T2a7`e=_}~*#w$+6lzX6ZL zA5YxxuoJ=3KZbtKL%S`Edyh+7)xf%;*)DO@bGVDEp5w1#% z=8DJkGBZ~dpJ&l9t_VxWl{wiC<$)dK#|ue~oNSmhZh4oH+cgIoUzf8GIMK zL|OUFFZK{K5O1K_>Y^hr|K5||E!$=sS83Q&^r)CKUo!>#f@F#G6g-?uuap+Ee-i4I zDUfw^P|la$ZbEivw9>jNvm|-rFooO1U%S-)*@rwHtP3Bvp+$f8WRVov7Wa3!fhGD$ z4JB{^^o<(8S2~4La}ehh&B@vs8vHvlQ91CVB_!J^OvRbg>q4% zJd4QauPBYStwv3{{sDv15!)(F%15MCT+hmddkd~`?;CV{7b=El_Z1p@9I?S+g~oMO z=v@Zjhk6W0$X-6{{m_pwF`rcgtldTQ*I>y!rvqbGE?v50vQXe*QdgJC=hdWQW?z~w zH{Yc*pR;?QcQB`{g=-V{-hTO(Q@2`!F~rmEVTO@du^|Km<{^T9rf z&0IU*31|8@O<{FGn&xYMl7w5j+a(Go+JNBZhe zSbDKF)I`|}Cv&$Z27qT_9AIHZp5DU_*2X|@c2EC&GWIJDoo zKi|ecOz(i2Lo2Knh3#pM2&$_NW%FXzE47LME@}f>ch&fcB_6l!Li5~xgDU5uo&GL* zSykw;M$2%qvEhL4tE)U23n*S=Q1|RowT{Y)`KZQ)5sv)eh+Y_SL0wI)dvot<1nXV9 zU`YtRFyNcnR_h>V`}FDH0Ai(7jyL-2l^_ni>q@JBL4WJBYFW;cb!vHrP-Z$WZfl!8((CjfG_1dyI*z3b9 zoccEiUW92Yo(*&#g@Cq@n&TDvbQF;M_QNPemxDjFdxQWga-F`=tm zx}n}vt@GPna!N|nSgLAAX!YJs)xLf(ZGXDu)p@LGh#a~Y>uuX79m?*bf^OC}^w3Mz zk~|~~A#=0GWfH|eIibmrIZ`#>V6*!sPTRc4AU~Ey!!BLati7ggy~+j^rAc#qrz6*C zinoE4jO=eW0@<3Mt%au&DjOF+NfG$;PK`SRoTqV$S8&9}n%Xq1RW^)bhqXZitbZDs5Y~N}p3iR<3D|hotiQT$0BJTH|LO@0O zwfH5y!?Y%7WTZ(6oxrAHmNt(IK`G3E;okZwouX|@`ld{xYxK>N<+fnESMzqe7j^Il zd|vk~X1tzOI%NfEk~!rzIpJM%YnxgWd;>%b?jkVXkVuuLP!9uH3H;kkaNa=HFyC

pQuintmqB`?sI>U$f5J;Z8c#`7?{XWS@aR1K7y47 zjR64+g=@BGQ4S$mGQ2M8^h~2=Hm(GNRcVr43-VBkyZ35FquObR%qw?HAzsKfidn{{ zs4H3g8e6Y9{&Q%*M}fnv{D6opx^P6jaV{^y*zh;`>wPt{>k@9NbJj`Rz1k`_s`GE# ze$!miBjr=(U(Ks*eyrkekZxGc`5RE}cSyz$V23K6L>32Uj5`SiuBK&TtbH7=sMDtKNe!t|4O@Gfu zWQq4Yz053n!}dwe`T71rcJ2A%5e=rv&NrvcvKC3o0khsLML<~llaF)Ycb;uxn65y8yAzqyux2CrR8ZB zi`qz_-Ysm;^y&(*S7L>){d1VdHKeX^+I-sxGXP&6cr#WaB_Em(Sz&J?*cSwLn(-eY zvxM=C8q|jp2>(9~8 z8~n-7l^MG`()qr9OCk|XM$KN{8AJ1AlC0nq8ES;y!Ze0^afy-&DN%>ZQ=LMU81Ju(#+mfm~D&N92FGZkFkLf&1@DWin$nS=n0JRnaat$Iej^m2gxss;MV&zMhy5to*>?KZ82R$n? zY1LPftzitg9vIeZ-t`2yBKxyhFs-bAQ+i#H6+C4%wGujyOh#Gil3tvfdr< zeX`}iQ5zCmUR36;9d!QAw#`ZE!AuBI_Pwx>VE1-`ll0Xd^&J$y&a?jQy?*^C)8mtj zjEwYep~jD{Qp-cRS%c|>oa}GS-{>z@OFJc^?W88-w=-Kd?l9XXUsalCpf5mp#6F=! zTAGzyZN(mxEB(gZ?bSzX18N#52x`Tn|CVj5N?C*E1%&8g{{gcU?z7cUk)b*0Z5cWX zvpL%yxZm2DF>p?=(q~_ssV=ntci!;weWS;_vP14K^S&jCX!+!P@6#i>FGVLqnZ1k9~qswFwxBSyHs-XwvmcL6mZf+%h#NqdNSy#*9f2a zmJ}FmDhBD5h9m+7Y)G)jht6iL>lt0wf4h^vUj1L-UhBHY8$yJy-dW}QP4ZICPW1J$ zU~8O&0_(dU9y+tWRT|&s`RfgyXgf<1U>hkQ>k69kd&}XX27l|roI=EmduRidM4gXx z##X&}{hv+rcgN&kNdp6u(bmTCx~x*kJp6@K0aeh0EAQS@qP}_oyL7I?ypltih@Hk^ zaYtuS8p3t@2|eLdi@!({NrOosh-FwvDP7{S80iVvqd?#!V(<5o>|pnmws-U zugj=U1B|M(-v+kG;vZXdC~ulu&-+sd``7RN%Vu5fdtX;RzU0+?l1Sw2O~WT)>0*!w2{p0Lpq#Hyi=Wkkw&d2UftxsUKpkcXQB~G0#~mVkmVv*R?icYg`#b9J3~!9c2C{?wZZ={ zR^-C{IwcZMPtR{irKbAdy`Ap^ssdPgTM>P+>3n#n-vApua~PxVY?G+O6>kk2D=9@Q zNl!Kv$oW_Q4X^a?$Ez;tQUP$9tDZ*dpZ@h8ia%uHT_{QyBQ&EKW}vOf838BUUoUw2c2}Q^ads|Ft^f>rY5WuxCSM?fv zCDoXip|q5wD)Ik8jQRh(NhvQ$JcDcw-)CU(IQQk#wckvV!l2tkxo{W~(9k z!jflQ$#Nc{b!}mLm%NrT&%cyXl;4fsP736u`tOgB_T8Oy#K4_@(?JG4;R^k&xmrKrt+^s+zf5R=dSB$A$G zXXM%SbD5etPt{jGevG@3btkJS$6&dMWO?VFoPxT}+a|Nx48{$*f11;Ujg4+H$)=pn z42ad#yd@P#3N+oX;u-8E_~YuV8~Q4pCStY2y;w_R;^!zOVh`J#$AaV#T5r-Vdm)Vj zzJdQm%jF+GLN$g+kR`t<|E?IPDoA!GBtM^QVuL#VV%;<*KAK?y_TV5WS>Ymtbm?`| zKVC7BNF-XXLb|(nK`Nel21c+BPgclE=k0E^#!mL}DOfocL)1lD+x+-XL|$l}@D+zfAU zae^d^%De`3bKP|Rd-$nClLmP|p&_{6Jvub1HYD3n&$mz@tgKQQdH(pGVOM=y${ULA zE<6@-=%>3ZfOqQAQH_PcvTn#@#IK?1Fc`D?;j@CX^=XM7@#o6jqo@bn1$^0zI zNIwIOW-bpsFXaMq2%`L(vG~?swIf?lKM4_SS#yX1O@_W>_|X$gSdd*08e-WJQh{Ff zXzO40w`2jFH7sIk7K#P6=OsRV5)p?gNAJ@7wNdr|VWm$HjWLDAeO%Hx2_ZwD2iES@ zD^b7so*JfFB;6HO$G@k|6H8}iU-fPMQwu;pWP|_cY--uIx4M4f7?7_1u+Eo*>)>h9 zMXn>rN4+97HzrOI-O0LYy3@2~V%J>t8H`r8xqHL^e|HjpwIe<*X9qpKBzWpn&_wiO zFhlI&-8To^r?(bfK>pQYiX{p1=J`zE>Agnwqo1rRCItZLmbNg`B#E=Kp>@=ko>gPb zMUp+0MFm#9{NOF7KR)|^74ZIe^8K@))6?C|e3EIaLoii%1?s|oeXSoB3ovxv%g?G@ zDssmU9`h!MsLL{0`bIHt&EgwxF7{6~<#O2na5Ka|z0B`Qncsfx&6^X`(=4UpB`LqV zD0M=Xh{L&yr5YK$dRoSw#}_PHknSE@@aymVtNr-xztu%uEErjtaxvv@)cnmC^sT3U z_67SG2rqedV(CI8;)+I?RItO*lt@Lzv>hd#NW*`F(Efe3>JCY)1nEvfR$cUHF8*k* ze;f@HHalJcojKbi=I6~a#W_tPBp1qW7Kpvbxi|&ANm%mC-`$I@`;B{h8~SvvEtzXy|Q3(?tm<#rwn;#PHj7<#d5i?sg5gW2N{QNP!lBz4W~zdt|sFP6PE<2;P1AMg4eoG8y{f5k0y&duIS5Ktuo=FgM zQGQ`;%*w^Z1&WaL+W!LFWB-1C&iGHU_tziw<34S27?r`^gCKOhze(dS+&=I7b_-@Y zHn-@&EmC;5GL4d?+K{Q$m8Wx@Pv!`{bumk|@*@ffJ^ND@;$wbpd9*^Eh?p3>n-mwA zoSgi{YUt@|C5F2uxpx_u;5Jzut@!xyOPbu2B(7*U^zobv4nh24qv85b zMqQ^s`r^e4levyq(dzsMeq>Mc4J8UkjvJmg#=UTfV@R7NZ^B_&N1T8{08TUO=_4W{ zBByxb(-bW;tr2;uh-LU!;86YNFaO6=u9NmTT0ufcmw%TKt=>!_YWg%4THYH*bB@T6 zq+*kQ_AG{k zlvEDNZJ@6#Dk7qDg~u=#iCye{e2S7G7l%v`VF7s`mL!O~J-x!Me_JMi0z8!T;HOXc z)$hBVMAY5g{MmEQ;ZvBpC9`8C7(ePfVm)vfu%2|=@!BGbe)gei zH^=CckZdo2X%j9)+<2VgU>s@P~=U5G2|D4}jqQEw-6A;2@SBIUNo{pHeOcse?vaJ@7F7sIQ zGf$TdUUHWL0NNyvBh4DA{jBEC$53PKPKD#VDHddDs_~?RHK~n$J*@ewwWz_X<^7GV0WOV(&3RQm2$(1uy7Po2!SAu5?ze=*%?a8efHtu_R-+AnHKZ>JuGB(i$wkO&n|NwZjm?@eMZgpz z&>jxB@n!JxcSG5r^7h3|(ha9dRR)UEwZS`<190dBJ#!J^eoQSTy;vy}1IMs(#R;`H zL}f1BP8q-z&2pHIl+q8E7*q}PqS{2t z`ssD59VEa>-43D?u!vkdxenY7iaCLJ_wF61Cg35l71^3O@_U=JiAyCmXx-DhiK1Zn zzJ|>`H>R=0*Vq4ui2uVQAMG>C6g7BLpMxF74i}$fGSm3ouWZMib~fnW8jV92uirpQ z;l5<@2zInPGmGd9%@0VqSibZ;VE&9l z`&8QjmDIqa*|un~xaP#+>mVgRZpn=qM`hzP!<7boNTCQ=8#LKFvjLyLJ~N$?g5%CN z@b_OW9*|eIww4rxoj|;Ho$G_W1gMbsZO&e0tnfsL3D^mrp%{vqu4MP{8y}}YUu}iE&jp=8+(?C~ z|Jp^g$Q!MU%@$$5SLQ0K17(M{G}FR&-8%+FLE9Gg)0*X?&|e^Zo7{HzU3+wyiRv-rGPUA!f`!INo$F6d}JbcDT7SvepW;EvL301s1X?w>1#lhRN2dT)x>Y4wppS zOpptU@`guK%L*sQ<&zzG?53X1WoEm1vjt$YnPQhp06oo1Ie7Wi85b*y^UPH{&nCUN z^zKE3v#dqvmRLOb*8OD9dFi}}9g`x17hY#?BfvKORd18F!=Uz|uFDv&#{SMqqN$X# zN4BCXj@YXf@YPy1uU&PowoZ42N_7H^JyGy7QyFEICQ(qyWqL2gTPk~o;{n~s>VIQv`p7=_Yd4ng8o$!y~iO}{KbeV}Ja{PM!F9)$HG9bS48aT%k;jWG^` zPq|JO30THSapPM-KTB{|OEcZNC99IAU(rrU6u;$w7o00LN6G_Dw@&o|%lr3z#yCfMrgu zp_1^ilq;!S1I9!OUh0d6f@syl6c+AQfgp)#`Mf4AN}Fv8NS#y{2@mIpr|I&o0A1@t z_SOV3%eQfq*!VBsLekWp%U{2J(u(*rH^Uyf?tdE+&Tv z)pAVd0z;1QjiSp6)Sh_YGUVdNLKuC*(cxzx%6xh-sBwEROz#xtg1F}KwBBad+dwUJ zPGQ7&;o=7AQF?#|0%8!$H|uyu=Z1u9?xQWUo?>&CYxd(Z4l_^Q<{nw*0gzOdM;!Xf z%TZ&;s)jQM{AI6Q<4`Ra%rVn2LYmk%3)y-TiWzgVH8`tvq1PC+Xwo&o_0xxMqzy;u0&CMEPz! zMPa)0ayASZBXb0k4CN#OWPOrhpGWC9cADwbCW(S|1+6JQE-V;-sy$Kk{LOw3z{RA0A5*9X zY0iLe;l|^)XICo@#smx!cyw^&gLw`rZ?52V$G#{E65GnrPw$g#F5rjAPX}X{!-f{YH&ei>jq3EIeca0 z4J#kJ?#GCTbhA#{o*KQYQ0C~uCJ$cb$y`Yn6e2)p(rc~+SbrEQgzVjDf&B-HhI>en zT2Xi`z!7+I&KNCV-2+f;?5*bW4%k$hTGte!F^du#yA8m176CR&2oE2bg(Z9UO2L;q zD?{=hhh&`I?a$S0C>+ee^*dUU?7CsO%p88QzT<4t)xYj*jKncal*Ic?HqZxpj&p3k zIFegUE3U5^|5%VGnXmU}8mZ7_)svnUVlJ!t8Qrmykfnze4zqlTLg)O?U;D&3W`Kay zy!H2wYwXF<=9!kpAh3l9K!XL6?tGn?D8Emj;xDM;=1d=5V5F)sv}oo=hk4 zs}>||ko8Ge5sUD*!e?u!e2}(e;yqsVmvK70`8eegjwjw`h&fDloq)rFYPsZfflbNc z^7}YlgNJ^XAVOe&#U#GY%8cnQZw9x!>L);03r*9ZkIORj{a#vn!At$udCXVLOU&?x z9PQt5 z%cAo1*!r_8Ag-tl+P$HCAdi5=RaiyD#AG6P4ZVnk^){{;kzZar$Tvg&MUVF{f9P6u zAHR6vY-mFA{40i#7&fpa`DKE<_2%e~#l3g$MKgFt(mYU{Jo#N&C!~tuIvX>s!q*O$ zKLBTsY{e3+bZ)4|JU`P20WeH?bIkVkyLJOBYsgBgN@Y9%I^TnU)-0bqAUC-!)rnUI zsBw{|9@=c&w?JRsv!s3c48*trdu1`R5p)%g_udO-YrZ6caU=V2`gU<=Iozh|Xie$T zwQF1|k`h|A2Rr9p_3p<7DHTgN3kWi@L}GTHmzj;&pexDuJ=?DU(+F7yxa8)f!upOr ziG`kuh_}nbd28e0EEhKisgSfdqwIFO=IXJk*E{pVuGI3ooikaLncDfQBL1Z!r2;qu zw`@msMDpTgz^CUwV1jb#WyM3VSeK{hGn2>Uu(@;xPYLJca(wL!rNLSy#@#d<0Zc>W z38<&Zf)_^@b&c~LF5+I3HDAYmrxI1{=H2D(eN631@TAx0rTNPf z=7#D9+7kI#Om2n4x>3wAmA2Ap(ZrLYq_c>pze&C9GE2HMjh=eZyZ zO}KgP4J7ii$NQ@t{&$!rB>skPPY%R7fX2I@RzB2Oi>2ZJInNHg`0{&-Z!QQi=IXlV zb2Q)(-)R=?HQ$x!jsWChv~-#hcXwTNicA7Ea-XT$)b5#Ofe^Ktvug;#zyXjy6}G`= zLZ+YP&wwlbb*=Ni73F{WbByzXz16E)7;Lyw#%FwQ>uT2kM@~qUtWHf$%_!FEs9C<)j9e=zL3o=kcGrC9 zb?wI*dRZrMSGld+UTfykvhUYTXq2RG%1cF_61zGUu8iNxX#0=U}(n ze7i9e-s{YHt0{YPqNO?4t7NM^-*I~*hbL5^_8s;X%rOa)BFV!e)jhXZ{2c$2@A}*J zPS_K*zcFu*b=+VOvN;uW-~NJd;$@z8=MHWPb<>caUNhlO1PsXxQ0nEJ?k6TD&btU? zCGvt+PY74GLg;yVjki$48z>@+8*u?u~E-nk- zzjDs~HQvbkXH0_Jx5rs-KN<0KS^6{?7y)g7vund=KFPX=Pm2@>lU+G?b|{Y{$m2j0 zwl1mZy7q2T^e)dKnGOLC%q6M2CTHu^=xVyz*2hcjz*oL2ujQnaAQ3TE zz(@lyxWnd6J83iLJXufbsI9S^JUrK-VD?zhIRqVqxgM{SrIj+fqMge60-J#5*&s^4;nMSqXD zY0VsppDCr3Q;$#E(0hgS8g7RJaM+avWbo?_TTJL?W#g5Rl~-Ec*Iak<#9x1&-J)A+*lY!io1E%c4 zFhK<(;9$VfMVhwvAZ~Y8Cwb4d&A~^l-sW>X+pWr6N0=vj=xB`72dh?50iKglc6}^l z;zAC5n3s4tfy`0(t_=BU@=9s%YbH%gAYgR4=T&hA|A zV1S#d06Y^6lb)U~2aNJ~A^Xl^(-Q&%&H4Q{VuJxrPKN;oJll3Z>se~GIRE}xm{HwC zVwF?k!D`LOtVgOPRC#lna?#gspz(cc$hEqxq|P=Qek90gSFt_&2skD35x0VGu9_q` zE%kj}WN7+!9U4w4!OVVUy&u&iN6FI1V?6Of3kAkGRH2o9lB>pVHU<3Ad-&s#j}X~) z5qnjwHN)j#bz|i-u8H?kHVpG-K`Kky)>B|d;|D+4>%%rHFU$&P=DSOXcnd(+Ye%SVN49n*E0L^9SDk_eU+t z6G%<(MW4dlrI?ctz+n_-CrEn9F7+2vBs%wrIOga!g4R~iWgtW;07Q7prMiu6lo-~W zXqJHIxY8#g`~w-Bj{;+G{LrxsoPs~JRbolhsAN8>k>6wc;nE;Y2?FI^>63B ztVYY#qEQ@hHXs6~!r&c6Bg##Ui@p6h+U@W-Nf^=I@HOcaxM2VId@_W|1urH+!}qP6 zAW`W8*6g2d>)WyzYG!gDjimXFYDsxjU1Oh#4ukjzI-qqI;Fw7p?S%~eE%~Z1`z&*( z>L-)&sq4R5ezcEC2O%Jr7#M8CeLRkbXK$s;N4518=G>RW+AUD2h%*CuKR-i?B%JXX zTpbqDm#f3C?(rw$zz-PdpZhf_FG<^?vRKR`Lgp+lWUus(8oF=jhyatOrdI{yLp9+^ zns>{}&!<|ORk(x2%}YfXJRWGrZ!d2NUE_(hoOi&q9t~PY@1gxRJ4Rik3;OPLQ>UrM!~MzWGFSPmd3l=wE#~I(^DxW)>~snmjja}o_P_ZXi|g%#UGjog(QgB*O7&+Nr5#D872t^Eo`oZAY#qLo#XG z4}j7VDblT8*SLPNUc@fU_9JkV9fcNo(SOE10Dhv8drgP-GX50^3>kf0D$2zV#DO+f~0{4 ztZTNyEH|Rx9+Xw6QOD@XNOmzYh2WR1rYV-_p8MHKs|`r2b0_3U~52-AbVRcNp|98jLQi+kk* zT`j$P?G9FRfz|G(NUe*3f%SJIH7u*qTBt8!qD{j*zzE{U^~9!2$gJhL8gS&jre#pky&!Z4A}V?kQZ zEqRjNEQ}!E10GEukdyzqYO#unXURw}K)wD(*BtXpe!{v2z~U__0_Yhqie!5h)m&2N zYinrTD2yDespdloam4>wM9Y_hM>T(k>9{h_KbKRwS_H-nJOXk|Ccx)KKW1RadNXpp zIpaa{T$f(v2Mq&9ei^Jri)K%Sqv&XdxOuJr+hswQVo!1kif~_IIMT@wOIKtW%56J& zp>GE$Jd5~EpnZb1*Eb3u8=TJSOp1VjY#7A9FIFB;2mR-z|@We*Vrvq-n zY>05&Nj=yx@;dUHf81U$V$-Q1B#wWQ!Poq{dbEn8dmQM_fCoR*HURU+A{4B>5Qs#X z%}8qg>>5Z1Cp178>stZ%}S?w z;D0J)4NI4C7@4A7=!(Wg-ans0JzsBKvBE609L8Mu`{P&l8S69TLy{>;Avb zX|jh+e(h~x_`{2x#IW|Ti|g`0>KgK%64zG2d*|1Ew?9?%zkbSX(USla^I7`--1p)H z+0Vn7fEA!2cgndWk0Lq$HHF?MQW6X9hXA=y|A(>K-4{g_mNmE7*xD)iy$eH%hxe>^ zJVo62xO*4J&5%*k&BkE2tvRSng*=U~1$)cN!7F~#=_an&VW32lF4ZR+uf%H2+rf*^ znuAA##uAJ=TQ`Wtl@n7biHR%}u3nY42mu!l+m4h*NeTerU-ZIV;~D^5-u&L6(gt9# zT)_N$UN0&ANTe++@S6Vawt8q=m|hWOpt$#Bb-znLyJoJJ<9yxMyCP1v4+yu|cyREP z!}QOeTV`w#s0NIO0naO7E?h(dn!krtR8;Ii<>*&@j9lMxtSlvS);nrWRyLiJu5d6l z{rY;`w24xx9ga>lE9|v2nxMrD@}4gSV=SHaIvCAcfjO-_(YdY;M(?PT!~si;j-GQO zw%(e!ir|ZOfW0J1c^|#*jWkwCxICLyDz-+$PR$qIhl#~g|!RFW%z z5*Ev3TVCyn=BM?yLP^R(9-Z(~& zy;k>u&X#jtoN~>W!`7^7)m1}x89{)Gu?12BYHP( zr0E~s1XX8Z_O#(vXyjVZM14!kOM|4iIQEgU)9sl7Nqx;ChixmzwXgy-ub@fTqR&f& zTwxP4RMA_qKg?cj_qBdJZ@sL%+;#8&qwPDOqDr=Q6+{FCRFY&+5Xnl;peUe30m(rn zgXElPMHGpWGm=H31j#glfaDC4K|+(8&`oN>tDgJj&fKx*{WEv|w_L8(4bACus&?(# zwfFaZd!|X*q`6%x*4uS?qD?0@O!BtO^mH9+H)t{?ds>;zcq2=5s^9uCgFZ+k7pz{S zHud+Qvbw>_`T$KGE;o(nPL4#Ef0ZRsIwN%!y&(W7@9QvtI==I4eIZFgOIsVeNO8Wf8YDIOs?5f-|a^<;CREG?_r#|!~15IS= zR1?Sfu8OH4m~OcxD>yC;qNX<4yY??`Vcq1Xwh^*eSa*3`Ag1MyKd2nhUFE*(Qn8Z2Kci8RA$Pus>gE;jHtK)>ts2dUl-<%j z^hR0W`qEFg$jxmUNL9$38FH+iR;1Q28TWNzc|4PXU!t03QutXWgzB4Fs?Q9mNcKu@ zaRoX#O)Y5sDItE=`QsCS=O}qT`q0~En0p`#Ab~t2!C~EFxBd=XbhrqX z_oJqlNd~z|(r>o~Xnjd;f zo%FIJi7R3D$zm{Tf4(+}zKHLaXYB7EkqJ$Sw$6EO)T^cVtUQ{`X4vDBJkC|(Hc)t% z*0eDU2|qqWzT2Dj)D2_KF+A8(-&>kO(Z2(N9r+!i)j}IZTJ;UAD#|$YAD_sPU5p*d zZbaQUaZOS$&}q(XKRL!-NV%Mm&r@znGa?VdyoC;Ki3ks8?0k`C6IqjY3Mt!l08ro& zqox6uM*28SZ1`?I8m$vmr>HyJ)}rK@zp;vl$nyP0ZL3rq%DeGlvtF5{4ld9Goo8-k zp400zB0G4-OYHV%c-q2%hTSG#k||gICsjAF?%#ZmC0y~^_GaVdUjCnRK>v|&{-e46 z1|4$Cld6d^%5sGj-Ftq%Uxl-O*E^a9;F{`B%2P4V6;{nLrL# z{@t(Y@gg}Z#uMtNBrVXw)i_w^W=YNKX-4i~?-mYnL&*`N$BZsL!9Eio%{D$qEhTgq%!Z?*uic7qFN6Fic$J;S}v@zy~S5Rz)0_I>e7S znkJNbV$wvSfHg;|H_syxC-a;dl{?Q(uO{M4s~?+PgsYM5@CwjJw@1J3vR|tpqT~Rw z4wKce#X2=cXCNVz0`goMhNC?_Jto8;*?h1L?|Gc(?3POPRr)&IQJ7rw6)*xTpOp$j zxzs7~0{H|kX&Xu=l8fAqj%Dg5D?X=B&M|%5Q)oeE4Sxly4IKcb6vtYtT>d!i?X(yF zgFzAX#43Y9w?m+nAgPe5$I*m}dZjZ*EQ#>*@nw^3RrEgZC1UX`8{|`ApVOqB9y@b; zAl4SYE1V~+y;Fa1NU}U!UaD5*;rp?N%M~B)NcH3nQUAq`Us&zeGXSd{r;612w-CE9 zLdqZ_G333K(E#*bmO-9T%_J9Vu8S}gEz402oNbbc>o=lkcov$_7XR5pH3lXOIfIqL zX@@R?l&Wr_vRQlTt%B+Pa8AB;ZgARtXxeObsPLKCljkI$2qLy0cd}{ZaVl}BwZ7vz z<#gGnhFr*NzgVKL_^I>=*-fO!FSPYmP?B~#){B2{b#~a#D)xtZJJn4k*KwqtHg=)@ zTQydz_d=7_BaSA7l`gDGS^1D3P8Iq+(fl)GSwhhz=id%Yx`=E3l|MY&Q$M}}MM=7F z$S9`+oJLhja5el9fNnbF_NTuCK@N>-DDMHlItIgD4-VX`8sBz=tpM+l{0OSB7FduPiVmo!*qTL?Y3-l8f!`bg=2uc_7xu4CAI8PbNI0sj1WoCX z&U8$v&lrLNV<+erR_?T{+F$lyPH)6DUkf0MukRP78}*S*?-l834=Ni}Gy>g}ILncb ztSc;%x;`8FcMdyxuI|j`4r_G8bnOfz+hk0U92{VM1=3h=51%@6ssN#gN0L>egW{bQ zJ4hrMS?|)iuI0mz-)p@iI{!t{`A^#g$)C3}Xwo{Kr2TtyksQr)mu`|mHoqTV@iJCR zL)>Ti?;riwgeYmbU)KdTriP*qa4gK4t23{#+E^)!t(R1}lPJ~ho&mI4t6dHzmMPhnx7OS0bsA*!V--ob0~7cnBo2P z(J;^XAATz}OR&Gce`!W@e+_|=Lgwd6aIg8byvlbScnVV~cw`m`=Tj>tKu=er#Qo>v z@0RE{X~WXcGj7AS^K%6kj3>w{4f}JkuQ2w4rnIDxhJ@a%`@QV?7~u(jad-UJz^J%k zp>_74jdR&780W3lkU_{R!@qT7?<9~%8k}vI-cO-`NPr1j&Yxx_|N1ZBm*uWE^my9b zz)-kGKejnegc{ekgkF>Tq8B`5&p@t`X_cDg0s;Y7|LxvC^Adk!05s)6+JI!nwcM_X z3!~3zR(w)$84$P`(<&7c53c$7z4SZ0sKV&;Gw}IueCxjq#x29IsEGco&y<@{JZ7EZ zSDa{4fo|h4sY?X{Sh>y3_Ywr@b77UU->zQ4c)Neg6mdw3$JGGP}o_lHhFE9aTII+N-cO)BQ z)^s5)X&9EaBB+wB27XsclD7HxY<^=32l5_aC^8Ii7I~YB()*rQdv{zE0PgN-82}i`9S6!xlfC;pTmgHy_^n zT}!XmcuU$*ZgiF)U5oXtpZeuTQg@`5K@W?&ihjL}ZOJfyN|#8*@6XA<+4$@naCn+3 z#XHvX*3|Ba9JwxkuKH3!It)&7BT`S6KMRk{6TBtYZxAC-Y^(lGa!h~n zw|)i*!eV4(yb>z2g5v<|=7gRK7$_x+FayS!;;~;aM%OJxMXFV8Z9|nrh7P=?NWh!W zvJWSA?|+F%{t(Lk?Y9hRX=ll2D!frd+BGi8RZckgFK{aP5M^Cl=L5~!H9Wp^bm z^rlHi2rAP7aC6jPfv#+0P?c1Ayg~ zsor))wZ=t}Rpq^(MH4;7)u8tP@{Q!Ran}a3<~C_?$Qi8Vds0w&o2q4^wq#CU5$)R@ z7`RV=&+smgL%x3(!XwUX4yF~nbKYw!E8bzCW+Uo;P|P=6dY?6pwB`N<9^=glQ$y(u zIyfTg`S|C_+zJA!Z-URi?L`RM(xJk4Bzzk0xg*O3=f4I_EZIx_QxC`@wMp6e9>MZ_0LFZRcI>Mmnev&nmh z?Ik81U7t>lC88cdgJZa%hb;vm8(z0()GUr0jsrs-G4D{m`1#Y+r>A+_u(;q?V5~Hs zOs0^jLf4X)Dg2@_SH}K^0iMg0dc(ik>z7o;zg)GmSoLaeS%l7O^K5Annz`F#O}}$B zE{BlsD*TIp^}^=t_3XOi)>`+Sh3435W_jx>D9{QNFM?Dd|7XEGe13nEwA?f)H-{C>$ET`PV%{SX@5!~hJ&4}UYc(HrA3 z{2LF(aOn+}{ct9>Km#01UyGPweQp0ju2TOY1eLW#OSk|?z}s@;MCo7Lsx6KwuqC1` z)O-Zt)kWjL{ESGf*9i``!9A6D!;m8IBg? z8~u7^$E849J2ikX#zx;TVr{fEp3#YuSZu!-P|)3JRIzcLJ&T>$mk+mtOce_Wp(l%? zBl_(a7smeMC${rM!dJX|i;Q@HgjuF7dC)Cl;Ir(Wt5sFaJ6%3Zh4~pPRk5gd3u;xRdBNc@ z)9CE64QoWsJrVLJ%NR%S&o)|2ABNnxL`BY)1`)9EtRF2ki=;?#C58`FM{Ag;)LASU zfJ~WUZ*suS^6FvZi2V8(|N4!R=Lh&|1~oRxjtT^v39YY>Mscb6YbUupjyFVNe+W)6 zgh`AI7uW(vgAk&qkQwe)G-(%__12-FqvNusd%n&$Ugue%mW|Q0{h&AkYd~3TIy)E~ zGp~77*irnQhr#rK7tSR~B}L;<*hPX)b%cuq1O)PY$64~R!mYza(+nmZnl8KIWJI(g z#zaM0_N@CwKq5Cn)YYb9F`maHLX?U>%Gb2pK{REeJAyfOQMKwJGajL0Qmj^$Dzi4| zqeE%B6|ukPZzNy?x*IX(YLvfqRCtMpS)Qu$3YP9}QDmf9M$y;aV9@AqSx*Y8`#u9Ac?v%co(r62G((j+NhS3YI6VpnpA=q^? z->A88MzL!O+&}9h>ayWfP4O*tnze>}8`c9`vl%OE1FsvKNN~vl{QWBh(t!A2tAw_FF7*au){uzsJ;tYibo(<1>;s0yAmF@5`{4j z4bpG}&b)h(UT!*QpD_`2n#e25byMlZOf8^)8@E2x(k_2!V#YQ8*;-l4dba{zNxH3> z<6<3VErc=U)=++_@{*&0z?B(S&Lv?MtYsM~>AQ)KJyja-HVt$oXy5#=Bj8L$$b-m} zsJ+8o-biXmmr7E0jX_voOLKGEpv8d6)(?{s^DR|grQ|Vwz?Y=z&$l4K!^7Khf38fc z=2#z+D9};sPGHiPo>c-QpQ~mA(p7Vx;kd8$yzug6bPg?R-_!Kd&pi{G9GpPk3o@Q zrfe_U?#QjI_Q1t(piH^QM)kdvkD5;wY}Hi3w#9sB=2#UTQ*EQTw-Hjjkqb5H8bg|{ ze=hf!_E_b#u_oDgK3T1A+I`sL24EqN+GA@TSnABa@<;{+&iG>Yk9%qkhCo3?SK{

yWdPSv!``SPm`|`kaNZ8*X+i@A?W%;4hvnRn7cy_(ieUlwjgI5HU25n zB|)%8ZKHZ8H1i|&ikrEX)+WyW&e`3#Wtei!kY}mmaC>zB!K%w4f-Zizl)ZGzdPj|;LId%>u>?2@YUBZPfiI=ape)Hq5cM)B8TJ;$o@pW8m zlcle{4me9Ld3!D}_%d&n;py4z17~3ez0c!cr*Ftl6HC}znN3?A9`n!agk@SrKU6w? z@k&0aC))8=;N4|a=9d83DXpePkr#Kazg$eOnc2y9W5RuyVg>FnUAHHsrt`@mdSY_h zrxd6=GaeMfJ%?kLXm4x{Ss0Uf?78dLQ|(tp6X`tMT@MP6t*QH=v;Mfs@`Xx6#k9NO z;U21Y8P(iyr^IoD%MALlV3>Z7uiH(f3>MW)D;oT%XL0tpkg);&ke&CZ93O<+ zZtSpp7r^=DfHHvU5dq?`IP>I95$M(0Zenn9LWXLfFva;RyFex0MXg~D($iO1zCcP!LPqM|xdd*CD+o8PZrp(bG$b~IoC41pc@qaNIg4vnY;P^9kK zuzc2%a5&-=FJK*z+i{7GYqF+pW=B|0^w6UoZ0RDi-Z=R4v9HI)7{K-r4giET z0lU@2gk%7@>Bob679+iHT;x#8Rse0PEI}KHw35jLPZ(EEM`j?j5{F4fcQ5=r%gS&D zDrj3JQNw27d$E0KK4{B`Uq*f7(IeT(m80?*)1?|xb%&H{48E}{uPHc8MnEtrO1gPcQ)L)^2D5gWP$L#`ow4C|kj zR|)bt^^7Zy10ErAb((`SVcMjg*sS}g$7_R+?-7j0^6RCxNR|pp4QMOhK2NS9>{$_a zVuyFKI!a2ouqPEq-_H=hAu~-n$a&niQx`>!;8n5nVUpQezPHss*K>USHfZ51JR-{t ze1CbD4^ZXF^hU{=fN~Pa6Ao4`Y(z)L&^Qy82QZk^!wp*3m z?27?Dqn6~a~d`F7dYfd$LQ{>w^sdU|8WW%6&7T0AHK(Mj(47n z+t#slB~C66@>iCpIJqz0SCbsX58To8GkpF$Um;m!G6|O3O}oI#{;hioQ0CbWSGEyB zH}2Ur1t_Yf-4(9U38fR=h*}-A2ke)(W+~p9Nt-Y3zyBYxF4Tm>A) zlu%XytkZVVk0?dl!sm-$aI6=g!<*8*)A;wFp{FM-kNl=PwNFL7efMYC+u|5sj&fUh z`>YJrXpgyiJ#+!246td>0ij{Tji8BPVuvYDWk=5kfm8g5&Dg%V&MglO7tO67%?hI< zK7mShgv91Ev*AxA6DiHzrUBvN=Hc^58>)o(X?(V!&6-yr6*A^botfStZcW9!)rz1j zU3f_>`5=9G=V@}#aq|0-3}yI6x0wM9*+s!TRBF$#5IYUa_@fJ+|U^Bz#h8+3~zWemRa^?)ILvG;W zv?q+Ss^%4py9%g(w3CFn+8uhRT_7ZkRzCD)3ZXVU<@cmy%2vopmD$;a;D9KPX`l&~zgoWyrL(giuGWD$)L>kXH{I zQgL$7YUF0vm}~xKT9^0aft%1{)N5k;ca*%Q@v%kN#}e*u2g+qDD3UiN#6M8VdUQ_d zjgPe=#JRY-&%qSqZaoMfqGmij5mY9k5n3Ai%32fpE@CHH*il0xU(2Lrd1@VprM8Do z$Z=6&doj_wv+z99;#T6SfX8z$xu=sN z$C8QUoHe{I6Z$CyPupyGgHKN7d#y>0&e9;c1_Nr1G zVO+(D;7Ht&yqZ62R~>!R{-wE}4vaKYr;CVS4oaNdn)59sHry50EKE`@d`^jOoq|B^ zi@SqeEp|O)?``*eY$i`9-!?pWsi>vfGa%m6Raa>_M1`^|frH~%e$SrVK=!dwnA}vY zdxSN;T=b#X*n+Q*K)8mJePIH_0pNqRwH`}Gzq{^xd8Ajuy1!Oi&3&sGmichup-tYv zCiIS>H)9Y5_qziE@^-IPg4?$BwW@&Zy4-v6h@E!ZvtoB@ZHfEH2ZfB?Zp*#|5-OC!fJWebEQ8tZF~#-xR54y%hsm zFpFubgmBbiqOI|Cz4!Lsw68qicSNo!Fm%j$ziF4xux-jqd>UjH*BS4|ufyz%+1>0GJAJ#B$nu@Z*vU`lGVzpi&W2z^kB0qk)}QDo;}H@* z_|DYllMz68&v5s%+m>og+&s!Q^5m9t0e$7joNKIx&*n+ugWWy#+kg(u;#8_XE|8LN zZu3)R1ODdf!9&5mSV3KK_B)6!L4(MVLqx=zW7L9w^w&6HM^jey5AV(ORTIx|41IW{ zZ&THL*l|tb>ySmYD_kNc-_U8-1!YZW4BxQcwMlmspI$9OepY>2(;>0SeLUA1n#eTJ z_=?~`wnE@(#L!uvQ){nudp+VZo5_cWW{k8fkSZgRg~xh75{j*_aazg-hv>hOE^Kq4=7a+KFcI4pPX;XE)J8l9rEr-L9TuK5B%BWS1 zRu4Hz4vx+!NCgf6d@YK#)(=5!I!u>a`&$XdNTNEdQV? z2x84j*U&?|yFP9!Q@dc=!|0@w>r6FcR#Bc~2hML5oAn@Sl7}1}n8c9zxwhkLp`3ph zkJcN-dZCaoAhSvT!zAq8j~)HBBG~8F64+Cy)h0k5!nz92&yJ$y4cF6=Ych&CYdXE* zpT?;MBkkvW0TI@Xq{io9`?1ZeH`V!A7G)dlV!KZYi2~B(oZB=4F_MM`eeVH(L*UzY zdy;}PRTOKCT_})6Q2hRWV?s~xM3!+!C(W0*+=96^lwQ!tN}q&1=}}Kk;-X@flc)oe zs=>zaIM_;i>+u&l+Cg*n`!A2Hq1!rd1112|I+zlbw>+?r+sbUkbD)KXJKWG{DAQ{8 znBUSV(S5kZCSwHoWq5D2hHe_xt^Xu6mfce={ZLtgcFBLwB0MAD4Be+j!t$QR`|_C` zyxi@Tx0?z$3f8i1E#X1;NQ#Nf8zy(xw@!z*a#=(@EPrgp6&;Hax!@3Q)a;K|mY;Aw zNXb%4mQTIyJ=Iq48o4%O)ErZ=MQM3h=h%HXQKVaA5W{K6>bbkd%b3b~>SS#$&y$#T#&yM?{BExdOg#fXrsWN_rCAAm$1#lcY&*qsF7%^5 zirpO#E=w_Z6RZiB05llFo1oa^kD<=QIS>sz*_Dssh+n$1oM=%X$R5`WGTNwWMC8ThSfW5yQDklY#Lt@Kc6!MB~Zg?*8UYL(??xfxCXw@w{e= zy(xu^VPrJ1gQg=EH&b`pl7u5I4j0G0O`2M|Kru|?;HZ>X(L6@u>({T}zCAKBnTefl ze@m8UywEd@A1N(&zbf zy8eQ&=Wfzk*p1ht{}aUEh~bZ9VZvEJ^yE33KG*vK@Ifb7Z$bktw4TAf83QEnK4 zZSV!ZE~a{+!}S18V4XAjPLr*{7CyCKWqhHBp+|efb>Snw$HP*^6Qhsrw(hRH?#Jbt z6ECiD3p_vwcytzZ?>(*gY<*=2_YhKCyg5S*(45!6Nv-3M=Wx`*$F&2cSZ#$CYC3ou zJAa;u@QFqNzyR;T|#|*5_hh|>o6Moj}FWv&tW<_ z-fzjP48RiHI5&da7#aeu>1QG4^7eJOJ%>Z7% z6F@QrN~7O4y97NtK!@&R0j1WUSE5vtH?9YqGK77Ga|{%m5%I3FNlr26PEK*_M1~u7 zpd(^_s~^5%+mo&at_1J_5{rfzP^=Hh6J!Z}^BsO}!P$Mq9t7HsC6h#SA{+(dWv*6g zCC2vdu=SD5HARz&P?m~PqgEyNy0MIO)Z85*B= z{$Sax-nGa^+)A8a-y-J`<;gbg>MH!F=q?DF#TqOGc_>FAjh9r4H* zD_;1+WgWGFkwnM3oef!=vo3|+JSLqtZRmiDGxr-}JJ32h3@ z?qZXC-YSDzNh%xZFB=^ygx4`s_*0UTTMCx?tRdRPq)92=2ZdV!T{Y7tS*IU5?U{Zj zwc2_0@I~$3No)F99}?e0jtW5RLHp8tH#m&6ld<=k)l60#F>E%_iXG!&OY`Q63?~%Ui|b%t@7#)tjG5F z(1~)i_~}c4IcNuh5hjSGzU^<nES5<-B zi55ZkEk)e3w}3sI9MRM18+mNI=i+BLRU3PE12}80<}0v)coVDSx`nRDang~ZY4a&t zHph$+NJy@5YD&Hg@*|I(l%)G?mgYU_BcH2Bk?}8&Uk9w|8&-y+v$pu;owoEbUhX>y zCA)zkA(6ekmvXwx?f6#WM(a)v?{?3EohH#Co?2eG^$Iyq6H9`VemeC-EFDyni0!pl ziD#*1;cI-;l0j>Od+{%MY8OBGAR!EKniR0DB30c#3Yyf<6N_V%y-Xs``Wznb9urF@Xai|;u0GH)b~!tc5kdKRlkavUA75a9 zmOLow)Y}^L4Ri0Lh&v7+i4-L-CIn=+t7EL3Y}PbvT;GBQ&+S1dFM)E(=G`Y@NZNaT zsT3-Ff8|Ltwi8e@cF@m;TJF4)-3&*3*WzZ?|RO3 zCdD7hHvrFF18p%$YPehsTsNH%uUYoV74*xEB6~^}yK`&6jpKHA#^*wRd5N;pYr&)W z#q&dW9Zgrbe|dRA6>EjjX?3(_wX>CK1R%uWykS z&N>V0Enc>G<-lBCH9YFgm!wpYBs`ZIFZZ!%)xM^P&XIPYT(MDPL_$Zi!iJM_r{flA zU=HEXtGtI+qIb3&i9(+i2WqG~P~ND-*=-mU;dQ^>YwN6!PFjyS6F=j`-5b4UvVujMl_W3BnX=k$I~&I8RuKVDvj>)Lt}QQ7sn` zyNKe(^=8q$)&QSLYciE+!^w3=t$pjI_Z2W&_RyL14J%c$#i!))PwcIgrL*CTW{Zhc zN>1gyV+RVDYGV@H?^_wWlSNsI5FV5GPsg9HNG|WCMBRKO_GtXgo8#`=gp{=trnsHx zXjoiUK_Qszq0o1l>f_Ics)ZAZg+mWwyw_vr{WR0ki^;+*u#O@Q>g@>kIuc>3avvmf zV!Ntw*9&IX37M>7zNX$euKDn#pd#)J6eQQ$2zn%~UF|*TksU&2P>{k<68?_Aa>vh* zN0a|`v{*hj=6)dkL1)hTEH6APRXW$7?dOC0nB87}EQzM{r?N66k1ZU4C>`sYUeD2c zxQHKY1re{V7OAix!$^mV!cNOwtknv1_(wK|xr;P;pnQdQfJXlMj;EhtBkts+Qc7d; zb=lB25`)PT+!;A`atXL`eiC|x)O%8X`a+UQv7QZKac4zH!CM3HHt~P`ZIn0hxg|th zip#@M(8_Q?EV@yQhT>PV!Q+>IKxW;j5eh9~fUZ0k2+H=b*@ ztM`AowD&F1)|UaCjs+jnBfL8f?{u!q711LKTIL`3wJ$1DGjopv{ukkF1wS}v`(&?RHx&!$}>fuW%S3;w=KVPuw4!=SA|GMi^`R0cobqO{zi=wtfSCeg`*v|6^9jsMVS7&vuA#-o83}xs^SCe z?hR;>Nra-H%@_w9xo&0vO3RVYV}<2S)hMVEgj5w?UPbxxsF-%fnT*wftfz%n>-vLG zAbt8EXJakCRP}=j#MqE3>4UE21_8>Sf=e$PUQci7Vhb&(k7CztDSWs)IpWhs;P9;?+)j^q~r0;B_X zm%gY^-#s)}I1ZYBB;!s7k+S~Kxlj2k>f!%M;wXG4RpoV%=}rl6tk%o<;9X{`GfL+* zBf(2Xs0-5Z^nuv`AS2mK^sIE;GK1Q-mh_3xN~}Di*6taqm64CgjQ%oh_5+YjK^1>D z%0z&uZ1EjHUALE6@XpVjVBeFT(yQRrup57Gdp=RRV8fPG*kRu8qqMYirvCWr&J%iH zrO2+t3Lv1~8{YWkr7urwiD?%bkVUs!L5GB_R&sH)H(}~Juhz$1-v-3HkJ%LX1_>YS zA$;$_U>1okw^dZI&j*nqPaPSv^k3Y-B|MbqBSr5-l3`bqmnv5wlQnza<|VTeq?KJP zx#M|RjuSz-^R77fvQYi=n)dR;$)2{tu$q@md%fz$RdU>&zButVGB+VQOh}wD1`rL8X z)+YVwGn>-<|=&KXZj>tX}mIE*Q6`re#*wSe=h0^K6Ky~w`itKYiRQJ2I@Fz z2I{FJ;25*EdVqLMrVFALO4*lHQ}A(RK6UuS!45z+pI;s;r~t_3_Q48pM0J#?=>=HB znw!ev$LXDh#oszLo8~2spTGb9)G5UdE08WMESvCZM+PyD#s$3s#KR5SsC4tW-s<_5**Kz(E7jb#u z-c{aRO_E{PrOnH{pX;Fr2X0}vO_dTD6%U`p2TpLB*NB^%Z2MfdQBC83vPLQKLK&vLsOhhM zNDDKuWt$65)cXRwVu*YB3g6WMqHbzo%Y5xqzy#qwSz7kp?kwF(#jVq{sae-B)1gXm z+Y`5*uh+0fXM#mq)zm68`mB}gGEy`po2c3;Opa$(%Alrbq2^}+BP!kJD~9Er*pi`j z<=&Yg`WMIc;^MC2X_s2q>b)udif>YT8pLjXU+dr9yu;7q4BJeZnL10)id`WmXFK%0 z@LKB>o9o``E!{VxBhS1(czc!9-I!SQ0ehw1o51MF%kLUbH-aeUlz+=u_FzTEoN!R@ z79#Z89)Tavu;E2C__RCGa%OoTC#YVp;zx6k zJb(r;zwBt51Ts94z(vV{kR(&T#wEK-;?~i)Ewl|lc=c)$w+kw!0K7!7;zZO-E4{kR z=?M^jE*o9QfrJds85=AwuAFFWn`1{S`JsG?W zTt^-|5?5Mg_VDaU9oB9X<|&2kHN1ZnWZb^kRd_M5y{luw{MFu&qLUauE;*+GTMx9i z>Eb8zFAAxz`xz==hD%%^J%bREX^UuH=zyfkop`xVuJB)`jJ-L^7>iN`Tcvazz${uT}*yJ9G11WR{W#L;^`uP)!C&{ZvTtjd9tjDxY z;K-?AUb@-B*Ii!pR@0++uLd5DI9oz322A6ON>2`&3gG*AP;emi-EiTURRZbu2dPt& zOaOnT6n&oHv(M)3Qc3sztE?&vP_@|N_h}|wI$}?V!sz%F5FS-FR1-*tk*N~9zALce z^ZEDh)AFNskDSfcmQpj_ww@`~&;qecX<}DCR1w1M!I+pExQ6;2>`4!#`@lK&8$&WZ zr@77rYz7x)2VFq*KXWU2i!tN@(otOE**>unMJdq=Wp+Vh8XdJzGTJI{yqXU(S;j2j~%*jMbgT6^%d zC4Dr04~UH19U(qzc`G$Q&wG10md9$BhGj;nsfcRIC(jAKTkCenC`jn*n9zgxJ9bg;d&J_9+>><6V^7j@RPIw#!g$@oA=_djTbaP^y>vz#bs*1Tn zQNYsTS*6)*9?1HB zaUX0~aW^8bG~0%!%7(rJbpheeV=6Gm5&e(_P}mIAskWKrlH7KyT3yqjr%TyyWh}3U zqfX5V;i+mTJUO45P-ErR*OOD%%&{(%U*ouQ`Y59%VVA1iMY&@!+p9_vpPYkX+8g!i zBHd9&RjS@gM*cU&8eJ1Mo`a|if2vp0ZzgVw9BRST8}mVF|s5Ds)$+Bt?)L@m-Ug$yryj+ zdDW?a*ik8!;a?s`y7%=&t!e;}3JFK<-rZIrYjlpPsc9}_@ruEme+YlWBWV^%`de~* z4SiDxp8`X;sr&vc?v+=27Sx2pWfih?p~TyzdoPjVgNLENxb!5SA@!S%-o=HH&i@WP z&T@uF%$u^SOpkTar!OB?(^FHkQ#^ZS;(9N06NK$1A)q@ezNwrVLSg=|UM1jaBjab}iJNtZ;TG6dbI_d@ z(ajt)2(73~+}kV658Z4U`rcE#soxJ%5j$=Qd2c92zz5v%#0BvGZ~lXL6E8tg)6i2t z?R&G0Q>VItpzoH>F;RkFHGq_9L42ou z$NMsh*)hBGhB0TBO?}cqXME|Er^&nk@WfiOyP!A5BA@{ekp__K5dNFJ=zSy`=b7d-~3ovMi=n=3M7I zUoVbls+>X?+mr!b&)p|`@2r=fC367kFqX6wH1fhGL9kUb$A8UfX8^eDFRfAM_C~Lp zv`0O7OTldl2Yjp5gEB)1)7`>zh2 z@14i2sRQvNWoY1L;HHk0VKB!5WqZ0ZE2F2sn&?jz^}qTH2>bilsB`-`8%U!?jDNGQ zIMcgz0UFXQ1%54Mi9w`Kn$njzqI50cK(HwF7IQx2?-W`D@?&$J~FgPAs7>5tVb+F@*B?&UOa!y@h3_i7_;UWZ<8S$%)uNJUpPg> z1m<H8K2x3Nqonlf zQ-5JCKAqW`(Yu=WyX*zSD{v;LW*g!IB!ZEI<@ z-jr;N)_^Acyko&@!*A?pkGOQf4e}w&bafLEe7axd||LVa*A4VCH-HJC$W%WP`a=w&r9(#5aVOp5uUrIOjmv0 zY#|B^v7am21U*N>HGVhVSO!d?ziI(syvF}L9(p*C@ZL*6E#w7n4(8R-g?}%Zfrh=y zfaV5(172}|5&p;q`@b`?-#dWofJhl|23qDQ9EXQ-8EG0aY%|SjX&NT;0(q7S@c4L? z$lU%SVv-C>@YSq zhaecFZfbZ`w&!1lG*Hacux%DGvj5}hz0bhG0pvKIRK?|EmXwJ?PcK)NzBxK%(sKsW zYgTk9EX?>%9~bDJo&y0CP)-B0U)#VFLXY2E@j`4YXF@E;1 zuP=tUb9X^#o!!x??v4iLb7KC=a$@h(D9pI*4(D`|A@AnYnU-fZ%!qcO@5V-XC*x zzxad(&$D+w)mEf4g9#P|!(5mwZiZRv43h)+lb^|PTuRu#B#Uv3r5MC7psh-rBa$Bo zV)_vzLG1(@G#e2A@KMj6dvTwEiRm7g-P8AmX^Bn4GN&jmLo_ULZ@7`K0 zP{9G+(u50_+#{#~bkv{2@Y6$p`C*%#omI^0%xmjK6$NNam+TwtA zi@=SN2VoAd&Lv8<+yXtB*Aq(U&b@f#2b_KF$9%m1(%vCuEVnHBQ@0JKeN3OtwGzbw zXxE|G147pX5$kFWgIWcU5Vvf}RjbJcbSUWre(P(DjEr=xQzg!cwG-tPG-7Vwa^c_8 zCiw|BbxTc?6;f|^0+a~FG;!7d*jU-8$pH01XKk}##W$S2W)Bu z=YjrnjA>Vb9FR~TaRI_PROnVZH%@Oqj^Wbh0<9Fn0sKJzz(KIhC`|ksNK86Vd&0UW z0cro`L@0B`K#iFut5&g8gyPB34)=j)i-MXjNEkZEW{gKX7qvaPYZc0FeDdPH#?3ha zN6w-5My)OpqMC(Fr~}p6g5(M#WxzqL3S*DrW>@1soQ{?) z;xB2%=NMv+KyKYGR?6T<*`QT@0}y2@p-pj{(nmv3og=_THozl4Y4FgjJ#37PWR-LO zJS^%uF5mal>e)da_SoQroE0F|1~Vztf@Oqb_C)4n z0Q4{B1&S_0cc|0T_UqAP=kH#jI9)c#9uylad~$4lerYEKf}jWCr9Skj#{YEn|M1_~ zN^DymD83k&FOojJ{q5^lB?OrFQPOgV%~;-Rncv8{_fpCe&YqExVY^wk-lv!*2DmsH zvFml$`m>c=JFk2G<9owv$(uM`~44edcc*@z2h}GJ;Tu27*DUITmv3VYki=aE zLZa2;wTd%QK4~uukLatDp4d%xITi!b$@|c+ZTtdLA7B%?pEDA6ckOy4cNPNNjxdzA zo0IrGDev43oJ^Atf>$xjw0;r08)FFTEH>~QA6uDVFqS5K-=7d=HwijxyVA$yC23dEP2TMqsIC zG3N49NjLl?pTqES*~@lz^0hhj>7_q&{@*?E`I}@{DOahYRlZ67p@bsy($2wkB7giZ z9b^9|*^RMFj?c$nj@IAqiFtqj#CsEl7#@g@+BMl)7USSn!<7S9ry;mggTX2f z*J|wvc}3GsY6C>A4=ra%w0^B)o$KbO<y2$s5l4PgV2wlp_|lOH(u+g{Nb`&ZOS)cIN?)IxE^b8 zrGiuaLFJdLLoTtGxOea*=FWOM1i<8-cN1C|I7cYZEU2rnb%6l}z67>g?Z*oePR|xT$UAFt#&>yvia= z1%ksOUlU<(hf2V5=^Aanxlwgjg22PDWgUfknULhjfnlR#b&OJ%c}zGD*oYzs&En3F z-L^~{gu}h+!9srRp5^`}JUYOqf%^zb`9BsbO-Hs(+5= zzgJ^_Pa3kHJnzi2>o~wDa?;Ojq%vm0-YO%MrahTI_8VXx4sr;eE=Dw#z{m1DUj^OC zu+C~#y<;-&X-5Sug3v@+WuFG%a;_tNFaVgjXfv?*ZVSNOc(GoJ;f!t_U{|$s2kP@G z(3I)^bOfq`A5I=BgD}_a)15e!vuF^SGee7v-^Uc*L15ExKUAGSoKknkwEYn<_q{(S zx$d?W%d>+$XwD($2{QnJUIU6Dv0Vv*Vw;m!LaND-LXwZzr)B@e3rVUg?vxwG$ zalz@a1YG((e^psy1^5CJPmNmW|vu-3WYFmKK z938j5Y0%R==0?(!wfXLuvw*jx2CdcOqg5voLlSI{`_NN}qR%W1tfW*MMZHv;IdR9u zh>!-*hb3Q_Wdw}lVVlrzD+hfd{uLldv>gdE+`@UU?c_0wr=*B zTnQdVB(Z?g7OX--^7l_Tz=ISf$NO<`U?%DFZCN*?3?*B!Y2@TRfU6saKM zjf=hKWo&TB6(B2_dE91q&4uK>b}`Q?+?Efh*m&Fl70^a}!>A1#TUM9Y%JaKLMrEe8 zf^^hzP7@$iGzDBZf#x%146ok!?t{>=JXwyaeAil5wSy!0$_K1G2)Sl*zrQC{3Rk+4 zScyC0E9T-gxdMC75y~0j_>8oeti97HS%9;t^d5o3DtBMqF$SBxCccmWiIz}zv8~E= z!oz7q?*#RC2GIl2fjm7F7HBniE*I*QwE-3(GWoEnSuS(NqrCgTEzEkftXs%?=~Jte zYv1$Qa1zZO7eHE%S(~$68&Rhz)uXMwcFs0= zC}W^BW!Ba^E%0&~R`%lCZDn^EcPsO7oX=rMgzsSz=jn6TDhi^!QOLICQKv$ZZQ!1` zLz(sXMc;7ur3(ALCr;a852}x}JMU4;)Du!K=Nb}7PFQ48*+Hq7!rp#%vu`ng+Xetq zV#SBDSDW;C*WSJn8y=(4C4RD{e;>E%v;`t~wrTs1T%Wyfq{(Id`EYP!9@dtbb(xod z5pe=?$*isos9JSn=MPA_b#I8H`_^vMMdR*2>+j*bR?Nd0@(H_QA&^g0gO|4N5Nsrf zVhy_EI*_&b#-7n?s-5-u$kVza(S5Y$Z+%9uy_0;|Sg|38{6}`TYzc+wS*Jta-P4_Q z&j8{2WE`kSn_Z-IsQ;lN{kwnrJ&Xg7s7z_Sv!V7*SCaG7l6-6B$}n;=^2pg~U_1SR zKoWq_Oo|xL3EM7oo)>T#a~>c}dM2vOcfC8@k7XLD1Aq>G8(|9DBNYJXN|ety!KwZx zfT+j`b*Wa%Y5D0A@!rYyQh6UW-SgGBjzU!XN49#LG3^WDwc1#IM6u zyC^LMTw!_Gu()2OuJ&=_=V61Q>*;rIy+8A|Ecm8`wGxZ0>)N5WFL7Lo$PQ7WxC)6R z!n_^b5H4=8daUvth%^Mz=>2fRUW8L>C)w20^kIP(kJ;W0L=4WZM%Y@W$XSjWU2Ug# z+q9Qa$bQNg|CxGk-6&wL(>FSpIpKK#eS^Ax48RAq1-3FrR@tCO65o$mV)rLx%+p*F z!7eW0ocpt6^)Xik8>5r#8d@ecVoe@|AFXOu`7!eYE^c5sRQ6_qmz(?SCpXbGsx!-< zJ-&ZCmDQ_Tr4%KTXx}m@fR}KC^LCy|-ypu5-Q;VGx1@o=YOz9t{Q6=mgHfhmzUJ9P z%&hn}js`IY;jl1?`33$=n(D3;T;Q!b^mMG~gnQ^hR$*jX8df+bTO6rZl)rq}u1vfx z)6%)QzA7yBt3Q*gPvd%aX!r+ehDmG>s>b29GojzG${KB1u(r0=E&A2HdQ|Unf*;}% z7pf!CCCL;yX|0DTw2Z8`s<&n-0A*Q`YxN)WzhA@(5Zv^9CIX-W@f459K;c4<2L5YqME#FAJf&&{%f94 z;tMoj`w_>+4k>hjtM^Z&dmGNPkD0eRxH-c1zqKw3jXc@m$epsC08tuux+D$+D-YzZ zO5zrSdy`3lNz?bxq?L+;J5`aSJ`w6wCsJ-s?$~OBLA_h&#$wtizBTDs^PsGfmNm;b zw}b>II~)cfq&l{-Hki#p3QT|g$XOdkAI5BiCe8K*6Ns*#rk$%X4lpm`1WlFt2@*&x zZY5l;H{D7mSYMf}L`__WHSEGS7ACtHs)2k7{i4+Tryoo>>n=k@E^BW zF&pV^9+pSn))kVs*<7luBIR(z^XVrbo_~as@TTYuI@-+3yvh8|$=^L!5H&i_#;gD* zk2Z5*15;{}r|&bjxiw}HDo)KHE`OO%=eA6ORnaN!#PM*Hk#`@HqQc63RXGFe)$2OEoj|ez@;q|0P3r%-cU&RBH_1i{d+Bjj^Yhy)=aMdyF20 zijPl5G5c)1(|27|*peLIBBPxoKA4j3^_)P+G~{hQ)&j)qcc{TiD>}Od-eT+VS-4?{ z^b6C3U>UFN^DrJk!2wT$)!SAUbDN?ECd9!kMNvz1uFD&u?x@41$$LC5+#)0!d%z%* z=Ml;9gmSd;adPrm-%RtA`W|v^syN8tRsN)J-X3I}9a0^2YA45TjN=1)!1a@csEv4BwW~FC^B7SuTnbmUcoh?fk@Uy6)XF zQGA$n5=+A@C{S)XGruzFZqR3czq;p;jIRG3^-+TCf9h6A``)qq<38F3-dU=N+pG72 zw=Lb%dMeG4sZTH@diFbeSCSc3Oe}{`r z1r`YjbR#TX;lpKCyOAP3Y%BD?ulVg3{`I!Em%Pen&oGCwDxvh_`Kh?5DBPRkoWw_s zW$)2db{Od>|7flh3AgAZ+r5B7Oaz{M+rVulrvI~MXT&XhBi2W!@kNdW1;z=fdY-!9 zv9rRGxzixmd$`bUZU!P9NBf=0DhZ&FgXkvR<}S_5eWCJU>+9>QvcV18IF4P#j=3;m zX;y)#Yf=$Jh*Y;Yk6wXSeep^FtteQVhipYofx7$uhDV>#UMwOFHApkmgSB&VGkjV(g2Bh{mai#n0s{eCT+ zX+D!Z8Q6hpyR?WMXEr_=ql4Y*(>D9D}X3B2ycc2Ww|52fvFsVW9)2 zW@bgOAe|^QZG2V4x&$R+@;y#O34-14Gj-XJDKvVsf`^l&2?s#L^|UEa3A-Yk z{<9K=iKV1Xiv{b|I>>0X?%F^1wM(nZBz~TBgQ$Car9wTGU?d_bA)~SnsV5}N#}g)N zngdRC_#Fgy07m`XkDuBd?zCYel`7_dfD{K`TS_W(UUXDew&cxAb1f6igJh(ythA7VFyMx25DiOcn+B;?kQvS&YH!}C8hVNtxb}i&iV?P zk525QRZnjjjXF%vzn`sp;dCfka}4p7BUJvxR)yEkAxW`=1>*~JO7T(=A96Chqhxjk z*x`J<0KW1uB?b59q>q3}akBT)N1znt_$CjNP+G6yZZz|N(zPdfTv8(Z)KBl#KJB$6 zr|%w^^An8G*I?70YV@L!FV+#>9L|rx0$$JA6{1X>6H;9L!jGA*4<>AUXCKLtRmvwh zC@ZTi*D-9Ei*6r*W>|Ws$TyfDRgZfp#sqHfw2(Zu7I>q&XmA&QEj0759w*y-^*x~h zh&?n@uIjqj`-J>HJ4r95;?}KD0^}Oj#l^)fjSbp4(#9ei;$Rc@ZQpsv9(xxc)}h!G zw=cqP2C12)^+88~?n&!EFZ}r3jt1ef^F)l6N8V|{s(uM-!CvaPfm}ddd9ygJv4eJ2 z4c=PmSjLGgkC_R)1HoRD*?apSVpY0GaxR*7wjL_e7X69&UC>VLai6;7p@LwbetciZ ztH(%41HU~JR^{)Zq8gv5_x{6&ZcpLl=cO`}Yjk==(>7UZO$NHUpSyN<^>nIj1E@Fa z_xXq&-o6bc2*OOw@|u;++Y|`|FLTYItr$ok4nChLvKuWM+VVVj6W4G6)kjyTZNXBoB9>{A_s1+I%}O=Ft{x#-~SYsR<=caiXI-0 zlZI}5Je~cqJ;Jf`$2XO^3|}B#^3aw=`yrQY>0_ZJ&{h4vtwMb-KQkny_$_GGf}WNq2tIGYu!xV#fEea8s746vVo2CNsr;xbMn z!yOGuU0vyY=LbrDX{mNQtIdIIxS<3<`Rj4=2qfHE@~^k?30t;d1n?IsWouGAEr zv{y?xV0lC>JLsvY@^F3L^(tOv{be&M(gt0vf=r!gaVc1L|_29VD1f_VZ_gw z*0|kc`o!oB>f-;h*WX%1|9P7)K_-?otiAi3=B2fQs|T{dH*PsOxx|3>$IM)@gk8A} z`Oc1E8c0Iz8fM=kikeI>X=d+j&p@h@g7DPz7rPkN!lkz2*=!z-mCbSO4ISl4q*d+9 zmoInhZZfd5u?=Y1jZAsfWZIgVt^9P0k>Hpyr^i!1PD9`K%eObzX-3 zQ9hFFGuF;(vd7@yPb=sbTl~Gj!>3Nl9E>+6T*_XgKskwc%vP zduHu1UXMK!AjGQSMm-+i>4 zz)DN_z8u_zS{*)}E7OiqJ!Xm)DQeg)(=yy4GOYE~6VUTkhxQ6>E__z1>?jfjQ-Pon z2<5-$VB6PKGIpDuerH4`Eh4u&QS0vAC*hT4Gp}%xTyV?_OZVeG2I5s854`I;zvT2# zeVmL~r-N05KcM_MPhR|HV`;Me)L0Dp&U&KrXhJDkL{v>ZdH^E%#j~%si7GpuRz|Uk!R?uF`rGuf`DQ!eR@Qz-N}M8p8AQIH z->DU~#0{k!xjhO(!7%}V5c>C=CI2NTFy8y7D+mJ}izBd$+0nV@paz)9|L#l&M~$b5^@&0kP&PO^jZagRt(4!o;?emZV8SXt#X)okZ{)_b4O$S zf#VlS&Ok;8nDYPjH~;bN)ETdXZ>kLU=WOHj>sTEuEk79!6dTm%m?+u_nkt~jBV!YP z6yx0%gVt;&>ePCqvG5XaK>^oM59+yrUT*3drw^xUx|79JV)=}2)fKNtYYIho^N6>~ zF#EPq5u9+ay0s@dr7v>2QrAkiBpd{<>_#-7m>Ybm&OK!Adx=he)vCR_vz*nxGc-neZ*Hl8m$sq$ zXpC5-TeT|sE{MtpR7zXd2BAYs!iFQ6=sxCS*x{H;{i-fXm*t`I;P%gF=wpWvrrxOH zlpB+Qnn7Ij=NDr)aRWI{=GgDPYm3;1)y8$7brmu5@vHrf-k$AUUC}T^0uO!2Ct{0@ zZ=FgibT{n+GaXj_>8qW-4T#xM;k|!X5V?aDBiy(>RC-R+!XoX|?WJ|$miTDRJ^#c5 zRD9X4w&s2aGH*=wJ3!xe?2&(%eaD$riH!RhXUGFX?1DmjQh2%ewgm68=^y%6&0dSB zC`LV4J+3{JL49?kHE7XW*wfz>e9$8NT_E&o*d5u8ULEJ~LWqnK3U~iA;HSAOU#aD;X$r>BJ_iO7Tbt zx~X&uaVEHU*G0Ymj1lUf$JCj9232>>a%T@e-+MEJ#c2D^pJ|m}lh4W93_ldzF+Pth ze?cOopCZp>fB56Yj~j?Puv5g2;-hNiJ=OV1Z3ixo-x1c2Fem#52Fw5-Y-=An^F4H3 zoeyk24-;Ryx%1-#9~j-$ngwkvdMJ?5ubu8cQ4_Y)s>XPFd~kGtZi%RJq* zMhxVW&U03?b8^-flnn$r#%S)@9PpcM0@cTjP(vq=T@Jg3!b{Zq{i_XshsEw=R zC!j~Nq{Y}Pz|UXWb4pSc)mRsXVmG?$~3q66J{}jVRREGw&i~e?qs&x3qaJW!>Vo2-zitoNZcElaXud5 zD;IQWIhhz4d3e-nW=CeiKY|iw1Y0BxGxXTetR>>nosxkaVO&mMD6DUC-?WYgL5WAV z%7WKC%_DkwG|47lb=YR)dVTqpN8Bw8T-k05o>TTEa5DwE_Hm2B4_zb37XMsN;~9HW zHQqkyer#gnQfx}XG~#&uN?libdlZ?|;|ify$t-$RD;2ou#%=6msZ$*FYG+ToaQi2P zD$nxVcl{$>kF^$ii_LV@2LA#u+RKuirawCR$A9+!LMr!vMb~T3O}6(rC4mv-JU7UN zOr!s@mH$-Y$H=IkKJUDYRcir6$xHhcmcENa1>iqKm#}Vh&m2gb75T0iix4+VlZ(@6 z!HhO@K8VQZ@Rfog8HkS4SPs-xe*N~X1APdEFzvR^u&!Hf$A)3*T#_oRP#oFahz#bh z`3ff**4Ec=NH@OlJ>6enSr#Hea;8luzUCHDKmBB^@@YA9_S4p_tpL`RP&MjnaaAkh z34efnRiNgtMk$l@9oy|(9)FfxTabt0OMRuMi|V=78`JExF;JqnPK`yWklnB<9zLT5 z+K{iFXGj;5n`D=$d4;}x}EO!gQz4R01~x7?6$bNnKty;swZD>n9??r8Gg?Q$s6k5M0InEznu?B>cYQmKM{l}vCxEG;gI>4K zI}Id(YinGv4~B8?V>`kM7WOKK_{PSAGYGE=ir7AV+vm6;5^EfAt~7jak4&fbRRiUQ z9`4PK8Gejy01?l_$t?Os;-RQ1giCsFSr6vp%Owth-moG_!#W$i#nz_tE+y%m*sHL( zlA)K#5ts68Y0DTa7&=P2H7PZOzJ{+he!gJN^h>e(Sv?*4B5}E!=dgwIvu$|S5vEK- zU)Ct==HCuk?;Y|g+lf~YcqO#ly&bd#sPr^7G)$$1s?#-^jM@+ITM(Ijc0lf`+J{K~ zl&?|p;1C-($n|z-a(m)^;F{F$ou#2=MV(%=LHquz@|wzSfhZzol0k{<)w4{Nm8E0 zjBeu&ikFhuJc}-lv3-jIT@sIJ@6l1Qwbd-zr0}(jV3;w-Kci4nVyY#XYJu)18lLD`yyzBc9)fvv5Se-4nC8@jKd}0eF%-p z&hFj2O}w^$F93g%%XfFQcxk8FVtS9~k(SmSJFcOVG_jgvRhA}zeoyGRJ!A$tw2qt1 z2NpOWiOL-=v+E~hIbNfIsMF_nZj)vBzKuvI?+T8@AK|cK#TmVsUiD!kgKV`F`#gXA z1RbSMttl>b8!KqeWm|gTSEjg$^WQqcs3f3_1>C&698E~y?v43nbbWz0Ppv7 zu^VNDa*Xpy+pk|vs5`;4n`vO!-r30qQyFoU65%=c>2O2Z;qJ2R?Y~B>`S<K zJDRP$8j1pn3m@mZ1MGYzF+2N2#9?K3Ub5qRjV-k)Qc~JK%OCxc!GmNa=vKOp(9RnU zQclT;cl8;NfYVm}qb7c`fKh$hjK@ zxD8iFgn$41h7qIv+qAI0(vMGkjLA?!O?+%@PdR+=X!eM&S47B>ngZ)AlP<65_4R{Z zGg?z_7+_7j#fWh;52?MkzCm?lyIq)2|3gEK)pjL1)WU_Ca@nZD%o0^Qh(5K9X>YMrs@N zgf*zPwiZmx^IW@*B6Mg`TL*t@$VWw{B-5774KG;zR!4-fhdN)wUSiR}bGW^~9dm+r zUY=c<_xJEan>P2u??$$W(OJlj)qRwa*Wx7!^f&LkXxyL zK>8qe%1#M$^U!0*MUPnE6o3-o6m7-DUFO)v=cQ@uc*35NYmbu@>k$XveP_#5_|9DY zbk7=bmw4aP?f_qn?Tpb5p|M1Tiefypi)(j@tefkx})(O9<)qio;_}^Kv`niw$i|M60XUMSQGb50Yf^jC=SVMBF=YAA2E*K-N`Op z3lHWTVe|c&;~Q6(hB!3#_aYV1e%ZkprO-MCC0c@MovS6fN=?bzOhl;naR3{t2+cxL zy)%zF@CcSyP=lz*ey)^9gHVrAlFvV)OTTV35$1MGl#!pbM zX2#t$!~0)gp|+3mOh0b8aUriu>JeG?aa%_kp{5UpKcZ_-KlBr7Qp5Y7a_>_~1{w~O z=P|kMh$zW*u33GCFl^worBW(GA~tA2>>iZ9#Qgq-YOi7APD6RQ^J}6rd*=lY{-CWx@;Zh)$~&i_=)b7%i!(Xw=^NQSrVXmkvrc(}kUoBtnxR4LU%a660Av+?k^7zMS9f#lB-3M$-{MwbP?o?DC&@o7dZK=|c#iVkt2UK@GG z)8VszOPRRW_H?UA6YS79xZ~>lmAxD*R8Qvd*YtkdUp~O%aThsT89gg1tP?oa>9`~7 z3DBn9oNOV{Y2Rl1uNT+v#d;W7P-KSTM$3aO{0xkZGe8SnzPNr`JzY}+Zmsj0q9cT2AEy|$sWw$Q$$0uyV^Y#IV#I0pGY>z~3Ia!#H>{;xDDY}Dt zL=Yn~i4#Pz9y1$~r#56XE_3U1yG?i_Okd*5Sbc!rNK|sNKF|zImE0YXhaG}GiU)3t zxFj>az=*V|p1dhGzb{Dd@vKb9c2KFm|A~qgD#4~94at8mmA>N>(TUAT`e;;7$)y@8 z<}^QwO-&7%&CV=2VO>Aj@u_ zYCf^T&!bbPdLTA^i(xe{l>WjJ$p4&LQA0V6!A1ATw~O>E?+q6^MM6A@%j_v*)suuu z70by%s#SCxqbf(JD4+D`n_7{te3j5LW%r^HhGWEf!GZYbD|;GK$;pzI#`pKmWwQ%Y zp4v9U-V#(h+vvPk}j8%M+8nSP8v8_pSRZ>+gJl_ts#@ZnIvJ|yPJr6p@N`2~FG%tIf zaMeWW#I&~R4{=Qydb;T}c$#b}U9^Wa)Q5aEnT`Lf-PEv!FY_RNU;cRW=z^>7THE+F zVSb(~6K0$E&{4L>M;8cO2>)pE+3+}VtiE$;f}vb7^Un*|nb=x28p!aKZgE5PqA$bc z|GYp+@U4kgwZA)ktTs3Kx5pgT$USw9R$R*|>|)&(4fW{2 zfqDbJ^CUK5wK3?)g9;}B%hauuRYL_>UJfPz*$xRGzm+88?u0NO0U=*O-#yK<$(Mv< zblemc9h-umX7bY5nC7F$=X#&30JCX=DHu`;>;%x*#K)d`RrzYDpX$-Tj?nVT`%b=} zxzf{tCJF(l3VpBknEvc{PBOIwMDO#GkPuZE!gp@Ws<_11oxb-aGUF@M0%M-)p%2ze zEHQJKr#gJzt64Kokc1}g+0Ap4C>GC;)a*liqo-Sf0*GcqQ5eK8fV|M*I zjZ!4k4_q-a@^a^p(pX7`$$7*BQvFN(_;f6tk+XlHQ5x@n>grS!M+t=4L#BrKI_#=% z`fV!K0$Ah2 zl_q49xGcO+8WL?tzgq;~O-zDUMRL)9*`7K=Fo#o zlxKfnu-d|lJG{2jncpVYw^H0VwUzxaFdyL_{h1+<@R*ByMN+S=Gk++?cp_K&4@-Ou zUCdgcw1a(@x>KkOKZ<)?IPEx+2(LBHiefK3?luRE(*QA=)cE-R>*~o2Z!Vpkb&vXn z=RY9=`M!LxZbX?CkqHe`!Ma{LGxH%dl%Lfn)C}NXM(g>2aw9SVU|IH_df;#()?mFP z@u8@oTjtd)g;q{Z;g5wD%Ps8 zc9N~1;3fYP4eQ@QQN!wklse=COYiFTH$2oJOup@QD;{R^re}W*`WoS~4=+qV8)EAO zJhw-e$UZ3thG@NEbNani_K1!=F#&=bF7qaBJqbp55^eS9fba-EKYz}cik9_A$-RvX zGa#;fBdNek;>L|V(!uTWEHLSN_!@ec=|d)!V|>QKFY7YiKL}`*71o}n2iA#9_H2r= zs8Ip`2<%!A%Vd9p9v|tMK5ghp>;kGx?}F+<7643B$_eN zSh--^Q@@NfqWZ9 zOKJDO3h`-fWxQxf2c-5oK`y@yXmBb;VN(-WXk-K)zuY5m@v*42bc9L2ssQ+{p~&QG zXStoQA)5^}*T+jiTG(DxJud9Rhn4HEYEt#Shf2ut3fG<+!^ciGcyw4D`WPPU z#d%t%r^^(o1+;AJ(}hclmukFC4ny5(s-E17ll=MBNx*DLkrm7TvP%iHoD&4>n~d?r z@SH}}y_TJdm3?B~(P+OxM7Z}(&3X?h$H0TyKW6Q0MbfDRse_S#H4KrX6I7)fNvHEy4j02Ti$NKd!y*VipaR6J`8mo0$DwC9G@I7!whi)C%%P~%n zGM?t0b8P=c2h#D-O~_)As3^&2F)VKuS&d->i=Q@^Ht!zI3K+%~G*4-5KvxH8!`sV| z2zHE@prX&NWeiH8g-UppK#Vis2EftvB^QP8^2~3(J(n11E%)g~ZP`KnqMfkuRZ!$E z(p$YA8N*PF7?Y;kZOcok0XvNK zY{y9gtj`W&-S^Uk$vhJ-iJl3&34_ZjgFl!D)Gn7QVNx?h9kNpfgVfX?S|w@q0A)Z7Iwx6SKC&uBT|>eYGMlQgG(pmO5m(*dP}=160F?(XW8tDUo2<2p|F0H6 zZi*sW{i;Nn2FOS$dp$dsx%l`nTR2o+!CB^UR59Hpx=w^)+Dp{Hlce^moS~pYZ1%HE zQ-Bz3=34)86r+=O&2rND(pj3ppcNq16}?!VJ<^pmH#_q{DQVc!)qC;1uz=^}g?c9Q zRH3{y=RhH=MAPaCK0!o+UCX|+-U%{@lyNlLG|t1?BgDg&?qDgqBu%6+7UNSb@2EyG z)qBr7+of|#)F#Drr=zlLxmCEo(MIK}`09B<#Z`sU-aWsA6tUJ&y($&Nq(P2$xH>Dz z{4Z9qf8vD^_z+aiH@K?X>Q!9K7&0=3K>-ovYMu1T=So-=CTSDH(Cq6hpWtHt3fp=D zYkqQH=U(-uc@o+BzT19oifgLUVJ+;5(%JtM{rMHL_lz4Q1vViuOh{SKr%D$mx4pY5 zz24bUvoucb^gCz#5f9m3Dsf7Oj{6x4&}gjl7F=7Y#xSi(S6L3^CO{si-2$E}_5*KS z{&eoBMh8q<9OkfBs6$|QIjZyx&IV{*4p=U_Rmpmg zA*OJ{t;z~zt5a{=zc;kVBlPJOf$ zGBN4eFFMs+82CIbKnGnbDCfF7aw`R>aBbJL?MXzxeocnU!;WUik_vaE0s0I^5p=}L9A-F_ z)zmxAk0a7vl9_lMbddwBIEN%b5*3FX&#KT5Z#wb8ZZB_AC2P8sRk zLUMML8t&F}YtyBbj<++cz$A$eFo4Kxs8i{hwS4EepY2t93mUf}5RO!R%e$vFI;yQp7DyzS`9=x&iqms{{R5v!! zUWTW9o?8IYbGa(KXo~9B^x@i@YYTyiYT+fVUp}) zzmp{LTgmo!H_Pp0hafwt{3b!yJeNzitOW%H=YR%eB@VP|woYmR)#k~!4J}@`p(=~x zwdL9{uFhC7=Fbw(oBSd?{xw?v&m8^tS1fDf?^U-H{DWpKOHy=7Gu&O#g;)tz50Pzk z9N9`vz`ApC&<{&r%r*ZhDTXiR0#eBi>hY;h!D0gSe8X84VL031lq7ZiKrj56s3hO{ zfS9q`$;uJ)n;M zK9@bP+sf!W_$XnoPg}$Sa>!b0y7P*(O6=RbyPoOQ?+_eU2q5V+BG~O5u~zO;jJp)< z+=^}tJ&g5rny(mgn9!+}ChTg^axgC6Qz+HUyn3cf=Kh&(nMW_WXtH$$1XCcMl??Np zJr~edZ&bM@G|5o!Wc{9p9!+Zp!(<;mp#tE$;M9ieM?>W&w0g^VF&w`PEdFZG<`c+v zbLXC_iz(!)CR}Is-7DobYSi!V?>FtsRLD$In#_YR|2(~B*@k(4i7Oi@_Oc%L866!J z8G$r-Y~0-Uuil*axc-kc_kY7TWYf#YzP(I8H92=V{=5X=hPvDa8O=bfQ8rGUB{c|R z*=tzLP-gz!f+AILlCsBXS7HX_ohvgv*bUT=k-yM4-McwT5<)`yvAi>hlki`^}qYCgT0^5UgSBJg7}YN3*(!K~TV zG*ss}bF8vq>iUWIhf7xH4IH0jo@E&1v~Eg4yS4dE0+@o8+}_$6)%YvBgxE3F2j`>) zv)_mimu}ZNE{!|}!jkuO8eFrer`N*=oE8Q%DpTqmW=w$uiab=&j9#)*bnmmCBonSQ--Ih58c17tBZMl%uq*8g-&G(PwRnHEh{ zmFdpEd~%c|l#$(1=HZfvcKG{L0CEy^&UnPc#MTz`(mKFen`JpjkrTGZ@n8oVoSf5W z$E&YX`6{L;EId4JzME#R!E1Ux``q7&hrfCu|D}sJuO?S}+hthXHJpL#Go)gJ(6!Cb zx|NeFmJzA69&y??T|C@s3f}JKbMSW|8ES z>IDxo#S+dkSvk})#cW^>>pB7SUgIT zj3Rf!_JQF^&IK(-StoI`7 zJ4ZCkp^a(1JMW5>NP5tfAg<3QNEbk~C2xE_mn;e2uS>@_NZ&foh{?|wcJlePN$9<4`mD)K?aBZ8F zvC7Dl6dozht?0nOer7MdO3#qwQNVXFp~(fS1wJ}Gx~3d@2EevQ_iu1=q85Bcb!I8- zY26k+{l_B1llL9}Z-3lvK(&wSf|F5~a>bIZS0~hU z38U#f%;nZAx=kNiG|*-qb+|`Tq|d0%r);@>$34sIslwu}kWeOkK$^`YW16g1Xk}^;&Wct-U!~)jpNZ!`xB&bu(0am=Z}9<{-D}9AYWx ztGL{4yk&yw7VyL{l{4{Jb|+p))-LVTBzXL6NS`!#qE2yS4C$B2&&}?8n=$6TtPO-1 za#_hs6+)EWR%dwAkGtK;(HUUxQ`DrRo={P-dC44;pcinUo2w};rQ@wztx8>ws~OqH zNY9b8#-f;9^E7@({v5e}jau1PFFxE(i=sRt;{;q%QnrScJiWv8H%nZ4CtC=G0ixLi zu6@*={%;n4^vC|~G;WZOgIHfPa7;q+KZk9;c;%W+=WY%;ELcnJ#zg-hmw2 z&zzBV9DO@$XSzKyz-*wOa=?is&gy*<8w2P4SjK1`u)JpsJy?ZbVem3<*;G9lbP8+v z-0;422xT4B$@$SolGQxtBd|2n!eH|IQU28}{q0sA z~wp*`Y?E&JYaL#oi-60NDy*2C`e2g|;bJf#{2+cHqn} z?dV@(Z_uB!Uk#1ui@18eBP@dKNeX#Ig%6D)kN>Z4!S3z!3}{9(ls=P=qDc_A*OJK| zDKS?mY2Fb`7LL7Uv_*~a$s!0|QVwK0_c zu>waI??d_|c?nSpWYAm!AALmLzOXFP(&_cOGrGu$?5FCp)UCc_(nj{F!(t%av8hklk~m_cAA2aa5}@xR)`)B1zribf4girXC(R;JAt0pc*EBz2(fy zs0ReWVc@x^zyB?|HCBtm;`m(hwwge{%JS=2+63y3}fin zWjYY{ZdlwjOb@4ht1WN`(z>8e{{>r!d(!%bYHFR?RZA;&LRDRTOS}BPgmNoy%K91c z{3y5jTXuK!C9f-_o0V6c+*auLHg)&BtgNnxP4GW&Mf}xl{>%6&1_h4;vu|0mmQAG# z0VXc@^Ne=})L&L|<>@Tdz&iOX)EH{(o|=N(*qk3KRnJc?68r>x6Qj~oV6J_AO}&+} z#EEPbSpH9X_q=9zk-Ly&7g`T%V| zZwgC8Tlw_cU!J%u%i75^YIh`#`+RgWxO@E{zws;mbQ4`soz%wk@5Ih?M_$mLY&TK< zAMN8mmh$^6|IdHeldY&mq)=X=2wGUIqO1{|c2los_-y`V!`dQsw8|LzEz;`CX4mIM zY|zrqclT*%Zg=3!TtcI*MXEs}zj$~;lU1-M4)T?oQi;9sVPk&R>)~_y|DsZ}&TQMqW`7aLtM@{4ECm zd5|rRkug4{?0j`BF5#(sdJl!ODo)otEars5@89aTWBuQ6)47j}wy6gYgxDc+t3qcX z)l_F(8tzo^_8LCYFeO>COyZaI8S?39qinGD^ZXeeI~+G5CpO`|@YQ>so=cYt?K`9O#I(od{%Qy&o;4+b#~;XUE9ZMx|eM& zc`gwLHf*9_kyKR!vJwnId93dKoA=8NA6byCC5yvg!$~q;)tfIvs0Rn6ZR1lZ+t$g5 z&b+jV=7}JOqC}UY#igI+8GA&x(e_SB@^$gDb3^3TRi7DJtKQ*8p2S$T87eiUQjR;_ z|Cwy|nzCE)uzLT;i>`53bxgeM6{C{wghSca>(?P4+5Xe^{L>iTp7j6m;|1B?_38We zXMcIJ|F$Ly`PY6yFaMaLqtt$FBAaeZ<;>CqGsYZCmin)|``yW zk95NFd#m~x-qGN@Qb8yFJwakNedI00k&iurzo43LP*{DjyolBPv44pq?Q8R@8MP~^ zL0EFqPAfS`WYcKdIQ<*@UZMkWlDhKl;hf z_hnD){h1QjP_61}ptb$>e{T!_f8PR-N}Ulpk32cM$c74>8f}uOFEV!5)xPosyWy}q zmyj+6B4S-a0WrFs#5HNasmvkOjYposUy73mIw#DR-V816>toFTsYG70tNOM<2wf~4 zT|oxaw#M*|B!q;en^jJx{9=_l!aicuvJS89^5SquQg@Z(Kv)<~a{1f0rO-%`ef;>3 z<35_L?SF@~9es^K8~@AgHte4sKOK!KueVL3Pz0i#E?Tli0lMtf#pVAGZSNfyRkFMf zOOzmjq9Pzk1yqufktjitEGU^lC1;64h7m+bf*>FQLy#bna}J6~X2?Sh5{5j$Fy!zy zyLWfp6~Fi1&+oqf_!)Zt|c4Hbk5zV7e^Ylrc%zl{<0h&^b(w4G}6z!vK}yMNHAegQidts|-{`Z{P4*Cr-H z1t&ZPg+I8Bx2zxti6yQI46%K_yx4_5R3GCY3@Sw=(Y!>6b)HFH1q8z@)CTm+<}igA zPah$Ad#1y-df$&;Yr6OdYpz`kylL`{w8|gPk@T zF?8A4yX|rMk_eb8J=p6RzE?k3nZMALf9?rKom#TuZWUoYMA3u`%PePZk84gl*)ZF) zopJ+vydelIL-j^ATLVu3uSgrBbUxEG*@8P@{ z0MewQDMZNnNPST*OfJ=rMN8Vrx(e(~Pw4w6h-N`|Z|~k>a>d?~$+^Ha&!^U%a=FQO z^;R{72yLWEaa9U&WuRlpK9kEWNI!gucCzqAtI@orGn}^8#Ag%Ne!znecgG=fd(zPk zW4>zq1o_iDsa(O8nUP{9TFE$L?sV*8NsLf1iey;pvc5hG+qu!fl%?Y#%GXZ%x7qr& zA)EjsHuZ}mYwGS0rVIi@9XL^mOPt=FTlJU-@29{+@XKcM(*{!rd8r0*0>sl;tQB z@2A5o!J4>G*80l*;P=h&*b&EtS|M$GijNpv@WuVWsXoU85y4~bI_{TFz#7k7YrZ!&99~9#z~F zj=cNxLZ5)mpTEX=<8p0|tA8}zacc@IXYGKUs40hb3O>c3hk5(GRQ*rq;M2W?j^x?t z^S7Ct`K1vhaW>Ca3fqaR?RQN-fMmv%96fn6a8pJ*m3m?CiZi^#u z0zp=Vi3BHjg%$3GLpt!5U%`=xzLP#%!>+7`h@O}{AOXTJyES%YdZW%&(bSkH3il+4 zd9aVYHKPegQ675RaoY0FmNq|Z{+QAA`>%-$l7Nx5v294MfU}*fjTAI2q7Y$~<+2|WqkOHwo|m^>oCCgd8P2Pw zsM`Bd>z>M4(@2eOMdPDw&zM6bq*lKt`P_jj$-?n*F;6X>A(h+m`mC3LU-*1|xcpiZ z0#SfXzptnuo+j452g?OnChHDW(pAwfRlV>BS))l6j&sspUBbacGXoE{eR^E>*p+)l z1kU!X6g@eUfp>ZQmtVj10haC#SBF?pL2@*b{%339FIE1-CzTQ0?H4q!fnDC-Mfjay zevO28JzG|CULh0$b^x701Hp6b@MDpRR_Kh~;D}1KL>yJFh9TbG4KGi(8{&mHAw3s` z$tvV;0*JsF#W^{0qEg~9B-RQ^Q7Lf~o*p7F;ii-e(ZaUJt{PjKuE2Se7C`1OfJ4o~ z!oxp3y*+cx9t5L>`J8*j%`kY!d+g3-?n}qY_s+GBwEYv{IGcPi9ZT^_1tzvcC_Vee zR`Um``C**@FzQt3aDiz0O$*&|W)aM(&2)PLt!I{8cYoqWQ;AwYwZB34`cJuGc6_k0 zLZq$Ea&080L2cUgXhr6;rYG7bj{yoipM*W}D;S&-;7(nR!$@+ldO%DuL9A z%X$d{00;2&7Zf}8`oD<^%=KER{#Agr2uK4X`}u^k5)r(+fp~!JH2!3Ct|)CN710P= zPpF8=>&LGk3GJl4KxxH}S6{xRuZMww=mIa@~B(aDeW3vx`wB7`OA*E&Q!VAGp+x zwLMi#2*POiB9^nr-^7=&XB41nfsG2z^bRDAM_b~rCi2Hc@1P*yy$HOj*jy3TsrJ5U zVH{`SO%OB}p-i}t2CQu&$jxV5nrRq(sde61gc<2NmH>bg>jAWvU9#W>ezWyMCqx9c z+AV=C%DTn*jkH$&mHqr#g%gk`PpZ>H!cv1LmsA%VgxkrQc$nPFv#_>6OEM&z;O@5W z4I=mAk2Ok;4ssO&-1_=@Fm%`zwPVMj!bRX(LJM%Ms>=M>bGUDqI~pqcRQ|T2$881h z-A4|bU;sBQJ;!mTaZhtBVCkV&j!am7cf=B{CGwygjmM#- zrR5}RXSW7Bog)5=6$TUyL?DUn%(wL@zseMqH3{AG{??N(G7}> z&)Q3bjbUVC$a&jbKsW!f2A5_ujmh&bbpIFY3pC;&)wLUa5|t7wael+m=R|CV{3g$D zOKt>IIeNW<-1Oz@M-q41f7vJ$6`&|Yy;yW%a%HIxQT>2>3$&3Y=emj@E(7_GrL(5A zk!g3FZCPXyWOV?G6$9HE#D^>`!~sT?Az(xNY{qFQw)!>$lPjNV`oJ%oCjh9QCy|ah z^lR6zf5dd{xALkVci?Zz7F1;O>IMQ|-06`J1ODZE5>k@?gt>mY2i$lE_T@5JxxLSN zfZ;A2mok~P>l!PPedNgFu-}a~N`Ne^1%9Q8zKjb4#UCr2B?;0*aH>?3=U8``bGx&CKfHLr$)wV6 z=>_R`wi_%mIjLM;mW7nAR16khmH>$KT+93f2q05gMS(1X?$qB<=iUAU5uQ=smHGzL zE%@v1P?1~q_+Qp=foU4!w*b^$voJD~9pxbmC{v~#Q;xMI|0R^>5-UgZ_Bcr{@I@A7ZUz44L8TVMr|g0jBSAjvqt-~RWxbvFGr-_^&moBWBU81Aor0252a3Bl zSYpQcVkSzT;01xIriy9g4Am1BSZ?DUe`f#w!|PD3mfXcZ0+N?y8E-VxE4 zP;U857qz=V+YWV_m^zgpt+XGHhuQ;B{SEffK5Zv}bWd_hc#pwiZsGo79)H)A2~UWI zu}ycQivVuf#5wf-%FdR{z1PEh#d@+jj@Hght}|$;WoaDO3g=jM6cG~BTL$Fe8hp-# z#U5{MO+nlWnOhZxDfb}i%xGuR*%;275k;=To>gvL%zNU@PlV{HkJ*F_Nr+PVq6ilw zPIYwWSrf(ULGiX)cT3`Kim_@U=F%{xkM-Z0Ix`#tRvf9b3-6Aq46xNN7oSvOHrTrI z3|`7Hgc)D<;N4e?7T$C_s<(+V*~(?&w(Nf_H1~B zy^FUwxaS-2I!Cr9s8yj1UG4QwH%+o^Is_>Xl9F$5XG(hXd=FQy2}OHpGJ=xoNKoF} zlAGvb*pYz4?X;NJl`o?mjRB;b&FdlJ1qP_rXjTx?KjU~w=xOOC&#eybhDXH{sCbPQ zDxPZI-54(UsO(Uwopr#*PuO(pUdWr}kqULE!P}zC1qkCtfwA^CHYQ%IIwjWO)gHTz zXFl9*+(yN-0lG0xM{7z}(JSIP+8jrWX_wqu-=qw(spYwEhpep^a1ADUkk4^My*|{7 z?gsoAk(;A2mq8KK*-bb#ze8@7AKu9gE_+=oful-=?fDEF!_iF)Gmm}LDQb}pv3sBr zlovGj6CJPX76O%_ik|OkR6MtyBs$D>H4V4m871ZSS#J zh337grpMwFU&<-RS!Z??gSL%=wr_OK#3(B$Bw;4OWRHn{akRB@>KZ>>_f!M*V3{c@+^OA74>Xuj9DfHWGWi-!Gq^;mQ z+q<0i*|`jsTiHP&O4h@Ccm9SS)pj${?sL-Nbn*O`v-$ZOjT|MT*D;D6QIU%o1xxuisuzb!l$QZVQWDd% zgEdfGEzOWqbx6JJ>IMPAcbfcsPCD6Hg|(`BgtcF7u0HY=@p#rr4tZO~V(ms1~nL7iEb1 z0WsyLi>^zN>{`ZcI}A>yjit@jvzR$}&A|u+8h1rNprkb&bYtg0Lc9V+#Y)265S2&O zw%Nkg;UJIhvsJ*m>5QBz=8!{7Q|RP&kBG_o>a>P_%NV-m9!R-A*Hv9ZMy3sT18EHb zFDOJ{v%G4pnRacqZnFiH{jLlSpD&{E8sJMp=#UL^4F5{}=`nzf&hWkXr2+q&Sp)t_ zAsE#Udr+P)-G;G;z7o6E%a)J`RjSnk`CO8jeHL*p?`m4R#)X$qepB_)wW4X97r&qg zr{`3Cw!gbi#xjbszEvLL%SGrPLDgN!>13Rn~W-0bn`EBkg%Yj*7^Pyd)t7wFH>u5 zunZvv_}u0{c80wVdy3b0Ahc@M`7AfELH{~~f@h2SiTkn8Q=mdVVocAWOf(zN6xj8i zkCMw76$J_4BP@c;9<-){pMz`$d9~U_CLh}98fo+lkf9e0Htd@K_c6bfc9S1=Zf!3x zr+=lCExY^Gfms6F3W7fYG0FqYfw0O&$xET-7ts1o<*5@{p8e<X(%aWyC~@yA#_ga+HN~j z^RC>~GFb-F?4|~CkJ*r8&M{=|mv}$c2%rFwTjfeMXz&fx{Jtt7ISr#uiB(jH`1Y_^ z2(}EFrK3SRg*u(NCSOBPf#vhN)6#?!6{`Y7lYhY}?HIc$TpKw(g zhxaFl3OwV2Gz@G5a~TT1=70T65>lm7NcmVCgx6n1pzzNp!);?v1@j^3*KdVyVY>II3|W-I<&f1Zzk6R;-ij(Gfzn2tikb_(Ti z_p0CB>TVxPS3BvlTy`JAsE3A#wmH%=QSEK09`RU$GDr=w%Ybu%M-AdR?Py`w8xaMn zgG3M*@h)GT4bkKfP!oKWHc|lEE+Pa7Vj*si04Z?keO?MRc^3o@aAfLsm#Y_)?bhxa zR7nBun76u4+YFYwfh?i7RB`us9adgM9ax2^)$P)|P2u>5gp>@q#+O(QeDT|D14L-- zw{U#-TkTUTlW+n7PuO(cJ%-Q+SIA2ifI$#-rPZQit0g;feO+;Ftwx{RrM+rn$EyC>n4>fZ6UE0{dX z**S}^i{N;E-<_ZJXngX!*s0**e!eJ7}9E{;K=Psyo|(414?aLQ#?1M&Mr;ANNT@n)GdJFljYu@y6*P;u@YiE_p11T;JH+ z>IkQ!t*i=Q&Ur_$q_a{?9{^2o*A-+T?v_Djn3MBnUTP-agkY|N_ZlkfUrATk>}6G{ znfz#T{BT;Ukm6eCSL$wL#y(nx^L^#AF)4Sbo=vygRWI}*Y&Uxr8#(z}c#xBPz2&5u z*t*}aLmfjUAVckm#mnkGAQI0ZMDK1hJ$Y(h zvpc#W{$w$aX~JXqYKCB+08aHP&L19dQ-&jg&>L6yWt1KMJ zI@}C%E}skx3^bZZVqPmK6L4B;4+Dnod;0|tOe?Xg@YO5deBoDNc2l>+TCe4lZ_I7S z@;IrS5b;Vx+}5Q@@%>4}qDSuIiSK~JFH5VUeUv9gz~)U~mUdGp6JCp`I#iroY`s*k z_h#9fD}JDMZ@sO!#3>jYQC&M&Kx~{YWM2L~ zLu<_SiCal@sJuWWLi9BTA*^v^@*ZhsbS1_!8riax(}En^3K_}4`9U?FO}O}$%6fm{L#J3e z-G-WX`u4q5PwRGDp9t6ZI{55fp3n$$M1)=WJ@F*r3Gusls@Ow;%A5DwPFs6~$ zAi*MlJ(>{a$9^+;Xx7htCsz1aWau|*`4BPc;eGExmhHvEE~cK2%T@BpQrA>v-XuMg z!I8;Jd@6%8hs&=L5b*KUQ@ryzjJTIch>{$n%VpJE(Y_aCzr>+^shz?VWpS?#Oo?vZ zpJ~0$W8%qE;LNuNdL0unhJKXj)P>o7AJ#HyZ4qCxop+LvS|*uUsk!tqZNix*j4ELQ zN)rUV{t&G?a=M*o!j0uBf@FXv(KYXh%blp1=nl~ZuE+I+^Ywn%da`qc$l41(8tFfv zVx{!BZfVu;lUKxchiTSJYz8e+x*u5`4i)R|YE0369%PhBVmi*iM?Gd=wjr%YYKq0a=Z(-AfsA=_wLdYcCEN0nQ zO52wAz8Bnbdi0uJbf!o2QQ=`#Cqwj!oYH+7xPU_=BirMwNF5{x*@C|(vwAx`cpv(m zhJ8l+)1!>bFG#7v?53N``Gv6;*}k@OK6udS)H{$3TDI+M(6WQ_H0a=>90S|6rR56k zfr=y;sFY9BA-l5vkoSa2iy2!byLGgv2|Ta!ab>AY&S5a}OzaGu8Wq7Q=xVJMX6|@Jmvx2`oukz+1COpoKx;f?A`&2gOCU!`21*X-XWF&gpmD=T{^^;q6r8gMl*plDQo9qJRb$SHwbJ zy47;ie6NL~x4s<8MFbYbXMP&4LAaG(5K%R`qqupLOLL5Ve?~_jX@C9=Evb4~+wN1Z zz#d1D^Dpn7fStOblC5Gy+;)CfCz^Yf*-q>D+yDGY-3W<=wKBtfSPN*TdAhIQ2~Js& z!f9o_!sDWZM{fdQduEKH5h`|9%}07U3_!y&v@M7^XM`MX44kZNCU)Cg7P$9{))?ig zxdarvTc$;PAD^sse=bzfKBD=2isHhBeAl+Y(z@?UAs2-PiP3Cosc+xbq{s5v#1YSE z*LeC24^1#dua7u4#dFzImihCUI*)k6a+(6pXSCiVTeRp%czsFSNivc{pNR&)Z|TM8 zS{pK6F1jn_tngc%u_PIJBLv(dH48E_Xzigva-d@!ry(yZYuyyxy+0OhGnS`TzBy~s zmtv9ih;2A1PTUJN0L!&ucf*F z7CHbDu6MWEW4o*aq~~52c}l=N&o{U4mb8H3-mV}HyK>KoXL|1iX}bq8c@B$7W@tTM zpFKbhw1qtPd}m!UbZ`Qu^(b{IW;aGM5ChzjQp3yNk zGdk=-@BNjY4NL~!YX)&nmo?w3f*UInEvH@4A`uA*j2NZa-Dl&qcX+;HT~>J;tcATM zD$}j^1^BPtOu;Npy6pB@;O$k?!LdJB(SHgS<9IOcM9MtnI4W4+HQ$v`CHzlO3VS7~ zDd9%>r;aso|I%_@3KBlsPH}=_?kp`P)v+vuR!k8Pa7LOF-XY;}S5@qtv@jSMO`{8NLn`)`iPpTlU zpE*LUL7S#7Y&uozpmFQg0Ex8QxZF$og+s?>ch*YuTw1v->Lj|LZ_45uXsIcyU2JVL zPeT-?={@%5%Dw5H^lo+M;Rjmf>&n~TTXNbe%N@-F30s(pOlRW>Yt70w;T6NFGSbqG z1qduJl14o{Gw9-hpS>kn6762IO6PdK@;48rxaArRUfpFmqin~0uPj|FzarDlR_g3K z?l!0BtT!C@<2~1^ef=)n+#TE;oei0a@eengK@_BT)kIxoWaM9FOM&}9s4vqBSlzPl z+>8@QF^`a&(FNLlM&!d70~?@9=X>JzC_|m!V@KEYaa^PZ;byq-dx2Yy`x^-Hn5lG= z@|e&n@^9{!JzT3ycV25vcsdDLM2qf9kh69u52Y!^JSmT#AFTIX7%-T$4xtm~JkJ&x z^`=j>BSD5^r;@xl+hEkjt8rZ8rQ94hbINeA(WFwu=ICMLaNU;|q}nLwn-H&ILeTx{ zY?yGAUT{f~)X7bKlI%bM#t7PtB~*g zUhFNGg*J_|@6YDwNo|26*>Dg$Oztp0&Trg1@0gVMT-)yy^`h_QoaeK?%&rU*f$REW zt(pLre-uN>0eXIhB1d15&2=xF%7OG!=P>zE)*K9LA7-o_%$`wljz8T|thfkZm5I|X%J!^zb%{~%UDE~ zq;(fRn+S8p@IJHKS&vSw(vOF);&M(Z=F*&ID8HnOLNn05oi)>ym3?J4T40isw*1hl zJM`YJ7FiP=?Xy`koHBd8(^o|twsO;$l!g+e^7a!!z3+DD6LmI9<;i-X+LkvmhJK2!2|0Nbnt;J@1=}q z6VJQ0Kkp9joE_{`smRhfS7z!#H$u3u`u)ojq)6*WCdQUT!&DSnp7^x>M^sVST7el5@o8aPGS9 zwPmKO`qhiwUDw}E;}R<$LdV$s z{ay0+D5absPFEYW`A`=L*&?Tym{{ueaG9*j!3#*fD^{Bt^lLQhPsl#Uq5T#9-O{GI zEVW@HR>&T(cW_8cT@tW%ICKl3IVWH^OJskFj5JfLpxnOl>kSlFtiT9BPyER!cSiz) zg6QIB#}|gvaXg*wvpaMkrmOq|0?4!qQS~E`(skn2J#VC&ceR9$jM$`DEP6Y>lhRAPboXjz;uqOtsFbJ$z)BOHFSEV zB}O2GXX>kexVm$6!Ge0HSjAKugdhv3MMU3BtYSE{!3N1%Qby1&s7evIMDRPk=QqJtm z@)rb_j?_S(xaXIWe0!Aj0}SX5I^P%7uT)*>qF6$BdcI(4ftHs4BD8(gfK@>)QBvUR zk{s3p9|9Es0XofEf^L_g+ujAogyQT($dl>nMz^GRA4v*whrqq}bCbXnUN_ zrLcu(rrMLoHf%OZ?@Mz;M5-cfpkL4oB7V%8e^ZPZ6N~3;#@tMDj=2^gZ$sa5e3=FZ z!KbK9kg}{jdZInpJBrvhDidYIW?c3Q?eXtLB=kM*9hU&vsR_F4w^Q1y;3+oo%Snm$ z@Bj-HP0&L@n)K86ut(#|2@FjppGqTN=7?hpt$Ffktv9;;IB@N`)=chnb-L?VV;bPs}8;>Lp1Xk? z-cH(Hfo;LVPY>^y`)WkYw7nNZKQ^76J|P|#)8(?^Qe~Twm;@Kks$4bKs}MSy{%?hgs)NZp{rZ zXn~IOu~T(aoVqH!>`Ukx0a@UQh_(;qKKWpV%yWv~##r(wZyD;DDCe4>{v;fsk1&L>O@Vj`mFBKAfIm9ZEVrP0YA1B$D!T(VfHzYinxw> z3=mUd_;$P(zmSIuhJ}7S>aa_+lNd1FMc4^MI?fE9Cxh!0nP&~O#gB=;Ql^!XB7JvL zk*p_3hu<7Nq|QcKr2;F^>2lmzKV9R&;E;dc7Tm z1Y^~af{7Z9{ObBofsm*rB>+pumZlV!?>WvNzqPe>b(h3pIZ^7RwAYEEXA@t}o;&w; z(cmV|kEZ%hzw*b!v*RUXvHW(H+sWtRBv7eQs-U|uX!KmJ5VsL7vi;Q{iODgWnPnzv z?xze)iw=@r1 z;)J6{Vw0EhjlAC5f_#RsM4M9q0w$ZwqN{_2PlnSbjSgXWs%5G&W+U^bLkw_zaO0fx z#r4yyHFz7XzBX>QS_cZpGzD^rSU_Ed)vqzIU{GA4=h@V?4?>(T*{>P;N;gQ$_pxgM zn(`KLsU&d??x$0xteMXw4k2Az#X2JNQnZH$!u+ouEKG_~a~R1*b$wEMO((qEqsMlA z^%QAE=OszB4bUZ1jc@9(p{dyjm1M_wzK>jP8G!rER1l#0o9+P;qF_1H5nX zps^8?Dr^H6=|kYx`Cp3+Z$p>eyFJ||`w{TB?Sar|T$Zo={h4YJq-a|C$u0lpmp>P>T>3BfT+Og6n1@Qh?KsK(js8?W~>tZ!^?M&;(-1QDzc zru%Z!fH(DsrA)g9CcN>|b7?i=#-lLMgF#2Uhh~?ya>?mGYiAzHkE<2<=uN2hCX4V_ zWfVXrRF}&tf{9nUR|@9D53X7b6*}k)hVU4_f6Qyuljl@6K!RxjeX^@)Z7K{Jl%iL9 zOMo9UMz4PDeY~$mj`;>2?q15%`Zbo=MUZXtc4fufI?;?q0a<}&?CdC5Q?DJNiVyaO z?tP_E(uUb;lT0C~Y~B&RXp7r)t8}t@6%_P#uG^&fIYHob-(9SzU;F-gH-cy-m z(>GtN8?=foUz~E@=IieJ_yCW(bS079Xl{za++>Aa_B6v!ruPoizCyLvS+igj{Lm|lNYStL{$nG zU6WIFis6===X;@+Ph)IH-p1>!JI~{_VPV?5<4W;q>nh8pqhEdR&TESuerIz@9O|}i z(JnI&X4j*kO&G|N5-zC*?YI`G-qS}uC$M=oh=+$aUHy8qF)cngs%cC)yx2-d?#-7M zv7T|50TasB>T3H5b?<}=;^N{$&&Ct>itLKm^$(&H;WZ$LMnNalU5nBv18TIWh z-)%Z^Psw$QW^(anTB*D5#ONkznp3fTSXRO#<4Bk9{#QSm!EV^U-qsJVa@HH_4C(4 z$2f*b2(LZI}!!zeD@o0FgP$`R$5)l#k_Un*74XFv6DtDur^ zQLlhuQ%6q3r@%OZHU1UZ60HeAr&<3{nf;rYj^8nti_60pb&eR}H23w+lZtwD5RWAe zlOPbMka)TY-fi21C;|y z?RoTGYc5*(4rRBxOqQ0QcUxNHO=1pC-gbNzgHn+52{=%ASRsE0KBf?BC`k#}7e;`y z%cz&Nc{fm-&(e7tZ5AiyaaX&rTw`$9F+RxCD|4uMsL=Y!2KFLCbWBY>OPdXah^O*U zg19Ux+KW4Q6VjU##p!96RChnbdMpWypXX6R?eC)bF^jFG=ZXjB4mLK<6)4V$l=wJL zy!N}hlQ~w2N;(_Kra#Ys+kNX9X6(yQkp(NC#kYgnqBI^(t$gWJ#TaAH(o&G`7$#r? z;jwIc&&O^1U0RKS+wj#kdIdg{_OcixZp0V?i}SK5`%AuL7;rKcYrK#Q{i%jZIB;02 z%a~rydz0EnSM2*-2)R)n&?<8{jz(~+7K*wtc5?*#$%RmtkJ}{9gwcK!ip-dye%9L< z>-eAC$TP{43!TpZX4q8?KW8jB>L8ev>S?b7W}2N;qwTJ-?{PfoWG^#2Dox@Sn1+g% zRs?0F5TgvDs%xmgeJ#QepYOaND)@~Uqh0Qt-4G9bC+3k_DP~y8qb60u8`Q!{V=1uM zhP)~t$ym`eKria5@P5ptWZ-b@E0;9V6turAY4nMU&xJAz3ikK#F)9Rl(33Ik&15Jm z#_U@ig*y75A?`SBysOAk`3xV4r`#t9cADGkpv<@JzThU%xg;-I(Nwir==jYvK|hKW z?ubG14K4J-Y(g$x#x67vQqFIEQ`8p1r?`-s-*kmydpk;~{oIfwt?t5= zdzDON^GLo))%kSlvpJPJsg%-bCj;H|^ynAZl{KHd%my6cpp>68dm(>F%>B?R{lSO# zRTjmdOLqj7+q$EL{m6CQ(gb&Ir^2Z~%q4N`df*zexi{&~tD5#W^zHgAu_t>Cs>|Q< zt*!i*+;;|?sdraV#&P8kWuvx1EX%_#ETrP~5u|qNQpY`9TuyO|?0vHb;%*zU>q`Rt z#C?GkgjM(uYW5&Klpkh#&KnoaAugYP`6V)xdC@_cr_XG?8P zR$FYmd)r=sO55NU5+94|AKcQh_n+%{c|0=UPqL-`S(oe!=iyzr^vP~eiV`g+Ax=w# zZh2S|8~D#E!twVcivtA>09fWKtJq!cXE=?d^!4@CteM!mV4p31xX06Jˋvp#0q zKnIXy{)gGRS~nhke7vt>LA_97885$n(cw65s-Ms+iFwj<=E5p+j{9=F$z0ds&tF9? zm{j9txxxpRQj&Yq46+?pF$L}RWC4Vj;9cj!VV8SqtcyzI8FzFBQ$3o9(em?QK=Y{W zY%W|UAejV6$)bn48ZJ{4 zCtJ61@$lOEutTCtgN-JWVxb@uRG~HdZe{*aiZXh+D-9WFJ>fBkiV1R?D0hmB0Rcd2 zZ2L`0#(r{!jKfbd%_2M-Q99PrFc2#)bbJa>B(ZtPF)b5WTPoftA~8(TL2#NH?M75kgZW+ zGym46wW`~rV%BzW%qmH(ZA?zBW zyT6YGw^h5i3SU7;xK>mnMf~GPH5BL{%jy~?_LYQI}}uO4)(UCYqB2+*?vz3oj~RDOWU z_G^$6+L8?l=_ZDT$yi-FUKE>ZaxO84!t5m{H-%OiA%|-lWgQZqX|1n4Zj&EGT+uD1 zUYHC`kHq}D4D>XesHK>K-ad5Eeb#4s|k);xN=!^O0 zy*IW2*LzzveJc{F@t)W0a>=lre3JMS4f-qZPrB@Q&D(TtWp(vU56N;tRO*DKYx{!j zsBW2^+_c>JMKxwOS{iM}0sCxY$=8<#!p~Vl`A{8Y=8#Vh{S6sdQs8&)+)=G`?lg=8 z6`Vcd%$tmiwc;|!G}0a@W0{3w-wWoOn&|u5u>!E^t7Sr7)s^>YGO{&D(A{_hg!r;e zVfEn-3dlPkRp6B;b4juT#10YOH_7$wtL$F9w*0~)ThE`S<~R3b zx!9rjBGW^1@x90M+Za^T5ti&v$!Z9gA&o)j4xMf&N6nm2wozw-N94f4|HX&G#zcj}-Vhsahlg zV0!DeY?^;-3iYQTjB<4_W|r+0m=wjn4q7<~oFEC~prAyd$#>VrUW8k{JHuj#2vegO z?h(17OM?74q+`bZY^IgE;CXFrtutGvgmA^y&d%VYk|mI}5W9a_CZKVDbIfM{?yN|v z)o7&)H^7jz${o^qO*4D+MM8;UMcw+?-_`_8 z(rqrdW`>!JyMA;<-f|(VT=3Kj>0LXeOa2Ibn+4$w9m!e9(}u$q66f_Arl?o4cO6C5 zTX>#{KCD`JCxSQXSd-mg?n0RT@)MLU+@!W*8Hv^8K-6MYu-OJ{r<{@d<@6cT)TQ*F zMjaJA2=h%4%X)#v|0?t|G=v38dh6eZ_*?ad^4Roe=1M;#;QnjpQ7bT-w8zc_EY`gG?&^~L z#0db!_Dgp2U>hlo@PU{-Ex+ZpnuDDTQ;Knr!|H`&GqI@;%@3KucdUlngTQlafy;6CH(h{WW@1~NmZ*YqG*g@ixO%DO`Rs` zmZzG+Q`^SI#6Lf-2o0q$fq=Hbapmd`5L45SM`bx63u(Cz%HgzFq#tMi`k5(!##fg? zgb(@s*`+#Cf}{^0+JL`OxiX{off;j3_lhi+*eQfJ)mWuPp#vOdfj?LOa)Ns0dki!< zvYqEyFk{u$O%XhZJ0`oc3kcbnWGV(fliEO=Q9kY4h+4kq>)-2EPC2i(RosWuZr%A|RX^d5CeX3hO@0E+c0vp&6Z-CMjCKd7AD`f{Z`=Uk;WW;Q& z*eWJdGfxsU6L>QC{Q2`_g=p^7>Sq&@WzMTfJRohLh~=D0h|NiY+i?&7;UE8-|H?{B zc+t0szws>p#f7kQ#69E|EQgC)9BEgssPe|&Ct@5I#T|HVC+idQ-VO0w>-tYB!uf@F zO-;?P3o4G=;M=KaQMY1HSnyzNrj2c(FDo2CdBmio;Wr+A5=163dByNsg*8X82`9RP z4DHC0F;5Ut88I&w7K3D2nBiTCs1X_{snaW@iYlns*n0L)x(~GP5^$FpYRWF?YzLE8q3IjSQDnZ6d>OV+XHw}2!}0R+ ztI3xp0F@43#XHaZ(m%U??xSvI@zE)^C|Jn%;@)FW!k-L5czBEru6hKrP|!aksS1-2TIv z`kPe9vcW#p+eCunAfjV@eQsVyWdS z7;(s^`rEMoH4<1M#R_(nd4-K*T!)Y8>{9)B|KFwTCuMj7ca#IH{5|h@=$NEB;8Ohg zUhhp}-i$7#HA4j2gVdy+$nYslWPnswZDHj2BI1Ah#2+6KIzZsgBYXmR?2}L6rn3QB z>}!f_l=zY5^RZ;G3`$e=X^?~(^}i6g3&5v419lvSvbN~>xxb5BzZMaBcUmX8b3lj# zm+0y}iLu@!7kO3_5`$y+=zq2C8gl_-p;5n1%Zq;^BEL;xXf=U(gxS?;l1EBofrgGm zhIX)A$w$&-kA9W#`rl0aE5Ok}isLCl{NrN$^#h^CxNSE|!gW70nK^kX0nd?`bc&?? ziekoa+{%fcvkm?e74x?Z(P)TUU0n@EpYPT_{U^-yPo%WtZ!Fn=&7#>=3dpDG9ya9F;P!U2GmXQzJIiyzvj3e`e!OfV ze%HG$sfp*06%70?xdcdA>RCt_MPA_=sxn%Qkzb_1Y^KsVo96f%{*QV7=PSUjl7NI9 zit#9EHos%HzPH2;65i~dyUkST@BovkheU=D7)f76U+L4BR?^ytW0lpf#q1cR9x9Ea zuMbc*+4`Hm@T;s~k-g|})x;<19@_0MB~rn{XTHE@|JUsXj+w0SW-$3w^_$Ig7k_sD ze_#FNV2L4`xD*xHyh0%%6B$My(sLx&Id@+FFCNcmhAY;06Aa$C{%4-u-xPx^9*$Sd z2{W~Vf~h9BI9Yr9^)rp7K=%}7Z70kM-~AuRA1s+zx6p5!)#}=ZU&sxt@J!OqU%8T^FsEwQ!h!8xa@ErOMp1h4|KshwqncdT?a?IyiioJF2#A0R zhzKaXg9Vk2fFLz0y>|kH5D)AfXX0qLF4L+=oz1qdX+mwndWXWy}0_w3)f zW8D87A;FI?@As7X%sC&LC!Ubzig4ZEgJ*O)%!sb{eaRc4yjD%5B5o@x%{8y{E_kip z4Pu9Ra9#v=wB4@JNt_ZW=YDfC{2MY_E7h~CXU zI#`s`A}m4{giFnRpuX~<#j9{PTM)l)#E;Y&`FVr2S`A(BS6Ug$;$jplp+O)Jfs55K&1sYQVF?D&yGKh7 zC4E&bV$k(q?b3!$32QL8{4m$Wh%G2K?iT2_I*4s+oz=S;fJUI`ci?~{Z?llF%vTA; zdSq#(#;6x3w6G~!haMelxrsZ0Ny^SD@%w$9nucXGw29&L(KQ||Hef&W5Ig&8mi-RW z?UlnZpjd@@dd^9~+`cSJb%njssF?o#$|C*gr*}hQ`mbX6YhE=pSUVzhIcteEDj7<| z)>00Az0*n%n2|JcuY$^?DZC+#}B>ov2uNDGZZZ{QCPE>A6%LIZt% z8~TD;N#icoO0~348i?_Y3_4Vv)kR4sgS=g~;2k0%pO-Cl{rNvL{_n%x|LaeAqw0LW z#>R1uBIhxHV=JR`%Aqm$B8o#TL#(C$Gx@@DBspexWu)_5h(A+E<|AV)VzW?Te?_Of z5D(E7M4^{p*Xfc&KA>)a8rR8dYdM!vOQ>Uq1o_s(XdYF8=~ zuoGs%Gb!17@d?!>2L6ITQZh1;W9Rv5S*a*bX&9uOJ|P1FfgelJi5xl6kS>iTs^~o- zKLgk>%Xzw4DQbZ_pFRq+qVVTK1~slnM-+D_d=>k#mI&A&ZZ!j#4@s35UKhR#UqXM0 zuKih!MX~}8b>75fIyw%NTkYC4(#+FquEn`;s)Z)6-;wdZ;v5SV5R*kgI3!vkXKRD0 zC69hs9UdJ}KCRsmIefG8f`ZD4`q4NF76^9N54cn)A_K%uz$*0Qb#8j?Wo-{2-Msp( z;zdoguxxVx9jgyz3u2-67=!DQ;MBW-gM?{@Xw{w7B0yb108EHjaQ{ z`UL?sLCpbKrYyyXbynVWczBy^zf}gbcawUVe?xTzA@2gGOOC-r9cXe#z2~+^&kS)V1k*e&x50SO zoD-h+V~Y2zb~#fskaWsR*%3bZVb`pGyW1%oaI3*C*Spa|SZMVAx*-jH1mM}z?c3Xw zH+BG4GzB&rkSN4^vb^UyW1jYLtYR}^s;`DxMCt+grTe4yC`?d&fyc)l*BKjBb2Wx9Fz|a6#$HZFhUTY&w_P7U z?tr^vj|)@YItDtsYJ0>H^pK_8uM39bYF?(2^R9Jj<~wtk@j|>M*Ec2M`J)qq+V*oD zEP&p~H|--INib_*eO@ahF1soQZYpz)SkXhv%Z2pR~wM!3{V{(8fvKqVKS_oA0 zpI-ysZ@B@OQDD|qMPr04W`<0#q~!Vs*vw@hAP*SX<{cesLAO)`*OZAJJcm>iDLR00 zqxAAaN~023!|v}(?7FL@{GMwGqk*ko!fA{eH^McqD+03}^}DKi+Um8`Xa5)R?avCN zj+68j5vG}Pq2puuP?SS8t1;2KvVi!U;;a>`S9(%&fjnb_DcAV8XFc zeM6H*#RN6mI8Wx)kPM^F7^e)q)j;v_R?-ABJ$ax5c&g{NOK1A{^59gN4nwnZ#wN^u zL-U+63!m}PyNog*99@sDSDCz#g^}^xK1~(Kl z*d}85dibkqjeC@%$G+^g?lFqM^ocG4nXG+QPNq>(U`M4LL~{8(r$bxyeoV3$51#fh z?3WPs1b5NkV8_2{P@d76nvsRP;?d$sg|MOh>RtgY!gpmC%qt4szYzleO`-emWuU6s z)VLH}+!xoR*XVOv>T>`pLZ60ta}Z&=@kco2fGaBBQm_Sey>wEt?>XHemb z8=2KEF}2p5PXx)`4bUZ8(q;UO0TD`q8A#esgaI8JA*}7|#(`rWKc1x%d>6L7dNc*M z54}1Np~CSpCCaowE3!qj9q_r1{Iw(DQ;N)vLdIP4bY_MK-q6-!QT+ura_k&W3NO9-2ii!2IK^0LHlR2i(EpO%; z)vtcsqjm_VW^C^9{S_EJo$F+Y)yP)j_QuVkp*1exoRh9JtPkO=>$!j}M(20i17xu6O>F^!d!oY-;5sqhQBJsM zlK6KRO+ejx_^8}a-5aeEGo_Wdpkn4J8Is*LfpE9^7?=LCvh@-X_hlY zA<3YdC?rQB?E~{t++; zhd`KU&Q}1f6bDdIqThoz0hAvu)UaSVVbxg z$*O(<=ym-g@AFN7B78?U2b>(<)kUV6-I03RQVaAKw26@E@brmrwB8U5rA`PyBYMX8 z6Jmck#ubyR2<4Bn-Y-C>+ozvXg4l0FDgi>;O^HL%WYaFM963A;8^WIGq7KYdHuxb0 z8`JU<2AEH`WX_4L=Y{)gFsDX<5L+o&J$OPwMjf7awCIl~-(79%N%odWe2%`%$jFrl zmwY5ihfB98R>S`31|y2Uv{1J7PcH!N%JjDq+w()$O%}n`Wi)v>8@x-2#|_*(oJiwH zfoMNN;Ung{Bhedj=rN23zA-1?{onzI_JG4?hVSzLKyY>?kndoPCYwHRo3{k$og|iw zYOUhtn|{FIUH-kd_k2e*ADihfFD1qfVR&AtqP(eT8_5w+n($zecrOuONpCXB$u}!> zzhZsO58e8GoZwq_i@rOnV`7R8_<_~U;6~n^&bM9Y-qh!)Pr;?XM=g^{`O|Xjngr=q zV!+5cPeU3*(SXm>2tN34RO|opUqRX=y_Xp7tkiumOx$SjVv+&+E5M}pC=L@9Ld)68 zIwwkKoJpv)eYCeWVzThTPcxKH!*nDhy?y=(=bH7;o?u=WaB{OGtJJf~G6E#`-lRO& z$c9GUKoQq1^dK6clmBCyq-^2a=sHw+PJSF~aOEn%> zIkg9@m2hJyjj8wuAZoZ%F$7xX_?p?4Krtuf@J2ssvCc!0nJmzXeS#}c)s&nN`PRPg z9~@|TeUy4lXK~wTZY*^^kjy`Kk*#4_`5Uk0kGuWpULQc3znA=$E=4b~aoIwk4m=22E@4*A2aKnEBWS;sDAe{ zo(U{lC(*j{n{mx=(7t~)A^%oVUVP4cxEUwRC5suX^bmP>x-&#_bu>^MRJEkD%fZ`# zH!?-BCJA)ZBJ}T|YfBGJjfZ{Gi|Q`8FF698#e-vcEHl*bj8@Xq0@U zScOeDNm{qyLD$$pIFtHZu2Y`Hch56M;CnkTF3Jf)NzDUnJEdONu6>5JJuU-OrNX;Z z41#UIT!;^UBDIi2LBi_lq>J;tOarx*s*dd&ggB}uHT4+vpY!w*M*ldol2jZ&O2hg;m1kdGGA<+oioj&0*5 z7Bxp|;C}rX;abIuKbybCrg=IgXba2|lMCEBwMR3ssAPt1gw}89O(3x(jBF7Q?-nq7d0(;fsXB92fuJ|{HAza$X;ltA| z`O#{H@5me&MT$(y{anVaCyQh>bbuEtQ_!s;dSK{sk5%ppPIyRdwp1ITirVq`1|RUb zTO6m8^I_6*=!~BmS0SN}^I{AH#0k!Wt$C*i*vt544q4s z{ZF|odPtW~g&o!hS+cKRNA2VBO^j`lzj-L7=_$ce%dJK7-e~kQ#pSDTmam$P%a>lj z{{b}X%s%3{>ZZ1m7{~Y9tn$0(_ph&MvRs6_zxr$f=^Ve3IMDc`@p*u7E)c}q|HFDj zH1oyuW45UFo45`K35C1S-|9a)Lx z3EqId%U1CvK_bDS0q+=;pP%o#aUzO3ft?_TcphiZM15jTBBH=PKcda5T+k7`D}h|S ztn4wKzs_djkm@pxL$9dDQP5LHvAx;u_yV~J^p-lhWsZQ~_&U)ljS=`msgbc1;H~jf z;b6Dl&{~S?YanqfgU(t}Gm2V{KF(ds{Q)}UwS%?o)#1};-l5-h_b zvfb|c!7Z~BDeQ?$w~i0@oGBq-b$!G`Cis1u8UgW17c0}@f|@UG(6lQ*6Cpd^+r2Fb zUxYxR@HRuSMd`>5*$<3AFk6ptk#j)QE^6h>3Mi_)Nf0L2&H8q;GJ3)NIkoN>mQg8_ zJq5GDL+e7KZNZ{oReG{ksKtZ$38Ag^ms@*ch15k8#x^iVEE|s_tjqo4s8!WqNq?TQ z6uZMBVPVvA#VvrRc3*t}FE?+FPSoY0GIP(7*EG@ML&UI2xa|cj9*<^w&jIa!2=My* z1Wg<~XvASco4@|Ug2p${rRA{ErUbQG#<(|hag{nWz}jl<-;&$E9*#7Wv>9hb&Xag{ zqvp2!`5(~+X0^;3V7x|gGS1Fzz(zi1ktL?z&nn?p`u_m#>AqxUv&UR*xx+tYzQ6|f z+Rju}Vz7-ki%>P{bLYeAy$@rKzfsc0IU^8Kz`|l?l=kXXqpHB0s3T}H5SnwJ)IM-G zC@oXsa8j|u;;s1uTDKF6!rb#257~zEO?z+IQOBnpf5Iq5Kqrrx>kCICfr=%|$Olt- zjSBcNm?T+_l{J=*WLf+~!&0S+-mmG0c>aMi&0ZICjm9aBc*s9tY8_XRjW%2kT499q#(4&&U5J) zv>5utSmh$$=+>8^=>K%lP5!hpPv!^I z{f+g2ezDE1#=hcfG1UFoef@j!vHj6g8uwwsWOaPm7nPTQSdFi)<#DdIKGs#>=iw@} zpYAgW^5ACGSlb3JgOha5uvwin$K??F0XI-z50@_-e!4N(*@zmk@!NLYnJ?u1| z$$jlZfaIR3$zl{;wS6xD<3jBDhP0SWfwAR^-O_Mii)@xE>%5l|PUQIX8PqLE0I_W( zQ0F8m*&{Oj3>VIKw|o(soJ9B37(+{nz~ikPFUkc!L|OK|87r-BHy}QtcKSpMOu`n4 z1i$mwgP6h64+8&uS5J%ynZY+w)< zBgmSyw99I8tht)*zcP`D0Gc8zgzFUNkUye_bbqz&#fx%wuIQU|9zz_iKkzic17rN#!& zt>0s%P2v6t9Lt|Jo>NqTV7<0>KiH{O*gld#0iBD{JS$ZMsP|%y3CC`7s4Ah@j)V!= zUR#No)F)p|=aFj}2+i{POM4}BnV5I)xZ8q~Z+F({>i{PS5jgt$%nA+&uYk?u&J9qI zoJ=BaDLbwkzi&PfyEpl_OfpkVGKd-mg>&%tknVLR)=KZRm!3zg3bp?jWFwNPHzJHq(`Pq|oNtHi`7n4_!ZIv-BB zdHT$HXxM!%T@sqJUYsD+N+tIen#Wi)lU%IAEBPu;JWmfXKgzConMTV~O$*Nl5Ibh^#{%wg`%_Qou zE)o{oeNVaNr>PYik~dXv0G!&`bzkoa$hm0-19g2 zrHu*vijxexWmoRIc=rn#udyphSj*(gNJYU=1A0Klvo>@*8z|LUOC&6oD8}!lo`*X` z73ZUm>+z{`xk8wW=qZW#a^rPT6J6pdZ^MmoOdK3VuD7U3BMDtF`>B^LxGwHXAxa~m z9#TxOm@c)RaGOoX9Rp0aGWW&lgOU;(L?CitTZTh_ZHtM-4esC(zxqY9T}W>O(sBXU zMy*!E*X`R?E)U`K{DqSmCnlBRhksYSrR92(N0)*zKL5SMeVbEqW3TL;N%Qoj6Mqc} z++;>#S2#pSep502XKh?svZqbNa8gCs{b`VR=H20V$8uhaD%YcxiB+=2i}apGk*Sd+ zMQd<$F7SwA*V(h|3Tpn!@CnpAf0`_5C&RQg^1vn*b_@LU^Vtp;Dl7v~M^XUSleSk| zkyANZ=^CB3bi}6DH1{&z+S1g<&)tBv_RTB3p1`L*KXGjX&T_d>& z*W9ou*)uPtFT$P_M6SNVyjnx8madjUIIpSaoORy0CwPUdI;Ago66U8uawir_Fu^Gp z%RfGQDr611F$Qd<7CKDW{Ha4Q8s#kB^a0TMtF-M#k@}|iKo|V+$DEXxiEs}3t@N?n za$TlN3Z|U?Q}RCNDn0ymR~ewq7ue!D$i@|8#063UeFr7BHc<;siE(ai(hR!8l@8A< z_frt9)i$-YYr!uDVY;+x1>6`AF_a7ao+d_4XN5rRW3? zq~V)4*UPT`YSfJfHZKx1vas^;@;J|yhYJ=L8 zlrRAnS4a;s4)yP0-0`Aik?bAX)azqo7wEQTvISohG0)1&F-6KOknGOnjxlX$qO?n0 z^pI8b0*}{46Uj{$N^_~CssV+8gt)b`n2)Y&fA;lpax#!d7AuN5uLTjs_oKL&5aYdj z5rbI@;~d`HN0F$K>^!6bcjcNKoxq9%3~3CytT%mZyNYjCN|sZm zt*on$`sC-NxBWg^=W3UgP$UCgbFiq>%8T1HCfTxCVEI7AsFQgmi!%nLqiNQg;`(&r zR|_L2fEObUwrPL1vQzVa%1ItTD=~__c=pWK)HcDI{=zql9;q9tEq;R_!`U{x)WonQ;Hi?%M2e^4`HB@MKnE zWaZ;io80=kUA?FIT>C~&?Oi1Qn(a6g;zyjF zhHr~>y7G!zO}@VF_In!lR= zcAGjBSi-&_#5`!VAmFjlWxClKo#Icb4slXS`q#HUuM17=K+(h>q1|rV;=3K&`Xg5f z=lw2u2yY>HUE9>NR4a?dLGZ|{l*WtJD0~xj-8b`4AN(F}6%@Z9Cu3t~W@i7oR&wv^ zgy6!MU71`yWU)8bxHCrZqRNvUjo5=2K`YBu{}uV|h0Zl~E^Yo$b^>0drk|WdHpRk! zlK*J^yM^^-D#!lKhDcxW+X9N4GkImNfVHWfIHKUq>@%u$bp%1=Q39R#j|hReb)*B4 zWqq_P!fk;LZTk~|Cv75&7e)uo3`TdW2zGmPyc_t$HMmZhWu=!ZN;o?whnM zakmmHk(;eALHwgOW*T>9T@2QB!))Sv`nB6-ad9`IAG|Hf?Kg3OmSrf?kG*+DVQb&^)J=W3EElQwNIGAgO`Rv<63)<* z!ouN{$7qrexzg)$$|Ez;vS*KsFBe$th8qbsuRWi5^viG^e!dXJkH-)iw$WK`J<(?av~zFTBXaf2=?^|s4Cc_CqtLB(jz@!swlQMX z=SQW|t88^=nUN9>p$hra8{>QZ%9SFrd0p!Q{7R6Of@+=WGAkrYf5tJ_8ODJLF=rpA z)uAz483}7lO?-CQTOYLyrO+y;m7nvGP1Mo-wvQ(G_j|0|Y{a5mJ@_gWLfI5QF<4$d zPi|x|oTBPhMN3#*_-TX5P~;p#T8^Bfx%L`f-n=61RJ(CFW?2{Gi$e*|Ws&${Dq)wf z9^DCi=sbCBC@esCICbdjb;9?w2o3{$1rMP|N;4CmoR8$-)W{19V52mz`_ys}i?lb_ z-oUDmg`C!ho85K94rw(99M_XyF(1~OZwr6Nz3R_XTjm6^Q6NLrGE>sDuUr1^B=97H z+MPbyIc_53citGNXUI#A2Nbcw?wz_*>@K@`N%e?XV$>UIF=yerjbkhachtac;3V;I z)kViCsujw~sH3_}xoKfB`NBdbU9`-GscK{+!^p&B?A`I_fM&(7U(=HOu@ML zq4cUC$W9;4Qu8$#fPDQOgb+Z(?xXrZPcP7$+ODYr54_%fxH|2^UHO{VAu8pb*WA;+T?2t99z1o%ik;G%VB{-gE4nsB#XV zAolk>iq|anI(^%_^TLB|Q%}t1C2ae0X8iqE?kv8ei2aW^!_8tI^OrSr$Dcrz6#L1L zbNe6#CnrQ@(Emq0pOO@72Cn@HMCd@xAA=S3cn_=V>$56i{DZO^D6T5v0ckeRwCTJ02Kk2!^wk9D_b8|``$dI zb%zc`XFe-2GBP^BW}X)JjYq`9+%rjZiUE7zVgYx82-cIW@K7mq#f&+2WanQf_5-Xy z(zA!<!GW<<2n$JrYC0|#VzC^Bw zukJ{lb2i~zI&|tv*&K~8ogak$3So5>nAgG*Hh&hMrutpHZhDraQ~YEu5uO(o6TWgS zR-o`A>A71f?c&9UYnLZAFLE9J4vG7ZUXzx+^1{M7_m1YW{#3dJgi$R{kViQ3>I`;Bm+RRLQf*BPGZ~JRDd?1%srhPQUR18{!Pf1novqR|a%1wUsUjF`XY4}I z*-D@=v1z%mZk6~%@w(pIGK;*Ljtj8>!5(+qW&|EmhP~2{sqVXjDU4N8v~!PB7!PDp zOa>!~LeAouT+}5GUBYrO1@*?ymL;k;e8(&?w*!~homM{#t&k_Wtw>`NsH*nmx~*5s ztaw4C1(w8tYMhbghrbUYQu7tv}<7_SQO9@W@%nAk8hd$D(7h#0m)u{i+$hz-zWYL5@AJ7OfpVrSN& zlc7VoI;}F^+?y*~oQ5VQ?O?Os7-2f|_?|}28^T4AM~94~nlZ6wl+>h@g@4T*Wen$* zX>jR0+kupthpXr7bER-kJ{l9uMVTx1x^MkzLC(7P*e_7QZ7lJloV6Ao%iIsrY44!k zH68gz4GbNPZ8Iv|{!Lz~lcfEoSy~u}SSsap>+|Dv?Zx7cj^ZwQOxiG3@={d$#-kb*!v$#8bo7(675waftt*7dheCVZJ z#MV|1+RA0Zrj~fgVZr10@aIX}|1w`oky_F=QWrLnyEl5%4g7zR2sQue4dfuis9iwu z!DMmwk!F_&Gzg6RpAvp`Q(9e5^3AMNY&_3{d~oH*;>x+I+Wiz_C_t{p@VgyTEGazk z-9Agp;)e>l&dWZNVYLK7$y*PwpV$+x!sknm39HbDiuA+6HUtv7qj7)G?@aF@Fn9H; zKD@tInrnep>H{{O7D+7OhkZRFRNnoakg}`OJZ|0AHOtyG1^Z!CQjVu036k29^I@mh zIyT3bR#ffWcV9)eZOwC97EEU6Q_;W=gi8Cd2fRl1vomY}dmiyHtqIJp+PZA>B3`sq zA!7K+9^7!bZ=UV?FZ%q>t6jp!S3rqycd2`DFi%f@1GR{;FQ-7nJ#;9e9bO!D%AbaN zCwi!pc#TgnDoC6SKq7Ekp~^e+OApyh%!<&O z=*(oxlTuH{P)WG(Rd!w)J{G?+>uba&kv7 zr{1J(tEf2g1~bo;F@Be|ph<~&q(gT|SlI9|7u6DMwv9 zv2rP-viCZ7)uwx|b2+H)t7o`zZr!t1uM|wjSD{qFW7rDi45j!Dr(S}lu1E0s8yD#a z8N1;7MpD3GuRZpEnT%n4a8$y-ghe)nQ|F2}AJ=~(;J+~{i#a8gm`$kq)@)@c#PK(6 z_X|>87GL?+I3E_OJkS`GtFWK&qdN0pyuX=`ubt%H5@N1$5mHp|zd`t(rBB>N>zO4! zA#PPWZrq_K{ocKQuo%B?Q)C2Z>aA16p;knfuA`ttVZ5W})j~90z1*77wP~CZ@kd6$ zs;ezELrR5Mr4EP8P6B=5&v*7onAk$>ohCy&{5!ht+RYT%755(r-`_Qz+iI+M$fj2k zankdlxB$Tsb5rv!q+UlgI_#%VUo9bqIc9FT3|M?tq)Y&&U7c80Yils59{a_(Kfj;+ zIf-&>)l97|>zBYCQQFU4@{2BME8BCak>y2U31?7hjBiIBEqalanwdU+H$4XKyqPp3 z!9PX_TMZXH3Xqz<15D_HsYF7MfLezj%ihrUdeEMEu96GL#5uAH?TX1~*z-fbp{SA3v7agWMqZKvCCdS#@^ zCH+2EFDX6RlH+(Zp1G70tz06%==Q&dw@y(+dDfJmF7`z-<@y?(gwg{i4%=8?-3bSr zRf_8qAOtCy<-eZItb=lMng=y~M7&tB;jbB1L3}2tvB>Dm@n2k4!}azCr-b0ZqqS(B z^Qm{)%0L!ZOl>Ge1HA*5Jt4-pV+D{AFxyMm)OtCkyS~#F=60% zCkE1TmsZs*&GNif>hBfp4q(6KsBeOiv2`S?e54#`k7XLKQx-XGjK9=J?2@e(I!}ml z#A;~J$Bbv``CMKZudag7D?vxnz2_d&43yi?-+PHWcePDEezY{*a-<|`epe(-(<|;B zdCX@@9^vj9-LdQ^iJ^lFH-X2D!gr0VTZfhr95hm83W*0TM7-xW3@B>Wi!l{;PwZH{ z4&XMWHkdBSZ8v??v-s3U-fsHWB6O5@JOa+m3mr1=>lJm7A~d$`OJ**d)dUUwBXX(jD7ek*cg?Q= z6#Ysu$>6OZRaXbLhSs=ihM$c9eQc*at*_f&e`a^n7=v{6k8?X5vG1!pwb!{khHY*| zx+VjA!GT)hFMSL-)h)!^t>##3f#o!8J4FiHEeZZz@f7uep%%0%#{`d)iy?zq!3NI|Bu9*qQ>;cL|gc!C8ebb^~ z>H`JMJRp_PD)Jm3`STc69yGoZiZ519oGjBFfb98cdZ2B0!y{p*JZRVzBc2@IPVmN>soUyRM6k4KH9`Z78${wwbn3eKvKx=rKQU! zmbJ*WJgYX8sA@GHh^) z>IWxCS39lz1KD7oLhqoATb$*4JpHqIj;lMQ^lRz)GgW4`x~m$&S}J5(*}kczrjt3$ zdIpCB54;eEqYOGAY53G=!isKEJ-lxkl$`MVc(laq)sos!o?dp3fqY}#d+k-2y#6%Y z;|$yyz^-fg_f)hn4E&zKTs5A)iELn-J33EqZpNQGC{o{J@SNEj42`lRW2)2s+vB-! zw*xm<+M~{FjXQJ)zisq|InA~ZIkK|M1ncshRyFK@T=M%w+0`!yugnEE0T9FZ#@_}5 z@u-yaBm!Cy=dmC%>7M9u7_I5-15_T5SJ3&37v|ps8V!Sxbr?~S5SH6-D~gbgUv&XB zPx~W@3yyv=RTw7y13gbkTI`qWY$nIEx?_rJ9*HoI7ac)0aOy&wScccR-_-(_Ig-50 ztX7;tm`vPR5gqvCr~0S;xkpGQVs{It;YJ~9@_Rl7Zh!q`(pj<$h3H!bEdc_FGpK>C z?}>LOL0>4cnp3>ySF`~Aeq)l@? zxdfda^@n8ngwx{s)*MY>Oxj3BUfWo?`G_j0)s%p`FubhdQxaJVfpI3=b%v0~+ z37o&G=Eb(4)o-GdDA9obysY@{ugfnBAf#Zt$N?y{<kJDw@(u5v_Pg5czh0}`I7=E5a>r~XCtXC=SiL%8 z*V)7}YpwciBRRkT(w8zf1g%D&wncDNx33N;FX)w;m#%B3KBLl%mhAw1dWoZva>B7W;}VPm~tLrG|`yUKjzn^Z{@W0>3SiX0GK%s5S0 zIN{qlYbou!Wtc^nf$h_Ym~OooABCwh{YSEWal^~3IPwz#r`=dJcxU9uHH|3omLS%J zEYT3!W^$TNIq1G#Ji@bAYqs;6_@$c{QO2WR)7908z-3+fcL1G?CJMO(J($Mw7`5+x zc~A9XN?(lk7IA}5Kq9J+o~(N3vk_-2i&a2yz*n~`mVcoB5{Z(2oZZACVIJ8#m?|d3 zksVMo=Q^&Bz5*M|&x>UdEXNH3C5(w&M+0ig0!%KjHwo;qd?o?s8Aa8rpjd7&O4Cj_ z{_M~QQr6lQ7`>~;MYfLarAR+}wuH?T_z}YOkj#br@^%gW#Q8cuILau&>jx4`0Or=4 z7I%!JO_(2ItBJr!?uh=A)&kv&4*W(fFvYHY_AbKpfBKmIZdXock^L@p(YsyjwPdBv zo2r?{kkH#|EOsv|?EmYu?y0bcNOfmv7}E@%T!ty_XA*y zJ_wibCiqG7o+J_YdRGP-P>QYaqw#h!BT$6vJe11Em3u2T5V-jNMGFktkED8Yt5s+j zi^oa8nY$ksehuce(RujdByE6s$GcjMYajnQv0tP1N|%ou-IP48EK^ewY0`O5&>c_q zyLk@-$HjkPl9I&yA$2URGXZLu*{_*@f5QL!H%rT2eEs%4-nbL-O3*rHoeO&KJwM(4 z5Y|_9;G*XHL(#A3BAmFVp7c*d~RdlV} z+&^AAG$waWcl-V_pNtEnuv+5&*}o*Y&%t#7HCZp+O2}sNKG1|*&7~ywJ_ty?^p{`po7;TMQQ$GFeqb?*x&-hB2?jpn_C&RfOY4pQ zj0gDV%pxLMw-Dd0h&kTHzav|m1dJyAB>ll>_RqTgjkZ!S^DT6c)`bqmCXdeh1^Z{! z@9W4OmWVtPH}Y`- zdT^Io_xabYU2Po>A|oTwTe!Hzbj|X`?X@ST|3rhPHaG{ptRe4wRStHfeNy6JTL#;b61m`KjBUK%oYJUa; zFF0pVSlClfObzSe-#kw$^rZYBb793bdjhW0Hd~8FiH5rw^Xb!l6~4DFf78m!bL2~g zGcqu#Kjq`4`s;lUdQAeXDNAYNVq)kWrVp2!tSL#i2t6N8Jowz)s^aXL>H2_Qpx7M% z=RXU$!2zTxkvui~k5A(Bug4@4M?NDKZ{EDL9vK-42@ii2rpBvDaoH9(xh~(+r)7SL zq5_89li}y;4`V(B#ZJ_aa>b`#3-+wWSwo)o^D6%T_ExK4MT5re_tDcyVpPa}W>h@e zni7uffwK3;j*<7K^NRrT6(9VM5?2DU^AzUWH=?;{U+G}kca z;@iFu7L{6Unq~9%_|YM(F7LID-xPda@9wDp7HBolc9%8f^!VV-o_I{d(E2c|j@QR? zv!P0&vV@~;a&Vta{mf$rlqS)>6-pVf=KnjL%>xk6l8#7}>McBke? znJ{bL`4s>%CN|+Y1bm|8#SG*2`8$&mfi>?Eyi9|Ch=JUSgx!QU9Y~z6pV}Mu6z93$ z{b9+hE}lo2XKaTuW>bu+qhDHl!a_Jf>NStheV&1CMi>jsSV@dcTz|3k7yJ*MohlJ- zQ7;JL`V~GcANyT{m2dxg1a4nEzwn~1M&zo=@0bB6Z<8zcBrjXG*l4R&48jERA_jB% z;PtwCAEf)WbFFM4+oM*uS494jUqNoT8|O(`uTyNS*g*=6KZ~3=I5R3xHcV34_jypH{kMhXeNv zhMfrCJ}>;~#{{@Z8z`tI2s3vsL%aEcDsYo}BHf;$FUBSQ?n5(W-M`*%7b!kSAfFxy z5~qzZ2~>QY;5&Kncu)7bzNv!YzP{-NzDTOkb}IB(bZO_nI{zP9m5cn_v3F`_d_xLW zDegoD&!wr$%JJgo)G0`JjM|(N&2h2>gMRh_Aw?2ng{QG}#qV};MQ-a%35!D=T!4A= zU2}cq^V*-M_YD)}o#^dfG5dTF_Yl3+ zD#kR6;wNcuca15y>*s%yEMz!)D(nmn4i*!Qy5d9@X!YJN&@zxrQe-Gl9LMW`fRCzL zY5*dz`Rx3f5U>@c%`7wiS})S$*o|Q_GrZJ%@U!Xc|LE59xmH?9>A{Vt#rNBfVGN#; zsEN7J^)F)yR-?!uq-|Zo%`*aTx+$mml3~V3^7Tr>BdTf2K&sCX6y2Ok%Ad&R&E6zX zwfFyl3M(0BmSFfsd#=^t`0=#c%TqA=DwD%!Wzlx}O9^E@0Vql5jh>3RIsPXpFC}G) z1P4|bnO1FvF zvK~9ryd>X^N>SRn%w$*XuD%*$ccmq9kw;$@-f~_bIYr|h8F%GeV=;>x{RfkV9sct? zBVnQLr`(ba`lW6}WF|vL6Bt5hFHBSVEwGy1g;eCz#w^2-xAztE`yTrry0=(C}bkt~QVX`m;V{46kMv(ORUS7`8@VM?>s1Kx`UTPKV*r|SD^ z;IJ&+%A)(P3#6~{=v%gcofCCOMbC?b&iu2s{#^t+dF^vGIPcDPce+T&MmDQ$d*XeU zUA^4$ItOG(7nTdjXAV{b9C?bmKFp6euP;&#^o!CYWS)XqHa%w+66d*LxY)4Gzu!e! zE?>+7<^F@`%C|+5J%v~v({A!j*I7p;Twf5%R%9HrtH^uGO?Clc345O8R7{yJ>#b%u zaVWA!I{3XTsAS+fY|*d-I2Hcmu#;Uod*{sAP0oUAjK5Ece|Sk;{HC3pv11JngLCPX z*O4D|z7~}&v+N%B)}pH_C%YG>Se^{0AJ?qa4n@I57k)>R+@!c+|C1#oI+_FHzWo)9 z+B`zx-a?3nf!qN z>4;ZfK1*I~S)upfMhxw_7Roa-(Qm{M5A>ZMU=LMH^}p2y{0i*v5f>7S$~B^z=5tsU zq39kP~lEfvLSpWEs`OL_FSJlA8}8s z+5KWPoyDHDg7Jc&j#B>X+qx!)AG(W`d16A>X-`qDWxuZZDgo6tKlIQ#&Hm@I9k07y zH-Nj)=MPVQ(>I<(k~jI3rWfOC0!*b;7V?gCjPJ*rk{q+eGUfanU0qxtt-ki+LfVVi z!+6VoWJjok=gmKZ)c>O!gegw_yd4+@#-FV~0%rvFEu7SXvhwo&A{gQ^hS)R^&Z((X z;sFNVMeYaoBb5%B19^Hn-!=2CJ+fFY_9y-hNjtf`{|ez=Gn_%8p+=2s$O17M<3+Lw z8J{U56Til7%Y8lJyWQkdR=9EC3& zg`T2u&h&z^sqkDek6a;}VrBOu`87kf;`4szF$=70f_!nFe1(k^KLgRf-&_^(lVFhs>Ixry1%T%~h5Sur z|Ie?&hvsa|Ch|?s2h50y7*!Xg-^>Wy5{0&YkDUqZ{lzV<+_>lbtb^`hGdXts?sx-T zsU|7^eV!5DF`tHC{0hq6TO{;pi_`<)^!ku&KDIiwZnEOgxYuyXoz0ym$;(~v1J9Kp zTAMhk4az_aCv8jGzg_GVX=X9b*gtAXgnR$a?0I;Vg#J2Iy3u;CRKy{aYAe>P;V2?c zrvlv_|C9Y2B)5=i-NNcU{{OJ{)^Sm8YyZDu0s<-mN?L%RfJirjfV4_Ut8^nsGaynb zDcvPqL-&A+bPPEI3?Vtd&^5p?%x}5R+57CX<2mR1JU{>N#W>+`-)mj9uIv3_kC~6H zp*+z3G4?kG;oqW)2zO{q2BBTj)Qs=nJ&_)5+pYKG7pyfipO z_gi0zvwxeykr*yMf$7@48_G#so1J-^GRo}R>Z9g0C3Az1q(E6am2x!2C{)cm`Ckf*b|A>)Tr-)S*&y0Z8HA~VqA%Q=8OS1l#Jwe zSLpW{xFq+bzU#H1J~M($2#zi@UKQ1*_p+#A(w#oT9#eFWtU!PdYPzQ(26LWfHM;$0 zH}dNZ|GSURqkd1`*468r?wW32KOSB`ZbbKvhWra@^etcPc#?1|8EUYRg_r9}gBj7T zl90I+?wycnDy&=`7n2(_xFJeo8EY)H8Zl_SpG?*i;7l^A%gS}lJ3E1#&vq2?Tw8nhujJ5&`aPD$T>#N`0ygMO8LPA2P_oG|sy7>Mg zA_2dJ;+??0kJAiwzSEb>nyC8kh6kIchseS4cxL zN7@r9k_z1A57?6vQ^&;cuCY%q*UwBtTF{@2ng8{LKX8N_AA3hdeP{Wx{JYEZduQzv z!F-W!v0926n#`q$=;gt=l?gejb=0NZG$PeeV-b{U}i@fu8e26JtAi$pbgzPl$>1A_5Q1uNtb{FBlSu zjUrVdIjwXxh4?!qSuGFFm@?R`d4u;h*Oj!KlP*5?aVe_>c>Tn)b8aSTOpF*QtV5WS z(mwt4fs{@9HZ$`X1(Iu+->Y5tJmb80;jE&{+o_0oI)#JPA6x%4oG-kId2@A5ypt2Q z|GjeNaqr13SSWE`!7crSoeIaIjy_2Vvh75!0s)T5-9%&@lOM_2rrXEa( z!a>*HXh~zhaH3AoOpPYuZ{WTEx-ozJ>B^&@;i_-Cy$D$us%qlsUhe3*EWJDG@Y7TC z=8MUBgBKgd9qt_UGA6pyy+eQ7?DkAQw11zHM-hM<`2xFFBw(b}ZlKav0hUs@Zl&E} zTxzT`;)E!rd2C_2E1QKgbpAG3efd{ci_0XZGN~jL@ejwcM}hDuZ!7{ z>!#8T#Ac!&5RCqCDt?~$v{IiN$<;r8>EG;27KqmRps_AbG1Y~o552(OF-}$VV|HV8 zlNhxmQcz@z&Zn{*D`~W(vW$bVVI~_!{@Qi@-n0(fDRIW1)~;P(9gQmOGcd^7X?<2N zYnNwGsc6xlS4{lds=LnQ)4kedZRPHc@pSJ8MZK>{D^H%M02GU43d$_;g$NmJFkD2f z7YrDlnIFB_U=Qi@`*G&;;m8SbE+u#c%Hd8XmpRck?|ap@Q8(XF87HCc@*E<55Pl}1 z-)%(jorVv`zYwGRNJG*&=x|4p>q;@rG9|lJpTUtAZ7#aiBF*6X=o!rX*+mm$>ng2? zl$6FCt?#bCMH0V!PoJBY+S%MrdO2BYutzAGUH-W~5BhIf02D^{G-UgD@%lm@oCT4hu6lz=m=Tdro^6Cq?L) z+9f9dCid^H<8PPgcmL+|iZyK-B0+G|_+F<8#mOviddj&w(J8$*^t*8G*SjpaL>0$J z;L|R(OtS8dGvX?9a3{@E!#uGV-Z9MD%W(WQ?MC~`%y(NUSKszY%GqU$_GIGz?RQ(> zzPiwsq5Wt556#BLn?;y zEI&9$PcQltZ96n?S*ID)h^dqNPmMYVs>7q580n(W!|1b%wb#YTP>KUD#2gzlGc#ub zn?L?x5$zR7-oJVeTxFa_aOA&yzlyx6xPO6MAzdBcsRz4ypEHvm=pqW*~xu%3A9DG-R*@JO&)Ht)R&W+R)IK`c`Wos-hR!(>p5>WEGUcHPnwB6iC$#7C>n1W7l-_ zSO*snXpQ)H1=|#S(Pz6bCW(3yx^%V4<(}aon*c zp*VXQt zkE)n8?qez@Z4X2#>b$D6!MAycdbM2Hdjt<5P5zElT~8dH3FV6xHXJVnUyl0qt(;W=^+TJGCZyYk#Fd;Fblx}8w1qpaov`M@*RUi*Hl zaN`&DsEb&P#1(LOq5R7B3TMAz#Lj326l^-yw6 z70FrS8?l?&3CvW;;=erfLuC6#1MNE+x|*Mv?$93aqgwp4?;cX7$+@PaRzHuz1IuR4 z`s&+GcOZYPJXa#&kbxx&n(85h>{^4 zjd<<3*s`8KFZmO4^y6pAKF{+f38{{+8+Z!;<-7iit?`GKT%SH&WgT*~QPF!&&w`9a z#RE~^-Z^%!0C~K`@axeG*qe7Ih^V@>%4llbFf8j*G+a2Pofgd&l&>4uYNM1TQ}&4AR$a#@#MIWO9z2kG zm;$;Ljx9TXbrHXXz$H_sBhGK2?DmrWQZMFjY{j3=LF$*@!YB6w3-S#rwQAz%exS!j z{$5QH+q{r?CYJ_%m%3a2}9bpWyoOZp-?yfgrCcM)_h2*$~ezZE!4IF(_e> zR{9g|=m}j(p&{uj|LSf^KEVo{^)rP$mj$9f`N$XW)9=1sKk4Nm+iw1wf&Q<*`0w8F zQ8rDg_H3EOww_&?;c-p-ZwF@J!yYU7RARhGS!oy_s}TE7G5f#UAnKS77p1hOIe%^u zOyHNDU9=cU-Xo3W(}M@BSQzS(gAN|oY{M@B82@EG*A&w3a>yG45wk7vT1}O|09dSi zkaTc(0DcRi_UFI*PJeKe|HZ?P3Tf_@#g|Tc>GD*6SJJOWqz`0Hvqj8Vb$~x&3JPU5 zmz<^%^c^3r<_sG&ZTQt~FMpd=5)LZbP8|&8+dim%U)tC!oVxyG+|#xYY+GO&xM#+s zqK|iL*FN1P-W{xRb*$T5C~N2$uKk#~!B=lo4euaMn8%$>_=geLZe74I)!B_9CHQ%G zn#s9zt1=Q>Q7EtJtQx9=w*2ymqX3K)i$CR+z?K)icYH{zbQ&(6qMI~A+CuInt)e>Au`jLmfp>+ckcwCKc z-JRHy@+g0dwRLoAEWV^8;%r?$q1F`@5~q6iR_h^){q9(sCJvG7 zG?@+ewM#ZtalN6`c+tu@=hVDv`9+$fHZ`$IIgF3zg zAKIP9#(ig^+rBzFINE5MMrQ@5+-1zP;dVSkT;)M%UE<*%&)z<$^GCdDTJZXC6@#JY zK~%^<;dB_f9G<||1O-C~xMbA&=#bqIRE4@(kNk{vfv{ zX#{nT+WQTXU+Ask46gSy=n3&lat&oec*D7V^r-$7pZvPFPt;MO#UG`;|6nHn!$Tj) zjlRZVK9(IfmC!_`Og^GTGF@MyN{BfE>Pf%*-$2uKS1dFf2#7y+cR%#f zHIZ#Kjlci83=C{){VYj(RC5j#>nGx?7=KDHoxgsOEj&4y@iBD-ucvRCq)SfxYC5k!Jj0s{g%nsRy)_J=8cChLLF`UiWBu#XCwxv{ z*`JGq&r48cPpti-*aiiuHk#z4s($9(a#?7d0vb%ry`x^XH$o4hBm;^u*q&Rx6D0LmcF;sH-}R~vzj*;_g8 zb`ycIt_jFq#vHdX-ECv^P*1^1vXY$j-I{7k{WO19vvbrendMM#zuGL-Lw=z*k&AUt zLWNwS5ZaXYWnMqoNQ;u{`wK0{?^ayB@D~lcYh86<;!N4=Xp`n(8~UN_WwY!OqOu%l z49cs}ju>`EjpB0!lck$-crU#9=GQThDSvATQB+Rv^!+7ZT@{FODW7^I!LaMElq{?d zMtV%)6Fq+Ke@<98x>)3zHx!l3&h%(pUMBK6ang%8Fm$%FE}uDf{>x=2#~^b*}D?#_sW1Y^m2Cv|1^(>t4^$r(krOljmxH zI-*0L)jq4EcQbB^^D3UniZzTZWjW$>>Edn~IngAht+qDq0j=;nAURmdF(mbT2fOy8 z8q!8?$APLcX)TnOrnGBVa;B?TusfO!BhG+6P4#9|6+3tjM%ZWVs!Yfb9;O=?4}LTg zMrRu#?m_fdM{UL`npVewm`RxRogYsh_LdgpIh&LeY;KMP;drjv_2BYt!O-yBl9|DK z!3hDQ){l)p=Stk>(s7yK#O~7S0fYI8#d$3Qt{`fT%{t{&acQ8jF(R@xH%lQ8pa32= z#rM6BrD~UAL~gcPpa!zKWKO9x5vI)!;CPo-QItOex>xry_9W#uT8Yk*+XiG-{|A+t zzrP*8rd;MKF*kT}d?ci}(A)jVsQ?Hz^c5?;L){&|QY-|qAyIL|yw{G2%<{ek9 z2BUU5U`TB4{obN)9?RnDs*Cvh;!qF05x$mWYcBOYFlRLW8rO5sdo+e=whn&|fKc13 z)dF;Uerq2KY)c-RyQc(k9mc)^^8+!^=QmQl#mCOBTfCp*VF^}VPe<{lJy~CE4-=0D zBH;DQHz(GE99KHtf!kEWimYNa;#(Z_$2zS~%BYCBz0FMg(VOahtSsArZv<^NeD3Zu74Gg@yOrHqr@WEMyg^Iwz|J z+bUaCL=-wxX1ou;b^Emp01m@yPJ%+zGVz?gtAWA9o;xfc5A25K6m;#^ur6SmcYEDl z5oYHC=v2PNCJ z486Nl(x)M+Vw)wI+1X=8WR->50c_wpMPvXOoogF|a=0NF!kPEKAw8dH*9xGU zdR!p{9cv(%O(A0CewJ&TTeE~09LiuE6({@RoSlIWbFaW zk2Pk~9+}!Fc+xtooEOV_1L1@9c+}Gue*z zA{O00Wuxv0%hocaW04?iB^sM9H1WgEPV^qMUHjQ_`%uf!DUZx#=tXNsWKNxBo<>3T zo8=J$6)}^vhRv~y7DIOg=zB0xaxcGrlR@D4D0cv^>9Yyo554xFUZD5qwr8DU*v21R zsN1D(!-p*#=z>mr{e*y-+70n)O-S!g77ze0Y>%mcBCk*#=?-^M|J{s3|Ot zY5&Fkek&RE1+aDI`&k1<#&}d#xgZq85O!Jh>Q|0}jtD(%i{n?IxpfPO%^v5RJmdS& zZM6q$Ty${my;0aQEATxb^t z&N!e}v16P~O#NI<#coxQgJFRx8$gMXA1$-s##gAI0A+-cL4*Mqw74J4ybrb)_xi~P8u>{!_L?)JcBrygy&D+ ze-zZut!6$lB~3BOAx5!wX)t>_P)pCr_fg=*D)WA&V+e+f8(%4fOuyk>XVI?RQ1p5> zU~8C$sfAbn^??kxQ+x$wp)5!A z(vt|HXeBWJMpt|pjDW9#dZ|^uPEo!V=Zc`+yURL#Q{LoJeU;^ZVU13Jwh%B2>cQu@ zz`4=cQn~SoxM^^8@fI$j>3%TYiXGoo@bZ>y=V?mYYV*wplzY`IYgy(^=}_3Mb%>xs zHbJb*lf9Q5H&BKEG7=xEshq7_7dW=2SPi4t)XYX4ZAQy9S_wk(DfFVe3wnnXSEK_P zO`z#2s|g0Ksk(4^d{|WrllQUo8^*tyX86r!{)epb=j*QbpQi31?X;Vs5p94U90_wO zz5zHU0FHPWdzp*3x2V6ewsE*XBNCumgl^hn9#dY=bvjg#mwzqI49qnng!jrCGSA54 zn&6MqP!8xjkuVXv2Cw3tT_=cv2c%}d8Rw1_7krg0ZQ!XP4&r3Y+G^ABf(REFG~U^9 z-^rQ>(-U19$no21Ir!CGIQ0HXk&AVCsM!46NdqlB{)@<3-4yBipfeeVNUq$St4~gK z7T4}k$Md+P2*{EGdQhYlv}qW;pii7kV+a;7Heo-wdI>-A6^J8Pmx3PujE4}w6{3Qv zkm-6J#?x5WOd)JgdRVbZEAwfL-GypXxvTZkxV^mvbu3&WjErMPcqQY>bKh?X_2^D9 zv&|Uvn4Tdrrv#oxXPAWTiV2+LB43)|ft&0t_V-w!K*OI_sMhmx7A)4j-U)LV`m+c4 zL!z2A8)+R3-+QjAz$+C5AoXd@nI*F%p6~EO+-z*}4pZ^i!JC3WZ1_*{hGhSF`jMi~ z2bsw&WlmPvNv_|X%J3{1B$!Md$&}ru7aW;>i@0Q_UFjau9ml5%P!=*34F#(q)#Bmu zYS}2;B3-^%gL8q$54O;TgsAxPg)#osZRmFI`}q74BUYs(cGLr&EX(0ehi#`=g=}In z&yD`CWu7hU+6~6>ytYGMM34k=2AkuX-k-_VM7Ap^VeVSFKpO1L(wnzr?DS#_=Y-t8 za2J30&qqc7v!e~aNaT$#!%aiTW!v~IsqF)CHmUKo6GvWCnjXiNEKyw0o=OWt1|Xv+ zFlk?TFj0}UHLPW{Qep+I)w3MVzsA!NYY4g3gg*`}YFb6m0eky#X%>2CC80A$x%{CA z7wjk@xfp%}Hs?baXV!tDR;wp&gNeu@C6F!1h8=6Ftav9CA-TK>VrsTcv*I3}%WS9S zv+1Dxm2C^*-YM%4p~{dR=IJyd1V&s8gwPNO2yoG7Uh5>>LRK+pQCCx{@j2wJ;Snma zc`^p%rX3gz*W#Fy)li8K8Kxd&&iI}Op5Hz8_Wv2ag_z&%{tDv9ObE_-Yu|_>Zpx(a zRZbty4GyE|te%2!VaKuIymtNSI@Ol7s6iS;+WiIG?6q;5a6Ipe(X#oy?n94kH=8xQ z6l(Wcp=Ob#fxby4arBUK^F2_C>nJxYO5n3bb#7oEHiXhXuXSuw>F4u0YI^z;uxBmc z{oeFxXpn%`>*7J|WW!YL$L&t-zv>~843@OC%ujMeba3ysl+LuJwxLX-@9Juf8}8IP zHDbTsq5L6$WLT)5s^OMCPP*T+XJPm51Xt|_eZOi^Uy&7hZ)@gmb5G7jcLhY{nro7J zagr@+rz<5mx#>k|GWv^c@@+9#hTDefZb4ex+RsO*N5vt$yN zU4zg!gyr?o4%XzW{j-ao$zuVyXXMM5*-$a|4CQ8uFwu-uvV%lZ#3Dc0TB0SQ0ENd+ zT)H%w<3vlekFlGDy^t(&L?ze@CInE_Z8Y*1=_Zsk+LoF3zvB9_0-Zp_*LX+xKM|&D%G3AxpM_FZAU?YbT!n-bZn@6P%yyp%k&ag7Yy2BF zn-L}hB@e}x+@5IBoyWGNMw*yu#=Nmsg0i^l5Q613dF|rB*ry)qF5rck5&(AkL$+UsJZVfy{Dx}_yf<5bB6kck=5HSx zeL)xT{)T~n>B2I2JX9v7YOm_anO&rp45T);F3>6$?Yxpsd~z33$6sbo)=9&8&=jiTSHzOVR{d`@QOWo$6MOHrj4&)C`7DY5v* zY+vm0RO}XN{9p(Bf)tS64%FbHT+!@W5ups^cNXvCQZ(XTpArA+wH#;MOLu^p##!7* zqW&!=dogwX$}#lbUeBT6KiPsf=@*+bCJ$yN!d4B5SQDErdhdp~+=}UkSuIkkOkO?q zDQa5yNIG+NKg4z2yUcmjUFfjA(ctYAkQHbN`6=Dmz`X*YySOOv(7lDkVYCIE@T2L_ z!0Bo5HgwQC1TbP_+fuzoJrk7gyzNb{ke@y4uq1<4Xd#)`kFI9IHbb|L+u;pH9G<&9 zf^+CfQD(`;|SY473>`tI0VJ_6IuCnpK`aaG08VJUx`O#uyi1}R^ zq;``5gLa*@KUvi6FI-$~f7j0U+hzL?p)8o*+gNp(LS4*n=v^i{0&UR?PNOxiBZ&>S z$#0R2EmVQA?YdWuxXoEY1fWY>;C>dy7O+bLTdV7|L9dhxG>c-mr$Qqw29IN|@tAdF z$fW-ecOjohG%PJoJbPIsL3B8V39@40=C+7Q56FcAfOItuSC%NW1g?%B{MN;D7--X1AnqNWy11R3Zm3i;R8boa11<^sRRuW^a5nYQlFP zbC#XeQc2>KN%5XG!NH(6qU|WWH4+5umUnk)NJM%i3RdT!x}d=&sU>P~zxv@~4QXl)ZPQZ(-XE(i>CN+v^|s-2 zb0exlY%4Xcm|-i=w%frT(Vt=P=(=bv{E1)X55>hytLQ-F-IxVGnx55B1 z$abnqnUwBFPSt;C5dU+?{)Ymh2mb^G8i`G-7>I3rv&~a0WAgr#Z)T3>Bll|HJj?;e*xK{G>z^p`rg2-sYGaP{*|Z z9r<=$JsBfFucd&K2C)nqpjkS(37~b`Wa2}ii4SJ#IkoGQei8OwSyS!&tTvf-9bo_;To9QBdkoE zbGIY>n=`C#u3Z-!)&`2 z6^yAQ!`@XpRCsLO>a|>BJ-Xw(s|U)IA66w&t#NXx@&qxB)STYpnz}lL@ctZKBwd#F zV5lA7EYA*8%Y$KbD`v)`}CS7N}x~lXC3gvy3(BN~kKX7W*)Yo>s zN2lJGI_>)=#Jzl{oSSma{!ym&c!U1g3549yk*AaHPQ2sRu-}edE}I7X69f8Vzo?q= zY$>ufFFtJ`=9M&@S5~O?(8ZMP+SM0p3vLC7G$~?@4qL`@@ zGu)X{#mjWt-Q47!jAGjR{z6_^K6-OXMPnkJaRz$aOfmcZcosoh5V3e(f|@P|ziIS2RPld>3_(6AY~Tl9!QGlQ~42 zYxP)8Kyj*y5fe(&m9(^aw5)Y*1RqMS~*$dU@u zU`IGv?~d{X7y}fe4sO2l3~D9tIj%~?*49?G=4BfBh6qGh>|S4$7#9wR#PyVUeE;;h zPI)4>!4I4F@POOCRWEs4N8ESW(?9DpUFxm|L3G5@Ps~&U2znUtnb3&l37?6EZQ-h2 zro{8~3$pnT<6xpEQaQ0|xj8Lu2Tq%4Giozji`!Yd5t(xo$5yj#8Qf*ti%IVp?ukCp zgqfBtIs2yr!y56^YcLO>#=EYjh0K?stltpVa8XQ6G(O0$1W>qptQjhK`ARLLuj5(j z^tjDmFx_oX)o`Ot_jj4}3i7<~P`GxuOktdQdf82_|eR$%-K`1BC)j4&#Mx?JbO*cjxCY(c8tcaVa+P%F2<3UU+@2 zJg^E&OG`Bcc#h!t?Iq>Q>wItZy_f|!CG?!-GoiNXLfv`h_X3@7IBS$&^wY(E@8nnE* zW||_E6Ezm)n+H7=O7QRmYq*5RZW7rt8c+Yr8spdjYm7EK{OG*hrw(^Nx$hQ>Vye*FdwYmL_S|PwW^GGf{qb@M7k_Attlz-=X%5im9c3=$ zAO!g?akEp&$r4%PVDF|1dr0-luY*C%T`%J^+}Ki!syEb8F#f4_y=kSAGP`;2J+t1F za-t)0`ry7{P)Ky%XQ>Sft0phet-gU*c6AJ;ujVJfzV?XWmFwu+1Q!80!+JPhV7HvT z%7%??iExrt!pH_bJ2P{$$_pc43(~f|t9I|}J8w};GUtm`XJz)#6~uDt6AN{(?vL*U zg{gMiXdV8mkK|7kw*S$x{aUs{K1zGWcWb}Mmt?bktG0AJsYc_Rz*8e=tOM$;?whw$ z+Oy^ESk&!Rpo`*Y)d;C9y(#8`J0GwDNUu(myXVPIIk61>Vli%Iau12r6_OS>v^Su6k}Cg73M#H2OJ_ z{7Sivgx8TDI2WoP$bEfkRjpJi&Zb-`X+K$9^Q#X8w^L?SF7}>Vs!g4koZU*d2&=I; z{Y^%ZXIKmBHO~`c)aJzjr||A9R(@^%EfoWm1@TPEIk4sREs$T&i%3&i#kT9NX=5ejtlBh zK-|a2m1RR|i(((V9&p*}9#kFSQ1mx1Hb`bvcWX=2T^$=j8~+r`N>86JbXQeXt=$eq z86Wv|Jb<*?4L}X;@-AvlT51`wD8*%j-POpy-V<`-p~ev&Zvv#oGJH8grf@Cso#f(z7dT%EZQPYg?(TBs zQKH)AxD)!Ze3rf^YxxMTXl(iHrQ>pzf`UT+u-8W4C75C9w`c)$VQZI2divLE1rDNn zdv#kj0^Hn7cHwBj_J`+CUqp75MYX9=RbNhcPjE;Wl?%h&W_21<4})wQD-Bfv1GU0> zyh2(0*f>d)?}*F|Gofm-H{PO6R*eh0Sas4@n>_8WI>7!IdHjvd`z3|HBSnN?-wYqy zop6B2z%)1 z;r7^CZl4%cV-C@&RL|uzqt)wgZB>+&hjGn@t}<2D6P!RiI9fds&YQ0iNWt_;;yCFu zPGaW=#QCIK-N1reebv%eX9<;LPL#{a1M!@AcJ@c>?Vmnx?eK7Qf@4T)_nh^7`148e zk|yzew=pi^!u6pgb4X#8b_frv`(a+&Zm|x56byF+rsVZWIE64lj^fFc)fk5GTf4h_ zfkH6I+Ci+z@RZd~B{K_iM*<&aJ{mcR*k+sMOct4UTRXZcXjDw?T9o=#^z)J8DRukF zqF7&1@BP;a!8nI^k7SasP{mXmcR0AMY?|$K4#C#?(vvF{sH{f{;F7gjgyaW@L0m=d zm5z#2JAI0LZ6!G=vA}_Ube9DpkN50g+df_?>P>)4Ji(a>)q*E#R35{;=7+0ImIkOC zz-9zT{xLneRZCMQR2w-8f#f#3ns|HXB)*3?CgkN+F5#XJO1a;-NB8HOUNd<{FG(-0 zd^SlmdE!3LKIfN*i>agi{K4?TE(;6>W90NS-DO@{x^T8(CF;(!nUmJGv4%COn|nbs zq|^p37-*BY8W)To+Vr#Y9EC2ca3xxQ1HpzD9hRLiz5uUzTC zHh*pFhqS7(u$(5wV=q2k_ztM$?rt3{zCJWTReNALAGoYZ1?B*}Vz#KLafv6ex=&|^ z?;0%)<-vkoH*153-Ne_%vLeaVJQhYTk+*prkII1*(jw4CNJH4_M`5iFywdZmW8E<( z51;oktYdSQ^-am7-v_lvFzX<9{^9k=z_#d`nj%yc=B?7OU2C`YgOv`sq8rQD^~k5| zUFFS&5$)}>TZ^-*x;6{FtEbLAZqgm_J?^f1=zF%^$M@WBIrN)QImx0YdQ~gyY4hR2 z{n!6kIIo=??@pfdk_$_Yc>kF-m_ju*a$9!5NXIe(EQGrzisux}Ys;P$)Zrz@Nw>ra zdq{_5OPx~B5}1W_oa*rmI3u3q&WVMiGnLfaw|fia zi(F>*OScwuncBCg3U<`Z;34Gn3!145ZRp9CC}3B4 zVdw?bi~aYP-XUAg=azG@f4AN<+FV_rTizdM@T ztbNL?XIL1z%M+K}vpcjfI}1d|b_}oa?A>KZaM_w;gNg3qkPX_DZfm2g%=hjM*>)%= z@*?0qB*ZX6;|{!H%-I}ORq1JS!~+Vtn`JL&O$+43M5=dInU{s&&pjcYbIH{PRD4(_ z@816DL{p~97(k{@upJ5el?Bix=0Z_Mx~{g`8_I*`EJRgQRLorak;Cb^l;7j9u~Djo ziF3YT%?t9nZEw!d2^-Nl{gd;!x)aW%rAgjbS_0UMOoXUHWTN}HZ z5kJbZNGx?0{@5Cv)<;r(4%Z@#4^1@PpvxJj__7MY=Cu{Yx5X##T_E-tCUVch{;X zYabmQbx#mYxVxDUnC_A67%Tl1%HY?~^uO61f^2C-hwK{V6b6nC`Fa#;FSV_-xO$xk zE5iA28wI9Z<-J>1zkj$h!N*&n=PdoGQpEAtRGAKKnZ#rD%t$uGQ)_0Ha;`7E`OuwR ztN0FkpJMb10+seq?7(u|%wca_=)*^0X3!9GnV$Z(Nmo?wj!A)b;M>o z?5Ys`>qiP#Q+o;k-4tZq1#I)75384LTA8x_Nz_D5PoH!5aKnW2QXS?fI3u&hhRZX0 z3#3l{%&xZ5(`D}%5f4WdWV}09&Q1{6qpZ&sDmPPj^!=$26XmUk4^5bF3y$n}XW-4) zR?q5*x3AIX2bG@%dMqhwkUgI2CYl4cvs`L=Si0Q?@$DVTL#O386`MF}u9x%DyJl(( z90vZnD)^Tf$JXT}eU9q10+!d8wH1^UBHBNfXY z?@+!O6awa8&`bX|#G@ke1fgI%-NKO!Iq2NKMdmKVd`j^#!GHmplT}Ln#|;0N>Lit( z+1cJAgYu_3mFAY!q5eTyBMdarzO=*ni;5q3CKnTT(Vk0FSkrn%-G&vrSzX;;)bRWs z7;)(=gP<8lOShS7i@f3E=6@NQyOzMX>Q$I+g#lu+@{SXeMNUtvFs z&_-JDiQ$i5{D10){d0T+dSsMx!H8H6Mq%e)9?8CbC?a5>?! zWEk|p6?XdKs!fNgTsQ@ySYvQ>x|TL)EtW*NL8s*x+vTK(G25^l)emv=?TqOduIRj9 zupy2j78MiC1kDar8nt6usYS)lZ`{*@*oX*;^g4%rD}jpN)dL($gw2?VKNgr;dGuZn z^F7}7HLv84;;h@$Mcfg$BAMBQv||d#Z$s>C&5(hA)-AYWKm>HfqLS;eos;-L<1H*t za9WM?A)QeSry&O&zs=onrT+&V?0-+F-Kd|WQgJ$;^g2h*RG#MUY<0^-;mq^41(hf95f9Q_SPzzv z{t+=TEd6G^7z*$Dy1F?1KP#w8a#PmWNUFNwVDKFcsD6|7P}jZayZ+Y5j~W5=^k?fnc&$Qgw*3>R7sTs;&~{L^J1x+rHyq855+J9iAtx|nY@*u`GbL*8t7 zUEF56BDk{ob*rCntjej^aJ&3C32ImcIRXZKc{UeZM3OZeWRFN})fYR#+1M!VoCE4B zkG%+vK1ci8c4gKrvc5$VACHk%vUFg&X4ZW zwQ9F)bN1Bpe8hFaaBj=KY-vDeC!GDHYRbnMFYvTmC@C+n|lfr%;VnopT*!|LbDcyMl>`u z*F4QsF>$|`a-SKF`#%u%03-k5GP7|v&F3wKnVfI90C6EbPJ@O!^PT?f-Pa`aD1T70 z8tu5T`^7Y{pdI&ai|jE{?yg%=Nh=1COg&BKY$fp0acLBM3=-G$SRy1u9zA#MX3uph>FG496KGaLzac_{9~KwtrKk$6K8xoK6Rw1x2_0V#w3clfHS}H$Lev@ zZR<@DIonyF_v5{mM0m}6_9v&R?1HMr#mE_T34%#&3>h zBvT3?!_TDA2jHl0)vlU)*NH&&v~PPKhofotRC>05+Vw2Sl-S)xs_hF`D$J)7!_3k) zCd%I#0B+~QAnL}0|Nox8v;9j&^NN{I!x6+#Q-vMZ!dK9mp|g(0*yxYVP|=lLm?{@G zDg7)3xY63S0+Y?>SGM^U1e)Jmj*Kulj&O2V^E_lyHR0CCUgj|~df<;exXQG~-@G^U z))CFsx$daBD47yWX-p4A%%U-$k*0fMOpZ^p@l}s62bY}G7^>5_nr3r7t$@3?kd)mK za*i$@+44(A!;i7^p8H=>!se=H*7AOcQGG#Mmy)d)Xn(F#I^Mf$mh+1K*Rv-3p3@Dm zhL6gwQ->kC^V_AA%%fjvuI7Fbp%Ttfm=NaMT3KIMU=eUx&ur`2XU2DtZ;8qWoLq)n zq#BP!Ziw?Kd$pQA512@=>jh5I_}Zk);m)YsQ%u@x_q3ac;+z(ELxiUpyHa-UO_Q7;YO?~7$d3~fsL5n z+5{0!@rTDrO`V6gn#cIqnL$LPRfOVP)!{2!2n{M{ zGR%{DKR!}iTT_?6{*wCXtaobtv&$hr8t3M&j5cE4^4jU?N=bLN7eR!V#3{Y^)$C3Y z9c6k$L)}xE{;}CcNProaKDSE7aG10*QEeEwA9C<2D)+D#M6MArg2!;KNWnv?mj-{TdzK${bLidt915h9qegyok~%r8V>QS z-jokRdMPO(Go0dZH_Yvj1f)JUyu6myxu~`jUmg67bCmQUwg!Sz;DF=ir%#{URa{(L z^3-xd$6vQGWbAD}8=@HmKy?FfzQ_Wg)3F9H_jwaR$e#w^|Ho?T{nL8iD{F+*^Pa2F z4j0(!SCN#W8X!<5yot||pi$#J{Yv>zIT_v6Q0G0Sk5OQ&yit4Gl)AGti6B{5i)L(P zI^(=Pt^kVtG+Zt6-}@=uC32Xo5bJ$R@3ioin$SBoI{X#iaO%kk<%Ur5ndJz^_G%Zx zB_Oh-pa1$QgU%=;Kn%kG=`!5Vut2H5jqJMf@Axb*|}dLWS@rfxoKilHCpAe zPPML^8RVO4KAyE4e%N`EBcND>f&0&xHcfcLdF7p*Bw~eh;;K zJX&rxKN}_ybLt#*q;MXqP}*}~Jx zn6rR2aM*m7ME)&Ekd~R7hErQp9KKou8K)ts#goGp}NvGT;BA z>KQCl#!l6F&Sdz}KO4r~F1K5~XPSn%&1C)7gJ7?Jp4ak;){r8M>GhU+g{!;ke3_gX>Wi0Av6?WSR(S`%L&XC;G#kIok-_QOOOc=cBuswmdB67^}d>Tk<&`y$1F^1pZaytJXZ(kh{)z-Z&2#Tm6A|eQa z0wN%wbc2B?-5nw&l9JLOAPNG~9U|RbLn+doLk&aM07DH!4&Ub9*BkH8dtZIy^B-rJ zbI#1!XYaMwde*a^#gUT*dZo1#qU(rgx{>)LbM~tTqEV1n{#y&ZBb7Gn`Z7ufC6*;h z39x`@`ZTLa`RoBYE-r11`Ugmbl6wLp*Cd` zOkfO%N#?}db#jLmeyW~)LPW%6Ze-w|OF_=Ynq`DzNmeV^N}eFrP9?c3@)D6Szk5`k zpeEnf+YZyT2nor1-}OTF*)w@%so}vGlOjrF&?MpIqB!?|lsV&z)SX*D_69%>UGCVA zRD7DChKFRQ!@$h;YGDTulZoYTM(r<_$1h_uLuHN6RJkk#I3 z)%mMj&EUb)a&Rc}*{{YLvoL;d!2bGg%~|e;(B3&)8=_U6GGzl^=b3T}ZeYRR3E0VJ zDzoIFVPl$LVJr2Q8kKQXvZPV1uA1}O5((>AWXVMJdi16mJV5Y3D0M7YVaxOLdbSV% z{`_XkP3WG!+4+5+by@p7y0=C1s4Dju1%yZ5Jt7{6_>SnwZ`0uqL&I|snBm?5S6A1l zXcrfk96l7CC!Iuiae$e9(x+b}kf)ZG7}0RIT2x9+sY`C7tMtd$4uWa;jFMp5BJS*w z5@BtQ$Bf>vQqz2N4X547!hG{iXs+nPx+?Ts>08aq5kaSaIY8iCiU|?X9b|O{^NolG zgPD8B2XGNSSX6)b%UOQS1~17RE*u}wQ7>D0`M+@4{%U*cHeS%qU6Uokr#qQ_qIRhKRaQ%1{evm_i#Bg{7K1T+ zf&1Bw&dZ@|kPR{K_4Rl1gLvz05)6}0bjPWNvkqk9|LA>$FG;QU79JuaWYi(`Dnax! z!8b4U&!+jG9)v#4g{v_by3+Xg_$bE=5&oidOCd2)R1}ACaQaH(J~jXwjWRHr44 zyFSdk}x?>13aFV zlp!8ohrMi^2xbHRloG0!TVAn&6|@8ID-Pe^%}ig%&^gb3X;6J4DIR`!nkL0@;Eu`r zicc8o^|IP<3FrGsugKiScoOZ!idxKLV%xd5M?5Tl8SoD#SnOYsG3)TwGC{ zaoBZ2Sl88)70SuqYn1zcY(;|#H8r(}PSx(cOB!cJ@9+x?3y3w zY^PS}$gmvU+BN9jy?at<2F1$INy{uYRql$W$%?Bi$!xBag4k?+NkOFObP-HVThj^1 za>fc-YhPxD-vUMJdybAa#>}(#TNm!4-k0PI=RZImRhvUXnTc)`mue1(n^_`G!^t)E;H$mOlASyrr+jJP!e7=w0!lcE!bd=6(oABry|A9cao1@M;PzyEfQ zUDk``oy4yxtVG$fv{&8w6!LX89pkJ+*EWO1N$%55J>R36GaIi_!SGr>%v3xV#+GvO zq4#Q>fQvF%?J1t<_O=Wai0>;0hiD)9%;Z`iAmEYiEvpo zF`2M1ld>luv0WLMJ8}AlEcQPPxJUtMIuH*5m3iXZE29yMe$UIyMpIofRl4?&8=x~6 z&9z2&wZUy40?Ocph35=fmBorV>Po=rk19CZ^oLFOpZ0_Az13$(+!*!+9$)anSWU$N zpHmb;xI$Aw0f^&g3mGS+5aJJL6j}8$6p9Kp*&5AZ1v1=}zC0{Tv*|XbeGi?hswp^m zvk@bAH35$E(Q{kgKc-j@eebY!Xt;i7dm;u>+^WjVU20;eIc+sf&idGHdcaoc7F8@j z_=q%%ojr2{{S}0KwrcSAt!-@w_DNY9mvZ)kOmWVpCMT1_^<&5FR>yF&q*h{EESLc_Z>+iPVoLmnacPB`(*sDoE*f{N~J`- ziTM~`tj3s|MlDtXMnqX9x0z~NG{g|)tNbcqDX}qPO@eSn;ku{)(y&|GOBx!yZWv6e zi{#40{GEs0d_?>|HGvwW>tH*hMe%}8ONe-Gi}?4H{K~F-i}Yl?R>`zCZ;Hq9*(QUw z3*mnFyFf#sGF!8vH}hu$o7a~gOG%M5wOHf2q#`V9)E_OxIs(_ab$F9>W^C7Q$^d6C z>?{k7kdStT_R9w}vC`GR9SGedWqBfQ<$HHrLp*E?y2%^;*n30JQe_)HmUSP8zu5T3 ziaK|2(L77Dw_kx{=0!T^6vd}!Xzs8Ip6Kd1$n31gBU$dxjRKavnM}{w+4(hwYs%_# ziZw-6qmTEg7T8IMNrH7_$?opnm5#UiJ@(63O?Hz6Ez2+A~d1W)%cai^#>q6*qd!1V_aYbu!GT? zrMs>40CK2bzt+f2VWeV(f4@CL5K{5op3UD|cfa!g_OP`ec45+Sd@YmpKK`u!{vn_v zvTuaS9P1*bz$?q#JI8HJmqh=W_3*c-m`EKNmWm4C^S{(P_cL}CxM7+!SoYIxhFO4b z>fhOD{9}*e+qT`TPR+?FrCDU2`psMYx%2;Wl)m#psJq|#jk-Xi|CE6FolF1eM|)7< z^uD*lKClu=BKvlq|LUB7^EeMsnu&ez>fE2c|KGgU-<{U{r0$n;gxC+y{|_bn@6P)- zZd;_+>xA&N|C?z4H!k&eGv4Z=4|Q*EFW%bp-G6=He|BTk^jIK230BhmB+CE(P5kM%c>wmy zOP~LpX`t2;@n-j@Kvhr(6Vcg^zlfB8#*R=q!Z}3n! zZ7=gi@mqWZWOC8LTp0CiTSVV{#YbBS;{nF8$txwfq?pa<CQ*I_I$2B2iS)l&& z-0YZWe_R<-g5X-Pc64wM|MUixV$`*2rI)s?EG))f@bcwG6O~&_=?cF=UusUJpOtZM z`NuJ5YnAn_EgKF==*q599&nN$C0N%tcF1SQh08$^`|*GhvPpV-5Lz-&o~qX*{n&3UwYS(>%Me98CX1Ygp3b=r4TJUI*+TQfM=q@D zrIK!``zQo+jgU~l8(ANBj0;${r~hYD;tr1D#L)bwrj{+TTH`>1l~Lc~X37qgN9n^C zY0fQ+KVi3HKfROjw2uCb5K~Z4Q%>&wHsuA>-ei;UF@<<`+-Ws`q&;q7f&Ey%W%Ev( z8K9pU;IDz|qH=+?ZsMfZCp!QRoOSY0Fo9)a3`tZiY>NsbQK2ynTXe0;U5Q zlq7g*+J2W=LkP#+B&w>bmq!LZXVyZS*}DSrvjX4pFfMV9;%PZqEznrOtL;ZhVonRo z?2Ddeh;DiTFk{%ix0#asO63UsS2JVj3|1~}(Si}5VN z&D?d&k&q47d03#q_Y<@yd3= zf$*F`gKzDuKUC~3aB=pHwz0 zy@Wa>d^2AzlVX<>Z5RTx1BwnCbEC-7feg3~Dw^9Z$a%ZP=i-$sPobSy*o)Z4_uZ+w z{#ARjpYr1Wa4_KaJmFWMvorUlH5U(?nP$Y1`6}2iS`}UK&YoLkJsYV$VIl}hd`yQc zwG1&E5R$#{h!9hFfrM);pJ3B1AcpMH%wZ#?K30JKD6lcq2Vxccc9Y@43eC3_ z)MrVV!*CxZj*V5EO?l>h2MDvCUT$n`qHnH73qHe57F^%CU_6%ovAhD(0#^LYXp8W| zhnh0@uE@9(`aGoIDz{m|m;KkCp8DN&SfJaxAn#Kgtj;}`(q&NcS#xDG45Zs7)Jvb6 zb1UPfADg}0bRzPqpL=np3Tto;44Q*{2Vm!y?Uj2aBq$}kq%T8j`8&;)*z3=>4mkQ^4jm<$ z0#=f3GUP`lt*7G?1RTV#QEYe}2qBEtx7PBd!xHu*!ov;6_S3TSo73J1-t36x3QwNV zSJNMJLbYe^BUe_KTWQmPWD7ee8_nLEo3&>UMkru;Ee$J*9{WT%)qHFV+gM5QJtzeCV!_g|^BCUnf%yh>YDsJzDj>?&hv-K^4Gz}-vZOWo+dkk+vyfeTTq*(U)eeH$vD`VLye{5 z;`$1L#iQ$zsdH~RD}A$$^_&r(g*jue|D9q`D3k%&+uKvuwGU`CA1>^`58t25>X9#a zhMN_GU*NPKM>rcOJl`D4d$#c0n!%NsGAAD7X z6d=?Gxb-wS7fMD-UM%I;-m@nd3;L^jSn)iAFwawIeu%UCDt-3;U2k#mvaFGYebs8`j1nv2^$Aq7a| zH@?3{$E?m#G-o!J?oq?7cZ9rp*j~-?teglx3WXd1XtF4bNvY7Ob8`a{nt8gS{LBBqz_fq+7-zAlw_7Z2|1*~aW9z}rdXw)QvaLLSNUbGl@3Q_G0)mSq z2Pv=DYvOpM8I>w8W=HfnxE{Q$B-oe#Xvm70k1~biY1GPR&(UEKk6@*L2Y&=9R@#%(&3ynp^mHeL!^1&9EU_f(=HbTf}688@<%z2|08wH_=q28zwHwW~W#gZukA z)XFX239SxfL5`2OrN$-;)MV2MmFl9+GUQW&y?nTj(+2b*HxClb6mror@d9+9>@0U* zSYXC=9ku?Fhl>^M($onXxqJJzqT^L)XhHe~VUn9^zLn@wI$^ZMbR)APBT3TptK&wU z@V1-Hme5r}!;<v#Dj&dctQt_h| zQJLwknYC)A=A+jE4R^qYQL+c{IY*Vs^|Qh!_tw&k**jj8;;CY1WH1EV_NNT|3Tyu_ zoZE?|GqFdsPc9Co%fMzmp^1`&wTiRA$yhBSvGe70GHl&?h6v0(R2U zj;L+WIrX-#?re(PN_5nSqUa0tXr+YM*k>zQal{cP55Bbej0_mre~65Hj{Aj^y>lfU zIIE8lgUtGa*~5jpo-VJ(LLN{Np;|L(Z_=qrrAUMoZrhJ~edaVC>&`5LWjy6c&*vtI zEHgmZ8H0Keb7h1amM;;J7#(NBI=k+Omlw{kv@z+3Jt*Ubl#X4KjNkaQnu$%ek48>g zs%j&hnh4B9s|%T4zI<6(AsN-HTy`)nY@O?c)8r8WL}UjmT0?8Bw6iugIzcI|{&6{A zPaDmfwq64!HoJlVutaB;_Y~80O--|fjG(#P>hq;AIn?o*hRL8TpsS}~RW`ul&monBsr$kOK|ucfeKHw%^aM9LuJ& zQ!b=kwWL@Jk6GVc2{H6qaoOrgbBu2ECvRqUahl~x!GC%6m4>i!e|}AUjfsEv9i?Lz z0SjyUqi#@B0HV}t_Wtqq$QQfZQ8pf7+~*c{xKHS-9#}-ja98lH#e65sA$lq;!Egbi ztNT&D+c-`oL%Y7U@T!#r5m#b zN1vzC5G<*ojZKOJ_R3CC4lNCPAVzm{?sXL!a|^arHvvfjrBeZwyh`)nVJ&=Oe9^&( z*DEK7n&XT*RH~hBl37@#94R9rxxAPTgrmkXg&a1DOS%ZK#Q~6{gnyIovdsS~_^mtR zvE$I`v)0fhL(;XED;>*u^kA-Ci`s#N8!`UjGaAm^5yKf2+J9-+q|-Ty-~OY}z{*K>VT(C(p`&N9+seAH z2+!3(vspgm6e0L+`P36?H6K4NMaZr!p<9>p_!8doWi*8{Yus!rND)7!ZnktyDNlQV z&+s(Z2f6=;5Z45p`0-HW)K*Jh6CXj0wPUa5IRX3CD(9V^w95JV2dfc4ZF1(B;-D7b zh|Q!#z`H3G@4$|W)ey13o%DjHfEeu*$sn{`?&Om@U$&I9cQmBIro(T)8gArMOPk=f z7X(xy)TTAOxcjhNfv8`wote4>#Ex4PXd5tWG{zv8+_{S6akmUeCeY1#G6?G^mw|0h zG(7k!e@R)+MOIc;CLT*rhK)cegQyiH_t}MpMJF%wymCfvS{r?<7PIXG zI|vls{xD`cF9PAS{Q%$R2C?O_KIq0aKh;vA2>b1Bfu4P2HG>wPJqO`RDdW~lVCpMZ zK`=QgsA5OC`EsItFNwuxEsQ~dZ|FLnmSc#`o@twM6;;*rF?(cO z0RL>EviCyu_K2IUY#jNqV{!W;hX)5%ckGYUWf!IskmXktQS7b^!Jq0E{T>lze*KR>*km zT9jVaBe%QK*nno~u$gLC|3<*3mViJ}*M;yr8Dkm20+a1hf4CcFnBJ{3{u5M>;FiLO z&|4|oix{J?2&=UT-6B7j9csxoY4tM`Yb|xapgxp0;xt@(R}QTRh1cp(`Fz4(s)1Bi z7)Bp~@XR*>s3N$X8Y-DZV-9(2D?wY0D-d2YLdBR`w=>4WNfl-#fIHRfgbeJrt#*Rl zK6YzOSkq4$4Mv2ydO|_K&}kiQ z7VGGLm9S`jJYB_Dl_#Hq&jum@n;3lB_S^%u>C>6;Tggm`TX{-t8iZuH;qY`&Nnblx+W4BO$-E{Za z*5gCTh5WCiI%Q`S70*Tr7-T+tNHO3MAamZS-CPRSc4B$&wP$Za1iMj}A>`8Wv*n9m z)sYV5wcmCQ*HcjFdnj0xsedk_-Ri>m2650!0q~6~{<9`qf5KG%I6HD#vCy)lX{4bE z1)Z@RfQU4{|1|m9NSTF<@p$$-_C8fTFsQ*K6lfrH+ad+y(=c;@E%q10T`P1wyb0(; zg;%esvpn=E%c%RDdmL((22hT)Zr1xOp5T>{A%qEYa0rgIn_Ip)siHzE_tA=*9Lt%w zhRg)_WI)0lx(6~rKyYVvJ|pBIZe7U>G61Em+7?yqHcD(@AQq1$+i?YN-b&Br+(r(V z80>Gy?WuaV!+OgiLODCr?w?~)#tWhM5xUVT9(Ekxg0+q~JUEElS+RF4&&$i(LPF{L z6mebP9mF^|JBYf*BY#Jo{zF-Vu?S+Dw;zYa%;Kuu^qO2grO8dYB)Dt@9YZ4m0%Hx( zCNY4Jt$#DNGsO+XQxR~wZasB_T8E)V2k29!VWcjn3n5@ycWAUo`e zYRQS!Sq{kpg{&U|@d;9vWZ{U+9=q)NPQ}ao9-*O^Ub5P$bm0D%YL@=li>4Bx&tvXX%)hC<&GKjn7H2<}THm|ONB#?D z*eDa3opl-}By#PFvrHq410Rb8ag9C3`8~mKQCyunPzLL%Qi>px|C2*pv;TQ>l?osV)BaB)+epab?GW zf^FnD2{9go1K|4{H#W_tHSP=ivC&I_@vmJ{|n2EU?f$&PYLge@>P0fSiz&%v79ff3c?RV95)@JL(Y+V>lyWnuRor9y!Kn&DkTjl)q>-Q>MHp9&v z5eq)M`-vm1ngnNU`U5Mc7$%mM#NBn)t5BMpKbeC4LC^^5<8EQk{q7J}aYFd`;Q=#) zumPS*={Ds`_MVe}t}>P}nIHbctGr9rTCgl5dxz~PdUm@4ej(?bx01WAnYm7mLwW=! z+w8OmCKW#0-{bnIN9DZrPP5YH$;eo@IFJJBFxR$C%zfg0CbKuEEv%%mp`k5Z<`H5~ z=+RScpii~s+DN6X9d!~3ve(QBU~{yu9>q(|Qb?l>Th9Kb1)$uhTiAdn>-Ux?6ERw1 zW>%6l!Ku`5s}F*kbH&lmo;}NUF|xZUeIQK;^n#MNASq?_3>!}HS~6iZ>4&0EKD{|l zaq3oPh@+!}`n;VjOrbn4PRAVw;6*C00l1khA3Gn)d?D1_%bo-$$tEIEg`l!=bJ1GK>2u!A~pU{b>;M zvzZKK&eQjW*#ZYjxZ8RZ5DFI(-VBmEe~+ zQD|tLTM8C#h1KWY-9~~!(6u3IYX#j~@IZsV?`$J`-jb5sp`u$+I-FNWM~70AcN|aI z8DN-pU8wQu{T!ny78+-^G`N(tc4>ncH80)qTp&pptq=PjfxQAa*a@f)p~N@NAmpuV zKWj5%fHs{nuFc-9H1V>z4d9o$h)i+0jpg!qiPN4|!u* zy7BP0(5xRv74tQZwMzgp+y;~pL;BKW5bhNq}Ft+7rlW_x{*lqB5>R29i}9oTJ;oRAgl3aV;d*I+j83HT;XFTa}ferl5H zy-}61v$NBDoUe;4&}my0bV9u%d2e{x7IwIg3Oe(MClPVZ}csXj()h1Bsjg=WHo5aaafx5NGce`bQk{}U@BKP)DP0z}b*UBjTX&m~^ zAajn37=M~{TrZX@D26^)b}gWCCbM%GmC>_oO>OyY^==4tH7Yl-g}w6%sakItaD;U$&u*h%}A7f;hv&w_RmB=IL| z^Q}M)0-aK@LNFa2Z^KY3`Oyj4JPtY1B)ONUFG-Wg{V&Amd`aS3~|s9 zyohjpb7guv&kIfRm2zi+W*VE7ltjR89!41L6IIG8a8!J*Dknin_&Akm`IU$=o%>}k zI!T+X?KHBM4rtYsWSI{zYOdBIStzN~?r*kF2#iV-5?1J(+Cu7Sq@XPpM zb&Fmmp6&HXoh}|psw~-RLVtv9DFq+Jbr6hY`4BoRxXN9Br;^p5tE7P0{KCG`)0D7O zS7i^sy11rz^3+zC&$TLOF0(KiiP=Z8y(a%uT#b*%@c?^8`YDBguybT_#Yd&ar7YLj z1XM<1)4Y$cffui9ZbHHSDdA}2>P#5dh2G^vS1JOrht0se8tlD?AFE(#0K2lg+((#m zLTZ$2o5<3d-O2?2yrJriY)5foFF!o-8Xfml@aKhah!6lKq@bKXUQSYovZMdRD ztiIU3kI}j*j~4_l1b^6=a|@3$mAHPp*|2s~o6V?`SE19WbFVoD2LF%k-z5tVHgv<| zmb0H|QGT~uRKuC0Gz1p!_b6#zgbIjHv06%)K0v<|d+YBn$TDw9)nGJ#C~Tzj@xB8Y zw_S1-mt7SQKD_Zndi+_gTzz9_>HR%N^eT&4mpSEDCGtwQ4tcDcjy4(Rpx4xJ966UM zHF>Z7BAwteV}h-wX6%`Hlab^C=ZzLq;!s2T?#&lGBPCF6A`V*Sn>W=P-@86Zm5gJ_ z3ygV+G#oTjFXOmpD;0Bdw}14iR4{o84h+ zum{IodwM*ga23*|+4pI0hKI!qR^l#GE%~;wBFt7ld%X)W02@?rbo5f}eM*R(AnWtD zNp_4&hkpL=f|{9J3nICj;(Sm0sOGI?qg>|XV&nd{93yS8V-=MPMx2}-SO|>94z0ka)Wpkam3&IWNpv01_MbIIefV&JXxiX|2X?!MNXX+XU4n-rl!O$l z*3{j!y)Pn92H7>8Y-*#x<9Jt0J|~h4Td!MZJB=-MBj*k81!H>w%c>td?bB5xpzj(S zVJ>9=ZT^-Ux0c62#d!o!fqQ~_F_5g75$p}?*lKHS4Fe?Q^Eb z8~qAQqKN4Ras z$MlI(o^}Er94wn|x3hVK`4bvrzELEk)GLxA39bXA90u75*hHPT@@X6yLe| zbo)}fTUvad4=x$NLu?aT!rKKTzQB3-rKS}x ziX9%jWVI*r1$PSohsK&Bp!53wz?=6tz%4AY{=!-(s&-^Q%b=rnrv)Mn%h*Wc7@ zv9ROUbT9)KP7q%v*~_bWUr&a!E(EY=SJgeBl!^2I76tVv)Cj32~ zBHqmpdb0@^CP*dU{G;j{e6>f2JT<)-d%D^me#ZAs{&)W7LCiW4U`0G(KQ+wzLlte` zM*shmy8X)!M261H;9*XaSV?0iT5NZQCs0QV$Yj47OKc zOdyXK{NaOT|9;U=w!&phMC#Ji1y=ksB=~K}zISiOf1^*S1MQIXF$cRKpJ|%Q%EzZp z&heaDMaQM&c}3!J9R`qK)of{QwyXrQAM(I6V+LT$%cWa?b-~{U>5s2uuXrpkn_?f} zpA@C~Hsz^QuU3Dt zH>DRm1%bS0;5nq`hy`Bj{rKRt0>Jh1-(R_VA507rYz&}|hXnrLW&?k7A0CO=yuoOd zu2V1%@o$6v1NZvNArm|JwDk0Cxmu8iwHf6y2|}GM7m0~efHQ39)Dlc5UF|km=W#Mg zxY7-{PH}UQkynh4fNR8qy7Y6l`PO@P*L%!ZuHHdOguiWQe>F63vp*b4RwD|KsHyHTG zmHn6D_9Z06r&oTT)I{{%)lIWPdhvoLm0hK75E;GeTnB+FZ?zVFKrukJ9Ty0+m_Jel z6VyFOIbHU1|6`fe_aFa5uPmo>HLl&$xHSo!g=uQs+Wm#6)040{;>@`T0jPtRXOI-rDTRt`#VsBcEn6j52uVf=UmkFy)#4TaqWH1 zA~G!O?dmcp(H;Fa3-nLnPEIS(c0(Mz<4?uvK9D6PxVs=%N_5y`h^UW0rNnw*_}2B8 zQ(QYtAGsfY`fp#bt~$^?rv1V%{^}QT5x7$$^yQlY=ILiY=fU2>V1q6qT%H0p3$k@j zS1g6iZYgCdia6!_T6gk_ZHYyYFex{K%$mV)p+Rq!3M+$L(!+c$U(JXQA7p1-4($a% zIVzA~@ID|v?5f{xVM@dbsPuA-kFTPcYdye?Jc+pxRMtW9w#sQ$_}QF$?c*6U_R}|z z@%w?1yc4V!9Y)(dnj!NT8bg8|zlY;o*3=uT6-RHQ{^e=g;F3Y?&wjNB($XI3>9?>C zq&qe0m40*ae`uv#sK7R84ZZ6Ludp^c@db0ZFQsK;Q@n8Xx+gP}N^U49$8C!;ie~`- zgNA0wPl$IHJ_XW(q&a41n$UQxyg+8Z!2D}d6BXjR^ES7|c5!3t#VG7;3g~Vp_#fO` z6>|KOA;Bw?hlXIeM4@3${q0y5{>`_+AZ*q+1xE8u|F@t9C>=FI976F#8sO5&F^j5Ct6{z?!{CCyvuE z_p5@)x0U#>{0I?kY?cU#9lp*goAhreD$a#F*f1x}Rhqm1j{lVyc{bK|P;JT%a;%dz z*OkCJA7>v=wmx3%WB~LiQpdm^Ev5?udJ0XTEE%c=NzZq5I-)tHMuEgc){)MlE&SM9vsHKUn?%3-`z(+b$|$T3(gK`H}@Ds=hLczr9G|`I7|}xM%bY49;M=;xhF7HfJ7|*Db5{ZIawd7lg+d zKm2DK`uh<4_KKR&131Hv!B9G*22=`PPCwfGq-8RYN$0Y^jT&y7wZb)p13EjK!-oEF zv2n;5Oc8%M%zSaAB+F*0za{tCUx{{oe_Dxr#Mu&j4mLwyU+Ev7;J;qVG6}a+_{e#2 ztfI(tDF5EE2M?BWM0t6+dt3Q>+O@FlzWIwo%?tM`MKC}E!m)BwLdH|h-43#|XpiX4r_${>>XNOINK{)zWu9T`I|TPb2s;YPrHW$78NbuV?m`qJQ$u|mU(E&oquPY|G@0~^C3Kw z*m81mQ$mwQvtEDr5&!9(efLscQ6j)xKJ*#pw66I50D9G5+>-c$A9hQATS$MtmA~{6 z@rbb^+UQpAR4B6$|LnPcdC~8G;Nd1&w_^8XOW4j%`u%V7$MOq~CjGKxEZ%?d+dbAU z?@an6==V%f&CVx8v^Ca-q}U=ZAE(zV*1oU=gO;`No)UsKkA*O=!jDO6plTvRF~>2p z_{Feh=gOE|G?!GXwXoUFW|!?o?e5u`d4smu2p!ij_N%chfQiSx4;n1dce#Mt2nM+G ze)U1Qeg?0Rre-!Rr;r3o&CdNIi+KK1#yqd?D8)O@Iq-tG?V*@x%h@hr8gj+iT4!Fg z$*yy!=Fy9U70~6h^&}cTs}KQg94V=7xoRQJ)^WZ|;DPy~o1V6osJ~Iio~CjRMl_sR z!+5U*PzR#9jBk@_+0=Y(Y@DmG$bS>`sj>BqzgtYI6SC$3puZAj$58Nv8uGf)3o~oo z1RYO9x3OWmg}y*I)<$!~$I^r`I}$)rh0Z@`zaKe=0MK@r zXS@QF+u@46TKU>(Yl{f=%>u)YrQU_?Hye31DlNuo1E^t{`L491!}c_mJbwjg2D&Z* zl&W?|DyFEbCbVJ`W7I0>WD~O4DM;UiX=%~W?hv<_@Qbr2~pKfUSwTA85LCCuHmuS;c#7+hg9*``o?0V73aC}t!%tQ;V8R3t)@ zAK8_;qYA3bG2@}PbzFI6wj5P*HEBvrpd6cd5B5uY3k{0gt>xqnZ~$2QwPdeshT^bG zuYOO-4~|Dh^v&GKp2HbDs8QR3n{Z}^hNRyrLp9}SXexV4xJ5M>l$Jz>=()y>P?$U@ zD=I3YV`9?aG9NYzP`G=yv)Bib=S$M+gGjN4{k~4W|LVeZY+S+l4wvy5wDq_of)@!F zi{IS9)Zj(&+UarK^FHL%0 z{BgK&%SHU3vy~@<`25<&i6UF4k=uu(ka*U-c_D})q7sE58%Z3t4LjlQFxjB zAwJ$b4t;lbvMJ#prrpkyeW}g5OYl0#L!2GS{p=X{Dz2%vuZ{Kmd2*{V%N{~2q>JYP zgn!hYph_vXc9q=7skPrY$-~QA%T;sv%>3Cwx3)pE-u>XLxKyk%bVQ8#GQ!k}lw;Xy z?L!(ZC+7fUgu#S*n)%Sevb6dvmGu5&ZSwU@`!EF-wZi20S1_jC6?t)k7DKnnV6HOp zn@4joxgnz#kYV0E-b4J=Y}_iONJksDngF?0 zQ?+M&2rQzM_5QYz#xyVebEy2F>e-_7K+5q5oulGnn~K#vjkt+o{!?2KH=p>^G4hE6 z#N-xvRl0}0jPPdFxsoqi`0DcV1kL%RuTSGTB4eVW7#>`683Fh0@KKM&z`KnZqx-H( zc=mzXJ_5P1)z{^B>V%_PMcTD_2=X%TqzgzJx1>aDeGn&MYR1mOOv@O?tdAW{T!^}R zD41}fE+Hbv^2QsylctsXIQZu47iYLngx7&JS3T4NQLHaQ26mU`I>T^2Pc;5X)@ zXHSRHS0Co0qDO9!2SmU(rq+UXIr+`9RE}<-$M)Y24I#~AMH)0D8{`JIyj@#ci zjDPa>j^4Wq6>)Z%IlS8M8avVH`7z5b`XF!z(zHAw z%NHus;wf&xSeBNGL0{@l{1M1#u}mR$!@nUm4i_*mS>`NZ*+tOM^z(t#pP1 zqt)OQeeyHEG>fj?}Fl zyHlUsX!NAPcQ)rvdC$%AwRJbb;GLcF18HW9_ihrv0)s4pK?h%6CzEn^;g{{p(R09X zF`YC=B5ln2Qd3B73_ZSfZL9oDz1TaS6K{*yq6YL2Ca@R(@p-tAdHVRJC9XWK8kAv1*{60Vb}w&{TmMylvsEE_c|wOuv2GN}X|d%oI%K1+HUXQv}_HzSIW zJek{k`EiEkFnjI5ye|_=n8d!O$@aigG31F_JqOrr%%qsL%L_K$gDb>b&l$6Ia4``|M^k>8=ehtckBN1NANM|pX9v5Z%O48OkmIjrmZ z-tIq)FaVJttCdX8UnLw3ym*_ieSQ|OkA;qH%G?L2ri(+}N5o(b^U7#~*;2&q-Ql!D zPviKy&s;egdtfQ29lKV60?rAGc}+SMFZ{b|{4P7({|t7IFye6|`&)81#_7%>e*dvFV8nrymp~mL@=^wYMw|x&PTcbITjJ|BMROS1DYgPAolg3(*8g#H8&4+rD zY+ZBa>Cj`-mo=Bw%dct6IU%gYajTQRs%v$$!dh&x=kP|+?)E5hc)+lFq|(qy`aIb| z;_+|oecF7?lW9!3=dpdvhX7nqju^r*w+QfInF-G%vCJ#%+nhYTZstRW2hb3B+>6XD zAw<=g(qsKGKURm;HWXBg#)ykYP?bB)d}RdQj?%H6H2^#ZyVIkFfUqOlWWdT7$Z<OW-W7`wHLYYSNM8+;Hc4j@g-+NOvJYzk@Wiz$gZ-%SpSFx~kpW6vLRXd^0Aq($YGI)HyL|E5` zd;7WGaeDq%`<@!!v71%1b3o%Tm(lb(zJdQvj^?vx-9qXPz)KL|wkbERO++|I-_q0O zAL=w4d3D8Fs|$wF0aB;>%3zsk|@sgfNpv)Z9*w^a==+_-0e3 z$oUPB_fapDD33^(RGheRnJq?3wS;!Mi8&l3j;=m@u=<)guUhCHu#hGJuv+-}&y_p< zi?#@tim43==cN_@`a#VBy1ND0Bu}sCsl?PlqB*l-R+evfQP`6QUSeY}lFR^w1wvAA zmK|;R9H{5DBCSy_A+zl_(Fof`nF_1;UCZpe7_k3G)*Bf()U6~twX6dGjp%~(~;Y_vJXY$|71Whx-Gb};)5 zhDD#r(wtOCGo5*+^B2)=tR|k@P;_P0&eY?+LE4OU`*eIO(8m~utNXX>?R*XQptTimyFxmdzuh06I({Z@u@jxWd$Fm+*&GP@#! zIiu7-JUeuMl`_((_LFgboNdBPM@*d7(Vj^)Ls`KWGR`eC)RN8&%>IZ*M)0soGGYB) zHax#)5uuPj=Uu%(ai(;kn%{ZI+HF%H02+X-K~oi_Os`rSv*v}5C3PaB*o8Ssj$F5N z-vtJ?nccqsr2gWO^-N8y(<(34b^m!gp(YC3z4w6){O)p0APvVtzL74`L=X=R7|wS! z8!KQW1+k0Iuj`s`51W}` z7V>EZk`>DZ@$i(Q8C$rs-7^|fT+KnZz9$xEMn{{xe`9Om;w`|R&RJjI3%U@267$hu z%jsV?WvU-GW}LXd@!L`VS%WJi!BzdHFssIOQX9c8~b8t}5b&XQ z;q0;uuYSN46TwfMgyts$bk<^GPuhLN{=pq?4jZV{GHl=l8owpQA_1Ei2si1`n-*)k-hEzqwUKBpx$DF z4ih-2xR~3d;}+k0V*Ck+w>;*`)~-rw4C#|l z%$?p@#gpr4SKHT$t`u0gy^{8O65S^DvD=zau13E~fa{#US>Ld#B>xtBeAH7{n|LO|9 zU0tIyFX>8=TsA;b?WyvD-$w>KNO)fr^u`O)YF}+D*QHTjF+ZxHRf{-}bH!Y8k@yPm zJWNiaS@@0LI~R38cv~ls2qo_XMZcnZ*T0f+d5aFsC4jztIwt}sg!e|bjZaTlX{}A&d}`LbjcIJ zQ##GjI@0KIG{85282FKGUS$fNByGQ6(Z=VqUa`YY-of{!>ujgae&3QSM{GY1VdAx= z&7-+Sia^M0sh)e;clF|Nqh32;Dd005Zw0p?a|4KEGG}7p7bLc(q8*tOE0hz0%eJp>-)H0RxwZP((`LYM4^fU+{~rHB+Zo%00^cW5R2|=%JA{ zeB;x-)1hZ_Ubm3pq}T)EJVF+{#bEZr{M3Qv(CgTZH^+6(KKXg29~06)glOOYVSwKd z-ZpdUCRE>ce?DUYq{CGM#>4+BMJJmlL^y~Jwo#@tk93Sue7*CXD&ceL>uUR9t>C5c zw)CC3me!M=@@vt=`7hSR+4`zI8N;x#k?P-Z36T#&;%yYZ#2SP$vi+WIn1Xl$o#XoC zuVw;CSbfUMyB>r%J$jvE*Z`bRo|TW(^vfD#M9g6=zn3=(CS$WUI~ahxLBubgh!NMj z8Fxtb8E6V61reupda|#-FwjI!&7xM(n1m1ekDw?*pQ26)poct$=DXbs`GneH4~B93 zohY!r9K)RiyXlJ9%n4LgQ9w?mm&~uT&=w{Ye$s6-zy}(5x-(Q!Y)DLP2t;JAzgTAI zwB5qAwP}=C68}sPkqw6BncOp;OL-mEf(t*ZG;E;B<^imzcKU_VbNz)5HgcdD(ZL|z zZQ1Jbox-9>NpC905uN>P=lE$8hfcKvVB)pg-uyEg?t@y#$S0^R~IAwh(Oj%B?|ek${7BF ziO9g+Der#I2~(U%8P5+_ZY?l`9?9;oBJkMX@`EpP%9FNd{v!VS!QYc_7Tr51xb}WF z9&@q8?#nTcK`#`uz^1VwdY<+9Gf?s|dkuTxR=gbW>=_CNxGLOzD)~P&XL>P`EbrX; zs1d0G=73O#X60^^3a(YSpP=m7Zp)?}zrM=%TEutKW7@7}T`95KR1gRWFPHVZkHW)c zD4<2dryWFndC2Qp>6HfgVdpdk&Xy(I_lAl&IRQwe_LNOW0ilSsFQ9&`C0+tmM+wER z_YXS6+!Y=u(~li8;%HDZ58=RgqbH+MO`$`Bnrv$o8|B&1ewKp0e0;XS3=qo)bW*r( zqtkod+jJlLBwfXxUU|X|*K>cjUVEHGdGxXCU75B6#crL8_Zl=BBkV7$(UKK&?LYv| zmjo}l+?TSGYGY^-InUknT$lBwIml8_h&~fWU^-iZix;=tVaJz|kR;122h^O^^Ap&i zJWDob<4WJO%-*WTD_?c$>VD%(&CV}xWwS}{>jahr)iQDq`OezA)^CTKKL93B|r zX+cS96M-BI)z~sK|1v&u7EJHq0JEO!qC*u1+D7q<&JM-RDFoeCPbAxXB$r+vRf}TxO~O<-EuUM1#eWbD$h~AKL^u%-B#Oe zyqPOdRtr?=sVsh$UYpLaOo#S$isd?eusTEWHn`_$n4dJ%8tH+2N$_^fyjk@41}-0H zlxxqPm&DF(CRFErZoTVH4>mD9V?$JvuJfjZY2}rXoo$A)f^|{rax*sq+?677jY<@U zj%fQfio-xg_><5AC>*4njxUEpFGue7>kKOQBDQ3MZv6)XYol9=_1VVM<3#QM_RPn0iNmM&$haT2rl3L?V7PMrzh-9LqDrI7jb(zg2m z=QMrRz2fr7FzDSrP8-~Ijt1r6;JEx^XPW@Tw~xi-31Ry6_6YJaNb#Uf^ z{fWvVNw}h{$}ROg+vN*y1Sip=)zRhMG%69VPi{HGO4{R~W}(LH_k zRY%JktMGfhK1D0>`t&i*n#M(z#Cg?g+4^j79ZgF48bMz7ZMxuZ8k~VAcxT>VRM6W#2Zfb46PfnV}LN~_l@NHS3e;I-!W$aj4vnwR1$N|r2bnJDmb2PzMAC^Oc z0A*g}vp?gO!Mk4#&L|x0Ox0xH%warLam8Gb1m&d87;4~UrkD^SQpVwqIw^*@)*K@t z){}KzCdCtY#>ejZV=(d0ED85?-zJ3ku1WDWtad&8bkcFyw|k{8m7V**24Ouc|6_F^ zV;YE6bmYWp^T#>-IORvPOl~GW{4aN_CwdXgH zUH))Fsi*gJ>=v;bBpuICl_f;!fwH}N9Yw=x2VLC`>9)|_X-y9e&c{3JN_@_}crEo- z#iNkfHL1){=Zwk~fgXr0TS<4lT3_zD z<@BYsgt8BIUoOEnhWShs$|)Fb=4W+|m!W&oK92eVyXooer~;W87VO4lytbDUXoa z>nMk;UA=bgns(w&(sFy zHhax%nYEW;CXZ=)u&_T)x(-YYZ}$zbs=vggU9wMq z+n^9^-EzJqX~@Tt6xI>vzF_etBg1IF*{du`)5*-6xD z^!inSBOT z;&0d<#ST2rh;;^1H|@@&eL6l@&E!FQ{{4tW0^QN{K~%2aVqwE#Pb z?8D_Gwy?e5O-rV?{(dA;F-yPxascB3l=U<5juS5gpm zmxlSBSV{<$Q6Pt@K;Sm<1lDx-V{|5jb=sZJGiU;Kdv+ zrb(oB{Kk7=GYaUr`Ngz%W$J|{Pk!G0;@EZ9)rBvq@!%$8&7Eo@&|G|(oW24Ev__nZ zT*DT=>OX|0;&|cjDnMO>1dxYIpw3Ch-z-0g+lUhPjxM7jq%<4~eP9RbC3X%I{Eb}* z<6U|7d|;-)Q!g`^Xlf(EoP4h@vE=GN!7}^lf%g`n%=qlvJLY%nl17vo8E}kbh`=IQ z$tA8h_W)3^rhUl}YiEnzI06cK^m;eQ6^bPu7jBn1KROd>&3=KNd2XB9P`=Ic2KVPT z;2@m8=}U9$C$_psT|&j@mpmXTUC_6B>05CtMTJ(=k`5oPIF_Nm`laMX!J%wNO^#tA zKDp7dvzB-f#LjYUBVyn%QxT2a5p}ls?lj!mq!J}-4LDEHB{_S}vz7WdOgT;4427Kn z1#BB6s;&jXckNO)4YbI+t%6wZLwQiqRgj716B4qP-;v`cI9}rG&^82OVb4C7UiG(_ z?qb$|XyLO4px?tkfgz!3pq@+r?Zk~|FJ7Do+fO?xg*w@w=nDpjpLsT%5~UO=SW1)R z_$^b8Ld^J>AT`mfC3-#{$|q-cYoZb=%yyjLv+=})EHEBVOBjhZE=?biwf#Lt*0#49 z=cw&^RzV7tQ-X}Yu_^2gLEqS$%|MLG+Gpu66&`TrMG2$gCwG%aBeh;OONhEO_BXH` zy(3-;3PL}P-lQ6Rc;sedh`P5ZATIjdkgYMi)wU3y%kK9O^v>(NZe>)B@MWsQ1q$lO zd{iK?vze$!NWAV~!FAIb&%C_;)Ph?5JTX;G|4Z|HcOQf*L^b=lTG$pKOxH_qED_gn zuhSp07(^(`nJn#H9z2?T7Ne34a-lx+N*~|n9HZRGE1p?48S1qze+B-$*{g3oN`+R> z9ZYejk_lF^pj<8@2z#Bnns2{sA1=v9 z=sw*SU*6pCT~f0LBh}l{D zvZ9R0m?^Wwh2ov0A;^enxAkI;*Y@q8%>8{QV3l5HbM zYslWb>y^&I&TX}mp{iV`kLuPgIPf_|GOM)WcpD=54sRk#oECy4h(qw%XjibNlvkSXe0V@Y#5^!P)o)OH#4Q1Y_?L#Sf1cc6+^HN84++$XieF|yj`B}+YreJZEG~l&$e;y*>vO#g`+n_=6gQ5B$d_01E9W_mfs47y zK

sC~&2(!LO)_X%_r;?%bLy%0eAx<8&VCW%=0CiaP;iMJzo)AHU zMp>IKpCf~9ki3vwo7kZ?c`EKLh&NH)1jbhdQit|)bBpn|qYE!utbKj{1yb$qt#w)cwO3mAFkh+FChJhXhD5+Zcr28zx zD_Nfi4*Xm6;Cl>Yq=ip*a9q_ zxg)0-JJe7GD^q??^(IY@&fwB-2QQrj1vy?WqXQrAeu~_jRHGQ$^Ip#O<(<3|@1iUn z)!@-%w~+Eq1ji=*Ct*yOP9tN-lVjiZJ-~^Z>9TV{V%y}!uPuuEK3hMaXy2%%I;UxW zvQ;h#-nUh$`z)=XzGcy-NS(-x5?#oG_8Qk@5`uc`uu*a@^qo7Ozf!WbLca zH2pT-;7Y5uhkanw#w-SY5J>Lmsi~<{#X07=Y>3kNM0QPOqMI+U%1;tc8QwMXqyK{R ziJa{(GP-vI;uS2ubAV=ODzDTFfN?JXqreJL9icnaB(~=y^ z=j@nekC+m&a%Vv``N_j27k%pvc{&MQ^fQN!m3eMm_E+8p(^LP+vMj~e>nr^qvJkao zM2m=$Z0Ii}YW{GznItwF?lP}uH!vfu*gBM-Zuedt*?9DRri_39CA|ewV?nuKMDy1| zZ?`a4ND1LY3h;~-XP~m8ufG9~K&qABf}u)9k6rcI5TD_%kMq9HP}8j7Z^4~!1XZPT zsj7#mVFCUd#87~q>LkkZy~W81)L4YRdV#e*!TU7>HyHVXWPdNU=xec0@!HQ#Tj4!N z)t$_enPvZ!bpM426{p&Ey7k8xRmvQ1GZKSh&;7psx?Onl=!bB+ZNGSftsnk}XKY>Ke>m#J zi^C3weu1R_f0qcuwwDZ?__XGc@&kKCc;60Z=Y#h@KlwQ|KblpIH=`2ue|FUVM~Ld^ zFr5RgEeHg_7JOQ#wpI{8x5K%Xd|^&vPuT7)Li`o2_I#o%>o7p_7@vIyFJZL&@1FlS zU)@T7|8~E6;_AthTR#aj8v8O+#WZ#LOJ>6g3oWc1Jk>|L%U+~`4|FZQTdo0QV zX(O#XPSxX!c~R+w4+-&LqSMuFZkIq*g_xl?Dio?Aukd?<$ONa<`V zTw%Sa7<(kshUeLvvyki^2aje#Uep zc{?j2A{NQghj#;2-UElxW_%{GXTlCyPe? z3>}$O?u4k`s*zc8u}jBxj!_SVQ(9U2$8ZEzxki>nm%XC~dyf1GW#Xr|1kVZz0Q(Iv zYO39wAN{!g+#Y-oar_8rno-kzR!0U4eJ^wM8uF5&_+DC2MR4qyf$-$5-+uc>mqG_F>3RTv(#lcoNkQW=Pr)W`ox`zug}Tez==A%ITZZs*E=qWpFVx+N0qYEdR~_z8q66fN1vPWWlqiGI@W7q6D0<(%C?|&;X)Lz z?7a)cgtmGxH05Qs~_>$+VOnU#xnrHaS0#+EFB_E z#5-z#gzqE*-$!@Qq2x=_DeDMd%3R6Pa)+80@P!V80fikFoqrNdKZy93pZrVwTjuta zcN{+z_I`+KjB;$pJCa*&4hnm=3jxwZKu1 z&d?RIX5cMGXX=R+An!Eo%YYb~g8)`~xphapP*rv5tVS?(-YNKK^N;Y=AUZ=VZ~uEBjbenwsYqfJk-9 zI$tj%0w6+CjGI8f!l78+zW=M<0`h5G+%X#)noZ#Ms%kmaD$F_oJN94spns`Jt`v{*vj`6_}<9ZkB*~a{HYr5i>8r zVQyQI0=0Hke!T70Qky7hASuuvzm_M9U&zj{1mhVt`d4g+5oOU*W)KYYao5{P^I!Ey z{}5D1lK|pK*f!Ltmn{$1mX-uiTDNz|`Mjo(?6&Fsys%Yak*>F(pP%?h&HlcE#l3r3 zJm>A~?5dm)^h<;DHQV#eP^Rf1YzW$cPc~{@y7UYJB{T3Vb8@XJp1pruHRL9!l?j@0 z;umXWIQ{0?;ST@-=P8utw(`^H#GgYMN{l*+W|f1# z;~07KN=I1~$DW)*R0J0q_g$%uN{SBruY@UpEQCfL05E?+anHZMveBmvqjg+8RFy?Jv1fSw%|5fQo5_*ESXLg!2!l>N=wR=b0)ol=Rc z|G)X~bBpifYCIUF;g5Nbe=h|X5>J~QVopfBZZ1D^%Hs(09dkAYOJ>SJ-aXY>!pBCg z<@9o0Wf{G8?BT&thwR>a^=!mk{p{ayp|^YXO9(SPIQTI60n5V=8cYmPvrVmolth!AriNUJGK2ep8MaB?% z_E_$urD(BGO*QgW4Xbj}s8$V{w#?^7<#F`WQ@AxeHnU{tO`4soJmBX==pnourd1My zOgs{eVpR7C|M5BuO#kLXY#$xHxZkvpHEt%ZF9Z4}BVO6Vp>*`IL=AjnC8N_$PWdb` z54Ay7p$aZ8{H|Hit~i;%KO94c*8$a(@7m-Bp7fgVZKwOU_x{(%8s@5#lZumiR=WZK zeg5&IDrq_@m5O~1C)+9DIN-cpTRZ6s8V1`uUh#$aif^P!#pWF2k8MRmP^v zjHxGK8|zVL*Ryc3F$mArouss=##Lk`;YoM4eFewAzUrU8N!GYUqY^t{9SFNGADpJs zVnReC6b_cq#-(7)02Ij54>FY;I3ojWB3sXq0LB{k0ekLiBr}QhL&Kh9;bl~=e9vHf z<;`aLttEe7`(J!e*%vTBFSy+=lA+UZi%NI6E?n%)_ino=U~VURD z<%c-I5OXj}a~@3Oi`sBdHnE07-G?0UwJoNrAEIjLOn#9^gw=0dW{7Ls=rnvDLH^FM zPaFe!y@xk;aBp~C@Z5wo;?sdraWyzyFOv%$b7*2EP0bu2Zq8j#O08;xk-Ohvp-l_1 z7N+|)$ci0;qbmXINj!d39ELU1;LPUP{L7aKcyz?6&pb3ZHA3l_5H3P_{vphOjN>1c z_n04a8ob}=#$S@1ot^4CU|-TRemz@1_^BxpiF8wA|I0i6&xhS2(3zxI6B1W`uvn)! zei=@CojNM6>vxURUP8;x^Fb?P_D85;d$3|L#y8Q_ug~Bi+?6A1*wX+A z0GhI2}7=LM0tGYZHYG3^2$ZQch$sCR(vKZMHT_17; zRg|_W#5Hc?17vT?QeWPAQ5E9UxTEuRHHG4O`@5wdLyzEFu6A@?CS2hZ6J%A}76v5KP5&wqVDSE@qgxM^YOu?C_y z4j-MNQYPv1gQWjPqoK2>4;LsefK|GtK!~9I3GhSAZZ5#mt&zgGG{~a z-A}La>|*en=6rR$sOdGu;9ew72*U@Ytw)&(DTdu|1YXMws%Pkz zd#&cXhh5Jbez;?!IyB@ld`&GQRA_w!fq$gySDr`d;)WP8l5&m9P9i3e3+x!uM9Iu5 z7=Y-3IgzlIFZ582>7+M)5FA%-0J!sPH3i!ZSIQPeNXfRpIwj`2rUhr$Rk(Ajav^~- zgx95!+Rb4{4~Ji*P?`-;F9mTDI~EfOi;=sTCA0-9X@N90M_6Npl6F>rrr_EWd~gT! zNNem>gxGaxdB#XRiWaJOmc@YIH;u3{CP6E1*zP--M8RMSyD?odZ657wR+=|{i2i?b z4g;FRJG;9%XxI;`M<%g}asTF$KX1TymDUig?%@GMp9~?QkM-LXw-T6Ui*bVyiGH(V za3*kIO+4LMmj-;7+gt_&eP#uR*CI;XRRg!S+{XNYd5>B)`4D#a zTJ=>*Zbw6;-z{tapJTn7?W}g9 zd!MfdM=70;TST(2X%X>Ykv-U(2?COS$hP{Fe`WH+!24iF-|#M!DTT!^Yw? zGNXm^NxYEt6n0j{Zf?}dc!XczE)NV;SF@*kx7u-6H#fJ>Mcg{DZoXPE$i`E$tg)xr zj9D-dDE?HaCw2Wx2kgCHV!sdHjkKDUOsbAsR zs`ULA)`ZU~HKz|hA~0_$x`r3(EZshv{3Apmi7BrpK3K1$U@#r|pYg5Mf;>8kYeF>~ z?1~D+O*XC#g^;AMqhV6aF&ir%yl1=N_dPuq)Q}aD8S0gDRvo)T8?RJQ7R(Mz*rA{# zGP-h~w|BV<9Kr^@>n;Iv20w0VBv0ddD`Mc#8oNZ>gC#jVe*8r$LxEl zUHN`<7tKGtK4%_wqL^vG4(XyTy4rW!oBscrIfQExg?3kl0@@7z>e%*t%; zaCb)CNaIRbX5OUgLK!yKQCvG)>F+xP7U$IcF@|1Zvw`0>Rl1$w51y;m^*pPvTr0$e zTAOpLoreThrlGAN)JOQ&+#7T6pds1XXJGJ+&o=}v=juxgqMXc0W0&Pavtfknh+?1l zvW!$j3X9Ji(xCA(hO$8m$}R3c7Ba4?Jd2`P)O?Y-<8(P6)ULR@CMwzA)ATag#VD{s z!mm$KFAFBEuErT4KZsT>^cp$lW>hX^ne}!|W1|A$d*(}*+so%4iY8rUB&9W*nLsb^ z##cyk0)RDt5 z-?>?!PWyqHt8t0+)A3vbyz4SKe~rj953H5}kKe(1$;=`uGas#8TjL+>7{~{0@)M(@ zhqY?hmDS`)t9h*4^VtD#acah&_5OcN@o(;cw+DTvENYs6Cd ze#p}Mg0tB@H__OJz5me=`!5L8mrNHPJN~KQjDfV`7Ee|Mad-mI!dje;mj*PCDzqGn zk6iH6G)a=R)mNBElVTnUpT`5g=PKHa+}%>EJiO6cuF_u{$PVFzxK3y)mGgU6A)Hn| zbud%r3v^58$++4^$VOAds^+y#6HD_WnC>~OIO-bdw~|^ztn|?#)l22E#F%UpIJL>5 zL$dw6+%##YF-@PQ*in?ryQ#Rl$9KU9bs9=pFxQP8*oOFx105wEn$Tl|-Z*>3)^|v3 zmYK0&ao_E*)vO}#VSBWRGI;@sHU(CZ&fHr*<35+jA(x&_c~ZKP5!2H~9P)r&5Q*sN zv6Iu_T8)`W*M$qFYrncC8|jJK^!s5@T!Pb}M1;Wm$eml9vPGM}Jd4si3>&x-6dQW* zl-i)lMj%SLVS&f@?7Cos0dV5(C{&)>x3y=#1+3;XSB$a;t0`@?M&vU?Pj4~mbFC3n zUWKHw3sH3=!O0mpr=zvGmt*S5`6x4gjDjcJ?&+48OlJUD03OMTS!+U4*Yc)K;QqyH zvRqQtPEcc@KOZQeVs7OmiZ?~6S^Pjg)w?!R%p-`F_O3z}xw9j&AuXz!^Mip&j48Pr zFAsBZl}z`qaY0d#S(#&%NBuYea(Y;8mt~9d2!_WIa>B0oi&aWViM+8V_8j&N8d*6H zpFm+l_-ZYLDqtq)jd#Fh4B?C;HpV;VWp^ly*<-WK)~>~#veq$)slg8~4-?VjD^7r^ zf)m~Q-={j*?-IWv70jfM1x&MYYg4xgr0XQ!)GhLCdd4qUdT!;Cm61c4rGqkQBv6TN zy^C^x38$0Q2wkAiIEFp@<8feY=kmN$7Y3CsX~6ENICl9{o|NxQH#|41W?*$eG%*Kea8>8(NN)hXgz@b_xpG!dnd8krt1ngP9|A0gH zR$o4|0XfcT6xprw+qctp;KoScVh3~n%4Cozz0E%&RPk4md+ssg2ZAzP#(h!rVqx_T)F(Da(?uJuyI5q?0`<4n6HPqFTjL_QMK9@|AkQjH(@qx{3wf^Xy$Xz{D`wScW??W5_T}UQ3{mzP!f_s$rYa&k*9$@f}|@&sQa~X0D?qsnW-vV4To?hjE1a0?r>f zX11XU8z{7Kvs#~xX%oe|&HeMCv5biu^IU)Bg< zKgCK0l@1~Dsq5l>3ykuEdv+%(mmvF>8TK0@Zl8k;H9KGo6az35S0g7*NgwNYb9aR& zmeX$GT5^Qh4D@%kK<$B&urK(OW~) z-;4!D0g=U6Gf{zMuExq7hkoEo;U-s{C;}cqwY$|0&I;0^rk3EQ{Hw!09TBU@r07kDkwM7RPX|n z#;CXlZ-6%L-a8!A3-DA1o~AbwI=og3YA^!CC49J}U-o>-ou;m<0+EUnhp}avG`Atz zQno5*T?2H05+bO#zMUFyp9PUoc}9L(RV_Z~sZq z>^te0_QbN%(R{|jvsEWhw3+@WQ^_q!9nd5(Vq4Qh8CKp>XvzC7z+N7$%I|U#`-6A* z43fXtg)}snblv-Lrq7HtZH9|eVAL2{NOOjoo4)7Zn4l36wvsBul|;?4?j4`Oz9dPh zs;uK{!BG(0zv+BsDPi;s2Z1%Cq*l_=^GSUF=GlXdN<^}Y8#n zb=TUOLT_shtgjI#q^md)1}2f-pLb&u7d(xw^Ak3z*%4}pjc9auf5ttPx$umT0>~=1 zv%A30xzuCWCIgR|OzPfyI<{R#0U?!3gIm)y`|JwZmh`*GW~9N4TD_$8H}`C7ho3LX zqZW(I2l^$1D1FpgBaE}R&vjB2V+X7J;5)M8+1Uece);?`G?Y~#wO+a=j6fHK1}{r- zZz;j5uUsF^I3T#UO}j?EekUOox`?Z;hUt{vny%`Q6a98h!XiB7!EbHLtt)t*C*Ws!c%+}hwju{-C*Sf zgoHL6qPnvID!bl>;UD^xR71G-a7YbFNfaQ=1^2Wil6B(cPORe*3&ER#JVIw7<`0i$ zHXkNCTR0X00(w)gt}#rcm0^g(FjhEiFrx+pItM<9ab0sVQ(D%QR8niT-F2M5>wWI) zj0|N2F41w98fmypBO%KnRFE8vABR!S?%uEMb6_s+q-FEnHjUwI)zv=L1WKYK+xxsD z7Z(;bLk>xvAFHoluXLZzy72P`Q{*9`1&1`IsK!~sluV_`fao{o(AEjSV0?8i znB~u{zqLQ>;UNla=XIzd{TYYFu=11LxjmQ8uf=pe4*uOiEY8h zyfPB|Ch$u4;yjV$I-CZ*Q?JSU1r{!b0eGYL;q?a zoU(vY8x*=+{BYSGMRix~bSk1pYlK?1ybNAj9`hQ7;&MxNE6+v^M;=5t6;Av3_>B3W zgpY>{7Fc(*FVOCS5zPOA#IaL!u!pdY_`LTUL<9#F8p||U0pjyZG9Xrpe&ob&ZO9l< zAI3d-6*uOyuh-m5qru<5qw0Vshuq?R-<@)ce9}8#5_t~LJJy^Zt{IRjm0rhIQskGi zUh;*}6;k*zy+z`js!OJHuNOH*f=HR|rHbT6DgK#F-l zIbUwomcX+a&UqTAnQJyQXye4fI_Ot1cRtbjO~b2G)J49SBJ;$wd^rqD9zciTtMGVC<&~*%1!+Um;kc7<8;My@YmDxCc zx(6y^jTDuBap=zT-LLrVA@tA3pn`MJ5c2;Hbti-6YnWuzr$Y!4Wf#bTuv4Z@V9VK3PH%2RH3M zy{dosUta4!aLA88b&5niSTpsj8dI9--<5gU)2!m5^>=Bp+#dOoQ zH5QYq?sewC%>Rv-?GG7xE0w8m^q4B2<>9dJwyK?TK=knJubVvJMh6Dy@?+(t_&D%q4H+HP{yT{|xGgQ97IU;B! zUCf&+x%GhgbU9y&Om+KLg?}idd5Tig78bz&>ec>(6Mc)itMI`#6e0iK`5%YqACLW8 z9u<3+&LmuNyC28gWjDe9lP4I`=%`RC-FmNDHqUpx@tr09h7Y%1gAJ+JLAqQh-{bW+ z-0xp^V{;R3g7IuPc+Zo+k@i2BQ~DD_d3ia*|Lqb^$6x-xT>@|T`KecTL!JL#K9U~Z zAxQdi4vQUdY-%)=^&q~RGuI3Uz1taOo@5emgDKiW&V`;C+35-o;G49ph zLx_KWyJhgJ?L%YA*lj|tSwN;@fX8Xl>j znIl2BmgOg&BeipBymGOu$NRTN%!Z=W$FT)v8ik+|=D2P`o&A>n>Fc92p<9=eDJP$n%fzAtR%>4dMx$|izS5z4JV;WM5S^mCb!f{=g z5tD|mIN*z(4bSIHKy%m5-d5Z(8GIllX8!t=3D-mPB{#*RQsEa})5PbvQ zAG5I*@@_W52p6bAD$tsloG}lhha0Mve=9YLS5LO)$g#QjH;NyX+X0;J=*MTgt~;69 zUT19%OK}IEvRN9#&Ul?uFy-;&Zd}QTLKc%(!7k;*JXp$-u}M1SpZ}uw$r+z>ijZCH zK6MLYA+f?cCfx{iRS27IXD3t9kg>EqNLTj79u8bL@@?c9?@So$XPji<>a|!?hcGJd z{iM81z1ss;_wzVE#!MWmA=Zq@rq>q_qL^@6%Qs|aNk~{xQyxRm0H=mGX89+{V*QK{ck$bBR_AVMn3xc)W+C+E33OF?$v5|ARz_zM06 z?ppk{DifAg+q5X;=a;psxA7*dsBC(|ZD@~aPiVO+L4s_M;_YS3(u3njDA92o-YFOz zxa=%ETzK+8{wBSalxpXlNhU0{EoVFvtG&dxg-IJ>50CLG}m{NTPJT8!=Gpc;2Q+>Xe3}RfX2-tiB0+!Kdml7;Mi7@gWo2 zR@8aRr2pSaQxI(fyndnD^ZEf()=t}oCUD7_>QhPkDL6o2Qp^ zkDN&tC1^5p|*PE@*(ryc+uRd!jAAbT` zsCNFW-GZ*Urwm>)crvXDFt5~bOZn$~rh18aY8j-hO%r z+Xu^8(um$H&S-A>xzTK%+PQ0n!y`bnd2)l7EuX|A`tonAb}UDq@olR-&>Tbl>h;)X zo*R94HSeKIhEEoEg8WQ;;UnG(-XY6(Cafi40q){o^RijXS~|qFrC#cJnu-R`5TaAO z6s7Z-sw5uZyGWnq_9V#9s@NFES==m-+3u|;A7+sew1@t8;~xgT+)H&c7z)G_gY5u0Jea>7Wy)HTT|;>M4)FqPT@Uve9~l*?kdg6Z z~zES9w2JZWv~)i}=pFa;56o zJ^MyVs$ZP=-$f?==dYgZ3gAyDxo7!tyO&IrBqOHYnaeX~#--GRwHjwub}*>&0N8K* zHIu!u+>QDv-ZCI9giE`EICw`YWG?sSUNhu-*v(WXwAT3V@LEz=KX~7-)@j+Fm`qe< zK0EYVDXL2aPXH>q!sTR(>(vpyk!L(C-l|guQq+=v;H^Q=xDQL81l>Yb z6>_5aAZNadFK@}oopbd*tle4xJ|dVFa;bjNeBZVA@rR-|{N6IvfNRTfzz}kZp~v5L z8vcC18?A2^Jemdqo;|j8!U$QmcD~qC5lvX{an&|1jdi)zo)XXdrXQ>)a>9{?f3|uL zoCnzo7Cc|WIj&!(fw1&WhRv$-KZ>a<0NVCKdPauWEck>40Xnv6FZ(<&{8((zwfi#m zvz{)S@?2qeKWk6SU-$>wcQ@(sVCfpr?wwj^JadPKl@z3QOaR%ZZs>s@WGPNQTVU z`_(7hPf~i4A9t#!ezi}{?!gFRk(Bi1)Sn2%XDUpEr4>=;i`Y!&gP#cYr@3=IpF(J3{a#HlbOxnCL)O3COfYESQUmqg0_ND7VA0j?A9Cu}ah5^Y zB6m%o0aR+`#4C7-2c}gs*nVRs*t|kiS1@d#NNnp>1K1AXM>-@~*fICDl8_!TL$z|D z0!0D(aY5ay#Lx|X2l+j&Xw<#yOfr3vjDv0rLunA?d)oh_?Y#q<%C`1l1p%e1fFRW} z3P=?x(h&x*fYbm=2kE`nfI-1RQ;{MaL3)*5LlIDV3n0A+flxwAf&{|1aU7j_-L`}}f;BC$@w*m`Dr;A(E7eYtnB3Cm zp3{fcrP3crjsu&XGhIXH0M?U9b54qEq2)ylh{M(xeHb*X49_MEvyN4p8e9yTX{lxj zjaj=&$G@FkW%|+3Ms;8DME4yN-w9{^y_itJ?%9@*EvfxSNZ06ZJen=06kY44u{vFtTc0udyKS2{G}`XL-xeu_1;) zy7=>rx*AZn-!bv(5~M7IVC^$@C3RSIq;zmBu`zNujpX-6cDC;b)&`B{JE`NC(q!_`y10()1X&&pQ6rew0w1wRg~zsaX0RcgIX-@CEJ_>Tu86X`@Q zzcqanJv&xCTMa^lQ}yQm95%sbNPv9b3ucgUuK<!DPUd2!Fz>&Gc#j3)}HS|B^D6Yz`++&`ngo-JUToOuSZ@x()(`wRPI zSOv^?@ixMK-X(fa#$dkE&yhQmoyei(fF3uJZ=WQ|7ag)TFR5UD)yS`VjudUFR>kxR zjqq>x&fTZmDqX#}nwwx*>6{&ahoIs1`fWQtbv9b@ck*mxJYDSIs4BCsBtqz`g*k@z#DOKYw;~7YrP^&Jh+7T$!4Npo?%IhE;^)uiCJh_ zuNn8eeX2C(5pH(mMx(Fw+J)DJ$4BqDGNk$e@G$hQswSkNohrceH{%W~=6^xB5rO9? z$h9f5@69L9G#dF!*advyIS!d@hWW1_bePPj9@O#q#{NnKsWkHbaz#>rVNUhA`)f1v=a-aaWVH?4eeb<#U&`4{ z7ibK3sWL<)jXoDM?GkYP^0j@}Eq6f`D$#EJ)}$aOfLt%HpwS&7R)#G4v+A=CmmC>HzAtoK}K<3v8aAJgkKd)z^8eax+@9S${@%)DywFrIDL1$2^QzTL1Ck8 zM-Iz)ohrDCgu=n*{vF>tI%P307Z|@@8x@o8D)WheVfr^&rL6<~s1ouyTV2|Yj*gl^ zr31tSC&(jUM_E^!G5k_FTvsCM3HADj0jWz>4WpK+mr_@6uV$OMQ=yWFmaW3MJzl%|=5cZ766&rV<2BGU zJ*f>5E&6c$V1gB?8}I#Wm|QU@ zX?}hZg>~uI=Zn{bxF_jDu&NmMnD+&nS#2M7b9ztYk0c+XNA%a zDE@aBFkxEVBI6rt*Uef(&l7_}O2c8^d+&d-D?@0zd-F*001?kRhcr+)n5SRmQrB($ ze&b@%6@syQwI69~k8gRsC+b>Jy+YfRpEU6tT1sz90((|>>aAHoy|$}$V)AQ`nt_h) z_V{|tR$-p#RP4}MJ55oq*d3zP8R?Bu$PtM9`i(C4_1>qeT*6taOj<00((bJJJy!P3 zVfK3BGSqA`18kJkh;Qn*@J4TYc@nD=+wh$7iGf*-^vb`Zr2bN zjkYkI_fPNY7`{d>K9}K5G7Req;R>njX&lIW(Jh$e>J+)jc=BcdweH@%X{Y#XqNBSp zPkz=N$)5I_W|*RzMyCCSWJF%drq!HpaHRdL7yZwz4C4)BAP7)p4pgw^eT3%VhWZ9! zts{8YfDIbK#=ay)vIA+9ig4qbYfF~JOzPk^Jc%Uy(}@tiMicByeytHQFjQUP+8p|r z$KFkn99(_1O#jzVc05tnq{X5G#iE{1N6!d#}S#cS!0$bZKJFlXLgsl^BdWIcB4 zt7OFio(ogO)SS7ESY`Y1;x9)xIDz!A&-&Uk_nVo&l{e1aI!C}$K&A;^qvdr!%3J@+ zc>Y9phk%$?*BCTAe9Y9V_xt)nvz+WpSL{`@oA`_Z-DKbU)o#|Yg66jw`93;nCJ*c~ zE2a3LbMdYB5Le7@eY?~hjjyv~`SwAXEg`v~m%d$^Svz9iryk2_d8UJiobn{V5j_Zb zTL|}d!BZJ}Ekgr?^XVG3Q~_ZlY98$Q(9&|7vQn5&jyBS8bTmiW)}1}pXU8P16q%tu zy7l~5YHEAi3MuV0CGX~TzGiAB#sCh;870o&5K*7m|=L`QT6-1FlGXt?uxY-?9a#J6@Q9XG)dRY>w5 z9qc|Z>a}Tk(P%RhJ3XKtj!}4RiZ~ygOK?{6xeF?W$<3ismNpRw%bXQmFN3wV+#q%B z-H6z6HVW2xApt`!w=AaQj*Xa{0QEKUE{khY3${)NZ_Bq_6NZ*zU3-}ju?2z~oS1x^ zVK{HR%kbMe#wdT*ZXtw@nZ`l5SO;dHK8L%E<3$c%jF}mpCEF2^#I)<9voIqirMW3} z@Jif`E#RiYnnr;R4G&JYOC850@k_joYIcr;Dh(oPA+O-AJRenPSdRHYc$KMvuNYPP zysnW);h3g(k*9i0OgsFGOIeKWB4-<$!a;dmhWh7=Wv_LFrRhUXv{9hcNJ-egl2E1RK7MK;t6TT3*n_T_g{L9f6CDc( z=65(5`_$Y%)+Y=-h+mc{5op`&0&&erm$9=Q7Y7gQ5%Z&^S=p_bRT^E38B4fO*i`OT z0P~~nm>xae=*#wwJrtD4s{$#bJ<~Wz6^Q<$*37SS>*wL{%$=cK++n9Up&1LcInf zSGQ*?p4caCdZuCft~(#wlNNBE>~NQQ2Fi-sRT7**SrM{Me>f7{CwF{@6(_qFw?4`4 z|6q{VP7GbBWIufKdmiRGOmXjtYJ6yi;+l$YC; ztPAXdc#%?~D+h(_%somaKl-^~!Y6Mw`awGwf&h|kDyplH*!)t|mD)x#mf;de?nZwA zKc|H|;iKHfr0~rca~cS%sC_fQwA-=a!q2~XCG~2XI7Xte)N z_(^?zeG$4IA52VrJ%uevj^I$elp)|aDS6bt?D>z-7q-Dugp8Lt6Fq^gcA65_`C?{w z@Hq4FQq7uJQp5xFkH@h+U$p-+^Re|9`s^Bh1KFJOWUc*TrhSR)$XZrpb9997(EZNz zA6;AxUi2e`tl=ltu2@PMeJrBLWhU_}Hp(1920pAvLs_3V`AQ@r4kGKr*DKb3rBltM&_d2>C@8|!`g%%*OKvIUhIq@H_>5s+zCl{eSy_XssAF%NL`w#oi zx8~1}o^le@3=!@5G5+;t`$^*dcb~2S1=b%F!{t-olK5{P@8AFbn?zKU|2IqXuwju1 zuxLbkiX8p7|NVpf(PID8#Uh819{CzwyfP?d}6~FRnpVZuou8 zW=6E?6xVjAw4n0mnIJRENRQuK-{sVAxlPd%Q=UryuL>0o_aE%)l_FGkNpnt3_u7cT z!7Q`9Pf-0OllHr9o~2yh*M?d3d;QZ~`RV`eNWu^lj;H?*<>w)d>!m9=-hafssmr^7qQXdywK;LHYMeEU%SqK%0arJV?}v~ zJ0Xv72x%ktg+UG@#O{1;OWwTU7U7zIoTLZ8-ZE0xVfos+Vfq^hscLQB9`{_faURu3 zoO;0 zHc!w*+ZZ)>sV9`gmgw^Gt0l|uk9b7C4cPEjPE)Mbo^TC60)Oc=_zefZsCZt~J1l)} zu#Nq1-8O*px&m;-nMqMMS#qqzezGWqD;s3*=6Wxi%@1GKS|jWF*`9R<`lu%|aNmMu zC#tvX>v*F|WNku|N4r2mLN)E2tBY5UET`(5)`3&e1CyB-Uu075WH&$B)W76x$dM1p zyO(!gau{~kTn`mFMi%zzs6uvrf$G?8soY`NlWMwz82zcKGV?l%zQTM}DV>#m5hcNF z;!ur_6k!ct(Cb~xVzkZMVGb`vhl{yDEt9p{xfC(u#riUBm|55R!ugs(tn@85{0e$y z-Bz~R(Eg{es^_0W+}p)EpcWxM{LX5V9RkqV$KU7_;j&R>}N#Hg`Sf4mNsqmqxf{>HXL@XeD#u4G(M;MmCPf1TP@f5k`KFB ztiDdSdYEbp^_Ha0ee>SQ4rlNE+BU7LS*qncwVRZfdJXv70C64sC~=QMvfobGTir3%U9Qy0n7ewa2w50ULYsELaqjq)GWf;sf7**FI zo7`RWh@RWeyZUmf`4*|IMb>1nSr?cpuW3fG>!vMEeYQMzJWIDEZM?j22K!1eT}-p+ zZdnX$qosP)G9N44o5>Q>BUaS&ps&nNy?k*w9@056#L@GHfw%jWg|&-wGc zfoNoetxyc%Y6RnIjQKG9s*uHsc6bkMI{mEvl33l8bMw5b;W=rYx}05g{Ge+YJlQ$} zChWr1EwSPYDNMYpzH=sRVCOBL%ol%RXpVulFUvRwhKJ*6g^)VaOO8%nT1?FL#+~8K z*@fX-S6)aj)kSWv*t)C;e@!%oV(vxmFUkX_Ms-mQ3Q_Bxq(5lr`Ch?dcN%6Er;|by3iCS;L}H4l;eDj6HWaPnX%kBMnT63 z4w_qAI)$d;T70|dsgSV-Y4P2*^VyQUg`Am~0Typ9Jd3?=k1tQkfSh-dzo;)IKZMk~f(u)>DMfnR>Ts{1RKhhsjc zZyx05>8iTEvDiCdSB{)Qsub=F#4LAJ?8XEW6yUiX@tdi;tfr+>d43)Gl!zDqwV9#7OgU!W z_u`b9Z*6Azn&L`i^1#TXseay_{VkS_sx1Cp`mIc)kY`-xzTx&K_bTad72FF{hmL*; zfAXe?zR^#h^OVgCar;s}vpX*6?)9$G)AC zO*SnkTh#2<`*MS!M8~q@olW8(e<2&vVayTl8fRv_|2Dw;sf)660d`Bz(W>)&-@L|1v40E`3emz@tR6?Ko7s z;QpDm@+OP;t}8gb+8N@x4oJKAfWAVd2kO+A%YJWNW?Zd9Rfmlc!VpEHE#-(ZT!EHK zvyys;mAjAPUU}$5FXOWFp~gvqk7^BTMwF!W#wN*nt~z0lCS#?|?Z@7TAB=UaV&aMi z>xVb1T*C%4uiM_w6xYkKlerU@Iofv9c3aBHTGx5&P1&Rqji!ee!3pubzZn*G?nONl z?R3Sd6y6`S@gIW=md2s+NF%EcTEkGZ8=Zg=l6JroOiO=E#x?OrS1 z9p8-?QjO#9s`+dY9|SrG=kfR1O{vHZXK0eK`w67uMZoln8^iaTd6&+R^oz!UDZsS^ z9%axh4kl?_gby9d+Ao0@B)16PvoyngX0*J$wp3QGv)lR#<|uS;tgjho1V%Gff@vq9 z5887COh}WM#ABfjPs^T6^(~e$&+VUulHLD1QumN>#GI*kf@d2qk#2%R{UH1LQg*`2 z;p+{}z!~`9HqQ6j2+J7-?D}qh+BY*0J5oe_f=BLnO?y$(g{&eew<2=k(9}S&PyvkU z(MK(nD6yb3Lo-iVVL_{|5ZCnS#`pF4j^ye*3wO3MrI!p5@1~nzNEXA`W=1o(c%?vC zHW8(!mx&E`6Ge#cDdUkSd}u^Zp1~oJ)sVrUi^UH+?y7`tu(};XrlWn^Vd7lW96^g; zbQ8*v<29WZui(?S+(U0&3@M+j$s+A}N%rBqd2*!%MnC^vD0^(hj(^?=+>k@+%v|nO z>!Ce+J$GndCLAskvAo9DR3GBFnzL{_Ef*$%=4~z{ z?@+|5y_v>@hnAsD& zedoqu$FJx0^#)=Ixr$&nyWC1pn$%PXW_=!xJT60=iKtn5f5&T%7`_IBCr$yoHc{rL0)>45cb9 zAO-61I#-Du>L#^cHf+dzSQ)4<4d!aNHW*D*K4TjVfJ48PSu$Eq$SI5VVR^reLHgrr z9LD*Fajl&xOo|=qPq{8pHrXOi5%TeA^#$pblC7^Z>SPm)ab0V@b}c$3>M|7?Rfub9 z!=XJ@s(qpr!|sXpUAi&?^>Gr2cVF9G_7hP3J8lunZN8{sqpnkUhB=L7Q`P(-ls`|^ z{_7-;YFTo@71ctEQ*zh(dL;V4nrhwLlW4i{qUgAQa%!N0v56-owQ}lX2!6VuN&I0E z^)+RaN7i=af_beO4UK|XPHJ$LySj*XFPd1iVs}N%PTx4I6+4z&PN%3lG&~c`RU}ZB z+52`oVOI-BXRQ19>={@PM2v)q`Y}_+N@PNS;OSSp&Ro50)0!+PK527M;iC$WN)75U zYnry~WC>!w=l<4F*FF6pbGgXzBw}yU-E;}LvApVtxnVyw{6ZQ) z+Ab`%)=*mhs^dgv4mU2@ao)9$<1v9yFXXzo^d=h3ioaqrTbPK?>oyw9Orx9mwQ9WH z!k3Mq&AI}^%&cmS0Zt}($X>v(Ec|$2GoXWe8{^kw=~ez_2Wu8cYLiy z&yHt$Hb%&yo9^_#{c4l1Zzwf{<0^@ulyXgC=x8o{Ih^fFv;9fJR>Fwd(UzO0q7ZvB z|LByE_f<#p_-^$bt>q|i=Piy*JI8CRd)|y5epT>BU*7Q?;eP0>A;f8TK`#FCT6}F> zWLf)kLDH@5vmfC``K{(=nCyVD`(6G*AnZ1VQYcS+jY_p#<_Mbf4LG^WMsQE6x9n(p zlEg|7aqAhkgz{TT|3+6D^B!ZG0PLUb%)1|{pg)tIr6<5VH<^S0!q?{DT*!n*gAutg ze(t~$EuHcui+XQr>O{L(Cnu8U9_P99znG}W5{2F*dQ=>?YEWy7_rkFx&tXiHag&6e zt*wAz6MM(?QNytSOI_v%Cr{sc_~PWv7tXCJ#MECu|JN1IIoW{yqz!GQ|O7R_o*OrisL? z!_*|uMt&Pf@RJGmW6zDx~Zl)Hi?2e=kLzfr)OOZEnQn z(saw@=abEXb0lY@=WPnr$5n%H^HA~+)E=0x#{=%M9SV-eEr{)!7=oQ~|Hk>ABlB)Pl0QQ=z~5VW`U9hVrA!Dhf8P zg12uOeOA_nwj-~cE*R?KEai=c{sX65j~;mI|9Y`puM`By}mOPR3w>B}gyRNwTQ z2#;#aC?B)?-jfn7vL=_`<#AF@kbm*L0nHC4q*ZC3T^N0Sz#!CUxbXU$&I8lChn~+$ zi`3b!ll`qwhng+y?b{0jZxt#Xi-wsWM@Buk;cKI5Utv4k{rdImSXz#|JMmXOI)Z7b z7Q5R^VE)}z!shgcp?tlrF-Q0+Kd73DT$+Nzt;fpq#XQ#%K3BPBQhn0Y1CwWjaO18K zONiVUBbmr&RLml=Kz#Xwy`a~+@j$Ve5l&|eUG=FLpC~Y_ z8|7SAeP;ys&w%8%JJxv6zxU%FqvzHh(RQqyA$8sA61DWEp&Ce-bjz8R4w5Fl6E9-F zGSbf|;k}uz?v>2_-fQ8FWhWSTcyD=QdURH#>S2u|hY>Se3wK}_O@yXBN!~jMRZ|$C z`+X6A3M&1)O5vjTQo(A)7P}FkJT*&Yv8t4OHM5(#By%i(fcl#Cmq?4vMVyL%JRze9 zzfw8<3-i-gzudg_^)|Wga}ueR46_Zc;^Xu|!k@)GqVV{lif&bebaVQTEo=F5W9CL>*->Js%S`#uQC46Cxh!=FIms?+qs!*@d8%5e4BLM(iU`Y}4+u z9_W@r5Y9{JH&D<5w0I+eXsf+zCf5e;a1Xxpy76G%d_H3kpRJ~5@@9|TW-+Mp z>wsZVs;I#NZ|=H3pMK>R73P5qh(wLDyIE>*j*dwMLJ&V!2GPD>)j4KR#cF=QBGNVP$Ni)CdYv(RL{?f z*y-vE7+2xe@Wf=)v7(b+&7^4SM_{(Ck7H$*XqsZ!X2tLaFb#6H2~T%h)O+&*I;?t9 z!iPI#q0Fc(`|Xh$B{uJL7yBLNAPUlEd@wbu4e>f19U~7pvwnp`;^$K9NQ2sd1ApcV z*Zp?ZjfFExI8#ox8G9MU@ELRhRe}ePSj^ayo~d+QNdbfYZDENM>1rr6jfc<^F{~Nb&ryb-9~@d3rFc?}zqh9?UGNzlJnp z-(Tua9n}8BZRa=|eo&U%ZBI>7o0qM2$)Ju1jmPE?PAAoW+CtW)OBDiDvkCrz+i>J= z{*2t7=?tt`4Q~7~MUL41cnTGf7N-g1Tne1;W76gNM}wpAR4ZfoC2f&TcI21b?5oNR>UQSEhjPl7b>fDY<7MqSKdj*p5fi+g z6$o3Qs7rh|)nJeKo(h~f$w)yON+GySbTEtZqIu7EQmwu5{2>Mc3jkONapn56W2>8|NhQ@&?rq z*9zlr%4e!6d8MI8WEB5aol4g0XwW7vP|2A}F{tra04*kWnT}_r)E^}#9eE)Yw8JXx zH{wv?gR!}0)q8HB+T9kO2vo0j2U=QML{17Yj$}mT$N*{Vt?dETcrbH39(3R_1)cCf zPfkpUbbbJ0#QQdNzBrL<7M<&pTFZ45BB`ZzpZiJi;GcE*ZTBg8<<0&=?(JNuY|ST%uBZqCyQa?q>s%nd)Y&8^I|K9afZt6*>(_JbMC3IZTt&&k zstmrd4$!>()}1kuJ+5`tqYvk!Qek}Ssujo{qf%G^kTu9XqsYiE&Pc&s+V~`DwF+qU zG{}}Qj73xw8VjUS&}|R3@$0-Wg&cn?ao5w2uNQ1KZKDFL>G@}Cy0bWRelDevUFd$> z)#2oa6eu3j{Pdse`rki$3P8HyB-wBXIAkCwu1aw02fKX^6hf;_&-2 z!Y*^K@0y~8XH0Q%0v>U-m+jt9bUphf03;*`^Fs%o(XnK@m+4&jH)u{)o}AMPy}dL* zIDgpib*mY_M?U#0&?f5&J$tQFQ&q~G0r=O6mC3rXP&TR2LTwF=S=9&@v3}nzi%n01 zD<5*fk6VM*xwd%+j=-nu6+;iUGR3yKFvPG5FQ;A=pGo(#e$aPx-{VZ=LVuj;*J z58GT*tJ|8C&$d(UtV5xGm1%`c0HIc0k32{7+}ptA(Nb$#o#8GPNw40I=$(x@hnG}W z2c-?vIa9~rySHyVxdOBhudzyaxFK>TQ2K5xR|NTZlnES<`};K{Nbe?!&qHrc*RD=c zvx<)h)M<@rjoo`ivOJW(71Mq=;ZE@eR5%J?8RqwuZc7?^D(7E{BLR3GDt+^EA4W{J z@-^B!nQie9uK>8MXm%?V22|zCNCnlI!Fek0UTW1^pLVMyfBU+we85ZF=p7Srqy2zN zt^wvHHk(}hWiD013Y%MS>%S)zrq{m@*f87-d3%%=1U&4T`pg`-b?3E!@KIC zC3^(cdMTxXXQYC6C*W-%!T(uwzS((mR`J0-LU615!iEwvI|>;@@TSneZfwe#LUGY; zc_N>}&-MIMhbpRHwvP)tHXnb~7!(ByhTzu$_BCwNDw8bF$IcAZ$jWu;@J5iFwlR8! z{DPJ+IpAyPW%aD3bnP-|2p4ti^tzbys%e7M{1q=nf#cqQh^|^hj3H+VbUcspl3Qv( zH3F}8x|w`pxAvFwPx#V%%kAYUa?1-x`LK+vZVG4!@r`NgsACnkek<|?wbzgM|y+H6`Wyw`!SIc0}asuI50;F_pN7&hDMDG{fTx$Eo_tBQp8y*PT-A zt1BxD+987O+Ubp zb`%-StEVhb#8(g~dJPDkZEZvZ)ZQN%y~AJkS{K1tdRL|Z#GX?$>zYMVU{0c=&S8zH zFc_})bs^sW`dnIsv<+Q51JC=Rt2NlbWubiIN-(tV1IE@gQELlD%g~-BE6?NwIP+gcLXr)ubN6jSs%H82mq3m;Sz=wcPq#r4{T(TJGi;i z7i4+_LXksD+NmDE2^4JT24ZM4=TEZmH$S1lq0OGTFZ&ucLS2SO)Ynbkzuk(8Z(2Wn z=knZjXFbuv-d=#tM|!0yc)W7kN}kbjWKb4pO@MzA2LyrMfHQea6qD&#yP-H141ajy zUv1=+a3YbS!uemvZksesp;043@fQK^czOEcR#Pr{t*W?oi<&ouMs(cJyYVdNy!A;^ zvqwkwU%<(kslBi(B>X1@dhmh`9x$~Vj)^)`B=n@sq-Lps5R=FLBgQH96mpafItW7^ z*}f^hlNyYjh4SmUpUHVSxO%j|LTZY3Kzy=wL9plnnXoLDgC!E z%e&3LzS59OED5?L@td)Iz?s7T+NrQtaQrpuZ_MuzqAr!`&G`-ymaatH(^D76A7tqT z=~X$^i`b8Tuuq%LE1F;IOY?^Wy)(ZL^hOtwpAeC>g`S;*))eC~tzw)&lk*xdt;%OF zEKuLL@r?X=4X8O)hSh6V!9v1)f&E%&fDv;=eA&e;FRWHfiIC6L0IpnP=uY`;Z>l`O zG%O7G@ZGJY%Y&Ze)e`Qg*ZDaF6$qV8=8c$d{(W3oJ5%teK?wP zMKtV*&AE;!APYv7cBC%udABF1_+9{Y(E{Y#ofhg&#yQisDw09?H)1SJVtiRzIy*d& z%*bno#1*@8ui{pj-l{x~nEVH(`i@I6=bdIhJlnO37GZ`x#LGPvFjDM4e)oxdUJ!Um zXRK80Xj^4zmwWFgQ2)y>yAjL9{2jLHYe6F3UxU0S^=@5Q_jq+b;nt1{-I|VJ5|V^b zoAlJ^Qu_(q#++y&5Ayg6z`ex*zxZ{_}xLHS}Exn)!UB~bxgAUEQk%h<+-eVWtxwXAmX>gd&z!#i zn+f&rjcr<>yOJ?2ufyiQW5WCbkOO=NEN(1jZQ%@!V>`-F$%L;9&$!;w{I4a=77M0c*`1A$hMIA-R z>onC5to(t^cJ7MuHkt#9udgZznp0eMYRDX8(J*dL8E>E?paS>b4_)JKe2aZF1LeJ6 zDnNT#xo9RjP8vl2_i8-y-64z#C~547Sw@k-c(R)tyLxW|_hv0-Nbj16``9oB3#j+) zw%}3J=aNkIqSUn-`bmkt2zD6C&hD}!ASb(fl#bePYv--wa*b;O z@B1ZI5)IS+veT!;{<)lv4F{U7N6v|mxNyZ5K=D|DzlI8DLZL5i&7*9RbG3e>Ua!Id zFgV%>kpX|Y&H47hY|XhqT&ezQne{*`=c1}Y8zbeq>x|!}OP4(A{IlyNr~^!*Ie>ih zOvQEJZKnB<=)Z(5h)rJPBORGc}D3(Pcv#;ePQ(+ zHxc((S=1goCr5Gs^dB`n-pK9Ig=ZDDxgDBl3t-Irg@foOLGQUU9;dTlEO*qK{Gyve zqc>0pc}79|8YYJU&FRLuODuFbj0@6>qblyc7!;zijS|xXl%r-Px4ly4?pHdc+AG2W znAn+U3qBgb;tCGuYCHHX6F6*xL{3j5Uso#p`H+7smyPA;|A>{g=4T>W>)>Z3?purq zzE0jME1#ugn;Z(W!YIkJP?@EiA51G#ZIvzEO*ab>rtgJohJ}!JXa< z2q?-4r%v;e7*?I8yk`rzLcN3%J(9FUDc_+r)l_%ja&j^C^bKIBR~WPCu03Z;N06I4 zYVZ>!lh8*}Uvus}HTI(Yaip{*c5T9zjz`2}MK@ro@!6@1iaSUB$w_$l`6DP;D2BQa zr4$^4gjYc%3-j}5N#+h?=k2wLu?M?d=tk_at6jD#FdE&eZ8GNVbTSP<0oK)djh>!f z@u+{nxcjhy^94W?Y^C;m)wFB!MLh<^1?$s z!ae6A_vN9|qy8X777aPW>!LD(Ujy;gdqEGn=`82?g2Q1i&W#>`yk8hdCY070v5L8T zP>vJg;;Zc`<6sYCwsa-zea$n6~>LG5{(% z#(S>=E04e*Shm|XJ-EUn|7{nZ6D8X1G%|7UXfgcbUH-H~-(CQdi2GSp@7=qnPao7> z)&Ji7j_8}nF|Z4 zgL}RsFcS8_Z{3^2l7~>7sp2jwIv*mp0HDfy>w(M69?^`CGkWVE%y^lE;{hV~F9Q-j zI|HAS)B-ZEi2I9id#TPh1yT4{CI#+{yWHDe9_EK!Q^bX-rzxHdyGLJDbp&pFJgMnw zWYGEQV1%N8>;SK-NA7w(gOOjK(Ysa9mKGJYEr7|d}R1>41fwD-YO$* zzHhF5dp}m4L?k3Z$99AlsK1Q-Pe1d06Tn7~b7t`c#u~1ZkdewyYRO#fe$C6*CqB|P$|%$I@1 zPoz1oW0nitgD_iecMA!Iqk~ z9#E-Fq832SI~KDpy(*|IQ(=R+GPC%q=SqrdV=(!x!PS=+l{#mdpX|4PX4>LVP1+tC zoV!=;?;3@e+C9S)q=h1!3R_Xzf`dVtWoP3z;SIK z?M`|C3~d1boQRzYUL))Cp)rY21~G#rDGi(5E_T&czDH1sE$DXjEYbG3pNQiC$t+h9 z@4XY@o?*B4AM-Y@!;KmBtIt&yt@0byOBUo1ebGo%(r=-(aDyKf0+H%{(Bb9gF0mk= z(>iAX#TJj1thF`n*Y0h0I6y$aV?#>JTBiOD4w|Z5x*lzt(0@O{m<|~cI$LyqpwsJyCJPep+C~@+go6IBny;Nmht6t~K+ zj1;G_zt%BpVJWaf#EAe4x238G^8mmMWI(zJ@7-w0H%H+C@cfK(d4QHqAO8ZF#f5hES29LZxkk5VGtff{y3Pk92y)g}fwvP)6n7US z_rL>fL^~UDNs8i{(A?M2(LWsVI_WEGadM71-!3HWCo>VA^tr ziP5PwFc3;{j+^;#*nLlE6D5QrWcs2uxv8yL}qejoOIKjR6_ZF>bk83hOIksow;JTww`tlH=Vjue%v z6#{i^%z3Wp{yRzr&RB<$A`@)=Qs8Cto!#Zac<-%+dC6@-uN`s-WiYNQNotJptl%%Y zEy;Y`+*_F?S6{}&Fn9t-EfT4A%agJiUGr8=WkS@Q{U&64N8!f*zXOuN`(mn8HKOD< z9P}6W`j{arP-zG7s^U=tljlwC`d-PXn)Qkg_J?eDGhTl&hNuE)J~#~IKyp9il*P$- zti;|cGKTGcJ>2T0a5sgv*>ELyaLU!^E(7FwYnUBiLZbqw8Z8h#AF1)$cxzO_NBeBX zEPM3To$9w+8oGw2>YNi_K1FtcvXDIpppv&To0U10oj*K1<&OY`Xao8nlapL%Z3-x9 zfABb54+O{F0a)c9`GlJFHfmZY%j5#%-eJ^+P#YLIa);zB3b{Vh%(YzYoSyPYVy&{d z&=VZ965wJ3>d#+xqb#6gmzFdKcREJQHzDF)N998naVgSctiqAqGg;Ns=yRQ~=jAR< zhQF~O|IpJiy^%FEOe#L=|4HWd$j9#B=Km1^{k%<H1t^xq2a}hpSfgsPpG5jk5e@RRDpMs*pV* zgWO9E6s9Lxzr*k zt?pfp0eHO<)0XES5Cp$o5oLk5aFh8DAD+?fE08Pu9U2h;Gxp6tT@GiLVPnu3uJLpn z02$y1kmXWk5M1;KC5bvtCcKyO=DT0|k@K8OSDbK0disY#Wp(&`1g9O;3-I@h_YfAPIZN-FUJE5Z>_srE*N9ANnsB zl3%VoMT4XdK~RPJ+}#=T?B^_l5u=8%CuB5idD@WWFN?R=cgEklRiKu^ESMI6?hgZY zu!|zN`1x@$wsL0nz$bdtH4*gR017_7b9WVFul7X{O6-6S>zDQe(-Bs@bc$v{a5LL9 zNv9|V_%k>wpgT)qHV)m!@F7bCFzzfU&J1OqBTvxOHI{!Z4c*Z>%(dH1gX} zfE$W%91XNGd1|ZR^oV5^-^{u&oy0V{PV0anZylYZN~- zCjZrWw5lfBm3)9vJu5P?HQ)I+z~SgI$)iD)WpkKAN z4I0%0>yeh6B<0H#^cpy2K5MI3qEQgnEjc1D(>;x1q{IPb-zo%`qlCwb6{sS5=>mOE z4{&R)H}fE|cC z1Z9BFVJ3+UJA18_k0$sH*GcrpmlrJ>9v)RpA}1LT0a+{uwPt>jFH2r-)Z&UkoTwdo zH&6U(1%5wQO_HRQ%S%-u)hl3cj$H+yQ>x7Yf5>2Tw}e-{M-c8#TmDHQ9UK5Rf`^!e z{1>g1v~WD|v<205AbPSJ_ZvA&@{ViA;V|5xRpEA1Y2)A^5l9kuZx1gtj=wK+Sa=6c z{`73#-3Z33O)KM7157z4VX7p2?Ml%6s~5?T>EfVlM5xh8iMIyC`1Z01CE892tv4dr zr0m$OSU`NK2(j;DqzRU(p3ipJ+T82}Jkm<6Q`_5=2C$iWOC2V}5f+&Dv=uT6D`v$Y~y`|Iy%Xv zn_6$%|0GFY6gG9VPBRhK)&KWgcbanw-E3*QJqTHQ8FYV4-W%q70 zk&Q-?@R7F;_8}O-^)Q?wvbGGMOsJn*Qus|nPfjJM@a?p`yxi;e_sCgH$?ZlUxgl+m zPx#)d=UI?>%F8RG8tErEnZ}b|jB){oBJ<=0bHS_eA`Fhe*ggu0nCT?})&77%mMqCm zFGA7;DY^L;h;5}{uwo^`g5!(Omm!~iR{e(?#j`=0{67Vx``<$g9g~|ZnmQ5tNZDG= z>%2idTBoiiicTZwWaN_9j`v_s!`{j0$<2q&#tOfF%A_Ezzs%vX;L$3%BzHM_k+U{~ ztILOPk3-MVndTOV14TlPM|4Z= zWK-OKU!pavwfk1#;dY>5K;hTB`z~RZfDyfUJchP5E%7ef6 zUq2y#)hF->cbLpMvE$+49eGKXH3J=x1Jo_@>bE5wj*rnvqA|~Uc>>1F9w}OSXhvzP zYE~5=6Z87SVt*v>BZ&yB*n2lVkX@gvK1CeBu9@>R&Va1kb}Vl$5Mur&5GqOhA$N}M zmZnglFg@MJev?zb1ebEDmTOZ{`NQrz+SOt|cVhSd^SQ z=N5GShl+bsZvfEr=&^4=E?YBkqs%U^y$vr0LXTX!{ds?n>A4cy?&G~@){l*kpNp7w zj7)YtVR2H?|5RuQ_DBiW0lk+bgmbTB;`@Rg#BzU0NavtXo8IAY;0U(&)`Aw{mOCrspRLE zYwXGfA>zxpePg-~JELlCE-;E@w7~~y#K_U{Sij>eJGq)t=U--BSs_1SxYKx;>6%R6 zdoqu=GZ5g;u10W1(ibTlaG$YRwGXbDulKKUl39sb(q<@)FkwU3QY+6&`DOw{PaOH? z^q^#Q;^(ev`R1&K%%OVP?d)8%Wi#!h!ob}Ly&QLWxi{+FiK@q()hCvOt~GeNhM%1Z zHrRQr%9%KnN1s0C-HGVETi>L%-@NpO3g7rxl~D<5YIv?gm3!L_>Ni$_|LSX3-%=y0 zJlq+VtISf&26xd>PB+e%^~Vk%J?R!aog)tElt=WjSPc z7kT}J<2^{5f0Q5iX6?R~m#^QbCc`5nB$RZPKf(Ey;J=xtpPmR;Q^H4nexx0KQnF2= zKQdrntldv9x6$1i2IAP+*#VUMCaEXkKV9kP_mgtuL0H%&!qi53vyViwZ?iOCFZMck z^@VfcF)>VnMDN5S$#r%fYf7qUa^>EZa<U7gkC!yikx603YMAD_Xz!w^T`Em;n9bFbO=i z9xwX)oBN;dr}_fk*#ag&t1ichS?|GG{;zLg6y;e{j}enL`ezxu4k;n*!8XSM!q zPwuZitBkTrYG+*jpYU}*{6HhT@B^dv%kvv8HvJL~0*`Ailq;v~X`?)mGc$w@vT&XX z0_^QjmcP+P-`(79r7(QjsD@)k_#14LF`4YOc9G>Gkvf%Vb{2q7OfVDoE&RJny|Gby zGk%DC{@kelwU_j7iDA=yYSB2nJhnI?z zoA}2)ZSqeAN=UTvxz$sqZghM}UV9ZFiEOmX%8(~DjgWmBl2_czZQyByO$tHE=~VNb z^A@1->_a({jw+W`t0|yuz9OTT?0euTaJ~FL->29or@DrR^@mJqWDQg3lMUZJ@l>-L zeqLI6HGfHy8x$T?mpb_P`CSsQ8N2|1p6=>M`|6v@AU+Oj2go~cp>rq2`xg~9yzb^i z3;J6+58P7uA!7};Bz;eo{Y;!H^fB)@6IolR3Ua4&et&!RaPuGSlG9NfPGty?^GAlj zKuY`C>fE#3+!F%=6zjwzKsyCisukqA(xkK@!L{%B*5-7-?d}!iy>T3w{Y>< z=*Sb>Qd~09{3Yp)^{)@zDzlGu_B&&?vu>=h#-0m4yCsQ~VJK=*lOmn7z@~6 zpYcw^c3t$+<&dMQGS7E@R0*z?xRaBUlDY;#vNRj%2zw+z{=%?sZ%`5 z&@Ukf=nMWUOLNhQXgn;gT?SULoCoM{)1nyH|;D_wDCK_h$wN$pD4FC^IKnSKrCaGgXHXq}a&|}Dp1JUR-B@j2i?-qI0#|`c z)?!s9WKb6)cemc>tx0oFg#>99ypGum#SG|_L5E(!XC@pZ>6{&JPrI@q ztstZj#o6bwdMVSt*`DN16V)|YT0kh}1lW_IYQX}TQwLZ z+qGxp4vOoe`bt4E`g;PKJWpi{0l3g0MDUJ>={dmld0MC(gBx4vRC`wDPtzNYlsZcL1W>3;oVx z;hQl}Z}4jzEvn$iHwE5++6z*Hcw-#7eOnh%2L5{-Tkz$>1j_K99N%XBlmj#Wgsv^R zbc@ir*nWOdZ(;-%np%!~fl??fpj(?iCz2~uwT1BRiz_|%RH3*NNp}o6ccsZnp}g~} zMAjVBdtTx}%IxS^{u+j;W)O=G8vt<23A5Td=6nfwhvW%?)@o>$Fvm$Tnzm@O`rE>{ z5;v+0I-@F7O_khGY`L;+S1~ zBA|}Pzq(N6!b`(z`ns*G_8~dQ(ENyni%C)5j7CJY@JdX-{VmL)4miKIq1uh4@HT#E zfT)o3+EROS>Gh5)&r(@HAVFaa&sz95JmKAzB~A4Vo1)GL(o(wT8E6jA^Ya2AMFPf2 zq_@XjnAUqXQFS!F-HrL&3qU|O!=BesFq>-Y%Sf@St?om&PO?4w#HEUPaXoaXJO6zA zs9DVqt0fVE&;crqar^TA+jaf>z#Qh^sl0Di4L;G!Bw;G{G9=Q&!j^uV5V zbWI2@SyLa5nl+K=79(atnRnZD$-1J4=n!fO=rxou-BT4 zkVp-ncf0QUd(Ugx~ki7=|Y!pi=+roEYBJO0CF>PrG^7t#LhZURBEnDHd{2SDwTp(~5iMpG+eF73jX2C|JH_xC0ydT>l3 z^7ytrRZ0<|0Mg57R60J!eIfvY=O49e*E>mtQcyvsthFA;fl>zflL( zDtdGwn(MIu-v#b$kjmg>tP@xEGpfmBv7Z7xR4Qe%c23hU`EMKeimnMehMO}vtdY{% zU7A?MI=;NyE2vJd{eqsto`0;vI2k;p1NmZSRN#&=puXRVtUd;F9O%Mjv!MuKg+3jK z1%UzFmzsJO$8$x=H0;(^=I-CnXh3U^QS6=5Z3dk-UvXaQ!g)SL8de#Ojz#5_{ZX8< zYHEY-yiSAiVUwl7Z~xFY@2`$<){$LIeR@_35tLTd+a^Kz-Mhen@>jN1oPP% z7od2es?Fd$*1P~M@X=Drjn{>qB?vqAd(qcqMwd^YWCppPL8w^~+nltez z&{9!LI~@=W^paNZBTW9A>oEQYhp}{~N@@ADzw33@arqSpviPnmvxy1ufY(sRVxq!r z-jYS#P=am(a9~Bparu1j_r9%b&JM_M*705`BH~jpF$Mb0S-RWrfy5bb-114jGuWxs zG=}Mys(414*;k790WE0fzT?$NK#xdWfDsI)4{q$ZjkLJX#3riq(X^aDe_jvRZsuf_ zJ}O+XL0N25op^9C$c7`IOeiWSTwrEq_AEIK@wR746(!I_#u>%lP$QpsxZfHQH4BJ+ zQ5KqfeGq&g-mhC4f*HoE6u!3_3iHO@GTbaqmZgdqA{h&Xv;b>0t`DXR-ZT zCkUmi&NNStG-Ka1sXN_KJ99vQy+G!rBb_8@l2w3(v&L z?8VE@dMKuuNt79|R^Q4UJtKo)Y3qvqGzi6pxnYj7gV-t+u#5$-{R?gt!g6peC74Gtz8J|IQ?Pb)Gmz>T0 zGmB{IFAs#|MH}^+qI%4Cc*WN~t||#WO^33dg(WuVHTiE@pySfcIfB_vvx!+p4b`3P z0A8SNYKB>}QgaKN{2v}WPRmkNK+>O*vSY3{$YSxOF_3tj1%a!=y=Zwxmxleilq)OY zP_3}F(`l^8>Qeq%v*S#>HV1BjO zN&%)xXcc-!_Rfu2rnxT2-7l=sGvEfuTqMy><9+xOuJYLabXVD+dj$m@B~li zbN$lcI2}}4{7?oqx9RoMq#Kb(W;h-Uaia1YT*3@;+?hPLthh|bxGegtWzH^4^3 zu0!8Mo$}f;vjYFE&5Cq^))p%dsw-|H;N#k;lWl~(Sy03}G}2;tJQ$T!ii%fC z6xEjBd39S|Ts-^@dq32q-`FmU)u*3W!+SY|qrq6|yms5@`2i%-DVmlX9sFRAZ2eUy z8e5r0s;#+fe_HfCLq5ji`i*G?P<3*Ndnq&ea4aFx7M_CO?OiT35$gpi=QAi~cbxBZ z=T#^((@;?Oz!2Zcd@Bm7Q+Q1W&})lmDL9R$A&~lRBJLQvNlB zNdUMihms61yAbvunSy5iIGXT%zEZuvh@OGf74eMW*UINxzLQ!LCEaJF<2WWwW z`jPp~j&m>Cc>pa*kH~*IEcKM{z>uubTLuc&G#+6-Wl#gh;ADc2S8yM)b z-+AGR6lXNan`@V{X~9rj$nT!*t;*jSX4(mc#z*l`E*vs8Kz7$|*Hg6cIphubnICT=ZsQRW+lajat37PUV{ zEekMfIt*`1Aedapt#E6vPWrtGKY7#ibqCa++%H_3R=WTVmNL5SX9mw~@0AUQLttz1 zGCZ$ilsxH4*B~A?djS0FCb78#+L;=eqc^hx8%(Mt2aRb!VPs+6)KkT*aqAHW5FV?e zIu3N;g*lhCtEoCKaUe!sb01uLj0_5Y7L8gFKt55eOG!aN?UY^6zS7zrFy`1NSmHJd z&{TrgrQ+TId^plfPvxovp^?ck!m)RL;{By7bhCgH*lGgbvL9Zepu16{`Ak$FBLKEZNa zrt>)P*;@DohlEKY_BtKcqVsQXk4)E!;LkZb3Bi7IL*kKwDy2Ur;sH2WrFP3sGkjMV zCKLSnsd-mMr7{wpUS3I1&oer%0(_&6s=*2ljn_}}AKdjsj_(cct%PIpI;WsRffUd| zxCBI)qd!Kp9XE-GUlQ*ZIL1B?q(s6=N8l)%UH8Vx2P`jW^>pl?ADsyAt&8gAewgXQ zH1Cn(7n=S!EDhlvr2_>V7c(0w?sW`_3T;Q&&gLSc60rhTNB3o(INqHB$jybz&qHj{ zBIMOitJ@?8l}tSGW_|~IAj`pcGSX&`;T_KK@T9Qi4~(-j;h|FqE0_Dqht~oj+i9>` z^jQ54m|Av}@J5v9}hmyD;ubN&ly~WX~D!@fY(Hvgla;6nE~F0R;%3uJLEBs^Qgh$AR}TPHv${1JKJzrjC_C{{Tx%CA zy2pxZxD~K7mB8m3egfg>cI9HJ7xZo5=r$cq>L`B`#Mi7klMcY$$hPIUtF9W}uJ$4a zY#%%agK%Aoco`H?vNxqYW)ZBH*fs5vyvMCXSA@1r2j>GrxjRV?w~Arjo^yDK<3=;L zrXce5G9Shu8jIZLO)}s|ju7-eKRM)a@1F5hQBz;!qG0&BN1xcYgBSsjKGPPpcMM+A zU%RfsxYPJpi#6DxaU1O}RjZJra)G~0h0ZIcW(cOfKaWnqy}zCZKH$N1WTM3vwylBAUbEm&uEtbNQP zU%zyh6&x(VwddYWm2HDXoQnm^;E*lbFILw96>emih_9uC1N#c%yh<=3EA)PVF$RF) zM<7%-_6LcOc!$BkHRkcMC|}9JCZc&o6C^H#N^7dCE3BN;mQdV2>qvfRV6cw*I*}BF zgb--m4h5I-Ehy{;wq9NjL?S?+r(cSFz`?hz#R#qPyil6?4@o+*rysG14j}1*96+MF zYgPIQmX(^48F24}=CV|q5*+hfra#Vjzf0=p2^9yWCuwQ#4FHs>?5W1R{Lyl$d?|Z{)kayXXF_Kup2u z6~jub4LA}M-#Un|r{c(O$BVOle|-PWIMWBCq}uBO-iv|^&@T5@y~-f%V_|0AL&>>L z7OYMcMR$u%*fFaSVLiotXiNK@ULPVh9GIna{U@5vH^ne$N?M{S-W{ z09f<)N8J!W(S8)N;us_0#r}hlzoAAh)jSn5fXc>Rz=1y^k8&h_qErBc8^497SA4ar z3S6-!d>zV(2%2z=7b$m|f{aE0be(S8#&aZDCPIqcbP`eyaWi(Qx=2uUT~HM7UR;`4 zbA#|`R!@ro0utc@2bH4BTK#4d*Rv%^MY@pa~DrQC7a7EeW0ZT;#b~(65ar~ ztpD0_)!H#=wixO3CfqXON%CVT0^sWoHSw1Z<24H;YLd@iuE<~Z*bAi=L`Jq%RY+2y zYZog3RiWJ?6L)2(@P5NA4#v+4Cw4@E7NK$DJo3o0CCf77zT{xZ$fE#z^4C37F<8=w z2{lBRkjfz1Xj(eV+R9k;iC)IgYlYihMkf^9OCUt#1m-H9jTl`N{q6o1A({T18>?X* zZS50a1r27F4O#P0?4_v1$cVG25TUvpl6=7a_=>O?w6nc#;`y(n*=Uw8cS&Cw~^zs|svBgQ8P2}f}1J^>h@_2J=Q97;m5cpaXJBEpotNu zwolcgop~;*h-!smQX8r2m&%nfdPrsrocu~er6UP+npcrW3((L={A?#%Ktnpsc)T%{2ALC^pG(vnQ$t@SM46RvIG9CwEWuL_3^x^ujm3P|DI z?aLX?L0+AXE40RR0yJs50b=8*Z$EY#wF=|Dxt;iJlU=PW9Dx#4{qAC!iC~g3IXWx3 zy;}n`gL9MrhlO zOFpAK!r*SINq(YA$X<25H+jV;^WstjVP2xibaI=G#h(;^I}<7F<1f96&Z4o4GlRy2 zgp(sQaWk0ZxE)9A+N@18$?qBR&icIzVmgMlC}#PKx9xkal`^%9@7w4DwL;Lp_7v%g z6SLoOskxmOTJGR0@~K8CYuObqBT-+9qGbiRYo@CJ6TD*6|7QV->*AjGgDWA*QAsX+ zLLDn1esgp6${h7FF9=UJBCbYw70~D_VKl4hZx_H`I1!6yr9M$&Kl#Wp6>%)L z03iBGfW$|J_**%++3daAA=#YmxR3(vU;Rhg70f;X^i>$-sLy(bQluUzpn82SSeiGhSh;${ei(dZKcp1tefIe&Y-_uygtL6UGkM=<=i$yh6a&XH{ucdOq;3Fdm4Ub@jWtALBhw9zU|*0!YM2w@O|-K9mAn1h z$Eb@3`o&DSME5@~`jbEF#6RAsU^V4bZ?sz3mwwfM+ql19g=gSEW!28~SWHA0h6@5qn)LzvnPGIw4GWe>s|J_TWb_|j{>X*Q8 zju<+>d*kQc#JjF_IOMP}CAvf#EKJ=Q9i-1EpUY$!;~Rj&MeALlPOuW{eNWY!)jqqQ zJ@70@v_9&4MD3rC{r7qO!7Cnuk98r+q$ES%Eyh>sY!(MGQV^W%Y%REonc5F6bylf| zELwBwm*-1GlAcRn?tz>>(&^%+hyQ=4=7uYMY6ny=zVU87D(LnWp^Xb=_60&U!ny2) zK``6^1J8EslyrFFF zC7d2>Z~w@Rnpmr93n?g7toPU|!YxKAt{(mfr}erh9n%w5inNp?HwYC_7aWFf&R=d6dok$q9mFsm-||*&3hS)0-yRkJAZ4u z`hJ(?i3pJ25Z?T||NFCt&k@ws)&0?dT{3^c@}s%KnjGV99F7Nu^Ve22Q^v8F*>ptx zv#VD8{*Q(H;k~22Tbt?^xRZH9S2Wpvv_I9FIFLlKINo*Vpn%N+KxZe0Q!3a)a&DLX zho`*?5n?vItM*v#TvFfuakQNP1xr&7(P#V`Zsd*c|58FDV!U> z0t=(#O+Q*a*SDnaFBcINLGpD!#FoXEVVZ|K^dO0B^)Sosd8`{9VoRuQmah1s$_D30 zd-nY{fA=3lG)g$kuK=BASn|WeR!^z|jL;(30jk+{m$h+dXL$>&?IM&r+hn2($q8ME z6U#&adDsc=An~c&I|-29HFOKF&lOUro9~wr zwesBc?;3hGQDCtW9oPzyt?Xexklf8kMjCT6P(f}3B9vXv3F-J<`Ae;1YWr(dLl9`k zU%&s8L2j0EnC%Dd$j2s#t`u%Ffy3ZHRf@^GS3?CpgG+Flp zo4XO$P^NL9%Av=bY5B}GRGen&eVled`&hSjG!Zf&@cSi4RgvEjag=Yi%CzWPf790c z)_2zl@B26wtJNC1=Zb=GAg#Qw_4q1_nwgoYxU9?+UEi{`hLepPdYO`F*$+gG55}W! zLpj9ZzE|0Sv=elDV0_F`GcBVi--lOB9l+Bn0zP9AwMoLCvwUpGi7~1Lgtm|etKrkY zvct07j34NJk9K+VfhHuGn}^{Pj96hHOTCIb!88k*BcTbv=@e9~-tbgt4lEsT-?wLQ zXvoJtjg_ugkCRm^H%o&Ef>N<^OJd7B!=sSPNrvBu)-QK^Pl@$9CnY7-5A74OS?tj9 z@f8V;51o2%Q81h3x%)1H6yX>}T zc09X#-5vODE!Wv4_)H@HtEUb?kh>(%^~8gn5J5}kfy)?{QH;#=+b7N6^XRByb-1L1 z8{5SMzr$YuYGg!SncJcyM5{ z-ViMFHW^03aF+t>q*)3*t^&=gtvo^_!1=NDhs+B?_$EUJ1g4d~a&zBrt8yG#EEI*U zE%#l9K912&mIcu6j`FS0T#IJ~XX!rDXVM{o!6JIE?f_=9eBg)(^c&~|#-LRBL>2Js z_L}DmJi82xz9_Tj$#4&hXMOK3Gf4WA04G1hvsurBt+2;WJCwfqqz zAkElP+h2@f1WlnmxGrdSVv)sn-VY~6^4uq$0@!@3g8c>S@@!_lRBy~O>6=~0JFZ^_ z>cXXmbV^=w>uW*RLHrL>d*&6-)v*4T6R;Hr!V?3APIbF`{yJmO4vQ#%;f+PjQ#+tu zJ0r6j5x%zuEli1kVW-FY!*4#sbs0)Xm99}{rQp_od%W8dF%cJ<)Z#0H`MF25Eb?Xw zVK(E~g%xPucN_Xi+p8+hcg7Q+?qT%zSkNBK_m|0}TEqfw>lu_j$#a^bdqu)rc`(Y+_~^5o@EY zikIw|1ED-N47c7{Coe;EDa1zUz02B4k(R> zTA)~4W-*2Ot%KetxIF1Zgi{+J?@QGNLl`832-o)}6qMoRRx2H_+85>`EN@}bbDPHek4ke${2bLSyj5u=<#W(LpjoyN z?ufMZUF5lF7!O6`mv$!7tE~uzf*uRupuo)KjkzIVVJFh@_4rus6qgg^1>e*ues=G^ zJ$&IgIK?&Aa4fNPrr*BvkF{A}AV14n_!}I=-#b2CeG0KbqChGrTwNNYLsVVm0;iZ( z?JXP5>{eho`B=hW4Dq+|CkBvSY!`XhND|z|sodIS zSf6f(!|?NScL;D5TEHld1V0Q#Czd~{XHtphIeUicuEv@CN-5+B`r19drap>A3 zvDjn~WEPiaHnqMHLAjxx%i^b#+no6iehVsm2VM#I>v~+-@aCoQvG5NDCeYvXFV_-LKvcIkwlL8qtIIa=+)7dL;Tv3t5-qiG7`+_ zrC_%1I!^xx8zAIh`>{>8HKY#T#2q zT1Idr?Vg&xCE%)Jg;`KJC13_I2xYTx0otgmu&JrZI!VQ_DQsXEbrDEx0jY69E(Vhn z%=`1)L4!FUMm7slMr!^%x1hlAxLxro*yZCu%FQgcq+b6C!U=JTArd5~lKL-!yTGAw zP$oQrV=$qkDlPGO33Y^#C7#rH>H`x=L7#kNN0T|RGg^l-#tnni~$ty4FUhBG>48ixMUOP~k+%tei3Cer>LV+GTqP%M{ zP;;6_>w{q%g9%nwZy^RUq!%1XVjyc+szJ_IP0h;<()E1uV`aX;qrMG|Ll65MMIcB2!1M;XlKi;Ve^c*8~ zR*frVhmCGztKE7ptalg|3r)5`}!gj!OncPE>T5b&Z%VG{`j) zVrcLXn+arCS!&3{kRy#9yoL-TU_MJ{mj}n&VA{C_u-lwIxg4VdF_B*7o;&J|8qMzr+hT zZ3j9dcHhHkGYDA%GOk1&oIBd24WX$--ge7T7!ks$0fD+MoIwtb9;ilN@0kTohRZVD zYVlbMl&kb*SQ~%e8IpYK$QPUNSXrmZiu;tK7ESu>16g?=Vov(-M|ZNP?pi}u6xk+)-w zGRt0ltBt~&agmT-ax&BEEkC2A|Iq_=_4RH*Xn8`$r{#0VSlzD2SG~0xCYI45kQ_;$ zhgc6-^Sq;`@00JTOex7&T)pHe<PQ18&(A%;-0KhZy*`ii zb(T37XRz8Lc5J1`geL2t&fMMGc{*~WZHYNPVNaKd(YbS@x{?i)+Pl`hyROJSofwsUQp-^2o<2_^5&17{!`TUtvvj#x=*zza|9#yGw*L{Hkukf~nupzO{X>sGP3tNeK{A=wcSZBaW>)Iof2Q9bB_(wq*Li=W z6~({*_WB3xo9j&Tx;k3C(7{UlEfqg_*v*-+e@H+R%Y%xZ8@SFRirk_9pV$4e@%B;I zah>xfGhP_3e?~X41RFh=p*PCO$>~7>T1c+Xx zKfDOn{FG&|y}MWPmuzz0c^ylqJY*N%{&W{+__yBu+za4;+ZsbZ)N_?b1!zsZZR=yY z8!Yx_-hvH@iH-fU0Il3+M=AA77Hnh>6B*&2`E-d&onIof{k}NaNM1?Hu21vWH>Z6g zQU5pFktRWpq}Mcce$gI`kuj0oJJ2r3(WF$i=Ko>NcmNdK=0}(rG=AEYn^ZE`@`G# zhuZ&FYAZ(~oC-2)><&Y}M#EO^{)kx21ULVxJfSp#kUEVL0)>1dBg5K|+!!FlV+!rhc1V)PLhQKhs$%S0N;!c?;{pCxdumm5L@* z^=jIPn$Lt8jWO9zeq2GdU@lj2+rPNUm>Z~bT}$E>6o?s&E3hE^YdH%D4?ZvnOh6ks zxi!Y#|A`==$i{`xRa<^?bAMl?pC1$^58@ww@l8-@N~Xiz5~O^Y1P8IlwSLd%y}S4H zhGB?n9N~OuW?V4C!A*N%in|T3I%;>v0ngxrKD(cuBYC&>_Rn`+aPN@pf@i}6FN?BK z0sjY8R_*t!ua5i(1NrzcuEbAJ%b|SEd^GtDnt(+X&pDBZ97wvmS;@*d6|QEd0q6cT zw(f(EiHdAymS9qG;1@|r#D5g_&e-onD$g>h_hh@0w5O)g!~A&}(JL>l+PQMAH@26M zgv0bD;ygLBX_-X%;yq@;p!GNw9FMqa=VQ{vY6ZvMqWjN(KF}m8yK&2_44t~U)dL@( zuUul|W!M@xdu=q{T7KjB1J#EQn`Nc(X7jr3@i`s4t|ewH8-zq6I;i%iBX2U>cT7>T z#|vg=qO1rV_Cs=A6 z3n+y_`+vcPP&gIdJ>m35**idUa%E|nVC&+Xn7y{$jG5SSprFx#zhn|Lpku#BmBGZF zD&vU&HcIY^V*N7p^9f9hPS0PYBr15-Uo)T0w#ewiaQR=|I4V{+8Q$s8)>tMPG9`qb z$1t}r$p3w!HjZLZ9Hc6tC)nBK$R+M)Uu_Fg)<}yH&Rv*w(0$h>%4ObfytSy~B#Yas zlZga@4l{Q_+Ohk*pKr$17@y3eI62(h@>*Z(LRqS6aH@rwaDtXS?@(COvv=am3r$GHFr{_|_2$Xf&EQbg7*AC+zX$WgIrAs^;ivAq&r!Q$k~tOM$MN zJwW)@r^BP>F5t0}KTEAx% zz2e#0##2!{k1ps*#merysWeKn$f~iAqJeGKOq3)C(OvDp&}Y(rsmT5;RIPiESJm`O zLGIoj4`M@}sJ>KZCzDfa&QY(N76Kp0Xl0+*9>_Kmo5a+-R@%~aqUTcfHR%JP>Ju$| zS<@|p#qNcZa;of^ zJTBgh$CmS7SmyR&dPUVXR)W>SuD3btx-*{>wRiI_`v;EMHAfq69z=>sLR~7I;~C{u zF2|D(;#j#Gpl^H%GflhJTiA8J#@{hQn9K*)nR7%U0uT`~LjMvm@x~Qq=6hduUxM85 zp$&(y+u?JQ%gXkI9%EuS`R6Awfi+Vql3kST5@r+RYZK?}3m=|0v9P@MoT};wL*HZC z332y6Ohe`L`sAC>J3@c(fwN3=wc2V!MrUc0V^z@e^Pknz&lQN~;p*ZECtp9s{4C6) z=V&r9f0>kQGX2AKj0Adw5wewjTE*x0)g_dti94kVXng$K_Z7fTVnL$TK)%33` zm!BW@8<(M#p}K6ssb{DhTX(CaFsHcq_EYxa^M#o6H~d5+9({;es%uHOD#tdR$m`w$u_^8OpGHe`HaySLoy3?=;hID zw5H=v@Id;N8`!yA;hkT$`)4n7@b;+ed5=|`aGEHWAXpyMZ^E3`6=TT1{mMzq*3bVn zdN2US*OSJWsheaIErdi0T_skXRExb$aE?X*JVrCrku&HvoNItgl z?;1veAKr|Ak!s_8`0|^O3KVr^_Zst9(79scp@)-Sa)_O%=Yz$v&ptNBQJ*sOaQElD zakaDS6+KK%K$PAYHlshLW_|6cD@L@VqPT$osi%GMeE!qW)w^z!o!MyC&d=ZZa^$~$ z;o8P3JMkuI%+6tI`^)r=9iYEup@8skb^3%8=T(Wo0uF&=QXMIxjqi8<^_bzx1PUUS z+K0pXFycfPKij?a*FfPEIN0^F$G&)t>&o5N%M7Z)rh5r|yqLrmomeda>QsE*L$-I# ziswte5DlthafqsPiK;GyKT0WnymELZ;!I_>7-7Z!e#DJ$L`W>0yL;(g zBd)WQDz#7PF@_lyZzIW3W%G&87KA>T)wQHA{^I@NrqvQByU`&vyZ8n7>ywVQvdC`SED9CQ z2pdtaILb?z!#mD#tHkNfSbQ$&-=5MBpYqe`s20Sd?jB@D=Ua6x5xR-;x@vcK-B@H^ z*gOh`s=z6}cgsG6beIwgERGb+=Wzb#t6!ah>U%X;UsreR(6|ZyunE7Bc1_?wxq@07 zdh-_M&!7MPUwg-@7(UdsWUNj&Y9iU>C)I#` zkEsh8`bH$yS0#TP7CH@Ajpqj}wU2}+9VkpX;G@kOpe^|!b6ITp)tu91k+Vsjo4u7d z*6K4L2pa5lk5A!uAAY5ikGEr}@WmJh{uD)>Td~KWA1;;B0*=(V%}N%oeHKcxNx3M+GkGpN$9V?ap$MGuhwL2oy&?mDZ_vavMIhvO%3U5-jF z8NA8zaK4zOf+v;(_C>sn5o6J4es;6E={HxV>SOuh>0L_?vn9lq9)jEU-l8{wU$<>J z=d=?NDly+wB3xN)u!Y8tK6jTl?@H0hx>7l0{uM}dLNF_lbfrMtsc2j`p7(B^iNl`! zdHr19h?`wY!r^qZerGnjO(6^<`ePK2yOw&DI5FtlMvWvg(kz|MCtWnD?NSu|&C$G` zY7Xhu`PyNVR6p?mzTT?>F5F%Y4KgjenGxAcL(9pnIVL;z){P!=W;;Aa+Mc=dTI)+p z>fTs|eeCA%ErakCRjyab9FJzC3gKi$mA0&38Zm9!`C4b2&j({et@3ee!uR9!sN_-w z`5hXIudMVF>%&^tNXF$~csh@Hc6M;{yQhz{-+QbgNm*W=bkc(o%a{mcOaq7d%^Ofx zTY^XW6MCjv&#NCiLUZx7r!cU1-|xFOrvCV`^QNB%_P^);7z_G5pbNs=mU_BaDAxr3 z#Z7n-UeKR-{Ir|pQjdE1)8g{g^Vtz$|pzvECi`Y{%Ki`GV zLXzx=<940_GtV6TK|-9UaX~F0>roa*sIuY3JM5cY15|hs&VG+E6BTxZh)^^xy>Ybu zwdqJCd?g9^SY@QHqyQH`V>DGU-dbap!{225?u-p0Be8(vRwoQxAb(9Tm;Gw=9 ziHCY6Uet)%WaxbH@qWH|;dfDj00O?P^eu;)o9j%Q_wtMh$e4X*(zzM6ds~dnUZ40E z_xt))e>yjYW0zk+mHVBqmvF;tSl>n+P*Q*?dfdVxbyd-&=wDFv^HAZf6HbSH9HpF#B|0*%SvqA6 z4w@AC&9*RV*f)~vzI$>euVXg*^k#2l9!2=7AEWg9^1a0AL_^xHC8c0NE~A5MvSRCntcmjSbn~?>|4KeOr*Ry}m0TJ~78w z#bG49@I4VPzTn7oBT{8bQQFFHcjb6r%NTMowO&i8polrw!8Y;WF}H0a`?pDn2S3U zle&EnDD~V+n$d0^G~OdLhhKD?$i%j-hMLxX{?GAL2@Z?rf?-we=?!Wuo~jnD$pg>m zcBp$TUGwNxdRoF57EHlD-+5->vGCNuNYR1q(3>`hLhZ%s@eG%IXQbXrxBI@xKHDZs zcUg7ydhg4%BQcwdY{SKIIBPikD#?9jd#LXz20Ap>-WgNJ%tP6S1HFc2ef^PXah60f z_NB(dQA_@Lf69ogNY1Y=tOa>B+Xf{Tb-M2lY^ZP>N?KCPGOO9&V>~}k5#-+OEy$3V zspLOXLetrCidg1$i_M&n?&=M<&h33XuQW4kwJuHPK>JiD!_srh@ zzo93u%{KNi$B(d!@SCX_$V5AKKjnS1`{sz2{X&oR@RKthwNP_ix^K4rU=h^&X`73; zX*j_xNIQFb%Hao<2XZy-qe%)7h zI(wdxk2<{#&JGyb%ddAj-odnaW{oF6ztVrEFiK>_a{l!>UUQqb8P+A*w=umfLXx%(lK@i>5yHS>J!{YkaThT*;IdXKQftN6Zd#j`n^5SfY;fVWWYDaF+Ss5+`={ zAqmg(?6p_9_qy*j8K?PtuAg7>AhqLDx3z(I8?zl2Z~0i(GE*LII@}zHRxU)^S|=1^ z(k4OEcy9_lQ<@<3{Gg?}eHf9tNS?XL2sPLQdV{cGJJg<}GeoF80_=54Q+sw`S!Usk z0~L^|MNsd|O-!mR$g2Y}Hl=Nskt>5Tc0DOG$Y*}!2~Ls*jIodBkD`rDPi7s1BHIfh z6plulgRRyx`z!wS~Q|m{~>JOio3e5r%c`pCq+qXHhNFnlj@p6I-`ihC%7XEz#@Q!(@y5#pK^s z6y#3t*tH3&!30xo>o(s$&i_=G>@TV z?RJ@Kbe7nrVtYfT^|!Uk1e+Je1BlWgr1b48Wk?9t*Kng-7v(gB%zw_{Q&kY~S-d@& z@E*lo2~<;TKfj-R7!MiDr#?=&EDc^v80TTfV5*7Zgr2cOs z{I_>jJ%g-8AdfeYTHh;MDLYDzPHH)K{AVY%&#wWFS@1rgz;pfF;+z_*u2}@YueZw* znx0Y^c@T3GQ!0jrD9Vm`pg$~k88WU-U5J-Q=50+^ys@E2Doqu0+h`Y6&nFd*MtU)s zaNP0=vM%9u$kTwfJd^!>ft-#JbxKtAaaLkHVgKBVaI+lsX3#jFF@U_r=ZOHAvOS0d z=+8jqGVV<}g06XT@BTs*J;5_jqAOifbAMp6tc|TNAmx9azx@2!;nUjB^c^c6^2*%1 zXuDV{<`WMmtdILl=!S3{FE!)Uq{rAdWH$NG@%1-74k*=4t)xGM@21Sm^?yFBEp!yn z_u4%dP3;h>H;29Ai~DYfXF7F?IihF^lgZhsuMdWyE(Q#IYYPTZDz@^kXhg4m-|t_u ztksSS+9z}q-k?}m1B7XVIpfu!P;(Rk%+s?5zbSHgwV)t}gFoC-GkpBsQ<>5SW21)= zqQH?0{k|i{!tb&@S=@q4u2QJig<%}kHBvmMNOQx&fs6nkp+o7~-daAYucx!cAoYqg zt;T0(+bE9wIDJ3Ws}$v{MvFCR(xgxDZdU{D%JbT*UMJ78U>JH#28vhso|Rx#}V=ks5rww|-rg#LH+2#b%|>(b1$^$2E^rt-B!MmdQYf;D}t! zkQp@C(wiPQi!Ooyx}WOn{^_V)MY4_&#e;FvudAC1Uj&O2>oO^mP|n`w?NpDUswPU0 zs^<1$UuXa14DYwd)@=@RkBH?WyL2G+y?jZYhQaJGTFHv5Z=ua<)Owv ziK0Cbr-Sgme%24ND4_0eXJgPylQTKcG0f9(%tOrwZRw+j88v@__Wkl{pY4$i-Nco< zFWM&o_4~Z#fg{u4Av9o(;{uH4LdaprIlA>1YPD18NuGE&H%*|Uz7 zPO)Um0<0;=*UdYEL5p?RKPMr*>hX~g!A@1+l(D%~W3SE)NYV>(L65bC+$bKN!IvUF1QpoX9nZSG9>)G3>HsD6D-@tqWF z#{N7}R%7J}xtIODR%BOs9&_Pv`4i7IccfR_Lm|ZCx5S4wEVZUC_0jgwoSo!*GQSKp zZhgo|K=|m7RKKB`Nj$2$FtcCI3FOC_rYp!W>Dm+F!i@H=>a5tTPj^WscQrwdntV_P zxXS#v%`+pzz8FFbNTAbN0Z~km-|8G!erjJu!YX-U&y(7L1*Z2N%&35|-)oZ_ zM^U#&J}}Ab2$JGCgst*iN${0A8k2a9aS6C%(O}FmC$+o2x z4^;Q7E+q&YRGa!_754HIct-rRyl$*j2*O{DX0{Pw+};g)Yi8Z!C^MGp&JV| z6&3Q=F|j6=F`JpA!@PU;Qif?^i5^m@sa)4VBXpJ%YGbD8{C?cfadj1efG%{?VF>NU zi$4)F)0zywlWH1ZT+Z24RHO_q zoXXo?_##;0l;nB-tibjsKP(4H&cvRYtvSw@=C=+>gneXguUvd9&e}|=D5Q-DYQ!90 z2I?he*G9^)J^? zs>)qB@mt;5KUjk@ZK z;i3_QWXDps(uwIPeU1?L%nMJ#-Hopy3T*oX%MrM-ji+B@NjXOm^v-1pVp~pKdTBFX zPM^~*-AikusKlm!J>CkgJm%h+-dD?{L|ntwx4dye?St)m7Yge1UVOSe0|s(VoZ~SM zM8JmfyQJT?Hs%RiZhr<;wI(=qNpR?{O@xf!isk)5BNL9i{8F&M_defn(v1S7*5~h& zx0B|d?XP=gs7Lqj&yXB~q{oiq!H`*V0TX8djX;9CtRG?~_ITn}shDig_!?@<>l}C3 zWKMS4K@$3&jdg9u`|~fqOT+zO4^0vR@z}n{C4iPI=U6)uXU~{1u{w58b@A09Ipv|j z!80%E6Jlq^0`TKLpCc44csc@vEpK@G;7svZc-B~T-x z)Fk|{&?4zG>FL#2p9w#aG0%QRChfge1RI|5JpcqM6$k3@bd(*gW*O0|PvP3LU%Gyl z5xm2g1r&YxdQbx=mWVNl@yt5xCc$)gu%PaiOQlRuE*c;Qodx&3%4u#sQ~J zf4hv=>d)04g_x8ADV6?5)k`o}3W-c<$QBcmVPw-nEDOF1LcjGIgme zWwWCzakE>(om}6GnBc!-Anj{gsCAz877n9MnMlWWX-GHxXd1SmSe6mWdN!OEOYq3( zCaM7tP0KzFWE6PzWRJE@d4mk2Z6bgW&EbUcNmknU`q_rQiR+v<3PX?l@8`V#g%aIc zI`lC&H_2-^yuhqN>~@;Wee3He+wAGrI<_uqG*Vl7Y0j$O^2v}kAeAHlEvT_g`N|kx z%*MgxscmbTC4cOaX8mXhA89#r(p8=!x}=|fdlx#_sB>!03wKNqSZoG;i zd$A6*KiP-sIHHP?3`QM8xm5*FoMnO1O6x0Wk&dqpfp_>y#*I z;_aVqOCxq#6Mo4~m7#LI8db~kplEayC}#ZdxPfVL!Z`5@NhzJKw5;=P52dbPVLytZ zB4`wh$dIK^>TtP9(QHEtZc~(5aznxl%RF@+#oCFpvP!u$VK8j&Ai78ZJoqRcNMKE| zVaP$9<__@!Uh}n)(nEU{UB7$C+8aEqU+KsT_OiE$i3o^W4O5*{%1-ybk)a_qxToh) zap&{5p?P8cway-Ft^4I6JtO5ztSFRV^QOpKU*u_O%- zRDyday`Gas30UevaMCrA_SXUh>%Y1s!;+q*;YiG!rp)nC`(PrET*YjcjPpstr5xg|~ zo6U2UZ3S##|1h+7yv&BCglhxUU-s0bwvc#Wn^P6-Ooux|@q~}C;li+6`&~rC5*QK2p71C3qWx3G#{-!#nEA{PqlN{VL-s<1%U`uN@1?4*(bf2UHnZS0JREha~Z z_>@yK9G`|bxsa`CFg~3GExbL89=lfIu^EpUN`X2ev>Yb+R#N9On|Z8UttvhHny-_l zI;GoyY>&xD?LeS+W7FF}iJ~rT1{l|k+>uAvz_&{dr6p(*BLbYFvH4_=W)sN6>E!j% zKYG-l9bwP zrAe>;k;el?J-Uu6>|w>H^HUca>?{pU-OvP|ZFTQ4`>N`dT+N}Htin%WQZ*8}d3g&- zxgL(B7M-Vifnw@s74*!$eVjrmz~{v~UU>|OuRw>c8kPyd28!4wVfIU5d>Jp~(da>8 z@^pgZ#>f~3rZ_8Gb9Xs29wN%sIar|&U(Aa>O->%cyVoePqaAf5Zu9xx^?;kvj>SQw z*qv{(MgTP{Lkk~*@HEk9JM%%6xeL{UyDwfCNazUed=FZLI=oXZwF5!8C5ygvV>>NJ z$}kMAglJS=gI{IiRs(g^)bi=b&~!MTIZ@>(lOgJn!|pX$Keyhez!m~fZ+zJsazONe zQ>AH{iQJv3ied+;i194 z&e&cRYW;An3u*(D-3w;c%r!m)DVx2OFzX6kpe_&)VXInwf#$YznWt$t^SXgP*hsRe z;R|fpp7bcii9k6k00_T+Qt27aE?xTv(76>9FDjoZKX`n{+kPOA1Qe-f)hI~r2!q}j zQr{Y$CiUuTyo@!@r&)rq5H4Q0b-8^jOVEyztM(1YEsDD5bY(x&PuyV-Hd-j=-iAX!YE)w$Ry9&9gMAfoyhOJR>w;~tDbo#Tk?TDej&^rB1YaodxxuE;pA;hO zC!w&k88&Q}-e6$DBx9nHVQ~?LEpJCJAf4Oafs(oSLweCe=(l&Lwm?u^LgJB*^c^Q_ zT4i6$EkUuVk8xCwsRxOqW6L0Y6 zw2~8SBE^p9jm*_ItpsPRp%;Xt)hM0^0+%*@=VnZHa@FuC4KY{-IXj&$BK2i3&x+iZ z$3`9b?+)PqZ_xc-4-eS&TiAUYnXgL8do6Cgt7{Xgi(Orq59e2uLNe$f7GK7qZW~z& z0>M0}08q!e>g7xYHWN9$mCl>PD~1Ii*o?}aZM|89#0_1+sp5xCk&EDf%vRhy;?_ShfN5fO8mGEUJmFXJ!-hMaQCCv z!lP8`afQXs*9)e0sfDCQn9s2%yU8t2&+O~)GBzvmXuqZ6?H}gq#yjm%GgXl|{`|n^ zyFYfF7euL0Wbl|%VdY`q)-JHy-L%oySo4I7QEvu&393q&o;NO&0}6SsGg?RWlI|RT zuLa}Rq+L*;kPRINY(7hLNegb1dqW<$Ov1Kbim+qlWq1_MH5N7AXR?@OWIWzNJ|CoH z#vkTEe>{eLxB3nZ)Z9=qZ-xdIahvWUTr!B6$tTDx+ClOv1rD=rLvYuM_5o|(>B zm&4j>bwgB!ny<&KgoJ}R7+SfN?+f1x2XrZUx%v)auDr^Qlrs-6;^agaVf*H>Qb2FIHAoni81J zH5@^%5t_vT4yi`)Q^`d@8NNoQ?#_=lEO?-`NjNfiP%!Sr9?s#a2l<6PPdU{E+5`~> z_j5Z(p)EAZxZoT|1&FMA5*2saUhhJkiC?^R*Sx+2Ai6CbHHVNujZ%%i*)9^CV-vX` z>_ekPF8T(4@>kGPo_jXTXuQl;HdpIUnd1+@J^9_Ft07aKbwqu2`Lyh#uhd|9`{}Qj z4~DLXNgAJ5P)}{)fv80)Z+(2d{Ao8H!UaU0dP2JmZr^jij*l_(&vOx@WBjrOOX*)T zKEES+tG;=LZP@PfkhN|$8409EwQyUOADW0~8z@BLYPavS+if9NjYqB9j_N6$k!o0N zdW6Z+9dlnuXU7|qPJ4RNQ`sK|g56%Gz9W+R8M%GF5H*=)rhP5rX^T^~pwGGAHjeF6 z%>o*J^){qFN7Z8s$EwPE#fy;KIzIDUbEXdYPDT%n90xr5n=*JTT!VNwx?-Z!s9d}w zU_$)4gUbs8IX3qTm|UUXFT?_CJDx{eNX@$%xHV@79Z!?29L|4`k9>u^vk?De!PXm^ zYgT2fFF6ik2VA=IkD9FSoX+sobXVWUG_sx!51y~K}LaARJ= zrEaD*pIeS~+i4U!4Ho^*WzqVg9}2TfK@|z&znNW_F`{ouSLu_N(GY6eqw(6c3+S~8 zYw~M((GSjR@^#Jr<8^HTPxr=h>0}1;QzRsp#3qy*{#?rymk!e~cQN6G)7BI{KDjEk z9u5&U=FM|CeQa3Jw-N3}maIA!_hG6q503E4fOyz|ivOjdo<;_4*^`3s8~)@rt*h7u z5~Vi;>gKDHq8o^;)kVk;%WK`>L)}H(t z9AB_Zn^pstl#e-Kfc?O08H{H_5!UB@t$v>2|xZI;SXs}d*{^8%cH6&d-d+J+e zr`ehQesglXx0PRJ?5ROG&YW#lM-y#H4w=RHEbIi_sYukg=|^c@`E;KNFCPgYi5r}R z+(ypL)PvwH7O+WLsw40rHm2n_bB2kJpO&dKZhCk5T*dN8#2=XdpRfL3 z0Yn*X_BXMyS2y!(n^uRu;rD4A14X0#S5Yv8P@%A4i*g2P$U6$M0|_pZ8IgYTTZV^6 z2S$OOxsXVjt3~^3kKVes#&6BqpSF6`7pfzgolk$V zu`&sp(?zWTRDbmJLG=eW?%nJ568)oC6w^~PRn;k7S3P7>Zsq#v+9$ZYc`eUcL&ZjX zh>(GY-;nTy*{6$TvX%C2SjZ+KI+Pk}zEW^}!e{xLQAP;4=&>4>o3EFDO4uG0D= zayIi!DG7|%K3M)YPTpn?Io0?=)K#_vT~&8{RDdVmbe<&ZSB+bIB<owQV!Pg4@Tm zMzd{wA^y=stAHh|`Yr|LEYjm;<4ulb=*YW=4UVFXj@|O;7dz?H(#AqMI4Tr+dCd4O za$;@sWt?QTfCo5We@P`ah|jYH>$DNa1IWHhBO<4RYX{MxVaQ08l^2UCp=cpA<3qmr zw|DP+l}sdzM~gmw{K7gXc$8D!Ro`3pOc(<*^60(LNV0_sl2rSsKTFqA$04HPE6SN6yxC})`wMNTll7u%86Y4G4IZZ3brqOPkwk_V%SW7q7oxP)TuA-t-+@p*B12i z%}9qNUs`tV7KAzwRar$`01LQrmERC+;{WW0hIuUVyEgz{a%=uraM|(Gr2Mq=lp|C2 z6;oU7IR#E5x#dfRIS!NaDj`V~ab5-2GhhKrCFTc|h>O18k#+BE+RiMPaql<)s}rwepnTz>L3_^H^x`_>3;3$E|TmlDV?HEMH>3nysg! zTjiE2V)N?1puPV)hyRy%f^1JOe-eRc<)+OKWLOqzd{oODxiNFc&>^?O9TTHprIPo( zlm24fLS!v3H`g7s^pjeaZ;zZ>gUNYAlc6wdxTVqOb!QO#pTnrD1xe9KC{P;nV}Cf1 zMh@#{cfc#j>LbX{Ne)0=GR( zI$2PmHRd0_MOK84!Ni%lirp*`JPCJ9kIzJ4$J2gGN^kV&Mcu+*x1=NDuOurt&8Ns+ z`xjgIhhN+#vJPz1h~2Q$|M0>845@NwZ&_MOHoCO_P8c8iO)GpO_s1KM=y4-xodqTK zMY=aynQdDE>l9=v{ubvlv_GN5P&~ z6CNm0+{kj<%4*_3?^jXg`p0EN*aMf_<8Q~+HR=hDUcGwN&$#VQ9RE2T#DfBfDs?|` z%Bcwpuvu1(CkBdgb3?Dk{=HdZ3bvK)*gkG1%MtVPPW>-t_xGQ^3b1BnBa4t^{R+5b z-vi_y#mL~+{at!20GaGjIp`HmJKhIugcK$!d4|Ksz5Y|q{@G7_BWUQ9`0Hedb8TYcos z@~}qk$anOjbJ)>ea}&6;w^CJ4?uK_03YCPJv;3dGi9sVHmhGf*OSenR`=S5yp#RYs zd|mvlL%f4^L%yzV>e)|T9dnq}+s*xVLUy5WJ|-!L|M7Bu){u67@PcAc>B{+?Wytzf z%K&GIjS&M635A&oXZ9hz)dM8&`kmoS_aC-VXCuQ(R8 zm;H{B(f(yhUgA4V7N!|4Wwm(c_C?u>9}K&|PoN z{M2!bKvYQJ;sjFey{#Tmh|GHkx}d} z)bop`Owww8@=1DBT{JaK+}R9=UDtl%-kJY5Uk?SXxbKE@xRpNt`6Xlm^ToM?fG~e9 zy_3U2gZZoaiPYs#Le@o7XW)+P&zt_t*O<$QcTClz?xNShi@=WPT-D68fq&*&z%6*~ z*pa>1ueybXi+)#YfF03Acm2$TG5?VIxj!D<4evKDWnQ+D3G4aWx8c11qj2z`UjDwt zY}CAmWB*}Q%)G+MZkFzw_p}y(9+45-GSrqbF!wW;`1iH`(~FC8T<3~D9{P?xKnyed zHRUd-*>@nLqQvo|*}uj!b>DiMpMUc)M6O<1k7+&0e|j?i=7EwD|HHZ3dh7op;NimM zpp_lx*S(BXVxG?YGy4Z18-qKLfcme41pdlae<36=05u@wPjk7#4j z$oMgl|6Nk`Ujj&3!^IIt1gjMDnQ@mNi<}kKI^+Qp+r(nXrxpihO{hyu}jyGt2-T@#DUE`i7nO(e}@!coBK41YY z_rQJML#=ILi@!f$nQn{fO?$bTbNCv|95G~-a%GEp>GZ4L`pB=~7g(-0qRy!8lV{yF zf0y+FiO})g8_K%v^ZxESFqsw|9OJkxOna@(#5+Ts_WB3r@YE4OSOzzL~tfr5-s{us~GAZ<{a(Nr>WS> zwrExK1v~+JM0Z+6Rd^6}#ui@(-dOtUjXI%0gyPO8Jn;k+zpkBXozTeNZ!q>bsbEG( zU+9vusuLAi>UNB{M`qX&((J#z0ny$;vV(9Uw~Vd8Hr^cPw)-_vzgzdMyFn&6`|&nR z`G@J2|K`J(bwuFoM>A+8lnrFt#7d>pzhoyra%LGE+{w2wx^5c(?>6th6oFs2f9vSz z_>Jk)r847t8_S1fZMzao1CAj7SK-)y_dDkf-@=+SWq{f($n+FQkB>>(wkuK%n0RbK zwxY|8d!m|a_DJ>g5SCOKT&XIOgR|uP!a|@zf)KMp&yl`RE37Pa;y!anLU8 znoGLlBkEjsiQAAePjmCjqwm4FyoK*4<=a*h%QXHK_4g>M)ZPQtf1EWkZUr4)JUSBJ zkSFWpAL*9*uH@KF13FFwWgk?a@F$Qi^EFz`moc-ULLCgY$@5kUWf}y4zyr~&JLGcCV5t>2R56K z@=iyE-T(ZY2S;Bk(mzf6K!d{uq;0UU^>ba_vs!FsYV&B3Hv+iss)?7YF-xBY5!Djx zWN}lOeLe=u)@;+%{&eEGnhr1oI)z@WdFCBmLuMWkuW5Xk z>nMG@^nm-`*nZj8C}9XOV}}5tgsYAzBX>%7Xv$S#-Aq8UouLirgzM7pR!BeUKACEl zqWty;Rkk@q_GAwq>F(jj}~iV zm+sUx81N&uYftf1Cc^dF{y-9qN?MQSY(r=@9DCo!(HU2fT4W=EEj0I>EB5kqD6@st zDfkDXEO;$IJGlf<`}kI77o{bPUlFI@{hhebZ$}<>=#(tAQD1L1ByCLV+j&Tum%pI5 zG5nLTB)HT8N!BR&tNhy}5z?o9!nme6=a*c2hqwreD0LAq95{CItLjp*lVfSS^gByT zrD@}6EDEKt(@}R&<%bFB`yND;v7|Y--ej9FB6QC|H8s_uN+(Qnw6*}BctO4O_VQ=W zn(x)rvWuVd+^N##w-$zhv`-T}V*Faq<`mM%9qY0DiQ0BVr#vbHav+S~g>J|#(Q+Hb^Tkb-KM92B1RYwon$cP+wUaXt5z`em_~8-#xFf%CN|;J0E;Y!n6rf> zUV>rsH)+OL&K2iH|C=X&WlZC0z~?c3ZruX-gUjBzIQ@ zFC#%myao_ut7}>X>MdM(1(i1zeHx|Z$~Y$&=W4wz^JExHbx+wco+w)Q7kJl zPuJiXvL?T6M9`P&stNj4c4xKe^Iw6iLjxO~AKxTt0(fH^s7}VK;F$*cXmSZqpy9&V z;acM%2cx)NB#xHD_gVSPtX=ZOn%bpto4X9wxr(VHzMVd(x;^Vi$61`1UgY{t*~CMd z4fQ#@3TGPktVfr+*2_|8q(AS0nA& zuv}vDcHceFXh~Ic9BnhiDmuMq42ITJAdCJw3TF&n#sx58HXO&Q2?aLO5G+!qdq%X` zWwlz`2IVD{jvIY0buGw4R7t9$Tag$G(<2H4k%mY2g*~l(ZW?&xCysX+>=f{jk#f^>8{;gl6mrRY)|$!F#Ze#jEHX;pN~XenvFBfG6d&{ z@%fhCBbgo0N(}U2v(7Ex?viY|l)>HlHq*lGjZi zLq?@p`Om&ja%yURNgB;_xuSw!t?d0#ywZ{S-U|fd_|{HoR9pn10lfsQZ~GmPiBjaz z7?x&#t#i_CpKv(@p1Z8@)s_!ErDfBygwl%1M*Venjc}YeR6G#}y8XhL$lNf1XQpi&n3!8{R z>(3muZEK2SN$I(3n^meJ`|Ju)6Sd&J?I!{6`W01BMe3mXB3c%>-Seo5A&Z6~*`(>l z28wz@shWy7c4{K{qhhcayCb3rut(+7?{&mvgz?L|w5<9MahMcC}&iT>@1xXB7Xl1-jRxb>V_B0v8BA(*ylI;oshipk}IMqA}Nk>{JQWmiNyc>&kqLTup5HeZfI= zmrO;v`$>Cw%u#)fn2`_n>XRfb8Gd-Wlv#y?(fL8%UeCux9w%dH)bym_udxC$=n=ON zu&YU^!Zl0704amv@%^-@9u}dnC?ASC#co{P8&l(3T|A!qu=5-o&UW-F|KOkzsV&dt z1@J36-)4Vwe@6J-67c+vtY{6}_j*A`TK^zfjqrwE^QsoXr62DYbzJVOLAA95(DSQ% zAcZych!}hiqqdwH&&H=wwY#Kt!#A;b0(Gt6SW{x5By9;WerR3uIoW&JmOHVoObH*z z8SQX<^wwY?R~*vG%DxP21sgpjxd!vFhCxijQorFC)>oVVwx887~{&|LtMk?>|R`S6V`w~nY}_4Hykq! zVbIHctL&Xo8&l%4j>F52<67!N(x&N8h~DE5L;NofSp^Ux9ATJBC+m!0v-m~o2>$Za z20i;BAl_I6tj#CVe(+ejPCj&_aa7^zZW|kO*Dcn=)?tDw61RD!C$8a>M#aR7?x+d4 z)RVkZ=opXETh$jzMji65px~G*Dn$cn0rVDLS9<1%H$AG=Ka!u~aorbNyWkz+R5@|J zPd>|=2;*$It(~60dKiZihgtcLyuqJh9nRd<9-%OL!hFS{hgAGIDpJ-4F0pw2{#0`l zY;LFk8r~f&f!ywZn({(wDC%%?K_Cln6Uf2VdnUb*N0KiNR&k@q@g@(c76* zef5!mZ==R$&R&?t+G?Z3M=44A;Ng&FpzV{Wn%z$95de;V7%13|xEXx0#2=gIG^4I# zZj+{?G+V0PYqf|M)u#p5WeNs3R>MEst9f3@wH43u-2meiFR0_Kq{frkXkTyvSPK1AO2n!}5^j zP}+8viLtRQ)?<)Z6tPoe?I?_R&XpQ_3(eJ3FD$k9w)~y<(1l^EZUSyUNTwIZgbR@x zfIVC7=)C&zTd@4JyR9~%A9ZLp{_Ij6Bg2vY;xlKvx=sMk(9jsK`c@s#J{p|r8&m(X zk1q>P>l*V?BQKKOa3lCOw$%8rSQE1nT%p?xv8a9Nep{rVJGR87U^8jYTw+I6r4x4# zX!y7A{C2gp1<^6@1-w^gtXC`|-y5TvH96?_>K2r4!V%8Rk4Wv5VFYmr{sW}wi zr=jCzQCf`k!NP=jtbmWwTzy5`NeCpnbe*Ors6t&?KErU#>t*DHYCUwt^cRRAUz8@v z6DXB35=ZaPr(i&8Q_^=M^)xH;*uKWh7SU?wu@!^F3A0% zhEO@K!ak%!^GpFEizl75Y}5exJ4C`)hJfg3Z#xDQi8PO00vVPw>HZQukiPk9QBL@K zJVNRqW9H9_rSaUn!W6#`CmI5l{7&dCB0RnGxyln?whyOq0@* zyrPlV)P(Hh4AL6 z1FOZ*cH{s9x6qCXAm?as@%@(;K(8jE{LyVj04Ok1Eq+&Y9FF%A%o>S+QM=!u47t-f zu%b?3O*HtHy(6H6Ya6qn7@m@T%lcTp=z*4y!C`AZZk}k0VFXbhL z0oBea+J#CIk)l1vOyz zQQ=gKhs}<+FvO=)>&zydMIXpiXuuSt_iJ_S^*~4fg05Sqt_i-*kR~AS;3?p>`f`MJ zZMU}wu8HAL$#o3~SER{@0C8toQag%n$;+6}iw3Pu7nB;(gc%+y@>PHn=kHQtKUuvQ zap#sV-7n@T2ia!2m1f~9wdGiI6<+KQRqyr}01O~uPh45c&a@sy)h+j5#+azLe$h*os2S(BFaUDjk@ z=x^QO@ilJ7Kd`~9kBim%K(Zeokv-2|9xcuB!`T~QUpuNX>J;JIKh_K_#}1qo(MwsO zTn-D}>KqTf%nqfe_8pM=EXqs?*M(z|GkC9fnyTbCqraO>Af0J$u4w{`qh;@xAshvt42m%poHyN6Dq2$RgprjcKA*T zOFxA6sN<_j*3F;;W=laf;B(qbc8zFexax4Dw$-C0N``0O3r9Fs(imChaVss!%pEI$HN zX=lh)w7E#$^A8^VL4J>b`L>S@sDw$CUQZ5W0Pb$6SI^tP~Nz%>TFZq~AXF${DRgeb%P*qo7d*r3g4~VcvS#5?e zNRDMUpeQPrA@v_axxyoL)PPdnM8 zw6N{FH5XJ7CkX(Pk-Kb`&__DEZA1f!r8>P)G5VWM+;AX}tJu<`>Le^_K4jVFF}_yS ztWHsT1#1Bs2Lk5n6Zt(w{3?!j6_8&qu@5R^Uw!gy5J?O4KS1Azaoo)0N$2mBQdM>> z#L)pO)_W&ekPj)_RV$CaD`^EIL;$>$BtXXo)Gs%2pb95HYjYt3hKnbI30n%S;hVC_ zX7@g^vgs&b>rJE%6xDz2b&*Ig?}v>Sjx+>_^H>Z6Y>sRg-0O!=t=e&bmYDWWv7)Xn zpy2-oildFy{@$rAe&_bMw7|ZSZ&}?<@;-T0sM&Whd$#+Y$lA1Cf$3o*`C>f~B+1EtKCGN1!8w)K%&V*9ko0`^~%d(wI7fytkKifRaNr#PZyRGg$bW7ZNg}jz1lOa#bNaYGxA-~m^j;H|!8l@2dBz2O~J2X%<9Oe=OR3w0JY`R#} zCRJiZaW3gPpITZ2FgSobYPJQE2Zd9NmA(M!;`MA*pr^&}RQ{(U#wYKteP&Nd^Hi8! zPykR-fLH{!AM1B(Zr3r~m;}`NxZuW255`L8WH3}zV;D=US9GqQt8{!s8TSqank?DA zwGRSXj;Y#3p4Nt2o}c)tCnk2|e(+A6Q`rf03c{VoYlmtARPcem5H@|a*+!UkY9Uk` zaFma+{20RA>o=n+w0dmL#C1oKAKpF(DcFPNy$ety_R~JtHT)yM)6amQTi=CMc0R{Q zS3bI5`}s&1PbJhD1fU;Y5SV-^?#_^~yo38k3(J_x$OM6n1U5cHUxMQ8b9kPLD+Gcs z){l0>BQ}e2U`*h4x+lJRwIfNbU#WavKgwM^>=%l#>Pt2FplX0`PREA`3W$CvtTr+- zYTH44I5I0X=9CX$YYjY17`);}Dg?1}qKFB~krk`@2-6xwx;x9yrsT36lw!i-N z9wk19SB)T9JdBMk9q*^1a}88|f5Lu+1B$X;O!s2c4sgU? z6F8gEW?g0Jlk4TJiC-e@;Z%Da;RC5!C&CK^4=|G=97@mwX#PBPfTBy!%*nGdfI;RU z=YWKUZ&%J5Z06w(S7^-E{GU&Q0Wtck{iMA0c&2y4(jip2{%BQAxuy5027t^a?SNpb z>tZpj@=W&n_sdZaK0UIRDd?`^aK8^{mn^@9G+!VC6{_ZRdZ4xfd^Cp!(As0)oKmGs zQ4c%0OIrEz9!@?$V|}3joUHicf+TByYT*3w=+Jk@ovdTy?)`%mk(w1j!tOzCITaAc zZ)TkakH-3Y)l8sj9O1&6%6Auod8|Tp18DDhzSaOJR088Oml+?brxUxkt6^)N-)+mK zw;cxnl;hb9T=VONjzMAn;xklzj1BE5Ua%xs+M0! zkqO=+lw#l`WnPW+fVQGYr9b*ScJh}irPZLMnwkour#Db{#pKpfcWq-WL*IS8TfECU zqJu|uxVYsAzqKNtO$49r;=L;oC0a2bU!GYnynQs{%y3=nk-A5_*w1q3emwE+-S2hS zlrXt2$NTJy9i>EA+PE_1O+arw<)ErW2sXti!5q2VCC7;5_n;VIBZi{JeK5-0ci$Qg zt;VSPM06HaE6~>|s@5R{gn+ugXD?^FkYVvu01@^o7Hwg(_PTPrCqy_h6rUELp)le5 zInZc5fkliQl%P^kRuJnSJ1~P57_o^&rJlh z*5EC9DdUV=h4tF`^(&#lHrXdWLEVF1+XF=?!w=M)3P&K@ro;W6GK4uj1*t*zWhFb_ zIlpGk@D8|-$fjd>I+&YAh>^DxU~7U!Z2`rVGhymImn2n%xBc zx!B$nq{Y4pAw0WlU$VxpCbgz(gUgbXY&L@y$d`(y!g@AM6R>vax}mFHcuPt%u}4E1 zssjtD*)#$q)ymM;WLa;#Ncu-(Qv*+`x zF1_cK_rDoY)ETcT_ZWo{M;Ml#71wi5+U59w6f4L{@i{_ z9ZlG$&Bz4%s=}#a23Im-%a2ylr;ize(HIL=>po~@f`#AOnyh^v-W0~R&L7yjhZLe| z^@?D^7~<;HBlilUlsvT_VFznY)Gib9HO>rHLeWyVUP+6p!`B#-_vQz3MiA#gFT&|VEV5@P!Vj}_letq>ynw_V z+o|8&86^+hv%c1N*zx^V%BaRSJmb%}+ZgcDnq%gV?+wqWZ|^o@{|u9V6Z1Hof9dHw z3*7k*PYIFub}7huH}Op9&L1d8cK$G-1O9;J#_Ak^lQ~H%AM5P=NC7@rzsL|u!$zNY z^d)TH`V?8eYh}C4;pQhZU|%PIs#KHbJO?|eL{~vAd9o1yk^$m|YSU|B+lsXm$ktQO&sf?nc zpdcUwh)5GcKza?a0V-`Q6cva_Qz@Y)Kp;V+NN+;uks4}33xR|r--&ZS?{}~De)m1h z^DX}o*Gjm^mFt|n_u2bbDkjj%)is6TgIIxfdc8MnZ($R?Peu5o`aW2jawEfDQ4p0b-EO!R08)e$X9 z*E6&2C*mxc%aeop`xdJn#R`Ov%bQ&AT;Es@6@Kehaia(QF~#L`*R=Bne%~Jn{N}7c zAh*aGZMW{VTjVy=oxt$0d^B)kR)N)odhbsyS;qB^6}9O~*7K_uq~`@>L9iKPpJWwc zYO{yxBREUF0TbOvo^PFyK+H9a9+8>=HX*0Y*FQH(`4;t;P4d*PBwO8-DI2MoL_liechYzj-TJT=!HEtdTV?5SiRBL7<&Y1cXrR( z5Ch*6(EY}vHB_=Q1d~hq3VvFlt(RK{sQPc(FeMUY@@(Do65H(fL@fP)eCl9%>qzAv zv*ot(N)W1))%h}7(wDaA9`9T$*UV7&;#WSi8nGzRT(VWkx2r7i;*4}iePBhxU2)<^ zDd*|RKMY;5G2VfS9h!NjhOLG2_=J2sdQ#j80loGz1Z)}Q9?ReN&N6eTO#}seTYX&) zH5-=VB7eKZtl5`lz8N-Y`<<=RFN5}4Qa@cff{66BQf+KHS%|(#=|Uu^r?Bg_njty)aWm(S+5$I~Wsrj-ZP{wm$-vI1 z+wPE1^JePq>_B;(8(p1M{L=L?JtKzY*Q;uzMXR~=AlRj;O(~AKI`o@+#Ym$FSiBe< zwL%Ig(CHB}#<&MQ&ps*PZ#$_?^vkh84bwcY4ORHtmr;g~q|FPye7CCs(8aZ9OP$Q3 zQh6KF3d0InIb7S_=dCyXoi(;%YV7I@CRtBcriSJ7aI1yAqXuu|D`GlfT0FOHLplPz zuLVGNRfumUTL&6dG4Po-CbLYZQcIu%#<@ij?xDvGAIQCZF+}jIquw^%LQj>n&7`!KWQ+UBUt^5fBxx*K{5TN+ug^Gk9FW9~ZFM!2P*WrQ@ z$LbKTbe?7;*nYZ@ay5v+P3M-^2M!p@Nle3x;4gniNC5D`X(8*|52iZOg44dV>oV?! z{6IETGEYmTKJa!8?T%FrToQiX`WhqPWdZqmo2GQF&v;TYEp0fo73-N@aaW>|Szai1#+XtnB_VdZ2Av$mTFM3Z-O>4#+)>7>^ zD{jggNz#}}(z#-up}@UeaCh_CciU3yAa@Y6DSe+X20*%tUUqk`LJD{BUW z;rQ6s>t&0G58(K<;%!gC>yql{HU`)Jx`x&ixQ11b->_jZ_$x?Vs?;PK_N`NS#rAzh zEt$O>sHjATrdhVMGw>$jv&<_xIaFC%;>+M^1QyJSO^QeAU7HzrOYxGS9FdYupbB>G zOSE|a&`5Vbe#dWEo2o-JoxPL%foAG66>|<@bpmv)0}m>SqXkRiT9F#WCtg}OYPR%!1oQ=NI*-JxOgk~&u5 zd(}C{ENiw`NBDrt=JZc)uYv+YmIiC=FYG*a#=VV!e{I`CZz;apl7T72E9$f@^@OB0 z{{vj@{};;gKS7v_9|N5Lz{-uk@As2cT;{*rn*48n@eX*Bl79}j*a~;n45&fO z6Wcd7Ge7vp4+=bl#>OT98rLgQ-c(EDpDa@D1<%5S6LsO`zYuyt_qS}KHU7_^!LM(i ze~BF}D{F1rOdtOrzo*#mFXm(}>*yQ3fBf5<`C88q{?byIboSf6i5&dTKf~SmtpH55 zb;F8z;SBQU{Dshe5tiHLcK??h^S^(ooxuaNZ%WvaQ-?S6mHy-Rob~1dod7_tcXz1& zITB4hiq~&+7~O}?5~5PJ{PSnHiLG}Ad)9Hn2k=;;=hpuB-}HakgQpaCz5?7#VTCmE ze|gvckC$3xfjTQ7Tn9cC|2e61k_Sl91FFw*b=Zp7KaQ9GDIfp)YU9S#w;X|=l+=E; z;_9wgf}}7+Y@ho%Ng?c4u+jDvcm4ZaZRXB5^`5h{f{D6_AaDbf#J1+2bpwq}O+0HQ zf0q2Ddyp0SOXKJn8ujs~NLiib+jaG=uFZWYpQYBGpAsvI@BAyPtubC}{+z$?=h+Jv z03<}H&`;#&4Zjo6v#B`Ue;>5k;opx2KU;nb{tU!nd=>Tlat&Ko z%_lDaw43il>rR(RFN=C3o?#{7cu#l#;XMm)Q-ZINf=Q1Smt@h7=)Tru;V56CrEGAe z8;}dH6=>YlL!H#v!fmF(8n3|tisTIqks;yjiq6fYX6NKQ^Yi9y^W02+vLaM1V22g7 zpZZ_iz&30Nbve>nR(7vMiz;TVZhJC)A$Nrqr0{KyxGlCdY&9E3_}hNGw9|6aM)DVKpKo6gY{G_Bo?s!!-T#upTsi7X`^s^^+#*cCY~_@*9QK7JAE-L<>9-$Ei(qjVftRvx^k*=}H?#)WZYdhq>>?eF9Q5?J_F7zjPWdu3 zU;#x4a%UI;a|P0dZ&Dbri8ccK|q(x4Ca@D@p}>yA-;|0n>t^>F*$BCe(UeozypmF zr$RP}iwjz)`dRzTn%=f7Cj;A{RQ`gV)64ZevWfzg@kt*1De$_~Rc4><4UNjvLbd^^ z)+c%|Uejgs2-{liqz*W}mA4;|^oSFm{Tv|~9U&1U2ZNFFY<8r`is?#*1{&gHsPXr?6AcCFX4M)WzprjCLf477y*T~>|;A>7DhZAhxm2It8T$s zy6xvmJw3rAc1{hIsi6Wb^T-F=V%~J87Ek>8CaC4jLp2cV?u{u)G8DSDYI<}Xk z+>b@k6CNa+1ODA?9;@hGlZdVmtJiHp`FwazaVKvW%M$p%ZX{kpMfLwV z52$J}_^&`6(9iAkNl_(4+hZ_EFftWmXOHnBW@Uk+(Bqt@-`~3R z{$9=0UAyg|&FFpE=dHVNA2GV{gn){*dsdx`AZm=SA_tR8=9jy43;}Oy z8?YP6KcwjvfMM2&>e~Ykw`Mg#34<6hL47Zyv3g_@-*0mV5J6~h02@#&Zu_)QhYYXf zx=5f9sxt95m|)cig~;aJN;$B(^vkIFKaY6SOj-91fRR5Swd3lx&(dXfoy~!}X|_cw zRvxggkBMwe)~W~WOflKq(h#BaTM*7oHLq_|0f4|+q%_}O5=j}tO|*97dX%nJI@OZh zr^LE+3MNJLnt8PH4zc_P6^t}!Icp1FZq!D6y1`x@a9JFURIJ}2854yjur*Eo9M*)P z&C;Owqb(D;SOW)KFtsEYU%pTZnzI*3cu|LQ2*B)g1$@7J5Oavfh9bc*B=gko&`V^a z)K^qIlfWIwf%5U2-Vook#0;)udxr}En-(j#Htdzv#)E_e2IA?5;&8eyhUY?K5yEc7 zB68s#{t7v<{5SzhIWxsAQ)X^iI6~s)=~*zFy=3=Prb;m^Ko?j?^o@RhVdS@&^t!Y8 z2*}b-XRW}fLmxmL><}nWiMb%4KST>V^|sG%qK}P-KHy7P|8NdWbu2UA5%^GtB@H|V zRiG-6SWYmNrM@`cRb*e$Tk{KnTaJmMw)RZEMcYTOrVRVexzJt=C=AC+BQ^{xUp1o`nN*-|O8eMx} z;Eat)?)*RHRT z+R`S<8mE9Eh+E~-`3_jax`+-&V|&zLWd$ua+B@v1cLqk_djj>Xho~AQEvIy2NoQ={ z|6&byV9hP5fSaLEWia|+CGgJf$9gbcB-}`=cc?es;wSTg3LXsmmx|aiEQWjW zIlwef;B(M&uew~ar)ee+$DRZ%7Cb`j36HS#ZxTUM1vxBkz7Y5YYfqTJ60^8)ELOOh z*(p7+YU@9LC^?udbM_QZzj(;k{ho_q;ty8 zAd%N|t2+Zp@AHFR%PIw(&twH!RkVmX1>SN=#aqIR^^*71k8eG=Jc5uZMiX7LYZidN zWbuMW)uJ>p=#`WZRBp8wLADw&nHXahH#t!5WmS3NXON`jWiE13JYJK z)J4!IS~`2nj#N=+(S(MF!<`jEHa;C2E3Vp;112Y|MU+V);zhdl^{qP>fYIq*E+#|% zuzzhF@d9rgZt@es;fRw|^q#@XsqQWii~(J4ZZ^?=M_g3Jdi+2k%TPgA4@h9R1Jl6- zVET=2{NzW1XQ@vnLN7$D&KI!&h`R1Z{e~u=sGP)0MW`=rkL4k|emyX&zB2&awYjPQ z>$M5CPmjfjB~q=H603*vDrU-a++RkkJtHO41|D_;^%cno)>7gj-HqIUwUK(mts5po z9!46EPY(*fC>uso7-C&JBd&Oe7 z(!Hu1(K=VNXE@W3pN6d~VD2WIFAF+Cir=aS|N9Ca^i3vuW| z6FT5H##Z(T0G)KfAK}4y;tYHI<#zCJO&q^|V8x97;FZ#Qb3o!#_}g6du) zpU6OwHZWq0xMmGt#wC_q1DwuqTYyGq>x7f-?LC9=Ok&2z^LEU;TW4hosjZelZ7) zv{fW3IIZVZ6^#tCR(#A0>mvJtJ_OJoJ z83Mu@?7R|{3keF5e-Okm@-9F#fa?-|TvtqE%vz>*0jM%O0d=M`iwk+21Bb~_k=pR} zN9pZV5O&bDQ0zjfb(`ZcgrG-PmT~O!vgPCS;^ zKSsxoBxM`AUef=@HCJ?rfgDxKN_t(Akzb$e*Pq%GS{pYZsG*c$r)QpPu@^7W>n8~Mm@)MQw_uD1BuBhK}E`#BQJ~biq+is4mvhp zQ9|ArV~8y&p=Ytxx6 zVzm0b#v@PycDrZ;jLaf{!q?_oKlu(w(WYZ!)3?e>&i2I%{jo<}Q(G3DU%jM!Qgo5U ztw;!Lnp*{}=gFlBABrXXTA5RkR=s75bV){F7Q96z^w!SX%_pDXX;U4!cRhM)Ic$2R z`eg4p%PcbsOARAE*0|N9{n?U^?daI(71}!aE-p>8%+4SOATM8LxUvbI(c=46oqWDeZoJG?oxbYg=It)cuc^RyBzsloW*@y8aslv# zT=y(6XIqf5+@=~ScOh}IBX{6*SUx`F%i~=KmujafZqM5}hw)zs6EFe6om^uNq%&@6 zrIpSVDnHy|`p(WC+n;A?O73mGR~F>{Jxeo*n4n$@&V(Ctp^kdqy4>bV)A=Luwm)U<0ch3{Mwzc$;)Mb z;spvV2UI;rYjVnAM5&qG@EmxO=B75FX)d`>sovdyu0(_Z`Lmi%m zD8UuqgoFKN@nblc;eLj^iAVNLI)C!?vYJMfVl=!J{#MeX@B0`3Szuu=p`#kUM^xgi zd*O}TvGBb}*=%EkXpwx`_<=BrWGtujy8B(bj~V4cbaM0}Qj<0(!w!kzLafLTGIKbb^0Z zGm)^=2;=HfyvLI8deOGoxd)oY2Th&~g4h;~Sk+M{=>%W(ZrQOfbD?S?foj=lOKgo+ zW90(DDlBz-2PmD!cIe%bi3dDJIR^^p8iCS;_@<;=ec^3VOz5rv z9CI_+>oTUL!tOjgeAF3L``kbhW%Je{XktRR_P~V)UbJZRa7wiTvYeg*WOd3V>!J=r zO7%X`OZ4<_gNB{piEzTY`Nl#-B`>o!jI&!jWnQ7^>KOZ~jBfbp&5Vg2l!J;m+tA4g z0f*H(VS1p2c(nU5aC+*$MY8Bh&w%wWG4Q}V{Dg*X!N-uo}MoTWf3Y zb}{@7n;s~^xQ7GA48k&rd5riO?qNSilcY9(6{V}wy3Shn?CB%df!3qBWc)mVNohWd z>GnG37d;e|i*dF4ny=aV{QRoPFLwP)c6KrWxd0qoRKEY%aEnAXk_mh_?|hx*e6&sG zYlq}rx3G9OsO2lR+)cD?tMi*KyaY}wB^}86`ND-Nf#C!UkfU;lttE9@TW}P{=V(@w zFBzG}?5mN)P75#N0Y1fwS32%x6O)VN<+i8t*j~9HA8LFUJtO=^+4t%hh$$Lu##^in z-+9jM3BjUFAV((%z4qD!hD{~$;Jf=1v#)Lmu9xt?lWw2BfCmWtcfrz=x>yjBb~h6{64=g6H(Ly*d+NqwooMN8h7Z^)00KlELpv=DSOo0e!n_7 zM-R_MB`0eTRaFU20M>R`6D0A$sPhyY7Xj>GMN%7!2YYp)Gtn`1K98CWlwF&&^fzG` z`HqJt$TwNh?-qRIB1$RxvOPH-PPg%I%slNm>a4Vu!gReln*vP3zr|xhNH_C7e0Ty* zB#!5-k*rzL`%j7O5*=X49a25QwvYrhi#;TPnxhxS|8rPE-8T<2jYHfWOF?;FD>laJ7!8LK4nk65<#Wc93X#%d=LHR|j~(e>$%LP1N*t z-JnhOx0s@QqKyvuxbBu@o2!mL)Z^#^+<6o%QSTx=R;EUYrvYf+#3`+7wau_7IFE}v zhqyibtp~EP18AB2dI_9EoJXb3Q8sPGTSaq_fgRxU)uNH`*UdKp7}@vRsjMG72{fbf z6*L$$zoUF(x)C$|SUg(cb&n;cP({XbJ6w-CUna<8NaS*mdpdY$D<55&hvO z0#mC%oFq~&CD?9bEC%T`&+SlZ`p(=0S}WU|sGP}H%3~$O;V08zURey9PC%wFdc}IS zf0cwp<;WzDC0PTp3wos+CtJpJv^r8jRvSGt7L3OEnbU@YCC97xQQPE9YC)16<95|z zbyppFY*_>DxOoAaa=8~gyb>W(`}@2N5uNKM`$)COvZJDfEI+-NFrk^GI5i5+ZZ%+* z#NMwTQF++K^9Jv(f2SK+2Gcx1i}l)Tdzv?~gjBZtuz>8J>VX{sQfxi+MQN1NP}f*a zigD0zR4nmjq%^TTdcA*OV69KGP@8 z%hXTGdB=cMMdhrKt63#9bI7Zx5>xD1sxR@WKtLkqK|Ly|a`<;+_R-Fgip5OGSYZ>o zp&!%lwJbNNJg~T#s`h@Bm{2}wec(qSjST#gQI#jPszoOuBsJOO9%2tzKxQ|KBMVch zQF$kuY>I4U6}uRDNr#=cQVE>U)zU$)CdXKO3H-r|<~(Ib7%Tc`C3 z(>ZrLQ}rXbY#YHJY#XmmiULoguX{2ME$9I$S{3)ouv0by-rT}rTb zr<@|2KU@A49~I&ij}RGH8#P4N>^II2bK%JB4~!5~J>QHvM~9KL+IO!^pC= z4d4+SWnO^*v#Yf)WylyXyiv?kkm2}Hb&iHD#KmQpDXL%v+_7L9j&JRXkEtYWAv^)8#q3bR!*!Fh z*8R_#Vs*7k_thoz1Iu2IxgzT4kBRVFvLSH1SJoh$SvjAqJNFM^hn;KMZ&d$vaU z5}3YQ?lh`kQPnQCrRbRWa;yBK(Xc6VmhX$Lzi|R6JVj!7Fut?@?rG3dN?3Z760kI_ zZrAQn1X~y%qfcb>#b%)vnOs8jQE_K*YLNfd))XdiKVVHUHdpzQ7dUYoLTYm65+Up% z@7^a$&)JV>3Rd2i5&Z&zJ|UUi{Or9Rwy}`q)8eJ^dODa9ALf+F5;(2_4|0qW(>kIR zLqi-k&fWkNm+T6+7F8F*UKiDV^WfXyXGua{-|rOqk(P@Cu6qZCkdmFQispP*2ZNsq zoppE2TCjZ|XOl0KmxvnkR+^4|m?k6^X|M~XZ z@iPE4|AMdkVHW_)^AtcDJ_6p2l<+5>tUf^T;?5nRK~F)wTfV)3A*sb3U?mWwt(F=1 z4et-@w*)6tWV<(W;0Ymd2{wv@9}VX6`>Q(;Bm6g>^Mzi4ejHS^@VDbg{9xFS|6hhp ztFDcTmrj0#*;wyX!h&LKZ8qA1t4+i_sdr0*Z?fraI(uE|f4Dv- z*tu=vh1LEfE*ilP^pdVktl0Va!W+isNGw$xX$i6PIYQ>wrN?8=+eu~uL(31S|4nC`S-);cJm*{RK+1Cpwi@>%VCoraH+K|1G7vo z$x*G9k`6hn>WSYF$?gK@%r`vy!z&eEV zI^Ox(q{b)bg5^0oB+@!r`3J1@ioBKqV9N9ayX(D0iFz{yUDwyw%Q}`Oy_ttugNXy^ z>rHKKq;rtr5O>`)`T_6d?)A{g$;uk~n64VC8xTg;XF~M6xr7lI=T$eW#7(ftTzC_6OwdiE_Fk3<&nw!xY` zMLX$fv2_OJenU7#Q;$t}f;_;3U_r+oV+Cf82tRtzA=--dd$%%65lC>Z2-PPxrLw%dtBSL_Xh$3jK<(9sG z5%j=MtJydhK9GsHwA_d3IR<{hD!p2iJ*ZM|>Pu84!PnXoLVM#(88$o<3xnx=0{lE$ zqY9~lHF#HdpeM)y#FM`+pmi5qpzc_(Vh8sxwDtu*out8|4d}M-RcuQplZ)sFT4o0Z z4M6F3Q=K&knjYVd&x454^~bgOt;_vD>>D)^r4qUaY6&6U__mob*uKQDv%ER3Zug+< zdoqLWVS@2ZRMjSXhQOd%XuelkjLnT3`(<|K$v{A30tlc5s|MZWJ!S3NEqNx$S|lH6 zZ8$>rhyyhkzFLuN4pbkPumYP=fz62-8d3c(PIB zfA!opvEGV=PBf_ikMfe|=9}u+{^Q-d&rD<6mQeR!f6mpf$DTEF1Q4vCs56_&ZJX+j z{CmiFZ~}co_&ZtmAOGU!LKThoCICAHJ@@%3*MFd@_?Jyj3yJ5KO)Q3g{BX~{vwbk# zl?f2(7MFMYlqY<5dFuq%^Q?cv=9ixn+-3xSc%E6HU-19)``^SzYM%sbOJLDcvX1*@ zGvWN7zvtV(=u@^*;y>phxBO)v4qNu$^2^V8%J_4sQLfkjn`cCG5~f z{Hzq74LP1{qqO7iQwK}`WML$z9F%&DOJ&byb|7>+X{e7BID_sk@^1T_gL)m z0BnQ1#7rLTz)d`Y2O?X!lSwWFP1B!ZopufQ;CZ8}R;Ih`zy7H<$~E}mHqFefJi~h3 zilWK*r*AeP$jIHUMN+pBB)7%GSKrlw<2TH6Nl3%)FUHbyzXN~&$HM4B(|2Vv1~0zG=oN-~WM8SxPVq>QkbSdYn7j zoa!d7Mny+9@l%I?+MYWo#A*~!bb^w5S3bs*laV)~#OXKYfUU*zR?C4^t{@Z80zBkV zp>)PJ(D#zh%o$`3j?!Py+7EMDmQ_?l!*7|>xq?4k#(KhNavhtBq}I>q%?ZNt%7WZL zhy6Xk2KdHg=Z*kD*BAqd;G?kq0+L@rZLDf;F2r2z|Im8MsxZJML>1U}z;Y1;Hsft6 z6GgxHh8(HbnosS9#Z6&Zn1Xo>1You1S4}fR#6eH;b-;QYv5-t}Q8V?XWY=62&65mf zIbiP+-CL2iclFU0xyHp?;uOazC?CnnH@G^<7%}nLT&%laG`7#FX{zw+QI(j5_AjxH zbT}HI&-M9r-(3v$HcKZq9gEd{Zd2rA90S?}j1^n0p4OpQh)3mx9~ws~K}+Keo}CTO zHGGPA>$}G2xIm>UMR|v-=sq80CbQg|%ws>~+w*LX+AT#@Qpn5dWs6Pa*i(u>_y7R! z3pz2mNK8pB5U~ioFh3aN+Y-5nWe+mqh)1Q()N<<+jw+Z!%hzbA3BUIzCqLq=Hw+WN z$Kg#DhR{1ClKEa_AAXVWu$k@E5a-zi<(QxLTU)>$MX<(VaAV~#g=jz)C{Nd!Pd`=4 zo%<8XD9eG&w=2<8rfHB6V7%nHQXpM}qq5QM>fA|M&`R&6NHJ94B*}BeV+R*Cz&F2M z4FsLycz&IvciHnA8$ywl>r_v6nX}`$`?d4Fai(9tyErGA-nF%-NeTg!*-L5Ue(Bws zD&e~WkHOw})x4UqDP$=UHcoDrKza#XxivU4kpPWc@ujl%*6|?O`aX9__)-l#a9vrW z?aF%f>*oyqb){zTo z31$PUgS2}sT=;uVJfDO$SM(<0wRGeEq57n)ykP-|x+ignUe~s_UlCAS?gu?ON8YvD zcr%I(@2>q=0?@@Bm6^hzCD+0+0RPfNv0y1o>o@bPbt65dHlZiGX8Y^!Mj|4|>UH;_ zj6ziKNvD5*tDm)=@Kj33My*`21ny&5O3BA&8U+wg^MY}pr^FRGxu)9p;bX*8K81?n zeZ!#f52?fG4WHENc?5(@f6T*rz-;o+y}{=ytU=aqzEy?tsX{L5sX8@tB87Qb8g*mmLqp=6!CMazKA#zZHo}6*U`P}E z`J`vvVFF+J= zW0Td0Z(mKD3nHLeRzK^$@UT2J@AKcO0dZh5rG6KoZ*)NLC!UAn* zv0FPs2JWWOypKS{?H9f?kI^)Mj&GV_!UbOP+qFJt&#`M*CnkY0aio9~swZCzf5Rs* zSJMA!k<6#?)StwHR;-N5b^xr3C3C{US`;XfUP`6r@N!tBU;umJ;*J3%J*yo7rZtHz z8nzX1|gST4*7COW!hb zwTwIq(EW142i5@V)Ok#60sz>vihD5Perrm;7&9toV_6Z50Y2$r#hGy7ZQE0l!jgyl zm^PNBr1N~ft^7bUozpPW)%sw^+`$M*zk4I?Kx|j*MH6}lOO@~P)$QEg{rO;1-sm#h zYZ{><-X03Q@^CHcH}rUlExg3+s12bqH0ZWal$y`ff?So-?1oMV6T~k*`e&|Un2mp5 z!Kp|y3)Z=nnG#p7)mb6awYOc(e!hfwqByJCpzI!@nATE>ne3M5amc*hQfx-hGi{%G zchERG3jpe@kzeEsh{k?xVIF?X494bIh+Kt3ux>o+k{uDyE?YaWcv|4@V%^-C{ocWp zf`~Bgi~1=7!jC0u}p(e_%3laT4Mo+z7O@coM_`0|;0_Q1b!Uxjr7^ z7C+Bsk`yPiVTdF!=-pVX;48wgR)@5JHf>3Fi9B|&umeZ$_grYBN6w-vbMo9RS@WDy zt>8g&R&Wnvkjto&dv{8QuJ&vre0=LhXHV`xCm=#tI#LF}xaj~3?_I`b5Ww|+Knnxb zp4X27^ypJ9YPody9;7TcpNX(QWLbIyaIJ-~P>{OE$_K@`^4y2OR0Cf&uG9kjMGYK$ zx#XtHkbXK%A0_hkIr7?3Jriz8V+D4AFh|Dm{w{7A%mHuMuc@IS97&HH5^{_ zP^`CiN&*H)!Al2gHcWE~PD|fFW9}%AWTt%BZ7#n_YJQXCrptinaum{bb7Q0;5X!~2 z0?AAuCbogvxqlhpv{tr!SJsmVne;Z_1a)rTTFS4T(#xS6(|mh$ne_*4pKvM=wmJC5 zs_n6_&FVRo^w1ZXqfmg;Cx%28Wx6b=mpcaI9>3~ z-?BDm@~Z%kz@NXrf8WdJXRo$;K!qVKV!sPhqj2)>&8Qo5DyzdPJ-xxv7o&MZ-ye#L zi9UK|e=m#r+A$m#2d|p-cXwPq!6a$Gg3^wgaZ8SI-aiV{DFQr@Y2RNYnIG`>4Z} z5OWmtL@UqfIyhrxdc8ZN5fpG%>VZ{0IzeK8wI9 zRyGg1;sWVc^V@KoY(52K035E8@U!6`%i0S$73+Sbn!T$`Tu6e+JjA2qLLmp>%8rxYlGH;14PT?K{Lq4V zpX&Id*z+5&`bv{S`x^wq#mrSPpBNqXb-%YLol@LRyO0g+ZDp*1t=I^lRb8%bdG7+p zz9uv`hsPX-c;yry9e#VJLNWXRrJ`%qZoZ`F(i{8hb_D%cUXMzeQGew{G+6(Ng2P1T zxM90C(ws=oE&CFO6yz}Hp1OUzM#f~+h%a+vRjt7yQfNYN%%|}c>U_ms&)Le(XBl;w zTKW;80Eq~%Slr&AQsUC}yG!Ui$>TAfLg|_LHUJ=n}JAUq$wjlF=oSD#D|-?FW3_YUz=

gL z)6TDBj_bV`=A06ED>|u9)npxuTI&D1q=;Z+vnZ#IZv_X}XjW4tW8K z-Qp+e)~hCNGNTeMz-A@!y(mxi+whHh;E=K1+@2gE`TOz8_}LDfU9(!0wJjMJhkWUJ zFIm}n73yxMq-##i=YM9*h5=tMJ>fz+>AJPG*qyW1ee=0i#_76^v69W)Z=A|nOP|i!F?GlNRB!ZEC^rhi<&1|`(D1~+imtj0T^ z3+q5QMI+$kM^Z3a=LP1FZXkkk_z7h9J#8}8*Q+-i5Al+@6;99On}+>4GfI|kHeKYSL4YA+E@(HqJ0Bfg;shm z1R|i;Fu=7vr{@{73I5-QKfdF3QO!F~Q)kMflIe5Z)J4`_J%{9h639u}1o?4ntuoGoj(MQ|rd?B^! z>g~E@sNdPSYdcEogd46Ue%gJtJfv-+dK;%gXGLpn>iA8CJ$Z&&ZeaV`wIAN5|F$Q$ z>yruEf6&tyfXI9f?DiilKq`P*FqukFEZ}_q600xrBT|&*KjN6Iap*EQ!?Oq#ad^!m%Jn1bQh)kNm5%7fBIyuoZIBG}0X z&!0PYxxH^?TDe-OK3Ob$_xdU8&{~zt`A|UaX)?0OWd&0ZzgY+MnZ>O}!{Gx8`&FC6 zNE05UP^JyH1Q^LiUmUk^o=_ugc$AJd!o1Jw`htwScDDUG`7~^G9#GXIBoQx)#n-phAUxE3<}Q^_%id|a47o2b+&Ez}i8((`^e-c-ErV2>u zYdP2eh_2Gg)bsiHlQkG0NVz^UJ#jm&HW@#gd(cQ@eNFDRLQk!+M&?=N{c>f59y zroL`t3v~Gx0+PejvkV|HX3?TC8Z%GwN1w?)eqH1g9;+uIGJ2=Z;Rs2_`7w@CsstQB zq$G4}!Y*zz5*G;P7muGq`MGicr$96!pe3z7Y7d7&Ja{CWq_h65DAfj+QSDjJ)|eJ1 z0B6Mr?;X&jxq8@uBU!ud z?ZkH49$k9#Juk`|``aY0d2`4FY5*AgiW_N8tfae6JH{K?rd>W0IlwEsa>aIb86wgs zOsxm}0E>}tU?UjK*iYH-u7`mVD2&CX6VTw(?7h^_$m!Hd^6haE+|Hl*h-*7yHCZhq z+aFIYvo_ap{g&9QWM1cu7^$@Y{MZnYaKvihlU7HpbtW`p;QpYuBq4Oe^UB)H?EaB> z2<0lJ;es&qwYC9)NvM<+9}p1LY+hgAhlY2KH(btlx z?icF5ZAa3dzdkebiK?!Cm{SfPDEn-A(CdL~9DE%m+rBfireVqJ0B?|Wq5aVHe7UN50(^Uv&Lda z96#bu9}GryHt%;~YRidPt!JEBJd3|JHS0QCj023;@#3ZBefh+uIP<&>qT zD2vi5{QBV`i9V9|8h2$p+|{Kq!zf=H^=4s)T_bt3Al@zAFYn_H`OtxeQ37vDq@6Dr z~Tnd)_e_`e<6ezQq1Cl{mARazscR9Kk2^i~(M6vJJrw zIs+)=Oi+~crzy?L{|Fr}z)@=2#W(M7L&w>dLbu9UK_&bPk@jRV=F94Uc`yUmb3HzU zS#6Nk|049(!)l}ypy{P(1s>(TGo@FpcH6|yC&e`h0Ymq6k{T%lf^kV=pX~P=^36J4rHI+nLNi8l zUKnzo`x54!Wfyr_1*i#MJcQjL$*@>kNQ>3SWyJG3rzrgf&+C~59F|6gJme`9fFA*HYIpkS_$?{ESXc>VR)(%DwmT4D#4~=;yk*Wkv0KARqAI!>#+!pykQ~e?P1e!kmp&&Qg;4aZ-I}DnYj(_2?D~FMmm8qM4bG17klB$;~W>D$a1;t{hy`9rc6J>jM@b- zDsY-OR1xnE5W7xRa&!^>u~7@357U_bPl&=JT+D7SXe<}8ici^9*BrN2qL6o_*5+5o z>avduCzZObEk75GXs)e|@QnN%F)bvF%6-juGZLNdlPz<_Qo}_;%P&Mh?%uRWbo90~=A!iO-Ny`Kj2>=B18)P@2vP?9{d=a)MkGgy zEJ!tFh-KKt7EmZScYb+D@g+t&X-S{cS-utoy4n$oq>zI^mMJ=)=`Ki!g(&o#7B%V3 zIVG!jGK^br>;eL9i&29`6s^j&(&*MED~O7#F{=#zkLY!w^}7v>M{o-xpm)hCJbHT zWDXrVU+);tFPmF@zLVAG4E=Dg7c__tq`dCJwDdrn5UPXu$M;dktV_Q?*`HR(*r=98 zZ)gn+-Ft+$Twfuih_QpLCZNEt?J}dTy}FnB?E$N(pj#fu?H}WM?p>yfdX&r8Trb+l zEiF|S7V?Lfm( z@h3_Ce(jC*Cwa;sIQD+w*P^@*nb>h6e)iV63qk1rhqm*MYXa-mwO#300HulwC`eQ3 zO=T>ofQmF}BE6T;Aw*O_MT!)oR2w2S^blH*DmC;Dks4}33jspH-EqEi?wsHK&YjG? z$A27ULfUR?uk}9fddzOdebS(Kh(&IcTT5{hF$P#W(Vn&DmiJ?^yKO>#?Qw7uKT`v% zsnOJ}76)7;B^}(_%8F-p=y_Zd0!q)kq)|V3HeUSjmn)KExuqCKG}RX*8v05j0OV zG^ERA?lP1CSd~4c-3I}bX6QlwZT(JuOsZyr>_E4XW2Id&Y+Zrtd8mM|@}0y> z=K_FTVWWx?wKhlt3;J1$dKeZ@8h3s7CnPaNB| zLqd)aff37-RMlq&OG;c_X_my!w2d(Ip{o`K3SwZj?aCw#d^RMk-)Y~t+Nl>i$3I&& zzctUR(=Gp9ah)R|t>&;Enc6O+xf^}^QY-l(JaeV& z50ka{X@fuiJ(RhEyY4gjEh``7qrDXpe9Vhqg50cz#sg{D50*ZY_xtj7yZPq>%Lu#8Cx3L9 z|9o<^CK)|Y^Z;pQ-Nwu{`IP+liJ7huNLsOy@df(n64J*B{S#UmRBS+cNO{unTRyWO z4h8(fihZU8|0Zstri{SCaD%@?k~g588s`;Z?y7`0cGn_}Kpb8~SRs$wdV~4*HoI*d zIcUG?ipOFOxj9{-uGhmx85{W2PNFj&_|mdvI2Kj0LVI26jtZLq6`i}Yo03mm-nmiF zUhfh1(Z0_ZYDdHR9_r2&Wso_Zt+pwUs_&D;+TbBGbuY&+x{b)dZN{8dOW)oc z7Fcry-P0l1DSfszWyp&aO zzoOk5ji`f6O_l8k+l4{r{4)`3L9f0C$eF^d`hC+D)tMo;kp>Z-dD%dk(C-3#RaqmI zJ-lB8xosL5_ah0a{vi%IrCCiNAtxO8!_dm8nNz&lOj}8TS$=aP7aSXLbDS7S{v82* z(+3jel3uUFUf@yW>D;aebX)a!C&Ob`EC_)`hCOO@Wf%#!8yfnmt1k_Up}m|HcBq$J zOqUOO(Qf=_&LbR4u=bfmhEP5~*9|h3`cPt@1izpk)~mUwQKn7hv4;F8mAsh1q@r9_ z4c;lzo4`>+>@(#bmmYr`Lb`@=LXL!a(=)|9M`CH89MsHq~X)VU`5IZ-$TXO1Ev z7R^Z`W?1>uv_rM5k;}a~n_JA+Ut_A`^o_e80qk%k`evmEMvR_8)d3bK;M)Hxd1~7e z6zk&-{n}$=Ot5gHlLkx6IEz;k`DUP9R!3xQ{XN`KKb{8Y!@D-KM_D*yJth<)v@h8z zlkBe~rE6a@xZ4?ylMfpg;l7kyR`3(kO*q0dTK-X>gK&feIKpkLu9nq4m2>%VV-0s* zy;6w@H@uC?a~-iWjQ9lnuEPpxEKJ8Nd-$KD}54j z9dT`OA&h#LDvLd_Q#p1m@A5uE%e+1Ub{y4SKCP?8L8+wr{qX`52$*a5d@FwciPi=FrO^$6HBQsKY$ zo5z3`wsjc^P;!F_T)^7$EY^ZXeI28vo9^R*@OP3~;ePkQH$68bXQnkuIIT$xYbCYO{Kc&vE$=PMG}U-GaFh7AHw~J&G2z2$~#;ep_^G(eM>Co z?u46L)rIEsNdZ0fOUeg|96LVslI;0)^aqBey)~CJOO4j%yKJWByd?V&5M0QKTl)Av zxb9yw-sr6`>I?Sp2o<8INZ9TH?o>uTq|U9%tvoq-R9_`j{ZUqi01$kNnhki5I3vIP%wzPuEZc35(q|FgROj6FQ z=pR3({g3^xURi^s@QKuG^?PP&1>>aK8e)p9gG3!5H$zR1! zRw3-LX8Ls0+yC*i@7_Z^DdoSu0A7Osq$V9g?f-{Y&@}pxn|t?(SyyFUPQ-5+g*o*P zxgRbAD*1B!v)}Rp@x@hH0|omxWEPDU=qg&!Q`q<~kNKdw?^ReB(90kEqVQk-$3NfK z{{63iuw%O9& zTb}=tThOOZ<9GXO5gk*%Wy{_bq{wt^(i&_?HrIcT1H)wAHXOC!c7Ez%eT~R z_@RV$_9t;@{xxd)pL;D$(+|0ZV4Q_vaFdh&b5Hx12%+2LgFHBy%RZg>_sjABb6I~# zXF7I_^ZB$UGxQ)mo_Ez1;iaZw%YXSy|F;EXYYz%_;{8g4QN7(VUm%9L-rqY8T~ZDjD4+#E zKFGQgbWC^7R}Q4Udsf4xyTa>(ZR^kKoOqeL3=3YEpQ^G zG;4_L$h0&CAJwxN!XeQNG*eYnj&%Q0u@au)wm8c2xW{x=7PR)oy|H|;oVInG?s3CI|mapQ;V~a>^ zYw&A{!&^B>t$xc1mKr@HC)1w0^jWlXSAYv~FR7>Rp*kq82l4_VQkWViR}m2!jPk5$ zosY!ap=TO|n>?Dy#pK`K2-w)M=ljXUHE!&)%rW*cl)rU4EckdO2l}xTwviIqx_^}8 zt$n1Dy6VPRUhnNEQl4|&Sxz(U=7NDEPz+_P-y(vUOhCHyzBSvxB)EhIfesAzj?4pL zW;D=3z7Tr_h1k0qYB>dZKk&1vjhEcFz(QSazAys~t6(Mg!RBgFF;d%BLvz38qK&XIOwcz|)@af6r3MOVUmAo{*Q^_m+SpQCXqS`!EAg0?B=%aW8`vpJJYGa+Xjbl0f)Dxott7w{fn_+RNhzYdg zfu`pPz?3fm#NeEUNtza4jX4lpa_B!4yhHJ|FWLEiqZ+JRPUn*4-rTiLzG}cX=-E3e z<9EZ9&!;;kE$5a+@1&5U@PyIo)DN+bS3dY@26kh!F={OOM1* zDr95cPDFo@pU2d93OiN=gKtb9+|@g!kiPPS8<$!2p?s;bVtr7>v0`c(6!7e5wN))V zBp^ki*r3_9J&26yTa{9v=U53k`-qkZXIe=Dpmlj)ki-x2m_h1(PB6s#_wV1ceM{}Y zIvwW+i~7$wcXr(xUpm3Lx6iqp zDxlGCI#~Su0JO$UBr*E=h6<_rHgI!E_FWJD;;`*8VB}n?SlAlO_jTw1PZpOJzw7lQ z_ zE;Lvxz=JD#NT`L<<_KNWPS9mBuJFd{Vqk^meV}bHmS2$+d7vO6TfeJe#Cs^cGf-N7 zX_U-=b5L%?@^gEEO=OmfNpg(ik>LHJQjcrDEp0PNiZm#1e4x|-xq5Siz_aTInUycr zYCo?e7MIl!s08FkkePg{ff@PE90BfBZ-N6r z?N~*5;}K{*b>$!)4wR@9kKdVPp@D61Ody3-L8{PsMAS)w$gNIQ-Ly2=IPdKeFXzHf z%Yo(wVm%=^(|5$MF?RrY-O5+9sF!SUMQQ|)|qWWm}Jc)$dPmCFL3A?`lhy{AZb|+niznk z7>-pWVnNVSQ>zhk74%H0E}hTeps5&TZ9Ey574azKnMZ{7z=I*6Vl7ew7AfE3T^2z4 zTVtKzoY>8_HS}}tj$sBy3_(>2cmu?pe10=m8XdN>i!mCCs+ILNghk{i!{_Uf3~q;e zMNv|%x_XA`)i?>5@p+iaW6O=TE=={tGWK~}l45WrwC|j!cGG$!d9xuw#zAkUC;*eY z#hod9C4__MV($rzkqz86q!(5}Be!#&zOC^xOnbEy1c6$LfW|?_l2;ic&&vey(KYjA z*Z~K-?@tcR1<%Ivr%cAp#B~)F8FYk>EvKrQvt%n9nZYp%PsWu^)CW6^1}gEQ#zO3L zlT6XubMsP5g$25vs4g)jc;}0kItgIk;a?lrGNMqk=Ng;Dz>3vyN&8Y7%nw0FtcQZHO37p*= zetX{HiP-`dd1p>PA$Fc?F+wTu@{xQvwjTgPu0&mUh(xoORz}z>YnysIG$3~FzA$qu z+s`smPz{avalaB;1l8(X^#OQ)b(PM+;Fm{5QgsI$ zn4^cp2!8n?#ve;c&N2j*gS}-XGiK#*sK60cg^eff#Jo=#6G`1W{gXb@wK?ZpW>?WP z7>u#z4#F3Rn4fFP4V*1sPC-@!xi@Hw5WIYgj%&hQ#J?nR;2_yldyqw78rbT+1|0v~ z-jO>-H?@Q5(P&rg;X1xPLK;gSGwa?cp&cHzc`Q~uKt<**n&4>c`|Z)-+jUJ0v`bU& z)+^~;hn9D4cAhJWVqBx%0K*fWT67aHt=N4TLj?U-1W! zN49Icfxytj+jYqyX%+%-VpcULjd-&*i}$I_9zjf$OlUV=-811!CZDhpe|f z;(Zp*C$V*KdA5x3H&MEIrK@midfsh6rPsaTnt9~=J8B{Jm;`y|VzVJEj>o0^$_n!r z3~=u@Nv;sdzoMD7bX&sbBFpVzpaK-DC|$E@n31*+UHnX6kmv-o(oBLTpDjRXUB?n? z){4~xar|(WV5C88AE}NlL4qPZ$+D@X@b`rLlgmfBd}cEx9iYK(jwumBDb7ao8gu49 z0YZ`gp_G+R@qwbnpezX0*&7P&iwrt}j;W6U2<5JC0CuKEkV56%n%dLvCyu>%Cs|ox z*sTw0P7CQn>KBXWwc^_Nc&stWe4sNEmvzgA(CZ(;Ie;QlLk%4R9o01VOtq=vs--p(FRK3s{IsP^ z+PA4m)c z==GX5#0mFtKO2`QTPx264iCak9h1LcE$T$6l;w}mv1e?mjPqFqy~-FNi3^H0OTmr2 z(tj*{<)I!1emk)X4aH(P<+ATdjcLg&pda#m+m26jLK;Y{oA(9TWGoQAh@b20L;9%p z8GGwoFkx1FedU?1lZ>y{*E{czL@1WRRsu+dsoo_s)sU-eFNV79x~e}E90&#e`r=$a zy&d{tXlQ;_?b?R)bBO~orinc80|NCnu)Fxcig!$Wylcqs=5=v?pdk!CiTUOC*9|FB zClyS~Bg7=pQiV=se{`I zCMzbpA#h)5mK_kGC+Tw6CaB~(qS%Pn0g5%Qh|e0j)i)1R*~<@WO03(qDx=6JErD#i zvWC;x?w%>OFUxTCZpqJYd@t$9&wdaMVylPg=tAP0JWm)+)yg<-Q$wSr%H^{FR3XZj zgng?fd|=bWztu|PkSVir+0v)xnv_UIL1yK}tTW{_Tk7P(4E~b~yFY|FyJ zDDd5QpIPKL_a?WAdYg~WflB1AEzkzUQ5*(00@~zRT$Qr0S5|pVV{nrcL4n}ooyU<7 z3}0+8sg6R6bV#QUEM6PJsFF|V!H3!aFU2{^#WS%QI9EkA96|3;QXE^N*i`TAIc?Dn z9BPtN!0*vCzlRzGcHlHt_X~`f)iGm;4YEgef+((AhlySH9Sc<3Q7%e%FOi@lLS93BkR zGwJ zVkm?gF8A%ZZP&S82piaoN8y~UGNUQjg**rM;gVG=JTJg#%Bll5;{aX5W)^U7FAbJ_uEZPYkz_Y00T0D@02)D7RUXY;4fo*pW zj+t#sW=4*MfcBN|7UANK8 zo04O+ar^l3xi!Tf{gFAF>d`AeQ^4n3u^I19w5zM)6;FdqaAsF&bx3JC?jl>3=tF60&11J zrcl1xMjrd{Ebe&A*vSemQ>Ec-8}?C7FO@k!@!nXdoEcn{A{!h?Hg7OlkACMeog&xu%&MvoT!f zl**z1t#{Z;DZAZaGhcTgkcN4z(3rs<=p~#Fkhnj1oGdfR@yTwuas#XHTcnxUFG#@E zd})kPA1c26z$Yk1ShH=;;_N5-`c`~8^$2Qqh=u@jVF|SKZi-(RFunM7!DU)^gIxOi z4dL?C9+Sahmd~(69!Gs&%!;_%!uIe1R(Zkgjfq%BwtEH!Q9a03rAUUOB348zCK`-& ze9pUpk0fkDrp!i;<*Ku_h16YBEyL$q%#3C`$S=IGr~$pUs~r#(hl@w7o3pg90WLFM zo`+;K{Wy0lK6g~PT=NL-+)ZZ{E2soOvMfvMpUwsyTlj74brP; z7ev|^e!ez;zkfdjCM=`N)klxoBKOfRgiaDV4jL{BWsvM?NhVD&8yD`p zzaaD_=;@|~1=KOpXiyEU@)o@_7TRt#utEYiDfs{j@y8c`FxQ(|GhJ!c3C(i?0YBT? zKlz3^qCZt%X!f|7p$~4|D~hs`yQI>;)zF+MtjD0z0feY$JM6ti-iz(PV=d~yep*^l zm*2d5MtZEn*!J;og#30?dq&S=-F1ZB1hBJsrwnl$PN8}{(hP;qnGHZX%Sg8xr89V{ z4eUFI+W<`0tY<|&eIs0}X?ehT;M1fjqWEFTnI$)X$uh(Gcf1X;uNaAoh8@zJdLsb# zZe&#f_){ZUKJ$lI01bXZ{DPlW;yLIt&+gU$=Itm4{CMcHULlCB-rU;W^$2w3W6LY5 zM2y>f$?KJvnDftzb6a1Db#Fz3v$OYLw&l<3JWf%CGyv)<0K`$Id3ai2 zGuKt=W&_~B{7OE>*z*R>qAQFhZ%t$e$jc4q44s&F$Yd0kuo)m~n&z509~L>sJ>cMM zGm$OWn#;5rG4&-9vl7jIATWd!tj&x_$~3`xYQwHfdY`1T7|B#R6Ooa76=7<)`WkTA zfN;xL$@E=~#w;&@bz(W(fRZXWu4vG~iLn|7J9k=2V9qy`@rX!D>~ryYkhLwju)X{Q zD<(rPn6;np;J$B z+(4Epn!TYC7+7lbfZSNDOr2{X%|&1U4YC(a`>}P8z8eT2`z6;Awq+AJWcS@p*QVkn z%Esffa)8@`Au0oKu&p(N4%u%!Q24C`u?2vO?ugJ}W}4L;tJ;q75%!YKTM+e=1QaRA zed6&qEMSxcy!zcRu4Fz^tOMfP(UgR&Kdi0Eh93Fc1M6ZCZbG#ueWaUh4Ca?jYpz%=}wo?Ey(8x@f zoL40;yf^O4#e{_FoB4kpmKlW*D25~aWrV~y4my(Y`wn%(f0ffxG0{Y5dTqH`Hla+) z0Ndx$M`Bn?AYpc?(D5uxcYb1coQ`jKEk0bFATACH)k?G2g$cTYd#IlKEgWm5yz*N6 zXAt2uHukBrsc`~W;nNrK^+vWt2W*ZB=R>)ftnW0-5$*cgwyreH&8KA%3hQ4i9k+`+ zLgsCzX!6uf?d5W1u6N!vg9@5S$~Hh%XgtywVCz|KP&YTSc0zd8TbuHt4m_`mDxx*P zWw?`|0MT3V8`nq+Hb}ur4xC#RKaiK?wKZT)yY##T4nn{1vGVN|heoOyHNf`l`SWKl zW~__=3j%L9|EZq7U)~)|Dv6-p>@%P3UCltzW}y|K@vxt7+VicNzqkMZxn?YsFEQ4o ze0JTnIon&pd=izdrCl%^GN8nS2 z;R6LWp&P`p8!6APz<3f1L83$2vE<4uPOKuw2SYPz&}g?{{uxGEF6`QQd+A0BAgx6g zogSI#-(I#p{%dy8ozM)+jU+aO27{0X}h|Bk81DsHMvAjD><+ZVbqYj(z*A%}l!( zC3=5PZPcft*1)Z~R@I7j-8@EHF@hmufZp2B^`cn}luV98)R`@sv0EuVcaF?(G}JGl z!T$;qw1XQf%NIHs`8fi3fWd7WU}J|>0k*c(@QhVb>5^R}MRagnp{|(A)JI`cbjXGV zo57TSlB_Z_hq1IeHYnajKPRbBYr6yk>sC|b-R`HmJ!?CDd|YJf>yY3<0rufL|QMoa$C?1zNRUrR?x?L3TUeWUf#EGdtvhzCFFsl~`5dt7$NV`{KJgJ(gI2IYePq67|iQfN&%8 zi}z}&sscGx*05czD+&j}GyrpjvwfUmIVIaqX?4r|;7DS@3(dMr$`^3EO} z3kyR64JAgY4O9smy!Z}>o4T7GsXjpHgoO7XK;1`=I1$fr z?2Orn`&5!Xo=;-fJaqHOsQ$er1E-t{P`wG|L7*?x{wzK2`qnv*cmA=_f{s@h=hkz8%*;%d;p=9c3G7id4Q#8NbYE<1Kd7LDM`tjvCqu=nmj1PsWTsH!H)O)3=cV@ zBxseN?XOwoGz{lEF7bq(SQkGDM1u(XupnT)k#B(les}(nXAH7Vdb2eYO2$GF6(^BQ>OcB2jUv*0o9?5Z(iz7Fwb?QD&ywwg2Nm z8z;Mu84!il*Sk~q9P0Xo##Dp%pR9FHq6D9;Aoxn!!x?NdOwP>R&r1Hn&;%5(4?2)s zr#QIcn5G>?`|yf%92)z$-~Kvz>O_F-e?`C}VMnWoM$~)-i54lO9`fe|rr}sa>i0|{ zK7MCGOzu<=fYKEehJaUb<>90vog}kgnjklGALD*(sptHr=kZn9Q$Z&#T0b`n+!QKw z9JoL;9|)gmNt)X}@(wuOy#x7`6*lf^Vx-A*pTaw&IRh=2SNI4tMzUE)A+k)@ssJVv zTyaGJAUG^r>*r%*0D5!P+$HxQ5qJGrg$&bTEkJMDXLuHZ0L}5prS+^E zdUMjH`Krn}fZjZy9`JPqK**1w{JYvs;5p;aZ3iVKBv>aJU@M)Npr@reFAoOkIj<*kf;*7vYrlbon+40Fc3iMU^ZBXO z_4b$Unc{#tZ)wCE8+?3}b4LwJ3sLn947V?OZEpaNuYDts-L}$CawLqlRh)rhr!fG` zJaMk;`fwCiZ~w;Yo@s^mpeV5fNMGSJzGsIgcHoFMPVBFnPz-Ea+GC;Q&dhMS&e`*? z#Y!?p$Ni#wBmpy@tlTC2!u1{nR=G@(0&f{8i&iHq?iLMK+fghx`q>HgkrI6Fq;n*V zGL-gE_=#l5Gi68^X?l2l`1G5hXcs|M0XOuwZ)aQLO^#g;Pl#%-SrN@ zO_~#`y?wd>`KvsW(54JXKSff0Wln7h&!5kL{Xlz$hB)w>s>c#~c>#L!kW`?WQ%^WT z{McVOy;SzcL}dyv2B$n39~{*Hc4A_31YjrDI`r)$(bj&REV>%5rX)t4!8cw1Mqg@4 zJ?OZBZr9JsHFgjZa{fYYkk=7zj^JkKa7lQPSDkF{KU~Mr zu?!Pf>jk2Kc;@tc7v|TQ*|+14O4im7s)|T6=g9`WSf<=f@b3g#A7LA_p&@=O8yM$k z*}qS2&~n*x!XQU7vOR7KzH4WL0p?zku5g#@JXahMDqV%h9UDDh^LzM|q&N00vOyGw{z z{XHDUfzx*rm5zeRH0>pS`1eevZ+q%~O{Te4H`9MSQRpd2wY% zPiNQVXB=l)!FpI|b$k4KKEflg9+<#-cvm*|$3LHo^c2^=Gqxnl7(Fq2R-vTzd!QKZ z*O$!;tijjRGU9sbH+@a}f6)>${bduizv*i_bnF;ls~n`fYhM1gxkO_C`yLS@j?#7i zqh}5L^)W$UQU8JfzYnvB{GN6}ECwHd3De$6B`vxt3jgi=T-sR}VMx@R5@=Y)o@b7E zBa|Pbl5Q!UdMubxaPhuj2JEa-`uS^NUfFLQ1i^vv`hR)m|MRo``dIRR|FIzVGdTal3*dj?m4lve z9y(Pe`GLR|_Pamep?{6rxK{3=-#l*MLoqN2(modZZ~s`wgML0SWMI1Td#A_clb82D zefsqIF7&Pnh4W1R=luB}m<#{;q$hLt9a>__B7e94w=3{}?xptJJt-lf1zxL)rzZM$ zzt-)O^78L?p{q)TvJU*`NBu3Mc9MPn(`Qe?$ExM2iT~{%>t}#*;`0N&(FQDg4xN0m z>+k=ln&OoAS&Eu$garTb#~;S{R96Z!`-@jw+PzsOl0!&BRD1i~bi)bZ^!usq2aI2y z`|tPSe=`$0b)Hb5v*{;%AbDuXB|L-J)vB1wSFi5b9hm&+8=YHBerDC{6Kah->LKyS z9ZKx-{d`M?lye@CrUix7$w)P7Y#c00cC|Z4SKYoRLn53G-;jYx_I7ezd&$eR#(f3mLcU}dzUZ9u@&miJ2F>oJssU+9CXi_U_Og z(atq$y=e^>lCW{ZbZ+nltAOfb%)okML-hWQYsvD0>LKM~TMQp7{Jr8%U1J=g=;+9M zir(5{<9%GZzBr=E$R%Ofq~c%kc=}E&Z?-_d<+;)O4XN`~%0WI%w`9Kg1a`W@sCN!J zX?Vhx>b@F;hqRr!0{IrSgyCLH#8L^qTLu~;@=E10*j@KLpz5l@oTN#7k(C1x)Ul${Z8rPynsOf&g2qf zV`GgWwaH2%&knN1rP%C@cgn)3r#cV<*4t+Vpi2=A?G;EYwThL{<@#N0_4>`45TeO+ zhg8)lbSo_6(A?p!bM>hzG9oq>7Oh*Y8}BZzN7bPv3YxjZY|o}Zo?r>h`nRy~gSR|9 z3RSuXfT?lX7j<&6R|4e9-ZM&`_%UOvr`$4GZW}K;RyNZJ2~uis*1*IsL{vNJ3rVS{ zVR_<>a1{oOT7}k0Vi&G*=ZWC-31lzF3E%2~6fMX;+hYG|joJRObPu)zMLBh1f4|!Q zH6Cyyur6PEgFnE~;r!o#p_}pLPv9ew>KYo3{={v%ec+^TS1j4ybC0L52@Uz$*jOYs z*%DM?eFgREZEQe~%iF6Y<&(aM%(wWkfR&dw&ZtV5=9FJRbZ6@K;WpK_XD%w0Bkp}Z z(7BNuVx2Pp!8Il-tZEuXwBMZ_%`U+7x$@7<6RE}pZL9<_%cRw4A9UenX zwQUiN>$e~))PpJgV^FqYdkNAo6#hIoxN*=E)(Ee;(X7=lIOM%>=Hge_#F41u92{0p zj}ixg((+B{L!_%={j~UyD_p|9;r_hRVyAFW&(FYaaMLvv5d&z+`ONpep|d!V@b& zdd>sdaunLVPD-UZ=c6NkO^|KMxSiPtTyl^JZH9oF_u-#h{gFbMbZy{43!=Fc3f0|q zdeYKG%^EAwfp~VY^3A7K{x|L>2hYq;XkW{Fd~Ir~a)k1}`Z?O}NfLi+{D>H3Yn^@M z+ou~KL3^iv7#sjE*L|mFWuw(#s$J9b0^G8=d1B?piWtPuq-IG{^$2vwkG5eC4^8sV z4yT4PRCKXCpJ-r(M@6xB<-pFHQA7DgVoh>PhGbsfqrWc9%abUa^hPFl_dFJjP#CGC2psLVDVm+1Joi#C*wenxgMrXhtn8Z;HCj<> ze^1tBKzM#<(6$K=OH||#g7AHWSk!ApF&st5vG4#TIDQnPh%JVO^5ysSpOb30M|e#T z@0a^LJ~SqfNxjt55P2h>jB*@s&rHaASX5t$DP_153GiW!)_6G$vX^$#JA^8d{Plsn zH@TVRE64KegBLVutMpU7#ryo2cmGhN;ckGQUX!Y;LIZb?R9WDLZ z3>i~Jg)q%s{B|RhRr`Hk_x9L)Np}nM9QjUyYL~HAN|23`>V&%;OV2`ASwec(t|s4A zuF^utQ~HkQlTR-DG3L@XgVAJ>by6PfZv!^46nq5>alPh=AD#ENpxcrkQd)R68#*7D z8IbWCkDkQNE1vAJxIednX*20WVlQ`DSv}i2=Sdut^>0(|>dmq{+QF_&QlBq$s&7fT zMphk|z6Y1M!7KQ5q>Lo<-CKesB8HP~SdzOKe$hs&tg&z2X|%j9S^XJ7nNR2yS4?#< z)60|q^YQ!F)Zme8XWznCW_Q8T*OLZp&T+s1G0g{Emrw#QBaC`A0&vHG?N2y+Zkq3zrS>)IuA2^?Mo z_t-)+?m#*4o2zl|J$aL5rmHVuzPoTfiD`NHWked^m<#@fv2h}^AH}J|e=5+{)glsa zLRy})Mr9d3SYt^>4S(bCliX_30f%4(p@|%tAHsxHrQuZAb*=ZSkx}WLh zh|%1;U5&o0oG&?MeBQ%br|6C0^WW_vlmF<)Hc(a9NkWuItDY&zh>7SNUis98Qncg` zH>PNUHFF}l`WAiLN|2)vdy!imTEBHvc@oVD9CkR{#A+ncCYv6|UqO_XuEQVJDbKIATH zFdgo`$n0hbmanVHQFA2S(m#WC%6)~QUucYYPQ4W~L+A1DfdBt6_ZwV&@JjIGGo z{ONAm;Dl2*1@c4{DiHL+85g zU?cdFqnCzJIx<>Hc8|v7V$gCFAZhc0Kas0I(1HZ%^z@egvHTx`{40LtDnz7qPHeu0{^J$G-e8V~?VK`*ZA#5rLbS{8eh@zJstq zZ>%ZRzn+oKu|I##)yH||a&dQM$LWYXT3k4YKhaCu!;kRsIZaFcJQT6&W#BZZ-!R$4 zVO_c|ApZy0r>*ypRkweNr-L2%t13tj2y4Zks!`p%-d6>+RKMj{;UFfm zzc|~i#TPT;Eo6j`;8R*$%KfHu&x@Ql(Xi-F4bUI7B30`~RH>-2QvCa!JGD>Z2P+T? z2;=mp0b7m!M-Cr0Z|fN^+WpL`$B`fVAd~I@TP{fxZ-!P0B%}bpi z_Q-ct1fBkXxE!?o)wt9{W45CrY+(e6eZJRz>b4|R`%+X}-)9?w{^EzKmq)K_Y`R-5 zrq_q3oJk2#99GrVG#}o0`PInBr=-y5gWW6jHA8vVpC1xcc*M&1KEASO(7c3s&DxpU zP{_NAlZ@_x35S@CdYhewf8>tZ0K%hpr9pd5Wp{_^g`#&xPhrsQt;#$pfvQ)x*5>Tv zw|ynDP)TM)9WS*V_t^B#pO?kTJ5Z5n`G^VSR!`J?1Ycw!{O(fqMJIiEj;vz9Tq^Y3 z|AXGN$4ThEeym6}Z8HGZ`B~gc1bHoh5AHElbvL>-do)ry|wXqim&2Hdm~y zVoqPyWCMU<60RG9s{xNb%E>7#<1lJjT0x>p4Ip=(tg;_%>%~n`y-Zr(U-a6Xc~eVD z4}yIBII5<85k{?Lub^l_5QgAxp%4IV&!oLX&Xo{~*`mcB=EX1+2flRG>%COqm-Hmu zp$}bBRc(^%g*D`4-_mgAg_Ps$GqRUVwAchxPw~h)UVv1n&Tzn&RI|IETxph(;Zg?K z6u#KBl(qyV@0??ye5&pbfXw!Eq)La@);f=EH8}_MweYoooUt?LT70ZQQ4T*?WMnF! z-2FhtLs?%YqwK&VEpTcVs*n~gN{m4t`Ysm5(JsH5WIHYZ){Dq`=DnsV=r0RUp5cD-hm>1GealGN|94_7Sp%q&OCxja{1w{;+W^-#bTJB6xXRJ^fP@Fb>e z0Y`J=r1|o=hKLl)_)E;ok5k&_og#o(s`-WhOaf8aY4nN{HE1MPM%`GxIoq9@#&G{U zxY4eav)9{rzIdr{dI-5=p~W-O)t=$yo2^gaByR)7D+oC6p_7^X^O^Ru?B`W|T&R%g zZDewkduFtu3q@Pc9EUt{Z9>$5_M+z@K3M!T?-x7D9fs$`f&=shWLbiL4)@pVAff{i z{_TMK{aE-+6}7T^dvXb_T|A0~|LpIYQ4_pKS1yruck~R}&jgb(w;3Hxq_&YeuJnh^PBk62`GG7ik2CSS&n>oiGOLm4^~>eu|Y_nsQCKks-HmT>kOw z=r^D1?TVnbKTPvJU9%kja*me3TG+~D0x3TaaWUr)B{GSe(vI(XT=%NK zhewX;)Wp#QFPa}_vTBNTM_j-iWTS|w_*FbUh^ZJvz#n8kymslPYlE87R2Sy@kCiFd z4*=g-_h!#)6KWVAmM@27962_*35B0GRMv&}JgH6Bv3XaC@d|k8j%)MmaN}-Ax^G_X z2sZ=K#T%j9uo%h8?WTPPREcYl3yWliPv%cXBf8Q)Po?Hmv>Ggu8XMHFsh>`YbQ+4e z%BbWyiyxlME4Lw-f&>c&MC^I1X$xMq*xrhPc`%;kT0ZZ27>zeJKQzm`t$g|8kIChd zPe(gVxr9OzWUklDu9d7bm5+u9 zWg_eCpRFe1`I3eb8*I^_Jy{bH`}$34^V{ZE9GRB5oDo{aCLIKKb{^V$Pbg2CTr~N3 zRezw%)KmBIlN7x_u3hsrSp~;->$^|aqW5gGQW7>)SEnE>;RPbz$J}vEivjj<5pC+| zbCTWC@C-r~epPG!+k?EPe}w zF5C5WSfFK3uTjA9I~&}Q?%(+4bocXVl@(X9bia|Jl{;jvJBKFNE(S*55b$lEIFpx` z*I7Uk%lB=T?V^sh%YC`?zO!+QU)kqJPFK|TFg_5Dy_cXWbG7xo2n&NeKN4|4*LyfH z^FfYr2Wr4!pwG=zg!#z;#by8hYK0IM^-Op2n6$tJM()%iV@2$sQ`07)2PPx_o_H0kzyaFa&(0PkkJHe); ze;ZuSvvwSwrHkF4v@gs4pyN6^-D;$H=)=g&1B0Eu>ku#6q8()9XyQo$vBsb$K6rww z`p58m_9nM%NsUlBW{!)STNK!pNbe2=;8hGr-1@R`71n2j_tQ{sijic|U{-AIz!WG9!%R_SXCHbOBHL57Sd%BfSt3PJwQj*Sr*voul&R zp)n?BmO-ZcCF=s=XyYw1`KkKVGySWlwZ-X+nVwXoa+Z|dV@i>n#TcYW&RIQ5QY^aD zye1GByRq@yvZBy=aP9rq(YZ{KI5GW8o;r|Wzzz5DUY<;$c%eT87Af{ zXqdNY;O(9){b3XC8~Z)^oLW@+hJbkOzFV_sNv_+fz=!R?AI5{|SoqwJn?fm^-IX7X ziT5e9>L4GzvOh<9z+d_LDMzR{Z^!DW80<;?RNpOWE}Q-#{(IFu=FQu}{e?ht|1jr* zL^jgx1`Lxk?A{@X?>Ec-^x0S7DMT>zeA#T z;368j^7->~1YEdLtHfi(_w65lt01Os!}-Bfkt%j}9vGwRg!jDrDJ zl$pt0wa5ymiHL0$BN=Qo>8#8)5YDq83Ij?F;`9KvrVRzc6!|y zDyb!|3Ol*isL7^ZvFbj(F%%-=Hgs1SE;F#YL`3Bae(`@#A#;nRgXx_mSwdSgv*jUb z90xd`mZ{N84p*5aY*&nzneu^(4|8RnXOZ{3$dP?6(!s+W%Ah3jkW%-TpQQxvz@zUr zBEizH{%NbPKp9tgvml*ipS6)1gDyvB!et(0(Tlv(%MdBPVT%Wfd2cS7gO z=4RJk1q7tl9#REoKM5PB9P5l18PDcW&V`np=FVk7POe<;odOCKH;&YZYxf zq$`z3@9(sWgGCkyeLN^tG;OXBRiBUeA38QMOqP!(VbtlftougP$fMIvT&F)MaaEkk zSf7uwyqZJ$*=}NP2Zw_?h||X62WI42_Y_jqdv|-2!^n%A+9zp`J6<6FdF^YsLJa5? zrJ|Gjl;=G2StjTEto+;B$$Kze@34Uq>pn99l})>fcW0$RTS}Y9u!VAh1oeDZFN7xd zEWP8=d(6n7$+5aMxL)MGKBuo=VEoZ#cB#-)-eosY+WBdoUi+5Vicc*G)o-zLj@mgmZZa&MhhL~DOGfGCljt_KE49XooAMlgp zXWZXv-?~r)lB6U{=h;3yar1;Z)mO+t&VkLdePKSQ6e}bz|Lm27%`oEBc=@dM4dxXW zQfAX(no75Mk!*g=G?lA*0?N%V{DEE;log^u)xBYUBZz_H_>=<2FTdhXdwLi6`RPv` z=Gc3ArEdFB^5UYyi4!MoA3j*GVDnal_Vnq~FD_iz7W}R_A_yq^3zrgCDi624EIQz4 zFJ=8$=in}GMB0IEgv8)}x^)x(N$yZ9&9>lZ&Tai88_-w8Z_tU*s&)xBr{Ovts&#~VCeXZ?oBVq@YyviTSfecytN>?ml5Z! zNlnd?t(^1x{m$zVtK^Acq36Zl_dc8E0lq*+H({jU+CXuc;%IUECVZw`+Icde;vSu^ z%Q*^g9pm%v@-CUq3e+57N13{0%pO87;D`Zau^H$QETqnY(rE7;m^z}7FtREsmNF+PK0<@T?Z+-Z+0s> z8)STSN2R?VQ_fUw__IBDJ-TAyj?|a+&i7?U-LJh7^I|6&Dj01)$b9@c5h^}g-+#5L zEz7|-TxZwIR%g2P)z` z6t(MjxG(uH?|It|x!rPsJ!|-KgkulylmFs*2H}u9C+umq(tGLN2ts}GZl+)C1$9Vo z3!F$8Gb4Q`m~*X@&n2sD9-~l1CTyGX@2%h!Mczqtsx|vDHWZf$R@3xK#^&ciM!Gow;D~MR}2Y|7wMP%!|xzwBy@PqU~lI z-aJghIm*RayOL8^UbSA10kefvoW2TPd`4T>p~$iFI;I3F0OZ zZvV7_nm6cY4AS)9fm`C)rfS$0YjdiwZS0tZBlPP%4cqd7IWY(D6kAjGaZ5|7-q`d!*jPuTPo;3<2LqJ|(dbr5i zIF-N{hERuZtzAe0wWM+TBD6Oe7SQ^Ew-@-8Gys2hBLe6OR7 zL=guF=`rmvxS;#6XJu0xGd%2Rsm;}Dd0$B|_eUgzcXq#t!9~?Si3FY3f&j3^D*%tT zNjwgK(hNuwpBTt@^?T);CWQEvuq=7|LfP^Ow7-wL;LgCt-2i2Kt|{GdCI*_FlhCcT zrME|8aB{zpv78F+7k-f%CJec;%7$t?->M|A%7-W6sKo3s_qR=%+#bD?q|k4b*J8Zy zf&Gah-5P-+u#z;SWWxoPCG2e>GUxG}*_Fz>&xgZr=`n!!{(v6O5eI^nfBC~AoB_B` zr>S39^H*Q)g`{|0+M$estjpDJ$k#koe3ve%XMwabgwuWe=M!nb(*a{auYCUeIkO_U z`=MWbe;MiJcnkZ*^EaXg2q4lqE!RA3NRlmM=F_>{^4ZzSWx+7V#O8@3<0s|$^V`$u zc*L=jToHywD3xE(r^7y|^*B+BiBE+1&1GoZRclyYs>v8(tzXKRX1lBW!G|B2Cqq`& zP>Zg){YHtn@I%KKW$y4QwxEyKkgFUA54OWSuY|BV_`r@TJ2>PMya%PVM1CgD4sa@X zt*Y--KT*3$Tv}Rk0(6UYE;+kNBR|AwLzG`WR!9?9N^c;x2f1ARLKMih$nRCWXGLsA z!9VD~wiGi_J;r=)(|h0+?!L)4pLw_my`+i9(Cf=#l}(RZrzJ&UC8-zW2d(?F+2L(;+MW2N4FQ0hfL`}wb#LPv2qV^ZWnH-oU#0M_e;gvMk1tTfF9jh(uG?+y1v(ODr>KAD+ z3uPwY2igIDtU(-C7g{H8evR2RDQeoqoT@)|>R7r0x9Gk_ykSPqU-X-QmFbngn8Sq~3=`=6W+nf_>rCI>dhp=*LEm$V zO*#8M_Wx)1(pSA8m5siLW87yv{LfYiY>;VzQ_Rel4{xNF-B{T#A?QE*Nykke9;DeW z9JifN{mnN@Nxuau<)=nslD{+u{>M*dUn~6n3SjdFoLFp%aF3S!-S^6)`F=YOl02)hyUn1`SbGv8@~Gz7F|_T#rvD@<-&6OH>sMZ|rmd;J_Q0XX$GVE|_x>o5=uyA$Q<&wT?=-PNWnXsxzl7F*OcU%Uvsd%Jhj;BUUy1Eqg>_x8xlecAp0 z?zQ*(w!(~Cj~|~p=&QeqTQ1%2oBqS=I-dN)yRVww_`S}_pZ~@w4h}Hrixpi~CGeZ? z<-+pd0&wn--|pO%fpZ7Sf|x5LetX*e1(HR@k&*9;XINM!>gnn4{d?QQf0gyQAIvL6 zgd5=L_iq00-#z9UNJ`wBE!1)pA`Dw9Ab z{14WAx*%O^Cql|JL|Jzf(j(!W1e|BmkYe>8A56?T@d=RP%gC%}^Y<+~Cr`&5^^=2M zeN_FYAOZ*s8n#^7O$XQgn&BDGcJ8Bg)(uiMYH2NFd7a(6EzGDCWO9Zt;@;iy59hnH z8w4bKqqj0Q_$=y8r43MVofMpJ&Pa#C6vVLEnng7E|8bO`yaww^{sY)L^T`Zs+K9H{srilPBFQv3(8weR}$( zHmK<|fA5~pM*ceR!E4;gK(Pb5h^6Y1bj@lTwR@r_UAwcyzraBKAm)1jMY-WjEp%XQ z{F{HkvP#y{1BbUPGhkouGmKBjLoNfNwp*pM(eC!W<f;K44ap=j-EomFnW|d?q~+5)z6B?DlBq=+Dob_% zvXbI5w-}}V{Zo%m)xJ;Tr+)r}H{w%>Re!w$@9A{dgcT71YXlSu_P*BdljeD_jYinJ z=ixX);lZi`-^AP!JWaEe=E`Mtl#J7aYRl!SuF<TTdwCOyLiF466)1&7NiIBJ7ZHMb((VLbw>PZJZq0f1)rJ!n%U`kw;v}b3+KxP^0k1|%{@h?C z?0zU05Jc|r0M4cARbR-X#u%Z5oE|S zQgG9;gBg6-{WYuQ=h>4QLreUeavl%vzvD1js0OtN(?-hs`?Tjqm~p*@W}>K-Ft0OA zOgy3%Ezwkh5s>gi=I19aYYof`!rN}I*wTR2bXl!9!kisPuWT5!T2yAXm9_moZP7Nvmd=Ffjs+N9VGC#0$l zo-DLzlh+4Q8x^*Zbh22g$p-?Lfs(aSAHsEmUg{gj8C8K3QAL#vkqPk0X0sr;9*g(3yUwu)zO5MAp>)~?Sp8#DY zI(m9KWWR}tTk(Kq8*^0@Cx&U}(*wP+Sx&94dH4PXBAN z=;Q0rL;vgr@P7z%wpbJ-R5uR5GYprdX7hY)8LF%pqP(LO(Ha}H*iQuXYVRJn} zDw63%!qlnd329EzN$c!^s=R0Dx~fu}{$?r#s4I14v&L zZjiNShzLr2H8!WlMSD#xF$#s{e_uej+89MjYvT6X=Cx?^a$9n>_3Ec;W%716Oc;Tb zuEz;*^{xmQh>4~*#q1erU-Rx(-%MH~*tAo~pfXL>3jxvIgPu0@B>{4)XAZL0IayKR z^xBG$Qe2jSJz78OnS1W=TzI;8LqlY`>C#y0B#KMa?bWs%g^kI>vP2fk<>(`H|K5%T zjUcyY`A1Hi#acrok=AnR_}ea%&0y`x?oRI3w&pHNQ8S>I@zukf7arMNlhys4D z@|BgUH|EKyg&O+Rjgrg~X7FW(eetTqT}EBeJGK$3TzE`n1OmhTW38eX*kpU5Xfo?hta z?R==E73DII(;cdw0E`o}pCi2yN9J>Popa;T)RLYir-{0jSZPZdxg?a?MDFd%3Y<@7 zWoPH>>6?)po^rHtaCkrD<17#-3}`QCnI)Nlr7&4LQCQCfYp&U$&RL+Jh#@O%T-J{~ z%D6t=tvb_{X<4>eR0;qZ)30=-q-=|&`oi@WzmmApIsGjc>Op9oK$C+SfRK17A%$B1 zoBR4%qxi)KQ`@H>dc4z3wo%Dp?($UVM3qx$15R;C!uC?vL$RpG0rX1mIIP>I4Luh6 zEym;02c>i$0-;D_A|mn*H}t$v;#9@zb;GGFI`KRqT=F@FAM9JL>`v8dy{MDNe~B{4 zbba+KqFe?HCyO3de!Xu#Fza8$D$kI)Z!HJlvit7da3K<~3#frPnfsZ&cM0$Y6yH1U zmcYG-9Io?p8^)(|zex6xGNo7YUR2=)hnp-uX2PYjKx(KzE#dN-Zzd+1Oj5X>1e@dCI#FT? zk;_$;WP$W$p^AMM4`hI&0fwWx8i5@d%JZRu231%nH6h22@@4JJ|-n-YOjxH9#RUA8##kZUy-!x`j)&B zB7}{gI=nU@#dn#?-(Gb#&L0MYIOA=84#8Oa+Ehk=1dijblKb#SoDAKy3y`+M)Dv(8X!!l`B_}!fa)x>=U)8iLL%Kj495I2R5{SZWS+@C`FHO@$F zGCA<6{d?X0S?~e>CO!wJ7J3BRCzERB;i;94)$My>=FHtgb3@^HUzm|@l6=y}uG3^QFO}+0w~I1Q z8geE>-MF(I7KS`QbQPJ^0xW)^&z~&^3s=Z^gA_bpKr=_~Q;C>lNW}vOhcTkt%+WF+ zwMqC^)r*YPZv-vn% zSF=TSWPh7CKqs93K|*ie$bzeG#pCcb6BVu3wuU$rd=1s^?OfYZ0lcF+Jz^U|9T-Hk zv#uzf4~emx5vwT#x|B)Ci$GsLNaya66&bhf8fL{M!>eeOYxQAD1G<8G7qCz_AwApk zXBzgYilB-t>Hf0t2E+~E-G%io>$DcO4#G98n^0IyX|h8F+8QL7M*rOYsW4RyXcP`cP|P9 zvbeLNuTKyDuv3^Eb0p0#X+Rtb?pFBxJI(SV z?6WjzHL=v@p%?62K`FG-t!XwOD1Mg8_OjAKnm6`vqrIvwS7SFG$e&x!Q}#fV_Gatq zf{>!xD_~HnuW0zJ(~Go?PIh%f>mvN58xyU5KBKC&uTr{o+s0}`fS*oputu&&_a0j- zs;0OYGvwL0T`VRE)faJdBc8+B(D|m*_8nQS>`Zqz!I|w|^+|TAh3~JIc&=Q!^dq%$ zt$C`1f*z^{%49XG9BW=c&)g;+KU7S^3%z>$Q>01QqUvn9NFaiDGwH_;%??DL6tr*i zZRYuh03-cMH>v;BCM^~{-w?E&p<9pUdbAjc4$Yfz@VmS87l zLTyId{!4=40lTDc#9V)+x}E#$mT3;E@OiR1j^q@&y}8^^B+LHj1>oVK*f!E2Jmww} zI(*v7z3a5hdI*n)J(Z0L6VN;8Cisy}y5J5&f*8ucr8=DQ1jy`|>Pi97FrVL&Uwc3* zp;Eh&Dptk(UtfKJtPfdGcFYlakOe({*Tt^umm-nk4X7QhEpF0(g#@-_?DK-T{>Y7; zUd(W$PDxX?Lh=@G1sUJlXNCcwLE33N17$IAii*iPDMI>Z5#nGf_0JmvNU8|03baU> zRZcQ|b+C7@q&=jJNXxzv*s@I8$F4@V@OrM3bpO zq;eY$8K3n^m!&v?R=N=Z-|}~v>eF9kdV@_8Y4OqLr1sqjhittE6AUO+T~oG9H}d>l z^S}cb(N&&v!cOn%3(jB2sLz9X&#kW-4o-KrFKhJTCLvbGN3U@+vJ4kbP6Kg;=*1AM z5RBKL)FzS&P=O3c5K15rpsl%)#W-0`V%u8I62ecoga38_2NGQx!CSdEicFX1KF?h4 zNWcRDhmP#cUz;*vDhf!YuioeX@U5*${BY>l$;MS~^M-Nz^v2@pqPx{BL70^{=d#(y za(>kpnjx2DVCI(B9Y%=(dE}ag$gr2ya$GUKV>J&e91C_~!`z3Ely0 z$D$KK-+~n?sLH@E|Hq)U*w)$ zl9KwF7yics+E$qb)&X;OC+5V#9O0mF4smFr;(?_47t*?Uh6~yat(r3?fk(KcJbs!P zwkAqX%$FUNq1o1H1er#&&ESt38ILb!LbKn9mCv3$(ek0VCGDkw1GN2;Zd181tg*wa z$qdC)Y_|hrpBQLlNd;{!oWLN+1`#DR*S!!{N0hmhS{N6^&OIb7OilRi6WQcoC$!RZ zK`96TN*<$pVZTr{FKfwfFc*PDtF(8*kV>zlo*uZWr?a#&ZD@|J!98R<{&eYiCJRDz zHMFg+6j~A*RmO$Bmc9YUjS8O*!SX##@t=8$VXw2bm(9BOn5lUYs!k-R*QzM~)P6@e)s(v9^RTM&p_On;O*60V}q&!FK13EKginG&RH6gur4uN{6VT>InP z+H0O~v&Kr}Z<(G|f{stU#o9TK1@#g6`8QETzL1p(oRr^pW6jjj=NB(tTxj`%xHJH| zDu6$id#>ncYUk*6c)OAa^HmO`*>h>P4^bYLu-oUiL0Fb2Rk`{m+Xlus5T^$GMiL6G zy3aeK{voMZcCpkXTkU;!^S~?S8azS|+I=Vt%SXLBLi@*2$okAmJhjcu>;|w&KV&+| z9&|S{hx{dp()vC-kn^V4i+cVCZGE(}Ud#1Q3THamUg4eeSg&>_M%xa${Uq297<8sj zuYK2PX*sIES==ogessff(G*CgPk75Yt!5ZHhZ6H^#h_CnZWy4{q0CT~Iv^kwv?b9| z#X4&6O?l_!Ad!7K$OAOVAmgH2mk&5{)6<}C5D}REPe}gSv~~wx5fghrVfN%o@cvRb zhUWg;-3iL$jlA-?cj}KeK1o*-hyy)LRQ5)dJWEYvnT95-N;ftR$4S7`GCMFmMu9W) z{YC0uOpH~^6!t|;sJ0Jg;0L6$ z$^d;))7#5X+Ec4>4vr>4bNV&>=xM+ zMR}9Ckc5(p0%So*o+L=nGD&3i+Tk&|7!Qcg+O~6xjHm_R_?wQsMqaiE;}Goa!|uIo zLb)!3Bi|$j7AJ{xSy;`{o?o8fxSDzJtruwV6!u=0D#4^EgLpbBa$g-#)+WY*wn*Oo z?(6!;jiv#DCV_AG1b1EIn&ZU{#Ljl?NP*K{bL>)NW*%tO<}FIxcL9Gx04TC*7+ZiQ zvg2#bF6J(sy0>UQ{+b|V8D!kn*2&ZI%_Aw?$D;OIBos`)wV)ySXm=pDv+6MCSCc~% z9*cJz3_xW7w5X~#ZHkwkz1A)P0pk$_b@OsCv0z5keZ6}WaR~_>O!Ccsd9uz17@IoY zS3qcp$5MRbIplq6x^#2&aCU8@$F({yl!4|wKY?g+&MP|~^qbKyu?m&8#cj)j6xuG^ z8sglb-?vi~h_w4zajzyKqagtNEDPJ8M z1(bAyExUOjWm;f-gbmX-;c3}Z{1#G{{v)o)Vr~W)aUakfA*!kXyMMNeVEuF<3EL|R z#8&Ulir3{R9vZu$oipO7s*{RLPFGh-;9Z`m)Np!T;fu?9bGdcL%-{7yOfO&Fammjv z1nlm83A=&04)Y|cL%0#_e0I{c7iv9oO(pRX$mbPP^a80ZckYK8#Db}{ItCXorFO$V z_^nr>ZI@>w@DT!z9g+{fr?(^wC*&m2?h{BIJiN{Fr%p=_q6jp0OU04^Ls7NO+hGk^ zKyOFY@T{yVevsMU=Z!d>VD=snZ_r%o(SpgV2O8X~KiolW?UJc8f3zs&qCMss=u>y| zqVf6560QR(R5fd78oU_k3Ix0#f&>q{!e!0kPt3|Xt;SmR^s>QbY>zGKn^d9YDcd21 z*1E=eh9FJ0y}DxP38Zgn-k?>>1JCsQZ=hYtN1*WNT;CdTHyv2jKjS&}n#0vlvv;t> z8`jyAe;dyGblfUNSpu!V+m+{z-!1f5(x7HRs4>9M9%N!w_9WEhZuDHss8D$y9BHmf ziUhDe?&UW%s8{3q{9f#nt?8tv3%DXg4(N}w`V@4zS%0^iW83K7X;$;Iz+4cHcOP<0 zm;*bEpbMl$Xp%$8_S>S}`EcA3L$;AV=~dec>35+j0iIHXbf-vV8@Gv1}0LX}ik4SM1lgMNlBd zpHcV&?4O5>B0$VTYBBv&0JsGNfJ_|4Mzg!GFVwdM++Yd5vZM7WD)TUC;bzuj0OkU# zl-RK*2-8$dLnUEBGV%ow_l2Qz&Zo^=v}h`p6oB{%|`#&g1E>D%_Vp@TI4C5SM%Hk`_kce0zEVNiyV{y-<{oQE;z%<`YSr%ghi| zthl+;v1PBnl2Ix%i(>x`D?s}tQGGP9V75Z!F`={nPpW5ub{O-CJwVnY&vUoqOKzPxO^9a$b-o;=C7}7k)fY!xWh! z%Zu@w40q}^u&dIe`PJc}Y%s4>2R->JL2VndHI?jkMeUHHg%^=a% zSPL%<{=&_Bcy7xY`E$pfXN9HvzT6&?t!P#vgMZ-RXFm&s>!V_O{HmWjdTu$J0H)Ci z%naw3s|#}2A<*O(di^hij-ZBp>!Ag;lLS?fPZt9_ z*(#Z1xV^`5NBzBcH*OwL1X|rJ2OGj2T9Pa&vGa>^Oe;e?&Tp@}&#V_s=Q-$XO z*Dy;A>@0+B_Q_OdG+jUtedwW+a#j7O+O&0^2@6W?HA}2uy)kRM79V;h*5+{1R#sWg z2a~%$P<{*#@pY#OlzEVXjN$NsHs8B&yKD35FI!KbZnb`|#Et3=%`ID)#>BEX zajQKpks?z*a@8&*#ffNV9y){#YUb~6gpd+9NEbiK8i@Lh%PTkg5FS;&YCH2$!bH@s z>aW)oudtFgEK8qSJa1tL?1pn7-_F~sWzKI+1%36&oB{(T~^b5%BBUA)kP}2B#KkokoAHgYGpvSHUd@JWpUqLbVm78g<#i}JX99Urf7{dFdrq> z!+a@vM#EsH(?hveVdWiDk^E+c|Cs3QWW?`}V zTDIiD%T+=p>80#>SdorPpT}~Q!WTaLm~4fRiz7zinI!*XbDS1Qjv6VqipOjNS)xM- zVe_)xix`*YuA!J`UYX^q5i4KZNgs=pQ!bSHoHd|TROz+nz{SW!i#V!5mh7=SedpAWJa!P>_4rZG zM?zfk<}4B|Co%LK{X=?15MDYc)7tDgQD)qv6*EbhG`wZJm1Mc?lWJjH2K8goHFUcj z3BH#Nt#%a{io^p6vTRZivXo1(t9UZxL+EBbnjW(4lh~o{r`KmGIV9`t+D7UaTS-|YNg0nf5FbH*UdtR| z_oDN=re*kDa#d$2s-^27<$ge1qrr!3b1sqUg^hc1UA3CkM~U z8{g&c`Kr_m8f);n3RD85_C(mYhOHl-`nW8x!X+&F^+HKqU$DKEo?WZbyA8PtSLk(C zebWyad1~2FPfI_Fx_3IGqeHWdkWO-)MQaV$5cju|rn<8&0xnd%u@FMX_+FFW+iucx zXBdtcr@QAp}G9m(nx|vW;uP1c6ul zWf^Xdzk>;1&dt4d?nv$AF7m8|B zjB=+UxA>p5cY@cXKVSDnZh3z-PPa>A7{arQhL#$u&yhldlPcmQ9QGJwI$!WD*8u-9 zUfj|JmRVTSlW!ULp?`U8vDJ`EN+_u5A%9#i#vqH8vw$PL9q~a%f*02fBv8^%T4t+5B^`S?teWG+gqP1 z7~cIRkNWaf0&7NA7A>#@uVDJH-(m>^!7mSBOGTLKZvUR=qw{>M<}C|D$L2OXu)amBj1ckhv;v z9Dh$>8)W$_u(_qz|NK2qDff6+R~Hye#usVC@q3<<+dl%^@U*bVZ}Ar|_-M4XwLxHO zG(G!!MkW?R{b#IzJ-fTT`#m%62Ht_l2G=T!Yd?GZw}j?XFTT=fqa1-be2p~G`%Mdd zc*a>V(^j@x_{=`m*}wF{O`E>OSbL1;SCjg%A{(i%N_&#eymwkQMgkbWmX=EN=)t@7 zi~=Xj`#lU}_w7cTt-u&-^ELW%dGH`F&CCK!<+(5De3fp!=D~@Q!;)h*Ho9cHi zXbA1p%R(ZfGxxM37khik78cQrv51E_c0l@3N!f%&ewW9f#&FGBrmuTDjJ1GL77cOclx=0pM)t_|KrM3nKw@yP z<8f%mIV|{Q``AVPJ=;zqBnJ=Biq90Nc=syt@w%d~-3$ zo$fdZy=T;a(AV-}t0(GZY2`vinFB`a!KlIXT3y1Su_+$LmcS})$rtLf#6)MKi&aRF zmoo9+l&v#QuTl1qwbMqTZRSGchJ-4I>(*csx-FD$BD__pKIA-;|}_o z)Q9rDo2VpV>_yU;<2}Zo)YoV4`J!(R@*%5Or@Qz3gT}tlwY^0VrZSU&2{jzSReBe>4{d8M#Y{7f0p0qw7us&=NZXR%(?ilaBLP^GBu+1MKrENl| zi@_5vT!X9jqSbohM3tS#w=hE*69dxD6~p3x?@T_;({+V%oh4vBF3(`#kQoejG(&j> zl$@dO(4C?GVkKj`{0BYu?XWLpHX}igjgJ4OpH2Cwmli&}`*} z7}>OlYY8VlTIZs?5*@bNHRV>;{7}4aPI9tx%DBWDW8?Z`?@XPPDYvKR*idtegOmG3 zy^w_(^z8C-TplAI_&tOIH=s@pEd3ml^%1N$(?;ql7cfH4{B~M=*688(q1GyGFTn~( zLC6wC;SkjID*Jj)N===@;7tr=p|Tvgr?@nyfC#rnRtgW4B*?D!!DHee%*6d9ZZDjo zCINdldO>=l?h*qzmt;L9EIZ%wc9xQrm3?@lMUAn*`{Li?cXMw40&XZX)BRO@Cq-90 zH}}u2xe{VtduHdWz}e8P$-z6Gxg|P6QOYb=Rbo$BB(J6C@E#cm zJtvx`RhDDtRo6B5(88g*Ls^Jrx_fB7mJL=nZIPHDPTHv)j-Qq2oP~LePTcXpo9(oQ zi}xDlI<(A}4$EwDdHS$sxYZ}QE76h@{C30iDIfhXf?PgR?RW5TPhNytN69Wc@;KUr zE{lT?r6W#;)pPmXsBBL5o;!1F4(mP|!TVyhkDwNuj_?%Rb*j!?n%yHey#TqY&rtt; zxte#Z`52)eTbMWMU^+Gf}xuJ#9=dx&e#v!dGv zj0h$jyBSaLHOfNR^V5SSoq91-B_26d%j$&}sx@{JvMZO;1`E?%!a#nzGi7k(q9Os1 z$6N9=4Gh>r1bTQRG2&?+NlS!l-~-TS5GT)b;QjXC{AEKT1p`^=gv847u~zJGFh zPPTGj7Z(?IoD)_uJ?P6@vr+`?iS=@-4HM(Ya+nhy*p>+|vNu63uDf}-3_4LtKm49&oDZwt4>f+yQV$Wj** z*<#dvGnhHChg7IwQ5nSLbgSWJnGb&TS!?Way?UaQa9-tZTKQHy`?59zj*PcQ_F1<< z*}Ep(cfBZh!YewV77{DYdv%Jdo(q0ACyB1lx3ft z^4=Ze@=19dBb1VlEoznHrN(U^?NLY|HwR<}0jeW6^2fdhakbn>!x0GLE4l21q1!QnNhWC5-qz%ndM@urFJVj{9Ue4|V(J&%+Pz*k!KIX-u;(8RxY3Xj`qn3Ndbo#5G0UxB>i zc7&yv3^uO!TT~Z)j-m~13KzyllLk|riG9<$vNh2LcJZV$2@^DjHKAVJJ!-qjjm1+F zL(bO%DY=Eq!5{9R(@H0hkyyLTT~JoT`ygiboRk9=F>AfB^zTy0?G;x?;0RWR=}6)7 z>!!dJ9GOm~JVa`7$++lo_)I+!9?31E+ez0dpPs~;w@mkOx=(3NJ=N7^yO!wj6kJ|% zt-7Q)o|#_Cyg62CHQ!_`fKlNFM=wO33e;M5fbYf@}Z&T3SB<6H2F57NmHsvSe12zeKoA9A>$3UXXBmWoxWZc{m6yKc8 z9Ul~T+YgYJxbYm0ScA7f;;Hdacl$`Y0Muk)XhrMcn)C7&CMzo|wyF>nVcw#5;_snN z(dTb9LfitByp95KPTlL2jdQLeRP@VyKBlx4^%yf*>SHjI5cbf>L1`Uw`6%PL^Nb4H z9&UX`L0o6SWEoqh;6Jgt&-BNf-EtGkeOFiQNcmcpiLgvK#ZCVgP8;;TOtPzH=m`;3 zQxMjG4}>W!Wc2NQt2Q3_=05g8Dftg-aLZO#!1+>!rFLIy7VYc}I#Q%&ekwW<5?7%K zyiyC)s3nQxIF+8{s|E^<;=;X#EkcBI5cb!kyhU5%64>?#^lQWiSbB)CGbl!v2^PQ4a_V^q&W=mZ~MmlR|!W8v;BhY@z3e8s$VZbe_u z##xYtO)^uXUks%-_%3aRAP37$91V73xgZtw)r>gKYr9LaQuAE|x>5LaAMPMN~=vVI*T2+`D!7Odf+Ow{wr#m!0 ztY`T_>F|u8aEHkjJ|?&M?OMmHD?q?n5fSNPzs86;OW#5Um+PY_^b+#!sSAE<)uJ(V z*l*0cD$`ob3uNq`D(&gqE^i6D{g`X%wVM#@)ih$?Io=Pj$f#ERDxJ(F@!-MWaLXa& z5{Ala0Hy6|x-Xrix~QI5iQVDMt{rJlIBZLUG>NUK)UfC(--jWy+;|LNR6h?Q*~Gx9 zT~l558iukGYKcUoR2p;8xbwv=eoKW2GmUu8P^&x$Q;x>ej^yn_LQv zPyK|7w&|1w`W@E4P=RuHZ*M&t%;#LdQO1Uu&e&b>%kS5RaTe|P+`{!3*yAo}3He1l zLwnUxu`IXG;uE(p7G1-O_^y$iqP91+Q1{`4?)frOGPTgmUYwqE#Y-R=9n5}JE%9uC zvk5z}BOQq8&tG>|C?r3<>*+TuGzO8rD8;JfN1eACkeIEC+hk^r@->|Vwwa^EydttZ zwk^-Q+3{MfBI6JXNCX6~TMFb9wZ^v>5sg((QbBP6h>rCzyYeeIPm9Kbf2f{p)m90= zErTzP2WFVx1=lqm-dKv<^U27y^hFui&X1Q`Zi=R!QGFNp_tEawr?n$#7NNLRj=>1o z5^CgJP1FM`S5~`)iQdi>HrZuAEs6O{S#iCQ#@u(lPO~cVoo!*)=f>FP0h;dlN~K|U)qv5bPGK%{ z%|l_b>wj#l54K+sdIE)NXOQ|Fog8|4d6ZaY*xCNFS0U^kU~LeZi}s@C*QbkA0kxOp z)2W3IX@mI;*BxU8?$dcipsXGsM4KUqjO){zUaNXyN9oV@eVT6)!V1oXpA$6?{vMP` zDEq2hdGg$r{t#S!Z_bcHD$@o0G_iaKfD0Tucr9uP;R+wu_;w36#zM?0L#vM}?2R?$ zV5GG2Hp;aC;~GxLvhl-t5(T>KtJ>A+CdPg|;@i2bG4i~E%xvlr7(M*YUI0>%gT5`H zJW!-_`or(xJkD+X+CmHzdxEc>4>{*)li(L2%7k>b-QsPL& zFT7pZb#V+Zi2=r8vj?E3)nizd=nb|g9V-LV4|ahw_gMAI9}5bC>cBW_vcUTz8}QAE zl>BdF>z2HJJ8LPAOEv20&&%=7iL^8ogKzAt8h%@PaymYDlRj;>MQ{)d6TCju_^k~8 z7I@&#`7pzcHpbiWA%X*i3Yx*;+E@QJEdu=2O>uC%i)SmOy0$uXz}IO(3ftOfH&Cds zvZCVczp-Mm*|V&|MtAoL?QU=m>XerBJ`-K2n8lS7xykjulwH9rXCtp#1CWCsg15o- zwPyw+Y@1_+1MM~!v3Kr${jsv=C7j*wQxr-k02T?4M1M%)37i`CYI0S5HTLG@PL4yU z&*zE?nVx6Xp&m=Ax?{jDVa!3e35v=*eDVEfM-rORblA77H?JK7uZ#$)+8Arn-$_fb zW2Q3gBIOmGh?Z3XD+F#cZE&1^D~yN7962qqAUYCsv$$@Jj~{FJd4}py!T0`}j}S`v zg=QX!EuH+)vkXsP-zD`v3tz1g^L^9dNWzeP-8O<1csZveQk~VQYhuX{)vPVul~!9>?0mzil>F<-hlhH zLh-sR-5=#W>-GU7W1)w$Wb;my(8cUt?cp6Zk-17;88A};E)hjdj-tuKcvC&{n%@Nt zgMnpuf{T?_ftuhH=`|tTZoOpI-VZ7@##q1BvXu**-W}+!Os7oR-j2P7!w3M6r<}Wc zSX*Og*VfjSetuOK%V;9y6nCU-Qp3*OrLh_xO1@FG2?EX-2D%|hYv{oU^8k*uW@$J) zN6h=;%2D}y^Hc5mD1+WWTG!1x6$=D)xg@+m)!vknGMMQF^L724DD;k9QqT@FvA%5= zK&GM&D(dToI?pqFc-0wPW*RZGG8n9&FAw9Ng#^-r$VjIerg|}K^IIv4j$Y|QO4p6F z`cE7yV#z(eN7Kz8Kb*&Ib)W2az$bjenbarN15m~O^*%fjy--2HND-P9%>F;x-aD$vtZN$|aZm?r zqZ9=J%UF=6A|N$3M5QT6Zz2NHrPmM{2T`hu^rj*pT?jpp&=C+qZwZ9nLJ}Z^03peD z;ylm#e$V@UYngf0&%cxfV($B#v(MhwzOHLKWov`;BSFE#M+Z8P1Axa@Z@1-Gt~uZ` z5sctnY!m7g$kpb`rEN@UyIcNspmC@ungfqy_&rXBT|==7Ca%GAlB_L`jN{k|gMGcf zQny>gy2Gwc>pWF?al>b-V~1<6CM=@rm1k2(GYeT{r6T=w=fcsCP+AWTOlWre!l*Jr zVHjKG0Kvk%=}f!6w(EfKp%7s&jR3|bzmfk+RHV>cSW4iYn~14S1RUH3$nEp^w_{0) zlCa1d2jq{7Wv+;LuKmVJ(r$m>duxp>d zTh0TS%XI-4ECl>rD>uyfj6Ru|4v@Bo{Bh5%YM%uakzHU0d*Fi7HX0xB*LD*RFPON5 zl>>mqy)3CSrG8IViBnP28Q0zpSVz?o1+g>9G`(^~C~)YS(Y^670AI2iF#f#MQMY!@ zDbR6{@?Efw+jL!mQ-xhAGO$-30e&)LvLjC#uB^wO5-`vv2XZ}DKk+I=DA2LhN~&@L zJKvMx-ddKe7wd4Zz*j)qLFKtFf_c{-By6GFQdboBUs+xjf4ABg-TCCwHjA(xspz$p zR(a;EK3jZ?_qPF{bu#>@p<_p>-giu7vD>Kwr27=HQfDo5oPk+(v<>#h&{)v0(Q&9Q zNlDE7km#pEztpCaIrhZ{p0uV%1*&CX>wgo&7X(k(HV$}xkaX?Pqd!W@FF*HJTL#%{ zzUxG;Iyi|_`DOE4()Qw;4)3HhFOU73UcGI{Y9km`qP!w8715G}d_(C`?+jy| z?5(VEWPpza*99efc=RLC&6G@*<9)GDQ22n-#%=v_D#;6wi7_%yT&kn%*PLrMN5l_a zEakPBdi|UlrA*y$^7@K(M~{woT^^7|U%8kR7I1@s^kQ@rPR6J2M;oYVI`!HTz!OVWVLE z_53}sY%iPfGnw83CjL&KsW3p53A6#H*D-*8cP#BNK$P|LRQsP%Ukn(`*fI8vVK;Zs5k)UY)?LxV6#Za^5M_!e zKJ7TlfrC=bGyn~o2D$ugo_Rb``d3>N;uuIIy>uC9aX1be>#nAv{w`hCUt|j2xTK7l z!KR=O&3x`awru!Yt*2nzNZ)XRGi~7O&3}Ildmbw$=Px`5eqO$?*WExxT_b92$u|#u z2tHS>g*Mw1zo_g7XAEs^Z5>ewxGDRZILebp`+Vf$WZ3Pr=fE{h0BAdo*{yVjV_C%T4Uewzc$YEXbX&A(*OaNQ`NKGr*A{(C zod4Jm(u_9WolXPe;a6K`aJo;%K{vvxn>gye!=5~o3%n2$3jx~HD2EFaG($-8aC_tV z7EDZR`}7O0RnFRB^XYp#&*hdqO=U5@r4_|N@B9>0(8~ln=EsEJ)_#H}rnra2poK{&tCS4F*r|+L&D(=cyW-*|J&=a!Z>S{c)ny z8|1v*Fg6#Pe&8_?u9c+t(`14$$_`AL5B}&~Jy&axFV3I~$y2 zr$G9rKNEEKZ$6npcC;-U_s>6ng5zC&9H67ev27fMiD3hA`sZ8Wz0TisGQGv=qjLYn z2mJ9XD@nborx)`JYGBIiG#gw0pMQqW55BX>VidfaHQC6(6K69E{A`)qjP{|blyfBc8Wy6E7o9#Qw236_5c&3uftDc$>;4uH{E%9>>vqsR?7EnFJ$a~)UNvB!#9-tW3 z7RuC_h5eLeKCkFN1%Z#8>+dvFkb=B;KndUHo$ehcC54;Spe*=F}DIRFRyy!UE28$^wNdL4ip zz*zn7UFu+o*#C1bgo3M@tWeRGqH>BY`rki&2-cnE+!0p!bMCW)pKk^Ms>Q)^gIChF z-+syxcP(<1<_D_sv!jf9(#z2RG{>8>NpcEaOIO;P!PsrsR4Jggfj-Cu(Dk*7=r@P} zg}-xbgsr}5{I$)+rM7bSKiFGZCj(HbmtB+__#6W{!1{NOF~7%OaeV}Y42opSKYsl5 zK!^1dVDgO%wyALuQzY*(9%X+?{q^`oJbvm!h)7tR1;e{~Z8dk;cfi=4V(8w{|0q{N zE)2Zjw{wi~hNwxF83Y=_{Md!0IV+-jenIWnxvSXNVGO!RICDA@Mktko&pz(*kBNDdn=czyIhTr9IWZilzVF2WrqULU zd9QkF(P3o~Wf2A1T+OTP5{FTALZKC_@%faf4G}uVZ|3Ivyh@aC%ztg7Xt{ngk+533 zGpZ3xFit3SDJKjRwKhYX%1Ervg<`( zJ?@b0uT#VB)%C0G%_{z+?w$sLH9@7vPn6y&q6J;{zm&rTh{YN{T3I?e^pNgp6(OVV z)K%_dTmRQ@!=)DJV57`U;8A)#556wYji9y_f&RD}032PZ!^mX5>Wn#h43^C3Q7@dm zerqnQ-vBR!FM#VimUO>>)9Hw7Y~0F0@+M%pd&odRtjiBNLW!3RfCq&8rCxnVRz4}0 zr6ZDaih4Q5#|7dGGq?9VsX0{(U@0V z%HVKrzRBS*ss78`&VDUr7#En3=VAP#AkNvSeR8ISOTA_uD>HyyCsB^QTsHCuzGQkp zdDT#9dwI$TV_I6;O?~-X(9~)Tw0|lra+HcmCyIIty`FT9jVLm==TKY|P*IJiAr_8; zqg9eT=-EZx4O1>_#mTRbMjX@2ea$pa&C&-4gUEV~I^pt^^@M$D$BNq8#8fq%G?kLL z%@GsLCR3ZRnj=}MUS7$*&3A&QbUvKk#R`_n>q^HJVF3NN0+4H@h*Zr38y43XehXE**9p+(iMe7P;j0;4A4FMCJa3^-ysMZiFtMuRGje) zi%AtoBl5CB*sX}|GtQNSNS}$|xT#6?f|pv{l1DI(aMkCzJRwv9z}qWdH^`(HAXQRZ zgQd?5X1Ue9%}Q}~PWEd1ZC_-PnYWfC7YXCqqEfVimJKH%X_7=d^WOS5bN|tZ?t)Ql zQ410At>9N8JBjW4eZLvvY{9vAIF?Tmqlei8KY_U64_;cPIJpy4)j5uBn~fDUww8c?>`3M7d@ojS_vRveFcontON-maX`$t_3sU0Ups@qx zy01QOLDkmQQV)c-u;tpkaJCr$<0%9{CCVuR#DQj_KQWEKJjFjtr9EGl*h>ac`oSI& zf)eXswICv)_r%0EBkks3f!U&|AU61Yk9E7bA)vzCftPkK%|uje#l2 z%>p6J39+o#D4s`#_Ub2I#F=~P4U{ws`W`WIc!DVmvJT ziACzizA(pvO*F2hw+MUd%u?b6og*xmD2vW@;ou|#cB+;5)4;t&6@;DYAPO`CCIL1N zL1&@VeQ^u9h2_75-YB#zT+6E4U?b?j4ac{_)I+E;!unh*2;yW>L~fP?6A)=adAefF zXPiN^`peV#H)_Xpz^xG@`caBY z|FJjS!Z}h+#Qzc?vl?SF9?MgFr@POd_U*2wcvX{$v|(SyYwi=@ zLZ~y^)!X2gIsL;C1h^b z`M_v2NU>Gqm2D~re%qCb-=wvVdCdn6Q`7<&s-MVZkNvk2V9g+VdFKgc#Vg+xe*5Q4 zC%w1H2;+=koQbt?PIwEHJb=<6T9WdPTU4ViqR9lE8rIaUCY-1@>N;n(qIuuP$`y6_ z0G$Lo_nqAidaF|`IYTr0hB{$&&S_&CdkC#W3kW~5;*0bRB`tVQFJv(j{E5!55TpeW z5>jsAsHkTbXz?ZLxfHKxvq)WSi;Fo!fe5GK^)+miAVfthOQf(yWx@Au9jpmF=6(~G zQeWf|7l!TC4@w9=B9Ip>4fK%uKnUv}mvykWpB%D^{JN+UKW$Zc;U;^Gt_09V$Ngc% z5?HyG0QL!Bcb#D_D6;H+sQQYV`fNd)HlzUEI~AOeK?pN_W{g7u_9%rb#Vwenui{(oFPaKy>Nk2h`fpXhHR#Bl zIc5B}=trZT1NL39*Qa`7`E)bJzvy7P)r5e)&4)(6M!V%FQ_dSw>PhSq#SiE_w@rmg z>fAFD=moLDZ1s@cx2CY#yI$vW@^W*-#Fzn2`f$b;zENA>u;8<&+e)!m!7D)7U^T9- zNH~IUh=}Xbbn~r@fX|ju!lOxl?VUxe6Kiyk@th1^be$rpnt#rsON!fG++*v*7r-b} zMTMcmKr5=%-q=1)L3?3yc!D2u3wLV2^Pz!_2J5M8ka49)DPKgH_~4#Cr%dL-wIVC$ z>^J;}^6}S=(q0`_XKF>IT{z*Oo$B7NW!~1$YKK0M#C~y?Mw?C4S6+AD@vaGazGi#; zMwCtYm+y*&14)6lPC&5$#|5)m_)6=W7ck8pHc|fK|*WkMsy(ghlE+aY* zaW4c50GT83uoQCbF5e69dCQi@{Bl!4b>@@odRGzX+8up!e}c?O&M!6eb;Qbu1K>u; zZ?|g4M#&5q%ESUa(g$Vi6r}3$6|07+ z906kNkRT*b=b4$kfRfJ>$(yb^S>Q5NScfbxJ38xVx*5Ai^jp=M?3{XzH9h+rut#oU zz1qPndr;-=9-Ay%4;DL}niT)bl$!jeHdVr;YWEEEc^)RF+_ zB*|pZjDT=F(F0ij2P6kJR~pd=Oq^7jj+buN<*u8HitPv4?pyb%N{tAqnr(Zee>g~b z?;*EF1i8@N|CTv+t@r7oZLaw(R09$6wY=&cZDU7oK!xQ?O$(D$QuHglWEU>_euY&` z1;#PtS&~zqQ~dfvpac$f$h_{Sue&kD8)tTJ&!D>3LWTO4Spug{W>*bMO;Ycgn?Itc zZ{*v=A~O{Yj_qz9t9;scI&Pj97eLm;dbATRJ{?zN2{?;J%S`wq6O2!AGE<;LPNQ;G z0jz`$Y#NZM({orjOKL_ec%k& zlxyRljI{-4&y)kc!tEWdc8ZJf5F3(cwbOIcS~C#4rz+qc3P&4Nybru`pRU;dtEOE0J)HeY9!4jP||HCt~nS~leh zQxEc`iTD_rQsx4?!POBQn878gaY4kdj5Ox|Zt;-ZsE5hG*`uExHpM!Mev?F{c&sM4 zPH@_)0S(})9xJF`A!+mTuLCK9!8sA=v?WUqeT!?q_;yg&^P*jjkMRO9;0V$u6C?m3XK*g-h2Wln*Z z+u^gGhHkNnQtk%>Qb$QKAZXbpZ)Po3iX(9z+mm5Ze1oQ*3p_9b9n>UYn_Ds>3c|RY zyXfCo_XgSI={1Jja?^QeUDd*wxomqk>*G_vPj%5?dHM|}G}W-vE-xv5MuF$-ZU#oFnxTad$Mep%TW3&&M+tgL1IUuOsz=g0g>&+`<5iTPEFZ5dUKX9Ss-x$pYZ zQoIFAq(FsxyKvG8Sk_$hS$@q@JN`??G2hLUc&BSwX?kVMI?ntca5aeQ7Xd6X*9B{X zrijXi2p%pfNC}#~FwUdn@slY)P*tUoh08E#<{*2A11@%H1^z+%CTC!_6;~f(HYadj z{a)SIrnpm4XpTKn?GYCtav565ds!u3o*mGXIULlABQfttb`jAAnv2mKODx7c?s5|q zSn)R1?I!TkC28)}TcklN9DRRezT1w_FfWTgFesox-xn#R;<9DaqqD;gxM4(4aZJFy z2Vz>TnQY!MD2bk@Ue!69PFq zLwn%Rt)p{II}fPn1l<0R{O94QE2{@wZ%O`AOgqWVznCP3^&ndS(35`3K?S(M3Vic- zZ+YNH|F;lj%l{n;HTg?NEFMUwt5=@IpU*F&!Q$*iMMaXetXUciT*S|@l!Bti*lAYYy zi;d-Tnkn~)RF_mK1X`^^$b2nya?~3K$eVtr&7l;E=&p@XI@QFz&Y7~(KWNeNY{$;2 z;`YK&p0Rb7+3?2sT-t$J)E|56KE5yJ?5he5<=`MXjl%WtV~9wFZha@_!2Mj$@ml5F zf&S3YTw}FS%z2&Cfu?)O_lEB znAi@CRe8xFDKidXp`<^5XKsY_;{U41IF7t=U>G7P=;x_KULpfAh)@$%H{eecWYy41 zD4STjb6wK8t*loj&3C|e*oztX-I+u`3;pfWh6ssI{J& zk9v}M#ScXHhiuQM-|x;H4ByQJZ$|PjDxnOowE`C^k06dBS_~|pyxI`5Y1va*vJp{saCH2wzhR|Gq>zok!DN>5yOwiH-FI;?ey_oTQSUk~<#$Lk` zfsFX=Fe8q0L$ibPYsxwTKKaJf(2URnpL=Vh$JHw)$t|^Qwv0=3*dM-5;FoajEYm$V zR)sG}0K%;E=cM-C))I;{WO?3>-VU4b!dNlIZ!Rx7IERxvmD4*{@VOiJ5hB)_qK02! z%>KJxCJy=6jGkF=UDBY&9(X54Oy*d9G0QQlV+5-ywQAyxlLEh=R6`2#q4W>J33X?M zbzKfVObJru1)d8AYXr>MR5YiM3i%t^=soyId&4~n*Q0M$5dz6t`ln3J6?eF-ovrFdn;I_Nl*0aSO@Yz$)JDq5fa#tFxS-f#6BxzsJ3ttK7TJ2HpdCT^nU^t{p7YaBJ^S zvv?BSV``TO(w|yT`K9LK%52i9M?mj>UfvlTCnM-0rfYRdL@L_T%xl;hAan zcu4@$J%Q1@=G&X883x8(@yZP%YQCN%JZcdtYvr6bJM1!@Y?I}IkNsx;Dpk2^?)nb( z-Exxa1ka4Az?G)B(>u3?{WiKCQ+3klRGeZ>pD0X$IeC4Qli$pEsMF1Q|>9WNk>6`liR z0soH#HpmWv=Ykjxr7!1FKPRX6W)+duk6wOq6;!2PHZY@9)|H;dS-@*yqNnG%O>v<< z*2{Le(H<%$ndT{^?C0pQRN?dd25>wf20LQG={N|)KE^4%(CwAa3ZB^~IXg#z?tG<9 ztT4_|J4V!0B1VsvXS#=!blJ`=*_-h?FA%V~zm62A7{f|H6Hs5X!HWi3Kzjvcm2NR; zDI2p%ukIgv8VjjUazV!6!g=*g3%;b_;#Hu2rmi!k!^ACozK~eKy>e~)WY8K7ysbp( zg9j5v1VyouP|x`;WY=0fw^Yj){}44*UsZr>-#=YQ25A<0E9+iaz_RhGKc)ZZ?Ag?( z9@~yB1g@5EE&0ZJ;7vZrUY{Psrua#flX#tP{($kBZ=QALlpkf7`QWnyIuaUygPy;Q2uA%gbJY zq7bI+Q23KX2Jy?a}JQcAuJT%Pk0-(%#U- zlASJ?E?!pQABer16{-HXunG3bN_lmDs!1=HKq$v3V6=iSBUiEia-G_v4PXWaWGTj<(Jlc>_8z8bfY#UKyD#<+94UE5 zTq^0^Kb(@$)dsS{s!p>pH#{M@3b-{Ce{p)w2Ez8Nw))T)q|5BvO^OjKL$!tCzTw2U zjUC*9YE9q#Os&f`|9CdGLsto>*HF53-WMI!=PoBHqn1(n`-n`ahX(hGzDd5eSB^AV zL5f)AU>E?d;Nd|tSk2kaD`ae*1f^AK#Nn%F#_=jT6(ffCBl_N$%!Dvc1A%)YAxZ>t z!Wls?FnxxjtZW?CZUS3N|H`z2Lt%nbR#%zaSb!M+XCSWY?_cRw6KT1xmUbj9P@w?y z;nQ7kDn)g>@HTp9_o~Psq5xi8qs-WVa8KB0Hvk=yq0;3t?4w>sW-ClZ=*FV-ag!W$@{jx(5Z7>&;8}=Lb~UI2Kqk#3AOh1~_5A&`8S*oI(~-Xrx?9iQmpt z<;j=g;!CV#{K|OkDV_3R$%Re%jrUNvtAQExhN=Ik=0)GtcaA{$40+j$-mp4h=$4c( zC*`}%bJJ%kqWl)uLk)D-*EcRLE--KXiK8P8Fxs%a0u_FiiWC|MLwp5upXyqgr?K+7^Ol4{7Qy3!^R-dK8W;-L0k$r!M=CM~ z-*BAMeL7izRzcVENr9Yvpscl7@Me~l5dVW+RCe@L%R5=3E#|KP-)m@QMW)cf4I`Yl zy7*^2?R=I&^AfXdeG3(0|6}j4JqP1=bI^qQ&olgbOMHm07NnI&-cx2#pufYJwnEdL zic>o#xFDCE3hmq+Hb6?$WIiqLv-N6cNv@`vBf>!J65-!>G!dFnTQGSL3G(;m4Fu$-uN?A%^ugiJSt3h|c{@~W7pw~IY8uaHp0GhLbo0F1oNR)O?~R*T_=B2vz_p2+HK^}ac$Vw8|O4Pxmdqm zIyf5dlr>)dSX%0?@iV;~kA)slXB6QDXghbQ+DilLCsbVs58n1ob1kW9?yK% z(kB%YQ2U6Bh#237TlMQ1v@V*IeBPv~+git^rbTNj$gX3j_=h*v)EGvrP_QxTq8<5s zKeoI}zq(t+n+RI!0%C<&M1=yPc`8crJYrU0UuDW#_<@?WKZo4W7LCR2lDg^g%IOP7 zs}`EY(k*a$4ka0Q$0wr5xfhXkp>#j-Vda9F+2Wxm4HPc4YE{&l#wRNMby#P_8YY*$ zLO4PKsDHs=nv8uta9fr!&nD^G09B%b1?uLeFGZBA>1EBN*2Lu^4$3kQ`lO&Z!PFl5 z5=We|efB2py4fi8n}Jao(kZjUv+$ebWNN}_Df*Cf zZvqq3b26sL3eqZB;xH&lUivdjD~T^HVAT#dtDXSZzZ0vR;xm3S%d}X-7q$QfULX&| z*k@wC+p5*^gXs+^;K!{1a3sOrOzkjp&~#e*D=z~LNq4sra}y13edyIJ3rsVCCVyj_ zEcJ0vM>!qf75k2^)==*-(=Kgh6hD>>&;PK?$_=fRI0wr0my%{x(|?K!3OmcelQhyG z&5`uWCbn-1vdj=79eMr{Wv*#Z;q+S(k^2c4HBin8ZXeT3RXTkuO879a;yW=?Zc);F zk#O1ccn!Z=)X~Ed=Z&XRUuo?V*-%~&Ag6S{N$nFh14=G^trK}Om9{FOskCB8h?x%2 zAV-Ku$#c3L2&{Ejfz_SG4ArwG4p@C(no zq>EsIesXQIy#h(qq)skuBsfgHOlysyo0t1Mj%_rXUR15(xjedH26itG~uRpW6b2R23 ze>gUNJ%E;Ozt73hd1mn@gdIiXfANs_qOKEP9W%O*3CA|D-^79oz&8ZR&lw zKSj+3UP|b%ZEhHj?a-@^Z1k`Gi*OR8!_i*}&OyfGK6aY_|NN{3oeWycIlm)NRalmd zJ_}p>@;@K*>Ybp~P`4d{r>!6Sq*wGPXb}X{B}+EE``Fl%|LeMbcj%m$6gUN3w}gJq zDLBXXIoVvaw(v-!>`(d+PTw=X4~7KsgtKSB_m5Zkp7=d8Gmw=2%qP&-Kl5{+Ku?cX zB2>(gt(@*F_ot@QbE)3B2fj%_pyXQ}!6 z8ns@u2;9_D+UPp9vMN^CL`I`{fC+MICwx|5r&ZVce)Y&ZgPz;JW!=>C)N5T2m|@Te zykdoG(c8`wp4bZX+3M@J4ad#UnYnjk8HEhw_a}&&!DCvYL90z1ont6mmwKMMSD{+&41|(vTI^?9s4w zT(-BV{cROi=eK%&OK=4=ms-w?Q6u%-=YXPMU%Ek|u(S|u#=xQ}!8TQ}S4?cGaSFx@ zXddU+AdJ5Niz7HR!EtGgOt8wA+1-z^@|vvy9(%$JKx3!*DSK;!;Sv!$a;XtWs6hlU z=Rc<)S>#hQmyonc!!ePsfG_*;9{Jv5B~F+#TU3%D-ED3(0IunVw)3r-%OAbqHjQ!J zj2X1)uYna`Kju@bQi|YN7u+&WOv2NA`sOQ`jF8EhIE%1yx54#j-nghhx_*R2*@m6? zaE-}?@m(h%(8I4pwWNjv@q>I)SkO*erCy8+%Cp3&H?!}cCwsen`x(bRv*-u3L$)QR0CTGL|X{^gv8!w;*nTlHZ zdMYYL$r|APfF>gu4zTk9yR@WDb#%vll)}X^D78kRMUywlvHDuF*W&n-uS^r|G+Qc` z_P)MIA02$a+;1iAu5kGWQbuJZl4rl~@(DFthg-BKZ>1W7{7*#-_LrU2~7%-xtd_z`)F!p?Dmzt}TA+ zuH;v{Z{bg~_{`crdZI!NpY*OiDb?9jLe*ZhY6cTJP``WADXG`zF-ytQ5puYk-^UDa zLu*O5sl(LQ;`6rd(pGr^hOTf?riN3;5m z&_Ix9S%puQnt6>})HllTu8!m8IOc_3K63HVW7B|E-lECScGjig5DuN6Py-B7(LbD{ zM!jD(@mq+iY>cN@Otv{pH5`Bdk3+~AXJ-4p?p%YY`k^<>z_Vik?l%k2p20MU%Y07B zer>NR-+wuZ*1zv*Nd~N-S7L=#Di~&WJs=P|xLo!a1GemGZhkCI!SD&4bJHv?cbMn= zYkAXmNo1f;=BEigHN;9Ul|AV%ww`$4E)5gqA%IsR{+Ft-Z{vyXLQ>8}32Hl9xT6Eg zm8?NVbzSFHy_BH0+3w^G9&r(`sQCBEc$Sdb@u0`wj!9n+<#i)vz~)keatkX@Br*FK zgNiN%heJ1_urzUzvAFszAZTs5jh+W|^S2S2=-CgIuRD^QD~ccQv4v6#QrW3gYX6k{ zKFomCAePIegs|Xq$ZtBYbACZ_dIydk{b456^%o~n1!k;KomJc^q`|CE$b=~=BaiZR zdtvyB=DW#Wn=M`Kg|7hJxT4cnQ0JmD{|hf*qiJIXnrtR}5MnZ*d%@7#6N>=7nC|qJ zx53U}d^=N%c?0W@+qqJ^6ILi!E0r>3tLSWSL@qZ1xYkQ?hp5vfuP~PkK@%kSgrH0H zH9k`>mg}>g0q!8i8LkKVAK6`uZ*Vj}ac&l3Aq1vECtNp4)6)-)6yis7685!TAJWZmLB*48H|NfsS1!PLLyE@DoJu{R*%=KPc`EUUjl|so-+Ln z$AHcP&ZV?s1djainq_#5M5x6Pb*sommv}Sn6;-(coU$!vI`j+RG zQ+xIwcum>Sr?;&0A-1+-koMqnvkkOeX+9cD6%De%=^4K?@SH3kRM~AyU7HnjQ3d|e zTm-O%n7$+w&}gW?Nao+UYfbE!cfX35t-Cv5^ID^^;I`=qzCOT23Ml(&e5$-_ZG+xi zs*anT-6C$85R>Z42i;nm=6F*(JS^y2`2xF-`P^I={}iZpEb!@o9J8f#a4gDXhZfi?l+rKxh1q8Ru2fZ2pOD?;hu*8}9c?3C2+jX;YRpu~PVS%2X221JZ; z<>QRcpFcnOoy-{gB2{5dWTS_-T(c*@b+Yg61hiCJ#dT=yHgwK}J z$Srg#juYRps037hYJBT4*E_V7Cgu~oU=vMo@bxt3s{0Y37yLer>3Hh`PF)IReD*pPgJD2#DXeCm!(TusBI4Wl!RV#M2#Vf`n$3j|vXuYazCiFB!M($- zNl2Eqa3*+EPOVyRC>4Y)Rt7Z8C~7%&e-EkM`}Q?hR*IKS85pZYYJ#JYuU$fOau$82 z-?S9d^UFr^0Ns|=W0m_QMH{7pTQlCyA}hXiY}ahBIt+i%dHKlI z$AYn8!pnISDYJ^(Tzp$Nx4lxI7dR8+4`jxK2gTYs$tl#HWOLl7JJC~}inhOQ00pzN zXKDw}<%C7uJ9HgpfG^#`rTHri6-~&z&;%?nk;=j9`vE_oj24F>wHf%c)hOu71LHBm zfT!$t<<2tn3z8K`cwh2;jmXJq`^+>@m3m#il=+_p?f)}6k;|`cbyVw`f3{y%%|u#Q zTu|my_8Sx5DZl+?r(ghaGExMpbpC~@o3FlS-b`u5iSTi(n$7&q7Ax zgeyvE`~7VTN=$ZdCT}7izU#vm<>GUDolEr$MEm$%#1q_aTe^r|AOS;-y%| z-Yc)`*ZE8w1<=aOM||S)Kw1DYU$YM#yM7qfL4_YQdj=@}!jG0CrQA@j2e**hG#qfH zz#qsbwL?yDFFF{#llojfi)3S2H8meDzRZdD(eC(C^#a?_XxVGEn3S<|OyE+WGws1# z{d%YT+@DJqa=`={Fu5_;Ncd841p(AS>7YW3S)v6 z=d+k?3x8USV-WKy=#i)<7=w(vJt&=JJ<@mdTEMAW;mP?owr8ZgZRiMZk^o3=@rWX8 z>tI6hN5XY$=Tl~+5|^F7;F#kLlbJ(6Wm!yDByOAVg#4P>23oHXJm=!ts_=O+HJ!PT zo+4HTJv^~r;c41;zTORVYxSV~?flToY3a8*;&G*e0uORM2N0AF97slr>qM7`-7uy5 zb635mQ&S%FU^C>!^_rv7z$`jX^MMkQ3ZjM89?!uX>+e{gWOTJW=#j}f{#EC6{~Spa z2cZD1n&SWzP;J}zqGJUVA6{i%r(~rC>JOE%)oy!V37i9{qv0liZv*DVky2m1a0D)u z2EY%r>WpSaCK#VL+fiula^8DMfeo~ZTvR(9GOP5L%W8vOw|$1lthc-h;I&Uxy6mKC z2?RLSSU%jBp}oWTh7{@y9@&fb{w%$e9;MQ`$Z*4$y+N*818SXhQjLG%k+{9`Qmpnh zQq;KAo;SB}OwJr|@qIv5I+>N^{NPEui$;>HvM``QZaZtFsVEzloU5s}@sPZEfj%&F z(F*d)pI8ZDFuqz1R|t6zm0eJA+J4+L!%Zu!-tucDXLi-GW<=rTPVgTxFa?7`;YV1R z;wH&^^4ZS)fM&R%Dn9VxM!?2|8mkb##q|jfu9m$=Hq5$=S2pBFkrT~H@DEOyvIwCv zT;{apY*RH1$ShV+Oz7b>*ovwWZHe1;lmhGQEFDOEUQBCC^KqUlG(&h5*>)0}lbj>! z&Zh9umTLUhNae;4^!1wQ2b7Kh_n+HdIVs*bwCb6{iH~6+He;fDU2xF#ZwBb-LHQaa zXq~5~pa6qRx+bzObcap6m) zyvmcEy8;2zZzaTC@~hu>w~ud^)MXw%pqri1O5{145@0-Vg0q)UM3ajMXQ13ZEyn7uqy{OC8E{60?qM2!nKbU(;wjYy1O^&b#&;wT(fG#G2AXMo_RFz1V zlf4_I4n$_e5qUw)B2xUmHo)*9)BfxIk#4ZhCx#oWRciSjXF8WFDc!52(jdud7Ci!0yxLOVMJCAqB!s*3A2fq8Bm-AGQ(`wZ<8r~ z0|lc|kH()dn))wVx4pYU&U1%X<(H2r?bCaFj$LZR29Hyzr`=V)15 zfK(KySauSZKkWbjs$#0o%FtUOJ+`2H!)KhcHW6cB9Rz!POFPBPo`09$1B(xXEg>U& zx@BO8Ss>kf;m!RG)n2fh01=8}*8!neTU+1v=3Lr#hZg+x|ID`j6JvO&!uQ?w26!-h zEm)RAshlt_cUEpO08>JQU`nKqKC5Zkwk;dGg*3GaXgSRnr7k58QSe-h@5g!3EUcFAWHnV*lEJ(_0Gx&cu}*Yp z#?|_S7}S`ryAo|J-4$2k-6#SmhK`P0yOh?JtsViPiOh?2Ji>l&<#Lpf8E_$4Ton8c zf3d~~@QuY4c$b@bw~YWB09PkF+mVumiyPB8zDO!QIx1|UlB`VqmhL(yB*)8fI0TrC znYu0T4sTS_PmMO1dGBlA@4gJ2Ad+Oc`{k#rlc{x;T}^XobhT~z2TRu(-W$cfDL_cz zto5QXA65x(uAH-BFgDS)EUzJObvaiMSA7;+L#B#gd!xcal9QAV8yQZ%${N`7K!g7& z7^~I{$dk#O3as*9roawtiv^13;*}}i&B=BtTR+jw^#EpHrAfKuaC{+hyK1aRPp|(? z>hJ@5DV2Qh*Spwj`~Y?F~~GT&5- z_Sa@0IJs%L#B%R)slIp;qkY01jq_$s5?YRCf{87gbVFK0T$9Yt@ZCQjh)Zu#Hk&c9D-`Yv*}3GO=Ixh}Uws z!*97bH+TNFP;CyNL~z&__%DG>&mVt)>_A+_Qy2ZE=Kk-x!xqKF#L}C#-R0Q{0$tUd z#uSOD1rdYJ->(bMps|2f%mavhty-I`Dz`9FIlFlQBE=Q0I6D-bF3#^&j+Y8d4bJGF zkH=IJ)=|ysK+O833Z!&rxKsS6I*xwuFWn7_<-*$*{!2*ph|D$2D+}hJppjXeY3)N~ zHDv$=@6bw7i1kp9Fmb6-HI-dk%)`AjWl{#r#4xGR5S1;T2Q1l;px@Uz8bHQN3*6&< z6VQ*&>BcnPj=cO^!nu2K9LAWVJ)T^X6GPU5y^@@3H;>HkC9o5w@lwtc{*lqHl3 z5mH+1`@TfWRkF0&O$gcd-Hcq>N+`1L6)H0JeP+s0`?tZoB=2$CW+Q`c(Dn zp?u;SRZQC@vr#2iK$~uWrCEUUV^DWEhgf00vCS9|$@mnz0p7BTDaC4^=w+7%F#8tG~+5(pHI2Wy~^k zuAjgif(o&xuLElnt2JCM;#!6hEj%-7;VrT&18kzKrLji#(y2#dK!Bw=7*M&COR)~P zsE~M!HwvT!v$^wWS3q}9_(XcV*1$*ioSKRj0VHEqa`z@_G6|pBGm6zQlx-^G;zlvm zk^thBLG$Q&txJF#LFI?t;o4jW$vM_0ugt+A&oMK`hdm-mjpeSY={ztr$}FeYr>dVx{5)gNAEMe5Qsheih{YgXw zKt#}P*&Q*zo}4l!s-GxFr??xIR2X+0Uhgc@_*YPMPZfatDp&E}A{^Ll^)a+vj6Dp=&T zIH2Ig>pAT1`JfCG$Tr1Wjy06ivC+enUxlKft$M>!WGBL zrfX7p<_?pNKog^dh8#TP>R=#h|n<}G$ zAqyZ=fLw!!L&!Zx^JX!CV?1 z&B$4|=KJKy@iB97LX%3Qs?358ukI+db9?Mm9MUFkr9&Y{>(posV_CQWoP+f`H`ELW z(UcoG{rFH4VnMoi56@CTO6gwSKFHeut>tYE<^__Buhdw%a()tjYL>1y%K2BHVr*3y zYjxE~wP^%O5L6P^HOycu7LwM}FQr$BrN^I&RP56zBw|%NA6sV>OK1 zI&__aKq6>IvluxbI;-p2OVv3NQ3CHX#>D?I6w-!gXY4Zh2c4h%A9U}q-!UFV&*L{9 zTHJzWUdoF6(C(0T6RgVLhZiw@LvS?v*UV7;|HfgvJ z+7fIM!yAjB&Mw&Ql?~WHZN5)=g5k2upv#JsnA>#EQdbMSw|w&0U|bCii}GXC<8I3g z@=JMmJxs{pd-1Il$BKz{yIUd5^F`R-4X5_3l#foSV1$#N=HwyyOrY}+G3U{`niElD zz{K*N_!Tkt#O_U7FzO{wqR(H!r{!|6D6ak%zStn?4<)TXGxlFvksk>QVoa*PcGcS$ zJ)my6Zjy+>VZ5`s&6eur>%#rFHQ4MDR6Kq12!qhLKCdyRWpKmYMVnRKS`n#Au`fX7 zea}lIQ){MQ5qPoV_G|RYKH=Wcp|FkW>xDmu@PZnAEI~R3hp$1$7+9Ked#&2%i4`@^ zX8ZGza2}2x*Rz14aNNSNTIpk@plAGWi+fVe(-Y)c`fAEHslSQJlHy%Bo$QS~@;*1W zm94bw@wd}uvZyvcS7YJvkfZT{k9{jeUaCuF|8JD^D}18XUGJ!5{CEC=cStIM(~{c2 z-RImRnc+O+s!94EdA4*Lg14X6YH0x!P2`^_8c949z$ysjxJq9YnVTOZ@$!FtOJOp& znYr1!DfrEA3W-!8=)X};m^8!#np6sjxB!Sa#7E!H2T=RH)V?~^j&^xDID`|nwYI@Q zYB~=Ne+xh*+}?^&0-Ab4$_N2T~@}@hBDwztCdeQT}$Y zEXXL~NLM2A`n#>-a>xHcY--E5dG2q3MIW>Jw3OG64UtT>zpGS;VzK@xf%ZbrtO&pSn}4|1#3|EDbNJ3Jl9r`Rb4H}xh>F`^!BCi zu2}l)rI7;$1vYzOsrz^Il>Xn{xE%y~QGtL$qmX5N_b#m+eEPq@>?T&Jx-+Xjfw=lJ z466KcQ1D;;0=m{a>6IUEKEVpcxcvuU_@9HY|ML<9EJXlj7hvQ2RcQD8vUd5;|Nra1 zdDu(S!}r;-_omPPAJ_XIzfaYb{U>Z1J;+N#*wHB9A1{TXKXB8Iy|;Gn7U1s>|JdDI z_-Tq@droOrUUGT`4r?_ zqd9(DX#a-P{+qjV3!Up#$N$m-_<1`qyLvmOG!`^u&I6h3{}EOGi^u;T;aSoOWH-Qg zY1`cEg#Ry=%dfAYQ#9cDbB4Vzrng-?@k{vk1@j+Q{2%K9YuZK=u#@Xznk`}MKN+@lh?cUN}T;rJL;cX!}8sn2JMBiFZI**g}ku@!s^#`R$QzrPn-`uvookqf8>wrOnlYj;rOak=``hYg;wMHUrl zQVs4Fm=+<-dj|a+Dw~4W+OKavF>i!%5{3z?)vuG{#=Ak6cn(q2$b$+6s)fn;2UG42 z!!lGjDv!_ftKZNhBF?elj>cMRD$2drMB)Ji;h5t3;m_E%orWMifq#@I?}0_-AJPB) z^!xHp?u?^$CB3D+pGrO%;M8!#&(qxn7M?L){bXQ&Ki{Clz}D7wi0hmD0P5(G%Z~)k zG*MEyuw#hvpqTy3%Sgh?jo}JHvO+sya8bCaN#qx+zSE0ll8}JaB{_(rI>^XYB~uvW z+M5{@psJ$YA5Um_&^S|%%d0T!PHB3Tbngei-`tAC0}5g~84Y^$?v`^lfRVJLRA|%Q%Bq z?AIQh2%6Nhg9l4!6*a!I6)fnRHDULms>T+ahSp@*6`c=hS1k;*)GoIWa__2uRpvBE z|1@e50pwHbnXJ;}Wa)cIx4%?!AU#*b&a>x+aXFSRJeO>Rdpzw>=3-}-AOE`8qZ@6j zn~4*1a{6k0K4g6!b37N0SOU_8j0Ez?_T1!D8dRKqQJ^Ewih&*Ca-TzP_DieH7xXZ~ zH|XHCVdH#ZPjf%z0U+t7cBmvw~@GmZW?{079G275Yzq@SL&xBlN%ZOXrgxRC#-BO}}MkL=F3=%@KzPgY0IfMrwpb zlp#mkb>DB5cQl3!c~C4$XG3cb1_Rk9k*ZX~P}8`lA<5D0n6E>r7aLU@)DQB!)Nk`e z01LDli#SMhnNSg{f2r?g<`jE1!90mYg(yp&TpXK4P(Z(w;W}I8`IR%#*IwlFn$KFc~Ns(Z`b@#L3UO`pf>0Qs8$-@xT z6WdGmBIiha_3|#7u0yG36B|n6BWLyB#9xP7=M5EI=`Lr(-9|Vb!+n(+a`(kPmdBVW z6%xYDxGS=%94H6v!S{-VfWLRLBnx2)NL@I?7uN}bw_m*NEk@7jzp;igau1P}S4cKk z_NA=>>Q|#sus`PE5tX;f0#-jZDtg};U4sh9Z@}r&b(6@ynP%*MYnXv~0aIT{>A0}#7ZjD8%Fom4- zapRC$CS+*hdi!ldqclB+a;irts9U1M*2;jM7elbl|Bxw^eJDj(SsO>&!jkuZXM<GwDzI+V7NCbZrQP1yv{$s&cQnNywuXa2( zF6Y~F^OE*D!=kPC*vIR?{4uJGhszgh7;6D=b#`?eELbhI3T0+s@_5L1zC@Qp(aR}C znrUcpu{JU@qz_t_Qv34Dc?%Xo3O<)xdg#&H#TF@rQm)d$6yS7hQibw zpJ`*-+{;fGOPo-2I>Nl0h>21y7}yJ=c+EnrF)_LeM;$6AD(ysn4A_1;Q3^&o`INmO zS*DLDWHf4phRk!T20L0(H}O$GgaNpLof2x)7Rwh5P8@=EKu2Pacm^6rpQ_;i(=k@{ zS>cmD`UXRM^jS$DwLvwz=hI+ZA2~WIaKZ}hW%J}qDkM9j^4VEj_c=y+ylV$49+6k& zpB8u`Pg$fDumwSv?22%OSF(ivj&v05qYYwja$1G!rd3PZA>ea~BR`CJu5ooT@DMqxc#IF}ABn zfV_Fm7z?0vwUPeCP}v{pwcTs7sn>bk^$a4?9I9t}i%-HGH^Oy8j_c0F z)~U7NeD>4}nCG^G7ocAKhL0S4+2|IMtPKR~4pBMDl@>qvQ0*U@M3fT(Rj8`yGYz!i zEo1&raeH<=7IV#r7l1WiE9p_Tlio>-)#0D<=fXXnKvth?kOw$DfMaHLwW4t(0e0vN zxnB8TmiY=G*`etdx#VUuR$-x+ePm4h@9V)f6G;lhIRt^nG*XG6NeKTEQ2|czo0Z<% zLG0bQuybXHcw>W^vbdtOx1w=M+jW<%L$OD-x7D9O4m1et;5elk#wv<}PqI)Fv2p%} zNmwfwWPuxm?7V9&0=l~QgA)5wh2V}pSAKmmzF-hw9wC?Y&LhIPc>0xSof%`?873M_XxD$n|O=cp{H6(eD=Vz ziP%=QybfKcNYu&STHm@VT`kg`4kdZqnC{P;u{lKFYHR}R@Z8)xlswxQ@h!!2>+xs0 z4x`Fp*sll0lNgc1t{q#}pC2AN$K^J=M2mSO{owxn?10~$p|Ff63F|Aqi1DtR?%B0o zLz%fU{P2n`=dce>#ky}e(!UyN;svqH=A}%BB$#>O<|&U_f*70+Eg;|xkG@*3{LaZ( z0#%}41Vzg87AEkUhdeO$HSG#p{KiyUEAgamv{;jr)xrn9r`qko1PjjkhhNj?OAH6# z9LM7IM$`$zix7hhhL;KOfK4ZuAIy|pVZMz~fxG6(_n zcE&iP2NJ^6%49Lcz4y|0!K(Qb&tVNXg&o$YsQ^w10{<;2DAQ_}8o3ip&>Q^YE?w{7 z;`cN7ATlD=8#jHDIlB4~zGZV_=3tcy&Xu-kciW4Roz|1(yw@J=sD*H>>d7WlY6P0# zEQu01bEFlYbp6%#lIaSm72i^E*1)Ks`i;>ONEp|B?q83co*SInwipIhlMWfA!x-Sd z_(=L9iVOOKVg{v!25SHfBV!Zv;g6nFti?#We z&OD;&4TU;Y+gma>WE%64Gu>8?k`&2b&8@wuaXh%mLcoOqNSpc%z>`8CNkhbT1-xYo zmwh>`G}&;v+qXWK!u7Us{K0X-NM6d-jWLAO<>(M*#Zz@JtJGTD0R|sQv~ls73kW%> z^Zv$gsn?LR(fW4(f;UD&z%|NON|+jCX%0IY z4hLWRIcrdT;OK zIm?zUl4GLK6q}h|KcTc=d`Qw^aH{`fVPWB75yC^G1CxVh=%23$vP$(y87X(Y$LP*wyy7irjSr9-OEq-lf{CO;U`u+%2(P|0$tk?7Y0?9 zzbuYi=e5F29*-iOE~@i=*U8%G(4L&Q^obxVr!ee|=Itu!!z&T`q_Qnd#D=kNuPMED z*qEQm&hn@CGMRr9XQnsGi{y@*FD03zylj{+-7@j%BwgRWIDSC1A)IQ~7Rndt+;53X zgr~Tj-CSL2Ov|dbFC9L8@7}#Y0ARbIxR@PMTQOyPk}6UDy#o0X(JD4cNIcOo0Fg0t z&_Bwy5!aYX2aJna6zT@~K}bXMI-u;|I}R>;6sr9??ErB_y8W$qj8Z%nozK-nMsAW4 zurmH>g9a-k7pYjS3c-Y<#-6cjT@`FrJ7D0xuKs)`Qn9e_fHRg!y6<5D0n*3qSiTf1 z>N?pfxnU3d);ku~C*IxYcLD8{qKSc^iKr)^%l(wM!v^lJ<*96r-yH$oWZF2-ftkjB z4}iL(-y+(dG=XiF0Am)%K;HSqr*_6!hikjHH{n*|IeZ6Rl-R_mSWFf)QrM`+*5bAw z-C8$kdKp6MEm)$CHB1>%U?i5-PYj+|S4bsnxWX!sm-3iYT{#$I8$1+m(2$P+M^cqC zn~at;sI+ivs*=JBlAqtkN*aZAJ65kg6X{f`M`${q7L0Q&Kg(A8?1mSFurPEd&P`n@ zjYz=oyTe9;;?xec2^?!(pK}#?L`W4gw=7jORnzPw%isl} ztDZfDYoOR6Ecj?PG7!2A0 zJ=Q$?R@+fOqTEOkD*b$QonNjRn>{u;8K+-l84?-gRD&II_Vk(>B6Qc1-5Pm&JtFF5dB)LCklHnxGT7MRGfKYebXzhlEDgyU6LB*Ipng2!aKiaI zM{04Ku>;*1wL!mpfEmv**z^Q17<~DuXY;Qw6bi> z2HevACk-v|a_QWv1^EnZ{PAw{I&HCXd@-Mu1sb(InPgX?!*^h&{%op0=yhKF&Ohiq zr8KivCk>#IkG@DV4s6s1J~M?QR`#9HHFl42T9C^Q0nUC!?F&#{eYrt@Jh$l&)5dpv zuy1^x{eCOkBXbf5LztToud5!Z@m~ij10E|++K54b!7fp~)R1KT*`!*AS!H=cl$>R& z9_d&sVLle@H&o}l*1(m=z;5KF@3rx&u?En~QAJQAwN5jWCgP&bh7}^cN9`iQ`*6lEL=d;W3I1W`5{<) z@zKcC{l8oMUT>y11Q3C*%P@0tMcr$q_Ly;dIHK$0{i~JMy}60&B{)~~c}?P_lhC<~ z)_WiwsY*4}63j3q)_l*9x<5>k>6yaPIN!*WFaC)14YloaT4Zs>SNoZfVm`NqmBr$P zJS%_)XZIKgK>}nS3e+WM(r|btTZI|BwcuGZ&VR+BTT_O)MX*~8v)#>~y!bNUdgfl& z^FS?T1ARAgf_AmusfsbgB(@amot+j4YNe)ys`o*?pA38YCk9Mqg4Zo+dsCLr6( zSG+bS&|Pin2hxs#X}yii#d72}5zB?LqzPmdlnboCH;ph*rTL^1HwQwfe+yaC3!_K){@|&xPo%MAab43TNaGcBT z)F!eMjP>K@G-Nwb$;5&0fOrGEo-suppDXXht4-+U&7Zvv|Ld*( zZPa}GUP$mT<+Ho@$R)!aEW7=5-|5JBf8M|`ZCN4XXM63Yl3jg5zt~r_xC~Wg=ZHQ2 z1Ozh6F2NNyb1u#hp9|!@EJLg}zc?Wg?aIs`HYgYz%~Unn^?QJgQY?-q54F&Ic;EJ@ z3m(c6*nJ@FxNsFYQL@@`B8CLMO^NTVe~BEN$c!^#VgZJCl`}88wV6QVX#14vSm8Ql zQ5(#a%Z{XMeOjp@jcP%C;2e1s#HhJ#d^O3W^dzI_;AY5S^>#B&rK?}y_< zApB5xc)T~ZotCan1@~b=M>2@o4y@idd9@8%ubcDHu_En zSp^A|alDicGxY_{J7-zk93yCM#hLh-tREhVc7CRz-(UUYb05|=4=Kqt9B1tZG&zFz zCar1c0^|3!*2z_Oki!n4&yniRnoxw!EYOJ^bKYnx%iJ2I9zcP$LQ1a)%CAl7W!`t< zYL&u*R#}}bRZ7pMCwMg#;WRxlv#uGv=c{aht8*NO0bz87Lf4_VbtQDn6(~?;n{z)s z%Az>EC@CuLIw$8k8QdM5oWh+0R@q4&&4%Tmscjx=KT!Ifc<_X==hkAY!;EcCGW^Tq zG_GNGuDZ|lXP8y^?Mc9iCsOX-&R9yD6_-&0huY{$-O4)chK%pUKF|uRo_RguM6tW-tidB%x=Jktqes zKGn#un1dH+^Y}GB@G~ph^iUPSEUkc#)Q*2Q)&S*+P$bq#y5$1uz{qk-NHCDzNB3I* zO$LlvJvb!Hez%hLle4~KFju0swHH=o)xn&7Nd8Rq$^yw6(;}jzvN~UNbMmme$yne= z1qal{y2D6n3ClT20J-$Imhw!z)5@Z)dXn@f+xC9jVL8;M<%9CYH!WTBRSU%K!|E7L zSAE}4Qbhqzfhu7W50SEsuXO?0=3Ct!<-Pa}48Sr0oaz`2wciT@LV_uK?%RP-^}SHGSe=J++=cFq>n^ z(k)b>JK9xX9x_)dRN9yO(0`0S%f7V#w7ssvV_}DrqUn%w0!vx8X^7agNU+pGb+>j+ zzZDa+x`?d6trP=S)Y^1`(YjGZkai=Cjc22~b|$OV-_;3}0}eXohg|$Xhr>FFVcujLp-WQ436b@i`!0+j#R7p57*89|xpf(>;INi_TMFs9N>GDtBCBM9U(Vt=ehxC*we4GRgO*#jjTeSY%fPI$z59F!g)F9!?V4 zw6nM6sYg%=>Zp%M3DPT1{P^)>r_D&B%}&gEI=|Cw5!W=-N|jA=yX&A_zMD47<4 z+3zyU#rW+u!ol3iIjFr`>HKFrwXLI$W+>s>nlzl5oQT8UelLIT!GqwU_7j}c<3lkF z#E|nNkGRl-LSdUl`T7*im4P-#i#7gE;q|eVjz+7bA@Nbq{$)tohHofuMGFZ} z5it%YS>(;EemS3=;ZQL@DXA@XAS|o!nioi5_(K=-1mUU`*6i;VO%3?H2E0^fPuu zxOcz&>Xqz?V#<1dMl!uJH)G;EoNnq`~~mT!3Zm4jo$a(NB8#e#&q zPq5!fJlp^LCJ1N`VQHIC5XOkQEo7v@sk6nLQ}zst0vUVJ_kX!y)4dtzs#n@gzrVj7 z=KjhV+hAnbo_s<}*4c@(=6Eg1p>pY?{0O9C3OD@85QIEk&gX=_F@FJ$AB3iC^V)bZ zsSFpf@tk$m+CGpr2NnUFEc3oqGHjNn7A0Ic-Yg0vJn|>l_SJwhTgEz{`dlM|p!CuK zYf73gTyyrd^ajWR@%rE49m)i?N@xggJBE^nrHJ`$d}}nNW-FDUrR(nNVF6wVhilf* z6o*pSWGlRAg4#PV6u$TMdq<*_!l!L8?5~;7HA#x~yrDJ(MqLQCsvwR+UEhSwwd$1y zQN+e=?6TIOcn#&s^BJKD0F)s&`3aOo$7^0)Kh$d1?i)Vh;rxMnu5{)cR}i%-1H`Rw z-t(@y;)JVnch6Nj)&xEqNi>zoYFo!lO__o&YV*)pArz?CXOuW~O92mFer+k$cRJ&G z_k767YJU*M@-%Z>5xn9H?#!`vU;FAsKew`~&o5L_v}a~-Uq8v|f)lqNwXIs8@9G)M zM*vmbOpMtR2vmdG5V%hjPK}k(!&g~jN4?tO#U$M3`uGgvE&`&pzj%HAy1cDrOBl&r z0*vkE#4681R@Q`;l%MT|-OcV@g(E#mcZ3hSz_#~iV+^4yvC`U#XZ%7&CMwjDk%RD; zcP{7xt&kwo-s`_!J+k{jhvR8JXsimmghB?-FJSaqK=!Xm?`~&EcvzK_SA8KD(ObO; zSDU&hBEm>I$7c%!NZh@~zcofL51Y10>2^qiVvYICwZT_;jjEsR%ZAQ@TO9&iEZ2kph++C_Ty~H1+yg`Vo_r$6m`Naq$xB6Wy{UZy6sg<` z4xc|`NyF%gvCpoq1R+R{X)%lss;#uk&O!qApp~1ffEnHI8+G;HRvFWJ)2N@w~{u97zr(=8?Z-+ z7W*=6f=TUz8^8VVz`#V@78LQr&rIDDUVgq$%41!}5T@KCjy~Nlaa6i&z(utbR@6q! z+#CIE5-3Mqy^*W)*<~d6mLUyw#hrn4ism>sVxiP7MZMt{?<28?MYy zC$0Ar>$fWVA4M}2HExhpw)I7;#n;z@*dbaN`+|DQ{`DQsMfHEqMX9M1zK${l0gmlr z${I+XI?m%_=To?|OV+1NJZWrabdGsypVv-J_DI)=^Y-trD)$|q>J}xjIOdd^T+3_U+q8fY=pnplT@Uw`06Cqo^ZGSO&&`{vxYvI#AUIT|Tv0FWJHB z@YHW_2kRzJ@9$RhGM7`I5W*Fi1)e=2FqHwS6y@M2fSI9O9@-uirkgq9=fV zplTQA#&s3dNn`Ae4*RXNEdtP#@b}M-1@&yE)14WNJszf<^=W5QynAV_LyhdH(ybxx zz51XglK#}*2!;?VYTZC7PP=@p-M6b-F*fk)C&YSUMx#qhkaJojOBw%ObFgS%6)&Xk z^FK~)y$M+<4|!73YD#JyZtD7%ZFF3dv=-&h4$I=Q&i;?Lz+k$q>Ct9F<}thN@`$f?h+{y4VE~ zPQjvEjdRbakfc}f1^$iQ(%)d8N_xMpOY!i-gn)iY*a(~WxhDoIacBqr2|Ye|0FiA%K2WxFL*gY=;G71G_?Y5U+Dx~ZU)_T0;MD}#N+uq;AKKu zTfH=jB>f1;a}hnKWA+Q><&&42I$RBdKHSYd`z1K?ojE7L&~wOrxn}Q}*yt8zu1Msa zxw6uUFrFsadXn4fbXm>j4J?>ueJZz=T@DTK4oC!9qZ?^lC3(-8ydhF^_t_1__M1&; zXw@U%L-$?~CiSf#FJDZpu2!pSC85!7>h#b=(GQcU3xgk^oW&>bQ}HTtB7udL2<4~^ z|E!PW=CiBtr<>5Vi^m&1R!GmylViW%C&Io)MG2>_Y`}h7deIYAc?Zj)f2XV7HT4dW z`Zvv8Rd+gAH9C+Lsr^M)T)7i6J&jY(#->7D6^jVrld_jI2#M8>g2t3dFAqFdoAbTc z1*uJy>8>?L2P=Z$x4~0)V{itsH?bP;^ z%r@=8vRWZB_(Dcc7`#*?7?-n31#C#H*S14s;a|40F&!||;*+SWO*JwRMK)N^su zLYfh5{Dpu45DRR=^az3@JYSD5B46cXoTROGEN1~2J1iAr_x~9$MvLl#*iAS9DOU>n z1?$?ORQr-oeG+4NTObX(5aa~(^MzI&M3gC!)uoOvc#cLWz;uX3xa#MQy1?^tK03do zyX#5eE$AWA04&5=_Em0x_~H2rxWa zlbLalqX1y}P2RnNtDVE;W}iDcZPFppQBErt_~CMQN!L17p0g_+A-WHUOb_?DgzX)9 zlQG3_>R^wXQ}CE8Urag^q49KM_8zRtl!}(1Vu#>9)KTWww_0>d$d8T{%gY(2U_=7H z3tg8}uYK#kX*)eoqT#g|pmMA_PhO#?Xe9KEHl0}c;-64DxK<9wWA>+Xpp1rUR7VIz z*={+o*2Pr`PTQUG!xX{!m1cz5XG?FQ<8RQtup3&C!gpz1 zD&@z~=AS42gw9z%0X2BNFC&0;R-2=b=`N7?G&2ka8&|hpj`ElJ~qIbDO3Wi99KaW$^_4)>1bqUwTQfJccyn0 zjiaQ4?{8Tx3f{i;w&YP>Pf=Zzvv5|CSL}tXZwBIMgXh#;(Btoz@DqSBWJ*00R1nl% zFN!pSgD1Q~{xur%A^6vWPt}Lk^mPxBK*>j{?j?A8)os$tp0cRr?9%EJpX zXPX>~%GbzvSjl1F*|KO`3%b}7+|*g)jnLt}BgsX<<3WV_YfB;p!p*GQE+Cq7a0Ht; zJ(vaM1_Sq42gz4oB%aZi}ElzK9%rdhhiV zLF_IX9RCj2Zc>{+hd;T-$?{Meu;n8}0rrd4A_R^CBNG#^o3{^5lZNbNdgUBXVgTO5 zyL>!qWtOQa%zj~O3}4eh7?u#}6g6=@Vut6 z;wwnK`D5B1?_F6MeXW6%B=Z>uWS*86WKf1^1noI%+WDa|`*M)8q2;r&7ZCp z9nBON5uC=>bc41C6bnwlc;C4`v}~&9khklN5W+;_g`E`f#fqSYpXI$vE#$*ILw=qC zDex;AA1*Rlm=ALqa%aa784>jg@3++)mm-Ys8dabkcOLs#55498Exo)Eelc$tBKi1_ zRk?lj=_pS@7Q*L$gJg!yPY=sHx35dw_CYvGBAg3SzL2gJgzI%f;FPD*2xqaBFGW|x z!h54C9)RfHP!Zog3IL(kY@3X7te%}68|<@shTlws5%u*v`nB9^>N!b931gZG;!=Lf zFu&<;fW+)8P`7lAMp+UEfRb!y#Y&+j4B1LQ>aC(tGkYnj6JdgQpf@gB*Xqo+wwB~* z3HnA6n#2LQI@PkP`k*3IKh&2b;i;u(F%iQ?Ow7s2sSTt*TKoM&w;C2H5CRbLLe183 zk1^9nNgVhP&?FG-sxYTen?u|kV6-UIg^WH2J&q*1+|fI`WZhl4riRD7geUc(spw?j z2%EU>nV~&U!zJ7dnbvfee{@47$SbXpT8fI66<+cacen!vdF765APf4EIZ3ksE?aOl zjN*mly+bzd>r-0XdfC7xv^};7a$uyX`TFOgE9N$(FU-ATAD6zo#4MOjCsdiSXi=so&z%B&$rmYTCW7tbY24>T(y#! z$P?I=HoUFD)MGmsq?=Qu{aYK}@MKABNyi(2>V;1^M?h9m>J6~>F+1TW>l~w55}C;> zY`&?nYGCd)9CfI(#m&KbRVq~>)iYBWArV(lXM!oQ!u4IeyU z^I4yJ1ruCu*YFCNE}H$ABiO5N{=nGYeU!5HEmmMvO?k%x6v$vZ$dS#3~yeKfM6#wznemLFrfc$NGf3hr#?G6 zPt0B4$*kiaf9C8N9q`!pZ^X1Z;V$fCcKnY&BY6cd$JJNoH2(3m?W7NNmJc}ho&eWh zr-S4F$Je%#_aS*Dy}BB}z0~*2@6Ih`^68jR&6p&E4McV{g4)Sd|Ig0=KC3HLDN1U8 zCvqpx^dEmlhw~5fznkXo*P?ci=l}Ui;5@B!n`*hm_hfxnwpl>eVPKWa`a_pf{ZrgO zzW;xxr2Wr_|JS{C9u5Hd#Q^@gw^(FX*6HhDRqu*Ds4fm`1piJh=%0Qj-~c^friUya z;QrFSD^Ex@egFREC}q$;4hZPI`pXXBUk~=5+{fd1RrkWGJ*eOl1H0pHcT@GJjs=AN zMUn816yE+R=~Zf#*vp-r3%l|bbQoxQEd{LylJ2y}Z+-6$|91a7StCqGe^SWNqH4Z7tLgqp%m6!7 z)tc@e7)*o*^lI$N6M7u_heLJno`JYsNuM{>)8D*_p(Y2LT}lqYbRanZ(hyxbbaz(i zz5UIg%4^oao&RrF$^W^M1d)Hdg8HeV-T4KtpZ{SJe&>YU*6!rzVEWfGcAmSl1NH>O ziu`dq&`zwgR6HYiv1)=$`jVpDFY+^t&xeT6$uAZKLd_wUL+D|QN)odsHGLVhpYcgJR% z^D>BaAUp5oE&LR`+0|RfrP{&o<}EA(4{0I4(A|0o>Qtxj*D?(OC!g-hR-h|>6j1oi zm47zjyfGpBYZBt_AF%=x%~qhx$!pT-cpk zctiUU#8ft=&+@wzkWTA7Fagbx+x*-+@hcrqpuorv+-6M8osd8TZcG zP22Hu7Q7ASIk6YYqIdc@KdVveefmY;&55|XAJewxtgO8tMjzh4rvuJxRvgNHUK|pZ zw?YG8&PhRkUxlg$Tlv@=t|oA1U(NW593Ta&%s3>!eLlBjtuB8^`#|Zq!@okg>QOrK zSb<@UFU3UoR^n2M=t@#*hDIY=Ez-h-4y8-F_vA-w z-6}T@ZXXZW={Z+ozYqdP{3ANuGyzK>3Pro;@5SpU0H*hb0e@X%dI6y0*$UohOjbnXIsgY z)xm#qoCDslf!WaekdFGl&%}~%z@iHeozeMo2L!NEd0=&pdxrj!7LzQbe&W!q6ZI21 z_kea+Oh)zlyz*Bf9yNjVGe-b6nXS3Gc{#!az?pyuZ-N_!iXEEG{riC)etd(*^DJtd zIP>n)?0i=he2$|bl9E2`bNpZ1PMl_`LQGkux6E&OqIZNaWo!f~`5)qJ%lo&Tn$r2J z@qN|y6#@WRB0cEZ^r0f@^&cn805<-IFbE^(E#tpmlAaw{zidhE5r6-V67U{#Xw72& zezBLqdz1?8_}RMbJiWhJEr;z}Wc^&-#?n}~l7ic`&LZ7Bri?|b+7akw(cJJj!D9dr2)e7;<=+JifXqbr=1HcGRCcCn^$d=qBRsaC`r#l9=ypkIvGo zjE|6racn4?Qft_EIXqWbT~7@s9Mu&n>O4zM=GB=pLip8hm%>XIo^^3dU7fM0KCh@D_*}2Wkqb}1LNeHvWnakHga#SgQTy)! zT}ME>{L=g$6daYe+2EQaZO;(lv;VnFcgz+60^9 zy?EUt4wZHu@nj2kkFvaZEJHUaR|G@<-gT;%11>_~QDs~C(KfJB74ouov~qUqToStB z&pixSjvyk)nSVIH0=`JH%D8t1L=1(DQt*rc<}L}VJ3s(mW-4v_{3Xl#n7SG{4Zkn_ zB{q;L1Qx7yBx;zt6IFkc@D(qZIy(dWCbEmEFe%M1+g9iHSPmSw`+i6ou-Xbv7zJrO z7N!wxuA5XYSugiH)+7**S+7`jfA{^)?Cvm?bf0jrmJ9LHEmUZik4P8vr|; z4}$op<`&D4+K?9=7|Z_=ccTg z@;>8*1;~vX%ZBZY&)cyM;eY(g1&@H%Y9%mahVmQx=YiX;;B3APFp^a0ArMRo(~|*V z1P{KvNj}gC{j-!+9b*71vphB8+MiX~1$XKvwwOEpsh#|v$Bl-{VF9)>^wb2b>5OON z4rOGPuxzDUf;%?&pT9NgtbQc`jwD`cO;M0>n;(#(*SRoreXq=w)6}8@7|*omq~2Pd z9Y!cbvmV=UdAfI`gni20Z**f;bgqWn8KZ~E+ahH+VxLY)-Me%m02uOya5x}a#ajZw z#6Ip8%DosCu;D)q!eA#*-CGse_Z@pj^CDfHFW>OdrMR|HB~!k`Scy^J>wX=fc<$J) zqoEz)6)n)Rjwa)_SahG0>at(IOjVwaJPmLkIw+NLPT@YwtVHV-0RcfQF!{4sQ z->?7qr#{`I)U%_6!mYgm1odN~Dl5-bNY8)%S@=3tb&9zo5N_4s8_5Cl9>N=Y%q(7} zDKeWGnHKw*e=h8$KJSMwHS)tI2{Av?MbcX)2||0`@6Tz&3w*hprXAOYPh!z}b`L;@ zPVXCf;*f|%@2O_1%-MtrxjkerG6bJKXT&%xv?AdRLcroFk#t+?5BSYp6xE^m5@b#Y zRkrP`qDDM+3ig!_s0Y2eFr*89r{~;SGIizH>>tH9#KehTOH+n+Ei^vN;V_D>0{l6O z#yO5QDwS9j^NLkueyg<9NYtP@=A^beJ_Az~V z*1z&JSkeoBeZ423;W$W(&Pv=rSO4?7>F@TDfgH}U2L{%eZsP!oy*)?QaAl*B$5+r8 z>r~66eoMaiU%}_`2bzN^uBv(^QxM$z@Bp?#F1KLPa;-P#UzO_1BR_AV0BO;a8X2-d zw*EVjoyr%bAtl2e=)nn6YtqK>4k^>L?vA`N6WTwnPG=CLvEzh|3ZFkW8MxRZ)QdgI z{r7f1^$x{u213;TUepAb9S1HBhmK$8aqa3COU=7Z(5fGZJYY;<5Xe1D<#UUAFOM$* zlg?o0v4$YvTqx@YJey1tEMn;o^7=VF?)iBCY5TYD3LVLE5=vJaBe;`@_aY$sX_gp$ zdvowz7(eVBgqj-4+NYuK6@- zg*_}z+-9XhXV4J;lml#@0IxiwJ$UarHfeam`#sOQ6MoKM&E(SAH%Z zn>`Xz#q-S$jtP?bf2e!&cqsS&fBZg9%jxJ;s1%|j5@M2luaoRcl3k`qlI>Wt%{c0G zvWx76QbzX35;4<)Nl1)+n=)iK24gUW@9WZ8e)svD`*(MLKll0L`%e!vbIn}u>;2lE z&*$s)u6eOB|3negDGQx-p1&;NImqfNdb=A#Wv6{EgZ+3xG&{O!C{Qzq8oIt7i5TVX zB{#zKsS4ZR@5n(bzK`=~c8TTn{_K{v#%)IRH{u+;rtOqD=3{nno;9@;d?r{$r15OY z%_Y^`r5dpoPT@fI_VH(qVM;>6gzwjy#Mh?8H~wuro65%P^4uqRHiLBP@kHus(8Kdr z&eIIW2FKH$XlC%f!k&63YOuQoIc6Xvb64^)C#!(8H08RC=A^9kozcNszJu$xDCH~9 zISK1l2|@a4>8mR8PL~lq9i1$3HCzX>S38~pVXp!(!~LUnN)XHIWULH=3sN!~h>qIx z%+$f>iWv~nKdC6`F?yS*)>UiGv?<7Zh{l!yUGe^jv(n31@}OaD!X73gqE?%jWsDxN z#^T*oEV?+dJ+9Ia3V}#3skFM^bX6O_d#S@mHDi9Z5kU4~yU6?Z%NW`-T3}JLa!Mh7 zP=06;k?Zk!zWM$moDRtj-dtCG=%ezr8NMw$`1T=PRH2SuM}FJ0U$Hfte=v94p?l+} zY{Rrvm8~d&#Pf@e%?!Kq`+u{-6HoVcKO!4myo3F|*0FKv#ejb!|6xw2!JOQUOG`J>oJ65B>8szD$L*Yr_`2#-s`D@GlFtrCLYf~bpstn=Crdm1 zgx2G6!Te#rzm*Mt82dl}rS33zp5mzF$uE>KoM_yeY;7s}0wrDRpp*I$I*OCAm&*OW z@ZE?HPDJ9hUKhFNOL>_K=`eBF=SW6H?iUQs`d9b)yQ}@HA9i!XP_kVg%)hDsvU5ZJ z>KcDI+`sq=x5XjU3%@{d|B>4K=g81++1p=z`fko6;xJVDZ@mLs$rq@uQ-4Iq-;%Wd z%AM@q4GH{?kz!ocg|eu>y2HO--xqDW!91KMl;wZ3pnvzsrB|_9pb_LrPY|+JCRL{@p!= zoaR1ay>Nc&p)os2TvL~-6P#2wVb1`z?j#; zrQOZ=q|H}*zH-od!m+96+9h;Cfg6i{)2pr8IE7K)K;O%V8m*L zI1z3G++BAv(b^dtp|DC73c666|r+7%l zmH*D={)elT{-)`!yb&8=f27J6&G`8D58%&Vv~76!(I)KBfBwe*@m>GQJeq`#NlASl zLe|&j|C=6xs6^rmqrYqFeafc8A|k@GcegcA{_5`j_q*xB+UkhVEZ5(4=)mEShKAFe zOU*wIdwj9w{6`+>cALt!)t~>aBOi1wczT{?Bc$9``FmXFCh$L~kc?x0wuvv=+W-FH z8*Dn9di2u%zh~u-C2juHd^bsG_HHA`hsxif?SKERzI-E}u>We?Dvycf?SGL6{O>;N zQ|^n*(-Co-uwFjYz`sWV`QGA!o!t*?gnFyJf56!P(fbhrgyYT(e9 zFYJG?p6@L_G@OnQnsv^1IQh41q~xb;5!|T67w#}J&1eIx`Y-MNKbC`sy(vQ-jXZ|0 zZD&Ka@@wyeld~hs)@U)o`tsx;uYgq=(b1-pt+5c<5p4&q^~VnR;zaF6JFVRf?%cT} zEz!%M_&+biuS|H4rd?Y+pYd%f`|7w+ur4&;nuqJ>kqkJt7Q4^jnKR>i=etc#+#hGw z-!W24f!WxJ3qS1Mk(zC_Okci-_QB0E^uVL;JSHA0VR)BP z?mkDJf)gZ)*SH6P^z=wnjsl|w>gwFd@6#qs?~4RZnjvyS4MNn*C&XjaOy06FPI;IY_AyN0Se=Z}aZ^DD`<`UFg|+rPn-a{(A~D zaT+slY0`1BQfp9>!c3j2dnrj;2zs@Ie_7S?sW%nx9_blm%6BM|%8PE7si~KGi?2OG zaSxh%S}}s_YMo~W_Ae^QMiCwpF7?<}5ChUSYx*2`DuYX{zdGueRVokyFWOi!Jrdp} z-#rK|U-vPorM_jD;%65`o@HPv_NMY@=*2M8dc~&&_K~}EJeC}umZ79p9Sd)|u{|w7 zT?|53sLH0!^>iogYnJZPl@EcNkDI^g<|;d_2X8R=QD($|$;nE;k+@*=P=W$eV%C+* z+DcKa3$lYbQ8t}2Yg;_@-?~|W!j^qzS6p|kgZ-rUn&Y_ zO?uBYh#2YcSHAjI{L!f$ib601>T*qyXRbClP=I{ZudKsN@A*uXb1%^D)(!(RwWnzc zJBICzF_mD^QU`u~@s+8E%`ruKy9vqCF-_K?7^W^N*U$^x4JL~SYw@1aH@HG0zN7WV z*q=6>;VmLy7JEco;i4uyJPzng^3vUskCy}XE-`}F8Q!2f$YRt`F;1_)lefuDkHZqr zilao2gc0H#l*_X6gF_Sw1uzS(reqpd#*zl{Ti9(%h1HLqbS0;XnmsSeu2v6urm&V{ zgb{-gAGq-WD)t)jEtvMki-d64ZAUJgda`tv3j<6fKARZT1{T6 zmv5_K3@SU2t3SyW>9BK4-aC64F7-4EMFan-Qum@H1s8*vvhNs`l9m{y4Q{?Xp%;G- z<=q<|hu7dcgkNrUH`7t;n+(TN;Yg;Gq4_TUQ0@{;|J5XU{UtLl(CBh;0oWvINh$wb?)+>W)lTeM~^gMn2=F)Lv?{gIP>1$-nHQUlj z*GmfTO!BSQBhoUm;~eId+?d>cLt!Fq9>fFY!o6WEE~X;q@afC5-Rm?xQ-39J^Q175 zbPM4NVHyUp!>BEO=e?R`#~aaWp5i%ZTRh3N)--*BwrhS`iX*Mp9W!ZddORwWbilX! zf$j`ZChvC7+R+ykl7uzD3GNj4tdTx4@ytY`85Ey7zrrn-+hjCg( z!$xIg?4c+p3d?v-b}cntE+dQbd$PS)l;btM`XJ<684NiTtq~?<5L;cu^5dk+gX4*5 zgE@>!6yG{25h``uPEc&+st=bPP+#y*VR2% z;3rB6M(>Hu|FFJBUcXydv)F5<4Etld;F=ZhjA08~*ZFJbJF>^jPU;XIS|2c=pgK{O z<<^03nOq8#NNJpqW?q+B8})G!?|e;tyMA$Rj)Vh?z4pT@6+;aqnYEXaTMOdilEZ~; zVsFb0wg`Uw@g95KZmKBl!G$|`y^85GgZc-zwAbBoA{nsw8}HViv*BLO4qnL?^G7e7 zk{|S=?A}&qAMQm`*c!FdQUCRxoTd= z4^tvK=(iLEq9-|HSLF+1>J}&h>k8*R>h^d!jz*5BAe$4PF3WYANvEbH()}u5=zoq- z1@hB+wL9(WWZx>7)$UgJydBIZGDsc@$Z=X?lcxV}m*WSKczxjQ-EA`CdNPA^{u463*{qdcXc)_@r4_=XT=k47 zUvgw#8F=g)`+hUg@X$~8IL)4-CkbPJ0Ujv|>0Yuk3F(&Zv4 zS(E%lMt;G7!TkoG1+Y*z*Z2j8DC#6mp=z#YA*GszdDurKmC2B3m0c8U;N6$ zbG`vqPkYi4Mf8ER_x)F$%IOK<@Bc(bQrl`$^>^#@N%)AlU zBt<-@!*l4t=_x`tLn`?&E(yPoHC|SParIG`bVGt}KK|#uKGQHy-qgP$SkbbNsJ2)< z5m7LZ7{M+`UVe8i_ZEzvs#vJ%swu1z_*%iPZ-~w6-u9Xa)1nEpn{)h|Ua_3fOslfX zeC&g(pXALMREQ)C4My0KsuP?#&wYEHvc2K#xe9#f>bq-rX;=L6r;d_}0blEtCPy_B zVMg!Oyn?p*bVhZdHRp8QR;So~lsAWBrmAdeM@7_VVbL+_i{19)j~_Z>2G5;WuPEM>*tF;o&|^$}RsR!=UR45*h*Z}qt`CpB~v z6?8Fxba$}br&8hY$Z)Jje~gK>J~z0@?jIVf6Hfj0%%F;#M_~5Ramiv~8=1Jl!4)=IYGiUKW6aG2{D{ecEU5&p zZlYoxxX-!Vw`108jf7RbjxN=ac#}35xZ0H?>VWz7XV-g1wPbG-0&y-bxoYmMc%BzU zTc2;VKCiIqYMGPA8dum9MMY#Kw~{J7;2W5)e}8z%#2DsZUcQs&#YKO4)8XoI8K0|{IZp{ z$n~X@kMfG}RaJ>K@afmAG%N)m+;V1(vZu-AJVJ4F>DeQ1%19pGHmZdnh%k!pl&10KU?8?=2r~mD3eVX z(_xG~EKmZTK?JXfnTajB$wQV;XQ`UxZTO4kN6YPg)x#M3U6i~zDM!idTaN!NhvQV@y6$tS*7F2PzgNm6S^Bc^4#+m&YgH zi^6Q9FzdN@{<wXIWY#Vxnq`p zyt&6r8%jehQ!EUM!fCtR&R#kjC`7Fsj??orc78wjG@YJrW?7-^{}cL-!}E>@)iww5 z`aC8=Z^K!Knw@R$z(}*F`zIfFIbkn{ zbhi}840YY{+FolF+b&IIu%oJ<3t&!55a(Fo`Fjl(Z~`gdtVdA|b)4E-3YO!}}H z&RnV95BX1C7IALHCk(89vDZ0IglF5Z*Bt&xXzeEtTOJesev{@U`C}m)dsJQSNd{hn z$rX8N*kf>im!SS@?&JbYSkU(5@gSe2AH0fgUZe|8P_9;i{%>z&2Md?zBQ@@$0CIif(-AeJBQJ;nUNCw^51D5 z6o{Bt8#8lma8{Xk%n;7ZcUn#0zmw_4^_ikPc5M@63tFs{ps5fQvxf}|8I@0ozpU%u z@}Ds#@N>4*FX2B@Nm#2RiW$f7MFQgvjsuV}&?0q-<~~*YZ42{ptLYrmJY?=~AKp#1 zrR?)TXUeQ;iY&If=ZyO-+y-Cp<|-YpL0XES>m@c%S00Fb@ubk+cf}=32&Zf3bByz9 z0~>gaqy^>7nE-U=BNU|ggUXc31D%d@^cFK+ySGqX)c#OvO{)lt0del;*ePbk*y|UHt*ZGNSBFuDJBI z&@6AO?K4WWa&BV!`sygEV`#6ni*Z8T>1l=U-;xro-BPG#6;l5|1^a^|ad%hUYZ=j^ zzP{S|j~Ks$BA%9D#d#s;=~dR^+>(9xbY=~EEjIeAeIB%rJuTS9_;5Lx&v;dhKZbP= zWmk`PF}l2q-Sug+Tt`W4a}aH)u7kC7ZL!DETq>3_3^l>yxJ&tEomQr2UmS^vb~F6c zY30$7rsC(Ao#va%`BPn(QT*w+C~XD*?u)mwwDT|UMIrwJ>z7`8Qy-l7L;i%A=6CIKIT83 zm4pk;S-dmkWJWvl-~@>g^;mApZ2h^IFzum=4l`@hm=Vg!rrK>TwXXq9Fj3vR-fKVf z@s@xg4bS1=arA12;Kd*Ko`dT!X*4;S#HH0qCd?goV{*M=9*M4-HsO=@JpN&YiNT<^ zKSUYx1W)(PV1wC;$?9{lF{NvB&QEQfbqI%wtpC{;XdJ)J$3+e3dR}E_)kY1~oxp^( zC12&qJ1^h;wJJNJz9~rds}r|vEdyjg>)ctYUVQDj8IoIRtEQf-QJ@_zK;Tl&%{>c3 zw_`Xwl+Sa{wAuT!s=%StDW0|wZ(wz<*3S96G>y&=uO@@*kx^Ak;%C@Tu8ivqJ93X6 zrQO&JSdT|QPn=LE?jw6sCtgGCa2?t&}FMMc(wR!AA?LoG6X2=dj|<;UVHeH5H(pFJ#H{<5)YfamU_ z@ErE)9M8_?0JPxS)Oz%|l<0)quL>Y9El3Y!S04HE)H%+znl)IwsCI>ivTw0cixr@~ zW>dR_Ut8=u)+LGf0{7%VyT$f_1N*X`LwXSErP%z|V=MRUW|z1*+OtzF9|*uy(+ z=&cPv=GHL~6TC_(@X7p;(h_u82|`77kTC?h+_UQ|d*2-BknOa1s2kU1`w>!!JPi!( z=I~M@S||ct5-zlNy1~DfYqsu0GoRjML4_>>I$3R7pF8+2G$#g*ex7d5+RVQ99Qtb1 zzHm|ERU!7({!uk^VV_3v+HHYBUzMBijXLx%9=<)G+*9wYg6m$7y+GaH;-@J~PQP6s zW-*77#MZ`7Mlc)UAOfGrP^O~dh3GJ-bt_gr2=h0R3ZKuULbNO@1+;NEQ?!C3i6*YI zf$izl&BotsUO0N2aWOmjO%dIX94b1fEU0L2voA+PtwD-|`{dkiVuD{YD3T{CAMcS~ zhjL751al}_5n{f3??&Np=$D}+f7G)N*B9tT!8N*5`-u_SWBaJaG(QZlRn#-mQ-mO} zDx$)~R>z!x%%h7Qd`zu@q$5#;EIHegEo`)vCh9h0ou+HLex_~IH@qYy6#z`o%i3+L z$S&$KjoTzpy?F4IH&u#`)#B@#gdqNXsSaAM*NrESJ}pBgym%{KbZ-cS3+l`19Jk9H zq=wSrMdO`C#B)OT)|iBKrs3UKER>1nBdt4|M^7H$KG*&9MBv$_pz6owosGrS*z1L?5(D6<(#s~jbQAG42a zTX!1UG(EfNvNKvxz~r(L`apV9e}O;j?>I&j7%}mb4QhF@f{->>q*8Ai&WJ#wPL6;= z^7FtSXIrXSs{XezVT)exyC)V|Ho%CogGx{Oh<+tV&THb6tX8>KR^=3X@ z@fASu0=HhP zF&?9LHrQ7R?f?LewdU3~!$KhHEEIJEwDE;F2Qtk@<_Txhp@}yDW zddAJpv1|lX-0(PK^zb*aDtbTt6ZLv6^CueSMxW#B z!W=*?x_{~4d1bEVI+7YDyRib$olE##d}NvYmf^{a0)1{SIzAtPEpGvx@P-G##jw`F zcZgTVHF@KetO_bydm(ufrt-p?MsJ0zg6qcX3BA&c8}-u8kw!l-AaU;=Y@;Kf-p5uwPHLP2WjZr>iX(K0V(b@KG zZ7sUnHuAK6H7|yQEAK<@5gW*V0jUU%cGyWq2$%{ghuM-aJj;&iQL_md4#1p6pn#s)QI9Yp-Wr}$*${c%coka zsgtsrx8&m z-Yy$2gK$&<1|pB47N3VkLi?eNeIr$rpOrXIowj?Ty@PJFzF-9T%l0-Ig%Ccj>94&! zr>8wQJvfR6k_!oID`JLoH_Np6{e|j01aaDr_A-?vOKP{y1v4vxtrJFrmos&1Pfj&P z$qznTN$Aqv5dZ|mIqudS%2Q9Om*V@7?mE-e+M-bRl7_=3{L<12A*)rctk^hdI<(L2nu-GeB+ z{^eDwWA|_1n(pqeIf0EDrJTgDZ|O-2t)c`F5wamSr2dyfug(M?=V-Qyyjc(1)$*(}%BEoIL+ zmW67??%=t5p2uX`NVf0+QTAPenU!eGlmp5+_zg>H8&oOEX|RoxLbLaMT{U!X=sB6? zwnr~^pOTS>L=d1)jZfW(LT3Q6^WBk3wx2M1SQFga=;%UUY1(OiKMC<-nU~o0VswOk ztP?+z;1-Jrh6z;(;E0s4g8plKot0V@live0;TSCMBnyk_OsQwca-3gGa$3Q2w3K=W znL>`z9^2=xPW1#M<_;jI6zSn>^L;lhm3WrZXD4;N4QDWH}0RLXeV19kH-ocgd2$%}L8a!qHUN zx60E(ys^?*7K}|5m@GqaO!AVG_Bc{qqr-k*>nYQ~tL~PAT4~W-mH9Or31FBgg?Tyn zC>=n|U~;IV1uUyrJ)_LIDVhltiQ(vd;V$8!{op2)7n$DH#=kF{YZ=2RikdgsgkQED zl!tv3=V%(BFP76+vcaieuwdhw7Xb&c*R5tyJ8qB3rLBcVQe$E`?b1CY;K1)1Dt!Fe z8(}QaG7-a01m*xWS3{?RO>b>P!_^{Kza4T0__ zP7P{D&jP0ZY~`#y$)T_BM}m6D(m%v;-CAk5#pF=5{QwfF{X(CGK62vFg306l;>Pyv z#Xw&BLML1xkQ=#odJ%TBX4=)=S(qHgZb#(v(oaa9gcG+6-2GnjT5%iM)yWfMhqr9J8f%gkW3!e$w z6dfBWWklQD5v1SXFkL~j5L)X4Or=fSmKNT53a;zkhFo2&(%xo!U%+I6bxd7a=zxM; z-EN{7X?BzDpu8<>!aQ3KRZ|+k;si#F8;V}PT78?<@GeZg0BNW$ zA`exi`9qKP#PTa{{1YV@`K-QXKdI^jwOSsh^64K4+H=?7w#_DIpjPZC2)@DbhRQo& z+f`g-_ckV`1SJ)^#2XoBRkdw+X?%g7YjT*8!lzCTm|Gd(caMSOWO6!LAngPIWhAo^ zR==~pPp(Oi-)2BL(#lJ_lEW!lLI`m3cN^gQb5%T$MvNVHIm;ZPyK~}{+3Dks2qXS4_n6v1E~gm?u436Hk6(b>GIx5 z4|Vf<_L-n#P(@G6d^lDy?)!|bhMzHSmQZ_+e>dl3y-$HTpwS&Mal+R<~^?}~lJ|tbval2{!@Z8$eDCXg&CqTsM zSSS7}?oU(=iNjAEQNM%Q&;D#Gr)5y$9pIN~fq)JM+JEnE*?^FcmeV;H>p8qsD9zMB z9Tg@pDuZ`lC{6;T5ugeOwB0V6d_Zeuhh22WVIUcg`?C(y%u8Id%j2Uo?*oqP6fuXL zk;N%>}AA{vg!GHiL20q-fgGv?R0u~MZnxJc^c zBZcR0SNx-h(hX9r8$iZXFC(q|Ftr6cD6iDfSC9|OQ4x^v8OVI_?NJ?iN&gw%GyZx9 zB{fdlJzUB&LYR2dc+?MoH@E1y103+=Og&x zUc8}8V+4A2XaNp0tqy+~aQ+jMEA&oN@*Lj1NFu{U!;((~(Xk=qj1q>zOV)Ul}3E%&(!;6=ow-swxxKmhS$&UY~u z5w+>D79yNMbxfmLd!dEM@z6ujSL$9O3LZnXVi71x*yQX8=-`ic`0>^kp2unz#dnmQ*w1y6OLND6Ia0+5F5@VCr_NqE}?xJzo4w- z>V%To(@>d7^@NcH=S=ID-Gn&PMaO^4UQGDT?7}YMoUOgsmZduS?PS3milf?midZZe z1P2F0mM&cLGInM0GxY2x>UrJs3%zQWU00J&3iXAFt{+FQDx8k5lNBRIWDY32zZs}F zQ{jGM!?v3VFS-U3nGZR}=+81L3Wab`l@7@jrqq{3BnxtwuWFwbnvL+vc=jp1sKT6m zN&Yw>p4f`030d5bmD2)>!k!!V!!^Yr_g_0=FZi;@FPLgAe~$Tg zjWZBaPG{M)UEMHc;gZIg5=gdztn65r=S0$NldRv^hbS$dnNllQ>Bjh4bVCWhZ_os3?BHUIeOn?_tOL-D-JQiLUrX)WSP|O z0CE(7zZ!&oK6i!60GDZP$!XGRrtbmpK4A7nR3}n=_`>+@tsw0T>@5wg>`n~5rOgQ!XBFl; zLL7AlT>tt$KOS^E;HUF>m&B!Z9pn5ab<3gKWckeUt^9rmN9;8VRo~iKfgs4URh!BA zI-JmX$0HjR!lw=tA-#TX#aPYccf*^LdgMfShT-fVYWcg6?7-- z3m)JD1+6gJClKGk8<$D?cy z66zn0q(n0Z$_u-al~@a;JTb~G;W?jnH`gPOFCg}a#A>1OMs@FEfKZHbB%^uZ^dZ-k zW_RozH&CaE#-!{oI8jtYt4@H}v?x5}cPzi9drq!$`uss^%i{-Kz(#a3RSzeWI#~WD z0pvO|oySA2n3|@aqa$L!bZAw|TV7&!t0u!{9ao<6#JlUZ3+A;?q=7h?RHGGx2?$$YRomlgDIno*4Rk zhs})d0-He$tW>@bZmvupqO?;qL4{CnuXkAqmbll}9=HX!Oo{{wsKMU04F_=N!<6_W zT{b;KCmJw6U>HmKr>dKo(y-dFERLOE#E&EzH~O1GPHsCI;Axz?@0`O#itRy>>Bg@Q z^(L*wtS`k}_020N&vhfPrrpiAB@O*>ZB?oH(_MF4*v~spdj9ZeoRiA>uvJ|f@scEP zj~}g}HV^uh>!foO!4HYfn@c z-mTTBJ;!%Q4RUT&hgo|D0}~x~BtjI@^rh1-$gT>OTnN6x2L2fdynDFh2fR%Z&Y=e7 z1^v-eMb+xrdK3Gor#QH1YbF_jww}j{3WrY%M!A{PUP#9UX1r~D<|?@>efiZXzOQ?; zi2@*CL#5O$07h9+bzno~mnYXvcW+UJ_2y{#8N(?%UD z%@UT{g9$@n#`R1y1ba8s2@Oo82hqhY5JquQdq(%dnY4y*W@T`XRG98eV7**Qy~um2 z2SEroq#_e1*|9Dd;-}9cO|u9}sgqGd;$C*a(XgDj`3^%@QQjy}=VB`gM8k4|rjHkT z)$eRCH3AW(o^yGIfQpmpkf9M95*of+;56~T3`262m%BhYG;oP%VmrqJ>9Md>0yD+Q)~5?$6rC*MD|QaQovb>L57HgYsYbtnQTw35IO!IZr@BMj z4Xd7W6@Evfw{q-MRJ>%v*Wy6e$S~H@7cVG1n{ebfS|!Y)k&tdG@no2csD1{b%7-5H z%UA$bBBh`nxB5wReMP^zLL;sY(dPihUOnKZB?7kh#@ZBN)FAz;RIPZ3Y@^!54kl+! zZTpps2c5c`=O)V=man#_F~6%s8G}e21P~qMNU!)CJJp`)p0%y2Nff}Jhz^57tUDD5 z`06!%sXg1y4Xp~{w1>OYRG~4jI3G_vZO8=0M5I*DCACmwaQT)9k$+8FEYJ&LWS%&;$Ac{FntX+yv=dGVv z|LSf~n)nuWqO2)t3F>2+X+7^iGN?pb*S1rLT6R_r38uLMnpcCHSdgqkajG{-#haR*zrbM7AHr+>z|)RTbpRs#S$Y^vnB3p~ir*mqou9wM;U zA4$IA8D$T2LE92<#)p2_%17kb1Oye@K)pwOOOb-Ly95ZdKReD3bqIdf4Yo!eu*f>8RFhW(uQm=<`=V5_s2cd;n@Lj z2mv%-;kmol|7X<-FF?{{Q?_v>Z#ERKs#qJyXJPT&+bG@Nz=J9?e20oIK@ng zBdYFT6M{+Wt}X#xcerLD3su0$1l&iVHR`1tUBj8Y(pi!F=sbefk|JyuG8g8O2r8g? z_Yk%FF!nH}a0t~|v(ToOhkA0lqyS=XR)8BQ-m&5DTx&l$f_EteA}1T>MpRnKmrEG_ zVoT38|E}re>EOMgU5kL*qzw&^l#&edY)P@n2jem|=4!RyaO)hf54YEux}|-EgLwr! zW4>)42bWacTJ*lRCe<@unQyd%is97D?3?V|X2dWPL&dD#3WP6An3WQ^V@D_gp?+of zgj}?=)X1j$9g)GOxQ_UfL%Wut5y1xYm28|+J#F|GUbid4V-fZznY(Wg?8sVY@qRII z*64S+gryg%c4C7@L(g{k^h5VUM=nim57pWuKhz@P(jDknwq>r5uCHc@rChb?e;XD;rbS;X<>71cujAvgvmrp~w{Pt1b88=DSDtzBx4SA0g&xZFdf*l#E>L)493kN{ zg>W0p2$!M4_jNuo;Jgcz)}#6$-_Ht&ODnvwozat5bLRxK-+;0Qs_$k=Bmr>oR|mVA z@94>rsVK({KNC2PD0Y&=9S|G=x1oYuBB~b_W^2B}E6BeaB_deMr_LS8H(Sbqtq0OS zD(B!EP@02O%ks$a3i+I2S^l$WgYtk3t%^|*g%xnL0$GR#pktJewyYCmyZ7tsc2)qG zkZFLXEbj+WzOuT(bzCY(CoS>wxRKX; zL$NcpPk4>j(VKRtF1+83=D&OIUcRB+A>+>4T8(f+z10z?7}dqcoRf7yLOO_G-2(FS zND`tRe|}gh^Z<{^Q3gn5vsXCJuEveRQGm(sR2lsfkB)F2$H1wy`my`+y?d^121WZW zo#jDrK4wxsBEmpOGmf0TUfr!l1qD3`()#YJlOTByOn8i19EF2NZH4_JG%OKD4zwzR z9afU$uxG%^YY5pW1ErID={(XUpaf}Z?xLWRrpjW-&Y=6f(bd?ayf;qSZD3#{_I*Q* zPXt!p-^v~K@VBhE!PO1Yoi=gw^4r{3ORqe-iE80@29UtoaYpD|WH$_8G(Ed|{4(Dm z&pABOx1=X*(d6+y_d-LO_N#q5tAb{Qm7h|*L04448D1|n_S4rpuAo&^!P}Z%Cme}< zCJk^Xl<&1~u*_-m=@vit zC{|AR%dLRE-Qa%1M3KuY&H!+}8=WP!r+C*L=cMUCI~9gtCz-nQvsK^P=aZm*a|m@^Una`joO`zW?E%7HD~7n5AU1 z)N~^d$`mb>JjH^*tBqz#_Zm!gU-{h2lkvHi2ZTOLn??;A>0qhz;DV2$e{~qGiB1Y^ zX+!sGvcQd4WSgANlIj@r#glUe5%CmzJGzU$7reS%jUlrTn9Y`s%yc(?g&|#tSW4SdIWD9=(3USOovmRXE4xsS8^P9rR*g!1i0^Iyzrx53l9TN zlTFv#5F5^{_XlLNk_96AkUv%dLXrucf*~En{0HLf&)O0t zJ~Q;$Cx*vT7=2`Nl|mcdwPtyR(x0f<;VYzAHB&Wtc6*#3bnB%-YdM*=to5oCSQk|! zr*(qUcXL6-Zai-BGVT>LqTZEXv{S!es zvj7t72Ln@|yD4J2fv@jw7|S2xKMvw>p6=2b?@26Pr+OT zR6yLV$ToZVGFx$s`?HU~Ow_3MKR5W?;Zvo$bL7TGCF)$}v|6_!-016UvQHBh2!^A?YO zsyuF@?-I6}Z37X9vec(q%OTwG$3izmUEJz`tJHY48J?I1CXE393dJbLG`{6#+^#=I}MgR@A zz6lH_&qhW688C1H{uMbzHIu>Zu{Tt{oi-_g~K8K^Pm3C-E-m_{R{u~ zHUIU3IBtv5E3uofBrgB>|7c5p@rxhHAoGYaPW(-GAiYh$>8{A%Iq%3w(n{#>8(Aa0 z?Wk?F#s9k_cVPVu4R!xc-&yTH{~rx(y6~PYV(a+_D_?5BFcB5MdF23E9=0i(tbB6w z-{L1`+qskP+1xvvzG6g@{#$0_e8tAv)?{6>;>j|-==x_j`eJDlfAA_zMp035dW*ik z{-Zr+78iRRexZM$5d|{bs%iDPDa3YeKpeEFEqrKdGfNG zYbnk1ttc|)rKsHTVU(OMGz$`+q*n!eX~4d)gMA;_ynH^2Dn4H#^SMFmPqT*VMW6T~ z)2}>c{^9!P@lG}D`jVATq)g`UgU-QM3;kh$PDRsRNt+`fWD_s>K(jC0GyC#DB|WlQ z&q%my`Pau2Q8<&6)nR_yv)QsgANso>@*~s;bn}OPP1WRsMhy{X2m%xj{Wm$`Gs$c0=laD zdXKq{lmYA|C~?FGJR2pPK=!1EXdK$a^77lPaHKRX0gTLmA0=uWNK+%EiLB=FFQKIAxor`LGCuu8b$}`U%nj$k<77~hrvSi6vk@Dva3$(-sT}35!(bexP+X%ad)EU7+7++_ELW4ExxJ8GWt#kc3s~XN#{%^lJPjEl@%WFXLp2Xv5UWvfm*b>JiX#xPOflMkPc(NgA!X!f%VT56b z%^fQT4@bbq3=xQ)M9NrO5FLqKn9f*V&LANpDMUx4p2BdItaUnJ%^cJzWmYk19`*Y- zlvmBjN*b)sq1NLNq}0>_5sy+fVG*H*l~0GMwNJue*rlI}0tY6o@>nhF%j%?&By>6! zV7f=@Fj30XUq}-AsK_Y@61V_$^f6?3O##s^1dwptI!%3zxH}0^bdAU9N#=Bt0nTni zew_flY(~Z){AkLckdp|jBi>N#Zp?r&-FpqX#Vg)ER*faAF{kd#z&w_#8#8S%(C2@z zciSo4PA;N}jM&D}{N89{UL)2g7*Cn0p8FF<7rFjA<>3hymYugf3@2P5PL2_)y! zxzUTk7Z=MbY9wHS$3>GkfpQc@?Vq>zzs^(iQ5S+TXqbA2!8#A^ua7L(6n!#=%>Rqx zw6XqYmvF(7bBVgnA{gl`C03|%PMrsV+_*J)#Z263@KB6O+#uLMHUO8RD7leEkO%1B z;`7u__~3rWKrV;hy4sHx@1Qmp8}mrKsM=Gv$6FeiJTUpuKz=|58CYV<1h~}#nH3OT z0z3FYS(Ep*iN3jO!HjEq68vGSYQU)CpwUG3bjiz=-P>queZfq3J>m8|RF~7**8)o? zv?iftKgqNNUj*&$PLPdv4?R$w$FrET z5Ic;JJ=Nu1x5vEHyst`t9z3px)`e+IClVHl=|3s|^CJA7H2;qu-aiG$Xfhs2wGN2H z!B6(Je1G{^wul}p20DuCM*f-ef4cSy6RrCuuPRojWeSM$IdI`04955M6f-YS35^ z7436;0Ngb-vlQ+SARrA7rsn6%+LfgDT$()A2m2X!l)r%{35=7dLzXnceOf*H@nd|4 z9rK|J452D|8`yJ8eYwF1Cq(UoF*GC)Va=3+@XXL@lDy6$lK}aa&T88Jm-qW8CxX0Y z;qYzZJs+#SB|LZ(J(#&_ShU08PiyfxJKq=i0>sq9v%K50tp52zFHB565LT1c<6taA zzV}S!sANJAigRg$2}U~3;+jyL?>8du&s>Juj`ut?djSQvQivU<&NZUko4cqk06~qr zuYGcFYt<4+g9%u7S6-WZaz{i^^Yj$IRY3aDMgV_Hk#$7U;z3$ax&XLyo~=(nqxE1M zGOy#@*Zm0bX5haHSX0_@viGOEcJ5ew&%nai(8VpY@ZIE7gEvqHylk_-DpQ?=~O2Xg((fP~&eAEBBWVwG0 zx}`wt&?@N!#^g8=uNsYo3oYkwp0%I*icJ4|4%M9xjXY##!`icU}sSOa(lK~LNu@@q7Kv2hyaS|GP%}hyI4}%rYm0d z$+7Aw*b@$9i}ztL-~XZQtHYw)*1i=*r9>qK0Z{~$Rze!ZMnVvV9!ii#x(1l7fQpLJ zA*H0m(9H~jbayj!ch|tT#(nlVd%M}+8Ls#6hhAJT&#Y&yb$9&ksy%E2)3qo~rfH|1 zp8fz!;q`te^L&t;RbbjM78)IaIcx$@5H4&{mIFVw<|}y{OFL@oPDRU~$3+aPzkzR? z^V`&Jz~)*NLZ0W7maYI0xF^Pa+YNZ{hjRwDng}=Sazo zoaeGGU&oYPnj1~?11M1g8%Q|1?28O-@whr>X#yK!~M%M{l~qjdU?eV*9Xk!Gx}$AYh&&Wion;o`cu z!BcU;7kCfuA8M}R>d3&y@UUA3sYaCYk0OzKEgQ%L&ar*jlUo^Hc5Z`&@~P=xW!gZ( zW$cJKu2nrOn$^{3SX zs&^Egja9Kks81#I0@3I;?^#ILSs8x ztU<4Dedbl1k(A-*j{_-k^f{%7i8GqLlYsx6(L zF04PF!7d#1?#Tv20}PZjY}!^phhdr{A?UbS_KQ0=3chmMFP-^@O$76{MbnqNlK>dc zL=gqJBo4J1ic09-1I@r;*ju-*x)PX4j~e)m2mqoQ=1Tr$8-Kl@Km7^bj}MwG`pkli zfi!rmVe_jq_47fkwNtebDD{va(NJBfUnl|I#k2sh2Dvaho8hbQ=-jmzM(4aqjvRR5NdF*mjKTu|UjwZ3fSgX2D)Ee?SB#l6B@u#?w|F@13IR(RdN402KwG0*!m^2 zcc$xt+J6S`{eHH!{O|{j*}&h6-cans=D4fJuvV-gu)Q8*Tj0Ava$AA;)Vr%bJD?3y z(-5nXK!N(K{B+R}1tLgZmg}c+^7i;|pckGYv8@5r>U^vFiM0s^Ys%X7I~XK(cV?^G z?=}2^1@M6P<~PIsLI+7xBT&mD1yO%-H}QQZDVU_=kPk$t8h!FfV>=z!(MiB9(n3p> zms^z7O#M#_j(i+~3|2Bx= z-%kPGeeSt4y5<`1@OHIs11zqFjl77s={Wp0UbPZcQ!0G?W9P4F*nl=gJ@1(E^ zNy9LkcEh^+IzT6bEEOIDtxqBT=06?ZRsB+X10<~Id&t~oTL6s5KWR3%cQ3yp5 z9-dV@{6{CtX8|uwcItXdV=p|heodImb+e`g1xkNofU-y|${ogRWw(wCr>yJ|#`VmZ zty;4+%(hOOKwYqIOSm1=6O)Kb5BtS;O2r>P^veMQ&~musMYFNB^H*zb6wQ>T?o~sO z%{B~o`mobGg@Ag(Mm2&%Eq{%D{G)db1EkSGj1Z$lz>?QqI7nA7UtbmKndU)qvE}`G z7(b;9NF`#k4Tk;ZuCCKV4pQOc?V*UhR+sGXf6wOm*9mhc7h_{mS2lalm_Bq279CX- zgaszkYdED|FfyLY25|t{(Clz*e{~;FsaL1GqAjs}scH~rBM)or&h#f2p+?DBU<+h{ zJAFkIxEh8ac=fGY9duO?8maJ8!GM*>Hf^7RH4Rk(dNPgZCyRUlM4JdZ_hws1JWCcF z5-6qO(15MBwTUSk#`u4O(f5#V_wPF)2cE}lvDuarLmimY&EhZOrX;x>rcTL~vRi?=vQ7nAelfdUb=P-ttY|39C1kSQ>+>as<3oPJTJ|2jV{PJ$mcTccym zWNYfbE;WZ2YLfm?Xufb+m56$v;|uQg?5TIsK&z!S83+BtuGz2r4%jZ0!1~L}TPbVh zjgD+Zlop^Ba2-_vSGfklmh62z{9gO7H}<*M*NZadjo^BcsP^I9nH+1X{h|)R4q+Yp z;S5QzlKWRW^gCwm>b|zqK009kig(=}s5Wb2=QVVD2@ayZ?O#GB&6D@0NQ zkW2diDp|+rG2AaY$QREmP-J>9qG) z#XYj)Z`@Y;@5()4zj*Q58F-`cIZZ>n=39?G27H{UFI?}f1ET^99@_do?0g))t!>pH zxZb5!rTJ2D%NFwKW^{t~QGk7rWvxM?5ejHiGc~U%>>Pt!%)awk5QkE-5c)}FC zarDs+NW`LYky$Z{M^W?}8Y2ImUHadT_yFp0g&VG;;EU%XIumMt;ZP*^1RQVFQst2M za62l}4NAJrOpkL&=s@)A7%7qPRK6H-(uK-;(57*9@&02>^skKe_cx$< zqGh=ZE7N&$6m@S$+n(i6?jt@&0^Ek9Z$ABgFa3XJdEW5fk7`jYQ2HF z<6|3um_O~fd;m)S2c`MFQ}6$NN&kc2MDF6@OzoqVef}Dvtix4$YIu&evR{VgG}}-bcMlh~g8v z-v*L9{7cH+eg6J`-x3KMkVmC1s$74}LjUi~e~_)No_lU;NndkmqnFw@7XL zw`E`OTu8QUim3n2BL9Qmv`R-Rv$76A1f;1BM@)E7JU28|EJkRfQm76`PUI8#)jR`y z96Na%=Yu^6wKb;VNlQx;Zt%@?tm+)f3UUH)`2@hnAf5gC|4#J#ydsTKq#U^Aj#Oxe z*I&~q{{s@j3JZz8<8SYRJMcKb9Ykv4xjSl99)NS;;Hn>u$|d!*sUP5+g5o7^*&yH0 z1mmuyVzVV6OE4b1csF$G?)AC9g;f71Vx;A>grI{C{!VOO!x$V_FH0-r>}#pna#Xf! z{#xhcPKq?&Kg0s|lSe_v;Sa0UujE_}d;|=Cyc~u7KD6)NBs7i_W|eIjZQJB|dHtas zaCmz43@bkc#X{oAXk(n8f}h5F$b+oLE22AX%P;pl0`U=QAW@FPV!so9@d%N%FdAZ0 zV|l79Xi;h{O8vuLH_lHVfj^{(uOG_tAEvd7dB|GHf)+@Ces|c1r}qEKi(GODXDDMr zKg7i7S}cS?H1>)s)dAvXk!pAoeAlf$}y>I+`Ux6`9 z5tQT%1@%j6s**1}`s*ee<09UF6N=t9wZFd%u!dZ$8Cw0&Rru%@aw^eUC`cw=^b#5} z8!L^o@MPA|vRs0-*>Ujmx$B@@idxc0@4L|7gYji=p>V8zxco!b@-Akn~x6DM7 zF`<%buUw&ui=H}1F>ua{<;osKPs&-A%JpY5YdGIh5x{Ync?Q>gf&Rd&-qiMQoEfkIw*?!FqR<%M36XI6r#yC5x^euBm%hZfS zYTUJIOO%BAUAvW_fQ3neug%1oOcQ z;cprvf7Q>&#n{;R<9yB28C->wn?%R)so?pVUh}eso>mKzWrpP$FUNk%djl(a~W=RWlZOl*#)k=w+wP9 z?~m$$a118u-5qFWI;xx%X+E2`g%hd8zLhX_)Bo1nDh-51BR*U?kgICYJ(kH+KyrSp z(ZD0x0-AP}yajdJlD%qNQK>1JSE$IcP$rWA5(gFrr4d!uxh*D~u07 z?Iau@?`(DNN_j2E;BWctXegvnhlKdJTRZW^YzI|&Rp@MR^?d8;Qm%lBL~*oV7_V8k zA;11>B6mLy|6MZ+5oWq?>kuM1P#xK?%`i)_Sv&SCd|M&Ighf10IxoDf65CZf#qlsG zRoRGSG}8_G?pQ$jg_t;mAnGwA6#?3X&Y3MZvJHDSK4Z+H!L*$>Py%doZ*Y3aI$WylekGTu?hhp@(w6DOsjo^mp~jz+(Rid^ZcXoi^*Z7V?~ zL-&>H`|ankINrl*uB#xEZO-0E)%|vr!Y36fpNqJ9{Tzniq)&j{@V3*KJLkN9uc$LLw%P09W`Ha*qhrbVnv#%wr3OW;~xZTa1*)gwB z$yL(1ze@bOy3lew`dawS4T+*E0`$NM?X7BKt- zWjx8o6+}q;g4Y#{&pow4WM}OqH($*{E`{2+>t#r1XsizIaiwp^V=a-0r`OzpEKGBQ zI^`mg!**%+9_G{&ttX5GZg%1thL!kAr02frv;K~6+Y+Isk%Y((3+1f}OR|R+O4vL> zWkNSu_|v74T)wHeCOF{tsNx^3NV_{j)hBY~i@BQHPi)hK^=#vQR9mN7Q5MiutEzQH z4uvGv}MYO>OK?_Z?s5w!5&n|{u$e=NQnu`0{w(#si4YjotnDwK~k?q)5 z-;8mU1QNQ0kMo?No_H=sR07dYMPy_4u)m zk%-U7fsQ2U`3)9EH7j-B%F{BeKB8m)68*mt;P2P)`~m!SkJ^=j7s=mpYD-*J*+y8< zkg`PFU4?QsZkr_-h>=7sv<0bNesBMwxm$)HMpZJTUiM`Iw#8$|kst zR)V;*WB4-hkHj%JnLlzX&b-{nvm!DpQow=>nLa-PXDV(^%)7cW+ag>mq8kBBxc(?P zf-Jw59gQehq#D&d@9m;N6I7L@v3yi(+nxGT>nRV+GN7XJ{=xC6cD4IeWou zY5pXGE6whDSNw(OBhnuvagQKJ<87XEVywMxh2|bN!6d%jC^LL0hX}n@SpRmtYJIZ_ zSIz>$nc#7PGqlht?PiJ_lz6*n87*59__aJ*maih|hWqZrkEycrV@x+Y>qfLX`fJ#6 zms`?AKW6$ScsK@I^agu@PZ*ArLLrMv3(-6Gq}NiW@9y|WF{?RQ%OTA}cHh|BYM$gMaYQSOn`Pj|lj zohd;E6VXJyU{7ryCzdwFHjxC8!Z@d)jx%49^LB==au7a@3nE{T@>(xD_I6!y`5?NI z;D@`F?g=il7q|L?>WtYc1H+*8G-RDQ4R6M)*QMR68F4)*tTVDTvfXV??(0$}E6x!1 zp_XU*F=K!60pjG=(2M#DI+R>yrd@@W&$+6oj0m?z5m1d8M6w3G-TRN43P`T`7~Df= z`PaAwH<8^=eo`@V7epN&3-!B>A+su0akc+IC#%^hJ(a?sI&ij%kg*#7<;0@rDXmZ; z1tg;VLBzf~XFoCjIHWjwe0yn~jh{mDg^850P&e?lcjFI`r)%VZvwKlxIE>1xJwZ-2 zJChYC^9zKtfhJoH+%Xn_56vuqhU7_|TVX3tg);6^459dOzF-M0dHf}n!WW|(>EE1( z^PcBz**BX_2ecFcFu+D)T(u+iNFP5!A~I^I-nz@p%((F!;02bBKYDltxe@3;BBf^9 zw#jTU2>e|U1TXyRX`DsSQ9NIEZo^Gvc28Dz=CuKVswEj*JmTN=0@=CO{u@K+J2}~c z{=t)i{{43v{-Gv)KQcHo;UN*Y3>;|{6C;pwzU*}t=e^5u!9#|ewej3HuX$d3?cz%cXXy3~zeiVq-6WWa zvx=9%;OFPvG`CCKZQFw%AouzBBwk2(#GnE|Hhwd@^aANl>`j-ZQvC=BhqOo!b0%F#a+rVx^#G<2$K0>3q?i%V?$- zmk8I&JQ~%Efas1?ej2R&iW2CrS)K0SV$U4F)Bbdql0c2POQe>!<=t@DG_GPW76uPm zVT(qb^;)Co4pErR8rhzb)tGmN&XOS)hNK4V1TbPEn3WrYSslA%_q^%D^yhTiEj?#* zh(L$!y?h_5SqCTt#UG)Jxxk~aRVO%3T*F!LSlM7Ut3=0(Llvfss~(1al~`Yb#mFZh z@pm+xCu6uxIz=hm>|a86ho+dGck&o+^zLDxW^-pf=~M;HQv?L&WCF1 zfL1!9g1PjTXw8)SpV!L*p<|yzLYWa`LjYfnT+?;N@jv(-DW^-Z&ho*eTS#P2A=|CM6llhP7M#4fb3 ze-k-FfO>5CvVzW4exsDZyx!y5_SwtfM2lSXSYWOaia_XR_SgcgQF~Du-;nQ#bu2Oy zDyPLJ+$>5K#bW}M(7?v*->3TofJAG3NEd$vpTADJB zyFr1#vGN``Ue#fw9X3zFWQWf-d7V{ppSz>%p|xn!%%*|VS$;K}%KkEZYtow&joe19 z@%g=|a4NwCH%xQwz?1v*^e0ZM=at4Zh^-f%);;lGN$7X)p>Y|XFv`J5WTff7tN6}t zEc#V!Y^)i2t}IaV^yP56v;7Y1McnAZnlkpk%5#Pv3|dp%A{E=Ppcb^$i$MYCRL@<^He|~cwVc9j zTif}_wMANhpssFq9?WfK@bqMGVJgJb3u`~VZr(rQ0NGh13`-f=0?@IZpsOO?GI>K2 z{aDEt20AKAFMEqojsXBUZoOq`wu*`ld(f}uYt@Y)8&5`V8EJnI)Mr3n4g1g`CcE;s zVHy2n0km?Fm=`W8DeJr`EBST|LI4^RjpI6k8V3rOYiU1-O}(!6^OY51{4BOoYccr@ z^0fTAH|XdR7Fn(pXB%$f*?MZuV?qsaOX;VCI;SnnyQ0o%IwfOhD~1;Z&O|tX@pH4O z)fR;^J9FlRoBGtEj@Da6*lw3I$Gpk9hvt_6AT2SN{362|SfdSw+>=Og zhv?#{PbZ#$aJ-l827Q)8euDqJS6&{itCPZnPz$DGpqucN&=u1Y7WH{%xScC+?ZnG=Qm&#MOZ&;P zzykm8Qe52OuBSyuBDn#gaLj!a!v~ogu1<4V=Fe=|#i(!CW9M9Ol6E?I^lJ~l=TEAw zp(*v~^JROQ`@_e}GZ4CEXFnFvps&!3!Ain%XFlfI>ox4!peLxB&TD?x-lxxbbJW$- zTYUE>dseHDc8tFgG5WJreQ#m6Os$bvm~%vs0%j(o!ROt$x^|R1CE+oMiXgd{f-}c# zcSRF!amN8;^4EgV3G&7BO%?Q{5a_bk8HmE{)EdAt^*BZ<#!k$zE8(f2^8%nw|BOfXIp!!?s(u9nMj`Ujo^=v8-cWIr+Fu{)Eb&Xd1Voa=gml%AZk zXrn~^Np8VBJ*A6%?;C%^Ky~L^xf?z;mTcqod>sP5B^JwyW3BvR+dIptH7QQ9QF$}U z#7$)-zxDMQMX)%A!Rj{$J5ZaZbMj5Q=~7&eN*(i#`8IZ$w7j>{hi$J(BbLV0%oUMp z7nA`CLJ4M_q^55Wz#>-Fy*XOi22tZ9VH{&-4r2gnLdbgLtmi1psE+;*jzTSt_CzyV=n%m49f~Cpz=T9eT2q!n28yb>$(%b5# z*rR=<*w1nnjr?}zn5l1phD(_u9mpOS-`f^l>tz9W4F$eVUKTyGu2mYk$ywdV1|aty z5;5tY9G)spi-)e-HWaNZ+Le9~HVK@TO|lx-u#0nP!>3Jbc!M_a7F|CLbzXe-EH@_R z$_3|z!C{VmDwgu!e1+$C!p;zh;cAX^bDXMNUw!9{uFKgGT(=Tj>-=h2w*8HC4u$S- z>$5&O0?~Bf6KHP{Dg~$~y_Y#M2YxgBggkFBLzRs-3++uiN$-5K!!O!BvyAU?%&1T-o-J15aFT-)Uh_)zXLvSiim3`m^!b%$m6i}GiGq7dOS5_>H1hTf?FHqR*GL^8i zn3UV^578jwESh;+UD(-aS;MHk-e+6YHw{KF6N1I9%`|OTJW$^N5=o!n)gK+|qJG8^ zVk-uQ+QlXoK&_FY@&~E3$AS&&J(!Idh?>ecXl%1JY*zWgNWAT4hCeZQqI)+AR_2GK zI7ub5JDJrT+OqsN0g8*=&9$J*EiOsy=TQc$YsJS%!Of$0T?|rCWgqKW+AN3HQ($9s z*=T+Y2|H>hr`c*Kr`IXsnB_QDX=pcy+BJmHy1w+J?_YcTV#x+o$Vip$)!^Lxrox>e z!rJ+D8CeELO1%@nW;M`o!qLxLxp{OGxn`m+Te)6lG78kc-*#A%kcCzXv~ROq0C^T` z&Nx0#ry8T<){5aZ7Dyx3oQox!*ctS8eRSg`k5f*E*tREZO_W<;yKvb>bJD!1Ex_N_ zq!;3keuwG4>zdPJ8_K8b+LfoO~&HT99>TX$$I3ZRXX3l}Mbq3qA`)dWxNkrt_#hm)z+TZU0i93pN$d zU3HbKs|@SCv}>JK5!H*(y|J91I?|KD)?#C&MYeR_b+4j24WCl^;%A5QNq-j;Vwy~s z+}UhYv@VYx1<^Q1cITHtVD8k_d4<`tpGen{n@+2UsH6j^x^2z7B&aQEvz-#6`sAeJ z1<>@8*+>%pgbRDq=v{iTt%+f*&Q~n|Mtkx?s(Gi~d{OiE`|~$qx8zbViBNP9n+p}G z=3b3)DFAQ?4Hd`>V?*Tfnxrq@8w7Mt!1CGJG8eNZd@ayYmtO&{ywT3Wi=CuR1IDvz{acEHn8vGLxHJd)w&2K09=xx^b4`$=G>hU$&a(#(IOn z{a0rnT5$Hr2yXu11|V1ZeG74+%ZcO>R%^l9fnj!!z4t~&d`mbB=AK-=c;3}3?IKit zQef95G3Tqd&?Sym>I$8s-(lc5ERe<6$7~K}z7%1&+xI)>K z$PpbF`q5e^Wp=S5B8hl!{UzzO*@uSKd@noNj3XSo8)f3k%Ralhv^TD7W)OfkRoX(T zEEb~B4v^=DhSHR`%?LrYORtTcQwnc*#^3-+^CntTdy{*`z`#9F(?zi0scH}xTR#;5 zoLCrCALAawZxGRa?l=odi0VbAXDph^0%OK2l5`8#*LqCJG+h!fA&UdqJth<`3mDyI z2hg5x)oFk_*4%5fw~Hw?Q9NH}{hKRp#{cu@@F73vg4kG{oAaMDEE&_6>rvcT=X`Ra$)1o#?e>3$qzLXKwBFu7^L1Kab8nCG8WJGrFYXhh%BG}dn z0Z(IF7iGk_r??QK-9$(t7b(vxr3Q|aT47+@x45aYYvnfdqwB!*xV;^gj)>3oKz`C9 z3p!jT?dnr9ZtGkqb?>6|VkoEZ7`ENRkm{FC0?_xIx>c5ThmocVONA3D>6TkPZ&8SK zA3Psg6K+TBqUK4O>Z)kWZ>C~{Z+_kd4kRxnH;<`0FUy{|KeindRt@o^c2{IihX_k z2NuA5>TGt8Uf&s_&G*zimuB~-p$&0fJO(Fq8H=Va81joDF$#RaZFK@YyoJki!iHuG zbvgZn)5!%gbFBb`=H@I{+Q_-Q#ZdD+zR&i}R~hN|hP)a|S35Mw%r;x*TQH3+vUPQB zxYeCSzQ9*iQOOvp66e`tK9gZW6o8$a65*9_GJZy zeIf^c?)S)5-{0)&^74$6kd7&PwKw)^S2OBC)Zju$NJ#pe{d!x&d6qJRK5O6i6~eCa zq{OPOMZF1Zq|_g$4a!z5Uy@Dyxa5}BsI^ltl1PP zzZh#M{m79`;Kh+<(y3oSR|<&DcN;dw8I5BH7@VHzBD%wB31(H#bAK-I?6RS5`Maw3 zZMOXkfu=R(sKxi@dUf<^;`6;3z-e!TXi$C-+^S5S_~P|6d>V*BBH`IWHTzM22%D~& zxnOkjhxdc)IUI$~=!I>oVSqLEEJZx6{wtr??p$66GOu>vwD4>|!4IeTtY;@sSu@ue z^%)X#pz3z8&KKi-rRg=v>h^#DJ9!!V}ugcd3vfLv% zyZ1{oYH#;sX$xN>0szc}OfCYnl*H>?{FIvZQR?Ehl&a6+y`8jt<9a8z*XJYn3bIf@ z6Ar#%37={g)Cd+Ces^OmmQO&oFjs5tRY<)_MtuM!&AYO-A@f0lhfgXh=naWFo+;da zXU}P%feC$MGh@FhdBhTRo*qVw^HozNm z7so8x(cw9C5ddFQZ=)(9&a=+LgaVAC>&Vc?*@RKXnlQ4!S7W%W;4{XJ*z)055R zFMr@3eutTYOkH;i zCnjBwye`16W1lJ9bBT!Sb0~7;oYX6T_s1@v)T82@c9%^utyq`%Z26_%NJV#^%Zn^l zRWCpD9WtMKmr;K@5bF4ZUk}IXDmXnGVCOYMEYY@5D)Sa6){atK^ zy4Tdh_72?LshrgW3z$za@)#k+~yPt z0DtvnrDKuq{P|ii8g?X!D;+9Mb=)B6=dRqz(Sv10V~_7IPb!u`Yud?&X?ce77C-<- zX{@{)Ln`7ojmXqdTSWD02?$x$@;GhO%;tfA*va2q1ZPHvmBBMUlVTpM zQZe#oj}H{&m`!x<+eFg&4B52x)aCTjxNH}oA*3<02D_Uk)LR)htcF3J!0Pp8Ztm)A zAe4AxEOhU4s8bEcrpufbOV|{#CW~hQ-%6*h?8sOS^R4zN(?kx>r*^(3db^@I-8##? zi}gaf71;(Sh8MftUjk^cE_Hp2>E!HF*jTLcoLY?sUxzYBQrec$PAS~+=}pFZH)%t?M{zW3Xk;$7KMFO%-}$1+{w}+MzCiYj zB^c0ILnl5PCn?GPF3@zH1SL+~t>w#YUn*UCEivUhe}A-SlD~UHdLDu~Dgk5^*s*bl zF1dVf_dTH=onoWB(e61^)4i9%q32E{qcoot%0`H37rXgi!*t%;Jt|mXTTrTKQaVU1nOzj0xsJgJNnrT;xFVeDoI#Gq&^RC<&uZGPE@%{^I{RVrP z7d2OJATrjv+xkFYxXu!THNs<1AZ|WNcwYbH)=Cv3g|^fapcc7cBeX)#28#VN5+(_M z#D(+ozB_+|nU0pv=;_Ug$kG!1P;-iQRRcL??J~uZ2=gM2AA4!U{m)xc$5f|1Nd)>u zOvC_AB}f@f3TD(^ms%=N&atfPe2ssRCG)nqS^8<*e8l5OeV{+i0O^9>dML)jDWXDRP)*B@Xykt+Z@*4{SlB9~3FR`Kdn~Tv3CGSy1R|TA2lAIXbLd*2KM&VN> zy;B5Kg;$xFl5aGs+#aOu;jF)q-LrSDAGTh!fYmYzLwt!j3_A-O3*S8%VkLQ|9d_}l zVq&LBx>=Jlm!>AI%3q3$jb^5H(@ei2IbnV-yVIz^qCSr*di+Py6c`B8$B4QK5Pst- zFt}My61v#lU+F$Pmru(-hF$%LAZ_P>!l)gb`1&E9xI*!vfb`phvM;bSEwoudj%V#q zG+^g~>pA9Vq;|N&($V-?yUr`b>ZZvH09q>NI>L2tH!Ag%}Y+` zp1Ld}tW>V6+fcM7-Oy#W9ab8kW*#A&-Dle~vL*C)mv!IYOiY4o0n{AHHAcmimz(@R zebsz4rNATR?&t@>wUdmTYib1=j#c>D-|;EqiMg^`<>}tmfCZo>$Zb0El-#AM>cT}n z=78_CXosxflMI%3t_aujCQjyppEpD3O{K)G2{57E(c!{B*A?N?m;V9rdEC%8fqrkL1&deJ8FYcIfw9OC+ug z@rMyZIP!iBfzS$8tPXBXr&PVSX%__Xvr+(+-qIEIke+s{MZt=(K$(dvMNXK*3}iR0 zbBEW&SqAgRPJ5$DZRtww7ww+X#V3jx28J!WuchnmIosapR@d6yEREP*C{S1CJTZ9> z*sYeO=l;>S4jc6%StI^TGSGgB0R{4R&Rbm(yjtwqW+znuPYGS5yzOc89IgQNK z*fn=jfKmUXaSkJ&`*QklmKVLj@XK~+PU%p?Vkeobn7>T0w#WGrK8QxYHqT(tULt1+ z70cd;pDzf0!q`O3Uy`(wZqH>vy6blx*8A3*@BWt9;6)_Mu>N&Nr?JZ!N6VT<_9Ev~ z)ueIbRiioo0(DbyVQQ~ox)&RaDgu2K{<=UcMc6yv9IarnrTO;udnSNSVf*abFG#1P z&}WV+YFXCFO>}hH4zv4Kpgo(_Uc0JmP{#*Byjz{^5lBMy=YzX7$s8Ow(`1wbOcZzY z&Q>5@iN=e5;K)$B@B_=Bw&{L*c);}flz&bQUDDLbRG*kRHs??E*;S^k>5Lh2v>hw` z^U|hd6y94UJMrfvHu%;d`a1gK*6e302KrJ8X2?ClU5s*91H@l#j)mrA7;1xb=Oi~0 zIQ*~ri=6DJy^n!`O**-QTgJXRUQ#0;P>W-s{x0e-)=5z)o_Ac0R1wA-MRuNwCsX7F zS$1QG?8FvdG1$;(zFYUIaB&(YVRWIz(b7Ba2s(zs5!n%(W~+x5I3E8P#EJ&+>@J07@|xHtJN; zbe}Ffw5Qh(YM;Xf2nWC1hB<)tokKN8&V_R_H+MY;Q-tSF88dl}+GdxnBRFQL8Zc{w zHFo@>*j(UX4l0kam2(D*Q0(5`-oEnL1+(Q&>*8Rl`VqkorD6Gj@9t_hj3{y0p3}&? zU+Wcax%6hRS&DOFLF9!zdv6XfL_A%4F*&KXb&PRqn$g-i!%9gMwa_bN9;o{;|5@Nf zp?!CU^pk7;B_Ql}Mr_w!PgR8LM7U1pH#Rkq@r(v>B5Y3b4AGMG`&n#k^M!j`ZrLR> zE9UjNqzQDZeZalEiufmAOWqz+s!O(}h4j-w?Gal=0LQv!VemeKhdC1}coAcU1mJut zp=Fq)jCvZ7u1<;O))V`v46Ezp1Zm)rO4$;S4U2F=D?hb##>Y2qXu~bN8JUK^J3nf7 zyLOa=yTK$XA%XgBnU2p5LPeEyra~$fCbe^S-|m&WHml3eRP?G#8DA~joU53$8QGQ( zui7*Q0HpM(UqDC&mQkT^WpDWQS@%4@KKauo*PtlaqYr;#)T3uE_ZLS9oAlf zon4Enn80z(sqfqK1Vk)%amES?x&WUW*)F$>$aOJa-Z)LevS34)nVIQPv@Uw_2Zgb5 z4iVQ)$Rbje9EM|3D^p5_wMv>)!AB^qY5++Yi?XSdk(@nCsQCb+o`tdQE-a3mm-=Y%E)=o6>%J z)~*Docx9ChJ8U9Mcs^72=E}!oz_4q{#8`&oXf1f0``I~e9M9D)!IiP9q~^ilVM31t z0ii}Zxx5GNdk5x6%Op3=kfVo$fQU)(%92rx=Xuns&>CKA;`i4UkAn03E00Thaahnjn18m;5i5W$Y`7JawhR-9nTc zK&VL*OUS`3I{%*o{x9$T`>n#SGRj>8IB%inQd4m6xH$+#yuTvHP6=R?l4Pe$5Axi8 z!eU=hrd55)k76P8dTPp}18yESih9rV^Ms6}Nv95n6~G35LRkqsd#>S+)2-q5;{Q28 znunkg5rE))5{tJxBr>`J$khB%Q$FWG-wh|4;QjDBoY)JoIDy03z)vhIv|ovh2F@xN zH&f;JD+PU;I=V$44u_48;;mAFf=d8*xK)sU>2R(f(hUGXZ9FMD90bBvNMu$PA3%bF zDnM{E)(^<+@Dt>$lwJTvX~1sv(SKM2C-U1@?)+_iIRm&37Jx8JTI0jvu(4cZOcua_ zJh79a`Q}hom|_RzNB}P&f8lqA5A%!B1?TcIUorEY>y4$y_ox-i=f`xOgFdk=I z6manow(9=8SugEozZCI~7;op>AZ*mm|ihB&12*@#=7w za+7#Q7#;lm)I#FpC*`*fl`77}2jE>9`v#T@$O-T|?6n@leTH=KcCL~6r5zrj|NQ1} zaT1RAgpRtjEw@`L9x4SM!SlZ+cj@?s;x*QnjE6|+faIP^!82EQfw&kA8~t*~2Y5{} zGCuV+5Em5BxDQ)gT>TjS>6RNbt1v^I{Lm!DPnMO4A@uX}J2L=D_(JS)xJ)d^f#2NR zjAbml!)L6g@S!0cssV_6Lg{ttgB_u(DZE-W5TY`?lQn+=;(ee)aU<(&wQ-o7oa8Jf zl{;K20jiNzI`Y*KRI`1&TyeI18(%7lIf`ve8n1=o*3ydyhFY_eyn7_(<}g^ zzIVt(A`$6G6dhc1xftPy)=fEmxKcOr-0?@X)WA`|W0E}V%QFAn(fYQ|F*bGBj)LSx z(aT{+P}OdF#0O!SgC92Bi1VkTwX9Y~2PdyTo`_GuYcUY# zyit4Ko=rJTJ^&GP&E4Ht&(k)}GqLkuh9*2&PU4t-OHPRc&y_#D-kJClcz3VRj)0c8 zYoq=<**agGdAHO2R{v+`r*Yge(An=yKNT{25+%Z%Cna{8D(w%SO)U!OAfBTxYJ)KC zM}NA2r$q2KME!m-#s-0o91NJH*GWC8Ut0N}Ui#ly6>@F(`nzk7g9EvZ>ocBZM;-l_ z;cub>U%{%3>=}-MnLob{6fVf-@;WaUlP#{oNw@IDL?J`w@n-d^l+Fji|B=9t%qK`v z3#7Grh;i&^2LEUjvTgfHf^`3&5iMhK)=#y`FH~y@;LXQDN0oqD5hxGzZ-19>#Pl&R zkj35IT|QBXqpGqp{vM<}Ci+}uLqp(izu{HY*9Xw>8ATi2bKpD2dhMEz&2;-ief`*x zk&&lg*@opGktr8BW+kVn<(L`P#V3~FsZ6G!OQ-b&0N7bfTYnq*QG!w|F+??6jQLk06>+scIE^sKY6hPND@@?kb>De}xCWDM4ZXv4X zdU*Pf0&fH2;tFSXg2R1cRUr%J*+wuYU(E}9`cl>M$waH;*SE6jQC;6wO=WU#?$!lJ z$j=gO+$ics54|E9X;?Y#V+1XZm~7jnWGRx^eJopjoAKY?odo`I{TvcMg;1v$-$-i9x@4O7v`Lj27S{@TqRtP6cU2 z&>hcCl6d3iNB-!^n+Ht+VGsO8oo*^OdY;@`5Wm{wc85f?_ASBf)`8m$j?cG)K1z_R zJf^P6Zn;<{r>w&&*LZ@)$U>X7SFXmS^2(8&e z`P|ZB7_X!1cvJ4lOJWTMhJ}gldy;2Ni@$uJJ73eF(v$Y9I!n#NchOvW!>%IO6CP`* z>C}}rsTsQM_wEl?{}Vg?e?{}dr+023$ENR`{>%T^g%Yc0I}^IZmUfdo^=x*V{ixcq%HWm{;-X@a%5SCK*4|Ge zr=Ys`AuCDw(c>SgZyefS+Yt$*AEX)jxSEh-;(Z;vS8PS>k}$J3vr%1KYZXmmj%Kq8 zdQ;ZyXmsHA@@87!i_9=_6m5@RXr{G5L}lKLb8lW>XVa1vdssnH`13GPR9MdWI`u$J zPt`QW)EN8~*mQr*)@rrVSvW5l|HLs2FR$FO)227InO@0B?(z;ay6*)KNSNyGvT?*W zuFEzo=myh&S~PL{a;KEAr4~uc#_z{%D51mpikn7>I?PpD8}3I=Ath6n@AK&sMQxiV zbfnuFT`R_Tyh-p*#S-J|^Frn=70?{6b?x^h3ene=vcHnzg)*h`ng{THYg4tXbv60V zHK?JAQOKK$`Wz7~iG;nEkd9rlQWYmmM|P01<``cCkNb8`l?g^U|_p^>!Ydi6S*` zk&qN-P?+1^Sdg4mNYySPr!?pOu18biA6qo5jPxeCL;TyorSI;JCSpGA?)400w$$Pt z9{gL8<&A=vO&e$awf_ zAfH|uz}MW{W*K){n959E`6@JsMISy`Rc z@uSvc?yZ2{V*ce(4;b|Q)$xOd7Op`rnq$rdUmrG8$sB31B<)Wq4Q@`UOB*$lmHgMD zo$`2w$2Ux`I@WvrhxLk~w<1k3DVAl$FD&P&)@y3TAL%)0-Y`@#N3Iz5Dap*)wnO2O z&4?$G5xj*7*Gx7yH|6EzE_QWw$$!1~K3Tt7Od|Crxx|Dd39K@LM1UCoM7~zZ1MWx< zJR^xnl9RjI}56sV8;E4c1^2Un0O@_01pkvK86O?^iltJYO@g4Em_H!^@w^Y(+yFn>(|rOk9^5)v)zK; zV`7zCzdTCA9}j;ecC+au>50L&ss?z38hNxe9c7*rTLZT_I+oofN&7Ze3OPSE?dByU z&+r9h=QEH6Q41Qx_d@S;2VP{q-V9Anl3pdfRk-F_P*M1OrQySQDV9!e-~7HSVIeEt z3BO-rq!E!{5Ndon!tBZz>DB~#qc1!lSlw1F4sza1+q-o2ldUa#GH>XbH?bLXHZAdO zg15ML_(K6mitEW2!=1Vuq;1AhcJ&rOYDt>brS!>%vvpt8Pl3zEyIM%c);8Q-xAqFo zV0+_iyBZ5WkJeCV6tITb65j~G6hLZ&nvBzRJD>Eih|5@~xNxQ*22%#b}LS6MZX>A%XpI1aj>lNFbq{4jrmMcTAkBJ2boc%Q6a0%b` zomNt1km|ToG%|KVxoT|YexsmcM05vvYv@U$4da|~Qg4R5_6M-qZC>8-=9I|-cZTYm zp+lNM_naO0NF&zg7Ex2=f2;)6m`MgVllQpA3DI~vH+Me0SIPM&zaPPz(Q_AZ+kCU%TkHRJ* zP8^}69INRrme+H1i;J~3elQ$2sYi@w!9C~HcXz}d zG`U|?x)ULG>S?UorYh%EzuU{-m3WR)4N(!CeD`W=)9p41TkAy$hT9W0S+XVAU? zX3;=%st{ikvl9W&aL=3L{6bu)E(->9dtrW!fR*eRm6c2p^Rj_o*UF>ehG3)mrp5oq z*n0;x+3j7!RuB=;8x;is6$KRm5d`TrKtw=AL`n#~2mz(H1Sx`2MWmNd1f+)E0trRw zy#)vmdVml@52<{YXWnzp{XX-&=R1EelaS27B-gd~TI;v=TD#v;qxpYDa?5dob$=+T z_@zSPQd2F!jD4maJHu8Ib9OJxShw34il}j!h#Avye65hPlHl+rdw&0)SpdD8n1xmk zp=0Esa1z<=l!}vJ{f{DO15{$)r8YP^@d#%IPR57EckZ18?i5jHqRg*}`ZnnbJ)9XciEeMpYi*LTanp%M3T|qh zA(v#&Rv8f)|En!!7>$D}*q>PuOw+ymeIxDUyS39O^u@7S7K=~4R(*Vu!-*lS(mhHp zB{rnT-SC-~XOp*iJ^N!$uxu_W}oA^Ta^L;f<&OAMP z2P_i(=m63oh*XI-wsHVfL=}u6DxV_T-=d7cAmFJ_wY^paTqT}Q4SlN;?o&y0(D*S4 zYZ(aWFO58BH{WN&1xdDaD}`pcu)%f7Lc}%Wzi3YgyAIxIwg)p~+TBs-u&to1g6(Y& zizIiA-dbzMv_=bUvNE*D$A{|7J%iWuEPC!gIjQ<8R~wQC@D3}^uDAaU$oLm<)O&JS z!Y_|5Z4rLkn6A+rZa->!jabcpn~1&SG-{vQ#Ytp}1IFPh;#-fn#!7>eZ}HUzZ!ew& z`0~EyNdP*Yo*~EAZyQVh?H=~~)~LiCm$aeGLqDUO%`Dq&0W-uEq&uRE#oh(~VbT6Y z#t$Al89(^Wg8b#Ex}y5+O@dG&u>M&bp^trIw|yVRQoR5E0mrrB{>Hz))W1vRI4j*| z7=N0@HsF|6Eyu-SB3Wo5c+J9r-Y^}uW{55kfMRu?cj*AyblW;SAyTdDl`L^bp{k_&jz4)eW zyk~^BOBO^3AG%-5C#b&!AtuOoUE7V`zK(`rl)ccuYL5}=_iR1T@U_XD+e_Z&>#CEr z^Q{8~oA{vy+owhjDv+4^-d!CNeCtzC{F<-4fRWyr_U;rxsgWs#k@7aMHu&6kM5jIX zTDh**5d@l9HL1ADsW9UQ_EwvyumjCD-Fxpgi6nK&;+}s;peenPO`|B~7hG`qpb@{;7%C5XNB&} z_gq;l-JH7DcB@~F+J6fEGVR(jA_-aQ0bf3-r!f=CELnxr zjfJ(6Wi;OC6_**5TXz9De&$&B@zQch6|oGkD&mUSW!-c#F(=t69*C&bj97E1U0kv! z_T7r9%s%x`L}|M+U)c}ehVx@BFfn_}RRxz^`(f7nPTrlm%e>8O z+^7=9o5Hs@m3&;w?X3^of0=!YjZG{Ad)?|pstrVC6B1M|sx%cIW~eRorb_TDRLK(f zkR2Cu;kP;XWHx&KG7+7SFiXGns>IGCJJk5v(35{+1c2W7tAJ;cz3dlz;QHUa=S17Y zzVaszOQYYfCXMTFvlG{OUJ#wCl1~;%qqo-i62W6TyVQ4_7OO32Z(bFX!M%s9vc-{j zoopf6J3noG!K9ev2X}I9qyEx}>h6oOX*)4NSgxxrT?0-?@2(pgX7b=|PT%AjK@vV_ zdl&Eb^cl>LPQJC4R>&Q5sqrpy5n4XWKtbJdKX-Ta-IP}APFcG?<{#QEv9>Bfw6;px z@!ales-tYuCmqZzVa46wuklNGEBj@`PRW8jBC5K3Wha#7(?o~%R%iS4_dGcp;eE!R zlB)z;Ui(NCZB(MVd-~iyY_mu4T)ee4M_^1&LS2NYn{y`Z^;eI`H%E3=c_%Igwf4uT$|#|kb2a4txqZs271A4{jdvnFp7bSVjDELF z*rVS2wn(kzG#ALUEMmNs4+R2G=+RdyJ9pd!mo&x4=I~3mr*^TD^x6P_V=fh04>8C4 z5Co<;8G)e`c7Y}S=xA8_pj!^5DFdF2JjigdQ^8`PgObhL1A}9Pq4dW}`nKVXubwx8 zOY_2mF1|B0yLSJD@5gku!>)(zqcKly(@g?{S)V0EIz3|1s{N5T({h!=Y)D@AjdV&6 znd~1VZu){|Uz5RdaTOJr1s$rG47YlGPH53vfX~s^1bQbUIhX6B3x4BDsJjVow=J_A z3VD%|Tu@ZLxbEvc<=)*+*&RDBR7dEC@-<(;s3W2{06lQ2Xj_1&~aHTY>w_od2ufwl7qz)e?tPj%~fl;HEvQyXUS-|IX@CO2`yHER~!w|J&@B;=?zE{hHTXoxJuvLgOHtsh@SIg`F*hV+iZc3rHfD|bS zd0)>TWl+L`H)RrY z5XJ0+I&R+tbDzidDbw!iRf-|>3f??oOv-I{uH~j~ZHV@qBiz-<>qh8-Tzq2{Z%wCqfHZ^OEy8-dHlY=@8lil(0Y&C z97GXKw|&$L?VcW@a5fN?K@7*bKYw*TCYF2#yoI9j8%C$RD(l{DIozdbK_aUv827LKR6l)bg~!iSHO+(v~UC z?LA{{5^^a^PFuNpVG$-S-`%=9B(UxtM6EqibT?UojF?ca6D-o1enZG=sf8t8M0c&a z(Xa!$P{Ww&sOL0j-U4LVA!+%Y1zDzR>2-7(C1E(_~`QW=@3-X%qwG_NFSr|H*AeMXm~ls3ab zL2lE><2$zdl&#^)bsZvwM~*6PAk+gkP!B@{9Z0E6#W_EcpDnJf?gC_NqhPT^L?E=* zBNl3RK%Nto44Zisf$(?2CpM~sjB~JwHYv9nyxpovlKhWbmW$CJDi#uQXV#V8Kgc(e zsq@`k9ocH|YAz0TSPiJ!a%ATbFVk|1WaUqw<4EJ<0|+*i^~~R4#9~I>{R2VN{n^S2 zk$GY1NKwzl5n13Ls>x4i2{n1#eR=5tn&&sGYHRiEh5vDD{y&}qFl!rN@Uu{0Nk!`x z;2ox2Kf2ob)JqrQATHV&&mw!|RXnf&hk6A3SfPRp@YPjPQI zXV0GpkZeRXSNdp(A*Q`Ij)361D0LXRQO!jfs`OVElzY0Gy#W5yE6i}ASjjWd{b zD0%wK5TYV5wD{%lZn$zi5D+r8_%)ELgpj2|UDoxonLJoKTIVJ%p-8R?!tlMR0NY_+ zoLdDfswX|Z$o>5eK7Kr|aQw6sA@#W@4uu_!6Ir$F{Py%C`1#R)4bZZV8()A2r(I`r zV2?je)0h}95AKT55<*Rfz$sPCF*McLq#*NwcO6q_ez~FWrPO2bsq)0<3}{2WUsq(qyF6|)RhP*rdQhK^1YUL3Lv`!^;W~w<5#JHS@&R5Ybn#b+5;_ zpxqmaFj<|;Kq|NdWZ;~TcuZELqTNr1czW|yZ>$u5QC!#7nl$?Kp%svs=kQqW0d zDv9<(D|z(clw*TWXN2sOb<1FDgb(`F5xO$fvz{Lf!H#Y%XK@|#cTII4GokKcLE3Ue z2jm4p%qBPUufwn|{lc%gaIdB$_c&ymqG`((ib7Qw_zg<7 zFsiwuFMV3Kx(vnQYL?7JLe5e}7iR)9Gdz#(EsGr7Cz~4`1hH8bb{|5MRra5#;dp65 z6I*X@C!iZ;2v{50fseno9BXUE8xb*VNs|e%MSj15%@B-e#A9ncpw7 zCe449_42H@DgRAH_zx<^i;G7n$Gfan!zIg12Uyu!tZYW&IkB8^d%*lO!WQm%d6Xh| zW|UG?a=LIk?BL`$y{&K?tJsQW%8Q&JAxUWpKXl+GO<&xJb>-6U#$K%Z%$Rx6QppRQ zq9Ml#T5e*K^E%4**ms_|1i$H9ur_22(`t4DnBkPr=gt*Em~(k62BH;a+#R%F0w#MA1a zJ7PF-$rrbI3l|AHkBD9^E_Y}T`{Tx=ULQ9zbf0!#kJKO#Q>HSeBr4H%JV9SoS-8j& zqIYhOj~TwP1p-Y!e4)TUtt5VnO^n{Da}9-|I$A%tIliLGCFJf&9WNICpaQ!M$tAkE z&|0U@UW*IC22ECipZm#vJO2sVnWSrg-*zd>qEUXQDzr8(VpS0u3Q0v}OJ@Z{Kdf{9 z;&BUkX#bY|KaemkJ31{PR8bq=5+PzP4q^&FTqa4?AWv6{bmhY~W zg%L4%68)ryhB=2}b#_=?9l0ibk$TidbC=Bf=Z}ljP6=McfK+Z}Xq5%Xxh!=o+|;#N z8N_9)hAm}Yam6}fTYX8PzPe$q6OPC#;j?1ub;P=`wE;AO&IsTB#=)a2(-#!Upl`c& z^nk7dkF|3F@4k!yzjO)Hf=KR!7cLp*gkZd z_yo)R$RK}VBW(v>a@jc})2Kr$GOF$kMpEPt3`@)ceHkOwnJ(hu;#Hif@@|00PM``m z5qQA95VDT^=Dw+9ETUTy=M;5U=i$g@IgT$1+u^!Uy^T7v#~IJ1T?|T0GnO-Jg021I zSpIUXhG5gR%2FdXcNn{e52ud}wdfh%_O&!whPn(HqtI4m@zQMidup|HHGq!!UGDqCHM3?7Uc% zlmeALqDRf;+EkDAt56S;Sd=35JK~uq108St-WopT{X2+k*COxsE*X)bxwz&BaQ~dX z3K)RUZ<>XNo*hP@BV1+7ys=4$T*ls%5sJFX=S4vyV&#S>y?`afV0(~cM1R2h?q@Pf zq+?`H2zlim$EEw1-~NhUGd|Z4yzy27wUgfpI$}!IkR$6|8 z@f4H2nnM7$%tBF^3~QxAmi?8zp<#Hokt}&*m2Jr%Q>Uz39lex+QLgVhpP(a>>X}l{ zY{h0C_CL61f2xabMnC#qXr1sId?q0(grniw3DUO93Z^;=BvM2$@sqZH0R0G7rBOZ< ztQHg_gc}k0(@IMb{~ppbz7a36C{L1<>IQ?aQO`_QLB5Ld>_E)Jx=9=pxIv8I?HVu! zV_r?_thld5N6AQqxR-;j7F9MzW$eOmsEIw;sqJ@d7=hyMN{mJI%DCIMMG#@i)A0yu zxkzk(#6bnT3R3)U%i6Hu4aDAfA~ zcntGf39cI9*!VON?zEF6n{emz5pK?}R^N7|?txV7d=zfVs@c+)ch%d%$iuUfzE>^2 z&z<9!@a0=5#_G%0oL?OL}pyOaC0ZE)A#k1-DK{EKak^n=Bi{nsZXu>%>NO?TdJ8f*;ZnHY=*0oa~mkWPd@`I+)qs z6oFrl;hgOwnRIzDW+f+~@8?zVF?67LX^pZ=oxI?!tm1)>^;N{FNsN;S1<6i7Z#zSm zIw$2GVREfFgvF$^;BR0Q&I8y(#5SK9z|RQ9ln ztiC|Q8|)YLrp5x@M#Z@BHn{dj!)MEw}Li;)-eC%_mS8!dsUxhzE9&3CKIy`qi+ z)kN8!#y0Q34dkere_8 zC`~5kLD-u5^HhZ!1!#2eFXoBfcI^pcyw#+b$O~I$Z`w;sWtvSX5{X%Ev+t%D*jS95d<3k{?shqb#Z)`1$OGmzw4jXHr- z^doRhab<+DzYX4K|i^6Rg-@5;F@w_o14?OQB#;GXb@S_Zkq?xFfikY z*wz(#gUMDuYye|u)QOT_3F;fuR6zoL4x_b-40MAHAfh*>ihv1(hM;kg8-NPFPI?@)>>VD}2j5fNZ@5&XS*d3kF=vlJ zTZJf4e?HW}+_hg^HY(P37Re(Lq_lRM->fWMi`My&juzv&&5zn6ED)jeN?qz#UB z?!>HP9!-qmS)*_I=X)MEJFQ1&d1FeYvNsUAC9c{erNdKFQci|Hh|j-~j=qghxjzi9 z>H8eSc>SC3GvCGij34jGpFZMi?X1Tp?rtA_pr5P%Gg>3>@!?81mszObV;`DJp{$t- zMR`p`0lV`>DTM3pjzx{jYORpPF(SyoRXe(XZM72mO>R7TQpAT-Djc4Ss(*JSH^ek8{&``kC|ARpsRFbOk9=s423%4 znA9DI=^-#&Y)Hp?+lomQ+&9moZ>ggSq~Y;mI&?wS$7Bb`1M%GQFI=Zwq;87^b%Rvz z`*xEDb|c^oYD>3WuE4M|g+e}62wjK-bUL(Si%2i! zgFgIYx5+5g%HFjlM7T<+}0C;IUNagM7bgG-FS4?>(kiq3cW_XRL+_ zeYrpvHSL9gKJ)~)MG~{SB2%BEJMMa{`zGF96p`E8A6m%ffyW7F9DjV1m0i!)b7}-L zeGLbrHHeMC1y5b**MD;xd=m_16fq12uRm66-|kZq=2xiT+Pw`WOKn#S9A|fiWHA}k zU(({D`y_i8lc^oH+}+jROencp&SkMILw~|+#n=N|lnbE&We^h>BPUueP)BxGj#fCd zR?0M*14=GRXnD#j#%_d3yO0Foch0-_WRF|bZ9F5Y0OAmzz<$SmpXKl}a)C-vV}aaS zO^mNr7OqF=Bi08iG`J~aK?5s&+a~<996A+i?6uz{xrd`LgFF~gR8;>V1&*8amScBU z@2xOsZM8gIT@uO`%&8d^`mDp)>B;ysC1jWUwo8^^H*Fb+#{GUy^i615bqL#A2jf=S z@_~u(Z{B64WvqwnP3igk5Jw;zyM`^@UO42E^GCRKHz8lIpeXr#8j~DTXlHjArWr>U z*da|}f$pTsWmyL@Q!Wowyv7x4-vrKAEu81{8HWFE*dHtaG6BmW`|fOGe-nXC%TILoLG^RGF9`9;)Ku=x#z_Ccp_Ovl zyt2IjmSc~>sj1_F7sjZBJI+_LE zx7NYXRz|BJ_I5*cu~Qfwb|J!Fsv$~MolYLG{?fD%%}e)}tNzbKP2*OvFL?b8x@6%c~oc|=hDz6^aj7EBy} z?p>LGJqpS|-Ztdc`a~MasWMhf&yz0dQPIfnCtBwJgX9}!d}N7U$?-o7V|Qmn`c-md z5`Afd;1=Q(%)8X<)>DlnOPg$sh_#)k6P+ zpdSv;|9$MV@%)+oM%0Lw@sDyY%*0i03b(fWO>*i!Ix7n z0L~5bsn7v9kNHHT4;ji=nDa>palx=y!~wOl^_D^sMT~z41}k3^{;JJ0mEtpfTA>=) zgxZc}re1PEm2pnXvVZmU#8L36*K^aH0}^9s)jxtg`DK>xD+IAL$DW_b&G51xExb4T zp=$w{Qb&uxy?gfv0HC)mG4_(>U<@6)KNYF8)SlqTYYqj58*7#B>lF=?UTtDcW4up1 z7#vxufph_{9SymaUlzocQ|2sBozvM%P|5c@MlX3U`#)som_u6a@bA6FAB+i+HOsBF zh^3=b0BqQzvrBYfN%bQ7Ag@|Wt6F%r{_u7kpIV1B_h^p4r^PyIL_BjaX62~djw1E- zs74H|!pvu?&aHC0pZtksbj7`8SHH7~mFPs?9qLojiQg8l=?-2~+L#e?{=K0InR4b{ z$IC*OTRw?!aU5Y(_^#PIO{@aNb6vp%O4TN!D<1Ln5BKv(^hq~!sav5jyj}POlSF!e z5>eZg{?b&A&@hq@iNQ7QGnTK%?h>gxSHK;)tF&0nvRl20WJ4&sz8{#o&gSN4-2~{h zfkUYumMBfAb=!>$NBv}SclyJSG3bFEal);MoM5CjwGu`w2o3;n*RmKX#tRbCp35re zJ&fYnY49DrC_Z`DSP%^!u-}+p#>8^9*1uc0bEIAA6yiS!P5(Y4QDSgRy2Pn79BBnx z_hFm2u^EZk`=dAs*GmXxSwB)b{_-#|f)V>Ofq7c>k9o{*v_yWVJQ|?4Shq4AmFHhG(h722XrH*VEsk>e`DZ+UMg$ox$@(^EAy4XGP+ zLdxHzk?)l`PqElxe^yoen$24i2U=t8~SJZpSF^FCrlifcl2BPOt_8R36L_& zc7YyCOq?9x-u>H$<6!4M-i0dII4hIw^hqb_$2`f8e&+kA#Puh)jdP*RI;F;?=Gl|( zvzmkIy_L`u+Z_8MvXW)Z5;E$1JF=Lr3_lQ*TP`-U#bHh5Wk~pK^wKI+x)-SsJt3 zf4Ko@e*=jNdYAHR@_eEY1Hyt?G8}z4mu-&j12u@6MmhdY)8J?V;pzXWrKALlYH=jyK0j?q>Lu3q!LXW19wlKI{vUKl#^j8LOh{ zoE@zcjo+I87-Jr+o29~IOjF^0>QBHD^)rHl8IKie*QqbJhKKsFQMN_x0054G?v0Dy z7z|OS?Ls+Lk*or&u^FjU>=VHk^*cZSXV-)r2#&8dYe7^IPP#!Bm3>Hd0+&;T1pV$d z_38!ET^kkwp}m}o7h$X7SDa7JC%o51C>C|b=yK1GeNclAdj~OA#O0tp2GWh2pO7sUy?6KCbkyJF-6C~Uujzo3 zI@Y?>IQ$RUY1ib1A~3wd?vImaI_Ue#n;Nsn{lZdGLSs=lHq5#6=UZR@VSVnU&jCia z#;s^^OZSrP&nW0b@ZLsoLXCF>c^fP~GL*^^1!|TtM%aKnb|!)|lX(bf*%u?Z96H=L#Y=dQF^ePf$N0t0E)Kn7qmBO;F>kfdn^J1=0yxA^&C$R7eJGL+K; z7>2FntQ%*)ubPB5s%!Iz0x~*uv&4laGM+18s!En z+#W*kj8bCpNVQcNK-CPL1en52zDZ~w`iFL^Jm7(oz^Wak)89-y{w(!~V9U-P<{SSE z3aWBYy)z9c#XtHS8y0#M9RHkN8{6sMZvK%HsASw!A%D?Z^o*sR zr#eZnxxqmtEfK;lBB;Hhyu(OT?lkfG|-y-M)_b)6xp5!92aL1 z^mFaZc=qhsLL_oMR!79w5j*KSbg#@Flgd4zleiTlMi|S0KALJhTL?mG2OG;bn`9|_ z?J#{vr#bpGt5%NW>V$UzO8j_ZJr0(fyaBrz{Vk}NZ+<0^&0`FewH%||RsQMdF^PIl z+eFY(Z?er%y6+3P`|@~Ja`+wcZR4DbPY3lb-!B1>&nFe9la#Up#h|9#<(~`|fshag z1z1yChgBHeewOQ#l%*?=Di`L$dL!~giRmA*)T#`RvhFr~PfJs*fcdU`v*^`?512yUiUu8+RNbj@(< z!~-->t8s3@`O~Hnc{0qO@-?h4N>FC;gDT=-pdc9FUi{<_OwZT6TqedGB=Xu(@XwxZ|1^|hUnwmu@RDlXgBDho<64(*HD@n1}LRw zvI2tn04(;-qL^|}arE^@r!X9g@V}AUe|mK8obA`4XUw;<)sLnsNlTMzCLap(w_7&wYMGjAyFsi;Pk&I1 zG^_9h$QE1AL=^NZv?Dgko{>D60ew0aZPJ5PHAUj-g)Px`qMXWwyxhffGueJ zaa0j+_9~E{%b6ZPzoj`c1CCeKn>2W95V~}KVtgo{3wq{$Bvw&COC4EQ2>uA*l=lO= z2b=*j#cv+$p*oQJ`c;7ULmq)t6j*oIH6GVrHLncd;Cs@7x9($V{UIG# zzh4_yUZI&XO>eD;(vE9K=oM3|BL&xEhXlLg#xo41ab<^LR-nErY}FaY#2}(T&@Y7- zNHrSKfq%uK!Qg@11DO4EvK7Q-sXOKm9+yF`4YFt7^+jMC#Cr~RulLtA7HA1z2vcg-wt^1A+nCSNx_5fa%l*d zW2f_C+f$=OMj~EbgzF+AZto56w5zQt0xJ<4nZV8*gI%5?K2kZxY)k;5Tue-*57zGZm-9so%EdgodgU zYAibj6SlSl&Yn9rUefG@cAK@yQU^&W`MB#$fbeTAG-<`n@FATzfhmtz8Hge4VP_-} zRIJfoyu=xcH_H**-T9UvC5wBJDt2}b6r$Q^uBi0P)(`PsnH6J`Sd!~ZR;i& zU3^{)iGIz=&If1;3i5BE1fdGkLg42cb+Gr;p`#yxMEPhW#@PJ8n<#_ zK)W_T-3ssFpGqB!AkbRAZh37$%Wp&x&I9Lvml{X-YoZs9zMS!#T>!dfXHel;>N;g* zbJ2CbNds$%Y3J-5k{SdIc3BS{J*M3dN{T?3{^H;j9%}v%go4}3Z9zYJo-d8~WZutv zP^REbQC#NS)sDPGp?mhDCnkW9zyy~mo}hCk(2@7!9`J?$>V9gTF6eYtoC>uaI#~Lc zmLN=Z9kDc0RaEepZsN=)djM+Nt7^xopp0Fm?@sIGEW0Clx<<{UFyHc@g<5TI*r4Ce zRXB`4a`jK_^(&Ku2g?X!>CNTqQ%K>0D)ylrhQPtS^oZQP1UuSVy>5Iusm{%-iD?6e zUR)EwZthYj$EytCPY5kiZ4ETo;32fv5;PwM0J}Kf-l{E~{T~_MrL23u{n-lCPd%eE zvq`_5u3q`}XOf;Upbv(M9?)il@^q0^r)n4I>5BDIySZ>;hBBkN5JH@&e8_zOy?)~} zc5{jMuY4obVl(2zmLHt9rAda`IBg#@mHB_b!2fY6q)Yo}X71j#YQ2z%oaqU&PE4%) z(ZIGo6a_$Bw%xN1DZqN%iDv#rw3(%X=X}Edz*?*!hVlusCG$mb;r=H7?ZNwh!K%%F zcc$0r_c^*VRz>DjxSLMe{&CNg5&o z@vi%S1gu4*xQ08E1wVgAX^8kMN$(EFU{zq*J|pEx$*P+q?Cj!_-KxjCf#=Sq&0 zTRp)ylRImJKySv;iJx1{bM^q^FxFIBY`6-BoeH9i6zKN}3fK20O6jM0?Wt7JJEI?K z-7pN^|5#jD_%d|d#iliMr{s(ff}3Mz)%?hMnlHU6Xj4=4t<{lv zSNn+{A0A183U``9;Mcy}KLnUgJ(G&v0-6Q8rjL@J^2(D(jpiM2RS+Z1C9IayNhRVEy!SCB508Q`)x-8*I>(24y02Z}U>(k_V$QFPy??~9tFTm~ zOY|X-a#OG2;U00I$?UND;kj8q6>*PAn9Chmw3Jyh&sK#Oc$b7x2Py}hfNU2rBR4?X z>UhkhB7Q(YA9QAfT)GUIsMrIo6|jghsf0^Nv^@r7zDjSJtleG&s>8o4?JX0+fLC9y z(jHZdgXG8c8LsqA^$z9iW5Telj$;(pX1vT#(heGKj$_wKsw4jhK9=U${Nc}@)o$d3 zw%?121vHz};YAMvq7olyOuZY)zfOfs3>xj&Tj*?83i7r84BMeUY6N*iP)D6gv`ll~ z%)VD?NHaip$9dowjV6W?+tBnvEfVG9VTP^@ZFzokj}{y(l<#Gj^mKbkD{zm`hokPs zi$FX|w<47Je)hM-*jVYW(t3WK1(6S4zKo_bX{2v9s3;j3b`W9sCWGf% z#Z=Ngdk3sERLF552X9p8nkQ{H_{25C&JMfu&S*j|@4q0BKWiSWf77vC-I4qjkCrz3 zniJuzslYvnsd%}?`c~LAJ^eWV#Y=ku#%PXlzitHV4=U05s9uCw3(H{b(B54L^|{8m zyFa;xnK+u@1S$R~c|vF(<+bsUh7EaY-vl&ZC2xG4{(?KW%xtO(j8c(bu9kC;lp)02 zYt#|^T!beMKrsnJ%Z3wx+ixsxCCLJ}NjeN6O1)NILLl$*P2*Po7JdrE!WirS0gm>uL) z7rb{P2kgbUw~WICSK7Uw1il?1ko%ftK>eU4lYZQJUaPv}+x0JDV7E!e9^VZeB}P3* ztOCCNN@m9U2A|zKhfRB|nwmdtO>Rp}lstwY4`8%q&5}P<%-FSKaqn#lqgT@3tv2jD z>+WnS6_z4iZ=1kTgv~-5eN-4Z);8riR8(a@l%r+d%rNox zDpcHB)~#|xLs>gbtY41MkF&Srvh7tmRk58XIId^ln2hC^O!5PGLVgpBggz+!BeH_| zw++wq8Oq5y_o`^iKJ?XT&l3JD-j#9?)YSG2AdCyuxTSWqfcNba!HV>fz<}-453M(y zJHDRD)Nvj0aRbU%$HJ^_3S&iBLwiwd~TzyMDhG6mZE`>yw}+mZnBmZsLzv4h0R&DA)szDV~i zjW#TehnK2@o3ig?j=l&~mXHQl2eJwZ9ev(EJ5lM?>hY-Lv(8ajY$aAa0i4TURed;^ z{rp1b@Ay;k<$dy6EbI3gj~yD73|rgr=}oOF3O>6>;6ZNCwYcN**tdYQhQfag2oQ|O z*23h>u@4HOZwgCr3Oja9ft)J$bE>Xl`bz^T$~MXXNYYLNC=9>#bQ_SWkeBqzMD@7z zB@$3!9lJT-)@JO_LP&kz%r;nN)s?W-5hIeU`a`fQ;5fU37Z3*Ix;{DX+jHvtl!Sd( zPfzTJ`PPo^M5*kWnlTxtk^I;c*Fgz@_#w*dQqqDdNdK(VtTu~qxXbs5FkE~$X_(m z-$AWs9V&pm_Z7m=?2kd=Ena^YLs_A|F5yQihE-X(*5uux;yC}wh-ex zJW7!5Q+mwR4_FY34YGWKpkFJL+pDa5lAITCoaF=~G?S`u5%#-sk5*KiI_c79y8%Bh zY=pDn)87~Z1lOC)!~OWAT_gr9J6JsbT#8F`v^E?yQZzqY84Os5c~Y`783Bj$m$knb z80{UbrLy{7`n}r*553-1HHln|Z2D*?Uh(2cg2|&c|3inLvj_c^zjA#;=Z54+kic_^ zD?#55UCBr^&;QVJZvIx+R2-xu|G=wU*2hPc_}W(l+6Eu$?XCCPUQ+O>uEvk!fU^(f z6|dl8$d<3|stz~hg_|7@AA>O|HVU1GkFr#J9Ju@Bdb&=FxTt8kPB~)5ZuGRhz_Fbi zEcBe_{YpcvF`hj`YYzGf`1{bI= z4>$9q`3%O@svsB)xHD#oTsu{RosalA6YIAR4Z1LN(IyQq@jeuL{pA|9&bC5WA};{$f-QBWWSB4*ucMDdCX!olJH%31&%D=sL@6Oi?$zm9!fPXY?o?uL=C9&l+#37#XdqpAaycM?43N?9$A zJ#^cID{Fa>8um&uLz`su7Dbe4nLww!h5HrUe5;M?GuKlCuu0U({RkzpIZ|PT8$?gI zbOa`~BpxHpt%oy71)SwmFeWdDuBhee?=5berBe=q16!o3Z)A8w1d&>UiJj8@3@4jaHiT)j*{xHyT zZLIV|-=`{nimsvIEkB?p-U=86?9m6SoxoTVOsOp{9^{^g)3+F}d;1O2Ro7sd9G&we z_qvI$G{^YD`X}7U7#|p~sQgkxX}fSWxPfJ`Qh=%ya&MwTNq;w@*mPcJYlA1Z)lDjW z{=J;fa8QlgSsB42bo7hu#ICyVATI=a(UL`1y)3-8uG-V zp(oI(*{6p(Ce19{T@z`1JY_YS6Tc zhoAB5ABZr6?u4{BGjNh%tVc?U!fGiC4@p;Kljz8O56mR`SWC(+@^Aoj!UOeZ%r_y1fA?u_onwg0|R4k z^BpVUUl>47lj2#i*E)6Q>m4W0IoEk56=*sdGpLIOr8Tyj%9RSM?Ja9Vx_a+*V!~c- zqxXNO-Q7%VGyg?1p5jBGP4U`f&?^-YxNC~y)&^8^4%(|$Eu^;g&VgzE=~UpN_obC1 z6~M=E9BcDKAL_77U!~bcO{udae{S_%ACp=fO-9(i-c%;OR&AF)j-NdLgz?fJ-6jCN zEc|9MD~vk#g`CH}xHtK$jkwA0tFuBg##6tvS^TC|Of`QBa}`opuW6VXU5et<)T{au znQ_Z6(ajU5zZkf+a6P@*OS_&_Gang~>{zEEj;1?blyyuwH#d|VFRZh7zBvCW?$;M? zqG>Rfpg53Q&|vI3pz1uLr*D9T!>Af4pyT-+D{a)s$zT&D4yqeN^{O2B)&iBPJ@_~J zKAb+lyqd8WVMXwG!1DJ?h~q(eVdfK)L~m$p8q9>8>btMI5O^+MI_JpW-}Sd^?&h=f z%(CY>y>&*YBxgvtClKfmcj}^NPWaeLmGC)|53Ezq`M^e`OJRGx3c>oE`AM)?`(?8m zd$JqMZGN%P0FRFbhO!D*>%|E49~u~n>R{Al*SnEtjy3DIE_x8pl@W>+)L*YADM3H4 z2a<98Lesgya&kqB>qw?8Vbah<4C4;;=2jc%C|psi*C7zfP<=&&0=tMz<)74%c##RW zPZJ@UfVCmZuR+4`_LnLbrmnNSz;Ln*w0H0s^sAF5?2*$mZ4-9RBoRtgeFr`-P0Xp+ zYfHB)*##OENK1oscMLf+Bi$t>49qAE0}PEY#BcLF=ZSOfx#ymHzvuUt z%ywRT@A-VzXT^K1^LdD`_Lg3B0Ro6At9j; z06cT`o1m?trnNV*;!mlyYAi!akri#!VM2{AyjXgT{YCF%hk+1gAQz08(;1Ojlvb-f zKJ84-fa$3}$1iX0tQcv{-$=V~-N5G)iiYGsLu+kDD%B0QPXr~H`MMa2k&lkp; zW|1mA#Pe)fqS>2@^e(TIYT9IrNlGxI{uup~V!iCqc=HQ1h|5;ny%EmKLnmMn`*!1u z^EFM9m&aj&)4DV2q+h|tj7^^F5myJQXT}w5k&McGXP881s3Y?#{Fh7ixchZ#_Fc^d zr$mhRME2AF`pM>(JBtY$WuK4LGTJ&9ED)rBep+0;G{0k^sXySSp3zsMy%_N>Lz{&p zzR{VQ%^wpHy{&)zsn}|6em7Prs#Z#V(K(yAq~(Ad(pi@C{N$>3_=6HqIn)PK4Mz)7 zeqbk?O0x|sR^;JvJLjnG>~8M@!aZ-0$!9&M#PwX(5)?? z>c-hof6@(}BXi7OSEPI${0h=aDe!b(%>TwjLyDxExrK%N34nt~r(EE7G}aMrz$FJ4kYT!$1ALQVN@ zp|{s&stfc3io^JUl*VI$?X@&{NAKZOKIgj=qLyy@Y4Dn3pU9Z$#i3smzUp;Lq|i@mO|YM}Qki2-U8& zsptZI1A#Xrc*H8jnWQbZx@=G<>Kx+A0i#oar*eefI`?DkW~2VO(N9hm%~MDbGVn4u zb64m&tq2i2@6p&HVe)7 zG;g~szKb6B(zG{t1eC#+gd;}zaU_C_--mq1!$Rx`W}fbvR40AP-Ns+un=Cl^At z0SDN2StEer-EW{sY9Zq_$F14PgrYSAZEfxFFBux;dJSJ^fdHCsC1koWQv)+!|2_x2 zPFl{*T~p@NPxDtt>IJRu;6W*#{Z>_DFC)WLLAz5?^1;g5ho{_^p>M45tgP0h&)6Rc zTmF;@#?Cj>@f9<9D|G|x+ZL|CqOpdi5+J+f2of3-AL&l8(eDi+eJ}xCUg0mSY8J1m zo_&SdbcTW(N%@FQ)S|^!r$Li4jUg%6|ICrImIn-LJ83Z?9)j-&Ka*uawhIpg9{Qo^ z1?&hL2Yq(x6ZwH9VO4T}5G`>{Oi)>EgtXt`q(2+0k1dsHolMtQoPF4m6~zS~XkNaI z4Lv(Hk^IS=M}ODQN&(*eT3A*Z5A1E z_!0azRE*|kv}Sb2M+IgdEdv8Y6x(k6684;D6DTG~-u0%W=qkL0viGsw8y}w(2L$@* zbM2e=>Gu&n&tt!-Bab?kn)2*VNm@A;g+-L}t?<>7Q>F))4?n)&e^m*Yv|`>X!1Cr; z@J*+En@@86pz{JtJb*%}bd>bLfg~PRss3mr)4ltT)htgdu>yRB(`esHyT81pnGd&& zmSC0Vy43kV;5F><$(~OJYaj7ph5zN76(QN2<)!)Ng1o%l6#aoD=SyCyl@=VuMha&1 zaRN8eu4b@_VeG6fo>|{Qa+8@^=xt*=t4-e5;Hmgr$g$*(LRu)i=v!KCwV#W%y#X_) z1+}Bf+rX`MKiB*hw&>X+(ewe_x(z1U01K(z{s`rB@~Zv7qruh)DU)}?6ZS@i3QeZ6 z;GygI?yoi_@R=3goiKJUo23k1C+1<4C}jNjg3mdqX|P%IGjjLn$V8{sEh~fR`focO zEaP(s-Yt9q(l#@DjOC>mmWucn+x<_2kVhiEK;WY0r-~BP)@{!17u%jVzdchjVs(^n%fLb2XeH=4Uf1vzKKBu{ zF*r3B4zi!SHJ`aM~9Zw zZv})(Gi0`3GdnF-xz;}MN@Hmx_~b;Ffu}Ir_oB5AR|*@H7K&}{CY?aWrUrM!C&V=m zz$WbQQu{oLN7fx@BSJSOewYOg>cr=AGQ{k35paLfSV;gwO6i`UxSg!5iq7p;h0#>) z?7}fAzwD>a?T>4XaiAllcpA<(YMTr?EX>U*E6L-t>1wgD20i3IFMs3UL{}>4hyzjW z;WLyy{t++Ed0G3p*X>!2WaO=bQ+0?*3%?1<3yz0B-+-hS6rtM{fFnp-RB1Fi*@{aC z&%Cl=_F9#KniihLYsq9|TuumkrsXN6tx2A_I6WrubhucFl+r5r-AX<>K%JoukV&A$w2 zV?soct!~-ucd((1zDZmbuK>Mp^GC8xc{EU}Hgks0luB#gy!%lhT~PbtWW+m^;AgEp z5;4WsR%tXRHr49 z8J&NLwp%*(Y)sjlzj=`!mBo&I+uG)s+upwY7#nXZ0t01l2@#nPHboyzB6|IpSfD>38H!i4GlVirPLOCpdR&_v2XbrzmUp3xGy2Q9g;ciZM4R?%R5uhg zc<_wn`5Ga~jZ?w|?Q0#u{0thFr#19JO2N++!ESzmMO_UiQYEWSV7zOq$1A*blM%sg zkWWhcWrPMzC=O9;3hd9v2^=G1Ii`r5kecxGkI61%iTl{7IqqtL;lRM9gJdm;_Izzs zQ}<+$m+b2e}$e1VHWPZu?&CK_qS`orwEQ%JN z7;#6SBd~cx=CF(_8PFc-3+lXP*q(w5xo`au1VoEP8g_Fhc z`*a|vX0C*b^F}i9%*TBL%)tvya%2Vpb#b8|vfwZ;d%{3~CGNW?l^70WB&vl(MV3pP zc!+M@#r3>QQtG_Ax;mvJ>b?Xk-g9)V&jgX;!K^-H`G9u>=q5CODgN-aK-P66bSto&LBE;p7JK)*O&#Q@mHzIBlYxRB4b)L#mZpZT^5fqF z3Ed1IVIs0?urd*1fUoecj_JSDjenSD(Yx2cuimT6k&8A?6sxnWBVjPli<4DOdxW6F z;+w#RYYciKpxGBT{H{Aj(~rzk5)&;3)QH{zWhP(qJ11Lum8Xz{TAmL{Xk6%DG||ZHw)qH=?Q_d-t%WlSpfdu8<;TTYHa+h zPCTSGg{G7;#)m*HAt6yak(ny#RbS{0${!*v%beqQd;wi}LRlip2g+THsh=}vD1Gsn z`0vxv-oHawlYNISD>T@h>G}OTtVD!F?(`%iSpMCK-HZ5Y0gK~caFGu={vY9p?M*CZ z5^4rZi&o-UG-|ua{a`BiTZ2u|_ha|ONRk3o@2Q}ZPw39Av#Q?KgVW5fp(}y?5oz8J zv(A&8!ARbyw^z{Yi&Zhf7u zvU&6{&?O?%&vm7-?I$6@cmqE~WLo&yXU#m(^iz&$hRVY%uR*f7mV_#2_m&vD^4IN` z%J6T37K30FFP$TeIlCLgKWm9Lc%^kL0xyxg+}k6b9_Uvjq^Dn- za*j%^8lcIOKv9z{Z~ne(QQ_FkBs=omR&vKX$(_GHm4j{}-mPh^Ep zmPk|3qgnoiKFCi3+m=!oH8pfjq;Sl2V!_cV2*AYGdbTH@LL=;1k2H`vnJU+}0T=%? z1Pt%N7F_clyTLO^%TaQw_r=K+6ewgtfRFW4kYmDqxm>S5l{kt%QA{t>04_}-sthL2-E)xA&lmX7Z&vPqTbTh-hc zr5y&Y8pv{M8Ua>v;zGJeX8pj~;yp0si)(O-5u&1>Ya zRirrLyu4^D;){NOp{4~4*-ZlBGM+&kt220#-|4B|N&~;M*+aN!pfQlyXxh;OY_(^@ zq_GZ2<@2(aS$xN7FTb)4d1^X?oKnm;7q@WFty(Tyrohv;@F(4nEfJAXnd#7d?85_r z+UdG2E-kd@Pm@tC1{gW{y?Z*Prl^LU5)6+KAPqkg%n5B^LG(=8peGv#pMrzZjmoRyF7{mr_nl8goon)9ez9Q-YO z_#aaefByw*c_Tm|V&q~OLqhlFJ+0AQ`c2Ls2041_S0c>+5&phHA~vK%rEY)a;>=ZVX|_%4W`0!Q_r#33 z-MEg9LyU~%1t$G|W)at6x{*=Cyw2-(75GBTP*t8|HA$3gY)$xq4-M1C!pUCeb$t=U z)X`fh94F-d!*B+z75vtKML2(_jyr_R{G#qY-s!8dxRo#h^MFnqbrqFBHMJe~C$}y8 z)djoeZly$%u-sS+$#-2=diVUvy+Yv*Fdxi7q`Zub^F^y-(H3$$C_vq>we)!y3Gd@y zJsHtO(!xTZ=-{oVFaJ69-BYhzaVIwWz|BDy@_Bb;j^Jzl^YW!uUTs~nx-jPILulz7 zc?Dr&U@O%LNPKIk)r)tp6}O>Tlbl2|?jik9g!ka6#53Q6C?kjD6UJr9Wl!J6sESk! z!sOYe%X5pw=pP}|Zbt)Pj?fI>*-!lJ7(i`C9nmDlrfrAR*Wq2DH5?uWha5iGpCPhs1M(Xj}kAtIlCE=QniW;#%j zjw|<8H-IYE^cCLq-}JQ#6V_=O#Wff|UB~@DH2Cit?teCuzWKCKv9S!~2CiAnd;Kg` zuDiwn>vIFx3d#JfU;zxbhqci33u87Jy1Kgd+Hh%lv!%i|PRpXjJ0-dVdnnU%&DI+6s%>`({0w}O^;FEm3T8wst0 z+oJTP8r;xHxLT%((D>9UJyMzavM_lmMQ&k^uP<{am?}IM^|V{PT1#i^RX$V;$k!cR zH&a=SE)sbzt-_8KzoLNZTt5)hD#CK%#+#kl&#QD=l@WsJa0q$`9}U-9o1lg?y4FkI z>1Phs*0%a(yIULnz+XSvwbZWJ0j>$aQh2iVU0Qrb?_=SU;04bm?H4gglJm0%buOyi z|As%_;NYBGLRkBL^*!8RWZ+1^*Tw57V6%os+4Gy7dNEsZnH#Bm(TOmUnM-%J#?HRg zX3gan_IvE*?;eQx3a$1KB&VPW*71m$93PE7;lnRAz@%LPrUblf!T1%bK@ZI;NYJRs zbDz)r1b=!`CM2UM1MD-(Fg7o`|5?WVi?3El?hBa9J}GkjM^~m381wb|nqRqo(<_KU zODUdM&Hh-9%mBOhiM)3GyDXr*y$`5SSRf#~vWuK=+p*UXEgk`cwJ;z<@<>DkdBkfu zO3U({{O#RYt7mXm@az8y%E>xoSxG;5#Kk%g9ANg?qmW})z3``z?6bmWw5R0vCE2@C2+K&A{|x?eMKsT)0TBlX%cnWC-08qbJfz zArlAKo2jx^<1Tt=>LJVo!3{So(I3quB%BN4Bp4;pQ9R-sIJjwAuLHgq$p-Y+y68gE zNbYmiaax#K(lEcef9L)S%ovt`I&BOo$3Z|uD#V?*CF!M>QGks>>W7HCiDc5@mcT5g z0sIcTPftt=+_9v$hdod9myHKe<=|bKwk+T|?fv4|`UAOhV zA7?Gp%yu6w599y%{K7!UK29?(VE8&+1|2MwxH!Y!nkvZ0>yr%OY#`23vqMC>VfMgg z!y}0i+;qG&JO9hZoY{}uwkb7G*cd@G z6oVI|ikqf68HP(PNAiekzTz4H#`r7#*-JD@(((TOdk&&amnx!dUg-}yG8Zs=Jpk4` z`|v|LskvUZRa?)pm8zgGxS4*Y+E90#JjHX4Ip7?sg# z9eZG&-{z02X~XZfXR2Le8U4WP=MN5NcLzx{qGgLEpR+i#(l)2@E%{#`amcuH{&lG8 z-H^Gqt{U?>zk2T%wld%_Z@Oc;t^sj~?}{kxd@ymo#hQgN^dwQ|>5~IBwdU8MP}`V6 z4e8u`^?b4m)k+bTyO!8ljwpO0cR!W4*Tk6at_5VL24_M;o)Hp0{MfJlvOkny!%M4X z^yF3oACSrDWG3rEzd?NqrYR%v0dc6Ws8b{9wdMVdz0;ql%6{$(NA-lQI*fO*IvvKnS}&{>#P1u(#2?d!|>q; zDjW+=rzdX>tW9)+I``Uz{rsHchczEW3mo%VEFHBkI8W70!=?l-r!0Dd_95_hx`$cf zg=Vi8O~|n#ltsHfZLP}6Ix2}|cyjQ=2EiYbK!pZfD=*epl{Cz43|-m2@rZ}BJ^4t^ zsz$zN1rEaA@)Th*FIZ_dFMnjEHIYCFRGb%4d@>7%^ zy2Ocrl@ky`w?d2L1N}mf`lT?jy)-yV>*N{pwg zqy8%Iyd6*ago*H1?N=l%+U2NbSsIToSfS8B@wq+epv($3xlC`k^GuGuI6^U z+j$WlebGApljE;@6Q&SxpCqgFLZf`L9spfQx^s_|C=4JG0^0}KI*BNLUG5>v=-pT- zuX5e8k}h?~6~RwR8pzYdBrbKFL=JqtDe}rrgZ%R4r`r(1mdMTb5BY~%O!RPe!aMcV zv`3W`gz&Kx6-5IDIRh2#3CzppTEgmc>POod^%V_?Kk% z=ay1f1E3ayEIu*uc@2$ZAUm}ZfUVyAJbfpViOmw;*osAOyHS^G8x|Lzcps;SfT7ad zxOz8WHtGHZ1VuvvEpzy`#_^gy515$Hg;{w=T3WCKX&8J!$oy{KOF;;S)n8O6 znIu7#j-QE{{B9oCi6hI))sWF5+Fa7iYLJ?b5~@s5c1|g9ec^QUH0q^6g#mc2^~ek* z6Bf+)A#AHyh?odGRo5kBXJsyr3J>SBG7&!R0148hkG!Lb z)HN+-la5e8wfwBfORUr7eW_Zkk-X5eVJ&g!tED()LppoIMBNZ7oQqp*a8?y14^g<> znDcVoy+PQDp{fH_DHC>C(H+A6;E@bDOdO_vVt7%Cjwtb;hLkw5WE1Ftt+gxjH z-Bg;a?4Ga@ggRwL80KGyhYvzaoApBF<%ckw`Z^ZtCvy>xJr#=Uj8b~*ZDkC??L6tq zXS-(_L6ep4&`-LBR+2Di8H%AMf=1KTbN96N{fWc+q3#cUqQER3>aJu8egS*i4cgA( zF3P)o zR4^?yIp^;{WqhA96qGYmi>ugp_!-+oT_-*8;m2B{no9LkCSeI)$N3xkjGj$2OT~xf zdQGn(Iy9c%W@cVYO?7Sxjb=A!q_d{z2L||iYqE1pw_Jkcm+QLnO?};x>Pwj-l*iC?C}cn7MHWkpj%WcIAlIZ(8bBu_DS z4rd^K;f_DSFE#zWQ40I?wM1B~V1)Wv*5mv)Ik(j`4BjG8QeT;4b!Aev?~g7jy74}A z*y89o8%xYhlxrj*8yu8{yho^es^FZfN%oT-g&{O6MIeY-4Qx;gKiReLX$>j-7AUi9 zb~{%VnBm#l>EzzVY{^b2a`-3*6hT8OBd@HTRFZ4dVKr&2)$+qpJGoXR^p%IMfbvUe z;ya4bx(u<4WVm&$_2C4golyMK9n?8b^wIlsT+iYPZPO2!#iG zDyq^tng{;H$GO^LFU#b4-S)qhxfP{N&6Ew{_DdYjGS1iR&bos!ph@X-0YmeW!e-%# zI;d(J&5(cqWY8w3mNJ$A-;Ku@${$CN^D}3QEBwBJWp=p9>WH%qCY0>)*NX|rv;xZC zSWbsb+33l)ZfLFWL1ec%lt)^ZRDC6cJjr@L={7r?dhI>}9v`0~;nfcEJO5~M^Uy|w zrAFCoA%4BE9aJ+I!8_5d=AH-bKigd(u5($oy;60L2z^=m?#RY=SDF;S`o*@GdbS+C zo~D_ee&mp@(So5S3?J~>F-2&s4U5}R&5VI$jw*3@TdF4@TFt_f-D^Qge?z54jq%o; zoW{@TzZq9>s{9AU$5tOpHIZBjyJ8^I`D>nHz9*+mOI*AgFA;>DEpZhFF<4@6#~1ir z1Yf9PF^f*shzAVaHO(PnVKB*yOLW->TbSqfc}WQLZVZ|2btqGv@ALqy{MgJ=AMmD6qLlhd51$V3 zK3oY+p4S+W-X2`Kv5Jps6oUT#3XfQ>VV}h~nFka8)v5gbfBzjn<1gREzw=pJ<-yoq zz?ML-K?}UMc~aN(wO4MvVF2A9zZtltoD}U7M1k+&`jk%h)}&&q7L-r?3#7);=uMa6 z^FMBv$%rN3=&2y>a!Ox5V?p(?uja5oR!-Ys?sVmi>!N_X$;Yn+5+$EG|A_Hq*|30Y z%+dS%ePm=~|I0W3qYk^wNZK^jYC^tQ;9}h_OajbXWzpSAc$8c6wwgvVV32Z84jESkoDRz+hg#er zAhTYX3Io=fj(0R0Y>k7ckr#E)VR|7UA!fD+cug6n253F+;ER^tWm~;9xy?(q)!|Pw zgh-2Ap(#c-6vN$&4-SIib(xn0Ha-(ty*RJkNE%dh=3*0sDP)oRFq zYT2GZRPMsD`~AQ#?Pj|LK6SQQ%yXEnwj>B5KDR1Sr!_Mh4~_}o5)DVN8UJ49-^^i>X3Jbuah;8&EDEw}7ff+R2ZtsaG$f^uDi&%4 zTKM_BC_Y;ZfxF&-3eyJU@Jo;wb7!UX@^lxWdq@{{Pj}s`gl=GNhRoEwd z5_&wMkdEiPt8~dhPa(UX33hiHG};*KU%XWqY@>#Tv@9m#4E%Iz#uR+i#xtf zR9GC&|-_8pXQOZ!7V z+e0&$Si{i!-tfPr*+w_<*8I6|@7Oqx_xt=mxLCg*CE7hqOOss2QPSSA70PUx(ShsT zldZYxh}5@scM*9mHkzIH{%Yj3jMsmfL&gk;NxUEt7~ zK}Y5<;hyY6tn2({efly-(K9$HW__ph>!XeFM4K@T412Tr!?eM7|F#Cc_oR%#KOQ6r zdo-77^Rk-HZ8_i$eD^YW1eyN9;dJ-+Mg7Islqo7Y+SkXhO8L(2e@2KuRF9jXTlwB- zOud?|>631T2tT*_4I{YvwNUzNWV-_ciiz3u4zaH0`AbVnwq2HMlz;4d3`*Paez-clJ zu5#ZZ=E#DMJTwi!bju3?P!{_!<_Tj`jOUp_|co1La& zOb?UMCdU0B-YL@>FR(hr)iQJcf38mQXVD+|IGo@kSMA!B zrqAgP@S9P-0H${V{uJ`p)p>!76>okU@2Awz5>VWjS5u?b=)6U#PU?L{|54?oyg5Uh4t4#L?;%Ipbo0*0A_70(vDbVaP2PAag09M%r;bu|6 zYzGtsbVt(IZ;kM+KA_+Nzy9*ZyD!*F3bOLwdN%j6)$_-dUel0|0J?A zyhR`G#aWNMzdpVC`S0>X4h&K0(QNBOAeBRkksuncCyyULuKkc@>`ls~1T4=k<=wk? z0orU4`!37}2Zua+WUEGiJwRl$H=(M0;^(G9+e_!5%Jb)m70}andL*nTz3C{h0A}6mH5&cxQNH(H zWxjb-9e8V=<_PFXH~pF`mkkHXxiQP!X2KUgO@Q>nYrX2wPy&|ig7}Ug;>1{G;h9;0 zr%q$L6=Qb-kc}(>iPm^vPGA=Z5@_FYm|#0s|GLp}oj%dPy@(9W!p@!ubioe*l-f&M zb;tx&WuZx^{WCbTf6jl`efA$%1IsCF9y^0)T;`F9WF@dr3JW+CZ1xVOn(LimVzTk% z&*L)$1ZVEaxxA~_rp#@b=Xg!J!}&vwS@j#$t_oPJ#`7Z_fx7j4sxreC_uAZof`Q#0 z8uYZw#)RAv(%ZY~@^IP^v%JfR^xThN72fS6EpyG-2F6_fyvSG1U}Ih@D5|tAbGZ1I zXYa29s>0xVcDDRROG_)~;f*4>%!+q8o_p)7S9GTRofd|1Kz(f9ifHhkHuc}RbM2!F zqg|W5u|!x13nFnEr9#26$aHMEivww)8ouJJip~D?;iX41lo(v6ju2V<;fm zkK?zR(5;*wmShE%07~2b#Yho@tsQxQHWAo$C@`$-{m16rZYqu=U{nUw_WKv#m?Vl2 zS2(CHo>=5eCE=O&o$+C^QbU*lpx#P<`R;S=x?bh{5gLiKs}&XzF$7KxRTmFCJA1a_ zAIXkCH|D<)f?(zEL%f%dy_@&#bWe^oGvZspq?aPc{r#`pj$4SAP!L!wr1fIzbPha$ zN5O4f|G;_8Qchkzj7HKg?{MAzD79hlWHt7x<0Ss7s~hMj?W=g`5`|244z;Zw%Cu&f z)l)N_(rac__4;fMKi-~Km5zA8hI{tGaK>pmtpud2z8v>db(w;pe7am;x8Zz>%6Jg? zdCM)wB2j2q1~U>Y(uK!n7x$yXB|h!r7Of18(`S8ulJVZVgDID>dd?@cRX}4P>~xSz zDgL4J{SCB@`BtOTht;%W*(5jGMQ%-fwkzJBLWq?`$4BvolPQ6+nR=TG+W97z>XVZ4 z*0$5qqL!%)$A!wOV*?M#&use1_MeI_dk-i?W-A4z`aLqhN1+uFh$InjU(cUo1qsuG zN!4bUEO>t~Nz;rQrJ$=(ja$nx>Vw`hy?U)}4e({O3aO-|{ z@{E2O27c+9c$b`9-dQ7IZnr08vqNcd=ElGs5cz=^^}p*O_{w6X@UTZ;#VLO3hSC!^ zuxx(k0?_!}0tKD+W_p>JiXz@$xx2JU_!U=Ilr?XUC2h>C&VBq_KekP`|1^4o;P%;)#2oqy#IipPCb4W1cu}3IpL&y!? z73~_VQXjnUr1R1Taa~RD1%}+d0jjr1$8&RQ)PPnXyOZOl%aB4~1cS&O@cB4i_PoeN zd40AAKpNm`*sR=zBTzFEKbGT7@k56EmA=E)ka^`-HC+S8_d_-+^bbC#v94srP{Q)F z>FtGrS41wBxaKFAi=G&&d_e;g+%fN`=b2M@?T_HN+8F{zbsvDX`Dyw7w7S9 z^i8+r$v+AKvoQ90JG?6itLTX~DpjW!#e0@qC-dRl=5JF8emjv{42j%RQ@rbjFD#DbGUg`+0Sl>89*d}UZ|kCVkvK9%Gba6KB5B# ztJ~9Gk@mq(n;+}$@xzkq!F(rF-ep#bP=DN;;kS2KSXpBQ2K_so&Oy)5(H+W?hLB4j z(Xiv|k*hhPB~+aWelF5cI@Yqbz(PM2xxsG=7CM=bY`_5XhX5ucQd{HwtJ!Vx>`k-f z>rU~2i~+1^H3V5+r!(Z{Y3N!Yx4Tu0nq+I23*9PQGd2(HYF6(6hR79bTM9|31)wWB zZk2E*0F^Jg(?Ivd{gm%m+GO8R-zrVQBW!4DZc;8UEoohYwYQ5uVVOnPlYMlA*|Pqg;!Gzbd8Jb3xLLJp~KZmHil6?7xZCcO$Uz?{yQb*`GykZCC}FB zAOmaY^1cxFYMJnBl*`LBm-3kn368_rM)Z5V>O92UV@i(I1IfNTJAvW#A_12WY2bFR zKNQU?AyGhHyGSS)J3FHxTMLm1)98X`EJ$^1-mDqFwKwh;xVNHvS=H_dOe6UW=3m{;k(R{Hh0*D| zjxArbr#lP_cL)wS@HSblFKZgqf$ST$E+6#>mhJl(Zc~jxg$2ARE~9{lFW|$f2s0da zN8@Pn`*I?MSP2z2O-7ou5T1*9!IzM)wG@q7a^vxudh|>gcTbjfw5wP90mnQda~>&4 z{)Ah)alPASkXzd;LDhB$v$Dd_4b|;_&(=0kqZ=@6y*zqV!gAdX6 zy)ral>)CTfz~_6`L*wEYaJkOqbVBtLDMwef^x!X2Mx9FZES#kQ;-b4+D7GJiyMF0uz#rI6c4~r zKbO3LS*eg9{se!I zxvTtCVsI;h$4Lf+6l0q&@Ca7~6SyC5Kc0?g$`)oT{h31W&5D2JGsDv9d(BX`&Cwcw zVc=Wf%hRP-wO5mgq@?OMV%2Qf#x5K=q8KB@$kA&*x!38_8E%P4dU^N7YaA$%-x9_Q znvjGA0_E;DhRtYzv?sQMn2<1Pt7!yrMWg)fv>-xOPXhnvI)B&|31GMD6=#SZgX!wm zBe*@&DL?v5zBKrIskVb@(8G_7*4lMm{uxN{u`GvpS^f9+0s3^M4Juxvl|lyMk}3F4 z3^nwSS%vrX`*lzFG2#+3gjy&m$VjDaXlU@7FMQpxykTQswebG(WaQEq`%L(3jTE*; zsx0_SyG&55ehd20_*0M2@&VUKEn$uDh3OlApi=0Ao+Bsmkl@N%$2o_Th1$VRUZP=j z7cluR=m3qJULggMZ^2qIG(h+82~1>O*Me6*@mVeCXx8M|x`$@#r3li4cHLPzs*>Ms zY^xZq>_{Y*aoV((w$j&@d~n|xRqn^Ly9Y?vY8dCgZS|Nc-mOyskk+;R+p1{aA~9;W zmRkt`XcGNttHZ|H?{JAuMH8!ZzeI>*>cp*7YxTGYpgGtBt4^MNkuAxeFR>azA=BLu z#82u!D);Oi37}{A^=UlYPAo9a?whFOsmfIY+i8kR%c=TX@b@0D*5bi}40q$^#^K|n z0-AWhOlhg=Uq2n%_JAu#U?-;%a$fE z;7=@K-E{-fwEfB(WCctZT78;4cG#Enl+q(M2pHNrqWhycnn5NMF$(asa#BgWe_uI& z)sFt45HzIP*CdNM+5%|{jx~O#AGdt0!26`mX!gW;*$#D9oQAN>Dar!r8{Vufvn~z! ziL9}Tt>Gl>(4CE745_eY108g{!eMb5=Hlc`9;mo4a})c({85?%0>$lP%{b}q5ZKDe z#g(*g&RI}P@zKK@;ESI%ik-!NSx|6v_Lx%WSKDTOW!w1d43>|s47OXTs zrmVeSGx1hfNoIW=@N{NazoY^5>Xu(7N)kAJY45nHOn~!h&TPYddw9LJePT0QXSTs} z4wl%@E6+3iGLm_ruDL?(0=*;5Jv%jJG+8{k*Fij9dLo8oYY0%G z08VxBmPW?C4S>bxL7A?_z|cxja!X-w@||~V`WWNcGyP9-R(+DFW#;&x8-zs znV!Sp@`r6VSR!D?W-B+F$3J=LCe9cE^`lFWq1gz}CNEKPoGq;(zuboX6->5K5DxbB zG#J2iD+fR|kL43r2Bwjo7UTkD0H;~&!`UefAQ{&zwLDAbI(LB_NE94h*{oKctojvSaCRfpe!@MVJ9ZfpO%9dy*S! zsTGP!pODgBcuu>MPnj}q(;-%g)b8&9xY$+nX}s`_p5KKHyxXP8<1t%Q@RP7qPhUyN zhT*46c%f*{Fq+RI<3}+)6kvi$uo}0}dfN$99`|R8T{r9Td1*XaPxmP-Q)H;5{=4A5 z!KmYQ1FRN4dnQ+-5AwtX0d!ro5)q#byd8)lgx7vavi-C^eQ`08DK~eP-IeZR7@1y) zM%CXG4?Oi6yL+B~Q=O?s&XK5X*ud?O=IFfKY_a^@f6jHB#(z>B&=;C{63l;vDgKp@ z%Nq4%Wnr1qVHg|(Gk!C;=Ad&N*LJnP_9v@np0W}vMJ0d%HHPj_v1-ToR+TlWNdbxAa+YIN75quQ5rel=oC{)C#??HJN?QkeV?N$iL;d#=PPjYz&w0f4m zp@AL);RXz#`Xb73Ou0GL#Rx_0Seki$81k?YmHtKJij3#9G+=RO2}ZJ=f#F;15A0=;KVJ!BZFj#;+b>4& z_K|awaARLpIH1fsC1>$}{>^Rf3Z66SqvM`VOt6|yu|Lf#&e;`F-_nZiHW4r0@-3kQ+8Ka(%cQ?Hv)XN;K%Q)wjE$;N{k4!H z^NWJ@)xfYbzFM4>5q%frYSrG@C4!?J3|g{R7FtLwS~FCX!&zoKJtsSoD-?r+pcId$ z^*y923N=nbMp`YmUL*h|_WapHi;+V2D`{F(DNkXP`j+wWll_pX+NaE;1#qG3%F2f~ z6{KMz*0VKk)$=zl*U$lV^A{Fl4WUZRbFRx|iLwAw&3W<1mu#LES>fHs(=r(~9?Z1b z@$ZZzYQv6HQ^4R^yPc4x#)|U%n)i#0-dP5MZ-+N#*|it&FAu{R*0lATHa6~1NQ@eK zU3{SMMs`5gidop>fpHBtN=gQqX3Jj%sr@?$-j(aBL+cwTfBBSaMfl0GSr zZ(dM3sB2TQtl#LoTS5w26_A}#$jdFT-Bf(=v+#9}X=gAA2YX#T7ytsH<+^ot=F#uH zspbJ<%`=<+yeI*xWWRQzr8JFbw8}-^;72&vHD7`VXNYDG-ndWiZYhGR1#i)`TDJBqBPZeY1Z+? z(9~(}GJ_UrHcUrtt7}H+QPGneJN0kqP+($r?7;GXW-klmq65l@ot@I)A1&%yse#76vuw>Y~D>KOJCSsvU2_F3)?( zFuHZ-wT3Xk^_1xzcIBEhG_4dDbG_E_Wam@Jx@0G(Nn(`ywKTKR-$(LkrH3P6iu z3{ullCg(x<{v4B`nc*+fssgxW;Oypi2q2#{cHS>wh#Zz!fw6`GZ$5}bxTO6 zX}%1~%7$1F(XOs0`Ttn^&afuCrCr5}yo!Q?ND-w;m)?saC|yB%Q+g4QPJkq0N2Eya zNSEFT5SoH?h}6(KgdQM3fCM;;_uboFzVmI}*ExT@VxEvZ&swu)?wPq~CNP_$Lfk0m zv%Nl|vn*X?+$*C!MhbmydsO5=y=aL?V$c~nHAlu^xFM@k4f(_ml|SBd zNDHi=@@}_gy5gOq+%2y+4iot6mzj8o?{vN4>;2N*di3 zOBObEC{Y8#wZz$)seW{$n?~C=fRl}-&-&r$p^sD3^^xxO^625kn0|mNIILnyTk79o zO|LKS9}o^h;rj&WaN7|C?lMSTxfz!_p{Ag~N&*YubKDEt`sWH@3s8fpuv_G>5-Z%{ z*(80UqY_!kW?(?AezWA&C)vp&27!wseDr8hiSyF$7y*=Sez-U%qHncdf@9glYr4m)+ z#IYjS{%Mo))ge0`JZO)abj~#1eX#|!F38BVj&;zg%a`7_u(E1v{)F`7nW(_?l7IM+ zVnfFRj=EZ2^{OR;Q~vvR7_3jpF^)qt!;Ujc2?SJ&w3H)xaH>as2mE-?3SxBLAD`)a zjs}G4N;d$)-4lk@Kb)&Ou^oy@gx*z?faVx^&QM(!LxT3@MxD}2A`XbJh$C-fp~p(U z7BTKF_u3QqPcJig+2HmS{pmQ6ORRaAARR8kmf>}y^$Mp>3n^PX!=%?l-GTFPF1pQq z*o!>pp&31H*M5aTe3ioI6l*@)o- zbz}IxYDMc==0!gJ#Oa&KxF3O?E6MW8%VQ8TI4z3VK`(h_O585>+sl{XmlCvOi#@Q$ z3Ll*UAz$XvWvf9RW8AqN>lZJhd#8D$w#V$q2Q6doXcU;fIT|pz4aEWHehA;KWf{1c zlpGMf>G#cJ)TMT13S`WL$W`eLvsb~X;KW@0T}o37pYIfRw)x)jdPwcmbkw7=&Q;b| zgdkv9GLDEozHe_nOf2=h@7?*TdUiDB`=(4jl6oF{qe&`j{;wqJg=e9^U>Fe z1w$*FBqytNrFSMy6yNgv1hp~Y_~9{RlW__uq@Jf1G=PqW?eDdSVd9w7fu983KuYf$ zX#&^fs5^5q*_4qjmjNd6FXG>C$iE)xjN>gu(UQHAT-6K!f-z^0BcH@B=Wtcb&N-ER z$tmg0Z*6a1!*xYJiIfu>m9`Wt%R?d>N1=w!x$wkb&&vcI*)}5rW4=s z>YFVrsU^;J%BhrU&AU-@^l|8i8~vM)jqR>tP=L}fdvJ!~6Rl&pg4fparKX!j)*UgW z&g(2XdW8r8I{nU7pVEBvs1PDLt6nz$Lr&pLHj!9ESe?bV-Ox>xu1=M1dV}Q(V+S;b zqfu6?M^Qj+!P`TuV=y4)ySD8`U0~obbz`nxwSvOO0inCiMW3I%iE~-~o@@#g8Sz9e zmtt9!d>h--Yt?JbluW#msrs#S%EJ`)s!R$6PAl3ztowSrN3i< zschopf>K;M^Y)X!-5VB~(_K6Nn`|mjF6|D1f5x5aKvu; z5qxs7SUX?Z-cH~&nEzeSiIULJ#bBJC#GBYli`iP?HaOw<>ngeAGkF|P!sunrC>^c+ zqrh99(|(7IpZ|)(NVy`&1KJ|p)zJxKp8I`HNblJ`^lXCn^^XP_Z>F({j7J?DrM9oq zJPox*o@HZ4guVq*-3f9XJn+4q#Fz3ybG()F$sG0yK@9d(frs6a-(g3E($N|6%B-JIw9{KO5-t-1zKEkMteYCtb=jS3lR=U5>X_aRuCwEJ(-R{UIv+U0`a`f=V zuP#udqSjM7fQ}0`p^B%u{n^Cz(i@P*{oI- zJed3*X?Q8;L#zoHigjfz8|8FqMRdn?)TJqb#>i+E2zi$4z=JCw8eN1_lW5!;OS$g> z+4<@{o2n^!r)ptNsu-PsG#Jj&&i&XtSGIj+RCnpX6~oOx*IS&kGZ)6*b4{zxu{A7n z12|n}Pe)v*g}N)h89j$N;sWAWAGPpN~$(W(Zk_+`BW1HhP)uQ3oj_yBXfg;`Mfoqg*I8pLTfE^W>Fe zf_mvbpiqIX1K!;rdfRbFw0y{cRXu^rpNc!Ao?J$@FX#1(0OW^W~Hu>_w8wQoj({ zdgek8O47<;-ZM~Qd;a0lkUi+UR+0<>k-j@`SIVp7q_%Hze%nC-3Q#SBi>V=-`((e+ zA!-cz;{GH1<8(6Yn+ZQ|kSfYvN`1x1_<7^xqcberi26M;J_BtU zx%y#E1Fv7xtHrX?sN~a0`!xK~(&{ql71+>lkCT1UJ3Z4ao60z}uObk!bkJFh!KB+i ze*F5Lf_CXta9QidENA>l*g|gM!=$_2$-8OEj&(*=<~CmS`>SZHh1nbR?Zj*eLyH;# ze&^e8jK$2r$2@}9#36>xX;p=qVurd*)?#^A}R+DlALSG}?LJ(x#oK~ciG&Ouz zD?L!vuqVQ4?9m=O%^zQEI zEww=xy8HR%S!N9zg=7puZS41@5|{Xd{9+GA`m2lWikaEi+BU8@rRSP{Kc{9=t~^!M zmyM2Mexa73Y_as;x1@m$l)AZiCf2s>YFxi}0+HZ7c}1^ElqGYRQ!XJ=A>djngXMO%mcQ#zEpf_> z{bCG7`K(}iRv0&}rGC+dVL5|y|8m6~O;;J<-}aPpc2w5lx+Ui!%OA_6L-**AtdHB9 zowKxapS=aEE5%g5e@(!ppRQOqzRIb`5|V>uL`=_Hp?LOl5c{^zhjS6GAyVGkdqUW5 z%gBLuZ8(D|!UmChhUAx{Cw*ORK408C?&l9md)(XCMNN`kKBX|o&2G5o8u9t_lOWi& zi_MD1r-)fJ##6-2wEBi!i@9QjIFk?B#{Rfr_{58`Q6JIK{#9*fo;7-VasR%6OO zzq~3OeN`tQ1z9uQmrP3BoNbMfXEd5Vv@*PA?-Akic7}W z<=J4Eu`W^x2?!{%EV+gB&@d+C;*W7iUQI-@JR{7ccs}vHf~A>srrAH!p7eMYIed0_&f%6en{?-PHiE`H+A% z5Ocl7!meB4Y(+_u&Y;uJQZaF(jSoq=WAu=zKTd-(n_dED_}>`;E7kLE#m5o1dEXZ;;jhULgNH)(RT${#!xU=H_!smK(2YmL*_Oz*Pt{whPuB1**&r+ z!Q1g_?g<8?SrZ{-hgPKL+@0D&8%;a0R$IY|vCj$};)m1@!I%t-?Kp@=l`h{x58+M* zXfx{EH*TpDDn9pE%xg2s#aiM0Vy2uog1pWWz>j7EJNjgN+G#}NzM4(V^m7+ylZ zI7afH#!w$!4IU*i@MsSUUr(9swL$4-Da{%vs+d!gazcd}*pMjH`o#yzFGOXgh|8E) zqA~_|UyIffX)qZco*Of~akQhQOC4&X2J)f%Htae)BL)Z?7k?)y*8wXP>%|iv;dnX9 z*qjv*&`NZz{OU21*?4U@&2X^Dz0b@*SkfYXTRD3_9^*72IdJjvW#)t~1Z3^5F8?oY z`RJ)mrpxATyqS&hSF+ffatj2~H#K$YO6sMJRXtJ&L+PXR# zmF!reVkDSpk`Y^}jNFblpGs{}LqI>aC-6#2s!(z3-vnFrDJegQLiOsL{-$b-SyQ!D zjNp$Zp`_2OEX$TG`#l@`b5Ev(}X1T4#+jz_(c)WYaJc$SJqPG^Aggk( zNRh2gS5@Zd@-wz7{3oB?K7?g0K83v5jb1_&I>vG8+-s%kO6u4=kH%W8{d?lx(&0=E z!Mp7~rOXwHXans8G6HkVMU8Q;Y`|=lSebK09CRw<>%>H5u}cF8w&ok0XL;SCrOnC) zz8-bSbgER2WVc9oqt2%OX_ix4e8t^jRA#BeN*_-vV*5nIicsb>eLC5X5xVcXAQbjU^>RI`vEZ?L-+CA?`-R?t}Nv?x6$rPt^n^ACJ4}&X|u`K$RDJL^M0!0y)JVC zGTHqeCqXNt5O>`Pwrv#wB=Y8p{gJ*zIMxC#FWX%5YE3pWjNM4QgY4O8W!gfb0G>?@ zMtqGf6v&A(;+}1b4E^%uY`&R>$RgRRac>zGR(z*KWeYvRLshE5UWO~@BW}Z72(K;J zuVv;`TC(dgdeDh;Csqwm#Zgmt#9aCv-FWP{!DschjqY+=K5vmx`{^usdCW|Dvfs`k zS{+iq6|D0%R>XL5n0*VA4Y=4}<%~tz`uOq`2_LA~Z&t4&hc{IVLdKzMlTB(Nm4Ff3 zqWtQenBSqe@$guMIUGezNB6ASw>U*i&2WUn&Zz!g=wiG$R9`z+pF2nj$21pJmZz+yLgM#K9ozRwQKGTl_EprY_V|wSPZcTi&H)pw$t(BcVh_;In zIiwbICzdNRe!)~9ewFSV=)EH0I}S{I$KI6o0k>6W+$Ghk(I}weyI7BgQ8L03ABt_k+@YcarfK_K#Mvldmtg1=sNv zKTgC+LlqjULql#CsK&O0KYI9682vxh@q3)hVecgjW_8k@m$z|u!QXwQyR>aE za%jjt6Ty8DFxYbyJr;ESVn9dVQvX#n0OkC|06tdfhZwLWX~V82>(F9Llu%)zcsZEX z?L6wH;~j9=TmB<8l^GM|&VL80i090|Kpn8s=Vsl$ve;*rYI67|(if=dvtZ}Ts+`73 zVj3VNAyHAc?l{?%v7FJPeweK=E9phUCGi7PmW){QROpx5`noS1_pWZrg}Wx1%v`(0 zK=JMRA15a7{D4;_9X`Kz_*Eh4?i-THkP`>jwq%q7=_Oc`l9DtU_U>DT)m{7nznGeK z&yT{_>8oMd7CFhTl++J~6EJo15(%Df*acq?)YgYx7au^xzo&;mJ@a+L z?g|(@8Fj4I2cNC-?)>wk;E&fCTC-hbFVbc=!~_gws<@|huR;rUyTHlrt{C!FZ4%v zVHPjww0!mrLhjS2oxVQminF(zFUd@dMMS12SYek8G>1)~DTDji8S>ndwvXH+2Nw@z zmT&{Idga!IJ$WrVf;6#I-uwEA8{>Wsj*6q@HpL@DyJ{;TY0 zQB3NIdX?XS@57+lSNt-VquNR{ZP9%o!YJY2= zixdw3#AK{0)nPA_f}Rj=v9JOTNp}jSK7AIQXjRDqaiy7iwB?b|~jfD)W6mSy6q66QhYcJm=DpE1E$zS(B)_YUskh?^1D~r*$YP`_VnGf?KTSqBK@a zEsj&YZk%kkbvR_&f2sx}>XavW951Ca7C~on886l3=Q2zB{&;gZf~AT2I~3(KWe6cz z_0FpTe|~G#JCG7HL}@;UwNy(KyXmyfl+yqekjl$=;;TVH+oxrEQ^EkQ1KmCq!*If; z`3gyN1-8QU>tMmzDWav=hrD&ip$A6>v9o?s<3=YhZrzv12U7x~iP8(tJ5=Z5@FP&< z$oNviAMuAvj_J{_AvWjxul8h|mb&qVEU}}0nzIHQVi}p?b_-F1XbKEgIKLDt3{ArQ zc*D{2O z4P73wXXR?I&3zg#MzK=t1@T!LfpG5%WO;*XQ1K= zCu9@odUYIXbN!{hD+W^2==Cw5P>!!sKeOj8t(t?Mi$c%(61+t*#hj|VHeAz90UOa( z>P>yw-h~xZ^h^3#k29I2yhqrN5)$_}r0Fx3plwP|zTj4pTTb`hr%Z6GDtl$a^Z3i> z(UoV8mFr#*Las=ArJ=ps3kLPjDJlH2EMf*aM7_8XQn9&OYzMdgf@xbQfj3WBbyWA7 z*%gLn+A#LKU}I3WDS@3=6oPNmI-2*%N)p85ze;ml;RuUd$9{}JVi#9GsTBC^I$P3T zhpq)0Y)DJ>4$hcLUx>>Z+^Q^H8nPQ|!=cVoR43{$+x1qmy2b5uc?N+W#$a96zrG7~ ztt_!|(R&+;U+{!u7DnQ3#fX|H+oF0g-6!E*CYo@V;L}v;`(q*a1wNjt&u@Js*Ntp| z8NMh%(IZIHl269{8GPa+Wruwu=)ARkR-D}giqvMdVKzZ8V0csUS zPY9jYEyl2;Rjk---Mlw~d4!_J`R=qW1ZP6P9}`=bF!$pUr4Jf*(|kxTVj{OApE~&C zl)X!D?iJY}T^Hg)no(owcEbyA?JP!ynP!V3I!31mu7Qo(+e?J^RXapYhZaH!ufRG~ ze9S;mjo&d*$mkT=<=~7&pKo3??k1TgwRywO1FHL|j|b5RwR1xfFKhrEL%K1cR&b@3 z{xZVSpy*0APgRl#`PkQEM*NN&=c{N@1_vbA1l(Lk9TKy5T4%pWYmZ#~!)0~~&tu2E zzWeSdygydm*J*+Cu9UlU`wB1}Q3fl9w`wyaE+5yLBuIUBKvd|~jGq8sak>e7h1Yjt zH22!7L~X{IF)0jw6TC%CVDQ8n=0}b9;I^UaYHAVm67DhnUmj2et6G3sqBILAH&haNs;__!i+0-E9Z4vVJ4em&jAC@q55@2Du{}@< zIRDJL7%ot!nVuuy&EV}5a;3KvOtK8EQxEOd%F!M3Vo)9!wQ<;o@^njDOE0&72$d%5 zKXac$D`!HJm7QHNMyR%XGwAApQjDJ%l!5t$1V8Sr@ltj#2fJ_ZUUe2>5zfk|SjN0e zIYl7Zxzj2isWxKFQ%Qq)&Q6S;qBF%LYpw&$+0`NXP8n!Uxn)CFj)37_8J&5VGDY5K zPab_?<(A}QiFhuOxvm9b^+SegCp|-9yp;b7h^shWDrl^nizk+lAYUgb9)I$7hJ?;ulfS`K2)L#@DaOh3z!ZJ0-Qa&Krg1tTiZf~#xW53AW`=wm(XJ5jw zYy1U{Uqt}^#HGR0B*Pw^r6Kr$2ue1*XI!>v1r-IoQ+C*SyP2;0CrHlDKGbvHt`spJUHJ3rfB0tuA!|BCs&`4|ZrQWLvFW>Va{h{2 zwxcYKN@LU%8Urbbr~mdX&9x*A`1nKbY`=4Is6&3;96zo78_vSdkIeA+Zm$frvP23-ToW>NL4VUd|2xmMtINo@klOG)D7a%d9b#x< zZGFivV3DWrlMyp>YQcS(^M8B3i&y_#Gy>h_%lAlXad6uIYT1I3CvV=&`f%{@H}>(O z?8L~~<-x;ZA`VS(CN`)AQAY3%w=0dH^;+Kwt^Z@aNR(gf)ZpN?uRw&^;{Z#-`D+>Z zt)KrVN%MVi`GJx&(>krfgKv3y4Cw0=`np;7-6F4YLQJe5JUWWr{`}F-YFQ19qSpz8 z9%qH$k=K9xzG`9gd`z_XMv+JiAFg`yx`7%c{ z6bR6+i{=0S`#5{scV_0^(J2$Q-*235mAiXRY0DO&=-QC0!B|rM4}k%9gwbIf6qh0; zc4DO_mVf7*{Em10k0-szNP^rZ@;KQkv~-ybOXijPcvAWWE_2P+$3p&jMS>+xhJ=PZ zn23~cIF4j<8l0fS2A5EN3IgXuO!_QS%(*RNgU5VGqJ z1EZ1O_xEs;l9KY9HU6Q8bkAkhb5!itNK?AflAc! zTwPsV8U;`8xKxRZ`)FRE7oSn-$Smw6{qn1&m94q--atTuipTpKh(tbo{=WBpjpj8Y zVzS~`q$5uh+0WeLMuqId=fSCm;)6bcb+b4AA*H|bN_LeJ6sQd|iw$~d6-I7=hiC&` zVVGH26>QOY_8~acIMJ?;&jt#TM!c4C(`(>|FdE@!QAZ6UK<|i~sxgA=&Lv^#*cyUb zAf4FF$;ruXaAZF9s#Yk#@H3Dmk3?j>A1I49H$w13=D zJE+F!S|6kZY%qp5g6!v!BvD};_`peazQAtI`M-cON8-yEbdH&Yr3F;~nrn|&xLC1k zq`uF@j#TtKOG!y#5$u%`+;~aG6AZ!4wSY0$P~$DYfRhi(B|QdWvU9>b92~97cJRA* zUxwX!bn|{A2=VrDim~KCQ+F$kAX?1UCoLA0pP5r5<6fxoD;@T8IsQDnBnD4F0<6di#o+h;eXu`IW%Jj8QoG1Zoi7i++7xqI zv_%MMsn&VSwbKNhgb!5!uS0;9i%aF@%av68y|k#>?g29u|0d4C9w!AG+xLZvAyz9nmw&2|f3ocV z;XRTE6Z2gu8$IeW(VR74Wc+BJ4`?%CS*u%U>abF&36eb-s-bJ)JVrx<2+nOEkVj8+ z@W0G%8iJ>n_R$5i7%eJ`ymOXzzcBrafd9{vCOdX%015YN$faR*}cs_4AwO zy3%Ge_b1%`+aAk~UH%c-5>m(OI3}ST@be*m@$G-XRaw&ZM453zN09zXz5C{z0~!WW zt;Hrl7b4t8yPhZ_Po6n5tc6$sorgMV5W7Q9ughUDy}F1~7WJKga9=ce%ZfayF{Un< zLX;$CEri08giS3j7-Y#F04wRZn~Qux53 zk@IPdV=uwD%5&WZ9&gC_mn7_}%1$=}%Rj!#fqwPhEu1u^sM}%~5fm!VWq}Cxtdkpy za)hA0yR#JfxVy8AJzx_@*+pvdK1zO_xg_JYrM*18D7t@NQy=U-0%w_~8oK^Vw99C9 z@&bb~hn+|b)BQmE4beLbA*CSZhgKfsPkZ}4Nv)(O`Zsfp`vS^itHTIXij0`p zpkjXprjT;l0|&B~Tjep$95f6gNRKZuz4@q3N5+MD*a;giu-GHFPr)lg8Ge8A@?)BLjUf%*+0?A z??EkJAI9e!Gm3-N-iV42akoX!>SQpQ)1P&vC)EpwL3uRNi9VO5;?jMxO)LCtzQj(W z=DR<28<^UuVgP6y%r|d->#g0HBC{F+&9}@OKhjv%g8Ds>v0@ez>K9|b@=ML`Mgl*? z1rlp!p60g@Op_~*GQJ^Iyy#IOs@H!%yfYtxmzDf_u02VN;}?teKNN1Tn{TNdI_A}7 zZvDqf;T*GDFF=~fd8<$72yK~za*86aEn8A@@<=d8{XOeswq9|%HHkEG{;KMj4q)|x zC=GuHh~G|}tF`wvyissC zan8>`Ko?LHb6}HMA&IQ#m;16KFLOL@ z7E@3Qa8r{#^&d>;pYqj-lqK$wZY*6V_f#FDriWw;R_?Hb;N$VghMznsUl-osurTH% z%t1-qrC)vFze{a%lx&7t{5?3ohM=!WtgyX#Pr9lzamOhW6k{4pNfEBb1Umx4nMREd z1ljV;jR=Y;S#I38;|_YA@bU2hnp9PI+_j|@!;)VuWL*X20Q|PvRR6~!3jF?xQ#XH_ zE#SjgWg1Q@1xf$(WsaXDkz-_Leti<=>y%xg^eg%PH|!+GC@A>Y)Xc1>Y5;`uTIV`q z)4(7a7WvIg;qu5VYW z{}~fq6eUUWb;&ej|8I{CBgOUWya0oPWVp5HzwgPvKGe}wvFG!SM|3v=dEUm4TSi&w z4GQj`TCWWKOO)cGC&}KF4#m!?F(~H4uO9DTVcS`2Uy0RnrqB6_{`dd&%Kx|*-(nIw zVIRiz!zz!muW3~Dkm3g27C^Abo9|Y-@>BX4f1G+SK|Qa23?1}$E%OhB`v3My_5~@O zXo)@$q_F)nQ<8aAt}SG$Q#Bk{4yXSG;5{J&&fYmvA_;+JV)4IQj{ot{KcDO8;+(zZ zTS_Y((sx+3v=x&rKVlt%zrv|8XeSf!4;AUleUXk10E{}=$#Sp%PLh8u65yOnOiT(D zId?o5M8YeYPDOI))ibYV>leoViz{+=faL3)JIrgvd;>TC7fbk$JN|E9$sSzRMLH$t z7>kT8eV5l-VJ`d>pQhWDWlXRElZOBP$aPerp-~S=WN2S;|K2&7$d|qQ?E<@TRTOZ~ zzKzS>=A|U@)Be#`WYIQ@?X#PiX$jSk5?0VhI7Is~nUDV%DT!D{as>V~X#ZKjX0H3n z-S1a4BpxkXbd!8I*Cjia)g=xs&QkoJk^57PnxSqkaXXYn1$D(=- zj43^z1_-3UuFp`qwe{Qc+x64!0@fRsNsUI9mVemZ*5ZRUsz{~j#`8X%J%RSa6gjxg zi1Khas3&eqbDsUso$4fq>nWN|v*{eIv`2!5S;_}Q9B=4DY;p|sgZj5ysdDeKQ*Far z8C*c5g4eNnKkxP1*UfhMH6T1tliy-i)c1U6?I~m_%2^GbZ70-uEUV4pT7Z1n@&y`$*H?(k5W$0 z;qt~Q0eoP%wYR_4_+CV6NK@pGYis3Uye2$u#V9B=&+l*L*bO6mO;{ijL*vQ=shpS}&Rb9r;bBL`Te z!O**YZz~l_DC@^7K3`;C{)uM)_akt!yslC;v3cBXd^_tQ_ta^>zm&58QN1w#TTee)d?lgF`Xf+s* zoz`&KV7(o1Sl3{a+S#=@ABNkJ9@ZaItV%3-Oa$BH{&9-_(<|rDx~#tSPUrrd{U*Rs z-+POGT7SPy$3)dFFyl|cqfAUxKD>6!nDVjBRE~7e`7pDlKrt5`z--&YEzGcY6S~f% zdLs;Ex_gWAY7NwAuE+V9(elvCNW zB5!V)eWJlzbQ&p@CfnL@xl`yS#3#7oy1YM?n?!^(t<~sgW!38PFk+nB*F-ykGN0{1 zic?zn1C7L_N;e)gv&T=|?FR}J6Rxh6JR7U(J1-l`X&bzbswML9)^2{h%=NG?7hW80 z&C7&8+*zk|z;zFGVYFU7GHP4gDNUBytHw3gSI=w@SC+dIa%utF6kzL`p8WB5nUp&# zW5qgN_yxzB*kxY={`zgw2U|n%-4*x-vG_z9D4%c_`DHW(IF`q#L|tdDA0u5O1A6*`MbQLi;XHh zs)aO3iNpYGPn2XpPmic9(mJ-02PQphS24W}fWRv$DdPvLSV;mM#3?o`4CIiiJg0R9 zeoM!CQXiqQGG>*?YQkYyN)saXj=cZl2y!g)>9R*OTnzH0}4 zGP@tt62@EmX%`3o4!0r`Kjd*DTY0r#@^jk{8M4ZmK>3gtme5W>L?v*g*ePfV=q8LVVbRKb+~g+u0e@KZQ~vGKkFyw$St{p^fk<5fyI4 z=dkx}F7h<_R&49|j&wlN(%{l1%8U%Y)R-^WsUhm3y^eH_l415~(TrzH`M+{N=6m~Su! zv!d>Y70xUW=ZE7tbl;ef1T4lR+RV^nv~Q#LGpuu%9k^l~Z_Zr_$<%~jq<2A$B4U{h zw@InF49&ByaS1#n#NwjmT^s{l>X-z;qj4Dx*iYfQ*$JETyYESdx}1U}d)veuv^ga_ zR)pVKKdp$vhK$-(Y{zWd7EX{w`Ry)oe!=FvBNjP)e7x{kf2ZIPO+iudkmdFw3d`w@YM&Egmo%P4ao zYI6F#r{UeZcjFFTzYaSIi!m3-#neRyt6A)Q9JIXW#yN=r9KQykNwaB%^BuIF)I9pn z`a`ryYC*vm=#d{K7QrBQg1q_))Ef(U$g1e5NA;;TJ&m2W_d7|+$wK)YtIbGGCi)a5 z9%<8sjF-Pg@xT{)7vvBI0xGSm)&5dEmG{X22+)@Dd7`OD0XJM44R653**;mJ^5Nxqdl>57tNaQraI-ZsrypU z4#c%;WdcC>F1+?Y|7p50#DW%n;l{XX>}vZGekTQ_+w6Nq1Z`tMT}-kWw!At!bBULX znwxKnlgDv3qDq}sNOWc|P$%{ztaiUlRxMt7C1OD7m8D=^1};~mf(0vZrUcgY+8KvA zys3O($O^)}Vc*`6MdwX7sW(TOq%*G}mpYG&^eQU-N16d=dQ$Jduycx9gQC_dIRCntu&C9yVS0)1X=A6nv2NeH7V3M&_ftsU=ZgjEbMZgJk^&5 zuv_O&d*1Bkg1|<`EW&=+eGn8(z1H()%p;5?9QnN3SIOS_vZd0lPYs9=M)5@Oez?8aWM*u$Ca;aUir0PUQV&=|HsYcr@1br_^UvSdeJxr^A{|7eE z!N}1`c`T!;9~*C%Z|?{d;f^qY?HdUyCff1eLF3@SqUzb_YPA6laGL6taw=aVMa**-|%8&U!2VuCr0P!OK69LhDzp%7Af8L^IPU( z`JjdS)5qwH2YB&j!|oBCZ+s9NN4$)Q1e!KmJ2wK9f$%+0zp%`y{)gurm+oo1gGT%y z`bW9b3BZ)xwvib9(Z#&h6S;1yVz;|7s}fm@Tb`cl%Wb55H`n*Q*x~P9*MC;GvZpo! zs%R9)tn60C5D&E*YI)pvmaRlAY>=>e1)9xXvbn4NM3o5dgc5_|88o>l!Wcd%D24X!?I5s{Vdv6VwxkY}GsXPj1Y0A%tM1ygHdM)?o>NihBg85>uQjz(44T_9z`usL}@v0ONIZ@+r=llN-PXo?YSxA-{azE>=6SLqgJ>qSLs zp~?9D91Q+aVzwAmd={5=qV;vS6D^`oDeg;JvNFFC;&}AP?&fqD<~zDX^AP4Sj}PQs zI;t-)oiUiZ=w-s8l{LTgTtis0eRGghQj@%wIl!G%J-ofg!OH*F`Z-wU)P?J#%$(?t zB~$MX*2?RqzTadK&WgRKUDKZu1hOKc2$H|#5fGm9#>IEJJ9#BcM+7gdf&$?`G-HJ$ z6_@(Cjav8(@gg<(b8o2MH*V~D-6^eM9_9gcA|;^uLlScgQbJ*#OIXfs#m&nXJo_zK zJZtE?e`eaer_52{d;zfb$u2I+gEi21daY?4JnI$ANEG080GywhY5T1bxW3Dl#eGi_ zPzQvxOhjo2+38a@Om^(-P4?T)(#~AodNGu@ufM#Wd1k1E zVB43)jyCcr1%=TIK z1`D2sM)%;xBm{&+axwSFOODEBtFWOUa_nXMF#2Es^tu=e28h@kTWNnt*wq0SI+5L8 zFrkGcqsD4n4RNiW%NspdnV?P!IwYDV94F|}ZSUQ}2u!N9vW2%KLZ9ZPf|5P9-8868 zEFu+X5sZ2*r$XR0&ZC-wKPcUoOWs+uX`jF?mzE$Gl@goiY)8qs_XgL(8@duk%AMpi z`(A$r%~TMv@wxlEKd`~?v$W#ee}@OTYw%=$4mFFB_ke&n_M_cvHijOzTL>F?rn?p0+pA%Z)dpHlnFTN{S(jL7Sv(-u996+Qgmc%@()? z=t!Hahyt0H`}u=d{cbC8`@c{v>r!rceobrBgCjWp|2pcd9Myb>LCq$C2xhafq#*p7njlAmTFaMKGcnIONN~R#3lQOrK04Wt=DN4fXR$=%rX#R=&u=On+q=-i zZ`xq6F{?A)`lZWJnUj;|iLv@-ncJ|t7<92@cLau85e&Vo!Mok4hK{x?gCEuR;^+lD zo0r^+2i5i+DhC&>0JCe)z)$?u$eut^iXt80l0U79>~|cvg@xa4Q9KLj(^^e@MDUDx zeH7h@8qGMpC6MTZL=BgDuA4eHtr%H=f>-|eOzIi6C1mE)dN0<@InaJvUPf78eB3J( zvGB{(2+-X#0=_9tWlAG4mx}CAcY`=NwYlz^G9i^7U%}VP;IBRaJmENjzmACnq5KlY zqyJ`#&=irM!|kBaLa0&I%wDMMQ5)!YkZM>_H0aEC(13?X6gIj9mYLd=j(D{NIPjjr z3y(Q~dLbzp5y#Nno#B!cxC?Gk@3*QF&YrBQTZLMU&qe8d%xUjfuIRp2YvriKFG;Ui z>B^ocXGCyS>w}LQXZjHvtEDsq`Oqa;tL6gq{R(;}{-P|EtA~~`P5q=uckHKFhl){q z2Upjys-16|YA*$mppBAI`Zb1CiOJ6w3J5Ff+dkgj9epb!A$S|_SEt?5K;3PWEVJr{ z+hPT1)b-?!w^Gb-e(i4O=J@y$!%^*sXO}#+(jlx`wHuLN6T`9RuA%ye=i0=L(0gi4 zf6%Q(0iqVZv=&6SEW*Qy>Y>*bwJCSfbY8xCWwF6_y%~hND1=Ht;fLf(kNJm~s}I{6 z17cGZ0(3R;+sYsc&Bi_nmBNPHlt1T9JLfSR6tR9(w@D;;jfAf{@#EsSjLPl`DyBr- zkW26YbSYTZP5Jiy9|vGCfT9mk+yz^TDy@1l3YUN+mM!59Qp4BmGs7P~I)OZj^K{}W zmh)#>pQf^k(+N!p0fW=Ysr&hbozun8yX0^BCPM|0I@q=quT4^@<^#NY|CWlvi_N+t_PrMlVjiG`|b4lHi3|1Kb1OeJ{%z=5vvJFLD zMgpX(;hJq+a$}KY>W&02Q&Z=8vzKx&6(=HT9ZuT)M!p7ot;tHkj*o#!0VyBt3uLX)%*C4+MyZ!-bn^7CKlv zxn~zI;+Kc$|J+j7&Dj)`80@yxANzDA&vwae$09Ob^;wx&6VFjUk%oLdyGGlP^23tq z5wir=k)DPp(cCeAtZWEJLR5NYEbP$x(63^>qF z0^xdXbF3{%gDo?>H3^}$xv$^p50xUj6-5`k=8G)qXY28rV^^1k9MAwB+`M#2YsJXQ zpvauG;-J!Qranme6KF>wy5e5F5}up(I5R{IY1G9G13`Oz5QvIaY_>*VB3D47-h5`h zP@}tYyVA{8B2p{O)*^amQbPM%%_s$>rs~ZsZKpjoy>Xcnr=>Z8H(ba3p?3xzGr=qH z-Jqrx7(okQOp?dxXLAV4`eQzJRf;vbH9le$_yh?uOPc~f~B-YZPjO7(i|;g{q5S4!;p!KosO?8xv6nhNJX z5eHKzXz2z(#|$mg3g1Cvc?a+lsJM3O>4+_NpdJ3nJ<^(u-arf^_nKo2*TQw)wM~6j zRz*)lCR_@bRLKW|SUo+Lbzr_k5YXX%|NTFwoqk^3z4w1uJMXxrw!GaR5euTAZ~##O z3q_aQlqp00RjXF5CV7QoS8Xi z=FYswx%d6Y4-qtB@3q(ZwdecXUZ_QN3<<-nUn1)PB%z%bL=mUN?j)9yOgc4co`l90 z=P_Iclv`-k-gQ^ps+Uy6q^-G>?|*-|wT*q6w(FUPM;;>$Xr|F7T3Pf;f z&@|u7uyewu`X!iNwm%z!ayF_B6__UlD4|z7EGrV25kApXtWLM$qYe{Tey!sdL|%ow zU+czWTcS1N6DJ-WS9DwR6OL{O|Gs2c;i?-2_F$)gz!Bd{M)jiU`c6`CiY!#_V|pBD zBeZ|L2)4{=uk6eK7rkdMkpVaK9+dY$a0qZ7Te5&U zBw65JsuH|FjRr#wV7em4KDZ#N*d6P<0DG0n-Zo({8vpIvJ+C{PiD+{Q6D4L-r<~k- z3a=aQ<{L36Zdq}D$CpBeQ3Mh!Q#HQ1M1K$Uc;)#jG^D?23s%cl_C|eL&k#qE9@{s z--l2NqqGg0z5%=9vEy5S)_QHE@m;Ou&#M5IwVj`8Fy#?WHP0*)btoErI&=a*( z7nD%6zw%YtF8Ec-M9n*<6zwI)o3L${At*R^|Ji`{V9H)8Mh=$H_k>Ti zqXO(vHdi+YWp*t_{@>p17EonbPcv|RuARU)3e!dp7|jD(H_@j*-5|e_|_K;8OCr8=4;}a7xu@XR5e4 z?TQ#c9k_8APwxF~*yf}!5RZa|M%UsX!gTFiK+-iDMxiJ+y0%-A6L>D0<``)&)TUcD z@*mW^n#n^T&PSo>RNam5pAGclF}Jtkl4aKjR$#$ZJR2U4^AiSEpH&-sixqw<;lFNq zvR3ahmUA5lZN=vct7Sfi_SYYWC{=h)o^$jz_d-+TcA>cWoa5K!o#%74`-pQNZq4?i z#a_QQwx>)L01v~~2b}9wda)4&T3$)#om)_Cf*RX%RjrmRpUd(sK|xbML)_=m#r~?_ zQ-6^E6H0y2psIAr`!@y`i0~kRV9U9Nt$gOxdm1?CWDE zpBi1J3*Avqp)dJVr$E1EA`qy(leG)Ej~E)yX@$hg)u?sIx(rl9vMjVY%Yh1H3Ich$r%3U0Yb)NVUIYC6{KAaRIj0CD?!yOTUP}i>E__zI2|B$yax?? znGWx_>c&+O*33rYL~mLQRyvEtXwoiiTUEE0N2vV7(&Fd(_F>g|BXDHMbE;kXmDqcW z93*2SGZJ$0`%NNLW$;i5TUzY9X=LO6R7unQ+;3%0BE6;Ax&TzZSHv1!yR#(pQ{LNj zzRgah`rrBd>{T=n{v?|947uy7YIG4VZqF}r6XFAKk%^kE$Ipz)b?^=DT;qpNZ1-HQ zU7)GrNgqA^ZHu_Zk0!PCH!uIhunglzP)tW+RhqM037c~Ud6$V(ab3VGaAP(vXSt)2 zpo^w0#D4#NvN97m?fz!VGWa0h8Z4x{rb6Q4LZ^`3-;Hu^6{l&Z0E*$AY~z?62uQt4 zcfRgchcJm}cV`*_j8!RPXtk`b(7G*WXNBT!6SL2$#@ecB$hF$KeAyihm|_w&Nz4Xq zd*ttSDAYmkrlliKi4@#^|9sXsgW-ffyO69GdVcS(|T9GbZ9+N8` z>LFvOW_`Zhh{LKg$?7KiyONyNDvJduOaUZQUM(n6hZg|c2Ot^2( zIpr9WE@hL_B8+B1-7^07{ALoAjh3}`vL``d+YTHab5m-?5_k5DfcGA@qBivrukOYg z@f>1Gk@l)^bh8!0ltr4|16RP}yR z(JDzXY1N6C*L>>Fs>%v z`PQIjdbdwEL{aDR|oBaR`jCA59tz}kj2nz}}1ItG{Kx)=6 zs@|LFOCB9Lpm(U$z`X*@w9gCvr3#DD>WE_9GusD<6_ho$fpXtF&rD1uYjdVkhHuG* zS_eC>~-Q5v`KOo2N^`Fy61~;tw0PW zYF+&%MaiQ}5OQ348A3Dy?WJ!yU{vFhMWxdz(8^2(bIVinqjlFTDnK;SSKwM_cV2r1 zlHeYxq)O!wdmZOoH5sR$=G-ml{E7-UVzi&WG&VMCn#dF>Ud7lCde^?B7|R_Qx{0q9 zOv=v#p=${Meg)Ax()_WcgU;I zINg)KE^^LtZMez{;;C_Ha5b);oQ*<61L;{ZXIur-_ck-&H&%4#ap^CRc2g_@UWx@% zRlL%7fpY73k$0`|^39cmgrhT^>7guaKEm0#DHWsZ^g(BI3otI!E5Sa0zF!u~xzDM{ z1*HMcKRFofU;^gy%QLJ>YdprUmd1gIcrr=8I4Xrp$&J2yFC;$)kGOvQIxaObop@ju zy-9Wxp8athjQX^4Io~~^EEaW-emNNoH6{`$;buD*!a0sIg|Z7M@Z|0kXt5mJ1(-9D zw7G!Tt<;6wBS*b|dzrF%ZUbQ;5xqm*K;U<%N~>J6JMo?PYRuawnx&b2Em#`B(Cmy_ zLQNaVGZ?#NcL1aTLOT+vbzOZVUT@ot{R^Qx9?dVDTmes>dhsIH6J8-gwgjxRm=ryO z+It^s+YAszfO)_&~lxPNzQ+Q~AzrKGW&%D!eQL27o8yQ(xz8dp!jjQs)cN!sOD3!r-0l z-D`ydF9BMt@`5mYW}M->1KK;2kvC=Os^T>(e@pDa&t#Ry5mN$X6p0RM8Iu%%}-UITeHfpfRC@9>H<^CI12&4MQQV8q6~woBw~*2o-tag*aix| zRybADDY|;#vUOc~!P8i+MQ^dh+cpswzcNRmYgMcqa4ELXr2ctbDGk?XT9r>D+FUHD zR%#XYkw2Yk_i0_)jpb4~8oMg)c&P(0&g8>>onNx7bdBHMo$BFLL7OY6#wu@m=NO*p zbJOw4W7!H=3Hlbfu?mCq_$q`DM8)Eqri)%L2d^#cR?AIu{=TmLt}-g>N!*jKTCdqo zA3&cqyP!3BQ|s`rS8j;EH@i{HdY1b__`}l&d<+RZhV_rW?Ya`hF{A$ESnh*pa%vd0 zME=DS!I~Za)D9dnaR}iBe43Ox?NQ)bKnGM{DPI z!X|nIoPJ&QQ?u2`^y1M+`F9b|F#77^%Fn)U!pYMBTAbA^?SIoajyI@G8zb`t<-7x-r)#g{&{K~6D zEGrUo$8ea5^0(Lin()tQANEYuoy85#2*^tRlI?ExYh`^cPlLHC-PU2$fKYVS?bJ~s z{N^%GbXh=(clU=#GO`+Hxq2?%B8=u1^?Z5ML#%L|=^c*Xz;uV(3&HkLiTqo&AN?z1 z_?5Lx3A+{Up-SG0=m?E~4d*FLc?S{by9HvQh(y?0d@uWp?A{L+5>?hxdGHBXu>Kfr zi!Zd1>DeafV4M%69>lP>{MQCxkY!9ej#fjKc?6ZJnUmp_yBD=W>NiOB2cYVS0E;XG zlv}F2pJ(eE(X7!j$D96JOHGr7H4D+9`~l6(cY#-&KDVURy-hlO9Y8PjmND<&pY>mE z5$V9B2F!})fODFK4JB>+tkend!rSK`imemB?z;4M7Qp|Me}>ZlnJ~PY zO-m)v1y3%w4YkzVBrNKTW|JC0WbuUstxdMfuX$t1!ekv$m`8)dmYGp4v7HLzuk{&{D3GsQqBTMWJE5=Yu5JNZBOx?3`=Q2&r9kldPo)f&fyyOC$I z`D4Mpo8Z>}#6IbRYpW{f2aZ7hH#C(#Vp^^n?-X0B=8Irlnc zT&;r|L3O1(+jkGbcQ$!Ie-z+{@e^4u8w&dA-<$YLMtSyHD4Mz66L{v|N9kmKoPMqD z7El3I@ttJ-iE^;Uo|h+vBv|9w;;`F@P9QC7;fS3W4xnnsY#QvjvaEr+Ab0xk+usIq zvf~vz5O)$WpTa0&0Un4wN5*}G$7yO(W_5^L?k0 zvapw?W0|}C?S`7yOg6d0<3>iKa>3jd+#76r< z)sm{EPbL%W1ZpNkHhw^zQ=_|7j7w>JU5`Dbs=Xy~F)@|1;FF@s?pr{R>Bg3?6Wgk+ zQqMR(`U*rjc+Cw@pFTI?H}d9u?s1K7oX_&x9nO9SkclQdYRO zFPj3hFKmCHUKcjA!BZwX#JALXzLPm&JDiT;AFJV|Ga{`r5I#Uy{XKD975HE)Uz>$7x`1G81bl!B5)*Ptuc> zm0+?oSOHdc23sI6sz6DFSEgx1Q#aBy9#^R%wk6-FR;FRNDKi3yw?lw@;P}bDY;J<2G7PX&i`%O|}?PL^%RLN2;CZ})I$T@a>E!+&!KvMZo$J^7E9^lj?Al*N~ zxQKeibnR7U>$33~A^)Kh=(;y&`9-}s0(I^VuiE@Bh<|DbO1s@CuCXnB!dC+Ka|%Vo z%VChB+E{SDiHhX?@rVFK4oWOrfQux&`8Ca#gJOD2?%qkM+Qmos1!XT8g!I>%M?- zH=^U^{{6R2AfI@S9Qh&NXhZPMC%pwEsKg2QKDHB4jC`fAmY-COt$h!RJ0Yz&q{#qd zsRzg@=9TCl`SmNwiqpo4Nf&;D33`Dzj9>^jCJ!2a2l__`ocu@Ed-u+sy?FXI7Pq0t z9?epzAA?`{p6E=|+t8~NdPGe8?Nz_*Bz?sAjM8i^c3+cPO={*gHWH_bEv*6>gf-EM z6buS30~qdxnFy9tswq-*cex)4;Zd-*gEvL_4NDAT<1QC!B@5=x*j?e0(GkgHn;Xa zK0TFzZ$1$Dcnhf0Gd#u{9lU_MoD3d=+5ZmeSssC9zT#7&3MG-M*AyPmw~jdr*xIN& zmwc)fPpZdnGdbG0#k+Fp@4_fqC=rD;U+G|v7NWi2*i7coUs@24Y*W?oUEAW7D0P}S zo7ygo?%nSCr7CB@p~7*X7V-N_udB6K*fr6j#>H)ZGfE<|^wfZX&l@K9NP0~Y{e&N^ znb-foV&Z}*$9fyMXxk?OQ%|90Qcr&@&L@+%w--*FU`i2UT%-D#{Z=0Sfy(6CDWh!t zg6@HXq@So}GZ$Z2t{5l@>NQgi5bxD}=QP(K>;Y{!Knz&@6PNBg^x?Y3jsh(A8m0az zDhIiz6=8JqracIC8ALKK9S;wWu5xEnpuqCcFAmyR&TxuvA!yFuUr&6S1Cs|GQfU*`KO=_$UJ z4!Tc`AL3U&smN{wS_Neh(e8JKR8TWdU9aNWmln4X4k@fdHh#fUF0#?srt}>t+ilrI z!oV_5b(HJKwsi+W(k`^=$He1bP%|43EtnNrU;#%GGSt+xG`cB=OZU5mg(Swu*^cV2#p$1IP(YI-`vvc=Aq`I}Zz%b5xtdPubA_!~wCBybuJP z(txFzQf|Mlm)h3_P_nVowv7o=d2s+-1hm(t=+u4yV0nLg&}V*dvbPdI#k#Xt!ncG@ zmva8%RB{0yotnBJNb08F^JJFrSMT$}X4hC%xD0fUJSoLgJ27E7gmjc#Z!uZcZ;!pl zRbl%fw^^CV12gfheg*rQwrYfFcW{qwajW95_*5PA+fh@g_1UdleTCh#==FUEgbhZ3W+qgu1C$}IN=J` zZ<89yd^wR{&1*g&YYkTIeBAq|I=R0OUY*q36I}^Eqn+2(`Z|47SuwYEfXajGz{N(w(9jSU1-K(B(6|?2VMic>?}gA!DykVjAyfLf z)8p?;=YlX`Gi{w|GkFo!VF~kpan2^cwnu+Xw0x}QUzf+p8*i9_9&6&3Lsi;?i9Pr8 z!91HM2Pb!NbmZn-ZESK&GVN6-{7DqwK{yfMpQzi4i+UuFRQ z2N@hh@bqSBxDLv}hQl~T07@kidh3|Hlb}k-hJ4?^U!z}szc>HW;K#q@ty}vA-DxIM zIMR%)KQuOB=X%6dDS&oxE9(Pu<^q@gL`<{6{IBlO3d^j0gYj@huU)U z8KW#c-kER3>Fo*9moeL$&gKB%qjlv<3%HXVK*Zk538{zi@TIrVjscfAaKp1Ua`OtK z!T!$ZlXYx6_2r8?_vIe}=$8r?^O@nQ(z@!2elysf-9o%JAKY3;fC3Ocb?VMPJ^Cka+}fj`swOJ9=#^L(b$BPSTK;vaH5d$VFs(}k z=M}^f0Bab~wdMIrLMx#6v|m=0y9j;7uRh!dP*C2MeNWfd{Xl_u$ZmO}B|0g|iGR@M z-K9OCn)(U|4lnUQTF}L7YyLl_k^G51;Xi()p8NX1Qk`JIF|p8>E~UvS#B|B6a(kPGWumFKE!!fM{lxCHK){A;_ zZZ=6QrPd`fOkh8FjB8QJ77wVPy8k1!r}dgSU_BXFtGFU`_Kc} z)7>Kg-v$Lam>{3ZgT-S!cOgc-xyBuz^SaYdVH*SHo?ZFh{ANkvjXzth+ytr&VPz45APQY;S@25u1BBOn+97zCY-hgY(UJ8vW43I*N^jGJtFn{ zGcx&NGR3YnXH7`eYJK{otBpLS4ytKIU&sD=@gKg&G&3_JxF~ioW)PflpY9($0p`(v zG7kUQpLk^8O3ZH)IH>-m?EhdldPS+v!o zf4~XHoVYx-rZ@))PG@PB!)?T@-%kkpP#kcNA@2Q z3V{~2%M-)?<2C+&{Ki9r5Wbq=n901R=8un$*KOLS;bJUU6m>G2x&JAdICx+~>pN&0{F=70ZXE_`JXx0KiEbKm?zs=a*abB5bkNA%Ht8n`!zP#4#Vo^o>GLJ+ z?@bN=OWVaC7wW=WR&mSKqsQ zPt1Azcbi5?J;%4$%}~JtUNPDldQGKR=QSk5`UzUmUoJp zzY(K?3Q*CB3)lMb=;G~{FMR%dIsVOCdY+Cd3y91gS$~H&{`=+&Mm}kC49?CU`)nTIfs_eGIkLMX{N4ACTs0KJ+!}swC}l8kc@xkpz*}!Prvb>|Fi#ee=fYe z4dBwF661|8WLs!pC!LEa$=eU~dl? zG(RI%w-OBog&Cc{vl13%i-E$>prxlL)ckIwrKQ=`KinnkPiTn|vH$WM=<)g`6G8v) z0T@%tM?r1r{C^4fw!3`Nn|#+C<5V^`g6(pCaI4`NI4^6yT&-ODmkp^z3Y1PxzZ($1 zUH@L&;_1%PJZF-B zma)vux9L;@(g(@~+5djBnp6lDLK#0d_mqqKK#6@C3%v|vT%{g}zqkQWtRdL`m+{c; z4@0nJj7pe#rupMjg55Km$BL%Kn8+6VDS(Za2$*lYPayqCTJ7{w*B9%NoiG4(Yt+lEr8(2SE*NtSkc{iE%Q1=IQ~bu^GXzG$$&cTYmI*b z`27+xd>{k38CO2Y5B=lJ`>C%sL~e`p0*zT%X-uwhUTdLsjo#_HoSWG?_*8WW2X=m_ zGFckjQjf;LSg=foj7x2_w4Ri@n9i+QHx0r!t#WUPmM(_>qkC;X&Y|)qZ&(S#h@l<^+ zD02m-X5whz(e|$k{KUL2gQot1x~-X=O(|s8xzBQ*{865;HXuW;(7LZK`}>Po@`4IA zpgS5Aq-qk0zwq21-5vCZp2AOA*e6_{T&hZ@v5CjVl7yQ_>A`_vT5mKhooAQ#3 zm_$W~fFF~LQK3~8lj;m`{ccTb(6#FTgcyE)$&O_C*Iu|B)7woq534qwq|Sbu9DON& z?q&b#I|?TE_RMWmpjhWaJa7A-drK*RvVjyJ zwS;@~g*2!Dhc8e5;ynsTq(2m;X0G72 z@r_vg#klHfuIa*Qq3~;zNME5BE7&a~<7Lb?YBXXD!FMFj_eg!({J z?1g-b1>&xn;h|z-CVz>;+}!#Aop#ke@TZQS!&Xe)*}+11c6dw5N;XO__QQwSs=Z&O zI&n$#f~{>Ds^mNMse>x9{GPCcg`Cg zE6z{*;&cvx%`+eM)g133q5kn8gkK_cZCBr32K{Fl$lc55LxE=kSE}NB&{IFZ7K!+l{ z#<7U33oX$?9U&wjJVzq&7a`|*3$0awxeud!2Z-X=0aT~MOtmVN#5>eNFDuYXlqs~< zAJPAmH$*X>o1ayJqdTMfZQ=9O2ZJEKf~(}!6y!BFgmY17%5w?{PahsB!k)F$+}9rF zaXRt9G?rJ+JO@{UAs9Wn{Lr8MrT?0mE+_@F+mKUbLh9N{>P1Aw($el7)1H3Sor*R+ z(Z$UKYJGC|T*?tjDqm*(@z1sUMpGQTuWr`VY!B(X&o&SPO)NsX@wNMKR#Ovt3DlH( zdvM>{r{IJT`x4I)=7Ac`7Sa>3H=4Rmw@BxTV+TRY=!P8g9NwE&b?=1yHUDa+cIwOl zhhX^FR*)qyx}Cq2f~pL|a;qXDm9RH29V1Yma_!DT7YOObTP`X5=xVP%RT&miKK5|c z*B^Q%7>|!w$J`PF#++jMQZ+m*WW7V@%ug&uWyb3Suj&;Y!`9w1#5^am^qIP|3KLgovF7E~=rOchs=k<-(avQN=u-yDsWMr)pLBHA= zy7v-hbNPnjNOi0wR`TBY{>SXM6A?x-%|3v4s!~nY`gEz)WK4y|_Jr3=FXd|ILlt^SmUHLZ`fL=hFoVVATsrNnBOn0Z z%F*+KztO%oqi`~2&mqZL-}=u8;!J7{P1`_BI?Fjxafh8)*IGVeT4&OsRmqIdjg!DH zuO`H|vh;AI{f>XYkW#HMqVKtoLfjBb)dW-lQO^KrofmPj;Tj$v5@iKhh1KIhd-+a z`ttS=8S)id%<}Bn`7in^6=Kc2XA|JEnhhB-?Mv0)vd*oSR2y8no zQBmq(pxr3zXYrH`+eJmPSbv>RUVbRrNcLTFPdN6XPTcdgUWnz9Bj4R+uh^w6ub-dy z$B%cEC<}nOEdTVwM56289-XnRT6?*d~-8sQnA~ULQT^egOWo zW-j|v@9gg}>HmF5UFhUAyCXE82t4$}M=;h#Y$wi(+^DircD$u*BB`G*x|$|7xuLyU z!f`7TsaMLeFE(DmRkC???b^#@L_u=R*0PUhgZ+F*g#(;k(4I<1&WJg{SzzCHQ$Ng) zKlDyb8a8Nqyqg?b*bgQ31!wVq5i&)_gT`6AmZZ;NTeV|X?!2rFXcX>`56vzvvLJqDHk#hI+<59n*I7&Y23tIUJuo45drmX{ZG zS{14?sYnMJQ0aPlp%;v@eIT~kzN)dy|6j6;faxNOhY>)oBxT>>6=^vKeoPu9M_Cb2`Je zscm>|GO3olrcr68&1QK$DfR*BnwWBWHLjdPcNS?MF*{-f$U&znsWnYjc>x8EX&5gO z%C&Gt%Aq|P?SOE_m4bN9v#mpY*k!Lpm^6=+&E3Ij8^RUI+M-M?GwtR$3*QYs>Sl7< z0)64cNfcta5HI-7?RY8o%4!dBtp-wxyGa-d)CDtr~JomL6Bo-j`15grE^HPTw8)Hr&@0azN>B`Kq$up72?kEM25%2B{)Xf@S zavaFNV9mhB0x9*m@ynOzbOfs37RhJy7xoO_p&{zD=n1mCtvxjrTdQ}v6(v;85pcct zo9^H09|uZ*lP+yUcmt6hRV-dflOXvt$Cx<%?6|uJo3{JIp|=;|oUasNIQBF}slKCE zUkLGSeY*@;tKj)UHJWHhuiq)YBtnk^wlYb{r%4ZGOlt2qTya-WTODDSJ$`o+6gEy( zk7)8pyjC0yQf*rbIbT0)b?UJG6R*Fh-TXaWYwUoYlr=@KJ-R-Mg{~|C=u=m*8($Tr zmQvf8qJJ6G!X}EZ?MuZ8>lszN(%5cyN%tbYTwYIS*8w(K=9uq~;uynSUQ`I5moqul zsQB)aQfwVC z7QS-u`)>nfu0e;|b0q-k%=L^EjcAUxm6%yDv~ zN`#>HV(GVqX1kZ?WM5gbjLLA_o-MJ_ly~}K*&+ayYdJ3vymG3Nbgk*vr$GLFj)v*vcwV{&W zk9S-Qniq1{R)7~+q{h#Xx(0rUeRx=jlwaCTY?dbBzOr(Q|K`-Cj0S#Vi2*Jy`Mfu= zh^zH^m?j)j)l{-da9mdhpexEp6=fPhx&ORTg2k$Ezt6@>OpeJ3qs9)ca)|9wF*C(s zID9J^^s>DsJFoFa6&0PARYQ-{V2)kQz$|86oo;>g zdl(Gr7VkShD3SCQB2Xm(ZBLlV-vq~#3MgC|a&9;#ThA5ec+LeOitIdxMRf#L9{xTZN*b@BqeD~dD%#x{G}r}QRbeF+9OSR`)% zZN75d>I!GupNIw>KW&#aBfyn|Z?(Wm@IwCS zBqiiN$k-YPE0>oe>1!0mW#D7xrMlc zJSA4p{|+k?{P9w^cT2+#gN6Fy-MdqstHyi~tPQp4rGTP0z4)F-<7&pmyM=(Kx~ou| z6en)&pvaR$d>SmN(3IE0XB|Tw5b>CoH%*)cF^*lRH{Z||sMO}5j-Fmrn`FoJdk)kY zF8~_`N9dp&y=q#jUlO~z2McSzITT@01IGQiR@8MlUpsBAR&Jz)^_SdaJE3&e9ZSLR z4gzU`4F&7yb(IPGtu<&vP&G9~Mi`Xe3u~8kyi|ZO+8f}I(83Un0tn%6<*_wVVGT}= z^z9{|Y+)T5yFD1WF`fQu0+6~D`tJZ=HZ9J@fh$e-(lDSt+~5|SSJ>*u2WTEP&)5ar zHofUU>3ba%I}4m^yfCl+r0V$hwaAnA_ONYHD#fkV9s)l@uGaq8sY9sPP49(M{?M;B zr&5%du9$+k*vKm2dhMGJOs{pHC}DMxiXYOriScjBy1vX(bYy^6SL{yX zfD;t)g*rf6S*`sRK7z!a9N&w9yOZa+(R0c+;|B8y->>bnPfbC;;R-!20JR=0!(8C^ zU)LaA9eL&FCV4Xc^X}z*CDETM8t*?A;z1#{eJT(g&>%b&6I@OS{+h!UaQPPQ;hkv$cP#9G6*dzSo$W=lsprZfVyL?qKF~2(dN8)A?3JJ&V<% ze5Hz2-9hz2EAf|Cjb&wWyqc%RC8<0%ewZH3?9`^`kqyOYtSD$k$+L8A4*Qf2@6?|} zjhA)mJDC+&aG?bsujzmyNKsxI%Z?TCc0;)Fa%)~XB<(8fE0*g} zvf<`70f13oW-%nNHd=nW#xhZrD&p_=HD)c1l7G?S^D}jch6paN!7>g`>lSem(h?p! zE~1~{08uh+*Xgs5pVl#4j*1;V--Y*vz3PSqvz)bV`n55ju5>oZEC2OjGG$S&CC%Cj zZy2+-p)(A7)k_@T5xyK5+3x3BwYHHvM0qeq*jPMaTS;;*OlUe0__91c8@>spsPs-Q zDB8FyCKDg;+ws`EYpea8_>7a86|CYi4!>uupk6Eq<}wu6)mNUyJhnWPjCi%!>oxIaxK^$~C9`cEIN+wB9?n8O@-Q~hRm+q?gB z!T#h2=03NS(|LW^NlJ!uBUDO$yv96?b{GD;LDH`dpw_0}0gT^IV-7y2aK`-d0z4x9 z;m!w#b4(3>6sRjL@^^+}f!9>d@gF7+!n)gDt!o4~y`ASIB)C+Av*nuHS}#;vdqDWi z)tB-k$C4eJQa6u72dbsXWv{YTMzXzbK7gHhTAQY*s=?J@(aawA`KJz;UCe5GOy-7# zKoqy+g7e$}eZ0xBFG)sZg54eS!YKUi3bzr5weLxh9bWN+*(_Ug#fGn63vY~K=rsGa zIdc2rnhDcI)m^6R*p?1}2N?tO@5gR94Vt)lodZ(bGEOicwB1f@*VuE@XUa7_6AvDv zg7jDPu@-W7fW20M9XS;~g-cF4=w1(h)l4Hpq6f>JR7eGul^=U7D_kU#9?p}ormbmL zbhTnm^r3?*I}c(Y z`F2}Fxz+uPx?T`m%Ib^h5$jd8xisw`8e3GAug=zwQFCeiWg1(tAbMA|4hxe{2`~h} zV;zC*Rx&HMiZuwXy=Tph z_o~Y1LT;3agUjz34tt}C%OQ@v%$bIUuiei0%zc{?Cy{OuDgmkm#_^&2UZ-A?S(pTv zg(gP619qICB^V_PNxJUoSu$6tK}{>5z5`ljl=k{yrTcHLU0_FP1rUTxU`*;3Ms-2{ zZ4R#8XHEg$w{-d0!Pmcv{UC!zYovvYJIo9LCImd=Z^B4l~3vbWvKTPy3I1IEfyF3tIHuivc4okIrQQ2)&;{(Yt zQl_;ecySVl`HI^|H#v z7QKUnYjHX~efBI#1Cr63<7IlYf7J>&vJ5A_w#$o*T_k@D-IqL{6w>!f3Y+Ab8_qK9V;D*dgG7gKF>jsrItvY@KMHlHVL+Y#T zH;9|O%42&RhtG~5mDe7k2?U)^Z_6#+Kd!Df8u$VJck|d6_i=6dnMR%fGN*R z`cmO+&qs5Syl~;|z&q=C4rZlUF97`JruMExI^r@kIK_{Q8)rxJOUbWzrCD@ezqAj~N5yv;OX|`W{7ep^PD(ZE;e4cD~ zaXFCHJ@~e@K`EHXO3t{vk4)t}q+eiBp6hQ{eI!p7+vrdZ-TY%L;NJyeOxJF&KFa|m z?&HyJbjV1lU?WrnoH^Pv(Xr|^W{lC<@W|il2lgU;uaz{%wwOe5?z+n+%80oS-rWno zZjg5zKvcYaceK>n_BOmOjCdsog`RgBT4!-jl&m}QVbo;++L;k@Odx-9>6(C?B5qAl zAz?`VWgIi&W6+-a3qSLu{OS>c&7W|qlE^M~bED2UtE*1y(SZ7p!4k5fJwVR(=5F#i z`vPwx=v2^7y7>u^LNg$?--^fWmzzFaVdSuBEn9QI#L24C&2@uDj!kPJT15!QI=c&P zc0CCw^zG3zFi;F5KA5}wO6`tG=Y(rP0kbdI*p}PSlzc61OT8QT?;@!&@9>(UNw-^| zGl5OO=>%84^YjkBxxsblgMxh?=#8_#EWGyABBsa2o8oX1-rv*Y`k)v-tTb*gZWrK6Bn4>MvwG=P3@SySRM ze-%M{G`sE2ojYCWfu`Ceg|EThnh3))BUBbXhESD&p4pu9;%orue!WH^wv91#pF-gM zp-xyrzj|}(G6?rGNgK193{i4Nn5_)FU|OjkM0mD#^vxGpjvz_23+OlNUk%rxgZ9(% zIwxL*g_Aal(9H_f@a$2FDeCtA`Y@3E2Ivm@%0;^afaj{--NrirhX8tflRnn7;o#JH zT`Bw`Cj7{eM7L|IRI=ttvPBDT`Mr{_pcj?3uxU$Mi=24tlZ?4$T+Sg~XjY{&)j=DP z)6`rM5;f1wplCR}n&jOT%p_)7_y(K^x91~O~(yDW{-dm_fUL@SrvnM z#Tj@_RWsm~H>v(DQ%GuzW~D&9#bZ(YDd4k>gzvCNGC@hFu6SiJcpRt_daY-BTDF99 zacqx@(w2(0)89Tm{N(0OjiraA2^Do5__f7V8R=bGiie>B4cP>g$Gq-^0Y7peEtiLj z0poh?mpqzqXXsY!2i9rxx=^t`ecN@+lVrOajW=k&F6*L)isyuQFM^UuQRr+Pt#f3@o7^6j-+C0neU7xNi z4+cpjEv3E7gM)#w;|P?fC*zR_FvhI;Ng-X3-RLJjfeU0?$-49+ngNF(wtXT+yigfe`=>h{Pi?f~+7q_QErDwPN#RxAWOAMJ}qt4-U zS8m!@Zil$r>U%1(b#NuM?1*%_@2nyQC3eB+q7@={^sGRa;nSJaP)R7sMS-$ZWOwz5 zv?@X~C2d)$*zhnomk_0f%|zlcc4!RqMDKKRZoBX=ky#lK~>%8}}L}5)B+goU|*uExES7eodY&Z!SUa>8q zG@7AqUN~87VqC=p=hO3(_@&AjfU9lDTDK2m*w~|x7Z;fwfR|Mw0O!fV)vn`=uuL*Y zVdNa@QviqN1-RTIA&1C{j(kvy@-1C`mU`q~+;}@zT+LD=gHITcKMv}LiXH?WhYU)W ztPEwwBuv9xb`AFJV*tvoWslV7>z7wSe2U|Q?F_tLz(}{bt93T9oG@)vyr4Mhf;FJ{ zim|Way80k;gp%HcgJ%*@o?xTu6scB5tVUGUH&!C1OWesHM5L4@hT^=d_wDk8&)Qa0 zb+qLfq~|q?Ie+6!AI-5cEi0IsF*N0c%ncUC(~7&aGLz{W>&({{55u&Kx*(kFR;ZQZCVHv*BgDCx^^)y>HYg_^|@wI)qxO4 z@Qg+PVc@ARKCmy$U<^Z`LB<^7x^)2PhZS@_qX4{s`|54PKy7NM_$?~7N>)%wuNAxZ z2!eJ4uSe@KHN1&!qmknsG|deXx~W^-Ret%={`9ohK%ws)Ewew&=O@ho-iL4CYkb5g z&pFo!*bT_WKt%QM27OhtR-LKJP4V_`S3K$FcH>wndQ)6+ zP(`_Uk8^RKkj8#Hd5TKnf`ShlLcFE((ASx?pMl07-Xcn_!>+07HwPYmsg*r3N&0{YwtYwOgS|l}0m!LrfA42>!g^WR*;Qi7t(GRy z(aog;W4H4&U^(%9-rq;{W?!SKH{*d7Ct?h~@7^QgDSCzpn|gZtf z*yzJRuywNwG^h5Z(ro2AG;uxhA@Dz>>;FD0l$K8pjOw*&IZz8&a&%lTw*zAF_7EHv^o{G^fxB)f8T^&E0(7ji={FK52H?gf}@Z3-{GAlHopT4rA#ceE+pz=~*7 zO_mX>HXeiYg{@!DelG?IT z+_paXd=15`pZ$9hq{aP*FTtu7JR_=I07V@@FAd)-p#KXj16%}_7{&@W|^^B8hK z?lY^SHNn!rHI_iF=vsdY&y60U*<3IOeH-2+aqy4V8<0p z*K=7rSOw^aL?8C%6SEm++#Ah_|mN|!%c-Bbm3F_^~Ndrm$bVd~$akduvcD1uXV z#=ipin#dCZzvOjqn2?+?F?E91C=axCI08wSf~svmOQYSiscN>p%Dk-{Pwtfm`l?@w zaNicA0h%rD16T!()H0%vp0|#>$qo9?Z(~hZR0<;q25uAEtPZ+h`tz~C98kWMdhsry zSG!wMhfx{656ch02H!^_-v=y@95`tHpsO#Pf%Z8N9xjEHjClYcP+Ci|mJZqaXt;T_ znvz^!wl(U}n>;5PD7>= z$_;e3uqJBz>xG9v1FMBON%@{Nf&T1CM3HDpUtT4dJ|)1UMyyl+tU zVg(or4;9(52tZim)XmalUv7O*W;0(NPI9(H$+y*AeY)5mX*+1x2u(I52TyCK)r+V_ z#g=9b1biYcr$ftXxb#CrrY&d%Nl~jfnB|P zWbs)oeGbB?lT2QRw5?s`iU>HS&JXtsTFM*vEjx{L${d4x`m)qcWGw3fmWpcPbbM!n zMjBhIMS>RhBsA+qWW@E^m6iFc=eTiXrQ%QpddfLrPYjQ;msJ`TRxmXDl`8yiB*GW( zY;_#hsRj}j-vl}!eU9dkM@v`5KYGlxD2{=}*UE;@A7%;tVU~A)H%s#Kpt|F1@7Rb! z3fWXQ2bRQx;Xjocb|^+iJcH;&<0KC$EPVENHa9(;#s-aiuyx6H-%4ed8MZPp>FdYa zT-?7;d}d`W#BB`hD4w(oJu__qrvbYb-O|u#~u#B>i-L&pGu6Retsb8qTvWqfle<-u5vWVZ>Eia-H4;X7!o8NS$8yt-+ z>d<0WNqLE!y@|P+sArU}d?=@xqkoG?VguItmx|k0XM99$E&32sy-R_|zbbo~7U)#Y zNm9#I6;?J{X0S>X0(N${6QdYd+^`Zuo@|Tv;l6UL#1v>Ho{0cacYN)RMeBPj!4CoR zyd;;Td+k>yPp`?)S1TVNTlzNb60pIVQW{D@u>H9NI?!ALYXsP0GV!t0ez;c9E9wZa zOi;Rk!Oq25cG7?HXwy~eTSKa|H}_J|-m!F*Pm6NvG|EyfD!Nr~$hwYPwOpMY=^$M;0kWBCSx)2BXu(|WcWlQc7ln8}hFlR{J_Gc&c6NHre5wO6 z5KiX0fpZy4HJ{bi((b-Gkh8IQ3!39sOR*xGeiZ4#L2**I3yG7m7QkJR<_l;IMz-aU zA3WGFV~5&iLjvyC{+bu$#!V8Opbs-=zfxobTZjjpYH%qejkw#RmR+vJa0Xb5)HOh+ z9YzfSS=PGV03^VkIi|VW^P*z)T!sI>BjSTdWsE?>LtM8cHnGD+w1Okhi=+ z7NHP9uZCFba9VOfKx}di7HL8-Er}g#v*vY|jl5K7I`WcrmE?)bQ;*y3u>FG0+jFVs zWW5M=S&`nXh$&|8@{l||?PjRv7Xiib5{nMQ*n|2Q$F@HB@YyAD&aC)NtFHV(APQ*# zsGyl4N#2{1^Byp2q{f)rnypT;b?{!JoLolJTG3+3i-4lK2c9(ZsOtDNzj?ymhsInm zYoEXX>7M6<`q!?SreU6E>PTW(9RWysahG4M)HMn{_+ zu7b;wSAcW2$vzg4h!w)gxy6jQ>~VxW&c1FiOnv;DuzX z2|{!Evl#}p^bT}TEN07ei#d2*);T32&JJNX0y}nwu09)Mn(Y+0KGu0%SM7*Jj&8o+x)@gW zL`M2@7!j0^GXPQrRUXDK5Sqj@aWB^ZJEs6LesyLfLUv&{q&lRS-@3QPNhA8tn`)rZ z=F7+R?0Y9Gpk~rV;dj~~W9H3uvLjck(mbNx-Z_Ij@`D272&+_r(JYm9qZLuHGO0m( zw&>eHXr4@hk$M$!Gp$nF?Fu)fc44a zp-15p(JN!{eLJV6)odX!+aSWZv?@kE*^PL(ANnb`PA2=~W4;4Map|CR7uUxUI9dz( zswA6;8sTj-QgY+d5K+Hzp)TPSK1l=MV(fnLwTbEzwqz{F*e$U{jK(o?qj_~fdSJ)0QUQ9*++0L4 z@Xu1js(DZWjE+H*JD1zWoU+>L_Q1y&Lq==@ESijU$b?1NbF+-vyfFkW;X0Bgdq1K` zIf5WAHYeM44Gu_Q16b#F*E-Nv3nyyHL_IA?1j}C1MJr@LSlZ#(FkF7`qEWOe5lQpV53=W=RU%O9Al6T! z?yG5FS5AM~b6jO$#H=E3Kp9~S@UA6U8X?Z?oLlqET0Zqfyw=|MXvNzo| z*znAD<*8YC?;GbYay%NyyD~5$2RXYDSBU(uEaUt=a|f zpf_($0TvAv9Z(fr;c-=W%E9%QSoo@U|n z!Ki<{wE_?ON}FMLlrS=2Lo0Huw@!n${N|577-`*Y$7SBZTB;10n9Xq!~}^e zqYv{R8`4d9CN3@w`FfS-45({LQ&Cj!HA9|yN&d=8mdpd^Q(IKI=qJa z8}dl|FVWRMKj*d+9%MeeN6PC2efUDihpq3koJ~L4T;6AdbSTetxVKI{E)Dl;f~mE3 z<2ip>d`OekyyxyMqCz_eR0>qTrQMYRfKVk8fssU3&x*AWHP?a4#R7SSNr9ybFnCZc zcectEX(I5ueG^W2B}xa8(LS&3N$cOeRrx6CZ5i-DuZDV$<-6qV+5jt_fg$X><{N`Q1MWWcs$ zbA7SBX9l#@0kDW5*dNE=sYGjue}J{y!!cF8NV1z7l74*}ro-PfQG7UHAcpI?jj4YF_o`7;daHFn$@OXYqnS!N^Z3$wHb+>a5R% zPRHy$^xn|>m5_?+1CPxG9O3=$=%}8vVUeZkgDR9v)n>UvafF6P-tc|{ZYG^xs8rx^ zs|T4vCd_R)b5IRn^?q>o?xls=!a1?3)$TRWbcBp8k7V(hFPuo1MRF_d#b^Ws2ZvcC zdMhM)cx09}2z*Yp=$eM5%ABD-6PWrR*602ulP10Xy<@^mr+PtPuzHOeITFKe0NTxS z><${pzin!tyaclRy$*f{?<<0J+uNaS>pmOW4v9dbtHJ5vj$P@8po`pPhEF>V+L>1h zskYsh_k=k&^FTjG$qAro<{NzWq16G!Jsy&riSNP*KX?G*2=V4Y|8gP!%gdTr>Q2%1 zYUlcy?hi_IS%%e>FJHZUFC%~$1sG5F`PG&+7I!0UZSBMa8_?2lcbc?}kZMJgiwsBQDW18wV8;4MmBA>MLpIs4fEEQY*4r48Y7ZzxAO`DaE z(T`M=3yN+u*((b`75CBw-BtEjt|0VpgG_z-T=ypCn1By1~`x4Pyj&n*j!{ShE$BTX+%&j2&^yn3Z+>^ zJhVeBI6N&WO>}Y@V7H!HUoLY|p{YW#RZ7UUOQK&n1%KObix=VL9Pg?~2Hr0xPKZ!tyhgfZfx>y|YU|vpS}%0tf4DLJePM zVv3z`M8M0)XQFKCW@=-1!AH+lIOd3%)Afus9p=Ok<7bPjI-8ayCL0ydOZS>ndu+l$Lf^!QoiE%D9pjYOYJwD|GL zpd*stsuet*xpqKLySC^Ny>rOBqlu8Hc6cjRNQto|ngyjBa3u0#vP>S7=s z??kDQt=?W3A?&hOYBN@Se-n()K&LIbIX@p{2eUpAV1pNJGhC$89L>(;;LxYYSh-05 zZq$I6#XKH}GwM@LPAR-Ib{Xh9v>&q0rMYyK!}?vsG26jG8PInbtP<6rw62o}0yG7M z%~u#w@nZ`>S#HC6Q1DTH9vvL}eojuc%+Y)$=H~4TwzR|7-%z&x+n7XpW$??wssMO} zi#+IYW?epi9SD{+Z9<(vqA^%5AkE0cDfi&PD;s>M?*VD+ZV(if@M)C7nQO1!1fZjv zwyDjIk%zdMzt;!tC2t|?4z>EPC;1w^Pt2f$gI4_X@tOMOHA zs7Eb#dOhe~>mn!KKEb^W_J41lYcZ|Y`lvi}E%hI?tUt)S?+5>Z%zGQ2a&3d$ZfwuU z_y@UnEa62jcPR{#;=Nx|>}~vY3{Ohx>bxk7KIT@1jj@>+q* zDV7Z#65`&$J@}={z~r}6guUs3E*|_gi(Y9-OC|O4c7Et`=R_{x@h(bR+-kCOOq7qw z$@>Sr+^jes{L2`q1Ky(re&~qNNfPN=3AaR#Yoa5x zJ~}RDh1|5>K0g*y&*fJj%C-WFJyJHNDq0w}{?{F$-=D~Y^G6glV`2h!7ybGlKpiwE zixVON+rND6@eQYfKv3{Cf-|evX_u9bI5EAh?Nk6ebD>AZnCoikM_DQ-UH)&JY)6a+ zN2*7k-@1OCtD<(KL0T)25;k3A`JxH-5ABqNJYUx z8}GI4mvDDXVw^=^`w-#;A?_{r_sC-Et@!N}FXl_$0LQKMaS+~F_Zt8_E+k7~*s zAy!7ueE=|sZRh%3q65;xte9?0P}PA}t$iJ#?*ww^P9x>i^(yA?h)~YPguko^|1i7b zK4qggk`B-inP`4Ue`}D1iRE85ag)8tXq!61&opt%^)EBnP}%nv`7zgrM!XM+`L=N5 z51SUrtjFHq5oGlX!RIeuctnC;INwe4htK}25Be_Yd#j0kC#7B7;?1D}t=7w*?%99J zN8E0_i{6g4k#pAwp_6<}(r0m-&%`b6m|8imJ#0z6@vVN<^2yWVO27~|Ro}n+4 zKH0i`<@UI`teo6>3vMdqKfzgk`kim~$!Ug>TQsQFNcf<<%?JSfuo+AuBi<`9*+MV; z;j29EAps{^WZBn9e)9A+U!%Ukx&ML`_vBWI6cC}vWcX{LzT^+&X?Xo>G!fXZ`BUzK zfthD(S$JHEicZc+RX=x+)Eme%q1F22sho*mZaDOm?zc1GO^ZowA zPiX3|l5wWY%bqH{t}u&={`6ob7Ix!=I+ya+znTBvPab@~Cy&p8-8s*IG9an>-+s`a z{slNAa7Qee@t)Fv!rC5psc*td_Dz}Qm)dZfpU&v{^F#8;$VkAia~KoL`QVqn;-7x< zPtQc=qw%?XSb=woLeua@aIRHEgDo@rfk;45`S8Eo41QYQ=g)rw1%JZKtlWQNz`t@a z`ebHiFfJN3!>|{rp0<4|bnOu@-$Pi$a)NS0NdEW+mf9rs_4Ul(A=>ioeZRQ)`U04FEx|? z@YwzPK=qH8*m;|jx8PD!L!?&PxMj$hWVKx<;qTcm1#a zOS17vv&9`%K^8RQwu~!=s}$S@=IgV%R)dqwdUT|JykXCuQ=U9^iq)5)}x}>79erCiOCUta5k*&8&5Y!WyQZdT2eJ!=cGs^ zWg^4FDcwPb>EowQj{*7UthV_Q(x5^!`lb$JY;0`#%{zCr0YwliC>JP;@ueCcb4?|k zBsn?dFWu5*22@w7`uaIRqR<6q(}uTUph+3uwvH$n5`n)w`p4(^|L#kZ6HkJ(VWtT; zid=6!9C|u@&7aY?tS!TjB-(?OOlkLg+pc%maV#h5mDylaMBN)Id zxo_T70PBuWlPVyk-c;$nmc#66{XDw}3jG33u?2`$0ioD7%FCB;tgNg6@za!!{cd^g zCQ$R_*o|64;Lqv)pT8MB*<$N~ruUwCWy>^-j+6S$WBw+v+5;)KY zJBW4sm=W75!bZ=PP5;vqUs}M0%*e=S)}1CR;%)?xNkq=wO+ao1bU7mdr2uYu)EZ}J z7x_yoO8&^{Kgn3!dGTtzC{PEwOFQy|$j-WjLkQo3M=G%Pom}YvI zWQj_^Za>n<$Zk~vx({r!z!h&ucKUQAXI|+SMytN;sMA+?A21-b^Y5WGKjsQNj)enM z)IvBXvQm`|uXciCD#d*n9Cd))T!x^1ai8DXFX+Ml`ga1H;S|RTT)4v+qQ}O0-Hmop ze&$b-u*}z=UTE4~_^iwOM@CpL4JnqR6q|ibef^c~VrvS*8@*~9^Nx;=)5QaZPVNhf zi#7)I3=G_#KeyW$lsktJC0rjqd~K%|h00Tkj)`Fd(NIL^iN1bg4@Sj`bf$DGL-#%LI3V{7%qJ)-t`=O zCn9r}VbnO@d>3W$$Yk-d)ks0czxhWh-;@+atM6oc9ON-@cy7F){pfH%5HWnJ87r5g z6@|J5R;YI3M4$RJI<$#w0P-z0fFv9L?B}@njmJQv$Cj=`i)yzqlmQuFoWrAD@Bn(W zP~h~D;{I9X+ESCeZhiZ;i{}riZx4uEyY{@p_0Y%;cdD-((dJdm@oh!#$XZo<-0l)3 zhO5<~O~;ic)acTCNV{vf5f>5@#5({dl<6^|5zq9U`bY5512d$tkalc^JU#jr|Jc|p zV$ARc^;5Fqd9Dq zya3i{fodT?Wyb+(jF`IjDwOA>P6wZP^HbjTUHjVY+wYEfNA&?Jhc|Xt0mnZsCA=v% z{$8$}USZM{#M`@C!Wqh?VVtN8Z_%@*!>Up3mX(zW@Vpgxc=xXFjLpS@sS*K~Ns!qIJAUtUiN9AN zm?4WT<>@XrxBu6aMhZ$wa+KuJxRy>Gh^uqyv)s2tHuoqmq@v!O$^CJ7XS9J~40U>c0^T`>-`gOwe`Ie3 zM?N!o^N7UQt-#}jwOCI-9c$b@y2G;>{YkmTC*MPCs|DX8?7nGb^$)G=kA4!k+R%p( zz>e9RG0km5ID3VzZQEsU9dbgJ4k4`-vTwH)eN>ECf&f8otussQqpgG5q(Qf)9EGEh?A4kN3bOfFy4h!uNJq9 zrJje`s5nB;lhbQ0iBJ8rD43c;7ybD#}nGJ40 zlDFca2W_(hEsM?$UKyee{BMp{_t4bwiW)GF%`4HKnXTDVvcFB;`sx?&eVF7Pnh89|g$iYa$l z(uF0wf1hcD=B?UMN2n@&rMpXp8P0sV6}NUiK2ic(8AlDl{Bf@aHN0b#D|KFQIe(kwrS z1N&|X32A{-P7ei{5dwS>P3U9UZOuG=b}K8ZavyE&_YY)baQmT>2ioXt$y4Oy=3Ob$ zJEdAkL&|gKt`W1n$p7zb@9ePx!rsj>ZnPl^zg4od2+rnf@@NM*pM1&-mredPrhb1d z<=~Ki%+vIV4=o?a#knfK-vg9wAG|jDvvS3iQ5f(`>O<>1FvVHY0HAIm&VaGH(Y#XYd?Au>(u>4hQ z{nxbETII=pG_@IIM+U`r{Md2XftO_A=bVDWN|E`wi9dx4shW5akN{H7wNdq!)c3zVVVIYBZzDxUmE~tKf1H(&S2P^cww`PvVH0=%*EwlOU>=}elHiT7n zwBTyK|1p0W*99R^>V<)pKx;SP`E}o!&uFP~i>k4o>--Q7culvrw~3UxkqRC8PUe{G zmtKWW+bE&ljf%nh(-F#YnwrsO78dgN?!Cx7=A8%fRw$IK`TsW=@{PNsowS!?qqy5C zVI!67tazC_fG3stMrJ@&BIQqqnH+sAFi8H=D2yl7_Vv+HheVR))Zwmq6O}} zTzvoj&s|QC(H7r2_axzVDN4C{dyynw$UfS*_O+~+S7lZB&)@6+d{H&Zr2TAYX1yMX zXYNn~$_9Cp#T#U2t!E1o@BQ@clToB{Z>c~73DswiU=N5Wxa8RH{mQ5N?l8WKDwe-@ zKOTsqX~Pw_$3NdMu->=|gyo{f$Darn8!^m}R_Vdp{HcDiR+}MP96UtWD8$|>bC0)a zW7OS$BNF`(iota8&d{4k(|`08CZ$spG5XG7ARua0Shbe zbPdt)87b|uquQdA@Ol79Cai>ky4lLhoonv1^NlRGJ2$>1wl~GSp?1B*y{$6Ky;Z4d z@tEuqVEXwiSGzay9Ft?&~FQfE}5nQcco)a_PVz; zHq$b>`La6yYlMeU^$CNv5{al-LU7y~UC9_@etuV9oVQ%Frn~zl#N+KU8#IE3&Cr4d zzl-+?@0dLt&|KDjJV?NW?RmNH1z3DcPL{gr|MDvs%QN3?u((R|SIxz(>YCTnI^l7f zi7f#xvZZ$^P4dDXe*VCPWB;9xd+J#9JVaI1C1FNyOabB0uU!0wA%f zuYb1Y|J87l!@+Rb7Nu(^tF&>)m)KWO5TY!Ctu}c<#EJ{Qql4Bv@R0r{aaU#D@JdpV zK7^k|VyrO>9yd~v@v`J(1b9q`hGI#P)tj$x@`R7UzsbEd@O*9vopm;`!7pX8F>)J} z=XA4ue@cQ*Z4A+IYU<$r)F#WKSn1h(bQNchfG>d1&az-Jfeo5w;7bexpo4^kK3};U zp|yJ9)fMz%Dz05*?R3~dds{zpEVFUhy}7CVVw6~Rt1!paY(~Gpor-M2hG%DA0#1HV zS#n=_)MFP0DL2ilD%U03>($LNO9#XAZc};@x3A_TXaQWm9{wV3+S~;U1vS&_HYSG4 z?3+r)xbivrXdjJRIQ&(2@451+#gW5!n@6!sW$rXKYeANM^1!FbV&3?oME=$c$qWH| z$$6#}2vgm`>bhKcn)Dd4PfJa(BKz-=BoxJ!tf~&;ZwqQvzC^dN?Q7~43^c6HlM)5=9cy;B)Iez zSHJZLm(jM8zdE`@h&aJenlT(kL=`u+wuU#e9^-VqO~I+5ny+UMw15RG<{N0zT#;(b zfNgzyZw=`@DIQg4KifL!ai*;&vqriYmE=_}rAebKwb7tSgUxKOgzeMkv={f8k1@%F ze4SF3&`VW&OvnO6^Oe4?%flZL%HqYL`nUJQVifP+TMW3_A~;+mtTXD3^(&~S{VO;7 zoPyj&0nWsZ8Fdh@P20jT^K9x`U7%g~dq_A0&NcK7y1{VFyI|5ttSTU>U`TGzPwSk;>~mncMI8`EV5*(49eG53goY8-?NT529`d- z7{>0uSfB6d$w!lPAe6^(`qgSpZw1S>Yf=nJ z-aArYZ6u%Q^zHZ#UgxL0aBjUNgnwSfdGz>t;ikdTg-e&3i!u^>G&nxMf!Da7evmEmd~(5o82_ux4_vc^Ff-9d*RP;ZZ^o`2|Ui z=4KAX@quDUcq0!qgx1Js4IWjA2RCydIg7coi{wm70bLTvcblX@g={t<8Q6 z9>*cja8c`RkpRY+nG#d#P$;1cQqBj`P~KTr>oTmccjaU6ZS#+5AMx*AydatH&kb5% z>cI%2Oh3yo_@q-bzO5c&cTXCe-NYQ+1jxuve;^4L@!3z_hy6NlLGJp3dqG&*ZIu(| z`%4pS%;Ms;i<-;0%_3)*ZH0@ue8tyCfIzQglN-|%;pArWB(a2J7V1tBx3i%y9MRTH=qz!tY&JsgaX5axjhXlB${2X$}V?lhzwny_v6CJWlBZ@uBy9KK0VLKL zV>F$(OCSDGJ|-Y={;i;iMH>k3YAKTgHObc~w=`NGkpGfteK$X{@nE!>8PA8jTdW9Q zdBZ%q{YFPUcOVyoYUw>e-)FivX-t9!IbP~+D0sZUYUMXU295Luke=OB*NduAX0hb! zfVjB1>`1m6=&X+TKvzWzrAP-Ww^liKo^>zzIK;NL*&qzXV&(i zj2Q!xV`7F4W4HUWTE(`;YkgYAEGo_Db&+rp=)2wJGWp|I$u>C(%`NcJ6o(rDb{9xn<JPNYv68R2R3YLxip5Xt^1t2oBEZhCzzNhl*56VZ+eeLLox$l2g z7BtWkD5o?xyZc;ql$1h>Y%!WI-actr1@+-Ad_wP^da!D)Pu#A-#MlHBe)1KIq4HD4 zE)G*^2Jt=BQA-1Xq6#_L>7n3`(KT)n5>{LI)l$#D(W~<}(LxVg5^M};;V=WR{%XZhywz)Z> zj`^~#!<_gkQ7sWRR_*=G~)M!LT3w=iXGMg@ebkm-__GSC{${w?F&&PsdtV%sDiK(6Ja) zFh|AL*b|m%aS0sPhtLu`>Z)obM9SF}!#OsXM-n68SJ9-=677&6yx>|Mt%_e6t$xsN z|7|+^in%v4QKF^LqQk{g8cc|JC1jKVEza-bV-qj?$m6JNd@a~o46w#-jm+8AW@8K5*;Ca6`pjlv^4Q>N1IYlhRh%>B*?+71{}AYWJ#Ktr-w==;o!$B11D`r% z4&WJ(dzAX!!_8db2j5%`6@Y-hS#xq7`vEMR@=M{Qfh;V0XCr6kMdhXv)Dz~ZgQ~%@ zM#P4n{O;!bE!fUx_}L|l#!fdFewr394Io3okUP~x>%{3fi#qN78yo@YWx$^0)RzUo zlm^&yYRbi5v*(nWWu(NKo38LfBO}n*fBa0HEm)0ORgmZ1RDCRTAs{AO*~X@5*p_*G z$XLw1M`7HxF-?yd#3)mtD)d~7y|beT^!7$|6BtB4flO(S&nEzulN_q0s+}Pkk5ax9 zNnFYjEAKKLi^Xq41NXM0Ma}%ep5YM4YA3nzlCDQD34l?1-sRA>{v+?qGA7vl_=0KF zo#pB*iWXuCHl-}agsJ?LaOK*rREZLeDy z(6}?4w`hZC+afE`-nEutp;pKE5tPHin7Dg)%@4Qw-43$}=|lAIJxVf}pW7U8zl(5U zTuI%o8h7jCIM+Q~5bU`)0!WelIj)!i@gFE7`fsQJGaxeDZ&5wixUx|iw(bnnazuX9 zWZ4Y@J@S1G-kKOg5836?sk2sHDX*3%b5S8{#(%oil4(z}>p0My-YZ<-dI(rzORNX) zhnqCYRiOO-;eAVh_XWj!c`cEPrz1jJO^cuk;}Z4SdUNsq-gFT*flFF^UC)-<$k|tH zt491{!$CGmxZ!?!UphSrU3X^KsOyGI+R8b*VslZk$e1k&E!E|g-df`k8Qu!K%$Z*@ z+iT-gBxUF*R>xH{-oANU)AsPjU||Wr_QSpsoB4zJ)eva5vU*0y@@r>~j<&W4i^P3@ zt_p`qX!yHxSatkDvWU|{Z>I9ok8@*Pn;ER$tGe zDb=NAZBQscBc;800B*Ue0|2Q(y~{e`-EO&pBLVHN<(oTL*Nm&r>I0)ic81oe_1-%zWvD3ugA4O{XN}^35VpjSQZh?DhW*k>pCeSpsYvvlJM&$0V_Z(&?)F4HUgGgU5KF8xGKBuj!%GjZh^uZ#VQY;!~ zCcM^J=|v)**M6GfK!^6({PLKK428=dpJTvC+hM}vBA@0u;5}jhN>rBo{DKc zJ=yk3TxezK+`n}f#g#B zS`OsFVtP~+AwecUV7 zJDZELW0N8MGg}y+BGE&&MYLtD>9-d+4PTahbA=`NzHV7g#yMg|S%W6crb1}Js|B)j z;cn^8t$swhv^Q&M~SV)xb_ zp3xR~B-zQWPilpsQxK(gdf2x-_`dOY$WrTx2cn5dTM{xK0ttP!ma^ko`Bb<5EF%1) z#I2DbJyqc1CRVtxp4%$R;JJ6DiTlR0!J_=Ib93jJn&O5|g))>39XoMCXV=`776&Fh zEt(bLiQAL3bTz4zxU2_GQG?l{Y!|{oqTQP-zUY)P#H8bV{vel2Mx4*5JO-n2qd z$yWY6CHuQhP=|*P(>34;3D!$7iX2Zh^`SE}T!5i)q@u$n#fSkm?VVBQEBba#p>hSe zQ%O*QXROM&yNvLqGLKM=nVpa;NqV8;2Sv-gAYn^+ah$UdJTh;XSsPj;reIx2 zBYWIFa_1>XoXHwI?~)#q*eYq9;h!=Tlw?rfm*+-jkFjxd&AwcjQa`VE^!#nAEii1# z8|G|pZH=sY_(BirW8_eOQ4<4%)|-Havl)>3103stj#OK@`emwwiq&RLD1hypyKo_` z(G!fUg3a=9&i5oWfF1VN4gTrCX(2#r+4l?>VxkrYOPU3zG$+_(RrjFXd2LVrK0ZGq zlPr?&(KoMm#h7SvmcS0qisH4+@%^`1SmS||e*t4`Y+eBlj_GPQdoXgRsA)BiBD zKO`gn{=3ZZ8rLA7&VaRHC@X^c6^=B5Q=*Dogjc)KPc=m zdN*L`Q&^PJniLzWQ*O4qxy~!VcJ^?)-*YD!AX5P2NxSllc$b{nTC~~rg#X8fycK3u z_^k^njV{(k#Tt6ZM79dWJZd@^qothC!4ySf27L6+ib%#ZEIZ&7%40T5W+q)yxx1+; zGD1#sZa(@P0~Q7G^2*5rtM649!DWtY(6isBu%^_o}YPt6|F%G)#tz!!JAK@}CtxPd!m^{nhWqdhdrH5jqP48hBLp_W(z+ zc5j2>qtu7pxq8(5YMWl!%kx&DUo*Re-UKEYRC(CGBHL5fj~Y_HSF$#?xC!YID?(MfDNtBk|Ji4o{HUvwhY@|?07GZ=15dS#42iDa5hR`Ri ze2=N#FPqI<>dSA>56zumASET0F(2ybm`??%P^34^vjSqx=}J4cQfW>j(l5N}jvb*e z2c>bdU<`P8f$RyL`AGR0B`9DZD+~dsLRGuT`+eVQ?t)e8SkYW&BcE#b$`)p$1*;Df zk~@)J0GfnLm{n3xu$oLOXgcnSeczNie5iUCNYk_$Cm4dEn;l(}`1(!Am;?3#(}!5O zm+5&1EW9~NB$BRckFk)EZ2pzhQ zjf^R3BX8+3Jz|-UYY5KU{P^+X(mP`MH#H2!8rAa*nm|uz5vn~HvI*mH0yrp%B=nFt zd7|I>avt0A{9r%Z^Xkq3pD%1z4$VaGxya+-HCYI<6 zEAO*kuxfOFDhf+~#X`S2q`2aWb#&*xcH%);y zdU4-7^4muwR$%SCckg~?{_ey&aq{2Y(|_myFGNVW;eF}ZzN^8i%Fak04$Dy>DIr-I zrg=u_yI@k{9J4QI^DV7K1Ji7iMzfY`R!Y(XcQ!lIQfE>qq8C z5E*K)LBC74?zLQ+pAtIU&hyp?AmOf9H;J(YqnD$c?qgRhPKO6^mrIp9&)-}MeyJRM zm9zzP`dE9CJU?gI1EC%XCE1Y$^<}qr@$pzU%cT-~pUL^OB@8A)F6%W1k2*qgLZoR3 zIFu%m+#}hgh4y3KCF0$#W^*FNTpEBqR79h(hRO-rK2&+4Z+p){t!Z<%<8ZjVD2qbO zWGQAO_F#{^8+5?uF&Qy$_j@u6`ubNu^T2e;hcH4YaBHII&mS7B7FT3Im_^QF+j~9n zyrWoK_)wYXo6w*>z+zV5GS6z{y^$-Sc>>eZoy*g9;O>5+)u3!Q@x;dN`~re&py@E@ zl*>Y{6oAB?f25m(MN;Ck%wQZ7^8otA0{ohx`^?3%jeb2A5fR;j!a}HMV_nwlD}=;s zdieKZo560eBEzd$!$Vb^nFaI_a_I=GMm5{Vs%=Y{2;)H|u@()9eoXX4$ z*-_;S_Se@cDz!_9bXJ-g{e$Vx-)Hk3Rux zZ@=L97UHEUCSqFhNEtl%ZTkkaP`*cZTR@T(({Zq7RJNT?hGH|!&UoUzGe{zC(1+s1 z0CZB$)2FMFh~!p4Y@nAX-%jI#(wLf0@YdU?puf-3<%u70M?G-JBY6WrLgwSo)yzSQ zCV2Xhe?8AUT;Rhg7Z)=#-GFA+w+x&>``BgBbbIw;`QEUTf3uphgbgIZ_^p}?E<7?b zsJn-6`c0UE91G*k3c$er!6r;%*;`cz;RU#3d7q7E_2-wRhA(Fw3$Yg6o?d>MFM~wq z>Mm_&WyO~;<9L*pRW_W|iIykO1uReeOWq0iD*34#oovt6%8s0S{%~7N_k;bSljKe} zit#`k`x^(pq-f3yUQtke_poele_Y!dkV$Hep1vSlU)sS<=dKdl&&YB6S$%VN#xa7} zNB=xYuhP{dpl2IZjqad#Ot-Z;wUF^#?mZDCbN%{tUhh3Ora>!C*mdHzFUTC`(_jo< z-+h5#p)}iFji_wf!8Qew%;rAV5QHKNxq3X}AbXhh{suu)k0|Pu9e)9}sNXwwOP%CC z>NQjHsGrRl<>Z>JT|c=vUBIJ3H6_O1~Rf=K;> zl2?+nN)sHcPid$IKK-*W@sEHp?nh!Q?jgS`pO@uGDcL8pu@SY@%*h2@$R@rcYMcCk zGsa+HPkoS-T#{NNLy&0f*O>eW#-smX?W^OO-uM5H zSO*IQ6+uF!1O%izR6<%na)gp1CEXwvBHay2_asM+q0%WiYK$ITV+`1U-@worF#{jqY=N+&2^Ysjx*Pdd@k@42~X6-L5O^Ll>(^(OY-Z-3Vh|J&tYqk@T zlxXO=uUz$_!CmBKOCFyK*rr+^kV&$NdnOlnr=^PsYqejut4$BpoT?9x9in(0A52CJ zce`D(5|AB~;LP@9VRWrdkgO2d&~U=acd!6C1G>17=I4OJX0q8;Q$!)3_asL{b%lXF zIKvd$y`R0s^D3Dp@+=#LrmZatFlHXZ&1*7I5qB|WJZ|fjD*Kw`&AV7hq#3Hl)j2P} zY(_<-pD0k7l(5$cD5&Ksz<&aJT%PpSr`~F56K_NHA+y2D8rnc#}}hc<_O;S zA+O`nagqg5bfiuEn!LPyxJ_Bkh1iEq1olk(hZ+CmW!9o80WHnCK3&EA4S3zhS5|XQe-)9F*B*NNa~}UM zU)qs6)h($BSF>wuLw9o3DXa#3Kj%o)l{tgH3fvPPHIR>N0Zri8sWf9XKcVLY+YPeK zEnZ(FAusqjBwo3k9lBzd?*k*>39g;F4;;%r_I*z2l0W%tuBqN=MJ842uadE6-;q&7 zKeI&F?enY!!)5_MDU{qS_DCLou;1#HoU;yvsfH8Q62TElq7Q^GoMhsg;PkVOMk5O% z!zqoPx%5FTEk#WyeJL0ANvE5InOYp5KchJ(G0i6q!%ObybcwFfEC58F;fu~oQ&ZD6 zlTb+$an1f>;M#V^mcp6m17aLlz6CEmA7#Gpu)Q4ZPv`N~Owut(9(E|x6jCGK z?cF9$*7jz@BomaDX%Q>ARtI>N!yaWhL!PfOmEUR7*`Tf{Zv@e#sW0u7=-I#zrUQ0} z_P*|z@ds>QCaW;#3fo>(+x#~FSqj1YZ@Z2A_*zfU*(e$o4=5-ixu)(Ri5^C|Gm(oa zhuF?(=Ye{^Y!QLt70le+;t3y{Teqw+bPj`5n}Errh{nK_W7K3nPQ=TWw0`r)f>2vu zo<+m{>0G>=msisGnlm;R#GO>^$)jaB3adv`@1Q=fxMOCTF+oSZjhgKk#~Rg5G9i zD009fraPY*V`QytVRP?gL6{)qcm8ll9(i5!lyjtfo8T za}kue2;{mCKC5Ic7+9g>2QviBGY$$1=%hXw4)|u9SY0Clhl&oSM7y;*_KM}T=6}4( zJyK5U|m!NHCGS@&vW-^pw5wj*$+&_H}CsD}WKk34t~h9AC+qSXV_BhE{0+ zjF576=WDg6gr~>gn_mv?vY0PZeWL^od`CDNsLNe880QK^xNV<}Srz0^!>m-dWPKh69IoAP0N4 z;Mv=Mo)16L=}6r9K0S!-!jLNmPy58ZbgF=kWBu-0nl z>!w?&%sQ>hk1vK-p*-4y(^6cPD&ZS*qI-{m3nMPYz><9rgtex=Zcx}3Cx1f`S8J!W z)B;Fi4@=a|>xASEg(_$zi26&c*=F5Pk^D3hE=X}>VuG%@^^&CrAFu!-*cpn5Y+)<1n-p)=H_$V2rxE+JXd|vg*A2nO?AlPsgBv}YVz_Z>f94yAgxq!sbY8zm--*+wKw3?dQ-Xm|!GO7l- zQxNnyPXiF&;}&C|GB7YC*NHwaDRjR7Z(`xUU_|s6AIf`b3)m%FiM?5mvk}_38;Q=~y)2nk@vtAhv7_0;b@TP(x8@m z93z*lop(0)C#vqFA3;+*Qk`GH^`1_P*y0ZkiTq`{_1$8&<>Mr$Yr+c1TmgP~F3at~ zhQSKuHy1vGI$~GL_y&K`nOZe7wjJ4W)|!)|Nrk>z$%UhmR>fdIKU;h^%h(CL^s2BBDW$>-=Ve3E2mQbDHB?E-FPM+e=7@IfCe_)_Rgw za5kHqF>i^>j(v?Lh1%_T(VXrm{)xN5`C?8E4g({XP&yXPy-oJ&P&xeoA< zkF&W4#Ph}#*^WG(;xr80Plu%X&6cMZ`J4eEO!_Q+guNvwlcXfN`aR$W=vF)BN~kEX z?dvb~r2DIkWJ@4{6SHx7XJ=q+%u$193M{LYP_8{anWV;&z)mhd zSp=CT6S!p$HH2?zWWxsrMOa0DRANfeo}m$nVnY zGxX{?xw&V>^}z!jjcN;A69qKG&4f#?V^BN0Y+E*!wGeq&3o6pi(L*Y4`2FvElb0`l zA=QB~l}d}}S9+>9fAIWHa*Y1sP@Q*8iVV;+l6Aae?SJ?3Or56R=f$&GS%>6$*RdEH zO-dn;tsELr7o~o#cYL<`2VBU<-cBAnX;Oe-deC?q7f1sTLR=#&4-40?G-7U#LiM7J z>NdXeT`ReIaz_O!V@)r71-&3qa^8Ub zmNMk8;PMr`4abkkE23|Hl6{pkKYv8^A=ZmHTH_8zEEz9Y_f`ftE%tx<+Tdv}iPdC^ z9SIL-r4@C$OCJ3;p^<+tucNPzmvOEB7*Lc4mjwp#y()Yh^{CVOw;5}00A_6G!vVA! z07cEdFJKnWK2n|5Jmw9SE#6hONdvi0lRv(D~HN-MZ`}=D2lb3}izdO{L|Luu9MOl%KG^?Z^*yJ6ks03Anasm@|Q4vkvm zD4W{*j8X7&%jw@rS0$?N8m3%bS~Yt@Pn&Y>7kYzhT&jW2c%ILp7mO&EQUJNydPD^I zaLlzoi=5K?ty2gsFc7h_$WQ+`cVf{PWo5e^^qBV80b0pL-?LS9-VdJt9Fqx*F*ejUIU(1)JLBuSO^ZP743z| z>IQtYFa60=rxa$>LfYy5e~#)06w=g}AE}ycMK^fQnYr_1Gb>Xo!fXvXZsu)`N)__wwQ~8G~SYRl#VQd*a*!iHUk#(R@9S#OzZk3HeJoE1usWE;zHX zj%3}z$Aql~%N68Ih(}nu;96fo61&Mj@XNh|-FBmcTWfH9%FN76%ZDrM1p#mT{oBtA zjy+*o)41~bG+7M5MtA2xasp%4!k%1ob5m1W9Jfh-QF-n!Z6%2cdxB5Do^YQI7Cefd z+LJ3+!z2jVrvV;Jw0nLbb>jISK|(n;ey{yuKub9sk&G=}>3{mkzL)91V`0cP?w?mA z>XMg7&tQAgR0R}ohF7MDd32CmMk@lH6G#=QDdXArrWvqy*0LYiu$$xu-S;xuHD&v9 z6Od&E)2{yLKmQYQ`s@V>L<6>9MF*O4IZqx7oLE%&2%upe_f6AbxF_tu()2`Bg&h#2 z4mk2>14?@Y4<0yibdI%J9X9eu44Hf zFYk~NX=H}v{!*m;0FDa-MoD^;V~+1W`n^>BHAmXhEOMnPQRjChP<8&`Y2xNA|7ziucnE1bIQi!cw%G4lW z|Ky7!g*tN)tqnU^T=tU^d<$htrCw;>l?dG_Za zH#{10qt{>40Ny#U&vW;`QAgIpP5^@n>HW_)C!i$LO~F{C;&k;73pW^vf5>uJaBHcl zc2{VHz^Bf1Ce{Owfaj8bw)NQw`DMe~8F7_~i3!Lh31&}z@_PSM_Ym-)U*bkrM?B@1sXhyw=v-wl_lFrQBS7n{*vC+S~Sa*h#++?f(nlg&HB z@$eym4RdADhsZY@FfwfA=ph*&7^K$r54bA{z0EZh`Fi z5C%qWm!LQNp{0LzT)Oed*^fN^EO19#l_mS>@A=Q!{iEObsB-d5$XrWPlx{>guH1%B z`MR7!Y{Le5--hvD2P5Td)MeoP)a@wY@v}PgzazZ=V^=BX3X2gos<2LGIVp!9QlT4o zTFKaSAg}kPY4qPL|BfbGP6{w-y8#A6?xEd}zS>Vu%zr+qk1i)3f2|8! z0Uhj#zdjLumWvm!Ns%BDrcD|D$75j*CdO*??}MQ@TCaTnR)*r#36PNYFUaDLWg^vi z_VSgh;q}ltU8+m}9L@iJ{Qtvm?75YCXPPV!CoLC?GW*HrUH=U;7^{1i=C5 zdQw3_0elPtW7+?z%KH0H#l{s@40MT6!~|gXXa-sw`@&!c{SOv`V1l|C-S~~KJZ>>} z?vDrcvuF5^e@<$bq&WohTP2=S^?mTO{X@lth`aZu(l}v%-MKt}KU(v}ZM**7VDl$; zi{HP_&`DtD$dm}{ivA|YV-rm~n#_?r-K5~AL;2TrQqF$y+BIMiI>Lmp{vQuUZvDpB z2PHRm&E&iFpD+NOA2TVpZv-c)$$!{0qNPYd+4>;``#;@2rM_Jmir){m9v9KRKs)~Q z!Td${7^k3GCB3()#(yeGK?L+F5b_6t^WBx0^y7r~|90I_CrCY=d^#M)qu9%HU{bRc zCi}FP>FFzJ*GeUD@3F!Cn{~_44q7Pn=+Rv;9xkLpqW{yfi|_K01zzi1A+-I|w}lGD z)uRCkxz5f3Nn(8a_U)ft#*Up>H2hdu3Cd7s#JP_D_G|y2d&X~X5OqK1thVzx(la^xwSuoBgueWld!LM&$Pgq>N6#hDrUR1|Y0Q8NUiVmNxpL zednbQ+lMo+-qU`5S*uh0%hii_ZnNDYVS9C^_g=!AaR|w$Hy2t3F-=r1r8PIj6FYrV zScc<0*E-`^wXJ>lXRO7l!~|L*e&KKKqo z>fRy!Er$Q~<;Um-_eM|wYNyD0_@KP`$=S=d*~-&bBNGOyY|%;tP~yra({C5{Ds8*C{y0u zs_q)cPwfXgp8!wPGgCTX3b?_`OVZFj_&G<7<;xEhL|Ci@Y8fCEs@wC-l~PZ0Dcn>0 z^X#)VDQDDF|G1;h90h_4Pb+bOBSXsPqLAxqQdm9Lao)lg_V)G;Qw^l7kcxsUFO6;u zx>i-A8q$dY1x^ie9$+e~}(v1sPcXtDjg?%Z`=bfVhZ{FPz7 zbB2`sk{bWFBcl%kXF&sTdyxATD1x7?BGilZ3vnB1+@t%3QygcIH)`tby=ejVB@W(+^ zgxrFCi{x19?zE=!*INu+QIlHXRI0GEnbS`i(fKo>l9={3gm(M8;KWWbKHD*=qT0@#V{xg}Px{QP@+GW;H$6;OuFEB-@Iq?T*%v>kr$#^Vh)y}P>V2ydt6zB@bPv4y0 zq5{NqHr;CLw{PBD=7n;3k2^2+OFY0&|624?T_Eh?h^$c>d?c9APbC{JM_BKoc_vG_I!GoT7%GJz0YToS5x>9L zPNQ2lWp|XID2@CO!K~G>qNzn=X24!CfOOe<_KJ9Sh2G8L{=VY@_` zfa9dixnaPMrH~XJs&>w&k_U#5L{sT=3^gbDNau!2Eeby_g`H(C?pQ5;v7dBF$ayg; zNy1z23?--aez;0_(n6G>gQk?ENhqL!NzeygVUNi-`GifP_)dSriCwqEw98pRwTi9Y z!lP&tqk!?s!kqCea%ubRr5>ghfuZ&;a_%5_7WH8Cn)i;vC6I^c8H)=2#CJ4najC-& zNn%LR8D4Q@_KoJ#;ID*4Vm$o8U)j4n)Aq}bQn&E7wtr{@t43DB1ta&}la|QsymQV) zhX@|y8Aw;Tx}h`$V^K@36D+eH_!8y2^991Zpw%X! zAv)L{d7vr*oKrbAMha|`pHT@cy9eaxHKzOESH&Idy8Rg?4#MP;uR1LcsigSiA#jcl z)u1@Ufr#9x^FBTO27R9j&(UrcAYG_fJ35B=sB}~1_6W<{aMweNS8-kf4^3puF`U6D zq0T)Vy>-N-@X6feGTQ-l**b|1OR#(}w-$za7~`f{yg1iF=%%p+g0k@E5lVa37hhhX zeuRIK%3^8|grPsTuwpn^`KflRmsh>W+AU$t@Hm!kMYNt+gdCL*-Ex;&-Gh4a$l1Vp z6mo`^4&=O2khsCbnSf@3TZ8t3r!KnrR2&wL12&%5-6yNEiOgM3I^Utv?A~)xwU+g`rEK(E2 zvAi<2ix|VBaEjGojCps5=Wj2mVY!Et_kvtjJMYDM^?*dxS?RA2|W+1=DrVmV4l7ySC{<%p4R zynNvzst|ql%6g8f;xTN>)y#UUZ?&h#ld^CjJ18Z+Op<(BY>FdR{wM}(`)G-Rl+b01 z2ixMd!OE80@+WOKZ6>}aBd8#yIV^HzIS5)UL^^1!t%h)!JZ)VXUnG8LkEaC#EBdtPZTw%^{Oe;iCh{OKf0F2G{{M(Rk}dON~5Kz&~MH8DOg1DVfiUt9}Dq<6Pf{95t-k=tM^trx1TdQ3>K6V zZ6)ye8Dv|HBwBUG;R4GiCZJhGVbS_EXo^tN%FqH4wbzZQbi|0rTGeJx=S23*$}6hH zPbQ7yg%;Q&Z!d!oyerBV+$5exzh|DTK0MqLX(f1!4Jaq@*C>V139})(QrHnXt-D)3 z{2SGPQ*FuUZj$G)y3$u$hVmKZFg#wq?Db$wCFmin%Y zZkD6(#G1_fI^S447N~>SO`3d+=O&ArQ`;i3VaF~wwzWoP&jk3q23hP0=e9ru9Fx#( zow-h<8^GKHe#fBV{(;~kt$U+Fb$pDnxF>GaBta`zy|q>=J?(kRr=4$`yOc)lM8ws$ z(KW9pjY@CZf(7-L^c_I>ANT^nh~b$~*+0Ahs!Itry_IUmhv~1gl=`G_VCR@ZS=iWm zJCYsK%CSIoE_}}~f#!2DKVr{tYt#-A*j2;4eaD#N^3GT6YkgId9|}`J7t#9C5IsJ& z!J3N2{{j?S=~K0yrL|dC!&Kn(AoLF#A}OgiLWm^ytH5-E?sd-Mkvl+aGPI7@qN}Yf zI^T47Gn(0uo5R~o&I>(gGdep?pyNYn=WA)wd40@&9Gr6tIGn_)HmgPe8lay1UP?3> z+E;^GpkVEs#b+M6l5Jxkw&8#%pU6u_FL4J7-%cPsWdQ6Eo#wxPDewVNhHe_@ zN_&&4{q50CAK(BNbdCFK+r=u~7)}GWBhtVyflQM4Bm)1|-(L}QB{M%?(a*~t1&5i! z)YOzI@bvA4d%8OMxRm3Bh1h<4+57$7^#^_^G@NlGkl8b6*=bBbILGKLBI5HLOffSt z1@|m6{uLl~wD!H;Gn*r4jz`5BDRU#|$96@i#BvakTSb}C&+;FJ-{Jvu?)EK3toIq4%GtR8?r4c3&O#Q~xM+%&|cJN}_<}9akp=QtZ&@(8Mq$(SJ*CXa!fE z2bDqX;XNPo-AsoY*vp*FHK>V^ug@V}*BTp_p%$p@FWTO%eDZYj!&t(bwQpqOF%D+m zk}DFzup2C=;u(Fw*@@)vLuYg&T(q{lF@={LTA6T3SP?yWMI-9XJf%a+m|ES(*K-@eYQxJur|NbEcLVsIG!q`!0dEP3=~r3nZw z2fM|Ku3grbT9n2`f%}xMJm(qrevLnRLAM%qXU9rk3Q6LxNk_AEaqaGcjMMGf3&2#0 zsrtL4N5%5{HNtf0%#L9&2=kgI%W&Jc$jcaPG0^Die92aMDm&1&hIySZ-Hk~4+ zN?Q7{bI1}TfO!AGgIPGfxs40a5q|G@>WeAfay8jiRFxYY3P^?{Cd5RxY3R2P_6f-n ziG0HJzvQXrdEg?B%ahTGJsVjbDObEeBlLtv4rIwS3PSFhjgm*vGp!R+;v#4#jQXcD(|MTTfVZy<+%fMk= z$9!LGw18SzC3;@%1EIZAy54K9U(@_4)^#`${{xPvvoK&e{O|@%i%sMLn-) zyodd|`G31Ek=zICV2bD^9&TV#0mzNoz_$+dO~S#uYezB3sMxqsn$ph}m6v&rW<5^# z%@7?F+H4)L28p7{&bE(o*_5a`e0B1y0+LfO{+lEwS#>D;q!qF$Zbvbg)k%5WA~pXk z`%>11H#hh7Wn*kyxTkB46rI?2uNNn=6P1o;Eg=1tk93!B-VL}JI&3sjCfd($?BSL= zeZcF^BYs_n37}rgQw%!i8`M;k-y+&+HMJxcHQExu^Qw3SrBL?ef8PHhKmVwn8r%aH zp*YQ~(sY}FJWQ!k_4$`S)y^j>Nomh058dVJOz*AmtfRjbZR;V>iOCpzfsHBTdA1&y z)tcrT`8soO9D)jpN5oBa2^zA?1YX^EmS(1xOR;Ej81sYsG;R2=Y1BH)1-OuU-R-k5t?U}e-+4FG3 z!C8n6#Bh8pNQOdZe0bl*(RO(KF4k?af7kS75$)){rLNoX3nbh2-`x0H$oN_^3_?-e;o&{K-?Js3a0&m33l^9Aw*E~m8>Y{F0Ran+ceq* zI)-%z&tExil-)U(Lc8HjTky673ILBDAwxTevAToU(#G^^pcj4(|9(Cey3!Gk-S9N~ z+E&Tm-U6>NxIso2r_(Mbw5m^4!aQZw%P9Qb85ouv`982e^2$3$E7D&;UWlVKh^l?H z1I~rcYwVA6Cb$Pn%pza=UP1G}=r0EnrUKz}XV3DotJe%#4mOfADa54#9ILgcqR6`> z^e2GTmxwbo=mS^-S3=V2B(45V^nBGp39wZ~o}1mg+Ua$nwWxG-Kk3LP)W7V zb6FW*S_6e9Fzq?iIk(N`*#Tle>&F)`~uDVVy1|1wdL1R|2?srEUGCEz}@KK z+L&2|WQ~z`|4uAfvzPUUqRO8nkNptZQQ=t6!`GoR z{+5!$&6dN%HLeJy!v%}J$FKX;Z9$Q~B4z=C99fVCp21kX_o0%Ea1VU=+q1D5VjMR@ zx|4)c->arFP>%4mrr18OFu`!b<`TT@H)m#~KhTcAoTpN^oFigZwh;Gxt_#|@BnVnY z&^*jplOKOYjo5=p8o-6po?pR;{g`)t;$lmI)YzBCP0SPl&b-EceNczfZtGoi{Tf{a z-t1}u_V;~S5A4(6vRf?$Wu0c5KD*^PNn=Aw$++c{tlC%?8* zZQxf%Efzr*`s$!88Q-sC<9x@A0RFb}0MjFZE-%!uT)E7y)u9(J@ulFSE%Z#vfQq-D9h;No?t&v~ovQ@vqej#=dm|H9-C+4E9xS zsTpHb-S&O_>h`(78)Usdymrs4s{5P@5r%7 zT4^}KEmCNW+xP-zHICD}8vAYGoQ&l!*cllq6z4?qX^sRz-hdmF9D29l zo>kqE;>)|(ND8IJjbfAL4E?GZ8HJU-sL=D*4cX3LAB+Vjb(?|sYOFu~B1brXUi;)X ze~<;w6`U=C_UglR=jC1$>zPYpWO~pBYyfL%c0M+3+ z^6?8-8;binaMU<8w=b7^y3aSkY~%p54M}$VJ74=7r6fxN-Z!pSD6Mf9&PE#=slfHHg{XrQhR|(CnkTzE1>D%z__t&F-DJ=Ik+}f z4si;fL)GA0T+ynI#-24}y}J3>{i`%eBnUo9Qk7&8CMe>dn&PfOz7|KMmny|xvY30X z9=}IP)u36d!CYA}#a@+58hhwyBJDL>`q5Apm882h<6X!z1Zod(87*&)&h6KB>T3=pj)`E7|9cSH@P7Pm2;1M>95C+Mohn-d9#XeaeX8P8Ioy60=T}Jx__;5#3 z;&`396}>BvT7y8NoYGW>=5m$pT)oT^`P&s9IK4in7RByLrnSEN%5LTL3MJXc1aoZw zqtsCmTt?cX&&O&T`FxQ-lJj|3j@=fXe9FLXA8VWNYz5V0lF|JQpJ+lDoq-}EhqW98 zJ^Q-pJWC@FmE(Cd^~$Yp7U~(;YR99`N*;c_%d&l+earRTg7Spm5@vWVp)--+9{d+? zCnuk7c1#>|81?mtn{njkUYd~;pm=!}TzwNW_6}#hmlFZ3P zmMqzY=x}gI4RH#Df*<1xlzE;c9Tfe!144q>>M}4Vl%CExq~94oJsr_($ux|uAh(hg z&wrfD$m_eOHK!{-J7Vaa39vBHzJ}=JLU1hB+ePEXRF#xUB6v>?e{=98PIvDD1>d)^ zwh>*&?`sRLL*L4MAGePI zt91!tjf{o;S6VEG7GeJTQXk6xjM*gUm2#+ zzmaaAo~iVqQF-Ob1LdrofQtsHeR~qz^9z(oOG5$5DN4C*5 z9yN{FcW>UbJYv@x=3f;o#~z2POl$YS#N0myW;pl)*CJ=~rt>sH-`l?HHkH)@LxtIz zwYpNRD5KkG-$VE_5`=oDLcEA*Rmzf?!Ewbva8&8dE{`7jy4UP5E#ok2MIR?|Yu`;K<-Z13Mn^5#VC9A%Up_@-wRfjISeIoqI z9i94doSRc&>GVlpxG_^!ll1^%fp*4J6v6cG`k_}~sHvFG9TG+qqn5@3$}tr_`?4&4 zXaJkuDJ;yeNw{G{eA8`42uXIxjJ8&xG)p{0-j5f?Y7@xkdiVp7=e0J=b0w7oTMtv_ z56hmRg9|fU?Cnp_Sg>!TSl!|l*FEmjTQe+w9ty8`9X-Y|G`+Prz>uL;c>Cz)K~4Oqr(~WI#3urP^Y=B@{FdUHlU@L zw(XTxD8f+ObEwfaG=8Ihz|pRVRi0jKSaMq-e-gC|zkLUFbch*W%@a+3V6{#F~u})&s26+p%ucq}% zMp-{U;Mnlrz<@0|^&;%{=yx2c9^!D9ezTG3Eqf_t&xXQ;eWYBZQb;W7xBHc)u3wi3^J7Bi_SssEsYC^9s?fir^WO5FAl2=X74|{TVSh;8cd&7x*Ej+5s1_l^7T0C zDRjXoXj7n1xgMR|!ln6orP&?S84CJ&tnK3J&Om$%GS+hUbTS@>6WhX|s}RZVEnFcK z4=liD^F1-C5FP&CT-S9kVez;vT z+7`*`SxT`3;9FtMBc$d1ubA&Pa!bn`Vt3ppzr^8MTZ{OFV_~LdBNDgLK6oc|H!lu& zIXzGQ6tK$YhX%ox$yl7LD72PXd+yp!lKhaMMHhXVQPJpobanuFz`{!5Hf*Er*^d_!C7oEmWY-o~oa$y% zMB3yuTJ2n;ks56x>atuZw!I_e7`jJTbseXE+L#pOvgd&6IfOt;Osk0HPr~JkD%{(( zC>Uo)n7O%oaNmbj*TxnC;upFl4gvU=!2Rr2b0BA)$+m`1dqK8@B%d0vJUY|~Kn;qL z9ycHq-?#L#rG;9u?17u0JW!&9dg1r^b~p1`H&+FWPY@33;;Q!SN7EGws`zD`}`dYvk7s0-^rtZ})(Va-4x-y%Pb zTnQ=aosH=l^i7DLQQauROD{s@U0BZN5Sl3bTB2ReG^d<1_3R_>t-dhIz2_9s>WCpuYU2SQb zmln+V`o+^f!&2PIl?wly=fK7({E-pQSEC)ydhUPmMfrGVH~Jw}3xy?j4=V z7RIsXgIheHGtS1UGw-FNp!1=@Ihsu?Y$Mg{hHn?-#@T`lXLjwv@W92vm@MV%ivAaD z%u+OqAbKQk#!i{hHZ&$1-Bp`r-C{3aX;H%qw|yv%f0FIjts{?#ptuu4!~OVqf6l7& zHQ*s27%%|jQVVKEP(y>rCwI#|f4_;-&J?6tB$`@QqigWudlQcBIT#BH1fTqvx}i?w z4bV#)mamL086UL=Fs<@O9Rv#mLv`e1pAYtdPYm^*4;N0~OgbT_7M z@{F9R?n92H$tV^em&gOkQX*pw1|Nx(*;z3K1qtGFT8U>M8>+cBa)ro_>}i&GW?*ff zEwc(K&Ipa4w_K$-(mS2$=wKmwooyZ!5M;k+Yt)Wl{@Wddm-lp9yU zjowJ6Rn^`{mkRBA5FcHeeO5vePrQ3Xbz!}Bu&C%zd?hhqP}wmXoQ#7FzW|6(s`?O? z9neQGB}!9mPVrj8m82>ZOCqkPghpLxfpk;XRsNq;Kx;e-FkJh_1GMU&T~1HEx*h6tCn`~;EXS|DgC8OH^IIb z1};N-bZ!&J`n0s)rvksyVY}}i{Z5=bX$FBI4|+H1MYoZ&Sb80O3AgS79^i z5|=m9!!Mq2nN?l7$hL39E3<&;ysfYC7!a$D_*`wzd!&t$?P>?X8~PSZTfK!2vsipW zNicMJbGBVXlM61SLoJZAM&miks@cZ-6k^_#^+lx{vGd`MZpoMvzO9{0N4}TZeQ6|0 z-0Gz4Fz{DK6b6>rI#)^S=108qf2+H}a*t;s7gMkkDe0AxI$qUo?d#!7AF?|Xgvn!v zhE+SKd53fsJ%nOF(<6Dtdmv9Un$FcZ)`M~&ylv1?GDC-Z`18}qF?Zx{hP{iVrTenS zk}~sW)zKnYQ97sw%;hMMmIbQT`bpBV9;y{_F-ru;>+oi)f)nw3(GG-mg^XNCF!g}C zmOD*zgSAteZRMmMC`7aCqQg{aog2qN`?i{Cz0c(eTU0E7FHGz7yZiRbmyDIvW_`7H z#N9WeBF|w#9|1J*!8;8h$s!f8;OpzfaHwA3b1Jm>n|s1BJCf5=+V7dy`kJF4Itz-K zE;HiloVD(4Y$5+ZWN##ci}=7@V=%XUr!Hb#$G<|3F5|mgU0nH7gf7WaX;5F9HnhM@ zx9t##Q}$kV_%&;5n0bw80iG^pxRS?4=hQX z5mo!o5XNcswhQ__*^1BDQ6 zzGJCy%S15S<@fh+$|RB;h>fP}W?S<;S{IkDQb~AKO3TQ^&-f*r`2424*A>&1ywX=% zSlD;$hr<0o5LmF$$2SSe6VqC$sFPEcxFFa$WwW-Z+)Wf-vh6q?&lfPN-y9Pc$B6d9 zzh>>N*fwVw=sWSESvBcyYv-~EK`qk4;2EUKp4}%$?r7r zs9SiR3hvP1Zv$fFksTk?i?dCeXmO(PO+s0n)4Zbf*^jUf&VnK}~;V>bEZ%d`~4 zy=LCCa+z^-EqKs|Hu-3+_cT)grK}CPL4H>Bx#Gm;`7L)sW2{l)<`Q&iUM;m`;@SOI z8X3pj>jad0vq^~;=v7?$WKZJ^%*%N>>=?dJlVCk zy{ycwY%Gdtb+DVK?S&nGiq_=HL!|EK-FG;U>PdjP9IsY({~5)?4{x7xN;Bt zYch%3z$<$00=T=e1MhR*d(#P@p4;O02x_^a+Njh#N+Ql? zYo2?%2g4l9xpe%^``fJB!YG;bhNPp zb}Y$GAHIDPqxiJ&p*`Ujj&crh$JpTmr^z<%X$kIcRf}!x87eFD{qLBmaAGcZgr7nd zdOr=)H(YjFdJx&!x#wO1iT8d~>-JtLS;TrPc_#_$jg-q>y`y8j&4s9qckh1*2mG_d;&W62`h4H}o%l8EJE_CeZyc<%?OF{p7)Iiw zS-p$Pp7E(K4%Vj5c(YCl{jRXQK>_x6kUX-o@E|Gm{ckg0dQ&6GNUIq?4COa?=s6}g z-8qR8ul6(`B5m_SnF`+qJKuXA{H4FrgjTyvnQ|I@Gz*Qfxx7Kvd@Ra7tlX{4Vy@Dw zIc)nnr*=`27;*huFVskKcg^>Z9fopAlwZV;Id+5eUu7}Q3{v8|3$$#&u1sLX$ZJEU z&+zq-fuM3rw){?8tgF$6xQK|}yYttXLnZcdh#1Mk@O!UM#dFchwQhbawuQM@^|La#h6ZyV%bVq|RSx4cyZjz#8;!LM)ZwNgdKn+fN6oL5H6!xgTuS30{- zpT|UwoTu5U?MNnMCyBW$fQ|a;UgF)!vwa6ehc2a8CC)jB3KpIQC6HlT6srySiEV%h z9l=DxniOvqd=MDz_8rp^9+J}pu9glm6sJy)E{ioheT4U z>_4qe5^-*$p%=UMd((Myi3aK|XyXu%t@Wx@mE=Vvd{)tB9YjVlPhRKSk#SsQitUd) z;tws2fl_ErIQ^J8e06PF%mOe=ZX)#L7eTJu@xJY9D`+?X07WpfZbXGH*hu zv~dHeI7LxN>5}dqYJ+-%8gi zEK!b-SeN2Nu-{X1pB)Hi-pK08XO7l~*}}Kz*MkZIho6k-4~wj%o}N2V_rsWr8J*Af!Zo(15Rz_HrJu6yMbq8 z=UkV!D4t+1l=+AyxU4PCal2H0*JR57#wYA+%u;E zZl3UIFh`96dM@7HTz%rrm2=Qz$h~IzYHCr)#Myazqh~LDfN57Ipu_q3ejEF=dz^9q zLEI531dvBAwz81y`GXcNvuy?OCSZ6U#91I~W_VGW48F@t^jEO)DUx#|I8Jw8*MSy# z0$_}Xy1T#?_kF3n3$eV3`3e(jSYF6Pw|(0YO+54A1URN0C zu9<{WzPT*<0MP;L1DOCT++L+L5@~s_Ib_B3sM0~ra5XF97B86_p|9&zEI!#b7>y%| zwL2>0L!03i`>8&pvFh9burec~MCN@@Tr_3oGqrB?E?m?j$V4`Zg?f4o zTD@gT(<53IJOqDnk~a1cvQ% zgFrZ-?0_+VC-Hc9RZ18gHN@9~>6k8Q<_p-MJC6z>pE($s{JgQnozX@`ITct_Vbl^5x54>k9iUez} z1~9{EB&N=nRzo2&A6_@_Nid>nP%&wIt{0HjLmbqxlxnOUA6!W*$RkcEhG|~RKzCd< z4RIE9FP@sY66ic@EIwG@QmXZ;ht~5#!qP=_Y(W!#jN*nZ7k=5X6hqtrRCN!6BA}{& zLUc%Xg}ip}*0u9pQ1%_~In=lzJ8ERkXwmd#N!%i7zmU?0YsQW@;{UPsoncL2Ti42n z3WyDr5d|z1k*3n5qf(@+2uMfiU3v)tQBmo=L!$H^dM6;DbRsoCAb@lN1PKsGDBoe` zPP=z5@7(A4{FRU($vOM%v)fvWZ}K_T@$1l-$8+qCjjV&ISO=u*E?I}S>Ch%7aH_*C zme?WO%&gCi6AUUmOXOa!cog@|vTYfF?+=g&rZhUj474QFg<3@j`dT|!W|Y3udCXX&$C;_L-PaaKPw(EPlZ6TX^A z_rcFE3}^sG)bP%>%v1f}xb7>5D4l${xO$G_cRNcDe9_tHjA2UdLw?JXs@hTBqwo^&vvJV^Itt->V$JVQSO>aG2 zx)<3>E_p8d)kWfJ%>2UZG2Lb_wOO3W;J4XC;qqCPh(3#klB2Xd0_fhR1#B7U^2w4D zb}+j86YbxsXGgK`zL#=chmjKZ+(yhTz+9W7GA4}>gl=n(j;XEGwv6i{nrXb2hIXcU zdd)i~gQoR<6K*!FMitec>d%baOP?b=5+ZLUPg^hEH}oyh%SNVcZDFCYr%MIojleoBuMVS zD8^@mez3r~rbCBRfS!U1SUJU*(i#xkr=XR*&BuT3jI=NT6|Q`H!=>08`y_ITmGyV* zy?oBhnl(c&a6B1wABA9A7d9pApqn=p6_oVdG;k06&qrM4mAI}->)F8a$Vpsoa?R<- zY@rdh(r{HmoHviSJS?Y=L4Wahqk$NUO0^;t-M7e5(2U)z#(>5>ip37m7JzNeiF%5h+IE15i$5fJU({i;>q9nM$45y4y?p6W%4DEpg-bZRUvg~ z%SX+i57}{xQ$0I&W@4cRk1f{pzrb-b{vqn*D|sB{+Rlr~bnfImwA#>uW<*Pxi6|(K zERO7}c|WLSyQs9pu-~z$1$dACo9bW`IJ7U`w1Q{%+ts0R-hq)AHhRuWOl%hNRWWo% zjDwzw1p$pL;Dj0FzZBqRJl_byTT{j%l; zG!@~uL!L}^m{u6TUkf1F#wN4zEWf&Z*X>(P^tEf*=~g^XbldPJLl{MQs$KD6Mbiyw zN)}^?A5Bft7TtH;qedQIHwfd*H=iKrJHgiCO&Sz3JUS!k@4DU6e=+$z)uYr>g3c>l zOfFEBzdlpZRa{Ro_E65p57 z-kVY*`oG|AB-M@#c&4x0Zq_xFC{SvM&WIPx@a4It*e8(etagkNB3rwAJ!prg#SiP_ z-R-)HUNmj%-{3q)zzW0?YlO_SZoilj|I5=Chl=js#_PRtSKUiw6j=?)#jJg5VtTe{ z?=b(Z3gAyAvL0=0C%<3{+Wz>;o%lw+#rG<3wy&1i^;WAdO2&P-%yg6hYaG`aVFd9I zjY1;aRTa!fRhwH}`TEPihu!BstHrzGK{EMI3-2!k5uVw2d?$O3#((AZFo?&XFGl`f z8o|F+c8sfE9d%A+w}*>=3};nTV8n5zBpe;;%cDzL?gh-=*GesA)5v1tSNTgKx7xn7 zT8PO_ z5D3f3X+A&C#(-%@B&8bSstT_&vtDY<5wEOEj{|;NlYda{of7rwOel+m*mfspy?y(3 zs+v6eZbxUl-sh*Y%*?#%*-yhj|IwXs5ujcHN%&{#K5kBiTX3whW@vCwP?W=To8Qrt z^fCa9>LaC|Jm6*%qddu|#eO@Xxn;M)mnkYuu|EtT$rOAY^2Gj~mu58_@M={`>Hs7v z%S!u>h2fEZ(!%-IcYWnel{;3@eIip2le2AQ7|1q8WBvsBI7PM-!bf2Bldv7%@qZZ!t7$`?qUcys$7 z?A9M|*$k1&2wpPjcyG7gE!r`A6v#40!@|niy7^;Lc~!!0zZnz(HZ6V%3UI!WA3hw9 zcx$)5(7)O(H^98OlMsr+RBF4-bX>eBWSiL3)bt@g^zy}v9KJO4f@sKWlIv7U*!8X~ z085>Jbx<4SVMP4|2!bd4cL7R}2qFpJX#Z$aTK%wq6y~e$20&)yLu@h+hsBSmmVXVp z)V@?cX1g&tIcd`L;Y<-=q}!*6<+mB`i-eFj8c#_+1dVu5ao&e0DX${If6$uwIE96W zMex*tAEZ=OLt{O>3%aBX?4bUPdCi_~{zwOn<^8oiJ2jru^ z+cO>L>;BU%8Q0a%_hw8_hDZuBuFrKp0NvDu?s)(yP|^aBf^%HYzU3hSf%J?USZ3Sl z{A1vfj|TT?#GwM&AclPPC!jFvn7a;&h+&JCxB-rXdcEW7hJ+1XV{G_)W4lGM5K@b! zUYdL3p8OXF%|H9uf1NO?0jeW@kVx$Ty*SQ;O9X!$$=@HvU5LG7;?Kgu(h{Yq&%qIa z8=@bp^R62LGxV?Zro^JTbp{r#D3Czv)q`cTw{39nSuYzGm(uIkuRD-Cd0@YuBui8A z9c658jbJZM%Nu15`L`AS^V4yTmn_dCK*Rnzgt#~VSS#B&a({yUW|ZCJW4Yh>7k>X} zTHGHC&4E|7RL_6^pWE^K+y49qemkLB*9t)FqgD9A*ZeFJj9qTk%=KmY7(QtFlXWtKxb9h&ONHw~SzF*t9NkrQ@tyZN^)w6(fE8VTsQY zwyLvwb%U!hhX}B`84OZqW;D9RAfyAb8*fLpT{m-0g6ur_0ggv?Z1W-d7CZq7C8CS$ zF>biM{9yMEC+X>~v*){&{m=0*zuXH+8k-$8Dk8`OD6=ZtaJ$XIY_;vS?N=I=L-g}C z^gOzEU*SV_9{h4puiT>KPk(*H%SX6;xv*$oj^6T9RDu#tbe*3p95o2%dQbh)=U-nmUj`t#!B6sn*=8$jV^0mEt|~8;ZOg zU$!;sVRqzhyJKzjMNg$>b@uK?9`Vv@TOiUKVRyXzi%edL;K3eW(5^$?K)BYyVAhus zcf0F$Arc%M92nAg!!CP$4S6has_8>4G4atxokXnbUP46T&u9FS9PSV8ky;Q0uf-iE%xRxp#W&4C@(NZl#l5k`=+F(}v+sy4+Vq;B)CfCbh4BlwNXnf?N zYk2&tuJZCR#|)Q~&i}Haab^mZ6+(!+;kmyvs{?*Ee(e^(YDe5ffQoXm_lFvw0-0Lb4VdZDptqRUq0Y7G)-P49x zLbF&#jiNF(!=MJM)^=p$HiB3W8|z!|I&>3 z%FNn**Hp=BT-_3Abhhjb=^f{MwLqAxu^R)-Qp1A!U5Uyov8~xrwxO9HmY4rSV^4*LfqKdt3%b5wgjP}PY&KM$llcg{HdZ}!yO6{ozAMx51;tl*~ zx@5mi*!g(!o~EZaI}y#Lbq%zq6Mz&82Z(wS-oASm4<%nlmw|Te?f0bSTx9s;A*w?F z?KtO=J*29j;1IrUAsIg>Tb^rc#S`y4wmcv%R`xGW{e_36)yObF?I(6 zEAnu1dBL9KYJiW^8f8bfLl4i06KAgo$r`e+Os>N&kt)&b2;xXF@jYxk?$@Caz`3{uW*smxQUEM=iQgNJ@-3LIfT1_qO@*av?SmvC7PCupLM7SBmEl zY|hCZ3e(g}Vha?7S0p27JS~jo}hA{venoR zyw0qc4ML|gULXn7*?{_ofJ}1;bIec2PCf({+iTpLuH41k7|m;-fB*jdqO`o;s|R$h zr__A%L^FVP^w-vTzW3rsvNdbvldaZ5U&wH}{V|aB+Xt0Wp`Lqf0gk@BJ?S42`1}#D z`|wlgLY7MPF(8^!by*(a01f!4xjFM*Svs6WkA!kPnC82zmT~_5Nycy>jTagP$~p(2@grK8K< zuo_TWe?ddf6A2DudnsBU*A4ERhc`9zt&w6k)y^4fV$O}e{P34`_&v@5t0X0L{IX=F z=75c-fy>g)mr1Yt_irjDwUARS(^UQ-QTqMY$5kmPsn1>UflDeMH#$&8_&>jn&m#T5 zirb1n;;C*A)&F3|_$m-~RC`&_j1wjN`!xL0Otrm)Czb?^j@C6)EsG%2$|35bc(BZZA9y1>Oddj$Yd7deSQzJF8FW(*hG{-aL z@76=WhsCNMT)S4qU)}zHF31XkZ)6E05&TZ~VLUNS1o? z;u_WV>i4GGrvKxaIdEqj)W-Yf-+&6w{(3Nrzk8heGPW;oNHJS|e(`UTOn0p-6;gnY zbanN}9hd*FpF`Uajnz6^?4Ed86xp7F%Z?gW>|AhF%sLzPH)l3H3EvdV?{QzPeZUEjlAw`xe>XbZoBa}ced1-Jqw%UL6 z2mb3{{_6{&Q4|@d%VEw55}`Jtb;JtmiTj_PWSFXEJuVISyU&p<_0k65 zPaU*VExGl}&^iThSXiz;PiRiNscC+_8E^nb4K9N=t1 z&-j1;Z>&Twg2r}e+H4*KKN)ce+pLr zkz87L$f7C7064uss)IyZWV$ZtFm71$H1mKSC;>8wF;2m;Hvs zG=kZz*DGojrV){IEfCfcyfFvHjZji_CQZ1 z!MUptrvelaS6AB+?L&^U#^VtoiU263my@&;!LHg0u)-1hsBxKq@McYfK4axXl}b;R z+A*q=8xj(;6#6d6-5E%nkhc#%n9yG);TiR{H+ek3uuzetpo(qX(uK+z8NM;vodULE z$LKJf9>Y&)IV3A&V>!as)#*IcHqA`bVJcH>?|b`9Bp?wA1rzJ;iO81|XSb|AU(+hH z_O%`>R0Nc39UV4cSS3|yzK3ZEz&@Avw%hGyDoY)vEdi(q!Ee*^kU;2YsA2`Dtfb*ZvnF2Uep#JmB zqPxbA-};$BeqmrE;I!yTwb=XisqxPG`}v}gRRg4FT3_a4WuEHXPfq5prF}q!T^aq2 z7(oSxJ`ewR(*4Ip`0W0Gny1jZ9DH5-liyRdYT0adHNU?e@_%zzhC5xG6`&R916Xl` z-phV^&6=vx2|IhyKH<+6QwJ;tkT%J}Qh-e0XgnIzcAi@&wqmM8_W|azr2YMOCm4AEu|(uGUz+xUPbhgG3d+P@KzLz$ zLEVM=$x!8hzrcXo7pXyj{g)r7KTg*w{*U~d)G}4B9{r>f(yKB31pA7p8Rc+bL3j>8 zJoi_^mX*l%@3u%71xvw?-UgiV`UN_*OxxS-)a$9-@JdEep?ec|jGBWL_rUbt6VBTSxH98bhi-&LuUQM2!ii|`rLNR4cyJi5NN9$+LqkoOiD}mz2Sj|$QeOEOy>e_OCMpkc+9DpwnIr-o?udfz z1JXhwBpD^;v5ewh^E|r}C8g_tHH*3vm%@@!jggoilg%bA1!urGw&O_l%&vs$niYVK zO}`;xLAmT^Wk2Q^>9WV7-@Rls6%|!sz$jA;kKP2}01?d7G2oea{`|?EpHQOZG_zqp zL6hoMzH_cN!wI9ZV&w8MnL6b5!X=|cZjKZT70)p;V9|O2h228jt9Ao?BFP4TX6kB+ zEb^MBZg)feDyhPqpy8f8)|=Ip1pVIDZTN!n^2hy(ShxZ}!X62*9=ey?kXw*NBX8WWar1z0rt}_EC~WC&ZRFr;Kdi_ z^=ztsT*!%w-USfY>meJAhA#+<8!n#kuf`HRvp)R1RpPcIZsnUQL9Q;!N~0L-K7p}F3~JZT37wpBj|=H>9bfU6@kxTVUqS~)p){DK{r6jvYhM}M&n1$koIdn1Xk&CLh4&K#%s2WKYaNO4WN z+OFPsh>YgMNU90wq9YCtD)V(iuQ5*jLSpC=pzowTN}sN z<&EN1l+02PY^wHv)rCMzzl4bS{^f!3dc3z%C7br*P<4pXmT9tFc=Kn}N&B6DTo8d}Q~&YbQwoe0^VXRLIH;xZ^~^Em14`MH}%x1_10`-q(+ zYFi%=?Yez-q{zA_$+?xDluFpZR6X-sk5`=k_DHMLBX90zH;HMr{ta|Gp%w0~d^W!4 z`&6r%1E9x9`dEEz4-vy}>6W$cVA)hiPXOAGErfW+kgWQOn%ph z8UDOH3Q=|joJOf?%_sE}F7PBGk0k5!-oN@E*0(JQAs%LyDc!K&mcROm^6Zs9r|irt zwQr~|ocsJ*|1Iau@ls8$!D_5#{&^Xh&;IAz)uo&AH7O6zv!3>lzt3>>QyP+xc(>8k zMNR(7v=AI+YNismDqfu+rLy}c#HAEBT}!LDIVG_(lp7FXxx?LPU!Q;+X)&gg0Th693|KdymC+CGg5@QB2wN~TW2$)(7ew@KkiD`|Ze z_OK&OBa7WL=G5BdwyeYv@hx+g=WH0y&F&0S=Ie5>>qIQHdUJC#b_q}^Jv21@==tM| zShpZuevJ}n%qC5yrKStxu6K#+43`Gjmj&ol&J62}Eaz(JVnAYW+BR7z%&+hW`$nxk9ho$v$VH-tl5Vi;?AEjN;#5Iul6HzDeU_2CJyg4M-fOql~ zaWZG$t0J+{eJ_9hATbjnAAr>wMj9%sJlB(6t=vL7*5xv{^GByyNuBsi1+( zaLoD7Rm2;JLxgSV*jY`iCaQ3$Sxjmf9+IrxBGRcU2|(9pT0#H$<;G-{!*JFcT_N#-F;A;9HI0aw z-L0)Hy7AdSF3x{uMK+Wt^AfIALTK0$&$*r%@-tAtPPk=38tMY9G}1+AujmxMh??hf zn#(d-uoBvJSO(cx*+pmK|2CPm9-r_2$j{ z3upv;hLbqJg3hsPDpi!V@GzscM*4y-LHu;w;G+}3!4)oVR}NU`>sD$XJ-KM6DU1RD z%E;;Hh<9FqxcngkHp(I<){(_)YcicJko@@tgqW@1-Vss8Amm@tACFyz3*V0%3jR3$^tv_5EBzVssJ8U&{l2g}uwCY)J z^Vpa{L&Na1=7srERrltO^}#f8IjFMJl0*3U#leBMu+hD7qar9-1+C|vYi2gv0{7+# zv%$Ew0Fw`JamjWwr4y5q?r{M-7G|&_VQW{F; zb8{9p+l&J{Q#%PJDOx%K|DLOgdwpOfQm7%1_@=h6_^U!Q&z)=cNkqI2_IijI$=k&_ z425w$7x+9Nx--D~0p)*qW@(?F(!K*#4D;O=?DlMVzC9}~-t_@ANk+B;lgFRaa0D>_7 z2uvb+KGC?gdlT=?b>~!)&ZX0*KdLhYVEZtzOCH2X%+&5NCW5)zlY6qV=`~vekn|yw zz021{>I%}i+}$gWZ1zWfo)Y;Z)A{d@GV>@rs2=+0%~2dQMMK3FX#N z)p+RO;v~x9=w|2MjA*X`o=dCT_G9ywdE5Z>$22<4FSllJsG5Q4+1d79loDN1i<(>I(!eEZ`brx!)8+Ez zHDMWzXP;i>2Vh$XaT)NJ+zvYEYOgMjNk(_z+(z1#f~@jkSAb9Mz&b&80o(IboSA_W zXKzqws9_wb&!}g5if(kFZ`s!Z(Ncq;uZY6EgUv>$irv^DZMft((ynl}#}0{dvi7qLrwOtaB#=|%wM%xyH785U5PHwy=MjWO0&{-v{DiB4I9u&Yo6bjRIL-i<#Y0x)!Mw?Tf9TN*884EQ&%Ei}i{E+J^db!G2qZL^|K29-O~EI3CrYd= zC|4?jlNdAS_*aUO;glPr5P=U7lm`_Vq&{v__{r}@400EjGL90;=qtm zr=^oqYLo5Yjk=w(M}SX&V`9Q4)eN=Vv-MVG;K(KKYWFy}>+-M-X-=Avc0sX>?I^bn z@(Gx0x$5KN)03m=D*UBt(rm|Ly=Ixb6b}E~cM5?x;tEXy*_|o(+KhHjs<1;l8mz({V_6*$SQ98Nx(xNr056B|$Z;uD^ z0|b0*BJdSxoc{d;fv5mEIKEVcX8mM#yJqg4bpZ6@E=nq=hKl2d&)a1mUBgf2$rqZu z$$ME}W|J~qK1Q>VGMVif)t@FuRP$fb(YYxgg<>Lnmw00xGBsrkQTKR;KVui*CAhXc z`oOE`^?ALYIBQF}m4{&B@+y3il9GhDB8y&A$JsIcT90S0j1pR}Un?*hE-VI~Kd7Yo z@dDM=E%J9nl)&MKt5_H{a6$et(Pz&Wc|xM>=mq^Fl3PWVT{JU$GZp$XeIl?Y|B zhVP*|pad-H8e`p)Dj$Y6LNnfdDOI96TIG{&8p~htf@f#&n1jjtx5_7*A{v81|ep2#d zhjwnXV*QvaZlqRJ-?nO6g-&p8xLMyD_(7$gKiNude-n4u&}vNdyYJ1Te^Y40t$MU? zNvjcSTC?$v;}U;Co!IW+Pr?1Qu47lxx~>7arEF)ppRK&nc?FLib=^xzAN$~liso<~ zwQTrYBGuT)rc{L$t6T4asJt3;)mRxi%lY9^3@$&3MdWh}8jZHLf}gq0dmG1af0kif z6MLHzB^*z8V>(83xoS)|MUeNhNanpjUL=1?B*ejPW0ez;fUZDZ5KtrsGHRjrBmG#$;xuUv&#ZQMTc<2txm|n zvGswcmt z75)0J+`V3mRz$mdc8a3TW&j$NAO3~E#LGD z_KyT=$?j$w?@dqUVV{z>AJ2Mx=}Dl#)oAK1*OFbj6PBaRwpLP5iCf)9ytNf#)tNoe zK44lm#ibK39~f`^RscK49$H;~MJ%sEP^Ov}mPA*ZizF#L>n`Bc)5z6bdP@Wd zVk|Wd_uLo16bkp=>g+S{o-~g8(MB-s3E?O}Zf_D0rUD`&Pi&F%+T{fZzzp09C1N@D zs)ix4!$LGjJ}B>9@3$u;$tNH&GnM7ei&ls@7KRg=ZeUI&%9F5ewu-^iOt1AG1xeGe z%7asK!9UxwG3RO5Y5?b$S6}QL~pjWum?Z96gy|rsU+l7DgVSI996E zNJY=1y?Eq;rIy77@mXQ`Hk!Y7{#}mZi4VQsT2XtVXd5(IpYO5d_bKl30I_$MNFrqh ziW|?@ciaK;W-#H41UoBh0_g&`|EZ^aR9;ncRygyRCTSvc4x%dgV4&Id*1eFby=GYK zO=n!c0KPp%oN4EvhMQ0PwNN;m9Vb+K&0c4WP{CqQcWC}+zQ@Bd!Gu2*<1-)nq{QX8 z@6 zK|-;qN=)eZYhkbasEZdbuJ(;B@iI$l442#CwDlI&q2xPLdYoL3=##vMQ{^9Kku@^j z9obaR=>D#I&?o;r2&q@Tf`3_qanTYCPPelNCbXo0(&8z`)nWcySEQIcR&3Q`B9fL$ zeh_&{JW=`1!otETa18s{4WnKAu&Jq;4@WVT*!d^;SMIo}YF2I=gxD57!-N!oy1S!L z4LTqT18WoSm+fhCFoljWN>vL-9RsVEy&lb=$WJ{zsqg<7$k#F>1taG?yQ%K^#;8@n zxXzq;u5o%?rTk{np;Xtwei^cdj%<)vv(+njS^s#!nOWG<0Jo&10l%9yIry~^aN70M z-`gWUe!S9a3(}|=E%wWm48x+2F+^;Vg`EiMaoCyUQ)pHpAx)QO&5vF6T(o8L72TV2 zYi8#>7Lx~rY)7V^THK8qmG1FUWd7E>cK%zt^bR@Z9(0D;Y;kqf3nUcH+|DMqjvhcPZ6+fkwQ)l}2{e z^9S!AV#>P1Eul>7bN2oOWPg{RAH+C${bFi_+WPtc!j89`^n~%1>_I856z#deh@wY= z)^V&B5E|R5X%D|o$`G9iC>=}c5BdBrxxXjyQP*DbJFf3{1_5vCn_SwC?M0vN0 z;`y><=Z&7eX_d%4?b35lH=Uy=<~Yk$k@CBQH5xWIbl;@BoD0#t$+#rF5_Wp|Yu8XFUx z(dTO~nE{@c0RDkn2)y^E*1)r?uW?2~ZkHbrO-x8}tfHcF8VH`vl&IL)xz`PMJcC9H z9(!#~3u)DPrOZ_^Rac~m8M&0qJ{#FGPlA>6=v6099k~@x5yJ~YR^2jxgV7R;fDs4W zx!z15^0vCtNc5nU<*JF{aK+vveXB;;4pk{*-6r+6c0yzZtlZ+Krl%7M+8UsPJPGwF zr^eVxgVjQMf_6hU5h%}gPYLsu3^)Q2SkiDiKqp?n$~2o!(JcvcI2sVZ^V+(mW%qvU zgATmU@YPUW+;{!3io9ZR9&|I>K%_M3 zhRyX|ttmXExXAD1YsdQxLFfj`ftfKvgl+%uGknb;e3Kzx#>aygdHO9;4^#tm-9A6G zvUP|RFnfuJ3(5MNCSvB|@7%kLHh^@;Y1VjdDQqngDreUAeSVe>n(%crtx_-vpDT2J zK*laRPiQ(ni{`MGfU|KW&p)vwOP^PEqZ;9^FU>0RpOQ6Z96-LTbUd!yXp=;``-MTt zgg48A($%4~To0~?(yhBHH^=F{WRSnc65FYsdpoL3%Ga+^zdk1Ltspm`{5B_EIC^6c z5>DNr_Y*4(F%M^wOI_Z*w7Geta`_#mV=!~8S5=Z@9oJ77C}}B@4SKBdWo2}D68WuIp&5N2Q`BGWv_6U zgf-dj`x&%bqN8~)3{;TA-||be{%IuS;~h#+=PSxD7dB!giuAm8_mbnHMgXfRc=%b6 z004MTi9LaVC){yM#10c(_b+!VH{#{HSm%R^^4*oqgW{vLwz_L?M;6;;yJCFaKJLz3bu#>(cO-3K#nUHMQPEXNXK=g_H2h z@mJ=xDhxMk%wNV@J^ZLw=QMwZy+-w?+OGzJ8vD7PwvH{swQ~DOwu`PqVN~+N07!iD zO5aNT+}uNm>lcZ-ovvdlza*rcP3fRnE8l*BTd8HF*-;_}1OdoFs9VmOpy{-@oE@2{ zaeCIc~RAT-L&cM!|@eJ>m{D62rfiVm7Gd(+_XbEx9)yoUX zrBl`uS?zVfjX$^k^<3sdaF*y4wGLW)pWzz?w!JxL%cmJb6p269BTjbHIK#P;;O+&xDUh;HI$Iff=K8z+ z!|HMUWfFU}NxPuq18dq9vgv1{>26XPrpl&zL}ber%@YnoqK1$=U1aH5Mtz4LluSaH ze)K@D5cRH}$Cv3z|JuV9#f_F#-*Gs_R|W!%qAHhuyP*Csn7?_%PZQ z%n%fO?d|0#hExh(FSb=VNqmavHR+6Z?#WP9HN)t4hl6=cC5J@nreFqb-2BWa; zx!-E;3NQ8DOCMSPgfXk*$3`b8Ji5qPqsK74eLOpbLwaXgLy?=Y89a3y2 zFO?)>+X;Y7OJ#YNJo4FfX7di4a^@0#xXgYNYrhLM_v499_g^GC32(7nbcYdJUmW&1+-2{%&#J!KbgY~RWHB{dqY{)Tt zvyotE;(TV^uX0`m^kPM#*B>;+6ThX~8(p*>t$Asjaow>rds`-Q;z-jNImKm60kg_f3%63sM=UbZfei6{V5NH`=Z8f&+=`;!VC`Q4<-y-!iT zG&D0^Fu^8A{S`7EWv`73^0iw1Zq-?8ENi9A^gREc3|0Ct@Qh#T)7sVvyg^X6WM0xy zkM5=qzLOCiU8afLT;&YuB{?jMb&Kc$daZod0#H}DhunMtt06BR8_@0Y- z&*@CaJRpiVTif}=AzoF+CT8@u*NVr;-%^xl7UiY)ub|+%I-N`6Xv(qOaScBX%3286j)%gn%#Y2)_B{1I&{3#Q=?3p2!=Gjy*JwUJKnS7jt9u=6rSIBNFPF$?3Jz9Mpi+Fc;0Y^-m=VO_) zLp9hSNtQ?se*iXJDG>C{8REG&{_%WE=2t#_NF$D{T#ZW7G0eqRe=}7M7&VfTdZjCp zZunv}QFRyh1KZWw8m3iDz5Fr9XdtDTi{t{e&^?S8+P7l5np|NUVMt-#Da*Zkg25>OUU7#=5g2j_+%s<5NTt{8vS;wJ; za3qty7RN+T{qcSZO1>PG18>jMZpQC*x+bHw`y95WCzYa@CgpQR)0K5PHV$(JE^g85 zyX5D*+=GczHykYo?7+TPyZ9~)%d#I8-|67rS|-D(U2kLP_4pM)2Uxj&DAjw^FkhK- z&5fZ+Xz7cla<$_-I0tC%#;yDOM2edQfyeb6bS@pOQeS92qo_+;XZZ*i&0>ioH5jys znobKhH#GBDir&clqzi7FbW%!)B;RwW`~b^yy|u~;TsO{Z?i0H)2+)+s7~9%=@mg13 zG7LZ4ECg4ug^@RqoPAoHeK<QYIAGvaTuvo+}-Ib?!w^$pJ!l3-FV*A z7t~2!cj_5+7E+4lo%P}dIb-0DG8@sUFu6TdWIQowX!6^qjH)H~{PVEQZ;h&LpdIbN z$t0Us-^Fzpb^K-fC6Botm7w;Re3ys{> znt|5VACX{VSqux2*zHS95u6*TjF6U-)3V|^FemN2@K9doW*v8>ilDVu?yx-U!m?Ac&=@Q7#XQ&b&g3tq*;eNDdmWno9C9v@1z$(biPN7)_+ zY9T5a8~yGHW9SO|>+{{U2xOO5>Kzp%(AfC+ZNIExJ{;M`Fj}mYvRm7b` zl`3(9=xbD`PJvnvF;mx$(l$@88cS_nJ#>U*F&9&7ehUrslT1Ms<3V1l#9q~cLfntx zOKiGIKYiuD{B1dh$;-=2jz$qyT3QDT$h(&E`5^RP@>tufBoJ|Ps*8GeZB8go<*iXCq4w;DAaSduHPSL7((d$5)_o^DG)k98Sh4a zu%JvQ9x@e1?&z#?&i~kTsZVY~W_D6SeEl}nNn72DY+VcoN7m|wC_VuR`klEA8#?(B z!m>$DCyVj7MJ~Mmhj^Hq>QeY`I`~w2=?5fFoUh;JX54$b(OX%)t72JJ{T2!S`c4$G zGF%K@8>B#snfz>#+h6sa^zbFw&co>|Pcnk*MqE*h4&FsQU)+b<4ri4e7|8+z-y zwRw)wa@vD-cNdG8&6ba8Z|{Ylr|ojofgY1d;$q{WJgHQpbMWDSD1MqC|>G{ooEW9I;=grZLa@WbX z#QCIq@RwBgxI8-mSyfx0CXBw8O>c2>UgA9nNU>0|0M#k0$wke^SuDgg-6(l!NkVAU zEr>4u=hLUh*Se!pE*2NTQZPPwK@GFtwGm9JV!N;0Ylo&?RzAI}9(8Wcb1B@ctWj}r zbWB%hY`IR+wsK2^&fg*iM<}bq&v||KW3RZ7uzvU_Qk&Jl zY&f)BzuL!3b`EI^_e@!T|D07-wRo(~$7dN&2l3t@tQ4a{FCvgvHWNr34t13 zfbQj)xp+_tl4(ydf3e+oegRYSjwnDYEJGr?-4oG1?Ddw|U-4=7^)FeN;I zXSj>F#YdMcnM538#oWF=DldB5p;W#UU-o(5VCSvk-My9_&(PGNK#zkAj2C%yTW^LH zIF3E&YxF*lkcy{p)&q) z{Zv?D;$=dkraawp0Opi)zuZ1dJv=JPWcMY@ty=}8#JgtNwug7#Fzq~G+i460qgPQ7 zNvB+W3Q+5wdAoHzenG%i&auo>Rg$50VJHSa-|sjQJd?Wx^WyjDFXx5h`&}2?ATyrG z7|ndrM(DM+R#LQ5{wbe{@yo9GJ0z0XREuMvV zxKC%x)@^Tl%0GO_&)%D@-hL;k?=a46^X;bee&~GurKWJ5UGLZuAdgklF1IwHG!@|L z-sx*sP;kJ0lo>WSL5K;5iGv<9^T?VzEDp zC1G+iW9ORH_BI(4_Bh47Hkt`7f#e^3l3vXN-WVKefOO13W~X|5Gl@|ypX)FdAH}Lu zN^HmbW^Zgh9T>X3{Oj`y&7~h%xy42!oQh?Z_!!|s>JZPHxW$1lwQQiPvRXwxd0X>g zb>@%nvpUB$0tS+gtTFyIK-SrfBL32bs(kuO?JtWJ-nbgVGAOA5aI+~4v ztG~+mM}+S>ePWzOl|9gC(`7S^W>WU%fJH{Kd>WWq5BIvQuVtg?T~_kXI@KxXzrD&R zI!YXB?t57s8+!v%`~)D{$)Yai2I){-;xXFSoTy|1ABaENN7R2hA?m#FXvS;!Q=Id$ zC(uY2i;;>jkeN622)bJBw|Q~GRg5KXX=|y}Bd&H~UHGF)l0&Ur?Q-rpUy^(Br^JJUKxKLm1oB)e>j>Mq%3)xq{y~c|zVE8Sk9?RbAKW7MolR-iRG-t6dU~ulw zjxyAdCSLHaw7f<4FX!ED`b`Wxj9yY~x82nSQvs2H+yZrEv(kkTkhPzq5Di1U~j7KW$LC>GA+(=zRr~FO9 z|A3k*y>CcJ=bjM(eFj#B;nvsxHGtfI;iWZDh;r|JOPrpacE4N!U7PNa@Tl3`I{GI< zm}Y&$B^Zkq>@+XucRFcwh^cVKgDu-<9{kOzy!-8Asr9plUSmI)5j8cQKg4%49z(mX zu(HaetHNy?$WBiz%WX%MKEm`rqYb>d_jR*)fE>+ZQxwdmfxH$xH8C;4_6sf39jgH@ z_E6OPBXiL4&@t^w(N7}U6ciL4yZV4bd8phD-kVZ1EON~7z*@^+t7Vo^ z_3wi0XFT4+mc7(^wSDWq9LTHQeD4Z3G>U5*cfoITt?JxKyw%9uk$Lov)_mW_%?5IC zU^)Se$LxS;!V=R1M>L zlX7jeZSdC*_Oaj)flM86nQX(13*BwrE$AnHFo3Q{QDLos&h9=9!FRmDFN6bHMaF)B zWct)Tn7(%g5IX_!P#_{-ITfzh;Ss<72HlsXWs#bT6#gF{hAlBnj_U`8vFrUvGkYVaNX$lBky0I2^-pX1l^YGyZu z8C*cggSgBA@Y#9Y=+-X>0?5?&DZ$EFLFJ3Hf)_nma!uQS#pXJ1%sblnKaGqv%Nn}M zzT*l}4V|ubZC`zRL^w7{ZP5qn2{nEs{q}^ve>igDxeCTn)Fslru&}6M_GYiGGLTge)#C5B@J|jKAAGIIjZCGR^u|bH- zQGh{dJ{=rL#V1dmG@;R&JT)u#)zS^_-@k9%5_)wNa5A+4mX!e7m0l?+J=qW@V6jf4 zC=_bZ4*X9=9_yCfQj**`xn&+o7ygH}gHlWkq}oFZ{v)IN%SnBTl+q?y(v8GK77b1s zD!*3c{|u#FfN^;tn|^XT^sio+6e~?CkYc}2)@W)@_=YTb^Ik#h1xhea*?ep~^Wl&3 zRWoW{#(06Klbs~Rcju31Dn5GjXoAi9*GBB4RA7Vtsluk`x7^*2Y({D5{Ium{(VgrI z_)ru;eVv7!T@f%=q=I3JeIZ~oO+P=s{W|Y3_naz?sMDMw#WrBcm@nb235UUW+y}VU*mC~=`HI(w-FdwJe7)VrP4U@L)_P}pQH?PmavO83{m_DJiRahb zAKZCvBrV437Acmyr7LWkA{5bn^}BpZQi#!e=sV%|&KGt-5j%9%?sxKyeiITAcLd&l z8kH&oQPZYbO9BdcyPHUJt{a*snZz8g(3`jhC;NU2{rJYgSbKUs%dp(qT2+DI?(Qy4 zzF#5C!_!e=*PjV`pY3=r(yO$zGzl|n>yHZn26>``4s&*3i?I3UC*@yb*nbW-g2U+U zs+#j1<~5m)lQQ1S=O+v$?`XdL`Vp$0vTrJR@>gHiohbiwaAnS_np9&e5jd|-LyTG8q(Nl)@Ax(g}ej9h{15R8{4nF4ASGmi3hE4YB=;-MEYz-Ff zoQl|}!R;<2p*m0#Paufn2#i6WOw!M_cX!|Z5KFx#(-=!r<5de<1E@tWVPi}j?f)eJ zhJ?9c@Qqt#>PO2HHHTlQO&9F^~fAb49ba6@s zLicw*#$SUGI*P%Kq~VSiJ>{H2J7*#WPC5_XldMYN>`B`C6MKkPkG;3^reT8C*|BOz zpMX#)m!E%T2kEYG8g@k@R}p`HeBiemZ(k+vtRX-an8ot#M*~ijcAvWo7?ncfj9g-# z3tC`^7c@~7bP#AanDZ{Tym`|k;$aBM&JYA5llNI=;tM66E7)7Yg= zCQ+Ei?ZH2UDgN^s{YRf`pV9Qu38%UeYZ#g2@pX3H;$qv~kOjWXa5?cMeAD}1-b(O^ z^CL0uIJyc;VDsOHn@`}RqD|k9-XFy71wad$Wcextc~$&FDtYo4=6}0bCn*C8S0oOM zd?)AY=H9+NJD{1ix+V)zdN+K=cNsRgD^zNA=ws!n@bIe7q>C*GWOd8d_20t%7eVuUK7Qf zmadOh*hP(I?{k=f`bs@LK~K-q81tB};?{x@<;}8R<;ecQdHOH^Bu(j;pY zjb5?{{G0Ha+mg4M;OU1CmaaOP z*H0b4QYu69>yJwJJ_%9~pvaHK$phD=%S}WwzAhriDnjlcnnU5m4O5`$XFF_MVf%3G zFq?5zXew+55*N88_BIC8_of;lU!2E5k(mvDv7VKcb!fpueQ@%`iAbOZHCk#B(w!ip zR0QT+17h6VN@zry%W%E-DzD_@n4w__3BCXFcK=&e`}1{F;Rh$=o)}7U}x*%He2f;5@kRhraS z^lJn{oCiWiUzW5YvO`=hz6_*K0ZAToOz8KGU~|^V`-2lg0>hjjzPbC4p$1h;}Vh0!*aRZIVLyz=!ZB3cWLPA35ct-M( zl7|Wm67HFkjs5>))AHY*WBTo2eks}55fGcDq?$9FJX^l>a}ZBZ=M0SeL4&zc|04@Z zbC~J1aJLgP=g#|l70!82J4R2(Z1M=g_*AWTChFuD7_%-dQd> zHmnc_qDSrSde>!X>4`;2*J=4fr_KPvq>nR4(7SiGms&6Ver#=)vC;Vbsh*aB zwCS5eE5WMq4x zse(`07^n$f1QN!4TRNV-hn3}Zppz945D@0HTqrCqj%3!v94GGV_&I!w2Dky{$S)1i z@1OCX^1O~8I6P>B8E82tA0(}<_Re#2%jX1Bj$ks5KXhckzL|GsHfSv9^lVXO&nP-N zJNT3XE5M zsWPpwedh?|)__VJwoilmG_YVFla}T^NvESXekQ|{k z4{4d!8n;kD{!!YW*c-@^M%MidI-NivGlOx4Zv2g3>53MAG6;>iC-0)@n(TLRviG0U9B<_(1U~?15J6lYqitFl!BSKuH)yy%L070nyOIU+2G` zqQZLFC{*0UG#DH3?%o0*iQi{Z-tHCmCqE9Gt~&ed+QS_HF(*{HzMp8EHujr|c)tFs z($vJ)9N>C$MA^pqW}&$D#_ZGYIQpIubSvHF1Ad8oId-+>hjX+F+eU=tH2ep{n9pgl4~_onax z*$Yun{5!qlR{G0LPWhN~?IUnqF~?LpO2XcPo5oF=j7)_M3cJZ~o_}m{Hr30=ZbC-s zzEhW76uKE}j2Q3V@^@LdKUQQ%3)&Z+rv<1>A!4@E_nUct?ef@NuTlgYUz57f&3yFt zqw!nW{r9<~lPmo_qz+8e!Jb6jB!C?kCu++JOzZW|)6!Pn1*EOZKsA?Z1^4-+;B_k^ zaQ?de;uOP0x&7^ot7Z)~BS+vsUp+oBLn#7aO?5LE40jzI+_(0np?vl9v{(>{Jjet7 zGVJG+k&k;r1(s*6RrI_Q+a&HhPZM0tD2lENR{!H_k!c1G0YbXptp@7VSL!NTj#@dH zUK#A%6@tPyYP9&1emfOSrL^r`U6-10BW@m?|6{*-r4Vq`yfRhe1km?t5QoCf_dsRX zQ_eD%{V)iGGv}T^Ko31^-8)dQOXl_i*a*ldg5G3Jz7W7sap~#lDt1g4E}*?l#QyTB z=Y`9ogICKQ;;)XztfjOmi#nd=V6ou3yL_SfPhJ2%!EbnSDc?iuXRWMmeWDqkFs^Z- zMCS8>&dTb+?abt_(u0kW{J*`+=^NAw>JKJua#^xzXG(s1Ape3X{oCdE^OukF<$=Js zB3s=YSeOlGk>cd%R|nJgEhY;>$*C)9spy}iXJQAM!dG8$-)8)Bj0btdFl`P08 zAv)S}?7Ch5ZIFt(>-H46jl~>Cw1h=OdI0dD5Ys;_%Zm8RUr1N=!FZ8i!5S>VeZe)X zEmZNvo5-y`{kx6wu>bRe>8socgY@RK{E2)@HpwVf7FTmab1G%Q-h^jEr4BPhqwAw1!E+=mg36**nyt_ z<@pWRw?jBeKK z4OKq5=8)IKPC>E!2rrDUwK43B*5wq|Su^Dl-GJ)X5IVMW6-gP$#HKZ8UGIHAa?%;> z+nPd`&Z1{H>C-^cBEBM`;g(VLjpjk!ErV-VRs}7-6F(D-gt}SjJ8B@n8-|<&3EeZ9 z6qI&52sBK1Yb$f!vUaomhRGUa_*+rFxo;{RX`S8=et}yza?7{WK}sdt1}lF8>{!OJ_;;HO7zmzS$OMNQLZ2* zgRbdVh2-4VP(v+yAGu;-&eNjnp8XmU!yKz3$FrAQeXtfofMj{-CmaQ%Ibj7iHO;xh zL2pWm6Rd3r=;E_C+6yEL*75iV z($3%@?cKXXm8unA&C@p7{w9y|(KdH2lS=Q4r_T$Kg0x#FEq=CFB%3wkdoenDk-_Io zq>;83ZJ>BLqK;uKFVoVn(I%omStWArC?!0E-}$VjJu5GCtRgnhY3wd^8N+0{f;zZ> zEdDsSSR?K@Qu5K{H1d}jkbL2J_NHPz8gcsn#pC2~N<;fq?lz04eYAud%>Zd*K=V-8 z_7LMvJOT$mc!DG;!pNlf>t=)$<8|9mnilp`A(2$pHXc|+wCQHhd-gcIdVdBkE3!q$VI;HlsYXA-EpMT`0yW!! z;xhts(+C1&h&8QKQi{cA&*vu`q4RuEBFSnZA6=ufWe7&C{3fCVM2&urTkcA^`(AZD zjLLvlZ+d#h6ck=k=i!)R5iH1Jq{@fpR+X-=<azQ5SYidqP5j@Pno!c4HN} z14>WlfETDe`7RhW+&)TV6nA!9ii(O#@!skLnWj6BYK(5P?Tq)42ln=PlRbXJa*<`t z#El!0JNE&2y3AbiL=Q|Qcx^Q=0&R->)y}3sfI0B_Y7~nul#Eo_Tcf{Mn%6F}0dTaN zS&~>qsI}hQ_YwV}vkxZnTW>H&lz&C|PvP1W_P1H02&5lV@nPH|knA{r_AEPCSZ~AY z+}INO>A^$gP(6rB}fBcSgIdAB+UhQ7z<~FA2blSwy<`0R{CcaXw7`U-69~Ep095yb zm*mZUGccXC(gWGvf!+hvqjuSakq_(BsuJiIc_WbiQM_o=r zuIHL-QYqdscn|ICe?R&zsfy0IP3*V2PHU1PpfHJ#IpMwDWN#||f6Zu&eCh84>VRSV zZLsZ^yxa{q#(sEof)mXc9*>Wr)s*ggwq=(yr75>JR{`qZ;;SY#UmbmLQK-7vso5aQ#YF{Wd4_-18Q>2 z%H7fxuHqT!Oks#BoOR$hPRcstQ}B=KDDOj)*s@R2foZh{>&}c)?QD|ET*^G(D;nI% z4MLR2*q8Q<<`zK;7rwD}iaBsP(Y= z^n|i3aL>Qb6%K%)&=+fV<}}mg^iCNwP}4fkb5d8<8t}bQz{~}#<`{Q>fAr|lp{34s zijs%TFN6WgU0?s-x~aUTPt6d^W^_Us6sgbJc6g-#+{Hdqi1=N&Ab5=ZZF~Yx*DS52 z)vYI2CmW5oY^>sZM~_~-1Yp4Ejfg8XZbqRjw!eQ6Iu^lzI|MG!_ieYOfBJNO`FDc` z!5}eo0QGG?Ae|O#X%xg>X4!EbV+6R~f}q;JKr>n%7ku2MdGHfT0 z0$ufrHF^|m^E(-fU%YtH@>@&jdMlI5T@c;;Z2kTKg>sUt0V=e$@Au1X|3BK59O>Yc z?|7@`Si`b|Cg+H!&nhKVC0o>@sWy!uzoDb@>KE=-2O{&{L%V3d^?0oBAH8hmOc*Y- zOy4ApeCoS*egUKZXRJ$9u?ayOZG(R_IrVE+{cp$Rj|V5JD&I`NHWJK~Ra7E@Pu5FN z^dA~XglIgu+Hi_VOie>(Q|AyDJgg(Z1~l$MgH1J@xRh^2+*s^y@bjo|mv$hvu?3lY zo1Fz9VIKvB{o}Oitgbf4@o*YAf^k zcd*YsujzdoB8`?fa??Eib2Ah1*Z8GJ%1f6Qd~azq~hrbbRZs15wc(`ftzjFTRwwI@x0ElkPlH z5)2ZC?$-MeIr8H=kL8`6i-2GK{oz6s`=R-gx03~62L#iV*m#4AY)Fw^Oib_4#k;Ss zZ)iSR;xG4(gWZoa_o~EfCYi;p*2C5oOvOtQ4sZ84r#rusZRFKyUxE#cdB!oD9uK3G zn(US?2P1eYn05fT?P3;m;Ny>(<N-G)f0u%_bz6T<3}NCZGGO zVEiwKT!%0CkO>|kBQ%tZ=VpUnnwfbxFM9xDMFQAkDD(YpzK;2pWi8hT*?eo(Sl2ab zLqpqWY~j`gB(XSyuI_4I5HPw3Rt}Uw+h{3&00SuS<@<26#*6jn`T35Z)WDnH3hN!r z!6xp4P$NIk<*>r)XK$B^uFo8#Pyk0-m_nTa# z1!dJC#rAMLve@Yii{#a`1D~P=zx^GXU?`@S#i~WZ2E2+gm( zG%;_dA4Hf2lutwOb*llllxpq!=~y>obklKhK*+A|bpnjb2dDAYOr~C0e0kHil_6Wz zRsF63`Hrgpc5i%gF@OAE9@lH4rA(z&91F_l?ayK*d=rqM(lf%49}T^ zxvnJ=dmd2{D9`c(eY$ut%OOAZm&2$G4&$#Y{CNX5dVUB|QBieP=x*+PANYPIQ!B4*!E&eOs?L`DFFM~SS@4i-QDlwj#+_O;7 z-c*5#&3{fgyRNH)TVnaS{&mikBAzpy>+^i-L!X#VUvPd@MZn3iSEJmDsn2^jl~{HN z_q9#<;pb~@4m8P^2Hgr{fdg?@iq9nO0!22>O5n+Y2lXIzl#H;8RI|iB%BYyt4Kwv~ zS|1+Ab*K)Qd*qWAv&|LRh?4$xV*~vkorJVjt43X5JX0MWQ{y(>MCK4Vs?+yX z1v!r~4=g9A3yLC49T=EFcl_)ITJfR>pF+}ZSX=;`8r%k-oHH(bJ(0g<{gG}g zj=c+z3$li1ALx09#)*!A6!0?x&)&u3Rs82(Q4Q(+IFcTXGx@N$fKAql;B`T%ZJ0KPFde-7cZ%%QtS>6VkWk5P6|&y z4Hpa?-VxcRgQI= z2m5SZfIaGeC&j1ex~-PEUa_G~r`N@ymVD>8nsN!N4dI=>FHblG;`SmWqq+rvNRVHT zI5oAL#2Pq=p7-irwuCkOtMzKgVw8W z_j4X_&+&Yj%1*;{Thi*+p`I2k#TKiiCFPc(NAUS?^Tm_jBmJ95>H?<4m0&E#RpIiM zZi;>ygE9IdNgg8rc7x6Vxw8awus2)=p9IPX-eAA&66XyAEF7mH5>k`1JnZLd9-?Z+$iuW#N)yMiY~AGTi+WBU9zF2lROHiRXTo|_sl$OGu6v>^5CCbh` z3%A~FecjkkF^|`gq=~){^0ta#oy@c==UVTTVv9#aekKb9B%AXzB+I`X^Bm&%4b;rN zV-8P9RoE-rjrk5qO^?qmg3aXHRT8Mmc&}du8F`gW9Lrq(fT}ogV%6CB`PS-K+`Vs` zp3bbij3eS#gzqyNi!WK;oc0BUFIZ3BS`POMthzm#3c|ct@z`*k^Q3%VZSfa=l#w`k zI18+jSr_FyjIVbO3^4gGt2cS^NT=z!yq2BE9y?5cQQ|0n&DLFu3a|1t`GKmsppJu} zE$mU*Jl@sW?WhxWXW2I*Z&80>XMaGs!Z%FUl~+JhB3>}PJT_ceV0EuF{r=TgR;weX zCyT;1PWPX?dzo`%V?7n~43f~HCQN-+eJ2HBEmB*mF06oRxXwUTxm+z5Q8kH47wCle8rRaLu8;zWA4qnM^Jo-f}x32>*}7E{<#5{W@ApAgHjzMNg*w0JF@2i0o6a~dy8o&N6 z^5ovsc#pWLLvzQ*RGjZNzc5*#k)*dHj&90^uP1Icg6*me*2`~mC`f8ZwrdqA{UWV} z2OWyxJZu5mp+HCd{)rO-s0>jCK@6vrm6dn5-1dVyHBsam$^{nJ!$r|!-nVQ}YyZZn zZuR@Uv-q(XU%a3iGySUlPom#Azs z;8-&U&@Mjj@^Smj+4oyEi3Hs*;IR|^z6u9@x>)Zy^@=FLf8|Prm&0&@k6gVWI+16H zRx5vS&~w~xC8fG<2HHEt=(Y)Gl zjClF71eHz2=JWb>qr>Y7ADjWg`mebMXXVq+oy>Ge;DBGPQQmz{@N)F|zzl7n0OHo) zNl%RrY1NF8@(HyJG^-G=Pvi`QA>{hnYqmKN{I$ls&!lfXyUD5~76HM79mgF^nnsLB zR1`JN;jT-VzqjCF-JXUq25N)zjK93be5gWtVV74V@GEvjuqBn^olc`#Is68AY_t&R z6r^9z(52Nn{NWII<7SW1#`{TB0I6|62N(B=<5L;V4YRrLUGvXia@*JB#M@K4U8;G| z<@~s~PNjjcImD&Ud5xO7EJ&Aabu0{XbKI&|xlMnlvcF0YPHe48fev4TYsL;{tJ{xn zXu{5}=977A0KNB!)g?vxRE&-ve{=Ka-4`R1u6w#>dwFBFLwQ+F-cJy`Tl`|08{R7U zvGY(bsT()ishsV8*0)p69r)s4XksGk4bY3NyyBYgyRV{dADz73?!1xHH9tJws=M;d z8S-Lle$LTjnXkyw+WB1qyt`^BNEXu_*5fTD3o8%U{1PJTq;Yoiozm$II}hILD{BJ? zSj8vbdLP`og@r5G9RjF840H#%jcHi&RNxkp`MxcesfkmVtV(N@s;nHUmOy;bAiOAwu=m*;bGXyl&L`+q?Pay_)?&3QzwGlJGqcn}x2gK9 ztjk!;;36^2NA4`t&JVp9q_SM2r$O7rOA#wzimhVxHW2ig^!Or@tVv=U%g=VgCQLNL z5a++u`+EBzy@d0$d8rJm9FTXWNC+m4a;DQudVgElztKp~@r^4m5$~WNG~zsPGc%=; z$=C0nm!u)sWsv_kEWt#swdL5WhRN@on@O=roAOze2^qqi9A;E)ZL0bawbH>`87#qL zU=Ir@#qq-6KNN*QQNOD*xWCm^tX9drm@qL3%_+wi5^PeZ=*{<$tlyH$5o>;5tHlEubnah)p%x^fMOdr6xL zr5kdRx9d15rF4T9g!%cKQx6t0sC4~V#y*k-YM8GY80c{3<}P}tT?${|uH~w5EcKH_ ze}1lNN!nsL43CR0sp%{}k3U&HRXdw<0ZN?rK^QU=Y> z(^OV3?_rG3z6mu}Uzq%?sQMc9=x{T^_J}!fediRu_#v-ZXG~AWV6H0bW0tae1QuI0 zRZTmU{r=g}?(M9^Wy1!`1R7pu=+GPCnFQ{+_DjcVNIE_M8AtIoXmT5|xZf=UvbSac z>V9}@SvGpG!js`(FaygW+JJq6KUi_rHvu*=)eARl0mkF-#k#)n(HCCv23$@Cl?srK zvTQvgH%jPFSv>u9UdhQ`=xd0{ zJd=YRj3E~DZNwtH0{ZmH6Gzwg&I@}EeQUL5t%|B~y(z1ag29x7{XD758Yu#z@qIi@ z;?CZBtEAdI!p4LIei8qvmU_rW2{j zMEA>48Ke)U8Lvucf_WMyr*hzXq$A`n^8%U|V9LFx4s|ye7YnW%2yepi{@BQ8X=eg8 z%3*Xx1qVFYTCH#Dev=~Z^1iSJz4Y$>=q?-zp)ljSdbPsCtkOo;<7kAChs0*^I8SbF z@EIdbe~N^VWZG$cO{!O2|7b0f%siM9zH%~j-Kntd4xtc;*zN34icPB(S6R_%Hh7O+ zzpY6CBgs(5u2J+W zv~sGy9ODCV*RSVfN%qfQ{Iowi)8;f@GN6&`{v-l*ROenoN{WSXy(iX^o9a!iSF%3N z&Sk&NSx#<-hY5`t1$xIpQt#}xR%-9->7jitMrnw-gZ{0yHxE?J_xHVV3f`n{5sfG} z3zrx`POfkKB7GT}>DE8*;L=cQP9ROA*ea(EIjW2E)cu9yFgZ2iF1~o4Y@mq4hw-BC z5)XGBQg^8H6)pE@X}^Vidn){cMeeGg?13QD&pA*PRn_^P>ZuqTZnX-sXhu%osWp!k zETinAbdT;)X14t{sPm0k86Ol6(oC+^2)eiFqf52Dcmq4ts8r_RZaG{~yT0Twu=0H~ zw2(N}4^+i3`b-3tn;ziAQRCDW^n3FS_9*z|J3+m4kPb|#X`T(He+^T7dL^X{f^fE} z?3@SX$oweAtPCp9@Sq08{aw%R2;*O3=%7xxcl;+hTLOYEgL@?)toWm6Pe{JrgOYq_RBmeefO-XorZefrK-At-c@%4^BM1siqJ zDd2|*3o5u_`G?@tQm=>fTY{m*h(23Rfg;<9!eIYn8J3W43+JIS#jFs|F)=5V+zL&o z!xf=}lsk{jp-iGh|IDPGh-?E2~}VzB4MTy^e#+ zZD=yRML)}wIOeH=lMalYU7K zgioUdOeIGV^UV>m98uNxpH;`){YGNc%IXLUMvA(_+W0oE!seEdl3zcWy}E z^q!&q(%&7@b0;mW_pb0EHDgoihly7z97JwMM%_^^Unr7w()ndns})D--mM@NXKC4) zte#|f&-&vE@0C-&wMTmz-g9tO;BJTrau0U*q_b-w4@DmL(+yd;(K|!Clbwf(5<|PD z&8&2k=p?@kFpnx7LMHCS+)N}7IIFTXIrVgZP%1&m;A~z~BjKw1Cti8aPW-dSdQ*2r{zjyua~-f zwHw0Q<-#N$`l8&f??KH4{zsF0r(45pj(lLneLA+U`69(T46@L}lPgTjV{$tFZKNI- zCn$H&RJl4y(qagh5E6^VdeJaUBtL>GbU#Z5^=)i1j5sV4UR3dN(q~mQR-oD`&fGgx z-#4xNDI;tL*U@YJCKi~TACyK?k!>wk3%Y*AvopqKlLf+yOy&(&eV~2cvc5eNIL+c- zknGXR5J-}U*(WFS`hW!eheaV;(7^KZwu)0p8aBhiAI*?0Q9o{FXqaGWggFl5CaF^%-{T}X7Po?TyH5MjLIM!$TdrJJ>&OY z9@dRbDEShR9b_#h(z|H%rP5t*Pr$2z4Z6aU0Ftd!5O5~SG88$mSS1|M`J3%;`KR<( z1UjO0m$^HLZ*bca4z{)x)L14SWz(&Lht{&kvVN^sjV`o{;-6oyaJhGuwK77)qUgM)6-zLwi%Lgp7EQ^v5{P)mF)sd%;t234Fqa}tc@UH^JJ&UkgxyS z>HM`wxfhIs9i-8)=C7;+>>4m!>P)>?MtD-B>XXd)#?aAvkhI&2I~3iQfB{aa&*TzS zw;k%xwg#RWaJyHUbPK|NlAd3*t=R7|3Xns-y&%y1{8iH#_T6Z4OjJ26?3Lq#IE_aY zwA-yy+yhhboGemR)p2>W9<6(*qh*i2sMJFd2a_CatRB$|GTHGRU~I9QV7onuF%RG` zMRz1wIM+^X4G4k=wBDYfIqK9{EuwJ{HSS%aC%sq12(1ODEj7aB6iBV^s-6INKmqa^F@?LL@v@oH$0tffM4MK86GHZ6_BKxA~ZZQL>Z zE85QNSvRa-+_uaH5GHeMd?9Op!_3k$6BP*j2j2=+hnG9aMAdgaJu@{6ij+|aP<4M+ zzmWxxe2}`0jqXX(HdQJdaM;_bXS3W{HwP|ALmztSUL|03>=aoJo%`@r>Ka z9K*>N?lViHud1Vy*>J^9#c1%U``ORfpsU!C;{&`CmbGB94ZTD z+^gediUk5-qrOdGQ&r8gqCT)h@4ouA58Bra__ao@Qm3(kO@fnZKg0K1#~qu@PkO9^ z4TYTBcW&$W-OxmYu~=Ai;mnt-t!?VV4^p?nrKKJ|`hxv{0Swxwr2X%U)7iJUy;!C& z*LLD+hf8O%l{i0|SSgon2`pq7;jFWo-ISZ1Y}@9B?w0tFwpmbcl{AIKQFA8}4*09X zE0q8wynX~;jq)=;?7_C`=f0hs15I2*ntrqM-+ZE9zf!2EtXmBcmCKxG$7QQ8Ff#JU zMBY(B3efLV-20WTYD&93Bt7B^q9o0#@x$SxF;&(@i0Nm(c$K%A7x;ffNPmvs`lKNb zGe#iId^rJwS^X3nM1~=2Z1mrZ&WK=~gAW7_OL_!)5m>k~H8E5qKET#19|HS6MKL=~ z`@M$aUSLxZh)IeGxBVlbf#5OPg~Y>SyM^06JcDv6{`V`-ph_(ueI=FiUHa{BKecU7 zx_k+XsWKx;W~ndVu+bf>c33XbHwk^khl@+7&3dHWv^vosZ3sk~SA9Sp+o8ENz-^oA zzD~UkkdF>aS}j_v-5D@yoP%t#l%u%ZKYxF^ z+Lh}OivqJh(;*Ua*0%4l98LFteA88rhL#pzF0HMDCKHz<8%j#%Z_RTCzhy6_s;KZ+F#+P@{cn>Ja-mm5p#+8N~595sYpE|Bd$XigTj88MqlVvexsJLbkURv_mxs533anB z%9CBqSmNgLtgd;=8ySfEq;slfrzanwsA7tVD?TMwX9H0eW~4EhLb_Fjn=D@5K~EwUQ#&mk{g6454Z$g1_qI>g&V)w512oqb9)c`>wybun~$9WYgR=*_N8V3+|wBMc>Cssg7U@5=(O zjt{Soz==}6CK7*hIeza&j(aMfh`khI`_kO)&9!jm^B3z}OnES8IF=#zu zcPCk-QD8MnQ?8l=YLp9==`t5!766s!#ltamvKuiMs0(o;tapfTR472kB^oqcimR3! zE5aSX671!UvC8FnFel$+x}k4iaK$`9jGsI8+Mvt|Sc$p)6dRl1`sodmIEm&7X(l9X zYm?3QS$$EknKf1`%PNohtg5j|^Q`|@1hup|NZ~Yk!Bj)X01@|;kDRH*AhXiZ z-H(ksMJBHMwda@5J<3@fnA(j{^Tl2^jd6jc3iKp?8QEM4=qv62a5I3BeZfU|kT1$C zW+)%oc~-=3sX&B4IZbzgu4BZF0DQ#xR)tbo58^oq3(m-V(tOH60Q;e;qdoy}oV)OX z4Ud+=(HwO0_{_1n-+Zg_sOXRxs(xSP=FJ_;BDSDp9&YBKf<3seeKz))l1q2lV%t@+8_7aa#_F}97OtDQNvP5`l-1@qbv|xjI7lMoWdSVvm zCI8nuV?W>>ODjZd%rbY^77Jehw%Tc;um6%=W{cQ30p}%~^6SB!K6CbPAzp!mPW%cp zMWgzT#$4)|V5M1QN2L^q@9*yxBOh7uAp9%myMhwe6DOKp# zA`!NYI)^($y~^G91Z$>En5L`UhZuL#5|9#>YeHri|K(Mm$yJYD*-6u493Qa+TPH%> z2y<}X`@yhqwf?73vKsS2dIxM z^t6X}e&2oWUb}?-4*K;GK(xIqs;&ZztZQlv0{6UPCIZ`J#HKY#r&t3j1RVQZ1+phx z2UgejUb7tn+OSF!nTy8$aM zO{?*()iN)KDwc9%7x?&=%ueQPRwK1E{wgNLCmfLDi(!40U7}HS@ICA?0Ge++%pShd zpouuga1NM@n^|iT=Co<&PyoZpvM`i8o$LwY06IN*-g)jBHz3NeKwcBIx%%3Ino}L(OZ+^ zz8*^FV?#PZdGTUm=O~1`ujg9Y;&)9s7xIuXg{PMv!d@Ie@EB%t-ZU!;>xqYTQX`yNe;7a1E+W=#w=V z73uVJE7&OrCUU=ZV10YTW5C+)VJ~y-a(=PZE<$9!ev>Kh6mHoG9c~gd$L_Z*NZ*bM zXX90%r9FlqnzN)ro)tZGr0h^BT+brO~*@UH{_QvoJzN{_>oa z`@Mg3J08mqk?T*L7hv13zYB_on$B>g)432ZT&9%UjUdh4p>@wD(`Ss#7DRj?3mD6O z)OW3rv@fQ2{hEeC|Mh1@j}}Kt8>In$-UlOT3&3~JcXW4GkOi^@T$`jiMU?6VZ4hT0 zGc1Gta)#qxoZ(gl9iSm8YxfH#bAF>@J*LX_O(3Xnz2|&;`PzRBw4_QMK47UxW-P^L349 zg(GO&<95BG!Ai~9JJ}1IS@$voJj5I-8bCJZVlEtM$J)zrcS#fo&E7CVeJ{5PFbRTJlVNLq< z-|07N`B0X*quZA@wK;7_!fCG@X?>y(i&p+b!us#yPLy$a%d=@dlO{Eiv+7md~vHJ|?&%3kN*OTmX#yM%deTXI6 zPVq?t={F6GvYp1-%q6x)GUhVQOl_P%3lK}lNUk4L7I$fsP&~vj5m6$dH8>!*{kEf68b`Y^ z&&u8urm>rw=NqnRn{!ZFXTLGO{_W(fqQZF@KOH~1ol7sF7ou6-`b46g^N!KiO`}KlE#f=&0l3%}aTNm6sNKw*fX<@6l=Khc` zB_-u((-pJ!lk(#@pnBhLL@2){Q2HF|S{rqAOiX8|mta=`W%bT80%gdvE{@5fm`kL@5V>h_8+ujaAE2YhD&2#o%;G==fx_me3m3xnKY`YG{~-SGk1QI*_bk}=o^tM;sXmSm zVU2F(C~-gvKr(1>a%D_y+p7rEbrERL;1WT0SFIQ|TP>%LKy2*Y%ReBk?KSR4JXFU$ z#^FTi@(=bl54sj?Qc$By2L{7)r?*oIxr}Hs1my;pT5k-`32Y~r(H6ewi%VOiv0!%a zrw89H*I;s~_>(RJL&DYvum+@`@rsX^Hx>YjoWLoEFTL>2G3u{|2j*Ideu=(0)Pjzn zP_%tu;?)KC+Lp`1j(w!Cm$pWelY!NNM4Vod_Wdjc(w23ZmS-g*Db1W642Quk5nko# z1wN^Ge@o2V-2pE3EDwwZmv0#{HHKv%SMVxtq?$;A$z;Zdi@@l&D(1xrNfPsGtJvD? z!NKcx=a~3dBrD=duAz?HM&NT$E^w!xpt!a+pRL5E`O)GsuSO-AJ3y4~SuJG@&yWVx z&Mp@k0mSf>Z{4EbB?t?eM{yCAu@kT?p+2qA2l&SO(lGPH4hTeUY2NVpeDHH3!&fIS zegU4Co<)hR8{N446oQ~qA?yf#E6-)g}C!BH;u4 zUmgmV+{Wen>17NQV_`%?4E*ESP`KYv+_^Egt4?vB!B`gpgu z>ay$+CnK6jR^?0Tu4#m$6#EYI#$dOQ^X#O7QkA_hytqttSRzmt@w(7a^Y6xCf7+=cqp(+( zKl(P8WpqIE(d!q3!mjgo!LFl zkeV93tx9vLVRXCeO`#y#N1Ld+(?w zv$cI#KtWVMMMVJxrAZMKklseXLRA5gF4Cp<8X}5VDI&e26qOQsC!k1^5}E`E5Rejj zs0ktM+c-0hbKY~#n&0=n|F9x!ArH^qcfYUeVk)}wcpir*8qiHo#Qgwa{`)T(2SQ>O z&0k;UFyELz;zW7haP9l``82o0pKB1LGqfM%eZSsk9m@R#Db>5(sfzr{_4&?lbyMf# z(J|3j+Uu$kf?xAHe1%3iLx<>+mofz8vBI9w)l?L+6JNN1;`kGvP(jH}O zvE9LcwmSCrHp{<%{t0eIYgZHQyg}W#CFhrrh@qNqdv55k^MN>w`x%EvjtwOx3v1%S za9x)&A%O>8(x$Dv?@s;tn0WL%9WI;hX9cd(bOPY+EhEKz|C==3fAPV8l|Mf}k|zJO@kQ7H8VMt zlyJVa+4pr@QPD&4{LlZ7yJvMDAo&U1(-5ZIJ$m-%v;VV!(O(^ffBm#t%Q)?1!7Gf^ zjs|ZssC&5P+mSvV_pGv4ile#VfA9t~SE#ra56p1yYdn zmEjt{Zx%D>G?sK;C>aXHU67oFu;?{$+F%O>}WML}Kggl;N&4NC~ z{q3apguI{yeFq@h{n@s*711v06Kjrq}!&67V~WceJn|LPy~ zOAP0VE=waraW+E}aM=$Zq7CmJTXk#oniqM@dUU#KTa<>__t%Zw6Y_EI3r!6mKzZPq z)St9Ef4g7*=(+yKPgsOpZm1W{L+ZZn>${)cvhqAWc@_Tp=&@tpe?BLXr>M5b&DGu_ zsZ(3~P0DE9!>98|cq+#T+mRC|ij+_P@{8X`s2CZY0wT8|Z(07&Ed1d^Fi`BU`Bu|j z!WS69a;;-%oWII7=1V!}#Ls8EeEhtSAUNWe5`8vljLVv1)xr~J1HP1le(0K170gCW zt&!sOi(}5np*?%{EEvfg3#a^YWB+#-RmJMq-CFmgd}C!J4b1}(mxjRaHhny68jQ@$ z8$Zn_X}?HUTTFA}DRFctuAr-%vC1)bwrjKpuG5vYZ%LQom$PM7%P1?00j$0>))v2f z`|DQeQP1wE)tf}B`tnAEBRKoYZ^%vt9Mb>Q8*fY}f6(rne1zQBpEz%_Ck$##_~RF%QN6;@tNSRH!&OB!&*+ZpbM8pFQY9 z74nh0mGjO<^}!{_*f0cBugXvmDIKyx_e!t*c|B>Mw6zBg+T1d(5&3#OURLl!iJ}>IX%)56}lJD%B@BnhDrU}3f|_~_o%a-ah1q(?V;!YT`cleyVqLyO{z+aXVETQ z_=R)uGv4G0xKu&JUkTC++9!N`B{GUlAVa#G37N0;F{bAe#`$EJ$j{w7e@_K^(e`iU*SX_wm&3oh=U+Zr>g11fUS}{U3{H7x9&)@O# zhF;|3;uQMvi|Y2q*;t`5$h!@zdd< zV*7}!Itg_jm<3-m$}`KM)z2Z=UU}Y!_?Tg8^%vT}jI@JJL!>lDY%;HUb1h_rSCDcJ zI0nJYvwvA!kwYuYvx4qq8Zu!sj_;24^h*7z*;$lP`fEbwfhp}f z2LW90_T923%xv^`v6wT@dH6&mNB&6KLRtiic$Cq5aW-w=L55x~tL}6B7=7r;p5n($ z%l)hHo{5RS)e;X?AV<#&ik@x6s?ckx5?Ug;#G0F%#UBiupC7NUMNR^wh>(PBXVk!e zz6lpQyAa?)iFqknbKOhv<_+oRQ@bi8`9`HzL3OOxdilKDmuE)+GlM2<%rOs!yzz$& z%HRITf9xsVv(cKs3Hk>-OFq^O#!$6h&ypjfXCVwXuD{7Kz-1r#`3^HE2bV_ce;ag4 zIOmXvCXQ;ACKQ4c(Rif%%+k-Rz3*UjlrGHX~&Y6@vWyR{@`^a}>J7 zro;McjG%bHrafcfIlj90@2~Ugrirj0eQya}n`Jx3L_2^4Jk$a}2k5nJSJLnl@{R=* zuYUS}5sy^H*oKO|;7E0!Q;Jssxp$aIy-nybYiD;#gm`CDdz8v3_O%&z(@ zpVdZrxuJdmM7(dHZO9Hf4|3JGN1uVX-Rq$lTGnyt+n=vk1^qD?w>PEL6c@Jv3q746 z9yB;_kP~m+;>lFcKLm=X)@-r=j?L86 z)O4;&m%?Gu7Q3=5C|9u0v;Kuuw+$>i?5ZJ&1D@#yqT`G}deHqQqH*~HzRFRLm!VIe z?&6$YaVeVv0%4)_;GGYq9_@TS)R6^~`Q~38=l`>xxtY7~%DcDqg<=X7vBz9G;xc+J z!U7QCquLy57Dj03q|pV-OI>^)O?012O$NU_kZSnz&ULVI&q9hBSLZHr1HxX;gt~)(U~9+xLtX~TW){k z@7X?BUHNUdbXrDa0L7B_Yg~|N&u5*TS|;&8 zsVp-y(|lPmV6%uO7%4d_cZ$i$$*}K9xOcQwQ8Os0ZfpSOwb5}?OG~R@a~V*B zVI2P0H~RnSv#!w=L~`+S2q<6h7vvDGUwEdoc9i`HU-gINEM8yVZ1TqkZDi;0IZZg> zOI~u=_OObwzz{;@^3tvtV+TinwSYiSa&rqoJwk66(`$F7GacQ&te+_0gHv>GX68~??0%k-dEBpV*PK&jrvr_Owa6$s*d(3x1VKE zuv&cS>k_ZP`aM1!K3sR37m5uqH-2%<>Bh!zrQGo+vL@;ls9EyTH$@p4wYN3=npytp zzRQBQ0_iAMlA8mztp4IhzDM0Fl?^$UH>eX$`s|cW_r+JvaJLONX-TS#XJOvWYE|ft z4_S%}f|c5~x39biHvP84dZ3G-b2(pEl}O*}`}#1e)|Fo&WuV((19~02A07k(hE1S1 zeXjQ~ykAGYpsx@xLRMT568f5}3s#U#a%qB!i{aGA9mD8SSnV65=KvN=6AYvjqCbDW zg7PXN2BcwuR`_W3#y!p!#j9YzF+DR=jmnpFqB*??vW&ntnVHiOQcJy}4f5nyY{!oe zyCWO*G@96YZkjMjprWO&VHR>*s2Z&hHW|@s4yYf;QJG$OXzmanyM^ewK%LK zY$-65&T)mD?tE+M!hYyC2Ts~&ebm5(-Lk*FDBAkQhU z$YR@04n%@{x_5AnblN41UBJ{SM~qG?qS|GHJa)@rThnfoKp9_c9jR7@H^?6ix0?^@ z-iiR<@@pA8vDMZD`G0$O z88x(PhU2`>qU_F8E_c8`RgQ6BcoM3ihS^K}=vVkQ#i?E5Y%qa;RF{r?pfkYb0ilFD zP_udE+lXkJ1{-9CB;J$!J;Iba5pI=PR5GlTQgK|Byz}&%MB+I~RV)6{Y6@^^AP}Bx` zxS)I*22pb(B9-Psv~k5@rX`M)C~oJsZ~rAC?2kDZngCVhX@n(V!+@6A@I)OA9sRSg zUa&7btOz(Tm&JvJHQ#oM@dCJ0^llm^Ct!-$IHpsTKIj02^6}@8xL8uH440-j4T-W) zH}@jq9R*B?i#$I=0OuGKk){a9arAnj7jq<;X_(ym@d4WWjFQZWVS(|W{dN29UHivc z$$%W&%{4~eb6<+`Ar_{~tU>3_jRxFduXrf20!(oT*q$#*>xU_VfBrDVZoE%$PT;N~ z!W*PXmkRx!20>xx`&KJ|pG0D@OwfEqY!9Kj8|#!N#1xncW{-hE1M;`G3ilVd-Q0GzESyQ`H9mN;UEoq&L~wT zc2-L29#rnv0`?&cG;0`Xg5e?*N09eD;F#@77TEcCcUNOFPZYj=-(kG2+RPWXwp8nB z=dV#sDbAx<#x#5n9h;e+-j7OP+cRV#%6vduV{OoT1@-VYc}Cp~QGl_hN6x>4|JPt7Q?ERktN`mc3s2 zz%jDWFL0Z`ji|;fa-T_3{botiQpe1qbHR)qjdon9^To8_(Yg4dh- zR50lIx;hYNM*x%Bbqk|jh8ch}H33>iOLRg)i-tz^-Cg|*MDTXxCQ`CNIy_vyJ9Yc> z)K$#b_8&MH-xlhEGgvb|SYfO2+m0>kYUOY!F)_X{`CbDp>#AYZ1-CYp=Bas~v@=b0 z6_m|zLr;6_GBtiaP5nyi=Te`7UjvsrWOgNKz0qCl{Ga`)4DrA_jpf;3N6Tc_nq??VPNL87ub+Rb$iVBWdnmc4}=JPZfEEW_U|fJfc5)=n7FtX zVO_H7M92A&@;tqn(j}0w6?AlU#V##5IehyVi?Rb^F1Q5tJwrL#9M509%8!MwF#b~a z{DWjfWrF3{Hb7%egH6~9&#jb>9$7E2u9vpCh(vrS(M)|OZPjwn2f=WMe1%*lDBw^C|Nd_Ynr|$ma`)D)Mon;^N{Zrs+~ug!%KZ19 zFU{VMVj068A$IQ!sD4Z}7(jSS8n*yK8Ch9bZO;YL&I4NEN{HlLkS|F-)D@t8kQ}$n z-y8(U!hGt1_=e913(1(>@(*{T9w@;9%?Ta=g#@b-(j9@=dI6-VXZW&-si~6y{X)y+ zQ!bbE1EwaBWk$j;HRfOU{6BtbNM_hZ1pq};ST(3FHbb+6Vy1Kf!|GG7?$byO3PY9}M zfTsnn$nMI^04<)*l{+R7Ve>z3{O`6Wc_Jh#=g3S*0KY!$emg>|)H0YbPoyP#DJpxv zIkr4(C`|ob87f*DtPHPNQJILT1?!r>QFu*xl~@lKBMTQ z;-2LbC=nxiPD+BBq{H%H@sC${vteHapzH*b#!49;Ra+PF5WIRbjq4m3gHOwBU`K5=n9>tU3$lg*HI>W5df$BvL4j1&{Pma(xZ?Pm=60uF5$tR zbiK{?MnJ_7qXgL*VuTt)2aW974+1!+0J{=pdkR4HcmXG4`PqknLe&GPsmRwNjVOa30%rBASn+ zFXKhtY%N0Hj6dBH-?$vmAt;c3Z`RJshe$9Pwms9g-NvJvq#Psky4ZJI2p~V)YsdVN zXs3FUTg_khVW>tCvO8@Wfdkf~9bdmrH=u)DTOrS@a{)x-luSnY=Av&^ipSUIeR72c z*%;ZVHK6ep83gzN-(m(XJ$v;kYL}~o+~u!J>~A-qw=}5Bh!r;M&;;Zv-|Crf#N}PJ zxK;eJ)@%&X7h-Cm@gRwDAJG`FMu{{eIm&0*vCN~XZl|P{^ydeP9|vBb+}T})MkBUw z&32pIYrWr-v5wzNrv~K!P}?@@iQL}9L%JcZ4dlTUf1svS!_p6!m7>7v*6`D5opdEL z$wu7<*WK1y1x)E49th8rE$+CD38eXbCW+h?0}SN5#M5^I_|gGYDigM!5WL$RBA+t2 zAAI7E=FkJoUh{w78dBjoVLwvwcrMRh8B0anj;=LX*Lr3VoW!`%@76HTbvw$XqF;{} zF|e#FI8tp^aUsRV;y6B1W64sLEIF#HN_iU{aNSS%v%8SoAFT`(v*W9WP^B~h{F1ON z-bw`--KI^Abz!IEn~F?G6i0>OnYMUGS{yEH!$86bCZ%93iRG=YK?@9{g4YkM9%Kp! z#O6|sKL%#2@&~6AwO+`A%vK$DCow)w6bPNrz%qPmE5xnAeAxQ#-9O?ad##E$hTp*J zV|$R;EaB2F85&XPH?SRQ_sO^kXhdN5v`U|XvIvjEBv)Kf4ixL@#gb7 z5Q0|a9NpZCkQFXK!A>0zee>z%>cpm`a1#4=KzfDB-6IVYU8J2q6u`UJjQ$H^`Y)HO za*rl;0KXLae0`kAh3W?Er^2`WuSOwhETl4RCA3Zs!Ef8%fna#;FHUSpj|u^P92aD{ zBQp6ZZDBkhVl#9Bv<=mpFt%#vZVexwh+P%~yVAZHz!tK`xT-1f<`az5yM8Y8O78UR z?1+jo(-yHmT_>8#;rmogP0~AQY-Tn_zj~@Wu#@hPbd7h-+Yq;%ofRUr-6~S)ymsPXcfm(-dOMbBw}? zT#M#x`g>$D7u72=d(tE}b|E;9d3r~Zb3Mti_1TD=I^BV-%gfqRvTF`ER(i)A){TQH z1mt=nnrrK0KLQ4aQ?S14o!ihPS*5PJkzr6Oky(3I>p?T2_vr$lNPfQZ+a|G_Q6S|W z9dXmM&JJ-#zExCS9!39>nM-MO8TD5E;3+w;_d!%LUfg$OREUlQ?tvX%o=VynduRl? zU2+Bs6tLnzNK8~7yl|u-uK>RCr1WoLm}cLVbMN?S0>y|Qhm7dR>)II>yP3=Neih}? zQH~|UIy=MNGI6}rvV1P@KBMa?fm{4Ny1RBI_A!|e{}L-S%NFy(Z1|6rppXX#_8vg> zU#!0!d9Qw51zvNi!m!Jv@K)uryq-<(3shE-J-PusPxIZF`D3s9+z({@P2as5U8>}` z1lhAM#rtOBwUhar?IzG>wG~chK`65>YA>=secZs;B}{m?YqLR;Zl{^#{ zCkHjNWz1Ap)vllzZoHwK?c0pG$EdtHLG5*_@n0Z(=j)gTAQ^X6^n>rEP6XI48SuVQ z^>meh=2+wicRk>PmYWjj(N!g;P7cYr{lhl=FQCLRmi2JP7~(>nYc>Gqdu$mP z1}yI`q{f^3lygM+kiFl{tSZ&>@k*)%liYLaa68Fw&qAQkxl6lPfqI--ky|mxI5J1u zk>;q3m2yvc|@p^Y;M3NzmFlo84#(RC;ET(GN>osORc zSW=%6V`G-~3^q>YhCT7IIQ?c(t8Er6pErj+Gw^`{aY~h~y+Ad_skJ*54{7khfmPwu z(g$#{_z_tjd9-AC`vdjWu3$ za7F1mQR;0yM>x|x%j^gHb0dE28iv$dDC$$#EhlVUbzYaxPQD7!AST#Lmx(D!N!|1v z*=-WZ3I701{0NI7vuDK-uSd8Q!jb(Z;qxr3hM~I`5tqBSi+2V zed(ry((Hsze8P6$F~au_>P`x1Pw%u|2KctDW%g62=EKGaDBrd3*)Bz+S@8nbG2O%~ z!IEEAuq0nL2w81}uS_Vo)ZSze!vB@s*rZ9dba_7PI7Dq8K#eU|D6k{*SnE~Wq zfSWwsOLZVR(5uoC3a#Egu(-X^X=F|lj5L>SsW%UNr~yy$Z*hn%i!qFZ?)cZf9TZ6S zc!Y*uK7}vfSL*7Rt-%9>_$@1Zje;kZVQqa3cP?& z#>WuH2Z#&1$tdKTHm*K{>{2tyjzSW|y%#uq%1tVHiIf*WPyw|Qyf|9@PGNQ8oz(l) zc#GK|^czbpK+P1VmjM7F>wt-lFh&HzCZ$`Glao?6T|45|i+1HqcQzwmzAW`-Z_GtM z_BOX@j*gAB$uq8S5|m>@l+Ga%=jQB(>jNtxGZ+j~!vf)167lPuDd#ynl3%SRy?6mM z$cZW3t{bjWJ-SWg16oxU{%vSm6T|3qOuzC?b%z_pOXj7Y;X*j)zMRKu-piKeiXC(m zFwjuLe0ec8^m~w;$T)Z`IjSzYZ#_yu`Yucc$<*!Hw574(Y-R(|*pKpTZ3$a?k`Sf1 zao}4vO3oChCkZ>JR?)}z%RlmH|;$I6lmfs3=5Ak+2rRdP`*f1%ojBUv;(wy42Ybwm5$m< zn#4eezdvD}LY$!qHZ%=>jtJCy%wKMf)h33Y@vjE?cR8}wdfvkb@b8)-FRBaFApjw5 zJn8#O>Q}%eJDuvQ?1qllk=NXNSVjiuy85r=_m=54YC4Er5pN2e}eOa&4hEtfbD+Y&2a?xl#;Z#AQfC|~u*$2bfv2949bay2z^ z_y`-PtCKt7jClRXi*+GB?Kb7B)>v(tkh<)Q<%GGszSX;Xnn`oQnD|rX^{PpdvCl$R zj=ml;JNG6aA=|&%H#Ta{)|~vHB$Il`PM+a^6al?ZI&kqScQLj~hwCO8L4sNI%lXwUl+LT7|*${3U z-`2;wZ2H!nV?rHdeDL53u2ZvVoswQpd>A>Mk5#7huRKT|8Jp)dGpL_^M67-Yk!sPo zU&O>8^U#6*@!2mSU-b2&q5Hc+ZXRkmrl-Yp^5~(HP8#=%5M%J~9xlGQW;cZAYgWp% zYxAgB|2sSmhJ6KDv0g&yYl~~05*wYJ64>Ey9~6kEE5jBYqS6xOz40oF95uO%o(sb& z@Fh9c3O3HmPOi7(v(Ra|TD{ax>PBt`RYn$5mORtj3X50sfOgMrUBE_v>o9M}Vm&9;(>uO7%R4F`FUSQ?9f9mO&upLaX*cSK@9+-~ z_ZTV3WVoA{zMMD<+XGEbY{28}4Q*Fy(dnm?J<5DGY&fP!Y9}!QJ9x$x!liC8qJeY1 z`?FUY$zm2;7`%6tsVFVUw&_A}fAY8_N6l|s|75=?;SKHV^SUWUtfy#qnc`-1jDEfE zgS5cyl?G_7=Nw~K(+=+zN5hVHEh3PzW_H`qFmQkjn0l;@sy&_nigcd=pF|4f)7A%l zDYqu0UfII{Hs9=FXYi?-Q9wMz%~nnup*S+_5!*J*-sVGG_HE;dv_{D-Qzpl-hxJ;L zqIYOm?TkzOic8PSOCIV@)Jhn)?-%mEXz9v-(RHz+mEm!p7Ib0JaClF%mK?{GsD=hB zJ;QjS{th;n==fM0Xo*~`Qh5Euq=9OM8r>^r=H6`cZbhz_7);4wdoFk_IfZ8D+c!=6 zL?i#xSo7yP+;9W z$%(4<-cpji98)*6xl1E0av?MM0e#)pPqBt1~mq+<-jL5HrPCdnnR|NqQLEr;f zMI5fcg@lCYD~rJpwV82qvB5J^Vf`5;*^_wh;dpkuxlnG3#|y=xjd5JSwXjWQmiHIw z1i*vBvfnMcj>xxOB0tzdb0b=AEqUhn7NP6v zKo{OKCnhH5Fi!l69i?yrjz9+nmI+V6xwP$eDzp3QcjS3l^W&LDB{~E-a_kJ~hR1!oy@dKIMy(z4y%TClq1NdNjWvgBd6P5vYJ{5n z7feCSixPSxQ*Zu;+GNp9BQH}7(Z8Q><8r!#<$gCb1_v33WtyVAOq-?xacxbnpYd+A zc)arQwwtSp2xlMl{ix)GQ1JQ`8nBkerTrkd&~v3+B0b%(-9VN$(Hf@aOS%={t9b4f z%tG9;J8qp->_nySCPSDUv1>+lid5no=^p%6`Q4>%guj?Xx9gl;^5oRvQy5I$l>~$> zO+01H<^i-{G8q;J|BuQzhIeMe z!pd0`>LH0rvE=bUY-Oe|KWQbDHKKGfsH-a+M^|@kx$z_iF?yIKQjstnamn}4U*+OryME@7{BcFQz=HGL2EfF5ZBsesMFY}yeG@Gf3{ zK}oL5jjm-@ufWC`SppU)k*Ji+-PX%rI_@N0s1w*PdUU?5OF9*QMgEyr8ARGe0pjNE zi#Mkw(Of5f3tt%Y1-dSXzbLlJiT1koNrQQf9p~$W(kEt2`i=R(!L`RF{K}ZezZC^_!hjR@L3mt-7|4HgA8J zyBB3XvUfQ#O3^HysjtJOa*_VZwi5@_kY?gTC3z&|HXYF+`N^3I3~q1M!0}@em7fBo z+{B`oko`9mS*z@5H%mMVl2sI)7p0aJX6<^GMhBgVjWJJ`!>Px`Yfb2B1s>c(yW@W2 z(JAU*TDer8EJU**kwQpIBPtoZ^_-F!#aFwhhv7>Mn?@_=RZmoU`?fE;q(KKoY_Xgl zsjxFk_cRqUo3L-2ywa`QMn@MC$VKV#wh9Xg$A8!A8S1j2Ryb1@49zaxuXL;GDkQ?v zDOa@IbL4{qJ41H}c`wB{M`uMgx3VRp zmd$e?JXY%5v)-G-%ydLj_htB;%9aIrp>qAHG9}#^_f=RF;Sf9;=KXl9wZe&Gs}7;u zpb2E9?NO%(qpBwRJIrxN4a?!1u%QLn#lMMzq7x@#E^_wtN$Qqs@HMSxdd|+_ zP70pq?VYzNZ_MCZMCFp&q>0DE=I+DqpC-N_!d=n9vL0E6IERF9WV|vjnmo?3Ty5^x zZG@{yVNGVSV)LYGseI%3wn9|iejYT}L_O!~zY*)PNX;A`Y`{k zHe_=DQ!(g_?V|JN)xv-dj?`~@;^|IQ+)`JtO0bdH*e#-EMKV6Ne_V0}sO=C%%#0Oh z;V;gi&)KbZ0oKq3Fv;>_!`<;bDv z2G^oYb=q*pFL@!s#}^~sd@L7u1|9xNvK_!=J|ql(Bd{azn;Wb2k?uD(w&1yvoQRlB zl?n3}V8`D4POkS%f+2p~>0`(WY2uvw&Q$abf!3R*C-b!Lr7`wP&;*>(O%#>?Er8!1 z0V3^=WoF>;jMGG#kq=WSmZ=a4(a?zKQY}5va+-rIM37Ui=?JpufTUx6{Wce;;E^lh z$%D3=z8_6CL)=W{dBB#6$M*G4D+LAS=aQ4yXB3!L@&?`M39NWU3v0`PE{HU%a%&fs zn7X2PKGQW^DNfA0%EV`!L_fUR8@M@nNY(1*?Bo5rG4r*1uqw>9gk>1ouQAiF-YCVE zIxFcPjnpC06?A*s;Zq5jtPCt?q7mb(>ZtHa3$m?)i;Gu{&?}&IUHU0>D>bO^d34Xk`oNWH-I`i_+Z)}LC}_<})B23qICpS^s~a`k zF2$CP6ukBlH8aYVb^((X*gYY&@mnL5fYcp%C}o$;ILG05cujtsa3)YRw;&NZ+fUUs z5BlWaWcVC`;W(5=BtggRiH>P83tIeDSXDZt<6!f5ce^*K(ozE*&dT)$g~6@mQeUv| zxQJ@qxKhOUdFsv@i{{0{ZAKPad~fO2T!{p+<+I~!xXQUVJ!BqcX#+fY5xpHjLWn_A zJxRXx8_w%H$a*=u)DOo3sfFaHj#(c*{6<-3O)vi~MCWdX=UZLqg2fCUTN+m1bC!Q| z4Tr)OEf!LHh#uyKvP>`EYvn-A=*|Xx+p&E1PP^MDx84CYK5pr2lphjhr9HdldWBQ_ z=JdGYa8YCNNC}`>J#Y}f;9Y~JIHc-eA3oeDtXUA^xF|o8#aRiTmuA#hpYXmE2v7{k9ki&%cVmp{()K>XJ7>d-w8n~c&D$i`R?<0p9h&kGnSIt61ow7 zrp=C)ILZ#cHe~)OUYzOo66|Dr;~Tm0`!By_EEbOZQSNx;5i~>2QJ&C(GP>suJ^R zilgtVnMZ~Ea@U;}!VLSZWF;C_xWdM}o?L8zjQBqZaR={kkGi)$TZK=a*3O<#`IX>_>Sc9?V9_{eEe!yD=wlhhrS*2W;>L+ z{r)!x<(*F#`s(c>^$iT#8QCYKWgrvj(>X9mM_8%zaEW#>=}mgOfvbPh#H^-Ry_yU4 z+iAHB!E;m+d=cbe@GCliA#=FaH=RVmL!%2&XSkdkPiVOf-_>)NZ?hDV4xX|7&_}ZX z7z7`5yBIbscS*_ggl^R@FZgz#;p-m5MV9pn8=ao($?`xVWNPVVJ+Jh$uDwTtCseuO z&1#KP`DHhVSZLe$<499#@Tme_+3;2)!Z;r4WRkSl@cnpvcnwm2%r`#peAHLjUc3vr zI3{-A7NxGw$Oh9q-oQnjmLhy+Ye@3!oIGAy@b;}~_o&~_>bL0YywiH=6w?Y8F(Sus z)mmA~vYtVr7Io(~1h;9mPg@S+xqCW0YUgB&Tyf9wIw(>#0#lA%nujDOEY3|vq;kwB*%XZBeA4xW_!@{~*roM$f%JSX7tzFu3LGzq z!q#{K<=@5S@8SvLRtl96kkh+d=eT;MBs8y;}M75N43?6*4 zoQQ5uW)ShOHz!7A-SAHNeM9T8%Dquq`7NxbiJaW@rwSkcE3E>@l1|Li?LoLY_4L5` zjVit7Xl_5jS;>P3;tKgPe&_jNHvY9e zVqzzCGQF#IPs68|$vg*H6gS_KcBF?7XG8{1)2TzEK3XuiP+Bn!BG78P()t}J^-JsY zG-#HdwR{vdnD0{A&gxilxX-qRF03-G9O6Kl!voqhg9`NHF@ukiip zCrx2`7P_}HBIVSBpgF#FZ8+z_wFc=eF~p=v|-)6ZnOT5i>kG-@PNK@Yb$$N z6-mugAWSpYuJ9lmbj>$Emo_Wdlo!;if@&4rR={52+vPp@D$<_RA7KvmoF!;=YP|^y6~<7|JLL4CKu208>e`4e zGtN$kjUUxu%(NihA56a4+{o?JpP@9CT^6yF#g!arQ$QJ|d zgqC9$&j#9xpAC>6b!$pkR@(l=@*v6~v2HV4EY^a$gY-a}`L;)#mfu{2mOG*0V=E1o zP4t&&g1W6o$|@?p-VjK&rXzLkbcoh!xzx<_Glh)VAdsV@`B)<6OX!}s`1lU6bFi|c z zG&*qEODs($>o*t0J~4-7)$}o`p>D<*%|yt4l!UZHS&<@ZA*chLo~2#G@CP9VyoWoT zx6{T}xCV9T2ul?Y&y;`RO!`w(eKt`gP&d-)xz|@708fvi#~)9sJ5%|4z+;~|b{f?P zpuGpLarbVes4;xr=~UsEpaSyVp?@wI@1%HHlu$4n`@W*|f+fKBk9OKxjf6{8X8LD!w8cn~xbyeO; z#X@rMl0LErzNV9#wtWM&DaK+hU)Ay2-rmh0F5(v#fBj_CvAPpviOyMJZIJf9|LcE^GmRylmQ z$^=e^5J;F3m=We&x7^|(!n`ir5kYLEV?h4q({TGA($IwU>c$k$_3*AlYl z3Vytv7%{@LYi^R}a1o9PyDR5glbE^A?A#-*LRudn0>Id$<{@LBXO6Y_yhubs@~0JB zIsB+6-77jX3v%h5F{2IFqFGj6)3H$a?0n-}-&qDPX6M^9sThfc?AWe}p4zE5>t@zJe0LA+ z<4*xipK&SNiX3pe&mfVk_tK{$+~0Y4!Yuc(uk+C4E@Y(rikUbS9&r)O z3?AMErI*FZs|~9Zi%j=t-9z$roakp_F?7Nyz@AEze%e#QTxM^L9>go+7Y>2{(k+pt zomIV4U+nYT;jo2dp$&HmwoT=(g|TwRWrKb=9X?z}|3mHlFE!Qh&w(E`=}3KVY7UiR zwRC(*I8g^zMA$_o;BX1Ki%Kb;JCG*YW(uKZFkzB`5;wWnwH|SLSU??iw^#w%e`}Hd z;YzHbsjVvJ4D=jFO?-o@mDS^f`;Ty8y8Q1QP`K9Rk2dTV=d{3Nqs%P7py1TEE~mQ9 zK21PgZxnnRFRBH|gn!3^{F)H(9Ymizb3-`Un|+CU{vj@ua?A|W_8zP~gVnJwR*voc|jhAhTm znMBc`-SS+pDc3F?GJZ$HdE<@6|?2)}7pVp@>L(^8p*pbZGi&=x=U1*mw4 zJxGG$mlxveH(@jB<3tvMw#Pz2fhB>$0=ig;RP|HLn|f${ zy(;Y6q;Ae>h4#iPT`Ifn0aXk1+ulqTe{>+0OsJh6NL_yJ9yDjU9nrjr1#=88g@G|B z97%tSx$xxOi;JlaendST*&ARmA=X?6)%KeLfiKne@rFEh=bf2(wMVtSn2~r@+CI=b zFrtZU<+*U-!ZpQtIu?ZtYFy}aw5I5(-aOq5zvt>l2~`5v+HUjE{UC|Y>B1vih)(H^d zMHZlEAM;K6Wv)DT{t#zAlPIGDW3;toB@uMqFkc$s>7hNi$Aq}^ygZ}7?BskJKkd-_g zv-HjYq7UL{=RR-Hv(vnrJ0&DF-?U%)^5ypX%4q7bz3*sfJ+EgdkJ+j2+@Eyb2|Nl2 zG5pb)-ERvUPn+_>M^0SmqRUpVfl`kLF7+~-4wl`DGusL2mFk-J-VGc-(lO~lw&LEF zv&>wTz&whl??UtUX_WncjD2-nRBP9^q=Z8%=+H`tq*77?0xBJ%g46(#(wzegAc!0# zB&AyCv+sT1Ypv^A*IEnb#&h-%C&XQe zzs0S;wRid5gA}VWj=J>VBkw<_>&r2A)r9g-v14M}UVc&9d!!(~Fo)!c^s&i4vdS(* z-T+foaP0M`(dXL@UU@hPp%#jw-wK~GrX=0rL&v~O?M2YJZyr5+CcMb5y}zVsWeHov$eK*^MyVRdV zY|n=4Q3+O(TCCXmQmDDTkEcU5nW8Dqy&KS7W~_l4o+jq zS_LfLZ;00@;H*4wkY{~2=Rc@>G?#)t92>5C#7*lgkpK~K_;wcUAsFn|dG1)phVLtF zJTgUAEVk^~j23BCZnwnEtDK=tQJaTeHFu8u`%i$g9QgHC zPWmn`2A0n5rmhI^cvg87TLcz_a*EQYMI8ohdn`yT>ikSfyA?OXU@lZ14#!%?M8L6m z#WWanm}3*xu=*L`%}pyM>-Q{V69d*kxSMaTltl~P^UPGz8_{!4AY8p+X>*jveYwmO z!mX9svX*x_i7Es%*}n}aJxo9CJB}_e5X=Jqrh=>EFVI!6jhnbUbpxQk?V&e0tDQWh zQp}$`$%sd!z?K9A+uPIrz}$4CExX~knIYvJTuJ7{S zH^xEN2y~WhvLm{Ltx@kCjJg?Y!Z#(nxJ+T43a5H6pu73;PRI;^c=(KZ^7!$ky7+5= z$B|fS;T^gw^BE;9_0_akvfdexWRH3VF8_a|t{VOzNaqV`w1ohE=FLN9s$er!Xm$S9 z0O{NPE?EhA9eU7W2mWrXEhH(bv8w)ogk>aXgO8yCY;|YWt9$+Az%0&47pZN$P!#-d zQgB$~DMmdzeg9r-P~d0k)aCJIisEiX6;`s&h{DW=4C5kKXIxOmJcHYa37^K+Bv<)- zST}lOll8;K`*J8tSXaIpsYZrh3&*YY4M9pym$qpg&U(z`)`A4&kOd(85Fky94~S^C zq%kJw$(#nu84b!Rb5?&LIXn(({I zO(3Hc>#5y@r9?K(Cb7?8AL~x*GU4u~jMHa*(mo7m{jJJSInYQNd10~b?a5(1wqXpi zR8X=Tm*`-RHfnkj<$;=5vME8+d!OKE=jGWci_W6T>ybFsA%p@oCq>b3D!mI2F{#1a zp<9#3H)zaUJFBNS5U@^;!5w~3ls4-I9o=pd1LpC0)?fq0Q@8vn-s`f%8IToVrI~R- zBfK~g`yRP9MIs`vbVMsWXp&b_om7INqb9ADU8mfZE+rlUQ=Vyc=&cNZN^HRf8`Q4x zs&ku}(&z6f@r&O3IS8Ps!lKhz_pq)Fl#Pq4bN2)(x*!o)%b-|2`_83d7C@|TCw9iG z`M>foBKi+yI{Pw;oYtICNA+Iz1*qxy+Gu>C0>EY$KbTRnaqrJvA*TDi-2)b`NwuWD z)4PD>HDI!`T;rM*35})E zeLIP%$IIEdG?&(j@4-qt1uMGgXs5SsDQZrK7oRDUIE$s-KDr(pg`iYHg{L0#kGq(} zPk#|@{!SYP0cqzfn8PK8K(nX7$NAw)LtnY!r-}i<*>zG_2K{fZ*x*PY^DRLzv>O*0 z>r)rg<&g%I6tX08Ze~|ft{}RrWll~lZzd5gA>DFVk{dm}D8CAk^(-N|-+y6p7|S0H zt*gpdlGR?)1(J0+lTX#A7;~a9k(?jJxU)7qb2w3!*|f*LfUe{r=?<~pB7}7oralX6 z0=dI+fPuyylaV$~A8#yfc~5)H4afz z{eZvk3PbHF#(wd0zk^`yMxIUhLwYyGGHVYVMW1+fR6jN3Y=s>D%GmfGY7wZQJghnN z>zk~7=!YYbSRa=cr&`;+y07d!HVF=&p0LZB1d`yj&!+495AS{1UmI$_ICZ91IV(|T zhJ%Elvb*1mZD;`L0k?7O>6qfY81&(yP`#cXxH`9%kibz2+d(-w@=(_$uVy>GcvnNk zqc-L=Ho5gs_b>#!cw~$Qd-QAPU+aYy16kJe{)QR`Eor7oWS2y{mBd*FSC=3kDZbxs z29K9BucX6~;LpwXi)4qRSXHacf*zZPz3ci?%a7^NLg1rY#+@xHpqi<41~l8IQO`FF zR)zy*6dmOc>7%5_>5Evrr}d?SBT6lMeCpx0^~bC`h!5R1f-0-h1|Hdt1Nf`4Wa4Z- z-MM`CJlkYKn8U#`s^PtBoBbPVg$5og6_eIu8S0}8jt~6MeQj=Ye3czHua=ogAMopU zr`_`~abwi)<|ZYcp&^<_s^s5TfB7>W<6Xes5EloJ4YQM$mA0kPh55D~M!OrSKlihI zVHWXjztQoWWH`hH)EDNO)6THvhNqzQaqgXijc{d|;3~4MxhHdZ<`huf;3ErdOVy<8 zYRu@xT;+qA%_5dLU1#6PNp-#3qfKA4F#wb2QGE`oB#^K5GsE*0`$QPkgy)>*HIu8XFpc!t4M>zr>h!EWc7HXV!XH(9_ag(uR--;=t;@(!K_d`T zd!WjtDRg?RxaiGE|2GMFOfVjARLA_ewJx3ZKFiNBZaOaAeaSOvB)t>=pp~Kio}%pZ z6-33rvq-)}l&4_)R>V6fWBtj3jiu`Q{)YJBOZfn)02O~BtCdai>a6`u(mMvsksxZU zbK2gy7+Kr}M2mw7_U&@QYYFXbYza3dPJ7E27UOKf9@0;S_nT5qn0~@WxV37tkX=RN zL^NT<62mqnPItQ3SAg+mMoC_4@g7x+h~x3-agXghZREwzyPBgp;)ftL zeoX8-1{oFA{!n5UOZc<`v|C+$8bdi{wmF@hmB@@hS8Kc>fYKu1;{tsG-qUHd(XThA zE%ab70ieY>eKzYos;{s#vFL>P%mL-#acjft`WRp7W_4QcU8%RKfd~g=FvBw*ZTxo- zorfpisvqDgEYkWA{a+(lK!&Ts&2FLdT;X(q^ONsN(Tr0}po4cyWpcxFCA9V-vt%r(Mu9`fqlk2JR+_dDQ~4 z-QU=Yu{=x?L8JWz;>A-X<>NSWcV<1by32$NJo^uQqEx1>#HiJEN zf#c)G4tH~>15H~)Xswcv;MIki&kuyNy!LzF7lHu48Y?-?1S>!U?6rIvw={$1T2=35 zy(Z2+d@3~J1M$`^4mc1PH%^@pc0Ky68zz}sl3*ZEm8pKa0Hd4!_*u8Ig zn?@tndzBbS72^a95?sZ?+)kU{F&#rIIHHb9IVA7tD-*0w)s7z&t9f5A(YlIV7;_qS zJF-Y6yZda>!GM6XCP$H(B3u#ZS#Y(<^FyHdDRFwgIhyH4NNXBH1ku+s;zgpo2C0*o zWvTl8leoHVJ*@LTH-*nKd1^eY^J5TO#9MX9ec0@z1JdIfQg6w$?4{EdD%Q$i(#E0m zw|@(XK2s8!_2_jCJf(jYd=3S>bfVM9R}_q;S2HpBQ5DR~IalhvvrjRGH~-+#kB(lQ z7AQ)AE#g3njpwHKM(x>5OeFxN(@k;lK;!+@$YX<+oj@=>fZq~yb&Fms$g^|AjjTjCbB9A@=?ctHkw zqszlQ_0X_N{O)NXwd>p{$!+MuQyysQmU=Ws%c5=_1l!=~U9gnc?}%3(B?ZMI+%gl} z%*d=nZp?o1@}T{EXqxwLnAT&?<(jC>B-x}|B3)i(?<>lOj=w}^Nwdw;2X)=rP42FtnD;&%mofXBJ*`U5e zf^eR9dhDr#Y0RPWo&W_#A%95$L_*CM%@IBcmRqU8#Q4Kc^-}vuMx|!by#Dq&h^L# zt;ak=I|<_s!HP+nFHRkwIDBSDV^Tvoak%r2p*M-WY*o+I^0h#LQXZ|M4zBCpTzQS*(jgvvhp>sq#6>B5f!DC{#^wKz|f#S zwrFw!xix}ZKaYI@@(h3XD*x@*Ol?N0t*99Mz5UOMccIPPag~Hi!7No-=smyI!zk{) zo=otL1sT*!GD-c=jheK~6boL-UEsQN{kCzcIsh1B?!>nFW990V+JCBkUyw642G(Y+ zDc)3l_ROHe=pZ2vJuo<^{L!Ly?o{bx+Pe|+A_R}aEy^(6nGOTUSu8NnIbP@86uBzED@?lRjfWtoMy^&JcE?G zX(efge`F7HOwjJ@kk6>ke0)bi;l3D-+(~8U(v!Rxz@i}t$N88%q&ueE7MfaqWgovn z;1Q6^9sUR6CQ@iAgVAvsu8}s7fWpEFD`>;QEc8}=y}kz+XuVQMF6+4UHDLc`u>q{` zZPx2m*&zH~)auYH1S?J7QVtElM!yIpcJVVGJFjBY=H*SGs^I|`pjFceEf(`7MIu=n zY&NGL?tf3z{Q4fhK7F-@*VQ#qyouAVBN5$t<7_4gEu#;1krPRX2_v?x#!zfq+)e6^ z$hffxu_>L@d-REK+hjh#mg1jYIUJ9$t|wy6qLTI1KwN;Q_OpKEHHwo-yJ!zN&)IbWwRs9cHBAkwyp;^r_H+4 zhfo1&z)@pBbvs<`SEVdX6#LtrjJbgw;^Jgs3k{s0wtm;sD2?Z#TmRt&Z;6fD{ri8a zh+?n2a)I3F4JBOdrn$_qAXj& zJy;Q>DHEbI%wXxOpWrZ8-+c?U=Vf8>;2*K^e!)1xlK?vCmw-mZ=+p%%UwhL$-jBH7 zy;mVT-Xs0G@0jh?<2;36?K>SnGYdaV`hzBn4$A@O%TEVIv+l;>paEhM|5dzZE1W}L zoVC(?QqJ8!_$+zCWM%Kf4qT8x9C_9S>2YoRfR^XVGbils&2cvE8|0NxX>{ULHA4R^ zDhltSG+HZ)lYJx+9|)BBunP~^05*ufWU%WUS}RzjutOvB9?XJ2Sw;F-Q5Epvu|N;{ z`y8)DxJ7@i_)FYlG@5Xm!@t@2$GiDk_T~4L(`O=Trt}aVz0|Ov%hBm(&=(}UOfar+ zpC!-0eW#fTw%lcasr8a~Bn9AwU_9{UP3~CQ1gsoWyER|#oa~5|53l-+i{21u^kN70 z|Hz!k0MDkGa=)F%#6y{hhj-@2&AW!OSWFI`&^V8Vitcr|i;@bK$e!yExU=aG3(a5s zL?Av5Qd9&CBFx&Nq6=7{jd6+yta>}_mTz{_Z8|>IWWSYjAhst#Q zj?3iuOO%dDoG&{`xg^W`9rNcRhH&?RP`d^^wv_jgW3^)adzXZB4qEX6FyI6j7Sq;H z_`fGf@J8buKYAE|jZ&0NB3uq8`T9*ae28?jvw7axgJlLmnN+T|1n$Xd^z51-T;_9# z&T(X|Y7+ka75#l>W2oS#r;37{Jb5W@f?_I7`(N!vxY-l3@IM`VEqa!uOAT-!-2t2X z_gNx)H&*6L_FVF52fh)$Zp~|2~dH6H-}4}V(*{- zWIlcvc9J>p+s@Wh#r8;3qZvBXzsq@OZaeMD3bbe+U^dOy5>8w!xpx81PW5Gv#S&PM zwc-?5%0{@zgzmtz3FE;zghg*MM4dlf#qU^gQeF9`ms-KkbysH%?QJmZj-Y#k^B=75 zFI)cW6RiUll1Y;C3pHP(XW^^8&tn-vAMY;(HS5VSlYZ4?P&(3UfO0?*OmR>pn>mFY zb#OPpu6#aj3i{`zzsaoc)ouMf;2)+T7^l&qr!N5Jfo8q|&D^j=gsvHVIsp8-ppgxu zZMXkcY=CLc=8s+g1>&F?he$)Z*)YD>fkyVFr9K6)eEb=(?+BvyFbgrNZX19G^1#-^q?tXe8-u1z?z>3fcvskY6cg4p3!SA9qyKl zXBRA9{fjpL&vcJuA+`sp*!4hn=QTgQ0|n#zevc!B*@!GzeY6u^PZK|e+)12k}PmxjOTgbhvHA}9uSD<0k8FuQqo^@s?XM2 zvG-`+%8B%$s#n1|##eZwD~JVS{m{LztGu5rO#gpF#XsLl!)0QzgJ!mLE_>51HHCd9 zE*h27lE*v{0aJ|Q(+9-k9RVvXMOf~~qV_cDLcA&&MJeuS0UPE7Pt*G|Sv7$MiDoL%7jX{x&1@k48=ZR~;vu0RATFJ5#DJ~! zKVeE_K7}v$00L5=3s_X$Pr%Lw0QPU^fSp>y;={BEyM?f_uL$XoP;j;N%PDtkCHv&x zj?Gsh_(p>6uBNGsV0l1#?UHRHM1Wh*2nQ`FARwpv?Af0oP#a-7$yRScot0oN&sfzH z>D8nN#p@!KexUV*JnNo4KXPH<5}bt$5z=oIe4`Vama+g^uI1X%#S4QLct$L2)w;pNm&-%bqROD{6iuT z5#`dTjOdl+;Ume*Oy8V~W-o|`WLYvk=Fw!dbF9v@RyeAaP?xvr_%uuO9Vs;G@84)3y zY@YWxS6I1y$TCzC7L2PQ6y)8qI@_uF+XOTHF}%dda+NZf>-NwJrNqf<#0=_1d&m3< z;I(>HCJ7%Fp&1yyemZ8d^WwHsJ(XQ0 zQtQ#rajlDiKI0oe*FCQZ`TYO+Lf)22UU!o;1b;S_Lb)sPCgJZHuO)!HhVvLKIjw!h zT@l@$M?5o#(iVRt3L`ML&q<{b^bE=t8M#lfJ^06=ZOK0hIbzbVC()bHru+?CX8q!% zwbE2itiJ>xM++dI4rmc`O$WZ=pn2j~<5#X~j3hc(FCsOPW&DVJ-&j~?cU6C#Kdl9C zma7|Dfwzb0qx=DhwTP6~81tmZU4+x@M_9!`mnrkd`QK?p&S}6Qv!rx&Hf$Ke5hzd`K;#@m~vp4^R$ZUb_YP|{$&=VD84KoK2Ch;*r>zt zPqyP{q{e#EJhNe!YPJzjFP(@bQ-FSvH>|?d#tcV-}EqB z@3wMK*=B^RhwL19-BeyNnsPEMzU*5b^MP{^J0PeRHKo=t&j#4`Pl$%*8Uhv}w zAS2DN{&00uJ53W0Ur<#u-rZn%JwXW zBr3kcsHY3-(&zn2{sU|M^((v=mxR_`%+#r=eOPXPj#{pJHcOy{C!*Mjl|!ApOkJv;nO4amKmS}J}hteXDY&c>polHfVM)HaRyE<%O22$o8>kEM9+I4 zNU^2gaTRmaa+KqXIR?G=e?*Lb8|JOEyqg4-Mkz8*>)!>UV59}$=C$PIb>0b!q5u13 z&);(BjRMEE2cT6COWR3giZ(MXs*-kn<*JT`nL+!f10Ad#SAubl`A%nC)>|_<&oUc{ zI*fW(mgd*NYr@RpqDf(nrkZ_|;9Y>(*?B7%WYGXM+?uD?yRv0Tt$r|tZjE=S#A&o_ zn0XI+G*qH2jd{|8+mM+>puM37UdUkYr&Uy^z+ z6$`rw&(MIfuUx5Vyjj z?hzg6)xXVS{%&P>tMTr{rtgW&diIh8eZB$iGW~SSAI~$z6*LdOR_)_6?T;J`g8HF~ z3_Ncv0n(;_4eF`N8d6{H3t!OnNNmfFdyPssU}y7`smX|(bH11{KzX?wXe9F1tOMwu z6(fqxodoseqG|S+kULgohbp&H>K+S~_9zFvbe5CC!K4D6&%5|wZGd6OPJgcUCt@1E zs39a@;8q)90rdrO%|Y{Ky|m=T690ym7JVAdZNkvCu+BWDAX>tF!@P<-)W3Tr- zZ6GT0ilqt;E>(?WmCD@4ICG_UIcPPwRGb@jvGt5Gp!Z~=v1JZg=FFI`(lli8z6Cmb zJ#lxn_kA(R&*Q3(4T#!3ur>LAdc=P^#{lcYQpEzcDsS}cjR`=SpUc|W?TYoJkB|9Q zuC0WkW>URfC6fqOklcd}b>JNlWZ%bYE5vMn&+Pwxb$u~xfk9KbZ>twqfIr@?4e&?D< zvk`yg^{85x>DXcg^ZStzrMW<1+##`GUZi9#K05D3R38hj?7SpkKmU4c6L>?v$3Z(4 z@}&I;@*KyGsxklO%;fV*&8kW0kI`_UtD-TO{M>S}4T zp5UP@ESTU2MA<0*VWr<6R-8mp2|pk%Tn$%VULIfo)burfr9S_3fj_MA&r{sb6S}_E z%L`$PKr{gvnG$PXl;MuGT!wpAJ*7K-^f(6=G%sLhFlZVVX?`<_vTLayP}JlTAH7IV zZx*sCN2^1q6h=-tT#*I&QPd1a5o9qrQ(L1k%s~hX~YiGFcWc#gY0_A`& zxn@Wrd}mqXQ!yW&B^=D zUvcuo9Ti*U$Id|@vDI)=PGb1ut$E)*I#HEDdqPfa4n5Eca=2_H8DgXKt^%{5Ou6{$ zVf#5HeWv+w99;j&=lu1WsZu3b`-M0|d9K&?I)fJ0N@hLnK+C~wuW395$<-;_skcpW zjsaUBo#L5k{pnaNaYlwjPWzuPy7-4Aa&@?Ub%E!d>~O8Uj5icozUK(q6m{#`OL}`9 zAf~Ce5g(}4=huntMcx4oiOghy=6xePV|C*J=-7gK*N2+N?j(yPbT%wiXyM!U=ZA%> zBe=D~K?fG2jEwfcB!MqW3#qX-x7kYbJ(?I+wM5W_r*(K%LMDegM#7k9%}8#Uw?r zQxKq44$2--=k@|E5g)HLFXe<;Y9@8n4p!AY@C0`O3X;U2d|Q%#UR{$s9~8{JGhC^t z;toqABWY=DsnF}UOuVhQVppC#a{I(yHt#Ztk1pK^pXyPTb1ab)OKtSpFbKN;38mEf zEzUiIC=6w?{nzHN_SFr05uVUrVZ7HvrreP}J9{^=Rem z%{+UJgj#n%qb7<7+bXv={=g*zuaiy?Oy{AR%9KD`zLPNuGz#xcy(u=hPoYzH?*u%w zG&q-I)w@7N9$o$6TM^&SfVN?PC}vuTaz>~$lNQLg{%-C5zL3D_6Xpq(-Q-`@24g7MT>~t7}iY1=~CoPn%3aJqUkArjE%zttAqPM>hbp~bxuYd9#|9n zi)sCSGyQn%#$(po#z1HAucJ-4J1w88nLjpq6_z~(9S{RPUNcpzua@#m)QI(6*o|&+ zV}-7u5}@YNqzMD$?uP41M)W26*<7C8_flW|arhd1$z{{~&-n||GIKLPvlvL(<~w}q zYwToyPyJo|cygm*M#lFIiMkm&fq>7?Zcy|m*O`qw2f0AFFtDIh?!kJ?grl{gSLL5^ z_XQNHY95FUay?RO?B=}R_-i3~aj^5lftb~#Ay)mTz5MYd{%-DgEdWxxAN++nyy>A< z1`kX!JR7jiJejkeg=Wz)C`Bd676oXr9{>x4D>>wppO+5f-1Zwhvt7lE`3C8_{^y{| ze$I1=P0S;dZ@)u#I?!-vz=m;xCm+axO>}ovi`b99Esh%LXV0W{o!N{R*8wWVwTthy zzXuX9c5eU!Ic_U)w)^DwKnW?=0OYtRRzd-vz9Q16z1=tTm?uo>4d~pbbAs@R&lw=3 z9Aj@D{2Oa7PmPk{Mu-CEZiy_bI7(r_HoD>Uw`T3})O#?lx#77yD+;KSbk}WChD6s7 zZe3U(ey!Hm7)kl2UU5EW!G9(Met4#SZZZ`U9F%+72F1CcbBp#SxQBWx+_9>Ht?un1 zwpgN10CEr%p|t~uI;S5InyDtKESZer9{s1v_SfBiewwp4ZrbBlMTmslsPslOOR-8m zk8U2*5*XlNz70AGUJ;`VSt#Y!>D*&k*j696Y_p;3A*(Nn`qRVUt}2;Rl}m(9M*wBO ze_oPz4KH!3Sc6^w;D-y=A+`nj-q9Kn9Y9P3o*2HFlk@RAg9h|S@CV>?ogiq-hx= zHK}AX()wsNdKl|o$vmeU^{La02G~rktq7y(ltP!pcCKUokz|DO30#Ztg=~_FH0lIc z)$^QTml6Q3oFliz3bT!tH2?d){_$!EIAyT5!ZQrz2iZ**b-cWxNit2~b?Pw|HPDfQ z%qI#f(s4IK8x7_0ou`Ijg13#g#J#_awor1u(?`0WZ$;mIE(-oxFOU*&v=e_rowm7n z&J1EVwXc(pPJqL+_!|&Ck5>*yd+LxhaYmTFlbZ`t9>sL@Kj6r;+=5)Sr|HwVkl;Z^5JRtc)g3O(5-PhHZN`}j_at9=Q>LJZg94mI>_Z@j zq}*aM?>=Fj1X@H!afj*a$41~qTfnl9YPC+l1Ez}*{D{skoiqOuJpOggxUlQq8w1Z<&LSqkRv(hM!-nNyuf>L-b6J{hq4Nvod21%mS) zax+5S)@&L-Z~0%hh;1%z-%3Tmwv#OX7*j2{$5iULXx4Mm+4>XOvq z!r7w5CybWB1Oiqba9ld-Q!n!{&ZsZ@WD#!-CLTCH6Lrz5%?2oidD;%dj6f!#34qxj z8ol6yZywDZ%nN1w)GJ&fYF1|-?IRDnC^}~BU?J=N4(2!hS?jJF>JE^{>4v-HK**mXvR!@f@HT_QBsn z)eg=v5G*?^W@KE!BTWdGX%qxHlKgv!goR5L?t`#?8B^r?tx`BT;qAV>qBQ2b?a>S% zKN+&EF9I*$4N3(2xbZct8T& z*y50Wv@T0qFz{1RxsVo_q18TxaDBE~SN}{M3taM?;nx==O7|dLJ)F@N_yABo=0WSB zjy86r>Id9<>~+R#0sx>sUe#*W?zhB2>tu)#xCz$bFaMO!@Wuf=gx9PcXEBPTSLk28 z2;7`nmYMVgV-n$_1NN~9%WbkQ>R=ZI==7}lmY*=ZZJIys1%qLKpH?6OJM>Z{c=OBe#3PY$SN|UdTQ+@ zJGR>v>=g=(6C%n1B3?Qe_o+oeQj|Unxoz@;iD?j{7%4PGh>cK1d1y=b*#U)L9NKEn zfJj=<+-&+|d%N$3xle;7g)H4vngMJazv&n#MjWEvV*eOCwTcfglssObHROw(!Lnuh zV3Hw6Y9}4%-&p;`kL(LUgQwpHQu@DOefVu=1`3XQNGC;$aw{)N(l!>?k{6l~qgv+!TGam7F=`7b56-IS8UfA9{D*h=zrRX`VV_>vH*B9P z?&=nPw7Sg%Vi@J>?NQcN?184<;8f#UnF^AS;eIFA5oVfH#Ihu#wKK>WT@_JTk>?GlcrhyS>&&X<*Pk>@*-(_8XaBHv%l0FHq>}0K){?9KiqS3E$S)tIg4ZB zC%NnMcHxpuIm_5V1+!>Ulw)f7hkW4s1IsoTlU!%AGhF&gBl>S*9d5XnI4_o0e@2Jh zzazIyT|i;h=TrCAvey=(UXBGTv{Z$PB*Y&;Vkm(~_&k^7%^2V9zbA|ZbKXRRJt9>R zNDPZ>lp~XDAlhT5=ySh`zPyT$(6|M|_22FL^W@HG5=2z&$yKwkXcam1UsPv+#J;G% z)@jPx|Mb|3M#H*z-TCyliD^IMc3!scn9lB`4Zw7+ydyj{>T}>->S5J-R~ZG3hhF`5 zgOncE4PQ^3c?)mo>Lo=Wp7GoRvf=sG5t6XtE`hH`#;{*03tLM(kr3LjR*~!Hc4@6=}FdmNPqU=*qy zi=83{v-2kIz@E45ncl%Ydh@dB-vxc}=N#vv@kUQ_&_eJf+&$wa zlwl#a?l6}LT2YbZn7UF@KNc4wjRo@p!sw$HfYPB`n+prH+@Jm?c9~@9d|io%JXh+_ z^Q7GyU(H>5-s2A)OK%Mkwfw5>-ZC{|>4oTF~FE7*2Xv;_+od+H& zuPlACNnHMB?Gn$64*;?Iz|8=&YFC;?j?Kpvy6oNsgoaJy`)ExdBO%5WE~ipQW3s*o zK$LRNNl8`cxuQ7OWv9K3;oa}tLdF8xJM%k?pX?M&SHX{YV823B_Pmc?)V=#U(u1WmJ^nWmU~Gc3jikStHIF^eU?M9eUhd@lfFY zCQ7<1djft3bTFQ5oPeuT0EHDNprgpc!*TBa$@9SF2$~=L>C?x?j2vz<7Xo69wD_7_ zv3 zMIjK1mHo}F1N~T7dw9;0YLOTINIg0|sxGNkkRmjf#AcTzUwIO0Xya2moa9^UbEN>S zUTBCzPM#~_q49V?!g)pZp(^_dA)%aXbw|d;S#7ycTy2N0yHq=kZf0$40;X$o()e)0 z6nAFWa!$TA)#oN7(JSo#`NL5k&oX0Fzc}MYJP(~E!BR0(s0tiqNwAu8v%K_`$SKxS z0@j;J#9gK=cawy}Q#@~x5UuxJe;$_b{n|YfL^ah;IY9ULF&;Q(N;)n$@RHhnir|00 zujED5-eWX>$2p81C7f_VPE8PiQO)5c~ORV7K(E|cNOzyK7pS2F3gPlnce!|c`TOm-D^OJv=9cQI`=SrF3&5^n=Ar%h}Y>X87W~*xb z6nG+}{e-KCF){0DI5nOOmYO7RD(W|$|@z+-Ub`*7hg!Lqe?gqEKA?{8o~JeYd$rjh67RnFT4Yr&hrp>;CU zxjf|9QcX022!5&`clqmPT92^aCCOdz;$p8@S2%yHKflAj{(v7OOFnZWk6?@m5u)pg zZV83NVJ<|7>}t*Pt{6nK+$8eNqxY#xCg6>`;i#I_Ha~p*+mDygM>HQ1AvujBN46X7}qUl^;pLL#g$lie(Y4ot9Yj(p`f+? ze*G)Q=IPf?1U(7K#xwY6YE_M zcP@P29{>7k{(O5{Vc3z83#x|Q4NpACdjjo(#EI7l7K#llIR*_)jqeBlarY(}T{&5o zslY>ci*F$dQGXc0V*iXM?h5gCdD$0DBew6$PfLQgzU-gyRP{pkr4QL{v$IKR z4(CH$v;qQ%S;2vMMfin2Cm-`8cf!?Ls;i8L!?sx_K9~2lPVe4$!;xI#^+5 z_Fnb!W2=kDOab6I-lNBQc4#tsCVPk*N0dv3;SM-PJW6 z@$E0Cww-^R9o@NqQ~-+NIio7GnkEDWY#UeKPJ8&NAjNNXKwV{?8VnOWc(iju9L&fr z{L;c?()~tr%l@t*-cfb?Tahyo8bNDcU^4Yf9#s+jnTAtduL;eHhtsv8p=1~R>=HAfFuc8G`n<0nTdL1aFFwuF>Tswg?{1x{eQwaBhBI5F zz~g`8t*m2l7ILWrQD?`2j3fks;1B8Rx-|r%y^)=C&tx?>xt{GK?Eu zZ+ZD_h@Q^5sVzYg&L~;`K#sn>bvjYn}kde`TAAt zLPxzG7LA>rY|@7hvUSef)$7-eG2!8P^w>VyS<1dUtpWTDZ+vs(~nd%a}WlC4^4miF&!oyAOOTKMNbZM7AvgU`Q z=~=uo5*K}uroT_$N&eQ!J9Sasa_xdEtgWq$>HfHPQ?<(ly-(~fSSi3?_fhzZSrkCD zSDisa(a}R6{0Im@7l}U|bN1q{DGd0)uA*b5!9NUYvhZax35gvfQVh}Dt#WcQAk5_D zB~KV+q254>$xs?UQ+5ci-fO56w9_>Ay4PMs|>!Vt383L5M1Py=yZp5TU!63T|=AB_cdQ78oug7IDAo@ zi)I85RFi~nVl%@erD}&l(oF<%!BLy|%anjK@gC(om`=-`(96 z&$+A8(CD!^5#)VQvu4PH3UYX&unmktTx+p-nkVA}-KQ=|@?3R0n(yav6txM8iJ{*f zW!rMkvFAubt3^ZIxX1?HVq^7Cad{4PJ}~~0vI>kMeF;N{KMvDYNTEjK;jL72jX5@QZHWOSXFIo&+ZRgIN_?*IK3tQ>^^$Kt6tr6x5jTbPe zq?sngE?u!Nf3dF><1|jI;vnvgR2u$tB^sK$G!5Ij!N_Q!+f*e0j_;0xJusn)cN@Cz zJ_s7__Q^T*BfG!@*N=ACa*Ij2;+}27_)UN>fA1+CgV)|QF}}0=2&Z`{@7c=3+C=n# zzW1X$IxZN+q@}Y#4PBC9sEbo+9gV{zS^T?2|HNQ-Vm_N%EbiKQY?~*Kh8|oQ*-;S* zh3aj^SkG)Nb*rks3z82tn0+n$?YMQt(f;*Wi=%M{<+1}eyLdF3{0x$&6%L^#dNn;Y ztBTp)Qs1PcKNY@9dn0toJ5YMRsa_@auu0-#;B(x)Lqg2rWrmHW6t9kr{;--$wB}nY zqL*G>^>0YGz1e+Cr}d(dl~U^L4}Hl1toJAU7Z{~Z;~#Hf<528{==*qyTvEj$T;0D! z-h3xF%j?>$WqC?PRXASuR1mM!4WrQGo@8HKYUT?m99!6wFJM*2w)<`0476XQ?YH_! zTdQNHqPZP86uvm5JQZZ(;-`&0q@t*b+{i3M>aE;-8J;eF>99C!Juo~1rr#}#C5nAY z&^H{x^g$aJP#sFzZb8WYP?hjSKeOcvd?>hJEg}PblW<7F^hi`pb_dHW@SRqmbhsPB zPd2d8-&0I*7J2xjt*zinQsfX7Cmf4cn2DaXwWVnWOl7H#`BKBdBJy-%0I6rr;WHPJ zr{C0>ScPMGtvaP9`2bnUI*23kE%obdoNIliL7Po>s?48`vDX$|)YPZxDwPvE9lwr7 zyV;=JsQ)x8Ys)qkJ4i|i2@#&=?r!9&Sv~6b_z?97JBd;5|1W4ej||L6i6U-zBK&7O z3FbN2J8`Qq7yMB2WPPStc_jx=U~%#ngUIy-aTr>OfYaf5A9bI+F&jZ9{r(3G?wvymaqmPJ*7;DL%D`pvpfaoeZIBvx`^*pdm8dLMsjFB%JcLk=N z6?mfTf$?rQ>9g$zmkkXK^?_;5yvFU9uii0|Ev7{WGQd7Ip$WWP7E9R4C@3zCyPUKv zw6$gPV&2Ei_Nz?6lN%&qm-bRmKthw5(#z*Q({GuC_DcXMrqe7>6qZd?r(+o}$Vn#CITqU-RI2d}0asza(3yHrHtFWKyRDMVA=+qvIPHwx}z^t1~4uHZfSzftT>lE_fepls}OqiN&o!Z{1L75c6Ldq#_~? zp4nlm^}~K+)s}La=y8_QgkG*meok_)V&Z-2+AJ`h$zQkn41RWcNXU30nXPB-a9U$+ zyUw5~pkdTh>E(wn1V^9_iL*HiNaFZb%|!_6$lLltgM^S(?<`DBEzEWnwbU@vh-1L> ziMak`l?IYURab(Ge`)#R^9LdGOzNJ~wJtP)P%g|djmMC@1Y2DnK4tCZQB2p95@FrT< zooSqfC8Hr+1A4J)YI)*p*{__DJ3m@mTjb)I!yqV^VdD^(0|2k9nC8+hZ_?M zVy(lfNBw?YFQd;BeM!)DO*|6jSB&>AWXI3Kaj!UL2#h2TMRgDmeR0C2mI-CV!7nZG zC4FHfV4LDgYcKK9`?cbP1$>L#ELkwJSF8Je4~jtQk|!tUCgm&nxuxMtq?}taeJtIV_XKMfeZ>cAkwAAX z`bYTm57FLF3~xH9Z1otFZE;f}40%5^2z{%YY3b}}HagBk!xihF5hQ+nz|OLVTm% zT!lPFu-QiY_K2VKh}({3v#mH$viuDvM{z*k)e5N;n<^$DYmuWOX6t@R)mn0d} zJuDcW??9)=$+div2fVs+azQ-m+$v7@u9zp8DvIVk7=M2YXkj;lqNXa8vqJ0Enj}E- zU8e8F7%+IYbzcd%1R=V9qlp~9+^6v+>4d~Z?~Z{Q@Ck>4o?lIkCjs$Vd*Nya-&Bz? z&8LH>b~{hbDlc1Ccm-JBabCaaPe9^Zy(HE!Q;|gW)aAr(Q&JkcS1m?t<*Ms???nJA zze3)4ND`>748h8;S#|H~_nh+VF9n`~s(u%oW$vj!RewR;<6uVY-UStj4Wo*MAyK!a z^yzUMZY=MUb;gD?^4%|>OJ_!=OATou;w>zEnNWidb}IQYN8cE{b7wz|EiP1VX%x{V z)FXJbae=X@eWEnt?zk4xWc3VWLra9)H)?P8l$LI{m~JO1ZDc5k91=cooozXrtwcQ^ zeE;G?y$S>q-hB~!g-dTwOy;4*lF*97Day2IbV=uv72&!W?vcP^)w5z}x{zr8XH`Z_ zP56};&aS=rmf(c83^>9R?6P4Uu^TY|CmZq|Tbohfom9W|-}U8khZ?Wg+40-ReQ>0_W-NHh$D?hj{gCUL(VH}E9HM$ zNY{84&wZCEGa(}L;N#SV8;|v+urED=KDi*}52-kKR%#<1+xV1*c#~m6_zi}};I&q) zAim1o>w+IUfDwGasdH6ppq-?=$0fd#xrkdn_B!0KAcJv$bk?gxt%_e9&+=L}!E1Kg z;yi`V&z@nuJX@dd?4P0-r1VAa;oKPL9^=5mu69QLj(_HfE`P&*t9_?fU*MQNS6L3; zXYU(1O#5J_c&v?J)J33Fq8}>ARr|QNOv2WbZ--=#w`n z-iGq+pNtF5R3SKD1RlMZxFeX$J<7_;bRS`gBf}7I{*AO5Q7Xm%o#k(yEe1a8{Wyfx(M{-pwc(6(!@+?J20?>2NprrTPI#C@T9%t$9<3X`lu4J zB?o+-ZUpGeRXpoHyM4g<9fw2=A8L7dh`LRqHg78ephZe^AT#7y+%vkdJ61omhAmXA zIVAQs?V^)+cfzNCzN1Xww`4kbQS?llt!5=o&-iF#wDLX?{Bme`*rXYOT{$&2%0PcK zS9w7%)O7j{oiC`Y5*}(ADVo@9wmE*Yj`w1O`oX?^(rq4RT;Ge} zq{(Ia4#Pq+eu4HojZ$UqT8+??Jh6gN#6USem7`)ba$Q>+J}zWC(`JTBb_xM#uF8g^ zI2tN5#ptFesWU>`+I6uPFF1X78=|Orl#I(J-TD!@^oiQN3KRoJpOcfjCKJ>ByBfcr z=H(bIY`_C?T52*CTMLxu4=o!_JB$dYY52{ufKL?^S@}aoy`XqTCw}vqH8~$0Zh1%Q za*dy>(Y%kðdfQuXlC41D^GK_i)DE{8Bu(v?Xi#gU!k#uK}Kzx`$g!*|-DXCt}J zd?!T=_>wF_mBc#r)qu_5HSpdy)i5A@5vIfn~Q;N4NOu`tfDH~;2sVNH(7 zsR7+|RN$Ew^0U$8Kk}z*$2T))(qq^5;a!M4evrY*hIHyg8|9~fikp|MtJjTN%Hz|0 z!FL`Y8D#N!Ro~*%Dn-L%&1ke6%0^*;zg8;cJwZ45Us?kFm& z(0L)uDx`RVt=x|Z+1SLoJA+^%L(-A}b+=ic{z4WmF8~Z8;GQ<5e0do|y7m(|I_jvF zP}*JBeh(u+eY<-dAvr|?$pc~bL(&x%D~8oHf7$LYz!l+IS`VNqyYWW8A zl`r@qE_pT7t<1>HopzDRd-b$t`&iU7rMj&^*($^$Zn5?$BS+z55MhCD+Rz!$+{n?& z@c40s(@gozf#ddzgEfm2^w#+NHB7`6??ebIIzk<6u$IuhH&C0>i0VcOIAUkp-iT{} zVY>EM87k9-_WcnK3kH@~(`s*LS|vMslTO8f)Z`XK9n>)G`BjY2oTI~z=LsslHT>Rp z(lPwNWO8A~*isjjwG4=Rv``yoDh31uk4ed%X|!B2=Z9T5p0yHG2K&LtLJ)*K z%W)(0JYDAqWtEA_o5>`$>M)j(757o$x`=!J?094ZU&r$hG_|ny+txsvoC4->AQjXP zogp>_U1n!91UztFmrD-I*+wdwz-e9-Xrmq*Kx=~TO$O$iS-hEF{ohNnn|<6}d})z(iByna>{?nQ3z2kG#TEJT_#V`gy+# zI;5T25M|=i=LjwoX43Jxk7ourXwnNGMze_;y26ow@f zsyOoW?0s6=1vO*sSf2lL3}2#@1d#VD=0}fkwI_FQ4EC@gUw;27f1K1CqBbTEB_Vm1 znNo76(?eKXoQ8>+xw$Ehl0C6|YGc_h;T~IFK7?IWHfewpK(A|nU&H;X|eA*f$hw~v9M$cTon8Hx=8N5t^_mJM;Z1- z|8;o5E}k>|tf3kj%u58k#o%>W9V4-pVZO};i&-i`NDn1-Ve=`IEXj!Cx-me!BzB2^ z?TuKUd#49-?aTW1&n|$Yl(70;Fj7Mk%E^iy`~G3>Rn#!@@4Z2s>rUH z`PI9!0UAcy@(+ml1Ec7s>nS2Ys0nVkIBtEWNQalHKoojfGiSYg9M$aiE1sL6*WfFG zZVkPWNFHbXRny62P~-*BfwyO+hB^Tz#NRF_^IpQ&4{c`5X_`sr-FmwnI#gTca}N(3 zUI41plf6~F-6fZO(c}+%-RVenq>fHDUpklN6p`R zr;Vqp=mrY33DZIq?@u+h@VPWiG**#v5!r=M| z>3{}-@9~}&?fk{+O+~GDKiP4)Gc;p(U=i)0a4wtzKoqd(Efovx-~KQntK4cuW5#T} z2f4A-i$S_y_2#+u(l?UQLkJn$u3f}A3Y_Ci-0p=9^vhw0V?WB8=%9k;Jo% zr7QTI?~B9;_j6gZU1S6yee)p4%1ot3d=tZ8G6WuV4_Byp&{Sn_GZZ?P13)KuKnjaN z8+2AyC))G%QmMM<}@)(rTwYpLpA|ANWaw=w3^!8tpOplCV85bx;O z!pXc}=x)4_lv- zQBc4s)cFCrK10!a^W;c!y?_5c0N7d<(;U!#-23+3OlX$;|3$Hn%!TDK6F;@4hAhb{ zr6JIh0!l{jImu|>hU&`QB|{uR+7&e#jo%4?&LBOCXRJK9^2W699jfnAfBb8bk_#Bi z^{2yB%7dVod5m;39=A)t&#fT{t753t9Y^>Xv_}yTjy}l)TcTh-#r2*fm9^~ygBMrl zn8YtE(I9rNst^73NGJ%m8w}@;mM?&w5Jq z&-kqY33*)otK$b-N^! z6mmk%1aLEt`F=O2ZueVX;Xk})+u!k`cews^Gl!d#?2XV%;YBaC{3>L@94J2TUun-5 z%K_MxiCt!9euBpH4ZTz8kq-!N5xUXrtgM!A@$s6ZwuAU0X)Ro0eA088YXK!eUr3($UdQ5IPcAwtv9+@5dm4ub_b0ez5dAj+nbU!A})2 z!NKh^#yOb1_`C1QnyaTG_k0tK7(jdZckgP*zHsZ(D(s5jWop#rh>43kxGII!3tJR- zf8*=xVh0o;Y-;>95J{rGJ)91vGyn&I5=)5!F$G039>qYZ)N+psfS6_U>pe`;ELVke z#>u=!Jk8v|I|dpuqt!xEHY!t%c_{@Ycb^-&j%eZUiNc(s7@p$ebLYLbyRdw`0JJgD z%V3jKEy?LHw&EFB;t;-0d<~+u(tr_ZyPY#E2sYbwpDdNj{OHn}c)Z_bb&;3!|csiMRBJjoJ z^J547&-KJW1r?;`N%L;iId{I!Gfi-4mCZu0lQ|eoptjZxlU6%#6LQ^KNBm^jp_kIu{D9iJheW9m)ax#TRT*s`1^ z;j1Tj%71e#kf%LIZegO4mW{#)I%KIc_IVG5=AV5XDd6Y*i{MKCN&%?TyP%J0X>JC& zTDN>Jpiz4p(Q6Kik?(b27p|!l1c|Zlb#pf%tLJ^Y#|(bD%6Cli=)dxz7k}dijP35_ zli=16qUH0#LJoISikrx6-t$KcUZ69Z`9?ZJuWi8uUQ>n2(dLNO^w_?5PCXoXd3nN% zj~_oSACGjj1QVEy6}}p%buzad(ywaYSJM5zfG&$Dd@ZdBlCDsDDexgla{tQ@#!?@) zaZ3qJJ21Tmv)<}o^ukRDmziN{!3;h%Y$9pci{5vG4$l^qVWfXyxV29FH%sW}phG~5 zMhJwUDd6laQFr1d5>@Yd6A}()WZaK#)S%4m?{ctD_m&c#29IPcA8n40H+TJfVmjry z`@?hnMEVj!?{|Q$J>!XX8OZ*4T$qOMSSFaD!y_{#f$7nn+9@3%qpMr@W5V3?=K6vA zpC383*KK5x!Jn7~jBrL_0V`5hhsp^&*A@vpCdv6AP@d%JfGHvDdGMXkRvYiLv(Sa# zIjN|PcV_x{@89otRkVwcnb@-r@T#Xe6SfYyZlCLgV$R(lGa>KGTe99S$L8H9v%kGg zi4KvT~AnxH=24$&Y#J#=+K;|L(yb0NhVe9kN2@W^-$!->X`%CPnRc&f_^{7d496F`BLpG zfZF!vFPleC6$3+&ku@s*c+OaB$b!%x+mqsHR{hl8FMbmT0-7w8Fs8{3s zhpzHpk^a4Of4}%o#`yQb2+JM!I+~VMuZcn*3mTscWpT0@Gr8+PqY@Z`@a1w}=jX0( zSw0bABrcP>slf;m>xn``j`=Y#1eMawzv2*#7$aURz~~-Y_(K!Z@y(R3UIyThz)(~4 z0nj{dZ06b=JiSn?d^&+8}%}1A7@2aW++?4DmoZOB+3h zA`WZ<**5{S$WTWlNsH`xWH3w9cO4uc13o^AU0m&KO}P65&UiXh;JhTLXc@kK0RP0+ ztFO@z8RR76aV;fM;XwbVq@XOb3Z61h!ki%u?qER(z6?AMX4vYdHE^Myt7g(<{`;XY zpi3@dQQrJeU*GzLBVVDqYQb>n!$)ncS*Pw)WHiqodGV5BV_d1(u<2zyaG{ydtY&t0 z7mm32m9o4h5jBI392=^!8s`0l07Fq8Nt4k9B9lOC1G{P-wgPA@%SHNzz*S8ORk)C8x zG7Az$lu=#4tEs4Pb zS$UjI)r~iy{cO$~`6yEkaIOLzHdUAT4>`sJ;zjQSb6A=vh+|a=LKq!86_NPl_M8;^ z4hlZK6eKdr%An|@9_lD<1TomBWhNUMTBQz9H$Q#G$Vj;U5r1^46B=~5s9Z?G*bI&Q z5j0kS!5K6@FpyB?GKn$+BiKr*nm76+oIdFBD}FteNu4ZgAl!Uu*$D<)l(fdhSsjPu zTm7Dyk*GNv`$>hQq@cian-wijB*I*41SI8ut0(?SN_lj(L+UQ-fp^9 z3xUn}LntXZRujI<%^M%~Z$RO{a&InpjTA6*%=ZqAKLBr-VZT_|5 zyLFVlS02GM=~0*btCH7*N$LQpe6Am^p}I+ji}TVg{#B_xuk-rM`;L{##p?NMBus+6 z$$W?I)G=fK#as2w{L6)A#pX7=W#CQiW<7AN@{_kb8PbikO#pXwx+C68EMEy}{l&;e ze)n!3QzR~f{!Vsqzf6wW)b6iovso~Kk#396^(ESFZ~FtiaUv$Wi0OH(gdyVS(|1&= z6AmHO0R8p#h0*DG5``FTv>5U3Sg(yyJ7JNrO0**WxPcc1f`YT%N^MvDX^3`Qec!tH zZVfhN>qulqq6rrM@wPJJR>9tBvJ(Q_ecNML@MFL*guzw+_0P*{Pl*gfgP1^tF%-f>k?1j&8*+*RRu-;xt^6=?LQ z;$I!m_BD?}1@R~Un}u0G6Eo!f;MEudor;oVzPK;D?H|KC>P`pzO4*}>dl3Pz@odxro=WA|+hS6dWDFxI2%o$ddEmfcI2AzRzDp_0 zIRN6``Bhx?06*Yd3t7nbU0&Y=EaoKa~jm;PY zW)>hxfMx^}K71g;_)Q}(e9AJ(3?&!F4kyNQUUQzTX}*(3Y@0KM!*D_7^4&ZS-mLNJ zUdwi_`V=Lc+#?Og_!~PvHS)tfjvuOi_(Hb2(>j|&S0B@t1|IH}X9ti`5>{fLU@9*a zxzDXr!f3>qsEb(#E&*-qn@bWuAN7>tLZc(NYV5AUqKxGiGE!qEF0R$x(6oL4SkU8Z z#l`X!_A8V&R-_oK&tpdhK9MTie7QwGLjlT+#BhqbhE90Hk;r40hz4efv+z>X89_NB$G)uB_4g6IxhAHyx1-&uMxX>6e|?< zQBy-*D;;!hv{)BFSx9ojz7DzDUac$$ynI{)bmZ8kmZcjNpT8=5%fX z>+BlFWOZfw1?N2G>R$?U;V>x>8e8w@ayb@dE^&r8c(t4-U7hxgo;BYa#oNI+pMv28 zRe=C0nexmt5{-mff{s_Fw|a$+F@kL5gRNkVO5hNArb2GM2@2-)r~~-v)(ZsdKn(uY zWI3_ftWfCB2N=_>#Pi+#R}mLsNck&Ps6`Q}5p)kbq`P0d%~jIN6*Vy~{p%M?P5&g! zo*(gr(|g~t1XkG@X0LNNjF}xn8Yh_^@sTuZPl{UqJj~>wT=+9bh{t9C5l=vCNOSl z*W2G2pX~S;z$pvL={SwQpAqylpuRzH`dtP2Km}l3Sb16tBOSQ-spd z<$WmlW!HGb6+cMTC-qLZ(o@VFB`KBGt;mG&nO2zQ9z?g=wpU%_<;y=K0MVepG6xF{;m?{-@V&EmvPQ22q4;drru@mLSd zkqI`H)aDZ}fYl6#)VQ}E4KJ?z>NY+~bU9u6@jNZ6U0;~HsZ1sG#K3X?jPOM`z*zwE zhLrI2Mduf9uD)N(x(8h!Pi0)vrOf_6H=~Ot5*w5M?Ca!A+kg~qOELm_kP$nYmo{c0 z#~=d2Aa#chgK-7eYSIWKlvcnH0k-sX5LsCf4z-pK5Bb2`l5~WpxNX#Ne#$!|e0QZi zIJWFau5*GS4UtZ6g!)nTan7ivt23c~aeG9rAfAmn=9i}TU%lKF(@Nb#UTV%@}xG7C|H%LWEc&$e?=_0~imTn<3Qf zz<0lOw;=7jxHO%iP!RB+N6PfRe#_{d4N4;_r@K9g7a*e4z<`qcE3->sT7 zo_D~Fp@a%*5~v-11nJu9G^JJuuqkb`%5i{@nQ1KJ*;pTW0rfc$8 zkh^|`0fG?r={g%+TG4cRE(H;gn%KJgDOUI79k?C)#C~vyhq^@TB!8a>9b{@OCd03( zv5*puuCkpi#=1P-nI$ga@(FYkyx4g~`1akFFJ7DytZEr*rr6=|`|U6_ZS_`VwaGPq z)cS1G-cq+j6j-o+>EPqxLES^dUUnpql%Qg?*)*Q5izqeQ77Ggx54sIL;B}~n_#@ey zKHIt%Ye3+ox%kWN5&NF?;IkwV2U@I43AodU>(<1xy~PW=y~|>QpP0wn>PtS6_XKIx zM9;wP)~P~KpFYjOhruluTj&*u@XeB+_e@4d{dP$^9nh;q*8Jwj+hS{x1ouwW88+Yp zogcX*C~@dq9_ULhKMaBT?ym^j@5`ecN}TJ#hFPWd&HUc_$<2PAzuJ+#!Uo;8Y z0|o$`=Q+vv;L`fz^RI*~mw;!}+m@B)JwT_)JDO!N>KPnw*T;Z6bbwx z5Pr*2imk>9Rsmx_h^ChXQS9{tqR2gg0XmgVSGB^E4s5p?PE5RgC&=&&<#)ko#yDo4 zXiNkbBm;r}x#7#UrQgWhXefxR4jCvWF!;g##unx zdtXP&DLr|RK+;D^zDAd|Jon|#-$a!Ne#~OI8Ujs{#oYjf`%vY)mLf|t8hcxL5W@Zz zo=YbBRPo?0Aqm9jgB*-LmLw~x3+r+(n*fhaE#O(Ef*{p`qD_+6pA}RqC;#s2H7a;Z z9Ea~GxWn8rnJvaCz*!5+j@M6;=ts#oJ7-l}F<1-)5=#StCF`a04wPh&ec7U+O++x5 zSlo2VvYxt|O?5eApxm4|ay`wi@#_B25TD4+Zj;wymH6t0ON>Z@lSco%Z-?aR(&zUX z@4y8G@79JN1w=9PKi8A^G{tFf{C)27g5DQA6~36}cWfUQX#~iZwQd^&LYYO?&ZxeW zh2-*_<|S>zz-@5>9@;pk@N|exK;!4f-L2VDmHs41u&v#Rz|8E-51lCu^Z3 zYI3DgSbyn3hfxhHz;PSpwoz8|oGzMEuMpFADqIy{e9*T%eZ;{L?gUO`j;1&(qQb(Y zwPf~B;T1_y0}I)rzU@F95AV*oqv^OFVywI}S35ET^-EQ2aQj`$dsFu?-%1Yg-UsWH z^-aYFz&%ggvtN3ULMLFs&`Ob)Hp|7s^6KVj+}2j^-kDhScQwffM(;N@WZREaY5Q#| z&>m!mI~1*AP8l82v-)+K4z{+bG{~r~4X@d)YrQ}#O+Cbs2LV8!Vj|>7dF*KncfoEk zx3|?CMS6ef85&i-I}3QF>hIZ1R}uLFKE}(wr^}uPgZ~tQ46lwP#500jv+Z?Nwg8@Y@DB6vb776RH3i{Cwrf+xv2+T zYHAJ}U$_#nD@Jqo!x%EnSGoOTfh=YI#ZJS|m#5=o>XNvJw0?lc`qrxL;fm)>dz+4m zPjhZ@@RW=#D0M<{#U9=((QSz9Ru}t`e|0l=hH?Cer4^W{77vHj00nr5n+>uEkV@;o zMy?kHT{rt3_ZnvOWJcrTtggw0lIT{YtNm4T7)NZ@qTzFinDAo>S-kV$To{k!ly|TJ zIH8r3HY1EZI%K+P*Z=&ZnUBA*y+ zPELyM0cxbR>-sNBhSL1BA9y*{)|2fh*0&F7ot%N$4b^ygK*N>hd$ajdO8DvWEh`k+uMOFpk}qM0br#~w z;?Vu-P(Z)X*9S44&Mr~AZk;M~Z%C(?q}r~zJlE05I)Q)mILCKRg(6EZnwtMeYR6Hw7aR1Ythq@iO!@ePW z#U~w}$%Zzp5G#qcCA)Tw@sWC`s|%?+>7&=a{2cV<7mfekpifN+LHPHfZH(=$u}47r*CfA;Y|IqN+`1_>Vly$b%5 zOsErp(f%g88-M;$^-$IX$X?APIcmJ@8*DciP%dUab!2+L!+>qKou_{U-%jd|J06aK zTMlXYd`4&1YmI4HRbBg96tDam9Fta86_xR1Oe}Ufua6zzC5KL^cO;niXKKx_upbx3 zdtW?<_wui@lPY=FHp92>mKPGmm>Khs)=K>ZUgA zs_6Uc<*<}KK7d+c9N{8>dy5(aizT97BMu#;a4A*CjoI2=dq3TQKn9WCfV{_G1YRW> z3Uy!*i%kqfP^&TjHK{>noeJPF_Q1ozaXi zf}K&yB}JQDo9EcL*To5vD7c34PgI&0==`Jr;pZ_OMc*jzf+sVU>br^!@WZ=2K2nF< z(~81Hh0aWJYn**#(7g#Disr)p!+A0(ox%P#aoLyPnwWn;O}Qv|b44uO;x=Ctl-Utk zjH9l18%~Q`Kx8ULja)G5VRH@<5WRok&AYUH)6may($j!tM2^M<4d%hpQNT{9{YPEB*f@0S!?*jT-mybxy7=p_&u?nN(ml;poao~RkFPIw z+Rf|QNly+p?dp3?MQ|7cI_Sjl>YNAtwcp5>ieclaAmiWMMpjSS6PTmZ9Y-Y0E_E7w zdlH@zCOokD{8_VJhHpJt!z6r>R%)l_{oWRuo7Z~}$gLp($2U8FR2%5}kWf?$i5x_p)p2lsuxfa*Z|3ZK7 zY!oowA2*1;ZiCb;fVRt7xVec_ea|f?e!6jATt(cMoXV*%@;Rbty=ZA|HCgTXda3t8 zYB$YmN3`?z?|_x=_*Ry9{TAR?HilZry8ZnBDmnhgtA)MC=?g*E0TOo+o3BiNE(k&L z@nvGtUg@C#&!!;>yw)+efPC5B^%mvW7JG2=LUx7NoJyv4XBFX<}c%Zy->M*Y1o`+7D@T%_63$w+w`|)Q|6N z4Pdc{ZL{a~4G3f6?i1-2No$Mm1o{W%bCZpk(#hgm-sC5@2f2FE=Sxm5`E7G8{MLTu z8jb1gA}Tb7b5+l7U%;6FlBqS44!K-hk^^5mWmBJre*DgN%3W#&&z?Gu0rKv75+U2DL#V2n) zEdb3OC0EYO=(`?t_w@XUYw$dJt=QDrng608w!99pN$qCh%s_~T$NO^Ka)s8WdisdZ zROU$8_0No2MxIT?#k&vA78a~?m(FF+Yd+9S+40WlGd?qc|N%p8FODM4>7U?R>z*wXJnDzMk#u{m} zz8KvEx^jflO&CP&=8qdTQ4y*c;wI#L4!N;JrCp)FLgK|L5Fm?uo0G(lM~7E^e{mZ zrv)BuP0G$6<>e%IVo0;stk&r*?t2io?3u_i(lEkr?VaA}?GtOS$!tm)sMKTOkSM8Z zT0?{LhmCI`6EPo0ME(k-~PR}7ztmJG%**nTuL#K*n!2B6|+Fe#0k?}yV1-^JhO zw_1s6LL!1oN=2J@!tX_h*O{fia&;BLy7UB=Y|$Y101WurpB{c~)?Z7nCcgcKO43S1 zXP@74ytwJMoS>z6_GYg!BD&3Xwx#|!ClYXflOv<1h-k!gUN}ftF1Z82w0LTvqfS%x z=EH<3+-%Ua@Z&Jvei8s{^{8?lBT>GrP~vI^Fjd1)@MeIY%q6-a@~0 zHBthM%T6EjMNLA@PT8+D#b->worp0UT;l~8?Rkh$OP$OYtxY#uCK1ARb6v-%G`Ffb zH5N!%_2ni-a`wJ1hZztD`i{>1zQ>vR)6$Zf=gnTam6+?!3?5@-2a>z#y7}H)Ac+@b z+RmtjX7#q!!7CUq3^Y&E%XO1BQ=w2Af&^!w*CMCwOrR{5&;94U9yeZKrhaYmp9c2X z`uF>clAKM=I4=u&_cj1Z!&WyRQAT`&*RPgHx}OUx+Hvd9K6IbtbHU}BjB!<<>V+_C z2Iv}*INV!~j+*btSr!Fs|CEO(Y{5WrON&##Hr=KUnEdJOVd#bpnW;AIxN{=IU0YEh zAmYBq;CBPf)ebH#<++SZCX~K9Br7y(y1!V_i0MlsWWm#m?h{w{`>uNZbY%WBi}GH% zi};1G#w(}EdcFVzf>lK$+N;KZe{(c_7r||)i#&pd<>qs2gyz&gx%)1pzAv( z1WU`63giS$u=O2&MRkaJ79zA@m-mA^j~v@dGaW+7JrnZ@ui*1%V+zED1!MhGOTq-z zZClhAfP_2$GVqL?wfCGdqgJmO&@IDfZ^z|6zTNteI;+==8b&>^QaSqOQYp|ewrgbm zJEtFHe?O@9ZqHVXwthQ`ur&HoyN`bvFFF*n-b|;1dVX65E=yU&m&v8JfUwa!<+L9cNhQ=4QVGSZropv_sL@zUANCZMbhnipYH+wUzH#dhN7oSA! ze9*)C%#I7KWcYlj-fa8LP3^{Ez4_#dk+47F4cReLmlwbp_;(w{!I`g!mL1(iO#jIk zFEJ-CejPnffigQBGr!B3;f~(PB&2(6b4*w|S%wVJXe1SHIcKeUyVPLLIbYA5yD=Ny zm-zCX09fza{>+D^i4T?qEclDwBoO@favh=$DFvE^9?yY6z5cvvb#6txL9kzK+mso1 zWkeQ&YBi6}!wzL28eWGqcX6;IG=pRXwb#OVa#-~XIX(*$jZjjPcD)7M8Usb|(};w| z9h`%FM|~zD?F*g53GQ}2 zFD?PF&cW|iDuni^V$O!!6n}MKNp?CGFnyLe?BLK~ypt?WaRf_vFXf>yEYOhK9I?;&gPK@Uce~|wRT#2{yXibm zSQx8ELiom^gr|Lc{**o`B-llMZEiiaH&MV3MOV#~d%!@?+E3ErAR8gE4j+Zg}ld6#zgU!06R}07#VRRY|bh ztPef?CYqZAG$ny`#w023cON>VaT|@VdCcRmBu6FqG*FMU;%HRc$VJ$GrL3$XK8cK! z^wcnJFxRNbmvB#6RaNlr&un5kv9^8!Em!{)d29{9M7qTW*xu&|gr+o40*MxVVh05 z>?i{Qlt_jNQ-^w8nvd|L=g8DXf~LpS3vPeZSmia+BO+b4k=tELsk1c3tko>{BEwa-G-hEO;_10ze$tw(Rx;?Bf2>FbiIPf-d$ua z+A$c&uG^;_mRW0&Hx7jL{k%PkD#hRb2Oj_LapZqpv8gbSnmG&k^boWy9@~{NxnIGO zG9k*}hhnAbu4tmazcEBXB<+_9OzOkFuh41{RZ{OKD#fMObY=OD|BNM1Re)k^YABn} zsCu-u!lI=(Rs9=hKCfP=oSg8(-N2vamdZPof*t@lD2*_rx0VH@0}eThWx%gcz=re) zyKHCy{RN`d6Q!6#LqqNfyu7?To`)6*d~fjysrj;ghZf(RFHr8-5N#TaOLtKwSvqO? z$jz^%GWx6S&^U|=bF%YyE0xOk^M;zGTAe9?sPf0Wx@d8NkTOFO@d5J!hGUTUMPXik z?i16E_{hzp@f%#4o0-BB)lxykq=C=q+dA$b!&e1%cB+|5n{NM;eEy=Vrh4> zyPUfCfLF7*k#QuoUBY2WMC2ry|13c(jr|TGp?@$zDx6`iWA9)oJ3nFhhp7Spu((4_ zTJw!?sZT*YfGw)u6{r??ud)68mChh>lXiWug?E72@5kINWpC|T`kOBATpY8kn*l8; zJXU|~Yp(0o2O7L$42wyfd+Sej-T{lz`J|%4Q9LQi;MccZBqa9?uXgVYp@LCqh<>RX z(zyC_9AKU;usx%d*l#m6*@$@#%n9EBobyIbgahavsIS{1(rNIdJ15^B{h4h_C*=)^ z5*GTNW5{*eT#~Elf7dHJ0@1sA;kF0ZWhWkri6xpYOOue0B(vN!0ligL{?hpmL>Pi? zXX^q`CmcReAt50$B-eLyR5@FwN2(++&J_Qbu`#`s9qPYV--i`?u*!zu#D@Qslo>+$ zvOvzta~=gU3wHonnKPjGXkz@n|NLw(*3Tfg{Ur%><|na^*RSO`jAqE$uz%oA)#rDw zuzU7}{mTVtx}5xqs!YH5@#vgOf52$>9o?u&ABs$G&f!BaNE4;+G-m(h_EP+vNG*!A1^6-D!GTmBAgOG`}1Y-bUDg= z7_h6jA5WS$FWMu4Tboce^v;SS;s9uMgui(MB&R$rjVja;*oJPiF4l@yT!!^j78DDg zm=#;jP-*=uy>Giys$2Yycjx;v5AIV44(qIw@r1v?LSk+X7g zuJm`Mr!#nG{IoR0w|pDQ+PbgdZ)n9##ffQE^s+#)=*@HiC^$IS+ahI8-WZQg7895t zsnFIEPtVkZ^9Ol{0QAATI*DdoLC-$_betC7e{w9{k*cV4@^(!(zG+e-*7B^r;gDfs z>ub$h%;r-85&G|JQPGW>`hvCch~Mg=`!AZ$>iDzzt>7>t4X|wmX<1NJmcMsSb@rrH z;tybG9bTItZ}>C0O}J*NVU$5I7JAYL8PYZ!JXG7a>Mf$(y%xw zMt-<%Phr;qmQT%}*i&|5EgP34A0{#tPpqQ9uigurHN?+@#BL2`6F>)wq%z8e@W2y~ zA9DxR%r$ICm_2GS28tom)6=0#%U?Q?ZBZgR3S zYd`elQ8V773@}W`v=AHAk zsMKy>&R!E`L9{+FtQ=crs!1=bV%B-zoi`J5iF z&9ux_D#kOLq1^}jgSK~E^z70c8>;7OE&D$GcFI`Qsy;gAM9+DmzKbe8M9(E}RLwPh zEH6*D-?e4!e;WFsM~n4|LaEV|Z_q`yKbhaI;9H<>G1RyTT-w$y%Y(S;0iU$iHwk93 zxiR~UeuK&HL}{d6@oU|+#VS1vLY8JSGOQlx>W(((;$Frw_e3rFQjtv%4-=j;?-_YW z*~+`@R#0=OUcU^vfTx45EeE7SZW#B7L9FUDbHqZ}0<93;#_r>d{xf2!0==|UoPsaU z8L-m~#_xV}*#G@x-+_mb>(0{NuTj?FmCXZ>gMCxc3n#A>0+ z*t4(Vi;624Gq-!^aS>Ew@etqDfvLp%W9N|qyP+@EUe-8y2o2*u%Ek_nL#xpedCb>g zx7oHB3|zVFqu`iip072sXXp7P{T{OsjMhs^e~Q2#$DYh7)YDr9Lg`2cPlyT z?}We_2mE1S?dA~;tv}&luJ1An?0B~p&vSAH^PZX-LryUs1gi1@Or36KQRL;6@OHJf zb@)AnkH7vOV_yLl)%Lwj4AL@ybhk9p-O>mW5>gT(U6+O#y1PSCBt%78asX+hk&qa= zd#EA5@!sFPSN;9}-}gPwd4|n1GiT1(d+oK}^}g%uO&m=Yx0yVhe}jL)&Rne6GE2b7 z!N!(U?<3^6bgxK5R@Nx^Or=frJ2?SHq2hCYIg5`JqLZDS7nl25yFV&%h|w^lSJ&n%o!sx_JPAj;N4s-k8SDGwGb2lPhJ} zo~HpH-H+3YY2CPC3oZ{fGZaYhv5G3v6^PYhZ{zf)S}IM( z_Oy{R&(B0EYN=Ac`Z{3M4*Mud1233x0un&MqZK_y?g}AkV_G* zVe1c}xfm8k*ATr9E?K}G~)lPlBPupDi zQ_e}z&UnPQ7gpuLNZ~uTr6fD|9*hQog*}mLzKt|jJuqz?dQnQFv$$Nn7Ty*zBK2@! zgI~u?%_ih-iE5Hu)K)*Wx+5$>rMbdRqoO4kDdYl;b~Dxtbo-fZdRW<;Lx^s3Sou*9 zQVs~$cR}Y0DXTkZe`dtV$1uTw6K8^7qTY|2byKJslVr~zFYUhX@u7GbQwRX9aXNVG#@=ZycrcH!a2KOO`#_=}|!9|Tmr2N&$NQ9m3|f0Q*LwudNq4r)9P zmj2$cLd!!>jnZ)yU~2YFwzwuEEyppOe{17qOSqw3@R{gAE%j&8&0)GVka3SF*`^7n zizQ(`Z`N*CG3O?1j2o){=G&I4X~&epUISvi*-L-4zVrWc34jc zCgBBh@7)dbPR7-h*U3_?eAvWi>#gHnvj|{}t#!Oa1Kp5FSV$;c$X34m({RS4FMA5M zZZnOzTD<>TVZ={m61X~Tea?~$G4W%f?}yVuxm6wreLA=lfSuQG@<^65kq7z#Hg<** zB%?!-{PBT{G&tL9js{&7pv$OQM5_3Q5n5Grw1Bkf3uMIZ>%hr$}ay34fpueDt~IO%l~jYw-vQv1Rk$YXMBuEu76}@M5=qp4BNJz1yeT@Vd;F zMN9$d!TKn%p+wJJ23>BnegSCZ5NhUmoB(wDmCXX?HP=*=R*^-gYl~-$_nEj#(Akly z<%O>aXx97PI0(jju;=M$C(4_7o;6_uaTgf$eI+Y}uX~0Yq%49EAd_&B zo3BMi^HWtbrDe^U^wK1*W7F}Qjd2&n0J1<(n*MhJ;BmM!!~}EE+Og4B&rxiTmh5yM zhf^MFAdq0JJr9D%>36@Yk zfEJY?>3km^j-i#p-RyCeQsX;`M+!hFur%M~kWg0D0>h{cnP)`TTb6o!kOFP8dHG&Y z$zIi2QI*y*fQ?q|{p>j?gAeB7H>r)w{e1;q?ZBSEv}^_xHK87Wf&GB7_u#g`=iVTN zH^pCn)XMstpkq4%wy~q+o$cjmc;L118>D+L7AOSTsXkX;HW_zO=||mn-{gf-**313 z{pTs{?};dWro~iL8r9VOx_ZXC2e%sHNAkjF(-w5Bm`-NP13U=+#U1sa?0!YlzNmi9 zEBuch)NiANnXh`NeQ|hsd1zZNsC1}s6+CIo zVEBD!6IF)NiW9R`7rv7B7)uPaKPo;(6ur^5t1}qdDMN;W|Ej42qHTW&z+IxWK|>=i zs#pXTkv!lnjYsl-{I-?k?%jEuI5}Wtd+8|#No04bE(78W&XTA_+$gZWzx`9ftQ|ny z^EM$l`3({2EoU1P_F%IM9gX9Wj++)Tl1;nuur#+at3J(MxJgv;$V6T4m4m&B3?{`a zUab^@^u3b80yeWw*o*l;)PMWccQ&)Sn4ERcpJ&1I@HBHq=PD6on2y4G@WD>f(47B- zA{;c;d%8eiTmR7?@wajP4U@vk#zqfxN9OZk{EWS0q;bEbVc?H1m=WCn0<>Jf3*P)- zmX4e0SuQ}FkM3x}+=wWfyrbq&p20p_^+#|mBvCHagqz%)Wc|@KzV?o|wtYJ0;4WW} zqjekGxP8p_7D77G7a-y}*<}I|LB&6el+sHS1lCYdQOSDM&&6lETPO@)eX>>$FZw1j zP*BAmE(3l7xD8~8e*sS23|2gpVq;jODPbS5Jvg|V@g<~Hu7b5547?fo*jilCP~!Wt z!T>4y3laud+dhFw7Qm{l{S#SI5SAu^@|S0t_eCtn>Bblx#vhO+C}-1Q70Eu+v<&I| zq&!-sG|q#On6Er!jvNU1G~M;pyke`#y0~I{TNHM9=bLF@{Ecs1ci#BhxC9JL$i0xs z%?JKAudNGTIM}OJB%NS<&l&wne%fw8fnC7d66A52GF|ql7e{yBvwz}o*?R5ph-Ag` z?Yzdq4p)_Kd7mCh`fAsVL4%-}=Uuj)4SXaNc0Bhr#&313EA6|Yknfm@C)iiFUkE~% z>Wy)g=A>kG)accfD%TQFmROx6;j8Pqkt!`#d0W|+qD-1ZjjOpX?{wRQd z28I`R8>`ytzy|GF@M~_nRX^<{Me@E&=E@OsBl~F6D`+&;&X4QLr$AAC{ygEtW-i6M zS3+m3zN&?j{ki}5d5PB2GFisW?0`}yl%&?9=3-RdNFSmTtE1+`z`yV4ulvg93sg<# z>Z`SzT0NaI?Ku|+-0WCmY(}W~%uQ29t+0(sGqM6BE((MBX;NaN?j=N~z+)NUCjbp%(2Piqq1sy;4y>B*S!*E7Obkp$0+`2m}N$Nv&%~0>1 z0wC5m&RvUqC!q`MU_;g+nR+&;@^;C+`NUIQo!kamJ)X{pF2nStk9K6*sQV6+Ta~P; z^*e#3zv@&MHqX*o53kg zD24IzVeyj+-;{QRuq$aoKx}8_uRu%17pbn#p^jL{-Ls9i zRgq0s8$%``Uk`XKL3~Lq!knli6-xWpF-1@ICUN&Alh(o$1J>@#f`lTTXD?ixbw~$Y zQuW@_!eNuKiyDu?FD!2M8$X@H6g%>{UN{&49!+1V(4A56R!NDWRhruByyv$Bv%$y3 zw`D2Lciujpi@eVuk+GhhuDAOAwaV4HOv&7S30H&N=&`*<O;XClAJ` zQfsxoPduUv&Cpo$GaP!!3>1kxDK){)4F@PKE-?W^=sNwLCl*zFW`%VXauC&9Hs~aM z<6=gmNx{i&=(mZG)EN_!Ob`lcjSLJ@lb*KjSJJNYA6fFI{MB-$(*Z_PsRuU;2dU7j z7HIM?_!j1RbLmb-L6MAD1kOOG;~bHaMq*tg<@-A>G_wwi!(#9+Y;IU2k1*l8)>7_PpUG3XLrHmiemX~HxX_R z=q`P)TEi`}q5x^^Rt#s_4W^72)sN7h!an86*q6F9m@`BrHy!A=yz<%`dgo^Ydh&7p zbt>A|@vR3#IK(kE2Mw8IB2xSlWn!~5z`*aE5&9b@-B6>{)A<1Kao9!eSiwhT-*x4_ z+!ibYXtKg&Nk{91<_2^?E++*&`8Tg2O@j%LdFV*fvoZ2}G%>^YdV9&OYI9r6KdD#A zH^xNfvrU$HnR~!M^-FIG^B_YjWI9V+C3`One*_$cO@uECkW|DssyAEp6G=Ui=}#Yc zBDm()uxryNy|6J|_U7}0+~6NBgW3nhE;Wk7o|xe&4WoZ_Wxf;Ha%&^hChs_Sg>2|$ zOuiFVM_gn_K+KveZ&{M$YELEVg(kDxVY@fuZ#Faq;80CxUXb!zWuR$4f2<4dAZewo zuC8XbJ@^rZ@UGkNYN%d8EtdAXqDj`mL7U;LQ=q*mO9zKRd5KqEUizSma4;zpw%dGu zpa-psw)`!e{T0;ye0{I6J2u7g9P-JBh{ey8p!VE^mvN{0LB)gQ=Pqg z&0V3BvdnJESGgzuaFttj+fy>_(ngZ_xkbLf|PU=Ho&R~IvQu_O}@}PuEnF|)+)l8=Tr8OXc z?P^?5KJ}(=0ou+|k~KeEh@yhdh-iq?hJM zYGCSc^js^nRAb=98=u3S0DeBt{dcQFlAM|28i+SNwxfhmFUTzanI`{f1cpZhfTD`q z4(NPjyxD)T7-ve%YdG{e-tua1Dm(qz^|pY)Ed-?fP8H_5<#e0#QiAW7kB_M2Yc+8a z^h3b6bi?N6)PJU~bd&IIwW8I-+H>k-zf}aXz(- zkih8lr=DdWXs{WbrBDO~&xjCl!!)p0!wS5kaA92pO1M%+?U2HAkG#g)yTK@^XOg6U zpXqzw$sjKA+JKelx@-imN-Fib>;exiFq~GgP}ZBrX+JQP{>UVJQM686ijQ+x=KFar zUy0bsOW0HVQjX>zNF=l^>*J1=wgGe*H?d9ZaEnt2_bF7jPj)h00#;G(pADoZqHTQ=x1svhy`lP&h!w{ut*`RDuXEay@)C<81Ls*-Oa<`(oUJys__YR; zf9fUYt|$fNrT9EfLi=i!A6Fvmv5lm!XxeGP>vhM9d1p(SA3kduFYx*7Y!${MXfyr^ z5#1(xpDV`}4AnnmCXXj=xK9TGZ4zK)%BIvwt>TRSz!Mu|$<*!PND;PQ$F(hy(Aik; zqftZEhPSED7E@+UPAUSWuXvtTbEppGO4uzM$2PHDe)F8N(P#WQJ_pJXe!g)6KkoN* zj50M$-MwHU`+OLK135?zr%p%x7tTp@V_FWI1Ym3j#ejOM9lrRyrI!aeeUZ6W3Eid8 z(tSkJ3HlbA?X0n9Dya+ACyecK0@dz`U;3Ngj-@JXd*TN{qV*WD8%%FIYCeY+)U|RX zNb3P!zn*Tu4x)J%H;>wTT~ujn2~OO^OOhhGE09dO`5=2QLQ>{Hs2xYnRMx(kgZu#h zxb&)2Vb`-+f}v{rdDZq?;CR*khUFkl0xpDhL-FNmrkloqr;$&^bQwN=G+VIm;x3qI zeev0PE8QAAoo=V;MTmbEHS=^Pq9^s}b`f?&n3UNZXMOF8E5Pi{vaukS(Aqb!=ZOGFK_nMfIbOFoT>t8 zu*@3Po#$z;?r2R7&pc=*)2mk28S`?IjPBtlwNf6>d@U*)=TFahF#F_uZI1F!#7k|3 zvZf$M9Q8O8%F(|}OmFEwz@&5ujQ(Z_9kJB@_&O|KW90&=(~oWYizil=t$~$4&hNLK z0Q~H-64rd!fz8VooErA)`-cgHUN`Bj8n)~eLI+jH-RYJ$Z|{t4?O?p{4yfZK-%n7u zCpDlScCSLxVtL>0{SY+dE1o$d+ew8;3&P6?CMt>@Je@ZdOZ&o;vR7{^FET0etO|^()Qr@Ra#{cc2`N2^^cncFljHaZOego zT~!d_Z;e1WCkq0gb{urf%MhoiIk<7}m!ylw6x!Wi?|NJz6TM93J}jN{2ExCV=(MNE6`fwK{(_#PkE`&dNp?V z`ZND0FDXnn2wWrCzDLKi+U*#K@QU1VT#VqXdV#JWKL+H9y0of9q{3ZuWJuZ6nLRZg zk~YFhzVThOptmV|aBZwpub$~Grij?7u~yj!GhR~qB0nOGD}K}QdEymaG0f-cs{2!JG7wlk|VCDuPT;x-xPXIC~3cw%MrOvSPd;yW3 zXPxn>Nq2hsIBOPTRc3ILL|-nub~j9&tbt7Mdwv7@!eszS1ia6gP~C9<1=O{*B5>OP zWQzH~PU7N><`zpHC%*5n>GsQ{?fSoddQl#~Hy6T4u5t7Bz`n_`;xm5VHSGy|`7~Y- z1WO+LE!5!YQz%Hz;k52mN`-&Jo+iZ(fh!4@>g|{n!^J>Op3OSdS35J>z+A#leEM>z zM>($vo4zc{SfIv9VBG4Qp_k=h-RbO-OwxUpC(q}c5QWUWD7p~}4+6VqT=RQi)CCJj zvT>`GO(W9rh~Dx;jq!)FCnX(HJEO+ft9q)H?+=K|xaJeGy2YG4^P4=Y`J7c;t@G06 z;3Y@!Lzg}^S+#dnlG(6NXUsj%egUJjfr`0EttPHC-WY)22$B&J6kLCvc>05$>-e{{Yaz1C%O_JkWdNmFEYX?1HfognX}O#&vqWo-SFxamxAey7JYo zwNgnK-ICaR3aqRMkxGelzAw&<1m)&h{1~}52913Eaxxic$0RYpKf6kQE{RA9u_0>x zPHgKDtK}Fkn#|n;#_QzBBD}m=-8rGa%S8J+r;YWte=YO3JN@h5!%z6r7ncVElR{FE z4Tr(Ib!f28iuGcjFgsT#?oeB)G8)A`@4qppO__P|er)fE7}VN)*5AxnmP`wx!f`fU zQy2u9sqbVbnr-yZ#vsR?0l~r$xwAF%uo5D?SaN^uZR=uBTs&CjU)8tv^qlu>IG(gi zlJb4}346aaehoSPKJxQWPx7^X<0{D1{`>yg27`t=;b?CeiX=}VtC5+M7uKo@K*jm0 z*RH_%s2CC4%n%``2~3{JTeOUv2y`~!`&X|ICUor?&b9kY8L#-pq$Xx;dT-~Hj!O!q zuwj}Su7~w>bU9azDH{;hSy+XV#hUw(VETP`)v^~~2PAxnI$Fz#l z{vO0LjkYRIM8X^&tN3qc{E6KDkTY9tp-B=0AEOU`bn;v8S=$32la&n(3+}|pF_%si z#XY33lW3sCP9}Cxx`}z9*%eSpITCt3JRv8T(2GJymfw%ECr?jWuc#%nOPi*0zS<~^ z@i&raJEC7iKW*ytK?eAex3q-#2KHYVzV&mNnP50r@)~5g2Wnvv%4xq!^n|QHQe&3~ zj=yK$HL_TUIufI_D)m}h`mwFqrM>Z?5bONUAfChr#P@AhCmhe0JzEoGhP*3v@-Am& zpPhAWs+q4R+%bfV2L~&Rl?1ga``yoNvtEz%GwHTa&a?CUPSNa?-V^w*clf(+e(9~n z0(wpFo#EMi>uU?JF@ot#?1I8=j_TP5>q5b&$%B4&-GL*+oV4qTU855zJ!(0)qo!@P>!gkJnm}bYaw_`+vJs!qZ77j!m97LBbtZUg$?Mz`_gllgbj3t`bCmlH> z72w;^4(P%&h-~`@Llb;bwVJT5IV5*%U2<+BcX-KtUGu*6LQ%`K#j0EUv|wZH+VqBw z40MkEeW)D;b1u4VFcud+Huu^nJ11FaYVvvGXD!>9%;|R#6n$1}@JyS`%-l3=i%}=F zO$Qm2)+jHueVr!8?{ID6u#gb;r%bqHnzT=hS}2)_!MrRjmQIq2 z=4!oa(!xuLpl}eQy!e6pu@_Hz?>4eM zeIT}X;=*&q=Y>(yJ^(cHHDuMTgb9I#7&h(t;l-LlOk0Gl7M_vU8uM{sHSgZ1w zm~JbZo7k%0GplMZcRIbYY3csF`dqx*7y>RYG)_5u5>U)t+d-!})=?m0E4kEDSv!1(R{&6;=i1tc# z6|Ary?#g&2=TDEy5hIh9xaWnt`;((oRHk*eRSOf?Pg)Aiol1c_48L2%GnXo|k~hY# zgf3bPc23rt3b>qC&Wvx+9tTh0$x1PtHa%Dyw@5x_fx;*D_p8p{a%Ww{q(d4HmqMH;Qpf zd#OE>R~IQ}E)P~Xn|ks7$>8ZJ+BL2>S-QLNyUO>&P?NnsrgQhUj%@mJLf>nI`X`*e zWqHXc;o~@LF|G7VHufWgI18iHt!OTK3Wtbi{T#Zxl<$0p z{@{)T>{55f3Hz}np9 zQ0itjN(4+oTnIvoP&Y7%=0{j0S%ZnHfAzr)qi-=ap&RWaHZV4Wd%~|JTh+Vh(*A){ zABpL8$OOe+GEO*F`r5>%Z%hI=x=daayb5?`vrx6G7=`bY_T!|~4+0wx6kS^f3pr%7 zDymxLN9r5rZ#|pRr#8)#K4M++KaoXH2g8wsz~T4}SA^5F`quhWto&!{{@M`NM+xn@ z^JfLYV1v>6*ExAfsn=2|mwQ8FaqBWyeHXc2T||UU5?}jP9|`THd``G-K#d4aTpbQw z)EJ2CN20q?#f{6H2x3h5iF=C63Rr7&PL*(6p8l9TrRPMJ2|XJWdW%(Q>V5wQ!dKpV zW^FV5u|Tb|v6+^9Z2&wrXfwSt4Azjnp|-tTAaUB7S|&TX8sVf}Jdj%4Wk9?E)>;T9&L*dQBji$lcCGp15# z;3k4ZP(pw^lF6y(tKd>tosXMClLDr*BoTI0b3^&tmRBnZa8`Gr zl$Zeh1ro!ln9z~X5(V&dJ|e__K*?Hm6Q|1@6hcxB=$Nuo0wNj`5h$a(S=W$65W zhoSqbv^a8D*Y~j#dwzksNSJeZZE(nOz2#w_XMa8TsN|E_#Oz=k;V?K}{B-=zu6j;g zfyS#T_zSbgI3!!L(aspDFAx8UuEJcJ;Uai?nB7S=-@Vt4MuRCpfuIzn?cqV0CJ?T9 zMfXiore&uktf`^1^<)$;*rdVIyy8hd-Z|k?9@PNyp8b>eYQ)J8v6INiZIV%$&D-RO zU&-Bj1qfn83!xkda>@N`02fz*7;K# z0ppVS*qclUj@;+w>N#v`cmKbA!B74X;Tl?)dAv@&T|i*X>+fmTlVzTL*{JcVk363Z zHCFT!&N}sb5<$}t;#FS`m}Py~!JK+7%xg9~gD+e>P9$n^iiZZTvQiRyy7hYQlQ8O= zjO=@5G$CMCqPwz9jZm#ue) zmq6ZcPXowPwZCUhg7t-vVm{wB}XR}vFmW%$wNSC zLvW1}I#TUQQ=Pi;#7&LaEcdJ_(EaaYWZD&0R9}>k6Q?GWP-^qyqF;Sa7Nla346ic~ z)_^sOGEatUe)XGDb>ED7x6!9(VUrhi)l9o9yzV>vI&Fh??`rdeNm;7Roia@QNUz3FGLHMZ9_Y37nCn|?tDVweCOpBFmDpCI-9&*EX{ktS`PBJT_+@h&Z~Jq-Rd}uQ2z>1gs}fFeP5sj0U&oJDe~w)L z!TlqiC}~zt7pFY?#gTu(6ynQ(FepsM8+v!6RdqMvF7Ml)jD8>3coHQ64@xjF30_4KMi82h$E17$ni~2dj zZGRe6JTtP|b-=|??-4;Jb-#M03CEo3syEw|9pR=-=M>x2xW{mC&9fc<>pi_ulZXf2 zVK?}nsPri9?#v|=t^5*>A0JCZxUMu)P0g}xt6tK6;||0l_-J%(cid!p(d&=r-$N*+ z;tloR`t+wMohjzW^nHT?Ps)BUg9;-hg_0PTg5@{Koz_N*I=!BanhDik+sCQEnOkdE5 zRxC*>^~PrAQ4-{-GH#r}fT5E$E#8ZNe>_l*Kyz!p%|cIoPC{pIvM|L-b`!w}i(uS3 zDkMR^=cLXX9~cZ7e`Y+mvWBq3?zX4aKA7G%_?{`Vp&G|)_E0{M2aA>YAC{pR7?lGx zVJKU9AA;KTabA^s0pUt0q^hW~K%o0($&Gq87V0VKxakfr5W71`mWt3Sm8g&|iL~xS z<0E33zfEDF|+zK%YIVbwF}-dpIR^{Lcf zhPyJRk5_Yh!X+j1CiG%Ax$WP}o}kYlP&3OI|wOg}A1Y`E9coPN}nqC81IDdhHwO@Fhnws%V0#qQgVf$ErM9O(8~NGq=N z=zlz44P--^sQRGQCXW-5B6gb-Ktpdrk4fo3R2x+cEu6@;NWHnoZR39$v{hxsZh zhA?N^>K#Dn0AP#K;gJH_GVQ#n7DN7A1;9J;rcM=*Fjh}9P-BC zd>eZF78x=iS5*NJi1HB|)ZnY8Nn{IzNW%G$}%u!^zjo*`cM|#M! zd0A=Sv#0k~=MX_$q+Z)>I}NL9J||M`2a0#pO|2k7g(bBY`7$;Sgh3^8O6buQDlJ{? zrL*2w5wrVGC7(buYnGgUsehONkF$R&)U-aX^Z5E-i#^m95(Q<2cb9Obf-_Ip$GC-)6)_Oz9T29JW=7KTaf$XxuxGU?$CdDhgud8WDX#tYIW0gb?? zJM3o%EjtKpa{yb5VVzDF8AdW9vs?PV=n^kbz<+SP3698a=& zx+)XH7W=nDks=Mc_`cQ>y3OpM*G}(r$I`=#@Z5d(5{%2g6~#r4{L01uYW9D{U_9UnI7z-%f%$+CgZP#Tx~mij!irVS5LRgafVLE!3lt*u;6H*dfr94wh9hov8> z$S=x}MM^?Q+xZGEfnyz((zr^Ww6hdH7_@%};&HX!i+`uTN^}xF;+MK}s$k!0&mwTLL9Pd@#x9%;wC)X{!S<_#(w10mW z;LMHv6tyt6ieie%Tm1@O)=AY*J~8`;bm`?l3$Nz0NKkk;ht~o5BT4oceH4)z0}!O2 zmh^vBNzn!d12I?+#V`b^e-cIh8YPz0fKcU>eI)9SbZ06pgr%f-geW@e2!);Ks*LoL z;aq~K$5}NwZsp;j=}t{N9&$bwitcrZHv`Uug%0Vf?U9ma68I7RN72$@>4TA>Zgc5WWLt_t_xPMMAD0};U;s5^AZ;6zl3_%( z$ct_A%l&=e>K?|4rUFgsdS)H*l1ajSx+gdwUbzDM@vc#;K}y$$LJpaU5-~mQ9vi8OWByJ=k=zzL4k;@Xu)4^$K|#|y zAiQwblwm*cKiT+SefZDoIsM`3+FIQ<`zlX~>iRLO;DnVU*N2w!k{&$lc7K5 zgZt=|I8cADc@hd%(!D0xCJ!ijGVr~)XX+`m&F?v-wY=v``xJHX*LDXlhm|cC$!`3b zt3F{L4!J2nM_Uhh^s6^d9-hiWiS{>g3O){H99-JZdrq93GM3$`DEqEJ!Yu}@Dn-VHEM(T~v6)8m*SN$e`ba#)gcMq5MqB~B3R#e3+{ z{DeJlxBhfmuI78iVo)phQKq>mRYLsI?DGF%5rDv)L(W``e=^X z_-kSh@vM4pIf!oP3aeJU{yWQv$3mXxZ}-=6OgsNo$NymvBQz-Mbga}PZxx=@=Hx#s zSEj=IKJG=E)eac^h}uc|Bi>)b>Jnvl(R*>0fJEwsbAV7ptxKJbWzC^Z7 z#i*o1TD(SbUxwuoAQsm~8Z=#=-^8;Wf{Pv$FMm0urVAh)Kq55A|9}Ypw%{T*f|$!v zQXXjez_KtNT_Dd%Crqc1r0+y0jHDATj|eL>FrCKq-jf78#P(7lzCK1N@!caXx^o)^ zU{WtUx|Z98BnJyw6^<`%#zf0>w+A;Ng}66p8_92AUo!YQim_RH>_`Gj86?;h)g$=JgsW*t&=M4 z*W4JAqbxOVFP_GO%TtmnqcIqmZOX{%>xty6ASIe}#cv_Td)2Gxr8pmp6!Cpqs!LMu z{5YxsfV;gLh~YtJ#?drlQOfpUpO$_11*K&SP!(ht{hYj9&z)FME|w9@IVK&^i;A(w zVZ;hbIONm8C&lmDW&cQ%2~;;ZfBLO?a;aL!*H`Ds_S|(s5i^&H$8nXVhH2W#1yf&c zLkzTDN&Zzxn1Ve9@(Yh{44ebs_>6EGL}?rIx*&*4_Yl1d!NdklDBWpV_b;sbhYKUN zV{}q|HF@}TPb7v3$+8HPxU0bgeuh;grH$Ths(n&&di7Lo-`h|y=~o&sp{){;lGGz8 zReMuv6VhLDa|9d`F9aOcXotE5l~Q<}(r2LWu>m;bcEfen0$TgZH=PuZt+$UBAC;;0 z=ZX}MrC@Fgiy|*F0vH53PqA~MXY`v~-fT!ZOQzcU=@CeD*RZ1m5ws|;$gRh5uM(N`W5BP{U_qrUv~g#5f}Ulypl12bwxvZm^9yY-jiHp z%yoR?MiG_i416$LSC#Q5kQ2t59{-QDc3{(;AMSK=#cRyLlyFIE$b5h<%s(2wvwM&uRvsZr1 zZE?}1Qp}0 z8`@EY1h7?)Hx`-F-=DCkQHNS&i89dX1m?$)U}M$Z-yy84d{PkAa7TSy#segodh^uZ z6=xoQWNM^B_c1>;TS!yfg7JcMQ@7LZw&y|NUZYnYZf0IKZ&~oLATd1%vvYNHz4QLLCI6tQ-kEb&*AM9)dkx{{=xk3X>7jbOW~)^{Lj_8-}@rR@09LXF1It(}-BNvpS&H{+rPi=+i6Ne@ox5Ry`Yz+*R>8P8tnO(|ZsFQLvR0u-au6Y7l{yGj$GWO-=Ex3b~H#6O~!i9l61re-}J zP4jGNr~}0l05a_HYcP)XlkqyJ5_9{H30zDVzeNumRR;E->%8A6FxeToW4yLM%{~S7 z)Kgs#Y8p@%;wtCt)L@-y;yp4c*VnjeU>ml>-(>O@!{1}Fnd_-z{WN#5({cMBPdO6V z#@TzZE)<=ZU!jw<_92PG!69;Ts`-{PgS^iwHXlLAYKI~#U1A~f@ltN?6|cOk@xJc= zcaFj6+zF6$zI}}&?O1Qz1ZiH{?)>aGWf8B8nUp}VNnw(?^S8}4a zz;6yg8iPE;H`9#WRyTGppIyTH#$9T`pn=${+k9$8c!th}_S6l#=`onois-iNf;-;Z zTVlbiY6sg&@jt4a7XVYuZ==WR=GzMi4HR1`r%JY66uHd?G2PZ~y;0(og+ zn?7{}i0-mXUh{2;WJu8Wx^a!i!E8ixTT>5+w;vsOt$Xc-59*LLvY2@V8r;47H1E&3 zC4-%$@mx!eoKBGD55~9n@QM8B2l#8CkP+_a?)=6P7q3)!+3qlJ5JdYB9xJy?(syf5 zberk1_hu)sw0ajKh3YqZj!Qt2^rTvv@nZWQWJ<4B81g70y~{oiP69pXFJR`6^5b>7 z0*XyS!EAsSv;Z;p1dM0wPicCQYUeS~1mcxzS?Czg>Fw%$T^kz3aF>tRX;)zO z`L?fn!+&JpA1Yft;E(ocSr_cehtba;Gi*K&D|JE(YCUy*ThC%g#?{QLfSe8Yjl841V(+>+g~x5k3A=_Au->ve9PGSr_~RYx37@&tA;r+kLQw?XIU)JR zAfVMob(ELGsYL$tNzTFLYlSnt1)f4FNLApVS#*RF-3_e%X*|CszL{3I&SO7C{A;$4 zXqBLiz5OTQA`(xiWg+d4lyRlE5s^ck4(>*atVT8pjXNCf!*v(p@=g3Fn77F(EvBYE zcXe=lW)f0!aOTmlLS;fqmAGMDy!M5JyB}EO-}89xRS_r`3%SyuCGoloMS9iWj~YXl z0K*_Z@wQAHm`8;&fv)V&L2Vy}>W(wcord}DAZX^4$ z@2$_*(qx@bE3U$n);>t|;JIL%baiYzP;7n|n-};1ls1;2Tzuq~@VJva0chv98>BxJ zpznxv9+oY)T{On*^n$@;cE0ateILmB1rrnlkCp+fs{CqbT@=?3GX(f# z=~dj#H*dFEr@ zc=C-9C=oBWFODn&1<3o`gdfN~Sso^=$o!RE{tc=iG-Y=b=vC*+@z*U@cr4^1tJz~C z&R!;Zu{fw{?|IR@MqqGoG`~avGk4|@6F3nYVGzsbg zv+9M>Uh%m?^pAyJ50EdJ(&YpKc>3{PjyWt#u}Gn8%|{gVG%=E2WWZ`2JDJ!{$6o=! zoP`i1Z@gnEnq?^l6#2Xn2;}{n0YpjvJ+~-Gi>-P6^DILy!8M&q1pmI@meEJCW%{DT z9uN>lC?Aly;P81C9ya~w^B8}5JRjA?!BcmPtCwr!MgG+kIU5Z-#f8IzY6I2d&X2MAQ)DXo%bpo*~yx$sMhK$l}6 zi0KSg&U^SFGJY73jxj9ABDRx9l8c-#iNy9+I2p|j~ z3!U}OV#c=iS z`2xb@NJBA&y);WIt&#EW#CP?r5j5Ymwg@dE=L6`#P2be8uAPbzOn$;PV@N{Jx@E(Y zZ<=@~Ox!fD`^k;kW9I&&Bf$VxMy>bTGz?=NV4=A4aW^k(b)B9F>2DYxK$#E0UY z8+FW|hXJE6FyR>Hb8UH;7jc$#Lpx=+D1hTa7>ca+uy{fN%=2$mohb0(a?9d%vC3ss zmCpC1R89ozy8Zn7cLL+r-zpNmbd<4jD2$`ol%QktMs``TZDj|%cM?zM!!EgWcZ^g0 zFB1FjPON%zW%c)30RJSWcu8&W0y_B7My@~=UMgs{GII3kAWXRQq9STXrvOTv%b9wJ zQ^tB;{wBtU=z5;%RxYOwp5RVtRmxARWs_oQmB;dJLr;$FT5e)uwfYA&p@e}*s!Q36 z#)~D4NyF_en|IXBgB8^KDWbJzo0$aH|Cqu3x@6mbqjQXoPa6VOxDNMW0EC= zTm||F*w}MqPOs4=To5_mmC#;mAJJ$H_Kfz)UF(tZX>}@L39}J1lK+JG4)ZZK{YptT z)_-US4KCKTD^{CVa;aw$LJ|xIud{Zi?_O+b8Z^??hU&d-^g}Id-O+k1Qkr_--42ee zp}LMJlg=5v2q|LWT9H^jEa(>BZ7(=@93*|yj8b6Ah$fE(Hw|bU3C0+SKw)q((?*II zmNKbj6L`P!i6;zEE6-8d0}vLR;3vl0K2nb~+wnRQ0l15P6rqX3u z6urcud~>s(>eP?*{5v6QL9l4Ma2B~uK_bbq+q4UuY{~uS`plC&Bs9>C_17N)!_P;E zm(tU0!ZHgMy>ohxDN%K1guN)Lwc&kg%8u_#mmHHGe@H`nkSX53Nl0re(k5v8ouyx~ zM{vhkElH#M)Mx^C3E5eOrqctfaXe=~EM_y*{M#q(?8sgr{`i{QqO6_}LvhmD8WZgl zPA_A%C@F5i?UR{`*wQlh8km#V{BFyvi*KEy!2Fz}Xu~FB%lQl6Z{IUM+sTQqtn##r zN(Jb*$$yhk#>L5Ou4^!)sh>4C8K1vT_t8bmyK<$j6wgEDz=NeOpI)>w`=_!90u&P< zsR&foMU^-@y9)6r_CRHk24YVD)(Cj<;jIFiKif7%kMCG z%c%!Q-sj7?SPsVA?>}(&fUKW2F61r0{wEGRmA3lh-dWKO`jX?N42~0jUVrx z)c74n`Oi@P8H>%!c3Dfp-EM9e(nS7HqfJ@;Sa17kQzg z{16YJ3UzE`HM2XDoQdnRs*aUtF?*2D&4$fYZ2l-4fjsnKyOL|s)0#1j7*-7A?=J|M z=P2L$ql4?a+}Ce7M+QRD;!oPUhi&PxbQ%!l8SfT{bra1PNp%X$%6Ue5?`m*wC{GAi zXBk5_on&0Mi+GhhyCVQ$q95y4j6@yhraWr7KQiS+b}wI#uAEqO*!?9B|DYuU!-E1s zH!!bmV$L<^gq?nq3l}#ryy_*tm?Y*o);2H{+D3M#^}XNrA1Og4A~0S z@mbEvS^UkVrMLfwuN>NSEHEh*Cs~w9pY0lp-JqK}1lxARQ7qN>@Y# zfl#Cf(nL^dC{jfb5D+P$NbfbY71X z&;12}@g&g0hIgcp1aZDTUB0vVlIB_Sb2xZaw)ET2ey(yDk9bG3hC4|B363SvBornf z%&?Xphcp%rGogUVcnTEo(r|`r!le;y`Qq@?I8Mpu$|qVLl@~PA?JMk)qR94b19bNYvLhW3+qdrAY8a;BG|7kD(yG;y|3JlS=VPmdEs*R`Qq;U{!&@e-bTk&$0@&w57JQU&{wwLEgo7^go%Yaqb3XfbQp@cMw%6@%RBGatP#^Pg@h&Y+4?HrA+_v;bq-kdX=&-dJBR+=g#c?`l?K4F*W-vqNFbr6Elq? zH}Re4eOk&OkC$vvKI5bgJ~1d#lEf~Q>7Ic;;nkc34d+vQP~?v@rD}M5a?K^0*_AIv zF!|Z2H$_epp>x%$#P3_G;`@WONORO(a+0)_m5QjuOi){2(Aae_Vm^Iv=%{jLEvPxj zk&f5TZI&L&D z<;q2bFV}xMNYZ_S0PY>3!er{B<-uDT!B0dM!0=k1gb&r{y>nRkKQ-YIZv9LLN&Sxrr7HUHpsK)W1 zh(Oja*NN{}eac6wg^7fwhT=Hp|M6b`@wi#YxR{P76*J((B4AT3hA2j7D6?*M@-hm8 z_>7|Hq%_%-%iC6Uu7C4bV|2(9{y>nx@uFoexoAU#KqD#lAb?JaR0J{oVyv#hK-3b| zMBgTLOD~#DGF_`*CMJk|&7OKcwNkf#oG~7GLt6-S@g7R-l%%Xyl#GNnXC;C7O@Hv@ zp~hSbKC&;LnpbB2EB!N|4gsE3plZsYwpn_|_j`{^3`PjMbL8PcgYbjv=?Awmjc&A2yEZNvi z?Jv4Klbm!EW!}+P-}w6rMJ2&28~XFxQxO6*JlEkDIO=3S`!PLpy>=CM@wa%&UA+A)~xM0%9kiL{oi#6&M3PK?ntgCpjDWrl76YBE!@4!AMU4} z=CEC1E>UWj7m$R8Z7T^(kmMu#b(SR#%X=Gb43rR9gG_g)=+b9GpqR7C6Oz(ijnYvN zr4258Jj#4A<;3qNoa`JJu}ibZc0s^R6D>w_ZLHW=JpdeTkL8!5A^3{W$zVz z6k0Kt&wJJ=#>%P^E!Wg=R;GL!v8r0hQb-7waf&ZYc{)vhIT$!pfq}<3*ZfHy|FIWt3 z{4MLrg&fr(w~oEuMv-H+QGcqSzLzU>-#$(y>VJ}^{gL&QK*>if+0w)rjyjj%@1hUu z!jXDLM;(u?XH=Ww6+(aQ=`I%(F&w+x{ra6UoW)P36 zuM8^u;DZv|+agE%A~q%LHBpJjeAly`7j&*I^O_!JCCPg!Us3!!Bi@a{_Vk>88htzgHXd*krsQJvDO<oKEH+#>Z^_sXp(YD#+FFwTIyhcOI8Kmi)~Z#4f^$ z%vNcP6@RI%uh|BLt$w=odEm0o(xt@raXCcM&L1-I7^To(K4IoDa=an94gJKhWXYHS z^lDj1Uwq8vQzPPk4bFaC@V_&kkI9XDk*v>8nwup>fs%4*epnI+6p7J>L$|V$2y4%dA8?6>%s7tm)0!k&545-h)=Y@I=cs#9SXY5d9lXwQx4ssDT_-6Jd6qeD++;kqbB`_uY zMsDnLO+-g&cK~sT=$9;^(5LlRTJ4SiSGySFd=TEGX$1e^wlQQO$ekV+W%0n94-05! zUfxRIn`}30JKo`OO!09Lr%AY4qPy%cO=Bi-XzXEDya@9Pf+y`>3QAj(AC8|xkGZ}I zl*t_a=`C~Lvwq&(Ct*ZMr-w~(_NMH|oiW=2VS%<{y-&3lKa8cAJk0*+dvOioiw~1! zG;M@@v*z!2dZ#}Z5R7izlG1Kj(CVN}-0)+A7{2f}=&>>*H_3OfWEbf0oX~x?aHRqX zBhlF@^Q6Wk<}HP>zUW<4t>< zs29yF=YBj~y;;uZBy)zuk%%MtodwBEzLC6z5NWX~`O9*!Txv*u%Ax8)Yag}0TFyft zS_sx1aYVPAjktPujnH{ZA&chY@L%sPSghUMUQ{bn{B=b-qAS0EhC)HvT=MXV`G6eg z>XZn}%pdcdu(^8JGPQndGh0QK1htQ>ylzHwap5rOMrHEBA)1yyFn@EiWv6Q(*!AYNd4JinCfP%tHdGQ+GRzARNom-H(`=6> zYVX5|OFkQ7r#scA%Ov8A_wXmf$pd9g)O8T=HvTI?B-G~fW8SCr-+wKMlelVXJMH}i z+SsSL1FGfjkao!gsutDcH4q8i&1bW~|5kH_WWs%eT&|Z+)Qd`d?M3k|dusf9eAYHyk+^kK)kfsdMtxABq6eigiQ0T1u-e0KYGLEQI+NW# z*DUBR0v2oUx%MP%RFpK{YyPBgZiAlOmt;XU8k3f+MI9}wC1J~tp{6qCbwZ(RUTou! zXw21ps2|B_vhr`f)+6#BT_XLT6FZ9bCBn=4SpPEK6v(_xG-(n7;fNJN({DdP-r$9KZQcp1=E%lf6wNL@mYT)Y zK{@!<)*Q$qw8aW%+aF)ByL}-D)&^}7mN+fo`J6?stKkzdurl>b0!8%PZk{@ty>mhQ zZ^z0h2d<9TSWEb+wdMa0+b0p%^x)vF7u6hBvyOwWW)L`x4v$cG&t3U&d9nZ=slvi9 zz~9ytn(sWmFwnf1YA(ap1BsKA?9z~7>jK+VAjKJ+ zsmb?p@1&co2EsWskKh9mZy_ zMDJD^98)H4`Du5Wy^zFd#GMi}$7*-rZT@0|@8cvTx{C$-hSXj!AW9e7DjU3;tp#y| z`?}bdyK&(G^YT!sIB_%fSk-Ny{*eLzhT;)1ImErUOwJ7H4X}$Ehs<(oY zDHLyI%5RNJZX+yx?81N>$4795hpNW$LZJs^3?&Y%KU+gWZ<{VhS2hZ~R{pYC9hT8d z(jvwIk}QOxU5ON85pTa%x*p)7DM00XHBKJBcFU^Z^e++=^8(9%FK{Pa%VNyvs!bJM zC~5cdiGlHl+d5-5!QxrZMVWW`3`jFZ)Xwp)adgZXUpG!<`Gds5wjy{PaRD%afz}01 zf#IJQ#x)dDwhk*|C6=QIb>xBgfw|74*T;=EG7IDQ?z*&v(z4#mJ74~WUH|LNYjH5U z_^pwTJXi)RBtxvNJi+_ZDqp>Uz60A;|E7KypyxIeo zW#j0cyCp>o_^fQeXhx^O7J60~@f;#@-b>2Mi^M90MN1PpM{#kqB#V0qt4_d<`=2@yk zLiyTX_4db2JCFEnZSF5Wb>t$WdTl}q`OvKqjBapk>xJ;dwTTdfffg#dVwcog32H-y zFr2>2b;)g&hd9wUoDuXMm8p`hTL4lh*l$y3fk=Io(^+v!!B>-_=3qq`w?y#<7Hwmm z_0`(C*PJ_h$-l8XI{9HD`VUC$nbhm1Hwv7PCc7_x>xJ&23NJlUGagoXA_EsyDJGeI z^@Aq-s3Zf$vah2PcS2>R{))QpI$5B%2`D@MK|ED_u*wgzAO?DmZC-5Jhg!E$uDhw3 zJP(UZZbYD?#ULhIqzPi;CCo!pVR_a&+T4YrM=UmkWo44cm|}Rnq;rqB)%2_&co}u| zZR)=*Tm#HK{JnMi&z_sVoj&QNK^Xb#A|klzl54;D^Y(4k4%Wd$e&ujb02$RSPdhH} zn!y}y@$mVP3MFK;*N!8UmeYv$9`Wem_4^J&<)|*?C*@;;>BJPo%5I77VFk;^F62aBl4c1eL#Lz zb-JBNKI?ad>r^&^!-IrxY`!9&NmA8BwBCYD_vj>}u2|~$imk(jk~f)8`6c|RdURB* z*n#nqjUZX<01&GBje&5lG1x7ka*KCo)uzCj zK{eI-l_ujY>Mx!Z=DFn#H1(NTtm-|O3ryU~h{SB{;xN~6#H=S^!5}=!hPCm}i0vVW zdCsX3y?a~8-NNIP4$3E{p%{U?~QKd*Sk;i75w%Mx=Qwq_`}I z>UI(dxEYzxEqADSB1a#&l;US37P8rsc&au(l1wB`d?J-zg-~e^IhJGbB;h3-6e-5D z=y`)7qUMwH-I{_&(y0zI7$a5Y6SX6`XcHk+BJopU%stf2x7(_UpB*|TD(zMO-~d8q z4Uu#^IX15&s@%M9HCEIQY=u^gBQn!7BR{%nPomcEbuKNh&=}o0VVQYc#QV0&a7u#n zTwcdTJ<>QA=#~aEb9w_$PHoHl^6C*5^ny8e3*w~=D^`1v0&M3rMC|&W^ zGv+%^&!I$_iQ6_L#+p;*`MFTFkdwXJic0e;jy#>uiMU+WHuH@8%Lxa%%U zIJ4M)s)~RrOtEMNX^%z`YeEUH-kG*L2nOjI+9q|0o?LH|l;$sp;#~>*n1Jf#iOW)( z6rxgc1ZS^{mCV$iog6H_2UBn0W!XH0uTgk3Jl(IF+WYi}qTRYM1o?N4OHAOjTIuO6z%5W?h(6Qw;x1 z6eFC!Ygg$41*)vxj?BoM0lTJOc{lYWGwTb}cpp1#vW7M!q}^VrV8W11x8NSU&%*R% zBo>3tk@h56)1BB2P^#}&TYM-m}!M}5+A^t_&~2hx#*P|d&;Uwt0i6CF+Z z*WNtR#>5_o+N7nwbdq!H*59GIld%xC(AV{TP;5PY{Vg$U*`&#n@mZr;Twz)DNm|mr z-C-Y+_sx`984l|5Mmg&85TXC`5eG5OTrL?omt2}TZFQn1pJ$i4t z8#VMuhwqd_jlHF*s+*X2_J@riAhXio|2Rq5m-CL(tYflnuz81-Bprow{V6uIbh?$8 z@NHZL3X0n;(~^nq+vJ-=U*EEMJ#vM|MVq#88*#zuY2WyLJL_0>TtJB9YQ}7wBmC6F zyl_E!MqT;qAmIwVQRfcNB(m$d>b|EB)yZ4^0OD8WdL>_ne?><3M^Jg+NcE7ZF24rf zH~;$ZPfzTg1N~T_A{I;!n-OyxKd62GlBn-dpyKDF*f_`Bd9vvuPVSO;$oE;U^e*4S zvyMS%2`6Ro_2G%gQ0neP_QOP}L(}K5z*VuZKyR=p)I~9!d7VEUT`o)oF_tVbgI+`~h84>GKuUjPCYCJr#fS-f zNX1{TdYGjKQ(hc7oL4jEr@NMiN`zF$kP8%HDEN?qr%o@)v@6wKP^?4Ao?p3sK|sKn znK378c^imVbRRM>5DJKNFXT?oFwmxdLDLA>-2u-Mbe=fwb88#8^ME155&oa z0u!S_-^_S4H===AJ9lT`Tl7*4B%(uk(RI?A>Ul6j0Q0IBC8HZns(TFACsO9Z3tXEE zKB_IE?U$ZW?PZN6jZGr;R1a&M{UAU$#C6PTZU0A^iSZhap5SIK?#jnvZ(nzhCAhHA z(5@)5PdJFW7AbgUmwAphFYr13r_z(Aidizh=krq2!c9n7+jDzI&C5isx~H&>R{A!!MCGi(2ITg%O>RJs%doB z_x#B#f{%OGgA*k?jD%1{YNR>bn`UUd8!)4qXTbfeN&fmA%AoN$D|`JSy5Y~1jwC^< zU0Qz0w-(^xYEatyRj+rY9*@f~eh%O7MU4Agy}fXUi#6rLixIx%;}nyZuDWy;mA+gX zjI#8P{YZm9b=NsHgB(iv8^m5c>A^Rp5hZx2#bD<`$j+1x*rlGAiOkI!4B-ek6(T0mlvP&oo$404Ws~2|Q6wz=`?&n({Y#fK1xmgTF%1-7` z9wWRzJjL+;Zj+P$N*>CK!EVSmA?juSDrx*tu#@j1SBl=7Jc==!yQX#z7g)V^D^y#A zqfG7A%@Y@eJth_}jmia$>IIDwhXM2Y1&!K;C=bhlbuA+m7>vn8-itGojx}w$--J}5 zn!D^Wzo)-4{78T5KF_;Bm8&)~f-X-G@ZNkw>01Le7Oq@mkectpv&+1+L3~JVnIcXj z_$*Ivo6zV>M(#)b`TZny;5mMT0LxIVIos&4;mVn-+4EdVu~OjXLKUoG#&Jl1ZC zB-T_5*j`PC-Vj2YM(bBy*9tMsD>P=ujEK?5oKbVpiQQ?atqzXQt;_j-xpa0q02b<^ zm|8+pWJ7<`xbuxwFG=^ok9a{8x{KhjkIPq9I9Gb9quph^s}3ST8%45jN0O*7u!d9| zB4Oj6Hy1udG;Qd2mLd9UjFu&7iWIsDmweMDj3Yvmb~CueJDKJJjU&`vMGFPZ;sd(= zaJivZow!-NE|)tNH~Mi@eoga*&p;9vDa6K#SB|eUue;c_%o|uwe7xmXgS^~jPGjyKE9 zwazZ+r#2b2@CONi!{P26Yl=ps@gaw!tA|hxeuCwg*xE`-ZAki4qW2tXRytXcbW)wz zkrOL14wL2jlAX!zNnCGb2BoZ*amCbrEdvSv_C*t`=m(la5}1C$(-roVk*zLnD=AMV zGWD~5=20i6u>Bylr;z1FCj#f}qlv4x4tX+v{*i+GhMlfp8yoA8@{MyduboY<^o69d zbA?p7jYS{F4_cLs4HO$$W<3`Z40`cq1-{=9*~?VpJ+-dVox-qdPekoclIvEBzuP!o zZ}?<(t08D*q-SMmeaTNbjU9;`jeKwe;FhGe2$QumZ|=P9Yyoe1<{Xs>VX&=2@>!sn zq&3aSW#z%3Oe~Zm4AG)-0FZrY+4VXQpE$K{dN*ZlYVm1mg-BFf7_Yamyx(AEvEozP zr})z+<+!h2?$S!|fe*KzK}gVd&yB?82iT+49WR=*X+@&tI!w{i8zv}|a1Zs)BOk8S zGL(LE06PLDiVLvF!l@z%qXukKwCZ|j+~!kVh=+Q#@>~M8Nd$2U?8lrZCvY*UaW$i) zrcqKTDhv5SYR#)u>B+Nx@6XE8jB13qV*v`<{-*laCJi(Y?Mcns+(<^X?U#OD^`Ojt z>3iS2j>m#s)2juI{KIN0>{p~?ktmWn6`YSIT~^b;_mpuzpHLWMnItK$f&TMSZ4)wL zeX?LgI0CL=NzN_?w4sQ|5aqi8T?UL3~_3VpRA9e~< zauxAvM^`y0uUOeQ%&ulDj|qehN+8JYHRo#Lf zoKl3M)J1!qp*NE%cX`_QI2(-+Yyt?-W+fj|X>DPw_4TzKLgSr<0grvkJda&HuGg;{ zO9QXBt)*Q)ymRHWVlcy_Qn7V+R@AB-N-sXgyj=iq216yIsBdAlHr=t{YwpfUvA=K; zLS0B>XJd0dqSs6Z(vn{C%Lon~uHfZ<)GFPhk%Is)n73ED*VMT{-DSB;ka8|9CrX|5sJs)7qEkn`8LloAya*Y*;@W9b(qx&e>6&_-DbEYEZ> zHNox<9flcE#&kA1u;|;6tU8#CT+;A?V${CgXn!yvp5X(t^_`gU8F!k`1;#?20@A7;c;&_0Y~9^$^XP?)S-7Jkyt`V9}$zhP5eC zKZzKw7v-~VpVfBnMyx7CXSVF#i0{F#-)cQjflUaQBzOzKCVN)CeZ7)$a322((>QCh z$M@-UndazOhVSvn)nB{D0f)cde|YuhzWdkq`#&zQ5`;qhFW-jJoAK9Fuc73Vg+Hgbt-8q^~pI4Aow??BRzwva}WYV~o zu!1w|s&r<+vA`m%UlmM9HB?lwe}z-6&ZRfV9gHEMQ^pZn#XrUWTWJaPqW>b^DwFg{h`Il|bXM)QnYcEJxH3~}9dr&o6KL^$Be&es&AY;AQ zIjd8>`T4H)z&k4fEf7?u3&AwXqJuJ4%9O?_W3O5)a}SxJ=5kDU{Gx_{l^8w92+Uhs zB96|9dNqIo+N2M~K6j8+O{s#YR#^gxd}8ApvM1kNbFPg}aVcH&HXHPkOs6X|#*#@8u6v$=-jxeFq^%!vm`e#r~K-hfDA z+$6^44gu)BxBUuA1sNus<_VI@Dx+~GAb(JKRC2%4Fl5oXLU{{N8KwYi(AyOkC%Yzs zpj%|PR-UoZ0M~|Esjv$yweGh#TCTpM?I;!Ftgq(A^?#t|HxH+hHr(V{-;O1t0P%QX zur~}xaZpV*AnXbYI)qaowwN?U#Ez+l`hs{1rPO^iY~Z5t=JasFfd92yh>+(RJ`7*po(Jf#f+}rqP_OaWZXn)sa>wD&hK?i9q1iYiBp!7SP0#5l4599zx#ig zz^}T-DiQMiJ5jCkkCWX#-1l)gFC>KtybfE^=vLwj@9rMGbL(&&Zew?~ZQakYV^iI1;s< z6R~1U&m%sx)u)4g7!4-(Q1O?yMT7E3Bd$C%KSJBnGLEOtv2pV*I?F?r)m8Ie>r98f z<~R)e0;rgze>;n;nmyvor(%>JqULu43>cw~Yt0oOD;Y4%^xdFE9sE=x63a=+hCu0p z$T(S=QRT+wyen04aJ4xq`nL670m}E}*KK1AI?)`i#yBTNJ0HAJE>!^pAS!Vtx;H5$ z)aFG-*OFt($i1mnZrqYYI_g+{8S$r?CLZVelvJ!YKE7^!+JQ1#P&ka^u^Mz`&c|At z;ksvXtSqd+$q617uD*yVy1BZrA3^*)#Upd#*sIjbPG9*lUJlAj82anlP{D7|kU(Gg zbLxBe_>c{5U_}&}fK^r!oC5+%tw8}G?8t)8nITr*0F5ep5g5Z(tFtg`Q=R8D#NQ}` zLv0WGt<^0gbxH?1Y}}a{wb5)a?a%$OU{m>>=h_(Tlxpk!->CB6yX`l|{I4f$uo3#e zH^KIjthR#mX*cu9LUyn|aKf;@z>Av2H38)J(p!j$^telP&uw3=XpBEh4UXyR-!Bm8%Mse+ z%awbtXj9yrRt*%)Ox}uYmW>O}!EjA}5a8N;{MAn$v@X#k(>Jn7eRS{Ar9Uz7=v#0N zF5rkC6C`0(D~|G-efMPI)7J71DaOkwZH3n#oZJ)n-Ug~cBAT9mebJ{!3iMz1%$n2G zpPsam2e%J_R*JzxW~wmrsUHr^!v~Ufw{8AF*41wjCMuyFhIoOcqTafhPvHupo{#5=wxiOhMO03p+Ti^GTLPL;b%(nx zUNK$k%~|fyj<6MS%A-fCJyhKu?6SF|rk$tbr> zr|fV9;cIm{sV?4ITGM~2oqlNNY|V;t`hG3-fiWCO+M#&J$0-CTq;r9E1VzCnqPphx zv!aR0Q1U?o%RyTDngC_mIxa-Wl});jbr9wuswx*BAl7hO`fS79^d z^|kL5HZgcOY9-(v_gj?k?BvNeV}=Lr4B%9-z5-bE=h5}2-{%L0Xj-i z%7dXBIX=?EhkbnBD8DZ%mWO^RGb<*dG#s(HMk@J(|C?sv;4Qg!3uzBzwlq8 zGG%0=*06r%yjO-)vowhfz-$k6-dHzlr-j~6e2 zIAu}113MJ}+=Di40J1X#IW`vW+==cynB&joy@;*1&Mu5!&aLb8lKFd(-)M^v;KoPw zZnM1oV)o|QW66HaBi=~$J#2@V_ILR-c_gCU+E zVRR5HSNX>Hdn1L4OC38mXllOxky4XWY&vUODW1o~MW)dWI+v5HHva_HC%*EbM4M66 z#Jb{g)#{Z?(j4*INV>rN2cw@ZV%`~W@`_!+cFiHD6pf z?#b+{=INWr^_Ia$+imR1I7->rn*Z>t$2uUD?1w

5l&oz3czT;je`Ry}|zQA+R3~ zG!YL2ds|tM3elevxmC|41nxy`b?nf4_kdEPU;~~}*XE)+9SV6Ke#(_~?l~&w*bE66 zwO3p*F|j)KUhrED?c~yQV9t5OJYLMOnE+rt@L6Htc|c7aTud)s2-`l7D2GCKF$ge( z>P!^`@31%ELi|WAAYesRM`USfZJ~^6&E75dw52sSejGy|8DSsm0NQJ%;D;PjU~Ss2 zz>Wr!{UU()pJL&XZ{CH$B4y634oCQdp$frlh8+&dV-|g>E$wl$$cXI8UPBH!*_BHt z4z|b4o#Z3O$#n_>u3(OFnk;GtpKIqsiQvtIg*(=;QQn=#*C5Hxj2}6v0Ae`7s0I8( z)_OrLB0@^1Tn)lSI$bC6jBM(XIj2O4J+p_`u}!TDhg2lvMZ2X=sUp{oLi7Qh@^}KK zi681-h(HW6hoC`cM=8ajd(>ydM=M_M*EG)Jy*ayYwRhsaC|iL#;U2}d>n?q|8(-f^ zrQ-BeHybRuC^uAJ3vqAjr1IFJq`LXaT=J&Dk@*Yc*iMyAEQ?0()dY)~_Savtr2i z!OWv}q`!nd0ZhKiP+Nd&0K1o&8(0{o1JeSSvV^I2U8-4QbDlBpndY>H-EKi&r0`py zG%6~YDRW_m`lsC;>vL68VS7rk5)upECwDd))#xb69@P9aYFRK3stbOKu>-z2u&7QMNvnf z4qSD&H}Jd`ZBP;CGs^(k3iXHIxXP#4s>o ziAMON7GQQP-^w_~De^aR+F-)Ker#A#R&5Lj#f5oQ68G!AzP{x+1-YoiwpI^J|Qp#)*WTJBZIXcm|NJ+$NMIaS;=tq;>dRa0_g-70bh3gvS;SJJ(| zIcP$U>`V%$q#*bm_a;ZU{#l-+67S|_!a2^p{O1uEvWP3h1Wq@l(ReBPIY=rGCRmhv-Qfp_2(%ajyrlLHVz!H} zJf<%1?VLvt1LPTIo)n1a|%V+t!X}Mx^$N@0~nCe78@&>RcV2;tm z14uOa>4Wr|o07cFb}gVEEY3>e{XcRW=YF1_#eNFg>K?u6{1!m!VE91K=Fp5><$5T4RYVnH`ZfDJ*4B)ZTdLKG-?2ha-&a%qA-?gnPRHi2x|6I7~Kq zkf9GK0gf3sZ|cR;zK@#=r;ZvocvqlYRP+K(89S%#nC+k+$47Jfn+<1koS`k^|m z_=W<08rFo)CD`kv7sYg+_9{xp@dtpYG7=|ckA_g?Mp%I$Y;&LHvm-&b3$cjTG*2K9 ze-R`A*H$n|T;Ow7Zvy8@M)CL~vqLE!u(l7Yybd6j7K|>BI*{Ru){o1FFj8*v^<9-S zqZi#pwAIH-?d@=!Qti`qyxG)<5Xi~sU_!=}*zq()TKb}K%SQUHxIp(r73>kPZ0A=I zw(PYrR}Ojg?pNgK(&grvQ>6ZcS|TFwW`~Vr=xm1%XHfj18>FtpQw)gn&bFbG}e9HheE;R&&sk!s7` zysBw3%F_)1wMs@5er}Q&)AYZ2zuykvi)IL0U&nNp!tdmE7GGihhk_C^eccku`xD#t67?de1&&DxX0$S!ojmn*4rr7<+lsNP(3Lf; zR-IQNfb~LjW^@?1SXC^!hmS=rn39=gaoL<6)BIhwSr(xD{xyMlOkEFYyU24K z*sl8K=#%W}2S z6ElXK)IEVv$ImDpb=evkz#xy#W~mnBUNhKwzj_WC%B`#0iM+-p8eBZyp0{x}$V*Ek0mn+#c| z8n?WKwtl+=#mcp{3Rt`}xF5dyE&ttNa=$WgSd|&%Zml~lcO1gf%kvsMx79q4@u#mZ z0F*;_*+Ad*WfEjzIDvZ!O%gwJvICtL+>GMG{QtL2`+uPhtlCX9u1VlSn)Z*-^mWPW z%$qv6DQN(u4+4*_Ia3n^nA|1DuNn$|+w+Jsv!C0jC9HG=gv2^j`2}Z-?Fd)!oy$f= zd%iJ$xCLhkDguFxc&hJ}Hsz5#3Yw7iQJA9)*o``YZ#IGW0u|j+DI5&2m#z=3h#!ZC z2VPc}xT_*gnT{a+JiI6&1c7P4pkEb6)CjP0D&=Z>_(w`IdY{6&(NEv{W8hV5-`Qv5 z=9#qDl_9EM7qaTn_&lZB@(5T3)ylclzUCv&!ZJF?DFA4SqI$t-sC#;%Rg{6E$2KnH zdGE6~5LCXT4v+kqt|9d(&ftlcxudpbrI)BGlOO*WR6lTswYu5<_d`Q!;q?=ISKlHRSE*b{sJ%h$f~XFX74|9K4cEqmv;mR zW;B&1`_KB}A3w<#P7zG(W?u8IIrKii8U#C;|>0hWMg|0lr| z_A9B#mjl2K2RID_ASei+65MofxHz0eUXU{pK+Jh!c)M4h=NM|Uk+}c^cX>XHNGaWe zdvZl5zH#j^n)tvZr+S}>Y1xcluwM=IT+HYK;{d>h{M<|cBW~Py2@rIkn0>8)aOoBP z4|{e?Y>xUsROKHv(~mP+zOb1fw$dQJiREWUE>^jeWb%t3t5Bz zvXYxs2L=domIHjdyof7;Z-YSesbSRLZgJX?Us%=PQU3r4?|H&SQpqSm0<^QsCsjXh z=1p81ntUI&?1U-P5Vo1MKD`&i|C&arqa7DY?w=hmS$uWo-9b7eD;{^>omx9nbkHV zY&fS%<@i1Nz@ua9Lw0aAzv0QJ+()yja9@*=9bOKkyZT}zw`P=#J-53|h^MTvi=xPs z&T#kL%f(E-#VW!h>Gb_R0n@4DWTaD$(TyrV(8;9Cd%)b{*QCpXi<3#Y(ZVbn-9>Ne z9_2KIk3OTGOjw}^e1sK6ZA7JRB2MzVm=?`igeVqNgLfA9G(c!>`e>yUX12~g2f`#3 zPHilAip>PRrtvz9ox4TE6ws5HPHWq8TG!yU}PAe6+b9%@cx($ykSi zqv?*!J7in-W$YW_K4(vA!uOjC_P6@yY%C$hW=F$d$_5cnx-3~DnY<1vQkQJIg{+{Kw>zM>1d14ggR4&o$7-Q5`*e1^7hb+KI(KqCzIQeHy$U9noEQNW=HOEb zMXQFA{V;&@?oh*b{e~IOvfP1xidMGMNNx zss6<=>R41*A`{RATB;75bNwyP8eD z^6bDb>Q5UQGNM zzCNyD2%HZS?%0DAAZNT=&o>|vOQsl~L21tCVopCRic2I}{7a6J1RaHa3rEnV_Xj^s zSMY#O0O8{}=(QVFVk7;4SFrb#Q_+J;U(2%x8=c^ptv8B~&Y&Bg_Z)y0EmI;0`-&e{ z-@J_6xVgl4^cxekzSKq^Fi)eYx!X1*hZS`BLPEmH{n5N?Yxs$LTXyBrF&Hi zqaW+FK91tqrunF?ea&BP@wfJQS?w?%6~k>)bh5rLl}GJxZ|DcI@Z=+qezZtyVCggW zTUJcKo2O)3OB<{w)i>pN(1BHUv8iHSeJ?B^-(b(fy-WTVsQrIA4Q%#J-u4D;#6#2B z!wcoHPy!9QNeG5Fh9YY&g`TW2Z}JQ`UoPcYH1-_Q5%gM~&b$}B^ZjYN!uXCWHnzX1 zb~jJfSwE;;oDLw)`yX7E1&-34CSH<17`xLByoYI^DcJ*Rth4+p$;+FJcEZ5~z3VLm z_(FX4>Ht7I->U%Sb)7L(u4X5R1+WBD+`C&e*hc;B-=&d;$DT7G$>n~Faw>jmnN6E{ zfj>UIXIzt$UbG_Clh_abwPN!92L3y3%^E7IH&An2MihBv^yW5k<&BpNi($RmPUZf8 z0)`N>97L!??Q+75{&DWni{SUUdI3HaOP7!VWF!sLp#a`+P=z-zqvi$-y@vF7&&U1o z0>|Cf2bxRupO)A*F`q9{c5KzBk)3=7Ekj0aVnrG=H&rim?9=|t554^#L`P3(+BaQV51D#;P3p0CrjfLkEHkZu$TVX=&6HqA} z9CX6U8%j-19+*Rm)$PI-Pim5er=Ztpizj46CN!ui439V2AKKql90_rTTJh^>XO}J zA4NmR-Acp3$B(?i3{_ANDyWGcavB{8=f9^u7j>jLSPiz6;(R!V+3nXUpM`9iMXT^A zNPZW+ERDKGaVo;qpRagc3PTL~m`ywSNwr3D{~nJt^=V_tuDG#qhR5da52rIDAME8OVLZV4ZK@ggJyc-JAP`6Q^}ee(qr z9CBGI{$_frZ7XnYPD!CgGl}q;%VKeKX=FR8r=Vdi--=7(9f|t$SvmGsV#dMa2YU6} z97|TjSC((4e=a6DrU%2bWLD~DKY30>Z}~9Z#_L*2@jwvZUDhs;413pf`u$)_^N|Z1 z`r|$e>@G3aE7BLK1P5aW_~uz5&x174FjmXXk?7x=%?c_$vY)`Gl<3%;o(^wREcrC} z9>a0C?Bz-@q)oV#S z5QV(sJ(JUe)1}OXFB+dY7=pX+$-CA?`!2A@Qid&v|PFbK1rem_M}T0rO`7%vHX-cwU~1=k6j|C zG8vB@ox-PLUb~pJMF>Pn2wl|OMq#*? zd255&y9LVOz<&Lm0z-@{J+ZyXVnX4!`={9P!iyUMFYZ@~@65lD!C@>SZYG73J|VJ0 zC7gE8fQSu}2^a33l=f6@=s}3h^B0gj$_&vZ%5A!d`A%T@ZlSp{G9detfg3uO{!%4iLJZL(GiQKRf!d9Ovcte}W;S9~qN-@0`cYocDVc;Rw;ca% zq&wA3y&~|r%xjO8!#8#K>tcE@JmKLQS#8qU^?VyONkTWWCcWsQPKo1wE;I(5^KJLChPqAUwHi?be)q88LOT%-11 zdJJNtux0Q-!KfoMcq2So`KBYdT=2&RRhhxIdA2;Oc}fElCR@iMEaj0ST+fUt2(O&I zm{Pf<4B^KRg%|g#Ke$Foq0nGPf$z!|jvF^2Y;3x!P5rZidnB*j1>97U>-pxbQKysE4T zcZ#70Rnhfh46!n!QVIOOoe>NgQ#GTdUg6K!kg;#spvu5et&(K^?9|K;GXeBeh_Xx+ ztLPD8BkY!)x@Ucx|5;-mrr-+M@)uE!;DQG5V{H-oO?a9!xjOid%FK}Poz{8 z2>))nawyS{WcgE`?JwLPiaf zM&x>y(9xw5^X_z)ExA;_B#nSHX+g4rgarR;W{*PuJZA$u-$~nj{KMCMN=JN- z@nCkI(*c3yiMrGW!Lp$Y&@udLKR28TZX7DiwJqMDl$lpNvI7z6{(P??Q*4ZF)oF2? z^SY1WvH)>i@Q_{#rFnW7J@ego!Td~D_*92;gzpHOF-)Mx4y}mlZ>Lao=m$|wyr!Vp zK3?f4$S6Blfv<4vwbo0iFZQdg#;F~pA8|dpjRB=Y&tP(vJ`22$ooX|U{e=6yq*g2Cs6=9u9eWyBE2 zBe9pFh(qPl4{B7het-)MyGXF$F6 zPPgUo4nzOGR+x5C^!1ckvK*QoS>Nq;_9rn|W$}?d{KWn(Q}YNES7x?8HQ^l(bM1-t z6LR;vk{6-CcljQ=mUWZN+SrAHwy`hwqLkE9AN-xW4{It$MYkl(JVE?#;29b5wb|-a z^k3f<@n0%Q<3tcgrViAOQVO!V#$mNaS7U9^M@~FGcPP0cI@gnHb@a?8iaWx;4FW>Y&gbWK|}ZK6(|TCcLt3frq~zm?&gS2(jM+4v66yVdAIMV?5#!1b+hJ;2li zW0AR71&px1q+%6hkU~+v@in~-G_Eflc*hL~#bhjV6kkFH^uJE^NAK;*+Vhm< zYVN~F$Kkcu5%Y2ScyVQ4WTW&|h4;-Hr^QLz{V*u)%vh(@G^=H-%RS)Cf?+!V8I*(3 z#&4dyy@6j%-W+?YMWthVdEc}jS?Wry@4#EdnPmWq=Dw!W@Yh6 zMU#F7rgk3PO$2h8E#w+g` z+>e4kc$M9(lX=tDX7i}cnylUO$cK8IZnCIMo!!EX=+qpEJ7XChK_ zt>YUQXB3QI+aM0xPdx0=WDpp<ST+E@?dj%63~bzyuA5GCrMe_HI6Gzi3Ig=B8j-m$mrjNqL&h ze8omb)jA8>@|hs(bJUgdXCB#P}H;`g>z6O>J8etyZR+hv`j2(C8S^9TXKjy+6f72DU;9V_ z&D%E~Q}N2coZVopZ9{Br_SkLD=h+L<=Js12-y;Ts<2RmA@mOnhxggIb%_zLyuBQj= zQ>G7JJ6<)Sx<{e=d_G=NtD8khN%hfnh_1ElEi?YImWMhSV+#H0%cWzLtFD_3-{vzC zI4_MVa}K!`!5;3%7=yspm1^qk!pc})wlF_tRe*|h9rij44BraOWI(}`ym9JK+O{o8 zYbdh=Dbi504LE9I2!_~7p{Q7;*gI(YHLXpDmzal{nNwm{>LL(#t+_darFd7&nvXb1 zx7~=tq=xD4E9Ew8zy1AZS`M4(T#Nr+asQ_#>z|(?o`FZR^g{N9J(&jHLQZ~)X&vp^ z@N~+D!idBFF4wj~)SK&DK~*1(78VOKBMyS8_5=>ec)NP|DGQmhIwVgqCyIv#uFBj_ zdnd}xAN*+!xGVy?84o(V@Vw}=U-`}Xi@=s1`8);qAE|e!@it>G0z%D~Cjx)sCz1m= z`_<ZNBR`)e;4jGD_w{4;BqCVc~ zZ^^6pWjOp7vi+Y{DuqRNiz{iuZv2JA{fB@1#y>ZD3nMf_ICR#fS-W|^0z3cMV|K5@ zQ-9Kb;dA3g1$M5@h@jz34^>Mq!N{t`H_`A#C0}P;zy_fSdmw+?I|4D@~EJ}wv6B09&JG1_kK);G;3==Qaq%mKV{xD?Fg)(Hq+%$rmRTt zX!Ydw-9a!E-WwdaZ5Pp*I!$X*EUY5c3s7Aar*AN(OcDXHl!N`QgLU3BO{z2cUc634 zf~*>V&<{*wks4w6c9n5x1M|lO81&PH80fn`4Jr{1%u zX!T)#vurTwEP_^-EaXAsnK9^`)$A|?8+(pw7=7V)J~3C4G9?7hGsqN&iVOi1Dz%5QQ#%y4j+cx#u$W)C09^Gtm6epu(y( zI)q@a-PPh%DN>bUJ5P!mr z?{J=7Oe=6UvZ9x9Iqn{qI%-n`Z2r7YCDzc@yu;FNatPV}vSmntR{#@JWEWGEC{c_} zNNA1}epd#)X?qsRg8s09{SkQoW!nA7rh8guyjqK6uY&Aq)b}@Naj8Xi9DlEZ|5f-v zH*vONn@`TbJZD9T+AVsAdp676SW-K1K;z-gD1TBQApGOeo8$UMt_4hxbJ4y1C*GFBTOld`^nf7Jz`L$IVWjuU#}|;H zssIT;^h<~I)z^^%v`R)9e4(cxc&E3|>P9*58nqj#v``%^H_WVUNZd5%b8wb&!?{@- z0H<-3#!mo} zAkVQIL)S=k5GNW-z1L2UpeK0&C{ztAfJdX3(@xMXW1cmWw+N?kp+FkXar3-lal{`U z>R|&|+U@im7&>XiMRsIv)_T$^}vyPQH)yn6XC?nh@WXIMFg ze0xzCfJ6hd_Gh+}Hl+d+0gb#IgUq(Df&^}r2EXr$a#kqpNdhi>%rS;L#8+$f`vMmr z)QWHGZQtz5t}@ZT1pq4uhbISi`LwaNbSR7f0Apf`-MKB$=)`&<_TtUqb7;C(6(>&D z`fbXf1%){>FKC|`MN)u~uld1GQ;}IXRV@$O_@GFM=1PzTngXg6i`=1rAV4gG0Z^z? zZFcUnhwtaqoFWEpkGVRf&p)Nw7hsY4Ajd_JM1h0f^keuL3^mZyRJ-MKh?9;~sV!uiBr-si+LQrfQjDP`%m$9uN=*k%N-dE@0=XW;%+D|2K1 zrUX#OAQ#YVpL=Z1Lq4(fUR`yqpnKIF&!#HDk<^qZA9+LT<%fNbBjCHG@T?yc)E!12 zkB*%6Zpb@(-Y*p@U^Eyi@}!)<8A}ILcQNGtcrYWtKFY66e~~K;9vu8Yr>nYR{}#GU zit@Z=?jxFDx#gn0qK>nb-?8kx^2MrY_!rXMrlTE`%+yKuV|GweGy(4*W2+y%{i9Yh z&DMP-@5@1ej)-V|B&_DyOctt%hI&hUkU zc-Y4_qZsW?8H1-Zua4iHGRk^hvOgPfHphmKw}aN{(YoQ8pGKjLbJW0`5A_Ij8%&iw z$yO^I%6cu9a0i_oK`9! zVqV8pQ!6>}Nco~UVs!TuMq^rQk@$6fv z8;DE0!R7^hmK&-Zu2=qABDyTE%S`g_lyubz5!9*~ZbOJ>)~jqt^rpQLo;N5mZnGtW zl2jE_@i{+Sz@7rfuP9IpTAzu=rct$q-g@}d>iW1bH)hJG{Jc*TapJk+%e40D9tdG1 zGI2$PV7>Urz3NlKfyol@c+2Bkv(ep_LrH^dTsV46i^KZsmu~?g=(xb?v~W0ol%QDB zqvr%t!ugPu_p6`5yFP(rS0MW2!Z)!RH-q%%a7m*+b*cwbQNr`8i@l=oO0TtZbw^97 z`GKdbPBy{j0c46zq4z%JyntiAw%L@xnfwKN|LNWPR>j}{xGH!|K!T~L_X`W`dp>=L~={%M^K#OilWCD zcUS(iS^n9sY~@+bKi_<2CaIkL-M5%;b;f+_1}ZIq1BX@w7#KicQUHJ`zhPgfwVWL$ z0M8!#lv&-(yFym06dybS9N+f$dQ>^^%vD z=l$jnN0mD?p6?Z5x;9$R20iGekm7a;wBHDzUtbL}K7gvgc=u7OXfNywT4jCR)akh& zZKjYpIZna6tz44UeW*88)yanYP!L5)7oXwERZ75BTKy8?zCXs8p>< zRmUbTXBSt`)?2cZIHsMg<;XeB{@X9gf9KJupHivvFra(Qzc}60E~b;&!w+ctR#y6L zOVa&n(BcOE2iXFrBJ!B%VeWQ%1D3U+gTOG3@%^vc)}Jq8WT;=(xtQ|xeAoHZ_)^5X z)UZkN6T!>-DIJ+Rzr(tJ!8_@IS|5OkiYH-E+QW=QtO~KG&s!CrUG2(DKA1wILHDB% zrpS4H&lI2Cn^=XMKMU9U{FfXk#v;rgGsWKL`ol^PLtq0PcJrZCVJ8EgHK}BmHwpt< zYN_|)d$BJCI!rvc%BYWJe4c;OBUIDpCsEesUiHF<<=B)%T(7C+d{r;E(|a+1ROLub z&ASB%LEk3?jjU47!OJx4yq>Qiskm2=03cch@z?=k$n z(^Hh?iMVD1>jt%3i)EoRkB&axyzZa%J9WRxK<_|4L?B|`golmnW}*OyK{K*CbHE_XD?cC4=YqE0makXL{2xX@r9yKsmM_#IiY8t^I}MW zlzfoYG^4qn?{jq+Grv*{N|pkv1(+85(w?ALYLH6wV#%|%81LQH`v*Jff~OWOigH8- zWXtpl$@u4dYW{K06t_#|-$=DpRjBdr#+fYkzx^kFt3a>84IhCpS2BD97lY$4{DTH7 zaE34KryxQq1YG4Ng@AuaTILQT^pR~R&0}Ca?$u%dwUieiEB zbE+?B5aJ-YR?YHhvFkz>V|9$LtJX=9T&y{-)cCV*vbY~TZl(Bi;?2vfTxp=;5$gst zBzpL)@khSCKEq+tk4!_$#+u_mpWBtgYsEbhx*x_ciZ&gN&d{uO-R?th)W%imF)s!# zjP=uC`?or%ifuxn+Mv@_lix~m#WcSD)~+{gvBSKk*sa+L_lnR*2>FfmMoPJrNke3N zAlyXmOV!A1`=$%+`94M!1`iA$fG&AG6}APTGDy43xE-`Chz8M!W{`#(1Ku2JI!;|B{mY zsh{CnOt$V1#2bTu zm3t4@72iN}Y1e<}lzYch3eO3xQkxBSqP=qoMxwg|WFT*>lw2h-X`aGWZuZ;Ejm*=+-$hMQYr&A&7ANZczh8R2~%$ zB^xYcH;ZNm`+Ui3F83F9`E#|xf~}sKAh^;W z3jhrM$6W4So%qzT1`(|*7DRb-II@w`P+v!Z)J+B{#Y9@ z7eteA_bJ_6{!29Y9}NVe49u7O}O`wiJfZ=m-s2R8K(WywMf7veg+Q{vIHCb3}A|fGYX0)F$lgKy0HS+)UfdYLa~(fFg&(_#OH#E4jTi})Z`^j7&*_*fzGPSF?KZ41 zMUj{2k2+3LA9~Qqm7aBQM;G+?JJ9V_t{T1v_D&?1sb4hcCKjA()CMau5b*^Y0GkM%-_P1 zo!+$7SKziOjDE3GPt}B?RI)C_AHK{f6L?Vmz@jH{p>TGUtA^$@B3QTbA;n$VQ!NX8 z`!11}KpP?%BGcIDVjO-NoxeCTXc6^)8+fikC-){VhwSA(7oV6qENk5$c3oCG%(-|V z$T*?z5Q}|NcL2{V(>IE-(5olGClYGuzX3jP11xIfsgB=$Pq?Y8c)zefbtj5AX1XFx zKh{=TI{7_V$|k4ju}L6}l0t@>MHr$30E@~bF=%KLoU)K@PB{^yq@GszF9Ym(6s?c= zu(AT*bU2r3PNeh3!a~45%HmC&Mr)`9iU2>P!KuGTP%3~)5^W>G09dO&7pJa};+roz zLD3vRh2$QnXK3rI0bANq^|y#-hYq!Vl8G)M<1_eNMYG17M`H&ZHWj=>jSi07w|e2rYcnPk$-Lz1Khk8-IWkH3 z%r$*RDRMtjZAI3!PeovF=S;q~;Z$9maqt}XGG|q0$&eXfTIB3%oBj$5Q)Ka8)+|QY^kMm;tPkNcDnAyS10>zXKhgft2PYVML9|oKjmJ z1F8+ADrLwQ#={n?1f%oDU~H2aXyFZp@9E%tm+mx?W2Cr(pobh+*s~(G{ZUghFNP;j z!H=W+$7d4)5KGEhx>H=p;GG@x-uG{Mn8Ewp7l8x#&u$I!`7b`@1JW7+5KGffA)Hcb zuz_xm5-w3QdbDcWVUmIQVrx)OgFCp=de53e-7{MSv(1FsXL)O?eYKM(Cy;tni?fSj zYt6IFTNyo(^=#F?emC+sx4%x7=IsRn0$h zCCp19OGvEe3@h%*o9eYG)4tn859(r=)Lbm5`p09Boi*PLCt|(fhtp{{$$^DGxflN% z0dp;k+c=xrG`wYVM0C3>q_(zV{=xR+M&;+E)w0q_nTHz_5;<|yZf5{~{B-zR9qwgr z@%|BJFn)zrNg*JEKESO-6J{C#;l}s1Q+T0}`>(8EN@o0mQlpV9K9S6Krxc=Sws|<@ z;U8~b`Y;rIXE8e*A*Bo0p=p_vIzucYBF@%JvuML{$Z@iWBv23J=J&0WPP&E(d`M2!=`|Pw}gto7D=0$!;k6h_vb9=B6md!6U&=-HeQa^)wF+iyt6%j+woH1ACOw1 znEDGVriyX4u0TE&=(DOTLO;(X|e^CM>%SYuf3GsK|9N7g(J*P8&smnHWE@9=Oe^xgv za5~JZi!V&t?HW`Uc@qql1@q�nocrGA;r2xdjG4zZ+!?@yn;gU1jwT2WyGX?pmp*9w2b?S+;SB{l{{(u}{3{Kp6gx^7ptxoJkbk zAJ2mf1br+JK?g*xi9{y4Hu`?zTBaHo@HP-A&DhUtllhePy;KZ6HB|&e|6rh>%?I>n za-s{BJpI(lTL!&wQvpeuD&J!E0S4NofFyGK!-(t1mX3#3Rr`VUGmY0syBN-WF%0F7 zB8^mAMM%0$*|@-inFnj@3fs~IX-BT9wwznp#NYJG6*V^D5n1$3SgwYv zzQ~8=uq{J*d*&Q$EpUf8qr^6QE5B9MA3HIXTxNBgt^&3B{6UjeeFs=kCZ!KDtSn|m z*~D4Z7X0js|Mz1^4s&rNr?WP7b)+{M3 z&0t49JANa)RVw=X^PP`+nx=L*Q1!pYjpbsnp)N??(I(8W3is5H5WV=|MpyC|>>%gKC4o%0YsLtzlYuu^!h-+O~?RbZv>bv!bkcHO!h4hnY2Oj7@nx2%C~z7PYWkHudtVeQd0w-67g`(({p!okK4|lD0IUx zN^{D6-Ziyc9Y=A-|=@$G46F?BBSx`i)+x0;9f>HTh^D@_Bw`{alZ&m;Dm zYiB9FXt-|ats)GIRCvCWgIH;-JgxI6yjKzN|6O|#Z@>xn1*i5#M1Q)~fSgwJbHh$t z@?6YczX3b+zvMUoyvu0{P3VyysO5Y=vdQ`03EuQ@4WFVSHkN*X9Ji`oU6FwvCa#^0 zkg!9qLX^QYR!ZS)%YIxD!EyGF(uc^JM{aCl(GG{V$6h!2Ao6A*5t|s<3p5rnertm> ztlOrMR5PDyIJ^z*(B)J(3==4Vf?>vT_@)0aYZo=^E?PqqR&`BzaEZ_f>&)hCZ>96$ zPS;=DL2Jgl*tv_Mculq4aCNWx+p0`+LasF+wrdKrTYwYJFw%oF09u)b7YIaCg=U@IXzNZ&K~k)GSs0f zKVU>-KRR-CiwoqvA&Lt$rRVVI11Um05&_i(Eq{tpW=-WE+N0LjFg!Oi+tFKB6lz$% z#F)5@tt$Wk3edZ(VbX+?5B*j=^iPh4Y_KNSU*%v}uXg}0?gRwZf_bi?|4{ic_C4=lelMakMV)yrxt-_aOFwt7Yq=zvuF zOq50xF~?QGqrcVACX(5id(}#5GS!EY`}dDjPod;3A3<-AlBr)j(TEup6EfI#%7t^k zgttZ0MVq{1Q5)TiE5*Sqkiq3@gxwmiQmKy0Q{d?d%&`PhHLy4Do;H)n`J7dI^l$ zfJbefFrWs%l0$}NKFAhu2fX)<$mjeSxZ?8-5G>9LrWST0@~J(VOe5QfMu_->xvxd? zb9?*V!rQqAYJ3|FBoY6quJ1nBf@iYOJu8ZGvS0sWL8j%%u;|~@xfEVfUp_~Mu5bdO z+M)&_WuI-1$HU9Ew(I04FQmE$DGGj@tGJZ)a`8eCPfN>Y+WHnf@6|V}+5i3(VW;oW zWY%t6?EcChK<%G%&i)f{S@X-QWy+o&Z`7H-wHZAZbB|xPJ_!<4C(>8LK3&vH;ex|S z(n_ycy7~GtE@)+nWIjt_e}3e25=nF`{=PVU*lN9qzNwE8y8P8_{9{#A^_Fbel;d}m zB5b$@dt$F5pUpMwVot(JuE&+)z&);2qkWsQAgJc#?zQOjwEisj8lgVuFMZ4gj#46vhAB{AxE!n%4qwg$mR&rZKq zlfueyiuRH4QxH;9(}%DVVSVCQZDFgvVbtDejHrx+T_%K)oFM9J3Q$=-w_EA$K|D#41`}sQ z(RMu$hg=`fKK7!CwM~kIh{{D*HF{bRGZi&mlF|g3keE9*d@#RL zdGpX^#qplo9FJoJ<04Iicb;5R&C+$R^T{cd$7Wd|)7 zJoF9NXG4f!0hD8O;5A{2<{qVL*KA$;{3-kc9$xtZ9`wVQj+Kz^fyf{nZgo( zf6k$JVEr4wk;ejTUi`(d&?m!nDz0WX9#~Aawcaqhyf`N2xpzjLe@#qsJ|%yFO7WOA z)VMcj^JKd|iK99-k1PnN3!JaqULiZ_TLwhG&37d?a|rhdO%MKboNqcH8aCSh3yT2){D48#ohl)j)7UA7Sw6J=GIH9CG;2!JJhKL$j#E*oc7Jjhmh)n zMr@Y8MMXKv^M1MW?=6Ge%a5=k-9e!*{y|ax*LIKD7u!5OgWtVG9ZDEyJ{ofu?N&cM z;r3ry#xJaO-mO+tQh|=rWIU_p;mPY8c2x9J^}Crh_8l=8J5{ZCNH%nvr$R`$*j%~K zVuOoog+1dDuDYgsROqiIJ(rf5hr_IN+7J0AJTl7{e1>cFc#rv(xjN&&N147WY#pnr z$btwhygl^)%xm4dx9p>)pxr93tz?Db>;?vg0I{8w&Jja)v7VA0)|EF0^<0fRcJACp zRFbszr+leHZZ*@{ib>iKoKQf=b&lKZ5Xfj5y$2iUud(X`46=_?eLFtygJ$^2lbQQf ztw+p|!8gaiIz~>Ze%%4X0n)X-^^@X;*+BQ_`E%O9^RMV+sIKi_D7_gap^O%74wa*T zvhjsQLYWYqa#0XbaRv+u)$?)lO9_s`v3R=uGnblSO=Er2NLa%ff@A#PeswJzc?k*u zd%RCVfkAQQs5YY9d13#oTVzca^)3$8HgccQ`s5pZcb7|6XAIBpmJ9mvStr;17u-Wk zME~;HRKL*M;^EKU=*n2}oL#?O=TCb7+qzNWAZ5MNc%?MYO5x5-(;adWPQU7x34TT$$<3x>kk>~~xu^VTpa-QrVt^G7SGS9G%hs`{`PS&NI`VV$TzFT2S ztY+rDbD>8+gooEqEiIvYeOE$oS@(>y#xq+OiyNZo20ZQ5QYwtZ zxGsVUBHA5{ySA%}tp!}$m5y$oZ_kZ?j<8qe_8UHv6Vh`q?Qj{xtAWmuD6>~}#l6n| zP($ZC=ICQJ=_un{E}Z9an=h{GqC@;5g<9DqD#i=-KPZ#PHd_iVG8B)7iprG7aQ9MC zdRLr9hEdaUX@I%KrEW5C+J*UbbHygnop_w@DEeWZKCy-IN;bq4QYerG0B1+S!SVA;W;&fRroCzsh25Mq9vIq3@ds#%z z?at6`bzM2U-k5nS;)}$$V=?qbRg%qfRt4eG;@?*qB~SO?4b#{@`39iW()A-X?uI__ zPfM(1c65*D0@a=|RW<2r--GwXIiuGYKb!J^_L)!zcfjTop^sB8<53j^gU^quA=iMzLh=o$R35N!PEgA^&4({bzOj&zLA2P7F0A z34Ohk9J?}MZ&v1Z;PVKh5e~it<2CuKoP#gx%3p|rFkK_(F!RwRX+T-PN}ctL#SFg1 zH(yV8-ag^<_BgQF6)^=Kw?LrW@%D#qGlCMWF_k9kO8D#;_;Ovh3Mvw$q!3Q4^Z=O? ze(vE7E&-u@{}1ieAA$*WQo-$Y|^RRxw@EW2+@w`(f6@m?{QSN^Tfo zWnac>)jJPrh@1}Ht^5696NhWb5o}K}VF#TQsR|w@hD1i>*T~!mT-}9;f9Hm6ZWQV- zKI`h@%oClj(LS!DrOY{23B!6nj858+qo42isllR7yex4YUgZ)!%KqFk z!}$xrxBHZxO2&Ae4fSy^&^w*IXs6^}5YwWORsM|5^{M>_#>DZJ+m;3o>@$*YBr1yQ z?QP4sJY)5GkZkZl_&)mzZ^seoSHp&a-p2qE$??8iMc%|c4YQ>52tm*{q@pN17LGSy z*`3}KJ$QWO2XyyuMLMfdxlA!dqRFIk+OA?d^yJRTG3oxHhpo>&wBgj?ZCf>^Omy%oQCYO)v1If)1A7!?YxDZ+2Dx4fet~)6Kx=D@=X6}Y3Zfa%+ahd z=k{MAq3*>IUKbOOQw8ayh4*HP3Ot7(+dEEoeVR@aDTk8ZmMK*!Sr42|u}Lf3k|;Q5 z$67_7y4-ic#z-`sXp}FuvYle2e_!@{yGBua701fXt=xFaW{IY^Zk$~m{||3(9?#ak z^^dnYS5=3DmZFn7rD~qXR#7$9Jg2C+sG38PI#t>#iW*vDYaT<*Q)m^fnIPtrAS4Kq zh$JMxt>@n7-243QdG5X6=X<~ZcqOs3^BLB9ulIVdwfA;ot(u>Je?if!RjOzG8Xz!F ztLe)wwxLSeKfs}!wTq?CYeCj)51#N=`Mu;`DyzG0oMcH-x%6IR7TFD_pyrH~RQN*; zN>$(GeJ7VMGloNxIO)AnE z+;l`+GO8x3BIFX+hru~?5xZSyI-3Qiau=G`3Gd67%YFolGCsfX^w;5?k&O|lt)#ha zy=YuJyGY^H{?JN%!I77vaFK6e$Nqc)`Ume*VpKf@eI;Hf zRlB|GYUy{hA;>5}f@&Jw^*IMtE*f06nk2v!;J4G4sS?o6jNlR^?@PW0OJw9EIh}Fd zHrOcOb7nC~%?sKkJscbPLR*jyAFRSP9XH-h096-XeQ6`(#=)fInTeJokHn`+@6^uy zNcGD7{G8#v@Ik|C;d8q-Q=<0CrwrqrHgw1H6C#!=!}t{ZRMWiZ2n06R?)99CS168? z@%I@5s^`7aLEZES$PFe1Y0*969rNa;s(jq=iS)BzRYO>bS4U91m*` zd#}a8Q!h>z5Qe_nxAR-Z!*J0WBPXRfowsG>0|X+k__tw-+H{i5roKEMaa@Ym7&-dM z{*eVX3f!D>wSYaH#=CjUjU%tYCJG6KG`%X`$~TlLot1s(xuAMKi%r9N~zU(6B zP3aY+Vd{9SKBJI1`X!h(Rh8_4|4`@KmV+4zm9AV-nApSx7ax`O_M}$NQ+;~BSXkt? zp|A!bA!2Tx;K${(jJ8&_&Cg`gR@`wcm$h|Stf;iea%rBnD)juw>}(Y^ceKqlRJjzo z_|Rw-wYahIFwgSb?kLib-FUS^?3HRdr)o8y*|D;Ps4s38v8W+AB@q{8ce_^(EB*|D z=&R$}0tOAot~_2jB1qo_9&flER|_qC^26kyg4?E6+Og+=VPMdx%HAk~j@Eafw# znz{3QLZw6VeAH4!&l*4&wC#ya_gT|mfo5HNZRBYvW8UqzXoGxo2UU!`ZM-26_p7cl z+dC;*z*NTuEjM%|B6WTl}4=0CJG3!WF>BjZ(*)@a`G`n?3y_>hIQm$EK+ ztTR*FQ6l~1{(~JEPq%hw%hGx4(}N?D#}pw&M~hTV9fU`(b9(&NCgjW!Rnc3Y5N;Cc z2>rg%Fj@e5!aZ>b6*=G4*KfZBWL9TyMU`jh>;0O?-MnuQRQY z9^DnW<4;EJMl<1@k+HIcIjH2cC0fEgSdkP8c*+;vK!`>zZt=DpssnANnr!P7&DMu? z8L6(oq;I}c(Z$@l1t3ww2gQvGdkqTbA+n4 zmdNWNPy0k?JcT%tKfXPWn!ER9qG<$eb&fw$4=G1C=8n(F$rF55z5IPBeuEtm?5B=_ zyw6zk3dJbZPL{;hjl^r7sScmj*EzrDr(zJ8=&nh-ADzIBE$+iemT<~U!|#88eCC!y z3{?7Ke#hoD0hsoc5U(dgFJ|VKzt?ft!iK)t!6bSGkcZ>ZD$%IA@86ZQTfF_ehmJ!T zVc)+CW+y;nbDXxL;wLUww@y4s(2+-H4oBU4UYb`ZTKKEAHcr=d)V)pldky??bsq(_ zSjhlOY4@*(jzC*JS~(r+>PtSpk{?yXspW2jmos)lhDLFc1&Jn8Rc_zk=V5fej2tdr z9t_n>GLMpYm$s7}UIAQ6V3*D;?6u}icwNk9ZJ`Phc~qk+n_*(bGxW~V8B9fh;skA1 z^D97ZMS85!lBs6E5gCsfklnr3h>j7q#FMJe80Yo9Au84pnJLpE~@oq)opu!VZ z*+y^bYzh@#SmnxjZh|>>ul9MVK;Or8pW(dRWDo&<#DrUlxDFSARh5(1tDQ`)6y#1C zlyu}56mQ%erbXsgXTZ5-njy5{cvxtIN1Rp5VMsD*+Xp(^)?MlU$-g9`bWOA-+YMn= zrE-#Oa?_)NYiCfo{$@`+cZT2DJFP+#HuKH*7ll>q&50>F4w(&6{rr7ImkigsOR42D zC33&Br+*wg26R}!oGUyRh8?F0!5`CBH#?*w?jL~aBwgi~OPBbrmp+lMFo6(n$>|H@ zK41cKYoe2qWE_x6?`s6i#|7+$my4;)AZ*~M))LEyh zxD%wKXy4pkJ zt#RSTK(B`C$$(Wdj%;hf@8q+2u6{Fu-GVo>$DVM^)eA%sz@kt`^qq;mi#s9sp)9w%V6^@#U} zBan-2ZaP~${9y)p%=`>9Rr?^SOl+*6q)7TGm>Xwbq|B+gk&m3qA8iv7AMu<{N~U}Z79q&M4zI}x+BL+LH#t=F2k+GGWwVA4x zUTr%vA`98~xNC0Y#_j=omf9!67PSkcaOQQUeq>G#BA>~l>XF!T&DgxITg0x;mhp9B z43*?LyJq266tY21&|;Gf5H$Miwmld8)upl1t0o@k3*xO$h>~o`IC~ewjR(I2&U@-8 z$JnohW67(WO>w+!V*iu70ikh&r6^PRjmZ%d`mGEP?`x3zhI~nd+DJ$>)FbF|fsB3| zLR<~~^ud`vrWp^fNelOx64@ITsb-!^kLzaD^xz$-??66+WG7FB=#!lN$WIPS@T>ji zN9YOcj4geNbNny6%?b;dUgPo6T6$wu&x`A|X5^+l$;r*B5g{V)p1fmb$JiL>WMn=d z?=vY*+#CH~8rAWvmC~<`TXDf1fisdeNSb{?-vmbY|DIpPv2@4(_GPUqN&Lz9>swjn ztt|{P{EN@2&ts=7s$B1HzHuB7u_$k4J3%tqpp32aL>1b6dic`1!LKk?Dfr3IkN&q6 zb;on$jnwFMTmGvUWS&2rZV~rVAjpkHp{&?=1{v)gcE#ZFS|0vdBdpm_oBOwA-{QU} zUc1qeQxU2Cfi^?YgeHDTtY4y&VDh_N8+Xo`i`^>u*6Ps2oJ(R5?Z-iK+U}c%Ut%dO zBZrR^M;{QfsorSy+jhSolljFuw6MG|;vf%Z;I@gS5Qj{)4XZVq~ZHhnPD`bbtevF>~^xgN>zeMRqFeYO^ue8PMiT=q%b zz|=%n;GNwcdF%UD3PR$O_{_M;iX;6m$tpZe|H`d~Ajbc>P&d_|o^`@f-Vn zPH5gj#QuCcA9C!4quB9H$O&hwW7>R@{?vOG<{!^-mWQGg&x2*3c{v7m9Dvt(bn_J<)-mYXvb+i-cGR222{laJ)kmJxE708+B$`ZK zAZfkL&9$mnvqqrdX4s4CWQ@M+#gcNT?-0Y&1Cac znMuviSN)4S-+=9JF4jK)?N;T#dn>2)m2lZP`6Hh@8}>y9N0TqSHfZ5Hg?tQZnzYDJ zXQTLp@^{OR*-d;WZcTOIY#LW<{YtK-`*EH6k!H8g`*okymb@+djg=1?P}cib`1MVe zH#@M=#!JqaPSCq zw&t?>7XS9`MRccKMq-@9X7h>m3a%sm)Q-P>OI6w0ydl+2Go-F}c2)N8BXjuf79!1) zmpigs(_?S=qB2#RoDWokA;Qi$a%scFLkho(A>7;ImC9c&K8td26#Z~ucaBL2>{s$a zZA80Gxf1sWZu_*c?MUl89sOx5fFo(B5k`-FTu8?p0wWYqLrd(^a0amidBAWmHy(!CsY?1oL< zKyRihy0rYuaj)D&Ga=6NzOl!`K7YPN=@N!-!>+#0?H(|@v9WaE)TScG{)!A5^?GZCwIJ|qVG1&a-LQ{z49q*OCZo0gqEa6p7 zn!=O@sbi*z8Ib1-t8=j2tgX7VLFbnrUxmr}*8?ih@3@zxb;xhG!?ICJGV&qt@1`SpnC#fGlzUe!;ChZ7EgJ^Q6*WM!VbHTjv? z?)^~TD(vgkTD;1EwT(`@jSD=FR4nSZ~+ZR?LkaZ*iIHMTj;7L`lPm`24+9oSJ zFw1W4KU7KB1?Y3*r^?z4g24|-3lJ!m>+B9ypMbFYM*<>>Ii5{FD7%KeJi zUY5Uj{9mQqKi-DDybes}Ft!UP{?YIK z{+Z#cr!yTN_O}@Q`tso4&*8tXQdouH04m=bI{4>?_q$`Y2L18_0FEBh(PMvh#s|Ty zCJ_;UYXrNnbpNSk{q89bf&rVMEpqYxLooPbRgS*a+MjVGrqjkL{ZE%AsaB1trpmT0 zLePCc{hP1;qxHEV8iqh17OGv7{^^GBa{dT@5E=IJ@AR#|9mE5N<0co_w)J|_TuM*> zJplaeVgG%}|7`jGr{f#|8>PFpiXMJl{!b?OS}^RM0CoOfSXiCCh3$Uil>4WHO{#4D z@#z-#x^-W0>)d~Mh8<7Un63NRwxh#BFTVul*cyIz36D>GjPE(Vhj{;F*8ga$fB$Tt zY##wrCEOYMCudMgQ_D31Tt!ae_Rrt(Q&$uGRpGCs=6~9gKV7y{N6!MWRZQ^qpZS!= zA=0fx#>Y6ZztYb?AO8Pl>cDp~whvrgUmV`)2)R}X{gV~=Uo7t5jjsI=5LJNso!k}i z|JZzfpTcWc*m1y8n7Ynv|6!|qb^HVy+u&2s{X2{Q1knD^EaeZ>ILBl;a3H}3-OS!! zN)o^~EL`*LU~*SR{Ck_`XYm8L)u(?^a_!ng<&+xpDZo8_ArNj1t_7O4WsqyM0b!tX zV6FvohmRbYPUuI>VLm`XR#DJ@&)_G{z9>Z}x4eCY@6T-gNooF1K<&>R=#ORj`RW|! zQuh89`xCT(`5XW31pn&WZ(QfNxj*i23FYqiFFN?|ZNR^5`C>Q3#KhDNK-(^m{tPDm zZ~gLsO;!u_YTmy*w7>J}e`63&_lOh_5GzFf(?50UBCvA%?;iY9()X`!`2T!d${5SD zXU}2|?_ArGX`T3Ag`t1GrU#FbC=?(setP!Sf7r~g)v3Wi`~Y!T_k23?ABMG~rz~XT z?gE>o{~zD1A1sOYo&$TeEz^qokMGrq6DJ1#-|SWEz`&{hS9=98E&yov3I6sUc3|Dd zVGJnudg_nVeZ{f=xA@0DMygYn#iUGpb}#Ke_Uu3VLr+`pa4zYXWdIhq$=TZQpSHkb zCh>++Ke+B_T>SS!_rHrRVJ~kOp5Kd!FPrw4ul?gS{^#KKFWQqm%kF_)U{;zM1s_@9 z&0FvHGIncC;$o_ILw+W7Ld5b@j*|rosiyVIbJl5~P$6nwXrigNv?mHm_A6l)`!iMD z>pop`mycCt)P<~6bnfNn-LH~@&ioYjc8L9S^q^Wq{HP-+bVGwOq$3*5`P$9#j#}{f zPon4K@99q@hmr8B&Go65#D z;A7nxBp*AP7{~qrdnQ-Clk+*MM$^1Z?X{w9ov1wzajjw0DKL2(o_`Y~q z*3(e+wGnkdy= zF^m57{ZT(+8Xq{c)}up{Vk zcxqx$O397)YFB>bIo%_t~j~!iL4Y$JtR@!M% zJ+xn2h7E)g7Ms&E4m9srL!S=Pd z!?jPiy^-pfgMLIgQAf{M@C=+5>X&}{jW~H*!Ev&?V#@*1Ele8M5S`q5GSQGokT?qI z%kow7Cn+|Lgs+)@K(S=!%1EKBOY$?oU8v=`3##v3>B!qeTl#}7GDao$%q)wT`U*^dWguFPJReFJdvI-sA40U>0DsO}?qg z#tSicXGG-8S--~6a+|@5vpnRT4t={gqu-rJ;qn`)V(G#wr_Wwzkq%ScnPp$wn)D8Y zBWOkZk`S6-Eq$%Aad&GH{`oGu50r+?q#dEi*q2t1K8fT57fe1((0gQpLM)`d(S|)OGe@?{vE!=6FAJ zkq24nBkA1pxN)^6bs-mmnJ7W~rmSU8*#%McMGa6jB^Cl@NYc=D} zJb_a_o%P=n1oO3!{Fm0JeEaLsOa^6Uld8N21X+7>)rR9uGZQzGgzAFP*D_I0riiRrs3VqQyf zcZi?5mi2{qA$Kd#?3mpks!6KXngvbEl~vt4fczsf?&3Py+#zZOzp{89raQK&aZU5}2dW)u=BA8jb$a2>60l`% z-(IMnl>fTgOqpTBoO{8wR2`aMBBsJV`7YaFH;&E$*7`WvHsBo`lxLsF>RmS*f$&=Ic_%6Ts_bBx z*IUeUrL&(*Umo)yuJecvcu+I!o|*OE9I{`IJ-eid=u~ns8G!XjJs`rd z(yF0*%Y!7YQ?AvZ=XR`8I=6KZs*G(6Lq(tJo!+<65UIG{dcYP0%8XvD%~C546$ST2 zf2XVzEzuYTFj_)LxAn}NzUnS%AXyAR=5FS^g)vXyC(PV+jU zpZJ?eN(pd|7g^jyqwL>sewDOIG-H%PG-zra%GH5fVRaW1Nl&IV#BbqA$yUP;vZZJ8 z56cbznEa>_6>3k&O}68%dOQi!>h_(y`P=2IhSn_ZR}DDIhJ!Kz*dP==pkw%%W6HFp zY_eRp976acesgm=hR{VJz?gJ$2iTD6Z6Tupufdr17gq96Q zCt=^)b@*s(3`F0241{}GshT)8UNED-&!tTq8=q3nsoJu^605vru^aSWHt;<46!@mL zD2P3p^dPP*H0;!5z~+tgAs{F(4gxnzIOYd6Kj1|(&Zi%;b?i%(?Pn(%&{-O^XuaN0 zN%w=|!AV^Ad#JMj5rE5%rS$nGvM$-(v^^%~ZTXt@>{6~TSf*V_&y`fIunAs+ye=$~=<`~s|9qXTy0QYU3# zSL#kNPiNvAzf*_*OHj#D3LEeUO(Yw7!<8rtyvDAGWFK$f8bd2=lLXrD{6M#8%St!9 zN$p)xs8`GG7CBbd)_=rwjX@`XX8at%R3HMr)40P&->L3O4SgLb=QXY#?Hi}*`ud`ut;L7Me)Bg-y?=_g~J ztDGI0_!=(avMT6xqxmgi*~XQ;a+x=Y5frA6Z8Z9YmS)e`p{@bZh)f3it+vd7@l-71 zm3k-5I~2n+JjkVa%(i$}h-CGkDkprAZfu~u(2prXeW2_Ni@`Gv;4i>eiIf)Ru4|ON zRrsDWW72ru6UHCn(^aKsw9FA|@P)=i;(X$UAspVcL(oJ-CULoz7EGGk&BSmT%i@6G z-`Iz_WZUpa_NtP-=5dl0g4nnEO$qlk#cMufN%_|Kg=gtv+_64J{oYE8Lipd?qSTu9 zv~Jn!P?<%wtm>!SX5}6GX6Q2%+CB64I&AfY6}-}O`CKw&(`FEphEloRJVqXjg${G! z@B;eMOSzgnBnj+!mo#zQ?Gc6QhO_!|pPN@7D;;C`>%9Oxy@f?q3Qmhx+)_Ivr%L^9 zup_sy>eI=KrH|BgjJss6ntUrb+yX=(LC`I&XnEZJzI@ePw_03Lu>wRux3nA2`kKqu zFAmmP*(Fpgb>oWigXeAD0K`m-cV0-ykopMPD7ti4`pous1LzP?Yj#)ZnGQs+-fUXG z9oQ{WTX!W^X~_KA1#!tMnjAn77Ea^q>N2U37-hqv5L?pT(1k?cD*Vmm{LC`*8l{D| z##7f)AI)J*53pg=12fPvHDeB}wd7H2S=)>naZlL^JAfwieG2#+ z=*K@QI{8w0BI2@H3!d7s%`JcK$yXs?ukGOW*gjuHC~7s24#MdOGUb+u;o7d22^l>&V?_Q4610i2>+CH)@Jt8q1{_ScT;Q%fVhV1;o7%7B`O zRgMJ=o`F;+EJu~@eob$*#*$JnjbH4Zd>2qL-Wqdc58R%Oq(jqTCSEzo0p#1sh%S9D z(ScIm1|v@JE^O|lAWdSXsd`XL*+jqK-Y%`~xNVb~Z2z)2iYdf8#3+-nPUI*9nirrJ zqBx*k3r2Qg1(@isPJ|81HIVb#CWJ>>U?DF$( zoTD5&~!++om#>N}p5yTe`bp_(K z`~xai%+mW(LTf3?#8DfRKUmh7EN{w;0>*FG6F5`vDJtr?h%-ZUPMv*wU*(*m*y%O^ zb}la};9vigBh-Au7-9QS=uipcQ?8&NeTsw<^M)ZV<5FXcP0@?ozAsC+5*h$5Uu-9@ z6a93xk$`|U*-e;dTaPZ!#&Ewf`q1KUcBuz3>WU#k9ltF0_Sc1m)%#*;uQ=U@@k`mU zWk-yzM28TXYxxnYHIqAVZl+P~bigE)i#`k&m0W2e_K`i+MAxk;^9cqtrIy9_9*<0# zKa@$MY${dCEMvKsjPsA&84b#e7#Yj9J2xGKiH1D$;@094%)0j$H~iw`mbE{vA;$B7 zdzCR8O&MTe(D!!pRULFGhrTpCeh}V?DSGV#^L4Ube`(`B1f=j*IOm zv>()n;;etht}^CX{`s(q3ghKj!)JE5EdUR}SAw}!=3ZPOVfd$9nWkZeD;v82|JalJ3y%fWV?L?G8+@0o>i{^UeK6BeK#lxI`f@9tHg_deRS_@)dI z4|^#eSlhQO-We$UtytpRbi!n}RTu9xruen~f=}rhSBW|ue+!pc5(R=v=wM;sy zxmGxy0KS$R>s_P>@Nm5U0qGLj2O&XS6mc-9;c=M$V#pRX(}<&i-Pr70M&xSvN&v!I z-K!Lbo7no`|H*}pGf%(ok%P?Oa#ONRQv(2D3==xT;CoNFmpr0c-Y{n+32B9(Yy-){ zg@-eiCb*VN$Sb42dfrdGs-!=YNL*vsxV#K^WfjBpp)OD^uK(N(2(T z;ZEdP!BY*Ob{p1T4+VEp0T+!GD?ZJy%rwo%@9a|0XbOG@emHG;;_T7hz;-?>mo_7# zs=k_b-$4y7Dp<9_J6~8U%bYm9hAcpt>#MjpE&~MWEtg@fXsYo7dti~i%a$B}0wLI+ zF4c!CTAGdyL=e*#9CfqKDJBxeC1}78(jZN~ll5#B)>J-UgHzTjWAf=6Je9nPrH`t{ z-*-$!UXNK}l=-9!i5gD*wY|tN=BWx)qA;!C#i20GFl;7lCf4wP+qgcvyI=M?;Li=b z0b?IjEJ2IffkN9z9SC@kSP!Jmcz6pUvjpCvwEg25BkVWns}I?t3w&gnPZfwB>B&%T zoRPCpm`N#LrY`Z@wsM;cuu{OMWv2_nYJe}!C=+`mp;eoA)4BU~0>N38?VQ$f3l*C- zY$`>_t&gJK?jZvQF8Z6v-mg>FdnF{;*QpDR@ zq}*q>qtCv{79w^{ZW%;<=AIewTgWx->sqY;;tgz$el*3>{!K^W=U*4<8zAu!bEJhB zzYM&6=A5Zxn2=JJmoK!VN7Y?-y{vImXDA= zbW&8A)P96S@?0?98jVZ3X^Z1u5sDo-l~Z#i{j5~l?)z>{9?$uNkHpxRW5T6X@%%Nx zQg6JJh79I2FNO{H(xCKJbJZDV3fZ}nav4h+!`vI_I#X~ni)*!1qI8SSzw_e=*=;!k zfQiL!KD56QyK?eU-5KtHbpKIp!2|}-Cmy0osqY_Ahc4@YHfPAEtM`swP~Y0-1K+d+ z(y(2l#G4Dv4XmO~Z#pKM?#MI4Cps1_fq(nntN@-$gG#n?lxCFZqc;6kk1cuBHFOx| z<5%%zjW=aKrYIR791p2UA-2tbPk>->!3#%dn>h-Nqr?L{X9WhLuzrfFt{Nm$XIuUY zk6ZUMFl^wuyXLxC=Kae7H}A{qD^h^x?RGGyrWNu#FQ8X5JoD27HWTYiZ{6ZhG3Cpb zc>bvV%XWY66I3}sO9IN6NRJ|X5dAVe1Wlhgy&%6_PKvz=P!Vv$1)0W7=WeE7e_j_& z0am<19#Cg5g@-q%z(c5h^7hL6ltm6T1nbAvGitFS9~NLD=5P10v3%$ZY^*sxZczR7 zPhmxcyp`mwlGscFM8<&WlZ~+^2;%nd)%69rZo5Uxj)0 zQCvgqTaKh!w*W4lG`wzeb7#DO{@=8LwJ!qtaSqairpm$Rq=RZ52LI!fmu;HDs|%?V;wju>&q#(^cFC z-Fx9$g?%{qc6u{^ybOv8!t$mQ_Hg1Sn|K?)vX>{3`68t!YDTR*q)Sppu*O$7J#}aY;p|okxxh&}~Mu9Jjg8NEqxPO4)KDDmmGsz0+S3?byW% zWG+hH*6jm@3hCpRP+bHz*OIc5Z1d!$C{lhl{Osm$VmEJR8B;S#DQ6Q1TYM3Vv+0vB zdR`x$C=HFR7knYY|JuU#x6y+I*v`Da3h{3Hm5+EnauQZfgdRM8)Z$Xial)r`A%{Za z&&@&(mifU$qCOr?kT@;25X%E6-BS!i!8rRC|E=m+(a>2|a6r7mB!6(Ur(M)Ad}@elLv3O z00^h#)jRA*s(TB5Yzu>^uO#B)nVagf9%Qh1wJf8G#8BBkrem->Ry4<|YM~@@^m+Vt>lQ((~`H4KFC*F3G zgBzLlP|-Kx0o51Jvt;rvtqkwSMj3OAr6x}KqiiweN%Bo<07WdeEeLLXh7gh zu**_6u$d0o&;v|l=TLEY}W-PU!NqGEn}QR?oEc>vn4r$p=C_J#F^2 zWZ$=3vuCH+mDZnTIupPPhab)tuza8=rl+cx9oocs0Q#t%%*YX12{PD@!U8s!fA3MY zkxdrYYS=n-o7kMLz@veGA^L*mkY<8tSXvC|;VY4&Pclscsyg%iqus9a5{=Eax zE4Js1e|yR?qnD`yx$_7J;%duLir^sl;Zz{^t%*3i!yx6WjtF}c-nxcAsk-wxUlmV! zist6JpMBCjN4t9fWk;%hM*!sFH9#q>gK3LhD{1fdPI=1Fl`kAPk(PwzHdA+Zf2_{F zLiz-4*l60T0PX3C&>FvtpR574+*c!Rx-yvDIQ)1F6RWybE1-PC@QUiI$uDm8+;IKp z2Ja0fBZVTCDboaKpaPh7;NXpZBsDcdPd4ibicy;EH*!5zs_(b}=M9S=Rq$ft42wg2 zrpKu(E~@y>NmaA*oL!q}-=g)qlX2YJP0M+yp<#}da0w6)#}Tudkk5&SLAp{56rw3h zp8P;|a=a!>$qTz(=IGy0xobZ8e9kx<(glNj))Czg+r@(dGpRi;xaj`S^=JGfOcfJf z3|iLbfC3SuJhXgAuhRijV&6H235oLsulNY0d(pbjmiylNMg?_lt!zwlk5_qKPyIxy zzk@vn;7R3%m`%phgpFzFXWk%Pd;^0QhZ;w$1z3%DB1kG z-(-i2U!4G?09UZYF7K%qy_GA;?jx6(KaY{!z#&FcgEI(;+jFIoqBu?6grR+)(RHkE4_nf~e zr)CfePOs^RHV-Gaqk&YCEIrIXuAx&TgSiXj>gAQG;4za}XUEAv?dIKR<+UdBU85naHFb%fi(<~vHIrbyS znur5Zx_~&@BNI;vZQUAw^T`>vk(dcv?HKC~^_Gq90sc1_8Vlh|sXeTK2KfzYFt*{2 zuedjI@g=RBJ%P|yFlZQKC z!F>Y?gpvn~(_Mj+`UNNywTajBml~)=^$*4`n&U|J@I*id`PYo&6jWh23<8r_wd~ zY=+Z~Gvu3;%FNv!*_s?4X!Ey1QE|(#H(y?F4cKwilP;$S1%xiC^FNVv=^MV`wK3Pu zXopR|U78)(6Ft$7EnF@5j{#}C1$4o*yh6$RVHf4uNri7PQ{zL2fYM*mUd43^X`pJ` zB5znXxM_nl70Zd--^m-8mI=ZLCBA~)H;lejwC_GU3sP1NUs4&P2oR~M63fb8rgk@C zVIDEHWZ+kf;ZPT<+ zm#7M4a!_j%M;Ore0Pc2-ihT;>KIqW5tO1C5Sdv7HFq?3fnl+0!mf3V@%tv6}=FC|c zpojtFtgb3!I{{_i@`OTee%E)Yqq8{8TlUmnZH_2fFZQ_Waqv#(ab>0X2IbP>cZ>jH zj}dZ>dMmgD53!vr3{|82!e#R~%s5-sgd{cHw^NhqlEkfO7M_MogagSaq8|h)eHRJK z8=FR_D0S<+>*WXQo7Vv#K}_nc1002T!~42;=kel;IYB1S{17?MBea2MYs(y{g=Ekg zsIS+W6VrA2SMcvplA*W3COh>*%M)1cn*`Ptfbb+=IaQgtC^ERIMA|N6FLni)<#!>3 z5|I9BWmpqNNS{2mPO?v~jqSvVd65_&fuj}~)s>kOa{%gSbTc2l+o=(K5X{$*S<{k( zOVfxI)=2K(`9tp9U=c@cYvBFADq&)e@wANgoK7HU5LO*FC2aKzT-1*61!XY}^QDhx z#Rf5O<}E1Af{x*@Ys^k(x9x+Ks5>1B2;GW>7`KQ_473JtFmD4Z=7B-3|9JM&~Th%2)Qkn-ba*bea z7n~acsQgoairWtX^H5DkZzOqNLOBI@S5ei8wzCDOWWn)ipCs?q#YQ6@W4kvuE3>^o zfkcI7scxV$C9Mo61MH>Ou?1!08%=V)D5zo5h{;dpd`qCiOw9 z`{|tLYUiml4yV}?9Bbkt&Y%BFrzLRNjF8k1^WQGtpFg?;WFt09qLa%W?{OuEu%)## z6D_Y{%el$4@Z!5G*YwgAMmp)h0o}6P zc@b$2UlyfR(1bD+6OxcKs+7Ll5< zFVjHn#S7@*xThulk!hSs8-C#ffj|(KM0??f_gAgDDwf}z4$ACU1voC^)+ttMTPCqQi4`hRA84sb|!Kb_s#DMOCiGS{KTADrI_%pV}30K^h4b1 zI;_cPv{#1ZJ%>K_E(6=l{tV?w*`*v!=x|{iKYc`w7k0xI%EEjrbP6b;u*N8>R)rX3 z);{W}7Ce>e60B1J8R`lhvj4OIGkf{})An4{8Xm-K z@cv4ejpPUJ738h=^18?=U#Nb+%dR+`o?xJ|44MBvaZ(%g>*RbAVTha)X9?IdWleUenUH(F11#SPvu4r`ts-l(v8)Dxf zJGeDC7zQMzl#d6W576hJ59hYD+TTpVy1%|93&jnqVX!I`dFBsIV$XZ&ZkYXjwx&X$ zbtQ%wy{on1K{wX8D1EJFYr+GSog(h2*$h&?*Ka+u$qC2-{Zv0G-G^DZPgmP$UyN#s zO@zoDW{)Nf?Kj=>(-(zpik^Bu=P+9bvWL$a{-xZWJvXl?m+YD!iZt8blUEr3En0SF z=?KsZCd zb3?63DhPSIUm$ox4Dc2p@UPU*16ATwrV)J9h;qpN=)-8~(WRMtl~-W~9KHsb0(*6e zL9Xe>!cAzyeSgz~$S7;~Rs$zi@T__?0_m@L@ml|;(Sy!cZ-`aWb8vhlu}{(aj^Cb4 zg3MeKh>>4RIgLDjKSm8`cN7_1L{)vnlAI}|;BF_I-+4#HZ6}BVG(UDVi54w0@lEze zvPfse@=lWAsSw^I+fSadK-&YU$-T*dJ*$d0r`rW-zeISg1|$N>EZx3(9{!=`S0G!r zVjrnTE7a_zf@^zZ>+Sai?PS@$%^Lx#difW(ECvfVTm0THdEa~xTz0B-3%OVkZg3rJ za}0Fm(%*DJoq5sRLGWunS;|G;>gt+a-1xc}lE1e4$zSo2MGI};qXqy!$hc<>ErSXJ z?LVCxziec7E;;|whY$gDrN4hEW2S@0+s3=e0G|y3^+QbA)z}m^r(~}tYel>i$zC4z zQAs7-E9@wY8{I2uwd}wZ?7%WvO{3y!`~lhcCbborcs<}T#1U_$jblZNYj+}mLSnbK zh~*QrtddakrVst+Z`S=_q3pE^3OWI7mc&1o%V#d*qM*1(J=#2r(7C=rTf7%WFvF1- zs+9|7?L5Zdl^&`-j#AP3Tj{2GMEWL-}!k zno!yC6=b?{39=jL6D5l*Q1_ZkgmJ(2lO^EX)|E;;rQ))l>Oj-2;<&yj+eCK@Sngrs zJ`R0Q(7nJSwRND=Zu`E}(fFieco2|ggsQFPgD)vg|CAyW4KZ$?AWI)2Lo?8TR)|ou znEZ{~aS&0MEH@H8>YBZ28e9hVcd8Zb^_Yx~xwNdmJP?rUxBgg61Zme2(;jdZuA~=O zWRnl~DxCB~>g{?DV(7I9vPdSu{h{O}(5nG~zFnyIe1PAg6qxocuPy-QoJ>-y^vn1Ul}NOub3~ zXy)44%A(t$JLS~H zR7KP6Zw$*TprUg*ZbHI)QDCo``SRk!0{B4M`d&}PZTcq#;Y#gJDo}9S z{_Iz83s%@&IQENjer-re9RL-(_Z|uplWU#74(ncYR_%?tvIwZ1X5EOV@Ve3`f+(Nh zp@nFVz&$5kw76fjBid|3n>_ns++foBHpT|v@6i?Ff84ZafGsS=W9K7T!69R#Gki4y z8Dy=gi{NUmjry)5ENC*#FFl{KmI2U1+Qn$ak?SA9U}-c`_?D%;RdyP~YcWLEcG@r4 zK0vROkf3}%d+LXo9Y*%?kT z_9go+Yxdn(Vk{Z!80!qi^1Ht3zRxSixu5R){`LIvJpIvYUSsCFT;I?2S>NyXNEp)I z80Yhjv@;|lih^DxH(~X~nv+#X4@|Xqe~X$-0+BYt#WkX#F1X8wP!Pzfu6N(av7P8s z6Ejy{#f1$Mgq;BR=c1h}P@DC_1SRAe1xmdgiGf0xjI1nM9bCw-qv*Pilwjmk#iuoBCc!6 z^MSH`?98=%eN96viBC3{T;*JiMgd@Cb`vhQv6(1DYOiYz$ghp77N?69Wm@|_H4UB9 zbhZLoVFArmMx5kZTobW3!U&vC+v?oOr2`Onw|wVuOT_8NH}i>A6;1W>7ihq|_r3a= z)rnSLelt83069q2)}W4DXG{RTZ+2E+Y!&Qd-C@FI9VJXARhZ( z962A(v-e?dId32Q}(uOXhnKK!vd0G<9K@Y zn=w`s&!Zp>FZsEi2XEN;i-`V{1FBKkv^_Ompx5Vj=Gf@(*#~N_$1qkv!$GTguW;q0 zmwIAjP)@L7Uel`iY>zfW#pjTpGpOeaAXGt@SZK;lhsZP)3Tp|qkF**!&62$1a9E>t z9*F<3zpzVT6D<_pIA^#)@N+nSjAEO;{8gNkyH#XcZxNRCsYmrwFcAzXxdUNfI(TLi zq_YNi5P1MK(%IsG!tLg1@7}F9ad4bpw{%YSv-EYwCh%1$jX0gE;`-tS@!r?PDwidJ zYeFXkzaO>t%^=2hq+c9a&>$q3&}ek4+7_;_OfK#UCAz2%kJqw4G?BM-#PB>ydM3DW z#?AM+8fb^dn;JEZi_3kMAm<)9a8mzI%z^Zo`#7ItxTW+(>G!xm5r=3%iZDPrPL zD^VI(EP(jFuf&R82VT9>75Q~=Olfptp_+qeazD0H#i1s(U|PE54>Fe| zIyr>z3dp|I3cE*lia>R_VW)fAEMOW?mfA&>u(aNUf>tBk!Q{x@r<45VCqP_GT|wSO z({9+`0S+Q1KWt)Ql>#Q%W?D@UYvnF?6IAf&bL<>p%(QE?Bn#wrtfwH#-!CqU7D7cH zt2(y|6E7I$j-;Lv5#M8f9v_dxDU|5!uC1p8Jkp;a3*x4%w4CZ4LX0gO!$39k;c`X^{EaK+U=~ zW%p23UzzxqCmrrZ<_D*tcdgU21uO%&)JXR6U3fb+_mB-w=(8AlJI^EY9(=wsIMn9E4aBVQ#kQUo_My~=}NX^?g7#x zd15nB>#69)#NuelHM8D!vH|nKEZ_Lj=R$e|&-nao@ayCp*YZ&K`dpB!UII-Zhn0?L z%$o^nWc?jA6M$QlYg!ojg^1})>yg1PtMK;UiZbmyH2{GLj2pwp$$$<}l4`Eqyq>)K zNy3a_^&4UizCSsS5X$DU0k%Pe*wFayC2YXs;-o(qGHdHLmN6T%!o7(!L1LXN0REiD z;|6d{0KOO_uQzr$YWQik5AXVnmt0Ac)F@X8DWNrhhj!9EjZD==^mPcUR%5JPC$-T9 zE2NEeYs_d5fyZgU-Q`k*8SOI=z6b!sgWy7-5 zvbrXqBXKIwd?&-um!E?Vd{t7yi=UIpeim{TTfw*AG@dWrn(*C9ju4= z@(y79=qskN-PDC(Lq!WPIni+WO^GWX!=X-=>#Oowt>V$VICOmPKV>5nOy~?!W(_AD z9;AK&GZB-TmtKI7YDgk_e=eBjhk70ekT>N)!%{HNP>xP8dEnp+6*#jY{JL6+n~)~B z3^X%{=-vZbbRrH8cl=csFLc<1O{~NVVIx`N_F=2yk(2^_-;vk!`^~R!4iyVZK-Y|e zq60xfMAiV_&JH=9huygOHk+iH9?MPq{lc?KY?lH7pZi51@bF zY&A-y)h8}@2mr+GEW~Jk268haFD%n@|5)bP zO!?VDS}JSOtH(DH4whL{uDxIrcU_t7HTvRVsy{=Oy_B8OT^%sX*aRPN{nCB?^eNDi zFl6J+@U5s&{)ZgEL%}FY6jggSA1w`$9yPF&*Czit&NDX5r6{Qzk0;ru$IDNW`w(z^ zTBPS<>3UAdS~94t;C@R>)$-E|Hu9;*%J;E-N(M+Bw05iV+m-jD z5bE1y*wy7`oMk`?Y{#8KDUkG`^b$mhdaXqH4|^#bQWKR~N8 z5T1CroKPP@!S1>+=FRwk(qQo-+BtT))!B0PX(X?`Z>+hPrHR?`dpM-a1qGZf2V$<~ zB-OJ_P!HY9{;>{gZvj5-JU28X8__vcw0>?*0Qm_(tt_Di(~m z>6q3ABALO!MIUU!z!X8SOk3q4E= z=J?RB^Rzml0!i1Ts}!lzGPfc`63rK0`lBjv%g?pdFJkGW-;e_F*-4IM&_cYC zx{9|NDaeM1Rta@6qs0l;Se3=g9bG;EtXiZe)_IjrxH8+L`5Xk4baeBtK_s_aJsI(t zb5_l@70?Ac$N6SzDNMh+6i7F=y*U}skZ4gK-TRDC=W`}DN$P}!c*Ndn`p+YGq&-0) zuJD@Oi$)Em&l>RciZ?odA*~gE{pWnFG*}c==tpAg@tCz<1ps6 zucMxuI`{A2FJ0`T&V2F?z0mvUl~kqS@m;i!Xcx{BK$T{f5S|WFR2fSr=Lm**402j( zqilVuJHxe0gZ=kzCp|z62HM-NPEu1P5?W%7b+30B+n$w!D=?2P#3Xw#vaejpPGZTi zcz6Q?T6AHc`E0GF>>+1HD-a8@mDe0I?8k3y%%yUeXNE;s$ga?I0Sw?k&dVd`jh8Hs zJ34nu9!X&UKZKHsg32TO{do=W>IQXSzQWU zCP@zDKtQL(JUJ`$MAX=;8u`n+v*GN|!>Pzw74R$0@@LxTL+&OQ9^6&bv3unv1&~8TB%@Jzsnt z>NJimyCYW`KkLh+dlK$ugh)aU=-VPDB48`M!<<}a9j8V%pMpM}6YVUKk8@24g!6Kg1SfjDm zwmSTL+!gMd==oBu1G%J^CJ_@O$pvHqiDvnLc9Zc$&4i}JgE8jP4qv5iNLUPt%*xBW zNR?&YxV#6joY|9c(Z@aHhW(j1)AMPQ>7NpiM<|XW%PB~PH@tDhn8+RRjqHogwY?Td zF?^l&C4<_7W1IA;4m)_qFC9w3cdFGL7~>Pef}Rk483o_+4?|F3vrM&7Iv8^(=qsnT z_4RX{(^PYBwtUz9XfvckOI^nT4iogsz<~c!)WhO4Ons=vn^n>Wm9j)C11MQnG8h27 zAV3r6a9W~SM$5(D5J*#U2%5z@{2KMb&gx+?;vws^Y$kUrg3RJd&&Q~J4Y$6KpI9LR zBX@26$A>;VSi?EkIa69vltRv21j0%t__^g}T~WYTq^mo{Yhkz;9P=FXF02n&PLF|2 zgD}4Gr9XG}1FgX%Wd!^gf?b@~L;s2$(+7vLu|H@YNJzMb~0OCJE6W{-;`BXCwr?eC8 zdwlP|xBvhBlb*d51sVI5gtLG0WWQrW{s$j%e^J_evvSd-O61uOGVwnb_=tP)gWz4O z=T7bY(c)tPtZ~QrfShDv+5bt;{?DuX4__T|uZ8rBjIJO4JF(pVEq@ON$eS{tzBl!0 z|5^C|poezX-5dDzB>M9Ia8^d& zeHy79zVhv-mP&|y$N){FzMp1H+zNCqpW1EXgEV;YuI;tR3&j%}hU_O!dx=Ddrad=1 z4GJLcw$d^JM`sEjJrq4u%M>p>82y7C7~TOw0nS{+~c4A%NOnm3PpO%g0^XT5iKXT9*)bM zrT{_OM`kj+C7}uy2l6}L6&~SM-v{r`k4ab$}OJ1Hn!o^GXb!(mJx4oW$vy2O! z#fAOSP5J~d?*I0xqx|W+nsC*6xz)dHJvVf)QkLU0E|d{5F|oCr$9R^7daE~E@3;Bp z0BBD!n&VO|C3#O)`Ehej=MMX+;JA`%AZ~GHR+bT#SIn$kUw8m8I?B>4d$Xs|RWFVl zlw111%#);q(A#oJf4ib%muSfI4kV-ACLBySaod};I;py^+>@!UQPzH}`H2l3_V`~P!E)q~%}+mZWnH~| z;r3tuy7`WmW+}S3e3CTr?UVh-GTNlkO)xBRTNsRPu`Z?erEcr6Q1a` z6(gb(^Q=qD{e`g>{fcKS%c1Sh>}GprA6i-M1Diuty_?ckfCx(Ie(A~|^+ZJzuP z7bqA~?a9Ph2CDe5qJm&ySRQ(|uxI<_`pY7Z`2ee1qa*{X%YubeVpyol-W=P1*=dbt z7Vn54!jnqY&82p3F({j-^c8;~fm+i?(n|hh3L_-+QWk;e5Am<8$~0{&16WNq&%H-( zari6Zp>FI`_}YYK%xqT(_`Q^+bxH}ZCo^wkliAV5-a`u$0jtG|n^_?)^ zhLH2vI=a;pD&dEBG4q6D5(|8__RfGo{$(C=5y@3p0A4J+3XZ}ogP5+bG8`;}I9vLF zLp2EC%=8ceel9Qf{zQBHAb@~a)r^?KsrMe5o7W8~`EsyMgMNBa(Sw@bZ2-&Fh`3Y@ zB%uxgQpA1;l!_7%heUGfnKh!b~TyEW7be37<$;YU*b}6ClJ`^R`-oE+H5(j&2f4ZIKL1pN}0mL zI0XYlO&xQrSqYt?J$t9yHR%y&kK~|&H}1HQYk*ycKCgsOOf6^yN)}W9;|0H zUROy^T6Coy!^nZ2YZ(OcoLVVxBr*(F`!m}nxoxa3hc@#C+`&1tZ&XPXw?r@Efkao57G5yt(}B>iu#Dzh{?rV<^<7@} zpa*r*yo&OQfh9I?3FcR{(5k!~I$c~2_JJ1w5l#*Qp#z~vaqH@Nh&-WBB@^$qRHH6F z+3LvuV)dPUP zkSWVnjRdV@Wy3xq#B$dMwjGn^v|&5duCCfpg`C^B0Y(Oa-jo}mqWq}kI`}?7#pKtW z1S@}|>%EaO=yZPf3Y`cb2Rmf;po{lUjWT{f7yF^5U$AVK8${*Mh8~)k6udTi?Azsb zy)XdObIg{&O>pp_mj>6oNtHBc@G~HfAh#SJ3>Q#Kh!iGP(=8)eGFG0J;!-*BkK0^6%N{Xun`o%y|?EEKy8G;Nt zHBvep%#;Qpm_+s&iMw6(S4Q!o7^5Pf^Y zfAzk)>}i-Lba5jYSQ%~+^UIknvGa>jHS4;Q$&PfZ`98+5Z_R8hkp?i9?=1n@A%%@xeN#)!R+a@#ttzh-y~^gF1_Q=>l5`y*f>v^p%kgQ3ixbx;Fh&H z&Nz0a=xR?9h(I*+{9Z1}vn1X)5u@7IX|7aqk|bPUT>`l3q$oXsPKY)6)IK6vJIC|Q z8BI^Efz(8$)BQo6{)a_=7SPTXaJXb{Zr%?GnuX^ed!TGXIU1T-E3ZB2yPIRBJAOdd z)vILzfZ`hr-!20fL;%IG7&Z3_vll=EG{{zS^i1EmJp0GqgM2Mjt-Fa5s%Q~Y^gDU} zjqbv>d0TTY4a3r6cHI28Ti5;VZ7AEI!n#2|qihIrZ38EOTUItqKjAiX&FnjcyH(YqK%ZP56&=3~HoT68huT8g_;K8VUuhuQ*Rz#CiS8kw<$1#XD_yss`un3<7XXlfwon84ll$En`n_XX?ep^V=q;==dd?L*+K@#f;> z`66Q$ZBy0QHIxzi-}>v-96Zqa=?^nO2yHq3K->YR<&hu?GV)HM#+xcXAe)Dp*9?VF z&WFVnnw&I#a@0X-5kI z4Y#fY7&N;V9M{s*!=V9ugd6xREcucqZW+g?09RXL4-MmqG3zfs9g#yhp{d$AR!pjL z%MUvJ-Dd3oA%`ZAcW;$NWRN@pIE<*4PTF!K$D7q>w!92u;bOl z!L29Zps%2@1c?RHY)(arZb5dY1*ll`OCRsh2it!TkbQ1Hz}*AlR-b|~;{DnJqE2ysv9UO+ zrep+u9Aw(lGYf61qdr5(;IsM{wLrw4eyOU#G3y!wV#tzGE?AConf_TnD9yAgDGv+` zw3&#UZzn_NKS-bqm+QVoeuxHzABYjpgAKJ0;p} zzv@ks<+_0`)Zl79@$DX>-NW_keURu=SqC{~94(;KY_3^ZDDQY?b~a&6OG}uoBav;5 z+L=?#TIJ7+Nu4x(3vyn4Anp`1 zGRS3{XYq(hUsTmU7o5f)(1QpxzA>8j;!dv2J4#_LqP~ zr0CzF^s~P8rq1M_i|hnvm-SymU9CZES%t4orjKUP1ttnxESa3VL5-aMOwZ>(ja{_g zvhoT!w4lgTKfUe1Hpe$$Q705mQ|(8mW5RL(2wgc|Zm6 z7_cMHi4)l>s;#~?z)8*2pKp3+4);U>0TA(Uz8PF0%0QC4vR+zl^5aWB zsC5y6ax%2f#k&}{}JdebDB_GueUQkrTL!PEG6`6}$G&CBz!K;Ruzg?ha z6X2v}=JblzP)hwWcGX)}WYZllFu6}plO})tWqRlB(p0`9hFdm(52F-nrV{7wh9Ui5&LtbIaasL?$6ezU$1tqC(Gpb>3S$-$BFITpS zK>s|zcfLra7ZnrZAE0n}v3;*C{_WjvdoN>JQ5x!{sfI`1ZuxU5nkMU>Wr@hnE${z} z3ongkO~a6yT?#n<=2}lNWai*5DTCjg-+Gh)T2S1w^EiKg+0G=sI&z5PyU#ih09vq! zk8!%swjT4V&*i!qWr}A2&5Dl?c6@tXV+AyVg6k7eq+(Z9mG6C6)`x%->_25)=DPht zE5O;~NIT;e9cY_WzxSBmeY2Yf+;{w@wY6p`N#R$*wl&_?ShM|g{>^GZA67`ti+zj{ z-FA!ri?4m>pLQRL^J;!ns>t?lU)Oh?z+Fz@CPO};Zo$;urHDt|x`*rDO6G4~TN=>+p3!U*w7#x?#GcHY9Ix2e z{n-}XTxJnT=M{g9*{)|LWS z0tXlUn*N7a!dM0r$1_QNoa>{}US(urZ&|>xOW^J@x(7b|sJlz+Sh){nWvqs>aR6N@f!9cI+XY#xnN^ob<2u>+XHBoBf~Rh>6Q(es|NonS?( zeMOXgg(DJ)obW6{QV7I}e3Sv4uQ6u1u~F^CRpKFbYDA?5E@tUa5J5&pN#sP9x{kE} zC}myU>Z62i=k`NaMYv;-^4k?ia)NK8qL=MK!Upr?yiHo&G4VR z=bVf0<~((B^;PxNR84jF?zQ&%*$&lElgC0QMSu3}8J41gjMlSf=o-(Sq5eXBf%rvA z@Eq&evp3HaWh8aHO%F3)CJ^+z{`vF+B`G5|!jd5L+gCct=ZP7-ao-h2-;fL#Nbo4D zDUXJQg>=699a2IkN%wuLKFG_7efe_gvH+`V0}dD!8Oy9JtGq7*`PO%|2(F!N_C^2x zj;!$YFRzcdfzQwrxNRDRb@1Oj|GP`}D-t~s5?ai&zq%wMXe9!9dR2vAsvyxx{M{88 zXaBbgpzx*_FGqr8vnb;qhQEA&{2Yk^{=a;3Bs$zpRE?Yn7wysK@qf2~&(Jh-wn+c> z|65-CeFu;~M>K%b zpzw#ktA514&=ZXR`Rj-0j(UbNNG!Nb&h=OA^QUG|lq&zWbl(IL%YQ|(ib!|GPWj6% zL;=zMvwvHdR$+$9gJTE)U0R6&jGe+{K0^K1gS_S#Isdb@q5sJv7+JU ztAtIJWKm^O;nD8A2^IFS4 zC8Nth#cJLD?#0G91Bux+7;J7?Hu#v%A4g4veBp2$zv{zIAKeSj!#UJQ3Jg?KRC#4h zjqNjwZl7CJG)gg@NI|6wq)!AageXKG|Q; zGJfsRsvXpw-g4syi%C=#(9h!gAnG4ca3ei!wwk~c-KH2P|1#q6pTF8+egy;<@Gr9~3 zZ38A>G~Q}XJi(~DaQtg-Mc22taO0hK3B-pNeVaE6)impGHWK)E z=Opp4m&FiR%nE#m_psFmb{8UMi@B{xFt`yK_rY%fo!e>jFFQ4`gcdg+d9a(d?2TSK zrlveEX;a2oT|@KT9(QF=I9a6M{!&B1%`vTJ#j}h`4QR`OposEcp%Pp$S~qbZkLJyJ zh>3u8eR`x>bcQa#m);u0bYxUZVXyNrmM_5!Yd0+QOgKFwdScptM@ApWMDzLnk)KWp zmk4dMPd4M%oTfXW!2k6DPTOvk1)Y|YE+?7PlT-Uz)!Va=Xq*`*pbwp>YHe z#Za3VCa@c!|G*%W*ys+;3Ll8XL$d08-Glo+|3iHSZou+00;Z$lRkO$Z?G1}!g{gbHC>>!%G%)cqLAAeX&ggTw2E!K z=;q4l`TwnnPFERlOm6Z~q*GNCjk@Ia4_1_F>Q0Y zbHyqUeleE+zMTd+y~)4qV0So?qOM3iED3)*KrbiaLdlSh*c2;-5ckKB;D+i0^hJ(@ zt++mXgX%1?^R>b+ab#>Nk?7!PO6u8gTU*$Ed0CKYd3204wHm8$A39(;uCPW-R)(Q(~1@hGvZZ9cPKtJ7uWdi zy#M7MUZqJ#)XQ9)uV0_hDQ5K3Q)QFQvh;)fPL4&dN{0g<^CE95X$w+nJAkXrDDqL1 z@-{Y1=tRTOO{}sfRAaL4M}0x}e(m$YRqb%O<;f~S=7^@1FSHDp=@xYVE0_vdN6t&{ zpgXsCh+3w`x5|@2o5(kk*C~DUZ2q+W>o?Uz-HpUmrS1xJBts0Z#dRB1-$+w;Uz}N^ zS1lPCOMZm)-fLt6va<=h;#yV+A%p#$M>Uu)RVey(ot3YL4 z7iOEFuWh4O9GQ-SDmL~StU%~Oa@wZ;wCYfZ&v5A!u@;XK$6|ntr zi-up~%EM@{&)JE=S#aiCVs-?V1FS1%GB_-64W?qf>H}q1soTg z8XLXW*|r8Uc{_p7o6d`0w4L9tYo41=wXS}6JcpV$sBxG!hv0R+$kFN%%rw0BJb4-~ zG!k!Ue+N`=c_I_AjVu_5E2~u{o0Wd>WOwvq1Q7H3qt8^W=3Q492|9h;yx&$x;|nz~ z9Xy2J8&w#Cu^(=z-0g}j2R@eQ7rzK2@*6RaZUH<9*v&Y7V|_C9D7%0Rwcx$;0?pn8 z_b*+MHSnEqI%_OO_86YPVGncdn{LRQ#$g@m*)DdqQa@bnj8V=zHZ)b*-1m8sDp7yO z(X(bQ_*{(C+N@M)7A)x}bDI6`Wnbj>I;K&00tUZ(iTI4)eH-j)91TxyIGo>$MO)>$ z28640=qnXYC5M6gP?AReLp~42~EzTI`+Hd@`cZ zbb8;)W+(hlrj4DTmB7Wu%`e*3Yh zNmr-E^T;sABfLm#dZNn8akD?x!e**Iaz2ZLRdM+V;Pq^lUTfj|OD5xzocPcAL+UP@ zy*)dTtTFElc(U*B*f55K9&pH`GDW=RJuU7aE&Z{g>0wLLC5raJJelG);YF&X-qSGo zXv%!6^e7?sJ+I_puw8$+6ph_LmG%~82o*ultQqHVJh44E=yZR@{@L~6ytTiBLZPX9 zk0TxcaL+OpTdMr!2AuWZ#mZ51p@;c7 zAR~*cAW?mfbV28!s3Qs#F?D-`jwIcjHqWECc2iCcVan|3f^xyvz+natk^!}}Nwbyk z)A|pie1vHGKEm#Dg-V2dF@XTxEdfRG3>u#lOglzv#exyXbZJ}y%j~SV!Cz{>E_HD) zewK0|TMcI5QL}!drBh@#!}}H*Z(TAJ{<)FEk{j|aG;d!u+c(-L?-Ci zbsF898bPB>hi%aM+@e>_WiPB;!9u^vRC?sC>aZWk^T=**vAleeOJ{3r-J;qDTD&7{ z%WF9;WjP$PQrbodoME{e06=myl^6FSDsMx--VM~F*=5JH8-u>cs=T4sb((ALA$SHb z!CA*+D#TfAtniF$_d-A}@IB_a6`BOyRHS_}wRvYXQ$w%I&ai<_)%08`@Nm9vBW2{K zr!-zZU*>G~3#jpP2G7+iHWSJXZ7|om-G`v-m)RV|SQzrt@Yg0k?}w^7a;=~^!^gzp z=ph_13-P5_&3-qOc2hnq)kY{vrFUI89XXD{9G_^*^NdEGKBp`9kur-3uRMl>1#grkQTejEdq@MrCVo4L_G#L zce7I^4C=jo_Nh6p+UWBo1qC35{YAPRkRWj3#OMe`aFrDRhX<;)I?r0*P+MgA8YP3*N z9{*J6RH-(#L2bc`dyfSPdcrZ@fWLN?xm(7&yC!YPR*y1_5t>WKRq}5_F614I2U1ZJ zx2L)PoO;slPObUY57LK!qV}q+CO8JIrM~h15;4#;b$zsQ!sWeZ6YLJz z?8DaAe0$Z!l6MdCyz>lnGh#}Xs`q3I)d*}-fL*!a+tMz zi%f44DctnGn*Nq@cII6tDq`O5vgvEHcrS`t{*aq{dpS8qA$8Uo{^G!n+_Q6+_0F{S z!O@7uFUkQG^%?vgO7NP^_$Sz}!_9_)Mw3%?Wot|^uw-sEuWS5C+0Vg!?T+n!O))0{ z1~mP?Q`F7zpggN~lr5|8qxvr*Eh3V*l6>Bvb!k#l0==rZB{PEZ1ocaL%O#A(t=EUg2@2 z*Er}*FfqIA|0+j}mvs$lwi*y6f0QeYAmeS-3+JKp7REQEh7^ zp@nUeBQKA2V3dV#ki62M0hNTOz^(abx#yAA!@&d#P*Z=~80wjMb}<&L^Wf?PODk;L zuck-0Sbo8-5(?2Ro9`!J+8xXM`K7AuaFTq_B5qK(tSvGS=C=U9mAW3dG4%X=t2@8( zqb`QgE9C>rx%O2Wmdo~P`GK>o{rFc?wN)&4#p#8g#n0!CIA`jg`NBl~uJaHGZl|x- z)GD(;HNAJTFze0-Pi=cB@G>>n8VLa!B@qZ<_`zvB7_8ASD3Zl0r-gQv5pbyho7?h% ziIFNYwb|`Vnbrx~Vv|^HP9*ZMvf6H%naMRdqYmey+YD zj&0lIcuf+JeU~6-9|%!mw9hDDqDml1{8mdN%hspUBT0Di#PAX{YsI2@*DnLJl&)4^Kr(!M*g{xH@C7} zFi0;@3lej4GXK1_9ZuC40OxmF1_3Ks0sYy6IClC~L42i|R-)w+2D!$}Qx%5K?FIeA zI6Y7JA8^G@-w^=##aDp0FX9+f53jFV&rkRd=UT{K2E4T_l1TR78i{|ExWe{>eBR96 z=;>12y2fqRl>F^uu{6w`vp}xryzta87D){fQec?P=O~5{3VuX6l9u}zw0#s+%M`Oe zcU~zGFlCKfZEKtu6Meu=*-Wr0*d9vIz-(Uv<4}_|vd;IUU#$;ixgT$M7=wHk;Cp%ADV&p`MS z>$qypXtBfN;&pEn$xpsgZE4fXD#M1+L;C~1(lg0mJ?~a6l%}}Vo0tB-I_X)folpGh zl;fOQP10ZYXR^MOi%zeAID}h%ILc^@294>mrN6J~L{pAUMC4b5}1= z$aPETeA|yi9Da*oiEXD>^$k*}B!p`62h0{%0tmdAcTbn!7`>)bPMb3Kw_L`g6eD#( z`X`oI`^Dw{G-2GJ=XJ)9oh1dj@==P#^~?Q$;aacbrQh|;n-26Xt4~7T63b`TC)GQ+ z7IDS+?e!#qq`I-Z@&dvB`-feYQ)n!a7l<}-xmKAIdsC|eyXT*1mNY3)N$osJ$Py2D z4i$9x9j0sV^5oBCst}KEJ(?xIJxE9>=!IW>x!cqg@L_YuajwlLxQo~{0LDKBG@hqPi$(te}eYq=E!-}Ds0Ai>07j%+GkLkiIT5@{;HI*iiz1>a7Imr$bBa4| ziq}DFK9e=x^DKn2cgM@E-mMTLo2BZ?qvk>?3XvPF&6tz-KqCR!7D1)*+8OY8I?VB6 z=cqr89Rn^5cpVx~Czt5Ok|P(%(w{;N?rI2tZ{zkxq~{6sVn;+OZpxLFRLn?cHC=p5 ze&doS!;%QAAFzlK1LvQ9+3M%M+!rJ+)hg~R3{U>z+iuWf+-jXze)9aS%w6&g{QJ+% zm1RFW)%V%Y@9QijRm4bG28z7xUD++v3JL{vx#Lh)BSHWdVw53b1IU8jbDe z!*Efl3|ePSIPT}@J1tK9zw34%``w&uHt1ule~)sc2qPI2bDsU_kEOrryyCoSSh!hf zSeI)QsI~fCEbHBio^W}#*1$!qAjW?&Z`VlhPm{%W>_W~*bH4nrJGdMsd8PY8WRnZx zJG8pli>V#U2o|oG-*Mm9T3K!g=xDXu2_F-X6AFnIgt_SNwBRuTzn5fik=fDphgQ_Y zQ9Dfxhdkvz(L~7*G@GuP34UEgR(ggOApXsW!nY*1S2Z3z`n5{mcjPEYc@sIa28d{W zYukDiL5!f+6hG?Kn;N~jFSK(t>Cy)#iPpMHC!J!GSxv~V?7&c+9jNoQg+V_@hVY3ersGO^bSKKi zLgUl6zF&kuM4JV->21(z}k(o@WgwN#^{Sufctb#$gRzkO!7M!o3|eKR260&vWYe52{humm3pfY8J{xh&{Zl)1-2+jly6M` zskT<1TQd3~0R||(5($9gYd1m`Uk^x{-WzR`G1G3SWW&GL*w0cXZ<4<&!6_O^f$DL6 z))me}Dy+9BEV_igpX3T>^F8a7rMFPD%9&e2o>>pT*AVd3d{IB|>A9$fDbM-Nwp2ZrJ?gj)z$IOHMp4qo$yU z7c~5zm;UY|FAR#~@(e7w4Mb+#_dN-Zyj#G(;^RThOy?6h&%qRVBmz$FUz)VGos4Ig zR{b|+G?44CzG|;{FQ7gW=#p^@r90raF^4-6@?1^T_WFhr4vC%D3U2z(AQkEwCc=GR zp=qTcHa>jDsB9hS;RIn?DLv$Ln!8!Q>y7(JvIFBgS1X+ZCs;E=Vk?`qb5OF#R>}TK zQ}y~hMCCg9g=&_m(e)2tx*lR@deh`_Ro^k=ezJNb{xvGocYd^`K@%`Gk$?8{#(yfC zqW0%(g%7FX(q7lb58ku&oakYKn@X)2Wgl3}Cqe_DU+yxDB_cSA_{b#yx={H2`>)bs zU9)y~4p++nme|E3s&lsTb0_-XmO4421o$8AMDN2aqwzvAz`);_I+%h=fAycsMwtx< zgwS;V-r90ozfDH7A%M*UG`M|Vx7cMRdj0S@WpTHSZ>~Vo#Qk_`WxY>`XEe2L$HMtnXqKF6D0!vu1mm@Jn;=T0G=-x)h%Ir)F zIjrB^%#$wgC0X4OwaOVQPp?(QcTOy9{}x%9$oK>K^ob+9B+i}u?l!n)dxXkn9fEkR z$9`*XDYiCZ-SGfG^>fuusnU3~=!KkGpLA3=-Iz5Ot=^y;bP8*KW(|g-1|K(Ti5D^X-($;FA18z-fqj_I+a=>U^`g5ShNyg0mnXy^`#j5(-keP#48$t3m3P)nl5-DFkph&H~e>xYvlh2p~f$Ft&9E>`a!(k&ll(aX+G zp4N$irwXbFN26b>LWS7m?Ss^Xsb^#FZ6^zYWUlI?q-m^X%Je2GPV6uZc&s$O%}+xG zbqEwgReTOk0=Vop*n;heIAVxw%@iWD{e>d}Mzg$xi01K_q^aI@Q!#RsgxGRgtCJlA zN5y*1Wfm{1k2&&`Iab{JSu_sL<6TBsq?_&B2J#FLc&Zo_P=S=8J3hI1Qxrfm*I+k4 zoLi#ndRm0Vys3QIc#4`pBlVgi0Y}6$=!lty-EpN_D|GxmSNs< zuuRB&t$E=Bk$YfgWjnuPEj2-*Le_BM)LV-MWCC`ren~M13gx<>XQxh3ki%)w&>o~k zG>xyUc+haZ6&l=Nu8$|~VK87~eaSZnvay^>v@cXhl~Syl>B1!v9SF&q`PnLVfPa*r zn6Hs{YmY6JkjYj&7R;f#54G%U#!I1U>y980%rWyK44o0Gn9#O5o~<+uA~Ho)zH$)s z54B{{+=)5XYA#tJT7AF@PMQ3lX)RvovzQh9V~xQ_Bo)I+&uv zL)69*L#|@FH*nd zpn9?|y7Qf=o6%VTL_4l#$do9PPi%VE5B$Ei&s5;&j`pWphc<|cC{7;>XY=SP(c6>8 zhC~WP?8con@edYVy`8ZJp0!k@>kjRdx6JnRw}V^rJb~3_;f6TnzwE$*0Km1u?9YjI z4hO$FvpGOVY`gn^*(=3qxDx?8?yDX8zHWdd>i<!-)hw4^wSfV z{fSh7Ms^`IafK_sKgn_RqzvK#jb*1Fxmjun&yyuR+11NYc}*NNzu8A)f2QA-8f|0L zix~E1C`zF(cs&Fvs}?Jo88i6Nnp~}LX2~^jF4;5;w?*vf6iwF3jW#I~Shbg^r4}H% zWM?Do|JXUvp&x*PYn4X4gCJF=)K6n1$kn;S0#0qvif!6j_<3a|( z-U+`on6zT~loS6Mkr9TG+!-{* zmI~SY-l&?`{E2+^SR|x}wF}ZkszS^A<7OJ#g*Iw4_ zhfEkxp3FUq#$a1Cg{aPtns&FFs4(INgsk`~S0-ek);3YN3bghHMfSApRL_UdTopOX zN%USsp4C(q|xjcPvx>rBiYtD;!PvZ3s-_f4a=9t^&~P~%noSZ<|uRWeoL-5 zk3207|G?8hvyX5Awa?-RmQTD6&BKajxR-FSWGlWtt1#-AR|#d?mDYP9jr>N~I>d10 zm=Kg=0p@gH@hmk2o~Kb7jIdlPi8nbK0JY{xOFMzzk}fUgPPymWuC%8;Vx#pq&DL51NJO+Xy1)X;d>u7>?L(tSFSq{O0S7DSGP^mc|$w|6iuIkZqXi}+l_*Kf|nF=o?r(z-! znq1x=f(NED8Mp!ax@+BBCI(cM2`B38{g18#m~$GX19&AKU=3G7OLqYCtB^wVU~bx% z4B#7YAv}{$ZulrV9LqR!tWpgVDuP=RAD)Pu{{6LYLkfF zj5mwCG8pkHKp3u~3H-Zc7{S2jy{6R(@b0tV-FjVy#1r0WJ3hYI4z8@TGa+8mEvf)Y zOiU8BrtW6xbidARqCpe?n-qH~CL~w?xqyOy!LUHQy+B!W{t&skgWX;5X zR4084=fzxB|J!wIOv*VjU6u~V*U*Uv>BAKmyL%0U=x3$Oz&5KCm&-ZkRo0hl#(01& z4`fKJ32D2Y5};XeJZa+`tJbTIg)n(ennJUsqX6B(2!hHywg+sR;pd}D+Zo9GL^B(Fs5l+w=H{|Vh)Z~ z2$#57TbE{gPyQ|0byuRjttEy}@gsj9NMgQF+HGs#imxHR2Df5@VwDNOZrGW-J?^Sa zfrCu?pp;3{xa84)eyVcO_rXO)-e~`HFI%cye(DU7lgKT;E^3WD->ZXxWAvd_vNPv znP0|eu+x>z&N9(0(BF({SSkWoKR#YiU+^mS+<#2sT3@>Dw8`M3**6fOb~Oh2o}}8Y z04L@wfdMV{f}Th47k$y$?jf}{_2v}cO_2G$@RI~@nj0bt{E|+Oe{$(G94r#gbtEsi zc?^tklw~ZvYB&(6OY{R)VB%dBXJh9g45BiO8JjXti6dk20Qsm{H8HRC%U1HDkQV+j zaClr5k$f1z@%9Cx&A{tUss@!qmR-TvzZMfa^U&m`&70Jf>nCQFg~W%B?msLSo5)&w zOnVtvdqBa~VfHfsZ6e+)u)Z1D3_t0_gJ$+ilG#oa-YkXisQlQgS+8FjU(RIbZeEFk z3ch@b%(Lt3Uxbb57MQ~fg!j5kOAP4`TMHT-H(RKA+Lqg`B8Ew2dD~(Y3)unK|07C2 z<6=Qp3YA)H(Dn<4?$zd8wTAeQR%UnR8bv=ZF@>2Bu-=!&Jy?ko+<6bpP~3X1`ahlo ztahm}&C)AF-!>JcHibX>ZdApW%;x+Mer=&Xo()(xAoHCX3Gwfkm_7TCEuOj=9h+xI zWzqUCQG+#gB=~usapZu)Bv3w-uUiS`W;REx$>yO6xqW9{dHBAOX*k_SuMa^cuq#)Q zbV2+cABrICl=qanlb3PS>||I&qH4Cia1J-Ku8+ARjJU`y9q*u9gAe5TB4id&d31@%V0h_IA5Pz z2O!c&?=9tFbNBoDbM;4VS1yr*&bbgHs|-l;&EXXKe4SMdkQ0CZYwjzA$t&6&N95;HC!J8F(wcY+)OJ-Y0}_7uRkC@!svvK$kr0q;dbb ziyAFaI^l$Oev6I(6uKUlJ`F_|?#W{B ziFm*7j!CQ}Uz7+eD+2XCfgEc5kF*NZ5+R<7t@sg_sMeJ`@AJIb4M6ya5S9*-Z6Hz= zlcdT?c^1vW0*Og2_m-B4L|vr|fJ=`=G1}8Efw0t6hE)9~uDzE=JLl2vMsRQ5FJ~S_ zv}~<8l*(ed%;TUfbGVe3drN@XS=GuxCUEkHs`MIUn|gDl-iS^d_Q>jcL$bv~(WWUs zqku^N&GRJjz!5v}Maht*Cyl=M^%s2)cM`+F{o1x-sKK_V$@qnizU30S^DK|7QF$|? zeTf>l=+oN^NTKqF#}vGxxr(8c7k&NBR98OLug)th9(ER=a_w*Y8y~85?P`ZW5VZ9%RT%!c@qdG+z?*{&db+d)N=B!c!oXyK6 z%0h&U0mm5HK2@6SQvB1E_0HtIyXQA>fY~j?vLG37j64|StRs0bv5W{Gi=DIH!`!3* zaK$8Jn`C~$tX}Uhcc<8y97K|`10x}cVCC$SS~qw}xU(k$sn9wQVx)O8y4>3AerJ{; z5}*in0DJGF``=%A@#3d&h#bR?U$PleGSv3RA}BZl&LeSd5B|j5p9B$*0+9-{^cF#= zm5+W{((!6k_ z9grUQb)Lu_P8K~7A8bkQ|)0VbBJ5141f;Xlpas`u z137J0%=b`;RKP#2ah^kK@tuBQHMKzq}IuLe{p zpok5-IeJh7ULZngH6}Zz(zORqA2xeUuxuJ6a3obXKz$( z7jU_(IOC>{djVT&*iA-UEAP5Q0XSR>4SsNvF$~ePnh?KzNc-A2z1J9hW~`>B%wQaS z*m~i+mKcNxR;9HNj_D77lznu&r^*m>dtD3{i)1$vqD5BmbSN9 zyDynFr>S%;9a_xUkAiiOdZdyk&F|s;S3O!Di}Y5<-|MDs0lwm6W4nF(;JbQx6?}sK3u~Q&ov2l+Q}fTO=Fd0d-oAIaa)Ja zM2im_bz)yE%=h$IC59@RF|Mp+fN&Z1Yw01ghb_uzGyYmERp9x|UhSV$ zR8S3-aDmf%AMD_uG2s?I{^c^n^b|yS(ak=l5}qWRpY> zTw-E|;sYAfhsKeKGAmy7uFJc&B`AK)XN3G(SBY9?Fa4UK>cL-t{2~ zcd5ngWn%fXAScvbMo09%kUL<;#d~PMC=imEa;$hbo1N@g0i6K`eu^Y}1H9g(u=N{i zROdF|;EP^eFEoL*_E%P2=jdlk9>n#UGS80Rjid-XmkkfHLJ!$nXbuo3;6LE|y{(+A z>*t$b4!s4#{M|OX6{qZplbnoq%BknJh_M{TOnFQ3pr*__b! zXuV$|`YBiDgr-L=$r{mh`%Zq;;eERhTgYhL+pKidgl(Rk-*Yh}Y8ma|FO-G;%T?WE zFq=3&lutW;SZM!rWycAWG5%4X#8C#j#VI-?E6tf-ZWgHr%eygbN`AXtmr@Lb)Je3M z5ADviU$FMvEQdMg9Eg~kdu-G1$ZvjH>x@rMxkpAMthMq&T~;`j8<+I|NHa{U?w4|P!~ybM z7Wh)*=UjlEz&Q38PS$kH;-f`37(xzGSmXFsu#kLijpcdSlgp94_c^i5L68-%ZL zsgw2n<+a?l7wd0Q`YDzvnI96ig!b=3Szi2OrlsabOMI6m_WnNiMpq^ek*5^u-;oP2 z0X~GF8qqK--nxn6XSb`#l*LZ1%+UU6tF&}MzewGC?m;NeT96Cv>6o}Rmy7G1myCVA z&fQ{KrBRj-Yx0QvP$N~!gzgc|jnAZDeni2o({f{-K@Urd!D6TiB0w}~)!Gi#v{;sv znTD>mxDiEDiSvjH1bKloDmMS*#&?GAc9`!>t9^Tr3e>Yli3-XNQ+cg5!Fm>TS)7{a zR}G(3*BzI#XD(;sOutNpNZ!J3#3vB0^hMfCe;s11__AIZnC~<96sjW-w`}q;tlI0u ztE{B_a&P6(xm`tNrOk&cV3dzH^Kz_%T&kRLqjvbJk-faeK^Apq#Hb=I5w$jvCCSVC zQ-7BKW-pfe{_E=#G*@+}<@$x<`Weuc^$q4#QUfPap$VUbbCz=4sBeD=_wCgH&X6%T zPL}vTK4zo&YRat$Vb+AgoI_lW2OCBiTaq|!FTm5$LFSjq@6k9a-iB0IBj6qgSvD=a z8JotDX*g)s?{QY}_<#O}&_mK#u=1TTUxb|I8Nt_C^ZOMlhBCPw(gdABn^8 zKT>UaFvb`nT$3W=6^s6h+grn|4r>$qqnW-=Je9n%k+vM-My;`7VCL2(}We(0oCpxlONR zO|hd95p9<&nGMKnPFq11w->WN>`2|C?2p<@`w(8;$eLY@Fp-@*bYB?oSWAR$DXN;g z&pZ;|o+Ynl6v#QF47$Yc{xOcjGRrU5T><;M1-2K7)ur;SmsjnzNl!;}!h|E55HDrY zlMwQi5ai>9*&oka_uS+Fv9t&e%cdywOBS+{$usDGnHbjLI|hZPNd!eaR9*5>T}7&k zx~noEQsFOe4g?)+mB?mvejOt#m7{7E*ie7ryObt88acwl{aVjiz+EWqJgbl3cQj|A z?#cAZ3{}oJ&JQeD2d?QgNmm{a#MzLxyB#v8d~7AZI0j+auq`{d9L__E`u}7BB1oen z$(mAOukQ+sX0iL9luQeh67dJ(=(`5Ai#4hw-@9`P=Sk%xh!*{KhP;Y|6eY5Lv3K=e zjM}W0zVIko9G(}ZLN1O}s0?;8?HknJsZ}j6LO3caKy!UJ)kEn8Jd<)yKdt!5rK zfN~f#4pRHt$k6ue&(6?>gASTZz!Zx!Qd-MK(V5vNQXS8`rsQc9oe>07R#`9QJUhbU z>Kw%`vL6qjWh|T`=HRvVDiz4xF4%5*rAH(Yn)Yytu!2r~LqDo1v=K7Ny85mE;G@i! zWmJqqMtda&%l(l#{7&3E6f_1ruWO*neB0Pl$f{rcs2Jwu<=Rp%JVP%oqBv$WGlLpC zqcG&^=$u90et3o7a$WT*U~^4f-24gtJ;o+;ri+EwaJE>pNVmL*Nwb0pQlM6dEY;$9 zwV<9adVo|2$K-0)=C^^M|FM-v1e}a+5hxN2HMPioz6 z#+Hiy$3o5{dA)fXPK~1QWMa2Z>OB}ObwUw$ov>DKzbB_h+ylv9&rVGt2`OgP$RAOV zWnMQa*!Ll_zy%ly%GS@-A;&DlH^u*>KXv51;93u(e}8dYd|Z zs;^Xwt`DJkPGem3Bgpw?ZR=S({MwJr2&|b|rcp^?r(0gqD{j}R@(3F- z81hvDwel7zc=TbxY8tinmS_o0$4gzIllr&>oY=0GYJ}^65u(^%#~(q}yJ{&lMeYfW zS&Rtgx9f|Qws|sXP4L2Gs;1VU+J@xQus3Ph0+Gw$Vo268&1c25kM=SG_N$iu0?zMk z(fR-MaLB$|ghvx9*u-o_fwR}cIB`0Ebss-l)9juO4^_7I724ZXRv$b@wH$3^CH;M~ z!pw_Z&K$kvPeqtks0}nJGnK2u5ea*0^&TGL9w+?I{H_nRiFo-5(o&C^Ruzx`7Q|Y)+jZ~^#=-%=!GQc(lsdDGu03%_>CJ>_ToTqVc z(@}o8MQtzeVYr!@fy%sE$eW?o%8y%WEU|D%-{L$$eORC^RH{@y+hM618|3M;T1w^X zZWfw^Ap0zj@GZZ1|1tSX{{(Dr)~o%@2Cv`!qw|~8~3y0%>fIIHgC;fJ5c|w-O*m@I8c)T?33jE zU|dTUkDAye7r}pH)8af+XxS*B-pTvl4jAW&{0T`{3LW0t;rL#W z6vzx%h3^Ov@It(2tIRM&TLEjY2G8P)%(n*{#wWd$X(Q7be#eSOn=hr9d*?eaXD>t^ zc1{@PM3CW<@djhcwkxUAqM?0V#G%ZAL~^@$$LX$@)(FNoEXv3J-eI#cm|-U<#Xt(o}bWB7W=E&2-jD^~aG<7hmFi zr!{N45fNbf`c9!53ya|pF~pgmt*M#N4tVbzvpHF|ZVo0ER*!QBRTqvpl~(%uLcvTy z7Cida8>-U0_hIAKmx74tx^EP$hZXyjn4EE6CBMd(C$A)FZ+9VeXC}A!8q2}pSo{`a zhtu?^`$ONZU$wtmO2$HtCt(8nRhl*+)Lr<)9`aI)7pF1e_{DDo=j@qE4cA$ukx(H0 z9Q)y_YhkP(pNZ4BJrqOV>5Xo!j6(XtmEpxTLzE4=b4wJZ$AB7XJQR~mOb&McTj&pZ zEs4U|QSD>(p_ok;VeT|S>osww7bVTe%qhOn?mci0)QaBuWP$-S_ad(D1Gr!jbSxb@nEG|5#j*J}8d85M0l2gG_lbnl^@NkcZ+;XcLeeZP=BhXHSzb+JI;lAk_kBVgv4&D($Qpa7@nfJZV#>><#$;L?@MpnT~R;? zqDlCXw}%pIfNpDR(Kb*1Ucv1Z{|TZC72`Iw-b93XmTqnvBZ3Qf6<~np-gh^~HwVm6 zpa*z)Rc0_l7?3yl7FRC6PgO6@D-h}K)b}j!PdY^U=8%S7={fX5a#cO@g)!P#*6Sz^ z`GYZ#d0qa$$gaZjs$nO82E4d_5m11lr^jan~bGrK!D+d#e4rAUXpFJ~USP5%Rsd!$z~6RI>+ zGqZ#(XiV9S$Jy)@V$K6OYxAdHjc+SMTfv-Si+dL$d;M9nHtZTvjeg~as~Dt7tr5mG*CFp` zsgON$_$`9ldw}$d*QxbYDrM>UMjH13ixr3Fg@+?-?3$_+|>rs}^n;289jR`w-w1i9O5glxaeE!$y@0RhNx?mdxc?XaF->-j13YXiE}G`haRL!N z2L;2435)DXGmC13s=p2LoPZx{QMJD6c3+o0P|p%VN5r7Hch9l|M)P!AM~gJ5d4{gp zsj;5aJ~RVe?sM7q%FrhcQM=87 zXM=@254+<<_iQh@05Ian%Y*;N-djdR*|q({q=1N&fJk?Pj)XKyHw@h(CEeX9B3%O` zIdq58jVPVc(%s!L#Q)@q=k~roJh#_+zrE}EGHcd?InTY1edO(q(y@ngBgAvUhwi8ye$;yTc&A|F@C&iV+-qeZ+K?f)}$n>_Z(wbj`OZIv@pJp^l_-JR(9PHw(7BWD{~7mR!z*2t`!~7 zq|)rNIf-@)H~1M@z1?bFFQ}QNU+YSXdJ2<_NY|Kad5B~H1WA@-HcoC4*yJN8CM=m>)nL_3FvoEJn2a+O^dCQZWSM+U0t75;CuP}G#c$p>g*nYuR*Eo|D z8~V-&~sN|AlhTmwG8(46%Rn_N$WzG@eTB+z~hz+Q=K$B$Mu zZW=%M)6gdjy@{72-d6}5l1gU8y@LWss&-Y4;%M|6YNDVGc!D75#m^O6e|N@@|CFi z)qImKwr@ul?ru@#ek8H}v*~2meYlm&(%T)EV=>0(oLZ?aw9{CuJ=DSqHl!kty~CXe|i@yCTK zrTM(v!Q|D}j_3ga-)OaXx8JjBM6(4N{n=?|D9jusdKweH6;A~K&Q)h=g_ZPyD!J0( zp+w2PoksF4g*=-ZH+I#yKZ7GvxgToe+w5dXDq3UQ_K~Pl8-7DERd!XzovB=twiwxZ zqKq?MGP9hY^l)v3JmJMI&D46L#7n)moI*rhyTF8wloFyr_%lEkIEg8`vchU*UfMcM z&*-nqydsPSi(5`#CVVd+8}%rQ<=;8|uy;x!(xK2u`e{;J|I{VMtPiVwy4G;8e#L`i zoI`RbOPaKx9?v-Z6%!D<;G6;#5poOO8$%`lj$I-O6Vvpm|CUtavUCraz_4hikjjSN z9-(BZKF5=t_KfFl7Q(oJ@b!%a=c0ve<&^NU7EYN3706U-@4Y|&NBvx~OQI*ZX>^%^ z5bRtYNNgcn6i*V9MoeXj)I_Qr6dY zl1ZbaB4oAl4skVi1t8LqA~qf2wkX5Ql)BMoTi1~y<+faOh|7-b_g%1Ck2~>NL6q}D z+@>NjJSMSMMrWHmopR4MvHcy6+6f+-XY7C-6#i%hMh_jcARYS{UIJ#~(5ku*By^5z zDza{_CMfvD3x-uno?vOAa_Bu7>M&}o$t|P)%4sv%PW3HKZ;h^Q>56w4*12owXh|St zF`F6Z2keE$_I(gLc=QI^oxxTRYq4C3| z;qgy+n?aE+cc6@(2T(Vyz~o&Vxc$DIpl6lJv#N-E+>hN?reY9i7yxZ;yo%Qg(ccnx zGMrF3=C9=7FxVOOh}-)3nA5kv!xX~h?T3rY7)dG^At9eCvr4`oh%2U7?5$xA)ho6Z zbjY8%S(S$!H%?CRfry@)_Bn9#wOw`cJyi;J+p1WEB{0us8mW34Ob>& z)Dz_2zGNLrzUnDBK|@J3UhbTn%Mu3CQWC+7r4x%Id!v7pIy}Zjgxx&-uF(2tx52=w zd5G1(?ctW~+lfo$qvVC8IKGOJ1pNvN3MK`h^{j}_Hg^W-&_$0_-`eOQ@q zu|fF=L?nA=fu_T7n7$*gVC;hv@!+TjUYA-b@)!lO+vIJ7_i3#*$zf5+)aO9a_ljh% zdRD`~_o)-W~s}YK<$HW85FnKcOG-_IWfI=sp4_Ai_5eiF|DdLmOCA1ZW=nl4HrDSqjop zF922dI2;P3#@!I|z{AF{Z-Iw=7``5j04($7q|W;1wfrYzQ$gB{H%Y4}U+gxXkn;NA zQNMb)e$pgbK_C3B#`L>O(A!uE5^6p564i$Q96gyH0rUx24(HjjY1}o20ww<2sazhJ zVkxXA9=Kr%FJyxuV>E^V=RjhX?>>Q@w=m}TUehfx6-hO}_#Q+G0`!H3yRyWKC%@>& zE70946r8&o)1yG0uM58(3%5TXSduA&sIJl6JNq0ik{>xR>hWU#d#PrFLt`u}GoJYw zw)WzDWV2!0WFO9gg0|{3w1sA5tuIPopfHD<)ZrG-<3<3AeK-$eA^!+hers;^81d zc9EFq_GBZhU{#?XC)jS1!BPHV)PpRzf3#eO0m7s=WD=rq5ks#`%wy&Dq_KxtP%9fM zM?7q_a`;-sYDCLjMg4tt6c>rAjFI4FzHYVU+9@-2{C4ozcMlG!tja{7tF?3g+4*)k z2U&O5C$!VOz&E9W@@6GxDyt3yJf6>1mb9vrX=EX8SY(rxt+MV8yliL-T;`h(bZ~Rc zhcDj_7CoD_9Ml*0gd7xUHzC}$gx67MlxT-W<__4uerh)MDDHA%G+pxG(IBVW?1R!) zZozMc(EgplEM>tXa9tD~QxzK4x=DAY2h0g$aBAH(M%(A0EKalBG;`-^pw?Ere4JYf zs}>l_N=*&)VN_{5CrwDqIXl19I4e`u9}9dx1ru~lA0}rpp$#y~yyvX6Jo>Hb?2TK- z8=3khiL{D{z21a!W`|O$hAv)9)y2(G7SZ=F3{Y6S^*(w{slXW@fWWJ%=pK1WG@moGYKgi* z$}o+V$9F~F{>frkvjTwY@V5M{b%YLo9=RE;BYwh@mpN8;5>-XSp%o0!(WQXlZ0*O( zYsy0GGQ z4VG7jg@P{**PhX-bi=!VK!irLt|H2{np&~j5Q?NLMAYJN8rH==><9O}$%qrtVs%!R zo8lY@Zb{#|%~*__TkOr0jQ+;pE@E{BE@B0t@ZP769;%59KmT(G+q0X+y`{2`$BXIM z<4ao!?)(-9Jmg0aXiUU*zZX4})%=)3TZuF{o~Qe=lLADn&cP7!tDvJ?Cu^{L@2 zSUamXf&G4aUlMu<5w`2z%+X~kPQuE!z|fHD5!qP2%7HDt$DOms`-7r%B*EJxDi5QB zf$Hav^{(Gesof)JWm6w?#nPQvU}`-2RvN_A&S!+TzZOq;X{2pNTn`Z+`BpO+_sep4bLOAeW20VW~5~1X~kfl~uFP!*6g%hfl zdK{O_uH0Rp0t5i?Wwr|sd4nEF5`U2AH^`@QFM7OO`!G9)-C1kZpSN5--ga~2UuxOr z*u|gp_U?W1;RJKcn-~H0M~q67iXWTLJ!?rd!%(hX&HJp2UR{i%wnh+O0&`zlIL4R7 zNija+*zX6y)U+qj($gPqz>4YU0{54hV4o=5lWsJb*9Vi9iAd=TI7%k#?3eC687U4d z(ki#J0ERAS`1wuy7QPx=IG($uRE}xAOHjMVtwCqpNVu{;L?}RGP zV(3$Lqid>s@9`Czs59qU?7$8w+xlYo-vGd|KSu5)&`mYY$xB0G9O^x*Bk~Syvh55f z8=TST6%tFp0X@EFFfJoJ093^-smdq-SKu(lqTVw+J^#|FeMJytKkJ1P!iRSDy2E-c zc{3Vux#Ja`GNpM)=Ue7!>%YWP9GH=~i~22u76%ojM7R0f^R-fH=?qF^g|%iz3FW7d zwJK@BlpHVKC`e)g$W$phftGsuGF<1`-5iZD=@|N!2sSExahn*KI+6VEhjfW6j+lvL z4E|2* zNeOYFWfPbHYSv?LMPpR_84K?tE0Qm)KE#q|m(qJPODdZ6r7>5Jix(y3h93#1MeyCU zyMj1Ac?;bJyTOg4;3dg4r~L88rVw<we;2NK^Rj8>vNz{m=!t3q|EzL6H>?eWSPymWL zyX>GDxcD*Q{l9XL|6@7Ix=TQ)`V&dQ;#kHL%VU95EKtcRBc20!t<39atg#kBDtIqg zm&qAuKtq$f5ilJyp8?F&Xeoa2kc$p<>Nyc3+PJMh^GqV&3{s;nzn?u(a$8JigT^Al z3+*COP>159gucs>_&;Zr4g<4Fh1l*B()%;g@52v{fbun52UF>AH+$sFa|^3k0{3pL)ncYotIcxqnLHGTIziR<5-kt~LX{I*}Jf(|SdG`aY{{#ssirM5o3JS{kG(8Kz z0dDk^NJl_+kM>cK$^wwomx>lhSd-8M48vC%#Nb1ZwSF=+cAM#%yK#mce5}9>TA)9w zt+H@jl>whYp*JsM(6jC*|Nl-gDQcXV>+Eu~0mIYe*H*Ka`HD0phc@CB) zJU{YDbp(uEDz9r&?ejJLGgl#7+XT=4qvRv+ezF1g)Y}W;lx(H+03R~w1i#J`k%>nA z=k5;6viT+MhcMsHa^KyqN1=m(p|Y@{64@X#nYMA}t|ATuM96A!qSj4Alaagi0^fnXOMW3`(Q8EV*UgyvcaSzTAOc zwn8e8bs{mDl}ERUn(K{2Pl$H-^X1e|*4qcX?)Sxi_r(bQQG}E}U6ZSri3r`IM0m?L z6iv~>c%{a5otCIJ(L6nBUB@13fe9z5k8j`)iM`#Lbw7qdSd^pVbqky0Bn;#sq`|>M z)l$;#l~yLc*k|Uqy@zKT#y>HBbK}4|zsdNW(^)3*Ga@k#=+?4gThGxZ-PXSimS|gl zdr>=v96yqxW#DHpkQ%S8Gj2Zq7*C6_)C8uw2Hz3HT8^0JF_nTF$NPRr76_#NFC6hN zei4zv#A!CRKGGr=ac6p_oO=O_CuWa}~FU1)_YUR+H5{SR2L{HBkTWwI)bv(>a zq=pmCo82v2uM=W+>27>Vlm=Iv>)bwnvBOun(m+EKzz_xE)ylw+tuUz{9cvOPk}Cl7 zi%!v&Uq3&7!$|u3WPbH0nR|v1WGp!ZUszNxVy2m8Ja~wBRKBj0mDQkKpYl*0i0LpK2iTa`;g)`hQmk zf1QIN!`*u274FuHqO@rH1!0utx3}x3hJ>P|O=nvQ1&DZ!k=8o*2C+c$w`C2n5CuK0 zLS|N<0}(QIi7yh|+=ld9s_d_|t7G7Zn8!6V>LW20pD_60`G%tAk^esZitqr^F}r&< z0(;m}M4-DN#8eXeZNi~z(up8ss~w(tV5C)y!4PDw*a*`+eowvKQRuUbAA(Hb^3DmK zheS!}BKl5h4-yLIfEzcvxw|69_`HUk&zec}{;QUqHGSp+$gn zTTa!k*+L)1di=-=Nmsp1Vdef3q*8{eEz&Xt`P@hEk)bH)#`VKlnf$l*|1S?S3%v$K zX%o>~TKe>>(21E~+RzO{l?cYVVLtO~Flt_b$mmCOcr%7376i2NuV4Mnx7X}Z78tf^ zAdS~&6hUHExOl|r-{?zGmGwi_uvEFbhi`9KfB{(XvQT#Ep7_3OkGSr9b_cj3zwyF1 zj%=%msVpP7OAfk<@TJ&8@~dG>;)yboSbf2|u5kB5WA+^JN-{qCmmfH;MGG4>GV#DS z@gzfD^wM2jpx3hs7iVuW)Ft-dvRylY4(_bBdtXr8J=^rHVbc@TCd-*CbRgwh0LOT6-1e!unBtO{spN;G0?dwko4DUm0r$ERaJFD5ABO)N{ zd5lzkLyJl4k&TkAgod%`I`8xD4S~QG){kohAV#z91`*_f%qu-}RC=i%-*yNJDSNKr zXR?9!U8NfNDzo?dcx0=#Cn{lV245sjcjh?gWaCEyXlAU3g)YThb}rTK6S1>;>-)64 znd!~FLUzdWlq2GMh84HD=NX%WPK)m0cs?fRXzIHI)3dJZpEtl` z#d9sCcbXh7R(50DSDFihL7rQ<7h7|(>?WM~I4oqA1Sf@v@jK^| zrq=u!WJUsLjg+o%-MSb?L9^W`ObxtjrIMmU7kCK!T>6YJEG}Kvg}LLdHJ#-( z=nelrK0o@j(qik#+Hy4I$y?brrOBmz)v(md(oU%)F>!HO)hu~xY8t@Zx+I@;+|Ls$ zcmRoJ#>~E+^T08o?6>ZUF)2GQG>PHalLtA?7sd!ma#y$MH`qzH%O|t?ZhtX*&S_H} z$HX>pw!T^!<}Vu5(-oV$937O{{T-VJtJMU>nHXA1+mmX9F-cS+m#!Pb#k`XX-|fCG zyBv2b_9IlYi7z?v#(b6BwD6hrd@!}~i~R)BP`$KthqTqzbyk>mQ^$^Uep+`>!6S&c z@J;5yj)_Tn`2f2aD$2kSa{outY<2;J>C;(^r;h`_AfY19*n&I=S$1t~nIYfP!7eeGT zD-G0jG54L=^EAHW4PBP#EVq1_llkTwJd~}V>|Rh}+XD08?eUF(8jhC%?L2V7Owr5$HVYloIJwM|-R|?5GNQG6@ z%VG7yCI*#r)3?`jD%{sh(!u%25<2SjT6H6A^zIII65Y&8xjDCKaWh{`aotM{pTQ<0 zQhwhwQa(lUAe14HG&ktifx`%2=Lf1xP}B0hqLpD=v!+2dc|9_$-0d&gLCXgMQ)g1s zF*D1^Vp$A7S<~M9fq3UiCW<^<0MjE=a=jT@-gd-NwjnmS$4BURL;dOrynFg z`E8qxh;N6Y@FafMg>|_&Ah6=KOp=(`&)c*cYgvWU&-Aum6(R$sF|OQc6*5%!jg2A3 z!4YF)n&Z#|^^Tt;+}=~)#AS_#(1w9(bUe_?yR#vUPtZ)5`>r_e=UYFg?ek9pg9l$8 z6o-EM{pjP)N%?`A{C!7No0s5e{tB#OqJkB&dD~`M-myZ*fG=WxQtWtM>J}Ul2FY7z z1kBG!0K+KkQ#p!X1mWLhSv@tFekMkX+dIqt|pHqQ4)_1F`Q{VZ`BW z2-60W*0(9){;zx9%eDj}#O4Dc!~}HF%EYn$VBsSQ-%Igs2zxZMRGDNc)TATAVEICS zKzd42CsBWW+8xtm`W!pUVI>4)f5p!Z&ztWS^u(4LWhOw56bt_S`1sE4K4+Y7cwc=) z)$S()Qo2M>RIWF1LCCJ(`dQ%~dQ97m0m%n0Prs+8|&+ZRTi zuKW9u{2ibP()B~=e!y_5`|>l2QbD=Z;H7;qKOsYD?;l?SXR*tgLtu7S&|qLnZ# zPTauD^vjcffV12kd6WB~aX@XHUk?Vh?wHFw1Mi3#QA0i;xJ?iE= zc=)j@o1^)3&Rb(+WeS@K^lGLuap4Y2?Y73>b8PRldDX2b_ACeT+&a;*wG4vE4<1~G zkAFB3zxiQDb|1wAVWrj)W2jitcB0;_nefF#i5`pjTvg?AH^I^uj1l|tH6JRNZ<7dS zmg)rK9649-mc4ov3xH5>s_^_1s)^M6@h&5>dSI3;TE%=KpKm6wA{??QJ1n6}L zGTsw51Om0jgQV3HGsQL(Tdz{ht0_GW4`w zIqS_=|I9UI$KgbTTprE97jH>m>BVIxp94!xYL-c(+$yvbCA?lg;s3itjA-%!e- z1kn2p!Th8~xi4=_cT_7a=n@1r^q`SfY{KP}FkqoEIpqIrpOWYees+0 zelb)3AZ7N)i8|e}!w7U=zwB+*BWBg7X>3^>3wi}k7zsxk6@Kw4v)?*J67*k2{39k4 z`Re<}W1q`J5Ob++ju!9S#<{(C^S#|ROR?GiO?(0a>rQ= zib+(%IeidQ`Mp?R*i7zGnJzX3$SI3euS!PW<4e83Sc$VpkAkfsic*e7)Y3l-X7>&L zU|y3d$CZ$14x)a-lRXiuwSGFOqxc>1Yj}Br3UK=h*q@R6wTUKyNJ28{XW2B$zt2s? zs_KVmn(!kJ>vrP*z-!;R{1Ld zMC>q7ZfZI5fK8r8rPG*fl&NXsn0Uk=y6D%{YYoGVe|)`Z8I2$Br&mIRbdis}e;Qdx z`vb&ii>`404>9wPBC^x&nWA6xG1>d-YPEqKc-8kE^*_@P^Wv089b}Jf=X1pVO{0KR zD34(90CqpHz3|wV(CsNt%Dx0fwbd>&&jwl`#@2-Hj@cF--&0C#Jo$w8bmIxFbU=6S z6-b5X&m9^v+Z78Z@!1WL%bTAb9kcJq`!dSyaj}#9y9%JZLIK%N`yYJRuWzh*^EXr6 ztppv(U(RcHxRjd_nNe+i>G_O-6M#UCRmD|UPRU^A9arQp3Bl?`R(tj4(Nn$5j+68w z%gZ)~0rUJQk@P{c40GN{-E+6VS5JSt^(`) zE1QT$Y4W<#oTasGvs`pn=#KDSG=XQNTCzFd&rJx#o(9tA$P0^`udrlF(gKjo*Y`vZKHo z=eI5n>ci)(W&Ge@uY}SRrD0$UJBm+pXabo>VI?Rv*h8)qx{BU12JqBvsD~8l{8=M5b;JFs<2gOzKy2AH-O5z;TD(Ne8hv>VFiGb5L#b0A`=))D9-dW6XQ>1I(W;3|;9!*?O6k_7p% zg@=-&7qM9VN^fK9ed57h)s)OE^O-6KM@a(1_1?%3g$&%Uy42ci#pmkbvTGXNywKBT z>~&Aj&#u?G@D_#Ce9@zXL>J5wm+~^~$GrnwHCb1?SZC0qjm&$u<=tc^AzdkI-8t@e zEVbp?;NNUHG~0AM5l}cF;rW9cpgcf(7~Jofc>5z_6(`}G&NCX$CW;*$&M4hyycMzX zKu)AkBX;;|8tTCF^OhwKnQ;{3W`F5nf`IdfE5OBQcjUP)*DkBq8Se)dTbRI3t37fn z0Hx`1^o&;EvFlXd77*yxycROot*-m2o5ARfoslK{=+kNXqhBTB4r-akc;8(kstS4HDix0$ zw6yFiyfdcG6x;{XDAAQa_5`+luL=8C3xT76lzu!771U7&fW)yxvz}9fm5~j{jYL}) zo3%9Tv=K#hlSJL-4U&t6ATkGbs+T&mI@Z}TP=FrKz|A(+Y;VB>a>UF$<;{o?Q|!Iw zt11JZ=~@kHYU(V}!VeiXkGcO^V$BWet8~$=>H9#^F|MFCW|lQO#G90qXl4 z5_;{h@;GfpFGa_18~X_UBdwsxffKUy5EvQ;&C8R*8c2<9J+nt^Cn;)Pdx88b4LWuG zmArO)qG^J94a$`JlleJLiFp>J7gOw~)GN;JG}WUfbmcDsUD#J_6-0{kFoJw`9b`RLaq(2q=G36rICg zY5PY3AsEoR_v|b6hFpp-1WeKa4$(h*p%MD;t9zXy!WhX<%P?iUG-d!m zyg?&HK0)Ju(6W9YkN8*ZTZE6kvexuYGNNZ}r&%T;ruuGG(g_GMTe~ldO>dDHQ_2#s(JeRiw;8YTao(V^yWnl6_42J@6s%PdOx}0D%vV2bs><$vCGE>tzV~$VKk#LAGk-f`*VheH$$JhZWWSJN zpAh|IttrW-H#1s*79K>2bk@xstueke0xsCG8WV)rsi|2^L(6!L9 zTp#7bW;71MT45%<6Fq5 z!jUWP%cx}ilJ}Rl|KYSeMg{KoFr13?eG45)bK#1-^P24T{>^2ox&Qvs5k}*8_{~?S zkEh%dwvNJ^7d`)I(V- ze=l|od?Mdh5gioJSq>Lyd-x{Wwu}lABZ=PD4~e`-kj2iI8;|7jPyDtmErOdW2(Q!q zxKL4l75qCsi;|%n=^z8s53#$G0>|o~MDZ)Zzo}7=h?vq6nV zjGKN<6I13??Z_=t3A2Co?ndcrVnD!u2BT7RIGalkJpfz-6Dn}$Qhe?Ew<_udW}M9d zZw~|$xO%wP9k>0t!hK;ske2E$9oy2-DD8#Ot>Mo70u5%Pf9Lx&z6zb{YsC+Zyb?V^ z7hRIEavV#+xpkIWjD1L~!yYpc!C~)Z@rbkI_al@RVwo|rt7@^+vVW!&@K^{?BQzr+EALP!$9Bvj&$!{)lH0)=_sMQ8b{xdr6Qqp;W*fKzMV zlxcaP{!eM8I>z}_`b_N>50i33-g0lk@CpQu^_Z65^@d)rUWke`11vbX_zT)v8M zG%#SfD-Tyx_mtQ7rh)W@n-nvIV~r>fP}#>pR~aT|znZ2y^E||MM^_E}9ox6<%e@OO z)ZqsooaX2s{ad6##d=3v6r~UQeQREu<`2_Ui5c-R(i#+OklB&{;1GXKjPv326fV!y z-c-RkCTl0UTx&3 zVJx*v1>?1O#Ry-WNn1CA=t86b5K$=M3;wSf_D-l1{@_CtCDXB#SAxF^JWc`9!v6G{ z>=cg3Mkx5+ZtN^Vw;OEZn)Hwg~}WJ4tGVgw)``TEg*wrC+p^3<)VG@hx<8_qqH zew{g)-P+bBt9xay4C^3doOk@OVtR$RIm&8+QteqmJq}Z*+O*C(= zC0Y2_ow?!Pai%Q`IUmriS_WA8sg#%&ST2L#p~ah+UablV{_i$qNhbRVV1d7WhLYsR zL8dME`HR~@29WxjBKE)#^k}3;!zRZwDAOvy#}GrHyH0;#4Zi;$xB|M7zujZk&pfte z*SE2Nf+Ds>Um}6Y{_p!`#<%fTneLr_2Oo%fb+j(y4}3|Bm#1 zFag^^fe7*8aknEEK`^HuRKox| zu-ZF%n#z5GY<~FlT8OlZ{ZC4vD0~HmyBRd;n7mJZVN-FZWvo}2WmkUiNcQxnG$-t; zq`%@NKKC#vH8}?OwzZ>87Jh1-B?^}m)Mo`~R!da0iS5n@?}2jkYz*fD3n|1SAjqHL z0d568ya*WOx`yu&U+gvCRxAOd=h=82miI5*TpsB8hZ1pgPn4UHohg*)*3y|NObR*a zK%W1L8_-SesIw1<`>YU(QsPW*7|;3X4weMNT))8isf^SM4h)PnvA&l4R=QfpHERFh zw!T)cyf&=Ai?fXb?%aTj=X2Y^!|}<7MmT5*R))Hy_NX6_b?ow9?>Wx)q5HG9H-q z7OM1ZYH&9hZs&5iI>*S@Y5ubG39l`*>(aT97N}pLm%9>?2qRrOx0)C?kjV}q@M4Dj zRWY+Kd3Q>{B*}3Why8h~eEWeE(0*l;P3Rua>nK72ch~UEp$zxuOj;SA2#<5(S5i+V zblD2C?q`s4z4E!XYLyDOZ?4Z~K#pVEs@Ia0Mk$__(m@Y*R&L-=EWPQ=*@T4jbL8Qg z^gd5{M?3lwx#EaCPNIPBNRP(qFmHiIY}fBtJZ^&VWJS2=yY+i3I7NHz6`S;RDYN{dj|>50zVxt#T%^lQbUmEs1~}U!+j$M8W)^^nb|-u_`7<};x>3%1 z#ekb%X`DB?WAGVvTCgs2_*%BcN+1pHwhmWTGnZIHUxrnH+6NKQHR(;jzc!ybwVx>4 z;qUOl7M_-)kMLF0;S-%3X?2gY;L_bpKD%Je2gbynmIJqXN$2+KHR#(8Qde8V!c*zH zM@4(y^^r%vCU*`6woXynVMoGsCjhw2KT*FVIK_)Vu zh4BM_!krcPGTC%0-6`qc=xM{G^}X?8hwo0F z6i(04t^^Xhq7oYvJ)0W%+0j$F(1YyJ_{%RalfrnO&dw`P3LdEvUlb)oo0zqh(sE%>Gj z9P}uZwz+POy!?Pgyo?_8py~^SA`#BIBNu(;!3St6rKk}?wh)Cy`GoGO#&gTt#Sdz%S zZ!_|aMl#|tD*?;2p+zo8`IO?R=3f@Yd1CFWzi{@PUrR=3UsbV38p| z9NLxeeW#nqMgIsvrk&)m?NfZIJpnZdAxl%^3I7|ltacmiDzA~;dFe(QAcxtTw=fwR z*TQ|e)Wz^)ZPOMZyV{;pan0voQGEE~hloLJ=@}6sq)Fxr#h;?y^q2i=s&-b|BQ8RO zFyqVZLE+t37npL_s?1l|^bwB65u82jyr#$K=C_(U9S7}SrLK{Ua27`LhfVf>RFigW zXfcmY$(gQky3JdHGuvkl_nOU?V-pbT8d#>K7#UrCRGN{EI;x+uvUtY=VV=awM(jG+b?}UQSuQOHawbtC%>GImK2g$$Yo=(z3q>-iy!xxUNFgCXr$l^ zPyD`uB8$Uc>G{<^+-6h0LDbgxA`iG#JO&C7Rccj9nPq+Ylw9V%q|Ky6Y2x0mRcX=dMt2BOU zw%irA^xTME&KbBxdQ7xQzv&f=^hfUodYu$&np?*^3$Q%YutVgRH zQ7q8Xw-hXqW5qfavF8B#&=x`%-4+V%TxJ^9rT3evFsF-SR<+~RFWrOrMsy`|S(>c% z>p84W^9Bb8N8gnLU!H8r94xl!Dr{|zid}f^3Mj8RpL7!hhlh_Mk*sTfSN%97o{v#M+p@WiK0 z1NKcY_QJZ+U-~kxpyIlQTg0=8oP@6SC(y;QXgHAO%&JpxZCWSrT^n@_s5V=EzZ})3 zoM!Px``9g(XM6d&=4OpX@+Rg9mx}%yWi75;#T4N7v@SQF)O+@7_3WCTl`=BRJ8R!N z4&^wrbj7hiS#_#(xveiHwuoi`a#mQ3f_IzX3d6EIr^6!(fp3hmZ5sK&_3H9>Aa8_9 z0@w8pGEm~7!EG~5D}39a!cR1c#;S4ZQd{o9mH&D@6LnF0#Qo-rS)|ou&4jX9>U3@P ztG4^#>i$NDt>WsMYXuT`EYE6JX2NLgnSNK&8GUIpW>}9%K5~^;{mT$Sro|Vhz>Ovj zx5$0Emp?Y?vc3h{_CKAfs7Mm_b}fCn{Y$tj5_KmFqMz?6fo5^)masMwa_eqy+T(>g z0Ox^sHOA`A^OU5?8vF9?*+!i*AR`l=#OYg;AUlM60$R?IPg+T0(^(nGSDCbB;c`)~ z9}@%$Q^;yJa!49)?mdq<%0n(t&u68Ohf!Y~tvQlX5D_s%x~>BV;m!Ah=Uitm%)h}W zy*?#A9}ynzNO(vtz!*x%5uNFKTTG?`+z4$Q@nhyiV4?vW@TH7*>aZe=LS{V*r&Y>7 z03eG^SA3rrorv=^w(u2W61Q!vLQ4FEqYyNi z*TG_?F&G5?yB0vV)wz7M1qG`lffx`OSfkx@7L*MSIX!y-8AlW@`!DVVCh2urTyU(0`^LZ5rUhu#Dp_FiA z-~E%5<@#cJd;8CF7C#+-JGWgLKM+b2!Uk5_wCDV1m$*^p%h_kAfhKJsYKKnaW@Pna zwbk*2sx=OyPdWxhkY$cmv3YMA;E{qupOw4IW-q^oB#LRI%#2x2cAZW6N~tv-mBm<; zl_|_fu=jZRmYb&#K7D)o`tsnIiT$O2fgKkve9E?2R@DhYIImf(ttR<_)@WsxTzguJ zn87opw1w5r;r8ZwXzKzxJ;YB@8Xy8(~-_zREGV`Nqn;s490$5)n6%d7-uDBRd`~kFtqIm86$YEVb5v30!iG3;ShCLMU z^ctwPg$6$`xU=e7!xZ4^#xJ+IKC3oblw6N>)4^O&+fbp-i&Or+kWF6+aq%v|I+?sCLIU>V-KIV>|33)6*tHg|6>)#?Z;m#Ls+w>3#8f$W8LJ z?N~RoKuq4_c;~jDgAabtm*)*tPzFI*xyK%}eh0ZKitIqQ%qjE{7?+Hu>Thk@%A zkfGj9x4SyE7pt$>g{R6)3a>m@!%oXv3xkI~8+vPfaflnZw)C~WHm|NYo?*LWd1vuU zzJ6cl4x`v+TqOpufY%Kz=h@N&0;9K0x3h<9nkS_C)jmcYCcKfd>%v~OioQ^&ZVK{9 zJi8wKOsb>aMElz;^-`6W5vf(Em_$8C99g{y`ClN;mKurocx~ox-f`LvwkszK(Ptr% zqyU+*0kzM$j&>xzBy}-e>Q%*52nB2A1Ze^R$8R0mv#!-W~^)AiL$;Y)308 z9lY%nYpGA8O~HWS{aq)KzTSvfYINw#1C7qCe=%>#7)=y>s@k;E_@V_+(9_z1Io0bv z6_{EjD+?Ri87>QNEvxrdIWQ(q+VCg&jy!4?jvrDgGP+OK790gfJS23=t1RoFGrCG6 z!XW8|aW%{;&2+fv-^g=2s+3w{-4qnsa&8)OOyRep?dHdnlP}Q2voot$%4-HmIS4 zcZ>(-jdB{Xp0D*Hv^rVnS*HBv@rl{?&*DOl>ld?qjx4Jrj$29Qr1Vn1(Rb4~#$zCb zD{nTu6=qUlQ(QTndM&>m6e|sJtHvJAYT^bYcg1mCtGKYdaZkTgzP7^lyQr@!p;#V_ z6>~ops50{>MeMs2O#8d1!{`AtKfZ>^`Mx-=_SQmlJ1`Q*usjSbsj@8Yvtp%DIxA@h z2oA1C;TG4Y8Ygd5xMCcu54Og}51*QCYI3?jIdumYku=TBlM}Ql1%pNUMTC!P;z{8^ z9^8V1C<}(=?96A^Iy))MPA{j`O}v~8opU<1N;0yGC&*ZFRISJ@e72Cr(1j_pz5v1J zLGQykv{zkQ^OK7WOEnCoRFMI2!G}`&uk)t6chO@u=qmGUXkhXs)M|KQEyQK1axJKO z)X}FI^fl3+V4#a*&Hn34{HKNuOUsoCeJrH%g$9C|8kv{u`WD3LUu}Kf1JXxjSg}r2 ze-o1CuJELL`WP{h8!q&kQ2hRWyUH?22~WM=ACY$}-I9zyK9Wa$N)Rn?TRYezt*Sf7 zc3tYv^)IvAdGC#FSVa|1r5hC)`>^pzePz209>Ej5SQyhhUgl7kAnB#DAY9dr@_YT= z@KL5pq8DhW$W#+9niFHqqn@_yg0`LJJBDi)Re|EoHf+u`!k_qR+k{|Vd&Ile}~cd!N{@27^_b>&3fz207x*_gY3hZM}S4)$mcqHBxht%WG|2 z9Hm*ZrA7vTZ8so0DsGb?N(Xb zQyUr8mPWv&ewq5vy6C4F88@W}n?wVEOQA9LeT2DD>n5mZf>6z~mSVt4Fuuy;a~r-! zp0fhLha2W~5PPy*D4p(q`~-lYKr8z^MkQJ~xNaCeXe}(NjwE;}->X>Qg_^0&q~@b| z5jEQsdvUiF1n*d>RoAYTtHIvN;rP+gIjYw;8gGhs#SGh7cU((8^s0L>!DXG8eJNmW z7`OxgI*Ws_?vsvr;2$UoVa~PMn&gqPkk<6I;!WCLd;zJUURE7!wx9~&&($z-^q5*|PhW4I z)}poX&XKA2=9~9t=iab)Luwn(b|x}@_)s)*d%(SI_UTK|Rzfx3>+nUr#ky`Q>y3mY zApl>n38LN@X9H658XDL2Z?f}abIe@TA01pM%hPX5d!}g;-&ev*zrL8mT-pZ=hoE@1 z*lsj8Xp6MQ25e-_itN?(8de-_M=8xJfaw7_=MuBpiNy9R=I$xrWWwt9oR>)LHmfY= zinL8yxnU(88iOXkdVocO4S`F!=C@1lt7%9wh0sYpOyFO*$>o^eari2$%%?8OJaT6M z7o550G@%h)EZy;kJm=!3uE{*>WeV^-=BipdQN^pC@#XI|9A78!V`{%)nAs0HW%P5O z6Bf!(j~O=yep|o6($=cZj?3DdNg7gbqwr(S3nP!gNtgbN@u;q(koQ~}7d=kqE9$B@ z&{y)fgzWSfdwP0CcM6TF4Jfz|H9nHF-;Gd@KwHeQ9z#SXg{K(L*W0-Ew4?f^b8Sl_ z8_Yg_`+U~>x40O3C$jjou2KmpUIxU#T5B^Y!n+<^>0ZTBjuMAeW%fupu`-{2MrB@N zwO)Ehq_h21+Iy-}BMM^=;KRQYMrwQ-bTf3jS8(?p=HM<s1Y_XN@RHG+zSr zn*!V|88Ljf`Ce6}%MX|uz-_8?hT(D{@l^y05FisYS4e*pc(v_oV^hZCFV78*l;F^G zq8#u%esfDpdxxrY6mS903!Z)fTgQg7msUrIp9rZI{F|C_6ithny|!NUmS`Ko+Ad+9 zcl#cK%R6E?+GqHI6vSiN6ywjSTQuXCkY~UCZO5S5157Qx1@@Smz|#6`39S{E1Xb8f z3@$tBdp@xF>b+Y=n(65>1o{QX6!+OID%EC|uhMM5A7 zXkqbot1dlhS;M5O*R&V$p93X=J?C-@yhAYpm6?^n`b3D2&|Q1gTv51+w?#dxWQ<4 zQ?OQ!nu=V=t>00f47v;toB)L1_UQMIAjN4pOu3KuNF5hu*+>qkOMB_jwthD0SQi9KljT*MFi*e+VO$i;yw%j+GynDBUYHP)kOH>*c83 zu??TB@>sx+OKdQ3U6^URaZE$(ELS2mL1u20GV_b&IR!IX8w*GcG} zYoo@8A0_S1Oj{e!>mm6NI?>7MU~Fq^KlXj)Dn1~5_>a0Zd*@sEq0H=*>sg5dh&VuE zdg$)IL7w4~gvguIb6K$_Nzqbx7|hw4i`F7)3Lsffi0#cRXD%A3@~h-JZlP34ve7Qb zBfKP{@@%q>r|hdLxUYo`0C9L|lif$xouaQf?ryd@?f@)Qa&C3G%c4;0pUM`oEp_wz ztf~pGMOV5O24;eGl52wrJ7f8EwX#$Nd2;z4)^Gm4JUT}z7ORV3DkC-+drQ%%XEYQ*V&!CW2s73VIkP}!!lOpGoc!tC|WlUg&%kY(v&pMEUJI? za3_0nX<+O}yXZ#fZJZYX!SIAw_i1xIW|quj8S^02ti@VWI-G@ce6{3NO1)|2oTnIK zQ1kbqy)+dy`~Cashhm;ukR#j5SL0>+?W5)uT&MNVtKC?A91uY1wAq3X8KXx4Y|)#q zOUiCs14SyiFH*5dO5Tch*@sVj+Kr5~Nvm;9gnqDabDfM)=wGD%*$^htlbb$py=KmbL6S z^}pM)Tmb(t@d^`kI;NjKR4tO`9x5IXVanRKGzDOSCp}Y>LNR5^Fi4%Je$JCHtIQWYX`vgNAjcU1(?_?lCf8WlJG-T> z;IV<>F`C&b*#;$x>DEy{49$`q(tf;r^!`0C)5=pcZ-SIw^sYE$S0CV(mLqXBkxwLr zb3l#uHS==IPpCkPg-e^86BCli?cZ%@w9$#s$0AE6Crq5c5Qll1Bvl%y1r9SoXEr;3 zF=hPAw3WwNDg~VnVeWbcrO6*=!Ik>k-COUzka+LF^O~O@ zilJc=8?Q)PR=V=b+&P+H7Tic5Y~i@K(;ZV4W^J6z+nm`V@iw*~DcWYS`eK31!zD%}jvpZMx}uCgLb2 z$NmNXD^KGq%Ei$sTiDmJ`>-kQF-9>L|FHL=g*SCOj4wDU&C)(~9+gA<3G-6dniO}E z#jFL64K1@l?eb=cVRy6eI1*Srv|XE5>-Um3m$7+DEyzCn;1PnIio$p%;0ilB9!W-^ zw-=2Al3yRecmCHTY~nM0Dok})NeT0Jg+fr(1mmR7nSHi0H$NyJss>AchbGX zuub4S|C4*yF;_Wp_rpydbuE@qFY!k_X)PPYt&RAB-UjuCiSK!CP}LIv5mK?u5*B-K zXCR;%*J^+`R?4NsnnJGpC^WdGSDLcxO)aeZyDSQ1OC)h{*w0# zQ;&{HOQI3liV(z`~D#c4Ja4T2S*j{!T@1R?=u>)5DECu35jot#Xp_3W03^N zSVlMIx|OgdU|^`hGB9ZR>hiJ=tQk<_?62Q&l$v^TlPz3T5z02(_hA*N?_8C;KGA3} z_(**SDd!2|f4LmHT?!?i<;`NfK>C|80;|B;JFueWugSMC^S-k z@I=4X4xG2BjgO3CsVgS*zCG3?^7)`^7;CXqJ8gt;cabs8)u@gH?weCK@i7lq5|RT- z<$9AKgWGj>2hE|o{Y*^(n0#3hmBo0(dyoBXhvl$}3-Qo<>JJUyAa<&bY4}C^E8zfG zmzKm_c4*^VX3-v}y;z*r7DDYf7xRYja@-*#R&1G(N@C_|i%=Z^xZUfoPAx3ewR2R;TyS5)Jz?0+9cC) zX3ekc+IM92ra7DzZcPt|T>1{wk74_3O<`!@ZMCQIz%q7iK|)=>>iXWi3qtKsnmF#u zcLo+3*7h=cWgJdzElbO9P}mx6O_Vu=2!)I);;48rpozaPQeDoTXii`uDW;TP zWkKcBwjXe}Jd5_r7&a4S!#GvKD+^;q#tn#rry6uLTG?Jd(8U>QsnCo17zTdl;n%Tz zE;Z947#!YLe;E2+$<`}}$4}V!T}nw<@6oazuS(T0U8yie`ZDy+I!Q zr#t2vE;J%Sy~O?qQtdwVMu?2=MpXMXwmd%X?nH4@6EE}6(*oK;DhJGT)4p&gdNtZ# zGz>ZWI`{Sz7qjQV-vKb|@(Y~I5l6*lCq5#VJc#vtZzk%Hn9iA?D(4Z3!L4`w`{DMSkxOzn%L=}{sy}Hs3 z@2Ec~Ez@H^)~VDhXN-XPr2yLwSTwJ@L$;x%BiWKC4o21=aP!FJ-G4v82~&sw6dp)| zX-sZ%E)D`<2&0gYy{DH6w49UxP(NZ9vuKSQU_-TGUqA9YGPd_s-PawrSj3FpK~Wrc z!(@Nni_4T9E*=*(JFO%!oBZ77cs9YuGMC4NFCvbslgo`=<|4Za?D>p72h0Es#yC=9 z1v9)v8RK)f^JGD=s@q{wPMZ7|_U9umixwX7aJO+`CM1xY_-btp z36YYcTMjVg=;l}9O@U#NALx};P&OSE=7S^J#JQDl699r}U$-RHvI)H7j|>Oy0dCFJ z%${i?&CXJkUS$tT8^DE25sdn&~rMPWkXZ)@xk88?E#ecH;)fN z(y5?|e&M+*uzG=ssRmV>+Guw5<0RKKX6>ql9MEi#2D+nl!0V#=Ns_||?kIa(Ag37q zJ+-1Uz9HImSv<=IEo5t;upEbNMfx0Z0R+@jOtq6ww}|g*-Nt4veT@ZL=9gZCw z+~u`2lp|2PT`H94nFxzK{2lZT{cu&+XxALbc0<52(>Pz8s!QiOqNTvZRYsPc{AzhH zhmPGvgaL?Dn`fzRJM!hv@+8_x5&7bnXUV)%lI-42&(wJqHy5#a1!JFk9O~1bkic5T zD*0_$OP7fAj>O&97B%uL6h><8ldn*rb@EaS=3texv9l>|9brl4Md;f~a|!nR;~L z`geuB;mpzg{VYZK=N*wbCS*zL>so+#GR%8xgoaA^S>*IBLE>z_mw8vBn^DaJ?d@~G z_!Y&0TH_*hxY2IUCOZJ0%x?{OGXOm(FnVE29c^+zBBT)_n(0z!F;YU#O(iwpk>ff) zieewBbxW2QE%Ki~P{08J%9flH1@$jaiVK0qGSo-EuBrg!&m?|ed47S;7v-9w!Fyie z*-QS(K2oYCD}6}y?EB^!Badr5)${;}3s7n{IV6lU#qIu_=nY$;%NaMW^OQFP0GgYv z$w+5d$JG?0vTddLk#<2|t;FF2tYGAPAIrcVvUl=U$h=X0t9pa8#YN$ zYCk?NApHasu~~H?1qkg2(R-x(?0~vyit^3hj2zvuV(-%mlM~=Z3d}BlK~L`8@D|k? zYuQc&QjjUo{%_$f4N6x1~?GCrCRb90eUFV8}9wCyTNkv{)K5p@}x^I zhE~+MoKiM=2b&KDwu7WMo-Me~!5qM`$PEFaGP?=S`R&IGpoPw&cF{+fwUi$^Ll=jz zAdh-o(y+#)X0u1yp-!*U^{f4Wyx0{#gVnbeSurptHo(Eu#hL6b{sdF)5ZnthA0|E{ zn2b)50di8wa!D$nE5tGbD9XCh1V_o87ylqj0-D=}vhsD4y)Gs38`^ynt+m)+pU$0( z^IT9Uhq@w40!BZ-Z7Uf_VlfzCTFfu5Un$v7&t`G%nl!IScBpo+kE-*evcwJY47j68 z%54+7L`1TxdKbK(^H&QHE!!emrNyPN1{98(%jObCl%{`jL4g{iDM?)|?tsO8iVdkG z76@t(J8e{8xO?dOVj|UcVoRE8YxWj9nW2oOa`KBB!?|oPd2ge-zcOgtby6)r8h)p{ zbL!X}ngy?_8Xj!`W&wUU$-#raXDqvxgc9P zwhNQb93U4)v(ifOtB^FO#95377qz?#CP~>G9Ga+ci7$hc!CMwO@Lmf8>JvJzx~R%N zsH#*Fi%n!>Usj1uh3!z|CWvm@A+LKM^_!4e>5Ub%FmKFoWZ}nWfSrba`!82Ju4NwF zJ<*NZoEN}FS6X$JgGpaqNN}{&5HmWP>7%W@9 z6EEbmh^b6MD39#@n4@hM^`hQTBlM)kzby<&3%-32+EO#1$i)fciGKd$qu5sbF`G;! zG(PQcET#Q0jT~wYkVwoQk;vs3?xQKZuawL4;4O#9`qV5J__mKa#tRrFv61SDlb@9E zL!=>Ya6PhctUhY+$ZA#PYkVI1D9op?EVGPV9GZ5wE5i2 zO-|uY=TA=wZO_492)_JrvBPv+{o2oxiyZHlxYJ`~aZ{n047RC1g?6Op-hR(`8Wo=j zuWs9u>c)AxBH6w;9x9B5ICe3^-bv6)h~Jv8o%%L>DkSt{BLBP#L^J3`$KTCLz9p_X zDxH@$w+xGi#AWMteceYu4I75shEIoldSuhbE2)jRtL>IVcB+2Tu4#?M7a!@Wh!?Ib z1(r*H%^~huh_`Nxso2|Hw6_=y;t4X~__CEH)v=E$l5WpYr<8ZCVEhyN+gS{>gc0@} z%at1LOcs99e{-X;V$|=)%OahrpC80J{!piA*~aoO;?Ixo+_HDDsYv#b*j4pdEOe_Y z9w^f7?ARF`TSa_Vzz$gl7{sgvd>K+~fPmqvgfCT7Ag{)^(BIPv41!WJD=CT=C)iv37p^AHP zZJJA_4fC^j$hNUr#~A4?;FU$=q?|2Qn;XAoUyrGfIOuS4DSifV3N`XTk?(qb-nv3C zMa1S`{y>{%>2|TJaraZOVi)ZpwY}Fs$I^n_GMbzd^Rm3Suirm(2 zXD1^7sU`VqAw`tfv;CuaUdxp33nb4Lt=)1;1|U-=wbb{|bTFrU^6v)>R4d|DiPSz^3;+A8LOX=b(7(nsLVTEzQH zKXQ330&J5Xb+} z|W9ZPY^%y4!puG@~G>uQ+{rhW~`pP{0{K0jX zL+P#Io3R@Xsg;s&udQ&aWUwMKYNOzd=HC95#SHVmty*iB^bVX%JMf^Ul(tSl`vSjg ziib{KM&>9p*VBVUjxDX)jM3%EK*YjSiBgza6U0|IbK`!_=2t)bwEEO6I*$B8g(#L? zT>H-;+~;bx${*EibxHpW5a)Dsn8F0HTy(l>2zq41$6ZTJOB?s9G7y{igRy@! z8o*&FSe05l!6=9lInyf~AL)02$O8`K(K$$|HQ{A2UD~>N@a|sxQ|~1D;j4XX`^-N@ zza0>nH;DF#yxT3H>Xdw=2Fjnz?f$i}v7h>gxCtUOV;#@I3iQGLg7Ji0JgkA)ILZEi z9CWBosM-wPGwki_YvN)_J7{m`+&uWi^0YUz1f5df@N6b2cuu6e*rrm9ds2A7(q)yI z`A5;}&;T}=Pv_wMCgg*d^uVWE@HvY7Esd+EU_cv-83yP$V7oCB%q$bjfUh8YiU9IH zV2GhC<5+UVlnXD$L;ZwY_?Jh3-QrPlXJz0rKJ77 zPt!ixFYuwV)Iy6YTZ_?@M~Rt#?;9c0^y>x0Mv-51CW0ked9SC;c(&$Q;Vhr^$em?C zWbdtxKbDczOx6AL%BT<{mUf(wAjvOsk0gfH^Y%Yo?nHzIhd|F*W}{yyb|Q^LO~}dO zyBDSPnbiD(K)8&)N41s?-K&&d>Uup!QodjUwrVtBc2{K8?zQb(>PWVf8F{+Z%^2c)srQk28_V{kxkt}soU0ADg+3HV7NPDAzRW zSUsM6WkmTJgN*eh@#xdfh4bR+9P0d>wXMa7%($%Rttyjs$i(tybI_hEx{k}Q&ndpq z#~W4l>*ABBbFw>`lpezC2SEQALQXpKTQTn_4l0c~-zAeV5JTGF7<#%C9KW|@+aRQr zsB;d&5quxb&?N8cIMLi$vkLZ_)$j5pI=}PBR36zX-Un}FqbZN*_q|w!y>qa( z41*4y&cQfk*T=xdf=_;YI#wEQQIDxp5~R$Niaf?YUAtD{+jRDMhHC@`+np(Tgupf_ zzUBWUbqX#2M;LxDl}Vd)dmT@FRn4*CPExo0=sz>WzEFJreVl-Nk-DtR0oaAYn%1cp zMF#JZmbSJ6s?lFVTboNzP|yMS2oLHY{aAqPui2fg9k*EKF7OR*p*YOhqG$Ns=|iLt z6l?*;26~fF3AnEX!~8KicKl>-xp*lfxcoIZ!%ND2gZ%$) zzL_;H9yEqd>h?dK*%$gbWqkP_sDuKsfSep6`aINzU9(UI>>_GmrSP8inm} zLEA0{p(G@>drmiWMiAd2xJv?Tw4dhXe|G7;J@A$5l2QSNl(xPlv5ZZxjnCx8!0&xe zmnp+lEDHSXpk@94H1f_~x(S0W5Q&uVEgJ89oA~xs$=#`;aeO`9^`Cga0L8&Ys6C|c zNXE&OCHiQ2=A|; zT$=K+1^*LYoJ`S`{*PyCoV{GIpC>PTx7ex0)9THd(N7}7Z}C)jI_Q-Q{xkbCFOaFb zcpN+I_;C^L)Z(N69tgLt@uH7o;WdRQ><1y4>KAP`6aEoRyYb^U{<9B)Z#OQ?y%Ewo zb?4vpk{jP%;&`2Z+>?ir`F816_3Ez`?~@34eXBpk{Jcelo8ignNL(2NSpp{W_Pvmd zD7aZ-!r#GM?$f{D#S4Uv)+A^Ly))-QvC*AdxB^4OOzSM{dYKgJkC3E1`e z9VXxhZpO~pgOGjkjUc8XU}Ky`$^5hVfOAF~m|0F;pE!DhyYsv-pk)Mz#BdM%5;>NN*64E^O=x-{Se;?ZKYe5(Vk>tX-6H%b{!pCx1 z&!ZJ%u|e@01pI0NvWTw#`<5Bhlzf3mM(|H03;%?79KnpzNz`<-pf5j+CkS1<`|vCg zkzp_)d`_FPx!KnWU05mJCrG-M_M*wsSgXOrV_oq{?RmRDiDO@x{N(YWDCI7JY1UpY8zm z6IW|Yz}9(-e&OFqVrk@n|8!ekHV*1UIr6-3wG73v7`vNhK{ z62*Zx{uc10;p>wf7p@)ZIsW^Cf$#djef(8pfC;1}U*07B-{Noyu4{g6JwBx>iDrgsq4Bjm zey}x5BE|e*f#vgC>SuA{_WVG&{XrZ)dm81!9|KPi_2Tn9$3O20*szOt$(8`y2s-wR zod3@DlefbZ>l+bG3`_uI6N0s)4lPufORQI?mPc8)baXpxOj8Lt_&CP@uMSGM0_91gU5gV<{01eWeV`2 zNs!yI8j^axCI7!2G8~GFP^AE~1X22M8wOP>0r_zO=V(f`*h~d%t6J3Yv7MLbbg*9} zG8<-LC4NOCuGSEEAj{AzPU14lXFCxtfVX}dNZ#43RUU}_J;wg-lJ7IW-;o;dVn)u= z$!MPOcZ4SEZ}vz6a{ua0&K#Immcbei`s2qKYR9^`l{H8jR>FsU6(m;?F_*+O6b4sx zbQ+@`nJ5GQlhBZ50p~JrUaIwwT%fE?xe|H)C*FWlN0w<>*C^!4Nf z4sNksD1)IwgeNgXthKI-_Xw@7Kp{JDOhMFKNR5&3oyyY<5-|OfpnqR&=&!6CM0yj$O3~IKp+KhN{is{14o@U-)xPbq13q6#soG zXGi@71~tR4K)r^&PrxSX^{-iQUOIlr5uD68YsYb}X}FSe*exk#yQ;$lu~LO3=LIrJ z*Y*azU%~-4gNV5#AAP9=;~dk~m?7CLDM4oLN6;Q3HcBr2!aWg3Js-}bma@MiwC*vH zE#iPgD9al0po>CwgCCD`c=@QT^M%Lhq5tUQ&@YmH?F*DzB%)%_e`Z-;_^y&tP{%g| z6el)8wNz|D9|zk*DwThhs^n3zuHN#=-|SqajTlB~znuBPel*ChVQD2kGm_1sWMVS( z9$}N?50qyr$@f)-ZGnuRWZ*I4zt~VFQ%3}(`@aeP`=7sW#%~l4SXMRitLVQMFX%mD zNX3J42zVU6gLySYbxR(&_m|4$@!41H2-&|!AGnzY)pY13-3E%VTm}8JP52oOcs{iT ztmIs5dvEXe(VrYW(A}Py@hX2QcbJPf@2Y%IM@;YC(sE~8uLS3pZVAJ|1s`rACxY`_ zqzlH_q-{qzSZRi|LnZDC=aq;6v#HX6Fhd2u!~9<$J^4Z%GWkz9nX4reHnVN>N3j%| zNA1nQ19uSahF$SEAmzZ=Z)dAa!6gI^F$Qkgb7>e^HXbS(1l&!9MJ*QQXEf^@+jAO% z$|L$}u0}(ikiPFr5_nZw0b7E4(I3K!m?XKh>8g)Ztb3W@&p0!k0T~7dZ|Um~kcQ*J zLaDm?@`bv$!u)EEZ_Y<<9K3ZdH6x8Y>OZXrPxIiEy3Lhpsb3$N6egxNt%e?&Ss?p5s z#p700x~w!kPq_cMRA*!h-S<|$yHsVpq2u9>(3*&bLT~Q0fPH#}S4V)8!Q0P_KcdR; ziEr<|dK%$Bjw7=T82mT#*01^c-=Mt-1nq!*x$wP@ z(Zshy1PA-iW!7Jt6Qx`8O(ht)Vf?Rx84aAFi$s$wThRW`VdV?B3qpG>8&c7UwMvIOS+>=;+T>v;>iYuQoars==%sEdVY@6 zVkfV7Mh27#Im(cdoat!9XX4`OEDnjFtF&A`vOta6qu!d=dRV1w+K#<+rXU;=!NLC#~P1Jq|7zfqZ3Gglw-?nQC4cyLrju7AiYCO`H;Q^MYRv{v^xv40 zdYl+T@1f2`c`|9d%sn^6jg3R@yG1$F1Mq_njyr9_1YB0rVezOQR(vF7#mFnZ`6B5* zJji^ohK9yW&@l|c@_Cn#{h#R4cS;%C}IxBkW$>qnWi_}c)gp;xBG3XMgm!ZDzoKc7I!1w z6nWVyQ~i2|_Xwh`gYXZNy774e@q3A16(;ILIk0&8>L@5rPIg)B5i%EPUXB-V$yRqr zQftJ(AIQ!0$V4);eg>}R;M9qie2+yQhI$`LZLicF^Xm0aR8NWu@PhINso!0 zN>y-^FEz-&lsm$)8n>MT40ij;BO_|xIEU`)2!n(2rvphjf70_>b{l6r(y&<^%!~?d zK;2%oijWW0tQ-OE@By(K9Hn28I?&o#p2EqrACn*vU9XZ*2OE`d8NwT^_BOVuGc;Qm zNqvYM+n_!TY(Rq0E1h3KO3kNMLaVPKa-_MFSukE~>Sy$v@BPg;zVD7<4sq|H#yu|} zP=CW$={t9r$}r3mSWwRvU)nE8)M6k%OjIkOl*t>Fugv=p7x0RLMhlMlDmX=%+zs@fo!~H3c4F}SEWu>G**j~OYOUSxP4XJmFU2)UpfdyIBrCOyK z2~8D0XlLgJuGIr_*cy~e#E=PC>hF7-=bxRQ4WZ^wJOAEf#!u3&nR7K0gJx|w>0d2? zE1u@83KUMf!0ke7O){6jtGMe%Wwbg~kBf*es#W$(ayLo@0}w)wkFXod0#XX0!J-ya&Imsi`n)1t0F>;YvKI5c|%!nbXHQTM)}lX z!vssALB*PQQB94(O2T%IFmO#1G$JXL2G)9-0EV|(5rh9Z(jH&`?Cp!r&zhT?fruF3xF&``AW$nGun0qY zIAcQtiY1nJ>WE2Fa$-NA2k+F)e=9SXSf$MP$t5JR3H%ji04Yi@9=1DMW^%J2MiSSa74JA}PLeo@-plrXWYn(g(4tb#=V z>d8`ObaN}ddaZ&PD)$eCR@+Oh;5=~8Eu7Qo>$n6qz~7&N{+Ck#qOEnpq)$G{P@ScZ z`cDFr-M=LCdZ@us?=C&b!+*4V+@Mtb@^`x9uU`+=N!UH#07FSDqZ$s^XT@+4yNHmP zDm@}LQkooS?Fv{~tD)<*gc`Smy`GFTGL|pakIypu9wBo$P{k44R<3#TKOY7DML@>J z%|1|^$1^hu#MQ~LPL}7IK7Ts1e6E&{7%g;#elQeKa!=;l!PT#K3q#(E;*bz^=-SiJ zt9wdEFQI(ME3($fgyi;&Sz8$`ELA@07P#TX^9{hP(TfNxAmbX}-CLgw=&Q11;<+>YarNv?at0#HiNi0#rc>1PJ-TNIi zHHLp62Qp1uM$?4S$G+%*c)O^9{Dw%Ye~nOHCyIGsQvZyOMGs|^v>O48B7 zKI6Y6EmuufNX7OttXj_U+i)qcC&H;)g09c+VkIwNVIO}$e8_X)`yV+oUrcz4I<=a4 z%+C8L==f&7d2Y(je3}oKah)7v1zf#20OxmQCxij33vo|*R>&VP_`i%nPu*;tl)i1B z-m)cQe(PrKIAri3a^SnVy+`V|hy@uWsQyT5-PJl~*>tkYIMcBke`T-E&obo->xEpz zh4QyyDmlZ*)0uVLg)X$k|HW0;|%6u;_8F1kSv^ARoTC^+Fg-@KH)|a zN6wF?6kIy`t$EtZtcwwUdMFXJ)AoWGiH|}u`s(UMW6AM-&HWIjhbVvpdR{qpBb9UW zw9(Ly=-P2I-PdYH$|r%maET)2-soq2%7J2C6aUTlhv&{Yc^1DC1enib^09;1%d{2O zFvdN^j~!h?F4hE`OasXLiuAgBPW=xRulD!SXJA;(ndEif|ITuO5Js7?5Yvv;bM zn01o7Gaj^u(SLXENMc=`ou?QmA~CUwxF5L5PBO(05X+y^=aOWy&owgN2-u|cH)HqL zyRq_>b=>ID{BB|z%5r75Bg*7;FV)V+J9CXq7JnRAZ(mjMytH6sw9@dzwG=4uNX*0*Y_<)4h|mNHGVM<;>@)vABJ*{GAvJDBT? z=P~s;2-(-rVd07sjG~kDY7K8B>`i@S2iN8S2K`8JCvX~8+V-KY{_)8RK3x8xp;e|L zb+GBw*4j!I$f(3!zx@zCd*FvpJX1bzFaMECHZSjL+bYDZ+QQOuH`-J~<8HEdiQdWh zqpcP4z@|Gb^lk;m(g`s)sVo&kodP{}PMw0@V(h|%=I$&u0%$FMZxcVa?G%`t9;Rz+ zc6uUwy>whwl=Wi5$(v(^{%5}oyyh4mP-hHJ`WrQDU6J&Gt7w{ROA6}NMK!y9hf;~% z83ALJi26_Gy}JmXS%2D!#6jb z4@xiT)uTsiOJ4mjI4G?l-u;;&zR=M@HGt#Di+7Rfbnh-YU;jyde(&VvkF)%|9x4gv zjQU1QWAG4A!hjQTYoF~Z@h#WdV-{gFeX?@c6;{eEQT8-H?bNyrIpZRH=gV`Q!8yTt zbWmknMe>;a19}$sozXHou3FdCtwRatKV%;B@8&j18epan?L$v&hG#D8#D*@F_?AJ# zTI!{Tp|$Heu?=R=5~tC7n?RdA5n@_(->@Nj!P8+>OLBT<7ehT0+-NmFq#aMe6UW*a zFN}@3md6F84w=dc?v)u?HCDx1!n`fWL)K%})MoeG;Vg}QB?NAAw{A=5`S;fz3#O{> zVIin$*)y2sJ3v~23S`;O0p5PwH%0Wc*}J(Rj}OmtuLr~^_qKm2IN zA$V9DP}VtnOw>3>I(2i0(~2vhma&%Ysd+Z`k{_<8Xkl+1-3R5p8ZCK>eLBHUJKT_* zG5o6Jd8hE?*PJ;?Jm?)&L09>QxQwK|L_A&zd{@9@oigGT6uKlvO zq}CND_{6SiouX}VP|)nt8lcgDm3E0~PI_P^cbbk4ZkH8=ZGB)5o7ZQO96KPDVCt5l zcBkkY1#Jfi`s}Z>Qi;5HKbh(3i|!Og4nAvD8xzzGi`ZL@pCNIc1Y?;z)=|2TXtR($ zn-PIC=yo~kQP^334X-A{ATA=>lze^#p#Irhy*@%1a=6WW5)((Vd~^&yGuL^fJe$>j zF!8@I`hnv!7^&kiRmwV}<^mcvmZ$)eR&Qo}3D7ZFCs89Z$Q#w%0WOY3bz)};UMU65 zj+9_wdTa0CI?(DvGsm@UG#R_|rOb9hk>vnIx(h~f0f~#y-n44NJ=sMc zXk&IVM+5wImDJ;RQh&>oV%sEizk}xCL0Z9BRokiv2IBDp;<26FjaZTNTHG`&SLjsU z*{E3VkfGY5Lg2RD1;~=osoJZ7tCGNB5aZ+zIp@c|GS4q`+%rlO*WhK4o&ne~$ml2TfA7?myV z8BiL}>!^41BEI)m3y_%Aljn|52PTLDvB-cCK)V?Cu&c0oR+6=qG`x`FI*F%fbWNM8 zv~8rJ-GQ|Iwg$Y??63tG1If8_7aD22&bg@i*wZ7=|*J3)O~{jV_MB3!5^jwDyc_<2UT9sdq#KFMRY zFF<2fp+mZLY|MKVx1GPVrPQVJW$aZyFWm{ey2xp^Sh0-8K1q(*EYtFM-Am8R38=nY zz}3$S>-fL{Nwi%N(Yg2m{=^vAR8v>D0;$v;@;%a4+J**|8fPg3*wn>`c_~w-NA6CE z3^PT>nSAT1tUv5Z+mNi2E5>-@k<;GzP%9ETHp(Pn<;q5B8IR0_*G9Sxht;s@q&w|8 z1=o<%65_eoBkX~vIv8nOqpQ)Ufy!ZY0&VMCwU(e>qC%)jFR0y?5Fg>%AqXCKd!2tO z0BUpV`e}YXuzt=06h4_4eCS6Afa!xq%XBjhO(9GC^r%YR<27?JcRHuec z5pg3><$pl1ogLNwmlHl7u~Hj%ld%zBtdDA(&HIr(0u zLX@+lCfL(6E))Dn@DNB*Ba@QoUIP%QW~Ut0tF10Imo+K84;*B+$2imnPs^V?=U=3} zz{v^aSAB*pT~)8&%KMV}DdcKS_R<+D#qX)-zX~e=PNL9#izy>X>YP>AA=A|eUDJbN zhyvkdBzTU5R%G*4Zf-802YMRa6^z9wk&a6%6xHu4u1gke+)uQadh<|y&r?Xdxyqrk zwLp}99tKFV!0i&K83=loy6?d9gBIuzWq$*{EV-K#%ICK7sttkIysT#8Id6~p@`Mg; zSkfx2tms?P=+l{VLO(Oe0l2<7fx`X&#k~u9YG3Ca5jC_&QM7v%h@^u|$CL%%vKOO@ z1{M{OMa!YlgZj(&hV!>=(W#HL(YxaGh!XObD4t3r+Y{#(t3$&Jaks0njjSNuc{;Ix$zwsG0pz5`uwL_JdS?0|wjfSUNY%I3t+_=8lwV?bR-@Dms{w>t zXWULXv)ToXXiZbH-b%?ZDRj6IWaLG|3R#K(U(M<8dop|AQKoGlzaTwdSTN;%r8F&y z(9LSdueB;2nTg!!j-X?u<9yoNXECiR-M(2V6>f?^VD_>TM|B~>yZetbQ%o;Bz6Vr6 z&&95u0|S7S-Me$l5RA>AG6a$fva*Yy@y_YYy1IwQgrV2UVbn40)00wQR4%ttdvp!{ zsxof=^+KN}6HoEW#~{J}2W_`gHc5CrUy%Ys4d+6uWa{@0iJQi;`^(%^!YiH)RP^}K zg_kx-xB@PzSz1_Zm!pcrkJu_F9W@hO!JF!-Ms5coyDrFBCNRK$hG(xf60rS$?7d}J z)ZG_0N{1j4g0vtANK1&MqafWWjnYy|N;49I(kb03qO>%MbazTfNlQz=dl*ph`F}X) z%Q;`(=eiy*7-r_TW5vDKy4Tv5uiWN8^$uS{z&Y|RDR#_-b0j89QnmTS#P0H9t-^QyGL4Z&qGLD!h2>nO>+z z2wTUnc`})?&0by*xzma0uy8x6V_kdc!fa*#osF@=+5LPq3Cp|_j+^xHd?Gb9hi_2b zRv1ALrc=)Op;5>Fqnf(ur<<6>IJ$6=;5|jLFE}UCv#Pu9^7HyeAE(l`RD93^EvR-Rl+)`e)K%!_I|^8w10A;P?KzK*@6q35 z4a*c*U|IZDIuWcS%iDag8Od_5H5(bt(ftm7(iV%7H_d$8G3fcyv>lo6e&Qx5W!PQ5 zz0a*O_og>vkt`CxjNMF{%csKa3jsJvQjXxIVAD?*8iv1;>3CbOFXrl@zpiEFixi? zTm69b)6dfJUBOoU4?0z%qHzw%y1KdtYfRRM>y02k{iJN6VWKsIW%Zf&2(Y1Q;IK3w zRQ}buEm|0@Rp~^PGulYX&MrVYVdIm)`i#=}ZsOaGw^}aw6_zd1${ynDR0_L8krq#cYIHQ|ZL995_eL z@9vM46{c&CmZYerT<2LOisqiD5k}Udg=Du>f+CR`K9wm!S%Lf2$8(xBPJu!>saJ_Q zdI}SA0ua)ZAM4Sd3i}%v6=ley`#;yhhdzR3-Fbpqk1|_tK1Idej!P+TxCMA1zh;t` z{&E{sdYFhbi3b8qlxR!A?dd{z1<@cl)N>D#jrOFmBi{P+UevF4ViFUNgyUTT>*GC| zDy!^aNw%u3OX{2bgLd|7-wI#FxwJHIjBT?0*ae%??^fXu)zTDl&Bwg;%ieX63+J(_ z0+h{zh?LVy1fghGVL3>nDaCIiFA-h8TFQlhtf<1Zk9XEoa{nY05YgjP{t7^x#_B$1 z0s5Nht2I9I>Rm9#6k(adzu!V7feMSo3$mTX;%^{@(b ziCH@Zw$pGVQAU)BH`+_bBc18S)#g{ESj)sM%h#P25~8mC90IMyTR{zl;e22`pGWrx zU0sTz!{yDJ9CIyZ+qbt-8P0H%IIvb#hS%>tgJjekXNLTCJw5Jp6*C;hZ(7=8kvafz=M#rBCzOGz$rsqtMqxH>cS}J&tj;b zf$~K{0!$$3FkwVRON~hqKoijGsa0V4+Z9sb!rZJu|<}eT!sB0{wfj?UH8qg@i6x}Q8N0rIvSL*%FM!cnl z127|h(tpVHQy>h6J;9t82m(Q|Q;*8Gu*!awMmb|SZ}>G^Pi1XZNqMk>pbKl|uR(RH zPJSydf$a~COYw-DciyL5g&TW(!1XhH5KFP7uq` z_2#`_yUw#Y?;5`5J&`=COppK>OuA-BugrxJgQwt&Qw>Seu3DClxtD8wxAr?DOM|k8 zE(wU*-%q5X2GrZ<9Y$E+>|h6d15O#RJmw1y%R|&wm3t-9u{)s?=HWPEky@^^#Jnem zAu!8YU!o`pk1J70pa32uGwX2rEV+7M@C1gnZvF;@Mnaam-0wo*8kAzR!Lt4Sp%*W( zf_}mWd#P53=co_JFMw&e)M8^ZA~NoaA_!|Z9GWmL0s>+ZK>P@bqHN(5XJ`Y#X&7?j zzhTJf$MXN-Gh;k@0MFes->&4s|3kw76jnH$%Jh4ud;mJ-4F}(wmLXvy7Df`xr<0iZj&$)HsYP{TAz!Ahu&shL(`{oK&JDj3S zX;ezht`X+;s6F-Sjzltcy zxt)EUTK)pIiX@Qe;P2Sl>5M(1kwhue%0}m{K|bD31F>$wR?;p&32-lYozA*@oUe=* z5sW5X`2F$69&^@hzuMr**2-C8`yZP76syFG z2W$tasQrcDENnY&p}=_tQ$MTFfsc9qq)X!OB@-t;B>?MQLYsNzGESb`3m}!yO<-eL zH3~F#^=3XE)9uo}*aq_J^umN3Ca{puOK&NXxPF&1IiVcvv`O`Zq>cU~&2WmQEBfwj zsBuzJ%jPxF3nX1!aeHXNh9pwBsu1QGq0zw|5E`GiPh!g3|LCI58nB|yH-g08>+SL+bK6kvz(>+SgC$%MlfkDlPZSy*~>_(AFDoMJCB9Eo!|!7syr zDQp{#JW$^(rH~|3aD4o|9a7Ao__f~SRsV! zi{mfy7gxR+7F@Y6dT#{5kW)-_ObR#2|A0CLdOA!A#$X0SNhYl;Hy3V+Ua0kg8AWz& zxQa_(=Oev1F%&|u4OH~v94HL1V^yVHEM-0p1s`ow)48F@Wdqx=uP=V(;zq&r>m$r9 zuF`0)-qU7PVA9JnCOvh|&CwTmwqHvgM4{e#pFrp;9 z#FL3}XDOtu-85o`MsoK*`&3J#H&gBDJW;DVRP+TX__=jFTP8@_seg`;^Ey2+wDo?2 zdFL?>uxX>o$&cZi#(KVKd)cD@d4h>8yja3yi#qkeg;`VG0IH0aU*CBj*d}9U6HK_M zHp3_g!=iD={~G3C0U)Je#<>gNBEUZ~OP^tSzrB3z7nnQ?yx{sTHU1^g`x%sr zM*@7!q)%ze4qYJ;&G_T0luv;{qZAy0*VcLz181n=d}t#0_d`z~??nXj%?Bn?2XawT zTC8|*RQDKjt*d1DA~JY;3+|eK5RGUp5>UsQg5k-eW}cpU0XWsET}Ci`-pne97RW5t zWQ9`p;gMrf$QC^d!e8@*KN5f%4r%s(TsHF!Alo;P33H+Wgo1Hn2|-}#fr{bC0b^># z?EL%kW1tIf2XM~J1p=ZwVj&114xl&(Pwk1ye>^RFwN;>bby?5%KLUb)`2T| z_-S(qDi04-*cLqNGU52o77*jZ=#bjM{{hy%(SJAM10bOn1r#1`=Dr}#4S~@in~Y+B z*!2F$hI6&N3Tie?*uMdlRm^rNz@eCb zf`yRYRqN0%xs5S`<{5UEcyoj`7Y3Ienf7z=7hHNtuA(#@J~)xc77?LhZD2{p>-@9% z_6JWSxY07fhC#z*X^IOf2-8+QpHmlaUj~bkJO$Tv!HH-{;r|UhHNXm#Pwj;ADIenb z8(XxN(UUD6^~x81x~*c^*Xan>%6h+!d+Bl`w)||Dv|kMw-i%s^B~C6mr2Lj97i5`i zkG15=JvzIz)*cl@8f9R_71DhTJ0$$7<|9L{z7EE*z4qOEk^#N97EDd8AMB>q8_k?x zlIGkGKP~yj9YivMAMu4yk@tPSCEU1m>sHEf;r5byh55d5F)ApCMkjsl8q@uE%a7C5 zmIg)7R4YHVU)AkWg3}6zyz<3*G!cL!y5cFA;Ze|!jLc+70t91&HS2I_B8l?;v~)YCJcQJ0Ygt z^K8%CMJFHoZ` zG8&G?FBFN`!n;`$Y;iNa{QW|9w)IYMSh{vBk(ma)#HR_`ZjvpfJ3DCU|u;B$ev|$~nb$H{o&4WG}~ywVu9LplR6h zvhGI~(TBf!w*w)s#&)caw$;>ch)a0%{9+5WdZxg#!n??mDb-38=z*%7t$xF}EoyO* z^r(8IRHfB?Is$c=GXXgq5coC{OR=_>-v+j2Y>aMVJ^I2=mnsWOYe1d=$RpkMJYDTS zdO`KTBeW1Uz~856TyY#2mG)dyqYH%wQuzTL2$sItp8!4IL&!r$brPJ92|+1TitZ-L zEq4YDwn8IU=EYyIV#R5ziid2w6j#U)C8tv-$+X&9T7tXhFXNEnXyxyq-(nqRxr0a2 zR};n6+L5Cat%0w#Qo1lt;nwmcx0C#NV|t* zU#FTv8!5|l0bdVCd~Yf@=61m{Zui^e5haTa_8PHj!rzZNptBr=A5PDH)#vXY zrVpJiC0Yv&B63r=a(&v+AtjnXJsjBPTXpxeH2{?h6pOX|fn-UPcu5_#+|faPmT)+u zfMe@>2XRpJI#bjcvOB)#KE=~A4@RW0{+#{7{9uQzN08G<^IXNhk!DT3XQns)emiaP zX{xxd&6)ZR+=fb(&EsfSY*sfeTGZ3O5ehpvKK4zxUtm_+!Lb)oBV}oM5d2>Cev9*( zyU5xusA1cl;29UV-zik4w~9_3WaUo*=r3xjnTt!DL`}ynp8H8{ZP+BYxB7e^Kw+-p zO;p~tY95l0*j!0SQJ?a#Vx>|a{$#?+P@Y(`DgExxV{%5wUi17r!@7(oYsU%d^k#9g z3ezhGOguANF1&LLCpNrY>+ykYAvudrhb#L}etkxElA4#LFmPB9+IuovTE0wC;oj~3 zPH48o?ADDt%^e-#y|R2Evy}mfmdmi{_g4`JD&@(G`LA!i7+mYZv@7f*jT2&+al~vn zpT@$Y=J6DNMa}8x>Ae4(VBkOf?^euaHFB7OYiWuY9s`Q<&`ro0~4{a+(e(Sv<`P445Y;W4CY@w*Scd_3(B z4e`VXkBVxQDU}Z1Ug8lIATSj6qE|6)2XTj5&+{BLIQOcQXNA{^3c1zS$5limq~_3tL0hFGO~q4{K64`(lF66-z-XS}rjk!bX$wB|d78*-$6bLTIY3fzn~|H1_#Rg(?QuP}rMZWeNW# zaC=MCZrA^^*>LM!OMcdQ!niW)yiEiAP3(-p9}!z1oT8$IGbJ(I);&j8oQ0!9+Mbx& z%HJ4f8zEtM{}WLN@Bn7DfFUJf)26A|EjPBtF3Nsp@Y&RLk$L@Sd|7V$Iit&q<|fWX zZKTS|CpDGaHu*S=C02uq9TX$FYD&7GdI)FlWIXNP z)k*p8F7<0W#dkeKXB2E4wYcNz((6x$cu-=zCX}6%6SB3XY}zd_S|OJ;TTjC)#(Nsu z1_h!aUJPU$0@+RvJvi>@OZ}&Z6cw)fX|PsvIa)F6LizmOi0a4INE5igM4d{i-9P1E5{gN?*to&0BkoQcrWVCy3X-^|5tATZ9W1nRcZks--Lj zuPJV6SMv*UtH`c8$K8#$bFTvFn&BeD3d_=wz=a_lAMCbk6VtB9u~Qg$N!Vg-S;U% z(gq3sqB;lAL&+J0xYzV0&-;v=xq4j?FkV&3105q^0b^;_RZuFyS{A>10s1 z@~}RzjIPpCzgxfP%J0w?@frC*Jil{&n`MF`=NVFXveye3_+i(r756Q;{UuED%Q8Yb zXgUL^gMhKOT{|~d#NqA%`X~MCb-#L_=8$~Q5}-YoI(5Gz#hjO1pPj_%u)-tM=u|y= z3TJk5RLlVAd+>nebUv_BFQsQ7Bu$t2dRuMc5u)S-QPwc|J&jLVY{khXoM>B-d4Q`# zo+K?L6)~Z08=02&RS4p^6~fD5E3aFFkWQ~mvYLbsBE|kkutSCo%1dtsGA1C83Gg^& zv`vNr)4wBbW`e`LW*}XEx7x-17zz1;%1}2;50UUFsJ1Zz{Zk6&Vz>8K+^Q<1K1^4L z&wdu(*mvGc&uF+wLSo9X7}vXfkUWrInmI&Elj=8KS{P~;? zRB{QRttueOOiTv}6~tpx^s)6N+l|vhNbZoJ!|Y)OW*?4%(BaRjau$biUWJyH)^xMM zj*T{@u==TIT#v{w znSm?Fkw-`S?FFV%et9+1A-wxhk0?$$UcH%(DtOIjvBM&=vOD20*9=ITd?t?d-o}yu z^^Vu`K%yfesA~kRKBkf5Op`_#!GUkXRe9=`dEFNejXGJwnO_Na5OYEDYF2a5;vIW> z?}2kOZ%^OFcsERTj4)7Q{l0#qT$0s$>_h(#M`IoE)Zf^MK2f?8C8;0%DSgc5Ro*wp z34OfcFDC3gKiu%RZ@l&d$gOcS-zKOnuADdsslx=; zt1F?AEMrnhtBl|1*W9_t==Ta{Jrb{jioNE8!pt=-fPM$U^z1h`!(9$h7 z`-`IH$;y?2ozctt+}t(`gx4-_cZe)hh?HGY%OSZ#p)RvTb@D0uk&t@1YH6}_RI0(` zEy2oztm@9_6Yucl5hidrSN3{5K@AR?+JhKxEHqqF=cw|5(sj&8WygLOe1lR%QFrS68PXNc&o*|HJ~ zNR>Q%SY~N$DI42hSw6M@1YDbx^K;r;x23aw^`rNQvbX~3Et`>Y;n$-M%aQGx4vWL& zf}`DHb4^|MU5`eV__5NRgxgIVU3O(dBl?v=uZ+kOLW>PFauteHH=A-E4-#gGx-*fa z%1%g`MVi?>&CQ4A1;cg$Whq7uUi?*R?DqY#WqFVlQ=|O~13C_6s8#jokN9N8 zs=@iMd7%@Wotg=J#~`o~vT?LJnfcWDz@EjfX)E_-SmpiJQe)PQNG0c6oA2u@W`Ol_ zYE>?@!XbIPcI3G5+NwCnm|q`awJ?(HIkgF;I1T1}7XvZzbg>&lp4go{FJGd<+PS2^ zA>}oP98UJ&Usx=dQ}e|-OE%$OtK~wvaG+(Epqc_)1>~Uo@elcpobarZJ`eBm{u7cU zBR!Bv8&%^kqAEy8}l9mZ5s6^nhPe+ z6=HambEW0;qGWcD`*rIRt?9ioMYSGUZs8uqSaAYppR~*jsjxn})kLNK&c!vlP)oU} zqCRZXCsrvn3=My^gY-~1Lx+rQZWkP^2QRSmS1JgSr1KEc=Lapm`6L?dsZF#(kzXMl zqZt_)iBAwzNazesey+BvK9Nv$FO2Obr79B@*0X?j);|IN%y~z?wrolXAH1`_T zH#Tr9l{XEVgsR{X`}_$dyggYhU@AzaDlVVWd6H0ap5_=h)Z^S@nYdN4Q*kn`T`deM zuPTH?xuN$G>owTg^BzQ!^f0~)D6%h#Pz@~Up(~6(uCP<(mnh7vFPCgNV;=ya0)0eb znL^7ldSOsQ*MEr^&c=A)(eu(%HVhtwgky24Y*@O1lY`!~eYRpCAJgmB?pU&!-T3ZX z-IaVCQBsx<`Iw;jC*S(U>!Xd<>Z25+jG|Gct&Xwx zNA`L2@d!p!IN23FauCz5J?1NX`>Sy4nY!5r!ATTrN*?aWBYk^+BKGL|ylNo_32Bm{xo4HHj;e@So+GI1CJ=+DK z5KJ&Nt$Cu*oE?|2%WB$$p0_k@hs*Z$*;^lgPkWeT>MB<^=`~HsQ6QIMKZxAO3gb9%2R=T=Q z#|)*tCLRvXs(G(M50z67K=W8JBtG^sXV1eT=c;2}$Jy$;Pqn9c>O;D<_=;CkkRuk? zN>CWd+;OwuP3D16noynPSCgR0k1iNSss^Chaug{NnDY2Z{_AT*_3-r%{s~?uaPwWD z0>G7uzxDNOW*xLyrh-RYeU>c?1+S^YgjMW1juL*>jPmb9X)X)MF^)`&E&VO#2#BfR zt1#skZM;bs0*+fgp7k0&Nvz^Q49npo*saldgmk%SWI6T{hHowsg`tWFih@Fu5l1T< zfiZqz`&-@bw9zv>oXrAZZPFZJC(?A$%{lk)qo|AEK}8M2C`3@gDGc!ZZS|4AX`jqj z$UJt~{uY&^sj}usIZ!?yw^lhnrrB>daX^7Vi%BJ4KtzRrh%rM64f1L(o&D*Ij!TCu zn|~?7)qka$Ti8&SLm6#G!VUw1fQ0LTfI<~4i-ZxrkS3#h`WyJ<*&ll3CTFs3L^E%) zXwJ+LjW3ABL{kPO+@+Cu{U%K!?1`zO7W2dUhl*Otw5X`4qL6*#8_DjRZUod4So~_2VYfromTbiQR34T zc1#Av&>SdOJKbB&G_4(N!S1n?TRUy4HyHn)5mR*qd&Hv8 z=P|x0`Ed#VX{q7It8Tki{^LPzE6*1OO0>~vnxzLZ!lS2TKb+6i*FYmlz;QA6_T`%_ zQsjvkEj#FvkE~#S{X!?NZS!#aZhm_(-ERB{f&FID{7Xnp4|LF=<$DSp>(gf#f1VAY z0~0fP$>(}D&+|d~CO|qc!fo7+bU98YM>pIpNttzH?>@9#9OHI!y1hu91yNU5f9#(j zW%`OZAm=fIL6ZMUA1?9f7tioQrLn>#4()k3Lgi3~F~etbH>#UY-s)r(1T!xanQSWaESUd#XV}i=owC+GRg_Ppjs7jufsx=_c5ke{ zt;Qn#7B8w`M=%!2YOAKhF`&igD+ZHD1Vnx$UK;sDDwUMO*?qN{?XX6WMN!c(ri5}h zjbVg$b7r8!rPKpxTDV)50y-EG#0jHP%~8XiV&Xy=ovyD-^+P0`qhah$D1FU<*B zr|<7Qg7{#3DhsjS)QCLkWN%kp2~lyxeuq2BNKf%r!+c@cRg`1`0i-1RugR%>SVu5!AZ z+mW+HM1x`xs$hfAR>pF=t*wqAw@D+HlFf z4Zfk)r?y(D!m#dh@y5C_Bzjt#^+fCcs-I06{Uqa5%T2~{Er5= z5y9^X0uR9N1(CIpbxVfRpSi6UJ;T)b(U7hrLQI!fIm$axNV?6;e+Bg3_`Ru3N*{<0-gV<~MqVsn2C8*mU zq3^(jB(+6n8&I7a>@(*?3VS^S6;C-SH#e7E-1gQAuI7!!AC!XjW4<5E2J`X*!r&r> zfV3w{)r({pTKX-(e}>?`J(A&G`Fl|%&W!Nc(W@Lf7!axkl)(6Vv|vDVYjKWD4GQ=g zW0+%I`8Cqy?Aqm}D}=l9eph~r+1E%9T_^{T@vlUD(EDdD^vsTm1GZud7erR<8qm6d zo9(@LMoB`r49HWd9B2E(ac(i2=t6v8Vu$xh%T+?hZOL)?=MK2zR1`8Sm9)I?$B}=+ zWvVg8?2LYY=J(90gi#JJg}Y1yCu62+{@x4tvsuB$m!lBw*5NWt3kiQkKiddxAVg*S zrT*AJabL3 zG(g!gKkb#Vl}#sW*Pvn^`2~jp@?SWKuw3JrdR5W~n?kLdUvD>%OEZwsJ$&e`_~;SC zK4Qt_NahgI^n@MHZU2c6$MIyOjx{e35uk7J^eR^0%7_QP>MhlGj~1AuTo^BL2n-6J zIv*YaR1alrOuSJ5*@N|kky-nG&|hFi^-LGxm#j#UqzdppQTiX7@t|2_1-RGilK!6exe3Do2hLB9}J;%Nb z?ZLxCKNDptTs){29z)?2G}JdE*a%1kHvW+Hi>lm_3K2$D6$AE52X%qT_~Q<_{NPqE*j(`6lF7tQK_!1??lgeb&kfVq!`}q4Cjh^%?$J1bceAb`@y`5kK}(8qUQXOqp=$>V`rJ>S3W_2DM2d&EMad|eonWsU@S+ehXhv}b31ZsW22sAN7#=D% z8ysqs@;FmC7iyqz9L>Y4qM{pqRQ%8amv5@6*(6Fs1zfrVtkYhQatw2qOs#~8Dk|-7 z-B(Z^(6d|o^yDaC`_wg>e*e!XWMF0{B7(4iy&~McDPszs>7U_LQUh~OqZDri{Gc>h z-I;TkL4hU+mOGO+7F<&urF8G?^Gg_!0(aFWwfUe+xZrh=vDdofyX}l?HzG>U!z5t|`snAa^l1(UWIg>ikN!N# zpWvAd&3o3SQ|I>shxp9-0ehDC0FcKo%wJEcw!PD}nc~U{DWmugIj?Ykye4$0;?zK2 zpSX<7du8o%5P!!6eLh1*MBdXr{lHoya=&5DBk)W&_9T;R=Is-FDDBZ&ZZZv!9m)MK z&E!S$!0b#1UXFAt`XEIn)oO#=uMZUZ&WJ(k`;7Sw!RHb~Ad zUSi;BOp&g!skQXPZ_We|j9NRzVdEf4>dBWr<~W+;?MX4k^7ymxadeY&&ae0oz_p95 zgZ)P??D{Q3adTfM{{kkk9}W1=(4&Cg9+f;@SR7qxjl84ciH>G0dx5+T)69eRxpe8} z)3pEqL!;#IZD!Uqqr6co^34Q28+IUicTP2NPt%Rbz48UCg=-HU3WrRR#T$DLv#;}M zVxvOQINry9fQJDJfT=DMxWj!QL~&s>P!vj{HQKTq}rPZq_#yEwP`FiF}dSvleINnWhJp1f#PhskxgBla|q4YnGq>3@DBU*f$%c z7LN=2j)*~gYKE!dX1Eg%9~=2h`=Fl)z!Rkd2mdv_E#Cu!e*puIP4L2P7isvHtfNnA zk~7BFsM;UZ(}p9H>g$(-n|?pV;|lC_-qLa@wUjlT!evX6@O(z+Z}E)*cCXK?w@(Pk zFb2|l`F#JNm|sa$UO;|{smPhf+cT0HL8d|8RalLATDN_vwKECqgy088F zD{-0N=WpMBE`03sFFJE2AejyvjskGWO(GoF@Q*+!VVK)f!pIl5={}O$Q`XkX_L@-F z%$=FZAH?`5Db!sbY?In3_l$eevP`)sy3Wp+0E_@!3_D|g5&sufM*B#lVErBtT;dQh z&S53b|ALi>7%ymXOHL2jG%o?rOUufVzXaN!-m4|jI=HH-cUZAX=d*s$Ut=R&H{JLA zF3Lt^E&BCig*l63U0$bS`Ed@tN!*`ONn)ep9L_U|QcFR_>!T>!=L_rs5ykv-%>E(W z&3kcW5Z&R&?6|XI_7#lq<6o~-nX(|f4pWjek!%72f<wV|mC0HGeo zZj4eXQ+_%e@aI}?q)gVh;7r{UUB?gKv6aCH5>fcVZ9|7skEJCw?Y4)J`u~h-4y?*} zGArLE`kmH63r?N*+lJ+&GuJMW$ zxZJ?Jj&uh_Hc^O$?2dV`!-VVL-KRggk{j5L#_mHQd3XTH60$)HO71*1w@7jym=m{d z{qhnC#5#hX&~WzjbBR;Gr$uQAhV=ZFs}KU;caUb}n;~+76cDNE)wT)fmq}@>oVG(jv50R=?p2H# zKE#OEa&dR3_Q@9j5%vdnl2WFuk32=u^0x{#p9XN#7SWw=Hd^$+9fX&0C;Foyl}S!|Ug>PL8aVN93oGOM?9W7l!bLDU z-yqatKTeV?mkC#QM2ufIJs=BFT9u0nG7H{V*IM>A=V`7i>t8>3+m;~6|B*KBW#}dH z*gF;*6ooCX>t0>qv21#!-4V}EuUTpt;V|ylXw%EsgH6IgYkwpCQqpLtRg~~697jr} zf-gh)`sungZqWG&2Lxp=h!@JZJD^yTD?A>tA`y7;5u5z3d|t&WUyV%DNU>SKlKxQ& z{$}_sC0qtqrOTNq)%3Yq>ZJ#!1zy|L#Ijzi8n-p|SD!lZGp?E|Z}oP{?I&2N(n-J7 ztDKLHxOcoBw6WDI$K$kce6SW3NWt%f9HB3!>B@TatMQ(t?__uzzHb1;alyK{uW!J@ zCU_}5>mwwF`!c<@Ad+DoSitjBGX-n`IivhhU<)YOZn(Enp4i;Id2ID|hLNlR6`F+N zRJ3Fv9xn6xOLGGO7bRe)o$EV2_^7N`!L%JcB2}9LN(8kn*%)Xi(bNz?CX6NZ(A$rI z9t}To5j{1U-HxdScck zClw`7yz5NI2v_)EaLbnJnC3u0ygGit#-zihYO7ZSiXj7PA=~Eo4bPc`kP~_V~js`epuBU*?Y3+ zVqsy;`jA=T9);oGLo#}x^++K{z`j#(R~%@N0Jk4x0aH!mifGc74;i$F?1L6BDU>6D zb7Agt*-NDPAuRlTg2x_;nz6w-t^J4^P2)N3u|!gjld)Rv2#X}OjqlN0pZUA$a~J{r zm}clVO>o~X@ljcFh?QC3`h!|5sB!7BtUdYYa{8r45c?Lwz+Sj5X>{3nNK7W@50q$w z`AqEHk527q(2cKt1O>JWJs*9{hh>A8MZst}IJie5=wxEVfsMxATbpSP%QNUgzwXji z2q8pch}a`y(^=L?P;Qo*Rb_j*^!B#C|4K_$I5Ij;Q;y0zQf0pigK2x0a@4I#$4yd- zj>tSq%#7Vn9}C*~9%*Q^Hj4m;yD1khd8FI5v#u)894o(L7X}OaSrXI z-^*h>`j)ji_#tuYM>kElP-uY3PPdTjzE&&ckBsN-cYiGxcJfhTIN@{V?l!#U&2+I2|d~4>~KvzIhf$=`ZsW=wl?5KS(h$ zEbSFrO$gDX<|vh|RUf1QPa*q?9oXJI6gXfbLn+?K%tUC{#sKAO#laR z#z4ivYK3-dDkB-I)+hOn#CsE2&V;;nWR?-w@vmPin+@dN7BmNDio<+}J(KQ%vv#4W zsVYlhN@&}!^=WP6`aa&VLgOIwar5d_Z;l>j?e^FTDU&cJq)-w~ub8gLXK9z?g&_hQR$BkRfNdAkFgK9J~ze)Dm6bCi}hDr(;)7-STRO~z^E zO9WGc{b)8xYUoNr^qpWvZd{^EDK`| z%HEB@Bgb0S3%dMzMsoX!*9UC<#z2a&`9$||+nh@C_ypMcVR(^#Ft*+g8uTw=l-88^ z#wZgA>UW!7E){EidiMEK!T+DsJfh5Ywt-K z_H0alMt6=AjUA3fjjeZChQlB@JLG<<*3op2>!B2jg>mb_Q6_}OC(Vid* z{(+${cg4Gx)&WL&Sc<{JWLZ)vW{Jgt+&$19v2@Lh`4``mlT|x=UZRv|r;~jtEDWuW zK+xjDKWa{)-HGf`!wry8frl&$Lv4%xgH*Z(2uB+JUkpAvl$U_Eugj{+{ry9 zkr$RR3WKG;W}5?QnmQ)^NRfEOCwo(`hk)Fd%`*dR%yX$VKMkUkuSXjv{SH76`%^FJ z2Tcb&ZQr>JN#$5HUHEM#R&I?$5sXz|^L7|MM=IhQZN2f31lhUo%(GhqQb z1Mj8jWnyNSlu|7@kH>5}xkvEF-ghk+wb?f^U>PdbnA{O0d>|z$`SOmHcs^s}09(1> zI`S0(DvOb#=jQj+P-qLGH~Q|%x{F@9YcuB`;@XpIVm|;dx(|M$k*TWRuyl$o4H-?T zH^=1=u27~ywt+`KXFqR`$2=y#7loF%K4v=g;2|NBAzdZ`lp}0w;XL~VwZ(@YAQrSx zw@{&N1b3Z|lMd&KPl6Xm7TeH4;MBw8K8Sqy9ZC$R_M}=^`Tp_2L*VKw`3+ZLfeem7 zo}5yv308n)pQ12GhkS6G2KFk%^w>OL@GM1IE{ZW$eI5uG<$))~!7&y_v!bUa+ndRn6WD+w)Gruy}A@6E9?8?vgc zF5xQ@qa_wcteLslndTAC3$nzsQf!Cfju5&ZMY3u$0_R|vx@cKCu+w8@XID&ZmT=F# zTA|o^wM?wsZpmmkE^+Bqpq#sD_dPpwCc@ZWZQHTtl-nrn9Lqe%eZ|D8%pmP;O#7m0 z-%M*B+$mi0ZnO~9YTO2E0iR*1#>%@mQ1HsmqTNl$fal+@H+H7GHN?HM!)4$UC?DK=G+8Bvq1THICL_IGR>{Pxh%{$!7)RjO1;oX z;$Uax$m>bp?a>B)X}@kpb|zD^S`S1H%dxu?)7iQTH}6MqjTRr6WRlI^1=1uMn$+>; zl325ODr039xsj@6<$8l?o1F!KG0K+Z3v`|M2}VdNjw@RWz1D}np7UDIh^JcGVKcVm zK-4re78yN_3h>$s_5q?KMUqqeuHdJpo<>9{(q7^-K#YEck{R@9<1tJrm;i{J)Hj{4 zQP>B2ohA0Esz`j@OdNy$iZ02)EzpV*8Yke`qvtYNi`Yx&wDp5JroR}pf$K?mXyisI zWVaX&h}pSWl}mKaIch?x1^K;uKU9+{U#zE)3py!-I$o3VYLz5%E|cKTLQUIkmSav; zgL{LyMMfk%+&(j7OO8adhf5lLn-BGG^G|R`0)I=kk(02dIv@Y-MI8|XcSoUd=N-Pp zdxt-TX$F?^Dms=5Z0ssWx#x27eQ|pBlNh>o(uJl@Y%V1>HL7FIhdzSQ)X}K&PdH<6Cixug?)M= zQ!deLzO-76UTRDzO0-C%utXiD1zU~+$qNlEK* z=95}1w#qI&YLmz|0R5%FiP(h=mlJIPm*M@umn?-;gQ1U)s~e|FQ!d%PQ+>ao`7LYS zPDq(iDgSwEBum1<%20kP=%H+p;?76NWIC9wv$$j*&0iN;T(kxfBrW4r&SYLw#uk+P z_R<3%bgg0@cLzc*rGf)$fN~n=(u6c|FW{t+=woCnT#YbSS(YVCQeIY-7?s?y4jon2 z7z6sqz0fMN%or095#dcY0|G2f;505$c-i?@mGdr96{UA{h)O+c`-@z&9;xo)tQuRP zu}Jn#iFdn_0S{-JN3CiE3wEV4x#uFqt~Tyfm6$M>Hyms)8T;;9zUlWwzkc$o@iO9Y zju(r(PMP(?ai=Ag)>qiM-@A63B*N&1TM{hQX@is=D^4)A&B(kfS^YGPqmZuz+af0l z_dH5>5T8Y+gvV#;=s_OtqSXX=hTdWyY=t6brTwI#dVb@fsgnr^&aP8G8?231w6B}_ zg(5DXi{b>M!dGO zFZd84FkNg@v3WyUory%Pt2oZjS5Zf2RozR* zLbHBmp*OSQxN>TjQ~51Y`fwe&<=g&yqO%VpEIkDdlZXAblkwZfmou@i3u%c4l7kZ` zx(?~$C&y=bNwvJeFGUtJjpq3-2Yz~FSFay1#zzk2D4h%IJ~y6vGF0Z!jhXCn3rtCk z$h$&#X*}$ol0PqcL5}h7ZjB@EZJV7W)F2S^q7?YoCb}KA_Ea2QRwv?~IwzL}zXR5{ z(Anr{{4nTAA7c@-)~AmlS!ttYIbFCaI}#Lcj0}~ad2XsahN+`kqQ#eUNQ4RfVP2>F z$oeQ{bm(bh7DGDmyJ~Kn3h6k7TvQ8AZKU*$LZeoW(Fa3oL(1hUB=t}K4_RLw*JRuN zt$>OGiYO={9n#VzVF1$ICBi^zNK1Tw4!uLP8buVQzS;mdrrmY_dM@E z_vaP_;kwQ^j&B`J8yZ>Kp3a>yEY5R1l+F6o!%B${Ve3n7>@|5z0wq@R!*=(ayImvh zp_WNRCLXhkCwDq{HH7+csHHeuTZ7y`j5M0Y)xOHe_U%Fc4Sn*b*pvkpqsNtHUG5yM zUY*g_H*&kuINZcdGJ$BpEzGGm$zE4*Gq0~oi^lIcs{EQrfM)+&fX-dGr5m_^MQS&z z8u)c8RGKrhTgYyE{G6cFf24X@GyfN*fYt7PPcAAR+%#=(6Nk=%(pZSUo=5*()<8`c zdr6@dx`7s`${~0BvPb%=e>b*IEwUL-5k~sQ^5A{&k0t(p0ujCdpenmehLdObyYIK^aK%%FK}&JwIf9 z4+$UiGzMzOl+ZnCzik&!>3i9UFY2?Xx7@BKg~!oFO3o%WJgbZFp}=hb|!P z#~AlHYrZ<@QOnXK+iQVsd{Zk7ZLfdN!hfxChxlp>yy$t(7)+Z>L4H7m*6m=%a)3Aw zU`>d(+?9R<04=cYtM2KrMzSpa_!KhRdc&-mCK6FPCC}S09*2-8lwS~IOP^7Y49V#kH1=2bE60b< zcdRDoUEw-#u1BC6}&vM%|lF+cS9a0i+;I(!Kaa(6UfGWA5` zp<}|uFAfw%x2F_5QaQeW8nIjhX$lF>a*}|Aa&mGC5aeoS-+9^$T{61($Yri)ovR9# z2E*$Dklo|)8mpsWI8+t=W2vF>R|`?W>hr5of{}$8Ud0+*ege17zpa7KwM2QeLGZ93b??!T(I3)_X3G4gdL4qX&G^5=s?`(T^V;gb%mni6mIChY__(_`tONR#SOoiPjtQ^BOm20-68 z4mbN#RTE8f2ietZN&U+3HPSda^p+3e4F=$yb*=S7K1_hn- z`2}BMR9|vafOz*dB^wIP!L$k$0pj5BcKKj3n1tGL?OS6(yGq7ggRpi*M_M`?2|JLCV^EKx+Te`#2>I_KW@5FTqZr&&p4+W6DK1iYZ zw`Yz#veD)3r7EN>OGAjc+4szz^*hI0H78UBK&ldD?@@SEirb(=#kidAyb45!?VkF< zMaJQzR!Y_q%LBj9>?KaHS4GYdXcwcZ9#~J3q4u1P21n=S-=hL zaWtedzy(YB(XVXm8k??m@UBaB-tE|pNALh{)vnAfenXtiJ^ybn#_^+gLC9(9VYhu5 zY<1khz}};A+eMXD+Hc~y;~h>aWSOrB>W0YX>UNT7gWj^&mp#F2-@y)K*D6q6|J=It z@oeGh5^f1NH=@EL_CF}tY8Ys@TGhk5VQwqq&f_h{_?9Mak!{`PH|o&H>3kVZit})!yDXT{nfB&}@FW~<|A(U@2RhJ1xF^4GBr`x({Vm34)^uf8eKBTxR!p1UCk-KiS$VyKM zNpHbYVo(|c(C633gK#q}vWdiEb=dJ!)C)`Uz)L#g8BiT#>8flqu|BTA;#6X*&fS-U zLRJ>Uu{xE$(s;9AkIdB0XV_iOLBj*EoTHOdrl6`Xj44)Z(70X#&+Eb_%IDUs{IG5oUKW$*ixYqj*e4C@{w=N0}l%P>87L#vAozL&yvF znC&#F2L|ig-i>;mJ8#%Bo({uJujo8??b?1yp?0)vdxUb6!un#08}{Z>H@Y~>1--`B z<|#^+9V+n)YY8nJhJpqDC~x|bsOSP@7DK4qP79q5Ydk0N+n!m>nR+Z1{W^I4tGj{r zk`uda%4Ly>PWR|h7sD5XbbmI^#@0$HpK@y;6`Sxkq02yf&DL#GdSxLE`q_@AF5TI- zpvvdHx!+93RSTl0Rs1e<%Iw_SB;Ml2HHFEybx8Tqti!N?kAWA$p#3H2*TJw``q$0w_ z)`>G=KRxQsQjjE@`RAG8;4zwW@f5wx`fLG%ie1iLyw9jIL!rD)yE#SAO`E@Vn(8`l z0wT+@Bbq_g#IUK%;5L{7^Hqjm)M@!9z~#n^GSDvkeH(d~Icx(4Z5;M8?u3N;l{xxJ z*YDOM7RFJl6G8$obj@1ANSR5!<G27S!Nbnq)xQ)!Y92v2>kZvX3XvG;qbOqCL9wn)Z{5%uf#aH?JH)(H2CG$UIS; zHUkGk2iUU#70{}{qeIfy(gD}}?{b`&9Ov#{P<#cTMqa$A@RMLyn<0#z3CBO()>#}X z)<_mMzYa`BsW*Cm6>V4^t>(rKxc;0l_*pwoi!w@i1glp4mdnJqKJPFtzQ+^ z_}H?RFatfu+{||#=JBKDT(X1*G?#V5B&(V%Xn$vow~icPHo)3pTwA&<@9d0r*KSW% zcpqAXEj7Xoh>3{y--rbxTT2aPg~%hu-CT~u zefO)mK-(+rRu_&LRr)%rloOy$VW%lK!k>u;rL4Q-kE2~=Gh2D%_!o-Hk?kf#9x9CwXiw%WeqKh1UJBqR zmBI96_^@DWxvo!N5C)-Hu-w@k6;KNWl)pAS^&BR!7hzN7mc2&HX zM34(uf;@I>T-wE=4%V6-?OmWOadY)DurxQKT>zvRGUEDzx5?FR%cGS2WqQ(&cylr) zvDe)t1!_xGQia=e8~g-r>|a$t!3`|ZZeW%4Q7*h=rdS$Zu(hb(m?uY9z{|{1E^1No z>c9KoD)w0+WB5#!NtQNj8^^ct_MRyu&~B{bvB%)#3D8 z)vw3uFP}nj!Fx)gosaMCX(4l;8EBt@x8-0jPs!#`wu02DwT!(a^&}--DZk)_=acaD zr3f$@v&LqqAYmHW<(HQnrCrwXrJFUAqb$`Y95BVR+s(hPh0gi6GSElSMG zE$-C&Ep9I%C;jR{m{qFc0tdOBu5|N83F;<>#u3pbs0u00|DZx8o*KC|USj-`BHmi3 zZKx(^`8!a6E38aUm`!B_oQ$vMQPvKI|BJ; zWlSG?`ySA2E=CzG)R5kOAg>sBif4X~`$LJpS$xUBMfjZl-C=|^0QW3VkK;seMJPO!)mfN1K%x4l6X ze{9qnt?m2BiquYrF7O@Fk}!Qv!!HZa zqM~ICxVw*6Tc=aHu|Ye-+b)Wx*x6dke>UOjMsMd(zRqUdN|<@|503x_^?eq3$TU>kLt+`vB8iqOPzi zpb@rD0>YYB4{B2mLle4?D|9?yIc^PVk4Hv4INzmwG0uwe7yMxjKseOI0cnHq9Edz5 zj5Ac5?F7UWWpdiIdXB!uy|(^$Jq^4`))>903HfJ6XV*O4(YUlIN2t z)81ePFo8}mXL3Ix=yC9`SW={)i;~*(-orMv!HmBV1-O@@Uq@qB+Sr*XsT0_sfg@uLf3pzTLr0W0KH=I)v6b-o&OaO)MwIMEC~A zU8_nhg}nEdpv_=jTJ*!!xu<}h+}K|(PoU0B9SZ z>ewXq%ecrCY1tVgH&z0`o?MdQ4>9C!FE?IQ{)pU3T@~+oFJrI~=t#LFJE{)WpLCDx3^Xqi(q?{`QSXmolnq#~8*$_~lj&7RT&m?ZBIx3?XnSq7S!xD<;{W$v*5FB(bGUHzc1^{5 zLQ4%epY*kLfJt@($=F@J5jzh6VwRgUW5q$mqr}%umJVKr)mgo<-P}AbMh$Hu)vQ<@!LY=lf8a;1OHLx{KuMAZGOreGPN2f1Y_kv%L%MRRnuUTHGTd|z* zbrp?_VkGVsUM&;zGD#M5DPXWng-j|57q3xroIolcRd#~7Jf&U# zsPRGFa(orEnGs@9LlL&*fr9w6I2i1M&X0R6u-gK?1`3*1l)V#uhxKbsoMAV3g(Z!V zXGV#i!k)ZDBdYd91uj1HEc#-}!p7Q8op61jy7ifXLGr}&>4=Qacct$uA9)fRO1r7N zYAyDwUnDDZwZn#nUK${F!A)8NC8Yt+9zfi?K?BVs!J_>nP1@ft&|$1bfV`5{Ya#nl zRr`|edl&C@v*@^`(8*Ij1Z91PRV%pKO3A(c8kLfym?<}Cz^KwOwufJbKs+I?Z2 zcs8tfk!=3hIU)){LzjI+@o!hs&r`KhxhxI!V!1t)0m>;0kt%-)&ve>5BA&&j4OSSm zdd#PL$a&pTgg6RWk$1&=e{o(MWHEUE%slr3_f$-P(86wIqZA$sUVcUJSc?Q&4Knpt zVevT=T%w2buL&8VxqsV?n|)@@s#uJt0Pw}g`fJb0pBq!YOzy-h_}8BKLZ<2W^QPPZ z+(q#~^C>Q4>-X#X#~e)~?N(*wFHIBB<}@l)t;_sOvULU@iC)zljO#1d(M7@6mfd$& z#w;uci_Ns@QzX3+x$kZ!Tz|g5Wn)nNRD(&CgAL=-FPY$+a!Vig{I_3@szq>f>0;4X zrkg<(H{F^{eb!~QvXxPhq2U@CYG96G3=Pm}52$M!4|3%L9Luh1sFtjiX3rqiuX0be zb%2Z7iq%rJ%4JaTb#Hu_z(Gck1N1zJ@PL<`JgV^}OV8-$@bTM(@YW$rbEuZ*GI z_RTS^b-ZHpV{c3mN)$QXUt6L-{BG2iX_@8vx&7?vg(&ku1i1Yt7m9#mKaX^Gb^k=| zo7g6WF%AT|NdR5=YDP0EHUeayB zG7W!iwQ1w%NI-d!=)GA7>z<^}ZG39 z`Z%+J{cM_H+Vg|AAJU$zR|(^$*@3>&{)?;r%XqB@Sb6HjchIVDUaQ^xVlcdS2EtQ+ zm2fJl!}k85K=&>}Ss^VVo`$=+Ds|h-5>c9}@c%ap1i9-S}RBOE?e=3SP}JhS!m0Av$vV4^90V9i!%j zoA@o?A5L$DgnJRjS!QiDya3@;e~QKz)_CSbaUj&7^neRh`FZ_KR-GDr;>)kQHrg*_ zh%eepR^H1%ABWtOlY0aXBi4&OH2dt7-&~YgA7nY6mYvRVV3)b8!EqE$q*rf>P$eJ| zcU0Zm$uvNNfu}mZh+x*|M8#| zkZ_}1TGnOEu}WPXElpi((&k6iXh@^8rI??vbR5+FOoD7EpNBiwH>u^<<1U79hR}X) zaYvwaPg|%fHA@4yn8mt_>f*s~1-N9I({d@Y3($;>^u#_Z0FNd%g|R&4(!E6g*DwFm?`Y%RQ0MoR z|51Lk)H%f5Kc`?p+F^lLQzNv&%Xy;8Q7qMAaf$dA9xiL5*pqs1KYcQ><>mb||3ETe zp9F$qz@>$Y*2M*9YTOwMyd}SIN~S!h0v;H zwi1|5uwk>s2LFJrogA9bo71t%;b#q<2s&P#0SQh%-9cDa>`E}jHIERG;!LE`PDiV9}ZDvOxF4ILZ(4^6;W(D|;KHkLE-2qbJ$u*Pl zB&+Pvop2tLx<^0{MbodwnLN}h)CGMBue7&KcQu~(<<7VZivvi-%}tOva9(!&KSkCy z!4wcf%3S2Ufj9Qx@e$f?CP;*8@^weXRZ@0P>#_vYUy#Jb9FRh8RG(7nGPGpBIDacB zDZ+4DOx}^Tfcbz%!W};0v)LQ)K;1w+NWN-HcR^`XCo+YvPg!QzqM<7(;KF?FS@M85 zZ`+Fxo(~GIKBPw`4s5jx^#ba3BhuFg#-Z>aF3uRNGs=0&!ER1>(4e zsEEv%6n1q~RVbFj&u!)FfObz!7f;cVTDrK7*Y?Vy*md%ULim$7^li9Cg6`0?8UERP zRlmJFIij@E)QdJL>=LMtZ(vL%J}XrBNB?1jhu@?2F^&Tjyo#%4ESq zfUb48M%Lm#*A+OsScrg=lu+?I8)q}yJa3A19pShz7Gx)^u;KDr_Lgq>Cm!LO1C8q+ zee~y-xSr1~;FQGvLY)WFwqD9mhS^+i7CFg{G=z91eNI|i#p}t%D|?&ft|KeBP3OGPv|9Q zD8c0I8R6#2L~>rqdF#HkMNX#j5%&r3d5Yc*J8Z^dmJD_~>9GJ2$8YxHdhTSIW&xTO z!+;S`dS{@~=>SxGI8C_Ss%Po-R;o?1z>#?ha&ypjO(jY4)$mH#h(Yo4F>byaGo4_% z1j_rK4UJvAua?=tXErGYFK9A({e=sM4T(@RLdDeo$gO+#sOg5+`TOUz@SuJ_m3}^d z8uE@lTl(tx+c!$e2#UDn_NPvE$NFbS^ib6P9$E#ejasxvgG{K5Lzyhs2N4$kXcw6~ zxC7Kw>dW}=?*8$nq61-G*kACqc5x}v544?JEYH@sGvlr{wprP1z52KH(*77fO$oY0 zdyQkw$J%K`vD=SkuvQ)oA^nn6GjTM%;43!Ou( z-HCGP%7LZDBdzXkYR1)C?eJgQtG*S#ryc%G3(kDId@5W=P9%O*-QjcTgf+QVG_i|Sj+XOdpphnzZv?J(TQOaUMJ|I*)jO5rZ3fF;nC)?>(K0xG zQ=!Q#wq%mDdFc7#I}SR6L^)lsy2fgBPO^|tYU+qs&gudJ1%w7}_WZbAD+Bvz=x|h4 z4qF+m_i$|IW4ZD!mXJ+3i5{TxRrcLH_33)qT2((6eUjrr`SA!)L&|1EjOw<5z%~_w zT}GuMN)1HY!zrgzAkp}^Lv*^L3%Vpklpn9WHn(5UzUxcK(jn%ywV+|pb!uS@_06tMy{u>%ZVs<`4RP8=d5YPi)tAk7OSd+5Md$=BcUlKH z|7?jrABaO9Y|1>rb@+Gd5-^hL1yojULF}FDp2t2nLMlY(9&Ep^yAlNe}5*Ir~0zz zD9DH5h(N*R`40j3m9`@sXwvFN^H0GFQM8hIU|6@@K__)xO6ekKtL1|8G4&os(2DdG znRa-~3$${WyHP|*R>A$SNQtKd!rFP@wlerqV81M(P-5r_%vr%(dGJzZlG$TWyS(YL z!Xh12SB=~ATAqYaa2rRIR90$c_-rT)S%8(sGE$l?R0b;Go69KW-D-5CL6lyt8j=Ue z;q~pQa4(pj(#Z!!g1spGiE8MU$Ar11>jIFYU{YcP(mP zr24Y_I=-lEjWb1daB+XZ)wg~Xfet73(_MW^Q$-veP-h}O^r0(2_KXJRY zT+>thzVovKvatbC;*xzuL0>X13$M@$Z9&WV_Gp_QBHvs#R*!;mc8S;EID<(Bx&r9i8dAufHZ`|zQ|#U$-x;3fZ5Bb3cwrs$~4m}sC5J*QZD0F?SbfY2~y zYfqJ_H76^fF|5Oey-X$gEbHSv*_r)Tg*(n<_SM|+>Dn)Jukx@rFKzb&9e;JY9V82F zSl@ed$*o7Xec2Gjy@)CMM1SNJAB=m&gmL2TY;X0VG~Vn0%jg{h(Wp??RK6mVW1tzJ z!3e@al~k)?53Pwb3ywjL<5Z5xH%Z&wNy~tGM3UlD*y}tzfEsu?>a=1WoP`*BX zalR9wJu&2#UD>R7RxXH$jUWRV+r+l$p$>zhs^j!fwrFQ6`E z2H81Wrg???PNI;vCI0YBo*a~h5J|UKg)iLrz2mlRJ-|?i-Wcb)EJE3${V+|$F#~O$ zM4K2Vq(d_Tcff|lKF(_|_StSB;w1?E2(Prdr5zx0P4*m*i8PeIa4*6U__lBse6M2K zAV4H#g>QH*vMoPJn)h{f)}8^aR_Us75QDny1&&Nf?66kCyzQ{2({;O^A;xB}XE#v@ z%jV9~87&rr!eyfZ0>uc4o^{mxn$R`mD9Lh~W`N;j6*ilaKvCLSb_>{DI%RC&{GgFP zw#@yT7b(+(ON`nf|FFyOJ?hk3^-B+Qu`hs}Vs~pnKF@6NL⋙{C^G^QGl0yC!YRt zAK00@6kEkGeMTq5RSTmXDGCF2osa-cgN5x3-sZzfJ+89IW;@jREBt zC$jJu5?j`LlK!7=b9}}D>l@16&?gc1FYB1QEe*p4D=g$i7z9OG0pbhvw}D&E-|8rL zfp<898+jD>j@ij13@BDzSvG=M)R&&Gj+y{k8v>FMGH3~ZwcH66n#(`gZ$G6^kaZer z`I3#Q2UkA}u&djyaA@!tRDSOGdQ%RF=Z$7YjT~zxg1;4C@#P(HtFZ2;oityl&07;n z;Tv9QWKF;Fc9-_yWxcze#XqY&6uK#DD}qEQZ-?b8I8|IHzoFoyF;Ek0s)b-96CY`F zlv^@ALT1c>QniJGOw1=iK=4oh4kSVJ>TUM-2`}Io-2d)DeXR9Os!>EKhea7+k~{=u zYl1RT5_9EKWS5=(omZ{DB?2U22fR)hrkFtuWWcZk_mD>EwFK_Llquyj#2)wuRm@gGAM68pq(ty6v%#X|j|gg!E+8tQ zLGw$<$RdHq!_W$U6DavUrA78ay>%mS1q05mr02A}jWdq%AspR|Tn~&K%#i$}l>i)( zqr8E+6lZ9L^e}7ma?5f-s%1*$FsgtHa^f=6#`KnWF$#Z{InF0?HAevZ90LSQ?uxVN`^7qKRY16;C)!3t>QuaMXqedX(q1=3<)C+>@0?S- z6>b%X0T~hO_`R=7)|@orZjb6miv|)-d97v$+QbMtj1Oy%yVNxq_y#-29JSmn6g=Pi zsst~0GRIDTk`sIH1$}F|df8FQYdC)i1wj{m6{(8JAFaWTNwhi>uS~7J8;i_p6k_^# zQO%DTV6jg2b_d((8}a2*tSN(sdysyrb~fZM)6L}m?v9K;wZ{%p8VBv(_CSCTI#${0vcn+( zDoM4i{yU#L_s?qU=yU>snQT?30pz=L_iE$Lw^)%$pCPyNrP&WcLZL?)*Y~v5jo&@K zmn%y9{QFt6WHRi8_LxRhP9wNV3MPaOGPVRqEr|33}B5u zVX>Xhurw-?YJpv@fRcy?kgqU(PD^apM}^u^P96uXR(sB~U*M9GlUr0bw-KveJPYn0 zVQ3Mf2!-h{J2BuN@uu1aogHMX5<;@H;5{I@Gr=S)E1NMs7^w3=)5Zfplm%{|e40xq z1NxG?Qn6u~c5mm;qP5>U&xWp>X7M+q+K1QqwMWr8cC2;gkb&ZSS<+;3D-A`Q1Vb(4 z={u5FN~QgpiB%I8FZ@}*CdGuGn~4L*#e8<(Ir)0Tti`UDL`yyUF7qI5%b5fjrWT|s znHZO!TB}ZJ*uOkAHD%ZPx8K5^$B0T2{|KRUo4D3N8L+YL=&xq#UGwA3&-0)DD!`MR z7XCnr{oZvW<;0XcC!$9TA{YbOSexGw#WL$!r&ewdBgBF$wLu1+1tAFgti5%q9bAbv zjK8+#%sMl!ku<+k)Iz!91A*z8fB=(_E)c|(fX`%3_^;TG0YRUYm6a`o^&p*DIaqB{ zOh$%aWeGgk7?|PnV~(ehxjs%BSHrI>_Tb!YNZC|qmtSX2 zgHTvpD6~t`-e%DDPThGyge6yshVrc3(U8&rHkZ->n;5AkaJHB^x7pR0!?DHzE&T4q zG7BrYg{x1OVOS_D$C=t*AM4S?u0oFWr>ULxA%4l8luAby@ikqwbtI*I>7gPDZ{#cn zumEYIo}R#_z8!G1zqh=oAA@3nl%9;{#Kf2;x;iYqcfDNYV1I9HxV(HmKEt~1{8mbi z-Tia?NA=E{a^O!VFBR8Rot8ZdoEESusNC(s^+h+{bSKf)&gE?a*W<0TL`PcXPMz4i z`Lrh9MWKoEyd>@w?07Elg5=M~HCH^ROL;=FI9TAlFP_Kt4U|4RP;wrlTk zxi|^eaVtmh@xV5lCHk$(2i)gKUw?R)kvrRzoq2iq{J#^eL+y7Mz}w$p(vKJ!fv9+9;eWGK+@zaN!Fm6wLGyJdZIocnm zDQfh|Dn0nzMG|pnbZcyH_@M# zL4@x-kFm|eU62ji{mbE_#)K^>PyHwf$-^ z{_j)^pwhc-PAYvWDzjlF)&6Z)fBhWfrP@TM{U;>k56UG2GFE;^Mw`9}^5w#Ve0^wh z8p9j#{;wO{$%OB7d_RF7VxMldCrE2A{6z&29x{+Ed@Zi>v6-4?Ks?eq-Ow}m0aije7aINGdVZ?&| zIapwR1jqfWX0fym2cQ41(-i?OB?}25f>Vv|-`|8@87$1|h z?%nriBv$9qHMyuRaZm!D<_Qg$RsOeTo4{!!#l-;clCx5&r;H*^xD@dGg~rIeQ8fBXW!e^Sy5;K4d2ox9rk z$JeL)=s%f>wW^>I#)Unf->1~-a`wG+laAnt+T)Li$?m?~@^&dzJn+px!on9?WY^Ir zso3<7*Mv?NCneJ#_1&E(KQ+f0EGmZhPCs+{fb>Bl5#G7b0cte zGCF0PO0V686!%Ta2|_Q0&92*=aJ2@tnwB`xY8j4DX8`T`Gfq zDDwx-kIpN<4C;LdY5t0F-Ed-DXcys4JR6pG(+jMg?&xbatFe6me>`NmW4HT>KkuOE zkXn@KG`{%5pLl$#--*yScP#z}<-R|eq7)P=jA`dxT5`&L`@p7>Hf*~%l=HU=Ife+bp=jndPBurAuPKyNm%r7MH zjwG%msA2YR{JcB|PWC_ReIw;X>e{WPGYsl;*!$+cPT$F&%{)qmJKC-u0Lc(QgKq}~ z1?99@@;hZe0tTT%GW{%gsmh~~S=&NC=MC(fN?888FXtes0~g4DpLW&9;Ix}(o_4*w z)Dm=QuW!=VY_8voKFV*McXrwABoq|Zg6RyR+co|tXFXS_Cu2l_Qi1OH``T>4!CF;m zEQy6Pjo^hpKZrdc2xY{jquyE49On^+6B2+d^4~KrrpYIJk>&!p@bL!($5vg^k4olB z1%@Rs{~W&DxcE^p@PYCHF6j?JoGkiZ*9WLtSa649GWqRzFDa{RVy1(<$_H8D{hswt z2cGOr<(f58eA(>Ih&2kH-~x`381I5fHpid7-OpF^ZzOhp2oTx3eE9w2184Mm1-YZk ztLW~S)_z6c{xYuFK}Gp$Wq8?stEsc=)>8zy>&(J{1%H8k+WLu!xJN>w9*@ZJq^)w9 z`1Id9ROZqj$xn-Bkj&gg`{#wm32Ua&dor(acoPwx$CV5gi~Y#{unPW1r!VmEkJKm7 ze|z|Ub~KnqQUUD19};==lvEtDFdv3Gxz){NgU$`YZJe@%W8$yge(>?8A`{UKNj5XD zEj!e>;l>0WrIb$+gSu*?ckl|@|HE@`cHRBe>L!`R8cEIoew{Am(0E;oK|h_k!{eQk zdq8o(X+7z!*0kqO7wdNf-ICy1`i++SpM=X_3g7)rk3_&!lC1u5ZCqH=_XwGOci)+Q z$Ag7=562oYs?%%22bYG-E71GjZz#Zrjg&e-lZ}y%Un4l)lfU-a)!Wl9moo3}mH8|U zWePp)?2KjY@;{pQe*{7ds32KAc`~&&Lsqr^qxSgYsOD|R-nd>f7g)VdSkw(86qYYs z6`K~Yd-!L7#v-@|l2yk+63Pn0v$+<9y|E=aE42>~K|l|PVdho!G8T__?R!&khw$`? z=YXG*l0?t&zjKu7NpJkVIPSCCj4^H+Jx7J$g3&}eZq`g6*EVLmHxAg2AJb_0 z&V~Y=s{GFemyMb|pS4C8%_jHKr*mzaYt6hYEG&b$Mj`;8j-p1p*fm=2frz`=D=wJ{ zfaxX1%2dvNPlmMyzE$93K!!kRJ;r^8c-syG>56Wy3`Eg&d_i%Tk z>qfXkb*7hXMnlECN??0$;Q3C_H0FUMF_NX?t@l2AM1y$>K@-3 z>wgbK`*55bg`L!n9)DpF=?=Wo7o(bg3o?$;nguj;yvuwa$saJCIol~t! zvj8U=thNzg(weuHKClT)HW;u^QcB}hhB_)N8l&v#8Iim)1>Qw72MiS-;^8vuVeoV!JpYeT`?#SYF(Q{N%y#}9o$L5i&pWl!m_)en0^q|>) z*MBlr`e>-1>g2fB(T~mlAbrhXTgd0Dy6485$wy#BdW6Mgn&(DsY7IlX^=%ahpZscI zrFSQCBo{rIb388R(%(&kNc&?G{TU|r=R}ClswoxAz{*eN{f}Czk9V35kQ;mbCwn!h z43qbdXpc5f5&n}-?aX^4Cx^(l+(U{$c&ru6sxlKPQPBA#S6=ym#&`Kq@8>760Dhcb9gb>;|JbiUm!kGpu%hvD(g(HD0tj6ZPL3EU zEcn`Y<`2pnjr}L~_pRxUt68Rlh~_#=k&*Uas<*|g`>eSr-4-VdD5NCRK*mi5cOk74 z?j|A(0^)fvKE^0wy*FuNU_My=yfPEmvz&O+rt7zA)v@w=?asKOCg2@mwe2@KaFb1j zjL@w9y`|}+KmARTKOYam{+yF8KR8XD`?GcFqZ@Jch{sQ=hZ$;kvp5MMlbl!>2}fb+ zbEo8L2k&&B)$(SB&3WECN!Xeqh%9 z`QmiMC$Qpq{MS2fL^PMY+g(063SzJ_1d{QSHMy)bX~!}y{dZr!XL6O7nXvfoZ#8YN zVd^KN>wjiAtxh)Yjqp-io+#f+qzl++IoEqv9HVIopOin^ZMZXv-QMV$4dyD5J!tTl z!%t|js#G(H;?(657`=549DOoPxE?my;Y!?0x0iX^-o5WVL9rWEBho!lANdtQY2Z%K zB)IOh__f$&Ws31%zd9xRr%YT=kK?U^DiomBMKl)JWVjOrzJG1`&K;I#-Gn9E4 zrrc;3%1l67HAZ3>vdgSC_OkQ^g5HZvuwl%`^0V4rN1}2sN<36 zD%RiTI}=9fUtMng9sPufwO5QwKNiI;M0cF3X-KI)D(XIa|)-gwd>gc5CO%s=pX-eWd< z^0QICrR6^4hdf<(UZ;e@VPe_Y*26;|kR6)k61H|y@9|FA*DJI;kZtGqWikDHDe~JQaSBHm zq?^J9U7Tp@TiLCX4*3zX7XMYwILI7K9u%^+ZY@zyFb!}%oQ~=$dV58*AH9urUrcnZ z+Uy@HRDBC_RSsTCWhNh2Px$U+DiO;C85Q0YQaMN&ANP@68YC;psS|PT!%blCVbAh- zF&IntbmYQKMxQM6K8cXxQm$V==0q&pv$=I?87;t!O?;wi#|Z;ySbh5ka!sngBee;% zKBUiIj@*C#jkL!z$ML_$8-6eX@7i^B@YU{nXR|byrU!cW*cfD&;>9DgF78rg8UL!V zm~Ao-jD0D5-cdrgl@(7$3gDs+z`l;x)~^>do;E;WcuJ z`{B+yTV_|$h4!ardL_!mq&apkD&AMTe2FIpWRet-TG?F?7^mW^YhilzTY@qMUK7p7 z`y~{+cl{1u(MY8+lsD|Bz$f1g7?>GwniM-0bAP@-yz9$pkFAmP_KP!ZEcbBNXgK#i z<80R;!>1<~P)@bm^R~wO<53h%Y?!j2O9Q1@_p6RB5WALLFXl0Abgr$2VifHPUFph7 z9#VK{kHfxJZq<~n7TYP6a~S$G$2URS1cvhFYfv3~n|p?dKYskE+$qeo{DtwaeQYX8 zb(f6^>>^h3JGL+QMRvkjsi;j*d6jVyFFem>sHNW?^DOLFv3^ z>QU{_A#RKxXXaaDaDKwMesk+2zckLOmxmlRa&@g?GitmzzS*&np^|l#i2L?pousRQ z?><@9U5}q>J{z5k8YL>l+!fst+Pm)>&dkQNW$u321fALE+4*>CIC z@7IYGJ!!C=<*$Xi*&)-qh(1x68D}^yN^w$0FE{AA^Gt$gK>(+JJbWfU+3a>ji|@yq zE1c2s=?t5?(iUcCuM;o+H4te=Kox0KS` zuU~H>(;7(B>&|OqD8nvA_|=-14j1cmrw@r;0K-M^fSKruLuw58GBSDrDhH!oQ>%0f z;#O(I|L7lPTMl(#(A#n4m3~my$%!d>(60}sTJp2;wPrpBe`_FCM{Lq=5 zS0;FI`46IP$7%gnuGX?P)qielQ>?MQ>fBxG?;6Z(f*-du0ZeDzn%G_r)a^A=~_3TY=+C zNnjE{0*g{&rj`#k&$<0p zU|NYLk5S#DDz_bVbjqarfl1%c2x29(d{>#LZXxIYQTEnhRc+lHsBA$=MU<8XL0UkR z-l&8iDItwVkdp2OQ4ElfQc${Ey1}MFxrp_%7C!%>)thfZIz%1|)vsBu1 z{}LX;AsuG6r7F?i&2;_4??&6*12G%;Y-6sD>*z6di7eHEIgj^b*Vi`!_eTbmj&n8c z|CYGEcUAM{%>o^PSC?+h?uHS zzx)O(E9VLK=ta|63l7uREJzFB;-mCJ` z&VBIcQSIj7T2o+94_`yphT-h`aF3im;hSHPk&)+hU7xx8Rp-a>D|c;vlRJ!2eJ%d9 z5|rL1rM=#YzJaQ0;T{yAoqm3F<>1cEL@Zjt8)pjma#I2@!a6VHJ_Q8$p}I1p&x?6x zZQ4Y{BC;fapUP_8!uI55ebsYioNzTQqGsfK!m(RwwX zs1p-dD#u0DmnuCTe*DII@Vm0HZ7j~DeyTI+_pdYCjfb_P1&ybyDSHl%9&7Df^>;{= z*~-v+9^Iz~IC_KBXSvz}&%3+Hx2G9`t`*$U^Qp4yKiJ=rc|4-Dhd3&gckcXS*0D&L zs&f|6A&jBbzjJ;}`mf43ZO_J8`M#2HS7r45<*4^(QmsrT&Un9%k5Cmc+BbN?XqUWr z_nM=hAp~zDF!+f*lTzgiw2oVFyTN|wNBNHqAjtWsG_UZu9S!P+7Zw9Q)i2>h_dAdJ z7w6*&YLfQdx~~TQr3TPP0-FfQlSxBMC%u1OMC%E!Z&9AyH_kuF5MBOo%lFVdyf4>C zd7x)LLNs9JI}>rmzEsK5Z8O%TWCwKxAE~%$#AJ=Jryy#qbAhuJN{cIVy$i_ zacjKSHL;Dws~q!t%b@P%+V#{f61wT>%(Z)eEU2|?`KFdW9m8NYT2Yi?vd+g*Sp99i ztt@%*l0*aFPuD?hm3lJu++%HYc_X6IHGcafbDM7*@5~mR40Ex$@#+B>fm^ao*?6sG zE}yC1wLEDoGQ3A%4{{wzAi7_sL*>5_7^$2t3UkFH(VCBBl;V`Vhb%vkQsVTc~em6!LuPJ!&08nao@NG{d?y z|44$qoI~^edvnjlc{`OPxPR-Y$L6k!s-O;+w9qaepJsI0rf!m|=N@E2=VD{e*>Vb_ zxN<&sy*vfu@lEdSseJuW;nx)wJ7?m48UuADl@p_m*1HfIXWpksvD@kfH7xh5t zmD}&aA_jrAHM;&GDvF2qW`_zGW806)ClGzdkCG=-kDq-=Q9H&N+RKPyvh%y@cGl@Z zoEXSPpeae2%^A*0_l8SD=G`(l5u(v*8a=|%MNcZ868#Xdr&DhNcJ}I$lc(-4^;zWI zzI~gq@-qR}%+kmO9LdnQ`|h(ixb9k7Nq+IHZ1T_eQ!*<6=O`>-T+&zlY%Af=&uHiO z^388`CHEuqbois%^eY=osr>dgb)hBS;A}PZ-Pk|IhX>c!|5UvZ`sag5`Erx?A3oP@ zit2Q$UWyb6?cUZdnJE2o>lOh0W|;JJbQWaE7_8^GeD5~4xx~hH^KQGxKy`+*qs8e@ zGUt4E*qdDkC$oLe7v5CZUJG*PU}gPw-(fOUj;RGYtImGWWO=K==%)xx#aR3Eblt<= zf~ytn5>+SZUO`3YLPlCMU_3DxLf_sc5K%dC5Psv;uid9ng@d)HOoQN&c zIR&;X=B3$L!aw|LJ&OxYA`)#|!IpR+k=?S%ep+Rri&CnuX@FY zlZb?*KQSZkb91ANGQVG@;cu!5@DE%r2~r_~!HAmgN{RyxGy*`G1@P|rbhwQ5VWFSE zYPL>6JaoQP<*%Nh0Pgk^5$it1)U>qnaRx+a;6;Kp;GCp&MI>wv^PzKY^^NiYgP3yj zJ>WLyGmPs)#{1UyL@3kSTUy{t-jzRMyJ$1;tM1gL!pp#fzdSK^K6bbez<=>d&tM`ylx9CPp zFxeg7mC>kUeTH+hvtqjSq#sVMeDuxrRva(dTq-pR;dK5~4F-)5ul{H>VB-zaePiDq zryHnAqj~m{ATvEQmi4pA4di|>e@CUTqzH+5>U1w9AHi8F!Po$aE{3y|8+C7Q2`gO0 zNO~gS%*;&lNtr!n6Tj^YUZa}6C}kc=UEkQrA`_W~k@CDU%P*|SNk&Vegmj1!Coir; zD_Pfwe!>Mwdf^3z;SsFTo5YJ9-)sV$-hK|V&3#0sO1yaa`&c}Rn43N&npn!!8z zI>^OnzbBr}LJRX|b0Qj$&jfFIo=c)N{HGrsLE({KPTUBotFpE};+0B*9HwvJ7hg`L z@x{&Y#sJ~J?%+DA;TTtMPo=ed%ad_F`;SL3f6>m7O!XNsUs*l}+w&z(v#kMV{E-H8 zNz%UT=gysD-v2^`)dPuyX7e+rl7Hd1Th3D?i;RS-hvzj7DKN!tP3%sgq7V6fObQ!n zNN!;kDS8^>oafX^_uSZo#*#^XwC<=*4F6HWZEBPDRM$9TgbrEZ5dxf?k~4i&=og3h)j%(#jb2B3U;7_yB$XF5{FS?>h}^Y5h;t=R{zVbiw#Ogw z`Ze4B@iFdNx7G7s1`o$2Ze>bK$&FgSg1NY`FQ?VJ{`|!P7=zMYzBn056}XNs`a>nE z%gqO$9Nulp6-Yly7H!wzO`Ch}sVs7Kpc$u#!B!T^)FVM0;dh>5-(5FPX!>%W>J_h4 z{LGA*MxLg;oZNzhx;{kE$g4=ec`{C>U7$ck%g2*hJ5pYDm`Y~nm}FH5XXtG(T>Ta@ zYu}p`n_#zd^y_syO5|5EVMVs$FmE|f6Q$g+jc(Yp;^Rj)BL%-kbm{#5$mHGZc&=l( z9lOti4iKt3_yutgA#-wg6NF&ghkNrf=G*JDJ0jW6JkYf@!fw1~VT`*2(Hx++6VdVm zj>{jg9;}qmokY2So);Tev>Qog=BX6{grSwANq}gBBX|jr?kU?QYg#+?M`fyG)7gAg zKxPUFv1pW%<$~H~R_xfwv`>G;1z2bY0-=(ygWt0HX4OpTV%)q=d-_`Ja&oLtJbG@T z&IKc!$F|elF;9+!{sC=J0^kr9?(IH{01S~H#^Cjm8gYKaEcBLI(`)Mav0>9o>5BW* zEDGJ=jvsrL81`3?uOip@<9Kapdd)Paj&%2$L+fP*yhg%y!wY(<2VU<40Jn#HZUMSr z(RKD~!_B(-S4&t;g>HI>qLgxXAWfJjqe}D(4u&s!p)&<}->A=w-t8irpFezPMtVL2 z%JqUu$C;4Gyh}J@J~bc8h#Yb)$&az>o4_Kn@H$4BhzupkxZ4q*$wYD#Yi=sw z+TZC4AMHPt?2_>GG)^vbeT>-%Gz1QthrVT1^dw&D~n`6GJ# z%@8*!PcI zSN#!&$TmF9kFvR?B@&u#DBiuBX|hY?G7asEgiK+|X@TmO+0`kFaUsz)z}RgeMbDFRS66R$8*h%b3s z-N0RDt?8%}w94$_|Ml$$cq7*V%0BxoL?9L_n=Q!XKWKAjTsE`K@#M)9A?rS_iuK>G z!gw&7#C@u{S-kM|DZMmt1CNAlI~KIn+;Ey3_B#CFfaMx*bXcC^;!CbL9sgX24u*T8 zo4QeIn@P6cceqaA^gN0)BGUC&<;fn_wteOf4VB30!Bp1s+!QeDFnaI)6=+J=)IlkQ ze1IFJ2hfqt-`*$iqi-NqfiZXcJvlcyb99R)2=<|Kg)vNn;4<;~`HN~n%9V+GqEeG(N|P;P}GVPkyitB0VK&%XE4_l z`D4s;W$N;yd9pD+jO+$dH#av&0Hk@RU>X|ZUxz+l9Fme_1=4V!90)-(Jw3h3wIPes zb$LWP(c>Et_^unjG&>RDgezhQXG&Eq2A5(WG_?3J{` zET-0hKkA~^eHPhoh6jEFWxRt5XIG8NejGo*#Km?E^SmQ?l?2>gj=f(Lhw)m+#?CI+ zzWG93I5g`v{|W#kuwW3Kjrp!ED_7QsZy9Y$ZMh3%j!gt#v zDr`q}+~_cgOE^heSS4%8IopC`vE6x(MjhlOzVPFaHUR@<0gm#f*!t5XDUJ5+Obx7I^w&34H z(p08b0uj3kx5TBW4qDX-xh`tu=$GfJ*+Q*Q7insBliu7YUnfQDYkPOM`uJ$3EJhB! ziHD@o+Y`G?EhNJ8)}=CT?TXbKVS$--rwP^LokqCmuu`aun4AwHLI5B-=kTWw&-3DP zb-<>A0<0$B66(E|6gQd8#h-JUg*bl+FN7#Py>L)Intbv))RoGMD(t)>CI)~u`pBh6UexaMZMkzeyOGfGa4^kzLDKHqSc7~(?@L$$fL;}ii-31|nd z33g4a_ra^x{F3>4q}!&BlI2Z=gtnbU?S?H!`WGeGhW(R6fro#OXD!Y~zKw%=LpIdb z{>U-Ry$A>h!I+4w4KSBTHWtn7fD#iE6S~_@)6(AFS8$UuUhD0(dYKTD8kd~9z4f-5 z{v0}`8#kgg(&Ve_x|3}-L=aDd*;E**l-PbC`sp~^aCzS6Q6VZJB9-;?=P!3Jmy|l2 z4K-gV@g5APpg+ymB_pBDvm5DnnuASPS-;$lrKt1uc@2%oyEI`sX+?Og1Wf*g<-+$I zo~L{^tb15FAyY={)qMt{0pv*D668}Pw|7XTUH>dUc(Lm8EQ_gKAXAB3b1nURf;YJq zloevBXYe`6Ug^)3<#eHJ-?a8L$ymYy^2j~GzVi^ubh z9zSWdAsf(hrjkPrV+n??HF4u9m4fYx8hv_O|CZ_Jl#X>MVDU*_LA*H~@~Zlc`kq3K zSCql;Xt1kCH!0wmAeUv$5mj{-Ild_r-e&bSbizQoan>xjfR=$7p3EsJiOZK~?eG-B z&PD>CqHDZ&TwJZ7X*f%bsj_pH9dluT<5nye;G{C5@98yCntK2F^-CPBGuOl8tTy_3 zh0T8UXz|?=TWE274tHK6SXS!M5p(tJ1kX>rz>Gq^NHFDH4YdiYi~K zfKbzOxqQ%N>HTDi+Bk6r3+9)532(827LLt1FM7KAi?LUniEr3jd;M1?6Qw`TE5RE`4T&8B8oW5B)CtGLrsf$!p3K*f8Sqn-Z~`WYQ(_uFlZsb#ckQ8Aj`6kjdLNzV2H+ zwwwgD5>KziNe=Utb&ArlTvw8Xvx6F5TZ=4?uM7JcD$SP$OT=vp?oE`axUKHI`LNxx zZx?a>G*eV)=ncI(v+CdBBgYIGt_F|sy$>Fv@2h?M|8+#SN^M@|ANb{b9(2Tm%^+6{ zl-B(fWn5rKXcqSilL`ajK8CC|SDQ+Ytz_(E&)E!WF+V=;=c%lbp!Zq?xXx6piGKf} zNd>=es)@IGC~RHcoT0qw-5`4B6R8z+z(Zey*;NA2MXYA?qVJB&LU&4#-SQXA%?Xeq z81r=Oe7!|_oL2<=#5S>Q4|Oc9Wap`-Xwpk+KD7>h&IFf$P_Xx~9%zOHxcOL>W6bNh z-&;^uRHcP^Q={|FtXL5;C%SbGJzQ&F0y&e`T*?r$!4;_zkDo%rb+a~nH*)TWS(mru zeG^x@Qp6Y^G~(y|g~GK{)Pk_&X4Z+3-;?{h`){ks{=}D+ulL8=c5Y~)OP$AJo=5*W zZky3|P`P)V#Fl@@OjdnW5H9&ewxb(IBLx%}Z99S11|Z@3*{E=EDI$=TVt z?8=?AC4vf5FHDqQoDO-i<7OWopQ?EVEN#0eWO!QTZ*Ch!0yJd6_+GvY8<+N#>T7*z zP1#ypENGJO%?q;*dJ@23v(5@>Q;6m?>wnbor2f@b>eg)mYH%FWhknWai8s|`=)TSi%36n=inXo%e zjle%fk|@4OT)%ZI`$2H9(!U%45_?qim?~z0Uc^Y>_Y#M%SB&CGb^fTYl79!aoB_iQ zYF=~`V%8#stfjrPGg5kRYw)gPZ?HDr%MSkW9n1Y}+xKaytVfYuf>?oD2DdY&Hi4%9 z4g~M{z8CtFOp-rbenZE)5${!iYc;5D|w3K|W&_Js$rUuGgLLv}q`_Tb{f`3L!pQ&m?lTdh0+e05|J7tdgw2xq)Jd=SPiOJQ075zGm%r_M?#omH9b^mpTrp#<6TIs7Djim)!fz6C_dv9 zR+Nb$E%;IfE%qz$k=fF~@_K8Xzv6sV7^Ui+@97F((W6vwn9E1-a|xk z{N>?#e)6OcK39-5!5L7Yh{V|>5 zaJ&{^nK7+@X?_j+Js$j1HW=Yfa3(+=f*wYB6^&iSDb}Xy{&&}5LP}&`pO(>%4v&@e z&kv^|^N^|REpi{@jhWyn<8$>>O<42TyH~9JhALQ{dDTdbf$dj@A3;aVi!B16^B@u; z6c>TW?{-SDDKyasGCUG(dz3Kw3+L^EL+m~8one$#g>#58k48e2Pp|2r2{|7Ak8{QD ztH!iaUS)Rg6M?P{4N$LD{+6_|1O$wb`--6&|M{&k1!{CacU z&OXOTC!l9s-TbGmCahC}$9QLVfEB%9e|rQQ7af62CZW2MJ?thYsusLG3Ho_&Tv;3M zue*0{YQG1UY9gdjgQU*Sxd%@XHCIcVo{`bA(WP7WKC@Qz?FoiLgG$vt;ul_L-!g_U z-bp4yjvMlzW@Ze7#EWgi8h3W+p@XY^O9YF1TQSR4th(zZ-UX|Gl2qxVQUy>H z<5Ts=9u>1XFFN44H`FO4PYt=>3*Yk|zxQ7+!oPa1$f@Nc-_Z#H28@>npYRj^-zmjh z{{NFww5=1%!1x&XNOTq#9eu{A)xIw~66VDlBC?*T@!C?7}| zUsA{9GdYK>q~9*!WLR^+I-&ueE2K#KDvwXi%;;G_6i0n!V~kCd znx1`VkwxJ6ixq^oRc#*oaYOpdLwK$K__)Vvx$k{wJx*8AaGTbro8Ux}ICD{^6!kB0 zE<}p56-{pyDP-I(n7Vi8Q#&pZ7jOY$&y}g{7xQGFUWw%**^hj-WQ%|jFdzuio5+!q z?A!5o(B`@onm{BQv~iP;0ONCfB#i}g|BytB3z3}8nKG@)hcSo&WFz&T&kJ1%40=>1 zPA_`T@{iYfa(Fv(#DupvFyV1R$;=0j+8Yeh*O<9bpPj;+f5g1?#pB~TnspPZIWbKp zMc$hHgD;>KB6UcmxP! zx=9`})}9llX$cQf5NYzGf;9p<>Eu&ljblrf0o)YIAfW@ndzLa01kG`N`#TFgRL?M< zIi%Jkgx7k}%4YV<=X2Nd2KZ*iD~)+BL^a&|YV?KgXIAZM+<2`Yuk+{{dQz#u?yGI^ zA<&^((UaQ0aIu#+WbwzHzwzReI}pyy&bJ6Fe}0Qeoa>vuQ|Y?izZODj#D-0D!v~n+ zYibVKFmQZue-0=KA~G_{^3jD=gT&xH9mQeD8hzb}Yf|ii{uyv11TZB!$Wz~dp5M#L z!ksoj442u_Ic*}C?F|S}Ma2@SbB9m(MsaX*>Vi|Keg88+DSnpc$`10?m6kfEcWv%- z2$clqA4tk&Evz-rf;FhFwkYcaug1&dK~fPrdcndp9;;58lyPQs;0KSBx0sw^Fcc#C zx;AfW%G2X2BT6Ka{r;j{SP6j@!i91^ew-3d$&MByaEC-Qv$Iw_qAQb)CUL6w8IsFJ zJX~I$p~GYe2;-58*ns;LAH!;a&K&9mZV7O6vrJ{BgQeFZAPc^KpOR(&RPtDzc>*cZ z&tjNUCp*_D$WAOW0qpS&(ka8b#E752KqzD=OT-kG+ZpY7H1+R!8zv7>?oge-{ z>Mw!Gkwq$o0;F!tT5+;iuLRwV0PfnEl6faIcVAb|DK8E1?LV!t8Dyk&+3FUmB;B(4 zJS(CaAVjl>$)6*_rS#WfV|Wyxjh|?6kUsND$~NY!AS|W$1={SIil>NUJQmM^Sy__- zE^gIH#MUoh^6&|D)g);nahLDpS~Ji_PFd-xbgeH%GU=jLj~H^tXz_ZFbA?p)=?H6j zk=XlpXvW$3mSyS|++v61!NKCE0yiS{nvWl@Es z9Phzyl@f~-j2f;i{fy9S%d*4mR<|CQjLu{cjId9|1We$yB7=3IzeHWGTu}(2`Xa}5 z3Cy#-h+aset36tTJgpZ?drB?p>elX=>JZULtX$vz7UJ?!((x7h=5CO&^H*&Ne6IR` zrV(9^e0H}iyyC=Tk-&fseCgreVfV%xzubj>GNAVw3>siPP3(K+-SWSE=$hs*Tk5pxh=5n@VfE!ofL zvxUC4BgNe0MzN!hAW;<``ROFd4jbC@_Ybk*^$xq?{azL^f9XTi#Fe%GaI z3(}1Q1P|9IvUoTIR_jE<3OFzQTFLch62awmnXx8@gd^~U+76O!eVKK#rOoDm@p0jI zq-wl&%hc@MbWd{Tfqik_Lpvhotw zCAZ~QkO^0u?_|hu?_%t!aaCTn`8c0Fx%FehV9t}4_GO7>i;!N4M>XUDtma8+ohnJ` zo$S?DPots}H!Sv@uEZ9OW!t7{44)coh;gx=%q{7a+-cBXUawcvQIeI7)C#XsT&b!K ze-K>rW+G3a-ow3w*nQ>C0q1!x-soKIT*c8g{z!87fz-`Hi9$?4MzA_S8x?)mBjv+P zCGjlV)S1gB4#t^$v>_P7t{C`a-#B8em^(QCSt?GgGJ9anFnOI=ng!ggCMBdi7gRs% z>gU&RRzIwS*r8R z3d#qZg%VwZ1q|n(-Jw@hw0vx4#u&r)SvAJ8>~sI}YzdW$?%*hF0NXEIW2=NSv z{#KK9?%XYg)AI?`?_X+t@0&%_sLqY68w3VmvfMjLk5}1m-%g>RqvKxGI9LriaYi6i z9Rsg9Dyr>*fuHF&S>v_V)k)Gq%Tnm2Y7*zkhRz{j!#Eukl*L*BJr$)~tWaM@;yNEF z50bTI&r?k#6^t=IDh;!_Q$WYaf9cl(H`!u8|ApVe7V9&m+VrzC3x>-}iz&_Hm7LZm z6@Oh0WlR=XTzug*)O!pgj18!_C)B;xkJ?85);q>z`Q7_?Hyvt%sIJhqCX$L>BB$Ebr= zD#hz6gAI}7Ou8!}&MWy(s5NJ5qM1hUr~!nHG12h|sKsM>#VuPmpyy&$_5^wT>?fNH z)#YZPw#!92Pxd@A0DNFMsXGs8iCMcA%0!EqBj&QQfpztQ+6D~5C0-Y|rvvaS)&|T6 ztnlGJ7H7g4*>v)xU1^&93zH~ltW805d=pz>VTYGeVj-^cgw-=|-{=UbgSZEij=J));K_~_w7#i(F1_CjBt zoSU_o8^5MGOU#GkpHWazoD;L~bM>o-Zi*vHueTp=J8h6jrOQ9FUI}u>K$HWzP$xsZ zZV3s819ss?BqVZn#uBYfw^pQt?Doz)dG;*UQ=oq8W`Yipdi>Xi6iMfvhMW?7(G*;7 zwLTmcPO3vW3%fKPg!tUQC$*vN?V+QU{uaeB#QI0Ut6il2-ga! zYTiGl^tyUBVZ3BBVVu%-LUt~hm*-M1YG@36WVnB&p#3h*B<)a?`WGoJ{xE3 z5O!&hsr52sn^6MfFvfAg9SWFyZ)#=lSitPo9QGS34(eiCxQi z7saL^#X2k|M!|5JFUjXu*t}e|AruujrTOKXDp0jyKAfxfJU&)TTTH=CzY!?o?v2*J zSoQA3M-58k9)W7W2VkSQ`p^Q#JxnGIgsx0CsrU`ELsY;T;_^U7pHk_NX$occa=K7w zYAEHdVtzLh$%ogR=g|{HHbI?$WOCOd=2eSCo{?6)*8}#=c9oU}gs zQ6b4@I$ba71qGqGk-ycnrC3su!0ySIx(0V21uH+Rt72|@W%q{m3I={h-pMMP?0@kO zec!1_@+VJo`3GIBsLL)zjwP9QB3dnr+8%xKy(ZsKx?OUHH9 zbiBq@2of_!_x}0kpE7OwJZ+NB&L9c*l|G%Oz9k@3)w5e6m9^q51fyg-6?rkY^kL;o zd+<&ZJB$~m(rRiP@A+Ew?od3jQ`gPaAu1}99XygQzWw|YS-M(yCk0)u=&sw@rG`EE zhDm4it~=$mI=-AN=eFgisA%i9wG5t1;-eY{t|r5o4>!6jx)P(hbZn#VaF&!8Y2%Dx z>1t^Eof4P+)j^YqlAI6jR!gMPxu)|yG4wOvfA)@SW>g9ZaB)RcQfGn*{X#IAcP98W z#@6kzMnpxioecH41q0NUHkG0e2-R}mQY8Osiv}Q41^J8TLNy;kWGiSyf?$i^6F&%k z&^j}t7hDkj?ys%9jDgOFvDsXU-Ia|`6Z)Kb-1;`E{6H4W$_(`xVgrxk78BnQKyqXLObTq)Pb3e* z{`c`Y20xnKUe)&{qZj>Ety;cZG2&O7pQfWlX61H0zs!1|nbw2XccQ|6t9h=--O9wy z!IAHJ!`FDBQO!{YrgjHOQ;p?K(09LADG9i4#uoMJ1ZXKd679%P{@f;DY2aB`@9@w$ zrftdVLraDVL!Nq#@#;vH4VyL31_4u1597CNhj}A@gO?`i3CfpyEj;KjPXC&I6G&X+ zyC`cxFj-VVH306qgJ%KYuAOr;SMXh^UX*&(>^*;-;hcwwJv=zoWw`a_HxsAEKN|j( zxmfD#?~uG*le911Q)xo*je*Q0FgrpW>6JE~>jAUiXP|1)Um&GM=Y@kxBpPb2R6|eT z7^2hX6fG^Y`Io<7)6V-yO5Lo}7Xva7ta~tlr*v@&bnRC z9QF%rDYGA5`0p)5Z`umQxPMVm6vx)<#A8a*XwdB0X^?7oxOUssp~JIyRQ8sl6Am0NH$9A zbb<`!eWPRh*vdgbfGh#dcV&ADzH4`+22!312++e1J1fQt8iZ+t- zHFlFm7bOjA+#0SBlQ7s9)-b{q08-730y|d`8#*>$uMba_HVXq))Ed{3jsaO8bQsTdht zCq(#uoWs^g+-h&q2*5^6$pj+c9++HhKH1<~BbcgD_XDn%3VtVV=5jQy)>T(l z#HZObbw?$#<>^L^9%r}YQHrHcZkIf#tZVx#U2l18PUTL9d${WJuTH+6qwcx`m+@L# zAN;`tpgwr+SE2(6)wqdJ(Qg}>V1h*{v6;C=b6tPei*lbu`6Gb4006l0qQXc0ds?Iz zr~-VT52fODqoRwE0LJKhcWki~Rqk-R5d<5KlK8;PECv{uOY`FTea)PogpAXB>#c!qZ;CD@(nR$I5 z`CP(WwAM8~Pj*LZbsHR95;B^Z82CmE0JvWWD{3R6UXHJme~YEmqHDlh9VReF0qR@{ zIt#j5b&bmd89#F~Z}8`0UXc<+!<*J&ZkV&Z#})BBzVMm&e?fm!r!~`iY|qLf>`aWe zJA!z-BQ)Ggmuc{nw0q~4Yt2T(r1U*?U6I?}du6>dF=|U%?>qs49K|UOIlJxm zyUOHLbgZXNQCrQ&Qfq4EneZC`wMMm9o~*1pb3~}FB+WX;K?6@^a7n;w488NaF1JKk z;Eyz(Qg}-hVqPJWwm?1`N~>m7E_v|BtObB+v3v<_ZO(@*P)_j6i#(DsX=z1+XF%vv zwM{ncXc@xysg)VPP*td9diU7TZz~t<0<|#3CGd4HUxRQ>^Q6Sycz1t7e})Y^f*LqA zRBjVj@vPGLGbXPqZCo_RZL8orCj;d$sNvajOAWq0jaYYd4snnZHcXz%L%XRm;whP& z3i6Z!_h++l|8~;7$!gv7V#Se4E0$&c#ynGr-(9(?>;s}yJMs!iS(7YQ zpDGq)(+LUYSUi+b=hJ&*EaWei^4h;YCaxvM*1+=cppk6Ud~hNNl0kM8w+fdBQrcO= z7-aaCM19#{Xm{*gl{@MB96ahZ!NS@>gPV_|loLKh5C7is{@vDfyrk?PK{RYYvwLwT zoXVditHfC#d$|0R>x94bjv-XY za@D$U%(OSsl~<2qLlrXqA8bNQ)k;2?i!A6-w!aAl}*W49A$^7L9DBOGc!>$ ztKtqxU)pE2wyd@R@y5Z7>DitXl?{rA*`f!v>?*4Bd%3%X`Aw&PRaLK2KZHb4!oP+cA4$F1koAbphhUbk+ z?5f{6yf=HSMchj>H~3MTif?VpM^_v1Mt^Y$UCr1m<%#MIC&$-Z3xk!lI>({W9PH*c zxFzxSo!K;aX+)Aq;u<9YwkSZlN8u$9;)vrTW@V(Oakfp8k{P{_Lo<)D{C^CldevlN zU_!M~r5&pLStYSQl1vu08_PCW#v+Pl{)A$=5=Zdt5lp{Locus`C)LCRE8SOd#20_J z-fzL`zYF;C$K=B<)`+gtZ)8ZM4i2qhg8^35#uzl8F1>>`JM$Nmia}p3uf0 zLw7Ov`rUyG+jfIpodIc!)3NkLuEzv%N2=b_a<&#;kfpDMTU3xgqfJl zd4>S3L4g~3)1-Fdg+&5!mG`(C6QwvM+*Vu*)pHsKbBvUqEOn0zC)OMUsSPT2(kiUo z>}Tvv4xXIO$y2-xNolXX?{6-(W)V<$| zNqztll{YYy_p=32;FP%V6Ei^dq7TH>mWZ?7ciw}Q`9pX>OM zOZ&lb7t1x!PI^Vd^g%;wti0yqiL;XFultHq>}4g&#lK}G?W?K2a=YhjH2h`in|_bL zg@gOr+}bK3h@YO8|KodKL(GSA`&r3?RA6N;v=@1pSN^Wmu^tSqGtFCT1^W2WY~bWtZz`2P<@hU{ zP~+jHa<;hc`nmQLG?-|p4Sia`Uu-q0uUEH!H1A~8PZq@cd@er5V#HtnDY+l(c_Nxw zE;$t%Owd8yF1k7uDb4_&7y%u9NmEb;guC6<*Fxq`T~-X8F0hQ#9WE0DQJeT^z^LII zgVL+Pq>*?>k9{9t#O95MbP;!SZes9=c}Fwhd*$!6$-Im|R+vt*6*VUEIPdl6 zDJagn6{NeiJq_}eXqe2xdc6Jt@9 zo=kqGZ2QyKMpG?Eqw_MUzq2MYBB0J7prVaLI{RfoONWd+Hu+Eb!hjP1kWnxV<2oxFo2yN4c}hpZ zr4VAPMbGwxOKR~Vw*wiaRIErqnH1+iA}6F>5>ILJoDk<$=qqtw`M%a@aLz|$%B=?? ztWQyU_Bpt9(zbMTL_L1Y?X=<(2pKW{Q`Fj<+0WKhrTth9fCSFY%X=-I>zehT(>>~M zohcQ>VvgJfSFXNGPi8iOqCM-yH0vto9JkJw!k(Jyx45+5y=PC2ZrR@RS^lVB{>($~ z5wS^du=ovSriTyZG}YDBSIX_Eo1b8;iYz5yyLw0kqVZi*0dOfpf>V#%)zp}ZrV=qu zKfe20x*^oUp`&7YoG?x-^n&xUpDs{RR8o2l=ydCl>F=Je{)Ja87>4=3&65YeFE!dr z6dJt6W{piP5xtSfxD~>NUTC1i+DcH>4PdD@H`6cT|KMKxGIz;*H>JakL3&yqqEaGU zixp1A`d*|s0R9Hy3t46k*Lt11K-IKOIZ|#K&>FMH$bbIC%jo)tmjLP2E_4yG!gHt9 zL;55E%CZjgF&6aqaL!nzXusV9=sXn%E#wymGOaD!UtH(`;HuGR`UOmwvkMHivgR?+ zAQ)iq2LJ}=Kb8Uf)(_M32xuQ7q0>Zw7+h#MStd7PK?}Dxbu>iNmK|=dINV-e`e!eo zoE~rr|GC5%i>{H^vr|eb$1uMK9(Fdy!_EK?JNc%f9%87>3ADHzN6M^f!tG&4=Z8PiF6j z%M4mGiC#W$c_%yn&VLJgc=-3(02+6B<=4}Ietf@{&Iqx*q&FkQG$%o=7@C?Tai+_f zg}%*8m&C1>F!L|Wc^hEPL1Lsk5IKQ}C!>vx6EWBT068vw&(+R5*CoB1Z|Jppe`mH>NJy{SbCw}c_q}rtcWMKB3OofQvHuuSD8x`- zbqc~Pjz+J^Bu||xT#TPz71)oARugre8Kekt7$^rV!d-vt<7lqd@eE(+Gy;WMKpLO1whG!^;5ih@$( zGzIRwfD{EcY>XMR(el(oRgP)E%IYXG2jugW=TT7^u1f=&m3Br2MF6sdrZtRWPS+~z z#&ZkA7rN2_UN;gu1#!^9kKhW7-G(?W($$dO)$G~gy|1=&+noRA<+LO1QN}hDHVJ7| zrd~hWFxMS8krpEd{i#eZ1h)M%(vnnjqI@VDLta3>@Xu9f3-aBbDP0bextnDDTqGx_ z`Je7q@2DmYUQmu;3Pui;>W7nQ6{80bEb)>F`|Wu=2@kLQMMHZQ*(kIFCUwW2zCMDW zeR-TQLT|3WLsjs5=Gyc@Q;OXi1P$*hdT&V3a=;}Nv%N66jR3K^g`bf25HfGp1CMP9 zqU5Rm>@>x#PZk_raC*`QfgKe&4b7!n;vy^m1V#$t|Gfs$m~!mJwK^7cXIUA{?otz< zz3hON52d-S7Y~CdT2HGJ5hyB%2_fA8HS6PgMnuS5qi)A{WwVW zT!awvYM`j`?QZ4^1Mbu(i*R-vM{^pxC$#A#soi~6GP6|!jki2fR{r= zbc#r$(Nf{(s=57FNa}fQ;jt&|W)$b0#(EjmhAwK4X!QtiU4B=hX~lQ?QG+-kum(a230x-kXG zA%qhn=DD7pqkxQDsGd*sHZ;~3+;re#L~Kk`698kw`V;;IjGZPtuel)lw^bO>CYKS~ zq%CQT>y3aCA(jSgDGF`}F!MgYHa=Bc(^SH67_;d;c+2-i=t(?$6mNHd-2Jhk-vdXs zl-x0r1DEwK4(VF{m6Ox$lJL=TOa%1e#?;!^_d;-kqO|wDtAR1;bhy7|!z1I2Rlek0 zfj?eJf(*a=tssNXwV$GtfP3In*xv&9>+Pwt`1!03Q-9RfcSc_7(4Lsa2oPztTc}7* zZ##3pI;Q#xTk-;zE@&5Q>qFoMw{AA&vnaib8mMEUMJh|C$Kc5BzQ`c9W=C7C6Qu(K z9UcW8UqA5}-JlD;J8~qz~2aoThLPLi(FuI);vu6i-q8?|7JC zJGLZ>a{OB5I6VVnaLBId{=(`HG*Mt^{`5!^n~jzQiM{Y7Jy=Xh?>-#Isv7J}y!Syi zBOV*c*)}QGQe9PHtoAxbK{IZV+V?EqKK1GOzg<~Eng53uY4Lw?H*D>!7cs}m6^NK8 z2z_lYhXR1c%JrgE&j*Kc4IIe=e{B2Gm9@WE04SfZr#pp2ux^?>z-IOkLLubBE=Xhi z4%ZNd%N~jn1-IV^$Gqik)(sO+(Vs0ic-+V^3CoySeo%eTYvxuo!?U9kTE#SX3!y4xivK;8z01 zV|I3S#RC2E`#mzRu}G{bZY1@+briyc8|*krX43-{uIPMvf-yQYfFFf$#J5-0M2$vL z0YF}ygdPoMm<`w6|LAwr;sZ{glk);9@stuTeHSOg^5&9Dn~(`IkQ7>fdz`5mNwwM4 zn>jl=I`+WeLFhtO4~eV(BHu5Uu{)Xwmf_d6wkD)e#oCNIu8AQPLXG%Ibk~EB20b-@ z$9u+P=`MXTg%VsFVdA~n_%8?qx&4;-#lK||JPbHfoBcoF%$WanvBV_K|EfM_^&B)r zLS|-W%`nQE2T->WAaUAW&m=ev{r5MWHv4tkD0K~4pzn#xJVhtQgdprGKuD{uB%Od7 z)7)I*7vhj-g-b~&SIZc_I#+Z$5$=SU|5sr%*&U6)*0hSUw|&7W!?-=My59}tq+80# z+Ce-s&{m^(Aen{?Cs_Den68cYp=)FJlN4dh0~?87NqOraOfsZy4|RlbpjIJbbuau1beh7wD4+m9gOEznVTi zVv*w>|8zv#$jl;i!aaB)+EU zM7#z2l8ZcZZ8|Um1yj&29r8k~UoV{2QEkDk(o_VjfPBI!Bo&Bz0Ade*VaRkBX)q-8 zC1v`d0a(F6!URUk029(3ert>jLvHJkDTlHuW@P+9%+0@hL8J0N z-tOH0^>*bGH2z;JP(spJhKh=_)^vCQ!0DEIR=ToR-6fZWnZ#sQzzi?Fh+Ig_1?1AF_ z0smL)!VGk$@H;D-U^?fm>vN#3FY22v6KnYI;$ANnIb3PS~*}ViL zTweG9it;{J@xkYdB|k|!&~*36+vj}wF!e-)?b$k2DMb7wDd z;Is(NS`JVb+XgrR38uuX#cA7bi*dMqNx?SL0GPdTmDcC?cgC4tPm9M}|6V3f);bNT z4Q4_1qaQ?LPj6H@-EHH5-!&>OkwQLP8PcedtX9Z_1``+=LoXIsO$T+TCtNtMQtQHx_G^i_q|lmzVdM6|A4xpt*b zVB}Qlz8(W5j3z!#$Ed=_$wuxH$hUi`Ics!+%!>hG2z{aeVN|0SEK7LvG?fk~-h$hP-Irx{m*jFd;2cNzIn=2-`GfKIs+80&0jYmdHdg6JcMr2!BZ+kcm0Uab1}CFmy)t|PV_Oj}@_C)KU)XL-wc~fvqzq)aBm5P# z(3%YT>Ltx@=rVS;-o0bBrBs@ieJT{ud&LC%F2!eb{gRphL`HHcV2tCr;Y`+0_C-lN z-hSI}*Ibco9=<%%NM{xr>7aUP>v3xY+$_>6p^0mo_86Yh=ol;M-&g_b81iE(kjzkl z>>=>xrn6SmaIEP_X68OC<}>qN-$Q62^O~neI~O0b-aty{_UCr75)Z3fw@x1C!`pvi zxWLZv|M}zm?4O}2_MpzGRddSYTnvr14>*Zb>HJo>umGxf6pZQpX$fc_sc+xRfVG02 znrca!Ef+9uLbz?+_`$!=@;tLPx&PP6Wd?JNV~tBeI>ogh|jOp5pEnrNSk!Or_?)G~MkJp^L#W@VoWPC5*_UhueDn<0$n#1pyUVBXw zsISmw4iCCJSY=WxNuuV>0Iy!WHyX~d|G6KFR}XCce>i)~s4BOpZCDTi5l~S|*@Sc> zNT<@>Ag$6Z-K7X3(j^VjAt>Fbh`>g=8>AcQ=36(gJ?A{*eZF^$_s4N~MEAY+y62kn zn%BJMTqwV_wxjP4k1GwCy8m^s8&5APc6?OxP@DBXz7cf3L}M!yNNVL-j=?~~{d&zw zoZYPC&d#-UFN$iXv+PfxGc~+%#5GStLGS*feb1KWU)^P!atnRrG!fHsSwKfmcLO&8 z^ZNBJPi6t_QvefS4=+Re6{K2}C&GM3f_li2t}Q(PT+#U09T?9xswz`buRkK?xJ$!8 z!@Z!;!Fs}Rw|Fiz4Ghy<5V(^e<*aIs9jbUvg#kuD0g4t;$?ccf<;B{8==3QM=u``z zX}B2#hQQaz3NvD>MpGVNHr@@Favp4a41ea_Lw$K1 zoS6YwbK@-#x#ClFt!!n2G}+1xpZGq;jInRzr0+c9mflF+zdL$gfmo^@iy1A3JHyVOX0t0x{~pn`ZYox1?V3j%>*5lnqFXX zLe#0y^3&4cFYiiS358E85yM4GD{OAFlz)w1o`;X?d9v)0W{>NG*hU7roy#91XY&ax(-g4=RI!f6YkLA6Vn%c0ZtX|h zoGUNqIp_1W%Y@dQHVrcEYre#D2^#;9ZU#MLjTI*3(W1$hXO9#U7`5M2iV_Y;AfImb zXoFZN^?KXS3grndi#=?M)@w4Qi24}&zD)frB|%^)a62K ze;HZ==AP>gyI4{tFy;X-sV{X2|DNsjwqDRU*pMUIjARX?qTiD6$hrtJC7cJga ze!6xSUq|tD$i_D^hz>t`NAd3EYbB5e3zS;pB(P>!yp4F(=fH82;n}+@vmd?`wtR1F z>7MPEV>O#8t~y;;J5f&}6zHDqnWvD7bCZ71F0RiZkw>@@?mxkTbf)sb!*jt%IxcU13}+u)S537$dMM z&T1{3CEYt^JBkE|MT$RryvZ{boBm@?bli!{YhdcQ7A?N+>{+QMCG`N^s5MLb)9yR} z@seMoylIgmO-=nXMpm7c59d1)ss8*a-A-10YdaiMY%t$G<{GdLZnJ@>AnoxQt}Ar zqsgTOnSHlAzG!*gp+sQdoi=qY+)KzQ)Cu*b*w&Mo2#YuT$D;`apnMk)%6X)u?9{@4 zf@=0bk=#!*rk%4|M6+VyKH-+qxCN!2`(f%MGkeJZme*g{kl@dICUmIbE+-}XAlYcM|rpozk z-HN0AV8)=-2D`_D5G!2+w4kjdh?OZQ`5bvN+B<&fXAUe1vfXmtQ1B$+d)wBRtD=Qk zdY|fc^jp&1SD6T^_C3hl+PIc_5j^_&J{jRifD8467-+^*1!`_d*CSIctDr_p)p7z<XG#Y%0!ah>SW+ys_EzIOkge^GYvzyfNRBdfP zeGk`6_0Z{ZLwSe8_0m0AMwg8^g#~Ci2s5uPf6Pa+^oNT^Eyrd(qdV7E1Mk&Fui0vR8a}LisIM3CCNKgu;f~=-* zShlLHAQ1?ElV$T1l{d{+RLM1Y+e z7;aTtlvPqN(N5H;gvhB0)KV&ruw4?VgiHs&rRo3IfFB}1zmuZECfYs}{@_mkr?ALr zmmahJz~E@&7#%XA$ z1-18qbNJ`8O(0Z-4n|tQy;*udu6_5`huQSCVfc!nnp$Q7W1SIu!+-?Ze^44=lze5qm9TWbdFwYUY;HQom)Uy7m$@#k zy^7b&b(eBTT*6 zRioNj2<9O@CPC&ok1606VhjL=TL2a&5^@wK6}i?vYtZ_mZ+gaLF6`DPZ>wq$uL#En zL`y5~u~wY0(B9GDsJW4Wa7*adeY#O;DkpB?G)Pnbd);4uAV0@VDG5o#Q1UFL6g5iH z`>u73c3s+p_C%|k@zI?OevzDD2izn+XFlP~d_D4H3n?2E>OR}a+W68(A}_mj!SKC1 zXL!n&dO0$x$>l4Cny%w3(>7lo;t&#&-M)SM#h15FdvDfiZ0ncemiuy&nD`F95plXr z^X6-vezgJoY@D$%jOc|5hzDXY!inu=AM@nUz&zdG@ewu`vq^!0r9>j%2p?D^kHCq? zcbS+v*74ukBepm^ecfjkm7tyXvOYC(g9zaxE({1of|TKEq+|8Ykz?zAR7)^vhU;mL zuiB=;(fzG!w5o5FEZf=Sb0=qb^P=He@u#}KWv@~DJ1$UsT4u-W+;AR$4+2JhzH-%< z{kS(VJbN|xD+nSSy#jy3!MljU+61)Ll922Qk&a&LU(;loIOSs=ZG9x`fkM;Zlx=O+ zt%Ji{Dd2u1o%J$0pc5j=ukp^{>R-e)*4NVF|9%-)kZx;))~NAPP*PPSe$L`zIS*?o z@fgB&Cpty%ClY=yJTE-NGJG4zl8&KMSIeqll#pDj1Y;?2ktPi9&FNf;5~CX!xiY(5 z*=o=I`q1&AlEyZ|<}Xhm9VOYV7szZJa$(8XR@h&3dvw%+Uu@W_syP0Rve@_gbb}!{ z7XjU7ps-S)8NX*8Qjj?8tG#MZaCzD<{sv3L*Op&wsj!seLOwo>@g%-H9Ic?Gex=;Z z_#ilWrZ1{RwCv9N8(@qUORp&c?@EzF(@ynhXxmI|F_BYgU(y{#x>vX+5D7-zj=R=r z?hlUhMl}IllSk zGdoc&MN=KquITs0Vq%&`N}`UyfA6|xVGX%YLY0Bfbn5@)h(f!{3`{1%av0a;*V!j6 z^6HL+{_66olp@UaPD$5C*0|f!epd`T{k^df3BEtrUVh&foS;yX_tj_G&2VXWkAiwH zL2qPg<`fd^=}ibF^V1c*-%+An>eLOK8^On*DqA=f4Jl?eIy?Ua(6 zQGbuD-`^uUpDe4iYJF2DSFjpGI9G!{>+g|WS1DHGFgJZWnO#oujZqQK!K!}sV9+9!Vy9G{}?c+_&F(suJuSPgaIO2zu&u+!H zQ7wJBIQE~@@nRT|=k5;f9-+q8F0$F-k)W!A==1t9pWb)a^^^2PQO1TWQaS`|`+QqM zS}@lX6wOG1i^4f|H^I+Ghh1JvU zU7COG5@#eC)Avw1`-5G$L9C7Eu9U;q&N)Uy2_@?C)YfOw>zBdtNQajawHR|4VQqKN z_j!a&skaQI902OA_)2rzM+rTDqF58pI$8A{IXA^1u#(sO$aSV?{q(L<%c!gFcC76P zMiYHs@;pGwf)=AY{8$3X=ht5f+CY)>py-oQU=&UOU>YYP-G?F&{@LKsMMEy zb}tP#8A$!N2@N~tdZ)UzC~~?OADbup{dHaP*Q7v0103Ef`(q$~&Qy8jVlu`**_sfN z@->>(03I5~t%LRRXgq#7P;ct&((BE8?sxE@4&|8cT ztU`-?YIYpfp#$nv%UOO-3l#iu6m#32Thaug39 zJYm4Q9e9|^8R(f`_B(oG?kbkDZt&e8Au^w#c)Op6a(9JTJm9o&C@$lbrg0)Y$eO^4ec?thcP21J5o+8OxDitHJS4|BhKWbbw|RzH2!H0aVX zG||NmGUEty)4Yk@*4|@&Y3nSB=NXoQg^Qpir~*5MDX<`X4zyRkC0}37lvbS~5-bHM z5`{9FKpoy$9Xgpu0@>CvDSbkSWaAk&h~9Gq#I;d|U^+ zV*O!RC5L&h+(qW&gH~VN`NfBqkNcnm$mrSJ()d!X0Xa*VMe(lx!oO_vgkOBZ-mEI9 zt*V0875p|Ax-Q0wqx_=0hzSn|93)E7EAH$sZ(oOf~NI7yg6Qy*gx5kd&mjABp_k2*K>TjR*UcB{Tt3=%|dV9%z4hrrXsCoXL}2C{7c zrp&&k|3E3XHnHR=%{nFHh?niv&+DV(u2g$2$!MqJuM#LEiPCF3&c<;nj%~0)-|~Fr z{uQvPNJ6_s0X(Wp(uL6{885c4=_UmMcUwjI6eFBNva zx=CPq=N`8F`Ij8|lp#?asZX`i0k=tN59XgXD#t(8^EErgTaU zLeoMd&xB9?lA zW6q!!CW^aE2ra;NvZYYRiluka3vGL$BWXk`@=O;pZ1MMZ`29kkf|d0N7|8$Q z#qBTIB(B8^O=k2~*R4S>W*@p8G0HEp%TN%&{f_-*6!^-VTrj3u(eQg?FKU9j$PwZ5 z{|Tc559OV5GKK)#fnc-ttMd{NbiND|lu$^HcY?2e&?tU@zW)@FQ<5Y{^+bV+si9=a zasB!y_3g-htl@)tGED@!LqVpQZ1M1~SsUE+90uILOJ|e+-i)@P3Ft9Rk6`E=+}XW5 z@S!pDRJ0lI5j1JJXP&9YgQT}yy3;J>Il^fIm?>rVo=x=u7))bXZyh=mFTf^U>6aIA zCBw#VCfL`rd;4Sb&&6B(f4z)5#f5RVRZ;8kmi|!;;X;(^5%^FL1yDs~LW?&Cg%TsK z7^bA3w?#wWp$57;Fq}EknYV~21Y8@a)Z-Oh2rQqwa{gD~t#tTx1=Q=~IYZgatliap zue-CwA|{>ui2vHX=PkfdwVa>|Vq#VwhtdAut2k(^IlNk^qqmI zw);MRFz|+HKowXgZ)BZ7*CcO9P#XArh#52>!usJ4RWpnOk7ho?cV3O$*8FSI$IvYH zkcx!M>CuS&0=6f06-&&t>WO#JBQqidfcysL;t*mw0Fk7R5PAY!fbxddv6LszhjI~; z_%p!b98OeZ<1y8GN)=s3~Q;# z*XdT%x8=<13a+xv*Dt*;kn7Z8D=hRE}5+cW&AFW}2Xe@E|@{Za~hC5pYN6&Q2OQ zyN%Ayb8Y8e=ref-NxqKD_)CQ~{DpF|Q1La{%W!8uQSB&&sfqOn@x|sKwA)=U*Alq| zcq*G9MM`9`TVQft48!1I22mT|3*R+gOA=tljwX4HeW3;FJ7KP>%-1a%O8%z31VZO9 zaSV*F@P7XB2EsXj4qJnB#Hqy@EX0_`~0#YKRZ;|UsCaAZ{Jt-HxV3;qMzZaSUX9??x zi!zfg&-8$-{dnY-@n37lWcW<#lDMX$^kVD5I&VV#^2^il*Rm5{pEW;)N0{S+qJZqw>D-#j3X?oN#;O~BxA|9zy0q6 z4<^&4Tgdi#S&e=!7`g8DPQQ4tw;ug6@*a*FR;>fF;QD`z5lAC~Z8AZQNTW$QTV7i9 zY&quE0XTXYH*e`Ad>m2rNN;QmIOXOx{)?TS$XuGXLnCl?*T29Qf%x{XHv(!6CZC8{ zV^9m)3LCDZD6H22CaCWkSON6O;$@E=BVpdauW#LahJ{v-U51 zyz{d=N75;v&_2vs{?`z~0(@>kRD8>c-z{SIstaM^<>AYO7_r|Cvfive&_dTPQi^8} zfIU*(vycL-E=P{vEsU70X9)jQ>{U4y1H%AwueaM&Z-atQL48ReMQ`m-PU;y3#CH%P z0AK+#?OXa?gh`$|)f58okz}4O5S&9wKf3%*5@4qSP~(+A&n-Dnm=+gp4m1`y?n#C0 z8fVpmlj!QjPQkH43cEK!XP5?e@nUViNKwGreN(|{WFbZaIWar3uA9}VtApkj)RGf1jl)XJGc|R6qM0m zs5A5N1{2eXBo`Qrf3d+VK0=y@iaLhc7UwiGLB+(gSFJuc2p$mFmSRbZ+Xu{r!NG*U>Llkk`IYs=aiCruT-M8v%=E+3sChP{~7G|q! z^?hmN$TeS#dR?-raQm7PwpNFjgkbW^m;H4HxpB;?ISt&au_^7l`JY9IfKByV_=>wy zR*nRJXVdlk!Q)F$K>Excydg0XvO|!TirspqVcj9-b0x!AZnw7A7AOInqFEIUr5#D# z{?YG9m|l(4(1_J!22AhWe?JDiaZD)GdB0YQW4fKf5OlBU(!zyUE_2my757X4Z8duR z_;lX7Xfx(b(Q=61*s2+P00bnC6)baYx&ggm4JLz1tB$XOP^Z;7UU^9d=w-^i`xOZY z%f9%DJ}}BhyZg?gyr8tL{Du7TNTFz4x;Gs~ZHxCJVqy|tGWS!42Y5Te)_5mREgKmj zZO!94784-Deut~j>RLGXMM5r#+b0s#yWqc>(V~~<1`yoftqonMQ0Ni)SB&h-CDE(YGJ68D2(xD~gcbus=EdKxG?asCnWb!T1dp%;_ z;dy^WOy`@1PU#c*DW|GB=zhNg?{j$@2MvoQJzopZ(9R*m?Xku>w)fbh8s$G31=!6d zE@e=80J9>dt(Of>#{0rg2Oghs7;F@Ssndc&?DV=c1CLCouRDwoxXrQ&Y!K*_KA zr?LFN)!~3WlT@~)?f+M(asiL?d=M-cU}XWo9PZrt!z9Lp?*bFuZ`KmK}& zrSMZ!JrY<~D7_hH3{TXuf8$fdznsCXB?ws=85%BiPn)aVa6mppOar^HHQx*BzJT(U<-m>U>^8lccD~CB0c?P`hObspXB}Zx!_o=6(%r?x)>s z?Myw31aqq5(wxB-1A|1rf0@db$o~Jh!sm7YilEvTDMZ>7M=l5(&2NaT&$MR#7WQ+H zod`KH$XqAYIL<<;x>7_`gz###?mxhV3k8p&u*Xa8egC=Rn&7UhMOe6EWJ%L2&_BFYr18Fqca*|;RG}hgFUjpA8-pxgVSE(*7 z$5JsDj%m}0sAFC?=lNT$`k?wX0+d%dF2JEtty(tVcmIhpPn1aw&2!hBr~Mqp z=TM#wa7I7%>TnJg(3Ag#P|)vC@wj4L{H|p9G&NZcKoS|&UTk1+nHjL?>h(qH9A2lE z9T;yj+MQGR7y9~`sv}^j>2@(A_9T63;ojM)7^!UMpXhmhvn6xnzGX8vAT51;zJhby z3M!YgoUgCZ1>H+2L8D?Wuno|bdB%$Ad6fpbnH4gGUko7g2mGQ@oohBi%ys^QCz2q6 zr3s1-tOL2uCnN?-?`~Z%XS)Cd@q0xkedY01YY*yI_Eq=RgKP@nV@^9926`7?8_^SW zo`ULO9NVzU?!rdMk3v?%Ynxti3TJ?O8`^zZTvhK&>|p$b4>rCqG zwMy&7cJoZJ_0LlE#eNvc#!D6I@@Ifig-rf0*2g`H+#98aid^y%THC^I(5XfKjNyph zT^)wz>bxVW>+MY}GV3!Ns@f6v(4M`)6pDAfEknNv`^~T|wnDD=^Fm%X_^UTJ3{MWR zs{B~P6uUoZ;a5)i1%u>m%47?S1!1*3RL6N95NbDHG&}CL9{u41!56_o$6wq|a?IE3 zyv~pgT*uvqO5H*P>K3EaB|5;@h+{Xe$|nQ!v6VQiB4=g{Z8ti}#?~4gmL!hS9lLW4 zZvgGDt=pp2c#UXCLzA*VSXxu?;z^$BCpvk-o%HNyvtv$sVUdwRMV2FuwCV*3k%3Iq z9^08FzdlqtkAU@QWAl)?XTS z2EuT$F|}#0V_{~(@$?o$(Op#?!PaQT7!t2hCTh8)UQitDq0i9wr^wNXzsWs@&B_ZI zvH)O97O#rPK>&b2hLl;MQVYCwC{>NrkM(-nXSCzS{Q7o^${BIqJ#`&3wHk>fRmXypTspdwmA5>I4T^!gWj@|g?&$Rr3*UeAc!=cr^5XQApy}jm9c zCQt2HR>K*;`&JIyii}vNQ~o5?E5&&>N~^MohdDJYFYLqE-xD9a;@j@L`r^ye3R5#L=fhK|0c|r&g}k0m>0-{?fhDfOqg{Vsvj#p`*iL$cl3_Gfk9>~iH28mfHI+g zd2=!nT6SHl7zj}Ejp`L6^c6Lq1 z=ZSk~!SB6}bjs%)bi;>rOgaw?dIZiyhRdz+dSxPL%zciK^mBQ<;i0gxVw0YBRsjVyb9ZXf$Fj#a1*vY}GdUg< z@vQl;pV6D4HZNP(G=Ayuj~I_>FF!rm{}FJlEyPl^DuxuoWq%DJOa zoz&;+Cp?v1cUPtcEq4vLHYsOw@ZiiSfroC0+j!@UZ>;9JLUa%v^^%wBi(E+{lTo59t4h)+ z(zF;)PJ7VmJdCw_e#g&w5C>^5gu>vUQ~Xt{_y0_HL8jS~;(AV_!B}ywU5%vsz&Tax zwVaV79&(_b8cWoN8FF$sPA_Q8f=5pG>+lX01Gmm^vJ>EFSy zdidnG5ME>tGmX^{YWeWyW(kerIj`>dwYr1$9HaP}nQ*@%`$b!R@-z=Sfr4k=N;`(5 z%Y_oJQFjdc^SL+2eFK80RVHm_-x=g6kQInPK0HlxPV)^tiL;49-Jiriv-7sAr7q8h zUVZCI6;290-J8g&m*h3y)h6UN%by-pBu|R*xk^H}smX0S^OlI;RmQ3&r&yoFp{{y; zi5#?v*-pJF-C@uhtDYd!Dm%&ETkOe-so`EzZORWZqiRob8lUCzoI2+2u5n?DL6S0L zbJ-NhQ7!g!-|1r@+?(5X*H0bIRmoxSzey5}_vsWHjecD|Q!ZL8=#=be_k=1$U{_w; zTcx(_#X-3!(;s5idK!Bur(*dG5yv;Nb)Ywb`5@&)aXbdfyi^%szli#%9|p$)QoC?Rd3{M76mQ#qK@5M*Wv70-sD1Aas%2 zSHI1a_rTCUAom6Pw>>~N-^`y(7gCU(=H)F->;B%Bq{Z#+U?CeR-51A z!CS*IOS|@{@cASUF=Dsv=i-887Gs&l)+N?v2g^t6>siZni#oULWolm~OrZ2xj7Wsr52bVxEw9mHKqMr(?DfUkoo-p8pS=zK}P1U#(cT z;OUvNN}t2F-lYa9@w)plU@b7AB~b}Vlfh}zDD7l$8`L~ zdfC=SSPFQU+qjrRL$6=${$b?mnfWccHIutFB|UFG36KKM`AquB3$22;+5>P*I7TnVW;Fs_IzFQl|;#yJx&k0O!dP!Lp^`Y=R8L+!-`*pSTVwU)WF751F(Ux8QO=odofjbA zNqWqEu1&BxJX8BenvkYLyA4f8d)-WRWR zotQ??0QcJpiPdZ*90Qx~UYuhJKIH;i+yD95xP_#INmAju8Ogjt9>$Y#Cp|rvjnv1R zmYb|0%izwFhq%1ZxzE7)%ezOLHFH7s$&wFTPXjg<>~ApmE_R+iHO_gM>Up>%UojlS z6nyi~hJuvrI*L+R<`Ug~&irM^?@7P87&zt^M=?>#ZF=wskDC<~+2reX4yA2@DmC3= z_<{dTSTqb|A3zRDRJ+8w_&GWeg>H{rx=4i~khxI~db{DO=A6q+j;p;tCv;{JHE77)Li?x-Nj&Z(f$-5i zDKGYLiUZHRCx3=W(z4t?2C<^0SrLYcW^K{go4I`;?YJ=qDc@r}tosi)3x&*Yzo`;ph z*6jCxzr&r7u(vPKKQ{jLfl@f>UM9)N)kx3)-d%eH3)Y~&-&;scuTCKi{NQxO`oI~f z)Aq_V*E)y=lpGvCS&-mY(L7@y_;R>xMreyGpeFrJ9ZZg-Q_0Rg(i>G{Sy(U&uyv@3 zD{<^h5jX4#x5h}6YqPK19%%$)dSFfF*E+Ob`bm{ezl)lXobbHK75v4YLC2^#Anw3Vprm^BI(UwYP)byO<_i>cQ2&5bb`>7|t=Dk2jckJ4L*4%?tEk zk6)unG^QzGrnbEK1l(GyHSAQ;^{}~J+SqHm%gbPUFa}nL1zb%MY_|jqh7s%T>6uM( zTX$lBtrGou1jmd78ZOtJI`MvwdfkB(v!kWfj@fSM`^!y3LqnUt*gD|(+M2i8q8gx0!E(3(+!Td^fz3ijjS5iycyXlQsmF`98F(=8F(4|hKSw8vj)6hX8( zbH}wF#_Jh1?y=^;F!4!Ouh^{ek%@xdz`#~}HPO6M)5%sq(>7O*WdoQS_(`0(X}KU; z_2#KHH$QX=zl#Gvv;Uql3OZ`v@Bj<2ay#YxejIQ(g-DN~y2%-VGUAH3bI0~U>)CXf z3RY+K0jH0paIn_Db5h+}!QcBdgJ;aB=b0 z>UG&>r%Em~8hJ2qV0CyRl({6!NM1(Dj2Ywu?M|Z`&*fY0gb3y)vq=FoOG#;%W?z5O z?(U(Q+7#E9ho3uE>G#poAH$Dz^{6s#h>d)@!hT_pHaU6t?DgJ6l+{?(jQMv}@9w&W zD0OWnL8~*`iBpfm?Ql+AFHvUBwOn~KqNAN^anHj=c4d>GrM|Y4Gi>M< zWb}PSD0+fQnS*r%&YjV^)Y75eq(lECEDe6OGr=%WzK!nPoKCTWT9Lp#89+3I(t42w zo`Vx2psW(#NuGW&{jO#`w44nTY%I=yfcV8n;qJyvpdDV|5uAZz=X!}xxz9~O+IUXu z2u@uRddby7yAkF2TeCl|PiKfeVJmM!u|oqaR!;Ta@>+RKt|Ck8M)s;`V081>Z!V8T z*p;Uu&)l<*bItBBSCehu?rU9Vs|x#-4-^9v&VinE zsV;1>-1>1M;%AnQ3kq?^#&DHbu0Lt+vpJoUfgOVMW*j0%wq0gu^H&VN3FHpkB-+<0 zkhI9^m?hG-U-NSRq*>%Xgj1W~sMs;WtIXoQKb5|hvGvJiXRsU$0crKU9%0Z@-txwb zfY&vBd%;Gl?%rt7bde#w!A$d)1LVL7h9qWnT^G?hVfFlDxx-zzuYVGXT=jh&>TJ{c2sD4(NUX`9NFJ7i+~D}j<+Jcx07IMHdG?B-2k(xCf< zf+8#JNdpj5kp|TY57E1zkw2vNP-JO;+66B7y9maly$G3ZM$;?^S((Iy4hKexvOh- zW@X5N|LTixq$y3*H@bs!&!9P;tcD*cc#jfP3fIPDVYr$q6E%!_0%9LOKDeP;3Ub=Y zGasbjdBHP_clHuydM5R+z=fMDsq^iL5qGFhyIVj1{Q1-Qk#1#WrS0*4vQnM9OUo}l zT3kAnjfDzQtm|!1BzR5@6rhGQ9;p;7Oz*DXr;pz_KA6{2D$~};nf$ggjI>7F2Cn

-wF0PF-7j{C()798BRwCEVfB_;Hi<5R+KUdC?neu7c_#v-8J56_ zn$B`D5g^lTe+UaBn{S_$nD9KIbeLxv!JwKZGxo4Q6M8Q`|0Axm(iUD^FlEDUjw`*NZZX8V*-zggtzt06?Bc7$zm1E;2EER$ z1?9`xf}mtV0NNgx?S&-++5&6VU!E2;9Jt-&@Hl%c+Z%eWJ3%o@F!@{4J%8&opS*LB zBi9RLqN&yA80AN4>&kj-Q{HJS=9PgaECtO0^M!7Owxj{5M=}4^C4^x5RH_%U1sWXf zIy}ef@nkjX1`Dq?wv>8rv97dJq>0y&UPa|wPztz0i4P_&l7hM}D1AlGU@?MOp?czG zcnc&-Ws?0l%C-)HnK;H9gs`5FW3n{86G5zplXc_aoh!D5imbtBw7^RG=4sW-^1(2l zp=rD5xu<>oe+1%UV@P%8RA){9XmJh|N^n37q>4Vm5gtZCA$ z7MWuDa&`7en&ypDEe4nr$M5Yi3#&n$Z;)7~02Gx8iUfFY1(25t-;v2~3@=v{H}9P#AZYR&TP1+NG>%5ciXUj@T9iQwqPFu2%(ZHokYM%09%`qv$xc z6RP{1)Rmif*hr+2TqH{Ovk^|8mK-gCUn~y}n3yiXR&;`Zo7x)q+M}IQnlXmQ4y?*l za!FKfduK`OJDTjdt@>Bj895|0hV|7?_RtP&cb|y6(Gd)tCGn=K24=oFtZ-TG*qrKR z-f@0Uu$%p3Aa`oec>Lq+W?PY}QkhI-jeui?h#r{?W#e_$_%3CJp<-N7&v(*tsw!O9fQT;n3 z@IX$d4)H>x)D?guP7*YKYBA1RmIPhN=o0fiy-S&5#OJ#4?QzlXYE@T!cIiGg`I}L0 zYis1Qtuf3va@T0q*Uv&lo<5iv=uO-l$|7ksjM2e3Pf~@@&%5H#?qyVei2k&n{7ZM^ zlR$-QA06xA0rfWPlGtc({wDK#59y+g*=EZ`>&SR36Rqrc4UMds(mxS1CO>UXH2up4 zBnpYk@rKtIx-eZ#N8Jv!3pflnj+I}}ejhG%ceGe4sNLK>QrC};;zj0*wsh=iC3NxEVqw1wLCoyec3*TwRs3PfEBpYrAF1* zXsx>ob8bvg8*a^6`sw_P2Q31}nO(B}LUM8i(;eW_$L0$R2N7A$Si6gC#xu*;q<3)o z2dGQKsvMXeS@)5in-v3T>cet(+1I*r^ zgWIJ|^iGMEvRe;}xK4CwJRpBy&{aOs;&i4{n5|zLr4Z1 zi>26Kr+f4_8}gP(XPGKzD7#x8%uS^pY@G4fX|5gbU)6BkS4h1zyUlFevhPGC5u?T1 zk{#A@??q<USq98C>>2{cp3?edf%;FlIupB${4! zbtE{WmRGc-a((Yn?#7Jw(N@PAm)#nU#uwK_&oS=7Y~q;Rr}GL1%hBpBCwrr*9oBl` zd^xM^-ABhVvF81m%_Xs0JIf(hE7UQ1jsen}6T2jl1LH~QdT#Ctf~K}P%O|fM>Xrm} zX94)hANAs5f**ABe7b>3gW(fV(?6#Z+L}}{NI|h?l7{Ng;B$Br|mjKgFk7e=Fbt6`$$r0LFgx!s%4*#&?EwF(22+y z^)IdLHiO5~mpDrnFgU9oM0X18R+8tJk`6+yZre+iP7K zxhe$|E%c}K^(1@@oQ@T8fB|F{$^Gtpzx;X6>*77WG^5(`a*SzPjIfHW9`%#w>MxKiOvACVh`G9)+YOMR(44f04 zYPl+PUuQEu9u`|36&4+O333HjR;<10o}I(S!M{&mJnumc60M{$>*&qdw6W9gh9Hm> zlTU>97<+%829Cqn}RXPjw_L@ zVPTs~AB-tDIH)EnZEbC5h7_$O`g3}es@1Sureejni{{3O^6q`u+2Jg5@6+_)-(KjK zEZ1NWinTeGC;U_BwC&)r%FZ}5K0X#$qDa*d;v&7LeC;vX?)r3p80;2H9I*C(y#|oF z$&)gkWHZq*aTGLz0=_ERnWymnqVoS3H{o@uFkbg>%oMozh|nHArvp-)jKr1*+P)y1l+j|R`kFs$1~KFodb(9lwDb9R z%@VNx@N;}F)b<<_+*~aj_pCqNr8rpqN@kPfv9Z0#7CddHR!Fz#MPxVB9t10lAlBJ> z;%v6nXw!aTU!eE~{U%J{cM-`=LFbT1wI6Nj26~Go3v2%P=*Cq|X1;pMsWYJ#&7hMZ z98mb)Rfk*%nh=__+l^UR-ya!xFw?x`wJ%l?4!ywKZOlEd~#m&RPDIA!NoS>s_t|q@4(hoUU;T>EW2Z8p};XD9P z-r@cpJr!6Pa}xS_aztL6OfNrwhfC`&rh<`CVmQ9uy~0}5(E%--IGwek)x_$(mi;|} z{u8goM(Q1zc<7vbNmf2NcqN59)0@-7^DOU4Ih{n6;WG1P->7JnpuFH|O44l4Sf0d1iq|dCNHk*Uv#?b++zJG^P?>`V-W}585TBjx(d$wcW zWJ1K3MCLH=DS8hy_$GGL&)7yn;}8-vW!pG!%>IRjOBESOBIW`l9B57 z`tO!MgoeeSZeGQjf0>GLD|ZORygxfhzK#2b`tX$ujD9T7$u)O2zTvBOxew=K=@Uoj zS8YVE(WnNI`wJGt+ysD7QtohHdZ_9I|77r>LeF!Ia$W9NMbOJ8@rL1o{>_DuCt6I~s=%zswbn90>o?42+R$)8bxI3{)v>+o+Isc$*hy$xc$+`rs5WW!q+ zzLwsbfa9qwpAh1XbbKlnL_np(Gm&5&X&uL+8%-=gu}tjz6iO8~F--VR4Tm=7Z4MU0 zQlYsKuF2S(_I=Vb+|1Xld|Uk?O`?y$rI~tDLwP}FhVg>Y^hJ-6{}KaUSMlbo<)uUw zmVafo;pRA{Y+*(Itwhjb@=1#$;%I#_Y<-ljhU+lOX|}mb{~$Wc(Wx`r08zQsNi3XpspVg zUA3EA(KuKxj2KUNrGJ}7Y4TUB-GOeN7Bw;Bzi_ZS9Ta>8^g!_aZ&G&R#tDVWnu*Dt z@7#a;!a%q_*JggkQjm+|Q>BtWRf*%YrX%qT<-8NPwc8!;!fG~lkFY26)BB2y>eeYw z*R>d^`S^G~+N!%=mbbR!a8D?1n;g!23w`pL}Tz$=5jb0A0^(m%$udjJBl`x|4zLFVRPbKSTczl5@afy#j1; zQ;3d+&swI)#WP%bs8~OHk;K%a=rLXEXCd zkD8KxIr8*nq1cX@oX_uLaWpz1ml+A&&R8rYFObS^m$S_OZK3!@4Yg+R;cAV`1Msn> zL#cx3gE?n)QyD^w*w+K?g6`v;G;%kM@;BZ!`;y~z`<{VvvApBDO?md2Tmp-(CdDKA z-eNs$lJHjQ_Z{UTPTvw&TAiKV6*5ln@u}1wkL8}h*&4+02!CPX`G6_}H23*+%mX#QDt^U(iQ1{~D@=UE{a!W`3n(fNH`^vgW zFjfh`r72|_l^*}en-&CDz?|&A?*9C(QQ$0IqD@HByL&!A;qwLVM6lYBngJ63&NJ5$ z-){eJNAtm-#?0 z88fzV!Pu2H}8xiP#NuC4R-0di0w5k=5G)|nuFgQZTr|U`P!;#^AvLFZ5{z38 zIE-j)%fc{SeyhGivDnIP9f@95LDf#{-qy3|G{UCYCEv{MdTaR@_1@nzszuLQHgVd7 zT((X8z-(z97}bhb2h7%?HSb-GX5bBl+yTFkds&HvCfyRmu$P6cTQc#LLjCz;DMu#B zK0WdJI_x0#KiHgbpsfme*uhVxnyXFP5#p&Vm+&icglB@3bF5P?A%;m^I!8T6n|2}x z`F0AQ+ipIZ7u)9>$aS}AfB?-}?uP~fd;pBW1!}zE(g@k%#Sd8gg$7Y*n%;ZJ;xWlZ zGnG4rE0QNOI&RN_VLtrxo|I1g)--xMUW2oB%Ke|B(PDnZq_%0n%ui#%Xqwlg+yaEOb{pAj3TZ_)Q7GLX3gCo z=D{xj@JqawEH+jH92BVHyQM$g?b9Sm%?>CQ?s=gjs{@kb*+cL1vG^=i4xo(Xy#IKT;4 zA8|Efyb(XZPEWh7#x$8$Ik8Dk+S%>M3AO3pPym!Y{%^wb)Oz3YIFBM|ASAz4M*&T9PjZ~a(|$aG=zDanJlRnxr}ri+Ek#>s4{AmoiapZdgd%E zO*Kpjqt4|WMVQ(dc)-<8sxT<4G>J$192SUl8O*rNk8Hpe-q`)~uJv9E`PH@CfsMZj z?z6MaoYhTalk6>ZY4DU-t}cYzc~J8Ad*V1)*09Vm!a9$|8(djux=yQ3+>ziA0@T?< zg1ZDpw{o_s;S!?m%s9n){L8RFzWEYQVkmC!vF5a&s8?w8|Hs*T$5S2t{o^QEg|d>2 zjBLu@PDy6=$SxV#d+$nQXJ&7*%ifBtW3OZrlD!?a`&eShxzd;k9NIOTZ1ukqUB z`BHXUS>}AR&Lwk(fqSB8#+l(Bh}~iG7ww8?prxDgb!C{&mY9>Wlk^TmZ)qgf?A_8U z-C?%pl??pOqTl&fJ{9Kn%hWh4k9q0zxAU`D)Y==o?__8S^971ba->SDzjH0~@q@h7 zQp^Rxm5RhYk(pDfPKJ!|5QKd+2Cd7B{!T2Zjx=Cu^w50C*xpmyrJW}cH-WHST6BpP zcZF8gw@k0R7rea$%Fq>T&fE}f~NJfAPtWIyodRLv8 z`!0b<;)jOpuIlX*bi2=zwZA1Lt=em5X}sygxP7npKB{wh7Lyhcn_(O=>zS zLBm=wsx#Z7U-Yd)_1CCbb$Y(XTmN3wN{$N#Hu6T9;>{n`pd2EaM|38dx2b((PiNnW zv?8XfXQ2EnQsrv=SL`2u@*FHV-i4H%mKFpyJo_CI*reg& zIOnn`VeMo&{(-|p_Z#ELX0BQFK^!Q-hq;+G)V#&}t zj`8z&cXuQ_idJ$L`gzg~KU1SGM=x#vpmPGq#tf;H_PyEl;J9H)cdULlkJ4cY8AI_T^i~1WQX3|U6d2IAuex6Mazw% zMR~dnI#-$DKJ{^iBm(418++*dc58o>SYLxj6&$VS71n$s&sxNe1Ct1dA@J%VLb~{x z4>~t#&p?Duh=_&~n*$Mgnv`3A={-~=5n9r4AhB$ul{6G`Nlhu2T=1%c=5mz72E*Q2 zEkIPc#L_IMjNwT(%E7W!3wB@4Js*skaowDnI=#E`GKfOTeZA~;+bd9rYl6i}=kuL@ zBAkt@o_T(*k2{!Ddea_;;vBJR1jKJkfLP+kqoLoyyK6Evywg3*HQ~qN^Ab---1d(z zu9iEx5mUTHQ8p_;1n9az!<`ekwMb`jAG703eo!6_18OPtqw8Vii-`T8e8m9WeOg)F zq?C5yRm*w*Mcsq9IdC_M3R8v-wWxB-tv^*%T|Ha#kQYiT^U_Q1ab7jMEaq)VdJa(1 z8EHtn*{k8SPMGCB14Kz!rXmxKrMiSwHj9%*tD5Ccois{yn=(FYE#}7ViFTKx?E;km zm3w{biu77!(t@i&>gEsXoey?a)3tPKrsbyP4!*x+%t_d@`fcYvPYdh$oFr~wE*01|u4ByfVjV*RmQ`+EAb$kX0k z6c&&m?2_}SSnHam+#BYmB_+O9;1!W3wRayR-Q@tlt%MeDywQNqQS$=wSb6N%9>qPk z+igMbnQM}@96xF?8+7fXo0Vq-@~`%bHFHN$groX`2s1h|p0ClD=oh}cW}tC{+v->L zqsPKfUCEF!>YuPA*jD7choVMLhh6+RoCrQ zV9qS_|JXP{DbjuK-*7|B)mO{8#`S!dpxCZiWaY+bwQ*xF6&V`lfIEXlGRh1?i7Rop-ot zaqtw$<07phntb}^H?Ah+1rjrXM4h;`GuJ|l>l7B@!Q9cT+!aCd5_OyD)Cn1U_EV?f zv?fP@;JBeU`J`t=fb_Bye4NSO?`+G0rjb#CnOmF;yS`Ripr?5L?SGG+VBUWZQQYof zOeK>F>Eo821c z2@f>}UVkLBy-#HxRrsgP>UbwNmH(L0P5>>2L=FA};dpi&px19mz#W*nbnS)uH@acY z^?5U$={cKvTN)-NB~6n1DNVZ7{<8k}of7p{_f0op!A3=5>uC{U{&R}{1G0{16UtAH z>?Q;lwTM?dnEoCh{1YM^2LVCHjRORr+pglT)*~fMQtqhb zjr(0)-S=r_O{)`gK&!}ZvO)Ww4xiJ2k0@Frzuz#~_T!f3jMkN4|gb9}5-m^I1$*xNAf0QyR z)_^Jz4LHn<@3*Un;s8Mg#Cub`GJt4IKb8lbOP8Zg zP>SU3mit}I92Aoi`o?pg+q@&*K1dh^2`660lQISPBwsMVWsrXJ7?aDRf(al@ou?bP z^>gDmuonvgdj^#m7ZR(j@Bws^4TC3e$8{1QQ@fAd_2BpcAs{-(Hv2`M<2=K_ujuYE zS^}DF59+w!RXSv}CzzTZ*tn<>2vh(salBq6;=Dfum#U}0Emt7M?`uP4j*BkS3#ShXL7(-V`xO^0`UiM$!?eDv;hOK^&zKiWaoUc@0fPJ!fDJeR z;uy;2;*G*v!|b4UH5NPXgY)@nk*;|0s=;}#)SSwR`Xir0xF`CTS8r;a$q8j- zL?~I{eeeSdq3z^}&$KrDu6LP%RDhhTd2#R5UxdeSLecnZyGF=34Y2CK1q%JJ!%NSCevqihM z#Tdpp!~l2=R5iQ?s?*TC|5N!l%zamxWu*#R6T6D_vvJ%2)AI)?E{cqk%#Z?8jtG$d z!aSYs4O{P|t|$z!(>3nta~pPd7lR*sGX#LC!2wY0(EzeADLK!vVtXbB=;AK1J@jIK z98d#~;LWjbYiF46-g*p&jX1XxbT}YHh%W$2{BV_0_vBUBuTIp4KX&Ez@3Sc?e^!AA z$D|;88FleCk>KL^%lM&T077bw4mb1ZJ(c1Bp~=F?FJ$*0QRwbMW=&HZF0>cI>0=!Y z-qq!6+M8esz=7MxY`EN(zosnwY}m754McLqb+;|$bMS1NP0$hCO=rG`sCdjuyX6+hikr0F`V2Y4yY-Hsj;Fi@0N&jr=yIq1@V zV}CrQ4#DFGFv9%&d6h3-Fj$gD5`i}xBoZ~g2Dge_`J6oq*7Q?rTvW=mi5TnkCZGYo z#t+~JihIk+re$6s2U9_sQEpM$-{|=-EQti(r(^hsE{=(pN(ktHSAhV6`!Xpc>V&Z% zNFZ`5IsP?y_B`(%izjRVP)>z&){=jGde}6Cz{tjNjzN=oEZ|;t6ob7P$Q2tL6-76z z+e4lgdh7ICh~QfiU&wldFB~4&k@!a-hHmhzSfAM z%jYFl$*$MvPK=8LuFKlQ2{AnS@0RrXF>@YPC)n^PiXC`y#Y$~D;ruk`qU>10E?!{@ z7^r1GS@qwu7iI9k%TgyzVK>Fze$A#FSUMK;ltRMjyb?k{jBt;Hqs%=tQi%bL`vD)& z9^Fb%uQ7-=b&AGUxj!%T5hIJX_@INh{3#e}_7D$iXFtxxOQ&If+2$pAZ&#)Yg~33! z>__eA{CP?hG27G5pNC@QIC2WFR%TZ`&AD4WR9h}Sfu3bPGdNc4Ju(p_myuzqG+C~F ze?26@JYtdoezG2y3A_QOQ=7h?7&tOCfq|E&_SfILyblbcv9EoUNTK&{-D0}n8lgUd zS3Q$gZ*y~ZBk1n9Rm59&3tio1yk+Rh|B&gM8SR=Xr=r zKZ+ySOwAp8uN-`9<|90+AKpjM9b3}&4+%;_x0Cu%3GtGUmzST4Iwbh^q?Fb05=8iT zIkIr52X=9~^R4*D!p?&WkH*-Y<+^~|J9*2fi-s+(FQ6Cg=S;i4KoWM?|Jv8hx9WJ{ zB9{@0TlQ(MOfE-UI8Qu)xFswSqdKDIP#}}EL^a29(LK)5sPpCRRgwh1{=WOk&!vfv zm(YbL8VD0>PxYr3VU#H`82gk?$6%Ec=I(2w$HK<);` zAbrM^S>oB0xK22$yUEP+QOi-rmnW-cM#D?kEhpfanmq_ax9^DM{Y#YIkH#DO<~L_m zB5jbstOc9?iQX!d^y;GoTYG2$@0-1A?|)mJ|#LMwDV|+kpQ;apSu7VSC8{ z1K?G|Zb0N9(NQV8Kb}azGC#juulHH3{qtnQWU6@TTo}*#Z3oK%Phu+mD#_<>gRG7> zj81F5o@3X%G~zVvsZSd5*#8!OKK^nK7*R_D2L+w$P2`s5W4H;eYC71W~Aj8dBc zK@@sO@2}8MOU9)S2^gE(w(erj)pmh8r9-QS!$a~z4ETgUN-9Fd=!xgn5aW*w+ODXS z=?QhNv(ER1=FY?};`Ls|OHeq7ty)1D_`C<{EFUW7k&lX#&4WbN#?-v%ca1Ds@pA8% zr+2tkn&KPULZkMQS?X9^p=yoiA1b%RjX0&KKYr`y`aYnf)J` zv|JA@w*A+*UL)u}a*nx>%{nG-3kGn@$6WNnHR=y!+c72JMt^x9GaSTAa>WSX$7mDL z9TAX23|tWuKAHcVLbhapk-EqY0-*Qlx0-%Sv=p>u9|L zEwXIfiQD|Qw`;bsssW+BirwU3g)M0iA;wyVVDfX~S@U+4$1AePy!x$LclWRkb2?xn z&|%Y(7LoY2>lGs^<7GkjaF6#vbHgJh=60FGwno0i*VF@)7@`p3(A zBtaI8tt;zEtvH4%^VsN32E2dp;_dweQ)EHj19kDD`I|^fOhk#iK@@o_m*9fh&LBff2)a^Y_S*ni37Cqs_YnvI2--ZfbGBCCq zCR_?zS~tP>6{wL^HK=jn-RK{)Tuadq4- zOCOA5b*uCLauu@l=c_t@79PRm&wdfiAU!In^k$ISL}L?ay-W@e^v4RHlvF+O&Hk`? zr`NL&cj#~iQzKg`M>WyMYty;CYck)YQF9>QCVgSl?&Fs-I?90x5#9{VqF~o{)|8Lc zrbBa*Vq%|X$==Q+RyzdD#0AAmQHAlB3}WKSZ46geD2V&S43)p*x{X{@Wz3OfJW{Pz zqDH(q-y5_qY2x{wP>>VHuiFx0-$OVhWY_Mmr8fFLpk?i zhz~?oSWqulERWBTB0_a;>hE4~im9XlEd={Hq##1q2n{TlWkV6gJKD1pKiVz~GH3Oh z1dlka*TEa3ax1f=!Ms`4XE!m`9}lpwBuFb)CFy)Ym|nWX^5QFOLLsX~?|TOA2v2dS z2FVP{U^TA-sH74?TZIqu!*)Vsy#xJ;DoqERwa@Wbg?~MPvrj%s37-(5kGA(yUrt{H zTEX@<15Vv4zd)LrhO?$cPz{3`p>O_^gSA>k$RD^D6i>Q}8#7&7tBGFOI(OiNpZ84B8~5sJNN_ z9E~TA)}}afy+|DeNV-3CV&FIRP4Wxpqn%+Z>EFeCD_>r~)zmGH)=*B7z+gW=KXRiN zz|WdnHnh>v{eC^Vjn1&|rLXX}q{B|QnRAr;-A!e0OwJcU_x+RWbpQIqWY3X-`aWmk z;OjLVn>c8^8*FD&*^gz1IDF0uCE@Q=hwlckZ|ZYI3yW6{r(uFRo8@ifnCWc11s-ht z$(o%4c`7Bsu20LPB7o`rzR>WysDhfnj%DI){vLAwhEUt{?U)Ei zad1}?f5BjwY~vOG*C__6Fq%p4NC;pEw2+zEVl1K<;sSv;<>rM*p@P}_PriQyWhM$V z5ljaKyiVCNil6WR#BkWi9_B3d;Hfk_+KblB(mnVkxap>^`#oH0F=}tI*5kEXi(N~< zXx(m6s%z{mxx3%cL*phS6(@Fx)x@fJ*!RC53^kbK+w76J9Pkun%`2Al?!-&0F?a>u zX6)4K5LYO(i0=SBHBxg4(|rf+5pt<=HrG24bR8X|)GZ7+Ki|r-_q;_LcN|0V_H;*= ztzKV3VR_MTTdbogh$)u0$)8hQIfY)jd=CI};ZwA;pSRSGnGm>gK*-$%A(Hxuri;#+ zhdlvTa0roQW8E_s;9g8#2P1x55w@0iDdlIF*rjBK)a{mg%OQ|XQ@f^N;TGM-rAvpQg^Gr4O~L{ z2`Y1*HY<-&oyb>)70VSk>gJVW9fVP6weKqBv1J70E~<&X-aYC*S}Ze6+btJK|1JmH znA4oed%9VXy{jAIDrs`yVsk{&ARZd07Mf+As`{LjqDm5Ric!t3xnDwgmIL@y<<`bS ztu)EI0#=7C0|iISv|+*I1hALX>55Edd`GbN$t*ToH=6k^gh}w;j=Y;VHhU-ja4LHLP)Kac*Ba z-IXz27#R)p;YXzb~JuO;>4$n4{+urt`+Ig1h|n^lo&9(1|X`5u<0zWxRT; z)pjVA_n2_*<%#5JqQM8YBswu~9DTfNk<7x@KDK^>kq+!7b6=L?n&aTY4&4U_5YNC+ z$SFoSTJkE=49p7BsTqw;(cbYxQuFjem)X4{<8mp~a8ta z+jalV7&A#;A1b+;d0H`J>U(BX(#8MQ^df0sYU&; zQ_t;7Wo^eG)ln576p{WY6#2{^`v~kYni2-bzKoMFP_1fFQbnItd)Eug?d2CqN@;}y z*}L)R(>AkMMdFG(ma}?NeYzklf(P8P3|bD^ ziK`uxz!R%xPAR?)v-`M`+Be6t$$uL&{m0^#`%IK68S=5v)usc-m0Gc`7p@@v3nA6= zzQ(n{+m_=eN4ZxLd(cjkkdN0o2 zhXq0?eUQR5JM&N13{PE`7l_WLfGsg%dK1%S8%tS zYB6h~j(1M<%&p9?8FpzjuTj-&@f6W0OhuEy&tWb)4F^D;dFY_Yknl$(^F}5qIZ1Wa z=@p1gi{s%GZn9m7KZ197Y{Qwk=7mtp#TSZR7MFBi%lW+A^5Zk9qsld6$DFG~Jm2Q; z7fh2sVD_;BFZ86dIaS>5gdR^(Xx!ARG&x!63j%%^D}7eYIi5~Ny8G#OUf*?N3^SMy z_TCohy`IHVM)@MBfyEHVt&7e&psOUb4`s{dbGdaHPFPYdM_(t*;UVvANaRZjDW~)5 zF(Cyl6aq>NIaz`we4+6!@ED7_UEhz(ph+_51C!wbXl7`_3AN^># zUZEFb<)rP)m&b!VA!zV0B1;Sb7%eTat&@6+G5uEzzM*~gtNL}8c>26FH9+coM|;us z{HE}%p058DKVUJ!5z;3lU1xukob%2Pa2G|5;ZgQ?D?1X}f!H}0lVM2| z=9JW&QvqIIb8%sa;st6}(ToJdTfh4ry0bWj_nu|uC(wZ0x9kcIE1z6ctzY&T)_V*< z90{qQf46(`>6sMBsdH0{Uu=bX#}s6Z2(_uOgAUsmO>dd<`+t_5XqxTOo6mF7*P^L= zi@C~c`W0GLY#yNAnUcYlAxodz5QCtrehtO{WHSkm;43)QJUEW~s4{mqR=VuZGY}w0 zE_k$5|I)*gsMr}zdXV1`%|w_cppR%dV66#$Qr4*3o^Ypo(l1T+c{FTDb(Z_k#UM!O zaon;^#)grDl){|rxp~~RLGP3^@ISb_jzos&4{WCu2 z_$)#hJV=%E`ia}2*&(;p?8jIglKfQ59@@?2hMP=vX}Y91t44nGn;Qem`PNGN_`t4& zM?|yI_?g07K;aEAFc{tPEG~_!MD`sK3WDp*FNru&4_oK#NfNUJz|Grr99`prC&lRNn&_*8k%DW&DPfj*R%1?bx z9TTl8WFs8Nl763qouO1(ss9UihXR!4z8n)HneC%);3s&;1}Ssx;TZAaV9eJZjeuN} zkvHCp=iTTjGOX{%pR@3Ne3CiBrnv&=?hy^Pf)oG=r~Lt2{lD1rl(@&yb`2o@xE8E0 z(Y0XN9cs0vi=Vi>_m_n} zUI9^Ws&DHjQu7;pSgP^xC5H&*MA?Yig>m5k6U>psz!XLS z$3P`>zninlFU}-re8n2{&=N*mM?pt0=jcfkTpJ4}KAW4yoQ2`vV*p|WGm&olzt?8{ zd{~Y$R6lU35?fy~dTO(1d40lX?>oVq^SMmd-=L1i3OrwI)^G-seqwz>$WejFnpS%; z7V-Io;Kr?xM4`N}=R#ig{CdSP08>_XRmuX;fTmgQiCA=3`6E-={}-7$WTO#)p!-xE z_rLg)iEu^!*Pk3eBQ?p76KS8%>vS0;WFYVJ)dD3bsb@Yq?@tWnTlJfk!45@I)yuA` z+=J2QJ?B)DiVc-SgkFm-G4T4{RvhQs58hWvOtEl1>n(4nml?5?_fV? zctglBfN&q5i|^S?2jf`C13693%Q25&>QCBXMqlF^u03S_fg{=YQ(+nPh4W<$HcfW> zkH*8F2IwIJpJdY{w_j!}XSIdPQ&Y*iTh>lF3_kxczHl>;JmSyOYH{wZKX@#g3nA1r z@~vh=geGzRLcg#U1SBdEI9o-$Jwl+0uL+GQdnkQgy^wuI4w#yHJG^@DDb}O_#K6|b zv|t+d3L^Ad+(zL^ViRzt(3e&eLNN2sH$1zSY*CeJ%V!v*OkQaAT%~0#8 zw*A6$0tUEmYz)Rl{~49?vwP$oX6_P5sQfg5^q&b)IE5x$Mh*2w&@F6y4}J(|V4YDd zsuuj=!h{KxTu$!F$$!XvtFxq9W(HJL{NcvGclv<_YGmi7k6ul$XdfS1N85QsQOuJm)pcGb&?5Pl7xLItkbQbv`m4Eyf86CpC@wi z@|5gU!p5{5VxI@TSsHHi*1Sf(^4)AOEqX9bSjmDta{hE{z%2M6V3a5sUDYXLzdn8a z`a2NGtD*rJ7xr>gDLrH;Ipl1{Kp0q3hMVR)+jIDeaVyG7*|2bHP(}32zjRMA2^!ljmBo` zV)3dsJ$V359?hMTsM23gmIe*J%CFPS=%G~4HM>O4D?x8k_}Qv`h88`Op1hJsuz>d6 z$+u^Amy0L7F@!a}>4k(w)JYweU@fqvm*(O~O;Ug^x(|HPTBbm_nlnkj}~ zrO=Z7O+RWTq|i(cm}DGHvQloRNmWH3_ga&1MAT?LZ|`;%V^w_2W?1D$kEO;2Fu8Pe z#^{A&l^8l2=^z<*$ZfJuOOf2dfDyvDU%wR%WQ}^P zTi&{7lCyF9sJd4|BIJG5u4qm8%%jxNmkPk%zU6aT$_cRq#bt%w^_FwVR}VlE42unj z?D$R`4+PzZSfu`cbk)hqyn`Wy0-~(zzR~GRJipyCt_}5K-o*40T3f(;jtr%_M$`9K z>cT$>fJ+#g$>jhDG@0^nL#k~4J9Kfx@s>4(maCA!&J@PMW|;C;M8)#WB|B|ode~qs zx8;M7wCrflpvZTf#FsrP4dm1!k)`2eCDj2H z)VPe)=T8XEx7Z~}tJY&*Jwe3Of>-6lnL6WV$`pu2)$*RjrsHBrmfx`otdxUreeTjVrG%?S zKWP5V07E1%|D3IUjRA~A$-77d=L?NIQt)VUVJ;I4KX9%N{Zw$e@olv$r;#c+#7aTn zaK(f>IE3N|7^JkyOhWjr2hglOy_R}4WkCDz#FAYG2xNRJPYbEOeahz8{YcFu3D%R* zC+dJeA8X~-5n<0=2baY?=hBdRxT-AhwEM5@DSE}@=Pp?r+>j?k3T?iZ_xnOE@wY(u zk8 zXuSgs10zvG#%1==B7ju>nsTcYfK+rXFdmg79n1S>S`G;dPX5gP7syb64}8%v0c5HQ zucNxyKPM{XaRW@9uS>6e-;>_7u!2llo8OIA! z8N^i>j=lIJWaR|Esr3jQj#RS?-+=I;g#wHzzONz`j39K=Z#J41-CORUR2co( zih=`Pa?vOqmrevPxiIGWqIhP4dOSq`utQc?brXycd`NC}ao`y^S1JX#@k-!-V!U>~ z6Dm3TOSpg|o49;tyr!edG}t!*eQS?U3eWn%&2f;vIzl1b8M2)*n`XSh0NL3DApxut z^A!{f7GyMeo_`uV;w1xK=k*Lm1U&YMlmv;hGl6q_P$<$UqWDofC(1k*BJ`#-1{ho4 z_Xzedac*qxT2$7@m~tn)5O}G@2l=K zdFO=#R$E8YdF29OB6#RrzvndO(V-Qr`)&42?jLU_Q~{AVfo;{nii{MLdc|>rydw{> zb_WH>iA+qcoh}vI!+jZrkRwa6{%#uzjf*DM^#s3X_qg!Rtlv{b>OqME-jWEqKEaEO z?{*TOUxcXAaV$Wi1)80FDKt^Q408$;AvCa3?jxicev)5U!lSAAknRKznEE-@PM@8j z$I4|;a#NLHGW;nZ<%c@GOcaL9t{XoaSw%94L9X1oE|RL^!4h!gb=nEB!>{Q06J@3Q zz#irfI9wPJur?;rk%<55dq8lMc=td#rWTewID2gnGnqt_`+<<^gt446WCwzM(_-t8+i{L7p%O813!_3gxXaCpulOsDHEckiKH+bT8KWu1QD z(!sguV3i<%li;^%jLHki7@Sw|Km^fOOj@BZdd+mO1M&CXu#G4YIE+_LTc;$W+dmv>aJlcs~Pf1pJI-g$xqOKzqB{4SKR zcMTXIeCzIU=MNULhIYH-Ktv#hO&O{m`d-4(mJKYB3>i*4q`xkOW+qCFsBY?w5+^W( z8HRwAp7t;X)1Ol8H`M08^C;vpw7I!0$fc#G2I}<`)$HLp2{(S7BJWT}HC0Yfxf(F_ z>+UZ)xHA(i6#8F$@*oHojJP+G%K5NX{bIGw4T)#dgZ^uE(6N*URjS>&n<{C5%zA~u z;z;&tk!gf)OL>hJch6djf-*pWiBtto<#vll_*ew~VQ(^Q^)Krs9_6-%RMR~za|DI> zzPpV!xyxH4yUADcu-GcKuyjKiU#M@ajJdVE!=c78y$RTQIH>E{d18kL;&9E!>}V9} z6q$IAhJ#?l4@b<*$6m;6TAV*lxIFO!(rtbkxO>z4?K!D>MbP6#Tf!GDUjU?mWQPf5 z3@Dqj7T1i^P|7~k;4nUvH=A~Oa80uF}|-82@uzdjp{D$ ziwq9dw#pI6co>>~Yk?VHtZvF=$Z;I_QfjsDD>>SlP}n+Y*5*6{Db!It`hV(YutnKC zYDeu*H+EW9hbKW%gyn%s>v)UPCvV}TC#ZuLibBO0SNbPze^xbl?lQW7^#&9ir;9xY z=2f%drkGa`EvRgiifauKmQZdU1z0PiF+*!t4F*f&QquB^?EJhUPHU6h-Mzl-K5>KA zQVGtBWGZIRXbhHg<|!Lv4NvD~f6{QWG= zF(*ZnwSEuOYK@9`Z~bF(eJg-a!ia|v#ob^;&Vp{-$rG~-I@ddJJc`eM5z>wJG4|3S zx5YyMWuIEIpu~H5-|A<|ZT@hgt(mq%bGSNyz9C3Z@b7a{_Nk*yQc5fwA`aGvr?D5; zdgjJ-=i{9=)(LF+Mdo5PM}Ci}kv>@;>UsXUpo%0=uS~;ft3}x=9Iwb+@o+|tr;ZA^Bpw00G8Uf690nWgTyMYu$2m<+X& z4YiJVc}V<`FQbD!k59`eTcbp{T5Z+0H%CK5mEDXXRn8<>TOPDLX}WaJX}ZcWG$@T$ zk9~<7GW2xh|2CFKUfI5O#N)f%wZEL5Ucu5q!L}B-!^|qlX}gS{>V#2 z>`3wzY~+2_asyV)(?dT0Uq(-tlBt(mtbaZD+VRTQNFWPF^5j+@7-l1lJGZVk))C*= z4_bmUa3^0(0H2|t(hZ|KLpiBc{th(6mfJw^juVVDe35rcv>%k0N=C9#IAi;oshhsC zU}cMmP8?<%PkSKiT>34VdX&#|{TD61n=*dCuc%Gz)3+(TUf2!}4!fN0#mj@teVGbD z3Tm`sUGRf(kjudZJ!d%rv#z5H^NFA$Otc<-HrVBXQ?jXM{K{?$jX(-L?O02kS;%%I zVFl5p`c>B0ewoU*=rioN>-9&@6Z}le7QR3EP4ipnHAB{;_+p&iQkhh*jFKN|h;YH~ zC)tdBT{w7KSSZ(>BP1~itfrkENkRLA+WCn6_y@wosJ~ormn$5`Vvi0U2Zh%^>opcF zbog?xI#n&$zTGgho!JrCk`@*Y4TFls4zj1r8B9~`Rt~JQGH;Gurg0JW*_mGf!qy{K zk)|)&!K;qqkwHh##AT;A`2|B?GcTbS%yg#3&eySSruXea&Kxud8jg7;V_Dxk)@EQ| z5r4^(gAi>nKM1#KEk)m+MUaiqep8GyaV8VHl7#L#j_=ZW#}lqq69h{l; z&orQLg+c~*c@Jq51X2AO`GZfagVIY)oElG1xzU&U{FVYo%& zZ$6upIMp|I(o669tUG#h|Cj2tHS}+D)t6vI!FEzztY^X*?n-zwdpxaLURQ*h8xFF- z+%U8S2Q_!!%gD&g!bg5_C?_dIs-I)D;ei}WLvs765hQBqA)jZxS+hZ^Bs(CM^)V=A zw~)H7^iQ|9?J*PkfpnH_i;kLE3$P((Y+9u%Bea>uqc_hp|6mv|x{xPFjK0ou*E zgLAc7tD<;mYk?9CdJ~KL)SO9pgF1DjDs$L9Up-{)RbygD#;1uD7GxmIdH#9uL+wPW zw}KOZBL$x|Rts?ExWZklPnUnL!pX7r)K6~)>-;{3pc~z#NH0#d`{)zbfhktsM!Y3k5Cc=Lpj-Po87f9{jJ^wjCDtN`U zpBKPy6E6<&Uj1U_aN+vSZQvZU|NRQ>l1T-BGu$;p!q;_Y5u}{;vtTYebJG622wkNXn(QZ$$%z_5FS81NgJ7QVk-;adQrYEH-XSvN0bGg8=n65~H| z^M6^^$uW#;jVoy9KQr$ROWT0ir>Hr>y$Kxv7dT54r-0b(vWL~&z{s0Y9~lX^%pK;F z4P2eLjLnPtfvsUNUhDjv1XYkz>cCnuB_5?>Yat@<7X$sudbQFf)KaVi^VlLe{+9R3 zx_dkdup++jJtLW_asIi9n1|&vx%u_fzQw3CH5=iR7%XgJAxV$%MI!ixu?~3?kFw7v zgVcKI7vehE(KJpTmc0vh^Ze@!tMI0FeiV#KlA1z&-VBv0pH(inU35?D0}A;*-}sEj zjb|kHus)#dFvn{j>_QgX7tDEdm#gc*M-R4jdQFli4?doqXfhKD`o9qt>sCwDvNZgDmEL+IDP40l{Yx|bVIc$pMc;2sw0 zw=%8fb@;~MFGUo@Qb($k^2_Ugclnw6 z?lTNC+Kp${?G|q=RsO$82{KLO8+RbH1`**(s&aC2y2CT;^%LgaMpV#(%7>w&9^zJO zmucF#@l-N^Nh6iaNGEAfxUqKlq~jwsC}6@ zGqr~n(@Xxl$+nR68<1hv9>)21nY&km4ws=F zO6!Q?%ZnAnQrEpk?o0|$gG0PC^?y+>kcViLmhN&7-0oXtY*qhSi{pXJs=n!tO`wEC z-V3=ujG%kCHG)~?2`lZGnXAr6(yhJ9eeHbY`@%J!j~ku-0#v-U!IO3(x=l4+zPlwg z6#V=eqi$w}AKgUeK_={g*&LZBhmOsF;lb?Y*w$A!5v( z?RAG;=w%uVZiJYBOS#UXSpS_O3%%#@@(RsNyBZC14a?(9r7Sv7`?(qnN4;Gbs*ql) zoWw6n5GnacJA*>w6oW3K+IJ&VJNv=x^|Y(DU=XV;DArI^0LCY}bf#MaP6ESiKK=iT zvZGQU1Kpl?IIl)jIc-5Hu*T>Yhhpcc<}j5(RQbuMo1JxU;Rqu1!GRN~Z|^(uo-!L* zEW4%q$rrHPU=VI@5}eIteP!nGXx4A9?WLLQ)|#m5;N>FzP1XN*yZ-n8WRfl?;U%b- zFQ7QAWe{x6g^*TqHsnp%990YFJ)C8Jrt;L90y0qI^+T=~e^d!CUIDxjbU8fN_1)nE zLDrcJlM2P27%9M%#8S%c`Rb2V@0VQ6W&KZgaJ(AId`KxGl-zf?Sw5|qciEY&Eh?6_LvZhna%8edAoLfbTB=G9Yu!)vt)As_ zXV7R2N?xc4^gS`aJS}>eL7?~t%)4*@2l@8j8AoJGpnXOrfaoa0k5sVvcgSEsg<}!j zt`T0Gq%<@Aat&u1q_o@R6}lMa4vf)q$iWuW@u}xW7->#B+>RcdU%>J;2i)7gMGVj{C}O!|4}>wvrE!lF6TD){?^`x z`1{vat_2xg(MTMs((lk5D6otFIFqHErN^^T>ab3l4~F1X$?0wyDyBMa8kP&d&?5|W zTe|Y9u+6C?qzh#b#jpE5Wk`%h4p=x9n~b>DIk{VmT!m(3`0uWZ0X{G*WIII!d5LGY!?noh8E)2CYcG55su=b%y@O zTR}p518-oX^4fPQ)zn=p1AVf;+S=*lBwC6Vl7;|lL9Tjda`XmQO;*PGveUS%N`-AK-`Yx5clAiwgAUs3h~jvvw>b8t20pol zG~DFbP&Me8Gj2BQmC57CP)Z&yGb*WM-*Oo!eO|!CYW_^H3`o%@9*shGK(V3!D|9zv zf&CK9tN~*VTKT(A=#;W=s-#|zbNTrVjobQnPz+yW`X#&B+1cmFvkLKtyYrv+*El&YM$O@_gxd7<02O1Kt}X}e&9Ez!PpO<>OJNU`wW#M^_cStNY@?hx z3|_Gr_TGERtdzU2lFz)D-V!rb747Fb8TP56hU?vpjGX$}+M;vp^gmpyhYkTM2o9T# z-a7$TeJ*Yz@x-!fhYR!wu~mw6=$4XN{Q z*`1X-3(asaD9F>#c|zs$Q}w;3tjYHxq!F+~SmLTpAj!yd)n~I=ndF(oIXRp1KxHiw z+6b*B^yo4yyrl}~FJWL3cVNSd7o+xyyBlTSwjEo-1$Fk{ykq&*R)XPY6~cO}(~UA@k-cgiDKtAkaG4Do4dOh?StCQ4V4D;2)B$F_$U zp4gr`ubW7N6W<%mcJsONEY=JbgoV|>dy7fu0gZ% zTE3eMVZ^u%twigNe?f!~>&u%7wPkVW-~rmzXCy9(pK@F$>9mxoWR?w)6KCb9z%w$%sMkUi{H8 zO(5S!0%nP0J5dM6u*>o#Fhe!HfqS_I7NBnab?14Ynng^Is0kw`R_;YGtAF+0AAuN( z>j8w;^u7IJCmk^4wLABKd+oOn3^}Fj=xd|3eZENr2V4WOHD#yQ1skd@S&+IVDTgWC zfzHIckUt})h;w}q&Zxn(Io}`Fl^1xG`>Ggef;9>`D@*ruRx{3qPe>vrj5~9ok+hol zo;zM<+)rl#P^Yx}WXRfTsIbY$u>gxyfFZVGBj^AH)4ngKRvY72M|h7^mN8%Tvx$C| z?Ljvptv!q)?%SAzTq}ku`3p|T!>JK^Ex-G4|wvFQwK zi?4y?60@-BxXpj(*6<=eK%O6_&LUG^UTE1sf31f#MwZYs8+u(@fWoY1-L#2LAv(=@ zrwq*Ksn1#%EUIbptXjL2=vCG7{9TLiB`R!&Y=iobbxL`RV)6@|c$hhoMW=%gR^PL~7HZ{xrK*GRh2>seWG7j6Y8zrG2fI+pUd$fLcao)2V|MFng_0Ut( zqcw`%uxa0cwd!GjM1%`-1Xd}uG*|yOV+E3RYO{OY2XD-tE`eccVT~euCNVRbsd7(D z-Ao+!yS!2~DvHs?Lii`z`+LV2y@3|4(C`9 zCh=g)?lq#R+=``5bmh$Q_}i-=Kt+2sK~qah&mDyhlTJlKyc?CUI9}nLP%iy;zDU05 zEF=@P-4Svy=yU@KQQT&!N1FeRQnXP~=Rm=)CVegES(|EfugpHNp6+gR<9U*H^w9e2 z2@2O>S8FmqO>+9qNJO&eR_^MQ3~h#wq>6`e6dz*Z{Zs%p((=1}-Ij)*jXu?B<*pqV zPDEK*nadPKxAYFRZsexb3#q+$`|aO~i~m3n9yjQoaX>QcH63@ZMGCsTk8yJ)DBEjS ztNM23>g}YuK-RP;=rkE|%F_y{R^8OgPGJ~IcApY6RHxYvHUJI=n7&*Mj0ZyAEg?c+ zS%9(|(I4`KCneu6e`G1YbxEX&!OjCY#w=k+TV)fg{kEhXxg6C)%Z$ke|A;+O=N~k` zD)?bU$z!4V@lK!Jqh`K$&~30!?Gou8zVdv`4a@Ydrk~3|s-}OQIX?60d7bWVt4hNT zbIrypb&L9GSCJM@R05huGs`+QrZuk0O&wYNH>K$#r0@EL6m*zA=d<14ws1JydB4_P zal}d@-@oHHp)T9fzH6GiQ09}&^L%ehFjd2=y`jvI>Z{$DLksHqj!|??pOE6q^+TuS za1bdWOwU%|DbUdx?8x#t(c7bWV5*1~g4tjpApn89fe3)mYUZ_ES@S$W2W(<1|cuMGCDs*s5SqEqsc? z6gYMJy+DNCJS0~&)#fL42mmiBOAzE%7}1ZlNvp1&N&E$7IWfJbl89&qg{-eY zRzq(x&G(ks0T7wdV9JcJb&2JxL^%=-nH3RCERI>jDcKt>m z_)+Ud{10;y2l?^h>4)`dN@3MxAVm{|&t^Z&WOshYaC*&KqE~QGqG_V}X zQO%{}erO))`=cWkS~jV`KXsE;D{l}o$+IJfw0-IUEOiY$P@Ag(pvdIeHs8cJP;=go zt^!2YLc))0{!nC>xxLfoTC~ss7CL8ScggO})-J3zKYH5*1zTAoJ)eD11K0)F>0X$4 zl3yBVP1GgMS^EfPe9x40?w9#f$Q&Q;+Hbbo$s0PXpG>;xI`6H{4D1I|@wevJ=7mS} z|0IC;mR1a%XnVrhOTpYP=T)cdhRtas7&Xwv--|7IzNV4j64?ko#@#j{diqB=92OQM zFw2_H);VAiMzLG*<%w+1lxANdIaXJMXIOLI2uz(zbe~705@~26!LU>XLHN4Cv<-Q( z9bL9Hn3K9s6k35L@78q+c3Rd3GcWsIHms2Df*DrUWm6^*c4D+vljAl+)ds9(6(apr ztG#Py)uu8NQw$xvYQ;ao9?{i^X?BU#R!(hPnJQf8!?(y`$)Eqak{=wk0HG!?=*-ng zWTSK6%u~-sjlLh>cPVzv_fJFko4R}VEicqZLmr1QD0JO3k+}H}3Ag9s`FAAB^RO9x z%}J-V##^KHSWcSy3ueR{X`uB7!jP<9;xT?7T$X55gx341gOJGdhkk2-g z@sxr$N?i7#=5C6FwbtsM;w5X_=9wB%Nm{vsH)Z!jwQCda>P-_-9F9SCBdK`N2;{UE zZ4;5}jQ9a@y&JYuLe0+Pa3{vL&jYR2T_^E2TR|;TG1?8gzY>Y*xA3*lc+AbZnMMA? zSbQ9eVp%X-iRA^-y+O+RmU4j_x$>@39G^Y_)()78-DR15s6O#W@g-7CX9A|<&PZcm z;0gK!dOjvkFGjI>IN_^$cdB)Rs%@gQx-PXG55DIi%o7#+JEMCO`_$YZL_x% zNil22^DaEf^ohDPepMIo{~~Jt=1Dt!BHuGS1&zi5#YgS}+JAMzvp#VBrAg)9LQ5*y z#6p?dFB*(xi(voNDS(e8JVP>S<+fL^9>0)s9{Dm=KgKPL8NR(Q3*R`>xNw_t>$bEl zDnoZY1QZ?0=V-E_aydDqRrN#Tse-}W$bwWIX6V+?_7}qvxpqx!62jdBFGSHCs9OOFlld9;an%$LUu4F4z z-u3?kMxWBAOXmUJBdtBA9VtZQ6k88T(YhSqUJg}mcuJeBjXJ!Sh;YLi%bOloysrAgo?5d_8)QN6A(vG!`!xOuN+dHf()ECPrHmLJ3RJ;){*%f^L2iXX2(O~;;P zQFiJU*>7J6&wNFlF=RkPe|)%i{u+-u`8k~dF6B9;KqtMtTAa=?=*pBWo{4pu#<`$M zbz$d6*o*M{mxCO~ZOUBt8l#(-aS}N-yBOc=B3cJLF4h`dWr^FBj^RTFZmk~-*G3`6 z2f2<;J}3Pp>Q9Pn=j6^bAaJ9~<7e84$XOOmoeZ?_6>7DGAux>%(f5?eJ43MD?JQXB znWnwf><%{msXJuHQ+QHa`8BZ_Wocqgo5`f|?whzLM*jO6IYTXt)!1t$B3g_kV{5iE zk4B^>q77o%fD|yWg1s4nZRekH0$sop-g7O*g|R|8SN=;a|zUmsOD2fFL|up|MxnO~5W zy-@8q6;*SbcTcll?O7Gj8YrJ}c0WiEa;zD*+rY!uT;HZS5W-F6I%_=eV3o@*oFU+W z3SRov3&12&rnyI=EQ(u{w4Dv)e`vCfPxLlh`T2=EMmHW?`9uYusndQHhh2{vgV|YI z(ke1>#TR~k;@JxUUOQLTwjWFYlE|xAzJAK#y*2U4#p2Rxl2ngubCgk@c!a3wlv?A3 zAQ~={WqZtO5l28_;@C&5AZE;KBB@fRwFEYGrfEMX`>5~D>`q(W`t0URLoZUEY!<78 z?_$>Zj-|w6UwZ%7Bfyb?Ou&8j}--_omZZ;-=-z zk4DS(=iRy;-b0l9Spc8Oz9tU&|hGjyc4(O~R8Vg06l zg0j!hq?#&^qYh2B?x^K~92bpz&Ak;5Or(J>bU#&{~00FX>; z%l?6rX6qoeH-E|mr2Z`;_VrV?6Uv%FC}n3+P9mDk65t0~LX#a!z|eaHckPho1I_N2 zNiMsRj<1Kd@02{+^P$+~oA-vvaA}@tGw(BfZT93z$%td6v!mGLwc`w7?708U<_F}j zrC#>(pQB_-Ugp?Y-WbPhn>y#-qI#~Oq(+l=@fT11@1MKhKak?;=Q_?YF)GC{Y*cM~ z{(5Xit`KA!AFS=SM0M&aSWo3H%YbRZ>CyW1mGF&Fs1cl3;6|WZJFC@Fjp7G#BJT$WD`v?T$LqZP(zN{t4F)j2 z=LYr`qIYSg$#Lq8uPP;g0%=(AVquZ zOX0^!n|8;T37@pS3QjX>-X@BGRPIqA3x?>MW-a6~NIO#*o!Av@6Zg4A4yGqR={jLc znTM}o^BA(*;A_3I1SA!z*Nsh=*Q)Z%(brQw0G}Qip=bvoWn1U#0OZGBM|{x1#S2qZ zrD?KD(VM_K%i7vzfhsv`azDq}cURKy-@ztY5odKMa?PNcXfF8y9xC=h-s)hYhzoGo z9NY3Nyi?E7e8k1AUrFI7IQa2cBPl#lMKfC?_trp;R$peo_avn3X=>WYz=IRD9KIZH zB6ghD4Q4Myg6<{>Z&ZlUSytgIpt*@8&DBhy^W@pamqcKE;vkP=hro7fz3+W%H;U98 zxGlcaNonz@<>>+OLigYdv%^8&#YIFS?ApDaWoMSf(ie5qMncau{9v0MQ&G(pg27H` zN(45+F|gf045fpx{bJ-U>0Se}LhrGrTdr!X%7?@+vp1){Y|$aCDf2WRxT0G#=Vs3* zU9(pGE|<&=q-eUV+KtRL@hz--v213Pa*^#nDR`Q4p=O;RzYphjT!QX75qbKGa3Flj zqgL-wU$iG@JclDVqMc(y>#2|OKoBRa%EE&Du|^8)Kv{&(eVnj2U7m5)nNcymCx_KJ zD7v;M0e0f%?Xeus3~^`JU7qt}*SO)(Gcbh6onNB7r|#f9IExg_#yWom4Sy%fl-SFs z4fAa@XSu$eKiRgMZBpn>AHzShfbP!GT>1PS`y-ID_eJJ7#7C;M`_8g@9r{AFJ|3tX z?$A8d8xk>Pd6zv}w9Y>SQ3mxC$6e|F&?2WSd=`}EXVb^=pWG~)bcgjwO?*#jZw7?B z@U}lC_bJkFI?WhogJLNL_)GLUmNu%w~KvxcCvnqCiw^#tbjg_QjkKH z?o!E&Ig`}K@&dcJ9R^yRs~L4<{Ovxoens)nd6pe`vj;Y%d1 z|L~$9QvTTI@&Fu#tAVNGK`3|M_ls7S-lri=t!8GYS$^#+=Z`rjxKY&6hix$r8{mI6e8N`Y$qJ}oqWV2E1eB? zL34u-8y9|GB>h)vm?6ihs;aY0<*v^9NHbsakt1Lc4uY1uIG0qsJnAgXLTdEJ%zNBK zsXmoJteyJa>O{U)sXbjHt6uC^S#TD-dXv=pL93~yCuOLuAVrdBXM$fGb6RrSTrVJn z)T-Ex7^~dnF*1#i&G=!?w{y(CR)@cvsQq(ULG8d#-qtiCAeCmjUrlyx;2;mW!13fs zS=SPmW7lI@B@WAY$AishOAcG<_@%j|#pHV{uz=8oL^|_|d<*<4q@9^eNw&su;w;rG zZnaMvgJZwKq8K#?%BiQz-!pjRir?TLa}@{ zy=zOalSf(iM9gLX45Nkv&f{oAU%9P!^#ju-=C|*E3P0)@77t@$VI@+1bg6*Q`@_qp z4=xJ5<$3h*Qr6kRA79I;e383xnd;p89M$*sX$?4og%C>+6T2KOT2;gYrhoy{G$u-kKvwK>o@H}m9xsLS2Ibp`(=y{6~5sDziE zwdYR`kqhk0rmzUB+Q+$T$*7fmi%~;>g}ut&BAHsuI?-)yLhy@6 z+=6m3tVW+%Ar?p9@u^&@^gVQ+rlK+psbK?Vcl@Z^J)T{Da+}OY#1x8ja}0JdL8JJ+ zgDD(|&5DW)HzvtmO^{ZWZ<=+zyABsx^D^?cIx4i%VaoT(@(JYiit5biFBf-8&YeQHAZX=aN{;xlOBtlw*AY zI#cloM-mpuV^Z@9!pb*BP~4gCs&E)>kRM9RATOzsdUAN&Anx{BkCj@-*X%M zDA2nbHRjz-82gsE1|~686dHSZwsqu5FfDKIdi@C2lW?wN$RPOedgn_o${0lT;SMX$ z(D>Wq<(&M0a=i4Ir+J+on3YJCDWUutuC~M>>PFNTH}R^pSiJB zUxwT8T4561QE{;q;sa$TPnSatQg@i`J)?q?K9Fo}Qs#*G)MLheiW@rd})6*d1(AKFBWwvKsky+ri?2d`FbR1)K`lz!D zi{U}My+DOCOj*b~Sb+e51>f5>Gp0V=BnSfQy6RW+?)uwo;KZ0fPr48re`$$E(X~hU zk#JfbujL7)&GE9WT31R2pDN&yT65?SE4 zEac<(a_KW02WAKG;;%E)}yz)Kgvknm5K!kXP2_s39$8PTr>w%4oh(W}$X z458TL<;7>`2Xy+=vWmnC$;vv-V-HCpGGsGXtS9ECat4Qe%lLA2<+fRIR#eP*BoXsl z;DEY+=BQZ=XFh~koy8~)ZWp$YS$ahErWdB!FR7|ls57^+MAD}h7J4bbGe+3OrsC^x z4SWo-wFNHYLib+rB(HL4Bz6$M)97tOca0ZC)M6 zf3Z7FRPn(k4HX<$hoNFdTX~ndG1q=mJ^7a*_s1L4`7hhS*v9a*5g+uyY|wdD*9H%d zPnAkn2lSTa$TKwXOn&$_BTdlSp>4O81k4=a6nZ+Zh!u-2q$%+7eCVi&!0C76JUNhu!@ zJ8rj6qj&^3!v>t@I#a@n!rzW{`aM_tox4(;=zO^q7&jQ5P)ZVk&xu#INxCYtbQW7B zW?&I5>qpQQnX|oWX>PB`M#1y(A39{d)76mqvvGW|C_F;ajMW@rD=MZ;cI;yYwiDrN zdO3Dft-QP4{;VzF;Q9DYpCNCk>vwg$f5<-ksvQ3O4bKMMr`RBxLYMu-h(`wpbW@|F z9MEy`!a^>3Zf-R$u7_M5VymIgPJ-aZsD*_EX)5)wZi;bFGzQ-;9qWax3nPH^K3=a# z)7GQ!6{n=2@cvhRzFwK9Q#EddCM%^8ZjYL2?TT~Vut5`kT6pRHU!Eu1r?g!En|<}i z^~hogX{%K36{*D^TFmuc?Iubiz^Z{)cuzH}+%kAsl@?ne1Ves1~1y|$9>$<=6-3BKT^x&FiC z=rPId_W~Tmi!dX+B8=c~N`Xn{yn0D9-%b7xY{_i?oX#en7zwy`ilg6BZN0Oi6i* za-MFlrNBd4hzq^Fy`4((4RLbrdGbzoROG*VHnhNlIRQSUZPn=)=l zgFlQF{QK*9Nb#iXSvXCEehqcmW>8nU<2jND=b{v@zrDS`k6dnNZ#Q=pKPu@om%~f1 zaWc$*P0%)+d+qnLI)A%U{_qJ&BFxdW$(~#aUZ`IN%l+X;{#-1)^XMf(TiQLW$K~rx z$NcjbeiJkPmp47TbXy$HB-VJT#1rWC!mM8x<8{n$)wll@BmGT`{?C25QTW5@)vs@k zifeOLK8}^y*_pLhPN7yKXBf5Q#GbYoZn&xEB}9(>7^{=)!=zuhAA^xy``wh9U6 z4-vF!SfZ`yNmd4I)i1UG?Qi{I4U!??(vK<0byL90Z1v5L>{dEFPyBW{;y*1s{?Y4+ z+j}}t@r^tH+`)!;V^Pmpx<@>VpNi$@PQCx*L;vl4>0!KQyZTsHeJnnMM|s(waqsQ( zqb>cDa zeQ44DVP+@(?!PJcyYb@SM-a!pX}f$!5#)=5DM*$#js6tvS`arA%WU8X1_SQY;2V={ zN$!VPR%4}|qV5A4TCL|9Fn!+Z{K&5bXT?TJAWEnZQE49g583K$4~TU!GyISFZ`c zGenGj4)_cslS@mzpFC~bqu78~`VO;h=||v4)Cs!(?e)DPP*t0_gAcE-v| zN%^X&UHwPLi)Vx6)1}^Yzh>e&jZ-EdO3Y(5+_S)4uAfLCSC&X$sw2p!ygrUpn{?e) zuykH485)&p>oJ;Zi!6LGBax+&>Z|9xln&70aAok7eEwi+7Y5(32((LByl*b42pb2&o}-n z+TwKODWM$9-NF=X89k(6cTJSkLci*E?Bkoj2~idpHh)h@Inn)asn7$sKn_>(*Ng_T zHNqJbVt=ZrF3YBP!1-6<=}+VNGWb~P6taf+2Annw zx#B*>ZM{d6WGlk?b$|LIzkkPw;?K+j*-`fAMNug?=BCRY)n=c0s+Yd3$=Sk!(<5_!d9@}O0JLpf!d{fOB^pf z>;}`%^yWtTx$i(tj$Si)*xo8xugEm8BaXkjrWe?k^b|q&(CHk$&Pe&FyP^3thi#Li zl_u>`s(E_ISGODN6Txe`*;7$q0Z>c+1jQSntt_lG7~A883b_~u3vX%QA1%Mi;8$Mm zO81zy=1Q~uS=-ldn9aRgZkzWvCcXyOe({5sus!Mlsi5t&-2>8!bM_hy4su$w>OY%+ zLUc|aB25FI?A=ju0r%0A1X_Sh^P~*7zBR)AT8TNTl$ZOn)IP8m5zpzus_Df}j*3ty zRLiGk+PD{MMla#QkQMg4m^?X+69rd?wXt#Ta14Zh-^DQ?SGSWzH1*fS{xZJYs z36)GHLidCcf~D~6#ur$;+@nD<#H^1{{<+h>xW$hj#|m1n#_HGT9ZuA{%)D>pa{m@r zXfa?hQsd^g{qQ=^ed&rxS8pDx7kS$yv-prUT2zhYhI-7CUeopg!p}5=_5Y@+aCJloa=dNg6JEBGyx z8Y)d2^J4O-Kvuend+{@C8svGfyy-qkL00 z(RmLaadJ$5S_z1-Ie4nH;*t;#K5r8$TuC(41Gk;jh}Lr$(6FsP&**du<(Kx$e#y$j zZ*91eRMd)^4(M%_K+U}Rx_t{Z9n-UP7Bv&WJ=557^O+!oA#K}=9x5>aB!%HImb$u()$=6S* zzi0nNnK6R4ZJbkSf_(&!h4|qqo;cFjI=mABetg!RNlYIw8Tq)z$>H@ z%g_ciVn50uP#FYlN{o@LT6*QSzt0$&>EuusvO3HLLugh)PqEKBu}RyLJ=@8Mrv z_^%r?g_SV-XB;BK=2;9&J~~zUFQ4a8zN*L3JFBR8z4_KJ#L3LkUNQH6SL}ES$lR1L zc64`xF>!LTnwn8XXAhoj{CcDR`*G(FPfVNlFHuwyMA2(@L_Bg**VnUExSMQ=NVdNV z3hy%&{SikY{p7b1A%5&`@3kkdb zN;vGben-~n;o-^BBKiGBh*F@E<;Asl^)i2n(AeLdGfM|v8QCjEPlz>08+WH;;l;~m9V6v zoj#pQeJT+*ZO1<~%VE%SRZ*yR*S@`-zEOul$8H0xAge|;lQfM+W3(OeiTy%XLZQP7 z--yTb%LopLLAH9{Pra)eN0e0^3Tb=l&UAOshk9KCz=I6l{?Xp*h*5NBS63A9F@JF- z;`YGqt-)(B9kKgTFeQEszSK_uWr zZZDK1Jnqa;ab4gJ%R)D(S8wK>)M&kF!0FK(?pIs$DNm8~lN`MnHR4XQz^Hc1%~)mI zB*tKrv$P=9pC0cF33+OkgC9dDt6g-T#xfbXB*hSX2Bv#C(~fu6j5{vLnR+8f`JWWn z4I{KS=Dr%4pyZ9}6GgtgzHNNalbJp_;^423^=_0$;U73A>AS2A*eMMsY>U0FS0Sh=@QvzC`wxD_4vEb}9zHgRXIPc1vaRkctqloDB# ze)5vB@qTwa=L4_?)bRBZ%c0g}#-#9I(L}dH(GmAB#BA# zwTm*w?fVpL2er)}=~=7{=5kpM-bDaoGf|-V;K!KLQ@@oliP{DS>IRL$afu$#g7^e- z=Fj?4K||y@s{3Un;dign3-}VW-P$3`{8=vhDBj>)B8PT+Vz{7~Nf$=%ySVuUHFL4A zP8But!`HgYsOcZR&RjnIp9WRb^ndqRk{Q|{j%Av4@rdzlPTb!Ieqhn!D;pK5Irh&z z++6*SU^^fUIhR+t5#23{mHvWJy5RhT9eJSiNL0)Qt&Uh;qPW$?+Zoz7MQ!GYxIpbm z&?Xb;eZD&68iU)XZ}Lmyb6tkgL6jnomlL%aeFv(@&RZwPM+z}_JRis&=q;6uHdHc< zRTF|U#k<_H%dEmg3FA<9oYf!R+sdQdF7~y`y$CUX%M+ zKbpVi2@JsxrgJ}d0IggreNNx{@(f;@LACR<*$xMzj(40~4$J+93n#e!+A@VTQ>}J; zQBr>bIgT?KSkj2o#E$TUAkTh%M4=t#Sw1U>ePsG)1+!=DQvUqZ`^(_?=cq-{q z`+yCRsObIF#|eCrax^xt?5&1$STqBU2WwNzoYyfk=tHXTHA!%p5uU+&;j=*^Qlfh3 zH{(MqDbqdYXAPpR^SV=Lrcw4CZ&a@unMSwPbzcbM?)pH#!fzE)Cn?q9=Py>;&0AX) zv$Ns?*(~i#0l7;m!dbP~ZacmtCz117Cxcc8Pp7a}Y9El~hy6=PE{lFkIA`CcfXjS@ zL?vsJd&aP|ltuD*8LU<>rjMaq-gJR#OkUA{UbR$DTf20XcB6n(i%A#L@EY15& z52zq6q(7e)DS_^Zr2U1K{3*2m!x8&ep!5cz{@IFb*`bx66e3#PlB~zeW%Jt1E#tO8 z{CWSFT1-kVnw|Xax4!PEwl&ASVh;){FJY&95S@~xI{>75Tc@#>x2GX+;0cOU64kb# zYBzoCA{iul$W*B*yDE-3>Ivn7uRe6aMMJKuE|#M5tM+^^P{9}Boec&~I$f6PQ~URB z@hZp84@cz+j&3`yz*EOvjrGZBYK8sM2Q%O)a5h8GL4q_x76CqhI;OzW@WSkUvK_vGz5J>4sP4 z9Cf4Hn^!Vg`E@6wA#iu-)ZOL?%R6T3NEzG<3F0h+CA|gMjiS_V2j|sRNhA0tdItGa z8eKYKMYL#Lok9}$_69;#GvS>D^c`#-STa{taKDFX7|b5i(N%TYKff}ynW7}0>gz*A z3Vg7t>*XuTlEcK3i5J!*uD!Dyj2E$d>w2P}_}F=y4YQP4a+-EDOVF0ap`$^XFtG1d z&7C4UR271F?wCw0%v!fh7KxrqgC>mjt`^GA^{eIhbdFWK1Q(Z=R!@BW^uhNbx6{g? zb?>}KS;u<+jI+6e{>&JoN2P6KN8)jwD|TZb%;O#er~-E|eHf1jG5t-C()IVGMhBSQ zIWD_FYV9(p&}}Uw-?FQ_edt*a8Db--Qo|L7A5kVKO!8vMd5zkUir=K z<1)kZt{zwy4$NYz(rvzmSmag>**CXZ20Pa}f;O`xH%&#cV|yif*Mk{9uID`|-EjiG zq%Y6(aDjZfuYZbiHkoaW+iuY&EaS9m|#Ikl8RXT1&32jty z51&J{vz4`wYw0~}hD}sxfRY3{y`gcbDx2A+XAABd)%(Vq({+2FoS^dS=hM$I&}ouH z#2l}`@jsZpt%Tp)2iy$$Z6t~dbYaXCzOO_4^7?y|MjPM%GqO zN5{NJV*6G07}@uQcZF;X%MFODbKrJF_LWA49>yW!%-Ts8Yr=xuMH# z-tXVtF0k806bFO$fm&%s%uI7hZ;2)2l5Jng#Es4w6X+d3L+6Ow7xN#OZg+bjotEs!(5R9@bzm!yrx-?-kyko5oymdQ~uVs8sdL+bXKwCwhThfIb}A}WQI z^B0BWZ^f!Vj~joGH0cfc2BHB^u&xG?b;4pI2-?p~_y3s=wtJM$KtkTy@m80{>|4T7}6V zE!9SME+NtR#eKJ_IbmQ^r)__b?y7EPcku$NwyO1^w6&HzOm z8nC^w5yKs%jytcw6e==eZ0o%63xWSlH^@A@qqQ~kRPAKZ$o@&~4M07ngtA3=>8+wW z2XoO7R1+211j_`qsdOt4=O5`$8FLynU7+M$?y+9%yyQ&0@tpYGnE(FDP_V9(?uQGl zEw33E!Y+ed1(8BsTB^aDYa2l9HS!B)Mp0x$B)HrM@?H9i7D+9gU!;&fmD_%mu)d>( z8Nu}Ls>#$}FxUAPNX6>iLEX}ui}P`?sGR&79gQD9tqN-wJdGAo0d|cG*2Vtzx|V7l zi);CKl{CJ5gt7CIcG#63-_Jcm6Ip7y$Xwlp0{uJ0e9EMYCoija;nPn*GqU29VGa1| z!N8>85kO?{%yut@H)MO&O0kfwggl#v_E0*5&^2j_ESx@$!92&Tq;_R?kIPal4V@pnP#} z>;1e4uHOzlAIH7AjZekYX;idO#d=KZeAg*&47z5;HmO@6BZ@K3a;t()2!e)cN3p*RIo##1~Kn-Wq=u7}xL`Lw%pKUMkce~0ptLKOr-OMRK`V6mx> zu!ZgHMG6s=kL-6&aiAd-W1Xm5{5;g!oyWm-f5Ople!`}i<`Rqz22bNDJICML6i8*# z6)&(i1@!itIa>LpWoW*W#GvM94#Y4(16=S-8dtdtoK)S{XMirQ;dP5lUpDj?J@dbT zHyY*y$)6{$PF7d)n4`zoU(qKtd6cq8Gm7RXDO2wA>M#tjCdBoO_s9adNs{UmG+zi{ z9d2<_k8FdNed$UNY7sCSic}JVFyz;Yaz269Nj3Lmd|}N$^50ppgWU`!i*~&=aWdI1 ziaVNao;$%gB_5&MrI3fQ@Ip{k0ZKVpkhNy}65I1t+)7P>Np~0G-J-@Pj`_yK1uXaU z5Sud(o*BhKCLgm`??`A@LaT+vP>(7z1Y&uRG6Z`Yj4?5OrO8xVy{u?-yOA}X+4|1; zJr7ATJC}{PigBo85s#2w5G8LvUoHtPmqb%woN*jgrVJVf)B(t=a)5>&%!QWt_RxXNFKUH_WuM+4cES(umI z*0Eb)|HOg$u4na)#^U;?V%0}Hd(VCqUz#PCs_XS@CzHkR=ZqAm<>aKdzKFOJSTTGh z6sXl_HGYMruIztK0f7krzeEK;kYd{1~NXO>j>Aw^(!6y68ct&1kjCN_ey6^y}p+u zlRgDL@oZ|42~0E%)iQ9A^d+Iv_~6+aKQzwgy7SJa&W^^dZ4s>{?*;Wm0zPM&aC#C1Nu} z<~XAKaOF2rkSXDS{Y_331-q6X%)VYBbD1$0$X9VY z54s2IJK9H*uH|#sDyj%+#4=Q4vBGz^7wEXIaXY{37b#Lq!4OlhMJ4X<76tq9$@vZ% zywGa+d@H5X-*ditiF-2Y3|>-cSz#ilo9mO=r#8uI88!65Vq5Vvwo1W5X}b&X20+3yL0k*NR`R;F4cx6{PoQOA+%d#0YBNq}WnFf?Z8u?72 zV>S9xfwZi%%}Sr>X+}AVU@!b6IP4@Lsap+LUaw!h0JX?5eRLxQWR#)my)F7s^mU{9 z$~ziRl|JD(MPnrnT2c_tCAzFL!-u4|bpSKH5iGLz4iro>KB_4`J^W8oJj7S2E2Qk# z$F+5epR1srsCgrTV`u&7+(Q8A^;=^asY2L|J=E@BtL=;j>_fZbdIp0X>x;f|O6P!U zoDzzHOLuZFIpz5SDelMbQXHvu?I^HXcEd8%^=|wO9vS}2;4!>wh`CP~*pp$zd7luy z{SISCTwzJIj4Aw&G^I+bUM%gsn)g+FYfrp!S`5NJl~*VNG5L1DX&6gDOiRUg zq?L!vORW~!`ju(i^c+VSk= zM{c?9cQHfqMOh;#;9=FwW`fo7s(|vxi@-Dwb?jz_oo*eB-Y{vzyaQqEQ~%LtTu--A z+>*v<)DnDMSFKrFlEaSJ>*1JN;ZvzMRb=nyGLA98J))8ESfIZ}XFRvm->jVL3hrP`3@jRb_DTPYLn85 z>J=9G*L1qnJ&NXlu!HZCh>qv#@^dP@TXLqpN)lmEFTYO%ruD^{Au1eXruY#yn9OZ5 zS&j{CSgbrPJw0Rx(fU2t@ZaHw2AQfUh~BCzJp9T{hl(TMN=!OFq}0(|lfN!M%kV(%2^_e%KZWZal3=p0CmXR}4>ZJNj7E6>(cGItnP<@?)g>t47_zyC060 zyqbLGV@$hQ^DL~X?%1aU=D1?0cqkaHi1UNz$4^xojj>NXy&F$D5llzuj&13+8&vzwQ zDw#u#MC=!P3Va(TDjns)@$22`OQH9|bKGU4x^B!Qj#`1+dQq_e-_gl+F~u+KS%Ys~ zw8`X^j2X@s*!3QoJDu1<>0sKr?U-1A1~fm|jI6#kzb=I5hoAxF`DJAn$gDq7^E?lk zSmW9mF1Jaw-?V*=0I@fCQPX%BCh198lESL;9!@cD1;x>(tmCY$*S#dPiu)Eb9 z!;ej_lgB~as@?M3kDa-Wd@>ti8%v=R47qt5cL3}EMB>G5_Be#)WQ>!;e*cTDNqbvA zvrz-w=R$RLxw&{8*OG<+Chbb&>Scs=4k=u^MP|EV0$z4kchASoz3U@?y447mA$*X# zyG_aOcT~uqe9}`C+5IWY#WZ1h zwy9aT2C;orC{w~`7^+0my-*(j+Otx4!CqQ)^D^-L=B)su|m-N)rpK}cDN(V-neJOYOHze-A-tvM)7N17E+YvRUc*#+j`r8f5O_1yMe&8_UT zQOkteuCOI|+W}Fo(>r5i%jc$2TUMrec-qyoK>FHX^+xsJr=1X>_(pIM~N=j(b~?cGr>Ed*E5qCbb+e1 z;8(-c9-Uv%9h1NSK`i+^<^Ev)*m9&IwK}p~0O+}FLy+j(8rkYm8{6&?nMrOBqS*DJ zNyHPmU&qf1W}3L@MhifZa}4Gq-{i*bls}yztebBW7Xd6sHeHToxhQN6I? z*m82bwLduBOgGdvt0ck*QZJIByUsC|R|CxUTYrGQ-|+st9_blR=Te+xJx@I0()8^cc2&SM+juJU&Vo9@f>QBwlB>nUaK{l0srxKpTu2fnvHp<8pfob$YIbvpyu zSC#RWoUEF$Z%HN&lvH}B=DYxfY3{?SJjxYe14u=|=AkJBpwqV zK4sta^=ll-BMF~ef(`aGdqaa52}JHj>m6lED8(hP3OQD*)nH6Dz91j1DQXvZa`mEC zSJ7O@oi=q%65Q-NrQf!?sDNS^K+DZ;n41x52gK-8`<`#$oAgNw#w4aI&B39d9SQz| z`!BiS*9$`X<3-l9rgb!eotCcaKA~LD@ifEP095$mc+Ui5U}M12Y{Tkp^6(aH^3$LJ zMFH82$4&!$l2@%nY4+;-YzdYw=X{Ph2 zqPd#u*~`Nvx;JdJ7d6^QGavf|Wcei|uW}ezIhF*#i>*dfq2)8a1!J%ikodAaIo|hM zC z3u5O9C8qaXL6&F2&2G_^9=6y1f{!JKQOtcNEj`hzxu5a;%!#ThvAMPi{;b4n7q2~+ z;VFqrV3V%q(#%lu5VFFY3Q*$+m!WCvTH--$*Ej}!5bo_=sYj4lyPRFyHnm>$h(+^* zvT-%tU7SoJjd1^Dm(b4hp}fcmX6{~LJNc#1)Fv6|dVB%G)UQRi0v=XsomX_4%8z6{ zVG9-!c!Ddr<+@NST8(30NYquzvz%z16g^%mV~{&_Ybcy7&MH|m0Ir}gJUcJUKQ*p0 zs_$VPy1?UoC5FmLDF(B@Q!c3kaa8Dlr9Ye`Od-i=N^KnQgUj=5G!xQM-YGJxwVaw# zW2m`a)rbWh-_ou9*x`CZc?qa_Dxp`r=bQ9i1mJ;IiBDn8$3UC)?YyVpy9R(%JA38h zwn*$+={|7o6bVVQKPmVeM0fA$%l;fK4y!zb8=dQ>X8_IrWA81);#{|M-6SLsJb@70 zgS$Hf*Wd*NC%C&)5JGTw4X%X+mmndyJB2%i1$W;cbIsYky8Eo%dtaxowa$-||AZ>O z_Z#n!`*{YR+Elq7@%j82RL|Bmyadp5cOdy(Z&SGg9ZKX$BTB$-|AmY9LZfqNn(fXF zP|z85h2b9W)h)gC_&~_(6cx(UqCqQmdE3#G@1Zfvq4?IyD@ zp+QBS`@TLYbzDvbm_}^AP z+0gfHA>g=?6dAXu5G@B0mfE2j*9()rrFvq?Q z+#ii2H(LM$_Q^$_0b;-ronn}5IArQ#$9{n6=pCEYu;7+!2v{)G+H-4$^SS)~Ufx+^ zym$gT>+<+IWpuy5?kvHlw>4{0pfG-EF=Tx|?6r>`Nbb6ial`tjtlC^i36tY+;Ff^$=yep#Jn-Nb$$5JzPXVzCVC+0lXR|bbCtsLwqwoM3+?bf!Ou^bL* zw_F6>>(AtzI2@!@hcevPS0XK&iep5ZKHW!9q5FUhb-odNikBJUK9-7btgea@WzSj{ zR3Pd-i*VxnM>+q$bI*vmUT_<~#6$Bo!FOIDVwT^y=F{&tAJCrwis46f`42!Pb7fKJ zY!AFmG68@0Hu*j(hrck{H&R#dGVL}g)JsXs;sBA%z~^$i zLyuT>VpPZYZGuxF1$zfjmI8CjsbWB%J2bCsPU=0qD--%3KGKu_^9TJ8%btJ#NEnZb zUIy+TUJVm1{;n1kKgtu}Wo+{SUK6(I!RcQA_NzHgf<5~6S0AVw zhGQiin#sR~|F@7m-X9WS|Jp~1u(5@hno~TxqK9lGam?ba_An(nG<$K19NpHt%p}&2 zPMT{sDiB|?yg15FUAXR~x4qOfyEs}j+u?qI9NkBIO(&jU73;*6-~DnIe|Km7Rk5l= zSG1%mqV+KH$aQW>K4cy-Oqu2bPZ3SITWmiep7flzVX{iF)lLT;4haQO3=0_L4U&Mh{5f%2pNff8sTsvH z>&r4@gS_i2U8B3S>&u{#J+EWC-Q+Ec^{B!$p_86=VyK%sMW9>fEujL@{dHF(FHZ+; ze471wG{L5sDQTdYNG~{@KW3M3+v-2ZWF4Nrv=)f#Lpq<3Tk7rMdi(l-O=EJsJ+FG1 zAHGWl-0{suM`vVY5L>?*zM%pXJzQGe)1LprhsWT%$LBKsK3Ox`UtJb1ukQ4cbo-wS z5(7G+GXBEH3+Fva&7Kwx=ke)3xrKt~nqgFE^*1Hqqcya&n9Ta7Ta68SM4 z9R)%O{uwXh-%Dj0QB$qj{w8*x2w`l}1n%CvZgfu|QkupFS}NJ@Mh9{UsaN&3#pk9v z_q2!SKtVli#hG(g>nl@iqmwB*y}7LP}~GzPw}P^=SeIWU(?2wK(K{?7HY zdG}J*GP=Km!93pb{4>(ee;0v$c+6th>hvc84Ciq~2;G^=au1PxrzQw!P90Ay-@0E? zq)s=kM<=E3eq3MvCloXOWd#3rD^6KY8zB!d>P2X|6{tC_OadlS3=N` z9g|ih)nbEVffc~H1BQPj8~uriwDENQ^YYNO)rV9Yo7$T{wVyv+fU(m?VGgAJqjno@ zYMoUy;7>`Dd|m^J0XFbn=}rP&%g!_?0W3`tRP_6XM|S5q0yp{B=V$JhefTG<>#x{A%J4Cg%1JrtUkS1?D4d_Tzl-Nv?fr*& z{oi~MZba14C_v%n@Ls1C1wh++ruM5h`e__p>I27$!+-};Bc)pK)2@H){)`KYr>$N{T`T(3XfI%IQ#&6FR6sYoDo&t!iFaoOhR)5%J#O z{rIH}C^HON2wnz!8P}UH7GnWL%8S%Da2$F-V}A?+qPto+@ZMZE2G*C#2A~rYY3~lO z4aWf*N=d7L`9|krxeP&_e7R)ht=q?;LUCE63@}tEjRt78nz2%?x+F`E@T7dAarzYb zZlJFF-QWAStKZ@K_Wb(>^YMH#p=ru;i%Cc?MWXg?Osfum<8d$(jtu_R`K{wO3b!R}z23zfuqg&~q`mtoxZH9!7ea?Y z0K(3_Y98J{(OcdNXu+{LO)mBY##U#~{qbaw8I4@x((caVzR&*!JA|J7c3xU=_%IZ2 z->k=u2FQ@>PJwZ)S}AXwPi~H0tGC0V`=+}GqBsZFTj)`=SI9zuEER?ktB8Y_+cTyPghlL)z=IG5`a@ZeC zBOZlM-OU6*+|J(gW^}LTI;$jecN=x&N+g*7*r*ZAuTAZt=SR?l->B`&uWdou@|NeF z&1SdU@u4WkJx4F8H=B@YRA5G9MfnG`3M~r5ckb^*d9HbSNE?+{C8H!+YsfP~|8b*L z@3u)jzighAxMYr@zizLp^P5&hwYJkITyrHhtsTPMdzVIccOhW^Fk9}#Ye}hYm(oYe zVZRn;62IRW61uT3* zg2(!{Jk4F^l>h+l4xSfF=5|j3mlZAu0bInvwtZllQbBFfx3|bdl5va-fVI2{@U_l% zALtmgoKaG$ZI?95S{b{~FX^wgRJL!HKQCjfb%$4;&tc{90h8e(h_G83yBUsH8ztj{UZdq=VddREj}$D3$s6IYS;p}DORh{88?-+K%>8g zCTlw1_<`29DL>EUTFMq=J-RS$&V7A(YJAsXeFZc!=;Z)RUo5bWfk})tp#$I-@JGM@ zgOz}T)L&P&*KUlcm#%jtC3>sBp;iXLCr6nn>SL({r=v~M|J0)1>T6Ry83{}^`U#y2 zWhfcOojD%4^0&>?9xFEic7-^A3$&2Fu`0uDoQO*HO;=#G^XuFpFTMHCGvmS?*pqv+I0$A%i|KX?P2 z-Rtq$S@>kWtwpg@Ra9%*$;gk*i`sZ(C1I(V)RHq^POU((7jt$ zLo^-^HoXQ3u%uef&I>TQ%5~fv0$l%Jd~Ee@woXE^E+YUsFU`9LZGH$FP`!5BGa`+5 zfQ2)_Kam4-;|!g40;)8-FDQh(?5hkNm>v~Kl%wy9NSFMSaw*krEayM-~2U@plqad2fQF$hHU8a{aet6L%IlWS(vc0etnwHU{rqLgzKLp?$oXA39_U#fY>uF#=$@8CD` zjlP6<-0|+f1&LV{&cVbJY%h|NxAcE0WY@oR`9!4^r}lpqR+wve;VO*6KAWs_MA^ck zDKAi?nRW6PLH`|IwhGQT(v$c*pM)-WW25qTsd%FkyL%eG{0kp@*VuHu^Dd|PN$XsY z>yBM>bt7Zrs*E4_fEoV^`AJpGMIE2 z*-Qtcf&XB7&KOY36K+pug#!@+6NnH$MaqZS6$K}JqM9xi$+lv~Nt(IZXu?G23G>(VY60PVoPe<3r)dG0q*!Qj_^ zisYk147)`KJ6=R)<545;3!2*y+PIXnXXO2?0Q6bgfDPQ?0g$cEUS|`^CNjnc5?xzE zXEZj&wbbWM*cB~g-?e!FEw?|)#(AJ@L{wY$*3{KaA4q1C1eib7M+1!J%%srrE1{E( zvE-`lGn<(Xfo{)6KbWc|d= ztd|n^5Ol<+@V2CK7#FZHI*D{pzWp;F5#MLV=|>d7U!?_5_Jbw?aUfIl^4tdaYbmJK zgGr*7eTROLk4^LPu?bZ#=bkOvk3r{UfLA^kOy%s)AJjtPP=vSOGL&q-Y)Vr(c$ncs zXQqMVp+blDV;m*k#FbDB3yZgvK$k*SV{+DWV_qOW!w`#+iphK@%o-zJmigt25k(Lg zH7yCSi4^rg#ktYb)5O$8#C3Rze)6KBk`FBZZRcQbpKb2s!?&9S1`#Ow}Yi3jN8(*y-W%%xmECv0I4`8`C{oMc#yyv#Yt>?{(fwY0eB#{uaLCnyRUxD9-85l{3Wzz3O+0P zkr6K9uZdh}%o!r=zUOD?G%M)c;Gd^yB0T7FzsRc;e2OK*Z=-G&jQQo6gU(ly6hED> zfqtv-uQj=!ld9pQAVo3k`$-Y!ET?qIan6c4FQ*1Z zx3nj}d=U@?kXL}+aCXaW!ez)r1TGnki1F$K=rqaSIFLoJZgE9+EccDd$hJO$S)!KB z7I)@LxvUnOP&GMiQ3z-2j%W8)^JEq4blF%%Eb0nd?LEpjn2DL`tVg1CNGX71$UmAmtf0OK9u8)}zc<5`k(_J82$>G`4A;>gzvsec%NR*P}j)O#FU z9l9wkN!NPq>)^dp zfk4VTD-IR6Poj;x|bC$0`$lAodp6IUyj6EKVc* zzd50V&0Iv^kR81(f4_y;CpReW4F$M-O~fIkCV`5-%;uREcjKnEd6nfa`s$N^R?*>0 zzn&tLio>7pFVCfpF|1#0d?`2}cycClp)l8Bb27ToxNQIIB?1w_Dg9TVo$+``fzxV- z^L?8hSth#zHFv}eLF ztMWp69zd!uXA>=_L>^q1xKMP9Ccl@phVz0HO*va^4s72`jetN5iHnkeRa|-^ze*9t5sTO zq?&v6&bP}xo5Aw3u;TD)lg_MF2#$hLyv6iDFep6SAKbbh*c)4bU*v|T$a0?9)^0Gl zQ?4xFlL0=L#^J5cFks}s7d&!PW6*m7JQ@2?gEET{J}0=m1|~JhwDVp!YFE9FIps57 zQ#3nAqZqjZd4c1OlK(-L(>wb$MzJD%F4 z+T+7h0Hpa&_0wA_DBvzRZYPb+pc$8NiI%@!N+o(1E+AQ3XDCl4pPt{&sLK4X=XUu! zf=A%6KH3S9Rl?Y`z?vB`4*{)>fa#+4mmdP@%1=MPbbr7?gS^>J3f++_{q?p#LSz-+ zDg78`;5(_$xw&Fe9X_PdEz#+3;$KR?DsPSuq7qhCe)f)Xb&P(R^67VkJ!u)$a$NiG zH6cZ-`krUy78y^1rMVM!igi2BFOj-rSi9PkCR{BS=JYc%80q~Sx$4^5{o{fi=7M>m zsM^~VStLIMg@nLkFRQyAwJI%#I22{%WIwrB9=`NR3_TZ7eN!8nf2SmUS*kaQ{t%uI z)%k3$s68LK^hSQ{dbBm&UK{7z@h_i>47?@rhUEjLH|X7MONP~Mv_c%|>4_njh*}ZM9 z2ney@81Ei3y(7A=aP->m%5YL7?eA6hzS~w$Vc&F*HQ|5DJvVepu|BFP)Uaz%)xuH_ zEe-dx&W=$q!mr8-!~X;z|1Qm6L{q-z^Od zc*_HUoUF~4ZfRU^I@6)7u0$GWeeahR17cU z)Ab(AZM$dJu;hU{fidTb#qcZ?HkfPdH;B)8pz|YL6E>6Ti=pS!yr%UXd=qK(N(?h` z^L%g?D@wqVGea}aB=gk7s^n-4`EYu4Q8)( zjh%q*BhA=rMTjaQq=eh~+R89YCcdwIJyHVSJCS9Lsy&SdxoEhO!jZ(MrO8G#H4*LN zF<1oKpp7-prH*9kGSt;ywzMwn>Z}xGoR93*Ph1z5H$8uW{PuI{oGV`bhxx#+>HH6P zICp2pZAUNI!QRZDg4zhz$L8hq)*^qc$>Zgt;r1zSYBmU z&^+--1Dbv|Vsy&6FTGAjC27ihCjwIWTp0n2-pG{Yz9tRnO8vGk`nuUbIKW86BIdAA z{VDlnk*-8z+Z~(&=LY0A6dlB#zbig>2TcTg$_!I=&|Cz}Z4l6DE{;VvWUG``0e$Od zK+T$b><;{bEU&9$n}$2UMfY%!YiYz%!=Kew_ac})3GOwVF|!5FlG^=ODvm_p{q-gC8C?>mZ>2NwBtoAzR2DpXJF>U)DHl33Z<-^rfhag3y84dC|~;le%XODgh~gnPL! zITv6uJt3FW7>sG1-Zxg1EMDV1jd?>CTWEvVIc1_kQ=^=(Kp@K&o^8_DdpcV~_s-y) zzTrunGsrTqE6zxT){GJqpNOojnJ#_WXhSyHt$xRx?ya5PrB0v{xnb_r>0J$Nzl2z3 zZe~Y-aP^!~3=lDR!06k8P=|E!39Z9ssF;SM1@-UNYWOk=f&hA! z&P=(fho7M@mZa%u7{V>N01s4fu##B>^3Uml)D=9evT`gZbEZMOk8x=9( zU}R!VMrfs5)$oy^x8 zmE6Ysc?YJrz`rv{fR}?S;_O(+8oBxqSD`YPQ}KDvj(9LBg-7+SEcN{np`VS^2hKp? zcu{}6n8d74@TrY>!@Lq55BB@KJBR= zCfelnUROvc_`FZj!IT@=d(4Sbd%SJw0yoMy)b>k&O2OcIfJY+4{ba+x$=#vd7p@h* z+`V|-OpsC!UM5V)ZA(g{!2xx>_giQJ60wlWbN*{7w`JgXB0=jKH1JOI%G=X zRNe5Gg{(0yO`4Nr?N18TsmC0o<-*ic#3|k@e|q*#q6kS8f~4HUD^cPhwl_K*h=o!? zHp);sJBlhL)A%$vSlvBsKIR3@XX0Z?apN%*kIObb@2yB5x?=R{B8%8_U;gB?FmzbX z(-`(~T##4T6oi|GE!`q;l6c`EoDxnK<8xY_j9V2nb|Q0lcm#y3we_hr6*JM2>e$qy^^h-YuC{T_mMr=X+mL>O~~xtmu+ zTLcs>6ShuZCE~$(i(7d$`Fig=r0{4COUCvd8EA${5(pmO`Gb-(h;?fVT7J%}<44QX z%nMoV>Bhp^(|DDT%=! zqwHwFoJ&Z}a0mW&9jSL(7x!0~umaEF_PYglz>pAP1@NkUdcF&!w2=`s=SILLycZdm`i30QM%ari z#kO2jWDGS(p&mZiF1c*xv~i_o<%`v;y*?C{GP&6si6$b}_b8ytfhVJkCC?xb->&*Y zyx=Szv=84@2ibVxKb`hvPQVXySmi(hl{pmE={xE{1f3Q+xLe??5X{ofu8Rzo9n%t4 znY9(cuq>F?HSS5)MVtk{GehA;V_Y5b(oKHJ6D;|N=v&vivTI_TMfuh-F^t2(RfK3;P81+&+C*> z-z|i|aDGEYt`<5UIZiHPBIB4v%aNObNi_W>GF2W zlOAq)NEbp!O|AB=G9B^=heE_LHNKnCB$EoD#%aVmZig@}r`om#u60Lv?hVhp-~Q;1 zflk8Vm|X`ahDpmf2?p-$Ssj38*qW;=S0X(Ird6KB-|xTi8Ts9^eYnlUu$)+BNzw&+!rHYSK>ah&ZYOo)a+#5rMor)_ z#}-^H!!pX~br?}zj2>*Lz4J8Z`V|WCrFlQ9lBXAU(1Qg!-ceiD`Ojz~##K=(FXkZh zo9g==-&_ysA|d8n+rn{g0%D)8z#SI5)k_+WWsPbnmNN!tuUAC^Z_tqn*=xmprJ5P7 zc-$m}zrvB@JR#v93kb9!`-%Q)l-cz%qxHy8f?BmO>d2Q2+*1fHEJAVG5tY6Do+0>k zLanJKN>h>wce!*pRN9OfsWw5@7EZ9t@+??3Of;fSa!i-pVhuA^cyN={( zqG$&?Bc{#R@KG>V;g?rkt;ro(eX7*-VR#h6D zu(%Lg=K>lW|C~1*KI^HXW{LHF|p(`fzogc8#$%=9V9eb+9@^i@`HV zKRgCxOI_Zn>a-sQuhfa3tp@s=4iO^I8z%F)dK(W+CHQa<`-NmC_tl^u6|xq$r2XJb zxB0{-csnk*d}8X=8HqL;WD|J=!ZmSTqr+X`I0>(qFVp2vXKN@5aY-aU$^I1YjKZ&3 z_?n%L3)AGcCDNSyJ9R{ZcoV#Lu?by*tSh6eJ$< zmzUuT+@VywPL<$_%%+J&$(dbJqhvD^`NFDM+}b&@Bx`g$feJNx-YK)zxbkLGi{0JA z+K%AXA@Kep(FCp8wT0Mhk7wh%Ia7YRT5yksclelTlPiHBXqjB*XPtZuXE zGCei@E+$zsnfJ)GiK%OKi8+6>$u~uG_`x$}b$wX<-Lt_g>5+@T?v?qP!5xfH2jP3U z$X}V=oc?Pujz(dM>5>a*0lW)l1^1J!PWf6Fr%d0sO+?N%M%J0kQq&bk27P;PVht?= zesw&rcR*G5mij7}TuD*Ry<&hip`J3LZm;N*8U<21%VPSxnz+EMch{e1(W+@ob`_fM zHmoWkdPafkk&xG%KX8NtH+X#MI$>Q6^lR?A@3Uza53CyTKWX!v%_^t$gI$`yQM8n$@`FK19h~Hnk%8i&2}+>m4O!TG!AOcSmYE5ZfNMc7g|n+) z9~E<@R^D_cCM7*T!{aOn326!Q1QKP~8n|gThuNdU)9&t?BdB=cE3IL^3C=_!!bRQJ zIxf5VuO97`rM+TBk-OHx4z}Py_+i23M&bG5{TH)`{F*;(1nBi@@b2$#s0D5OC5g&V zKHyFI%{Mr-`RElXtnFZN*@xBaw)hJkpvbcj9J>QPxm)}l;l%)2=#G)tb*^myUD7cF zsDbMFx|XbufZ=6`-C7qaEoUH166|iruIREmg$g*!!}}v+=lcNh9lB~@`ZHAYn|DArv509jocMm#zqkcAwP~gE z4(Mkq7R_SodA$yKi+Z>6f!askUXYkffNP~KR6qCla%Ea1>CO`DMxuvmrnJwNR8h|I zTj1mclf88xyinYcml+PG{}P$HEJF5?3IkRyN?OI`50m-aJpb%bZU_-21i{~9&TLQ- z;@!N9ExFTQO(N?S{+-YIsb>R5Rl~!@~^Up-+(>jqGJ6-KKo^PS;ng z{wX5j1FtXZprOam0;9ToP#47+Kkc49*It(N@+uH54O(sHRVLdzs3iE!Dp!#bns;Y~az7o2(ih!fL?PLiw|Z?O_B#_3HTT zyEzCXphS=)A3eTiht23(ZiJSBjkzVg)t(?iR~PwW9rEl!y@bi@3aWp3@=KmN;ZD3K z{^^HZ8oKit>)+$WmlWzyHm0L=t8=zlgBS0?xNd_$nSUam&M!~d%7=tKNgJ^RCWb>LkcyB zhGM+XgmrQtOCnD(mgmjx*BBP8!5pPJ5|$OUN*?wj%6IzWqaFB0Xq_^xh|*?bGE4EI zM?6ewXwFLUBVnJ1-6zKmE;sJh$(|UY-UvJ&+P9()idk)i*;Li$D<$YEjHkrfx3<` zJquy}$)k6$7;l<@Z@rh_vOG#A1EC(wRohM z+d_{$yr>TJu+Mu!kyd|8_@>u|*!+4pJ|oM)mn&=X4$_xywW6}TKs?mu*{bh+vs~wW zVH|iLxqdrqrlT z{*WdHKZz%X#C%YEt6q1u2xwEJRov+|(;Zr)v>1dUH@rM3HH8}68;Q%<(=u(L9*m#&bpK6BKO2>QL z)9vmmQ4e-S-9{%w*kG#U7hp(nVmB;sQ6KEH-t+qMxSwg8Lwl9acCm@H9TCxMgueu(R8={H?2Y|!*oW#_X+)_~ zM0*R9Uu#SESrw_Hfo|fnV#Cr^QDwDQrHbFkU`cSa7rG;o=)n|o!iyZX8rTZ9o=UAe z>)cuiAW}&ds-exh9uqO*pQMem=*Jg#cv18{y@MVm1e3mzb$$m3kHB0*V|bff)msm6jzqECBaY6&|I>ts=!+ zWi^d_8KL@#LW2^hcRp;>zGX|27D3mv3Ow@?NUN(cq`5VehVNT`iJGTO z!A5+T(sMUkKUTsrO;zs&z;*JIMcS=$CCR!UZ*{F+12`m{-vz#4=gN^Z>4 zL|AK0rS@}m>833Y-?IlNg`@TjJ3ZSoBHAro!hM$!veHQViz0kQ_s-y`vFVRh%yGjR zq`56Hc_0J9u{=xEYy0fmPF>QVnJI{d*8-1DDBZ=$-chQ-iS7U!5S~1C!ZZp`)ct&a zw~p z=|{+0Uw=na#ZIx40Bg;<-RA(w;RkH~`c=3h3d|jw3`7xrRt@uSPcd zb=ho|1A2HF*ym>-m;~^skEVS9+owxlX^C_Iu$wgnBDb1q%&q`99YRk%fQISzuWo6Q zi4R2l04TzC_cid58sUg>_j(xins&UVyS)01LY-K^qe^{9473`A3zc)th4cu_+>tbo z6|~YpH)^Fb1R+A>B7~P8Y&^IVo6^2Peg^cvDT1CF2lWtyRG1@@cpVnVx_#0 zP3I_zTtJ&@`FjZM*G4<9QcY?`It3w>Nu>pnlv_O9JUcP#?J2t?(Z7KODogqkbzR0V zks3aH-tZ5gXJm%env64g6ru{TSt|V$p}ow`r|FcU{N)04XZa?qxhGo1Eum1tbM*l8 z=IruoT;lpQ4ueGnbjWCKq59S&>ZB&eqK1kmD={9l%B6JN(hb$p#A-0J5OSA)J7xQB zcutB%U~s{WKYFPBDAghf{uP=52JcUUuacidc;@A}x#{hqR>+gPkNOexq1!dzZ%*+F zlO7&2MeaAV>}uE18NbAleMpsL4P?g}%4+iu6#WH{tH%ADCaHbUKd}870?wi|ntZCL zg5Cpiiy;3i2V?r@Kuh+kPC;V(RciNg5!u1}#V}WkuBP=6_scZ&aF-eUO8)!{ z^ZB#XY^gION!q078Ht6a0ex@G3bOX6kJgrDLcaV6nWqS7d@^i6mBQn$!yRqw5plKK z5N@|KU|&z=$U*I)-e(*>@`DOm_!Sf zEKFpo9Rraqg2Gayz_bsSTp$^AIn*N;FuG;1prfBj!BYe5! zbwZe2^L8jT`jfjg`^4FAwkMn=OE||Ei$_OCisinL;~>~DMX2cyP*#WG)~HsvZz@x) zi3QO0342W(=GPgT7#nHaHovV{f-?l_ovTjHXj|_c-+oaQ?Kt=_CEWT{bo-2Gfls8l z(cb2+)@JUht;>#dxjW#m9MFNsq5IVvyeLyKwwvC3lL<6XjQkVL_MsUQSe zVA$k2dE1s$5vxp4%(E1XDfpQ-et|9_d!|AMSne^b4GdE;x;K6@>9vU5z=o6IDP#)2 zSee|>suw*c4kr{h`EYV%z-QZ~Uze+L)tTyE3ACdQ=N*TmgEjPYu+?7&16T;)IE^0_FoY!YM@2V5-T>H+D6gLy)AT%!>ke@|Bg zL?X=rJ9Mzpy^f`M5$uii*xiT(y{2F8m&$DHX@W7tfmv*(`jZov$3gDBBDVAfQr<^G znni7Z1b_N)zYBI3X`0D&X9a>|!f^uEdBS>CbJgK@9c9_4<8YCoTneHQC|3;IQB&W> z;R5wJa`Scyc?(#rXvZn>#N!Pn)Hi@xo`otJM*_w#TR+PH`9Xq^E~S!8$w?8?*EZ3~ zD#@bp6{?_V(O4=q%w}Ge_X7EsIg%TL( zzL=9A2;fgH{^j>VS4~2{be8VE7-uy`>4=1~eWF~Xn6f<;S{{?dq*dEww2#_lB(-!J zsV1Rkya<{!ay}_z-GPJzx)Ci8Ln^aueoqdxJIR~hRC6u@(P=S~tO)Fp%*43B3pZnU zA|7+9>-d3*pN#OU-Lkl%+u<@Pft%e()hl4D@guIZ-uMcw>CJL{_B@S%ZG4gvV?FsU+sHw54SxqJX=o4Z^{=OFdt?M|zOR8FuD)L~zdY@k{2XKMqHdCO zO>8VyWmwhzKG+?A9}xvpe*`Iuh%N+OEd4QlgfYw+9D0(6s}90AypEO+0yC9jr>cp= zwM601{2`HoawfpOxXreLs!e>bKw{M5X}j9iSZUqpMX8OgvL5?SLIDqyfJi)Kp9k>Q zbHgRv47o#1v;HLvD1OV_bKA4ulJ+Agmy4M#irGf?+z$utI2WVc-z}lKt%kWKnH@tg ziXo*yT>-xKwMYS^O(yNH4JX*`5Rj!A%CJnV8CqEJLWjmwBlspk@n$lS)Db3kxOaVk z>X?`Qqv2Uzf%JEyqScYo@m(h?Kwj{bLl2BPo=k?e&il# z!kAy)9ON*2P2fB#Vazj3okwG-6og9~%cED`)(w4|ZATs!Kt&7=W;PuXd2B{E>(*M) zB=J~hw+%FX<%-|}#68r&ZkKO#z&Cs87w|5_)C4YX#x2->5Z2!*o6vsv+R&W8B&fmd zzQD-rbYe2qVEh$jJn=|SkV)_RI$*bJ+uxeg^ttFMc+QyQ`>DVv)Tlo}n_^sD+wrUi zz#xDS6-#Q^6=pM7@oHhWoKCdFoepS1-vVMFoAN(MtPeXT3iH8}RKS)Yn{`({P)5hv zBWGpG@yDCVQ|a!?;>c}v3;z>fp!I=D&1QQZV6GG^K8ZJuYAmdW=Yn4B?J@EHo*cJe zUoij)dtM_WcsfIv za~ZJK3mgh(2p~*!<*A~hR)vr+*}n@d}NfyT^-^;J4cHL8wrBI@@lhNQ-HfSp>pwG~y{Y zhYY0R`D5*!4Kc zLEvR-heWn`as(No*~D8yv`&mEZyGc%2nD^p4HBmzRDM(QrU(MpeM^#DMt+qG8 z1S!`PE|1aT(_*!eeJ8HT*_Q}(IuOb<8&0sRp!9KinNoA|7$GWzDt->}hS zCO7+$su{;?N_rkU+!i5kLKmGTaVGVF*T@Qs(TKVX@u+>9!}^}9XKaK%f3W}_&VuX- zrJ5~2t+)5|5k&Dvs<*2Q`l#3z8nd5T|GJDm{CRhAg%Ui8fq;rDEFpO6q7M>2bzhE| z?vBiOoSi*oWLs#pMUNGh_MdAq#t&}*tkml+0iJjlnrZLH`=%e7&vX~&UZ%l0Trhfk z6P~)#&O$uuum~%)U-KBLbT{mY?vp7r!PG0@ngjA@)c?iYSBF*MZQF`SNJ}ZT0SRfP zK{mOS?w0QE&<#j8NQi(S-QA6JO1Gp4NSCyLB5$Go;+%8OJ@MXs=kkvqA0M*zin+!d zbIh?CvOihA0PiH-(y^UH18u)sRUd%@rTr^acgv8Qr~T~5nrGa(>SfUJqK}FBY93|J zh0)kQ0Ufmdu21I!%lFSS7&0Nt`xX%*U%8l5t>P7Rx*xBi6S8>kle;gyzfDwaJ4;H; znU6wbVAy!V58uPS^KhvhpO?y1E1c8?Zo@NwK%m>=_Blef)pcqZVedm1x!!d7{ki@~ zS6JbCP{DgzlDTon5q=uc_$=>Ifn4fj7Z8@Ff>t9tV1VpZuUGYM|5G=K3N0{MmH{$U z%jt5Oj?TLKBfE_2;0I|SfvlWm&o)f~p}j4NM(SEOo2^-c)%!vs=<&D`4j$g8YHVH% z&`1@F+g&97^6mqhxmx9t3a=YMEuudqt2Z3j6`RN~qGb0ebaB4vcD6>FuH4PQ&(CxF@Ug!3tO;UF4k zMjpJ(Q9)d3g$2@IX#mA)anrKy+fu{E2J&>;+Ubp9p^Q+Gv4LHkwpN?RMV)w%_eT{O z+)dM$t2IM(;}ymUGq)5C)Rl#b(L=A#jBE2uQD@5N`vuB~Xkbv0GNG9{K3mkUNTm$G z!=gl6ljmMsj4TxnAixqvTeWjsTr6!t2)K=ffJTsQ(ncjM@|8#wgn(325Qg@C+#JrW zp}s~`XhGN0z36b_(H=E;k4{`NcSp;SMmKc5HS|@-u$mC!wcU8wo2orVOvoPGzkAS? ze4G2vfh-aQ=WpW0?`sJXZbWP>HeFN{9kjh((OspV7|*EbPZ;m#9rovuJVD!@bM(Sx z(QYs^y1&Sb+&hLtf`?gF#tQyH9AO<%?&4vPj1lbed=<5K?;JbEtn(ut9v-Ct<*g1O zmqaIeSGC1=^*&?f)dzuu_e+6j`bS)Ydi~8G1;~@Wg^{FAZvO`ejXV?K*;DjV<8nw@ zYW;iBQiqh9L_r822kDXbJ4LUGr}| zo_-;OJY}?CPTu>`gW~V2EjfcH2A|5vn4oKG&G$JuxeYnlBm$@eC*NW42oEy2PHd&T zh*M}VSbZBZxJhE>w1|_dxM+S4+Llq#tl;M>=->8M7w)HKtDAB2ujKu|&$|xvk3q@{ zVMOQI;UXFvC3ZYDqPL~qksoQg)7CD)yc0wX-IgD5#aPtShVfCMV)IR4@W=iv*`Q(H zQ^pj?wnNonzvqUEeQyF2T5X4_RbW?%4_TC-zP!`c+AO+gMG0-otNvVewaTu9zsiOJ5Lo52+oUj}UpljC_NdNJY5w3J+dX889^pe&$16%o>`LXN`0n1s z=2NbOzP)^$v7yhWRK0Z!=OO>BMxZhy7^d~T!kh+ge21O=bY`=*OqQRUte2U2|XweTA)W$n51LvW(iq!XqMf&j0X~6-t;k2BO@cs*DwE-^91p)&Fhz~E*TEah|(2cOsgorp*qHD3-e)JgO(W0kW zX!^$sYXu4L^_`fvPB5xJTz1`VdCEK}EI43l>JIqFdp*u9C^(!;=&t-@aeWc3Q#XK* zI_^>X+@Xtj#q#(w!}bkGFj409gDwH_R#F=lC@CRN%U&C$P+Hr#G~7?ZOtAg0yI6kT z=Ko%JiAU3_f36L-U$Cq(GqR-R(Q;TL=f(CeGjv;ZTm!nOFC+NY6&>YmbmhJ9y;3o; z0&wVlOCQ+B&DtoHR}wewK@&$fr*hjU)jJcd??V$OxQEx{yAU=?cd|!pXWGBsGe2c^%cMUFr8~%Z^jUhsPWfWThdT6 zalHcMUf)2hu?N^O_sQPbZ4`$!yj=EIhNEJGu=-B)s^x6CHSym7c7HRIdrK74Kdu7` zv`5+34N@!LF^~Sxpi&{ta2Dw+1i#y6vE6pD$Ah%_zP=7Ef4Sv@g5q-R-wC9D0|^>< z{@8C>Era|hbc>^%p`s_a^WN{~OU*4$FBT}{*tZNpHfltn{jGYWKm$~=N|Xyp-jTTJ z!2JUE0J4p+TCN9Oco3oAr}*z)IsbUjNcXX#!hRfpbRi@92gWB1lC=tRjvF6^rW@Dz z_C7olZ1M8oPwVp3t@Mw+LudVxb-?!>$yW}sg;=jW90;H>UWRGi2ImeD^>04yzi<$L z`veP}!sWNFVuKKV5EGIOBQWW>|GuTAm1?0Cg|Q_%n0!V=5+l0$UEHeha+v!YDmy8m zzt|!OfN}YkvHyR&MPjel#CRW!X7%k!YQe7L-_prE#1PlgbYl&$cbF(cuK~P(giLkw ze*iJ)V+SVjJ)6N3PyexD?GhOGhGE!`qpya9+an$S5HDLc3F#R=%Z-$Q^E>6HLnb%X zU0LNJr=K2d$k&OOOSwL>Fm*8;3QhbUSgO)M-#c_WBMLvqMgb}nYu8lMtiHP5zS_lf zD)l#{&(>j5w7o|LSDmnUjt+y__iVS5Cb*~8+o=BOnDP$M^5584e?H`~*RRrAzh7ys zU7Z#V0TPfvr!j|ke5rX%1HR5IJB*uM=xqxhO*iWfMZP{HM5MW$|NbD7`vid1w>5jE znhKWtet{r_ZZeZ@D~=}fw6#OXibQW=sS;GyH1CzF4asNR43v*?%ud;}6P?t{Knv6( zaI9|Jvs3*jlz|>76oV$mw|EPZbP;x!^cy|?{6!m8gX>pfnZH7-e;n8)%HN|@>~)a9 zG`nL&2X$!$<9d4TwW94ggxyYa>cN$-ck1!l2=->v%Two$=8kIEL&aWfl|q0_zjJQ& z^@Yaa{lPT;oeTM21cb^9)$H`8J4-5CppThqGp zQ-^J|P(KuqA{kLlB4J}4T>B?R_K&v)-2M+(rsO?4DwLNYLbVd`nX9dagsTm-axHxE z4fM&rvw_^}A~iX}T4SjJim`IoWXoav_e0uXZ~&LZxE!2!3Mn4!rNxd3b28 z#l8K-#LK7WC3vP-^0K_z+M}LVI}>76OPEVhEb528i1kH9>BF5N7J^SPn7(WEgS{K& z9aVty+_fAQ_J<8e@y-atc^GV4TK!=yivC$?d#IuP9w@i4JZR7?5f^W%*12QR{(^RY zzQ5C2qNfY!Mnvt0z?Nf+bQw~_hC$4C3@v3N_T(LL<9vHUH6zW>MS!T{)YU0mM0By4=cV-~F&(pq^;(l3I@DzAZq zeGL$#{~Hicn%5n=Mmw}Fd?IPhdvZ6y*p$@f#Wlu;cIVsLf6tE#YV1m-B;1xzu>pfi z{Fp~wWqAI3Te}WF3`~WH%3!=lTRV}qZx{oqk4pdaNn869cf>Fj@a!uCbjME&?sUQ( zVz-wg5C4K5vA4Nn$??yo2czgYdeSdjE1eIbOD$5Nd)@kyB@X_hve`Xc)mL~-^e-;k z|Mz$-7T~d?HpV+jMh~o$pqz!obdE-S%SNu-hJ6741pSZWpHjmw2$HqZ!Ra_;JJ(17&xSRW&gz3)+K%lAH5NNbOt2W$~vJnih%foRli;=hDXj{gRB{2T70H58^{ z;&?p6sownE?Oh@-`<1Ay5~FBh2f#VIlR4g?@bK&vtIu>=ceIMHy)Q@dy6S!tyd*_z z;k3@UhPFI}4O;AP(q)0?xxtIiw*mcvP;N4SR_D0F!JL!eirRnH(F3SQGE7$1kt^v( zP;l@*9}7#9+v+xN?eh(`<32!Eww#?~?&f$C6p4_LIM>_l-(9d@>wk&pu>1}ppWD&# zh{tVL7j!c{H0q7J<*+tL5ZQ!)^u?^wZD^>}Xj+oT;~RC-kR1O$&v=0*V<&IW8u}`} zCnE&NY|&f}S20ham^39vGizXcUK&dQUtT8iA~x@i`qCPtawv?;ylnN7A?09*Tdl6C zvPey=aUxq8FE+=Vbqw|My5hNL{&L#?AMso;4P#&0TFTE6J_L+SnfT|;V~9G%`<|3J zzWdoSDVRzE@f(Cxz>?y@Mh153H^ddiu#1Z>@>I1HVY|asnVP50o8x}rww3-&@$7Cp zp4(IQceoswfSbsGwdeQiXNx;E4_~s5Pm1ymeZv55g^TZR45WN`+k{YMIdNo>-|hkY zX#9j>qAe?ZYIElTz-wi=aVx=YGU@U4_XqEb;JF`5c}aO)U!3>y7%2%QBP(}m< zVqGAShbP?7thRbKt5mLRzy2`?WzNl(s3c7x2MPUk%V~swMC)-FR#B??D`ca}Dof2$ zvzsr@^?WpIiSIXFyZ8$Hvdo8)zTT#lKEI(_tc8c~Xv@2_A4bX#A!ODNefzV|MzgQD z-JWT1sWWtOOinQC6m*{Wf}$R>71#S$Gj)#lq?4gUvWYy4vG?B4T^0Q0fP2v}D;b|2 z%Jt8HHB66X(NT`wdw)!Tn1yIcd>DDPkQ9Gj$iGu+{?`Fus90@<@S$3S&IPc*k>PLx zm4>J^=4fUC0mwt=9i-Ws%k_${LHdY`8#(!IA3hJ9n%D#pTnC;PC_oCf`2KRCRWMay zj4Lnu#cJQ=n`~%tM+f!#wCOb~_2v=NOVbp0+yJcI*XeBc-mu)0OHSUb{VpB3I_S8{ z?89n!kLbQT)CEI1UwvM+NMtd@9Xwcv!aVCFUByRi#3-oTQ-rxWo8|Tyzf09I!-f}#+lkbV#>|3P?>`IsvZo7|s9N=-;Q0Ao+%(>cQZp6&RpDf?Fo6?LKO zE9J>3WTX+qzhmu>_W?LGbcENt~~P1+ZiX4ifz+`8UrOQu9WriV2nu(k0^Yycjp zvBd4a(jV($t{kd}qENMd&Ra~G$nO|?Qe!c4V@an7A-=*WAjM+_(S4rCN|`@V!1+4V z?$X`nQ}|aiwEpBqFP#GQeT4N(S-GnQiEk&f!s`=XwRygLcA4RZ>*>Px1&4^;YpgyX zknw%V{8;8{P*U?&KBn*V^oDx16~S|;ipmLWY;7|plmaLN^3oq8S8X+}zVCYN&8A!= z!e0Z5I|!VX+^ig3Xy8qtLKPIWlES~SLH#@K%Imeu8 zzNDzi(>T^=!@SL+jEY72jm))~eTrvLD8I}gYh2^_OWe#XKH+1Z`1XYA` zaP_gF;`z2#7Mh)4D(Lpehz0&4C>XkZMaOnK#^8KohpNJBdVUkz)CrR--wsuk)pQme z+w>TdquvfxId88L53)Ei{SgrEDI$v>?nB!OYDz}_E@yoo^775Vbj8|2Os%MqYQxqb zpI&Q2JPrwoA?aZC4&P!}IRE-HIXr4r`ohUl-ftIQZn2TNs>XL*fSR>mk><1P2OIHW zf%7jcO<+l;&I9bGgKd`+xl+7~QL`ChO>3&g2SCV)qn2}1g`wd~6WasFO|eSyf~VCs zlQ)5DpqP83O8hs60gd&`-LI7&Q*L2Ll*oKthS!_TV??V~q8-n%B|HwqB)c{waG0r? zTQvK$B_Sy~{^%9GVVZ$I%DSmz@%-S;xsT-oB&DEc%Iyvt!23$Z>ws@Dp(5JKf)dh%`E%z+=LJ z&EL=aP&v(pDRPx1RLJ=qS24gtl*3aIeJ&B?f)F%9CNm`Fz9xfIqhOlTOrR=nFj<8F z>ij=f02$Pt!wihL?_aUjT8Zpo;2GKCne2(Yd;ghj2>#mrQ&NG`J*uT@ljAk|eDgPq z%1?L4A#XVH#aM@5oPGFV0t@Odn*RN%o+KP+e8Qw5b0LqKXhHyXgK|_*XAe( z^FR1PA|<=Ewl}dgslTCERd{eXB#7DhnFU!wK`2Ir-J~DYWVP>gzc)`EWDmTz`vPfkF>7*IXNKc=u6oG9NIFI9gG`rSG zGj1;>F78F{IfprEJLmQFbMs_@unITF-LEQrw}svp_N;1q))`C;E3~616|Ww);8DM^ zZ2o3&D@@R(*C~$cQ-w04j!uKqO^Yth^xh1x1$c|=TxnOoclP=}Fj}Wme|w@?jVxJ+ z!RvZtMyHgGp#xgt|Gco}Pm~qcXN#LTgM+Aa@z-56g(pIk z5G_c=sT%VsRSmQn9nutt*dm*zx~xR4rW;tD%u=*m21yaa%$>J5GkU|ok z`ZHY2aAqCL8=-{veO=IBx9uBtBMjI^@Si-WGQ*( z&uS&~1+Z+TG`7OT+#f&)nKU-X;zGIw%s>^g>YUNy5OhgKGOEdD)Mw>*kLIhc(p0f_ z132SdUu79JVm}(aVRWa1nWY%{Xm^^^Utx6e>DjE>{5X*!J)DE*KuCS3g)%r=pg zZKXoC&eDXdMF)_N3QAUL2ME;m8}d)!DxaXM^?o%u-xIj3ee~OvC#K{vqo` zd8=mcU5V*XGVoRrc5T$CvN(F1bH+97hB5g=do|wsOM4ZR-pq5xlktOhz}5Lso)v#p zsiJLccv+d9@}bc`@I#13=sjrRhN+tEqTcJMla5=ElXWxB5WCX+)W!?{z(&^qKra8@ z3xG_b!UOCie|bw1YxCU5SBB5rjM!V>w#8pukW1U!y$xBMn4L8H(Xsa@tH<9MR)!sy z8;UNY>{5J;3L2d9Zw7+$;=B7}(2gx4%}6%KY#$VA)*8$|EoxX&O_9r?=$`9a zReEW4-Qp+c7a!eIq=P_fR~kY5O4DC^>X{i1u4KJV4g~JBk@lmrT(0A8@{JlQhOb?E zHh*Oa*etK#N^OF~UA{&io$ct1E!*Zt=h~F-Qq#nROs;MXArYVDgym}0^(>X5{_N(H z9ZeB%>tQnQPrW@}mvUX?@*Lz~Q$L?A^)b;(qBUxI)V{PyfNqwzEmZwWzMZ?V;O)NH zc?q?28e>#iLcj8E`-3UTw*Fv<80P&aZ@x@!`=%bmC0%U77la4&-< zH1?z2BI&AH@UR0mt!yHydKnwP%}=oswJ*r-I9>m9_#&@z#eTPq<5oq$N2Vg zkHT+VKql-4smPLzNz?d2yeq)XC|{!5VgjE5DvwpYb9z(YtCjc5T`vz?SlH$Fd!4M! z^ZU$GO&4Np<1XwX9u-fKjE0g2)=jyDH}4yKEY^M~)O!6akAa#+qS!V$05I~jL@`)= z&#X|wNG90(gRW#!HLfQa&+QIPQaMOyJ~L?CARJ5*mQqNlI#TskT z?!0(Fc7jr)U!YQN0HGS(FFWBwqo42pxAPCIUU$f^d0w*9Wg2bgi);)CZJ1jf#ir`C z4uyE*hJl9hX5@QviL@E|(oP)xDSVh{w^@uZ%(*(#Hmr|(A4l>!(#}M<$R@LqWe+79 zR(7w{9Ip0YqF{ZqX$ZK81@4&Y$=~)CGvwbU=PL(kW=XDmU{GGNw48KD2brbxSALm5 zvyOJj!1^Z@SAy_d4{ILBRZ{6Bf!To$FqU9mxrBY9PA)YOU15@8&o<9_nkMtT9p*=!qYd9?ZwA=CwZ7tW?EfeDoS158)BHCMt)_Z`OzLuD z7vkiia~W~>fu!d|bZ<}A(G$3A_K7@~{IF9cS0pR9oq+kS(V)}-d~LvN!@MJb*Zpqv z+Y+k~)=AqbRQ~y0xe~db)-!?^RvwLeWd8cw>uGk+%F>lFal_zdCW+j(tW_#~)?YHR zQU`c5>Kstj%~x08y{~JWS`) zd-w(tkLxxMpadqZZ`vO6etH5__xVD3q1CR(7WoVt){H9o_|Ve@-%>sAdE7_ z^-SW<1LWa*(M)z^;o4^Wyf2m>3D6a343SB1kFz)3!$>B5S;%JH270uf;0(B^(K=~P^HxWw1Y))WQpALYXr7p0ulro+yzCb(L z9O<+iOz@aO)2=_3)%O`E(XF++70aZH^znHG!eBBVHm{>eU`}!&GUnDq0IjaFna=bN=^ZR@94SthXX$l~M<_Ct?O0LBru7pN>mT>@2v?5rKQPKj0A+*b6z%fZMn5 z@#cg+coXA+X?Q+{W|0Qx`gDcq@cx*{YrU>SHa7xJTl_DHcj$a?g==bpY7*65Tk4_> z(`UAe`ZekAmu_N%vg(8;&s0_>zr9}||3eKR9st(gww{anCCO<(a+SugCM~$Q_@cN~ zlmM%hVb#iQaj~$;TNK#cF%Tp_ZKHxd{7Uke=TwQV;j6zG{P+a$NI*LDU!{?fnh?h3 zL9}2y&P?h=E_viP(RFMFpuJdcAiq;bCUUm=vmf`vlhjfZJfo5(#Ki>LCSSMDjEL+x z9?Mlxi)V+oDT-zB*gkH!+e>V{sY+;>W;ab!38fuw(v~WrcVnN3FSuF#gKU%38Js0u z?oN3MdyA#rsG53|Gqk5*sK39oqF1~M(p&Q3Tyqjn?GGng^?E7;@>RfKkY~JbB5tYa zQpXd%6x>bu{XKJu3pF*hBBw0rkfUbxbApC1-_2Z!7(ISAQuMBWf!p2OugBEHVVn!V z*hIf{S$tA*(cc%wXP$Z#Q~89k@p|^z^L@8c4aA||4DS9Sm}^okTvtpcVH^3$SF2=MAI;U-22O~ zUnUY5<#Uf)PWha>7U*o$kyg0u5wWkebo7kPIf$}r7r73+!&om^%AVev&QaqIa#M-# z2Cd9xy=i0`;4ZtaQDe4Aus>lrxvt)5y*25H&F_kts@=rk;kp%=NX%t}1l|V7_`qNP z%+J;N)AMA5sivnFlMBniV+#eiw5xTV%^CuAr~J=g#ag@@rk(_JYK7l$k(;^MCLFE1 z3hN%&FDXClnqa&wyxJdc*7N1EN%3QDGSRzZ@3q4>fRX@w;&pS#2^R?Iz`jAkWwC61 z_NuYqNyW19l;uP|60=6`mefb+>o4Dd;eVP@Pn5o(XbuWKV%8X1Abryvx}uxR|It(T z8xxaBz1wuCohvU&G*f8R6uXB-OUv@*LQ;!LsGUGHO{>g^1w7c(iCShqMz}uHh<&kZ z9@3tbWI1jn^p!z{0s9s0^Mz_F9+p?yCBlwZJbO)6$m%u>yn;9!a2 zilJ-3v7G97;`Lsa==s6iX$7~^;yh@DHBJb}AJQTlYcQ&-vFGpRNDwKjze{|nHByX! zV9?pESz{wyB7oSF8z?0VVs?g|*rG_~Hjj;J^utZ5yE1cvD z4K1zf3LzdIOmr6L<%By!uv-#JYP?COE86+L;2+*oc(Vg+mOHZQy2D7s&YahW5p-NP zXwHd-E&&-;npaZyiVXP4azCA;KDFAtixx)v_SWZSbeF^BfC0^Fr3pdz1VK{` zw8Qya?5=j7$5MF`J&K)are9=@h&$%y$vFCRzXfKuVeM!VmG#q#b09ZO?8xMvueUEa zJZ>Gy=)U%P1X$`)jYDK2*#+YD?$j-P`qUGbrzTpc@aeJ8m{u1Ck=|By(v{t{VWPcZ z0Bl0608VyWCK?gt$OnbI5Y>#j^Eo!@Y0`}A>J~P5j$nV!K?{~|!)rJrX6ISwrsQ-} zrJy}9LS)CaN97^PksC?AT7hI=(dU`Q+vg`F2J2Q_%u8h)9z{hj#VSm~7J@BQ7B?p> z=^gqaDG3==nB@9AGe&HN7Zyt`j@8DooQVaW@}%yX6>`{`$v?s~ns0DfH$G&WIpteD zKT?`lTrEl{H5qu=4h=T>aOqw)r7kj);*HyFGh7>EFG~UH%_Jfxq|=MQ@!nUTs_RZ2 zi#C)54gcL|Y@(fR!<}Em#;>d)K<_Z1+wbA+`yLVcr{iC*U_X$*VMGWhb`}}XB+HrU zFl*IDPC8PiEbtBjvB9b8^bJo=Y3w>;fj1=mrO!jtx>fD&=&a-Z*|RPw3!wOpMHo!(Xg7Su9R#> zUXhJ2p)&8-%%Moe)GZ!&px2LG{;Ic%ErZ38u zTY9?p1vZ>}r8#@;Ar?;Rj~u3%)BAk&C|G{CsoXnL#=0L_(snI$4R^r=Z~x6@k*^10 zfMQ~=3PY=yq1a1=I|G&W&Lm@stFq6&&jM~yp8QA zz|~+Tdz_nl<~`c}PWEx*3gR7AO07yb(TmGU=Mpsyh^%az z-pQWd&F`@7k!@ZzpyfW%j2FJJZi*%7Hm(58l={jq#y_RTSAUt+UQB-b;q|*NnnBA6 z6&0>V=8fVnVylMtqyu6YCu_3;Cgj8#1aWrjD}tJ%Kb$0BMkn!A1=5CX*6n;L{BF(_ z`UW#Uk4T;$Gh3KuJ!>Dd{hFCu&n3f`Zo;>UYNWdapZS6=Ze~gr7M91+;5{P(fy-}> zQ{bJ%p zs4vDQ;Z-V)%O(~3gzZdlO`6su-e|YK@tK3k!Tg#qrQ@L6{Ncr%+ZyfJ;Mb5=?_%^N z3ZT|AhJB&8hl}Su$}?J#;CwbeJcTNjgcu(mpKEK@lIo54Fs{N?BO!idlN9UJ-NUR> zC-l&Yl-mlG~QC#K>eiPo1@K=&hj{&Nu5? zO{h^7wQIzF^yubqcxbt1kqcsOTS;+qOrV)`NetZ zmTu!)%`l#zR?29keH>pDdmLXx?b`?!LUtOzw5Oz}#g;_Xqp(+6EHnI4BZq zoz^(}K?&phERRS#7I1of;6bgv;M4tiU$Me*P*{0}zxu0_(vc{7fe#_>-Jz)0{+=JY zc2QCypGLJ^H&Xpz@5uhB=UqcJ@yq1@9uzjE;@jk4oIr2MF9K zRXXah=8$W>Rfnmx1NLhje0l%j>fv5oq$9P&OT9J_Gc-&{H5?l&J6Q_t#8o%oa?%#Z zXOL|V5=-<8FU0`o2bSKf8Uv?`=qeCZZ; z3{{CR>0L|wp<5kP$rjI=39klA7y4*rzx^du-1lkIJH~8_qv?0Qb*l!j1>!MgC;Q?d zW8p{{-JGUoK)I`varGO$B6 z7KU~#fWx#9`EIf^?c8;)#)ChWoIiv_>_tn)z2qP_&r^hw-D%$q7Z>>YxY7e^b}6Pb zDkIpWzj|#@;Lr1kdv+nhgcQ>gP>gQuq|AV}FE1(KVjtuSqHVGaG+H%!>E+d_6hb>f zLh_g@543eOvPa-}qnw$YeU}DFT>o-W4DIq+CRJ8emcO%gTE=U9aT7#iXJ<|z*5WVT z?vH0@wObJ4A;oIAIGHs{-Of6c*)iT|)v@-^2$h4Tk4Y7cbOiF{llb$zQ<0xO>wrDsHw+UcHBgaFatUs0CqZ4HO2Cxr z>n&}wvBhi81aF26r=9M#An>>ge0OH{GIw!_GiGjci51DToL1`)!1ec?Vqkbpwl6O$ z#rrbIm-IL~MG6`{$q^gWK}k3>zp z_qr5@94R##L5_Y0m8^)Edcf7i(Da$`Pcb*{>e6DZt1@Pu6soIXIz=4D>x#gU3@0p4QPs81b}#{#lD+tGFEfFYH7(pI_aUx)4?- zue)fZ0=QO)oMw8-clYUnph*9>I7Jp8@-zj-GMuz4M=V^=5XS%UxwmW}IxXu;}7}0My}z8$SeMs^$7H8zI>GnDFYL6Rqe(yv=AGEjiA8eI0 zcU4=@)*_oGyUb zY+cM5bxrq6$8)1@5Qi;UO5U7GAkAE!ob1BEW(~pv*vGG&0`lwBZT+~UYlmmk4N-vr7(ZKCal~GrJYtz zcm!2`#g*OCK}9=_pYn+G-#rz>B+w>)r#pRp*6L;z`;Dx4pN{1TKaOK_60ck|3j2(SRgNor&;ypa<)7N~cYYjrp2z)cM3~XQ ziq3m>2kY&ZfB!wYPH1p+Q~@jl%f-we0=%6Zg5Yu`Ae-ur}f*1tT zGKy_L-H&97$wv(K%|8$&ON2jSj%UCN@?|LRB8`T3FeRnq1^cEu^kRuZjihqLuPvnp zy$C@Hz8&H2?5zGoA-wZz@1CI&9=D8aZ*SZ7l7W_9m7ct4wt-s+SLE1MXTAeTY|M0N zeRZrHdB4B|>nekQ37@FMIWw3jzkm*Dx@=*DELcykdw+2i3QhijK-Hmt09|f$L{Q;u^$Tmlb zW*i396FwWNi~&X_k4Y3q;henUl3vKp@?P*Ddyy;j{x>`L2d-vi zs3&L2Xel)=I^@P(NXR=nK2-Zi=CpK#pulv8F47k~U`ZM9f&&@KMaiOhz+&g)1qJ3G zNMgy7QcDrM_O{qNt*zobncdMa)D>_-HPHyQ2M^NKZc7C}=7LliKAsj}Vz?g&PO3@o zU*5{myyFY0(kAZgX#4B#yC2Cc+Gb}9T<)qxFY6yrz&_ub=w?sd5_y5=_1AZ)fqkmg zkE@vi30LY0a1oZ+RK!@Oau{dPMB~cl;Mq1F6P5_MoJ^a(@@7k0e=Hl@G!jy%02RZD zfaia>(6~A)|4bGW?a{1f(vBTBJ!}GlNuhI-B*(n+4Gj%>&{&G|#I;eKB!VqLPE#f= zbT(dO4S(4%I}24Q04tbHV{*|+`(3R3$h8ib0&fOZb?$g@LKCKHk+GN~L+N^^$Eiv% z{iZsHFfY=2{oh9<%jSR`L3TkfS6F-J7WjPIP{pHq^U#icwdsvpP{nnDu(MlAVrAmXf z-NL)mh|sbE&FIq}d{6%|@2{gPMp`(gFT0g2bY2-Yb6+VA6lF zhpNi={PY8yed@l)_xcHM^NS<6+qqEOm}15Y@%9)+uVVD9=;+&lJnzQjHl{mZ=8p|S z#Yh2CEPB!bOD;D`jm{w-puNIp6q!QlM07Bhw{tQe-B})s!-xi&bl=S1fUL3(bcqtQ z2btiZWJN2}V(rU|iq$Cu`D!7>B*{UeC)nScbx^9VjK_;X$45A4ayuwBI>*W6pyLy2 z7EVhPDtV_bLSqAG*V+SDxR{tL7RTNYCsP-2@iy0@vNJvAv0v~yrDkbiSdqP_TFoBG zMn+2<7H3_hS3eO#8UG}z0<;h>w{Se5MG6v=E`Q9Qm(A)$Rt2%Da4VhIZO5L_u`2#@ z$Wyqv+|(D4T8DJ!BE{EQm+wPv=Q0$LcA4k_%cK`;-NQQ^xV?6dlE`G%3$FpTA`$Pe zWBs4==)b^pyIV5Q_x@wD5_U8OQYnya!=E$w?*i`*7@2lPm?UYsiu8wlMVIGIo`M2& zjO__1zM`}ygo(UnI3`a*?UEF%!A<9wpNLf3z!NJ1d#`4jJ< ze03f46fs+ZFxe@kcBl?WnwJZb9kBxZQ{CAK8Wll-8ogbFui+ip38NK3zM~<%p<>YG zjhu0-rPS!C-VRDg?>ZefntfzJYWZPsV7Y4-aTrfWe&WN!pumUqq9idqj|$@IKe;WH zP3VLXtQeoZE+T!}oRVVE%D{l z42-ZkhCla3)Ez&A)AZ&|Kb&)KAR1$epVHof(X;E%B$V#w-X@=fzokxiiI&Jmfr)ph zArr&fTI=*q37j$z6gU%j=&~}|?1KW?9`=TbkS;UiZa-g2D@?`@yCRDa6jN>Ku0Ueb z$WOZH<;z#ziV%KqiR7e=Rs;wByK@vASbr`VCQF*hK#*deEJN?R01q? zOK_kQ#JMPjrbfk0L1U*qdz1G0mc=fPS3E`h69>s+2%dV(J1sIvhof6EVdOTZ1hz^K z+_&vN&@N+pkuZQ?D(&2D#TMf~?Y(7%IRBk)IA`ey0lDe>DHQw;=AG!gmrV-95(IQe zyeRA6sZoR8bNrTKh&;i;E`!T+{YaT3uLq~Kv~jEMJzCRxjs*xS#3!drAc2a2@Qe5U z7SI0aWcM%5Tn9|sJxlZ+mSRlE5KmV-9%}0Nq?d8ELt**sSzDpS5~n{>?XaTXSfG=w zPKaD=aC6AOVoQFALxZLX%p8U|`7C`TXj&CLTeHZl*cr&1ma%2O4bZk?tqTx9(%Z*; zk~kq&1^Olu_qk^HPrIfk3e85ZuPtX)sl<|w=>{%&jHr3Ni1F>4_1P&3=w*IN-c;jO zTGwQm{E59PF0o)OhCym7C6U7@CyTn3sBnjB*#Bp`}E3;kv>dgF>nSYMYxS{Fd#iGNc5-gl?4Jo7_n*aYM` z*?XpVpS-%l@(c(~o$HH%3Bx#%o${DvyUO{9QR4g6)9zD7U-TM3gtEy^O2+4qfXOm# z;b|gQWmbyd0O)!8IF~wNzM%=v-Fk_FQ1}usr8;!!;QvLlVHc%RXv(cEF*E)3A0i13iZld~` zb}CR6yRvejqF0isX1cUCKjd@blY4)_pADErP}M}!(-Z>&l4s)&Dl$%q;^WIbJxdCRfllGa2l!T)8eMF2q zDG6P(5$vzbbfM#`BeyxjjEDXqVI%N^6qQ~frrX;3pcUMT==kc<%k^qu?5L5AtP``P zwCc8zP5|gPvfi65rN)+*bpk-Yk$uFpl=?eV;^ceD``j`2rl79NjVA%h{Y=u`qX(iK zaKzK?281{^4sH72CE|N8T{=|gVs2AmF`$zg!}`FTeXfQnMJ_ zUdqk0U3_e>T|L7;1+TnGK6xW-bqCudzkz4SOTwjJxhG$FQ$ACELWUQ>y&7(KZez}) z7jmQ>>7u{r#2@v8PT$}8Z;Y#Hypwp>gnm-UyjL=`R+J4p6-A&0O7)8MJ zqu~6B+Y-NlwSq<7o8&P?DiA$!wr7|`&POV+ZH7_(`K?Rgt)Zk*@|vQO&d^!yZ88B}JU*RW9)lm5`8krBy}j*nD1j;{(` zE9mVj>o;jHrxH8u+t%JHPlLgo+w+jlzFBrq2|(`_jVAm440<+jW^1#BxnGFvp~}rL z>a4pZ_xhX_KBMc2g+(OL)J)u9l=4uxJ&yxdC`Q0@Jf6duA~ET)TX?jvfPHP&vSG@h zGFWYG4n7`w`S78|JB%3BBIKOqjoL*gt>omIYvfFOU(m|5=kuyX=^eZW>D?r<{roPsx6NtSP?tEcvZ&t!P zqdb0!NVl8QUJ_uuc-&|Meh%{%Ac&b4s);%p%hZc{5_+7<)v9=-KQP|$iE zIKKYDe#&l{PBmtBFJu7u8AXeWY+qkHljW_!3IP5XcLRAdceOk0gW=j7e*ICLt-VqF z@ih1QM-1GzMwPM#&_Gzx#KwN*isA^@ zSf1fs6_BK_=GgUL3!hNlQn_Ijp68{!J`>dO5(i>|{Zm{myTS#>Nz-NB5P_~;^EW?G=oaZN>5^t(Xz8I#x^sx{@_wHC zd*Aoj)>_+Ie*xRZoY#3C$A0|w{fMN9GMS^OV^7bM?=X)e1lQs4fJt@F6|gZPg|YaG z96drAqjg47+BpCG5GjBE5KJQ`hgD`eh7MhUK(VxSe1s~So44XJb>G+@P7~KSFB1ki z5j71X4hxoe{xkIsS%t9dS}kU7d*Yj#tPwN960SlbOqXb3ts;Q&W_4`7lkY~qvW8zr z7n(*N?NeEoHUK3$n>Kl8ND356OfVi}w?O-548qpdxXfvy3~A)vKK2kot#Rm}i*Sl? z;Xo#(VC|B=^xeiQT|K4Y2{S1WPi6k`#nQIkGmAG*Bop3>K8aDRB?t|+8Sf=X_Ufif zTa611{zrL`i~INF<(7zqwO9Eo-!gN~0VXE)%k7v zIw{VUne0ej24%R`d=-9s77A@>eWclxs=j@eGrqB5IqV|G;~{d#WdB=S?qYC)M@bKh zXWN9!`a0|JBFF%eEsOmw@60qbCWBOz215#^iAj>YTlm$#3PNsjo3vCfi_Sa?em`~X zzF=WJpe7m7AWybP9dr6I7(Lv3dk!4EpB{E(|<(rMv27^&>>Zh-(3LrMnxG3RB_>^g~ zE@agXtjulohCI0_z+LXufWVc0WtMiSc>>Gqy-ux?gn+gK_QYz1KYSwjdV-u+o3QTw z6{k(C<2dyv^dD?k3kA7q?*g%$)r{7xz*L~I!n{SDRVvl_=)u9NAEj7_AaOWKm1ip^ zI!?EeEndDpn|j(&7(^7LF!VK{tF1}cPg6I@bI^_ncq+EK-sIrblo2Y`>v7R(z_S=x z^3wF2O*g0oC{=;(3%!DMyCczt13Z1NNi9Z@m2xn=+sCX(ss=S%-p|%0b5N#frtb=! z)+b+g*|WYs(4+j&JbAEUKP6Fo;XyKdH9Wv${KEDw!}e!`0Yx}+ds0d9-Jbb6we{L3 zY+$hWi25IuI%^{Qe~h8|?H0Q5LF$^4Y%R^week%`K!5Z=@0C;4XV%~8Q1V(Zqd|Kc z+XZKKtJ(imzx?mIx+>X-?(F+{K5 zGAk*@fIU~v>})=im%4GeTJShxwoR`bj>?K65OKiQAh50W3tamS)3ThEbNid^R(WJM zEqIuhLl`ymKNY2YIsd?`r{I}^qmdIAFFm~md53D)XT|Uc=KvFGG;{Melt0|jjze{Y zWf++|OuAxoT9~(O`N_zG{*q7ygaebr+NWE(7_sFq*Q6Q3F$&&s(tEv87^3{Eg0*pI z@$-19u?6e^4xLEW(BuPB-O=ct~EW?xi-bmVbsKJsz&qBv!4sVaGHAwfG=H*J94<&PJC4~_q{EYXYo z`Po%?w$t}S+uPfMW&_r5m6g-cwd~>|7bb~CW{x=pty3ih^YAB?_haj~ehv1nwmD!*NvtbMGGjH)h9 zFLf81;A9*9NKNwdl?+OZVzwO%E#g%?En_e^>y_-m{TdLZ(ip)$Gv7>R={V$220c79Gd@Eead7)Vkcq*U@vcYN^SXaMTLAzuE>$eVL!I7KV*R}S6CN3J`OfVT{@wT|r) zc|vsI9_$=ETKvaTOZt1_x5k$tcQKR6ZrCco_xjlOA)}yghFr{Ld=hzIRB`frzl9pd z6z`vJ^>3wV74Oh4x$0=;;qr<2)v|Qk8RcO+8PRYuNQ>0MVxz%t_#C>)$upJa*z!ct zXtMWl0)mPOSW4P~bUOG^WG@{(Ik^(fQgO)rkWp_WZDJx$*>`byU!CB!3TqE0 z!I-BcGV}rkxb7EZxOE-2Ipc2w|iQ%+>F*)|#XiJ-z&Lb$iMo z-2H(R@c?OdT5Q~Mv$ZnMAJjJVMyY5$1}6cVmzqhZA8Z`zd-*M=46aT}bgI|y*mv)* zRonZ1)r?Tl=9#bV;F@p!_P<@{HcMK)|czkEydwj5-uaJ6;yKzdhI@J zZnX<13^#t&kdSbzKNr}#t{l03j{qeO0dCs51^&23)$mQb$cjeP1Qm&k=HN{Q@R%#*#L{+`=kV7A8{xk6IOCB%U`SRjT7~}=>Ky)@C1ZexNZhr=_vecNk?+Wp~E$Kmgr-4`MsX^mdB(CWq zsUUK$-%v$t{AUa)W?6;!M09jrq#Q_l*LS!W^1eFUDU;2UKm%lW|Pcc z32pRj=79VxF2BPk5cIC#vir{lC=8q1YMm^JJ26G0HR8w5*WLif@;`-79~Lsp#U|us zV0V+d(J_I;!;o^rO)<-Ng%5{|{>iTAQP8cHv(<@YUT0BKQc|Z5nWSK?*mxI&+eB@{ z@r~_VNZaWm_w7c-$Wb6Jnc?TteC3{?V6BGBOp%77*!}$u$o;36CF0xsezHEoi@saf z>+5IH$x`n#P>76twDj9@`XakaI3y^iBpYkpL^c<^^rN{d+CA7EG6VgIc+A}0u{RC< z&7yn9)pJ73#s)_`i)3N&xb~LSIndT{Rv?8#!@*7{GVjr`x-kq&?*;7Wn>^J>&~8l`%9{3`bC=sE?14UnIF_drR=_aB}NIXle*$ z;FU>3SiX8#@JPo9A$LtY0h@2A2m{@fGt>5oXk|#cpc*duNxrdv0sqGgPcHW06qZ^h zZd8`QYL8`92DXzL-v05p#&Vn-u(#w*#dS^J9}f-=9v=pyUq|dw zoDwxQChKZ`K4l}+(&xaB))_Y4*y;}MS~TlBg54|pTjP@$`R^kLm{#j+9Qq>B$82mZ z*aAF?4kZ`HuC+vzT967>@4A0ohkc`9U2f$x8pfgAES3c6am=wHG!}Aky9$&2_CLbS z@>-5^;o*9b`F{Hd*RE6NUnsq`U_Lh3BrRWvMl>*^%*XqW8Ko2}PHT#?#m1wS`ZE+O zK*{B~bV*j~EgUy7OnKjYL8XO%{{gxU$Vv~)(UuXyRK7$yq*FPf-?7`Ye!l2hWn-r26wZ12;Ze(KXx7k@$>Z@ zVj)vOos9vRiq=`M`{`$V2Gb5#)w7wV^s>v*oM^M_lju2@{b5O1WFnlHwAc%V6|t4& zivzdhsY`U|qC5yJ9QsVc9T)Nm?J--!YVocKOUbfPs_;3M11SZs6;&|~Mel>y74gO1 zb!_|8tlFF*{>4os$(G4I_B0JG55;`l{!f2gQAFJV=Ews!Ve`->LAU4SbphpazWxJ*j9G?TeSlAGYP$LQ9u0RdEz2t( z-M5O}a1|iL-bqFRNZudh4X9rJg-JHC$FHa@=qUq@o_>k^LGkH@RTEjUV$YQwo2*j~ z-Jh2|ANEL576aG?0%qU}r%?>LxO{bi&BLPwZt`ofpy_JpuF7oZl>-kk8+zS0 zcm-E70Gk7s>0`5_xGNjVZfW~3c|FkrkV9O`4mn_aK4ck8`_IVOy2`Xk>-|JIuZ)kU zrXXm~yEs^P{GbD}kW4>fZV59G>)j&dOw>;NMVkSKs!K;*y5qTjdaN?Dpm*n1)A}rJ zZ-LB*V_?z@XlZ-5cDUG8qfKU;LYt{Uc=X|ef2}?z0u%@-Q98xE9m&;i#VzXSfQFzb zi~n8oW9?3+`?eMU<-JzbA`^kw8@-0sw%!|Ww~J_o18zz5#vmvOmC+S)Nm$dx&e01? zpx$*)Yw!W3rV)9#Env^wqg;PmCmp`9zfn@r-t&O)=AcAQ_uWU<4BvV~yy2C?$fOR1 z)QpnXARu>(#}bX@qaoiGHzHtuh~i@7^xFB@!qs`bvNa;H)MW#%xaqRCxi?F+;`xA_ z$8pu&W7!;DV^AoTBH55HJvstRgsYB$Nd1|@F;b@Xn;jO>iy1S~DIjzKpqMxh z_iQutt$=lPXsY7Z=K3Iw0+pT??^9!5Qs=896Nh9w$8rN;S@g;2Y2$Wdo4DVG4)|_z z?ReR<9Z3=0@%42u+6u5Z^{{TgrSqhh%^<5t()&n~CjxOb|A{zA z38M#o`$D$a;5@t{=Qc@KTgFyjTbVjbNr7f=)x-+Slifha#3b0!C}o=i7$10;4FckY z`~W@WsI?0c0)i*xjPnx1O29kD8*Cl5_L~EHyu}7ELAfq!(3XsmQ7~|2p`BUaAQ#w6 znK}AIkOP&C=a4SlqN0W=n+};NQzgIM&nG4(^ z=KS@mDp=BSp`cq^sEyfoT|a9DTX4kf-HQcrKW>6c+?d>98EeA(doQA&2mc2vVp@oJ!SOs)4mm>*f!G z8jbiD15UHvsviC>vo?BFT@zcCpHEm17+{!LaF%OjFui)1khx@~a z@0mngmBuK4Ad3&Y|AH*q2{qo0syqa%yx~}Mj zubCzCgunTS9jA_pXK+l+pb^I5phbN??AJ?T#2Lt(cFB3wlQXaosZc=}|=ICqvYUX|J>588KG&#}L}{a~;>Czy3{od=UBX zWp2wtu#N?c;?E@U!W6TFRd;RwU3OXuJfFC>rJBw*2o8suxw!R@Pe5ej+seOc1_o8% zRjgR;vxuI3O!sCQXeUH*^|`#HQaG%sUu_g+n^E8GNX!A*6b4t+sFHd%5`ayvSkC z&H0jZusIWl<>U0gU5c3>*0wX`6|EjP0sg1h2ubh0h0B!^j`nR+UMyvU<^x5Y%5lP zXoQ~af~>EeOa4S9;Ih@Y96q(`#)`HZ<}BZym)gb$h{hHvb649ff(&-Qjho_PW_XrF zJDUl(2U@#rDQCsbqtUeB;Gkk@w7b+E_{Noi%y&fW(%5mgl~uPywT^M$MS#8_=mdeP zx;oLNRSAg9&@p;JN4IAx)dXGfiHrLw!%Fe4?Cn2>L}6$i{AwYKXOnOl6@kv~%X`I@oP<%hRgp zu&O}=1EP9drgph`Ub4Z)Vf0RN2?vzj=!ZYP=YA) zu6X4~z@1aoWcX716^IzlIUQek#aOFdLO;qjK#KkHp4-d%;5|gz;`=)$*PLC5-RahbTn5$GS%zSx++Z|f;`xkJ`i#S{43 zS?A=!mV){43lz(`>waj?^x^*C;dS9-bKd>_dB+F7GXsgxqIj z-NpLD&By%W0ln7~M}6o4L}R0b7{km_hAy*wEj^DR9ZZbzQw~0?b`a6#~a@9O)hkq7#Ic082@LhN}A63*bKpp3?$ep8xK{qMogY zP~(%=w;kN~$D#C?zCMbov2~A$A(VD6O8%t^F`4ZE&zIg9#p>cl=wiMnn4~kKR+^S! zEiMu$sP`r>y384$jJyM`?uV<&k!_ix91@5Rr*^fg7r98Fvan&}`1ll|0e+o(iw_1f zeq+55Q%%Hr7%;{+PJxrxP5&}&w5METty!s*xC(f0$GJSPYMSm?YuupQI6$T_req0H zuqKEWq;b7E7&Y-T&<&cl;}?AV$RR&HF$t1F$O35PZ>K#<-@L$W%`G2WWQFMw2bx}f z%bxfk3S96L)jyKs2j`r2|3GT+e7$7%SDMzU#iQJP*SG9~3%+VwbB`dlA~@s$glue4 zg2)g0c#@b?0V0o5;{%9Y5M}+tq?k3%yzpMG(Od;&UK;%DX73CGf-7Qkhp=jCoQsJ5 z%KN1?V3>c`$uARx?=ry&)a_M5!d8VhF*aLK{f9)w_Ik@d0rXk$4-N;rch#%XJP;y# zmB1(>*I;(#bZc^AE>l;O7&N}^VzSxey6iD6r&Si4Lf560wbwH1dl>i}XeWED3$h{$ zK!Ldtu`#uanf}*&N8WzG(~AXJ>r48!2^@cehNnV}LM?2UHL4OJ8Y%~RlW|(%E%&`f zX2^^8{R0EtCzngB57B_g;jQ=z5cgW3OKFa+!S;C~SKt%OkY$Mn!)_K?4^PfutBrdU zxNtb%Zd>=s24!|&yIsRBS><|}jNpNwbwcl~p+ox`$Pc-X=0M<&T&nn1$!QdO3i;Hp zO$A1wZw4Fs9ry5~Sg57|`)7me*Ho$ zEJf;34>2bhQ>f%^zr_dIpwrSd|7~>e%lczYj5mMw5(1d}I%PydAvzeLvDg4w==6F@_$eJ5py^#mFEwrve;-AVb+V! zQ-Zla=$Xp=(Nh)paUf(nRpXXjzJS8E<>DMWOR+7iNX`C(V1*#8{o`*oVOVcYy<2>< z1C5iF4N#LKFU@4Uh5ndgGIm`tPP|2KUP(jx6JAfWjRXhVHBHrzH?AUMsP|15! z75*J3sdCWTDZtyaDCT$A{npXt#`EfbQ9{Hh;JxS6;Nen}TN8jzK0H+DcDr$v-Zoi$cJKpYNT93!{Ms!L`X2_rGbGUe#Dlfh_Eg2gUZwDD zsYuJKI4HT!tG*kQB(Xh*joXVj-C?({yzp~O-$R8PgM+F&50NIIBili ze`KeS_1L)w?5)YlQ+f#bU6lh9L{uN_UW-3--8K9Ai0bo}jjEnfjn-6i*3a8bp)!2u zn{>?4slA*0uJkT#G_8(u?*=HJ8Yc{eSZr)uE%)Pzr!QC!Q*!=Q6CTdB@b0O-jZH46 zR146NJ|}*0uoWyvN>*w4@Gte(o{h*k1{~2SBLldUm`)<5Gy4JZqKjXIM~S;8m&kS> zM2=~eC`xUfXjcZ@t$H|D+w3-Bl;c5csoW;opB>~QBK8GhJU1-^wx z+O2x$d!l{aAX(rWNKsfebktu^)h0jOk@H<;kk9UCYGmnku!=;af*rAGbje45}quIXG$ z%MnQ=NQ`^6aboc^44xlxe|!m2cEUp$|EuR^=%nN<0ueb`qHVU+=C9KpAjY7Y8Cg=^ zgmH(wME8x-O7R0$#?PPF8{t*^?;ehR1OnVvZcj(HrWZSc(T{)UM1QZYuC^EF0hTh8 z+^6qGOfnL+ReiGM*;;jdu_W1e>h!Xg-3#hicz}xwvzcAE#-K*YTfM}}emoxBswVj2 z0Da1|sKAfk&7Y~lniVfh`p=6F@d6A|ys=@@yf#G=U;+>btUSIg-IzmS;SP!yx;1V` zEbRPlOkIaDu*q8Ps>AghTyxAT?VSxnWc`l`3|F-uS<%D`B#cx^nVB`(Uk=@4c`pQ_=-&!mCV1JJ$? z*4`GdXWl-XIqN{>d!xvy7=n`AFG?Upor5#}N%)doFr#_d*iv5m)sDf^w?-ka3cEn7 zT5xg{W0xH{y6cpcIhkBn{N!&$jxs?^|jb6_(12$3b=M*`_ zqvY}X6z3MF#`lvw*X;f5JSQ1vZDX-n3UQ*5?fJSiT zYxDij`G}gFR+9MEdnEEcazx_c6B%q#|3nxK=XP6{*W4zZ*ILxj?_NGv_Sggtqyeo` zR9g}{7oH`P149WwD7DV~bVb7|20UZFN^ciPG4Pr{9Cbb& z5?K3$$^Nu?4;Tb?v1o>THLnndU8HED4Ga>sex$GS_qr*yZn!J8emBepGwYXprCa=& z{4F5;nb7{PrN7^0yQ^=-N*K0-hsNLlG9u(R^M0$ZzPvnvUrLCOl$SWGtcSBEk&Iq< za6d-<-TaNUMwMoic-otG_TsMr;nI^?%l%{Y#DdG*Si>11YiPGLKGaWAVtlPqbL5{zB&F@;50xW82tNeZ!Q?C}*n z4y|8ZnO5Y*X|}Pgs{T&ym^5pA>UEWmw&T_?U=yX7CstcTPl{W6{=4i7*16K$C3oa3 zBV<@JyZrP?LyC)@A;?m%6lf2r-p{-CG*$~6LHH4+)#idV>)osrD(3bLuC+`sK4Z79 zj~cfJ{QqLm^(u507Z4EmHe8E|GmRs-?kZ#BOS#{@Q*+)(co%XZnBPpe$j4VZQ|s$EWAml7 ziNcmTBW|Kyaj!`joxSah*+C_;m#RN9;$5+7H7YF$)8)YeL`Zw7-_>jrW@PB$oFvM^ zg1bCW;;^j6ux04|>VB)f{)Fpc)pXA69~R)wMeN{q33;{ja9O^zd@{(sGI=|bJ!Vz8 zo^g3R&6p_@(D9sA_m&yhGxnWZy&93_eSzB2ctrt7oE`|f+qv3@o`v=Y{46BW_a425 zqmhYq$*~>zsJ-zHbWh5o&+cuD_f^E9a_{uZW2TCaz_2DqF8Y&JA{GU(KZqa%n{28_ zlH|q*xlrYr;O{?_%6B^m7=@QZ6g-COC2ma5s zYqzORpm7f(OmttlA$ZfwpCrw!6FE?q0@i_-%GW|GUpM zClF?Oxr#pdC!kjLcjPbL^5b9!NZk7_{{>D=GIQ3dRKRQw+5G?QaVwN=#v#S_lZNqN z-(!nfB8XoQyG`^6mR2I~H##{;Rin>(eu;jO*sNE#4~B0GUk7t^c}Afty8ef0fpTmz z_8DQ{7jRv(m?1bcB`3zRKg!)&Ch&g6ZU!A z?=g6F7Jigsl28jVPc1!jSBGWx*ow}WUYbm(<4(ag^A|_Ysurm0#7wx9;_wP|%M%N> zrrHegC$kwrCqUp@PZzEPqK-!hZD4qk6)ANt&tNc4%tTc7@c2~x_AgHrVLVj>KbcYV2NZ)hmvG2YO7CbHbHmJs!7YFhxr$Jym z(tGI58s4d_g-YpV)j-0Kar@7*^#qGnCNs7Uihy`oPVG$danlBQ$oHw@1h_E_o>2P9 z;(uvo)7SYbL~G?e84TRG z&RQDcHRhXYlWNgXTozp9!Wx;<^>WFU=80yUoYg~f zw0G6QL06&;u7Fm6&i+0PHjmbD|CpI+`J=T{td_gW{(IQvJz_x!4;LrQNjw}%3jiuW z1kT^X-mzxUH})$OCCvLJs*1-bN~J7ybscqFm8fB5!~ zrmgv+<>X|EtK1yRPh6rr!;=M=a^tmM_2_!7cOaWJcg=#jNSNle^Ue3`wAqY0^}l+G z|C?h1z%@vkLldEZVW2XEy0m(8&*=WFR@+GTW0je#Of4lTxe@B0`rkP*g*Jtn-;G?* z>92ak3*Le1;M!4;M1UV;z5Vt?@pgkF&>A@hY;ubN!WP{4!S_4b?VWi^hI1wkTU;x8 zUIKi4D+kSovfkc8S%XUHKq(~J{x$CIEh)-|as<)JM#lUxEZx?5xDZ;{0H7Z@0I!ln zD2km^W%eb`TtF?gx@oa6=LJ^>`b2Q9&R_o{(CELSB61ChlnK>eXYTViXYZu{B;Yac}(~-QO%~94AuMMg~)YvyJAxq zEK6SCdDC@zBgFgAjQ&EtA8N7L2q?gPS-v?{w=8Z~eh4IKn&;qj4e2FohzYXOzGU3I zTw}1EA{14g_l%lq^~V`?ADe&jX*Z%bsFvIi!1OWevWjD)2K#^Jfmzs@s=trU)Jjzm zD=^1>u@a4+)moL2XTW(0$dbRVD$9B!*d`7A+dUMk2E&?F zE|vHQ_wlCMlG{`EX&iFb!)1ndkTrB(@8;CE8nKV!whheFdR^_6des3TFgQMbojros z5w!RD3|+6Xb*_&^%c0JAq^b$@|uqW6HDi~KTEP$<7~pV57~QzY?cgrPq^ zrr|AP)=l)65#!a*&d^S~InD4ihif)UU!~UfxQMs(6>aW9uNc>4?}V(eEF6k-#pq zqM}z6%x2s<^R^L$#_OS9DK||l$9(UP7)$k$^wGzQ&}kqh=dU(|9A!l>N}x~t!(E&2 zVRvZ?PgCyk<|@6{O$yP~be8wd12F3enBvcGYC=nT@60xmRrW9vC@QxpFaN>#5N8J_ z31e1dH)wbcsM*x2&=l&vNRqCH1CQp$pz88kd_@Nb_WQE}i4N0eV6uemdstGCP2j$*GGQ3Qt53&#+){mWY;?79vJhS9kWpr-3=azxIX>e*?ni+rUp7f%$DL zmxhn;Woh%ZD%-HeRXZ)kE4E14PathWf0O`(e#ikl&JM^oQc`PpF#(V$VNyNT#K)m= zqc4)EK`*|%^Cosy(_Loj!jEP`)vy+HR+FD0?h5hxjl^Cq^A^#LyX{ywCt}Uc3&$!= z%}pfB2!{*nB>iPdeWe+021RYprqBfDCPIH8pFH={Q=u(z_h5w>G(^>|Xv&3IzOkj5?7 znaoGNS-LW6Jyg|SIFr7(o;}0x1n1W}t}(!FVN8*xr?6xURSMnB>>lM5_~OiucPp{U zCI=_5q`XQ?Va6QNTPJfjZokcw7W?DmSDm+_iTIffU-=pCLbkZ59U`WzEb1?v7^049htt7{f(4~p0;RR=KV%vC&^Bje8I)<<>~$EGCN{n}-2kCLrfUFK(#oy^pE^ zD9C)eDJ2midJ{bjIWnbJDD)-b-T-^pwR=u8w-YzLbY*L|)Ta0jsHNNAqA9d5MFXIV zw2aIV%5_1;1rNOWz-E2(4AS060_gYlJU-RaM1VNNpek+%b)$}3d&a2L{b}pIH!5yF zx)zYy7uu0#^GOb^-k|(Uf3$I)@hZ>5XfI&$W$&HgI-KHlmW@7#rLCm};XH*l+Pi*8 zm%vUk5+_4JTVLs4q4l~Os`ozFGuC33FgV5;AIG{~Dt(Ty&^GMT_pLGeRk+fCET116 z9X5(Zew+o>dA5YUpE z>&vl2#@|6HIJ2)(&7Duf;`)S}C){L!RSKN{Qg@s1w>yP?*{x31Q>_bJXL!|mD7E!W{)Nl?nvD=6aKGnz`dd0s<>SR z-)XFAJd?2pVPp!+6AerwI`uytdLobCTVUhx|K&d9v*&tsTvp;MEr4%ofX1V3qi#O_ z(-fl)g@bcj-S`)kVirOxYSo!$)cx;}xG{b5bVH5`-s^xAY}>CCYhm17Q$4}xYcvrr zw{(4{nFw@++-1)Qaos)Q8r1QFx&o52v=dn^^7Cvs+R84zvqtK=cr~F(3}V+!TUf%l z?#=~=`^)Q&cg`!NKG~61{e4P`c==cqFFY&5e&*CLfgJ5ee{apf zhM+iG;0CgQ;`^}xKiRo$&NPM}-~{q6iKp=vcC9J^Q|+}zb4^g zT#67_qp)EfwDtj%X7&*lqeE%@A|-e|?o}At3tTSa7ykx1TSsUUnd23-vdo(u9l!0B zFVqqw7~b~L+@5AR9%Xa1pRqDTCQUuNXg(BJo~~aQ+LA94hxLB3ZC_ZN>FM2D3j9kO z-Wo(E>??e5w?NUbzKWS=7aM(Td=2sX9oxs{1Ap6cb8AmYWj`GLoAY3>qOF6%^Deuuu~cd~t)l(&s;TXKL#ywl$?&9r!W??q!^!}?iGG?Q zhGZ~-*76r3Lo1%w9u9E}0DDBga(eBhHQ?C3-^PhbMpP~%fV=@fplEbTzskNlPBS{d zg_DvpYl3KU-~F>v@Q43CkXzSNRFGL*$RGBcwFo;N({vG>4plVL`GXQwo2H!kXJ* z&_pXydB}oOLtU3vI|z`1W{BaV)~02ElWG8N!bvLkrZ)3ecl;`~yBH~vVbCzS4w)1f z5Ct~2$~ts66g(>C*N#@nK8)CR^jTVQjdvGsaBEnMJ{g85T=G46 zz08UZRlY~c0+z5MI#WbnPIVQv8&oWdZ z!P~LMVZ+(}_j_H2@D{y3y_{(tl-<7vB@3pOHzOwe6ia&BuB>p~9Fx(@Xgaxy_RP1U z$vS%|%BAO*gd#u-c04;KOTN2aWT%2U%xmL(3y1(?$#o|GZ2j1a6M16mv|gE^?dx}PEZ0Pg+0|nr+YbTxlMf~Zc25UBEC`tJEBao% zzZ$1$xg8*D*sIoUKn~A0{rGLUD@3l+a?@*iyKCg=seAupLbbQWwxY8EYAj-2BnO1E zl}cW}sYl+LbTPD49=)_%Xlj+VnyN!i*TcK=l7@Hc9@Cjs|DFsyUUkU8ty|g+ton6WKw|LkBT^pT;Z#0MKuJ6B5CO8rS9U$i%~LWmhN6=G zPMFIORynf0%!V{PilYD)ns?NUh!2+ZU)0h9A0n1zKP&A1z5xB8qg+g4b-#WoLdP2# zwN$eu2M18V#Z}*9G7d~{hrNnw>4Hhgf(faDNvWJk$&#@jtwm1;TdRKszYLmzjoec_ zeX{I`V+{x@FGw)_GJ-g7JJccyC&q~3K(k=aN<~+&-13*5hibEoeVH*`wq-$exkqgIzMe$&3 z>-+$3QBkn*fG|mZ=@_Tw*LAj^Q7K)qmi-YzJyu@bEl-sr3nh8UAG37~BmhW=QX*Uj zK>9@dubRq%T>L-CtM$0kL_jr2C2XIs1CXpK z4l?u0^8+qS^5S$S`7IO86XtJr0Wj6yLcUSd~PHYbkd#%sB$fv#OeSDURi_;$elri||5JN@y zE|<>Mh)p+5+5Ri}EOcKGzi)VO#@jiQN7vG@E#>mW5Grp8l{Z}7@`BDd+rf@$Y-`N* zU&z}h(!3)e`Y7_3=?dD%z4GG4v4zvS`lia~*pGh~ACx;F#^th`cNQP+FVl;6cFHxj zI7kK#TOUCiD4xyeb%N2wFoz-TS2~gSc`3tjQz_mX zJk%MAN{K6#BFVIQR8KYXDp!?Nc%z_m%_xB0jq3F z!kA^wkcf7~eo|<_-&o2{r=~>rLTO0`*)q8C$@3X5wW^8=4Jf+ie*GPD`1y9X5nJyC zXtZt1^9}zm&u51mw~p;m{z#nVk%zs9&J0h4-i!7W8im%5jk#TWkNp7rcBF6M=aPyx zjKGK5_F_T-MN$YRQ__>^^xj*kapC~W%T2%JsKP3*bX>Eml*zPHV?yX=_ljR~aLyQ0 zIwX(UOOL*wcGdyvPgHY7CEh+yy6|n`h0FKgMtR{e+3(-J;jernOGQecpt0-NnK z=AN!sGQF56C|4ansc?GMuu!1b{&nssAe)Hg#M;}}nD^c$3(`67`g-zs#B(;2Y3DnR zv2eax94&gG$tlD)E-crrB@()r(;mlQE+~U8X4OkJ_9s3Z?HoOC>B8##o0z!(i3EJvR{jT|I9v)KA@;(d~KB6W( z0ugGoxhR!+mpj`IX+Fu&Vuep1?xsUyvhetuv;3vV;CSTqzJ!_(tfB(E? zwu)Ur!csW`=lLBiuS&L0Y)K6` zq-0T-n@^pd2tFnca>2X0sW&oypXGH%d(QUl*Pt7)5U1~Wvck{WP&Cu$2L0+V@Z8f* zL`ePMYUU2pv;dPMaH~ELKkH`Q4709628I0_Z-{Vv4DWyaZO~R1a175kMU%he3ONf> zZZ2E#Vr-ePe{x<>=1zSbX!nBAjD$Q|c{Rg|@MQhAGc!$^-43UzlIyn=-5UYwAJspG z6rZ0viANrc_1>te6vLHWtga~Nc%+>KEeem#)bNq)YYf|;mfKOJz6CGrSqxoJh{QEM6>^3)V#b=~m7Y=O-;=pCYS4ecKU#SF`WxA1M$9dRk`4)$-4o7z-u`Gz z+r6igt3imaAJxlo@E)j;b}#n~i>g#>WCQn}$2XSWk~%Iltc_#LLMgr*!ec>%foowb zB|Q+n3-Mh`69(L4J3Xf}y7$n7; ztzIW#c_mUftPPXojBwEDkYwZ=hfs3>n^4)83>?JFUT>YH0E^MQ{}=o+z87e0-OW(g za@3f53oq~I0y(*Yuh)$HrF~uYc!)NKeJN_f+SV6-aB{)8C@JvQWtv9(YL^l8Z{2~0 z+yd>FvQP5%pQ8Ctg^4{4%Q*6$X0-vGFBXoA>O7;oVVC?qQ0P*~l<7|v7l-2d&P_xl z*^8ga!NOuzny&avu9!PvqZ5(}%kiWMMlrMY<4o+ytm0kN-U?^d7sEjy_JGw@u%huE z1hY0OGY78`yQro`0l&%fVaPM8)aRd0jUR_Hge?0dKV`t}!CU_Ogbktvh2W{}Sk%d= z|E!U?VgG&TH;Bp62Ips!6)j?72Hjube`^P%y7vGuItLX&CsHHL`C{~zv}0=)C5bS#>W)|ml{tOOviO~;w7~ZI+diM7*d9Qh6<&JTD*3EBJq~|m}mUe zBSTdY{x6O?byvD3t6)KijC|;_45P7dpoaBPoD1QhTup-)iSveV5{14rU8!5P7M*jm zAt6FNA+0N6c?82x)70>sZ~_bDfrGo&81(3Nu>WaV0G}dqifj>c!xoJaGpeJWBl4p< zXt%T6^R)!-mRXyUrxwmkjxS0mjcO3>tpsSI%vB z$HhMN_&i^kSJb#?O|oIO`O{5I4!5uWI45*~?(00{%}xfiF)S#WipfDbCY`=#=;^cf zP8?m32sbDAdiGvMb_m59Oe2)LU_iV(J~$M1NS(2t5f{7AMoPWy@j16F=CN4mlLk6F zezDUHc%ROv;VRut1hPX1tz9sy_xQ~2weX`h`sMDZJ@Va7EjG8zbEy;JhaoeDl))7A z|Btb^jH>GG+IXc)*mSe0O?QL9mTr)i?k?#D3CT@KNVk-NlytYWgwjZFx;ykN|IhQh zamG8wIp6rW2kTyQUh|s2>s~WH4g`qqP?cv>?{IU_2qgG&McjM^^ zqVvavB$LjJ`o8^rkv~B4@{fp?!fY-_l~HFl;|NOX;O-7d^57|7n-ILuNhW?^Gmx}z zvT`*Ctv-pL2?yRsNf|F^?+M;m5JTOjBv8a5T!ADSk8R}6Z|9D=U}z3I3wfl>jyOBM zWizI0oVw#~?cywX>#Z4@C5ECy1&kFEIU_E7Lc=#nlZlfABPcwsOo!Jxr>%3FBWZKA zxaiWD@7CQ>(|N_-v?(B4oNcQAAc!7Fl+sO<(C~k+(4k+~G&+Sz>q-S_eZPMa0!cc6 z%lR&|5sQ$&u|Y=ooS#4O3FvQ@B|VBpihmT0{1o!~Go6B0E2`ZVY9o-(JoC6(b@#1% zUZYhWT-$m<;|?9KW}A$_I0^Ba5n4#M-hZAAGB%(IWl`Y-zQ7-pUPo^fOy~OWiRp1{ zqQM9{HeuN^WQYlZ6Np?Ul)2f7!K610$d1F)#l~bNk|7@;KKv{Cb#P3Q-onMyoGSjV zs6nQhhfDO}`IjN#G4ISZt~75mM1(}9K$%9!`WVMhnY6dkf&tC_z(uXG)RGFVn36km z^B62tZG;d1VFA8lMD=Oem+!L%w*VJ*LeewX3ARQ$q6b0rrIb?ajc9-f@F<#hf+7z* z;1X6#Da^{GSria>2i%3(PYgL_3}5Arygi|2(y%6P8=TH){&2T|8?7`!XT{~k#C@6%()j7+X1(Q@+y zI;H5k6OAi4dA#^lTpT`9me!T@dHc=d!!PsW6q|mwmnjhe2}T-4@6stMwvjo8Wm@Tf6~LsnR_z>9b8sMa^TKtoSX9;20j0O!m4epY zoFj1Oi&_+cqv)RU{Htn* za9-dQPNKS3TOlel{e-Di5{-7*zZnGUOa^A~y#3s-hY2cnBLaF@f8sq_jl9M@p&i%# zcEjt9LRZn_)tXh-nNLe%AA03i)ar2X^An?LWpIKB$SAYES^Uu>4;b8uWw7^GRiikz zyEY4ep^2-yT=I)dbz1lZmv)KxlZ(nno>he+^q>2APc%1`pn#ep&Lo<#q43^(Su84& zh+at1zIp!^eKc?^U{o?HE5_%c^kwx_w0m;8?wK;lSxL@XREKE|uiR+C4*7)wyb2{l zxLN{D_vP-mB-=p>C99m7IS{dsq_6QJI+0;3=ol-m!tJmubhxE?MuN#$fe(8)(x!g< zTWCc3AfLyJ_vPoENmz5q{~?S2fJfJa5P z6|sCV+2azTOL9}B(Jp#RtV{A1WKSx4tGqeeO5}2ufO>nZdKtRKNcQTvR18SUoT2HJ zlun|wYCBA7-D0?AOPlWYO$6?42(De!8kRKrJKEdDHE-ip)#M9xPOY@PvWr@WG%Oxg zgfEog$pu~7Qs>577q-ec?6)t+MnYh{HpocXwCEJHcl2qB?qo8~vzuYa;`DquY-mLI z8@6uDf-!|-j}vKOeUS$ccV=%s_=wbzu!V6vW9QBh}?ySuY3TQS%N zXRe0GP1S~?TvmLEFehC(6_KzErHSOAq%@?YAL+{1SFP2O>aE1IZdhSbBr+8QVd+>M zqbovpcNIokA%|AadG5G5Sv#UDI--ZEB~%Y{;P-!AkV~A=F${5^d()Hdvfr&FUetO* z-BGyHN5U=b52;^Sp4>e*Nwk3@yU&MGv2`@JF2q+20LfZZ5AcTxX@&q-C~M5|hNTCX zI8jHyz#R&F0FOEx=xKk&5IJ_J_(NhXi?hqGXHk7PZ7Vq0*fmps<}EBwNDQ1JqzY@) ziyfSp);CFlFPhvod|wi1{D%Lz3{dti%GndMznWfoQEDV%?{u>9|JnU&=|Fw4J2<6J zqw7}uuvI&6HIc4Nk6&AEW}}!Zs+t6fypqZ_-Y&`8u9mXUkxcoPpp9YLa!9h3OEQuQ zgzVKNZQ7mLYLdx~AoAl%R`y3OL>}BwTs!IRrov_Z{YCrgLq)^pO{t-XWHFQonY1&4 zq|K_+t#)aDyfr)^V@@uzl?4nfq3sk@t9vAT?-< z{AO9=-P&+oW^v;j!F)mAX ze)m(kKD$ZMs~ZUC7}KAQP<_q*%2ttH1^Y85fmWxmFXms-Bvs}8;>-#XMzt>JWIxSH zUos8H)k#>J-Q|SLFeQy&)AJ;zP>Xxwr#4DsdeTC?=$SoxH(hv>8BYQ*5Fa0{jyZWU zm1#;T<+P8b+0}|ho-SfTpH>a=p1a5^%*PhYM zFFAFbbw>T^!~PaK;clz&;n%+dDKVo)36`N@yB?M6>B$Q5lIgAA2>Cl#aAi+;9tynA zAn?=)7~T+omRHb;t3Io3iO!614Y&mUeA3q zJ*U#qz`@a z(0tjrYql$4i?iZN!sa4M3Eqw}t5VK68--BEc~u>r8Zx>T9aO=dZ9+ET`g=@c9MF|O zUx_t^DiL?3ng#cV9u`0RGAq^Fw|W!ndi&=aBTEnx!PqRv5))!0lGiVe(%(LMYiIVe zNn_+Bjx>9fU<)~C{ql0M=i8_nl{DLNbGz+DX%`j_Ik^Uz2^VAVeRDp)c+dUUMri%< zd4w$NMjsLJQLF*EX2i*#HckGQ40%+nwed|t89dsWnO`I+D6XG(e1LbEgVV{R)Vg`} zoxjEkPW&q~_%3&__r5A2W1>Ze2X1ypS?#I_g6+EYFsY;)TG+G>I;J>!Y_1CXp64xz z0QikI6gW%TP;c0g;@lsNZElOPisb$@YMN3p)4H}LKcaTv&btM70*D)ylm$uP>JJ!I zY*X8F#LeLx#!r-^+#1`WmV3!_gNA`Po-rt%s7K9?n?&=|Tax9H!E+UJRPXZ3Dtjp5 zJ>+7$`mWH*0kp};f7hmctk6h&_5JS$+wFTD%$Us=*M_b`R82*eTB1KIr#iKP$Cg92LK0;Vl1 zhNh+PEQRD8NX6j{ozcpuOfUHg>$tptt>TxEvs;$(v*2-6-e3z!A;m;T3gklDk-vjr zs05pgsiS}vT#ZymHekJHOpKFvfjPBbv7ZoMN0aQdPkmPW+s?f*{|ZU?nhIh$@mTmikZdsg^Z9jxZ4DgX7I1$iWI+OLZeB1F z!|Y{T4<09Cr{#rlqZfK#rD&td{gHXu`c_8YS=2oeGhP_zpJXbRuJxe=2n9~Kct(Da zx7~7y4xJ!lsAo;00f}(^Jxy)7;c1`K6KOtyrL>{w`m6Cq=1yu-fP)9wdr^t|MM`}? zQURn(R_>tQMrQcN>fSgSs(hW8QqCK1Y-z8eGU3fyI+>h}gk#h+0&^aBak9TQQ?AD{ zfuBFD>ad~S`F+y;HVIDuKgCmogfu2|OjyUs+mPzFo7wYCC*4J)v~$DN!Q0BpoDUu4 zYeY^~+7frOeAP9Fowu1(L}Syfg?AAj8=BVxU7=%AAxb2jf~mc)UNN|ueg^q8-5>ni zi>D^BIU@QmOVj4mwIX|KSdVy!)8^El9ky(}40&U?&f2Q@0*~c|VzS=HVL11Ts@9`7 zsMJ4l0vRd7m0Xe?rc`+W(_pB8an<;{swSZz{o0$TUHbP{q(#-(oauK!XI#^GBbLfH z??F(6G*VhY^&db03_}fssbqjFvo)G}T2W$%?}Hm4cPR6cnf(9_8QN zW0!E53AmZ&`W{~>KfbM1q)cOSsbQa@WMc_&GncXYtj$PN|{>96Y116=HLn|*XjTY$esc6K$WZiqAN3}Ih+hF z5B%d@nrDK)MW4UeGI7t*L9<7#$a4-3%$J-WB43vnQj51>4bN%_FO%Sr#PNq^EZH_6yO0J zlbh9R_usKR=!zS2AKAMWsr@s2|Jc)!=f~ZMW>7B#FTQTi(P27UL9*4Sdu7x>{u!mU zLGTanjB4_T3$>+7vi>CloJ*&50WS0EdrUlSnXY&CGNi)F{(A(#Z7h4zIk!5nkcwXy_koMF=!Dw#^L>!8C9E#;@ z#K6n+j#95yQUa&kGUi!`Ib#fuV#aWP7EZTx_0eV4PcGy63YbI{<6+>|Z)FwFSM=drDo zUW_L&j_bQCr%;HGAIoCA76!pK&22tw`#Lw~J`B;XTsi7VYb29u*%aOP@CF z55@C)4yLB1e#;w({T24kmv^&=QjmVxG@C=FM=@*E*g;EIaGa%`9J2qnvxY+C2|1$W z#*u`j7e6!bJ`DZK?*v3ycb&xA!LQ)Z@rxMwm(%lzBXYJWSj_P}V_b*v>$cu+CZZOi z$ziXn1KXj={VQDgLmzB}I+r;%sso5F)vR3K)?={+an9>;tRNmPV(E@0o0#0M+OXA3 zdkJRio+dBaoisozt5*bdRwvXVcq&wDb*qbSEk1z)OqmDk#-q!In7e!KC!_6~%-I?1 zp={xZqqW+B0X($ilA~#h_HH&i;vUeMJI8HX=0@nNC-Ed(9=p7+V+k+g6QL7hBK0kc z7-@961GkHqSqE_$d>ep*@L+u=*qiZN&Fy3SXZXv3f!V+^c%OS`>XQBii&0q0btj~2 zKoYnxlG|IbM(yOSIQdY@o484(-L@uy%}&9Ws22Lyi89GdMP!sP>oWs(tf9Xp8YD7> z=MF57KI(aA%Ot<{^=m09sWBPdlwxxhi}p40Nr4ppRh=G|?Va%CT*x}Y z-zgQfHA64is5;$0zUl(+s3t`xu1_(Xckd(p4}{>UWuUPJgTL!=POIWp;$G zI-egUIaBRhRJ6gmdA<)lV6VpVj<{~_7}wf`~^zj=1<1Q`)q>S9lRf;r0qiT1<}u*Zr4!P>K7z#^7hJ9 z{cVbYmN)cb(Ut zw(sJdoIIH(pAqW$(ry&AEA4Fs-=iaUBBWw|_pyn)WlEDYP-J-JK01hpCBLq+EQ4h<4z3 zM&!(sdh*CCj;l^b{4DTL5+3()wM5t6ypU3TE)@^hIWEcC?hnWtXV8!JXmHh4cnd1R zTM~~H$or3LAZhfk0#3sl4yR^Luk=ki4k8jgZNkzP<0^&A<{EUO++o3AZ z#Nl>qdwdIGl#HxX{6q1MiDc50Mj|_^7y*Go#wyzwNu3)*Z>Y_$uCP)K?owS-&ymr6ASOKv~L$rtlvU<-R$a> zLIKRbWBSP>t}{1md>^(a!V}C3)g{=2k?R7jMy5DFwTBxW&r)V&7Uy~b)6mqE+VU9X zk(1!Ppp#QeD(D{B&(eypOFIi|F8a96KJrn{XJzbc-J=faJpZ!BXK=@G_J=aoY4<+!TjE#I-R+lIUi?bxtKgj(nPdmecKIvoJeXU^q{rhDV$Ld5;f$O+4Pet;9+07X?@)IK!>nFo7{87Wnluq{g zM%kBg4xcH`cHLrCxv!dpUsmNuBBf<#-kA)^=2!1XDmL2%*-Y@5es46+YJ$o)R{0WS z{!WTaSXAqX{7@g9pV_EE;s5GlYUt-#UT-OBc;l<}s>x!r?2)KOcx>Rrgds(-FE#aL zN=YZz?n_e}OqA~z>y^w#ogw@o&tnKV{I%K@#_R6*?zdhvzWnkq;Ys#gRJXZ?MZqOm z?Q4{g9aigiR*{x$E23-6dMFofCQLm!OPx25G6bLLZ-+TXoyQaLnOcF!79t_M6_qhX zri+0*T^%v%<2c)#sZY$ePZ}Zb=O+5Pqw{PF6Yl8x5ymcJG5j788!7}@tf_gY=sb6d zggDvsZih5oAA4U-NEcHYdV0Wr6bh@o>UXt;VXtF1{1Re~;4t>#d(Rjn?1jMe#9=3; zitjz`-TJ|{cPxhy@rQ}y+|E}ukFDAM!b1T97l)vX@{|>BHZvL34Q<|-&@qVnp(s|G zfDet8PoH%?-^~Q3$7{fqErKPQY@5I7HPL^_+?$6x8BK!k`itEf?wWE$D z6AE)%`kXQa(&-ITJ${l&;_sqgVi-UwRyA+f!<#Hhlyg_RikNADu@1}QgD3BA)&_n= zkn%v}a)spxUVkdIenfq4O(k14t9a9U3)pQrTwgfwNWNwv86Z(QfrS(0z2!XX;{W0%+85= zW7wF17Wa`_E=eXWlmi{54VSQW%{!v<`Rf69K3Ej32yFF?o$V>eObqsVg2An}|7!6n znSk2i+RPA!^_qy9=5+6s<7=l6R|NCy(0$v%pJQKj#lHJ+-3QD3D*Sq4D#FN~V<0cp zXF+lQyCepLC96@ysP-}HID_;(axBE)qnAoeIR@bsboNzsL3by7+j;S(W5b7^JSwOu z`z$D_vwrW_dNPW{`1bp;LW>`S-)`40ndW%J7W2pvI$lHT!3ZSPU#-UJqip}P@79$H z!D6oJj|?@6!(`rc8&7i{|73%tKl^6Rz<7R+%OY(&=R!k2FrB<3@9s7}KXIK}jiI#k z@viY%=k@!0vB@8NAmtVKe&JKaI-iPDOYlmTzJ<|iIb0%wOmrLqN!*a}BBg`D^7t-0Kx zb_f+lE+bFxMrse#m|1jVJ9gLf19QLGC*;N$Axs4#eEQ9wF7iEtc;LA?Q;guA2}6u9 zm)Fj0f6msJ{m@+umg@pmbft+tVE`g$_D^{NZ{j}&-)k=_`dEYgSwr7KbFFZMZkq1T zhB>QLXkr*17!@d!Ev!`(+3yC$EQTMXIGr559ea})g<7+XoQ{7Okv~1Aj>So9B=FW+ zX&*&YQif#B>*HJe19LdyLWb-M321AvpeOqd)1d?BJj_Ei0iJ|h`Q*K9Bwy>&KIf{5 zk;RzFH)9)S?O*s5d>&oeW_|8_DfX#Ho-^G{Elr~Z#B+sfF@o@IfAk`U%|%YV zH7l1bL#yOFMz!s+fI{(^rXu(o;o5f@)Q2Hn-#>wvT=6r-%k?DqGC`2t-Uc>BZQ!d5 zHbM`FvuvaMLET*4<&n-2wj7rfpU-gc9$)jERSP6=M)>YcTrbd;TtUMA+u?}-PQ-Y&Q%i)VPQ zu!8ttzHiv$xf)PT=X}l_3msfX{xg(?-pd28P#y5h8?;U@Lq70A z|EMBa&kws_nnSWLJn&dC7zo0XHlL!IJcWi|!>K0B4MQc?P|-tGf#pe8ZrU<&V3n(g zY_Yvy;M?HfI^u!Rm_!vpR0cQ1x}r3M#Ni;w!#YA@j5?uIqA&|(eCug!J;qh5iELS(Qe%&GDFyb@V&mrFRo(Qw}Y)setR_jB5+@KU{zf_loX0# z$X;QuHsI2I!5L>!SQ<$?8il6=l4i6O@#E6WyitxMLb{=0c9!P;9&T2HMO#R~X?q3s z%y{!<`?U7YBdK>TxTik6%$57S8T^}bSjZ5a_J(L&1A^-EX!-!XIt~byIAO?16l!qx zp34d^4MZ;oPw}O;sC|lNolIBxb?q0nfZLZO`CM{^N^?PS;(1QI5rP5j-#iNasR*K$_txb1=*%1~;&dU_p z!h%jU0(u7vN!`dy<7|iRtcK|^?Jq6NygBR1VOa3$W3sab zh+_e>HEp^s{5v_p-(``Q-Zs{UT77;sz`AH?-U`$U2Tg=kq0;OSJM|8 z5BqnacXz`E?C#JIt9^E>G^G&gD9V?;GL%YzB$yFaign0;R)CQd{kIx&#NW9lx>HxW z-yQtC$JXC=VrZI1hnMVeYnCSOh`M`{iBZoMA9|aM;PbHcg5!<9_{)Kf#c(X1D{hN(+WuJ|9uYtHi7C5!MRY|UdS(+8mhTZnnk10I z&vYQJ3^!KpUNn*8P9EOa++zCM^d8B-*u-)BKiI_kj5=&6Q`P#Y6gug;dEtEE!!%wE zIkiRus4fs$;|jOvT=Ltw%NC}k2jh;Lmn32J5T?EIR8<`oLipURvixK_xM4?fd`ke> zHljXE+Sb^zhl@LS|3nrzOQmXRXs+#82>+}*4X?p+lx6z87LO6=Lle3_EY_=r7A$f& zkiV=O0DM&S+9Ir%j3K2Vc~sU%#@kuYSWVwBf9U(X>`qv-`v4}V6uYI+oJ_R0ue0E7 z>;@Dcl6;$FguSAMkL6IU_)bAeVjQEkIZr0WTS66*p;s%5X_pYKVpZ;J877HOqZUJ= zn4{MK!3xw?c>-v%o`#Pp^5N(Ye=qQtJ@Va#Ldb-Qj9UN< zyXs&rwf6NX=Rd2^f7r2AbY_QGpw#=3tN|zY@W(w?b?qTVH9(3P)NE<+6jNC4F{@5eSDaZxMm zYDz`k>j8ku$Gf}QQSl~RP{pEQR|-K?X&4s&E4GPn+FO;Ac0y>mMVsz#b&m-vYk~zw zRoCv{+vfu}kp9_5+w&Q^2^AB9z+{5tow-A0@`o~e*p z{IoS_bonEG$U+er=C-%DMDiDTbx5ry02yNbzLt%%$Yr!SbE8e`rJ$$xwe}=@MKW0d z$qoFw511t%q&m1mGD^2xVFy>%+y3xjyy`{+t_%8x@LJ?uMj$TF6-h=8Wd>4v-&Aap zCm(?q8VbJGjl^@OO02NTZ+&`nQL8ch0Fr&yqep%cXYCr7*V}9r<4d_)hK2s@b@ip$ zuRDH^PY=iAuM39ZYiiNf$Dv_;sQD|AA=sxRxtM$6B817ONt9TMxZjL$VcY5OR7=hm z?_P;gI?zdu-zDYX2)w6Fb1Ka+*t5ZBBDRUfge_4uvdGJnRTadLWRkvbJm7(C$fOu` zSNR&HD%whW0yJT<+sSIjAmZujf6f(d^YxjsltaS!xDctC~Jh1pPL9ZV1IdYO@#k7dWY@+E?d7t1Y|=i!l#CSnYOH3v30H3 zpYkLtG%T%P3z`(AN!xW7FfZn0n3-)AGU5_&H~vkj# zq;yOP^}K8D8hR{j4@nbXcCv4q`=Pk=kp;6Tz$Pkr9)YC>PfgxTH(;V~+PB=(5jd^r z)T9(c7vWF0x__Q=?tGVKlJK1CgxpN))qLP%6K^NfDK|Pc@1KSCZ#}6KRDZ}xp7fxCoH@Mf2P;T{q%4>o zI~$a9JGU2KZ#0u8SC|9%;&ro&GqHQ?@4f_XypH~8anPEqaB9!dAv67 zyy7)_iH!#3L`r==HtDYh$QGBdu3zAg)#^CqhS*Mt z<_#3aJim^&K3%*cWMsrr;l5jlM|hk$8oymWb_=}mUBCLYgZifLLQ7tk_fVsn8zj+d-9wglaYRv7~zmAE-Ux|6wsZM|l zOn&+PJ47FDNM6<#Gv3Yls|VBSJEGboPTs8r>R}-`TJ-_!`DuY|&s_~Fbxzc|-#05R z3B|u|poC)1yR2P#vEb(p7QsS_Z5?D`e_re`vLG*JWXAMdINOir(nh7unio*0?#Vf+_y5PydNmk99#6?x8=H6fcftf+lacMpzeri zKhs8{6`@A$-ZU2Z7k^{6Kv#3q%_De|@D0_Zw=M4m5eP&Kg8zR6BG%8*iIZ&UhJ|Aw zn@{RqLc_PTR*Z>bOAGKjT*Oc{^xyHgfq2oO=mbir?dc?70MR*~+PQ>_0YM&p4Pj~< zTKyLZS>%y))V3~Z?l~hNDK+Qt3mjI|<8YZ{qu)3Ry*9d-?Rb=}tgyPfsXI5x?e`wO zZUxkn*PykMGdEOT44*G}vSL5~*&JKwm^G$+T2OHX|FaU6Tcgk8pjl(px-)wYo$-Gi z9;KI)^C6M0^qP)Qi|p9vedcU%L6;{+EQpR-!+yzy@xv^#Gjm<^;Y`#sa(0^H@^^su|Rar8}I}h)o&aS5o9AYWv5voQ$xhJ$o6Q z(GH54U1A6=a(qxfWkp6Z%qUM@_Q_4yN6$aVj6w{F|05Pxs1l4hr<;hx1l8&ylG)Ep zEXhZyTnfK1<8b+Zqnq7xT~CP0m%tXT7bW#dQh$$~!dSxZ`cOYEE{;a>6_RMKUW+@! z&uUXp;!qAX_FwMcI(PyNkP7H}^c2BH{|T`OPb+eT422-ZQTU(G(mvlfh5@%o+(knji!>f(pXgZ;BOq)47c z>1pfK)cSPLynSx|^W%dh&mlS4;AE8i=|}_?dnKp;FFcpN52ZHsk#(Lq1{Y@bt`13* zaA_p*bY+AA!Zg>uA^{HH@(Qc6mz3*gdLQ9-Bq5Ig?ZIn%efRUR!yxBW~| z1W9h)tWZ-0&SscS0|LDGlPi}nDcn*r`qOmCg*s6Ni8w%DPpRvCHK#x4K4M$|F-#>2 zwyW8E;st6_(}D!>P|fW1}K^2Ja&e{69%gDDE2K$o-mq4}1JyYdI~x)+Ws>xIe|3 z47j6&fArw@!-?&NVo;&x>fa=I`8bf#PMDaOK;Z$d%MYftM~BXcdO%g8X4NGoqJU}R zV9bvjTS*Ji4XP44<(lNbU8tVH-m0j%aFk-OaCAE?+pK63B@wa=S)#q|#f|Vrel$mJ zcYJPXFBjs!-51wl$bt&*QF1z^5YaU+&e@bwyOh>Rq$g%-8YxzvmA;5wa2CYST=Q1Y z1j+ni)b-XOe6c39>tsm;oZr9MOs6wHM30(c zRZ1gmt;~oYk=8fUD;-_i z-P=w^8pZ;o^&4)I@cTJ=`C1QO(pT8nv>ztEQsD*PoXiKnQn2gf89WRTBJsj4fqlS-J zPrEctj-2(!5cnQ7%(;$oG!>MU4XOVIsvK@$sSl9e#i=L^$pJ~9X8z2)Fe6VbMFy;I z#Nu@tT{vwfnY@@J-Ec5ta*lUOpyg_d=+S3fbR#s{8a#xz?|@<_Mfw+wc#P!vZ1wE( zg~l-Om<0bmCRcKlJ`qI3dvgw&r@P}0aDmxxYNJyMY?hfFO&j|3AN z66d{8?>1o-qN?gSH!Lv=Vrucd=~aFY7Vt{R)%v3foGm%s{!kzVHOjgkv05_Fu?bAd zZ5C<@>#%XciwzXg!BJq>SeB@%mtQG{FWt7V%J6i&Y4fS`XF`{Mg-<){(YjbOG!N_Z zLOc;_et6?!3%CAAgq>L>$FP`Efd{+tMEXc+_O=Kper^{2AL zxNibcW(W3Q#JazF6W8KgQYNh_X*4&BV0m3HvA~x=YFcndTalrApqug7*A54}RCawR z!d{&mv)_*!Ie#x#gt}CE1j+qx`W0YxcqPmxe_J|z$X*iaUa#Sc&l*Ra-+k*;TYH1W z(I{1@u2+ut%R~g3TtgyLsl@g7qhIriOQlJNKaTHE0#)A^kvhb&1` zcQYVM4(Nsdk`6V9AV2pMmFF~I>Ua2a?~)xJg=hN_RMhfvNSM2BfO`pYai5ORlN6?Z z4gS6ha;!pdA=B3jP2`<+Y39s9bJQ65J0hg*(B@`_NV%l#yD?(`i9|$^-*3KcM=B$( zT^OM$E~6^$S|p?u{j)N0YFq$e8z6~a)R*&9@7Rh7ZPa3soc2~oimkj13H8hppqUyQ znyc&qa%0Dij#YBxk%M-~;O7WtwG%ms`*_LYBheM|cv|d%V% zud^$k@_hC7m-lPM;l=Ki6&1Ao7D0d6tPwOCwg9D8oRo+5$smHq&T+lA`=3QgodF9* zqpuS}&*?8VivkbF4u}1?2~;<0fnkeh3-8~|yV)IGK{*RBi`(8)Xh`^pKpB~s&c^sA z*ER-V?eBcVPns{bCb$l(WLf`LEhP`sPKg45Gu9TxeY#{Z#mdD z$xj=kFQaJDodHZvAE)ofR&mbb2W9Gs@P>>X!1GKrI4dZPEM#UX=uebPpq5mD0tVVh zdqH$)01c-0bwf%TLOL@3!kZe@Xhs_iHfWrhIbCKy49LQ4{zhoWi?4HqWVN#p_73%# z2l7)65}6$6++@62y&4JE09P&MUucloXzqDLCzl(G#FZ;CG=s(ho{n!;pQp2hg_I#3 z%&jIQ&7)KgW#QDNNsjt!0KC<_$FZ1qJkBPQbf0jBLd|6Ce|MnJd)6b9YB9YxiGob@ z6Hy|fOf=mSJRWz}~jndkc`cc~KYTLg{R8Fih8 zfC;sx*RKW@^!PiX!FO%ppSU$!{ zP#^rF_I%YOT!`g1qNBkM{+HvGTMKKaeyy-HhGY1{7cewfm$7gL@APnsKJjyBM+HK$ zfY3mik_!`R0V5C_$Oodi&lZgSw0oTUxr9i#B!_yVZ!zz^k?y9J>uxJ$71p!Ht-q@o zY2W7neCP(!&A)~;+nGA^79M?>g)ZtNsl~o|`93W~^CT5{biEnhVht5}z$N-O4l)WW zRwoA7CqU$C$pjYXskd8J~2!Ywr3WhO& z(F;jw?u2I>U9@^oPf^z$M^uluhO`+Z86(4Khzodr_@e9XO6`!(ZsaQQ>LDw4e9>yp2b~GaZ$j<=HY8Y6E_P8T+@Nf3?V#-^lt?L>Vs1xZtV}c z6resZ3~6d7vpJh{iWXQn9)SN}%^+v@-zVcwoC9(^>#1M=cb5PD@9y~kRxPpsMl|aNArynUJtb4)3l6_)dhoiKAQ!I;9_?OVbKTzP;Ij&i6aSq;xg;G=y$N~Qbz{#{cfW626EwNd z2<;uh=>?6Ce1MsSnl#ZVbTW^#MBcozB}EW9)PVzr``@-#oeD3RHK7sbde958rzgq{ zekAq)j0ME2yP?1Pghc-}+H@FQnngz&C@fw<@2|px3foYYiT@XVvgY^SWk=di)i(*BgBtpIx7bt_)*!Ua}s9qB-VB zeo8@sTe1kllN6}sc)gxuym-TyNT0a?3k){cs+701))g1(gCB+b>cE4ZFy3|;*Yp^> zOHA}>`j!VS$!%D&XAg=JSo+#JQF6(1@t*E_Z1U_S6yc#_~_~WoXGW4IPIw)gy5^CvW0f5ebiarz=g9b0}d3Cd;*dW-!0`awh;j2I6 zapvL0w|OXSA64DNvVWc&wqOuPV8K)us<6>2<~Dmz`#JDw-akH@>Nm`2zSa7mF%$bx zL+8pCxN2Xv5D1OA+>Xa2FSPl4zC7Vh*ObPJRIVxs@3ogC~#YVwLr?90_*{@fC3 zlVz2x&6^eeTQ_rTm%p&Lx>;m^X z^%Lwli0_8u@P(Gl{V>O-i`CalOYD)M6rIc;P=-&gTfG>sV{jWi>Y+I{X(0D$sEl0t zV!C9AIbD}r%L=kqEk$_Y231PQ7-dngNgzaF8OpTd&HM@e)amKANPp_z*mE+2!a}7C z{o@9%^x_s^rDod1TXYj(mT`!aCBd*q-|3YMeE7PLjyYc6fmTvzNEI{I`@LyMUTm)=PB?2l_oUelt zIn{PDZ@^xd2#&cvfoF_gUsy{@P##h47uiN&ABA272 z;x|EjQghsqSRoXG6c}7oHGTSocGFeH#+7@_u~Jl8y|3_N9i-G$Q$;QWROMi0&U5`m zt!COwrPbLikRSIotBZdY0;=+ZBALCe1-l0)mLMWO9u{C5Q<;{I7P|NaYD04u`NUr| zogQY}zZ%Uimkx66ytHHwGE&(VEjD$7UT1o+#hN$x&388vIYkd|R(dfvJ7A(2vjDAL}rDbi&o(Jwzb^)WB zL_BqFQy{*V`{EqkS{FHDnk4pD`ZXX%3sCtDy?du~r=-;HU%!ihF84E~h6Yjo)xJ2U4M~5^C3Rze6N97E!4TJ`Z&AbfB zB`KroX~aN;PJw&mmlkUnY4j}R1x0{vWOhEg&r1nMDo8E|qF+{NBd%H)#{g1b$~9az z>46lMtcx$ed@X_hV(o_P?OM!*Syi8{$m!YYg2%j{KQb2xd((`r=iS34*`?k)rNF4# zpNRRAqd*Njx=Wvo1m32`k!{+4W>7hmJy`%VVW*bR_UqjGxP0u4t~f_WI3HFpi=?<8 zwr2bW`x*NO*_J>(CvvZR9C+b1Ax>^E>O*2M!d<)fNw2wMkB;%L?nnX998@F^;ol2o zSLFR?2%J@XM(F=x0SYRSl8I9+im{lvjG9BJAJ@>H$ELBpwg8l~>x(@m1`lE&iSb`9 zj))t8EWWRQ*|WNuSjggu)++QH<6i9%%vkhB;`A4G6O57>>(I1Q;_b!2jYMHm_C>3@ zQ}NS}#e;+0r%T6JKEA=r2eI=SBAe@(CJhYxk`?A20zeM)4R!Y3+-YA+FW85dIq<$PAPrc@@^Yd;5Gw|_omPPC( zcSxC9KEO6EtasbenTrv|m?>**rfYmf1Pvw}4(_j@2Qm-SMt5Sv=;Rdh!q}-L*@H=W z?r;gcsFU|@l&?!pP9^Or!lZZ~Ms$X1THI@5mWqWdhUQ4t__{O(&HR0g1wLV@eqq?1m%f9}q z*DW%#!@sV@+{wMXWT)>Z^Vh5@qEYvN;r+3cQ9bLp0}`KjRHCCHhB(5uNl9|)MxOG| zNaPr!f37=NrxRkcUh9<|ecfTY4e(t=I`M>2&C^HN%0e02ZV#;z2FDV+I-Pwa%)VarEdT(v*4LG!0l9p-`TrN8_u!YkGw8=-w(DdLtl?V=6Ko)Csq2T zJwOa>>>(=oj>djfbaz8q@~$i#VOWLSVAWyuP{+h0cu-*ffKJbsn#6V`iV+plw?N$8=r=1BDTIKC3`EZ(GmTT1L(%#S)|6a#TN z-+_t8iamK6CC3<7^Sp-1jmTpk6c) zL*-NAj_+(r^L{Vfc$gAonbmUmCM6<(t4JnveMnNs5kmnfU;-4eN2cFmMVYsu#xKS6 zNxaiHCGY!}e)H$JgGqxMLUSKUrQ8%)Mn-o%6tR5S=8e=q-_mq0&54D3doH{c87FTu zpo)vnRxNcc=;i`Pn2vMPF{#{;szkK-hgKY{hKz8UDxcg;PhS;x9cW;6uE^exCX#&b zLnNWSD8uJsNvO=1OeAq6DrZ7O8gM7^O(iLz$EmG7AiO-SU*e28aado~7YUzIjaZq8 zR7W1--;n2c8G?T6SuF`x!%ug}KM#%X^~d69Nbqny{5`maz`qEasN&-8&ybBi>M$B9 zO}BduBOaAxB9+KfXYNcS zmdSjqLylmOf}(33t-U#+ZVb05MBRJt=&O9ZOYA!4F8gVJ33-%`#7gtnXW)w!yHbUQ z;<$*YomDe0iXm6)j!x}79kuacR-SuyXsWW=S#Bn0AM|5dpOqzv`?ph|u9R`Uv`~X3DTf2OYt=e5C5>Sz%#NyHK`Zx8mY+ z5b-8i&$a;reKU-v(~v5Tr-Ed11=lGIoFcZkT`yKuE64kmA8;gx{f_C-r2wzDhz?&NBtr~eLA(Vwe4O)4laq` zukI7hS55Dx0G2UGZ%R8}&Q7)RP56w`urGeQ$IPxWVlu|flJT`ii*GzhYtljY@hMO2 zUYuECFcX~@Vl+hL(GRE*yR&Msitv!ElfB_C^XWj3D}-q1>kYN}uvpLpD_wgm>w&b! z;cS=6!t1^5L>xs7i`Oqxh@wBSaSybu`h=jK>^%j8pHiV7==?XvT`X0)157+% zv}bf#6-mG^XtPft^1GEZo_eB2`BTavhq*{($X~hA;Y)+oKpifMNHUA63d6x=5m$Zp z6Wq$+rQ*bz=^L%Xl^?fSm&86{9trfvN-@*fTDH?K18RXGo*H64?7VuO+} zbu#Y=(EW(KN0E?l9J@@s+gt#8-2CTsD$&Wwz|z53G<*7qS|&~N!1t7hm%iK$dZn&v z8j@eSuI_7G-;X5{*FJj;OrGKv-plm&xc{JzUW$nEi@|`?qU~5wV=B#3Sk;)W22FxStEQlg@c6fbL_wfZ* z%Q?$t`EjUHkU;j&1L=p%A3tj9>6B zi2D1?DU@T{Xlin<2DaEB)JxCdP*oK8pUw`@$&ou3PoppzF+r76ndJ=`HMRp^-i}T(qqxiYyJFa(Ib}? zTWth=m5;`vYjr%^{KE11S>*b?VNe)ZW|t1}3t0RHDt756!gXiRW!h8hYSiPq`?^AP ziFLOroliodA95Le>9ZQEc?)jStMq0nen{g#`e0C?fm z8L*j*)aT6H$9d)>6j(8`3XFL+fY|z9^FuF{k#JeDM(gw)VDj%>p5DD<*!p~f;{~vG zB;ZtzN7cN)vtY2KWMOmH=pdFtoW7DsMq3fA1doIU5&;L+ko!W_BY~g;%qiwUYMsy||il%ANN;m*2_x0ixuv?H`;;#OyH_@m%QGrcYqx*phj0Nz*ZD zy~DcK2RuWKxz4yt_-}@V@DGLsc>)ZzW4{v@rHr9|DxeuF6)XFsST>^oCsNKrOa$Ec zt)uDLJl;PNe(TQlG=R_N*=$E_P{)=XY`RiB-Z@vh*MLJM$egr{2=Fuq{>hH*LVmVwc8Jm+~Da z_1!~EtB~d!FYih}GM|$+4%l#ZlnxV+anDr zq%kxEDeML)Dkf6aYD7*hvzqQRCPv>E=O451`r5EpV&QgY%H{@RQTRepfctE>q+=G4 z)J8!Fv|pH)*vh?Tx>L?e11|N}Pw;B3b{7E#d<8Co9LbwhB7Ws}(EsKsac%?U&tGB> zp3VDJ6#tV@s^zlLx_JLv zYu2#0vOT|n`$d!$R->Wu6kFr3@6*n4$-nR;mz9pv*@+m*-%YXUu7yn5Dj{_A#rB>F z?5QQl>Azcbn{Qp=jo6TzX14wOey{F*SH;Y;X>0H4<=eZq0@j*bBf8Bh&TU)xKWy_= zpR*hl-^G@AEoNz+Ope^jdc{ax9c}cjla_FLFMMX@6$$Z6-^X2JcLJWVJyU-|$~;6u z26F}xuB%Z;+`V6eN^*_tW~*iIp1Kp3bYHz+c_(|Yix7uYa_Fn1+xBM}ua*V2g#Hk2 zfh*9i*h`IPo9(qj2N^bdOno6e!V~mG~`LX2Pv!882^Zo9)XaUdg-IMfs)5}dc)&HPScXx+te4up0~pXb7k z4?eieIIysTWttRb-dtks73wCvbTwQQ)tuipvK({At>K_nYU+dLPFUGhRS#xoVxkl< zJ<#nQ4)6V4rb@GCinT|fQ;ZzSsGU|Xi+4*TLOG7+#tNhx)j}NtaUXJ4&0P}(jqhv{3ryD2(196vfHjxH6To(?((Mh?D!CB7FP6JYA$Q}U#)TI@7W*uq~;<5>&dWD9I^ zuS%ZLW|P)2*Usir3V=zOd(K!7OeED+Xr@M5xm`L(nj0Hi8P9WfbK`${suOO5x?3y7%8hugL8+? zcW7Q*s9!nElw0(lxsA8(PhUTKljy07@r|xMzo9OhVEfmzA93S!6nH-zj znHsI;wff+~#yAke+MCsA;tXILCUk zevNIub5XVsDy1c~Gg+}9Uwx1vHp<^$o>eNmc=VZ`_1b|-WvDJLuBL0W9=V6}%E54yAR(w$ z@o{Ia+G>;Ba%}tI_R{&`#!IJxF`U}~k()ni$~XdaQ3`a1_Yv(e`Oi7aQKBbR!xS(w z9YZD=TDL3Q#?v^e6-Ihat!FKWb+a_tFhQ^;U-NdKJY*RwSZqa?uMdvK}E8nic+amYX$OIo*c{Y#U5ql#+`eQr*xO}auZQ1&xs@uOS$ z=^Wvq=ZhYyY&-0AKywpj8UbQ_$XCnIW45|7$iJlIheJfZFj;1x=raE?=!L@ZWVS4k zJ7QG!IX{1VQBl#CVuQY^lGSHak1x4@I5?iBt$9vM{p>ohtzQmwWox>;wztH4_Rd0= z3_r&A+nL2TYaTTe;F^eTD!X^jx)nVlXoTaAMcA4GsII>zVA|XQ-R?^L_yQhDtp1oF zL-KKg4bg3ob@p-16UZT1`RcEc4z8DAA#oh=_eMfIkbbttEU^%CSK|Gz@dpbAwV$0U zDk@DL?Qs~q%3VLuFi5SSRywX#h0X=+*>0VqWt;u&cC>@Wlh6I-M+=Oitvk6{&UKaD z1BvZa4H)(c*>jT`@j^yuUwYqa4sy8cmssKCpZVIuRS^*O=_uEURysHyy2=@JX}5aM z0%a1vGx!i}bV5p*w2+!rrr*UX(oCRnHk=-bsQE-GB`l=t-e# z_Zqu<_*&t7J>;v88Xi`xHxK9!UdSvGbL;GzUd|OnO1?{#9Un+E=V)b%xZjnvvGlpp zOoZN!%RJh`#zwFOWf+vRz#1_mU@N@7aiu{pJnZ#o>Ymt^Py_+!CHI`Bx(X8WbKPWV z{?-P?dr!V(HCU+3`MzS$>2{)^Tp;;K8~3YRjEtbyDP?{E>Omk67uXQY&SIj`++r*a z`ucom75@FkFlV^l9T8Ff`WYH;N?c%a3m=EZrqS_GEwud zJkq+eQ+z(5gTu4mwq1Ph*h@KFSL>UypCGjuW0*G#KcN{?q3fkKA1|+AOlY%EtJ}Fh z+rT94fUjZPBB8cnIxlwYbzg@hMyBn`Lqss|R1|i~0b>&mJgWcsJ~Jc8a9i7_>WlMG znoRCJ(VT5wR%r)zMQpVrV_A)4?(Wz9UPQ0c4mSqHU@?VbQdoV8-h94z_wLa|aBZIQ zZ`IBnklm!+oJaG#JN)7Qa8lt*02UUH<5i4nuDr$PwM}q3cbNB^mOw*KH|$a{R6-Ln z=K{YkbUMDwli>r!c5B$`XB_qcozR(JuE#td^WSnr-vo^kiwS=1>+6F9?dptHFLx%k zSzLi;(ui2gqneH#vB;$qRSxkRx<5^iFEp$2P*0HjGnKvQ6nYT2$ z;NvOxVd@Q*0^jnG*9rUEi!PIjPQeozr>p0P=nkTq7XR~k{*6)gx&`{~tBx>ewvWgS zo6TZ%0EAnu%&_Hc0@*s>`+aoFn;K&4KOWS4Ay$RKL@X9u$tm% zJZ!(WYV%sF%yXx-4nFLIs`_BcD^uxvJZn{+%WE~s^RUALt2f{t1q^)y_L`X4DQgN3 z2R0k`Y{q_veDZzCrjXk^R_yD5k`0wwQ>PEd6};=RwJHOn;fK0Q5J7)7hTa3sf7DpG zCse?=%}$Fr>{ivXgJ*=~Bnga263CXTXZY!Sw!D@ksu5X`@gubDZ8*@;t_X3C<;Y)H zXSHydA(?GH1!oogl9xR!|8BKa8W99+39M)0e9{BX*|>*E%gN2u%DfH@j*sDvb1g1k zX%DQqTAzs`aILKTY8=jeRUtq4=9qn^!2IFhSLZ6!YV4^GaNJ#RPuwg! zBJ5z@rRZGcWN=2A!BDO(jjY=F5YrBUh_bWsBhC&FDt>&u zyU8FTvS>Ag3@G)3p(GP~?}t+q_GW9H9;6dE@~gC_E_z>sjNLs}Yb>&|436KI27chJ z)-9GpA+t`l>{KU`yGyvdKOP0}Y{8_W6O&uX$jBhwaK`|7&WW=NdLo!{5KW3v2B42p z?=)pML^}C#4A}HJs;bM&U(r3g+1c9MI$}aSxl(aMJ%8KaK(^p8w-83j483uFWB~bi zWfnC9cWv`Ox|=6#<)G4CP08FcbQ&rRhUN5^6Bo`yI(P#y9Coq7v@<-<7tXgDsY;7S z$A{Ox&=ckZW_T}qCr6%QjFU4h;WdAmdvBvdQ+7D&`2xCUPFhQouXOu;h7zBw=uszW z7G;jp9H58<)RAJLV!RG(a*YU>;@I{e0kA$b3O z<(y!8-t0;@4!z!nR{Sxcy2B^d6gEj_F z@m9rPBSF2uX!MHo}G`%|(k*T401rwza>WZ%|F8?uw{OamF z(f!dlUh~CXr36vg11rrQ{DU|GA^&*qj)BY|4_>i_`rt)FXx!qPx-^uI`jfZ|(F`qC z%BgbB)X6%|Q|3zW6LO*YskVr;kq)AwA=5yEAhY7Mj4-{8kusRBroKpsJ47TE`?O_1 z5LemV-+)N@g}Vx-kgH4q&n<*n$e7c2ULEC}g#)NXu}`w8N~R%^m}zlos*E;^X`YnqsC&3jgqOY zp(Z*xtBkdx4EkXaPTEjq|NM0Kmp6wUle(qb z_`5hL+4cu2FQ#Z_AQ5A#TV+lAAwjFTeG!5i59^*=E!ZvV^hyMVd3QvhbJvUMh{3R9?P&)A0xAf-(}6x3!>veNOdsm|zVs>$6Qa1L9 zux#`aM(lp^c|v`J?jTu7taZe7y?5;s3#+<2ubP8&50@$DgYKW*EO)fEw0h!AS`o1H zv2u4yav7$OWAK=9n>s`oGp<~6@=y)P3%k*cD&ZQVVu(j&&cXG*SI zRaS7#Wb`}UtmiDjbig;NIq07q=VPiq4j()@^l45vq4lp4^xYKee7w#sUp21u?T|oz z-5l>8iH%j>UI&5|e-dy1#rz38JA#q#(eXBSZ}NikmWqIW9@ktw--kwdDZQXGJ*i3a+k#UvkD^tmSg_GZjw1O6UV%f}Ar{TTD&x{9neSbRNqlkxLe%)m+HM>!qm&{Q47=?G^p1U{@!|#?Q>P4!z+1C z%7rFQnkm-PWB(C}QbNOQ38L~l6Nn%}OM#-0+aS$I1UZh7>uP=@KSE7;T(`NX9GVd; zCOoLiRCW5peB*bb=`b-h+gt1lv;10Zl~G+=Mae81CKPL%>gnYt=yfrg4>>)sB^gGq z51#`mB1j3jmur{TTq+~O$E@OUv^37W)ze_DjhtbKABE+zGRG#WQ!)rn1<^K#h6`TF zMY@<`_W_%wM-$D#kCpr?P0U_?Yp@&0-pp^7!r86kG;lmEC&iDk?bhVdDJG{#5eqMC z-JZHjnfp@hEvt>8eVc3JRbQZ1nOj-iymQ2tSW9#zC4;UX1^R@u!oOJyoXVnh44bW+ zcev+uQ&T}Lq7&DAxsl9G$vpG*;wOECnzwiBo@r}Qk-|gDsb@FSDVRL()7GXIO7A~T z{!0t+kU6?obrCYA3|Wip7EKSM!jI9-VgZ7Pf9Jmjk$X+FbT-p+2PI%dCInns)>-w2 zp_Kns8-lQjuuTom_5qxjdIv&Z(Xg`4u=JWu1~SwtX<L)n}vTnuC2{-zUTCcY%YAT})^;$v_``)O@Cuh_v;jhGzs3zPtxtPN!7_D)e){l5GB|vg~u0{Rfy%gM+#E zu1>SLuMn9xLe39{OJ{3B4c}HuAwk~LYTFv~-O!x-GvpZ56tyod7n$`SzdR1Zv9MZC zjy*nEk9OFpc=rSmdXv^t_-vi+A@;AFs-1M6(~MSdr}DhZXbJz28}nns!!C=RladTS z)wZZeE$^jT-dmWUAapa$Eee~6GQmjm#4^Kk+s-Ew^K7XO1COtxcRgV&ku&wo$s|Jr zo^i7k+(WC-;91GTRw-eBHc&WTW}_DgoxpV)9~H|D+J`1*sb}{Y0mfqoHISh&@N9S? zo%hm)uQt7&W~`_#xuG%=g1i)?P)u?R7@XlY{GzjMJ&b9ft39uFNb=Z~XI>fh>AI?vE{N+J<%`bL7t{}D$PSVoUKTy)rh{;5AcTAX6OGk+$ z>5~(uH}GZF#jkDo9AFh4jyK;%_A4Zba*zD5&2~evQN%w!F4O5TMRt^R_{6d2qRVs@ ztLm&X)l-GX4h=yT?Z2L=-2X7ax9k1^YfSRxNE@bzv;lOcG38FAE;&X53aMgWFW%^{d3B52`St^H=r z(=NqRxaH=|qjMN~4C5ZpRorydvB*#|(@qgR;cdK5Lo>y(rVD!E)mUg)E1Ghez9ooJ z+3W+>X9@=GH*QKq=GVMp7PB1?7u<_|1X;Qv;uo5NZ0Lr!n5>`kEVqM0K5|}OVnHs= zpkJygx3ABc=<+a$riaOU9#hU3B+c12bpxnjb}u$ImRP4%|GNWenD8*o?#n9PGIixui;IsBW@~b?NCT_<>K6T!I^K4F zqywYmR#Ko=L_o4nj>b}wtl#W|v4p5a#PRk7uz4z`3_canSjY0T_2UD*&I>a&hoW;)XhNqT!VcI%%bJxx#Ut{iAnfpv@sXw2sdCp=DS*qx+q!Q+^plqQ`))5+f z79`ZLWIjDSw#Vu~n21=Paw{oVua|o$Y+nRqn^EI&HqwQOL&AE42q7CUmcA!c zovI!Xbz;uo=9!2iMn0?;uCw!z6&&$)`lmn?4!XZwkFMXlGTC!sI{GU+3GZ>R7~kp} zx_*J<1kG4G2mM5_C-7FWa3eJZ?11W}uH9u>uX^reJ0~;1PZEr0*bL62;x`d=rCLoM z$W>p=Ls1J2amm*~gcx_;t#@8)9PeyFqA&B3T|kPfSCP-lMuH-kL<8BcjVr^Et_ykW zCL0V3LK6p$|f+zCf(eia`A8WO=VIx~(U1RKy4h4<1 z+Q=5jz{BnPu%d^?EfJL|m6a>1fa$*!ZFVJIs9BqnAr*vrxKJ+C(GeUNzz}!&{qXJe z;S4VkBa%e_h}Fa;v}PXXFn~J_Ez;sF)sr=I>Sn?xy*edDw_eQF1U)BFN(@x?B~&bFyx@;$;D&juw;scKOD%dx@3dbfMlU8F#kDQ8rq2J7s;7 zE6ifexpm7yapdzhGoqzZq(#}ClR$s(kj$h>^4yNMQPV+hyC+=&8?QWiu z6TYDjr z0&8|V$m3CK+}i0BcU$&%gcmItrbV3=X^D*h6&SfpuV9togTS71v5N%n^XuNMn}hNj zf>e*8nf4#uRGU|@>MaP`&nKAkn!WYl3*~twOgz!Dcc;7a>}6hT`B;PP^!Lai!2^?u zwF`CG8-H5&A1_8fDy0=q7zwS$ZU(d-H(Hb~KA&M2jwEO_|0-H1fz_9kL@9Le8T_Rv zUc0JrOJx;07NG06}$CLrZU!YYi1R0 ztGTUAs%a^ectz2dY=+Hm*q(6I$wxDe{*0uj^0zn1unwPKdh`%KM&(Q-Yz`=E$m{y1 zT%A$*fkbOa^WArM;LHATXq%3r9(piGo-nG;pMypuVPACZep0jjlN+1FCa~wF>LdD3 zw{Yv9e7`8E>J0jfGnBBLCwv9`>Vv{BL>g#|PL@s?dhrWW{Vom_?k92Q`@bUa!L*|K zo?DQ~W;c`9Ox0Gh=0_w8URSR__Q%a|jeZ+=T5@pm>hsjcr2k0lpUi(;AEJSDrc6om z_DP#ZWHvSm2^k43x_DrR-g=xt>^tU;$mj_diDL9Z5Z}1mxQD%zWO;n+wju6ejYpfV zxjLJ+EY4tpd{-nc`y(+!q}n4r`#TUmwb|SsGMu_L74^zogQ=jf<71LRBkG;MS}yIV zymA96f>XueZ}uKuIT(yFtwAmzfe!3-s!{H8|)>!}d|_ zduy-f4~Ed6%9@rZ1%w-r4ZPYysoEtM;fzYi*l1&m^i034t$f-O>sJt-46u-^vvyGmEeu4Lu#xY^} zQ~Hhsr2wA`Q8XWbm}DS6{|@I>*L?!>>vD9d%-xsdK5q1 z>)|0{h}T^hj?Wr|?Kud}bA*P?)rRgb41x!FYdPhp?;cSWT7R=#0#xxw#h!|}gAiE{ zM#A0)0UNXedOm^&YYAV5yN>UjXkK@kf_mvaV9A0V4UkjvI<-iut3 zVLzWps|9wA8wb$^&fRFAN1Vl!dDpp~Mc{EogLmmNKD~CRc2PmFx&=Kd)E+fhmHSj2 zR*o)(_Nmyu4A zT@88`#_EB=U>&;e+Qc93^9Mt<9Mj4@t=FFm%Gn-IAtrk!m)@N09CM-juV12BSv!xR z$b@t0A(X%E0^GNQFnh`8>`{xA?&Q=Q4S~DgEnFU63{-;GMlVz7N#9R2Dn5|>!3dJe zG)buRy|DM2rA@P9BLH~KGW}?UezIlAj%^<`oiF8^PnG5R2|t{8*Sgr6O32Cqgzea@ z=wi#RrDO)JF3VlFOT(@!@6oHYzS*g(%b3)&t(AudnO`kU)T{W#) zsfuRS@!38I+)9!2pEhC8fh=#XZ914}5jxf+u5D6!q%^PG6(gT0W-Hdsv82EJvTYDI zmg&iMu8gW{%#)$+4<(f3f zQs{iL?0tMPbzwe7ZhKTz$M_9Wyp~^F@nkKeX9x3#VK&PyWlcDs_daLiZ46mbk{Eb^?=)ra^s$JhxqAmK5g#J84a-U z^L$SD!0prf!K68(hW8d3YlM|=O^+}1*AEA(IPa@2xt}=kSgu*D*l~KLK4flaU$&|; z%+Z!-MISZOy26Rww{o{uY5-`>LL%dMwx*^=vZTR+?aU3Ox>e!b;rw46T^2*=Y+S0c-m|9o`r~HcWC@@N_P~G+)ybW}zhopRYMtzPAD<2g zTU}8ROW$xgr+3c;%R%E#*~N~vB{iS*n^);JbG4%rI$&jCfCCtgc*ynH`y_dZ=f(S3 zfE^_KEg+r$)|)rjL+hcGV3ORg{Z<4kK=b-$PFe1yjGL={w)g73FLhH)<>%77W5WIZiPe$+Jl~9l_4}ES2GR z`wOk42%_s%ql<+XuPf^1S)fx5A}EKQvq>x9O;m`` zlA2wd18i!RZ-Hb{W#!0WDZ5AMe!qYtSzlr~GAJYjZ}o}j#UW|q#;n+v9(q+eiMmAx z$@%YQyb_ge2eB5zA-Qeq-5a6}QUW?-$!9CjLi33I6|+BV&yB6vO?88@SekLzYUY^C zq<2e`ifVDA^^#mU^{VnkBIx+gtNoUs^|V@u485ifMfS&4CfKYKmH!M68Ii@v+SKNd zTjKOj_#e2vr9U&@XuO&i6H9z@eEcO|0J@WggB8-WpP-Z~?2={Nah6H$=B8<2pllxA z@~zfpff2u;Do<7UMd8a(MQ3++4G2$d*IM#xruP6=&;bOHD4E3l~9i z0fg~L0Qu znXaG*p)OW6jmW)bYpf_1JWmGOtACb*E`Ip|X*5n{5^V!Fw0jkwT0pIHeF|_KRQ*ik z-1o%eoM_4<$Q~tgvel`4@dl6$fNt|x9ZZM|qO+wTG$6bHA7@MN+iw{EI5*TQNFR&Uq>?@Vj?;40t2V2H>_6%75p6X_PX`~ia|$uPf5 zuNKx^BQ~;QH5H7<)#I`&wYghGL^IN$F~&5d#0}6j@rM9jfinKYs~}o;B?Bbcx>Ocq z2*Y)$)bFVP2Sm-6c~_|U?B<-uZb2xi(UvB4shEl2K=)OC&@?rTGhp1sE#??B&D@$~ z%VS~5A6DaRAofjXny}*JqVHc;KZ#FFfk*n%A5A<+wZ%+JRJ^>VUHe_F0AwdMVi}5z zO}mab@;kR(Xd1ooL5gjUw9mh;L32X|G%JrDiFS>1pk=?sue~ZX{0q+ zAAcjd_6>9ENEQY56s;U?u3OAaW?Xtgs}Q{o^aeg$ho>UO#nLkqxxp0WVKl-?w$1yN zde`Enri@g~T0>ge<4QU+4&4KSAN|bY%TnPHECBka>Bu|s$)bWug@Tg)`Kdg0tE!|*c4D?L za!x}ffKpa`#m^^K3#3|X9X1Q~?W+|%v{XKpDCA{3&-1!|j;60e0;~8d49)1nAhD4s z21V=KF(6o~vsc#F*GqT^11Yws8!$%$mc(l%h2D7M6}3r#nOnM`yd+~t5Tjw3%EZWT zu_EWiv}O9fzT%v?EOcZ9Sj0rvBu+%PEQCuyL;V9U<2eHNR%O_e3_k)n3_f34jCR|1 z1=gdPd1c`a*#tfoML1^Hy6-}1&&*5A72z529RITkiQ|AEKR#m6Af9IE@Cm4HWy%5+ zbg}q@07wnaPTDticX)+M)9`Jfdh<@c-X%jvui2YC$sR&Y11$y?c_A*fw*-|w9xKC;5#Qi`FjKPTdh0M-S%d9MuZuRO z+nbymt=~A3A;A}OmW}T)bK_S7R$ESngnxquuX}s_T9hKZq-sc^;4pDWyw|s{zkdsm zbtx6ROtiekXXU`#C+hXOoYJUAJTaw5nSVhFnC_HQMQZd#j}vLx@Y7ojO2W2GV?uKm zTfuG{=zRYTloCXCNX^qg!Xmk%U`!AIDwJ44t_%gWVhFYVF&iHEuecPkn~Wea{ZyF% zLY3glIa>FN{wZ6?pPYY&?28m`po8?181KvpPRw=y$(8^v?3=DQ5eV^#&>jA1^|laP zTD;uaJ`E-rQKJKvYFhN@(0*wXE*RhrLVhi+b*Aja^R-q>0j&o3=hp2Z>S~QoX2ejJ zY@o~YeA33gqNwXV;c5vvi|?yP4I!%O7-Sw>ngZzQi{jFockt@YOp`bV9e&6Cih|X9#(>x9kFV^>-UA z&t+&q!mNHRQ+g_Uo{;f?{X^ysHlhD&JNl#!ggA^ZUx1IaaTFTON<$-UQ{BowK>4b!fG)!WT2_3 zDYZ^UHeRE+>5u20*u7}*R$<+2J?oK93L6{Sz&Hb{F}^hs+c+%wI(po$$u4`#D_2)zSSXl}+dI(!p zs>;g3r{$9S5Iqf2^pP>x@_eI3e0Y_Qq8yjQYWC+FsxJ5!x*Hs6-Q3*5YF8DCOU#~; z5TlQ{f|Us{9x_kZTOTvOP;-yI#UBN<@AnBnnxv=XMD9Q{vxpy}CjDBO8lD-LJ;glI z#wt;BlNt0j%@**V|M!BFeqeT?-*_<6Ig?|4tA7V{FgGsl>pze+%P2 zE)H;d9hn;4Y%P?`{r&x&4;LCC0|MH7d_Tf+42xb7!80i^K$UGDGlK{(j0pdZFn_Sr z^@id&Ex7Plf+3B6nA6lfcm@SVOJ$pz!k_8MFZX{zls`n}`kV+D#vey<3)esN7Jke! zjMb(VK)J5c<0^muCW~L)i~q+mxyvyk_lu4R3r+a1m;~rvW)ReKPbP@aSsrVQ(EUz_ z;287B6Vgm0a1d?Vu?j!sZ;?BoyZ}P~Z_*to2L9!n{rJooAL@^D&Y78#!YrMw9wPPS zDbmLz^h-}-tsEP9sF|hz)D8VD;2LWIMDA8~vV&(P71X(obWn+DwPgCSL|Lwg6Y)~F z0GDETw`h+DG=2;LG)?sko2p{)Wg?w?^-Mnv6I5*wE$X<2ibiOfflNslPK>{)lr0{l z^$JhoZzO>Oh1FyZPk9XZT3Svc#xk`%+phuvfrD>!mxqJA@LsLACd#i@V_se z6ZDM$_YX6#$NeGxh@*w_-Oiu+^wW(3Vp;zb|0V=r^x?_imW&|qyM?X*+Wq>%eJq;) zJO1jv^~qZN)*ax}E}t>;h?(DZUJC8DZ1!76`nCcooH_eL;%4icA5qTT&G1~?g~mVy z`Eu;O=jB7BC#gIi-xbKWoyYy91=uKM(Vd?z{>P!JYdwHxhUC-ul@Zu z7ZVPV@Cwr>)n`$FlIO!G*JjU4g`}5Gl)rUguAcKBWk>za7arj; z7-t|DNo}9C9BC|2x&LpfW&ev|Aj8k_4x$fx^LYzGoDbmNfzR^ekrMov%Hwy%+R}(M z;2|p&Q*^Eg{dx`{}vZ=HVaq{hNI#5zRz)cuv^>>)d`06kuA*?i9TnD(PG9S+*U=qZ5+I11)`enJPUZ| z@-mg$cK3#HmrWG$zw+# zu-prtZm|VN|KwHEVm1p@eyiwUaLQZXX57cyclVt7w=lg z3^K{!=#apP|K+)j4f4Fb^MVaxk2|orG16iFgRespCpqJ`B{t~x?NsB3|K3~wOu_#p zXZoMvGf}2|!z3f+cw0om2-X?7JnKki7D^>A{g^Dkmo`M41rHPSz!&ilTgdfJLA@|S z4S(EB0RD?4MRg$~NY#iYFo2NI_i~=v{Q`gby(`>^R8xE~LsmS48z1xE;`e__+T6xW zm)iptZ)foT0qdV0+y8tL#3PR4moAFU*YIXd+yu; zc}nguzkt~L_n&uwYJ&an$$Urn7Eim_W6S9HIIR?9Y6^KVnYz zbgq^2YEM|6vB?-XGl1*`vIAthq?=m<@Iz6sK`)&to&ZCke?~rH;Jt{x zd+s1P@K3y2>0bOReOO%izepMUYk1K$&xld9#R)*4s4fy(7RdDY0<1rNeI(*9*ZXfu za{Yi}f!3*y9MjCrE%EVasiJIzRQn7K00&#x|Np~*u2lwNZkn0Z;0hGJu+VFT)wiO3 z=^WJ8=UiVgrKk-D(&48WvV1@h0d$nb|AyrMrDTRG@1u>hNs;y3&VPobRye^zu{%^M?j@!9rT7VaR zUA*$hlv|)7;#2D$w0fZyXoWKz!*2VG`!7CADO(}}D0@$yaa6I>!lfd!0 z6bd5*rI4KDgCIbLG*>Xv!7f;Hli~L^?f*f)Y#;*v^;eyd+C|Vr=+UaDVs-$P7hXzJ zv{4a>eM{$pR|6Lwd2}c2ZIA&`n3}r+z{s`dH*+J@!XIEr{81+)5d#G>O%iL>;GbOq z7dqaRFYl}8rc}uQyXz(VSGxmR#{d=oA8YM@d%6Fbeq>H&mW8*1ykAVj?eQ7On8b`V zg7!}KUxR)%{(L&_UY}52W&l`6pE%KfKrL?mKVI8Rn=&a=KPm(1sMpp=HVey_BG%yaP%Z5*K07R|&$YEAxMuQ-K5w(I7HnU~ zYF=&WY1S`28Q)qdw&>UJ$qHcrtL>zxNL_kespptsNZ&htK3n-M>+&*2Lrre{W%^Sj z*c(IoQtad)1?ia;hb1*1jvnl_Ao(A(y#-L6ZL&2QL4zd_+}$C#TL|tB8v?-{f(9qJ zLvYx*ySoQ>cMtBtbpyFC$v0=d|DHL2&751eirNLmw#WMEUcGv?m;G3l1V!n5I#7`= z1h{_xDh^WbSnNMrnOF5fg&7E27o^&orpFVriZc!ZOgNPPKTNpJ=Ktz!cH{^bmxk+2 zt9*#HFrdTqtQu$Pq3C_Z&K{@qQ6=^rYvpN0ZPYJX%ECg_U%^-C79Pc~A8xD*3)8`8 zwuL2h=oAuinq;DuqgZl$$4)Ub%Wlv|$t=T4oby~!v);C^G!nJb$Y12ysFN!Vd+2lbNrBGA(+=lWT}qym^ltU4@3oN?BRk`B`< zF>)W+v`!<7_<{!_wv?3=XzuPBMMz?lrobf7A~Blk2Fm_)RH)M=ey8Q>-$;Ocpeb*V z@aEQea!g%KLH6L6eUf@()2EY1<%SFM(=QR`$C)MyZ>CSRii)U6Xw=SDDPY@u!_s-> zI`65mf_~BD*Jg(5xnAFJTVf}NffXk6`+EksOWo#~)6PN`6Sjw6=vEtKQQ)$Z-qLTN zvys|N8f7X(Lw2eyBqHzM2Ul-iL4R;|_8OwpglWH(U?k7@KX%$zuc*Mxx<~DN=$GV( zG4JH}ZPq)&T7dZDrTPDd_=7d+Tv;Yep=4Yu6?FemLxPNkB@O|N@E84Xxc{jFm?&&N zJTofm9h<6x47A#p;`D`qSB3P9IdiErI(}iB+X}30fwr$gK9Kh;dA}c^-h35&|HaFR zfif-3-QrBYiZqD;!IwBH%=4b3f2(rXQGs0&Y}6+n5=U?rF`nCGot|RdBFffOD{r+p zGIiAzIpuKHLZAo!Xm0Me7Da0|kt&%vK%)ZIMOIT_LRfg9ew&wg&sLoJBH6Eg<$ z&m&`5TuBVTG7&DJ~UqJ z8&>P0;o)wdAw_3#_~?IzXx#=J%a1EiLUE)QM%H^%9qSuyjUpAPDJ`d(?N8Kl9)yAw zN(1Ku6{4@@*2zbl+cw|b~o z|L;?ttj(zB8Y=1OuQ8rK(dC`iGxvwPh z;kPM#{(8(Ga2y$Oo+i$w$St0%G7Hy=>=LMs18!5e-AJTx1U~!Ecfgcs80$RwZxe6- z-3eDHGmQXZ2>g#9JI#VZ0*t zxSY6c(bAQ^+`fcW7%|;X79w0CCBBK03E0E0!keX;)IP^d8OiovAH~n?4xBQs!^AFI(PvoCh!h$G%@A!PZkqLg>j-k8U zJew8~-~I6d9PzQE6xMT3=W)fe;L;}Vrj<84f?0mf;Uro{smq^0MyO>iVORyW;jsE0 zeSaZ9EiL|G7T#mWRAEu0>!f#1%1B8^!wNp~C7!V8h3NyovQiSQ*~)ng#tl+nT~$v7 z(TUL0uvKal^r^4cjlE;XHWJksuF#DYwd$S5v-2wex@?@<&faD+iex>G2%YZ^U)GPQ zVC?GZB*JW40(X##S@*3ZR#U^eMeIB48I^PAkY8J7wUu{9=+j_-YyLWHm=noDYDTmk z>%w_+0b-zYsarofn_v3`tJ$k6_Oy-S!T6-@p=3Ah?WKG$cA2!f>J%#hu91xPBQNL^ z7Mln!yP5xCa-H#|n&(;V#Eq3tyWn12@;HihIgm5>3vks=xD1SqSKPbjFump} zQ%XXU%j?jW%T3OlS^3JUaQyCI>_eX$K8DLp@T}?ypHyph&7@AcIO}^pv4}hjVU+S| zl(2i!uNxf#wX!4uA7P!37~H=wpr?HX<(DlxrL7r^Ue;O8MIdvAY&AeAKFD0ct|aV~E!dL40p-&caELj{L+(62vlrK@jx zVV{%aorl&hXO_Qx@>0((MDswdq<8{jN-wh{P%&{USyLlM-c&u?RT<(JdVh$+tlYD?fY+b_{0~$15mZgF{CCpxQ)ZOK=7$UW%`r z05+9;gw@9a&AL)nld-S$8BxQrVU`GO>U4!1mAbaKwvRbI6re^u@)GsOkMHX&nB+%( znM5Yc0!ba#I(MBROzZNCD15-8szAksbAB_c#X&c69z2*zfoaoCKJKVps~?kM+6Cx% zhY5EmAkSZfs8PE%4}=BF&hf04dc$t^KoRTVGu>I@q*7o{Wb`sUWv6v_LgXeJU9I!w zC{VLfIrs%FM{g4e;MqIrIy_oVM3^f;QlX)K&xYHaiQ{iFd3x-6^tJaynyCmvJeCw5 zEqfx5!U!(Q?3w}_;^ad0o~UPUvWz3FPO(TZrV}5AboH5ngN^my7Hm|=pl;WT5@M@w z8x>n&MOtny72hV@cJCOEBtoVVY3EN?VZe7>vld!X0{3gor_h$;LSl-yn1mticT4AF zTlPn~#i69XHcBJmwh{&jY_tvz^e*x2xKDR(D@;bE$V5Ic^sH{58x;rMa<>twhcE@{ zjl+oqL9m^%9_r0NDcJGxdQlsqCY?PpB)zG8jR@{~+nkkQ6$a67H2Hgv3|m8U+mpLm zb?I&menRV6gb$D6x+dkMG4g!j^jYVfu5LVXJJqTFxq|!gW0QUjn}0z?luWqACssrz zt+nD>Z<&xD+iIH)X+Kji6D@n?ynlQS#^5{{aD>{z_Kozo%mq03)zE8lO>}AXP0iQ` z%KH_R*;opbY-*TK)0|2kb*!wF%~|8}F=EH(c=c7q^v}c8J7%{0H#*2UyO+~_^wJ4B zg-{}%p*vW=!q;;x3_E~lbg%+5%{x&S8mr=LOP|)Unw^<%N9}e5QtM3iPNqN!U%6Q_~n#W+-VJgSIEbH5ldhysxQ1>U2Nf9neS?Y$Sx_9}J_=C}QjW z@f-!yonQCiyd=lPUrqV-eAvyBp+xJng>fGVYc4`G&4vcwb7{OIp`dfS=EYWw+D?$E zG?-H{U=J!)SZQevmcRcs5**(JDs8cgvfCYjyXP%ejKF8A8bS!m!sA(6zFD^-4W7&E zt!m3WOat6`Wi{nsReFSF&ptDKEY=E%XD)M4TS`>};q9ig^UVG9*@uqW#h%gDp z7i#LV?0izy$KTBY2JKg$6Ffz@{pm({!rk+dQ`#ZMF9--B>qy0?B@H1kxp~6u?0VBX zj0Bpwq!3*HsO$zQv;aToB;I1&B+23=UD-&MIvk$Ro%LIAYD&)>ZiA-2gp^{ZmI$p> zYwcW!?|wXTj8e2+sJdWm+!2OPErS)B8grsM4g2N%?C8g{po0YOs=cU+pKp;k2e~+E zM|0M{k!h?yT5LzrSPvqbER&*!6SALS`Iozd?H5Cms$&x^&@MQJKU7*TAsX;kxX&Oc zw>Xm52$*NSc76H*61k){`CY{1?_+ zl&15V`22xp$8$VKY0q$wJ$1%R03p3JH4xU*ve`O_=?1gX@|>MbRq&}0pm-xLXF11c zP7SEH`H&m(^G` zM#=KtxoUtyO<47#0t;%E7o#WH%1$xX7uGF|FX_a`ZU^de_D>1(r=0n=_$NUBqq`c& zTl9yMH%E(XN=9i3*?vh>kcgs{JgYSsR}0&B9~0`qJZXmFR4a{9p+n)i5v0FH12`4^ zQNtWpD}Ago*1O}ZOOs(ZjtCx#|KI|s^40QP8ZX@35EeYlqZL4gQ6~JGJmeO2oK+d? z`+$h|JDOL!UF&O|7)G9r*K#%h=qM=2_@dtN;5QY=5Q>Behj&Mcq%g-YZ*8F@l=ejd z@iznYA`Xyy?dq;b)`%s~e|Lwp#@@d?eQ1<)!+L3o}cD8B)BgltT z6ed3#F@bDenyQB+ZPAtW4iD$<$$|&hVcu1hyxSGK`Q=ws%wOkJBbqgkJDqJrfyd!9 zeYhflKG>G+O$;j^5Y(1yIm#;KxVf`2qs(XvZc@TqQZc(s*RRHhdgJerUE&+PIIioY!IWX#|yj?HM`h` z8bqfhJMWWb#s&)#w#_=B5QWRYK3EEF#6Qj!@cYe)3psG4N(z<8`Cv`70+%j8cwh^wbR$I2k;85?c_x)6)>&o4&cNNj}R6NqDPA`ClNL!fe7v2 zUV7}SK=%_v{SJAa!5Ikr<}6Tf=?ksFjV`3p!#n{MoN?u%nn3k7%hH#M(rrj9T3z%jC$+ zaXSY}Q|v)Qk3}tfYxD`Ptkk&RElqr*%s>r4P@?qVs))?gq`)FkRzM@EGJM|zGIK<- zBb&mlkWws8*&|zAPvyvDUL&Yfc~e=_QQZZDjR^s(cn&s~hzL!Znav+>5fEF5VBp_a za~Ws#rM1&NYE9UDbNuz~C0R^`G`CeTIvNX}-5J)>Z4YAM{ZCv4-MG3!bgBGLKRl+c zVyaN%Z`gwEH41I9MVYdq;)?_0)ca|j`?WUa;#69&ybI#h-*bqLizAHdKR&EDU9|E{&DsNPBT=PgU4JmgW2-@mLEl1EqDoaB{e93qoyux4MeQb*jh(hT z@@4G$5P7r=@?Me>Lf0Q+;6ouFvPmjuKm#m5M zgyEIww=VMN5|w4B&ieK-(8Gx0vMkmEj&0P^Rw-?~v{kuh!n92{o3L5bJ`}-;ov!=p z@N7*EURCvKBuDBwxt5?i~Yy%S>VG|llTenD%lkfh>VBGr>u$bhS(w|r=vAYiz) za0m3Ayu;RUTq*u!u3Z*-;Hv=Jw6Z%8t211Mua;%lKYu?+pk*gM8^&3s>RJC|UbLU&?rAGbYs zb6KjZ)i2gnG1R+j%>+B>yN>QLJegU{PbaIMD|#B-ax|}s2Jsjg@UM%;7lA+&3f(tq`nJCsQ@W7uy(-FD6cH;qnoQcNhH=~{T;Fy$7yA* z95VJFgzT#z+!N#MMdV?2!Z6GLI<4v$55TxZ?c5#DDlk_&9?ak9SsBsB(82|@SIl`x zfx4x?RJgFyj82(I^EcN%t7afpAv<1GmDhL?$P}sXc^XgT1{`PXBNcrhp>Mj*DOHop zo#_-~``c;!9k4Wu0U}>~S7yf=fJiQ4izt=5KDVXQiRwa=Wz{=%5nwsBXIEuPk|NlYf&2W26QodWkRaR9MZ3w^@bMKKE zBV{sp{+rVB>;*9qz;l56P#LXPi$gVAtRZZ-GlC9R59(VBAe40lDzC0rJ=17tX}ixi zdcv}%0(Yl<3v#}7c{U#!EvyJjRXRf1wa zCKh=nw>=q0SSNpxo|T`i#^H`??w<%0&Pdts{>5_o!+=yBO{PHIV{u6)fM+|W10)kF zUjE;RGC-bDI4@Mg<&TC2Q=`Lpua>f=rc_z$9gXE`>qq6pr_Kq0>Z{tO22hQ_Vmy+) z-1J51*W<%p7n&Sv+=Fccz~Lw7OluTEN&DW2h`^`it+a&1O$D>hgm-ZQC$I2jHytkf z|BpP|Ke?SxY45c$YW=uB99fp|H}*aNfHOf`*8CozL$f*_s?#tq$cpO%i^gg`Lq|hJ z^|}lb1EW#)4M)^}$$&Y?@2=sbOoWdKQOl0Drw17OO1=<;CC7?|_97UNcXfNjn`P{@T%%AOkLQwh?mM-=w9~U2v`+sIb{};L8_3y0p z?mx5ETD@hh2|6EmN2*2i0Ire}Y4cA)FF-)ou)_C0Qa(X#8qPM!>4?QFj3H6({ucD;Fq{##7)GzpH=$MGE(y zbZJbliAoxPF-@+aS37T#e*eP<#iT!q+q4XJ5>;%CcrvCqXv zp-_B>@@H*G_9tl-(QncN&_Ithe#nm%4rtge^%=RXDE9KBQ&Jyx*Zfi&TgQa(rO+eO z16~EM=s%ef716H*G^ULa(D+ML=UJ2&Cq9Me31jVCECQ~AC<1#65lHxlRj)G1FW|gw zx0%v~jYNfNzY+*d^r-*AcjiT(!3=z(-Ty3NLd~*c~Z= zqzg}sxA{vxZ+%N+vR&PPs9%=pKEFa!0EM~av9mII`;&;0q`t9EB(_WUbRU;oZIbsW zj2Bave#rakg@I6f%JLTkfV`n`KJ$wUd5KAPy4@eCDTI6(0ffpay}rmJiMR7FU2Y_1 zJuG%VrK!B8&k%bZ!xHfvpPA)VCG-Vc6noE$-wt{oJCNk?*HZY4aSKHugI9nAZyNs8 za=1XhH=O$X4(QBjy3*_%2Btfb26%vuRM4|9E>OJ-BjRJ7PXV_e>@RE{?B_0=8CyD< zyFUmuIU+LxaLx81g0Pp;EgyUdw08>*5b&oel;6O+u9)CRz_-fEP1fRL%%9E>aAk+sSi!jY_gH^5)KF6rwMGs{X(K{uKu5Q~H!3RQ7M;EzxV7r(Gdh*n>7K z`f>}Xk23+vL7pm8HhLrSnwy)U;I_85F7D4qLv{ciNHL&TXB3r<3F$u=-{0n-4gR~} z9>?0(bwI`RNp?xP$zcymz9%uDAU{8SC)HJ!m3Kcs%Ve%x7d~YZb+x;@yF)NBDJhAI z3iNM{?O%-iO}k(sd6Spg@8lG{M4w?Z7ngRf>-VqEmDSY5R^85#=+(;wHxC_dt>`Jk zv;S)y{-a;q$jgBq0VI$Aw8Q_MJ#^CO2~`QuT9uT9tBi&-={0M!eL0*?KIx_xuj)SN zhxYx28UI<9fBSJ>EWNt;70kf9L2wC-tWG`)5+r%)zo1g|390n)ia!nM{W z@?T!cfAldjQhrlnHlYgwm)w2+f)F+Z!0~p*VS+hVE#9QCrT&$ z9i>Kre+yCG_3I0eVo@Dcy_fpm?f%yQ6H)34AUsul5SM=WzZxOYYhb!yyyt%jeM-Mb zV-o$_+4>K@Qy&5FE=EC59?#a6q4x(M)m`Nam-`Pt_CMMoz?1iYQ=Lfe8t~_gl}K1D zR0jd_#$teib4*f_6j1G+3-m%)7>uKz-2SMdB0{THnhn^I5cVhc%4Cdae=Ngir@{6R zkg^Tt1pXn1TUA>dr&^{hb1++mX-OIhceytywn?x}U+i-7*x7i>uK*k(5fPF1AwW3n zrx;$o{|zzea<0}g$*EB+fqQ8CXEBVsA zQg_;?jMgn>5m1dgT5gIzJ3lV~dZSJOn#>t8>UFtO!l{~><0c?CH<^+Ce$$gXe=7uHRVM_so;zmU!`MEPzWgUT@PbsQXOoZ9-Y72O`J#xq3{ zwqEaO=N-4*g8Pr%^(zvbMw9mMz{tUi*TaCCL^dEs4FA{+R6Pd!BVwaAUZW*C#+C1` zQH)C4&F(pHoSO%4bPNn}^Lu*q?BrR@cVxn*rNuGo$R=@EW9;7AQSpnNxm&VZ=#H=T z5_-N(8$NqLYs=e!P(1Q}E5n_yhb}>2*@XB5>hq!kv*rx5mJM=yg+58mm1~?fEY^&( zHch=Eb`4es9$E&FOYUW+;scv;t%BTTp*Sho(&YRupUV3rbbdH zX59{77=a$~FBT{9DaFvgaO3EUxlb_78C!4kRPoVx6U+A_CE<9kI~oZnb!WW7me03` zrGl;izcyDGnTyOm7Xk<(!6161H3IP=jLXU879jcmR-hVTaa$E7m2y?>j4j49kj3Nv zM%44rWNZD({X7_*b~okAibRmp#qRieFN*GJM`l1gZ)bXB{4KP*7TI~VHpfi@7Mq#! zZYf&7-K%JVd!JI%$=sZ!;rZs?Gz9-6_ta!*b^A{~kAOIo4yejVMiO6^dynjtbi!gD z{2tS&x98O(Vsf2*+5ua@fuj-up`-mtrKj&L)+w`f-K-6dOST?3Y}Rr)0%3$Pscd#H z{Nu-nkZs##t5=U!ZG^+Qqy3$3^uj;?n2~lgD*7UCFJ`C1ebFIRAgQ!+(-U3?RQ`UG zl#~o?Q}#S=x$d&N-sQ&akPvD{8=7sTep~?lIHXPilh3zBbs#{2hp~`oIX+D`J zhq-i%z&8_G#P}Kg+2gYaj>m~xpy1D;N(yR)vY0#jMR)I(ahf}Zr|D1vQ$_(CjuAcv zgO>O`p|x-Ta?bOYFoBYYGmIIdeAilLfT-3FNZsP|&cc98VeZ!4)7v1K=zC}sLc-?L zOa0Bh$P6ZDyAkePVkB)X(|{t3vzqxv8}jF^b>*tDPtug`r`?#D*hvT1^TvehgodB# zR@9RKiJ4$X#5)V!DX%bAx8b)S z);@7XZq@cJsccl@b0XX<%)j4aZmWwrt~lMq>eBAG?w75L95PZ za}@G*@mQ?t$nMOdp;VXPuf6wl<6@1phOPfqBv}WPo}AE&<$2xu6c;Gv1zQ1Kp$gy0 z4TK568TpXZab3;n`(Z0s0YZ6i+|P$OI;eVM1?CRFE7R(-+B9Ra1q_If!1=8Wsy zCXLh#SBmWb^{=!R$k(dOW*h;JTKQ}dC?WYb)Ce>!;!NHX7U`K(lHTAC-6m0OcRg`k zj}!{}Q)(hU^f0j`uY!pb(Us**Ux?ZZy-^6Bn-|GGd=%Kx*kS(S__M_hGSt#`+qL^s z)_L1CcL_3-cpgYW2W==xMgUy$@z4kuzDIhz=u~L8E5#_s)!r>VLJ`gnt(NX>Ro7@H zA{D?PgksmAqdFDOP7&gwL~Zdj-e~^JGJTAtnwk2@hlxss#ZE)l5jY4#}PN;9cYvqqLWpKoWV?7v*g%*@R1G}D|u zV|^n>*ta{DZUrC1%^RwkWPjj0$??Xao&$d+8*p7F0O#pL5ObrJ{D$uJ%vvE3$YE?7 z@qL@o?=;Ve3GLuv$C%>e9KO(PLq5*xf0x4TzzjbEzByzYr%qxTvxMbBo+BN0L;dW-ngT zJe2HWsC_X%q^E4*@osS{YYkdipi}K~dgA_lSkG`Ep(1Sr4j*(o9A~HmfC0@jQ|D55&N$V*9dp zyu!=Z+=5ncXgDxO!alSGP@-WLnI)+T%x)?l&5oJHj2xTZ+OCewJS>{yp*DEH?03A) zs0cdzLNOBJ)?f{JXzsg&IAq(+mFaNAwNbYpbY8 zRD;HJ+MBqUML0FJWK-`&j)&Ly#QH*ePXDWs{=x-A&v%9@6v3*O9WF&fsY@n&P?KBL z!GW5wjIKFvju0oV_TIUS!0KNyYL5hy&G4%)PLd(H@9LKYCZv**-PXXc5j5_&;F&_$ zPE`V=E9JnPMJPW=_;#hV8EVYoZ1E0JXKu|?ioglk64*i#f$(N{hn-{#Wpd!}g+Wn5 z;&JvoS>8A(%b2v-{Uz&p55tQ@DvRgByv3L_7YkN=bRmw(i#*XJa&@^ZMLJOP?!%gOTl#rzx$my(B>T} zSbNgmw$&gGRB=&CpMP48dO<=yr8!%Wu1qJp&21>~{vu)OSmmxVlf`S|4%w;t9G>wixJ0Pvh1s?A=6#Tgm7T1HIl0u7 zrq`MxPZj|#^Lu@sQG!tf4u2rj01?cXnH>X#yl6l{4|oOV1&kg!+3RzDcs zT=hW>I6Jd--cB?|3{&Nt8ZkS_FdIYFTUtNZ;Z#RQVr!5_J7aw=7_D|GRV@p0P>dc# z;lKGIP0(n%9GA9{!P9E9A)3hNTFdl##Z$FZi&`q4VK~v%@27t5y6&>ELlOvS1GrOI zB%HZTFI8j&D*@%rMf5%HO~ce`f+1?H2Az%9=9ovFy3o`GoHHKK!~~~q7~wT-9uG}v z8=n9Zw4u#YsaC8`%zaTI3#yT%tu>1hmDlm@+ukW~I>ua3Et-gU`~oBeay~XWW_&Cs z=-6YlU9&5x(T^NKaXl;^O&sxWF~Io;7XV5Ufe$m`L9;cOb8 zw*IE1MSEe-(DQ*iBK~Oy=yHHs-5PcUKq)Fkg!|XWfV%D0hZlyGy_&$#E-_O-cfi}u z=>{Z1YLOR9qOV@=i?iOPkiju3^}0UZ?lqUArd^N|wWuAuTj4(YChPJGXdl@q0TArE zcb)W6k6fLYuWgKZNXX?~8Yo>8DI*`Q7Mb@r1)6(^=MVB$>6FF^+PX+}ju-dtQ`at= z`*xlT0#(uu^z~8S!*)Tl4v+rvmD`jQVST)_qD_erJ{-}LWiSAJg&L3!$uo7mjT3CJ zm}j1RUVtC5Ky0CcUfp`}0oP@Q-s=o-`&fl>L~vk+?wZ_PBT=bZ$i!R{DP;mAL8=Ek zP9GL^Wpc-1;koB&@3Nt(U(zB;;uZTEx{nC}h?9~Rv7(qc%$#B?yg+Ze$B@|KX}XGZ za4n-pctEWt;d%?uw!x^LHszu{TvdCfOOkfYy6+pYk@}EU0y8>_c|y5~5oMZNWwpt8 z$I!ZAy*=YO6uGEJm@un=EA&Um11Z(EN4;#ftM=R?-l*|fdQVr`j^D!q+OTTdFGQ?& zM3gj|dmeXe1geOvZ$t^N4zl~1z%gY(v8sCJK#wFDJ@Zns8qwf@hlJ3WgzR(mv|mT? zG1{$YO~V_8flr@x2|_=5I_#(oZP4>8D~O*LN%|D-? z(~Uf*W?)gaMY>I*Tf2%FMLESJ;O}nN@;LKz*c2ll>#p_yQL&!psk~0beS4tiO%kSS zN~bFr`2uZu-nrj@giVg#n_n6zHZAXMY(04X6JvIl|)@l+gZ_eHIMnu!6# z1)CE1YM~Tw)BvDwX@9Xs6_8ggDne0k7>I?EZ0l{;Hk4SteD19(Yc`c1DKRto;Ta#L zJvR^{hy-XLo^4(`sn=eO5a-qLt4~UH3$^lVKw|oxOkNBobJ-2$Iyl+8zsp7G2HFHs zAYjnJF&#)@fiKoCTayuHX#{$S7cP6W>6d~vzm>@eaWWRO_dql_18q*voik=B@iFEb z1&Yd4 zn{i5^=xTRtd9ltq9vPoo9LNVCS@V<0-_aAOvhf|<%sB0uu!EJ`fF?8JzDOw-+NF$x zTOH*q9xeQ)TR-EqUHZus8)bZ8keEqrHqT;8&pS;qfLR9)taj@)`ML9eIo{c&N6Mi` zuPb2$CBd!R>eZlgWZAX3KpH0S$H>&fLa=A`PF6*!`wX{jMjCItz{^VO--kE|{+nQ8 zLeg=ZB>R)P!qA~oRqjs|qWj9ut4&&bqgu5xZC#lvf|&Y;VX#6#@$?8wnf2;u3eT+l zXYQSdSiu4bXHwD7&-hWsJ0mG)0Q#Op0qqQTOw`qRG&jxo49KLi;^%{7vQwN?Nz!z} zFP#?N#BlD$R|0W<;s?H+*AfjUhO}@t<&^SfXW0Z0aJsP!I4~oqo4YF(xui6<*c-$} z4Rdmz4R_&^JzWSam$AQEoxk&-AK9@*m$1yGi#5`u5&q6qow@7Pp{f5^ z6}Nx2i+Z-Jx1&|t{n;Rekq~~|^s!B#{c+XG_nEdu9iyNf?Y&-SAJhmZ0R+f6Hz?_z z0M;0KAVWAn62Lw>9s6BQq7fvnJt6`+7NdhNjURr_XG@@s6BooYe8dTsVIXtu14CrVsT(Y7I97I5#&QxF;G8fEOU?(Q z$459E?{TJeH`Lqu+h%9W0ycX}!^lCVpF*BJUyY~e=(^Iz)vr`sn4=MC^hm2N-nrNi zh|-muw_??#W7&_Uik0$YO&qwJ_Ydc*x;2iN$20nxv2ILL)4MuNb9K75hm$aIv>A6* zuDsvEx(61Zuq+qSspDe^xjVfEmfGh504!#bF(SFk1OU~u=ugGdlxz~Dfz$82QBm-@ zrK5vu3KLQ>K@T0;(DVFIX{ri`6FDJifY#(9@3 zRlAoGXs14$z^(6+QpsOeSce>01pjp=TLt5?8_pe@ye}=s-m|%@(<7N2OqClRsZC=K zv9csb-74TEwn4S80aC7o5M>c>(6M$y~FiSkUyG#N1?6po^zy z>*;Ki-3w`4=v~9x6K!+dZF#@wxnGbs0JH_f*e$TT-h1(-T$O&#;R<9PFBdxE^fdCKqW8}i2fACy^ z(fx<^cE8`K(&0&-NR3QdwF-%fdXqDfr*+IL!M-OjPIq7Mr2}U=X`R&Mi(cib2949iHd=hkCF<_nGb04A z0ottW5>kNae+%o{&4Dke7ErcOWh}SrHc|J>!L#~qMF!%Ir3j~nJm_-)=zL=8xX{13{pNmIp)U-rKg_P`% zg9^wNPV}{F)ApRbQDJvZEz3r-t^)}8TnxYr^ot0RyoWm?ylH-u-f{l1FyzQC+Umk{ zJUUC2>cwQAm-ARgc_-a;UM;+hahgK|Ef;zfHq|f+JrZzKxv__KbR#a3}piqSx%sDET%+-W}__9B;SJ5IT&^Iy%5R9J2 zsNJ`LVe4O?jBsIy*OSxO@9CNUA-grP@{YjVHAk!d^zZr5~vMiFif z@3$xrzRp3mo;x}`-_aVOU>_F{3Mz>^|3qQH6K=uix_2FUcX{9npJ=@eugH6d9zxm@ zs#gYwQ&5>{eew|pRgU*Cq!;p4V@Gb&wdxY}LpG$sJkcjFdX!HOy?uWHsH1}J{KwcU?F#bd=}E;5#bX{^!f<;ZBYbgASq(@ zIz$w3$9Jwsfy2J&&NC0uYraMT;GEiz+CLdRQYn=H-S5-BI*4OsuTJArkgfx}mP@HE!L&xQ zP693XqP6!!r4_PV4w<>*&#vi;cEek!$mvjXaN!+e$DJ_#Vr%9@kM?k17bn= zf^|1m+#3tl@*Dtkw9vX(`9X$qqjr4OD7+_vTma4CV>Bd+%R{Nf;`K&4%uKva-CEa0 zV;;Ke1rAOLNVJe%siKvrr*lQY7Jw;}GWb)XRi$TKBiW|xU!z9b6INoQEVnuk&TMGu z_>jYE+>6sI$C&lTZ-`a2t&t6l^#oOd8FCS(r*{#AlOD}d94`ZO*Cl)ISlnooqZO6Sh9Lkt|e%^fNtNyS9n=7%C|;6c2Hu~;N3NL8XD zaC*=KP8+%cxtV-(Q^$MYxqOPNcso=8)3I~|zT|N3vj1rDybF{v6yqO6%qszaZxmD^9^g9FCGLL0`Q@h; zOA-rH-{YDBAvZUnWaCj5@*1D(mBp-X`(euGyC2(AN^)$LQ@VD>!(ejmd*dItQGtVkFYSp^$I{rRLKTJ zDf9hcp{A(e*lcGP5LABO+rXzVk@`04`o+Ui#x$*iCy*h*0{I`rT#qUQb+z-mh4l#O zZ#r7fj5=OnD&M>Cs~^4EcYZU>wqUH=){K*xj|j7L>_uj+OD3UMwp~F*gru+ zYt8&y3xNMyBmZxm$|Ta4{^9lB|+PV!3)ZhD}}2o!Yloi(EpGHBIZo z49!Mx_v!Y@^FZ0rlWB3ijstSy-C+76PZTpey$p?5J@2y_&#{fyMGrz!-ves|W=?l{ zA$~11HreN0C7HIxb~H(z*HXN!87AGq=x?Z(P-*qLNyYoI0Fds1MWcE{owjx#;f+wi z0M3-thY+FS(T@3MWRV5OZyTTF7#tS`_$Xz0j;aO8b)nb@fd0np=uK?5Boo;Zkh=y| zG&XN$ax|1>G57Dx4*SaIsDbXgwvcP4x>3C#H|tupXvgzmzx{5ZAhF7$3&?Hc;iKVM zbD+WP@|V?qp!@90_^G2>0ioake!ST?4i_S3brL$SCpPDz)haNmhU-LC8amLKK% z$e^tE)T2#&`__cvGWzd}^X_K>woz7=KMIK#^Z9+jq8Aas~gP%Kg{A@U>LgVd>H zyeE8brufbMSIOud$V=upZ^Xd--(%r=1ES0@!F4U0KBOfOyykq6;hEthTKR@ActjAgUO0NmWZx4SPT0DKI*%?%u5CR`l@O5GY zKtrz**5n<6uU<<9d>#*=EASXo)X*?3{Jbkn@=#s~FL}#-OH6QUX1!{?{v#smJEP4Q zjiig^#DT#W!9^Z(lt*B|O29>`;c`H7|6{?DPFor6^y!!ZGGEVS>fyA?@p5BmDxr&& zdK&q?Rs6u!EirPzQd)Xhh|>+Jw@0AQG)#-mE*m{zncP*t$AbIT_`Zh@km&ISSTGR) ze;woYA6OUO)c_u}s^>>l%8za5-IAVKT=%oV_T8PHuKULrZ(u#UDL-W?#kCLInm0g!?IXdqEt` z))NbzKCjBs5fq$#u}bkc>soJD{0(ljqY(l5d?q_fCioaGRB^|b0L=Y6`}OZU5Rtwh zlQ;6^dcc+V1C6j&YE1U*S<`9$JFk91)c-t>Xz=NMxSka(xK+Z(Ani}fswkVMF!3sWA$qV&V^Xm-mDXX`qC^92syA z;K(Gn=Vtu76Zq$OWHe8gnMQTCO2|D{hwFOw&gOV;ZwQ3~gS)v`k>=>iOX;)C984Xm zoiJV=g~d+ZL>si{pj4&OR#`#;j)H$`6LP{?UJc2DQ-8&nB{2jWT= zrLpvYw?8*y8}JNk>7A8`0RYCsp-is-XpUMj`fi~H0M6$CBSZZZnOv>uq9lRyExG&_#>O)iuc@mVfSwQij>oZD+DB|qzx8CX;-#cew84-{!C;N zSAiPGuuvCOLume|Zq7YvuKl}>2zY_#hMc?!XucY{y6@J7bxHnFMFMnjI<#XF^u{V3 zZpg^I%rU7=gJeOlJxX}<3%d93nu9+@@jOR+ucK0;yw|+*^ygYVF0)p`vCgX|W_=mW zPCGGi9R~{`t=q+4CTIwvZ@+$b=5HV7!&M3z5Iqm(;^qLoCiX1R9S9))G2_#Cr1cmm zZ~grS{=C97uF_09oi!jP@?nAq59kH4)mgQ-r1EJ=x3|b@c6RHsOkj3PY8XT0ZF^_E*hr*}ffzw<+xHeL zHj3N+@{LY{05N4h%Z$C{^OGy13-=2E*^E{Y1c=(VauY;@R7RZN5z5oXxz?iJ<{iKS zk>G%#(MsF6?Um8{*9Gj}6?eTi{-+fNaGnDTG|y6qdd;Y2qx49txKnaMGEoUwx#@}m z!Yiith`Z(;O6~vl`*KkqDIM!?fb)eKb1VNWD9l<Llqy2g6nRbG2R{znVWI-NG+~@7ozju)~+M6JHm}Ii&t-rK_ z!Wd(-mVT|V-;+<-k%dwo_XBwHKR$Ct0#?0{WA0C03?VpdyZU^XO>q<4KcDM&>B=V<{bf1U8YqoPH6q(S*g|DIl%d} zBxP}>OvuaYkR3}IvwqnM{BL%cLr!X6IIdMm9Yc6_V8M*V{%-tpOr|WfIa(7{fb*Hr2lA9 zAzrwf^Z}dmlqE6gxyeb<-`~cUv_h*9GC1ZM!JKbTxPQnxUJ}@2$z-kic%FHJv3s;g=)8n z&c8GLQX|G8v;*j%`Bf^)cA_(Hd6jqyR8&Nid8m2JvmB@SfbU%40|e2RS;ScO zCicQFh`GL+@EO>Vr#@Rf=@!)K;TdY^J2&Tq@nne9*Ac#IaSrK{SEh1Oa|+H|ku@Ki zxt#Zrzd`W;my|moa^}4F}aifzWHWn^uD0Dv49E5Np~=!-dy^0Xz}!grg)gDTKq)&Fb~8{>?f3 zsb3FZ5ET}+wQuUoXMaz1*cFI>SRYs7p~F>oXj7ho=bWnuK$VaC1*SxZp0P3ipw@BS zPv58dGvB!rR}A1J0NI3<$%Z&x%iFEbPkd0+C(EW=Thmn4Q92aMl1dLt14@{q3(VBadwDM7ygHbPl1Vuc`GPk3dN^B-VIcodFM zG9>>}IlF8Xz+|8=n9_YSllft2%{0574oY2tT`y;u^|&y4w_$A2=KAtap3Hxsf4W@U z2~yS|B5L+yQ;N?2?5Ub8%x{;f3P{TL57t3)fDBzaz>?yTA)iu_^JfWMQewHc3)mNE zEF_=TiawRu-X^9Q)Swl?K}HP1BA0KOGN~_>j_U8+>Yt5;jFy;4SR)!6^k#wcATD&s z9~S|>LwQIMTED;9!JYU*-L}kUT0U*?MhAL((KN7Xvc@@AFW2|lPQY3G1l$&B4mBIe zTopi%jUFwx3>vdxve1Xg@#S<+wI|OfK=RSqF+$73P!3sYSIsZDqe;S_zEPaigg*s} z?m0jPotpM##j5)OBPhq7 z!*ezrJ+1O_yZ$|+C1U`OJmjkEe?nUDnIAKs^0t+Lo#}`9V@tF7RVz+?a5D(OY>H2-;ilK)?s{vYEm%;8wP<6?{BZpWE0fny{3>ql=m4TOv+ zfCCaU%6^o>tKoiec9UgVAkV-tLsP2*9I8iJXE!GZwOW#)^nW#av#F3QMv1x?L=VL* zyOVlLLdAA<`+{F5+}Z;vRgZhNLj^JNE-uV!!k0-Kiq$UjRTiXcLkHUfhqGWKgrUIc z5gm0KYYo)+RRcUMSr6)f7Q?#oZ&XsHNm+Y9(YDn0RYkY1ecvt@Xx6g3_SieptOB@! zoOmlG{wJ=01g{=+f8>iMv@CyP5?fV1V#Q1Q4;uIMsm?J7*L-mtV02Z(Z-5RP0cLou ztAKoj!vMg7JbWf2#mTe7iN$diT|^r;@i7O0pKAEQBinkf^oDO)zn?(xN#CZ1n?&FW zt`P-_elPeDLSaNb6Ls#6QFfNJ7Q(~gv`(!zccZs1e+rRXSpt$&(<+_`J?VFL>hUFxr;Tf@{K)@R%$xWY42Ej&m^<9MhdX^o?k9@$ zw2(N?$iF(ujyMTs%@jW>;>>|go}d0A?{&gqjuh{BA(@Tqr%%uE6CWm2;$*3SJV1_c z)=oKd=b~D-aRKYSt==2;Fw_!9xgRtkPs)9HclCZaDQo5GZg5;JtuZL$9%#acBy-!_ z72<`QEr8dxB4h0lN84Eg`ikoI*j!pU!W{7xXcR5c-$ooy9v>;+OA)JxB#-C0?^MUfoeehyRWBynZtH4@5avZ zh^lbFCa|zE?vtJ@70IBhNddGwNlDl;$$(>5YF%xAxU(d?L|T=lk4LW(MsF~x`Jq>< zH$ek#pqrF(rB`^hc<<-Z@COR|u-c&Yf*6Vu!zCy;<&&J_zpZ|yfz<&%Otn*b3dh}K_R2ZuXGf|G9o zueq&!yTM(*{_Obhcy(*=7PFYw_N^_(L`eQJD>ru>;9s#7k!Bj4<$F>FKr{0cZ-17Q zimg@)=-T?)IZdS@qV1g=sNH0dg=iT|sk+f$h7w%3HTgbN-Ww-dJ3ooXT%poqH0t{0 z*ZEabpdBn$t5CbyCUjX1d7J#v@BiRze+zgA@@lmtbEY`QryN9B4Ocwrd>%;g|H0EA z-?dtvvCNnxU`cuq=md1YO*hgA;E^obkz(eWUZKU(e&F1rn%|J?pcDC}T|iHel)p1G zqfKNcGxb-I#m8`cb@d5_B7QNtvXnA|7hYuf4ULb~kjxQ|# z+NSt+W%xRSkxB#o%|t7uN~47D1yMA_UQ|Ea-kp3D|5lKGmQp*dp*LHr`qkkX8Il9s zg=hIzX|wY`9#Yw|=M7FyJym*7%4m87538%O-g3)VH)Q0uxuO^{{fLd7D{?v`LyfMG z=9N`PVN=#re`@7`KeCbVMnHdb7P8o~+t2(@Vg#`KE0FY2dP6-ck7Le7 zbAeH9{*mS=%ZZ^A&ici$lxTK`y72)YzjtgP!Si}xJ|2FJ*DH_KElA)$p7PJf z|J@)!Rs292v{^8_E)U0W!wxl2dq{2&DX-gmTmQE#?T7Q6CPp?Gwf+Jb%!MgsoNPIB z^K4D+U@$(Qb<&qi5{D`7+=(6euP+09NPimrI#79QPsMFFyl{(*)%kY8%0I^ICqT>3 zmylXq(B=_m7dWDbV;=ZvlF{4z5#9^;FYd96Y_>cWiPC*oyE^ z1d#vZCE`4wt=Wuy`y;G~ZfcTbV0@QkB9QNV812Nl0XQ?YH^r$eL)PcKyb`ac6z+Ovc{+WxEe7K>(#!W zTs{;_{YLc*-1hx0U7Y{AyC*Olod?+L-?=TU?VkW?JWpQ2w@N9HrK&&P*8WSnMIv_( zkcrKfL=a5tc z<~#(^=v^&2y+0vg=&Mr7Us9EG(pP~SmkkXCPi%RlFqwgL<@aBCSU*h=l%1cq(iScm z988#9TB=4!C{4JH?bLkW7s^itM$Tz}O?VB^|NPdS-dt)lQn#wx` z9P{-Il{densH9{+(aMj!^55m3sB7UV07E_0IqmeCSxsNcL-m~i;sVllkvmA??%k{I zFO+|AKP&>;6(VF)Qf>$^6+W&a( zJ4*oY9p(p18Wi73>iBG(!sWqM_WBp-FS_nK@N$!}mQ(7N5JZnD6zb*;rxz9V;fWE=7^W#DMTu9AuG82BG&2zyCJT>cGKZ` z5cBNTFwle*7-G;F4hPX#IITM}Vl%le>s|;5iP$5Xp5cI{U9f+K+b&&MUTWwAwg3W^ z$d~fa(Mq4FE|J__8|SFoTZ!6}n4qKet6;O^P7oB63%s~UiGs)4o3w8WIckmHpZ_dF zOc;9h`0G+}lvee*Vthm5NFkykr^Rk!D!53DTv#_#x(Tld86KC`+>Vg(9f>%CVni5;s|CF|8gm}HI#Y+zqK3=6G0}UWW*giE*r)#5hN{7AkT_+2w31FXGv-0 zeCRfAIKL)Na{S{f_P3F<$BX|!^Tk_??o1%=HPQ!iPv7GnukgFq$DOCkclXO5k}}A@ z9b}+~x11rk1+ILq5<8~&jFX_ui|;YjV=8G8qKX8w z%rk}J`CY&tb_AK$1DP_U9uX6Ltr5kVq&G-lXb-$`~PQ#SA5vWkxk-_PC5WP*xbU_!h;QETMA|ZtuuR z5zR(OU3m8|knMjsY`L0`7@lZ!5Xy~cAbGzOzB>RY*8W2 z#dZLb)o!NWS@uioIhSRe_5k}1o^MjqaUB4jbI!9NW;{S?>e}aj&4sRqK)RXL97ccE zwOBw7f9qnEffR_{Ts^FQE%^~jxX%;d^tGdWE}NpHb@=AE*;Xtxu+g(zD$BdNyB~(_ z$@YiM7=C{LxG%Bn@f2m5Pjf-9QvzhP%HEbjVB3tsYe~NGylE9FD@FIXdl1gW(^6G( zQIMRVBl%{BUjH~knc>qS4-(t}yIsTqdw|nHu=`v@3xFdF_4RKu^N3``V;`W9 z9}fAO(Fe(C?|@X4Ng<1hw)y?qBk|GnhDF%ck^0@Ur|HchefUdET@eewtL-i6_0c*f==i0Ch2PC%ryOKF!6g(dOCgE;lS19k=d!(v0sfzQ6S;l^El*t~v)^IIep>@1bPWU5CWr7l^9O1+WuqmSZ86-npcU zWA8&&;0A0{F)TBx8ClrSW#JLm;$_2;a(|;-Y$!$q+#Dj3-hh{#8LZi_8d^}wfn z;eOq3dw6T-?>2B}m0`PuS;|r%o?qA10h?DlUfli}pRL=gabBq&82T`=BpY)EU+(!B zzO<3Wu`wv?D2bIWF!pkI+d^?!KCNhX-pf3@)98beI0BVDy7b;?TrtS)W;TGhVbBME zH1nMdl{Gj@k2*>;>YDh9pm}+6!EfGVr=>x}#}BhB97YXohKp{Hk;Rl*BE`4RM^Sr> z-~siMaB9CkMG(U^0({nBOp9fSwx?vJOHNE1*z&GKtFVt_{@ zC&(0vE9TFu=DCcdW4Yop1IB84eA_znraSsg>!fL=@50_Qj~;k zF9hU~Vuox5Tfh6k=f2;&X#d%>rC8FMwl)zXqC#?V%a3gdjBwT#o6JkoD4%vXBDE(6 zNExK!#`C`GDHr0`v-JGB^WK=Lp@}Yy?2I)D&L%875KfRx?pBXLv0Uuz(bE}CFW{#W zgacg8;l4ksOzht;B0yRiAa1)5QP=A)%* zuv&=`jLg-W`kXo@o;AS4zjC26Nf|k{0!9B`_|YnL*_306PVjI>k(Md8K1Hzo?P=!o zT$UbP9(8FuXtlAA-)}11EJwM{b>0sX1OOYoNUxKgh2`qPCo4P+yvW5v#CH)jQ|4j; zPA#E4LcaS48rs@i1G&oKfc^3M+N_+Ei$A7o#A(05pSPp3$jCr^v{F&PXon@rZc!i^ z@Wb_BYo>a)+-nC*Ot{VQwdgq%7z6q*OdIL39czXgoF#+090YcZWuCF8c}WP}O`K0_ zPoYegO+1u?2?=M(83N@VJ`BiZkJiRvI&!xb%F<;!1?fTv@iyOMyF<8vRU2c4N*+5| zhnfx4E5K;;b^21#WqM^U)pQ>2!9VxB@o4>V zYm#Lf>q$tQ|3!O_KcHXeFl;!rC@(KOH>dM9B@Hm*k1jr7J55A!`{_t#iM|0kb3D(? z#Z0G9LJ1JPJbqSJMr3Nvk{0VCO!4#GFYKqOT|aZU)GH^lp^ft z>x%617=G(!A(ru?4ebNJDooYv2rTBa-*B&Hrb~BJ6$4uvnYU^h9}=16}Tf~;&{1lc96&DCm|)cXD70zbdfIxT+5 zlBYwUko31v0J&lzpa&r-^R_uEyvY17l+@@*@;s zpMRb5ab=Mu^%@5Xsi}-F=wPO;)wtCHlKPU$2^V70E}$KgOHk|ZZA3Qv)l<_}pptPg z>`yL#3y8)`!J|HBmsCn|4X;W&dv>Lzip2tnHfTvbYZ&y%QMW8BMsv};nXDSVYF<^* zb=e(2tKYLJ8ofSvYpnr!L+C@>r~V50 znbKi9^t9qArrE7#slCH|J?-*kt9&#)`ZBBgQ8W+`CRQfR=l!ut)?OWdo}qx2I7cpDmYjm7M^3cQw_4_~If|Vm#C3POB@?UHrM}ua7tV^_N|= zk%U~FH-& zoF*OTbaC>Ro*Hcqi#VaNn9rK2hdq~xYj8~Vmphcn6smDMq!~6B=Sw;>K+aZ9{XNl? zQQl&d{)>L4h|9++IG8kd8aCx&`Kf_sXX7FHB3nqNH?xA}If+O5o6CrV^oHkmJmu3W z0+0HR1_VcU7J}P>@S%2W@Sjv$pH?e^gr5I0ex`1|VJ~|qLRJp&;69rb*G*aImCyUu z%toF!-=~l=8p>(7BSqu8Ez$perq5{s;dn6-jLbI_pDa}ucDp0YwUJ*Q`|d#YBJCC4 zfJjW;2dj9BQ-bY}_&5iH{^TJdBm~hVH+`gP-IwVBf;&G>PMu?rTU~;2{)Tj4VU3#O zn2foM!cO1^>2EVLCPDJaSob0zi|F45Ab&R#bgFpMi%)&Mn##f8yXf#}q850Cyy;ds zv+D6=?i8Qtbep!AVVnd;&%P4wxXsOE=GPjz_9i~ofk#z2Rs`=HZV)P_aia2Z%s*k; zqjm|Si;o3mZZV?A;gme~Cz94&Or6!G4d4Iwq4tXU9UtEB1v05O9<|ACVq$ydbbL`S zch#dX&9|6{ZYd4^*w@<6BLpv2Js^G)^YX{Lj|0!a#c z8RAJSvGq_vcCHwGK>y{-yeH{!$7l*ylP(p7%y`+lM-ZJra`2`vt`)R&nSHZnX;T(7 zCa;n}AW?U(4~o-m*GU+=XL1_u=kS3@O>}E8bErTYwdw)7@5;7kRJ*ubk($%hMww!# z$+IWt_w2LU9J0n6LAJ`-t?HTG5hkI+Bd_eocVF6}AJzRpBnnth3oUMd7M}>P$q(7J z1niwk`RvEO6!jE5&X2j-GU>1LMIm<&D8Z6Y&`6}j85*=N!v2jCpsKSht zb#JXO{Fn~1^Oizva1X6;YRt4L`%w|UDCV2TY=ms%A0{L0D#{E+Ke|X(ti_rNOj)PB{ox@8uj(J;c+?2bpI2^f z!zo(WRJbn)C?tm#oDo6+pd+}o*r+ZGbUww8vl{#@u@R6&0+ue~ zK3V95^d*)LB9d)0a-W#DPF?8oS9YlhlbE!ccN|(eM`&38Kum=<)X1kPbsLN1G@{qMqh@t9H5u`#)C`D3*FVl`C(QPPPW@Ow zw7Umdk~o^1Wi&wd#RpOn*VM+NU6BJoa_ri?c%3gC%xq&EE!ZbFso6B5@IvWXd&4sxN;8HBT)Abg4^+*Wvn? zoK}w9^pgGb}!JT`+un;q&4_uyc< zuUL@q(p%uEzV_MQ1po91r10bO6K$+8Y@Gl*vpGLCHOANW zaNEK0W>Ifxu`b_kyG(j6w8Pzx-~xsbts#PNdeuX3AFD<%7NhlYSO~9t$gccI_HsoI zwre44k<8x>Jv7KxBJ>vl;`I_RkNlq@|(S%!!$)2!)y>L zTn)2=V1_(}M&`YcJe^z08lnf$4>f8X8ge;|X6}WU4R;J=du~|_&70Kio~6KUzpybD zHigZEMVVlnqLcW{O0STU*EuY|;cg6Xp+Q%__4P2Ugb`DF6&%74CN}_|RI}5~Ym|jw zcy;jpY*y6ovW5#-L+1vigl#)3Z&mS)ybCm`b%J5QSfvKfiaJdJP%*9nC~We4qJJm=N5eCn<=gkLVE9~=-w}RWoQW@4mBZ=_!(0AUd^Rp>KlaWW`zqfv zSzqq$aUgI4CtmP4&2pP<7&r#aiyUpI^Xvwon@FemB1&!dCLfObxb+V>O+4}KLeBS? z(2*OuJn1|V%V?fr9=)v}nZg{LEU>MlhyE0Fd&IKqyOL-jXdxVTz$S`r{+PKvl5X#{ z@p57A`*X^mF7%`~HYQ4CG?nhUwM@6PM)kooJeMn3xE+S!*CvuUEbU!#NyT`qUVI2< zXI4??!@C6l`9A-37I9dE#EM7XjLTr&`C0go?IVMk~ z9U?2N2ZZOn%K4u=`-2APug=DNBC{l()+kNu;g#?#chwosEhv_Q|IHiog>Kr}*{Gmb zUy}*`3U2@-##s14wLMzWZ!gF;tKKKq&~{84To5?0j*F&%45KvJU#&<;^-T>jnI+^0s%x6|A%33_j#7KBf8je}Cqmsti6ufN{Y`QS5c@nhdh;={H3B7Y4zA@jJK z`B<(5n+KO!U2`28R*A|TkAwdC(4;Gl$E?X?-rWZov`+PdPlY_FCd7wgY@aMm4tHELqEE!#XCuH_!f_awRrA|FzE6LKmT;lOgE6=9x~~l3K1}8TVA?tGF7fNicx& zu5Syho#>?Cexb#4IF49zfnKLzyVV`~a8+7lZg9YSCO1*Ec{7_lHO>KEdoM{a!dGKP z$D-j%>~EH;nnQQG;>CEU1S9W*(U2PzI%$JDDXzmcDUmEUZz*RSwj}!(YEuspTz9n0 z9Dl#UmPV1lmP`;`d;WT23oW%}pt36HPQoxO`cHrFWyg4-Z#wnKkTaGm#GdH9YK?pv zN2F_?5JQ(w#zb3>Ew*V3(RTWm7yjz%2r?`?f)n)A!cSSK)lhK$ANwyF$9IIPfpuLyc97nkQh^R$=J!Xs4d}`6j!c(L}0u- zD%1ncN>xtBvCYcWU2vrze{iBrDq!&ZPsiN=VNuJ$l(rsTKLT>>_|_PtT|kRWPhG|x zjx)7dafdBN{&DIHVHa*9mEKlhzAIILzND79*m2Bt{q6z{JvFuOV>t#6sPgSKxZ+PI z*W;fOsaL-6qVizqpgcP(3%cz0fr--Cy=%zn%O%+l-6hm_TWGP)LMx?GT?iBZBV{4S z!5=nTn5B&KSzuDy=4ejO?C>~NdleaH9B^?HD0tYj2G7nY zYof9RT^sI|OGVwL;%pUHxT%mNlih^T*uxg;948w<2LMAQWkxJhkK3Ql&v(U25!qse&~BQC)Yg{JZ5gw1`qjPjn;sixqkkx~)9$=4sXyJ$;W zw7Yl`-|y@Eg!VE4xb2*@nSP*hP0j|rmnyVd3vCXPY& zB3(pE8iaLRzOgQ-jsD9a^OclG-PF#O;6`U@aU<)HXFO-$vo!4vG_HbS+-hK$79(J2 zL{giJ%)T863S^2s?l66GwSmi#)0iGeU!|TZII>`Np=BombA)=SRrodra$7C>DvojCJhhOw<_0Uqsz9_(y zaJ^#yG3J|VmX?+?6QjIyKQhAzyI|gX4mB&)u&7bz`InW**DYUPYE`=kTesNORoTyd zIm05C8%j;@Mjsnn%!>g?FG38xdwo1J%!XUc+a)gaQtUV&&2V}hxyFk)2E2aF<=p@M z?z~6s!Tk8_hCh~NaM&Yo-A#nM$^p*Kk}S%}`P${{c7A`OuZZVbO+HAt8?%Muj5eTU zDa26Z59L3Mb#JJO*^gyx{n&6dM2MH!jXLQyZW@6eEA6~wVdN0>g)gQ0dk%Ay zEeu%s~(Tjy_QWel}DKqE{X zP}|8z?PG!9=p%!9ZVzQ~MExkI^Ovb0#ni@zY*nPOMqL#;&%j2)anc9mDZ~yOT8PRG z%X5^ou>?oQq7wrq(s?vC@}6icg2em*nS}_V^~4#D8w2+?axI8!-Pz?AQ|dR{sSdiB z;$9AqBKK#MG}6WNI`x{7&xsYyzo#92_A-!vmY|uJOwZ6Qq#Da*U<^&(of74HUt)s2 z`%qrbkyD>emS(j7xcSYQhR00po3N{H^d7>5qnSV0yk||UAIu(5YnEI1YRa@LBjvhQ z(oJdYVXsWG@~y`E+fos3RUOu|B+vcHllMN@qdlJGxy6T42}pRIj*7Us?vGU?boji( z>Q=34f*mRsHo-a5qQg|SXr}7bunEjAd-&MpHH%IUy|0J6?&@JRK`oPx!@2h>1gz<& zYZ&}5x!L^?FL=&H&K9tFkk8#pi$M&f3rJH+qQR8a_9rc=*M=t-QWF^)ys0Ul(AHn@ zgcA5$UXWm^AhI+c#yf8u(?^bBo)+Mnaz6B@i92prpFb`o+7{Q{%~4Ig^rYrESPG)` z`pEcQKPpAUl1L(VjB*yWcm5t$((hX($0O0pLfqRQs6=N6OIH_f_iw(sI@JBpax>q} zZTC)<<2MTym22D!VZoxB)mtA_zi5Z>ExPtCJKhUv<5iVl1M!*MB7aQGU(+53tlulo zx?xEsU1vX`u@N~p>Kz5--;G{t0%aK#l629#&-@4M&7^c^`g z4l9Ut>{WdRS8KIiB?&H=4_F)A8@Bit7a)CTsdn#z>btVBf@I3`^F6WmLWm;Wb)Z+N zg})`}Q;+s*5)RHvR;TB?HhQl$-v6DL=8Cp!Z{c%;M+nLi*!4=D^hyV4r2C>dy71~9 zu_Sws#q9X9qYiH6W-(t8ox(>n9^V6QCoU-oys4xH#KGE!mXFdKX1Fvg6WyF-mJiF3 z;X^`K^OX~_+&-r|MCYcYkj&rmU*o*r_85eV^vr6tuG>Z~>a)1@W()3x-+oZVP8#2E zUhFq_n%7(S`nH5-W^2Bi$FXdAyBY>(Go_^=cNX$4D@-Ye)p#iBK65T2V>AFmp_)d_ z2f4W~*ndsAwK{?C9iwOTpgYNPvk+l;U0)lH@%ilPH2pD(USQnMj``8@?#CPbUmqo# zzPCF#34~(+?E7Xv-WZNJngV2AyR6xJ9G}YEQ&XG~!YgJeow$xG5$RqM#rw8uSVZZqW))M5# zJ_%@ss9Jis)F*BujGx7`RKSzL`bHO>|ZakYYewQSSSo~59} zM`$++(fz^FX#$7y)}(V2quh#bt_CGaczebpg1a(aZZ!p8ek}1S?z94opU75hyaz2_&NC zw4o`uwTpH0g(7)FU!=snhoE*Tf848ljG<}>T$(C*szJSDTMW0q z!p|E5IT!x}50gOXtnpSDABc$WB>B`KMQV1cg8PvNYktt$ogW-vq>X<@Fl(VsA$@a6 zqk`t`*>3K}NFitPAJc6b*~M`Wr6#s6%>RyGe@nBm<#HmJ#`R7hP zj_8#2MqO`?Vkd@fCfN)Gw8tR#YKY7g;)1P;I}qHrdTx(E4Ge;fBRntcfi8FR?)n21 zB1C8#Ic}g|-7R{zWy^(i>nr|}YmekT234ra;sF>lZr=2Tt#~4_9V=)v2vMPu-~xkU z!o_ba)i{V9#{tFZh1kaR&GmE?<29`pHr?6RoAcS&*o;l697l>P2cbraMA(fW(JdvN z>S^Vk`{g*8j0K#(Zetr>B%8lw<=_>ydj}yTZ}6fO<8H>Wh$M6C^EFx*M1HX!cZ(jf z9jO_-2jh_hm}?3(TCS!+)_ak1H*&n#ONXpMW4_C`Yc;XB!OJa*Xm#AH((#J+b?Q9H z`h}Ebt`cq|n#XgXbB2w-KxfOqD)0JwbzwH_tI4%*CJBN)6LV^0P6=VKwZ0>v#ci{o zr!!^V0qlIs69;;F^=9z~8g1oPL*)%>gsfTy_Z}vf;1($yx_VY68r)4`_w!!qlij|h ziCD5qd`50k^k!8djxF0{i$8}Y)sFiJzy7Bm-#))D&v}{%GNO8~Yh#={Z`(i$;Jk~`q3!!04VpTSCJR`;6P=T)XGBmIVP{4Upr?>J&Bf|DNiV>u1DnuD*#RM=Vf*X!M9(_JU6bJQt5(G<6SgM{^rh~=bY zyr5&m6;4ex=C{oG{pRlc68WGrUXXRG#wmP6Ud6;^g|op=eav6g+5QzIJKRPp?$&; zIk7!?4@B>eYN5zRvpgBsSJe{2=y#Qv z<6%%roBDl@D_Sz?{I*FF(-S%p=~vZ?4ay}I;<)AnHx_CX^R7QfF>f91!8sO3j0?lG zZ--_Ie6?&j80Av!0JHj61+wMH)x4O`btQ|)3lyL=i(oZ=Au5BOYbph9IV*$j8&rx4 zf`lXeW?TEpHj>?UdN7ZUzP*Rd^`;}{Kr|9p(uk5Mf$L~pnhg=0pxap%j3gFxd~y*1 zx*s-Pl+3(s(u3rq7JC~*wpaSPVjfcq`elrV#yeZ|L@Vq~X1aU({D^2VGSzyYNvIbx ztHcJ9YV7^wT4&trngiFQ+tW zw=eQ+XP>DO)^71E#QLIF-BBnINGY&OsL5k{x*2-a5%U6%DxXFkChsUj!8lf3+rvl| zzZ@nf=rC^er5xP#ucJhb6KIBTYt(R6p3N@_8c3Q~p6h5kd@B^mp`!wy$Wf-1gQG%> zlqp%H^Wkh=HTi%shn8MR#>CSoTi|I zk8EJbwZ$caIqo5Hl$fBa8oB6bda`Db?%m?L;;bud8q(xtn3q#_sC z-I4@cGekGnr5<5&>Yo^m@2b}NgqRAyZDLpT*ntky`W>ockcCE@Yu?D^WVDZ%HdL1$ zIG3%1gp#JlI%MsAg`8Y(qmtlWcDQ>9O`TUB&WAV?iq%>!Ls^eP`Z@u7;Sa&fZ;4Ri zi2Gnn8}%)WBwHFE`R0M*p(jnxiY=sleKA+0&Axgv!=&myq{g)a-)YobW+LIu?4`+o z=??j_jYe-|#Cubdh{J=eWHAguw zRHZ|;*mz~o_$46~Le`;ui>{=CumN?1fDYoEzi*p{FK5`n!^sG@k>Zj$OnbaY6p&s0 zTvcSsv?p%8x~{b$Icq*u5%juuhqk?uY#5q%bu_b(&%R%GbGD7zYSiOIy%ih*l7?GU z+hF~M$V;~M2KP=JPc}oH?YGcm6NRvpBiHoaB8tnL?uDABZ-#IbHr?rGkpe%G(La52 z?oZzg23pwEOa(4C_-(z^fKb>KcQ~Ax%OWt%R*KhfS{k$#TMH8(;}rASd6M|tlSQFt zz;sY00@;9$^}!qv<)fr;j`&iKSH~DP)YkbCX+mnecJ!?WiZe4M1Vaw9h4B=G^uz{p zE>eqBMHLp;wyV<`{*~IoSO?*mLlzAu;Iy;CE=%4_n`qd3nsT?fY!c7^lal>ZQ!|Q{ zh=sU^dfI1I&8i}|F#@$~usodn4l?%`WkadX5Qs*JFBw!0NNmm!T zebGd$HEj1Q!cppoS*TuN%5vW285vj6{V3{j0~%Qe!{w}}n~9FQwbZsnjR)xAz{*$x z-Ju>(f#JS*o&Tbh8C9Eo?o$mizEH}o;PC_$N1CQgWy|q)Iq8Z?LE>AS_L&yd*3V(0G>x<258!Z7|-5!|Vd-o(c0k$AmnS52v!3%3&k|EiX`Kb%Rsbg!Ld5?OeyPSO# zHIJ(7FVa)2##!E*>{8mN41?fBe;O+g*L>o%x7IMblihLCR42rBr@&kz4HEG5b~oM$ z1BN-qlW|-oO!spe+5ZIz)w@Gg#aIw)=@zGXZViod znS17N%H?d3pDA7tb$%1Unr2vY=vuRwvxzzn2j_T11#s72S?@VFyl78nOXBehgVnCKgGC$$)%Na#^Ic>dtPau&?;PHFWs#FR9~L`f0Vs-xMu@9}!Q-tUi7CuhOb zYKys!cOYkmtUXf)=e~7l&gR`jq$8_(wFsrt6hjmq zYfFZM)M1^Lj%HKj9Q$JxobXxl=a5v!p0c%Ep6N;dld1j>#>rWgpC>f#@Epi+?>i-C zeSKmR;OJ)K0^+vPdZjJz*6IV)U|+$brm2o0PNkGLR(AxA;sRU@14ee8x0deDv`0kf zHTtz~xb9aFS(4&}CzK}GY#iRNUHoiI)k3)e3xns|?0$|_Z9UB82d1NK( zZd8!`J4O$NywSa+$2!=VaF_WYr?tfzevPy*Qv4c+zmwbEjOyN2*~HAMesj7)vJ5C` z^hymJ+}0v$=~Y+al(K%%Sudn}Z@SvdvV=Qs+?M+C6vy!E;7=^j{aE2uLb>2frtD6Y zhVg4GH3LD1W5Tcsj&5x3^8ttPt5Afoh!`U!IfJliK)n=}A+5ER5k9}Z%AWoPabf?_ zETILM7RuTWN7-}no6o;gFWbI`@|9w|n6;iidzfJ?S1BDKAvPl#_&psAN28hjp4r#) zqaQAmC(p`3L9AsPQmfrq(-x(zGR;xOW=qMxUA8n_A|rJ8s>pm~+qb#|97;67!dRDU z-C=tE{6Dh-&(rE6{Rx)g4>jL;q5@@+JFg@pnJ(G96(hIHy;2!KzSgnhc>8=1nXsZZ zDaR;cVN#Vitc)j**rw+@v5w0Fe8Kf{v_^y)w9Gyo1m?l5IO)8rcOR)`Jda;-k|Q#? zMmpGS+}pqjl9uCf_f-~6euaI;a}Y5-Km*$Ib3nMNsrHOqtq;lPr=c#ENR^TVehe_PHQQdW%-j@Fl;P-P^pS8LC95_ z5mKp2U)mS47|ZQCU&@&tatLXC)JYfW5Lqr^Z z{peO&i{u}D)t8sB=<{ZyE5Ui&g+?~E#Fpv#*5=NPS%mrKb87g3j*h^Dok7K%Twbkx zvoe1u{0&4x20<(9O8PUeiR*EN=|M0qi}okmR?31+anM;6r-ImgiWFWNl={r*4+bH%hsoQO7?_MzW-B9&;%V6Ji;7KK zS`~j5sEJ4&%e^}sd!B8(D#+InCg^TljiLcw@I}D9C3#!qgWM0q*-+I|^En55u9L2! zqVwr|O;sxKxOpSW*BwB{zu(8OmA|fx+*#^@Bt{yzy_roD+&D-O%S+IaRJF*4PVNXF zQsJ!6MJ@4Kw-80?5U!>2$J|;A~knGg` zNffj?_ZXLy*x=ygr5$tPGB;PEj%+;K%~cvA7$e&Ue9B0vu#C!}i`=l%VW}=)fqnzZ zbrse#y*OqG!64$cy6!+inUK{_>o$)MC?#uf18edST2&c`J3%8enTc+p$@LOWHL!$4 zNXXD;cGzgGH-c2jH>GN29|^S*Gs14&_=zrGitLP)?uz5xDto)LJTkX&Nxz$>#g*<- zzg17fiu1Qz5=HV7?HVU8t(={O%tWaOI2ZKUx~hl?ZDlY8|NR-u%6^M0I}@r>M$Z#d z93GW0CMommF@1K;Xn$cX>wB|sZz>noY)?im8!ezs;k-%E?obFc)2NWa*|a1^pPG$4 zY1ne`9YH0yz_t(T^w_Tfag(tOuh=j?YE7b&+U?=Hs11Y)vlY=)SGyXOR@D~h!ee;5 zd5Bw9nf2^|dtcH9BBGJ0O@pl9djP%}vGXSRX>^tSq3dCJ)>HBBG1E@|PjGY}YkG+( zYNG;?TSu+Z&83P8BtP(*Zb{H;i(o?d2YMB_+SKDNZ1!=oUfh!1^TwM6CtNwnXMaTl zf~-P2)1!BN`HTPGtk;7Ds|utmpN!X1haar>K8>1ptKFSEvCT6Y2v~D-2vX)(=Qit6 z>^qro(iGb}7@PpOR2@2=CGdme2N`}spT<8K-}osg|#(tlePNS(~3+b!?M~A z-WOa^nNGs zuv7Lnh}(*^oXht&55=>QU!QhQx%PL0ybzpin!9LcUQ#y|(Hs;@_3V96zMv}P^UiFn zS(?I^w?eCH5rdce%8h>x{UV?-?3=gpgxS=rsDD~?yj23G!67y7&$LBe9*J`ycVA|E zvb)}*sNMYhfXt@G$!=552R=U#N5x4gQw$q(G8w9j*CcFGH2^t|hRWmzeoK!(lkY&&7I{&k|dR#(fho2?s>Z99Rm5vu* zOgVK=5H)So`la=o9bfT-bhzX%kRMS>y)8J}n@ddp+PT6X2|w;d)-=t*DrU9pmOJ9j z{-IE=#)+eS*+0f_@AiPsk9dPIbZHA{;>@_~LHhFr zGIEv|WYXXr&n|0sY8OVhf_WhH?Y%6v(~b=iLp;SM3IXAF_lwAlE&sdTTT;){ zplw2(g%c-S(T(t(hDdaQtyjX6k*2O7$L+XMq~1dWHnmPOPP9YRA;>1G?Qfg+K*`fx zj~`#-!i_k$ux`$yUOaDy`qZ5nW0OlvqA9w+a&ldS zi1Iph?0WR1*{j|ahJ}M;ewyu;7yHf9Wvha)R=IRuLJntb<#xuLg9GmJLa*HJ814V^ zW>@AgdmBvOqkL$RUR#k9!Q5>m6w9Xm{_}jIb*aT}Ha=2ePggX^v(Gk?Rz{P8cUw zUcT)J#GANrAFMn94{I?_4ZH*XqIP#|T+_!&on=vtA|pHGaox%B#fs&is+xoy;`-Vk zMjjZq8$FIbV)z#%2aVSO7`VVz@4tD4bJ#*Sara*yvAY%T>EGG>`uc&b$-QWXa|2^?-eQ6av&IN>23c6&-|9VWP; zFZh*fALb{frB_g1&f}&4!{mchuMe7j$FVC6TAbL>Wi`FaXcSGosB8v!K~2w2`?rcn)z{<8 z_RkIXGhyKRt#1&lkr*y?8mMnz&2WclT^ys@@>S7F-i;^LB2vi*G5 zkwO@`vIDvMYTR3~^B|CCpxxi=!<*&n>Xm(gy$h|^*TJ~UN;(FI<$VoMFt6I(Ix5a4 zwEI%9H@{kfh?0rsNY{FyxD!OO=9lBDUxTi&Hk1a37fcx*zxB?GSAt+67-2O_h15cK zmTK9Q??T|VNCCAytOpvK(uo$?0LVv43hn-)L7`2Lcxt!avyyIYJqE~VM+}#yHiq>i`(kt#dqrXb4IZWSX>DTGRv)?ms|1}o;!B&$_=2k>;v2r{@$s~TGBL3Dukq2u%!A6SWi)|$#>($L*!n;LQSCCM(bkbOuMS|gxmQs>!wtlJNLlo|JPha zhM+rCz!0t~r#+Jd(XNnNj)9Tg$RdLrtIhCStb5dfcBl?9cAXCSfStg1t5lfk)jxdP zjo&`*4)Af;=hYr01#mq3Hinq~4&*iIc*XLsg0qMupMJ|EpN5iw`|J3dHFb))OTQtSy+ zsB)Epwnod*tw0^OBdt}T1w=VVxCv49w4Uohk3PMAiU&t{h3JO%xh$sfsi8J0EaDa_E1x=iwpoAZjU6W+wySvK3X6wN_Lxi;>gC`*nL z*bDB8!fo?R;I$D4gW=_QUH8M&(hdE64~=P;ObGv0n6@yUzVm1$k!T3PTqekcQ>)L} z2A{(wAlRKx?R5Ikwd%h6M7)-xDHnf=Va3PxdFnqLCp!&zyqx_))1uqt)2nsC2XTq} z>x%$!qgBm=>c$G=gzKiJ-2>w|39%x&NAh)3q2Wi=xOd}I{?Y<04CiK!WOdRjG`8B3 z-2XeAA#(2Y_7oKWoKbcK*oF4FN{Mrx`FL6J+#{vS3eJKTSC{iQI1 z8#8}&|0$N?qrL_3*eMSl8g~gSjBhw1@7;O;RU049S6QEFC+_^&b9&6!znZ~BKAje) zViH(}pU$_N*kCfKac2<+^#b$C?|Bsz;1&A#dh#PoFax7z#e(-G6du5!)~jtC>mMu#{)0HGv|ha#F4UN zb)_bjVK;?Vx=C15D82kj4hgpFKXm^M9-n*ko2RE+-SuA5ez~UGIvl(icnvOmLkWbq zsvn0Hcvu$-Repf7Fd~v=q^-$e92`iN@20gdSP&1j>xZcGlQ{i@Zfd!Cx@4ZfqUe6k z))D^8q6on(~HN37!!vTENVO|mljd&tE|FF{29|;J3<}3>U zG**zGr2F@4fE5KVj)Xum5->zO7zfm(fCuIa@h2H8BtLfwH-38N6)(NPySs;G+uNCV zVI@JBhp7#$$~Le51N_10H6_7DYXJ!y1LoR0;M$y#uy35NM#`oC>$P`p`!rh?emHg4 zt5?ptUo~RM&BOQzu*VdG0Mh;A{1f26|(PBJv?Bf@Wm+}grFlI#&iG*{T{C!QSa*zC^%n`{HLwl{z-RXm;lvB^#sqEMPDWWzz_ z{VfF}$h*CT4*-_=!r9{mP67C%UnLKH>r#M{|yNrN(o*kk3aTfdQiBR|X| z-6QnIe>4nXOoECJ+a45BG^rjOeCXLl%sv})#-A@`jFb&te?E_K1pjV{zpbc&V6axd zEaAD+TFO20pR&iSR(fxv|FQ8-e{2Zy2m@ek7Un@?-h-T;$6=eH`@h_%q=08@k?MjJ zSJttJBt~Iyla2cm!5J?{WD_S2R3qXt;Hgoe|6?tFJo}6hn_RNI!f=`Gj0eHG@RjWc zt-EnQKTh~h9Wn_PfFt?%pFM)FomI6kI(LFfI{x2gGx=`v`t0}BmD5@wWBNNfrrz|B!Af{PeRNb|kj+)4!)~e>Q>V{G~xq z5eEX&WxxKOFi$P>zt#dDW8w&! zYOoyDXD-L3I*g4&R&Oc1cel7(B8inw!^--P$o>0GQOR5YaKnS7j!?Q}!ZY6r^wdVo zferFzVHm-pRlo>(b1Wz(Tt3^gete8AcQYRlC%`k%-~V*^KX;3V$kL_9nB~Fnj7Sqe z4&9OAnZHwP0j2vNi-YkIa8NO5O*UNMJZqSQ4>=Y+aJGsVBRnlk|C{&F|ZhMC0-hR_?@Waxf(cEFOn>$%Ktk8VvPW+Uw- z82^7?ZN8N&43@RaLhX>jN=N;roY24!41UDpU{6-_`Yba6j`lIZCjsY(+Uh4;7oTE$ z<(z1|+1cTf{xm{Rz?_nZ*OB9FW=W#?6#yR53)0__KOK~wMLR6 zobW0KcN(p#od}>Cl6KnX%Ht*BS8!T+w19SWw`fp;g2*m|_@Z{^Hf*^Cz6pf%th0^4 z?00y)9flJQ|5c#XY&<>RqYv_9So9;eG=xtt3@aT%re38yP~)v3QeixSHHO)D1&>&o z&I&;uB2c`?QlB+2F2*1I@a3F4=bv_lUJbv+YxqgYC%^ z2(}LW4DY};;QOMkuFGkcX|^^@ccdX6Ca`*_&mAW8U!jc=6WSskuwOs(4Nq$S-(DU4 zfKB)xi3#wMK2J{f>d$6ntn`XEg>9+$(si|h2A@CQD>UtND&s9S?FUEsna*yHPMZ`N z3>TwD6E@82ZFt(%)Ksr9=<5=ZoIi6%tYD7_P2?srsHbG5rKd}qn!?l4eA2Sq=Or)- zNrog^r?Xc|L*1HC_``BrT7AIWpbNN4-U4O?3Pv%>v+gGmRmIA57YaNxe zd}bX!HtKicl(j+Uf+at2lcsz0;@*rpD`lg)L5JDV_DKP~liyg*co!nQc$g4)5A#UF zo`n`4Sgn@;iLk4WFEt@FR$p1(bUnPnW-hdqP&;IE)9mZ8TYexg=A64bXJ@jGza0oo z-Sy3Xn?CigT*!kBlL9bRd;%C%W8U<`bYn zK{cTqM)G+6(4(f@=~%%7gWh)`NChNuiPlNmT{4`Nu1@A*W z?N|D`TEvGm3xtvOlnTH6xR8Fzt@Z>haRDV+it^g<>CS{_kuH^x1kEbwcA~%o%92;B zHuP<+-;G)qA(ky)65XxLc*cL1y>l->*~`&bms){=k;Yv%WO-lz@VLbaRikh}w33pN zvg*SnKC8r|1&RKjwEeTyvt!nL0@brNQaK(bs1ISbN&M5MN>2K=6w95qecaAzPqcJJ zrwozefJUW=sgBmu+m9?MA8H50vn_9uEg+rDb`?0o%euFG9nk>qX9B1H zgknw_1P!mr^p5=y)mATjAxSJlJyzbLGfKO!_kYl0nLz+e-E|WBu?|nOy!VV)|IzmJ zI9M#F!t;ZcIvrHTj z07=S$q2YfnmxoB?CG!K9vX#t#Ny$^LbMd+tO8xefS7A~u6F75CT4!xhYD~4GeHoa3 z(9Spt?d`!1z%7xK^17EJr51(YXk?%gilx=5bt!Z^asoc;0P?q6FsS(qj)Ebu zT;WZHB!E>}@gh>2<$&ldIfBNW_?}wKzX4ZNtruD*=!V{MYJte{NrZZCHRszT$OUPt z`^$#97c7et1)Wvo5_y^KVi~MDeCU zfjY!+p8e@DtL-z5e~VF6>Nw!b&~2QS7j9fCJN>d8y$p|Dl4(P+D>4zy6rlsTF;0Qb z?Z-9N2LZnOpH_Ui7F$^w{ba_Mcnw-JHPa7a1j`08GB)HmX+amLvCuw!bB!1x6bJ7% zfF1eh&N>=Kith9EaP^|m>D9ufXzl-WRGy-Qm>3gd160$bUdyP=SY^j0U1UM9qjQa| zn{!P!Zykivby$|CB>GRGo^&6OcsICZTjj+<^e%P-bi<5Gj&;S8x$OA%& zy}MPzzSh$tXhZZDN}vlSu7D ziO*vmDlv{Kvoc$}M-Tw+oz7(J`sKkKs|@1*^VOb%x2dqmM$q;1r{AO}1CpcdQC=?l zBYa+mmAI@#aB43Tpy!FMFf8XX?eROy{hQH#9K;5RwXTc;tZElz#82|DxPoqW-_bTaq$Mxw*sVRx3KGyJC3b;inU8|S5u-Y#|=4M9;1hMqz zlqb2J%tX4oaC|i9j4*#S$>p@YdAItU6wkn1?KUMsB}#oj4~A-?RJz6>Q3SDAfL2gIO=DD^xzN zJP|#qoCrV^yLkP=StM@xjMa)!co)(F#17(rSipsscN_1RY5G5s1r9R|8NG@3dj~!~g)&S9jezQ! z%9Tiw)H`@q>aU!hn+;;XYcXsF>%QatsX#*@8&?J^ed7oI?Dd=ZU$U&^tFQbb&UvF% zF-^f^6+4Qiv@D|6p0a2pLEZ#kcmB7zy(RvgTYuRYss&Jo1taV8b67%&^q;Bk|Gech zLJQq|oWQY0+Uy_I@QfZ7_GT^m^gsrYmQxrtz5$dSq*)a{O5}4#-@hb^EtB%<4N?hW zN}x5zjxsBOol#WAJUU>ExznPdw=1kE1$f|f=g%tVXv^uI_)VJtT5Z%28&Quf$yhS%O!u0_zTSZ3h(6r^a^5(4<)$6=57u4-VN*qmYy5( z*bQa^xwrMXF8FBbVV&lGoUsbenhaBZ-d;*6~}SsP@QBuluktp$n5&Jl+H% zX7ut;2&rI~|Id?{PZVfQg#RBW1zVlIE;RSJXL48#Jc_;{9mxkmtjPi2+bD5O@cY|W zzPUfdZm@W0I_iZ9_8*r{b0rmaO_2r5Z{k?#btplHjDRhX%V2j~t}GP@HI`FQQYue5 z?S5g|`BRO~?79`P^buQ?Q(LMitx_^Sc!Z zgwaElC*aiUR$nk!vSf&@Qu4~}>V^T=FVM}Y;ERSmp)>3Ks#SowL9*PFw>PH&q_5(` z&Wf?rC46!|X3)F@+3R zbmm-K{Q@SD(cy^6O0^qQ+8AWO>xHMNpXR!QoT~7K)4BsFj;KEzYGqvC<3CXZ+1@YW zq}*|RD^-y@qm*0)&crz31y$Up2ELn5xJuLSXgvl|=(TCDipu31W$JXY!au=P>ystP z)LA}CT2+AqSQfy!@%PhwdbMe@sT+y4N$-J)^Zh)VuC)jO?HK}Ro`Z7f5+2tk^JoFP z$Pomw_M7DAcTWn#AGoGYlmdMu8!{l80i5}4S2c^tCMLACX7x$gp2J{~UU`x-r+k0;Xof10j z&tIxCgi#Dw^{8ctP`fG^%7#gR>m`)PrA6N?^DU0?6(*kKT0=c1F#hz)O6KN(dN}-o zIZ8KZDf%xh0EO$!n1k>)9-%D*GOg#gJDx3z>?lW36xyNb-7G1&4Lp=9cUX}qhm}Jm zjW@Rz9ktW0JY-T~pzQeOGCqa)-070cD5AN&4{eQNLoN$Jux1ELNL!O9@b{RL1e~|y zY|;JlyvUu1zUrKC#)GnVUE)RjhTn6a9F_uud#cj!$(q zK5_X0rR!$F)bZOu8LsAL_<&t5r2f5~C{f)2ToD4R{>evQkN+lDBU8m9F_fIYwhsk= ztX85|d#fc;_(x4LG#?Dvy2EFiWk?v$XBT>r(&b?|OmBbu^(n}>#6dqi7uRCi|kf3s8;k!o>goOxjqPf>rc6T4D84&x7ql{=j<{m3Dpd-LGkVZ0B9 zbF>60Li|w$(KZ5r&K+u%PlB^8rWkc8$*w7hNL_8n6iGS4VG>gHROAOvHr~(5^%0H_ z>eb?RhkR^bk}_J|c(HoV^TI8m=}fdE-o(;j@9n&VIGi^>`EnSKQ;+T0p|qI1bmp17 zuV_6@)>>yyP6NUR4(1 zH99ni7UZ`ij~#NUuT;&%SSxYt}-n!=%(0T8=kGmI(D*MzFSx&y^BvO09DC@W{y;X z4!7y(E^^zrySv8{3&O8`mc|Zp-B`l)v^PXhH3d)hH_37mrRD3y_ji`>Md_%h?d+^G zO-&bd+b^PqOJVnOHMlR!K;f1(D2s1T%VvM^A5V= z9v?J=nJ}0j$T=b0L<0)aeYG9ola2u0spPz>sUZG1djetaDu1?fy(En#-aZZC8}YXtZ=Z z`W@CR(jCX8djEM$-pDp{?bX}pzU=SoZ?^U;^S2h{EYcP0E5C5hRLT>z59Ex9t_o$_ zN5=sQAl8$20gblHJpT|`f-F}?mc1HNtUa`jigIMI+B@12mJA$@Zv2GojG;y85J!hS z>0s9%6s-geZyWaL0a-Awb4nw~etEbxHCPC)zh1L5{=M0WEcmN8UOVs^Th0%9C@@%g zrt)vrxW6FhX5L)zE8#>yS#UTZ60;I*Qb3ELI!Nn{yg6LoX?m1jD`Qv|Qv&ZjjnzUz zno1EYqgEPqlS9??Du)&jl{Ay@RsE`EYn|{$eK#?~U_=%#L>82VI#7Uod^HbX&8_R|2BxXe&8by&|f zZHjc_nNbnd1IucrB+I|Bk5D;Y|kN0ZHf=GRF5<{+sO)8N+r z#yo4SRm2z>lIa1yO09fe<)U<%6+AT;fih2X7~WK!uXxjHeTUDySoKM2&&Tz_YD2`f z@S9)6g58si{s6pG4lOj4t{?)sbw*+6v+iVxvM!|}aR_pdeL!p|PoqEtG{fd1FW+Yk z-058lqc>dWg;d6awg{;;J=NBVTRr^Ma4pin55}X~)~$_7YZ=xU;b@-Kt}|!M#0&W2 z0*7wn>BcDW#deyC^D|(+fEanFg#cU?$=Vsq<6xsx{idLLe-V*qrtP#q_W%M9pPFD= zv#vi?BLw_xl%DS9W$)JdQ-Lr+^|PD>j_rH5YxbtB{Vr}2A*O_&dX)BNH#=yC8a6I3mSEIv)`Q7km zke2?`opVFwYl2#myG@IYU?c%IQWL=cnZ+h2#cpnGX^Kj<&^t$~ib!exbh{^Vq~@#?x^n?&*8Kmov_{`L5U`R4CL*)nM|ld1O$onzn&Y^ zoAAgk<9VXc$QVw0NpTG$pG%IZmKMn(I@ymCOaQ)rq?Bae z-xYCe=!VuiiYB>R~)U?1lEG zZFu)Un1%OkDN(t*AxA*6Mud-uWcvuM;K1|o@|BsYnKm;wF)=B$-=ap5n)@w+X( z&VC(s@^(R9=m;4xWMj~d|H2tTM`f+*~o1gEbxYc^pe)jgkK4KrWu&<+yo^!t+EMc zFJ@7vSFt5-?D4NcQzJG&O?Z&fU$!D4tuQUwUV z#i!z_gGI6+nXi^QuU`Bn+JG6#c+s7Y0seX!Ouz}5l_hgp=F1-DSk=yUt35e(o*u6{ zVLI4xr~hu;WfkiO78v?C%TEHy=#>6EmRB>9O()f#g{^j4FWY5e42*%6EgPePcu53P zglX8tyeeZ)eUE8NSPJW4Fj7XByRzeW95YKUMiSfqTIMQ1$iM*3^+)rQ8Ix8$@7#zCL26YV~?~ ziP^YG?-H^pn%y|&7K@WNB9NTFE<7@q(}BlatuE5mt;37)j!qy6(`-! zKO@DSA^x%Bd&H0L8$NFkyBuW;j^<7et+InmRQdJc`rUIKnrX2LVvX{pmUQkXM`e9k zijY-mQz42`pOM0JnO1Pz{gzznVsZyDn@c|vMW5NMmU@5BG~QfyC`jHF7yB$J*09@r z3F+HF-nq9d0Q!wHe>loVrxvVZAeczB19z@VmuUvsl-K(4Ss#PJ+Ckix_l4#h2X) zz(Eb7|AKBMBg?gFT`Hc(a?5Izn9}vbA^zFt@{2ao<~-^v2o19?tJzp3RlNFU(=ls# z2%l^mV2QZ^{qQHvu_h0zF>1s{5wy&1E3=Pxm`u?M9+9fX#tIEGYb7kFyL0=kDeGma zCO)YwS0a~joo>;|dn?fW<&oKd2w$W2mWuYn)-x2=mJ z$+f)wjPN$pC|!#SLDYrXB%j}`=|aWYdo(of%k8HZ3punCISl=BpcP6dyAvnJs+D%=SsP=iD%8+2 z&u!!g5PVXo{GZ^n5E07^vT=kYTAc-?aV3wByq|$I?gO=jLBzSW7)b9Xp`53IFDTKD zQ{MxVA~qGI#DvH_XVgb9J0Mf99`KTj-4;Q=uFqx0Pz_)C4WT{RY-6#<37zqRYvJel z;{yv58t_%D#E=7jw=k}o`SJV?kpRySHo|^+64GrjU%LJzFw?nFK3z@dMB;GR;!)p) zoC>NAAa?1uYbx(w@#xgF3)iaJp3f9;&^dgAwqF>`Mz~otw6iq-D0GC2p6j%Ev`X@7H0{b*r7est>NaDR1G%z95?Sz`O{R?RO;t3dE0OrV zhNcdRoX=Jbu40+w&n4(j6$oY&Jc$ifDbrBhl3h0CB3-mUB4^5DR`yI8RxbdJF+hFY zkNjz{>)d7BR1Bu1c_aur%K%pmQHSQ;W^lIH?!*YdZ&L<~iQu3vP*fGxZwp6pV?WHwe1 zk{489fCjJ-sU0!K;}5?6_+sQLex} z9#giPW5jP77^NM6GhGW^6atqaFKy)jsg$V)rNjdPkvRujKc7jY`V^VFDfzxUaE8WX zc6E_{_4x6_tdEyatl_mc^Ao(^*Wx~&D`{2YIMVPH#U60!D_R^u_51*GoAwq(!cBr! zv_Jf~{10kte{q4l zV55qLlsvX>$ecAv;PsD-+3ItLL9rOJ(F%AQc9LKoo@$nw1j;mbV%>d8Zik@>qPt~e2 zw|{imTVKTM@J?GihO`q)=0SP4%#x2kgnNV$1MYDw0x)EpsK++Rkh|IcPAZD({6f*z z&&B<)E9X=JHME-6ohCy%K-N&M(TY?zeK%!Sc}8_-5|re2)nRou!e6{FAe;Lt$-09J z*6>|2OdVI}jnN+)V+4ZL=ddc}-{ZpzYOn)XNq_~BaIN^30{U>7D9N23y8%JSk{3wi zDH=Qi8uMGf%L}uBhN!=QY<+L-;M9{@>Gk%B)eBr1GB#sON0!d~SOADv54xSAESh~Bk8%duU!jUV zvnfa{zOpQ_Nq5Tn+S-GxrsYx1Nx~C55ww%$hPj|hyfTMc&3{zz8zu<}>Zn$!4ZuhG zwukA=u?T4Yc zdrywL_VK<=ue!{E)HU9n7-SB&AB2Y9+;w<}6Yd#E?IZ@|w$9t+-=+`>_XSg?o)0t; z9(kD-=9#5*$Ck@(63KP!5tR8>!x!au>`+v{)fRkzlBFFCK}1W0)ya9@ar) z+(nMZ*wU+H-ClkWglmV~yYKF;y0|;1rL$_q?=(~{zbxvY)oL~aCZ?o1ym0sKzhxdQfv-Ivo zC%`0lV*S}5Uw)F8O)P%z93)aA(qYx%P-U%{)?;rn=aKx4#f3XI)PUY~o8-)Rp#W-S zyWG03jn^z|Xat>&SK3TFP*9Nt$F!h$w?MPL$^o-MC1kKuz}>Z!(XELQ3oc!H*1-2) zAtKp+&*!>hSsU{h8R5Id_BFG7_XAV(`V*blvd}KMbxtgea=70jMP|ha>E*(~`0jc4 zI#9V7j+R>qO(e3_?xp~)MNB6%Xn$p_sw|h<_~J9){q&z0!7K4l`g2g?hD4-py#g6r zPhaNhOR$Gu&Xlu}g5m`~%OT92|+gvCb^JD9rXwa$t0ePS{e-mOgx8b%` zY<0J|@^cr#xXSH>c!mQ{ulH?mE_7qtIEpplPjxaMFX+XRq-@cbHvzqVHFWc4pCV~-?24r8lY_nG%4M^6l08v-TdC)P^lBb;F*5#W+ znkxYSw0|cn30VN5ps~J5=7#|=_xKMK2^L!kr&qf)!$1TEv=v8P&hz80yTXM z9EzXIkM5&#wAhYtulAJf@#(44CE#A8U}aLx+i<>sK{461oHxH)WKG3J)d;Cl>MpMq ztOQ=$F9!*SYXZux$RY9YXveC8N|PH5iU_UrXlD?8(daI7yXJlr=p#k=198p+i(%p1 zM4q5u$Mz=k8**3K{exyW<6oyJDCK z@5?%Ha?rE(hYW!!9Ulc8t*Zj}65WqOOu5JwCO-oh%y;akYkHcLT_;vc?D^Vgf@YdJp6LXimJo$So65`2^`%aFF>Okmz+WcCjsN!YB73 z6s`*U+Y2j@0Efed%R?n*Wh=OYg0gehNFJTk{bMtfJgj_X<>q&zf!BJ>nG|C8Rk(FX*kOgSVb_!a#Y+GQJ6Jw>- z8N-#XUStF-W6`OFX2{0QI>{}It7klq7LjcpLyrh`2b6`<`AKVNz}>pDuL*ar?mHe| zq5_e%tlD>%m)5#i@_&($X#mZV#QW|>d*LQKtaXCdKO7KU5KCYqoxsZn z3xb(TkKWG_mx6yfIJ(uY$`2%sonDyk3Jy#+iO0Dy`pJv^gSU-s0i6l^O=te82dIH6 zAf>sc=cZ(Fd0^%=LSq9*XD7HXaJFWlyTVS4F@8}^*D$jBWR+IH_>zNS zcB+_Z9ID+EtRm+90JakWXD7Ox=6KOE$ z`IGV=AfIVxb65Zc!3k&3-1b(C6KoDJnPOMyDUbc2sGOK`c-p1VXEynOiK^<~{6~WzFrEByj{=TdR7Pw*n{#}ij z7M{{Y=WmRj8V&qF`eNj|*7SFIhj|n#*HH^F?ko0byZQIdr}fr2I5w`n6_YV&XrJ2L z&=o&9E1~S+fRnjz?y^v1+zrvJc$&c8j{T?y`Y-t9zhy znD+icV_RkF&nZfg@pBLAe3#v|a3zVpPq`X)gUk;h{@p zSSv*DKmSC z`3gY&*G0Y9LFUplUHCBT91y+SyZJBC%gqO{DV9C>!0)nQy3O=+`){f=W0ZM8M*IZMZz0e9Lt-gBbn=H2#RAv?H=fj=8xHg8yC4UF(wJw7-DCwgPuRnlm6Yy z`aW|Y3%EvjxwF9&6fPJ28*bD95!PGkgbO~XHySKWrtq6#hJR@RF3~ED!p5uB#REy{ zye{HL0$QZGle&8XQ20kyNvUh^&32^vvw5+q{$w?&1ti3Xl;W=LZQJF|IRt@D)pb${ z(~$*ba`&1y$B4YQ93|}r@wlB^*Zq$vz$Culs}z0BxtC;@!-ooG>4!?thpbKsI|sw@ zy*510x}8}8t&|D~fyM5=~N_nk=gVhgd_BBR%lXBe$kT1GT zaVAQ|^F%PV?6)=d>Lpr3>6lo2KU`g*-)f^`SCkIZei>H~t^?-UBGg zZQB|}P%scgK{BWal94PlNr{p(l9im1)J+b$0m(V%oI!FDP!W)vX)=;?&awa1xc9l| zzIR{kz0Y}d|G(b5Rg_&{mC)U5%{9ZAW6VYKZf-{H=5oHZj#x>2@b^k$7zDuiUzUd-N@K5cAL%~^&cHgwkPTXpopqF?NduGH@fNmhriK8P0DL6XE!R;&}B zKeAutDhtrCXTMmxqZ8i2%&cp){MMObd{s(#%I(a8h}$M(VS!P-JmhJT!?&fPSm>Fr z&l;F$2~wIV3F`i(gk{=(TNQvJsWHm9|07UQ34S(=WWV@L@nI;aQMKNMf)b~S1PRa! z`2r%(#Fy%BCZ z{N2K)$oX?mTy@|PzEsi9{o=NYDPLBNSx!zBn{y+^d4C}`3#_cc=B`Y=8luXg3fs^U z+eA93Mum&#c;7g5lS?PvZ#AnYhA}+5+on$072-580tN~XVrff{(fYAj=4sZ1eSY@S z5xz6D>Zlx$6$DLU-B7NoRK6BBHd<_%NX!r0R)kCL%~TL&;GjwFYP zEmzwm#;}sP?B&Z##fObdtV&|b0purPQZc+*p!2^3ji_{dv-)ux$qP*r>6mEAhnBAo zT@cmG9co;ZQh>?b=s0AwB%Gh;pn(z(8lUF`rlr5CrfD*fKjx};AxgyK5}{hBoX`JQ7H0a?ac_PnE?DA}{zD+i z^qx~8bmM8pt0pIf>UWQlv5{k{&~yl?r(KWgqhIuFYR#|es@5cNQPh#sL@9p;Di=R9 z*r433!bZ7TI@Iv%%C~@6e*cHcxE3w%;RX}Ox!OX`=Q}=`uH#W|@Bz4H03u|z=KhNm zN1xqOxQ;s`rD(wRn7zV==xDwwGp#DqKADXWkxs_eB)~a0AJ;qdg#>L=gCZ$%)>cN} z)r5}~Bu@I8CLE>6SMdB9xCaM56GpS^AIA%8KjQ+3+4ei{74o<&K=o30`#2Y{+GDZUYpZktVC~W6Y@&6HZb=& zQ_%DLlyFH9NBR2kQYfX(>7dE0jwtEd^F2mp1$m84K9?cjR=SSqR@vutP(?k3qkLTn zZkS9kx0UwROCfhXz+IsPGl6OOx`Eys2_asO%UZLq2+xe$15*;7sCFj=ogTn_O}CDO zd_?dcU7qzch6%XySLuDfn9Rn!w54k3+FPRJ!f*j*~AUP89y4{;{JsQAoZ z*@nsiuniE2%i>3XfFBIx0@($%e&<>$uY4LQkoD>mZ3-r0?73+us)U%Pni~s+QdvR* zb`#)}cwY;pF4YA5RT~=~Ok{R)Em$KRWGkY9Q%0?4!7kMCI82dR?hQ{HDW_53H_fYTctu-yjcx(%Hm0&ILvz{X$K1T7%T7P3A-uugA8 z54h3`KD@k+6nYtg2o?e72LmAZ&ajt>lmO9fA@+&kk&B#kr@i#P8USw^zWH(s%yP28 zIpmE*K2xu@Qy+f*IR0H*$Iu5!kiAQEr5{Jm2nkiANLS`x5+05orUY#$(UwRRO2DQR z1?@%2j@q9 z)}z)Ahi%L`E`GP*Ehg8ylIMSn`cl~gTPu=`qMWPINOY|)(IrsuQ?bsS#pX6gqga-9bVg6&Lq{~k}LARu*T1;BwW-Pm*I5D zRtA$9TWAk#z&+9(8sKl{@~F0AeBtw2XAVi+)+9aots_@*wr1seF#T6EOac$*x4jz5w8rGYe*KgL}kTao66^;wlzJ819Zd?S4Z~4QN zUE14z?3o{5+K32V|9rdudd3Og(tI~-U2J0FXzXYi+gb9`$!C37xAWAVGa}x~;be=u zw=gl^XW|9QbwQNt!uNaoJ({s2X7heqBDG#;DMMUO(Ljv8&3KO5TloAiMor+_va$eM zz+G9CT6`TeeH7G(;OC7Fs`@F+H2;IA!n=*PDR`PF6a#ZFII7n^tVi4utdjF41OGw` z)Rz}A>%A>EHa^=d4|fjqT``DoYfqFlTC$@|L`S}gCoNC|vQ zvYEikM2>^dv{~*}^@fj@Sl5<^iHkm(GJ;p+Gt;%@A@9p0X3KGfFB>%*J?(D>y!&BEFqeW)7HrUSNtkqjswzgJ2^rBcM-`KbS zqZTWWM=$c%S6RF#u3hSh5fJFq9pZWK0%E&1ON7>gSEgIaE(;#3W1NHJ+`h3!EI1o^uj9yF*<#Gg#X9GV18EN<*1=rQUDS9zn@nPI64 zS44qV@XQsBvTw>HD|`p@+A`;}1eQC$ezWZ6^2&5>At}1V*IEy-_t#vcf-#1E7U7gC zQlm`1B!WIcnH(!IO^s*UC$6oi+G|hMfT-fse7O41A0MY=U%P{rnL~#=!!1VY+_?^H zYuFu1NE?J=M<2vzI4q0eG}MDh`Tf3!WiuRw=+}203BLNSt8ajrIj5ty7oUlMU}9#~kMk;!ui&}ndWx#8<74$VU>iJV0@T0>0Y3>Mg0cu1 zi-l)$w}-vt(F|7O7+r4E^N8No_GQa%1uguw)qUj`RWik&*x(qGJY_{PTKM~`|F8o8 zAA^g==*OP-8Hn#pQy(%;Jbg-qR`KlLaFs)T^C2Gtri{9PF!O8ygEbZALg`3w-^5_lZmdxC=vYuxt z!$o!A=X!~wCxYu?DH7WH`SPxZ_C=~UOByi8G#ryj6= zbeL;MBI~u~2koCI!NvwD-$O&t5Y}|3-|LUk36+3W&>EZwOw@r^aCG(m;8BMeD ztsd^#5j{f$_&%3qP2$#I-;rL=4YfDl&5-a>60pPu^dDEdF8HP4dinm=pb7?9@3AI9 z+G-U3tkw^v@8B4tw7^7DG5?DXT(Y_`SqFcO5`ccS@;|SG+gXhy@2L}idM4*b&zNNU zy`;7C68!dskx%F>urlPQxd2vo(fRBpFIcwMSiOyGEja1Ol@@&bbN(_>JrW%AbE0Ra zDV^sl*L7Z8@F-s|{vHb)?oh0~{b^o`Mz-om?Aiy*L^ajyqT5dPrUr@iOyDoM_IYsp z{+GTKVU5&dusW_P(6&_u{?-%jA; zBUeh)(#bBuuKnYEM-S}BR#Q~7mD$;c(I&k`6H6q1IZoSKPnbu)ptXqd8T~*Wf*Sjs z0PlbG9Nzfbc87;_02P#<-=>sTzIW&@iDFLE5CW&hn?6ll61;-vcu5o|j_9XpH-I}N zA?%L1ab>Yz)UNL%?Eo7s^NrS*zh(#j6k$QQ@bL0fP>TGxoj?iP++i|`-I@R-08b2r zR1p5wo}$#R8hPW+0-KyQ^T7P&bJoSK&X_&&jMW35Gu(#^cc!X;JKT9Bp%=sfjamtO?A&h8LId+4Yq1FYj6yeub%S;IKi&wE+QU?Hh== z_FWGe-fNRl-uNrlH+s;#`sYRP@eD%r}5iy&-#1hmc09|>iKTW=*?@q$t0;hC28P5rv1>u0dLmmGQnOGFNI|d`6Ab7Usd0BS%nk^4cb<_J; zZfNq&V_(IehjCvrJK!LQXsX-}jlSm;jlZ;xUW0@HX7x%WZuGgY8FDZL|_Y0nyTsNf03JwN#^pM7he zt|7|4L%@7b0~Y%6rr$@J0@}fi@v4>e8iAFu3bP1iD{VTJf*k6GxcANz<%lmwnyiJMjr&)g9yYw%*lq`Fuf#Gy}xDt;ce9`e*TrZ24jz5dD=h~;{swqCxVb6 zd0J5iQjqRvgpZNQ{sPF@f0`0=$Ym9cepBtu*UR`BNf>_#WEOVwKX6Y0YtRun8AKio zbS|c4bQTybv11?T;Cz?E|2%ryOn+yQ`Sr`Ty$3bTZx%m| zvSrI{sB0-fs&RacMRt=*Yhuvs6 zDrvY)=zT&s%F38s&kHpx;tV?zqSK3tfrN+*QofJ{DJzOJ$v4@JcvAH)l(|um(i;aF zYtoZ=79M8UlO7PzRcl%lL8&pFk;_KIXu;@yR>-B3%~_~H$K(@>8J(FW-{0xTJ!Lh( z(1MABOLY?=9&resV+e>D`>1b|T}qJ~wt+TzQH& zt;*WaW~C3gUUcz}2%q-e3@1PR+Ec%c5k(FI!-n-imZe(D=}VtkpTG=oUHuVHgULX) zvH9#aDa5ukYXdaEl$H(*-bdgVw$y^j<#pO|5F=tf&8o`Wg7aK@65H*ck5-4vidWwm zh7{^-y{&R4oW5p--SyTya(aKeslo)>kEbXVVJ_C@&Sf>nT3%^I(FA*9F;rU95pX(g zg~+Vjs9Sng-)_6BVoQaBflZ#a$;t_CxX2{ef-F`?y7D{iuZn?*M2GEt@humH@sV?t zR?{-~siou)69*fT%%8X4N1EIWtViZDjUbodC;249C70&@RLL)9!t?sJ%jTCf?=N8~ z<9BIFKSbTE=gEnARF1dI`I}$iC#C(Z-o}C5TY`vg2-W`9=du<5OESy|b+@k{8=ekg zMVMoJ=!!3ceV|d!!{a+$PPdzD!2;L*k!aOBMK(_5Dbu_0#ucvtetfypf$1p_V&;OY zTk&vlzcyw*Y#gz+cY=z2`H;uF>L5S}a+$BM@#p9LL3ZnZcM69Zwb$&KGFpu>71&=Y z{FpQBbGJklBke4U?Bc!#f3D*Ud&=Ej#iRLjRdNR53dvaa&MiRDH#vwqh&U^%%TYYz zj0@I3e8PHhFZD}id6LMTa&9M{Y;eVK>S4Q9T##HQEy=t$hqoBYZ!E7<7@eF=)0PpcwheMCbP0F0ll(VOVqyPfY^D}-pXO+7hak(z25Asjr~;Fp2l^P+1r+I&CG3S4 zbx~NQ&QP}QQsgT+dWZ%RzFgR(6?*D+5}EZmTKMb`j8Q*W9rbdugXuI1oRnIPR{3tU z_|V1L$NH9-1;dxOXBgaMo4kW<2HuUb8qlz<39#>P2*Y_Q)?3=45*9=Qp>B}9I(jWC zG^#a$Cp}u?djw1iM=XJ|amU!o`RZQX7bn^AEoEKtl&Cfl)dB&dF+fm}>QmTh>Vx51_z5@G2t-^NCuZU5K(5{9Ac`E zJCDITKF-mTNe8hf{W=SO$n_MsV1J9IAwW919-HuX=M;DM#ZWNkqDwgB+zm9<{C2EQ zE%w~`kd!0XZ^5v6_h?FpUXegPiFef9M-N^!>AX_W@ZmU_Pddar`dbWCYx#Ibr+TK> zHu}|}TchVrx$V*vDK%fsj$B(cwbc*D&7zZ53ZoUB&_YL<^&cC#;Vso0td5uGH~dV8 zJhzmNosM; zIb+QP1CQIfxasM-qGc*{b4;lCsDm@STQW(;er<5pJ!&a0 z*+O*qV5xm2?%oFx+vQYK<%w@?jTS}a9Z%M{zJG@X`U<%BCKu)UXPPCW zmvs=9T>=ym#71#WPpwfcMviX+ZerxV5>HLkDf}%$jGqh-`-g&P93v#*$c4xlT zNs?e~r89whAc8+2cI_EkR1|uFA`DpoN>M#}aC733$C7Q%*C4PH5EVu{TW@WlszazY zw;c)ZkPrg<0#ZZV*EoO}6-LMiu+>xcHg>#{l0?V^vSCIzDI4!zq?!XITd=@!P$-zA zl)AiZ+@P0H#`xjeA6$TQ9@kTL1AYCw<1-%hI-oPAd`iHinG#8_x_hRlt9x8@^Di0& zgG_L+dvuC9snk!g)DnMp$JNK7CXV%hs0{w_GqJW%b5S1EeFK8{XrBTD)$250cS1J(CW_f#nYd`82T2cj}c6 z26^*$fN{|K!)%Z>+tazOaXCZn*f2D(zW;)Y)B!tWOGL35DOZK1#$2W=g;Dy7k z?#c3#a76k*w)$@x?%j#Sv-61|b84TYavO zIcD(J&W}BfgJJRLKHqUtmZQ3CzekyV(Y1Qr7Qq&#|a^Y+f}W7kcO9X^mU#I%))C^2xYw=~Qf0N+=G1G`7 z_OX0C?w7rquG`*r+yJb6`RP7D`DKP)7Tp6-_w#a(OD!l4<^^PbYd%>#Q=9S>rt5B$ z>K+~57zN<3AyB~Qo3Q=|6t@Xsx~UzNwSq&=D-MCKr}*L1_X9pth@Q`@#TY|~QYmE( zxJ6#XEqUw!q{@3|^vZd{fP%WPV>#WhQCasf>$^VJ%nM~^mI(?>0KUA*LAB`xVAPN# z=8-?h%KS2dYc4eVK&Q`{z-4(myaA=8@ zsDvo9v`Y9{my2-#&lK0ic)r`Z1hPhk=uX1!CR^n3_h+1^9i z>;1hVVAH(raNVIsslUyHl68bkg9tbkF_5`4*(q#!I@R51wRp(m`T%GiN!~eE zs&YdU)fu=ocr}7KnP1yM?x3;ZA1#zWutiJ&C39?dvZPxBgwNVr^fBr21<#NMY^?aM zvqnVbSmx%gS%FJPIfR@IX3_b2VT?$@?2Y4Gjz;w1U^WcaoZ1;P%#+17T@xDHM9l8+ z8-)*JEc0lQvlgUTLH$%+LaV}CCYeXN^L#j`FMY7W))`(DzWdWWx+!NFo7b?y6h~pV z;AjHcs~K78O)VY!)kiAvoQbb50~b-|Ldph8V7VlP2TZBpdTSdtJ>M{@O!#w>`cnS%=o9Wu`lQch8;Mv+Jh|&*99~WuHiGPf3K*^%=YZ3p+5;7V`y!U z+{zyAW32A8hVG&^>^-VWOM7f$d@k5!$kj&rqa|-+WSRE%Ve=1=gzu$~^I-+<9*tDj zbws2kP4e6y-%v=(wI{?J(k zx6X$oqiKu?`IYCEhqW%P%31l;fh4td1?-Eh6v1-YMXuFJYKa|@^zn0S-&P0cvM9OE zPRA;g){F-H&J25!q)E6e=Tl>?S-}J-pSN*a&*Njn>tI`pN65rGA|&K)gtr`JKv=Z? z7L=IeAmI_RRRzoQxJ<+q(JctS`SWDr)evT4gA=P& zy#tfC$tg}@Y+4s&`&)VaX%P_K@0U?F$z&IG5MCsJZ3P2lpF(gF-DG82gn1tT<~lrqF|yOcp=%TTGB%q0>@)8l3txj@_=FN}v=JYsfP0=4~9HTZV*D^;O-Y%7lu;rsyP36|6+x%w10ob*Z@szhlw% zLuRr6MhekT9vYVpYtwAY0sV>msCtn>t_i!vskxik?DBP|mFBFXxBcA_>t4&ti+Bh_ z0ae?m1!A}n3Q!-$lxZa%UYm4<9flq@p4)_NVYf47rq3@}N4tecDd$&HaP+ifx>pB* z5hLAtG%K;O9HUIB{Y7YsPa8V8C3sYb_x5^PX|uFc$rT$UvlGJgOZAIylzG~0PSiw% zhJIDF>d&~<+}cVXXHhYgEkgg*DHtI8W4KdLPC3(+E|VIuJeE_~*F5MvzA>opaoDXp zjnF|u3DfT*E)CeS6mdOrHjsoH_776rLB_Wj)859bbnBu~KqMI1)9%0rsCMLUp1aPL zrVMJO8M;&%R+;%53ba@gHMUPTrW=!YmwIG_`3?yu0r%4-I~>H{z9Ox8hG8Cicw@AbO|Bg?XECkcT^${x%RG)>R1u|t~QDf zJL(-u(p?3RaSqD0$PY>%MJf408%q^`F>W1zrJg8a?bx$Bp&dRGV>6BMxdftv7 zlI^!>+$!R5SXC=ht#MSmtnD`v1pny{ztON#-jTQ#oVW4PDUQc3$aVvjxBy+EQe$O% zrfKEp*AKj~%Ch-!tHzB1K_GY_ieu69-V7ID_kHzK8t?*sK?`ypW5zD+2EhRYmA$BPn0UniQo}7ill7y7M*Sgd3%$Oxe^x*uHyWCjLkkH006CV9Q-pYYg{b84%UnTIy zspG)SYNVMAuV)Qsm00CU6PB1Y+x0qNFO}Hjh~G9tznkL^_{J;xV3YrVIe$JpN+jcI z`u1_N-Il<9owPMLWb??0)P6n0HK3xONB}Z+NzrdxH?+z5Vu`2Oz6lLl0V!q5@GX_c;f~m3u)J`9cVpz2eT4T6w^uV6+Ae zwCJJ#)KC;g?2lJjWmC8ve=Vo{>}v4IeodvlvvbhAMStg$axHV-p8`wFZGljwXJ+GC^}Sb9N_VOtwY9v^gBf{TFIFhTVA@SCgXDC)@l*^% zS@w=xx3TuFU7kjE6nz7($}V>WO^tSaExTFEJgJVLzMdL+cvg2xd3gn|(p*b$-{32A zG07uldb+NrAR{1pE?Z;Fbn39x3JDXgFjawvu{MhNdxp8j3%HGlpX#nbo2!wa@>AKw zEY~yaTCy2NcmSYqt7Ar(mnxf>8TUsJ`R%dZw*>IH@xdx4=}ckGtghAIfQK?0sExAg zgO;aFjJzNl(kMMkhebL$hB%YnrVAT2mdis)_IC~nQZ-6$3nDfth{K+Z*{k0hI~dlaGw7FW^{gk4a820{Ve`;(g~K#bHkL#bAj9=VV)BL5Iv zKrc=ufw$ycdufHaPeMInTCdZ_Xn-LzUr>>e_=4UP=TG;HN4meLXictSUecEen{ z9XlHdeJn2@EG7c=N0(dYk7~;URywuP-^S%f`}(>}exzLUxg);Trz9n1> z(2wmm@My_=yQcJ7HAvo4aXm1V=VikUBIJKvQo`xprx3?xbPY$baO^|*GXujQ%F4*a zHyrwAMi9wTv(m zgHC0{#e4NjD_CJ=dRwE(Z9*!Anw~Zbx0lxR>S|cgV2AiE?uOBdSP{$9v4wQs(LBvT z&f;_Lzo0Sc=3f<11;rr8P3(DuETw!e3JYAJAjVYWJd-muvTREPkWfU>5Yy{V51YS# zmrLSxoFGJi@s;J~YKOQMh3XY)Ko62X?9r^(npm>v=81a4W`dr>rGgwINHmHnOsp5> zE||ZJibA9qBZE@QK}L(JE{@_0V5*>Z6Wy60Y$T7_Eu$&-A$C-dWV$0V|NPAuQoJ3&*)C$~tK7;$ztU}w3i$)0`?xl>*Cx4U){ zvN}tK-W~0yzPgaZeU8BmSKm8q1}7b>U`X9ynt?MpY$67Ce?B~LWigP%&vByGK7Omk zvGqE1sj^~?vp2?C@#KzqYY&)6AlKmH=vw4M_Gk(u%i8qN`ZF2S`s0_1&DOhfErslI zPLk@~5~t|(n#}wJXN@GEV=e0g8$l0Dq{6Z%xNK{>n9KfSU>}dN;FjbS)Iw0Vn80O4 z4mv(9j9~K2c{q=K?Ov>3KtM)y^>Y#F8|;q$)OB_z>OY8S`Wnl`m2Q&kf|dpO?!8Y` zD9gj(D34~O!b2GA3kk3%{TM<00)qmeP)5yvd3tF0{L#?f4deYSc0Kz#+>5$|iE`jT zjGF{kk{?Ku;J2eo90uQ)jAmM3h?ENK$DIaQ=!9S_1a^o`wN9}aQ^N}8m=-LFeE*O~EmckX16l5<+|5Y$1?A4I z`SVPo19u#lWwDjqb zmE0hGC~pBS8rAq@H>S$(T_w8J#rC0mmqH2naN)RdZ%F7lqZP!BE>I7Q?`?ow*zDrD zJNL%B(q`F5s7{uirH|XqioUdhye;L$q3E8vDDJ;FlJ83sIZk%vcmp>wPy5aiu2fOE z{b7OKOy#!DTuT6Zd$It9!0yF#*LXFwXK*)F&uQvho(G>v^9N&bZuoR2DA5##99B#5 zoKkG4;C!8fHCBihc}gp84SV@^B|Sr2kfUBO=VN83m3X@*!++yp2j&-0c&5g2koSj` zW;q9u^GRHs8M!|g#U~?^)~dC$CaJTWrwdA(=G5zNKT{DTW|B;2C$tg$O_ZBVdxWBtIBZBi@@c&?@N~a}AR=_4W*lt%wtA z?gw`3yYaHd?ZAfa^>+6rV!ZLx8@+)$ptx@UuQdo7WZoCmc=UTWvP!RMlx38~qOP|_ zpvQJ@-1~q&=XGD&=aVNJKYnQIMAn7?y2Dz_&f$hT&F`55zY4g+XYvVIPuFFEJ{_;a z_Fen6(dgE2t``epQS@DF+}RU&?NC+ymd0((8Sd3Cs0(O}qhk?q#*rM1$oB@42*?~o zFg68~8Aao&gn34iVKl6NsJUv*af?HkqiEFLPZ1vz^TGE`;Aj0Z3F|j1_vXXA%1%P( z8<<+sroT8K%l^ipXh#JShnIMPsK!*gjT4GVs_VTF{4_-IxGGus~kwD zaaRW`a453v?7%PqpPVy<=~ROjJ#jBW*^L>J=3C$DbT5e@pJa{sS^5Uho#t3hs_&oX z^UzI!o#MbellZN?$;IHR-tADm6Vd|` zUMaS0*{tn%S?Q2EHIN=kbv2kSZMZ_$9b8;^4GauwELX;>nEAkT9~YljhhFeo_o=I= z=+#P}fZE0XNHf97#N-RlkYJms-({j=WT3t86VUw#-Djz41UBH__BP=rAm80wjTxW; z#X8N4xw$@&EeGY^1gK3iXxTofaT)=26@tvn{yHOwc%*Mq%4=Wp&ysM+8D82wuJhH- z_WK!m%*AKcUY1B1+a|w~r(QwFr6SSlS8_J0Qf@BxYB^Zo@>Qx&!&WN1N;!yG|WMB0}XykWMzezF2qpDtZEix}MXq z9aBBF(i?I7IaOoJz&D!lNUJ7Hu^2WP=|f(m5s%GrLaRfa7~_NTjmQH#V$Gp3)pQS&{j(%_6}iu5iw!y5j*{rh$oE%sxd z9sN6a+d6A0+#@!5BENz1tZTB;6&6kXx~tC4T+EB|_P|oI`>VO9GPVn~)ULN8nY7wf z+m6r73!A*3_JbjJxzlUbgC#daHrD5H5lh58pvpj9shGPII=9Ob_h5dG`jBd9rpc#nvibBG$XMI@ zU_|W3cef^=?~FM=bS4<2i=-pu`9^|tnhD1zU*ZCgT@w~JLPo%irT2yy9t5N8uTpRY z+ym_j{0^NsvMWsK!7ogy?&oo00o5I3isk@Pv{Z{3zALD^d?Ukn<{qYxA)^W_Wg4ehqgP#trwb}&ax0R$%d z1%C`>t?GBSzt44{LVg|6c&Ikh$`)a-|fM+H1O1dT-72?D#QzD?S zeIw8HEi1Gs($z5wIog)*JLxsJ-FvzaRcP>PfqK|psp+ki`BMl3CnHL}Yho&FYj!1f z?iV0nuoX7isAIKym!t{Nxl6>g!>3+mh$axmXR+|O%TTV+9|^vgfW$Gc3br;JsO`8A zNm@@*XnXz4wM~+98&5AiiA^7*VAvORZ{R$;cX$Ce79)wjnhBf-2i-{7~(V69}qmUj$9G0@+2pJ$JFQz|C9n2sD(s7+O}@ zBwlSI*7S^t=PQns{!N!N?>9bvy_98)Qcnf+pjRz_o`;=W>m4MnF$oZPEYmRr{fym+@k8ynCFa$tqwDkN>k^^ z&%e}SVsvHfisA0*nrMMCkv>nssc^}RRb`tEvV!h#gKHAjA0!8E^rhdgup0N<^2o6( zq5KxE_&{ELOuedVi%HSX8_VqjF^5a1S+|bmS)6DP`O+AlT&?vR1pi>AG=0PUtR%@P z4`m26_M#rHqv8W_oA7DLv@M*=pHb?${h7;wm#)jBMoBgu8j_SsxA(#R^wyLK0FKG*&VctW3jcwPHf;Zz~mcCNrF47 zQG7UH&QN@wK{8r0%TN^7P#@S=@jNmLlC>w}fi@$b-kx{l$u#V0pvcIl0N?))tV4D|z4�mjxYfi%!-90c=ltxrrywl+RvKUTq%^&56v0ZV zQKH*S0|rIMwGh|0-OTroX6n<4M$FRAcSXw*(5E}Dk%9W+MlHyLL2fV}{(q-7&iT-2H#c9UNU+AnOVPpMIm968+lc!y60ZPs$Fw}*za^9uKt;O2 ze_1H0S?hv@F3~3<7faE@{X&y8V=)pa4Xpn}Y2bmRDg+^wBM<+!N{0O!Bi8Hne@C22 z{`aL39#QBFnE#FjHISHw&7J3~s$8QC{#SbIMWBX6DnJ|PmWNmHp^K+L0XjUCoBv)r zQC-cb_)e`o)U|}?mnzBZ<~mB+Lz4#?U#Rg_p!3CH&JWlV6Q?xhe z-mA`buI!|&0tKk6a&O@P{dy-LVgY%mqACz;R+M&Y6WFb-pX%EGQu7So1-h&&;M+*r zH6!O=7K9Q0Cu;n2Tci#cC_r`a?bh~hLu_4p3xPazP#Nfe|6v8M$$otkj_b%siU}~# zf6wT^NoVp12H%}{;@}0e9aL;IP5*axo!QdrBiJvSm%o0v-ZQVL`U{iI-rjz9`wr!8 zJ;aPEAtF}mYD5(A@Blu6=h(T11ISVori7Gnpa`f%jiLA@kPEsJ z$PFWflB<7FDEZGSrE0qqV&Gc+Q&6 z7-1ux3Yw9BOOq!l2zZDVSDHM&zvfwq^QQneGVsQiD+wjaHJKFcdZ)@KshLP6bansi zp9-M^hfppcdgsrGkt_WKRc3QKSD6Tye)2V-h3-t2*~T9%RutKmNZ>{)F@XZK_;#(m zlUHI5|MD=9hpy%UC8o;o=-PYBz##&x*MIz_^)Zi0=ZE3h+L;PBgv1=u-HkSkQ2zYr z2U?3Fx(NlY)UBR!%m4gYKE6D;Ui@VgDN6+k(A8BSOa1k}NO@=>wv)ZOh>#v%uZ8g- zQU3KS$N4N;a5oH#_YF`Mcq0!%tOh}k@xOcy|21KzGUOWxx`Y}1$Ny#>Dj|)CvhU5m zBSv=nB|^OtBO}2dGCmOQilKi$+%21Y$wNk&vMhcDCElgi9Rz)aAfTx?;ma2Ss-Ze~ z?xI4ekL$SKhYIwuSeQngs8?a?C&N`TL+|6M@QEpam_`w9K107e#G>$5tPfa00roF% zL3}lT0R8`j!Id z0l3lt>(IK^iSsLLi(Re98gdH8!M`vCh)d&Dn!2Jz-5?)rA4ao)8Tb#k!^+zCf7pL}BXW*KW7p^+~>8K}rb@guh%Pgk% z#{+NU(}@Gp%r*jRuzAs~V)`M^S*uzVErnY(CzdRs@WK`&L5`BKYYVjmDVs0h64sik zTuGY9WAZ5ne8W+{p!{eE-f(ZYp=IHuthC=lQkKKiiHE5kS znQ?5#x^oP!Js{DYnx1i4rUK=fh~9l4dSY5CPSBzfReT!A(p+GESiAonko5_r`QnF5@E?~NaWF3IG981)lcrhB6<8ss*5`={c3baUGg+f+^V=o{-3mkL1xj7KcaO~aGNmd zf<{6}X!rs@xG}zLdT5yBZ*JXc{@mvHjpc0vG1@}y_!qRa6x%eN+chRaPC=9S98#%g z53JDJ0V!OeEC*Vo#aaj35R@+#R=7kxSphdG^?s_luT|&DB>oDCQr9gW!WhO&cEKol zKd}#G>GC7EJ$$pLHKrHxEp+hi)XP;tu4iayG4ju|EC@~)=4r{Pcxt&1Hb*1B*?JA+ zDVu5571Iq()1tTkhkQ>Js1j+dras$Uo;y~-M_oY^hEr+f^&b3FSc7}x&zn}$0SxtM=n|4U#MnU?%1t+sgVB~%Q0$~k zVt~?^@Db|u5P)e4j>NRHgN-tw5dvhgvZWkHAoZDxY&;@YkFEU(ROB1FrDjLkPK8?! zFUzuT?IPROSy}`tiJFrEu=E zJ(8!?8+vfQS2Bk;P-zC0;j5Di-W)w4>hoOiFu4DtqO&vn!}RKw;RCH-?2P1KaneLV z=K7IAjrPl+bP%h+UW<1_`xDKeHLy<%<|9a+uB~b(X?{IF$kE@)&T)xV&2b3j z$$Hw^5SsXh#Ek);Mo#dEl!VLmC8b#K(p(gSOqQuKg`NM`AYutph%YNE=N=g~yja?v zjE#|Nrz?ruYZcyM@*GJbsGnj^YL$v(X{%67V~=W{C}&9wqJX@}=hqYi^khGZV9hco z4yTpOrDf0d$j?Q-8>BS`9V&o*MrOD3O@vPF6UtDIN~E^KrCQ$WlF#GSX7I}_RdxHH z5FR?Bd!t=I)|UZAKv?S}TPyJfc<5Ru#8}IW2eM>Wez?1(xmzNHj;1t%l8n!v1MNvF zTrZKRiO>0{&pR-FWq)N_6QFY?WUlpkPq8Stqv8kWA=VNuBSpdV(ab+e$RF7LOu63B zl)dB>5O9DV-vvhmrk3lqG8G%X=2R)h&Nz8}ZUx=U>PkLO_Lt9;IO@C8!zTm?HcAut z;enCxx#2DirCPgJPK&uum)o8a*AaQDox|=u?FBlGcVr!~o(P*a5SVC%rEFv3Ng|jM zC0S-D1swwPV8cd!uZCkAh%4wFMsJemBW}VI_3sW}yuke80SNay>8=^{baZ~T(2dm= zPCmZG2h7^*wMO8Y3Z*i`E)@NzhPMHNOFF}t#c8g>yYvwZ)Vp{JItV@3l+8fv+6?AT zodTZjY3$qI9KfMFCjP-Dh!kB8!<1@!8!2~(TLC@hU1KXa&TZ-d?kIfuOb%V9(T@#q z@B!oCeQTi(l5z0oKo`2K>k$Q!NUKbcigeCwJ!P)t5Tx~Oe5k9+uq@tq$y2WK-^Go2 z^bBU0*slns!K`U25j@|NU;&BjiJGl-e%c#<=+_X|n+YcS?FzxI-^&R`3@jfqmP{zd5C9=kbl-?jLy zp1q}9y=d);>Kr=`%X32Mq>$w-X~u&$Ed%|Tk~<-tg5!_#$P&-?cm-;mk%Us)uGp%O z#U7ooIW{UH8lY!|6ypArThn;ZIZfy;B)BS`KJMkf7k;W7`TVUYujm@0K9QRsv7R^f)K=MH9%ty zG=9KH_qR5m^#f@LC4j4}Ce@sLz$hx=RF|klg4M48Z(P0oY3US97#wCCEc3P$(z?O|3?XF=3e$(_CFWT&0c=_Y!+~MUA_YMEq4|J7rn88^w zK#biu2xZ7p3xDab9ZG?1>mLzN_IetK`YU?1bwtA)7P*t2MohB@Z+TaHL$6qGcvyve z4rIV*<@&thPvzs7DQ)Zh{(X!PG0lufw0OwO^+2HZ#)2F!!v1eL9Io15ayaQTIoxOJ z;LkZ?7gmRyWlein(ok$@BnP*L)o7MssO(^~AOT!5wq_}Hz7V>T8o6~Y9(9+yoSn)m zMYN!x6;&>A!amyUY|V0T$}=ScHXXD$B@&t19Oh9g(&2m<#AY!m*7cMP^EqeS<%^Zl zj4};q43;a-I|>P{m3_66zdG^_Yo3&xRCp`%dYmscgFNCq^9f-dVkRkaGO{Upi48&n zEG)#%^6+7W2(feEty{Osmb37`PD(~m+Sj8JF|f|F3m}0U3EGb$kN**tq>&rrx``W`F1r1pT6tMFG0Afyy$N} z)C7_2>)2XBav;u0zJ7n>JX~$4ckO+zUvfs*tiMQy3I`HdnO}_ z8!rOc&okwD64U8G^jA$WikZp^NSeLSd4^nVvGs#MHZ%3!gLTz@)Av|)KGWo4HaSi> zH0r{Z(=@+%8#mZ@k1)G3>lO~J6V0*6rIRsvRa-}Qm}S28vYH$R3V+0(30vsq8D{_R zzfrwWAxL$&zo#tmAmq_3bVvsA7=blKn>zwDK&q_PbEX!0Mt{_12>;&rMQ%Mr{g3`E zohc=rro|G?cE*a2b1Oda!WhKy87FrW`>u2E8vWtZ-Cm&cdo*gI5Jl0bS0Bgz(-$`+ z3m&rAilbb=G=uyo4unKo=ykYT#PRU@ISp759q+~`Ca`UTyBwl-N2`tvkZx|L!=mF} zzQ(6qGcRM`Ilcks7y@H#eja6@&ni=nMQMUA2UVQxlP3`@9FcO*(1&BS?GQ&Kx2;8k zFviuOd4)VNMft!&dF7hw^mJPo@%`nS zui!?h`mFN=1>6!*R_W!TA%2eQz_V8T;Q%qXT;f8uCivD_o-58*LucwOz>`z8Pcu=u z_Pt#G;sS`x@ko>EtZ57FExQbt+9q)18@6R}kG6LtQmf55;1f;>=j%7C$KAZrKh3na z)!oa9s3H*96Yt1!b3HTYrZIoy|79vp1?gkC ztvsU1Qqi$H22E28{oQ$Ua?Gse7r}gPEjm#rvY&w$*$I<2PTk>@Dp6_eEo%2$dQ}Y0 z4{WWH;S8R@@v3QdHBzLDmpvJ5mceiI9W%x0_H8*ff8NelzwDU5qLSyhQ+Vi1#k)5Y z?OYNC8vKM5GE$wy*BLF&Xg^EQ!=prM2-?q2;B;nPV;ccdD3S81y6mRw@!n$}iM!J7 zS8)<-MJQy}#%qfB{g+T1=1aD#_2iQz5QSSzI;+36;^*Lf+N^!un_`oRZ<-`t%+P@q zfrA3^t`FKi&@nfES5-ILTMqKzoh83mWW9icLCh0zorvpKd`=|UC}apkqc$+=HMD)i zW1`gHF^CL|JGFhia$%F{VwC0KMNh3KKwx;Xrenbi|8{v(O@AL&^nM>hDnINM{@19U z@vbv299NMSM2=q|5puVzhJ5lJn;k8#M!rSW=qQQTZz`LopV=aEWdgzB#b@l@Fw;KHWy*DLJxzwz{_odD#cDA2bcP%hvPFAzsRf zy_!R-m(Oo_Ysx7;&m!}UG#D7saicAVEzQowmQ!)qjWcrn-}F@F8k%1=Srsvm`hX0Q zRl9yvJoJDEJP(*e(wctv!&}a#FSaLIdY^Gabw91f%BWJzZlPmdgeb z(NFz&pO3O^13SAbR!17yryYm=eCp!F!t~tN$&p^I+@{$?s(@N|edy9*-grOYyecjmV6!MR)$BK zKSJT$8P)A@G$7A5B8#rS{Sna{bdsXqv041|nkgSj4`JG0kkz%H53hOslc~v~3C^j{ zOP(7v_0FoBD;IV+!C>L!z}8UVjT_@D{O1u!stUME5)~@eJ^d%+du)}_lfg9_wTks( z4bj^VSJ7Eac0-ZJz6_5N?YdY@c7f{z%W*~mRaeY$^#k4?rDwEBl^O;yP6ft*kx%d1 zH~S4V)*1e=>!xrkw>~T}zg)e1TrxyS)jDjcC_wdosEjgnrzh*=eeK7{AAaAq^>yWx z1^4HznYG5Pjv+F-LdrzBu*rOIuG0Y7vbw5`-#17|)Ra{R8Br3v{6mMSwa*!+?TN-7 z&D8p)M)6qF3@hebV7vCMR<8lDw6L%ixrPx2%c6x}FG+Q#jC2nj!3hd!{emi;$N`<^ z;ftk9RHE|f`qt6!^9_5LJ}HUVHQM5CMNA;Y&JUBYvhBa(Q7UCA`)#*7M7L^RTEoyk zo$M6+`bT555q*ASi}cyq*{H7dSZ3CvDCxH9G`b3Cg5-o{7{$`oW!BQny*ig6}<_*b{PqkPKeKoxlwE1`>tmbp; z7$Rnq`R@K3Dm?6dC*rLA*8tRp>%2dFijUwaM{Rgda&xo2B*^Mu`%#FStch*wCT4Ft z~7X6Op2*uq&& zhkgkJ|4~cb4Q<(Ef~av|y;D^B5pG3(`V>>7&SZJbDuergX)jQLS}{ho_{ZM?#w7l_v)qyoWPLJwmfeA)pLK)Smx?6DZe#x^Fvh0JZ(4ZChMW+So0C!Jonv zfYJ;f*BSqJ_~8GIML=EP06NQVG2sfwdq#InM?Ph}d^7Y%ZjVWgS3RlIZ8OE`dVE1B zf4<5Ov8@k(4X5)8883K52G~r85>k4W_87*ZMC=>~Z?+p%bLn7_`G)>%_E_kpnL(9p z{eVYVy5;0^9Y~j9ep77#^SI>Mg6EUWkFSMAcwK`veoU>A;gb_xA6-C(-QZ(~H1ZlL zFQJl3wxY@ZoU<;Px5!h!%oc~@YGW)v5G4O$WUB5vo6+_ypQrB?@3I<VQd`>Vt(i~i9yC58XdHJR+6>6#kUQA$ZjNvUXQr8*hr z+>|{-H_k?QOm1O!ueGw1qX-qfM*6hB!3+3;BroDo{!kJF9ocQVH!9$Ln14B=_Ur8E za6g!1m2$@MpO_|%hv)?%n=Qnlo=%6!?C8|RR4}>s0C(AdpL1roxRgg^cfOcIAp}EM zZLp*7`LA~LmSCne{Yo&f3g}5Fjf0j2n%ozj(gpd1^Td9RuiMZPtD|J9RvzyY1wJTy zT~2>TPG81c5yuir$-#05d(z2Y)-Y;wm(8|I3Q6;k#)*%V3ubgg%DCT$2_1i!B+viZ zer2=cgQR6sy-oSyRu|&fp*gI3E{n^a^2~fDppw;ky%c1K!tAv<?)THZ!_^gPlWOTCbga*F)dsp@HvP#~OZF4~nxieaf_ zJ>-F98Z2brdPyoFe@pFdI!dsSRk+m9y~d_g@Jnpb>MFI^dPv9oP#&E{_>5lVUD?zk8I7fIi`OzTJtX#+6$n7tJ2Q*I5K1T9JY zqOIqvKQ7ZXXB@3zsatv1S`l-eNM!OF(uC#sD3|xcqPMSa5_DNb ziFyA`jZ|9jEALUHiZ}`mr;M`lh3?<~IoKeF1w8pqDlpO`4jW66?l7R6->PgyqAo9x zs0$;#jB>V0Hy+aV{y(QHJU8CjCdQKltYw|r>tLBs$U4n;6Y20$NLsdaQNPZa4NT0E z`1LncDjnFt;Is-``#^EDt%?n*QtoiwrW9OoHgR1U^EB#QOrSEY^Ux@I^;vtsCKk-@ zT65x~%g#5Vo1}M!6fIq)8by2}ERC!%WEfUiCekhyEbyNDW&3WEHLEur1qocQ?y#91 zeu5H7gw1SZvN*+ufZ6JSbB;BqhM!Ym)1#BZAP@4gY7N(&$cqkZmux$eoRXWMzm{z! zQY-pwu~Db;64Ha6hGN(bWF;0T3p*Bv@;%j8Ldvn?4xd`=W%({{DWqPryvyG5_$Ov# zOYg?zmHSuX=W<&sCbJjtsL3csz2q97%?Vr4gN#VIz!*E);g8~)AifKGjv26{<1k&- z!}*0s=HEWChxx}x4sxD-xP=TI3`2`GY@>FO1GRaRD~-0YJ|CUDJTM6+_3a`73&5dK zu3gz;o@u}c6jL^+8!GgjYs$|m2v3h{P3qtI*2?!s5Ayc_j@z_aR8LU)6x`nL;Kcg|A_0`w;xsdHM(FabwTl#bl0dz&4;cv!%6Bgzn5Guw{$ zClg;aOYw6s06;5TZMY;anWwz8w6=lZ>!Ogp4WPhY51&&?-=S4c*hy-QGa0m5JqTxY z_O2!OeHA)9=^?DY8qVN+0sK{c!h2Z{iS~4YW>_F2L~`io`o{@bH+DF<}J>IXt+c< z*sMs5X=w$P7_wx(Si4{8w`2_CB93~$xnKgyes1f9p7CPF+%@noPAWw8i^+A3n3_l& zmL+3dOd;(trjt*(fu!?`*DW5AhANf$cBd;&plZ!&@41%i+|dx25cZ=YN}nuIsw3WB z8WgGaG;l>t_<;A|!)>Z31}zchj?Qf{{2(Hho_}u|t+GS(Yot3*Eb*#`?<&lk2f`-) ziJ7ot_@$##W5(lc6C{@CI|r`9n=68c86l{$dXA$A{wSaz+ zZNu^=kVH09u*sO7nc}6fU=$vF$uX`97ub8&F_PsqA!4Z$K2!5ieRyKOW31ZNCV!($ z1X0J+ikeYq9~$Zt`ul;-{ZeU{jG__qbv4wWT1HZXfd(Of>8T0}^Cwk~M;u@3&66|) zP!t+1B4ve+trhCUjHE`u_+n-13KEp9~wcHg%~T;<(Xak0mz zEGI)c4l`SK;D(HS?ly<119Eun^nOT{iq|(P=a^Clo6XE&ez5oEyaO-NdYWA_l0(7z zMWN~NY>=XQy?H{(Nb#GkVKoQrY2Q#3kvs^R(0hgTFv)p8Noo&O+qL-sw~?-i zqKujho!wyMHtajn!>I0p$z;;3@%5em%p(hehfC;6(B)*`HybVyLd+Qfu+jrqf z&XTevX~IlU=pHdX8v@_ibrr3!@RmmfKODKF9+Q$)ooHU=!VZ&O0hZ>;8SIAnkJKNq)tg+y#cQ}iOs zzHHzv2hWvIuhQbu{&L5a5l&9WmE#@zik*PPrckEJjnOHGLj#YiIKQH`!m9a{CiVJFR%C?AcO_<~weKIj$3_QAZpWZl7*wMd}!c~_#PBM%+>-sAk2!=F!bJNVMe zDn^`rgE?N}ZGi7*TVIY2Qv^r7RQzIZHnBq1;^xkv7HalkKpkp+#sY+PH2xh-H+Aw>8bz}T2SfTJvh}`E>HsiX!ciEkm-(}iw581nPuVsc8Qc6b+;Yqw7dGmG4bfif1HcqXjUax?WJv**m zbFfd})=1NEd7%>96Q1Ex#}JK~j53me-V$RFC7H@5y}w*yxsyd(AUwU_(Aaq( zY*mE|MMHS+1EXM?+jw*R7t>Wk)Ph{r#>up|H0d%+EHkiiaB3y}_SUDm^VMv^5=j+V zFldwtyvZdZT39%2dvsmY*c@{r!t)oavX5vwP;(~BO4NB4oR z-@ncsl``KF-e)!D*|!~GF-br((9PnFW+dg{JE4sr1tAjg6e2nvP+c4_6#hj~%Y5U-U{bBVh{Pn$^!b(Qjgr+TIWoo+Z%C{IfkQEByF zRw^^ra;C7odjX-SHPfUXbam44vp2R&#&Tib-}aVjV{%f`tx|pO$kp%ai$8tAJ8KKrl&Ai^qzi>(Sk$?r6@Z_nUcd~*Le#AGSw82-XL<-_u^{+&z}MGd}^ z#_l@Kq2Q508^F`E9RfCzbnHz5{O25k_z8{hfuIX+#(QTHhS<{_CLc`nK>uzOl*GMD zPo<=i057paANr~#0Ikl~X`!{4G(2on)SIC1e(&uj&kVj<;Kg5c?;hau{5Lm$6GU2LEhfBG21@(y2xr~0m1wNl? zWthhg-CM)d;YFIi(>-%SkyO#xR^xZ-8UN0t*R7Q-H&{1MbI%-I5Zur*cgO< z1?#5OwLi&XuV0^>20X<9oXYDcr~iWwaaEXTa(TEkPrn(T!}XYpSMM9p^#iHo$d51mqzuNa=whE!TAc>(mNXY%qFBGB^L|2?uKvz8G{t%T*U(}XKpLZGk zjBT!S$~MQV6Uad3_f{vpIUCASztVc zC69EuA;zs-&G&-k(mSa}PmIKx51FQ#9bUV(P8X{M>ocp~Cb{_2q_cC!I4Gi(KNt10 zKrZU}G>O(-ZWXtvcltHwMRd=UMuW)oD}_=JSu|K7UV=>}-rM8IT|WYc``Wnit`r{B zAFeigYk_uzA(Zvx~CI=2QZ~iiwh_i-4zJ z{ruhL?phxLIq-AhLgg_Zzi0vp;N7}jr{BeG#Hbl3V%zJ^vGc<9n|k9XL#dNH@>8Fa zf6|(6%r^IQ$2t`klq@oC&5P${j485?7WXaj=Z^0>bS&1S=f6Z$OOE4UxcxeC8RXBE z?y@?H!YCDq6kDv?$#C1xB_AVLnAhJ0|6mNhBio0}z@A9H+?Iix_5SMVV%<tkR2g&m z(dk<2!dhn#fX-(Ui^>U2fjT(23~R5E6aOoirp3ZMzDwr`8YWQ!%rc?4%28FjrTpwg z3z>XHm20X=@g?S!7X&_i~93$NSU2h_26V4ZctMC(48stw%9-dxye7``KS1I@Q0xWVpXzTvVYfIv~2U$9ue!Rz& zlUL35N^_-A1-2`sl}JM5_AX>UD_y_#^0>XnYIEq$cE9G0#mVZlL9e5pfg)$$0G_w^ zs0b3yHG5N&^e!GbGMiRTbP1Xpxl2t-z}J=Dl{MrP=88U=o7BTi6T#zTLBMSEP#y<8 zjD;|jH0Fc8MpC*hae}+`$*qFB7tYcwU%!sL{FjnOT=5bF>g~RZaiyq`0(&y8kI4N@ z^Kjpmq!0e0Zyx%=vwknHE#ux-(=dqG!8N#e_H2D6LrOS zLR@mR3x~k(gPoO5ASKUE)&~H$OY)&gK}Kth+%eabB|7RX>8s5yb+NJ``Xk++uC8zM zzoT4{FL*`f{GEQlo$ur=A*FOn^IWq1NTo=sqEY8+gC$?XIk#vj!h|hFd^oYV4&hgu zuf7%&%pHE{ykG0?kTt{Aad}3l(O$PG3ET)@8b8>P5 z*)8=$ek*3HC&FvI8qESU1)zb?SekpfF{Zt^8Lh*>$LS`upxl<&Bnr17Psyv?!Rnai zzqkMorz+$;#_^N7QRz;ud^~iZCoI}V(W~EP!n9ZrR&szWqWzSXx?{8&38`~o*rXS2 zn@5V3f}@($-#YN;dc4lnz@3d~TOVEN7qA-BC-W{-3D#$QVN7Y7BCStx;Jd#+0h_7Y zf-hG%|9mq(*{pp9Mf14hb9AFW2mC9qTce^W++nhzAosnZd+tZf9THT=)05#!;R`22 z8@Y4dBmbjnT?6MytI|c7oC?YaNt_iDGN);{wWz3K^$l)r9c33(OKp5`=%koDyHcLL zZ3v-Txiw@iB%`bQfK5ifA+UaC9QZVXlfCD*=`Jqj?-WMLFSQ%&@_K%r*hH;-qTNw> z5qFUHgsc8UKBG_Ix1m2{j8Xuf!{rIhg*FrUoVanEYq7tsXC1f>ib{_=_H;GCtso!K zqKUlnXdYG=)Z_@AUHJcNh4V)1w!{7LwAZfLx2tjBiNQWmr;38V)ihJ>PR5=@(CDSM zj6Em#4x*_@&KCY15mMO6@(|8M4?3I)oGNpS8y_07=3EwY>SjSqX|*}~Y@pPZPD5g0 zYuFfc>w8CbPaMQ35^xrP0 z`fr=R_215(0d`d#WO3+f$V_4*HAvu6On$E~3AP%A`omASjb>T9ur)J}1hRY5?tGJk zq~s@8{@k}Q(a4jcYz5_cE}OLnAi=s>#!1sUo|+j~N?lJ}IP6wq8f~H+m)Tu13!iU1 zAd+8-@n{=DIle^AykNSeCQ$f1Tl3`=$sy7AQ#1{)2qu*c|7%VwQ}`9Q(}Vuu1QkBfRO5lTDSQ1tttW4(C|MgK)1zN;lr zJePdddIRjQbiv&h17=Xaj?V51GHd#*RiFOS%kJQTjXgpy<8Xo=)){sDg%iDy!d;b=%)<>Vmr6hv@<@G-S%B`pJX>a%^ z_21zn&qvs;jHdpUPb*z~bs>>veZL3dG@Qro-P>yLD5`hp;+cSx z5B=|kReOHoJwz$zINel(q-dyY1hG%;p#DulnsFu})ucNuY&bze`i&N<8yIah{s|7} zI*rt&Mp`ZWodK+3Khu^O^mkaf?#(_&N-sLKv-T8e&T*#S9LuIZHrNK!ljo-ytN#(b z_$y;I<1Ay<7ItJ7=(+tN$JqW)jaDoqhh<^{|tO#GY)z(odHweLB z{zgzd|KI$X=z;6Vgn0YKoNs>;;*+@G&*0jA@h2g^=@X>52mLD{UhVYKECp?>#S#cO z1ALQL3D0`M|Jhb^L*9(P|GpXjzi#TcV zou*}zK)dVxcUpFk?e$^hf2C!Exd@~dQ$uR;Z54i?^MehEHb5azFQ>hL1$a^MZ!z`Q zXN&H58dELp%>E|Zwqk4Ndd{2~xZ?8-)Rro!k=nhLy2Rn1F6w>X0blVME%=jh%VFvZVrKD;| zU26xkK1!9I4EY#7m#DYFA-rMjw|W;DkQ6VVeXM>p_Je3uddDkNYc0{dtqZm4i%iil z{-(0O=+Iv7>A&m$r)@Y{*7cX{HNib$a)e3K?0iBtkedGUmg~ohah)l>03>pKU8{@x zw!&8$!u^gTSD+NKhLV&e^x`$kY0OidVtxLJSqczgu#tPx!2~+t)E2c_b;=d%8JlzP-wR{O8K1&5pX&@*;Z(u0oo8 zg4>bfvmDP4hN5r%`uCS?=C|7K9k;R=a!F3qq3;+raoexomW;S1GU@~gY5J&}2d~wg z6ARKlcMvzf9Ch!-q;<%i4=+vc++tr6l`DJEMrEFARbH{^Pfpz}K%UTZ7l(aIH>K zh58GMT7?A)Qc8H^zex%Iw-;WmrO1g?B=~!Skv!f>1jHppXwi!xAFf8AL)CXfg!(@` zN^3((C?tWLESHeT42LKdaFqK(L#aQpnr*#=}NocT)OZG^F&D1 zQH0fW)99vf<8>*bWvws8cKzf1x3LqK^18?xpSQpB>WtLtlK5PC^7+XUN7;nxpajYk zfSCyB1k>bUiweUKb1NXiItiR;$1jT6Z~e6Ng@?P}72c1NMS3|fa(qtYn2`~EZZj(4@1`o8RptTejTN`*$yyFB1N zwnK0@PoqnI;i|T`&^U6iMzmG=Md))Rnt$!9#%ynx+K?P0Fd{d)WxZe13ROWYIth6whftL8oTGDazf znK|u#iwsRRWKAlSvwqfZRsSVG&oq8#VS)~(fbGT(%kj4;C4 zr3pa1O4#j~$O)mxN)&NhofMeadQ?Dx(dw(X1doJ zqPRKrfIluPrzZVIZvxp8x`urF$%RY#wp7Bd<;wE@Je~jwl;<*?h4?3|+U>k;}jNu?N1MopyniwnxmGWYEY3 zrMasT!ghK29sL5xOp-kyy$jD54-e_QtlcqKZa`e#nR!Q}VfbRbl+j0%kzjCpmNxCM z@({W9WeB<2XIq8}Wwp;)vk2doEj>fL-n3#&?Vy>hpokA^N3Z+Mm$)2i zzaEe2STt)na!AGu#Ip)-I;Ka1mUXnl5WAy8t5m$O0-t;6%lzZ>^6Y&du_%?~ifva$ z0wW?8(Ls}RCrvS%Xmqf^WN=%YP# z;iZoAhK|Gg->m6!hZXrxvf^@o&WN&p|aY+Am%Q+#jLu{#2t$XVJ)^}&m?r!4C$n9tOotqEx5$WM zOY$}1#IUJ#>D97S^F5}U)C3jM6=J15&|_9t=|hevF+MCO<-Pk!_p)!5L0vjo*DaV< zMd(^cMuJ4>4@CVNCA=&$gJfPtxmjc#mG~iqQl#asd}0Td{KC|oxv@A*y%ayj=rtYQ z*gH|ZHsjGa6H_%GLQ?D(e4UyLGDl?w4P;D24* zUp5_flv^&de_7+t9>`s4gehR3mQ?Bn4>H%YSXETX`Sy$9P-S5c93NdDD0Zaly_qha zc=`Uhw<&q(Oqm_1#5wEG1D8*DBee7670PN}y-vCM zT*X{tGxMv}%RJ>8(L0EiLm{WA(&HC|BgQAJyrRK#rF?FOT?_I2PEmNM4Wq6nk$v4m zzKT{>%rNL|nPR$4Oe}p3hvt><-e#vX(vP{MQt^%R6J#q?^Vc*BO9k;yIuawbOGp;j zm*=O1j+QMIlq1f}(Kt7PWS|EGV?(l2dT3qHKSKjdR^`opLL^M+xICM5=oZZu?pFG7 zV5%qu1#vP?CTAM{aTkuR&o`bU&(-uyQcIDJ5Q1@T_4rJ#NEyVW_H^?aR+718zoJHl zIeT%(Ah0l6%ytq`(5^e)?I(3g-!qPH8qpd(Bn zHbk@Zko>ayRQJSD1&F~-T{@=19$ zPRWGr8D%f1uz0v-xx{QMe6KWg-VS*bDp`5FPk?ckYbf2VqxVUJ966`8p*Z1SvWD7{ zpMK!NUi=lCM+MbC7pQg~Dm+}rlIagxS*&SF^@$7LSQzLBy3X8IRNbT2FD!o3O-c#- zdvfZw>OkaqxtT1m>y_P4?RTZhQOHSocKhqZ)WTe2q_Xwf_(}E2#DxQ7i8I?W>T$ z0)Habwa)6zvD!c~@Buf?kW(q+TEs|I)ermel zCr%_X%Lt3~&LopU5};?LTFItPR|bOlXs4S4uPJpcy|+E39jmzBd?bTvbE#kjF*ZJB zwb<9{WLo1rm1>`h3+m@Eb!lPUiNFQUrZ>I;kB`ceA|fwv=nv^ed9FJcxw1@XPWh1s z_Il+$UVPX5W!3{y;H|?Rv$v#@CRO%ij{FwS>3kUevtUg53$xa3?gI&Hzi$@IL;W*m z!}DZ^Kc7yC+xwFdZ0t3-2U19zCbM^jP{}G0z=m_~=|AX9mIi%2+j?x%V|KlUK=f%H zm+{4~T6qT2VW`m#^HlSrm6d58c^QPpI;RuUKt=9<0&RVT>U2WGD&Z_~wTwDugto0PKyVuj6ciF7Jn_N;h1$a+6OZVxQ_c1EJs{S40rLJ^P zcCj4hZj4G4dsaCgg`wnN3s7w;Ge(IgrqWSd^k*@eC0gad@ z@cby0YhIB&xI{$!$%BtoZ`cx;iaH#Ff1pz8SmDy!ahEiL;`b{Ts`zUfP)xjcm8|-?5~JUA5GTS#ADP zYgU`T{G39yp9vwRI_#waqMkMH#$TC=ICdUQ?j`89CDH6$P7&fYoDo^A>a z{PN{jGBP`(tJK!ak3!s#FxmD<6F(ay#`?$@AY%n!qy3jLjy4PgwD(9#ia{}IX-}f8 z3GId3SVjRb2CMB(Fpf$Oy3923uWdg;>e`Y(Tt4Y4;@F79-A(QwQQn+qC{y29!uPIo z6iS&bijVkb!u6Au*?`9w?q({G)KxG*X=RjdG2p_~mcArz+=%g{(4x^{b4bZyt}**i zOuLcVI`zr%1(#+8DF}g<4@1qzrzD&hl6(s~qA}F(*9n#75-A!wm&?&!u8m{2SfODa zzMrq$_TFf1*juI`e3<=-YI{{6&tmToonk6y!3PbKK(yFmIzifFGZ`Lz{onOXhS@B} z(_DIO3^6~jrd~=7>0ZUev~1C$P+|2()cBbA-eEG>cFLyaevxtySp!tg53MOz=w1(^ z*`qv}D7Kv018bVTIr@fTirkZ``}0Hj6el_B%-?rg;htc?+H381Fi~cSmrWG2V0y?| z++iL^R;uq%+qEWzl}a%|#_6*$6=Kv;FPDtym<(+x&NnQ7O6q}O(NCu$ji9~DyN%^A zwl`x(s3~fbtU05#hd^;EqN0XZ3`wA%`Q0Pa z$gCC0Hy4Xf=y;lT*tEx?AZtXVT=DcvsNL@>H!I)>@kB(@uxnPG1M%<=_iLRn@`i?K zlfzJnuCMN|Ir~4XHyl-<-cam}iBd<`@jg})qJ0Ff&lU_B!}$~*CL?O2A*LX!3z~q-n-EY2DcaIg)bc3G7?G?+r?U}+}Lak;F z_l^L!j^Vyp1oekIwa-F35_ePGve`tLFhE1hSgj?I%X+xUqaWM|uv%kCODu`dRn8E3 z{Hnfs4+1Pjb_{Dnj2AX~cJZ?~L%XvsQ~4epk3A`OW_VhUW1?|3~_$f!CA z#e2|tc!a4|?Bp)S^Zd;>-Im3OI;p3NeZ^>GWJe9IthU>?T?jcU_3eM+ib)JjGT$#b z>EQ|=OtTi*-^k8em?C7cy=aj1L)b@UeJjXOYh{5&<~kv(H-W^k#^O~An<>ZTA&8YC z4Py|;0(*#f%Ne@WPR9PNdAX$KxQRMfOLjNebn|B>Lm!KZnGHt9(HDUXvvCE7&1NO` z0a2MmJ*D^i%QLl;U+HCW#j1Cs`>&yjnOm=75CdZ7#VQn6Ki z_JcGL;f~tAcRB&dI$)Ns@RX-RTNry;qpzh&kE69h635^AK`T1B{Pq+5_`c#Adm&&cdC1j<2I3qR@6Xqss@BXctdG^lBng{w3;$l2f#F&Kj z7?z8PL%II$>l{W?B{VZ$0ZE3iW$tw*wC^h`}nFwK6XaL;T!GT`>Pc7@f8a& zIs`qkq18Zr(1=ty7x?Az;&nP_Hw@U9To~4hvEtp5ZA6uhJ`UG!R^z*JMPqfWp;O4` zW$k-%T8)Y)3v9-5KH(Kf(XLY4MHo!ktIwwgDon)Z2NK^}N=_MwE;+nnJf?*XXN#m(+j{R5)~i1@If`v z%1$C7r;S`=aL%TBAuW-mY}9d`)a?xQBhe6Qr#_ZJ>fq*N;85y)aRr2}3+gb_bMop+ z8Qpwy3t>9tH+1^FZ!J8Rf#e2NsR`X=xou?W-8Opi^}~o`B^{egmh=lL z`;AHS;;Sm+Jk@ZSD{7=B>QT-t(*JxY?QQktu96S0M)4il;KM^L^qnfQBC@IMu zCKGmJcq3bN?+S+<{gRkbqMIxtDRQ?zd2=XN+Ht64V)9v%yLEbqj2jrqfjrYbGe2EZWjBSb4UZ2ijX*=4;{dJ zrIaJ@ZKX+Xhv;BLZ7yok0Up2?O+m#bUim}CjLt&=p61P!%}pfh!^WNMpb1L2wH0)vn|CDw zy1;`S`tSd!Gf*k+zBY}T@tm;%>pZg6OWIl^lKfPl=Uj__Yq+K-ZUSA!M$#czltIbH zwb?KDE?vWZHFOYuAC*amp*pE2q)<5D0`rPdu!TUz0ce#6ZJj)Q2@m@19TGb}rLv&u z4d=J)Efw-o7T9xkGEexC5A7&ds;hZ>Ap~oPXd8^Gn%;(=m{D&n@pjel)k}F9-yV(# zze~Vu7lgXCvSdEUq~9FRZi!R;1rZS7C-zi zJR!h*KXC!N7AJMCh#}D4Gq0c|_G7o>wSq;%oZVH89Oc9g4#nD6k1j$`kNd6Kiv)0G z_C0*#ln0`Ye3>6#H2=Hv%d{Ux5B2NKWvjoiAZF=aJtnMyuQzol8O#G3y&R0oCh!r` zy?mVOk6-=1Y&}2l_TNlBdefD3!Q}Z(^ zv?WQJP^3HU`C1Vz6Jq+;XVWNMBjm%@V|M60-(~N`gU9$9jA2!$8F75HmD`JRXPzP! z zx2w*io;MO?I(|vwxNR(DGa`j;-PL)NW-g-EN9DhO^}G!Qb8=ldBu#-Di!(GRvIDOP zwE>c)W&DT`(L&qaUS6?)2$n1w4VPFm!*7^r?L!1&Q-cr(n;Lz@_VH3_ypwPs4DM{Z9L;4IW+yZ_S#~sEFSa3!~*8BGN zU*ezVN_leSZ`DExaBc)a)-Id>Dg7;weiW}oFAob$1o$6`jURO+rkLf=BManp8~4Jf zs>PBOB*0tm8~G&kt3ztz6|cd{QBiK***bxeaJ>Glp)G>)@1yCmi6oNIj4e|S$6>Pg zY>~iZPt>KMlc?V=pZay*0Ty{{4ARK4FL#_=c1ldT$k?cV-435u3;!f^!uw@n|JPpv zLNDijgdT>OPAwenUF#~-LyHP1eb!;l%|-w$^8tpFU!QflDspmndS)dL%EVbaY~zYy%iUPQE9l5&r9KKaxpID2>iN&Y3sSR zENtt!p%F6aq$Bd?kx81N@R$ZU#f4tiAk^)JDds{(RHpIij-fqqJFcmq#l-{({Y4DF zUv^XMrB{z&1Ozk68x{IUSVY*zU^bS-eQ#@YnJ!m4MmKD3xRi~IBH7gphC@DpHCIc1 zMJ8}Rix+0^q?Cy{CmGJ_1C!|GXVlM+wUDUa(ch?F`h|aj`khwcB&6lINb{G@!4094 zmOeU?cxcy6vHtsPy03oK!t6N(f+#D{`L!ju#Aa}3 zQ)|WT(7B*@OyEGSzD`VL-d#S7*_xb?%kEueU6b2}zN9%rVH(1uGb9}G`}fU2n{VSq z=*ij-vuO;>N0vL>49gEm^jbeh`Ukj9P7 zwxj6wZEKN16N#?jNJZC?B=mhlm7YL{YZ~nZa>$m@?%Hxu{h5oG!>eVo?@E@j@l_F{63k{@ozBIwE! z5E;Q>$n5$|!kED2>d3w|H6w0!-p^MbwS21BE$=)V%Gjgr{Bqu`0hzGwZlPYC(@CgU zlbr|z4t8l<-M69NGiDssQr8wR7;&-t56qcn+82vIq#!zbQ+p4Fxx(^ch$}3>i?_tp z-uC$-liv1G3I+H6(=~MaoO0v7U9#qg-1kz&-5!xK{fTm%{||fb0TgArZjF*e42Xz| zfCNQyk}Q%%K|l$Tksy*J3n? zR-xQqswZuS8&wk@AuiT9&9Y^Ka@7UFJ_P6uP+tZHQEu zx9P%fKbj$?SO_Nq2rw%)wGgzf_}PcZdSW3-dtQ1e&vq86JdC)ZxLPD@p+-!5ykx;D zP`15XmvE1@mBO98SuGN1a%|)cO4Fl<5m|N?V_Y>69-p$;%U~PYv0j(4U#61F*<~fDY7r}t!#!%s88p|ThZ8_R(kq>G&I_vigYKmr zzg1UTaKB%s%C^ITp$5;={Bw9ModlY`*pk94W(7+kACnW$rW!D|^WRW}3FH5fBD`#) z+J4Igvt{?X=rTOR#q5oU#@CFtSeRd2-Nld0LS3fQ4&(K=+ixjuBQ<~q$m0(4ENTG; z*R_d^Br&H4DQ&0>j1?Pkkz|QQ<{)*V$42Ar&KJd&LkWkcJ_|L_2F72!_ydmaAAe!7 zX+5>Mh~T(*G0A?S`oNVODWZZoq6VqPr#vn zvyuV;%r6e?`-_y&x~)Hjvz5OE;~QEQ5WtO-&|B8$*8v>l#^4VOK<8Mpa}n*j zmcvwI(Pj-Fb(h6gCht65m&Uk%kXZ~2`??LVipRg)1DghDNnR}80oCB0B2#rg;6D8b z_$7g6*bvYRyUz;z>un;dJ8^#;EeFMaeUZIKOwoPp8RHw$(5SSdS5 zL&mv0EyngD(67H1G?p%$`1inNDm;#f68yR|PyZ^8iNWbGo(vXt8zL=0b@r*ha%973nF9oA9WX>!4v5F|5QXH~0Usj5^&S!e*&}yH9=mqu|Moiz z$6XHBjpV<6Rm`{`BD54__>;Pf=WQ|+-FRe&*SBrY5A+cFD_+X<{~G%CfYuO@&-7Og z>;DLQ`rAtfj}2nS=xJU2TW_5KBC(bK_SS!n+_?YtTL+Niw+WyS73W7gUI)~QKZUsn zY9F|TB5M2gGZ^`eloq&5o_S=meRR~>yE|WU*?P!O zw(xgW&X=G2_|E-CT>RAELuU-MLQP zLkBypjPTS{7oZVfhMztD`CR*toPdjvTQjac=!*Zoj<3PkWUp)G5OKy^&TmH@U^B%f zlzS4nW05R(~#d(rE3opUe-B zBZuPC2_l!DOBexn?0}qYMZOS_!Giph0`W=!Z3Sy3>(5EZy}kl_#zvK=IVFZb!CD4FhY0{&=X0M!Q~An!?j@&UK$QLrENbP(C8 zdqAw*$JbQsfK76j5>LRo41Dn{0WpiZlaqkmaLH#=7FrS8o1lw7sG0ExuD4NBsV+IK zkXq8|GzMCV+=OmZwJ_lC{oXR&RGOCO(oIG`FaeZ2;9 z#lbb`t@=|OB8yWd=$fBHT`zkN$&xnE=;hD+ngm2MI^79f@?X)b3>cIPFeo$0 zr`5g!EG*AN>_$H2sTJLmbzjQKS^&Mo&2iVs9w0xz)0HS>bqxq)Z0O}cT`#b@WD!j4 zfqpnmKv2*ni(Jimh`|C_`juU}A%uVT@j?nD;&ebNqrsn$q@4|{pWTSR_!`<&;?}79 z0dUUpVBD0ysjVE`_7*e5se5MwrSu;U<`k2%0EEnfypBV)f3N%}H5Y~j(4dJ53zGpW z6J7(^!d@U>wX)IQ4Di6+;Qv$+mg<#SM6oEJ#VS^Hy!XpBc}m9Q3*tZF)tFyf>4|QF zwh)sow>d3fZwW<_ksRngTqD_{SDC8eF}&E?eFkik&IknUjFYqvL;8x!yt!M&W60oFrcV#?76YO~B&*O~BE>U;9y$%+S( zlXkzDZvT^Oe_rB?Y7S=x7|9cyMzvQ4^6!c^9Eo&Y8~etlS;AFi44XY8rLv0dlE!^s zXHkku1AF7v-5?+V*hP%U3p%WY=rMT>Eq(Z%_Ip_!Yy!|Cdc^%}dDH=^^(oU&hFrca zG{+)&7Rqz@DM3mXP~i>yrNVmz>@z+3Iq>TfaKBI9U*tYWbn=ft^A2Ah1evStFDwAy zrQW(Wj9+NByWYeI`sTEtVGj$9?iOg|U;p%y3iLlL_M4QVIo0pnIc11|C#ODa**7RK z5NnOOJ^3=(O)Ywl@B<1C&MWrgbHxbYO(Kr@%svJflE>dZer19-hbvwPBR#l+42a7+ zG9Z(aA(~|lw)n+FNJWqn0H1Q0Kp^IFGSIQPdWYmRu(UH|)UN;z#U8?;9JmxZDo7@y z0bse!!huW%YwFE!;@Lo2YbJTYc;BB9o|dix{3V$fyh?~Q#I&YjxdtaamFw!r z4gVALQ|qblT`TwR9}X|>V=;tYKmdn&m;C&z&SYOO(~M z*Py|%ckjbJ#Un5upMTOmy3GW1BF3FB6XJa!0m-%KUj<0bqeHK}sdH0VS4NWw_Ule1 z{Nykk8&7&Q)SX{P?*g`-(dWL9Jg`8L06YO-1;AQ!?;8ykr~9IYjJ-1)>USEaLyl4N z-U812>ztCmZ;49s)y;+UQ1|oR-@nS*!~5^2nGwdBL|~2G+$xo8qoPialvz>XXzn6z zQrh9Zodcyi<4JBLHK7pc-oG*?W*<`9urnl!KQBWV3aoDMpMe!A`s`WwRP1vAuIY2X zvj;#UmV>Dmt6h-{<5eD^PkI1>+)z!KqU9L@;hu*%+3Dfucc0qZ>1xtB9C0sqbdqxW7< z8CR{B);+L&F)AwR&2Ui5)VJ(M#+vJYUEzrtin3oi!8OuHogi{L@^#06*Zb`nBk;A- z_His=9WST9xVA7*iTjmIf%gZ<(V($&0pi&=9BzGr%1l@>Bg{AMLdGE6;5eiB&gHR(Qh7*C8&OO zw!jdfa<>AmFkEVx1y~2o53Lc>Pay=&d}nIbix*`3%1#H&OdP}KIaQg&&Z>VVT9S<~ z0%ZNd)Mw>RG-|FT{|ZmnMlTLC$)R8FPLBoC6i=D>J1mRifJg|MgwN(^b3Y7Q&QE11 z?~w+Ng@>P}*^%i^zXC+b#;ctD=Ub#U0DPNbH>u;68i@GTY--lCKv_xq&bh-xyJX;T zG4chSI05Zo>L=8Dz)VnQJ^fVu!wrz76u37x0~I%#{=Pu~uw=m8Go-=R+{+KzuEpm7 zpxT^C@GtT0b<7vRP~7~bv|?>g=N=uyt@qJ;@QorB&=*OyF4wIE`PCgjo#IdkIZxAg zm9}2Lkl2#&dm85s@sn9B$V_&hkw;zvs1O!vg0^MwM4?PY_8Pc|h-){M{Nl@`b{=uF zT=M)NcupvdS~weLj3_l(hv*uPrE@i(nj=__-A=t4!YQRbvEwZAP8D}yvqN-LD1WHZ zk$9qcqJ$eC-G0SK`Rhp z*%Z=lu?fOBxxv7BjVrb@!*;lr zJcLa(<#o6zYi|gBjp6;%+?ruvEF&)3>F!Q1pfWT{F6*9ss5 zd0<0`tqDRa;CPdP0Bj0^5dd|jq1Nx=-w-)_+eM&@*1KLt>hdeAT9MA?HmZ$N-88d) zWUx+8L(@VY6)%v1^{3mSW)ajWiPZR#b2uaw$kFvK_GK-$u%*7S9>}e_^k}h{MITJS zal_s?j4`M7+qlf9K%(#n73m=wFsf-j`s9%ih;zawAJagrtb=0Zb6$`J@EW|MYu~5O z{YC4nd+c37Rc?=dZj3Qw>wb(J_6MqW$jAE&;c^QZxZ1CKuH`?O9X9%^Ru*QYtwV`r zubnNsdfI8IvXy2767D~s`4qQFcO^)~VL}OF($Z)&VT9DGMLES??G+r#ZB`wt&g5zL zeR0&#)QA@{xg?2c*XZP5Pc2MWH)XX}OpVif?Df&9HIZ#qsBH#pBzXN;VW4V!V)442 ze$8OA9+iZ8t%;+` zHS=Dk+|X^WxaykK;2*kfwN@Kl{N;<4qw|CPy^Ou4iQ`q^prvow%WG{X#SvEN4{*}l z8K{1qB56(2wkwb>AADy>tHNHh!rqYQ8@HInKEK= zAmka;9(@~iB8UfhljU9(L=_44hXFLT4Sr< zVT#_haVs`E3Cv0DowRa zLDp)zcUim$Obp(m8m;F*5!3PQ!7Mu%-1RI8ABo~nK5N}q5RLX-6kKV<< z00KrF(UOe7c6OCO31kCIX{w$R@I@ia_5Md7ihwfCdS#zxmK9qR$sFI((+90Y9n)>u zH>LC_UI%}DQi(DP_HaRq+DwQ~j8-}_OF!!!&2yY?1Y!e(9a;dhZ=rea9FVab{iBSf zpAXn3`$yfN!@mbeCdzQj$L~W!tVTis@}sOybhMh>onEzv^nM z?C|(O11?^8$n<{S{;-BhYai3NDx+2cpU0!+TlxATf;TWB2?C^vBA@yIJ*)jxQ2qRe#W&)i{OU3!0xwwu#KF z9=rJzq!+U!lUJZ-KR|Ow8H}olstN2Jh)mr__!f8;_Z@>WgKyH6t0U!sV28_fb#-;k zEEW2B;R#!isk>ISB?PP20}vaS0cT3!j2tq{S3ns8q&=U!1PzH>12Vk&pkmTjG%>gg z^9;$AJp6A%M;g2f6*2v`_kFEvx11_oldLCCo0RRy>eBAI+oD%0enwLViHPUZ*+*QBlQ;yZW90 zcx(DXoc11xwCi+yuT0g${p0RMYO?yZwk-6LyHpfs&S(W08&#>d`dN@R4Kgqg8v7U*7$4WQVElGO9zb+HkrD zwe`Ton8F-Oa!F6GU@VZ4$hli#-)Yj*)6-vIC?0#Y)Y#sz=$@~0JK$C-o#E8{erCi8 zxeU^pVVRbr0M9c!6Zq6G2~_%iwK6xm0Bq;%$D%(bHV>^pVzcR<<}K=*t68w1kp`jB z=kpX6G_GGI1t@|O%77L`&VM}WDhd1jY>?ofUY<_T9tg;|@rJrPZbkasm4eOtxNrW3 zvvaGT0Y)&Wf;zBapZKIWjW0G;pS%3_l&o;tsrNqz*)J~>0xCA?Y0%NTAu zwl3$DClyq3!g+!j#9wB;lJJVa>RAb`^ylyZQ)`{p`Wnq8EvvyA0^p=yzfcKEi8!ER zHg>INjfT-v)SbrPAB<^+fX19uIr7H|dhsnm1aG2YBDUp4@g{ocZY?dl7r(hqi~^vt zZuEY9@fow2Wt@Gxra+<$!x0%WQnGE)mGp@`xRqK^QN#vt@AsB3@rTflR$LhT0naxP zEY!&>wdv2(@s9AX0!k9O*vKgx+*K?^ldhZtT< zlJ-uS@Z7jP-?cPU2-X=r?lrKH+-W|a_mfc8>3pUK5t(EEmM0Myj=2uOG6qP2qy1^; znn8KedNK5IFnDXh-GZ)QKWTwP526pEq464uE=<~?ca$;mh;on~vt@&HsF9vjDLq%{ z%4D{$({MtEgkNXApvVw;=JUlB&N69L#}n$G1AGpX>4G_-P5hk;>W6@VI{jAzeekVo zd!+lbow2nN>-Moiwc?k@go6hJnjMv1@iE6$=(bL#*-yS>fl!Il-O90i8hu|xtN7Ke zK5hub1>2n-f0Fn^B6%cBC|YbzT057d+@4Z-zRNgm(QzYb?&daEL%eK}<4Pi=6(beh zVbjC?yucVCOU2ey6~{TClBStbEe2m6`-0}welD`gGzE|6IS$2`)hJSu? zoK3#E%N4hZMjvV8D4cRRG|NE%u?Q=zQmcSGw92RRU^50q+t&Aw8(r&>GrAjzSR6R> z&I~KDr{iJB-QeZTNu6aifJ6GeJ^5hR7gBPN!hQI7D902d`VvbtvsqcCLYx_a=v`=1 zF$l6dds{g+Guf$S&~3H6y8pEv)qPg&?V*_bNp+-@U$S(8F;2_5Z2b`~WYON&#(&1QWYijIK^2vF0Tw@#gw#PX+jFbKrT(EFpaGr@NDsU^j5{M0 zXC{VzHp2cY@A$) z{k$=B|7p`h1L}N0R?$r8T}0@i#4RVS}9JZq;O_)JeO3IF-O}%8M(_@+wK~dXcE? zJjdhG6EWBoOzCV2wlW0R_XaFKNnWewH@We=Pjh^Gad`xmKItY1O88Hot~1Q-%%^67 z{K}(0XV6i8BV5cI(AVlc0saV(jXKecXXTGFtjtB09fu%}9Dfbs7+Xwwz>A`%+;v4E zQU?T}PHrH;qRw0e2!_8vi3h}&8rUWQO9gD8@RAbG*mXTF&2^gsrwDD}HJ(LT$mf$P zl{?nMJ(6c%8AQ^wiR6buB&Vu3Zof!QPLGm;T2yWac`>iHE{X7U=eQ&Dp=vt8xq*y{|V4Zpo~5@NF#c;=5=u0;{0Vy0-%ZY_l3%-Y)s`hmA3s!bfU*_y~7K1~mXavojW^q7`p!=%{Glx!R63Bn{ zqxg&`jt}{ja@E^_#3PZ2O4L(P+%+>dwNQ+?`9bQ(>No&eKWO@e4iA9|thrubW^FkJnWEDHt~%q>WYC@I7AcN$fHm(pNwj zrQ%ABh%>Tmn(13AQx_H#nfyb~r=Os&S+A&dv=l4uqnhtDo;n_mkb$?R^6>!%>Czre zO}+c-yfVA%+Rgc{{^L=ttW}~R6W6^i2uFkE1ggU&7O(DqW^kd&tj(;k9%$Xmb#=*2 z%^J!dt$-G|$w8c7??9VMIt7$6;SS0_v*nyeDq@8t@;<_vxv)B}*YNm)7p zLTa4lZCh)X2|P?e2in;9Rp#y9UZ2lLqB6e?(vx+G0g>2iU}9_k$BAti$it$^7?m-% zL4>DE=AZ&Qj$TlLUYBSI$o|3!c3l^50h!&||m+P zjkAt70J!f)?+sgZQ0uCjQRu zokLM#^DZOoB4$;*t}#`_{Jd77_On#ZbD$g8X?&B#!9xD*^)|(5eYnTCWQ=Ge3th#} zZ14PB72wXM10fTX7s>kt6H6~&Clt?cdb0g~88ktBbvl9`59aK!FV+9~V%C`zyRb=h;x`bU{v&ZTqesZV7r@>VQw& zHP%ma05f!x8sLl;5#}RNX7)L(#s1-djY=*iSJCYg4XDG~xo4do1N)e@{`N(Kq7N%x zfmOQ5tzp55!0;jFIN4x=PXLcP1-{QB)^KLXmba$00>~ACZGBSq6HDuGW3a(O6q08^ zK3<;UXES$>PUhCF+l{1Y?6_MQm3doPJY1vWT#nH8?OpG!H4>HFU8T(*Ik}|6Bs!OP z^PgC~U~ir}s}MXTLUU7Q?AmL-miA9G9cBXYw=5>iy!6;w%uo?9m}1<@1yaq67b`D( zV7Y!n_E2z-1?62oCQeSwAXaLAa$?Hm@j$-EGB3`<0c$OF)wcj+TtENFQ7mPD5($^< zlv)nTb-v1W>}u$g5u#qMAZ6X8YkeH!DE;xSH_l@+l|yvwVPw@lwKT>T7FDLdpq$7} ze|Y|r3|4=Z`C}bXX6R78MWcTQb0e3k#3SSR?M=n3Bkx9zL|#p)(Nj%4JU{8=ci!>S zH}J^Fql_G_FNp!|^}F^?k5$A59M|+b3q9wYjTeRA?4~$2l0+|Gl#fE>r=|=x8W{K0)+(n@Y_yq%h{@OEu*hxw)Pi{%V@v|~ z-FNM^s*Gsta2I^A^oUSJGA+1=`74L6Rgt)HfNVyCC#%Z)e-4%1#IV9Rtav{uOC?}pW)k!fN>*_ zkIIO-sUdU+Kc|fojb%q1(L2rLPy@YX~GvEC^rYSgG=C7xHw&?5*EhGFCp=yUWPk)#11RE}E_+DY>lM0+ZhOrtr$)E& zCimM&84l^x?=zO%`(QY$;OH<`sW{=WgX!?_{(;-qU{yJ%gRX8>@V0S&gV|I>h!|zb z4br9$PQOXs#z=ZOfq^<|Vv#XS#~7xyzbnTW7HTv(eno%BiS_~4^wfY%)#GK6s;S)N z_MCKeQ8lTGeOT2}0tLF6%COBNtFEg(s}Q%-gNWJa5?2VhYMp)jT=%394}8aFQlPkC zKt>FPGDkh@f>-PKrH8lT<~Lz~o9QN#1mx&flPJ z9ool=TX0MAZ)Q&J-P%QqXRpydX;*hGy6O-o?pm;iibZfEmYbyai;vTZylv9D`_49e zxuB+C&m)peH73+^hFNR1p`d9FEojLj)Ylc~qMl8vwB))jAC5_K^P-VtAVi5U=*S1_ z_|ygu#rCA1VKPof14cec^Qc*pO~*Ctn$K}`js3AD*M4O7$?wa)qlki8O~dk$e^7S8JNmT9byiEcjW&o-=80O?l>6DsIT=wqZGg z+#B*JZ*)rDZNIF^Sdp3W#~1^#A75psql=`)Q8x7M3dqe4AbsOIzw zn>=gi*y|XKSCi_qr>hb#)X}m(URl&JW&``EWAsDBUDl#3Qx>IOIsACZ)_lSLIAxZe zhU&xqJ{DD4{@PgCa*M{05Nh*Xt#NYL#A^FBd&cOaWRm3QpbMg zF~bogeA;UpYb1q5)IWgd4ZeI;j^b@0Z3U#n7B;D#WbfSsDX(hJ?|zIc#bsdN*`^Bb z^@?~~zbVuT246q0?^@b1Pfp*fWB7KP*u3__ycC;}v3#fkc>PV$>eFYK9H!Ccn-2~( z4?U2i;h_Q6K{Kyks)i6}lEW5^KG`)yGRkMd=dofpu$`UrZjdP)wMr|aLZIFXsp+4P zNnWf{zwPR&YxtND71Q4QngEvgIa?T+&@wa^>=omxGBFZ7(Kfl4RO>k%N~iy+I}fM* ze1BPou6oc*Jzv4?FpVzbHa5jduzflNeY$njekb_&`73D>pL(SwxKsD~E!zw8gvWrq zq>b}yBV**IB7MX7SQetdC1Iw+*&*7&3xjA+>g0&l&)!Ap)N>p|>YBkPVaF>x3I%bP zc~oR-hX7(0{puDO~e-k(EtAcd&8LpJDJ{57T{eAEK{NqwT?uo5` zn(n}ilLxz3e|3PPC+iY+j6CcDYmr!QI~9G20`$2m*cP9=1kuD|cm%4s&kl zmF9kIxrm~sc)aKacp{t_x=7? z42~m9bp__MU>aH&wJg1*D5#T9#m)~2NJ zWn(PL(tM$t*?e=s_2#6Mm-{&kM@aQhVHN-Ky!2a|A?wLl_#7DuyMmtZ!fdr5_Sz85 z0I=5PfceoR%}Z_USzN4N{V2zCBXN@3d-Vl#NEqYZ*TcYeaoI6p368+DfH_c$tT_W| zU*~CX_@`YAtWq$kr=E zb6xWJ_H(;5gSvu-x7Huy-ksBK3Ikz-_`eSuCfgdJZA;6%HV-J-uuHs)u1ZJ+wZrt> z0i;UF8y+~c+z#5oUZl^4a`7&1A2IvA;Y74Q16;EnRgPolv*{$4j;3T*St)K$#Z8g+ zd1e>7XQ?iEaMH1(x9hi}yIS-tQ+R<+Lio;xLu|bC{xcd?)r}hGZ)2$RFr7j@HbJTH zqH{Lxr(TO7lD!6LUXw>45`^!<#cWhyc59@q?geYC@2uJ6mWB}MR2+-*e5a_KRm0T0 z)CNcV<$WQ+?esQAQ8or^s+{`z?^UX8Q7zuXruv91)vMIlZy(H2p}0+l*}DA=X>8qa zUdrIkR3P0<;^cmc1a9xx+;a6$D((kn_WA8XDt0t>&Eh7uJS7+Qp{6rh(qp^X(3OW* zRMlE;b-bcWI5=#i2sVI`(oNY&a_)=@h0ioN{rKkJ(i*Lrpm8f1Tf^9~298I{rJZr4 zr`*Vh{J9DYqb{fM{*vz=$~vw8G5m)gGS;Rbo_C~s>&G$~>(?*O!-5I&mKDB)Tw^>Na&` zXK!A5a$3MH?7V>43jnq%ZbEwR_NB&bbc*vWoQ`+%4kLQ2L(GD%ack)CQh{=hPy!fT zC|7zTm&`;XNKJZ3+M{~YZK@!w|E5~;*rCK?9!ua){uvmTwSCi{n{Dcz~_Z| z$)jZZP2C*6khTtQoK4g+^j@9$Gt=5~Ht7?U;!1S5`n~e5G*`gVrebp2xJ=decR;Z7 zg8vV_YlYhjEst957tli5n;&&X$^UAW;n<23tuja9^zDiz~Z-2?&=V@G;sol&f@)aRtm1$cic zX0t^V&_e>zO%N6S(#Lc=g1~ST;F9INus^ZnzeAgJ*4;cSfEs{huP?8 z8`3dVKyUfu8Wv|7+En84xm{AFj9G-prvvAEI%M6p5%5*@)3DF}(t9THS07ssXh;y> ziXN#T<#_KdtabF0wm_4Sg~4sF-Ob z;*42>{`eHSfk#dL16tHf4lP04Af?a?(%&eE_q3b%VhNj{vAgDN$M z6P}rx9B0FA4f7>V;)Yf0jnR_P)K%c%CzLOzL>78sr9EnIGalMsRK@z$V&8nzs&GVl zA!7Nw(Rb$@dq#wEvS^la!f@DhWUDftosdm}#E!tuM@#9|Ji_*InVpy3Ke9dVHELVK>S~NfPGVjmcEn+G@dK#fLT`0eLpS&UcEPk`phv8w7Z$mT8%4nHs7SoRP|mFl z(K*y|2zsNARqf2(_1N1FmkW*Z-u=|nZm@f0p>-_5dvq05?u{HS%K|Fbl0}=cRp`Od z&vwX=mkGgAJM?qvlbsx~SL=;%=tB5J++i4aA@Bsf@V$S+kI6K+^?nkx^}Y$uE5 zp3@8W>rmZ~6Bct`I!8=;JnVuT=@7jN-3owO*fId6tRY^pm7<1Rk*opw><^-~Rgd$m z#`<+~bR$0aQP@Ac2Bbi(x8u(DR}>c3tqj); z2^B55Z@DhHFQvkBjri=w%;vgTyO={IK1wi*A(acgVH;eT>G>I|jAB#Y8!ifduX$cu zr^+~*Uwj#6z}eFMO0F&RN!O@R-m2yDJ3}G0%q!hv^KY(P;m*$_fGInfsr%G+-0x3t z?U=FIXq0LbXLIPIl3a5Ac3&1-P|t`K=SSaJaz#6{G>d0X4irwpU?A9D8olqvM;^tW zCV%CUXfEY_0nPisliu&Yb@~->v=>$Lg@Ph)4KkfNBCn(k~ADeF-ob?VH zr?+XpdAK~~lAkK>7|oteU&bWI^tGVQ3^FDk0wVQe-7+-g56Y$;Q>lI{7u&gk%dUW2 zHmD|Te)H%y>FIY6Hku*JKu3;HoCpqb0j_l4UX`&{usPXEjNozRyu9%Ey2;}KU=;$) zf#4#~rVrNIuo@?dZs|>k!4hW|id{&cPmdD8j}}RM95srn>?#JCNAR(*ir`Vl3`s)N zAh5Q>)J(>HiH^^_z>o0bx`agFT4h`g?SYEbMFDu8FaCCEw#K6-E|(o`6K9iWoZam; zH)w`xkpZwJ{XA8>g01VP6NkpbD`3I4_1iZl=EUn^qx3ro6)!}Z;LW3RF9d6@ z6A+S|e4%}B?(H*+_cVRHM+amSvAiRdnjwvUA#Aokfi6Fc&zA`;UYOhmo;Tlvw6gO) zSNojP6V`qdRWA|E@WhAT02M)?y3K@eWMKy#h8vkw+u^jSD-JzCA0A((L%M|uZhbN| z4kT4wFF`#yO$iDLNArHSL(QX5xv5Wx64qChSC;pwz1p%=nnqX6A*5%?^DGI2&e z`^$%^rd=uVbRbgDRZJ^+5Y6OEdRUwQmP;x+eG~(J#GWf6f{ep=e(nMgLc>x8Ccul>N!l0 zHx~&a*`q~9|sh6RGoZDj1JCy)7DNztaTL=ygc;yOQGWGJyEe~42!D+c7cntr+ zdXguQov8pjt0e<{5s!)crGCqW$+j@Iog@(Oz%NAB0Fz?)=D8MH3tde$7fQG=ykol_ zTuoE#_yx#PJ~4wkU&g=U|J=lmfoFa=t#flMJ5yZhZ9z3~Ar}9_g_NF`91MZXU(PZ)*eUqzP(rW0gdP9drNJdAq=HvLm@OzNn!6Z6k(UQzK?Kb~s$V{5D7Z6H zTik`}Y#HTN2rXxZZvM;JFV%L`i8XVp69&mKGOz7B0 zhg{<5Z=D~t_?u=`1p0q8mB01>*rYnM|3XIB&W*qBol{Uy9)VK0jf=L#vtMPg+(@QL z$cG?*%sqCUu`^;$M0$l+?1VT>xG2=m@x1ORW<2uT(L8J{3%rKU zCq;Op(?RU`5B%rfH*ThzgoDeJ6GCc@bh2yCQ=k#z2Kr!b1~kG(!0kbO5^W#P;K9hA z2;kNt9WBn{-HGRcJ4pgI43qu4c6Ee=<2?v&TuK+m=D(C$&NTv~Xk4xAO(B5U0C(nh zEUfTDN9D(Q@S`;8Tgc_fFnJI`WpWJ&jZP~KB5DOjLm*I@-1@tLO6Iq^YHB*D^*;*{ zA4SwUQ!2i!eBHHSyE~yMl?5U+h>Vzm=FwV(E2$V}2PkZ=1$cJYm~GVYp+pQkb>8Yy z+7lGWL-%r-h>G=AbJX?UuB4&!Pp{*OB}ixXDrv#TACjO95E}skz}gUp|5~&nrkf+5h^p|Mh48Kk#Rh>*lWb$hS@gJo!Nj3Uw2(hZKYfp^$noZd8^)4GfpgwmtepO|Y`TLhiY5w3MLEI8)#fO;oJVngJjOufkK zM&Wm$jvA%B2gipo?xXmuI22q$&)-j1-r0}dAkJ82a%=DMQVH;D=(Pq_&LxFE$#Fm) zJP4&?WdBipmn37wr}SqY`uDI|gRdwL!Y1fZ|E#tf{2Y`2vcM)h3@a_)^YH=e;T@t-s%07 zF!=|wdaFBNPijv$LAyjb@jtFL+|;Do#GAK4!VeXY^T7s3J` zIIsBE+J#&xRmNMzgF_ab`VUBx_*Y-6LAB27VCC5d|5-lx_l=wEjt|=XsVI5Wx_sDQ z7+1z0!ly^Z`1D8|vSFj{zu7mq3l()xArnEiEw;51U*$-Mdgmx!P{t-RF#_D#S5UJ* z6f7v>13!imazS;>$>tOpXbiRnB_J43v*!&x28s8%zQ3Dz|6i!*pq4@DJdcQY<^D*^ z{|n`8+TSg6NMZ_YMKwat_i$$1Q4je1`t;F@hp@4*Gwp?F;7;<{*U20_Q0?dCeJ~rB z-3@G%!QhCct2US{tS~s+G1v~cGZ&ILM*M3J#J_e7lofAUrQKpBsBu}1pf+-o-Q7m= zHGyq?NX063^zF}d8kb}yGTF~@f36^aEhh$uX3F?@-j+S7d+i=b@-Nd+<4-S>+Rqa6 z$P6*Mh9oThqA<}|Y8LBh?n^$PwkHUz&<8!Fe1D%qLQJ4@>C?!9j{;=1EMK$W^UuJ= z&uYH*71$?OnM4=^h7iNz!a|ry!}As(5pKYC$gK;Mf_v*G&lf%N2szv<_sAIc}plzqB}Z9fMN zxIjfEP=1FlKlm6_dIqZyn@?|r8z>T+UkcJX45+xFwYy7sC65;G0MuR}tP9Zf`C<*6 zj(`JJEa-HU{ZRLP+vSl`w|1wei%m zT|-lQgJ>@hSxOljEXD|7qe1GFwZ+1}umD|aDJ?@QjRo;KDib2ko5T1Xk&G_BNELgK zcAU;PZ0Kj3O&he??lwoyAW@$KsoTK*MR(gE($>At@$~4kU-@*+Zv5LYLZbcFT2!Ng z+<_cT=CI^i&I~$e+Ae~HcHq*WZUY@C*67ryY3~xv3i_Uv$Uta?$=%r z;Vl6;2>lZTeTM<|h1hX@E(&yrIF69C9e9)|yhmw-JcSj;TJWiL64)!Sd zESSC!op6)0uU(f1R0!Smn3ZGT5v(*7(YON3H|;O2u|x^i6x+;2M^<#4_u9gDin_Bw zdC5&470k(42}V3_a`Md~1l#k&FVApEf&&vl{zuTy%uloZa0u#*$!GZrRC>M9dHQqy zYYFDRH;1AtKCr(B?ShpiWgo=7aK?Yz=>c5`AGCEExD!6`jeBD21)gLNy;DN3h>Y?! zk6Hw}z1vodJX-5WM055V9Mp^%`6x1bIDRjR=7ly#bif_%vp2j`w%=2r&*Gh~xvKG! z>xYeCt^{S^bmszGja-x`=2#*+iYZX#VpB;Kh7lF8Kz58Q6#8yn!(W&ruuDpwQ0P=M z_yED1HgH^WjjmYtvx{wyIWs$?9j{j^z+3jgKbX9T@|)^-yaMmvIPjWp4DR8l8Kgm! z=o+7Uwe*ljhkgO*)>e>YPlg{o_;V!GPz#SX8r`%mwny@XeT? zpPM?9Mga9+@y)^+jrYK3QL#5PrQi+m_X}yRCqUP%G=0M<{o{=m^tGg|-+R*G)DvNpzb^O>mu_(yx?HDMz`G0rYyQJT z;f;s;(ITkVDR*#}zki63q?Z+H!Rg%@{XVD$&M&ax61)xb{`O3M|I@zqP`{o}5HwLO zHG#o?@Y~g!kQK?yB1jCrQmpjPpJ3u4f{7y;Te)bao;d0_ngTs^IE8zJeXY!e-8OcB2TUtE6 zvu*&~W|A=Ifa(-3UlxzMoY{d=iDUTvnf?B6zI(qFZEdP5MO6R%l?1+l^=10_`=k%w|wSA0MHa3wB6w(r#7LQgy>iHqa`HPAFzG=Y#o12WWj{UhluG5Y z&3v>sVInLKhFi)j1kJ~{NAjz5IiuaZyc(X9m)MVAU0hiaGNu!;jXTaLHRg$2Z$-#3 z!}6+Lr#?0`G@KJG&^H>0u-SA*0oj09%TzCI7vzN9a|WRYVL`OQN~Finh2fZr8xn{V z=L>nSBUOPQ21nC*=UW|n%*KlP6*9fB-0d#+$=q#H0LzK=B|e*dQHxl7Y2`|DrmW8!ee8(mEerQGd$>;ndwhK1BW6yLG&=Y z&kTMk2f9Z7^(WzjFJi?z5;8nuKX%kkRdC3hBL~xBBI|Lyt#nUrjpf z;$X8HX+5=CohdwO z;}^fLS6HaOeQCzVdG_^?z1>WXNClsMS@u$ie8_o@`4kWP0mgS<;XbuDAouq`_}cVN);J+BwvB-G^!>%vI8DXVAUMd@W!*PHU{TO>;lhfPKyCJE!S+ zJN+(jBgKRqe)8hl1=EU3dbzsxSkN!SI4i?7hO~B>)5Ib{;K-T8G z^Qw8Qp+y2)ax8;+0eQe~3V^kB2{B(SJk02+mIBs!_BC%zY}XG7c`Yi_HLf9W@D0Ww z^l3@E+7+M;l~%r}%FvN2ZT!x5_)dL+K5+&n>)8Z$%{5S@Sd34ys@LjfpG6rv0|&zc zs#-B^-?Ewfjo4aia>)ULvE`J@CQlZmJCzx=(tyF|?!g1kM1G*6dT_~M=&c^Jat!xk zaU&BjC{GpZ9@mLl*qoWMozhU3PS%kx*!hnyD4AzI9^-o>D_MNJL|nahCr`TBvG2Ah zdgRgUJkO4`C||FL2XG=7*R_}EvaOa#w(TFUj?BX~kuT9R_vZbXD;aOzohv$c-fw=3 ziRuVtPRn?1ueTws3*JaOT>F>hQEit~Kvn$5Xu2|6*4z)4Vc z7AX?JzcwL!k1`(`7x(-_FmAbxuljH9zJ+|%p4AMob zVvXE$&U^2zOBVDreFlj~$6S;EmZC+0(d*I9^2m8T&S(k7y!`?wnF+9%IwC*w*xlkAvG^#m<#wlH+~__>pLbbeWKOpAMuRayZ! znQ9g|x)^X(jY;x)J22(?OlIlcl7KfG{ay&LI`%YdbaZ0S?>q_zX2GsCs~qf+K1wxccMO&3|_<88jJee@Y)RcP&-XzK^Ku)%)(?jn$84k|*KNU;-ns2^#cM;Z^U1DT)@hGKt(J60Z1r}W z=K3sz?NE-=@?w>zb>1j~hrE3HQF;6-h?pXia_&TVQoQve%+urEig|-4-`01k+FDO1 zNHJ86Y~M_ndawWFh)_hu8jTR5%t|M*kBg2yxyxYtWq2@LMQUdzGSks8ahk7cCc|<6$}L?mf<0aV`+O95Mo(TaC?$S#}blk1JUui=Z@->5q--sG-$ip}|WOCl=@5 z)vPCDe9fGE4{$8K98g`Q_vHW_(Lq6e_UP2Exc|Oawa2QE+E$PWGZX-Ncf7i9Edhihu$N(y>88dQ6(31ZfeF2I(AP z8;A-+N{4hK-C@z8LkvAC-Oa#I=XnR+Tm7;B=X^L{&UKv+n`>}0Z#=Qqz3z3d^(;gB z|L>nb&-JgSjH!Y~(^*=bNrK0?bjp;9>O|dEO*{FgUa9sy8t0F46|k*Ys;9LB#yG0s zm4;{zmloF@xtA~%*O}4qd2P6q`_d<>wv22Xs$mG6H=JQN`NsFP=HN`GfLnSYdHXok~ z$$WfGF4dFDU@^)iJ$d;xPM4BJ^Q1O%WFf3;;lc4UH`UKRXY|Uz1X(JRFa@Onb~=D& z1h0-61;H60-xr{W`6LZ%5^3G?Sj$*`1Km~9=Qw&qtg2&7YW=qlzAeczA(?R{8aY18 z09%BC{)qbK;^%rcE8J_eAk`z|P8Ew5?;W|v(CCN>_E>a;>pDdim6Sx4UTd>)Yc>aU z!;%X!k9jSg>m{fUSD1hzu8aj+nyw-6ZHdEK)eUB9E8z84;wHn+^X3rRj^<$qv*UHZ zKNR&BzUIi!%`5oW$|cc8M*^mB(iX$!<}>@8IL7#*%$#jYHb1IFg&(27zG1 zGv}Uj((J%k20c|i@o@}%8pX>mHh}zT5^Fd|#b!PRkim=_04S@x_Rsv+JS!5d2w@YmjbE)B?bBwU2 zd1tBuL{RX(6r`V#3H4mb?_skrvwO((<%G*vj(e(`a5A#y^M$U4uTw2-bw_t%9PAds zu_xh-0oM|zA6g&;r8qvAYLY+a@Z!Mg%@hWCwB2~!t8b{{Iz6kl;A~SlCkQc^C+WoQ zrNZN_J-wy%*CbkEdCTbE#tZ#WNl5IcY<4zTG>?5b3m7mes^KxNKqIj67-^Fzp3gvw zDDegPhzs$@Fks#qD_M^OH>*N}>7S1eB$hex0f!d^yrh1F8~Yg?zo998mv2YPfiG{n zT>sNE91-@v+FdhVwUiRB7kq@|+^WlyQgkjv{D*V0c$*3c#8~jhm_M#h}yc z=A4a}Me5k;VJCZbzdozcoOwCgOGRwGpejhj5jU0AQf52SOiBsbyqvX??+hX2(8rz6 z7M(A zHog!ppKB|ncJMVC)+P;Y&A?sPkXF@+ny>2vHsRpB@u<|MX33S<4!ikdsCdzAawzO# zaPv8v)!&xzPyFO;IXyI?RQpoGmzuZA+rP?jz7s^_Nd3Y9B_7CqTRb!}#Mq7l_iZ@} zJEtCL1l)JajXQ7e;J0=(J}{k0_CY;7Q~apRpm5cUO(tG~3ze2~TbApJ8CzI0GJ^Ze ziSKKavv}p>;jPXYui0)&`_+^*Df63u+ebwfR+u9va&^k%vDeTJ4i2EaVaS;7Y%a^{ z$@70Dhz+iENb&%eQ>qr{)Hj*LHA_Zpj(YKA6+3*}rCZB@Wy8*5HHNee=V{)si#7X3(F0K(&t&neidi*v}A3v6ak1 zsn()oAz^j_eP_5wHOW&0{ycB1NgHfk8LcDVp#aLv-=m}_41zu_>Yi`+nd(tIH>xfL zn(pM!@B$IrH^Rk!i@c`6a{D%ho4%*Q007ev@B8Aq>W9vF2s*Zfg0>@m=p;i&x`{J% zvD(odMap&n2|Oh2FUuee)oMgZxy3u6Wb8g)Ki2d`ik_>T*vqW|DX2TG#jfAZ7IFC4 zDgHFI>Efzomivr0JFFu9@7l56yD63cC??M2II2Y1n@_jLinjUPEvAc~H38<`nxNK| zHucZ|=hX2f`nw~$dPfL}qvjgT$RgSfX@`>qFw#pJIhkB;mMwYbXr2<}Y#`Sdfia(EG5U+$^iN!6$jS)Q+GS=!$ECv%A5vo_cYXH1K zkn2l`6#AUKpUG732xh>?ook|8h^>+^5Z|D}Ni?;T1HtHpr!)#SXoWO`CD#@Nx1B@b z<4%sKSNKZ=vf#DA2uKUe0fb&Zb!KzVBwMs!8M}$EDMnka7V%ldbv2N<$M&SBA-V3o ztrO#xhNCMN-;=nDjSrYz==`K--zFfg=-X8e2$bfw$o{WMX?NA#!(^{~dB!I`CJ+BE z`t1p&(dUHgW6$KR0=o7N<$z&4VO;BZjPBhoZYHlqL1@V6S&m}`oHOENRD^e1Rkwo3 zrVzmSU+z4>Ce0V~-m8@=dglzzQscAzerx1=%!|xDcW^-Cc(TSs3VP6OCMT6`B~(>0 z$hl@E)=!g9*^cn~N>4Rk-ci{dou2wT;!PToqOlr`@gWuU`g=I^!{_$x!cupTbVG+5 zH;EPURG)`X8mBTr#D_BB1XB_^ttL>A0vyC-^5X&9}DTYrXzf5D@%e;!YnXto48WTT+Jc7sP zIQ))xf=H8lAW;@0Zj;~lZVjziQWY|qim7%lHCsicav^rc^mkJ(cy4?fe=!}nY z2hdP{C9h`CKX|^uX?iLcx09NtG3^P$*xhA;e)4RLZ`JaZ&!)p7CxB8KSH3l9-x1ky zL;S3YByz1AvJ=^>zMEAuv2p=TlIX>+KMXeU~EWAIX#03o&b!x3u!pPnZ;1?*TWsU=KdO5 z{K(7ia9d~^dR0Soi|AIq;gJWsqBj}$s(Ivh0UlWS`$TUeaQ)YlK5p$_M-$=$Tl_$v zsd)>EYqB*9?|^2$D%cx4$Qqoq0k$c$b-k`qmf$mq7dr5~(J&q;J{JszC=>zPEP;q}xKxhQB?Yt1=DS$y_oF!h zNu)xhgLW@x`-`(0Ci3I-M4ab!Iyp7x3M+y-WUy?R-Io&;K15|HKKAfTs&BtQpuIWM zx)9@$nPy}$QoeP&COEBRxoc-ro9Bc{tmErf)K^ot1?P`V`z<-*!)LJ*ocevblr+ML zcV$x&U4w7FVaTo3IJ2Mk={R}ZUQ%&~8;Mcq>s8f)(6-?66|St4A&||W_%yETo3o9# zxah|AkajRy{LVI~lO>AQH!o*HLd4_+`JUU%D>DC^jE$~9_ z+cljZlSn1{dnYBn6!dJj3+O2r<5+FQ5eo1a2fcnBym`IkdqKssuq3p0vBR%8$kT%chBD%NfH{Y^a$t6d)-il zM`rhY9`5fqUvAtvZ=t!^7Ro#1(pkMeJv} znsFBN`&lO7=R3v*tSc2j%Ud1iz7S>wzO=$h{Xw!W;}KH4ixED%FGVLXq+OTr#p%Kx z4b%C-qM+epx@7g@`g@4qOO+1kvPL}wOHIy7E7{rr&yIGb93t5V`Om$9PeZFi>0VR7 zZWF~7&k>-BRED8Cj%Q5hddhaAgjyCe8#quR` z$6)|Vr1Xqjsn&M&`X(os)&e><)$vnf43gNirFw->{ltGJy6SqYDoqoZZsN_}pFgBC z@cS4AJthzf{^w&Zk}s-yj}ghL96xAQ4yt_nKjqy>LzBr5oPH-FsGdz7WN%~3!b|{N z+E-KZ;gtZsqU|s71HZC)`d)tKkY(!6>W}}&Sy8;M@Mn^dh6+?NAd8BMr1S4tdXVSh z3)B9Y(g)=D3J=Gh+L)J@uATIQR(W6q$i{z6kNj;^2=Rs_&CC)m2$+Y)0DxB0a{(Q_%HIl_1IuQp1?yHiHBF_( zbNkY{nd)@%a{u})$vQugk#6(hwqI2*Y<`c?!5#zv}0ZT`k1U)6)tY<)Klx_^+lDLET|3xwJ6YX6 zwfa9ai75=cT+m`wCIA5F2*CG11^0_~0;Y#Y?I$4(!X>bffW!;BHXR}E{KWdY(~7i- z)oN$w@wL!fJJlc|AyY(PyZH4TM6J2SsX@^j=k)Y5j6}Adxp4B)tttH_FZbY48~XUAy^u#Cqocxt!p z`lR!OM+0v*&wQRy&(pKoJ)GSB#{Y#IB4@Kp(d)g(K#A4ESCEzwguhP0lL?QT4J+mb zEgWrjKT+wQL3APO)ePTAh}45~p^UpT?(^0dQvL_nW&*hVLtaQh7MDA%pN2SgXko#r<)ydr_Qgq7q8K7+;7a1^DR{ zWOpI5?uUCI^J$iPZ+a6@_hyIn#%7>Y2^0WUE2?;GFExyT)sZ9I!j=|u8F$`lf~X!G zK%;A2F~!_bHYp&YQH%zoZv?mw&=d9CigB8c3fz6L(%Gh*7-jR7qd^ovcm>KSL!@|* z#dC02&=5c2?s{o$j>tBY?W@Vnlhqc#Vh!3zf+m6w>)bS^Y@F3)|pl<&XNXuo&s0b^5j+m~Cx>}0ytehPzFB}(3i*<@h zHz@ABu~YvN`^#?ihOI)i&M`3RYEecg`t$^PDVaPsnl;hW)6SkX?k;4%n1M~a7NegF zxP1G6(O2C~7+hJW$|c{1F^%|h`B!lEL@2N!>GNxl{?U(;B?@bH72_{7Y`Tkm<4dPy z{ltOHZgVWW<+RiVWk((Hcgi5M!rYN>*Z}2pI01XcRjW@+)*-ecZy#(VC--s!$KH@t zNsSbmoQl-Yb4?M>FF^I=lZeE}^}BpJs}X@Hn{%MZP)7cis)i#kuqIi zR;@g(BlpCqRp7-swVsG>xnf&YdPhCsT0zcf!~DmBO4E9){B1zZkcsvvp4|q&`yp|S z_J~^*xqYrvbgQRlrjzV7L@##1<=2$QONZSoTy=(8z*z$pitSyh6t8*o^>(8wFY$X} zlxKf&nLd`ppkiPL`}m&gj10)0jEc6n9X8!Iu zyLyC5=RU}Dqrt&O48S*;Y@%_KIJ|9kIEv9HbJh& ziq5JU5a?G^w|J+au#7aoKMs~b8jJhKz~^TfGc7!T!}9?Dm;szL2$MjzD610u}>Se{HF(As2XS8q`}1Vq3d@fT;$ z|Kph$==bXlfY8=X0$*={M{6#})y~}q?ey8esU4n3jv^Tq+L@SeK}Pe#gWH=cZ5hwn z<=`OyVQq0Uu|`Bxbj;@%U7!%gqjS4om`mAfP7L%Ql$`W?0yF^OAe9i>(A`N{{BAKl zDIge}3eW+0E?1shZ7#AKXnvIL`ZXVw#j-`a`Q$o-WYU;LanKS--}AQx;4(c% zi&vhTgD!*>HCcHz{V~&1RdnvN`E+T5B8H&LQnpTry;dq^-W|hC{}SB!E7+M{Lu6Qp zqDYfisxG{I)%?X+^qGI&7dYM7f7O1XONQz|=W+@xu4-s;9m#6~iOqlx5+^*S!-p>* zNP?OQ3_&r0(7&!*jL2MIvz+IP)ICT*v#o6sWBY8<&#(WlQebj1H6MJ*g!}`-NJGO& z{XCC#9aRwTR)Xhrg^DSdbh zSlSvo_jG}W)y0!;^d5`v=#T`?LNcI2YuYTzzg~@21DrPYu%jWv!ay6|*X1JGmgZ^L zw)Kl!fiZws2CDiQ@gqorEbAJutaojIs#t@^zM^)%%P0f0x$<527X+ECfJcxZ-K!N~ z37}K=j7aM#=2vEgRg`$Nvdp5S>3vbsvr0bZT7JVF4oni#L}DhpP`)sBi??&l;Tb6{ zvudjRR5xrYMxNSOH8%czLE$hc>L?yxb|*}cK;d3+bGua)*G|hR*H;dUZ2oEqkE>DrlpsqzgS^NRu~IDw1~iJW zev$D>x%TD4R%p;KyW;tNKMGP%5`Fek{0LYq5DghQ1uZR8q`NOyXp*C*lbftVZ*C zv?}G=mm!hbt+14%vbvR9EaQ&!p0upRn`%SdH}rwj&2DS16nhQPIYZP88fmwD^QE`W z%@OnAla?P^*LvP9ML0#A07M!(-KuPBLDM)>8@*qqgyFu%Pv9Fnbd3*GA&hE!<6?L4 zLF_J_;ePer{uh$*JeCDLG<{G}@qUo*?F%y|P=D#uuO@WA?vQ=wr*rz<=GXJ~Tn4TGd1d%xwqIpZy&W`-lZKj28}vS61QJWovnVK(v|vbu)R zfJqJG1}hj14oBnee3G$u0kQgpc^rqz8?x^Z7q@GyX0EyZ%N)Y$;_8;ehP={f_j$j~ zZ`n7l>#)>Q?HAcpU*iSz0e>lQq?S;{y~X^3hSM*~R#+F_zS)DW9*#zY0U!Yd`)e4| z_%pGB#oV27jEs&G6p{D|i>tunAS%v1yHQyD(GG5{!1PPvGCGEmq}b06(sh9@mCAUx zRk4z8E&gV)p4Mh|ZOfB>Y8x1;##ra!K0^h_2ne55oj?F)*)6-gfUPK4NRBiV$nFJM zyejBJa<)W43?_d#X)9UDBpxD_k1qo7-_2i6XV-WMWh(E5t;9sCUX4Wq5W`7BX_Yvb zZ|LhJEe=37E1=KL)xN+w)mVB(@$<4UocO5;Kl`u zCXqtY>8@~T0#~RoX%>JpwXEfFF8ux@f~@8i2PqKwPRk_T9Y`XoxU;%~I;tx^rUvgA z{Ux|KL^!oi9W*<9d~p{@cvisfZBd7u)%X^jalb+bu+%O2d0+sYJ;xo(zzmd8n@Y9ePLrD?V>;MVN( zT*{+qX#FyB4M5_)z;3MBttH4D>6Yhy+U6f-0N7rid;5(qUI`GLgw|LW2nJbH^5X97 z#$hAZG`MJy%uN8xO|Z0DNS?Ay-f{^A$6>%XuB5 z3u4p)=4yG&jW2m>?kS2b-O3P(Kc%)AVP_(5LVqjn!e*wM6KeB^50xX84|5@oXP(`^`dGEu=uK>`DLZOs32&Hs8Y=X@N zG^d>vcCWu*|JP#haX`w(Vi^!hrNMrRq4x>U&9jRlQ%cd3MSXDk;z1Njh3ZXKmfY%- z4=Nc(p6oh#Qvk0F%_O=!&b>>|k!!(v?xn(tizy z5|#%+3*qP9Tx72!#0zNgAY>nj*!{TLaD&QwO_l$Rq70EjFXEN?>tvjDMa<7HJ z2s~Y5@u4HVI=Kg_J>Cs%r~49InWEd!;h|GX0(*(_hiPpt`P4ziw%YW_MZ^HwP@YhRk9S699_J#bw3#qW<4WjLj`<0 zpM%+8P_Xby=_cZ@t2v3N%>`fCInVLg?OGgvw{{Yy7rtW+#aD>-zurYiXo6U?0)*U~$LLg4J}4 zY}&;2*njLrH=;!Ly7u38jvUvZy`%3$t0yzk1e{|Q2%vybL z^^YOO|9a_&CCK=^mOpIV=>4oZ=4kWVzjb~=^8d~YG;dI3+XOr4frz$=p<&E<1;*L- z<(%%1tz!}WS1MPD0N-DKPA~r6ny0}W<7;k#I@}=kpvRLr4qbK*NPC$Q=XoJTCDerX zOJ1#0!C35nWTcizOnvU2cp61noad^zN9-^ z6WpQU-=KbYxtBb-4>Hb;=`flZXT4D1BNX`|GkG2_2O{o_+4g>>ejnS_01v%K-~m-zaiKbF{A zw!nH^Z1^$KP{G36xBg{HezAG@Z#0I&Xh=YNOHoy}j}HzqjStR98-fj02{u&3NzZ3s zX(1^V4%>2w_p`w>1GI&L0m0{knY|-$wvQkm$$GV<=O7?DlpQU7f6aHHQFw%9|Vf z=AgTin{wl2qt6DOl?rY{HTgkr=}muX0ouZ@&Yt_Z^MAP~gYbUl7}SO8v}U%SDe+mx zcaJ-GmdG39>smEQ+EV|a>$b;^iXJrWZ-E#Kpjj<2K@GwG2gjZXky=iUQ-{X&Q6OW4 zn`v)X{6fk4|B9bVa3d&TczOf7dSt>YB2{MRA`L4g@yU=s_c-2YGF*nbyWNLYDT^d& zXzF&q?$bFSh@Asm(gGacR^&g7jwg}ZnfuyMMR!WVo<<4~LFsyaZ&y5MVhb*j7kO$} zXh0~_`2%UFZft>- z11We0##nNB_8(XL>xLvD^zT|Q2liUF<+M$jN3Je21EZ}=EOK&k8Q|;}t3(frGSHX3YvFIr73%|*7Xi`VC!XYB?nWbz zHYX@Q-`MfzSDL0MdOpy%pHK#^otx?icH{}L&s^n3i@q=#jXpO_@v8M4i+_Q1={xyH z@VO6(V7Wy7XmA*W#Kx1p&d-deKzv099dRQK^7jwkFx*CyaiJ{$#~hy3b^kyo&qn?{ z(Nn{U7QX`Df}LfFWebhf9ZFN0$6(mD))zuR*Z-FOHLurq;dyh#Nuaar;0P9k)b||G zRb*5OCzrj&7|3pI#LVs*{@rm{f~*nz7ZZI)f^0+V>xwt@FBM11;G+^jV%L;Znn!lt zsd~97?!Mhd+HL1cHEr-Rrr5*>7lju26qqW;bBZ*;W#5dGaaGcfDC`7uDC};JcEFu4 zNg(5+x630IB&qy(fckL5o!pD;`~KD4N;DqnOI63X3438C7Pi)RYv^z9U`b*@pSk$)%3Y8E=x35(G(;>EI>4HyM9a2 zFq%AlGZ~(dR|M8)qOhw9{kOR)^H_-~k67H0&w~BDSNY!9Zupk|zaOyWm{LS-#{_x& zO^;Jc!XGEdcPLinjB52SPvdmQ;sZdjSB<{(s`KA~{aUVozv+5liDYix*^FnYDKPVe56|znZ~0~WLYoqFb1~V;wF7;^pZTc~p^pMikIkLRpjfk@ zCFWLNxmWG%Kptu6R%JBHnlh$eVpAPsgj{c$_xX*G`3K7cdimVIvIXa|*uIp;CY2Za z6{vMlvXH273bVkSgw&6k#W|3JrU#O-y_XJvh_H`@#61gx96;yt{o2usxk2Dyjt{P9 z0##pe#ox-Ped8ah+pjjouRXsoA3rOynEu9mCOMYRbk#-jpo?i85#ulzLYfEt9s04$ z_~m7;r-{-TtXys)#+&&=?S3I^@VIP;1kdoE*82wr3TEVQb!+YMG7VCYL76T9!?K1I zsidFd(nY0o%=Pp%<<2*_gzG!VY6XZK=tS;Ox@7TL?8a|uC>J>wu=X=$?43zT@4yPy z&g+f&sIorJiNfjr#WU>x&j9`s6nU>4k7Sy5PF+WjsV%)Ny-c3!qe7*#d5vMGTG1+y zU*9Fm7PYfs9mSIKF;eCrkfp+ufSeQTR-OnN#z~$Sw;diYjcu3Fpfpa(0*apW3+Ug8 zr~O66p9A}QO%#Hvn!Uhs)Kne^3gUSw=Sm@&V<}^SR}WH!c{}Q_&p^{>2PM0sI+UM*I7DtRzi06yUEzSi9yF3;7Gh+1t*s1?eRVI zg!TO3a>hiEFNspHitAnKi-fuIHM+eYQAUX!u&)mh`mqN- z6dAuA_69k)Dy6h+5gPO`%3n32ikqNd`np!gIJm~ekO9{Oi z^dD2QTrFgat)ZX!GW>C&D%MWxcXoPzh#PMc(tTWjCJ6B{7-mLRWB&JO$z0{AZ@gz% z)P#EI_q20iLXt7#*WPo_MIZHuw~M?`_EzuSvG)`8nD_t>x<%Kz34-`zJ!EqKeDzvks^y5F_iscw!7t=s0S{n+i7MxnuyJHKagGuw;X$Yfh_ONKDT z(9NJ7aW#uLbe++Q|9quKH_hg5L%hNSPc9-(ElbNs|54EKPdp+!!|nN=3@eW%{m_bD zB5!jyNEo~bMtQuqj|A2ps$T&gs@`?bZdYATB(1$SK{d1eU}!);8=a}F$(_E-BkZ>N zglJxj8bNVoNp!fQD!v*axq@}vt!c-gH@8H*^d;HqFjqIqpTx^;lz*i7fq@_}#PHXN zj)g6I%)-_Pb#0;gVd7B5+SulI3&vM`_$HgyC|Qi!6Ynn1EDR`g%;-D{P|H%$TOMx< zdCd5R?dSIUZF4D}upFpi{3guD$HxSZ6AOO*nz`1pk2|b6{t_sA2^(pEHwGm&v|{0U zK`hD?wQ?I7X^;P0R3PiuOpJSvDdJGNJoF?bD}2K(`(5uUe^8a{Rike7Ome^QSPE>{gAV!pz|BZb z-eg5^FZSvXVmb7|r_q--JxxNGT_z3w^eZW{XRxB}qTAe|yHd`SwIi_y>?el6^!*1o z20g%MQwr9dc)ikHQAS4HWus(wu@g}T?GqS-5`)mu`;J5vlw)MHUg3MY7-yAol%`7U zx@#hJXph0Lb)^zT?TGGychn|Q;q{#07XtR7>OqoR!YT%_{A5yNbLF8llhiR+G5G`U zDb4FMNaNjY)*N5!{VJ{srpTssPfN$%PbN-``Y}m0iSgI@kdF&0mQ7c6{&$8LG>DTQ zY`2^J4ejl|hgW=1$;xrpE;S(I18vYYXGmLnGL`#Af<7N)Kn@YI9IFvv zjgG5p$hx^{-Ktd5A`bny;KK5!CxYIZsRG7czYsJ2gh&>tVV(@OH0t2(EgAhBje3_xVHJx&Ns!(N~tq+p>DxgjK(52xaYl{|6Rj}2+L&{y1zTW z8Gi=d(`uAB)ThCjUhD-%+~#d>&GyX6Qy zMq!&<&;GjjK^I)2k}lrRWxYICYQ%*8ErtwTB1C^32KNU*j>U5`tTx}BZKF@H9~3J$9`#XsiFtaN$%l{joCg2hhXOt-AuMb0 z%1lakJ}7AZ?>ar?bAjTy$)WWU#UY~^dhM|cmdcjfYtuxp>SS{{byJI~u2Pe4b9ckrU;tD6PP@yN;48JA9Ptua{M6OpkOUDu)VEnyhzB{oEx)O*2k|=`EblMDuwfZTrRY_``F3z4$Ur~-3#;VILTiLuaSHZVHj^S*V{dN zV=DB1WcPLJ;ero?TICNkn;Mg(T+%FX$<{Z_az8^Gq`(&xb9jnH|>_(u5zPOW6`2F8SgEH2;?jwF)S*+yYi~`0G_TAZf5L)Qx3u9mzqDpiSP?}0Q=)ru*3BM2lks=KXkTGGq zlN)Tq*>q7JIZYwp8H2HRPLjyx7FmC0Y8nu63InG>Ml;D)@Ag&@OkSaVT`C>*x{n~Hz|P=Gypz_h>!Ns?8z+pTCIqZSklFcHy#1`Jkm{1%P(&cn66 z(fl}s&K9}Ma#Ar#iuUcBN6A88oNbZf*P~!%e2{oh$qS78taQpo?7$faauEgy_}C3S zYkNpkY_7KM!o+`YB1FbVn(%Ffy;12Foq*`=5(~7JwHdlzZLt9?Xk^a7Eqxx<3Wtv} zNYI8YRIw(l zp!itka$lQ@Ce=@ z`%qS;+;C5RbRRgVcw$T1e|o}rhCDmzy(3jKc9@!`BuAlk{x9Q9HFgea>Z#zkIBTaE z`NEReSND&}Qm}sDQ~ez>>|5hHMjy2onDWyhu&FPEMNz<`jSwHWQ+zB>AE)w;z3S{! zwcY$zhI&rsNtZV^w-6DcHg6^oU=H}kIMg{=H27-6oM$YBw zdKb~|vSFMCdYD2i199l-sRJvl7=(!NOHmJ6irv95>H(q)!gjZu7Ix)8DjeqY>kW-wKSFF;(?5Tr$M^J{OuVSxoYp4lm@5_OI>Q2zxLPu%&~ zr2R${zs%Q6U-%)+C*4OWbjj#G&HxlUL|H{^GmeD>U4D=P0Sm@Iu+;pftC& zpwkPUUpdfawl}Gl)}xs-zU-kYiWFzu*2b=*GP~CZj05PznRB!-tnqoc_t+hSn|fj6 zZPA-GyHjcYeCDg?sn>DZ*Hu;4V%Sle?TV-ZWBaCPp}d(;vxJ#x<~E}t9R1~}{@^RJ zjjyIu$6j4kBxB#3E5$S&W0X4LYWD7ExDF@KG%Ds+ES~`VE0BiTpwmehD0kuPcUtV7I-y~E z*zXn}mU-d{NnNH~sXKj8yk|et8h3?~oA{EcbS9m+d-P~i#hSTX%eX>{%BN*!O%>!A z-R75jg;~kW%IjXcQ-O}F2q*9Cd%NXo=}L;vY6Mwli$-5V+tWu?W}AB!rPxon^a|4# z#P1~P`Tmyc{3gM5&x-L1$>juo3n#1hAMehcQw-5dmNqEQx#@1!nHr{+sm5!DK63bv zPO-yDS<4!jTL#nU~!!XQ&FN@d^viRIe8(uAFmHI(4LGYu=q& zaF&!!DZyJ4v;~;t4&#WA4a=k$k8?SCe~vgbieU@)`CT7~apBgdj)_c-*s7!{&OQ3{ zz9x6!C0dV`J=$~kHiUIwU2PBCnxA>iWq5Lc`oteV*X1&~%%OFpWJ$9))-fD7vzEtX z4gw9f13WY7HVSdGJ4R#;`S+ykeY27teY?SDvuj75Y4SSU&CU#rNy9^FOZd=UEg~d#AftLoMbNt3?8<} zaH&c}GT$bl5@eAAofxhrHbv?DvR$DE^<%+rSp>w9MCUUro#Rkp7`XG7*Dj%%mjz1$ z&bL-TKG)2yctId7S;{@}Tfjxp6oaHJLJB_kUW263@E|pTOhAi9cBp!e&2sl#d>55j z;u}Z%^w__0(1pRU&8ea$JI^+nnq451_G-{&ys7X?{I6`kOoiNXMM0}w;l%Q7qvnR? z1uuQ_0?Tw>;Vb$NH3-L&n^Z^R-04@>zSNw%Ok?`@*%u~<1X-LDUJ3f3tQt_JsYal& zDYI~2|B%3-J8x748@_MIzwReclnD5(Y3XbtnIUDn#;*j|oBY-7MoBubK{VYR_7|$= zZ*AV|kWk6dx=X!y1LMsHd09H~t><)y>Db?)GEjb3Uq{=NTJ&8@g?7;VjDSw7_lEA* z!(W%&4n=L~8pS6SK5PpLaCY#^Uc{t~x8nE{L!MmD;LqYMF{NZJ=AmSH6;|QM^D0^U zQj6*P2}b04C^!T?l5a^XkJs_VpQ@r8c;9SA9SGnlGcMnSGo6Q+R(nzJ2)y}ie|>%_*NWa(l8&| z!L6UVc4KI7Sn0YkqS^UfRUbhE(ge)nY@hwux?(J1=!MDW&sn9G0K-Z=+7nlqcuz9c z7{oYEC6!l&)B1dRol(+5gS&PX6_LJn^;>gR?%LdZ=7OQZ_iiljZ?$=Vf-r|r+FgGt zeY(pl<6Oaa{JFz?=}!($;I#ATN5&QCGd(_<@D~1sTt%&U>#91Vb=` zrthvQZ|}d$R&V&-%!5FI6~F23fH=c8=(dVuBD0dn+_@=9I)!@e0@JuqZp3m~QV^q* z3^ERmd(nrCrRH08blrXGbDeXy;jt-fvSeT()OCewqnXrm>^5lE^ZJ2TzdA{;^ZTx^ z@Nn*-(N5~C2yE^4_d}2!A93iVJf1{6Ia!U?$K0vGJuJ?%cBB?{OOEmKRKQ?QT>#ww z7FqDOg{qmYxRSz0?=E~XOxlib>?U0BKhLe9^QBQ^9h4OWxvkM|)byk+W2kpiN1H-U ze~H*8>09vU_fdKL6dWub0zgIMytsR^bkJqH;qto*!MaaRj3E>zt)oI%;6RJ*Cdx2X z=r}{045ZJ@rs*>ewx9UfZ7dqdbneMfmXE!TMvQz}nxYsH-UHK+?@xjT{zRrX`Sa@^}{1|4zL1(tnwn)%DM1!JX{)}SwA?IJCq8QP@* z;Q3hU6p*y~WsmYlJK{kSZ-ApM&w^QG7!-Q7y!+rg7SkM-g4l{S9&6r{ov5tXoG+%g zNRsNb>@Si59s6vWXZu#d9j3d!wC3;F4fvpHC4I^0gB4?~g?1wO)+jZr$GuWBmyKJZ z1avc0KE0*Cx_*&$t|=R+?Lz`$MUGWXWalfy^Qw9dZx>Q`##Or~8^0X40~O0hi-Zlw zIs2;23fYoY*7Ce|35*4{twR z2Hs_yF1GOHG&j@lp7e63DAK}tq78^QYyN%~vnQJzffS~nyMg<0k_r*w!mM0>5?i200 zD%B5jyv?&?g^pEk6r`6jukV0P+kA$&E^o#*B%L_BhLG9#KoiekKFhZN0UG|VuH{n; zvDZKN>mT;cs}@wlk$JF<;-+2Pk4+8Du!S5FwnZ70V{3eGyzVaVc>)Mn!KSj86LM23 zDXob0i^4nTpqkz9a(Rt%JY?&|OVcfn<^N9619jZtr%H!T7a)qaOh?^Sa{8M_YUo_j z-5X=ob6&hglqmIN@9H-aHE)uflifOX@o@j#<~`@~w1J@jge{;e7m({%zXo@rIVJPE zH~^!VFLloquqcUKOta=mA`UGb?$_%dc6sSh!nsn$S3T>at{dGJjUf-bwcYR;_DWvYuebo)~M z!Algt8Bm92n;5G|nt%$VaO(KNFf(!IOU5cc%<0;~+Lq^-E1uhmA*;C-o(R~hmR(r! zUX?lOE3M5*EF#M~wx7>>)|B#UaRdF_lCVEg*KPA`jk~}z5u-(p>vIF>Ak~--cFHC* z5!~WxY;5JxqO2vSA=Wn&l+_-XQk&2O9d}|I^7p@*xM9W+iD~?)2V;UBsS{qFI8#?sFebs z77!O2`MEcx+MVJq{|ATuPs+}>yV7KKkXh?+k1kv+#f6FXIBSXs&%GVz3`c`STNbx? zW|6jdp%yV^TsIoiSgZg)dK<7pJS5{L%v8@#aMtjr*Xr2b9^n+%oDPMRIW!TnX%$J| z<8vo(o;S$*3J#?Svl=Lk)}?YxlNh?b*rf_59SGP-k9af(f)?|~>MG`CM6z49({Ds9 zE-oaBN)6lFOd9I(IoEmIjGG?Pkl47NoL7Nlc@^a5I1@2q7!wds+7qODIalB{(D`5C z%C({FQKeiSZ;j$MZizE)?hiSZBT$ZLIJHu7mLZ1M@U~CrL}PR zpfV(_A8VC3TyJEYh^;rl_}GoqE1>4bPZ1Em>dD8hOz;G*mpUyA*yy{j4=Jxziv%1F;=#VBiHOpZ_tW)`USs_xCmo zvj*)kN#oDwl>nyv+qn8Acc>m*Y`V7=1ZgeP-4-8u-bi_nQHwFK%5-L+Tp&tD@d?0= zCm1~^c6mddFI7GwD;^j@?2dg9|2lhyqbru%vG8w&Xs=U#XB7xjcHT__d5;X*8Y>(} zG#=Vj@cRV+8g^$SaxF==|v{?%p(5C#( z`UKwCUo?Pu5!YMwivWR)Q`rvu8EG)uAAVJ1?7ha2l>v!8{HVP=@zJAG*%OhZ+PUbqB zwbod+f9>qM$H!6zhMZ+$MT*->=R_}wTzpJ1vy3v#T_{_b_lCV@o>-e1 z7|2KV>oF1Zl31XFiASVbKo!6I`{_~)!lq)HzSsVQwBzKXmqisdPqVidCYERIcMd;G z^K;e0pfTBkqW+2ze|^D%rt+e4AcK`6{jHU;3RKQh2fpe}LsQyK#Kv9-c~nec5iYa! zMQyA(&N$d+ZPNLo?_RENg@pcvUVsROILMs6I1}=A{k+!?rP7!#C+D&_<_D;ivb5GL zqhN(w8Hk3i*0dI>BNxxkV|)OvcjUCvE)6bU89#PJ;X{t-)<%Dc6_;^GtJt$GKplhx zCDljlmDF3bJ@xFUVa)a_D6FxD8x{48XWrFs4AmxO)d7(gyEg zLI(ff6v@kBU?8or;+G|@dYK$&x?c~&*N4No{*_`q7R3m!y&VioE1D+nn%iudkrW}wZhm(Le8>yK8`Mjc)-_ls&ZWvDBvegY zb2ixSu_BVBJ>Tc5@=oKc8RKeU*-T2)ih=qbOUAwD2Q*EL>o;e^#b0Nz$am+cHk=vQ zLF+@Ie5;p*m|_T9v|#leJ@>UMP2oK8u8l)nb5Af7z%Nk$sw)KQX(Z|?>csyM({ zuaK@mnEx1k8T`c=E_Q&xE`!Sdm1?II1*;UVy@?z3pFivpz7E?Ax}vHTuDBA*;2h=q7>3AM>JH>Vk)b2U`Tg#slmMwl@c#A5Z%93ljr9d zFCRNOU~ISfA`F$era++P#_3#MVEmXc!d%R0Ra$s&JId~B9RXnH;)Tr{=p1HIo2NF% z(E4rI|BJo1jHh$>28pYO?Peh z*2d>K?|J+@XT0CfZ;ba3io*f>UiVsS&Uszeye32vvLRZ?Ep5++8LqLMIY5m_`GrTk z3Z^|4e}tsE4}Fl#`eH09=}0_!Sp~q^4Ve36bO^Qhm|2CK1&#bhJoSK%qod-?ct2?g zHLE#tnhpZQ!!jSjGRtgz4~sWr$=5M;jn zi}*cEUC%4~LPJ7kE05#nI`@{l!s#OzOgOz2=67cGEx%4<9$wUV*jb$0E(OR6k(ie= zoxLBpD4MaIr;b+i$;(|fm|9GNu71>oWZ5GA~?}T(hyM(&WCrRHzeSpRowJ z%oY~^2Qfx^@N2WzAU69U4x_gM%0rInK^^c^f zvX8Nut;idxX!6lotF(PVR)5YoC@3ma77NwjeB=3fus>m(VYR9ZwE>;ge^c$ z=^YD_>RWhzdFq&77KDYz7|G3zPV?3Lu1(+fDi-VW)?L$}Ru6;1z}JtSuTZ%x4w2Pw zO*k_-x|+KlYyRjAOg}{ZA;*pT0gG$xVTKHRl+x%!O$vbA_%cLbWi+2ZaQE}XqDnw6 zXYk^g4Mc*%0c{(jH#$*b>F5ll9?@Ek^SbqcN$W}Li?aME4tU}f z0S7=)c^@V(HJrs=e?3uNrydDWGlQDGT^KV-jHF3i-;i{2cRPmlFRbMv2d))D9jnfW zb*E+nh5IsX9MKzXMm%Xg<1&Zb;XQA&eU>SmK#QmKx_;h51~c3>-kgu6Z_LU67+IyC6Wiz#CV2VJ=ZJiSQwHc zIBceqDT;ou=e5?F7DK4pd?k|ytJghZI7~iB#j**1xaszzh>l0(V&mS{i4(lkiSn^_ zj#966a+1`E+68dX8~= zyeN0<-rww8a|4biyJyL%*DgR(m%e@jtgZbNM8QUK5CNHzH*GE5*r~}8NWz<)lkRKU zihO(`Wo_xa+eC0VnmK?Tp%_2*iPabk&iqpH;d7DiX>Y0KieR7BMCr2wv(Py(iZlHz zl?UY+?e>g+zvpQHwHi}2$Ar7*v&zz)D#ZdmE`0c2Oz=@z4zqH$z znbl>r17XQ3JSxdo#E}GfNd^0H1RfYjAVWNoS3tt!+Nmlfi+sq(BJ3=rRkhn-{PCrQ zsu1J4mt|1htxUro4?6J90`J=rH1J@g`&(|^^kQA;b_TA!QGCEnLU}DPx_Ur2hQ$au zwpSZ&ZR%*yC_kaWAA~+)Aop@3ZB^G_6WOSehy#KuVZU!XfGYrhy|>NRLJgSzv!e03 zBv&om$6A!1quh;SA90@o`fT%z#o|zFudF_wTh0^kBTE*SQ?eA|?@Ev8l#tUsDx@qr zXORmvtUqi9tEIY*R!D<*%bF=0u{M-@vgS}Tl07SC$$RM@QCfMiP-JvS^CRi6j79f= zA&NO9ro>osix=)bQ&QuLwJ9=ZMiLb9Fc)bOI74Zk^6t5-S=8u`643q+`hNAdyBr9D z`)_T*jRzg=z2Dx?4VNnlPi?vhd5#y-rGRdXi!M#4Xmfhi#{>iSfaFky*hT7`$=(RN z0ms(Wk27T68J{`s7x5N5zdQ&=Y0*aMc=~R!Umk0KYO?}8<45!8OApg=#suPv8BorZ zn)cC?MsAYKmn4zyP5aF%6dPiixlSF_8w2@AFWy`N|7t@~V~Vh3+7x5O2YAU`MAUT& z*f56=qv&s0-VoYVmNxphHAl=WAf6lY}K9pg57*BULo5zd>JvhgxpJG)T9e z!g_B#Rb?NgRG`lA^X$-vl?OLnxMLUziJ|Tr9me8t#cKn*xFk7lxwRw56%5 z&Z$xnwT6bS1&al^$-68LIbYxK+Z-)Y#D7)|-FfI_WwRQJw%aF~nm$v~EpB(QS5R|r zE#GJO0KhtF%DG|QFW~ic0T0-2;x(481yIh)CiM^V=Tui}_fg7?kBH|1r6FcYwQ;_6 zztk|~^4rJ;+McoaBGe?VKoxTOGPc5U!_A8Sa@lYxK)qgDA)&=e_v2yaekNd|F1Wkb z6t@A$YV7I#O51fIkk_mLGpsd`B#c#tPY_Vob8a46(;mCP4Wqqyk-=~%hZz8yXaeii zVG!aDV)0$u%A*$rzX@N3XaITU1oSBV2h*Fzcu+8ftAlZag=G6|J_u6mIN>x_;oK0; zq^&@&(iy<%Q=?L#Zm~(Hl@=V%q^y7tOISbRG>->k>2xF_n5cf}5Il4`60b9v3s_v5 z29lQ6a8RA+EB2P&Yv8`Wytbhk;Bx0qiD3GJffAb7XSM4JF1y)@cIzuo`(|WUB4})M=z{qg z{JAZpwh>xIlFQ?d1=3T7dQ;VoyTIlU3XMqWNTXAH|FCq*7i-DSdZqC)MG->6LWv<``Dq z5MUDY=tbWvJhsC0LAX?wsJ;cV8k;IOtq_L6du=L(U?155x?E=X0}pCEaX`8%SIpTqmCx@X>AxZf!Y;;?3L+yI|H3_zqkm z8{RhYT(W?wJ&alw^SK5uYqoRg*2+V-LRnam6LqIKve862B)!?OYat_!8#O=@2Z_Yx z`F6D1*||#$|7v(=PV1Wr^8u!xb?gSGN_`3X2X=0dy!avNzT7K znYfaNG?e6ZBK#@IHRnF9nq2q!GM_XK-}!MWDBfrGbHzeZ>eCj1nN8bh(fp!+=IL?u zoRSUO77g?_RkoovY3Q}Q;d;FvB2~-voB6kW9@CaCx_97k9WA?gf2Vjstf5+=;-cgH$4xis_KpGb@SB2PCndn(?)>3$?*qo zD_ZzTTuL*6^?LVFwbyyCr&2jC2#*e*;YX(&wypQ5q3?t@Rb0ae2UL~ zW*x0zpcEmlpKiE(OUUCY#ME%kvbTKz035^Bej_AqMXsT^1HP_GoPXS@Vmeo1oGx;N zh;~OvBDs{L4kB)9&>C=m3a$H+%l){p)XdGkQ6}PWigZKtLgQ#6tYV#eLVYnlw3jVe zu|@`-{K&1kM^OPbgVzQofGmFD_|Q@OfB^;id_%~ePsXRXp1wra=IUkgML@3AG><#=s2Z-&)okM!_ek{_&bU?lf8 zjeR7p)n&`hw_mPV%(YQD(-|ScS?)|E15&sfZ^$*Ugj{_phD0+df68%(Xb^3)coz$P z)J)S!=+ssSBIc(49Q8N?6NmcxC@0TX_-@C0ltiYZ2EEPoRfV!OP9(?YM0l4VMU?t( z4@Nh4;w&B-%+*X!jZy03GHErT3Qah#JbZF=dJ@8{TmN=GxU|nqk>)fs((&;T-?3O@ z_02LA$UK3c&2Rg;Ng6=wdCyE`JqHuWJHnaFPK%AZDyUUJ$o)#@95|Tp*yc*N3LDO4 zJUiSB0|GVQH(BoC0Ku&Pn0(;zlok#ig(u#z%Dmin3%ZHkP z{37D(UdO$x|LI-@%jaHP3F#d0t=FxP(II-lwxZ*9?z!6EleQuKZO5kWsnX=sMdPUf z4{-<}(;|R`Dw?8qqrhV3!%Y|A3zrr?VOg`azIof3c8>AD#18{&A0mx8Isry|c;K?l zz%0=b*(Hs=2w*T(B+<`d{Eym`?85)q%GA(R6A?jV zJ9#JJPj%xCX>=2?vEX6Dc?9eN`R(i@XlOAnsgmoS8AjLkddW2z4Dq+ea}K0CWGe(7 zJ*RT<&7Dkq#qqjVau=E__J%wYeQ)4$QW2d-DaXMI zY;c0#tPFEpQkKgZRIfo>cDpBRP7`~}x9H7>Y|z%&{L3Vxtan!fVvwX^`SF6fZq2Bz zc^#|%+j4NCi{U3#8RAP%_tdAn`(3@BL&)6TW!91CP|JxF*T-W=3w9}IWlm2yK}wgL zFV4~WFNS{_)W)BhZct`hq`2%6kn2QUwB8nGaf1FPifNK1jlGsve%iHmDW3jm@qH*I zLQp53;xOUcFVUFym;SDilr4L=^%g<8$iZF;zE&+lXkAr;)6nt4Ow>7|lo+?X$#2F5 zuc2g#bP#3VI(PiCl$sHbJ|8#d_9ZG*Oy5%GU=)Xz;$(Z^`OG9IEAlg?!mWp9L#h6q z9cm-?e`^8$!oLHOa}JKKUvOJ%pyi?WCk#7gU7R#zcCZ?zEyFevkSuw&66jKXXTmc+zux-J{_)JbgI4h6K(>tR@|t29{50`} zhAPaSE2U{;Rc?xNXQwsk=JVSVRyW{br}0o?;o~Ue@3!<(5&OMx0IAV<~V}Bam|cm1m$SPAn{yQ zQj(Q<<5zk}zryQ=4N<%%)6tp8KDADr48(UhowjoqQM}sjKW;Ii)Mr|x+DFw81)&}> zn{HWvTu|fa@}fc|zm{v8CyV>lp+~hUe`w~=owNMZ3xU4Za9hcG2aN(C@iPjv4BGD} zqEA|#&;&gu$kvz>f(p&jRWq!=UZZ+**mOFM&%%kx;wh7N1gn1SK4lw?Lafv8LNcq_F%GVe7*RB$EM84x&UazIXp-fQ>_M_S2i+B#R=n5^1c9G=+1IIBu|npb4Nd&6~` zXHtIj@Dl{xA9Ack`Sh6^Q6FzytbnOC7(VmH zNJWJ|8M98Ul67^JpxVIEjK>6_S$I=y{AG-ObeW%t*~7&Xg5p82`5yO5Z|y*0tvSGu}{ zzOULu1_X2^S`wwL(*wS?${ifTQJ4){os(5qZo1&dxUORerC_dHDQ38}M=#fgf!)L{ z`Q=q_bmB-%9GbYz(J;INw`$3iV@#ZM=OoW>^VQ}44)v+20ES{%Vdt@{yKKZWIzJBb zC>T4NyZ>VUPTK01LqkrY%K+I-iRMoa-i;5Q8h6H10Xt^*-u#RxZCC$Eds$U`t$@qL zq{0=I3XjBTSNkk2H)$MQWrSeq#f9P4+iF27GK+U+B`}TC)0Ku) zm7l>|QF2Hsmw_rgnV(GUw%A9Wg~YPwe01-rg?HBoz+SD+odj;7=Z4ZL@`mWton5CK z7!Nv9uiCYD*@MgqYzZa=iPrEvw$cDZvqPR^?re0?{6f_-I_g1%YuVnyv|F`A7`1AZ zXW*Oj9oc_2X7Kl8H8EVvm8)=CHxHcm-1g456Q1utSzqeZCS`75k=h^KIugD4IS!Vg z>l|JEmrQwSEBbVOrF~Q;_C%uqho%!uC)&bUviQ zFyH^PxTSuJ@BAlxw^#58eGo@HpzHF3oOr;6Q7L?>D^?=RB0o~{!oCRTVp@x~a#cLY zx-`pgzv&_-D4WR=HRqc;Qa^DY!mE#3xApRnb8o8IYWH*I!!WNH*r<@mjcy~F}xlb{_@r{At#Tlv{fD#0Zm#uz@BG$>E96jBi-ZYPvQQ~O{kXAx;1$!3lNR5 zuB8zi(7+b=F~(|$ebKr|Px{kjnMIU;DvT)%A7}8nSEb~9 z1HNQu{72-aBjn%poPAdkbLkJL(3N57NlB2KI4jT#UGsi^afB6F~AHQzXE zvT{d%A`^jGTzch1U>Tp$Fa2I**E96n~aZE6~5o@oQ<)$xnn z)IMtQ;>))JNSW|S5GL*4DV4S-RRz4={Aa>QM|Pzd#zYA47iEBO7>6I6uAlTz>=tNO z`}W$CS*%5W2>#QL5O@pTXkxtv^QFZM*U1{72Hj%s8e`cn!*XNU?AM|3>PgV5Wff^3 z>wffqP!`v`A6`K>BErZ<0a$dy69&@BT1WH71HR+z46Wl2HW9sg$f$uNd`wmo(~mn; z@@|I40G@jg;zp+b8=Q{ebAPnTB8rgP>BYzmE6}{NUuV}`{FG=GbXtutA#nxrLvP$9 zxd_}}J+tgRcH=v!bl7wkg;qcLXG=Nh*e@0Z(d=7W3_j0emA`v-#8kY2&|flBM%(b> zyKp_(w7a6_>hJ~=ooc>T@$ER<-`-A>_^Y1jI=k(kU!M;}?hQ%B7frH_=NrvOBT}Qq z^T|GP;D$)O{fp=msF%P8;-we+KjC(>zGViv(KY|RkHIovOI$$(+lbHg7y!(_8nwUQ zK(r+Q$A`t^9fMGCR0k zv>X3;Eu`|l05x>P?|S*K-}PIN1V)e(sCIjb>y&cF6UE8;|M(HVlx^Oq_ryS{K)?aY zNahxV{@iBNQbaCS#3)Gg)5a~_#Q2dWS`#IJ^3(eR(;x7LWoi{01lx}}_-q0ZW z3$OjLzi`2?5nOuO|(1q#`DhK6Z~Cfl@h|FqSH&IsfB zVOSI99tfLfJ}0MO*1X;Rs4bZ{OQibGf3@KM>$!j(O+2>P(s4o@8D=v z-(M_Pvr3HhF}Gk;2^EZgoEg4ar3A9 z+iy_+{K)*fn6)RfY^+&-V~b2D!`CVP^r^RXNMnx^G;I(Ef$2Y=hHFUZ-loWf)}n91 z_}l;NG(>uV4Cs|f4H|Ej3ws>pFQ99(Sy=B62L}n&P6$+8kHHRLpf<#n(S|2O^<{iXzHGO~grEP{#@Q zqnW5JDoB>94glR6v>Xn;(7gR~>-X!sY6k~gdsFlgPze!{>a@&ENsU;s*ozJ=vn7i< zvH!F^gMmc|SXNgNWTWnGO*xDIy3rdG>(IrM4Sj#Ba({groQxa-ep2;S+>`vT=S~Rw ztr5CJfNNE8w8|Gq%}?QfJxjd3J0tnbZ7ifyG3ZLpy>R!{!an~SuC zcJ;bJM^n%;V8Z^(>-M9*26OTO;o&j!A0HpEnbP3?as)kYd>ryaV#r2HTKE5H9sE~R zA{9kwr$hN;C=_2({M)DgpC>uK+Jr@jzR#3T{|58?$G%VgU2vVebwsE_{?{wW>DsTw z`VN?BxW2&t^9v_+L443^D!}ARCbEAM`+r4MM63sA3fwpah|5Oizu!2@x&^E=kUz$p z=tdvY>dEvpG=R9>$|D--#z8~y(R%)dg-{{@);n!Ej9fB}Wj=l=^Z|8wX5|1H2o zuVaP-;HTz%w}ZLZ>(Ud^Zwx4FjczX3XCMb-oEk8sFp`^13+5biafj*{$@F zDP|x#xVkx)#lF7u4Q1NI?Rld|U+esk;$K(R-*pvfFwRwybSj8!B-0rwNq|TtW(vm! zb*`#0?9uaC&}jwuWY9TK&Uu(C{27-zh9%VE>~I4yFugSePuIN&F-|hD0HRj(vK|a^ zOdh#`$Mkr-{-OZhPuT?8*G{n6;kqMD9UaUKS^!!mUoBrSY$zF55kmR;hcqep9l}^* z3Y!*(9hm2&pOWrQR@rw+o|4*ue$CDw&4(6<@i4ExA-5{qPC1UmxP?(&J>QM`FArJ% z@O)NR&&MTzY*a2SZ}^}!mY>sA!I-~9@+>2SJz6l`xF^vnQDp>nzSk24XvI&w5%q6& z^!IqC1d1JD!%OWB6&5{-JS?vJrZYTX>SFeNS~>pu(=~>Yl60LYZKs&AFa4JqW#$p? zV5r@argDx_NRD!DtWQh2WK`_d1JK=XT{(Mw;0~;xrae<8VNLQhPqiQsh(q@WWOo5E z8>fGI9}dR(%{_d6Xv25)>g`PFdjH8$T%}#X3~0YH1Zwm1ZeBXqcb%XE(_@B7H9ua< zWidj)wh#yxI)Exux=JBk0tojVf$;!Ev0*zl=j)$uPdsx~APc1fG93rD6>nOw>=)zS z%KRqPKpara$A}!j>LDUoZf^&QV=znzF{3kJeMnW;DwGByiBc4smSu#`X8H;ndnz9g zvF%_K4MM!yU+ZEYcAOPOOanALonY7X7#k_C|kXYsa4);F^&pRHTo*on3v zbnWfI{8ga;TD^kFzSETxkcuy7)5OC%R~b)#7Pa((5p)L7vsO60atW?I9#du z;w)hsEAjR}p{}bmu}TV&Yfbbbj2`B~o_g;F@m&Oiw(d4C^-&+2fW30v3l8S}v3Om$ z+j4tqc93v6w4oZZlkMi@=CcTBUP=b_JOabIT#DMjQ^mL)2I z-K=At>K`!v0v8f;VU;y>1z5>bX7RJ2zp~%E9S%_AXLkg*#>+aIU~IN_gIV%{nBlpq z1(9GH33q))$L303>XNr9q{EeztD&A=c(0$-3cM^p7%2!$?QFeQ zZjs1wkQ|<@bE^m-;vRk>Ktlgjk)Wg9(dP~Ia9d$NNN_BBCq zT^PUc6LJer(0{oLrZ&Y=3f*eMrIjOH0KN2vfZs_6y|i=T$0oALFFemHU7#LdkP{gW zEre3?k|l&vR761pJuD2~Euje@iE&l@-KceGT{2o4di~qA(LF) zz~@5}$RnFRd2{j%)>@9SsFxUjfwi+7vV=4ZlGB9^*j9+0-WQJ<^u&Am@AG*6uG&Dy zD*_pKhYDSfOZ77cemp?D*Nf?Q&yf@z3!>YggZo(RmBye?n?wYCRk<}4di919;-*4- zanFWIj`;cOM#m^IhG2^gels-gsZe$ZxLO>qZWa}w35oN%U_@8FF8x2C)AeeLcT^~q zBv*IQgMwnG?9Qu~G(qyIQZxV3^wqV$4-tR)jk{plmJa=u%bXaCH_&KX3(|m>HDNa?70!1v50EgRB%4hz4+ob9uKp(csm97*e}*1|X-aN5;hr*NY-X`@5p_PJ2Ll zEv{6tqw(rriUj~rv+j>GjWLEo zx;c>vt@BnAOFjn*U!%3b?CURsF8Z!nxVpNkxt#4xh7iy4fW%@9@FlQ&(_p_4R^W&~ zB2tn$1rv^m;WaAa>sJW-{b8w`!|X%6gvYXPdUB!#>!@4lKcLZMgw z@Zi;yFICE4=S2XKS=eiWVTkT8Ks;w%0s?pFBa`@9f`)_GMB>!Uwqso|fHndQ$8+`c zsTkOqQ{mg#VUadG;L=&KY3ng^AEgYv274M}OyPL;ol9z}N;WN|qz)3r`k_d`2w|Fm91qMtFq6OihlAI+cDuaA{9TdB4cG+bz?3r>aafei`jC1$k$HW6NeUJ))@NU;9j2E*N z0g}}70!Q5}9D~w8Sw8q+{CR(}0179VtVeluv)Wu9-RFzi!3+~a&TAEl{W7?L1$*MS z%o`%o%_WsKCN@=Hcw5nV^ART^SK}YP!i36RA{z}alQKC2un7T`3I-&yz*F!!Z-|DU%`1bcqLwHd#VV@$1ei6E`?8&)*Wu z_>GhZzIBWu${Bnl^VSjX58waF$1!jb@Khv!4Cn)G{*2e*JmZ1aS8B1I2S%tb>COF> zgf;W!FX^^}LC_0e-YUyXKYFk%_eQA}0f?`)y)%AE9poBL_n~A+!v?nn1_E-g!Gh63 zF_80q2t}ivHgXx>`c*95t-C_v#>JBZrg`(7DJ_uGH+Qoz{ZG@%sb$N-y}A(inXirFxwPK)JwBC6Y2GS&@LkF)FZoX7c=0}>bKvWU|1RUM&MCK-vxv#;=%eC^=Z2JGUMpuY! z*I#*>zhrv4|BPT60~SUVPT4c8 zrsh~PB9ez(LXgJ59P&5{-+i+qPWz>3mI!)fmiCC@z~EDdV~|=(o#C$x9ZE*fQ;ipZ z!pMJffiH)o`N}PPkNQ@5c|Oz{wud4yn~^VryW{@;pvTp{ey{CT4R9X&fqdTl~j-Pp?MRni`|A&$&;mKVV$w;40%D+d}~a>)sksC!}s{`v>if}3UqjWdh)24&VKhr znnBDIP1C7!1uQFXYx&{Ego#u9Imor#3oJBUQ7g(6!2-A%R#FSE1%?f$bF1kf?xD5p z%4<73joT0+!4Dp}%l==+5oQOIMYjny63m2z$}H2#-}MurAxHEKoV zbVrHL@IgE;Qt1=~M$vU|6_j;kKW-z`{917VD& z%T&7-Msj{;vly0=;e+odGnv0S1T`nZ+E1s%DgP!%@ll z&NW-W=qu&O$j~tQ%%MUm(*ig^?e4Ua#6__^Dh1_7BDiQo4rTUGTq~8EVPj-q0d6a= z-J}5vK-2X9`u%DndaZW0u0On8RvRdISpEj zjEcz7=Eg}1=(&Nud8}O?hY~cY5;;&-sKRfIYyuUt(RUwAvLLn_&R!|?-FH^}xmeq$ zn1{9PdTdex10C_;oq1zLa`od}lJ(=f;xf!?(oD1-U)UZ`JU#uSaD01M`-W`&M?sS* z7eCp7tEZ|``Pp?RGp7ERdll3W=mPeImWJQxJ*V+xLaYTRU88HKxYhU#DiA8HDBoR! zJ-KJ>&0Ba|9p%@u2>l{RoPdpAMG%Y#+<MmR0;h(>4o3s9r#4{M^b|k^L zP@$mvvXP%jdc%yU?MI#i4-kv`(DVwBHJI%B+|(M9c($JSX1Ar(VO7H*P>Ff$$v9M@ z`~{53D06zin`WR|vq;~!b{ER9J89n|4yp2zu<@6!hJiGKK6U*mj9 z?h@y4RgFSg*%(>Ir#wB&mDd9^@J-`J>qp}B*=S&vX zA=AR=ObXd69Ve}jeW6iu;ZH(@75#1pTbKBI{gPW>s3Y+_Y!bG_K8!}SY&sC)+YC$2 zhvExL9WsEZ7Ka81-h%tUz?kM0cqC(VD42(>0gYsY?c@nf*HX(d>DFt-a@bh&x`!@G zWFTIxjDj9vUX4=pViN%cjH#M)too8>wXU{!p+`}T7y^%RFR}V0HMSkD<$juKCpom7 zn)}#SvSd@?%`Ok2D+{CsfF^D8L44M1;wb@^@@C{?tUY%^vlUIE30!%`v}4(=u*bT* zqQ(pLQcJDy#sYuDvK{t)v=KkCGg<_~tp3_XX=;Hdp|F^G**0a>XS)v&My+WB2}jo_ zHP*xRS?tGAL4!GKyId=W3pA5uC7mn<)AvHP#8|b1N1MCDtXcL;nv0_GY)X26ohb9( z3~(7#)xkfuZ1Wjl)btEf{a8x}+(K?=>E23oKi8`|&1oUS!Dlz+)^GZ_d-2iW-RW?) zqTA{lSQj-?&uYJ67srgJY)eoQ;o#;#9Z8tTE#@vq|8S7~hJc>S*q!jl>Iyn;8|*kw zzAT*rXwYc;=Qrw=HLsxpU0p86HA;Z)IYF2r&p50nX;VdmA^{ABR%W}`#nIt7qD|v_ z9Ifr=bZZr)DV5aDZ1>_Ghb;syW==yc~4hTliy4N z#}E<#PJIDlyl+LR!*zlmZ{Ko-ub1>hf@32AeyJAvqo6nXr9}mxvYu*MBd-JViJ7Vn z$1MbLM-Wb*Tt}1k>ADS`Wb@x;9#pA6GanQKb{Y(sNuI80+TD(eh#LM@AYghkc|r6z zAYefm{mW1{Nea1rAH|iWOR_k~*D-3HH6HlMObK%^H*B2=BmzyF%$QLAfvif~d4!B$OXNom7k zOBTI)!-c5X$VIo`mJ95Q>cYD{3%^ZQ=M6_IBhbQjZ)&1y&&tlE^>#+y;n}xM*)|hN z)#!qPs-+tzqO1K1IS%4xjvn^9G4=4%j?&cn~JzDn8X79m=($vSu#GxS(q*2a@PXd3KQvM3)zsO8o)9zE6fkxC?tmNO@r zd5eTXh;yM|r;Ec3PCE>mZ2<7s;BY!cYW>3`uM72Rrw#n_^O7E326pp74BAWs*R8sv z&L26}ssIL-QmEdfH*1Jw(x!)>9XZ!sPP=VAkY11)X82p7VW>@}PM}&0*NS9E+myHu zijtI0A@ig6j?v?LNwldZMAT5JG$+1LD`0}~*_sEZ0d#y!ecGunO+-$6nhwB_8mA1^ z0v!Zmc|E*uiuyoc?e&p4b~^8ib%$nr*+H%n>@!ywqyhnE_`gA(#HOvV93$7RcEHSH z7_ZD~nQ_}+A&bRWb28H^28hnRBW{id0o1^ug9#y#IQU(~)lL~~$(KwsFiE+mrsmxK zqQ;;5*|2u0z5UD6JX2b)b-v8;ep_VhMUaF>M z9LFU&4vjS2>o6as_S4!4acHlbjRNZG-RcV^)CYHkgQtP{mNKe9FgY@Lowz85a?V>n zj2kyF-jOnjZBY&OrY&4{b$OATJu6tR54EyykR@}e=!}m!8jX+VeqSi$-&-q=k|vQ} zpZ+w#VM~WCkm$3Jn5kdK`!H(pcRkndv;x!TCYZgkv`A5kuW-#>YBm}9R>4zH&s zK);Fqfl*Wck}+Rp!^6RJ0=qqwrkU@O@LQw6529t6xLtN=I8!#G{G7`nK)Crin!#xE zpAN+;DX)Ryw`O$~-GL;eWf=iy{AtATRo3=Zsm01<-vr3`9OX?M~!&wvPW?lP(c~T(=c5rI$5u)7G)S zm;5Cmo9W#Z%f4)j6PQYR5`bX%$roMS&df`S37R3 zD18k*&sQ$M%-5;9y?CNjRV=bW{jyR#rC;{c!C6Dnjl;5E#E%0-?O!y#l$dHp1}biR%AOb z^3g-0e?!NlGbnC zKHWgkoPz9PPtL|B)Wj};+&1lu*)&p=#5s3)d3p43huyz5iP!BmuAF)6G?XFlRLgiV zT78V8Ta-a`^uXUAnLMk~` zDfGVkyyKwwmc=%y{lZBVu7JhtdbqCs&0az<(8$4o4V2@^)rO2;z-yXKaGu6g!hdK? z!g!uQld8_2Z7+uSa_#s{6o%RXQo;`_OVsCE0YoIZ8m%swjKvc@%uS(f!*AH_O-gBZ z*=452f(nl60@vFaQk-KJ#qcvAu`%TX5Z1W8ZmuG>FdCI^Zr0F3lTE_L{Epn$>xTuE zJFg1F(r>myljX*5ykV4-UXaly|G6ssz1ok8K?n^x%!rS5PldE~_d)Jc*L9(y^hoGO zV6`c_r;^ZAeS1SA#VT&;CE;`DZ~DQ(PssIskGWpdV(5559{U|<%g+ne#&bvA6+0w( zeqXcVf}Z~AZQ@Z5nOw{4gXfqvFEDAvS5#7EEXz8usXona+*o|#`MvZxvIr(?PR>}F zCSRIN+;vI3E|LB;@%W$Ns-Ki@JW5TmPEj10e(rpTywn3O6=V9=aYurumQ4@CA3q9Q zRczs;H&HNxQg<2T5;0v^nDqfjsT*#uj71q7~MurEN@owi5ob#}D1b(a;FP63s2+hK@B^EN6bWi}cI zFtSjP+$$`6(t4jt?=ejZxb)rwP`bL=M<@6U(iEq05nQQ^KS-agoU0ATLm)Hs|Nt2P)XrX|6E~t)H1~P+w z0w<(Ne*iFXX7r~|#&ggbJs7dWKMrFFqJ+JisG*>d!rpk z(67FDRMvsdx$sLj<810}*W?6i4FQKvbZ!9vG@(|4PwyXm#J}hcn|Yi($jPAguYGxf zlptuWh1iz_1Pq!jE}6X593>$W=7RVR{h*Ga+76$i#tjr72&=x=u#IBWl)#{M zJ0$W;;C5=hhc5vux0>;;PrB(eJ~NbPzs&f3aJ8ga^4@3T*%>ccgWhEdwiAk(sBwo8 zn?Y=op2VPm51O~O=V_!{Q-nL_;$_t?J+?{6(ipUJP_e1q$+A*C7QaiI-{Q3!edXix zFzhbH%aHLFxpiGHxTBoKDqvSJ-wa~=I!wgTb4fs~CqqJ^kuMxR!yy&Z*cHuiby-SE ze|~?5^x6FCG%d@lVGe8og%{cH$dq}~9CrnLY-^l02pK~bkR@_z#TgsL)5Li*q+(cP z9NS2|&gDySoP8@42vUO)!ICB$k1N!3HMe^$N3Z%z!JE(PEwX{&W$7d+@90SwXTrcgi?0n zbuOM`m;KCe8fvm_M+=AM(}v1QOlN~)gLISbt~+_cy~mr9bm!|66$N*Lpy)duIMh;i zqvFi&CXLm(Im>@j#A41_pvopU1@w3`aT85HXVWc(*|&i4tzN`9=uG8L>OzL{Q{eZU z6}@FiL|UF#B71d!?x0M%o%Tlb?H=SqA+LDWt-`8%PjS9bBkzuC2a&dE3lV=wZfEF0qTJRbRE5K;V6(D z*+DI3rw7tAHxeW}<=Iuc(iAhhlLh97UkWWkBFbXn3-(#XiaVQBxcu-D{zW)%tv-9mNB81+^a%ld+Ou;wRR2shq z22C@?8W?rgIHsOSU{tZ*N&g8`?uGbhFYzF5jn@ouFg?GynJAO9>)5XH!#zjK+(y%RFJx|Fe|BhPn@9O<-?=U{E8HhWVrHS@TXw|lvK{dda^JOhIT=c1hmG+v zkbFhXQ@LQ-*bv|h1BlOQ;=85}StC&hByXLL=6hX&P0Ps8-NMJoYzBr0MPs*nj7~{A zGEd)KTTW%p+KJ_-XmojKD&)ead-vyyeKd9*98=WwV32pYbmJrPF0B3KPdaD*-2(8l zc@Pkb2s78`AX@yZn=Jc)BopGeZzh*{f9*VluzuUWRP;$Dvk@M?b3GC0N7MQqdEM3( zAklWmxsiCv6BReN|@o|K+r^(e4mtC!WKW_LX< zks_I6K3k3z=Rl2i(=~fMN9){@?tWs@et`~_RjzCpBaBJA8ns$lMvzfH>;98!3dN}| ztR`0%f_Q{_YGQx)aB?v8qfZ3rezI+pLWY7g-r^k`=r58r*Og{Ntd9pgOVO1Z^0cao z@A~yKdaAysS5T0AjV~`RKMElCV>e&}V7t2@-iMrU!Sp4D)kGg0{J9RhMJVQ(wsNEr zw`^GI^|;!tS80W`UWxIZW!uIV-LJfd#t3U(M6KRrB`LrLnSBKRPH8eZ*k(#^T?_&Uc#7pLkA4$|&qr?E zHr0HZ&ChT6sQ4DKlEe08N8)CXkkosLOQM1{t7wXN((BscB9bxAWhE;7tVRKhjq2{RA!`tL>hy z6H}GfnA2@4vRy6ZU=r@HVnBOWhWr(%q`f~q7*ajQa(dl8$@#Y6@KojNQ5efv2)83< zgY->YB$&lPyWl0E0IXcwM|YE+DwMPcRGBZYt!Bs0foe-W)hX=x!w`%RAt3pCCi=0Q zQCpuDlWMiu*5Knj#LmXgMFTaQ^7_WMt?c@YSMTc0oWrWc)*-Rj!M&ah29^A8ss{SG zrqI^!C#-UX{JhFVGz1wv(eF9;aQ#mpn$H9>1Fe)G>`+Qw3|VX%g$WxYBk^=F20G0F zmN0x$k|;I-I8_RA^6$2k9*1l;(}dZInb%L)%m-=F>FA|Tm*Q-;p$rA4?{vhOmOEn< z*CiuJ_|Dc@gOnvABAzXxGc?Cj*o^#1md(~ujv|?I$FS}L1htC#i|X#;x2h7n_Whw^v!(I=nlkE*IQ=-CsJ>@ItuDbjoq1{#n_{l|E=P?~$sN{prWzrIAPT?*9l z5s%5+fOLu=B}j^dlyo-; z(jcAE-67pA-Km6xAT8Yu0@8KSbxGH=FK_SvdCqvw8RH$}{o?S0$o}nIYtFgmD!bv= zM1$Kc34D!4cl$W7fU~m0A*BG`#Lkq9oQdpxe0`6bS)8E8yzH<@IPwhj!7K#`m!atq zuyENlE}EgvWg0bR*dXg#btcET9_uo_L^RmB%H3;OMav>W zKakmejViq4N_Cdo!Y-e|69~Xy-j*bn@#8Mc4P(o>PxP9gXMmFSUW)_dF_1I)4yEbY zPE(KPhi|-l0$cPJ*m@7XhbtI{TVB(ld>@SL__+BPYq^O{S9b3`HY5W=C-J5s|5%NxxZbl6FNYd$@D@tfJEt7pJ(x0S|%{9 zHMno)hHMZC=%=dlI$XIXFs{s7bS)HuZX4oh&N^KKne;O5xQcN{U-j3fxqMdQWpKU6x7?ac8Zzd;7vHP(KYd2d(tZ})pYk*`j>6~c~ZwD=)hMpBdNRYqKe z3dE3a990bDAh{2+feiM{)jsJO(9}$er#l6#RVOUA(yaQ>(O^u5_({uqF-QTq`;lYG z?Zr-FIN$I&Z;F47AB(8|Gfms`g9WXcAB8!!i1i3vfEIlDzU@JBZ;aqqppy8+>r(Ez z@blN=Bw6O%&1m+MP0+W%uGH#<>XhS@McTA>tG74HBbW5v zJcYU}R(IC3B_z`JjRT{lTtUD3$UU$rE6~cfga)3ESwY0+b;}#90VoC=?e$L|ZFG{1R-@+|O zf31pRNq2b{R_Nxr(gY>_To5Z#x!?YBvY+kg;f6JYqcS?{P3O@9zTMiG^>1KmbyDOp zv`fM(zuZ)9IC*+L+wUf^{+U|)RjzAX?vk;kG+%h=*$Zr8-2Aq6m&41NcP+g-XxYWZ zX5S0P?DhTEkeh^FSdmg!yD{(&a?Ro3|#lz++bUdHKiAFS%$M0Hres8)^u1EvBmZv#XvzrbErzTPp5w*DO%U~PTHH>+_y^;MO^`2dh-w+ zOZH*P`whsehd%}ji$#5*N;HamOvNC!LBiKv)TRMACcWRPxsX^}zgzE3M#H53UDPG7 zQ;I>8MtNs^=M$-?3iBGC!2jU}NYA4NhE#|^alj)w<@^vVBGAl2l(C>R3@APH(?58w z;F`w^+Ur@ADp=3eNY$_=BcTe*B+&VR?q6ub`=Gf>)Hg`y)3co^8QWl>>~tESphrwN zco|23KR$b)8UBPNuSO#uY`7XWG`iXqvZL9%M|4#0K45b?nVB@d`V5Dh_F5&Vq@=c_3?yw5U+b*ob}4B3T>aLVw3(D<6R+{@ttN3wrQ8uu_(h-b zFF18aeWl%Wqy=m@e*KKuX&EMLj~A_=&Q9u8p@a*4pc-}yh;?$sT~hPk`@aZ*+?X&| z!{_H)EvtUEFd<-HxE7NtEX%78AMzzX=bf442j~2-c$KcW-nSdij#rOXI-V{iX$HjW z84-qZfkG1IUZrjEM)nj@Kti55VolmNzWbu?2UvREGZ<9ZMRp>zKauv@=HMc!?$M_P z+E39)W)$z=pwfYtiuD13j>#0{Rd~?AiM1WSCVyw4Z47i2Prs@uHa$2A^Xm)J8Vj;l zK1KYu^Qd%Fhs%8NAZ71m^?^L4vSBNhUaz-XOD}Z8QNSs3y!W>1dA91rX6!zOFFCgk zV))fpHSF`MRlfrj^4~n{@+v9emzsa3BcD_^eil^nx^>&hZA$uT4p0pUrMR^6cv?8E zug%A)siopX%TNnH{eiu)V2C$(eE-7Up8@P$9~lW?@2_iys=Hi=^J1JxYxfrZYjw%1 zYe!j1j2*v7l%F9@+#UD^C{>TWyoXnDEeQ>(J^R$}W*W`)WJrc#Gee_StsgP(+tC?^ z!p0PBZB4!R9Usy@k25S;SwatR~^%>Jx z`6*fs$xuOms?$#E#bOipTcvzkA-OxE4^Qu_)f^Qb%H-LoB2Bfq6E|3fdXjB`BO|nm_;J?%y zF8OMDxD;!k>DR=KO+rFxAZT+=czB7hYDvPFtr9>tf}OPjVL^LlzxmR%>wQ#iE!MJU z%{#uK9Slg029+sOBR6IlzCyLTVHcm#oxBz&lCoeQ?CF}T8mXI=)|JDM$lnWlWz>rW z>YwKHAK1A$N~v2c?U$s5S9ls^*H-|SWq;S#=A(!QKz-POD(i!gFm7x<7jq#@q8x5b z<5O&f#$5JQ1kDBj(?znTa0ND558<>xR^%(x_XH6OMus3`kuB0og6I|zRef=q3O?PX zeC2Xuo{y1t?6Hl}Zlp<|F5ksxxgzL!)cf_!RmtQUYWHN_NXO9X5*>?hw{(|pDAgh7K>-*kv}-s(2pjzi28--jqzZiK^2wGC&~p}Z{`A^7FPYX~om$5Pne z0-9*$coiKOSl2P{k9{#0iQa8OrK8C*i+?V+ljo8A*zRKl;B~}zL9E05L6bwQ=W$ur zQnW-S)_#u;MuT6YIdlZXF9px?pUYi5LhWc*1ictPex$~lLi&d|`-Yk`fAjsV(la0a zqB2RwIh!`fOv{JhnYHT;v>0xOy$?Hb0@gpWMh)JEv7?$DH$kr+DBx)lp9Pr z8cKFuJN-#|y;P4K=#HWF=z9BRc1iwKvuj*BH1Vj(ZVgGZHmvOTi^#D&i98^v%I5qD zHVpo~ln66k{^4b#?hERC=?K7-;U&_QU|`oii9^C}aa`kb+L_c{Vmo;!%$`#ECT_om zMU@WZ+zcjzpH^mQMS{?UjijdN6PY}>YQ1l-D1h(I>Kow-TyfLkbh|IKtj0j`)Ads& zBW_csUGa(xRiNZ4cbVEZ&fScXFwu^UfqH zK;7|8=|B67HvmwcQlrW!Br2*K@Hpv}j%o$Ut&ETM`Yb@CPFv;ss`7ZW=?NMghe$Wt zDjeMBH`zT8jXXskfN&k{K}b`e2|%@1g`L+{xFZ(So}Oo>cM(>Qi(gUCa;!_$oBBK>!$!tzubOljo6FJ`OKfTYhcC=zxTB;DYzle|^>d0X=jsyT`!g5fTXK6N3O8hEc zA-HHH6V)$|`gi`%B6*VVDr1?Fc4ZuHpbmh4OY6n-G5+K$=pXa@)~Iq#i`>O3Anfp+ z;JA^L-D+nm(QEJ0j&kY5#qM7H0MgZAu(|TY_X+V+KLeBzgJe>uP?p&4v|p7`y+&n5 zKA=>^TDuiqDvp{!Z>ff&RD1DAVlA0|Cx2#@64TP>!|8=0)i2< zrIzMr;oF5=Llm*OC!8&H7g$1a`ScjZmi9K5+g9x~ATx|ADIcb_dmbuK@}}NXl4-0t z!*CM@QEK~*4`N5@{VMydP0-qVZ2klAz^p{YCz+bq%Y2hzL?f6;Ag=l$n0P)J=9_o| zK<=`!=!_BAjo4x=e^a5XyLf5>XQ$wZ{pq6@yCk(#hH4W=LygQ+HR{KT+)GcgB!M?! zMmX?z(PgB;UIitPjCTht=LJpg_e!twU*G5d+_<5<u#{^b_Pofx2pbw28;tVV1^IemnndKtV)0~TeByV zl7HMMl*nCVs6MimhgitZ8IT81G%j{cA-CpQhUzJD>9~CuVB!OGUi%M@O3QcsjX=Gw ze{*q6#BEOvE0udcnIWfTzvp1pdJ*{CqGpEdHLgOpR(|vCejzSUxvKZo0^)ye>JW zhj3&+m7V&;&`c<87S)xbyFu~mSiJ_Xs`uzsqyVGK?40%#(lKA(la&`XGI>@DBK|^@ z`aqtwHMYajasf{x(~Zw|-FOFp$koE8BB9l8=l!{^KAP`KlkVyC@1$Sro${f-bw`HXLT6^Wwb=C`-DsZ+_-Tawv>56+wDBf!b z5>H~OTR1ShN!Fl$$>|gX9V_&E{pnYFFcMmb+|UYNjrlUh=C?oFXDKcmhCO-?q+jU4 z_%}rw(b^9D)gUPwJ@=v}k-$?VS1)g{~ z;M%mgnXWFU%s3A78Y0;A`%PcaT9nfph85Zb4%6_3LsdTfzK;i%cfLHQY2jf(yFVEt zskYu$6V~dMOk{HdbpUheo2Vyjlu<;3Q~cDNr2j}$sE75M?Xi`Myp^_x7iLxTt5kmt zb2;xJh)3RNtGGIH0D3jt4UOt(!G&dxT?V=c3~g)7XYsni2;Qyb8b(oPN0bS2PnTtR zobUJ45Ifi&E$bKEmV9u5$bV3*vzDvFfA-?J1H>!%^a*FrSKzpqYPOJz3bKI1->FR> zzP}De*#+Sp6^K$73rSX;N^q!%*LK8fZcc#`^L=Lsc5dKzPgrd>5u1rDsZX(!6F`cO z#${OCeotkc0<{x<-Rx_tnPo?$*e2lJC>n}W&d@i`lGsZ~Lhb)WtFCczYs5aUw_D#O&Momu8Hb3HlC8w z6aY{~oi{OM3H~D=5T5NyTTGht8a5N^LwV* zhBz#OhA;-tY)eK$6#@gUXh%dh54BraKs)A8@K}1_?f0oQtX_q%-GSP&O52rouBNx3 zI2{opmZ8XpVdI&5BFw3pEt|$!Hj&g~tJgm;3FN`>IuU11uF!ysZXg#7-QRxYP^MX% z9+fMM;P^FN)0shHtvga|z{W=X%Ayf_8U}OE4!}!itro;_|OHuyY1LmR=Q@@D@c_#6%%N0bL)mpk5 zxwVkrD?n`kc6mpXI`(jwcTH4Ij;3GmT_$@JKK$znP^75Agc1T5Q&(K!?>? z`5Yh*oON^q4eNZmB9T1;?TF(Ng>q`}k2I4~do$*o3V00NeoViFKMn^$I4>)}_U*P} zC`1$+9Jenxo=Fys?b|ho$@@!E+5xVMC_mm+OAiYs;<8v7f|u4Ctvev`X0Eoj8rmX; z)ibeFRS-!9|j^QcX_t@y_HAu8}{m zN86X&>;n-Kc#u4mVIN7j?H~7j2NBd)!gLH${HBNW#CoszcdS`d$J@kEV9uM8 z`#cspdckUdMhqw3ri}vXU7mo@mQZ}6%W8GWRUH!!ChR$cX?mbKGYds_)-wqdCUIa4{XaR z)_Zx{=Fyu~$myP>OHy-0R^LL*_Sie5siZVdVfHY9g}`Bl!QwLY_rJH_&Nn#8T*UD>Sx`$S^x}AH^r12#e4&M-fx5iwe{}D) z0(o`My8aYC_yNRlxpFytEi_HMhHY;`S9Ug4(8#G zZF0b6^ce%wk}?}$V;>&?BxD$qKyiok0skTm{EhE$Xbv(+cHOgwP3;$9w;~3(6%pN& zWaEg?cmO8!CHxQ3_b?FP z`X4D90tE$yWXyxAN5w$Q#;z_%JSeGdX#>s>$omg4AbGP?W*FDt3}H)Dd;D-SJ44az z@E#Vi?2K)G4;#NPc8DHA&5=tcqamE}O*hl9`Tu-p)Oal3dOCByOSg)ytM&;(LJUHB zLs2fk6_Dd0O~EKc|C^x}byk@G{VGMAukFCiwDZ%t#MKP7Hk`KbJ_o4?pa&+>dwO%jcVYjME^(P zRT>0=%*?2%qK4I4MxC*$-g;N=3A5lCFtr3|yt9B`Ei$XF_&c?J;({1(1Nd|gBO9E~ z*C4NUyQd>E?f6q!EvBneprh`r9C;Gy!6p%@r&gPMHM+91RA2(ZJo;UT2x9m^`bY>A zyY;?kXLf=Y@?l#~qo^g@XG10cnceabOYzKQBf7U%h@I98INE?`jm+HUt3Be4C zBn+)lLGs)TjE!Z$5|ipcFS^~#GSxL^m4`(bB$B-h|IQ%ipBdz=^nEpheNxp5NP^yY z(B#HA>|c@qyxxhq=45(Y|J)E3Kbv@64H*h=br2E9CnciC!&l$r2j_bKn0$ChVH(!I zrRB`gE{xOFh~Z9V_OodM*Ma}Za?={)-!1hXp@ymwkof8e0t)i2nyzd@tp`pl*#Q%SX z`yV!U8QD=D{SAnTCLTKRPei$$Pt0mu+!-M^LC3KsM+7A6sOzt{c#!t#LyK6)w$v`HUHx^{$RnYD275nDZfq*)f^Xj1jWBEGMB@M(to`2qwf5P8zQ%9` z&Yt@X{#gTiByNURK-4f;KQlx>EYc`8|LM-2jD(HZxjGCwYK?8`171PcDT4R&1(C~y z8)G)QDErM!haTKU=vzqVc0mX9S|5?c7$F@SOy@Al-|6(hQ1kd#3&1~N?RLH}b~oeZ zhMtP29brF9Li7yI;H8O;PI^Nl3Dcvpw)?8-SH5yTUjG1t_7uHD-~c&wiBKry?+$ng zKaBD(+P*dzN7XiBoQ^3D)5b}TRaP*i2cJbY$MQk=*p=D$EYTo2UWOx?Z2xSYi>N>2 ze!-ai`wbGD1}rc(m?F@Z2sW95H^8)MN5O*K|8Cj;-v4ti4)0pNB2Hkw6Ix-H8?Bv$ z??AYhoUHit`<%Bo{R{k6vQ9X4&I@!ytxEK-Zx<2KL>AR}!P_y%x`zMvo{I1#fS-cmeGgI0Km?!B4lliAh!v9vrW(ZRQodkfe?NHG|EmOiuspsj--|Ys z8Jfe)9=?vB*E`|T(OxpQp`iUKB9YYnH?6<12L1OI(V?c>n_q(npMfIkIZ9xe?0QqR zYW=Ln-!uGxqVoJu^6T4w&}#pf7%XbZ2h`d3p|OIVash}5aPSLAzd){o;crDr$W1PX z$B32&UVxS5)LxEZ5nRN9_Ck9yO|JSqlE3%gC>AWdd*zRqAcPj%5D5aL$F!OFtswVs zzgZnB>Vln>6fn=ueT_q=CI(X_^2ODu{@oEXgnk}l(dvTcOGn7_4xl!ZE59j+9L1LZ3XY5g zg9so;Z~<|zPaXnvQ=o0F08Ydg`trTviTK|o;uM9w2&e?$n5DD-FK?>IqD~aQAGXJm zD4j5CsWx?7PyxHq@*lMat!A$JRnkTMg_X!05nbM1jEi4;*f}aG7^7cDoQuIf7kec+ zyakGSxuAJ#)6tZnH!~EUTbB?W1Z4q!^oJ$*U}$9_$2aeR&V>kF#Z93ML@pL$5s<$d z_a!_FmSV?}TYESNl}&N~L*94`LOMsmck#Yags_!mxv;9+uH)X=ZCJ9i)ZkT^mRT-m z_rUTxEH_hb62gneHpVta@3n5(hOXQo2h#)T{wVzYI*LfCmt&q9AM#Uai6&9 zotJ({>bu|Zao>Uj<>qNC@;b_q12H5Z7Emkybr;xBk8orD4TQJ!_5fk`pK(70q04`b zxrb`hd{Q^c54iSlik~ow&v?t zR*f&w51ZH#PNA5u0*5psYwQ=zyZj+N3Aqddf>1H0m3AobxICfK=m**%sIK~Acl9kcFrBLpH`^53pZ|C};koj*xb zI{@~1O#je&e+pUt`=&^D`6sC2&66HxQGzCVKY!$mezi~M=W%}{<+C0IzXfa4f>x`y>~;6GUp2KJ2P=mWMT;N zmU#R+bEM?(_w-mqpHWu5cvN8h(Ym0OEpgu>0+7um#~F|<5cOwx&p`YB9^y?g@Z18p z1KQ2q!UTa-U5KZTfZ!fN1quFt_N&=Px=M_{KW8E$hz7#J*RVI%4Qy6g`3zjLgvbBe zW=(Y?3_z5)UWp!98?8E$Zb~XBL=_J+*`_)SSo|_a$+tE7C3QFx#9G3zSPM@MdI4}n5LfmoGi)yS z?WVD=jUv+}wcztJ^AFUl@VJ~~wcJ$WDL-e9fUB?;2kErjZuqz@U~rB74fQ3!SV^^= zBma)o?7zmU86x|g6^!+jRT4)kbgU|eBhe5jY#t>WM*@Y7m6_ZI5hSOiy{r4*u_F8# zYdmbMg0MgSl)M~05vhZD4Z93+wp^HkH2dtB=je}TKaG4m89T3E|uR!DiVlC zao}aFK`llS`e*ZuRZsR0Ta3nBkeq^cb4^n&Ot~jKGQ`7fW+k>&Y=8g5P(k>CimQgcy* zl8)2XA3BUAWJ35icJdEuYu=Io&pAoM*{@F^=puBW@)*1{Ti=@L;T#sZ?wsq*1VI-! z&)L^V=qUeJ6NP_+u4rFStuavoe$-QzeZLo8TF&-(-4(X(Yp7=Y-KgLhkOv`GrShUq z1b@^@V>qRqIzfcjE;We%x8cm&MsC)|?HRe|h$`~S0~d{x5Iud~aMmb;#URhxegbZ& zmX+?$e-cgDxfT8=zv5P#qy!O`MeM5EF#u)^J+lW*UBLr7`b7A~-4pg)k<&qm7hwwW zAgtEmf1}@ei9c_u0PIcG`Cr~t`NgjHcd`64PR4wigc^}mDWA3I>RCUzXEQxsNDtO@ zD_m)w-L?h#Z|${$7AK z2xm_t@I2N>;wLHy76+FupFWcL046o*QPFnBiYL1l3e(C1NDfWAnL91mm*m1STmVQ8 zeOZP3@4f_4B-ocA;g5i{y@-aY38v7C;bgp7UMmZMVKA(v-RGgu;S1KP+`xCejrW-X z-CNC5cC1&X=!_mjECq~aU5ffst$ANB_XL|VYk5-%$t*3%%VJy#AN$HhLYk`0muElx zz3*GGK7F-qR$r=rN7IUs00xVXG{Ce8c{LC?Ir$jmgFK!|teMc!S2^spRNw}9oMjvV z;j59Qo5lVcOS+2wxltKGf^9ge{j}?UPOur)7YZldR&F}JRvEd)DBavPS;_8xKYF-f zyEevL!_ojp!=}nwR`ITvcf#Msumemesi$+s-w8EEsKKht)O4-(9fx44+fxAP->WZ$ zPGQionw;u{6(F;DRAip9!uMY%zHj(%tk{VQ4^wqMhgGS-Zypf+&$(6Vn?q)C@{Xg0 zt{5&x-tI(!&=`cAq{ll41C}ojC3V)NFZr)p8-{CIz(15lYZ}4;bLa+NdHr|2_$mI$ zs}!()*<%YN&%W9VasszzWzN?`{q*2(kLvU@Hu%`B%&d&Tty$JSH2nA0L_mSvnnhHA z$;$SePVcdZfU#T%lg&J&(m$Jz`=tWIOY)b9A`ck zS_Z19kgzaeSy}Y0Ltw}&0mN1h4Q`t~&W}LvpX0^s^QZe|#`8^XxY6VS1Ttn`sqE%8 zjF=bmMG9H|R-kY)Wri0J!>L}6>XnWwbN(hvjjkw3p-}*Z0I3C1p*{cHv)<>n0EtBq zs`3j>59UOvLe*a9V;73?x5^#602`j~M^|{VFVO>3Us+-{O1BfEQbpIJWjGjj1tZ$; zfL40apGt`>#G%Rll%!o)1e<^$?2AVAGe*Y2U1i_`D7ql}yV>k3D5`KQ-9K&ko{W0; zeq(p`<3vWI3t~kgk19Q=B9EHD@thgb@~@MQ<6<2zl*@ahr?-!O)&Q!Y{7)jeJ_Gg% z)jImZf+L{v*<(O9-{E??0YnqN-Q}`lSL#erJGAjJo>~bKX7%tGNRLipVS$@3Smh8^ zt&hl0Q&lHsah-Z5f{(zYB3|ADma9YyVYxjJElQ8HUNhmPzVP~B%EX3uGP6!Q5af5V zh?oH%Cq$Tl_#*nj>?Qb>VS0~8vu}ZjJsOBQKY!Cmbp^#lqypaa`aWTJFBC!NQEHjZ zyA^-_`H^&P*xH7D*wUv2z$mEj3GRVDG=43RZTXmu1?2&F5a1rf){RE^ra%uWET0_h z3rs2Ti9B&c&nlU9sb;Q+UXWZJ_C{33$Py_!BUcsnn)0X(rn?kAOv7*n4}Uv^Ogwo<%rPm83*|0JR=UDEXRjwq*vv-jIe<NJ&xw{AjxYtglZrCk;+vgoU zkN;sX3<@2CK(jXl(VCrYMH^G)dH)ql!3R)>_(qq*Tu?PqZ@&>{2#x@99uV(ZyTJ4( ztib1RbY$=3xciAsHt602yk^nQ0HlP#-ve2ZSk`_5;&E)&bt7=q)$9f zrSU8^&wvOA6vT1BYCz}8fuaX^0h&i$0xQ7oO8pLmlrPRP3b3kFQ0a$b3bW)H10H=w zL#e9!&V^}3Agrd&X6Ny7feb(WAvBgnom8M_jg6ehYA7Df3Jr9CCPM9vLn`<_u{dA5 zCowc$ejjusM@-`U^gk+`Ng+Ar!uWV1k!?$TPp?1p9Bv6Lqfs!%M>jZGW?MqeB$L=n zWJtmOj!-guz6=U1xtcRs-->&V7p2wD>|3J@+bz0)0*UeoJe-cxgIQuHi=Vb`ZfVol zEN5LuVD#;Nttza+k^?;y@a|V|keCy3g_&~D2)fSasfISvPBXF(@c71!tgDSA(26>u%Z;Lo? z?JfB8GT=vHkHg|D`w>s$hv_Ddn>~t_8>omj01vZT-AOf+n{wIWjy-M~-mZOJk+n$} z{>?f^kb&14jJ(WVy{Yp+8^YuWq{i|RM;Ny3x3W`p_wTKiTHdNpl*xDqgYEToAs_4`IcrsaH(7mL?r59ds!Op{pSm9cQQ zEHUWAhhZn;(Uz@0Q)T>w$I&eCTUqKQeE3A_ue!tRcMFA&+rKHUz<+veDXoZ@U@?py zRN)jacgw4+uKvtM{$o&3$T=(ipsNxGEX)tmKui!lh|ivx%C2uYoz`L& zX!Tr~_uOdGp50`?+zel6$=qOW21jSv#xpIY=hCd&_sOKrut)$>w~2`z*&O3Cl2bBt zG}|wfwmPD1NvfP#=k86n_nX-=h$E}}X}_3c22bKdIuO(5+EqJ~VN)F&Lrv`5`XD2Q zqknaSzfJ+~)&{g#t2YtSxdYo15LdpRX(-Aqu75OxN2|g+gWGFLRigC+w_aWSKWo6Z zzSLx34r4gaMLRH-PIkQFT=|uEUS#*N>_m!2CdhDZy+V#6ml|UjXo30KCHZDvFL?%_ z6Tjjb3Xh5+@Fd($;=^zu&HT*q`|dRHXI?EeXcNx*?ZU57sa%^I-21fho@Pusxo4a; zC;p3PY~#DIkjEJYbr;VG2};%B6w^!tb0OQ^X(m6{a_#R3D;0&ZY^W?!qmq`P^#z~+c+MJWz1MoR^Eta81K37;x2_ z3z(+Q4R1>h00Soq7&ucKYt5rmBJ^2RB@{_5eBD5`YEL72@}X3hLim)(NPt>pe2rUO zKD|HkGGg~`yg@-e;K%MxluX3Juc8qe@_d1nspRFvRhtP^vv5lln&E$aW2TsN60Q|K zabYYm>E7K7q^)=Kt^~xsFhttB@p{dF=@?>o6(?35`}%Mos$zq(7syz;DAeCvu8hn9 z)q384_l!x8dQ?*!bN1wq<|h1BBSyRuoTd@ zXq&3=lw3O$!F2GGA9$?Xoct<5ZSAwiPkGkaldZqR$0+F%$3F+V0s-cNl`4~4j!h-* z`X>B&1PMn!Xb$LdW=12egZfs7Sn^t#V+2;nR<#rne;_7MmG2vO!CY!97{Jqo1rZfK zH|&WDwPt1yNqdCpawitclAczPp8VPKI1w4zWvw@Ik^lkhMYjUn?i@%|7iLoX*oH;e z#0DC^0nqpLHR1-a;$lZrsr?FSZ2bfB#tK#6PL^t5NX651-Q6OyE?4VEl?MN{;Mx9dk|)UH?Y ztPl+~AiB{I$XCdE+!LK8c&`w=yjeE$n6e}2ap$!vJ2{XS!r*-aLvIuAoBwGId*paqwAUFU9Q(?@wH8XB+Yx?UnnaYPj7SN{!tM6LG<2i)$;sh z_{CLPA6S;8iJj4Mnz?UwXG>}x0ku(%yuk9wevTg~ezJ!d`q8HI$0&xQm^;Ux4O;;( zGCPD|VEozv?#eaomo#vj3>B^{25XoV5?2KkEm!@0xJAgRLjMV=EVhnYzUVw zNal_ispX1F7^m~@$S_F1yNT^#xm6yFDvpS!5OH4Y49Pp^BVn&pe1z`C)@&DX=OdGw zYrUGM8HqTXvQ}WFPQr?biW|heHxGsIJ08rbd6rQt-Ih>pk7#nc{c5&EX8$nWhWb-5 z{L%TLz{j(U2Hp&8E4YF=wuk$lv2hYE;4K#Rce?8tgkzaqfS2!hpCb-a99IMvGR`|t zeK6iN0%9iD<{PPG4y{^?jhSR-yKy<^l3P~Q^Xt`c7Sal!KEnbwwsxL!d_qetUKuwr zd%2|*oe~k`H0vE)h%l3X{@7R86X?1^JZpa? zS2s0dUVIkp(`&6EAOl%m8 zDNzYXbh$8aeW>*q(RJJ=V0eD(+>MYxrz?A-WBr*yK3Ui1pNe^c-{H$GSIl~Kz`a&! zUx@^`rs5*@nql>bXDF{{aBlg(Jl0?jdAL1YmX`P7wVf->?O@A41TCkcK&jFB1MTog z;_cm$d%w(R=K_es(H&>gxctEMsPHgUnM4vU~0WrLuVL3kXE;Q%x8 zxb?Q6x8Qk_{*C)fm|zd7w5jMd!eFus>nEpThBKY4pr{prT-PA!MeUlSU6x8$fuCvs zl8iR@j{}==DdLt=S zze}zDTds9szj8xNr~XVYJxe2hC)`oQYkvntqChH?y5P`ez7pPaB)y|5(bD#KmF5@< zig*x@@2(S%q!;<@WKWElVkI018Ie%ws3_l|jG4N+VmIAsYEayj{xuPLi)MqP&S|Ye zE|Xl=S;2eXR$Vj_L+?bd;$8&5=vBvu)7L;)-!A8kmTukOs*{s$cD^Pjc)7eHGA5ip z+~fgaj-ycsqC`YnZtg#%R4XSX6UpC@{q8%ir&qf!_YzVLWM5E7&pRB&$7=BXpxkd( zDnv4oVOzY8U6f-)zk`(e^IU&erx2C~L!=F`P(H#q@hY*PM*V6=XVZ!+!0LHn+v6$4 z_u?FA$E2drlBKIu_@hIBNJ&TS(I{m$wKl3ANx3H3m`5ql^*#xBT4!WVul&-cQ7WH%cV&!@wH z=qt2bC;K6Ka;zXPJfTFP!{0Ki=JUn)+u&_Z3x5Y5Wx1Sif*0&A$p)A-CI^5XJ4 zmz3~(3&J6tD>Wew+p{j&#qUe-)XR11usg&fuyZT_Efa^Y<1*kTVAKq%ti)nWy)RoP zErH5LYDS7WNte3Leiiw$e?md1;l8%Du1bRZ`!H}8O0c?Yd|wA@oj(Z zmX`Cw9dR;?9zLmgi>I4X!AT>XX1*e+UJ|2DXhmxZC4GSPT;(fy4moaxnPx2s_7B>6 zdqVK7{f9pZZp`kz-zXM2mzEh-|EmRLt`XL?Q|kK~i`xGv z@q|9E|EHvt6s7cKjDv0YnOeg(W<^mG=|SlSE}bvWdClp*zbWul{?Ik(`bf2jJTC}{ zP=KY|+8d)`!=qQ3^uqLF zu_r!e-WMy#W6yVi8L8v!^bRnO2I*#sqB^cr`YU7UoVmjOn9Pr41l<&TKsEI{3iL$ldvJLBki7+8w>Nfqa{_%3 z%cl6zjFns6;g0(tkM=_vwi>bPBVuu1MYShn0*%pRzmy-K3LlxL1oWnqhLoQbznQmk zE1G7>G=-Uj{f>@KP1}`bKqin5rLbu+t6hyIq?Jz>T{GF|!->s2qZO{WZ_Al!I8~#d zzc~)ZkFqd2aXPUGvA0*!6{|9aibtJs_p^oW?Txl1#-j`**NUQhgOU|di6xiq=}9R= zrEgX*XyJ_a=ca^ArI;+&(L&oIFRTgdH$D59WdC(n+Wo)WmG~af0fV%t&9Zc@;a<#V zIfn7wrwd`@HR&%16|Z(b3w$RkuI+yms=^d|@vy;HO5{a$zC1RNG27S7I@1cPd_zcH zGH@}y240v#0uvJ~s38^E@1{?ry+1b7!WA^BI>%Cqi55tNLZ3C7>#bsM3DYh-D+(`| zd@91dl@64)z8`bhdwXEj{F>>X@fGR&eiATgq8xlgx|D##$cYZd%NbD}(_8QaA<*9) z*Ny<~_GO;%faMH1+&Vc0CGldX zeM3*wxScYO37&>})7023;p}Vn=-%aL{cJeD!t=TL zD&bgj>1pd@Bf+g(gtk_@%R$&K=t3!;%6PdUMJlPv94eFF3{&1m+}Rgzb&Bj)>7dfx z{*b;I^t$Fut=)TukXkNYAZ=qf69XrI!=QS}=W)=46|Ics$bByA5tChGvM@uiME#(E zV23@V?sB)H^?2*p5RXZ-w?I%8M^Sn2XN5)>C^td#CAM?L<+`HERjDySLW zz~=~U%{g1&9xuS87Ivvt2t2H<8p#&pEJJksu;E+N<}8e3W`=Rhb679mF2(|pLnfx}{)#;M?UIy{G=Wyj!hzx1 zcAvUO18+N9jZo21N}+Futefd0!C6UF5Qvuezc7n`tb31H@KgKD{N9VBijvQeGHbe@ zuum-H$uyILN{~w9*YrWFg(_4YC#yC4ZI~}mg*TcVR14?Dxaeh>l{p2rAO4~{Zcntt zYGc>HQ{Z&TgLSA@vUM?+T>G1C2^i`jYOs54@(FpzEr<7Z1V@vt2AnfcsrDzx!%J@q z;`p8JEu!k90!|^t4sa0pOm|yBe!xCFdb;#7KV+;Gvly0A=%(jl8 zpf8!&)H%c2-mJqX4$~YhzI?)(OxWpK`#hJ9y2(fBjf_t8jG1e^_aDd32+$oN#2S-5 z0bZJhLMj<2algs@>FvCnf$SCW!W4hYMS;~lmCZ^S9s_{5R8_jD1vo+FL}kF7^V`=E z$$H+iWvHMg9*a`R9AuTE+ItCe;oxK`|BL`PBJWuWmtF2Nuu=3_ta63s5o=i~8$&+T z?!ee0+cLW{X>U}zq3)$vt|aE8OaUJ<0P=J-9=0%ev#$M(S}Q=*y2U19p;k_)Mt2^V zHSpysRA0W8i+qUq^=FMCw=FHvb6u_IMB1R`vplZ{?J=BETsxajf|OHAufF9BsR6Wx z4-S2mAClAJSIO%`+sY>g-}7$h37R#N!7ROYi=)Pog-z2jy=JZ1YBA4?Xd)exa@C@e zWdt-(>qh*x)o#bP+Uk-%;?g}%{gw5eZIdeVH>wcNr>OW28-sot4ul3nsTlqvGFcRF z=v%eOKqcJ|nb~S?8bCNWPK|4(@}2EUsW*5g{tDk%zb5QxX}`iq>q<`?Ab2L1IvKT- zBn?;4s@|t%5g+LWZHaJqvOvjM0|hapgzc77r9leUrz#8khLFR?vAmx}?H^#aU5AWU z8m;>Aoc<3_-xW;!(mg)D0!sWYF=O*y-ocnCGti7E>fjaeE29Uf%y08U%8E>aMD|vIt z(t5L6FDQTW^!OR9oKkG=3lB_7{1RqtLJUM^4TKOkNhas{Axa9G*t78`x|Cudb$!8) z{t9USO-nv=$8jm^ZYzIREc1<B?sCPJ8i z$p+=qi^J)x%n)+1#nVbU(O0n z!A@!rJsqys_hx2doMQR}*xh4PSTz(y%6=(ldilY=0L8wuazr%T!d$z-kytLZju3%j z0qGuis8XosuZ(CmEa*1Bqq2iGC>%1IDOP-Y8fQ>0+}c6f!5TfjwSNfmzG zWTyCHyTprZM=`SoO2MgNsL>g4L;Lt3PEs1jLy3X>idQu%A1xcy;y7Sc_d`J~A|W#k zT+s=sT3Mg@<7Nq%akN>94gl)L-le0wlR__fCn)vw4Uc1p*CKTzgKFtIR$;>l@Q(uc zDV??D3vyx0dK#Gd1XI({v+Vr(w;S+R#vQXuPTF+uvH6xpTCKoKeBF5-j`t#@4_BObv-f*vsValvK+?W2*S1B(6JB_mM305zxF%yK zK!d#eKcGs!H)(lZb=%W&R`*0 z9<4$qUPU5kEUI0Te1UaEhHnqdK|b|FG59T?hJ4O`{Hn7Vm~eLMW8R9L1Y1Rhh2g9! z?r>3I6!?z6Wt5am<*nlghr-mG`klaL%=95|WMeSbu>hQSCxVHxzr(O7Fa z$b{!NOU+1?I;)BBDBx&F8&%Q56)`Nqo7Wi?{q`+~{tAe$BZgNi?@po{iQ_Kcnl(|Z zY&;I})i^om&kOkEQBHyr*z$4F%_myo^FN$olr+GAHd_QX}4F@WnI*~y<|r{cF=+Rnrg9HukcltHz~ze?1%J; z#Y}x}jsEfQy30<)TgH9$qT=Z4-k^`kXWG45OWrk3(5|cM($2a%Uj3`sZWOG{P&<^E zCWm^KzE$W@O3-ah9M59Xni567#Gn8t29)8$VSnlh#}^wRBj-h>^WtX1YPpK@@Y5AB z%4xEvu1zW=m|$OLa!3#sag%wHx+@>D6?Q=lms`aYN87p%FM7$R1~0xbqZSOCcL+Chh=7-dRf5y!=q z=_+I#TJ2VQJ>)Rfb1j}Wt{U*{!o^Yr`Tj-Ah0D-z`@vKZ)-3gMtwr!wU%1iu+Qap6 zOCkD3Qi@+8f$;GX0su>;U}iR9i`za}u&5P9R=~?hu=*#q(>3>8?gx&1ei>dC3+#P= zrdHzODy8y{PA(RC%%hu6HMR%zxSgI-++Gq>|H|Ez6J;Qf!#-&MMuw9?5@QU_WukmW z6YQW=t@x`Pj%kaC_?1o6bn#gDo6R4uV?wEJ6C)^g2xeB_3u(q$&(_y$umWdg&5tLE zfBT9}(wNq!m)+Y8idQTF4q+K(z*Gw~ZG)=9NefpTE1M6nc(Wa)`x@c;dTT*2O7zTq z$d>)<81=E@;^z;*f9x7GiT+SXiI6BHkad;yaJ`VNOucpZ3K6RF0l_yNGL-gVC9pFp zb?6SC+Pr}=Qao)qEezt(k$N(k_5msgrPuM6p3_B&TON*7!oW5X9cl;27%~{uhX}Ck z<=)#J5Fp7x(bU1wEZAiYUCAhiO-EUiVK~C)C-QDwB9A4P$U%;(?RV_=6|1T)uf{cccfXm z#I-XVPyD`2VECZa{mfcaSfx(ZQc6N%G59+@w48E7$HmTY$m7Eu73j3=M$j^mKaW^K zn5;Mj@ze<1;pSz=a2a_0)M={=*szdp0i5qktbQhv;qZ4RlSeqRVEsvdweXfF_$1!PcjH z{=6qD<84Jj*H18$2Kk`OfOfH%gMQnmw}@yx z;u6)SXV#{pw|PsM_wk%ghKp6UeDSo3l+d)gSpOO`@>SdA9dCgdJV+N^Lb(kGQxKwvXS%>?gu`k~ zoDQp)35sSBB!Vs`AHxs|J3O#eZUgW%d%x&)G;N58JQUEaRjOgdkamGIOBa03 zwWU{cdaXPLjHpmfS}&rf6T!u97;^Gj@VB;x@*BveDP8bt`?z^hW-tEq445zACUF*u zN$ts?%H6{`4HO=8IT9uFnt>}1e_2a;Ry4O3hmVix2TqXQ$__{y{mg&Wt|Kp~>ng!y zGp5vZGBqub2$eBChVU_E48Z{@$zi5;?+s^&bs+`=W%`erpaweCV%-*+j3&v}F*4Lw zLRlAMMSk;(Hk{k5SxkrQS2Bu;BNL=YJ@4fAFG3?kQB5X}Qczu=I}rbEqaebk<=oCR z?t0hb`P%nl%xoX}+r$8@^>{l>wZnJT25+Uzd+woR28Jb=`Lbz^SdXkw;JYK$L)agY=UBzGWs7Hz^pI z4E-$tozc+k$2i}=u4px9E`f`{9O3k^vRYGE_<92dFs~)HYuGaM*mYg4HoIg*4^BO{tr3|ddK@*np-_!5&TtWR+96-?AEWghvZ_l-YZ_+`?7$qc#~W86D-ubOrm+1d z+s#MyZ%6ofgZ*@uWL_f3E@Xy1tHsp&f+0^?7C6?l$iv|pNQUA=fjY4-Ro%ha?=vMc zi5jg^3@*}i_z8`2B0fXU6s58Gm#Y5#o)Nbay83ytjJ~czJ-dzD*T%00BQ>$Iny_C| z50)0|6bYqYsH{&cW_G9}pY4u*4yO$I;e51G?}c#d4P1%ky(e`ZAHFPpGwE)O8^~lT z-atBDYoY6n#KNj>eQn)xB(`Nz0zjYkJI%B5qCP_ii?5St38cQ*=}4V#cpTM>1RtnxRqo`cci&CeU8Q^oY zcxk+U@Jg@_yEu6(YsosHO$|=YMU&zn-~ot!Fq3Etk~h^n>?|dejs^zNcVZch0R2Q? zqZB~8tIgk&(zg^|Ttltu&7B=WY-v~_wlr&)?Cxtq?(P^pe>A#ArCT_DMR5+qQit%Q zSU=qEa&lJx)S$yvnudKV&%(}(|9V`Y2l{*P4QS)YG(5d&TL6}?kSolEGaOb~a_k{o z=2#3s%)n_Fps|0KK>K?#-%2{A5tBj}I8%fAEWx(H;wIC{ct(x?jlHDTqV<2B#1}J8Ee=W*x zu$UM>9ZKdupIiTQv2W&Jc}BH*>pcHcuUsB*V+b^f3n6kH)y0_5HoN+1hn${=h&3Nip}2(2PRQCaO2fnI`iy0w zvRk7c<+kt4j+a_>(~WE0ws5#O1_j@$XY}$Xp6eS5L#P_A7Mi`>Z@CvPk4j_2ZKwAR z+I1!r{sHPPBZ*p`iMo2z`UkP~PC>E^WuL0a>=B6PS#a)iGFq%=_PtQ|?>>)8E?g~( zdCuKMXi&-=?1BqqlhuBfg*q#Yz*?@21B>b%9PT)dQ0^+qqDiys9?VXv9oooeAIu&e#t&>+lp%uIhS zu{ihECS!DV$jRkeKpJ8Vy$P(Lr<#1@A45fZeSm$s%^TU+-tcqFn3?D4x~2*7E4MJg z;@&$$c&bqTfuS?V>5>sM{bryXLP-Tg(f-Uj-?V}BqJo&mwihT*&pVZ}@?00D-d)@DEr16I5e`GBz8fwWza+vPBHj0-W z)^02|@SOFI+!}VaH15~?*39+I(Jl9QGW~ySB0^F1KRybx3N3~2N)hDmUQ}oxr7T@2 zCFNAB8UQT79(SMt3;R}sdE`A)e?B*S%19uEW{o?Smhj*kl#ed>N!eebBg1>^S*&d0 zOFGE-{Yi!H!V77zliE{I=(Sj~WA1O%$&h6f6vTUIDsQJ3PzL9ORFjZ#1;#btQA*OWB%SLbl91X2}=&c zCka~q1@knjdB0_yv|tmte1JgF6=<#cN*!(nUA3xHU^D8E8_ddow^4u1e|?zCF(gcb{?PU+{afZqO#R71>TZ8ZEYeh@O^Qn|+CaG1o&`Yd)I4D9e43M5Lmc+J zw03$*Pcm>zO^hcmlT7Q4rByAEC3ln8Fl{CCfx*Cj>Up?UXMg_VEuti*IJ5(WgSnU_ z+@6?*wh~2nB2DlZVGQ;%a$(ZqYS8g&TM8Gkp}nTlSA&i$G;5dqUU*iMf*U;RY`4y;r}5yhcPx{GAC^Y4>C_LtgH zMv)W8upL%bz_y z=P*PQi+VmAo0w`o9lgDcs~R=^rmho>xM8E5BcV^Q?7GSQ#xpP|i2rwpZYYn%q*!lw ze+gE=>0J6!>F&qTWh^$$98o_F@8O{M0?xd<(3*VPSHP$d`)awo-+VNJ&(h-vtx`Hu zSjLCTfqp|A2UQgvOlX$edH)Qv!BcX1SsE%PIL1jlpvQf&*9qDOpQ8$#wap=LdK2 zXwS9p&-{grz||7Dung!Vjw;hE4<{eKqJ(n;epSq*$OV9#^AXeoY_2}htN%v}@Fq0z zTaa)GgpTN4JKL{kd1mwWNR6@xlyb;CB~9c5aL>!ND)B{zn5>ElSEmdPq_nU9toD^# zp@Fuy3MmD$KV^I;tU`i*)gg?O5_V7uWyWQmJw1HTDWn;_3q5QU4%&RE-fna+VO!qx zuiXq;xP+u#upYH;C(QuJK;}0rK6?QuJRXCqfl#X77dh7GCrr(5OgYp)8Xl`iBtl~F zyhpMHNPt+k_B70!hltM|`qjs^gP}BcEF;13?RkVNZ`@M~a$fG>J$Ur~`)%6-?zgVZ0DTEyKL|$&?hwFkMp? ztg)Ghcno}V@*PXDZH?c1)f7X^-3(ebZN$ux3A(cHH?I&-s+C^AqLnSkz?T1plDAs^ zqFm{7wdzu;doXcwSDVchdQH9N7wqJ5T-ou+kGIJn^1xbmN_*U?4n=dM+GuB7EfUwp zRq!)zZoAS+&(0!Rr1msi!YT41!HR9ZY=OAk<))goT&9IN~sz6cTo{fkZDUnCZn4S!E+-yA>#gP{%@5 z+(%=fHpMPK=3j_ITNu{}SP>fc?hMakVj79I6P!14&YqmCx_VRAKUnc|QAafxW`y1b z-Chg5I(}xyvda~{zUYU5agt-#Kd(|+W#-fBli^B+5kz?Y6;mP&HvaO0WhJI1EVY2R zk<1548GF3N+yL`sP%@Wh1nOW=3A<%}CQMuxUo0PUNC`F(-s@S)nuseAjPHmGc=~E} z!+|Xyy51{b*NJv)tIFHE1q~yXZOc~l(R96+!Iy+x#MeK*`$&_VWqUT__Y7tU*U+zQ zoZCs@%jIWA$*@5rWw=OtnSv8_>}+J*11D^9TEsY$cn&OCYDooIQMFGQvR}-(!pO3b z@PA+`L%(ij<3k@b5nd$-3EZXw5g2csu1HYa9`#iqCB3g?YAzzOC*uG$R57MeF!_Gz zM#3&Eydd5O;kFpqtV{kdu7JMh)Z1K0B0-Iu6PFHlzOoy#9uv>&`@asORPAOcSmPUs zPIsf6z7}4le7T;tyI#)egYX4Nlz#Lpud6i7H>@cl*8hQo&M zn)yObR@Evo6pd4{49b^ngnF&pK}BlSe!+1XR3~Uz+!|+%a1-d75Hz%_hySmk{`kP_)K%ij&(2=PlQ-jh069;|nWfNNa3V>X>{1-yVqv@+y;7}{XKbe>n|tfF=6Rtw8Jq!|=$NX*udOJqifuIXkQ*)N$g7WS zsMc};M282vMlnu;`kN;&cF0la+q^>D`Lf{>$3v;ghFmZARnNMl#AR>gBq+5H?tqnR z=unJfRGGj8nMes5PtrWiH!bWJQwU8n{pq1b*jf;0U5#%m;MS=`R5m~|eDND7fzZ`K zd%*PhdadS#U7v)KU2EujG7Hg z<>ML=$Du1hMxy|k(D0G?pfz{fHbKf5#gg%muGFa zsk)4M4JmOErZ-zlGahC+?HnS#h>YvX~+_yLdnQ-y?eku4|R)Lva=<;R+8ig->zo<>|SsVNQwl zO-!h?P?J5ZvDWS7u8)^`z{JHt{Gc5`zhVFo_-k9sSGdaor~lqw$uGKfa`$v-d=v)* zZw{RWBwyD9<5Nel2ZSLIzBCQ(!pfHDF80SsG6hwg8YO#*;;QtjLAx z7rli87)C=plt2Y}V|F1Ah{Rd@zG5uV`voof8cP7~)+I5K!fa>o^(;QmQKe?N(FmuUooq6aa4vdp0F$5fc6iHl|m8N$=r8a4_))C0>T8W?0drM z!5FOUYeFOjWz3XI*fWM0tdvVcq)V^!cfGP#)FR^gQ}24|Cg(#!Ij0^lB=t_Ow*@R1 z`%zIx{7*agFi8`MHiJh7FkggKb;<;WF{WaPn-W>Fd!bRC(S)(XC>r+pbYUTKrZSp7 zhlXy0K2x}adeK^q?z3V*0d5jPT@gOw{t7kGG5l@$)=*K2_AHJAX^=b)3n?}}HY4M- z)?b%0Ue;5xQnij7n^fq*K*NxemXhx?V?`YOprdj)2NF`hYe4}urK&z12llE}vywku zb#%!>vXL&CGE+0ncZxp3kPsxZK$TLn8?rzn^QCGROiax1(;Nat=;sujNPc1(;+$S+ z)MARFv93bT{I-6JO2lGTrAhLOu@m}djd83hn-F8~!N#*A`0bvcT_#{2z*3O2hrYqF z`aFl>-7H)o)lJe&iU?Cd0V^uDPwo>3a!ETrrEV~bJM`r4LN*L!mn1Ib`P zHr?>`Xps=3H|j3q6+p+#=}pJ80~{SPuL%Y6FEZ zDYZ|i*y^NI3_HnN94M$Geku~w{%AyfKD1C|n%=0=p_p*Nl)UUO#QciJ8L*MmlBBVr zgG0+=jK%K>unEJ#RbZ$E=>zKYL($J@3Pkk0ItekB)~mOiB(=Cyoxab<(K=h;L^yqd zk>kvfy$nR~VyDc$x<-}h#&=#W?p3s6)3&i5=Z^nOgr%V6_Ii{T*9iAJ;7l_y)_vl@ zj*N-R@YLcHD~(df@uBiZ)ye7)+LGX4H}>H^; zX{_>w2{9QzZZr7`yjK3iFF8zK)i*YQN@(tnkfN*5)~);u<=VQ+-&vnj=`~G&RW&oJ zUum{ms05|3S!d^_Kg!`kJ6@Tl2j2M3Aj?wp^eH^k!83mQoMC()tKEfys|?2hu>DwH zw`yU`ls+`y9MNlT6%dr1Z^y&cVB+B&Tpr13drp;;p_2+y9y>`1%3jHetKPPQ8v#O2 z%g~L5?L3|4deg}l7k-D}!uCgmSW(C5V7WIx_f!z^mvV_IiXU-Q(rL?f(3HZd~GxgGNzJYt*CdB2ymCaq8US3W|?CEFG+LA8bZzc9>T8zOF`}`-kasw^`kP#~%}T3ad*K)U;Y7 zX>G?sd3t=twzD6MF+8GzWBRbI||P zACSIHU6P@Y$X4fh^9fk8cAGe1>t*rAHKZ_D5m3`IKf#mwMY>)kmVESKgFkX2&F`6ymc-rEq1;TUc}8B{ow3^pv469CDDGgk1J z%$>T}V=3pEYSXEmUU{BwRALS5PhDWJ>2SZmEC&B8NI&5+PL#=@i0%}4^OM% zj3rzdHEnOIY)o9NWS%^>mN2%7g1eCLSsbQiJYj-lDw22sQ9z@l`w`Yw{5#BS?0|)W zyHLgUpl#FT7u9sZ38J(TDy*tRoPz8_Gtq+dIO4K_H?`b+VJuQo3KTP*jQs`pJAOoG z(>qNIJ`aly#EUARUfgO}5+kcZUzSNjAyw;|1RG9m;>qZnTV|2>DXnx!S57Y8{D=`Y zG|%SCfrq_Fou?P00xmS6stt=OB5~>aFPPsag!_4?+r^&|MQm?tQxlR=(Cp-v!LrYt z{bXYNT4>b0$(R+WHtT>IjEaaj5SrtQDz5P!G3Td67rV-#KK8rkvKba-wfLglBhRp% zU{=D3zOOmyXf`a~+?^8eVM~tdNytrIdXos=n%g8z59eRHb0s5bO4F%{Xm{ zxQ3;8Cxc~*?ggdV)f7bkG8{Ipi#ojE)snKFMaVAZ2@dJ4MCbdi_mp9FmE^()Wi*IT z@R60?B$rL=PxC9JFp|(sMiS1j2=Trg0p^B^-BJm@lhjJMm2kmnu;Jn=1dOoZVt&SX zirijoYw!GuUd@lgMktq4hhI%j&&$HfT7@~!6B}DWOZwutOl_EA`^5d!@{- ziL59qDgH9-l_IoCDH{KS2W=fckJm@+MSi>mctZBFpKgRv421W36sm9U4xgv=?J>t( zN_S@82#9-Z6z3#u)UYFxXVLiw859lE4YD7{W zz4PRJ|Dvo_cX7A9w-Swv{~24G2B{-v#xKA#BD1foYa4qRfezm>Ulmkh+hnwcnx3gC z*f*4BM$F$RVo+`X*VQGKcQ>5Vl|RDk!(+xcl)^+cLSv{~=jELGqazWB|zEf?CY%-4}GLRj<~BAlp6#qp0%bh)@SP&9wnTvHyylTKr<8>pxGT7Y3$wm@Dt8UHHZG7*A} zvZ=F1E3=fP+bx|<;VJ<>=AFq(70YQZfbb5w<(9Xw!&nTxe$Q%<(Z|!zG$Ye07Wp{t zOGK5K4Q9Oq)8S9-*FE%BpnC7H}3oCd6rCE#zEJ?1zMSj-1vE zdBhTqlPqeX-jaZi8wU3rkzbwhbi|vYlI6Q@rD{8ay z`&;F$$lQc}1FN;-tW?xxf~d;JXnS)N-8Wf@ui{bY8?1H1n4P^tJ_X}GL|^D+vyBud z*{q6q1F`ejtrdRC7r4Yff2wDl`_r2~VP#j~i`PpA{jsi@cVAh1NPqQ2E?M{|RNM-C zYL5T7b~E=T`p;#*)(wM`Rr=%YA=i=<7nW1D_Y_)%UfR;?r1!gipQzu54TxR8(lk-x zIExQDb1UI98;f94xqfL%QhOVZW$@(<2jp`Al&eOG5q6lI#M+WB>#KspdPHr#!)aqV zOK!Ps}w4c{cTUsAKu3@_ew8Gup8y+Az{;<+<9(b5l((Pau#VkV_QNx0HwDsn!)14&FNqZ95!O-(&+ zlXpqzdg^BQ{1XbAIy*f$q$BDrLW{#|9>DbU^4el^g%10=H}3i+#p_TG#UyrFa|>+q ze%iF&&*F));tI{l*N8|AF_`jrFB8bfU)>0sB-m2Y^l6aHEpz0YQ%u5p-RGM5`2KNL zG#n{@^Rp{>1o5THohCL`P@pi)Ex^#t!1994WavP@~- zd&UE0K zZM%o;74NXirree1J)2)0(acFftHsN*n_@Q=A!0FU?iO&DrY+-8=)=W(Vkr%C!=Mtr zJ&MOfMO#W)-_nhxV4{?WAa{^4P_G+^eG!U0$j}@2S-d3P6x|fLaK1#h;HbW_-Nn~s zf)aWhHpQj-=Ln|0=d}-gT4A%@&abvMSK&PLHP_sH*_G>BZ3_ zv?4UwK2sC@EUPzg&o#ui=pA8tdgv2q zzO|le4Om!TtJ2I=`*kEcPuz40#to|X8qNksi zD+FEh>gis+rbv=i!ErZ)sye@>={x}VD`bfm7te|ycuf+c{Y=-*!8w+Yj_kt_xu;$V zt$bTIuwo;#Mw)rOFh;UeU@>gIHBmB+;`GJtmGznV%xI9Sh*o$Oml@p^tf$v^%Re>%Y9`DNM)7U#FSMSNrqc8MeXIQhQh38HH|>Ks1z`B@O44)Dq+=8WKoeU^ed{?k#j9RPSaQN(W?S( z&^>AqMPIpx3~f2mqDVly72?Fmo{iGFFCwQ zdPq)ieiR7An#???_;aO+9M#*&qAUEL3eiF(12~v^7lD zNT+CQDSh0XI*}&fzrrjyS(ubiZF!>@A+(bxjxCeSr~?fw0ltx29cUcys{(l4Ywm`e z_}<89-Pwsp5!>}3dz_*ION7VAyQiLFp%#jB2HCx#-RM6GD24}D_P1Vhx9sGarqo|- zGL7nazT^3sWu0>3N}w#Z|G&SV+^$k zDmt}lerX-I=35l^rDNUNNX=6A1k~P$uJc#7m(Iq#3f~Am`;p1X>g^l;=aXkIKo9%P*jhOpP zSmFoU#t%pE3h8HW8Kb|wBAA_K3TQ6(7OYlVcJBFqIEyc)K)FyO%`rztu}u&nmJ|b^E`B3j`nPr zeIrN#?ghfaUir{n1u{7Xw=vC!X^~TGgZ?db(2su8OQE7#2f%4d`qBLLzZR;gG*g~8 zf97rNk0OrPvJ?{=NB_zD1FmiJcjy!O*LYscL(4>J?*jC8a3$2NGh%TxGn&o==R;>t zKjkz=WqG=ZgBbGn zL#ab_Rv<=||3G*M$dVQe8szpzy}^O!_F$0 zzF3Y%%y!S;TBhh{HnU7xUK)C9O_n_C#WtWNww6SsPWOrW6+XtX2xihHsfe5ZO4Fxi zr?hKh1yoWIcjlFd@Nmb7-m?#1IR(S6Tb=IENeW-9*s*^z8~&MWI5yYdl!;g`;F7O+ zWVD3?$bY!q-Qq$zLlt~-*FTf}gxfy{YDu!oA&~ZTcZ*U=cu1__hoGy-C6U;yD%%9? z`_hET%R0(gwQz>=CZWe-FCGm4;h)M?mVOmarqLAhDfm25M(eihY7-r*+zG1i`8(NJ z4%t}ia=obMM^3Y}-mDII4DI7uh}P|=-1P>(Y^v`C;M)5=;6yHFlUrG-Vv+sUKic*$ zIly4yJQZW2zDHz?Ozxx0F=18Lq#}(Jb*G3;eG&4`#d*W_5)F6o6drkpEzv;lLO9YF z4w~SYtSf5yY4fIPXy6LkrEu#~MgX>T^CXn5>1hKh9y0WafkJ%DA^{Ml^eT54R;5GzmH)273Q)$P3#8TAGTs(3U=$YjwV~)dUB>G zZUAK)KI0$ITyXOt!O7=GZU>_aoP)4+r;E}cMViQ!)yS~0{QOSRe26RS(Z4Fn8-uL>uoaS!E1Xzu~ zuPK#Q*23~#yhX*unZrMPiJp(Bm5fF$n#&a=^t+VYIN3L}zx(6Vn!3r2k6K7~+N#9} zd%bR^g!~WLKKMU=#0#%|-Nb%>2o|`{q+$cgXS>KYJe9B79TKh+by4-oJ8_H|OGX6r zDxwZPz6(GNOe*9a2oR*&iKm*pb*)QTWD{-vF?1fG;Ibv8^Ngz!Q$-z8f+9tEvW-mn zJq1@|Xw9`IL{z(M^?h4`-Mw|nYn z^xWNFj6dYTMeCkw4Mq2S9}lmHz#9tb6b&#RCdGWF^9!bT9N=0?H4=x0!ScYU4VKo?U^2Pj!T+2lp zxYoNe;b!Aqju%F*EFlN0qwldo5S!i|EC9m{o-~)#)+Pk4nkB7b)?&>Rm>2ZXaES-O z^^ZJTdoLfpYs-^<61HT}y{${SQ0b_ijW+`ZyWz>+HsHlSS}$?}>(&Wj=n<4Mk>Iaj zWwwH@&~6T3;NA_jab!aYJbf|<H_GfGH^Yi2Ghx}B#?f0grtbt+NN)9TXft>-@ zdW2OxZ2m9~#@b2iaom@DWJlYcI^5ft4oo-bZIFbuA@rNbUxULrv~^?@AejR|e0fhW0W| zzFzbr0~|py`E~1GdW-Kamfb&GjNP6LTl7;0oo2C7;wE3<(SbsK#v%;C4DDfFz_Wr8 z*@u?#j2H)~uuHz)R;a(W?9t%II~=x!QRwlM(Elk+8{(5{FluQSE4z9KQGnre4=-{C zc=u_gFPEmJQ@{X!iJzH&6&BCIS$c13`ZsKaoEL{l=i0ez>?vJy$^+K>nt9b;rNRp( ztYSCyKHz?@E(mM=FJmau7aoiE)7F=&X7esjgSyiXk4gbuSGj{AI7!&KSu|j6csdfl z%-Vnfjv`*q7}*Y90cRjviGCbU@CW5$i0;t*^_O;x@r8sPc1YMMa|H$(k%;OGFlz=e z5CeSD{4#G~fImY{}Rq@nyR<#;@~=yB-QKQXCS@$ zRlBECI^`dR&o1G-Bk5((V9II+`bGUkk4z9kJ0x3U;Wt=oe+OME0H}u28Z!!@>SQn@ z!!1B3ov&wiHYyAl7ZcK*=ih9>^x4PP_pFJ5_)KF}wKD%5>91IJAsr5|u#l1dXO;bb z7Z~Gb7pw88{xPP2$<}?78P9e+1gcfcoce>Kv-!3{*OR`=Go>!&DH}5jDw+${)yy3< zO^9KfrFd8HU&~-~L?{ZecmJh^XFdkx^QUNRtsMq7 z5zVN0>-!Rr!A4|d`v-^sb{IWaNHxl@6I7$r13?0Z;M>sfFYSyT7`$X+mt17Y?X318 z_!!-9YGGojq2d_aCBVduA@?y>5F>B_A4|1(`*g5{McqPscrpt-NUNseq*T0kem{bRTY1?Q}% z<3Uwen!u5Tlj-fz8`_hpS*bOJAP{*=+3BsZ|9)sc!H4GSM4bZw!@qNtv|w(UnBQ*h zj%JW|-V8A0!Gocj#e}Q(yNGoV{lEAA`=fK1kk5M?5PtEZTN|K<@D5!NF`Da3i>v5b z+p-{N2_Y$U0f3gUpnK!~O(P6AciW)hXWK@H^NEOqm30YQ-0#U@GV!sJoc|b+KV>N} zylG95=PqfW#nB;}M~wwUXthG(?U$`F{My(9q)by6+k)IMcnHuF-lliAbo?p=V#ozIe z!{YV4|5EiuJJ%Btm8;W;ot*p`Vh%9C7rj>i*cL{#JmgWZ0pP*+#VBrhUjEo9A8;Cz zz=P|FQQQ>#?_+?X@xS490u>r^GRrUlk(I*ie}-2x_r2AhHB_e;vzz8R)(i&2%lJF_>h<|fM=VcX>Nt!1c zTl|zC zM))_O=5Ih4D}E$AnC!kBXi2>mAoR?E-b$!6{uFhGh%re|>D_MseS}Z%{yQCr{)zZ}ePAX?jQ#&ihk=$PvtW~PpZtk$ z3u>*&4R8Tpbzvi~|MW`py6@@DxO)?(;gbB~l%J+L@%$jj_C*H-4lZK;R~i4>;ERg= z6P>`84^`+drm;D9uV2)ib6qW)5##;B6R&B^tt8Lrx|$&)S1@=VQZ*Ib)mbjwc z2A+ZVxvzqgGXXZ(5^mfb!okexab@$(s2RwS@-Z~q=fWL*9)%FAC( zl)6iJv#L9}-jDH)Nq3+$F_P>GYP{FJAEO_W`0wKa{ojC*MD@?+i3iy{&B5l$GS&{`{J+n7Y!}BV<-=85)_NLavp6L3ijz3j{8xRUSa*k8?!U&(-&zxu?bu}PKHk1O znOe~{P~ibH^ME$-7vjHTBg#*?@lRShc>k6kUJ*tQq+0O)+tRe3gl|==G=DLIR4d?z zbdf#je;<2_IQ|95l;A@_dR3GlxfSOB&aI}k+^*PhOhtU82ngST;keF<|7F?!83_m}3 zLR5HI*k@3eJ|?iC*%kn7NCKUgz;fNBK<76TMw}7Dk5tgV3MlWc&zwwvw~rEZsXY%b z1~;kbtL(q?9P6L8Li;{Dx@9~`&LjB5Df}CzDkjF;)`Eh|8u1)8*Z;Q zd33xxC!572Qp5gXATUO5g$qR$xnIrn;x%=iOAriweBq}wx2=d)dCniM6swSYWO?G- zyZ@w1zJJrD5Yc^86p${-k~?j|@8$n@tTI!_-AWQfEmzRSB%%;vN6r4GOSu1Rnebq@ zoIHj4-^*O#u9eedCHMB4XZMM{O<)32N&%7A7H@SDbhP_BJSn0c9*yTo(VUZ_*=j;DT!dW zTtga@7!8Rf`MdB`F#mbGUC=w#wJ|xjhD<-6)xj)SqVct)I|~GN2-@a1uHq3u8Wm@1 z9}G^_j3A1$8D>0THXSuwZbsf z)=&uWaM~+$QS9$>B_p@n?$xQboboHlnTZeAgzOB$?lP5w_aPV>OPT| z=El0as{z;Pgte9I@n^8p1~FjAk&KDG$yCOjhw{jlHlIKN`xZN;e~o*TnC@=oeE%u5 zHze~|4@@KZ%Ttw+fZb(YqV9%_$uEix=nj8)xX(Mx+b&U%x}dTrPrNE zka7+~-hawDMT$V&yt~oTcz-R8>UQ&SJ8Z)z;diRe_mf|pzkWPPw1+ldZzWY2G^M@* zuZkqN2y(~Pi=G_4rh8DwZgF`EKRvaZ`J##jAJAo`Vq!wNY3s-Z4FiLPiRrs{zU|kA zxiQs@6c%=U(qZL`CHgFuQySfLB(xH6MqWO@5tSQX&HY8hx_|WgRDL z4|lHj*GQ<{4JD30D5qfvw>m?=%ge}M3OZ?Pr*61Cym##(bur=c;6$_)MT=^lpy_5UI4Eu*sBqP9^|O6ijB4new8x}-x& z>F(}skdp3{l#*^KX{1BCyZbEm-tRZg81Hw+@rPqPe-!R#-E+-(%`56S1Ba244M);p zu^VDWyzcac2x#h%DH@R9C2r_H15A8Ph z*jY?gA5v&kfBam!%{1KnA*{x!`}2gk?a3G$nSkqyT>)Sw;j&gS0}}ey?u0;w3y`e> zfhx@X^>M>&2u$}S_a zQm26xSj+R%eSd6cy(AY43mUJ>Q4ctzABPz~=EL(iAA|yX1AHMOC@UUL2#mf7jASNdE!E&kP z)#|DN2Prl3exAbJ+EGR`_6)rWO+;tF9nZ$TioT@vw9+vpYE4^HXRIKx}BmW-lbC1Cfw} zf;s~6e=n!*X)f3673&dRqmYoVewQT%LeS;(iZ;OaQ1xbCXG-F}RsuH@+mFDltA2Hx z^N~C`x34QNqTm%;p&rE*NYN^jQ31#vYGN1RwCQ1fs37@j?+FVCWWu}dqleSaA?r~y zdNpode^Q;kahWwOHHt-B-*~5Ru`m$>%9q3t2Qg1=N>8%YLjDy!WpC(zv}fmS!1lq& zlR%aizx%ple|2z+eCl_dmUSlF#|MxA}&zX*9fjht( zIyn6B5aIRid{}(Z*Z@L^QA}lC1wHZQLBM2@9G~n=1>snuC_Ym1rZ*2F`>CvULz(b2 zLlT*!gu@2ZV0oIlwrzG#GxCjnpeS;@t!9HU3;0EM0~jt2zfQ3i`aD1V^qiYAnpxgi zY<#~rQ)zR42FzRDxt{2svul${NLcjs_T~WZNO`Mlc1t@mitxpzKW@o9+7G#$4>{yn zlBlvjzj93ip56})7AKd?0fI`pOKRoG%0oI_1azsd(NQ% zw}9T1_uKFOMi_*)neZI)+24?~JgQlpFG9ni!BJVt>6x*jHBt*W!um8Ky zSQtMtBHtr}^zk(wyOo7O8b4$~k%n99F2&mSmEyX$>!bIckqs+l0UHUJ4-eW)Uz)V+R262 zJ6BLXPbOJme=-RT_<@c4)e5MDMOyDhkrh!07xf4>3a_^JIV^vHIJRNWB^2#xG6n{f z2hY9ANiO#bF5_WM{c)_m6yG1ZfYoyoa4p=$yDuC+f`a zg|b9?7vxA>9@HQtte$x4YK1=v61y!GA3k;;SXr-#bS-B{?l#Z10c`iS^b5Pl)l{i|GDhJgE4GGBMQBI|EYn6hC- zx$?fCCFPuP1%P)9 z6Gl@W(hMbS@%3w9>QqG<9oE-(PC(89qN9j^FZ7GYPH)iGp%C-C*ESZ6fc}AT9#yJ4 z2}0Srou4)J$Szq?KE`R1;q8P0DL_6egi?_G#s;tflW%8x}ifBZ_ zX72l)QiwhDzDPl2QyNRixxwM^kVybAOLfgY;CEVJ1Y2Z5#8`H*g!4B7VK=JX{@(ca#^^pc#6jG-qUd`FkkB@^UM zJ+xZ2G{s)^m+(kPqM+x#HL|%8m9T4c+(j37y7_$0Xm1@y=MB7)(5IYr@PKh4h_h>1 z9a5xks;38QJ!mlcncn<=H3XS1A0qiquq*iI!VD_Y#VaC%aAgHW{yJU=$nvW}H?mIk zRH?f(9yV^fZC|PJ`Juf7?Lbk*mr!q4g5=7|zNH<#6RxY!cTAsM#lMVdVK8r4`<5wf zPAuy4WV9M?YAN~s_}rY-A4?jr;9>b_z#ELrSqH28!xT9jhu*OI6`C8lghI#G@Pb&- zfE>QsH)mCO)&JoFER6MwM_C|}&oNfD%{%LEyLq^A9 zD3_AsrfoEul>Rc1-c&GhhGkLZI%f_8`?kt*+@;HyOnRTwlC)I$WABjlCpjp&+t>(( zjEslnt99hpL_Auu#9Y~&TZ}sXX`I&GNxl>KWfb@Q^`MFyEL>&$^nNTvJ;$Q`2ygSJ zJZPdoI{(aQv-Fr{cmFM!HPC>@oSeLi@Yukj1D<;LS`C(a&QJN5f!Yn$em&t6rr@r| z0q+QX@QmHF&RT0bka@=8pJg>Od3I$T zKr-}Br`*D+0uM!jJAHS1qom=&AKP`WW~PuT}mUTcG8a zJ5K6fNjtlR{dqdl7!2$+6CyHsROp+9Rphh;{l)|9o!BX=1Fgc zH`SA_^uqu21>;~d1p3O?|CCuR*+}rNsV;(_?vVGNZs9Apo?s58IAbu`nC4PXxbA?+`6c^l(Cwcg3THX8czFp466YdAV@ zP!x3eUvKR0DWd7!#m7pAF8H*f6~WQ-HA*5TQw$g*g%fYC38CA_XR<2C<}CPV9IIL2 z4>)T%95t+D>H$0|l-8#B(Y5B{+L&TB8?dGmNV4xjmZr17T^Izwba)(#^YDcd{Y z_di z&Xc>Z5Xm;Pm?}Bv`GAaXiY8c!Zo7MiMM_kFy<-naQcg-;ECnIWIF(3be@coL2uzRU zBPX+!*EgUMBt9D&{x0g@6~LRilQ7Ry2I)92DVVjbg{#PJ=5p!t7S(cMRA{Nw`$Jw; z>YrG7c9sTD3=(<6BzcvNbhH4f2v zbH&&5zTkb=|^ARDJO=sPkw6wHcRA*7hzxsatLiA<>rmI`^Yi*%5 zA1z)0jvpXgR$BaIw++Cm(AJ4gZE=PxPU7jz@z@;`4?B@vok2sYz#l$qa5Q zGCFl{saSUCS8w_%KDER9eGaK-tOlIgGL2TEnaWQ%V)B1Vne#-O)wW9G&)B6p{!}Sh zR8!SerMy44h(JvJK2z2gC^gxGd0S$8%ZE<4HF^!T#iZdMh2MaP&IJ^%#oFIrfjpKM zjlT(`-y(`OV|hUuwR~!@s>SpICDXt)8hM|=(DdP2=CL~ShppdATYE{R(KS0J!I0m;4G7k?%vx2MG@>lUcUX59M~0w!r~d6X2ad^ez^%~|BJ zXlNBS0wfJfjL=%;%lk?u3NAHjjNf20>oVvjNiG7hJ{-A3G-jn6UG~MFrV#;$DSNMx zuZ&#@NpJRDDPPDFjA*JMgrEV6=BmP?g5e_O#+Z7c^x)-oaM%*rBNszLj)=00L7u2T zMUPQ49RjC}o*X^Apa@K{A>$}ieEg7-$t{ggx^mbA&=*ZBxlm;5G+UGZiprwvNdpSA zX#Vzt?zIAXyS*v1YT3CT1!K9I!CWd9HeBDo&>ka;65u(xaNGWk)u=EX?=qdv zCw;nhUQ&VU37f&^a-{$+1dKw@m z*-9s+11?a%2^wM~!{)(3P^;DMk5e`l)Ea8lprGu~=1F#M^_0<`VMr<8V%<=PF{ zRuy3EAw9?r_(LHEVw{cXg!Aj*Ro2J=3QD_$PCQd(AUc*~yc^5edc^2silWM$C3QV! zaGIS>0w|=g;BIDL5IYV>y8;k~}K}8p_;17-bt))6Gu%q0xt0 zDb*A|DqL2Cp_uW2ZVCfR#w38wl*4jSE0j4bd#T9`OGGr0+7v{1YFjS1Xns>rr2xi4 zzU@zULxsE`#jx)slcJ}oKDY%dwi%0N)5?}ky&@9Kr^A)?djOjZWtGGR5Fe5d1F3!T8gfKph2kyE&3hk-9hpx`JNF6# zNB-00sVTQ`Yn}5>J5)R!V^!FS6Bd~#{~r5=eNbY!Gxn=^C_Tr8?ama({f;`r1DxS}eRCY@#AXjq| zgIWOrZKb4L;WGfSw!HYv=qnzYkw|h@0Xn5rtVo(J=%f2hEF=pdP4MZa+mcK*I3K!m zIwZ0HzXeV4Xs!lsN?>s=J75IVb75d-GTfkrL_=6kYUksKV)tYDB;@KU?mUHJxlFkz zI)%QD-2}`GG)lRF?`PQEmR=}F0WWL5hyVMo&yn-^sihhJee@skt*SFz`ubutgIHw$SqcmoY102gcyyj>P1I}6 z=cZ)wlzB5p@84iwja7-e4=NnC$1*dkG3$}YLk_XnQ)K5mEp>*MDsb2=q2Vy=pqF=1 z$2`*|?kF<_Cp7RjBuxp4g}t1 zvn?yY@QShiKb?Au_2GQoc)gXj-9-8{fa=N`%j+E{XY_ocK%CJ!KvPUt+FIS1;xfR& z4l-?(<8HH2qowUbMmsrCw%PfW2#FNmG%!F?CIlkQ<*3wp zEWaO=+4(a|o5y8&N0LHjGP4@T8JtSr)!yhddqc0t-cSF2JI{+Mch9}fJ>%VuwoWC> z?%-{u%_$m37S!W+(s-Wy?HU;GG8m73v#fCD2EZ7DcD>d~AP7Vf1&}qvVtfO#3srVP zgIF^2L=o7xE?+gSeWPoXKi- z%*Q%fUu_Iw(!o}J8-z*Vxf75N}oI`n#tEVtUai`K8A1v+}ud`_+)jcc}+%BVs4R=Q;v(S z7Uq5!ch1#3f77cGxMiev+NC06-^8NZt;=$Li1gD-)gsW2KnCDk5K3w-dwlN4g_%%tEzikqzI3Ey@4+%~w^3g^1ssAEOTZDc%;d5Yfk!G3rXa2B zFRYiE?#74Q1lOm~nyg0vog7G3Xva>bgrsc!X*tI_PS?L23%}@jdxk(-Sm%2N+&IuT zir97>`Oq5J_$U*4J-Q|K-O-%I3;$;uQzUt#(o748rW|bEX1LpVdcmKZf=gP5Lk&j7CTA!bX^*@LFRay##Ag#{R{395U3h6C4Vrk>+?kD-L-3Z;wFY z6@-(X9Y@)MhxW?xn-!;>G1AVrPaw!|P5=BQ8m3BLxEjE`ChyFrXpl%ZT~@r{&_yRm zyklUpahP;EfG{Mi&Fg**Y;({>*1-S^?;WibCli1yrCzS3`mh7q52W|p$P-R`U7{Ig zJNleX`)nxgu`Y$c=8^Xgn?cj zD6^k@wl1WKbxQnAd6z)zO*-O0(Nd%CXWx;%x@8`Nv^^>Y{6Lfs8^N0K;!semMc{hD zMzO-u?6mdal5cdgb7~;()bPnughFD2DdR!6+OYiRjAN5$71u3eLrPC#8fO`dS0akt z*-e_JM!jLV+}c;IO~<>cA~{bwobc1JUrT#=}F+?t3v^smWANtN#!k-491TQF!cP_zrISHXeRwf0}l` z;+nOD{UeP5ly)-$+$iQgun$7X9{IiPIi)GYzK6V>16XkHYrsATTQRDs+pXC0FR1YG z>U;_3_GiWYZuI+z|8?Uke)fk=QMjDTDsRuu0VJXsKb44Esn_mzjbD#>J-hxc1A!*P zXbrs0<5hO}b~{ZLGsruOIZ;E4CFIWshcfpBT&}o!ukj27cC3bJd1^Fw_W^W_{)b>Q zz_s*;(GcRnbh)+(=|vuN&(u*`PuNRsD0ojGNpQPcl$C0;4~*A~(F^F;$MYm|Rj)y! zK+oZ{PC8fsl|OEJQhlOc-Q5|_W7Nu0K6;J&4g#PT7&538KoVOZ^N>w1@O_i$g=)s} z!ZHi}|3J$BfKKF^xNY&84^_XTOl#mZ0lB`PFWLvs+DVeL&;3J1an!k?qJcWYyum4G zk}?1$pFo$po|&(uNBpoZdQA-l4IaO*+aS>2^rNN5BE3Fd9UX=!Rc zbxWE|VIMJm0t$#&ugFQ)e>n}s@_TSZNXJCWdmrB)k_hZSiqoOx*FJ%Lb+z?6_Q8A| zoJ-y@IUOB_Zlxw6V=712?fG-A%(X%sDIY-^N12d{O1^2yA_!9%pO$#yS(O67#{V(4 z78%1YBgl|#z+y1BWBX$3lNLDF5+uXoaplQU?s`h5@y;dKRIs9u#bTPla;Zu6n^>;c z9XAe%M7qsLbtv&21DI_07rwF~e{)lYdQc5E4CYqU5;AX+J!ES4^Jg$K_Os za_(N9O8Hm$_L(wGi~{MzAEx7SMg1#Y*Pr6(r-&XJRx(vPsL;$n4tDIfZ=t}Zj&x9` zX-Wk)QBoyU<{S}|MxQgYO-o&_aXp$5ko?$J)&Fr&C#z5yzDz-7|Ce@tM6$nf4G5n; zeR@{Q4g#f&WKU)&+c`eJK3VC4>*2qTKkTkwEXC=iTGE}wHXgEdgm&Nfn6!qF`{g)B zan-&I=U_YVky1`N98FHU7N;eh!n(F?KpV1PQLiLVPDiKg_N1}ZYXG@~|7Q*Ma{cm~ zDXSv!{Sgr{vn45sIhUC8rA@e;-Kx`@({lULAO+&YqklE;T1_<=vnI6kFPo2sMIa5&Rerd5+ zUb<`gmx=Lzlc{#K00ZdyivmF-Ka!P9nMfkvXzATM|484!j!b%)sxuvrgpp|?{=s1f z_(%)4zFAf%Gax7UG{3fcWNuES|LIcvU-)mKzO0Vc|KV{A?P6z6oq--lSQ?9_T%l;_ zy4~j)5|6{0Q43bep`^eG`2E{mk9>068^c>_a;`N4*;neien0j@4#yjnwbLA)x!ehW z4Bmd8r*C@04x`BMa6T$l-60`s)&)xs0SDd4E&OG4RC*3jGaUMVyAcQe=SIxl^}pSS zoAy9THZ?WHCy)epjglLw4mzcJVOE7;~K0vlBcsWW>m;c>M ze%5C*#{fbBHd`L{v~#5*zdzr!!Ddmp)7ls;)Ccf$@Q7-bL%T7R!kVz-9vl`Z_#X0N-eHVX; z5bZ6EpzC4iXVt5W1b3IU(PAggy3s;|N||sc2}}>ToK`f&4-ygqXY7=e;A40G5D*Xt7G5eN^B`Jvv1JwIuy+!V8F--cRLLFon#KCs&)1rP zHIA}&YJM31i=K_c5Yi|$u=8A8Lui-VnQzhs5cHakt2Pr4!J?&aE(ZpxVq+Ts#RnG06_?HaHaOXVGZJFcWydHM91^RO{u` zJXAkFvv0YeW#8E9=ib`?S!m0kzGbt&fC2OTaPAq|5=GrCslUTgYAXzZililS;4tU}r_^j~&dLVP!pSWl ztQNM0r`dOIcR;p|R|)f1w{t>Cms%%dYjBg9XZ8F-)U%3OYW5KaRFYmw4=ll@VSK$M z8(@z|feFNXcXb z42}OI*(@-T;YPV6_;h#!7#fykFE_G-?Nw7!KksNitmpE-Fu}V72kUt1=$ANwLTS9U z{bjHAl;VjUDI}XU!~eXG@~oFQ-;zA##6p$T;2Zeo5Ela%>&nN4~lWHY2_4+5{wa<~E%U0Wn9?V@&6bAoS z$xqQa7`AqvQh#DKqmX}pia0P}erFo#`w7NcpwSoj-ILPQQhZS7MHKb*d(PPORC)t7 zB6zIwxs>S*x3@9ZQ!CGJ@)ccAZ`?tw_XzVXZ?Cjmn`@}*?!DU$WQ2v#(SDjO*}rfY zTY8qg;Ksg>3Z2%lk4qmm?gRJ43e{po?3zM_A0!UNa?X=mhiG2MZQ}G++$@qCV|!Rg zAAx~t{O02;}h=n|DpiwFI6%Q>i zhno9g(!Jg4o-KbkGdxouoqhqOnyK?cKgm?8Vp^C?os75uF>>lDLvIahosSSjH zo^$+a8@Ot-RW6k%Q?r?lfxGoM3b@4n1+atj!qM2%OW=*$ApkByA1s!d>bR^Fta`(~ z6kwdI%zd5r@o26P%+d!ME-gXEDH9wpr7=@IS)y&{2}-N1;=@+|*?BBP}kXs{qWV$t5c)}^-xDoL}b)A%+tLX%KE?SFQ(4G#-{|LbL{Lv;H84SsN}b#1lD z$~2wN&w=%Z^Lh5Us(|JTFSW?BM2Ba*sPJ{%l|+NdMt~N6s^P|nb?^oFDUrW|)~&^kuGwZ1N){ukk^5da)~;t`iWQQ)p(Rbs;9S#$M1)|6t+=ptj%X zdS4oB5*IZW7q0zAf9KZmY&A4Cla8r?6QH-Pey?mZtd0y1_XltIH)i2=3IkXEE7hVlU>-CvDJ)ltq+KWKW6X z61a3}LT>)q*ZE%fgA$472&S9@Mht!oiKieC8(wkQ%#UZTHrb_pDIIR162&)s4o>Kv zY!d#R2w2}BR2{78b25X9&vh%h}<~I(JbJJJ5Lry21UM|=w1aom9G3<<9G{o=4$lg z;Tt=qGNh%RtqtZ_oM7a=A+dm+h1pZVcfzE|m{?bPbGKq4;&uNV7c_u|GL`r+-ak03FFhXN~0$7 z1M3?9{T^@e$3`-X25&Gl;BuSizTMXIHxUKHZHgwJOxo4bFq7lX7@k0-4w`Ojc=Z{h zCaVw4r_#X2N6v6oyW3-k8TW3PJ-bJHPPPZ`jp>Hnbl?7dHEEnKlEe>S7kP zFuB*{TtEUvBYPKJ#@dyn;lUJYvHd+=REE-42A@Y_qt-hcrXnp@3?Gw(Q0l0x3*96( zu6QgXctrua?l9v<9LPb@>ou8XdQsmq#kcZoL#^g*o3zUZt#o4eO6>+dX01&c2_#(QLW6kDJVsii*x0nXl4BMQ9_?1mXLu^6=y!U%g+ z>FmDp|C8C7?Qwl{kjtuOB-Tt5+hcd~SNI!`Qz?3KN(TnL%9(|d{#=BWxb>CgcfAXBVEGZVVP=_G>>FN#A9kZyL*y zG%m;jvY+Rcv0ZXjTn4N1H7mq@&qnH8d44SH(tlo^Ub-$1OgvaE-HSJsp~+rsb7IU_ zNR|&nQgcv@o%I>Boi_h9{q3rot5~-@{Lg0!k0!@s=w#-Q1s!_T4D=w^nr+zby+8X# zUiE+M@eq298F^V&)5=LzGrrDc)S#+`1kUNG*BGmQ<1gZ=v;&6Y}OSasoN-iVXEG09l<86&* zc8XORifEJ)wxA2zBLAXcW5ZM{cUK^hDeo2Dk0>k zZ#ENl?HB_5#$9D|$KMYSSVUPCB-|Xj>rU{ov1r_)f4zN*Zs>MUSwoC^aMLTimY{L0?L}bvR6Va_^wAun$8fk*kHlt~4?8AEm8@Vokxn%| zjPKObFdCa%w&m~dbIW?gk8{)-3v`TW}d@21$58_l9VwvdE>feN{e0 zpb6sB1I1j^1=oOG!H!*$mYk-A0HjN+&LjhyrESXjtq%zaE-xO`Eq~Wg{Y&1>A z-L(&wB~_R-n-KkdG_9*K2L{|6ibPKhr`PPf$-;X@x;eTRZ`(EC@#5GB#@cb%tW{PD zaZgX;KL6edLP};lSevi-v>=+6BxhC6`U`utGa^~kbjLWNPP4`+7;WWE;3%E9IYw|h zGJ!wKdZ9*KGW6Z0e-dLVt5S99J7+gl@9#}5FTQ736eIl4?OCe6F`4a5+=q?GRTb)98MjbcSDj$;~3U-NfW|f<4wmW&Vm5h7)Cff_udPH^L19VDR}jk zQm);$LYwxTQo z0z%oagMRjfoH4CW^`lq%O`k%Eo5Z4;7(NtHVh;TvWQ?L2A}c*UT^ujlXxCU&r6 zpg9x`8PU;B^Y-!(S(qN4n{mygo%HsXORIm+s#8Jci%uNq0B|&D78acaJ0BmPq_hg$ zE^K}pA3g|s zia_=B^|E+NG9)EvkDmLrQRx}0TemLXaC`jx>#&ip+vYhS7TzB~s(_FBH}$BwtAZXd zBtu38?q!quL_Kd26U~2$UEq)Ua))ep;?C`PlRI~yJ)zF%>-MkqtcT~CY~00aU%VPo zc;iEzoJEnXayGgDi+co-rrT!GcsY?)X)H>2VtP3kqBYw?yXVqQcaYbsr*oktcBB~w z*R2?x&&vyw%G()(^_Az2Rn?f=C*O`5&TE67P88B0J)&!fNo+2sWdR2U380;2naHnt}ffFP8qe$|sV)yASCf zW5EKepQlG(y#MxmTXgI9MEPRkk;M5$j4$4k{1F=%Gq|R~qY>peG@#xYugLsGtz=AO zL#@C0>cQv|IQr9Q!*mRathBgcfK{Sk{i|msketeQvKn%hi(Tt-IM3cOt-^Ie?1+fX z0RQ&Abh7dmVR&e$FGx6iSHKkw@OfcyGF4YJY^RR<`z1SmbQY8K`I%pW-TDH<<-U3Q zF6<{e^9eB=GBA~hyfdTkg_qo1s>iRc{$4#p^q*%r z#p@GNz6dx*NV8`M^wfZe7i4Fx0ogT8GBV6kfqI&M&8q$wI3Z909_2U|%>>a1_^Ean z{A-u7UYctt@%e5|@Ypi|j~xRl(6@oymuv#?Us$Y^0JLlX_Taioe&Y-4FE@2}IH*A; zUpYYruj~!j!FB@%Pzp&kKoP^GXURyLz3!cB;6LKBVzR4M>V7&)US98uFI037 z`w@&>i;LBouc02sD75c@i-cIU+=_dlS}#)A2(>wJKu!;+BWf z9|!U;D?lX~Pc)s-jedEeH1@S4i7!tSU2c9z2|Q6k@#twZs6YtP4pQ6WW&WMzR^Iz2 zpkY$1F_!cHg@mfuy)w`#3?&^E--{2EAo)wc?FQPMWxq85A2p&iH!qKrf+CQ=uQXouyIPR1F9es@9b2Pm- z>I7TR<&lEA4&;;&Ktg+P{&MLBzka*8#@SBWnr-nA(J3>myzFN7mtCOVXqmF3>;2N| zL43hjb^ogyHf{2#R`T;q-;Q00X40F3nONp3$k$8_euQD(D{dlRqFi1L@~-zr@=?LS zLq3xDequyNN5`%7^{2&K4iUPDm?5IgUTpQ?{66TLr&97UmR_Byqv9nY8R!1>ZKd&W zYV`=s!#@XG@kUwn*l78hS8SBJ@C6cW>Ej#}Jr1kORFHNn-rjMIu}KJ7#<1X_1&81# zoFA~cO<|V;&1VpJLmK-~4@+fW62O2I9q;>by~;hn*B(6gGQxUW8Z1S!u!t{A(P00i zRr}Zm5_C0ZLvueEXdi)#z7rH2&F?3{Z}3@H$&oDwT790qJLqC=Vu&Q6&fD3t1bvW! zQpf0gFoCxFDTa7<5I!iKt7;78&?C4o)A1L6pyG70;EMPVuFZ32@qe& z@(rMnqEK#ihB~Y(ejLI=R8CzUa=d~*+B{MeaCd{+*|I*< zR1mBS#a8p_;1C54nu--V+#tr5&Esin7@tZ^jO=EJx&2FhAhfncNO16v@Mr*V1rTuC zSM`B~uVEt5xCEw}p*GcOM|d(2p%|@w(4qEbO5YD%@w_K*S&H#j)V&xuj@S%tuv+*f zmUF{rG?>72oz@`Eyc7Ls_!GkmVTAvVP%$u(Urv}NaaV>W{?ek4^7m;@9e zK3_)d`q_;aAI?{RA4{zQ8qsiU#=*Z-Bg1wTir*>$4w4|)`elgdrHMw(-Inr$*fjW< zEz5C0D&%I0Lh7E02`UQ}?BJIG@Gpb^phNkeZy_V&r632_Kn;GMv8lmGU^JTx*INHP z$2QtIn}B*f>K0S z3S)7xnR>84?9Wu197a?{IfHaxiqYNT6&hB4&zmYaJK7}t4+b>#!rMVP6&GotI@>an-CPY!F8(s3~{VE{9yp68olhp7cJll_#9 z?v$BKN0>*%HqEKj00Ei(pUvv2gCd)w&i(-Ijy`Jc3)(uYF7jvpjAwa&Sz3VrPqU$b z0qVCmX%C&FoZL5QUjr&*1aEFBpaqp#ubfyPCa)i_ZyE(Xl3qX9GF7nL+Uecj)jZlp z4fHYF2@0N^vQ*eIZGB>UaC2kV@wnww`Mrc0Zc++K`;ad_I3h9R;2i3C58>eoPJ8ua*$7%YmIf=M8|#+3Nu0_3~xw02D_@xx4yhf`6#m9;y{u@3(>KG z)FyD_bK{b;IdgNJpB2OW&GY0~Uhj%M?ekh&pVJNXy095J zoVCl*?u@F{0npEgk(k%xLT>6)&uxEZ}vG(BX{Wo9yS2oB0 zx$iTgzzZvp36oI&jHV?`K#QC_MW9QN!fB&htXV^KbEC05Gt9(b*ZA zW$>8zw8v?0A5>{$EV&hr=P5_qxsu?I@b1y;qphK=G6aTxt}jMVx@^@zV8-He&d)#$ zm$O`1Ovk$#eowE)Q7#thqfL}2*+_qno9f4(CQtgTl+c2U_|JXQ*(W`ES6@VtF+*@{ zM$@)osOVoQe@}Nne{;>CAQ>70Q_p@)eJ?LJ|gs83*9Eaj&88-}BOu7b``gur7*0u9V&Pv!%j zHQ_yB#!oorlb&|%Q;S8U>s6SX^fwQW(d|Rmi+8XUAA*H{`J&9Oh>hy51R>7di-eE~ zQhB`|Ap7_DL6GVT!Azl6*)z68QDyVlt-%26U_oD;q%?MmSCEj4u-4#E$IreTYLew) z-}cvhvqpmwD99Cl(I4DQv-RDoz9)nb5$He@MxBibb&{!rx#Z;yaSV8=f+J?=isl3# z(G}-$6bBJV-Evu}sD3S0q)|Hrac=Y)ct1UGgY=zg9lx(Qiip>7(rfzHX6mg*{%&67qbY??c{LQ>9XVC21`^)RW;|2yr4IOil6G zTQHjYHMerIFCDi>hu^dRYCDbzsY$6;Y!@>jwTi6JTT*JiNRwx}URA+}^Ulh~ZG_W@ z89P)P5lC`s)-T`D*E;&(X4Z7d-r-lW__Vg%&Au_iQOwj-|RREu7}=ICtWrC&W*?>(+QV-c=PUlENES=aF=wi1C4 zMVq}n_MCOk6I2--N1OM4KzeX5p?@H(?uivzJ$^-;r6Ma9O6Gxyo~wZxbVq}@;jODA z+5b4wQMrNyQQc&}HtJ~jN8(|rBQPio1iC@lpC1XdLnLRF2hnRi8srVhm`7q3T!S-(N?TLRnq?gkP59#)D=rhT(U!$Oe0BJF+{)wSI z=(c~8fD0>wS^B5QDc#!A4rfdzYPRQ;GF!_G4wxaLS~KP4-HMA$T`QTv41w>#!~I_o zUxzPVJ>Dpb^_@7y{rRN;^j#a;@0h5%t-NK7nn zm@e^Wzf!wfR~;ZxoQz8lOWk?hU6^q>AAD<+rew}`3|bKhxcGlad&{t@yRO|^O1fK+ zj)io02ny1nbhk=LcgmtuS{g)22zxH|x}SUR=Xv+OkK_HIAJhZa z`p2Aeoa1+%BWQ0@wY^2OWbvfK@D-yI_B&-GLqYGSUaMWsR7 zESCE{h|Ka1-VlZ?W@kw8suz({V>+xD%NWdhFEQ-}W^>~+69zbW^L)0V)K1%BCk$^1 z(OK-u<5n67mmaEf0mP?yf$Nl@3x}-q6VzLVk}t z8=2m5c6w;)Ox@aoK5Ud7a5SYSll%;7dgWT~>Ymkhx9AR3C|ig`u1%6~xnaw()XOq& z5pBNeIt;Z`AVtRzr*hh$reV6kP%TRAb2l=5f2PH_I5RaX?u!J{K-gk?G>LM z|9ZjDHy}!v)9LoGNl3%?aXA#=0}Z)gSWJYz2k^GxXNh|=&9u+VQ=SZulFS1wH5f>} z#r8{f!^}jw)9L1sJ(?t%Zy9A5J$L-^HnS4~;-zS)N^J8+km?oQ9v(U@-pst3BpQt$ zv4L42}*o7*tX7lEZLp;MbIkB-1fviyDL_>m*6_Sa-m>Sgzg$v8p? z(~vR|-;vEE6(m4uaa#Y_`<0ojJ+A%mBggz0I`7+4T^+Z^7^oa|p*?D}lalMSV(Cz? z-qrGLrCuQ}^R(%*V(B`0Y?4S-F*Ebx=L+?j*Tka25An5^5^QW^ybp*UHf%ujI<0M0 zuZ_jd$!%x{B)fn45R^ba4%hoOz}7Ru!s|LZ+rtr=oHaF=UMiHT_1P}j4#nz!XkT*t zhXts>ZJ)XD9$8wk95^RV5s{g&(9Ct-8&@%xqrgKPL+k7)r5LAKzpsVZxrEB{>qw@x z$)CUk1K;Cdol-2k83jc{3)TPW187N;r=A$4_ZjQ;;qysvJRhYIv0H+otjH_xl)r^K zy!h{-&j|@gB2>E<*xKlSD`7j=_v>89>7~c#?-uR1IDV2I2#k*QluR+N?CWE0Lmhu! z(j%V)wEaSjO{D;qkcro#tFKew+Ezi}_o*rtz<%R#x-)+dooc2;5Rv%jWRXLOz<-@N zTMjhom`MI2T2UTJKa_M%nYRu@apY=1e)^EPhuU; z5Jm!}Jxa@ zNd3TQg-#O0Zzof`Pd~dGcaiY?rGnT_wi}GBQK0Hg}coIw(Vk_rrEHbJNsG&pqvdBhV;=v`HXC0T!x33Lu zh;wXXLgL0!ZsPl*AEwcYp%Zyx>eljv;>orLn1&T9JB*%sduW`^Je!W80&1O+Rw_g z%I*=d_0&pkoIfzA=bBLzyAY6tOms%1LUt1G#r*WWI`}c=}ZTqAWp8M zzsKW+5YR8)&@v1S5|9)aZToYv@R^9@@+$EkLv^4$G&F5dMiyXJmT_yAFK6k! z@T7Y{PP#kkg~qBhQKa6Hw}!W1kM_ORc52LE>P>}Jc(&lnZ((!w8{LiW`@rrq7$A5Q zNz8gT+xINZc3o&$a9;2B^tK>ltjUQ+hh=_ueAnBF5k@IOmbM6*&;v zV4)W0co!mux0XxWvF@k>E{DMrY)_g#84!(=0oPfE39IxKq*iGu!1Ifhe&i=v zdIVSft6u#dRs8t3(a1EA_nw)#shmN`*ERtHkK^M#$&+Q_J= zh8{@g)f0r~`yJagIpUTErGeSTZ4qf3!`Y#P%qo@5muGWLNHIUzQ+}QVl^=56<>XiO z+yG0?#bl!UJ=C^;sm;Hy7tQhC7cN8=E^G23Fdi9tAdqunu1HZ~U2?4E1|xa$uFhXP z%t-ewA2Is))jLf*c+(R+WtXXm&lA}7L0zt4zli`EOyZ9MeR9O!QU2?^NGS(@Sn5R4 zA@{rI8Cf%l)r^|`(l6Cv4Btca;0_54U_C)?aNY=+uC+<;irhT^+u(?!dyFwbm)?5F z!C+M|6j}!5vHWP?;B~U84!74cFhIU^K1gVfNETAp8P|B3tJ4(b%whNm8T8;QMH1-! z%nKA5Dyo|6zv00ikV?3BIy4yMlDahCGI+lCPjt^B*KW>^I8xciKT^7d?2GZ1dr1j`pwyY44n||JUQ< z!hssr>Wm|)r~G^Ej}2fxc6U-|LMZqmi8K#Pr?0Po8vg3yz!YNKB9{0-v+w0guzNN6 z{krGl>x(d>wSw)zh=dYeRaIrelQ!wn^0A<~_BrPF9Cm|_3exfpn5?MVPC!@~T9I+9 zgvD^yoTZ;RE29`Mj#zbS5p1oMpmjGh(`aOu_R;Vh5Q#HI)e6LSfk*xHxmlQF?ETy)-+JlMwfH7iS`3#C~{^I*5M(;_u-|njb zFljEFW4DY5ycPvdM#bFWyS|Fc3x@*mx;%KS;6-)lKC~oP^1JLmxO=0*(FcUj3+n*n z#C@cIB)Y>h5!l4g8^*{l@#7`~P^d-J8L2A5Q?BET|1Jt%vQnTw?v4Z3BP^{^5|;$+fh^9VuC|gO zWKHEz>M&h{9!Ckrx_?-H5I>~r>gW1r?WcOD_eQj}(M@y&^OM`8ceQ1os6$MPn{{E+ zR~&B#n3Ctl;OO_gokaI(Q`O|Z+DB9*{K#F7SWtN2E>AA6x;Bd^13<4nB|7~xP)^o_ z;)$zbz#H0#mLE;Q9g*=y8$EspZ)mfqF;V>ez*&D}c8gk>>?l>pV>MV zIk7w}gwPw5<>&{`Kg{5P&r|nMk)j`b8@V63|NdG2;mVl)UXwx^ykE=w;F>U|iU^@L zr~IHnTMZ%y>c7I>|GWAh5kLS)gFos&{NCNMFd{(kdRW*wf(YI{b~WboME69be<+=V zqZp?@f&|!$Ur~a_5SwO>3#GAxzC8H8B#yq>DMw(A$RWu-_`Zx|KP8yga$8nb*yq9b zRebj&ixe+qV{go%VY3P&ot{kUi=m&*94gNl}7wpJ*S# zzi!H(gX$s+8U)V6{9qY%yA|GS9)N>dYjFCuJHqM{{24trRTO0f2$!0$7T;H2@DzN) z)t^rLvzoRY|86?vN`d?C-1(c~uA4&dOJ*xNl<#R`rUhV97LoEw26+60s*V^`S@y+P z-hL6rT+4JcTa(YynD^A+`@#12yU0V^daJe5J_LC>3y-&_Uo^gpNafxc@lNAjUS&7Z zkO1HN)K{fX#<#m$zbRkrB>BnqRYqdy&lp@!xj$bfNA>r!$V>yC#Y0yuDe_bisTIOF zPgOWVD9&B{Q<88k^TvENoC^HUX3tLjnfgS3b@vd8ziT?~EE-Gu`&`aOOC1#N4m{e< z;mjaV1D5Z-C*(H%UYxvIO=5HUeR8U?mE1#ep3kF%JU^u*hGtQjnrFlwjgUFgasFKh zPN2UO5=`5y>M zrnUQP0snCI@0#-e>$LL?UK}!l-QB0z6{R`F(`NP5)4os6_e=*V_qHSf4dUDrDJgUrNj|mqUi`DFdn-9|NZii4U z2XDnE=Eq-!taF=qRZ7KrpZ1BWM!a_%lJ>OD(D8gz2o6?6$|9J576K^^+CP;tfq%*~ zeBO}z;Qq^IG<7NV$vK4Av<%C87VTenM7jexkl=-HcEXX`!XfSc-zVrK{C6u58NLp* z{AY{7qNWno&W!sVjdxEFG$kvLnG$+msO9AwwsdD)#R*Ix#RXwE5$oFYcz-+3wf8K%$iiIVtDM{b4jr2jXn| zwN1>d6)`_(6u2}>#>cA%xH;wwV*U8qF!!Dn`;nYn2ashZlR=mMH5NHfz1aTFB?TcN zQtGXvqvHT-=jeEYLw_jfLA8TAXVUySZ5W*A#ofi1FT;7Yr-U)q`cYb1n9cx~KiAYf z7wQ}P8aa^)|A;{t8StR!0~U{HK`R?0FzKT?(C>KZ z-r!|JTfF_{jw>x_9|%5<^DVm(4YkjevilQYIiQ~zy_ZQFFgp$U(FmT}t3_Ym$>%qO zs;jF<*>nU-d{~=4`H~XeAk#_aDW*#O5|lS=U=wkC9|wSrJ8_=!@Q08<=Ktd%+#f<< zC}2`aL(s3=vyh6q@k9Goah}wXv*@RoTpqM&oUFeS7*q~D_75iLiY%U|IHweFqP)J` zFg|dMm#*|V^kI#+e$**`Vfxcn$mb%p>jsYQ?%zGPY*%ZjvfRc=74p3MP9+n=%@z|% z#Dd6BxKQs%=yiS{QI$%v$^)bYp_B1Dq4``qR7tmrdu21*1Rw~^jj|cHc90Qf>C0|V ze}_$9jQaZen#deL4vv$*sd{S`wMS9@Gl!BFhlQ61%Uz0*zO5H|_po+uu`Pxy*dqwP z$PT4(WKK)R?q!0s0`2mU>iSGc_fa#?3EMQ&lb&3)76bAw>u+Yuz#eQeUaSc}sA3*J zDL&g8$1K(?VPZAI!o++{%&Jvco5ZRek}DHhOd<|gH$nmXSu|iys6EOBvw{!0NR0zp zTU&|6^kKGvAb)5E$_~PPD_<>1KgkrS9XF^E_xqNV_Sc%=;+eaq^ zl|48rGb3v-Tj!kfWFiO6ntQe+uq2%nsACKUuTs7)-Gy z3+;-fdmPagj7~WD*qk59R}Z8z&bIn5n5Aj746C>7fZ+Eiif252KYuXyWJ|Wb`S1!* zgJ{^;P{0W3W)_0kqX*;K#t-`v_gbYYdUORuk$Tz2-F@t3}0v9M?4A2 z`WBWT4nVS)BdP!4QQhulB5(k8e8{h>TPu~*Uog=co0&0M)G9>71%!^pi$j0g^6bCX zisE0R-T3)TZCT=1cc2lG>%%oPY#kjHGTUx*7Uw(1%I?n>RDK$GpWhG2?f6o83PTRL zP>LuerZ8-AK_Ft+nCv4h?U`yErm6Q4&Jf=o%_nr({WfHlb&%l{`Z@ixC@i$Ncnm_M zwl@jO(i~hx{bDzHzG8aY@>*b!j)Ou*TY92Ymu(#sI(Omu(2NjbhhSnx_Zt!`{JQ*Z zm9{$HHTlm=3)lf)9-eBhDQYN7IIW^7z2%diFeuZjT}*dqiEkQ&w>QZ6UnY9`0*PS> zXbswoIbvQX5Ty(u^$B=5c9k#!LUNu7Lt?xROwbk`0@xZf@IWTrHf(=Ih4XU5!Ase! zv?d=A3zj-EEKqaKKQg?2i^T#?-RcNW__}uCCz|_aJUMs3SqFt?l&Fp#6gqBUu69zm z*Y`Pt5?6+712+fs#I6Ep>6i9j%T1mEcUzFH?nkM0wzQlVD`jo`H6aBnDktN|R-aY$r z_;FJWzPYUahdT`LFjYE!)jCj2#+t5sfe;uNQ~M-M+?w|K6H_8WgeC#ADkV0E{ts%! zy${_FiRDLXb~`2LN!h3GYQyY($ZbkaafP#mTFZlZQ8{L+mhTluXNe)?y2TcC;fL7d zdzCz;_sN5bh*K-rH#$g`=)i8Sr9bZ_)=@o{Z&4VrY+ z56<075eqJS`jaa{P$HALcy%rvuT$~kB#n(cP9NO$Gi=70fZCf4zw0r}4Ipr6@i(Z) z>-_RX?=oXx0r=)v&6q^@7yQwb-_{A5kAXM*`4n4NZHKVS1zFU+W202Ek6zrza;hr; zKOJfIc7M#_`eO{`9{otGMA>Nju`A_$ zOZiw~-J0k-YxI_(|I&E-Wcm>PRvgc_Ur$_Tsv)y15Uvuhl1n`O^=_VVkv^*B#{0SD7YZ$hY}qIS7K)hoNU00j8N=kz@~4iLr| z3>-ST1L~|f&zyAM3Xaq}nzs#cwlA?6p8=S(16T4o2f_x_B3__37`g#%-d#78a;dE^ ztLHw52_9T_US-6WN$7po(}K^;0{Wjrk3j*DzgHS?wB=e3)tGvN!Y_fIcFq7c+_{9j z7a7%nzGc?RT4h^zKo(*u%(S=r}*8VGG8t=vfWoKyrZ7(6xz9?aTY=t*a>w zT4g;cWd=x?B(HYkNC&R)`;yoP?c3_?7qH8r3zZ+~*Gl5>+{U9l=PS!F5)Tj2N18O{ z>Rq>S2%9-@vO2;PXwSY{4?#yp2H%VeLoaR!#3&S!*vcX3P!D;{G@?EIKMpj$R3(Xs zGq-bwsO_Dp>ZMr88?N*%kT~OWxt3B|_7jRpN;cJtiC%5l{{=Y=!j(wJajETv@=)Q{OeKxAQL?ddvdmjBK5W$_GSgJ?|o0s_J5H<0yvIjR+z-s*ZAWYUgRybLB^uCeEWm-XrgEF#rIhrWy*3Dk0KUlaOF0}g z!2#Jp;X#-aBCI)BN_JCOy(k=`B*AxTHQrN>AS3+5l~Fc1_sR!=XEx&7JHR1>zGLK& zc%)*?^6IA7e9~*hSmm*wbA!Q-8)hpXR)U=S%Y$4~X4|(?=)77yWeJN0_X3mlTWj z!eMz@5ZssTi}4V9`|~?$KMTRuu3$#hHZ%QgSDR$%y;*9#skNDFw8!B(flebM`?_5{ zA*b8z<2K)yHnLNA<5Mn3nh8wJpM7(Fo-`@j1cJv$nso7wksNhT`Z0a+h&wOeb+agvQGjkaCPqrJNGU4d>MoWP2xJQ1q1UW zgM;8PouZtc%m)<{VoWLtA2c1!H`Gs_3)oG6GebR$J_JV`1TCk;m&~1FE^hhbym~O0!^%A=c` z(+&bAN`l1aF^!?q0e70lBuAf*mi-n$*=#g6u8bPL#9@pc#6-`xJQ&;yo zzkQ5J8Z=$|QpYjL?CPa021?>kmZssCMmGVs+0T*9bq>xbOYc6Vpf&K@vPX;QY<>Gs zM(GLKE;SCrhUKKV{D=zNu>ux7cozWEVuukq2ep^;mM``PBPukNUW5LUC`wc1Rn#-6 z{NZB<{_C8lF^q?1@S5C)AxCMsEqpNkKdFI!t+uVMbT1WlMmWNn?y1p8MnSaa3sgcw zjYB7PKgny6Ju`a(36s${@^6J!DfleYHYxu)&eK)<^bGx&sFY!<*iJiA;QO_V?fI{r zAG{tv*~TI&SADx1BK@OKo)T=IS%A*3PkhgDK{2IV>Pp3+ zF=52DpH_9xK*6NyEqxQWLxtXY-&*A2N_$_UJdOHHzP5k8Pg;o(gc2gfW<)t7lATQS za9R`#X0k8&s@}rypj|ghtXpyyyD5I|qcW-1=|{P`n338@7p35O%$bUrnT5GwC^82@ z6=>7Fu6gm5r`qE+6*L%P6de;|wXo9WDRcn)39J-T(Oyl5(W^TkWNC^QTzcDt7I1ol z;k0t-eq=~w)gD^j)PWLoWnSaG$$7$YzB`jLx7tl{3^^ExqeW_DkChy5k4P{R>so$d zMEM|t85WJGYU{~Cr29!!MZT&Pt`S3lWhQ}6?@QIg{g`bmxqnyy%P-+cf*uN&n?Mr3 zC1=4srKWc{h&vhqlK3sJ2Gtg`?0nw>I_IdH?E;3M(e=&pJ1!AJky^ zRo}TBl*TYNev*Mqgtb0jGuj;6*?Nhbvaf~g`ob$-tKHImhFA?wz9zhB$?V41m?Z3` z!!lZ&AvWJ{;EO{q1_XMY^z948#rEr`24$5;(aO02V^h^HFA1U7I?ta&;A#VKuAzg} zmX9yx*lk1Y6wz4r2woei{XE_7Motr=Bvy+kQ9RP&#_^fta$Zx)g^cR9U}Iu`TACzO(!Da%aDU3AhsqM1|)X?5%cB8VQgn0M&4C>p;!nPkqc?xVN=5U zI0z%p!@mMGQy81pZt)JVLg56+DrU%nzj=XX`0-(d?-dOjo%E=Yva>}fbiA1LZHdL3 zxK1K%<7XeKdh@|#rjDhK?i}ZCfsvApt1X}Q)8YL5T-{?FCA8jzj0;Ni(JzCdl{0ff zN2EQNW%_)9sj1(&yzMKYMH&Wy1mExSzvw^fB>DCk)9+(ZPJ@ICq0+4*$BcG)aehVs zkL?Ocs)(Hcy<*BQ9^A9rQ^C?}S5U6MO52UBThOn4j>uo^&!H{lCS{tq@3B&bDwkd^wdYAX#wB~VdOWq@C6QsWTY`37ra$nmx<;1Rc0awlxINhq<7 zrKvealV4rx0f|y|L^UB(>dYPa_!@Pt(_v@pX@#lcu`sI^8?Nj2w;<5%207s+w#!RJ%G{`% zo4TimUm5nHYH?xha9?3{Jw`V`Qqnf#s39T)nWBQ*i9sFe2#n=PpSalUzZy0;S+>C@ zJxnKcTa*lv2uofrqdadZ5d8TJj5P!C>$IzV1v^fy^)fM)W7bMaSW4Lva|3g|nwNai zEj^b-z)m+43U_Y={iX;FdS`eT6Sd1mE_y8H@4&T7grLL z%5_`Ly~QV>4}~hw59@OWJUF=hip!YT$n^+i4I-V1&_00`;au%42EFQm5wmhbiK! zJH+QylBN%A7e3dNAW}|LM=G6tgn(?;~peg&Ulz=KAqK8MN}{q%>-qg z^s{G)m+K8=NDLZ)Fta@lsc%G11ijxt5L!}=ks#D5EeD3Pa`<`Zi-SL1XK6pi3^zNZ zQrHmw>8*&n4JV!zR0RAT9*T= z-}A44wx+8Ya-%^I3qN*^#I2EB$FbUqIBD(rzuEB) zAoY=pA~VebudaDD`9Ato+u3M1DDgfKh>K{v6D2utksH#_s?bnfk7ERn#oz z18}A&GYmYC-7}!m-}7F42l)@}XEC1uZ>aru?fl;xJvGtmm&~!bKW|r2p2NguuPp5# z$=nHFQD13Ey-+3V5ry#MI_wEJ^wv%$(-Atd!_Mu;GHi}*x4*dWOT1nJGFGY-p2NGy z?(9|vDBlZ>nN9^2DHcZCQtdi{Z$*c~k7gTjo!4({VZGrfa<6+=%`N+>R7@#gZQp)W zPl<@hUBTFMqyl|*lEvorHik8Ux~jwH|6Vsv$YzgDr`bzfzuI%?e+10Q0d03KDurY@ef$?VuF{%5$)(!7Wfgg#1 zEc7@2@d63NEM$OOc2V)in%>5n%}Q5faj5&iDgDm&uRw};DdqV@I0tS!sf`Y*J9ZCi zQA5@RgVxBzor*Nof_;YnrVQD}@Y?JizL2J+*DAu&Z$*^o>2+OPM2#R8b=gA)Ni2#- zvF$jl?UuAl*snJFg!msx{C3W5@iW^^-Q~s7EQ~pcFVX2`x4tKRRx2_=sFbrf+J3ig zs=puduxx7ggqkTf@GXC_9tyJWkLi5Q3~}$z3R2<2e*;$1zgrF@;`3NN!PTxX;`L|J zY*2sRlN|7-mM%-|KFn?gg?y~gysUj=DC;h<1iOvV%>$;p)39x;@;ALJbP{3W8F3?C z2M72~VSWggM;lO!n;Q~=Pp6yK5?{x|L0(GEjOW3mWXR# z6Y9b;*us+W#Q^zul>>SUi`zD4c~;cacqY3YE!}_*u)8hif8z?8X&Nro0!7+U6R9rZx|zVQBWExz`Y^!XWG#K8ko1w z+qe!QV-Z-_FS~_LB%lG-O@#@KOM0Lk03wvrF4=_<)(RB0b9@Vpq7>r^?D{NA^93@+ zOJI_Z&&m|T(V%vPm-pj_K{i>oX9q|%sXUv2A6=KH0f5$4@3>+s(ice{-`YtsSx%%T z;eSI3R@E+{ZV+pTq}5gm0y}^pKoGY-1Li&eQgD7p|JTpc!6X4Y;izq3kG3ioU?B|* zL_(DY%Ec~fZvZbGlIW%fjp@&DQUZbI_zl?7MHoZ=y%GCwq`>sL)ZFgO(#7!xj<7lh z7oOWU=a!WKc7(ORDzxoS*x&3I*=1yKI_*(+EO@wN#?t;&=WvAN@`3FJTe(z&!|g+| zqq*l+Ox`g&T;A&zJqe8J2;n^U@+M{>|4;zREbB!YnPg@zL{ zza2gWj^KwtzbYI0p@2}3=rLx5>8Ky*bGVE`7-2R;PYJLuVVlP>lG;Ns28|4{yKl*U z;~CgQoXw32`<7m@aqgFLmz#!%6WcF9y>yR!|0wckq;a|I`&SLBmlWg<8~b>^wEhqx z8Vvf^lt!(A9ZLsG=5IjRELGxGCN7~2d9X9zOz*Ni;97-`YjgnF8KPUIJUouhW!1GN z_B-%-o55JXpLpM{?Ku zJJ$M=%t_PKdm>hrfU|U&4u?qSE-ET7e%=^}`NYwwf0es>0)X5~%pTALFdv4(<_1$t zcjAp_8{Ijpqlty9W)!!+jonXqb@Pv)n2qAu4h$a;LDuRL*egh88CBj&_=>;>L9#px zNiPfrkx4}GUcc~v((wN(fa(+)+{RkYm$nr@){Sak`?A0*(<88qWFDN1p#9qI?9=@R zHdO?MOVTJbV0v3A2AygQ?8R5gpXWbVek4>*uLd>n<`^`nve{S65cHy-lL9@{*=Y4e zNjt+(nuIe)aEQItIBA`&0e0FW_VQ6(;XvA3tnhm5ZEfkHjHxn!Lk7I9+v)-Iq{Ad8 z^E7zIP&7P@Ze*{wzjIq17PB|jb1qQL8euxHP**~|N??X*VH!S!3t7X`fg53_NVG-q z1&gG|o9E(JCjDpkUu{nqa;4poU^gb2hS?82K=1)2aCN`-Y>hQ1OBQ{2gvA3K{jz|A zSr5W2QW}N1}?^{|R z4C5id85oyOU_!u<@7lh9_;}wY5wG%DpvJ!Xw^)Aw%z;vi`A%YNBFg`UO`Ze*ISQtJ z;C6#Ex^XG9+6{BiW$mp%NAc4jhTPY+iB%<>ww?JzezHBI$fFBl`bqd4#(VQb`vYHx znl74@N22+^xYzK2a?|Gdq*bbbc}&Bupb^_+dt_A3oM-*D!scJos$X6aGC159EifUL zUxJUoMMgoQHIN_y?^=$RG^jj*JbA>;y#83@z_J~4=4?8F9tX%ag4AVz zKG^X-NumbLHWSkKmuK@%W!G9*mtcIV!9k6@)mOX0vD9(kHS%o$f0I^8J%2exSc;a&^9hihH{xyXa0b z^&~%e8XiD^K3bMO!8KaskrVLIxz1s+9olbCtQJGYj{tHFt?ezTNJ(+o^;|93E5PwP z=2_0_FoeOni&$!REsRUn=|+CHdL!1i^d}?i_Qr0;ODevUDnw1E2p(zhu__|pqh4An ze4I`_C)|QpawnWweev?-$J4V|gqxe2orzB#lLTscMFiQ0D`50>AV`VPW%K{7>D{(0 zzb29|3Dx=3hYHXybci7owy_W5E8zQIX57)}lhGpsV-{R-L71!v`C4v#-daNod_B|u zy`JR;IL*B+h!Z^z)p{5n?Th+waJudFRV)Lm8Xaz~TiHDXO90)Pob=F=&~eZA8s5$z z<$qDKLR0{xHHV$vahEOsRF`ukz>i_YFC)&0jbhw7-^b-Yb=GPzY`B*$&#yfjL$Pai zwFO=fy@r5|?#L#e9Pr2Vmkxt&#R4AGtvIrPhx%ZRHs1$vPf8-WHZ{a zz$LdpiLZt+6E*x>M!y-r$m;2VIM+Us)AOL0SYcLz?uxp}lU>o{ho1XlyU(O2o3mnk$`)M*ihP!; zzVNWQqP0dZa-21tZzI^HNlL4JA+*7%{U?7v11p)^?kMR{R`VUr;%C9+Pnq?Was}iJ z`Hg3@C|KE(A?odB-n6;lxU=K!qG0)y1+^fP{b=$V*xclDD06x|Wmo!@PYL}j61pjo zFR*VfMSF2q&4Emp&B?0#u1nzXKm-SG0e>cFe93a|ngsK(k>xt(A4q(8za}d0#uni5 zH)hL&RO%95&L^kNZhbPpI@{C5bHz^9H@7!-5<{oIw9j0MJ~H-rm{u_XiHSJKJK5Y1 zmHOpnT*Wd}s!5+yC% zyos#umf+MXMZ37V6t;ZYgH$YR6G4PfJe2w@0nCWN0SB%+E^9@x@B~oVPA{)}tayyp z1Ej*r7|bHY$`o<^c%VExuU}tS?K1_k8y4X?!!sTI{p37Nt(~#f#x>958(3rNp@PPN z2^;5~v#XO;=DA8~JR}?V?s1k134~PG#IR9GL@rr;GZ-(6G$TMGi38!I~1Yz9))nC>~iL742B2ClVt`tkyrIT#3bw8(rz3K4o ztK(#YBsm6V!H}|#MbhEcWIP$wfgNB4j5+8MfB#DewY?q2MVtQ3?wYaRANn{lnTJA} zmf8O`l_WJ!5iXyD)ztj@W)sM#9D4S!^Hu+!Q zYd+mvs1Ur;)6t{>N6JdmIgH4@{IFkjze3s$S8ll)|56{5({Z(?T+S1SXQwsP0PlFI z$!69f!axMtBF|m5uJ7oxETsX42on@XsL}*v;Xe{?GeQ6*ue*xB9GNZYP0~97@@Msw zz4QmVwxS^%s}AY(AB5~@h2YrGR8zI}@JF}r*Kv*bdrBw@3~qAK_bh3%9_c@Uy;n+m zv(&ku7aJQJ+SVpjEu^b-K_~nRfHze_xe#Z-wpF_C8y%Aev-ccsAj}X#LtAf~p?1kH z$BVnpB*8$H22BF{fZ)9#6il%gpRQ_@is>P)m-kPgPZ1TC_bG22PkNvL$c#7T-^qng zV^fI4I%OP<;O$w0T-$@A+YB!oxt~e(g+&6Lvs-54F=!Fa@(`o{=&GRvBn`0 zvYsf$SIcAnfCB-Etv(#9j1>mhp`@Hf3QXEkQg?Qyf1v_zeBdFYv$d)vVh^wkRVudh zc=OxMt0Z%-qPz_QQ(Gv=Lf4{zGOw|#>nMR?pqed=>Ur#k3?_+lWmBAsgDiZL6hdx? zkc@rF!XYWJ)8*)>$6Pse!3AC$YIe#=X)gc-C_#F0S8L)H6hK(&)g~A&0W=Smwu>jx z-LcgAuk=p0zgtt1Yeifi$ZQvXxTbnec-aKFfwVe6^K&*9MV+1ROm!efT|>Y)=S8Tg zQROCB^TjA&6dQ7bZ$UsFFQDqda7N6TI)~5#MPZ}VHOFQz;MmJz2bt1td$YX~-Dhi$ zBZvY)OgD;YzPk3`}YcS~PiqvS;_Yfm0%sQN9Ko7Rxs=@d%w%#j~W0Lc}3+<4L z=>VwRAk+79BgD(2W(RVDzxl%Aa$_%+FXGjzq&;OG?1!}0D{VYX%Br6`uZ_{CNb!IpaQa{Fk@iXXc4YY8WZt6HoTvR4O_LQ8Z z(R~47A}fsA3`o7m;m+{(#qY#nZ;-G+ACbbg)LA0bS*1_ZM3l^Sl_W01O;&@&T$anvWp~h7U6!jsKYY-FYXOH+lJn_%BDPe~4h6_diFZMq zXZs7dlRxEz)Sje?c{+tftuD9W5|M&&#`;d$V2(s5sy-5}Zj|xL;Muni!iR;G5$_OF z9&UC68ZpP+K?TjmVR6^FRE@=U!5NTXO!Gw9)bexij8Y%_65j^#Mp=(?;Agd2Qbtsu zefoG0hk&R-V!|^V^s5Le`e`}VYN2PJ7 zZw1{&R)Rg9WQuXRWBBOqu_eqX_c8!n1e{+C?z3j$Fu~c z)}u^KC@jTGohHoZz9eYBv5Om7Z4a0A-aR4D*3 z+fWS;KO2Ap^#5;(VgueRUMxJYDW-JPJeB8rK%{2>M~W%zBlY8%ui2G+E@VS&XY)jp zqO+kr;`MSZgy|aMU|&z-*O7a59x=~Dv5WR~@D$atK9UCt_>Q6e)5*-?US zdg5Y1rOV|@fWr#m{9BlD;wS7_fn*?}m-DdHqMKD&jdR8ca=PoMQnx>d*VtA_dNA}T z%R|C3>hR1HWS`s3*KeFBy!;x?y)SA)R>JebCMVVH*V}?p{x`4Sz;y@~g}HO)vw`5U zMMqlL9bEm!pm5qQ=`oaJzhEaz#p++sJjE)s@9`FLlF~9VrsKuu%Niei4+K0wO=UMf ztMwqKQ)_xzAsM_Pe096(P9ebV-VWv}+GRxuZdLuNo0Uq35P|iuWSp;5P1t!|Y3dX_ z+#w*{&2x6p^=1U{?g0Mm)p+|FZN!^=E%5&mJTcup4^CcHXk%KB-d#{yPhebT?ahfw z*A4BmD=CI!*j-wcoYt3JUPEp44c?>{zM1Z(VrDU-w+4kGM&n41vVK#VM)_b`_7i=x zhYjMpwTtWDWgk7N?28h5_o*GNK`0}1HuF_jBkaj#a1tE|!{Yc+&g(<2HQdR;wcOup zCIh*{uAYZ{H3^i?R$B?Lljrpy3UBU}XFDMO1mbofI=4~Go`L;;c0>X@FH z16%<2vV#Y_3E+jG{3zd$E@VH7kX7|4@o4D(pu;5crfe3B&?4&#d(y0?syh%V7^3sA zA0>DoVxu?j>QCs_%xg7L6L|iEWV5X~6p(Uib*?AtusdFNzEJ83m3~+%6&@sM8}9oz zNZ2I($0&WM4*EwNYT+-oz&Fj|QN*hVCnMg=RUqt~T~7?s3P6*= zEUl1it3m5s&)|IJ^z|J#Zxb_7@((g*HrXvmAv}RE791L78e!~=Rh5?ce!oOU8s$iP zEb_ND$4kDO^quIwy2)T<5pcSYf@l^a^Vy8XYgSy_^^34_o4cG~>Qr-JX_Xt;lwg}_R;)T(7dxV9mu|-(he2b$O8I9#$@ejxp^+z38t8`@@D4Q5n0i^Gw7{g4X+sh3C zb!vh*kXITE0xb3Fbw9bhcs^Ut4g81-XL3(GwhfDwhd>@m>K($+dj1j6P@`dEQ#y<- zdd4^a`e~IUk`w~Am6NC?FMtpfQoHuWZ4q`CrY{{>kUH6Q3K^<#_v;$kcFFr4IU#?Y zse)7*uMeaV`~wRu0=Rn$>wj`j-8rzji6MPRw-GdsNy@2@k}h~_g-^Cx{?q5{+?ErJ z*XHoZzOa0uZLNRlpktL=ty)$SGhJGp7K0&@Xz}#ARJ1$s{EeR+e5} zF*=|4Lh|!_`Jn9(4jopL4u_8*X$>%b^L$xb!o$Fa z`Wbw333s$KYr&oIta~|*0Ze#|+b~`qUC`XMA#L&dvU+`wKK+An*OH8O0=t@zy{b{^~V`^mfS@5*lS8$&9~PCO@Rbl@8mB%gYaQ?R!2o2UtLV^NX8ndB(S65g1UH4~9R&Lt0 zzPY{5d4&kWl?x(7o&LgGZ-%CCw-W7fbGMoGjASpczRBnE%^LS|uw!@nmI5jU#1WSg zk}(KurH^M^3$DoQvi^DCM(OsA{C_kLG+&JEZNbT~P|`s+TsRr_Imt~E*co$0nx4bF zL9DY2Zh6d(!u6c@x41^H%Vox^JB=+phV4Y=yP&J!*r7OuOD!&oLIcnNnfFoT&kiZi z&QiQ$nkHA6RmrK3&Ia{?o4M?P$`F2fz3i^;{iQ+MGRJS$WfP`R>x1dtoxwsE0+X=o zhvm4!l9UJt2s^jmu&gh5RyX2GI?6?R8kUAhoMK>ik2Zz0W6nFP7saw}JH)w-#eLyH zLY45HH%#g@JC@W1^>@ zRy3LjjGwEF0S^^OD+eLL@}#`-ivJm>{>K*SOV?KSLnVddKD{dlNG(y7Yo0CHB&`5& z(3)x(MTw{htp*1^kw}^{ceqcrTq^zy?o)M;T?AVE z2x!LMMYx$NQm1za>DV4B2f8^D6g0RCvHla?{I5|?${!8Qp$nX{Hn=mA>3`rTxAZ2qII+Nh+Kpjz+en z%lnZ)kSY(`DiN@pk)a`&7N!8mM5f%J0c%yfVTZ8JzDQesF>H?x9az8bG2)5jk|I1- zf7|y|3gO57M=W$`55j2j=)wZf(9kpro+NSP(I^)OJlSVYRC^!(JrUlrwuescxhi7!hK!%jz{H?_N}_Ds6OdR`M8J<$WUW9rQc8Y+_XYi z+T}uw3h4fwlKk%d`v~9A;NXMDma&mJ&Ju@ei2yTZi36={6= z(R_dmW)t3#%;6-8kz{4l=|RYpUJOw7j#uQIJ(P)>&tgw z?`FH6n~oA(*8x5t`0bE$_L0LZo!a_Z)qWfg7s^2??zZsSLm6w+q zEr9FB$;$y5AAw%aTQnfNHv6&sYi?MC^96!!@IOcKl@vuWZ*`sr1&_-4CFkP@6r(Nb z6CWYd_q+a35P9Tjce!l>MuqamhBx|5TBAhRqhMTy0iUc|f zWlH9-<7uSbCaO2p)Jg#~?#}|$1gvsu^h5jd1*38J>bU$o7 zw81&T1vT{iJ;#}U&N1Ne9OpG)wsI5GyPtWuSmZ*a+}v&7_z{h_QKw}(Vs2;bbPuMx z47Ni4)5-@-4IXX554E4}aU1Iq6UtVN)w=l%349o)1mr(9^sTi_xhj!TL8;&csrsG4^uFT zXaGK*{Me#@Gy_>geiZ$cJ%66cfmXwp|M7tTTBaYWV)WO0k)odL-8eApbMdHKR&Dg8 zdR$O+h{UI`7f$;3<@HYl9|lLc&EQ*t;Hsj-Tnl|DA1jm~+^d=v6Jo~n#H(H7C%?xx zn2`C|>~!m`w{w!8PK!i$@tuu-J*mg}#|b!zJs!1X9yn_D2&n(ZYqxo@_|A@@JO<8FgLTm) zkpCkV);I>h3}uuf0p~e;T;;E9dg<;?3xqRyR7C#ct@n8SwRH-{SvTIj z5C4xBd)zWWQ4>+C(8CR?&FE%Wgz*^}(Z|1j5eqf}oErz&W}VJ+C#6x~%Anlb!ygxe z{@+~;oOIvG@48svO|L_I+jcnG`O*T==I@wme5iD3hAE^ii&=?u#w2vV34mL4gKdvI zOZt`1iNCk?gEzQE=gjMb|F&=TKg$_61UG2OVMfUPT04SEIFiQLN#GgdksMf6GpE>; z<7j6q1dMP`$)~!mypkK^egPSEe7_~fYrNvF!gfXX_ot->e)aDv>QOe97Uh21nf|+F zI4s4qtZU3T6}`yze5H3sB2JO3RB)ROLAZ^iiN(|aSu5~r*Wd|c@_+@ojqMAe3*B~3 z@Y7+Lh9SPQ$*-qXe{4q|Ry*vE+ZUe`+M8sW&sx%eF}72Dc@u7jEG|S2ed||&#&lTm z3_L<|`kPX!Bwt%qo?*Mr!amu~pkO*Bqe0bQDS?e>Vg1MXGeJWYj_Fa_nXTSp6g?Uw zbH*mZv7^TJiNUXSUTg;{)SM?i>WYG|Dqk6+7jRz>_YH55RvHmJ*(R>(B0$k6Y!-Rt zhCD2?{m+vGzIry{6LxU9=KnZtIf*a+$|_v$ERiTb;GH7*lygOWWKfXTMq4+WJ_fVnz!Q>F&8wC#& zhoXn7ne#H8V6w5m?JALEclJlu?oLbGfQ{d1R=EkeU%iIC1Wv3`C9W%Z@Hkj-Pz1-FN80sK)$JDCCqL>xgIRANAg7Za4v`w)4Zl1qu zjUjlJ=w1sn6Kv-=`kUU3a^JeK{RuJJvsdTCSb(>>N93~1)~MSq{5V`|uQA|CotJRO$j_xC=>5Qs<;oe<`Au$e~p*tC^#wh>H$!bI<( z!Bx{RgDAtn@kWm5*`jH`Xj8sC_6p6$Vk%W?G(!QNLInyq*f-gY=`vu^&98JbwTXe3 z2^6yD{CDgJ7zvOZpoS^P@7o$qMF#_h_5DG^Gi`L%ov8G~N^RpxZKIRzS52}HdQ7Y@Dc9S45h(@( z83S{jonr3OC(Yr9B{KYWjOBoJ|wcC8P1k#nX=gq z_Ql}T09hFDppP+q2Tb>0jE6A8Wm>Pc(>sUFOU&zR&27L|pcxY&<>t%7r8t#*Y`;=T00tJZ) zU3-bZguG1rycK?%*zw;X$spU$2+(m0_YV=Kj^b_J-p-&~0ng$a@;&ygl z>~l9ajp#IMC2wUlC;`4J9H>|P03e$#FxK6@55R!v^Hf{b5BGPMpdQ~N!)Ds#uqD*_ z6A%n^Th@w)W72njs>eMr2lZmmph?=F)4ldlLMT0IgC~oZV?fl8!oUOQ zhppcoAKUTW{Hl>uQ0N0Fp2+EG)f11QBzjadwDmaeA<8XyCpm!?zEBXHxzaq@I81vC zAYjEaMM3z+o9Jin3U0xQIW(z4=U;!Ehd_m@&%Z2`nv@iDdFht(ak<@FOSIW+A{Wdr zdE%(=#cr?`|t(vuHwptY{Ia_#abTY zQGomI(1dGN4e)1_nC-3T+c}I9S!1Jre;r71&v>;gzxYqiBXDuAfGBp)k@-D5`{$Ij zCmBmgi->|gw~Z(^*2a-+tG|F&h8^I~GibH~WL*>5QshmKyo}B4@~LE6bryjDT@$({ zB_*Za>Q;4m0c?EJ&RermrTIfJ)U4uUK3yCuRYJPQcSe}XT;Q-y z29!~ol#R;BYRDtwrGr*mTouX`Jn6u!7cQHb{;P_*rG{JCTfajNq9<7k2$0dD&I68M z17MO3dvvz+Dc~j>cmr%=6*WcB*cW& z5>JiXusqEaQjeTGj|~1Wh$A2*WVyJz>We=)uYj%EjnKRruUnrAzfJ`b7ixwAKR@zT zT7-eyiSu9IPDP+{1@g{ck9kmAA?c@oGEXPLLk^r&$^ob1X`!nh-(Ur``sLif3n~L%3arl?jJeRh2 zSUeGo?{7LjNeU-toV;J#8{6txOguHZr*P7Yy(&gOZY=|mmdYB`U^6e#@sYO9a1BL3a zkQ&&o+}h^A-{{i|_6a+5Svk05`q>G=sx+?FHrd0n%R^{A_}@G6CtjF)OPukL6CwF9 zsC-b~zR>Vud79yZEt{Z{H4^Mfdm~OEy=}Pd82N7a(fw)sw=US6kU4=oO?=J!p63R* zWDp}o#hCtIlI1`Ow^+N0g@lw;jv{6_G|8r4hM)u=HIY2-T5`+Hj9{SHyq&hme?pT8 zmlTKI8ixxV9lgqE04-KdnZ=!Epw@gvVjwf&tm@Tc>~Ll{`k%k@tHfOk@cwD3&_62+ht z`)Q8r+apdT7NXy4xc`q9mdQ;-dalyufFpOY^)h~7XkUFX+C9~30AC|l^jYie>Co${ zsn%3HD(X^lV^>*8$uAb!39?D`*W)}%!?D}@T0d(nXBqJMJ*G`c93TSH=lS{3ItEi+t`MfUwqrTEaxp_j339)B{!RTJnfLxA?U{wE8mx*Y zkKda1U*B3v#YwbMrPKcL)Z=`-)iRsHXBOAH;d%w*vAnZR4jop8CGHw~X$3+4-fv|G z5Av=pIZyadkDG06CM+K!TaxX z+Jtst_7ffQ25-mzi~=TdfpWPCm*Ogb|sP;7M%Z>#TJ}2yGI6^e9d7YEV=j1E#?jO-Aln&>6iKWf*uK{v#ufx+8G^L z%_!QLn#{ms^eEa(U_E9p#EpD)Alc|pLBc`)*GU-sDR$_;2Pp#?__%|L;re-GOQWpB zoe6y4I^c+^8RA*o(jG*QUrfLm#bY!V>0>I46y z%%miroy?yb;ADVKl&Fx9P!P;Yiz_l$o zU){E>im}W}UJ~(yRnHzLRLPtG88+`@hJ66CO!H{!v10runEHu^J^X*GAlUwQ!SXLq za%IH7t*$DVDX9M1H1CP0TQ{|6H~MG4Zoqz#!4%-ODcWSK=FL)HO@DdZvb&pG`@3f= zya@~(r}oc$&lnCeD5URwJ`2ve!9O~ZAODV{o;{g4N_p|uQX~8v{_K^BF-(EOu+C&W zQbJUh^j2*$qh1uCO~H)}+1_eOOgh#Dk!8P`IeiP+v)c3PaVdOyV^JLTXd=Oi=75Ga ze(L20_g7qEtsAYIu~DR7TOILv3HP|bckQd%_|Jdvuiq`?FzC&pXi^Of#rc0VlvDGy z9Tsw`CW)-yJ4ZQtCL%ovv564<@f!DKLqpud4_C#+DSU~bgo;cM6a{YqT&1E2lRFKl zU=s2m5+ED>Q^wJUeTVLZ46MhNwRSfniZUKeXBM41$ zD<~gr#i+m5B~N=0SIW4-I`JTO@T2KS8V~`mMY&DSIGA|Kph-osg&-7c`7x zlapN9r&0I2UOCvy8`9TbiNKK37xj{_lj7^^>#-gW?QXPyunqwk*>T>dQa7@v8l%+y z_EM@!+-Wb)twRC%#QXca_*`Efr5}ydI5$YYO0i)~XU{iJ^4$TimY!GruA>a@hfI2Y zeu7%cFjDVrsiW5iUGLJ+p3Gpe{NwJlqAU!eb^}il6D+_Rm-XzAx4QvDdGBe`teUAg z&WwBX5la%syg7=#$)`l)`t_@DMM6Qw%@N$8kw5}u0Y##)#s;jri1_UC*^*qxkd=@W zWvd50raAIt0AU=Z0@Ir}+7GvKx-pjli*70RD8j=2AP0O~W^Y0v?y;9%dsv=sFDWA< zGGnEIib@y+f>7h_37vY(o=iTWe9oAc7A2bHLzoRL%m=~eVxA@7qCkfJ0EI5CLJ)v56+_XweDMh>yy}%`c$7#sUAZ#*;Vi%bk>7#3+&vxU1-*vRK9iL_e5j0M%9E3Q+g^i_wACJYfd{MC zD`uz7T`jp+CL@{Ad#u}O!@?g%qgC2Pwxlu2M!oNE#k>UfB*1vfSiVBZB>C}Gj6c;o zhJ`h64ZO>XC>?A*AUbh6pf!{vH_@Pgyg8Vv@;&Y1NKj~M`yj^d=B3B^uOQcE=Rqc2 zeKyx8g$h}Qr-V3T0=VPw^eYw?Z$so{Wjl{i^Qs*C2;-}O0%m71Y8M-)GNFJ2;_~W& zWwn}JroNSW1HMKLTydxPN~-7sPR+K#w-4kvOuOInXn9;Mib7*&*N{v)h1S1;kh6ze zzNF525tD$&=}RL|=%>Yc>n4u2E<4Hr$IwMm{ z8g07XKih&J-%;@?3Pk)`w8ms)>5aCFGuOP3Ia8l${h={+MUth_@XQ_wQgll8Kf7#7isxSnEd ziT5$3N2~4oCeqQpJ+i1&;l;K+`YAWHUL<;d&k-(eAzJVF_gpTw$m;c0iE|Tu zL~YR=Vyv?F5b`vbJnJlDTH`bc$eV#{cd7AH>(cngci1^%4Kn(=*?fWfy+m+Vc z$$}Rkhsq9HR4qBbyI38|-qBdF14Q6}a%uz7HiO?26Qrx?1GAfvw~7ER`fb0mBTBo8 zjuKY?ZqzRY4U}m@K{st)Vz??4q&1lWSfrR0NvtvaRAa zp($&~j1_bAE`i==54hxFK~fMsE9C*g&d_@^V&jm6ncP{a+vt!GrZ-X#27o6DgKEkU zRB28+Uog%Eq(-EWZO6^WRV&6lQMEXOk13Ez4kOx{XBZG}*Z&56;&HH0r7TNz+aOU5k8|EDYL>>nT?mKc5s=k=lnQV5)J9G8cMc7M6cZ9ps zRpr;AP_f<>tA5|+8jkczH~J#((SGl@C9K^6cCIyR*1Sx2N*4W@V%?FPHVxcbqxt6% zH#XJZuXfe0KI>tH;T=fh;ZUX5{i1@^0U;IOhR`36S(~eO4*pK9=hIZdB$8$d-DbZ* zvEZ^Bm5|Va*%$Yt#q67`s2GM?vrhV52p$aFOZGH&Ja!L^rz9jOgs4GDw(QPsNY_z| z&EA|#jW$%C7A3%Ra0KP=`rnnOACPtxj@H;serq14n5zdrJ9FAplpsptV4{Drk3EJLj5; zrX-(ue9m?k74QHwkh1?(W?183b!N0|B|C^tQ$`y5r=&$V4+?*TZw{~SlTtj*>bYND z5DI)7KW#ecc@gyDFmoj(I+IZNXig9^&bz+5R|J|H9?VVEoi7?_m=8OG? zICCM8SMAi6nkOn5kb#Odh+kT)-TnxVEP4(71SQ;G#N9_N&>$V7Rovn}0KJ5o;FyaJB6P>6fVE6msNQOKDJQav zyoOT#8uf*b1_czYRy~`z_gxd!VzuL}uGi@vmiTKd#!rC&(}U+*c%&w$g)JLAz3T$8 zMAG|~*B4!7JmeBV$ST|_5BH6o)>qi97*Ytkpz?q$hyhVf8hExLkq45_MxPC!n8!3? zhHEuhOe{cj9=aakb&i-2Untvmdlgg`p1^(z8G{RjfI=+XN5Q){Miu!S>q9wi2fmDW z%p?ZY&Wja|UR!ByJz$pYF)96_m1x8BR(NnZ1Ex4zOaYx@Rs!+U4& zn%JScxT<&Y20R3G0>2(Ie@G2)m0qrwPH?#%eo*hjVXd6Pb3TF1e{!}z%h)yID1-C* z87s?MLT-m{qjzI`5JXTqpsaa zWWKF(A%Ex;HuE?t_Cssy>s#k_$%FKc^#uRPDNwC|8wAx~pw0Zc_Um9G?Td^NCHi61 zwwU)vA-bkVj-cgmj#B+_Uml>-=rWWI!9?`MKqancY+cM!(ulTBR++GI#J4FB?EO*Q z#Jn!Hll3m4{8zK?u*9sv5G&yQb}z=KJ>27Y?Cy3Ynbt>sJ-KwUYIZ{I&}$9$+%qpu z7lg8=70dQAQwth}M;+JdsDW=<5-NEMin1&m=GSMr7sm!!A>s3?^F}?N>r%LP2^T3ng@WxNp6Kk ztt{o3`0l3Cyc0_6tn556ps;klJx!H)`tAqb+F(@5J z&q0}|LMU;kHW&&rO8Dls9SwGU1O3i?d`QDr@| z?PlWQqwsp$L|)Lw7M!zO($dYCPwVQ~@qNS|x>B7qIk{H#LU6TEz0E8J5KzX1E_F|m z^5|Ig6P|0i@UxgI1XUw@`xCb|DcY*ag}SV+%PLYioAuSE_>gUS-Y~@Y?Kd^}f-I~) zrzh|ftIj*aIw2)fCZSCuBgs)85;N~nY}srnMc0t8&qe!QTH|L7azzbS(=Rw-zAr1V zf(63XN%PM?tuzLq$Bgq?FR+0*d4aAnPyx-SciNvBnM-be@I4)%Tz^kl2ULaDN-Nu0 z+HDzr#0^vfMuK(k=12jPVQi)Hj}a!@^i)*+74C7pib=v~P6gsTaEXMJ@vJx;CHXO` z1|P4-k=&XQep<^#LfvdW%h0_QQI*We+I#=2OCowr4o;d!&ty;c?8XR8X1|^?0o-4a zSzzskN7Mce$xyZTREjMTkZ$MOg5_oULI5va|f|R zOcf5gUh1ULZ8^6Br242&OwV{dW14dV8g5BW%Wwp<9muDoGaR??K9r~+1vQk!cZiJO z4${u5vnmeOFli35P*;|{XQ!9$D?H$hd6%>UV)`Y@gvoc<|Y!KZ{?dJH>Ldu%N|LDqs#w z|6+H?NCPRsdoT<1#+S5gGg6n-T7Jdn?)SS`3>AyozGPh%RaX**C_GMivyaL*dqr6h ziTdimR&s%@V90PNE*Lh4uL2x|x8EM}GmxgDYGCDyYmiVwj6i}>{`>*Zh4+H$haBc> z7$ZRH8}P%nL`hs~kV}fe_DWOLrp0b8f_ySR?nja|?gXRSpqms9Wr4WwEs#2Czx)_f zAl^|sFfZS+yBRqcq{1ObZCH4vUUyR;%;T#B#5Dd3qoD=;j3(%}nNx(I762;2hd0Pk zgxwj=L$R&Cl!V=%Fv3lvX##(wF_I{3VD{@OHK7zc?Kq`-PONW{z-%q*ERX`WROw*c zoAQS{1;mF*#VEJ?u_+~v=Gp=L)8UU!tnMS9#d;^X!jo^qj@q+GZ0Ky&A1vV}lrnQp zKl-$dS9$Lv-sG{~wi}SX1R_j`A>Y0=DeX7mx)liXZ;n`A2M0oS7<1)r8hY?&20y4s z*$>omUj*viUP2i0FE0eUJlsE=i03`5HJMtf)34EEnan;$>X_{}chzP% z+w=f&03}Fw>mKw~l7SCRyrW!)23Fdgw8jvkMi9VUCtR$xil)f_@ckkHq<(c88+B`I@)@=7@zf2)5i5sqF>> zBt~xQn_5+o_mBkdFAd?C)ecT1@reDCa1VfdJ2i!7*cH+RnCuKw9$T3K1{% z(mNDt%pSAfRh<^`qanzI212Pq5haG2Z{&JZn_Z0seiA~jKtXL2PksFhsPM8yHYzRY z_(fAsDcDW)FvM74*mmBBG>!c7s~$b6H!=z*Zx!QDS7n4<-iK{^U&E;+YjN+r9;{3e zNTD2)!NHoK=&RacR*kn3E!O(C1}`<&FlNdbpS}?-_Mf{Id z5eZoFe3c{y9W=(-%8$x`Y|*#|H&X6}x5@&7F{kxJbIoOy;fQ1W}j3msMQz~MXA#X7$40(xd%yKk(>*Vr^ zpiZ8luztO@Cpc~NI)CwIzJ`|etvIx)hez{Cw6t`e635eP7$jrMZ0570B;3T=g*MNI zOLCB+eMi*U6`W&B2Hf%~GUnX0*Bd#T;zdmdckp?}3dV;VcEhalx=qgE0m;ig+adauc7C^G z1dp?OA=%$kwa<#x>Z&hY(e@a6v@uPDS!mMqUdF#D6oK;%*&aztu`>Ohw#wu%?W)#b zW)nwNvwQhWCGgqF*y_79qe0aVdo$&}hChC+VYVo1WWm7SqZf)a^-E%VAFmb7wcQZK z`a53kd`zSxzwWQmT%al7x9-IsPGetvkFW5FD{yq#LrbUT0lsab-CD+~-2-x(4>T5vmea+kG;co#*mm5h-C9YBl9Q(76U1!CGU^G$k0IC( zCHX7c%;ld7!LbtJ0yZKGt7 zD!Dm*mCn)>J*I_ITnRB4D(C4Sqn2;>l;8oZRkg9zqz0gr5w^DOGh!R>kj2smAd?S@ zM(ccH-ic0eHZRj(1WETQ6E#ttyUf1aT`q0u$suE?w^$ZKC~-i~Y;z_vh`LT){h8Du zaRlfGUcCi4h?xUkF*VT=sW+udzoa;`Tbym8jfdVDOiU(*v|-YUR%7Y9VJJm_!q_2h3uDrBF7*O zDQ;UvUS4=;CgZ8ijE#$mAfPSc8no?KaT#sUbmjinE6)pETNDR0bnmIiRpNtLKUFt;zA@w)JFfxjkR11YX-Y4TDY?bLzWHbLA+( z1ILLEsUcw=niImh6eS`pNxKiOTvrdFS?KS$yz3{9&2>pu z2s>CH-Za+ywwY@+GRagW2^WAMm>DQyoTM#i?XqqE`1bLU;y1F7iE*tB@CD@wvw}ga zr9wRbYpB{pdDaeOHH3j&9RZ7qW+x*tvG6c8yG+A5E4u5u@&a+cIslZq8?8c+nkNCw zN$v)s=SjVfDDBg)C;p9Syf3+{acbvo%sJ&Kh6yfdIz@hx&>cZS5K57J1&y&z2|O$J-$+vaYm>vU4`R$zW0Cp1=kx(H4W4_Ot^t*lXhRxXeZ z>V`f&U1bxhs8Xt11bk1pGH&sQ5`yCFu-E&Kyg*^ z@xzt@016*ft<}7;y_zg#(r|6gtr+uE_I98;6+lTxKs~fiaYG3-^Fc->U@9S1sjfWm zP=0ag``azkEa(L_aMDfOX3=d4vrj-!p-QT92VdN{D+f z@(rvU?!(xnz{p~bBQk0Oi4sutFsooPP>w&xAw-SR;bpW8Tc6Wia zl~F9EfwT3d7!Af)Tl-Ugvjm(hiymmdyu0On+Yd_q@V(JQ$j#)8?Cwp3T5gJ%f;1wp zu+20Hb?JkgJTnK;z@(D`VnJK1TRM;~ty5|8egJ*caDMURhz}hdSwBdhRVdWh3t;Gj z2gaML!FDwYWL$vB0TTgfL|s|#27}d997L!ucPu$M*QW!IViQhVQmD9gonM9j3TU}t zB;6iV%@=Go(tfRQNP+Oe{n?tkC9$tM!476U%k_^)Hm8Su%%~;LkW6yu6Yph3qu=k2 zlW~%NiQnZ9OZ-kbK>+PuLW{?CFCj=uJ%-%^JYb{xiVWAPL?gJZi{X@5f(3QyFHxRd zFdA6m<4|N}3ro_iRA|Hf4o_0;fQq)meWEveL}p0*MCz>=kBgb%?Y&I0Z;R7DIilnA zFlgDD@l0Yj3jwVkwtDMj1Lh#ma_R-5IZs^#Fr*BdCBIXsNQ{N!uY(X=i zO^UyXeNot}_v-&XX(7LACcx!^V#?F8Jx(D#w&?c@qm-LXO`u-`reFylptH9Vq56N-h+hlK6Riyy>i zzxai2sTj*`Xe&Uy$n07Tp7@Iw|;(RVmBF%fDhl>a}X-$bvsm|3~zHQEvy={+u z7oEWQL>4GI9X?KxR2wwA;Arf~?5{#zcUy`90h^B3H96m5ySG3$99KqDLR>s7P7q8> zDq3c@x*Xtw4qvK)Ws)>}=-Aip&`Z!2qC4+!+=&|42g(qyC=}eeZP>BLJ)A!J0LiLe zgKZq<@54LP-tj7j0J;^dujKMQA>mc)=^!nR57F)yf{~=n9Tw~C)_8|EvI(5Up9TV4 zmE|`kzl$}xZM}$}g*5C)Ee$)(pJbm^KlQ z5g+l;FW`>xM<0P8n8JjWPeJdPUU8GVjM(m6o(B_Ornet`AR96M>FwQkhqg^^)XUDc z%KwPO@t@9MB-fZDSc1C@Q)iVV3iT6Kxf8ORy8T zn~0htedd|W7ADXRZ;O%=yfte5B#ZH0Jn|ABwCGQ~JCUb=ww7{ETe)Tx%9=r8^5JH3 z&z5X2Fl*g@zgB= zLZ*`m38H6)x$Y_!nfdl?3ajnjk*Tx=O}m}U#xZQRL_U|qfL7D?lx43HfZT$cq9~81 zixh}j&(o?qn7{a#-a*&WPXf$mNpu3_BQPnxAij_12*+4r2h3YI2LR1c6ODQ?4m?-J zdCFsJFa@oz zkjkw~*czQ6{9Fo59A#QIRryg@?F0RDxpJmUjXp9V#ekem{dS1%6`lImxwkf=WI0ZE z3&#Datnm4#ll9Wm{j4T~V&Y99vM(O{U-6Vt%qu=cvm7=HABeMXq`C2IyrW-rR21PLAr=X&7f~y!OU$2BQ{9*b=p` z-Nu;=u{z_2b3tj0-QD^;f=KcH!S?4AVLFE`WB0p~=|&ME+zdEtfM*8KOqL1;EY0t@ zRN780hyTI?{Ov7i@kxOi8#9g&4yQaB6fdctFm+k$3{lDcpQC}%aEzFpok8NZ-yQh8W89z0_PD9yVi4~M>Uh}X*p}d zlm;_W`guu4POMM<2)9O8nuk2{V9^)l{E%P&_atLEr|Ak~3Xii%5MsjFO6^_^v*jrC zMm>*<6{wDcZA3?=S9x9tQY_XvOYzb36NI{g1|{<|K={}*cjSYzkmMCXikr>~EaQsb z^CIsE{$qDE2(3UzY1((EqHXtKtw-cnrQ{9?WWzMe zn}S7n!7^db9!xKjSZ;yPLM*5sz`RMw$Y9S1_dciwX<6hC$fdIM6c;FM6)_w3V%Nwm zXpY5QO-`DI|K&lD#+*#b@mIWVO|~m ziz~5I*K6e;Rzn_*zAG{0Qr1ICx%krbtDjxegYIV#6F{rCXOzIRY*f(s)U{Y64|kKi zwIo2HD9V~XO39*@EXU^8CD9kFRN`=g#04C|q~QRCNH~X&ZZpr277gN^%N?~OvbDmBj~q|6ztw0bc3Tmv_yX5!vK1kmMb03H$>X4*DorT znG)9GHPt0e19nOykH>dn8C}VXFa-%8pxQY43|!YmoEYL{Qm8)Gw73FrZJrA8&Np1* zuYA*B9Hy5VlqclB^?e*c36XOT5u-eM-&sZ0T_}jzJ1{l`m!~uTS~S>*{X9y6FJKuS zZ*3yaviO}N5#a`N{gLNO?wVQAE-X1DZN%z*)MMwn!{Jm%v(-JFC$+byKrN0fKH<^prNL9gozk#eJo2nE<7EhRLEeaZljANT`RV7G7ks}LSWwc2)f9eU&<5f3++$w zc2s<^gVWfvsv0je9I^BlYUkJ6s*Pm~M~A6#25Wc>vlFDL^cr$9Y$Wk@fOUT9!299Yg)l zPy{W1vhH0-5uk7B1+C)9Q zh^q&5CBx~QV{^_+jrQ*u$RiO`Vc-zI0*OvBSIrLljb7=XFoC4OdqwV(qmBncqujG? zmmkOG_N^@Bxu0m(My@kBYeetnFPmifO*Eq$eJp7iw6#Lg?G;!9Zmt4}>GE+pA?&vK=jJRkL z-8BVL{73O&y>vQMlnKNtkTqEqKTkN3$qlKIW4pWC4J1%;!Y>TIY`UEVEs9^F;W$*} zY6pULC`0eczO9k=^~f0K$>h8ZFLXPcPjkCj7T|LEl|Ruabu?5u)SoJ4>UKW=v-ejb z=u%p+aWoAmmA6yNy2lrVqwP$Sc}LaiS{O0JJL#5?ptMPtGT9no>ePE-)E_OuOeQ~< zz!cq>#aoZ0s9Y=35Hy@AyDHXgqmhJ9(gUQT3gzdew_xTcw>o?pM7N<7a%o&`F;`ob zlhc5)DiDBy0kWoxOR!u_(3JRM^`QY&21ADCl--ZOTcT#vmvE6&QMO7wb!7E4UdD}A z&UuHz?h!MRPq*mj*s?j%9s~udcy%EyeePha0u^3w@hN0t7vPYX`RI zgaeeaiDd^bD97@fyavV)q7g`YhS%LZxS5!ePx#5nTdfTY+7S#MzK7UW+1zDu7@AOr zn*va(X8j=@i|1$5#YBg>w|B)$V-iH(0V&vBPu~?pB8GrI5h<9X6EaTS?d5&;{Y=o^ z-NszNG3Tw#hkUChttn?o3+TGgD!LZ?7Z@I@ZQ{z}|Z)$wc(8!Lffej`&=W2h0_|>>9BY63BtN zHFBW+>4vhu**gyG?2#0O+o)}I@}B0%EMxTS!NsF$x}rOqBF ztahbvao@Tzb4I4=y`iXC2hgyCG!b*%Yp-!!w#utOb4$2E;I-DL6ta?}lUY>KKAr*6 zcLRW@TQ?pIk-DQYQ3jQWP1>7Q0CmRZa%)WaILKLf?VQuYGC#S(aa$#o;7P%3dBRwu zSZ1agWSzzDO6YpDA~NF#l|YL{-z`o3g5;SLZPEz(n?iTqKRqCh1ok9pbe%>wP;_uX zuN+`yAM7LK_Q1F8fV8_wF$7Is6~ygs7uauZ{DnxQ>XUI2qPgtP&0C@gn~U(3V#cL6oonH*_fVky3$h-Qky}b}J82L%bR;XDYuXcR&!EsQStdYU;yV zz$bMQ-JB%vlqs8_wSN503wMPk1qOXTC|4+^x~wZT6a~V}I1{}VTO(P7*mR&>RA!cTuW4(BQB}73$kMG&9McGiJW99)jDL|DeDaR#>pw+eG`qPQZkOP=F8qHEkFM z;fM8DYZQD{dHmafc!@@@KgovBoB zs{Pk`V@acUx?ik3)xZZt3! z%8}~Y7e#Oh6l5bSfYrXFY=fgZ=c-fHk5ay2!wQL-8j*l+FoXNv> zX6UHaD`MT03V{T{6i*^Llhc%$w=I>LjyORt_yc)pyrtUh`?wLizEOVc;|Ubz;ka=c zW8M4&9PTBsoUohDJXmqD`?A5ef}RE|8jH&Zby zL{>xJy6z%KCs5gV$#q(ft=vgUNeP$lSfr&WhmLg*0GMm``=?z*W%%X+T|h-$2)guk zyTPl%urF%u(q4p`YH;OpkhU`9bcKM|@F{808h>A~vpbjtg5Jz?!c^Mb)v zrBGHF=vw^<(iSB@ar*JqzgQ_R2*s6AuRWr&{d&;sOFlP1zej;1eLGg`Tcp>X1;K$nbZ*;-|}zy%pRwf*;3Yt`UZAph+Md zAmo?|f41$YD=RCJMQ?w}%7A3MJr*VPyAvgKvF*8k#jM!(-SqsaaU98bCfj@r zB^S}=CGQ_!eTy~g&{lkpbYOQzBf-E=*kOXw*$5a}h;zV78Vm*)d-0Z+%YhXZduUCW zJQ?MyB(oJty_1=}4EcddJxM@7{smIx3K6SG#P~qIxXB>U44B_$q?{z!Td!7qpT121 zM(e{cSa&NQ?r$nDH7tz$$aJFJ%rjHtoVrj+#j*R8={T+C{LH5car$OUR3sA43i)e% zO#Q^b6d!F0nBtdmp6%Ex^FJMS7YQx?nK;zwQ`7ok>@{HJ5kR;2AFRD)P+nV?wu`$2 zcMI+sAb4<>;O_3h-9v&q!CjKz?(XjH?(TXP*?V`t-S0Vdy1)AVP?=Qmq@KCvn#1mK zjan`ssZiXp&YGgXaxY!De2_WBT?-dHYW3Bvz_ySGpZ6PUny!NxTHcPeKtu?R)J|cV zbi>D^Fu$0YRL*@dx;x_}we%r(!&k5N9L$6%(exEtOy%cy^&Cj*%F8j6(W zf$eiLk;i+`bjNeDEH!Kw2VAV#8q))U5bw{Ohg@RIJnt>WBZZr@GQ0x?A>r4af~5Wt z)wJS>h7Ax!?0Bfahu5l4X7HsIi)R90m2{cFwjhTH+LEOpdgk z+EZ>?Y=(cTFlx`vqb+kiFEyaU;quX~UCKSGH;T%=?H}TF9#SpT`uYCzX@LPiXzscE zVG0FQUvulXE>T^)f85d2#4*xBOe9tA>JQ@zshif%(P6plHv?Ju&EcL>SO;T+&n!Fi zYGL7ci1|Fp4uHJpJ;T)2cJ$uvdM6(W)KJwGo7G%dzgapN_$g5vRmR}~s`Dl!NwsnIdvgQN8L}tfBlRnR1xk-u0EUn!(mJzip?ovjDxudhd zOsYWh&lVRGD?9nJ9*-4{3?7C&>s~ z_hKhSuNt8N1OGGfTU4Sv)y9Y4I1&aigxRMFnrc3@h%z0O`UcNT!jPuZ2A0V~?VeKr zU7$m~>%&G<(lZfz2X&LlpymJOGt#gEAS4fmK4+5ky-V z?dcNRmZ#VCNQF6%ghGPDdL+@tjC`HD zv&*OM9%7)!mSEh`tipQHWn=SGXIE1$TKJO%m1F{qA9wAk-b7r+*{Y9Nmq*n~Do$*8 z;>Y1ZrQ3sRb`3TUp*=aER7_8^AU>>xOpaJ$9eh&fxL>g+_@F&2dmP2h$pHk<5#xpw z*teBm?mdNt14A>mF_gs(Q<%Kj0BIWa*?f%`bj!oTPj-tE9Iov0@#Khulo~#n3xxE~ zDsq=Ee~Hhfx(0K9BjK=th=hu+&z+-TU(CbglvtG5HdM-r+2gVpeLIh-Y+mIwG9k+` z1P~H?4FE>N{(Dlg63*8bZ7t6Xc0`~plp`qyA3Xt9fH}{xOYiN4{K*LF4 zUO-EHRBCD%Fuu|ln{hO?{~-;O{f+rkSLrvgQqa+T%KgTQnK&Dp26}g~PU8x0$sz7Q zmlLy(`AmWEP>#;ioN|a;H>BnnAI0*falwQe12K44pASoTLSKNB%^{{1h-|6tM2|-)1rtAIA0JKrz)Uh+Q&I}&A_P4jweRm1C7nY~6yShq5hNf}qGMxK3 zo%BYyV33O=pR%syiHmf;l9y8O3%3^At2u0f;(j&m-f~~3N}uI@GoJJ~9S$D>?8BJC zmTPJP(0f`fJjuPQ;c!B@gD=z7plRO0IZr>Km+F~U_|yL4%aKKDD+`uOj0!CA`;HaS zazO$GrluBcy&u8OBwyU1fr2i~T2N?$en%G(y@5>rzy^89#!=EG4&X0=R3{^aGnY0P znCr99GH9~Qni<7C^s$O);EG|D_xniy5yQ}-!pn;j ziFxR|<{dDa&+S)?#8i&TLS6oxWNrDwX@3F|Xn1CGOQCtMu#NN6J-m2Mp=StSo@g8g z1G*-SH#);zh2O;XYf^Rd{|MT)6ab#czZcfk`YKE;dX{ zNlV(&;xL{Hy#h_opE6^>O;0-~#9@`0xx94yDEP$?X?qh~t5Rffmvg*4Hr z-sz)2qqem^xQ8*L`A&UjBDSw_WfqbkvG~&YyFTgi?mTwyq9$u-0{YoK%kXh#V|8D8 zHSC^{R<#5ThnxQUnF{z;8{P%pfl_)(m+SzD`ASSojBx+a_F$rEowiPekwg`MM+Q1& znnXq>v;cN~2LPBZ0{{rIKa0a<#KqevGd$l9cuW?%4~QlKf(qsvK!UNM(lTLks3o~; z*X#X=oQAm=!hi$mE9$2-}7CDtJei-cJQUTLJpAw?JKnX@b{D$U`jDKnx`;54jEHh zd7$lUvEV=iFRO*h`y!}PTcZsGegubPeK8l)ojE1bqYfb5XUS!Zz7c)EH8)ohuViQLIi$a1fq|6)ly-k#Ge} zda*ihCu(};Wc0i}fVfwyGzlM@*a{De1wamhKxR2=QTjBM)ih#kxln;(07xRFgpq5R z>ojax*?jd}55fXaS*&ruh;#!rvm-#ZeYTt7qrs+MV>S*3ge)}gNo791nJ3vd^YrQq zRDtte-KzON;!zzNcJZ`GwyB3aU=!ZOKiBA${` z(QqS8I2zy%HG5D+@po9*gn+`e## zl=sO3{+Zyl`j6mWBo6Z+fZ97z&UUE|vZ2WR^~EbNFz|<#a}9J0u8bI;>gO*kgiAgG z99YVh;=ruZ_Dx{p(9v_nD`RHJ!!K|P!h2_=1TP;;{#%NSq6_=1rz7z6krk}90rXM z23K-o59hDLanpz^Mcg;$km0_&NBPC|ZTuUE^o`Ad@b=^X4@8>gVZYWs9#B_l^D*Z3 zv@768rGdkIjwDIlPAH7c64*x?6^By9OPfFRoilrgIGD0jzlmOn?2S9%*?`d@AK|)q zFdCGUc5GYb$T(+k)YUU7njqVJ8-0cCp0K=C;Fbf)XNM8GA3JJDi@PtxyJ{*!01D=l z?SB`{mkg1)OY%2%4XJLT}lb)kXCaWkI`i-r9jY^Sevx$%z{;ALR6&i&b= z{CuhYAV+Pz76_FQpPuj=iQ56pIg)rI&_&(6(cY*JaV6}FkOdTe1f-?I`oJViB=fMk zu9s>{i;DqbMG!1NtS~|NUo%hvRu~}P;B0AOkI5MHq}<@xsM)*-kFRt0^6$@j23yqo zas*-(!RV{eZj>D+kjK;;hB=bm@A+SpGXTNcZI8}Bo&P1{@Rs>i4K821jy5dTDFA$| z@v}}<2$C@7{5k4rdV3I%5!@e8-I&Io|CKEqeJfvNhi8Nc;|vG0lcjieuJ?!Tr}ecB zfGmwSd$=(3Kl8_L?(BHOPyzi2$H_oOxp(R>z!)$v^;g{ZJsALICV2xh{~Iy%zcp}g zRsIdcF~a;q^^%IGM%h+^wVgR-p*2V^N8(R(6HTpJ*{)9UA*Q%dUHXd19)={CuLg%fBUa2w;|dZ+%Jq4BS!g7MMOQjh_30{`r2>nKu>KniGMLW_SWZoWG( zM@#i+IbwLf5CCE!Bp_)^E^SBSiul6_qp`|#1cs=FIlk47;)G(o&d9=i@qt^{l_STtP##f>gglym2b4!rY;FvH10;1n{U-=DhGDL|{ylZA;+%#Wrrje?z{~Qvu0*Rt4b4{|4bZ zMVcw<3($GoJ-wVD_!I9fwu&1=ItBnL1y@uNj`7DsA<@P{;F9a>HNs|2j3_?J9NLgPklIFAgWW5{9?WZ+^4Iw(7^f1N< z^6xUyZeJv;dCaugv9mtPFwz3mUKmpb@5m|WN8#1?L42Re`P0e)QX5q>ROuVId3vK@m%bmZQ8sxV7vHT)Gjpek7 zI@uHRuczrZ^apD@DA50)Z6Y$nIs<@!M!zYVoL-Eh>9r+rKDoXygcuF_lWcQjsV!(N z$viLC#RFH+`}a-EA;N5*)Wqp!YWn_b-h)6?Z?syeh|2>@iXnFcB|X#rg>FxS91LJW zpPZ%gj6MGme?aysGHuyq&*9@xQYsCHvXA@q5n=09tPhs|w%?gR2Q*PsI*i!od?8pT zzGt2bPcE~BTu+ZFqf;0(=Yxje3dHOw$62|7#l&OW2r;U}lt^ z`sIWH&g8nY2`Z~F`4qKe`Hmp5bh!7q>NRX}AU+2ZPPoah?p z>;&q-cs4(>w>-UC1p;c1nQ$tiu&nBf{c3U@RUwFt&qV8qXw=wFoG9nW8Q<=_HJOnY z;t_?{*NP};yH_6IO&MOkElRY8%ytTLWZjjMJ-rL)pTP#N2&)F++pTZ7TB;nRW|bl)X(2a z-JVK>SpV5RKk}_@ld`Qp&@ok9ytB6v)oy>>@afXz)7W9PYHzkHk`JBx2Yltu%Jx+` z_Z>qrURb}}D$2WUSJWN?iJm;@$grNd8{+_Zo>Cy*SLv`xt-nIEAs@mJ8^T*cAkT5n zw0oI#`pELiHwEde6Zbb=zw-~Dmy6~NN(J`6Hu3)za~?*W1>yH;ar5kXzwtkK&j=Kf zKbON+gMM@P2n|(#2RXsj9R+$z;IPbq6H!XaWE!`e_aoAoWCJP57vz!&P2gsn9F>Tt z{bwL_2c6q{KE&Y7i85xAWeCIp$vevcmGnrc!9Yn}7?pxhw*7o6xP$X!m9&i`15w}v$-FdDbd)QMsiDdHn;oNbcfApJ zD#aqkY`EsUL;ZU|LUDGv@iz^OFv1tW%gmqvGA~xp|K%O|-jCoJId;toR@$1?B{T=y=IQiiuG|r zJt3{+el=zW7m#$?D1zzB-7Z#?dHD{yl&naBW9Q!7qbztiGX0Bnqo))DCRuN__wQ^~ z2Ldj#@^L890Dr3f$HzL)V?6r^tNCBV4RZqMp;n0e{F5#2_;Ef&2XB1-zag#ke>|wP zc)){V1?FzN4U8~d5Bs>r4oG(2LI^qQK(}4Rb?1~$meVB)biQhooiw?i6y(9b{yvi# zO!AG*ZGq5$CD%J@tb?zGg>O9<;Tp!5^xi~Afgiy(4xy@HAeJ)H{<;TBtGOO()>ejN z9}9B=G>9}gOCE@6J`jt?fwwwe%8^l065FnYQmN*Dhj$)TWC0s^x3(HOV7H+ohr$^j z6%h+-&PkZ@HRs&?wRa_@t=CD#<+ZhOm@j9zVq2zS+w1#gmpy*PJ8>9GFmlid!TpZU zR8sQ~7YP#y$H-TsgA*N^RCxjOOd^|Bh8}^9wR)r2T7-?0cp=rT$3}L-+AEd6l0+^lbhzo_SzpPkY_k7 z&VJjNouG9>dC$hTJ!?ylIfBnJ#+*|oG6-s_iF7!gJj%3r0JfelQMA(ep~G2~+weo8#(*=&zprB-JAlsuK9Wfj z?r6b5O{u!3*-3+>$?e&uMzo0iV12h@0lUD$Vw*ApyUP?g>>I`N5&5v|^1*jrg`JxD zDpbyCmy9!Mw~|*6w`JHMod~s~T7aWldQYfQ{i6QCDP@r*5`E3ho)FO)s6y`7oKej) zXBztW;CeiU+ozLMij-Xbo|`GuSB(9N2qDRCw%Ngs^{WM&dui2nt-b}_`6lm7tu%u7 z+!Hww;;h*|8d;U$LLcu_Jbd#v*KJgf;r>vCH7qf-yW3?USG%!yYg>znkY^`Shk+;c zDK-cjd;O=Iedov#={l_!mS&pn+@32t2EUT0*}CV}i`c)>8bYdps`z5)L0Sm-eV#dm za|#9>fJ44<1RW6XQ(Y&tyLM0jJnM|m9F1o$gT~)4%*mnjMvW=|z8>&0`0Jy7m_xR> z^)_dRaJ0S{Pl8ba8<{Wmt7c#q*hqj-YJO~*j^9;q+xTuf+Z7^7l={W!+C>uLf4?w;v(=tzqsHl%;Cx2`+^})3J8@1$1*$ObsZw zpq%iJC`V%`boS&ne@1^7veP9{DX;Di9S+y%`JD?*|H)WGP_`RMPE>}+M+HlMd$O6D zhe>a%+OMqz?|`kzELzpIFt=>g+9@6xjh8-)CiT8$Q^M2m_T340DZJeUJ-v66izS3A zegA9AQjL>idJ{NwL^Dx@kp9AlBAaKng@jf}lGO{iTZ4;(0)t@XMI0OKKZo<}KuN*H zRd}lwN+8IOO!&&EAcDtX5Q3C=3qsz3rXl8_!j&y63p$m=9!FSb{_EoHY5aL8RN8)@ zG4~MlWw|X@3mf}l<5bw33X06dcfFHx$s}gV7iZGRddFx8`JAHvtSu=n;YjR}{+F7|K z1?NIS#O0i`{q}CD@xcjSHXONK#&^jQmv?SytG$OJ5~j1cWIUj(7qMM?q!{0sGsgL> zqaNM)df&B%BZ&L)bJ@|8iVaL*9RuajZBSPJ;Cw;7(hRsZtf#{$jQ4mV=GxX_O7q>= zwo{$+PaiFg$lE6v=m;;=e2JB<4^<4$x@y%&qbRV-K5V^T=GL`vT~6Tt*+%&=u)LyG z44O#L0fVXZb~a!)GwZaj;xN{ruc)PZaSF0P7MIz&Hj5Nhe2;AgChU96soI=55YIUe z<1q9ZQz{%&qyO4bJwjUf0Wdo7xXU?t$s;cQ#CR%f%2CC&OF86?jGKmc+XS=h>yZT@ z3MWgi`l$!xrLn(7KAvwWKzOQl=Fkh%xeO4Bvb)e@u6h3M&F2>LlgJX^y+Exfy^ zRW_zlV$WER_ucIVu8W^lEc$bM*i6FMC*aTKpi(a_x?&q(g;4`G*Hm-m0-Zaek$C=% z{Q*vhxLX&MF=)=l`A1PaN-cKmL8gz6JS!<3enxy$l1ytU!gIEaHMOqg#ofWaTvBQ2 z1DPXV()q8*&WReu&SF`qL1kNhjR&+gHz6@vBZgV__p`QkWsQuIM!RchS*qXZ6q$Qa z;*utgeED6Vvn)NoKBd|9QT?wsUd``7H8bwIQLtIxx1z(4SKIeO+_ZMDy@r1J^>-4S z)bMm-CNNYfkrtr4Gk!^^VkeO#o>0n*7kOz#Ca($ z+^Uc3jFt<^9mi?AALE#Pg)8vN?_j%Pw7*eCkP`BLRr|t7_uF!!0X+{ftBoA21OZ9~ zu8;*?%`dYRLr2a~!g{OgQtItu=yA;mPvImJv_qpa*K_f~jYN(FPI7ZIPwvJCdbf$Pjl5rIvnlPDL*Nw@zH#oMy z{E*?guFGtHMn3Mq$YW=c0bA{9-_|*N>iX5^&e5#WQ*^->+OY;tdxd+&eTQ!aT6HYx zM}lkWWc{*4fwMvmee9 zR=P)68Y9!;9T~5?>H1HmsvXadBt>hdwI4RBfA?#(jiIP$pK$bmlMmiDEmsH}^h$jtLEv;t z7LGVoESDqx%R*)p$`#bv{lVVmFH`9R>b!f>nZ19gQZ1-p)K`HZ0Y>&9XBFcrhX)>K zwcAYtC=a`7y7w9K+fyo0go3xv?6UK=28kAG1ql-x65QQG1PihDkJq4Kt4p+4{#WZ_?_`51=9 zc&VDpTdiaM@wjZJy0GS^fF3#+S_c1U);?3W_r;qa@}^+imTNP4Ay?A%9E_2j-C}O; z2WZ?o6 z=3VQC)vJrhLey)wTI+#fPI_GE&r*%aGf&Ru==JNy{r%qhKi5znjl3m@F*V@Fi6#M_ zhYu8XX3-gl-8C8wkk+)qj+Y0n8Ps16X;v;);QwXuw-Z>@Hihx6=QD!5tTx|>n;%eI z=%G-Mg>1Q5V&Z#Bg;(%?9&m4RkTPGvHytEI>nH3&)h?NpM8QnuQ6&`NxwrfD(KEdm z24aRpSik+5b}4ENti&qdy~iN6v4pYLQ@OY2dKCPy4~v;JReMin2rXbUr?%R^zPZeWYU;YnIw;oMK~*>b`Vnnx zIZWYHNcfLnUvqBt^e1UW_(yM6BX{!od#5#DfB*XWvKQsI``~zVAhRyvF47zP?Cll+ ztxA7k5DY@&^ zMWSBkfn0X6f171JV$g2q7utdC^1m*OAxg*)^;X(kXy6*E!316c9uTePK;Z7-!V@J& z*K7P8c%VhONU$jIuZzDN?l+&t3HWPYW8^r+S(ldWt=)=y_6^q6)lz|$26?}S;kpbow=%MNH?hucy$nr|h zIsjTqa2hSY&dPsC;8T2UC(fQyJl6aNtBtWtk|xQC!+LK5j}5fowHCf?1F2Z(6kKh! zm?IB;$c~v56a0J(F)nZcTu~+8Cl_=awI7w9JXzQA|16Tk$|kl?F@i`#t=TnD~_#%}|oQSzm-RrHgGq!siNUJkya z+nLOe-)<&qi^u(|F>&jWu~!yd@wmAZ4XsJ5Ki= zxEkcVbc|GUp{&%NF{&6}6~!l(l1<(CifCB3d;UZyZE#aRz`6ln=m7Q2hS>cdK0Mzq z2M;5)sZUz$tD>IH509se2%FE`+H!Ha^E1A;+A8?M>ccl?ixdVwZMrr~b_ZN9APl}6 ze(U9qlIGWxpYuJnz$!r~67Jh|FF|;xwQm_j*1vgyR6vl5&2DGVC0qbPj)+e<_bpbi%={U z9t?yHnFqZbj7>ljUo!I^=BEe<4pDuLa)dMSSy4STh)+nSC1?;5AV&O-m1q&0Hx9p2 z@~b{gYGhJfk5zG*Y4D1QrVFt&qtV0LK%vAn@A^REfX<0atA*3elA_m9fCCgz&N{g0 zF^fPj+Jc3mime=ZplY61w#t>hFSWV8g6__Mz4?u1{X?iH@W?}tL%rr|`nZvl=%fr8 zKKK1B{C;{AzA*_cDlB=ybw53La2_G`{_N*{O+H=#r{e}5=gRZ>_~+TuC)@?iSNvqI z6`^gbDxdtrwR^jKjGc?W-L;*Hzn(q++lw0k_z%I6PN9Ta_WKL}bN4|DSLPqby3LBZ z%yLv;VS3?a#yse3=eltow|t>6IAhSlFx8?weszI0?3QO!Fiy9jiO|R4zPrH4X--OOk=7O{(@ClEM7T}8FBfB- zDPT10)0S%51=-Cy-2+^Ra_N$rL^nvg)0dHWq;nHTpL%^Gp24A-PKL zbD1FqasBmE18f>bl_uxe@(6w{AjnvvpXKC>E;XZm&HlQsa0sEatI#>dgJLELLqnj* z^?@g=paZSIJ7hU{C2o=qQFHbc20o>vUHpm4;9OQ1O$;U6i8y%2o+Lvtu#>DMasaMf*hf8H)JGi*DS{HG%sqN@!y7~bgKZ)PiMMt{Q#5SxysdE zB$Vj7<)WG^RBTuF*DHMD)Ou;{On88!wWgTZZ0n}oE;NgXxtZ-V`b<>| z8sDkE0eNA+BM;HcR+)Xy-)D!WNZ`%HCJ(%&O1?CJ7?W-NwnMIasDJZ&M!OY?U--(G zm0z)kyD=-4hyQ)O&G(P>r~+GU+SF0#PSJg>Fb9om^5&Q%Ro2|TbWpbrS1qo-;r0kV zFDcOec9Bs#vreiyg>}@SRn@z42Xk}dw7J&y(GelvjxIlw8>Nf785Wjym3y_2GbTV} z!M^C`I-57HEx9ZpJY3&Orwl!mlosWTad@)a_729|?(E~!L++u(#q^+clUwJunpQ0Z zBSFwSFH0eO;l-G*pH~2vw}-buX0dv#y>dXvu#8R-sa$*#)0)#t5_s~j?v~wbf|0ly z>d8-XLjrPB9ngfwJu7j@8FfVw?*}$7N4JHV=h>~0Y3r&ax(~SEkDVl{fL*0F#>EN+E{|SbppHDVLWr?=bo90E}4cmCr@I;wBePti9y7b1;V!=V={YTl*qv% zF~9yY@)e^;kb&jd@5!&0oHJt57+vaEJo`M+-1sMSx=S$QiUum|wQYB^#l(7pCsY&c&Q5 z?p}1=uZAIMsBZ@XUu{D-#Z}feA4+j}?@xGv{u9TqZM)+)eh@g(cOuc%dfRQpyX5#+ z|L|jVTk|06^*-N-&VYP84LAATbZ_uc?KJ`h%?`jq7o&f!9}l<=hfuLl)8=nno0ise zE?!ud-e-xbu%|Iu-}>fvf s0Ip5S9ubD^N@BC4EXAbJiUB1n?SBIAQmLQk>Q+bI|QU$98g-S9{Ql^6q=oI|R7O8ad}&Curdm4MUNIC|mHv-&t_4^gbDxJ;OmqptYl9>v zExQYNj~vcCO|aCbU?=^i*9tB+=s5fBRL*ODPS-0UvE7Ys_|;ISV^S zo&7m|M90XKzJFrZp>Kc1t{~uXtSmg;Sin7Uu3Fe~Jr4hQ zHvYs+YJM6(vH?;JiptWf%Cz(u@IE{=Mt74>INxP(Uk73YZ;=YD@CjM$U5V-2 z2E4$z()T#VY!@~UoP|ys))T2A?jA&uXV}ct)`*bFr#p5t7mn>H*my8LjH9uR^KL9S zx=eMQqksp0rN^J8thKg~s+@_0Jg~pQgSVft5)m?4f{w*3fnNX%(4J%t>dL<)xz*~q%uz)YQWjz*5mJu-h~_N5!Xrk7z}X%T3kT~B zF+K-M_E}DP;TCYZ0tN9IRx6Eblqs>AAxD?r6;DZJoxhH#I70qO?@;CZISRjOsC*~vRYBZn z6+k5#?n-~=!^;!yA7K_R)EHZTFW%fLYTJ4XDm2CZHIDdy4=Usv!1CzYFyB(eCI6Y{ z)YSHRTyMvIc{=wVFO;*2SR*R2z@BZhC=-K|So&Z9CtqQyCMGu|s5&LQ`^~RF^kO}2 z38~5hL+f*ao=gDru@lY0;fE?QwyJ6KD8`p*X^DXNnMdt9mX$Zxg{!d@W{@j9(aHyk z9sg;4o&YTY3$6)0Ym6%p9KE5IAZtw$R0TCvZi?CPk8A-7Ah8o2QNT6veNV!URy|?JV9qo=t zI8L-KIz!CV;q~L%2T7i0s4CP}D{{&a;f0NiLpLXiY=z<{@FsGf!0UQsKmD|{^2FNo z8dBS^UOLT$?*BfXxXKMg0F#$9mMm3k;ure=y~-Xj>ye z))+;gzvX3{WFⅈ`+YD7nXys&nxpO9jrj|oAbx%dg5AN{I4(@FN3kiX6sL$W}0a~ zG8mWKNBRB1#rPx5o;Wr>du>(E)jgb!EuCfWvp42nj^-20RLL*7{`E40st}9)DHp&d zLd#=9OX{2jtL#`iz1}N(FXD(u_Lk>i1xta(bLYz~N zOR_IU7YF7~c85b_rf%WP2kNG9966&DBx z0yK~srnYCYgtApUAEuqD`T5X0HHjQZ1|n?{He*#ecAU)EkIOkkSIDT*%VGV$>`h~^ z+FNyXWKC^lZiOE7rI7jgCi~iH*~ZW$)9hK>pRSK)UT*Pko6jq~QohA^37r0FR{WnI z;A3$kM=LS>#wdiraF89^hHJdmOo^J+j2<>9Mh(ACG#;`Mo31pPfxOE6=Y#xu7`bXfqamMG_~nQ_gOAennp%bsC-|!i< zO2?)qXk;x$NG*X2;hmfnd#k^!7n%{L+WJRd@P*Y4#u_g$LUlhm<@IP|Gf8WAinRH0 zJlzMYk>J?t;Tps+GA@)z7lXjIfjN|}4T5hyKB{(nutDsmf_|~R1JfObd9#yB&ah$= zNIIN}9VI|kE>&W~wAow%dj2Y%Ujq!Dy`-)Z3o$t?*jDFTxXkA1__GkV{n{QD6VsDo zbfRFAt=jdiTEiZOv8^pVrW&HNT4;lP%0ID8?Vn5Jvt)&}2iS&fSV*d^o>Bd<6(%R_;QWlLr z1UU2571>JYc5AALz(X`w zbFDRAzHtDkWKD?{B;c*M-<;k3oV;6KM|v7fV$IIvpw|hjEz*qqoj8T*`hgcia`1UF z0(<4D5MJSB`GJYg!J2f0GS;=Q0NOP8>sfY>iB^k+hoeZHkbd~ge>Rm zdQ462rn2QKn?{4aD2fa|7O@iBClXI;&r^~vRAiY2FcEVh&N7UwG2FnX-%?1>-drXd zXL>W5c@fReP%lhzr_2nR_i&M6)-r^%n#KW##W5Ye&{gyIDre*Agr222;H^i8;E>l| z656~gjZU;B+6}n~q)MJBUya){AFDS7YUzGNATHM|8-_NCCvy^12Jzlf_$u1tnQkD- zlKHjt*Xx4DRsS>><_RcNl-2iJ_-=gQT}3@=7(EkI#=}+;ZC`-mHS_r@S;}rfD=fCh zAeA{$zb$>KbM12;)~oaWw>#Vm-bPYR!|-4`iB%|N5pjjJL}Lgg3~v!X#$A!q56URJ z&A;F>=sKllm6eYmqkh))&L@iH#*^G!4G5%YP?Ty3$F*#TS?qjH59vJq=`?{pn>&0-=4V*Qxf7Z!uGxO)UUvC^UA$Gj|9r5twx1bY zH^}zX_GT&;6_9P7Wc@zM^N7&mzGbFE;?rP-vr=wOite8ZiscNIDUJ%WhSFPs@Nu)u zx5Q*rQR8A*RF5rfkXLTMayNhWU|_f9(hk4&b-l@~&pOnahx5ruC+B5zfWYJUaaLRhDj%1`|0_D8?+ZMnLfZZpM58sX+|? zN|*qjsNDYj!P?ljfRU>%=GH)!Q;)PgQb!$Aha6Uo2RoF+ zLj7(6i6ig{I^7!=F~pxe1DSeJbg6>LAUVl9!S*SH{-${#N#63Wvy%mojRP*AZIE-51$-Robb?Rf6ENcJ0ya z`E@MDR(xCa)|QQ%Zp6Qfihw>r!p{KECtOo92D+3JFfvTJl;;hnIo4;@haM~6{-hJ2 z-gV2&4Z>TP12-<0{L=7+rVYM+TPb#sMg=J97{qTlZYu$`gj9Og(QS+(eMYDp?! zMdB4@7()N954TXu4}sBnWTx7xFkio1ILuE~=cKB>JneF(%WjUVwn7E+X}=!o%9OUf zcR*9xj3zU~>5H-B2WvIU2x6_AH8aj2PN#eNL~P1V;75d|Lz*d++b@`!bPD-pbr&@A zqxt?LIH>Oc!;^#?gmAJ`AN}J;tB?Sc1`pT42k=jkeo+ac0^{qdlTl=10=DW@ z(U~6~TE5?GaDso(fS}(237bEJU`9=sSR>V@jEb1}j3c@uayogE%d@#S$+7x=;XK>p zlv+xA_yPp;SHXC8x?t!RsL<(2wcIq(05(qZdm&lghd#wD-?N0wSuL7~QO%&v+l2_| ze1gC&i0BG%Uo>Ci`WyT89e;mVsxSDz(1YJo5=+?keFnt}6QL5!_#Le4z=}UtccR+L z@V<8{W-fvPL;{R-{hihxA$J5(L@@>(Tj88qE)I;P#FXXk_}+ex!8KKarAN6m7ffp` zvg0l=0bNtil9t#*RRCyEx-J$RtHtEYlXbP8LYEjKg@Bo85+EifKqHnorIsP-<#;W( zW#nryJvEEZ-8HSTYUgI(4QRSD7f;y&oq-frOxPDJ$PbF!?kEIf8*Z_>bq~3CXJ?@< zZW5s=x`P{Um@IB`K}HpB?03UF*pX=-GJ0TT3z7O&Sy`Z9%RaWr8Z}h{Bp-yGbuC|v zL{G7s)O1A8_Pw9x;zF0{{YnXg7B1ZS4u&2YD$lQEyCUbP zIdve%!`YeNopE?YksQ`yr=bpOcS)5RIjzwygO}1fYMpcA@%j6NLJM6V^~rHe;4T!j z{Rq=pdN`g)y)M5UNU4=gkBe=?Pc7};FMn%<)coAC{%EcOsbJ(s@Tt^`TNq4tA`b-h z@(%qzqmVQy2MM|kx)D;r=59gGxt*(*{F1#8v{6RvZ8Aq#TyDZS_;o3%o)vlj<_)@tx5a-}%4*pV~vG7;?+O-urM zIBx5-2#FFEpyKxHesZxf@>^tN)UfK3sv@Saxv0d{?WG^nMPWm-u>9z&D49fk3z9bJ z*0|uxOa}V}*($<#g@pD#$ap?YNI|k)*YkRmsZEwOXX$@^NcUCc`VP!r4B$!?O`9W1 zs^Wup!j4;DvSRFEN+AAf{7s^mDNSYF$-aW#!WCtj7kj)Jo86PMz=KIo_K3vM&m>Di zDyKbGuq%hOFb`$sDx1yKL=R+F1}$TyM#j^bzr_+O!Gp(DT`JTU4%QAWio`Dnr!R_l zhfb}qAC3oSEvf{$z!)Ll_a!&*QUcaA)~4>56#dKMkEcfdi-gsXf zVMbix@(-)NdwA^NFZY_K(3g4tqWI)|H)W{{-|?li>5-659{tE;GDVbR=x4&<{eQd! z_ql&wf-7tw_C=PF1^HwmYg~%1tKx*Lj_Hg4jAq%gmDIvVGx1sxWT#V zjlchWz0p(gmlLS;9jx&NACq2vafPe+-Aa?UDml0Y`S99q#Xe$}&>F)i!I(=|HL= zd__L#DYW%uX9oImVY2YfE}CSW?RA9CniXD`zuR|PpL7uXiAG0h+)-;X3A4tG)^2&F zg|zhJy6s~u)Oj=Dp4E=FMyYmVF)oJiudcZxrwm(@+2fxBI-rf-cT$8xY~JYQbMQ<> z{k)`bYm8M$>uVZ;V8<|!s_*g5g7YJgNo2fmBU-rtAL8<=X_tn>Pre*KKc21c%63%sE9M9I^7t}ZS$680@RVs6>Q6Y1 zu^MF3T5Ko{3EzGT+U$gi2*-BiGU-STOd%EclJwrtLAZV38??1PMllM;@C)|AmMoj3 z_P5ZoUa@zfry`Q0M6*lIfdL#O=vu*cX7ukNB%v0AyeqWkLbt6JIz3B6cSfwlU9jpL zc`XkhtS9(3nPW?$DMwxp_S$lUgj~l3X9qVbO-Btp$ow@IRpHb)@EA1Wjj$>(9b|e) z^_>|8uU|a;Zr3#cL$ZJQjXWasBUv)1e<2J!-@U0|%zGH<(oa4Wc*)g1f|HspTc>5^ z&z)y(DZhKz`bEtKPb$-+f;h&9npr&PZ dM;4`Q(vO2W47DiM7I5Z*T*jHOV{-3wIDc>1jukdj+n zP?-lm^%5~+*ljFiq@p&rdi^A_JY=hyr8X;_9m5y=IG3E(XW2*pdR z-dM_GD;mz;wy4c49f$hsvwLa7>_c#B0V=@q1XZ<&_;MtFgWfI zvm+*hb6#;gG;m#YDmwi4kujF^E$6~kQdAiDr$~9TCo1TP$RO>b9^2uz( z(_LuBM6~D(X=A0WBke5P`A>v8>f0G@3m^x zs+u)tEkE4dqhpHyzBWIj_!|lmX~Uv5hiq1XcQgbt-2MFR;r*c8+^M2&`z#5vAW@3$b0+1(9 zeYr8p%bX4)9KY&GpPYH2k|*k2OrLrxf8X%Vv0Z-%$l>!PCg?>6Ba#9MsTFzFt*h^Y+<9Iw#U)Q!JyCgCK%Z7ES1peEw1N*T+w^fQW-TO$f& zalJ19u)%H}wFc^2G)+ca?7=R?&`%(g7CF?Crw(~2Ua4;Br`2-rO!7EG|NA;5`^VoVrJ@FAQ$vhGm@A^#OA?Gunq#Hr zGr&2$T~Z3QxI!qu?;w6@h7D3S=t8T}-n8`JYlFHp!zudkKBqtq3VmA|J>fjufjCP& zQ)QzB9(KNcv*(2Y{e2C_6H;GresmU(fYruSL44>wieDu|FbAPqr*S!aNykH386>Qi zMll=%!dK+-UZe^Ls=lLd+`lF2;V6m=D7{loL^xgv!OYZNE*r#fS|IY~1s~2UGRAWo zBBZdm3ut9!$UXmjQmr8>etW&AaN=&qY_7KOrBb`&YE_NFDR19|KWG14&#L9$b=Qof zziTTZ^@q&K&lxk`heJP-@Fv)}KW(CIs2v$8nzf^4j7cm_SU(LEjI5xojeLWXyOPLc zT1Ht`l;krx=kc&O?`gCnJaiM6uv@Ngrsmj|nu`DnAq*dRPzG+d6U(^!&J7~6t9gUB z%U)4@`Gp`5AJ7pD5>%WNsduFLLw=;fKWT}itr~fQ_P|;4P}={&pZ!P zcdFYGcGaApKRQxLlg{N1n0>us^R2NvZTm5cLh*W)Qvuh$gY+| z9RrxX3mWa<{_uMXdpp)fh|er~2>0w0|4hSF*|gzk}r$;Onjz*6%#8 zPSI`NA?^ovHzCqzLA6da1hg<0*V0^iVYS=_#5%J5YY|l zSo)sZpMxw!u#Eh1f06SLV*B~gm5C)8=YkXO)tqvEAjD{_YP z9WHgkU8aQ#_sSnllHmt>O*?G~O=^aTWuucNqzBJ}Yt={z=|aqr1^E-&E`}Z#JzOe8 zh!_5Ce1pMy|1M-bu+e~J5thXeyWh%&2~m?DdUkM84$TBKvC-Uo*#G4Mpx63v?6}zv zXWO3+2*|V_*29;i;I#T7SB-%uk(hpHWE^Evk+h^}Llsd7#e1pWA1YVUG?JsJcp{ByL^d^KV7hJ!qjFV5_dBdJ_XhO#43 zj!1HeN4u6Bc!zk&unK1PfeDIHFw0;LN`Awp%rCR2H5P z^cs+Go&q3aiK4fpbXNQa_*b_l9C@bLng4iGkm_IMhkzQrSwzW1(POu3Q&1g=&P+l+ z`*A35p|#aZe30BDB**u4RuNw2am#5X&^ojo>MQ_a*_1PGaK%QR(H-M*!C3-xNK)oP z`tK^NToelF_02PrP)5VS2iLX{{uJE&`bN&)wTIh z>oa5_)D(N_BoxPWm-1FBl!i~12v(xD|1S8s8( zB#RS5?`9L2MEb>O@m=xKA z^tVgd+rW-(>bJ9oZJLqzYzyK><^OQ1$Ei~%VR z>$7p1|4;IF#ef!9f?L1{tm4!nuj!aw`RW`RqZ0Hc#3V+kq^b!!{a6r0pTGVV0505r z-aeZAg=56ybg~WqU=%yb6^N23!mrM$KIhZM@|XO^4=lgAf3yRKyF3K+u0;P-4O}(; z#ySn^?UvEK)@V@BTOgA$4Et3lqdoUiFs{L|JwQwBrDTUR7? z_%|MmjxJt9Npng8Upb2wP>i#3feES$;f|~JpO9rRg z_W;?jg(s}VpbifSdYjA_o53hJu`w>t&kt?=Jlb@@`JzG!)o>NR$CtS#J5-eyOw5wW z4xO3_#g)ks3%mkHdqR*BM|<7}gWfW8r0Tv9LOG$xT?OwasU0OeFS5UGe%5)esU2=1 zXj%6nb~z(qbXAc(!}z!0sG{_TB)yBawyWOxII`v5azudX@X7nbXO&_BJ{P(Y2B-V} z7N?5^qg}J#wa&Bibru8sa?G)=wNU0@{ZJoU)K5tTJ;>%hYx$qB|E4*nf3dbHl?S1z zsPIb2rDyiVlCNKu!oN~ceb{%&7)}z<(0u4oyv{Wt7LqlXl;1HN7fV%G4m66tJS9Osh& z=T3}DZiw2O6~RJeYv`=Me?z|W3H{0oO`X$ODZ9tky!rDL8Gj)jVK;rF!x7t~XU z8V8`ig`KRq5H4iG8S_b}4@-A-z#X(-qah|^4fm6;>v^6fic#jxcu;BL= zDx<+p)k##NI>=n7^|-o&g@uK*Q=$8DwkD#YqGWRISY{{fbi`isT{! zSlK3Y(D5kcG%FZ-VTC~);Er^5EW5?t!RC}EaUpZdE^w>UOxZ(GG4kNIPgseukxXdy zbt4f%F-c@!T{eWeV$ZKX zEQ+XIg_WN4_d|6>N(0{+pzaqhDchxy{mksqVnVZ!W@E(!K5C1D$VDkW_HREbOyptu zhIq={dIA~d6gf?VYGetkIj72lV_xvSLh^pR{KG5IK)iSF=x4XJVF=8k zGa38iScfMij!SaC_hlGGUX1>F%$a4*9>?7x4Yz^N1vRlGyQ_3FVOB!@gFef|%Snt2 zn{}>2Ce+ta2)Ew(I~cG|9d*}pITQA3Wd?7%5HCWg24v%tZFlM@S@}9${qLr)p*UuSODE~b5pIbub z;ZQnBo5@&SRy9^zygg+$TYQ2fu}j=UqZq_|1bw`EKWLaMal&UBhEq3<1p=PZj%E_{ z`u{~!)C>QDdcW)b4fRGQ{CXtneMw(?rwg(^QE>zZN&-Z`#pN2t=O zA(o8~vz+6v7 zy4dbm)o@TacW8sC2PMn6;m~Ur4Kq>qW+z?l2mxM^;F~#oE^ttDadf-87imcQ8LiHHOLP)4Ol!N4$}xZE3GR!u zDB?C#ZD=iF_Bik~2gzA0f8~QLIs9emcZEVH?!Mw*suhNW1aCz9HTcTXz970Ps*%ra z8ROFOXGDI!R5tbYyrPWJS4<$+812Rq&bFRnx)N{fgzCZ!& z+t`5EVE}j59sQV{=+mn5F9q=PNBX~TqSqL-wO(<}x#I*G#UF=1^Rcn-JXO#7|UGTkQQ9ttqmX+|-?2nLLb&6GM`MX6ZgFi2$(IvIkt zLBq1M+`KE-98#`5N0x*5DrZ^zM;G+%*=h{9#U_Tmy}j4NsFBb_AHX`RSA2J4gVgXc zS}V#8XZap=Acl_P@+SSI6D|SS;sv$c`mD_v(!ma;Rj7=OMQTpZgzLJTpqB&M-Aw3Q zc2rD%9-UjUfBKzC#FsE@vWnxV%y$@R;kX9e3W?O!*;^~M#wPtNEOv_rErUy2MNBvj zXZlnEd}1M5a>YvcQeAwpQ3A1F1wwqN;tM`VibNy6S*A?f#MAnzgmluh-yxHmVvB+p z!=&}#fz4=S=j1T6u<%~k@RK$;5rN}As>fe+?^k}%rbVcCI)sw|1rmG9GlGHZXoK~& z@0W2XL^I;`frvnrOUm^gx&yvDcp{A zZvk4BCSpW#m~ol$qH~4?Mrm${{frR8vTSc*I**cQy;@K*%*h8c04W*lqLQd6Ms#ur zIn_WNob{z)(r`@fZbSrDbXIQ+ahK=$h{Zb*7c3nA$j~wj?k%Hg%(CH}DB7 z!%}t>@JQ}XJMe_O5I;qKx&0Rbco_fhv*Gcete70GnE7MA1Rh58{xyQXM{GoeR( zBQuY@hzY)ncB#=j>MJf&-MVic3=B8=BIe;noAh3Bx=@vFYvIFr7fXSx^|vj5eD#Y@=ZZ-32_A?<;U|yH7PvUvTc*-Gi~;o0-^i zPiV8~>Y%h1+~p**M_)c@@Za677ApK-U>+T{=Kg7O(1&PgW_&Yth^a)^q-W8T!Q{r?ENtDb+nBO~lhINZNtfUmSP|85-5h+%UPf}c|;JYa| zrl-(n6d{cUQJ_C12PqIyY-I&!IGFV)VD`1g8_)CyRd451_YL?$By1PRo{A^CU?a^o zSZO{^Rpm$~PbWx~po-Fcs?GgmiC}VNLRkk>+71)nPDuP61#(?ZBzi-QKhkN=j)=*$ za4EdTpyPwFqPVU|Z1V*gb!UkA+RR#`J>c{MGCP@wR9|$T%N7fr9q)AQI4&g(?2wX( z7=C>++UMdUKp|Re*avkQx**B~FT9JNjh>rQB#`lVBGx0&&WW*Mils!tZWX^Sdusis zh)Aa6wL0gCm>Io{dua^gcOsb{HhW_D2nT-kO9>=T**gY2WS*HfjM>DX2{zUm3@1P78RYBr2IWlIz0^*N;p#@cldW8bX}rX`a7#*9=H^&~I=B|Jf4zKpec{mv0CUB6Vc8>r z5CQ0Qq6IWYH;QjoBIy7A9NQa{1%Wm6SqcjOkWe%hO8mn-qu6`NwG-A;gcFZZa-Nx* z$3j`+dv%iMEE2;-B;b~`3QA9nH@b=-Q~-z$5vl?aSo(umP3VrNfcC;#Zm*NgM+nIe zQzBqCp*sdAiMth0wzJ{#c7C~&|6FphAwy6ii~CNs^b5eAOm--O3c{ODDH=q*6%h|W zm+n;{EgUM;qoX|KnYMt6$P6(qE5J;#F*iO>K{7*Rnfc(liu+A==xmfiL=lP`MNF)4 zm;=tDn*W_Z60D+}VNh+_8wG_dI;|Y0Ixl&_c#1bRf3f^j;j^I9(f5S|KLmcLyFwja z1Gim{$w7Nz6Q$fB5>pSAps!G08~e8Wdl4wC;SxPUzJWf9B$pu|`H^uv`CDB-OznUQ ze;rGQPDc9FP~W-}*We!8tP&r{ZB$O8Zg+#)FP6MbwR_i3tp?-1zuMTdwfw{K3&Q$F z{|6H{52~+-sJ4rvvrzn=!O?l9*-VBGo4Kzti9nN6lA(h zGVYNpgA}A%Q)_P!e#B0Syd%9XN{@D&F;Nymep_O)3IOqwd3SylH0;?9-MZ;5Jg_G| zU+~U{tKWm}H2hfsH+3*n3G!k`=DwE3s!>*dIpBHUu9Sxj@%i{_Kx2Ky#^&?Y;t-41 zxiahZMwiKW?b)E-l+$ST25{@h#%Aw&*(9r$2{Yarq7*?J+?6#_e5l=55o4a6dGx~} zJfr&od)6?+bTSBYCdeL_{N*9vpQL=^C2GZ~!D|2K`MKn(drj|E;KSPW@;KFh%Kf0f z8$}J1;YE>wHqD~Vq@th)#n;R zZMg+$k(Ce2*q~xg%$4Q5N+(c~2sca!&)Fww(FwzMz&pbXA*YyHfFV;}QB2k;>v5&Z z+YTXb{)=R1$9b^Xc=3I_n@0?`{c=4Q<{DUAxKvkr)p-4dCa(wFqZ<(_WdJa25ALy~ zMvxu+_DU^9+)m>EWGIrm9@$RdI9Qb6hgko%Wjs@+xjnW=jv5Q2ACLRd>(Hmy%~(E! z1!1G`4#r?`+A@(#S%gcecRMFyoi~mzM>KRP@||_A>UV6U)&AP(|NHYG*r;+P8-aW`Y{(nC>Iz*VEH8NY$Z~5Juz{(}GkHMvCs*?U86> zM5+K-;;JN~OHsYGCR3-l(|ffSRn}Rb>LQ6EO^3+%cNE#*^KNUXiHikgv7?wLr2{`e zmMKA$5{7~4(U>1hH{wwaNrEUN!*CR*^GOvo$avV{Yw#naQHqcI-x6k*&OvT`CfykP zTz>Dl^cPgTWGQ)m$@SIE^cH{H#_hEwH-Pq5{jerwkPzpl_V6UIBz zjogHJjeql#N|JzNMLjBmzYycqL+#YLG^S{xVNDP@&OMaXh0mvR&n}5M-!7H?pXo-! z`+2<=FP@u=xxW3VbzJt^p;V534A1GO86jBC*#F7mUcuG=KmD56JYO7M%e9vUKmO|w zh4^tF2T*^34hfkRA<_c3M!)&4>Wyd(6Ea(046P5AGe7$qGN%VzgRJhiTgET*(rbK& zbCo|ItmT{B-`z#m{62DQ#k*3S0N|!}^94JXcG}F=NDwf_9PWBsT`JWGd_)3h&ad*8(X<2!{t`9wLp)$WS zF~oXZnU8Rv(2aW8eIUiy^}@Wdep`fB%A+PBI4Xr(PwCxf02?y>yyAZE7rdTdQ;;(l zA{43Ix@o!o=gocg1mlrz3a522@E;4L=;xg_WwK~o#Uv+IHh%ftcR=^P=XY3Q+)Ggm zUpGyBg>#)CU=ff3h_^6d_M*XH>4&AGdjhl1Whl-JD1&cAL{Wx4IrQOEi- z$9t1ZolB*UMLc&%cjIV2Gz(f_e5E1>!rUm(qw#))`Xw8ixN%{`q^R!YsF&+-^sTkhSz3bjD zx^3gF>5lrdi~3^j`Eb_nTMq?)DZZ15Sy7hr|NgdEtXqaWE#B@O6z@8u0cqDogTWq%bm8bQ}#G5 zW@eHW=91=S8s=seFK3b8D#i%z@}4?qDA<%=w{xC_UkoN2OZyw?_>Tp(cmj7On*sva zGkDW?o(_0vYV7ZxtlqJ^9*rby3!c?bkyV>}2Uf5w$8Mv3hMmw`yI*S)Vh+2rF~(Uu zU)5c`Yh5}QRPU6++Vh|FmANHZq=t(>OA(iDmiN5-czF7ty^^<@G#0Rv+K!!QtrlQ3 zk^PFfIQ9Be?>@h-)rsI>k|bkdVmQX5NtuYv@QXYRabMwK0lUr~i=$bFevv-jf?uIA z%Csda8J7aDOha{PXjZiz&sBkK^Ml;($r@*45bwsKixHuC%*N z9y_2}`s3>_WyDw2i`-{od=gNNhWYb^YtysPyJw|49xsr{59O=wBF&rDYB|&r_G7v9 zErh3nCkX5f(gLCuw^7$Se2UFeYx-qot4eB6g8LqO?BO2KJLyG<2&tpx|ojK>lz_he)fCJJAgp4|a^BaX`Vnfgf& z?whn&cyGHnZ-yRsc^1So`hJ*9@`Jhvc$PXzvXo}A4|IlUQVe8F4@2xl3EuwKb*u=9 z*vml@t15z0xj8;xg$##7~rTWprYPi}l|8l^$k5nsBZ)-EGy$nSFA;-$USNxvZX&0=0S4t7{V5 zr@*CV1-T_Qx{^s=7r&7-*{n8luUwRz<41=qxs2n>&-?A&$88pPzX);w2lxzw${>=e z{*J+;l^=Idd-S$zNISwtuxk|RK5^rL`0R`5o#)n9IR3e#3YlO1gW6%hP>44%o+3PIL{p*@WO=45LDrS6^0tHGRQEHdcHMa+Ih|vz0Le;ivI}& zWMHi$V}_t9sw0c5IrMut*N!$3dXPXe92<%`-Y>Ra!>z8&$L;h2P8i5oYz~Agx5 zXK$LsYgv5Z@zv0j`?0A|y1(#4;&1`39S!3nj!Q4_5t>3dDCWj?-{#5K?voYn|&=kjLqho1T5E`wQYm0P@Ql`Iu*6_jf;Et79yGSd*56(bZ+ zlP9aJAFsb~`8$^#T+*M7d66p`b(U{e9DqQ9_j(V{!*4p*nQ#3aZ%sMR(!$ZG5~1Ur z=Z=B2z9c>cJPuc@PrG63PwRrl`4))3`?=_wXMnEsORjP7D*2PUfk&Vv=ETt(!BV4k zoX2t*=KVP9LA5%gx$F6U-p5wYDnv-m24l_s8xo|2sqECS%Aq4xpDIh!-f?deiS>zR z5HEW*v(WV*D_4h4&Qe+P^$rQ>?N$POn5|mMATjt327dk^GTc)9g!0FpZ4>?9GwSAI#+eD%LBhQy|!2D!$mypl+ zbbt>#xTc!1F7E@Am0v6FmCn#}x(g#;ZIlxH z0wx1w%apz*D|c!LE#3jHuL-{*FefCZDPtt@SjZOX^-t$_Ra5$4n0V@u3nJ9T0u;|Q&MJQJF6{mS8^UuC60aJ(Wz7IGNJM=Sok~SE}iYH*@tlRg~qj%yyY}n41tzPqNc|qNFMlzHtWWi>*|pMKw#-H=8vy z%hcS09%X8ns(C+>X>Q76YE?bs@IPjF-xU~@?)ag9zYCAF&jY<41}@FB8U6NpK^)q9 zUI)Fz;m#k|)H6{`yJMQzIx!39(aepLl%0EC4OtZ^G;|%U2m1DTQVAXwFj{#l^Z6*H zx*H(vv>55o&pYTcF$oH89T;>sUcq2gD|DU`^PVcd89m%f2a-OeKVt&K;0fhSsO*8?xkMHowI<$~-ofyG+bD zYPeAP|7(1CJrzxB`;~YzOa09tldR`BL}J3YJ8vLaft`{k*_o!%Qx^Yqs$Hi`JL{3{ zs4$B#w*h};cdQ+$t%X3#QckDPulM z#Vi9><|UAviLVZBQ%%0{FUD3?N~M%9Eaj}qa=NR? z(3|&r)KEvyfcK*7=m=V+&x?U62rU8Jy|fS2^oTQFDa>4_hipX}<5kuYm03D7QA(W4 zIfx%MHjduLkPMNEG{>tB&DXCRJbglD{e;J-tOw_j^M(}OP3X@jE}4B}kfz?;3%5Or zx>J_6PY*e@V z2Gy%Bs{aj2j6$YSu+VtZ6ALd3NJPQGL3N}NWfkBlfLt!oAdI_!0`1V^;P!nrF$vcg}An`pI>3kCt=Pwost>p+z<6U#@V}UVA%`b zu{h~ny~$$==ig9VfA;EL(955^9gz<7(@vrxrh}OD=hB>b$kqh?Xk_lw6dE;ueGlr6 zHI82GAXx37d;soGhPR8j5?vAB)yPuYYQH+WhKhWFH_V?m&mPNr2(+*R-i%IX0Oub3 z#|$q0GsT_)CN0Ss(hol+j9a2}&K$UfA6ptls0xc`b$BLRpRF=sIy|QVCIzI0o+blL z-^=H=^mH_I|Hiq(gHxdC+QDHXxqeWz9tJ;J$Y+o6XZx__2m-Ix$A=B3hpr|^x#MBOcXGPkP-lfT0M93>VTF9Ap}_N& zotVhC7`G#4zudXL-mGF$Nw;=qxhfgv=(|*dhUjwUD>}Px7j2Zb!d-LoNS+2K z`o=6-rX+JNN#2HYo;+SRh^;ey@)UgiV1?lR+C_69Y5g_boI$G_}||_!)>VtSKSzPR=8DlSKWqJa6M!MX)RK} z1+Tr~4?Z6XYYJ%InF^SHwR36) z3!&}IHo6%zF3^^L0Ll47_kyW0^0;;>-ehB-kbJhM>9_gy?8$LUtC@99@ht90lF>_{ zJMYX54z+C0s{FQ@r{&Sxv=%k{i93)F&B0DJFgk|(Dtx+IRxDO;z6BfB@rFqZHYygbv2RY&RPORq?~b3aX<76*i{u; zO`MHGTM_i>jca>{gdKQ%DO*F>1n9D}s*bM-d_d9-)cC_`?*Nd{%3e%<<;b^@h>&gMtcX~5G-x1VR)$O;Y;J4fPZ&$HN_qO zC48U#278blFUoy9Evl}}kw_{mqlFBd3;J)7lz=V+PnLVb7??a)naj^#l&Y4OoRU3B zIQPZ7O7(CI=`3>un>N#ee*BXTwIZlv0FfG4oe!qaxwB_6yaTL}#%lp2Fd95tFB~Kb zNV^p3D~UL|UKmkgZLI-DOPNau{+XED5m@H0Vg>zXT*rEjg`L%Sj7IIVBn$9H0)@p| zuXEeQi_r`}ehu)ZVe0N|E^GbRR z^rlJ7c0%g7Wsk|(h9VqIl-dLC`S)Vd1c!*2lTrOPQvt6axc>Hyq<4#N8DqaO=HH(A zhW&5CEk$~PP1N0v{~&_%Z|6H>%Nk!WVJh| zsfo+GPCsqD(c~&WcREglF_gXDzR?c_zOBzqy)O;8yD3Mp$|HDB=b%COrQjJ_7XfzC@j&xeS6la-Rw0$+Vi z-lRaO21Mmd2jEOucHeZML__baU0KzW0vDfdFIG>Elt%FFnw|I2ss~l0^>#Iosr)>E zL>~+Nr|h}7aO%X+tL>*1m`fwc3&h+NWj@NMiOOlvtu3{@*wI$FiBY2pMw!AFF0`%~ z_(nxuEb_li4H900QbiUVDf|r6t2rd42(kKomfdoOJ!Dp(kg1U3F`bmMW}h(`Ytf%h zU7~B`(ar){;!+UnS?nY3?&0a?_7jP@ll1%d?^n6!e$uKwG&Ti9ye<-8hBz7MXOU!# z*)%|QRrET04Ry~m=G^;Hg4L7%AEZjEDd>N8gpuBO&2X3_`u`% zjx$ZXz}*|Rvn4%xUbo+OhYtYp_rP|Ac2B!xXQZ0+Ir$p=8wGmEsfHU0-uorChoe-S zu{hLioHbHY@Xuj6J3X(T`rYBHRVZP=DHZR`nhY z@V1E1=LR;j_CgBJcL2pi(PrfYF}2#4=aERaS>k=yYZ2k<+(*pn*NE7TD=As!GWGS( zcD(Z_Qc?T=L|Lim-zXtsg6i4Q;^tyn_59B=(#8a@me@ev0b^M6F{#$&%Hqc>6~*U3 za~IaevF(VT-}Gi@>I~ik&jwN(i9Bz($1IK~^OLG#x{Cc@L2 zdIY0#d&=-6f=4GLbQt~r8IgajN~E9~p|hoWb%ER8X8Eg}*VAPOtZV7~jSp+JFyxkl7wliF z2At0R=L_IpzZpS&+VV866cND#5eL?Kmo@Uln@z_9h``pU4q0LZr9T?b5rB6oA-0l} zhIuzqb!Q7$>45@m;u8AZgNaB{)(>a+ zS>x*eeZRl3CvZGa;D8`-vB5sr+~ElHkbxSxG-Y@1kU}QNfpBj5f%gmg|2*VBU+NeA z6JU=C!K65!7=E5WUGkKXlJ~NlPLeGhkkw0SOir3QNlv%7XPU96~C+Zo0 zspuJXG8w;4L~f2TO|6}So10UngSI^3X$h=mSh4>1TN%Skd|3}?LWDFQ(|i3ZQuZO2LuvLAlS3K2MWEG?$sD(!%60`ojfAauPAXbZiT(f(Cj_zWp;-9* zfwcZ#1{@qg?R4OT12qz{CK?<0KL^Un0xA_ePIKUYV{xwiw)x&#wu~}Yi2$-Bxt=mr zA(MZp$*zS4aLuOjs6!` z{~SG$P|RKH+iBE0na!IJ-R^0cQl#cD{CkOvAb!RFvB#Zpy^JLm8nJ4d|8$oQ4%m0UMLO`L2 zZgjby4o)1ZEk~&Lc7QhoJj)+BhbVOpv0?vnAPBb%0_(}mFz+J zU06+4mfF7Vd)P3S^4XjAG1CU z-fM=FURgRC2l9=?G!NuqR>vn)DU8azKJ7M7SrFgT-&{~siI-Vss zsDO?K+m!iGJkizV5XrtjADLyIcWGU&<{Qk`HUG^rbN79bjJlzmg8y)HS5?=KX3I(9 z#b*2L9T#5E1zlMVxmuYLXAP0=HrltrH@C@~oMP?|$U7v^=-+Pr+&6k4AHWhOKu5tK=ZFG@6X$4|eCrFR==lnACAFBd+ThuhA1hho+AM6{E=E^{D}=5 zFm{#2SsCO6$PiYe3tE`jR}YeW8I3#1i{1NWdz#RHEY;9*W90k&CE=dv^&hv2oAU<= zUa*3vg|iea66An3mtt2bB^m}0$(AG~$t_7y0zy!i=kgH}!}c;i442cZzPTD49*&QM zIWxVSfMAp1X{FtcP4J!<>P)Xr8YV};l$eo;z-9XuJXUk-r)O}3^I@8NM&GgBbfb^p zGu-i~eKf1}=?J(TI860@4oh5KANKDEl%a@eY1kiNJ&mU@`X#u&OLaW={n#@nTH^YqNZ9&Du|W52M&od;61B0h z@uz1uC|4!X`>R;fekJ%+>rsZ9PF3uK?=5RK{T+>iq-c@rba+^$hfS)>BJ*y~Rjhur z(W%b&+0mm$ewPFF784n);@z(|HR)Z}!N)c!xh2ehN9fSOw2%w67~mj=ppT%!-$-iZ zJL_%Br>ZJAVaoUOv}wE&B$@!pVM*$#|5jg}8a=@Tysup(oiIfPh$ujnG z&!c2ZxAC0E4_F)-J-uuz?237#z*T`#@_NU>r)BEx%=Py~e3Yod&rX{Ue_oj_GZu`c z51O@2H#=>LCCAlg-GZm%=X8lYQe+yYnGJPIS$;q}>2v2!l6>q}tEb!3dXH0G*D4FE z8Rp~R4BhdMu_vrI8=l=Vci_dwt+V*MEJX3#YHnVFrE;f2qtfi=Xtp#vTC^K1JmQDhngH{91RK3ZtHj}H`N}}3rfdE#y1k!?6!q@Mn%+;REl5rdz?a*AOo+>d z$Gcn`#;OuvxqrU@Z6>2mJ-{j8_nkx5fc|7A{nRX%z05m9X-x{B1c&`Fm+WC`8oDS+}2&|k+1ZBEWy@Y|)4`p)dN%vR3V z7mwCpvE8)nj%xpb9Zlu^)7kI&AUIUw6lr4beq8tMIBxt)z&b~G2jYjONh~dW9BG=y?{YRq)8_PFNn&u7JjZ$o}g|H0y;xVm%`3%jfDGO3P-JLTNYAK1} zb;^S&2@V)oKOPj>wH`ybuo_ULWiMs^pT5339_#M^KW;=cDA_4HdyfzjvU1sbWrQna zldOcY3YR_0-kD`y+1c5f5VH4Pzw^Fy-=Dg_-M=0^9`(n?b>8Q^&g=DjJ)h5W-T_H= z3|`OH1yAeD1;iA~Ffo=BL_Dg0h#<{hW4cwDF}YQJyRXcCa4QSjdEmLdkC zFD{>(ztVaAQJA56!{oDs&4$XF&CO!-p6?6U`H~EJ`d0m&F(ni}nyO>w(M?HJg;1UXrdil~{p*=@N zmo!?LTlXPKq@p}lo$QA3U(87{yCyZeYV~8J24Q5M>z}QQPd&Z(jhTnNfYgJARoy#? zBvrY0nDX^NkdhRc!BEN0e=iKEag5RSTHw8FPD*hI>gGyMB`z7Q2uqBx*Dp;Yw+iJf zBxMHLNzi7J6TfT=pkiy~ z`B=(0>?9G?zS?_aV|_u$$`$I?rAd zK?}R=p8oz8i&*}>F&RumEUzVJ^eNV}DzjPT_N}x>eA~y}16NmIlo(m-A|m1wV878r z#jE*icJ$5G@U?!s6jNQ?Qi~3C_cC5W(#$KPL|KQ^2hq>Aae3U_+oCwO(TJIRmn-?M zAvd`s5`pGsyHYmS;z#LjR;U<}unLuEchZ!FN@oU7(G}4@7^1iM5xK5c9Ip25QRLphQ30IzCvD*sW1|t3%TPfoa5Ll2 z&2OaiBcN0qdEI((?h@~SM#+xUltcTBh`6piRF%eHPJz=XOl44vN|8q10GV}m;UP$< z6YSeWq*|S`J-Z)9`HwO#tfz!EpttC-GF54c0hoKzXZ!4!N?VrIBH{s|TR1OE#U6;* z>o~;6a;}C$14p6EVm8TajlI)W70bLNd{#QheeRy&s|rGfH`GJ?hIc`s+PwpRY6H#2x^{X`!kC4TKT_5(#mps3vl%jM}5Pi+u(gGtMwU1~voJr8}=3K^X?~dubq|0KTI*k5#XTe_h9?Dvhi@4sFUEcrJs~O{W^>VD zOzJgK1+O-}cFjuNwR)o=>MtC}zBHMGUOt-~WpLN0Q>yWK0+`yAIQThwGCxt4qg;gV z={UF?AKqwJW&SP{Zc6J$>L(QO6FDDT<+uNYi#EgH7^u}C^1Qx&OtPTJhq+1(gz%-) z?3bS(JlCUTRmX8TKv1(2oII$!q@RrdzxB?2x?)7modP5qJwTnjE&2-VS#S)ID(|T5Fj|Fh*0|CLs8_s?Fvz|(NX6QQ}4!wM? zINh76JQD-YyB(XGALqG|{N`@xfSzkR_OsUTK3)4=q)nOGeYm;N6PIIM)v2@d?9e}RZazyJ{N(9a40dUvyjW3qO9(!AMUu5>#K~06<~?bIc$*SIH93e>wL|@g zNYl(-Tb5GGU8Z!m?_cm;e!TN*WB=P_FuPlWfiR@%U=LAtgEjg?rM`kf(D6$ETeX?o zryuVFj9U=5>8Sh1t6WVQ{0T98RD^P(8JM=yz3$5_IUZld-b5yCd+)!9a97md$S-kE z;$7Hp*-aH(`6T|3fAVGFx$}3V`b8|6w{QXx6X66mH+ijvpL4*a= z@W}P)rdTqwElE;K?|9i`j!${PmnMwEp>9@^38I6s8De_`El5sbFY3o)dfxb!XK5XP zIeoXHwn-_Xl&Jo?l?S;RSbssP1uBj8Ry-3?B^#hLw$BOXV57QXNncS~fLfyQVZm+H zDnb^So}BYEpv!!uiKFa3@^Cl}@zFdh(_XiEW=pCA8!#oyZ|~nTu8AW_L(ZpN{!T{1 zz%=gfyYvY@!0G~aW6-kQY+DGJrB7xQ)duOKcJ56Iz!DX~s;i|^D~Q(!${WqdN9)xA z4?y#}lOWBy-n+k$i_b19Qg#RDCu7WSPwJlL5d#2DNcc1(gKzM~P$6sO+P!E&Co8cZ zK&`l?_%6hhnAuY6(qh?MLYT1Y4qjAh;fd2DdoBK`Q_M^i#)I`Y>wlFfcB)sKF)%Q) zjm7i8`@evbz0`)9j8b#Kyp35>-K#Py9JeE@?;b7{ZOo@9l6D!- zm-L84+UioYQx1sGhIn$u+L`FUhq39lDWQ(GsIg};ax~`lgILoyDq<4mjor30WwPx# zDQ`UFq@?^R*J^RoR6d!~k#d>J8GecvbZRLyX-(lCF)2yqvj_~EXQTmL%|%l!SJ#T$ zO-qjzRc*e9Dcm(LH1i2xyOGmru(|Pk8AoNxqYgi#&u&!o(TeR{@lTyyydeakmRE(u z8wjLcb_&NbUN4#)?mD=U-hYxd&^FT=8DJXS<+zypu?6(KN*L0Z2yb03rg`Ow?**66 zm={>W=f5uBHA?t&xC8g2Ng@~F{c8$~8rFPRDD%i7eCyUqzd?thxZU(xT}^}(xfT1p z_QU72Cl7S;Ty~M;YP{VbmFA5*R#q=%mVizvJO8+e^sLH>pa`{oh`X>J@c1ClNz#N^ zf0+72I<-dvU8c2^#!yKCixXB(WyMM_hGz1V#28{Z;Oxhs^}nqkwEi-BJ|*m7D1=F$ zm`WkP%V_YHl)wjCMy!!6hO}^p8zP5qJ94L}2xS1iAth7!l!-2LG09wd706QB-SfqA z2|}7jcwRAG4rXD5i_O65~CFL7j{< zbrSiw8_9eZBh-vqrhr}YhSHBx?Oq(e4lN=kUm+EmQ@(xRtwNktG5t|A^{j7o~db(&nirAIK+M!ze!rAMLHmCsZ~^yF-c`Ig$W1HRjb-@ zJ@EZ{02K$Lk{;bB^biPE?oTn8fcj5Po2mNu?u^{73z_N06V+~opyve4%Qqz@#t0R~ z7}M?SlzAOS-(CT3<+Ki)K2`N*fw{Pz)u$}*>>10)ZBd5x5@PsIY3;fmf5)kxaVjtD z6geGzb*nG^p%8dKSpZ99d(CcUG}mL&L`F+@7fixsi!?F9y>2l4Yp1w*R9T)%hw66K z8%QDIFNwkA0#uiUx88EdcLs#f$!F;gYN*|WF(H{G?!NUT5P@6G1=dZByRHg%c??76 zA)|RMhdti{fc5dT;Lcecj{?LmGkVMHS_%V{0C<`b2BsOOHb4T{{&8`AKSdcE=w27 ztUl|UKa(2?$hnK`Z#o5$3VV`RAQL!Xqz~k{Fs^hln=>Z#ZqyqNk@74Kfu>!ery1^8 z4f^TwjJA(#Lds#t!?D%tCVstTq0Po(ahbJL?P{8NL!~T?4|c+jPUV4NnlJmW+SD6}o!HyrYuo@%X}fq?G| zH9Q)SsbdDTr`J9Pk@5K_#1^ZDl0+_AY#vZDopp^rn+%zt3G-MH*KcI%Ljij@_o0|) zIT40S;!bUe&q$N!kyK?J@JMV+P1*Jp&3>r?za3P?i`DeWnNs8@Qb$(YF2ryj6li&e z;vZwrqs_n^4T*zwcWczl&6^(#OTSLmWKg~>JsdGuO3N5t%pyB_1vH8Q`f6^efOzJ^ z?Z25s?i-X@cdHyUfiO7<{o(5MAnPxHLbT=-!irr%ULZW4jl9~8RP9Yh=OUD}pv#Wb zd)92<6DZD@x8+8^mv)p_u|hzYcd@_tn zlF=Ju-uS_D`_I-YKt~!QmpRNWJ3m@x7liyV=5AfRpN79`fqQ}0dq$F{BBff7+ch=JM&}L^J1*%Of9S?Ltj`dN<#fT7bg&L%s>d(LMAy(XykH zjQ7b~)oius0w(<1eRB^3S+l3sDsE1CVIYRji@@*dgN^cn@9PiON^PsM)QLlBVUNtu zqn%#?E4lyt4dEFpX@W{e7>LVkdRBCmK%QWVjnd4`=YMzraC+_(yo&_ zbcn_I*@H`;^)TkfRXm1BGI7}u_>PR08-4~6QWDBR%Az802MN!~6N# z`RDlv{d64qRBcCXnl6@dC%o|z72c0G#qDLIRoS|}l?Z^L2Ax8JPDF5oS$|+yh0`jl zP=5YJ79x*>`Sd1H#O>rO#962NBt2V~6x%s9A8L&E_nRKw(rDDS1QVL-b&>GEqAc5> zhjTp!jd|kI?g>kdk6WPfOj-T*GBf`=~EvXo*pAkIx}4V*D~_Tl*;;~RyA)9QcS&-3qswoVIg$6 zWjJ^rCo+j2x@ov&svHSkk=_;%mUMe~JnnIko6kj!j~H#+PifM4Eeh<`h2&>Byc9^4 zuXm$#g(gNZur@1X)ZZkk%2?R%lCgR)rG9a6usGPD`DiBqr2)06V79lP;LfsM}!9y)ymHk2Dh>u>n^k*f{)AQEac)8=I-9c~Zt?)IgiDAP=O?IhiC+`0km8bzfD!;U=^P#s) zdMe$KbUnOoK2fM@RXy(;LhP>5NS@_ss{@xjU~~i!D?;Az${&A|m!iTquk(o_h61=dCNW?nJ&h;P>ZOmnxm?DY%>U>*rI+ zU?3{r|5>fP3G;w*H$JR?;=~Xim6QH0r;6I4hE3ho3#89IuFmS49_x`Fmc+fuuWU2W zTiQn)p+&0POb@`Ot&BZ1>0J1~s|-Dgg#`2ra-wA}+I}1^Cr^SVy8iq@Kq^e$gr0;~ zzXzAWVSStVJy?#7t_HS%*ehiyshm7m{kqY=2l_LnZa%_EVn>^)3y363*qw0Y()o`k zKj&pg<>|>u^(E=m#$}H+!Hud_R)7B5FZNQR0-QP|f7Yzep^M-8U}0Gy@Vv2@x4=@C zxi$3uJ(_o?TtNHo_w}@8ND;XHA8Xi!1F79XdVC}dtA{6-zaQ@oNYE=b;D;#)OC)F= zDX5YQ9Qgrw;hq-wlZyLy9C=Mron^Jj7tQ>?M8~iHB|cNN)5ycoTMCS{XToP>{al!` z$Sy%elmEhhjIHG68HrOeh%@`|Z~eKSMLke*`KP`hPumo}-LLQJz&#EpUQeth82Kjb ztB!^)pN>6H(Cpd+#9{4y`akX$H0=6&sC>|(QR*xGAM0`xQsvo$fGYqdL+`H zKLdPC18%A`(JYBYME@(ERYXzQq3VCxL4}(vV$@!vcU4*yFR zcg76bP!2;c7<&Ec)8F%0(l{z6b5lXa@Yu3Gz3g(l&6hIX;&`491I?rg+56!#2pG|6 z{6V06GwWAZQq{2`k8GoP;A#?XenmYIEZW9^9rL+$=IDIB{`6su#;?%`V#)VDN_d-j z3$tSfljfx;<+(SOF=Bfi@3%q`cn-yt%*Sep?ypfRe97vAfA2iqnrQxHVf8sAlopCU0KONt%_g6nYy0{BVaQ^iVUg_+jrR5<1i zma^#T>e>R`u?6tSQWkd_QH{VqLs$T;_uoFBqVD}79(SpqN%qwhWOfHGXzQASl7C&_ zuQ{j?A?^+G+^AkX6&?5R&{aL;u^uOP`Iat{w=nqWGU>mvR-h|aG$l0P_$wM^wy94> zKNV2HS%2a})P&Y}pPvblx^WxN1!(Ba()97%amx2^WOFmkE`OY0rB85v^xcO4x23*f zcIkf#3?cdoa(8z2Tpc57qy}Fwz_|V1?&$igdIbsbI`=#o_zf=KJ*xM1`E@%N4 zVm<@%;TC8P*m+Bfi(i>W%h7Pl+Ss(t*mAmT828Wz&z9#I7iktSw;lylERU8cgIG{w zpY9M`MNGdDxocGv1wH9MVSVM*Ye=v#okgAdsp@1o=*n8%RINP%_y3s4#nyvsD}Z$d zac;e0fj9WS$2$fHQHNwKZD8!F!A4?DlcY{`xwn64$UFfMkDV6+x1y$l1@jF2ZhUmvG~L8Z>3DZfLfAcN z9}z!p=)SjR$khnBO6KD1f>V0tYoo**#k9QxCaPRNnq^XsDUadKBpW>$D_8B$)uxXj z>9MvbS}8-$e&bi%=@ognd9EtGwS16cv6ZP z0EGuJ$Op!sok`a#T8s+oSNY%lnmv;WPzLfdlN}{6Xpw#1f|lqWHX`DsqFDTeeHBmj z;SS+lowB9E)&moz=cmWJGhRaF%N zb$JNsfpi%rf?1R{B_t%gz%J|#Vxw4v90pX~ec9@}WK*@cY~1%g>z`~yn)o4sp3%NJ zEHh*g(WY5sDn0+antwaqX?&h9?E)EcJJ*_oBdb)&k&(0N@@&HHi0>?mX-j?(^zW6o&2l6?D0F`}#8VnvVL4@V|=Ntk4Z4wl|`q-&B9v1l3h z;~S@&B7mgXN^PD9K$^u)vC1{l#t*%IzO}JNzZG7u$y=cIUq_o+`(Szvs@jS;SCE^W zFsx}WMG~yTtH@0&8G3g5R>ypzT$TVweYP_}PeYpBF5HxyI!v`KwhhFVXdMAD z!#P2Zljq9)`@pKhs1=Jvyjr>WkOVN^$S1Fc6^m3XhRj)}k9J0^i72w0%t;oN@RLl{ zw;JBwsqQ!g_VIN6G+B=i-`0mkn5W4x2WL;`K7NA#jcRt9La>w=xauO}K#I2+FW3Y`LpQ8rxaE3n|f>#Dp@dC+D0 zVC61oGoShc@zt=%&|6vtdvL)wem1~p!88E8kZH7#OQC>DtBc6~_b`b%=-Oer&B+)Z zIE{wmK~{Di=ae*ZdALM20f?)$6I$giE2Cw{fb0?TdCoZ8%Nzja>1vY=7I&43r$E#z zrB+jTf1Q^Wa4rCw$}Lb?x&5HJ#ZZyj;RI?_bWUW9%Q{eMxLznC_n*JVW+*YG zu)+p#h1&?LHA5ft=aSzvEU{z=?JY*i?9!RFOLGje+1j=!GaMCUWu?Qx-5jZTvRrn6 zTW=WvW+F7qLhpU%&fhUjofHa8d5^grmWUI;f+=H3?j{rCpeEZN`wEhYEs4f`u1q?W zLvzY0PUE*y9fc~@YOjD{^f(`wT&bjwBU{b&KwrdRP1XaxC;6qQ`8mhNKoZ*-V7SWF zlL%$Z*^KqaS3S4etE>>6LJlr0KLj>E_$d@1Q-r%90 z455}Xp6^cevEgxje*q7uV#f0;D-po4re10_ru9KKaiDM*6d#s~>{Rp?g9v$H(Pg*q zAyOBbvfi!(w*srN2rG-ra%4sx7~syB!+IuHY+|L@qbJcP?y42( zjKzJNGBu8XQ)z`ryq02kL@T@E5`#-wf!wdr(@XJ>V{Oq2&H;LGGb)hF4saP>Pe{CJ zCP2d9hoQ^jXmqKm1`Stgcg8US}KGYpA_wIhYh_hk=NZFB%qBom>Eza+Oq6#8ohkC|k@Np2 zt23Z!U?A!`6Y-%0sB#bBZx^ufDr739>Y>TV4kW7jHEdwksL6N&*uklAPTjefe%^;K?LI6HB(X+c#P9W}mxeR)1b(J_F>=L(nDhWeL$~HLs za^Z!12|URN*h1XTaev9vLNh5-nhjsc?8vXxAj~@;kve}zttigob?W5kYR%GjmtWUj zG)V|rd?3R%t`@f^ju9cf1yD^3-et5YCvhSe0kWc@ehTRCo$ye_-=13*rMfu+8_7&w zcr^U@{0L2$4NaJ|ETf4mWBm1|j>k#N)JfL{!sABNYY)2`S{vkPzE`_eYZ6lcq!8Nz zW%C|T70*@JOiOB(*_s%(GrIS5x79rHiP2pvU(Dk&iQ)Mxg}0qOXXw^3a(gs4HIAwI zJu#Msth2{@1Ci-Yl>Ga&3)TB=DR zyf%I!&T(?>7%$G21gs(WO*L6`bF8m`^p0$o$)xQoDdxNQYfirM3MgI>*x#6JXl=g- zL1t&7`XwkE$GimybPp3zzZ$dV(-8XWtbDzRiiQZlcg&}oG`now0ES|%030pizTd1sd+#McTD z={dh^ix>R3_R&;H1%DD)IklXZe95e?5Ryf}Z5}5D5_k$f{pJZ>`{`rCpxmyPsZ)~q zbR9C}YMDlP79wOzT(cY<92`jS(@tVR(HOF`JQxK6zRGuTvDlc|hWdNIJ-;W0TJHAU zp7yAIx>C#N*rH+rIsK(G+M^JSk2vhsIj^*vqDOfJ7|`@hnKV)T`r|M@)bs^H&W(rz z^cH(M7IW$(Ie#PihC%|#D$eXWu#{R%*|@xCzjxi^uH&|R~UkU7#ka-+kE^%t~76Tqm_*hz0n{I<`HiQ z(h!hrrgUEmaUK4qr>dDjZ$T~b+5>7%?d{Wm#3b@MYOz~&4}fm;5_kyXSR1bUGPZCL4G zgwtWUzGHExoVpI*tuh@o718}4;FN~)t~t(4P9WCCLWcsl$-HcVDVZnh+Y0asaST0B zaoz(^x)nIF8EdB=XOM$aIkuV{b$BqFN#Mf5TIzlPXuOxEcD>z$;iX9$HmwmXg^wEi z-Ti=7D_W9UdpW`VXuXMU@iDDDW_iqv%EaZbzdROb;17OsMcW1H8fa+Pfp`CYGOMjB zNllJlDHRK`q|iOxC<<%_c!BIKyC;L62aA9j` zr;wtmu`k%4Ii`0iLC2I*Qd07H?&~}8LgQuv0Nu?Pioi?4nqOez%0X<9Lm;(OFyv?s z;N*zl67>m-)OFNMI?_4S)3Vhny0bEYoDkB~QgUT?l_fcN(e8DF^2yy2!z82avTjaM zZvi+=G*goicsJMG4+*dFs1>DK)Ir_=_&^>-8~JVZ1-Gx>Kh9PON)OOP1Tvf%bENEX zi6N->*%LI`uko%cP`j&-yS+f65942F?CT)P5te%eJ{8A~m!%I?B^j${MW2^R+`kUc7Zq^{iJGE`_H zK~({@S+gDS@OqzA`PS|yb{YnO^9PbiS}gWaOXb}U9wvGrx- z1^#roXeuI|r(SW-7Bamr#kS7K-QEC(?4FO@;*T<`Hs?Btj_3GWX8RLUEy0;zx~pbiBgFXp zF8w{ns800rD*|Wh_}wytzghhSw*)Qr#|N*5Tfadcl%xiAjMEIXWxDH3$vScodt+uo zt{+VQR|LIGQ8aQXpoBPF#l=LU9q(fz9x~pR9=YE7P=zKbj=kfmomp^;5?X4AGIajR z4?5#wW{hqaeM$9x`XdpAy##XmXhyREJU>8yRn%@117s|0#eXLwmoZJ9jJs&v?Dpl{ znYQqv6=ho2YsR^*DNVQYy@GQc75Z2SKUpYyz(l^fnEm!xpmTEmR`WPe%xS`X`7H)w zy2*3_Zm0pd)RSHV91CA+r*R+n_o=*B;2av*Nx2ZdXx=9KC_@+D5xM@*Kg?DLEp-Nm ziltTUVhRm`-Yp1@F3zT;51_=po2bGgf0Oy#NH6YVo8JZk!uclT-KDL>hfT?$W;7U7 zzYwF=FaP@7LOjYLq6IlbdSbi^X~V8dal!7~mcDb_W&>SDU8jIWkS(qa69b`Vz9I%L z_PHP<Xy_k;Dx5Sf{lm4PHitpRneK2YoVN)A`Weu7FMP7O_G|tC+2+?J z^kz$vGwBZP+8BGNL@sFFg6@JYBMWk4=u`QV<~T{CZDggV?P4&rkvbB)kdRsu)qC2t zM-+i|F31Wx*2vbG6u#K27>J9D=*0h8_MhA(tmzC)0bO-gen-|hoy#0}yn#8+Qkz-3 zFZ2<5kvll~HLKG+yMf+v|K7^sW4>ss26Pz(7n0}9KxO^UV~PGhtFA>8`=50f18!8c zZTt%?;dr58kE8kTr|(>V(<#D)40pT3L0>e}1HRMz!c&RBc0w51c`^{P|24P&EDdJ& z(8DndZcmQABa-yVS}IfCV1%X2 z2@SzPq<*9zG&62S|FHsHpsqsZq^?Qa9D?7M{^$4r+lRUUf)qTa>j5}h87eI}WlRnb zmtg5&X*|)x@-(5hi*$jWN;J3fV!1?$hH{MU@}7+M8z$(p&yg2}b`y*vR)bx<|KrqO z(yg<@*}}g`DqK~!1Pr+UG(#Xd7eY`e>=>FzU9eZc_6aaeY|DTbdj$W_)JbK-|2i^hn+3bH+;J3WfOM>E4 zdhkIiD~P?jbcH@1Vc!^192Suh_7)L-t+n(%Ap%F>8>+B1Rxaci5ENO|QQ%hmv ziqOyv{woF^pmr&gO?kiX82xz`MB`Cfs`dp4_sL{F&EnLL+FvUlv)ykVmw|Iv=f5X5VdXg_gys*Sc<&>dtxrku4IN;V^*FNDtM* z{GVI^6)kXz7j^R@WMhN(?@|2TYyFazh;N|!N-nA-@`U4zX9!@koidx1ZVFN9#;3Oo zu+$9wpdw_R>8qrp9^f<=D5_MXV4;j=qRIvNSuU8rP~mr4BT<;>yh#>5@;|9se2G6sFaj&_i<2OQAQ zc-CV_c5dlY}U!NtT#PNRc|(B$X>CpJTJXu8NB*X9|uOiY1TmTSbkJv999j92z+cGUu(i4^5Uy1q{j$*@q)fUcbz$2 Date: Wed, 23 Sep 2020 11:03:44 +0300 Subject: [PATCH 042/216] Fix timestamp handling in remote_write (#21166) --- CHANGELOG.next.asciidoc | 1 + .../module/prometheus/remote_write/data.go | 6 +- .../remote_write/remote_write_test.go | 80 ++++++++ .../module/prometheus/remote_write/data.go | 10 +- .../remote_write/remote_write_test.go | 192 +++++++++--------- 5 files changed, 190 insertions(+), 99 deletions(-) create mode 100644 metricbeat/module/prometheus/remote_write/remote_write_test.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 4af5bb53655..3287a4853a9 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -348,6 +348,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Disable Kafka metricsets based on Jolokia by default. They require a different configuration. {pull}20989[20989] - Fix panic index out of range error when getting AWS account name. {pull}21101[21101] {issue}21095[21095] - Handle missing counters in the application_pool metricset. {pull}21071[21071] +- Fix timestamp handling in remote_write. {pull}21166[21166] - Fix remote_write flaky test. {pull}21173[21173] - Visualization title fixes in aws, azure and googlecloud compute dashboards. {pull}21098[21098] diff --git a/metricbeat/module/prometheus/remote_write/data.go b/metricbeat/module/prometheus/remote_write/data.go index 2eec6aefaa3..3afaa7e9529 100644 --- a/metricbeat/module/prometheus/remote_write/data.go +++ b/metricbeat/module/prometheus/remote_write/data.go @@ -57,13 +57,14 @@ func (p *remoteWriteEventGenerator) GenerateEvents(metrics model.Samples) map[st labels[string(k)] = v } - // join metrics with same labels in a single event - labelsHash := labels.String() + // join metrics with same labels and same timestamp in a single event + labelsHash := labels.String() + metric.Timestamp.Time().String() if _, ok := eventList[labelsHash]; !ok { eventList[labelsHash] = mb.Event{ ModuleFields: common.MapStr{ "metrics": common.MapStr{}, }, + Timestamp: metric.Timestamp.Time(), } // Add labels @@ -74,7 +75,6 @@ func (p *remoteWriteEventGenerator) GenerateEvents(metrics model.Samples) map[st // Not checking anything here because we create these maps some lines before e := eventList[labelsHash] - e.Timestamp = metric.Timestamp.Time() data := common.MapStr{ name: val, } diff --git a/metricbeat/module/prometheus/remote_write/remote_write_test.go b/metricbeat/module/prometheus/remote_write/remote_write_test.go new file mode 100644 index 00000000000..f0e533f49bc --- /dev/null +++ b/metricbeat/module/prometheus/remote_write/remote_write_test.go @@ -0,0 +1,80 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package remote_write + +import ( + "testing" + + "github.com/prometheus/common/model" + "github.com/stretchr/testify/assert" + + "github.com/elastic/beats/v7/libbeat/common" +) + +// TestGenerateEventsCounter tests counter simple cases +func TestGenerateEventsCounter(t *testing.T) { + g := remoteWriteEventGenerator{} + + timestamp := model.Time(424242) + timestamp1 := model.Time(424243) + labels := common.MapStr{ + "listener_name": model.LabelValue("http"), + } + + // first fetch + metrics := model.Samples{ + &model.Sample{ + Metric: map[model.LabelName]model.LabelValue{ + "__name__": "net_conntrack_listener_conn_closed_total", + "listener_name": "http", + }, + Value: model.SampleValue(42), + Timestamp: timestamp, + }, + &model.Sample{ + Metric: map[model.LabelName]model.LabelValue{ + "__name__": "net_conntrack_listener_conn_closed_total", + "listener_name": "http", + }, + Value: model.SampleValue(43), + Timestamp: timestamp1, + }, + } + events := g.GenerateEvents(metrics) + + expected := common.MapStr{ + "metrics": common.MapStr{ + "net_conntrack_listener_conn_closed_total": float64(42), + }, + "labels": labels, + } + expected1 := common.MapStr{ + "metrics": common.MapStr{ + "net_conntrack_listener_conn_closed_total": float64(43), + }, + "labels": labels, + } + + assert.Equal(t, len(events), 2) + e := events[labels.String()+timestamp.Time().String()] + assert.EqualValues(t, e.ModuleFields, expected) + assert.EqualValues(t, e.Timestamp, timestamp.Time()) + e = events[labels.String()+timestamp1.Time().String()] + assert.EqualValues(t, e.ModuleFields, expected1) + assert.EqualValues(t, e.Timestamp, timestamp1.Time()) +} diff --git a/x-pack/metricbeat/module/prometheus/remote_write/data.go b/x-pack/metricbeat/module/prometheus/remote_write/data.go index 5d8a101fbdd..2258aba0270 100644 --- a/x-pack/metricbeat/module/prometheus/remote_write/data.go +++ b/x-pack/metricbeat/module/prometheus/remote_write/data.go @@ -122,16 +122,17 @@ func (g remoteWriteTypedGenerator) GenerateEvents(metrics model.Samples) map[str promType := g.findMetricType(name, labels) - labelsHash := labels.String() + labelsHash := labels.String() + metric.Timestamp.Time().String() labelsClone := labels.Clone() labelsClone.Delete("le") if promType == histogramType { - labelsHash = labelsClone.String() + labelsHash = labelsClone.String() + metric.Timestamp.Time().String() } // join metrics with same labels in a single event if _, ok := eventList[labelsHash]; !ok { eventList[labelsHash] = mb.Event{ ModuleFields: common.MapStr{}, + Timestamp: metric.Timestamp.Time(), } // Add labels @@ -145,7 +146,6 @@ func (g remoteWriteTypedGenerator) GenerateEvents(metrics model.Samples) map[str } e := eventList[labelsHash] - e.Timestamp = metric.Timestamp.Time() switch promType { case counterType: data = common.MapStr{ @@ -220,10 +220,11 @@ func (g *remoteWriteTypedGenerator) rateCounterFloat64(name string, labels commo // processPromHistograms receives a group of Histograms and converts each one to ES histogram func (g *remoteWriteTypedGenerator) processPromHistograms(eventList map[string]mb.Event, histograms map[string]histogram) { for _, histogram := range histograms { - labelsHash := histogram.labels.String() + labelsHash := histogram.labels.String() + histogram.timestamp.String() if _, ok := eventList[labelsHash]; !ok { eventList[labelsHash] = mb.Event{ ModuleFields: common.MapStr{}, + Timestamp: histogram.timestamp, } // Add labels @@ -233,7 +234,6 @@ func (g *remoteWriteTypedGenerator) processPromHistograms(eventList map[string]m } e := eventList[labelsHash] - e.Timestamp = histogram.timestamp hist := dto.Histogram{ Bucket: histogram.buckets, diff --git a/x-pack/metricbeat/module/prometheus/remote_write/remote_write_test.go b/x-pack/metricbeat/module/prometheus/remote_write/remote_write_test.go index d5c07f0d2a9..6c031be5bba 100644 --- a/x-pack/metricbeat/module/prometheus/remote_write/remote_write_test.go +++ b/x-pack/metricbeat/module/prometheus/remote_write/remote_write_test.go @@ -28,10 +28,10 @@ func TestGenerateEventsCounter(t *testing.T) { rateCounters: true, } g.counterCache.Start() + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } - // first fetch metrics := model.Samples{ &model.Sample{ @@ -40,7 +40,7 @@ func TestGenerateEventsCounter(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -54,7 +54,7 @@ func TestGenerateEventsCounter(t *testing.T) { } assert.Equal(t, len(events), 1) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) // repeat in order to test the rate @@ -65,7 +65,7 @@ func TestGenerateEventsCounter(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -79,7 +79,7 @@ func TestGenerateEventsCounter(t *testing.T) { } assert.Equal(t, len(events), 1) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) } @@ -94,6 +94,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { rateCounters: true, } g.counterCache.Start() + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } @@ -106,7 +107,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -114,7 +115,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(43), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -132,7 +133,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { } assert.Equal(t, len(events), 1) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) // repeat in order to test the rate @@ -143,7 +144,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -151,7 +152,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(47), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -169,7 +170,7 @@ func TestGenerateEventsCounterSameLabels(t *testing.T) { } assert.Equal(t, len(events), 1) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) } @@ -184,6 +185,8 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { rateCounters: true, } g.counterCache.Start() + + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } @@ -200,7 +203,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -208,7 +211,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(43), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -217,7 +220,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(44), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -242,9 +245,9 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 2) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected1) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) // repeat in order to test the rate @@ -255,7 +258,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -263,7 +266,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(47), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -272,7 +275,7 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(50), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -297,9 +300,9 @@ func TestGenerateEventsCounterDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 2) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected1) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) } @@ -314,6 +317,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { rateCounters: true, } g.counterCache.Start() + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } @@ -330,7 +334,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -338,7 +342,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(43), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -347,7 +351,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(44), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -356,7 +360,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(49), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -384,9 +388,9 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 2) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected1) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) // repeat in order to test the rate @@ -397,7 +401,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -405,7 +409,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(47), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -414,7 +418,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(50), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -423,7 +427,7 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { "device": "eth0", }, Value: model.SampleValue(59), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -451,9 +455,9 @@ func TestGenerateEventsGaugeDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 2) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected1) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) } @@ -468,6 +472,8 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { rateCounters: true, } g.counterCache.Start() + + timestamp := model.Time(424242) labels := common.MapStr{ "runtime": model.LabelValue("linux"), "quantile": model.LabelValue("0.25"), @@ -489,7 +495,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.25", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -498,7 +504,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.50", }, Value: model.SampleValue(43), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -506,7 +512,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(44), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -514,7 +520,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -523,7 +529,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.25", }, Value: model.SampleValue(46), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -556,11 +562,11 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 3) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) - e = events[labels3.String()] + e = events[labels3.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected3) // repeat in order to test the rate @@ -572,7 +578,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.25", }, Value: model.SampleValue(52), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -581,7 +587,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.50", }, Value: model.SampleValue(53), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -589,7 +595,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(54), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -597,7 +603,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(55), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -606,7 +612,7 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { "quantile": "0.25", }, Value: model.SampleValue(56), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -639,11 +645,11 @@ func TestGenerateEventsQuantilesDifferentLabels(t *testing.T) { } assert.Equal(t, len(events), 3) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) - e = events[labels3.String()] + e = events[labels3.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected3) } @@ -658,6 +664,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { rateCounters: true, } g.counterCache.Start() + timestamp := model.Time(424242) labels := common.MapStr{ "runtime": model.LabelValue("linux"), } @@ -674,7 +681,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -683,7 +690,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(43), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -692,7 +699,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(44), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -700,7 +707,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -708,7 +715,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(46), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, // second histogram same label &model.Sample{ @@ -718,7 +725,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(52), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -727,7 +734,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(53), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -736,7 +743,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(54), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -744,7 +751,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(55), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -752,7 +759,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(56), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, // third histogram different label &model.Sample{ @@ -762,7 +769,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(62), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -771,7 +778,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(63), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -780,7 +787,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(64), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -788,7 +795,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "darwin", }, Value: model.SampleValue(65), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -796,7 +803,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "darwin", }, Value: model.SampleValue(66), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -851,9 +858,9 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { } assert.Equal(t, 2, len(events)) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) // repeat in order to test the rate @@ -865,7 +872,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(142), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -874,7 +881,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(143), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -883,7 +890,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(144), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -891,7 +898,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(145), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -899,7 +906,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(146), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, // second histogram same label &model.Sample{ @@ -909,7 +916,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(252), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -918,7 +925,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(253), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -927,7 +934,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(254), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -935,7 +942,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(255), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -943,7 +950,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "linux", }, Value: model.SampleValue(256), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, // third histogram different label &model.Sample{ @@ -953,7 +960,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.25", }, Value: model.SampleValue(362), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -962,7 +969,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "0.50", }, Value: model.SampleValue(363), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -971,7 +978,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "le": "+Inf", }, Value: model.SampleValue(364), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -979,7 +986,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "darwin", }, Value: model.SampleValue(365), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, &model.Sample{ Metric: map[model.LabelName]model.LabelValue{ @@ -987,7 +994,7 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { "runtime": "darwin", }, Value: model.SampleValue(366), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -1042,9 +1049,9 @@ func TestGenerateEventsHistogramsDifferentLabels(t *testing.T) { } assert.Equal(t, 2, len(events)) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) - e = events[labels2.String()] + e = events[labels2.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected2) } @@ -1064,6 +1071,8 @@ func TestGenerateEventsCounterWithDefinedPattern(t *testing.T) { } g.counterCache.Start() + + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } @@ -1076,7 +1085,7 @@ func TestGenerateEventsCounterWithDefinedPattern(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -1090,7 +1099,7 @@ func TestGenerateEventsCounterWithDefinedPattern(t *testing.T) { } assert.Equal(t, len(events), 1) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) // repeat in order to test the rate @@ -1101,7 +1110,7 @@ func TestGenerateEventsCounterWithDefinedPattern(t *testing.T) { "listener_name": "http", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -1115,7 +1124,7 @@ func TestGenerateEventsCounterWithDefinedPattern(t *testing.T) { } assert.Equal(t, len(events), 1) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) } @@ -1136,6 +1145,7 @@ func TestGenerateEventsHistogramWithDefinedPattern(t *testing.T) { } g.counterCache.Start() + timestamp := model.Time(424242) labels := common.MapStr{ "listener_name": model.LabelValue("http"), } @@ -1149,7 +1159,7 @@ func TestGenerateEventsHistogramWithDefinedPattern(t *testing.T) { "le": "20", }, Value: model.SampleValue(42), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events := g.GenerateEvents(metrics) @@ -1165,7 +1175,7 @@ func TestGenerateEventsHistogramWithDefinedPattern(t *testing.T) { } assert.Equal(t, len(events), 1) - e := events[labels.String()] + e := events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) // repeat in order to test the rate @@ -1177,7 +1187,7 @@ func TestGenerateEventsHistogramWithDefinedPattern(t *testing.T) { "le": "20", }, Value: model.SampleValue(45), - Timestamp: model.Time(424242), + Timestamp: timestamp, }, } events = g.GenerateEvents(metrics) @@ -1193,7 +1203,7 @@ func TestGenerateEventsHistogramWithDefinedPattern(t *testing.T) { } assert.Equal(t, len(events), 1) - e = events[labels.String()] + e = events[labels.String()+timestamp.Time().String()] assert.EqualValues(t, e.ModuleFields, expected) } From a5e2e9b741e0af22c30de6abc768862e8ec64111 Mon Sep 17 00:00:00 2001 From: EamonnTP Date: Wed, 23 Sep 2020 13:15:33 +0100 Subject: [PATCH 043/216] [DOCS] Add beat specific start widgets (#21217) * Add beat specific start widget * Add package name attribute --- .../start-widget-filebeat.asciidoc | 115 ++++++++++++++++++ .../start-widget-heartbeat.asciidoc | 115 ++++++++++++++++++ .../start-widget-metricbeat.asciidoc | 115 ++++++++++++++++++ 3 files changed, 345 insertions(+) create mode 100644 libbeat/docs/tab-widgets/start-widget-filebeat.asciidoc create mode 100644 libbeat/docs/tab-widgets/start-widget-heartbeat.asciidoc create mode 100644 libbeat/docs/tab-widgets/start-widget-metricbeat.asciidoc diff --git a/libbeat/docs/tab-widgets/start-widget-filebeat.asciidoc b/libbeat/docs/tab-widgets/start-widget-filebeat.asciidoc new file mode 100644 index 00000000000..a5516816bf3 --- /dev/null +++ b/libbeat/docs/tab-widgets/start-widget-filebeat.asciidoc @@ -0,0 +1,115 @@ +:beatname_uc: Filebeat +:beatname_lc: filebeat +:beatname_pkg: filebeat +++++ +

+
+ + + + + + +
+
+++++ + +include::start.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ \ No newline at end of file diff --git a/libbeat/docs/tab-widgets/start-widget-heartbeat.asciidoc b/libbeat/docs/tab-widgets/start-widget-heartbeat.asciidoc new file mode 100644 index 00000000000..92d57b71fa3 --- /dev/null +++ b/libbeat/docs/tab-widgets/start-widget-heartbeat.asciidoc @@ -0,0 +1,115 @@ +:beatname_uc: Heartbeat +:beatname_lc: heartbeat +:beatname_pkg: heartbeat +++++ +
+
+ + + + + + +
+
+++++ + +include::start.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ \ No newline at end of file diff --git a/libbeat/docs/tab-widgets/start-widget-metricbeat.asciidoc b/libbeat/docs/tab-widgets/start-widget-metricbeat.asciidoc new file mode 100644 index 00000000000..986377ffd8e --- /dev/null +++ b/libbeat/docs/tab-widgets/start-widget-metricbeat.asciidoc @@ -0,0 +1,115 @@ +:beatname_uc: Metricbeat +:beatname_lc: metricbeat +:beatname_pkg: metricbeat +++++ +
+
+ + + + + + +
+
+++++ + +include::start.asciidoc[tag=deb] + +++++ +
+ + + + + +
+++++ \ No newline at end of file From 43ca900fded5df0c8e4f7d43667a1c8fe0dd9ed6 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 23 Sep 2020 15:41:57 +0200 Subject: [PATCH 044/216] Add recursive split to httpjson (#21214) --- x-pack/filebeat/input/httpjson/requester.go | 31 ++++--- .../filebeat/input/httpjson/requester_test.go | 86 +++++++++++++++++++ 2 files changed, 107 insertions(+), 10 deletions(-) create mode 100644 x-pack/filebeat/input/httpjson/requester_test.go diff --git a/x-pack/filebeat/input/httpjson/requester.go b/x-pack/filebeat/input/httpjson/requester.go index 579e5e26756..b5f58179aa0 100644 --- a/x-pack/filebeat/input/httpjson/requester.go +++ b/x-pack/filebeat/input/httpjson/requester.go @@ -12,6 +12,7 @@ import ( "io" "io/ioutil" "net/http" + "strings" stateless "github.com/elastic/beats/v7/filebeat/input/v2/input-stateless" "github.com/elastic/beats/v7/libbeat/common" @@ -214,7 +215,7 @@ func (r *requester) processEventArray(publisher stateless.Publisher, events []in for _, t := range events { switch v := t.(type) { case map[string]interface{}: - for _, e := range r.splitEvent(v) { + for _, e := range splitEvent(r.splitEventsBy, v) { last = e d, err := json.Marshal(e) if err != nil { @@ -229,15 +230,23 @@ func (r *requester) processEventArray(publisher stateless.Publisher, events []in return last, nil } -func (r *requester) splitEvent(event map[string]interface{}) []map[string]interface{} { +func splitEvent(splitKey string, event map[string]interface{}) []map[string]interface{} { m := common.MapStr(event) - hasSplitKey, _ := m.HasKey(r.splitEventsBy) - if r.splitEventsBy == "" || !hasSplitKey { + // NOTE: this notation is only used internally, not meant to be documented + // and will be removed in the next release + keys := strings.SplitN(splitKey, "..", 2) + if len(keys) < 2 { + // we append an empty key to force the recursive call + keys = append(keys, "") + } + + hasSplitKey, _ := m.HasKey(keys[0]) + if keys[0] == "" || !hasSplitKey { return []map[string]interface{}{event} } - splitOnIfc, _ := m.GetValue(r.splitEventsBy) + splitOnIfc, _ := m.GetValue(keys[0]) splitOn, ok := splitOnIfc.([]interface{}) // if not an array or is empty, we do nothing if !ok || len(splitOn) == 0 { @@ -252,12 +261,14 @@ func (r *requester) splitEvent(event map[string]interface{}) []map[string]interf return []map[string]interface{}{event} } - mm := m.Clone() - if _, err := mm.Put(r.splitEventsBy, s); err != nil { - return []map[string]interface{}{event} + // call splitEvent recursively for each part + for _, nestedSplit := range splitEvent(keys[1], s) { + mm := m.Clone() + if _, err := mm.Put(keys[0], nestedSplit); err != nil { + return []map[string]interface{}{event} + } + events = append(events, mm) } - - events = append(events, mm) } return events diff --git a/x-pack/filebeat/input/httpjson/requester_test.go b/x-pack/filebeat/input/httpjson/requester_test.go new file mode 100644 index 00000000000..31e65a57c73 --- /dev/null +++ b/x-pack/filebeat/input/httpjson/requester_test.go @@ -0,0 +1,86 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package httpjson + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestSplitEventsBy(t *testing.T) { + event := map[string]interface{}{ + "this": "is kept", + "alerts": []interface{}{ + map[string]interface{}{ + "this_is": "also kept", + "entities": []interface{}{ + map[string]interface{}{ + "something": "something", + }, + map[string]interface{}{ + "else": "else", + }, + }, + }, + map[string]interface{}{ + "this_is": "also kept 2", + "entities": []interface{}{ + map[string]interface{}{ + "something": "something 2", + }, + map[string]interface{}{ + "else": "else 2", + }, + }, + }, + }, + } + + expectedEvents := []map[string]interface{}{ + { + "this": "is kept", + "alerts": map[string]interface{}{ + "this_is": "also kept", + "entities": map[string]interface{}{ + "something": "something", + }, + }, + }, + { + "this": "is kept", + "alerts": map[string]interface{}{ + "this_is": "also kept", + "entities": map[string]interface{}{ + "else": "else", + }, + }, + }, + { + "this": "is kept", + "alerts": map[string]interface{}{ + "this_is": "also kept 2", + "entities": map[string]interface{}{ + "something": "something 2", + }, + }, + }, + { + "this": "is kept", + "alerts": map[string]interface{}{ + "this_is": "also kept 2", + "entities": map[string]interface{}{ + "else": "else 2", + }, + }, + }, + } + + const key = "alerts..entities" + + got := splitEvent(key, event) + + assert.Equal(t, expectedEvents, got) +} From 3fb01e33b8f121a4dca40f9307c42dab00caeb61 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 23 Sep 2020 17:30:36 +0200 Subject: [PATCH 045/216] [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (#21160) * Add related.hosts to panos * Add related.hosts to osquery * Add related.hosts to system * Add related.hosts to defender atp * Add related.hosts to cisco * Add related.hosts to suricata * Use allow_duplicates: false to remove duplicate hosts * Add related.hosts to rsa2elk modules * Add changelog entry * Add checks to avoid empty strings --- CHANGELOG.next.asciidoc | 1 + .../module/osquery/result/config/result.yml | 2 +- .../osquery/result/ingest/pipeline.json | 8 + .../test/osquery.rootkit.log-expected.json | 180 ++++ .../osqueryd.results.darwin.log-expected.json | 300 +++++++ .../osqueryd.results.sample.log-expected.json | 300 +++++++ .../result/test/test.log-expected.json | 3 + filebeat/module/system/auth/config/auth.yml | 2 +- .../module/system/auth/ingest/pipeline.yml | 5 + .../test/auth-ubuntu1204.log-expected.json | 297 +++++++ .../auth/test/secure-rhel7.log-expected.json | 300 +++++++ .../system/auth/test/test.log-expected.json | 30 + .../auth/test/timestamp.log-expected.json | 6 + .../module/system/syslog/config/syslog.yml | 2 +- .../module/system/syslog/ingest/pipeline.yml | 5 + .../darwin-syslog-sample.log-expected.json | 6 + .../test/darwin-syslog.log-expected.json | 300 +++++++ .../syslog/test/suse-syslog.log-expected.json | 6 + .../syslog/test/tz-offset.log-expected.json | 9 + .../barracuda/spamfirewall/config/input.yml | 2 +- .../spamfirewall/ingest/pipeline.yml | 10 + .../test/generated.log-expected.json | 66 +- .../module/barracuda/waf/config/input.yml | 2 +- .../module/bluecoat/director/config/input.yml | 2 +- .../bluecoat/director/ingest/pipeline.yml | 5 + .../director/test/generated.log-expected.json | 21 + .../module/cisco/asa/config/input.yml | 2 +- .../additional_messages.log-expected.json | 200 +++++ .../cisco/asa/test/asa-fix.log-expected.json | 15 + .../cisco/asa/test/asa.log-expected.json | 300 +++++++ .../cisco/asa/test/filtered.log-expected.json | 6 + .../asa/test/hostnames.log-expected.json | 8 + .../cisco/asa/test/not-ip.log-expected.json | 10 + .../cisco/asa/test/sample.log-expected.json | 48 ++ .../module/cisco/ftd/config/input.yml | 2 +- .../cisco/ftd/test/asa-fix.log-expected.json | 12 + .../cisco/ftd/test/asa.log-expected.json | 300 +++++++ .../cisco/ftd/test/dns.log-expected.json | 63 ++ .../cisco/ftd/test/filtered.log-expected.json | 3 + .../ftd/test/intrusion.log-expected.json | 12 + .../ftd/test/no-type-id.log-expected.json | 12 + .../cisco/ftd/test/not-ip.log-expected.json | 10 + .../cisco/ftd/test/sample.log-expected.json | 86 ++ .../security-connection.log-expected.json | 30 + .../security-file-malware.log-expected.json | 30 + .../security-malware-site.log-expected.json | 3 + .../module/cisco/ios/config/input.yml | 2 +- .../module/cisco/meraki/config/input.yml | 2 +- .../module/cisco/meraki/ingest/pipeline.yml | 10 + .../meraki/test/generated.log-expected.json | 113 +-- .../module/cisco/nexus/config/input.yml | 2 +- .../module/cisco/nexus/ingest/pipeline.yml | 10 + .../cisco/shared/ingest/asa-ftd-pipeline.yml | 20 + .../module/citrix/netscaler/config/input.yml | 2 +- .../citrix/netscaler/ingest/pipeline.yml | 5 + .../test/generated.log-expected.json | 62 +- .../module/cyberark/corepas/config/input.yml | 2 +- .../cyberark/corepas/ingest/pipeline.yml | 10 + .../corepas/test/generated.log-expected.json | 530 +++++++----- .../module/cylance/protect/config/input.yml | 2 +- .../cylance/protect/ingest/pipeline.yml | 5 + .../protect/test/generated.log-expected.json | 243 ++++++ .../module/f5/bigipafm/config/input.yml | 2 +- .../module/f5/bigipafm/ingest/pipeline.yml | 5 + .../bigipafm/test/generated.log-expected.json | 696 +++++++++++----- .../module/f5/bigipapm/config/input.yml | 2 +- .../module/f5/bigipapm/ingest/pipeline.yml | 5 + .../bigipapm/test/generated.log-expected.json | 17 +- .../fortinet/clientendpoint/config/input.yml | 2 +- .../clientendpoint/ingest/pipeline.yml | 10 + .../test/generated.log-expected.json | 560 +++++++++++-- .../fortinet/fortimail/config/input.yml | 2 +- .../fortinet/fortimail/ingest/pipeline.yml | 5 + .../test/generated.log-expected.json | 31 +- .../fortinet/fortimanager/config/input.yml | 2 +- .../fortinet/fortimanager/ingest/pipeline.yml | 5 + .../test/generated.log-expected.json | 509 ++++++++---- .../imperva/securesphere/config/input.yml | 2 +- .../imperva/securesphere/ingest/pipeline.yml | 5 + .../test/generated.log-expected.json | 772 ++++++++++++------ .../module/infoblox/nios/config/input.yml | 2 +- .../module/infoblox/nios/ingest/pipeline.yml | 10 + .../nios/test/generated.log-expected.json | 284 +++++++ .../module/juniper/junos/config/input.yml | 2 +- .../module/juniper/junos/ingest/pipeline.yml | 10 + .../module/juniper/netscreen/config/input.yml | 2 +- .../microsoft/defender_atp/config/atp.yml | 2 +- .../defender_atp/ingest/pipeline.yml | 5 + .../defender_atp-test.json.log-expected.json | 12 + .../module/microsoft/dhcp/config/input.yml | 2 +- .../module/microsoft/dhcp/ingest/pipeline.yml | 10 + .../dhcp/test/generated.log-expected.json | 300 +++++++ .../netscout/sightline/config/input.yml | 2 +- .../module/panw/panos/config/input.yml | 2 +- .../module/panw/panos/ingest/pipeline.yml | 6 + .../panw/panos/test/threat.log-expected.json | 228 ++++++ .../panw/panos/test/traffic.log-expected.json | 300 +++++++ .../proofpoint/emailsecurity/config/input.yml | 2 +- .../emailsecurity/ingest/pipeline.yml | 10 + .../test/generated.log-expected.json | 24 + .../radware/defensepro/config/input.yml | 2 +- .../module/snort/log/config/input.yml | 2 +- .../module/snort/log/ingest/pipeline.yml | 5 + .../log/test/generated.log-expected.json | 364 ++++++++- .../sonicwall/firewall/config/input.yml | 2 +- .../sonicwall/firewall/ingest/pipeline.yml | 20 + .../firewall/test/generated.log-expected.json | 89 +- .../module/sophos/utm/config/input.yml | 2 +- .../module/sophos/utm/ingest/pipeline.yml | 10 + .../utm/test/generated.log-expected.json | 279 ++++++- .../module/squid/log/config/input.yml | 2 +- .../module/squid/log/ingest/pipeline.yml | 10 + .../squid/log/test/access1.log-expected.json | 644 +++++++++++---- .../module/suricata/eve/ingest/pipeline.yml | 5 + .../eve/test/eve-alerts.log-expected.json | 60 ++ .../eve/test/eve-small.log-expected.json | 6 + .../endpointprotection/config/input.yml | 2 +- .../endpointprotection/ingest/pipeline.yml | 20 + .../test/generated.log-expected.json | 337 +++++++- .../module/tomcat/log/config/input.yml | 2 +- .../module/tomcat/log/ingest/pipeline.yml | 15 + .../log/test/generated.log-expected.json | 495 +++++++++++ .../module/zscaler/zia/config/input.yml | 2 +- .../module/zscaler/zia/ingest/pipeline.yml | 10 + .../zia/test/generated.log-expected.json | 700 +++++++++++----- .../zscaler/zia/test/test.log-expected.json | 3 + 126 files changed, 9460 insertions(+), 1517 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 3287a4853a9..1c41a2f71e4 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -589,6 +589,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Added new module for Zoom webhooks {pull}20414[20414] - Add type and sub_type to panw panos fileset {pull}20912[20912] - Always attempt community_id processor on zeek module {pull}21155[21155] +- Add related.hosts ecs field to all modules {pull}21160[21160] *Heartbeat* diff --git a/filebeat/module/osquery/result/config/result.yml b/filebeat/module/osquery/result/config/result.yml index f35881687e8..1d6d2e0d042 100644 --- a/filebeat/module/osquery/result/config/result.yml +++ b/filebeat/module/osquery/result/config/result.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/osquery/result/ingest/pipeline.json b/filebeat/module/osquery/result/ingest/pipeline.json index c14b9664d1e..2a0329133fa 100644 --- a/filebeat/module/osquery/result/ingest/pipeline.json +++ b/filebeat/module/osquery/result/ingest/pipeline.json @@ -206,6 +206,14 @@ "value": "{{osquery.result.name}}", "ignore_empty_value": true } + }, + { + "append": { + "field": "related.hosts", + "value": "{{host.hostname}}", + "if": "ctx?.host?.hostname != null && ctx.host?.hostname != ''", + "allow_duplicates": false + } } ], "on_failure" : [{ diff --git a/filebeat/module/osquery/result/test/osquery.rootkit.log-expected.json b/filebeat/module/osquery/result/test/osquery.rootkit.log-expected.json index bedd286615d..953a63b299c 100644 --- a/filebeat/module/osquery/result/test/osquery.rootkit.log-expected.json +++ b/filebeat/module/osquery/result/test/osquery.rootkit.log-expected.json @@ -29,6 +29,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -66,6 +69,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -103,6 +109,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -140,6 +149,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -177,6 +189,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -214,6 +229,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -251,6 +269,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -288,6 +309,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -325,6 +349,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -362,6 +389,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -399,6 +429,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -436,6 +469,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -473,6 +509,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -510,6 +549,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -547,6 +589,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -584,6 +629,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -621,6 +669,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -658,6 +709,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -695,6 +749,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -732,6 +789,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -769,6 +829,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -806,6 +869,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -843,6 +909,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -880,6 +949,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -917,6 +989,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -954,6 +1029,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -991,6 +1069,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1028,6 +1109,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1065,6 +1149,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1102,6 +1189,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1139,6 +1229,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1176,6 +1269,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1213,6 +1309,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1250,6 +1349,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1287,6 +1389,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1324,6 +1429,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1361,6 +1469,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1398,6 +1509,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1435,6 +1549,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1472,6 +1589,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1509,6 +1629,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1546,6 +1669,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1583,6 +1709,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1620,6 +1749,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1657,6 +1789,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1694,6 +1829,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1731,6 +1869,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1768,6 +1909,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1805,6 +1949,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1842,6 +1989,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1879,6 +2029,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1916,6 +2069,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1953,6 +2109,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1990,6 +2149,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2027,6 +2189,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2064,6 +2229,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2101,6 +2269,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2138,6 +2309,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_osquery-monitoring_schedule", "osquery.result.unix_time": "1515423115", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2195,6 +2369,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_ossec-rootkit_slapper_installed", "osquery.result.unix_time": "1515431189", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2252,6 +2429,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_ossec-rootkit_adore_worm", "osquery.result.unix_time": "1515431988", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], diff --git a/filebeat/module/osquery/result/test/osqueryd.results.darwin.log-expected.json b/filebeat/module/osquery/result/test/osqueryd.results.darwin.log-expected.json index bc722ee249f..5a8083a37e2 100644 --- a/filebeat/module/osquery/result/test/osqueryd.results.darwin.log-expected.json +++ b/filebeat/module/osquery/result/test/osqueryd.results.darwin.log-expected.json @@ -22,6 +22,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "org.python.python.app", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -52,6 +55,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.ruby", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -82,6 +88,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.a2p", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -112,6 +121,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.javajdk16.cmd", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -142,6 +154,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.php", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -172,6 +187,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.nc", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -202,6 +220,9 @@ "osquery.result.name": "pack_it-compliance_alf_explicit_auths", "osquery.result.unix_time": "1514471990", "process.name": "com.apple.ksh", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -234,6 +255,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "httpd", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -266,6 +290,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "cupsd", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -298,6 +325,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "AEServer", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -330,6 +360,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "ftpd", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -362,6 +395,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "AppleFileServer", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -394,6 +430,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "sshd-keygen-wrapper", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -426,6 +465,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "smbd", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -458,6 +500,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "AppleVNCServer", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -490,6 +535,9 @@ "osquery.result.name": "pack_it-compliance_alf_services", "osquery.result.unix_time": "1514471990", "process.name": "ODSAgent", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -544,6 +592,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -599,6 +650,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -653,6 +707,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -707,6 +764,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -761,6 +821,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -815,6 +878,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -869,6 +935,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -923,6 +992,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -977,6 +1049,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1031,6 +1106,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1085,6 +1163,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1139,6 +1220,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1193,6 +1277,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_firefox_addons", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1226,6 +1313,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1258,6 +1348,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1290,6 +1383,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1322,6 +1418,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1354,6 +1453,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1386,6 +1488,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1418,6 +1523,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1450,6 +1558,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1482,6 +1593,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1514,6 +1628,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1546,6 +1663,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1578,6 +1698,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1610,6 +1733,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1642,6 +1768,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1674,6 +1803,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1706,6 +1838,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1738,6 +1873,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1770,6 +1908,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1802,6 +1943,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1834,6 +1978,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1866,6 +2013,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1898,6 +2048,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1930,6 +2083,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1962,6 +2118,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -1994,6 +2153,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2026,6 +2188,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2058,6 +2223,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2090,6 +2258,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2122,6 +2293,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2154,6 +2328,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2186,6 +2363,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2218,6 +2398,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2250,6 +2433,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2282,6 +2468,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2314,6 +2503,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2346,6 +2538,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2378,6 +2573,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2410,6 +2608,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2442,6 +2643,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2474,6 +2678,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2506,6 +2713,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2538,6 +2748,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2570,6 +2783,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2602,6 +2818,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2634,6 +2853,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2666,6 +2888,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2698,6 +2923,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2730,6 +2958,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2762,6 +2993,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2794,6 +3028,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2826,6 +3063,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2858,6 +3098,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2890,6 +3133,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2922,6 +3168,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2954,6 +3203,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -2986,6 +3238,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3018,6 +3273,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3050,6 +3308,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3082,6 +3343,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3114,6 +3378,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3146,6 +3413,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3178,6 +3448,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3210,6 +3483,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3242,6 +3518,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3274,6 +3553,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3306,6 +3588,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3338,6 +3623,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3370,6 +3658,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3402,6 +3693,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3434,6 +3728,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], @@ -3466,6 +3763,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_homebrew_packages", "osquery.result.unix_time": "1514471991", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], diff --git a/filebeat/module/osquery/result/test/osqueryd.results.sample.log-expected.json b/filebeat/module/osquery/result/test/osqueryd.results.sample.log-expected.json index c339f8183fd..0f9afe755c1 100644 --- a/filebeat/module/osquery/result/test/osqueryd.results.sample.log-expected.json +++ b/filebeat/module/osquery/result/test/osqueryd.results.sample.log-expected.json @@ -26,6 +26,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "system_info", "osquery.result.unix_time": "1512649280", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -60,6 +63,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -94,6 +100,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -128,6 +137,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -162,6 +174,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -196,6 +211,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -230,6 +248,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -264,6 +285,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -298,6 +322,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -332,6 +359,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -366,6 +396,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -400,6 +433,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -434,6 +470,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -468,6 +507,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -502,6 +544,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -536,6 +581,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -570,6 +618,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -604,6 +655,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -638,6 +692,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -672,6 +729,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -706,6 +766,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -740,6 +803,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -774,6 +840,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -808,6 +877,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -842,6 +914,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -876,6 +951,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -910,6 +988,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -944,6 +1025,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -978,6 +1062,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1012,6 +1099,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1046,6 +1136,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1080,6 +1173,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1114,6 +1210,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1148,6 +1247,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1182,6 +1284,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1216,6 +1321,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1250,6 +1358,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1284,6 +1395,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1318,6 +1432,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1352,6 +1469,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1386,6 +1506,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1420,6 +1543,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1454,6 +1580,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1488,6 +1617,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1522,6 +1654,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1556,6 +1691,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1590,6 +1728,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1624,6 +1765,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1658,6 +1802,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1692,6 +1839,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1726,6 +1876,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1760,6 +1913,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1794,6 +1950,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1828,6 +1987,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1862,6 +2024,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1896,6 +2061,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1930,6 +2098,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_kernel_modules", "osquery.result.unix_time": "1512669435", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1964,6 +2135,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -1998,6 +2172,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2032,6 +2209,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2066,6 +2246,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2100,6 +2283,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2134,6 +2320,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2168,6 +2357,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2202,6 +2394,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2236,6 +2431,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2270,6 +2468,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2304,6 +2505,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2341,6 +2545,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_os_version", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2394,6 +2601,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_osquery_info", "osquery.result.unix_time": "1512669438", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2428,6 +2638,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2462,6 +2675,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2496,6 +2712,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2530,6 +2749,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2564,6 +2786,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2598,6 +2823,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2632,6 +2860,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2666,6 +2897,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2700,6 +2934,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2734,6 +2971,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2768,6 +3008,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_disk_encryption", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2805,6 +3048,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_os_version", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2858,6 +3104,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_osquery_info", "osquery.result.unix_time": "1512669439", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2899,6 +3148,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2940,6 +3192,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -2981,6 +3236,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3022,6 +3280,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3063,6 +3324,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3104,6 +3368,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3145,6 +3412,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3186,6 +3456,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3227,6 +3500,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3268,6 +3544,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3309,6 +3588,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3350,6 +3632,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3391,6 +3676,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3432,6 +3720,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3473,6 +3764,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3514,6 +3808,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], @@ -3555,6 +3852,9 @@ "osquery.result.host_identifier": "ubuntu-xenial", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1512669441", + "related.hosts": [ + "ubuntu-xenial" + ], "related.user": [ "ubuntu" ], diff --git a/filebeat/module/osquery/result/test/test.log-expected.json b/filebeat/module/osquery/result/test/test.log-expected.json index 37a56ff8f13..4f7d0589a04 100644 --- a/filebeat/module/osquery/result/test/test.log-expected.json +++ b/filebeat/module/osquery/result/test/test.log-expected.json @@ -33,6 +33,9 @@ "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro", "osquery.result.name": "pack_it-compliance_mounts", "osquery.result.unix_time": "1514472008", + "related.hosts": [ + "192-168-0-4.rdsnet.ro" + ], "related.user": [ "tsg" ], diff --git a/filebeat/module/system/auth/config/auth.yml b/filebeat/module/system/auth/config/auth.yml index 3cdbd459e68..13f8c95656d 100644 --- a/filebeat/module/system/auth/config/auth.yml +++ b/filebeat/module/system/auth/config/auth.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/system/auth/ingest/pipeline.yml b/filebeat/module/system/auth/ingest/pipeline.yml index a958855936a..54ab0dbf8f5 100644 --- a/filebeat/module/system/auth/ingest/pipeline.yml +++ b/filebeat/module/system/auth/ingest/pipeline.yml @@ -142,6 +142,11 @@ processors: field: related.ip value: "{{source.ip}}" if: "ctx?.source?.ip != null" +- append: + field: related.hosts + value: "{{host.hostname}}" + if: "ctx.host?.hostname != null && ctx.host?.hostname != ''" + allow_duplicates: false on_failure: - set: field: error.message diff --git a/filebeat/module/system/auth/test/auth-ubuntu1204.log-expected.json b/filebeat/module/system/auth/test/auth-ubuntu1204.log-expected.json index 74654cb6dc1..cff887d76e8 100644 --- a/filebeat/module/system/auth/test/auth-ubuntu1204.log-expected.json +++ b/filebeat/module/system/auth/test/auth-ubuntu1204.log-expected.json @@ -11,6 +11,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -23,6 +26,9 @@ "input.type": "log", "log.offset": 81, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -44,6 +50,9 @@ "log.offset": 464, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -57,6 +66,9 @@ "log.offset": 570, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -71,6 +83,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -83,6 +98,9 @@ "input.type": "log", "log.offset": 736, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -104,6 +122,9 @@ "log.offset": 1121, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -117,6 +138,9 @@ "log.offset": 1227, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -131,6 +155,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -143,6 +170,9 @@ "input.type": "log", "log.offset": 1393, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -164,6 +194,9 @@ "log.offset": 1776, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -177,6 +210,9 @@ "log.offset": 1882, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -191,6 +227,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -203,6 +242,9 @@ "input.type": "log", "log.offset": 2048, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -224,6 +266,9 @@ "log.offset": 2426, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -237,6 +282,9 @@ "log.offset": 2532, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -251,6 +299,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -263,6 +314,9 @@ "input.type": "log", "log.offset": 2698, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -284,6 +338,9 @@ "log.offset": 3083, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -297,6 +354,9 @@ "log.offset": 3189, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -311,6 +371,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -336,6 +399,9 @@ "input.type": "log", "log.offset": 3414, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -357,6 +423,9 @@ "log.offset": 3977, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -370,6 +439,9 @@ "log.offset": 4083, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -384,6 +456,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -396,6 +471,9 @@ "input.type": "log", "log.offset": 4249, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -417,6 +495,9 @@ "log.offset": 4632, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -430,6 +511,9 @@ "log.offset": 4738, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -444,6 +528,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -456,6 +543,9 @@ "input.type": "log", "log.offset": 4904, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -477,6 +567,9 @@ "log.offset": 5289, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -490,6 +583,9 @@ "log.offset": 5395, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -504,6 +600,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -516,6 +615,9 @@ "input.type": "log", "log.offset": 5561, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -537,6 +639,9 @@ "log.offset": 5942, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -550,6 +655,9 @@ "log.offset": 6048, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -564,6 +672,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -576,6 +687,9 @@ "input.type": "log", "log.offset": 6214, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -597,6 +711,9 @@ "log.offset": 6597, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -610,6 +727,9 @@ "log.offset": 6703, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -624,6 +744,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -636,6 +759,9 @@ "input.type": "log", "log.offset": 6869, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -657,6 +783,9 @@ "log.offset": 7254, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -670,6 +799,9 @@ "log.offset": 7360, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -684,6 +816,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -696,6 +831,9 @@ "input.type": "log", "log.offset": 7526, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -717,6 +855,9 @@ "log.offset": 7911, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -730,6 +871,9 @@ "log.offset": 8017, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -744,6 +888,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -756,6 +903,9 @@ "input.type": "log", "log.offset": 8183, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -777,6 +927,9 @@ "log.offset": 8564, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -790,6 +943,9 @@ "log.offset": 8670, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -804,6 +960,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -816,6 +975,9 @@ "input.type": "log", "log.offset": 8836, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -837,6 +999,9 @@ "log.offset": 9215, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -850,6 +1015,9 @@ "log.offset": 9321, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -864,6 +1032,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -876,6 +1047,9 @@ "input.type": "log", "log.offset": 9487, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -897,6 +1071,9 @@ "log.offset": 9869, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -910,6 +1087,9 @@ "log.offset": 9975, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -922,6 +1102,9 @@ "input.type": "log", "log.offset": 10060, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -943,6 +1126,9 @@ "log.offset": 11099, "message": " vagrant : (command continued) '/etc/metricbeat/metricbeat.yml)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -956,6 +1142,9 @@ "log.offset": 11195, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -969,6 +1158,9 @@ "log.offset": 11301, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -983,6 +1175,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -997,6 +1192,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1009,6 +1207,9 @@ "input.type": "log", "log.offset": 11548, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1030,6 +1231,9 @@ "log.offset": 11928, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1043,6 +1247,9 @@ "log.offset": 12034, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1057,6 +1264,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1069,6 +1279,9 @@ "input.type": "log", "log.offset": 12200, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1090,6 +1303,9 @@ "log.offset": 12583, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1103,6 +1319,9 @@ "log.offset": 12689, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1117,6 +1336,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1129,6 +1351,9 @@ "input.type": "log", "log.offset": 12855, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1150,6 +1375,9 @@ "log.offset": 13241, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1163,6 +1391,9 @@ "log.offset": 13347, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1177,6 +1408,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1189,6 +1423,9 @@ "input.type": "log", "log.offset": 13513, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1210,6 +1447,9 @@ "log.offset": 13898, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1223,6 +1463,9 @@ "log.offset": 14004, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1237,6 +1480,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1249,6 +1495,9 @@ "input.type": "log", "log.offset": 14170, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1270,6 +1519,9 @@ "log.offset": 14549, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1283,6 +1535,9 @@ "log.offset": 14655, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1297,6 +1552,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1309,6 +1567,9 @@ "input.type": "log", "log.offset": 14821, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1330,6 +1591,9 @@ "log.offset": 15203, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1343,6 +1607,9 @@ "log.offset": 15309, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1357,6 +1624,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1369,6 +1639,9 @@ "input.type": "log", "log.offset": 15475, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1390,6 +1663,9 @@ "log.offset": 15860, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1403,6 +1679,9 @@ "log.offset": 15966, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1417,6 +1696,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1429,6 +1711,9 @@ "input.type": "log", "log.offset": 16132, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], @@ -1450,6 +1735,9 @@ "log.offset": 16517, "message": "pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1463,6 +1751,9 @@ "log.offset": 16623, "message": "pam_unix(sudo:session): session closed for user root", "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1477,6 +1768,9 @@ "message": "subsystem request for sftp by user vagrant", "process.name": "sshd", "process.pid": 8317, + "related.hosts": [ + "precise32" + ], "service.type": "system" }, { @@ -1489,6 +1783,9 @@ "input.type": "log", "log.offset": 16789, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "vagrant" ], diff --git a/filebeat/module/system/auth/test/secure-rhel7.log-expected.json b/filebeat/module/system/auth/test/secure-rhel7.log-expected.json index 5242ff398d9..7d8ece1d7f2 100644 --- a/filebeat/module/system/auth/test/secure-rhel7.log-expected.json +++ b/filebeat/module/system/auth/test/secure-rhel7.log-expected.json @@ -19,6 +19,9 @@ "log.offset": 0, "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -52,6 +55,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -74,6 +80,9 @@ "log.offset": 209, "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -107,6 +116,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -129,6 +141,9 @@ "log.offset": 418, "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -162,6 +177,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -176,6 +194,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -190,6 +211,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2738, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -204,6 +228,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -218,6 +245,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -240,6 +270,9 @@ "log.offset": 1105, "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -273,6 +306,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -295,6 +331,9 @@ "log.offset": 1314, "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -328,6 +367,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -350,6 +392,9 @@ "log.offset": 1523, "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -383,6 +428,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -405,6 +453,9 @@ "log.offset": 1732, "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -438,6 +489,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -460,6 +514,9 @@ "log.offset": 1941, "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -493,6 +550,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -507,6 +567,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -521,6 +584,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2742, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -535,6 +601,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -549,6 +618,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -563,6 +635,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.27 user=root", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -577,6 +652,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -599,6 +677,9 @@ "log.offset": 2889, "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -632,6 +713,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -654,6 +738,9 @@ "log.offset": 3098, "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -687,6 +774,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -709,6 +799,9 @@ "log.offset": 3306, "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -742,6 +835,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -764,6 +860,9 @@ "log.offset": 3515, "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -797,6 +896,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -819,6 +921,9 @@ "log.offset": 3723, "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -852,6 +957,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -874,6 +982,9 @@ "log.offset": 3932, "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -907,6 +1018,9 @@ "message": "Received disconnect from 116.31.116.27: 11: [preauth]", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -921,6 +1035,9 @@ "message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.27 user=root", "process.name": "sshd", "process.pid": 2758, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -943,6 +1060,9 @@ "log.offset": 4259, "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -976,6 +1096,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -998,6 +1121,9 @@ "log.offset": 4468, "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1031,6 +1157,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1045,6 +1174,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1059,6 +1191,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2754, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1073,6 +1208,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1087,6 +1225,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1109,6 +1250,9 @@ "log.offset": 5155, "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1142,6 +1286,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1164,6 +1311,9 @@ "log.offset": 5364, "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1197,6 +1347,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1219,6 +1372,9 @@ "log.offset": 5573, "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1252,6 +1408,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1274,6 +1433,9 @@ "log.offset": 5782, "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1307,6 +1469,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1329,6 +1494,9 @@ "log.offset": 5991, "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1362,6 +1530,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1376,6 +1547,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1390,6 +1564,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2762, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1404,6 +1581,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1418,6 +1598,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1440,6 +1623,9 @@ "log.offset": 6678, "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1473,6 +1659,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1495,6 +1684,9 @@ "log.offset": 6887, "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1528,6 +1720,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1550,6 +1745,9 @@ "log.offset": 7096, "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1583,6 +1781,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1605,6 +1806,9 @@ "log.offset": 7305, "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1638,6 +1842,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1660,6 +1867,9 @@ "log.offset": 7514, "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -1693,6 +1903,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1707,6 +1920,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1721,6 +1937,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2766, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1735,6 +1954,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.27 user=root", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1749,6 +1971,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1771,6 +1996,9 @@ "log.offset": 8199, "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -1804,6 +2032,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1826,6 +2057,9 @@ "log.offset": 8407, "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -1859,6 +2093,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1881,6 +2118,9 @@ "log.offset": 8615, "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.27" ], @@ -1914,6 +2154,9 @@ "message": "Received disconnect from 116.31.116.27: 11: [preauth]", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1928,6 +2171,9 @@ "message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.31.116.27 user=root", "process.name": "sshd", "process.pid": 2778, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1942,6 +2188,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1956,6 +2205,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -1978,6 +2230,9 @@ "log.offset": 9205, "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2011,6 +2266,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2033,6 +2291,9 @@ "log.offset": 9414, "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2066,6 +2327,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2088,6 +2352,9 @@ "log.offset": 9623, "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2121,6 +2388,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2143,6 +2413,9 @@ "log.offset": 9832, "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2176,6 +2449,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2198,6 +2474,9 @@ "log.offset": 10041, "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2231,6 +2510,9 @@ "message": "fatal: Read from socket failed: Connection reset by peer [preauth]", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2245,6 +2527,9 @@ "message": "PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2259,6 +2544,9 @@ "message": "PAM service(sshd) ignoring max retries; 5 > 3", "process.name": "sshd", "process.pid": 2785, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2273,6 +2561,9 @@ "message": "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.109.143.106 user=root", "process.name": "sshd", "process.pid": 2797, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2287,6 +2578,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2797, + "related.hosts": [ + "slave22" + ], "service.type": "system" }, { @@ -2309,6 +2603,9 @@ "log.offset": 10728, "process.name": "sshd", "process.pid": 2797, + "related.hosts": [ + "slave22" + ], "related.ip": [ "202.109.143.106" ], @@ -2342,6 +2639,9 @@ "message": "pam_succeed_if(sshd:auth): requirement \"uid >= 1000\" not met by user \"root\"", "process.name": "sshd", "process.pid": 2797, + "related.hosts": [ + "slave22" + ], "service.type": "system" } ] \ No newline at end of file diff --git a/filebeat/module/system/auth/test/test.log-expected.json b/filebeat/module/system/auth/test/test.log-expected.json index 0203b1a1f3b..88d32188bb7 100644 --- a/filebeat/module/system/auth/test/test.log-expected.json +++ b/filebeat/module/system/auth/test/test.log-expected.json @@ -19,6 +19,9 @@ "log.offset": 0, "process.name": "sshd", "process.pid": 3402, + "related.hosts": [ + "localhost" + ], "related.ip": [ "10.0.2.2" ], @@ -53,6 +56,9 @@ "log.offset": 152, "process.name": "sshd", "process.pid": 7483, + "related.hosts": [ + "localhost" + ], "related.ip": [ "192.168.33.1" ], @@ -86,6 +92,9 @@ "log.offset": 254, "process.name": "sshd", "process.pid": 3430, + "related.hosts": [ + "localhost" + ], "related.ip": [ "10.0.2.2" ], @@ -117,6 +126,9 @@ "log.offset": 324, "process.name": "sshd", "process.pid": 5774, + "related.hosts": [ + "slave22" + ], "related.ip": [ "116.31.116.24" ], @@ -148,6 +160,9 @@ "input.type": "log", "log.offset": 420, "process.name": "sudo", + "related.hosts": [ + "localhost" + ], "related.user": [ "vagrant" ], @@ -169,6 +184,9 @@ "log.offset": 522, "process.name": "sshd", "process.pid": 18406, + "related.hosts": [ + "slave22" + ], "related.ip": [ "123.57.245.163" ], @@ -195,6 +213,9 @@ "input.type": "log", "log.offset": 617, "process.name": "sudo", + "related.hosts": [ + "localhost" + ], "related.user": [ "vagrant" ], @@ -215,6 +236,9 @@ "input.type": "log", "log.offset": 736, "process.name": "sudo", + "related.hosts": [ + "precise32" + ], "related.user": [ "tsg" ], @@ -247,6 +271,9 @@ "log.offset": 861, "process.name": "groupadd", "process.pid": 6991, + "related.hosts": [ + "localhost" + ], "service.type": "system" }, { @@ -269,6 +296,9 @@ "log.offset": 934, "process.name": "useradd", "process.pid": 6995, + "related.hosts": [ + "localhost" + ], "related.user": [ "apache" ], diff --git a/filebeat/module/system/auth/test/timestamp.log-expected.json b/filebeat/module/system/auth/test/timestamp.log-expected.json index 8903b63e89e..4d428b4d1cc 100644 --- a/filebeat/module/system/auth/test/timestamp.log-expected.json +++ b/filebeat/module/system/auth/test/timestamp.log-expected.json @@ -12,6 +12,9 @@ "log.offset": 0, "message": "pam_unix(sudo-i:session): session opened for user root by userauth3(uid=0)", "process.name": "sudo", + "related.hosts": [ + "localhost" + ], "service.type": "system" }, { @@ -27,6 +30,9 @@ "log.offset": 118, "message": "user nobody logged out.", "process.name": "pam", + "related.hosts": [ + "localhost" + ], "service.type": "system" } ] \ No newline at end of file diff --git a/filebeat/module/system/syslog/config/syslog.yml b/filebeat/module/system/syslog/config/syslog.yml index 3cdbd459e68..13f8c95656d 100644 --- a/filebeat/module/system/syslog/config/syslog.yml +++ b/filebeat/module/system/syslog/config/syslog.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/system/syslog/ingest/pipeline.yml b/filebeat/module/system/syslog/ingest/pipeline.yml index e45cacec6b6..b1352f2ad62 100644 --- a/filebeat/module/system/syslog/ingest/pipeline.yml +++ b/filebeat/module/system/syslog/ingest/pipeline.yml @@ -54,6 +54,11 @@ processors: - set: field: event.kind value: event +- append: + field: related.hosts + value: "{{host.hostname}}" + if: "ctx.host?.hostname != null && ctx.host?.hostname != ''" + allow_duplicates: false on_failure: - set: field: error.message diff --git a/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json b/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json index 7fd9929cf9e..a5957f19b94 100644 --- a/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json +++ b/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json @@ -14,6 +14,9 @@ "message": "2016-12-13 11:35:28.420 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp updateProductWithProductID:usingEngine:] Checking for updates for \"All Products\" using engine \n\t\t>>\n\t\tprocessor=\n\t\t\tisProcessing=NO actionsCompleted=0 progress=0.00\n\t\t\terrors=0 currentActionErrors=0\n\t\t\tevents=0 currentActionEvents=0\n\t\t\tactionQueue=( )\n\t\t>\n\t\tdelegate=(null)\n\t\tserverInfoStore=(null)\n\t\terrors=0\n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -28,6 +31,9 @@ "message": "2016-12-13 11:35:28.421 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateEngine updateAllExceptProduct:] KSUpdateEngine updating all installed products, except:'com.google.Keystone'.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { diff --git a/filebeat/module/system/syslog/test/darwin-syslog.log-expected.json b/filebeat/module/system/syslog/test/darwin-syslog.log-expected.json index f1abb5047d5..6f12a7a5656 100644 --- a/filebeat/module/system/syslog/test/darwin-syslog.log-expected.json +++ b/filebeat/module/system/syslog/test/darwin-syslog.log-expected.json @@ -11,6 +11,9 @@ "message": "2016-12-13 11:35:28.419 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp performSelfUpdateWithEngine:] Finished self update check.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -28,6 +31,9 @@ "message": "2016-12-13 11:35:28.420 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp updateProductWithProductID:usingEngine:] Checking for updates for \"All Products\" using engine \n\t\t>>\n\t\tprocessor=\n\t\t\tisProcessing=NO actionsCompleted=0 progress=0.00\n\t\t\terrors=0 currentActionErrors=0\n\t\t\tevents=0 currentActionEvents=0\n\t\t\tactionQueue=( )\n\t\t>\n\t\tdelegate=(null)\n\t\tserverInfoStore=(null)\n\t\terrors=0\n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -42,6 +48,9 @@ "message": "2016-12-13 11:35:28.421 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateEngine updateAllExceptProduct:] KSUpdateEngine updating all installed products, except:'com.google.Keystone'.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -56,6 +65,9 @@ "message": "2016-12-13 11:35:28.422 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSCheckAction performAction] KSCheckAction checking 2 ticket(s).", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -73,6 +85,9 @@ "message": "2016-12-13 11:35:28.428 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateCheckAction performAction] KSUpdateCheckAction starting update check for ticket(s): {(\n\t\t\n\t\t\tserverType=Omaha\n\t\t\turl=https://tools.google.com/service/update2\n\t\t\tcreationDate=2015-06-25 15:40:23\n\t\t\ttagPath=/Applications/Google Chrome.app/Contents/Info.plist\n\t\t\ttagKey=KSChannelID\n\t\t\tbrandPath=/Users/tsg/Library/Google/Google Chrome Brand.plist\n\t\t\tbrandKey=KSBrandID\n\t\t\tversionPath=/Applications/Google Chrome.app/Contents/Info.plist\n\t\t\tversionKey=KSVersion\n\t\t\tcohort=1:1y5:gy3@0.05\n\t\t\tcohortName=Stable\n\t\t\tticketVersion=1\n\t\t>,\n\t\t\n\t\t\tserverType=Omaha\n\t\t\turl=https://tools.google.com/service/update2\n\t\t\tcreationDate=2015-09-11 20:38:12\n\t\t\tticketVersion=1\n\t\t>\n\t)}\n\tUsing server: \n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -87,6 +102,9 @@ "message": "2016-12-13 11:35:28.446 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] +[KSCodeSigningVerification verifyBundle:applicationId:error:] KSCodeSigningVerification verifying code signing for '/Applications/Google Chrome.app' with the requirement 'anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU]=\"EQHXZ8M8AV\" and (identifier=\"com.google.Chrome\")'", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -101,6 +119,9 @@ "message": "2016-12-13 11:35:29.430 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] +[KSCodeSigningVerification verifyBundle:applicationId:error:] KSCodeSigningVerification verifying code signing for '/Applications/Google Drive.app' with the requirement 'anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU]=\"EQHXZ8M8AV\" and (identifier=\"com.google.GoogleDrive\")'", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -118,6 +139,9 @@ "message": "2016-12-13 11:35:30.115 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateCheckAction performAction] KSUpdateCheckAction running KSServerUpdateRequest: \n\t\turl=\"https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822\"\n\t\tfallbackURLs=(\n\t\t\thttp://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1617080069\n\t\t)\n\t\trunningFetchers=0\n\t\ttickets=2\n\t\tbody=\n\t\t\t\n\t\t\t\n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t\n\t\theaders={\n\t\t\t\"X-GoogleUpdate-Interactivity\" = bg;\n\t\t}\n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -132,6 +156,9 @@ "message": "2016-12-13 11:35:30.116 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher beginFetchWithDelegate:] KSOutOfProcessFetcher start fetch from URL: \"https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822\"", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -146,6 +173,9 @@ "message": "2016-12-13 11:35:30.117 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher(PrivateMethods) launchedHelperTaskForToolPath:error:] KSOutOfProcessFetcher launched '/Users/tsg/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch' with process id: 21414", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -160,6 +190,9 @@ "message": "2016-12-13 11:35:30.118 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher beginFetchWithDelegate:] KSOutOfProcessFetcher sending both request and download file location to the helper.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -174,6 +207,9 @@ "message": "2016-12-13 11:35:30.118 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] KSSendAllDataToHelper() KSHelperTool wrote 2383 bytes to the helper input.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -188,6 +224,9 @@ "message": "2016-12-13 11:35:30.118 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher beginFetchWithDelegate:] Closing the file handle.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -202,6 +241,9 @@ "message": "2016-12-13 11:35:30.118 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher beginFetchWithDelegate:] KSOutOfProcessFetcher fetching from URL: \"https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822\"", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -216,6 +258,9 @@ "message": "2016-12-13 11:35:30.149 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] KSHelperReceiveAllData() KSHelperTool read 2383 bytes from stdin.", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -230,6 +275,9 @@ "message": "2016-12-13 11:35:30.151 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() Fetcher received a request: { URL: https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822 }", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -244,6 +292,9 @@ "message": "2016-12-13 11:35:30.151 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() Fetcher received a download path: /tmp/KSOutOfProcessFetcher.QTqOLkktQz/download", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -258,6 +309,9 @@ "message": "2016-12-13 11:35:30.152 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() ksfetch fetching URL ( { URL: https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822 }) to folder:/tmp/KSOutOfProcessFetcher.QTqOLkktQz/download", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -272,6 +326,9 @@ "message": "2016-12-13 11:35:30.152 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() Setting up download file handles...", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -286,6 +343,9 @@ "message": "2016-12-13 11:35:30.348 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] -[FetchDelegate fetcher:finishedWithData:] Fetcher downloaded successfully data of length: 0", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -300,6 +360,9 @@ "message": "2016-12-13 11:35:30.348 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() ksfetch done fetching.", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -314,6 +377,9 @@ "message": "2016-12-13 11:35:30.351 ksfetch[21414/0x7fffcc3f93c0] [lvl=2] main() Fetcher is exiting.", "process.name": "ksfetch", "process.pid": 21414, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -331,6 +397,9 @@ "message": "2016-12-13 11:35:30.354 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher(PrivateMethods) helperErrorAvailable:] KSOutOfProcessFetcher helper tool raw STDERR:\n\t:\t<>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -345,6 +414,9 @@ "message": "2016-12-13 11:35:30.354 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOutOfProcessFetcher(PrivateMethods) helperDidTerminate:] KSOutOfProcessFetcher fetch ended for URL: \"https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822\"", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -362,6 +434,9 @@ "message": "2016-12-13 11:35:30.355 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateCheckAction(KSServerUpdateRequestDelegate) serverRequest:fetchedWithResponse:] KSUpdateCheckAction received KSServerUpdateResponse: \n\t\turl=\"https://tools.google.com/service/update2?cup2hreq=423332d883f010d5b10e169646ed851278047f76e6c5d4dbfa2233ef66e3b141&cup2key=6:1566315822\"\n\t\ttickets=2\n\t\tstatus=200\n\t\tdata=\n\t\t\t\n\t\t\t\n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t \n\t\t\t\n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -376,6 +451,9 @@ "message": "2016-12-13 11:35:30.356 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSOmahaServer updateInfosForUpdateResponse:updateRequest:infoStore:upToDateTickets:updatedTickets:events:errors:] Response passed CUP validation.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -390,6 +468,9 @@ "message": "2016-12-13 11:35:30.381 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateCheckAction(PrivateMethods) finishAction] KSUpdateCheckAction found updates: {( )}", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -404,6 +485,9 @@ "message": "2016-12-13 11:35:30.384 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSPrefetchAction performAction] KSPrefetchAction no updates to prefetch.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -418,6 +502,9 @@ "message": "2016-12-13 11:35:30.384 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSMultiUpdateAction performAction] KSSilentUpdateAction had no updates to apply.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -432,6 +519,9 @@ "message": "2016-12-13 11:35:30.384 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSMultiUpdateAction performAction] KSPromptAction had no updates to apply.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -446,6 +536,9 @@ "message": "2016-12-13 11:35:30.384 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp(KeystoneDelegate) updateEngineFinishedWithErrors:] Keystone finished: errors=0", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -460,6 +553,9 @@ "message": "2016-12-13 11:35:30.385 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateEngine(PrivateMethods) updateFinish] KSUpdateEngine update processing complete.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -477,6 +573,9 @@ "message": "2016-12-13 11:35:31.142 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp updateProductWithProductID:usingEngine:] Done checking for updates for '\"All Products\"' using engine \n\t\t>>\n\t\tprocessor=\n\t\t\tisProcessing=NO actionsCompleted=0 progress=0.00\n\t\t\terrors=0 currentActionErrors=0\n\t\t\tevents=0 currentActionEvents=0\n\t\t\tactionQueue=( )\n\t\t>\n\t\tdelegate=\n\t\tserverInfoStore=\n\t\terrors=0\n\t>", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -491,6 +590,9 @@ "message": "2016-12-13 11:35:31.302 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentUploader fetcher:finishedWithData:] Successfully uploaded stats to { URL: https://tools.google.com/service/update2 }", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -508,6 +610,9 @@ "message": "2016-12-13 11:35:31.431 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp uploadStats:] Successfully uploaded stats ", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -522,6 +627,9 @@ "message": "2016-12-13 11:35:32.508 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp(KeystoneThread) runKeystonesInThreadWithArg:] Finished with engine thread", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -536,6 +644,9 @@ "message": "2016-12-13 11:35:32.825 GoogleSoftwareUpdateAgent[21412/0x7fffcc3f93c0] [lvl=2] -[KSAgentApp checkForUpdates] Finished update check.", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 21412, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -550,6 +661,9 @@ "message": "objc[85294]: __weak variable at 0x60000a8499d0 holds 0x2121212121212121 instead of 0x600006a22fa0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -564,6 +678,9 @@ "message": "objc[85294]: __weak variable at 0x60800f047240 holds 0x2121212121212121 instead of 0x608002231220. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -577,6 +694,9 @@ "log.offset": 15501, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21498])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -591,6 +711,9 @@ "message": "objc[85294]: __weak variable at 0x60000a256990 holds 0x2121212121212121 instead of 0x600006a22420. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -605,6 +728,9 @@ "message": "objc[85294]: __weak variable at 0x6080096475d0 holds 0x2121212121212121 instead of 0x608004e21280. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -619,6 +745,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -632,6 +761,9 @@ "log.offset": 16312, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21556])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -645,6 +777,9 @@ "log.offset": 16527, "message": "Unknown key for integer: _DirtyJetsamMemoryLimit", "process.name": "com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent)", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -659,6 +794,9 @@ "message": "objc[85294]: __weak variable at 0x60000a85a860 holds 0x2121212121212121 instead of 0x600004a3b9a0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -672,6 +810,9 @@ "log.offset": 16952, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21581])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -686,6 +827,9 @@ "message": "objc[85294]: __weak variable at 0x608009840580 holds 0x2121212121212121 instead of 0x608004a22940. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -700,6 +844,9 @@ "message": "objc[85294]: __weak variable at 0x608009c5b700 holds 0x2121212121212121 instead of 0x608005830020. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -713,6 +860,9 @@ "log.offset": 17693, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21586])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -727,6 +877,9 @@ "message": "objc[85294]: __weak variable at 0x60800ee592d0 holds 0x2121212121212121 instead of 0x608005627220. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -741,6 +894,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -755,6 +911,9 @@ "message": "objc[85294]: __weak variable at 0x60000c648290 holds 0x2121212121212121 instead of 0x6000050242a0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -768,6 +927,9 @@ "log.offset": 18504, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21589])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -782,6 +944,9 @@ "message": "objc[85294]: __weak variable at 0x600009840460 holds 0x2121212121212121 instead of 0x60000122e940. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -795,6 +960,9 @@ "log.offset": 18982, "message": "Unknown key for integer: _DirtyJetsamMemoryLimit", "process.name": "com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent)", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -809,6 +977,9 @@ "message": "objc[85294]: __weak variable at 0x60000ee5b730 holds 0x2121212121212121 instead of 0x600007821c20. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -822,6 +993,9 @@ "log.offset": 19407, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21946])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -836,6 +1010,9 @@ "message": "objc[85294]: __weak variable at 0x600006a49940 holds 0x2121212121212121 instead of 0x6000078202e0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -850,6 +1027,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -864,6 +1044,9 @@ "message": "Invoked notification with id: d63743fb-f17b-4e9e-97d0-88e0e7304682", "process.name": "Slack Helper", "process.pid": 55199, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -877,6 +1060,9 @@ "log.offset": 20078, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21966])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -891,6 +1077,9 @@ "message": "objc[85294]: __weak variable at 0x60800f043dc0 holds 0x2121212121212121 instead of 0x6080026228c0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -904,6 +1093,9 @@ "log.offset": 20556, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[21981])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -918,6 +1110,9 @@ "message": "objc[85294]: __weak variable at 0x608009a53600 holds 0x2121212121212121 instead of 0x608000629420. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -932,6 +1127,9 @@ "message": "objc[85294]: __weak variable at 0x60800f259c30 holds 0x2121212121212121 instead of 0x608004a21c20. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -946,6 +1144,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -959,6 +1160,9 @@ "log.offset": 21367, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22226])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -973,6 +1177,9 @@ "message": "objc[85294]: __weak variable at 0x60000c647d80 holds 0x2121212121212121 instead of 0x600006e3ee80. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -987,6 +1194,9 @@ "message": "objc[85294]: __weak variable at 0x60800f053a80 holds 0x2121212121212121 instead of 0x608007227ce0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1000,6 +1210,9 @@ "log.offset": 22108, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22241])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1014,6 +1227,9 @@ "message": "objc[85294]: __weak variable at 0x60000a64ce80 holds 0x2121212121212121 instead of 0x600006629940. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1028,6 +1244,9 @@ "message": "objc[85294]: __weak variable at 0x60000a843580 holds 0x2121212121212121 instead of 0x600006629540. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1041,6 +1260,9 @@ "log.offset": 22849, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22254])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1055,6 +1277,9 @@ "message": "objc[85294]: __weak variable at 0x60800f45b910 holds 0x2121212121212121 instead of 0x608005822c40. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1069,6 +1294,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1082,6 +1310,9 @@ "log.offset": 23397, "message": "Unknown key for integer: _DirtyJetsamMemoryLimit", "process.name": "com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent)", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1096,6 +1327,9 @@ "message": "objc[85294]: __weak variable at 0x60000ea5edf0 holds 0x2121212121212121 instead of 0x600003a35a60. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1109,6 +1343,9 @@ "log.offset": 23822, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22265])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1123,6 +1360,9 @@ "message": "Invoked notification with id: 52bf37d9-0c4e-4276-8789-9fc7704bdf5b", "process.name": "Slack Helper", "process.pid": 55199, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1136,6 +1376,9 @@ "log.offset": 24160, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22292])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1150,6 +1393,9 @@ "message": "Invoked notification with id: c6c7e356-60a7-4b9e-a9b1-ecc2b8ad09f2", "process.name": "Slack Helper", "process.pid": 55199, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1164,6 +1410,9 @@ "message": "objc[85294]: __weak variable at 0x60800f246430 holds 0x2121212121212121 instead of 0x608001c26d00. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1178,6 +1427,9 @@ "message": "objc[85294]: __weak variable at 0x60800c85fd80 holds 0x2121212121212121 instead of 0x608005a3a420. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1192,6 +1444,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1205,6 +1460,9 @@ "log.offset": 25094, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22305])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1219,6 +1477,9 @@ "message": "objc[85294]: __weak variable at 0x600006452400 holds 0x2121212121212121 instead of 0x60000763bac0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1233,6 +1494,9 @@ "message": "2016-12-13 12:35:56.416 GoogleSoftwareUpdateAgent[22318/0x7fffcc3f93c0] [lvl=2] -[KSAgentApp setupLoggerOutput] Agent settings: ", "process.name": "GoogleSoftwareUpdateAgent", "process.pid": 22318, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1246,6 +1510,9 @@ "log.offset": 26456, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22324])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1260,6 +1527,9 @@ "message": "objc[85294]: __weak variable at 0x60800f24d0f0 holds 0x2121212121212121 instead of 0x608007423ee0. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1274,6 +1544,9 @@ "message": "Invoked notification with id: aa608788-d049-4d1a-9112-521c71702371", "process.name": "Slack Helper", "process.pid": 55199, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1287,6 +1560,9 @@ "log.offset": 27057, "message": "Unknown key for integer: _DirtyJetsamMemoryLimit", "process.name": "com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent)", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1301,6 +1577,9 @@ "message": "Invoked notification with id: d75f9ec1-a8fd-41c2-a45e-6df2952f0702", "process.name": "Slack Helper", "process.pid": 55199, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1314,6 +1593,9 @@ "log.offset": 27342, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22336])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1328,6 +1610,9 @@ "message": "objc[85294]: __weak variable at 0x60800a2535a0 holds 0x2121212121212121 instead of 0x608003828e20. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1342,6 +1627,9 @@ "message": "ASL Sender Statistics", "process.name": "syslogd", "process.pid": 46, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1356,6 +1644,9 @@ "message": "objc[85294]: __weak variable at 0x60800f241d50 holds 0x2121212121212121 instead of 0x60800562f380. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1369,6 +1660,9 @@ "log.offset": 28153, "message": "Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook", "process.name": "com.apple.xpc.launchd[1] (com.apple.quicklook[22348])", + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1383,6 +1677,9 @@ "message": "objc[85294]: __weak variable at 0x60000c444450 holds 0x2121212121212121 instead of 0x600007237f00. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" }, { @@ -1397,6 +1694,9 @@ "message": "objc[85294]: __weak variable at 0x60000c4424a0 holds 0x2121212121212121 instead of 0x600007026520. This is probably incorrect use of objc_storeWeak() and objc_loadWeak(). Break on objc_weak_error to debug.", "process.name": "Google Chrome", "process.pid": 85294, + "related.hosts": [ + "a-mac-with-esc-key" + ], "service.type": "system" } ] \ No newline at end of file diff --git a/filebeat/module/system/syslog/test/suse-syslog.log-expected.json b/filebeat/module/system/syslog/test/suse-syslog.log-expected.json index 48cbc44161b..4090efed2e7 100644 --- a/filebeat/module/system/syslog/test/suse-syslog.log-expected.json +++ b/filebeat/module/system/syslog/test/suse-syslog.log-expected.json @@ -11,6 +11,9 @@ "message": "Stopped target Basic System.", "process.name": "systemd", "process.pid": 4179, + "related.hosts": [ + "linux-sqrz" + ], "service.type": "system" }, { @@ -25,6 +28,9 @@ "message": "Stopped target Paths.", "process.name": "systemd", "process.pid": 4179, + "related.hosts": [ + "linux-sqrz" + ], "service.type": "system" } ] \ No newline at end of file diff --git a/filebeat/module/system/syslog/test/tz-offset.log-expected.json b/filebeat/module/system/syslog/test/tz-offset.log-expected.json index 2dfd146dedc..905d8cfd95d 100644 --- a/filebeat/module/system/syslog/test/tz-offset.log-expected.json +++ b/filebeat/module/system/syslog/test/tz-offset.log-expected.json @@ -13,6 +13,9 @@ "message": "shutting down for system halt", "process.name": "shutdown", "process.pid": 2649, + "related.hosts": [ + "rmbkmonitor04" + ], "service.type": "system" }, { @@ -28,6 +31,9 @@ "log.offset": 89, "message": "constraint_0_power_limit_uw exceeded.", "process.name": "thermald", + "related.hosts": [ + "rmbkmonitor04" + ], "service.type": "system" }, { @@ -43,6 +49,9 @@ "log.offset": 184, "message": "pam_unix(sudo-i:session): session opened for user root by userauth3(uid=0)", "process.name": "sudo", + "related.hosts": [ + "localhost" + ], "service.type": "system" } ] \ No newline at end of file diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml b/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml index c93494c2dbb..cdafe4ebde0 100644 --- a/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml +++ b/x-pack/filebeat/module/barracuda/spamfirewall/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml b/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml index 67018925f0f..2ae84bd17e5 100644 --- a/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml +++ b/x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{url.domain}}' + if: ctx?.url?.domain != null && ctx?.url?.domain != "" + allow_duplicates: false + - append: + field: related.hosts + value: '{{server.domain}}' + if: ctx?.server?.domain != null && ctx?.url?.domain != "" + allow_duplicates: false on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json index 247344bdbfe..ff70486fab5 100644 --- a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json +++ b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json @@ -46,6 +46,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "etdo" + ], "related.ip": [ "10.173.228.223" ], @@ -256,6 +259,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "tempor" + ], "related.ip": [ "10.138.137.28" ], @@ -296,6 +302,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "ari" + ], "related.ip": [ "10.108.180.105" ], @@ -422,6 +431,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "aveniam" + ], "related.ip": [ "10.82.201.113" ], @@ -484,8 +496,8 @@ "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", "related.ip": [ - "10.110.109.5", - "10.18.165.35" + "10.18.165.35", + "10.110.109.5" ], "rsa.internal.messageid": "outbound/smtp", "rsa.investigations.event_cat": 1901000000, @@ -518,6 +530,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "dolore" + ], "related.ip": [ "10.195.109.134" ], @@ -857,6 +872,10 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "hitect", + "lit5929.test" + ], "related.ip": [ "10.198.6.166" ], @@ -937,6 +956,10 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "equat", + "uptat3156.www5.test" + ], "related.ip": [ "10.77.137.72" ], @@ -980,6 +1003,10 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "vitaedi", + "neav6028.internal.domain" + ], "related.ip": [ "10.128.114.77" ], @@ -1225,6 +1252,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "olupta" + ], "related.ip": [ "10.98.92.244" ], @@ -1423,6 +1453,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "tquov" + ], "related.ip": [ "10.211.93.62" ], @@ -1480,6 +1513,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "qui" + ], "related.ip": [ "10.199.182.123" ], @@ -1824,6 +1860,10 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "aveni", + "oremagna3521.mail.home" + ], "related.ip": [ "10.29.155.171" ], @@ -2509,6 +2549,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "obeataev" + ], "related.ip": [ "10.139.127.232" ], @@ -2550,6 +2593,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "inv" + ], "related.ip": [ "10.163.209.70" ], @@ -2719,6 +2765,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "eritatis" + ], "related.ip": [ "10.209.184.60" ], @@ -2818,6 +2867,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "plic" + ], "related.ip": [ "10.17.87.79" ], @@ -2933,6 +2985,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "taedi" + ], "related.ip": [ "10.17.98.243" ], @@ -3209,6 +3264,10 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "der", + "piciatis2460.api.host" + ], "related.ip": [ "10.77.182.191" ], @@ -3251,6 +3310,9 @@ "observer.product": "Spam", "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", + "related.hosts": [ + "iame" + ], "related.ip": [ "10.193.110.71" ], diff --git a/x-pack/filebeat/module/barracuda/waf/config/input.yml b/x-pack/filebeat/module/barracuda/waf/config/input.yml index 30e0d5f2745..d90859f5f61 100644 --- a/x-pack/filebeat/module/barracuda/waf/config/input.yml +++ b/x-pack/filebeat/module/barracuda/waf/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/bluecoat/director/config/input.yml b/x-pack/filebeat/module/bluecoat/director/config/input.yml index 7fc587fb028..3e7d940acf9 100644 --- a/x-pack/filebeat/module/bluecoat/director/config/input.yml +++ b/x-pack/filebeat/module/bluecoat/director/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/bluecoat/director/ingest/pipeline.yml b/x-pack/filebeat/module/bluecoat/director/ingest/pipeline.yml index 9d462241ae8..97fbbb72c92 100644 --- a/x-pack/filebeat/module/bluecoat/director/ingest/pipeline.yml +++ b/x-pack/filebeat/module/bluecoat/director/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/bluecoat/director/test/generated.log-expected.json b/x-pack/filebeat/module/bluecoat/director/test/generated.log-expected.json index 94a001da91a..1d0de305beb 100644 --- a/x-pack/filebeat/module/bluecoat/director/test/generated.log-expected.json +++ b/x-pack/filebeat/module/bluecoat/director/test/generated.log-expected.json @@ -247,6 +247,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "seq3874.mail.domain" + ], "rsa.internal.messageid": "dmd", "rsa.misc.change_new": "fug", "rsa.misc.change_old": "quid", @@ -988,6 +991,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "elitse6672.internal.localdomain" + ], "rsa.db.index": "mquisno", "rsa.internal.event_desc": "info on device connection", "rsa.internal.messageid": "ccd", @@ -1218,6 +1224,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "itation4168.api.domain" + ], "rsa.db.index": "dipisci", "rsa.internal.event_desc": "This file is automatically generated", "rsa.internal.messageid": "configd", @@ -1569,6 +1578,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "sBonor2001.www5.example" + ], "rsa.internal.messageid": "dmd", "rsa.misc.client": "dmd:", "rsa.misc.severity": "medium", @@ -1639,6 +1651,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "ersp6625.internal.domain" + ], "rsa.internal.messageid": "dmd", "rsa.misc.client": "dmd:", "rsa.misc.severity": "high", @@ -1754,6 +1769,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "eleumiu2454.api.local" + ], "rsa.db.index": "tat", "rsa.internal.event_desc": "info on device connection", "rsa.internal.messageid": "ccd", @@ -1866,6 +1884,9 @@ "observer.product": "Director", "observer.type": "Configuration", "observer.vendor": "Bluecoat", + "related.hosts": [ + "olu5333.www.domain" + ], "rsa.db.index": "orumSe", "rsa.internal.event_desc": "info on device connection", "rsa.internal.messageid": "ccd", diff --git a/x-pack/filebeat/module/cisco/asa/config/input.yml b/x-pack/filebeat/module/cisco/asa/config/input.yml index 0cffa76a01f..b5271fe8598 100644 --- a/x-pack/filebeat/module/cisco/asa/config/input.yml +++ b/x-pack/filebeat/module/cisco/asa/config/input.yml @@ -23,4 +23,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json index 8d8b28fe30f..73d42d43af7 100644 --- a/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json @@ -40,6 +40,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -95,6 +98,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -140,6 +146,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -184,6 +193,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2" ], @@ -223,6 +235,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2" ], @@ -265,6 +280,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -317,6 +335,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -370,6 +391,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.192.18.4", "10.192.70.66" @@ -415,6 +439,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -463,6 +490,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.192.18.4" @@ -501,6 +531,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -536,6 +569,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -574,6 +610,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -615,6 +654,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10" ], @@ -657,6 +699,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10" ], @@ -699,6 +744,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.192.46.90", "10.10.10.10" @@ -743,6 +791,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -796,6 +847,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -850,6 +904,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -902,6 +959,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -949,6 +1009,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -995,6 +1058,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -1043,6 +1109,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1105,6 +1174,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.186.2.2" @@ -1159,6 +1231,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -1214,6 +1289,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -1265,6 +1343,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -1311,6 +1392,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1358,6 +1442,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1403,6 +1490,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1448,6 +1538,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1493,6 +1586,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1531,6 +1627,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1562,6 +1661,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1595,6 +1697,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1628,6 +1733,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1671,6 +1779,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1721,6 +1832,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "192.168.2.2", "10.10.10.10" @@ -1759,6 +1873,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1790,6 +1907,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1828,6 +1948,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -1866,6 +1989,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1897,6 +2023,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -1939,6 +2068,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "10.10.10.10" @@ -1983,6 +2115,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -2025,6 +2160,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "10.10.10.10" @@ -2072,6 +2210,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.10", "192.168.2.2" @@ -2114,6 +2255,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.20.30.40", "10.20.30.40" @@ -2156,6 +2300,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.20.30.40", "10.20.30.40" @@ -2198,6 +2345,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.20.30.40", "10.20.30.40" @@ -2240,6 +2390,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.20.30.40", "10.20.30.40" @@ -2302,6 +2455,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "1.2.3.4", "2.3.4.5" @@ -2359,6 +2515,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.10.2", "192.168.2.2" @@ -2418,6 +2577,10 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01", + "somedomainname.local" + ], "related.ip": [ "195.122.12.242" ], @@ -2456,6 +2619,10 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01", + "console" + ], "service.type": "cisco", "source.address": "console", "source.domain": "console", @@ -2491,6 +2658,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.0.87" ], @@ -2530,6 +2700,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -2568,6 +2741,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.1.212", "10.10.1.254" @@ -2609,6 +2785,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.0.87" ], @@ -2652,6 +2831,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.0.87", "10.10.1.254" @@ -2693,6 +2875,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "10.10.0.87" ], @@ -2729,6 +2914,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "91.240.17.178" ], @@ -2789,6 +2977,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "91.240.17.178" ], @@ -2826,6 +3017,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "8.8.8.8" ], @@ -2869,6 +3063,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "8.8.8.8" ], @@ -2928,6 +3125,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "dev01" + ], "related.ip": [ "104.46.88.19", "195.74.114.34" diff --git a/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json index 90ec4ed3a8f..94f2b616d27 100644 --- a/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json @@ -40,6 +40,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.233.123.123" @@ -89,6 +92,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" @@ -187,6 +193,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" @@ -229,6 +238,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" @@ -274,6 +286,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "fe80::1ff:fe23:4567:890a" ], diff --git a/x-pack/filebeat/module/cisco/asa/test/asa.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/asa.log-expected.json index 18ea450c55f..ea4dcecdef3 100644 --- a/x-pack/filebeat/module/cisco/asa/test/asa.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/asa.log-expected.json @@ -37,6 +37,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -94,6 +97,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.104", "172.31.98.44" @@ -151,6 +157,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -208,6 +217,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -265,6 +277,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.185.90", "172.31.98.44" @@ -322,6 +337,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.185.90", "172.31.98.44" @@ -379,6 +397,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.160.197", "172.31.98.44" @@ -436,6 +457,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.14", "172.31.98.44" @@ -493,6 +517,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.33", "172.31.98.44" @@ -550,6 +577,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.35.9", "172.31.98.44" @@ -607,6 +637,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -664,6 +697,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.218.21", "172.31.98.44" @@ -721,6 +757,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.27", "172.31.98.44" @@ -778,6 +817,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.27", "172.31.98.44" @@ -835,6 +877,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.202.211", "172.31.98.44" @@ -892,6 +937,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.15", "172.31.98.44" @@ -949,6 +997,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.15", "172.31.98.44" @@ -1006,6 +1057,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.209.247", "172.31.98.44" @@ -1063,6 +1117,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.35.162", "172.31.98.44" @@ -1114,6 +1171,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1171,6 +1231,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.80.32", "172.31.98.44" @@ -1228,6 +1291,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.80.32", "172.31.98.44" @@ -1285,6 +1351,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.6", "172.31.98.44" @@ -1342,6 +1411,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.6", "172.31.98.44" @@ -1393,6 +1465,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1450,6 +1525,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.226", "172.31.98.44" @@ -1501,6 +1579,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1558,6 +1639,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.226", "172.31.98.44" @@ -1615,6 +1699,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.238.126", "172.31.98.44" @@ -1672,6 +1759,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.93.51", "172.31.98.44" @@ -1729,6 +1819,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.238.126", "172.31.98.44" @@ -1786,6 +1879,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.93.51", "172.31.98.44" @@ -1837,6 +1933,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1894,6 +1993,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.225.103", "172.31.98.44" @@ -1945,6 +2047,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2002,6 +2107,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.240.126", "172.31.98.44" @@ -2059,6 +2167,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.44.45", "172.31.98.44" @@ -2116,6 +2227,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.240.126", "172.31.98.44" @@ -2173,6 +2287,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.44.45", "172.31.98.44" @@ -2224,6 +2341,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2281,6 +2401,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.179.219", "172.31.98.44" @@ -2338,6 +2461,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2395,6 +2521,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.178.133", "172.31.98.44" @@ -2452,6 +2581,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2509,6 +2641,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.178.133", "172.31.98.44" @@ -2560,6 +2695,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2617,6 +2755,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.133.112", "172.31.98.44" @@ -2674,6 +2815,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.133.112", "172.31.98.44" @@ -2731,6 +2875,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.204.197", "172.31.98.44" @@ -2788,6 +2935,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2845,6 +2995,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.204.197", "172.31.98.44" @@ -2896,6 +3049,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2953,6 +3109,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -3004,6 +3163,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3061,6 +3223,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -3112,6 +3277,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3169,6 +3337,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -3226,6 +3397,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.100.4", "172.31.98.44" @@ -3283,6 +3457,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.100.4", "172.31.98.44" @@ -3334,6 +3511,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3391,6 +3571,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3442,6 +3625,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3499,6 +3685,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3556,6 +3745,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.1.107", "172.31.98.44" @@ -3613,6 +3805,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3664,6 +3859,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3721,6 +3919,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3778,6 +3979,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.1.107", "172.31.98.44" @@ -3829,6 +4033,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3886,6 +4093,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.192.44", "172.31.98.44" @@ -3928,6 +4138,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -3972,6 +4185,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.156.80", "100.66.98.44" @@ -4029,6 +4245,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.156.80" @@ -4071,6 +4290,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4106,6 +4328,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4141,6 +4366,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4176,6 +4404,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4211,6 +4442,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4246,6 +4480,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -4296,6 +4533,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.115.46", "172.31.156.80" @@ -4353,6 +4593,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.156.80" @@ -4404,6 +4647,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.156.80", "100.66.98.44" @@ -4461,6 +4707,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.115.46", "172.31.156.80" @@ -4515,6 +4764,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4569,6 +4821,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4623,6 +4878,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4677,6 +4935,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4731,6 +4992,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4785,6 +5049,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4839,6 +5106,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4893,6 +5163,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4947,6 +5220,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5001,6 +5277,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5055,6 +5334,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5109,6 +5391,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5163,6 +5448,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5214,6 +5502,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -5271,6 +5562,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.99", "172.31.98.44" @@ -5322,6 +5616,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -5379,6 +5676,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.14.30", "172.31.98.44" diff --git a/x-pack/filebeat/module/cisco/asa/test/filtered.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/filtered.log-expected.json index e0c78694ae9..948f6c85ab4 100644 --- a/x-pack/filebeat/module/cisco/asa/test/filtered.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/filtered.log-expected.json @@ -26,6 +26,9 @@ "observer.vendor": "Cisco", "process.name": "asa", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "service.type": "cisco", "tags": [ "cisco-asa", @@ -69,6 +72,9 @@ "observer.vendor": "Cisco", "process.name": "asa", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "related.ip": [ "10.13.12.11", "192.168.33.12" diff --git a/x-pack/filebeat/module/cisco/asa/test/hostnames.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/hostnames.log-expected.json index 7d010afe62c..70df45cbf91 100644 --- a/x-pack/filebeat/module/cisco/asa/test/hostnames.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/hostnames.log-expected.json @@ -31,6 +31,11 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "localhost", + "target.destination.hostname.local", + "Prod-host.name.addr" + ], "service.type": "cisco", "source.domain": "Prod-host.name.addr", "source.nat.ip": "10.0.55.66", @@ -73,6 +78,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "MYHOSTNAME" + ], "related.ip": [ "192.0.2.134", "192.0.2.15" diff --git a/x-pack/filebeat/module/cisco/asa/test/not-ip.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/not-ip.log-expected.json index 74097780ab2..85bfef8b52a 100644 --- a/x-pack/filebeat/module/cisco/asa/test/not-ip.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/not-ip.log-expected.json @@ -36,6 +36,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "WHAT-IS-THIS-A-HOSTNAME-192.0.2.244" + ], "related.ip": [ "203.0.113.42" ], @@ -82,6 +85,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "localhost" + ], "related.ip": [ "192.168.132.46", "172.24.177.29" @@ -140,6 +146,10 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "localhost", + "example.org" + ], "related.ip": [ "10.10.10.1", "172.24.177.3" diff --git a/x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json index d27f89ab5b9..fcf7d339222 100644 --- a/x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/sample.log-expected.json @@ -189,6 +189,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "INT-FW01" + ], "related.ip": [ "172.29.2.101", "192.0.2.10" @@ -241,6 +244,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "INT-FW01" + ], "related.ip": [ "172.29.2.3", "192.0.2.57" @@ -700,6 +706,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "FJSG2NRFW01" + ], "related.ip": [ "192.168.132.46", "172.24.177.29" @@ -2154,6 +2163,9 @@ "observer.type": "firewall", "observer.vendor": "Cisco", "process.name": "", + "related.hosts": [ + "OCSP_Server" + ], "related.ip": [ "192.0.2.222" ], @@ -2207,6 +2219,9 @@ "observer.type": "firewall", "observer.vendor": "Cisco", "process.name": "", + "related.hosts": [ + "OCSP_Server" + ], "related.ip": [ "192.0.2.222" ], @@ -2772,6 +2787,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2817,6 +2835,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -2862,6 +2883,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2907,6 +2931,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2952,6 +2979,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -2997,6 +3027,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -3042,6 +3075,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.168.1.255" @@ -3087,6 +3123,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.168.1.255" @@ -3138,6 +3177,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "192.0.2.95", "10.32.112.125" @@ -3186,6 +3228,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "10.2.3.5" ], @@ -3285,6 +3330,9 @@ "observer.product": "asa", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "bad.example.com" + ], "related.ip": [ "10.1.1.45", "192.88.99.129" diff --git a/x-pack/filebeat/module/cisco/ftd/config/input.yml b/x-pack/filebeat/module/cisco/ftd/config/input.yml index a505d3030eb..4892400a8b9 100644 --- a/x-pack/filebeat/module/cisco/ftd/config/input.yml +++ b/x-pack/filebeat/module/cisco/ftd/config/input.yml @@ -22,4 +22,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cisco/ftd/test/asa-fix.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/asa-fix.log-expected.json index 21dc57d3315..72b115c6975 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/asa-fix.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/asa-fix.log-expected.json @@ -41,6 +41,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.233.123.123" @@ -91,6 +94,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" @@ -191,6 +197,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" @@ -234,6 +243,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "SNL-ASA-VPN-A01" + ], "related.ip": [ "10.123.123.123", "10.123.123.123" diff --git a/x-pack/filebeat/module/cisco/ftd/test/asa.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/asa.log-expected.json index b1b3a633ad1..70e87e332d9 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/asa.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/asa.log-expected.json @@ -36,6 +36,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -92,6 +95,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.104", "172.31.98.44" @@ -148,6 +154,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -204,6 +213,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -260,6 +272,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.185.90", "172.31.98.44" @@ -316,6 +331,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.185.90", "172.31.98.44" @@ -372,6 +390,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.160.197", "172.31.98.44" @@ -428,6 +449,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.14", "172.31.98.44" @@ -484,6 +508,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.33", "172.31.98.44" @@ -540,6 +567,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.35.9", "172.31.98.44" @@ -596,6 +626,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.211.242", "172.31.98.44" @@ -652,6 +685,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.218.21", "172.31.98.44" @@ -708,6 +744,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.27", "172.31.98.44" @@ -764,6 +803,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.27", "172.31.98.44" @@ -820,6 +862,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.202.211", "172.31.98.44" @@ -876,6 +921,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.15", "172.31.98.44" @@ -932,6 +980,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.124.15", "172.31.98.44" @@ -988,6 +1039,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.209.247", "172.31.98.44" @@ -1044,6 +1098,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.35.162", "172.31.98.44" @@ -1094,6 +1151,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1150,6 +1210,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.80.32", "172.31.98.44" @@ -1206,6 +1269,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.80.32", "172.31.98.44" @@ -1262,6 +1328,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.6", "172.31.98.44" @@ -1318,6 +1387,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.6", "172.31.98.44" @@ -1368,6 +1440,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1424,6 +1499,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.226", "172.31.98.44" @@ -1474,6 +1552,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1530,6 +1611,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.252.226", "172.31.98.44" @@ -1586,6 +1670,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.238.126", "172.31.98.44" @@ -1642,6 +1729,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.93.51", "172.31.98.44" @@ -1698,6 +1788,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.238.126", "172.31.98.44" @@ -1754,6 +1847,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.93.51", "172.31.98.44" @@ -1804,6 +1900,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1860,6 +1959,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.225.103", "172.31.98.44" @@ -1910,6 +2012,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -1966,6 +2071,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.240.126", "172.31.98.44" @@ -2022,6 +2130,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.44.45", "172.31.98.44" @@ -2078,6 +2189,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.240.126", "172.31.98.44" @@ -2134,6 +2248,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.44.45", "172.31.98.44" @@ -2184,6 +2301,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2240,6 +2360,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.179.219", "172.31.98.44" @@ -2296,6 +2419,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2352,6 +2478,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.178.133", "172.31.98.44" @@ -2408,6 +2537,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2464,6 +2596,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.178.133", "172.31.98.44" @@ -2514,6 +2649,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2570,6 +2708,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.133.112", "172.31.98.44" @@ -2626,6 +2767,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.133.112", "172.31.98.44" @@ -2682,6 +2826,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.204.197", "172.31.98.44" @@ -2738,6 +2885,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.157.232", "172.31.98.44" @@ -2794,6 +2944,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.204.197", "172.31.98.44" @@ -2844,6 +2997,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -2900,6 +3056,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -2950,6 +3109,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3006,6 +3168,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -3056,6 +3221,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3112,6 +3280,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.128.3", "172.31.98.44" @@ -3168,6 +3339,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.100.4", "172.31.98.44" @@ -3224,6 +3398,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.100.4", "172.31.98.44" @@ -3274,6 +3451,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3330,6 +3510,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3380,6 +3563,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3436,6 +3622,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3492,6 +3681,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.1.107", "172.31.98.44" @@ -3548,6 +3740,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3598,6 +3793,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3654,6 +3852,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.198.40", "172.31.98.44" @@ -3710,6 +3911,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.1.107", "172.31.98.44" @@ -3760,6 +3964,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -3816,6 +4023,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.192.44", "172.31.98.44" @@ -3857,6 +4067,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -3900,6 +4113,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.156.80", "100.66.98.44" @@ -3956,6 +4172,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.156.80" @@ -3997,6 +4216,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4031,6 +4253,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4065,6 +4290,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4099,6 +4327,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4133,6 +4364,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4167,6 +4401,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -4216,6 +4453,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.115.46", "172.31.156.80" @@ -4272,6 +4512,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.156.80" @@ -4322,6 +4565,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.156.80", "100.66.98.44" @@ -4378,6 +4624,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.115.46", "172.31.156.80" @@ -4431,6 +4680,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4484,6 +4736,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4537,6 +4792,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4590,6 +4848,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4643,6 +4904,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4696,6 +4960,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4749,6 +5016,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4802,6 +5072,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4855,6 +5128,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4908,6 +5184,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -4961,6 +5240,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5014,6 +5296,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5067,6 +5352,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.19.254", "172.31.98.44" @@ -5117,6 +5405,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -5173,6 +5464,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.205.99", "172.31.98.44" @@ -5223,6 +5517,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "172.31.98.44", "100.66.98.44" @@ -5279,6 +5576,9 @@ "observer.vendor": "Cisco", "process.name": "CiscoASA", "process.pid": 999, + "related.hosts": [ + "localhost" + ], "related.ip": [ "100.66.14.30", "172.31.98.44" diff --git a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json index ae2b729ada8..37efb99f483 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json @@ -82,6 +82,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -187,6 +190,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -290,6 +296,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -395,6 +404,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -499,6 +511,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -602,6 +617,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -708,6 +726,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -811,6 +832,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -915,6 +939,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1020,6 +1047,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1126,6 +1156,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "205.251.196.144" @@ -1225,6 +1258,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1329,6 +1365,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "9.9.9.9" @@ -1432,6 +1471,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "9.9.9.9" @@ -1536,6 +1578,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "9.9.9.9" @@ -1641,6 +1686,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1744,6 +1792,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1847,6 +1898,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -1950,6 +2004,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -2051,6 +2108,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -2156,6 +2216,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" diff --git a/x-pack/filebeat/module/cisco/ftd/test/filtered.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/filtered.log-expected.json index 2364b5ed1a1..6e77e652aff 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/filtered.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/filtered.log-expected.json @@ -27,6 +27,9 @@ "observer.vendor": "Cisco", "process.name": "asa", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "service.type": "cisco", "tags": [ "cisco-ftd", diff --git a/x-pack/filebeat/module/cisco/ftd/test/intrusion.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/intrusion.log-expected.json index 83616ceec8b..681c8052cb0 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/intrusion.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/intrusion.log-expected.json @@ -62,6 +62,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -144,6 +147,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -222,6 +228,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.100.30", "10.0.1.20" @@ -300,6 +309,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.100.30", "10.0.1.20" diff --git a/x-pack/filebeat/module/cisco/ftd/test/no-type-id.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/no-type-id.log-expected.json index e2939392ef5..b204f179fa3 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/no-type-id.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/no-type-id.log-expected.json @@ -37,6 +37,9 @@ "observer.vendor": "Cisco", "process.name": "ftd", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "related.ip": [ "10.1.123.45", "10.8.12.47" @@ -81,6 +84,9 @@ "observer.vendor": "Cisco", "process.name": "ftd", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -120,6 +126,9 @@ "observer.vendor": "Cisco", "process.name": "ftd", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "service.type": "cisco", "tags": [ "cisco-ftd", @@ -171,6 +180,9 @@ "observer.vendor": "Cisco", "process.name": "ftd", "process.pid": 1234, + "related.hosts": [ + "beats" + ], "related.ip": [ "127.0.0.1", "192.168.3.33" diff --git a/x-pack/filebeat/module/cisco/ftd/test/not-ip.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/not-ip.log-expected.json index 90fd65d46cd..cc0af87b551 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/not-ip.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/not-ip.log-expected.json @@ -35,6 +35,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "WHAT-IS-THIS-A-HOSTNAME-192.0.2.244" + ], "related.ip": [ "203.0.113.42" ], @@ -80,6 +83,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "localhost" + ], "related.ip": [ "192.168.132.46", "172.24.177.29" @@ -137,6 +143,10 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "localhost", + "example.org" + ], "related.ip": [ "10.10.10.1", "172.24.177.3" diff --git a/x-pack/filebeat/module/cisco/ftd/test/sample.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/sample.log-expected.json index 371218e511b..592e7ae85e9 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/sample.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/sample.log-expected.json @@ -185,6 +185,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "INT-FW01" + ], "related.ip": [ "172.29.2.101", "192.0.2.10" @@ -236,6 +239,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "INT-FW01" + ], "related.ip": [ "172.29.2.3", "192.0.2.57" @@ -686,6 +692,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "FJSG2NRFW01" + ], "related.ip": [ "192.168.132.46", "172.24.177.29" @@ -1959,6 +1968,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.168.77.12", "10.0.13.13" @@ -2010,6 +2022,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.168.1.33", "192.0.0.12" @@ -2061,6 +2076,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.168.1.33", "192.0.0.12" @@ -2115,6 +2133,10 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1", + "OCSP_Server" + ], "related.ip": [ "192.0.2.222" ], @@ -2168,6 +2190,10 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1", + "OCSP_Server" + ], "related.ip": [ "192.0.2.222" ], @@ -2221,6 +2247,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.34" @@ -2275,6 +2304,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.35" @@ -2329,6 +2361,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.35" @@ -2375,6 +2410,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.34" @@ -2421,6 +2459,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.34" @@ -2472,6 +2513,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.168.1.34", "192.0.0.12" @@ -2526,6 +2570,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.34" @@ -2580,6 +2627,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "192.168.1.34" @@ -2634,6 +2684,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "127.0.0.1" + ], "related.ip": [ "192.0.2.222", "10.10.10.10" @@ -2731,6 +2784,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2775,6 +2831,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -2819,6 +2878,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2863,6 +2925,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.47" @@ -2907,6 +2972,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -2951,6 +3019,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.88.99.57" @@ -2995,6 +3066,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.168.1.255" @@ -3039,6 +3113,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "0.0.0.0", "192.168.1.255" @@ -3089,6 +3166,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "192.0.2.95", "10.32.112.125" @@ -3136,6 +3216,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "GIFRCHN01" + ], "related.ip": [ "10.2.3.5" ], @@ -3233,6 +3316,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "bad.example.com" + ], "related.ip": [ "10.1.1.45", "192.88.99.129" diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json index 7d48283bdaa..3cef5df9a0f 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json @@ -65,6 +65,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.100.30", "10.0.1.20" @@ -154,6 +157,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.100.30", "10.0.1.20" @@ -251,6 +257,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -355,6 +364,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "8.8.8.8" @@ -447,6 +459,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "52.59.244.233" @@ -557,6 +572,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "52.59.244.233" @@ -652,6 +670,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "213.211.198.62" @@ -758,6 +779,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "213.211.198.62" @@ -843,6 +867,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.100.30", "10.0.1.20" @@ -941,6 +968,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json index c9105b957ab..8ab3e55fc87 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json @@ -51,6 +51,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -122,6 +125,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -193,6 +199,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -264,6 +273,9 @@ "observer.product": "ftd", "observer.type": "firewall", "observer.vendor": "Cisco", + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -344,6 +356,9 @@ "related.hash": [ "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad" ], + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -424,6 +439,9 @@ "related.hash": [ "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad" ], + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -508,6 +526,9 @@ "related.hash": [ "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad" ], + "related.hosts": [ + "siem-ftd" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -600,6 +621,9 @@ "related.hash": [ "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad" ], + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "213.211.198.62" @@ -683,6 +707,9 @@ "related.hash": [ "9a04a82eb19ad382f9e9dbafa498c6b4291f93cfe98d9e8b2915af99c06ffcd7" ], + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "10.0.100.30" @@ -776,6 +803,9 @@ "related.hash": [ "9a04a82eb19ad382f9e9dbafa498c6b4291f93cfe98d9e8b2915af99c06ffcd7" ], + "related.hosts": [ + "firepower" + ], "related.ip": [ "10.0.1.20", "18.197.225.123" diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json index 2fe9194946a..73ab6378da1 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json @@ -86,6 +86,9 @@ "observer.type": "firewall", "observer.vendor": "Cisco", "process.name": "Alerts", + "related.hosts": [ + "CISCO-SENSOR-3D" + ], "related.ip": [ "3.3.3.3", "2.2.2.2" diff --git a/x-pack/filebeat/module/cisco/ios/config/input.yml b/x-pack/filebeat/module/cisco/ios/config/input.yml index 2ed8ae959c2..e3e336cbe03 100644 --- a/x-pack/filebeat/module/cisco/ios/config/input.yml +++ b/x-pack/filebeat/module/cisco/ios/config/input.yml @@ -23,7 +23,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: cisco_ios diff --git a/x-pack/filebeat/module/cisco/meraki/config/input.yml b/x-pack/filebeat/module/cisco/meraki/config/input.yml index ccc2cd1a6af..be15aeb075c 100644 --- a/x-pack/filebeat/module/cisco/meraki/config/input.yml +++ b/x-pack/filebeat/module/cisco/meraki/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml b/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml index 6172ce75db7..cf0d61d1a52 100644 --- a/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml +++ b/x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + if: ctx.host?.name != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{host.hostname}}' + if: ctx.host?.hostname != null && ctx.host?.hostname != '' + allow_duplicates: false on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json index f8677343c20..beeffa9b5eb 100644 --- a/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json @@ -17,8 +17,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.15.44.253", - "10.193.124.51" + "10.193.124.51", + "10.15.44.253" ], "rsa.internal.event_desc": "olaborissecurity_event tur", "rsa.internal.messageid": "security_event", @@ -57,8 +57,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.15.16.212", - "10.102.218.31" + "10.102.218.31", + "10.15.16.212" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -519,8 +519,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.53.150.119", - "10.85.10.165" + "10.85.10.165", + "10.53.150.119" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -557,8 +557,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.187.77.245", - "10.88.231.224" + "10.88.231.224", + "10.187.77.245" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -692,8 +692,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.182.178.217", - "10.63.194.87" + "10.63.194.87", + "10.182.178.217" ], "rsa.counters.dclass_r1": "fdeFi", "rsa.internal.messageid": "events", @@ -831,8 +831,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.12.182.70", - "10.31.77.157" + "10.31.77.157", + "10.12.182.70" ], "rsa.internal.event_desc": "uiac security_event epte", "rsa.internal.messageid": "security_event", @@ -896,8 +896,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.93.68.231", - "10.135.217.12" + "10.135.217.12", + "10.93.68.231" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -1025,8 +1025,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.173.136.186", - "10.221.102.245" + "10.221.102.245", + "10.173.136.186" ], "rsa.internal.event_desc": "idestlab", "rsa.internal.messageid": "security_event", @@ -1064,8 +1064,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.58.64.108", - "10.54.37.86" + "10.54.37.86", + "10.58.64.108" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -1100,8 +1100,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.163.93.20", - "10.147.76.202" + "10.147.76.202", + "10.163.93.20" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -1142,8 +1142,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.0.200.27", - "10.183.44.198" + "10.183.44.198", + "10.0.200.27" ], "rsa.internal.event_desc": "uradi security_event tot", "rsa.internal.messageid": "security_event", @@ -1312,8 +1312,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.242.77.170", - "10.150.245.88" + "10.150.245.88", + "10.242.77.170" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -1486,8 +1486,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.193.219.34", - "10.179.40.170" + "10.179.40.170", + "10.193.219.34" ], "rsa.counters.dclass_r1": "emip", "rsa.internal.messageid": "events", @@ -1638,8 +1638,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.90.99.245", - "10.124.63.4" + "10.124.63.4", + "10.90.99.245" ], "rsa.internal.event_desc": "etconsec", "rsa.internal.messageid": "security_event", @@ -1791,6 +1791,9 @@ "observer.product": "Meraki", "observer.type": "Wireless", "observer.vendor": "Cisco", + "related.hosts": [ + "remips188.api.invalid" + ], "related.ip": [ "10.40.101.224", "10.78.199.43" @@ -1864,8 +1867,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.39.172.93", - "10.83.131.245" + "10.83.131.245", + "10.39.172.93" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -2008,8 +2011,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.97.46.16", - "10.120.4.9" + "10.120.4.9", + "10.97.46.16" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -2077,9 +2080,12 @@ "observer.product": "Meraki", "observer.type": "Wireless", "observer.vendor": "Cisco", + "related.hosts": [ + "uames4985.mail.localdomain" + ], "related.ip": [ - "10.144.57.239", - "10.150.163.151" + "10.150.163.151", + "10.144.57.239" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -2246,8 +2252,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.103.49.129", - "10.2.110.73" + "10.2.110.73", + "10.103.49.129" ], "rsa.counters.dclass_r1": "orumS", "rsa.internal.messageid": "events", @@ -2323,9 +2329,12 @@ "observer.product": "Meraki", "observer.type": "Wireless", "observer.vendor": "Cisco", + "related.hosts": [ + "lors2232.api.example" + ], "related.ip": [ - "10.105.136.146", - "10.46.217.155" + "10.46.217.155", + "10.105.136.146" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -2428,8 +2437,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.16.230.121", - "10.196.176.243" + "10.196.176.243", + "10.16.230.121" ], "rsa.counters.dclass_r1": "velites", "rsa.internal.messageid": "events", @@ -2471,8 +2480,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.34.62.190", - "10.246.152.72" + "10.246.152.72", + "10.34.62.190" ], "rsa.internal.event_desc": "Nem", "rsa.internal.messageid": "security_event", @@ -2710,8 +2719,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.103.91.159", - "10.199.19.205" + "10.199.19.205", + "10.103.91.159" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -2749,8 +2758,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.17.111.91", - "10.65.0.157" + "10.65.0.157", + "10.17.111.91" ], "rsa.db.index": "nostrum", "rsa.internal.messageid": "flows", @@ -3018,8 +3027,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.254.96.130", - "10.247.118.132" + "10.247.118.132", + "10.254.96.130" ], "rsa.counters.dclass_r1": "ectet", "rsa.internal.messageid": "events", @@ -3058,8 +3067,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.101.13.122", - "10.200.98.243" + "10.200.98.243", + "10.101.13.122" ], "rsa.counters.dclass_r1": "uteirur", "rsa.internal.messageid": "events", @@ -3321,8 +3330,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.85.59.172", - "10.75.122.111" + "10.75.122.111", + "10.85.59.172" ], "rsa.counters.dclass_r1": "sequat", "rsa.internal.messageid": "events", diff --git a/x-pack/filebeat/module/cisco/nexus/config/input.yml b/x-pack/filebeat/module/cisco/nexus/config/input.yml index 5608926d955..747a6cf0085 100644 --- a/x-pack/filebeat/module/cisco/nexus/config/input.yml +++ b/x-pack/filebeat/module/cisco/nexus/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cisco/nexus/ingest/pipeline.yml b/x-pack/filebeat/module/cisco/nexus/ingest/pipeline.yml index ae975fb7e86..b85ab503dda 100644 --- a/x-pack/filebeat/module/cisco/nexus/ingest/pipeline.yml +++ b/x-pack/filebeat/module/cisco/nexus/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + if: ctx.host?.name != null && ctx.host?.name != '' + allow_duplicates: false + - append: + field: related.hosts + value: '{{host.hostname}}' + if: ctx.host?.hostname != null && ctx.host?.hostname != '' + allow_duplicates: false on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml b/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml index 7671bb649b9..c828c45250a 100644 --- a/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml +++ b/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml @@ -1547,6 +1547,26 @@ processors: field: related.hash value: "{{file.hash.sha256}}" if: "ctx?.file?.hash?.sha256 != null" + - append: + field: related.hosts + value: "{{host.hostname}}" + if: ctx.host?.hostname != null && ctx.host?.hostname != '' + allow_duplicates: false + - append: + field: related.hosts + value: "{{observer.hostname}}" + if: ctx.observer?.hostname != null && ctx.observer?.hostname != '' + allow_duplicates: false + - append: + field: related.hosts + value: "{{destination.domain}}" + if: ctx.destination?.domain != null && ctx.destination?.domain != '' + allow_duplicates: false + - append: + field: related.hosts + value: "{{source.domain}}" + if: ctx.source?.domain != null && ctx.source?.domain != '' + allow_duplicates: false on_failure: # Copy any fields under _temp_.cisco to its final destination. Those can help # with diagnosing the failure. diff --git a/x-pack/filebeat/module/citrix/netscaler/config/input.yml b/x-pack/filebeat/module/citrix/netscaler/config/input.yml index 1226056cf17..42bba0c0995 100644 --- a/x-pack/filebeat/module/citrix/netscaler/config/input.yml +++ b/x-pack/filebeat/module/citrix/netscaler/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml b/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml index 51c9ebaf329..a2f7da6f2a0 100644 --- a/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml +++ b/x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain != null && ctx.server?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json index 861edae9b88..cb772d91268 100644 --- a/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json +++ b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json @@ -144,8 +144,8 @@ "rsa.db.index": "undeo", "rsa.internal.messageid": "APPFW_COOKIE", "rsa.misc.action": [ - "cancel", - "iumto" + "iumto", + "cancel" ], "rsa.misc.policy_name": "isqu", "rsa.misc.rule": "uaera", @@ -186,8 +186,8 @@ "related.ip": [ "10.96.119.12", "10.21.92.218", - "10.109.68.21", "10.83.234.60", + "10.109.68.21", "10.156.210.168" ], "related.user": [ @@ -570,6 +570,9 @@ "observer.product": "Netscaler", "observer.type": "Firewall", "observer.vendor": "Citrix", + "related.hosts": [ + "tor4410.api.localhost" + ], "related.ip": [ "10.206.87.219" ], @@ -808,8 +811,8 @@ "rsa.db.index": "uidol", "rsa.internal.messageid": "APPFW_COOKIE", "rsa.misc.action": [ - "cancel", - "tincu" + "tincu", + "cancel" ], "rsa.misc.policy_name": "aec", "rsa.misc.rule": "rQu", @@ -989,8 +992,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.248.165.185", - "10.32.39.220" + "10.32.39.220", + "10.248.165.185" ], "related.user": [ "exeaco" @@ -1025,9 +1028,9 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.197.6.245", "10.81.45.174", - "10.82.28.220" + "10.82.28.220", + "10.197.6.245" ], "related.user": [ "agnaaliq" @@ -1454,8 +1457,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.101.172.233", - "10.211.163.7" + "10.211.163.7", + "10.101.172.233" ], "related.user": [ "est" @@ -1884,8 +1887,8 @@ "rsa.db.index": "orem", "rsa.internal.messageid": "APPFW_FIELDCONSISTENCY", "rsa.misc.action": [ - "tesse", - "allow" + "allow", + "tesse" ], "rsa.misc.policy_name": "rsi", "rsa.misc.rule": "ntutlab", @@ -2081,9 +2084,9 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.80.5.101", + "10.225.146.5", "10.41.65.89", - "10.225.146.5" + "10.80.5.101" ], "related.user": [ "picia" @@ -2475,8 +2478,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.187.86.64", - "10.197.128.162" + "10.197.128.162", + "10.187.86.64" ], "rsa.internal.messageid": "ICA_SESSION_UPDATE", "rsa.misc.msgIdPart1": "ICA", @@ -2544,8 +2547,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.204.20.8", - "10.43.239.97" + "10.43.239.97", + "10.204.20.8" ], "rsa.internal.messageid": "ICA_SESSION_UPDATE", "rsa.misc.msgIdPart1": "ICA", @@ -2581,11 +2584,11 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.8.82.22", + "10.148.244.55", "10.133.153.174", - "10.76.129.136", + "10.8.82.22", "10.113.135.78", - "10.148.244.55" + "10.76.129.136" ], "related.user": [ "asiar" @@ -2697,8 +2700,8 @@ "rsa.db.index": "iat", "rsa.internal.messageid": "AF_MALFORMED_REQ_ERR", "rsa.misc.action": [ - "ati", - "block" + "block", + "ati" ], "rsa.misc.policy_name": "llu", "rsa.misc.rule": "etd", @@ -2730,9 +2733,9 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.213.112.186", "10.215.229.78", - "10.67.233.159" + "10.67.233.159", + "10.213.112.186" ], "related.user": [ "emquiav" @@ -2842,8 +2845,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.96.104.212", - "10.73.45.19" + "10.73.45.19", + "10.96.104.212" ], "rsa.internal.messageid": "ICA_SESSION_UPDATE", "rsa.misc.msgIdPart1": "ICA", @@ -3032,6 +3035,9 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "observer.version": "1.897", + "related.hosts": [ + "hend1170.www5.lan" + ], "related.ip": [ "10.111.22.134" ], diff --git a/x-pack/filebeat/module/cyberark/corepas/config/input.yml b/x-pack/filebeat/module/cyberark/corepas/config/input.yml index 4a0d6359c63..4b34d80711b 100644 --- a/x-pack/filebeat/module/cyberark/corepas/config/input.yml +++ b/x-pack/filebeat/module/cyberark/corepas/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml index dafb265af35..ffe90e79f85 100644 --- a/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml +++ b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.hostname server.domain}}' + allow_duplicates: false + if: ctx?.host?.hostname != null && ctx.host?.hostname != '' + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain != null && ctx.server?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json index 2df25e0b1fe..2bf31b06a52 100644 --- a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json @@ -20,8 +20,8 @@ "10.208.15.216" ], "related.user": [ - "itv", "quasiarc", + "itv", "utl" ], "rsa.db.index": "nes", @@ -63,9 +63,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.259", + "related.hosts": [ + "iatnu3810.mail.localdomain" + ], "related.ip": [ - "10.175.75.18", - "10.92.136.230" + "10.92.136.230", + "10.175.75.18" ], "related.user": [ "nnumqu", @@ -123,13 +126,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.7269", + "related.hosts": [ + "anti4454.api.example" + ], "related.ip": [ "10.51.132.10", "10.46.185.46" ], "related.user": [ - "nse", "incid", + "nse", "serror" ], "rsa.db.database": "byC", @@ -183,14 +189,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6713", + "related.hosts": [ + "uam6303.api.lan" + ], "related.ip": [ "10.155.236.240", "10.53.192.140" ], "related.user": [ - "atcup", "psumquia", - "ptass" + "ptass", + "atcup" ], "rsa.db.database": "aperi", "rsa.db.index": "llumd", @@ -244,9 +253,9 @@ "10.81.199.122" ], "related.user": [ - "eos", "oremips", - "giatq" + "giatq", + "eos" ], "rsa.db.index": "tempo", "rsa.internal.event_desc": "uian", @@ -287,6 +296,9 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3491", + "related.hosts": [ + "temq1198.internal.example" + ], "related.ip": [ "10.139.186.201", "10.172.14.142" @@ -347,9 +359,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6875", + "related.hosts": [ + "tenbyCic5882.api.home" + ], "related.ip": [ - "10.47.76.251", - "10.104.111.129" + "10.104.111.129", + "10.47.76.251" ], "related.user": [ "ele", @@ -409,8 +424,8 @@ ], "related.user": [ "umdo", - "quiratio", - "animi" + "animi", + "quiratio" ], "rsa.db.index": "oll", "rsa.internal.event_desc": "rumet", @@ -451,14 +466,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.5529", + "related.hosts": [ + "isqu7224.localdomain" + ], "related.ip": [ "10.57.40.29", "10.62.54.220" ], "related.user": [ - "rnatura", "taevi", - "psum" + "psum", + "rnatura" ], "rsa.db.database": "emeumfug", "rsa.db.index": "omn", @@ -512,9 +530,9 @@ "10.74.237.180" ], "related.user": [ + "tnon", "ema", - "cup", - "tnon" + "cup" ], "rsa.db.index": "remeumf", "rsa.internal.event_desc": "lup", @@ -556,9 +574,9 @@ "10.18.165.35" ], "related.user": [ - "lor", "modocons", - "remeum" + "remeum", + "lor" ], "rsa.db.index": "etM", "rsa.internal.event_desc": "etc", @@ -600,9 +618,9 @@ "10.74.253.127" ], "related.user": [ + "icab", "tema", - "onproide", - "icab" + "onproide" ], "rsa.db.index": "mqui", "rsa.internal.event_desc": "eomnisis", @@ -642,9 +660,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1697", + "related.hosts": [ + "tlabo6088.www.localdomain" + ], "related.ip": [ - "10.189.109.245", - "10.92.8.15" + "10.92.8.15", + "10.189.109.245" ], "related.user": [ "inima", @@ -701,8 +722,8 @@ "10.21.78.128" ], "related.user": [ - "taut", "upt", + "taut", "giatquov" ], "rsa.db.index": "iadese", @@ -746,8 +767,8 @@ ], "related.user": [ "pida", - "tatn", - "hil" + "hil", + "tatn" ], "rsa.db.index": "quip", "rsa.internal.event_desc": "ecillu", @@ -788,13 +809,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3727", + "related.hosts": [ + "iavolu5352.localhost" + ], "related.ip": [ "10.63.37.192", "10.225.115.13" ], "related.user": [ - "reetd", "iunt", + "reetd", "equep" ], "rsa.db.database": "aliqu", @@ -848,9 +872,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3219", + "related.hosts": [ + "estiae3750.api.corp" + ], "related.ip": [ - "10.95.64.124", - "10.47.202.102" + "10.47.202.102", + "10.95.64.124" ], "related.user": [ "run", @@ -907,13 +934,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6371", + "related.hosts": [ + "aquaeabi7735.internal.lan" + ], "related.ip": [ "10.244.114.61", "10.106.239.55" ], "related.user": [ - "serunt", - "itquiin" + "itquiin", + "serunt" ], "rsa.db.database": "itame", "rsa.db.index": "oluptas", @@ -965,13 +995,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.821", + "related.hosts": [ + "etMalor4236.www5.host" + ], "related.ip": [ - "10.125.160.129", - "10.53.168.235" + "10.53.168.235", + "10.125.160.129" ], "related.user": [ - "one", "abi", + "one", "ione" ], "rsa.db.database": "sperna", @@ -1025,14 +1058,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1123", + "related.hosts": [ + "quioffi1359.internal.lan" + ], "related.ip": [ - "10.227.177.121", - "10.33.245.220" + "10.33.245.220", + "10.227.177.121" ], "related.user": [ + "iduntu", "liqui", - "tasuntex", - "iduntu" + "tasuntex" ], "rsa.db.database": "rvel", "rsa.db.index": "onsecte", @@ -1088,13 +1124,17 @@ "observer.version": "1.5071", "process.name": "laboree.exe", "process.pid": 6501, + "related.hosts": [ + "", + "nsecte3304.mail.corp" + ], "related.ip": [ - "10.167.85.181", - "10.98.182.220" + "10.98.182.220", + "10.167.85.181" ], "related.user": [ - "econs", - "fde" + "fde", + "econs" ], "rsa.db.database": "equat", "rsa.internal.event_desc": "orpor", @@ -1149,9 +1189,9 @@ "10.89.208.95" ], "related.user": [ - "iciadese", "icabo", - "sintoc" + "sintoc", + "iciadese" ], "rsa.db.index": "eni", "rsa.internal.event_desc": "rcitati", @@ -1192,6 +1232,9 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.509", + "related.hosts": [ + "nevo4284.internal.local" + ], "related.ip": [ "10.72.148.32", "10.214.191.180" @@ -1252,9 +1295,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3599", + "related.hosts": [ + "itas981.mail.domain" + ], "related.ip": [ - "10.136.190.236", - "10.252.124.150" + "10.252.124.150", + "10.136.190.236" ], "related.user": [ "ipsumd", @@ -1312,14 +1358,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.5649", + "related.hosts": [ + "tnonpro7635.localdomain" + ], "related.ip": [ - "10.213.144.249", - "10.192.34.76" + "10.192.34.76", + "10.213.144.249" ], "related.user": [ - "iquipe", + "lore", "temqu", - "lore" + "iquipe" ], "rsa.db.database": "gnamal", "rsa.db.index": "ntexplic", @@ -1371,9 +1420,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.2217", + "related.hosts": [ + "rQuisau5300.www5.example" + ], "related.ip": [ - "10.216.84.30", - "10.154.4.197" + "10.154.4.197", + "10.216.84.30" ], "related.user": [ "untu", @@ -1431,8 +1483,8 @@ ], "related.user": [ "tqu", - "niamqui", - "quid" + "quid", + "niamqui" ], "rsa.db.index": "inci", "rsa.internal.event_desc": "eroinBCS", @@ -1473,14 +1525,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.5632", + "related.hosts": [ + "uamei2389.internal.example" + ], "related.ip": [ - "10.193.83.81", - "10.65.175.9" + "10.65.175.9", + "10.193.83.81" ], "related.user": [ + "umqu", "ritatise", - "essequam", - "umqu" + "essequam" ], "rsa.db.database": "ender", "rsa.db.index": "entorev", @@ -1534,8 +1589,8 @@ "10.205.72.243" ], "related.user": [ - "isiuta", "umdolo", + "isiuta", "tatn" ], "rsa.db.index": "proide", @@ -1578,9 +1633,9 @@ "10.107.9.163" ], "related.user": [ - "mac", + "mquisno", "sit", - "mquisno" + "mac" ], "rsa.db.index": "sit", "rsa.internal.event_desc": "tdol", @@ -1623,8 +1678,8 @@ ], "related.user": [ "asiarc", - "umSe", - "quidexea" + "quidexea", + "umSe" ], "rsa.db.index": "veli", "rsa.internal.event_desc": "quatu", @@ -1665,14 +1720,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.267", + "related.hosts": [ + "miurerep1152.internal.domain" + ], "related.ip": [ - "10.39.10.155", - "10.235.136.109" + "10.235.136.109", + "10.39.10.155" ], "related.user": [ + "aboreetd", "urExcept", - "ptass", - "aboreetd" + "ptass" ], "rsa.db.database": "teirured", "rsa.db.index": "dolorem", @@ -1771,8 +1829,8 @@ ], "related.user": [ "reseo", - "moenimi", - "aec" + "aec", + "moenimi" ], "rsa.db.index": "mac", "rsa.internal.event_desc": "quamest", @@ -1813,6 +1871,9 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3804", + "related.hosts": [ + "rum5798.home" + ], "related.ip": [ "10.226.101.180", "10.226.20.199" @@ -1874,14 +1935,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1493", + "related.hosts": [ + "nisiut3624.api.example" + ], "related.ip": [ - "10.134.65.15", - "10.86.22.67" + "10.86.22.67", + "10.134.65.15" ], "related.user": [ - "utaliqu", "quaUten", - "cab" + "cab", + "utaliqu" ], "rsa.db.database": "isciv", "rsa.db.index": "nofd", @@ -1981,14 +2045,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6255", + "related.hosts": [ + "tesse1089.www.host" + ], "related.ip": [ - "10.24.111.229", - "10.178.242.100" + "10.178.242.100", + "10.24.111.229" ], "related.user": [ + "loi", "dqu", - "idid", - "loi" + "idid" ], "rsa.db.database": "tenatuse", "rsa.db.index": "ullamcor", @@ -2129,14 +2196,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1844", + "related.hosts": [ + "dictasun3878.internal.localhost" + ], "related.ip": [ "10.212.214.4", "10.6.79.159" ], "related.user": [ + "midestl", "quid", - "amvo", - "midestl" + "amvo" ], "rsa.db.database": "urExce", "rsa.db.index": "ectiono", @@ -2189,9 +2259,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3546", + "related.hosts": [ + "aecatcup2241.www5.test" + ], "related.ip": [ - "10.70.147.46", - "10.237.170.202" + "10.237.170.202", + "10.70.147.46" ], "related.user": [ "liquide", @@ -2249,13 +2322,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.4282", + "related.hosts": [ + "mad5185.www5.localhost" + ], "related.ip": [ - "10.179.50.138", - "10.228.118.81" + "10.228.118.81", + "10.179.50.138" ], "related.user": [ - "itasper", "emoe", + "itasper", "tatemU" ], "rsa.db.database": "toditaut", @@ -2309,14 +2385,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3806", + "related.hosts": [ + "esseq7889.www.invalid" + ], "related.ip": [ "10.49.71.118", "10.234.165.130" ], "related.user": [ "emip", - "henderit", - "iuntNequ" + "iuntNequ", + "henderit" ], "rsa.db.database": "veniamqu", "rsa.db.index": "atquo", @@ -2457,14 +2536,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.7083", + "related.hosts": [ + "tem6815.home" + ], "related.ip": [ "10.174.185.109", "10.120.167.217" ], "related.user": [ "animid", - "rsp", - "dolorem" + "dolorem", + "rsp" ], "rsa.db.database": "tsuntinc", "rsa.db.index": "quovo", @@ -2517,14 +2599,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1432", + "related.hosts": [ + "mporainc2064.home" + ], "related.ip": [ "10.117.137.159", "10.141.213.219" ], "related.user": [ - "atev", "accusa", - "ate" + "ate", + "atev" ], "rsa.db.database": "nibus", "rsa.db.index": "ser", @@ -2577,13 +2662,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.4043", + "related.hosts": [ + "caboNem1043.internal.home" + ], "related.ip": [ "10.166.90.130", "10.94.224.229" ], "related.user": [ - "rem", "eavol", + "rem", "etconsec" ], "rsa.db.database": "oditempo", @@ -2639,14 +2727,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.2456", + "related.hosts": [ + "tatio6513.www.invalid" + ], "related.ip": [ - "10.38.28.151", - "10.201.81.46" + "10.201.81.46", + "10.38.28.151" ], "related.user": [ + "tiumto", "incidid", - "mipsumqu", - "tiumto" + "mipsumqu" ], "rsa.db.database": "abor", "rsa.db.index": "adol", @@ -2701,14 +2792,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.2721", + "related.hosts": [ + "dolori6232.api.invalid" + ], "related.ip": [ "10.255.28.56", "10.214.245.95" ], "related.user": [ - "rerepre", + "umdolors", "uptatem", - "umdolors" + "rerepre" ], "rsa.db.database": "odt", "rsa.db.index": "riosa", @@ -2763,8 +2857,8 @@ ], "related.user": [ "mip", - "qui", - "Utenima" + "Utenima", + "qui" ], "rsa.db.index": "boree", "rsa.internal.event_desc": "uteir", @@ -2807,8 +2901,8 @@ ], "related.user": [ "enim", - "ess", - "iame" + "iame", + "ess" ], "rsa.db.index": "nofdeFi", "rsa.internal.event_desc": "isnostru", @@ -2893,14 +2987,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3147", + "related.hosts": [ + "mestq2106.api.host" + ], "related.ip": [ - "10.39.143.155", - "10.41.89.217" + "10.41.89.217", + "10.39.143.155" ], "related.user": [ + "tem", "tperspic", - "sedquiac", - "tem" + "sedquiac" ], "rsa.db.database": "radipis", "rsa.db.index": "nse", @@ -2953,14 +3050,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6382", + "related.hosts": [ + "lors7553.api.local" + ], "related.ip": [ "10.153.123.20", "10.5.5.1" ], "related.user": [ + "minim", "unt", - "CSe", - "minim" + "CSe" ], "rsa.db.database": "atu", "rsa.db.index": "roi", @@ -3013,13 +3113,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3193", + "related.hosts": [ + "olu5333.www.domain" + ], "related.ip": [ - "10.210.61.109", - "10.168.132.175" + "10.168.132.175", + "10.210.61.109" ], "related.user": [ - "iamea", "giatquov", + "iamea", "eursinto" ], "rsa.db.database": "ici", @@ -3074,9 +3177,9 @@ "10.123.154.17" ], "related.user": [ - "quiac", + "dolorsi", "lmo", - "dolorsi" + "quiac" ], "rsa.db.index": "idunt", "rsa.internal.event_desc": "usantiu", @@ -3168,8 +3271,8 @@ ], "related.user": [ "rsitvol", - "Nemoenim", - "iati" + "iati", + "Nemoenim" ], "rsa.db.index": "eFini", "rsa.internal.event_desc": "acom", @@ -3210,13 +3313,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3184", + "related.hosts": [ + "fic5107.home" + ], "related.ip": [ "10.169.101.161", "10.164.66.154" ], "related.user": [ - "eufug", "orissu", + "eufug", "ine" ], "rsa.db.database": "stquidol", @@ -3314,14 +3420,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.4887", + "related.hosts": [ + "onpr47.api.home" + ], "related.ip": [ "10.207.97.192", "10.134.55.11" ], "related.user": [ - "madminim", "tanimid", - "mmod" + "mmod", + "madminim" ], "rsa.db.database": "tetura", "rsa.db.index": "uptasnul", @@ -3374,14 +3483,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3601", + "related.hosts": [ + "rehen4859.api.host" + ], "related.ip": [ "10.31.187.19", "10.52.150.104" ], "related.user": [ + "texplica", "eritq", - "oinBCSed", - "texplica" + "oinBCSed" ], "rsa.db.database": "lit", "rsa.db.index": "ritati", @@ -3434,13 +3546,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3175", + "related.hosts": [ + "eufugia4481.corp" + ], "related.ip": [ - "10.61.175.217", - "10.41.232.147" + "10.41.232.147", + "10.61.175.217" ], "related.user": [ - "tat", "ntexpl", + "tat", "runtm" ], "rsa.db.database": "rere", @@ -3495,9 +3610,9 @@ "10.150.30.95" ], "related.user": [ - "mini", + "atnonpr", "uisnos", - "atnonpr" + "mini" ], "rsa.db.index": "smod", "rsa.internal.event_desc": "isn", @@ -3627,9 +3742,9 @@ "10.197.203.167" ], "related.user": [ - "eserun", + "uta", "iumdo", - "uta" + "eserun" ], "rsa.db.index": "smo", "rsa.internal.event_desc": "olesti", @@ -3672,8 +3787,8 @@ ], "related.user": [ "sectetu", - "ibusBo", - "enima" + "enima", + "ibusBo" ], "rsa.db.index": "uido", "rsa.internal.event_desc": "lab", @@ -3714,9 +3829,12 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3824", + "related.hosts": [ + "involu1450.www.localhost" + ], "related.ip": [ - "10.123.62.215", - "10.250.248.215" + "10.250.248.215", + "10.123.62.215" ], "related.user": [ "aevitaed", @@ -3773,6 +3891,9 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3759", + "related.hosts": [ + "osa3211.www5.example" + ], "related.ip": [ "10.147.154.118", "10.146.57.23" @@ -3833,8 +3954,8 @@ ], "related.user": [ "niamqui", - "ptatemU", - "uamestqu" + "uamestqu", + "ptatemU" ], "rsa.db.index": "doeiu", "rsa.internal.event_desc": "uasiarc", @@ -3877,8 +3998,8 @@ ], "related.user": [ "nesci", - "onnumqua", - "tetura" + "tetura", + "onnumqua" ], "rsa.db.index": "oinBCSed", "rsa.internal.event_desc": "ntor", @@ -3920,9 +4041,9 @@ "10.47.63.70" ], "related.user": [ - "midestl", + "expl", "tpers", - "expl" + "midestl" ], "rsa.db.index": "olu", "rsa.internal.event_desc": "odocons", @@ -4007,14 +4128,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6648", + "related.hosts": [ + "tatemac5192.www5.test" + ], "related.ip": [ - "10.89.154.115", - "10.85.13.237" + "10.85.13.237", + "10.89.154.115" ], "related.user": [ "emeu", - "luptat", - "Nem" + "Nem", + "luptat" ], "rsa.db.database": "nturmag", "rsa.db.index": "maliqua", @@ -4067,13 +4191,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3387", + "related.hosts": [ + "nimve2787.mail.test" + ], "related.ip": [ - "10.65.207.234", - "10.222.32.183" + "10.222.32.183", + "10.65.207.234" ], "related.user": [ - "eruntmo", "itame", + "eruntmo", "eve" ], "rsa.db.database": "udexerc", @@ -4128,8 +4255,8 @@ "10.16.181.60" ], "related.user": [ - "gnama", "oinven", + "gnama", "olore" ], "rsa.db.index": "uatu", @@ -4173,8 +4300,8 @@ ], "related.user": [ "illoin", - "uianon", - "amnis" + "amnis", + "uianon" ], "rsa.db.index": "ons", "rsa.internal.event_desc": "temaccus", @@ -4216,9 +4343,9 @@ "10.204.214.98" ], "related.user": [ + "tdolo", "eprehe", - "porissus", - "tdolo" + "porissus" ], "rsa.db.index": "abo", "rsa.internal.event_desc": "ecte", @@ -4260,9 +4387,9 @@ "10.223.178.192" ], "related.user": [ + "etc", "moenimip", - "evel", - "etc" + "evel" ], "rsa.db.index": "iarchit", "rsa.internal.event_desc": "apari", @@ -4303,13 +4430,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.801", + "related.hosts": [ + "ama6820.mail.example" + ], "related.ip": [ - "10.26.137.126", - "10.26.33.181" + "10.26.33.181", + "10.26.137.126" ], "related.user": [ - "ati", "audant", + "ati", "taevit" ], "rsa.db.database": "com", @@ -4363,14 +4493,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.10", + "related.hosts": [ + "olupt966.www5.corp" + ], "related.ip": [ - "10.148.195.208", - "10.142.161.116" + "10.142.161.116", + "10.148.195.208" ], "related.user": [ - "quaerat", + "mpori", "isi", - "mpori" + "quaerat" ], "rsa.db.database": "squamest", "rsa.db.index": "pteu", @@ -4423,14 +4556,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.1026", + "related.hosts": [ + "lit4112.www.localhost" + ], "related.ip": [ "10.10.174.253", "10.107.24.54" ], "related.user": [ "hend", - "itinvo", - "uptasn" + "uptasn", + "itinvo" ], "rsa.db.database": "lup", "rsa.db.index": "isau", @@ -4485,9 +4621,9 @@ "10.87.92.17" ], "related.user": [ + "tamr", "luptate", - "eeufug", - "tamr" + "eeufug" ], "rsa.db.index": "oreeufug", "rsa.internal.event_desc": "ura", @@ -4532,13 +4668,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.5649", + "related.hosts": [ + "dictasun3408.internal.invalid" + ], "related.ip": [ "10.161.51.135", "10.231.51.136" ], "related.user": [ - "asper", "Finibus", + "asper", "accus" ], "rsa.db.database": "litani", @@ -4593,9 +4732,9 @@ "10.51.17.32" ], "related.user": [ - "itten", "mquido", - "llum" + "llum", + "itten" ], "rsa.db.index": "uscipit", "rsa.internal.event_desc": "llitani", @@ -4637,8 +4776,8 @@ "10.108.123.148" ], "related.user": [ - "mmodicon", "cusa", + "mmodicon", "ollita" ], "rsa.db.index": "ercitati", @@ -4681,13 +4820,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.425", + "related.hosts": [ + "uidol6868.mail.localdomain" + ], "related.ip": [ - "10.198.187.144", - "10.114.0.148" + "10.114.0.148", + "10.198.187.144" ], "related.user": [ - "equatD", "rsitamet", + "equatD", "ons" ], "rsa.db.database": "periam", @@ -4746,8 +4888,8 @@ "10.61.140.120" ], "related.user": [ - "loru", "naaliq", + "loru", "equa" ], "rsa.db.index": "umfugiat", @@ -4789,14 +4931,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.6988", + "related.hosts": [ + "ptat4878.lan" + ], "related.ip": [ - "10.93.24.151", - "10.149.238.108" + "10.149.238.108", + "10.93.24.151" ], "related.user": [ - "nven", + "sequamn", "ite", - "sequamn" + "nven" ], "rsa.db.database": "fugi", "rsa.db.index": "nesciu", @@ -4895,8 +5040,8 @@ "10.2.204.161" ], "related.user": [ - "ore", "quela", + "ore", "eumfugia" ], "rsa.db.index": "olup", @@ -4944,8 +5089,8 @@ ], "related.user": [ "ptatemse", - "enimad", - "aliqu" + "aliqu", + "enimad" ], "rsa.db.index": "Except", "rsa.internal.event_desc": "cons", @@ -4986,14 +5131,17 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.3175", + "related.hosts": [ + "isno4595.local" + ], "related.ip": [ - "10.94.152.238", - "10.151.110.250" + "10.151.110.250", + "10.94.152.238" ], "related.user": [ + "tla", "neavol", - "pidatatn", - "tla" + "pidatatn" ], "rsa.db.database": "itaedict", "rsa.db.index": "onemull", @@ -5046,13 +5194,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.4965", + "related.hosts": [ + "tatemse5403.home" + ], "related.ip": [ - "10.77.9.17", - "10.146.61.5" + "10.146.61.5", + "10.77.9.17" ], "related.user": [ - "umS", "tevel", + "umS", "alorumwr" ], "rsa.db.database": "amremap", @@ -5107,8 +5258,8 @@ "10.128.102.130" ], "related.user": [ - "ore", "que", + "ore", "sequatu" ], "rsa.db.index": "exerci", @@ -5150,13 +5301,16 @@ "observer.type": "Access", "observer.vendor": "Cyberark", "observer.version": "1.7701", + "related.hosts": [ + "reprehe650.www.corp" + ], "related.ip": [ - "10.31.86.83", - "10.200.162.248" + "10.200.162.248", + "10.31.86.83" ], "related.user": [ - "reseo", "onnu", + "reseo", "doloremi" ], "rsa.db.database": "billo", @@ -5211,9 +5365,9 @@ "10.103.215.159" ], "related.user": [ + "volup", "apa", - "atatn", - "volup" + "atatn" ], "rsa.db.index": "atcupi", "rsa.internal.event_desc": "did", diff --git a/x-pack/filebeat/module/cylance/protect/config/input.yml b/x-pack/filebeat/module/cylance/protect/config/input.yml index fc90f92344c..28123fafd35 100644 --- a/x-pack/filebeat/module/cylance/protect/config/input.yml +++ b/x-pack/filebeat/module/cylance/protect/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cylance/protect/ingest/pipeline.yml b/x-pack/filebeat/module/cylance/protect/ingest/pipeline.yml index 4df5148c770..72aa57c217a 100644 --- a/x-pack/filebeat/module/cylance/protect/ingest/pipeline.yml +++ b/x-pack/filebeat/module/cylance/protect/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/cylance/protect/test/generated.log-expected.json b/x-pack/filebeat/module/cylance/protect/test/generated.log-expected.json index aeb8dfcbd46..4f73edba010 100644 --- a/x-pack/filebeat/module/cylance/protect/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cylance/protect/test/generated.log-expected.json @@ -12,6 +12,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "nostrud4819.mail.test" + ], "rsa.identity.firstname": "uii", "rsa.identity.lastname": "umexe", "rsa.internal.messageid": "CylancePROTECT", @@ -44,6 +47,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "volup208.invalid" + ], "rsa.identity.firstname": "luptat", "rsa.identity.lastname": "isiutal", "rsa.internal.messageid": "CylancePROTECT", @@ -75,6 +81,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "eius6159.www5.localhost" + ], "rsa.db.index": "temvel", "rsa.identity.firstname": "lupt", "rsa.identity.lastname": "tia", @@ -106,6 +115,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ratvolup497.www.corp" + ], "rsa.db.index": "ommodic", "rsa.identity.firstname": "mipsu", "rsa.identity.lastname": "consec", @@ -137,6 +149,9 @@ "observer.product": "taliqu", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "tatno5625.api.local" + ], "rsa.identity.firstname": "tur", "rsa.identity.lastname": "aperi", "rsa.internal.messageid": "CylancePROTECT", @@ -170,6 +185,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "maveniam1399.mail.lan" + ], "related.ip": [ "10.124.61.119" ], @@ -211,6 +229,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "nimadmin6499.local" + ], "rsa.db.index": "lorem", "rsa.identity.firstname": "urerep", "rsa.identity.lastname": "aquaeab", @@ -242,6 +263,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "suntinc4934.www5.test" + ], "rsa.identity.firstname": "dmi", "rsa.identity.lastname": "olab", "rsa.internal.messageid": "CylancePROTECT", @@ -277,6 +301,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.2344", + "related.hosts": [ + "reetdolo2451.www.example" + ], "related.user": [ "usan" ], @@ -310,6 +337,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "uis7612.www5.domain" + ], "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", @@ -337,6 +367,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "admi3749.api.lan" + ], "rsa.db.index": "nimadmin", "rsa.identity.firstname": "iqui", "rsa.identity.lastname": "etc", @@ -371,6 +404,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.5383", + "related.hosts": [ + "rudexerc703.internal.host" + ], "related.user": [ "isaute" ], @@ -444,6 +480,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "estqu1709.internal.example" + ], "related.ip": [ "10.64.70.5" ], @@ -484,6 +523,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "xeac7155.www.localdomain" + ], "related.ip": [ "10.143.239.210" ], @@ -527,6 +569,9 @@ "observer.vendor": "Cylance", "process.name": "aliqu.exe", "process.pid": 2289, + "related.hosts": [ + "maccusa5126.api.domain" + ], "related.ip": [ "10.32.143.134" ], @@ -570,6 +615,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "llu4718.localhost" + ], "rsa.db.index": "psaquae", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -629,6 +677,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "eaq908.api.home" + ], "rsa.db.index": "equat", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -661,6 +712,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.4129", + "related.hosts": [ + "mcolab379.internal.home" + ], "related.user": [ "fdeFi" ], @@ -733,6 +787,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "sciun4694.api.lan" + ], "rsa.db.index": "enderit", "rsa.identity.firstname": "idata", "rsa.identity.lastname": "rumwritt", @@ -764,6 +821,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "mni7200.mail.localdomain" + ], "rsa.db.index": "uisau", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -821,6 +881,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.3212", + "related.hosts": [ + "ntoccae1705.internal.invalid" + ], "related.user": [ "aperiame" ], @@ -854,6 +917,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "etconsec6708.internal.invalid" + ], "rsa.db.index": "mquame", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1502030000, @@ -884,6 +950,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "Sedutp7428.internal.home" + ], "rsa.db.index": "iquipe", "rsa.identity.firstname": "upida", "rsa.identity.lastname": "tvolupt", @@ -916,6 +985,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ati4639.www5.home" + ], "rsa.identity.firstname": "con", "rsa.identity.lastname": "nisist", "rsa.internal.messageid": "CylancePROTECT", @@ -947,6 +1019,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "torever662.www5.home" + ], "rsa.db.index": "The Device: pexe was auto assigned to the Zone: IP Address: 10.70.168.240", "rsa.identity.firstname": "amcol", "rsa.identity.lastname": "adeser", @@ -978,6 +1053,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "emeumfug4387.internal.lan" + ], "rsa.identity.firstname": "ccaeca", "rsa.identity.lastname": "niamq", "rsa.internal.messageid": "CylancePROTECT", @@ -1010,6 +1088,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "rumwrit764.www5.local" + ], "rsa.db.index": "miu", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1804020000, @@ -1072,6 +1153,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "oremi1485.api.localhost" + ], "rsa.identity.firstname": "atisund", "rsa.identity.lastname": "xea", "rsa.internal.messageid": "CylancePROTECT", @@ -1104,6 +1188,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "periam126.api.host" + ], "rsa.crypto.sig_type": "rExc", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -1135,6 +1222,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "tate6578.api.localdomain" + ], "related.ip": [ "10.252.165.146" ], @@ -1175,6 +1265,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "midestl1919.host" + ], "related.ip": [ "10.124.88.222" ], @@ -1215,6 +1308,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "eiusmod3517.internal.invalid" + ], "rsa.identity.firstname": "dol", "rsa.identity.lastname": "sciun", "rsa.internal.messageid": "CylancePROTECT", @@ -1248,6 +1344,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ntexpl3889.www.home" + ], "related.ip": [ "10.156.34.19" ], @@ -1290,6 +1389,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ntium4450.www5.localdomain" + ], "related.ip": [ "10.22.94.10" ], @@ -1330,6 +1432,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "erspi5757.local" + ], "rsa.db.index": "undeomni", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1401060000, @@ -1424,6 +1529,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "magnid3343.home" + ], "rsa.db.index": "obea", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -1454,6 +1562,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "asperna7623.www.home" + ], "rsa.identity.firstname": "onproide", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -1486,6 +1597,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.3421", + "related.hosts": [ + "undeom845.www5.example" + ], "related.user": [ "tassita" ], @@ -1548,6 +1662,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ons5050.mail.test" + ], "related.ip": [ "10.48.209.115" ], @@ -1588,6 +1705,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "oloreeu7597.mail.home" + ], "related.ip": [ "10.7.99.47" ], @@ -1628,6 +1748,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ueip5847.api.test" + ], "rsa.crypto.sig_type": "Nemoenim", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1804010000, @@ -1660,6 +1783,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.989", + "related.hosts": [ + "uid3520.www.home" + ], "related.user": [ "ici" ], @@ -1745,6 +1871,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "teir7585.www5.localdomain" + ], "rsa.identity.firstname": "scip", "rsa.identity.lastname": "Finibus", "rsa.internal.messageid": "CylancePROTECT", @@ -1831,6 +1960,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "serrorsi1096.www5.localdomain" + ], "rsa.db.index": "The Device: reetdo was auto assigned to the Zone: IP Address: Fake Devices", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -1860,6 +1992,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "prehen4807.mail.invalid" + ], "rsa.db.index": "meum", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1600000000, @@ -1890,6 +2025,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "sit1400.www.lan" + ], "rsa.db.index": "ntsunti", "rsa.identity.firstname": "uid", "rsa.identity.lastname": "idatat", @@ -1922,6 +2060,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "sectetu7182.localdomain" + ], "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1804010000, "rsa.investigations.event_cat_name": "Network.Devices.Additions", @@ -1949,6 +2090,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "officiad4982.www5.domain" + ], "rsa.identity.firstname": "etdolore", "rsa.identity.lastname": "magnaa", "rsa.internal.messageid": "CylancePROTECT", @@ -1980,6 +2124,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "consequa1486.internal.localdomain" + ], "rsa.crypto.sig_type": "quaeratv", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -2010,6 +2157,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "its6443.mail.example" + ], "related.ip": [ "10.139.80.71" ], @@ -2053,6 +2203,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "tconsec7604.corp" + ], "related.ip": [ "10.223.246.244" ], @@ -2092,6 +2245,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "tuser2694.internal.invalid" + ], "rsa.identity.firstname": "natus", "rsa.identity.lastname": "boreet", "rsa.internal.messageid": "CylancePROTECT", @@ -2124,6 +2280,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "gnaaliq5240.api.test" + ], "rsa.crypto.sig_type": "ratvo", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -2153,6 +2312,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "illum2625.test" + ], "rsa.crypto.sig_type": "iaeconse", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1401060000, @@ -2182,6 +2344,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "nulamc5617.mail.host" + ], "related.ip": [ "10.134.137.205" ], @@ -2221,6 +2386,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "tatem4713.internal.host" + ], "rsa.db.index": "usci", "rsa.identity.firstname": "lupta", "rsa.identity.lastname": "ura", @@ -2254,6 +2422,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ugits5961.www5.local" + ], "related.ip": [ "10.91.2.225" ], @@ -2297,6 +2468,9 @@ "observer.vendor": "Cylance", "process.name": "nimadmi.exe", "process.pid": 601, + "related.hosts": [ + "prehende5460.mail.localdomain" + ], "related.ip": [ "10.191.99.14" ], @@ -2340,6 +2514,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "velites1745.api.corp" + ], "rsa.db.index": "lor", "rsa.identity.firstname": "naaliq", "rsa.identity.lastname": "plica", @@ -2373,6 +2550,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "Duis583.api.local" + ], "rsa.crypto.sig_type": "dminim", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1401060000, @@ -2404,6 +2584,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.2478", + "related.hosts": [ + "velitess2401.www.lan" + ], "rsa.db.index": "dolo", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -2434,6 +2617,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "sequines3991.mail.local" + ], "rsa.identity.firstname": "sequines", "rsa.identity.lastname": "minimve", "rsa.internal.messageid": "CylancePROTECT", @@ -2470,6 +2656,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "iatquo2815.mail.host" + ], "related.ip": [ "10.181.215.164" ], @@ -2537,6 +2726,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "issusci7005.mail.host" + ], "rsa.db.index": "tiumtot", "rsa.identity.firstname": "ecillumd", "rsa.identity.lastname": "iumto", @@ -2571,6 +2763,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "umq7428.invalid" + ], "related.ip": [ "10.164.59.219" ], @@ -2639,6 +2834,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "epteurs5503.www5.home" + ], "related.ip": [ "10.1.193.187" ], @@ -2707,6 +2905,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "omnisis5339.www5.local" + ], "rsa.db.index": "deom, Device Id: tiumdo, Policy Name: rautod", "rsa.internal.messageid": "CylancePROTECT", "rsa.investigations.event_cat": 1901000000, @@ -2737,6 +2938,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "ction491.www5.local" + ], "rsa.identity.firstname": "imveniam", "rsa.identity.lastname": "sunte", "rsa.internal.messageid": "CylancePROTECT", @@ -2769,6 +2973,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "undeom7847.api.corp" + ], "related.ip": [ "10.146.228.234" ], @@ -2810,6 +3017,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "dolo6230.mail.invalid" + ], "related.ip": [ "10.59.232.97" ], @@ -2845,6 +3055,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "nvolup6280.api.home" + ], "rsa.identity.firstname": "dantium", "rsa.identity.lastname": "ors", "rsa.internal.messageid": "CylancePROTECT", @@ -2877,6 +3090,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "urautodi3892.www5.example" + ], "rsa.db.index": "nibu", "rsa.identity.firstname": "mdolo", "rsa.identity.lastname": "nof", @@ -2952,6 +3168,9 @@ "observer.vendor": "Cylance", "process.name": "oluptat.exe", "process.pid": 4608, + "related.hosts": [ + "uraut3756.www5.test" + ], "related.ip": [ "10.127.30.119" ], @@ -2995,6 +3214,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "squ2213.www.test" + ], "rsa.db.index": "rExce", "rsa.identity.firstname": "rinc", "rsa.identity.lastname": "tno", @@ -3056,6 +3278,9 @@ "observer.vendor": "Cylance", "process.name": "ngelitse.exe", "process.pid": 4190, + "related.hosts": [ + "umet5891.api.localdomain" + ], "related.ip": [ "10.8.150.213" ], @@ -3099,6 +3324,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "umquam5574.internal.test" + ], "related.ip": [ "10.108.59.10" ], @@ -3134,6 +3362,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "volupt6822.api.invalid" + ], "rsa.identity.firstname": "qui", "rsa.identity.lastname": "epteurs", "rsa.internal.messageid": "CylancePROTECT", @@ -3224,6 +3455,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Cylance", "observer.version": "1.3237", + "related.hosts": [ + "amvol4075.mail.localhost" + ], "related.user": [ "pta" ], @@ -3257,6 +3491,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "asi4651.api.test" + ], "rsa.db.index": "ssecill", "rsa.identity.firstname": "officiad", "rsa.identity.lastname": "veniam", @@ -3288,6 +3525,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "perna6751.internal.home" + ], "related.ip": [ "10.138.85.233" ], @@ -3323,6 +3563,9 @@ "observer.product": "Protect", "observer.type": "Anti-Virus", "observer.vendor": "Cylance", + "related.hosts": [ + "evolupta7790.internal.local" + ], "rsa.db.index": "rehe", "rsa.identity.firstname": "tam", "rsa.identity.lastname": "deser", diff --git a/x-pack/filebeat/module/f5/bigipafm/config/input.yml b/x-pack/filebeat/module/f5/bigipafm/config/input.yml index e17540ff041..e4c79ac07c5 100644 --- a/x-pack/filebeat/module/f5/bigipafm/config/input.yml +++ b/x-pack/filebeat/module/f5/bigipafm/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml b/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml index 5df41d6ec6f..39579462593 100644 --- a/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml +++ b/x-pack/filebeat/module/f5/bigipafm/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json index a366e228e25..d1729062282 100644 --- a/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json @@ -20,11 +20,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2262", + "related.hosts": [ + "tatemac3541.api.corp" + ], "related.ip": [ - "10.11.196.142", - "10.208.121.85", "10.165.201.71", - "10.228.193.207" + "10.228.193.207", + "10.11.196.142", + "10.208.121.85" ], "related.user": [ "billoi" @@ -85,11 +88,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.445", + "related.hosts": [ + "enatus2114.mail.home" + ], "related.ip": [ - "10.92.202.200", - "10.162.9.235", "10.51.132.10", - "10.94.67.230" + "10.162.9.235", + "10.94.67.230", + "10.92.202.200" ], "related.user": [ "byC" @@ -150,6 +156,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4726", + "related.hosts": [ + "gelit6728.api.invalid" + ], "related.ip": [ "10.122.116.161", "10.209.155.149", @@ -214,11 +223,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2696", + "related.hosts": [ + "uid545.www5.localhost" + ], "related.ip": [ "10.12.44.169", + "10.202.66.28", "10.50.112.141", - "10.131.233.27", - "10.202.66.28" + "10.131.233.27" ], "related.user": [ "elits" @@ -279,11 +291,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3341", + "related.hosts": [ + "emquiavo452.internal.localhost" + ], "related.ip": [ + "10.159.182.171", "10.151.111.38", - "10.206.197.113", "10.96.35.212", - "10.159.182.171" + "10.206.197.113" ], "related.user": [ "mol" @@ -344,11 +359,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6179", + "related.hosts": [ + "sun1403.www.invalid" + ], "related.ip": [ - "10.169.144.147", - "10.89.163.114", + "10.126.177.162", "10.213.113.28", - "10.126.177.162" + "10.169.144.147", + "10.89.163.114" ], "related.user": [ "ist" @@ -408,11 +426,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6316", + "related.hosts": [ + "ittenbyC7838.api.localdomain" + ], "related.ip": [ "10.101.223.43", - "10.146.88.52", + "10.18.124.28", "10.103.107.47", - "10.18.124.28" + "10.146.88.52" ], "related.user": [ "rudexerc" @@ -473,9 +494,12 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3768", + "related.hosts": [ + "ume465.corp" + ], "related.ip": [ - "10.189.109.245", "10.150.220.75", + "10.189.109.245", "10.69.57.206", "10.110.99.17" ], @@ -537,11 +561,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2299", + "related.hosts": [ + "iciatisu1463.www5.localdomain" + ], "related.ip": [ - "10.19.194.101", - "10.153.136.222", "10.199.34.241", - "10.121.219.204" + "10.121.219.204", + "10.153.136.222", + "10.19.194.101" ], "related.user": [ "temveleu" @@ -601,10 +628,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4138", + "related.hosts": [ + "aliqu6801.api.localdomain" + ], "related.ip": [ + "10.57.103.192", "10.64.141.105", "10.46.27.57", - "10.57.103.192", "10.182.199.231" ], "related.user": [ @@ -665,11 +695,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7410", + "related.hosts": [ + "itame189.domain" + ], "related.ip": [ "10.32.67.231", - "10.164.6.207", "10.3.134.237", - "10.160.210.31" + "10.160.210.31", + "10.164.6.207" ], "related.user": [ "pic" @@ -730,11 +763,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3545", + "related.hosts": [ + "tsedqu2456.www5.invalid" + ], "related.ip": [ "10.42.138.192", + "10.201.6.10", "10.235.101.253", - "10.182.178.217", - "10.201.6.10" + "10.182.178.217" ], "related.user": [ "giatnu" @@ -795,11 +831,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3795", + "related.hosts": [ + "stlabo1228.mail.host" + ], "related.ip": [ - "10.151.161.70", "10.86.101.235", - "10.22.102.198", - "10.194.247.171" + "10.194.247.171", + "10.151.161.70", + "10.22.102.198" ], "related.user": [ "nse" @@ -860,11 +899,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4901", + "related.hosts": [ + "ecte4762.local" + ], "related.ip": [ - "10.167.172.155", "10.174.252.105", + "10.204.35.15", "10.107.168.60", - "10.204.35.15" + "10.167.172.155" ], "related.user": [ "mnisi" @@ -924,11 +966,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3427", + "related.hosts": [ + "smo7167.www.test" + ], "related.ip": [ + "10.99.249.210", "10.182.191.174", - "10.214.249.164", "10.81.26.208", - "10.99.249.210" + "10.214.249.164" ], "related.user": [ "upta" @@ -988,11 +1033,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1766", + "related.hosts": [ + "sauteiru4554.api.domain" + ], "related.ip": [ - "10.101.226.128", "10.88.101.53", "10.201.238.90", - "10.220.5.143" + "10.220.5.143", + "10.101.226.128" ], "related.user": [ "porro" @@ -1052,11 +1100,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7491", + "related.hosts": [ + "untut4046.internal.domain" + ], "related.ip": [ - "10.30.133.66", - "10.157.18.252", "10.243.218.215", - "10.217.150.196" + "10.217.150.196", + "10.157.18.252", + "10.30.133.66" ], "related.user": [ "evit" @@ -1116,10 +1167,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.752", + "related.hosts": [ + "quid3147.mail.home" + ], "related.ip": [ + "10.167.227.44", "10.181.133.187", "10.148.161.250", - "10.167.227.44", "10.66.181.6" ], "related.user": [ @@ -1181,9 +1235,12 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5663", + "related.hosts": [ + "umdolo1029.mail.localhost" + ], "related.ip": [ - "10.54.17.32", "10.74.11.43", + "10.54.17.32", "10.84.163.178", "10.107.9.163" ], @@ -1245,11 +1302,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5726", + "related.hosts": [ + "lorsita2019.internal.home" + ], "related.ip": [ "10.230.129.252", - "10.112.32.213", "10.184.73.211", - "10.192.229.221" + "10.192.229.221", + "10.112.32.213" ], "related.user": [ "odi" @@ -1310,11 +1370,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1721", + "related.hosts": [ + "paquioff624.mail.invalid" + ], "related.ip": [ "10.161.148.64", - "10.198.213.189", + "10.199.216.143", "10.7.200.140", - "10.199.216.143" + "10.198.213.189" ], "related.user": [ "ccaeca" @@ -1374,11 +1437,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1000", + "related.hosts": [ + "mex2054.mail.corp" + ], "related.ip": [ - "10.128.157.27", - "10.65.232.27", "10.206.96.56", - "10.22.187.69" + "10.22.187.69", + "10.128.157.27", + "10.65.232.27" ], "related.user": [ "uaeab" @@ -1438,11 +1504,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3104", + "related.hosts": [ + "avolupt7576.api.corp" + ], "related.ip": [ - "10.71.114.14", "10.194.210.62", "10.68.253.120", - "10.183.130.225" + "10.183.130.225", + "10.71.114.14" ], "related.user": [ "admin" @@ -1503,11 +1572,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.341", + "related.hosts": [ + "loi7596.www5.home" + ], "related.ip": [ - "10.107.45.175", + "10.47.255.237", "10.45.253.103", - "10.31.177.226", - "10.47.255.237" + "10.107.45.175", + "10.31.177.226" ], "related.user": [ "remagn" @@ -1568,11 +1640,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1607", + "related.hosts": [ + "nsequat1971.internal.invalid" + ], "related.ip": [ - "10.225.212.189", "10.44.58.106", "10.55.105.113", - "10.213.94.135" + "10.213.94.135", + "10.225.212.189" ], "related.user": [ "dquia" @@ -1632,11 +1707,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.51", + "related.hosts": [ + "ectiono2241.lan" + ], "related.ip": [ - "10.163.209.70", - "10.2.114.9", "10.255.74.136", - "10.69.161.78" + "10.69.161.78", + "10.163.209.70", + "10.2.114.9" ], "related.user": [ "olabor" @@ -1696,9 +1774,12 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.380", + "related.hosts": [ + "umetMal1664.mail.lan" + ], "related.ip": [ - "10.252.102.110", "10.46.115.216", + "10.252.102.110", "10.12.129.137", "10.184.59.148" ], @@ -1761,11 +1842,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1729", + "related.hosts": [ + "derit5270.mail.local" + ], "related.ip": [ - "10.105.52.140", - "10.199.194.79", "10.81.184.7", - "10.155.204.243" + "10.199.194.79", + "10.155.204.243", + "10.105.52.140" ], "related.user": [ "eetd" @@ -1826,11 +1910,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1453", + "related.hosts": [ + "orisni5238.mail.lan" + ], "related.ip": [ - "10.177.238.45", "10.251.231.142", - "10.110.2.166", - "10.18.226.72" + "10.177.238.45", + "10.18.226.72", + "10.110.2.166" ], "related.user": [ "taliqui" @@ -1891,6 +1978,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6332", + "related.hosts": [ + "iutali7297.www.domain" + ], "related.ip": [ "10.99.202.229", "10.100.199.226", @@ -1956,11 +2046,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6463", + "related.hosts": [ + "orumw5960.www5.home" + ], "related.ip": [ "10.248.111.207", - "10.172.154.97", + "10.162.97.197", "10.37.193.70", - "10.162.97.197" + "10.172.154.97" ], "related.user": [ "culpaq" @@ -2020,11 +2113,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3912", + "related.hosts": [ + "oinv5493.internal.domain" + ], "related.ip": [ "10.171.221.230", "10.222.165.250", - "10.36.63.31", - "10.45.35.180" + "10.45.35.180", + "10.36.63.31" ], "related.user": [ "otamr" @@ -2084,11 +2180,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4329", + "related.hosts": [ + "tnonproi195.api.home" + ], "related.ip": [ - "10.238.4.219", - "10.83.238.145", + "10.1.171.61", "10.199.127.211", - "10.1.171.61" + "10.83.238.145", + "10.238.4.219" ], "related.user": [ "reetdolo" @@ -2148,11 +2247,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3789", + "related.hosts": [ + "edictasu5362.internal.localhost" + ], "related.ip": [ "10.170.252.219", + "10.65.141.244", "10.74.213.42", - "10.44.226.104", - "10.65.141.244" + "10.44.226.104" ], "related.user": [ "Nequepo" @@ -2212,11 +2314,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2965", + "related.hosts": [ + "uido492.www5.home" + ], "related.ip": [ "10.180.48.221", - "10.225.141.172", + "10.225.255.211", "10.183.223.149", - "10.225.255.211" + "10.225.141.172" ], "related.user": [ "nihil" @@ -2276,11 +2381,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7612", + "related.hosts": [ + "redo6311.api.invalid" + ], "related.ip": [ "10.176.64.28", "10.97.138.181", - "10.169.123.103", - "10.205.174.181" + "10.205.174.181", + "10.169.123.103" ], "related.user": [ "eseruntm" @@ -2341,11 +2449,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4226", + "related.hosts": [ + "dolorem1698.www.domain" + ], "related.ip": [ "10.75.120.11", + "10.169.101.161", "10.53.101.131", - "10.204.4.40", - "10.169.101.161" + "10.204.4.40" ], "related.user": [ "tquo" @@ -2406,11 +2517,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2990", + "related.hosts": [ + "evitae7333.www.lan" + ], "related.ip": [ "10.156.117.169", + "10.28.51.219", "10.6.222.112", - "10.87.120.87", - "10.28.51.219" + "10.87.120.87" ], "related.user": [ "onsequu" @@ -2470,11 +2584,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.388", + "related.hosts": [ + "arc2412.mail.lan" + ], "related.ip": [ - "10.4.126.103", - "10.253.167.17", "10.247.44.59", - "10.57.89.155" + "10.57.89.155", + "10.253.167.17", + "10.4.126.103" ], "related.user": [ "ntorever" @@ -2534,11 +2651,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6451", + "related.hosts": [ + "olorsi2746.internal.localhost" + ], "related.ip": [ - "10.15.240.220", "10.36.69.125", - "10.143.183.208", - "10.248.206.210" + "10.15.240.220", + "10.248.206.210", + "10.143.183.208" ], "related.user": [ "met" @@ -2599,11 +2719,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4386", + "related.hosts": [ + "edqu2208.www.localhost" + ], "related.ip": [ "10.69.170.107", "10.6.32.7", - "10.142.186.43", - "10.34.133.2" + "10.34.133.2", + "10.142.186.43" ], "related.user": [ "ipitlabo" @@ -2664,11 +2787,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2026", + "related.hosts": [ + "ender5647.www5.example" + ], "related.ip": [ "10.59.103.10", - "10.142.22.24", + "10.170.165.164", "10.121.153.197", - "10.170.165.164" + "10.142.22.24" ], "related.user": [ "borumSec" @@ -2729,6 +2855,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1576", + "related.hosts": [ + "sis3986.internal.lan" + ], "related.ip": [ "10.19.99.129", "10.247.114.30", @@ -2794,11 +2923,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3824", + "related.hosts": [ + "uatu2894.api.lan" + ], "related.ip": [ - "10.64.139.17", "10.70.7.23", + "10.40.177.138", "10.8.29.219", - "10.40.177.138" + "10.64.139.17" ], "related.user": [ "rep" @@ -2858,10 +2990,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6066", + "related.hosts": [ + "rmagnido5483.local" + ], "related.ip": [ "10.2.189.20", - "10.67.173.228", "10.67.221.220", + "10.67.173.228", "10.180.62.222" ], "related.user": [ @@ -2923,6 +3058,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5040", + "related.hosts": [ + "uian521.www.example" + ], "related.ip": [ "10.147.127.181", "10.209.52.47", @@ -2987,10 +3125,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7604", + "related.hosts": [ + "taliq5213.api.corp" + ], "related.ip": [ - "10.231.18.90", - "10.248.140.59", "10.226.24.84", + "10.248.140.59", + "10.231.18.90", "10.85.13.237" ], "related.user": [ @@ -3052,11 +3193,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5407", + "related.hosts": [ + "ntsunt4894.mail.domain" + ], "related.ip": [ - "10.203.46.215", + "10.59.215.207", "10.207.183.204", "10.8.224.72", - "10.59.215.207" + "10.203.46.215" ], "related.user": [ "eruntmo" @@ -3117,11 +3261,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6814", + "related.hosts": [ + "mexer3864.api.corp" + ], "related.ip": [ + "10.98.154.146", "10.73.84.95", "10.230.38.148", - "10.255.145.22", - "10.98.154.146" + "10.255.145.22" ], "related.user": [ "sitam" @@ -3181,11 +3328,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7160", + "related.hosts": [ + "oluptat6960.www5.test" + ], "related.ip": [ - "10.105.120.162", "10.166.142.198", - "10.211.29.187", - "10.175.181.138" + "10.105.120.162", + "10.175.181.138", + "10.211.29.187" ], "related.user": [ "tium" @@ -3246,11 +3396,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6057", + "related.hosts": [ + "fugiatnu2498.www.localhost" + ], "related.ip": [ - "10.220.202.102", "10.182.213.195", "10.195.139.25", - "10.122.133.162" + "10.122.133.162", + "10.220.202.102" ], "related.user": [ "aquae" @@ -3311,11 +3464,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3297", + "related.hosts": [ + "ptat3230.domain" + ], "related.ip": [ - "10.156.208.5", - "10.53.72.161", + "10.33.143.163", "10.247.144.9", - "10.33.143.163" + "10.156.208.5", + "10.53.72.161" ], "related.user": [ "scip" @@ -3375,11 +3531,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2476", + "related.hosts": [ + "exer447.internal.localhost" + ], "related.ip": [ + "10.241.143.145", "10.35.190.164", "10.21.58.162", - "10.113.65.192", - "10.241.143.145" + "10.113.65.192" ], "related.user": [ "porin" @@ -3440,11 +3599,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.768", + "related.hosts": [ + "itanimi1934.home" + ], "related.ip": [ - "10.19.154.103", - "10.53.27.253", + "10.129.16.166", "10.75.113.240", - "10.129.16.166" + "10.19.154.103", + "10.53.27.253" ], "related.user": [ "luptat" @@ -3505,6 +3667,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5812", + "related.hosts": [ + "pteurs1031.mail.corp" + ], "related.ip": [ "10.150.153.61", "10.22.213.196", @@ -3570,10 +3735,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7232", + "related.hosts": [ + "edquiaco6562.api.lan" + ], "related.ip": [ "10.85.52.249", - "10.238.171.184", "10.229.155.171", + "10.238.171.184", "10.113.2.13" ], "related.user": [ @@ -3635,11 +3803,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.536", + "related.hosts": [ + "tatis7315.mail.home" + ], "related.ip": [ "10.249.174.35", - "10.198.150.185", "10.51.245.225", - "10.220.1.249" + "10.220.1.249", + "10.198.150.185" ], "related.user": [ "quela" @@ -3700,10 +3871,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.219", + "related.hosts": [ + "eosqui3723.api.localdomain" + ], "related.ip": [ - "10.190.96.181", "10.38.185.31", "10.251.82.195", + "10.190.96.181", "10.152.157.32" ], "related.user": [ @@ -3764,11 +3938,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6526", + "related.hosts": [ + "itaedict199.mail.corp" + ], "related.ip": [ - "10.190.247.194", "10.103.102.242", - "10.211.198.50", - "10.230.112.179" + "10.190.247.194", + "10.230.112.179", + "10.211.198.50" ], "related.user": [ "tDuisaut" @@ -3828,11 +4005,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7750", + "related.hosts": [ + "xeaco7887.www.localdomain" + ], "related.ip": [ "10.219.83.199", "10.47.223.155", - "10.251.101.61", - "10.101.13.122" + "10.101.13.122", + "10.251.101.61" ], "related.user": [ "ectetur" @@ -3893,11 +4073,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5568", + "related.hosts": [ + "saute7421.www.invalid" + ], "related.ip": [ + "10.31.86.83", "10.21.30.43", - "10.83.136.233", "10.21.80.157", - "10.31.86.83" + "10.83.136.233" ], "related.user": [ "litsed" @@ -3958,11 +4141,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5445", + "related.hosts": [ + "oluptas1637.home" + ], "related.ip": [ - "10.195.90.73", + "10.27.181.27", "10.45.152.205", "10.194.197.107", - "10.27.181.27" + "10.195.90.73" ], "related.user": [ "datatn" @@ -4023,11 +4209,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.508", + "related.hosts": [ + "ididu5505.api.localdomain" + ], "related.ip": [ "10.222.2.132", + "10.183.90.25", "10.43.239.97", - "10.129.161.18", - "10.183.90.25" + "10.129.161.18" ], "related.user": [ "aedicta" @@ -4087,11 +4276,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4479", + "related.hosts": [ + "mqui1099.api.corp" + ], "related.ip": [ + "10.67.129.100", "10.231.167.171", - "10.248.156.138", "10.189.162.131", - "10.67.129.100" + "10.248.156.138" ], "related.user": [ "sedquia" @@ -4152,11 +4344,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2927", + "related.hosts": [ + "siuta2155.lan" + ], "related.ip": [ - "10.63.103.30", - "10.142.106.66", "10.6.146.184", - "10.185.107.27" + "10.185.107.27", + "10.63.103.30", + "10.142.106.66" ], "related.user": [ "sequu" @@ -4216,11 +4411,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4023", + "related.hosts": [ + "tatiset4191.localdomain" + ], "related.ip": [ "10.93.39.237", "10.119.179.182", - "10.214.93.200", - "10.0.202.9" + "10.0.202.9", + "10.214.93.200" ], "related.user": [ "tionofd" @@ -4281,9 +4479,12 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5939", + "related.hosts": [ + "aute2433.mail.lan" + ], "related.ip": [ - "10.252.204.162", "10.28.145.163", + "10.252.204.162", "10.123.154.140", "10.30.189.166" ], @@ -4345,10 +4546,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6564", + "related.hosts": [ + "idolo6535.internal.example" + ], "related.ip": [ + "10.145.128.250", "10.79.49.3", "10.46.162.198", - "10.145.128.250", "10.29.122.183" ], "related.user": [ @@ -4410,10 +4614,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3341", + "related.hosts": [ + "one7728.api.localdomain" + ], "related.ip": [ + "10.166.169.167", "10.65.174.196", "10.177.232.136", - "10.166.169.167", "10.142.235.217" ], "related.user": [ @@ -4475,10 +4682,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.325", + "related.hosts": [ + "uptatem4446.internal.localhost" + ], "related.ip": [ "10.29.217.44", - "10.191.78.86", "10.215.184.154", + "10.191.78.86", "10.53.188.140" ], "related.user": [ @@ -4540,11 +4750,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3567", + "related.hosts": [ + "emq2514.api.localhost" + ], "related.ip": [ "10.135.77.156", - "10.74.74.129", + "10.46.222.149", "10.76.148.147", - "10.46.222.149" + "10.74.74.129" ], "related.user": [ "urve" @@ -4604,11 +4817,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1186", + "related.hosts": [ + "agna5654.www.corp" + ], "related.ip": [ - "10.130.203.37", "10.145.49.29", + "10.96.200.223", "10.11.146.253", - "10.96.200.223" + "10.130.203.37" ], "related.user": [ "mvele" @@ -4668,10 +4884,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6845", + "related.hosts": [ + "ipi4827.mail.lan" + ], "related.ip": [ - "10.48.75.140", - "10.162.78.48", "10.24.23.209", + "10.162.78.48", + "10.48.75.140", "10.162.2.180" ], "related.user": [ @@ -4732,9 +4951,12 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.419", + "related.hosts": [ + "sequatD163.internal.example" + ], "related.ip": [ - "10.66.92.83", "10.151.206.38", + "10.66.92.83", "10.119.12.186", "10.97.105.115" ], @@ -4796,11 +5018,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7551", + "related.hosts": [ + "itamet1303.invalid" + ], "related.ip": [ - "10.12.148.73", - "10.201.132.114", + "10.64.76.142", "10.169.139.250", - "10.64.76.142" + "10.12.148.73", + "10.201.132.114" ], "related.user": [ "borisnis" @@ -4861,10 +5086,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5292", + "related.hosts": [ + "epr3512.internal.domain" + ], "related.ip": [ - "10.35.38.185", - "10.9.236.18", "10.111.128.11", + "10.9.236.18", + "10.35.38.185", "10.200.116.191" ], "related.user": [ @@ -4925,11 +5153,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5991", + "related.hosts": [ + "uredol2174.home" + ], "related.ip": [ - "10.236.67.227", "10.134.238.8", - "10.240.62.238", - "10.191.27.182" + "10.191.27.182", + "10.236.67.227", + "10.240.62.238" ], "related.user": [ "tlabo" @@ -4989,11 +5220,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6837", + "related.hosts": [ + "ididunt7607.mail.localhost" + ], "related.ip": [ "10.109.14.142", + "10.22.231.91", "10.65.35.64", - "10.165.66.92", - "10.22.231.91" + "10.165.66.92" ], "related.user": [ "perna" @@ -5053,11 +5287,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.99", + "related.hosts": [ + "inimav5557.www5.test" + ], "related.ip": [ - "10.29.230.203", - "10.89.221.90", + "10.64.161.215", "10.71.112.86", - "10.64.161.215" + "10.89.221.90", + "10.29.230.203" ], "related.user": [ "rnatur" @@ -5117,11 +5354,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.5232", + "related.hosts": [ + "nonn1650.www.test" + ], "related.ip": [ - "10.140.118.182", - "10.88.226.76", "10.221.199.137", - "10.79.208.135" + "10.88.226.76", + "10.79.208.135", + "10.140.118.182" ], "related.user": [ "erspic" @@ -5182,11 +5422,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2492", + "related.hosts": [ + "acons3940.api.lan" + ], "related.ip": [ - "10.133.48.55", - "10.126.61.230", "10.35.73.208", - "10.189.244.22" + "10.126.61.230", + "10.189.244.22", + "10.133.48.55" ], "related.user": [ "tia" @@ -5246,10 +5489,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4044", + "related.hosts": [ + "suscipit587.www.localhost" + ], "related.ip": [ - "10.81.154.115", "10.240.94.109", "10.239.194.105", + "10.81.154.115", "10.35.65.72" ], "related.user": [ @@ -5311,11 +5557,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2307", + "related.hosts": [ + "mnisiut6146.internal.local" + ], "related.ip": [ "10.150.56.227", - "10.38.253.213", + "10.52.70.192", "10.248.72.104", - "10.52.70.192" + "10.38.253.213" ], "related.user": [ "ionem" @@ -5376,10 +5625,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2031", + "related.hosts": [ + "borios1067.www5.home" + ], "related.ip": [ - "10.73.172.186", "10.218.15.164", "10.62.218.239", + "10.73.172.186", "10.203.193.134" ], "related.user": [ @@ -5440,11 +5692,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2555", + "related.hosts": [ + "msequ323.www.example" + ], "related.ip": [ - "10.60.20.76", "10.10.46.43", - "10.136.211.234", - "10.131.127.113" + "10.131.127.113", + "10.60.20.76", + "10.136.211.234" ], "related.user": [ "nev" @@ -5505,11 +5760,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3291", + "related.hosts": [ + "tdolorem813.internal.host" + ], "related.ip": [ - "10.233.181.250", "10.248.0.74", - "10.50.177.151", - "10.187.237.220" + "10.233.181.250", + "10.187.237.220", + "10.50.177.151" ], "related.user": [ "ugiatq" @@ -5570,11 +5828,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2859", + "related.hosts": [ + "volupt4626.internal.test" + ], "related.ip": [ - "10.248.248.120", "10.96.223.46", + "10.80.129.81", "10.189.43.11", - "10.80.129.81" + "10.248.248.120" ], "related.user": [ "iatn" @@ -5635,10 +5896,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.1910", + "related.hosts": [ + "ntium5103.www5.localhost" + ], "related.ip": [ - "10.173.114.63", - "10.102.109.199", "10.91.115.139", + "10.102.109.199", + "10.173.114.63", "10.66.106.186" ], "related.user": [ @@ -5700,10 +5964,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3690", + "related.hosts": [ + "orpori3334.www.local" + ], "related.ip": [ - "10.159.155.88", "10.0.175.17", "10.198.157.122", + "10.159.155.88", "10.221.223.127" ], "related.user": [ @@ -5764,6 +6031,9 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.6302", + "related.hosts": [ + "equu7361.www5.localdomain" + ], "related.ip": [ "10.252.136.130", "10.189.70.237", @@ -5829,11 +6099,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2037", + "related.hosts": [ + "tse2979.internal.localhost" + ], "related.ip": [ - "10.102.109.194", "10.60.224.93", "10.242.121.165", - "10.83.105.69" + "10.83.105.69", + "10.102.109.194" ], "related.user": [ "mni" @@ -5894,10 +6167,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7314", + "related.hosts": [ + "uisnostr2390.mail.domain" + ], "related.ip": [ - "10.251.167.219", "10.219.174.45", "10.181.134.69", + "10.251.167.219", "10.17.20.93" ], "related.user": [ @@ -5959,11 +6235,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.596", + "related.hosts": [ + "luptate4811.mail.example" + ], "related.ip": [ - "10.30.117.82", "10.28.233.253", - "10.223.99.90", - "10.37.14.20" + "10.37.14.20", + "10.30.117.82", + "10.223.99.90" ], "related.user": [ "numqua" @@ -6024,11 +6303,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.95", + "related.hosts": [ + "lites1614.www.corp" + ], "related.ip": [ - "10.50.61.114", - "10.125.20.22", "10.57.85.113", - "10.8.32.17" + "10.8.32.17", + "10.50.61.114", + "10.125.20.22" ], "related.user": [ "qua" @@ -6089,10 +6371,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.3064", + "related.hosts": [ + "lorinrep7686.mail.corp" + ], "related.ip": [ - "10.113.78.101", "10.200.28.55", "10.215.224.27", + "10.113.78.101", "10.181.63.82" ], "related.user": [ @@ -6154,10 +6439,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.4522", + "related.hosts": [ + "nderit6272.mail.example" + ], "related.ip": [ - "10.139.20.223", - "10.177.14.106", "10.243.43.168", + "10.177.14.106", + "10.139.20.223", "10.169.95.128" ], "related.user": [ @@ -6219,11 +6507,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7456", + "related.hosts": [ + "ntu1279.mail.lan" + ], "related.ip": [ "10.92.168.198", "10.90.93.4", - "10.18.176.44", - "10.39.100.88" + "10.39.100.88", + "10.18.176.44" ], "related.user": [ "adminima" @@ -6284,10 +6575,13 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.2909", + "related.hosts": [ + "essequam1161.domain" + ], "related.ip": [ - "10.49.68.8", "10.163.203.191", "10.193.43.135", + "10.49.68.8", "10.173.13.179" ], "related.user": [ @@ -6348,11 +6642,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.7726", + "related.hosts": [ + "cipitl2184.localdomain" + ], "related.ip": [ - "10.31.147.51", - "10.84.64.28", "10.240.47.113", - "10.209.226.7" + "10.209.226.7", + "10.31.147.51", + "10.84.64.28" ], "related.user": [ "ull" @@ -6413,11 +6710,14 @@ "observer.type": "Firewall", "observer.vendor": "F5", "observer.version": "1.292", + "related.hosts": [ + "item3647.home" + ], "related.ip": [ - "10.32.20.4", + "10.225.189.229", "10.86.1.244", "10.52.13.192", - "10.225.189.229" + "10.32.20.4" ], "related.user": [ "odtemp" diff --git a/x-pack/filebeat/module/f5/bigipapm/config/input.yml b/x-pack/filebeat/module/f5/bigipapm/config/input.yml index 2cfda9d24b5..72e7af4e030 100644 --- a/x-pack/filebeat/module/f5/bigipapm/config/input.yml +++ b/x-pack/filebeat/module/f5/bigipapm/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/f5/bigipapm/ingest/pipeline.yml b/x-pack/filebeat/module/f5/bigipapm/ingest/pipeline.yml index e8059307928..8dbd2e2e6cb 100644 --- a/x-pack/filebeat/module/f5/bigipapm/ingest/pipeline.yml +++ b/x-pack/filebeat/module/f5/bigipapm/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{rsa.web.fqdn}}' + allow_duplicates: false + if: ctx?.rsa?.web?.fqdn != null && ctx.rsa?.web?.fqdn != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json b/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json index b3f74874b99..fe5ce75e182 100644 --- a/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json @@ -42,6 +42,9 @@ "observer.type": "Access", "observer.vendor": "F5", "process.pid": 6153, + "related.hosts": [ + "sist1803.mail.local" + ], "rsa.internal.messageid": "01490504", "rsa.misc.log_session_id": "deF", "rsa.misc.severity": "medium", @@ -809,6 +812,9 @@ "observer.type": "Access", "observer.vendor": "F5", "process.pid": 7589, + "related.hosts": [ + "dolores2519.mail.host" + ], "related.user": [ "tob" ], @@ -839,6 +845,9 @@ "observer.type": "Access", "observer.vendor": "F5", "process.pid": 5899, + "related.hosts": [ + "luptat2979.internal.local" + ], "related.user": [ "iqua" ], @@ -974,8 +983,8 @@ "observer.vendor": "F5", "process.pid": 4318, "related.ip": [ - "10.122.204.151", - "10.169.101.161" + "10.169.101.161", + "10.122.204.151" ], "rsa.internal.messageid": "01490500", "rsa.misc.log_session_id": "snulap", @@ -1556,8 +1565,8 @@ "observer.vendor": "F5", "process.pid": 1973, "related.ip": [ - "10.187.64.126", - "10.47.99.72" + "10.47.99.72", + "10.187.64.126" ], "rsa.internal.messageid": "01490500", "rsa.misc.category": "oremipsu", diff --git a/x-pack/filebeat/module/fortinet/clientendpoint/config/input.yml b/x-pack/filebeat/module/fortinet/clientendpoint/config/input.yml index 2792f46aafd..40b42e4e527 100644 --- a/x-pack/filebeat/module/fortinet/clientendpoint/config/input.yml +++ b/x-pack/filebeat/module/fortinet/clientendpoint/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/fortinet/clientendpoint/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/clientendpoint/ingest/pipeline.yml index 36997bc4379..28bbbd0e58e 100644 --- a/x-pack/filebeat/module/fortinet/clientendpoint/ingest/pipeline.yml +++ b/x-pack/filebeat/module/fortinet/clientendpoint/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain != null && ctx.server?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json index 3b9dc0716ec..69eab97fe35 100644 --- a/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json @@ -20,6 +20,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7880, + "related.hosts": [ + "boNemoe4402.www.invalid", + "litesse6379.api.domain" + ], "related.ip": [ "10.150.92.220", "10.102.123.34" @@ -75,9 +79,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4539, + "related.hosts": [ + "olupt4880.api.home", + "gnaali6189.internal.localhost" + ], "related.ip": [ - "10.149.203.46", - "10.33.212.159" + "10.33.212.159", + "10.149.203.46" ], "related.user": [ "mipsumq" @@ -130,6 +138,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 445, + "related.hosts": [ + "aqu1628.internal.domain", + "quis1130.internal.corp" + ], "related.ip": [ "10.118.175.9", "10.173.116.41" @@ -185,9 +197,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5712, + "related.hosts": [ + "tinculp2940.internal.local", + "reprehe189.internal.home" + ], "related.ip": [ - "10.202.204.154", - "10.134.137.177" + "10.134.137.177", + "10.202.204.154" ], "related.user": [ "orsitame" @@ -240,9 +256,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6557, + "related.hosts": [ + "rad2103.api.domain", + "enimad2283.internal.domain" + ], "related.ip": [ - "10.70.0.60", - "10.245.142.250" + "10.245.142.250", + "10.70.0.60" ], "related.user": [ "eos" @@ -295,9 +315,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2061, + "related.hosts": [ + "enim5316.www5.local", + "doloreeu3553.www5.home" + ], "related.ip": [ - "10.202.72.124", - "10.200.188.142" + "10.200.188.142", + "10.202.72.124" ], "related.user": [ "iusmodt" @@ -350,9 +374,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5722, + "related.hosts": [ + "reetdolo2770.www5.local", + "iutal13.api.localdomain" + ], "related.ip": [ - "10.214.225.125", - "10.12.44.169" + "10.12.44.169", + "10.214.225.125" ], "related.user": [ "erep" @@ -405,6 +433,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5037, + "related.hosts": [ + "isiu1114.internal.corp", + "uovol492.www.localhost" + ], "related.ip": [ "10.198.136.50", "10.66.108.11" @@ -460,6 +492,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 776, + "related.hosts": [ + "usmodte1296.www.corp", + "osquir6997.corp" + ], "related.ip": [ "10.69.20.77", "10.178.244.31" @@ -515,6 +551,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6096, + "related.hosts": [ + "tatno4987.www5.localhost", + "eniam7007.api.invalid" + ], "related.ip": [ "10.54.231.100", "10.203.5.162" @@ -570,9 +610,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7307, + "related.hosts": [ + "tatno6787.internal.localhost", + "snulapar3794.api.domain" + ], "related.ip": [ - "10.136.252.240", - "10.65.83.160" + "10.65.83.160", + "10.136.252.240" ], "related.user": [ "ender" @@ -625,6 +669,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2703, + "related.hosts": [ + "essecill2595.mail.local", + "liq5883.localdomain" + ], "related.ip": [ "10.210.213.18", "10.57.40.29" @@ -680,6 +728,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5166, + "related.hosts": [ + "ali6446.localhost", + "rsint7026.test" + ], "related.ip": [ "10.144.82.69", "10.200.156.102" @@ -735,6 +787,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7668, + "related.hosts": [ + "torev7118.internal.domain", + "qua2945.www.local" + ], "related.ip": [ "10.109.232.112", "10.72.58.135" @@ -790,9 +846,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1044, + "related.hosts": [ + "dolore6103.www5.example", + "luptat6494.www.example" + ], "related.ip": [ - "10.38.22.45", - "10.72.29.73" + "10.72.29.73", + "10.38.22.45" ], "related.user": [ "onproide" @@ -845,6 +905,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7183, + "related.hosts": [ + "errorsi6996.www.domain", + "moenimi6317.internal.invalid" + ], "related.ip": [ "10.70.95.74", "10.76.72.111" @@ -900,6 +964,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6907, + "related.hosts": [ + "lumquido5839.api.corp", + "tion1761.home" + ], "related.ip": [ "10.73.69.75", "10.19.201.13" @@ -955,6 +1023,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 499, + "related.hosts": [ + "aperia4409.www5.invalid", + "santium4235.api.local" + ], "related.ip": [ "10.84.105.75", "10.78.151.178" @@ -1010,6 +1082,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1531, + "related.hosts": [ + "tem2496.api.lan", + "CSed2857.www5.example" + ], "related.ip": [ "10.25.192.202", "10.135.233.146" @@ -1065,9 +1141,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6051, + "related.hosts": [ + "eme6710.mail.invalid", + "equep5085.mail.domain" + ], "related.ip": [ - "10.121.219.204", - "10.104.134.200" + "10.104.134.200", + "10.121.219.204" ], "related.user": [ "uptat" @@ -1120,9 +1200,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6994, + "related.hosts": [ + "ihilm1669.mail.invalid", + "conseq557.mail.lan" + ], "related.ip": [ - "10.191.105.82", - "10.225.160.182" + "10.225.160.182", + "10.191.105.82" ], "related.user": [ "eirure" @@ -1175,6 +1259,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5200, + "related.hosts": [ + "umexerci1284.internal.localdomain", + "ite2026.www.invalid" + ], "related.ip": [ "10.141.44.153", "10.161.57.8" @@ -1230,6 +1318,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3365, + "related.hosts": [ + "adol485.example", + "lit5929.test" + ], "related.ip": [ "10.153.111.103", "10.6.167.7" @@ -1285,6 +1377,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1835, + "related.hosts": [ + "evita5008.www.localdomain", + "oru6938.invalid" + ], "related.ip": [ "10.248.204.182", "10.134.148.219" @@ -1340,6 +1436,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2019, + "related.hosts": [ + "tsedqu2456.www5.invalid", + "etdol5473.local" + ], "related.ip": [ "10.163.5.243", "10.178.77.231" @@ -1395,9 +1495,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2493, + "related.hosts": [ + "ris3314.mail.invalid", + "nimid893.mail.corp" + ], "related.ip": [ - "10.177.194.18", - "10.221.89.228" + "10.221.89.228", + "10.177.194.18" ], "related.user": [ "aliquam" @@ -1450,6 +1554,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3022, + "related.hosts": [ + "reme622.mail.example", + "rumwritt6003.host" + ], "related.ip": [ "10.32.239.1", "10.241.65.49" @@ -1505,9 +1613,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2328, + "related.hosts": [ + "non3341.mail.invalid", + "xeacomm6855.api.corp" + ], "related.ip": [ - "10.101.57.120", - "10.168.90.81" + "10.168.90.81", + "10.101.57.120" ], "related.user": [ "eporr" @@ -1560,6 +1672,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1156, + "related.hosts": [ + "ris727.api.local", + "icabo4125.mail.domain" + ], "related.ip": [ "10.130.14.60", "10.14.211.43" @@ -1615,9 +1731,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6003, + "related.hosts": [ + "stquido5705.api.host", + "ionofdeF5643.www.localhost" + ], "related.ip": [ - "10.248.101.25", - "10.60.129.15" + "10.60.129.15", + "10.248.101.25" ], "related.user": [ "evolup" @@ -1670,9 +1790,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5651, + "related.hosts": [ + "etcons7378.api.lan", + "orem6702.invalid" + ], "related.ip": [ - "10.72.93.28", - "10.111.187.12" + "10.111.187.12", + "10.72.93.28" ], "related.user": [ "niamqui" @@ -1725,6 +1849,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3470, + "related.hosts": [ + "vita2681.www5.local", + "oin6780.mail.domain" + ], "related.ip": [ "10.27.14.168", "10.66.2.232" @@ -1780,6 +1908,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6932, + "related.hosts": [ + "tnulapa7592.www.local", + "eprehen3224.www5.localdomain" + ], "related.ip": [ "10.195.2.130", "10.75.99.127" @@ -1835,6 +1967,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6945, + "related.hosts": [ + "lup2134.www.localhost", + "ptasn6599.www.localhost" + ], "related.ip": [ "10.201.238.90", "10.245.104.182" @@ -1890,9 +2026,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 853, + "related.hosts": [ + "tanimid3337.mail.corp", + "nisist2752.home" + ], "related.ip": [ - "10.105.91.31", - "10.217.150.196" + "10.217.150.196", + "10.105.91.31" ], "related.user": [ "con" @@ -1945,9 +2085,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4153, + "related.hosts": [ + "eumiu765.api.lan", + "gitsedqu2649.mail.lan" + ], "related.ip": [ - "10.4.157.1", - "10.184.18.202" + "10.184.18.202", + "10.4.157.1" ], "related.user": [ "oditem" @@ -2000,9 +2144,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1693, + "related.hosts": [ + "mquelau5326.mail.lan", + "entsunt3962.www.example" + ], "related.ip": [ - "10.255.39.252", - "10.113.95.59" + "10.113.95.59", + "10.255.39.252" ], "related.user": [ "persp" @@ -2055,9 +2203,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 337, + "related.hosts": [ + "idestlab2631.www.lan", + "tut2703.www.host" + ], "related.ip": [ - "10.83.177.2", - "10.27.16.118" + "10.27.16.118", + "10.83.177.2" ], "related.user": [ "borios" @@ -2110,6 +2262,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7041, + "related.hosts": [ + "inesci6789.test", + "entorev160.test" + ], "related.ip": [ "10.167.227.44", "10.38.54.72" @@ -2165,6 +2321,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3854, + "related.hosts": [ + "ccaeca7077.internal.corp", + "proide3714.mail.localdomain" + ], "related.ip": [ "10.215.205.216", "10.216.54.184" @@ -2220,6 +2380,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 55, + "related.hosts": [ + "ima2031.api.corp", + "tot5313.mail.invalid" + ], "related.ip": [ "10.9.18.237", "10.9.12.248" @@ -2275,9 +2439,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 228, + "related.hosts": [ + "ian867.internal.corp", + "rumet3801.internal.domain" + ], "related.ip": [ - "10.83.130.226", - "10.41.123.102" + "10.41.123.102", + "10.83.130.226" ], "related.user": [ "tenim" @@ -2330,9 +2498,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4253, + "related.hosts": [ + "lorin4249.corp", + "liqua2834.www5.lan" + ], "related.ip": [ - "10.80.152.108", - "10.175.112.197" + "10.175.112.197", + "10.80.152.108" ], "related.user": [ "tametcon" @@ -2385,6 +2557,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2200, + "related.hosts": [ + "gnaaliqu3935.api.test", + "sequat7273.api.host" + ], "related.ip": [ "10.134.18.114", "10.142.25.100" @@ -2440,6 +2616,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5717, + "related.hosts": [ + "nsequat1859.internal.localhost", + "uidol4575.localhost" + ], "related.ip": [ "10.28.118.160", "10.223.119.218" @@ -2495,6 +2675,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4469, + "related.hosts": [ + "ritin2495.api.corp", + "oremq2000.api.corp" + ], "related.ip": [ "10.47.28.48", "10.110.114.175" @@ -2550,6 +2734,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5524, + "related.hosts": [ + "tetur2694.mail.local", + "oremi1485.api.localhost" + ], "related.ip": [ "10.40.251.202", "10.90.33.138" @@ -2605,9 +2793,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3624, + "related.hosts": [ + "rem7043.localhost", + "sequatD5469.www5.lan" + ], "related.ip": [ - "10.227.173.252", - "10.65.2.106" + "10.65.2.106", + "10.227.173.252" ], "related.user": [ "itation" @@ -2660,6 +2852,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1609, + "related.hosts": [ + "emqu2846.internal.home", + "item2738.test" + ], "related.ip": [ "10.28.84.106", "10.193.233.229" @@ -2715,9 +2911,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6248, + "related.hosts": [ + "dqu6144.api.localhost", + "iosamnis1047.internal.localdomain" + ], "related.ip": [ - "10.150.245.88", - "10.210.89.183" + "10.210.89.183", + "10.150.245.88" ], "related.user": [ "sequa" @@ -2770,6 +2970,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7224, + "related.hosts": [ + "giatquov1918.internal.example", + "orroq6677.internal.example" + ], "related.ip": [ "10.85.185.13", "10.180.195.43" @@ -2825,6 +3029,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 430, + "related.hosts": [ + "estl5804.internal.local", + "onevo4326.internal.local" + ], "related.ip": [ "10.210.28.247", "10.207.211.230" @@ -2880,9 +3088,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3589, + "related.hosts": [ + "Sedut1775.www.domain", + "itaedict7233.mail.localdomain" + ], "related.ip": [ - "10.248.165.185", - "10.86.11.48" + "10.86.11.48", + "10.248.165.185" ], "related.user": [ "dquiac" @@ -2935,9 +3147,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4814, + "related.hosts": [ + "mac7484.www5.test", + "numquam5869.internal.example" + ], "related.ip": [ - "10.47.125.38", - "10.118.6.177" + "10.118.6.177", + "10.47.125.38" ], "related.user": [ "quunt" @@ -2990,6 +3206,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 276, + "related.hosts": [ + "oin1140.mail.localhost", + "onu6137.api.home" + ], "related.ip": [ "10.60.142.127", "10.50.233.155" @@ -3045,6 +3265,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2452, + "related.hosts": [ + "naaliq3710.api.local", + "aecatcup2241.www5.test" + ], "related.ip": [ "10.28.82.189", "10.120.10.211" @@ -3100,6 +3324,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3453, + "related.hosts": [ + "volupta3552.internal.localhost", + "labor6360.mail.local" + ], "related.ip": [ "10.31.237.225", "10.6.38.163" @@ -3155,9 +3383,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2302, + "related.hosts": [ + "onse380.internal.localdomain", + "mveleum4322.www5.host" + ], "related.ip": [ - "10.125.165.144", - "10.226.5.189" + "10.226.5.189", + "10.125.165.144" ], "related.user": [ "mvolu" @@ -3210,6 +3442,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7079, + "related.hosts": [ + "queips4947.mail.example", + "archite1843.mail.home" + ], "related.ip": [ "10.46.56.204", "10.97.149.97" @@ -3265,9 +3501,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5773, + "related.hosts": [ + "oloreseo5039.test", + "itanim4024.api.example" + ], "related.ip": [ - "10.218.0.197", - "10.28.105.124" + "10.28.105.124", + "10.218.0.197" ], "related.user": [ "ntNe" @@ -3320,6 +3560,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1586, + "related.hosts": [ + "minim459.mail.local", + "nreprehe715.api.home" + ], "related.ip": [ "10.17.87.79", "10.123.199.198" @@ -3375,9 +3619,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5137, + "related.hosts": [ + "eratv211.api.host", + "unte893.internal.host" + ], "related.ip": [ - "10.115.68.40", - "10.38.86.177" + "10.38.86.177", + "10.115.68.40" ], "related.user": [ "mpo" @@ -3430,9 +3678,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5704, + "related.hosts": [ + "aparia1179.www.localdomain", + "aspe951.mail.domain" + ], "related.ip": [ - "10.193.118.163", - "10.115.174.107" + "10.115.174.107", + "10.193.118.163" ], "related.user": [ "exeacomm" @@ -3485,6 +3737,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2310, + "related.hosts": [ + "iatqu6203.mail.corp", + "dipiscin4957.www.home" + ], "related.ip": [ "10.77.77.208", "10.37.128.49" @@ -3540,6 +3796,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5398, + "related.hosts": [ + "ptasnula6576.api.invalid", + "econs2687.internal.localdomain" + ], "related.ip": [ "10.54.73.158", "10.1.96.93" @@ -3595,6 +3855,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2465, + "related.hosts": [ + "mag1506.internal.domain", + "tiumto5834.api.lan" + ], "related.ip": [ "10.182.152.242", "10.131.126.109" @@ -3650,6 +3914,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6064, + "related.hosts": [ + "fugits1163.host", + "iutal6032.www.test" + ], "related.ip": [ "10.181.247.224", "10.77.229.168" @@ -3705,9 +3973,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2861, + "related.hosts": [ + "gitse2463.www5.invalid", + "inculp2078.host" + ], "related.ip": [ - "10.72.162.6", - "10.235.116.121" + "10.235.116.121", + "10.72.162.6" ], "related.user": [ "oinv" @@ -3760,9 +4032,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3559, + "related.hosts": [ + "temse6953.www.example", + "mexerc2757.internal.home" + ], "related.ip": [ - "10.149.193.117", - "10.28.124.236" + "10.28.124.236", + "10.149.193.117" ], "related.user": [ "mullam" @@ -3815,6 +4091,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1710, + "related.hosts": [ + "deriti6952.mail.domain", + "squira4455.api.domain" + ], "related.ip": [ "10.196.96.162", "10.34.131.224" @@ -3870,6 +4150,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4984, + "related.hosts": [ + "abor1370.www.domain", + "emveleum3661.localhost" + ], "related.ip": [ "10.97.236.123", "10.77.78.180" @@ -3925,9 +4209,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3421, + "related.hosts": [ + "emullamc5418.mail.test", + "sedquiac6517.internal.localhost" + ], "related.ip": [ - "10.45.54.107", - "10.82.133.66" + "10.82.133.66", + "10.45.54.107" ], "related.user": [ "olorem" @@ -3980,6 +4268,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4020, + "related.hosts": [ + "squirati7050.www5.lan", + "veniam3148.www5.home" + ], "related.ip": [ "10.170.252.219", "10.180.180.230" @@ -4035,9 +4327,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 617, + "related.hosts": [ + "venia2079.mail.example", + "unt3559.www.home" + ], "related.ip": [ - "10.65.144.51", - "10.5.11.205" + "10.5.11.205", + "10.65.144.51" ], "related.user": [ "uptat" @@ -4090,6 +4386,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 487, + "related.hosts": [ + "snostrum3450.www5.localhost", + "rere5274.mail.domain" + ], "related.ip": [ "10.76.122.196", "10.195.223.82" @@ -4145,6 +4445,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2442, + "related.hosts": [ + "gelitsed3249.corp", + "uaeabi3728.www5.invalid" + ], "related.ip": [ "10.225.255.211", "10.138.210.116" @@ -4200,6 +4504,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6311, + "related.hosts": [ + "dolor7082.internal.localhost", + "uamqu2804.test" + ], "related.ip": [ "10.250.81.189", "10.219.1.151" @@ -4255,6 +4563,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 7128, + "related.hosts": [ + "totam6886.api.localhost", + "olor5201.host" + ], "related.ip": [ "10.54.23.133", "10.76.125.70" @@ -4310,9 +4622,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2780, + "related.hosts": [ + "laborum5749.www.example", + "eufug3348.www.lan" + ], "related.ip": [ - "10.36.110.69", - "10.189.42.62" + "10.189.42.62", + "10.36.110.69" ], "related.user": [ "eque" @@ -4365,6 +4681,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3284, + "related.hosts": [ + "lup3313.api.home", + "stquidol239.www5.invalid" + ], "related.ip": [ "10.47.179.68", "10.183.202.82" @@ -4420,6 +4740,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2314, + "related.hosts": [ + "edq5397.www.test", + "gia6531.mail.invalid" + ], "related.ip": [ "10.73.28.165", "10.221.206.74" @@ -4475,9 +4799,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5284, + "related.hosts": [ + "udan6536.www5.test", + "lamcola4879.www5.localdomain" + ], "related.ip": [ - "10.85.104.146", - "10.14.204.36" + "10.14.204.36", + "10.85.104.146" ], "related.user": [ "emp" @@ -4530,6 +4858,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3990, + "related.hosts": [ + "rumet6923.www5.lan", + "edquian330.mail.local" + ], "related.ip": [ "10.208.18.210", "10.30.246.132" @@ -4585,6 +4917,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4337, + "related.hosts": [ + "itse522.internal.localdomain", + "santi837.api.domain" + ], "related.ip": [ "10.19.119.17", "10.106.249.91" @@ -4640,9 +4976,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5275, + "related.hosts": [ + "amc3059.local", + "lpaquiof804.internal.invalid" + ], "related.ip": [ - "10.181.41.154", - "10.29.109.126" + "10.29.109.126", + "10.181.41.154" ], "related.user": [ "labo" @@ -4695,6 +5035,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2286, + "related.hosts": [ + "enbyCi3813.api.domain", + "nonn4478.host" + ], "related.ip": [ "10.164.207.42", "10.164.120.197" @@ -4750,6 +5094,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2990, + "related.hosts": [ + "liquipex1155.mail.corp", + "amquaer3985.www5.example" + ], "related.ip": [ "10.183.189.133", "10.154.191.225" @@ -4805,9 +5153,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 226, + "related.hosts": [ + "isn3991.local", + "orem6317.local" + ], "related.ip": [ - "10.29.120.226", - "10.103.189.199" + "10.103.189.199", + "10.29.120.226" ], "related.user": [ "emu" @@ -4860,9 +5212,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4691, + "related.hosts": [ + "iumtotam1010.www5.corp", + "velill3230.www.corp" + ], "related.ip": [ - "10.210.153.7", - "10.133.254.23" + "10.133.254.23", + "10.210.153.7" ], "related.user": [ "voluptas" @@ -4915,9 +5271,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5647, + "related.hosts": [ + "onsecte91.www5.localdomain", + "orumS757.www5.corp" + ], "related.ip": [ - "10.126.245.73", - "10.91.2.135" + "10.91.2.135", + "10.126.245.73" ], "related.user": [ "olore" @@ -4970,6 +5330,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 2313, + "related.hosts": [ + "abori7686.internal.host", + "emi4534.www.localdomain" + ], "related.ip": [ "10.137.85.123", "10.183.243.246" @@ -5025,6 +5389,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1585, + "related.hosts": [ + "reprehen3513.test", + "inimav1576.mail.example" + ], "related.ip": [ "10.61.225.196", "10.10.86.55" @@ -5080,6 +5448,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 3141, + "related.hosts": [ + "orroquis284.api.domain", + "aturQu7083.mail.host" + ], "related.ip": [ "10.79.73.195", "10.125.143.153" @@ -5135,6 +5507,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6331, + "related.hosts": [ + "tionula2060.www5.localhost", + "lumqui7769.mail.local" + ], "related.ip": [ "10.64.139.17", "10.240.216.85" @@ -5190,9 +5566,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4474, + "related.hosts": [ + "rumSecti111.www5.domain", + "siarc6339.internal.corp" + ], "related.ip": [ - "10.87.90.49", - "10.222.245.80" + "10.222.245.80", + "10.87.90.49" ], "related.user": [ "ptatemse" @@ -5245,6 +5625,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4855, + "related.hosts": [ + "olores7881.local", + "ptatev6552.www.test" + ], "related.ip": [ "10.87.144.208", "10.143.53.214" @@ -5300,6 +5684,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 1729, + "related.hosts": [ + "tDuis3281.www5.localdomain", + "byC5766.internal.home" + ], "related.ip": [ "10.105.97.134", "10.204.178.19" @@ -5355,9 +5743,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 4493, + "related.hosts": [ + "uptasnul2751.www5.corp", + "hender6628.local" + ], "related.ip": [ - "10.161.64.168", - "10.194.67.223" + "10.194.67.223", + "10.161.64.168" ], "related.user": [ "tion" @@ -5410,9 +5802,13 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 6094, + "related.hosts": [ + "upt6017.api.localdomain", + "xercit7649.www5.home" + ], "related.ip": [ - "10.100.154.220", - "10.120.148.241" + "10.120.148.241", + "10.100.154.220" ], "related.user": [ "rsitam" @@ -5465,6 +5861,10 @@ "observer.type": "Anti-Virus", "observer.vendor": "Fortinet", "process.pid": 5012, + "related.hosts": [ + "tpers2217.internal.lan", + "porissu1470.domain" + ], "related.ip": [ "10.180.90.112", "10.116.153.19" diff --git a/x-pack/filebeat/module/fortinet/fortimail/config/input.yml b/x-pack/filebeat/module/fortinet/fortimail/config/input.yml index a994af47a3b..ccee80408a8 100644 --- a/x-pack/filebeat/module/fortinet/fortimail/config/input.yml +++ b/x-pack/filebeat/module/fortinet/fortimail/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml index ef17c6f4130..f142da3fcfb 100644 --- a/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml +++ b/x-pack/filebeat/module/fortinet/fortimail/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain != null && ctx.server?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json index a6b2f00ef54..e3803f80ef3 100644 --- a/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json @@ -586,6 +586,9 @@ "observer.product": "FortiMail", "observer.type": "Firewall", "observer.vendor": "Fortinet", + "related.hosts": [ + "lamcolab3252.www.invalid" + ], "related.ip": [ "10.179.124.125", "10.177.36.38" @@ -991,8 +994,8 @@ "observer.type": "Firewall", "observer.vendor": "Fortinet", "related.ip": [ - "10.140.7.83", - "10.68.246.187" + "10.68.246.187", + "10.140.7.83" ], "rsa.email.email_dst": "gna", "rsa.email.email_src": "icabo", @@ -1241,6 +1244,9 @@ "observer.product": "FortiMail", "observer.type": "Firewall", "observer.vendor": "Fortinet", + "related.hosts": [ + "atise3421.www5.localdomain" + ], "related.ip": [ "10.179.210.218", "10.73.207.70" @@ -2640,9 +2646,12 @@ "observer.product": "FortiMail", "observer.type": "Firewall", "observer.vendor": "Fortinet", + "related.hosts": [ + "mveni5084.internal.local" + ], "related.ip": [ - "10.62.61.1", - "10.144.111.42" + "10.144.111.42", + "10.62.61.1" ], "rsa.email.email_dst": "com", "rsa.email.email_src": "lam", @@ -3081,6 +3090,9 @@ "observer.product": "FortiMail", "observer.type": "Firewall", "observer.vendor": "Fortinet", + "related.hosts": [ + "taevitae6868.www.corp" + ], "related.ip": [ "10.60.164.100", "10.161.1.146" @@ -3178,9 +3190,12 @@ "observer.product": "FortiMail", "observer.type": "Firewall", "observer.vendor": "Fortinet", + "related.hosts": [ + "tetura7106.www5.corp" + ], "related.ip": [ - "10.44.35.57", - "10.93.239.216" + "10.93.239.216", + "10.44.35.57" ], "rsa.email.email_dst": "ciun", "rsa.email.email_src": "vento", @@ -3779,8 +3794,8 @@ "observer.type": "Firewall", "observer.vendor": "Fortinet", "related.ip": [ - "10.201.105.58", - "10.251.183.113" + "10.251.183.113", + "10.201.105.58" ], "rsa.email.email_dst": "ionemu", "rsa.email.email_src": "ent", diff --git a/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml b/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml index 5d399e10da5..735db765ff8 100644 --- a/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml +++ b/x-pack/filebeat/module/fortinet/fortimanager/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml index 8452bb6c2bf..79b9a885628 100644 --- a/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml +++ b/x-pack/filebeat/module/fortinet/fortimanager/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json index 58b8f8f4689..78030aa2c53 100644 --- a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json @@ -90,9 +90,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.410", + "related.hosts": [ + "aer445.host" + ], "related.ip": [ - "10.62.4.246", - "10.171.204.166" + "10.171.204.166", + "10.62.4.246" ], "related.user": [ "oluptas" @@ -102,8 +105,8 @@ "rsa.investigations.event_vcat": "eius", "rsa.misc.OS": "anonnu", "rsa.misc.action": [ - "mol", - "accept" + "accept", + "mol" ], "rsa.misc.category": "exe", "rsa.misc.client": "radip", @@ -177,9 +180,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.200.188.142", "10.94.103.117", - "10.15.159.80" + "10.15.159.80", + "10.200.188.142" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -241,9 +244,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.50.112.141", "10.131.233.27", - "10.27.88.95" + "10.27.88.95", + "10.50.112.141" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -307,6 +310,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.5670", + "related.hosts": [ + "olo7148.mail.home" + ], "related.ip": [ "10.87.212.179", "10.157.213.15" @@ -319,8 +325,8 @@ "rsa.investigations.event_vcat": "aveniam", "rsa.misc.OS": "oll", "rsa.misc.action": [ - "allow", - "ali" + "ali", + "allow" ], "rsa.misc.category": "emeumfug", "rsa.misc.client": "caecatc", @@ -395,6 +401,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.152", + "related.hosts": [ + "agna7678.internal.host" + ], "related.ip": [ "10.76.73.140", "10.114.150.67" @@ -407,8 +416,8 @@ "rsa.investigations.event_vcat": "mwr", "rsa.misc.OS": "imaven", "rsa.misc.action": [ - "accept", - "uines" + "uines", + "accept" ], "rsa.misc.category": "uidolo", "rsa.misc.client": "emips", @@ -483,9 +492,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4059", + "related.hosts": [ + "equep5085.mail.domain" + ], "related.ip": [ - "10.195.36.51", - "10.95.64.124" + "10.95.64.124", + "10.195.36.51" ], "related.user": [ "nnum" @@ -495,8 +507,8 @@ "rsa.investigations.event_vcat": "quae", "rsa.misc.OS": "qui", "rsa.misc.action": [ - "iadese", - "accept" + "accept", + "iadese" ], "rsa.misc.category": "aturve", "rsa.misc.client": "utei", @@ -570,8 +582,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.176.216.90", "10.114.16.155", + "10.176.216.90", "10.186.85.3" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -635,6 +647,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.3917", + "related.hosts": [ + "eturadi6608.mail.host" + ], "related.ip": [ "10.61.163.4", "10.23.62.94" @@ -647,8 +662,8 @@ "rsa.investigations.event_vcat": "oide", "rsa.misc.OS": "gel", "rsa.misc.action": [ - "cancel", - "luptatem" + "luptatem", + "cancel" ], "rsa.misc.category": "uir", "rsa.misc.client": "ratvolu", @@ -723,9 +738,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2580", + "related.hosts": [ + "ipsumdol4488.api.localdomain" + ], "related.ip": [ - "10.28.76.42", - "10.106.31.86" + "10.106.31.86", + "10.28.76.42" ], "related.user": [ "cons" @@ -811,8 +829,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.238.164.74", - "10.58.214.16", - "10.106.162.153" + "10.106.162.153", + "10.58.214.16" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -874,8 +892,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.217.150.196", "10.110.31.190", + "10.217.150.196", "10.225.141.20" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -939,9 +957,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.3319", + "related.hosts": [ + "cusant4946.www.domain" + ], "related.ip": [ - "10.137.56.173", - "10.69.103.176" + "10.69.103.176", + "10.137.56.173" ], "related.user": [ "proide" @@ -1026,9 +1047,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.30.47.165", "10.5.235.217", - "10.25.212.118" + "10.25.212.118", + "10.30.47.165" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -1091,9 +1112,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.225", + "related.hosts": [ + "ccaeca5504.internal.example" + ], "related.ip": [ - "10.40.152.253", - "10.149.13.76" + "10.149.13.76", + "10.40.152.253" ], "related.user": [ "tetur" @@ -1307,6 +1331,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1847", + "related.hosts": [ + "tore7088.www.invalid" + ], "related.ip": [ "10.199.47.220", "10.212.214.4" @@ -1395,9 +1422,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.760", + "related.hosts": [ + "mve1890.internal.home" + ], "related.ip": [ - "10.234.165.130", - "10.46.56.204" + "10.46.56.204", + "10.234.165.130" ], "related.user": [ "orese" @@ -1483,9 +1513,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4450", + "related.hosts": [ + "eturad6143.www.home" + ], "related.ip": [ - "10.95.117.134", - "10.128.46.70" + "10.128.46.70", + "10.95.117.134" ], "related.user": [ "enim" @@ -1495,8 +1528,8 @@ "rsa.investigations.event_vcat": "boNem", "rsa.misc.OS": "ntium", "rsa.misc.action": [ - "acommodi", - "block" + "block", + "acommodi" ], "rsa.misc.category": "inrepreh", "rsa.misc.client": "moles", @@ -1571,9 +1604,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.7544", + "related.hosts": [ + "orinrep5386.www.corp" + ], "related.ip": [ - "10.208.21.135", - "10.253.228.140" + "10.253.228.140", + "10.208.21.135" ], "related.user": [ "inculp" @@ -1583,8 +1619,8 @@ "rsa.investigations.event_vcat": "emagn", "rsa.misc.OS": "oditempo", "rsa.misc.action": [ - "cancel", - "ugitse" + "ugitse", + "cancel" ], "rsa.misc.category": "magnid", "rsa.misc.client": "sci", @@ -1659,9 +1695,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1710", + "related.hosts": [ + "henderi724.www5.home" + ], "related.ip": [ - "10.243.226.122", - "10.3.23.172" + "10.3.23.172", + "10.243.226.122" ], "related.user": [ "olorem" @@ -1671,8 +1710,8 @@ "rsa.investigations.event_vcat": "ess", "rsa.misc.OS": "equatDu", "rsa.misc.action": [ - "emullamc", - "cancel" + "cancel", + "emullamc" ], "rsa.misc.category": "niamquis", "rsa.misc.client": "tutlabo", @@ -1747,9 +1786,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.5380", + "related.hosts": [ + "reseosqu1629.mail.lan" + ], "related.ip": [ - "10.94.242.80", - "10.106.85.174" + "10.106.85.174", + "10.94.242.80" ], "related.user": [ "lmo" @@ -1835,9 +1877,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.168.20.20", "10.117.63.181", - "10.247.53.179" + "10.247.53.179", + "10.168.20.20" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -1901,6 +1943,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2208", + "related.hosts": [ + "tasnul4179.internal.host" + ], "related.ip": [ "10.141.156.217", "10.53.168.187" @@ -1913,8 +1958,8 @@ "rsa.investigations.event_vcat": "illumq", "rsa.misc.OS": "idata", "rsa.misc.action": [ - "block", - "emacc" + "emacc", + "block" ], "rsa.misc.category": "ueporro", "rsa.misc.client": "veli", @@ -1990,6 +2035,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.3402", + "related.hosts": [ + "bore5546.www.local" + ], "related.ip": [ "10.44.198.184", "10.189.82.19" @@ -2002,8 +2050,8 @@ "rsa.investigations.event_vcat": "eturadip", "rsa.misc.OS": "turadip", "rsa.misc.action": [ - "odoc", - "accept" + "accept", + "odoc" ], "rsa.misc.category": "volup", "rsa.misc.client": "tur", @@ -2078,6 +2126,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.91", + "related.hosts": [ + "Utenima260.mail.invalid" + ], "related.ip": [ "10.151.170.207", "10.181.183.104" @@ -2090,8 +2141,8 @@ "rsa.investigations.event_vcat": "eturadip", "rsa.misc.OS": "onsecte", "rsa.misc.action": [ - "amni", - "cancel" + "cancel", + "amni" ], "rsa.misc.category": "umdolore", "rsa.misc.client": "modoc", @@ -2166,6 +2217,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.7278", + "related.hosts": [ + "uido2046.mail.lan" + ], "related.ip": [ "10.70.7.23", "10.130.240.11" @@ -2178,8 +2232,8 @@ "rsa.investigations.event_vcat": "uatu", "rsa.misc.OS": "tnulapar", "rsa.misc.action": [ - "odic", - "deny" + "deny", + "odic" ], "rsa.misc.category": "deri", "rsa.misc.client": "scivelit", @@ -2318,8 +2372,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.170.196.181", - "10.153.166.133", - "10.158.175.98" + "10.158.175.98", + "10.153.166.133" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2382,9 +2436,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.5978", + "related.hosts": [ + "con6049.internal.lan" + ], "related.ip": [ - "10.63.171.91", - "10.48.25.200" + "10.48.25.200", + "10.63.171.91" ], "related.user": [ "usanti" @@ -2533,9 +2590,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.225.37.73", + "10.166.142.198", "10.36.99.207", - "10.166.142.198" + "10.225.37.73" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2598,8 +2655,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.214.156.161", - "10.66.90.225", - "10.145.194.12" + "10.145.194.12", + "10.66.90.225" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2661,8 +2718,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.163.36.101", "10.156.208.5", + "10.163.36.101", "10.6.242.108" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -2726,6 +2783,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4713", + "related.hosts": [ + "remeum2641.www5.corp" + ], "related.ip": [ "10.68.233.163", "10.220.148.127" @@ -2814,9 +2874,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4481", + "related.hosts": [ + "itaspe3216.localdomain" + ], "related.ip": [ - "10.94.177.125", - "10.116.82.108" + "10.116.82.108", + "10.94.177.125" ], "related.user": [ "ecatc" @@ -2826,8 +2889,8 @@ "rsa.investigations.event_vcat": "ihi", "rsa.misc.OS": "amquaera", "rsa.misc.action": [ - "nimides", - "allow" + "allow", + "nimides" ], "rsa.misc.category": "mve", "rsa.misc.client": "plica", @@ -2903,9 +2966,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4442", + "related.hosts": [ + "mea6298.api.example" + ], "related.ip": [ - "10.115.121.243", - "10.113.152.241" + "10.113.152.241", + "10.115.121.243" ], "related.user": [ "norumetM" @@ -2915,8 +2981,8 @@ "rsa.investigations.event_vcat": "teirured", "rsa.misc.OS": "oloremi", "rsa.misc.action": [ - "ali", - "cancel" + "cancel", + "ali" ], "rsa.misc.category": "idolor", "rsa.misc.client": "imveni", @@ -2991,6 +3057,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.3804", + "related.hosts": [ + "iqu7510.internal.corp" + ], "related.ip": [ "10.49.82.45", "10.179.153.97" @@ -3079,8 +3148,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.205.83.138", - "10.99.55.115", - "10.98.52.184" + "10.98.52.184", + "10.99.55.115" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3142,9 +3211,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.197.128.162", "10.228.11.50", - "10.90.189.248", - "10.197.128.162" + "10.90.189.248" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3247,9 +3316,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.7318", + "related.hosts": [ + "deFinibu3940.internal.lan" + ], "related.ip": [ - "10.124.71.88", - "10.22.248.52" + "10.22.248.52", + "10.124.71.88" ], "related.user": [ "tcons" @@ -3335,9 +3407,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4895", + "related.hosts": [ + "tatiset4191.localdomain" + ], "related.ip": [ - "10.185.37.176", - "10.26.58.20" + "10.26.58.20", + "10.185.37.176" ], "related.user": [ "eumiure" @@ -3423,8 +3498,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.14.145.107", - "10.250.231.196", - "10.200.12.126" + "10.200.12.126", + "10.250.231.196" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3550,9 +3625,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.140.59.161", + "10.5.67.140", "10.118.111.183", - "10.5.67.140" + "10.140.59.161" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3615,6 +3690,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4493", + "related.hosts": [ + "nimadmi4084.api.home" + ], "related.ip": [ "10.7.70.169", "10.28.212.191" @@ -3627,8 +3705,8 @@ "rsa.investigations.event_vcat": "Loremips", "rsa.misc.OS": "eritquii", "rsa.misc.action": [ - "nostru", - "accept" + "accept", + "nostru" ], "rsa.misc.category": "amnisiu", "rsa.misc.client": "rcita", @@ -3703,6 +3781,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.6506", + "related.hosts": [ + "reprehe3525.www5.example" + ], "related.ip": [ "10.143.144.52", "10.148.197.60" @@ -3715,8 +3796,8 @@ "rsa.investigations.event_vcat": "uep", "rsa.misc.OS": "iatisund", "rsa.misc.action": [ - "nvo", - "block" + "block", + "nvo" ], "rsa.misc.category": "tenima", "rsa.misc.client": "iuntNe", @@ -3790,8 +3871,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.22.149.132", "10.217.145.137", + "10.22.149.132", "10.251.183.113" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -3854,8 +3935,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.203.66.175", "10.51.60.203", + "10.203.66.175", "10.183.16.252" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -3919,6 +4000,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.409", + "related.hosts": [ + "ursint411.www.lan" + ], "related.ip": [ "10.61.200.105", "10.157.14.165" @@ -4007,9 +4091,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.5475", + "related.hosts": [ + "ididunt7607.mail.localhost" + ], "related.ip": [ - "10.242.178.15", - "10.217.111.77" + "10.217.111.77", + "10.242.178.15" ], "related.user": [ "nimadmin" @@ -4095,6 +4182,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.142", + "related.hosts": [ + "mco2906.domain" + ], "related.ip": [ "10.199.119.251", "10.86.152.227" @@ -4183,6 +4273,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1789", + "related.hosts": [ + "ntex5135.corp" + ], "related.ip": [ "10.239.194.105", "10.234.171.117" @@ -4195,8 +4288,8 @@ "rsa.investigations.event_vcat": "uia", "rsa.misc.OS": "mquae", "rsa.misc.action": [ - "tenatus", - "deny" + "deny", + "tenatus" ], "rsa.misc.category": "abo", "rsa.misc.client": "umtota", @@ -4271,9 +4364,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.249.16.201", "10.107.168.208", - "10.34.41.75" + "10.34.41.75", + "10.249.16.201" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4336,6 +4429,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.6905", + "related.hosts": [ + "tat1845.internal.invalid" + ], "related.ip": [ "10.109.106.194", "10.96.168.24" @@ -4348,8 +4444,8 @@ "rsa.investigations.event_vcat": "agnaaliq", "rsa.misc.OS": "itte", "rsa.misc.action": [ - "allow", - "Sedut" + "Sedut", + "allow" ], "rsa.misc.category": "aqueip", "rsa.misc.client": "serr", @@ -4424,6 +4520,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1353", + "related.hosts": [ + "ulamc767.internal.lan" + ], "related.ip": [ "10.47.191.95", "10.112.155.228" @@ -4512,8 +4611,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.103.169.94", - "10.140.137.17", - "10.62.241.218" + "10.62.241.218", + "10.140.137.17" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4575,9 +4674,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.90.229.92", "10.251.212.166", - "10.77.105.160" + "10.77.105.160", + "10.90.229.92" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4640,9 +4739,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4261", + "related.hosts": [ + "spici5547.internal.test" + ], "related.ip": [ - "10.216.49.112", - "10.112.242.68" + "10.112.242.68", + "10.216.49.112" ], "related.user": [ "urmag" @@ -4728,9 +4830,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.491", + "related.hosts": [ + "istenatu3686.invalid" + ], "related.ip": [ - "10.96.100.84", - "10.182.58.108" + "10.182.58.108", + "10.96.100.84" ], "related.user": [ "lpaquiof" @@ -4740,8 +4845,8 @@ "rsa.investigations.event_vcat": "uatDuisa", "rsa.misc.OS": "citation", "rsa.misc.action": [ - "accept", - "utlabore" + "utlabore", + "accept" ], "rsa.misc.category": "reeu", "rsa.misc.client": "ntut", @@ -4816,8 +4921,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.246.41.77", - "10.157.22.21", - "10.228.61.5" + "10.228.61.5", + "10.157.22.21" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4879,9 +4984,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.188.131.18", + "10.242.119.111", "10.239.231.168", - "10.242.119.111" + "10.188.131.18" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4944,9 +5049,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.979", + "related.hosts": [ + "tru3812.mail.lan" + ], "related.ip": [ - "10.106.101.87", - "10.247.124.74" + "10.247.124.74", + "10.106.101.87" ], "related.user": [ "ainci" @@ -4956,8 +5064,8 @@ "rsa.investigations.event_vcat": "amnihil", "rsa.misc.OS": "tten", "rsa.misc.action": [ - "accept", - "inea" + "inea", + "accept" ], "rsa.misc.category": "quam", "rsa.misc.client": "oreseo", @@ -5072,9 +5180,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4342", + "related.hosts": [ + "riaturE1644.www5.example" + ], "related.ip": [ - "10.162.114.52", - "10.215.144.167" + "10.215.144.167", + "10.162.114.52" ], "related.user": [ "erspici" @@ -5160,6 +5271,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.6452", + "related.hosts": [ + "mdolo7008.api.corp" + ], "related.ip": [ "10.162.128.87", "10.78.75.82" @@ -5247,9 +5361,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.75.198.93", "10.137.36.151", - "10.51.106.43", - "10.75.198.93" + "10.51.106.43" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5376,9 +5490,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.5718", + "related.hosts": [ + "itse5466.api.example" + ], "related.ip": [ - "10.26.4.3", - "10.217.209.221" + "10.217.209.221", + "10.26.4.3" ], "related.user": [ "ciduntut" @@ -5388,8 +5505,8 @@ "rsa.investigations.event_vcat": "santiumd", "rsa.misc.OS": "oris", "rsa.misc.action": [ - "rsitame", - "deny" + "deny", + "rsitame" ], "rsa.misc.category": "agnaal", "rsa.misc.client": "urmagn", @@ -5464,6 +5581,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.6603", + "related.hosts": [ + "dquiac6194.api.lan" + ], "related.ip": [ "10.241.140.241", "10.180.162.174" @@ -5476,8 +5596,8 @@ "rsa.investigations.event_vcat": "luptatev", "rsa.misc.OS": "emipsu", "rsa.misc.action": [ - "accept", - "ido" + "ido", + "accept" ], "rsa.misc.category": "litse", "rsa.misc.client": "evita", @@ -5552,9 +5672,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2052", + "related.hosts": [ + "amco1592.mail.host" + ], "related.ip": [ - "10.62.140.108", - "10.110.99.222" + "10.110.99.222", + "10.62.140.108" ], "related.user": [ "moenimi" @@ -5564,8 +5687,8 @@ "rsa.investigations.event_vcat": "atvolupt", "rsa.misc.OS": "riosam", "rsa.misc.action": [ - "deny", - "ssitasp" + "ssitasp", + "deny" ], "rsa.misc.category": "enimadmi", "rsa.misc.client": "uatDui", @@ -5640,9 +5763,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2691", + "related.hosts": [ + "dicta7226.mail.example" + ], "related.ip": [ - "10.4.244.115", - "10.53.50.77" + "10.53.50.77", + "10.4.244.115" ], "related.user": [ "idolo" @@ -5652,8 +5778,8 @@ "rsa.investigations.event_vcat": "cupidata", "rsa.misc.OS": "ficiade", "rsa.misc.action": [ - "accept", - "lorem" + "lorem", + "accept" ], "rsa.misc.category": "iac", "rsa.misc.client": "tlabo", @@ -5728,8 +5854,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.236.211.111", - "10.221.100.157", - "10.120.212.78" + "10.120.212.78", + "10.221.100.157" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5792,9 +5918,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.3052", + "related.hosts": [ + "pidatatn2627.www.localdomain" + ], "related.ip": [ - "10.208.231.15", - "10.210.82.202" + "10.210.82.202", + "10.208.231.15" ], "related.user": [ "riatur" @@ -5879,8 +6008,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.226.255.3", "10.123.59.69", + "10.226.255.3", "10.53.251.202" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -6008,9 +6137,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.95", + "related.hosts": [ + "emveleu4029.api.local" + ], "related.ip": [ - "10.236.175.163", - "10.126.11.186" + "10.126.11.186", + "10.236.175.163" ], "related.user": [ "udantiu" @@ -6020,8 +6152,8 @@ "rsa.investigations.event_vcat": "ill", "rsa.misc.OS": "eabill", "rsa.misc.action": [ - "cancel", - "atemqui" + "atemqui", + "cancel" ], "rsa.misc.category": "idatatno", "rsa.misc.client": "res", @@ -6095,9 +6227,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.83.98.220", + "10.11.150.136", "10.171.60.173", - "10.11.150.136" + "10.83.98.220" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6159,9 +6291,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.74.88.209", "10.92.3.166", - "10.238.49.73" + "10.238.49.73", + "10.74.88.209" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6224,8 +6356,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.119.248.36", - "10.84.200.121", - "10.187.107.47" + "10.187.107.47", + "10.84.200.121" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6287,9 +6419,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.135.213.17", "10.167.128.229", - "10.30.239.222", - "10.135.213.17" + "10.30.239.222" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6352,6 +6484,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1028", + "related.hosts": [ + "rspic5637.api.local" + ], "related.ip": [ "10.169.133.219", "10.115.166.48" @@ -6364,8 +6499,8 @@ "rsa.investigations.event_vcat": "iumdol", "rsa.misc.OS": "min", "rsa.misc.action": [ - "block", - "eleumiur" + "eleumiur", + "block" ], "rsa.misc.category": "ero", "rsa.misc.client": "gia", @@ -6440,6 +6575,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4195", + "related.hosts": [ + "rror3870.www5.local" + ], "related.ip": [ "10.146.255.40", "10.226.39.82" @@ -6591,9 +6729,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.66.149.234", "10.186.253.240", - "10.233.128.7", - "10.66.149.234" + "10.233.128.7" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6655,9 +6793,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.173.140.201", "10.227.133.134", - "10.46.11.114" + "10.46.11.114", + "10.173.140.201" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6719,9 +6857,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.205.18.11", "10.69.130.207", - "10.170.236.123" + "10.170.236.123", + "10.205.18.11" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6784,6 +6922,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2682", + "related.hosts": [ + "velill3821.mail.invalid" + ], "related.ip": [ "10.97.254.192", "10.124.34.251" @@ -6796,8 +6937,8 @@ "rsa.investigations.event_vcat": "lica", "rsa.misc.OS": "taedi", "rsa.misc.action": [ - "imide", - "deny" + "deny", + "imide" ], "rsa.misc.category": "iurere", "rsa.misc.client": "ollitan", @@ -6871,9 +7012,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.9.41.221", "10.81.58.91", - "10.204.98.238", - "10.9.41.221" + "10.204.98.238" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6975,8 +7116,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.212.208.70", "10.35.84.125", + "10.212.208.70", "10.37.120.29" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -7039,8 +7180,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.207.207.106", "10.199.201.26", + "10.207.207.106", "10.143.65.84" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -7104,8 +7245,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.41.61.88", - "10.163.236.253", - "10.204.27.48" + "10.204.27.48", + "10.163.236.253" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -7233,6 +7374,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.802", + "related.hosts": [ + "cupida6106.www5.local" + ], "related.ip": [ "10.146.77.206", "10.109.172.90" @@ -7245,8 +7389,8 @@ "rsa.investigations.event_vcat": "lupt", "rsa.misc.OS": "etdolo", "rsa.misc.action": [ - "allow", - "amnihilm" + "amnihilm", + "allow" ], "rsa.misc.category": "ntin", "rsa.misc.client": "xcep", @@ -7321,9 +7465,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.2314", + "related.hosts": [ + "unt2122.internal.local" + ], "related.ip": [ - "10.38.18.72", - "10.202.250.141" + "10.202.250.141", + "10.38.18.72" ], "related.user": [ "maperia" @@ -7333,8 +7480,8 @@ "rsa.investigations.event_vcat": "rure", "rsa.misc.OS": "iquidexe", "rsa.misc.action": [ - "allow", - "volu" + "volu", + "allow" ], "rsa.misc.category": "ium", "rsa.misc.client": "liquip", @@ -7409,9 +7556,12 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.4674", + "related.hosts": [ + "luptat2613.internal.localhost" + ], "related.ip": [ - "10.139.144.75", - "10.182.124.88" + "10.182.124.88", + "10.139.144.75" ], "related.user": [ "modo" @@ -7421,8 +7571,8 @@ "rsa.investigations.event_vcat": "tfug", "rsa.misc.OS": "imipsam", "rsa.misc.action": [ - "block", - "utodi" + "utodi", + "block" ], "rsa.misc.category": "cid", "rsa.misc.client": "mquaerat", @@ -7497,6 +7647,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "observer.version": "1.1386", + "related.hosts": [ + "neavo4796.internal.domain" + ], "related.ip": [ "10.188.124.185", "10.35.10.19" diff --git a/x-pack/filebeat/module/imperva/securesphere/config/input.yml b/x-pack/filebeat/module/imperva/securesphere/config/input.yml index 68b88a27df5..e9d408c7b22 100644 --- a/x-pack/filebeat/module/imperva/securesphere/config/input.yml +++ b/x-pack/filebeat/module/imperva/securesphere/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/imperva/securesphere/ingest/pipeline.yml b/x-pack/filebeat/module/imperva/securesphere/ingest/pipeline.yml index 3ff3b353c28..a51475c0588 100644 --- a/x-pack/filebeat/module/imperva/securesphere/ingest/pipeline.yml +++ b/x-pack/filebeat/module/imperva/securesphere/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.hostname}}' + allow_duplicates: false + if: ctx?.host?.hostname != null && ctx.host?.hostname != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json b/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json index 555b06cb1da..7894d6ff317 100644 --- a/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json +++ b/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json @@ -19,9 +19,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "radipis5408.mail.local" + ], "related.ip": [ - "10.70.155.35", - "10.81.122.126" + "10.81.122.126", + "10.70.155.35" ], "related.user": [ "magn", @@ -105,14 +108,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ccusan7572.api.home" + ], "related.ip": [ - "10.159.182.171", - "10.58.116.231" + "10.58.116.231", + "10.159.182.171" ], "related.user": [ - "qua", + "temUten", "uradi", - "temUten" + "qua" ], "rsa.counters.dclass_c1": 3626, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -160,13 +166,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "elaudant5931.internal.invalid" + ], "related.ip": [ - "10.18.124.28", - "10.232.27.250" + "10.232.27.250", + "10.18.124.28" ], "related.user": [ - "lapariat", "modocons", + "lapariat", "mquidol" ], "rsa.counters.dclass_c1": 6564, @@ -221,14 +230,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "amest4147.mail.host" + ], "related.ip": [ - "10.197.250.10", - "10.6.137.200" + "10.6.137.200", + "10.197.250.10" ], "related.user": [ "oluptas", - "intoc", - "occae" + "occae", + "intoc" ], "rsa.counters.event_counter": 7243, "rsa.db.database": "tNequepo", @@ -287,14 +299,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "eratv6205.internal.lan" + ], "related.ip": [ "10.179.124.125", "10.36.194.106" ], "related.user": [ - "acommod", + "ncidid", "reme", - "ncidid" + "acommod" ], "rsa.counters.event_counter": 2462, "rsa.db.database": "uaUteni", @@ -351,14 +366,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "didunt1355.corp" + ], "related.ip": [ - "10.211.105.204", - "10.129.149.43" + "10.129.149.43", + "10.211.105.204" ], "related.user": [ - "orema", + "eveli", "labor", - "eveli" + "orema" ], "rsa.counters.dclass_c1": 6855, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -410,13 +428,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "pora6854.www5.home" + ], "related.ip": [ "10.214.191.180", "10.112.250.193" ], "related.user": [ - "ide", "Exc", + "ide", "ipsumdol" ], "rsa.counters.dclass_c1": 6852, @@ -468,14 +489,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ptasn6599.www.localhost" + ], "related.ip": [ - "10.251.20.13", - "10.192.34.76" + "10.192.34.76", + "10.251.20.13" ], "related.user": [ - "ovol", + "iquipe", "tnonpro", - "iquipe" + "ovol" ], "rsa.counters.dclass_c1": 3645, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -523,14 +547,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ptasnu6684.mail.lan" + ], "related.ip": [ "10.74.105.218", "10.59.138.212" ], "related.user": [ - "boree", "idunt", - "archite" + "archite", + "boree" ], "rsa.counters.dclass_c1": 248, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -582,6 +609,9 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "rinre2977.api.corp" + ], "related.ip": [ "10.230.173.4", "10.168.159.13" @@ -641,14 +671,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "atevelit2450.local" + ], "related.ip": [ "10.41.21.204", "10.49.167.57" ], "related.user": [ - "tali", + "ccaeca", "sau", - "ccaeca" + "tali" ], "rsa.counters.dclass_c1": 6818, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -702,22 +735,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "itla658.api.localhost" + ], "related.ip": [ "10.62.147.186", "10.216.125.252" ], "related.user": [ - "lorsita", "dolore", - "llamco" + "llamco", + "lorsita" ], "rsa.counters.event_counter": 4603, "rsa.db.database": "uptate", "rsa.internal.event_desc": "aquae", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "quasia", - "accept" + "accept", + "quasia" ], "rsa.misc.category": "boreetdo", "rsa.misc.disposition": "aturve", @@ -769,22 +805,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "umdolor4389.api.home" + ], "related.ip": [ "10.52.125.9", "10.204.128.215" ], "related.user": [ "nci", - "rum", - "paquioff" + "paquioff", + "rum" ], "rsa.counters.event_counter": 332, "rsa.db.database": "isau", "rsa.internal.event_desc": "rumet", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "deny", - "texpli" + "texpli", + "deny" ], "rsa.misc.category": "verita", "rsa.misc.disposition": "sectet", @@ -832,14 +871,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "rationev6444.localhost" + ], "related.ip": [ "10.34.148.166", "10.200.68.129" ], "related.user": [ "icabo", - "untutlab", - "miu" + "miu", + "untutlab" ], "rsa.counters.dclass_c1": 5427, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -887,14 +929,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ipi7727.www5.domain" + ], "related.ip": [ "10.134.5.40", "10.226.101.180" ], "related.user": [ "siu", - "licabo", - "conse" + "conse", + "licabo" ], "rsa.counters.dclass_c1": 6356, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -946,14 +991,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "spernatu5539.domain" + ], "related.ip": [ - "10.126.26.131", - "10.30.98.10" + "10.30.98.10", + "10.126.26.131" ], "related.user": [ "dipisci", - "velite", - "olori" + "olori", + "velite" ], "rsa.counters.dclass_c1": 7717, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1005,9 +1053,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nimid372.api.corp" + ], "related.ip": [ - "10.190.10.219", - "10.233.120.207" + "10.233.120.207", + "10.190.10.219" ], "related.user": [ "item", @@ -1092,14 +1143,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "maliquam2147.internal.home" + ], "related.ip": [ "10.100.98.56", "10.248.184.200" ], "related.user": [ - "boru", "ritati", - "proident" + "proident", + "boru" ], "rsa.counters.dclass_c1": 5923, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1151,14 +1205,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "olabor2983.internal.localhost" + ], "related.ip": [ - "10.82.28.220", - "10.197.6.245" + "10.197.6.245", + "10.82.28.220" ], "related.user": [ - "aecatcup", + "oluptat", "dtempo", - "oluptat" + "aecatcup" ], "rsa.counters.dclass_c1": 3071, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1210,9 +1267,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "hitec2111.mail.corp" + ], "related.ip": [ - "10.6.27.103", - "10.167.252.183" + "10.167.252.183", + "10.6.27.103" ], "related.user": [ "redol", @@ -1271,22 +1331,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "adminim2559.www5.invalid" + ], "related.ip": [ "10.81.184.7", "10.88.45.111" ], "related.user": [ - "undeomni", + "lmole", "iameaque", - "lmole" + "undeomni" ], "rsa.counters.event_counter": 6344, "rsa.db.database": "nderi", "rsa.internal.event_desc": "iae", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "deny", - "illu" + "illu", + "deny" ], "rsa.misc.category": "quido", "rsa.misc.disposition": "emip", @@ -1336,14 +1399,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "dolorem6882.api.local" + ], "related.ip": [ - "10.214.3.140", - "10.29.119.245" + "10.29.119.245", + "10.214.3.140" ], "related.user": [ - "taliqui", "edolorin", - "scipitl" + "scipitl", + "taliqui" ], "rsa.counters.dclass_c1": 5140, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1397,14 +1463,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "temaccu5302.test" + ], "related.ip": [ - "10.218.123.234", - "10.110.133.7" + "10.110.133.7", + "10.218.123.234" ], "related.user": [ - "etconsec", + "caboNem", "pta", - "caboNem" + "etconsec" ], "rsa.counters.event_counter": 5347, "rsa.db.database": "urExcept", @@ -1462,14 +1531,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nder347.www.corp" + ], "related.ip": [ - "10.182.152.242", - "10.105.190.170" + "10.105.190.170", + "10.182.152.242" ], "related.user": [ + "litan", "mquisn", - "doeiu", - "litan" + "doeiu" ], "rsa.counters.dclass_c1": 3474, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1523,14 +1595,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "idunt4633.internal.host" + ], "related.ip": [ "10.59.188.188", "10.123.166.197" ], "related.user": [ "emUte", - "min", - "liquam" + "liquam", + "min" ], "rsa.counters.event_counter": 7102, "rsa.db.database": "oluptat", @@ -1587,13 +1662,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ectob4634.mail.localhost" + ], "related.ip": [ "10.72.75.207", "10.201.168.116" ], "related.user": [ - "eufug", "eFini", + "eufug", "urau" ], "rsa.counters.dclass_c1": 3348, @@ -1646,14 +1724,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "snu6436.www.local" + ], "related.ip": [ "10.9.46.123", "10.58.133.175" ], "related.user": [ + "oco", "mfu", - "nde", - "oco" + "nde" ], "rsa.counters.dclass_c1": 3795, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1705,13 +1786,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "lore7099.www.host" + ], "related.ip": [ "10.169.50.59", "10.70.29.203" ], "related.user": [ - "veniamq", "mquisnos", + "veniamq", "pta" ], "rsa.counters.dclass_c1": 2358, @@ -1764,14 +1848,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "lesti6939.api.local" + ], "related.ip": [ - "10.165.182.111", - "10.137.85.123" + "10.137.85.123", + "10.165.182.111" ], "related.user": [ + "ames", "Bonorum", - "sis", - "ames" + "sis" ], "rsa.counters.dclass_c1": 6401, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1853,14 +1940,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "upt6017.api.localdomain" + ], "related.ip": [ "10.64.184.196", "10.173.178.109" ], "related.user": [ - "uian", + "tam", "nesci", - "tam" + "uian" ], "rsa.counters.event_counter": 4493, "rsa.db.database": "sin", @@ -1918,13 +2008,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "turQuis4046.api.test" + ], "related.ip": [ - "10.168.225.209", - "10.90.50.149" + "10.90.50.149", + "10.168.225.209" ], "related.user": [ - "olupta", "aUtenima", + "olupta", "olu" ], "rsa.counters.dclass_c1": 1127, @@ -1977,13 +2070,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "con6049.internal.lan" + ], "related.ip": [ "10.59.182.36", "10.18.150.82" ], "related.user": [ - "luptat", "mtota", + "luptat", "qua" ], "rsa.counters.dclass_c1": 6112, @@ -2063,13 +2159,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tatnonp1371.www.invalid" + ], "related.ip": [ - "10.228.229.144", - "10.151.240.35" + "10.151.240.35", + "10.228.229.144" ], "related.user": [ - "ama", "ametcons", + "ama", "lam" ], "rsa.counters.dclass_c1": 4325, @@ -2118,14 +2217,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tium3542.internal.invalid" + ], "related.ip": [ "10.242.48.203", "10.147.142.242" ], "related.user": [ + "ese", "quisn", - "quasi", - "ese" + "quasi" ], "rsa.counters.dclass_c1": 3970, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2179,13 +2281,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "radipis3991.mail.invalid" + ], "related.ip": [ - "10.254.10.98", - "10.213.165.165" + "10.213.165.165", + "10.254.10.98" ], "related.user": [ - "eufugia", "civeli", + "eufugia", "ttenb" ], "rsa.counters.event_counter": 7365, @@ -2193,8 +2298,8 @@ "rsa.internal.event_desc": "culpaq", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "uptasn", - "cancel" + "cancel", + "uptasn" ], "rsa.misc.category": "quamq", "rsa.misc.disposition": "usan", @@ -2274,14 +2379,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ihi7294.www5.localhost" + ], "related.ip": [ - "10.116.1.130", - "10.169.28.157" + "10.169.28.157", + "10.116.1.130" ], "related.user": [ "reseo", - "eturadip", - "amco" + "amco", + "eturadip" ], "rsa.counters.event_counter": 1295, "rsa.db.database": "ons", @@ -2339,14 +2447,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "caecat4920.api.host" + ], "related.ip": [ "10.29.138.31", "10.45.69.152" ], "related.user": [ "volupta", - "tsunt", - "umq" + "umq", + "tsunt" ], "rsa.counters.dclass_c1": 744, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2398,13 +2509,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "setquas6188.internal.local" + ], "related.ip": [ "10.100.113.11", "10.152.213.228" ], "related.user": [ - "itationu", "ptatev", + "itationu", "velillum" ], "rsa.counters.dclass_c1": 7245, @@ -2485,9 +2599,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nibusBo3674.www5.localhost" + ], "related.ip": [ - "10.248.102.129", - "10.208.33.55" + "10.208.33.55", + "10.248.102.129" ], "related.user": [ "mremaper", @@ -2544,14 +2661,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "totamr7676.www5.home" + ], "related.ip": [ - "10.109.230.216", - "10.203.164.132" + "10.203.164.132", + "10.109.230.216" ], "related.user": [ - "ibus", "mporin", - "ectobea" + "ectobea", + "ibus" ], "rsa.counters.dclass_c1": 547, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2603,14 +2723,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "idents7231.mail.home" + ], "related.ip": [ "10.151.203.60", "10.117.81.75" ], "related.user": [ "iconsequ", - "dol", - "exeac" + "exeac", + "dol" ], "rsa.counters.dclass_c1": 484, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2662,14 +2785,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tat50.mail.host" + ], "related.ip": [ - "10.45.152.205", - "10.224.217.153" + "10.224.217.153", + "10.45.152.205" ], "related.user": [ "eriti", - "imav", - "utlabo" + "utlabo", + "imav" ], "rsa.counters.dclass_c1": 922, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2722,6 +2848,9 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "mips3283.corp" + ], "related.ip": [ "10.1.193.187", "10.60.164.100" @@ -2786,14 +2915,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "aliquip7229.mail.domain" + ], "related.ip": [ - "10.146.228.234", - "10.248.244.203" + "10.248.244.203", + "10.146.228.234" ], "related.user": [ - "sum", "mquamei", - "eiusm" + "eiusm", + "sum" ], "rsa.counters.dclass_c1": 3058, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2841,6 +2973,9 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "fde7756.mail.corp" + ], "related.ip": [ "10.122.127.237", "10.86.121.152" @@ -2900,14 +3035,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "agnama5013.internal.example" + ], "related.ip": [ "10.201.223.119", "10.204.223.184" ], "related.user": [ + "rcit", "teni", - "tuserror", - "rcit" + "tuserror" ], "rsa.counters.dclass_c1": 4113, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2959,14 +3097,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "edictas4693.home" + ], "related.ip": [ "10.223.56.33", "10.200.12.126" ], "related.user": [ - "elitsedd", + "magnido", "Nequepo", - "magnido" + "elitsedd" ], "rsa.counters.dclass_c1": 3243, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3020,22 +3161,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nibu2565.api.local" + ], "related.ip": [ - "10.65.225.101", - "10.94.89.177" + "10.94.89.177", + "10.65.225.101" ], "related.user": [ + "tuserror", "citation", - "emquel", - "tuserror" + "emquel" ], "rsa.counters.event_counter": 2513, "rsa.db.database": "rspiciat", "rsa.internal.event_desc": "atuse", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "cancel", - "eruntmol" + "eruntmol", + "cancel" ], "rsa.misc.category": "imad", "rsa.misc.disposition": "tura", @@ -3084,14 +3228,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tsun7120.home" + ], "related.ip": [ "10.65.174.196", "10.191.184.105" ], "related.user": [ + "iin", "tione", - "uta", - "iin" + "uta" ], "rsa.counters.dclass_c1": 5836, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3141,22 +3288,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "lumquid6940.mail.localdomain" + ], "related.ip": [ - "10.224.148.48", - "10.41.181.179" + "10.41.181.179", + "10.224.148.48" ], "related.user": [ - "iosamn", "equepor", - "niam" + "niam", + "iosamn" ], "rsa.counters.event_counter": 7468, "rsa.db.database": "erspicia", "rsa.internal.event_desc": "ibusB", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "deny", - "rumwr" + "rumwr", + "deny" ], "rsa.misc.category": "rporis", "rsa.misc.disposition": "etco", @@ -3206,14 +3356,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "amcorp7299.api.example" + ], "related.ip": [ - "10.21.61.134", - "10.21.208.103" + "10.21.208.103", + "10.21.61.134" ], "related.user": [ + "ostr", "imidest", - "mipsa", - "ostr" + "mipsa" ], "rsa.counters.dclass_c1": 7766, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3265,14 +3418,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "magnama868.api.local" + ], "related.ip": [ - "10.221.192.116", - "10.23.6.216" + "10.23.6.216", + "10.221.192.116" ], "related.user": [ - "tevelite", + "iarchit", "iamquisn", - "iarchit" + "tevelite" ], "rsa.counters.dclass_c1": 639, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3326,22 +3482,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tionevol3157.mail.invalid" + ], "related.ip": [ - "10.240.62.238", - "10.191.142.143" + "10.191.142.143", + "10.240.62.238" ], "related.user": [ + "nofde", "modtempo", - "animide", - "nofde" + "animide" ], "rsa.counters.event_counter": 7580, "rsa.db.database": "Lore", "rsa.internal.event_desc": "nto", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "cancel", - "ali" + "ali", + "cancel" ], "rsa.misc.category": "sciv", "rsa.misc.disposition": "tlabo", @@ -3392,14 +3551,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "mquis319.api.local" + ], "related.ip": [ - "10.111.22.134", - "10.178.79.217" + "10.178.79.217", + "10.111.22.134" ], "related.user": [ + "ccusan", "inibusBo", - "tqui", - "ccusan" + "tqui" ], "rsa.counters.event_counter": 3538, "rsa.db.database": "sequun", @@ -3456,14 +3618,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "urad5712.api.host" + ], "related.ip": [ "10.161.225.172", "10.77.86.215" ], "related.user": [ - "rcit", + "xerc", "meaqu", - "xerc" + "rcit" ], "rsa.counters.dclass_c1": 7286, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3514,9 +3679,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "enbyCic4659.www5.example" + ], "related.ip": [ - "10.211.161.187", - "10.186.133.184" + "10.186.133.184", + "10.211.161.187" ], "related.user": [ "boriosa", @@ -3568,14 +3736,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "inBCSed5308.api.corp" + ], "related.ip": [ - "10.160.147.230", - "10.254.198.47" + "10.254.198.47", + "10.160.147.230" ], "related.user": [ - "illoin", "nimvenia", - "ndeomnis" + "ndeomnis", + "illoin" ], "rsa.counters.dclass_c1": 5988, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3623,14 +3794,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "reseo2067.api.localdomain" + ], "related.ip": [ - "10.40.24.93", - "10.182.197.243" + "10.182.197.243", + "10.40.24.93" ], "related.user": [ - "orisnis", "exerci", - "mSecti" + "mSecti", + "orisnis" ], "rsa.counters.dclass_c1": 4129, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3682,14 +3856,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "itte6905.mail.invalid" + ], "related.ip": [ - "10.108.130.106", - "10.249.13.159" + "10.249.13.159", + "10.108.130.106" ], "related.user": [ "uisautei", - "colab", - "exeacomm" + "exeacomm", + "colab" ], "rsa.counters.dclass_c1": 1044, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3743,13 +3920,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "caboNemo274.www.host" + ], "related.ip": [ - "10.64.94.174", - "10.39.244.49" + "10.39.244.49", + "10.64.94.174" ], "related.user": [ - "Sedut", "iunt", + "Sedut", "estiae" ], "rsa.counters.event_counter": 7128, @@ -3863,14 +4043,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "qui5978.api.test" + ], "related.ip": [ - "10.134.135.22", - "10.115.203.143" + "10.115.203.143", + "10.134.135.22" ], "related.user": [ + "involu", "orpori", - "utoditau", - "involu" + "utoditau" ], "rsa.counters.dclass_c1": 7868, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3922,9 +4105,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "iamq2577.internal.corp" + ], "related.ip": [ - "10.251.212.166", - "10.43.244.252" + "10.43.244.252", + "10.251.212.166" ], "related.user": [ "uptat", @@ -4009,14 +4195,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "usB4127.localhost" + ], "related.ip": [ "10.88.189.164", "10.20.231.188" ], "related.user": [ - "mqu", "tesseq", - "uatDuisa" + "uatDuisa", + "mqu" ], "rsa.counters.dclass_c1": 1623, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4096,14 +4285,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "abor3266.mail.home" + ], "related.ip": [ - "10.231.77.26", - "10.225.11.197" + "10.225.11.197", + "10.231.77.26" ], "related.user": [ + "ineavol", "volu", - "rehe", - "ineavol" + "rehe" ], "rsa.counters.dclass_c1": 3064, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4153,14 +4345,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "eprehe2455.www.home" + ], "related.ip": [ - "10.106.166.105", - "10.148.3.197" + "10.148.3.197", + "10.106.166.105" ], "related.user": [ - "avolup", "olupt", - "usa" + "usa", + "avolup" ], "rsa.counters.dclass_c1": 2658, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4208,14 +4403,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "destla2110.www5.localdomain" + ], "related.ip": [ - "10.172.121.239", - "10.57.169.205" + "10.57.169.205", + "10.172.121.239" ], "related.user": [ - "ctas", + "ipsu", "iuta", - "ipsu" + "ctas" ], "rsa.counters.dclass_c1": 392, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4267,14 +4465,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "exerc3694.api.home" + ], "related.ip": [ - "10.42.218.103", - "10.129.234.200" + "10.129.234.200", + "10.42.218.103" ], "related.user": [ - "dquia", "tevelit", - "tisundeo" + "tisundeo", + "dquia" ], "rsa.counters.dclass_c1": 6709, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4326,14 +4527,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ididu5928.www5.local" + ], "related.ip": [ - "10.111.132.221", - "10.76.121.224" + "10.76.121.224", + "10.111.132.221" ], "related.user": [ + "oloremi", "scive", - "ali", - "oloremi" + "ali" ], "rsa.counters.dclass_c1": 6155, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4385,9 +4589,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "boriosa7066.www.corp" + ], "related.ip": [ - "10.17.214.21", - "10.195.8.141" + "10.195.8.141", + "10.17.214.21" ], "related.user": [ "dolo", @@ -4444,14 +4651,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "ssusc1892.internal.host" + ], "related.ip": [ - "10.173.13.179", - "10.179.60.167" + "10.179.60.167", + "10.173.13.179" ], "related.user": [ - "isn", + "apar", "ptasn", - "apar" + "isn" ], "rsa.counters.dclass_c1": 758, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4503,9 +4713,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "iatisund424.mail.localdomain" + ], "related.ip": [ - "10.42.135.34", - "10.178.190.123" + "10.178.190.123", + "10.42.135.34" ], "related.user": [ "tiset", @@ -4590,14 +4803,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "uidolo7626.local" + ], "related.ip": [ - "10.8.147.176", - "10.207.198.239" + "10.207.198.239", + "10.8.147.176" ], "related.user": [ - "aUteni", "incididu", - "Loremips" + "Loremips", + "aUteni" ], "rsa.counters.dclass_c1": 3043, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4648,14 +4864,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "dmini3435.internal.domain" + ], "related.ip": [ - "10.206.221.180", - "10.116.26.185" + "10.116.26.185", + "10.206.221.180" ], "related.user": [ "oNe", - "nseq", - "litesseq" + "litesseq", + "nseq" ], "rsa.counters.dclass_c1": 3218, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4703,14 +4922,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nibusBo1864.domain" + ], "related.ip": [ "10.253.127.130", "10.86.180.150" ], "related.user": [ "mnisis", - "etconsec", - "itasper" + "itasper", + "etconsec" ], "rsa.counters.dclass_c1": 4564, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4764,13 +4986,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "inv6528.www5.example" + ], "related.ip": [ - "10.158.161.5", - "10.220.175.201" + "10.220.175.201", + "10.158.161.5" ], "related.user": [ - "dolo", - "rrors" + "rrors", + "dolo" ], "rsa.counters.event_counter": 4098, "rsa.db.database": "tsed", @@ -4855,14 +5080,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "nisiutal4437.www.example" + ], "related.ip": [ "10.150.27.144", "10.248.16.82" ], "related.user": [ + "res", "ditautf", - "tuserror", - "res" + "tuserror" ], "rsa.counters.dclass_c1": 4367, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4914,13 +5142,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tqui5172.www.local" + ], "related.ip": [ - "10.173.19.140", - "10.146.131.76" + "10.146.131.76", + "10.173.19.140" ], "related.user": [ - "olo", "orsi", + "olo", "Except" ], "rsa.counters.dclass_c1": 5844, @@ -4972,9 +5203,12 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "intocca6708.mail.corp" + ], "related.ip": [ - "10.69.5.227", - "10.171.175.165" + "10.171.175.165", + "10.69.5.227" ], "related.user": [ "rumw", @@ -5027,13 +5261,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "isetqu2843.www.invalid" + ], "related.ip": [ "10.213.214.118", "10.253.175.129" ], "related.user": [ - "ate", "nrep", + "ate", "epteurs" ], "rsa.counters.dclass_c1": 6260, @@ -5088,22 +5325,25 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "commodo6041.mail.localhost" + ], "related.ip": [ "10.149.91.130", "10.89.26.170" ], "related.user": [ + "atus", "aboris", - "orumetMa", - "atus" + "orumetMa" ], "rsa.counters.event_counter": 5863, "rsa.db.database": "inventor", "rsa.internal.event_desc": "loi", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "atcupi", - "block" + "block", + "atcupi" ], "rsa.misc.category": "tation", "rsa.misc.disposition": "seddoe", @@ -5154,14 +5394,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "gitse6744.api.local" + ], "related.ip": [ - "10.52.106.68", - "10.81.108.232" + "10.81.108.232", + "10.52.106.68" ], "related.user": [ + "uaturve", "neavolup", - "aco", - "uaturve" + "aco" ], "rsa.counters.event_counter": 5098, "rsa.db.database": "lapa", @@ -5221,14 +5464,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "par3605.internal.localdomain" + ], "related.ip": [ "10.230.48.97", "10.223.10.28" ], "related.user": [ - "usmodte", + "erit", "untex", - "erit" + "usmodte" ], "rsa.counters.event_counter": 4029, "rsa.db.database": "ommodi", @@ -5286,6 +5532,9 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "isau4356.www.home" + ], "related.ip": [ "10.115.42.231", "10.161.212.150" @@ -5347,13 +5596,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "labo3477.www5.domain" + ], "related.ip": [ "10.226.75.20", "10.247.108.144" ], "related.user": [ - "tema", "maccusan", + "tema", "fugia" ], "rsa.counters.event_counter": 3711, @@ -5411,14 +5663,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "itseddo2209.mail.domain" + ], "related.ip": [ "10.97.22.61", "10.192.15.65" ], "related.user": [ - "nimides", + "illumd", "rExcep", - "illumd" + "nimides" ], "rsa.counters.dclass_c1": 4173, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5468,13 +5723,16 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "duntutl3396.api.host" + ], "related.ip": [ "10.197.254.133", "10.116.76.161" ], "related.user": [ - "ide", "trudex", + "ide", "idu" ], "rsa.counters.event_counter": 2608, @@ -5482,8 +5740,8 @@ "rsa.internal.event_desc": "ritat", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "cancel", - "quid" + "quid", + "cancel" ], "rsa.misc.category": "dipi", "rsa.misc.disposition": "asnulapa", @@ -5532,14 +5790,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "colabo6686.internal.invalid" + ], "related.ip": [ "10.144.14.15", "10.28.77.79" ], "related.user": [ + "rspic", "upta", - "utlab", - "rspic" + "utlab" ], "rsa.counters.dclass_c1": 4810, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5590,14 +5851,17 @@ "observer.product": "Secure", "observer.type": "WAF", "observer.vendor": "Imperva", + "related.hosts": [ + "tsunti1164.www.example" + ], "related.ip": [ - "10.248.177.182", - "10.18.15.43" + "10.18.15.43", + "10.248.177.182" ], "related.user": [ - "quaturve", "quei", - "caecat" + "caecat", + "quaturve" ], "rsa.counters.dclass_c1": 983, "rsa.counters.dclass_c1_str": "Affected Rows", diff --git a/x-pack/filebeat/module/infoblox/nios/config/input.yml b/x-pack/filebeat/module/infoblox/nios/config/input.yml index 35ad775a3aa..b464486074b 100644 --- a/x-pack/filebeat/module/infoblox/nios/config/input.yml +++ b/x-pack/filebeat/module/infoblox/nios/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/infoblox/nios/ingest/pipeline.yml b/x-pack/filebeat/module/infoblox/nios/ingest/pipeline.yml index 3b42b82526b..dd46c730477 100644 --- a/x-pack/filebeat/module/infoblox/nios/ingest/pipeline.yml +++ b/x-pack/filebeat/module/infoblox/nios/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{rsa.misc.event_source}}' + allow_duplicates: false + if: ctx?.rsa?.misc?.event_source != null && ctx.rsa?.misc?.event_source != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/infoblox/nios/test/generated.log-expected.json b/x-pack/filebeat/module/infoblox/nios/test/generated.log-expected.json index 9552bff05b5..9d1e178db5a 100644 --- a/x-pack/filebeat/module/infoblox/nios/test/generated.log-expected.json +++ b/x-pack/filebeat/module/infoblox/nios/test/generated.log-expected.json @@ -12,6 +12,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.5191", + "related.hosts": [ + "volup208.invalid" + ], "rsa.db.index": "mwritten", "rsa.internal.messageid": "openvpn-master", "rsa.misc.event_source": "volup208.invalid", @@ -38,6 +41,10 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "atio5608.www5.localhost", + "com1060.api.example" + ], "related.ip": [ "10.202.204.154" ], @@ -73,6 +80,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ptass3168.www5.example" + ], "related.ip": [ "10.13.70.213" ], @@ -100,6 +110,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "mcolabor1656.www5.corp" + ], "rsa.internal.data": "veleumi", "rsa.internal.event_desc": "tia", "rsa.internal.messageid": "acpid", @@ -124,6 +137,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "Cice513.api.local" + ], "rsa.db.index": "occ", "rsa.internal.event_desc": "ect", "rsa.internal.messageid": "openvpn-member", @@ -148,6 +164,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "obeataev7086.mail.invalid" + ], "rsa.internal.event_desc": "natura", "rsa.internal.messageid": "speedstep_control", "rsa.misc.event_source": "obeataev7086.mail.invalid", @@ -170,6 +189,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "nibusBon7400.localhost" + ], "rsa.internal.messageid": "ErrorMsg", "rsa.misc.event_source": "nibusBon7400.localhost", "rsa.misc.result": "success", @@ -192,6 +214,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "iat1852.api.localdomain" + ], "rsa.internal.event_desc": "ntpd exiting", "rsa.internal.messageid": "ntpd_initres", "rsa.misc.event_source": "iat1852.api.localdomain", @@ -214,6 +239,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "mquisnos5771.example" + ], "related.ip": [ "10.104.111.129" ], @@ -244,6 +272,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.3162", + "related.hosts": [ + "ite996.host" + ], "rsa.email.email_src": "umdolore", "rsa.internal.data": "umdo", "rsa.internal.messageid": "kernel", @@ -268,6 +299,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "enim2780.www.lan" + ], "rsa.internal.data": "eriame", "rsa.internal.event_desc": "lorema", "rsa.internal.messageid": "rc6", @@ -292,6 +326,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "emporinc5075.internal.host" + ], "rsa.internal.data": "atcu", "rsa.internal.messageid": "watchdog", "rsa.misc.event_source": "emporinc5075.internal.host", @@ -315,6 +352,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "strude910.internal.local" + ], "rsa.internal.event_desc": "shutting down for system reboot", "rsa.internal.messageid": "shutdown", "rsa.misc.event_source": "strude910.internal.local", @@ -357,6 +397,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "itaut7095.invalid" + ], "rsa.internal.messageid": "rc", "rsa.misc.client": "ritatis", "rsa.misc.event_source": "itaut7095.invalid", @@ -379,6 +422,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "colabor1552.www5.local" + ], "rsa.internal.event_desc": "lorumw", "rsa.internal.messageid": "phonehome", "rsa.misc.event_source": "colabor1552.www5.local", @@ -401,6 +447,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "inima5444.www5.lan" + ], "rsa.internal.data": "nihi", "rsa.internal.event_desc": "Lor", "rsa.internal.messageid": "validate_dhcpd", @@ -424,6 +473,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "erc3217.internal.lan" + ], "rsa.internal.data": "olupt", "rsa.internal.event_desc": "modoco", "rsa.internal.messageid": "debug_mount", @@ -449,6 +501,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "uames499.internal.host" + ], "related.ip": [ "10.45.25.68" ], @@ -482,6 +537,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.2299", + "related.hosts": [ + "iineavo951.internal.test" + ], "rsa.internal.data": "intoccae", "rsa.internal.messageid": "rcsysinit", "rsa.misc.event_source": "iineavo951.internal.test", @@ -505,6 +563,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "Loremip6417.mail.test" + ], "rsa.db.index": "emoeni", "rsa.internal.event_desc": "oenimips", "rsa.internal.messageid": "syslog", @@ -528,6 +589,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "mnisist2347.mail.host" + ], "rsa.internal.data": "temveleu", "rsa.internal.event_desc": "Sent mail for colabo (eme)", "rsa.internal.messageid": "sSMTP", @@ -552,6 +616,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.2807", + "related.hosts": [ + "datatn5076.internal.example" + ], "rsa.internal.event_desc": "ihilm", "rsa.internal.messageid": "snmptrapd", "rsa.misc.event_source": "datatn5076.internal.example", @@ -575,6 +642,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ercit2385.internal.home" + ], "rsa.internal.data": "run", "rsa.internal.event_desc": "building file list", "rsa.internal.messageid": "rsyncd", @@ -598,6 +668,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "quisnos4590.mail.domain" + ], "rsa.internal.event_desc": "eritqu", "rsa.internal.messageid": "httpd", "rsa.misc.event_source": "quisnos4590.mail.domain", @@ -620,6 +693,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "wri2784.api.domain" + ], "rsa.db.index": "hitect", "rsa.internal.event_desc": "dol", "rsa.internal.messageid": "restarting", @@ -643,6 +719,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "asun1250.api.localdomain" + ], "rsa.internal.data": "oluptate", "rsa.internal.event_desc": "onseq", "rsa.internal.messageid": "rc3", @@ -667,6 +746,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "intoc2428.domain" + ], "rsa.internal.data": "dantiumt", "rsa.internal.messageid": "scheduled_backups", "rsa.misc.device_name": "luptasn", @@ -690,6 +772,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ento4488.www5.localhost" + ], "rsa.internal.event_desc": "amre", "rsa.internal.messageid": "rc6", "rsa.misc.event_source": "ento4488.www5.localhost", @@ -712,6 +797,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "boris5916.www5.example" + ], "rsa.internal.data": "uioffi", "rsa.internal.event_desc": "Distribution Complete", "rsa.internal.messageid": "controld", @@ -735,6 +823,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "temqu3331.api.host" + ], "rsa.internal.event_desc": "reseos", "rsa.internal.messageid": "phonehome", "rsa.misc.event_source": "temqu3331.api.host", @@ -782,6 +873,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "radi1512.mail.example" + ], "rsa.db.index": "ris", "rsa.internal.event_desc": "uamqu", "rsa.internal.messageid": "openvpn-member", @@ -806,6 +900,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "onsecte7184.mail.domain" + ], "rsa.internal.event_desc": "reme", "rsa.internal.messageid": "syslog-ng", "rsa.misc.event_source": "onsecte7184.mail.domain", @@ -828,6 +925,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "eveli265.www5.localdomain" + ], "rsa.db.index": "nse", "rsa.internal.messageid": "ipmievd", "rsa.misc.event_source": "eveli265.www5.localdomain", @@ -853,6 +953,10 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "uptatema6843.www.host", + "derit4688.mail.localhost" + ], "related.ip": [ "10.74.104.215" ], @@ -887,6 +991,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "evolup4403.local" + ], "rsa.internal.data": "smo", "rsa.internal.messageid": "INFOBLOX-Grid", "rsa.misc.event_source": "evolup4403.local", @@ -909,6 +1016,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "nonn839.api.corp" + ], "rsa.internal.event_desc": "temquiav", "rsa.internal.messageid": "smart_check_io", "rsa.misc.event_source": "nonn839.api.corp", @@ -931,6 +1041,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "adm7744.mail.domain" + ], "rsa.internal.event_desc": "isc", "rsa.internal.messageid": "rcsysinit", "rsa.misc.event_source": "adm7744.mail.domain", @@ -955,6 +1068,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "process.pid": 845, + "related.hosts": [ + "ios6980.example" + ], "rsa.internal.messageid": "watchdog", "rsa.misc.action": [ "deny" @@ -979,6 +1095,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "osquira6030.internal.corp" + ], "rsa.internal.data": "com", "rsa.internal.event_desc": "tnulapa", "rsa.internal.messageid": "diskcheck", @@ -1002,6 +1121,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "squirati63.mail.lan" + ], "rsa.internal.data": "nbyCic", "rsa.internal.event_desc": "utlabor", "rsa.internal.messageid": "watchdog", @@ -1025,6 +1147,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "lup2134.www.localhost" + ], "rsa.internal.data": "upida", "rsa.internal.messageid": "rc", "rsa.misc.client": "tvolupt", @@ -1048,6 +1173,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "umdo4017.www.local" + ], "rsa.internal.data": "ati", "rsa.internal.event_desc": "uine", "rsa.internal.messageid": "snmptrapd", @@ -1071,6 +1199,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "loreme853.www5.localdomain" + ], "rsa.internal.event_desc": "con", "rsa.internal.messageid": "snmptrapd", "rsa.misc.event_source": "loreme853.www5.localdomain", @@ -1094,6 +1225,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "orumSe728.internal.test" + ], "rsa.db.index": "evit", "rsa.internal.data": "itess", "rsa.internal.event_desc": "runtm", @@ -1119,6 +1253,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "oremi7400.www.local" + ], "rsa.internal.data": "ineavo", "rsa.internal.event_desc": "pexe", "rsa.internal.messageid": "acpid", @@ -1142,6 +1279,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ess651.test" + ], "related.ip": [ "10.143.187.97" ], @@ -1171,6 +1311,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "epre6970.www.example" + ], "related.user": [ "temUt" ], @@ -1202,6 +1345,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "tali7803.www.localdomain" + ], "rsa.internal.event_desc": "ender", "rsa.internal.messageid": "httpd", "rsa.misc.event_source": "tali7803.www.localdomain", @@ -1225,6 +1371,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "uradi6198.test" + ], "rsa.internal.event_desc": "frequency initialized from file", "rsa.internal.messageid": "ntpd", "rsa.misc.event_source": "uradi6198.test", @@ -1248,6 +1397,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "umSe1918.local" + ], "rsa.counters.dclass_c1": 2836, "rsa.internal.event_desc": "ntpd exiting on signal", "rsa.internal.messageid": "ntpd", @@ -1271,6 +1423,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "odoconse228.mail.localdomain" + ], "rsa.internal.event_desc": "tenim", "rsa.internal.messageid": "syslog-ng", "rsa.misc.event_source": "odoconse228.mail.localdomain", @@ -1293,6 +1448,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "cteturad4074.mail.host" + ], "rsa.internal.event_desc": "tetu", "rsa.internal.messageid": "validate_dhcpd", "rsa.misc.event_source": "cteturad4074.mail.host", @@ -1315,6 +1473,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "itation6137.home" + ], "rsa.internal.event_desc": "sequat", "rsa.internal.messageid": "debug_mount", "rsa.misc.event_source": "itation6137.home", @@ -1359,6 +1520,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "dun1276.api.localdomain" + ], "rsa.internal.event_desc": "time slew duraion", "rsa.internal.messageid": "ntpd", "rsa.misc.event_source": "dun1276.api.localdomain", @@ -1382,6 +1546,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "iquidexe304.mail.test" + ], "rsa.internal.event_desc": "oreetd", "rsa.internal.messageid": "smart_check_io", "rsa.misc.event_source": "iquidexe304.mail.test", @@ -1405,6 +1572,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "preh2690.api.localdomain" + ], "rsa.internal.data": "mac", "rsa.internal.event_desc": "qui", "rsa.internal.messageid": "captured_dns_uploader", @@ -1430,6 +1600,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.7214", + "related.hosts": [ + "rem3032.mail.domain" + ], "rsa.email.email_src": "ica", "rsa.internal.messageid": "kernel", "rsa.misc.event_source": "rem3032.mail.domain", @@ -1455,6 +1628,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.7727", + "related.hosts": [ + "tetur2694.mail.local" + ], "rsa.db.index": "itinv", "rsa.internal.messageid": "openvpn-member", "rsa.misc.event_source": "tetur2694.mail.local", @@ -1478,6 +1654,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "utaliqu6138.mail.localhost" + ], "rsa.internal.event_desc": "can't read sid", "rsa.internal.messageid": "pidof", "rsa.misc.client": "oremi", @@ -1501,6 +1680,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "tame4953.mail.localhost" + ], "rsa.db.index": "prehen", "rsa.internal.event_desc": "ntutlabo", "rsa.internal.messageid": "restarting", @@ -1525,6 +1707,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "loi7596.www5.home" + ], "rsa.internal.data": "deserun", "rsa.internal.messageid": "scheduled_backups", "rsa.misc.device_name": "esseq", @@ -1548,6 +1733,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "mmodoc4947.internal.test" + ], "rsa.internal.data": "atu", "rsa.internal.messageid": "ErrorMsg", "rsa.misc.event_source": "mmodoc4947.internal.test", @@ -1571,6 +1759,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "olorem2760.www5.test" + ], "rsa.internal.event_desc": "ntpd exiting", "rsa.internal.messageid": "ntpd_initres", "rsa.misc.event_source": "olorem2760.www5.test", @@ -1593,6 +1784,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "dol3346.www.lan" + ], "rsa.internal.data": "olorese", "rsa.internal.event_desc": "Scheduled backup to the FTP server failed", "rsa.internal.messageid": "scheduled_ftp_backups", @@ -1619,6 +1813,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ercit6496.api.local" + ], "rsa.internal.event_desc": "Scheduled backup to the SCP server was successful", "rsa.internal.messageid": "scheduled_scp_backups", "rsa.misc.device_name": "midestl", @@ -1662,6 +1859,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "col3570.www.invalid" + ], "rsa.email.email_dst": "tsed", "rsa.internal.messageid": "sSMTP", "rsa.misc.event_source": "col3570.www.invalid", @@ -1685,6 +1885,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "mipsamvo4282.api.home" + ], "rsa.internal.event_desc": "oreveri", "rsa.internal.messageid": "init", "rsa.misc.event_source": "mipsamvo4282.api.home", @@ -1707,6 +1910,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "umq1309.api.test" + ], "rsa.internal.event_desc": "mve", "rsa.internal.messageid": "debug", "rsa.misc.event_source": "umq1309.api.test", @@ -1729,6 +1935,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ugit5828.www5.test" + ], "rsa.internal.data": "asnu", "rsa.internal.messageid": "rc", "rsa.misc.client": "hitec", @@ -1772,6 +1981,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "archite1843.mail.home" + ], "rsa.internal.event_desc": "uta", "rsa.internal.messageid": "radiusd", "rsa.misc.event_source": "archite1843.mail.home", @@ -1794,6 +2006,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "derit5270.mail.local" + ], "rsa.internal.event_desc": "ntexpl", "rsa.internal.messageid": "rcsysinit", "rsa.misc.event_source": "derit5270.mail.local", @@ -1816,6 +2031,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "itanim4024.api.example" + ], "related.ip": [ "10.156.34.19" ], @@ -1873,6 +2091,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ataevi1984.internal.host" + ], "related.ip": [ "10.17.87.79" ], @@ -1900,6 +2121,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "tionula1586.host" + ], "rsa.internal.data": "idolor", "rsa.internal.event_desc": "ntpd exiting", "rsa.internal.messageid": "ntpd_initres", @@ -1923,6 +2147,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "llam1884.www.corp" + ], "rsa.internal.event_desc": "time slew duraion", "rsa.internal.messageid": "ntpd", "rsa.misc.event_source": "llam1884.www.corp", @@ -1946,6 +2173,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ore5643.api.lan" + ], "rsa.internal.data": "edolorin", "rsa.internal.event_desc": "dolorem", "rsa.internal.messageid": "acpid", @@ -1969,6 +2199,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "exeacomm79.api.corp" + ], "rsa.internal.data": "mides", "rsa.internal.event_desc": "ciun", "rsa.internal.messageid": "rc3", @@ -1993,6 +2226,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "lorsita6602.mail.local" + ], "rsa.internal.messageid": "watchdog", "rsa.misc.event_source": "lorsita6602.mail.local", "rsa.misc.result_code": "npr", @@ -2015,6 +2251,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "ratv2649.www.host" + ], "rsa.internal.data": "tali", "rsa.internal.event_desc": "BCS", "rsa.internal.messageid": "speedstep_control", @@ -2038,6 +2277,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "abor4353.www5.host" + ], "rsa.internal.event_desc": "tesseq", "rsa.internal.messageid": "python", "rsa.misc.event_source": "abor4353.www5.host", @@ -2062,6 +2304,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.388", + "related.hosts": [ + "rerepre6748.internal.domain" + ], "rsa.db.index": "sinto", "rsa.internal.data": "tdolore", "rsa.internal.messageid": "openvpn-member", @@ -2086,6 +2331,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "qui3176.internal.example" + ], "rsa.internal.messageid": "rc", "rsa.misc.client": "amvolu", "rsa.misc.event_source": "qui3176.internal.example", @@ -2109,6 +2357,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "der7349.invalid" + ], "rsa.internal.event_desc": "eiusmod", "rsa.internal.messageid": "monitor", "rsa.misc.event_source": "der7349.invalid", @@ -2132,6 +2383,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "veleum3833.internal.test" + ], "rsa.internal.event_desc": "iusmodt", "rsa.internal.messageid": "diskcheck", "rsa.misc.event_source": "veleum3833.internal.test", @@ -2154,6 +2408,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "aquio6685.internal.test" + ], "rsa.internal.data": "aquio", "rsa.internal.event_desc": "riatu", "rsa.internal.messageid": "rc6", @@ -2177,6 +2434,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "tanimid4871.internal.domain" + ], "rsa.internal.data": "abor", "rsa.internal.event_desc": "nBCSe", "rsa.internal.messageid": "debug", @@ -2200,6 +2460,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "icta82.internal.lan" + ], "rsa.internal.data": "uei", "rsa.internal.event_desc": "can't read sid", "rsa.internal.messageid": "pidof", @@ -2224,6 +2487,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "dol6197.mail.localdomain" + ], "rsa.internal.data": "inBCSe", "rsa.internal.event_desc": "otamrem", "rsa.internal.messageid": "speedstep_control", @@ -2247,6 +2513,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "lumqu617.www.test" + ], "rsa.internal.event_desc": "time slew duraion", "rsa.internal.messageid": "ntpd", "rsa.misc.event_source": "lumqu617.www.test", @@ -2270,6 +2539,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "uido492.www5.home" + ], "rsa.internal.data": "uid", "rsa.internal.messageid": "pidof", "rsa.misc.client": "snostrum", @@ -2294,6 +2566,9 @@ "observer.type": "IPAM", "observer.vendor": "Infoblox", "observer.version": "1.6198", + "related.hosts": [ + "reseosqu1629.mail.lan" + ], "rsa.internal.event_desc": "ommo", "rsa.internal.messageid": "snmptrapd", "rsa.misc.event_source": "reseosqu1629.mail.lan", @@ -2317,6 +2592,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "itseddoe5595.internal.localhost" + ], "rsa.internal.data": "ehende", "rsa.internal.event_desc": "tutla", "rsa.internal.messageid": "smart_check_io", @@ -2340,6 +2618,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "olu5333.www.domain" + ], "rsa.internal.event_desc": "dolor", "rsa.internal.messageid": "diskcheck", "rsa.misc.event_source": "olu5333.www.domain", @@ -2362,6 +2643,9 @@ "observer.product": "Network", "observer.type": "IPAM", "observer.vendor": "Infoblox", + "related.hosts": [ + "dtemp1362.internal.example" + ], "rsa.internal.event_desc": "itae", "rsa.internal.messageid": "init", "rsa.misc.event_source": "dtemp1362.internal.example", diff --git a/x-pack/filebeat/module/juniper/junos/config/input.yml b/x-pack/filebeat/module/juniper/junos/config/input.yml index 95d8bf8a477..ac3e93cc485 100644 --- a/x-pack/filebeat/module/juniper/junos/config/input.yml +++ b/x-pack/filebeat/module/juniper/junos/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/juniper/junos/ingest/pipeline.yml b/x-pack/filebeat/module/juniper/junos/ingest/pipeline.yml index afa4b02bec4..bc38869e537 100644 --- a/x-pack/filebeat/module/juniper/junos/ingest/pipeline.yml +++ b/x-pack/filebeat/module/juniper/junos/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.hostname}}' + allow_duplicates: false + if: ctx?.host?.hostname && ctx.host?.hostname != '' + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain && ctx.server?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/juniper/netscreen/config/input.yml b/x-pack/filebeat/module/juniper/netscreen/config/input.yml index 9b4a5566a9b..0fde2181329 100644 --- a/x-pack/filebeat/module/juniper/netscreen/config/input.yml +++ b/x-pack/filebeat/module/juniper/netscreen/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml b/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml index 5108ebdad07..f69e14d5f97 100644 --- a/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml +++ b/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml @@ -40,4 +40,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/microsoft/defender_atp/ingest/pipeline.yml b/x-pack/filebeat/module/microsoft/defender_atp/ingest/pipeline.yml index 392f3a441a7..0f35c753092 100644 --- a/x-pack/filebeat/module/microsoft/defender_atp/ingest/pipeline.yml +++ b/x-pack/filebeat/module/microsoft/defender_atp/ingest/pipeline.yml @@ -279,6 +279,11 @@ processors: field: related.hash value: '{{file.hash.sha256}}' if: ctx.file?.hash?.sha256 != null +- append: + field: related.hosts + value: '{{host.hostname}}' + if: ctx.host?.hostname != null && ctx.host?.hostname != '' + allow_duplicates: false ############# ## Cleanup ## diff --git a/x-pack/filebeat/module/microsoft/defender_atp/test/defender_atp-test.json.log-expected.json b/x-pack/filebeat/module/microsoft/defender_atp/test/defender_atp-test.json.log-expected.json index b7b2b12ff40..0423289d6ac 100644 --- a/x-pack/filebeat/module/microsoft/defender_atp/test/defender_atp-test.json.log-expected.json +++ b/x-pack/filebeat/module/microsoft/defender_atp/test/defender_atp-test.json.log-expected.json @@ -40,6 +40,9 @@ "observer.name": "WindowsDefenderAv", "observer.product": "Defender ATP", "observer.vendor": "Microsoft", + "related.hosts": [ + "testserver4" + ], "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.", "service.type": "microsoft", "tags": [ @@ -102,6 +105,9 @@ "b6d237154f2e528f0b503b58b025862d66b02b73", "a92056d772260b39a876d01552496b2f8b4610a0b1e084952fe1176784e2ce77" ], + "related.hosts": [ + "testserver4" + ], "related.user": [ "administrator1" ], @@ -157,6 +163,9 @@ "observer.name": "WindowsDefenderAtp", "observer.product": "Defender ATP", "observer.vendor": "Microsoft", + "related.hosts": [ + "testserver4" + ], "related.user": [ "administrator1" ], @@ -215,6 +224,9 @@ "ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281", "fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356" ], + "related.hosts": [ + "testserver4" + ], "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.", "service.type": "microsoft", "tags": [ diff --git a/x-pack/filebeat/module/microsoft/dhcp/config/input.yml b/x-pack/filebeat/module/microsoft/dhcp/config/input.yml index e8e683f9022..83985fba51d 100644 --- a/x-pack/filebeat/module/microsoft/dhcp/config/input.yml +++ b/x-pack/filebeat/module/microsoft/dhcp/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/microsoft/dhcp/ingest/pipeline.yml b/x-pack/filebeat/module/microsoft/dhcp/ingest/pipeline.yml index 7c917d05c81..6ba5eef3032 100644 --- a/x-pack/filebeat/module/microsoft/dhcp/ingest/pipeline.yml +++ b/x-pack/filebeat/module/microsoft/dhcp/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.hostname}}' + allow_duplicates: false + if: ctx?.host?.hostname != null && ctx.host?.hostname != '' + - append: + field: related.hosts + value: '{{source.address}}' + allow_duplicates: false + if: ctx?.source?.address != null && ctx.source?.address != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/microsoft/dhcp/test/generated.log-expected.json b/x-pack/filebeat/module/microsoft/dhcp/test/generated.log-expected.json index a350394d3bd..48ad613503d 100644 --- a/x-pack/filebeat/module/microsoft/dhcp/test/generated.log-expected.json +++ b/x-pack/filebeat/module/microsoft/dhcp/test/generated.log-expected.json @@ -12,6 +12,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ciade5699.domain" + ], "related.ip": [ "10.124.22.221" ], @@ -41,6 +44,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "orev6153.internal.domain" + ], "related.ip": [ "10.103.162.55" ], @@ -70,6 +76,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "uatDuis2964.test" + ], "related.ip": [ "10.58.0.245" ], @@ -99,6 +108,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "untNequ5075.www5.domain" + ], "related.ip": [ "10.163.217.10" ], @@ -130,6 +142,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "idexea3181.www.local" + ], "related.ip": [ "10.111.27.193" ], @@ -159,6 +174,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "etM953.api.domain" + ], "related.ip": [ "10.97.38.141" ], @@ -188,6 +206,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "inv5716.mail.invalid" + ], "related.ip": [ "10.17.21.125" ], @@ -217,6 +238,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "uines6355.internal.localdomain" + ], "related.ip": [ "10.73.69.75" ], @@ -246,6 +270,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "rehender4535.www5.test" + ], "related.ip": [ "10.45.25.68" ], @@ -275,6 +302,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "mporain2624.www.localhost" + ], "related.ip": [ "10.68.93.6" ], @@ -304,6 +334,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tutla2716.www.domain" + ], "related.ip": [ "10.192.110.182" ], @@ -333,6 +366,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "conseq557.mail.lan" + ], "related.ip": [ "10.148.153.201" ], @@ -362,6 +398,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "etconse7424.internal.lan" + ], "related.ip": [ "10.213.147.241" ], @@ -391,6 +430,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tMalor7410.www.localhost" + ], "related.ip": [ "10.183.233.5" ], @@ -422,6 +464,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "equat2243.www5.localdomain" + ], "related.ip": [ "10.52.186.29" ], @@ -451,6 +496,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ectio2175.www.localhost" + ], "related.ip": [ "10.194.114.58" ], @@ -480,6 +528,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "liqui6106.internal.home" + ], "related.ip": [ "10.212.42.224" ], @@ -509,6 +560,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "eratv6205.internal.lan" + ], "related.ip": [ "10.244.144.198" ], @@ -540,6 +594,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "piscin6866.internal.host" + ], "related.ip": [ "10.90.86.89" ], @@ -569,6 +626,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "riosamn7650.api.test" + ], "related.ip": [ "10.158.237.92" ], @@ -601,6 +661,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "aper5651.test" + ], "related.ip": [ "10.20.147.134" ], @@ -633,6 +696,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "inventor6088.www.invalid" + ], "related.ip": [ "10.213.145.202" ], @@ -662,6 +728,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "cipitlab6201.www5.example" + ], "related.ip": [ "10.76.10.73" ], @@ -691,6 +760,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "Nemoenim2039.api.localhost" + ], "related.ip": [ "10.226.199.190" ], @@ -721,6 +793,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "iquipe2458.api.host" + ], "related.ip": [ "10.20.129.206" ], @@ -750,6 +825,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "intoc1426.mail.lan" + ], "related.ip": [ "10.22.110.210" ], @@ -779,6 +857,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "rsitvolu3751.mail.lan" + ], "related.ip": [ "10.218.87.174" ], @@ -808,6 +889,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tqu4367.www5.localhost" + ], "related.ip": [ "10.140.113.244" ], @@ -837,6 +921,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "inci5738.www5.invalid" + ], "related.ip": [ "10.159.181.29" ], @@ -866,6 +953,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "itecto1300.internal.corp" + ], "related.ip": [ "10.178.173.128" ], @@ -895,6 +985,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "siut1579.www.domain" + ], "related.ip": [ "10.217.38.30" ], @@ -924,6 +1017,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ame6223.www5.localhost" + ], "related.ip": [ "10.178.49.161" ], @@ -953,6 +1049,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "aturve1647.mail.localhost" + ], "related.ip": [ "10.175.103.215" ], @@ -982,6 +1081,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "aco6894.mail.home" + ], "related.ip": [ "10.192.21.74" ], @@ -1013,6 +1115,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tetu2485.internal.invalid" + ], "related.ip": [ "10.142.25.100" ], @@ -1043,6 +1148,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "doloreme60.www5.localhost" + ], "related.ip": [ "10.162.114.217" ], @@ -1074,6 +1182,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "luptat7214.domain" + ], "related.ip": [ "10.0.132.176" ], @@ -1104,6 +1215,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "amcor5091.internal.corp" + ], "related.ip": [ "10.22.187.69" ], @@ -1135,6 +1249,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ncidid5410.internal.domain" + ], "related.ip": [ "10.2.128.234" ], @@ -1165,6 +1282,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "nofd988.api.example" + ], "related.ip": [ "10.223.160.140" ], @@ -1197,6 +1317,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "borisnis6159.www5.localdomain" + ], "related.ip": [ "10.137.14.180" ], @@ -1226,6 +1349,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "dminima4348.mail.home" + ], "related.ip": [ "10.192.182.230" ], @@ -1256,6 +1382,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "oluptas6981.www5.localhost" + ], "related.ip": [ "10.95.241.28" ], @@ -1288,6 +1417,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "equ4808.www.localhost" + ], "related.ip": [ "10.74.240.121" ], @@ -1320,6 +1452,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "nsec923.internal.local" + ], "related.ip": [ "10.139.127.232" ], @@ -1351,6 +1486,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "emoe4059.api.localdomain" + ], "related.ip": [ "10.170.6.54" ], @@ -1380,6 +1518,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "equun6662.home" + ], "related.ip": [ "10.46.115.216" ], @@ -1409,6 +1550,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "dtempori5735.www5.local" + ], "related.ip": [ "10.226.5.189" ], @@ -1438,6 +1582,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "cupi7581.internal.local" + ], "related.ip": [ "10.0.20.5" ], @@ -1468,6 +1615,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "quasiar5281.mail.invalid" + ], "related.ip": [ "10.180.101.232" ], @@ -1500,6 +1650,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tionula1586.host" + ], "related.ip": [ "10.141.158.225" ], @@ -1529,6 +1682,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ore5643.api.lan" + ], "related.ip": [ "10.94.88.5" ], @@ -1559,6 +1715,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ciun39.localdomain" + ], "related.ip": [ "10.155.18.139" ], @@ -1591,6 +1750,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "iutali7297.www.domain" + ], "related.ip": [ "10.85.48.117" ], @@ -1620,6 +1782,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "docon5398.mail.host" + ], "related.ip": [ "10.224.146.6" ], @@ -1649,6 +1814,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "destlabo7803.mail.localhost" + ], "related.ip": [ "10.182.152.242" ], @@ -1678,6 +1846,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "fugits1163.host" + ], "related.ip": [ "10.225.157.110" ], @@ -1707,6 +1878,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "adol170.internal.example" + ], "related.ip": [ "10.236.185.102" ], @@ -1736,6 +1910,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "red5516.localhost" + ], "related.ip": [ "10.146.72.62" ], @@ -1767,6 +1944,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "qui3176.internal.example" + ], "related.ip": [ "10.221.7.206" ], @@ -1796,6 +1976,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "luptat2979.internal.local" + ], "related.ip": [ "10.196.35.130" ], @@ -1825,6 +2008,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "prehe1037.api.example" + ], "related.ip": [ "10.182.219.241" ], @@ -1854,6 +2040,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "abor1370.www.domain" + ], "related.ip": [ "10.101.163.40" ], @@ -1883,6 +2072,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "atDuis5759.internal.test" + ], "related.ip": [ "10.141.39.190" ], @@ -1912,6 +2104,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ict2699.internal.localhost" + ], "related.ip": [ "10.41.89.217" ], @@ -1941,6 +2136,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "cive2292.api.local" + ], "related.ip": [ "10.86.44.130" ], @@ -1971,6 +2169,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "aconsequ2331.www5.localhost" + ], "related.ip": [ "10.209.71.69" ], @@ -2004,6 +2205,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "rsitvolu3596.www.test" + ], "related.ip": [ "10.48.104.137" ], @@ -2036,6 +2240,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "elites6366.mail.lan" + ], "related.ip": [ "10.225.255.211" ], @@ -2068,6 +2275,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "orumSe4514.www.corp" + ], "related.ip": [ "10.137.103.62" ], @@ -2097,6 +2307,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "fdeFi6975.www5.local" + ], "related.ip": [ "10.156.88.51" ], @@ -2126,6 +2339,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "dol3000.www5.local" + ], "related.ip": [ "10.7.99.47" ], @@ -2155,6 +2371,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "umd5182.mail.host" + ], "related.ip": [ "10.243.252.157" ], @@ -2186,6 +2405,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "expl2616.www.test" + ], "related.ip": [ "10.95.73.196" ], @@ -2215,6 +2437,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "risni1535.example" + ], "related.ip": [ "10.145.104.170" ], @@ -2244,6 +2469,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "umtotamr7221.mail.host" + ], "related.ip": [ "10.18.152.236" ], @@ -2273,6 +2501,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "teir7585.www5.localdomain" + ], "related.ip": [ "10.15.240.220" ], @@ -2302,6 +2533,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tur4536.localdomain" + ], "related.ip": [ "10.147.130.71" ], @@ -2331,6 +2565,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ffic6926.home" + ], "related.ip": [ "10.203.146.137" ], @@ -2360,6 +2597,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ate4386.api.localhost" + ], "related.ip": [ "10.5.98.182" ], @@ -2389,6 +2629,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "iameaque5093.api.corp" + ], "related.ip": [ "10.6.180.90" ], @@ -2418,6 +2661,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tatisetq3237.www5.corp" + ], "related.ip": [ "10.111.93.224" ], @@ -2447,6 +2693,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "rvelill32.internal.corp" + ], "related.ip": [ "10.196.157.28" ], @@ -2476,6 +2725,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ectetura2657.www.localdomain" + ], "related.ip": [ "10.143.0.78" ], @@ -2505,6 +2757,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ico3220.api.test" + ], "related.ip": [ "10.184.187.32" ], @@ -2534,6 +2789,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "Duisa7769.test" + ], "related.ip": [ "10.30.87.51" ], @@ -2563,6 +2821,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ptatev6552.www.test" + ], "related.ip": [ "10.180.62.222" ], @@ -2593,6 +2854,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "olore6487.www5.local" + ], "related.ip": [ "10.198.9.209" ], @@ -2625,6 +2889,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "nvol548.corp" + ], "related.ip": [ "10.41.217.115" ], @@ -2656,6 +2923,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "pteursi466.www.localdomain" + ], "related.ip": [ "10.212.196.228" ], @@ -2685,6 +2955,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "olupt1936.host" + ], "related.ip": [ "10.166.180.119" ], @@ -2714,6 +2987,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "uisaut2157.corp" + ], "related.ip": [ "10.7.142.212" ], @@ -2744,6 +3020,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "ecte882.www5.host" + ], "related.ip": [ "10.209.237.97" ], @@ -2776,6 +3055,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "doloreeu4417.example" + ], "related.ip": [ "10.61.26.207" ], @@ -2806,6 +3088,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "tper4341.lan" + ], "related.ip": [ "10.139.88.194" ], @@ -2837,6 +3122,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "nimve4965.mail.corp" + ], "related.ip": [ "10.86.134.125" ], @@ -2866,6 +3154,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "mquisno5146.home" + ], "related.ip": [ "10.41.78.169" ], @@ -2895,6 +3186,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "imaveni4500.api.localdomain" + ], "related.ip": [ "10.69.181.95" ], @@ -2925,6 +3219,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "veleu2874.www5.localhost" + ], "related.ip": [ "10.222.6.52" ], @@ -2956,6 +3253,9 @@ "observer.product": "DHCP", "observer.type": "Application", "observer.vendor": "Microsoft", + "related.hosts": [ + "nemul5083.api.localdomain" + ], "related.ip": [ "10.218.41.80" ], diff --git a/x-pack/filebeat/module/netscout/sightline/config/input.yml b/x-pack/filebeat/module/netscout/sightline/config/input.yml index ec1e377e5cd..dbbca93154b 100644 --- a/x-pack/filebeat/module/netscout/sightline/config/input.yml +++ b/x-pack/filebeat/module/netscout/sightline/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/panw/panos/config/input.yml b/x-pack/filebeat/module/panw/panos/config/input.yml index ed3d089bb28..258dda2c70d 100644 --- a/x-pack/filebeat/module/panw/panos/config/input.yml +++ b/x-pack/filebeat/module/panw/panos/config/input.yml @@ -195,4 +195,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml b/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml index 412ddeb5c58..a958993a61c 100644 --- a/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml +++ b/x-pack/filebeat/module/panw/panos/ingest/pipeline.yml @@ -472,6 +472,12 @@ processors: value: "{{panw.panos.file.hash}}" if: "ctx?.panw?.panos?.file?.hash != null" + - append: + field: related.hosts + value: "{{observer.hostname}}" + if: "ctx?.observer?.hostname != null && ctx.observer?.hostname != ''" + allow_duplicates: false + # Remove temporary fields. - remove: field: diff --git a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json index 20c28165a42..93fe08f75d9 100644 --- a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json @@ -73,6 +73,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -171,6 +174,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -269,6 +275,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -367,6 +376,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -465,6 +477,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -563,6 +578,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -661,6 +679,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -759,6 +780,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -857,6 +881,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -955,6 +982,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1053,6 +1083,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1151,6 +1184,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1249,6 +1285,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1347,6 +1386,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1445,6 +1487,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1543,6 +1588,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1641,6 +1689,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1739,6 +1790,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1837,6 +1891,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -1935,6 +1992,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2033,6 +2093,9 @@ "panw.panos.threat.resource": "b.scorecardresearch.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.137.131", @@ -2131,6 +2194,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2229,6 +2295,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2327,6 +2396,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2425,6 +2497,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2523,6 +2598,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2621,6 +2699,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2719,6 +2800,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2817,6 +2901,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -2915,6 +3002,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3013,6 +3103,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3111,6 +3204,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3209,6 +3305,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3307,6 +3406,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3405,6 +3507,9 @@ "panw.panos.threat.resource": "consent.cmp.oath.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "152.195.55.192", @@ -3503,6 +3608,9 @@ "panw.panos.threat.resource": "cdn.taboola.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "151.101.2.2", @@ -3604,6 +3712,9 @@ "panw.panos.threat.resource": "rules.quantcount.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.192.7.152", @@ -3705,6 +3816,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -3806,6 +3920,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -3907,6 +4024,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4008,6 +4128,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4109,6 +4232,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4210,6 +4336,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4311,6 +4440,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4412,6 +4544,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4513,6 +4648,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4614,6 +4752,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4715,6 +4856,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4816,6 +4960,9 @@ "panw.panos.threat.resource": "srv-2018-11-30-22.config.parsely.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.4.120.175", @@ -4917,6 +5064,9 @@ "panw.panos.threat.resource": "www.googleadservices.com/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "216.58.194.98", @@ -5015,6 +5165,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5113,6 +5266,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5211,6 +5367,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5309,6 +5468,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5407,6 +5569,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5505,6 +5670,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5603,6 +5771,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5701,6 +5872,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5799,6 +5973,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5897,6 +6074,9 @@ "panw.panos.threat.resource": "service.maxymiser.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.72.145.245", @@ -5998,6 +6178,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6099,6 +6282,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6200,6 +6386,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6301,6 +6490,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6402,6 +6594,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6503,6 +6698,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6604,6 +6802,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6705,6 +6906,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6806,6 +7010,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -6907,6 +7114,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7008,6 +7218,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7109,6 +7322,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7210,6 +7426,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7311,6 +7530,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7412,6 +7634,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", @@ -7513,6 +7738,9 @@ "panw.panos.threat.resource": "segment-data.zqtk.net/", "panw.panos.type": "THREAT", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.209.101.70", diff --git a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json index 60e5c4a2b29..5f979092c4b 100644 --- a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json @@ -79,6 +79,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "184.51.253.152", @@ -185,6 +188,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -294,6 +300,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "17.253.3.202", @@ -400,6 +409,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -509,6 +521,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.196", "216.58.194.99", @@ -615,6 +630,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "209.234.224.22", @@ -721,6 +739,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -827,6 +848,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "172.217.2.238", @@ -933,6 +957,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1039,6 +1066,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1145,6 +1175,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "17.249.60.78", @@ -1251,6 +1284,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1357,6 +1393,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1463,6 +1502,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1569,6 +1611,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -1675,6 +1720,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -1781,6 +1829,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -1887,6 +1938,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "98.138.49.44", @@ -1993,6 +2047,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "72.30.3.43", @@ -2099,6 +2156,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.196", "8.8.8.8", @@ -2205,6 +2265,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "172.217.9.142", @@ -2311,6 +2374,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.207", "8.8.8.8", @@ -2420,6 +2486,9 @@ "panw.panos.sub_type": "start", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.84.80.198", @@ -2527,6 +2596,9 @@ "panw.panos.sub_type": "drop", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "199.167.55.52", @@ -2633,6 +2705,9 @@ "panw.panos.sub_type": "deny", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -2735,6 +2810,9 @@ "panw.panos.source.zone": "trust", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.210", "8.8.8.8", @@ -2838,6 +2916,9 @@ "panw.panos.sub_type": "test", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "172.217.9.142", @@ -2944,6 +3025,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "151.101.2.2", @@ -3053,6 +3137,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "216.58.194.66", @@ -3159,6 +3246,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -3265,6 +3355,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.210", "8.8.8.8", @@ -3371,6 +3464,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "184.51.253.193", @@ -3477,6 +3573,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -3584,6 +3683,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "199.167.55.52", @@ -3693,6 +3795,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "199.167.52.219", @@ -3802,6 +3907,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.71.117.196", @@ -3908,6 +4016,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -4014,6 +4125,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -4123,6 +4237,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "insufficient-content", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.186.194.41", @@ -4228,6 +4345,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "insufficient-content", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.201.124.9", @@ -4337,6 +4457,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "100.24.131.237", @@ -4443,6 +4566,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "184.51.252.247", @@ -4552,6 +4678,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.190.88.148", @@ -4661,6 +4790,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.186.243.83", @@ -4767,6 +4899,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -4873,6 +5008,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -4982,6 +5120,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "100.24.165.74", @@ -5088,6 +5229,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "184.51.252.247", @@ -5193,6 +5337,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.201.94.140", @@ -5295,6 +5442,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5401,6 +5551,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5507,6 +5660,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5613,6 +5769,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5719,6 +5878,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5825,6 +5987,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -5931,6 +6096,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6037,6 +6205,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.196", "8.8.8.8", @@ -6143,6 +6314,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6249,6 +6423,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6355,6 +6532,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6461,6 +6641,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6567,6 +6750,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6673,6 +6859,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6782,6 +6971,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "66.28.0.45", @@ -6888,6 +7080,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -6994,6 +7189,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7100,6 +7298,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7206,6 +7407,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7312,6 +7516,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7421,6 +7628,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "computer-and-internet-info", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "23.52.174.25", @@ -7527,6 +7737,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7633,6 +7846,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7742,6 +7958,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "54.230.5.228", @@ -7848,6 +8067,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -7954,6 +8176,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8060,6 +8285,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8166,6 +8394,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.195", "208.83.246.20", @@ -8271,6 +8502,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.196", "8.8.8.8", @@ -8376,6 +8610,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8481,6 +8718,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8588,6 +8828,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "35.185.88.112", @@ -8694,6 +8937,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8800,6 +9046,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -8906,6 +9155,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -9015,6 +9267,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "50.19.85.24", @@ -9124,6 +9379,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "50.19.85.24", @@ -9233,6 +9491,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "50.19.85.24", @@ -9339,6 +9600,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "web-advertisements", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "104.254.150.9", @@ -9448,6 +9712,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "business-and-economy", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "50.19.85.24", @@ -9557,6 +9824,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.0.218.108", @@ -9666,6 +9936,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "52.6.117.19", @@ -9775,6 +10048,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "34.238.96.22", @@ -9884,6 +10160,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "130.211.47.17", @@ -9990,6 +10269,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10096,6 +10378,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10202,6 +10487,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10308,6 +10596,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10414,6 +10705,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10520,6 +10814,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", @@ -10626,6 +10923,9 @@ "panw.panos.sub_type": "end", "panw.panos.type": "TRAFFIC", "panw.panos.url.category": "any", + "related.hosts": [ + "PA-220" + ], "related.ip": [ "192.168.15.224", "8.8.8.8", diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml index 0598b8e63d1..05fe8a00db0 100644 --- a/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml b/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml index 5618f330e7c..a5eafc083d9 100644 --- a/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{destination.address}}' + allow_duplicates: false + if: ctx?.destination?.address != null && ctx.destination?.address != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json index ea2fb8b7304..f9043afa34a 100644 --- a/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/test/generated.log-expected.json @@ -89,6 +89,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 3391, + "related.hosts": [ + "tenbyCic5882.api.home" + ], "related.ip": [ "10.69.20.77" ], @@ -247,6 +250,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 7183, + "related.hosts": [ + "ommod3671.mail.domain" + ], "rsa.email.email_src": "dexeaco", "rsa.internal.messageid": "queued-reinject", "rsa.misc.client": "emaperi", @@ -477,6 +483,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 4499, + "related.hosts": [ + "ersp3536.www5.lan" + ], "rsa.db.index": "mod", "rsa.email.email_dst": "fugiatn", "rsa.internal.messageid": "queued-aglife", @@ -666,6 +675,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 3866, + "related.hosts": [ + "sit6590.lan" + ], "related.ip": [ "10.123.143.188" ], @@ -1256,6 +1268,9 @@ "observer.product": "Email", "observer.type": "Firewall", "observer.vendor": "Proofpoint", + "related.hosts": [ + "lors7553.api.local" + ], "rsa.internal.messageid": "dkimv_run", "rsa.misc.client": "uido", "rsa.misc.log_session_id": "tiaecon", @@ -1473,6 +1488,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 2861, + "related.hosts": [ + "str4641.domain" + ], "related.ip": [ "10.151.31.58" ], @@ -2407,6 +2425,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 3274, + "related.hosts": [ + "Sedutper7794.www5.domain" + ], "related.ip": [ "10.154.22.241" ], @@ -2533,6 +2554,9 @@ "observer.type": "Firewall", "observer.vendor": "Proofpoint", "process.pid": 4250, + "related.hosts": [ + "estla4081.corp" + ], "rsa.internal.messageid": "queued-default", "rsa.misc.client": "queued-default", "rsa.network.host_dst": "estla4081.corp", diff --git a/x-pack/filebeat/module/radware/defensepro/config/input.yml b/x-pack/filebeat/module/radware/defensepro/config/input.yml index 24f226db8f3..e978b023425 100644 --- a/x-pack/filebeat/module/radware/defensepro/config/input.yml +++ b/x-pack/filebeat/module/radware/defensepro/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/snort/log/config/input.yml b/x-pack/filebeat/module/snort/log/config/input.yml index cd99c6e04da..f36e381ab96 100644 --- a/x-pack/filebeat/module/snort/log/config/input.yml +++ b/x-pack/filebeat/module/snort/log/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/snort/log/ingest/pipeline.yml b/x-pack/filebeat/module/snort/log/ingest/pipeline.yml index 0db6047881b..640c5b2556a 100644 --- a/x-pack/filebeat/module/snort/log/ingest/pipeline.yml +++ b/x-pack/filebeat/module/snort/log/ingest/pipeline.yml @@ -53,6 +53,11 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/snort/log/test/generated.log-expected.json b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json index 62a15952dd8..f0150dcb87f 100644 --- a/x-pack/filebeat/module/snort/log/test/generated.log-expected.json +++ b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json @@ -12,6 +12,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "quid2184.invalid" + ], "related.ip": [ "10.202.72.124" ], @@ -54,6 +57,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "uptatev4292.www.invalid" + ], "related.ip": [ "10.212.11.114", "10.38.77.13" @@ -100,6 +106,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tlabo6088.www.localdomain" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "itecto", "rsa.misc.result": "failure", @@ -127,6 +136,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "eporroqu4200.domain" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "suntinc", "rsa.misc.result": "success", @@ -153,6 +165,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "conseq557.mail.lan" + ], "related.user": [ "aaliquaU" ], @@ -193,9 +208,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "itame189.domain" + ], "related.ip": [ - "10.182.199.231", - "10.24.67.250" + "10.24.67.250", + "10.182.199.231" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "oei", @@ -238,6 +256,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "vitaedi1318.corp" + ], "related.user": [ "temqu" ], @@ -268,6 +289,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "itatione1916.www.host" + ], "related.user": [ "oluptate" ], @@ -306,9 +330,12 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.4418", + "related.hosts": [ + "its7829.localhost" + ], "related.ip": [ - "10.110.31.190", - "10.157.18.252" + "10.157.18.252", + "10.110.31.190" ], "rsa.crypto.sig_type": "rQu", "rsa.internal.messageid": "5979", @@ -351,6 +378,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "aec3673.internal.host" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "niamq", "rsa.misc.result": "failure", @@ -378,6 +408,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "inibu2292.www.invalid" + ], "related.user": [ "isetquas" ], @@ -412,6 +445,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ori1241.www.corp" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "ercit", "rsa.misc.result": "failure", @@ -438,6 +474,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ueipsa748.localdomain" + ], "related.user": [ "aparia" ], @@ -470,6 +509,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "oluptat548.www5.invalid" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "dolorem", "rsa.misc.result": "failure", @@ -496,6 +538,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "loremag6816.www5.lan" + ], "related.user": [ "inrepreh" ], @@ -528,6 +573,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tionemu5269.internal.localhost" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "occaec", "rsa.misc.result": "failure", @@ -554,6 +602,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "onulamco7734.www.local" + ], "related.user": [ "uptat" ], @@ -586,6 +637,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "luptatem3834.lan" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "tise", @@ -618,6 +672,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "exercita2068.api.invalid" + ], "related.ip": [ "10.169.84.140" ], @@ -651,6 +708,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "orumS757.www5.corp" + ], "related.ip": [ "10.130.231.129" ], @@ -685,6 +745,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "sedquian4212.www5.domain" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "eca", @@ -718,6 +781,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "oinBCSed3444.api.local" + ], "related.user": [ "smodtem" ], @@ -756,6 +822,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.6724", + "related.hosts": [ + "apari5002.api.test" + ], "related.ip": [ "10.9.200.197", "10.182.213.195" @@ -810,9 +879,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tper4341.lan" + ], "related.ip": [ - "10.210.180.142", - "10.111.33.70" + "10.111.33.70", + "10.210.180.142" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "animi", @@ -856,6 +928,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "antiu3533.internal.domain" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "lapari", "rsa.misc.result": "success", @@ -884,6 +959,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "cidu921.internal.lan" + ], "related.ip": [ "10.222.183.123", "10.165.33.19" @@ -924,9 +1002,12 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.890", + "related.hosts": [ + "unturmag6190.api.lan" + ], "related.ip": [ - "10.238.223.171", - "10.52.190.18" + "10.52.190.18", + "10.238.223.171" ], "rsa.crypto.sig_type": "Finibus", "rsa.internal.messageid": "16539", @@ -974,6 +1055,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.3902", + "related.hosts": [ + "conseq6079.www.corp" + ], "related.ip": [ "10.68.233.163", "10.160.178.109" @@ -1018,6 +1102,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tvol3402.www.local" + ], "related.ip": [ "10.162.109.83" ], @@ -1050,6 +1137,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "xcep3783.internal.localhost" + ], "related.user": [ "serro" ], @@ -1081,6 +1171,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ciatisun7378.www5.invalid" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "riaturEx", "rsa.misc.result": "unknown", @@ -1112,9 +1205,12 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.6627", + "related.hosts": [ + "iqu4858.mail.invalid" + ], "related.ip": [ - "10.116.175.84", - "10.213.100.153" + "10.213.100.153", + "10.116.175.84" ], "rsa.crypto.sig_type": "exercit", "rsa.internal.messageid": "11634", @@ -1156,6 +1252,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ionu3320.api.localhost" + ], "related.user": [ "estq" ], @@ -1186,6 +1285,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ollitan5079.www.lan" + ], "related.user": [ "deriti" ], @@ -1218,6 +1320,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "nihilmol1849.api.local" + ], "rsa.counters.dclass_c1_str": "Number of Files", "rsa.internal.messageid": "connection_events", "rsa.misc.action": [ @@ -1247,6 +1352,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ota4562.local" + ], "related.user": [ "epteurs" ], @@ -1278,6 +1386,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "gnama5033.www5.home" + ], "related.user": [ "ction" ], @@ -1309,6 +1420,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "sum6106.www.home" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "doe", "rsa.misc.result": "failure", @@ -1335,6 +1449,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "squa2763.www.lan" + ], "related.user": [ "trude" ], @@ -1375,9 +1492,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "stiae3403.internal.localhost" + ], "related.ip": [ - "10.240.144.78", - "10.251.159.118" + "10.251.159.118", + "10.240.144.78" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "ostrudex", @@ -1421,6 +1541,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "setq5996.corp" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "odi", "rsa.misc.result": "success", @@ -1448,6 +1571,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "quiano3025.api.localhost" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "sequatD", "rsa.misc.result": "unknown", @@ -1475,6 +1601,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "qui7797.www.host" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "umet", "rsa.misc.result": "failure", @@ -1510,6 +1639,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "urau1660.www.lan" + ], "related.ip": [ "10.201.132.114", "10.140.209.249" @@ -1555,6 +1687,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "edutpers3482.www5.corp" + ], "related.user": [ "mnisis" ], @@ -1592,6 +1727,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.2633", + "related.hosts": [ + "nofde7732.internal.test" + ], "related.ip": [ "10.198.44.231", "10.36.122.169" @@ -1644,9 +1782,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "evita850.localdomain" + ], "related.ip": [ - "10.144.162.122", - "10.77.86.215" + "10.77.86.215", + "10.144.162.122" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "eav", @@ -1689,6 +1830,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "aturau3002.api.corp" + ], "related.user": [ "sci" ], @@ -1720,6 +1864,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ntiumt238.internal.corp" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "odite", @@ -1753,6 +1900,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "atu2951.test" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "pitlab", "rsa.misc.result": "success", @@ -1779,6 +1929,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "uipe5295.api.localhost" + ], "related.user": [ "mwrit" ], @@ -1810,6 +1963,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tatiset5041.www5.local" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "Utenim", @@ -1842,6 +1998,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "esse2198.mail.example" + ], "related.user": [ "uaturvel" ], @@ -1873,6 +2032,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "pitlab5165.localdomain" + ], "related.ip": [ "10.17.172.91" ], @@ -1906,6 +2068,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "uinesci6041.api.local" + ], "related.user": [ "pers" ], @@ -1944,6 +2109,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.2115", + "related.hosts": [ + "uovol2459.www5.invalid" + ], "related.ip": [ "10.60.137.215", "10.28.105.106" @@ -1988,6 +2156,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ptate7215.www5.home" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "ssequa", "rsa.misc.result": "failure", @@ -2015,6 +2186,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "metc7395.lan" + ], "rsa.counters.dclass_c1_str": "Number of Files", "rsa.internal.messageid": "connection_events", "rsa.misc.action": [ @@ -2051,11 +2225,14 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "Loremips5368.www5.corp" + ], "related.ip": [ - "10.20.167.114", "10.49.190.163", "10.166.40.137", - "10.65.144.119" + "10.65.144.119", + "10.20.167.114" ], "rsa.internal.event_desc": "Offloaded TCP Flow for connection", "rsa.internal.messageid": "FTD_events", @@ -2095,9 +2272,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "mexer1548.www5.example" + ], "related.ip": [ - "10.162.128.87", - "10.104.78.147" + "10.104.78.147", + "10.162.128.87" ], "rsa.internal.messageid": "MALWARE", "rsa.misc.checksum": "emu", @@ -2132,6 +2312,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "emulla6625.www5.corp" + ], "related.ip": [ "10.237.43.87", "10.82.180.46" @@ -2174,6 +2357,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.4189", + "related.hosts": [ + "magn3657.api.invalid" + ], "related.ip": [ "10.180.28.156", "10.234.234.205" @@ -2221,6 +2407,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "nis3942.mail.example" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "architec", "rsa.misc.result": "success", @@ -2256,9 +2445,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "upta788.invalid" + ], "related.ip": [ - "10.40.250.209", - "10.166.10.187" + "10.166.10.187", + "10.40.250.209" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "high-temUte", @@ -2302,6 +2494,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "consequu3962.api.localdomain" + ], "rsa.counters.dclass_c1_str": "Number of Files", "rsa.internal.messageid": "connection_events", "rsa.misc.action": [ @@ -2333,9 +2528,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ita7851.localhost" + ], "related.ip": [ - "10.198.202.72", - "10.78.180.219" + "10.78.180.219", + "10.198.202.72" ], "rsa.internal.messageid": "MALWARE", "rsa.misc.checksum": "equaturv", @@ -2376,6 +2574,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.2390", + "related.hosts": [ + "laparia5374.api.domain" + ], "related.ip": [ "10.147.155.100", "10.232.67.182" @@ -2427,9 +2628,12 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.1034", + "related.hosts": [ + "onse3711.api.domain" + ], "related.ip": [ - "10.95.152.78", - "10.4.147.70" + "10.4.147.70", + "10.95.152.78" ], "rsa.crypto.sig_type": "cid", "rsa.internal.messageid": "9193", @@ -2472,6 +2676,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "iac7016.api.lan" + ], "related.user": [ "antiu" ], @@ -2502,6 +2709,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tte4006.www5.test" + ], "related.user": [ "lors" ], @@ -2534,6 +2744,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "equatD1241.www5.host" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "econs", @@ -2568,6 +2781,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "essequ121.localdomain" + ], "related.ip": [ "10.216.14.36", "10.224.250.83" @@ -2608,6 +2824,9 @@ "observer.type": "IDS", "observer.vendor": "Snort", "observer.version": "1.6298", + "related.hosts": [ + "borios1685.www.localhost" + ], "related.ip": [ "10.231.10.63", "10.38.22.60" @@ -2663,9 +2882,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "Bonoru5658.mail.invalid" + ], "related.ip": [ - "10.46.57.181", - "10.29.231.11" + "10.29.231.11", + "10.46.57.181" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "remape", @@ -2708,6 +2930,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ueipsa6797.mail.home" + ], "related.user": [ "agnaal" ], @@ -2738,6 +2963,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "iono5161.www5.localhost" + ], "related.user": [ "ita" ], @@ -2770,6 +2998,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "untut3537.domain" + ], "rsa.counters.dclass_c1_str": "Number of Files", "rsa.internal.messageid": "connection_events", "rsa.misc.action": [ @@ -2808,6 +3039,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "reetd7201.invalid" + ], "related.ip": [ "10.135.250.25", "10.107.144.80" @@ -2854,6 +3088,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "tnula4380.mail.test" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "olupta", "rsa.misc.result": "failure", @@ -2880,6 +3117,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "apar2567.www.localhost" + ], "related.user": [ "iscing" ], @@ -2916,6 +3156,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "onsecte5119.www.invalid" + ], "related.ip": [ "10.198.207.31", "10.5.88.183" @@ -2952,6 +3195,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "iutali3143.host" + ], "related.user": [ "ect" ], @@ -2983,6 +3229,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "orro7466.www5.lan" + ], "related.user": [ "issu" ], @@ -3013,6 +3262,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "epre7710.www.domain" + ], "related.user": [ "aria" ], @@ -3044,6 +3296,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "nsequatu2799.www5.invalid" + ], "related.user": [ "mape" ], @@ -3076,6 +3331,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "scingel1634.api.home" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "meaq", @@ -3109,6 +3367,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "inBCSe364.www.corp" + ], "rsa.counters.dclass_c1_str": " The number of intrusion events", "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "high-tsedquia", @@ -3150,9 +3411,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "onofdeFi1149.www5.domain" + ], "related.ip": [ - "10.154.87.98", - "10.186.68.87" + "10.186.68.87", + "10.154.87.98" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "uptate", @@ -3204,6 +3468,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "lumdol5252.internal.test" + ], "related.ip": [ "10.35.59.140", "10.67.211.63" @@ -3250,6 +3517,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "quianonn2762.api.localhost" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "eeufugia", "rsa.misc.result": "unknown", @@ -3276,6 +3546,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "atn2219.api.invalid" + ], "related.user": [ "radip" ], @@ -3308,6 +3581,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "equu1159.internal.localhost" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "atcup", "rsa.misc.result": "failure", @@ -3335,6 +3611,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "urQuisau2442.mail.invalid" + ], "related.user": [ "uptate" ], @@ -3370,9 +3649,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "cididu3187.home" + ], "related.ip": [ - "10.179.27.185", - "10.14.46.141" + "10.14.46.141", + "10.179.27.185" ], "rsa.internal.messageid": "MALWARE", "rsa.misc.checksum": "llumdolo", @@ -3406,6 +3688,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "aliqua4025.www.localdomain" + ], "related.user": [ "deFinibu" ], @@ -3439,6 +3724,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "citati1297.api.domain" + ], "related.user": [ "emp" ], @@ -3471,6 +3759,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "nreprehe2138.www5.domain" + ], "rsa.internal.messageid": "HMNOTIFY", "rsa.misc.event_type": "eursi", "rsa.misc.result": "success", @@ -3498,6 +3789,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "idolore6589.api.localdomain" + ], "related.user": [ "ctobea" ], @@ -3538,6 +3832,9 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "erunt3957.internal.lan" + ], "related.ip": [ "10.118.103.185", "10.32.195.34", @@ -3582,9 +3879,12 @@ "observer.product": "IDS", "observer.type": "IDS", "observer.vendor": "Snort", + "related.hosts": [ + "ntNe7144.api.lan" + ], "related.ip": [ - "10.188.88.133", - "10.111.130.177" + "10.111.130.177", + "10.188.88.133" ], "rsa.internal.messageid": "MALWARE", "rsa.misc.checksum": "numqu", diff --git a/x-pack/filebeat/module/sonicwall/firewall/config/input.yml b/x-pack/filebeat/module/sonicwall/firewall/config/input.yml index 91bbc2d960f..b0bed38d214 100644 --- a/x-pack/filebeat/module/sonicwall/firewall/config/input.yml +++ b/x-pack/filebeat/module/sonicwall/firewall/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/sonicwall/firewall/ingest/pipeline.yml b/x-pack/filebeat/module/sonicwall/firewall/ingest/pipeline.yml index 921b02b96ea..01202648b26 100644 --- a/x-pack/filebeat/module/sonicwall/firewall/ingest/pipeline.yml +++ b/x-pack/filebeat/module/sonicwall/firewall/ingest/pipeline.yml @@ -53,6 +53,26 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{host.hostname}}' + allow_duplicates: false + if: ctx?.host?.hostname != null && ctx.host?.hostname != '' + - append: + field: related.hosts + value: '{{source.address}}' + allow_duplicates: false + if: ctx?.source?.address != null && ctx.source?.address != '' + - append: + field: related.hosts + value: '{{destination.address}}' + allow_duplicates: false + if: ctx?.destination?.address != null && ctx.destination?.address != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json b/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json index 56ba3e6e78d..5b84648b930 100644 --- a/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json +++ b/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json @@ -18,9 +18,13 @@ "observer.product": "Firewalls", "observer.type": "Firewall", "observer.vendor": "Sonicwall", + "related.hosts": [ + "nostrud4819.mail.test", + "oreetdol1714.internal.corp" + ], "related.ip": [ - "10.92.136.230", - "10.49.111.67" + "10.49.111.67", + "10.92.136.230" ], "rsa.internal.messageid": "914", "rsa.internal.msg": "lupt", @@ -81,9 +85,9 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ + "10.227.15.1", "10.149.203.46", - "10.150.156.22", - "10.227.15.1" + "10.150.156.22" ], "rsa.internal.event_desc": "ctetur", "rsa.internal.messageid": "1369", @@ -416,9 +420,12 @@ "observer.product": "Firewalls", "observer.type": "Firewall", "observer.vendor": "Sonicwall", + "related.hosts": [ + "fugi4637.www.lan" + ], "related.ip": [ - "10.30.196.102", - "10.241.178.107" + "10.241.178.107", + "10.30.196.102" ], "rsa.internal.messageid": "353", "rsa.internal.msg": "onproide", @@ -471,8 +478,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.157.161.103", - "10.78.151.178" + "10.78.151.178", + "10.157.161.103" ], "rsa.internal.event_desc": "taut", "rsa.internal.messageid": "24", @@ -504,8 +511,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.204.11.20", - "10.239.201.234" + "10.239.201.234", + "10.204.11.20" ], "rsa.internal.messageid": "87", "rsa.internal.msg": "Loremip", @@ -544,8 +551,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.245.200.97", "10.34.161.166", + "10.245.200.97", "10.219.116.137" ], "rsa.internal.event_desc": "rehend", @@ -592,8 +599,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.252.122.195", - "10.118.80.140" + "10.118.80.140", + "10.252.122.195" ], "rsa.internal.messageid": "401", "rsa.internal.msg": "inesci", @@ -781,8 +788,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.237.163.139", - "10.135.187.104" + "10.135.187.104", + "10.237.163.139" ], "rsa.internal.messageid": "882", "rsa.internal.msg": "itatio", @@ -838,8 +845,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.60.129.15", - "10.248.101.25" + "10.248.101.25", + "10.60.129.15" ], "rsa.internal.messageid": "372", "rsa.internal.msg": "ommodico", @@ -1207,9 +1214,13 @@ "observer.product": "Firewalls", "observer.type": "Firewall", "observer.vendor": "Sonicwall", + "related.hosts": [ + "tiaec5551.www.local", + "ise5905.www.local" + ], "related.ip": [ - "10.53.113.23", - "10.97.124.211" + "10.97.124.211", + "10.53.113.23" ], "rsa.identity.user_sid_dst": "iumdol", "rsa.internal.messageid": "1154", @@ -1420,9 +1431,9 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.113.100.237", + "10.108.84.24", "10.251.248.228", - "10.108.84.24" + "10.113.100.237" ], "rsa.internal.event_desc": "volupt", "rsa.internal.messageid": "606", @@ -1635,8 +1646,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.104.49.142", - "10.102.166.19" + "10.102.166.19", + "10.104.49.142" ], "rsa.internal.messageid": "252", "rsa.internal.msg": "eprehend", @@ -1766,8 +1777,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.191.242.168", - "10.165.48.224" + "10.165.48.224", + "10.191.242.168" ], "rsa.internal.event_desc": "equep", "rsa.internal.messageid": "995", @@ -1852,8 +1863,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.219.42.212", - "10.57.85.98" + "10.57.85.98", + "10.219.42.212" ], "rsa.internal.event_desc": "mquisno", "rsa.internal.messageid": "995", @@ -1906,8 +1917,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.195.223.82", - "10.135.70.159" + "10.135.70.159", + "10.195.223.82" ], "rsa.internal.messageid": "351", "rsa.internal.msg": "CSe", @@ -2057,8 +2068,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.12.54.142", - "10.56.10.84" + "10.56.10.84", + "10.12.54.142" ], "rsa.internal.messageid": "658", "rsa.internal.msg": "osquirat", @@ -2176,8 +2187,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.57.255.4", - "10.200.122.184" + "10.200.122.184", + "10.57.255.4" ], "rsa.identity.user_sid_dst": "sBon", "rsa.internal.event_desc": "fic", @@ -2318,8 +2329,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.78.29.246", - "10.125.85.128" + "10.125.85.128", + "10.78.29.246" ], "rsa.internal.messageid": "355", "rsa.internal.msg": "labo", @@ -2449,8 +2460,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.245.216.15", - "10.110.208.170" + "10.110.208.170", + "10.245.216.15" ], "rsa.internal.messageid": "931", "rsa.internal.msg": "aecatcup", @@ -2673,8 +2684,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.219.228.115", - "10.179.3.247" + "10.179.3.247", + "10.219.228.115" ], "rsa.internal.messageid": "373", "rsa.misc.action": [ diff --git a/x-pack/filebeat/module/sophos/utm/config/input.yml b/x-pack/filebeat/module/sophos/utm/config/input.yml index c2774be9846..865b6e27119 100644 --- a/x-pack/filebeat/module/sophos/utm/config/input.yml +++ b/x-pack/filebeat/module/sophos/utm/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml b/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml index 777046121c7..62aaa2a3c30 100644 --- a/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml +++ b/x-pack/filebeat/module/sophos/utm/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{destination.address}}' + allow_duplicates: false + if: ctx?.destination?.address != null && ctx.destination?.address != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json index d820157c77c..b57ab7067ab 100644 --- a/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json @@ -51,14 +51,17 @@ "observer.vendor": "Sophos", "observer.version": "1.5102", "process.pid": 5716, + "related.hosts": [ + "ercit2385.internal.home" + ], "related.ip": [ "10.47.202.102", "10.57.170.140" ], "related.user": [ - "dexeac", "sunt", - "icistatuscode=giatquov" + "icistatuscode=giatquov", + "dexeac" ], "rsa.db.index": "run", "rsa.identity.logon_type": "nofdeF", @@ -119,6 +122,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3905, + "related.hosts": [ + "eirure7587.internal.localhost" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "aaliquaU", "rsa.misc.result": "No form context found", @@ -150,12 +156,15 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "observer.version": "1.3129", + "related.hosts": [ + "data4478.api.lan" + ], "related.ip": [ "10.106.239.55" ], "related.user": [ - "eaq", - "itquiin" + "itquiin", + "eaq" ], "rsa.identity.logon_type": "stquidol", "rsa.internal.event_desc": "bor", @@ -196,6 +205,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7692, + "related.hosts": [ + "ctetura3009.www5.corp" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "corp", "rsa.misc.event_id": "AH00292", @@ -275,6 +287,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 945, + "related.hosts": [ + "ptasnu6684.mail.lan" + ], "related.ip": [ "10.18.13.211" ], @@ -306,6 +321,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "ssecillu7166.internal.lan" + ], "rsa.internal.event_desc": "barnyard:Initializing daemon mode", "rsa.internal.messageid": "barnyard", "rsa.network.alias_host": [ @@ -333,6 +351,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 2164, + "related.hosts": [ + "ore5643.api.lan" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "acom", "rsa.misc.severity": "high", @@ -362,6 +383,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 4006, + "related.hosts": [ + "ciun39.localdomain" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.context": "Unclean shutdown", "rsa.misc.event_id": "AH00098", @@ -392,6 +416,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 1263, + "related.hosts": [ + "atatnon6064.www.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_id": "AH00291", "rsa.misc.event_log": "adol", @@ -420,6 +447,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "gitse2463.www5.invalid" + ], "related.user": [ "agnaaliq" ], @@ -475,6 +505,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "oriosam6277.mail.localdomain" + ], "related.ip": [ "10.169.5.162" ], @@ -509,6 +542,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 5996, + "related.hosts": [ + "ptate3830.internal.localhost" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_id": "AH02572", "rsa.misc.event_log": "ntut", @@ -538,6 +574,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3340, + "related.hosts": [ + "nvo6105.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "isn", "rsa.misc.event_id": "AH00020", @@ -592,6 +631,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "observer.version": "1.5889", + "related.hosts": [ + "edic2758.api.domain" + ], "related.ip": [ "10.54.169.175" ], @@ -698,6 +740,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 170, + "related.hosts": [ + "ectobeat3157.mail.local" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "ditau", "rsa.misc.event_id": "AH02312", @@ -733,6 +778,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 873, + "related.hosts": [ + "ident2323.internal.corp" + ], "related.ip": [ "10.144.21.112" ], @@ -764,6 +812,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "ttenb4581.www.host" + ], "rsa.internal.event_desc": "httpproxy:shutdown finished, exiting.", "rsa.internal.messageid": "httpproxy", "rsa.network.alias_host": [ @@ -789,6 +840,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "lapari5763.api.invalid" + ], "related.ip": [ "10.103.2.48" ], @@ -829,6 +883,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "elites4713.www.localhost" + ], "related.ip": [ "10.161.51.135", "10.52.190.18" @@ -878,6 +935,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3338, + "related.hosts": [ + "sam1795.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "animide", "rsa.misc.event_id": "AH02312", @@ -968,13 +1028,17 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "observer.version": "1.5146", + "related.hosts": [ + "nostrum6305.internal.localhost", + "Duis583.api.local" + ], "related.ip": [ "10.17.51.153", "10.89.41.97" ], "related.user": [ - "tio", "tcustatuscode=eumiu", + "tio", "pteurs" ], "rsa.db.index": "eavolupt", @@ -1037,6 +1101,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "xeaco7887.www.localdomain" + ], "related.user": [ "uptate" ], @@ -1071,6 +1138,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 5430, + "related.hosts": [ + "iscivel3512.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.operation_id": "eriti", "rsa.network.host_dst": "iscivel3512.invalid", @@ -1119,6 +1189,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "dolor5799.home" + ], "rsa.internal.event_desc": "afcd: IM/P2P Classifier configuration reloaded successfully.", "rsa.internal.messageid": "afcd", "rsa.network.alias_host": [ @@ -1147,6 +1220,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 6691, + "related.hosts": [ + "oreseosq1859.api.lan" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "essequam", "rsa.misc.result": "Virus daemon connection problem", @@ -1203,6 +1279,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 1121, + "related.hosts": [ + "autodit272.www.localhost" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "imadmin", "rsa.misc.severity": "very-high", @@ -1234,6 +1313,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3705, + "related.hosts": [ + "rporis6787.www5.localdomain" + ], "related.ip": [ "10.148.21.7" ], @@ -1268,6 +1350,10 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "reprehe5661.www.lan", + "ntore4333.api.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.context": "iumd", "rsa.misc.operation_id": "equam", @@ -1298,6 +1384,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 2384, + "related.hosts": [ + "sequatD163.internal.example" + ], "related.ip": [ "10.151.206.38" ], @@ -1331,6 +1420,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "elillu5777.www5.lan" + ], "related.ip": [ "10.230.4.70" ], @@ -1362,6 +1454,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "ecatcup3022.mail.invalid" + ], "rsa.db.index": "nproide", "rsa.internal.event_desc": "xl2tpd:xl2tpd Software copyright.", "rsa.internal.messageid": "xl2tpd", @@ -1388,6 +1483,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "qui7797.www.host" + ], "rsa.internal.event_desc": "ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]...", "rsa.internal.messageid": "ipsec_starter", "rsa.network.alias_host": [ @@ -1416,6 +1514,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3994, + "related.hosts": [ + "nofdeFin2037.mail.example" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "nevol", "rsa.misc.result": "Cannot read reply", @@ -1471,6 +1572,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 4074, + "related.hosts": [ + "eFinib2403.api.example" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "ecatcu", "rsa.misc.event_log": "sun", @@ -1506,8 +1610,8 @@ "10.244.96.61" ], "related.user": [ - "iumt", - "itsedqui" + "itsedqui", + "iumt" ], "rsa.identity.logon_type": "psamvolu", "rsa.internal.event_desc": "orroqui", @@ -1572,6 +1676,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 1853, + "related.hosts": [ + "obeatae2042.www.domain" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "ula", "rsa.misc.event_id": "AH01110", @@ -1602,6 +1709,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "aerat1267.www5.example" + ], "rsa.internal.event_desc": "pop3proxy:Master started.", "rsa.internal.messageid": "pop3proxy", "rsa.network.alias_host": [ @@ -1630,6 +1740,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 478, + "related.hosts": [ + "writt2238.internal.localdomain" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "aed", "rsa.misc.severity": "low", @@ -1660,6 +1773,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7721, + "related.hosts": [ + "siutaliq4937.api.lan" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.comments": "server certificate has a different hostname from actual hostname", "rsa.misc.event_log": "urvel", @@ -1731,14 +1847,17 @@ "observer.vendor": "Sophos", "observer.version": "1.3726", "process.pid": 1090, + "related.hosts": [ + "tenbyCi4371.www5.localdomain" + ], "related.ip": [ "10.98.126.206", "10.214.167.164" ], "related.user": [ "hen", - "amremapstatuscode=dolorsit", - "isnostru" + "isnostru", + "amremapstatuscode=dolorsit" ], "rsa.db.index": "spernatu", "rsa.identity.logon_type": "untutl", @@ -1853,6 +1972,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7755, + "related.hosts": [ + "ectob5542.www5.corp" + ], "related.ip": [ "10.231.77.26" ], @@ -1902,15 +2024,19 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "observer.version": "1.2707", + "related.hosts": [ + "iusmo901.www.home", + "tenima5715.api.example" + ], "related.ip": [ "10.2.24.156", "10.92.93.236" ], "related.user": [ "ulpaq", - "ntoccae", + "Sedutper", "dolorsistatuscode=acc", - "Sedutper" + "ntoccae" ], "rsa.db.index": "snisiut", "rsa.identity.logon_type": "umdol", @@ -1919,8 +2045,8 @@ "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", "rsa.misc.action": [ - "block", - "icons" + "icons", + "block" ], "rsa.misc.comments": "porincid", "rsa.misc.content_type": "temvele", @@ -1990,14 +2116,17 @@ "observer.vendor": "Sophos", "observer.version": "1.3155", "process.pid": 6463, + "related.hosts": [ + "mni4032.lan" + ], "related.ip": [ "10.180.169.49", "10.202.65.2" ], "related.user": [ - "tasu", + "atatno", "iscivelistatuscode=urve", - "atatno" + "tasu" ], "rsa.db.index": "amrem", "rsa.identity.logon_type": "nulamcol", @@ -2057,6 +2186,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 5350, + "related.hosts": [ + "iscing6960.api.invalid" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.context": "SSL Library Error", "rsa.misc.event_log": "incidu", @@ -2090,6 +2222,9 @@ "observer.vendor": "Sophos", "observer.version": "1.6420", "process.pid": 793, + "related.hosts": [ + "olupta3647.host" + ], "rsa.internal.event_desc": "imvenia", "rsa.internal.messageid": "httpd", "rsa.misc.event_log": "ruredo", @@ -2124,6 +2259,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 6633, + "related.hosts": [ + "iavolu7814.www5.localhost" + ], "related.ip": [ "10.194.12.83" ], @@ -2172,14 +2310,17 @@ "observer.vendor": "Sophos", "observer.version": "1.4256", "process.pid": 5792, + "related.hosts": [ + "obea2960.mail.corp" + ], "related.ip": [ "10.33.138.154", "10.45.12.53" ], "related.user": [ + "eturadip", "umqustatuscode=ntexpli", - "porincid", - "eturadip" + "porincid" ], "rsa.db.index": "dolor", "rsa.identity.logon_type": "eturadi", @@ -2269,6 +2410,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 212, + "related.hosts": [ + "olli5982.www.test" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "uatDui", "rsa.misc.result": "virus daemon error", @@ -2300,6 +2444,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3136, + "related.hosts": [ + "nsecte3644.internal.test" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "isund", "rsa.misc.severity": "high", @@ -2334,8 +2481,8 @@ "10.32.85.21" ], "related.user": [ - "etconsec", - "antium" + "antium", + "etconsec" ], "rsa.identity.logon_type": "umiurere", "rsa.internal.event_desc": "serro", @@ -2371,6 +2518,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "econseq7119.www.home" + ], "rsa.internal.event_desc": "sshd:error:Could not get shadow information for NOUSER", "rsa.internal.messageid": "sshd", "rsa.network.alias_host": [ @@ -2399,6 +2549,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 3669, + "related.hosts": [ + "ant2543.www5.lan" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "lapa", "rsa.misc.result": "Cannot read reply", @@ -2471,15 +2624,18 @@ "observer.vendor": "Sophos", "observer.version": "1.7641", "process.pid": 6562, + "related.hosts": [ + "nisiuta4810.api.test" + ], "related.ip": [ - "10.210.175.52", - "10.85.200.58" + "10.85.200.58", + "10.210.175.52" ], "related.user": [ - "reetd", - "inimastatuscode=emipsum", "Loremi", - "rExce" + "rExce", + "reetd", + "inimastatuscode=emipsum" ], "rsa.db.index": "apa", "rsa.identity.logon_type": "sedquia", @@ -2547,9 +2703,12 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "itametc1599.api.test" + ], "related.ip": [ - "10.115.166.48", - "10.133.45.45" + "10.133.45.45", + "10.115.166.48" ], "rsa.internal.event_desc": "Authentication", "rsa.internal.messageid": "ulogd", @@ -2594,6 +2753,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "tiumt5462.mail.localhost" + ], "rsa.internal.event_desc": "sshd:Invalid user admin.", "rsa.internal.messageid": "sshd", "rsa.network.alias_host": [ @@ -2619,6 +2781,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "vol1450.internal.host" + ], "related.ip": [ "10.71.184.162" ], @@ -2675,6 +2840,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 5943, + "related.hosts": [ + "rporissu573.api.test" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "nihi", "rsa.misc.event_id": "AH02312", @@ -2705,6 +2873,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "nostru774.corp" + ], "rsa.internal.messageid": "URID", "rsa.misc.action": [ "allow" @@ -2759,6 +2930,9 @@ "observer.vendor": "Sophos", "observer.version": "1.7102", "process.pid": 5037, + "related.hosts": [ + "lorsita2216.www5.example" + ], "rsa.internal.event_desc": "olorsita", "rsa.internal.messageid": "httpd", "rsa.misc.event_log": "iadese", @@ -2795,6 +2969,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 4346, + "related.hosts": [ + "sum2208.host" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "nia", "rsa.misc.severity": "medium", @@ -2824,6 +3001,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 5126, + "related.hosts": [ + "ore6843.local" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.comments": "No signature on cookie", "rsa.misc.event_log": "aveniam", @@ -2857,6 +3037,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7442, + "related.hosts": [ + "Sedu1610.mail.corp" + ], "related.ip": [ "10.177.35.133" ], @@ -2892,6 +3075,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 6600, + "related.hosts": [ + "corpo6737.example" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "aliquide", "rsa.misc.result": "failure", @@ -2942,6 +3128,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "eratvol314.www.home" + ], "rsa.internal.event_desc": "pop3proxy:Master started.", "rsa.internal.messageid": "pop3proxy", "rsa.network.alias_host": [ @@ -2971,6 +3160,10 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 2389, + "related.hosts": [ + "utemvele1838.mail.test", + "seosquir715.local" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.comments": "rci", "rsa.misc.event_log": "aco", @@ -3008,6 +3201,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 2237, + "related.hosts": [ + "ulapari2656.local" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.event_log": "non", "rsa.misc.result": "failure", @@ -3120,6 +3316,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7766, + "related.hosts": [ + "stla2856.host" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.disposition": "configured", "rsa.misc.event_log": "adolo", @@ -3150,6 +3349,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 2404, + "related.hosts": [ + "peri6748.www5.domain" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.context": "Unclean shutdown", "rsa.misc.event_id": "AH00098", @@ -3181,6 +3383,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 6108, + "related.hosts": [ + "tnon5442.internal.test" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.action": [ "accept" @@ -3215,6 +3420,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7690, + "related.hosts": [ + "ariatu2606.www.host" + ], "rsa.internal.messageid": "reverseproxy", "rsa.misc.context": "Not all file sent to client", "rsa.misc.event_log": "umquid", @@ -3251,6 +3459,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "imv1805.api.host" + ], "related.ip": [ "10.248.62.55", "10.96.243.231" @@ -3303,6 +3514,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 7650, + "related.hosts": [ + "rita600.www5.localdomain" + ], "related.ip": [ "10.132.101.158" ], @@ -3359,6 +3573,9 @@ "observer.type": "Firewall", "observer.vendor": "Sophos", "process.pid": 1817, + "related.hosts": [ + "admini1122.www.local" + ], "related.ip": [ "10.96.193.132" ], @@ -3402,8 +3619,8 @@ "10.96.200.83" ], "related.user": [ - "acommod", - "lapariat" + "lapariat", + "acommod" ], "rsa.identity.logon_type": "remeumf", "rsa.internal.event_desc": "dol", @@ -3439,6 +3656,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "emvel4391.localhost" + ], "rsa.internal.event_desc": "sshd: Did not receive identification string.", "rsa.internal.messageid": "sshd", "rsa.network.alias_host": [ @@ -3489,6 +3709,9 @@ "observer.product": "UTM", "observer.type": "Firewall", "observer.vendor": "Sophos", + "related.hosts": [ + "untinc5531.www5.test" + ], "rsa.internal.event_desc": "sshd:error:Could not get shadow information for NOUSER", "rsa.internal.messageid": "sshd", "rsa.network.alias_host": [ diff --git a/x-pack/filebeat/module/squid/log/config/input.yml b/x-pack/filebeat/module/squid/log/config/input.yml index ac392325320..5ce8949c381 100644 --- a/x-pack/filebeat/module/squid/log/config/input.yml +++ b/x-pack/filebeat/module/squid/log/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/squid/log/ingest/pipeline.yml b/x-pack/filebeat/module/squid/log/ingest/pipeline.yml index 96b12b89731..9a8f547c6d1 100644 --- a/x-pack/filebeat/module/squid/log/ingest/pipeline.yml +++ b/x-pack/filebeat/module/squid/log/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{server.domain}}' + allow_duplicates: false + if: ctx?.server?.domain != null && ctx.server?.domain != '' + - append: + field: related.hosts + value: '{{url.domain}}' + allow_duplicates: false + if: ctx?.url?.domain != null && ctx.url?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/squid/log/test/access1.log-expected.json b/x-pack/filebeat/module/squid/log/test/access1.log-expected.json index 3bd7adbce31..26b891ba4f1 100644 --- a/x-pack/filebeat/module/squid/log/test/access1.log-expected.json +++ b/x-pack/filebeat/module/squid/log/test/access1.log-expected.json @@ -21,6 +21,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "login.yahoo.com" + ], "related.ip": [ "209.73.177.115", "10.105.21.199" @@ -82,9 +85,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ - "207.58.145.61", - "10.105.21.199" + "10.105.21.199", + "207.58.145.61" ], "related.user": [ "badeyek" @@ -145,6 +151,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "10.105.21.199", "207.58.145.61" @@ -196,6 +205,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "10.105.21.199" ], @@ -208,8 +220,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_HIT", - "GET" + "GET", + "TCP_HIT" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "200", @@ -246,6 +258,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.google-analytics.com" + ], "related.ip": [ "10.105.21.199" ], @@ -307,6 +322,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "10.105.21.199", "207.58.145.61" @@ -320,8 +338,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -367,9 +385,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.google-analytics.com" + ], "related.ip": [ - "66.102.9.147", - "10.105.21.199" + "10.105.21.199", + "66.102.9.147" ], "related.user": [ "badeyek" @@ -380,8 +401,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -430,6 +451,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "207.58.145.61", "10.105.21.199" @@ -443,8 +467,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -493,9 +517,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ - "207.58.145.61", - "10.105.21.199" + "10.105.21.199", + "207.58.145.61" ], "related.user": [ "badeyek" @@ -556,6 +583,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "207.58.145.61", "10.105.21.199" @@ -569,8 +599,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -607,6 +637,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "10.105.21.199" ], @@ -619,8 +652,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_HIT" + "TCP_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -669,6 +702,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "as.casalemedia.com" + ], "related.ip": [ "10.105.21.199", "209.85.16.38" @@ -682,8 +718,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -726,6 +762,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.bc.yahoo.com" + ], "related.ip": [ "10.105.21.199", "68.142.213.132" @@ -738,8 +777,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "CONNECT" + "CONNECT", + "TCP_MISS" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -785,9 +824,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "impgb.tradedoubler.com" + ], "related.ip": [ - "217.212.240.172", - "10.105.21.199" + "10.105.21.199", + "217.212.240.172" ], "related.user": [ "badeyek" @@ -798,8 +840,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "302", @@ -848,9 +890,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "4.adbrite.com" + ], "related.ip": [ - "206.169.136.22", - "10.105.21.199" + "10.105.21.199", + "206.169.136.22" ], "related.user": [ "badeyek" @@ -861,8 +906,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -899,6 +944,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ "10.105.21.199" ], @@ -911,8 +959,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_HIT", - "GET" + "GET", + "TCP_HIT" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -961,9 +1009,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ - "10.105.21.199", - "207.58.145.61" + "207.58.145.61", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -974,8 +1025,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -1024,9 +1075,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.goonernews.com" + ], "related.ip": [ - "10.105.21.199", - "207.58.145.61" + "207.58.145.61", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -1037,8 +1091,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -1082,9 +1136,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "4.adbrite.com" + ], "related.ip": [ - "64.127.126.178", - "10.105.21.199" + "10.105.21.199", + "64.127.126.178" ], "related.user": [ "badeyek" @@ -1145,6 +1202,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "ff.connextra.com" + ], "related.ip": [ "213.160.98.161", "10.105.21.199" @@ -1208,6 +1268,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "dd.connextra.com" + ], "related.ip": [ "213.160.98.160", "10.105.21.199" @@ -1258,6 +1321,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "hi5.com" + ], "related.ip": [ "10.105.47.218" ], @@ -1270,8 +1336,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -1316,9 +1382,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "login.yahoo.com" + ], "related.ip": [ - "10.105.21.199", - "209.73.177.115" + "209.73.177.115", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -1328,8 +1397,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_MISS" + "TCP_MISS", + "CONNECT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -1366,6 +1435,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "update.messenger.yahoo.com" + ], "related.ip": [ "10.105.33.214" ], @@ -1378,8 +1450,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_DENIED" + "TCP_DENIED", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -1424,6 +1496,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "shttp.msg.yahoo.com" + ], "related.ip": [ "216.155.194.239", "10.105.33.214" @@ -1436,8 +1511,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "POST" + "POST", + "TCP_MISS" ], "rsa.misc.content_type": "text/plain", "rsa.misc.result_code": "200", @@ -1485,9 +1560,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "hi5.com" + ], "related.ip": [ - "204.13.51.238", - "10.105.47.218" + "10.105.47.218", + "204.13.51.238" ], "related.user": [ "nazsoau" @@ -1498,8 +1576,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -1548,6 +1626,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "hi5.com" + ], "related.ip": [ "10.105.47.218", "204.13.51.238" @@ -1561,8 +1642,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "200", @@ -1607,6 +1688,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "shttp.msg.yahoo.com" + ], "related.ip": [ "10.105.33.214", "216.155.194.239" @@ -1657,6 +1741,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "rms.adobe.com" + ], "related.ip": [ "10.105.37.58" ], @@ -1669,8 +1756,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -1707,6 +1794,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "images.hi5.com" + ], "related.ip": [ "10.105.47.218" ], @@ -1757,6 +1847,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "images.hi5.com" + ], "related.ip": [ "10.105.47.218" ], @@ -1769,8 +1862,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "304", @@ -1818,9 +1911,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "hi5.com" + ], "related.ip": [ - "10.105.47.218", - "204.13.51.238" + "204.13.51.238", + "10.105.47.218" ], "related.user": [ "nazsoau" @@ -1881,9 +1977,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "hi5.com" + ], "related.ip": [ - "204.13.51.238", - "10.105.47.218" + "10.105.47.218", + "204.13.51.238" ], "related.user": [ "nazsoau" @@ -1894,8 +1993,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "200", @@ -1940,6 +2039,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "shttp.msg.yahoo.com" + ], "related.ip": [ "216.155.194.239", "10.105.33.214" @@ -1952,8 +2054,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "POST" + "POST", + "TCP_MISS" ], "rsa.misc.content_type": "text/plain", "rsa.misc.result_code": "200", @@ -1996,9 +2098,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "insider.msg.yahoo.com" + ], "related.ip": [ - "68.142.194.14", - "10.105.33.214" + "10.105.33.214", + "68.142.194.14" ], "related.user": [ "adeolaegbedokun" @@ -2056,6 +2161,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "10.105.33.214", "68.142.219.132" @@ -2069,8 +2177,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -2115,6 +2223,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "shttp.msg.yahoo.com" + ], "related.ip": [ "216.155.194.239", "10.105.33.214" @@ -2127,8 +2238,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "POST", - "TCP_MISS" + "TCP_MISS", + "POST" ], "rsa.misc.content_type": "text/plain", "rsa.misc.result_code": "200", @@ -2172,9 +2283,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "address.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "209.191.93.51" + "209.191.93.51", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2235,6 +2349,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "fxfeeds.mozilla.org" + ], "related.ip": [ "63.245.209.21", "10.105.21.199" @@ -2294,9 +2411,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "insider.msg.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.231.252" + "68.142.231.252", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2307,8 +2427,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/xml", "rsa.misc.result_code": "200", @@ -2351,9 +2471,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "insider.msg.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.194.14" + "68.142.194.14", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2401,6 +2524,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.37.17" ], @@ -2412,8 +2538,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_DENIED" + "TCP_DENIED", + "CONNECT" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2450,6 +2576,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.37.17" ], @@ -2499,6 +2628,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.37.17" ], @@ -2547,6 +2679,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.37.17" ], @@ -2558,8 +2693,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "CONNECT" + "CONNECT", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2605,9 +2740,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -2618,8 +2756,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -2655,6 +2793,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.37.17" ], @@ -2666,8 +2807,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_DENIED" + "TCP_DENIED", + "CONNECT" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2713,9 +2854,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2726,8 +2870,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -2772,9 +2916,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "shttp.msg.yahoo.com" + ], "related.ip": [ - "216.155.194.239", - "10.105.33.214" + "10.105.33.214", + "216.155.194.239" ], "related.user": [ "adeolaegbedokun" @@ -2831,6 +2978,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "68.142.219.132", "10.105.33.214" @@ -2891,6 +3041,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "10.105.33.214", "68.142.219.132" @@ -2942,6 +3095,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.47.191" ], @@ -2953,8 +3109,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "POST", - "TCP_DENIED" + "TCP_DENIED", + "POST" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2991,6 +3147,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.47.191" ], @@ -3049,6 +3208,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "68.142.219.132", "10.105.33.214" @@ -3109,6 +3271,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "68.142.219.132", "10.105.33.214" @@ -3169,9 +3334,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -3229,9 +3397,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -3280,6 +3451,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "10.105.33.214" ], @@ -3330,6 +3504,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "10.105.33.214" ], @@ -3342,8 +3519,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -3380,6 +3557,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.i1.yimg.com" + ], "related.ip": [ "10.105.33.214" ], @@ -3392,8 +3572,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_HIT", - "GET" + "GET", + "TCP_HIT" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -3439,9 +3619,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "newsrss.bbc.co.uk" + ], "related.ip": [ - "10.105.21.199", - "212.58.226.33" + "212.58.226.33", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -3452,8 +3635,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_MISS", - "GET" + "GET", + "TCP_REFRESH_MISS" ], "rsa.misc.content_type": "application/xml", "rsa.misc.result_code": "200", @@ -3499,6 +3682,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "insider.msg.yahoo.com" + ], "related.ip": [ "68.142.231.252", "10.105.33.214" @@ -3550,6 +3736,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.ent1.yimg.com" + ], "related.ip": [ "10.105.33.214" ], @@ -3600,6 +3789,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.news1.yimg.com" + ], "related.ip": [ "10.105.33.214" ], @@ -3612,8 +3804,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_HIT" + "TCP_HIT", + "GET" ], "rsa.misc.content_type": "image/jpeg", "rsa.misc.result_code": "200", @@ -3659,6 +3851,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "68.142.219.132", "10.105.33.214" @@ -3721,9 +3916,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.news1.yimg.com" + ], "related.ip": [ - "10.105.33.214", - "213.160.98.159" + "213.160.98.159", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -3734,8 +3932,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/jpeg", "rsa.misc.result_code": "200", @@ -3781,9 +3979,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.music.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -3841,6 +4042,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.music.yahoo.com" + ], "related.ip": [ "10.105.33.214", "68.142.219.132" @@ -3901,9 +4105,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -3914,8 +4121,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -3952,6 +4159,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "natrocket.kmip.net" + ], "related.ip": [ "10.105.37.65" ], @@ -3964,8 +4174,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -4002,6 +4212,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "natrocket.kmip.net" + ], "related.ip": [ "10.105.37.65" ], @@ -4064,9 +4277,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.news1.yimg.com" + ], "related.ip": [ - "213.160.98.159", - "10.105.33.214" + "10.105.33.214", + "213.160.98.159" ], "related.user": [ "adeolaegbedokun" @@ -4124,6 +4340,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ "68.142.219.132", "10.105.33.214" @@ -4137,8 +4356,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "302", @@ -4184,9 +4403,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -4247,9 +4469,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.a2.yimg.com" + ], "related.ip": [ - "213.160.98.152", - "10.105.33.214" + "10.105.33.214", + "213.160.98.152" ], "related.user": [ "adeolaegbedokun" @@ -4260,8 +4485,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "application/x-shockwave-flash", "rsa.misc.result_code": "200", @@ -4307,9 +4532,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "radio.launch.yahoo.com" + ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -4365,6 +4593,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.bc.yahoo.com" + ], "related.ip": [ "10.105.33.214", "68.142.213.132" @@ -4423,9 +4654,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "insider.msg.yahoo.com" + ], "related.ip": [ - "68.142.194.14", - "10.105.33.214" + "10.105.33.214", + "68.142.194.14" ], "related.user": [ "adeolaegbedokun" @@ -4480,9 +4714,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "pclick.internal.yahoo.com" + ], "related.ip": [ - "216.109.124.55", - "10.105.33.214" + "10.105.33.214", + "216.109.124.55" ], "related.user": [ "adeolaegbedokun" @@ -4530,6 +4767,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "10.105.33.214" ], @@ -4592,6 +4832,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "10.105.33.214", "213.160.98.159" @@ -4605,8 +4848,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "304", @@ -4655,6 +4898,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "10.105.33.214", "213.160.98.159" @@ -4668,8 +4914,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -4714,6 +4960,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "login.yahoo.com" + ], "related.ip": [ "209.73.177.115", "10.105.21.199" @@ -4726,8 +4975,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_MISS" + "TCP_MISS", + "CONNECT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -4776,9 +5025,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ - "213.160.98.167", - "10.105.33.214" + "10.105.33.214", + "213.160.98.167" ], "related.user": [ "adeolaegbedokun" @@ -4839,9 +5091,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ - "10.105.33.214", - "213.160.98.159" + "213.160.98.159", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4852,8 +5107,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -4890,6 +5145,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "10.105.33.214" ], @@ -4902,8 +5160,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -4952,9 +5210,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ - "213.160.98.167", - "10.105.33.214" + "10.105.33.214", + "213.160.98.167" ], "related.user": [ "adeolaegbedokun" @@ -5015,6 +5276,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "213.160.98.159", "10.105.33.214" @@ -5078,6 +5342,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "a1568.g.akamai.net" + ], "related.ip": [ "10.105.33.214", "213.160.98.167" @@ -5091,8 +5358,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -5129,6 +5396,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "www.google.com" + ], "related.ip": [ "10.105.37.180" ], @@ -5179,6 +5449,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.mcafee.com" + ], "related.ip": [ "10.105.47.191" ], @@ -5191,8 +5464,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -5236,9 +5509,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "launch.adserver.yahoo.com" + ], "related.ip": [ - "10.105.33.214", - "216.109.125.112" + "216.109.125.112", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -5249,8 +5525,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -5296,6 +5572,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "uk.f250.mail.yahoo.com" + ], "related.ip": [ "217.12.10.96", "10.105.21.199" @@ -5346,6 +5625,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "login.live.com" + ], "related.ip": [ "10.105.37.180" ], @@ -5407,9 +5689,12 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.js2.yimg.com" + ], "related.ip": [ - "10.105.21.199", - "213.160.98.169" + "213.160.98.169", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -5458,6 +5743,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.js1.yimg.com" + ], "related.ip": [ "10.105.21.199" ], @@ -5520,6 +5808,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.js2.yimg.com" + ], "related.ip": [ "10.105.21.199", "213.160.98.169" @@ -5533,8 +5824,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "application/x-javascript", "rsa.misc.result_code": "200", @@ -5571,6 +5862,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.js1.yimg.com" + ], "related.ip": [ "10.105.21.199" ], @@ -5621,6 +5915,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.js2.yimg.com" + ], "related.ip": [ "10.105.21.199" ], @@ -5671,6 +5968,9 @@ "observer.product": "Proxy", "observer.type": "Proxies", "observer.vendor": "Squid", + "related.hosts": [ + "us.i1.yimg.com" + ], "related.ip": [ "10.105.21.199" ], diff --git a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.yml b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.yml index 226b7f9c6c2..01ed5accbe6 100644 --- a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.yml +++ b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.yml @@ -333,6 +333,11 @@ processors: field: file.x509.not_before value: '{{tls.server.not_before}}' ignore_empty_value: true + - append: + field: related.hosts + value: '{{url.domain}}' + if: ctx.url?.domain != null && ctx.url?.domain != '' + allow_duplicates: false - remove: field: - suricata.eve.app_proto diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json index b7bc49cb9e0..68412b504dc 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json @@ -41,6 +41,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.net" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -118,6 +121,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.net" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -195,6 +201,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.net" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -272,6 +281,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.org" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -349,6 +361,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.org" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -426,6 +441,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "example.org" + ], "related.ip": [ "192.168.1.146", "93.184.216.34" @@ -503,6 +521,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "security.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.88.152" @@ -580,6 +601,9 @@ "network.packets": 7, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -657,6 +681,9 @@ "network.packets": 11, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -734,6 +761,9 @@ "network.packets": 126, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "security.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.88.152" @@ -811,6 +841,9 @@ "network.packets": 185, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "security.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.88.152" @@ -888,6 +921,9 @@ "network.packets": 377, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "security.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.88.152" @@ -965,6 +1001,9 @@ "network.packets": 131, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1042,6 +1081,9 @@ "network.packets": 210, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1119,6 +1161,9 @@ "network.packets": 412, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1196,6 +1241,9 @@ "network.packets": 504, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1273,6 +1321,9 @@ "network.packets": 916, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1350,6 +1401,9 @@ "network.packets": 921, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1426,6 +1480,9 @@ "network.packets": 1503, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" @@ -1502,6 +1559,9 @@ "network.packets": 1654, "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "archive.ubuntu.com" + ], "related.ip": [ "192.168.1.146", "91.189.91.23" diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json index cbc0f39eb76..5d113c8d370 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json @@ -130,6 +130,9 @@ "network.community_id": "1:gjMiDGtS5SVvdwzjjQdAKGBrDA4=", "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "192.168.86.28" + ], "related.ip": [ "192.168.86.85", "192.168.86.28" @@ -182,6 +185,9 @@ "network.community_id": "1:XhhAO/Twj86+bD+1fV8FnpLIEDs=", "network.protocol": "http", "network.transport": "tcp", + "related.hosts": [ + "192.168.86.28" + ], "related.ip": [ "192.168.86.28", "192.168.86.85" diff --git a/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml b/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml index a735b86e766..b888ca3989d 100644 --- a/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml +++ b/x-pack/filebeat/module/symantec/endpointprotection/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml b/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml index 26f7511d6c8..cf257ba5d64 100644 --- a/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml +++ b/x-pack/filebeat/module/symantec/endpointprotection/ingest/pipeline.yml @@ -53,6 +53,26 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' + - append: + field: related.hosts + value: '{{host.hostname}}' + allow_duplicates: false + if: ctx?.host?.hostname != null && ctx.host?.hostname != '' + - append: + field: related.hosts + value: '{{source.address}}' + allow_duplicates: false + if: ctx?.source?.address != null && ctx.source?.address != '' + - append: + field: related.hosts + value: '{{destination.address}}' + allow_duplicates: false + if: ctx?.destination?.address != null && ctx.destination?.address != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json index c35bd2dbb66..9b9183fe35a 100644 --- a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json +++ b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json @@ -12,6 +12,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "exe7309.internal.local" + ], "rsa.internal.event_desc": "rsitam", "rsa.internal.messageid": "302776834", "rsa.misc.event_source": "reprehe", @@ -41,6 +44,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "llam2073.internal.localdomain", + "sitas4259.mail.corp" + ], "rsa.internal.event_desc": "aboreetd", "rsa.internal.messageid": "303235083", "rsa.misc.event_source": "iumto", @@ -72,6 +79,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "olupt3702.www.localhost" + ], "rsa.internal.event_desc": "colabor", "rsa.internal.messageid": "302450432", "rsa.misc.event_source": "tectobe", @@ -99,6 +109,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "onse254.www5.localdomain", + "tat6349.internal.lan" + ], "rsa.db.index": "uiineavo", "rsa.internal.event_desc": "Invalid log record", "rsa.internal.messageid": "Invalid", @@ -146,6 +160,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "mdolore2062.mail.host" + ], "rsa.internal.event_desc": "tutla", "rsa.internal.messageid": "302449409", "rsa.misc.event_source": "den", @@ -175,6 +192,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "nisi6901.mail.home" + ], "related.user": [ "rem" ], @@ -208,6 +228,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "dutp6197.www.test" + ], "rsa.internal.event_desc": "tconsect", "rsa.internal.messageid": "303235076", "rsa.misc.event_source": "siut", @@ -237,6 +260,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "umSe1918.local", + "nBCSedut1502.www5.example" + ], "rsa.internal.event_desc": "oditautf", "rsa.internal.messageid": "302449410", "rsa.misc.event_source": "fugia", @@ -270,6 +297,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "olupt2189.lan", + "temporin7150.mail.local" + ], "rsa.internal.event_desc": "rem", "rsa.internal.messageid": "302449169", "rsa.misc.event_source": "rationev", @@ -303,6 +334,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "emq6633.domain" + ], "related.user": [ "tinvolup" ], @@ -336,6 +370,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "Except6889.www.corp" + ], "rsa.internal.event_desc": "umq", "rsa.internal.messageid": "302452736", "rsa.misc.event_source": "asper", @@ -363,6 +400,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "quatD1370.invalid" + ], "rsa.internal.event_desc": "veniamqu", "rsa.internal.messageid": "302452802", "rsa.misc.event_source": "iruredol", @@ -392,6 +432,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "iatqu6203.mail.corp", + "quaeab2653.mail.localdomain" + ], "rsa.db.index": "itat", "rsa.internal.event_desc": "aco", "rsa.internal.messageid": "303235080", @@ -428,6 +472,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "redol124.mail.invalid" + ], "rsa.internal.event_desc": "orinrep", "rsa.internal.messageid": "302450688", "rsa.misc.event_source": "ctetu", @@ -455,6 +502,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "enim5999.mail.localhost" + ], "rsa.internal.event_desc": "orroquis", "rsa.internal.messageid": "303169538", "rsa.misc.event_source": "iame", @@ -484,6 +534,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "reseosqu1629.mail.lan", + "rsitvolu3596.www.test" + ], "rsa.internal.event_desc": "gelitsed", "rsa.internal.messageid": "302449410", "rsa.misc.event_source": "adm", @@ -515,6 +569,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "tan3170.api.example" + ], "rsa.internal.event_desc": "dolorsi", "rsa.internal.messageid": "303235081", "rsa.misc.checksum": "dtemp", @@ -543,6 +600,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "eseruntm4247.mail.local", + "magnaal5792.www5.domain" + ], "rsa.counters.dclass_c1": 7519, "rsa.counters.dclass_c1_str": "Number of Virus Cleaned.", "rsa.internal.event_desc": "Cleaned up downloaded content.", @@ -571,6 +632,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "itatio6735.api.example" + ], "rsa.internal.event_desc": "rumSec", "rsa.internal.messageid": "302452801", "rsa.misc.event_source": "rsin", @@ -598,6 +662,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "radip163.mail.invalid" + ], "rsa.internal.event_desc": "miurerep", "rsa.internal.messageid": "302449166", "rsa.misc.event_source": "ainc", @@ -632,10 +699,14 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "vol866.api.domain", + "bore5546.www.local" + ], "related.ip": [ "10.7.164.113", - "10.207.125.114", - "10.175.83.138" + "10.175.83.138", + "10.207.125.114" ], "related.user": [ "remip" @@ -679,6 +750,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "inc5923.www.test", + "tatemseq5797.home" + ], "rsa.internal.event_desc": "eufugi", "rsa.internal.messageid": "302452817", "rsa.misc.event_source": "oremip", @@ -716,9 +791,13 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "enima7673.api.localhost", + "sequ6424.www.invalid" + ], "related.ip": [ - "10.217.91.49", - "10.139.207.36" + "10.139.207.36", + "10.217.91.49" ], "related.user": [ "lumqui" @@ -766,6 +845,10 @@ "observer.vendor": "Symantec", "process.parent.name": "mquis", "process.ppid": 5040, + "related.hosts": [ + "tnulapa7580.www.domain", + "madminim6826.www.host" + ], "related.ip": [ "10.249.243.41" ], @@ -820,6 +903,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ici182.invalid", + "caecat4678.www.home" + ], "rsa.internal.event_desc": "rem", "rsa.internal.messageid": "302449415", "rsa.misc.event_source": "quisn", @@ -851,6 +938,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "beat2952.internal.localhost" + ], "rsa.internal.event_desc": "iarchite", "rsa.internal.messageid": "302449410", "rsa.misc.event_source": "qua", @@ -880,6 +970,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ured3428.www.corp", + "uames7663.internal.local" + ], "rsa.internal.event_desc": "taspe", "rsa.internal.messageid": "302776321", "rsa.misc.event_source": "oreeu", @@ -911,6 +1005,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "velillum6639.www5.local" + ], "rsa.internal.event_desc": "itinvo", "rsa.internal.messageid": "302449153", "rsa.misc.event_source": "Mal", @@ -940,6 +1037,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "dictasun3408.internal.invalid", + "onoru5767.internal.domain" + ], "rsa.internal.event_desc": "uam", "rsa.internal.messageid": "303235079", "rsa.misc.event_source": "dipisciv", @@ -1002,6 +1103,11 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "uipe6805.www5.domain", + "atisu6579.test", + "tqui1142.www5.domain" + ], "related.ip": [ "10.209.205.25", "10.185.64.46" @@ -1091,9 +1197,14 @@ "observer.type": "Anti-Virus", "observer.vendor": "Symantec", "observer.version": "1.7457", + "related.hosts": [ + "udexerci6630.mail.test", + "isiut4530.localdomain", + "deomn904.www.home" + ], "related.ip": [ - "10.35.89.51", - "10.202.55.203" + "10.202.55.203", + "10.35.89.51" ], "related.user": [ "Quis" @@ -1149,6 +1260,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "niamqui7696.mail.test", + "taliqu701.www.localhost" + ], "rsa.internal.event_desc": "Traffic Redirection disabled.", "rsa.internal.messageid": "Traffic", "rsa.network.alias_host": [ @@ -1181,6 +1296,10 @@ "observer.vendor": "Symantec", "process.parent.name": "onnu", "process.ppid": 724, + "related.hosts": [ + "ngelits6213.internal.test", + "lumd4298.mail.localdomain" + ], "related.ip": [ "10.139.89.148" ], @@ -1263,9 +1382,13 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "tuserror810.www5.corp", + "uptate5787.api.local" + ], "related.ip": [ - "10.87.92.95", - "10.247.21.74" + "10.247.21.74", + "10.87.92.95" ], "related.user": [ "Sedutper" @@ -1313,6 +1436,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ruredolo7392.internal.host", + "mipsu3757.www5.home" + ], "rsa.db.index": "oris", "rsa.internal.event_desc": "labor", "rsa.internal.messageid": "303235080", @@ -1365,6 +1492,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ntmo4076.lan" + ], "rsa.internal.event_desc": "doconse", "rsa.internal.messageid": "302449158", "rsa.misc.event_source": "ationula", @@ -1414,6 +1544,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "amni48.internal.localdomain", + "alo6036.www5.local" + ], "rsa.internal.event_desc": "ita", "rsa.internal.messageid": "302710785", "rsa.misc.event_source": "mdolore", @@ -1447,6 +1581,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "tenatus4129.www.local", + "uredo4613.home" + ], "rsa.internal.event_desc": "olupta", "rsa.internal.messageid": "303235082", "rsa.misc.event_source": "upi", @@ -1498,6 +1636,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "mini3181.api.test" + ], "rsa.internal.event_desc": "mwrit", "rsa.internal.messageid": "302452819", "rsa.misc.event_source": "ommodoc", @@ -1533,6 +1674,10 @@ "observer.vendor": "Symantec", "observer.version": "1.3638", "process.name": "remap", + "related.hosts": [ + "rsitam2337.mail.localdomain", + "iduntu7302.www.invalid" + ], "related.ip": [ "10.8.143.229" ], @@ -1557,8 +1702,8 @@ "rsa.misc.version": "1.3638", "rsa.misc.virusname": "isqu", "rsa.network.alias_host": [ - "rsitam2337.mail.localdomain", - "assit1598.www5.invalid" + "assit1598.www5.invalid", + "rsitam2337.mail.localdomain" ], "rsa.network.domain": "ema7531.api.example", "rsa.threat.threat_category": "isqu", @@ -1589,6 +1734,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "equu7361.www5.localdomain" + ], "rsa.internal.event_desc": "pta", "rsa.internal.messageid": "302449178", "rsa.misc.event_source": "non", @@ -1623,6 +1771,10 @@ "observer.vendor": "Symantec", "process.parent.name": "ipsum", "process.ppid": 885, + "related.hosts": [ + "uisno4545.www5.corp", + "iono5777.invalid" + ], "related.ip": [ "10.137.5.67" ], @@ -1726,6 +1878,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "adminima6097.corp", + "agnamali3222.example" + ], "related.ip": [ "10.66.203.117", "10.92.93.236" @@ -1777,6 +1933,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "equ2353.internal.local", + "eratv6521.example" + ], "rsa.internal.event_desc": "dolorsi", "rsa.internal.messageid": "302452807", "rsa.misc.event_source": "tlaboree", @@ -1810,6 +1970,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "bori7611.invalid", + "iset1992.internal.example" + ], "rsa.internal.event_desc": "imadmini", "rsa.internal.messageid": "302776321", "rsa.misc.event_source": "ffic", @@ -1860,6 +2024,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ntin2655.www.localdomain" + ], "rsa.internal.event_desc": "epo", "rsa.internal.messageid": "302449413", "rsa.misc.event_source": "itasper", @@ -1887,6 +2054,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "siuta395.home" + ], "rsa.internal.event_desc": "iumdolor", "rsa.internal.messageid": "302449414", "rsa.misc.event_source": "fugiat", @@ -1914,6 +2084,9 @@ "observer.product": "oluptate", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "umdolore5014.api.lan" + ], "rsa.internal.event_desc": "Configuration Change", "rsa.internal.messageid": "Configuration", "rsa.misc.severity": "low", @@ -1939,6 +2112,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "tisund4302.www5.local", + "vel1911.lan" + ], "related.ip": [ "10.147.225.53" ], @@ -2032,6 +2209,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "evelites2448.www.host", + "quisnost7124.api.domain" + ], "rsa.internal.event_desc": "odtem", "rsa.internal.messageid": "303169540", "rsa.misc.event_source": "uidexea", @@ -2076,6 +2257,11 @@ "observer.type": "Anti-Virus", "observer.vendor": "Symantec", "observer.version": "1.132", + "related.hosts": [ + "iatquovo4868.test", + "madmi2948.internal.lan", + "edi6108.internal.domain" + ], "related.ip": [ "10.72.200.11", "10.132.171.142" @@ -2137,6 +2323,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "reverita794.mail.domain" + ], "related.user": [ "nis" ], @@ -2170,6 +2359,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "lillumq4387.www5.localhost" + ], "rsa.internal.event_desc": "sse", "rsa.internal.messageid": "302452743", "rsa.misc.event_source": "turExce", @@ -2199,6 +2391,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ipi563.api.lan" + ], "related.user": [ "anti" ], @@ -2232,6 +2427,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "uptatemU1147.mail.corp", + "mqu3327.internal.host" + ], "rsa.internal.event_desc": "Connection reset.", "rsa.internal.messageid": "Connection", "rsa.network.alias_host": [ @@ -2260,6 +2459,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "emp42.mail.test", + "ecatcupi4759.internal.local" + ], "rsa.internal.event_desc": "ritati", "rsa.internal.messageid": "302452736", "rsa.misc.event_source": "tenb", @@ -2312,6 +2515,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ipsu7538.www5.host" + ], "rsa.internal.event_desc": "squa", "rsa.internal.messageid": "302450944", "rsa.misc.event_source": "lamc", @@ -2368,9 +2574,13 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "iusmo5734.internal.invalid", + "dita2048.www5.home" + ], "related.ip": [ - "10.40.133.90", - "10.171.13.85" + "10.171.13.85", + "10.40.133.90" ], "related.user": [ "bor" @@ -2441,6 +2651,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ngelits2743.www5.host", + "inrepr7369.www.domain" + ], "rsa.internal.event_desc": "tatemac", "rsa.internal.messageid": "302452816", "rsa.misc.event_source": "lore", @@ -2474,6 +2688,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "olupt717.invalid", + "alorum1804.mail.test" + ], "rsa.internal.event_desc": "ano", "rsa.internal.messageid": "302452808", "rsa.misc.event_source": "psum", @@ -2507,6 +2725,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "queporr7029.internal.test" + ], "related.user": [ "unti" ], @@ -2569,9 +2790,13 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "upidat1328.internal.localhost", + "urExcep6087.www5.localhost" + ], "related.ip": [ - "10.31.231.57", - "10.155.163.6" + "10.155.163.6", + "10.31.231.57" ], "related.user": [ "norumetM" @@ -2641,6 +2866,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "tesseci33.internal.example" + ], "rsa.internal.event_desc": "nost", "rsa.internal.messageid": "302452816", "rsa.misc.event_source": "met", @@ -2668,6 +2896,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "alo7567.www5.test" + ], "rsa.internal.event_desc": "quisnos", "rsa.internal.messageid": "302452736", "rsa.misc.event_source": "proident", @@ -2695,6 +2926,9 @@ "observer.type": "Anti-Virus", "observer.vendor": "Symantec", "process.name": "sumq.exe", + "related.hosts": [ + "idest4209.api.domain" + ], "rsa.internal.event_desc": "The process can not lock the process status table", "rsa.internal.messageid": "275", "rsa.misc.reference_id": "275", @@ -2730,9 +2964,14 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "exer3621.www5.test", + "tisetqua6007.api.home", + "its1301.www.test" + ], "related.ip": [ - "10.216.134.62", - "10.134.6.246" + "10.134.6.246", + "10.216.134.62" ], "related.user": [ "ntexpl" @@ -2789,6 +3028,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ventorev7571.www5.corp", + "Remote:" + ], "related.ip": [ "10.202.96.232" ], @@ -2832,6 +3075,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "umSectio5136.www.local", + "untexpli391.internal.domain" + ], "rsa.internal.event_desc": "ipitlabo", "rsa.internal.messageid": "302449156", "rsa.misc.event_source": "num", @@ -2874,6 +3121,11 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "quide2790.mail.invalid", + "eniamqu1863.api.lan", + "quipex2615.www5.localhost" + ], "related.ip": [ "10.56.95.160", "10.29.149.77" @@ -2941,6 +3193,11 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ugia146.www5.corp", + "tionul7555.www5.lan", + "remipsum5485.api.local" + ], "related.ip": [ "10.173.98.74", "10.70.185.238" @@ -2998,6 +3255,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ilmoles4582.api.lan" + ], "related.user": [ "dolor" ], @@ -3031,6 +3291,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "giatquo3267.www.lan", + "quiado6095.mail.localhost" + ], "rsa.internal.event_desc": "Connected to Management Server", "rsa.internal.messageid": "Connected", "rsa.network.alias_host": [ @@ -3059,6 +3323,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "odite7850.internal.corp", + "cidun7605.www5.example" + ], "related.ip": [ "10.201.112.171" ], @@ -3111,6 +3379,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "ssitasp7492.test" + ], "rsa.internal.event_desc": "eserun", "rsa.internal.messageid": "302448900", "rsa.misc.event_source": "ssitaspe", @@ -3140,6 +3411,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "estq2131.api.localdomain", + "rem6392.internal.domain" + ], "rsa.internal.event_desc": "did", "rsa.internal.messageid": "302452802", "rsa.misc.event_source": "upt", @@ -3173,6 +3448,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "giatq7007.www.domain", + "upi3.www.home" + ], "rsa.internal.event_desc": "caecatc", "rsa.internal.messageid": "303235079", "rsa.misc.event_source": "iquaUt", @@ -3207,9 +3486,13 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "itess2258.api.lan", + "ianonnu4387.www.domain" + ], "related.ip": [ - "10.59.140.108", - "10.90.66.238" + "10.90.66.238", + "10.59.140.108" ], "related.user": [ "nulap" @@ -3270,6 +3553,11 @@ "observer.type": "Anti-Virus", "observer.vendor": "Symantec", "observer.version": "1.6400", + "related.hosts": [ + "epteur5858.www5.local", + "rin5257.www5.test", + "ess3012.mail.test" + ], "related.ip": [ "10.38.136.160", "10.45.116.216" @@ -3326,6 +3614,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "aed3193.api.lan" + ], "rsa.internal.event_desc": "equa", "rsa.internal.messageid": "302449409", "rsa.misc.event_source": "sunti", @@ -3373,6 +3664,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "rumSec5271.home" + ], "rsa.internal.event_desc": "unt", "rsa.internal.messageid": "302449166", "rsa.misc.event_source": "evolupt", @@ -3402,6 +3696,9 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "volu7499.www5.localhost" + ], "related.user": [ "sedqui" ], @@ -3437,6 +3734,10 @@ "observer.product": "Endpoint", "observer.type": "Anti-Virus", "observer.vendor": "Symantec", + "related.hosts": [ + "oNem5850.www.example", + "gnama2349.mail.domain" + ], "rsa.internal.event_desc": "ccusan", "rsa.internal.messageid": "302449409", "rsa.misc.event_source": "ntiu", diff --git a/x-pack/filebeat/module/tomcat/log/config/input.yml b/x-pack/filebeat/module/tomcat/log/config/input.yml index 256f657133f..d9f1e4a1452 100644 --- a/x-pack/filebeat/module/tomcat/log/config/input.yml +++ b/x-pack/filebeat/module/tomcat/log/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/tomcat/log/ingest/pipeline.yml b/x-pack/filebeat/module/tomcat/log/ingest/pipeline.yml index 9983081e838..64e1d82943a 100644 --- a/x-pack/filebeat/module/tomcat/log/ingest/pipeline.yml +++ b/x-pack/filebeat/module/tomcat/log/ingest/pipeline.yml @@ -53,6 +53,21 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{rsa.web.fqdn}}' + allow_duplicates: false + if: ctx?.rsa?.web?.fqdn != null && ctx.rsa?.web?.fqdn != '' + - append: + field: related.hosts + value: '{{rsa.web.web_ref_domain}}' + allow_duplicates: false + if: ctx?.rsa?.web?.web_ref_domain != null && ctx.rsa?.web?.web_ref_domain != '' + - append: + field: related.hosts + value: '{{url.domain}}' + allow_duplicates: false + if: ctx?.url?.domain != null && ctx.url?.domain != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/tomcat/log/test/generated.log-expected.json b/x-pack/filebeat/module/tomcat/log/test/generated.log-expected.json index eb9298f3d1b..51d46cc753a 100644 --- a/x-pack/filebeat/module/tomcat/log/test/generated.log-expected.json +++ b/x-pack/filebeat/module/tomcat/log/test/generated.log-expected.json @@ -14,6 +14,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/illumqui/ventore.html?min=ite#utl", + "mail.example.net", + "example.com" + ], "related.ip": [ "10.251.224.219" ], @@ -68,6 +73,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.net/mdolo/mqui.htm?sumdo=litesse#orev", + "mail.example.com", + "www5.example.net" + ], "related.ip": [ "10.196.153.12" ], @@ -121,6 +131,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/tetur/idolor.html?ntex=eius#luptat", + "www.example.com", + "internal.example.com" + ], "related.ip": [ "10.156.194.38" ], @@ -177,6 +192,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.org/nci/ofdeFin.gif?amco=exe#iatu", + "mail.example.com", + "www5.example.org" + ], "related.ip": [ "10.196.118.192" ], @@ -231,6 +251,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/aqui/radipis.jpg?llumd=enatuse#magn", + "internal.example.net", + "internal.example.com" + ], "related.ip": [ "10.246.209.145" ], @@ -285,6 +310,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/omnis/antium.txt?lupta=iusmodt#doloreeu", + "www5.example.org", + "internal.example.com" + ], "related.ip": [ "10.114.191.225" ], @@ -340,6 +370,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.net/uidolore/niamqu.gif?iat=tevelit#nsequat", + "api.example.com", + "www5.example.net" + ], "related.ip": [ "10.38.77.13" ], @@ -397,6 +432,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/idexea/riat.txt?tvol=moll#tatione", + "mail.example.org", + "www.example.org" + ], "related.ip": [ "10.11.201.109" ], @@ -453,6 +493,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.org/toccae/tatno.gif?taliqu=temUten#ccusan", + "example.org", + "api.example.org" + ], "related.ip": [ "10.182.166.181" ], @@ -507,6 +552,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/atuse/ddoeiu.gif?idolore=onse#liq", + "internal.example.com", + "mail.example.net" + ], "related.ip": [ "10.185.126.247" ], @@ -560,6 +610,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/idestla/Nemoeni.htm?taed=lup#remeumf", + "mail.example.net", + "example.com" + ], "related.ip": [ "10.72.114.23" ], @@ -617,6 +672,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/nimadmin/ditautfu.html?lpa=entsu#dun", + "internal.example.net", + "example.net" + ], "related.ip": [ "10.129.241.147" ], @@ -674,6 +734,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/ono/stru.jpg?emaperi=tame#tinvol", + "internal.example.net", + "www5.example.com" + ], "related.ip": [ "10.185.101.76" ], @@ -730,6 +795,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/tion/eataev.htm?uiineavo=tisetq#irati", + "www.example.org", + "example.net" + ], "related.ip": [ "10.57.170.140" ], @@ -784,6 +854,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/isno/taliq.htm?nnu=dolo#Loremip", + "internal.example.net", + "internal.example.com" + ], "related.ip": [ "10.33.153.47" ], @@ -839,6 +914,10 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.net/mdolore/rQuisau.gif?iavolu=den#tutla", + "internal.example.net" + ], "related.ip": [ "10.116.104.101" ], @@ -895,6 +974,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/oidentsu/atiset.jpg?ntor=lpaqui#sitame", + "example.com", + "internal.example.com" + ], "related.ip": [ "10.202.194.67" ], @@ -950,6 +1034,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/etconse/tincu.txt?lit=asun#estia", + "www.example.com", + "www5.example.com" + ], "related.ip": [ "10.153.111.103" ], @@ -1006,6 +1095,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.org/eriamea/amre.htm?magni=pisciv#iquidex", + "internal.example.net", + "www5.example.org" + ], "related.ip": [ "10.52.186.29" ], @@ -1061,6 +1155,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/iutali/fdeFi.jpg?liquide=etdol#uela", + "example.net", + "www.example.org" + ], "related.ip": [ "10.209.182.237" ], @@ -1118,6 +1217,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/itatione/isnis.html?oluptate=issus#osamn", + "api.example.org", + "mail.example.net" + ], "related.ip": [ "10.63.194.87" ], @@ -1174,6 +1278,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/emvel/tmollita.htm?numqua=veni#eveli", + "www5.example.org", + "www.example.org" + ], "related.ip": [ "10.62.191.18" ], @@ -1228,6 +1337,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/nisi/dant.txt?ecte=tinvolu#iurer", + "example.org", + "example.net" + ], "related.ip": [ "10.238.164.29" ], @@ -1282,6 +1396,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/sintocc/tlabor.txt?tDuisaut=oinBC#quameius", + "example.com", + "internal.example.com" + ], "related.ip": [ "10.155.230.17" ], @@ -1337,6 +1456,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/officiad/itam.html?madmi=tur#roi", + "mail.example.net", + "example.net" + ], "related.ip": [ "10.102.229.102" ], @@ -1394,6 +1518,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.org/tor/qui.txt?eavolup=fugiatn#docon", + "www5.example.org", + "mail.example.org" + ], "related.ip": [ "10.194.14.7" ], @@ -1450,6 +1579,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.net/roid/inibusB.jpg?Nemoenim=squirati#Sedutp", + "example.com", + "api.example.net" + ], "related.ip": [ "10.99.0.226" ], @@ -1504,6 +1638,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/str/idolore.txt?eetdolo=cteturad#untut", + "api.example.org", + "www.example.net" + ], "related.ip": [ "10.107.174.213" ], @@ -1559,6 +1698,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.org/iscinge/ofdeFini.jpg?molli=velitse#oditem", + "www.example.org", + "mail.example.org" + ], "related.ip": [ "10.84.25.23" ], @@ -1615,6 +1759,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/epre/tobeata.html?quia=iduntu#idestlab", + "api.example.com", + "www.example.org" + ], "related.ip": [ "10.193.143.108" ], @@ -1670,6 +1819,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/mexe/its.htm?ice=oles#edic", + "example.org", + "example.com" + ], "related.ip": [ "10.190.51.22" ], @@ -1727,6 +1881,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.com/velitess/naali.htm?nre=veli#volupta", + "www5.example.com", + "www.example.com" + ], "related.ip": [ "10.194.90.130" ], @@ -1779,6 +1938,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/xeacomm/cinge.txt?apariat=vitaedi#lorsita", + "internal.example.com", + "www.example.org" + ], "related.ip": [ "10.10.213.83" ], @@ -1834,6 +1998,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.org/texpli/exeacom.jpg?rita=esseci#tametcon", + "mail.example.net", + "api.example.org" + ], "related.ip": [ "10.52.125.9" ], @@ -1890,6 +2059,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.net/ibusBon/ven.gif?nsequat=doloreme#dun", + "www5.example.org", + "api.example.net" + ], "related.ip": [ "10.19.17.202" ], @@ -1945,6 +2119,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.org/oconsequ/edquiac.gif?preh=ercit#etMal", + "api.example.com", + "mail.example.org" + ], "related.ip": [ "10.195.64.5" ], @@ -2002,6 +2181,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.com/llamc/nte.htm?utali=porinc#tetur", + "mail.example.com", + "internal.example.com" + ], "related.ip": [ "10.209.77.194" ], @@ -2058,6 +2242,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/ites/isetq.gif?nisiut=tur#avolupt", + "mail.example.org", + "example.net" + ], "related.ip": [ "10.168.6.90" ], @@ -2112,6 +2301,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/acommod/itsedd.html?admin=stenatu#inibu", + "api.example.org", + "mail.example.com" + ], "related.ip": [ "10.89.137.238" ], @@ -2166,6 +2360,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.org/Nequepor/eirure.htm?idid=tesse#sequat", + "www5.example.net", + "example.org" + ], "related.ip": [ "10.246.61.213" ], @@ -2221,6 +2420,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/tanimi/rumSecti.jpg?emporain=ntiumto#umetMalo", + "www5.example.net", + "www.example.org" + ], "related.ip": [ "10.117.44.138" ], @@ -2277,6 +2481,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/temUt/ptassita.gif?uamnihi=risnis#uov", + "www.example.net", + "example.net" + ], "related.ip": [ "10.69.30.196" ], @@ -2329,6 +2538,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.com/dictasun/abore.txt?modocon=ipsu#ntNeq", + "example.org", + "api.example.com" + ], "related.ip": [ "10.135.91.88" ], @@ -2384,6 +2598,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/Sedutpe/prehen.html?rcit=aecatcup#olabor", + "api.example.org", + "example.net" + ], "related.ip": [ "10.81.45.174" ], @@ -2440,6 +2659,10 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/umetMal/asper.htm?metcons=itasper#uae", + "www.example.org" + ], "related.ip": [ "10.87.179.233" ], @@ -2494,6 +2717,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.net/mquisn/queips.gif?emUte=molestia#quir", + "example.com", + "api.example.net" + ], "related.ip": [ "10.198.57.130" ], @@ -2548,6 +2776,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/yCic/nder.jpg?itanim=nesciun#saqu", + "www.example.org", + "www.example.net" + ], "related.ip": [ "10.218.0.197" ], @@ -2603,6 +2836,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/ecatcupi/uamei.html?nreprehe=onse#olorem", + "example.com", + "mail.example.com" + ], "related.ip": [ "10.123.199.198" ], @@ -2660,6 +2898,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.net/ection/roquisqu.html?ceroinB=nim#utaliqu", + "example.org", + "internal.example.net" + ], "related.ip": [ "10.29.119.245" ], @@ -2717,6 +2960,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/iutali/itat.txt?Finibus=radi#xeacom", + "www.example.org", + "mail.example.net" + ], "related.ip": [ "10.130.175.17" ], @@ -2773,6 +3021,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/lmolesti/apariatu.htm?moe=msequ#uat", + "internal.example.org", + "mail.example.net" + ], "related.ip": [ "10.166.90.130" ], @@ -2828,6 +3081,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.org/ratv/alorum.jpg?tali=BCS#qui", + "internal.example.org", + "api.example.org" + ], "related.ip": [ "10.248.111.207" ], @@ -2884,6 +3142,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.net/gitse/ugitse.jpg?tvolup=tdolore#ventore", + "api.example.net", + "internal.example.net" + ], "related.ip": [ "10.185.37.32" ], @@ -2938,6 +3201,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.org/pisc/urEx.html?rautod=olest#eataev", + "internal.example.com", + "example.org" + ], "related.ip": [ "10.5.194.202" ], @@ -2993,6 +3261,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/aconse/prehe.gif?diduntu=eiusmod#itation", + "www.example.org", + "www5.example.com" + ], "related.ip": [ "10.183.34.1" ], @@ -3049,6 +3322,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/reetdolo/rationev.html?reetdol=uelauda#ema", + "internal.example.com", + "mail.example.net" + ], "related.ip": [ "10.101.163.40" ], @@ -3104,6 +3382,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/mUteni/quira.htm?ore=tation#loinve", + "internal.example.com", + "www5.example.com" + ], "related.ip": [ "10.216.188.152" ], @@ -3160,6 +3443,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.org/setquas/minim.gif?tutlabor=reseosq#gna", + "mail.example.net", + "www5.example.org" + ], "related.ip": [ "10.94.140.77" ], @@ -3212,6 +3500,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.com/laudanti/umiurer.txt?rsitvolu=mnisi#usmo", + "mail.example.org", + "www.example.com" + ], "related.ip": [ "10.223.205.204" ], @@ -3267,6 +3560,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.org/ici/nisiuta.jpg?itae=dtempo#atnula", + "example.com", + "mail.example.org" + ], "related.ip": [ "10.85.137.156" ], @@ -3324,6 +3622,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/eseruntm/lpaquiof.html?magnaal=uscip#umS", + "www5.example.net", + "mail.example.com" + ], "related.ip": [ "10.12.54.142" ], @@ -3380,6 +3683,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/labori/porai.gif?utali=sed#xeac", + "internal.example.org", + "example.net" + ], "related.ip": [ "10.158.6.52" ], @@ -3435,6 +3743,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.org/orissu/fic.gif?ese=mmodoco#amni", + "example.com", + "www5.example.org" + ], "related.ip": [ "10.195.160.182" ], @@ -3491,6 +3804,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/iuntNeq/eddoei.jpg?sseq=eriam#pernat", + "example.net", + "mail.example.com" + ], "related.ip": [ "10.20.68.117" ], @@ -3546,6 +3864,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/tanimid/onpr.gif?gelitse=oremqu#idex", + "www5.example.org", + "www5.example.com" + ], "related.ip": [ "10.94.136.235" ], @@ -3603,6 +3926,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/ntorever/pisciv.gif?eritq=rehen#ipsamvol", + "example.com", + "www.example.net" + ], "related.ip": [ "10.152.11.26" ], @@ -3656,6 +3984,10 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/quu/xeac.htm?abor=oreverit#scip", + "www5.example.com" + ], "related.ip": [ "10.82.118.95" ], @@ -3712,6 +4044,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/mini/Loremip.html?tur=atnonpr#ita", + "www5.example.net", + "www.example.net" + ], "related.ip": [ "10.187.152.213" ], @@ -3767,6 +4104,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/duntutla/lamco.txt?isci=Dui#reetdo", + "internal.example.net", + "www.example.net" + ], "related.ip": [ "10.98.71.45" ], @@ -3823,6 +4165,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.net/tev/nre.html?occaeca=eturadip#ent", + "www5.example.org", + "www5.example.net" + ], "related.ip": [ "10.86.123.33" ], @@ -3877,6 +4224,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.net/uamnih/nseq.txt?uidolo=umdolore#dmi", + "api.example.net", + "www5.example.net" + ], "related.ip": [ "10.6.112.183" ], @@ -3932,6 +4284,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/umdolor/isiu.html?mmodi=snostr#eniamqu", + "www5.example.org", + "example.net" + ], "related.ip": [ "10.227.156.143" ], @@ -3985,6 +4342,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.org/ibusBo/untincu.jpg?lesti=sintocca#mipsumqu", + "example.net", + "example.org" + ], "related.ip": [ "10.124.129.248" ], @@ -4042,6 +4404,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.org/magnaa/sumquiad.gif?oluptate=Duisa#consequa", + "www5.example.net", + "www5.example.org" + ], "related.ip": [ "10.173.125.112" ], @@ -4098,6 +4465,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/evolup/rvelil.gif?eavolup=ipsumq#evit", + "api.example.net", + "www.example.org" + ], "related.ip": [ "10.37.156.140" ], @@ -4150,6 +4522,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/oremip/its.jpg?iavol=natuserr#ostrudex", + "www5.example.org", + "example.com" + ], "related.ip": [ "10.121.225.135" ], @@ -4204,6 +4581,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/animid/upta.jpg?onnumqua=quioff#iuntN", + "mail.example.net", + "www.example.org" + ], "related.ip": [ "10.123.68.56" ], @@ -4259,6 +4641,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.net/itesse/expl.html?prehende=lup#tpers", + "mail.example.net", + "api.example.net" + ], "related.ip": [ "10.63.56.164" ], @@ -4316,6 +4703,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/deritinv/evelite.html?iav=odico#rsint", + "example.com", + "example.net" + ], "related.ip": [ "10.62.10.137" ], @@ -4373,6 +4765,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.org/tseddoei/teursint.htm?remagnaa=lamcolab#ceroinB", + "api.example.net", + "example.org" + ], "related.ip": [ "10.89.154.115" ], @@ -4429,6 +4826,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www5.example.com/ciad/ugiatqu.gif?turveli=isciv#natus", + "api.example.org", + "www5.example.com" + ], "related.ip": [ "10.122.252.130" ], @@ -4483,6 +4885,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.com/olore/ntutlab.htm?ameaquei=gnama#esciun", + "www.example.net", + "api.example.com" + ], "related.ip": [ "10.195.152.53" ], @@ -4534,6 +4941,10 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/rvelil/adese.htm?incidi=aedictas#rumetMa", + "mail.example.com" + ], "related.ip": [ "10.9.255.204" ], @@ -4591,6 +5002,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/oremi/ectobeat.gif?oreeu=uasiarch#Malor", + "internal.example.net", + "www.example.org" + ], "related.ip": [ "10.214.235.133" ], @@ -4648,6 +5064,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.com/orsitam/tiset.jpg?ati=rauto#doloreeu", + "api.example.org", + "api.example.com" + ], "related.ip": [ "10.5.134.204" ], @@ -4704,6 +5125,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.org/rep/mveni.txt?utpers=num#ctetura", + "internal.example.com", + "example.org" + ], "related.ip": [ "10.144.111.42" ], @@ -4758,6 +5184,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.net/adm/snostr.jpg?tec=itaspe#con", + "www.example.com", + "example.net" + ], "related.ip": [ "10.122.0.80" ], @@ -4813,6 +5244,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.com/ccusant/epteurs.htm?oidentsu=oditau#onsec", + "www.example.net", + "mail.example.com" + ], "related.ip": [ "10.165.33.19" ], @@ -4870,6 +5306,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.org/onemul/trudexe.txt?ura=oreeufug#Quisa", + "internal.example.org", + "mail.example.org" + ], "related.ip": [ "10.87.92.17" ], @@ -4926,6 +5367,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/lorese/olupta.jpg?onsec=idestl#litani", + "internal.example.org", + "example.com" + ], "related.ip": [ "10.51.52.203" ], @@ -4981,6 +5427,10 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.net/llitani/uscipit.html?etcons=etco#iuntN", + "internal.example.net" + ], "related.ip": [ "10.0.211.86" ], @@ -5037,6 +5487,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://mail.example.net/ptat/mipsu.htm?eturadip=amquaera#rsitamet", + "example.net", + "mail.example.net" + ], "related.ip": [ "10.106.34.244" ], @@ -5091,6 +5546,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/quae/periam.html?emoenimi=iquipex#mqu", + "example.net", + "www.example.org" + ], "related.ip": [ "10.191.210.188" ], @@ -5145,6 +5605,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.com/bori/dipi.gif?utf=dolor#dexe", + "www.example.org", + "www.example.com" + ], "related.ip": [ "10.2.38.49" ], @@ -5196,6 +5661,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/iat/tqui.gif?utaliqui=emse#emqui", + "mail.example.com", + "example.com" + ], "related.ip": [ "10.66.92.90" ], @@ -5253,6 +5723,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://example.com/caboN/imipsam.jpg?catcupid=ritquiin#quisnost", + "mail.example.com", + "example.com" + ], "related.ip": [ "10.97.108.108" ], @@ -5310,6 +5785,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://api.example.net/uiaco/aliqu.txt?udexerci=uae#imveni", + "www5.example.org", + "api.example.net" + ], "related.ip": [ "10.147.147.248" ], @@ -5367,6 +5847,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.org/roinBCSe/eetdolor.html?tla=iaconseq#sed", + "api.example.com", + "www.example.org" + ], "related.ip": [ "10.152.190.61" ], @@ -5424,6 +5909,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://www.example.net/tvolu/imve.txt?gnaaliq=quam#deriti", + "api.example.org", + "www.example.net" + ], "related.ip": [ "10.129.232.105" ], @@ -5480,6 +5970,11 @@ "observer.product": "TomCat", "observer.type": "Web", "observer.vendor": "Apache", + "related.hosts": [ + "https://internal.example.org/teturadi/radipi.gif?upidatat=mod#niamqui", + "api.example.net", + "internal.example.org" + ], "related.ip": [ "10.12.173.112" ], diff --git a/x-pack/filebeat/module/zscaler/zia/config/input.yml b/x-pack/filebeat/module/zscaler/zia/config/input.yml index 05e5f5c886e..f2963a231f1 100644 --- a/x-pack/filebeat/module/zscaler/zia/config/input.yml +++ b/x-pack/filebeat/module/zscaler/zia/config/input.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zscaler/zia/ingest/pipeline.yml b/x-pack/filebeat/module/zscaler/zia/ingest/pipeline.yml index aae73dd9ded..f60a8a2e9de 100644 --- a/x-pack/filebeat/module/zscaler/zia/ingest/pipeline.yml +++ b/x-pack/filebeat/module/zscaler/zia/ingest/pipeline.yml @@ -53,6 +53,16 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - append: + field: related.hosts + value: '{{rsa.web.fqdn}}' + allow_duplicates: false + if: ctx?.rsa?.web?.fqdn != null && ctx.rsa?.web?.fqdn != '' + - append: + field: related.hosts + value: '{{host.name}}' + allow_duplicates: false + if: ctx?.host?.name != null && ctx.host?.name != '' on_failure: - append: field: error.message diff --git a/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json b/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json index ea74e1c3b31..b7bd436496b 100644 --- a/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json +++ b/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json @@ -22,9 +22,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "rci737.www5.example" + ], "related.ip": [ - "10.206.191.17", - "10.176.10.114" + "10.176.10.114", + "10.206.191.17" ], "related.user": [ "sumdo" @@ -93,9 +96,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "eosquir5191.www.example" + ], "related.ip": [ - "10.173.22.152", - "10.26.46.95" + "10.26.46.95", + "10.173.22.152" ], "related.user": [ "eataevi" @@ -166,6 +172,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "orsitame3262.domain" + ], "related.ip": [ "10.254.146.57", "10.204.86.149" @@ -239,6 +248,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tempor4496.www.localdomain" + ], "related.ip": [ "10.252.125.53", "10.103.246.190" @@ -312,9 +324,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ore2933.www.test" + ], "related.ip": [ - "10.136.153.149", - "10.61.78.108" + "10.61.78.108", + "10.136.153.149" ], "related.user": [ "ercit" @@ -328,8 +343,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "inim", "rsa.misc.action": [ - "Blocked", - "reetdolo" + "reetdolo", + "Blocked" ], "rsa.misc.category": "osquir", "rsa.misc.filter": "ipit", @@ -385,9 +400,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ollit4105.mail.localdomain" + ], "related.ip": [ - "10.66.250.92", - "10.183.16.166" + "10.183.16.166", + "10.66.250.92" ], "related.user": [ "tessec" @@ -458,9 +476,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "cup1793.local" + ], "related.ip": [ - "10.123.104.59", - "10.243.224.205" + "10.243.224.205", + "10.123.104.59" ], "related.user": [ "xercitat" @@ -531,9 +552,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "icab4668.local" + ], "related.ip": [ - "10.119.185.63", - "10.74.17.5" + "10.74.17.5", + "10.119.185.63" ], "related.user": [ "erc" @@ -547,8 +571,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tame", "rsa.misc.action": [ - "Blocked", - "nsec" + "nsec", + "Blocked" ], "rsa.misc.category": "emaperi", "rsa.misc.filter": "rehe", @@ -604,9 +628,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "aperia4409.www5.invalid" + ], "related.ip": [ - "10.25.192.202", - "10.78.151.178" + "10.78.151.178", + "10.25.192.202" ], "related.user": [ "quip" @@ -620,8 +647,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "atquovo", "rsa.misc.action": [ - "Allowed", - "amvolup" + "amvolup", + "Allowed" ], "rsa.misc.category": "hil", "rsa.misc.filter": "deFinibu", @@ -677,6 +704,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "sitvolup368.internal.host" + ], "related.ip": [ "10.135.225.244", "10.71.170.37" @@ -750,6 +780,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ite2026.www.invalid" + ], "related.ip": [ "10.19.145.131", "10.223.247.86" @@ -766,8 +799,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "sci", "rsa.misc.action": [ - "emseq", - "Allowed" + "Allowed", + "emseq" ], "rsa.misc.category": "exercit", "rsa.misc.filter": "taevit", @@ -823,6 +856,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "radipisc7020.home" + ], "related.ip": [ "10.2.53.125", "10.181.80.139" @@ -896,9 +932,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "uamei2493.www.test" + ], "related.ip": [ - "10.167.98.76", - "10.31.240.6" + "10.31.240.6", + "10.167.98.76" ], "related.user": [ "ratvolu" @@ -969,9 +1008,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "piscin6866.internal.host" + ], "related.ip": [ - "10.0.55.9", - "10.135.160.125" + "10.135.160.125", + "10.0.55.9" ], "related.user": [ "volupta" @@ -985,8 +1027,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iurer", "rsa.misc.action": [ - "Allowed", - "ionevo" + "ionevo", + "Allowed" ], "rsa.misc.category": "tinvolu", "rsa.misc.filter": "idex", @@ -1042,6 +1084,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "spi3544.www.host" + ], "related.ip": [ "10.63.250.128", "10.111.187.12" @@ -1058,8 +1103,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "nnum", "rsa.misc.action": [ - "Allowed", - "ntoccae" + "ntoccae", + "Allowed" ], "rsa.misc.category": "tium", "rsa.misc.filter": "uteirure", @@ -1115,9 +1160,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tlab5981.www.host" + ], "related.ip": [ - "10.252.124.150", - "10.5.126.127" + "10.5.126.127", + "10.252.124.150" ], "related.user": [ "inibusB" @@ -1188,6 +1236,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "upida508.example" + ], "related.ip": [ "10.201.171.120", "10.91.126.231" @@ -1204,8 +1255,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "umdo", "rsa.misc.action": [ - "Blocked", - "orumSe" + "orumSe", + "Blocked" ], "rsa.misc.category": "tanimid", "rsa.misc.filter": "itam", @@ -1261,6 +1312,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "oditem5255.api.localdomain" + ], "related.ip": [ "10.107.251.87", "10.135.82.97" @@ -1277,8 +1331,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "quid", "rsa.misc.action": [ - "Allowed", - "itecto" + "itecto", + "Allowed" ], "rsa.misc.category": "quam", "rsa.misc.filter": "adeser", @@ -1334,6 +1388,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "uamei2389.internal.example" + ], "related.ip": [ "10.215.205.216", "10.31.198.58" @@ -1407,6 +1464,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "eacommod1930.internal.lan" + ], "related.ip": [ "10.229.83.165", "10.29.155.171" @@ -1423,8 +1483,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "vitaedi", "rsa.misc.action": [ - "Allowed", - "llitanim" + "llitanim", + "Allowed" ], "rsa.misc.category": "apariat", "rsa.misc.filter": "tasnulap", @@ -1480,6 +1540,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tem6984.www5.domain" + ], "related.ip": [ "10.161.148.64", "10.129.192.145" @@ -1553,6 +1616,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "lapariat7287.internal.host" + ], "related.ip": [ "10.203.65.161", "10.7.200.140" @@ -1569,8 +1635,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tdol", "rsa.misc.action": [ - "nte", - "Allowed" + "Allowed", + "nte" ], "rsa.misc.category": "adeseru", "rsa.misc.filter": "mac", @@ -1626,9 +1692,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "licabo1493.api.corp" + ], "related.ip": [ - "10.218.98.29", - "10.86.22.67" + "10.86.22.67", + "10.218.98.29" ], "related.user": [ "olori" @@ -1699,6 +1768,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "stenatu4844.www.invalid" + ], "related.ip": [ "10.39.31.115", "10.24.111.229" @@ -1772,6 +1844,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "sitam5077.internal.host" + ], "related.ip": [ "10.32.39.220", "10.179.210.218" @@ -1845,9 +1920,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "dquia107.www.test" + ], "related.ip": [ - "10.88.172.34", - "10.128.173.19" + "10.128.173.19", + "10.88.172.34" ], "related.user": [ "agnaaliq" @@ -1861,8 +1939,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ntNeq", "rsa.misc.action": [ - "Blocked", - "dtempo" + "dtempo", + "Blocked" ], "rsa.misc.category": "ipsu", "rsa.misc.filter": "iqu", @@ -1918,9 +1996,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "lloin4019.www.localhost" + ], "related.ip": [ - "10.238.224.49", - "10.130.241.232" + "10.130.241.232", + "10.238.224.49" ], "related.user": [ "onse" @@ -1934,8 +2015,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "mnisiut", "rsa.misc.action": [ - "Allowed", - "mod" + "mod", + "Allowed" ], "rsa.misc.category": "uiinea", "rsa.misc.filter": "aturQu", @@ -1991,9 +2072,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tamet6317.www.host" + ], "related.ip": [ - "10.115.53.31", - "10.2.67.127" + "10.2.67.127", + "10.115.53.31" ], "related.user": [ "Cic" @@ -2007,8 +2091,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "quatD", "rsa.misc.action": [ - "Allowed", - "tatem" + "tatem", + "Allowed" ], "rsa.misc.category": "aincidun", "rsa.misc.filter": "uela", @@ -2064,9 +2148,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "saquaea6344.www.invalid" + ], "related.ip": [ - "10.204.214.251", - "10.101.38.213" + "10.101.38.213", + "10.204.214.251" ], "related.user": [ "ueipsa" @@ -2137,9 +2224,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "utaliqu4248.www.localhost" + ], "related.ip": [ - "10.101.85.169", - "10.18.226.72" + "10.18.226.72", + "10.101.85.169" ], "related.user": [ "rroqu" @@ -2210,6 +2300,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "mdolore473.internal.test" + ], "related.ip": [ "10.242.182.193", "10.87.100.240" @@ -2283,9 +2376,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tatio6513.www.invalid" + ], "related.ip": [ - "10.229.242.223", - "10.80.57.247" + "10.80.57.247", + "10.229.242.223" ], "related.user": [ "itasp" @@ -2356,6 +2452,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "lapar1599.www.lan" + ], "related.ip": [ "10.193.66.155", "10.106.77.138" @@ -2372,8 +2471,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uteir", "rsa.misc.action": [ - "Section", - "Allowed" + "Allowed", + "Section" ], "rsa.misc.category": "cididu", "rsa.misc.filter": "Utenima", @@ -2429,6 +2528,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "aquioff3853.www.localdomain" + ], "related.ip": [ "10.54.159.1", "10.236.230.136" @@ -2445,8 +2547,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tec", "rsa.misc.action": [ - "Allowed", - "tatema" + "tatema", + "Allowed" ], "rsa.misc.category": "emullamc", "rsa.misc.filter": "emveleum", @@ -2502,6 +2604,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ura675.mail.localdomain" + ], "related.ip": [ "10.131.246.134", "10.49.242.174" @@ -2518,8 +2623,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tvolup", "rsa.misc.action": [ - "Allowed", - "utemvel" + "utemvel", + "Allowed" ], "rsa.misc.category": "untutlab", "rsa.misc.filter": "dol", @@ -2575,6 +2680,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "iamea478.www5.host" + ], "related.ip": [ "10.142.120.198", "10.166.10.42" @@ -2648,9 +2756,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "eaque6543.api.domain" + ], "related.ip": [ - "10.138.188.201", - "10.128.184.241" + "10.128.184.241", + "10.138.188.201" ], "related.user": [ "etur" @@ -2721,6 +2832,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "eufug1756.mail.corp" + ], "related.ip": [ "10.53.101.131", "10.213.57.165" @@ -2737,8 +2851,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ese", "rsa.misc.action": [ - "litanim", - "Allowed" + "Allowed", + "litanim" ], "rsa.misc.category": "idata", "rsa.misc.filter": "urerepre", @@ -2794,9 +2908,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "orp5697.www.invalid" + ], "related.ip": [ - "10.55.81.14", - "10.243.6.41" + "10.243.6.41", + "10.55.81.14" ], "related.user": [ "eiusmo" @@ -2867,6 +2984,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "pariatur7238.www5.invalid" + ], "related.ip": [ "10.202.224.79", "10.33.144.10" @@ -2883,8 +3003,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "lit", "rsa.misc.action": [ - "quu", - "Blocked" + "Blocked", + "quu" ], "rsa.misc.category": "oluptate", "rsa.misc.filter": "exercita", @@ -2940,6 +3060,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "fficia2304.www5.home" + ], "related.ip": [ "10.20.124.138", "10.158.18.51" @@ -2956,8 +3079,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Loremip", "rsa.misc.action": [ - "Allowed", - "quid" + "quid", + "Allowed" ], "rsa.misc.category": "mini", "rsa.misc.filter": "uisnos", @@ -3013,6 +3136,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "mquisnos7453.home" + ], "related.ip": [ "10.134.128.27", "10.118.177.136" @@ -3086,9 +3212,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "aquio748.www.localhost" + ], "related.ip": [ - "10.125.120.97", - "10.68.8.143" + "10.68.8.143", + "10.125.120.97" ], "related.user": [ "reet" @@ -3102,8 +3231,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "amni", "rsa.misc.action": [ - "edutp", - "Allowed" + "Allowed", + "edutp" ], "rsa.misc.category": "ames", "rsa.misc.filter": "dmi", @@ -3159,9 +3288,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "remagnam796.mail.corp" + ], "related.ip": [ - "10.143.0.78", - "10.137.164.122" + "10.137.164.122", + "10.143.0.78" ], "related.user": [ "orissus" @@ -3175,8 +3307,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "etdol", "rsa.misc.action": [ - "Blocked", - "mwrit" + "mwrit", + "Blocked" ], "rsa.misc.category": "inim", "rsa.misc.filter": "aturQu", @@ -3232,9 +3364,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "etdolore4227.internal.corp" + ], "related.ip": [ - "10.156.177.53", - "10.30.87.51" + "10.30.87.51", + "10.156.177.53" ], "related.user": [ "psaquaea" @@ -3248,8 +3383,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tatno", "rsa.misc.action": [ - "Blocked", - "ptatev" + "ptatev", + "Blocked" ], "rsa.misc.category": "udexerc", "rsa.misc.filter": "ptatemse", @@ -3305,9 +3440,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "rors1935.api.domain" + ], "related.ip": [ - "10.111.249.184", - "10.83.138.34" + "10.83.138.34", + "10.111.249.184" ], "related.user": [ "dentsunt" @@ -3378,9 +3516,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "idexeac1655.internal.test" + ], "related.ip": [ - "10.180.150.47", - "10.141.195.13" + "10.141.195.13", + "10.180.150.47" ], "related.user": [ "taliq" @@ -3394,8 +3535,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "itesse", "rsa.misc.action": [ - "uip", - "Allowed" + "Allowed", + "uip" ], "rsa.misc.category": "teturad", "rsa.misc.filter": "roquisqu", @@ -3451,9 +3592,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "laboree3880.api.invalid" + ], "related.ip": [ - "10.166.195.20", - "10.255.40.12" + "10.255.40.12", + "10.166.195.20" ], "related.user": [ "lamcolab" @@ -3522,6 +3666,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tecto708.www5.example" + ], "related.ip": [ "10.22.122.43", "10.100.143.226" @@ -3595,6 +3742,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ine3181.www.invalid" + ], "related.ip": [ "10.119.53.68", "10.121.9.5" @@ -3611,8 +3761,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "dexea", "rsa.misc.action": [ - "Blocked", - "tinvolup" + "tinvolup", + "Blocked" ], "rsa.misc.category": "ende", "rsa.misc.filter": "onse", @@ -3668,9 +3818,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tsunt3403.www5.test" + ], "related.ip": [ - "10.237.0.173", - "10.31.153.177" + "10.31.153.177", + "10.237.0.173" ], "related.user": [ "sci" @@ -3684,8 +3837,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "eritqui", "rsa.misc.action": [ - "Blocked", - "dolor" + "dolor", + "Blocked" ], "rsa.misc.category": "taspe", "rsa.misc.filter": "oremipsu", @@ -3739,9 +3892,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "pitl6126.www.localdomain" + ], "related.ip": [ - "10.243.182.229", - "10.229.102.140" + "10.229.102.140", + "10.243.182.229" ], "related.user": [ "duntut" @@ -3755,8 +3911,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "epor", "rsa.misc.action": [ - "Allowed", - "etquasia" + "etquasia", + "Allowed" ], "rsa.misc.category": "iaturE", "rsa.misc.filter": "rep", @@ -3808,6 +3964,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "remaper3297.internal.test" + ], "related.ip": [ "10.120.138.109", "10.39.46.155" @@ -3824,8 +3983,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "adipisc", "rsa.misc.action": [ - "Blocked", - "exer" + "exer", + "Blocked" ], "rsa.misc.category": "remagna", "rsa.misc.filter": "emvel", @@ -3881,6 +4040,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tamr1693.api.home" + ], "related.ip": [ "10.53.191.49", "10.133.102.57" @@ -3954,6 +4116,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "cia5990.api.localdomain" + ], "related.ip": [ "10.89.41.97", "10.91.2.225" @@ -4027,6 +4192,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "riatu2467.lan" + ], "related.ip": [ "10.221.20.165", "10.7.18.226" @@ -4100,9 +4268,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "pici1525.www5.corp" + ], "related.ip": [ - "10.178.148.188", - "10.155.252.123" + "10.155.252.123", + "10.178.148.188" ], "related.user": [ "inrepreh" @@ -4173,9 +4344,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "dolo6418.internal.host" + ], "related.ip": [ - "10.220.1.249", - "10.190.42.245" + "10.190.42.245", + "10.220.1.249" ], "related.user": [ "olup" @@ -4189,8 +4363,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uamquaer", "rsa.misc.action": [ - "aerat", - "Blocked" + "Blocked", + "aerat" ], "rsa.misc.category": "quela", "rsa.misc.filter": "qui", @@ -4244,9 +4418,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "imveni193.www5.host" + ], "related.ip": [ - "10.112.190.154", - "10.55.38.153" + "10.55.38.153", + "10.112.190.154" ], "related.user": [ "oremeu" @@ -4260,8 +4437,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tin", "rsa.misc.action": [ - "urau", - "Allowed" + "Allowed", + "urau" ], "rsa.misc.category": "isiut", "rsa.misc.filter": "cons", @@ -4317,9 +4494,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ionu3320.api.localhost" + ], "related.ip": [ - "10.195.153.42", - "10.250.48.82" + "10.250.48.82", + "10.195.153.42" ], "related.user": [ "tsedquia" @@ -4333,8 +4513,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tDuisaut", "rsa.misc.action": [ - "Allowed", - "upidatat" + "upidatat", + "Allowed" ], "rsa.misc.category": "aliquide", "rsa.misc.filter": "deriti", @@ -4390,6 +4570,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "remips1499.www.local" + ], "related.ip": [ "10.252.164.230", "10.60.52.219" @@ -4406,8 +4589,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "rroq", "rsa.misc.action": [ - "Blocked", - "fdeFin" + "fdeFin", + "Blocked" ], "rsa.misc.category": "diduntut", "rsa.misc.filter": "ano", @@ -4459,9 +4642,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "mdoloree96.domain" + ], "related.ip": [ - "10.122.102.156", - "10.187.16.73" + "10.187.16.73", + "10.122.102.156" ], "related.user": [ "emoen" @@ -4532,6 +4718,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "iatnulap7662.internal.local" + ], "related.ip": [ "10.120.215.174", "10.248.108.55" @@ -4548,8 +4737,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "rema", "rsa.misc.action": [ - "Allowed", - "uatDu" + "uatDu", + "Allowed" ], "rsa.misc.category": "ent", "rsa.misc.filter": "iscivel", @@ -4603,9 +4792,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "sBonoru1929.example" + ], "related.ip": [ - "10.15.254.181", - "10.51.161.245" + "10.51.161.245", + "10.15.254.181" ], "related.user": [ "abo" @@ -4619,8 +4811,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "modit", "rsa.misc.action": [ - "uteiru", - "Allowed" + "Allowed", + "uteiru" ], "rsa.misc.category": "qua", "rsa.misc.filter": "saute", @@ -4676,9 +4868,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "onorumet4871.lan" + ], "related.ip": [ - "10.129.66.196", - "10.7.152.238" + "10.7.152.238", + "10.129.66.196" ], "related.user": [ "equamn" @@ -4749,9 +4944,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "onproi4354.www5.invalid" + ], "related.ip": [ - "10.29.162.157", - "10.185.107.27" + "10.185.107.27", + "10.29.162.157" ], "related.user": [ "evelite" @@ -4822,9 +5020,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "beataevi7552.api.test" + ], "related.ip": [ - "10.138.0.214", - "10.215.63.248" + "10.215.63.248", + "10.138.0.214" ], "related.user": [ "eavolupt" @@ -4838,8 +5039,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "odita", "rsa.misc.action": [ - "Blocked", - "dqu" + "dqu", + "Blocked" ], "rsa.misc.category": "ipex", "rsa.misc.filter": "ine", @@ -4895,9 +5096,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "rvelill1981.www.invalid" + ], "related.ip": [ - "10.26.115.88", - "10.12.130.224" + "10.12.130.224", + "10.26.115.88" ], "related.user": [ "Nequepo" @@ -4911,8 +5115,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tNequepo", "rsa.misc.action": [ - "rmagnido", - "Allowed" + "Allowed", + "rmagnido" ], "rsa.misc.category": "luptatem", "rsa.misc.filter": "deritq", @@ -4968,6 +5172,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "quia7214.example" + ], "related.ip": [ "10.91.20.27", "10.193.152.42" @@ -5041,6 +5248,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "aturExc7343.invalid" + ], "related.ip": [ "10.146.69.38", "10.55.192.102" @@ -5114,9 +5324,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "olo7317.www5.localhost" + ], "related.ip": [ - "10.124.177.226", - "10.249.1.143" + "10.249.1.143", + "10.124.177.226" ], "related.user": [ "isciveli" @@ -5130,8 +5343,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Utenim", "rsa.misc.action": [ - "Allowed", - "onevo" + "onevo", + "Allowed" ], "rsa.misc.category": "tdolore", "rsa.misc.filter": "ptasn", @@ -5187,9 +5400,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "uiin1342.mail.invalid" + ], "related.ip": [ - "10.167.176.220", - "10.146.228.249" + "10.146.228.249", + "10.167.176.220" ], "related.user": [ "estla" @@ -5260,9 +5476,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "agna5654.www.corp" + ], "related.ip": [ - "10.200.74.101", - "10.203.47.23" + "10.203.47.23", + "10.200.74.101" ], "related.user": [ "litesse" @@ -5333,6 +5552,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ites5711.internal.host" + ], "related.ip": [ "10.162.78.48", "10.24.23.209" @@ -5406,6 +5628,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "oluptat2848.api.home" + ], "related.ip": [ "10.211.66.68", "10.55.151.53" @@ -5479,9 +5704,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ngelitse7535.internal.lan" + ], "related.ip": [ - "10.209.203.156", - "10.110.16.169" + "10.110.16.169", + "10.209.203.156" ], "related.user": [ "mes" @@ -5495,8 +5723,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iamquisn", "rsa.misc.action": [ - "lupta", - "Blocked" + "Blocked", + "lupta" ], "rsa.misc.category": "uasiarch", "rsa.misc.filter": "usBonor", @@ -5552,9 +5780,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tiumtot3611.internal.localdomain" + ], "related.ip": [ - "10.84.9.150", - "10.107.68.114" + "10.107.68.114", + "10.84.9.150" ], "related.user": [ "sequatDu" @@ -5568,8 +5799,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "omnis", "rsa.misc.action": [ - "Allowed", - "uianonnu" + "uianonnu", + "Allowed" ], "rsa.misc.category": "Excepteu", "rsa.misc.filter": "enimadmi", @@ -5625,9 +5856,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "gnaa4656.api.example" + ], "related.ip": [ - "10.26.222.144", - "10.124.119.48" + "10.124.119.48", + "10.26.222.144" ], "related.user": [ "nre" @@ -5698,6 +5932,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "psaqu6066.www5.localhost" + ], "related.ip": [ "10.164.190.2", "10.223.11.164" @@ -5714,8 +5951,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "officiad", "rsa.misc.action": [ - "antium", - "Allowed" + "Allowed", + "antium" ], "rsa.misc.category": "emoeni", "rsa.misc.filter": "itvo", @@ -5771,9 +6008,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "iavol5202.api.example" + ], "related.ip": [ - "10.14.37.8", - "10.121.181.243" + "10.121.181.243", + "10.14.37.8" ], "related.user": [ "umwr" @@ -5844,9 +6084,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "uame1361.api.local" + ], "related.ip": [ - "10.10.93.133", - "10.90.20.202" + "10.90.20.202", + "10.10.93.133" ], "related.user": [ "evita" @@ -5917,6 +6160,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "rsitame4049.internal.corp" + ], "related.ip": [ "10.77.102.206", "10.34.98.144" @@ -5933,8 +6179,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Exce", "rsa.misc.action": [ - "ulapa", - "Allowed" + "Allowed", + "ulapa" ], "rsa.misc.category": "reprehen", "rsa.misc.filter": "itsedqui", @@ -5990,6 +6236,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "elit912.www5.test" + ], "related.ip": [ "10.176.233.249", "10.75.144.118" @@ -6006,8 +6255,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "essequa", "rsa.misc.action": [ - "odic", - "Blocked" + "Blocked", + "odic" ], "rsa.misc.category": "cto", "rsa.misc.filter": "odite", @@ -6063,6 +6312,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "tat6671.www.local" + ], "related.ip": [ "10.149.6.107", "10.236.55.236" @@ -6079,8 +6331,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uis", "rsa.misc.action": [ - "mvele", - "Allowed" + "Allowed", + "mvele" ], "rsa.misc.category": "vitaedi", "rsa.misc.filter": "ndeomni", @@ -6136,6 +6388,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "uis5050.www.local" + ], "related.ip": [ "10.97.202.149", "10.13.125.101" @@ -6209,9 +6464,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ficiad1312.api.host" + ], "related.ip": [ - "10.230.61.102", - "10.141.66.163" + "10.141.66.163", + "10.230.61.102" ], "related.user": [ "umdolo" @@ -6225,8 +6483,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "itautf", "rsa.misc.action": [ - "mini", - "Blocked" + "Blocked", + "mini" ], "rsa.misc.category": "gna", "rsa.misc.filter": "usmo", @@ -6282,9 +6540,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "itaspe921.mail.invalid" + ], "related.ip": [ - "10.224.249.228", - "10.10.25.145" + "10.10.25.145", + "10.224.249.228" ], "related.user": [ "mnisiuta" @@ -6355,6 +6616,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "archite4407.mail.invalid" + ], "related.ip": [ "10.247.255.107", "10.234.34.40" @@ -6371,8 +6635,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "neavolu", "rsa.misc.action": [ - "Blocked", - "nofdeF" + "nofdeF", + "Blocked" ], "rsa.misc.category": "remagnam", "rsa.misc.filter": "maveniam", @@ -6428,6 +6692,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "aria1424.mail.home" + ], "related.ip": [ "10.250.102.42", "10.124.81.20" @@ -6501,6 +6768,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "Bonoru7444.www5.example" + ], "related.ip": [ "10.166.205.159", "10.154.188.132" @@ -6570,9 +6840,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "icero1297.internal.domain" + ], "related.ip": [ - "10.138.193.38", - "10.46.71.46" + "10.46.71.46", + "10.138.193.38" ], "related.user": [ "sintocca" @@ -6639,9 +6912,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "oloremeu5047.www5.invalid" + ], "related.ip": [ - "10.254.119.31", - "10.172.159.251" + "10.172.159.251", + "10.254.119.31" ], "related.user": [ "usm" @@ -6655,8 +6931,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "imadmi", "rsa.misc.action": [ - "Blocked", - "tatemacc" + "tatemacc", + "Blocked" ], "rsa.misc.category": "tutlabor", "rsa.misc.filter": "eturad", @@ -6712,6 +6988,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "edutpe1255.internal.lan" + ], "related.ip": [ "10.195.62.230", "10.98.126.206" @@ -6728,8 +7007,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "isnost", "rsa.misc.action": [ - "oriosa", - "Allowed" + "Allowed", + "oriosa" ], "rsa.misc.category": "uis", "rsa.misc.filter": "nemul", @@ -6785,9 +7064,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "nderit1171.www5.domain" + ], "related.ip": [ - "10.84.140.5", - "10.144.93.186" + "10.144.93.186", + "10.84.140.5" ], "related.user": [ "eroi" @@ -6858,6 +7140,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "nos4114.api.lan" + ], "related.ip": [ "10.31.58.6", "10.198.84.190" @@ -6931,6 +7216,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "oremeum4231.internal.host" + ], "related.ip": [ "10.139.90.218", "10.131.81.172" @@ -6947,8 +7235,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "rrorsi", "rsa.misc.action": [ - "exe", - "Allowed" + "Allowed", + "exe" ], "rsa.misc.category": "mnihi", "rsa.misc.filter": "consequa", @@ -7004,9 +7292,12 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "ueip6097.api.host" + ], "related.ip": [ - "10.128.43.71", - "10.152.217.174" + "10.152.217.174", + "10.128.43.71" ], "related.user": [ "mquiado" @@ -7020,8 +7311,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "olupt", "rsa.misc.action": [ - "temvele", - "Blocked" + "Blocked", + "temvele" ], "rsa.misc.category": "natuser", "rsa.misc.filter": "amnihil", @@ -7077,6 +7368,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "fugiatqu7793.www.localdomain" + ], "related.ip": [ "10.26.149.221", "10.217.193.148" @@ -7150,6 +7444,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "onsequ3168.www.corp" + ], "related.ip": [ "10.172.17.6", "10.109.192.53" @@ -7166,8 +7463,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "temUte", "rsa.misc.action": [ - "tassit", - "Blocked" + "Blocked", + "tassit" ], "rsa.misc.category": "ita", "rsa.misc.filter": "scive", @@ -7223,6 +7520,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "oremquel3120.internal.localhost" + ], "related.ip": [ "10.135.38.213", "10.119.106.108" diff --git a/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json b/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json index 66ca65108fd..bdf9957b55d 100644 --- a/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json +++ b/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json @@ -17,6 +17,9 @@ "observer.product": "Internet", "observer.type": "Configuration", "observer.vendor": "Zscaler", + "related.hosts": [ + "" + ], "related.user": [ "" ], From 30166f652803d3891ed53dbe208fbdb9453f8c3a Mon Sep 17 00:00:00 2001 From: AndyHunt66 Date: Wed, 23 Sep 2020 18:33:47 +0100 Subject: [PATCH 046/216] [Docs] Typo in table syntax (#20227) --- x-pack/filebeat/processors/decode_cef/docs/decode_cef.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/processors/decode_cef/docs/decode_cef.asciidoc b/x-pack/filebeat/processors/decode_cef/docs/decode_cef.asciidoc index 3078bf3477b..4666100a39e 100644 --- a/x-pack/filebeat/processors/decode_cef/docs/decode_cef.asciidoc +++ b/x-pack/filebeat/processors/decode_cef/docs/decode_cef.asciidoc @@ -28,7 +28,7 @@ The `decode_cef` processor has the following configuration settings. .Decode CEF options [options="header"] |====== -| Name | Required | Default | Description +| Name | Required | Default | Description | | `field` | no | message | Source field containing the CEF message to be parsed. | | `target_field` | no | cef | Target field where the parsed CEF object will be written. | | `ecs` | no | true | Generate Elastic Common Schema (ECS) fields from the CEF data. From d816b6292fc335ae90688f659b0ad6110c991c24 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Wed, 23 Sep 2020 12:44:42 -0600 Subject: [PATCH 047/216] Move aws lambda metricset to GA (#21255) --- CHANGELOG.next.asciidoc | 1 + metricbeat/docs/modules/aws/lambda.asciidoc | 2 -- metricbeat/docs/modules_list.asciidoc | 2 +- x-pack/metricbeat/module/aws/fields.go | 2 +- x-pack/metricbeat/module/aws/lambda/_meta/fields.yml | 2 +- 5 files changed, 4 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1c41a2f71e4..145d7ae09e5 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -714,6 +714,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Move `compute_vm_scaleset` to light metricset. {pull}21038[21038] {issue}20985[20985] - Sanitize `event.host`. {pull}21022[21022] - Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] +- Release lambda metricset in aws module as GA. {issue}21251[21251] {pull}21255[21255] *Packetbeat* diff --git a/metricbeat/docs/modules/aws/lambda.asciidoc b/metricbeat/docs/modules/aws/lambda.asciidoc index 5e31c8fdc56..202820844ad 100644 --- a/metricbeat/docs/modules/aws/lambda.asciidoc +++ b/metricbeat/docs/modules/aws/lambda.asciidoc @@ -6,8 +6,6 @@ This file is generated! See scripts/mage/docs_collector.go [role="xpack"] === AWS lambda metricset -beta[] - include::../../../../x-pack/metricbeat/module/aws/lambda/_meta/docs.asciidoc[] This is a default metricset. If the host module is unconfigured, this metricset is enabled by default. diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index bfe9052b8e6..2232cf3b070 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -22,7 +22,7 @@ This file is generated! See scripts/mage/docs_collector.go |<> |<> |<> -|<> beta[] +|<> |<> beta[] |<> |<> diff --git a/x-pack/metricbeat/module/aws/fields.go b/x-pack/metricbeat/module/aws/fields.go index 12efc5c0cf9..31a766459c7 100644 --- a/x-pack/metricbeat/module/aws/fields.go +++ b/x-pack/metricbeat/module/aws/fields.go @@ -19,5 +19,5 @@ func init() { // AssetAws returns asset data. // This is the base64 encoded gzipped contents of module/aws. func AssetAws() string { - return "eJzsfd1zGzey73v+CtS+xE7JOo6dbN3Kw6nSlze6R5YVUV7njQvONEmsMMAYwFBmav/4W2gA8z0kh5yh5FPXD1sbkQR+/YFGd6PReEMeYf0boU/6B0IMMxx+I387+zL52w+ExKAjxVLDpPiN/PcPhBDyL/qk/0USGWccSCQ5h8hocvZlQhIpmJGKiQVJwCgWaTJXMsHPLrjM4idqouXpD4Qo4EA1/EYW9AdC5gx4rH/D0d8QQRMIaOw/s07tF5XMUv+XFlDVQcoDGbrQpz/lfw7jydm/ITKlP7s/TN2nj7B+kipu/3ia0DRlYuG/+7ef/lb6Xis29++BLuzAZEV5BiSlTHn+0CdNFGiZqQj0aYMC/f50lkWPYE7tfzcoaWLdgOGWJkDknFAyeU/8qI0JY5aA0EyKF8K4j6hMZVgNyD/+dOpV7vSn059+7Ik6ltmMwxigNTFLaogCkykBsZN3sRbI2d01+ZqBWjdJmjHOmVg0SCmvhC0Y/uXH+BeJpDCUCQsHCGjDEmogJtGSqgVoMpeKrGWmcKnSKJKZMISJ2qoN//LVOwNDS3+vL8EyNVdhzgs3ZeVLgTQuK/Q2qPtIv7EkSzoI8NgR/GkriItMKRDRunXypuo25r9qzBv5EUkmWMekE1ArFsFtde32mtcPgQMiqVaKSRcz2mGcJVIZ9hfEF1KbViB1xeoSaXlUmlhuNz4OQzYWVit5OTQSSW26xgxTWk53TtjOzG0zNoYMc51zEPFLZJkHdjSGVebrZNetVAnllq+fNV3AWRuuZ2ZcAZFkFuMxmNcxZzcfP4vZS1W8HNrRVK82YzfTLGv/yKgwzLRb+OdjGkr9q8d2FKZVZ+xkmjZUmWlMzf57kx2B2BFwZ1LW7YGVjQHsfmxFpltnBhEfNO+ViPeYFVVgGsOcCWbHGUxPHqGuc9uoaVD0sASiDYZP3mlMFWgQRhOKgYOllBKdQsTmDOJWnKXAZ522KeZQkKwLYsey0UQTSJXfs3UlkCDdbjnZHlCQHv55g6D/blBsTSyBbymXCpTDS2brIlDTDcc8yp3ig3zzYpiae56UI4cnUEB0pGgaooc8mv6CEcTTkkXLYoCWGNzKy5IUs/kclP0PS4dOaVT1FatBefi3yanPx9l3ETfFYTUuH7ak609LEC5SKvGf0JS1hK9rQRMZzw6SThjkSLKxP7zEKS/PDw21/NiDmbZJFkWg9Tzj9/A1A21uqLExzyld1aM10nNjbMqfeB2gK1B2C+NuLmtldI6DKAdEEyNzthEbAib0LymKP02MAprUWeGBZN6uldXMsARICorJ+LQ/QxL6bTSGhHDvJTLkk+BMwLWI4dsdqAiEoQu4U3KhQOtR1STNp7MMiWSScrC/cfaCEgFPZMHljHKiIZIipmpNmAVKmCYzsATT2DqXRhJKDJ1x6KbzTskV00wKiL8oZuCCpjRiZv1ZMDMunSJLZqAsjWmBgTxZECTyKNDL095LQEoI/t92+nei8h5o/NxEKqDx4DReSKGz5NgEBqNWENpGXOSxEbkC1b0cT1qn0ZKsZUYiKohRNHokS/lEkixa2tkwxVfmrVkqmS2WaWbscsg0bFjk3SzTWdLJspaUXg+G6Sz5Trl0ZPvQ1KxW2/D9MW103fqe+HQPKWcRtZQd0wcDTlMdKJ+BeQK7twqSpTHmnZmBhNA0BYoOBBPIsdzn0OhzWJvdOpMUYONKS5iz6CeEith52M2RqZBmCSr/hZ/M2/8t+3cL/47hsv2v4d+DokLTyNJ9IcWcs8iMpoBnXvkU2FDfc+kNhxWUvN04A+u4mQIX5XbxIjSd8zqSwh3UtOXVSDGcdMzQNAGcTvdjxUi2ShrKXyobztxxW5fLaBhnf+F6O4qhqkYD25zIDNFBbONvSy9tOzrcTGx1w3ox1Lbuab3Jnay1geRKKanG3Id7hq7OsC1AgGpmj90/KsjvDw935Ne3b4k21GR2Q4/hgAD3QoqYuXV1sYTo8QNl3Kq6Qz4icwp/bo5TEmoMJKnjVgpqLlVi13VA50S/YcHegYiZWJR2wgvUgmOQgLuR2/S8GKkCRGxAWIKaW1nrqLPMuJ8v6QqIkIaswZCZNXGlwQ70FGj8sFTSGA5XKxCjCfm+TfuROPgWAfqH0G3JWoccKEQO5I+t5r05UPKYOUuYac9mSUFoXlVFXmnrf1NdYYlwLHjdzQO07y9TD6o2fkxF8NveR/rNrgq90WU+zFQEh3lzfgS5YqOrGWC8ZDc0Krr3Mzc6005bSCxBo9GgacrXzuy8iSFBp9lySVs2tTNpk2Ut2PRgR7mxLtoLZlihEY7U9lC2ljOV8zKnyQepmswzBasjmupyrVKH20nj4AR4wDuoK9KT6Q0mvE0eX9zueEyBtPpiL1siDvKoInnRgnh+W/KRfitFGai/XXHVmAmMw+KpJVssoVG/5P41xqrp/hY978O4zhjteThXV8N2ppV/smGN7sm1vAZnVvad+h+Sw0wf8Xz86nxyWLnC0Afj/5Q8S3Bhnq+tNTs86A9JL83+QsUBGi3d+pCpjXeZFOUo1meh0UVMjXV5VwhJ2zCRRstwrHnLjJJvZtQaOCa0oSKCE/K0tPIxpYxCrbwn/LklCb4tYHaswaU3Km/cMvgumWP15lM6BGeswTGYJaz5gTlfNKZ+GxDtFw1LNuzYJTmOh7UmxAPB/pFBBjcgFmY5EN4aV+3mXte7PIn1RJlBDZTWpfAFCahZB5D0kEe8RXnFQLRVN6rr//pUlkMKym8p5NX1p7vJaxIDZytQ4KDnsrQfVna5uYuvfQ7v6nziF98p+WzX2RMzy3KdgRtgMrnM16gUfL2NLeUT6VFU1NdpbxC8Jq9EUd1tJHn369//p+YYvS6OEzdrwTC8Oc+UNueUWzs2ADcKTP/AnCsnd5lKpQaE9GqRvnt9QgoFJZ9SwxLkxu+Xl+SVNj+/dgdSF5KHv0U/v64S4+iNwS79ueUnLio6k5jpa9PSSEFsnc5XVtMsCILXYnIYlc+1+Rkh4MQKEspE6aBtZhnWuAzXrnJ4GIPJQSuwTamg/c2hW3Ha6olzfijnDXvuApeBzIsF4FJdR6aqsZqGJOs65scgaCNGV4cmpJefalLsnORsljBjymf/uY8evTvMR4/eHdNHv3h3mI8epdkpcvo0bRSGO+J1RDnE0zmXtP6FHWqLq5aEci4jPIO/uniHepcZKKcGqAJ/x89wG1SRTEM4Hw3OYvt9O0uIM0JTvPTTSsu2C48d9dG5Dl7cfc4tXb6wythwI7bfykqB7za8M7d5jIIYKN6DLQN3jBYF5iXVNmZVGcREM/sXZsgT1YTTTKDjjjadKlMvlikTozOV8kxPj0CUn6pKER5O4aFUYfIEyQRmjkqxhjMR9mcXd58vcAS/e/ub4kyTv0DJXSnVU3cPtJ43GIhUpKWVYLtWhDQkpSwmsXwSluSmvJ034MyKWWbWgEYZeos0zo8xHQntJAswT1I9njJxmlK7ae93mbid0rqV9zMQBRGwlVU9gTuXB0GYMKDmNALdWHpMhPYI1plpCwq7KZqmoKYaohEsYJO2kpuPttx6XTuTuZkimZkjCqk/+j2EVCLpf4uUmDidrc3ul/Kdi/4bafvRHuLDYY62wnC2o0jO0VWSW38St6vi8wvuaKvuGSU31IqLmX5k8tRGA8eTHEotLDLq3XxLRS4PbaSCIj+6oozjyYKR+8qtQehIcjsvyCqJa28KNxKDsduziK1c1nQUuZVIHVVwgbCS7PakcbsaynQwHwRFU6Qp6smZYy8wmW6WUn8KLzppG2KV9cnrtCrmeKJsZqSOu+TGFGWDtsNX3T6SdCW5p9ESosepK2sdiNR7SKUy2kbUWPpZQbqkmqRUY5GHNMvqh6FM2GLy1yeAaCyArn7mc8acakMSJjKzO5FTN96RaR2DkDDPM5DSLrFdick3i0gq+z9d7YmsW7eA+n2b/qk5qXxvsu07Vf4pS+gCTln7mti7p8L1ZTixw/FdsZORPqXWB1+RAT61Mhiw98O1iFmExeFBE2Iwruy9lHZmmoCwtqjDnOZAU8VW1MBpLPRUHNB9rSOR7EYnl7cT15fNs7cRGeyIktWrT7wm1v/cA9r13eoXQuNYgdaEai0jhrluPM3bC2s24ywai6E4eIOfO2qlhzYgFwPjPI4ra1xYRK7v8k9eWQa/JjOZuQ10H5biEjqNZNzOzb0NEY5b5+GJq4D/+e9vZsyQTGi2EJiJxkl2Qjq83FuRklepu6hC/kNUJoT7f3qZGcPE4g1ml/9DDKiECdTp/1iPBRsBhf8L8estFJmldW6dv2VN9VhbgZ8H3a2wLbQc9PHDOtYAP2azmqub9j41z1aMd06jRxDxhRTC+dwDXVyrijLKhy+zVUhTasbC1wS0oTPO9NI6m/72JTooksbEn0Sp3M9UsGDaYFVN0M0NtcG/PzzcXcgYpp7i6bs//xyYSrw99+7PP4kCnUqhwd2fC5fusFj1QNDvxwH9flTQv4wD+pdRQf86DuhfRwF9dXM+JpcjzqwNA2saELSuom6s0R0hj8hjDWoFahDI/o7ZMBc+64WRvv6xyKQg3MJaJrTrBi66SivKN9xEThnncgVqOOjNetlw/y636vmV+xlENNOuGlhnChtrgjuYt+Z+g44A5Wa5/l0Gph9636XK9KUbvlhg5VWHTj52G9lROyaWsnLx7BBgO9n8ChWcW7QC1Ou6trx6uCh/mtcXBK9QySyU2dIGH7pp/CxGFkkmhhXKcG1eCmlgXZrvSXJCmAiVbCfOLcSqXvuVpsOCDqAp7uw79reYepIJw3gjYaOMSzpoyD0fv4EsgcagNuwQeev1s5vzs8iwFRSenhPkMCwquqlXnD5fA0asWpb1lCIUxzi3uegQCTZ9vZy91Y/s96lagNmR/FD2fHPxeahy5zaqqyBrd71e3Vx8fl2+MXeW5g0FyI395flW3S7TdAtPx5OngKeGIMse+/GkeaekDRpgsAtEXST7A+0w3e5Cy/tgF189NFCtDnXEmLVE7osLX9tt2hiezguwZhc49sPN5BYW0jCah+tjuKYPN5MKkdj5u+w9+6AANS5mMUbzuTkglGjQGluKhrRplWDffIniROimbw4aph/YN4in937rm45B89xO8SbfXWkjY1FkK7aAvYeYKYjMKDCVH3wQgJ8Vn96whJnpFXbMgPiImCOZ8Vj8aKqXvsqBw+f7m3BMlcsFi8+tajn3xwYU3K4dZQcV5P/8z47h5/s//xyF1lJKxRFtsboYFKmWii0w/9phDHYP+MeD3xH2D4n/1zHxd+QABsX/9u2I+N++HRH4uzGBvxsR+Psxgb8fEfgvYwL/ZUjg13erv9cc7DH8qRbXuukk4C1xC2gz3BEzdHb4Iv2SVyL3yyC2hGljsPTZA7SXpja/IEGb9efepyvHENC2A7DWVGmVlCV2eXJ9F5jRLQ16SkM/bw67EEov/mccrlaUZ664bmhwGd+uLgu2Atf2zqXnlDWbvlGFJ4YKspTZhiU+QnZpr5zSpixp7XLAoQmJYpgjJiNu3aQvNBHxgcunIdNwG5IQcy6fNHlVPQB43bTx22x2Dfj04eJufPB2lxqNgJvJEQi4mYxGwOfLI0jg8+VwEvgebF8D8/i5tDr3rc4sqYj1kj4GN923J/YHvKLAUjS8D2G43Updtiwc8G10OAtTNJar2aE+Gz1Op0oho7NTE+kyLbi4R3Odu9f00DS9EEf5hDAR8QyPhh8u7v7r+m77iWIV+mgCaYFfVv1NTwygPL6LlV2myK9vp00bqLu4mzrbNb0HDUMmmJtFBxoMeXU/eXhdvSruLjDlBwByR9hXN+fPgnnfuh+L2SnTs7Pasdex2rH92apngrkr+rxIoVmMdQy+iOMZC0k2ocuLTJoREafJLKYHRUNuiCNGQjc4YWsU9IyvXl6LlT+dGd4VtFurdl7ePBPFsQrebfkGUWZcZU7Y0koPPbqP3WmtiMv/6R/o1Rk37lZePvSWQ0lfKD00kaxg4P7YLoHGN2AMqMFQfpCKUL0W0VJJIbH/TAB64q5w1OTk9LPy8gYWMFFBYJVvHDHQ+A1HqL48cJa5zXPDFn8J2jCBc1+6zorrD5TxTA1SDDIapTnonWjM1FBv4uC1nLwnoy9So6ZtJekURJz7XfjMpydi+4sXY66FWqEpxSaz/qGNDWcDxm78Up0N0vfT6oWTp38dwz+hna/T0CPCvTymnbL4lmn5PUsFkVRxiBa2sPYiD9ivcos1OJdzDShqL4vC0UIRwL3jsWFvt16MWmEqfQzUH3xz1C8Tcg+LltXoEBbg3Tu1lRgi0Oq/FUvxo285FsAXSZJogyNTajTaSu2wXk0vCREpKj1l96Yn2rnt+y4UofTIChQWBdn/4Iz6NeIatsn5NraSmK1YXDjy9XazHWQX/Qr7MqDszQx7MLGLLzOgJPOrAM9PkdXgmKqqhNy705x3ipBp30ay5TiDmgU18ETXhx1n5MN0OPFo2y+KV/Td04HRI8FGlZYFt2cPxI9hnXHqGoG43UK/NE8d8zfX4oOSScmfGlgpaj3K/Lot8yk/bi75Rxu6NBegJ8jW58Eb0n9MOIX/593FFsyfMvMgx+Zz3m7Ld3RugPeH/ruzGmGPyGl/NWIj2l7MLo7xz5w7Pu5pfuH040WtDkp2gXtVpJjHLkAoZ7N7I8aA8k4qc8ZDHeYoG0ldGbBU1D0a5HdzQoMjnkq1wYkODa1lNrIyeK8M35PFjqxQqqbxReLu2n5oBxRz/5cN+7lLB14qmY6BPmQbY4V3/1ss3lZoY+8hjV6yB+8iFeCjWLedMfcybh73yHtJoy3sELtJGfqoHB98R2m/YjLGLc/S8by3FvVqvq3WOoBW8WFPVKn4mE9U3V8e+ETVQe3vQ7NJ3+P+hw1S26U5ft+28f+/zf2x29zH1NAZ1TAtLa1RyAkT1S5SNV97zJHN8iZxp1SJVlB7dQzyLwrdh4d9b2kCr87ub1+jCrj30mK9HVTEqW7n1V6wLsoWpty+KrwpQUVMEkikWhelP4ghfPHyfFsr0xJ6FoMwbM4afYmGIIFasao3OktTziAuhF/MeuoewSz+QJgjPRPsawYWgNP3/Bt22F4kuv5+w5E38f0mHM6wPZWaTzGdU9rdp3OKRzvTGFKzbMV2cOtpmRlMLNkt5vqTJq8U0Pi/Kk+y6tflZ8Yong06B4bpx3bsoQPlVz51l4mmdAHCTP8tZ+NYDF81Mvnjhkzc7aUzOyGxE5bbgGxt2ThXAHTGYepWz1H7nRcJ2aIBqqIilkngugfViXyqjVR0ccSu0R2wPQ6i086edL4if5ppiKcY+7krjlMWD6kjofC/NAO5vgxvpmj3ZIrFcOoubAOeQ95JbRYKJn/ctIOX3HrvU//YP8LWXJopp4vTZDYgfE4XCzyT989QugudOGv+GbqZUuNZtwGVoJH/cnaDBiYPpXrRZ63AlMmt/YH3tD/hNcvSls/0ozsK7HwUsAspMgM536OLcdD52B8XH6L2eDJMyb1Ff+9lU9p8rJysni1ZaPTrfIny/lSWzcf15I+bE/KRKkYvz937NYW8KtN0eB76iabOP34mQ2ABuLXvioz9E1YVinFLd1GN3c4xQ5XbD+tdFca8ncqyzeByoae+YK0pzUMWICpmiRQbCpRMiZ2418rCrfX4S8vt6D3X1tcMFNtdffZC5+cojrq2gYqBxlxGj+PCymcJFQe5W7oNn2tijtvac60+v/lW6vvPMiVVxS5hMyacbBMhruU/69EC/0A6SkcdjPPwJEBNc/NS2kwbUB7qid0MJHZ9oob8+sb5eXnDt81kun74z0KnW5u4TGtk5nm3w8lE95DLiPJndhKDdlaNvYEklYqqtXtk3pUbWuO6TUu5XDCBneIzNbKp8kEGzlgcYG2zB8UrsaeRTBLWnmcbzNq7OfpY+RLAGDh0tFgfbjvCOXK73wddzMeFdnl5U7qW2wNYMjIwJjQoo09IlsbUgH/U0HGyF1I30DHA7iNgfzN2UHi53Qmt0kuvNuPDHPlRk9tTrI9u/Tv3QK61wOHUA5+XjJaVx0isdfY7K7rtdn/11rowXHuwYOpRDckKJiKZ2Hjx1b0b/HXBE0Xncxa1+OnlunBkV5RpIxNQhUMUfmxZF/Kll5P8z+iFWBNfOsyg+DpdHjvvzJUgmSHZIjOzkMiWBz/698MX6xqNsZjrVc/00T+a1XRStmLUwKHjcGkwk+Pm2MfkOIM6Ljo3xz7o0DMcF1zjxTcU8TaM3DeK7enRDJl18RBwCTWcHjS+CeOc+W6zm8no41mMRQMm62KYY8NAKQinYpFZWb26vLx5nfslfSnr4ZqMRdlG76UnPT0dmHFJCku6Jw29rPYAFAxl1AP+nhZ9LBlUjX5PGfS0+2PRUN0aetLQb3d4gYrUM9wczfJWItIdhYDHsz7HzjAB/Uz5lFKCWkZRljKX9JsxQdUaUyjBfU2ojUuaZw0uw6Y2HimUyK0feg174NWSby9NSOyEZM449Mu6l+DXjw1Gh3/QcUHpx/rUVbeNmuMKlQrlecO1X7HA96hFiHiLSo0QEW91bcvUzLiMHgd7jLOdnAoZ9Ux+ceHNIdl+9FAqGIlnUx/oT8coj9mz4CVkiv1zJxHl3Nk4H4AWpwD+m9sJVbJxxfAAui7PiR1QE84egXy5v364uidSkfurs8ur+5MhgYNYMAEDPx14RaNl5XBXZcLz3s134iirH+KWDnDxIr2J2gmgSOfUbynT0un2kOukfnStilProEHhGbyC99iQ3G0YkUxSatiMcWbWG863N8rKk7rgckb5NJ7lGwvE0/yUtNeeuoX067Lx+gdOSy69MajfiW09Ly0AFoXzqWKJ3WiL67Xtpzb+6WK0LtXv78gda7ZcAmwO6sh8KRRGQSztLubC1QBHlTni3IwaQw4ivexxYIXNUJSHq9E7kc7pwt23zOGIRQhpN+nDjg6lp9oPfjoinb545DD6KqfI+1A3Tei34Sgsl3pVSSo/iFgH72yxNenN4/HgLtQy+vuRysTApDLxEkid0egR7/JOoyUVC5i6Lg36NFLglqvqirIPrfjMpyZuat8gQhOcOvSfnbMV+HpP9zI21kJs25k6ycJn6gf1WCOTVfu3dZFVKebYnYAnJmL5dOrmGTTOmc9BgVWestb5hlsFFW7+/O1RT2/9812p4F25v0O1KdydpGYTTOuF64RyHp7M2ETyHBs3uB7Jrq9hmKijaM/VRfjCIRo9ZulUgbH+vRRT3xlxyG3/oaUThJs3r9HITzDD++06S1OpHJNSyYR5w8QbdCIV4OIgc6AmU4DeYvWAtFDaH3WYKCdwoyJUWKMFTfVSmmfjReTbtuKrVpwH8gIuZ2doS8iCxfYsBmxI3osBEY2WMF0yM0VX9HSW2dU3IO3Vq1jNpkG+x4u/B+Wmd6h2A+yacU01DLl8+4G+RwgazCbcPmbMUlynPeqJ+0ddubGp3NDCcnQfe5VfS+wofo711Mip9zhSF2Pqr3y6Z1V0zxTqogSwh+t4fzkpx8M5/UYSaZagiMD3OLz12LrRZWmoaJu6isGpu9L4XPbBLn93j3MtM5dfcoWM5R1hx3yGl6yvKeUwNyMRpyChDAP+0iUOTGNidV5LEWICVGfuFc56fV5ut99PY8r4OsjnhzrWPldr64PV7tniZ7kwxrx1O3l/2KXbWRY9gjnV7K/nKsHE2D3XV+fUuvyEx9aK23lLUzmfytm/ITLDr63StTQ3Qws2t4o4z0WN1xo7tM/vCYfqnR+mpHHhyYuXrGdhQ3Q3vEcUFr6mlG+/rqGLRA/I5W4n773sToiCBVUxB38RdZ127MM59sWgHkMN8z+uHmq4rXIF3WOijYYteNNsRLx3nwfHu+EIdhDIl1c3Vw9XQ6NedlVQDIL596uzy530eZsuSD2mMnya1LVhL5QbqjkOxVkgmVzdXF08kE8odLz7bQ3dwFrhKJnqiApx5Ms39Xq6sMl6LO7sZGd2HEK9ApOpl0J+AHMM+jkbc7VVo0s7l++3gNCR4s3eUyyfBJc0fh7JOLEUGHCx7bZlPy1BQfUhWVf6jGfOMxl33EfP0ucmNyAIb+ai21V6r8xiP+lvOcG1Bv/lW72T0YDq9su3b9VnZF1/CtcYdBe5uRVHixaxwDC0fkukIj9vJOzXMQn79du36vuyxyAs1JvNmdJmapWjx2nM4VVnKag3Qecw9ZNnRMLbzYVKYuvlcvezNhYY6bItlUWJrXuwpmgGueHdzA905EN0c1SWAKepdhU3HaxBWeFCLtgR3t6k4RMdusRvWrt5PCgO6+2lxTF7e01u23t7PWPn27sMu19O2F9DtIW3ahC6WiSgNV2AJmnmG2x295WbfJxM3AMV99QMBUT5vjylpy8mHycBF4ndawmsfgm1jOsWDd2n+UdPy11OyrAN+5q8sivA3fH2a+B2QoxMWbQD2ltpsNwKC1z8oxDjQS7Yy9eBqWG1tFPgDp1mdugZ9moXMZ479SXtA97dHYsuNAAl7P6msJGByL5oGTeWM5+yofuWViHXXtNdB1bjT8kcUZBUchbtpPpdNLy5FivKWXxmjGKzbKin2wahqvKGcBjnR0JzqJjBZ44A8sb1fftG7b59Uvlt/gvyfyefbl3j9UgqBZFxpYwJNRtb6W/l4q30tuW74aN7IkLIEjt70n8PsWIrEA/ykn8dlVqEisdvifTORsszO3uZnQfpyRifCmz3LH60nuSedEw+Tj5KYZYP8pIamKQgzOfJ5SCgoyVVC/fYgWN3tR8l1o5aLzbvZuiL0SPKQcQUr8qapb/843rWlXbptiOArwe6fF+P6vL9cWA7V9+VzPNjShe9jrAHuF6Tpkp+Ywk2GS/e73GwiJDijUs3x7lj5c94W1SycGK9cGPgdD1c8VXHIioDKioJ/NxYxtRsVKWAoi6yJIGYUQO8IyWS0yKkma6YZk3vdJhQu2oT3AZG5pwtlh05jRzZUVDV2WcUgxXlRfC3oz5YVRoXadDXXshCvDoutDy3OltbA8nzbkG+u4P3FYi7/bIFsm42cB5a5nEcNqMNPIQkNevQ/GKcVqE19pzdXQf24ctWzK1wx11CAwEdhWkgCnN79AP9RvS8G4/dR8Nei5n8MfE2szJu5d4XG+S5oepQez855If57p4dOsq7PTXmdPuK4a2b8d64yQ3vzpjyRyqO9DRFX2DDs6vyhMN+qPJnUs45jR6Xko/1zET+XkoRLa5JYhepda/ILExPlGz0aN4A+1be4/ePCDrsFAie0Drg/BhMH1r4hiPsbei0TACjixdr2S4o52M80eOvkkKMe3y1IZ7deV1dGaYdaRQhgE6M4QGAMXBi2JtjzcWU38Csg/T1muFrLj6ZM1GYpJglILR7tVlrGTHc2vDgrFCepqquUnGQoq5Ssbea/vPu9uXvwQ+ZEMAnZrhzh9KDAEAMDn+Kt/XsByyybNEn5C1hIsaLp5pcfvpyi3Hoz6U/fr5zvzr/x53/SfnTq8nD2fnN9eT3q0v85VvCdNF+jHLuy64RzIYEnSP/khq6ZXPdnf6a/1F+p8dqhOfIDoi27ap9ITWeQyrD+X8BAAD//8xXL/c=" + return "eJzsfd1zGzey73v+CtS+xE7JOo6dbN3Kw6nSlze6R5YVUV7njQvONEmsMMAYwFBmav/4W2gA8z0kh5yh5FPXD1sbkQR+/YFGd6PReEMeYf0boU/6B0IMMxx+I387+zL52w+ExKAjxVLDpPiN/PcPhBDyL/qk/0USGWccSCQ5h8hocvZlQhIpmJGKiQVJwCgWaTJXMsHPLrjM4idqouXpD4Qo4EA1/EYW9AdC5gx4rH/D0d8QQRMIaOw/s07tF5XMUv+XFlDVQcoDGbrQpz/lfw7jydm/ITKlP7s/TN2nj7B+kipu/3ia0DRlYuG/+7ef/lb6Xis29++BLuzAZEV5BiSlTHn+0CdNFGiZqQj0aYMC/f50lkWPYE7tfzcoaWLdgOGWJkDknFAyeU/8qI0JY5aA0EyKF8K4j6hMZVgNyD/+dOpV7vSn059+7Ik6ltmMwxigNTFLaogCkykBsZN3sRbI2d01+ZqBWjdJmjHOmVg0SCmvhC0Y/uXH+BeJpDCUCQsHCGjDEmogJtGSqgVoMpeKrGWmcKnSKJKZMISJ2qoN//LVOwNDS3+vL8EyNVdhzgs3ZeVLgTQuK/Q2qPtIv7EkSzoI8NgR/GkriItMKRDRunXypuo25r9qzBv5EUkmWMekE1ArFsFtde32mtcPgQMiqVaKSRcz2mGcJVIZ9hfEF1KbViB1xeoSaXlUmlhuNz4OQzYWVit5OTQSSW26xgxTWk53TtjOzG0zNoYMc51zEPFLZJkHdjSGVebrZNetVAnllq+fNV3AWRuuZ2ZcAZFkFuMxmNcxZzcfP4vZS1W8HNrRVK82YzfTLGv/yKgwzLRb+OdjGkr9q8d2FKZVZ+xkmjZUmWlMzf57kx2B2BFwZ1LW7YGVjQHsfmxFpltnBhEfNO+ViPeYFVVgGsOcCWbHGUxPHqGuc9uoaVD0sASiDYZP3mlMFWgQRhOKgYOllBKdQsTmDOJWnKXAZ522KeZQkKwLYsey0UQTSJXfs3UlkCDdbjnZHlCQHv55g6D/blBsTSyBbymXCpTDS2brIlDTDcc8yp3ig3zzYpiae56UI4cnUEB0pGgaooc8mv6CEcTTkkXLYoCWGNzKy5IUs/kclP0PS4dOaVT1FatBefi3yanPx9l3ETfFYTUuH7ak609LEC5SKvGf0JS1hK9rQRMZzw6SThjkSLKxP7zEKS/PDw21/NiDmbZJFkWg9Tzj9/A1A21uqLExzyld1aM10nNjbMqfeB2gK1B2C+NuLmtldI6DKAdEEyNzthEbAib0LymKP02MAprUWeGBZN6uldXMsARICorJ+LQ/QxL6bTSGhHDvJTLkk+BMwLWI4dsdqAiEoQu4U3KhQOtR1STNp7MMiWSScrC/cfaCEgFPZMHljHKiIZIipmpNmAVKmCYzsATT2DqXRhJKDJ1x6KbzTskV00wKiL8oZuCCpjRiZv1ZMDMunSJLZqAsjWmBgTxZECTyKNDL095LQEoI/t92+nei8h5o/NxEKqDx4DReSKGz5NgEBqNWENpGXOSxEbkC1b0cT1qn0ZKsZUYiKohRNHokS/lEkixa2tkwxVfmrVkqmS2WaWbscsg0bFjk3SzTWdLJspaUXg+G6Sz5Trl0ZPvQ1KxW2/D9MW103fqe+HQPKWcRtZQd0wcDTlMdKJ+BeQK7twqSpTHmnZmBhNA0BYoOBBPIsdzn0OhzWJvdOpMUYONKS5iz6CeEith52M2RqZBmCSr/hZ/M2/8t+3cL/47hsv2v4d+DokLTyNJ9IcWcs8iMpoBnXvkU2FDfc+kNhxWUvN04A+u4mQIX5XbxIjSd8zqSwh3UtOXVSDGcdMzQNAGcTvdjxUi2ShrKXyobztxxW5fLaBhnf+F6O4qhqkYD25zIDNFBbONvSy9tOzrcTGx1w3ox1Lbuab3Jnay1geRKKanG3Id7hq7OsC1AgGpmj90/KsjvDw935Ne3b4k21GR2Q4/hgAD3QoqYuXV1sYTo8QNl3Kq6Qz4icwp/bo5TEmoMJKnjVgpqLlVi13VA50S/YcHegYiZWJR2wgvUgmOQgLuR2/S8GKkCRGxAWIKaW1nrqLPMuJ8v6QqIkIaswZCZNXGlwQ70FGj8sFTSGA5XKxCjCfm+TfuROPgWAfqH0G3JWoccKEQO5I+t5r05UPKYOUuYac9mSUFoXlVFXmnrf1NdYYlwLHjdzQO07y9TD6o2fkxF8NveR/rNrgq90WU+zFQEh3lzfgS5YqOrGWC8ZDc0Krr3Mzc6005bSCxBo9GgacrXzuy8iSFBp9lySVs2tTNpk2Ut2PRgR7mxLtoLZlihEY7U9lC2ljOV8zKnyQepmswzBasjmupyrVKH20nj4AR4wDuoK9KT6Q0mvE0eX9zueEyBtPpiL1siDvKoInnRgnh+W/KRfitFGai/XXHVmAmMw+KpJVssoVG/5P41xqrp/hY978O4zhjteThXV8N2ppV/smGN7sm1vAZnVvad+h+Sw0wf8Xz86nxyWLnC0Afj/5Q8S3Bhnq+tNTs86A9JL83+QsUBGi3d+pCpjXeZFOUo1meh0UVMjXV5VwhJ2zCRRstwrHnLjJJvZtQaOCa0oSKCE/K0tPIxpYxCrbwn/LklCb4tYHaswaU3Km/cMvgumWP15lM6BGeswTGYJaz5gTlfNKZ+GxDtFw1LNuzYJTmOh7UmxAPB/pFBBjcgFmY5EN4aV+3mXte7PIn1RJlBDZTWpfAFCahZB5D0kEe8RXnFQLRVN6rr//pUlkMKym8p5NX1p7vJaxIDZytQ4KDnsrQfVna5uYuvfQ7v6nziF98p+WzX2RMzy3KdgRtgMrnM16gUfL2NLeUT6VFU1NdpbxC8Jq9EUd1tJHn369//p+YYvS6OEzdrwTC8Oc+UNueUWzs2ADcKTP/AnCsnd5lKpQaE9GqRvnt9QgoFJZ9SwxLkxu+Xl+SVNj+/dgdSF5KHv0U/v64S4+iNwS79ueUnLio6k5jpa9PSSEFsnc5XVtMsCILXYnIYlc+1+Rkh4MQKEspE6aBtZhnWuAzXrnJ4GIPJQSuwTamg/c2hW3Ha6olzfijnDXvuApeBzIsF4FJdR6aqsZqGJOs65scgaCNGV4cmpJefalLsnORsljBjymf/uY8evTvMR4/eHdNHv3h3mI8epdkpcvo0bRSGO+J1RDnE0zmXtP6FHWqLq5aEci4jPIO/uniHepcZKKcGqAJ/x89wG1SRTEM4Hw3OYvt9O0uIM0JTvPTTSsu2C48d9dG5Dl7cfc4tXb6wythwI7bfykqB7za8M7d5jIIYKN6DLQN3jBYF5iXVNmZVGcREM/sXZsgT1YTTTKDjjjadKlMvlikTozOV8kxPj0CUn6pKER5O4aFUYfIEyQRmjkqxhjMR9mcXd58vcAS/e/ub4kyTv0DJXSnVU3cPtJ43GIhUpKWVYLtWhDQkpSwmsXwSluSmvJ034MyKWWbWgEYZeos0zo8xHQntJAswT1I9njJxmlK7ae93mbid0rqV9zMQBRGwlVU9gTuXB0GYMKDmNALdWHpMhPYI1plpCwq7KZqmoKYaohEsYJO2kpuPttx6XTuTuZkimZkjCqk/+j2EVCLpf4uUmDidrc3ul/Kdi/4bafvRHuLDYY62wnC2o0jO0VWSW38St6vi8wvuaKvuGSU31IqLmX5k8tRGA8eTHEotLDLq3XxLRS4PbaSCIj+6oozjyYKR+8qtQehIcjsvyCqJa28KNxKDsduziK1c1nQUuZVIHVVwgbCS7PakcbsaynQwHwRFU6Qp6smZYy8wmW6WUn8KLzppG2KV9cnrtCrmeKJsZqSOu+TGFGWDtsNX3T6SdCW5p9ESosepK2sdiNR7SKUy2kbUWPpZQbqkmqRUY5GHNMvqh6FM2GLy1yeAaCyArn7mc8acakMSJjKzO5FTN96RaR2DkDDPM5DSLrFdick3i0gq+z9d7YmsW7eA+n2b/qk5qXxvsu07Vf4pS+gCTln7mti7p8L1ZTixw/FdsZORPqXWB1+RAT61Mhiw98O1iFmExeFBE2Iwruy9lHZmmoCwtqjDnOZAU8VW1MBpLPRUHNB9rSOR7EYnl7cT15fNs7cRGeyIktWrT7wm1v/cA9r13eoXQuNYgdaEai0jhrluPM3bC2s24ywai6E4eIOfO2qlhzYgFwPjPI4ra1xYRK7v8k9eWQa/JjOZuQ10H5biEjqNZNzOzb0NEY5b5+GJq4D/+e9vZsyQTGi2EJiJxkl2Qjq83FuRklepu6hC/kNUJoT7f3qZGcPE4g1ml/9DDKiECdTp/1iPBRsBhf8L8estFJmldW6dv2VN9VhbgZ8H3a2wLbQc9PHDOtYAP2azmqub9j41z1aMd06jRxDxhRTC+dwDXVyrijLKhy+zVUhTasbC1wS0oTPO9NI6m/72JTooksbEn0Sp3M9UsGDaYFVN0M0NtcG/PzzcXcgYpp7i6bs//xyYSrw99+7PP4kCnUqhwd2fC5fusFj1QNDvxwH9flTQv4wD+pdRQf86DuhfRwF9dXM+JpcjzqwNA2saELSuom6s0R0hj8hjDWoFahDI/o7ZMBc+64WRvv6xyKQg3MJaJrTrBi66SivKN9xEThnncgVqOOjNetlw/y636vmV+xlENNOuGlhnChtrgjuYt+Z+g44A5Wa5/l0Gph9636XK9KUbvlhg5VWHTj52G9lROyaWsnLx7BBgO9n8ChWcW7QC1Ou6trx6uCh/mtcXBK9QySyU2dIGH7pp/CxGFkkmhhXKcG1eCmlgXZrvSXJCmAiVbCfOLcSqXvuVpsOCDqAp7uw79reYepIJw3gjYaOMSzpoyD0fv4EsgcagNuwQeev1s5vzs8iwFRSenhPkMCwquqlXnD5fA0asWpb1lCIUxzi3uegQCTZ9vZy91Y/s96lagNmR/FD2fHPxeahy5zaqqyBrd71e3Vx8fl2+MXeW5g0FyI395flW3S7TdAtPx5OngKeGIMse+/GkeaekDRpgsAtEXST7A+0w3e5Cy/tgF189NFCtDnXEmLVE7osLX9tt2hiezguwZhc49sPN5BYW0jCah+tjuKYPN5MKkdj5u+w9+6AANS5mMUbzuTkglGjQGluKhrRplWDffIniROimbw4aph/YN4in937rm45B89xO8SbfXWkjY1FkK7aAvYeYKYjMKDCVH3wQgJ8Vn96whJnpFXbMgPiImCOZ8Vj8aKqXvsqBw+f7m3BMlcsFi8+tajn3xwYU3K4dZQcV5P/8z47h5/s//xyF1lJKxRFtsboYFKmWii0w/9phDHYP+MeD3xH2D4n/1zHxd+QABsX/9u2I+N++HRH4uzGBvxsR+Psxgb8fEfgvYwL/ZUjg13erv9cc7DH8qRbXuukk4C1xC2gz3BEzdHb4Iv2SVyL3yyC2hGljsPTZA7SXpja/IEGb9efepyvHENC2A7DWVGmVlCV2eXJ9F5jRLQ16SkM/bw67EEov/mccrlaUZ664bmhwGd+uLgu2Atf2zqXnlDWbvlGFJ4YKspTZhiU+QnZpr5zSpixp7XLAoQmJYpgjJiNu3aQvNBHxgcunIdNwG5IQcy6fNHlVPQB43bTx22x2Dfj04eJufPB2lxqNgJvJEQi4mYxGwOfLI0jg8+VwEvgebF8D8/i5tDr3rc4sqYj1kj4GN923J/YHvKLAUjS8D2G43Updtiwc8G10OAtTNJar2aE+Gz1Op0oho7NTE+kyLbi4R3Odu9f00DS9EEf5hDAR8QyPhh8u7v7r+m77iWIV+mgCaYFfVv1NTwygPL6LlV2myK9vp00bqLu4mzrbNb0HDUMmmJtFBxoMeXU/eXhdvSruLjDlBwByR9hXN+fPgnnfuh+L2SnTs7Pasdex2rH92apngrkr+rxIoVmMdQy+iOMZC0k2ocuLTJoREafJLKYHRUNuiCNGQjc44cuKgq7Fyp/NDO8I2o1VOx9vnoniUAVvtnyDKDOuLidsaKVnHt3H7qxWxOX/9M/z6owbdycvH3rLkaQvkx6aSFYwcH9sl0DjGzAG1GAoP0hFqF6LaKmkkNh9JgA9cRc4anJy2ll5dwPLl6ggsMq3jRho/IYjVF8cOMvc1rlhg78EbZjAuS9dX8X1B8p4pgYpBRmN0hz0TjRmaqgXcfBSTt6R0ZeoUdO2knQKIs69Lnzk0xOx/b2LMddCrcyUYotZ/8zGhpMBY7d9qc4G6fpp9cLJ07+N4R/Qztdp6BDh3h3TTll8w7T8lqWCSKo4xApbWHuRh+tXucUanMu5BhSVl0XZaKEI4F7x2LCzWx9GrTCRPgbqD7416pcJuYdFy2p0CAvw7pXaSgQRaPXfiqX40TccC+CLFEm0wY0ptRltpXZYn6aXhIgUlY6ye9MT7dz0fReKUHpkBQpLgux/cEb9GnHt2uR8G1tJzFYsLtz4erPZDrKLboV9GVD2ZoY9ltjFlxlQkvlFgOenyGpwTFVVQu7Vac47Rci0byLZcphBzYIaeKLrww4z8mE6XHi07RfFG/ru4cDokWCbSsuC27MH4sewrjh1bUDcbqFb/fRnfJ0eszfX4oOSScmfGlgpah3K/Lot8yk/bC75Rxt6NBegJ8jW58Ebkn9MOIX/593FFsyfMvMgx+Zz3mzL93NugPdH/ruzGmGPyGl/MWIj2l7MLg7xz5w7Pu5ZfuH04zWtDkp2gXtVJJjHLj8o57J7I8aA8k4qc8ZDFeYoG0ldGbBQ1D0Z5HdzQoMjnkq1wYkO7axlNrIyeK8MX5PFfqxQqqXxJeLu0n5oBhRz/5cN+7lLBl4qmY6BPuQaY4U3/1ss3lZoY+8hjU6yB+8iFeCjWLedMfcybh73yHtJoynsELtJGfqoHB98R2m/YDLGHc/S4by3FvVavq3WOoBW8WEPVKn4mA9U3V8e+EDVQc3vQ6tJ3+H+hw1S26U1ft+m8f+/yf2xm9zH1NAZ1TAtLa1RyAkT1a5RNd96zJHN8hZxp1SJVlB79Qvy7wndh2d9b2kCr87ub1+jCrjX0mK9HVTEqW7n1V6wLsoWpty8KrwoQUVMEkikWheFP4ghfPHyfFsj0xJ6FoMwbM4aXYmGIIFasao3OktTziAuhF/MeuqewCz+QJgjPRPsawYWgNP3/Bt22F4kuu5+w5E38d0mHM6wPZVaTzGdU9rdpXOKRzvTGFKzbMV2cONpmRlMLNkt5vqTJq8U0Pi/Kg+y6tflR8Yong06B4bpx3bsof/kVz51V4mmdAHCTP8tZ+NYDF8zMvnjhkzc3aUzOyGxE5abgGxt2DhXAHTGYepWz1G7nRcJ2aL9qaIilkngugfViXyqjVR0ccSe0R2wPQ6i086OdL4ef5ppiKcY+7kLjlMWD6kjoey/NAO5vgwvpmj3YIrFcOquawOeQ95JbRYKJn/ctIOX3HrvU//UP8LWXJopp4vTZDYgfE4XCzyT949QuuucOGv+GbqZUuNZtwGVoJH/cnaDBiYPpXrRZ63AlMmt3YH3tD/hLcvSls/0ozsK7HwSsAspMgM536OHcdD52B8XH6L2eDJMyb1Ff+9lU9p8rJysni1ZaPPrfIny/lSWzcf15I+bE/KRKkYvz93rNYW8KtN0eB76iabOP34mQ2ABuLXvSoz9A1YVinFLd1GN3c4xQ5XbD+tdFca8ncqyzeByoae+XK0pzUMWICpmiRQbCpRMiZ2418rCrfX4S8vt6D3X1tcMFNtdffZC5+cojrq2gYqBxlxGj+PCymcJFQe5W7oNn2thjtvac60+v/lWqvvPMiVVxS5hKyacbBMhruE/69EA/0A6SkcdjPPwIEBNc/NC2kwbUB7qid0MJPZ8oob8+sb5eXm7t81kum74z0KnW5u4TGtk5nm3w8lE95DLiPJndhKDdlaNvYEklYqqtXti3pUbWuO6TUu5XDCBfeIzNbKp8kEGzlgcYG2zB8UbsaeRTBLWnmcbzNq7OfpY+RLAGDh0NFgfbjvCOXK73wddzMeFdnl5U7qU2wNYMjIwJjQoo09IlsbUgH/S0HGyF1I30DHA7iNgfy92UHi53QmN0ktvNuOzHPlRk9tTrI9u/Tv3PK61wOHUAx+XjJaVp0isdfY7K7rtdn/11rowXHuwYOpRDckKJiKZ2Hjx1b0b/HXBE0Xncxa1+OnlunBkV5RpIxNQhUMUfmxZF/Kll5P8z+iFWBNfOsyg+DZdHjvvzJUgmSHZIjOzkMiWBz/698MX6xqNsZjrVc/00T+Z1XRStmLUwKHjcGkwk+Pm2MfkOIM6Ljo3xz7o0DMcF1zjvTcU8TaM3LeJ7enRDJl18RBwCTWcHjS+CeOc+V6zm8no41mMRQMm62KYY7tAKQinYpFZWb26vLx5nfslfSnr4ZqMRdlG76UnPT0dmHFJCku6Jw29rPYAFAxl1AP+nhZ9LBlUjX5PGfS0+2PRUN0aetLQb3d4gYrUM9wczfJWItIdhYDHsz7HzjAB/Uz5lFKCWkZRljKX9JsxQdUaUyjBfU2ojUuaZw0uw6Y2HimUyK0feg174NWSby9NSOyEZM449Mu6l+DXjw1Gh3/QcUHpx/rUVbeNmuMKlQrlecO1X7HA16hFiHiLSo0QEW91bcvUzLiMHgd7irOdnAoZ9Ux+ceHNIdl+9FAqGIlnUx/oT8coj9mz4CVkiv1jJxHl3Nk4H4AWpwD+m9sJVbJxxfAAui7PiR1QE84egXy5v364uidSkfurs8ur+5MhgYNYMAEDPxx4RaNl5XBXZcLz3s134iirH+KWDnDxIr2J2gmgSOfUbynT0un2kOukfnStilProEHhEbyC99iO3G0YkUxSatiMcWbWG863N8rKk7rgckb5NJ7lGwvE0/yUtNeeuoX067Lx+gdOSy69MajfiW09Ly0AFoXzqWKJ3WiL67Xtpzb+4WK0LtXv78gda7ZcAmwO6sh8KRRGQSztLubC1QBHlTni3IwaQw4ivexxYIXNUJSHq9E7kc7pwt23zOGIRQhpN+nDjg6lp9oPfjoinb545DD6KqfI+1A3Tei34Sgsl3pVSSo/h1gH72yxNenN4/HgLtQy+vuRysTApDLxEkid0egR7/JOoyUVC5i6Lg36NFLglqvqirIPrfjMpyZuat8gQhOcOnSfnbMV+HpP9y421kJs25k6ycJH6gf1WCOTVbu3dZFVKebYnYAnJmL5dOrmGTTOmc9BgVWestb5dlsFFW7+/OVRT2/9812p4F25v0O1KdydpGYTTOuF64RyHh7M2ETyHBs3uA7JrqthmKijaM/VRfjCIRo9ZulUgbH+vRRT3xdxyG3/oaUThJs3r9HITzDD6+06S1OpHJNSyYR5w8QbdCIV4OIgc6AmU4DeYvWAtFDaH3WYKCdwoyJUWKMFTfVSmmfjReSbtuKbVpwH8gIuZ2doS8iCxfYsBmxH3osBEY2WMF0yM0VX9HSW2dU3IO3Vq1jNpkG+x4u/B+Wmd6h2A+yacU01DLl8+4G+RwgazCbcPmbMUlynPeqJ+0ddubGp3NDCcnQfe5XfSuwofo711Mip9zhSF2Pqr3y6Z1V0zxTqogSwh+t4fzkpx8M5/UYSaZagiMDXOLz12LrRZWmoaJu6isGpu9L4XPbBLn93j3MtM5dfcoWM5R1hx3yGl6yvKeUwNyMRpyChDAP+0iUOTGNidV5LEWICVGfuDc56fV5ut99PY8r4OsjnhzrWPldr64PV7tniZ7kwxrx1O3l/2KXbWRY9gjnV7K/nKsHE2D3XV+fUuvyEx9aK23lLUzmfytm/ITLDr63StTQ3Qws2t4o4z0WN1xo7tM/vCYfqnR+mpHHhwYuXrGdhQ3Q3vEcUFr6llG+/rqGLRA/I5W4n773sToiCBVUxB38RdZ127MM59sWgHkMN8z+uHmq4rXIF3WOijYYteNNsRLx3nwfHu+EIdhDIl1c3Vw9XQ6NedlVQDIL596uzy530eZsuSD2mMnya1LVhL5QbqjkOxVkgmVzdXF08kE8odLz7bQ3dwFrhKJnqiApx5Ms39Xq6sMl6LO7sZGd2HEK9ApOpl0J+AHMM+jkbc7VVo0s7l++3gNCR4s3eUyyfBJc0fh7JOLEUGHCx7bZlPy1BQfUZWVf6jGfOMxl33EfP0ucmNyAIL+ai21V6rcxiP+lvOcG1Bv/lW72T0YDq9su3b9VHZF1/CtcYdBe5uRVHixaxwDC0fkukIj9vJOzXMQn79du36uuyxyAs1JvNmdJmapWjx2nM4VVnKag3Qecw9ZNnRMLLzYVKYuvlcvezNhYY6bItlUWJrXuwpmgGueHdzA905EN0c1SWAKepdhU3HaxBWeFCLtgRXt6k4RMdusRvWrt5PCgO6+2lxTF7e01u23t7PWPn27sMu19O2F9DtIW3ahC6WiSgNV2AJmnmG2x295WbfJxM3AMV99QMBUT5vjylpy8mHycBF4ndawmsfgm1jOsWDd2n+UdPy11OyrAN+5q8sivA3fH2a+B2QoxMWbQD2ltpsNwKC1z8oxDjQS7Yy9eBqWG1tFPgDp1mdugZ9moXMZ479SXtA97dHYsuNAAl7P6msJGByL5oGTeWM5+yofuWViHX3tJdB1bjT8kcUZBUchbtpPpdNLy5FivKWXxmjGKzbKiH2wahqvKCcBjnR0JzqJjBZ44A8sb1fftG7b59Uvlt/gvyfyefbl3j9UgqBZFxpYwJNRtb6W/l4q30tuW74aN7IkLIEjt70n8PsWIrEA/ykn8dlVqEisdvifTORsszO3uZnQfpyRifCmz3LH60nuSedEw+Tj5KYZYP8pIamKQgzOfJ5SCgoyVVC/fYgWN3tR8l1o5aLzbvZuiL0SPKQcQUr8qapb/843rWlXbptiOArwe6fF+P6vL9cWA7V9+VzPNjShe9jrAHuF6Tpkp+Ywk2GS/e73GwiJDijUs3x7lj5c94W1SycGK9cGPgdD1c8VXHIioDKioJ/NxYxtRsVKWAoi6yJIGYUQO8IyWS0yKkma6YZk3vdJhQu2oT3AZG5pwtlh05jRzZUVDV2WcUgxXlRfC3oz5YVRoXadDXXshCvDoutDy3OltbA8nzbkG+u4P3FYi7/bIFsm42cB5a5nEcNqMNPIQkNevQ/GKcVqE19pzdXQf24ctWzK1wx11CAwEdhWkgCnN79AP9RvS8G4/dR8Nei5n8MfE2szJu5d4XG+S5oepQez855If57p4dOsq7PTXmdPuK4a2b8d64yQ3vzpjyRyqO9DRFX2DDs6vyhMN+qPJnUs45jR6Xko/1zET+XkoRLa5JYhepda/ILExPlGz0aN4A+1be4/ePCDrsFAie0Drg/BhMH1r4hiPsbei0TACjixdr2S4o52M80eOvkkKMe3y1IZ7deV1dGaYdaRQhgE6M4QGAMXBi2JtjzcWU38Csg/T1muFrLj6ZM1GYpJglILR7tVlrGTHc2vDgrFCepqquUnGQoq5Ssbea/vPu9uXvwQ+ZEMAnZrhzh9KDAEAMDn+Kt/XsByyybNEn5C1hIsaLp5pcfvpyi3Hoz6U/fr5zvzr/x53/SfnTq8nD2fnN9eT3q0v85VvCdNF+jHLuy64RzIYEnSP/khq6ZXPdnf6a/1F+p8dqhOfIDoi27ap9ITWeQyrD+X8BAAD//yKjLyM=" } diff --git a/x-pack/metricbeat/module/aws/lambda/_meta/fields.yml b/x-pack/metricbeat/module/aws/lambda/_meta/fields.yml index 91becec6fef..74db186c905 100644 --- a/x-pack/metricbeat/module/aws/lambda/_meta/fields.yml +++ b/x-pack/metricbeat/module/aws/lambda/_meta/fields.yml @@ -2,7 +2,7 @@ type: group description: > `lambda` contains the metrics that were scraped from AWS CloudWatch which contains monitoring metrics sent by AWS Lambda. - release: beta + release: ga fields: - name: metrics type: group From 5f8f3528d3d96b2dbed6c8c0ae2da5e27d2ba30b Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Thu, 24 Sep 2020 10:14:15 +0300 Subject: [PATCH 048/216] Fix dev guide test command (#21254) Signed-off-by: chrismark --- docs/devguide/modules-dev-guide.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/devguide/modules-dev-guide.asciidoc b/docs/devguide/modules-dev-guide.asciidoc index b8aa133f1f8..b3a8cb22592 100644 --- a/docs/devguide/modules-dev-guide.asciidoc +++ b/docs/devguide/modules-dev-guide.asciidoc @@ -486,6 +486,6 @@ locally for a specific module, using the following procedure under Filebeat dire . Run an Elasticsearch instance locally using docker: `docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:8.0.0-SNAPSHOT` . Create python env: `make python-env` -. Source python env: `./build/python-env/bin/activate` +. Source python env: `source ./build/python-env/bin/activate` . Create the testing binary: `make filebeat.test` . Run the test, ie: `GENERATE=1 INTEGRATION_TESTS=1 BEAT_STRICT_PERMS=false TESTING_FILEBEAT_MODULES=nginx pytest tests/system/test_modules.py` From fab73dd058e152ac67918893d9f74bcc6aac1bbf Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Thu, 24 Sep 2020 10:17:39 +0300 Subject: [PATCH 049/216] Fix prometheus default config (#21253) Signed-off-by: chrismark --- x-pack/metricbeat/metricbeat.reference.yml | 21 +++++++++---------- .../module/prometheus/_meta/config.yml | 21 +++++++++---------- .../modules.d/prometheus.yml.disabled | 21 +++++++++---------- 3 files changed, 30 insertions(+), 33 deletions(-) diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index 2c38df1fffc..507d8492485 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -1106,6 +1106,16 @@ metricbeat.modules: # Store counter rates instead of original cumulative counters (experimental, default: false) #rate_counters: true +# Metrics sent by a Prometheus server using remote_write option +#- module: prometheus +# metricsets: ["remote_write"] +# host: "localhost" +# port: "9201" + + # Secure settings for the server using TLS/SSL: + #ssl.certificate: "/etc/pki/server/cert.pem" + #ssl.key: "/etc/pki/server/cert.key" + # Use Elasticsearch histogram type to store histograms (beta, default: false) # This will change the default layout and put metric type in the field name #use_types: true @@ -1118,17 +1128,6 @@ metricbeat.modules: # counter_patterns: [] # histogram_patterns: [] - -# Metrics sent by a Prometheus server using remote_write option -#- module: prometheus -# metricsets: ["remote_write"] -# host: "localhost" -# port: "9201" - - # Secure settings for the server using TLS/SSL: - #ssl.certificate: "/etc/pki/server/cert.pem" - #ssl.key: "/etc/pki/server/cert.key" - # Metrics that will be collected using a PromQL #- module: prometheus # metricsets: ["query"] diff --git a/x-pack/metricbeat/module/prometheus/_meta/config.yml b/x-pack/metricbeat/module/prometheus/_meta/config.yml index cd54c01383a..789e7937252 100644 --- a/x-pack/metricbeat/module/prometheus/_meta/config.yml +++ b/x-pack/metricbeat/module/prometheus/_meta/config.yml @@ -20,6 +20,16 @@ # Store counter rates instead of original cumulative counters (experimental, default: false) #rate_counters: true +# Metrics sent by a Prometheus server using remote_write option +#- module: prometheus +# metricsets: ["remote_write"] +# host: "localhost" +# port: "9201" + + # Secure settings for the server using TLS/SSL: + #ssl.certificate: "/etc/pki/server/cert.pem" + #ssl.key: "/etc/pki/server/cert.key" + # Use Elasticsearch histogram type to store histograms (beta, default: false) # This will change the default layout and put metric type in the field name #use_types: true @@ -32,17 +42,6 @@ # counter_patterns: [] # histogram_patterns: [] - -# Metrics sent by a Prometheus server using remote_write option -#- module: prometheus -# metricsets: ["remote_write"] -# host: "localhost" -# port: "9201" - - # Secure settings for the server using TLS/SSL: - #ssl.certificate: "/etc/pki/server/cert.pem" - #ssl.key: "/etc/pki/server/cert.key" - # Metrics that will be collected using a PromQL #- module: prometheus # metricsets: ["query"] diff --git a/x-pack/metricbeat/modules.d/prometheus.yml.disabled b/x-pack/metricbeat/modules.d/prometheus.yml.disabled index 5dbe163c62a..d6e00936b2a 100644 --- a/x-pack/metricbeat/modules.d/prometheus.yml.disabled +++ b/x-pack/metricbeat/modules.d/prometheus.yml.disabled @@ -23,6 +23,16 @@ # Store counter rates instead of original cumulative counters (experimental, default: false) #rate_counters: true +# Metrics sent by a Prometheus server using remote_write option +#- module: prometheus +# metricsets: ["remote_write"] +# host: "localhost" +# port: "9201" + + # Secure settings for the server using TLS/SSL: + #ssl.certificate: "/etc/pki/server/cert.pem" + #ssl.key: "/etc/pki/server/cert.key" + # Use Elasticsearch histogram type to store histograms (beta, default: false) # This will change the default layout and put metric type in the field name #use_types: true @@ -35,17 +45,6 @@ # counter_patterns: [] # histogram_patterns: [] - -# Metrics sent by a Prometheus server using remote_write option -#- module: prometheus -# metricsets: ["remote_write"] -# host: "localhost" -# port: "9201" - - # Secure settings for the server using TLS/SSL: - #ssl.certificate: "/etc/pki/server/cert.pem" - #ssl.key: "/etc/pki/server/cert.key" - # Metrics that will be collected using a PromQL #- module: prometheus # metricsets: ["query"] From c0463f998c58ebc886655ab6e70746944c8eb94b Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 24 Sep 2020 09:51:15 +0200 Subject: [PATCH 050/216] Fix librpm installation in auditbeat build (#21239) Fix installation of librpm-dev from the Auditbeat build scripts by forcing the installation of a dependecy that is already installed for a different architecture. It fails for some ARM platforms, where requested packages are already installed in the base images, but for a different architecture. --- x-pack/auditbeat/magefile.go | 50 +++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/x-pack/auditbeat/magefile.go b/x-pack/auditbeat/magefile.go index f484cbb371d..989f8e6d7b6 100644 --- a/x-pack/auditbeat/magefile.go +++ b/x-pack/auditbeat/magefile.go @@ -132,13 +132,13 @@ var ( "linux/386": installLinux386, "linux/amd64": installLinuxAMD64, "linux/arm64": installLinuxARM64, - "linux/armv5": installLinuxARMLE, - "linux/armv6": installLinuxARMLE, + "linux/armv5": installLinuxARMEL, + "linux/armv6": installLinuxARMEL, "linux/armv7": installLinuxARMHF, "linux/mips": installLinuxMIPS, - "linux/mipsle": installLinuxMIPSLE, - "linux/mips64le": installLinuxMIPS64LE, - "linux/ppc64le": installLinuxPPC64LE, + "linux/mipsle": installLinuxMIPSEL, + "linux/mips64le": installLinuxMIPS64EL, + "linux/ppc64le": installLinuxPPC64EL, "linux/s390x": installLinuxS390X, //"linux/ppc64": installLinuxPpc64, @@ -148,49 +148,56 @@ var ( const ( librpmDevPkgName = "librpm-dev" + + // Dependency of librpm-dev in ARM architectures, that needs to be explicitly + // installed to replace other conflicting packages pre-installed in the image. + libicuDevPkgName = "libicu-dev" ) func installLinuxAMD64() error { - return installDependencies(librpmDevPkgName, "") + return installDependencies("", librpmDevPkgName) } func installLinuxARM64() error { - return installDependencies(librpmDevPkgName+":arm64", "arm64") + return installDependencies("arm64", librpmDevPkgName+":arm64") } func installLinuxARMHF() error { - return installDependencies(librpmDevPkgName+":armhf", "armhf") + return installDependencies("armhf", librpmDevPkgName+":armhf", libicuDevPkgName+":armhf") } -func installLinuxARMLE() error { - return installDependencies(librpmDevPkgName+":armel", "armel") +func installLinuxARMEL() error { + return installDependencies("armel", librpmDevPkgName+":armel", libicuDevPkgName+":armel") } func installLinux386() error { - return installDependencies(librpmDevPkgName+":i386", "i386") + return installDependencies("i386", librpmDevPkgName+":i386") } func installLinuxMIPS() error { - return installDependencies(librpmDevPkgName+":mips", "mips") + return installDependencies("mips", librpmDevPkgName+":mips") } -func installLinuxMIPS64LE() error { - return installDependencies(librpmDevPkgName+":mips64el", "mips64el") +func installLinuxMIPS64EL() error { + return installDependencies("mips64el", librpmDevPkgName+":mips64el") } -func installLinuxMIPSLE() error { - return installDependencies(librpmDevPkgName+":mipsel", "mipsel") +func installLinuxMIPSEL() error { + return installDependencies("mispel", librpmDevPkgName+":mipsel") } -func installLinuxPPC64LE() error { - return installDependencies(librpmDevPkgName+":ppc64el", "ppc64el") +func installLinuxPPC64EL() error { + return installDependencies("ppc64el", librpmDevPkgName+":ppc64el") } func installLinuxS390X() error { - return installDependencies(librpmDevPkgName+":s390x", "s390x") + return installDependencies("s390x", librpmDevPkgName+":s390x") } -func installDependencies(pkg, arch string) error { +func installDependencies(arch string, pkgs ...string) error { + if len(pkgs) == 0 { + return nil + } if arch != "" { err := sh.Run("dpkg", "--add-architecture", arch) if err != nil { @@ -206,5 +213,6 @@ func installDependencies(pkg, arch string) error { return err } - return sh.Run("apt-get", "install", "-y", "--no-install-recommends", pkg) + args := append([]string{"install", "-y", "--no-install-recommends"}, pkgs...) + return sh.Run("apt-get", args...) } From d8a993773780546a0cb8a7c51efa9b55b06a229f Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Thu, 24 Sep 2020 10:42:53 +0200 Subject: [PATCH 051/216] [Ingest Manager] Enabled dev builds (#21241) [Ingest Manager] Enabled dev builds (#21241) --- x-pack/elastic-agent/magefile.go | 23 +++++++++++++++++++++++ x-pack/elastic-agent/pkg/agent/cmd/run.go | 5 +++++ 2 files changed, 28 insertions(+) diff --git a/x-pack/elastic-agent/magefile.go b/x-pack/elastic-agent/magefile.go index ec6e76a0995..a4a5f314869 100644 --- a/x-pack/elastic-agent/magefile.go +++ b/x-pack/elastic-agent/magefile.go @@ -81,6 +81,9 @@ type Format mg.Namespace // Demo runs agent out of container. type Demo mg.Namespace +// Dev runs package and build for dev purposes. +type Dev mg.Namespace + // Env returns information about the environment. func (Prepare) Env() { mg.Deps(Mkdir("build"), Build.GenerateConfig) @@ -88,6 +91,26 @@ func (Prepare) Env() { RunGo("env") } +// Build builds the agent binary with DEV flag set. +func (Dev) Build() { + dev := os.Getenv(devEnv) + defer os.Setenv(devEnv, dev) + + os.Setenv(devEnv, "true") + devtools.DevBuild = true + mg.Deps(Build.All) +} + +// Package packages the agent binary with DEV flag set. +func (Dev) Package() { + dev := os.Getenv(devEnv) + defer os.Setenv(devEnv, dev) + + os.Setenv(devEnv, "true") + devtools.DevBuild = true + Package() +} + // InstallGoLicenser install go-licenser to check license of the files. func (Prepare) InstallGoLicenser() error { return GoGet(goLicenserRepo) diff --git a/x-pack/elastic-agent/pkg/agent/cmd/run.go b/x-pack/elastic-agent/pkg/agent/cmd/run.go index a7b56a664ba..77beeb6fe1a 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/run.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/run.go @@ -23,6 +23,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/cli" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) func newRunCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStreams) *cobra.Command { @@ -82,6 +83,10 @@ func run(flags *globalFlags, streams *cli.IOStreams) error { // Windows: Mark se return err } + if allowEmptyPgp, _ := release.PGP(); allowEmptyPgp { + logger.Warn("Artifact has been build with security disabled. Elastic Agent will not verify signatures of used artifacts.") + } + execPath, err := os.Executable() if err != nil { return err From 0c8f82b62d9a3b3ab4d2aa4b4da7c31065de33b1 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 24 Sep 2020 12:06:47 +0200 Subject: [PATCH 052/216] Fix autodiscover flaky tests (#21242) Use a tagged image instead of doing an untagged pull, this was pulling all busybox tags, busybox:latest image used now is pre-cached. Better control when the containers are started and stopped, run the container detached. Use container name instead of container image for conditions and templates, better ensuring that we are testing against the proper container. Move common code to helper function. --- filebeat/tests/system/test_autodiscover.py | 113 ++++++++++----------- 1 file changed, 52 insertions(+), 61 deletions(-) diff --git a/filebeat/tests/system/test_autodiscover.py b/filebeat/tests/system/test_autodiscover.py index 0f8b44b0750..62dd7916437 100644 --- a/filebeat/tests/system/test_autodiscover.py +++ b/filebeat/tests/system/test_autodiscover.py @@ -1,8 +1,10 @@ -import os +import docker import filebeat +import os import unittest from beat.beat import INTEGRATION_TESTS +from contextlib import contextmanager class TestAutodiscover(filebeat.BaseTest): @@ -16,47 +18,30 @@ def test_docker(self): """ Test docker autodiscover starts input """ - import docker - docker_client = docker.from_env() - - self.render_config_template( - inputs=False, - autodiscover={ - 'docker': { - 'cleanup_timeout': '0s', - 'templates': ''' - - condition: - equals.docker.container.image: busybox - config: - - type: log - paths: - - %s/${data.docker.container.image}.log - ''' % self.working_dir, + with self.container_running() as container: + self.render_config_template( + inputs=False, + autodiscover={ + 'docker': { + 'cleanup_timeout': '0s', + 'templates': f''' + - condition: + equals.docker.container.name: {container.name} + config: + - type: log + paths: + - %s/${{data.docker.container.name}}.log + ''' % self.working_dir, + }, }, - }, - ) + ) - with open(os.path.join(self.working_dir, 'busybox.log'), 'wb') as f: - f.write(b'Busybox output 1\n') - - proc = self.start_beat() - docker_client.images.pull('busybox') - docker_client.containers.run('busybox', 'sleep 1') + proc = self.start_beat() + self._test(container) - self.wait_until(lambda: self.log_contains('Starting runner: input')) self.wait_until(lambda: self.log_contains('Stopping runner: input')) - - output = self.read_output_json() proc.check_kill_and_wait() - # Check metadata is added - assert output[0]['message'] == 'Busybox output 1' - assert output[0]['container']['image']['name'] == 'busybox' - assert output[0]['docker']['container']['labels'] == {} - assert 'name' in output[0]['container'] - - self.assert_fields_are_documented(output[0]) - @unittest.skipIf(not INTEGRATION_TESTS or os.getenv("TESTING_ENVIRONMENT") == "2x", "integration test not available on 2.x") @@ -64,41 +49,47 @@ def test_default_settings(self): """ Test docker autodiscover default config settings """ - import docker - docker_client = docker.from_env() - - self.render_config_template( - inputs=False, - autodiscover={ - 'docker': { - 'cleanup_timeout': '0s', - 'hints.enabled': 'true', - 'hints.default_config': ''' - type: log - paths: - - %s/${data.container.image}.log - ''' % self.working_dir, + with self.container_running() as container: + self.render_config_template( + inputs=False, + autodiscover={ + 'docker': { + 'cleanup_timeout': '0s', + 'hints.enabled': 'true', + 'hints.default_config': ''' + type: log + paths: + - %s/${data.container.name}.log + ''' % self.working_dir, + }, }, - }, - ) + ) + proc = self.start_beat() + self._test(container) - with open(os.path.join(self.working_dir, 'busybox.log'), 'wb') as f: - f.write(b'Busybox output 1\n') + self.wait_until(lambda: self.log_contains('Stopping runner: input')) + proc.check_kill_and_wait() - proc = self.start_beat() - docker_client.images.pull('busybox') - docker_client.containers.run('busybox', 'sleep 1') + def _test(self, container): + with open(os.path.join(self.working_dir, f'{container.name}.log'), 'wb') as f: + f.write(b'Busybox output 1\n') self.wait_until(lambda: self.log_contains('Starting runner: input')) - self.wait_until(lambda: self.log_contains('Stopping runner: input')) + self.wait_until(lambda: self.output_has(lines=1)) output = self.read_output_json() - proc.check_kill_and_wait() # Check metadata is added assert output[0]['message'] == 'Busybox output 1' - assert output[0]['container']['image']['name'] == 'busybox' - assert output[0]['docker']['container']['labels'] == {} + assert output[0]['container']['name'] == container.name + assert output[0]['docker']['container']['labels'] == container.labels assert 'name' in output[0]['container'] self.assert_fields_are_documented(output[0]) + + @contextmanager + def container_running(self, image_name='busybox:latest'): + docker_client = docker.from_env() + container = docker_client.containers.run(image_name, 'sleep 60', detach=True, remove=True) + yield container + container.remove(force=True) From 6bd70908fec6b338d9e0a5a41cf4c58a116416ab Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 24 Sep 2020 13:47:28 +0200 Subject: [PATCH 053/216] Stop running auditbeat container as root by default (#21202) Stop running Auditbeat container as root by default. After this change, when user root is required it will need to be explicitly set on runtime. This is already done in Kubernetes manifests and some other examples in the documentation, so change is probably not so breaking. Also `USER root` is usually not enough to be fully privileged, so some customization was always expected when running Auditbeat on docker. --- CHANGELOG.next.asciidoc | 1 + auditbeat/docs/running-on-docker.asciidoc | 2 +- auditbeat/magefile.go | 2 +- auditbeat/scripts/mage/package.go | 1 - x-pack/auditbeat/magefile.go | 2 +- 5 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 145d7ae09e5..01517e07245 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -28,6 +28,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - File integrity dataset (macOS): Replace unnecessary `file.origin.raw` (type keyword) with `file.origin.text` (type `text`). {issue}12423[12423] {pull}15630[15630] - Change event.kind=error to event.kind=event to comply with ECS. {issue}18870[18870] {pull}20685[20685] - Change network.direction values to ECS recommended values (inbound, outbound). {issue}12445[12445] {pull}20695[20695] +- Docker container needs to be explicitly run as user root for auditing. {pull}21202[21202] *Filebeat* diff --git a/auditbeat/docs/running-on-docker.asciidoc b/auditbeat/docs/running-on-docker.asciidoc index 74007cdeb35..dee50fa254a 100644 --- a/auditbeat/docs/running-on-docker.asciidoc +++ b/auditbeat/docs/running-on-docker.asciidoc @@ -10,5 +10,5 @@ It is also essential to run {beatname_uc} in the host PID namespace. ["source","sh",subs="attributes"] ---- -docker run --cap-add=AUDIT_CONTROL,AUDIT_READ --pid=host {dockerimage} +docker run --cap-add=AUDIT_CONTROL --cap-add=AUDIT_READ --user=root --pid=host {dockerimage} ---- diff --git a/auditbeat/magefile.go b/auditbeat/magefile.go index 73110b17354..bc99856a890 100644 --- a/auditbeat/magefile.go +++ b/auditbeat/magefile.go @@ -92,7 +92,7 @@ func Package() { // TestPackages tests the generated packages (i.e. file modes, owners, groups). func TestPackages() error { - return devtools.TestPackages(devtools.WithRootUserContainer()) + return devtools.TestPackages() } // Update is an alias for running fields, dashboards, config, includes. diff --git a/auditbeat/scripts/mage/package.go b/auditbeat/scripts/mage/package.go index fbda2077f4f..09591705121 100644 --- a/auditbeat/scripts/mage/package.go +++ b/auditbeat/scripts/mage/package.go @@ -95,7 +95,6 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) { args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.reference.yml", referenceConfig) sampleRulesTarget = "/etc/{{.BeatName}}/" + defaultSampleRulesTarget case devtools.Docker: - args.Spec.ExtraVar("user", "root") default: panic(errors.Errorf("unhandled package type: %v", pkgType)) } diff --git a/x-pack/auditbeat/magefile.go b/x-pack/auditbeat/magefile.go index 989f8e6d7b6..7484e6465b7 100644 --- a/x-pack/auditbeat/magefile.go +++ b/x-pack/auditbeat/magefile.go @@ -84,7 +84,7 @@ func Package() { // TestPackages tests the generated packages (i.e. file modes, owners, groups). func TestPackages() error { - return devtools.TestPackages(devtools.WithRootUserContainer()) + return devtools.TestPackages() } // Update is an alias for running fields, dashboards, config. From a9db1b1f9421eb7372ae74faa8f6cd455148de94 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 24 Sep 2020 13:50:22 +0200 Subject: [PATCH 054/216] Stop running agent container as root by default (#21213) Stop running Elastic Agent as root by default on docker image. When root user or other privileges are required, they will need to be explicitly configured at run time. This already happens now, except for the root user. Provided Kubernetes manifests already use security context to run as user 0. --- dev-tools/packaging/packages.yml | 2 +- .../templates/docker/Dockerfile.elastic-agent.tmpl | 8 +++++++- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 2 ++ x-pack/elastic-agent/magefile.go | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml index 1cfd2402193..dbfbc9f4b7a 100644 --- a/dev-tools/packaging/packages.yml +++ b/dev-tools/packaging/packages.yml @@ -340,7 +340,7 @@ shared: buildFrom: 'centos:7' dockerfile: 'Dockerfile.elastic-agent.tmpl' docker_entrypoint: 'docker-entrypoint.elastic-agent.tmpl' - user: 'root' + user: '{{ .BeatName }}' linux_capabilities: '' files: 'elastic-agent.yml': diff --git a/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl b/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl index 5e6c0fcd6cd..7ab87f6f3ec 100644 --- a/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl +++ b/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl @@ -12,6 +12,8 @@ RUN mkdir -p {{ $beatHome }}/data {{ $beatHome }}/data/elastic-agent-{{ commit_s chown -R root:root {{ $beatHome }} && \ find {{ $beatHome }} -type d -exec chmod 0750 {} \; && \ find {{ $beatHome }} -type f -exec chmod 0640 {} \; && \ + find {{ $beatHome }}/data -type d -exec chmod 0770 {} \; && \ + find {{ $beatHome }}/data -type f -exec chmod 0660 {} \; && \ rm {{ $beatBinary }} && \ ln -s {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/elastic-agent {{ $beatBinary }} && \ chmod 0750 {{ $beatHome }}/data/elastic-agent-*/elastic-agent && \ @@ -21,7 +23,7 @@ RUN mkdir -p {{ $beatHome }}/data {{ $beatHome }}/data/elastic-agent-{{ commit_s {{- range $i, $modulesd := .ModulesDirs }} chmod 0770 {{ $beatHome}}/{{ $modulesd }} && \ {{- end }} - chmod 0770 {{ $beatHome }}/data {{ $beatHome }}/data/elastic-agent-{{ commit_short }}/logs + true FROM {{ .from }} @@ -69,6 +71,10 @@ RUN chmod 755 /usr/local/bin/docker-entrypoint COPY --from=home {{ $beatHome }} {{ $beatHome }} +# Elastic Agent needs group permissions in the home itself to be able to +# create fleet.yml when running as non-root. +RUN chmod 0770 {{ $beatHome }} + RUN mkdir /licenses COPY --from=home {{ $beatHome }}/LICENSE.txt /licenses COPY --from=home {{ $beatHome }}/NOTICE.txt /licenses diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index d9475d35be3..4178cfcbf62 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -7,6 +7,8 @@ ==== Breaking changes +- Docker container is not run as root by default. {pull}21213[21213] + ==== Bugfixes ==== New features diff --git a/x-pack/elastic-agent/magefile.go b/x-pack/elastic-agent/magefile.go index a4a5f314869..7296e8189be 100644 --- a/x-pack/elastic-agent/magefile.go +++ b/x-pack/elastic-agent/magefile.go @@ -336,7 +336,7 @@ func requiredPackagesPresent(basePath, beat, version string, requiredPackages [] // TestPackages tests the generated packages (i.e. file modes, owners, groups). func TestPackages() error { - return devtools.TestPackages(devtools.WithRootUserContainer()) + return devtools.TestPackages() } // RunGo runs go command and output the feedback to the stdout and the stderr. From aad07ad22fdba8c9c7a145dbe3c8b28a943b083a Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 24 Sep 2020 17:54:36 +0100 Subject: [PATCH 055/216] [CI] Pipeline 2.0 for monorepos (#20104) --- .ci/jobs/beats-mbp-2.0.yml | 59 - .ci/scripts/generate_build_table.py | 52 + .ci/scripts/get-vendor-dependencies.sh | 16 + .ci/scripts/install-tools.sh | 7 + Jenkinsfile | 1610 ++++++------------------ Jenkinsfile.yml | 47 + README.md | 11 + auditbeat/Jenkinsfile.yml | 34 + deploy/kubernetes/Jenkinsfile.yml | 15 + filebeat/Jenkinsfile.yml | 33 + generator/Jenkinsfile.yml | 43 + heartbeat/Jenkinsfile.yml | 32 + journalbeat/Jenkinsfile.yml | 17 + libbeat/Jenkinsfile.yml | 20 + metricbeat/Jenkinsfile.yml | 40 + packetbeat/Jenkinsfile.yml | 32 + winlogbeat/Jenkinsfile.yml | 21 + x-pack/auditbeat/Jenkinsfile.yml | 33 + x-pack/dockerlogbeat/Jenkinsfile.yml | 18 + x-pack/elastic-agent/Jenkinsfile.yml | 32 + x-pack/filebeat/Jenkinsfile.yml | 33 + x-pack/functionbeat/Jenkinsfile.yml | 32 + x-pack/libbeat/Jenkinsfile.yml | 17 + x-pack/metricbeat/Jenkinsfile.yml | 35 + x-pack/packetbeat/Jenkinsfile.yml | 20 + x-pack/winlogbeat/Jenkinsfile.yml | 20 + 26 files changed, 1070 insertions(+), 1259 deletions(-) delete mode 100644 .ci/jobs/beats-mbp-2.0.yml create mode 100755 .ci/scripts/generate_build_table.py create mode 100755 .ci/scripts/get-vendor-dependencies.sh create mode 100755 .ci/scripts/install-tools.sh create mode 100644 Jenkinsfile.yml create mode 100644 auditbeat/Jenkinsfile.yml create mode 100644 deploy/kubernetes/Jenkinsfile.yml create mode 100644 filebeat/Jenkinsfile.yml create mode 100644 generator/Jenkinsfile.yml create mode 100644 heartbeat/Jenkinsfile.yml create mode 100644 journalbeat/Jenkinsfile.yml create mode 100644 libbeat/Jenkinsfile.yml create mode 100644 metricbeat/Jenkinsfile.yml create mode 100644 packetbeat/Jenkinsfile.yml create mode 100644 winlogbeat/Jenkinsfile.yml create mode 100644 x-pack/auditbeat/Jenkinsfile.yml create mode 100644 x-pack/dockerlogbeat/Jenkinsfile.yml create mode 100644 x-pack/elastic-agent/Jenkinsfile.yml create mode 100644 x-pack/filebeat/Jenkinsfile.yml create mode 100644 x-pack/functionbeat/Jenkinsfile.yml create mode 100644 x-pack/libbeat/Jenkinsfile.yml create mode 100644 x-pack/metricbeat/Jenkinsfile.yml create mode 100644 x-pack/packetbeat/Jenkinsfile.yml create mode 100644 x-pack/winlogbeat/Jenkinsfile.yml diff --git a/.ci/jobs/beats-mbp-2.0.yml b/.ci/jobs/beats-mbp-2.0.yml deleted file mode 100644 index 3ccc435c8bd..00000000000 --- a/.ci/jobs/beats-mbp-2.0.yml +++ /dev/null @@ -1,59 +0,0 @@ ---- -- job: - name: Beats/beats-mbp-2.0 - display-name: 'Beats (2.0)' - description: 'Beats Main Pipeline 2.0' - view: Beats - concurrent: true - project-type: multibranch - prune-dead-branches: true - days-to-keep: 30 - script-path: '.ci/Jenkinsfile' - triggers: [] - wrappers: [] - scm: - - github: - branch-discovery: 'no-pr' - discover-pr-forks-strategy: 'merge-current' - discover-pr-forks-trust: 'permission' - discover-pr-origin: 'merge-current' - head-filter-regex: '(master|7\.[x789]|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' - discover-tags: true - disable-pr-notifications: true - notification-context: "beats-ci-2.0" - repo: 'beats' - repo-owner: 'elastic' - credentials-id: github-app-beats-ci - ssh-checkout: - credentials: f6c7695a-671e-4f4f-a331-acdce44ff9ba - build-strategies: - - tags: - ignore-tags-older-than: -1 - ignore-tags-newer-than: 365 - - change-request: - ignore-target-only-changes: true - - named-branches: - - exact-name: - name: 'master' - case-sensitive: true - - regex-name: - regex: '7\.[x789]' - case-sensitive: true - - regex-name: - regex: '8\.\d+' - case-sensitive: true - clean: - after: true - before: true - prune: true - shallow-clone: true - depth: 3 - do-not-fetch-tags: true - submodule: - disable: false - recursive: true - parent-credentials: true - timeout: 100 - timeout: '15' - use-author: true - wipe-workspace: true diff --git a/.ci/scripts/generate_build_table.py b/.ci/scripts/generate_build_table.py new file mode 100755 index 00000000000..21fe5d67107 --- /dev/null +++ b/.ci/scripts/generate_build_table.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 + +import os +import yaml + +if __name__ == "__main__": + + print("| Beat | Stage | Command | MODULE | Platforms | When |") + print("|-------|--------|----------|---------|------------|------|") + for root, dirs, files in os.walk("."): + dirs.sort() + for file in files: + if file.endswith("Jenkinsfile.yml") and root != ".": + with open(os.path.join(root, file), 'r') as f: + doc = yaml.load(f, Loader=yaml.FullLoader) + module = root.replace(".{}".format(os.sep), '') + platforms = [doc["platform"]] + when = "" + if "branches" in doc["when"]: + when = f"{when}/:palm_tree:" + if "changeset" in doc["when"]: + when = f"{when}/:file_folder:" + if "comments" in doc["when"]: + when = f"{when}/:speech_balloon:" + if "labels" in doc["when"]: + when = f"{when}/:label:" + if "parameters" in doc["when"]: + when = f"{when}/:smiley:" + if "tags" in doc["when"]: + when = f"{when}/:taco:" + for stage in doc["stages"]: + withModule = False + if "make" in doc["stages"][stage]: + command = doc["stages"][stage]["make"] + if "mage" in doc["stages"][stage]: + command = doc["stages"][stage]["mage"] + if "platforms" in doc["stages"][stage]: + platforms = doc["stages"][stage]["platforms"] + if "withModule" in doc["stages"][stage]: + withModule = doc["stages"][stage]["withModule"] + if "when" in doc["stages"][stage]: + when = f"{when}/:star:" + print("| {} | {} | `{}` | {} | `{}` | {} |".format( + module, stage, command, withModule, platforms, when)) + +print("> :palm_tree: -> Git Branch based") +print("> :label: -> GitHub Pull Request Label based") +print("> :file_folder: -> Changeset based") +print("> :speech_balloon: -> GitHub Pull Request comment based") +print("> :taco: -> Git tag based") +print("> :smiley: -> Manual UI interaction based") +print("> :star: -> More specific cases based") diff --git a/.ci/scripts/get-vendor-dependencies.sh b/.ci/scripts/get-vendor-dependencies.sh new file mode 100755 index 00000000000..e002a208b76 --- /dev/null +++ b/.ci/scripts/get-vendor-dependencies.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +# +# Given the go module it will list all the dependencies that will be later on +# used by the CI to enable/disable specific stages as long as the changeset +# matches any of those patterns. +# + +GO_VERSION=${GO_VERSION:?"GO_VERSION environment variable is not set"} +BEATS=${1:?"parameter missing."} +eval "$(gvm "${GO_VERSION}")" + +go list -deps ./"${BEATS}" \ +| grep 'elastic/beats' \ +| sort \ +| sed -e "s#github.com/elastic/beats/v7/##g" \ +| awk '{print "^" $1 "/.*"}' diff --git a/.ci/scripts/install-tools.sh b/.ci/scripts/install-tools.sh new file mode 100755 index 00000000000..297a7820cad --- /dev/null +++ b/.ci/scripts/install-tools.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash +set -exuo pipefail + +.ci/scripts/install-go.sh +.ci/scripts/install-docker-compose.sh +.ci/scripts/install-terraform.sh +make mage diff --git a/Jenkinsfile b/Jenkinsfile index b0f90c07b0b..e7f91ef95e5 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -3,20 +3,6 @@ @Library('apm@current') _ import groovy.transform.Field - - -/** - NOTE: Important note regarding the agents and labels. - agent labels are defined in the gobld service, that's managed by infra. The required format - is: - - ' && immutable' for linux OS. - - 'macosx' for the MacOS. - - 'windows-immutable && windows-' for Windows. NOTE: version might differ in some cases - - The above labels will help to set what OS family and specific version of the agent is - required to used in the stage. -*/ - /** This is required to store the stashed id with the test results to be digested with runbld */ @@ -25,20 +11,19 @@ import groovy.transform.Field pipeline { agent { label 'ubuntu-18 && immutable' } environment { + AWS_ACCOUNT_SECRET = 'secret/observability-team/ci/elastic-observability-aws-account-auth' BASE_DIR = 'src/github.com/elastic/beats' - GOX_FLAGS = "-arch amd64" - DOCKER_COMPOSE_VERSION = "1.21.0" - TERRAFORM_VERSION = "0.12.24" - PIPELINE_LOG_LEVEL = "INFO" DOCKERELASTIC_SECRET = 'secret/observability-team/ci/docker-registry/prod' + DOCKER_COMPOSE_VERSION = "1.21.0" DOCKER_REGISTRY = 'docker.elastic.co' - AWS_ACCOUNT_SECRET = 'secret/observability-team/ci/elastic-observability-aws-account-auth' - RUNBLD_DISABLE_NOTIFICATIONS = 'true' + GOX_FLAGS = "-arch amd64" JOB_GCS_BUCKET = 'beats-ci-temp' JOB_GCS_CREDENTIALS = 'beats-ci-gcs-plugin' - XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' OSS_MODULE_PATTERN = '^[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' - PYTEST_ADDOPTS = "${params.PYTEST_ADDOPTS}" + PIPELINE_LOG_LEVEL = 'INFO' + RUNBLD_DISABLE_NOTIFICATIONS = 'true' + TERRAFORM_VERSION = "0.12.24" + XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' } options { timeout(time: 2, unit: 'HOURS') @@ -51,23 +36,16 @@ pipeline { rateLimitBuilds(throttle: [count: 60, durationName: 'hour', userBoost: true]) } triggers { - issueCommentTrigger('(?i)(.*(?:jenkins\\W+)?run\\W+(?:the\\W+)?tests(?:\\W+please)?.*|^/test(\\W+macos)?$)') + issueCommentTrigger('(?i)(.*(?:jenkins\\W+)?run\\W+(?:the\\W+)?tests(?:\\W+please)?.*|^/test\\W+.*$)') } parameters { - booleanParam(name: 'runAllStages', defaultValue: false, description: 'Allow to run all stages.') - booleanParam(name: 'windowsTest', defaultValue: true, description: 'Allow Windows stages.') - booleanParam(name: 'macosTest', defaultValue: false, description: 'Allow macOS stages.') booleanParam(name: 'allCloudTests', defaultValue: false, description: 'Run all cloud integration tests.') - booleanParam(name: 'awsCloudTests', defaultValue: false, description: 'Run AWS cloud integration tests.') + booleanParam(name: 'awsCloudTests', defaultValue: true, description: 'Run AWS cloud integration tests.') string(name: 'awsRegion', defaultValue: 'eu-central-1', description: 'Default AWS region to use for testing.') - booleanParam(name: 'debug', defaultValue: false, description: 'Allow debug logging for Jenkins steps') - booleanParam(name: 'dry_run', defaultValue: false, description: 'Skip build steps, it is for testing pipeline flow') - string(name: 'PYTEST_ADDOPTS', defaultValue: '', description: 'Additional options to pass to pytest. Use PYTEST_ADDOPTS="-k pattern" to only run tests matching the specified pattern. For retries you can use `--reruns 3 --reruns-delay 15`') + booleanParam(name: 'runAllStages', defaultValue: false, description: 'Allow to run all stages.') + booleanParam(name: 'macosTest', defaultValue: false, description: 'Allow macOS stages.') } stages { - /** - Checkout the code and stash it, to use it on other stages. - */ stage('Checkout') { options { skipDefaultCheckout() } steps { @@ -76,711 +54,65 @@ pipeline { gitCheckout(basedir: "${BASE_DIR}", githubNotifyFirstTimeContributor: true) stashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") dir("${BASE_DIR}"){ - loadConfigEnvVars() - } - whenTrue(params.debug){ - dumpFilteredEnvironment() + // Skip all the stages except docs for PR's with asciidoc and md changes only + setEnvVar('ONLY_DOCS', isGitRegionMatch(patterns: [ '.*\\.(asciidoc|md)' ], shouldMatchAll: true).toString()) + setEnvVar('GO_VERSION', readFile(".go-version").trim()) + withEnv(["HOME=${env.WORKSPACE}"]) { + retryWithSleep(retries: 2, seconds: 5){ sh(label: "Install Go ${env.GO_VERSION}", script: '.ci/scripts/install-go.sh') } + } } } } stage('Lint'){ options { skipDefaultCheckout() } environment { - // See https://github.com/elastic/beats/pull/19823 GOFLAGS = '-mod=readonly' } steps { - makeTarget(context: "Lint", target: "check") + withGithubNotify(context: 'Lint') { + withBeatsEnv(archive: true) { + dumpVariables() + cmd(label: 'make check', script: 'make check') + } + } } } - stage('Build and Test'){ + stage('Build&Test') { + options { skipDefaultCheckout() } when { - beforeAgent true - expression { return env.ONLY_DOCS == "false" } - } - failFast false - parallel { - stage('Elastic Agent x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ELASTIC_AGENT_XPACK != "false" - } - } - steps { - mageTarget(context: "Elastic Agent x-pack Linux", directory: "x-pack/elastic-agent", target: "build test") - } - } - stage('Elastic Agent x-pack Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ELASTIC_AGENT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Elastic Agent x-pack Windows Unit test", directory: "x-pack/elastic-agent", target: "build unitTest") - } - } - stage('Elastic Agent Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ELASTIC_AGENT_XPACK != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Elastic Agent x-pack Mac OS X", directory: "x-pack/elastic-agent", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Filebeat oss'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT != "false" - } - } - steps { - mageTarget(context: "Filebeat oss Linux", directory: "filebeat", target: "build test", withModule: true) - } - } - stage('Filebeat x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Filebeat x-pack Linux", directory: "x-pack/filebeat", target: "build test", withModule: true) - } - } - stage('Filebeat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Filebeat oss Mac OS X", directory: "filebeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Filebeat x-pack Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT_XPACK != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Filebeat x-pack Mac OS X", directory: "x-pack/filebeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Filebeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Filebeat oss Windows Unit test", directory: "filebeat", target: "build unitTest") - } - } - stage('Filebeat x-pack Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FILEBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Filebeat x-pack Windows", directory: "x-pack/filebeat", target: "build unitTest") - } - } - stage('Heartbeat oss'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_HEARTBEAT != "false" - } - } - steps { - mageTarget(context: "Heartbeat oss Linux", directory: "heartbeat", target: "build test") - } - } - stage('Heartbeat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ON_MACOS != 'false' && env.BUILD_HEARTBEAT != "false" - } - } - steps { - mageTarget(context: "Heartbeat oss Mac OS X", directory: "heartbeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Heartbeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest && env.BUILD_HEARTBEAT != "false" - } - } - steps { - mageTargetWin(context: "Heartbeat oss Windows Unit test", directory: "heartbeat", target: "build unitTest") - } - } - stage('Auditbeat oss Linux'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT != "false" - } - } - steps { - mageTarget(context: "Auditbeat oss Linux", directory: "auditbeat", target: "build test") - } - } - stage('Auditbeat crosscompile'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT != "false" - } - } - steps { - makeTarget(context: "Auditbeat oss crosscompile", directory: 'auditbeat', target: "crosscompile") - } - } - stage('Auditbeat oss Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Auditbeat oss Mac OS X", directory: "auditbeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Auditbeat oss Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Auditbeat oss Windows Unit test", directory: "auditbeat", target: "build unitTest") - } - } - stage('Auditbeat x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Auditbeat x-pack Linux", directory: "x-pack/auditbeat", target: "update build test", withModule: true) - } - } - stage('Auditbeat x-pack Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT_XPACK != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Auditbeat x-pack Mac OS X", directory: "x-pack/auditbeat", target: "build unitTest") - } - } - stage('Auditbeat x-pack Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_AUDITBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Auditbeat x-pack Windows", directory: "x-pack/auditbeat", target: "build unitTest") - } - } - stage('Libbeat'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_LIBBEAT != "false" - } - } - stages { - stage('Libbeat oss'){ - steps { - mageTarget(context: "Libbeat oss Linux", directory: "libbeat", target: "build test") - } - } - stage('Libbeat crosscompile'){ - steps { - makeTarget(context: "Libbeat oss crosscompile", directory: 'libbeat', target: "crosscompile") - } - } - stage('Libbeat stress-tests'){ - steps { - makeTarget(context: "Libbeat stress-tests", target: "STRESS_TEST_OPTIONS='-timeout=20m -race -v -parallel 1' -C libbeat stress-tests") - } - } - } - } - stage('Libbeat x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_LIBBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Libbeat x-pack Linux", directory: "x-pack/libbeat", target: "build test") + // Always when running builds on branches/tags + // On a PR basis, skip if changes are only related to docs. + // Always when forcing the input parameter + anyOf { + not { changeRequest() } // If no PR + allOf { // If PR and no docs changes + expression { return env.ONLY_DOCS == "false" } + changeRequest() } + expression { return params.runAllStages } // If UI forced } - stage('Metricbeat OSS Unit tests'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" - } - } - steps { - mageTarget(context: "Metricbeat OSS linux/amd64 (unitTest)", directory: "metricbeat", target: "build unitTest") - } - } - stage('Metricbeat OSS Go Integration tests'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" - } - } - steps { - mageTarget(context: "Metricbeat OSS linux/amd64 (goIntegTest)", directory: "metricbeat", target: "goIntegTest", withModule: true) - } - } - stage('Metricbeat OSS Python Integration tests'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" - } - } - steps { - mageTarget(context: "Metricbeat OSS linux/amd64 (pythonIntegTest)", directory: "metricbeat", target: "pythonIntegTest", withModule: true) - } - } - stage('Metricbeat x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT_XPACK != "false" - } - } - stages { - stage('Prepare cloud integration tests environments'){ - options { skipDefaultCheckout() } - steps { - startCloudTestEnv('x-pack-metricbeat', [ - [cond: params.awsCloudTests, dir: 'x-pack/metricbeat/module/aws'], - ]) - } - } - stage('Metricbeat x-pack'){ - options { skipDefaultCheckout() } - steps { - withCloudTestEnv() { - mageTarget(context: "Metricbeat x-pack Linux", directory: "x-pack/metricbeat", target: "build test", withModule: true) - } - } - } - } - post { - cleanup { - terraformCleanup('x-pack-metricbeat', 'x-pack/metricbeat') - } - } - } - stage('Metricbeat crosscompile'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" - } - } - steps { - makeTarget(context: "Metricbeat OSS crosscompile", directory: 'metricbeat', target: "crosscompile") - } - } - stage('Metricbeat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Metricbeat OSS Mac OS X", directory: "metricbeat", target: "build unitTest") - } - } - stage('Metricbeat x-pack Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT_XPACK != "false" && env.BUILD_ON_MACOS != 'false' - } - } - steps { - mageTarget(context: "Metricbeat x-pack Mac OS X", directory: "x-pack/metricbeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Metricbeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Metricbeat Windows Unit test", directory: "metricbeat", target: "build unitTest") - } - } - stage('Metricbeat x-pack Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_METRICBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin(context: "Metricbeat x-pack Windows", directory: "x-pack/metricbeat", target: "build unitTest") - } - } - stage('Packetbeat Linux'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_PACKETBEAT != "false" - } - } - steps { - mageTarget(context: "Packetbeat OSS Linux", directory: "packetbeat", target: "build test") - } - } - stage('Packetbeat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ON_MACOS != 'false' && env.BUILD_PACKETBEAT != "false" - } - } - steps { - mageTarget(context: "Packetbeat OSS Mac OS X", directory: "packetbeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Packetbeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest && env.BUILD_PACKETBEAT != "false" - } - } - steps { - mageTargetWin(context: "Packetbeat OSS Windows", directory: "packetbeat", target: "build unitTest") - } - } - stage('dockerlogbeat'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_DOCKERLOGBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Elastic Docker Logging Driver Plugin unit tests", directory: "x-pack/dockerlogbeat", target: "build test") - } - } - stage('Winlogbeat oss'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_WINLOGBEAT != "false" - } - } - steps { - makeTarget(context: "Winlogbeat oss crosscompile", directory: 'winlogbeat', target: "crosscompile") - } - } - stage('Winlogbeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest && env.BUILD_WINLOGBEAT != "false" - } - } - steps { - mageTargetWin(context: "Winlogbeat Windows Unit test", directory: "winlogbeat", target: "build unitTest") - } - } - stage('Winlogbeat Windows x-pack'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest && env.BUILD_WINLOGBEAT_XPACK != "false" - } - } - steps { - mageTargetWin(context: "Winlogbeat Windows Unit test", directory: "x-pack/winlogbeat", target: "build unitTest", withModule: true) - } - } - stage('Functionbeat x-pack'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_FUNCTIONBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Functionbeat x-pack Linux", directory: "x-pack/functionbeat", target: "update build test") - withEnv(["GO_VERSION=1.13.1"]){ - mageTarget(context: "Functionbeat x-pack Linux", directory: "x-pack/functionbeat", target: "testGCPFunctions") - } - } - } - stage('Functionbeat Mac OS X x-pack'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ON_MACOS != 'false' && env.BUILD_FUNCTIONBEAT_XPACK != "false" - } - } - steps { - mageTarget(context: "Functionbeat x-pack Mac OS X", directory: "x-pack/functionbeat", target: "build unitTest") - } - post { - always { - delete() - } - } - } - stage('Functionbeat Windows'){ - agent { label 'windows-immutable && windows-2019' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest && env.BUILD_FUNCTIONBEAT_XPACK != "false" - } - } - steps { - mageTargetWin(context: "Functionbeat Windows Unit test", directory: "x-pack/functionbeat", target: "build unitTest") - } - } - stage('Journalbeat'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_JOURNALBEAT != "false" - } - } - steps { - mageTarget(context: "Journalbeat Linux", directory: "journalbeat", target: "build unitTest") - } - } - stage('Generators'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_GENERATOR != "false" - } - } - stages { - stage('Generators Metricbeat Linux'){ - steps { - makeTarget(context: "Generators Metricbeat Linux", directory: 'generator/_templates/metricbeat', target: "test") - makeTarget(context: "Generators Metricbeat Linux", directory: 'generator/_templates/metricbeat', target: "test-package") - } - } - stage('Generators Beat Linux'){ - steps { - makeTarget(context: "Generators Beat Linux", directory: 'generator/_templates/beat', target: "test") - makeTarget(context: "Generators Beat Linux", directory: 'generator/_templates/beat', target: "test-package") + } + steps { + deleteDir() + unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") + dir("${BASE_DIR}"){ + script { + def mapParallelTasks = [:] + def content = readYaml(file: 'Jenkinsfile.yml') + content['projects'].each { projectName -> + generateStages(project: projectName, changeset: content['changeset']).each { k,v -> + mapParallelTasks["${k}"] = v } } + parallel(mapParallelTasks) } } - stage('Generators Metricbeat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ON_MACOS != 'false' && env.BUILD_GENERATOR != "false" - } - } - steps { - makeTarget(context: "Generators Metricbeat Mac OS X", directory: 'generator/_templates/metricbeat', target: "test") - } - post { - always { - delete() - } - } - } - stage('Generators Beat Mac OS X'){ - agent { label 'macosx' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_ON_MACOS != 'false' && env.BUILD_GENERATOR != "false" - } - } - steps { - makeTarget(context: "Generators Beat Mac OS X", directory: 'generator/_templates/beat', target: "test") - } - post { - always { - delete() - } - } - } - stage('Kubernetes'){ - agent { label 'ubuntu-18 && immutable' } - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return env.BUILD_KUBERNETES != "false" - } - } - steps { - k8sTest(["v1.18.2","v1.17.2","v1.16.4","v1.15.7","v1.14.10"]) + } + post { + always { + dir("${BASE_DIR}"){ + // Archive the markdown files that contain the build reasons + archiveArtifacts(allowEmptyArchive: false, artifacts: 'build-reasons/*.md') } } } @@ -796,131 +128,158 @@ pipeline { } } -def delete() { - dir("${env.BASE_DIR}") { - fixPermissions("${WORKSPACE}") +/** +* This method is the one used for running the parallel stages, therefore +* its arguments are passed by the beatsStages step. +*/ +def generateStages(Map args = [:]) { + def projectName = args.project + def changeset = args.changeset + def mapParallelStages = [:] + def fileName = "${projectName}/Jenkinsfile.yml" + if (fileExists(fileName)) { + def content = readYaml(file: fileName) + // changesetFunction argument is only required for the top-level when, stage specific when don't need it since it's an aggregation. + if (beatsWhen(project: projectName, content: content?.when, changeset: changeset, changesetFunction: new GetProjectDependencies(steps: this))) { + mapParallelStages = beatsStages(project: projectName, content: content, changeset: changeset, function: new RunCommand(steps: this)) + } + } else { + log(level: 'WARN', text: "${fileName} file does not exist. Please review the top-level Jenkinsfile.yml") } - deleteDir() -} - -def fixPermissions(location) { - sh(label: 'Fix permissions', script: """#!/usr/bin/env bash - source ./dev-tools/common.bash - docker_setup - script/fix_permissions.sh ${location}""", returnStatus: true) + return mapParallelStages } -def makeTarget(Map args = [:]) { - def context = args.context - def target = args.target - def directory = args.get('directory', '') - def clean = args.get('clean', true) - def withModule = args.get('withModule', false) - def directoryFlag = directory.trim() ? "-C ${directory}" : '' - withGithubNotify(context: "${context}") { - withBeatsEnv(archive: true, withModule: withModule, directory: directory) { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMage() - } - sh(label: "Make ${target}", script: "make ${directoryFlag} ${target}") - whenTrue(clean) { - fixPermissions("${HOME}") - } +def cloud(Map args = [:]) { + node(args.label) { + startCloudTestEnv(name: args.directory, dirs: args.dirs) + } + withCloudTestEnv() { + try { + target(context: args.context, command: args.command, directory: args.directory, label: args.label, withModule: args.withModule, isMage: true, id: args.id) + } finally { + terraformCleanup(name: args.directory, dir: args.directory) } } } -def mageTarget(Map args = [:]) { - def context = args.context - def directory = args.directory - def target = args.target - def withModule = args.get('withModule', false) - withGithubNotify(context: "${context}") { - withBeatsEnv(archive: true, withModule: withModule, directory: directory) { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMage() - } - - def verboseFlag = params.debug ? "-v" : "" - dir(directory) { - sh(label: "Mage ${target}", script: "mage ${verboseFlag} ${target}") +def k8sTest(Map args = [:]) { + def versions = args.versions + node(args.label) { + versions.each{ v -> + stage("${args.context} ${v}"){ + withEnv(["K8S_VERSION=${v}", "KIND_VERSION=v0.7.0", "KUBECONFIG=${env.WORKSPACE}/kubecfg"]){ + withGithubNotify(context: "${args.context} ${v}") { + withBeatsEnv(archive: false, withModule: false) { + retryWithSleep(retries: 2, seconds: 5, backoff: true){ sh(label: "Install kind", script: ".ci/scripts/install-kind.sh") } + retryWithSleep(retries: 2, seconds: 5, backoff: true){ sh(label: "Install kubectl", script: ".ci/scripts/install-kubectl.sh") } + try { + sh(label: "Setup kind", script: ".ci/scripts/kind-setup.sh") + sh(label: "Integration tests", script: "MODULE=kubernetes make -C metricbeat integration-tests") + sh(label: "Deploy to kubernetes",script: "make -C deploy/kubernetes test") + } finally { + sh(label: 'Delete cluster', script: 'kind delete cluster') + } + } + } + } } } } } -def mageTargetWin(Map args = [:]) { +/** +* This method runs the given command supporting two kind of scenarios: +* - make -C then the dir(location) is not required, aka by disaling isMage: false +* - mage then the dir(location) is required, aka by enabling isMage: true. +*/ +def target(Map args = [:]) { def context = args.context - def directory = args.directory - def target = args.target + def command = args.command + def directory = args.get('directory', '') def withModule = args.get('withModule', false) - withGithubNotify(context: "${context}") { - withBeatsEnvWin(withModule: withModule, directory: directory) { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMageWin() - } - - def verboseFlag = params.debug ? "-v" : "" - dir(directory) { - bat(label: "Mage ${target}", script: "mage ${verboseFlag} ${target}") + def isMage = args.get('isMage', false) + node(args.label) { + withGithubNotify(context: "${context}") { + withBeatsEnv(archive: true, withModule: withModule, directory: directory, id: args.id) { + dumpVariables() + // make commands use -C while mage commands require the dir(folder) + // let's support this scenario with the location variable. + dir(isMage ? directory : '') { + cmd(label: "${command}", script: "${command}") + } } } } } -def getModulePattern(String toCompare) { - // Use contains to support the makeTarget(target: '-C ') while mageTarget(directory: '') - return (toCompare.contains('x-pack') ? env.XPACK_MODULE_PATTERN : env.OSS_MODULE_PATTERN) -} - +/** +* This method wraps all the environment setup and pre-requirements to run any commands. +*/ def withBeatsEnv(Map args = [:], Closure body) { def archive = args.get('archive', true) def withModule = args.get('withModule', false) def directory = args.get('directory', '') - def modulePattern - if (withModule) { - modulePattern = getModulePattern(directory) + + def goRoot, path, magefile, pythonEnv, testResults, artifacts + + if(isUnix()) { + goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${nodeOS()}.amd64" + path = "${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}" + magefile = "${WORKSPACE}/.magefile" + pythonEnv = "${WORKSPACE}/python-env" + testResults = '**/build/TEST*.xml' + artifacts = '**/build/TEST*.out' + } else { + def chocoPath = 'C:\\ProgramData\\chocolatey\\bin' + def chocoPython3Path = 'C:\\Python38;C:\\Python38\\Scripts' + goRoot = "${env.USERPROFILE}\\.gvm\\versions\\go${GO_VERSION}.windows.amd64" + path = "${env.WORKSPACE}\\bin;${goRoot}\\bin;${chocoPath};${chocoPython3Path};${env.PATH}" + magefile = "${env.WORKSPACE}\\.magefile" + testResults = "**\\build\\TEST*.xml" + artifacts = "**\\build\\TEST*.out" } - def os = goos() - def goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${os}.amd64" deleteDir() unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - // NOTE: This is required to run after the unstash - def module = withModule ? getCommonModuleInTheChangeSet(modulePattern, directory) : '' - + def module = withModule ? getCommonModuleInTheChangeSet(directory) : '' withEnv([ - "HOME=${env.WORKSPACE}", + "DOCKER_PULL=0", "GOPATH=${env.WORKSPACE}", "GOROOT=${goRoot}", - "PATH=${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}", - "MAGEFILE_CACHE=${WORKSPACE}/.magefile", - "TEST_COVERAGE=true", + "HOME=${env.WORKSPACE}", + "MAGEFILE_CACHE=${magefile}", + "MODULE=${module}", + "PATH=${path}", + "PYTHON_ENV=${pythonEnv}", "RACE_DETECTOR=true", - "PYTHON_ENV=${WORKSPACE}/python-env", - "TEST_TAGS=${env.TEST_TAGS},oracle", - "DOCKER_PULL=0", - "MODULE=${module}" + "TEST_COVERAGE=true", + "TEST_TAGS=${env.TEST_TAGS},oracle" ]) { - if(isDockerInstalled()){ + if(isDockerInstalled()) { dockerLogin(secret: "${DOCKERELASTIC_SECRET}", registry: "${DOCKER_REGISTRY}") } dir("${env.BASE_DIR}") { installTools() - // TODO (2020-04-07): This is a work-around to fix the Beat generator tests. - // See https://github.com/elastic/beats/issues/17787. - setGitConfig() + if(isUnix()) { + // TODO (2020-04-07): This is a work-around to fix the Beat generator tests. + // See https://github.com/elastic/beats/issues/17787. + sh(label: 'check git config', script: ''' + if [ -z "$(git config --get user.email)" ]; then + git config user.email "beatsmachine@users.noreply.github.com" + git config user.name "beatsmachine" + fi''') + } try { - if(!params.dry_run){ - body() - } + body() } finally { if (archive) { - archiveTestOutput(testResults: '**/build/TEST*.xml', artifacts: '**/build/TEST*.out') + archiveTestOutput(testResults: testResults, artifacts: artifacts, id: args.id) + } + // Tear down the setup for the permamnent workers. + catchError(buildResult: 'SUCCESS', stageResult: 'SUCCESS') { + fixPermissions("${WORKSPACE}") + deleteDir() } } } @@ -928,8 +287,57 @@ def withBeatsEnv(Map args = [:], Closure body) { } /** - This method archives and report the tests output, for such, it searches in certain folders - to bypass some issues when working with big repositories. +* This method fixes the filesystem permissions after the build has happenend. The reason is to +* ensure any non-ephemeral workers don't have any leftovers that could cause some environmental +* issues. +*/ +def fixPermissions(location) { + if(isUnix()) { + sh(label: 'Fix permissions', script: """#!/usr/bin/env bash + set +x + source ./dev-tools/common.bash + docker_setup + script/fix_permissions.sh ${location}""", returnStatus: true) + } +} + +/** +* This method installs the required dependencies that are for some reason not available in the +* CI Workers. +*/ +def installTools() { + if(isUnix()) { + retryWithSleep(retries: 2, seconds: 5, backoff: true){ sh(label: "Install Go/Mage/Python/Docker/Terraform ${GO_VERSION}", script: '.ci/scripts/install-tools.sh') } + } else { + retryWithSleep(retries: 2, seconds: 5, backoff: true){ bat(label: "Install Go/Mage/Python ${GO_VERSION}", script: ".ci/scripts/install-tools.bat") } + } +} + +/** +* This method gathers the module name, if required, in order to run the ITs only if +* the changeset affects a specific module. +* +* For such, it's required to look for changes under the module folder and exclude anything else +* such as asciidoc and png files. +*/ +def getCommonModuleInTheChangeSet(String directory) { + // Use contains to support the target(target: 'make -C ') while target(directory: '', target: '...') + def pattern = (directory.contains('x-pack') ? env.XPACK_MODULE_PATTERN : env.OSS_MODULE_PATTERN) + def module = '' + + // Transform folder structure in regex format since path separator is required to be escaped + def transformedDirectory = directory.replaceAll('/', '\\/') + def directoryExclussion = "((?!^${transformedDirectory}\\/).)*\$" + def exclude = "^(${directoryExclussion}|((?!\\/module\\/).)*\$|.*\\.asciidoc|.*\\.png)" + dir("${env.BASE_DIR}") { + module = getGitMatchingGroup(pattern: pattern, exclude: exclude) + } + return module +} + +/** +* This method archives and report the tests output, for such, it searches in certain folders +* to bypass some issues when working with big repositories. */ def archiveTestOutput(Map args = [:]) { catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') { @@ -938,222 +346,68 @@ def archiveTestOutput(Map args = [:]) { } cmd(label: 'Prepare test output', script: 'python .ci/scripts/pre_archive_test.py') dir('build') { - junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: args.testResults) + junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: args.testResults, id: args.id) archiveArtifacts(allowEmptyArchive: true, artifacts: args.artifacts) } catchError(buildResult: 'SUCCESS', message: 'Failed to archive the build test results', stageResult: 'SUCCESS') { def folder = cmd(label: 'Find system-tests', returnStdout: true, script: 'python .ci/scripts/search_system_tests.py').trim() log(level: 'INFO', text: "system-tests='${folder}'. If no empty then let's create a tarball") if (folder.trim()) { - def name = folder.replaceAll('/', '-').replaceAll('\\\\', '-').replaceAll('build', '').replaceAll('^-', '') + '-' + goos() + def name = folder.replaceAll('/', '-').replaceAll('\\\\', '-').replaceAll('build', '').replaceAll('^-', '') + '-' + nodeOS() tar(file: "${name}.tgz", archive: true, dir: folder) } } } } -def withBeatsEnvWin(Map args = [:], Closure body) { - def withModule = args.get('withModule', false) - def directory = args.get('directory', '') - def modulePattern - if (withModule) { - modulePattern = getModulePattern(directory) - } - final String chocoPath = 'C:\\ProgramData\\chocolatey\\bin' - final String chocoPython3Path = 'C:\\Python38;C:\\Python38\\Scripts' - def goRoot = "${env.USERPROFILE}\\.gvm\\versions\\go${GO_VERSION}.windows.amd64" - - deleteDir() - unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - - // NOTE: This is required to run after the unstash - def module = withModule ? getCommonModuleInTheChangeSet(modulePattern, directory) : '' - - withEnv([ - "HOME=${env.WORKSPACE}", - "GOPATH=${env.WORKSPACE}", - "GOROOT=${goRoot}", - "PATH=${env.WORKSPACE}\\bin;${goRoot}\\bin;${chocoPath};${chocoPython3Path};${env.PATH}", - "MAGEFILE_CACHE=${env.WORKSPACE}\\.magefile", - "TEST_COVERAGE=true", - "RACE_DETECTOR=true", - "MODULE=${module}" - ]){ - dir("${env.BASE_DIR}"){ - installTools() - try { - if(!params.dry_run){ - body() - } - } finally { - archiveTestOutput(testResults: "**\\build\\TEST*.xml", artifacts: "**\\build\\TEST*.out") - } - } - } -} - -def installTools() { - def i = 2 // Number of retries - if(isUnix()) { - retryWithSleep(retries: i, seconds: 5, backoff: true){ sh(label: "Install Go ${GO_VERSION}", script: ".ci/scripts/install-go.sh") } - retryWithSleep(retries: i, seconds: 5, backoff: true){ sh(label: "Install docker-compose ${DOCKER_COMPOSE_VERSION}", script: ".ci/scripts/install-docker-compose.sh") } - retryWithSleep(retries: i, seconds: 5, backoff: true){ sh(label: "Install Terraform ${TERRAFORM_VERSION}", script: ".ci/scripts/install-terraform.sh") } - retryWithSleep(retries: i, seconds: 5, backoff: true){ sh(label: "Install Mage", script: "make mage") } - } else { - // Install python3 with the specific step, even though install-tools.bat will verify if it's there anyway. - // TODO: as soon as python3 is installed in the CI Workers we will be able to remove the line below. - retryWithSleep(retries: i, seconds: 5, backoff: true){ installTools([ [tool: 'python3', version: '3.8', exclude: 'rc'] ]) } - retryWithSleep(retries: i, seconds: 5, backoff: true){ bat(label: "Install Go/Mage/Python ${GO_VERSION}", script: ".ci/scripts/install-tools.bat") } - } -} - -def goos(){ - def labels = env.NODE_LABELS - - if (labels.contains('linux')) { - return 'linux' - } else if (labels.contains('windows')) { - return 'windows' - } else if (labels.contains('darwin')) { - return 'darwin' - } - - error("Unhandled OS name in NODE_LABELS: " + labels) -} - -def dumpMage(){ - echo "### MAGE DUMP ###" - sh(label: "Dump mage variables", script: "mage dumpVariables") - echo "### END MAGE DUMP ###" -} - -def dumpMageWin(){ - echo "### MAGE DUMP ###" - bat(label: "Dump mage variables", script: "mage dumpVariables") - echo "### END MAGE DUMP ###" -} - -def dumpFilteredEnvironment(){ - echo "### ENV DUMP ###" - echo "PATH: ${env.PATH}" - echo "HOME: ${env.HOME}" - echo "USERPROFILE: ${env.USERPROFILE}" - echo "BUILD_DIR: ${env.BUILD_DIR}" - echo "COVERAGE_DIR: ${env.COVERAGE_DIR}" - echo "BEATS: ${env.BEATS}" - echo "PROJECTS: ${env.PROJECTS}" - echo "PROJECTS_ENV: ${env.PROJECTS_ENV}" - echo "PYTHON_ENV: ${env.PYTHON_ENV}" - echo "PYTHON_EXE: ${env.PYTHON_EXE}" - echo "PYTHON_ENV_EXE: ${env.PYTHON_ENV_EXE}" - echo "VENV_PARAMS: ${env.VENV_PARAMS}" - echo "FIND: ${env.FIND}" - echo "GOLINT: ${env.GOLINT}" - echo "GOLINT_REPO: ${env.GOLINT_REPO}" - echo "REVIEWDOG: ${env.REVIEWDOG}" - echo "REVIEWDOG_OPTIONS: ${env.REVIEWDOG_OPTIONS}" - echo "REVIEWDOG_REPO: ${env.REVIEWDOG_REPO}" - echo "XPACK_SUFFIX: ${env.XPACK_SUFFIX}" - echo "PKG_BUILD_DIR: ${env.PKG_BUILD_DIR}" - echo "PKG_UPLOAD_DIR: ${env.PKG_UPLOAD_DIR}" - echo "COVERAGE_TOOL: ${env.COVERAGE_TOOL}" - echo "COVERAGE_TOOL_REPO: ${env.COVERAGE_TOOL_REPO}" - echo "TESTIFY_TOOL_REPO: ${env.TESTIFY_TOOL_REPO}" - echo "NOW: ${env.NOW}" - echo "GOBUILD_FLAGS: ${env.GOBUILD_FLAGS}" - echo "GOIMPORTS: ${env.GOIMPORTS}" - echo "GOIMPORTS_REPO: ${env.GOIMPORTS_REPO}" - echo "GOIMPORTS_LOCAL_PREFIX: ${env.GOIMPORTS_LOCAL_PREFIX}" - echo "PROCESSES: ${env.PROCESSES}" - echo "TIMEOUT: ${env.TIMEOUT}" - echo "PYTHON_TEST_FILES: ${env.PYTHON_TEST_FILES}" - echo "PYTEST_ADDOPTS: ${env.PYTEST_ADDOPTS}" - echo "PYTEST_OPTIONS: ${env.PYTEST_OPTIONS}" - echo "TEST_ENVIRONMENT: ${env.TEST_ENVIRONMENT}" - echo "SYSTEM_TESTS: ${env.SYSTEM_TESTS}" - echo "STRESS_TESTS: ${env.STRESS_TESTS}" - echo "STRESS_TEST_OPTIONS: ${env.STRESS_TEST_OPTIONS}" - echo "TEST_TAGS: ${env.TEST_TAGS}" - echo "GOX_OS: ${env.GOX_OS}" - echo "GOX_OSARCH: ${env.GOX_OSARCH}" - echo "GOX_FLAGS: ${env.GOX_FLAGS}" - echo "TESTING_ENVIRONMENT: ${env.TESTING_ENVIRONMENT}" - echo "BEAT_VERSION: ${env.BEAT_VERSION}" - echo "COMMIT_ID: ${env.COMMIT_ID}" - echo "DOCKER_COMPOSE_PROJECT_NAME: ${env.DOCKER_COMPOSE_PROJECT_NAME}" - echo "DOCKER_COMPOSE: ${env.DOCKER_COMPOSE}" - echo "DOCKER_CACHE: ${env.DOCKER_CACHE}" - echo "GOPACKAGES_COMMA_SEP: ${env.GOPACKAGES_COMMA_SEP}" - echo "PIP_INSTALL_PARAMS: ${env.PIP_INSTALL_PARAMS}" - echo "### END ENV DUMP ###" +/** +* This method wraps the junit built-in step to archive the test reports that gonna be populated later on +* with the runbld post build step. +*/ +def junitAndStore(Map args = [:]) { + junit(args) + // args.id could be null in some cases, so let's use the currentmilliseconds + def stageName = args.id ? args.id?.replaceAll("[\\W]|_",'-') : "uncategorized-${new java.util.Date().getTime()}" + stash(includes: args.testResults, allowEmpty: true, name: stageName, useDefaultExcludes: true) + stashedTestReports[stageName] = stageName } -def k8sTest(versions){ - versions.each{ v -> - stage("k8s ${v}"){ - withEnv(["K8S_VERSION=${v}", "KIND_VERSION=v0.7.0", "KUBECONFIG=${env.WORKSPACE}/kubecfg"]){ - withGithubNotify(context: "K8s ${v}") { - withBeatsEnv(archive: false, withModule: false) { - sh(label: "Install kind", script: ".ci/scripts/install-kind.sh") - sh(label: "Install kubectl", script: ".ci/scripts/install-kubectl.sh") - sh(label: "Setup kind", script: ".ci/scripts/kind-setup.sh") - sh(label: "Integration tests", script: "MODULE=kubernetes make -C metricbeat integration-tests") - sh(label: "Deploy to kubernetes",script: "make -C deploy/kubernetes test") - sh(label: 'Delete cluster', script: 'kind delete cluster') +/** +* This method populates the test output using the runbld approach. For such it requires the +* global variable stashedTestReports. +* TODO: should be moved to the shared library +*/ +def runbld() { + catchError(buildResult: 'SUCCESS', message: 'runbld post build action failed.') { + if (stashedTestReports) { + def jobName = isPR() ? 'elastic+beats+pull-request' : 'elastic+beats' + deleteDir() + unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") + dir("${env.BASE_DIR}") { + // Unstash the test reports + stashedTestReports.each { k, v -> + dir(k) { + unstash(v) } } } + sh(label: 'Process JUnit reports with runbld', + script: """\ + ## for debugging purposes + find . -name "TEST-*.xml" + cat >./runbld-script </.*`. -* -* In addition, there are another two alternatives to report that there are -* changes, when `runAllStages` parameter is set to true or when running on a -* branch/tag basis. +* This method executes a closure with credentials for cloud test +* environments. */ -def isChanged(patterns){ - return ( - params.runAllStages // when runAllStages UI parameter is set to true - || !isPR() // when running on a branch/tag - || isGitRegionMatch(patterns: patterns, comparator: 'regexp') - ) -} - -def isChangedOSSCode(patterns) { - def allPatterns = [ - "^Jenkinsfile", - "^go.mod", - "^pytest.ini", - "^libbeat/.*", - "^testing/.*", - "^dev-tools/.*", - "^\\.ci/scripts/.*", - ] - allPatterns.addAll(patterns) - return isChanged(allPatterns) -} - -def isChangedXPackCode(patterns) { - def allPatterns = [ - "^Jenkinsfile", - "^go.mod", - "^pytest.ini", - "^libbeat/.*", - "^dev-tools/.*", - "^testing/.*", - "^x-pack/libbeat/.*", - "^\\.ci/scripts/.*", - ] - allPatterns.addAll(patterns) - return isChanged(allPatterns) -} - -// withCloudTestEnv executes a closure with credentials for cloud test -// environments. def withCloudTestEnv(Closure body) { def maskedVars = [] def testTags = "${env.TEST_TAGS}" @@ -1184,58 +438,60 @@ def withCloudTestEnv(Closure body) { } } -def terraformInit(String directory) { - dir(directory) { - sh(label: "Terraform Init on ${directory}", script: "terraform init") - } -} - -def terraformApply(String directory) { - terraformInit(directory) - dir(directory) { - sh(label: "Terraform Apply on ${directory}", script: "terraform apply -auto-approve") - } -} - -// Start testing environment on cloud using terraform. Terraform files are -// stashed so they can be used by other stages. They are also archived in -// case manual cleanup is needed. -// -// Example: -// startCloudTestEnv('x-pack-metricbeat', [ -// [cond: params.awsCloudTests, dir: 'x-pack/metricbeat/module/aws'], -// ]) -// ... -// terraformCleanup('x-pack-metricbeat', 'x-pack/metricbeat') -def startCloudTestEnv(String name, environments = []) { - withCloudTestEnv() { - withBeatsEnv(archive: false, withModule: false) { - def runAll = params.runAllCloudTests - try { - for (environment in environments) { - if (environment.cond || runAll) { +/** +* Start testing environment on cloud using terraform. Terraform files are +* stashed so they can be used by other stages. They are also archived in +* case manual cleanup is needed. +* +* Example: +* startCloudTestEnv(name: 'x-pack-metricbeat', dirs: ['x-pack/metricbeat/module/aws']) +* ... +* terraformCleanup(name: 'x-pack-metricbeat', dir: 'x-pack/metricbeat') +*/ +def startCloudTestEnv(Map args = [:]) { + String name = normalise(args.name) + def dirs = args.get('dirs',[]) + stage("${name}-prepare-cloud-env"){ + withCloudTestEnv() { + withBeatsEnv(archive: false, withModule: false) { + try { + for (folder in dirs) { retryWithSleep(retries: 2, seconds: 5, backoff: true){ - terraformApply(environment.dir) + terraformApply(folder) } } + } finally { + // Archive terraform states in case manual cleanup is needed. + archiveArtifacts(allowEmptyArchive: true, artifacts: '**/terraform.tfstate') } - } finally { - // Archive terraform states in case manual cleanup is needed. - archiveArtifacts(allowEmptyArchive: true, artifacts: '**/terraform.tfstate') + stash(name: "terraform-${name}", allowEmpty: true, includes: '**/terraform.tfstate,**/.terraform/**') } - stash(name: "terraform-${name}", allowEmpty: true, includes: '**/terraform.tfstate,**/.terraform/**') } } } +/** +* Run terraform in the given directory +*/ +def terraformApply(String directory) { + terraformInit(directory) + dir(directory) { + sh(label: "Terraform Apply on ${directory}", script: "terraform apply -auto-approve") + } +} -// Looks for all terraform states in directory and runs terraform destroy for them, -// it uses terraform states previously stashed by startCloudTestEnv. -def terraformCleanup(String stashName, String directory) { - stage("Remove cloud scenarios in ${directory}"){ +/** +* Tear down the terraform environments, by looking for all terraform states in directory +* then it runs terraform destroy for each one. +* It uses terraform states previously stashed by startCloudTestEnv. +*/ +def terraformCleanup(Map args = [:]) { + String name = normalise(args.name) + String directory = args.dir + stage("${name}-tear-down-cloud-env"){ withCloudTestEnv() { withBeatsEnv(archive: false, withModule: false) { - unstash("terraform-${stashName}") + unstash("terraform-${name}") retryWithSleep(retries: 2, seconds: 5, backoff: true) { sh(label: "Terraform Cleanup", script: ".ci/scripts/terraform-cleanup.sh ${directory}") } @@ -1244,184 +500,138 @@ def terraformCleanup(String stashName, String directory) { } } -def loadConfigEnvVars(){ - def empty = [] - env.GO_VERSION = readFile(".go-version").trim() - - withEnv(["HOME=${env.WORKSPACE}"]) { - retryWithSleep(retries: 2, seconds: 5, backoff: true){ sh(label: "Install Go ${env.GO_VERSION}", script: ".ci/scripts/install-go.sh") } - } - - // Libbeat is the core framework of Beats. It has no additional dependencies - // on other projects in the Beats repository. - env.BUILD_LIBBEAT = isChangedOSSCode(empty) - env.BUILD_LIBBEAT_XPACK = isChangedXPackCode(empty) - - // Auditbeat depends on metricbeat as framework, but does not include any of - // the modules from Metricbeat. - // The Auditbeat x-pack build contains all functionality from OSS Auditbeat. - env.BUILD_AUDITBEAT = isChangedOSSCode(getProjectDependencies('auditbeat')) - env.BUILD_AUDITBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/auditbeat')) - - // Dockerlogbeat is a standalone Beat that only relies on libbeat. - env.BUILD_DOCKERLOGBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/dockerlogbeat')) - - // Filebeat depends on libbeat only. - // The Filebeat x-pack build contains all functionality from OSS Filebeat. - env.BUILD_FILEBEAT = isChangedOSSCode(getProjectDependencies('filebeat')) - env.BUILD_FILEBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/filebeat')) - - // Metricbeat depends on libbeat only. - // The Metricbeat x-pack build contains all functionality from OSS Metricbeat. - env.BUILD_METRICBEAT = isChangedOSSCode(getProjectDependencies('metricbeat')) - env.BUILD_METRICBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/metricbeat')) - - // Functionbeat is a standalone beat that depends on libbeat only. - // Functionbeat is available as x-pack build only. - env.BUILD_FUNCTIONBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/functionbeat')) - - // Heartbeat depends on libbeat only. - // The Heartbeat x-pack build contains all functionality from OSS Heartbeat. - env.BUILD_HEARTBEAT = isChangedOSSCode(getProjectDependencies('heartbeat')) - env.BUILD_HEARTBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/heartbeat')) - - // Journalbeat depends on libbeat only. - // The Journalbeat x-pack build contains all functionality from OSS Journalbeat. - env.BUILD_JOURNALBEAT = isChangedOSSCode(getProjectDependencies('journalbeat')) - env.BUILD_JOURNALBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/journalbeat')) - - // Packetbeat depends on libbeat only. - // The Packetbeat x-pack build contains all functionality from OSS Packetbeat. - env.BUILD_PACKETBEAT = isChangedOSSCode(getProjectDependencies('packetbeat')) - env.BUILD_PACKETBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/packetbeat')) - - // Winlogbeat depends on libbeat only. - // The Winlogbeat x-pack build contains all functionality from OSS Winlogbeat. - env.BUILD_WINLOGBEAT = isChangedOSSCode(getProjectDependencies('winlogbeat')) - env.BUILD_WINLOGBEAT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/winlogbeat')) - - // Elastic-agent is a self-contained product, that depends on libbeat only. - // The agent acts as a supervisor for other Beats like Filebeat or Metricbeat. - // The agent is available as x-pack build only. - env.BUILD_ELASTIC_AGENT_XPACK = isChangedXPackCode(getProjectDependencies('x-pack/elastic-agent')) - - // The Kubernetes test use Filebeat and Metricbeat, but only need to be run - // if the deployment scripts have been updated. No Beats specific testing is - // involved. - env.BUILD_KUBERNETES = isChanged(["^deploy/kubernetes/.*"]) - - def generatorPatterns = ['^generator/.*'] - generatorPatterns.addAll(getProjectDependencies('generator/common/beatgen')) - generatorPatterns.addAll(getProjectDependencies('metricbeat/beater')) - env.BUILD_GENERATOR = isChangedOSSCode(generatorPatterns) - - // Skip all the stages for changes only related to the documentation - env.ONLY_DOCS = isDocChangedOnly() - - // Enable macOS builds when required - env.BUILD_ON_MACOS = (params.macosTest // UI Input parameter is set to true - || !isPR() // For branches and tags - || matchesPrLabel(label: 'macOS') // If `macOS` GH label (Case-Sensitive) - || (env.GITHUB_COMMENT?.toLowerCase()?.contains('/test macos'))) // If `/test macos` in the GH comment (Case-Insensitive) -} - /** - This method gathers the module name, if required, in order to run the ITs only if - the changeset affects a specific module. - - For such, it's required to look for changes under the module folder and exclude anything else - such as ascidoc and png files. +* Prepare the terraform context in the given directory */ -def getCommonModuleInTheChangeSet(String pattern, String directory) { - def module = '' - // Transform folder structure in regex format since path separator is required to be escaped - def transformedDirectory = directory.replaceAll('/', '\\/') - def directoryExclussion = "((?!^${transformedDirectory}\\/).)*\$" - def exclude = "^(${directoryExclussion}|((?!\\/module\\/).)*\$|.*\\.asciidoc|.*\\.png)" - dir("${env.BASE_DIR}") { - module = getGitMatchingGroup(pattern: pattern, exclude: exclude) +def terraformInit(String directory) { + dir(directory) { + sh(label: "Terraform Init on ${directory}", script: "terraform init") } - return module } /** - This method verifies if the changeset for the current pull request affect only changes related - to documentation, such as asciidoc and png files. +* Replace the slashes in the directory in case there are nested folders. */ -def isDocChangedOnly(){ - if (params.runAllStages || !env.CHANGE_ID?.trim()) { - log(level: 'INFO', text: 'Speed build for docs only is disabled for branches/tags or when forcing with the runAllStages parameter.') - return 'false' - } else { - log(level: "INFO", text: 'Check if the speed build for docs is enabled.') - return isGitRegionMatch(patterns: ['.*\\.(asciidoc|png)'], shouldMatchAll: true) - } +def normalise(String directory) { + return directory.replaceAll("[\\W]|_",'-') } /** - This method grab the dependencies of a Go module and transform them on regexp +* For debugging purposes. */ -def getProjectDependencies(beatName){ - def os = goos() - def goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${os}.amd64" - def output = "" - - withEnv([ - "HOME=${env.WORKSPACE}/${env.BASE_DIR}", - "PATH=${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}", - ]) { - output = sh(label: 'Get vendor dependency patterns', returnStdout: true, script: """ - go list -deps ./${beatName} \ - | grep 'elastic/beats' \ - | sed -e "s#github.com/elastic/beats/v7/##g" \ - | awk '{print "^" \$1 "/.*"}' - """) - } - return output?.split('\n').collect{ item -> item as String } -} - -def setGitConfig(){ - sh(label: 'check git config', script: ''' - if [ -z "$(git config --get user.email)" ]; then - git config user.email "beatsmachine@users.noreply.github.com" - git config user.name "beatsmachine" - fi - ''') +def dumpVariables(){ + echo "### MAGE DUMP ###" + cmd(label: 'Dump mage variables', script: 'mage dumpVariables') + echo "### END MAGE DUMP ###" + echo """ + ### ENV DUMP ### + BEAT_VERSION: ${env.BEAT_VERSION} + BEATS: ${env.BEATS} + BUILD_DIR: ${env.BUILD_DIR} + COMMIT_ID: ${env.COMMIT_ID} + COVERAGE_DIR: ${env.COVERAGE_DIR} + COVERAGE_TOOL: ${env.COVERAGE_TOOL} + COVERAGE_TOOL_REPO: ${env.COVERAGE_TOOL_REPO} + DOCKER_CACHE: ${env.DOCKER_CACHE} + DOCKER_COMPOSE_PROJECT_NAME: ${env.DOCKER_COMPOSE_PROJECT_NAME} + DOCKER_COMPOSE: ${env.DOCKER_COMPOSE} + FIND: ${env.FIND} + GOBUILD_FLAGS: ${env.GOBUILD_FLAGS} + GOIMPORTS: ${env.GOIMPORTS} + GOIMPORTS_REPO: ${env.GOIMPORTS_REPO} + GOIMPORTS_LOCAL_PREFIX: ${env.GOIMPORTS_LOCAL_PREFIX} + GOLINT: ${env.GOLINT} + GOLINT_REPO: ${env.GOLINT_REPO} + GOPACKAGES_COMMA_SEP: ${env.GOPACKAGES_COMMA_SEP} + GOX_FLAGS: ${env.GOX_FLAGS} + GOX_OS: ${env.GOX_OS} + GOX_OSARCH: ${env.GOX_OSARCH} + HOME: ${env.HOME} + NOSETESTS_OPTIONS: ${env.NOSETESTS_OPTIONS} + NOW: ${env.NOW} + PATH: ${env.PATH} + PKG_BUILD_DIR: ${env.PKG_BUILD_DIR} + PKG_UPLOAD_DIR: ${env.PKG_UPLOAD_DIR} + PIP_INSTALL_PARAMS: ${env.PIP_INSTALL_PARAMS} + PROJECTS: ${env.PROJECTS} + PROJECTS_ENV: ${env.PROJECTS_ENV} + PYTHON_ENV: ${env.PYTHON_ENV} + PYTHON_ENV_EXE: ${env.PYTHON_ENV_EXE} + PYTHON_EXE: ${env.PYTHON_EXE} + PYTHON_TEST_FILES: ${env.PYTHON_TEST_FILES} + PROCESSES: ${env.PROCESSES} + REVIEWDOG: ${env.REVIEWDOG} + REVIEWDOG_OPTIONS: ${env.REVIEWDOG_OPTIONS} + REVIEWDOG_REPO: ${env.REVIEWDOG_REPO} + STRESS_TESTS: ${env.STRESS_TESTS} + STRESS_TEST_OPTIONS: ${env.STRESS_TEST_OPTIONS} + SYSTEM_TESTS: ${env.SYSTEM_TESTS} + TESTIFY_TOOL_REPO: ${env.TESTIFY_TOOL_REPO} + TEST_ENVIRONMENT: ${env.TEST_ENVIRONMENT} + TEST_TAGS: ${env.TEST_TAGS} + TESTING_ENVIRONMENT: ${env.TESTING_ENVIRONMENT} + TIMEOUT: ${env.TIMEOUT} + USERPROFILE: ${env.USERPROFILE} + VENV_PARAMS: ${env.VENV_PARAMS} + XPACK_SUFFIX: ${env.XPACK_SUFFIX} + ### END ENV DUMP ### + """ } def isDockerInstalled(){ - return sh(label: 'check for Docker', script: 'command -v docker', returnStatus: true) + if (isUnix()) { + // TODO: some issues with macosx if(isInstalled(tool: 'docker', flag: '--version')) { + return sh(label: 'check for Docker', script: 'command -v docker', returnStatus: true) + } else { + return false + } } -def junitAndStore(Map params = [:]){ - junit(params) - // STAGE_NAME env variable could be null in some cases, so let's use the currentmilliseconds - def stageName = env.STAGE_NAME ? env.STAGE_NAME.replaceAll("[\\W]|_",'-') : "uncategorized-${new java.util.Date().getTime()}" - stash(includes: params.testResults, allowEmpty: true, name: stageName, useDefaultExcludes: true) - stashedTestReports[stageName] = stageName +/** +* This class is the one used for running the parallel stages, therefore +* its arguments are passed by the beatsStages step. +* +* What parameters/arguments are supported: +* - label -> the worker labels +* - project -> the name of the project that should match with the folder name. +* - content -> the specific stage data in the /Jenkinsfile.yml +* - context -> the name of the stage, normally -(-)? +*/ +class RunCommand extends co.elastic.beats.BeatsFunction { + public RunCommand(Map args = [:]){ + super(args) + } + public run(Map args = [:]){ + def withModule = args.content.get('withModule', false) + if(args?.content?.containsKey('make')) { + steps.target(context: args.context, command: args.content.make, directory: args.project, label: args.label, withModule: withModule, isMage: false, id: args.id) + } + if(args?.content?.containsKey('mage')) { + steps.target(context: args.context, command: args.content.mage, directory: args.project, label: args.label, withModule: withModule, isMage: true, id: args.id) + } + if(args?.content?.containsKey('k8sTest')) { + steps.k8sTest(context: args.context, versions: args.content.k8sTest.split(','), label: args.label, id: args.id) + } + if(args?.content?.containsKey('cloud')) { + steps.cloud(context: args.context, command: args.content.cloud, directory: args.project, label: args.label, withModule: withModule, dirs: args.content.dirs, id: args.id) + } + } } -def runbld() { - catchError(buildResult: 'SUCCESS', message: 'runbld post build action failed.') { - if (stashedTestReports) { - def jobName = isPR() ? 'elastic+beats+pull-request' : 'elastic+beats' - deleteDir() - unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - dir("${env.BASE_DIR}") { - // Unstash the test reports - stashedTestReports.each { k, v -> - dir(k) { - unstash(v) - } - } - } - sh(label: 'Process JUnit reports with runbld', - script: """\ - cat >./runbld-script < item as String } } } diff --git a/Jenkinsfile.yml b/Jenkinsfile.yml new file mode 100644 index 00000000000..2f720bf055b --- /dev/null +++ b/Jenkinsfile.yml @@ -0,0 +1,47 @@ +projects: + - "auditbeat" + - "deploy/kubernetes" + - "filebeat" + - "generator" + - "heartbeat" + - "journalbeat" + - "libbeat" + - "metricbeat" + - "packetbeat" + - "winlogbeat" + - "x-pack/auditbeat" + - "x-pack/dockerlogbeat" + - "x-pack/elastic-agent" + - "x-pack/filebeat" + - "x-pack/functionbeat" + - "x-pack/libbeat" + - "x-pack/metricbeat" + - "x-pack/winlogbeat" + ##- "x-pack/heartbeat" It's not yet in the 1.0 pipeline. + ##- "x-pack/journalbeat" It's not yet in the 1.0 pipeline. + ##- "x-pack/packetbeat" It's not yet in the 1.0 pipeline. + +## Changeset macros that are defined here and used in each specific 2.0 pipeline. +changeset: + ci: + - "^Jenkinsfile" + - "^\\.ci/scripts/.*" + oss: + - "^go.mod" + - "^dev-tools/.*" + - "^libbeat/.*" + - "^testing/.*" + xpack: + - "^go.mod" + - "^dev-tools/.*" + - "^libbeat/.*" + - "^testing/.*" + - "^x-pack/libbeat/.*" + +## Proposal +## TBC: This will allow to configure what to do based on the PR configuration +disabled: + when: + labels: ## Skip the GitHub Pull Request builds if there is a GitHub label match + - "skip-ci" + draft: true ## Skip the GitHub Pull Request builds with Draft PRs. diff --git a/README.md b/README.md index 28965e1734c..28fbe081d04 100644 --- a/README.md +++ b/README.md @@ -93,12 +93,16 @@ For testing purposes, we generate snapshot builds that you can find [here](https ## CI +### PR Comments + It is possible to trigger some jobs by putting a comment on a GitHub PR. (This service is only available for users affiliated with Elastic and not for open-source contributors.) * [beats][] * `jenkins run the tests please` or `jenkins run tests` or `/test` will kick off a default build. * `/test macos` will kick off a default build with also the `macos` stages. + * `/test ` will kick off the default build for the given PR in addition to the `` build itself. + * `/test for macos` will kick off a default build with also the `macos` stage for the ``. * [apm-beats-update][] * `/run apm-beats-update` * [apm-beats-packaging][] @@ -106,6 +110,13 @@ It is possible to trigger some jobs by putting a comment on a GitHub PR. * [apm-beats-tester][] * `/beats-tester` will kick of a build to validate the generated packages. +### PR Labels + +It's possible to configure the build on a GitHub PR by labelling the PR with the below labels + +* `` to force the following builds to run the stages for the `` +* `macOS` to force the following builds to run the `macos` stages. + [beats]: https://beats-ci.elastic.co/job/Beats/job/beats/ [apm-beats-update]: https://beats-ci.elastic.co/job/Beats/job/apm-beats-update/ [apm-beats-packaging]: https://beats-ci.elastic.co/job/Beats/job/packaging/ diff --git a/auditbeat/Jenkinsfile.yml b/auditbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..873e2c319f3 --- /dev/null +++ b/auditbeat/Jenkinsfile.yml @@ -0,0 +1,34 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^auditbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test auditbeat" + labels: ## when PR labels matches any of those entries + - "auditbeat" + parameters: ## when parameter was selected in the UI. + - "auditbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + crosscompile: + make: "make -C auditbeat crosscompile" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test auditbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/deploy/kubernetes/Jenkinsfile.yml b/deploy/kubernetes/Jenkinsfile.yml new file mode 100644 index 00000000000..452771edfb5 --- /dev/null +++ b/deploy/kubernetes/Jenkinsfile.yml @@ -0,0 +1,15 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^deploy/kubernetes/.*" + comments: ## when PR comment contains any of those entries + - "/test deploy/kubernetes" + labels: ## when PR labels matches any of those entries + - "kubernetes" + parameters: ## when parameter was selected in the UI. + - "kubernetes" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + k8sTest: + k8sTest: "v1.18.2,v1.17.2,v1.16.4,v1.15.7,v1.14.10" diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml new file mode 100644 index 00000000000..45b032accfb --- /dev/null +++ b/filebeat/Jenkinsfile.yml @@ -0,0 +1,33 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^filebeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test filebeat" + labels: ## when PR labels matches any of those entries + - "filebeat" + parameters: ## when parameter was selected in the UI. + - "filebeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + withModule: true ## run the ITs only if the changeset affects a specific module. + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test filebeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/generator/Jenkinsfile.yml b/generator/Jenkinsfile.yml new file mode 100644 index 00000000000..071d24858bb --- /dev/null +++ b/generator/Jenkinsfile.yml @@ -0,0 +1,43 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^generator/.*" + - "#generator/common/beatgen" ## special token regarding the project dependency + - "#metricbeat/beater" ## special token regarding the project dependency + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test generator" + labels: ## when PR labels matches any of those entries + - "generator" + parameters: ## when parameter was selected in the UI. + - "generator" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + metricbeat-test: + make: "make -C generator/_templates/metricbeat test test-package" + beat-test: + make: "make -C generator/_templates/beat test test-package" + macos-metricbeat: + make: "make -C generator/_templates/metricbeat test" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test generator for macos" + labels: + - "macOS" + parameters: + - "macosTest" + macos-beat: + make: "make -C generator/_templates/beat test" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test generator for macos" + labels: + - "macOS" + parameters: + - "macosTest" diff --git a/heartbeat/Jenkinsfile.yml b/heartbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..b8668715c3c --- /dev/null +++ b/heartbeat/Jenkinsfile.yml @@ -0,0 +1,32 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^heartbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test heartbeat" + labels: ## when PR labels matches any of those entries + - "heartbeat" + parameters: ## when parameter was selected in the UI. + - "heartbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test heartbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/journalbeat/Jenkinsfile.yml b/journalbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..12bb63f4cc6 --- /dev/null +++ b/journalbeat/Jenkinsfile.yml @@ -0,0 +1,17 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^journalbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test journalbeat" + labels: ## when PR labels matches any of those entries + - "journalbeat" + parameters: ## when parameter was selected in the UI. + - "journalbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + unitTest: + mage: "mage build unitTest" diff --git a/libbeat/Jenkinsfile.yml b/libbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..64a43269b13 --- /dev/null +++ b/libbeat/Jenkinsfile.yml @@ -0,0 +1,20 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test libbeat" + labels: ## when PR labels matches any of those entries + - "libbeat" + parameters: ## when parameter was selected in the UI. + - "libbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + crosscompile: + make: "make -C libbeat crosscompile" + stress-tests: + make: "make STRESS_TEST_OPTIONS='-timeout=20m -race -v -parallel 1' -C libbeat stress-tests" diff --git a/metricbeat/Jenkinsfile.yml b/metricbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..1219a27af77 --- /dev/null +++ b/metricbeat/Jenkinsfile.yml @@ -0,0 +1,40 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^metricbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test metricbeat" + labels: ## when PR labels matches any of those entries + - "metricbeat" + parameters: ## when parameter was selected in the UI. + - "metricbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + unitTest: + mage: "mage build unitTest" + goIntegTest: + mage: "mage goIntegTest" + withModule: true + pythonIntegTest: + mage: "mage pythonIntegTest" + withModule: true + crosscompile: + make: "make -C metricbeat crosscompile" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test metricbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/packetbeat/Jenkinsfile.yml b/packetbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..416e69a203b --- /dev/null +++ b/packetbeat/Jenkinsfile.yml @@ -0,0 +1,32 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^packetbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test packetbeat" + labels: ## when PR labels matches any of those entries + - "packetbeat" + parameters: ## when parameter was selected in the UI. + - "packetbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test packetbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/winlogbeat/Jenkinsfile.yml b/winlogbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..74eb55586d0 --- /dev/null +++ b/winlogbeat/Jenkinsfile.yml @@ -0,0 +1,21 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^winlogbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@oss" ## special token regarding the changeset for the oss + comments: ## when PR comment contains any of those entries + - "/test winlogbeat" + labels: ## when PR labels matches any of those entries + - "winlogbeat" + parameters: ## when parameter was selected in the UI. + - "winlogbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + crosscompile: + make: "make -C winlogbeat crosscompile" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/auditbeat/Jenkinsfile.yml b/x-pack/auditbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..86f0832d3f2 --- /dev/null +++ b/x-pack/auditbeat/Jenkinsfile.yml @@ -0,0 +1,33 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/auditbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test auditbeat" + labels: ## when PR labels matches any of those entries + - "auditbeat" + parameters: ## when parameter was selected in the UI. + - "auditbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage update build test" + withModule: true ## run the ITs only if the changeset affects a specific module. + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test auditbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/dockerlogbeat/Jenkinsfile.yml b/x-pack/dockerlogbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..703bb3d66a9 --- /dev/null +++ b/x-pack/dockerlogbeat/Jenkinsfile.yml @@ -0,0 +1,18 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/dockerlogbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/dockerlogbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-dockerlogbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-dockerlogbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + withModule: true ## run the ITs only if the changeset affects a specific module. diff --git a/x-pack/elastic-agent/Jenkinsfile.yml b/x-pack/elastic-agent/Jenkinsfile.yml new file mode 100644 index 00000000000..8f99e11da3c --- /dev/null +++ b/x-pack/elastic-agent/Jenkinsfile.yml @@ -0,0 +1,32 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/elastic-agent/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/elastic-agent" + labels: ## when PR labels matches any of those entries + - "x-pack-elastic-agent" + parameters: ## when parameter was selected in the UI. + - "x-pack-elastic-agent" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test x-pack/elastic-agent for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/filebeat/Jenkinsfile.yml b/x-pack/filebeat/Jenkinsfile.yml new file mode 100644 index 00000000000..d3d5e6d862e --- /dev/null +++ b/x-pack/filebeat/Jenkinsfile.yml @@ -0,0 +1,33 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/filebeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/filebeat" + labels: ## when PR labels matches any of those entries + - "x-pack-filebeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-filebeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" + withModule: true ## run the ITs only if the changeset affects a specific module. + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test x-pack/filebeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/functionbeat/Jenkinsfile.yml b/x-pack/functionbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..f3428ae7cc8 --- /dev/null +++ b/x-pack/functionbeat/Jenkinsfile.yml @@ -0,0 +1,32 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/functionbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/functionbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-functionbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-functionbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test && GO_VERSION=1.13.1 mage testGCPFunctions" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test x-pack/functionbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/libbeat/Jenkinsfile.yml b/x-pack/libbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..87019f071a0 --- /dev/null +++ b/x-pack/libbeat/Jenkinsfile.yml @@ -0,0 +1,17 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/libbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/libbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-libbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-libbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + mage: "mage build test" diff --git a/x-pack/metricbeat/Jenkinsfile.yml b/x-pack/metricbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..2448d43d85b --- /dev/null +++ b/x-pack/metricbeat/Jenkinsfile.yml @@ -0,0 +1,35 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/metricbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/metricbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-metricbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-metricbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + build: + cloud: "mage build test" + withModule: true ## run the ITs only if the changeset affects a specific module. + dirs: ## run the cloud tests for the given modules. + - "x-pack/metricbeat/module/aws" + macos: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "macosx" + when: ## Aggregate when with the top-level one. + comments: + - "/test x-pack/metricbeat for macos" + labels: + - "macOS" + parameters: + - "macosTest" + windows: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/packetbeat/Jenkinsfile.yml b/x-pack/packetbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..8496265e0ac --- /dev/null +++ b/x-pack/packetbeat/Jenkinsfile.yml @@ -0,0 +1,20 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/winlogbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/winlogbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-winlogbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-winlogbeat" + tags: true ## for all the tags +platform: "linux && ubuntu-18" ## default label for all the stages +stages: + windows: + mage: "mage build unitTest" + withModule: true + platforms: ## override default labels in this specific stage. + - "windows-2019" diff --git a/x-pack/winlogbeat/Jenkinsfile.yml b/x-pack/winlogbeat/Jenkinsfile.yml new file mode 100644 index 00000000000..396d1f03a7c --- /dev/null +++ b/x-pack/winlogbeat/Jenkinsfile.yml @@ -0,0 +1,20 @@ +when: + branches: true ## for all the branches + changeset: ## when PR contains any of those entries in the changeset + - "^x-pack/winlogbeat/.*" + - "@ci" ## special token regarding the changeset for the ci + - "@xpack" ## special token regarding the changeset for the xpack + comments: ## when PR comment contains any of those entries + - "/test x-pack/winlogbeat" + labels: ## when PR labels matches any of those entries + - "x-pack-winlogbeat" + parameters: ## when parameter was selected in the UI. + - "x-pack-winlogbeat" + tags: true ## for all the tags +platform: "windows-2019" ## default label for all the stages +stages: + build: + mage: "mage build unitTest" + withModule: true + platforms: ## override default labels in this specific stage. + - "windows-2019" From bdf613f27bcb7857b96f3284ac6422428431f11f Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Thu, 24 Sep 2020 19:00:38 +0200 Subject: [PATCH 056/216] [Ingest manager] Copy Action store on upgrade (#21298) [Ingest manager] Copy Action store on upgrade (#21298) --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 2 ++ .../pkg/agent/application/config.go | 6 ++++- .../pkg/agent/application/upgrade/upgrade.go | 23 +++++++++++++++++++ 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 4178cfcbf62..c466d0c656d 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -10,6 +10,8 @@ - Docker container is not run as root by default. {pull}21213[21213] ==== Bugfixes +- Copy Action store on upgrade {pull}21298[21298] +- Include inputs in action store actions {pull}21298[21298] ==== New features diff --git a/x-pack/elastic-agent/pkg/agent/application/config.go b/x-pack/elastic-agent/pkg/agent/application/config.go index ff15ca44074..e42f3dcab28 100644 --- a/x-pack/elastic-agent/pkg/agent/application/config.go +++ b/x-pack/elastic-agent/pkg/agent/application/config.go @@ -11,6 +11,7 @@ import ( "gopkg.in/yaml.v2" + "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" @@ -54,7 +55,10 @@ func LoadConfigFromFile(path string) (*config.Config, error) { // // This must be used to load the Agent configuration, so that variables defined in the inputs are not // parsed by go-ucfg. Variables from the inputs should be parsed by the transpiler. -func LoadConfig(m map[string]interface{}) (*config.Config, error) { +func LoadConfig(in map[string]interface{}) (*config.Config, error) { + // make copy of a map so we dont affect a caller + m := common.MapStr(in).Clone() + inputs, ok := m["inputs"] if ok { // remove the inputs diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index cc27846051f..08c38aba8c5 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -14,6 +14,7 @@ import ( "gopkg.in/yaml.v2" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" @@ -78,6 +79,10 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error return errors.New("upgrading to same version") } + if err := copyActionStore(newHash); err != nil { + return errors.New(err, "failed to copy action store") + } + if err := u.changeSymlink(ctx, newHash); err != nil { rollbackInstall(newHash) return err @@ -137,3 +142,21 @@ func isSubdir(base, target string) (bool, error) { func rollbackInstall(hash string) { os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) } + +func copyActionStore(newHash string) error { + currentActionStorePath := info.AgentActionStoreFile() + + newHome := filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, newHash)) + newActionStorePath := filepath.Join(newHome, filepath.Base(currentActionStorePath)) + + currentActionStore, err := ioutil.ReadFile(currentActionStorePath) + if os.IsNotExist(err) { + // nothing to copy + return nil + } + if err != nil { + return err + } + + return ioutil.WriteFile(newActionStorePath, currentActionStore, 0600) +} From 1f7f9c562a456d30d64b5853065ab3ddbf056c37 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 24 Sep 2020 19:21:18 +0200 Subject: [PATCH 057/216] Change mirror of kafka download (#19645) --- testing/environments/docker/kafka/Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/testing/environments/docker/kafka/Dockerfile b/testing/environments/docker/kafka/Dockerfile index 24bf0996193..484b294c39a 100644 --- a/testing/environments/docker/kafka/Dockerfile +++ b/testing/environments/docker/kafka/Dockerfile @@ -10,8 +10,10 @@ ENV TERM=linux RUN apt-get update && apt-get install -y curl openjdk-8-jre-headless netcat -RUN mkdir -p ${KAFKA_LOGS_DIR} && mkdir -p ${KAFKA_HOME} && curl -s -o $INSTALL_DIR/kafka.tgz \ - "http://mirror.easyname.ch/apache/kafka/${KAFKA_VERSION}/kafka_2.11-${KAFKA_VERSION}.tgz" && \ +RUN mkdir -p ${KAFKA_LOGS_DIR} && mkdir -p ${KAFKA_HOME} && \ + curl -J -L -s -f -o - https://github.com/kadwanev/retry/releases/download/1.0.1/retry-1.0.1.tar.gz | tar xfz - -C /usr/local/bin && \ + retry --min 1 --max 180 -- curl -J -L -s -f --show-error -o $INSTALL_DIR/kafka.tgz \ + "https://archive.apache.org/dist/kafka/${KAFKA_VERSION}/kafka_2.11-${KAFKA_VERSION}.tgz" && \ tar xzf ${INSTALL_DIR}/kafka.tgz -C ${KAFKA_HOME} --strip-components 1 ADD run.sh /run.sh From 1a801709fb1cfdf2424d958e1cd4dcbb3a5528fd Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Fri, 25 Sep 2020 08:14:01 +0200 Subject: [PATCH 058/216] [Ingest Manager] Thread safe sorted set (#21290) [Ingest Manager] Thread safe sorted set (#21290) --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + x-pack/elastic-agent/pkg/sorted/set.go | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index c466d0c656d..3963dda9a12 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -10,6 +10,7 @@ - Docker container is not run as root by default. {pull}21213[21213] ==== Bugfixes +- Thread safe sorted set {pull}21290[21290] - Copy Action store on upgrade {pull}21298[21298] - Include inputs in action store actions {pull}21298[21298] diff --git a/x-pack/elastic-agent/pkg/sorted/set.go b/x-pack/elastic-agent/pkg/sorted/set.go index 739e525aac5..38099963fcf 100644 --- a/x-pack/elastic-agent/pkg/sorted/set.go +++ b/x-pack/elastic-agent/pkg/sorted/set.go @@ -6,6 +6,7 @@ package sorted import ( "sort" + "sync" ) // Set is a sorted set that allow to iterate on they keys in an ordered manner, when @@ -13,6 +14,7 @@ import ( type Set struct { mapped map[string]interface{} keys []string + rwlock sync.RWMutex } // NewSet returns an ordered set. @@ -24,6 +26,9 @@ func NewSet() *Set { // Add adds an items to the set. func (s *Set) Add(k string, v interface{}) { + s.rwlock.Lock() + defer s.rwlock.Unlock() + _, ok := s.mapped[k] if !ok { s.keys = append(s.keys, k) @@ -35,6 +40,9 @@ func (s *Set) Add(k string, v interface{}) { // Remove removes an items from the Set. func (s *Set) Remove(k string) { + s.rwlock.Lock() + defer s.rwlock.Unlock() + _, ok := s.mapped[k] if !ok { return @@ -50,11 +58,17 @@ func (s *Set) Remove(k string) { // Get retrieves a specific values from the map and will return false if the key is not found. func (s *Set) Get(k string) (interface{}, bool) { + s.rwlock.RLock() + defer s.rwlock.RUnlock() + v, ok := s.mapped[k] return v, ok } // Keys returns slice of keys where the keys are ordered alphabetically. func (s *Set) Keys() []string { + s.rwlock.RLock() + defer s.rwlock.RUnlock() + return append(s.keys[:0:0], s.keys...) } From 6bb35c1533efe47de7706f9dc7c433100da1d6af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Fri, 25 Sep 2020 16:09:01 +0200 Subject: [PATCH 059/216] Configurable index template loading (#21212) ## What does this PR do? The PR adds a new configuration option named `setup.template.type` to select the index template type. From ES v7.8 new index templates were introduced. Possible option: * `legacy`: Loads the legacy index template. This is the default option, so it does not break existing deployments. * `component`: This loads Beats' index template as a composite template, so it can be used in the users' index templates. * `index`: Loads the new index template. ## Why is it important? Index templates v2 was released in Elasticsearch 7.8. Previously Beats had used the legacy endpoint for installing index templates. Now we are moving to the newer version. Closes #17829 --- CHANGELOG.next.asciidoc | 1 + auditbeat/auditbeat.reference.yml | 5 + filebeat/filebeat.reference.yml | 5 + heartbeat/heartbeat.reference.yml | 5 + journalbeat/journalbeat.reference.yml | 5 + .../config/setup.template.reference.yml.tmpl | 5 + libbeat/docs/template-config.asciidoc | 5 + libbeat/template/config.go | 56 ++++++-- libbeat/template/load.go | 26 +++- libbeat/template/load_integration_test.go | 56 +++++--- libbeat/template/template.go | 121 ++++++++++++++---- metricbeat/metricbeat.reference.yml | 5 + packetbeat/packetbeat.reference.yml | 5 + winlogbeat/winlogbeat.reference.yml | 5 + x-pack/auditbeat/auditbeat.reference.yml | 5 + x-pack/filebeat/filebeat.reference.yml | 5 + .../functionbeat/functionbeat.reference.yml | 5 + x-pack/heartbeat/heartbeat.reference.yml | 5 + x-pack/metricbeat/metricbeat.reference.yml | 5 + x-pack/winlogbeat/winlogbeat.reference.yml | 5 + 20 files changed, 282 insertions(+), 53 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 01517e07245..67cac68940c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -437,6 +437,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Added experimental dataset `juniper/netscreen`. {pull}20820[20820] - Added experimental dataset `sophos/utm`. {pull}20820[20820] - Add Cloud Foundry tags in related events. {pull}21177[21177] +- Add option to select the type of index template to load: legacy, component, index. {pull}21212[21212] *Auditbeat* diff --git a/auditbeat/auditbeat.reference.yml b/auditbeat/auditbeat.reference.yml index 62f29364c83..f0dafa75662 100644 --- a/auditbeat/auditbeat.reference.yml +++ b/auditbeat/auditbeat.reference.yml @@ -1144,6 +1144,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default auditbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "auditbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "auditbeat-%{[agent.version]}" diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml index bf66cfb98b9..bf29e0715ed 100644 --- a/filebeat/filebeat.reference.yml +++ b/filebeat/filebeat.reference.yml @@ -1870,6 +1870,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default filebeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "filebeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "filebeat-%{[agent.version]}" diff --git a/heartbeat/heartbeat.reference.yml b/heartbeat/heartbeat.reference.yml index f3f1fea3b22..687552ef33b 100644 --- a/heartbeat/heartbeat.reference.yml +++ b/heartbeat/heartbeat.reference.yml @@ -1321,6 +1321,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default heartbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "heartbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "heartbeat-%{[agent.version]}" diff --git a/journalbeat/journalbeat.reference.yml b/journalbeat/journalbeat.reference.yml index 08f4a04e008..4fe83567574 100644 --- a/journalbeat/journalbeat.reference.yml +++ b/journalbeat/journalbeat.reference.yml @@ -1086,6 +1086,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default journalbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "journalbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "journalbeat-%{[agent.version]}" diff --git a/libbeat/_meta/config/setup.template.reference.yml.tmpl b/libbeat/_meta/config/setup.template.reference.yml.tmpl index 48d23d9d0c9..3f8dc077446 100644 --- a/libbeat/_meta/config/setup.template.reference.yml.tmpl +++ b/libbeat/_meta/config/setup.template.reference.yml.tmpl @@ -7,6 +7,11 @@ # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default {{.BeatName}} uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "{{.BeatIndexPrefix}}-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "{{.BeatIndexPrefix}}-%{[agent.version]}" diff --git a/libbeat/docs/template-config.asciidoc b/libbeat/docs/template-config.asciidoc index 3271d567c2a..9ac888503d1 100644 --- a/libbeat/docs/template-config.asciidoc +++ b/libbeat/docs/template-config.asciidoc @@ -26,6 +26,11 @@ existing one. *`setup.template.enabled`*:: Set to false to disable template loading. If set this to false, you must <>. +*`setup.template.type`*:: The type of template to use. Available options: `legacy` (default), index templates +before Elasticsearch v7.8. Use this to avoid breaking existing deployments. New options are `composite` +and `index`. Selecting `component` loads a component template which can be included in new index templates. +The option `index` loads the new index template. + *`setup.template.name`*:: The name of the template. The default is +{beatname_lc}+. The {beatname_uc} version is always appended to the given name, so the final name is +{beatname_lc}-%{[{beat_version_key}]}+. diff --git a/libbeat/template/config.go b/libbeat/template/config.go index c9e963d6135..7eb6ff522f4 100644 --- a/libbeat/template/config.go +++ b/libbeat/template/config.go @@ -17,7 +17,27 @@ package template -import "github.com/elastic/beats/v7/libbeat/mapping" +import ( + "fmt" + + "github.com/elastic/beats/v7/libbeat/mapping" +) + +const ( + IndexTemplateLegacy IndexTemplateType = iota + IndexTemplateComponent + IndexTemplateIndex +) + +var ( + templateTypes = map[string]IndexTemplateType{ + "legacy": IndexTemplateLegacy, + "component": IndexTemplateComponent, + "index": IndexTemplateIndex, + } +) + +type IndexTemplateType uint8 // TemplateConfig holds config information about the Elasticsearch template type TemplateConfig struct { @@ -30,10 +50,12 @@ type TemplateConfig struct { Path string `config:"path"` Name string `config:"name"` } `config:"json"` - AppendFields mapping.Fields `config:"append_fields"` - Overwrite bool `config:"overwrite"` - Settings TemplateSettings `config:"settings"` - Order int `config:"order"` + AppendFields mapping.Fields `config:"append_fields"` + Overwrite bool `config:"overwrite"` + Settings TemplateSettings `config:"settings"` + Order int `config:"order"` + Priority int `config:"priority"` + Type IndexTemplateType `config:"type"` } // TemplateSettings are part of the Elasticsearch template and hold index and source specific information. @@ -45,8 +67,26 @@ type TemplateSettings struct { // DefaultConfig for index template func DefaultConfig() TemplateConfig { return TemplateConfig{ - Enabled: true, - Fields: "", - Order: 1, + Enabled: true, + Fields: "", + Type: IndexTemplateLegacy, + Order: 1, + Priority: 150, } } + +func (t *IndexTemplateType) Unpack(v string) error { + if v == "" { + *t = IndexTemplateLegacy + return nil + } + + var tt IndexTemplateType + var ok bool + if tt, ok = templateTypes[v]; !ok { + return fmt.Errorf("unknown index template type: %s", v) + } + *t = tt + + return nil +} diff --git a/libbeat/template/load.go b/libbeat/template/load.go index b018fda9788..5b0e0f58440 100644 --- a/libbeat/template/load.go +++ b/libbeat/template/load.go @@ -31,6 +31,14 @@ import ( "github.com/elastic/beats/v7/libbeat/paths" ) +var ( + templateLoaderPath = map[IndexTemplateType]string{ + IndexTemplateLegacy: "/_template/", + IndexTemplateComponent: "/_component_template/", + IndexTemplateIndex: "/_index_template/", + } +) + //Loader interface for loading templates type Loader interface { Load(config TemplateConfig, info beat.Info, fields []byte, migration bool) error @@ -97,7 +105,7 @@ func (l *ESLoader) Load(config TemplateConfig, info beat.Info, fields []byte, mi templateName = config.JSON.Name } - if l.templateExists(templateName) && !config.Overwrite { + if l.templateExists(templateName, config.Type) && !config.Overwrite { l.log.Infof("Template %s already exists and will not be overwritten.", templateName) return nil } @@ -107,7 +115,7 @@ func (l *ESLoader) Load(config TemplateConfig, info beat.Info, fields []byte, mi if err != nil { return err } - if err := l.loadTemplate(templateName, body); err != nil { + if err := l.loadTemplate(templateName, config.Type, body); err != nil { return fmt.Errorf("could not load template. Elasticsearch returned: %v. Template is: %s", err, body.StringToPrint()) } l.log.Infof("template with name '%s' loaded.", templateName) @@ -117,10 +125,11 @@ func (l *ESLoader) Load(config TemplateConfig, info beat.Info, fields []byte, mi // loadTemplate loads a template into Elasticsearch overwriting the existing // template if it exists. If you wish to not overwrite an existing template // then use CheckTemplate prior to calling this method. -func (l *ESLoader) loadTemplate(templateName string, template map[string]interface{}) error { +func (l *ESLoader) loadTemplate(templateName string, templateType IndexTemplateType, template map[string]interface{}) error { l.log.Infof("Try loading template %s to Elasticsearch", templateName) - path := "/_template/" + templateName - params := esVersionParams(l.client.GetVersion()) + clientVersion := l.client.GetVersion() + path := templateLoaderPath[templateType] + templateName + params := esVersionParams(clientVersion) status, body, err := l.client.Request("PUT", path, "", params, template) if err != nil { return fmt.Errorf("couldn't load template: %v. Response body: %s", err, body) @@ -133,11 +142,16 @@ func (l *ESLoader) loadTemplate(templateName string, template map[string]interfa // templateExists checks if a given template already exist. It returns true if // and only if Elasticsearch returns with HTTP status code 200. -func (l *ESLoader) templateExists(templateName string) bool { +func (l *ESLoader) templateExists(templateName string, templateType IndexTemplateType) bool { if l.client == nil { return false } + if templateType == IndexTemplateComponent { + status, _, _ := l.client.Request("GET", "/_component_template/"+templateName, "", nil, nil) + return status == http.StatusOK + } + status, body, _ := l.client.Request("GET", "/_cat/templates/"+templateName, "", nil, nil) return status == http.StatusOK && strings.Contains(string(body), templateName) diff --git a/libbeat/template/load_integration_test.go b/libbeat/template/load_integration_test.go index fc3d66cab4c..7a75b5d4f46 100644 --- a/libbeat/template/load_integration_test.go +++ b/libbeat/template/load_integration_test.go @@ -65,8 +65,8 @@ func newTestSetup(t *testing.T, cfg TemplateConfig) *testSetup { t.Fatal(err) } s := testSetup{t: t, client: client, loader: NewESLoader(client), config: cfg} - client.Request("DELETE", "/_template/"+cfg.Name, "", nil, nil) - require.False(t, s.loader.templateExists(cfg.Name)) + client.Request("DELETE", templateLoaderPath[cfg.Type]+cfg.Name, "", nil, nil) + require.False(t, s.loader.templateExists(cfg.Name, cfg.Type)) return &s } func (ts *testSetup) loadFromFile(fileElems []string) error { @@ -82,7 +82,7 @@ func (ts *testSetup) load(fields []byte) error { func (ts *testSetup) mustLoad(fields []byte) { require.NoError(ts.t, ts.load(fields)) - require.True(ts.t, ts.loader.templateExists(ts.config.Name)) + require.True(ts.t, ts.loader.templateExists(ts.config.Name, ts.config.Type)) } func TestESLoader_Load(t *testing.T) { @@ -91,7 +91,7 @@ func TestESLoader_Load(t *testing.T) { setup := newTestSetup(t, TemplateConfig{Enabled: false}) setup.load(nil) - assert.False(t, setup.loader.templateExists(setup.config.Name)) + assert.False(t, setup.loader.templateExists(setup.config.Name, setup.config.Type)) }) t.Run("invalid version", func(t *testing.T) { @@ -115,14 +115,14 @@ func TestESLoader_Load(t *testing.T) { t.Run("disabled", func(t *testing.T) { setup.load(nil) - tmpl := getTemplate(t, setup.client, setup.config.Name) + tmpl := getTemplate(t, setup.client, setup.config.Name, setup.config.Type) assert.Equal(t, true, tmpl.SourceEnabled()) }) t.Run("enabled", func(t *testing.T) { setup.config.Overwrite = true setup.load(nil) - tmpl := getTemplate(t, setup.client, setup.config.Name) + tmpl := getTemplate(t, setup.client, setup.config.Name, setup.config.Type) assert.Equal(t, false, tmpl.SourceEnabled()) }) }) @@ -140,7 +140,7 @@ func TestESLoader_Load(t *testing.T) { Name string `config:"name"` }{Enabled: true, Path: path(t, []string{"testdata", "fields.json"}), Name: nameJSON} setup.load(nil) - assert.True(t, setup.loader.templateExists(nameJSON)) + assert.True(t, setup.loader.templateExists(nameJSON, setup.config.Type)) }) t.Run("load template successful", func(t *testing.T) { @@ -157,10 +157,19 @@ func TestESLoader_Load(t *testing.T) { fields: fields, properties: []string{"foo", "bar"}, }, + "default config with fields and component": { + cfg: TemplateConfig{Enabled: true, Type: IndexTemplateComponent}, + fields: fields, + properties: []string{"foo", "bar"}, + }, "minimal template": { cfg: TemplateConfig{Enabled: true}, fields: nil, }, + "minimal template component": { + cfg: TemplateConfig{Enabled: true, Type: IndexTemplateComponent}, + fields: nil, + }, "fields from file": { cfg: TemplateConfig{Enabled: true, Fields: path(t, []string{"testdata", "fields.yml"})}, fields: fields, @@ -181,7 +190,7 @@ func TestESLoader_Load(t *testing.T) { setup.mustLoad(data.fields) // Fetch properties - tmpl := getTemplate(t, setup.client, setup.config.Name) + tmpl := getTemplate(t, setup.client, setup.config.Name, setup.config.Type) val, err := tmpl.GetValue("mappings.properties") if data.properties == nil { assert.Error(t, err) @@ -203,7 +212,7 @@ func TestESLoader_Load(t *testing.T) { func TestTemplate_LoadFile(t *testing.T) { setup := newTestSetup(t, TemplateConfig{Enabled: true}) assert.NoError(t, setup.loadFromFile([]string{"..", "fields.yml"})) - assert.True(t, setup.loader.templateExists(setup.config.Name)) + assert.True(t, setup.loader.templateExists(setup.config.Name, setup.config.Type)) } func TestLoadInvalidTemplate(t *testing.T) { @@ -211,9 +220,9 @@ func TestLoadInvalidTemplate(t *testing.T) { // Try to load invalid template template := map[string]interface{}{"json": "invalid"} - err := setup.loader.loadTemplate(setup.config.Name, template) + err := setup.loader.loadTemplate(setup.config.Name, setup.config.Type, template) assert.Error(t, err) - assert.False(t, setup.loader.templateExists(setup.config.Name)) + assert.False(t, setup.loader.templateExists(setup.config.Name, setup.config.Type)) } // Tests loading the templates for each beat @@ -225,7 +234,7 @@ func TestLoadBeatsTemplate_fromFile(t *testing.T) { for _, beat := range beats { setup := newTestSetup(t, TemplateConfig{Name: beat, Enabled: true}) assert.NoError(t, setup.loadFromFile([]string{"..", "..", beat, "fields.yml"})) - assert.True(t, setup.loader.templateExists(setup.config.Name)) + assert.True(t, setup.loader.templateExists(setup.config.Name, setup.config.Type)) } } @@ -238,7 +247,7 @@ func TestTemplateSettings(t *testing.T) { require.NoError(t, setup.loadFromFile([]string{"..", "fields.yml"})) // Check that it contains the mapping - templateJSON := getTemplate(t, setup.client, setup.config.Name) + templateJSON := getTemplate(t, setup.client, setup.config.Name, setup.config.Type) assert.Equal(t, 1, templateJSON.NumberOfShards()) assert.Equal(t, false, templateJSON.SourceEnabled()) } @@ -289,7 +298,7 @@ var dataTests = []struct { func TestTemplateWithData(t *testing.T) { setup := newTestSetup(t, TemplateConfig{Enabled: true}) require.NoError(t, setup.loadFromFile([]string{"testdata", "fields.yml"})) - require.True(t, setup.loader.templateExists(setup.config.Name)) + require.True(t, setup.loader.templateExists(setup.config.Name, setup.config.Type)) esClient := setup.client.(*eslegclient.Connection) for _, test := range dataTests { _, _, err := esClient.Index(setup.config.Name, "_doc", "", nil, test.data) @@ -302,14 +311,29 @@ func TestTemplateWithData(t *testing.T) { } } -func getTemplate(t *testing.T, client ESClient, templateName string) testTemplate { - status, body, err := client.Request("GET", "/_template/"+templateName, "", nil, nil) +func getTemplate(t *testing.T, client ESClient, templateName string, templateType IndexTemplateType) testTemplate { + status, body, err := client.Request("GET", templateLoaderPath[templateType]+templateName, "", nil, nil) require.NoError(t, err) require.Equal(t, status, 200) var response common.MapStr err = json.Unmarshal(body, &response) require.NoError(t, err) + require.NotNil(t, response) + + if templateType == IndexTemplateComponent { + var tmpl map[string]interface{} + components := response["component_templates"].([]interface{}) + for _, ct := range components { + componentTemplate := ct.(map[string]interface{})["component_template"].(map[string]interface{}) + tmpl = componentTemplate["template"].(map[string]interface{}) + } + return testTemplate{ + t: t, + client: client, + MapStr: common.MapStr(tmpl), + } + } return testTemplate{ t: t, diff --git a/libbeat/template/template.go b/libbeat/template/template.go index dac3a920196..2aaa7712d02 100644 --- a/libbeat/template/template.go +++ b/libbeat/template/template.go @@ -46,14 +46,16 @@ var ( // Template holds information for the ES template. type Template struct { sync.Mutex - name string - pattern string - beatVersion common.Version - beatName string - esVersion common.Version - config TemplateConfig - migration bool - order int + name string + pattern string + beatVersion common.Version + beatName string + esVersion common.Version + config TemplateConfig + migration bool + templateType IndexTemplateType + order int + priority int } // New creates a new template instance @@ -123,14 +125,16 @@ func New( } return &Template{ - pattern: pattern, - name: name, - beatVersion: *bV, - esVersion: esVersion, - beatName: beatName, - config: config, - migration: migration, - order: config.Order, + pattern: pattern, + name: name, + beatVersion: *bV, + esVersion: esVersion, + beatName: beatName, + config: config, + migration: migration, + templateType: config.Type, + order: config.Order, + priority: config.Priority, }, nil } @@ -184,23 +188,56 @@ func (t *Template) LoadBytes(data []byte) (common.MapStr, error) { // LoadMinimal loads the template only with the given configuration func (t *Template) LoadMinimal() (common.MapStr, error) { - keyPattern, patterns := buildPatternSettings(t.esVersion, t.GetPattern()) - m := common.MapStr{ - keyPattern: patterns, - "order": t.order, - "settings": common.MapStr{ - "index": t.config.Settings.Index, - }, + m := common.MapStr{} + switch t.templateType { + case IndexTemplateLegacy: + m = t.loadMinimalLegacy() + case IndexTemplateComponent: + m = t.loadMinimalComponent() + case IndexTemplateIndex: + m = t.loadMinimalIndex() + default: + return nil, fmt.Errorf("unknown template type %v", t.templateType) } + if t.config.Settings.Source != nil { m["mappings"] = buildMappings( t.beatVersion, t.esVersion, t.beatName, nil, nil, common.MapStr(t.config.Settings.Source)) } + return m, nil } +func (t *Template) loadMinimalLegacy() common.MapStr { + keyPattern, patterns := buildPatternSettings(t.esVersion, t.GetPattern()) + return common.MapStr{ + keyPattern: patterns, + "order": t.order, + "settings": common.MapStr{ + "index": t.config.Settings.Index, + }, + } +} + +func (t *Template) loadMinimalComponent() common.MapStr { + return common.MapStr{ + "template": common.MapStr{ + "settings": common.MapStr{ + "index": t.config.Settings.Index, + }, + }, + } +} + +func (t *Template) loadMinimalIndex() common.MapStr { + m := t.loadMinimalLegacy() + m["priority"] = t.priority + delete(m, "order") + return m +} + // GetName returns the name of the template func (t *Template) GetName() string { return t.name @@ -214,6 +251,19 @@ func (t *Template) GetPattern() string { // Generate generates the full template // The default values are taken from the default variable. func (t *Template) Generate(properties common.MapStr, dynamicTemplates []common.MapStr) common.MapStr { + switch t.templateType { + case IndexTemplateLegacy: + return t.generateLegacy(properties) + case IndexTemplateComponent: + return t.generateComponent(properties) + case IndexTemplateIndex: + return t.generateIndex(properties) + default: + } + return nil +} + +func (t *Template) generateLegacy(properties common.MapStr) common.MapStr { keyPattern, patterns := buildPatternSettings(t.esVersion, t.GetPattern()) return common.MapStr{ keyPattern: patterns, @@ -232,6 +282,31 @@ func (t *Template) Generate(properties common.MapStr, dynamicTemplates []common. } } +func (t *Template) generateComponent(properties common.MapStr) common.MapStr { + return common.MapStr{ + "template": common.MapStr{ + "mappings": buildMappings( + t.beatVersion, t.esVersion, t.beatName, + properties, + append(dynamicTemplates, buildDynTmpl(t.esVersion)), + common.MapStr(t.config.Settings.Source)), + "settings": common.MapStr{ + "index": buildIdxSettings( + t.esVersion, + t.config.Settings.Index, + ), + }, + }, + } +} + +func (t *Template) generateIndex(properties common.MapStr) common.MapStr { + tmpl := t.generateLegacy(properties) + tmpl["priority"] = t.priority + delete(tmpl, "order") + return tmpl +} + func buildPatternSettings(ver common.Version, pattern string) (string, interface{}) { if ver.Major < 6 { return "template", pattern diff --git a/metricbeat/metricbeat.reference.yml b/metricbeat/metricbeat.reference.yml index f40a7d572ea..9b6f37eb447 100644 --- a/metricbeat/metricbeat.reference.yml +++ b/metricbeat/metricbeat.reference.yml @@ -1910,6 +1910,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default metricbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "metricbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "metricbeat-%{[agent.version]}" diff --git a/packetbeat/packetbeat.reference.yml b/packetbeat/packetbeat.reference.yml index 6dc0f3a01d6..0dc551698e9 100644 --- a/packetbeat/packetbeat.reference.yml +++ b/packetbeat/packetbeat.reference.yml @@ -1570,6 +1570,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default packetbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "packetbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "packetbeat-%{[agent.version]}" diff --git a/winlogbeat/winlogbeat.reference.yml b/winlogbeat/winlogbeat.reference.yml index c76f369eb35..71ec0007631 100644 --- a/winlogbeat/winlogbeat.reference.yml +++ b/winlogbeat/winlogbeat.reference.yml @@ -1066,6 +1066,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default winlogbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "winlogbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "winlogbeat-%{[agent.version]}" diff --git a/x-pack/auditbeat/auditbeat.reference.yml b/x-pack/auditbeat/auditbeat.reference.yml index 041f460ddd1..f2167a6293e 100644 --- a/x-pack/auditbeat/auditbeat.reference.yml +++ b/x-pack/auditbeat/auditbeat.reference.yml @@ -1200,6 +1200,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default auditbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "auditbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "auditbeat-%{[agent.version]}" diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 89beee34729..9797291bdf4 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -3305,6 +3305,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default filebeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "filebeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "filebeat-%{[agent.version]}" diff --git a/x-pack/functionbeat/functionbeat.reference.yml b/x-pack/functionbeat/functionbeat.reference.yml index f20f73e8bfd..a55fcc56e23 100644 --- a/x-pack/functionbeat/functionbeat.reference.yml +++ b/x-pack/functionbeat/functionbeat.reference.yml @@ -1051,6 +1051,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default functionbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "functionbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "functionbeat-%{[agent.version]}" diff --git a/x-pack/heartbeat/heartbeat.reference.yml b/x-pack/heartbeat/heartbeat.reference.yml index f3f1fea3b22..687552ef33b 100644 --- a/x-pack/heartbeat/heartbeat.reference.yml +++ b/x-pack/heartbeat/heartbeat.reference.yml @@ -1321,6 +1321,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default heartbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "heartbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "heartbeat-%{[agent.version]}" diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index 507d8492485..ff9bffda33e 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -2382,6 +2382,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default metricbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "metricbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "metricbeat-%{[agent.version]}" diff --git a/x-pack/winlogbeat/winlogbeat.reference.yml b/x-pack/winlogbeat/winlogbeat.reference.yml index 773fde0fab4..62dab077c43 100644 --- a/x-pack/winlogbeat/winlogbeat.reference.yml +++ b/x-pack/winlogbeat/winlogbeat.reference.yml @@ -1109,6 +1109,11 @@ output.elasticsearch: # Set to false to disable template loading. #setup.template.enabled: true +# Select the kind of index template. From Elasticsearch 7.8, it is possible to +# use component templates. Available options: legacy, component, index. +# By default winlogbeat uses the legacy index templates. +#setup.template.type: legacy + # Template name. By default the template name is "winlogbeat-%{[agent.version]}" # The template name and pattern has to be set in case the Elasticsearch index pattern is modified. #setup.template.name: "winlogbeat-%{[agent.version]}" From b4c7a93f65b3dbb803191894954a9a946830e771 Mon Sep 17 00:00:00 2001 From: Andrew Wilkins Date: Sat, 26 Sep 2020 15:41:50 +0800 Subject: [PATCH 060/216] libbeat/cmd/instance: report cgroup stats (#21113) * libbeat/cmd/instance: report cgroup stats --- libbeat/cmd/instance/metrics.go | 86 ++++++++++++++++++++++++++++++++- 1 file changed, 84 insertions(+), 2 deletions(-) diff --git a/libbeat/cmd/instance/metrics.go b/libbeat/cmd/instance/metrics.go index 54cd3ab55d8..fa0d42bbeaf 100644 --- a/libbeat/cmd/instance/metrics.go +++ b/libbeat/cmd/instance/metrics.go @@ -28,6 +28,7 @@ import ( "github.com/elastic/beats/v7/libbeat/metric/system/cpu" "github.com/elastic/beats/v7/libbeat/metric/system/process" "github.com/elastic/beats/v7/libbeat/monitoring" + "github.com/elastic/gosigar/cgroup" ) var ( @@ -65,10 +66,15 @@ func setupMetrics(name string) error { } func setupPlatformSpecificMetrics() { + switch runtime.GOOS { + case "linux": + monitoring.NewFunc(beatMetrics, "cgroup", reportBeatCgroups, monitoring.Report) + case "windows": + setupWindowsHandlesMetrics() + } + if runtime.GOOS != "windows" { monitoring.NewFunc(systemMetrics, "load", reportSystemLoadAverage, monitoring.Report) - } else { - setupWindowsHandlesMetrics() } setupLinuxBSDFDMetrics() @@ -254,3 +260,79 @@ func reportRuntime(_ monitoring.Mode, V monitoring.Visitor) { monitoring.ReportInt(V, "goroutines", int64(runtime.NumGoroutine())) } + +func reportBeatCgroups(_ monitoring.Mode, V monitoring.Visitor) { + V.OnRegistryStart() + defer V.OnRegistryFinished() + + pid, err := process.GetSelfPid() + if err != nil { + logp.Err("error getting PID for self process: %v", err) + return + } + + cgroups, err := cgroup.NewReader("", true) + if err != nil { + if err == cgroup.ErrCgroupsMissing { + logp.Warn("cgroup data collection disabled: %v", err) + } else { + logp.Err("cgroup data collection disabled: %v", err) + } + return + } + selfStats, err := cgroups.GetStatsForProcess(pid) + if err != nil { + logp.Err("error getting group status: %v", err) + return + } + + if cpu := selfStats.CPU; cpu != nil { + monitoring.ReportNamespace(V, "cpu", func() { + if cpu.ID != "" { + monitoring.ReportString(V, "id", cpu.ID) + } + monitoring.ReportNamespace(V, "cfs", func() { + monitoring.ReportNamespace(V, "period", func() { + monitoring.ReportInt(V, "us", int64(cpu.CFS.PeriodMicros)) + }) + monitoring.ReportNamespace(V, "quota", func() { + monitoring.ReportInt(V, "us", int64(cpu.CFS.QuotaMicros)) + }) + }) + monitoring.ReportNamespace(V, "stats", func() { + monitoring.ReportInt(V, "periods", int64(cpu.Stats.Periods)) + monitoring.ReportNamespace(V, "throttled", func() { + monitoring.ReportInt(V, "periods", int64(cpu.Stats.ThrottledPeriods)) + monitoring.ReportInt(V, "ns", int64(cpu.Stats.ThrottledTimeNanos)) + }) + }) + }) + } + + if cpuacct := selfStats.CPUAccounting; cpuacct != nil { + monitoring.ReportNamespace(V, "cpuacct", func() { + if cpuacct.ID != "" { + monitoring.ReportString(V, "id", cpuacct.ID) + } + monitoring.ReportNamespace(V, "total", func() { + monitoring.ReportInt(V, "ns", int64(cpuacct.TotalNanos)) + }) + }) + } + + if memory := selfStats.Memory; memory != nil { + monitoring.ReportNamespace(V, "memory", func() { + if memory.ID != "" { + monitoring.ReportString(V, "id", memory.ID) + } + monitoring.ReportNamespace(V, "mem", func() { + monitoring.ReportNamespace(V, "limit", func() { + monitoring.ReportInt(V, "bytes", int64(memory.Mem.Limit)) + }) + monitoring.ReportNamespace(V, "usage", func() { + monitoring.ReportInt(V, "bytes", int64(memory.Mem.Usage)) + }) + }) + }) + } +} From 0a7a8723ceffd60e39c878d628501103e98fd5eb Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Mon, 28 Sep 2020 10:01:59 +0100 Subject: [PATCH 061/216] [CI] cherry-pick #20891 (#21314) Co-authored-by: Ivan Fernandez Calvo --- Jenkinsfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Jenkinsfile b/Jenkinsfile index e7f91ef95e5..a70d6f77bd0 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -21,6 +21,7 @@ pipeline { JOB_GCS_CREDENTIALS = 'beats-ci-gcs-plugin' OSS_MODULE_PATTERN = '^[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' PIPELINE_LOG_LEVEL = 'INFO' + PYTEST_ADDOPTS = "${params.PYTEST_ADDOPTS}" RUNBLD_DISABLE_NOTIFICATIONS = 'true' TERRAFORM_VERSION = "0.12.24" XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' @@ -44,6 +45,7 @@ pipeline { string(name: 'awsRegion', defaultValue: 'eu-central-1', description: 'Default AWS region to use for testing.') booleanParam(name: 'runAllStages', defaultValue: false, description: 'Allow to run all stages.') booleanParam(name: 'macosTest', defaultValue: false, description: 'Allow macOS stages.') + string(name: 'PYTEST_ADDOPTS', defaultValue: '', description: 'Additional options to pass to pytest. Use PYTEST_ADDOPTS="-k pattern" to only run tests matching the specified pattern. For retries you can use `--reruns 3 --reruns-delay 15`') } stages { stage('Checkout') { From 5b5c4cfef566073376852b91a2d8ac4c4cc960b5 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Mon, 28 Sep 2020 11:23:49 +0100 Subject: [PATCH 062/216] [CI] refactor runbld post build action (#21256) --- Jenkinsfile | 51 ++++----------------------------------------------- 1 file changed, 4 insertions(+), 47 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index a70d6f77bd0..9121d0d48cf 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -12,7 +12,8 @@ pipeline { agent { label 'ubuntu-18 && immutable' } environment { AWS_ACCOUNT_SECRET = 'secret/observability-team/ci/elastic-observability-aws-account-auth' - BASE_DIR = 'src/github.com/elastic/beats' + REPO = 'beats' + BASE_DIR = "src/github.com/elastic/${env.REPO}" DOCKERELASTIC_SECRET = 'secret/observability-team/ci/docker-registry/prod' DOCKER_COMPOSE_VERSION = "1.21.0" DOCKER_REGISTRY = 'docker.elastic.co' @@ -122,7 +123,7 @@ pipeline { } post { always { - runbld() + runbld(stashedTestReports: stashedTestReports, project: env.REPO) } cleanup { notifyBuildResult(prComment: true) @@ -348,7 +349,7 @@ def archiveTestOutput(Map args = [:]) { } cmd(label: 'Prepare test output', script: 'python .ci/scripts/pre_archive_test.py') dir('build') { - junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: args.testResults, id: args.id) + junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: args.testResults, stashedTestReports: stashedTestReports, id: args.id) archiveArtifacts(allowEmptyArchive: true, artifacts: args.artifacts) } catchError(buildResult: 'SUCCESS', message: 'Failed to archive the build test results', stageResult: 'SUCCESS') { @@ -362,50 +363,6 @@ def archiveTestOutput(Map args = [:]) { } } -/** -* This method wraps the junit built-in step to archive the test reports that gonna be populated later on -* with the runbld post build step. -*/ -def junitAndStore(Map args = [:]) { - junit(args) - // args.id could be null in some cases, so let's use the currentmilliseconds - def stageName = args.id ? args.id?.replaceAll("[\\W]|_",'-') : "uncategorized-${new java.util.Date().getTime()}" - stash(includes: args.testResults, allowEmpty: true, name: stageName, useDefaultExcludes: true) - stashedTestReports[stageName] = stageName -} - -/** -* This method populates the test output using the runbld approach. For such it requires the -* global variable stashedTestReports. -* TODO: should be moved to the shared library -*/ -def runbld() { - catchError(buildResult: 'SUCCESS', message: 'runbld post build action failed.') { - if (stashedTestReports) { - def jobName = isPR() ? 'elastic+beats+pull-request' : 'elastic+beats' - deleteDir() - unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - dir("${env.BASE_DIR}") { - // Unstash the test reports - stashedTestReports.each { k, v -> - dir(k) { - unstash(v) - } - } - } - sh(label: 'Process JUnit reports with runbld', - script: """\ - ## for debugging purposes - find . -name "TEST-*.xml" - cat >./runbld-script < Date: Mon, 28 Sep 2020 11:24:05 +0100 Subject: [PATCH 063/216] [CI] Enable macOS builds for branches/tags (#21323) --- auditbeat/Jenkinsfile.yml | 4 +++- filebeat/Jenkinsfile.yml | 4 +++- generator/Jenkinsfile.yml | 8 ++++++-- heartbeat/Jenkinsfile.yml | 4 +++- metricbeat/Jenkinsfile.yml | 4 +++- packetbeat/Jenkinsfile.yml | 4 +++- x-pack/auditbeat/Jenkinsfile.yml | 4 +++- x-pack/elastic-agent/Jenkinsfile.yml | 4 +++- x-pack/filebeat/Jenkinsfile.yml | 4 +++- x-pack/functionbeat/Jenkinsfile.yml | 4 +++- x-pack/metricbeat/Jenkinsfile.yml | 4 +++- 11 files changed, 36 insertions(+), 12 deletions(-) diff --git a/auditbeat/Jenkinsfile.yml b/auditbeat/Jenkinsfile.yml index 873e2c319f3..84bef6a6ceb 100644 --- a/auditbeat/Jenkinsfile.yml +++ b/auditbeat/Jenkinsfile.yml @@ -21,13 +21,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test auditbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml index 45b032accfb..d0f36b24536 100644 --- a/filebeat/Jenkinsfile.yml +++ b/filebeat/Jenkinsfile.yml @@ -20,13 +20,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test filebeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/generator/Jenkinsfile.yml b/generator/Jenkinsfile.yml index 071d24858bb..b20081956ee 100644 --- a/generator/Jenkinsfile.yml +++ b/generator/Jenkinsfile.yml @@ -23,21 +23,25 @@ stages: make: "make -C generator/_templates/metricbeat test" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test generator for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags macos-beat: make: "make -C generator/_templates/beat test" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test generator for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/heartbeat/Jenkinsfile.yml b/heartbeat/Jenkinsfile.yml index b8668715c3c..71369fd5814 100644 --- a/heartbeat/Jenkinsfile.yml +++ b/heartbeat/Jenkinsfile.yml @@ -19,13 +19,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test heartbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/metricbeat/Jenkinsfile.yml b/metricbeat/Jenkinsfile.yml index 1219a27af77..09f1a49b9e2 100644 --- a/metricbeat/Jenkinsfile.yml +++ b/metricbeat/Jenkinsfile.yml @@ -27,13 +27,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test metricbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/packetbeat/Jenkinsfile.yml b/packetbeat/Jenkinsfile.yml index 416e69a203b..580826bf2fa 100644 --- a/packetbeat/Jenkinsfile.yml +++ b/packetbeat/Jenkinsfile.yml @@ -19,13 +19,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test packetbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/x-pack/auditbeat/Jenkinsfile.yml b/x-pack/auditbeat/Jenkinsfile.yml index 86f0832d3f2..fd73c10a1c5 100644 --- a/x-pack/auditbeat/Jenkinsfile.yml +++ b/x-pack/auditbeat/Jenkinsfile.yml @@ -20,13 +20,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test auditbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/x-pack/elastic-agent/Jenkinsfile.yml b/x-pack/elastic-agent/Jenkinsfile.yml index 8f99e11da3c..f5074df5965 100644 --- a/x-pack/elastic-agent/Jenkinsfile.yml +++ b/x-pack/elastic-agent/Jenkinsfile.yml @@ -19,13 +19,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test x-pack/elastic-agent for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/x-pack/filebeat/Jenkinsfile.yml b/x-pack/filebeat/Jenkinsfile.yml index d3d5e6d862e..437f4c074db 100644 --- a/x-pack/filebeat/Jenkinsfile.yml +++ b/x-pack/filebeat/Jenkinsfile.yml @@ -20,13 +20,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test x-pack/filebeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/x-pack/functionbeat/Jenkinsfile.yml b/x-pack/functionbeat/Jenkinsfile.yml index f3428ae7cc8..20a8527eae3 100644 --- a/x-pack/functionbeat/Jenkinsfile.yml +++ b/x-pack/functionbeat/Jenkinsfile.yml @@ -19,13 +19,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test x-pack/functionbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. diff --git a/x-pack/metricbeat/Jenkinsfile.yml b/x-pack/metricbeat/Jenkinsfile.yml index 2448d43d85b..00fa2c1265e 100644 --- a/x-pack/metricbeat/Jenkinsfile.yml +++ b/x-pack/metricbeat/Jenkinsfile.yml @@ -22,13 +22,15 @@ stages: mage: "mage build unitTest" platforms: ## override default label in this specific stage. - "macosx" - when: ## Aggregate when with the top-level one. + when: ## Override the top-level when. comments: - "/test x-pack/metricbeat for macos" labels: - "macOS" parameters: - "macosTest" + branches: true ## for all the branches + tags: true ## for all the tags windows: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. From a75582f3d7233c8fb9828e25fd39cf9ad35cf903 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 28 Sep 2020 13:34:12 +0200 Subject: [PATCH 064/216] Skip flaky test TestClientPublishEventKerberosAware (#21296) --- libbeat/outputs/elasticsearch/client_integration_test.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libbeat/outputs/elasticsearch/client_integration_test.go b/libbeat/outputs/elasticsearch/client_integration_test.go index e243cb7d1e4..67ccc34b8f7 100644 --- a/libbeat/outputs/elasticsearch/client_integration_test.go +++ b/libbeat/outputs/elasticsearch/client_integration_test.go @@ -55,6 +55,8 @@ func TestClientPublishEvent(t *testing.T) { } func TestClientPublishEventKerberosAware(t *testing.T) { + t.Skip("Flaky test: https://github.com/elastic/beats/issues/21295") + err := setupRoleMapping(t, eslegtest.GetEsKerberosHost()) if err != nil { t.Fatal(err) From 2b8fd7ce88b38528647d59da14c623aad6d1553f Mon Sep 17 00:00:00 2001 From: Fae Charlton Date: Mon, 28 Sep 2020 10:38:32 -0400 Subject: [PATCH 065/216] [libbeat] Disk queue implementation (#21176) Initial implementation of the new libbeat disk queue --- libbeat/publisher/includes/includes.go | 1 + libbeat/publisher/queue/diskqueue/acks.go | 146 ++++++ libbeat/publisher/queue/diskqueue/checksum.go | 33 ++ libbeat/publisher/queue/diskqueue/config.go | 158 ++++++ libbeat/publisher/queue/diskqueue/consumer.go | 114 +++++ .../publisher/queue/diskqueue/core_loop.go | 449 ++++++++++++++++++ .../queue/diskqueue/core_loop_test.go | 94 ++++ .../publisher/queue/diskqueue/deleter_loop.go | 99 ++++ libbeat/publisher/queue/diskqueue/frames.go | 72 +++ libbeat/publisher/queue/diskqueue/producer.go | 109 +++++ libbeat/publisher/queue/diskqueue/queue.go | 249 ++++++++++ .../publisher/queue/diskqueue/reader_loop.go | 247 ++++++++++ libbeat/publisher/queue/diskqueue/segments.go | 254 ++++++++++ .../publisher/queue/diskqueue/serialize.go | 154 ++++++ .../publisher/queue/diskqueue/state_file.go | 93 ++++ libbeat/publisher/queue/diskqueue/util.go | 89 ++++ .../publisher/queue/diskqueue/writer_loop.go | 239 ++++++++++ 17 files changed, 2600 insertions(+) create mode 100644 libbeat/publisher/queue/diskqueue/acks.go create mode 100644 libbeat/publisher/queue/diskqueue/checksum.go create mode 100644 libbeat/publisher/queue/diskqueue/config.go create mode 100644 libbeat/publisher/queue/diskqueue/consumer.go create mode 100644 libbeat/publisher/queue/diskqueue/core_loop.go create mode 100644 libbeat/publisher/queue/diskqueue/core_loop_test.go create mode 100644 libbeat/publisher/queue/diskqueue/deleter_loop.go create mode 100644 libbeat/publisher/queue/diskqueue/frames.go create mode 100644 libbeat/publisher/queue/diskqueue/producer.go create mode 100644 libbeat/publisher/queue/diskqueue/queue.go create mode 100644 libbeat/publisher/queue/diskqueue/reader_loop.go create mode 100644 libbeat/publisher/queue/diskqueue/segments.go create mode 100644 libbeat/publisher/queue/diskqueue/serialize.go create mode 100644 libbeat/publisher/queue/diskqueue/state_file.go create mode 100644 libbeat/publisher/queue/diskqueue/util.go create mode 100644 libbeat/publisher/queue/diskqueue/writer_loop.go diff --git a/libbeat/publisher/includes/includes.go b/libbeat/publisher/includes/includes.go index e6f3ded0bee..a14dd16d3ba 100644 --- a/libbeat/publisher/includes/includes.go +++ b/libbeat/publisher/includes/includes.go @@ -27,6 +27,7 @@ import ( _ "github.com/elastic/beats/v7/libbeat/outputs/kafka" _ "github.com/elastic/beats/v7/libbeat/outputs/logstash" _ "github.com/elastic/beats/v7/libbeat/outputs/redis" + _ "github.com/elastic/beats/v7/libbeat/publisher/queue/diskqueue" _ "github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue" _ "github.com/elastic/beats/v7/libbeat/publisher/queue/spool" ) diff --git a/libbeat/publisher/queue/diskqueue/acks.go b/libbeat/publisher/queue/diskqueue/acks.go new file mode 100644 index 00000000000..ed9d7589db2 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/acks.go @@ -0,0 +1,146 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "os" + "sync" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +// queuePosition represents a logical position within the queue buffer. +type queuePosition struct { + segmentID segmentID + offset segmentOffset +} + +type diskQueueACKs struct { + logger *logp.Logger + + // This lock must be held to access diskQueueACKs fields (except for + // diskQueueACKs.done, which is always safe). + lock sync.Mutex + + // The id and position of the first unacknowledged frame. + nextFrameID frameID + nextPosition queuePosition + + // If a frame has been ACKed, then frameSize[frameID] contains its size on + // disk. The size is used to track the queuePosition of the oldest + // remaining frame, which is written to disk as ACKs are received. (We do + // this to avoid duplicating events if the beat terminates without a clean + // shutdown.) + frameSize map[frameID]uint64 + + // segmentBoundaries maps the first frameID of each segment to its + // corresponding segment ID. + segmentBoundaries map[frameID]segmentID + + // When a segment has been completely acknowledged by a consumer, it sends + // the segment ID to this channel, where it is read by the core loop and + // scheduled for deletion. + segmentACKChan chan segmentID + + // An open writable file handle to the file that stores the queue position. + // This position is advanced as we receive ACKs, confirming it is safe + // to move forward, so the acking code is responsible for updating this + // file. + positionFile *os.File + + // When the queue is closed, diskQueueACKs.done is closed to signal that + // the core loop will not accept any more acked segments and any future + // ACKs should be ignored. + done chan struct{} +} + +func newDiskQueueACKs( + logger *logp.Logger, position queuePosition, positionFile *os.File, +) *diskQueueACKs { + return &diskQueueACKs{ + logger: logger, + nextFrameID: 0, + nextPosition: position, + frameSize: make(map[frameID]uint64), + segmentBoundaries: make(map[frameID]segmentID), + segmentACKChan: make(chan segmentID), + positionFile: positionFile, + done: make(chan struct{}), + } +} + +func (dqa *diskQueueACKs) addFrames(frames []*readFrame) { + dqa.lock.Lock() + defer dqa.lock.Unlock() + select { + case <-dqa.done: + // We are already done and should ignore any leftover ACKs we receive. + return + default: + } + for _, frame := range frames { + segment := frame.segment + if frame.id != 0 && frame.id == segment.firstFrameID { + // This is the first frame in its segment, mark it so we know when + // we're starting a new segment. + // + // Subtlety: we don't count the very first frame as a "boundary" even + // though it is the first frame we read from its segment. This prevents + // us from resetting our segment offset to zero, in case the initial + // offset was restored from a previous session instead of starting at + // the beginning of the first file. + dqa.segmentBoundaries[frame.id] = segment.id + } + dqa.frameSize[frame.id] = frame.bytesOnDisk + } + oldSegmentID := dqa.nextPosition.segmentID + if dqa.frameSize[dqa.nextFrameID] != 0 { + for ; dqa.frameSize[dqa.nextFrameID] != 0; dqa.nextFrameID++ { + newSegment, ok := dqa.segmentBoundaries[dqa.nextFrameID] + if ok { + // This is the start of a new segment. Remove this frame from the + // segment boundary list and set the position to the start of the + // new segment. + delete(dqa.segmentBoundaries, dqa.nextFrameID) + dqa.nextPosition = queuePosition{ + segmentID: newSegment, + offset: 0, + } + } + dqa.nextPosition.offset += segmentOffset(dqa.frameSize[dqa.nextFrameID]) + delete(dqa.frameSize, dqa.nextFrameID) + } + // We advanced the ACK position at least somewhat, so write its + // new value. + err := writeQueuePositionToHandle(dqa.positionFile, dqa.nextPosition) + if err != nil { + // TODO: Don't spam this warning on every ACK if it's a permanent error. + dqa.logger.Warnf("Couldn't save queue position: %v", err) + } + } + if oldSegmentID != dqa.nextPosition.segmentID { + // We crossed at least one segment boundary, inform the listener that + // everything before the current segment has been acknowledged (but bail + // out if our done channel has been closed, since that means there is no + // listener on the other end.) + select { + case dqa.segmentACKChan <- dqa.nextPosition.segmentID - 1: + case <-dqa.done: + } + } +} diff --git a/libbeat/publisher/queue/diskqueue/checksum.go b/libbeat/publisher/queue/diskqueue/checksum.go new file mode 100644 index 00000000000..87cdb7b1aef --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/checksum.go @@ -0,0 +1,33 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "encoding/binary" + "hash/crc32" +) + +// Computes the checksum that should be written / read in a frame footer +// based on the raw content of that frame (excluding header / footer). +func computeChecksum(data []byte) uint32 { + hash := crc32.NewIEEE() + frameLength := uint32(len(data) + frameMetadataSize) + binary.Write(hash, binary.LittleEndian, &frameLength) + hash.Write(data) + return hash.Sum32() +} diff --git a/libbeat/publisher/queue/diskqueue/config.go b/libbeat/publisher/queue/diskqueue/config.go new file mode 100644 index 00000000000..f39f608361d --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/config.go @@ -0,0 +1,158 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "errors" + "fmt" + "path/filepath" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/cfgtype" + "github.com/elastic/beats/v7/libbeat/paths" + "github.com/elastic/beats/v7/libbeat/publisher/queue" +) + +// Settings contains the configuration fields to create a new disk queue +// or open an existing one. +type Settings struct { + // The path on disk of the queue's containing directory, which will be + // created if it doesn't exist. Within the directory, the queue's state + // is stored in state.dat and each segment's data is stored in + // {segmentIndex}.seg + // If blank, the default directory is "diskqueue" within the beat's data + // directory. + Path string + + // MaxBufferSize is the maximum number of bytes that the queue should + // ever occupy on disk. A value of 0 means the queue can grow until the + // disk is full (this is not recommended on a primary system disk). + MaxBufferSize uint64 + + // MaxSegmentSize is the maximum number of bytes that should be written + // to a single segment file before creating a new one. + MaxSegmentSize uint64 + + // How many events will be read from disk while waiting for a consumer + // request. + ReadAheadLimit int + + // How many events will be queued in memory waiting to be written to disk. + // This setting should rarely matter in practice, but if data is coming + // in faster than it can be written to disk for an extended period, + // this limit can keep it from overflowing memory. + WriteAheadLimit int + + // A listener that should be sent ACKs when an event is successfully + // written to disk. + WriteToDiskListener queue.ACKListener +} + +// userConfig holds the parameters for a disk queue that are configurable +// by the end user in the beats yml file. +type userConfig struct { + Path string `config:"path"` + MaxSize cfgtype.ByteSize `config:"max_size" validate:"required"` + SegmentSize *cfgtype.ByteSize `config:"segment_size"` + ReadAheadLimit *int `config:"read_ahead"` + WriteAheadLimit *int `config:"write_ahead"` +} + +func (c *userConfig) Validate() error { + // If the segment size is explicitly specified, the total queue size must + // be at least twice as large. + if c.SegmentSize != nil && c.MaxSize != 0 && c.MaxSize < *c.SegmentSize*2 { + return errors.New( + "Disk queue max_size must be at least twice as big as segment_size") + } + + // We require a total queue size of at least 10MB, and a segment size of + // at least 1MB. The queue can support lower thresholds, but it will perform + // terribly, so we give an explicit error in that case. + // These bounds are still extremely low for Beats ingestion, but if all you + // need is for a low-volume stream on a tiny device to persist between + // restarts, it will work fine. + if c.MaxSize != 0 && c.MaxSize < 10*1000*1000 { + return fmt.Errorf( + "Disk queue max_size (%d) cannot be less than 10MB", c.MaxSize) + } + if c.SegmentSize != nil && *c.SegmentSize < 1000*1000 { + return fmt.Errorf( + "Disk queue segment_size (%d) cannot be less than 1MB", *c.SegmentSize) + } + + return nil +} + +// DefaultSettings returns a Settings object with reasonable default values +// for all important fields. +func DefaultSettings() Settings { + return Settings{ + MaxSegmentSize: 100 * (1 << 20), // 100MiB + MaxBufferSize: (1 << 30), // 1GiB + + ReadAheadLimit: 256, + WriteAheadLimit: 1024, + } +} + +// SettingsForUserConfig returns a Settings struct initialized with the +// end-user-configurable settings in the given config tree. +func SettingsForUserConfig(config *common.Config) (Settings, error) { + userConfig := userConfig{} + if err := config.Unpack(&userConfig); err != nil { + return Settings{}, fmt.Errorf("parsing user config: %w", err) + } + settings := DefaultSettings() + settings.Path = userConfig.Path + + settings.MaxBufferSize = uint64(userConfig.MaxSize) + if userConfig.SegmentSize != nil { + settings.MaxSegmentSize = uint64(*userConfig.SegmentSize) + } else { + // If no value is specified, default segment size is total queue size + // divided by 10. + settings.MaxSegmentSize = uint64(userConfig.MaxSize) / 10 + } + return settings, nil +} + +// +// bookkeeping helpers +// + +func (settings Settings) directoryPath() string { + if settings.Path == "" { + return paths.Resolve(paths.Data, "diskqueue") + } + return settings.Path +} + +func (settings Settings) stateFilePath() string { + return filepath.Join(settings.directoryPath(), "state.dat") +} + +func (settings Settings) segmentPath(segmentID segmentID) string { + return filepath.Join( + settings.directoryPath(), + fmt.Sprintf("%v.seg", segmentID)) +} + +func (settings Settings) maxSegmentOffset() segmentOffset { + return segmentOffset(settings.MaxSegmentSize - segmentHeaderSize) +} diff --git a/libbeat/publisher/queue/diskqueue/consumer.go b/libbeat/publisher/queue/diskqueue/consumer.go new file mode 100644 index 00000000000..b2922778ea5 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/consumer.go @@ -0,0 +1,114 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "fmt" + + "github.com/elastic/beats/v7/libbeat/publisher" + "github.com/elastic/beats/v7/libbeat/publisher/queue" +) + +type diskQueueConsumer struct { + queue *diskQueue + closed bool +} + +type diskQueueBatch struct { + queue *diskQueue + frames []*readFrame +} + +// +// diskQueueConsumer implementation of the queue.Consumer interface +// + +func (consumer *diskQueueConsumer) Get(eventCount int) (queue.Batch, error) { + if consumer.closed { + return nil, fmt.Errorf("Tried to read from a closed disk queue consumer") + } + + // Read at least one frame. This is guaranteed to eventually + // succeed unless the queue is closed. + frame, ok := <-consumer.queue.readerLoop.output + if !ok { + return nil, fmt.Errorf("Tried to read from a closed disk queue") + } + frames := []*readFrame{frame} +eventLoop: + for eventCount <= 0 || len(frames) < eventCount { + select { + case frame, ok := <-consumer.queue.readerLoop.output: + if !ok { + // The queue was closed while we were reading it, just send back + // what we have so far. + break eventLoop + } + frames = append(frames, frame) + default: + // We can't read any more frames without blocking, so send back + // what we have now. + break eventLoop + } + } + + // There is a mild race condition here based on queue closure: events + // written to readerLoop.output may have been buffered before the + // queue was closed, and we may be reading its leftovers afterwards. + // We could try to detect this case here by checking the + // consumer.queue.done channel, and return nothing if it's been closed. + // But this gives rise to another race: maybe the queue was + // closed _after_ we read those frames, and we _ought_ to return them + // to the reader. The queue interface doesn't specify the proper + // behavior in this case. + // + // Lacking formal requirements, we elect to be permissive: if we have + // managed to read frames, then the queue already knows and considers them + // "read," so we lose no consistency by returning them. If someone closes + // the queue while we are draining the channel, nothing changes functionally + // except that any ACKs after that point will be ignored. A well-behaved + // Beats shutdown will always ACK / close its consumers before closing the + // queue itself, so we expect this corner case not to arise in practice, but + // if it does it is innocuous. + + return &diskQueueBatch{ + queue: consumer.queue, + frames: frames, + }, nil +} + +func (consumer *diskQueueConsumer) Close() error { + consumer.closed = true + return nil +} + +// +// diskQueueBatch implementation of the queue.Batch interface +// + +func (batch *diskQueueBatch) Events() []publisher.Event { + events := make([]publisher.Event, len(batch.frames)) + for i, frame := range batch.frames { + events[i] = frame.event + } + return events +} + +func (batch *diskQueueBatch) ACK() { + batch.queue.acks.addFrames(batch.frames) +} diff --git a/libbeat/publisher/queue/diskqueue/core_loop.go b/libbeat/publisher/queue/diskqueue/core_loop.go new file mode 100644 index 00000000000..56a50b5a422 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/core_loop.go @@ -0,0 +1,449 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import "fmt" + +// This file contains the queue's "core loop" -- the central goroutine +// that owns all queue state that is not encapsulated in one of the +// self-contained helper loops. This is the only file that is allowed to +// modify the queue state after its creation, and it contains the full +// logical "state transition diagram" for queue operation. + +func (dq *diskQueue) run() { + // Wake up the reader and deleter loops if there are segments to process + // from a previous instantiation of the queue. + dq.maybeReadPending() + dq.maybeDeleteACKed() + + for { + select { + // Endpoints used by the producer / consumer API implementation. + case producerWriteRequest := <-dq.producerWriteRequestChan: + dq.handleProducerWriteRequest(producerWriteRequest) + + // After a write request, there may be data ready to send to the + // writer loop. + dq.maybeWritePending() + + case ackedSegmentID := <-dq.acks.segmentACKChan: + dq.handleSegmentACK(ackedSegmentID) + + // After receiving new ACKs, a segment might be ready to delete. + dq.maybeDeleteACKed() + + case <-dq.done: + dq.handleShutdown() + return + + // Writer loop handling + case writerLoopResponse := <-dq.writerLoop.responseChan: + dq.handleWriterLoopResponse(writerLoopResponse) + + // The writer loop completed a request, so check if there is more + // data to be sent. + dq.maybeWritePending() + // We also check whether the reader loop is waiting for the data + // that was just written. + dq.maybeReadPending() + + // Reader loop handling + case readerLoopResponse := <-dq.readerLoop.responseChan: + dq.handleReaderLoopResponse(readerLoopResponse) + + // If there is more data to read, start a new read request. + dq.maybeReadPending() + + // Deleter loop handling + case deleterLoopResponse := <-dq.deleterLoop.responseChan: + dq.handleDeleterLoopResponse(deleterLoopResponse) + + // If there are still files waiting to be deleted, send another request. + dq.maybeDeleteACKed() + + // If there were blocked producers waiting for more queue space, + // we might be able to unblock them now. + dq.maybeUnblockProducers() + } + } +} + +func (dq *diskQueue) handleProducerWriteRequest(request producerWriteRequest) { + // Pathological case checking: make sure the incoming frame isn't bigger + // than an entire segment all by itself (as long as it isn't, it is + // guaranteed to eventually enter the queue assuming no disk errors). + frameSize := request.frame.sizeOnDisk() + if dq.settings.MaxSegmentSize < frameSize { + dq.logger.Warnf( + "Rejecting event with size %v because the maximum segment size is %v", + frameSize, dq.settings.MaxSegmentSize) + request.responseChan <- false + return + } + + // If no one else is blocked waiting for queue capacity, and there is + // enough space, then we add the new frame and report success. + // Otherwise, we either add to the end of blockedProducers to wait for + // the requested space or report immediate failure, depending on the + // producer settings. + if len(dq.blockedProducers) == 0 && dq.canAcceptFrameOfSize(frameSize) { + // There is enough space for the new frame! Add it to the + // pending list and report success, then dispatch it to the + // writer loop if no other requests are outstanding. + dq.enqueueWriteFrame(request.frame) + request.responseChan <- true + } else { + // The queue is too full. Either add the request to blockedProducers, + // or send an immediate reject. + if request.shouldBlock { + dq.blockedProducers = append(dq.blockedProducers, request) + } else { + request.responseChan <- false + } + } +} + +func (dq *diskQueue) handleWriterLoopResponse(response writerLoopResponse) { + dq.writing = false + + // The writer loop response contains the number of bytes written to + // each segment that appeared in the request. Entries always appear in + // the same sequence as (the beginning of) segments.writing. + for index, bytesWritten := range response.bytesWritten { + // Update the segment with its new size. + dq.segments.writing[index].endOffset += segmentOffset(bytesWritten) + } + + // If there is more than one segment in the response, then all but the + // last have been closed and are ready to move to the reading list. + closedCount := len(response.bytesWritten) - 1 + if closedCount > 0 { + // Remove the prefix of the writing array and append to to reading. + closedSegments := dq.segments.writing[:closedCount] + dq.segments.writing = dq.segments.writing[closedCount:] + dq.segments.reading = + append(dq.segments.reading, closedSegments...) + } +} + +func (dq *diskQueue) handleReaderLoopResponse(response readerLoopResponse) { + dq.reading = false + + // Advance the frame / offset based on what was just completed. + dq.segments.nextReadFrameID += frameID(response.frameCount) + dq.segments.nextReadOffset += segmentOffset(response.byteCount) + + var segment *queueSegment + if len(dq.segments.reading) > 0 { + // A segment is finished if we have read all the data, or + // the read response reports an error. + // Segments in the reading list have been completely written, + // so we can rely on their endOffset field to determine their size. + segment = dq.segments.reading[0] + if dq.segments.nextReadOffset >= segment.endOffset || response.err != nil { + dq.segments.reading = dq.segments.reading[1:] + dq.segments.acking = append(dq.segments.acking, segment) + dq.segments.nextReadOffset = 0 + } + } else { + // A segment in the writing list can't be finished writing, + // so we don't check the endOffset. + segment = dq.segments.writing[0] + } + segment.framesRead = uint64(dq.segments.nextReadFrameID - segment.firstFrameID) + + // If there was an error, report it. + if response.err != nil { + dq.logger.Errorf( + "Error reading segment file %s: %v", + dq.settings.segmentPath(segment.id), response.err) + } +} + +func (dq *diskQueue) handleDeleterLoopResponse(response deleterLoopResponse) { + dq.deleting = false + newAckedSegments := []*queueSegment{} + errors := []error{} + for i, err := range response.results { + if err != nil { + // This segment had an error, so it stays in the acked list. + newAckedSegments = append(newAckedSegments, dq.segments.acked[i]) + errors = append(errors, + fmt.Errorf("Couldn't delete segment %d: %w", + dq.segments.acked[i].id, err)) + } + } + if len(dq.segments.acked) > len(response.results) { + // Preserve any new acked segments that were added during the deletion + // request. + tail := dq.segments.acked[len(response.results):] + newAckedSegments = append(newAckedSegments, tail...) + } + dq.segments.acked = newAckedSegments + if len(errors) > 0 { + dq.logger.Errorw("Deleting segment files", "errors", errors) + } +} + +func (dq *diskQueue) handleSegmentACK(ackedSegmentID segmentID) { + acking := dq.segments.acking + if len(acking) == 0 { + return + } + ackedSegmentCount := 0 + for ; ackedSegmentCount < len(acking); ackedSegmentCount++ { + if acking[ackedSegmentCount].id > ackedSegmentID { + // This segment has not been acked yet, we're done. + break + } + } + if ackedSegmentCount > 0 { + // Move fully acked segments to the acked list and remove them + // from the acking list. + dq.segments.acked = + append(dq.segments.acked, acking[:ackedSegmentCount]...) + dq.segments.acking = acking[ackedSegmentCount:] + } +} + +func (dq *diskQueue) handleShutdown() { + // Shutdown: first, we wait for any outstanding requests to complete, to + // make sure the helper loops are idle and all state is finalized, then + // we do final cleanup and write our position to disk. + + // Close the reader loop's request channel to signal an abort in case it's + // still processing a request (we don't need any more frames). + // We still wait for acknowledgement afterwards: if there is a request in + // progress, it's possible that a consumer already read and acknowledged + // some of its data, so we want the final metadata before we write our + // closing state. + close(dq.readerLoop.requestChan) + if dq.reading { + response := <-dq.readerLoop.responseChan + dq.handleReaderLoopResponse(response) + } + + // We are assured by our callers within Beats that we will not be sent a + // shutdown signal until all our producers have been finalized / + // shut down -- thus, there should be no writer requests outstanding, and + // writerLoop.requestChan should be idle. But just in case (and in + // particular to handle the case where a request is stuck retrying a fatal + // error), we signal abort by closing the request channel, and read the + // final state if there is any. + close(dq.writerLoop.requestChan) + if dq.writing { + response := <-dq.writerLoop.responseChan + dq.handleWriterLoopResponse(response) + } + + // We let the deleter loop finish its current request, but we don't send + // the abort signal yet, since we might want to do one last deletion + // after checking the final consumer ACK state. + if dq.deleting { + response := <-dq.deleterLoop.responseChan + dq.handleDeleterLoopResponse(response) + } + + // If there are any blocked producers still hoping for space to open up + // in the queue, send them the bad news. + for _, request := range dq.blockedProducers { + request.responseChan <- false + } + dq.blockedProducers = nil + + // The reader and writer loops are now shut down, and the deleter loop is + // idle. The remaining cleanup is in finalizing the read position in the + // queue (the first event that hasn't been acknowledged by consumers), and + // in deleting any older segment files that may be left. + // + // Events read by consumers have been accumulating their ACK data in + // dq.acks. During regular operation the core loop is not allowed to use + // this data, since it requires holding a mutex, but during shutdown we're + // allowed to block to acquire it. However, we still must close its done + // channel first, otherwise the lock may be held by a consumer that is + // blocked trying to send us a message we're no longer listening to... + close(dq.acks.done) + dq.acks.lock.Lock() + finalPosition := dq.acks.nextPosition + // We won't be updating the position anymore, so we can close the file. + dq.acks.positionFile.Sync() + dq.acks.positionFile.Close() + dq.acks.lock.Unlock() + + // First check for the rare and fortunate case that every single event we + // wrote to the queue was ACKed. In this case it is safe to delete + // everything up to and including the current segment. Otherwise, we only + // delete things before the current segment. + if len(dq.segments.writing) > 0 && + finalPosition.segmentID == dq.segments.writing[0].id && + finalPosition.offset >= dq.segments.writing[0].endOffset { + dq.handleSegmentACK(finalPosition.segmentID) + } else if finalPosition.segmentID > 0 { + dq.handleSegmentACK(finalPosition.segmentID - 1) + } + + // Do one last round of deletions, then shut down the deleter loop. + dq.maybeDeleteACKed() + if dq.deleting { + response := <-dq.deleterLoop.responseChan + dq.handleDeleterLoopResponse(response) + } + close(dq.deleterLoop.requestChan) +} + +// If the pendingFrames list is nonempty, and there are no outstanding +// requests to the writer loop, send the next batch of frames. +func (dq *diskQueue) maybeWritePending() { + if dq.writing || len(dq.pendingFrames) == 0 { + // Nothing to do right now + return + } + // Remove everything from pendingFrames and forward it to the writer loop. + frames := dq.pendingFrames + dq.pendingFrames = nil + + dq.writerLoop.requestChan <- writerLoopRequest{ + frames: frames, + } + dq.writing = true +} + +// Returns the active read segment, or nil if there is none. +func (segments *diskQueueSegments) readingSegment() *queueSegment { + if len(segments.reading) > 0 { + return segments.reading[0] + } + if len(segments.writing) > 0 { + return segments.writing[0] + } + return nil +} + +// If the reading list is nonempty, and there are no outstanding read +// requests, send one. +func (dq *diskQueue) maybeReadPending() { + if dq.reading { + // A read request is already pending + return + } + segment := dq.segments.readingSegment() + if segment == nil || + dq.segments.nextReadOffset >= segmentOffset(segment.endOffset) { + // Nothing to read + return + } + if dq.segments.nextReadOffset == 0 { + // If we're reading the beginning of this segment, assign its firstFrameID. + segment.firstFrameID = dq.segments.nextReadFrameID + } + request := readerLoopRequest{ + segment: segment, + startFrameID: dq.segments.nextReadFrameID, + startOffset: dq.segments.nextReadOffset, + endOffset: segment.endOffset, + } + dq.readerLoop.requestChan <- request + dq.reading = true +} + +// If the acked list is nonempty, and there are no outstanding deletion +// requests, send one. +func (dq *diskQueue) maybeDeleteACKed() { + if !dq.deleting && len(dq.segments.acked) > 0 { + dq.deleterLoop.requestChan <- deleterLoopRequest{ + segments: dq.segments.acked} + dq.deleting = true + } +} + +// maybeUnblockProducers checks whether the queue has enough free space +// to accept any of the requests in the blockedProducers list, and if so +// accepts them in order and updates the list. +func (dq *diskQueue) maybeUnblockProducers() { + unblockedCount := 0 + for _, request := range dq.blockedProducers { + if !dq.canAcceptFrameOfSize(request.frame.sizeOnDisk()) { + // Not enough space for this frame, we're done. + break + } + // Add the frame to pendingFrames and report success. + dq.enqueueWriteFrame(request.frame) + request.responseChan <- true + unblockedCount++ + } + if unblockedCount > 0 { + dq.blockedProducers = dq.blockedProducers[unblockedCount:] + } +} + +// enqueueWriteFrame determines which segment an incoming frame should be +// written to and adds the resulting segmentedFrame to pendingFrames. +func (dq *diskQueue) enqueueWriteFrame(frame *writeFrame) { + // Start with the most recent writing segment if there is one. + var segment *queueSegment + if len(dq.segments.writing) > 0 { + segment = dq.segments.writing[len(dq.segments.writing)-1] + } + frameLen := segmentOffset(frame.sizeOnDisk()) + // If segment is nil, or the new segment exceeds its bounds, + // we need to create a new writing segment. + if segment == nil || + dq.segments.nextWriteOffset+frameLen > dq.settings.maxSegmentOffset() { + segment = &queueSegment{id: dq.segments.nextID} + dq.segments.writing = append(dq.segments.writing, segment) + dq.segments.nextID++ + dq.segments.nextWriteOffset = 0 + } + + dq.segments.nextWriteOffset += frameLen + dq.pendingFrames = append(dq.pendingFrames, segmentedFrame{ + frame: frame, + segment: segment, + }) +} + +// canAcceptFrameOfSize checks whether there is enough free space in the +// queue (subject to settings.MaxBufferSize) to accept a new frame with +// the given size. Size includes both the serialized data and the frame +// header / footer; the easy way to do this for a writeFrame is to pass +// in frame.sizeOnDisk(). +// Capacity calculations do not include requests in the blockedProducers +// list (that data is owned by its callers and we can't touch it until +// we are ready to respond). That allows this helper to be used both while +// handling producer requests and while deciding whether to unblock +// producers after free capacity increases. +// If we decide to add limits on how many events / bytes can be stored +// in pendingFrames (to avoid unbounded memory use if the input is faster +// than the disk), this is the function to modify. +func (dq *diskQueue) canAcceptFrameOfSize(frameSize uint64) bool { + if dq.settings.MaxBufferSize == 0 { + // Currently we impose no limitations if the queue size is unbounded. + return true + } + + // Compute the current queue size. We accept if there is enough capacity + // left in the queue after accounting for the existing segments and the + // pending writes that were already accepted. + pendingBytes := uint64(0) + for _, request := range dq.pendingFrames { + pendingBytes += request.frame.sizeOnDisk() + } + currentSize := pendingBytes + dq.segments.sizeOnDisk() + + return currentSize+frameSize <= dq.settings.MaxBufferSize +} diff --git a/libbeat/publisher/queue/diskqueue/core_loop_test.go b/libbeat/publisher/queue/diskqueue/core_loop_test.go new file mode 100644 index 00000000000..b5f0d301d15 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/core_loop_test.go @@ -0,0 +1,94 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import "testing" + +func TestProducerWriteRequest(t *testing.T) { + dq := &diskQueue{settings: DefaultSettings()} + frame := &writeFrame{ + serialized: make([]byte, 100), + } + request := producerWriteRequest{ + frame: frame, + shouldBlock: true, + responseChan: make(chan bool, 1), + } + dq.handleProducerWriteRequest(request) + + // The request inserts 100 bytes into an empty queue, so it should succeed. + // We expect: + // - the response channel should contain the value true + // - the frame should be added to pendingFrames and assigned to + // segment 0. + success, ok := <-request.responseChan + if !ok { + t.Error("Expected a response from the producer write request.") + } + if !success { + t.Error("Expected write request to succeed") + } + + if len(dq.pendingFrames) != 1 { + t.Error("Expected 1 pending frame after a write request.") + } + if dq.pendingFrames[0].frame != frame { + t.Error("Expected pendingFrames to contain the new frame.") + } + if dq.pendingFrames[0].segment.id != 0 { + t.Error("Expected new frame to be assigned to segment 0.") + } +} + +func TestHandleWriterLoopResponse(t *testing.T) { + // Initialize the queue with two writing segments only. + dq := &diskQueue{ + settings: DefaultSettings(), + segments: diskQueueSegments{ + writing: []*queueSegment{ + {id: 1}, + {id: 2}, + }, + }, + } + // This response says that the writer loop wrote 200 bytes to the first + // segment and 100 bytes to the second. + dq.handleWriterLoopResponse(writerLoopResponse{ + bytesWritten: []int64{200, 100}, + }) + + // After the response is handled, we expect: + // - Each segment's endOffset should be incremented by the bytes written + // - Segment 1 should be moved to the reading list (because all but the + // last segment in a writer loop response has been closed) + // - Segment 2 should remain in the writing list + if len(dq.segments.reading) != 1 || dq.segments.reading[0].id != 1 { + t.Error("Expected segment 1 to move to the reading list") + } + if len(dq.segments.writing) != 1 || dq.segments.writing[0].id != 2 { + t.Error("Expected segment 2 to remain in the writing list") + } + if dq.segments.reading[0].endOffset != 200 { + t.Errorf("Expected segment 1 endOffset 200, got %d", + dq.segments.reading[0].endOffset) + } + if dq.segments.writing[0].endOffset != 100 { + t.Errorf("Expected segment 2 endOffset 100, got %d", + dq.segments.writing[0].endOffset) + } +} diff --git a/libbeat/publisher/queue/diskqueue/deleter_loop.go b/libbeat/publisher/queue/diskqueue/deleter_loop.go new file mode 100644 index 00000000000..4e685285948 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/deleter_loop.go @@ -0,0 +1,99 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "errors" + "os" + "time" +) + +type deleterLoop struct { + // The settings for the queue that created this loop. + settings Settings + + // When one or more segments are ready to delete, they are sent to + // requestChan. At most one deleteRequest may be outstanding at any time. + requestChan chan deleterLoopRequest + + // When a request has been completely processed, a response is sent on + // responseChan. If at least one deletion was successful, the response + // is sent immediately. Otherwise, the deleter loop delays for + // queueSettings.RetryWriteInterval before returning, so timed retries + // don't have to be handled by the core loop. + responseChan chan deleterLoopResponse +} + +type deleterLoopRequest struct { + segments []*queueSegment +} + +type deleterLoopResponse struct { + results []error +} + +func newDeleterLoop(settings Settings) *deleterLoop { + return &deleterLoop{ + settings: settings, + + requestChan: make(chan deleterLoopRequest, 1), + responseChan: make(chan deleterLoopResponse), + } +} + +func (dl *deleterLoop) run() { + for { + request, ok := <-dl.requestChan + if !ok { + // The channel has been closed, time to shut down. + return + } + results := []error{} + deletedCount := 0 + for _, segment := range request.segments { + path := dl.settings.segmentPath(segment.id) + err := os.Remove(path) + // We ignore errors caused by the file not existing: this shouldn't + // happen, but it is still safe to report it as successfully removed. + if err == nil || errors.Is(err, os.ErrNotExist) { + deletedCount++ + results = append(results, nil) + } else { + results = append(results, err) + } + } + if len(request.segments) > 0 && deletedCount == 0 { + // If we were asked to delete segments but could not delete + // _any_ of them, we haven't made progress. Returning an error + // will log the issue and retry, but in this situation we + // want to delay before retrying. The core loop itself can't + // delay (it can never sleep or block), so we handle the + // delay here, by waiting before sending the result. + // The delay can be interrupted if the request channel is closed, + // indicating queue shutdown. + select { + // TODO: make the retry interval configurable. + case <-time.After(time.Second): + case <-dl.requestChan: + } + } + dl.responseChan <- deleterLoopResponse{ + results: results, + } + } +} diff --git a/libbeat/publisher/queue/diskqueue/frames.go b/libbeat/publisher/queue/diskqueue/frames.go new file mode 100644 index 00000000000..02571a65ce9 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/frames.go @@ -0,0 +1,72 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import "github.com/elastic/beats/v7/libbeat/publisher" + +// Every data frame read from the queue is assigned a unique sequential +// integer, which is used to keep track of which frames have been +// acknowledged. +// This id is not stable between restarts; the value 0 is always assigned +// to the oldest remaining frame on startup. +type frameID uint64 + +// A data frame created through the producer API and waiting to be +// written to disk. +type writeFrame struct { + // The event, serialized for writing to disk and wrapped in a frame + // header / footer. + serialized []byte + + // The producer that created this frame. This is included in the + // frame structure itself because we may need the producer and / or + // its config at any time up until it has been completely written: + // - While the core loop is tracking frames to send to the writer, + // it may receive a Cancel request, which requires us to know + // the producer / config each frame came from. + // - After the writer loop has finished writing the frame to disk, + // it needs to call the ACK function specified in ProducerConfig. + producer *diskQueueProducer +} + +// A frame that has been read from disk and is waiting to be read / +// acknowledged through the consumer API. +type readFrame struct { + // The segment containing this frame. + segment *queueSegment + + // The id of this frame. + id frameID + + // The event decoded from the data frame. + event publisher.Event + + // How much space this frame occupied on disk (before deserialization), + // including the frame header / footer. + bytesOnDisk uint64 +} + +// Each data frame has a 32-bit length in the header, and a 32-bit checksum +// and a duplicate 32-bit length in the footer. +const frameHeaderSize = 4 +const frameFooterSize = 8 +const frameMetadataSize = frameHeaderSize + frameFooterSize + +func (frame writeFrame) sizeOnDisk() uint64 { + return uint64(len(frame.serialized) + frameMetadataSize) +} diff --git a/libbeat/publisher/queue/diskqueue/producer.go b/libbeat/publisher/queue/diskqueue/producer.go new file mode 100644 index 00000000000..f4ff4ef2706 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/producer.go @@ -0,0 +1,109 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "github.com/elastic/beats/v7/libbeat/publisher" + "github.com/elastic/beats/v7/libbeat/publisher/queue" +) + +type diskQueueProducer struct { + // The disk queue that created this producer. + queue *diskQueue + + // The configuration this producer was created with. + config queue.ProducerConfig + + encoder *eventEncoder + + // When a producer is cancelled, cancelled is set to true and the done + // channel is closed. (We could get by with just a done channel, but we + // need to make sure that calling Cancel repeatedly doesn't close an + // already-closed channel, which would panic.) + cancelled bool + done chan struct{} +} + +// A request sent from a producer to the core loop to add a frame to the queue. +type producerWriteRequest struct { + frame *writeFrame + shouldBlock bool + responseChan chan bool +} + +// +// diskQueueProducer implementation of the queue.Producer interface +// + +func (producer *diskQueueProducer) Publish(event publisher.Event) bool { + return producer.publish(event, true) +} + +func (producer *diskQueueProducer) TryPublish(event publisher.Event) bool { + return producer.publish(event, false) +} + +func (producer *diskQueueProducer) publish( + event publisher.Event, shouldBlock bool, +) bool { + if producer.cancelled { + return false + } + serialized, err := producer.encoder.encode(&event) + if err != nil { + producer.queue.logger.Errorf( + "Couldn't serialize incoming event: %v", err) + return false + } + request := producerWriteRequest{ + frame: &writeFrame{ + serialized: serialized, + producer: producer, + }, + shouldBlock: shouldBlock, + // This response channel will be used by the core loop, so it must have + // buffer size 1 to guarantee that the core loop will not need to block. + responseChan: make(chan bool, 1), + } + + select { + case producer.queue.producerWriteRequestChan <- request: + // The request has been sent, and we are now guaranteed to get a result on + // the response channel, so we must read from it immediately to avoid + // blocking the core loop. + response := <-request.responseChan + return response + case <-producer.queue.done: + return false + case <-producer.done: + return false + } +} + +func (producer *diskQueueProducer) Cancel() int { + if producer.cancelled { + return 0 + } + producer.cancelled = true + close(producer.done) + + // TODO (possibly?): message the core loop to remove any pending events that + // were sent through this producer. If we do, return the number of cancelled + // events here instead of zero. + return 0 +} diff --git a/libbeat/publisher/queue/diskqueue/queue.go b/libbeat/publisher/queue/diskqueue/queue.go new file mode 100644 index 00000000000..5f756996e5f --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/queue.go @@ -0,0 +1,249 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "errors" + "fmt" + "os" + "sync" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/feature" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/publisher/queue" +) + +// diskQueue is the internal type representing a disk-based implementation +// of queue.Queue. +type diskQueue struct { + logger *logp.Logger + settings Settings + + // Metadata related to the segment files. + segments diskQueueSegments + + // Metadata related to consumer acks / positions of the oldest remaining + // frame. + acks *diskQueueACKs + + // The queue's helper loops, each of which is run in its own goroutine. + readerLoop *readerLoop + writerLoop *writerLoop + deleterLoop *deleterLoop + + // Wait group for shutdown of the goroutines associated with this queue: + // reader loop, writer loop, deleter loop, and core loop (diskQueue.run()). + waitGroup sync.WaitGroup + + // writing is true if the writer loop is processing a request, false + // otherwise. + writing bool + + // reading is true if the reader loop is processing a request, false + // otherwise. + reading bool + + // deleting is true if the deleter loop is processing a request, false + // otherwise. + deleting bool + + // The API channel used by diskQueueProducer to write events. + producerWriteRequestChan chan producerWriteRequest + + // pendingFrames is a list of all incoming data frames that have been + // accepted by the queue and are waiting to be sent to the writer loop. + // Segment ids in this list always appear in sorted order, even between + // requests (that is, a frame added to this list always has segment id + // at least as high as every previous frame that has ever been added). + pendingFrames []segmentedFrame + + // blockedProducers is a list of all producer write requests that are + // waiting for free space in the queue. + blockedProducers []producerWriteRequest + + // The channel to signal our goroutines to shut down. + done chan struct{} +} + +func init() { + queue.RegisterQueueType( + "disk", + queueFactory, + feature.MakeDetails( + "Disk queue", + "Buffer events on disk before sending to the output.", + feature.Beta)) +} + +// queueFactory matches the queue.Factory interface, and is used to add the +// disk queue to the registry. +func queueFactory( + ackListener queue.ACKListener, logger *logp.Logger, cfg *common.Config, +) (queue.Queue, error) { + settings, err := SettingsForUserConfig(cfg) + if err != nil { + return nil, fmt.Errorf("disk queue couldn't load user config: %w", err) + } + settings.WriteToDiskListener = ackListener + return NewQueue(logger, settings) +} + +// NewQueue returns a disk-based queue configured with the given logger +// and settings, creating it if it doesn't exist. +func NewQueue(logger *logp.Logger, settings Settings) (queue.Queue, error) { + logger = logger.Named("diskqueue") + logger.Debugf( + "Initializing disk queue at path %v", settings.directoryPath()) + + if settings.MaxBufferSize > 0 && + settings.MaxBufferSize < settings.MaxSegmentSize*2 { + return nil, fmt.Errorf( + "disk queue buffer size (%v) must be at least "+ + "twice the segment size (%v)", + settings.MaxBufferSize, settings.MaxSegmentSize) + } + + // Create the given directory path if it doesn't exist. + err := os.MkdirAll(settings.directoryPath(), os.ModePerm) + if err != nil { + return nil, fmt.Errorf("couldn't create disk queue directory: %w", err) + } + + // Load the previous queue position, if any. + nextReadPosition, err := queuePositionFromPath(settings.stateFilePath()) + if err != nil && !errors.Is(err, os.ErrNotExist) { + // Errors reading / writing the position are non-fatal -- we just log a + // warning and fall back on the oldest existing segment, if any. + logger.Warnf("Couldn't load most recent queue position: %v", err) + } + positionFile, err := os.OpenFile( + settings.stateFilePath(), os.O_WRONLY|os.O_CREATE, 0600) + if err != nil { + // This is not the _worst_ error: we could try operating even without a + // position file. But it indicates a problem with the queue permissions on + // disk, which keeps us from tracking our position within the segment files + // and could also prevent us from creating new ones, so we treat this as a + // fatal error on startup rather than quietly providing degraded + // performance. + return nil, fmt.Errorf("couldn't write to state file: %v", err) + } + + // Index any existing data segments to be placed in segments.reading. + initialSegments, err := scanExistingSegments(settings.directoryPath()) + if err != nil { + return nil, err + } + var nextSegmentID segmentID + if len(initialSegments) > 0 { + // Initialize nextSegmentID to the first ID after the existing segments. + lastID := initialSegments[len(initialSegments)-1].id + nextSegmentID = lastID + 1 + } + + // If any of the initial segments are older than the current queue + // position, move them directly to the acked list where they can be + // deleted. + ackedSegments := []*queueSegment{} + readSegmentID := nextReadPosition.segmentID + for len(initialSegments) > 0 && initialSegments[0].id < readSegmentID { + ackedSegments = append(ackedSegments, initialSegments[0]) + initialSegments = initialSegments[1:] + } + + // If the queue position is older than all existing segments, advance + // it to the beginning of the first one. + if len(initialSegments) > 0 && readSegmentID < initialSegments[0].id { + nextReadPosition = queuePosition{segmentID: initialSegments[0].id} + } + + queue := &diskQueue{ + logger: logger, + settings: settings, + + segments: diskQueueSegments{ + reading: initialSegments, + nextID: nextSegmentID, + nextReadOffset: nextReadPosition.offset, + }, + + acks: newDiskQueueACKs(logger, nextReadPosition, positionFile), + + readerLoop: newReaderLoop(settings), + writerLoop: newWriterLoop(logger, settings), + deleterLoop: newDeleterLoop(settings), + + producerWriteRequestChan: make(chan producerWriteRequest), + + done: make(chan struct{}), + } + + // We wait for four goroutines on shutdown: core loop, reader loop, + // writer loop, deleter loop. + queue.waitGroup.Add(4) + + // Start the goroutines and return the queue! + go func() { + queue.readerLoop.run() + queue.waitGroup.Done() + }() + go func() { + queue.writerLoop.run() + queue.waitGroup.Done() + }() + go func() { + queue.deleterLoop.run() + queue.waitGroup.Done() + }() + go func() { + queue.run() + queue.waitGroup.Done() + }() + + return queue, nil +} + +// +// diskQueue implementation of the queue.Queue interface +// + +func (dq *diskQueue) Close() error { + // Closing the done channel signals to the core loop that it should + // shut down the other helper goroutines and wrap everything up. + close(dq.done) + dq.waitGroup.Wait() + + return nil +} + +func (dq *diskQueue) BufferConfig() queue.BufferConfig { + return queue.BufferConfig{MaxEvents: 0} +} + +func (dq *diskQueue) Producer(cfg queue.ProducerConfig) queue.Producer { + return &diskQueueProducer{ + queue: dq, + config: cfg, + encoder: newEventEncoder(), + done: make(chan struct{}), + } +} + +func (dq *diskQueue) Consumer() queue.Consumer { + return &diskQueueConsumer{queue: dq} +} diff --git a/libbeat/publisher/queue/diskqueue/reader_loop.go b/libbeat/publisher/queue/diskqueue/reader_loop.go new file mode 100644 index 00000000000..dc2bb95777f --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/reader_loop.go @@ -0,0 +1,247 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "encoding/binary" + "fmt" + "os" +) + +type readerLoopRequest struct { + segment *queueSegment + startOffset segmentOffset + startFrameID frameID + endOffset segmentOffset +} + +type readerLoopResponse struct { + // The number of frames successfully read from the requested segment file. + frameCount uint64 + + // The number of bytes successfully read from the requested segment file. + byteCount uint64 + + // If there was an error in the segment file (i.e. inconsistent data), the + // err field is set. + err error +} + +type readerLoop struct { + // The settings for the queue that created this loop. + settings Settings + + // When there is a block available for reading, it will be sent to + // requestChan. When the reader loop has finished processing it, it + // sends the result to finishedReading. If there is more than one block + // available for reading, the core loop will wait until it gets a + // finishedReadingMessage before it + requestChan chan readerLoopRequest + responseChan chan readerLoopResponse + + // Frames that have been read from disk are sent to this channel. + // Unlike most of the queue's API channels, this one is buffered to allow + // the reader to read ahead and cache pending frames before a consumer + // explicitly requests them. + output chan *readFrame + + // The helper object to deserialize binary blobs from the queue into + // publisher.Event objects that can be returned in a readFrame. + decoder *eventDecoder +} + +func newReaderLoop(settings Settings) *readerLoop { + return &readerLoop{ + settings: settings, + + requestChan: make(chan readerLoopRequest, 1), + responseChan: make(chan readerLoopResponse), + output: make(chan *readFrame, settings.ReadAheadLimit), + decoder: newEventDecoder(), + } +} + +func (rl *readerLoop) run() { + for { + request, ok := <-rl.requestChan + if !ok { + // The channel is closed, we are shutting down. + close(rl.output) + return + } + response := rl.processRequest(request) + rl.responseChan <- response + } +} + +func (rl *readerLoop) processRequest(request readerLoopRequest) readerLoopResponse { + frameCount := uint64(0) + byteCount := uint64(0) + nextFrameID := request.startFrameID + + // Open the file and seek to the starting position. + handle, err := request.segment.getReader(rl.settings) + if err != nil { + return readerLoopResponse{err: err} + } + defer handle.Close() + _, err = handle.Seek(segmentHeaderSize+int64(request.startOffset), 0) + if err != nil { + return readerLoopResponse{err: err} + } + + targetLength := uint64(request.endOffset - request.startOffset) + for { + remainingLength := targetLength - byteCount + + // Try to read the next frame, clipping to the given bound. + // If the next frame extends past this boundary, nextFrame will return + // an error. + frame, err := rl.nextFrame(handle, remainingLength) + if frame != nil { + // Add the segment / frame ID, which nextFrame leaves blank. + frame.segment = request.segment + frame.id = nextFrameID + nextFrameID++ + // We've read the frame, try sending it to the output channel. + select { + case rl.output <- frame: + // Successfully sent! Increment the total for this request. + frameCount++ + byteCount += frame.bytesOnDisk + case <-rl.requestChan: + // Since we haven't sent a finishedReading message yet, we can only + // reach this case when the nextReadBlock channel is closed, indicating + // queue shutdown. In this case we immediately return. + return readerLoopResponse{ + frameCount: frameCount, + byteCount: byteCount, + err: nil, + } + } + } + + // We are done with this request if: + // - there was an error reading the frame, + // - there are no more frames to read, or + // - we have reached the end of the requested region + if err != nil || frame == nil || byteCount >= targetLength { + return readerLoopResponse{ + frameCount: frameCount, + byteCount: byteCount, + err: err, + } + } + + // If the output channel's buffer is not full, the previous select + // might not recognize when the queue is being closed, so check that + // again separately before we move on to the next data frame. + select { + case <-rl.requestChan: + return readerLoopResponse{ + frameCount: frameCount, + byteCount: byteCount, + err: nil, + } + default: + } + } +} + +// nextFrame reads and decodes one frame from the given file handle, as long +// it does not exceed the given length bound. The returned frame leaves the +// segment and frame IDs unset. +func (rl *readerLoop) nextFrame( + handle *os.File, maxLength uint64, +) (*readFrame, error) { + // Ensure we are allowed to read the frame header. + if maxLength < frameHeaderSize { + return nil, fmt.Errorf( + "Can't read next frame: remaining length %d is too low", maxLength) + } + // Wrap the handle to retry non-fatal errors and always return the full + // requested data length if possible. + reader := autoRetryReader{handle} + var frameLength uint32 + err := binary.Read(reader, binary.LittleEndian, &frameLength) + if err != nil { + return nil, fmt.Errorf("Couldn't read data frame header: %w", err) + } + + // If the frame extends past the area we were told to read, return an error. + // This should never happen unless the segment file is corrupted. + if maxLength < uint64(frameLength) { + return nil, fmt.Errorf( + "Can't read next frame: frame size is %d but remaining data is only %d", + frameLength, maxLength) + } + if frameLength <= frameMetadataSize { + // Valid enqueued data must have positive length + return nil, fmt.Errorf( + "Data frame with no data (length %d)", frameLength) + } + + // Read the actual frame data + dataLength := frameLength - frameMetadataSize + bytes := rl.decoder.Buffer(int(dataLength)) + _, err = reader.Read(bytes) + if err != nil { + return nil, fmt.Errorf("Couldn't read data frame content: %w", err) + } + + // Read the footer (checksum + duplicate length) + var checksum uint32 + err = binary.Read(reader, binary.LittleEndian, &checksum) + if err != nil { + return nil, fmt.Errorf("Couldn't read data frame checksum: %w", err) + } + expected := computeChecksum(bytes) + if checksum != expected { + return nil, fmt.Errorf( + "Data frame checksum mismatch (%x != %x)", checksum, expected) + } + + var duplicateLength uint32 + err = binary.Read(reader, binary.LittleEndian, &duplicateLength) + if err != nil { + return nil, fmt.Errorf("Couldn't read data frame footer: %w", err) + } + if duplicateLength != frameLength { + return nil, fmt.Errorf( + "Inconsistent data frame length (%d vs %d)", + frameLength, duplicateLength) + } + + event, err := rl.decoder.Decode() + if err != nil { + // Unlike errors in the segment or frame metadata, this is entirely + // a problem in the event [de]serialization which may be isolated (i.e. + // may not indicate data corruption in the segment). + // TODO: Rather than pass this error back to the read request, which + // discards the rest of the segment, we should just log the error and + // advance to the next frame, which is likely still valid. + return nil, fmt.Errorf("Couldn't decode data frame: %w", err) + } + + frame := &readFrame{ + event: event, + bytesOnDisk: uint64(frameLength), + } + + return frame, nil +} diff --git a/libbeat/publisher/queue/diskqueue/segments.go b/libbeat/publisher/queue/diskqueue/segments.go new file mode 100644 index 00000000000..5ce0dc49962 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/segments.go @@ -0,0 +1,254 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "encoding/binary" + "fmt" + "io/ioutil" + "os" + "sort" + "strconv" + "strings" +) + +// diskQueueSegments encapsulates segment-related queue metadata. +type diskQueueSegments struct { + + // A list of the segments that have not yet been completely written, sorted + // by increasing segment ID. When the first entry has been completely + // written, it is removed from this list and appended to reading. + // + // If the reading list is empty, the queue may read from a segment that is + // still being written, but it will always be writing[0], since later + // entries do not yet exist on disk. + writing []*queueSegment + + // A list of the segments that have been completely written but have + // not yet been completely read, sorted by increasing segment ID. When the + // first entry has been completely read, it is removed from this list and + // appended to acking. + reading []*queueSegment + + // A list of the segments that have been completely read but have not yet + // been completely acknowledged, sorted by increasing segment ID. When the + // first entry has been completely acknowledged, it is removed from this + // list and appended to acked. + acking []*queueSegment + + // A list of the segments that have been completely read and acknowledged + // and are ready to be deleted. When a segment is successfully deleted, it + // is removed from this list and discarded. + acked []*queueSegment + + // The next sequential unused segment ID. This is what will be assigned + // to the next queueSegment we create. + nextID segmentID + + // nextWriteOffset is the segment offset at which the next new frame + // should be written. This offset always applies to the last entry of + // writing[]. This is distinct from the endOffset field within a segment: + // endOffset tracks how much data _has_ been written to a segment, while + // nextWriteOffset also includes everything that is _scheduled_ to be + // written. + nextWriteOffset segmentOffset + + // nextReadFrameID is the first frame ID in the current or pending + // read request. + nextReadFrameID frameID + + // nextReadOffset is the segment offset corresponding to the frame + // nextReadFrameID. This offset always applies to the first reading + // segment: either reading[0], or writing[0] if reading is empty. + nextReadOffset segmentOffset +} + +// segmentID is a unique persistent integer id assigned to each created +// segment in ascending order. +type segmentID uint64 + +// segmentOffset is a byte index into the segment's data region. +// An offset of 0 means the first byte after the segment file header. +type segmentOffset uint64 + +// The metadata for a single segment file. +type queueSegment struct { + // A segment id is globally unique within its originating queue. + id segmentID + + // The byte offset of the end of the segment's data region. This is + // updated when the segment is written to, and should always correspond + // to the end of a complete data frame. The total size of a segment file + // on disk is segmentHeaderSize + segment.endOffset. + endOffset segmentOffset + + // The ID of the first frame that was / will be read from this segment. + // This field is only valid after a read request has been sent for + // this segment. (Currently it is only used to handle consumer ACKs, + // which can only happen after reading has begun on the segment.) + firstFrameID frameID + + // The number of frames read from this segment during this session. This + // does not necessarily equal the number of frames in the segment, even + // after reading is complete, since the segment may have been partially + // read during a previous session. + // + // Used to count how many frames still need to be acknowledged by consumers. + framesRead uint64 +} + +type segmentHeader struct { + version uint32 +} + +// Segment headers are currently just a 32-bit version. +const segmentHeaderSize = 4 + +// Sort order: we store loaded segments in ascending order by their id. +type bySegmentID []*queueSegment + +func (s bySegmentID) Len() int { return len(s) } +func (s bySegmentID) Swap(i, j int) { s[i], s[j] = s[j], s[i] } +func (s bySegmentID) Less(i, j int) bool { return s[i].id < s[j].id } + +// Scan the given path for segment files, and return them in a list +// ordered by segment id. +func scanExistingSegments(path string) ([]*queueSegment, error) { + files, err := ioutil.ReadDir(path) + if err != nil { + return nil, fmt.Errorf("Couldn't read queue directory '%s': %w", path, err) + } + + segments := []*queueSegment{} + for _, file := range files { + if file.Size() <= segmentHeaderSize { + // Ignore segments that don't have at least some data beyond the + // header (this will always be true of segments we write unless there + // is an error). + continue + } + components := strings.Split(file.Name(), ".") + if len(components) == 2 && strings.ToLower(components[1]) == "seg" { + // Parse the id as base-10 64-bit unsigned int. We ignore file names that + // don't match the "[uint64].seg" pattern. + if id, err := strconv.ParseUint(components[0], 10, 64); err == nil { + segments = append(segments, + &queueSegment{ + id: segmentID(id), + endOffset: segmentOffset(file.Size() - segmentHeaderSize), + }) + } + } + } + sort.Sort(bySegmentID(segments)) + return segments, nil +} + +func (segment *queueSegment) sizeOnDisk() uint64 { + return uint64(segment.endOffset) + segmentHeaderSize +} + +// Should only be called from the reader loop. +func (segment *queueSegment) getReader( + queueSettings Settings, +) (*os.File, error) { + path := queueSettings.segmentPath(segment.id) + file, err := os.Open(path) + if err != nil { + return nil, fmt.Errorf( + "Couldn't open segment %d: %w", segment.id, err) + } + // Right now there is only one valid header (indicating schema version + // zero) so we don't need the value itself. + _, err = readSegmentHeader(file) + if err != nil { + file.Close() + return nil, fmt.Errorf("Couldn't read segment header: %w", err) + } + + return file, nil +} + +// Should only be called from the writer loop. +func (segment *queueSegment) getWriter( + queueSettings Settings, +) (*os.File, error) { + path := queueSettings.segmentPath(segment.id) + file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) + if err != nil { + return nil, err + } + header := &segmentHeader{version: 0} + err = writeSegmentHeader(file, header) + if err != nil { + return nil, fmt.Errorf("Couldn't write segment header: %w", err) + } + + return file, nil +} + +// getWriterWithRetry tries to create a file handle for writing via +// queueSegment.getWriter. On error, it retries as long as the given +// retry callback returns true. This is used for timed retries when +// creating a queue segment from the writer loop. +func (segment *queueSegment) getWriterWithRetry( + queueSettings Settings, retry func(error) bool, +) (*os.File, error) { + file, err := segment.getWriter(queueSettings) + for err != nil && retry(err) { + // Try again + file, err = segment.getWriter(queueSettings) + } + return file, err +} + +func readSegmentHeader(in *os.File) (*segmentHeader, error) { + header := &segmentHeader{} + err := binary.Read(in, binary.LittleEndian, &header.version) + if err != nil { + return nil, err + } + if header.version != 0 { + return nil, fmt.Errorf("Unrecognized schema version %d", header.version) + } + return header, nil +} + +func writeSegmentHeader(out *os.File, header *segmentHeader) error { + err := binary.Write(out, binary.LittleEndian, header.version) + return err +} + +// The number of bytes occupied by all the queue's segment files. This +// should only be called from the core loop. +func (segments *diskQueueSegments) sizeOnDisk() uint64 { + total := uint64(0) + for _, segment := range segments.writing { + total += segment.sizeOnDisk() + } + for _, segment := range segments.reading { + total += segment.sizeOnDisk() + } + for _, segment := range segments.acking { + total += segment.sizeOnDisk() + } + for _, segment := range segments.acked { + total += segment.sizeOnDisk() + } + return total +} diff --git a/libbeat/publisher/queue/diskqueue/serialize.go b/libbeat/publisher/queue/diskqueue/serialize.go new file mode 100644 index 00000000000..9db8e7b1bd9 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/serialize.go @@ -0,0 +1,154 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Encoding / decoding routines adapted from +// libbeat/publisher/queue/spool/codec.go. + +package diskqueue + +import ( + "bytes" + "time" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/outputs/codec" + "github.com/elastic/beats/v7/libbeat/publisher" + "github.com/elastic/go-structform/gotype" + "github.com/elastic/go-structform/json" +) + +type eventEncoder struct { + buf bytes.Buffer + folder *gotype.Iterator +} + +type eventDecoder struct { + buf []byte + + parser *json.Parser + unfolder *gotype.Unfolder +} + +type entry struct { + Timestamp int64 + Flags uint8 + Meta common.MapStr + Fields common.MapStr +} + +const ( + // If + flagGuaranteed uint8 = 1 << 0 +) + +func newEventEncoder() *eventEncoder { + e := &eventEncoder{} + e.reset() + return e +} + +func (e *eventEncoder) reset() { + e.folder = nil + + visitor := json.NewVisitor(&e.buf) + // This can't return an error: NewIterator is deterministic based on its + // input, and doesn't return an error when called with valid options. In + // this case the options are hard-coded to fixed values, so they are + // guaranteed to be valid and we can safely proceed. + folder, _ := gotype.NewIterator(visitor, + gotype.Folders( + codec.MakeTimestampEncoder(), + codec.MakeBCTimestampEncoder(), + ), + ) + + e.folder = folder +} + +func (e *eventEncoder) encode(event *publisher.Event) ([]byte, error) { + e.buf.Reset() + + err := e.folder.Fold(entry{ + Timestamp: event.Content.Timestamp.UTC().UnixNano(), + Flags: uint8(event.Flags), + Meta: event.Content.Meta, + Fields: event.Content.Fields, + }) + if err != nil { + e.reset() + return nil, err + } + + // Copy the encoded bytes to a new array owned by the caller. + bytes := e.buf.Bytes() + result := make([]byte, len(bytes)) + copy(result, bytes) + + return result, nil +} + +func newEventDecoder() *eventDecoder { + d := &eventDecoder{} + d.reset() + return d +} + +func (d *eventDecoder) reset() { + // When called on nil, NewUnfolder deterministically returns a nil error, + // so it's safe to ignore the error result. + unfolder, _ := gotype.NewUnfolder(nil) + + d.unfolder = unfolder + d.parser = json.NewParser(unfolder) +} + +// Buffer prepares the read buffer to hold the next event of n bytes. +func (d *eventDecoder) Buffer(n int) []byte { + if cap(d.buf) > n { + d.buf = d.buf[:n] + } else { + d.buf = make([]byte, n) + } + return d.buf +} + +func (d *eventDecoder) Decode() (publisher.Event, error) { + var ( + to entry + err error + ) + + d.unfolder.SetTarget(&to) + defer d.unfolder.Reset() + + err = d.parser.Parse(d.buf) + + if err != nil { + d.reset() // reset parser just in case + return publisher.Event{}, err + } + + return publisher.Event{ + Flags: publisher.EventFlags(to.Flags), + Content: beat.Event{ + Timestamp: time.Unix(0, to.Timestamp), + Fields: to.Fields, + Meta: to.Meta, + }, + }, nil +} diff --git a/libbeat/publisher/queue/diskqueue/state_file.go b/libbeat/publisher/queue/diskqueue/state_file.go new file mode 100644 index 00000000000..2ff14e3e5e2 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/state_file.go @@ -0,0 +1,93 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "bufio" + "encoding/binary" + "fmt" + "os" +) + +// Given an open file handle to the queue state, decode the current position +// and return the result if successful, otherwise an error. +func queuePositionFromHandle( + file *os.File, +) (queuePosition, error) { + _, err := file.Seek(0, 0) + if err != nil { + return queuePosition{}, err + } + + reader := bufio.NewReader(file) + var version uint32 + err = binary.Read(reader, binary.LittleEndian, &version) + if err != nil { + return queuePosition{}, err + } + if version != 0 { + return queuePosition{}, + fmt.Errorf("Unsupported queue metadata version (%d)", version) + } + + position := queuePosition{} + err = binary.Read(reader, binary.LittleEndian, &position.segmentID) + if err != nil { + return queuePosition{}, err + } + + err = binary.Read( + reader, binary.LittleEndian, &position.offset) + if err != nil { + return queuePosition{}, err + } + + return position, nil +} + +func queuePositionFromPath(path string) (queuePosition, error) { + // Try to open an existing state file. + file, err := os.OpenFile(path, os.O_RDONLY, 0600) + if err != nil { + return queuePosition{}, err + } + defer file.Close() + return queuePositionFromHandle(file) +} + +// Given the queue position, encode and write it to the given file handle. +// Returns nil if successful, otherwise an error. +func writeQueuePositionToHandle( + file *os.File, + position queuePosition, +) error { + _, err := file.Seek(0, 0) + if err != nil { + return err + } + + // Want to write: version (0), segment id, segment offset. + elems := []interface{}{uint32(0), position.segmentID, position.offset} + for _, elem := range elems { + err = binary.Write(file, binary.LittleEndian, &elem) + if err != nil { + return err + } + } + return nil +} diff --git a/libbeat/publisher/queue/diskqueue/util.go b/libbeat/publisher/queue/diskqueue/util.go new file mode 100644 index 00000000000..60c529a9992 --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/util.go @@ -0,0 +1,89 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "errors" + "io" + "syscall" +) + +// A wrapper for an io.Reader that tries to read the full number of bytes +// requested, retrying on EAGAIN and EINTR, and returns an error if +// and only if the number of bytes read is less than requested. +// This is similar to io.ReadFull but with retrying. +type autoRetryReader struct { + wrapped io.Reader +} + +func (r autoRetryReader) Read(p []byte) (int, error) { + bytesRead := 0 + reader := r.wrapped + n, err := reader.Read(p) + for n < len(p) { + if err != nil && !readErrorIsRetriable(err) { + return bytesRead + n, err + } + // If there is an error, it is retriable, so advance p and try again. + bytesRead += n + p = p[n:] + n, err = reader.Read(p) + } + return bytesRead + n, nil +} + +func readErrorIsRetriable(err error) bool { + return errors.Is(err, syscall.EINTR) || errors.Is(err, syscall.EAGAIN) +} + +// writeErrorIsRetriable returns true if the given IO error can be +// immediately retried. +func writeErrorIsRetriable(err error) bool { + return errors.Is(err, syscall.EINTR) || errors.Is(err, syscall.EAGAIN) +} + +// callbackRetryWriter is an io.Writer that wraps another writer and enables +// write-with-retry. When a Write encounters an error, it is passed to the +// retry callback. If the callback returns true, the the writer retries +// any unwritten portion of the input, otherwise it passes the error back +// to the caller. +// This helper is specifically for working with the writer loop, which needs +// to be able to retry forever at configurable intervals, but also cancel +// immediately if the queue is closed. +// This writer is unbuffered. In particular, it is safe to modify the +// "wrapped" field in-place as long as it isn't captured by the callback. +type callbackRetryWriter struct { + wrapped io.Writer + retry func(error) bool +} + +func (w callbackRetryWriter) Write(p []byte) (int, error) { + bytesWritten := 0 + writer := w.wrapped + n, err := writer.Write(p) + for n < len(p) { + if err != nil && !w.retry(err) { + return bytesWritten + n, err + } + // Advance p and try again. + bytesWritten += n + p = p[n:] + n, err = writer.Write(p) + } + return bytesWritten + n, nil +} diff --git a/libbeat/publisher/queue/diskqueue/writer_loop.go b/libbeat/publisher/queue/diskqueue/writer_loop.go new file mode 100644 index 00000000000..b42e4573cab --- /dev/null +++ b/libbeat/publisher/queue/diskqueue/writer_loop.go @@ -0,0 +1,239 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package diskqueue + +import ( + "encoding/binary" + "os" + "time" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +// A segmentedFrame is a data frame waiting to be written to disk along with +// the segment it has been assigned to. +type segmentedFrame struct { + // The frame to be written to disk. + frame *writeFrame + + // The segment to which this frame should be written. + segment *queueSegment +} + +// A writer loop request contains a list of writeFrames with the +// segment each should be written to. +// +// Input invariant (segment ids are sorted): If a frame f is included in a +// writerLoopRequest, then every subsequent frame in this and future +// requests must have segment id at least f.segment.id. +// +// That is: we must write all frames for segment 0 before we start writing +// to frame 1, etc. This assumption allows all file operations to happen +// safely in the writer loop without any knowledge of the broader queue state. +type writerLoopRequest struct { + frames []segmentedFrame +} + +// A writerLoopResponse reports the number of bytes written to each +// segment in the request. There is guaranteed to be one entry for each +// segment that appeared in the request, in the same order. If there is +// more than one entry, then all but the last segment have been closed. +type writerLoopResponse struct { + bytesWritten []int64 +} + +type writerLoop struct { + // The settings for the queue that created this loop. + settings Settings + + // The logger for the writer loop, assigned when the queue creates it. + logger *logp.Logger + + // The writer loop listens on requestChan for frames to write, and + // writes them to disk immediately (all queue capacity checking etc. is + // done by the core loop before sending it to the writer). + // When this channel is closed, any in-progress writes are aborted and + // the run loop terminates. + requestChan chan writerLoopRequest + + // The writer loop sends to responseChan when it has finished handling a + // request, to signal the core loop that it is ready for the next one. + responseChan chan writerLoopResponse + + // The most recent segment that has been written to, if there is one. + // This segment + currentSegment *queueSegment + + // The file handle corresponding to currentSegment. When currentSegment + // changes, this handle is closed and a new one is created. + outputFile *os.File +} + +func newWriterLoop(logger *logp.Logger, settings Settings) *writerLoop { + return &writerLoop{ + logger: logger, + settings: settings, + + requestChan: make(chan writerLoopRequest, 1), + responseChan: make(chan writerLoopResponse), + } +} + +func (wl *writerLoop) run() { + for { + block, ok := <-wl.requestChan + if !ok { + // The request channel is closed, we are done + return + } + bytesWritten := wl.processRequest(block) + wl.responseChan <- writerLoopResponse{bytesWritten: bytesWritten} + } +} + +// processRequest writes the frames in the given request to disk and returns +// the number of bytes written to each segment, in the order they were +// encountered. +func (wl *writerLoop) processRequest(request writerLoopRequest) []int64 { + // retryWriter wraps the file handle with timed retries. + // retryWriter.Write is guaranteed to return only if the write + // completely succeeded or the queue is being closed. + retryWriter := callbackRetryWriter{retry: wl.retryCallback} + + // We keep track of how many frames are written during this request, + // and send the associated ACKs to the queue / producer listeners + // in a batch at the end (since each ACK call can involve a round-trip + // to the registry). + totalACKCount := 0 + producerACKCounts := make(map[*diskQueueProducer]int) + + var bytesWritten []int64 // Bytes written to all segments. + curBytesWritten := int64(0) // Bytes written to the current segment. +outerLoop: + for _, frameRequest := range request.frames { + // If the new segment doesn't match the last one, we need to open a new + // file handle and possibly clean up the old one. + if wl.currentSegment != frameRequest.segment { + wl.logger.Debugf( + "Creating new segment file with id %v\n", frameRequest.segment.id) + if wl.outputFile != nil { + // Try to sync to disk, then close the file. + wl.outputFile.Sync() + wl.outputFile.Close() + wl.outputFile = nil + // We are done with this segment, add the byte count to the list and + // reset the current counter. + bytesWritten = append(bytesWritten, curBytesWritten) + curBytesWritten = 0 + } + wl.currentSegment = frameRequest.segment + file, err := wl.currentSegment.getWriterWithRetry( + wl.settings, wl.retryCallback) + if err != nil { + // This can only happen if the queue is being closed; abort. + break + } + wl.outputFile = file + } + // Make sure our writer points to the current file handle. + retryWriter.wrapped = wl.outputFile + + // We have the data and a file to write it to. We are now committed + // to writing this block unless the queue is closed in the meantime. + frameSize := uint32(frameRequest.frame.sizeOnDisk()) + + // The Write calls below all pass through retryWriter, so they can + // only return an error if the write should be aborted. Thus, all we + // need to do when we see an error is break out of the request loop. + err := binary.Write(retryWriter, binary.LittleEndian, frameSize) + if err != nil { + break + } + _, err = retryWriter.Write(frameRequest.frame.serialized) + if err != nil { + break + } + // Compute / write the frame's checksum + checksum := computeChecksum(frameRequest.frame.serialized) + err = binary.Write(wl.outputFile, binary.LittleEndian, checksum) + if err != nil { + break + } + // Write the frame footer's (duplicate) length + err = binary.Write(wl.outputFile, binary.LittleEndian, frameSize) + if err != nil { + break + } + // Update the byte count as the last step: that way if we abort while + // a frame is partially written, we only report up to the last + // complete frame. (This almost never matters, but it allows for + // more controlled recovery after a bad shutdown.) + curBytesWritten += int64(frameSize) + + // Update the ACKs that will be sent at the end of the request. + totalACKCount++ + if frameRequest.frame.producer.config.ACK != nil { + producerACKCounts[frameRequest.frame.producer]++ + } + + // Explicitly check if we should abort before starting the next frame. + select { + case <-wl.requestChan: + break outerLoop + default: + } + } + // Try to sync the written data to disk. + wl.outputFile.Sync() + + // If the queue has an ACK listener, notify it the frames were written. + if wl.settings.WriteToDiskListener != nil { + wl.settings.WriteToDiskListener.OnACK(totalACKCount) + } + + // Notify any producers with ACK listeners that their frames were written. + for producer, ackCount := range producerACKCounts { + producer.config.ACK(ackCount) + } + + // Return the total byte counts, including the final segment. + return append(bytesWritten, curBytesWritten) +} + +// retryCallback is called (by way of retryCallbackWriter) when there is +// an error writing to a segment file. It pauses for a configurable +// interval and returns true if the operation should be retried (which +// it always should, unless the queue is being closed). +func (wl *writerLoop) retryCallback(err error) bool { + if writeErrorIsRetriable(err) { + return true + } + // If the error is not immediately retriable, log the error + // and wait for the retry interval before trying again, but + // abort if the queue is closed (indicated by the request channel + // becoming unblocked). + wl.logger.Errorf("Writing to segment %v: %v", + wl.currentSegment.id, err) + select { + case <-time.After(time.Second): + // TODO: use a configurable interval here + return true + case <-wl.requestChan: + return false + } +} From ddfe085974ef91f85f09eba65ace9b5149368b47 Mon Sep 17 00:00:00 2001 From: Shaunak Kashyap Date: Mon, 28 Sep 2020 12:50:45 -0400 Subject: [PATCH 066/216] Adds a default for failure_cache.min_ttl (#21085) * Adds a default for failure_cache.min_ttl * Parse YAML as inline + fix default value Fixes #21103 Co-authored-by: Adrian Serrano --- libbeat/processors/dns/config.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libbeat/processors/dns/config.go b/libbeat/processors/dns/config.go index b5e7cf0a0d3..8b0d6c9bd97 100644 --- a/libbeat/processors/dns/config.go +++ b/libbeat/processors/dns/config.go @@ -29,7 +29,7 @@ import ( // Config defines the configuration options for the DNS processor. type Config struct { - CacheConfig + CacheConfig `config:",inline"` Nameservers []string `config:"nameservers"` // Required on Windows. /etc/resolv.conf is used if none are given. Timeout time.Duration `conifg:"timeout"` // Per request timeout (with 2 nameservers the total timeout would be 2x). Type string `config:"type" validate:"required"` // Reverse is the only supported type currently. @@ -89,7 +89,7 @@ type CacheSettings struct { TTL time.Duration `config:"ttl"` // Minimum TTL value for successful DNS responses. - MinTTL time.Duration `config:"min_ttl" validate:"min=1"` + MinTTL time.Duration `config:"min_ttl" validate:"min=1ns"` // Initial capacity. How much space is allocated at initialization. InitialCapacity int `config:"capacity.initial" validate:"min=0"` @@ -166,6 +166,7 @@ var defaultConfig = Config{ MaxCapacity: 10000, }, FailureCache: CacheSettings{ + MinTTL: time.Minute, TTL: time.Minute, InitialCapacity: 1000, MaxCapacity: 10000, From 3f017df98891fda84b03a5640e42f9275ff2dfa9 Mon Sep 17 00:00:00 2001 From: Pier-Hugues Pellerin Date: Mon, 28 Sep 2020 15:37:30 -0400 Subject: [PATCH 067/216] [Elastic Agent] Allow embedding of certificate (#21179) * [Elastic Agent] Allow embedding of certificate This PR allow to embed Certificate authorities directly in the yaml configuration. This is useful in the context of fleet where distributing file to the remote host is not possible. The format of the string need to be in PEM. Example: Certificate Authorities ```yaml enabled: true verification_mode: null certificate: null key: null key_passphrase: null certificate_authorities: - | -----BEGIN CERTIFICATE----- MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk sxSmbIUfc2SGJGCJD4I= -----END CERTIFICATE----- cipher_suites: null curve_types: null supported_protocols: null ``` ```Certificate and Key enabled: true verification_mode: null certificate: | -----BEGIN CERTIFICATE----- MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk sxSmbIUfc2SGJGCJD4I= -----END CERTIFICATE----- key: | -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDXHufGPycpCOfI sjl6cRn8NP4DLxdIVEAHFK0jMRDup32UQOPW+DleEsFpgN9/ebi9ngdjQfMvKnUP Zrl1HTwVhOJfazGeoJn7vdDeQebhJfeDXHwX2DiotXyUPYu1ioU45UZDAoAZFj5F KJLwWRUbfEbRe8yO+wUhKKxxkApPbfw+wUtBicn1RIX7W1nBRABt1UXKDIRe5FM2 MKfqhEqK4hUWC3g1r+vGTrxu3qFpzz7L2UrRFRIpo7yuTUhEhEGvcVsiTppTil4Z HcprXFHf5158elEwhYJ5IM0nU1leNQiOgemifbLwkyNkLqCKth8V/4sezr1tYblZ nMh1cclBAgMBAAECggEBAKdP5jyOicqknoG9/G564RcDsDyRt64NuO7I6hBg7SZx Jn7UKWDdFuFP/RYtoabn6QOxkVVlydp5Typ3Xu7zmfOyss479Q/HIXxmmbkD0Kp0 eRm2KN3y0b6FySsS40KDRjKGQCuGGlNotW3crMw6vOvvsLTlcKgUHF054UVCHoK/ Piz7igkDU7NjvJeha53vXL4hIjb10UtJNaGPxIyFLYRZdRPyyBJX7Yt3w8dgz8WM epOPu0dq3bUrY3WQXcxKZo6sQjE1h7kdl4TNji5jaFlvD01Y8LnyG0oThOzf0tve Gaw+kuy17gTGZGMIfGVcdeb+SlioXMAAfOps+mNIwTECgYEA/gTO8W0hgYpOQJzn BpWkic3LAoBXWNpvsQkkC3uba8Fcps7iiEzotXGfwYcb5Ewf5O3Lrz1EwLj7GTW8 VNhB3gb7bGOvuwI/6vYk2/dwo84bwW9qRWP5hqPhNZ2AWl8kxmZgHns6WTTxpkRU zrfZ5eUrBDWjRU2R8uppgRImsxMCgYEA2MxuL/C/Ko0d7XsSX1kM4JHJiGpQDvb5 GUrlKjP/qVyUysNF92B9xAZZHxxfPWpdfGGBynhw7X6s+YeIoxTzFPZVV9hlkpAA 5igma0n8ZpZEqzttjVdpOQZK8o/Oni/Q2S10WGftQOOGw5Is8+LY30XnLvHBJhO7 TKMurJ4KCNsCgYAe5TDSVmaj3dGEtFC5EUxQ4nHVnQyCpxa8npL+vor5wSvmsfUF hO0s3GQE4sz2qHecnXuPldEd66HGwC1m2GKygYDk/v7prO1fQ47aHi9aDQB9N3Li e7Vmtdn3bm+lDjtn0h3Qt0YygWj+wwLZnazn9EaWHXv9OuEMfYxVgYKpdwKBgEze Zy8+WDm5IWRjn8cI5wT1DBT/RPWZYgcyxABrwXmGZwdhp3wnzU/kxFLAl5BKF22T kRZ+D+RVZvVutebE9c937BiilJkb0AXLNJwT9pdVLnHcN2LHHHronUhV7vetkop+ kGMMLlY0lkLfoGq1AxpfSbIea9KZam6o6VKxEnPDAoGAFDCJm+ZtsJK9nE5GEMav NHy+PwkYsHhbrPl4dgStTNXLenJLIJ+Ke0Pcld4ZPfYdSyu/Tv4rNswZBNpNsW9K 0NwJlyMBfayoPNcJKXrH/csJY7hbKviAHr1eYy9/8OL0dHf85FV+9uY5YndLcsDc nygO9KTJuUiBrLr0AHEnqko= -----END PRIVATE KEY----- key_passphrase: null certificate_authorities: cipher_suites: null curve_types: null supported_protocols: null ``` Related to: #19504 --- CHANGELOG.next.asciidoc | 1 + libbeat/common/transport/tlscommon/tls.go | 81 +++++- .../common/transport/tlscommon/tls_test.go | 266 ++++++++++++++++++ libbeat/docs/shared-ssl-config.asciidoc | 86 ++++++ 4 files changed, 423 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 67cac68940c..846c5427e8b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -22,6 +22,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Added `certificate` TLS verification mode to ignore server name mismatch. {issue}12283[12283] {pull}20293[20293] - Autodiscover doesn't generate any configuration when a variable is missing. Previously it generated an incomplete configuration. {pull}20898[20898] - Remove redundant `cloudfoundry.*.timestamp` fields. This value is set in `@timestamp`. {pull}21175[21175] +- Allow embedding of CAs, Certificate of private keys for anything that support TLS in ouputs and inputs https://github.com/elastic/beats/pull/21179 *Auditbeat* diff --git a/libbeat/common/transport/tlscommon/tls.go b/libbeat/common/transport/tlscommon/tls.go index 5dea417637e..3616a9f07e4 100644 --- a/libbeat/common/transport/tlscommon/tls.go +++ b/libbeat/common/transport/tlscommon/tls.go @@ -24,7 +24,10 @@ import ( "encoding/pem" "errors" "fmt" + "io" "io/ioutil" + "os" + "strings" "github.com/elastic/beats/v7/libbeat/logp" ) @@ -67,13 +70,19 @@ func LoadCertificate(config *CertificateConfig) (*tls.Certificate, error) { return &cert, nil } -// ReadPEMFile reads a PEM format file on disk and decrypt it with the privided password and -// return the raw content. -func ReadPEMFile(log *logp.Logger, path, passphrase string) ([]byte, error) { +// ReadPEMFile reads a PEM formatted string either from disk or passed as a plain text starting with a "-" +// and decrypt it with the provided password and return the raw content. +func ReadPEMFile(log *logp.Logger, s, passphrase string) ([]byte, error) { pass := []byte(passphrase) var blocks []*pem.Block - content, err := ioutil.ReadFile(path) + r, err := NewPEMReader(s) + if err != nil { + return nil, err + } + defer r.Close() + + content, err := ioutil.ReadAll(r) if err != nil { return nil, err } @@ -102,7 +111,7 @@ func ReadPEMFile(log *logp.Logger, path, passphrase string) ([]byte, error) { if err != nil { log.Errorf("Dropping encrypted pem '%v' block read from %v. %+v", - block.Type, path, err) + block.Type, r, err) continue } @@ -139,20 +148,28 @@ func LoadCertificateAuthorities(CAs []string) (*x509.CertPool, []error) { log := logp.NewLogger(logSelector) roots := x509.NewCertPool() - for _, path := range CAs { - pemData, err := ioutil.ReadFile(path) + for _, s := range CAs { + r, err := NewPEMReader(s) if err != nil { log.Errorf("Failed reading CA certificate: %+v", err) - errors = append(errors, fmt.Errorf("%v reading %v", err, path)) + errors = append(errors, fmt.Errorf("%v reading %v", err, r)) + continue + } + defer r.Close() + + pemData, err := ioutil.ReadAll(r) + if err != nil { + log.Errorf("Failed reading CA certificate: %+v", err) + errors = append(errors, fmt.Errorf("%v reading %v", err, r)) continue } if ok := roots.AppendCertsFromPEM(pemData); !ok { - log.Error("Failed to add CA to the cert pool, CA is not a valid PEM file") - errors = append(errors, fmt.Errorf("%v adding %v to the list of known CAs", ErrNotACertificate, path)) + log.Error("Failed to add CA to the cert pool, CA is not a valid PEM document") + errors = append(errors, fmt.Errorf("%v adding %v to the list of known CAs", ErrNotACertificate, r)) continue } - log.Debugf("tls", "successfully loaded CA certificate: %v", path) + log.Debugf("tls", "successfully loaded CA certificate: %v", r) } return roots, errors @@ -187,3 +204,45 @@ func ResolveTLSVersion(v uint16) string { func ResolveCipherSuite(cipher uint16) string { return tlsCipherSuite(cipher).String() } + +// PEMReader allows to read a certificate in PEM format either through the disk or from a string. +type PEMReader struct { + reader io.ReadCloser + debugStr string +} + +// NewPEMReader returns a new PEMReader. +func NewPEMReader(certificate string) (*PEMReader, error) { + if IsPEMString(certificate) { + // Take a substring of the certificate so we do not leak the whole certificate or private key in the log. + debugStr := certificate[0:256] + "..." + return &PEMReader{reader: ioutil.NopCloser(strings.NewReader(certificate)), debugStr: debugStr}, nil + } + + r, err := os.Open(certificate) + if err != nil { + return nil, err + } + return &PEMReader{reader: r, debugStr: certificate}, nil +} + +// Close closes the target io.ReadCloser. +func (p *PEMReader) Close() error { + return p.reader.Close() +} + +// Read read bytes from the io.ReadCloser. +func (p *PEMReader) Read(b []byte) (n int, err error) { + return p.reader.Read(b) +} + +func (p *PEMReader) String() string { + return p.debugStr +} + +// IsPEMString returns true if the provided string match a PEM formatted certificate. try to pem decode to validate. +func IsPEMString(s string) bool { + // Trim the certificates to make sure we tolerate any yaml weirdness, we assume that the string starts + // with "-" and let further validation verifies the PEM format. + return strings.HasPrefix(strings.TrimSpace(s), "-") +} diff --git a/libbeat/common/transport/tlscommon/tls_test.go b/libbeat/common/transport/tlscommon/tls_test.go index 42748770069..53e9da18db3 100644 --- a/libbeat/common/transport/tlscommon/tls_test.go +++ b/libbeat/common/transport/tlscommon/tls_test.go @@ -22,6 +22,8 @@ package tlscommon import ( "crypto/tls" "fmt" + "io/ioutil" + "os" "testing" "github.com/stretchr/testify/assert" @@ -331,3 +333,267 @@ func TestResolveCipherSuite(t *testing.T) { c := ResolveCipherSuite(tls.TLS_RSA_WITH_AES_128_CBC_SHA) assert.Equal(t, "RSA-AES-128-CBC-SHA", c) } + +func TestPEMString(t *testing.T) { + t.Run("is PEM formatted String", func(t *testing.T) { + c := `-----BEGIN CERTIFICATE----- +MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF +ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 +MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n +fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl +94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t +/D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP +PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 +CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O +BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux +8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D +874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw +3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA +H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu +8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 +yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk +sxSmbIUfc2SGJGCJD4I= +-----END CERTIFICATE-----` + assert.True(t, IsPEMString(c)) + }) + + // Well use `|` if you want to keep the newline, theses are required so the PEM document is valid. + t.Run("From the YAML/multiline", func(t *testing.T) { + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + sxSmbIUfc2SGJGCJD4I= + -----END CERTIFICATE----- +cipher_suites: null +curve_types: null +supported_protocols: null + `) + assert.NoError(t, err) + assert.True(t, IsPEMString(cfg.CAs[0])) + }) + + t.Run("is not a PEM formatted String", func(t *testing.T) { + c := "/tmp/certificate" + assert.False(t, IsPEMString(c)) + }) + + t.Run("is an empty string", func(t *testing.T) { + c := "" + assert.False(t, IsPEMString(c)) + }) +} + +func TestCertificate(t *testing.T) { + // Write certificate to a temporary file. + c := `-----BEGIN CERTIFICATE----- +MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF +ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 +MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n +fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl +94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t +/D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP +PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 +CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O +BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux +8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D +874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw +3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA +H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu +8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 +yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk +sxSmbIUfc2SGJGCJD4I= +-----END CERTIFICATE-----` + f, err := ioutil.TempFile("", "certificate.crt") + f.WriteString(c) + f.Close() + assert.NoError(t, err) + defer os.Remove(f.Name()) + + t.Run("certificate authorities", func(t *testing.T) { + t.Run("From configuration", func(t *testing.T) { + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + sxSmbIUfc2SGJGCJD4I= + -----END CERTIFICATE----- +cipher_suites: null +curve_types: null +supported_protocols: null + `) + assert.NoError(t, err) + tlsC, err := LoadTLSConfig(cfg) + assert.NoError(t, err) + assert.NotNil(t, tlsC) + }) + + t.Run("From disk", func(t *testing.T) { + // Create a dummy configuration and append the CA after. + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: +cipher_suites: null +curve_types: null +supported_protocols: null + `) + + cfg.CAs = []string{f.Name()} + tlsC, err := LoadTLSConfig(cfg) + assert.NoError(t, err) + + assert.NotNil(t, tlsC) + }) + + t.Run("mixed from disk and embed", func(t *testing.T) { + // Create a dummy configuration and append the CA after. + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: +cipher_suites: null +curve_types: null +supported_protocols: null + `) + + cfg.CAs = []string{f.Name(), c} + tlsC, err := LoadTLSConfig(cfg) + assert.NoError(t, err) + + assert.NotNil(t, tlsC) + }) + }) + + t.Run("Certificate and Private keys", func(t *testing.T) { + key := ` +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDXHufGPycpCOfI +sjl6cRn8NP4DLxdIVEAHFK0jMRDup32UQOPW+DleEsFpgN9/ebi9ngdjQfMvKnUP +Zrl1HTwVhOJfazGeoJn7vdDeQebhJfeDXHwX2DiotXyUPYu1ioU45UZDAoAZFj5F +KJLwWRUbfEbRe8yO+wUhKKxxkApPbfw+wUtBicn1RIX7W1nBRABt1UXKDIRe5FM2 +MKfqhEqK4hUWC3g1r+vGTrxu3qFpzz7L2UrRFRIpo7yuTUhEhEGvcVsiTppTil4Z +HcprXFHf5158elEwhYJ5IM0nU1leNQiOgemifbLwkyNkLqCKth8V/4sezr1tYblZ +nMh1cclBAgMBAAECggEBAKdP5jyOicqknoG9/G564RcDsDyRt64NuO7I6hBg7SZx +Jn7UKWDdFuFP/RYtoabn6QOxkVVlydp5Typ3Xu7zmfOyss479Q/HIXxmmbkD0Kp0 +eRm2KN3y0b6FySsS40KDRjKGQCuGGlNotW3crMw6vOvvsLTlcKgUHF054UVCHoK/ +Piz7igkDU7NjvJeha53vXL4hIjb10UtJNaGPxIyFLYRZdRPyyBJX7Yt3w8dgz8WM +epOPu0dq3bUrY3WQXcxKZo6sQjE1h7kdl4TNji5jaFlvD01Y8LnyG0oThOzf0tve +Gaw+kuy17gTGZGMIfGVcdeb+SlioXMAAfOps+mNIwTECgYEA/gTO8W0hgYpOQJzn +BpWkic3LAoBXWNpvsQkkC3uba8Fcps7iiEzotXGfwYcb5Ewf5O3Lrz1EwLj7GTW8 +VNhB3gb7bGOvuwI/6vYk2/dwo84bwW9qRWP5hqPhNZ2AWl8kxmZgHns6WTTxpkRU +zrfZ5eUrBDWjRU2R8uppgRImsxMCgYEA2MxuL/C/Ko0d7XsSX1kM4JHJiGpQDvb5 +GUrlKjP/qVyUysNF92B9xAZZHxxfPWpdfGGBynhw7X6s+YeIoxTzFPZVV9hlkpAA +5igma0n8ZpZEqzttjVdpOQZK8o/Oni/Q2S10WGftQOOGw5Is8+LY30XnLvHBJhO7 +TKMurJ4KCNsCgYAe5TDSVmaj3dGEtFC5EUxQ4nHVnQyCpxa8npL+vor5wSvmsfUF +hO0s3GQE4sz2qHecnXuPldEd66HGwC1m2GKygYDk/v7prO1fQ47aHi9aDQB9N3Li +e7Vmtdn3bm+lDjtn0h3Qt0YygWj+wwLZnazn9EaWHXv9OuEMfYxVgYKpdwKBgEze +Zy8+WDm5IWRjn8cI5wT1DBT/RPWZYgcyxABrwXmGZwdhp3wnzU/kxFLAl5BKF22T +kRZ+D+RVZvVutebE9c937BiilJkb0AXLNJwT9pdVLnHcN2LHHHronUhV7vetkop+ +kGMMLlY0lkLfoGq1AxpfSbIea9KZam6o6VKxEnPDAoGAFDCJm+ZtsJK9nE5GEMav +NHy+PwkYsHhbrPl4dgStTNXLenJLIJ+Ke0Pcld4ZPfYdSyu/Tv4rNswZBNpNsW9K +0NwJlyMBfayoPNcJKXrH/csJY7hbKviAHr1eYy9/8OL0dHf85FV+9uY5YndLcsDc +nygO9KTJuUiBrLr0AHEnqko= +-----END PRIVATE KEY----- +` + t.Run("embed", func(t *testing.T) { + // Create a dummy configuration and append the CA after. + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: +cipher_suites: null +curve_types: null +supported_protocols: null + `) + cfg.Certificate.Certificate = c + cfg.Certificate.Key = key + + tlsC, err := LoadTLSConfig(cfg) + assert.NoError(t, err) + + assert.NotNil(t, tlsC) + }) + + t.Run("From disk", func(t *testing.T) { + k, err := ioutil.TempFile("", "certificate.key") + k.WriteString(key) + k.Close() + assert.NoError(t, err) + defer os.Remove(k.Name()) + // Create a dummy configuration and append the CA after. + cfg, err := load(` +enabled: true +verification_mode: null +certificate: null +key: null +key_passphrase: null +certificate_authorities: +cipher_suites: null +curve_types: null +supported_protocols: null + `) + + cfg.Certificate.Certificate = f.Name() + cfg.Certificate.Key = k.Name() + + tlsC, err := LoadTLSConfig(cfg) + assert.NoError(t, err) + + assert.NotNil(t, tlsC) + }) + }) +} diff --git a/libbeat/docs/shared-ssl-config.asciidoc b/libbeat/docs/shared-ssl-config.asciidoc index 8aa9a33a828..43a88002bcd 100644 --- a/libbeat/docs/shared-ssl-config.asciidoc +++ b/libbeat/docs/shared-ssl-config.asciidoc @@ -105,6 +105,32 @@ NOTE: SSL settings are disabled if either `enabled` is set to `false` or the ==== `certificate_authorities` The list of root certificates for server verifications. If `certificate_authorities` is empty or not set, the trusted certificate authorities of the host system are used. +By default you can specify a list of file that +{beatname_lc} will read, but you can also embed a certificate directly in the `YAML` configuration: + +[source,yaml] +---- +certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + sxSmbIUfc2SGJGCJD4I= + -----END CERTIFICATE----- +---- [float] [[certificate]] @@ -117,12 +143,72 @@ require client authentication, the certificate will be loaded, but not requested by the server. When this option is configured, the <> option is also required. +The certificate option support embedding of the certificate: + +[source,yaml] +---- +certificate: | + -----BEGIN CERTIFICATE----- + MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + sxSmbIUfc2SGJGCJD4I= + -----END CERTIFICATE----- +---- + [float] [[key]] ==== `key: "/etc/pki/client/cert.key"` The client certificate key used for client authentication. This option is required if <> is specified. +The key option support embedding of the private key: + +[source,yaml] +---- +key: | + -----BEGIN PRIVATE KEY----- + MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDXHufGPycpCOfI + sjl6cRn8NP4DLxdIVEAHFK0jMRDup32UQOPW+DleEsFpgN9/ebi9ngdjQfMvKnUP + Zrl1HTwVhOJfazGeoJn7vdDeQebhJfeDXHwX2DiotXyUPYu1ioU45UZDAoAZFj5F + KJLwWRUbfEbRe8yO+wUhKKxxkApPbfw+wUtBicn1RIX7W1nBRABt1UXKDIRe5FM2 + MKfqhEqK4hUWC3g1r+vGTrxu3qFpzz7L2UrRFRIpo7yuTUhEhEGvcVsiTppTil4Z + HcprXFHf5158elEwhYJ5IM0nU1leNQiOgemifbLwkyNkLqCKth8V/4sezr1tYblZ + nMh1cclBAgMBAAECggEBAKdP5jyOicqknoG9/G564RcDsDyRt64NuO7I6hBg7SZx + Jn7UKWDdFuFP/RYtoabn6QOxkVVlydp5Typ3Xu7zmfOyss479Q/HIXxmmbkD0Kp0 + eRm2KN3y0b6FySsS40KDRjKGQCuGGlNotW3crMw6vOvvsLTlcKgUHF054UVCHoK/ + Piz7igkDU7NjvJeha53vXL4hIjb10UtJNaGPxIyFLYRZdRPyyBJX7Yt3w8dgz8WM + epOPu0dq3bUrY3WQXcxKZo6sQjE1h7kdl4TNji5jaFlvD01Y8LnyG0oThOzf0tve + Gaw+kuy17gTGZGMIfGVcdeb+SlioXMAAfOps+mNIwTECgYEA/gTO8W0hgYpOQJzn + BpWkic3LAoBXWNpvsQkkC3uba8Fcps7iiEzotXGfwYcb5Ewf5O3Lrz1EwLj7GTW8 + VNhB3gb7bGOvuwI/6vYk2/dwo84bwW9qRWP5hqPhNZ2AWl8kxmZgHns6WTTxpkRU + zrfZ5eUrBDWjRU2R8uppgRImsxMCgYEA2MxuL/C/Ko0d7XsSX1kM4JHJiGpQDvb5 + GUrlKjP/qVyUysNF92B9xAZZHxxfPWpdfGGBynhw7X6s+YeIoxTzFPZVV9hlkpAA + 5igma0n8ZpZEqzttjVdpOQZK8o/Oni/Q2S10WGftQOOGw5Is8+LY30XnLvHBJhO7 + TKMurJ4KCNsCgYAe5TDSVmaj3dGEtFC5EUxQ4nHVnQyCpxa8npL+vor5wSvmsfUF + hO0s3GQE4sz2qHecnXuPldEd66HGwC1m2GKygYDk/v7prO1fQ47aHi9aDQB9N3Li + e7Vmtdn3bm+lDjtn0h3Qt0YygWj+wwLZnazn9EaWHXv9OuEMfYxVgYKpdwKBgEze + Zy8+WDm5IWRjn8cI5wT1DBT/RPWZYgcyxABrwXmGZwdhp3wnzU/kxFLAl5BKF22T + kRZ+D+RVZvVutebE9c937BiilJkb0AXLNJwT9pdVLnHcN2LHHHronUhV7vetkop+ + kGMMLlY0lkLfoGq1AxpfSbIea9KZam6o6VKxEnPDAoGAFDCJm+ZtsJK9nE5GEMav + NHy+PwkYsHhbrPl4dgStTNXLenJLIJ+Ke0Pcld4ZPfYdSyu/Tv4rNswZBNpNsW9K + 0NwJlyMBfayoPNcJKXrH/csJY7hbKviAHr1eYy9/8OL0dHf85FV+9uY5YndLcsDc + nygO9KTJuUiBrLr0AHEnqko= + -----END PRIVATE KEY----- +---- [float] ==== `key_passphrase` From 30ff4d50f6a2e52b50bae53bc166fbc786abd1e5 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Mon, 28 Sep 2020 14:21:09 -0600 Subject: [PATCH 068/216] Add dashboard for pubsub metricset in googlecloud module (#21326) * Add dashboard for pubsub metricset in googlecloud module --- CHANGELOG.next.asciidoc | 1 + ...metricbeat-googlecloud-pubsub-overview.png | Bin 566083 -> 787320 bytes ...etricbeat-googlecloud-pubsub-overview.json | 1695 +++++++++++------ 3 files changed, 1079 insertions(+), 617 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 846c5427e8b..13602e72d21 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -718,6 +718,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Sanitize `event.host`. {pull}21022[21022] - Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] - Release lambda metricset in aws module as GA. {issue}21251[21251] {pull}21255[21255] +- Add dashboard for pubsub metricset in googlecloud module. {pull}21326[21326] {issue}17137[17137] *Packetbeat* diff --git a/metricbeat/docs/images/metricbeat-googlecloud-pubsub-overview.png b/metricbeat/docs/images/metricbeat-googlecloud-pubsub-overview.png index 5d0ffd588febea92740797d0d3cabdadcc85873f..b1bfdd4531f09d80a844cbdfea7b0297918a5d84 100644 GIT binary patch literal 787320 zcmcG$cU)6V*Def*2q>T+qI9K+2uSZudhfl7^co-(X+Z=*q)H1tfb`xwL_~TC9jTGt z2|bb!IPrO&_kGVf-}(N#4Zmd1o|!eXr(f$@YZIxZp-4hZO^kzsL!zuCr-Oq-afX9K z%tc6mjfp-S;KSamILgXuDa*<-YIy?e99?X2aFimG!FRNDcOJdJ37C|9t@`PG(pUy# z7LLwq2i%AGp~Yd$@mg<{WO~B;SBWccKX{;J=%p{$Rr|2!=_8k@w_S%HUg8b58dc}o zaUT)3p*K5(5W`m@@XXAcq~OEgEi;^cE7}@i3WGb0s?3RU1efD$6y!V2a2#9*906$p zBT~Z`b_#M~xN@xL@Qom<_q}JX3pGYJ*EhkG>hzX_w{cWn3x8zWuzR}rx!kJK=-DkC zZ~U5!mno5bze&IA5$P~~zh#{%*k#!(Y@0d0yCymQu$986 z9!d`g7oy(1e(>FoFaUU)mj1hv#VaNb=kdp6PhBE^N8vK+KCsKbVzHZtuNFOD0}4B; zWN$m09bLaJ5l*Z-yAe;n;WSP=8KB+le@4XI_2tuy!YBgNo2SJRrL!5PSsO2OC^d@b z=RV8~EGYk>yy0*p@p&0>Y3~z;N#p8FHUe>`(74TkpE^LwAe$a8F-laR}JI*8O0ya-pxA$AbbyG8d=LwYNRLyPSUXE%f(S7^-s z@$JMnFUrX>y7{aKhQnl69NtN064-aQxZ}3taz&J_$htEHl6DfnKenxaj|ho#^tAYs z9t=L}k*?8NDVEcFq4L2b^2O`q+){1t;zxR7yMm=O0%54I-aK{((fLOQk)#TJIW5~R zXDVm@Ubj&=tq+25gJ_mQ=@o*z<9Yla(?s71kBRKdw|Znv%wwAxlu9rxKWwhXuqp8< zs=$h~+U@5X7d%0_wtH>#ZMRJ0Tzh=p2GlSK(`wwY4?X?#`KcKg?XQ){=VCN6yaAn zlDymFQIFNt*eY35DE2;4MaD$}^!4qF`xQ!4(_{;I5rBLki5a<$RzA!f3Ynjn?yVioNMUE8t~J;M@%Qo+(?ouC2*Ek0fA zQckTQeGXl*N*`HQrK}vc%2A!I;wrr=J*ixfW{_NH-b&7c$}a^q7Hc`ZlrgyKnT0KO z?^!kLq=9jpej^sdpWnW=(r!)?Na{$6N|Jn$;v{3MJ6X~*)jdVJTb)vvQfE*;Ltdd$ zF=?{I|8OL;x6pP%a3XfR)d5npqiL%pDI!{zKXrzH z;yaCk+phgEPj97%RLQi;lyp4_m683N+mt(2J#|#Ra<}zSmNG0KJjp#45px#(A!c2n zEk-n2A%-*BI{GwbF9wo&U;Qy_32OnXD{FUQcwwD7IAbPVlAkG+XBgjZVR(K-GSxJ- zFRe-dz{^lQ*7(MB-DJu{yph=yWn^b+V7grM-Grx{x7^2QsXn~Iy!`e|@{Ewn8yZ8J z+!4}@(I=@-4*BHxO6?cxSmtONI=>7#0yEq-?BVZa5~McPHc z0fUHxXqfQ2SiNw&N4?LwsDbFR$1}0pq7|M_KK=(TYs0?FJAv?ztGo-g6{;CShK53h zk`HKpydW=5R({D7BRe*+Q*RHnEfRCj>H{1aI1dj#9D^AY;n z$(xEd4XCeIp;u8?VtD+w-r~K$%O;?{Q+RuZfb>oaKIdI0l3x4>0sv`e-;6zQPGEoK zep5Wxd>x!Spuxv=l$-ON^;bt`jE>zal^;(ac$4jQ_`g!T~tqF{2X2VdwsJh^<_ zek=~Qz?kTsffXASweub+&_(+*98h)eptPfHqs0q34LAka8(A-8GlR{P&3vzhe^VaM zl6z5v5sgGP|M>YMD3a+EZ__nv7QCLImpUZ?e|w#9Y4~WHtKZDsKX?B1==ZgO)b-}| z&;d)~l}x8mC1SCH7q+QGt8QzZ>z5}gexZTfAR?&LG)DuoH{%G0tLl8tH$^Sh$K-T$D8xgJoWgT>UyqXRlx{h_^iY7oE5m&Yq6#(RxyC^o{jSo^_MG-xWszlk1~&-+h-Jc!oBCpU3LfS|`-f%3 zht4uiJ3h)%C9<*-Ns|BqcPW zf~{_gEktd~^(D@Au+3X6)GRG59j0~w$Cm}*N6DQFt?qltyj!*A3!fI&7g~q92Q!*7 z+~D;X)sH!=ZUvUMLCF@=t)*mQ@5I~=&X$auRD%tVD`8T^!R=5n2Vd(3KkqsE{p?H$ z7_#@!^(OLIcSLe2s0ZD7NOgdayzlqxb&RR{h)hQ)jq{3$-@&ikd|4qfG=p1ZUB!aA zW*N66UTl9{yKs77{hrZwP2*bhnzvL2#%x;J@wrnNHCT{Th$y`^gCbo_Gc41=`Pju# z*wNSXhW)Edcx0UDVEQ=o*SwW;PEt&wGuWo2+?*_eh}4R}*6^^W*Qj4-`(-kr|v>b)vAvlNRs8 z#+w6G-=DsfOIg6CI*!7<>yG?@C8Qtn4!w=!JIt%CmF=(XeW`u&np2P@iRl0nOxbkR z`BLRlQNUF|rBsyvMKO2*eIm32utX7OCqlsIG#9h?gh?~0@6onjzFm&$1h0a>%6^18 zUs;?Fo=n4ne_wk934@vu4eJf7Bd8`(01^rW%?gt9oSX&CpvTGN8N4OwfB*PBbuDrT zyxCsmZsy*wtmteEyo6CSI&m)Aj zlc<;IiY+^}tFMRhy{KGFj6%5qPAub)I2n$BB~EW|o`WThmM`W zj=0A(2*;fhCouW>!>?iwKUW2OdCPz^mM+0F8yAUt62qf;Yk+Cr={n`k^-~JI8%zJI zA_8kl;n3h+DO|kU46Qt+0!moSn__FEY^Sb{^8y#c-voIBV%a_l!O2k*afQ=H}8 z`mZoC7d8z?Mpsr@8GF^W_O!Ki13Cb_@+rN_u@OY>O2$AOoJTBwzPQRd%ttslc;1eB zMqWnhYNFNvS1v0Xz*}3ccdqV#%E1wTCyEWa+Im?rzH@bP1B$+rc=oRxqS)}CXzpi> z|H|U!Eb+`pU5il`;AzV!z{St?>X{@lBO{}@r;VMcj-0}O#Ibi0&m6qG+(o&$eSLko zeEGNlp7z{4A|fK(uXwq6c{#B;IDvj{URLio-GEI0F66(;k+TI_dpf#%IRe}m|CDR> z7U1nA@$A{3ivIia@8`6A=lDN0xdH#vENlb0|DY?~wncz9p^ zN9_Mj`hSWV|BooIu<-vO`oAUpZ=!!1A*$)=h<#G4KfNf)BhLN*iTl6v>(~MTF5Z8# z>$^F6N%HhM;b?2PDbw? z?*7v4RLTwdzT=x(-2I8A>UystekEdJpZDZGdky0OuGQ7aT3vEq65`$B4-d^=GgBG; zY(@m9q-6mwGF|Z(5qou+zRT%pu(UMbFTV?W=}h+5GB~*S_oe^hPlz6ojqXN zJVM65`177cI){M@@9$QEgIDtKQ&bcM9!4j!*ZuGI947 zJ^U0Cll)#-mv?OdIQo}oI$^#dqpCkEAJyMoxHuuh&+k)FvB{(z{}8dq=QVjV6lu*H z0CzL?J*%dbq+sW%@p#e^rB^|f$|6ntFSMlbw% z_Ho5R<>4B6@_@G$KYHXu1BS>A3~IwtlD~a$WqD;tQY2AlXkpnXJwq$`5O)9ZbKDSP zIW?V4N^La*do#6iCADa8VF6;wl2*N`xiM8K0f~aZQn>2?!8*Y&P$wJr(nK9398Bp#NS_G4*QD7hBkE=t=P6CTpwHV2`zTET&Y%o%G?~+ZIDO zbQ!k?#mmbO#WMhjH*{Xp#64VlT?}Z~G}tRCbk6I+^`_D%l$-WdG#v;6vprnAP5!_`i!_xXXj-S< z;Q_lH=&Zr-v{0wWM|~iTuTTFNWX^eQc-xMeG(j55pJQI4n-`avkf=Mu>i5oAm8u$L z4ck}pG;_;p9waM@sN$lVNAG2bz`Tj%dDmy>6rW>>GVJ_+$ z-x=g@@-!I4Ht}T#i;>Y(=6GAaH!L;wc?sfQU1lF9Hg79MMu}#wH`jY9C`Pl4adWy4 z%ix5RnY_8lT_b;#uK&F@Ldjk0mwpfzt@vNq5RL%k!rr^}_t5@fS7)csx9VT$J!j)g z7fPlT@l@*hyixG><4FRaJt@a9;yuy1Y0cZ@;j}jCMz!^;|2E{&<+Xq6nczB(+mN20SRjp^G|#w*JSY~{a+5tVh7=xD5Usw-1BPv ziAd09rXDf(iROMn&|f(^@};G_uju{P+2?9)GXz>S4$>!@0Nf>}MJcd3`KU(^Fyq&t zAVke3M*Ku5P1y1CJvu?N%~4ZENH7XF7bJPk3$Qjb%d~lyW7*wX!Ckh!D$mEgcg?*u zT9+~kSwECj=|T2oner#;_m?yj|0KRvE8YB6a9z;}S4 zEsa@a2Zv%<=kUa18X7hZ!-|w!cb=`!7sjvvmc`RHrbIOHc{{#+fyNH*&z%N}>Qx!Y zzc8%au8UK^zpr%v)923#AEQ!~T-2h?0$i;J(ghCS#^eSC;s4lX^493V#@rUl6gODtqPd&+d{Xjr(YH*IQ`>d!ueL)o zt|@KyfL?&((OZb51crd$?us5$mAVoFy7rZa6+G%UC`h#_GgBLN75xP?d|GhV=)gle zBJjdq?rS*8mWU(cfocr_-T?7%s(|H;>(70lnUd0{br@LjB<-lGRR4v___L2ev2BYn z>E)v9dkh=|QKDD!q26iQj9RdmEhHr5 zCVW!;gw~+Sn2kwYr!^(;@^pYtQzCu+cW^CmznQ4kM)@kp911dTIS%K#SwG}+u@v*! zuhrT1?iw50KRHo_nK&a}Srs8VkzZh#vz;YA{Sc7q@F}3&j}*m$o&1R(Zl9{A@fH-! zHK>ixzCK>n+3)KpB$ygW6;a$Av1D%ZMKs`9o-=5uB)?#% zzv&cRW^V zVHVs3x9GMA7zRkGjAn{VG#o-5Yr`)k&{rHc+w6|ZAFczh=k9<7rnngyrLmi`A{?dK zR`-%st8{zFydo>Ei~C~OZ@>-jrv8V*VZ8-+4}%9!5qD4R&7c6) zHIg&3<9^om;)hz>22!{Ic|80-?v|TFl^YR1vtIT!6X_OI^K{gh z-YM}{@3HB-Nxa2BrU{dc3cp`iKr01$EeKe0Q|Gj-R5MBWZ8$pD;R|(H=o}Jlx;xIp zI>x=G$u}Wx+7M<7#gEGHu1h6z;taUhPu$_NGxgph(?$3PDYDyC?j=1WkwR^+ajy@j z@r@plvwRjik1lsGN(SLhCx{txv75Krw5C9yZ@%!|{H$3sQ1KR^&`Ew^+tGq_nO$rF zW=KP$jm{yKYl|( zFBO6ZGT1a*FMJC$m)nF^t|tQyRfx|_JN&bNBz-rx5xe)!7CP*!fb`UFo$jD)*Bd-u zt;W~IC6$-${4PNQ{n)Q?D+dCIAY=GqJ7mxw$NIdf9a6wR#)bumrp&|j?T=}xu< z4(6&$q7C^DPgp(=%e?D{PXo4`p2O!z+lsB;q!gem$&t zNP65wM}0)4_e%05^Tlwis?SwO3$Nt!^#ry{~#*WG!QC4sgdJqx!Md7TdTMNZc#DZUlS zcb65a(I;*e6lr8V<%XUpeBN|+pIMSXBq9kqpCe%$=OcCh`tYmdVFDKIY1AoNv z0%y$Z(K-ee0YUE@+A-iG)t0LI@`{jekRVApg+Qck?WDl|VdousFjaQ2iCg>1?!6$j zk;@nTA8rQ^E_ECx#u1Rjd)js<3ZR-u3HhH^Ew%d8zBW3i6}V@#@cbV`yWgP3Z?>yf z@O*pJ2IB%e?5pqmhik%$B?Bxe<_rYi=oyCs|85h!Mubk%HXM7oCl63!u3H zKJhWYab6l2lg~SeE0-OY=)0--nE=(IYNYgDkMkk(^oZv42N{EJkc&QfI#05pF@LQt z!6&U2b|xxWNVD>N;R zlPPjmpkxmH_zXa&_V=Nr6o=C%4FO2{%R}^+T6>tqo)T$B^;9-;ksBWK_+|17gXS>B zzKJw#>6^FvAlA(xuu%8oPSh%seZ^y-D}%U~(o7Yc85%>sRqtGExh(FN?>MQTv5>4| z-0WVXm};5(`u0Zd9h6Fi$ux^Fv)oLjIk##G7g*{#^$@?c6Elj|fr9ARt-fnlHS*f+ zKYGp}DrZY{ zRbLo92awFwdS{dy)eI8nFSL5MVO2nqlF7V1QaZu!#O0GmQY!7=zTs94MTAP$E#DC^ zY4MDq+y_69lnnKt?bVbU(u zkK(TN%1j1`&olTCn$B45%T6g~cQzF#_4_qd&Ych&{AVz;duK!09wDHC{fV!px1t`s z{H<$}`fw}%Gl<8m$xT*Aw(@u9(a}VnRFW#2`}LKd-+3?~VE@;b2t;DGFZ^)apv=yD zkNW|j^E}(Zq`@3}@-TOY2fje<7cjaD5KdK^GmTq08)$wY(r>_%Ij-NGou zT`r0Aw)>s-3t0v~y?uAxciyDQi3|00YpM+;mb#M_=+tU%G$!OZ=H<3Cle<< zPmEhm4ky|3tDmkgHFaxgX}dz4``YwI&ly0%Q9)Nbh9_5bn*PxvYBa{R_^CO4KV}2$ zcz>DwV^Hdp@ZJ;AMbSCY24@o}5CCcMEr!q$*drIJyw#f_*NZ-T>a4|3F(vz)zTIR22vMsI z$jV%uMY-vFV@Sii`Yvg4xxRRDwlb_rHkb2B$orSZ%;ic?+2I{!4=XJV3#G2|hPA9@j_Vfj|*wUG9FGV8P_;fOiQ?Z*Ym4}Afz*ZTX{CiA9`x- z;kY86>%|Tz$87PIfQNXfaDfVfPl;4Wgya;>Lk zm97)gA3_s?_YbAqwFCikTr@&}#QuIho#Hp3#9yWc)I#MMtJUS_G)?`z>ZZ1RqY^X6 zR4E)ia$0nw*w@&cjOuXrea=MBYe7 zM?K_XmT=p4=$Hq3OK})fHne+7@$l5>2(~Bj7aOV$f;p_o+L)_qYCOpOF4`M>jEZme zRuc9X8@2(~y=*kwLUt~%w-cS6YNttP1P6wVfwr*apgftc1*+hLbb+$8_rovpR^eVH1ZH9m#C!%3P|XX6Sq!IHz1$;iix(opR8_H? z#=holGxXNL_5PdW$(icfidRwa~R03PgLH7xWrN_E6fQI0m@{%Lu!UQPQ{v9@|; ziJ3C?nAi;ZNxy*V@tE27Gr(Evl8s;%742=^EYmN0b}-+la`w?{{>-=*gi$bV5WQ|G zjB*_N>RP!#JxG=GVQaMgGRkIa)LgXZ1@f$wPdgQ|R0NwU$_|t}!%SDd@Zy~=E{?ou^roK2xJXViN-Fi#sxZGZHWjljjiTE<}@?58B z>QM*5O)9UfpxYudn?`m*{I540a%KMKFE-Qk45m0s@@8QlK1SINB-qY~?D`}-zsPXz zGwa@@KJkXLG-S7Nb6(qzW+y+D?QD>g^{SBUKnTvh(LmN31ZA}l6lFMTtKw2T_npmZ zGVw-8opnI4v`7*3GJEp-Z%gHZQa`t|cC_G=<0aUP)sFWe7d+^u&Ku)sir$;=7no(f zHk0tVYQD#C{gv;a>kcXvrf~zyDK36Kjy8sb?&c#JB-_roV=vWS)l}7Xdqa0mC+Ie} z=q)RD1yYW&z^2>|bGOo*7bVd+EAdt`@!Ys@>+5XxwIx2kv^Hc%S>)$whh;FvJ6drv zhYYU#aMPY_%pQ|bg=|{>s$Vu^H1bt3PG}aO+2=3?ShIn5Vhk(?5_$?0k!}}fa#g6{ z*TO-l`sqs8y#^m}{UUPtFiz4Fx{;5B5}ap4-Mjp`EM_Z{n?q>;Etd-H2Ia*8NDcFf zqI4+R&jQ0LF=jyaZaezV+k2^Oi_TyP)AwB-wHO73VRd6xvPJm9k~-Z##{MeR zytngpXbef|3Tr}9KHeR=ECrh^5$kDu(b$4`buPx0nH8j`#k-u-F& z;RE5>DZk3dOpLjha0rM-?N?U#!N)NCfR{X2teN(^PmLpKbjjme7;q<3+nRMSI6F}K zbGkb(;sgor+nD5rCNl-ooo`RHIL`tSA`|WV%eW<2MAW~RL2Dh3Juf}hjp7bFSdH9U zh$=Hg0&>MsV;u(fQ~Gdb!w2Y-zI^Q+y85VUUhxclp=h*aF%>2+d7%Z^3mvfj))SMs zsX8Er0KF(ui;rrPOO2Tekr2gV=GX-B;7ZITGd@0oufw)rriA#BZmggD#bdqy=U5V+T^89t~?k-otd zq1K#AZ2_O-bMKR2W!n8>zXtKnos(rA3v;)qJlTS%+Ex)wvKvnz(YYb<)MiQPdAUj4 zomc6@f>vtTwjuq#$DGLXHp9b?EsePMwL}y}{nwZ~;)M=B7viKaP7RLF<3a4xd0j3( z0Tm_!<=;xdXsFxyT=2TkQv+(zb$ZicEg47%Xb4=DRCIG%OBBaH`>D) z=O9#(1^dJI#Ezzx!L0hw`5QmK-{VCGtj3Kl1u$tT5^41MWL2ie;b;1?c@V$D`{FNE zt2gP<3>EAfO>m#Yb1Oct6(ij=Lw@?IzGm4Qw(J&yU;z*3n8N9POcf4aCTCo+5=05d- zqNhpKfK4rXsQnXt-dzcws*08DIPnXJ9P)!?-&vp}HNV!GsIueuo_!|K$GRxVTN(Ur z4ggf($XiLU<-0@nmh+2%Ob|w`?Xr-j+?C`M2$jkb^FDflYJ~+BlF*;T)b#>kk}FdU z2{Y*B1#>uD>~MFjrV*5~_^$h$zOQ6ug1T|HELsp3y2eegv3vSj7Vm&}0UtGY^UG_E z#5|Aybs3=X6T-u3Dwqhic&Ff*@!qZt%V>39#y+68U>$Fz{)CyMlFdZRZ+Sy&ob!U; zqc*@;rpvd+$I=5AG9z<*=btimmQz?k+X;qCM48#Gz_8o;SS2c-CSKeqGuXV6Av#^AS}tDH|uwg0b`$>@h&KVPI)k zjmcThndG#MJe1k;6 zoFX?OHad>m_SG#WpKG-SnGQJNiPzH_w^`(AWU8&Hs0}5uf%%KUM>1_5lLll-J*tL- zh{VExuuI2cqf1X)wfmZ%1TMaRbnv_R+LhPkd+2$wFLDVtW$+KXq~tI$D%CGxo~yI1 z3s;cO0$Z^bk6O+-;UV^4LCsn`Ro2MSBtj6-A+MS627?o2#n2xReK;&Al3zmO$k73H{z<$hw@b z+Oil3yx$62LqimXHaQnMio_Pa_NuvmznU_K3t`5QGEwtTfg_5zS5gw4t398Ew@~OG zj;ok!lSIDlxPHFl5Rlbeo!!`Hc1wlO_)`6{RW ze5FnvY;K9D-iqaCREL(v@3su3f%d$ak06t_))hj9FFV}^}p#$GD z!P%@W2?YJ=)@lJ(tJvqEmYhL$DsC*c{6;Rj%^H$u1YSjMk$=2w>2vt`>y*3wh0ixg zn`UUz)t{)2qlp{2?z_6WcxFf_)Ncz0p%S~&>f?9Nnze6EMqZ)L_xj79P}pvs5zW9j zg?y3p&!|^7xQAi%<&7}tZ_DwmGT(9MlZqy|=0*Bcb+eUa+)=ihtMlVL-&9DzuZI*V z=_>4&v}AAvEQ#Uk%Cd0l`)xo0EX1ck#9qVfo&I&H!j_D3lt40v zs4Ml=Z*L*fOJ-|-S#Wn)G{ka-j6tD^85Dhiym1af+d`L#OF z6psAH&`Y-it|;(JAVBoIh3bZ<*Ue$6^`m+6*)nqUbzxpe?D8L2l^_*t;ppQ^QRIBW zFqzfb=6U`7cABJh>|}m!5Z0f=e-(U}mS;mo-DHBN#_Tbl?HqMpI;nKEO)XlW5L zL(N};XlX0wfd%-EpYOkta`lB&1<-o`LmVyE-I4{*$H6jcQ(Yq5`MDX^xWRFMl&*h^ z=Xqod)--Dj^d>PMGT#rHL;E1LxfyAuUcyjq`Ao;hK-0R&X+MDsSPQJzFA9 z4&$G|cWeN5_t|=^oqU1Oa?FJ(mN^OE8nfx=STijT# z6_li&(UkTo@wC@ zHUF@~K0?=Kv|XxVtb$CfctsT^!D>Z?7LePns|pt*pjLRdbQoz$();%~9K#OnM5h^& zz--D|JJ`VXY=7PHs8ud_YtH9XU8uj+o2Gn{`g}onXSN9p>}Y{aV|q3U>4o|amjV`- zB6lr=PqU)wgt{D|8=Eu*t{Evhm1fQR3%=5lmoC*W+kU^Ccwf(|POXyIdptWgD=U@g z0IUeU8lcL;Dot~75eu#0iJ4i`O$Af-!* zUdn@uZ4_TJ^j81nOvacPQQ$MY9k8WKNx`KCh?kRjdD z&3dF06@H>#so#w+uu<1YM*HcAP-o&4T7{7KL#m#N6E-HaNC_PJUzsRSBU`R?v7RtWBIXt8tCPPBQix~Ly)NdoM3_!=(Zz57$+ zMf#rYLHaqb&z0P`mJ+8W$#t)|7_ri9WmdT>#(H34W0kZ+50U|B)lN@$HtZ(d8Zl** z4JQ@CwQkE4DJh{9IRT&dz(K*EskrTy;=G+^Ye%iGujEfgzma9JprI$>f#`Fp(MHK3 zi&s|RhkHd^OHIlPjTJ2Y_?{!#e3l?OfnK5>RR5yo!9tU=wh=horeGE>GRALk#+{4R z9ewQbk6P%Am@y@Ng5@AoX-v zzZFouWT@X#L9A`!8!Vh;H&PP3?}<65Q~$K!5}<1lY@HL$AT`i>ecs|CWu1w8Bi++U z_QyaPCw1}u(uK=bLJDi~u#yWH5y+_+&t5W$%#rdF|Bk6v#uUF6;|L z7Yb^LWT&j_7wksTIWDB)e_EeS(|s<(_?@oTv`z-V+mN~59oOg7%~fy-ol2KxEdB6Y zJwvcD+Sa#ILlZoZrz^-O%)49d$NZeJTzLhHoU^Ht05S zsE+u4DpaSL%h*JpDHK&=Nlc1hsf)+o2>vM?#~2^>p5V}t-K73gU-1{J?zKRSTT7p` z6b-df5wI!!DkqYnNXdK_VY=1-r90ggu>d1a>og{@+_}m00}z`++pbq~U@u`ama!D(?GBq8KM$l@VOf3F6ZO!P zm8U1~y0s#sI~j*!X%qZ!-&Hm0@*%eY<;AHbZh!J153o~AaJC=NH?K7a>>)Zu!>bk& zXsfbh3lEbG0i2M1VS?XO{n{^AZav%m>2Y&wN7*1ptLthsb&X9!#G9mG*F%=g`1cks zhg>C^gf2_6A}kDF6(;82A63;Gp?k2{(8n|e*w{TE{e8G3>K|5iJAEuKz<>D}{2l{4 zb&_GtYh(Lz-;L}xz%k+J@*kI((DjECuOZrg?o?rF$r<~kie{7f~FM6klt@!N~0JKfX4V@^|Lb-)eD!o1NNDQ{FUf|yb0uHzAIJ(khE#@nN zZHRfdkD^xXEdkUD(~asJEgOv%qagm47A&1_x{}e_U%yjV{z^2UOHr8Y=L|b;T2_DXF0@oH)#!#v%}@TXNs|RtxEu)KXVLm&Zkx700S6 zFPnUAZ^!O}^)Vjcq|~;)n*+*i!`#;*zP{f_g^dCxXw8X@Wt8FD+_^u~l(*9@X<~ue$7=o3$Bu*KF-| z^5<83d?grtY?&N=gluqgT3F2W5=CY;U9&Yf_d%hpbO=k~k?U3k1u7C}8p%~Q`#Ay< zoeObK*8E&vuYR`CAj?8E$Gs=Tvy*I)Ua7isk(<7x9nZc4A+fSOft--+?oRrZ`U;CW zjWb2nckiA!E|*7cpPr`=CTF4*&|J1eWZX=$cY^oD?awV{-~24f_S44NgC^%2=)W%C zLA4~9UG8neNACxLep(G^Sd%9|t3=$PE-giVq>Xdue~Zz5You129-Gt6GjJ_ zJ7udMV(AU1bFR}7ft=hXpYdO2ZAn78RUhxN1s2sU_{slc-il(Qsph(3ZH!4Eqgv6&zW3w>ekp4(w3$PqOP%yQ&<;={*;P^^;1nL_Y>W- z4*%^hMK(hzt_Iif*UJImQMyXvvfp9(Wvf~u{bz)WI-D64n@H4W`IF0V{gdqvX}nHb zk3>8VqbYa66}?3X4TEBNxj~&OSi5vW#UK{nA%dBjlvTc8d1cMf#9f-iHtG@D5Rv*Q z^!3PzdA}&3>dz2r;@dgf`AufxI(F2uIV+g71@SXF6zsy5;^6RFYwl12EgtUh3u2z~ z($v;4YnGPv)zNswVRGz&sd5+IWu}j>eCU~zUR&?d`jqo*>E;v}o#^UR2M4v>%=gTQ zDxCp*qL~W1;NZUA-obEn(=0316joXwOe{dy%4ifvcl@Cd394>rVx#P!blR{^fzq!U zzI5_EnEqcJ^>7wPk-h{7YnM_)cc$!3m#jS4w1-X4CYP;-ey(5cG{1}0kzMOlBYZ0M zox-6C*^#v~_lB|sx@R?ZK46`ojhP0<}Pr~!YXNnFeO5si5w1W){b6t-({!U z`8!m6n7QCzIc*DHK{r9j^lCO(l>&A3*)9i6Y>i*faicWM*|Pg`f1<*f4f}j;5`b*+ zJY|?qnh4)Y^H4I0kc^JzP_d;#{|CRxOfBw!^3ItG)1kR3%+2|%w!IkB3pS0+BO_Mv z_UOLG4xZg6kCPvXFf`@~uUE6g6uy<~Lz1!DDC&7DkWWUZ z*w1&9ou3k()`{)TR2<-2Vs{t6yZc;eq5>naMr z*_z_kQP>lRt&c&D)f%;gAx? zr7EO2$(dKgyLpW7vPYC&nL*DoKdfy|W2ti6`*=JDSEv0QPuqasQVS4F#CoNDc!0?{ zJ4DA*oNe7}mP?jIE^mZg&b5sp$he`u83HE#v&6Vpme012=H2haZo(je(&YjE4i{kv z*LiwM%A3oI^F|9eMGB`XVanvSU*+1Qv<_Od{}b9`))(AIAN0*W6%soRLto4`_=GzX z7PoEtmatcDeFBjd)NczQKpN1aMO_Un^AOX9Xq_geoDvMGtTbup-Eo_#uhI2|7VX+d z1y933y@zvkhNN_&`@_b~4w1Tmxx5nHq7VO=b7{W(H`0YNqoEH?ytv_NA9}M@QX(!7aHc2?C&N{zDai86{fRX{ugE4ZQkEdRA~HGQ zyJ71iYf~lp7Qd!SloMm=KJ8LMRV=Zu%CntbHf8~om6LuDff6mo_g1!s3syt zv}vO&oFxEB=bjQ98~eZ#c-}o_IoBk$Vo|KcwFrN;_xLX5%QqJ{U^tKC!6)&6<#g&t z{+D=|Gn`fnxH6VWvfneBsaRk%ZE^!+xl!YVzE}pZa$=E*H|A>_#}&-+tQ2d79dN|D z$-7hY3#rlUP6P)jvEO8jJ;?vwt59oqqppB5the81iC~8{T zU~W2|kRUYjpy@-3&;Fw8_w-e%sDm0RH7y;5M~Jbq$3Ot;1=fl7f!Ir!AvEY}zNyD7 z?r@^mDhOGq3;V*PM$KQ$pDksFGdH*A78Vz7V!>*@_h!d)pIc=Q_sr+0sE)d-rw3uN=Yy$*N- zStbgJ_c7I}da?qULb30hUPsxjDUbwesFp!tJv!q*D}$PB6rD>0`bZBF=)l>yt_$@i zBIe!l(`pce$-W_?OVsYH7-5S=uDm1o(WBXXaHf3qzP-~9cu<@P>^n`X_p!w@*(THa z=9w-3%hRnoJORV1NU}{VQBwr-SdOu>veK9wNF0bT77bPJ5flCy#IWld)4F++S&g;P zIS<~WsGqNQWU_BHnU}wHepV-^s<4Q>XuT-I1e;bjby$kk1K6y4HLBCG9-K~{st4c% zDkO}}PyW^()G#^%xI&4%i*q=0$iId)0saF94ZFIcEI4mRY6J%3P309k7MPHc1aYU>=ZpxbH{tVJTDL1^c71 z_abdr2)9rvS`~0{2)?`v?oap5VCJ1bVpi|@=u-<6GX--QKNa)og&IlhqWpjSoV@7n8= z*b(z}#KVlr8TZ{!k@z8!GNg@l2+p4>GgM6BG_^Va4gZ91%-x7vO|xlcZ_*}&p9;8W z!R9UuMZC7FCkwi?`sCN{F;*g+O^k z!=|e>b~<}DdX^Sduw?7L*voq`)x)`8lG$GsDY6@!ztLk?=*jjH?&)Nv=l4I0{n;Y5sIgNaWt0_t;9D$E-shy4ZvT z6Z<5t-zRzG4b~}8X%>>$bv#BI{UUccJDAi(oga7;8C;l6SZWo-zR>MGO_%WH8YD^q zR^>r5s8vd(VB(n6eSzFu;1*|6WMbi2dbhVmt%vfso_&q7D)X1J*7_voHsU9SV!#sHh; zEhkr}n#xM<)#v*)ak^X1IoakD0q}*rX3IKTbjyG_l|06>-vR{C?X)BQl*NDh#*Cpbi{&!6ancF=^do^AR*c)h+X%19#;4w}2ne00V(0*}f_ouU6T%1M>jxj}SCWmrZu)K_G2C~j zs$ZPm30AU$7dpeKDz#N_lJX6h^K`kHB9FX^rIpqC zwZ*3=scBh$il{z*moNpr=L!`^9N{PaxdJ9TStp;DXW3BouD}I>g2>PCB{s$Yw(Dc% zr%Bv6hN|hIFDZJoM4`)OoRT=dA2w7kYHcg%6@a}pjBu-^AvgO1W=peB?0uIWt7@FfMhp$hc? zY+zv8P`xb>DVUXDuiuS)TbiShqSzG>g1;!;!8}uNB0Nt3quf8#J-FIucEs*P(I0+y zBzkt-TApqwpw2a0JDX=xUDbYwe+JObMwHTPP*DAwDKfm(z4v~jwcVh6!*bJ-l6c>= z+o?R)pwMvI5d?JVsrEsqpdSp<3bJDbuWMIVJJ+(|>~=IBrMx)3JLTiV;8YGbFtF-> zoPCx72V>_gZnG-Zzy8oTBJ$^2T6!o=fG`HYxt9XnddisqP?XCj`CJo1y70pjxvHOX zbSX*2f5<%V7MJf(P|ORMDzA-S$q}IrWn=tUNh~NyJ8x6$w0;yhE1!JG0I$MV9dzP=&xG$ACb;?W9X+XI%;pWY7T2`jON$D#OI^R59O?A&Js=3=hpZvTH zplj`!%?&vmX6AzV`3BGXOC2O}uq2<0`PBVUeSB(d{MrX;H*Ogq3aW(W4caEpbbQv_ zNR@J2d9J1wO0j1RQ29stfa-ULLIdV;heV!nw#S<`8(c=c|CXPS|L#u^I^ZGa=q~_u zq@$b08Ay1!HAiS@Rwp|FrO{dLfpwq-@%?GK6-UXA&nL`x#BF}O>fp8jXJ%#&6uYQ9 zII94@{Dy_fSGA~g69TtDpwfrQGN>lqSia@7Dv1*>J8(%9K;_N)_DA`Ig*A89rrg}r z`ag%K1;B&+)9Q)~tjLtH81JGdO{YS}0q)_NlLr!`;8TG>a>@C~to!_7m|mZbQljUP znLB@D;jw7K-N*|+%%|2L4L6h=)i4b{(6SHX*XFn3V0s=+KSlmZ)JL4nt40EN?rJZr zV_Xra0V8(gYZb_ZwJHALeDitFwM|Aiazo~J7`y5LPNUA?jU=+N#N$WY>yk2JZ9%3x zyfa;4llO-YlptwUO$rk_MWnrdoz$EWfUJ;@5v_d~(CTB@DSjGT6m2XEO&pDsRy1_QXxdjVZrLzfEMo=OUG zjuv!1rvH)xVK0jS_hr$vIYKSc0HROMiW2woA@dKePUPpk$~D7oL) zEutJi3G{~P7gvG#CmQs((Hb_rla#l7r&Sm^edAI4)C5jnK>Y{Ngq>Vt4e!U--osMi zpWLn1C#LQwJf$#jdIt^uU{r3++lOeYVF&TJvE6vTIB>K-)VD>0rDrB0(FkVqs+M z(_+47+3c7raxl0qruZ7e^T>4*lhC3Mnj700skCGxIY@Xy6ufUcy&$2F|PkVFgtK$HR=51=@^E)ct zwSkZ@Duw`wu}n|)t*mwnsaNX5kd0y8H_u2zWZtSMl%$yHI%HE zIL)6TIv5TC(7@x;XLE}gflA_by_;v^Z-C&bgJwV{6@ZzAT@ytFzpa&%cGL7bNW7kY zZosI8`P|p`UnTa2tG#KkRLo^og4x#$yNBcZd(n@7+SiEpnkCs0bxdfOuFr_wKY2>< z>EknR@JqO|Or(~(C!9p!DGfjtp{@h1=o?}>_ew$m){RB^o`&J)(@NK#-uj{RbM+#4 z=oDfvfB{)(hTYa)n^A%3qOOF5f}KWo&70E$`5IQX`-N5M4{Zz-%%xq&=gQKCBFrZa zUOuUIL(M)OZjzKUbOrh@el-x3+=*Zw>4ABkRr2EyNhjQ}iy%3LSX%a}VZd&;r$j z@v^&eKyaK)y|p?8%N1(e4Y}VJ%AU1&RCAwl%FZzd@PPj3^%|^DNX23|G@1vrc}r*2oR4kt;*y03_(zhEk*)>?w&3%{A_f zX?9RoWC=8gtvL3}?`uYXMEypx~>7aEKu8W`_}v3!U9~?`>R2Y z?-udpr0dJQH|P#W>D;ACO+Vp06JdilZMGwK`t5oa~tq`GiP+o|5;)%deMW4>bAkEkTv#``WV7O#!gw$s!P zR*lve`a+oXB?B>+jVfHfsKQ)2d(_d5WxY-%yk zt1W{E!13GoMppc8GH-MLXS-)1eOlDAgUp9X&>a_ndX{97p!M7J=P&Xm@5W#gx zdTkZkjeocMdBAGTXMTNPJ_lCFL$+Kmus_%D#b~)$5VScg8ixj$8Zr|=9mi`$i7ek~ z3M4L3gMMYVx;}x4W6$=iI=#lqtRRC8HeEis#U}#B%K6|`iNa=>m`BByC}_vqZH(J0 z^E4rc`s45mnGl=C+C_kBVwP*toSH1<^2-@n0&355S|})i?~GPSCw}tujI@(<8X3i0 zpbIIFj<^`_Jp9qz zb$cFsuqU01G28RmW!Sg9dt-6-kyP5b$CS6d~wU+*$K_lLZ}{SZt|yE(Nt zL8d493-oR}f{X58Sh@RSB2Nf$c+t~q0$?`-UBPx236(mv9`^<1HJ~O$aqsc7cB#Ji zp^wCEyM2tJg zbVI|!PxJM5II8jhCu^O*(Bw-sHdy$F0^NWoB&G&CwVIs+CgammXXE*`@HK7{pF}IO zU8lymb+2ip&y~5jeT@cV3i1>y8nE*j8JFCZV5&ic3WcXYnQ(DvRr=wX^}#qRq(ZmqDCavQqDnT)0wbH$!j2M^B* zrD)mB0G5M7_|$h$R=;qp7X6|Y}@ zojmbGup83b7;MUbksQ=LqI;z-v)k?h9o)b6_ja2et=}#NtTm@XeRHn$URddVLMRq| z^{7}4yRWL+<@Tk$S)AMv*Z1r1|Er0ol6Q1{fOssa#h=ei*z}vB#F?9UI+sGgxh7$d$;BD3tGfMmKh&?? z9ucn7#40j$oQoF*x8ReqEWFrPysYBn3NMKT1~tMPu3o)8I{gtyDSmpd8_P|^Ki(bk zW7I^`zZkkSe1Mj%h>mcqbR3(U{upuXj9M7S`c_-YNt^k$o}C;UfC77ji!YOO;ig7* zut37AOQH(7FbqbJz4$Ay2T+%1rn5LA#HMcM6&=M&;`bTH@gmQN^_~!bGj$W1(ljli z@pU#NJ=h4{tFfzYwy3#2b+?C%{}5RnQ5L-40pSL)zsikI^G;W;>`P{;V=uz&uV
TbSPUtvl)<1pSvEME?9h>6TAb1$O?h=PTAa!nYPhjXIYcfsj zavhGM{yI5j1mIBtIxMDAN7rpoc6J&`7^0UPva@rfxUe1!z<655)oL}|(}9PKf~5!y z(x3qa0vgrvwMt805DVuSZ-Zx)Uj;@zbsPES{#nZ9c}Uw4A!9ztQp8+{64a;a_uwO*b7?c zriNzz`GGIGCHJz8d00qK5-UxYWm?xFhki$DRPaTxc{~C0F|k$cVORd1_1KHH@*vV9 zBl!F)A@LHE%a<2$wQO<0Bh(0+@I8k!ms+cpf$rYdit`uiKVPX-h@@WXe46v^qwAmw z&2Z68qsOCX_#8s1<8##kjIHPn`w#Dpne&3Bzzqct<6dX0GecmmSWJHo$8dpu;>8NI z$vTvQTNs&~kpu)9ZxpXrC%yROzs(v=Fy6Tgu;EzDdTo?t$tl*6Tj$GfQ! z6F?=wNWak3i2*|Nc9O-bKk0vwB~2A1v_4V!@j`2KXRKME_1M<1$0cAu1x(IWC05vp=`PY(EuaRH?N@dgtuV?T zpWAzZ&ZB$jg8wyePwASGc)+q(3G$1of#+LcoZ;e#Nu4@S(N{Im;W(lLAQXc^#GSw) z8iv8r3~uQuJ{OHBJ!-}u72Xp*?o?dM#z0e4I}G~zf|nn|Blcf^Td zlpQtX_P@QnA>yQS;{Z@-*0Fm36z00zK?!Y*lhf=;&sFFym^xEzP2Rto^5Is0Q#FYv zXz~%(c-mD5#be4n9 zTfc+Azc6a$(|DpL+Nf;cN|QE9o!sAa{ifqDGn}7WX5Xt&f7{XfB}GRRFw8RfT?NXVpm>R0-@iwaxoAd(?sY|U z`ZnyO{M|m;Z*GEvxdCbswGL>V>xF15&YeOIB$`3Bn$5n5AGJ@Y!r9 z7QMz4@pFg#+`oHI6QoP7QaBjBi%zO(twVXen=WCO$W>y0;1oIGFVc6oUaShfR=>nzMM4-p|5H^%tRvxr>!|82QRM=~DEpi-~6*gQ# z%CdG1y&W(9p$fIH^`ppQe&i9(oLJl%ZEH?UGyNV|!(;&tsC(bfdR5}OVQ+itfl?sh z1iyh1mSI=ABIT7{)QJy&@Mcn;X+8I5Ao_A<)TN9ln(I*p_wP8UF&BTke(BAn0X<;@ z?BScQO!rTnjWQID(z%zfd?}OflYQ={Cm5{ z-XSm$KhNp4QLmyWV^Tu&6Sd6qnRe)3vtS0hl0fGw4{$N7IQ~uEI=SEwDTwaB9$&MK z@D=e8kaKN(y4JAxi~eN82%Ge^Yt|>82neBzs?n`Q)nqZ$xR0#gMuy*dC30IEW|=8@ zufpSik!ONGCpFLlyk2M|(q4%~F(LIetNf?D;@@6&!QYUx;SH)r^|LGPRyY-7pMO&D zMahhqJ52^HUV{gQO)e&b$k#yg8r75B4o;wJuJw1;@ZZfG^HY+Ox9UKqfmY^Fic^Cl z@UuMdAeOV+9_CZwg|*49Rin<9K*$#F-kuiHv#R^-+4y*(SBcd0^M<8v(&u$=+6n0P zILF@d_b|tkYb-t*T50ODa_c8Mu3@*}!VHZ&#!hX%z0eQgL@x7&s^AR6g_cOAdb=R& z#_?xgyEqjrqZ2-c<89o zKvl*EigSlsNZ5956~jz{sb_b;s`VY{>QnlH5}4++jCsKF!b4vDyeye4?dsT0q}HBs zVfFOxN}fyA^sQ@}leaOoi#+~jG&6NujmBY;f^T<5gFWy{=WckrfT+&0o#RoOx#B(? z(zqSGuq@Oq=;B~5U|1^77tWO)&`E7{2D!2sre6HD*80vJn`MRPyR3>S;m}?lZkg+} zMhe(e@%h0>FfUYnMHD~SA9#auQzMA5k7#3R89q=*iW#R$$QG>}a&3w79qyJZTE@Ah za@wT@yK+|&Ra@%J?vN_k*iph3sQ6j;@y@$Q`C6PNLVYssoLtT|% zM2MtrVbBAenn?$c5-;4ZMND#$74Skzy70aA{o2i3rAjc!X~O5NWLqmWNUqN1DZEjG z{KKp4Bji?*h1Ko5Dtzo z^_>O*1vi-Sz~Sqea&_UTLAblm&JAY$pUqb%;Dg6}DvbCz03dMeC=ScFK=hw?LyjCqM@=a_~T3Wn|g z_tzvtZ7M+#Y0=YmpjMm z=%Kz)v|5Tq&~dQOw-vMS9P|~t?<}`3mMniqK6$i$INzt$Lh_lsMw^p-*k6O$t(@Dn zqL2F?cG}0wKZdNbA0y**&Hc+euAiQTt#fwk2Y2F^eS5xZt6QDptB7cH@!yii3^hIPll z;@U9MCyIWZnP)Vrjwb0pe_-o$bVNZ!hH&UUVS($kls-|7Hv-kTG+~r62SL+*E%^4R zL|}65Gd7Ji5L>A_v9fXilb#l(jh7XyLV;5p%}8mu^m+-}t#QXL!Z)P^o?OuaL1CC^ zTVa)B8I`X@NY#OA3DDdHgLQ zK|6zc0dmPLCwL}A4i@3cfAJF#sN8}QMO*lG9wy@?L)3OfUs0?gGJ%$e z$1aV*tPhsAQ`4y&4qTKF4&4mvwI-y=H6TxhjzvddM>U&$p&kC-_7LYp%|m&!9^usd%%O%JM#drlJP*`kV7Ky?8zzr(1us_rTv;pKkF{ZTP@c{^a1ae9iE^r$l?V zns(R9@2v?w3CM2|eB?<3q9du{t4?(WvZ&(RXceCV&j8_TZ(?jZqd?6Di8UP(g2H@- zS_k|(4@E#1mID`Fc2-S{95h&L_eiCcIM9^3m<$A)_Mv(vsw%Yp=WgeJd#%voGi!(a z!P}zn*dP0vvYVswUGuES{i_29I}rm zy3$z2a?+LyUcZ>6IH zbI76?|2jO~q)*0y#$C&y(${5!0QFy=unX3jiX^-4`opVKsJ`1Mz?X#28iMD0>hXt| zompYi;k_J%1=QZfo910O!=Rm7*10h|DB|S2zL||)ZgcuTlw1Ag1Np-r-JfJuvxV5) z9u`)OFD)U3o9s4iM=A@<{TGIJ3GstlWd_C$_X=;%nWbSaU97+Dso$N9_sAlDJX7y6 zqH1^7&%C!SeFum8DIELMfQw5|NU3np$~W60dBPLXcuvH6TEO1vG0W$n#>3BdSL<#) za3poEA?Nd!#jQ4)PKdcy#)c)-joW3D#oE)^blqTAl;km^S6JD;>N=p}OG@BG#{-#9 z3V}XnyMG9&7T0?emj2jEOIN8=5>F2n28NqLA|LxOJs4f?mF*XO8{d|a)ZnXI`itEu zrmHz$*4;rPo=N@_#TnGk^rU5xNkQ*(?~FX}z`|I~{lwA{(-61%JzF6qXTz9o3Z;q2 z%u3i*B_W&d@3j;qZ>9$dD+Hcy9~JuQ;64DgYryH$Z*3L4S4qC%FwONAnN+8fmkL~- zx3K!?yP1Rem2$gBG$&Ra{mFRg%jEmJ3kK$|PZ;e^{(LXE=((n*v|K9{+!o{Kf^ibN z8YujhTQa}-8KM}MG=8wZ*!ZR*Clvxp#0+EIYT*TDzt&BRjkidIpdIe(wkOI3t?w8L zSeI3pFN?=dDV7G_Rx0NHN zU%IeZ0o1&1X$K7wpu>%tedy*9R-ICKQX=xiw^+KWp!H<*((Q>W|#p;OHxcx_nW!zbH z;Gb?co+y*JGW?@|YRAeb)+LR-y8_SMN*F?fY#YgP%a5cfx7W)^zgl0yF+@~L2-r#u zKmL(=D;j!e{klRSpUbDYcVGu9i)V0OGtk0BBzQGMGd0yLXT3ISEKMnXSj*5eH3V@D z2yMzh7e}so`Has;e2Z}JNhR4wLh8qE$)%^_BR_3+D)^UzBH!v=Sh_+Xuy3o!LK9!r zDj@L9xl*V_*hRhKEQgc?kO7celT~g#Jn_Pe`h>Gw-`3cuLxJz3ZO$Z0%Iu4(rFVPD;Oj&#X(RVmA!YH2I%Az@IyAFt6CXa#3KpJoSdG;YV%ZYSWm@`{ zWmCIw+L|}o3i34tXR2;u(5ZxJP%5rPkBo8#!9Y}bEMp+@_wV| zM&m5GS%}9p@75fntnJ#2bq*z}pM25BbZgT($EWkJ79saY5DHE=;*^}llY1ODXn%KYoKWvVF|YCqWhl!h@#+gp(iz38yHh=l zao?VH>YFt9=A9-!Mb9QEgP33+aWM@9;cdEL=i}GL(5z;!Q3vck^xA6L>ard7GV1^b=3{Rua{@kKc$6Ycv zc(?!dI)|NVC-nBOcPHhz{_sUk5n5~@p673g2oeD2iAePI+rco zjJIoeo99p!pyeHbB8lhErWe!zPdm>*^aLuGI?qgI3t_l|6(H>++nVhk(l--Ce(;Mgj4AMzbBAXDp= zK-ykpy3RyHL1tfvyD0@!?xNbc-_&kTuT*8f<+vq;bwW>uD+OJP8PA<)8#)gphyl?} zskLrYL^@7wh`?Jexg25g%Ev!K^+V~T4VAzL6$NteMlX zQ;=nq7;jRaGc*nT9!Av)CSelX^5Q&dh3ehh#mrRy>5=%q67r>H3V{qa(t34AwPO8Q zU91fS1vy}hZaH>&O*G)Kyy$A{C)wcf3%=5>KTAhl@RD2LDmGs~oE!HAt=_sTwvC(4 zI5&3AFA*BuFZX?34@bIHv{>P@>GioKZs#D<(=LQwRzJ1Ep{wQDqm~R)InrZvkJIb- zf;V{thTN1xP`BiAbC^S?MYNX$QLsRz?28wEmpL1vDYFANPaw*O-5AG!cSAqMPwRwZcn>`T@#d%q^f~U@SX=ccf zf=Wcap258_G)4ccl<_at^k+#V)aFq}jnGXWBNHbY`~(>17+txR0O4SRb`_Vr+PkUG zPZ!irU+~t&3>Z{&uXd7Tkc|F>PEJ^v3_L9CdG|lAsQh&q|EENwT*7?a?joqC!N=#? z$W01BKtDFli{Xxh zu$^YqXFH!#B7dWbr@{DauL}9&eOk_{?=5~il`@-gi|KE-Qj+X+b(xaiH1Lm#Q0`TJ zybOfWtf@juu>oz=>MyMm;pi-X{$kSWfm?B-|~D=6yb3 zYtqhuY2DRg8tF;(CrVjWgK?ZhCj#xt(=)~?qq=>DS@Ri?l zru?gRJi7ykmF4P}bY<34I?vMk>V;o8sQn%%_b)CbBaZfC*TVIkP03G+|3~kC@AfXa z0|LL)SJFOA2Shl>@D4g&ZRe<`hNq6<(SX4%-3j%mN(855T=s&eT2=3RZaK!uETjfWOGlUg$(9_^r26QN&+<_!lkv2XYTk&d|FNuH4A| zLh5)VERm>OX2`UJG^`$SJO+OU+!2?1>WzZrJNILG_zUGPXFjTBpIbs+_Z^fymRDr7 zpL)~!8IZuB)VX6(QHhVrWtsX`V#i`$${AFr)UtKX;8suA-~Ctr`VVyS-?v%Wikc}J z=uvpI9i z_Dgn|oTE{#d-wIr~$g=p0KX4h!Cqe|V(-SAQO$m!Tbn4kgp>eOmC4=^UE|=8<05 zHtrO2%wG5s(wM`Y7We(%_2S>8_z!+kR-l{?D&Vt~KlG50X12^`j=Zn-OVD~YXn1P} z%qtgv=ugrsW9y%sHW3Ww`>%HYzui8#_*udKGYjDVs$z6k`>^Yi4JV9hKxKw8 zOdXKOT^q3wfuABS3qoH@F02^z8fVQkGOa;?8|_O$j;P5-5DiXHRbVw^NGCQ&h*vZL zOg35FJ_-77m-K&K#(#BQDxW-)^$xCvG1pCOHxRPD6FgRTV>WoqoMn>LNE2k9L|?IO z)C4+6=CZW_FW0=2bad?;AeZMnxnYwO60TEOabRSbp>jNqh+QK?fN#ep8>Gw9ZSa$V zSU!)-tps|++@J_?@>Zv_NM#`G(Lyp{hfWzF-XqOZqj2to383+AgvIdRWexxS9Em99 z%nvX~L(T@=vg{M(PWHn_rdf!OZXaqwRiLZn!Y@drAVh7?y)LKr!#+gvb)tvtliri$ z8>|vh5SwE%1=EZVFoWJL0)Wjs34@%XK#uQz>~A4)e6;)OG9e2%euix)7v#Xeg`VZ0 z+SCt+<((dhG;9v)T;JemD)=!iD&oAKoUcgNjJi>f5d~_(Bykc6|5(8S=n^r0{g+*r zk=czNHy%3+aM9v``}9*MSp9pE|4K*yT?GGs7o73r)HoWmkQ6k`2_LxxXPQA)eM1u} zBX)sW=-A#+mLyB5OP6`+;as%%JWjkf_N1b_wrL2tB=CF8i@zn*mW)~;3{qL z3te3d6(RyHC8@!WOdPeTw+h%ksx8>Nx@>4RkF*uFCqzV(h|N4^7po7zKu@L;{$sr5 zWKG%T6xNIlV(Q@!o*K%lZigQDnE>E&z8Jo0Vtz{ythbJ}B86N9cyFOAWn9OS#$77C z9$Hl!Sdr?_R%=84ldN>jLmQH#+!)#qHvY@z54P3fjWzybw z;P3VrDyA@E6u9ooK6(t5q$8DW0Mcm3*U8F_0f^;ycj;q0U_sB`H&6Pa$eY*@rT5h& zWEjJJnq3p{-hx~`29E^Ap~#rT-9hM~j_1L5szYX^neSb5;LaLhAV|>jJlJD3k5W3= z?Daz@EsH&$Y5FAL5dW$4AixN=_h`JA-+SwTfMwc7SGEA^+Dkzmk% zJweSKX%-UApYC@#JxTG(X*zbcg2Hk&XITf!7*3gTTWQ-1C^ViAJe7gGF2fDdmwEQXQ}5+muS!6YvC{nz~M zR&fgEo^X$i4lS^}rouuCo9Hv;>`uY|(b4|j`7WGTs7~Ib+)47vvR_-0E(;qP(niKm zvbF+-%FLg(TbZogSmjCFdeZ()A!f=qB{gzSfs7M(U$Qtn4-A3LlR@pw0Ne1!sKU0j zmDQ}TYW#Srf;e7aokJC&;KtpB%1uOw;wW!F0O7yJkC;?9d(swg%6i#z`pvY@ckrjb zL1{Gt0D*Av&902 zzV3G0DVh~I!L~=O;;I#5f_KK`loXeL={o(`mqG;%j@n@x=8~2N|Mad3zEj@PEn%vP zOshq5@EjhhV>z|@q=7n$CE_&EEN~s~zE0u%Acn2XFcf@}iathM>kv`1hc=4i^jfkxrF%~aL0qpYj;^el~XsLx*&@PRb(@0@*)o~fv877+W zbUK_#vV?##(1O5Sq6x6jq~9(inh2){t>igQ3G}>*9-^}GX3|g+O6c`{3 ze0C0(z?-k*LJB<$gQu+HU%L-#NE^g8ZnR#R&p4@cKE*{!z-Q7Ta&(W3El9689$y`7 z0F)X5|A2ZU7#k%y!iLNoeIr;rY7y-F^k9CP4M(8C57T7VbU{hbUO^DT4q={G69er{yXFS{~HAXd;vIL z-_X#J9oa#>1G4&H*-z2~9E~B7!QMLsT;}4=qkZ(NgrluRr?|BtW0mrnx1|quavo05 zN$<<{$`MS&fKCAViM-#0iU0c-gihbozEOz-Hgw>Zq1%+VQ^es6l`qJ;X66+hSx}oJ zPDKUYnlBrSm20_KeV}--1!-)X@Qbt`TT;>>|w=;64PaKcGqzkny z%X2?TMmI>7poN`FzY`_fTUEq%h<#K}E5J~Z^T2qKH<`^5ZKauat?aA3tGZK=7sT!0 zY@X=uo+_C#yuQf;8iM-5YyR{YT`f6wCFmI5hS;nEAScJj}f zUL-S0qk^0OW?AEW?P7Y@Diu8^8zZX0y|PCn#M{M`ybaQe%hd>!y@uWSKI#vdnr|?1 zWo49_yqcpx_QLOf_5lVRv7|T?r$=pJX_gQ(B{talX6C~ap?NV}umI=sj+SKMwiu&I z^yo1OfGadH(Z7GvHwU(nR9x0plYII}{M^OW=wzpsbzQe!1ef>F`^}D%N@gyE>?`mK zK-9(;L4T2*L1F)SrQ-V9R%n_PUd+mIg~dnIb#ipn{tMmwbRf1Xr3V=HDm7tQFbXh} z+X^A(Z$b{XzbAM3PIx1et&YjX`<|i+w`3yqda)`FKGnaN7P(RBh6hfd_AZgeR0Hg{ zd3yI{KGtE0B*oyiAPca-sf})N%>oBxQW!1V)BNnkTQxb$JlOp~;J3&i;tUW~S!&1~ z+gjhW%2E;WP8fqP{RcJZUn=y;DJgRD6D24)GAm8^ZS17LW?mRWYRS5;mPWzIx~xBB zcauS+ivll|H}cd+hYi)Q%5@QWu(iS_<6)g007p{x*a1P+8`KnTbr+XQpNvh`E89b- zpsk=jD;@oSr?TKkI1ZDz)JLK;Ha7meLF8~t=vs)<$z$3!R@)rHB|Z6xRu)X9IIeJ9kayG=WEynK4J3bD29=J;3ZOeOEADc1P9oASuLAc#6&e~E{_jwqZ5w~k2;LiCd7=|F^Yi@`Imx(ym=djH$qBzgm1S1z3>z`{$H#DZ z0ei`Apqv4kpEeOZmaHdKmYRv?JOz2>Re{N|?2o-E0Bv9ID{*%#NjM%@py3pt)~ATW zv<8jGV>hD|t!?J%!^g7vKSD9A0Pl^ruY_cVKPK#7SX+pNk|?>WP$hpXBK{hte8g5+ znaNi_mgn0)5B1*$Bz(MI06;SaR0d|hjZ5~g5SVfpt+hWGpfK!nn{Xe8e>^jE2Z+mQ zaRp%o!qopBVg8=iWqhZk34f{Fc)GDY@i);3|8;|au;2UKkpT3LM*vObyxOKxi4Mne zvMOhg0Q@`=!1jXE11=v+5@T~OBQNh!2I`ha$<6rRpCkcFQupLf4O)GmWp*r{uIbig z?HdWFh&Qhg#%~>uj&e}`Ny2c&4Ke>7t^do3E_8(=T;>RuDX|J+n6)0_LnIhi&eZ(zCz1HbHu#~3M+bhEUshaiZ(#}D2OXGKb9}Z$ow;L z8SNANcKcWYj7!>7p_WJdOZwuvUh1h7I+j-edF&Cz(?H2wf$=Yq*>91!@)w#v)0`)6#oosf zUnrB0+C%`D@>sv%hyfVjSrmONR=mRhZefoaSHM$}emsu!38h+gxpL!!hT4()e~E2= zPtt&A{IiK`rMAi_zfgZvvjHUFqg!-5Jk=GEKa+%E=-8RRy!-c9T%SEKedS38 z=*yJe>hZu$L?GG%yae73Gj#=M8`V6x?)27fCs&*VCQEs_jF$oM)J z6;$Kyhu!(KkWSLX5&G13S8>=SnBb)fj9O5j-`%}4Y=LbgU<@t7ne*H6<3`5wJ~j%z zlkRq=04lr3*Q3#MRN=p0X4oCq=+$B{mkj}>m%t9l#P+XGu2|ugp6roaf4sskI(>Qh zSE=_QDRr(-BQ)T$}ng-^7_z$mqK_!q6oWu?< z7OAkb7(4`R>HOS5O`A2T6Kjjnl&P!Y!vawoFR{T&z3E#;d*~nl-oH1lsWiX#C#Lb9 zypvYaGpDz|4P|KSkwzthWB~??BG(dOcmA-L*KZ5B`0v7!uiH-8dtEou-D!eH7u_es zSM&K1AzNyOKY=sF++wwCkDWVC>k{O^q z1GM#eIvz}A39hOgdcIE=j+5Vd=>1cbJ6PgqFbDai6X9^sej-GCT!M6eTrEj#eoQkk zcyj~M+OHa1E4*FM-Trsl2r$aQkX=a{$vOmF7yWeG&0T?csroAvV)AZk&A<-XP1uH# zoLQET<8^@8gqMhVjlcw(xnJ>`QNfD!$REive=m9U(NUP~8I|g4D)JsSbmF4x)eCUp zsCiRkskZ+R!SB=}r}S-+d+#t? z`p#N4N^y!soHz=Z9(wP{g7poRP|wq=<00-9oS^+}wR z;Si#0*z?wM$m5i02L7}lM}^3K>A#tVGApH~!aA;IB_HawnU8US7w&W05%QP+LyoD8 z1S&H*_86i~!{Qs@PAb@ZGH5?vHWT1bi70w5?-_A3Ok@kKBBWI3jkeV)2)Y za4l}@_L_L)y-e+|<`sq5vpkCO#pH!yF<_Pfn}oe~oV!qw`)XNJ17TcT5!`g}L>OX) z?l#)oxDp4T<(j|^j|V2+HHeVeC_{j~V%6Z?Zm_!cw}X+G-!wXG5SQXc#0L!?PA)bw z9l@sNjqTj9R!H3LT#yR@`JoF6d|R^~rL;h?^$ODgt3`&cwF@f>lb1<{%ORkoa2l!B zl(C?6zqt;-jqf3?ao~N>@ah2(37cz)hjTB6kWwAf{u3#Y`Gk_R!Fxj=bEK)~+fN=N z%X=>e5qA}dqgI>Mfd|}2j56j~fZfQ%;VjB~L;x9<{SSaSp1EeZZS_kn$nzrr>FsZe zwD4eRt_bf=6AHq>_}zHRtzuY=%2eF(+MJ9pkm0O@ba_5tFv^UVk9!0{2T#}l69wr~O-iDfH+MZ5^KqrE>HJpky z5)Nw!aKBrm@NvB(k2eaCRQABCpd(((?gR?+IyXH)RtlJxI4VKnn>`?te1{}TfX5@t zXR1}_GeZ=Zw3N0V7k(R113>PwvR0N9Ro%gtA$fbPtai3{!b4(mq2Oz$&$7KM;iJ4r z&vh%ywvb5}=@UHR3iF;m07i_+U^>9>+`1hLfbm`$2Zw7@RG+w>j{PxH!PlVj@XWaj zDl}KG;<(lRxJ#RH>CHptdw0$;F`YYK_NDP{4h0Rx<%b4!ICF|K1Jr!yE>TnSroD3B zTYOv}A6RW84I7)Bs$cX^OadkccP9Z?WNj(f!5MGdxbfpIgTeNr zqH72wsHJc2ZOo~QgqIHt0PIPtA2Z)qZIEqg47pkiS_(3}4XT)Xsmh;HZnL$^TK^s%lPn4w=xVi}_cro-HW?t2Wp=6@wvTz@0zu$#wrI5z}KnniPz zbjAL?HDNqoIY!;3X7+St1ggLnQ7Ei=s<1#~OkV@OpK@7Y6is-iX7(Py@b-8ai?&x2{)b*!!KGzPAG7o4m)cMe*k`k*|M@=^i5A6Gf#cX93^mPYFXwUPPV=t^LSScB07c<*> z|K6M>d@vq+msAK3AfCmy_UVuKrtVo){fEhC8Kb9e2nwpCXf8Fzj6G!M3FKx$}UmaWM!7CWVetV60-L` zIu#O8WbY`Iy|-fv+1caRd#{7zob!7f8a|iq&-cEstA78T#~JVQdOi1krqRi=orp!hsESJU}_P~LL9E6`Dv4?Z;=jgH;Wak zg}gRmKa*%*wrTW&AciWp-+DDXvBCo4V!k=Q*p#Boz@{j?m9Uf&SQ@4%& z(5z|+rzN6o;Y&pos-@QQ&lrd%LwNLa2}96ZBNuCel3-x6Xl22q)=PTx!n&HAfH4%9 z;#wgXc;A`l^1Vi0^M3Q;omGgc$>kT}^WiR{MlEGaUWCoZ`^@uhcXk{X9MCjL?veS4 zGD%97lxvD8LZJiFKp&#o>Q3zvUejxBrxa00`t|K)$}JDI*O&` z=oZr}H;mcAdW*A?+e0+b#h$qr;!#{Rk{d*6maN ztig42FIfv{No=0UX&SH`Z5;Mp#KfxfUx1|b124ava(Xsvc>LM7Ghv+@MCestp#JI zRL2ON`uh5cg;8;GF!ok+n@aVgS>4KCnHQ|I>UKuNARDVXo)H))x$=4QlJ$*?-RfQU zVcpz^b%}-No{=1i+ZumNh`D3I3+v`&K_Y7iSPi@hSJPe~`2)9(E6rW&3N=+*4c{4M zh+L0X2hZEuEMH^tqQBW7hUtB`pnB&{0)t^!&}XgDCvuy6L!iD>g47Y4B z8?|euDEsOx%&x8NzIVoG(c*`w*z~Iw@A>|2TuRcA2rceNe2MtXMTA*lLsK@PTa{>B z1JdYiOjGVdmLE$qxQTiPMp2K*R=qgy&$?WaM!TM)9!P7`RYTnYLAsT89)T6CaujGe zls&TiqU!gluy~=6=8A#AX!Mz)PY2r;C5xzx>YQwN)U+G#LrA%s2t{V5(%uqQPDtuo zmo_iB-z%xx(JNvLtX5J|+D=ZpXh5%SXJ^-K2s<>RFhR9w)uWS!Z-`owULWApT5|y6 z_+ga4PZk9Eda?7P`&>qC;3V3)WVwPhCj6!A&`t-pJNmJDS8DQex0*$|5!W)!0+iob zAL>azvx5;ibydcioE15=X0CDjJC7$s;@M5O&dcG3F(@UWCBh?J;c1kkD(f6qtk8Jw z$AEojhUTEjVW6tqthlU`>cD>co&0ef`KDUjr|Us_TYg!k%O4IJ<%})rIB(yYiN?XZ zqa2Q!B)77zK4<7M&)pK3e$MD#vQxh_W0Gb#sq#h9JQLmp+vu=dj^R9(809Qmp5mtz zFsI-;`XYIuCITHcUz<@&;luC4Y3&#|9EaSNoSM zmA0k%=D4r~p;dK|rgsvF1O`rJ?S0J8=+U;VXA3IT`|`PK z?EB1UnouZ2`mhQ&7UM4wt!z2>cmD}Q4Y7jLXEj+*lfCJ@$WFS{QOnWdba(V@XY#^xW;Gq( zhVgoyT3QP8d~~?wI7Nsj5a$ibUP*!eUWSbyMN&Juos2TFKvms`PSnB{VtzQ-eUM}% zGE>u=@aY##d?5!AL&DG;K2A$rYEz$AQHrE&((>_nB8pneDtI@X)5Xfdz|F<~Y_+u1 zy~Y@5J#8|ghAi&~wJbJWddA*c);)g&+psF)z8L)!sJLw>({suOOjQrvmwz0>w)|vZlS)q0X`?|${2Zz0=3m+Pt$}wYYW}b9sy6!}$RLrt72mvNoRDD0#PFHsbWrwKp_`)e zFl@+|NDbB~5`j}CY8xU>)8ncu5veUG(E7neXsRTml5+Dv5-TZFawk+!b>v8fs*c@N zfh~)eWfu>(4H3rTr3xS8K(^HU3$(~}ed|WTT%N=B>&hWsV0}!&I&y(e+;_lElhVuE z$K7={!Gcor_9|md+e(9$L;tBx4T~G<6ja$lxnmJ(J8Ya^mUHxj6$3uQQqLl60tIc{ z6l26oI`t?DY;q4O;-q(b{7@2&X@1&LU^97wk7XVCc|nfK#Z64cI)v?vwC{BZlIV-m zQ6!T^)x<6~1}SJ1VX6;d`$BQMUqL%wUrm#g3+N9bOchxdVf9MYDtc!}V|I~u?fOJt zH4F@VWP8nQ(=&6y3Nknzf)W;iH4nOYDkmFSF9~FfGx&3x^I-F03Q_ye1{0Nbz;Oxkg^ORAI+y}!1D(PjF{-R{{ z4fRsWcFNl?CPB{kgVT2xjxmJh1rW>M#xUN*| zaY0+L6zaSD0l10cNKW49oenN{dZMkBkT&~K#2{alg`z)tCS%%4A47_4W@r$uyOLjU zl|xUS0|Iyc(yF6W6u~nZPZGn{^dTwfM1w=5-3tY}zgdzXo&)V9JEt&_o-_RvLi(`J zESJb%Y~^15)QE(ayQYg)a5twH^^@m@n5jgj)Q8qv1|jzermZJ6^onYuM~@bs%tCEU zOMfb0e!|7fhF43*dc4N}wGG?*oh_~q7V=|7PnYYM%Z18$6t{icx8A;a!&`OVsbD3A zTs}J6+ovFFj5q<>chF zSpkh94neIy&o&3kF?$L+`_*=)M>>n6Tn?lYpUcKRNS^gwj0!%x>T~D?Pb4+*rKusQ zcB@+DCx(sT6wZhRty$p>(0jrjrXzY%LUhn@XK*+`f@>>QKv5|9{rl_4WV>a|1rUSp znfpTO#c;~HZpS)EViS$12%XPur1Q+bBCDpRW?y{T{t}w&vTo|)=CPwc!ACd_2fxL_ z5EtERa1g{Z223gpJ+uUvDlyL$^W<&au--`FW{8g7&V}59@y@>0q{=noL@L@zqHtc~ z6df3(prLI(1HSn{X#4${%3uvs(n7o0Q;=7#_luLQTd0UW1IXtV&GF_A1t8$=5+aa^ zFwA}A@{=h|UYMqV{JBuMDXLjC5>6Gk1(Bot)R?2D*5^kj@*uCNQRDN4gCvfh%ng+y zM#?^Mi*f4=>)FYh3=}piARDy=8$LO&f5`*OB)n2`dr!-UF3I=K^<1l56#g~~03#Yw z^IqH8sV*q8OByx)jLQyl9FV}53Rx_Mb zOB=#MuL(jDsZNfl^{y;bKDny;2Q|?2mSwvhn2%E*?J}pmYU@l(epn#!OXRbY$leFD zDTIZtTS2Nv{X!-gQ+Wf~me0)nd8o6F?g3~N>SyfpC-`HsS?49)r2WVRZvKXM5vGyK zITH!h`D8Y!$psIFncFo>IQ~u}_moNApPW7QifXb>46}6HbKJgto{)=OjXge=SC~2r z)%KT5flXi6dzaA{f;Nc{&5}NTthi0ia(_L-yzrv^>m*+vxvEf&1&gb!fWF)?sJ9H) zYe!4nx}MSeWDtNP2Q)ZTFt0Ln-ejGId}3VIAd}GyvbEN(6zJiQMhq9<`jS4{ROE5_ ziI>-Wt?%*4Xot&?EN4UnFR@ujhKL7$=TzXj-C_yCi;KbfFY40a_e)^|2qM@{M_Of4 z8bwoD!zqk~p%>lJ7%mo^&pPLFGczxksqty&w_ZDAVjsjl*vGG6A1XphMR7iOWza>A zoV}9$mTRy{ngN}F3aipL=EKl8x&tzj2En%*^ zr?L!-(%bgSn&_rIkbc1@F*1Yp-puW!zf3sD#nRSi-OyMms3gSM?}UU^0DVX{BFk97 zYf%5?zHG=B#-7fgdt4iNAR=rqpcpMG+=rQImG)>?L@C-w_IVRbU}GSbBQmUB zhs51)gkG|H==^cwNU@mn+9$2H1Tz^KnZVvIQ&HQgm*L7XLwOF*pyQfhm+Xv33N^KE z=Pi~NefczgK_qG4aj$)fQ|BFtuo7k;$E@OEYiz$>eGiMyh+B&&3lPomAB_(NIy*E=u+D z4>YMEob_oKZ^qQeP~DwnNzq(hX^^8DrAs%TziO-DBxHUd4RhB3x72!Uc=&x9?JM-S z#M;turBq`z%b>H%El8ljLbKvTel;(ck)AyN$Zp0DWqP-Eq_F3z-JHDhWK?pl4!pDn zf>uQ9W%E<5Hs-JeFACX=W*jt%8PhXy^_;VMvpQ5djlvz_Gcz-m>-=4w`Ml=r*zSF5 z-utM>+IpEKK3s*|rWc*F=0^LE(7T>9&Fy)IH$PI&8pEEfEND>wTHTJH4V!_=x*!Gt zW=+;M&~AoE9!aMWK^Uo@_{^uJmP%qT!x%SCdB^SPmoRHt%>u+4AA|($JbhMob4j-+ z$7-^2?95nxrnO0ka8?Me`|2W%1gD=jzRlZ-yEf|zJ$|&pr%lj6#dtlx?=cyEd7#co z2BSB6`N?5}t`mJtz!TEuPAF8#<}?~QfYug2JWq=o)U(bOD=u*p_sb9_%u9WiPloND ze~#R;dS9?v&DV@hjGb>`%Axx3iGK?Ckk1IEKZh>gROdHSN7Z4hyOO8oL3p$>hO>~l zNI{dopt!iv(=u!FCzAtOtZ_KREK<*(K~^$wab6!01Ocn*$3-;EHvJN6mZso3- zh1=#cqS?cho*sSXCBntqGbY2Yq!|dC#SpHJo3Es^^0kX=5dj7EKpe_oV^f9ZJ?{&{ zmn$4r#EqI3hk%9HOtd;#Xb{AvJ2{;ga~#azXDV9d)OTpwI2Z=UPreJya^HM1hpb%~ zD0=I2qe?_P;OJ ztx3U<7h9A982SiP(MvRPJAPTID;s@sfoL-@QNfP?<^lQzK4TdM7aK1!*627V(?*J3 zQH2pDMxjw_ifrcZ2oL>)XTb`d2dgo^E4_vNrg*{W?Qbl=<;A?a2LY*7iw8T(N}#aJ)noWj`O^X zU~_=m=$H%kY1=NxRDy6(7&^*j5KqlbZlNDitCdseGUA|)^E6%Dv-Ltg_lyMAZM776A?~jty`vGc)4#XCr_MF_70~L3> z^!>TCPMkqZDT#OFhqjj>24aes`)Y`tY|hqv=>&FQziw0?$R)&d!0nNAJrMKBVK0Wp z5px~nwxD$f+kF~+sKoYi^HII97-T<$ZA|+oMT15~IE_()dBsZfqpFylE{>jYLkMQg zw!HTVY^^#SG~9V)W@bL_R_RQyQM^4FSB>ildi#kE9X^Jy115D0KVEfbhz?u&YjeON zq^aR~9?0r>ne=~{_7Yj(W+|F#m1bz(un`GlDY^afx@Dk(KvR^uaUV9hV;F5`UyiEv zhbImFq#aap79Z<`9WBK}fl&vqnBhsE%uBZ($ieuc_#70wt!jC4&;mehJ%h{F*hqPC zsN{?Yt7f9HS)(n<&=^3gp??ypOm`@0VY_maXTeeLG+D~WpaF(Z*W9)g38 zd?J1sCDbMjK?;GydLj-Bks|EfH69!*X)g#(`<-X!)gn0Z?vfq(d|{@$2c$!@dN-j9 z>w^8S>1v5zHw&#MvoBEUOK>QId`g?+EnkFwmHxh=0#3qQ=VoEnyX z$CJ}-5s3_8F!Z(C@|ma^9Y3#On&D)x7U>_tz~#GK9;hVDFT&t(?M3f75$(Y(YqcW{ z-5+Ep603zDE_1O6`T9^`)>qgn{Y2(ZX2dAV%JE^8Rl2nDp$1Ds4 zA(I0RgcDEABJ(8wicAZJJ-SwWuEtf5-Lz#$SGOT0j~F!k>-2WL$GF9WgZ9_Os4%y* zt@0zcE4uu|#2r4i_9;AMCh+xXoe04i3C~8GgY@q9pBAM2S#M(Xg&W$*hfF@_`w8u| zJeILp)`xHAp|_v3S3!7QX+qTWUx@3@bw_1=jItl((R3PD?pYoNK`X_%Bqy!T*yyM} za~NOo=EwpzPC(2BTX`6MoxAHI%kh2#kW|#&!54(N&dbgauuV+k-rkK>Ud`*WylfR3-3DgWb1edob%35QY&Q zsqxS>`kX6p1u2BR-``VBH{@|xqa0oHfr+2VG+*414_d*^ z3r_NhA6@Rnsyo-h&31LG%y@rsUYJu9Qb%a%5sAb_h}%dN*tSwP!YIfrgWBHEI`g7- zyp{lAQam|;b^7cIR#2tHr3NSUZ@D)L8u&NMIjyn18~ z(_>jpp-NFj$ORj*(4Bh8G+c^YB<5iWV@re}##-WC5dFH;0LG>g3m5H6HOsFarxo4$ z@|4@MME7_$K2wvDDC*1N#qJuJgH8wqn`L*L4iOc4SV@h2I#B|7wHsp-qo8lHjI75F zO3}#Qps9^HVO})v2X@U(-M8u!tcY?ziO}?8?H_?Y_AMftc;+~`t`}W^8zBvqW4E#C z>WD7L7~^B(+H=VMeCl}+LL$xWGmjY4=$g!=R-?V)TQ|@B0BLIa)5%ZoId0s#MJ8*a znimxgO0w8@Cc0qB{6nF*oEZJSZbk^M%et~EC=@7sFt7inIGk;DBGo6b516F}L7_vO z8>Ff<-UM6PGGyE1vdOTO=Wle?3?%;!Zu|jOgwUAKv2_NVXD7i)p}!y_aIRQlRSgJgkXHz zGgC)Iv*pk`A#3@?#q5zWu7^&MkB!Sl3OY1#VYn2MLnI96D^{D214r|EM0Iz+lDn%t zH4G75&~P+&Hcdjvb^KE$;Y_gI4R!T!NJJ4Rpt-LwDwx@|Gg=4`!$axR8pDZC7l7w- z&^-qsj2WtDJb409EnMQgAw=6(9GB2V?H!Uc&R>LNxD}aQXS}7aX!0||)@J(zcaTke zR~AO$j+~0@qH8aoRK{>^-M+j6^P>wnOxw`VkYx^*N}?=5JpF7^tZ)6yh!_IX4>86m zXOik{o*7j<7GC3Rqwg^IAy%BeYRs0$a(l7JoRB}Q4}zR;!?oWcKVd^xCF9qn<6yVB z^Jh$ha?a*PzCMhyX{%a^kVUITa*?2xfky9iIo8^9squz}=xj{dR)_A8gGFTz(7Gka z40tF$7mHxBTFr|-j(*osyByz#xh7NjJb}_Qg{5(S*wWhUD4^yNC6025V&n_A6{Oq_ zmIE4b;f#;V=^GsvYsV&+QcEU2KK8e=nb(h;Z-Z&xSsbg>ELv?wY6*=jN!fT!+ef72 z$?EfN`52tI_kGwF* zTElEnxZG3bQMb|Bs;(VW{hF(&x#{!`ZmM+d1*%aGK}`pR z%{d6NbB42tLv++7(K8ETc`e1JF^WqysWRcTd$eBTs#U6Pq#SkNN%6HZv1v__x}Ap? zgjxPxUzkh_J+uLrsIuU)8SjE^xnUQ8Id_A_OqR=6sXVDol4faYv1+H^3dC9r#j{Kn zR%~e|(@?_|t8LY`N}&3KWOArl*n&r8eNn{XI7kXD!Pv+j3mG5l8G1CbuI94(}$AdC@6%xp61OK%&rs$_Q*Le z#z}bz%p8K_5mF}1Pc}tR9ZnNGS49D#xh;;~99FCKof zKH!gKu*E%D${&{_ipxUD|kP{lJPD^oKl_A8!r$yF#*|-t{ z@!3GpT7*Rj-F8|}TI+I7a^NWu9+nMYgkAA9ObMx)9eG&yvsktsl~Gf1!MIZ{b)XA~ z0ZREMR(qI;*v;Ir5ai$|P66q7AY<+xh}T=zA0<2H~D<#SP-0-=<`b7ooy<6DWReiGTcdl@Hhz)9zc zm_IzrvfTGD4J)fo_~zx_`$OtUtgCIn0XH@dVC9f$2^oLGCgV>t!`d{eQRr$e#nJbv zU~>r-;13zqxh;2$lZZN9@irHm5d--OzrcB&V(wIVGS-U%Ibas$Lm9o|j&Nr+pKSjc zux`lomJVIO*z;K;>Xrl(>ldTMBB{=_n4ehC8>}t;cU3jdIzAb$RL5nhne`;1Ydh^W z{qz8U9!Z*DU4i};U!Iz=k;l}H=M|#7R8&-gS-$wltg9!nTNI}Yua2wF_Vgd@&$u^E zSS6&PUs~k4+L%|N!-+D%#!xCX>PGVN2AplW!5-_ZBcUK0X9+BIgW3kZBb+ta;2OOS z@jb_X5-uTOe93|_Q6)eX-#(zK{vPN)5NrBR@i2cm7SyeQLRWOKSpBA(I28b=80CJP2WI3Xb&s$B)4+X?E}X2DM}ZZ2hq{ z8#IoIeso!G2Ld7hO6nT1`ea~Ns%lWMfI~@OCj5@S;kn_9k+6)2p+ zS5{Vzdy{!VKAM-WN=a9mNTX=|+KA%cO|t(ZdU5eDp5t~HEKWBXe$!Iquy{jTyYrp~ z>p}H}pDhUOTPRK|mp%oXOg$c*=CtzGn<2po(Wzy!enUm&l&qYbQ~qGY__AP9`nBj#ozyR_kpoy_&^CA zCP4Mp6!FUbTXy>C8PA=D0wGO+dOqbw{SyKIuc3#FpG^w=`0*jQ!>1x%`QLSij~_4m z<~y{t-TKXU2nZni&3D*^(r?AX{~xp@`e}1EvS8Mt}vhY8Z@lU14&$RB} zlzQ?doU>=&#ucYXm}4MfecNZKCH4uGs~5P}D}}FK;;r19kW+nzQCwAYu>$mEe0z4b zAb`Qf#x=3s6K5wp%GZ>8IJ2+U8tVF|Re|eq}&f!nKb{ym$MC^GxwL?nr;2*8}&bY<)?T58}k3lcaquvBtWSI7bEv!>eoR?GJ@jV zd4kJVU;@bPea!PKuc8txDI@dYDTIv>?)DR#<-c70fB8}D{Lwu+ve$`u^_%GE#5t`n zK?jTdGU$JKy8i{HTPU$b?^hz^r&P7H1}IBjg#Ca&RN%r8>~imv51%Ra&+qEup!2Le zT4zG{edQAFj^K5=b04v?;9k&)C75^8m_wSTW(7;>laS*xc0 z(ZmL|-~E?qpY^-gU$vOy0aLN>!4;T2@|r01J~{N`nLh;2KLbQI0W=_hF-|AK@%G{0 zGfU~}*&8=+o{!VHSwi~cK&$LOJM@443M#+^V#=p~?;T!_tp>KFy&rs5{-1yTi;yB2 zL9*v^DHNZ7@_WYjydgVx9th#zdWV-SX$r+Gzv%*cC(d!yTs}$ui$MN^b9Wzj?g6m- z>j5Y5z?k%Z;=TTRVGn(C;v5?rprUhd-^&N;J^w8uW64tTCLwUZ>dcoCtY>V>Ir#=Q=wwrG|zowy| zqem0He2}8Eb^pvL@YIR!)~pn7I%uP@!ybW8?DcGpBZcG+*aGQ0IN*~$??(Q)QTBsZ zTPAoN9PH6HLZdS4XS6)>+;TL9n38#Qw*Q0vR9~V)cyX%Sq+-vb2aVA*sYP3*7t3{2 z3Xab8BbNAv(PN9PteB#sqAAh`rMeLZIJ1GAPa{X)b;1K+gT5nt20oEDHSf8me(=H< zwIsnO5AUL`6l}2tfPWWJa1d^fBr^zKzkcnxqQ@}y zoE|<>O)<@J$^IO%o64-(;(Vd)^a;=8JjGA}w+Fow?MhT$O;IA94|SBa=(Hm?6+_n+ zUUOTZS*N$O#frSpC>7%PYsU!QzLg8W=`2hqrSJ)G5yy(t9cyu-II4VA4D;Wy`UHe`|3og7V7dSYM zkJgw6x$j%r0+k=yBv&N5ov27SxiccI+npY#=4NBhqUd@i5?#XJnbSGLz$t_gY@Dvo z*<)56$pN!QeYl3T=o?ed7arlhH&X==6molD=T7k|VWg8TIe z`hYB|CQhx2w0_?S96Jp>cm+Y5uYpWZAj!kpcOj-FEg^yV4y(+jxB?lHLvzzON@m-7 zOvF4-#yqddOg_`0J%!k_nnErBcj8oa6=YEtgO!S=8j- zQ8k;&BexCjchyFPCUdJ&4eZNbtP{wG@$xH7IqVQ5J|*PZRLBb4t_B^YX<*Sx$2O*F z{l#UmJ+i-nl@fY3)fhJZD_`kNvhM_lZbU3LzTb7JBu#)2^lr?VSZpl$2GXSGkMjFJ zuDlat-F=Et^rP;`Zp~H5<<#$N@m>i)UHs(wSE!oc13${Mtuy~74?JF@tEp#c!F?=D zy>2rzu%X*qW(RFIS&7%>Fm;2zkOegv0IyDfI!JIceGV6MI9Wmw9lf<237TgMZ5Ljj zh5MxF>y>IOxH1E~fI>Txwxd|wFHxh5bGqC5g<*3TRVs4QO}91Cr~RYQLMSb_#N~U& z)>^5l7BPbba{CI(zK~(NDTzR_OBlHB(wE^I~cEe75Q zphe8LpHZPQ3lp)pc`0{c;1a)y??9m)LEvCizy=TC(&6zg7LSkhA6tqH5hNfFmfP># z6|cKcjAy*sp*nlAX0g<*`(YNT?ibHluNT*j5%GzKM@6|WJ|V8WMnlw8n5wuD?QW&# z+@B*inO@!kiVKw}IgetBM~B&O>WJn|ruIEmxOSW{UYdwNs#Altn9m8+W~KAWOyms( zUez6X#2=y^Lp!O%(ClWu7*+9}bT(1nrwb-Ljk*ygYNM=d7w&2~k2ZNqKTzcPiY7S( zErzHF$XK805Ti|R?#?#fd}){E(*47qx^X*JDW;=xbJ^u7Yjh~dJH;qU&}a$8ZXWZv z3x9o!FAVNMg%$v2LCJZoi%IjvTXN{4ctgZn@4|?VIG;W86(KY7-i*Z3r^vQyMf^9B z{#+K&=X-6hJ=X_HNnzxjuSxq7`#m2tx81dG`t&6T?rkyc{tCLm)k3x`oFSZ1uz|67 z&iYM!B-4W6R?z4|>Mph1Gr*U39i2aHA>umKwqt%=U54rJ32l%>9Y6@G~Uji`BTUm7YWds}qfcwK0~m&j_|pX{gxq!fO0(i|i5ay)B@< zswRRlU8CQ#B~Sx`XU!aPpPY8TlKv3b0N#x$y_my}&R=<{>^V6}h=x_J^Pc>ezq%`< zOLl_AzHP0DrN*n8e7>AQz2_?3wZm1}dJ0)qw#b;pu@!tgFpzoL{! zh8I>So5)-aKU{g(An`$ydVnUkiaf+!U0tWGY~5r-OU#$1$c{Rzu}1fEZp3}mK1yxT zgpMDF$WC-=I(6-aiJ-Y>7zJ1by6hn-*S?K@HF5!J#B4F@a}D=;9U54%56N?d(W-v;tu9^zgv%q_`<0M6I9?_=5{`2W7;DU@EuJc= zM2|WUtxmX;X*;>y0tU3PZd3nO&nP=Eh?K-vtsOaJ1`$0a_ObyRXPq%@d=lE>l4&17 zS`oDr-~ZvU8OSu+i`sPdo5D(?JP0L@Q&0p=Pd8~@@-S{U?CiQYhCsD`?ui4UbU4t% z=ZXPu^j+umIm$w2w=b%PlLzujZ|^I8xhTg-wF9P91XhBkm19_X$zOU5f2v#Q+1ZnJ zA7YpJevgCZ)pxP2g((xG{RW7$gwL8&#;Aric6loH(=Jgx-(h{|xF?eTfC{iNa&|q? ziGuFITZNn?f;_?`harOI8>mz+1HM#Vdh2q3kM07np|G=SNn1pP4zpyry{3O{=Q&zk z4c+V<14tK9vxccy2Vh`WyvgG|9YIUSU}) z_F`6qWzFX-3+v|~z>MSe`}9h7p``wkn1HRE?IbIy-G9Du2PoOA>z9uGuqfyNN94qZ zOz*V|mmLKLr^e;4H9BCJNmEywE*`qO~b~+?!-y!3t?y1G?wZrlFe#~=qgx) zeA*HqNr(kfpjxtQ8hfS(Q%vl)Dm-F5`2!Ll3g-ukI2FKWmA_6{h#eeMs>Ma52Dsr!;fBEhBvDdM3_j^Rw=qm6sRI2RRz6x&eH4G5ltGB;; zB!7oa5J)EFS@#d@fg@QKhi6f<;eND9{6j)2&ZCQNOS;>Lv34$w)$@a4qWmW91-BDT z-ODbaGEtK{u4nqv3iw=_ikH^hwF&qhG^ILyY#Loz$!sa<3rKKXrE(<`k6gBjn%5gI zT2wgBRlM^cR00#2tWaDkjW{dwr-YU!>7XkTHK&PI1l1Gy)44|~I|K*m%!}8{cW&b$ zfo#L8-M3AUJx!8xbE}$*o}|!Wk#ZZM!&ikO(}v8?uVscVao+Jt?+kZ)Xh;6!39;ykX(+lic}-L1wBUo;RwkCuKzcR0 z*o}xxqqC-$%k#+bVR*ykP_84Oer-E9LpWvqGElA)GD$i zqB%wvs&xw90KAWc+CX>&r6&FkHZV{QU7Bmqy%I2&&R)mc zW4Nwe&|vyqnDk~y*80&^f?94mB9XZv%a+SAN(g-|o*<{ykR1o<=7lIiw1g?oi`Kil z;;5{i%*fnT5#R+V6Ad-kJ;Zm3OcJw7vq$7+w_^*e3O2v!*~kr+bZhqQIF#+VN`M*6 zv;c}zV3$X+6JwytTCoMdU@SNbW6UT}M!}hzzxxGF0L^U8gHe0pUGAv7tG>)&{`NMl zxUHpI;!JXkxQ%(Z0{{(YTy{2dBL``FGDl+$6- z5+1t7W3o|90;OWVdqUgE?3SZ#1)*;1o9gMU%>erWW1p5dR~fxhPqOXx*&_8#qlrjv z!-bt2H`T)YCflohqzu{|Xp!zZ&SykX{cLq5dR$CZPapM}7u+mlz_dEN7#s#JYM`Me zZ*&(+DUEfP5(HDZRK>?-K!DLh&IkVGAr_bb**eRD8wtCotIogNhzLL_Rji%NIvT(* zxZ2Wge5JhGylw1*%m^$_jVdd^1&%6vTD8``R>&D8!a{Jy#c)!`c|B#xb%l1>mG-v0 zdiQxJ!5{TA&>#-RICwqe(84avtJz!ny}fsR-5sQWz&G&)9RW@pn;+ud39MalLldX* zMMHHWDZoBks!mSpch)@-0dn3MC8VQR?*yv1Mz$dBO2s+_!dcf3p2 z&V{`U|2OAoH?B5+1IV#yIf@94hq?!sDBP>YM*R3G|H-GZW`xXJI~4)GCT2+CaQ^Mk z4ol3kh!; zX^Oh!nV~O0$fKsKb#|i!$*IxhoO+U>u_@d_z!|hMq%+Mv0Q0S$IJzOs<;d2m6Q0oc z(*|f!IS43{9SRN!d23hVY@fvU;a)l3J`MAYoO(Tgn#I?%nIB1V35mx|r9{8|)u!&AL=NLRVm?7*4%v^u(ue8$p5f5XP(Hj^CJn|Fiqok=bMk`^*oicd9~ z(1Eg7&#=06tbzwwkGj>A!6_4c!&XC;71M!2dzpYWyYo}-R#&e+gT37*I|W&(dvlm0 z#IAJc!9GZ3KQ8-1JelC2mgt_w4z*+J@8sCMrerH&@_XRUYgVRdo2KeA82*s-F`%dh z>5>@z49k4stm$t?tgY^V5IBqm1kv3hzYB6B9h?#C`B^vTQ&=HjBn+jXhyk9%Cf$FA z$|aH5A|Lm~FXUJ|RI-7v-+t2Vxcwzavlfl0&gz&Pxy1F=g_I(d&$TMy6A##A$d;?C zg@a!Q+=opl=lBCZ!|cs>dmqa%A0Cw@GT`i@@x8{qs|xbTNb`r^j}P+i%D~c6=@48j zz`hwP4k~K4?|<1>bkGt24$kr61J~}km4K|7pEh%*{3go&#HnTjl{>|YHJ`Acigm<& z&J(92k5*L|{p;Fy8TGSJI2K?(i0B|${m<|8`aOCIF`LvndHx?i;=ldz32%^dG5`tK z>)M{W|MMyS+avxTzmn`D-OFFj7jvHZP9i@Eum5AXLG`{C9^cjWwEBOX=AR(~+yP`0 z0$S33=N-;*a0Ioa{mwh=W%7UL9rmE~Tko)&3;)e`c>SC4z`+6X`M>cFWal{El~WV$ zml)`n66BEI8JT80x<95$5YYRdGj14h{J2l z_|7=}n*mWC$yX?737I9unc~>Y?vIhbdR2YtQrf=|2!CV2&|^4mZp49-u)3Dpy$3rH z|FKlqcX@Kz*!cL{vGAueq%VHNzJJA&zlF+Vm|A+yw^-b=eSPg<7Wo&5q_Qfqso7b% zDDos3^&fGS|1c8&p?>*}NS0DbLuoHbm^WNO{WqaOVd$p$jmf`EUT^#Yko=8|unGlQ z$H>@X!Mhe9@OzN(lx%A1I@m<{bcXCV(NP^^OKU42BwpLszv&LUghW0im{Itb$#>lU z$`|)C@og1@Js<8RE`Oz--{t7gb2xN#bN~r|O&_2CpTTMPF5O@u@W z2+6qqsc|DUO`BVWp|9bk@6p?RObunFSVHy(9=#NEkl4$n@OC%_o%sxZ!b(OVkKmKN zXFt&Y#OQ4HDy#Hz`>?u|PvP(_BKC{H7#%GsEiE0svc}m}%67F!~(6U z?Bj0iX!2&+qD`}YTH#(?cvl}ZU&p?OKWMP)Hk54={KZ_IaBPh*U~`%8vA{cfg~m7< z;m=%0w%5lW!SGjn*kL>H)6HDL|IsXdk^Gta2@06Y1X$}3=C&oFwFN&JCESvhbp``| zwVCJj)mJ!13DA3wTw@>mQAdF*T$>y>+C?1+4kUzcpU+0(cSdH%u7;Qh|{pvC%PS3q|lpA(^Ik14I zwI*VpFb>VfSypvoB1t= zm>R4TRhC7vRMek!!$IK(-8F;zj7Jx7+DYx=BpaL#k)5FRqkpi>h66lyve0Et6APUEU#JH3q zy9Rb0V-Y~KU5X0(b_Y7Pg0~QF{Qp4gM&9DFx1DN?{DGK9l5Bs%nsWj&_9#RC8dQdE zN|l8u1jC?k7=q7H^d??&X@B81loE%Oh<PZ)h#W z|CLP7w!q;bEOxOvXAE~pPQ^hEy)6_??;!h*Jn$l%;5DX}qH&|=YvI5#EAZyI(Bx*p&-t7?t2;t@V^i^)p6GQd(Ao2>HwWm$nJfWePu1+Tr|D4+PfI$ zR>LhUER0T*ggruBHOM?BG5;fN_sx2Aqz8~dh;DpzIk^2gbPDiq#FSWq+YcK0hUMlg ztgME{?E4}(-_Y_4R2uXZ{u%;7xJE{`mIUU?h`G)5XFDu_~UJF)3ZP!*AD$AHh2qc zA;1PV!-aozH~uFb?-Psvk97Gjy$5xUq>hfx4DGs_;(o&Yg%{w;-*Y>u zT#x0u{m{j~PE3$cKPiiMRh*=5viXs^`lUc}9LB@lE?JWL;}?Qu-~D}6V&l)eJs&S- z{DvNGv-+UWa`;xERXpoJiHjf@a%A*IK)DE?#8DQ9&M7#8NB>&5guAwSsjG3gpu@uL z!pw$$NnZzlF1iR@u&8F~SorXn+FK3?kI52PKf|9m@h6_$YX;K+Pq_0)C*REwHFGj< zKWAbk^h<%gYrU0&kdfO5o27}m9E0XTRK*U9YKSoh)R2WF4#H!2ZXfUtp8g-b)62vS z3_T(S;b1UdXOQTK9q=z6<5xwJ+I+L+|IuTAu2zO*aDirPOE|t()Y=|cSi~h-hY|_- z14?y=al$WDYF`!duezu{#njwfWF!>gPcJ4L!l_L^>n4ItG*;7+*?9l@#Kt{#KtRUU zhqvvjbq+ET$+sua3zn=G*ux1~NYOIcxU_t8#`QcM58*{)cFXP7H z38{*F^9%X#D^#f8mL&jK9!``NhRUHk&lU9!gP|@I&kC5E&sX=it^Gl>FU9zav}88r zlxc|x&Z74X3GBoIr3?2soo-#8{MCl8_FX6%U3yXY5K6n76L_}2oI1b*xk<536z;ad zQ@@tOznH!Ds5Mj*2Zizn|B%YrzUP|%6Fcg^5l$#R_y-gYisg#5(eE)7L3Y<$0kwD(uTXYZ(ia=Shyd~Aj{<@Y3dy%}3NI?lFOoVI-` z@a%%_Vxs85%_d*$A1sQZQ)*G)d|cwP}%Zp zur8_rEiLsjuFo=ioU~6KEuB89S>VhcCE_ApJqebkw69IKxApRywAH+r)%lAEad3Fo zKRXUL0apIwZRf-7_aJC;n1@~BSyh12{B zMAnJhhbyITJD?%9lT8D(;)vM%qVu;4+dhZ!wfE+jv~AnXwq+aN_9~u*p-?f^h*z8R zD`24dyVRy8CV%&62Vj;+(1}}TFHl+x6e@4xuO;bc{3`p48;W!P^Z>x0E%&Mq!K;?IUs>*%K(_~1%vr(d%!$S_I9=9Gb@zHOjbI4D)S zq;oA6iC9c*2uVBP?t++;V{qTO8P0E_(ynhtt35PQEmw^^<5z4|G8u-qt=wldUat&= zR60bRiMD~_A3`r6wWj|++TJ^?$#qK~RzS(#N)r^MsURX<1?kNKs3@TH8WaKPy+aU1 zkZz+$3rLj~T0$o%O?nNXN5BwT5+Fbzp?ojr%$(W3GiT5B%^uEwTqtjO-sf56UiVt} z@K;H-ezQ5evhV7(aO%`U7Og55OvuJQm6&_BEAb|;fhnx_E0f1nOZ3JfJV;{jd*&UD zlW%t7$;eCet^Y#v@-LpDD^Y*TY*R&J((>_&K3k6FLx)8Ql!)OH!Wh7qo1ULpSgiRB zIS5yQpC&ofC)UaB63M~a9!rGA{^~AyAh5YotV(z6V6iXwk)U?EGv_?o*NSDIJZ1}K z`v!@j7NJk2DtqK2E}dxu)QMA+cUSi|mU<1{uWc=jE1&v{PyOGG-IZD(f7VF8F~BAF zeu6#Xt&)<`>ttWTWKAW|b9`&U2{6q~ciF3hsNNJ3c;A5C;_Oq+<&on1B8ElxfU*Bt z4Gj&8>sXP+Kp!7KVaeM~Q|%oJ2hQbDu+TEK7*`x{(WM?b@od#@yWs6P@E{<3u^emK z=xAqB1u+LwOf7)P4XI7NlPY0en_6O4V**U4pW$B|-&|hIx)7u@Ve?cq19|Wm5;s}k zG>UN297lL*mhm%3vxyHfeAb-mI9C$iWSa%ZvW+Z}94C9n-EZ8i&}fEoYe(uZFt z$&m(7RxUh6I!vo6z{LF2*$Pn)TyEv_j@infiIL%;nP-&QDA<$W;NUWa+xvhbT*^p^ zxj8R^L?5yp%N-J7ZCvI3sAl2g|2nMx?;rYaziG;5o+4L8%ym zG`zVk&BhH>6X==7 zWf&(=9 z2|_q1Rxa;EZA~@=ROx$Yz=K4Om%8owj*LI%RrGy#XeSE_)a8klg&1{|Ed3uG(O+{b z|M6Ff`XO(jDeHQ$ZEo|G>4tzsLYe|x!KB7szbtTP9Xne=-QB5N3U`9P<~--`?>`6# zxknbCnwPjYfpF0V?3k8d>;>%xIlaQuT1zV{4=Zrp_qn7U?|I;Qo${?MH>3JgwB=~7 zJz7luFb%<_@pa>Y*{zETVnH#&Sq5uwpj~W|waEvG(M|EO%%PWRJqu)mgzV>%U=C%rcbwNYjOZ6qraa(X%J(GCesw zNCWUJ$lA@zn^B2e)Xv-U(z{bB(OC?-}$W?jCcAlyN1)d`AM_~n}!D;a4=Ila*5L7 zAXWrkoBME4c)mu)B3KMFw`+qMc8c=zCN|Q3t)t$aqCO`~%Izq@1&TZ7^2U4%3$x1y zV;h+;dw$#&9mMMCX;ZlBNOhI3OXJp3?=Fv}7PjDAyXMc;_gU})E3^Hp^eNt6UMK|I zOj1|AbpfK#7)CpA@+ibabUOzuF98QBM64vw@?0v zX>E=d^xJ=yzQ00}h}3NHX(LYuDe%a9UgnVx%qG-~)%#hcyMWJ^2rV8u)O6a}0M)(B zgPj!2h_ok`SjrMTYBa0-tP$qla(zHz22jG9cv2r_65ocCn}@j|C*q%#h$0hP0`~|C zE;;djv5tz6xvK30P97^0U@lSQI*9T%jr3%nyUB1<8uW~sxLm$Um`yqCKP;C&;?Rl20 zn_$G4;u@jax}M&(hw8gS&y<^`5z96c5QC5K|H33;lb5O!-)wp^T=V8Kb&tA*IzijE z`Go+ARfN9YX)WFK&_s#0Oy#}@n z@Gj)dEABxomF&k|t^JmZxfMS(kEol>|0?|g3@~R4Z{IdeqaDwc>1F^!HXl*M>94ku zP_iYnslJWcX`Oxckl)0N%YFNEtfrCvn|Y?O9z`-ss$S6>}UzFFwO zY_{C=gH=#FCwP}M#OEo}_T2c35}7b1@hSy48SiOP=h*tRYmjTCLKyOXoj0+^YER1< zFkEMjYqPj>pd(Aa+swSwh~t4N9f+)RpG9+NM%YrdgZE9{imRQy#6hHMvCMUaV}iGt zxY{9B3R{E;D0G1I#t*L4YW5koRh{Q0S5%6s=iPkcvSFI4>!dx*?x9O36sBGH?pu(Y zuLR}F_W@}~qs0B~JY;T)-)a5j-$@{w=&hD5P`IQ1vuL#xzL(|WxVQ-qWHlyf;yX-! z+MvW}x)Si$)O@M=ag_tCi&_%+=C;&UYeOqH=iIfny?ZpL<`k`0Xu!cFb0^259*=v` zb?*~E$BR$W^mY>Q_V?_((x=u3=W{Wv{MQI^!MmFKyl!^=b&~0G98B%8X;<4`&~@Ha zZnrjtZtN^~U_9phB5>I-36#AlfRH(EJKn6_Ahc_rKrGH#hG5Sq1vI zoII%StcB~1RrFkaifQ(=JlL;&`33a*%1ROO3+RV}=ZlM;h2CXhZ7 zr|0-5)R|02TaSxR;4QLosvT`j4Yc%(XTLe3thf^SLF)?xA!TUC#%SB+E?A?pA{+s^ zOfRq2WN8JcN7_#*vP*PnEAQ1?r|j=^*e-T|rUXREb3u`yR}`v>ve4~nPS{xNCMc0I zMLf_uWhJ&8ZCf=U`>JSm)P6zFFL0;E>2>*Fhz}Aur&UmU2~e|(G~=_z z!d-2TxH?-|g4#R|RQ9RC!}H&ZO~IT4e%M>+67#;fnG0|?3+K3bwJUW(lqp{zbYYXym>Ip~x&h>NoF!B2n0 z9KRFH6g78Lg{Y7YforlIj_&Y-&y`y?+S=x$U7h-c_IRW6=XPQs!eEZ3-CXV?c+ed& zJ=%F`tVaUO=n(W1;{vE14YIPq}HuXS=Q z61S)Lk^~;mS*WQ_g)wkNZoc2OU7KwcB8YXybBk^aYWBP~<738c6`R6^4NJ_7O?ek@ zhpMH?x_u$6_U!m~tp~+l5@IRwkqzfg$b2lQ#VrxIq*YLKH^V&iiPKoQfLQOP=hhKF zo0j0QxQyC`aQnrMpx~|U&*QoIwi8=;J3s;g?o_p|M4YO~lUCaohA@UVn(GIvZ70I@0zVN;zpLf zri0C6tqNyemAUjJ-+V)ko@~787R-`rbdpv*-%3`^(#rTt`Vc@k6lL+=ezKJ=<6=>a z;bS8K5}~b^++40RTCIrmsb>h%%OzM3e0c+h2v;d}*oJ=Rkym8yJb&pSv61R+QWj`j zJPsP5w5zBT#uO?AY~?U4qfuKj;)=ejvaSxOg80Q^88EEJjb#w<_}J~}jB1dd{b{>H z6k$B&&dIJbqz*0^G8ssSbx)C^j^)9SJ0<6wYkY`5rPZzt=V;O%hXMe^0|lS@4++?S zFdLdJKU2eH{0BNkmShL3X;JOeiU8x@tzAt)+PMzLB0EQsow$ zU;bvByCUnFaRP|WtjgIbSu()8OsMTnx7(WNT{-WSyXhim9C>;2nbN+bMIU&WCnUfH zxu)-EIv*9&cWG^R|fexHzwj* zY;sQfM(;QPz(6ZE8+o-g5saE2S`YBr5jQ?)riwJy1w)~0NfKXL;7s$xA{b$EVC4zo zsK`4HZ-@LyT}TbZL*^eT2N2AP8Cdkr&0MiI*8hzhb?hDJfa}p%jfbtt``5%T9-ZYE z!#i5G?1h@g3MM!c4PnN*p(ASBj{#g04@ZNwSttexpmLGsN1aZ0f`G)i7NPL!0pG6@ z;|S&&`v})>0|_@)#d<|P5J*ITgg_RBLVM zZ~CJ>-f3Ieai3D~X*2if-o8Le0C+OeZl4 z#Kx3dt(0?xYH~?;_zDFGRr0yB%6w);<1W{EznDLM7HvSRFiFJb@$2v`Tf6Gjl>{op zg)a_Wh)d+4RoUCls=bD+){2h15VQ@!f4Cm3t~0D7@SQx}_3b4}&UxnhiA9_W_5PGm z-MeOfE={_|cq^H7gc6?)(WzlM~BY%b}m8Cm){)5)4w>wpdEZpI7TmJ41ZL386p zJUC1lX`;@ASh8@Ew@h6=g`YkCI?hS_ za)H0x`fc$oVQ;FY1G7MF1p(fP;`c8c{K~53=OPNuzg&WYgYhUnj#87pO2zQIrB6A4 zJFXvg1sZRQAJ6+OtZ;nR(YBfwS1QYOm{*nO@7r}W*&Yc6sB(q)EH7A>vI>*;@YoY zw`DqerB)8CFu%SY#EOpcG1zeyfwA_vo}V`yPN8+=_e5~|j(b>Llqy&3JF3=-re9~@ znk9v>rF8^c(1v4Kj(OpiP~$ffZ-x%5W$1>o#piJD8#+5|p1&kUS_fC$P@qpJGOsE@ zhiNvJl3XLxGBQ&$|!8OWq*QUQ?v)| zM{Xdy`wnxdjanE$!4dUtL%Dq1 zs|{pK-z5VFhY2yopb$`@sAjhnUep0yq;-HtA0#&ul*PaAJ`x3W zWUfM|gzL2_mH}Y!_zbG4a+G6^#N7Ov_@A=?#^KBGJpd?s2+Z;-E;eKz`GwGswFtFs z1=Hc;u|TOr&Af~kA3=?(sWOgO{Zk{Xw5~yZDd)s>MBQB4NPf0seIQrzYgPS&)fa+7g^)k@$s=ImA2(g(Jkj=Rr6B1p}I=bD!md z{C`fic|3~^oZCcm%2b)f?F8Xs6Y24Bc#(CVobtO3T+&j|WrJc9W8Q=?|0)z?`Tq&o z{X@COs--?LId_~X1eNVxgP=uEdiGl=;hup`)gGNqmY$_4jM>+T8d2{sNf&Gd> zT_Wwejsg9Apc`92^jKl-Yq1jdu39sZmp*>l9#khE+*r32*v1j)N9~_+0_4uL^yKnW zP%z>lIzhk&rCe?15@UiSJ~aZX<&dMoP3?ah1=-Xwlmb!iBpM#O-PnUR}*n z>8h!!s*>rGiz8l|&$BOGKopyrjIb(5J59dZB20m0cnbxA9cnc#ikrR@9{0;`)+T_*`Ix7oX(Y*gH@1i3#40?4l6^DcA{(@ z@`=LMb>o{mKfg8C>R=6?La>|Xus;_-=f!Z@L$pBLlw6(gdXO z=g$~5YrC`3oYZiNxM4c+h(H5XOZVRu14jk>T`J9e_9tt`g;-VxM4Rla8Fxg0?vm#M zw~uL@Nibxf=9_1iGe6~H8Pp4_jX$m$f5$!wFpGs^RVHt@61_eh_b!fgnzU$W2mP$| z#+#TVHS2W_PAM^q1I4iTc_!8`hUtcT_2$3PMfX>EpIB}QV$%O!y|K`@C!-g!`ZYx^ zY1xJ`HgXlY8tuW)?UF4JXmX#!Ya*Bak zyBatKbEj`s7Y`V+B(WZMdi;d|LsEo$euS8^)K**#zuen%{KcIqAGa?DiZ??5F+bG& z>$b9ff_jUj`{oi{(Zx(#$uIiuv3dN2kG;ply%L#84@HkQ)gOad`xKmPI=cMsJrl*( zRzeN&8BNvUKoa5n!+!R>kmk*nlF6;hP_pn$I130Jd&9+IIb$F{SY5!fgtKLIWqfVA zHlg`0%)B9;uY1)Eis>a`_iVzeCZ)|%YHQ_5vi^z(1`~&1eXTsZ7^g27h2MTEFrUl8 z6@!a!M^q5`tBX(jM@t{+pTLqqp)jy$byB%Yov|GR|C9}L!CGkmL)pu32cPq=yK^zSiuFFv^W zPU!n|ERTZpN<2S@Q?)7*q{?-FR3jAr>5?7U%>c8QS!({fKcCqJoE*7+8xl38a;C6ncod8panUa~y%A*_tC zWxhd4OV^FOMZ_q=Y<0X)%&_+xetOJgFhi}dNO2f#8$vTtJibnS!%rdZO=}c8I(7;X z6hPUpBR=tRoa(t0gPWC5VZA<$!>*=zEsva?35K(ZDYAz6wmDBO2$clkdR29v*KxA; z^}OfT7+PZ$j9P6JEGFMip93+8cDa6giFNByE_~{Fy;mEmJhW1pI}!GKioO4LX0B!g zXUX}e$@r^x-sr|u?t9?s4*439t8MSoC5PRt@MMMfm!tXouS~;5)*e>=zTsetaha$U zFt7I&GOtkNJMA<|Inzc{!ljmiHwgG!-@sp&`>3us&IWcKTix zk^WjxIfa5H|MlGlpa@j!F}}Bp(pT;kLFwSO8?Obub)7300t$Hd0P=va!QA;Le^T=O z--e^|Smm5M$9AG5_ti0z#p<2FNn>ce1D4yto;J`X4BWT(IvMS zYUgGwx4m9M=8|xn-L6@gyS2RkuX|-Xz)&i+3_UZMR|N&Pd;q?Pv!d7CN4Kg}z@wx%2B~PCyD9q)sFvTj9o%yPPx`n%j z%wjO5H?ZoByg2AdER^cW9bTHy|WCKlWIU=Dt@t2_|YN_`OSzWubqM?;Yv6G$?b z4=zz?AWu*5|9(t-V#&jk2KBBF^rkL=YyrvBzF;n3B};kQtl(a$-$L%T|D4|khR56y zGeqh}dujn{jpZ9;6=C+EBkLCCFbw%on{=bZ(6?6@+0VQnlRUAk9IRYyT!+94@iR!) zetaF*c_zfJ_yOHzwfsrIfiZH5YTl&FnUtQym0NcWmSt%~T||Ox>yqy@os%&BFl*6u z#)+eZ2U`{cMN#Vlh!%4M+j8FHVJ!Vd37~9~YS*VGrIxpnC4HPDFJ|2Eo$r!BK4fy| z==V)n9HMViy?M6`bu$ZU5(8gkm|H{{f}Qjq4dE+n`gkjq0{Mz0_5tnfLw-;)-)sUMZQxgH-0@QW>DPHfVoP9o@7V17rhNmBBn2?R)fGj&eCkgXK z?NpR9xZKw*S;oa#7`H8fq+Cf;3UDq;1khDUTLwCVSSeY2FLOx4+yI$Nx=3@49j$~3 zy7V_2&_P7eGo5@j-isq%I@reL3DF#jUt)eaNB{TrL;{ zJc$@qn6dVGuR~iM-A=;w6q-N#q7)1di+PsGd4p>PvS!#QXrk{iM~N9P`Kr6eniux; zh|IsLrP&F-1C8-kPz1ka9%mBbGCf-VPG+*c$KqhlxE#B<8OM!&iC$z1?7G#w>Vi&% zeBp5*8`5_1z6TT|hxnd5=etw4@Z*FsI!fy?lXuN4CD?a}t5b3>uF~wyHg=Tk9Pyt(b9c$MfH;aJ^}od0Od3Z{D>^^7Xrbn%t)0QYv*U32atZJ4>blh5)R< zvc(W!9)ZnYU_J@O(Ney=ib@nmFMa;lu1cr>$mM#l(h3(yqA+cE{*7_GYnA=Ir56&c z#Fr^D^fb!s5++jP!sFh78&l2Uari?Q@`^NWu)`rN@8f)N^yY0XmENG~r8Ljr)YsZs zI~5+I_VBw#7IY5~!fV`FA|5G;Ffcj0yG@{0O&2SE$6=&x265Bh4C%(tAk%J97^uNjIOU2j{}+w_|9gLM7)hvRss1YS zl6J0~Hv2g_RsrWZUS+*JQt7-$xpXjs+p~_i)&x4iU686AX$!|nB*$T8fA!HJ0!fQh3sftdY`X78N-_cDsd#a_UfJ8Vju zzPaH2@&tDab%E(9pE@T9gApe|tj(|p6{e6)0eL(E1hNT(%HBxSIrg@F&yIIXM zzp>O=IVCUqg&H!Ta%+b!QEJ6}mZT-VvcG87-Pat0N#eSo$N_Eo{^k@tjTsZ}Sb64y z%B*_mw&?3);qtbX)RKMX4NhFKc}1-?V5g8kpdA?P5V7M#*|38~_Z`?HGvg z9gevsYfV#nZ${(yX-CCspliE$?cMavu#ezuU2$-uS=|)CuR9m=9L^wij?Yo-yIJQG zh7+Py`YQbIN;ty|r`SU@!CM%4~#_GuTHz7 z&oAyTblC@M!77W(Vs!<>8Pn|)Aw|pA8Ey32zSVI58WrXiX~Pt+Na=kIyV|By$r<-p z!-p||3Q(m6^Pqtr0A7-=&&mM5#-J?}lH9mMS=QrWjX?vN=H7Exmiu&mZlb+M-pE7N zTG5NUJDGR(o;}>#kq9mfkoKuBZ}4VkIb$5;Y}1|ecmiEr8hr4r?a^F0Z{I^WPrw$T z?`dFMvPEHDo?y^kPu1e+8fz=~W~ys5#S8Ai_tq6nP=ar^y#a0S?p@eV-6zQ)A0erG z7lsC`ikok8_3?C2!Wd|emtQ|flO2$sl%&Axp&#YCOHYHjJG|8WyFUr(I)wNB_-0nz zIp%?bK6q|J^I*9OsTsUG1l9#d z=?np)7b7gnF-@bjry4Cq3Jr@NdWg)grJiP|IUlsXm6&;jocL4Fss5dty7|-Qin)yQ5{?vL1B^-fscA zd5obFDDP<3r$D6;&R=-kmEWr%ZSwiky)XuN@navlmYZRlZ~7V^yt7O#{c?szw=jd@ z6zW(lzg#6@AnV&DOBNgUnP}}o$FW*C;R#Cy`%K*RX`q1Tajdts(w0o%UiJDysJ0PV z9$^Z7)!Gn5?U50B1p^o~sXPk)m80D4t=D5REwR2aRw*%i3+>lLHGy%G=1FEXQ@A14 zw|+klD{JQ0C|f{z`2jR&-5^Or0V>Y9=-AIU7bc<>u*o*RQ+dpIko|46vBblJzE%*!k{l0>TCPPLY=1W4L67 zN17e5ks$#w%nj9XZLUqOyEs88YQ6-t8(BMHY+y|~FGmL#1zeqo3OEir;BFeI{&F(s zfhrylvoEZhKyc%Qx(2e^Pd1>RVLn&j1{1*$b6#lzRKf*gAfwHr=qtO2Cmx7?XMzC) z`(Es7CkK=z_FRy(o}D2^qxAWXR@C)1d=-YF*0DPW`fE*Bj71bs5@?E34upwEOSQR$ zid$5>mJz-WxUf9jK|-ih&&)Hj?8HjYeV#{tJ6I>ULmNl*GLWx2>6`^Bx5X#kwr#&% zGu`8rVSyrV$y|TM06d8a>232|(C~zUY|=JB^xdHnP$n@^=fsLmDU{$#|5|SSFaFAs zn~u-nd8h0!byDAtu%h}yFQW&l65K+r7N+kqucOF5zx)bU0n zPjWn;qWG(4d^)9^;!;ZC(#1d_YHc`o`4G!<+XcK?ItUcvC-F&ch}-jVN?`-&tx~v;)_& z*`6iZNoKp`_xLbWSKj;ekx%LhMdTF+|JAb7*gGKG?D_vzNsIk8Rw1cgPnuDD}DDXbVDPQc~2>6@6{Lscp0s zkx4~UWog9qagOK44eAOM$j-X88nfy7uz>mQ8c%|m50G#{OsXw!)uy#u)BVtgRsqq| zS*ybFb6t4$x5V>n4};QaA9dkmrh}o7Ew!~qAd|L-uy3J*@`O!UtoHIQ1WUbWyh^U3 zM3Z+APNst)v~kchP(XBlhnyd^-p?b-!MtZCXzjFqmxvswl+s|!ryPvhiuIIhG;M9b zPx)lX3N!}n&cp?a&sUDJ@44@+$D3TW;bvnbB4xIfqy`=2k4%NG>BR{O^+L|teI+g@ z%`2;GEMHhd{H=}apWm;M{nEE1_b!jK+#P6I$i;a*T719~4U}1HB2^I%axcH0{tyww zlDj#+3`-1$?@sOxsv7Bq{xq*~&)F^vYr1PW5SykDbuBaDY>cG_9l8Y!ujKEB6-kU6 zojlWqSiKr3ZXrr@rcfCG?lb|)w3xON)s{|39crLiiCxEbsr7@;*Rp-{V;SG9>;xKF zBB`;;PWoTsrhQ30pG+=1Nv)NpUoP(5)bE<&7CvirHT_N7H6%*zSc$y%Ts`Q$<4QQF zus*q2tPi)^4*Uy-rb$Mg*@l5w%!`j zl$y@7^YiRZF{`zC`h2G)cCCuw!fUm-pE&x01JF zU*eQkpDEoj$VL`Zn0-Q!6PwZd2CI6h#=g1FjXuQv49kY>z48SYq{2J8&kfFIlZE5lum&Kbf-i#)<15EP6 zo&i6nd|W_iqSuj$+lH{5x@*%tq{+?YR&iw{1nqvz7%p`(QJ)MqiDhomlnWGpVD-*; zGnIi$=G-^m_P7hMQ!gW}_%^P7Uy^nn*JIz+RYKO*zZm!;wG2lO?gvqmPxf|0RaDd# zz*fv)V+~uN5(;c|pca{@E2upZ>triyO2?!2c4n-?c4$n}HhH>lnA@{jI=sKwsHS`* z%v;nG>tLw4(G1|VgAtP&EDsGC0CX1Xk20Em;U;$l%IF{1Hg1oyImgI`cP^~WX4s^s(=fE})cG>37&MU*b?ztE=B zY4df~*PuIigQ}lYwtn_ok$Igwy{?!hJrl21yLKu!+b@pdm^HSij)y!QzN^Lhiz_Qv zZ~yQnjwQxo-<8|+^%Urfc)b0|wHOyn(PVt#Z>CF^X3+KNajzz}CZ-Quqm)iOWTJR( zuMT)FtiIm>@E>(S!y$wypJyp)WiGwnQY^c}SL<3sz}5~^^ChO>*59E8XsHqRs;tXHu0X#mqMa><+?iwJIegr7%{ zt7(Pw*oZ|4hXlZ{IY`j@<+u7XlV2_0u0o_cT}i>IVNBc@w;_E_ko<+537p7Se#3dhjYc2Vh6&|VmkdCjtB>m3z6@ZT+6=?`8tEA zYO)sV&$Y*GS*ZK(-ivc^tnfObX6g`}#zpradBSvn&aYp0Ycb7@`<|3t6x(|+%+dJf zC8883m(w1gAadn7RedPm0bO!7B*0CJjtOws^zfm8fB;=>ZS6?c9FSH@8g1~G<}hLC zE(r>sA~upOgzsblg zTNU)zinlcKBk?BF7b(fOc8-tOZBEbI9~rE9SZ>JPjBDTsf819gu0mOD_<~GFZTpRo zRg#x6eL?{;E?c=tDPM?Ir@PZ+s*PvRyyYWMZb^3Hw!EN7+82=DS}PEF!UCn#P?6Fk2hi#cavZe=8aFHp(o@-rCzB5)?7NbHhtuNFolHq9a%ly#;`oJ3`5HQ z%9$7-1Jh07+O;9Q@{#0&?%DI#H5l$6==rE$XqEIL*)Z1i#BHo3ogx9!az3*!IJx_@ zv>Pp4%p{aLF_QDyemiyQbhELQ58H4sR0A+11_o-6CEp8#zO`&lg0*w1k1xq1jw(TW z_%P&P7Y_|{91Y&3u-_rLOxBQBYxsOz@SSRM^j}Hg4-2@(o^;(@{?QdnTj0h*S*15V zna#>S-(7@0EZ%x+Wrp@1@HJQ*&mT`*%LCqZAq(`KNBne^d2yVrt=+De@r`+5!9kMD ze9HDr%X!J%yz`O?Ics~lJK4pa|228=|26}oDe5vX98aR3sJ67aR*MGW{oHV-3nK+! zpibj7_I>-*WHm&IN7nVCT0WRg$7u>tj8$V=!GNnIZbJ?ky7eF$pe}PC8n|w})I<6; zU?n)%7rf;b+23qq-IpHJnrcD_Fqv_}ZU!D%_2RJS^cVBO($bj)8M#{fS@`-ms?e@; z`0H1oG~l_ry=FoSz|TpvA96=V#G;X^+ZsvWPhE);dDGL=l>i1UK7tb=!j@`mfELI(CQa8p66$XKzZZP`1 zWF-FZd;_t34p3t|x4Z^DFSqU4@u3y&b#%SAhZVaFw!aMwFnqSnUGuj_X`m&LK8<me^34I69|E|_-mN(v5?2V1G5Nn zdLO6HxzflnFFw(I14@X>ki{Xht^qoQPakHS;*4x*VnOC zhc$}6il#mY<>TR*xmCsCVLcZp2Yj~;mjg;yrSIC8TkR8n`N96>iFptrgniYQC&7H& z5jX_m;)=x#w|q4d#WeSVg4BZ2(&iFT9LL=Uw)Xe;hYtx4y=f^U#b9Xe!|SQ(`&az~ zTS2&hxgMEAZzT`(djmXW1OL^Zx5^|b);0v#A#M!x_2<^eWj{D<|Bku}Ok!R;sPMVq z`hg8g)8yb2_c8in#^uMCanUa?%Dw&-_+01HMVeP37eA=cb;zYKcieJk{2;e+KjEVB zAWPiD6dFw2bR@5=Oi!ErB7o}~zLu0|9W0*5z>r^IgJ+^7lIK%=2phvgec1qEN+xK% zLvZXM-HY)6Qz0~znD_aL_N+{osHArE-IC9L@$>%6RaC#7(GXiK?J!RTn`k5ex7 z4-O`qPzSWxk0_q`=hx1-+&?ay368k)55c&Ur!gp@>^wP<%0zozRS!1mH{y@RU1?T z0_s8`n^zP5O*aUpGocRMzwqxmZ>AYJIRf_=(D=;%7}fj#Y=Hk-%71;F{(t;uia`JP z;gLpWd;a&KyMNss{^5B9LJ|@#XM#KaZ8k&Ga^qL&fnE`kL0QUXcMj;ZqqX3`0H|D+mg?7lEdz`4_ zlb?nyrqno30ApC*pK9^Z2n=uWxgVJK3nRu_6VY|lZ_Ui%7c%l5^PJn|z2Ih-yQ_8H zb?OROTUYC|0QQih)~_A1-TRgps~BRp%Zd>?vOzBYScZ@fs+#FV1;hOr;{yZfjXJ;W znS_D$-@g?}z@?H*?P?cu9bEkmy_3$_x5UWp-XBQKa)}SK0p;7yU$+oMMQ13ctrFw*w(?pzH8qm%_~7_Q)(#N2lKZmuH9~-KXVS(p#bQ& zw$(N@h0qQ?|M)09H_drmYEw^l9&^5UjI0iPLh}8!v>PMZ-N%pI$hR?t{Af+Y&2iOa z2Lgjyn*kf(oi^7Fk6sX!SE$pf%*nZ_*@8+RKUs;*r!7Io<`^-i2;6Mx4P2eW0Lz=pA{GKoRPH zk8R{){(8)`{Fjd(W6=}7A_&2%$Y)ur9`#vpG17xr8~Mq^RN;x~Wzur@2a0u%+B&if z@`3T*%O+W%ZW77o26lKqETMU9d}KU1$dGNh@fg^D&TR0=*ZGQNh$xT#^KAPoBKi&q zXkpC-L$R_fQFe>;(=Y`;3wU3(h47ip)*Wl~yF7l!&(Brudv36`)%M<7Vn1ko^UF}O zq;GWXH)f7Hnr7B5YjBL1-+JSA$%`J=T`vLBGNm(`7`3(;;Jo55$N7)LaWp?z&azxx zA8S2pJ62FDQLl%0UTHYzS9J2%1TKR3%uwuWaq&$C2jV>_BTvE=>fq%D7bQk?O9VUU zv5SLKSAs%$i}-MHA*fYz@)qZdD@$KXPw=455@GrW!Ij372jxvFw*b@Xq1d#Bwt5ejiL zR(pah2{lVIkEo5j4B0sm4=Zp10mJ>0bWW7JRF@odAth&p3o$&bOI~&2M;#M|Ow;k9 zEk1=96B>T#qbj5vR|blUi^Z%1-kv!RE6?^de$~_=cp*u-^9-e7j}UIR^cCp8{z&mk z3pV^vGGqARiG#P2u{$sXG$g_-BZpd-aqky9pLv9;pgULMe=6PnCFk}p!mK3F3FVy? zk|Nr|%>UPPl&Ah$;vUyQwBF*viwo)f65b!MNQaL76weR$2Y-Fk`k=hOLE7kaAm$p| zCVSUwEwLM#UB(p%taN_ZIqSqP@I?|ZBA--ot1aoR?KJ+os)ck}_cnzBpUQgrx< zYnETf=Rv(Y0kixu=RQ5-yQ?sX$IC}<&<-zXS?`1tq}hlFo1INWPn&Q@suLB}4Y_T6Z%LMAw21SYAugr1&$9|mXAyrUBL z8j`Hs^?@3%sX{iNzWWDFj-xRRe|MkJULm4A7CC`JnzJ&%^5lkmJbjOL{N!^W6v_@X ze%3fL6R~ANN$HW8aIm%2;M7@B^6r0cd$PNn)*F#?yg1FSKT#TPV>8sTo}8q_!*2BkX{lt zF8|xi;Qw>@``;}@v|C86XdpZ_&^Sk+e6iI5FbbOU=mab(DjTwv3~vQr-dq-LbvWp& z1^|(+(Zu+YY)ETZ+1$N(^k)4L>U z+s9`P?y4QRh5fs8nY(A{dj&Zov2*`!Y{QRY_KvOEGdpVVg@M2u$l2dTe%o8W!=Pem zn@|Ij)mdKk_@RBdP)6%lV%0h7=6|Vg9cg6V_C@u5zJ$W_U#o@OHL3M5Gngmm*Ec^- zjq+!L%ff-x!)|mvxV#mGCJcQwjgB{7w7|euz(?)g|HJq+f}+#!LRwKk%Dn{~3VD>^ zI^cxZ9o8QPKmIq&vp+nUO}@hYAE1VY&J6k{MOqhulrAsUQQcCJ5sCb-@aEe+&l94`fm^4ln<(Wet+9U!`NVyz5b^w+;s0$bex;eTK;Xwl4Zrem%d&Hm5%TT|Sp}?y*eP5F^<#>^-JK688 zW<2J%KW73oh4S_DFbRVPMx!*nE`Svab{X^ky!LyAErj5!vlH3&P|<$0bgPk-;suTV zskejI`E!urp(0IM4qbrNl^16dW}mS3@n9eP`9_F2(dKCOK(U~#*5J=qu7&@a&Fo__ zF|ion{wMM|1=qSvMGA#avGxVb{twq?%~sV!>sw1SJLD9KzB0&?D1%n(MHv1$=zs0; zZ_#PhpL~b!dg;~}{ps_l-nU$7$tn+oe6?P{;p3wNV_xY^-QN{9*YycloYepGmo>KZ zz5SoF0O%U4X;@SXQiBZdz{TXF{hz3~ef_=i#Gl@@sYT%0x!EVPk6F=T*gr~`|5L1g zHl&O>E^^Mx=GNEaSXzxcH7&DwP=-f$lqpgGx4VC1r*z9P%bm%KhP6ty?^_gWRe0gQ z{*)oVJ-isetlaSuAvKmwJEW)kF!{>fU=y39x>tO!qVw?JlupqCy0BUgndHf*!@hv{Y2o3 zOPBNPe-1&vcwp(-p3{<*?9b)+=crMVS&ql z*Cv5(jix|{wau2IJn3Z(|9oqVvT&pwu5KAAUGC3AlAlqRugT9n-bAMfZcrUx1SIsr z6kII1SBrhZvdI-8#8C`czDy(W>d(Gig*P3bK} zO6U-kCZPoB5FiSK5CVi20tpH4Veb1r&%N)}`N9|RaFVmn-fOS5_HRQISWIFJjP5BV z8~i#q@7#T8eiX`#-^P!2S^T$W_umjEz--0?iQ%jR&`x;5MYauyBi`37f!^hs?g!La}`7z|DxLR6fSyARp;Q4-d1^z`SS{`wgJxA$lC zq-p2t{J^faDrVHzrQR3Iw(iVT(DSxb{K|ZI6n^XaBdDl4AzZEp6;zlyM14*Z}UCu_+_r76|bb~yzwgb9I@k80s>vX zmA5O_{)_h-h}-CUkpgEy=-Ta|qGh%e^uw~3y7Ldt*vS7&k1cP%QnI zKXEdgtF$wn7H<%vLvbzr7X|}h-kCiG;W!;TJ3G%cK?w`23)${p{Ri)b?%FMN(z&f{64E>@4 z#4*bvX!*Z=O!4ZXWPUD-DekNPc43W^!0$o3i^Q=z)xH(~cC+SA28?)}^PT{&1*9Rl zAXmO6Z1A~?)_-~CfAU7%;qv*J-@#|!J?D*wBmw{rq z39We!?dbcOP%mD;^)LP1QBn`g@F-Nu_!{N#FMhaN(nI9yW+>Iae_ccX-AQW5Fry6c zuB;d@PqZOo>Vvlj8j8X7vwtyGK6Z@o`L@b_Q)zti%gl8P^}DeCm`-7NZBh_JqxJm73AT@c_}Hl$ERo&g%&1oE)FVir@BW0xvvpH&g8c9{#INM4lYo_g-d`@3)1^b z4LCnH+TsXi_?r&1d1{v8)xrac6q^mE3lKL&SxR~YA!=>3=?ag{E*=9mnYxFzp+8=X z*m_mv0vsX@iSU~u_KF^6CaSORO^a35Z0UQvT4NncBS}y-HwpP4oiM zZQm_q;dJAqn{{o&%dYb6j{LLu_-7Fv?|b}gwP&x1IExW7(4q&e2V~@={S*@oy$Ody zs#+9Q4x^Ek3uC^JA2GDCcTH3t*2g*g1#a%u_UOLg=G|B;bnpbTv)Lm=Ah8(VxSj(U z_c%jW@Kig9E*KfXsF~RX&65)iMvPU#;IK$UD}BAigACavQRGV)Tj?VW?Fu^YysDH( zRx03WfChEA5FwfuZmY80AF$=sygk@5a)LUWdL+a-BK+(TyaLoA$B4r#ZB!<}lJ5Ul z$C=<9U5WbGQt9kSG?6I8p<#_3c=SpzyL~fZ%B#=0D z*$G>5%L(#nCgnzmLw0c?d3E=>>6YC&pFB$PGS^!UqtK@+o6%?w`dU4_&gLiCbfb%_ zw7aOgdp}NxVq&9K4l|~-tt^<<4&E?O*^2I1X~Fj;sWb1XFhfMg$Kh?`?>s7`ln_#| zv*Hai{&vmZ^W(fqnkklcj~AB5OQn+5(967h4b$Zng=;L}5keU%x$EIB#z_{>>DPUi zou<{K2a#lJ-JK>8pXN~_IojR*)~frLp8Vu#iX4yfRP(&IP$(QS&15g*MI^ zPC$KWa;k&y|u7%P|oomKIKtfR=o1f zH_|f{I3h}d9CR{)1{{gF?^*-{K_={-DLbSNcD>sE8v&r%N{LhUVPj)Ne0mF+kP|Yk zVWc?qxJd9Yc*b$sszx72& z2$G$s$_!C&zuc`ggNk(IiePL5%O6CuLmwnj@tfZ73GcxT#+%R1{tOaFG1;PZ5+?Q4 z#EZV2Pm0Yj^Tp?c%$0QtyXJ;1LAzSRvA9Ne7;uWE_{7Kg|KKk0l$fe60pUUYbmCCg z&ZpYu;>{-y!6-^9%AVGM4(g!+^AHv7S@>$nCu>0y)KJj;IiFTyT3y#tRwBOE@8-{P zW_#&zfK}?1se6Trh?A;!wI zoJWs9eIE}qkTflpWBjj``;2 zBp@IlwoaTw!y9Ik#~s|@bCzD1lfteL(5`y*jDMfv&dtNW<1W^F@i!c|a)5vlqEE)g zCJKwvZ1aKV@DsS3asOmzL1%%;+lZ;4NZFHvnuqyypJ^lowJEGG>T*}1DthngM&4m- zhG4`&%uCVp&iueJK?B~E#P~B4UO#nV-?F(h{~+}_6rWmPo5vu5OkVNt#0j?ScL*`f zFANQrnuHaYXfosto`itH_fxHg>10%%YsRCO=T3c3vv#T;edBUPG99Bqmz)h8kwO+{ zy5)*VweLCY*UNSsNFWZBq?#7zJz^@sZ}ddUC~^8>SlvrXchg3FGmFy8cVb>_?VrA| z_2`}NT-fm6Y|^jW)2=R%Ov08w=!nlceZu54;IfM|UEj4r$Zfk{-%RABLLqymNT||W zU_i%nsBar1xS2XfAFe>Or-@{F*BsaqFf5=myhGbyz?%#!4*g{R7CCM!N18|zy&nIW zC-3p#_Mn^zZMPwP{gIhB7ec0e=Rq@lJt6?{J9ma=t$k~2a~Vxv0{)s^?cw2cz3k<0 z>zXriv+vG8#gCrh`1KFCue|5zu@l-8oBM>jBT@}BmLx^&gquN}Wb6HQez_}W=#kcr zz8>H;*-}ELTb_{#gH8l4lrkk*+i!0tEpDRDFuZus`F&@_3sGY85|@YD>t0n~$LGUZ zp@5y5$YflGUB_9>tmMihskKEp>*G ztU}>8)wla=iNJfPx7{xn5*ykVZ{z(D!I|QrPMcgHA|-ckJpTGx%~grMT3b?-W-p9% zmCeb&HzP)S+h^z7mfB;Q4<;6+uTpQtXS%&>;>2E5tW?hl+!7-;;&Sg}A%@@2%jQP^ zNHu^t+YNL==E4ZG{Tm?|UZ zK~WmMJ4L_$_6vTXe}zdG(v@l3(FY)zZ&6XY?TsYO^NbbH!t~{CKC0ymPn>kklOt4W zHUopCnl`-($C586sf`o9m+E>e=0ArPT)ZruhZP8!OMMx6y>MI}h;~a(yaL^Zmn#^V z(l5^Ac<>4x#!V9J(}3a0iTQ1a2_}>sP5&c3dLOkn9~V{`1Uy{>IgDBWH^NaKLaAu$ zS-Gr1A2l<<=fw>U4ywIW#moehgw@`J`Cg@|)0UmXggdN25mH9!U2cSTUW4+$KNrcs z_WRnvX+{qxl9>S5DWcb4(7+{fdfr{u;LCd^Dkx-+^-0#^F|Hj@@d7uM%5xb=*TZ26 znD4+MBukvV9kZ_pW&{9{z5}Hb$nIwS8M96L%e_P?SV>QWAgb*ey1b%lW}&5OirzR` z@-sefq2Ot#Ihh+&g{E$p+Y=Xv}f2@L7J$+^p#Lr92s_ z=4Iiwb$7sCwqLuRUK{h7NkttN0sEAuH?t$Flu=^~VNb$DHzU<^C3<)(qC2`m%YNsv zz666OS)?|2nalLl#8OCAEx|4a7PXi$z63FeMA>r0qXTkD?qK)wz^tQhocy zcaZTp+@8n&BtxLZa!zDLrgbCls7P$z?0;H+%wte8kvAn~;9WulsX{)S<0U&oayFc_ zh8%DbN?0Fpoi{}0D3;m>tWnO`wq#YIestF{g0aC$qhs0%8uHDElJ%XRdb6*m{T}WL zjrl^CQhb^Om5ey&QP3vTyXH$9#fNH z1BaLLNAxFqWWgIGxy=~$URBlMNzb8>9Fv1T5C7gC^vURi2fwb|3g-TLE!`!Z5iFGn z`qtjD`)q6R#pW#~v{n07s*?rt;;}^Cy^!uqH>>Hm7wXhWb%Bi$hWPE+6ccrI2M7hJ zmAv8vKQrR6Ic#WUd74ivPsq4lU%wg@~{~X9JXStVzDEJ$_=Jv5;ra*UAFOe*%?8( z*%dSU0L-$AJHz<#hK-gpglJ7F?YUx$Ju_YZW=Li_FJgT^(&=MqlDD_l<9UsamuC!g zgaYhisqal~Jj<>Q$A}&%cHQd8AMIiHZCo#}8@e-6nC07kRbZnQ#6A0<@m~HHgBm?7 z`s%#7p9~!6h4D+R(5_Ugk`wIS{0j-4ppqQ_2k)F>*Yzr51>(`_=BowYND323}O+JkRz zMZeLfFzotAZ9g1tA9FM0!1cXG^&F5f-wBXj3;OLiVK1{ETI`15in$x4r=5k{fy@cl zu@3=IE_$9ZQc{qpQNR4oSb4t_?U$8sbs~83{R7zS<`n&U*2n8CoZ2zuy^K8>7Jo(Y zwpp{1Tz@B8A4s~Qk-5NZshtcB*&22wFK81!{Dh zF)imdaEDOwH5x-mF)~fauV{Nvx%NlrZ9L>0Wpd)37Xk!)ldK1Uxapfsu6Y$yg<|i( z#02_XZY$MQD^{z)!!GZB=T1ku-Mg@HjhfAod3$ZwRoiN#&JQqV+}&Y{(m|Vhd8<#$ zfF<$!Gw8R=B9qvNj|W?QMYAj2lr9bQDaN}5ISb>;&tF{99UMIpWHV*c5ZBT{elCbp z4DG8L^2JppH+>O5>6ZV9hXAtxZ*6;+kLV$te7?=fj18R#>L0x4>@*J#*gQrC>d~-h zP~8|xo3l~7_aGm1y!k{&?WfXVeNs?oTXZ>;2u4-+3I> zRE$S7egXeK-IKWfp}S~>OGT>r>z6ZJAG`Q8fht}Mfwo%V1^-BAzSaFcek~K^&F5DV zT|lv9Zs+lgq}g$JX7tO{$7Fo(&hkkX?U5iaDD^O^CLTk(g0p;^jKWtpMbTLa)wIQw z5Ybw3_F>c5F$FHH_^w?3g!=Au3Gj>6;7-GIJ801k&~qfXTd9xdLA!0#-|TCZM4O$N z_9@v}sX$oN$3!gYMC=GIv;pa=W-Zw8Y=cBPfJ4yqGK5b5HgHTqK#{V@3%dyT$~`+J z7r!QLm%y%QXI!!_Tq6@lPSmVd424f&zGT#REp8GdlkJ*XsdEvTWDwd2GM=^1e?Ubc ziXDRKw>yqK?fNX;y!@ulO7XUxscsrZbd zHDWlJqA<&KJk9E0ZA&78VVs0BRNL9;z^|u<*HZmlM1R(#8NNS0Z#r-4Odn^06r0B0 zuZ4KtlqPOTROzDzM1sWAL+9EtCeZ2YnV_Ax-Wp*hHzv97YVH}|>aqGZjlQJDVOKlv z6lps4JbvKfI4+#NRtM%b5KkXa!pW~S^>Az#121WkyW!L_KVQgT6M-82fergqo!`(E%`s7s{N3~O70Nh={YVkBvIrsbfXTB^k5 zwo;wa{1T=~33O?Fd<8zkU~MVZy<_t>8rgn;mgsU?3o@U-Tb&~7r;bc9`# zCpVZbRNNiQ`}l!zVS0$q2IeU7iawS=#6qf$Dn_x|b-z`=9;@jU9&V8LH$j5ms&Ar6 zoK(9ZR72Ko6yQDWP&VNG%36%k5hVgv7WV_o$~|bx_FI}F0#PcVWU-><-xNAz4|2Lc zHqbEhz)NFss3ZKe?KO_QSn8v|bj{H-l{NthV z&Nx@gnrd)`60!5GXR8?KAM1233A6ABP_qim`mdWy>j(xJ3Vx5ytaWl=Km@T`^gC=) z_vZ|Msj7TEDYDpTe&vgJ`gu$1_SVS)!OcehFo2uui#tP-eSd|sG1Z_`+!6#Clkefj z^=COh(Jt5m;=0&K30HpO+BGLD)%A}KVC7{1Rkufm)8`4z0P}ZlED(rc3l_&Qj!6kB94y~D+)ucq2+#XXD$#Ez8D;## zs$B-rwA6g=Syg^E?6X$t<6OCc9c18;3@nXZW0~Nw-n4|KcWQ1%{9U0RLrzrQZJcf{ z?W|_sBesjp!||NYhMYb+bCX*mNTiK*ex+*$^}ZZp6G6`tUj)RbyiZID<4 zj-e<*;^&zV?8FF@~V?=S^Cv6;0hVTl?N-Ue&fsL%$nPoV{XnqxXtOL4sms9Vle>Oe)?q zfg_=eRF+-%Q^!nqGcYh2aq;?i(sa^^agL1W+wwXbus!C;D(g0%_eVYOZpt6hGwEkK zt-S^mF0Sv>Th`tj-qaMF0lG;8j|Aj6{NN!oriZm;%+jvtN4=Ia`xWoo--zQ_AIu@U=KS)x zQ`_}8D0cc%qLV0(Yppz~2QJ1FN!JFE2efWJ-@+`PmEE`~uL*|; zmo;WIRgKet`zk+o-y4ng&84hVy8LlB(S!9ywcn6qX;~!~Tr>WfO#{>MGBD*Xb;@81 zxiCSA=E$V(aXphbmUy?8?lkRDBE|mW7b@8we_lIf_!Vd><{~Qsi^K+0NR_F0+6#cv zDjVKGOB})_m25+oKfIC{NWMv$u8_fSEoxogdU^tue6*<2oOX^4U@bvcMe6X}Sw+r? z8aI+YYt3AH;|1^;9${476)Kg_S3k?U^-=f|(Jj_t5h1%dW0`ja%`m;u~wV4`G}M&E!z)~x+VNC?05Tdenh-FnK;^nRcLEoM(jKMl)TsU8!JteS z(a94*nC`G6x+Epo&(XA=uMQmBnQS^A5K3PQS=^-XmIm%l&2sf?<+q-<+B1gxw%;b^ zxoWVUB|!I*b@U_jhz%%Zkt2?45uCiY)zFid0UIyL+3gE+>a;#9yXrqh=!qx-*U#PX zwe_718Xjz6UNX{{dK^}XT;@4NbIpL#)Xw4n#wn*=Wg(vU_co>slBfwl(Llx-m`rm? z1i4M~u(EAuxG$Alz5HY!$9$9K=-Jy!21zr#rU{~&a4=8m$GBl{No8DP63nNGvWuS9 zm7WapHOV?;|54qO_jRI2J#4~(Y7Ujz{C=0iqJ9k%5*`WC@z~X<;vYKxzs2;ZQ|7nS z%IOK`lUC|^`H&Wtj$%S7JeY_D<#hmcmhwtRX#x(g7dsC$u+gJB*7C-8k9`V5)J`!AzV5faL z!BM=$Tb-|-t3YlzjM{&0pk){TS%uVZHUiB1Z5Nw{RcRFWyoJ}G^~FT&;`XfG0&)O? zTeRf|S!sOL$w7ISvk(7(tSqunG7#^OCCi85*1KTk5QIN)+<*A>^$tPPF*_DRnW&w_ z$#AID1?vI5xtEmdgG0fC)lYd#F~1cA6l}(59sD(}#OD?Zj*zH6?2~S3t!d^pXxg>) zDvZ;2z9|E=s1M>zrO>6FubhOO=fh(Iwtptoe`-9>E5k*bJ^Z98E}s0UGDA<46A!NG z)h3n}B*7_R0POJWC3q%uNT{wi0(F1N?J!*9uKs@1O3LAZ8=iHAg6;8V>>sQ?Wq4}N zBt_j~Wz4%BA!ivbn5$nxT0=uNk61QXgQF~_@&Ql!pywLgH zor=30`hdA=|F`FaJlKbEDc8l!z+t@+1Dm13YqA+4EOJ^gg`r2=5;guTwg$DbPX}iK z(+-jt1wyt*U;j-Ot@C(%I;gkekd9MDK7P^FED*fRK6mf^RhCn!tTN{qG{^JwR>0KkbVXBEV8}jt-#txtC4b_PqwX{9j!~8W#*kQ2456J46Z29iN`d_+kZY|0p}om z73+dW5$x{-l&Q>blNQR*-t`P*ukJLUlt zm^iqHxzrH$rJMKCO|n`*311Z{ag9enw2$+E!R%a!>pDQ)uY6$J3^48 zmK9J??}-J5)SLY-W5qf5f}=*ayz5yXtGi;F{hUrgI0GW2cRFsXjSSC=eGdH=45&sx z;xRQIzCcpKd5@rh)Wf=yR*0OU-%Kp{i6oFQ^!rMlavXrW7XHCq`Sm~xUt;5$sf-I! z69qx{@im=L>Nxv(*`jN*8ml{ICgn(-tDIYH079M0K+wb02+%c(($;e*hbGP4B}@1C z&9#kF4J@bK4K%0R5Ia+Dd1JKJeaoObHBMa@+;SaaO73~j=d%sM4F^Y711Qz9iqaxt z(>^WWVFZV!II2+hKF@-{eID-g%pUu3>oy5T3ol8FBU;z+pl+(#i_UyZ9=;G_ z;p~Jwa+mOdLY-Y4WS3;;rOrA_rAJGhFG6g_6mYtU@8Xsf)=PwsIaelGFFVCay$NyH z#rB!cJ8wd@xB8rh%S>aAkeNqd!t~F$0${W?`Lb`T!Lrg~2gkOJ1^OJDbmOfsS*ft|~E%w2V3o`*qFY1=VV5Z7$KZnQ|2>xqg`-Ji^TiZ1O)c|)t*SF^FIAk?|k3YT?O$|3^ctQq4R#Z&J3CdaKXea zi-C)+2Od^`e{ni=CaDO96<*9x!H@OZkFz*zAd*lt^$x#~^-8eFfom;#t1rYop5ZC&bauG=z&S zPrr-_b-eNc>)9vuz;I7N(V$Zl*zDF15Ta~LufU4+V>n<8_VuHVmqnTkq71P+%U3VS zE#+mZgEnQ_Ilso=#%Z&wFRqOD@x*d%-MoGqhjwgED^q)dt}ITykAJ+vy$;x5^j8(u zJ9FUs{A3#@LN^;W1K$z0bXlKrPf8~|vjxB(41rI>EyWcwO&j^2; z1@chlpjxej=@KCO<#K#&-k3K)&kk$z`Me$k+6H~Q>g(cp&yeHx1#gCYpC~qZq8J>K z!8sMYc4-vtqtVRHXVUgV{y#bwW#9|n z8zF*Q$cge3F-}kJsa=vzw{goXYRzyA{h^tPclwcq+tW4$V6!jXb9U2H;FZ-1hR_FM z`a{x9ZF7Bqv*AUiPSA0T-N_xy=cJ-IX*H!I{xB6X_oM^24HWPyk)n#g6_-a}U){Y} zmFcv{u@#pJhJ&?`TQneMEz?joJf~w)0pnWGb!(SrQ0Y#E2~dc4^Ms&g<<;#tyz80n z@t{uSw7xi*c6-NFE5?F}MlZeVQw+Fas{Dtd5OmL!=B#+#s~|zi1f@wFeF^!sT^7PN z+7l&G*Enj0vdt-6=@qSrDOm|(GRQEicdqL?cTmF0w$+aylG2IuGmNr(@Byh?-NAbG*5aKQhC$-QxEq7ZOc?)-css>7PoR zn$pKT-!7ewdpvPpaPeHqYa<}(;H6V(Knbp&ajFd*O-5C%B3l3C%4fJIwT*BD<1Rx0 z2)JLaOgONlVO?N@T(C4cH-+~mwW1?Y*9*~dI~H@_)K~+*Q-?11DrS>zZ3OimIJL~@ zitV1&Qz!NH%VErMZ)KA7C7XV**8-hrb5l<_8C>VF){gTh-Bt(aML;{Or$rok$yvbI z{=}hb2Ndn#u%_Wvi2dBFpG>huoicsTY|07++^Vqk?MFc|yJ&1+u=&Did=P~~n>6-K z>5hDp;6j7$Rzik?Rf{rCmTC4L%v)11FH5rh(KIu6&;7T+F>qSmA17}EQfSY3M$HAc zjKAP{Mz_r0YBKhR1HX_>q`9{zXc-1BF7@}xHmG)J({)cp=yd-i66=Gy42ftuKSDO% zgEUjy={f+dJ-9#6Fjt-(4lz`=RE({@M=$NnbfRk)0fVp%{4mPWQmel#`f@kv$mL)I z13Gm}JHgbwp^V1d>6o&gpo&Y^je)~w9+bPH`ASMgf;N=f_Xp56_kQ~h^d^YYzwsU{ zrle{d`LbM^tfOCj>3E5BJ9VsuHBD`IkE?6tAgF!6TyDt9(v^*(cMKFxETTyhkNjss zuo;D$mn@AH#>~ZPt}2St*I*B6_q_s?5afdvWt zEJsEUxRm(jYZzQ%qO@*IreE`KQUw`=;(sQ9zG_J7<1#VFCDACCZRfxfIm3Uk9^N4D zZiD!YcP?;q+?qbEAxCCfGp>pRVx6Q~qnA_MAHn2bA}EyilZxB7=iRA|kN`=igl z^XMYlcEiCIoyc|yT-meluExQ2O;`8_a~uDdtHWy{Gd5nzL@J7;(9N9#*lAX5ak{UA z!qPsH+UbJ2A#*_?;d?)HhL3Pfy@vQ%vnj@_h+>%fzV!86_dDVN14{;H#@My3H1%Bc`H7s@3Xp2&bXp|LY54;W-5(w z@t$1%LcBW!VyF&mGnZ^;5$LnW|FAQBE<=A6hX{k@%Vc%h`zsJ~Ar>H04R3 zA;mC$bmg@S92o+IWha%(*B342Nv8g$kEb2Y*5s)-gxyeu}O)Z`wyj) zm%4lorFBy!4hfiR^o|TIMrX66({*Q>235T9c?+T}9L7D2-RD~?t?i$VZ(B{zAE3$L z%6M{_wu`w_Z^AAQ7}j!tp0lJ(|D)DY#_dEwsAb_e^Y#%Shkuiw$PO5@p~< z`e5U7QgL$5H7SjhL)ye45E*$g2}jl2-lV{5^k?I4pC);}2FxZfI(8wQ$4;;m;?o$x z8g~u8$qByE&Tq+A+qe~Ueei*Sv}xtaChc+Bf$ujho-!m3LTy8an{%UCE>J9lb^p}d zm0|g8?i0$3mp0IjW1;CiMww>jdeRrd5(N1dB# zT*TSj0TJ_7-(>IVhGVzmQrFvVuAiRz4yREiSq6h1*E$=eeP?}o_Rk2>auemUQDU-bHio+9B>R)#(n z#_e^0bC1AfJaBU%ULk>3EokGzD~mTbyU;-s4lUy)4d^dyQW-wY#I)&^XdCaE&6h~L zZvL2^jel_+^1G| z8NG8J!`@#C8xsM~Ctx;vCN#!=VKb+ZsT*kt5@srvUws3SdVArt;EejQaWV|1uW~T) zYN^Es=mM}|V?7YzacgPn97Kl(IHCKpgo~{beN*WP>pe#NR@4_F0XB_ghc*$ zaX9LfF=8lZ1ic6l0F+>XhS^{p-wK*HYSq_j5jbKI;b!jCDf?rBkjG&l%49B1SHr?T zVMapIK+*#m5mx=kBN6puMb2Xfm!W#BJiqSwUcQ9`y7&N;eV+9Uxpf=0^G!#{4JK5C zPq$Ol@<&~hY2SN58+)Wvh{A=MtqlRD2rFQmeh!hO!Mp~^2LEGy0~!JuGMC>hK&fd8 z9JX+IVLRV9o0(|Hnw+-v>KBh#uZ~dJc*^iHO8ygR8gttY@85y*tu$2GTLK_tyAT=z z^Z@Bp(<; zBYt86{x7|y4bWR4xF52)*XAAZlg4ToY0Zj6_0HPwX2$AmHMIcejI5dI{{m>Iwo|L~ zaf1dDh@IJ1IDib)>HPtzl&(9B+8?3at#poH2}?rC$u%U^#Ix@ohx?HkAT3V+N((lu zM__nYb^U=n9$ST6x`^Dg8_=*4%5q*vvs=gRXSC2_V&?OO$8Y5S7p*9(hy9x95Z4G+ z-sN8aRHS)CnQlK%b-lLBdQ%10pq3<|3~+s=XlWltvrXWhbwL4p#Cfbzc-u<3*F}Y- zk8AI|JHv4#}5Zj(DzBUw#`#iFZH34brj z$}uPixFq1aJuF6!+i1eumzs&#zN(BR(39#NH0;oBYT~POr>ygz+D)qsxG2CS2^w_M zjonTtj3}sxq*Q>6BFIP`myk`S&Ua}5q7;M+Z1<~&;IpBALw^w~YX^5>8mQ1RaEpG$DJIJ5@WVEvVIYJb5F3EOh@uO%F|pd_E36U+ zL`?b;opIBkp68h|yT;;2$B^o;!eggugnOs#d{H^nq^R3RIK(!j?aX#)uaiNf>X8Rz zJBU??Myl(tktnpVbdZBLeC{ST^n_d`#9r~1ofMr9!fzoF5GhbR1;2H$EmKGr+S3WA zj7^{iE?fA5!A6>@A61D~-jM(cRSc;88aR{MYWVyWS}gr^AK*aXV2LH=I>q*G8(lsN zC`ox1tFD!;(nxbEaP>b3A3;KyFWCj&38{+I(mr$S0)0m9ZCmJz)R8Z7(wV~J7hKHO zKSZ*gVT$cKRK_lP%d~G8CZSk`8cUYnpt?JKUJ#dK&m!tq#ECr-2o+C<%a zQk(Ze_L0>wF{yihchfMImB5l9utD2Jt1Je8>lRuDMNys^X|J;w!;_OYevaR-ibCxX$vuPmHX77;) zr4haQHp8S%HmvNDEtU{hYWt)A-&p|kw%e!cW}vTfMgU3ujc^lg9J_vh-LXuG&!B3x zudhHM6IS2#Z$seil;D2gJ8hl7Q<8^aKYD2dsY(_}}9NF6eUuxl22a|WTcJED};%eKviWlH$c5MF9?9Q*Y*BklTq=0?%5(@G7 zX_w-W?V%Y+k6xc&@y^r^qrJ{mNFeyYb&oDye-9tFbe#0>8yHb0M?pfuNmg;ApIpmCf(r0}7TVM;6PuU@UppA$Up_82iniiNG;D zrtrP7B&M0c$&AB_d14HQ#V(`+v>vd|0-py1ipI+)S!+kpEff`!D(9M${=~>GQr% zPDjRATV2VN(C<`s`t82&Rgq4h1bYg9nxjdhW@^HmN~816U!AvNhyez!hwH7|>#Y%; zN=G_)6V_d}?+@gi$)(@G1K>uRJ?GT_UkL@Y+Rv^0{v+!y zHs5LrbXMq)`_zAcm`Smvk7L9d@?!TB=iy4-d)A3?hjgRPdZ2XoX(|;+X!AdNYfNKo zhCOJWZ=KIL@~l8BT{YPXuvIr3v=N*8Q{fd-!C_L*!_`^Vhn8dedz+%C3Z3F;WF-;SO9 z^Va|O<2~{}*M;zh=o>B1TF5^{sr!@D8Pi}P`v)FtQj@Q9WVWTet#X5C+2 z6Z!@rldnA0jhUgb*}=4_;og2m6Xuvn!AgIgPn*r4T8k(6JvY%SvWr~BK01o1{IG2Z z70CSCw>|Smrp{QHfqK#jIIBRwVsftZP6nV37M~VSDg3;Bclwc8Vo$)+$N%fA_~)B> zi29GYxw-x#RQ>NuCb?;8A~L9h?Ak^VUAYU8&L6HnIy6tTKPsm$XC2UrJ>M6yh2%n( z^oT~+zSS2Gb9hv0hCBtkZ%*glxpb(=o)Dat5wetv%OCF$@x@xe3hw6|}q zUCtRUMJk|Be zO|JprRLOg__J=*BRqwAlIplE0So(_mt6~A-mrOz)L}f91=KJliV|ld@`tFS%y@$5P z#%9jQho%q4HKrs!`t+1(`7J}X0RJXVrmlX?SB0E^tZs(xvC(eld%;(!S`g8=`oLsv z5LoLpG3PzB0B)FBobr8R<4x({(6n(mlY<@3@yen$(WqA8xmG;pfNFcC?>0d%NYD#Z zRM~GBwoN$<%QXXWsPbmfZ|1_*FA(^>`jr>gN9J<3dP{bTDW!zlxu=%6B^gT-qT%JM z@7;}*bt+BX6A&!W08xkjBBcheW#rIk@VYZw9Xx7lh6s#Pp3lL;4Lp~FHhj0ke#0rl z+K%NkH>EHQc~t^GS_G~spc=RzG?6H3I}RJAQO6W?KZvwNy<_FY5720xvT3E=^vfrFagrF@C z7jvTDjFsL5pNMNuTR-=q;f;LR2SRm=O#Rva|Lr{rS$FvHew{Fo%~CU*^TET%q=@?KTJN5wcewLO&nhM0$*93r6fbBDt#VwnqsD z8I8xu7@juAi;XBp>GZ3Jg$z?a0;6;=OVhhJD+Jic#;hvAz{n_-%lPJ?`bp)E{<6`l z3OjAPvd$}-u<6%GFFm~&=ytk_uQTg5nu4f zs3lM9URCvNlRhNpwsbLA>UK+fPiiXp{f!eo2_M-cE_OzcThIDOsyv!E22Y1?udB?q z&z=--4LeAfcPxF6p}<0Lf3>r{m_~XLT3SSL#R(JRN{9rED%Bg+rNNa4`AjVN!1AHn zZ-Cs!CYCKK$EWhw4I-oA-m~>7y&eRC5a60@>-v)FW7(byYhoxiEyy&)N%L+QHAgQ9 zaWEa26b!5SXR)9yZA{dylsmMUaMlVLjV$4Cf=CE3Is8%WaApL`W*m5y_0&%a!2hcU z2fy2Hx4unO6c4$2x*9s;Cb93M2$oM&V(uj%17TaPlv53beK(QTzbX~K>`D90$XI*o%Q<@HO zC--^*PLfETCAB>aOnL31N`nQq6(d%XeWlsDFJy4@{RtiGZA0|{|7_RGAk^?R&cwSSSt__=^iA8f@yWMM?RMc!hPlKJmB-d~aL=}JX8yM%~#ugo0U4iPMs zF}!Vr8dN1nwupaszW4ZfN$Xz|w-Ju&_!KcAbQh1qcVgdQJg;p3J5>~E5M`}NsQ7UC9p|y7f{dj9C{9bRKEoIfcWWj)dbYOqS&=-A7d}l z+QUl~Tqq8FJm-lynt?(n!Nq+-uJeHDvf8uh7vY#Wb>mr|uMum_yC47BE;(bsFlan035+I+*j}b*xBX^8QC)|$k8$M5 z@4O8F>Ey@bgb5ni@Q83~Ha4~~7CBuzyDx?M&Ce)hF5bO6b%#M6l?H=@-@i}qN{osl zwBMH&thasx_a{0HS%#M6^bwjSK}ouh*HaizE@3QmwziQ`QGILa1L3isH_%#4Cj;Ea zpjOMB!DVg^Va7Rl%64{kY0h7^oMAIGP;RTwl;!%9#hd9amif{%O^qt(-1sjW+(POE z=nh zgDahH*D0h8^`G3oZxuOJqp=wt{osIB>xlPtlB8ypXPl$#uGTJZg`mf=2K-Tnc*n$Z z{3N_#WRc1&>)EP=v$7*4i?tH>*hRl2ewSivf&#sD%a>JAA6SC&``}}FqkJ3|8*^&8 zZscCFPT$tw@s3*f8r z*TWbXXBpBUwkO><<%+8vJTh4jX5msRD`QKd@b*m>?K?b?3pI57+4}r&04^{(H!X~OS8HkrJ~hfq_@7K20O}wS-L=pUxiZI%Gp@w)k8ohTts=C8cj7G`p(h*x1=G7vNR1NFEgs;su+v-SCKr z+Y7FAQ%y(Aw*41dO_se|7jqZ+jj&qQHF;>gv+Sf>F&ms7_?o_c`3a}SZ1BCPXtkt4 zo2~$|>uR7548$YuKAP5idB#PzyI|HW5aDr?JySK<+S!l2`Gq59pCbz6>X#&P2p4&a zjoi2-0-dYr0p1Yn)Gg0GQRG9owKN%mzHc4MA$&em;J>TZ60JhY$NcCALnXx}G;k%S zsB}``;vskBXjc741iGHJOud8EDAUaR+O%?>O7r|sqS#C+$n6083arLLSHlQ+u5aC?d>!TO1? zAow1YKX2pjvxp$a&tlsJTh^lwqtdxCbGT(lBF zOEeSCsl52i{QK{gld1-+Gb#tLIl1*i?)>Uoe4`m~@bPKFn2#2DZGNfeKg!@AzYP$C zSnMp5kl>QtW^@va_nk=VC0JmY<7^j1wqIds6E`-d;E&wo77 z_op)3M8wCB8p+PWZu7ddmU;KQk-Z^FNhusAOLi|;m4dG>WBpP}MyAk-oamRE;-AVT z;)?!+6+gLzKSKieQcvWv^0E~m@DindeG=brK10j~x<<_DL8z?_kKq;xA#;f&0bPEP zb8}eWu|K@W<~6g4kslpDT=M?~yv4yG> zIJ)q=Lm!B`xX!zGD-QUv_YFSW|HqB~xQ;{l-*Ih~DGvS7@PV)(+3Pndzr5~0apdBq z$lE#RojEss!FfFp8RpA}#KiTJDFJl9rXc^2wC^6SnJgT;$lCjH16WKV@K#q>z(?SSL1(>wTLU4 znE&J(Lgv5sHn$Li2_Cbu;vt@ME`*W&H7WcWM*hNQ+hiyxDZ_odUmeG@>-^0tMT_$x zh&ojt@5u=A-z!0p8nnom7-^##%=rDkc~emgY4~=3Kn2$7LD7-9mgti*xVMbCKpJ9>atzf3s37BU4gR zqHRpNO1S^ut;sL97%I2#!GS&E`TN;GuJn^F39cfSDkR2a?t{}p)u%F+Yxy$cf&dxtZ`8l-3I|LMP6^MCXR zLt===#;Zt&mXy+Uzw}l9wJ-|7)@C-Mjby(_$ffU#Y;qf2Gs_sHo52{=1<!Yqn#+-@AWtP`*2>09SuI8TaUKrWG7t01+YsTzx8X=YNZ$ ze^G{QA{1VoyUlA1*6#=Yxtz0Mie+S~fT0hj=zMnpQXBMr{ew@D>*fjvf_~hd)YxUCQf4>la zN%XIPXc+CXQS9G*8&r-s5jVFu0GWDtHc|gxV4~1L`Ul-4U}5E27W;d(!i>-NA9N{+ zR`4&zPX4!oeisY~u(kp%VVF(ff53{Z$9t>lqpO_>*G83cFFwRzFMxCpZ8Yx$lNd(n z+I7&__lU1+%>oligZtw-yJoJt-k$UVL(i?O;h2BEGQJ9kc*$Jw8+6ZD;jzn-r0$Z>=vKHmKDaYXQu zI2L%P(H85S=^u!uSruY!qx(w_Sh_gU5~Q&mRv5mA3RT=woDbG~f7*%Sp=WhMi$zL*xF!1$oc>jY~?@`0-g_Os~(i z7tDeTKr7!;yeS)@i$-JhyrZ+-Qesa$%$icig6*ktZ6&@AsQ@nPgxtx!EtK}o#s!*s z=kDJ0;IiSwKtbG5YDN|*N-9d?N%M!WM#DiC`ne`muBhm4zH(aH_QLm4As?e6H#E$N z#W#HF645<+`wHPDZ)Vjr%bnQ$ou0wX%ge1oYeO)M#O>0U9&6BeDX|a47pnApl3#KO z3{@@NrYvugEm=C6{gl}v;QVybUQ4EdTDIaX!h_F}t_YXU(rVbgasKn}a}RH-ii zT0S#5#LI#P-bNx4j2{i)wv%u5nkQola}w-Cpzjmc2X9&Zr}`$g8uT&257#IC5r10! zTfTeufS^|-w7BtQC*;!9bjbOQFtbL@69|1ZcX9n1!^aOFO8-ml<=-|JN5x>d^LdU< zi;p+L+cWdGc=9|F$zD6+nziQdmnckS1rooJPWA;A*{e=JjxV`pg#ViGL23 zz*l-hs!|^!IXw>LiJ1FRd7-aLG97u1TV8x*OW}TmOmJ#GfP40OQ^ykKU$5F#1Q&7(}v=(HsPeS|9te#G1Ok#1A)dWv~)u z-cCw<6hp!jviO1QkuB}#w0iNBNSRvKuZj=r6sK(Led(H0D9b0APYw%wQ;wuZW2D!+ zpEd^cC|=4OJ`DTkz644KH|*0tB-J0QsKtXS)q$YDrrY~Mt!hojIK}3<;v%QHAdDZ8 zs!he9?Ifj}6&gM6c8Gm*Ud9JZeELz5C~)L{4*nBeg5zE7{iek=+&G8b9>aB;<6tit zA>nITP07baI-vHViT!}{=wV5c2l;4De-3L$_jCIiR8(V_ZH2Z*2b&_bZLSKO zPKkzgH*?4^^BuM}*Le}HuJ;!k?WfZ2+_9EMMwF%B8~B9G#tX`}Vqr#`Dne;IQ{6Ej zoGy}YaYq+li02m-(q?0%?r1sOnF|tlH#FP1r+ilwbzJXgBGGoWJgZ!kYwVUxGqGEc zyM$wD4iSPKgzNfuD%`7vp3ZD}= zUzv%2Z+u0ntQS2{Z15os$42nrJ{~IHQmN6=nJ!`=#^g9-Y)XjU z?nCkCKeGf>TLj&^M`IB;(O(QDrJp}Zper;9L)mxl1Qs?ksD)J=@%PdePHoc`;L)pC3J z{#czH1MeA)w?zXQwU0$umvj%iD^8&I`v!XrM@?vrL1 zhsAN+m=CbU)jEF}-8q^brDkVQw8yRIF}C`H6Z0-bWTE9cT|a)Jg!S_(quNVnHGfA~ zJel{ypg*S^sZvN--7tFh+j%1+N(If$3wEKG(6pQG);pn}=kywl6t7>$Jze&oXJBwn zmY-ce?zKAr(777PTcc3}paH7uJC#K{>;mQLNhjtoOwQEF{>r{B0U6BKM;#-z_F{75 zbB;+aRvnli&1xBw68$CaHZW;=mcxaaW_{L>a*jVa%cWEZOmIw@3>;Uz2L2qb%YTW= zSGoJxj+F0=(4w7t-IFnAoph^OzUG11n_5`C%Q>cSX?% zcA84%LXyaN;^$OP496+YzQ)!l>$!(G%FBcm))+yx^qSl<`n9UZ%)^__nL!X9qRt_t z86Az9PF2eAgmClXW$H~!vZM91k|h(oH!fS>G})@ulTDl74CHo<3_u0jg=a2d1eV3? znITWh3L5&+V^7D+YL$%qLM=yp>d#LGdTwJKZ%d;1`lD~~o~|X@3e-d0rrHaY2c%>; z*B6{MExcJlRYoCJb80IU9;OQ}_D7Gpr0XBIUGhBsm(C2KBcIAb(DhaPe@f@-`SPy4 zC1DKY=6ioNQrA-}iWL*S& zw33gbrlsY%y*omqdf3MeBy=@tg)YK%9EWSeV{vx1WyyZj`+x6%-~S2~xj2TcUcv{% zZ?0YZl#5$0gf8EF@_ekE$ac~RltnSuk)!!G(wDY*t{vB=2*Cy3qgWD#54U?}a}6-) z*SWpDw6e*BVNIo9WPbfB#f_IrKc}3U5H{Jd7tA|K!~bX+9qHbVzh#vTE@tMMoP}#5 zTI4Wil?4{40IlwD_2BH_3)(l+9BhJXGe7kXT%8dgGlf*vn1L_mg_4{CYd)=O*(XwJ z-jdTcaq6X7$ycxPM|YsB@XUbP2}zt(WX&3mq-BaJDEo9MS@`D+Va$cL$$IDOt+bNQGw=IyG+x_N)ie`~+; ztiB`36GS%SpTZ2Kv>hlun?BoVAY?1kw*ADlihWqx}H^YCt+V;7d&Srqrm zepkT*tt78w^JI6nKc^a~NO(0Hehy;mIY3R)BMrQqOQ1V70vOBE)l=@eiZqUbp>lH=K^;~euWOt?5h|1!TCe)W(NJT<#6%-Z}OOCSyJQ$Rrz{x z@eR=uW*DOq(0p>)Fc19#R#@wKbAIsVLV2jrTNa+miwVj4;ECz0S?fYm40|2l7KsqQIg*@Esv zFcHb;@Ku6_e8U9iiAo*wZ;JvahO!FHo1IS(L^Vt8g4YjuDQMVp(;l{)>iPpzpznEk z^F?Aci}GNlX%x@kQU&Mad%f8mXuGh!SCYCuM_oW8Xk7k%z6~RzECp5LL_W*w_2KG% zFKW5jEg{Qdk1I_BEv?C7Rddq3=2l%d7bMXd@|pm7rgqvEDHxMwrCCVUFuee7eap zVB8yg9>v!4P-4psw=>Um-Fa}suzxocs3fWwrlIP5*zOdPrblcGzEXQV3*C*%hXlA= ztLeKhuuVEyR_1{dB)~^`v(CUQMi1*dbq@-TbGOgfM z!n11k33v?UxqMd!*-W;c zX%DfKlXLQXOFc|p+dc5Cf1!5YnmRQlqgBEX$#XIxq+f`_z~%fzb}*AguI07$N zDMNW)-x~q`fB6tUQJCKW9C(=22MCz4cH>boFRZLg-L~>fvnncRH{Lf|IyzS9I8VQ~ z2W!r0^l~lP?V?-l)rKAWuuMNoQGf#5yh%?;{xEO_KR0E`(~t);i@>`XHAj=%_GYz}1y4)0sfHj0v6t=*O< zBn&G&%}l*ZbeLU^hO4GR+F)ZkZF6QeEdOja!16r`J7zSc%&pquFH+&Qi0&2)+z4N3 z4L7=?$PzZxO$c&dxvz_9HWbjN=Gc}R)?4!kn|wvSNlN!8q~+Q7^NYe7-YQB+wC2i3 zV&n92_;7!+DI>=@it%$&4rLH~lIW#?O0*1|zYA|@5J^Sg2_tt<$3u5z)D1r6t1@M! z91W?hscA4!X)XUE%vOEu@}k(F-X*C3f_4A5bqRbhw76@nb%@Gysz#$wVVuC3{H|uP zRaI-;hw$J16)i$|AJ~Tb=ku!S1J5QTC0tKjPCB@L1XKzi5$HYF!!Kywt(TsXF7xD_ zeZbV2M?mv}qFQm``Cfr7@xg_jk6X5vEtvgJ(hDM^Xo()jn`$jh;{}u5b8Z+$9iLQ3 zinM`~gGRN>%Gt$l--O{zsUt#Pa(N^(aMQa|R4OPbJa^3bd|yyzQHnoRzuW(nPM$=XlAKaL6H6i520^}c%|uqm*Y_mu`FZ*Z zIAu~(>YWL<>PQCeua%+Rv+ z&d+Vb<{`>bzeV)48bmZT0nbwFvY`9cPg<_#TfBCgNVo?#M|U5*Xxl;%SJwv9POLJ2 zx*u*v`(Ek~Hl|41;OtWrV5R~pvC49DHFoMQntWi6PgQf|(uB-kmVokGa*u^|6d@8dmm zt7%ohF!xv&Wi8~mX_!24Q$$92-H{(+gzsoxkSpK)R&qpes z3K7$JvVN-%+Sv{PnIx#QPdov-F9+ z1ew5dpyb*JI)Qt()Rh87P7iFw5?rA$pDfmGJkEHEcyzD(gKRi5u{wV}(|p4-f2RSv zgB{Ews&N(ta?wU`1|?;Z94C1iFZ^*-l*#O+x~c(z+kujKyju07`rPp;nU5Wc)kM>}}pso{=97ruJTJ1#ts9$wZZ#-#7(@Q}0jxAz^ zRm?!v?6z)}ndCr~vPR<<8_TfB8b6;(+flW$WhKvq_quum=+f1E%X*3xiV{xH<&}Bj zf@-U9SiObcJEtf9nh&+slO{`t9@ec|RC!@$$UGUF%PgL7v(@K!Z_-xRJ)*Zwxj8q} z&B?CMw=6v8AME6%u1|H$u5MgZP@ivoglrNubrmlOb%Q14r_dP?!xS!_^fZ|q z4U@gCZ#XZjJTK<6vE+s(G}{c+ir>(grdjfXgJ7K9C9*a6 zk+GI=fI}y~N-!=b{cRS2?bBy({b;;4)#?$?H{EjmcOZtfdC^S0cJ=*z2Qh;xdr zah~=p3|0#(8NY{uY3wR$2-qfzcuE=fs8KM+CpRzwupJ^m=$Swt9SIP(eF{`u}J z@A)Fm8#zsbi7$1^Y{D4xB>&RZp)I6Chysx1b7BQ%X#Qw*^?h|5?r=9=^kk3V7Fg_@ zuO6h>zFbY+zD-T{NEJ8T(8#8hA+FxL^0I*zQhw1=VUsNIhvo#|3Hnm^$`es`P{R&` zlzd4Y6%-g5pl0HE^49Zgm1A%*BO_yVM4I(8a9T~U_~=$`z` zcWRI85)$`8=RFr?CIecvs}s$9#!mCD>o9fdMhsuntu68TbBxUR7N#8^Z{ZT%2OOy> z6SWa24ZLnGFI*HgYz8%IU+Bf3y=Ol@e;Bg0ATLMi`k~ym#>VW{6HIr*99uP(NN@VM zaIypg0^ZPw2Ujar(9XSnJ$s3TSIK2>`ujDTpC_O07@BTCN^~f^l-UvW2FaP@fyR#D zx8)bHmS+a?nmi_mgvaduqPLNFuO34zV@YEe)Pn`MNTvl0Cl(!m=PI9Ijv9<{3L6$Y z_n0wXqjwnCWtd%#H0`A6`_dS|clKs}s6`LB$i>fN08*-?7sn|J?&lv9P4|7TcV--4 z^Oo{hb|4(@{O(BwMpqEg){%}5>0P@5w?qSQwX}ce(Q@qGl}cz@vG}=c^X)8IBUi|Z zQ|Qyg*WTc1Xqj^qEEF4P0L1g6(nnK_k z-y60S`pk|J9DZ%CIZ|~_qFq-jvXFRDRLGQ%mN?JPD~i?Mi|Ha{d3n3eF`^`Tpt7ou zv6r-cfnGPuFd@I?glOAsq%FnB?$vSiPoEEIQ8eG%yQpv|L459|sJC^NGAmH~3q*dW8^>Dt?K0UfC2Ab??Wtpiha& z`Z1}o&W-^)uciZcu4)Hzx_(-?cdRI+lb>%o?*w)FxblB^lhx@kQct8r04R_vFw%J+2L>~#B!VBnJUI|*wgC!Q!QCO?4M>k!d>C4tC z=4cVGyW>ENV^1eKv-2x)dw%VuUpQsl-m(gw+0Lzx(4ijmDJ6|M)dvX9BOXZz!s-E_<`S(1#JHGv{sl6=@Ojxg1V(5Vxo)-wR>s?3`oJR`L zWwbL%k_328W^Tn8dg>ZhLuN2%3%yik5}F@Z-MWaI%fj6N!}9|-+HMFN-U^45J9Tz^ zsw&iYAUZhN=fjMv&JKlX%9{lRQ9*1-Ec^Vc(~e6_huIaUkR>)eG3)sW*)r=%tejw* z%XkCt=m3;u{x7?zai_~UA%i2bmaCoEv@h3>hbMMTFcXyyUeY+tbv1+TwE3zm6( zrw6+LZfxq*(hkJ$dPgDhUl1is5)2%Ciw)vS zwbeZ&Ge_h)k{WP4Mq9`1E4^twmsvfKtTU|PtIC$4pyaX+q?aC+JJlf{QFdols>HdhOVD3$tMFW` zbT0{_g3asA48F1-U`3dM&ih%)$od$1#cxxiyj+&KRa#gRDWdvH`?&sXXqbnv$Gq*O zrEKaqkuIHAQPx169LXC(yo)-z5Ki zHCiMWd*6nH5i%0=1hO}})E$|dH1fJnq$)Obto+EeQwcGElhyAWfKKLYNtcLA1X(pT zFRpLzh<9|@4+>%fnX%eA&r$L$>6kGSrp~lKAk`n@@Enr9$Qba|eY)i6?hh~A_I#U> z1;o~}5X(5AZC?ySN<((nQ%rllbcIB$tWcZJRu$>k@1H4Y=B4>=B?ArY#U6%QltUs2 zm>a8D8|pDOHDOii01)-NSna+#SZX70#D8Xgd$hh!iq?lTPa?GhjpgI3U`f#`w$~9` z##3}O$|#PT6Q6S|DlZ((M&)eCygms$H7vUin^J@FVE6apW0FW5pkJEzZyo^o4&(i7 zr-e_qYKLiSHhV4w4kK#MK18gBZANTaoz7n0IXk+ygG_);&Il>&{tTER25RwlV%_5b zB$5W;TQ7-txY=2H_y}&RczgmAIo4>VjL#}dNXV3q=;6*js+034x`cjhqB4Nrd$F5H zaYE*h++b9^It`7!7@IIMoN@X*DtoH~K-RJQW$#7s&;>4miMY)t-soqxLRZ=cey=1y zp&U~EQ`SRsNU@mrNik%82ZsE-$@967}hwz?X>q&)#L@D1Pqr8%N zA`iR|;A@dTebTp;NCc{;rCQE0F}zOa<)yY3(Y)A_FG--E zNC+Uob1TL6lf$Nc&@~tM!2oiZlX~8$*nAyLX1DD*>0@`Ha72vUv}-*#Lom0uKhZlm z7zfWbfGWQHsVaPgIeijA<$ih0vklLp3GlnYW%JQ8q3<|0!(wSOJg{&kQ0>dMtr4y+ zczNr}nV57KiC=y)N;>;w4pHRTGXlygNX)^a-Z|Sab>Hjn6(P~AK<8K=2orWsCDs*a zgevEB{jpfew-hI~*)G^L(QU1rwd;hC;l%scUs=euok1vQ(X7<>Hx;ZP^EF;;CxR5| z7Ru3n*5DdUdX+UX#`O) zpAwF3^#b6$tG=#{uo-Qo#TvCHjL9~_ETrn5c$pUV|*qxzStHaduK` zjJ%F?W4$$V&n5;1uj;+?(8wx`*PS;b!s(~?d)7>i%fw=DUZf!(o_xCAc|6tBfzXq3g)J9iZN41UM!r@QUlm-UdRq&7sy%MU@ z_){nB>&B1}XH~1Z&=IpI9pql;pUuy`cPI^64?vMp7L_F$k}p|T!K+~?7Ih@`NR7L; zIpz+c+EW*l$8>q}ZCo3j=8K`}N1Mr}*`h@&oyrd*%Fs8lkBx)3n1-BG^)`zn(!>Maif8_7w zU8;V)gPqg^UZJ^+mOE*qakw=N3+HXC-edwWkpZ zo(z{)F68t`@3OdU7P)v{yf*qsdn?@=bJ^4CiHpodNV@*?h-1M=C)K8PJBWG%GPCqV@%)-4GtUp&J4|_ z5ktK$(#|eyoQmEKrFtjy&s!XYEXam&*)Th(dm zx=c0!0-$UjU>*9$Q;+HCd%`0|MbA&5%adST1tlfQ?-gk2;(=L(g)$@cnLW?$1b>c= zm6Ky{)E?bZwKO`~;#8aNjVeeq7Y2wU^V~%}w3R z6NK9Dky+l5ZXXy_X{ynqN=(uvvh^(rQ0W*FiNSiUtLvQcXI&HT!T>{6qV#QMO##4+ z)xMH!>FH!awz>ZHuN@ukdU5mhE`8xNebmCBk5)4}Mr)Qz{Q~mIoRi4sVje@tQ~(SW-L zhXru|zL=8IHAKVLuUCBLl7VjPCyR-3rd?Zi;Yz+LZPhaCio2l2N7GtmvMjY5b9?U% zR({$Azwa<$>qg&#E4Iob{bP!Xw=;)sFxaWeyl!XXH>&whf@!vZNR&C4R7aQj(y{(n zZ5T*lB>Q;7xe6nn3f`$pC=dSqD~Aw~55Y=KXltg}va?NmP)lCH-6!?At)ar#9Lm=R zlg+#rG11YzMWDLTUUH9q9(j>wph~0`x^uD89-7Sqg9X3EB4OcPcvFP$3I zLlPeA>*_c`8eLHC;%>P4QN(?e7hW5);tHI4!K}X6&n_3HA51)(iy#*JFe;DsA>GeX z`l*my+W-Vs-+cNmUUc|ex8Au=cG-4P*3G>QB!F= zGp!5UYP=d9Z0-h*M|lJoLGOzNd-#$4ffU_&lr0ChTiueswy`f-=6V8f)*y8)K$~Qr zv^>n|C2Iz!2p)ZqDto%eJQriey9^pLfdb#g`&~qh3WWCPC8;nSAdpz z`?@4f%No2P`P-;Mr=gN71bAXY+?$EhRM_+SIk!IcOP_6psrz=3rx+wzilV^XB*Cb^ zv&)|u9)%7vFns5_mz|uZ%~NF$o0={U^a?*vS;DJ?X6E2I6id7oz1K);KYVR&-_3FkFFgVR?D<_IuCTjU&*ofO?E-w&i;A zl>^3-s7ZaVh4RyG(tcJTP%c5rrQ{4-V2+@ZuYB-m{yL_96~rnZd3wr2$VM#>Ouu3r z%?4RA*Nm(`^b%7YYP;>euGOV7X?sLC3E91gVQ0~$=Cl}l5hn~vE7Yl-Ij`FZT{dou z2z7tpKi#zt+^!EmFR>GTqZQwY*JS|pwo$#g7^cgVj^X%DeCyr1yY7$`?!(3zCC`sw z%GHP(4ab}2?^2H z-9$KxQ{7OiOHWVF!KSIc2Er+s+o2s{?4&-*MZX6x|5(`<&yJV1*Z#AGZp=y8e0wdg zCdhztB#=qX&sYoI~?`diinW`>>@j9IhXIq4GK z>XGENjfwf~VdTNK+B{BmtcOI2*Xgq z^@`y|m*$JBqlxrfNpcS*8^RmOoSnDW!c|qABJ=P;p+`Vhi`w->LP_-l^-aoxb$wUy z;@Wfc0(qFr#j%p5;>au7Q~gv!J3j0$ij#JYhX@x%iKPnYzWwUB87n|KRuk^Ci%feI=+r9=m+= zt*<0$9^$bM3XhJqSnYy1Ce7KcH%`bVUB9x?I!cVo$+u;orw=PAsU42b7*6%%BhTc{ z98sw=3>a@lIrccn`)CiI&e8NesMrD5??eGHg`!Jkd4X?nbmxn2LszksOSt>bU3+s7 zZ13We&MN{ZN(ied2*PZE1eN`4%1+r@GRMP3{1|;JsW3_mDR?6yv-cU z9FxfZ)g({|dfcxz2n+XBNX{g%w# z;R7y!2Q)V`VJmzi&^IGwfB2YAA^Cxrq-0+^_B<#J3@gsXko+k_TG0Iy1P z-m(?!icOeR2ADNU!F7zLgV9lZOGy+8Pf%cB<;-Sv2q}MeiY+-Sn#umB>`h32DVeBO zxfkdn0Z*Xy(lI4X6s2dkq^@6UyV9tqOkrN(Pa6iuv{Rot$N@iM;SP~O0I$QEW|sSH zTK?FS2OF~ShnS5~u7uC)WANRAYcpGa}R8-Gtf^D_U zUUmlPRR5$emI}Mt@624!mdNEBT37eH%Y3nB9N&?{nb`qdI1V{0Fg!2W;rc#4exM%J ze}!@1Jv_7iL?y#xYjpFqjIEq*PnD~NV<#vOCNVEBNr_zlx!LVFz{mDY6M}Bt8L33d zn9Sx-cG5P}to1mMlX+RSyFi~bqB5;Doa|?UO7=Vn0*nqihksX0CTJ@J( z8ySc@e1I9t@w_@mG!0Xej5l(GF&K7|JR;?*sGczaxcbGIlVN8N`3lU1 z4%xaGLmZ3HO<~C0MSL@a6kNl?v&-ZXRql0I^Yma*nC#1g944(;)}}6jty0lU%Sp$a z#>RW(vB}4NE)i*uIMh690-QhqvWIl1O^9~6W(Z*mB zm(}CXAi+zZqOW`&g0#U893EI$228rr3I$Fg*XZfr*fP(F0|JzBrxn#D;(_^y7vJmZ zK0k8vzA*Dec|MvTH=wUD-fWxE;JaWralXCHloN+Sxa}oU98m)G*K*vM<28VHccT&t zOx?J;0K@6d&ZHB)CQ2ZSR^|7E5c{HwK66^;BTAW=nxfoA&m%fM%AI9zx@gr2?b7B} zA%2ot;(0P3s>MW%fg#8(U5`BlUeQ1^Iq{k?LyQI^_^w&7+&o z*%!4_KU8T`#EM*hix=lp*Y^-DHIX~(RV@I<%mAk!qyd~DSV>EZ!DY^=& znrx=j>YDkaH|kqQ5mOk=<4>uGHy0#)0Ui(0(d}CY;qJQN@2@2PfhU{Hn`*o?@HYMLlXRV>I3i^5*44T++NVrZAsOI z{3>@XCNLmqX3w3U1~!?>8%SID-JkJ;Z}xN?OUK@m?Q5FWtdvCYCqlSV;bjs0=;Mv< z_j_^m*fZbkgl4?cg z+WbZpu08gODKRnu+3Yy-Xc%r_|nEQJeQlZbf1*qxEwl;*#{~@M>G2%<5w=a&8Vg=7*_RcI>P54i!3kns zCZ2m~xs6#lIRdoTvI%C^45-s9cXsjdjS3s?liW8`p`)R*Jd+4!Xr_xvY#4l~KkZdH zf^Zdt27XP;$tk-Nzvq){V4W4=em1_)h&Cgnzsc3R?k@rb=^JGW!+`U5SPhFwXy)sj zqDzM!lsQ42HS2BOdOm?uH3n8#s$cqj<4y52KQA9$fiwq7Nd8u6^apqZUar5pb)iV3 z&win}Eg5xbo|}{?4V#Ou|2d^#D&G=saxI)P+`5Fnpi{}q%S+g-VIeCUX^2esbs+BM zLgf(==5H9}^A=r{*FhvRqG{FRjT)7T&IeP*|30^mJXqkqC?b{cIDm4^Yyj0 zm(It}_V>+oc1~Sq5on@jDr_{f1^M~wWs>y5K5JY;PJtTx{3o#~Tf`40o)f1}*d3ZB zySl59P%8kDs(R<(387=Bl|eyY>sgm>;P_-JAYu}YaAlZjx76 zfV9=-J-*aV!y3tOb(cW{5+N^;iM&sU2Q1``5`y$=O|1X=M5*m?0&>saJ4x3?n zz@noPwW^}6ehS6BH>GK^`M~z02Ao=swm& z?DpTcG{b$K2*Dh7Ld#|f?9gxmvb-3vC^_w_uTjMe%4)6WbxtrQZir)}=hZ4n?Y_Td zh0x6u;w4O8mT~k(1wZL}ep%CU7CZkjDPLp;Y-wfscu2(p(&V~p3u(IgwhLLw^sorQ z?U!$SW3k*RJ9ADR?^z<_Zs2#gHLk0YDu(Zt&NoyM$;|`lxR>S0ApC9uQf*Kx4lzGB zy&}zT(BPB^F4~DqOr%6cM$R@Le}*A=x^Tg6k}z}F281(KkN5G6!CfhRVN|tRPM)6W zGD%#z#r3ZWGfj=QbSn#Da&iu#E=|$$FF0s6PcruODL)xD1A)z8l) zB%H@ylK00`y?-yBT`VpxelSEO-$Nr>{Mlm{G&LrH;5&jS9nBQeMFx^U(czIvc0YFm zCi6z+wnY9{#*Ki)fcxg%RsLeCh@l&ZS<7NYRpN^O#07F=l&_5Jw6|VVZQ4ChJ@*JO zzE3N)nI3FHggbNjqxGH1yUhwIGIlZZe0(ggS?b9%^~N|hzTKN41N#Txn3Y$UkG`zW zzshohTr2GKllNb~AggFhUGGZqrmwzoWbB*8F6h^BJ9Cq$ruFug&>I8>HEWM0Kir&q zP-B1i;tWzQpNRVmIsbB_-6cyra7|19ipG+G!axSHkV7JW=fA19?>T*ox5^oW@j|hK z1wi_n^$c2zaiRPyT3QpipFY&0h*X&OF*~cm9G7VaT%27u@;;Zsp{1F*idQ8S``@MV zBJ+4Pbq+y}sE>t)6ynAUnk;0TvOj#7=ycqAqo}4tle zET2+XSYNF~kMTs_U4_eLjvCT`r8hS>SJ6a9wllMo4@^Mrt1vHlh;V*zaA4fgJAN>| zu5Wqek40FhdqfVq!Stz~d+!e&2um z%wh0w&fY7owbr%P&TV!1vKp{Iy!p9=g;^l z-tqY^qmCNM_N%0-)fH3{I7QN_GfHIJR%!P;BzlK>++;dPXN?@U{K2OqeK^$0}XU+T1S=jcP($5 z`nB4EVdhoy#Ih3)&m<{+nGmolG&tJ)8Ch3;qKqSX*#cH$?9LQ@i!VzE_6yMRmoXsP zE<5-06+ZJFu<@==&(NF2ylvd^)6J$in0r1L5%*v@^V(&hcwgFI4o6@abNIV6#AUmK zNrjZmzN>EQ>Y~i@m&2Z`cZUkE+kOxw>6G>M?J@YK_jr1}fzo7gzPlogXaCz{RmSRg z{6m_BBrL^rZRZ`M=Fq@*nI`M}iM4C$Sn5YRut&?2)6*1XWo7kr7q84w z?T$D{$`*HQEevWX<*Lx$pyV^uGMmzJwvC27mPr!>Nz2d%GFO@7-9zzw!|!s-@aCgMoLO4E$yg)8B%65FV-Ee5&P)KF^+xJc{%A=UBhmkk&ws1qtN8m zC;RdLJvhyyXT~kO?nQ7@v9@;L;Xzk&dUt9J^mOM`_&)3hr?)pXiBb+A`||E}-WZDO zwPp9iE9yuJInwMPnY3W_&ouo~SNAl|c}KKtd#6ILBhJCma$|C+v&&f&TN*0;F*erU z$fBf5hK83{W9DSfxAHkA4TLXcx3LF0Ofu=KwWoW9r>!-8r+CNbdhklqy~FO1e%||J;0}m+WrEw za*Nlz_@myP?UrMBna$ocy3cW3+Q}iVjMY$A=avR*eUaT2jUu+AhHuU*onGVVl6c`u zulCag9OGS?bpgd8C; z*gDKd-47geX&%d%>&>jF+@5I}`b2qPTa-ug!f|z^KUs1yr1n9^k*>Fjkl#(pKwd6U z?#>kW0OCEfmA;J zx&c~QE)wqI$b;1iHS^MAV-#@`(=PdwqS+zFHqc;K3WM43Au+wUbjt9^TQ zYFk+=Ot83UUNpYi+9ug$WBm#s944_FDdQQgjeD;|o{YLwUDxh(3pDM4TxYVbS4*8O z9IJjPspRuWZ>Ls@wXN}b?R41*uTfUNTfEplNbRIZKDW?{VukHK*IG~*do*Iy(a{lk z^%h&xs{7&nv7^s50~T-t`7Fo<_rCxEDasnRFct43YBICxz$5C-c;9Fmyg^F4<`#ZU z1>F`reEen~uScR1oa9o)Zv(Ek881LveFe&pRW4zhY(xETg~6mKewnKa$clK+@*8NZ z*%{d1?mM$bP+ip23zLrEv}6%ZJzP)uP66=@Lu2OhrvCK*VPHtUM+?3(FkxO3d5J>KhEE7L9hvL=aUnw)s9W zkAsL+ASvESs^qt04;fAkX%*XrS(>n(9+u@Y9$sDw4i3oI3r;1&PLbd0Rj1?7CyP*Y zjc?rLhjz{gvGDv1C!ld~5B^U^?y{qXSVouOrhhxOA%8 zLfb`QF6>gpE_q=?-Z+Ia zgw$wNE~|JId5KvO<&OLx%LpDdoVOEp-l>nM*R>QI$Pb1E2j7png!Rt5!kfheUw!#x zB~}M^NzPf6CY?YY*xgtwqlN&o{(54r2jTgrb)>T*cI$E~qgd}3L=)Fc)j0rjN1 zC3FixoT%{D)+{4uZsS$UG`x73kCuhm$ww92m?MjJERVF&lSY&Na#ARfuQyogNIjxk zHAyuF;~D`esS-&`AzBDh>XK2qY&#kR1Dx14bDtT5#pk6tX+`($nN4zYPgs~ue zro-Y4+^M;aDrMjfNnb{jU67Yge_ngBI8vPz(zRutlhc*xC=y=(QFK;**;`S61>k5| zG92U`WSS3Sw=AFx@vg_=u0_Gh40J7RZM}Sx^<#I*I-+hb!=Bz;*8R11Xa3qLxUytH z0_(VX>p57`VPd^7j6Goie&Kz#XO|F`GQ3aHOTspd<_TI9$^}*NHph(hbMJ7uN8@xGqYl?Xak^Ju5V|*1ff@Mm zN;g|OT3W<&s_gt)qxXv+z!weXVI?K=U%I=xB=s=PxX81<^)y>V?YRn#u@KmU!y5uYNtJMFGK@1fIziuLf}|IcdHPb^&X5)}gj1JFPtYQ@g%s^`KDAnVbTzE?1q z!)fI&o6k{sUUj**ZCTvM3j}^=nm9_`tcl1T<w_a>Xtk;NWX0~1o*#|RyW2$I=XTdF{`IgU9%M#pLr}Ab=}h# z_a=v>$CWbOpskf&jp31zme_qD-KkFT_5Kq7y5rBX)vms#*GRl~@7}Zb@8A1z@g`|L z=xy8aN`He%V5I1z&0iJ!8-D*&Vt&GS4o*&Vq$A^9ZtC5Y2I-GMQDknn^ZJ%mD>CUm zjD4@<8LZTc*(tMYz3jtT?QOIa5bJ!8j<;LEKnu9J5{3|j-h%{9%%xV5;E#t%sRleF z9&W*cpJqJVjC`0rOBNcLpBLY4wFHZ?QE*Z^N{UwN{>1XKZL_z(VYgVs1Gpla>7j73 z=^zd8UecUzu@IK|ye6OKMI$`822#@Y_MU*VoUZxSB`Qbd%+C`F4fgi-HlFXhL`)I_ zBL#6qDr$HPNcktE%~{&Z<&vt5{I=vv?J$e5wa%GDhJNp0^ zJckHmR$tPb6iF6U7h5}_W%gzD$DJ&Ek2L;rs31rJC$f>{UthnEMU-!QKp!fr)F+s| zG*;-d!$yx+({Ze`fRK{9;ORuKEh)*!`&>chL%MqJBL&M+BN6osPVI#B;NPjppQ0&H zb!}~PJCEc8k)}Cg_0d81)Gq&VSlL*6B(L*C3IqbtprNx?``ukmL763Z~=sgDD@Xc-94l6SizMB0WTf{KKt^7%V5Ac$W4YGd&YD z@`Ra}Nnv1OraT9;VI*<-?mWpaz>Zo_97}R^RK38Dw}%jrc+`|V2y)_3+acl7zVi-) zuhzrO^HaV}2fj{w>DImZ{`@3a1Xk=%b0p)AibdQQVli_>u2%ePdLVBSXD~f!*z!oR zIFg>VZ^t4oe&>B_Jg^!yNJz&_lU4mGDg_}Z%BfhmXYBO3T?CiZ6xw;ubSHT2o2R_v z7*#_;<^2we&A9z41NWyNwa+EsDU z@HVw#qkXL9p_{Jx$5+>8m#6QGM`YtK_K}1{Mlz6aKM_$#!@?n+ve=?Pu)PAV1fNqW zqe&l@e#+f*WMk}AEb8P-D03(+6&>}_8IrLLe7rB55?o=Rn3l+o2olIWJWw!~2Flb{ z;?_KL_4ICKs#m)uJy5ND0zEu@?6`Y0sOPnx9$;iNZ#9Mz*qDVq8gX&D@^jM%zrVM8 zUO=`(Mu9gp(srjc9~D=n%BK)$IVdT(pYdh?kPZ(Wbja?*>zy5W&`_pKpCWStTL)A5 zB_&buj-Da!E9C;i!|MLfs7v{UF74xYH+n1M{oo`OJI&bqN4Iq>%2ms4eOM5=ALKIe zXj$o^sSQ6JtaQmW5@LE2oD!2-OkWH=6V;F{)9WwGyB}hm-QOA{G);$fMR_oQ%m*D^ zlxeksOmDQ3Y%7DQAE?Xpq;xfCjR>Uc7W%hiBk<6_Z2{IAzk@h*&ngEJDLGi}(hN|D z(+-bxy&qKFX=_gDJ8sWe5O&@M^&|>Be|{afk?+-VC7PSN7gb6g_RYbP)C#YVadlE> z`uP?Vy!K{|)M*H4@o=k3QEXx4beIcz0IVz9p-#ApH8e!XpGYi5srN?XHydk2U%?S1 zFzPdzPghIa$v{J0sH$`m;6&hKZ>Vo2LmjX;7qrV zA3sXi+I|X(ilV@DJCL_q6%A@d8N|8SsW4PxMp5g11y@=+(2DFiY-c3j@;lRD8Mmg1 z@@(Qotarh7#V@BRSXTovkAs%EcSV43;NTP8;q6#_K=5sgCfB*lRxx&R&*uiyNgDq* zq7scRCM*#FdH(r#xONd?^%(rar zE3_+JhkFpGM3T*Hl*T=G>|UQ4w_evb7)4FB&)e<{JqVA(D#r~4%b;pAoy;Paz4iWl zyIOsfA}120BZ)@{MrI+YCgP~Bx-f-5CNi_)^})r3I_7erOWr2csA+D5QYoc{_nNq0 zO7N%;w;O6+JSQ<6Zv`GbN;JA%<-8koJ@RT~uSp+Ji9=oE7}iZQpM10}Zo9)$o`Y(F zsgf~#$QQiSOEnS$$k4?%`(U3;z1`k(nq65kp>JszUf;UX(OV9W;oeSTJ;3 z_2-N|AamO&QZmSUR=5~ZN>aS3$URlfu1PUc@iYn!3}9%amb=!*W}wkF&4w+E)@%CCTOSg3L!R(hJ4k(9D6FsT6 zO50@;ukN4S!!!B?3U$B)Kd+7sdGp4bjbMAeH_6xTf@!;f_4KN3jPBrjRwm=A&X54S zsf!x8NoZRzec0untsMV%7nw1%tYUJI4@4W!%+bwz`Xn&Ft;A@I)T}wFVN*{{HQ&a( zFTdRU3(uLqdI7nJIw&N>xcs1JHuYV}@{i60&!g$J@!EXL@jKbPUHFaCXq)m)0Cm%o zIi_FlWMF4kW@5sA=iWUL$z&9}_jgb2;SpQ2GU7a)o)#Zz2D2OJeUFN|*HQ#>xr=6G z2e>7+6_xva&iQuB7qiPn-fKyijx_{tf<5uaZ_Ra=V1TJWZcn_xEGCHm0CwuIDA|BG zNXzX&yxxzalV3)5JJRbg{)Lut&Ckj56NI~;w|1wu=|n3Y^4im|9&v9$ z-IQMjj&uXQxZ222ef-H*T1qOIDh?h$Y_rL6_d`6Nv_{#Aq)5nJVXL}^v|x2sxE$Sw zcva_TzSqi32eg+TvRMr3JAJGZS2muemnE5+5Im}Tk!MI2u53#)@2cQ7yW-Hq6O^*N z>R++#1pa4+#aMBXy1n8{fvPbAdRaxh)QtAvcz212T-DsR-I{N(B5k*f1TT1czF5Z5 zK%S1O=22(A`rs_n#gKC&RnEMaHv#p72iK6{oCEzffK?#j=90m4_>F~Av)wayvcVVI zlao8r#nxEfsOxS=Q{}4r{Y@5b`{mvR)wdMujtm@_#PiwOQ2NZ}p4CG#)2bzd+lZ0~d4P2nQp2}|1cHzdi?SazSYbt3DHh=@zK^;sHd zhh|17Gc0zYT+-Lo4>#(k&EOIi5?bd?N*Y>}|B&P43a>Vi_lHMs8+;~90QZ}$JG-sOj}&Bd0y~{C@D3K$E{YM$o6H!v*oyI|soCxRfbU)-%fF#~B=_N0Ookxt`oQqD&z)AV#YcK>#}8FX z4WpKTmvv`r@WEJ^U0$XD2#GDi{oXDlVs~rp8Wj~)l4b{ltJjW&L0Un}f5K#QE&rkG&z|&n=($QoL`L#fDAZ;pTH34HoU}*9iy*%G1C?M)y?k}7mI4# zY4+lWdKQRAWOImI(>b`gVfIuAx+GAABhti4et;c`sw{&|fTzG*U6_iD);?1Cb*&(k zvJui4qD9F})QBh!K=pc5Jk?>o5#Z2S#TEDsoRBB3f9;C||3l#^`NJmSPK(y?yTE)J z2fSm;PS&c1o}TI19R`?a!4<3J8h5yD8GHNdyfBPQe)L!Sr2u9`lx0KP#4Kz8!fgZD z(^J(f7I4L*=uJh2rxRGDd$%^GXm8fcddk0f$%HtD5umQ_}q<#3=*+l#yUewN;K z?BYq^;*r#BnOKJ?;n{fQr=k1rKg7xc%gzAP2v)}@c%(AzL)YaL6z*Nh$9nHeN3Jzl zf0b4}+o`q(68yNRpzURE#{1Wp%<7~00&4_Zce&A-jxwn|NOw4qbw+z(6nvT{t> zloOe`T zTAafkY2LF38}7al;y{I$2XC=ayG0d{zV5h?*D`13q@^`huWBOI{=7nyV(^u>RiW2t zZgR@Kv=T+T07_`xSnrp|-eQz_E%Vz>{I1#Xq2+QSl`6?q6PBQV_4Bv{-dYrxh%N9) zs8V+ne9aSrTeXJRrwpb4hNflOy@wGXE~K+TW`{I$QP6j z!|~!>7Eu9C@7#7nx$~h6f*k%QgM*Fcg?vO&F3&w!$|-f~Vo7J8`i7d-wsqG&4w#u1 zZ9Zl}$HHLbb!zT}w;T|O-xd=EC&0rKeI&QO`T@>ju4`NX ztQOXoI|_VxxJa3v)WP#eK~=LiGkKRgcD9T1$C(<+xyR{2M=~%lK!*4FSiFCVNI?^L zgB-I<^Mk_IpGe~~Xn-NN^^Fv-;E|4ThdK>KT(*sp(%)s5^|r@u>D6TvF~K*UI~Ca}+R~)+ zIV}uP$YElX+Uye%S_+a?saDjR!S3(xHzdDIdOI=J)6t`^1z8{tE*5yb;ok^Cw$nru z2(RjGGO`vFyWmGKx!zg0{ms7}`3FHke)9(HMLNo&uFo0801MYw_(Wb!_cVto4_u~Y zch5_Zv0*~{>mvL?ixbMxq;PQ+cEecNv?_|TrwujZ4mV(T2CGV@c6p^gay-WzD3MaA z;SJ}qeaG0xIQP{}^|+&sR&Q}fL#V3xq|D)sQr`jO5xbfIzr8*CV0^@F{-X_dp_8Ro z-nu&UJ0Ku~HCS(yrzk*fcBU-&seKQr z6AS*4==^QH|JSFFEy&liYf~gM8Bg;jsnvXsd3bs5Q8#K$+z9a}cSsUaPehyQjs?|n zk?PHgmM%P#={9@*5a2^pLoo)@LX72Iw{-KKO~Er6A_vLb>8cN*1NhXIReO6ZA>Wd5 zmr2{aP*N=7SDfsZxn>K>hKS7fI~1)n`>8o&Ifb*Osl%0y+B#qYy}JO6o8%6%<;5j93yh!x|M0-lBs&O2@44 zP7e_0t&ZMGm7rm_7Td05pWKHfap?=z^OL22c_|MaOkCWL*U~BvCjl8WvFhdA6TwgS zQi-oo!OFRXSgeueeb4g64lDqE%4->V7`Kn`{ zY|eZudyH~p7q6Nh%+F_m_DI!^rTHvK^@P)W)@$H1<4=G3Ii7=Ct+1A{xPT)OYYLZ& zN)5`9w)5#pAz30@%0MKI-MGOv#^(-&s<_tw*~R1Gk#t!>Un|2Qdr6qH+1@VSc4~Uo z1Znp$Cd0M98I7`)&p{-nEA3@csH9mT32!u&ci@zmyqZ8&$dP!G3aGhG#fi#)>#cjL z={%nva|rwMrd0E{cF;U?uWaJN2|O($dcaVr8y{e8c`ed@tO!nU_Z z$JolXVdURdrwP*117xXVQ14Adz8C@KU>Bt&r)K)vEL{7f(Q@!IgHtR}R`AdZIa-P9 zLp+gI?<|e0Gy+!nhkXCwK*slds!nXcnT2}BjzTI0Ha_MXkTX%YD&)*RI`Ej8 z7@weYqzW)9kwdyzuo>_!(A!>eEPDT3aicw7z|9T%EE{%@_wHk?Y2pa1Wtdo6!18pw zWFDxwJPyYqiJeZd=KeRUzNbun`?gAp?J~|A^#8RPr;8^;hYa$Npty`LN{I+!JPS^X zVoW2rVs9YHE& zZZxOEc&27%h;9VlVpqbPV_zTj{x&iqnJVcj#IdEb_E+2lZd!924N#HDkJ?vne-BEP%G@ zJlVFZSMN8Ns_h29kzQhuPVNrcN|?+KdGl>ySXDlMb3s2b4o8B3LYkdb+lT8D0DXF7 z>YSfbj3`Dj1ZeL~eJK;PG!AE;F(Yi#Y-!E7j<8<8=Mm+bMsjOyUU{9X_*^h#bgsd~ zltocAA|9&;(hTQG2#{Lj0)Dsz-@#!fM*NR=AamvFG=_hs^!GP?Ifv1HUCu^;>2K}X zt1)Q^q=y8}%imU{8F{?}4N#2w8aov1i!o?EXob;1;^Q`?h$Be|?>hybTP*<+{JoWm z{rUx0S6AI7x|4^^G?U}wr`dMK1rRw>oL0o6{;eE_hdwnsE57nQ36E9&?$z z>;iSj751y)NCa4+RB1d6Ev5_sTy}>Jb+JZ>D)>)Hw|s^~Mde$18d=>$kQSiDo&xIW z9*(k}GagQOS2FV!K+0s_RHtbRBxyO7EFTSj+^<%rpqcuwsr9s0)@}&U$bT_yY&4MI z=|{wxsB{~!lW#A`h&*{>!dWey+pXF1>9MzN*|GpSx+naBc9A(NX|8xA^(l`$G4T$d zpMl(gc!{}&E&$Q0ih!d(`VH@&kBq3Hp7I!n@I|sjK21$cCYwg>GKaONU~WzFvj-9K z0VybF-sn910>o@wTwE}eYp436(wQ$6uMfPy1fyINr|1gXi?yDakabql$SXK&Nh{kM z!C0OY8{9LoCTs2p*N8euc}$lJ8l}R}|7&$Ux#&L|oCvCzNd}uWsf0MLL3UUqi5$fa z@ZGu!T!RX)n5*BFE;T#Aay*E|F4Wd8BI#W1;E!zdig)iu#*71#k%&BB$e|KT)PN}% z&tyTD3dFzYJ(grjn!!z14Gj(df8j9zE<0^dObqQN^hogFloq8Ii4`jN>Y~Vj-SzNT zFE>P~J@eK-zbLx*Lr#2my7kg5aO!WFHF+D`{cec5GyR!Ie4jo4!l%E`;E++#35b8nuYS3L*%Io6dKAW05yG{DvLPwQxIj#zcy zQ=up0Y=v|)S05dxnGWG*5>PNQ*8CfRMIhl3QU!rT_)5}F8sG7h_3{m(A@#RcE1q1` z9MJmuRW)oy>~Dz}aNq$Tw3#08fybX_@Pr}eB?Wp>C**EOpn!Lk{Lj0#47btx!PMk$ z=-KF!A+lZ*c2Gx;pC^5*Gl;W7qJe1De^M_q(e0Pt$(Ha2JU6;V<)sLYY-hj}Q7N?y zj!;IbzH^s5B8rlaPnNC0JQz^+0a1%4TeT=m3UrKtc_+c4p?A6MRw9;R_RXMzagT#q z#%X)u_EjQ>TO-A0W4A?pnnJ=9hPm&_Vjb?F z+ibANByedUPn-!`chD<-U%a3GI}S0i0!fKJ7HWnhd7`Arsme`F;hMD*Xu3S*J6gij zIezLJ(KzOw8@j#7PGpQo@N=hVFxG#OBz+nvA{SyB0Gm>@Aid{f9P_B8A2b#f_Laf;lAppk>&*WEx zA;B>^(TO?&*79Y=7<{CoI5U$B>x1({I9-9nVH#2QyUIl^&FFl7%j4w%ROq3#NeVbk z?AgopOH-NE#ZA2g#od`w2j%VfQ;SWYo3S4BY&PEwFft!t#Yt)Z9#zSTm1u@55jwmLfH1EcyyyF>>lL@aDx4y2ZZ}Ml? z)BzMsPgOjbTShll%j7Bfw_fLA@s`GC3>2Gr%jOzTN|nm@+$#Fl45*Mm6(h|(-BNWv zt5Qg0(ountZg9ROD6lXoCJ2JkKRsZk&MCRXJ@oTA+GN68^tSFqm@UL@O( z??_^XHfP%rcTVQ1=RnVs?srOVf)mR#&oeUHPDxJlJ8IpbXK;{#vbJ=yATS8qCzNXC zoT5Dg%#v*}-i?YnIYFD{whvR~^tJ(sUZ*F$bxV1a#cLl86huMSj@THqs)#SMKPw#8 zFm{)d(_2yp^d;=W;f6Z&Wx5G{!f4&jhfM|)+!cGA<)CMFB@^ovBzfgiZi-pOzh%J+h5}V5I&CiR>P_;;6!Gw1v&8iT zO}10v^YXMs9|_C^SuS09m#(12^}jniei~01)ta_8Nhh0C8v8NZnARisjeYacSujmt zt!u<@!z8!b3>IId%*2d+(^mJtuJRvh^z(~$XpPSevDhhboj7x~ z85<4t(iUaLCs|`&{<rK>rafvWcwEP>LM?ya;rTLEJD2I8aV&vPLr$ln_Wu(z?A6U@UPo)J9 zmRXnh-Ez-`XnURZSAeNif3O=>)yHd7#Rgnfay6%j`$ zB-MO6R3EgiAr7KoqAny_wVaVhW8Vs|xyTpdRLW8Mxa-Rm(Lz^M7IUYWQ0CtdL?9fk zn35E-anrRX%CC18vb0^X>fTcxKxXfI9~6X_IzPoq#OY!>?6xZG@4)sq66nYiNJ}kh z-%1XZVqV%}UQl?0!MIbu$RG-$xkB?^xkdSIe!JzNyCtK1g4_~aP>t7>`*7c`&(Bf1 z%|Pd|Y8mKJx!x+R2x-H>Q?~>iDP4Jwox5*hT;_N$V52}KOBTMfDjiz2j*c^Q=Segx zrd=3CKGxsYgo|1R7)K?T?JUCo&~f)j&pNHV`~!iO4F&rfiq3*u@yzPBh`5z!=H}e+Yc8M$@7AOCN8|V zZl>DAAM;|mprblCNWX0g^i}$L3$G*jf6zj)U(7DW={_kE@Q7b-7@ zGsxaPMcv|d9v(hZm2ZEdE$$Rz8Ou(N(WftN%7+G&zj%%B!U*Uwqt5QdJM&!>s!l_F zuoEvR&h_u*U!A)>1k5fk`AY{GF;uEftAXsBsDr}?buO28keZmkG&}uV-R2vO1yvWM zmgAMe;9K+eAJY@wJ8jv&c(qb;%zC-sy+y7DG?SzTyE) z!4d7O0Ot5OsG2-0v+{RYuVdfX5bqd7HjQ&vwPyVL+4et%Z@dc#2z&mRAp!{n?h~IY z{pP}oxjC3rN}$7^dH)~_Pxbp>7rCbpMEb_6AI>DD5>!#y(w4#}?JNRqt?h!}rM6}0 ztwevgN5i2Wu`>8VqKfzK8xOa)7k^c%ek`FEVy^Qpd$<`d4T_A9Q+Q^~wjC*`Yp6>* z!BPREV;N8vr%ru6o&tlNZ!bQvMM3L<9Tb0fb!1n6&}(1CRPZQ=**_i92@rE(DN}Od z4922xAkqC(Ufv}te)?0yx>eAvJG3bsc}qkFZP9td$6I&f)$V&%^UTw@1Z`J-@^qF> zARpIL{mPTKkgHd4khcYY00bGzz<(m+<%PUZJGpk{w_^S26DxUVsw6ET+Y%0;gRDEK zj%D?b0Mi?>JL;&|BR&p5{(XNU)~p_mf59D~)g(nfRZr=RxlVwiW*Ld5HYwEb2usO& zQV6Q_a7}jMkT{lQUHz|bgp?pxab1kxDTr+v$QUkEY>5!sJ*;%0n~TIaRQ%phS64S@ z5x>5@9qjgSw&it2LsJLljM(g)NVX%0$#+JK@A2<{@#z9uY;|CE(mSJ7XqfJD*fdL3 z73u9=VY4`-Vh){m+K0DrT1{Tz#r1VA4|aw2vaGq_6PZ2fM(3(14oUe%)e1eKy2|*4^WJd zIX6Q^3>?1?pWza>^LmzU$srwyp|x7G1n(fV)z#LuJ&Ryv6=bruMl6zg7ToP*g5-UB z@>XGA-`I~xZR9>D=Tnftmgp`oFTeR^cQpPXtS6Nqf==yzNnkv+HQ%v%0C7`q#^mG; zy@kSgtC6cZ6ufukS2HxKcz9E^syB;V9=*sLi8 zuP`t$lo_{DJH8w$*ytr7YYIyv4gd7`(k=1I?Y@}lU9IX!a~%%pK5#qRjV)hb}5rPT9l!^Rk1bFGF3J zcb#8a(_#@XkB{e&3=IHi3dZ=qpF2Ci!5WK14#!kNvCv{nDN_sT5}vj19Bap58^0hz z!#Kt)Pg+F6f!>$uJoP<|;=W^igz}-Zk>>9CJ_wN)c`&0b@Ehm)%yl0+qBBo|UGz7qPpSldk+<^>;d9~&8} zZT+|(d{}T_>4m8$otD$Mdp$}VHeAowZ{!-r4wv-j3!KW|oJeG2N z+$+4Dy@LBa)&Kg`%JjTNGsWZFAV5*>FO`fR<(+P#BJFDCr`uCBQFeuIlifKTK(H0F zF?APAmPrgpK|z@+H)$~3PiawV)VrG-Aug;=L2%{fo!!yh&-joIFlPviFzULQ%j62* zVrjOQ{*XLkG9K^iU(VddVmctB>6FJ2q+)KKBjGlOP8Spv8X785YVwh-3d7I=DCcyd zU}SU6m%CFlYAcLbX~PeX`ac>|3sj!?vhC^ev}b0yiRaOwYt^?GFT41T`82y2GRk-uQ!5~Rtie51 z`mSrmAIH)nA0GXlAOOOryFx$s@wTL-X`T)I-vohenq{u_IPNK^^C}KrsWdn~)Mh!u z?aIwgX}$y9)I#%-E{J>-z}i!_gRAc`q*AFeZDZoHw|WN$%f3R*R7*lmz{#b3Q0rN9 z$7O%}LKo16zcG~Ao$LyN`7Gq)^guBXO7{2JuK(~YWCFoDs;36`?#&hv5s@x0c_KW! zD3EVUDl{DwyBi-JZ9GLMRjJcbLypje^N&Q+<&R0opaVNnS<^LhI8E6(%>v5%7@tm6 z)x07@!4-NubASOe`UUU)pm!iQLW1O5cZa^n+GOSISc{LUKeR`$`*cV#+b-b_d{waP z@xqu+^TIYCQYOA|XZ735!SFJz@&V+d;NSN(7EaKU(UFZG5&_|zDq}@urAt#|YZ#cZ zqZjeebgqtRD&$K@TpT@3LOez^0WK~%m=f@yTUilup{rlhIz^pz1_N|1e)>qfzOxgd z|K*G7=dV_m25Gnly#P{z-{5pu3z{P3r2(Vf6ncuj!a?pOm^Je_>rIR5Z(D0LPo(El>A&}{eg%?FmAXb-I$THRG-u7^ftW=oP?#b&pbSJU7Jm7IMv z9n!8%b7_|b)GN%B?op-P+&(^5JaN{)a=zQ^w^jK0NrnOSluPL(t2XZ)&F}6h3l6MJ zS-!Li!U15U2)AFpeEDxK%0uTeq`>WCkhR~cmm(sJ5a2|Pk(-b#0^Pdb#wzTPKYzfN zYkCAGM_uofzM7Xxfzz2AVrTPf9_d1+2S6??*hWg@lPV9SaBkjAaHUyN$Ph$3#>B$v z;!BB^QZ*ee4TeaYC8rjXdjY#y6O5*?CT=T31A-g18PJRU)Kx*l!2vT*wIp1{Z57xv zFyzc?R%4gY3>c20heBw-fb5^L6@WG*r#%K$=(Y|ls**5noeR#NS+!+aexvN~dcW7` z7+Xs$$zAK1t-zKx>Y+|Co6@o@9xkpSLjsee(C;x=f4Xx*A1Y|ztCKUapRNDx+QFxq z`=}FLp%T1zUVW9&6J`Jj{g?|>CbS$4ZLO!8k~d#b85*FcdN2k$}$-_uL| z*&c3jIp$r(M(@@ydv93lDeE^eOc7qyJ$Ex=xgTFHtptBh5>hfY>)>a9T5c221us4w zf@KH#wBKS^C(BLF|DL^aPLls4&edoEB(#pVEps(T0D`V__`&DuM6}=jz0O(6=}n-t z4sWK0Z*n7|bNu6NDo&YLa`~I`6(-{=XEw}3^hbPHmE1E0!yZS_I4C|Qkfg56M00r@ zj2_Y{14-9pd2LL@+Qd(BsCkLj1Ir@?liUi;U_!^Lg-_VbhVGnB{qX|zQZUNhune9d z+m&r%kOa-7bKh?qX9AYyMc$el9m?CkBSa6%ALHZZA!}P}jLlN`RCjZkq@-r@|Iyug z&g=?gV?O&ipL5&76YY%Bmi^?KxdJShuC9z>JYvnB%NSt-M6!i@2gd-J>n7#7jT0s) zo!Ah6>Iyo*b-@I?kchb3&w-cj=;$xp0=5$*p+YNGN_!Qg|E?lu)aE$8>L8#aqw<9R zxSbrGFi2qM;_a+^S7c>Vy)Y7AkPIlP8K|kbXWRCFx7a?&&h9PldGkK=J0?>Z71 zs^F6+LSGxnQSvXLs|2lAbbL9ex&7)1a#L)j6q&cRD__5Dj(FIk$(Z1FEX6-9A=7YLHyZj!j(iZOXub139}Vo2hrc)_xp8>_YgHt23nh?659J zXdvD&8OTpJIrXRC`TaA?tDbM)I>~l+u(~N_;r!N1Pfdy-6{Q5%BE@3fz{~!{bvd~A zo_}?FCnd$9v*_R}{z!|~H2xCKxJ_%)bRUhg+;Y!> zHuao|>pVgux^-)NdB#k&_>h@Swea;Fw~-U!`ZF}RGtza=@ci+TV;p&91$T>kypiY3 z|K*|&k_$4cxZfmuts^{e&4c{S{-q3U_p&noVb{858U_V*Z3wM}ZxLc8^8zxjWG$9*)_eBClW^}=TW+Afby#*;eLJeZmt zAOF7MeDf@g^!x+;$t9fm8SmqSro5~6%0tZou@x-K9|va~VI;f7bwhE&)H?^Yr3^tAnGe8@WKE|<&KOBQO~>p0wRHct`>LMo zV@}GO@oqV7FWl$DPOqQzm$`&fTUR-@Xt{_UNWL|R!Bh%4l| z!mwsGY7V<|ROJFpxp7OGRS+?$0qtC*YFJYGE8((@h-chq%v@&@TFyu3sGN!w2`zVToYaE2OdU-DK?B1H?Mg zk9(JsadlyFA;Yy8aKaezfOq}ykFkAx-QpYf=M0QG5w`>hwOk6!8cFK)wisCR_uCw= zJ{&n*O7Hcw`Q!4P(aFE?a#Sl01u7=rnes_>LW-GBPvOhC623 z)Xeq+`QT3o)Ggy)Bqo_UBL9n0aNYS#r&rPES|$jRT08pB4Xc552Uk>{NAb@p8$60Z87WA;D#87SMf$0yEsjikUR!B9ZCw z@lSIQk*j2JoyO}G_!di)O+6$=(bd|YfXi*eb98pT&rsdT!)`J1slvQM^wI22|{izUkJD~#Il&&$4&L}KtEjF#fo38(c*Tdjf zx`#}CJw3YSRCRf)0I4jjPWIm@ZXi7?ijjDXd|F(#!#6i8kNUJ0Gq2t%vYAg)-TEHF zw!8J!H@A_)`wC%}wZX?EvZFPt{XK^gN9@?YNeI{>4zvstV;k7=?&;X&_Ao~hrYYP_ z_}&fa77mNDY31?-Vda7PYkwC+n<@|4-E6R?nCPSs@tIb(A~|{cXJ|)Xzkbbf>6f=# z!O&FQ3s7mbSV(3D$FW3hY;7qhwUbtDHN$9V=zAw9;^*IsV@KVT&KcIy!`qBuc7Ch> zk$F(PGhdp&|G+mQ%C#2fB5h4P^6l7z&=SwwesIt0Q``x5Ep-6t}SnSUfYf(%roL)N#V)o%46FXl@>D#P9Di9TI^fAA^fs> zx<$FL+`q8!3gK*P6f^F1(!K=_uCtr*4{5c;xLJ4T=DavERA}VOtXDzG^UR_yke5ws z{Q0M7w{`_u;d3tH9Pmk4L>nHyx0|CSbfC-#(uP$V8_1iLvn#M6_asdJ;n>*Bj0|J6 zi#y%JE%YqD`-CllzCK+~2|k*v=(ZG-6q95hx?~duiV}U=)RzdCP5;i}UmVPgHG7l! z2jUFg@+bjO+ms!pumL4jrU&)-yUFDDdo;5cix^9&%mS;0SoJo`7EKsQqh80ru5?haF5w^ia5#F$q z1eI;pU@+o(H~$ks*CVsCINW=}-xiA`X|w4F(T*~(`G~ z**qkiQPG4-gAv!?L!={s$F*>ZLWTXE9m1jMSzk|?tzK3iUGI?I6K>7WZDC&4-Mqaz zCe1!#^D54928}r~Dk^1ZNxiOadpMF(Ehg;@oI0=3rSDE-Efc&gW_5q;Og=E6$NdO) z14Jz51ltEEj`G*XpDz=^dS8J#mc0xKj^j8<9^;9Dkufc|*!9EAq7G-)GWV&{LMKyPjTK-s0K89R=> zGufimujO2HdQ@G~hxnJcxcG9NtItZe&c+(&7KKW-W<5Ay5pTX=m7jacDYE2PB(?6)qk5V+dWwDZ(4~*k1+nASS2vx+#3KDN{wQ6 zX7J|5tK0kijBaed;$&`9JlNl6%`LLE&0hIBIQw9!e?b7zyw4$fhJ7W5$%h8g*cdD> z2@1NC@z-%;5a@>!L{-pa45a~=auwTuMX*Ab_T2LS+hu2nfQ?NU9q(%1e))KLrde5Z zv??#ByJvoZb+(I*LUQlyrIbZ#TlD|hA=X0@j7_-YL&Eav<_(%w2O>aBYpRuo$? zXb|uK(%p?BARsLujUWu&-H3qF(hW+tbeD8DNTWk{_rSaHdCoaAuMc!;$~ERVbnex=u1_{; zJMs^YeqXWhH!{KpTX)h zgpr;P=`DENHPxDTd$~kr1J}l;+nr6N18C+TV+%GX&(WUOo;pvsji@nq;}tHH0+%5BIr~NZaL$*)1mA+;t}F>+6>!C2)<4YhIPq zwQ=Be#aQ?g;9kk|)<-_KfAW@$+1AuC8oKa%42S&?MM#`IJTqi- zBcAZ3uI~Hv-5sWG1LZbr78aIR$EpWA4X>}Krll0i`-EpnHLc+TEn8`@9tU6+h?IklXyYo@W^4V_1S@L(0C;x*zlGtzhQ zuRj1OO;9S85f_EXfTJTk{b7ZAh;YuT4XnmqCT?DXa}|%~D0dVn8Vw8ml@%z5Zh0 zA^WtU^>HSM5YESE#y!Gfyo2)w)iSfEl-g@u48sp`8KwA2ZBv3Cc(IK&qvb{d`@ZWpUfM zF(`!1_c5r-&pth!sH$`2K|EU%a<$;Fj47`VrHCslsr;yO-<3bjYo4RxrhW+uSN&Pt zUzP>YL^hl*gD-FzD82eWvV?#9?*i^c8xYPZ7lv70ke#IqN!N@prA9-HRAbxPsnG9p z^Aivd7|}M7k3(W+k10FM++fE=9B~rxu3v^Id0Ohb{yc8bS7=P9nvJ;k`{DV>u`H+5 z@EO_v0g=YmsuM&G>of3a$;ruic^7aglunn0TXv1ezHuC?|NZfCB($vV0VO40>z{HK z>fboDdhb*BuWM5!GEMlTRw24K8pr*!)=426k?z=NdFwoe-*_kWj>L-iWnQ4Sb^S!gQ@Ut}v8*PA`!Qp>UI7iU|Dgs9P5L`EvMb#=+9sI0>t4uAdh z`-kpH;TN~^1J}6>%tZ`wg6mdu*(Pm;U7U6viAOrh8`PJ}IV&&GW}j+SStqZ`Ysn^h z-tzB%*DpC(%8(e9Z2>eHl**3Ub?hKNge~UDU$+oJbk)Q}+jpk~#fq3{WJ8ZL(XsH7 z`z0S{Qv`Q?@dI$o0{+$I<=r|jvCyD$S&zo#8@CA(J`&%z-1L~w2!OP!kB#Lq3A8I@ z$twwkm7&+aJ}MN!4dXX!Dt2bwf#*sgT4Yb`dCNgHGa-I+C{2!vS6)_D)=S07v6729 z4sO)}-9!_$dLmlSp_YH@g5WNmZu@SE#;fNcj@(r*m0fDb_x3)k%&yZZl)7k`XlmsC zyITmtAwQr7f(;+4VisQAgV5_g8Gd=1wsw)UKXeqU=LHIU(i|D_}i^@whxDb`*EF%Ar*^h35gci1`+!W+il=B zny#7E)#Q_}n%m=LR01WZM?w!_vBkIXN*0nmOroI^6BC`8{ol*uI|dKTM1-@w@BZdU zt2_Z%V0{rNDAI&o0>9tr$+`#szgJMkZde$8XxLy^9>;SBh>0G_u>rr7 zi-8j`J)L8lk~10UkKg4dM@%v6EtwM;$LaP|0O$Z*JasN#E{?`uMtiBJSVnLNF4US_IQx!akp;oI)1~Qb zq0{}v8=Llc$D*o6H*$oH`t=tmsh0B)4|4c|HMtk8!e%ZNi*A>@z^;N2BbJXVuMtGVA zfT(7ObalDu-U~lItE?YCG(*arQma+YLNV#o^d-!oe#81}v*EhS#V@N4hiVF)VZ%Dk z%R?bU1ids{>0|vJRt?Vtbw@*(vRPv7n%J|azKC%3GZxWkdp(xqo>&6>Zb-4f+p9|p zKb(dV)^YW46e%faf&op!*$gVT1$yibo@6nf3AWAbXQD%VDhyBHNQ&uRji#uGW6I_f4@-0W<`% zT6rGUMBGC2EB-M#iv5tI#Sv-<>SqzqKFADO61}~1dm)=-1rPo>-CdAzTUa0;+nxtN z9U%A?(J08uW|Ga*Nm*Oxga-I~7ycjis`kL44%`IOL_G)bwObo$X0cqL7}|K^{=>2^ z%YsGofF9;F8Ek)g=%WAX>s|3!M(I?4yu@@!H)HeKNO0=tC?|kwmG`Yvh4@|LQ`o(C z{cw0PM)Ez$Zh>_U4GUFv^7He{NY7@uc~}II1h|&QB-dicraS}R{F~I+s4TX#UG)MD zHNjcuU4z+Km4~rf+e532Lwe{Gx2_XRJI2_tXcEUm56ZBi0F7qdR(DjmV7hcq@OCU4 zE=OWQJcH+3X9)~=A$6q8q%_R6!hj}x5I(_i&Ae$y(UNcU2xQxs`*TE#*L*JRUJaEF znu_N5hSWbw{<{(!!sR{C_&9emEi7MY`WrU&zRvwRbZ%CxJMqgj; z#9u++7u{VjcROAy69BjeO-^EY`Dhqh)5LMbm=VXHdM8Q`o=dhDmIIJMPFWe!D9j3I zE7_*IOGWY(2?@3O6%}QZ3JujK`oZ}YdjJs|rgViErX}r2eXnYR$=NSYpcQG4-B}f# z%HHQw$>2MkH8UD792_m_C8wH#G{KJd3ua@VNKJooJhXwv91`a~j7==e8n3K!sR@f; z?BHsalN*kJo?~mBovSUv(MH6O9UL!xO=EgRH0H!WV;B?w(qbIQg?jG7m~C+T&iV$|$kR~w)1u8tOvupsLXi+JL$00o;?jK?^F?< z|E3_VH#xuVqPvzzW<3`R1!y17*l@{i%~h5oeSHJ%to~d-Ghsd-L~#+sCn{H~otS6@ zrS;8gJu5f63}n}q2)hRpT^v-_E4NLmPPPoZ{k;bkW*S)6KRtl=trGsVbCuL%?h-h6 zCGyINpH=c4kw0P=yJ+b1emQ2^Miu#vluOrc)YtD-=V!p4Oh${`wZ|TSXkIB=B0qdA*bq;Ml`WBXrLV< zM9a%7L_xt7wQ34dBdZOKDrc+hY{L>W1U%7%PM^S+=GKcfjUyG7xdQ;BL=q+{Cg1472vkU zoR{tiIMYHrV5-#gMC4N8s`el4aK#v^clt|mC9!h7n}1t`Un|WAd{r-K&mV&31x|EcQ+*+=T_N+7N-a2G9)(^N-oqp`$(cWH;E1bN1%>GUo7&H>+9t8E^ zI1(Duh^k!PIx>$x)`x8l|JZQZzG@yleLk?_A@4nMTJ0-Pmu9i4_+YZ|j;c@T9>ww(wtGz<)A@u_GonwHou) z+6o-$aeVb3%gfM2K*9k5Z?p;biJJ4r5r{8ClR4skBP^J!!F6Viu;oQju^gL9C%via zuql-{D~SNzF&K7ER=}(_9vh0|vGexz{ep;OPS4zMtk~Zelky|;I@ncsR{M!Bi?fVs zaZ+*_vC35(?>Ul4nmsbL- zD=z)hl+(wI`e0K;0s+$2y7K4V-PqXZnXrM$U%xJ}GvX}=@a1R#1Z7v@p?+`j6&V5@ zwZYQ7#O#w-!pA`z1y*%g+cN+mpRF)}CP2AfySV(Y3k_Ew=cQGuIT;zu#>_c>b4clw zzhZHo8mn5jQjdkjcx+v1Bs`67%hS4Fq$ifat6reipAw^o7hg^+Ze?|Kphn&G>D#N{ zj{I+Nati-Qd)>#?S3IDak)0hJ5KzJrdk@bJO5f}>92~=}qV8NI0&=$LZ^Nil+Gwi2 zF=p6W?Ek}0{k=xDET}3O2~#<$i{*3W(VWyg0BrSI|Bi6i`htp^5nyFr5B>@@WT<=X zmh|2hROKJV6BDLh<0~O-bgjt!wDg=_Fr8UF+&_efJq+zfxkvxzr+|#bKA;wjwoIyN zWMCkv%3)jX)yu5XZ@Ra!O%EDdK~_2nt|=0_CE3$iQ`xI+>TAWf+tChc=Y;ngQWIO5 z%Wu#b4OgFIbG}-4DSa8AbMiFRUreU5zK$KxPj@H z9+_@3s;J_Uon#Us4?F(Pw=hmvkuE2kOy9v)ZPr@Bk(EiUh^r+%#WqSQX7 zx)`{U6pQ>jHdNDlDsx}&6fcm zVVMw-j%j-oW8)w(jGbfNh6j&hQrs>nySVr5M+Q5+ANY@eG{p9Xz>sQv{|NDogU!fTLn>YZ* zOGGNe5cx(4puhlOsq_F$I%!44vdOdVX#cOaubZPX#&%r3=%!mIud@ypxVVI#?kvc5 z4q@WlONm!M(_%6~-@pr_f5m03v(RhTO-cVH{=~^CbeY^z7hhYi^ISsceCt_id6S69Um2TPdb{L(<4$drM9J8fk0 zj-6uLcx)oqnp2CTzjWc3oHbVv2H)%u+C39`r@y5L-95y@+i3t7ftMymB$#1)T=T0( zLZgw-x$E*dQD=YUEx5LeB&5L7!Vy4V@#)Oi42S(P%niJ=`&|o;ZDJz z{3E`^gQ+rzWM9^HxAh$;;ye&y9H4y+5{hY1Ry#U6hD5OEi|c^lO@P8uf(~0}l$~(_ zn(k<2Bs@fXm;Dh+^mc*a_G8cH5zV)AD6RK4mC6l*2R}+H@ju}cbBAxo0Qm0*swe5K zLA>0mw5hZ20iqU;uiJ))70!M9W~x5`O?_ob)(66uYx;gPigh-Q+d_+?91clG%W33H zs(0zK)z69|r^;Do8|cEw5Pv%I{*+eo%gg(RxfII~Iu$+xj91zk!ucyXR_FsvUHbdbY&c~Z4lNKOQ%uTN)VZIr|zhAFu#PGzztydVtbc&YV!|PhnXe3B;W2R3pM@2>L z90YeqfK2Nu_x=hLmvaYwS+Qwe9;<^>f!GtRe`=m5eLnsy6)b%30L25VrBa3{`#oxl z6%fS#87TjrI#cFm zGYY>6!ywPBd~W8?jg+a?e!yy(C{QpM&S4`&$HOzCnzNbdCzFWLz}#UnHyF-lyLp78 zzJ@bTzEolceQcqt=3ITHvH77Lp3&a{_#A8aWpUipD5X>YktK5|LhyvuWO9_&W3fL~ z?}(${a_(I}(C-_|aljtP=eOP?D9~DoND8|e2=_d{ekCV4z_!-PQDN01g@PtE+i{12 zY5Do)2FswfpTkN5gxmBc-#K@To1XAzOO@m&cQ^RK+r*jq!J}wNBXENU~M-vpZ1@{<#t z6Z*(ZY@}sah(%F1IuN3(*@_yP}8*Q1s8GNWoA;cI|f?l zs>o**{#WrIpHtn!PxgA2SeAEuqMZ`~;clS?K>I^}-&)R2uxdUs_#-fd%H@fYiJFUD zlT1(3Iu3 zRKs`LhzqH-ZDR+;w}`{ujN)NnpqqR&{38GQ!}-_IUsdTCMK_+D&jLWYJdT*M)w zWa6B-9mu|2AGPXBdwujB1FOBgefctvn;txNjI{R&CD#Xr*;;0Kdlk#{{njd%Ppx5D z#uYFE*lw>Ev-XzaDsDFsya9q-FY4&hsH(h1wB@VkNi>gjRf!&vi1Nm%WmvJ}HiKTu zYBsgpn_AZ)lg~)4!UWmNLVozPP%&9>DdU`Drb2G08E)CZ0d{iIitb*_^#>Bepe=bc z*jb|Fl$X~#$0Pst_X}|WW$HS1JP#;is#C;cv+}fpW)>IC)pvhD5bHj1A-9?^zp=P15PD%b!b ztJX~tuV#IxE(wEa|Ia*8=zL$jkx5Z8>~35pXMW@OXAb*S`vHf6d^|g@O}-M0&9}`Q zX^ZT(<^Ay3gbE<>E*%ay$VnAqmfORH3P^RdP-cHPSJn~nhpw8603fckg8tO(Jl3mx zU^eB;UCJ{$A*9?t-hc4#TVJmbP4ERi3rpJm3T~#lkP5#AOS`SwN3wa2&peq>Y`h@3Lyz1O!7_5%C562bu%5ZkMv&I(L1=>T*WF(m^%^ zdX~F>w};#vk8PJj-0sQ0NQ9w?+}j+jWb3c|o>0%6nB@A_d39ck1i?H_$5Hr7XP)Au zZbtS`Rvl7OQ_9CcXJyanAnf~~;L2;{7WtidUT~YFGCfSjT7DbJRA}GH>6E`C3#MFB zRIy#`-o)v|@d-R2laP|q(5P5@eHY;`Bb!Za>jTrWx6Y61>cYB?cGan9cmxC_a13W- z{03IJLc_wo-JrYrW8u{pfDIOp#x>RY=&Cu=bEt-Ag=*O#;|DtI>Nr}ss7jky6 zskM7fJF0PY9r6rDy1onP%N9^BcGKFzKhpEC%ZZt>fGVQy%!)1*cuxVP;BJIM>?|=r~ruVImZDZW@aDGPr?4N zZTfjeLfPSYdnzrXZFAopeaB$%J^b7T{BQmlkfz_#uToEHO%|T< zXZLw;Gt(}G>`8uoj%b{2cWw?04la7ePh@p;WLZxsgR4o_@@^p+0n$?O*WSHmT}i*R zB}T{E{omx2MrkLnuaEJ<@AX3#=1>6j#e99vz_7ToV*Mn$DS&W{dP?Riw#|HON#TGX zf*OxRLT!lylTiVf50#$cRV&7S(tJ4xa9!Dw!so^`k-95xU04xk9XB6R&J7<@X$T=c zCcLu%tL`@W`0hP|luTz!4{#eIYSs1-Rrz8H9>`25#<0KrKSkxwH+`D%oQjg8&;tZU z6t++IAmWjXdE&a~z{Xe!U=<+n@4#<*PSKGk9)%8g+SfU0=^ryrS_6OTuYYG~#2mS> zjU@v$>8co0&0`pN?kk=9XYB6?t?odoH_B^6^b| zMMV97RbG zX$~~}(wBd{hR?-_R{5kdSGNAbYy1-UT=_+hnVa)uwfD_i(nB`Iq=TWNbgc@1HQwj) zZ+!^=DOY~3%jV{L--KX`pRR_4h2>zWE9uS=9zoB@0q$s01&cfHN&1G%z*ck7C`d@Y zSrcCTtuwrU68nfAG$etWKQZ-PO1j$$vsF34}ZJf%)Fz$f+EzuykjsQ_h~!a-K9UwG#B<;z`zViwR0aLTi; z!a>7DH&Gkr{PB66H=wO^LTk>~#X31z+35fO-f(kss{rIT+N3J;*yYRx5Yvoy$@-EW z7vz?gE9FuV&#WhBf+J#ael0HVm&3=3AoeM-cmF z))z}0lt*7Q6YuencVRyG(=Yw~VFH>8rZ)Qvlc+FCN-C@QiJB7FWnVh6a}o~?w@8^F+@LY`s1=cEiD@($x;JPR(Kcw7~eViF|=kAjzJDA?w88IGOl)z zFD`QgE5<|u8=t$jQUVNJibt3#`Jk2U^!Wg2>q{eV5W*V#`r`{p&xb74Y!~HtPFlDp zET-I*fT}jf$xn*3yo7Q|pVzM+f?K1WM!?rUIbkKNaXOZeQ&3RWy8l3UsmeyZU%aMt z63{Aux{&>TtjBo}jG@>*%C$L51X2q~vm~7AL?xe}9qVTrK0rhB%WJ$GOAJsBlW6k9 zq}pG$#M1w~FmQG`o3KC06Sn%kqBxfXpuZ!SlZ{?6F{|3MS?)PCvvlL*)y}TK-``?z z0cG`mT26Yecul$7uE_G zgzqH#!LM>G^%p&p6r-l3_w06dmdolKhRasT8kV+|yxrqEG1k!#S2TDhEOZt!LZu zXG_7!@vQCe%zUKv`uR42)NLgO|J>)OqVbyMcCo`=QnBKmHvvG-%A(uzy#|MxoVw8O z5Bd=cN*8UKA)FKC3F%J=5%v~T96V=V+lzDFZ_xkps9#9=+F4&~e*4ac zUto3DGK$~)S>>UZeb;r_8~JiyYQ}%b4%j6wLOWjpmH*EyVu05&a=KFhIJpZ=Q>Uj5 zy%d_iEh#QuRzjy&BbnuX{DNH^hN9&1(fsMxyYo`#q~1S~6~WX|Yu-C!)t>cn9LQLR zn&LruT+~?%B_*Yi9psB$JL`n`@&r(6QEB*L*&Lnz*8M7{mnl4u?e>5uP$@zy+UnV> z5SquJk`*~8-6dA%J;5P8{KdW2n%#J_))iFnKAvF^TryzLRcha4an)9p`&U^^P0}Kod3Q0-H(C~Fxd;4-3nL94*vz6by6x7xX5%N0l z^j}C#N{ogQs!u`XQ8ar^!nbze3%k)|w4QjJd{izI)KeLeV**ORbvmh6uM8)+_4*=@ z4*iA~08%uXrxhMrGs{-f_eNMB{d=#FaD1(_OaxeX{FC!B+r_2$@$=?G^mvAxfuWgL9h!@6*<FaSky2)4yWA(871cP0DaVc z52QMu>{yz>wa?!WQzv-qG5jz>{JAVDw{zjws9__I;jdEV+l&fv8m%U!+Rh4;XfU=6DMmE0g z4MJ+gZ-Rl%Zt7aJOE;7wE2y13dA#o>Z`_l>4!FL{({=VvhqDUuytdQ)nc~0StP5_% z|4bONC;i_^pKdu=KV^}I>7d`JumSR{<}_QF!FDI~rQ7>?iJr%g8SAK!Q&W+T^QW>;YO|`m;-P(X+812s>jF-#v1V zdGxQK=f%sMfj5DH z7>UkAL|E7-oOw0FMj@?}12e|zXI2xpYh*xp8pOiH)cmuhgt>0sPY+j%$c=V!ssP$e z23Bd(9qWgvlH`v)YkCbaJ|I*-NFk0t;U=oe=Y;t0P$)DT&*UH-C=2Q*C#^{V)d6oG zF*#M)L?BJWY&v}b$buvUPP?hLjMxRJ66wM!))YCOzmJaR3gNT5UCRipF#dK&DC@Hkn_>S ze`uAk-N%5&KmiaSt>(v692C<1DH1ZzpPM?QzQKq4$q0u1^J{BG&`m8Yg4@w|EXqqO zDyRT;VB2!eezeHkB~-3s-J4J);d*L7@Mb+2zRpy0+MYVvcj4=0Z@y}N>FtrSGMyzl z8?*n^#HpB|pr^7Oq}~(?w;c%us6Y0 zlBf%r2_o&L8}z}!Ae~D}{Miq-&c`@>&RG(Ct1nrYnZF%5pB5PWl5_mJJom8gqNlaf zR<&^ZZ2~}GX)GM;xVYJ$;n&Ci_p|&8H?dhJ)3$~N`8+V=;>&qDJDUD8YB39i(tz={ zb5a@UEu1%dMq(qcD+;m<<8iz$qlFy0vpAOu#}wDWLvxmIYpX}~SF_3UI+_0h+8hr+ zcPPIQ4h`n*$16(#^UyjJ!++5o71r(l>)Tr2xm;|12c7`K|( z6I=dl7x#4a^<{t}qfhE4$4dh+Z6LlH8TZ@AzJNj|QrjucxkHl}yu(k>&+F!TfloZr zw!F!gU~t6~$O@fLrX_37%ByQ>B?6jbCyKMsCLjEkNqE+#R7Dmy-y*o1!%xTu&cVzz zUw`bRvlM4-9z%y-g26$;kP-;tFS04q$Jc!&BnFta=UWfBn`|TddVxG3PlhzH7Zp+M z*#hk!vnPyi)lR87Wos$&$74(9^UdMv)*onLb%KDSt!qH;^t=5A5B@5ly4vlnGugKT z2XQ{Y-aOYQOrc5F;e5>5wnR&nOF!mZ?Np?{8!kFhEe1O7xEz{kK|+2~&urhbgu$0C zv83lC+pL3WU$B*5m~LHu3OlCi;FCH7Dv++ZpWCq5PbJr@$dc|qe-tQ{^xPz@D96Z% zoLp0}eQjy2JcoBUe-A@d)j?o5zgSK|5dHGUl&1@%k79QwAIKO_#(uCV4Mw^CcxG}V zdcSOZ`z)Rb(seku$-DJB>+6)DRcMf$BK38*lNS=>l5SM+7-Ov|mad*2#x@pJ zXlQ8r8qaYPb*IJ-0oVBu_mDp|}(wMwO8rtN{1Vh$3Y1wJ|hFVo}h z>gRVG6=rXm_iX@;Z#A$|zysVgNeOLgGFZ+^%aR$h+P%FMAHX}jb(P6trXO6PVvu|4 z_u{!o9|9(bea)>f-*JL@(~a1Yq3#0)Hr9QbDg5yqRp!k6cW<4ekcZpy1lu>jDT+mRbMaK7qi<)QHfRn2izE|Q*C zu_@K};ffdo-*3GqKOIVwy|d<+7@^+H2Q6(JBqr6{AImc`b4#DEtgaMdP_Cx6+`Er^ zpCnw}JZ>B|uMAY?vDy!2o>_HdQk@dxD3*=d!o!9qGH$VgBjpq)syrm)?dsvg?0F~@ zpQOugri5aMdTqKO@0!25#_(EI{=(9-_Ea@6M}GcwdVjx)c?l*2*Y4kAcp4HeY{g^WCMYcIy|rjxdD^6`D%gqCzGsYD3 z6g^J1)pOI!EV`A5wC)Qn9%+3ho(ZU_Pz%3#{Z8OPFY)Xy+f;b=m`!^aVX=tei~VTp z@?dy9hK0o198IUXg{0{;-niB;b@!!iP}*}2BzH zwdwfo$^^`1Sym-Exx_V_-6g9f8%Y=LgZ<{&Yz(?xq`uOx1^LBT{)6}Qb_bu1f!@2Z z!nz3Q!#8`6F z)2p-;y()%uiV)w%Xk5g@!^`8T8$J;Xr=p+$_a->Wz$%X?y{fvjv*yVZRI6SP*dJU! zJb-qSu+ilX=Y>s5%gT}k@EpD^EG}vd5ot9)dOHGB+InlpG_a|6wcyB#0DdHrJ*u`k zNT7V}z?EM01wAv0mcVCAtgbBT-d{+RPFUO>XRtGyEM0|>K=*^EcCWeM`+_N zC8ISuot%gIgZi7Bdtu4L)b|w>6j*X&)IoVveE9n`d%EG~E7d18)%RB?3l!J}luSf{ zOhvnvWR-@ag?s@?Lu1?LcDjMpOggvR+yKt3oSaW|^*C^jt(F1RJVP|;Q?er7ye@=p z(+z#6pWpM#$G+qQbs@X&cXK?&5TA001`x_JjQA-=_s0t)z3Vgr30=lhX4j9}A8s`n z&^?!t`5e~XT0Ds*t{07@QVNH+{@ix@g>$bfBPErjM)sHHJ6n7E9ox=@h37P9^#RI* z#j&xmn*?%i!|15!hW`W*NL0GQKGeK9%Q;vb-8G+AUt6`70Rlad+*ZaVKw?HxvOBI1 zGuD8mT6?(_qV{oVN$G<({v$Run`CkfYzNM2wF0$jHCWY)XvQbB+-EN)0)0F1S^WKP z49~*%&4C71tYBHWZ17v+#-S$paAIs+H|f()KMdE&JB?_TQ2N?#lH``Z_^a}gr_K`< z#0mW`nr^^b811IMh$1g8W(^8?TP(%JrQ=d%{Qdp!Kw;@HrOD1gIfFkCFit(?Tq0uL zVLS)AGwt3bd@m)%MDZua7H8lHWDDW7lR?}Q2Mzq*!pr=g>>#WqD?bqu%%gpb6o(d~ zUBibzVhJS^c1TGoRn2j&&eYak07pR{TDW6LW8xeamV{KFBYF)mevjq$kwLn=L!9mG z$)w%B07sy;6yTm}AMdGdZBbFpOxExu`T6+ZB^N7H?#2ORQQwZwg)jRLB`m0L$XR}@ zNUo4do($&HoGO_W<(Is0+G}Jpr)Lsw%*Ztf^ddM@U@PqjBvQ2QoYm*0)O^?A=l`*A zhuY5Z(C5eMD#cn8&pehj=9<*eTu0Q9(VhE$N0(ZSn}s-3&*$YsMeOZ9H5{R~U!!v| zGc(0sX=gkmy77{Y?YWt1=-Lgli=WCPG;~pe+=*wK1%z*iyph9ful%UxWi73OIA!_e zsax#@7o)*wwli{{9JR-KOWe^I1>?P2}7#vcDP%or9mJ_t0 zb)S^ZdNyuNbyo+8E6XI8m&?NdyT0wf?1Oo$2gFCF>f=A&5u|X9yK-AKFlExJEdDzs zMN71Js}D#Dw3=Gpefe0(&<3M@-|u5${?+C#+xA+mL-GTpi(PIBZ)r9$fKTq}?zLOD z0ODjjwIIAs}9m@Vt|j7KCkLLLh8gB|Kx8Y z`8#7l+#z>j4SH3@d+<1^FlA6#2^Kb{g(m}O^B z=8W4_!qsB^*^3m(3GwDGO((A^4@A}S-`sinyHR7H{*Z=(rD_`oqCv~VKDX(BSsN@J z5^wkPYdx1bEkHa!VeZJ@KgM#{~-=`SZ?syRq?gm}|e7YXY-TgxQQA6mv6gT_4l?-bol zJj8{fJna-1#r!J}-!Um6K0hg|?SACFP>n~KS~v(B=DK?=#$pdgMpl^$O#E(-ey;!e zbmpVi`U5O12u&)paoOROvW?;Sh5tAB_urp|FE(B1u}#9sDavYcD!oVeJa}N>A&{V> zxp$BF4LHp~5%fxPU6B;0r_Q4<=i|1i%AkA7q?C+L|CIV;q`dSm?xWNf;ook@_@)?=t*jDQQR2I?H9UKbT7Za@L}@apXjF4AoFFLQQ|Y?t z_P{SF(a~em+1c=xMyxop$ViSKD=SI7?Aj(Kxv`a&i<*&~+Cjc}Tta_(EdB&OltfLf zXNM8~dwbS-1qDnV6V;)Ax&Cfu3OKv4N8mhV0qV+!)s64^vim2y0s5Rw zOv-EJ$GojTHV1mRJ>LRy-r#o!y(#?%LjQDgu%Ef1*_edgfu2S9W7pg*qqa-AT;>od zv$Q|PRUJ;abw`(Dwvuc9-Fx?mk5|7JN#J6VekmXqE{RLhm|V)Zl$TIjcOd4N2&*Tl zs^nLd6A&wSqYx(5)BV<2h#D2X^Oq$CZZ{XX{{U*QvXh^zupdG8?@l4d#GmJZ-{tZx z&pV)0;+vxY#C=Tz1B(u`TL=dh9xDI&51>2J<`b2bqc18Vl0LqfT0u&)n(*wIuT*kW zG#Z|TOX%CTe~BA+Mp*?#l?zNd>|23QJp^CUUQtU(t`Y~k-S^nq!u;cuIG?glC!Ru5 zN66CL6_H~*M@0d@5L~|3an5t~y2=TzhuyCf)g1ZfT>_M+WfX&?i8x3^sTNXQ-^gRO z&umD4L-c;v@V)qfv1X|hDX|)Uqb4OK1t)@dm|F3TW7$CRmKWDrP??2JYb1pFu7g8n z#jZ6zZp_>N;T-;5FZw`~W3;69d38rpz%^%?^vd9!8;Ez_ihFnY>O%{B1ggeAd;ZTF zO8C0g^%y&$!s49PNQ)xkp8~%Ue_0 z`zX@CM+<#^n;!FoiO<_06R2$8(R5p-)?z448NxKu?%MOek99Ytk(pYOh?H50_gj^; z@+&1pw*dlUbV)J=8f02D}yWnOPaZkJd)*k%-EZ=Yd(Mn9D0!((fA-=8ABa|eBw ztC*4)IWGP4G(Z0V-3_!=$~IG`#I&@Ci4c6-FAFJ8sbOG1Rys@@T8k1_*a|EF9OxwFBxy04^cgE^)xhG9Z$a346?IWd4<*J_s-@Y zEq9YpQ$K5e$oVn>9^k)KS^Ip7Xd=lggUZruI3Y#k472wxT6~Vcdzu#-l6ln$>W=&o z9@&AjJ0$e9Bue2a3Gx0&O?38@+Qb05@QjQlwdSJ2!i6I>7uZxEODZ1!zXtn1U)6S_ z?C##q*KU`rvM28r0{t2TnCNlkb{D1s7S=Czg0wIi3#g-GV+|QMfN)Egp8ocH_dRuW zLJEMc@I1Ggw5z!gs+V!!e0}uRc~RS=Zyw-d1aai1R_bP9ad9iS z=c-6srNlBX>vWEZMjp5Ad`?U`XBLPbk+RXL`ykI3Ao&QQo@jpK$w%2@6hr%mko9(e zw5HAGs9XCn?7NNcmsAYIZ2grHGL!dXb~fGb4?1Y{J1DHI#Y2Dv4t%d{W_G&V7#^EZ zuX#>R4&z_cFa6rv+KVdP-Q9=aBv9!$P-wx)U44)wt^%R{w!bvQqGULEz-<(bPu|HS z`5~UF=2g9ef$Y*Zg1Z{&0Zdm zO%(yw9m8ql9mW;$k@U`;J@Yx7o7#OzoBF4lWO118bqW869(H}DKAcaf z|1rBl>1<3OGx&|D$P14&d#7dWS!mt1R&ZluoitZ~=j`uJ3D!-AJ`#`eEG{CKkXbe@?Bl!43Bd}9>sRw&|d!eR$e0(%hqoWz{Cl~P}|8-YA z(XL+2AHzjv=d4e2Qe4IAtg_wywz9O%G7qV(Avb0pRIecyhYiSzhaXnCo)v9Jhb8JyCqGOcFgD3 zKlEYjaOs{njAF7qSut9rcKDu!Kpnq}t$C3Tz)~-~woG4wK!3CmLIF9-$<7S!jCNu6 z0JUrO|6zUjO{D^diXh#*hros2+x!G7ZS>0@~YopF1@$`2J*3_c4LrqQPH;&3m+1r7_CrNJgo=!lZ z#astE7WDSRZD@vIxKE}JFJw~k-||Ic`ZBF#Bq_jt@)PMRx`T6Gh+#-V6mTA(_s&~j z+y1z0jk)L&_K2YRvm<+!u*SRa8r%P%wdD)rON^}<rmq(m?zU6kVwY-*5 zQv;*RKUktFRB=+RGMuUw0|^tys`g7!$P3FPR>Xm<|6#vX*PjUqJulpx1iffTT{(tH zH8IO%K83t%iQOw(s>c z`f3y@;jtFaVd$6`?IyIG3WmODeGgX`*6~5C);?s)eeV1^k25U&(6hR z;KZc!BAC=CfcsUlRnNb19h=#$DXbnArA)!NCpT(Mk(RwMYq}jB9Cx+wVAbZ77+l91y)qV_G8?j~ zrWW_-3}o`Mp^?!{({i}}1c)G?(JP`EwS&TzN2Qv4eLt*46)&(4zABWYm`g>ktT1lX z-r9lgw+ZaSM0CXCsjs*Ll@yrj#L@B+UZJM*d~6Z_!`zs}!cYN1XUC#6bMxQV9;2O1tu9%GnvlwS zpHRT&nm1S4PaH@8P1b&Sr7?mcuh1iD$JCpMHbq9qdsaAZJtl4rM!1OxPv*rrwtYP^ z3eB0QNVT)ZPsWyKL2Zc+u6t}hz5eANH5Co)>-ZTI;X7MTC;Yp_W2hlb;vs_2`Ic2M z_a@v`DcU6#^BFH#S(TEiUnV&xStOhc+uqHI)UI5x;m`|sx8=Lf*JOI=5-VFcF}o-c zk~p_Vn5Em2E`cJ!P5XKnZ7>RLkK@>eH}2quW`Zam3`TN|~{Bn<*3dF$%2* zGli%HgPWqC1d_97Lh6}?^dN6$MFq7(m&{>(R0Ch#M0uTeo|l~jZHJ^dR_Rn7O^gx3 zVxb$~F-J;CsIY75xf4mo46RsqunrLNo zR3LwG@E46l7TFlTuJTX(DOB8(`)NT&NPS;tX8a1(El(_~6Dlae-B;jIH;_}=$VLBY{w-l~qDT1ZfcvX$Dd0ROyoLkdW?{##N-dq+43LLy_+85EwdS$N>g^H|~mp z`_=dT57zxK^W4w5Ph96Z*U2X^d3bXpbAYO(xF|hOYE}YaG)8-E!o{D3biO$kw<;PNDgPWe0RihRPDfk9KWBB9QS;*Q^QmG zSB7U>Zs#82GWugTu_%|2#6--pFYcCo<6wP2i#Mc(guoY+ef#@Oi)nNruh8b+q@^{! zA4XIVJ5qzVA=PmAO;l87dG70myW6An!-^m)FJF~yrg9Q%Z%_2GwzLk+Si-lC4iDEY z*%1ENINGbwC6TN|gflS{anvCR-@I?E7R#yL8^Y|%9_zGS`t(;L85(&=#WySR)ou=) z)aYO4=IT;Yvs5e8ChXV${L%IpSdgqeqGr<`U$PGF^c3%@=S1$wpDgof&5pOu?126`VbbQM?sIJo{qv_D=d#=)BHO5 z{=uDm^?|i7kd>5_q1}yfVUviXPT0{U;&g(=g@pk2Bde0igSAUQ3>Ly}vl1pi>>%X~ z?q*7McKZuv!(!M&L*}O9Rfm%pKwtK*;7vl0s`4m2$V^@W^)#WG+Yligln-hSVbBxk6`a z&zZZ@-54&?-)VYpN&kt6h&MfAfB879)!8zEg^g_q_5&;HPl|Y~sr%fCPVVF+@8+2m z-ug?AkZ~Zio0H+NeNc_c%Su-{+TWJth*2eP8|pNlMz+DmQ|B|V@j>y!kiSGxfG%c; zg-bw4Ug4GBpHf2Lt@~Uq+wVN z@{=MOoRr^;=k~d1FCt&cWU9$nANH_~Sw=_WPnDY~@x}wcXI7;^IXULDhdz zh;bf?8L{Y76k>3XiTXP+%VbM9<#Q_j`QU!nI@nrye#UN3El=GFY9MUpi+2`RaDJiKlwK#fK?cgQbg}dmRTfwsdda5~)4<99)86T30Gh4|^`Z?;;E;X8K zA}fuK-bu@NV%xn}3&(@f`k&hv|(ma&@JIg{yB z?8TRcbz`5-5IgS)wRT3_6N^aT7349Z?Lg>;%A zQlGfYe}R_)rp0qVebn(1DpP!0j)NXC!PC(5A7$N5x~_o%6IEmcDk__4JY|Nbr}^}h z#w5-AxVX51!E>+%dbDdo-EBigo29$a>@dM+I;sN1?yb_#n*}E^#+%j)c7+EM-O4Xq z{FDBD5`!}HJm^8ASgbn+zsq@9yL1uY2HJ(kfzv)>*&gHti9<^}AKcI8+c)UqIrMJe z;&!F^SH+Bbs@)p=_0SUNQ3v%f8uweycZ4;kiH4Myzo4R|?172gRHsT4kD@Kml^C>$ zRAf~eRl?VShQj>Q)aAT4VyZR5+Tz%g22=bA2y%CfNAinCaiu#R@Z&LXkqZ&+A{vM* zd?(|=NIb5Uya`Y9xVU#As&o0mt(Gec8KJM}qv@W7jC2K+znrS@rqkEXLhYK%} z>#~Wm_Toy%n*P)S`R*6qU%dc@aupBc^>xVZ!->kw^R1U{sHhf?Qpt6+!M+Nk3CG#H zJ|)cc0$GdmZA$+hPwk6~a>QdP%2_p;X`)w&Q(Cu~OHEoHZCKd!#uUS9nTCVHQ(Ld2 z$JTaeA_#;VFY=*J)JMSoMoa#ie>o>owturG)9U4q)GsiP5zJHjVIpBrmHHYy+Gzj} z_Hk39c|NYnrB8y#)g^bc>o*(;SE2aq?D0M@B@jvNx_jFsL+(t#;M$G&g!~6Who9AOnGjsT*yT#++ey(cK@$ zk$?9JHPjPOOgMIXqL!kCYZyDMA_m3=ogzDCzJn`2-&0!kT7^ytzp?hb!);-JkeGyi zM@XtR{_5OWt(aZZjSX&S=pdl}2_&hlMadGKOpP*HYsxF%vqJ(gPLa(%;ZO@fF|xQy z^cS3(PL^&f9E0UiYcD`0PYO=YnZw7{_uQ<3yv>v5g9;|SC_$R`aL~lsSd$WzCg3^i zl39cdo~d7OoCIE6YU;l+*W%SzG{O-oww*6Uw=_?k5L>Mj+fa*2NDB#JstaVU ze!*HHoaNF~tM>QsYnj@*X1Xiz!#DvK-s2LQb?!lj0v65sx-C!klPu0LcIO>aj&G{s^`xJ{9_(86@f&? zPiX%+-$G*PTFEh=ZAVCRaB^|6IDP3CR8=n8l_vZ0t7um;fZ|^$pjqh~Z}Rh{9L0{M z;KWg=#m2(gN3Lj6&!%BDE3??Xj<(-d*_7@tmI^uPQA{AFq|MM(!$3 z(E90xg?RR~%0x>duvby3y2kP%0UG1cwm);LNNyDw5HK}(#;ucoJ>f(C%G=iZ&Q5`- z(Y}TCYSHcP4e$`|n2G3cX!}$Nbn^ zAN`u!L%fRFUMFt7D8SI54EKr3Ij7SP8i6aE3hyQ)P_J!Zv$HF2Kf|4IqL4J^KNPg;pRCcy;{?UOi?1M*~puv(~-0lFvaH&taZ`v6MSztRj9IXA> zgkJu~ZscDv5orJWQZw8^aw>!LmoY3?5?il3U2AR$o!rtp*r`zu4VbzeSu$mm?eh7f zJ#6>VTK9Btf+WI{mj~ntT*f8o>55CfopEpiv?Zc47yH>hKyN79_N(!HxluhK?LX;| zT$g2?#oG2dqn&9cS~!pg`gX_0MzzAh=b$3@76qRBon7ebKVn4wCodX3gGYT$ATl<1 z$(W>t6J>OQjqYJC*1YnOzlY91RuWEB#J^aL7hG}aT9Ea>tb12kw8Mb#9Gba#?e*IQ zNsZ`xu^qUaYN=0r2HGo<7)BLlO{3@q7|f6yyezGQ>*31J6HLcRQTBl(8h#4PKk;BlK_3eA1&r)JmqB51yAuJe^c4y!sueYY2CZRnvl1@V0v&Agnyij{O=uVl zzmejZ(nDgVt>FLo@lpAe6F~uO86%(4QWireH@6EGb@}8)AI* zH^>;gD@ESn{Q|n7qylWFunun1z9uxTdNnBD>3hW^^m#Qv19_!Dya&m(W$!NA0%&8W7CFp96MW2Zxp$+t`*-UtfA!)8tx}h@(@b!`s&?+!tXm)V}T+>4u#d+SmWnBu|d9 z3Jn*1m61hO{zc84>-I^sY6|RLnvX8%#C>lc`CY|eY5|EIwIC%iPn=n=qv?(+N7o1I zV4Rl6hTI|Lbz&oZG`+=m-uq=OvtK4A{nD?bc2j&M@|tVCBu-~~ipE>Jym=TkdX z6enb5V508plb6Y#<+ku{z1Ps6hEe*cP<=1Ziz@z@J)2TJT4Aj1wibQf&w%bhQ zUFZS*v1+Hcn;S^}*+$wgQ8Cg}<+xBV{<2D0;N!6u3huwTwX7qN{5=T%rKq8!l(B|t zsoCHa1w0{hms?a)0qw(^+sa1>-H|@yhNZsLL}&90&p`OwKwF`08HgdA_s_hl9f8~o z3Ql)tJm?9COYLWaWls2<+o1T&!_+*D2P(i^$1p?qm%3wNeSO8;0#(P2T_S(!wlUvz{~#$W|`#E-49bi@7fi(5``fJunS6bk7_#$Icn$ znP1)9Fd1;!06lB+2%&GW9YnBSbqqP$b-Q?RZ})&h{ClR}g_azOEeI%_^sKhpLG-t> zZjVq1-t>(lGc{IEQ%wZMQO)sQ>;&)lR435dyHHd6OpBzX(!fd5eXsU9BJR!oEdC#R zbkCvlaf*_pD2HR&bGl8BzMnm)w!d6tV`I}k@KZgphGynT$I<0ifR;6zh}Icyzxf<= z3Po~f&g}L0k4hAD;rk7%gDZ~qnLT}d18t8G8Eh+&E>(9-tG07&T0|f<^z(5peq+}2 z#D(XVeVqSutr!fr=%CJCw*&e7sQ<1^$M-^v;f6wFn88g?QEwj{VjNpl6NZ=49|eTU z^4?6g6dI4{(0UHLKw{kLIB-P~?5 z^~2>iFp&fnG~GW_1z=)kLl)#EX^9%LN6 z#vF(q{cgI!i^oPhC&FuwYNIE`I}|ef-n?Kx`|vs#)|zXJB?m&=es94-`LK*7Ff6l% zfK#t(|BihAq*jALL7ulJB7#z}2v$=yU07Jyv`fI$x(TTywYP@@QY6Lhq;1LGt(40e zxxwAv>*#nCtU>waqn^h~Sr6tu`E=J)uqiM>AK2@yUh3(xP^j1f38`0Fu=h!Y57i@7 zz73e?=tM*#JnA^Mo;xT#n)r3fw^<)3IX8*)GDXVDKH}vTJ0}>?MHLVjNZyhLX#~Vl zFmt0Gk9)=ue+{xBA4i41X#xC@XhhEpJ6R0V1nV+tDFz2H&GE3{Ay*5J=8W1%nI%7YacRkdg6#{#&9w>>n0|R{G2RF?v(PvZ z>)p&kMXg^V;rP_2cz|{?R3b|~O0*(q%b*?jY2xaKC;QJF8gQz>rrnX`d)?gz>_E#C zjL(1#=uc;WhzlLq^PB!Vx(a%g>j#B(Z3VDeCXk>178OsvGlGA6RVJ0I`nzx6r+7M{ zK$DIfSspz1gko_z0aerSCDd!9z&adaniUKIE$Px~;c$utRSjEnznuGAw?%Popqskg zYe4d2VqzM(do5&6L`^L6=5I!CetHvbZa7~yH~a677utLG4fHoR9wSs*PX-eKFXDs{ zca8fn8Hzw07Bc->4&5yQ2LRYN4ieNGYI6YMBX)vCj3)zvs|bvxm69z<8TVAhMgtiM zOq!-ELn&*X;t^qFv|iC+Aa^VbVeV_m*jgQ7%%}DSuW=O&1E8B1+xEd8l%rt{$_j~D zCJj6@JrqDfMm+EfPQ6EeN7&}(^UQ;XR#t*?e4bD2kfR?Q=q8CA;y*M4m z^|)>qj%w_#-u>wezS-8-f51ILBKg2Oa`!%CzV?TYmPHEsqHiDY0{)*)a}l!;kT)2> z!TPkmdoC9JRCJ?VKjCrm)sw?^M%Mw{*)?u#n^`wP0+y zc42&>jEpY#DNJ!AIJr%s4^nhnS~;_4$IK!SEjU%56@MHVD6lOAX}Obr>i(KN9wAYE z5CF~hiuNqZFxGovyS7ey$9INEzJ;I@JQqF16;>Mpe=PmD>}JldYU<0k84i(wz}g+) z#R18`qOrXr+B~DMs7M58N(^wDs02~YpP#EgcVQI#cpMy}6l8g8mNE?Nk6-#9(BZN( zmQT)`okm4h*QU2Vs%);7G$~QMQ!nhF|wkMTwtCa4;Z{NW+ z^m0~vAI>J4#cr4=U#Nwd6u`n2&10hBlcs{aPm0^Rp~ zwyxadmcOP7vvGXv3-6G3gFV8qdZ&IiEK6E^0($J9B@LeF}no)48lnQy5 zLPS84w1$9Wu^%ay+28bcS;{U-JxZEIs1g*45!2Fyz#5b`Y`1?NNjVoDfBIF!>>|Jn z0X78Y56FwGt*2*J>3~dNBG#d$x%sVVZ^mDX_SHgezAwtl%W-%1yLy!o9^zSJH}iuQ znVFTFwW5RdpOrD=fP`bG+7a|pzo97XVPDIVPs|A8eHw45h*sdEl%crbs+VEhkpy6V zZLydb%nEp;h|^!N6~OU?p@c+dNLkPHw_gd8m3+io6TIwlWr*%ar*zJ5{PZi(F+MD` zuBhBxJIFVmxw*PDsP2*t^bv$vkKJ3f0R}cZH>m~zn{Ji3e;t-Cv|=nU(AP~chV_)l zf&t8y4?bDdSGZazp}w-9K>XC8&>isoBE(nJ$~SzpoogH$GM`J3E$jp|F{p15U|A|F zn;P(@f&spk+(yxU3kpLmmvFFZ*F??WUP*BOOD9`YfYlo!BSJ*O@-XJW^vIW=p6P$x z*?+9M_BKkE>TcB`yyJM;d-x?@sQMSIp^0{_D9L1}h{v(DP*8 z4Nxgr3A@m(RI^57ZexQVP!@425RNO36lHO(>GO`9u?YQDamM@L;$^3sw2&N}vO9&?eN$30`2Wj1!m$gSK7JB0g}fcW># z^ZfTop15W*O<82b>sTM`)6=h0KLIREf-QYtt%JUz6{{g?m>8?r(b4K9i_%rWz>na* zVnejt@_`G>)~ETid_Wb9TEoFq8BoP&rUGyl$qAe#rJjvMIjPu?=uFk{$mQ%{7m)ur znb`;Q>{T4og7h-Q%2)2rHMl{)WFmmJ+El2#{DMtnNC>6F&PuOEOPx9w*MyX8Kit8I z*lEji%&zVsARs0DmIz;XGADqwMKD7Ap*y$wJJtD3W~R4~pKlm^^SPj%f}lS|YKm_2 zTWf+lWSIplB1WRgZE^P>PxCi!vBaKA>37L$C_BIId%&!x&#pyMGu-W|WaN7VMC7uy zkXNvkIY<$-1UUBahL5k*8mbkJV~XH`Y>~aLdn<$bK1S-#maW3zk0vx39cUo|-<>ITV#zFT78TnFk3ZPq$g4Ign@4epOk|goh zx48YOeGV%AK=G0Xl?Lcy@=%&(naaSTjQmvZ(w}yXc9@l^`{{5Q$Bho57KbGxU~U1ga%ijOs3lEABmJhQrQm~`kY*s1cLxGdH>udZ8_BBmHhq-3TH2TI0E97d zaX*WGC{9ahvR(T9YU}09+`;C3U+$LH+!`8x&OIDsh;Uqb#H770T>$dt^9-lV8iX1b zLbGTDhnbBZ@Hq-C^-iz4D)LU)tdPEwFFhywb07NRISqap_miTcBr=9CIJ8Pz1`D9E zDJ>ve*LQbh9QE$uASi9Ho-cR!GvDNx<*B`cF}FxD(P1JrJ{F$}Gi)Kx%vWf*$QSYY z%h|jcUBt~05C_6lwhYH73=9pSu@1yC>#SwvW3G4#QA{ledTxgHc5N~c`18jxF~ zMg{_ZyhrJ5Ep&K{tWW<^V@w5h`0^> zMjp<1PU>zjhQ7GNgm)IK_sq$5#bulOAZeDdU_%GFkxewNvBEhKZWF>Sd6$2FWEr}|K%97 zd!DK@b@5HnXgy=!)Ov1}sMOcWp}V@e*(e%#LTWcQYV8bwTs7*4zP9Y@>Y?Sc7C2It z8a5;ZetOgYuyiMk5I>t8l9~Sm=bU(Son$SLQ3CywLJ2*+_mx{M1P1rGb!s5hUqW7( z8mvV}GFoUCMi-mKo&c5F@L>OUgafXc;r9uf!zAQjMaQ7^<$J$OT52(XP{U+a#tD(8xB)1bkpmJmn71+m zz*x#uoCPJ{9|e{c?G<#@L_~P>1*sBYiVg10a~@UZHG$Wk8DwOX^DmDSrWEXTe5V9Q zz`lcxb4Zt3(a1~6+c?NUlWSr6GbSykP6AL0SSl`HvMh0o$`c7E$obF#aE<|f_$x1e z?+SVWR~`$qkgFsGi3%W9EhjuJy1!Z+!x%CQ4OM5Rfo_S3jFew+Y(bLK#NM$*VPj)M z?%+gM*^x?`&wobnm+g_uw>9V)UdUwa90mueTeSPa7G@;$A2TvCLi-1g=>};L*dnNZUdtZTPx~Hk3aXNd zk3rK5jLM!XdMSc=o;L)#Jf4R_MJzWz-zrg;mxsv8_A9BU4x?oh-uX>Jda?X63t&=& z%By9xIv;N6DrHrQF4g0x_j8h2L$PbF3pA3|Or~8q&y+srFc`FvjEz?{xwYlF{m}f0 z*!gV-+DpbrdebCA0XP)`Fh?PY&VcMuDIL(cw3-QOxU-~bc;%!+e-9Tuh>?kRY)qx! z_`w6F^hx@T4$Y(xy%h^e))b%;r5KWDl0&b`kMXYw)Hc%xNXt?KaR#>6!}o;B?MjiI zb8h7u!SrEcVWA@fpw@-97RmsMQE;I12PNmyhdbeO%f(p4xEWxQi~$8ui(11fA4pS1 zhNdvG-4;Dx<<+Uy4t5HZ)K{!kON6Oe7JaI(_W}|;g@wf+952GgHggvm;BYt?z&I1a zes+N`Zj{F!UyKy zC6NF)tKT=L7;#Zfcjdvu{&helMA-$B1h2I)h*=)d-(puinWi39(|0OzwAaW~dCMq* zG{#YMXr{kH*U@WCJ~ZCAS8%lp>=9-_0Y$|k>b{Qb&8YGphPY2$nK-K3JU73B8H^rY0~#uxM0m!riDzTiX|()yCOo-FEp@8Q<7U}*4))EU z`I9pq#mLQDrdy=ft&@m#{G-(5&xeljp5wv{9r1~z1IE$D&gkrJ$#F^}fsCqWD1lr} z)na*$ex|py?MkRWw{l9(!5jgOHz3LtUt(s)DH?a&dk+SX7`BPB7t{wW-~5Y)PR(La zW@Uz`^0Ah;cX$f*)Yq{_;KfktfI5ucvZT2EB{m-npeSV@75X|S2E<#hc{FrP6OJ=s zy7Qk*PqiU~ko^Yc?GEUt2KyTJZnHAs!XdWtaE7x3Mz!y;-vf;Eeuu(sVwXe363!i& zHVHhd0Y%++$6-r0NN3hroDUx0ApA(p;5sT-lh6~p zQjj~wA^q;~1W(9F`>6ZA#N6T&b_n}2co=(fVPTg15YVGi1S|;h2M>}5?+tVX+AxTy zscyuU_npYzX=;&Lx9*tPO3$RGK3ARKVAzgqc)Q#EFQn)etgIo{Ku^R2DmI@jv;pXA z2eS_m=~5F<$sD{k3$smHJ25~;&k8Zm4iOkYJf>5qdl*5f3WnbidBOpS<#X2{AldfFU*2^ieK?}L5PV&YH_;d(5f=hEsu?jM?zeE97fpI6jHc_&T4jB6%`GQ90-)~ z`+J2-=8=&zF)0Dq#-A(j)$Xl-IkGvhZyecd1vp7L3%iK4Wx*l0!|nxjzEDoH!{l9l z)I}o9M`*I{t_s(!vFl&E12u(FAnKi3v7C{)P+k#MWXq@e6eIbiOv>&S5(!Bav(%C4 zUy}h*e+35Z22Jh}PjJpplv%Db!`B5I*JGMnAp!BVf9Qy+IVU_|W?t4R%sVXJmf9so;4aY_>Z@1se?AoE4Of%!6X~aaCK!V* z%D0@qm7bn{ZwHX8sYmMG(Z^WiiI&YGk^NQ&zZi*+uU<+;s)uQOm4)f9QsHjiFT3Rz zF48`(H2`1E5%h8xtpwejmHwJvROJKYyvi>ymu*c)Y5KQ!aALU=dI``8@F7tyVJ-sMR`5 z7#Z)3G$|TtHGZbmSwun9eF}5$^g`ivaQif+XKy-6okUi}B2hRUKoVQcf9jL}`G_u@ zi>a#iWqP{ai!}stk6@Nk&yS6QDK+eNOuh5PW?VEZ(Ves_4B z@KcRr>EF&Bh{w6EE=Db_bbw_!q{PmLWo>1<&&poxi!s98TcL<+T>Us3O(?XuT zPq)xF9BaRj$6nPpt92v|SJdxT)+Z;rFSeUO6^-JO#j1mLGKGoGktqTpl@I@7-((Ec zX@tL`1Pca;P=epL1Q>ArspGQaqTs;BW~WkM_2=IX=4m!NB`*97(TBl8`z|A@88QZCsTDsxUc zgr-j}t7l35rDXSIeQ+XpX$jvc^dPtwD&Z0{YEnP%M?j9F&LY%#=@N3&r;Q}&!4>7% zQ2EKw+CR8CPGdwMgR=G&L?bTs)G$C|)lcK4QYCZ}wb1EMgFp{*L&tdIBdXM$Rd(2(vROP!5 zQVO#4hRWESqW7@xA28Wxjy-S;0(PTB)Y(x+`{-H1>}J|FDISozsn3Xh+JFbAi+xwG*?AX@bF`qdzk0y~CR)st%yr^6EF$C!L9Y z2YR~l=psoWWSgwb{)4iqLm{AW)n{^cRoBmdsTE7l#N?)OtBO)% zCfkcb$zr2n6RRUw&Zss#Ki5~m@I)gm^ElFQ7VM$DGrEPGQEjF7>X347Fx+{1;BEx9+Fyfh};ePldKR;xou_~P%Rs+cz;Dlh=>F?B^F9!NS^53s?9MbCWZCpqY z7Im#{zPwldLNMOL|6bwya+Mx$*iUYl02$z%8b&l695O)-z7MAdt^mbkJXVX+Kx%4w zrr)W%Vk`)P5n28QA3Ul~Aj+1%5M|HkuoDAJZ`@=dmh%8Gf{&t9UJO5E+=U(sDwS_@ zgp`jz7d%a5{_DJ}WI(tZ{yKlKbKe5|_uV3*WUz zx30UjvrFv(L%NgW>`9sOX0!a&co_8idh)7Ll4 zM*@<67W1q3p`)+Vn>ITUd=0(?y=y&h-{PO-Ll(X5w!+4%8=Zfa5C|gubP0bn-l?pw zaSPC+-n|nWJLem0!zi!dF%ld?H{NsjMPsQ6h>As**4pm*X`2#T}@R2^K!HDBiE=MMvENVgz>An<>? zd@wr8b%!r^^KJ}HCjy~gwptuX;ea>u<8%L9LBCM=n*TW1T^TQT;wCnYWQ0C~uT^00 zTaSdN#U3Jh8wiP=4kPt+mmd?XL!rZLe5VlCf+f3c z_YBl-RCuI6@wHU1l7gs1&8G(x32z&>W|u*fhVFoDIV1us+`Rm^-TqR|x{h`KzK#ct z@SUXDH|STAU0>J|;(7m=unmwgnDJzlmY3sS3oJ+YIn2H_%z3~R5Ee#nTD6(r_~ioy zzc>N68IKPrQht8EAD@0o8~N%jjyq`8YP9N(tdn;B8LLGj2a-US*tqx8Pv&+e0B}-% z)qCT#JC3tno;+N-j>q}plaOju1dB}J#%Y-a7;p+e9grk~@V-oCv}!2f2T$ZRJlk~O zCn*06k2D(8UXis3!(3sBPNyaBfIRU;!C1(t{W3)f#mtUBxA~z<896#8MtiP}AavDf zyMK_sQnTK`9zj@+#8aIH;D^@*^8QZPZVnmcHo=khwtaC@^ z60zHaaBP-vH}|a1c>@&$*7jdF?p%6MumR=2#eaU+K*W>BAhI&-`W86~{;N`&?!hX72ENC z3n(O2Sb_4I^%{ofX?yaFN&IUt8W)hnQp?fg6s>t3g8D37T!b0#7wAkLX%AQF#wDku zh=7qjbUa4Ezpi;P7m?L>baWs^d}rx)6(F@r*;1nkdcDDMVTO+E3hU9Smr1ScH`#F8kTUH9?h zt@(DR*lvKdED-dRn#0wd=rZN9SB)Zkh}ea5%JzjL8AyZ(i3r(<1b$6)b=A2%G&H27 z%ggQC3Dh5e%*NIxj=ai9x*jiY!rtEAo0l(T2k2L<)U8gV7zJ5?R0Iv!SJu)cB#9y{ z+U4Z-j5p9i_9JV)#^m#v>B<%<#Zs5du@DwXN0l*OM~R0vw>o4@h~^uE6|phgW}CWD7BTF(l))m>{i) zdHwp`mw(j@*(pTmNBdT9XRQ#Tpsqkh>e7D$NMPvEeOWRzZE;w48DrBaEb91TY@`68AMozA|>3ZFrd*%^GDewHUXsBtR zFG1lxxuC>w+$-K_ZAEtq$i$ai&T1J-GSbl&^Z{;`n$O9Ode_r3^}j5W~|v)~)(ZfUMkY2me`06qBd;Kj2$9Dn3eWVKH0@+n`0hjX-zNo7+T1-T= z6a2ezt|x%>tdkf+VQD3c`$aoP7yZX#?ewyI3u3j4K+hrX`e-jZbTQ5t?)7lh3tm*+ zy1yNzy(V%TI5&4wvD_#{#d1|t`Va#CiT@O)caqYu-oK?Y`538=yj;CeokRXFOe>M8 z*klng(ZMGNlYA$h|Cf9H&41&W#L&BE+?$BD-#;+Wym@T5 z_&0DZ^G@W_kQ)Az^aT(q>^^RM*ZzG`!DGUgXVfYtU(8Bn@gDO=^sN)#W8{4k;fm&J zu?gx5SpEpKlV4L_t=J-p_XulCn&+~(B8Ws%kuTkyQ7@h8Xo9j3B%fsTHhYW z#t8=~+6$@J7yH9%rOL&>=9`$^1tdrD&cV_ZBZ*E9T}}VCU-GNAWG^@X&kZtvfYFO8 zYD)DeczSw<5bhwrnz&tDoEl?sdS#rR#DnUMX^!xz zjf2{j2KikU1d`_mNtidUR;cGDwTRB=BRVNbmr9Hx#wqlR?3?)^ieNteB!lfGiRT<= zo;co{Y+S-8xRbQkv>5UBoM5l_^)E132=k;J-(68bseuPBN6g?V>aQzSZSG_;>h2I} z>guNXoIAz;ioU=4Z*CJbfEH{xd?N6)iG|41;>XW>`LYTS$3MJj2g^3rLrifxf|qk* z?gGx`+=JY2UVnnCrv_pB`Ya#2}G9N(^0O6o!%4WvP95TnHH0bKyPF%uVXN=Ozcrtyd@dWciObDh zvDyv1_w3IQ!Vi%+r4;%Zpn-co{ax-olO5F-CeREIMG1WAGqz}QQfi2@Qr;F-A@Vlb(fV!ONv8_1QxNZW^vIuH=(%g(<$zqcj-@EZTl4WF>2Srm zE3CJvrQ_Z-cr8M8gxYAOE6K(s3o>Q0eB8kWPaSW|E0B?*f+AzS?Wk>R}*&)X%WnEqwsgmc4+m$U@lLf`W+S@3TazA(HaVc$vUxwdPt3CIS-+mpS0o9}-Co;lj zb%d;B(p(~ZBxV~Dah!e;d1oD_#P)A1`i~2SI789FiAEn9>s5nDr@`AEzHxaQ7Cg$Y zO1W;L`fN;wro6OErmwTLUhJbNB5f1wfeS30=Fn+jIR?kUGi8MaIt49%kCtNm0ZONASOn&PlM;+y|`{5km`TZB16mXU!e!&=x& zq-8dWuk{W&oiuf3201CmlLkM0z(|Wu@&P^iH9`Rb0_gIqR_)0nEGkOsz&~o7gBbMU zRqX5Qr!`C`KW7I?Giui_SqFs$X74ug3pBk7rVt#fUAWr#%lxPn=Y8JwWuPGskIusQ zhWjkAx+RH;<=@e%$amdL^myaDNbDDT0~ZgIj;|j(mDHIV-|GD5uM;pW*S?>82% zP~y7t<$3RMOizLnUK{^GU5kI;7A<_&aNSc5qqDcJYTQIhj1P{A>OBf=_XG+-meMYq z(ek&C?cmnwxu#uO*%4~b2Y3-2(cutg6$dEFcsaXA@$0hON-B@5^UJ$dV6DudJ1Ig` zs6D`Ay+#Cp2O-ub!^O%I@F`19T|>jnnzivb>Jj^ctYw|8ri2!|v*6QN-}L?}01ob= z?khI>d&!<6$*O2ZToI(!zKvY2iN03mWNJo-(aLWL&gGCwu%85Si&Lf;XB7RK~?=R>s*|eQOdoD-cbIVLq zB@vowh=m;@94X(sw7mIYK;YXI`r))e5*B_0&v1k_S4vL|f6V0$cl`sjMAInl4#h>^ zC3ay_7Zz@x(y_;HPADkG)aKy1~IJrAV)sBH+Vk)WUk3 zi#~_(p-D&}duT%rK-*w;|2P6s5Vrk7$f-ts7HuQFMCN2engVLgJhxB+7))J`cAL7+ zs=!C=OcS?oabm8jx{&wnR(^WWpPJdTj8o9%^EccY!` zIP*;Ns3;S$UtRku18W@fjD&Z3eNZA&#JlM5!x%?*gYPX?(e=qM(idts?~+r^6!Em` zBO?m$VQm>UKK?}_q`Vb(=bMlwq|;D`hM^Ext*lr-8*$RaO`N^_Lai2vRLuEQ z$Q1&W%8;! z>Lvu%yaJD#&id$^bYFT}b6a%dT+(yz-L6$vT>kK~EGRmfTHR^8s4dz)iNkEtC?)RH z8qU6))3mL?)uW=6cIdGfFUESBg`BOWHK4#25kdxJF(sD^(RLs}-%viQLK%lKXz0pY;78bg!Rawd5o0m<%H4&TY z?o6t)U+PEvc6^*w*qQp{0(5wTv)z8P6v(_e2?4fhqEkZdY67&ddZe7KyTPCy{and+ zCWi!yc!kFUriPrYIw{}Zi!riX>Z+X7jikT4;|v>#(Ix-F+={4u7l2zv>s)AYJm#gT z7*Z)qP2lIGAh5{6`&3Gqocv*9>`?j@>%xL?I~Uab7+2r5-rMh)EaOfq?%o@>hz7j z`CoUp*5V@Nf-WmJn%wD1Br6dO3Fl(%aBRv!ko?Po?Gad|R#TVpi10IMO-!Br00D=u zIY#vTrdcW@E!S2+w7_bA&_Q&p{E^k-$5Z=V?(^Bb?osh-&wv7Y1Fd^lHTcUH{#)H8lH{?-!*57dMd zk2*cEPm@O?)U4*Q%-P1*S3)p4orV2sEs#y{?5javgA#2lz=`K3g{ia!1**-Q4%Opn z#N$wau-qqk`cyVmlzl*Qas$32`k9-A9!69%sYX_gJ!$IsCVZqfuqM;l~` z9k};x4~pFYqJd;-4?$-_d!U`!D|30HW;Zz{vwk-e?Gyw4Rxg}$^?O3M*$?8M1qNH5 zD7*NUT0f?lPUBQ)anz1#*y*21M7z77EFs>`aM{tZa?3_XCp6G-oD%ru$D5@CPIJX& z>)P{Q5b3p=_I$7GQK9|O%>J8Zw!H`K^~j+gxRJpj4*4|%d>5-Z_vzr*R;;dS%O||t zt%t+!slWM@coDadk19e;G1>l>WHZVhh1on)vF71knRR(-?r*~@SnM;69$@dVM~nHPd?drMR{fAKs~ui+(b}qqB|wd4&C2XO4h4mPB_$A|;E(#oF#lhGO$^GXCj!)}yA!)_9JiV|hHJPL0sm8H zH`WO@aVf4T+JRWA;mR9dx#?;k_A;MjT9ThXGGxQOu7!-~xu5SFUDgda^sF9NmlI0D z(^$vXiYhGiu3hZ)1M5W*MXSVfmG;qqb6yGvwFQd>HTH01V~;3{S1;n2_z7Bng%%Ew zca4pa?u1p&J}&bBTmNQ5!roPR-eV!D?u97E^vtT9%Fb*B)Q)61wZwQ_;u8vya3L4a zfFtGjiCakYq`*FoAh&4Z+!`W{O-0gwdEh|RtuW!PB4~Ue{Xvo9|d( zRK9z~R8$dc8E)I<4B0Kgmy}cPrA|DH@G7Lb)*Nq4&$6<5d~H!I4jv|sYjW>>xlcvM zskS#ZSfXBW@6OrV_01Me9i1Kx1~xW{(g)^E2eGm;dl;llEFfRcIu5fG3r36BEOBHc>&NJ|ZJRFqbbk`x4_yHlmR8wTkf8fJ!J zzC8*UfaiC8|D0>iGx*GowO8EhUTZHcuby)$Yl2nJE|A?hQSIJ9&|4&^z+5^t=d^VM zrphA1m`0A|E}>yHH7qvWws>jUlU(0c7xZN`7v!`Fzc=cQW=Nj96U1aE2=~{)UPpgo4%H% zdMU2EnbBNL6!f;%k<$4+#N^&*Ast65spDvYZ70_;;)}JPE9=KWC^PM>H%_>`?ie{c z@5vne(5st7R8l7?(d2{6)5!dy0&%;^#r5U4&o_@`!i5sIX4f{x-k{(Y)YQ~kOOrPu zxrVyov1=xy4b{SvG971-De76WCul3gK;Ts}DJv+`+5Itp01rTgcB%R-xi#u z(yQG4zC47u2Po|Vv0|5x;DVCtJUFu#E)kG0yigbim`iBJ;6?i;dQsBW4&@)s)plTpxv>#YiViea2x;s=z%YEKHnCpFrr6~T(9t#p+orm zOT4|r6~cWrAtqHbp#Ah_C9YTC*xR%A(1lrW3l!Z#+({F1-mo;d+-&Hr>HKHw#|uIs z!Pg*Vn1UOcg(94$eQ{b=i}xcmA2M@)EDH-|S7m8CeN=yPtd2ZSojFG2Y^Udvjh)YQ zdz?6Oz_hl3_qs27AuW1v^6}7l0O#B+F_^lp>M~2keO>694<#cE((^YKcR2RWMo!4wJlj65)!YZqLLn0eWnzR^wRuM_ij z0^DCMAw_0!0~Y;_v}D!)`=J63{G@tD-KiCE;qv9Hp`7UJsCCNMgGC$SfEe&R^mIQB z^;y6C{3EQ7wz%D2{bk~;l4jK3+n>{4kG3-R$2gbVWo}YZRJ__ZJuyK~s|w z%b)t`>{opZ7l1#M3j*F#&ql_H%kq=Sr*qBvX}GwWYfK>baW9=?IEhEiU_XzWbe_u1 zGjy6xa?cACf}HE=hzpKXEH^W}uM6oRalCnIfO7_iE;;e_v+);h)yQNtxH;}x5FXj1 zvFs`zV2OP2r@|@Q9&n01WWm9+UAKHR_ZXqQ;h-Z`w9GoT1i|+x@=x04Q`4tkSCUm? z^lp@@x|Cuu9>oGEjlaM=%9&5st&@4O;OAu8gN*kWBL%5(8}Apk$LB5Ey-fQ5tH+7Z zuI{uxP_H9mT}#y_4ppiI}&eb%K06# zq>-yw90o1MTUv`B|^3Sb**EWAJ(#n4m@*vu0=iZ$F#H{XOv%T`p0|p z^hvt+w}dW-onz*+n}2il*~v8|j!QWDxwL#u+Pn?u@)sQ*PHr#i!~eu_G3rP-ZfhFc z*e93RSa=KP=vH4`kr&-qHw}LHuCe$hR-t;JJq5Lyfie< zf)5kcOJm(Yr3EwsRxdrH_{5WkRGixVp9t>y`bNDd4>_Oj-0|YVH2D=we^Ej`sbN{n zhIg6ziOu6SJU)AAw(rW!@3^U?%SM+65U2i_>}1KVWDRDCpw!p#+pEu)ZzksIxbLDV zyJPz8>>Dyh@vkCM>;&F|K4$XSaOn_Vkc|aKn18b+t+KXOc6+-)j`eSgj|HLKk#w*9 z{gbrZ$D5ChvHoGN3~52`$N*e~(ALK0Ed@ZRoNq2VsQFGAj$FSMXsfTUCoxdo6!}iK z)JJLeMdc5Ui<>0rs?6Z&*#n41QTyK^s&nJ*TKYc0Hz>`u%uExr0M7c9s9g}Ul`bDw z<;@yS*&Z)}FFCh8n1s83MSb18E z86v$vS#9@$w}Q9!!^@XNl4OD+Zn*AzwG5Zs_KVk#Qy!*VzFl$WhQVD~*^G?ffq`3y zuhl86whh;*49vl0%8K@XD}ZYt3p{_U6#a3|@ekK$*R9rGe|YtTMig)is@!m2liP=6 z(h8zJaOHv^3k#+{^o7zo;~qWFO%7!K-|_dSJ|X4xaylOD}rtQ2!=;7Cb%f9p$wN1i-~E=5uLg9HPuj)<=xDDo5&6Z6MX z`r@Pn=||npO5guc=Uo2oSR(0+u6-Y#UM&zAP(v|9`&vP@B{f(}`(CowSsy=F=MD*(~`pKsvCLL;KnJ4ezk5tSm25uBy${4!~{tke+^T z3yt>ruQn_WilAFX7nTH%LWrB1W`Bs)yJXo%D%;oF%VMb;4Z>c#E-8xLGoAj#weh6f zxS^bXhBPRj5c3#Lczxm?vsp41;f#s1q!0PEZt5_d59;J$)IIH@ZYPE7MEkqzN~wAs zw2YS?^;&StiM*^L(b+HiLL0~4Nn#lF`*XuHtr7Gpxu&t8<{|9yzpr0k0WG^FDysWY z&vh>UYL$OT_Rc4vN3t0J0wp;IDML`6!o!n4jpX6wt^p$Qram=aQCy;aHKX9=3c$ZU zwjL~FI}-(XdskN-XmhLUD~OD`wKWBinemhZ!1l7s#&+gptjZqqX_4(XFkO1~GkD`O z*wkuFc!?j?lrs)+C+p&xJV}x(Cd$9Gs+>TcBn9~ZC+K(vzG+DH;(kL+ON6DA4mz&a zEsrOShraNXnJKw$)}@lAUjqu8Z?Le)(w3h3k6XLXZHhgFl^%5y)*iXvN^zyLtxbEZ z0T+Y@mw8xa6_b@y;u~I|8_>VuM8C@#sL7I(^Y2-oyHMz|0lcu%>$v|vP z>9QGjmfWvpocl*=UV;du=Kof}wW+$0^AA+)yoHEljNR#ro$}(cQZF(JKwZ|z?1*`V z87aDNl~6t?kNkkPwzTIqo0A}Q%;4@@0n}DKlP7|P`Xk0nzfU1Zt^s~5*ZR-w$83=I z&S3Eag^R+dXe9&DM~~jLjt>t%{4YJbTKqI++L;m+p(V1R1PZm7w4AnGKg7jKSc<KEwudr^C2i> zvWMTBY?@Dt_vV=Rg8L)UN4@^5TWADv zi*bdr9-tvN_4bOn;fb|0N5t#y5vI$hvAl~LFFFb9D!|SH(lOt0a7C`f)6k%c@W14f6s$H&AZ5-EcX7uaoTF zTK=N8T|r?DSn_-KUXM*oOdpMKUJyns#>jYmN>WM-pmZ6a@6VmTY1y~g6MX%5lI8E3 z;o)T*MYWc+f&vvEGP>8rTU2d;dL28l_~=drsM)G#vED;w1FxlD(@D$xfIZ7;NiV@! zF2P}e-WItnXcm;jwo#XTTc_VFA8A-ZcD+Vnd3zz^_fP@*(}FU?SwO1bY!6h10MmqBG3}vKs7(GIAdqlc$21-+F>6(bmz? z!L$Dp+Pedr}SMzAu?H79Eg-M(Lgk*y51S;PyXIE;03zaZW=Qt>k|;+PKMS^i3^ zRU4JBTmVH9)@dlE4PH0tGE=lnd3L#5i{_|KjB32$F1~jB3@Fl0OEy=35_ZgfRnGEQ ziP{xVSm1@{9l-dq&CA=oS&DFeZYG%ZitGSccoE4zzZ8gm6F2KCkI^|wo*)}~18M6H zMAqi!Kh(67uZs~AMdFc)i_FyA%BE&gzHKAFuht%V`TdKiP#l6La$3mthSqW|xKJV2 z4BLpJA^1~gr$UtvIZd}z;B7|Zis^Xc`Y#Q3i9&nz1mQa?pwyzY{z(e zV{g-3$h*$LDEAY`#(&rEOMmP-Xs_a@m<%=A8mM`4MvJ4Kj{qmn>y{Si92f0qDEvSF zzc)2_-VmUF7hr4bRS?v6gZ7?KihI%l{_bNsELv+W9u}R{4incz_U%t2p5}cNe zd7w=B`KeJ!7~}H&pD#fCeRSAu;%9gW%gTcf4Ys$l^=m{q-!>kpuma&nhDKyyItzMq zVWR6%BnR~dZG3HYWMhzD+cHy-+I{)x4a`KVBQ-U5`k=C!TE8vNZrvs5jX`SZ7x2RS ztoxh4;Qs@v-|pD9{W!Cp#WH7mK~BAtNhJpOJhnV;zXnv_{81j)&HN+L;TuC%L36!D zGJ%Y0dh`o<%7B>98x{q4&Df%KwE9hq94NDZedYeseVbU%DERpDicifQ-z|~twPu%^ zr$<;OvX7lOF%|#jCWnWo#8`-d*4rGDZqIe-#p7tz*_J;Z$8V0I2)3h^m{G#toS@j! z5|zT`nUdn|2ba42=uw7dLvw$>+y&6y;>&~?xp~@Z{J$=Jas}6iy04xW`>y?y|G83d zQ)!)|RNB*0U$(gIQ!Y^scqUD#9#48(HRd5E1sms5pRk>9@Sj~W= zRnv8TH6N~7SE5Qza+pp%L_1A=a@3v8CC@ZP7|Xeq1%wlA@SUk2Av$QYe>^JzM*49_ zW7dKnR=a?k@KV2Mq-d5%Z?AT+6$^I0$J-h4p4k2J`%#m}vkM`hpC_bd__jyiYLZK9 zk|)9_REmU4{F)bK4Dob*4R6n*+hr3I`UxpX?bV>I6rIR!r@@CBIH7oP*UwN~xODX> z`p#Rj+pvq52snifidGy%uzcDopUbh4zJd;ArrVE_67pg6Dw(<}%{N{Z?U|_`GyCZi zs8biEK&RZ=?s;Z8nA7gXuK>zqJgqP^o~7uf|Eg05-GjdO|3afq-h1-oFx$bkJUE-S0W zt2gnx7AlY~osL#mrRRUJhnFv0djC7y;JZ-WkSMRLRADMyyoF9?Em0bsnK4#5qr2D4 zdB2y3)mub#=RiL!B~AMRC-mCiI?j<$X>lY^9?U7x$TO&v#bnjvMgnhE;kMs1m|V&@pb+WH>7l~WPyeO*wSY0${AY+4h{}Kf4O!hh%~sQFgUbinS+;J zox;U1H#09v$iW$HBz{{^_|=XK*I(#yx~ZUYKR>9<>#REfAbvWA zKMng3x!d_;fTrjVIh8zr@uFt5%pr5I3gpknYiXf01hmvSvsAl6b?~c!OWWAUsBLmt z;t?UBA7PX5aQlPW#P)YRLJR7#&wA+G*9Nu5QNX z| z5>mV_!{VZKZ~Dql!#hY5oj(GcX09uos$Hp?e}lVN25~?c!%Wu`6VhVqN>!D@Ek`k4 zgAbCCoC+#XRfj+dQDHYa`(55}`dL@MK6;gqQVErYijSWT7WO|+0({%WcwbfV8c2W_ zmbmA3cW`|a#uV~jB|dm#cJ)MS17_^WP9a{sTk4e(qWl^0ef8B=Rr^Cp1&;t#&2owd!~Ayg?4?(SM|K|9|%9 zsgTxrEDgrdWYE;Y!u`g!c>$>8m-Qjz`5RncVp%<(H5RDCRY&EEmTro?B^IaY@TR9< zZJtO5DN1meg5Kh23=I#>orp+OA-I~-qbMnf3}hpl->*qUytQsyVcF%mH~9$ZIj1By z^`s1#YIi)eNY6P$o(wdHJ(-DXW;kGx%ii0|9dIdl=acZ|Tfb#}{=Du7d>hF8(7?bT z{5U!@3%_pAisB~W5`)}ZUrx@M48<`S!EVUKc?mf@ypp7kk>Sp$zXdm%3#7I;)-Lp> z8->0NP?(Ab*Ry+F3cS)SQ}$0bCFgF+Q#r64|D;@OYQ`t!x8Tl0z|mqmxRIiP%<%Ag zb;Q?~De+EU0Fh~l2(aT=ssG%Ar$lnN)Da%YV+XUSE3&k;d}GzJY%MK}FrFQyzVTIjy4_^f$5Q z4%{swUo95W7?o8CEl^Ua0jFkUVk-GylXn))^{(57(C&Fw@iJRGDYa(VQGn9pYa1HHI1`$ACpd%a>y(lO4-5BH4B0y1d% z)YQa04qN*FIu@UeCD*z29% zcCbGaL$!67=Fm7>;;0Cbw1=pYaMT>j$d458{NZR`I#2Ke7abhMz7HI z<|0KrsNDVewL9w7KndIWIJ?~`JD8$w(U%yLK)lj!nO3&$SAk3Ra3K)1cP#)Ho$1cR z64%f1;MbHo*Mch)A@yu7=ol8a|Kf*foN7R6mjb$Wl7%YlB_$LK&x{wE#D^PR-xpi| zIyeJa(5pnnw0Q(AjZiEoc_Qr5*l`pBW?EpRU*R5P@5E)t;y9qlNz z6zmz#KA|~s;qxuNn}7X#d zu2y10M3|wN^7keE&(!``9$xZy>U|kuh9`E#V&qulAZ*&c+o5}C(m8TK5LpyjvfftM zUUlrRb613({_hCR0Ut;R^B0h$RuhGG@WS3F?Z`0gBM1K7w^x)ap1)2{Z>)lgF0^q( z#dWMSmt8tT%w&Adys|EU1-fN5tv=aAN*OIqaAN1DTvMnQ(+b+PyE0$!lnG>NsYu`0 zKa?IMPJ4W#B(bb43m0hF99m^_l0hle19bY0Pnd3p2{22M96o`+&h^~AVlOK{h?3Mo z*V$X3bIR%y3g^2>N5ZU{B(22I7np;^`OhA{1c)p5H8eUiNsw#sGC7}qrLyhtCsSXm z+XfQ*PR40EEsb+y{yh_unaSFSKLukZC*2)NZd`d5p_~;IdKd26nr7u27PfzhAI_e! zp6{YDI1fW_3$qwKu$Na*&|9AEO7jiUvgcsh>cY32nJJB;H~8nU{lShq%16i^(T_>Z zmk4UI*s`bwnMc`hk5`;2YSnbK;pbvwV~wEih$Ul*c2|A>4!Sy>yME(_haw{VbzJIu zlljJkFZhDg+i(m;Z5XRrpV#I#K9iVC*;=lk@N$A9^;$TuO>!vfwVhF!61oNvH+U@5 zSXn_Gbzzxd%KL}=ni8i7k37u&COzsxLVN@XWi2g_8!jmc0j+dmUd!0+Bv-zTw4k8< zyZ_@!dO~@j&1{?eOT776j+J`pT=PMC56}L)>!qE2IVM?hrKfh+e*bPR-;KH{)73hr z=Y$H?@;pzqZukJb__av*0etuUW6#Q;7eLB{*;Ja%`{5U#6~bTROJtqccPLz?j(K=^ zjJ%@48>B8`G5r{##k!IpLw^4F@#DA=RG^F7{?*-i5|t|COEK7<9<6P@g;+qfF$?ike8xEcB%VF@Yhav=*N+{JY$Os^;V`$-7 z&6-Oq5-u0b`UBZjb^hHM#^UW$lA7#XnkqLLCMQMK=<3~%??2@Tn#W(eo72o%lrFh! zukfp>_t3?A`7nn&b`i~9JbX?6I(P5b3ETl5aR~{m{2#TPZiW)#-`e!O#4!`o8f!JF zjI7FhGU9F_tGT@{QR$Doee~r2sP~J;?volS*D*v4QFjaT5(5*HPb7MEB$&s_R`Q)X zMVe&T#r8NU-y=tn)#;D!Xm?+IW>U>33zHPH9#ip^y1ElpI==juG20sztFDQS!~kcHKkRm z;U2n|PlYtkynTDIIw9W2Cn>E|Kx49=S;lLuz2{A_F1>wf-R;BW;I$ymix-U9@3sC3 zz5$&KM;Qo2B392MVvK2am7>(KIA&*l&0sEmTE0VcVvUxojt^3vIuiIh!Gf4IH6WRXSgMBs@UntFoMpR`4(PP}BtNyvl@rRFEX!sc+ zxUASik#bI^bVW-o59+)%tHms$H$KBXHtajDZfG%oM~)!EQJ_i?)vT<@c$2d978IpNv+Q7aOpR5&M9 z>ErbvD|2Q3?aloBLP&A9X6&_B^SMwF~hG^$_v&T1Zw#H~G0RWd9BHZNCS1G9<^5Pj<< zLPD$2!amdkSmENo>;}IL;FqyQ(c#px$&XeG60;dJ4QV5SS!ji;@yP${)Sdt643QhN zxl`s&K-($smqLi~>Rd0Cz{)fgn}v;y&43*Y)?T3dxXnG%_x3Yepf$IaSBtADDTx^r zQ>|m@Ma6f<)fIe<)OLC(Pj|Hn$r1uZ@bs0{#hKo+q2-Y&!qLb#{44BTg#abb8 z5(P1c2=0wAwt=8J9K^2SKVa#5qRa7_kz%(N%kQWq*AtPsY`GLr22?Ie9jaPtj=KK) z@8|0c&urKWpVP_3jW-Og#fNHR(Cdw3*GhSLh!|DFntUmo)zu$w^DNa;;d@#&^D{Kk zK6`NnmRcWjZg&tvw63uM3_1hJN>-_*FzGun3XfzDoMa^E!COK&J}%c@sbPVL#kz!2 zqq_H1RY~%OoHQo*_*m?kw&q&6ev;Zf<+-cI8cz?{VV*S_PvrG_hWx>%_0Z!eC@3HX zTOe&?-4BA%#-xZGGc~^|=Hf-Tb=X-y5ooVYGrxczxqc}zllof%P$u+Uc;R{FR#tIU z$UaO)0DoVe5h)caK<^Ih_kkS2v1hu!A)o*&Ezub(MX~3PEDRP^MmUx_LyT+NVsX2~ zE*yG1{yO)O0r*WHA2?Sc`uoAnvzkS=8imE{^Zl`-x{I3xGI18o5&Y4n zLAQ+t5_DdI*>t68MgBB{_;Qb&fTfOPF&@DT7tB@JzC!K;O|q6NA%kM9rwK6dyhCkQ z>=*xJJ%t`h;G7}4(Ll$u-lL-(>AWs(We{Pn>a_AXt-=R%`>C~=ZsRd8oqjjf8{?>| zvtP#do}{lGKYjZ2-)W>s+{@~L^xmXg0*Of`tV`L`Y}#!fmaWY(Xwf(@(==kuI`_QU zPBvPiJyDZ!Jw+&|Gv3!ZEt5@WOc;YKMVFbhojSU24PA=~r+QcBPri?n3O%1D?U3>* zrzx0)A;Q7fiMPANG0)m`Z#)Nlh+=UK$lj zFLM!`sr%_Cc7?Z~oaxyK5u^D#4|;VPE>Bj)3YOg>t;#lPA4LidTrdb*i)9b$fU{1` zqtvFK{~@CMAMm#Q45Bhc^UO8azNBgtec1RICm9}Cn`7KbkH^0n)v)=3Skr@$K}la` z_%-{;-W0D%Pc=_yQMWWJm~V8x!VO z9uGflQ2Usf0omElaunUo_uAq&peDjiGG22^fj^}D$K;o_qCR}!mKH!f4|_4>yrI>; z`9_q&7lzqJ-qREh;FlJdUTFnVU^*3gxaoZ=6oXUZuy$_}^qHjuG{xEqzWEN?74(?D zOm$xlY3MfL-Fdl(7#>YWGjZELz32-5F;3Hub#OPRGji2urOatTKcV!=0&z5GnJKrj z%;2v*RD7Ig&A{c6`w+kf8Ppx<|f&Xpc@zq_-WkF+4$AtFhP# zsfMQ(b1oFmE?hJnEL@xJIn-cW5dv{Dwe!O1ylqy_vVZ-hZ!zKVjE&+F&4U=oVp*)3 zi#v!K@Sk6EFFr++gmdls;!l{5`{_fiU;~@_4Rbc4>kRdH&im(;ebaSJzmK??hpp7| zQ&2Rx#QakyEh0mw*=wblbe2XA_w=7sDm!&chR(~)IRjtuc)t@+VPRpc=f%G9`3!TV zH`ibwI8!oka;rb0C|!gfosZF}nhnyJBD(!g#zL)^HcUuYygg{E`3bBhn>>edxFXgm zG7QM9R^y}7)1fk-nKXE-jp8GK1ao&ilT*8f`@1SVH2t+ z;I>$uWZek&L&^JJlW`AWGY~F=I&0Uw&YbFxmzhT=_7$1q?Ne<(ZFJ+sOOEToPY~no zEC4L%v8bMBGoZ9wtR5+x#avpMVEky8148baf%rtOtGm0gPoU0SN$)%cH1KlSd#z~y zVvU&^D!h6p&UhPSLd>Wa3$3W{!XT%T{;uP?7;)y7AZQn_o_lk$kO~zzUa_O6ev%v4 zK!(@F&l6=LheBlP2VVs2-|anhIp!}E)D%8C!@%s@Z(ha_Cl&cdMO9490#pcXjFJ*V znE`Jkf+;WA^#0bcBTQ0fzpCF`57(`8_agX=11KfzA&RX@O3fP+|D^u2Gb}?aECeEf zv#>`(XXi?n7(;jn4j4EQ?M-K7Loln2YC|Z-0l-3LwrH@qoV>PE>AfWWKeWz%J)emK zI_Vj0xc!F(57qa^H~xH#WIHWI9SuNqP5Mry`FdST`{;B)9Qm8 zRI2O2y`T1GZ@IpIXbBct9`25EJ<1wcWjwYUQXDYP%Q=zT4V!o{Sua{lxRfpw;GhVp7s*w5LlS5JQ`0i2Eo^%f&%dnjtJ^GrwY*mex`odmXd9w)S!|>^nPQxqc~n~;M7{(OId~n;ND0F zZVZLvR>EdKjM59SLR=APj?q!IsWURDPA$T7M{kf`juC-oue(Xz=G_AbfG={bA^e?H zfk1d+wSe=9@q@4uM!8|CBK&%l&5yFEu>;K8PiG%4@~|t}Bdq--9@#lsr){f@jaU59 z3bS22R=rW_QC9$N{tj1dU_*upssHvOu|XHwlOeU1eWc%-pm{4^cBmSUtYBK6x*$k1 zgiNe4-uD(e8>S(v*`RcTlIL$#Lc;N|tPRbgYI2ODRzqqq7FzJ|A@7@PFu;o1xOVl3Rx&s`+|Yqs-?w66JZR@YCmV1G%dVe(9QyH800xL@&;>j+E}YjJ{VKq zpz&1$<0u1gC%ZVPbv>iq-5;5Y;%=;yH=&+sfNEk%)Iz%)^OK|Af36K>aj=Nj(vmOb zYn2rlX0*b9Wq&w})x?}~;i~ruK}c~%vhaMf_8)9-ZbW&@`+~;d6S!pQYefFEWm}5l zGY#T>fp70F5BJB3`bkXqQK=P~B0@v*<>Gxp;8K_*iAit7I3}UrTEIQj(Hm%?X7xC^ zYBv|Q(B>|^?!GW*j%;a=8~^$6?^$D^D}q?18KVGYN?B6SutR(E_zxD@r4TF0%f}Ub z*v@Yz_pjQ`nz-6Aq(2yr$+SRIAf}kWfR2#C?w>}TbU3Noo0miJLPOc zi!EfglAeH3rt7DYje+z1knSYc%XEj02`e^`GucLiydu5=Oy*_iRLSKxqLHs+e34`Q z$0Qx$Wx*1(-#Q|bCTVlplgJ;9>)He>}O3S^)@}PwLzM7oc_jr=z43nLH^y&5(+v+_5dd>2XX%@fp+jUu+UDjVE{<2ATmF&N zqcUEeNAY`@d2METh6~S}KCN9QOXzfnou?C=NzI=FX*n>wq52jovNA0vVrSr;c6)D#sNQsWoHI8GOjZ- ziGiIhX~j;)^u4hXlag#@9~d4DQrYu$ViTfVgVv77*PQ_8;aE-b)ZOt0i*;OS0vJYm zJ(j~(M7uawO!^DA1-EPHE*xZ@_WkHj$8A^;2LQYt?Nwp^qgXIsWVv_10?uz&vEIMd zr!M9hKHE~Np+Dby%?a0xnlC72zAaWRS$z#OzAd2V5%wpwKsJIjOl;?I!{3J2cX7&7?IPDd{rLAa7>gHr^hmbecq-3)uuwkp&dc=- zBet?R-Px{`zwKil=;`TQ%dusH=+#Ax?t&357qO65j3v4s@<5UV;XR|&^;T}rZ~SpO zv#+@N`T1SqG&RgpR99BML_<^A$SVrEvmGX{;IxopfwpL~dFMjxY52FBxRaAr<`#8s@^41Dh*@8VlH9jsp3bg zJ8hM}>9wA4v_xcMePQdFo~sVlkS#>!gr-hUY7X=BGKP`PS~(qn((y2(#Yd6l3}qy#DGCgD{d>{=^Bg`Mv zA#PA#0TuyUa#f;dcD+1VFT3L;eMKXmTw{|q&a95e!9|-FtqeVJZuQH@xV{{17o~U? zqPjidk^i-dk8Sh|-jJYL1VU3;t!O5tZmKiOF*|L|bb*7{ZsroWD$GMHP0AYvD*HD3 zf|@-5H2N_$)rTRifNq7f*6BeI|GT2JIr~FN1+H7fAPHp($S&gI9-|#{qSc*BT9GrQ zz-hfF;7uMM#>(sA=}8(INV_AP>|zhskTy%El_oqnF-TnZh$T)nqv~AA31sKaG7((4-$&+(}(CZQ>=XL zvnH@D`m)YH`c#%m8yhY_Qjt2QO8wT%JbrG@wQm||IC`m!KG?NQ`nr>v7qU@oRue2W zWHH~JY$Dfb8aN(u!jaDu#;{Jx^EX)1(xonpcQ4_}h?ktNZ^?QOW4jmdb-34qsdSKf zSvnKRJWJm2?R;CQ67B7OUts<1K7-!AyR2Fph6|-L5hjO5;A440mSxcjQ09#7nW`|` z2gyk#8Q3&+s$hZG#A>^Y51X{0k$>{*9dT=May?}gS22>OI2Oj8crbm)Fa*a1JqsIM zs;<@}a%peOtGo(2{a;p+Z!lYT>q=GYp0f%&On-pmoIZaB6iMrnG;r9&*FMt%k*E|S zB*RAdh45Mz^s|MiXuJ>k==0g^U4=Y+M&Yy7W*IwA_X7fh-d9DpT zD&j_Y5yYtFA(@YWkiV_+^6!dePv_V(g6r`*mr0N`T+vOJ9Yw5@OX#c`b6j45gYHlR zXh0V0#8nmUF@j1E>0N$Ei@GarrveKAx0{SmtGzT1c72<<)nTXhM?ONH1j;!xDPbIG znpxL?$9G_McW*4mhP=xIl(ZrEIeC-M5v(qf*oz4m7NctPOHcN2l|WB10aeIh{uHP)rjAPB@bWI=$!py-N&>;Rsu-o2H&gW*! znSFiRJ3zMyHo(Ej&tf!^r_nr7a-*~W)wjy^2S@U+jt-{SO3qb@Oa6J(G>s^~Jw?3; zJ#|a1za?!UquS@Fwov!{Oq|#LxIi^sC~}CeDiU7E0f?z2{0^p0E&46xN0!D$@kOMh zEG1H=MFE7`?y2ynB&6ZLLck$W-%Np5=agZj@+muyr8mBnmv5+VSOB3{qkPDr=KU{r znJXZFCl$`iugMTeLbWl-2Z)M942sEKlbAK_EZbmq;Lmi3#z=*7HuB2sdMQ`VZ%&3K zus9;3$-F?o=67K1SPERI+aTU5BE`R>N8@y;C>{H&Sk1L9*DMBP3TlJI-fedB*O^3S zAm`z!?hq$*y-j;nhRRX7of>0ifO|oEi*i!y@uR|J zQOZ)miN;V$*me_sySm&-P{}B2TBeZ}7dWY>AtfcXwKP!_4OGS@$1YG|*}SmUr6Qmw za%*{0js*ZB4Flyz&?B#X;gotsXFn=2?BMV0QV&0e(eb<}TAv}k*$_es|72>Or&ASnk(|%EN8SC@81tD!$o7WlVQ%Kiz8(*q8sKs1^5!_zkrL& z-@rxmpTNZuE9&nj(^cKoJ+0YC7?SepMN(jOsL7DWXOLfK*Q?zMi+js zBqiSbDlF)JlH$q7+M-+Ao0ztiv|82E`;Wuk@h2fLgq3Q9*;LWxFo(Y*#OGf%j7tWr zKX9Rzh>?+zPJHbjq{*rL8)Klq1p+_sSOFl|NWZh>4~RfAP;3;xet4rBM&hp(N;J!5 zYG_^0U;@hzFq^PjjmPu8gD-GJ4)rT+__5^8pPeSOOUSGHK#w!;6pW{eE9as(9Q;kT5dYmADoO7s>fsJU&i91{Rn~c&R|Q*X+3+R zD(w#^p8a}D;wMuIYJ8qeoe+iM&5?SGu{SS;0iYgjGuveW@`ylrNM$MZq-xYV&&q$p z|1`*p@JY#5CYZfqAvcopHfXE7o5yxgK#@G^H(mxx4W4`GRrXN9g>R;4_zTlbNM&38 z>QYf?#m$XId@ZZ5*FIg}r%+6v;dJI~7%(APWBZ4jOx^c+vwQw(6wN8?nGP0%0#9NT zS0m4r{kfZ6-CnLp1RTUy#b#3gt+*J;JvZDyJNtIvDG5lGnQp${+^!XddHIcuG-$e5 zRC3^Qt~yQtNOFae@3AhwKXnlMs)RB7YEm`T_X9i9Edzt;zThD3sy1Whzf6lKm|i=1 zeLwRAcsp2ngvw?{H3fmyM1%We1WM_e%S1@La9*m$NLT;%MUaqtg-sZyrERLL&b9JS z-r6Vhd(#Dn*^cU_-9m9#J8Es-{~%4dC-%9iKxIDK=3F&74fao}xb(5CWGE-q1oIPq z+kr=@OZh8Lr#h2FsRvKzy`buEfLJ-&TUFLItVV^~B`O6r>Y2FNaWusFDvqG-yi?8kg)NdeGn^XLGECPJH$@Ru69r;lK{Aac$|S8P52E4_v40-r zxwJQ}y5_9+C=^ddz4a_AXaz%S^B5Sto5>xmv02m+xkw%+kl~{U(tzrzJCEy4+wa0k zyW9DTNC5AqaBX&ULT#a@;BFa|1Udfnuf28H_d!kNijjS{F+i25*ga#byGd> z?>MCHU)>*T;(GVtr`a=X%&(0-u!r}C@}k24v>F2_A8c)MZg`CS6OjSpTqZvh%-&db zJ{VrbA?1|MDRzSb9P&o#QX{;&!rh-lPnsgS5WQZcjatCD5wPh8o3pd#PaQ=P;$C@=t)@SZoMJ5HO~%##n-QUSma1;DW<_T&uv8K4K?s6 z?H@+^{3+m@bKP0 zQ^dT=$z70E6ZY|TUzS2-TxJHt7S#WsM>lRqMMYgX4SP9Tnif<%mZ3 z%4Qb};lU10F7xhGGkqBoW6Db=b2Uw7snc3IlXc&0iL05y!>&wW9<|x_0yXJkqn7s{ z*rigE`p!wvD}Bh=zjNSRw4^~It>tR#Klq@wjARuQ2#XeY+5KfKiJjK^u}oKQK6oKt zibkHfGwcKYDeFw?t^j^TXa9DD zBc5+-jIZaQ9i<|~d?0@*wD*-2E_}ZRX%g-xw#pN`txLbg_uRZnplhFc} zHbe?3Wc2pG4Sd*%|H!T=Ua_~G2_@ECG-n=l`tv4&q?u|7ez!A>3DH)j)l{%<6d!&O zFlA@}OwjJMe6tgtTFA6eILjOYsQVzrTm;WGQO#n+J#F02n#)M%z5|g}0<^H9cL;!G zqJZTYcP+tYXI)8;*A>DqF*64TSjra{aNELCAtVsqCszI^p7QtG4Q1cmA6ut;pYq~& zl*H!Kf;r7Z=JH3^Lk7uz=4a&f1AfLUC>q&OFY$-{JJ*w-1;Yk2p=V_upo&|3_~y=` z=CTat__doC)$jXHUp(CG3*2`d6Oi^ao>G!q$&~?akke8a+w7p1__7wNE~w27T6Ar8i-A)X4s{p0=nmMxdj71T07TB5?+%Y;zt^E23* z6(S-ck+z<+OiP{7@bHuC&C+K6u$L6pLUHe5py`sY#>>FUVGT~+5>7pbTgVEw5PsU9 zW(^H@tazH*U+KlA*-RbJ6hYc8h`C25VEANpp@Y$1tpuu3oU5xjfPlwGCnD!hd@5S) zS(-m{c?b9Z<`8{9A*Stn9FeT*K{s6QlNhL-nSWUbi%wPYRJ&vKy#<{d^TFt$*nlkB z{mSFVLL6uuch>|i870iG&=KR9$30!qT%D4KrUP7FGGBppT{5Q@*EQSiZWP76P((P( z#9OR|DS2l`m$46`>dtc1cT8he^+QNc_>q9yFtPJ^&G2|N6;+`(y8Z4NhTlbmI&!_z zEar}d(GBGc_V9W<-k@yH=6OzfQsjQBa*xPyP(?<%GRa&smkJnrwmpwfVd2*xO(g7( zg(lD=g@$R$!?xS1>6$ zQW>P_A?9B<+7ClKdK-Z2;k+?Oi(H#0Z;x;G0DOB=kUMDFvOsoCoH*M<*S?vypp}%K zeiQH3!!l5z^)b|(WiK^Rq#_lsKR_&W_A(c}omjmL4omVU@@tJ-cmk_z z)Aey~XX!izO6*M275)B?GVuFCxtd8tef;=Qk7G3yz%5Q_QdlE`;cbwN_gH%iw!W_v z^Gt%|od+$Y%T1s!NyF;9$G*cv65nB>)S3>Pg$|3XwQJwwFV|PkPA*XJ*?}Hhi_M}V z-knJ#G`(g;P>VJSO3$_~##t9Z_QIgpb6hT9*Ui`$}4GMQp_Wa{s z?spn?pVYX3jMF=iabm`Zt?0ZUL5x?!KG9?4AZq-t)!6~IQp8eo)w6Nts@2#t+D)Mn zte(t9oxDi9dBWN)+LQ23OHSR`1BQ5S7zm4dD5QYjYJn6|{6=#$r#r5qo6~+;o)t8) zC15Vyv{Vf`+m~w=`bWq7XNlY$^Ip!V#}+H19IO4dm||Oz@A`pVG%DN1!pXL$G(=7@ zMU9|dG0g)I6}ToZ81D~zRrAZ+Vj&fBGTv!QYkTN${n@v^WvJrW#c#FtM`=G+f8w|?JiKIdbny$mI|Mq) z0N-??J=}=?<&=L+F-4uw_tx?g{r38GG77C%Zlp*W{HN%dOjsN@2>86O-l=Q*GkNwj zHM5~{j!n?w0<;9UD}JH({jZe~u^A}b#e^fPTCP5e0gOpm43;gMeQ1WJYQ}<17D{6=BBQ_b|r1 zq088E767|+$=v`6udF6sMrnbiO$V#*=)it=@!J!U3-{hFufYKbgssWRk;gr0R5;pAN$Vm$< zT%MU7ts;e(y=637-k8^~4$N z3;2GTscXu$mMjBbEJ-)74~}~D2X7V$3KfMJ)84~yU5ah88nMLVa_(Fsw@w3{#S9&7MR)1aAotYhNh~{z zBtI{;i#YuchjAt$8Z=<5YUF}Nd}#ye|4SUk zx@XCH1mh$_NSXyu&3!LF2F7z>SpZ?|$o%U}Owv|=4EEpsebaG0j2jiUVznShGnoQQ zziQ>sHpaYS@8GmGH9~oJwu^CQT}|$FrG-)bAlok}}O?n9lVnd{jAib#wNS97%L8XY4AT2`1!$ZXU^W3oc=8A>zs?iby^-NhhK<6C{o{XQp zjvt9NT_x+-FOM(N%szf;MA*#Ee&eO3pECFelhX4rNHK-}CWDc^!j?sS>z1^$P@ ze_tU#B0ychF2D6*@!GYXl?$n$0<@o<&KdyJr<;8rP7rGhre42(?d_Mn@*g+wueJZZ zB$Xa9%wb%fPNfEj4{fry%PDdrrVH$n_5%j$K?pckCLt#`H?*J4y^EfIzOQ1*z$I4_ z!KxJCI9WW!UDZ?%5uAFVM5#Ae3V~7t@~bEraY}IO_Fo7J{CMn>0lTuZvtOSNh$)_k zUIpL>kpvLKK%-yPE{O~DGwT)CDI!9%3g>!|?wRu?+rsl`UubfKhC??t00glOSwHvk|tMG&cC&JPA;c-YO{q2$nlLF}zE3NFtp}d(2eUpyb9FkmWb0MFk@jWUg z2bAllquQUQl2#!z)pYh7DwI7(jvl$3L%P)-11V~Gnat~JkqxNl2BeQvik2y&A-WJ> z3u^)>a$ete_8%SvG!|L4bcOH}9{zqnlOALrJmldxX%~d?1rOU>B|ujol3iQU129oV zbPE7`mcAMGCDoAwVCO|^$2)bJ0T<~a&LC4SBGIL`X4r0h&>b4u=iuW%`tIReo7N9^ z@bd*&)8oNuAM(~$+NcwwqoXo}?k}=}0&QE|J|nL-2rl{0cJuh3$&80y_Zi3%RCi0E z2dYppV5C7lW0a_*5a4-VOXSPnEOfI9<)NA;%nl;m=~r|B79WrnP03pvoil17M{OEu zTebwO$F~+J*}4myME}#0`u+-_9U0$HMb$gB+6gwyWTp=CRbFgNI&7(@oTXLzjLyp0 zbC;30jyo&g>K{Ou!vzO%BhIzu86$=02yFc7+iZ0#CUg6rJB`M6CwcbH#CK+=glvVVEPjvnvsFJ|CrV^dYsg8{<;P^K6ot)Rm?J3D`8iy|?y`-{`M z>kn5Vf4H+>Tu2FafXq{d^i8!h(yq(8em&rx)(M;+HucUtlD!^eN_L`I`0gyrUzIBU zH4gARUtaUibW^q>LW|LIBE5Mg>@?ykiE%1GynU;a{d7E;86_e@5*Ng|M{PD-_ zlFxrJY;lyufr^<)?1dE?jGczh&L|a3_3@|0!XGVgMVQ{|97gcTe$kd{xR4#`dlTtb zV}A0R9%C)Jt)PLn3jmTY6%E?^d1_7g2-~;!fVt=%x>;&(Xe_*LpGzcS_tPj% z0>g-{g-(ArDm@M;P*C`XR7-wB$m;zZ?SgyrSs*F{4!CaZ{zbCCV9EYFL&N(5y%w&F z6+tQb{`lRofX%HmG|j&bFv1&~>B`SQTm3}d-<9NlKl5LY4P-n3O1$e^JlN9#C6j~R z)Cr0N1{HuhLxV5QN!LGOqUx*+Re5UD74+CV)gh!DbNe3_%l8HJ!-4;Gv8?|R6rB-k zT_Ki}t^MM5ZobtQT(5(sisJA4r+Get<0#C6_UCiqj{u(8X1R~>PkpT)CU6jt9u~^y zqVt^wN{+iu-_}TXy>LwY4jLSr5ei^;;zB}`8SXUZA>DfhA|#+jEwPFv2J9C8zrpW6 z2I-R}jcMBFJ4J~{+bF>=rwN+@l&!~1C%{o?l%+t zyV`-ifE$i|SEGHGZj=ECU62}G*9QV$q)o)$6&qQj@06=w-6)Mg7`91STMwu&2-w=% zSfY|HaQl3Fb@LnXgF1T|=y_}mMPnK>Bjl6-N@u_}nT}8dEe)b^D`%g~_|!jDypvk9 z4$KIf0a*EK?0V>5Q6zpmENw(jzV7LTs&^TEo6U(D>r6EpE*aI$ZdY7y1x2xs0=G_W z>uo`E&NOgqG2lF{Zz&ThOChP`GoaFaVF?6*QM5OX9fg{F0;alER^wND zhwsJ*sMQ~pi%d*mZ7!qPIRz2y=00bExXaj|s!H7K{+mg(0u~aPsW=H zAheBEvC!ktty$ltZ@du=1p)4!=Zs4#oP+7^bF7*8bcy-3%S8azm+v$JxrrZyLYG$h zJf}x!a18p|A9=I{wZrWM(Fra}&(iyh7>x?dS%FB#gvsD=viA@diz3OEPb|&t`?LJV zviM<$J_Wk~6BVS2Z);de&jIA`aaw5_G~?7ezZE!PBiCnbOoP79%742A+SiRJ9(}to z1>mqS$62=@ru6fL$W@EcdM!f2Y8WR{f4+LWqzw+-ZDh9hKo1_p|?1Fb=m%eghOavFqI!ShNTxPO3%@PM+4_~R3kn;1u$F%>V z@cv^U#)DKmJ#|~`rlmoWm2`0}*P9OmVx+f6O4P3g>7UV3;$(22YD4!=7XZPdLMmd* z+HI;=>6|3-jX14fm?^+SGf{0Q=@KU#&|!7wdI^*KbiQwoquxkiQ&U5EEtz`aTow>- zuYNHbxSRVK1e(l=Ld`y#?#**}SV}Lrn`i(x_;NyGbq+Lh0TJwwiNYeR{riIZ?`~Q|36JzN{y0yx&bZ z3>sLsE}}Tu=q2awyTI0@F=-j}?&j?00DIm6GEm$U2$Y_ZT280Z#O zLhtuxc$SGvt>_fLf%{Y|I_uC61O55J(Tv6=um!cU5eywaw`V-IZnQyrv`4F8;+%c& z{4!IB_^mVsl~Z8hmRl{Q1@*D`1rpu2cam8*Fj& zIjw#Yj|7yW-kj&Zc+BsU+ULj6TzuIVXpMjlr)&4M)X#gEML9|cZ%7xmAJw`b^^u8K z!N$0Y?L+ejjzrXYiu|3e1wW@XQ@Si;aL`TkX+Y%@;Bv78A|f^EhgW`fKtEpLc}ZLP z2Hnrs-31@=Rx0!HcI{H0sb#0{QsI- zAQe3fuY=qg4%tcN|3m%cpYNm}oI7-+A@EsRyRj3&D2Hpn2!v%+;)J0zpAMk zu6Fw%V|gcnu?-vBwQH_{_vdx*pI22mOqo*j37>kz$9KSu0k_`u(YFx~$4!xI^@o#I z31qJSs3jOfPi|hy@XAx(&r4_8=)YB0%X{9f{u>Ri4o3i{&_H6Sw>lGjrP8 zw`Z=%d-|zj-_f(8+EX;$gNkn-)*ER^KgAKC7v$2vOkP($)-3Fe{I-+*GH8LiC%&Mw zii~fa^v!r{CLHm8k1NI+0X3 zI3dN0L-60g_OEyS=c_Exd%Jsjw5H2#nis-;dY8@z|Ld(oARS+7)>b||F;v+giJ=IA z28;J?pqL*PBI*a_Yo?z2u`qtVcr1AJ`t{SVpkI@Z^3uuYe=%?WPN@a-kPmgMJ!Bow z*#H62t~E|pei98msQP3-2tAx^4|g*^8y$TOfBeC9`zqr=l8TvG-Xnz5V(#(tbcUMl zTd-&qAkw%0gv5FBK+b`APtMkdQ9L0*+`iRcByrvpaQxXuM>R##0n>oPS4&%?6qKc$ z2fzu?EKhj_IS)7K%L$3)XI;@QU;4bZuv9L;s4IBewA9aOb+KQukyGZvuxD>pA+*Yi zc@cPBUsvkGi29b5qZwO4EF6agQ)SMohjI2=RIC5Tn*6Wj@$wrZII@FpRhZOu_tDQ& z@vB#gP5i9CYXSW1vr4Q2vm*2X5HW$=c;Hm@DxS2S#G0NgS5vrfWMjbny4I$VVZNQm z3rR_n6(Tr_jtxg`?kV(~EAxOw>bOuIG|XU%CWJ>HtPHbheW=ffiE-vV{xO0wRe7_> zQO&QIRu*K-G0KD%Pql^wP*+jvP2pV2Ua|`_Q)3VmQe?=;)HDeZ;5wP4Y0eJyKyV`Z zDyn_hwtf7CJrX2CWhWbw`j!7O;9ouX&ky_8D}fJ=`Z&(Ay0(Y}_C`a#*`~s*y?>ZS?W^Tyjj& z{&J|YkB&g~`}G*-v4Q}qhFm=KR%|;E05Cf-B>dUZsi$&dktHDBS)Yj8N+~Yh8mO>y zmx{;r+oT-MO!6?T#MkcT4#(oF#fGHq$KPp|*_`@!N&NTo4aBH8Ev)rz8Y($C461AY z_nZH1A|s&TmVK^5{P;mSh8|cZaMiF>Npaj<5q3GUx_~0Q?qi-(e!e$1?^%1Y_ShJe z80c{U^(J8T)6P-y6kg}8H<}#f4(U%H>~sQhHzM50L=QjtSooUd%w2>Qzt(JQcNG5& zuFT1#GKsX(@i8L3Wvq$oSZ1=@rM0+7x6T-jsQis>w+OZu8PwFWwvIblm;6p|W-VBl zS`!on^%Q1WSLfVgq5ae5bF;If%jf`pF7Mu|_K43t4kyBT{y`J`+5%L%7@EoDB9f9b zkGz5Kh^?GVkG$1viAU?3G?oZ2etzF24ILSon&ihJF^x~c5|@c?!XiVB?qbzPnq_t~ zPqWwfd7+1HRHl>&lC?~&R7{-<+@(L(Ir-Qin#V}XN)R|2Q_Px-kK#I%lcz` zF9!5~A2N8BdeVr7!J}DY#~`wtT}lP=q=z))t(QkS9J_cSwBk<<2xH&fGVsI@@iE-8oEmvl}{4?!p7k zzl~tr7h69oY51iySDXB&M@>5RCV4j2pG(2n;~`difL+XtJGvlTgvl6n+fvS}e#cfO z&Yju}hRkhi+aMeGfn9TPQ*#=!G1a_>PK;fdrd?dE2W>BLEu)Au^!zRW=K8+$M$p~P1F9M#n-X=%;Cy^2?f zig(5GP)^{e@AdBhX_~BhkC3tPD7{Y+{Vnzmy+-K~wqqG>OIylA&lM|W-P!9GyazdW zHai$y`!)*u*Rnn5x+ZA&Rjk`Swh1!>=RlLCfiuNn37yO_WX(#^EA=9TYSIAYhXB>4>1ACvOX1pBp9-0{no6;|d$ zD<~N_4NSh3xPRZDtG8W-ZzLn|oyd|uo`@#PXJVzD2fHl-I{P}Ez-Pp3@503bHe-LsnCVqmUOKe8vyoZtaggoXZL17!>g}HI3tJ~V}8K1z>2RyHK&~q?n z?gau};)ZBwb#9%8ozHgu3Ow!O(^nyoSgtEH-OhVsE;M(7jX6?QvwVd_ip5NoF7!Qz z3}p&sCP|!yR~JvVws3o^sg-;9jy3A`mkoX(GIMnG=$JY~Gm>T;7Nz`dyvT%@p>C^M zv-;xW*K|xlu$-ajxV^6)fe6Rf>Nu*3Z)<{qAC8<6dS(lWQ@xlSvsXc8v(RVyc@u}( z0(>f!i#LeHsRa59OwB(L@FhP()|L)z$nDc9%dyX5W+_VfzCiaRubd)orWZ+oPe0_b z{pO>6<;tCr`xJ4%)lbu)(eY6H1RXOlN7W7cK!v^>ORbcSt|DECt`PIpP4Mstj>@f>Sx>sMVg9~L<(Vt&+pN+k4;om)28s1M;c z);_9f$E0IFS9!M0wd4T{U@H(Lnk*nk0!q3^l@YYQaz z88ENRt&7xi&}+xF9yIX@1eg9g=7Fh%8I6QdP%CO`4Tp&f{RV5j3r_7VE0%^63F_Wg z4T?*@D1Fz|`&HU-sK#&Yse8N9MO~o3k?VK~r35G5#ma795e2U1;x1aD>l3eFJ*&P# zbU6~VZ_Y(RR9l(_Q;%&eVDew(*JLcDYypwDbwy4M9?zReu=eA=P0?B}q&=vA^slKl zMTE_u(V;;+@Y8zW*mFnN^*GtNiM~ot6OTFLm`e6O#R9SN&Q7OLMcW(oJg3c*WCbH_ z%0Tb>&mq(6`U6q?TwlOkFo^68H8C6V=0y9WBSXx+r|>coBE6uc9yD zTivQ_-mNN8XW|e~*F>SEx^)EM-Hl7AM3*W>qg-Py??F!}jmtGt3(gm>X9gmEqN#qJ zZyf!v-;94YRDzTvt}cT5ZLGR>`L*FZhft8;T31U5Qr2e^N8M8?7|oO+u>T85g|5u4 z)<#nJM2nM_%f>pH$lN~Dg)+9SZ;vT1-}k_PTsR{_GK)|A=(g#))86?ZXmhs|x_Rz| zr(q9q)eo4FChj*sGmgT;zcRDGU6G3MN#7A`51}k*k&f?taNJt=s?7QjUIzot7#W*& za0%7mfuF1NE_m9dFE6R5I8i@6P~seA}ty^XORaUaLNp6wb9 zK)712>hiPd#PA)uUBn013fIAk;|Ub9jBZ(KQ7Gl5jdnWQj1S0 zFV<~zJjQGBUm6rcyATqxJ>cJ7?&x2OaZYndHD8(#R${{p-gB4hw}|W$yY>4To`a`q zoD5hpYF^m*4=|j&7f?WxTqIBN_FqP5Eu#!@QfJ#`$WHO+@!Q2i6%JO-+WVha)tu(v zNJXxbwMmV>nlnZkaEfoPsw`Z*X%VbR$5wGDBFXA&W2R_ z5$01cLxWCtjjlwl!DpUP*|7##oyc7RTaM+4;~`q3wd1AE=Q+OeVms=Jf< z-pa4VrM(8#Y8P91C%cIu{^gv2bKq2v(D9zWB7e|fntQoZL*i(pIV#Jk8!E0fiYfO- z6Werq`Ij9cH3YYLWLpCUY&qu2G$y0{ChtRCXX5{F!mD2PG9DPgHuiB6V)6AuL%%(Z zbh0i_jn7x6Y((|1X+?#Hue2))=988&yjs7-oul!_0SCs~@(8`mosWU)jj8#&;Bl;+ zO6Z-&l%qL@+iNQW)k0!2SjZhqV{3*CP1^$Qs+$>_V=t7#qRQ>u^G=?3oF1td#VMtf zPyH&pJxrWn%G%y9oM69+%)Wr#EGthwsKG6MO3Hcg2$&;u8I<&OpXFemxa$X|rbe@@ z-R~l;7ONQ#6RjT8eYhhrDz|RM0+-1fs58#RY0}@U znUdT(-*^n>%C01^iGlMQx1EYRTWbU7RHr)iW|miNQqg7nkHvQ{`hUu-*eJz!03^GK zdFVgqd2D0Ok9p58zPz?Hyk0E~cFIthhZhcS_hT=0_jUIyJjJAl+II!r`4-0Hfj55+ z&@Zm;mZt{jc!F7`)tN3~tQ#KAQePjeQLl@tmBo5}dv6KcD<6OZ95u*Lh;hRAj3Fd#m-lG?qsE>>L6=h+Oq7a8TRsZb3I+8Vbk}nwL=0sX!lc>8D(7rw>SA zJ>b)nhsy(obWHRF`!Sh!0cFM6_GbQzMPgQST3_GtvP3X*NHtcW$tvbs_jeTJ#bRF3 z0Z6>l->0K6`%Tk)+iV2fZVhml(~xR!uFhIt30{r;As|RD)u|fXdHJHCInqizI z%-kQZ0nzaF#Y|r}KA|0xr|H5!BfqqfX7Wz$)i(ZxwnAbN^N~Pgkp0d~=Y;PuJRI*U zerMy|+q}HCGC*t>7A5yJ^jFdugWm!(c5(Z9*ptWrc$-R18nn3SMxB}WPCkzJn>zj_ zQy>4kr39T_Xh|)o);noVV~A5o;64f2QsB^pvm&FjjwhCDIsup z!j&smhF_5T_G~*Ppn))rDR40jSU``8mE(?s;|lHo9;JAAqK6KxeABrreoKs1koypI zsZCq`f38@oOaJT z-1wl*vI$T#Gzz@*KmlD8rMd-BOk1KVdERPGkQD4H!LEZI+{QA5a?#$ttWh5Ax8*#> z_`@Ood@+A35EvoYAl_P5ES3%?t%VlX{QO`4ys{OpvV5;6^my@WH^OY+J68iv8Na)n z64oBA$XH}m-VJC3!f9AB8#hF1+88iQMKc@HAs^UU1p)-^8RrS{KE)r8_47sGgCm-e zo8;Ai{BVbSSz97>>u`3p-nPvc;7|WLJ}ig_csc-OPYip^7SlyLn0?#(#ocEM)v^en!mB1IJFp zniHQ_{|RsflRfmpi8175e!d=P8!IxdZLeH&^6FcLfXx?AmmiL0XZUC!ptiUy;AKILZ4C$noijKVjiHYGq|sM9A1XcHl%5rpC?6if*C# zr6(isX}~uO8CYz);Q&MW_{>$LpKh)(Vc_FcY18$UjXn+KBv;`{Q`T5GYl zVkQ-yM%%5>c~X^=5Kz*PDj&G(t1DS} z`ka-|T^eg@0L!wT=)r_3xb(>W9 zsREQYKE>CQp3(KP0S3(Tjsj2pz#2NTG)G?38o6FK!Fi710|Nt&HHcTV>9j+U*IHue zuI;$YHrf-3O>UqE*GA2-N;#+iKT7#-x%Z-E~U zgTt*LUI4Z}H(F3mh0X?MS2~(x+*?;C?Z40KS+ z%bzTln)TtLDe)A4bJ+F%YNQ;3oMm)=c9mo^DYEq>*P`Y@K z-i+T@`N|Y}4570BSce!;&`RMR^se3dxUqnDZa%R3ez#x~04KBQD=R8uW9nIyEo}eS z>Y)+4Dn>}|W9xux-Swgtv$~|M9F@<)CC3MdnRkG$#dH6!H&k184^vZ~B$U!AH101dyUQysJwJy(vkDJW9q#?Z4?2u^Av<1IO!p; zg`B9{_(sz(hA716k2?JeN4et zh1Tf#Gswx2&Wd0>cW>j-((~$C|A~niv1sEOYo~6IxIbH*_)-H?^AHgh9{Iv?;` zY;!8=78=j4{GG#JUkER-Sx zuuacr!fAON4WB^Um5tGIR_oR{HdOWGlZ{?!R7}`4dMQH(XCMH0j4pPwYl)auD%9R< zuqnM;iG7|{?7p5z4X z){*x+S0Xnj!oPt!83+&xLmpHzi~91rXnKRG;?78MU5C3)-kNIA47Wj)f{cf!)I~lrC;Yzi{QWvR?Vu!A1C?&$jnz&NsMK2WE z8U`+49r#xrdM;W_(J@`dvmG@WYQq)zq|X@Ifj-wvOcI@OYoCRe23N!y*`O5wFb7Ub zqMK6fU9j9@OJAYo=wo*4H!VmiIH9iT+s-GGQfKJ|>w~seExIz=3c=_*;sC+wNGyUB z3HB1CSz>Av8sX}slR~nsgi}b53w_-^LFh|h&!khy>hNR8@<&`7^s6ej+1`f(Q$7oD zmxo;fw$3si$bSX;2qW<}wTh80-9>av{&uluMo_GDHJmBgnPe&udmX!fwx)v`3xTFb^y)+1^|7;YGlTq$Tde0M`1F<=z z9(LjofFD}TAs^>kS&3Vypd7nEd!&e7CLGwy4o-1@_CI0ESA7`x`T3U~3oCJ?sWV3e zP~6=Vw&wTIfL2_#pw!OkH~oHTtxG=)v=z_N?M|pzcrz%%);>L4NJBCH+RPXj`k5B+X2As3G$jmIHwXwbwVa5p# zNI|G#3+aQxzdaTPG;?7{Q;8jVe(gRul&@ohG(j!H%Iu)yNnl3cB*n{@P>R~lE_D9w z@tJQlpXU^?vBJSUu!W;?Gm(eiy=LBi#jP<10v7Ma7nWK!XzeVAxbJdW829Q@6AuTD z)M)qxEM0X=kL^FcrzBj(Z0G?+)N~KKDP= zGl*Qd)A#O`xbu7*NHIJ(&pT4VwtN_q#i{%~uKW~oUY=wG83{lyf4XRSmCiWPeQTbT zL93|t>+b#9sA1n;?0T@J*Pq*dAh1U5Bofo*>>_)ti5@6)gs?Zsd$HdYbU&c@*?s~j z2d*83Kqvh{Crzm4XSfJW;DP{FAg$+8 zHADf0o`W>~)}*b);xTtBB?~AOdR3WeY(HxE>uLq>_1?;CdfgBL&Id@<88VR*R0oG~ z0CBj`Ld&L-J!yb{4G>TruRV9syO&aih6dU&me!Zi*`9V7?J~+YWlP-{N6|zbL!OW_ zm2uo)0$ew(Qk}o}J)q-Lfa?Mge5nCVg$=(y017(J6^l0XYfw%GFU_!=W!LE3_(30c z#(d&Hz(Qne0m$3*WWM%I;|ic9E;yy${5)`^;ba5w+~W(RGG&r1t&l6gB`;n;AM&dW zPM+;M))G_jltSK8kKEHiXR%%FV<;`fs{T(r>AT&3p%1z;l~coC$rgGPQB zi24i?urZkOhSsoLIfW7dx-F;E>E!1i*YL)zs3>f7d|V=d@R4m8-T!U42G&sFx*JGV zBy$R;oTs0zT$KU&aKklInUCVzww`HA2qLxvKb6 zVYtxoQ`xP{0L#~qAn9x^J3GJk8ikY%u z%)JdjtJ~HMCP&YPs#RPIA0c4oL)>)!Yp zMb);nAkd2GWj!NG%Yn;bFgksvlVD>D@}TAecR@ST(bxNNcIn*mB>>Z0nWa}8-UZm6 z;_gO3_{*j$T*2*#ZsiwH2wzF4us<2se>ZIvi2 z^w|=$7W(~6geuV8G3_yh+ZME759^+OEl|W?1m#i>2Go;qVI(wqFep3QICfFVqOar0 zhmz7mJJu%#J_TRU*(S<$Fo4p+9*`OSX7uS*R|-N2K}f`Qs-6SlVknf1yB=Rbh?t!6 z0cA(iQ!Kc??Gwa2p>JiZ5fS(o6dBqkdJLRSrveZBafcb~&D3n4(nCuRe4y`=P!;=4NU^K{I`xo)l*`izj_f-P z8A9%!>yA}nnv=7nY{SCSRtY4Mw=+(h7!$35Z=cATn^kf5EPqh-doH%b9k#&I6BB)N&9CcD;bg_C`xX13z5j z75t?`Y8RMBWZ5f+7u&3bmxNsap_um8dQMp0YyK(N$%QPGdKUWl&hB{79oHB-jq~Fz zo;u3pI9MWE>(f)-HJ1dRJnQ;dt0}!@UGdw!LBte%X1N@-)Np3*dLQ++Sr1WnrqIY^ zE)ucMvfZZRY8-=D`>mMTREf9Hb(-MKc*~PWm&hxTHx^8vbrRkr4F+8yCz7Is@S2!? zgxcu z2>r5|P&fZM-F2=w;>}?_N1wbxb2|&6+oMh4a=Moy{6uvP3*gJcK8Vc+8J9+#J~lR> zLX-RMhPGpNrQDJdbJlL_X)ADqgHJV^=I!nb%|;IFe{=MSghPHtBn&bCwkxgL;5K!g zQ$%64T!NG!xERcCbk5O(XF+?QVTP9_#6W|y(>65RKM-cEA5k@>z*^AljK+V;3Y-3- ztdv09-%&V(kj;A*#?#gm!AnCCgXEG6t7(J%Grr|4{4$yYYB}+OLwdoM^a%#CRTDJmYSoWE^ zg@4M#dLa1J!`%&ozWeSB7@+Gxw2P-)&!*AU%25OYjg>Z}b0l*S)8o>z@9Nn-fn|Qs ze5I5r)NIJxU+0P{ChWHDV*FYL)NBYVVV7F1n zVJ89z(+&j`yHJoZ@g91N9XyJ^2%mJplX6FjmXJWK7qJe|89Y?EqIYvFynAA#vPrgZuY8<~_oPc{gIT&FNfEuG^p%(Mg;&#*cB{M+Q^ zq;7n23_#WNdYk1HR5;Y6tAlS{Ic@=Itd5Ck@8N@MXcrv!l^@g)l2+^~!YOJod=n{f z#Azj>2qu2_*AAR8Yg zJ`6F@D0EyGM(>lonP?;OKL!@;Fymb!Si@6~u;?QA7HjaSptL=Dv(m%nQXHs89h0zC z2~{2+ks+@}je+_(FLI{WDE9k^fBJjG(-ctlR-~E7XML-bDsb;)JnA}*_15TD!iNW< zms&eFv-tL|6uCCbJrwq9?0A+e-hbe6N!`N5ltHyov)#I(x7ljC@`GopvkjNZ*)y%j zgrr?GlS7(D2MenZUvEm;@`$#YRGp?IEjODbT!gr!E?xGYjq|=7%lk(kBZ+hlWqu_wtor4ai>;&3RhR%#oOo1Akpz;tuXXC=zG4 z>F%ke5b2guLJdSFUPl<7jL#t`?@W@KeOEH`Zn4JFiO`NDqLE^kCo-~gu~4YLf)czn zK0oKybIe{zEHoHvqd+lM&F-#7&Q>M_85Km5I0aEKx7f+no^ewWs@v4ltSuUQ3sK`P ziL~A?gnv#{z8>{zKT0530KI@ zJjoPzPoBY4Tr#opMa#SIS^(8V525GltLb7kW39klJbXM}?62zXc{ze2o^6Bbp2|)R zD4b@>Vb&sehNkD6_=2HM7yMk$S~M>Go;clY+HYiVg^ z3{2v%1Mmz%c2vyj$@lt)-;n1H2~H&kF_DARmMcZ0(?q2Kdno@A!uQ6^=gNdOajUPb z)!{5$2)BXrU2%NcI_7LyyN*cfRw;LJvZP1Ck`zcIXYhTp*o=1u76Xw;-y?0wIr}hq z&oX1$!z`bKwwpltUsFsM`qLGZ?tOA~Rf)hvu7+OWf2nQGmRwnn&(v=((oLbheuTIc zM*7gLR=jdTPlv37g0)`jFY6=^XrS`hTs1+MEl2BwgH$(T>u6q1C_Cg_DAUd$8%s8? zz2~qMQuxXQKFux7*~$SiLdvZJvx?^ZEF5P zT7Z4NfEH_kJ~{t0A3=L^cHgA^le2h5S1tbw+6L~D!OglV@vVlz*Dtzl;t9$SN$-47 z53{zQ)+|XGh~S(2oUGK%)<|T&0AUcBU@FhI+Hz(BC8*qlY=JfL@HFk`j&`!2uO!+E z*-b2|vV7jEi7~U|5$jIPu_P|?u!k#)R+ix7qK~H%b)u^&gIN;X{+me0Dr7=>U;3Z^ zF=#W83Af^MwqnDXLER~J?TZ7dg-pS=>`3*Xu>CfRc)e?^G(55P|?VL znkQG^F{lO|2q*_(LMZ_25DbQZfbZ(5ZpWd4 z=~s7&30H`i>Cbr`*GdsKkspluO3i+??d^D^qE;@dyE;qzexO~^(Ytt21XpoU7SiZ@ zc{Y&T7?VLfVWL4hZDc6%t|rl)l_+^U_o8q|x4&bySk;clX1glW52GbY_iOTReFCsc zAw8S}!;p5BdPHXt=EQ8Ykld!pOKz>=>@9En&|TA8L7jl(DzMYjn$gcgudPR5a*V=O zb7%HLe811*Nv8cyckIY_-+puwOOH_y;N2;AEew8(sjU*B)qHt=uBC6Lh zJx!*N#MAcg3SgP-%w>XMllEy6x?cO|d()aJ&RpJ<@{;(M$Q+0|{=m=$T1{=VaJ93H|8yO&OMR&8yH z<*y&V?VbA3Sc%~WA#vC*&?ZBfr=0v14URPLN(0OiuOK$I3D>^cV`C3ia9m?7$77u! zwkF`=oZ?|F%wbAhvB6GfG7b(XP!0Fkyg&BqlE=%AU6IuK8nai-pM8u4{v-vNfp8WI zXe5RH4cXHeX)1Oow%~1OWo4y@j>$$u-QBlN{hRFDGOG^y)G#R~$|M%-{bp zx!lW2XIlB330i~?9uu?goH?qpIob<@8~?m@FB3_eOeGOa$|aE3+)K4mewT;1nDZD) zCZ@d}YZqh7bOOGG0#Zw`MlHH*7YUSeu- z&CrTdeB}P`klcZyvyl#u(ybVPf0l-rsQ2bh54H73PTCi9x<8b1b|QK|2WhR*O3U1J zOnYO@I52amj4q$8QBPfJO=a!yRQ66k0uxoyek{fB?=cJf!0I#pC5uLB?jEU&97oW~ zzeK`E9)Dp_jW2vJ6ZTjHEZ~*}y{@T+A*PvMllTJRx-avcgFyB7qn5JI;It2^c}5)Q zw8*R{d5?2l?~FM|hYm|akmswIRHD19w9Bg>A<*ZNakjvBih0Z4?(6ee?@I&9UIq+v z229Uu{m^Z-QKKE|kpUBoiWn4xG*-8uH)pTsNt#E&76#Qzn$ZFJg9B?(>WFZ27l3zW3J1tLBJC zHo!zKeiFw=-lDA69&h6D)+rukWCM<{QVep_ZCl3QULa@ZmKs@LO6Z|#KB=^93V*9z zBjq@7SS`!1fZIx|IGuUV>TLf-Zp3PE9O|AHXku&9&X-i2jkQLH;iyaandKlcfBhHH zp3XZpET3+dp{l&vcO!o&t~RwhFV_ITi`Cq^&Js|oTkVDTTxl=PMQure;wdaGU$xVQ zwx7-$yuqd|og3ohS^C8ewN^M0?X)!bOl>KmziSLR0k%b2UqhbaRUiFVcC{ zovJT?M?)d{%8M7b667IO-m{0P7rgG2h}o65NX_9bp*bL#>;V;mnH!xiUcVllH-+Dx z81*^r8MZOEFT!fN3$Jwv{Z)~8LD#N3Rhs`SYH)6rR4Q!QkP)_YWoYdTzFXGQ=_U_4 z|K`B}-=*NVDq`tfB~bBv;vFX2Y3fv0qP-PfcrLomWuh?|)6)jZLa?@F354rs7^)k+ z9+Gpksl>|NJ3gn0Mg9}`cZv9NV9A**&~~4) zXTkKSPjzv`=h%cPDfoG=Nvo(TM-8!p>? zDJlJIQ1N{-Ia@X`u!`G=M?qZRUT%(Wv)U^K+&y1kp1H;HcR%Ev^d5<++8e4({YMuy zdH~@QZMN3XSK(?fe2NA*d&D$m*_EMt&A=cEvpyOc@A`fd-;NZE#pGSD1JR<^bcex- z?Qq9F28;>r%0j-**;)L)W!Yv1JBR~MRH%rWu?our5kZ+cA=J%=urGkyyjlmzHBLt8 z6C;n&(Ir%AVH5(#npfeG$^h@r4Xqe0?q{YUE}x29syF-%xx`M!T9u}6>3|~rvyZzE zMA&JYYtP2=E#{FOFb;-xP29d74rRVzPwqUP| zQGnsdOQnYfVEbvG-`<=cVUwStwA?YBbmezzyPGd5rbCtF=)NJ-g|2i3Js#QGugvzk zP>wk$B=we@V07qYDH40I%Z|4(F^Bnm^?=uKU$>`Z^d8A#zTiJ88-r=__7Cy!7NOIw zr4r}ftz1;0c$Oj}kxzPc5EL^AM`W;Oq`rXrV(%1p^Y7r77pwER6U;PDK~IV&m-*<) zHQ&w1ly&d%luRp~+nP(x(ORC_3ESeZfP6_7X`X5y$7c`L54XkVOl2UNZk;%)iNGbr zxYbAs9wLr<=A8DGEagjWXzgiy9El{}0Q7`T<7PmV?1*rq&dDQ1Z$)?VYPP z85$l-a;Ev#FyP_ne%D^C{<8yI0~(Q^#C-WD-iXW;|3`K68@0cRMJ6wJm1Trw-}RVb z7=F+7U5vXfKRZ$=>~&=6a?NXR8+m!*?eWwc=ke?K=6}jy)>BF&w=A+xN>!23#1Y>eT*o9m@nss~pVbHc31A#4co5MJqoDZOn|S z8uqE|_wB4Rs65Cs*1>;t#GS9JaaRj_Vr>E_LX6vqeG3M~gv4kFH~&E6xgXM-T0M#rm`pj_mk)>W}{zm7gvH z5ANfX_j<9HOU7qoV`=O%zz(GGYD9b)2*U>R*gJfwP=6W~{$_&zojb-^5oy|g!B_30 z#Qz!U|NEsQS{9T}W+LMH!Ytd{dtdi|{`BePrP<#NPEqu|AFs-=EW^(bl&P6dBIcIf z4#pC#)=Vp1r&B!!Hc>)`LS5eql!C*&@vaAeAa_F})OYiiJvPJ8QQ_InYe=-j?FoOP z2j2j=!Qs#RJ|1;p=>BC-QNFjviuIw9DF-5WsOJa#kbw$ zgp@1fgfeXzF4j@TH7+?7p4ODh?$Y_sQZ0_>TzxIUyx0*n8!G(A6v2V?qZaf)Jz#geIbNf;8zw#E5`&B0Y!*NEa!g_g=R`#?Yz8+<;Y*kA3KZh~6IDaAV&VawwL z3k~wvH*Mco#?96|D--d=2^y5b4_S}bs?e4O7$ZvE43=88izQhT1dI=jrJ(0C%i#LB zf_B2JXYFy=p!Pjy5B~fh9erGtd+qqKNbQgg9gR`Mpe78S9&tOry7QB-ot%CD*_u;d=XC4YD&>8~tJ^;L z6^vJl*EZx4enaIgC3iz%sF89_CgJ%+?H=)i$U(Js$LVE`=8!%jMOz1c>MLzLL|gyy z^|mg%RKd#*8KLqSGlxkJX#*-d- ziYqn{cJ$CcnD;LOu9rWjMh4H zZO)5a`C{otUX~SQs!y^U&b!PA92hE6zuK2CY(K?Z@_Ee+mHO#s?+4YBhYy8c{He>u z_!xXlaVOx~+fui*0*hbg{`xlT!JI=WH~wrM}l@a)^p7-VQVEnkYoQ850RW)Lzkv z&;hT2br;B<^s5fgnNy8d|A*`Rn^hh>IC%N;<;XKVr6qd%;6Cu6_fMZ;h6+o{MXX1} zbj=WgC93#7?Xs8f%bAH1&aHm;{`Ys$yU4rl@N&)ceandkYZHy<{bJ+5Mq{jO=>2<7 z>@dRxp7%#-jU_xE8TMQJs6^^JDX>&qi0j@)Xo>q7O!L0 z@ezM}$LFt~iyJbPBC=lv16#}V>*yNg`3GI#l@Fs)lgppa@EBCto#>2}NR9?UWr6Kc zQl9b|J_)+0mMcqhiwqA>ot~E2?;YNDC(iR5U1HkywTikT@=rbRH!op&`ZlzPeRE+r zUOxCzVMIh!)Z^lMQuMA$q;x2>$O!u=;>@YPeZgNr=FcbD9b~lg@jS=9n{ou0br-FA z!VXoHG|1;2klB@RelT%P?}WbpK1S_5C-!FX_GG_muc58ty?;^3|5xiDF#Kz%7Utiy zuamGvb?O*B+JB<&(+K+O`sA)$PZwa_PzlosF#3mY{rf!H;`zTfuWTo8Un%x&X%sx0bz0soEj`%b;% z2W$$8HJXlYuZ$h=^iez*ePX{}_$W_5z%ZrPtku0;qp~P5Kt|d3)V}XwKj_Nn`!c(dF;n;rt`uAb{Pp0;sXJnUhixf;t zX8QFv#Q5jtjUQ z5Bp6Ah_?6k=0dNUT(OKsS(wK@!_m9^95A9RDwV^p?u#Giyc>NP`?2-z^D-1;Y$@#3 ze25S1yyw36{Z|)M0|epPLmx!7-s%5h+_`v9qr>{MprZYyFy2>9t!mn3@^H(6&j)l0 z4PqJAj76RP)Aaj4^zRm@8~5u8?k71`D4?dQDvhmSegX ze!JxN_n!U-W4^suW%~Wfl+6By$KM2udKDOI_zFlk+rGBoI!s!Td7zcOn_vZ58mUOl zQe*4ip)gu>CAix6bF0NED}=JAUVCiE$bahS_5a;y`}QyW0!1xv!21f%BeNDRV)vyh z-~GRW%I2DB+ap%RX;*!UQ>R*jS{lnrOXq!&Ch6)jw1@s{Tkm{>@R3is(NoX%gRK9q zg;4K@z8?hpMBTq%-pBfYE2}%fF0(uO`$UM2_iGlJMQe%gfGTObl^-nU=fl(Or}q!o z{+}N4FOc7-`}2ca@^Pl^%$4oOU4QxEpZ}C(5Vjc;AYn8!l{K&KYDdc<0qV>~icn%= z8$`-(>=SqGI~?g3cnh=qB!>dBOI-1b7tH&O|F1?V4w->YgHcF4m(6&cZ)-^MyjVnW z1E;LMzP{VYCSY5^OcjY%xhwnk`9FX1U;q0NaWGFxhUXIk`!Mvc|Nn=X1$@d!8E;^z zvu5p^LW>~~s^{I2Ap9~4r>+)%KP!|&J-r5Q*}FcI|Ehg}%VMT|&`lPut><%e(?Mhh z=u}x;O_J>8%Y-g=@V;~HzqsH^;b9TO;@r2`X29P)qDsi%#BiNT;D?-UUhxsTu7&zJnO9scpZ@6G@o z{9Bb-?!KMze{{jeqX!@NU19!yaQ}hmaUn+|9n4gXIL#r0kend$X=d0p%z0n_uW)9+ zSwH!EJO~69tA#8X$M>6GSDtwT$0+youpK*=z_72-^ljaHXCe^!ovm*8KuC zxz>8rxo>zPIO`_nX-&%yG=rs-CkfISbNUS05;${^=O#;n z+)R6veZ`peV?hx$*kxRU8H*ITFJ9?RmqfN`g|(+cpG)qC&n|5YtW??ygD=l3OpMZx z!gI~Z`~&4mhtMtEv6UYX+pf3xj7k$uaY;Ya$=6OBm#XQ*bBu_!Ix~1I;M6TPM>Zi5 zPCsy7^}fKV>#U+Q|J;6ykzj1On93JNN`_UCmXtj(d|aZOuywc+O52+ zIK`g~Tgsk;B2+-LMX0gGs;U5j*m@by_59(2?7mE8!gOo3rD48aYJ!uyq4*p92c zaf1U>J$Z6&pw8ktu+_vf^{4Z#5t+k5-deZR$k_P%wwb+Vx8{j8iM6CBi6bKOkobIEm?2~*_@@VPM>Ul0weOn`Ja@}E0J!eUgnZ9Wl-ChG$)MK)=rB*LGay3zcpHi z1i!t@J&!20mOie2Kiv8{1N;URd@=%GfF{iF3kxUOrZU}X;)ypStVJ}o zGwWg#{N*!4UvxW`dggE?)v5Lqf8-2?FBavFENj6{OuM;S>F)k~`EOiAs0Rh^MqMJG z;}2w`xRbERSL9_WCt}ZnoN+NECg8l9fRw-bjEKk84+b3V8y?{p;biAE@l(m%=exeA z7*yo--((?WyTL6_$R*J(&JiZJY7wia=|SBq z3QUCI5(Op?$;Bdd88YkAc$ug=cf*kLq^l<}IHEnkRP+L4Lo#{E*=!KruTyR|$DjAK zLQq7D+;VhdA!=baa_83f1`DaSuH-o%5y0KwF(}e9(7b$c z$m%znA$Oj{vAdW~k-RJIgl|3`6EE)a8Pz4+r`7oK=-gH3ixWxP^>mvzHy-=N_g&1C zFTHMJ57DP>klTf>sv9ac3^J&+ghnB`ZWOE7^}kMCtT{ zV{megBm>eaac91xC(@HXOjQ+ zQHyUb#?&*ZH=|(=O<4irA$&MGDcg+DkfWtrZ*ZYzZJT#91Jtk$nGl5sa+~fnj3@88 z_ylLw*&3YkaU*}65SdwcxU-AB3ipheQ2XgT-32alZ0}rT3=T}?BCjpFlHDcs6N8ZE zrJdZ$$&16PN%5Oz)d784rzdkuh57aphF`$9-mMBGnwMHlBaE6Rg=3?6$C=lOYdgEo zU%os++kM{6X`J(>laQr6saBnnnabgdk% zlcHS$#8yDYl&epk9NSiP`^8+ns{gF1wR59csQ9#u6NW?7q?!4{`UG(J*?g%=SCG4y z6K-2=V_pk%rjq^68pSlRcluU;d933+m-7UHkm;XEc*ie#4Vfch_w(7^ z+__!avH6m0Xet2t^V+3*4W9ahgWU(?q@2&-5Tha5m2WyT#054dH#@oatcGoa`JDH> z50%X9PTN*$!Ul76E`hcBwUNDY{>*dw(JddL+b88jJ!g&Fh&Xj8&8@fJI7Dx?dHEDy zRs>d2_L;78iC$X!#@+NHa!Zs=)H=&~K*iH>4wS}LR4aL(uh`p_G5R#J&hAgqYob0xJn@#W(f)*N z^HPZ}>Jfbv!~(iVEreo1It5w|`Jdv*BFk*Q%j%BHM|!M2+bJ0;-ifVoc)s;;oe_j8 zSsWxK3NaoB=IT_pSRmCEeFvrm=ncH4=}5P=1Mg3uVan1 zDsb6^y2d1#U^+2Y^!>_aTc2!hh8PmA+Z=Ll9{x~-TDG(j@N+z@+C8b|$pn3>9Z7g% z(#102F?TL5mD6Je0@c#xf={`7hUL3I(KT}8gyY9#Z=WTJ<}75mCSr*2Gw$Rz^CmN{ z)v1N@ozD!=Ah&g_uEqBXq(<$1z9pFxuO%6Zc2-5%W(V!3l}zzz&)T2XO}G-Ob*Gp8 zi3&qo>dR<9d`&rkrN#fk(p-K_8$ry3fP}cNmRfJwPhjrw<(_0*5PADzK`Kh#1{t-; zs`CUEl?-#8irs7NV%bXY>E_r9OSYd3E05wc9I?Ky#R)2aIc01=8P=T$?&Wl_P2hSo zD^f3awbC}WE^|JWbLR}pkq?D> zEnFWdb52gW;ptwN(i&lnF(H{kT<_tyAK|5S1?BqdBq**}?)TN9&%4b^mtv=>ldnqE zgGU^_+qyX3jYKyYDU=|aKC{ZFhMtY2qh*Bkc+xTYpv7OM%SM1M!O|JsjC1aCyoRod@Q-Y-kEmK;=Zb<^o~=EO-Hf(X5I!mzW6#q z=`pK?Vc8p>qMiv)DxVTEKJfUhEZN9jOUpzl@-Lsz^G33?Q5nub5Oh!n`h>Y=I!LH5 zW`Z)ek!B)QL%6Yq{O+H7tl8C|{}xk@Q|>3Q#|)vOq;;o@tH;nwHur<&@j&t!&@S1S z20LSOeD&9C2(g1z^tX1F5tmxT>>8D0+MtpWMS#gzbl3uuFdt+soY~|b*7NI*Oh2+o zp`Sb1OD;QkC_0dZT9_(=j?KCvus9QOV#grt&d&^-JBc8V%kZv$gh?nQh4sa7tu)1n zSSTLTo^~omZQkS4E7x8z+;g3Po~21%+?^Soz_;#Hbxcr@@i`AE4g|d~5uEM>7)Mt> z2(_`J=Yfi5i#KIBX5vcoG^l!|p9J#Rj*>Yy>>Gr{AC;uAUt>rd-H5w%qrDO@9Y05$ z5S8v(*xDc!T0Gb@(QYu(Hz;7u_E_o+b80H|_?G90);h;0I5TNV-dWEN-`@E`k6-$k zbQg#>`SX*RsZUWcB$E4HI(4O*Z^kCz;`|#ff&%52a18sQ#J-(q%U4$xakn?m;$l{^ z=Z{trm8}qbF5@O&T>HTfOk5RPgeylqo+N4HU2ofF$hWBE&(<0if<(M%-K>@k&(`*7 z_Yi7$2Zs3OIyyG|f*Hcw)A0>r%J3U)#qpjw(4;H?aPzJQWN*+Bcf0Q4y1z7Ciqbx@ zs&H!DliXC*5~Vxr3wB<96v8@~eN!d6FH8oa#k{%_+~PWy$c)e9<<|+RKjx(-7@hO+ zWK2TSF?%LxOq#a8pcIr{$cNmL23w@Xb>#$Q^20b)V|F5>QK+Rbxeb5jEy=0)GiDa0+j>3m zD~P;hE@Au4tDlV+dEdUhT_wFa?|H(pE98cQSpdM0l`e4)o&ym37FRCw;Wa6V2BaPK z=A33!`vr@^IQT|1PrBiN)IxYVcTXn4Ow)8;bwLR+Xsfz1L#dchimDz3hg#4CHMZ3% znNZR3x22A7aMJnku)8cZrfZ^8ga_3gY@tt^%3s+~`CKs|B#mU23?mE|7P2XLLOlz@ z!ZeaSDSXDotQ$;*EJK3r5RVBZR${HZln>m^|9&$_ebw=j$3z(Ps6?Thp(Qp=DMt@y zk}k++28k7xx)1KW&Opu(!`Za+poMaM>^-u(f~+D5+MmoT(FbMPc|iS6xJLjHCeR^0 z5`c6SynlUxJiwW=#+)5ZW?){gjQvi=FDs-0tlC3)VyXHq9zb&tP1}~O)aYMQrRhZh z@rJ2}1mfSpd}Z7oy&_37ov)~VDu8;z%OOMV9L6TpoJnu(ue^@pMo3HMbY-wRu!lDT`pq(8#I)qmO&RW#)sp}$k?7w}=<9KIiQztKD*c>vs z>fQ+TkP4LE+2AGESuT7{=3^*J^)x=Y_eQngo(#483L5tslOP@8sh76ng5`cRDUD>4 z1GzdoY?P`WcjRb^QxF|3gNELsHs?sP%#+5hey|o_grC3TZ+icvJICXbnaMmVm2*TO z%=~o#NNQcFKfI;C5WLZT)k(*nJ8 zwt!r{R7so*Evn|8Oj2t|4{mKP-l^RFTvngSrq1$pu+C;x^iH_lNcYcIRAW|*A!;uR}rK<3HapFb%YTd5T+9Zg$>U+cH!DQ&D%|J;1 zYF)l=ei|yYsR^LVP8FQuHnMNBvSgz)tgscQykso$#$U3E8q>d1m^HH)9xV z8?InNC~LmUCImld8YEQBqhQMHqVw3->s*+vm{w6<*k0T#&YksfW|^*mh&{K35TLI( zC*^4_2@**N;A}Ukjy+1r*pCiP$*&lj{(~v|iiVz%E3X4Z*__BSO@l^XE zA&M6fQH(Ula@FF@iI07N>ZJwRA`F?3jS*Zab7cc|1*$zTTuqEf*1DmrF8kge8v$DF zY!^SJY=(IK6`ktMlAJHTg$eO6xe(peDLqiUZsB&aoJ}oBP%YVZUB#!BF0aKos^D(R@OAjb z?M*yT43PAq6Y{gkrVCm3I-eBmie*s%B#6#@0HptvAZ`za7i38$J%aNc zW|TwcHYA}|+;gU0yZuZh?pJmW+_4cTd>z~8R!wB#FWJ5Ec`~O;8P_%rt$0~)b30&o zK_3S`GW*KdPFt0NxGT!vohUquZrUUaq!EuLbovmkTVcsf8;W1|VuvDj@+Q7Z_bt^+ zqDT_CQ*X4;ljYwLOyuN_AyvKN169T=FRS^se%KUg9MO47fw3*~H+)6`p2eR6EV+fc zaWePSePk!YpWof{tq68Fo2{0dsWqbH+4DJlJHje|Cwwq8&t7JE)^~B2GrJ9dZ_pfr zq^-NT+w1Z@X`VlzHqU~iWBKZ|iP4P5RUUGtSg}p$5k!;@XhEJdr;($jgtcF2U%TOz zD_L1OocTiXb@!^i6fW+l&Qn0TC>^O0FJ1>E34R{{h~skxa~ECTIP(95p(O0pk*C)08eZd8U*nu|TS(hEd8WdZ2P0ma5|!1aaEaZ=_8hGqxQ zH6A|%4vpdass14z%mQk2ig#8{MAnpXVc^OtvhOqd`pS1|bDLP+2ee7zjOfJrRCZgr zQJaLGd0rTf=r2rhY3y!VtrtWf%#z*0l4P!3a+;e3$5@OfDs{#*{cA6Pb%0Flt^phG zi-Kxh9xP(hrt-Xh08H>KO65B)?ItGiBC_wZ0Gk1DTHDCObhO$KtR!ID&OQb#I$DaC zzN@hd9FLl2my8KXMb=4($1R_0G*Kv-?d>Ej`lsWiH3&CIh#yIePL9i`2flP*n5;Nj z430LvzC;2C4u<<{!SJ&l<4*CFb4R9uS>SejwW4GzI=t^X^!wuj$5kozHAz-T$WrbH z9ayW^s#o9In*N@n{pbxz(24VwQxY;phfj>!E0wsdzOBs*I<#K)0* zcS*+XLAMX@L>st&t8G^INxz!Z%*+{^@9#ms^dv}971k;o<(6=g$}Pz$|2g&kQm*5( zj7mT~PX&K8k8WNHieatTYy5)M=X?AQ0~J)&>LWFFueAz+>SR6c$$@3s*^^^J*b{MA zW*@U`MCczIN&eLDf{i@|a#xCJo_x=5kl=Z*z_WI!x{nX4F%=ZLK9dKmobG2^@lds` zquCo>e`V-slW^1WQHQjn>z$8eUQ&_M-MhOjvhH=-!3vokaYbnDA2$u;GXrPvc!ibp z>|IZ;n>DiS=o`}a*ASn=bcRC1U>>T|kRfJfi6sf~;7YhnMgZA!C=@N8knJeBTz7XE z+@0dj<+=)STW&jMG5;|?M>TeAG#a^MJyI8y*wt0=}t=EYc zf7!)IxpEO#4>|XwGvhd{cJvCiwr;dKoQ$-PCE*t3>Lb;6Luei*q!OEjGf!E@Cp>nr zb{xVkJr5Q#dYByLj(5v!s@G6ShB>A*a424=LeZ(=#%S5=i6LKlXIdZ9+Aal8rOO;lXnH!dk(i2*fVVd^WrQue? z!9nO@on_SA{V8{~>|Y+LxA`Cbc3s0>?GX`+oFFJ+L((+EyHjCl7Hu78?e98p z@iYzT!HhD_hbeL>5*`h;sL=Z;Ym+UT=#|uMJBlJ6^A-zrG9gK%Y{v`G9eKgJy7U} zmHhR!!1BN7Xs@HiZ}E2f(^d@g8&m|Tv`?y5zrCL zc1c#0f78~xFeNs2C;0=Pz6De!Khb%RH);;9XaKL+~z#;t6#f86LkZ z@|xxhH^yFT4v@!O#}P);Yo$hQx~FN{27uNf3M~ETD8M*5TaPWenq^ywnY8QBYAQC} z4R8bQKZZglppnja=fyEt;`#4(fXZRAzKs6TaS2tstLzCXFpiI|e!bYuHWT=<@$EYS zCmw%F^=v2Eih{FV=GWyij50UT{2n=%HfD`^N!C1@$kHxiSnX$}7DFHAFWsbV5}`c) zxXW=%%!w!K7tb{UqDFE0i%}soa{cN|3z+#tgqURK$`ZDw?z0rj{Os7b4UhN41#R7n zX7?&<6zO9~6Li81pv)uzHoyAN=kQ;X?>;+?fNI2(ySwj=C4uOINbd!DIWFr)&@w^A zx?R+^tsw?i`gobeqbju$TwyhTxb4u6Lt4b`D1|Wg!HB8~L%j6vq7|)i7rjR{c=rn3 zg>#GHT8$N>aJvCw%DhZBst9HG%vxIw@r)IUKoS~q%}X~p+SbNiyH@uwcW;V=-Xs<@ z1eUoixoxj6gm0TxscSd!09@s!bU2d=Y_C^Dy^QN}129i#R-&(uZey51N{{?MzC6SZ}K>mDEUtX-| z88@TGnV4Bvb*Rv(+n-%Z>ezZVKcPydZ}m>ybAXTcyA6NRSeMIs&lj8dYU`qyrj%tj8S2~hBAm8TXGL@q`9t&?~ z$8M*3*+j;6$2ay>kNC4LQ^jl{)F)VUyY#T-PwlYJkUb#pu-W;s%>7NKr4Fwlx35hM zn~mxlgoS1Jyob^kb8JK5rL(u}UE;Xr@`qp<&wq5@w6GqNV@0P5ra-q9%Y6$TSNiWTf3kcg1~qJAHqIc z&b;Zsi6JTv_!fq~P&b!-O@x_etAfi$1z(fS!q0z5^K+n7NlOt;V^8?}shTDdA5%6UOc z+J6>VTE#}CG2eTR&?DFOp4)I49pXke`fz>(e;f!Xz=sP2m?h2%FKVOg!FzKPapRbX znQGjM;!etT5kX9xsx;;$2vs>^&-4|q2XkZk+UX|RZT)TU8diiy>lmaYJ$sUNP&%x3 zBh7LC`Q|-2syME6CVvCI$1sEOTW^5sVQv?*nM`+qH>y7BWOLJ^oJ0p) z5l_j*_JP$OiLX$W27j>OTN1@nRi(udp2?f!KL>!$5bRMV0Lenkwc;!Sd{z*2!Mh*# z7hS)J{ZSNhMfqSBT9+!q?rx&qOm#S79WyUER&K&EJ9oL>C^@opjGxWrsOwyN)FaOWp(A6GqXtbGz#I9~(o-L~^CW;Upka5jUHvhPbS;HHkwr!spGc-xd+^OHSoo9A#9=Mi$5FQ9xGTJuAqy6`gm? z!=H&uZI3)(CafiL^yQN3w4qmgyQx<9(M`*RUnQem#@G;cWjD&pMj%7DF<%_-Wp$;O zrJDl_dcg-&CD5hW!H>8XxcRBWI;mc3sFj`tTdzlB23|nEPpe!4Vk)c8|``T^>zmqJhnX% z9P4P7zMh#c&$OVa1Z(#SVH*llL$aCI6?%!jOdB7szDZynP%HP^Au4Udi9>ouoH<(g zN8!3Gk`#=t^EefR`|T%+)6098)*J*jNjAZ4_;lFIFg&{fNF7d6M;};}D~jK0yVt&J zCZ5%{J&A`VcYXIL)`XUhK-o}NJY@~MkZ7$3QEhNaSot1GQxgeA><7h5r#X&Fe8s!_Iku|0LehV)*gs+sq8_lXEZ zMwm25R+!34uD?vxBJ=zNCMlsOEGVK1d+zS!*|2PhB{>)uFV%?Z@q&wwdNEeo_S;!c zp%fsRcY>gj&a&eha((+LpODtlsJVR8$D*4XR`C-TQ^B9`HH_^8NnNn$qql4Pa}F@L zgNdx<(!y%OZMSECZii0+OXT0Asy#sK^dNH;stZ=mjK7Ez$oYT)&ZaK-<8x z$}FQsp@p2dOKm;2fvn|BI}#L4a5po}&34P>jvcZ+o46N0h9Q>nFU?#Jp4L?O1dfmj z(L{eT<5G79%PYkqt*;DwI4r9uNrEsH-9n4gChcGPO9+oXJCyO)i;1}^Uv@HldM-0$ z1&_)NrHySa;f%@YB&c5dZLiSlXyQJ8%&?IG-%za83#e| zF6x2ATj;Ce{6K;aguaK>72}}RM^bJN<~BE4PlT1WV+4&wHS)EpHzQp%k7lYWS8ZgT z3}W-A+S}YDA`zF8CnL&ZNj^OJ30*k@xj<06$V?L}RvrdN;h*L@9sO*GHQMUg;*i-~|osNgsx~#~xNF0*xYH+mcRxC*2u` z%=rSio;5d3a`J_Zsf;I{Y|*V-qC{+7UkJ+f2l9~WUZwV+P=rnQ(1!13^#d!`M8C|} ziuxt!@Y0*G&fKC!m=rx-DXMs%Gtv|cApDoCXbAN&RWh-a=+5~|Sp7Y)5~cV2?X#UP zt`Fv3{81^Y0{W!>KA}eQrV8O1;bq;*3EtBt2JBW=*Rp-m_Cp*UDYr0&~= zB>l3v{#q^sCv~Ye9Xl#1+C`j~b6&8^H*aB>$$c7Psh#%7p3qA>NiU=-G_DMn4`x-T zmy4j25x$&tDh?ZMbRle*^aBm@_erat|NojYd2$!MMyKJJ5ply9TO>^R>?4eEZ2AZ=5 zyJ&?S7`k5CIY;&oDHzI1N??}x0>DMM>ag*XERqv~G*b!A@tP>RX5WuXLU8`u3w(+& zOcMYlby1%Xw`FU9y1CY@(fWvd&m_pSL&KFhW|A22{>A=#^d+EI6uobSuxSDdwSm>l z6W6QvycK}Ju1*oKe@bfzYwxE_%zSooR&Qv6U$S^1JIX%&8K*pR9}l)vElk3sXi{QO zMQ!0x)>_0&?UigyiB@PP2?liKG=6F1OGd?lXkUEZcqcgtVly67Ixzed#kN^*6Qe%+ z4cgQ3Sd|1;;nX}9wHAtx6F_=q&-2YRk93b>d;aUatnLzI^8(OCN0&61>s&VHsdz8 zcVFwVCPoMcM*UE#+5nuny~~rV3xiTc^b*yTK?RAeIQ(m!qRfSf?An?MV*~j^OYZ;n z72_BoW2ARujZqbndIN&KeTP`e^n(R7dA1wlutYpbtwNSAITe7<6pR(9fKEY@=&(J4 zdr#>XRU&mx z3H|Od>^arIAT+N`SK*??$!Q@El5h(ba@l^bpVIm6edySrfATH71waLd??Lho zs$oo@tZG3@hwup#K3rc17^}uO_anoAqsf4=L(By*TmPyaauPR;ez_T?1K=P2s%fa(;QRNRI z9=a81a~5SA{ts`~$<=DjCm^I?!ULWlKZLQ$ix~1i?buF(8>*~3gC~mDZ-l3~Id-`z zp^FjFUsSu%#CExl{dK=^*q$9)kif8p>Tm#yf=s2kl5I>fW2EpcLc9$|lFQu~i*fr& zd0!FQXd#4uC#dQV4#Z&x`Yced=>3{7@tqPX6$+3>s?#4ODRvw4XXq=LO86NiSz3Zv z(wp4F=8x6^mBn#ZuGB${^jOsGaNKW~pobf1-E#O|ZfF{X5!qMIEPaN|X7kn-8#uV_ z%eipas>y_XJO#l~GyNrX=r*t*6=pep*C5-vK2hV@w(OE zpxn?-#mXI-uH%n=5WiP=hb89@2x7?Ushe zc?Cp__LzOO*X~T^rX3Kb=OdZp=hhu5l9L@>s8?5KRa40(u0C$%=Fwf0+mdhQ0}ML3l;L&$SZ@44GHq6T(Wd;es!c zlL3Ro+Ei?mc1Keblc9}>ZOSmbDQ8EJrk4jT2)CMaetV1u|pO_qcfAPt$36JyX{{YXl<^5v2rpn%uBDTM?Md`6bGTrQ7R z=R|rIEINvJjL^ZLOJ~90D4;l485q-#nlu2^1{C)0f+$sAHM1S5A*qb7&+k*k2 zI8}~{j*C8Te#I)AZe}{JHU-6j0^{0SIz`$VUcbzz zA}vae(zg7{ohru#V_0VfHYo@$uW#$#{>eiCcBe}Z=Iey#cyG4wE*8DHLSa}DzxtY8 ziYIIA$3PjVK6fGW=AgoImnK(yzGh}AD^y|nmTG3VpJ%qrmsYM)#u}og`no2n#C9*i zw%^?qkjG`Iw+s^A_Wt39+DVc|q|D zPwTvB5n!&*peDSi=}7>Dt%u65GBvzRal7?AWcT|u83iY@3}@!mVH0`l0raKxAy;wT zpOOZc@L_mF5jo=ry8P5j(HVPCkw%^t9c}4FAl-iyfjn=wZ?dbK+J*uIU8o{*OEzkd zPU+jNCosDo=d7iku2mu75dh$R`TQn}`gpexHv~pKYBJe5*U9+jrb6DI8UL*7V-5Me zu5Uy0Prch^<}0H^p*Dg!bVW;geT#A1v$fuxjQ87JJVTem*uDV;_mo}pkAT|ptNiHN z@>S7?s~_B)7gocsYuCPn6I=`oX$bt(O~Rpoe)DspDK1TLv=wN3P*HVc)Nvdkqm85dR~XivUbH*Dpt-t z0V?7KQzrD^3@L`VWBsvYAAn`!9g;CBIyS=E;WnBf=X zW6;9Y4tV5?mn6LG)?En1VY{Xjd&tY&IHk?+GA}KMBu%@xiC0HyrawCZ~%;s z!f=>VgkEd~eD}Z5q8dGI7sdaP6)}ni#!2BnMDQw-1VX#im+B9BmG1-B`xz zaQBSp#aRRf-HJqPQPMKl(0zwn~NQf z6Zo>zM_AAryJ>m26RbAnpa-lr=;aeVr5UnRal@uLtdh!~I6|)y3=h1}X>+_B*d~m9 zuxi@xQEifa+%AXcJU0$lrBHMXRR0;(@U6*WK8qyoMeAS50rIS`Ce%?|@@dD0!Zay& zzi-A6E?il52rdOdN#6i>Xxz#>D;!;8MYcH+xIl+2%8YZhJ>!Yq4^YZE&{~K#U86 z-dP(e8hvo?)?Nl1k=14Gw}9x2o^9!djM=JG4f#SMJnxWRw!f>`?e5>XFZ4;)kP~8e z=C~AV>(Sc;lmJl*vz4#SQQIb)mbn?y4Te0g06Sj!GKhLqnEH zjT1@gAa!RfIC(rZWH;p-urrdyM8jR$Ih$W$wU#EN&on(c+_7B4Asj zJ)O}i{?3crcGhc+V!bX=O)y`iK-}-5q`D!~2yw;Bk%AV`XgY=2uvG}v;*yRlBB$@v zeJn6{ue%+rGEzT|jF6ml#%Vtx7mrq2Jw}>1oswGrnYdkjwP8-wqghY?QO36Bn~b~I zb9CYi5M!W1!>NJ0<(6jGuc~I#AxJ3q*>13!Uwu`(ZQ{0RzLt3Ay<&koKAN|d?0*;E zFjXdLFsVNpuOvop+6JWXkXuck6xzyYmA^+gFry9_ z2XFx_QK=5V)NQoBw^`!vowerTus0I5wWByYR1C|&) zQu>Oa3nx>8|% zx$KW!L9E&FNR*tYy&8Z1muH=JOi)Fn3RMvJ1b{wXMuKApdT$tQ0}X$Hpcof*$ei>< zt=}M?ad#hYRt1>5g8f*rmDuxZ@^2XLMFFDT&N5x3&G0GK0oFD!OYkKAYO@-@nOqvu zexG-;4`~;`J=r%W|9(r)ftG@q$D?;sC(g~zeY~Yk(NBB-g)4IMn~(o|B3Y)Ne>k7n z=fW3{4v}&_*Bh$rF!wTrC_x^;0gL*nDUjzl3HXJm+)P;W0-wrz@P?%YSmUwxk+Z6Ac5z~a`e1w1tF=!T@~*PZ`LU=V?<(zR4lU!{1BT%r6LtGj z+Fv~#La++$9#ebMdxZ8b15@$3;Y2IbI=yT~boB+a5>O|4L7VpMp;k-u(08kQ#6CTY zO*=izqbK}nW??_>ly1QjSp{5bJG=Ai?@=O2#loa)?wma_V^4SIYzv{;9w3i&Q|vQh zpxs;+s3s{oEPkudpgwd<4+bg*Dn~+x)lG~k37$WJ%jj$Q93IcuE#F9jVg`knCcO|d z>UCo^ejl$*D6KbLk)ggG=Qjb$>}gT54WBo4H#5`H#F;+NN;n?qxbjLp`)-+evWa=0 ze=_26f7aeZAU)y`c(GkTMpE1?3;or!Nx>>CozPMSq~(+oLWB>mu5gCQTDqZQJM0zJEB??05 zk*)*?JwgZ}2_fG?k7e(B@Sc0`clZJ82`h80ImeizzGF=9QzCj#)UA7-ofv;}h9cHTKLpqc}B{ znkktKgkZsKWm%^k8Y%ok{k2Jd+~{BDWnXQ3Q<`tmBkt2GL7l3Z$KQ0KH68{cTg4u( z6OS8Bu2LRlfs`0mmB!xS4Thy1qpR1W#olKFCS(U-hc-hvwX~`T&3#lq+UwrE!-{jZ z3}`0~7H!xOI8z;LlHBU9unStdk0|b+70axYQ_P+z8)ICxKr2&PsdniPW*?2a#&dz{_y~VM zJ&>?|TY^>-Rdpu&R0Bjti&PUd|K1$QW$sp2;$}kYU-`_}_=MxcV6lf>5nP}q=Xi+v zyM&$7uz;0Hfg+yYiIX+3|(Mtmm`sHG}#?ec*> zAqVQtE=PGm6tyd?=bRTBYb_|rzA#X{l7MR$<+Cr_P|9f9f$Vi@a}-m@j1S;$jz2H6 zQd{-GsLhU)167zaL1eauV$7(^)p9sY2B1ivguuxNFQpF3YHGO|i{{eV#vo5$?p zEjeIsddQ8F=fw-C@Ab#eBhCZTi>aI3s5cd3q@*E{?N*QIrzS`iV==Y6H0MiR0dTaL7FO>obl);pZIH+PT%e%Hz|7nH3tKlS zJSCxzM_PieZz9=a_j$j}s?OVUhd^+0AjbU!r=-mTg=+hTyX74aHPT_9;>Bi0eR>6D zz>RGxq}qL8A7_853v>kkcs&CbQdAd(ymsg4hH#344x%MpPmyjCnd_=ueo~QlsVJBu z#_aXon}yR+**0;`H>TI!~OSy6a8 z z+4+r=l@rJL9|pjDS{3^p6~>WLK&p)?j=pyI|3ZJ2c4Ba1b7nfELF%=>Gm z*p9P77IlGX&*X_rAa_RH-)hiJ@zJSM%0GDhn(WA`wOsT&=5S*WwXFF_o(;ABcqwp2-_JH zjobg6QJl-zyqYEp5V<(S}&=#Ke*^#>|_ks)@^&J2uQ z(Q@Ymz0Ks7DDDl&(7B@>`4wGfL~og};1b0~(hp(yw36efnfl)fF6N?RFFaDOig9(& zP6Y0plbHJwY-!zI((@X8D9hTgd$}!X7d22#euMTha1-`-k-rXVz2&{->)#Bm8iri> zChjz$m`EbHe#(suW%R=VareH=l})sLqd`CY>HvX9eP=yJW|hY8yYiMu)wq`i?QuQc zTN8xp+vA3+X(sr-morxlIjU1-YjA)LAR1h6wQa9+AjYPmcWci%0o4|<_YWUfi{a~8 z=6;Y*d%m+u@hldSFCMeG1Az6aKIE;mJ|T{r^}0=6nZ2rjnYB!IJomV6Y9vLb$I*we zvBMo-$LK~o!>cW{;bv;>oV9_oX=W`9)PPW-&3J{|g!RFo_p2g9 zD9N$SJzyd`f`9I>t{62rB5VHmo1c9S%nMaIsZ9=kUVmPm?Yy0KFVi;}_{{Ltm$U;t zFM;$GsjXWPOsm8?jw*70g^#hm`vkG<>e#NADiGj_xU2*_atDarO87U$f3);k9MlG| zvB6w~5nRRo1KI|Grt74mPVrYn~+Fsp2yvYT^mCddI4tOTJtS@~1i#p@uQj`^OYEp?fp6FW(l-C)Q-tGEW znznlr2;2okGt;~bs)kaCs@psA;x1N*K9usEpDV!LH23JN+^ZjqMY+p=7&^OIc#$aK zlv6=Ls)eO%qntjU8YwWVyR`Zg1|pU5%&cYBi9Uv^r803G5ySwfu5r9$3aX)r?MX(W z99&F0;i7irCFhj7b~aIqF#Eig!#;AK*5(C9B9dz?X-_U?OT>L@pz89cX3dFRxE{Ex zt!Sp*OYyX#jXJsgNl~dwj}6oTM>?C_Qy+yo*Y)bA73U&2WQFbkbu`}FK-ZolCB<=K>{r71fi$ z!%O&=n-y|W>W6?psyqh}z29S~f*yX&9p^GCbq_5HTH3$Z_&Bm32V`)%={f88<{mq4 zd*1`KBr>+g4Wu}|W>kD9Yszo_v){_fg`~iQe2{+VpLoqIpxXn{Fv@?|F>G&C&kXu2 z%B;tOC7M4w3d#AfZreV6P>*9@Bry|k5VB`x%XJ|2}eCeQU3B+m&Ft6)$5aZzE> zyXrB)Kvc4THnjTl^EE(j=*Zck7EkFgY6=zGb63XHO|>RF3@ z+kM%Qi)>#c4==7w9)Jak3CuQ-&h5(M+xeShrsU^z6XKKn-A)w0TCO0FwAq1+`vD2=L+SsA=7 zJU+HDZB)S_$}MssFf!(3Zg`e-$Yh&Lyk&*^*3?J1otzXe!ZL)k8{<02H`8a_2f^LJ=oS}&myDGikT!>f~Dibz~Thrj)zPMvm%ngO6S z=@^4_bN}1kK(`WE816A?I;?~9T=k+`W&($XX}$eH1%C#oY`#UZNfTQmo9NBUkxKLs z3!B^zA3nAz$QSrk=oC@nH=FV_?*MYmwQsOy8W`02C2hJ7D_sIw4xm+}qf0u>KdbIBY&wLm8iTr5ZLliXap6O&h2#u#gw z$#p>IE<`@To=UlF!p$O|FVa$-QUC(c`{`^hn+4@ue2ot0P|sSh z(rl>nx}i|LdTbdSo`0m-jYjIdEn7?_yd~0R7c5&r;=v5*`5zY9=a9{E?Z`Y2w zZ&e!&$_H6Lpm{|&I4*5ykm*Eqgn6Fq!f=(T)YI0Is@dZG!PrQ59hy#x=h80vT}n@$ z-6W#Sou2-X~j~+qK{Q+_^C}a$b*a3Lr=^Y-p z>2wBE+oLaZp?2(9;x+%0^j!NKS^MN*K79LE={(UQwkC>XDG&*e$s{TUbZ3cF&P^gk2-ffi@8&>urP2x=vG zkzTNAJ&_PO4LROFm#I=%BUIS2;GP1szrGDrOM&P|0x`XsqW;5(T?f%Y?DhnBo+7?c$FhaZ=L~Lm_0TO}S;cy!1V7d;5C4;>{2i~mZxgRO9M@KNWB=fV zF4DmsUyqMpJ3_ojVeraIo$N%hDbU6fsdbsCjRnSvLYH=8dDEiy=tcMI!zHb?iY?kn zi2ZL>@y#f<=QZvbB2A?yU0WY`lfP(rq%Px6l#rlpd$?c;t+D*t>mqDp=;+1n(BiQ- zQA-AZ%Dd~!EounMY7-loqF1+ARh#wr?>aIj0n&-JXoVm4A^E)k60TzAdqi`{^*}Y- z2;d?IlY>?l!y>Zv2q|w+czaMBbXbC*GZ~4u^W~gccf(|{F=!%m=>;}AnsAKJ-r7wF zSYEGm`Is_N^X1mGoW6=uA$~$u$!5m!r?ttqgFE(XlQ+Ryw=YSw`<+qg zSw0CAsLjZVd#qUbO-WpxscNXz(*6p;?b(bpYFJq4^Z4C~x_rWc>dF&re%Po%qtwq%sE~7u4f_0Sw+2wzm3^X$!J+h$zu|70w^!PS?kkjF3 z9EzsJ?z@(Z>?>oOMx8hi$a_Si^r|uo2tJN4yTm1(TIxOHI+#B1GeY#m?|HqpOK`(g z*BC(PMqTvnR#&~7Q2nNXDU~cuJV19%m>A0V;L@nbfZ|l@7M)J|^ThD$YuK< zR<7|SyEAW=zrrD@cEVR z{llg|zAW$sY#BNtLVVp-z&U96{K6;5ZoNeP1avc~lrXV-day#_QLKn*E*T}y?PQ)T zdWb<`QpwSn3~?cfnL77A%3a5vshj`ANb4X|{@iaB%UIRbmeqfE(vrd$vX_yI>sD z9;Llzmg`x-zS$nmk)QSl?9@x_P1~H^&oPlPv%~OlbF$#^6E7TyC&woIV{k#aZIDDM zqL#m+^X&UJppf{zo%!ST=!!To9N%1Z3t>0-$cw}#%fxB_;OxX`VN^%lD+4uV6^IfN zniFjM3Ys(H;}8wl-A0UZKYVqq$4ywWkug5_HW1^g-ELZ*2Wb}YvDS>cj{Y*=Qq^aD zMUx)X$egVdM$Uw-+p)JNRw(mT>m(2M;^$L>#qaaCZ0E&)k#~!NtesTS{e}rnjpH=1 zHSrR)s6Ae0$o=tViId7|5U5vyyWXM|`^mZbv%USRLKowjKk>N-`xIUQ_?s?-ni(c}~mRz-+U7 z4AgmI-OX1w{i)QGqr3DK8H9WG5W}O9b1lz{SGhaMsuXX-qANbtD{tL;%j(x?2AAVZ zqkNy+(Rp?2T30MmHqCK;+A>R@3($crI6@bQ+RnHxQ1~kUmO}@cE}g7HPLrMo`swAG^tG<$KeUl|u#P5Yn|Dm7VSIp^;>)z? z(@JOGFrCEanTBq7_jpuyO?3W4_S`un#DLfO1JW<+kb2lI)yb5je9}O9hu)^9z+1;B zx!qd_!XMIgI_9se0>IXNcSi0}fyxipi<7VaEX?|f^m?^&0DJ~hs}*=Y59k>rGr%hg zlzi~gRFpdMykF=d0hB^U+nia$9aKD4Ofxp-F5Ifv@m*~vP#^jB?5C;vXnp%eZ>3iL zS4zYR{}%430Q1X;CLwm5`82K1IRl+@95HyM36zwd{*~Y*FqwqBG<*--{KY zjEK~Gz9$T=!=}p+Vg38VB=>EW zDO=mLw>lMD<^mY@@v(V;D-QIeVS>ccXK(Jvrdh=Z8X92ZHd5fxQ+w=q9IY;vu*hC%7Dv9T@ha47$mnnW!1>-sh zcMjQ=DkY@Aw|;AN?2H0^rG(2lra5Q%4ws;*3GOo`ba~I~DF+!hAs-V+^7fgyeKSgL zwV6V);ZJFUddpQYf~L!R9{6%3!WwkO&XGzp@3`8TLJ9_%b^7J%vx$d1{pwQq8&~u- zQ{Th9Eh?~g_Uu@A0ee<@u4cFRB{O8!oZ?5PI!=^DPXeJ!sA{5V?+&lX)$+$zXEm9y znFT}@?~!&fo*>^d``g+g856qNIKXE!oJeS@AB#%@J<;>Ql zLCnD#i*lzmH->u12T9eJ5a`(tc{c*@3=E-EN&f8?$&^df`o_r@&!Hmk>aXS}^AP72 zXoFYDbMmMJ1=<>{eiXh#4r3+J2PvAKqh(I$68vBp>tP0jvchI@PPa7FWC-#aS$Kmp%${{*-6_BU!;|A3KV*v3~*DNoAs zB!wWO|EhR}8?{HYDaLxe6p-LM+ z*)z)oX8#PN!ki7G%UihUK6|WUj*2}+CRZZB1YSQgM`QTH3lXF_9lMmXlVvydEM;$) zcbP0M)Nd3ZNbDr%$7gMkCY;n|;E>w2cSmN&w1VciwBN6HqYTSnO#P_7gBXjlQL7n? zW8wvL_P%9tV=!YiyQI$*W7J`Pj;>`WLojLG;eqUTbrishcf+y}Nq)kU35>c~9G+o< z1PQyb&sf=)P0!8Q*O6zh(Ow`%=giu$jR70=_N5zIeFOEeeg(1c5?SsFx4M4vRXn|S z@8RQ$z^2e!D1oed_kQ7*B^n>gnHg#)v4nqZ_9^{0|GsAVw5 z5SIKneTG)=OKAM;yZZVW+)IY}03;k2Gb$KPHJS6XSkEU2N?(s9jWVDZhdW`%pNxI( z^*wm?@ik~kzQ;n~l7&Sy{Y~e}n0;@8W?FsB!I9~Ng9=^)bE>(M5M%HdTNX?2vgAwG zGbEUjMU``U4CJOC_;J}NCI;d>k*X_zzX_>gMF&J2?3Jx}cA+qq>}sM07Rxg!RLN93 z%Lvnx!I-o*-j+6jU7eXX4YdY?+2puOYN&Uqb$@!z^<2Frv9FgoQb6fq-wx#shnR;j zh3UJzz=7=ltH zsr!$BB9ZHwW{8n%S5QSTq_NT#4>_frrnJ4RDV?e@9mjlHij1FFJ-ziSow{JMi&fNu zS&7kXO*a`G8eIiCby9h3`L;Ml^EV@X{nuIjH0g`kj{RHCV#~MQa@ByNtG_Skt+k!| z9$mRME#<$_q4nd_|DP9U4bqH-t`h$Mz(g#+JoxXAIDRxh#;rUA7wKn&ico+K4$=oP zI{(`_hsg(AIel)0!zZpiZ0|3pkp7(a*T?VHzeQb{DZ*=da(vL2zVyFc$aLjfKtrSR z5f40!xBqX)`29?e>jhkSdFtiZ(-656|B)wz?F$eBfX1-&aSfB5|B)vg$W?|wOeL6R zP9%qYXTHDlz~+(aJNA7Tu$hydcpA9;!m+L|_Mo(i{+Ykg?b{jf|NU#Gb!{>?_95(% zL#$)?C4J&=x9yYddp3qPo+&!~o)*91;T*$LJS&3zvLB^?x7T^L!A~L1eU90B6>eSF z)s(qgA6xW0-aW&`^D>q8Wb0A>#p?dsH}~>)4h}LiQ~QE#q_<4(J`je`2ZOHADhC_P*p&W*x5?`j<^2Ttb4q1`=cwDub{;I>B7nXHke@m{d`R(`bWo4X}o2&lcO`+2{pd3c9Q~TX2mhFF{+2>?^ZtFKurf<*V zh_rWfeAbDCdHVfN*5SWnrXQ1RFlIZ?nh0pIIjI2B?^Nginx&N)I}>OXiFH3;=>V#s zjy%H6#`yHyxX4nqcA>yI!m%8-^aa#<;Ew|j8pe4v$M-0$+kHr;MM}?i2IB71!D4^d zx?J08In(r%g%ElwJ`($%sD@AFK^(W>&@``YVnw6Sl?X22Z#}a)_9hG(&X08{iUU)O~MtUTtvJQ>wZ@G6ClN^^Wb*bIju-izbW6P5%;K%o*n(V z=a1fi#5g)Sy0qqkpU{dkV0Jb5l&U3SD*Zx8bD!Lzy>@HI&fV&t-tLE=RH80{i0NbZ z8pm+OnxercIGiqAvvo86b#lGDpZLBECWZabNym-16#=Cp?h@P8m4#ZNzX&kpbbyZ} zsmCrVeIFnofb}p7$6a0Y*;BkzT))sQ&1+K*9@__OabLcE&F}l;dR{{#kt?`Ogyvzk zkq1VPH*5NiIQHkCaC!G;PqVHX7b~PtCU>Z4KdVrfAdEoRoNRTy zi0WN?cb147uuTmI+PlZ0!&crpR*apH8u2&vIYFx%w=R0mThiw7sOapM2GoXO*~dNH z{@%tc)Xau2JW6!ceB+{vso2soYzUTnc@QCk*n-gm0*)RIWxv+GY89+{uy*E}!Ykw6 zYjv(u+TSPg%c=l$P1jb|a`=SIiT~J;7}0w+BsjcR(024EXIy=(Ty*~B*t<$S8})yV zaQ9vS*nDYdZFt5OE8iCFPcR+Za9Uqp790=5q%sdVlo-ZA@f)~$X~z2g)&(^bB?s{k zhC_#kvP8g*U`Z0wj?N0c20TPf2$h)1U}iI4PdE5b(JnRg=M@xl%W*$wTbEk12X^Es z(zj+|s%f!iK|X&wMuF^~|EhkTy&Y`rgRStN9IFH3W7e`cjDZdho8Ifvm)^j~?+` zsrwuwU?W?I;r8~5o?5wetPg3Vzb{j{{-KMc1Ep zI^R0a`RJef`@*GNB8)!gnsY?jJ2l0_NGK`KvNihs$g2;j3}Z9*C7vZB*zCq4V~tNI zB9%VzR-S)szi91YBd{BE*uSk{a>JmKkje;CGNZtKhG4XMp@f8laRj4=_eP<^`=OBL zEAyx^MIWCkQ!m=^zl|8i3r7-dL=LOvx?qihBIgdF4z&TxFNmIEga4vlWj(KhzY|y z+s2oL>?{-D%jTut>K~GdE;}Ufz%<{Fb*~Fl?Ap)TQcy8+(`nESyOJa3FEaT__p zSVKc8wNVfgH(^s*d@8cOP~JW8V1MX>IKH%H$O$DlrL^ijUr8^o0w=gR57EgC!Nqz! zca@(kV|B=pg~OT%BCFyHmg^HF?83cgEd2hwSVK*iJ2S#3N2pbquWa;8_G+6`xlO~s zHw0Hdo~=>J)_RZc8!7W&ey{4%(_YbXHc~NmWCsUYXMkh^DabW+TlBBfKnoo-DW1rk z=R#!~gx?gG3Ue$U5ZG`XIap;?byhHg7&DrhNy{yU4-~VFx1dIjM%rK(ALYy2cJzzc zCbFS3)T0D~`2Y1T`$vGlwxaVzIjtP8+#FPd1d5M$HlQg@uLKCP*5Bpvk1hA@;=qWfr%35u&vLcO__l6Jl*C$*!yxno&^1e0;2heXtQJ#@Kg z$H^yd(!0Np+Hn4u_u6M4m!@aV!bqpV(lT5vGKIy|xy(Al`GWp(1!{xjy!3W|TS=3h zxD}y}90s(6Y#wh0P0})U-pYn9epue1Ez*{y@%fnMw~s(A5HR_%tDn~+2Cc_=`HnYj z5q@2sJnS}kTFQ)(UAvwON@X>&@G-2SZ|W{D6rOJW{Asf1tol-d5aknPY{SBzK~p*( z33?QLcRtiM71;gtnudNRL)iL_DcdA?>xOA|g*qIb0 zkP@Y{q%Vz3!A$Tkbz-pfwaVp423xA^OfO=iRYQYo4LnA-shTk|TEA4k5l*;MuG#9C zd8Jw;Rf#?!bop~fX4YCW!-C5;nLg=Chv1=N5Sq1_M_=D$xxqCz>I7OTny(lT03gJy zW(*5xJ<_`^F;b|)%agHMQO`cMHnqz|%~RCC$!*Hv7??K8=BFJW-;#aK-&vL#zg&p) zY0oRZ<15#4!Zyj&N${8swO0+-iRCsx#DY^{)E8^L*`RjjV;gnDHv}>u{;ls*KQJrS z*Y-xEZj2gnIM?bX-CM6g6sjdK$c(umLt3jF=jJvt)YFs|X{z94`DUZ`f2XWA(-PtrdOx*m9QGyqP5a}{? z6O8ah#>)0!ABp;JOvIPAuxIije-VsfhXdpYj-U+GQrOJRZo1{s(B^sD&q7}ebdoII z&DqHS0amC^>hjnLgO*ILj&VKyKI%!A++p;Opi;o0O=bt!J%X%~+iUJ{_rkb;W~Htd zo+VVk{NS&TIuN5Q?2@}$^+fGppQH=d_pJ~R04Sx+pE)XQR^%!V?-V7!&?|)X`~SCX z-@$iXQy#JY&OkKVaWNCb_MOfD5x}(zMlI3Iqjt#RO6A{t9Pz@0V^WqWPAss@3D?XF zw=p`#xv2GH%In zHq@H6JgK)^T3oaG24)q|99*`kJ(Dr$u7pIXt*6G6@Q~(o)%W}$!mk%CS@(?%$XIhBM5C&Zz!f14Aq0-| z<)7b8iN6|SXLSKJP0Qou?f-m+mv@uw5#&JTAHxM)WxckS5fUzc+3oE2FW%J(m=wIx zG>M{W`?vyH_1b(b@zBzjTD9?qWLV|U9hluc{uf|7v{xOm;Mw!_m~sZ0rqnX=J_`4w z5zOtkSml>110QiH(H`$qVd_vyNJvCbsfcLiYQvPgQV{=5b1x|WUK0)J8-p~OMec27YM7qJl-BIB`p5K{kiKNkmyuhCh&gX z4bo3raWc9#?;>U3hN?0I+@BC?{<|r23y7v)c9vcgLM3zYpG>HaWwb}F100b z)cen)p^qx*t8#4%xnBlAaQRCEcRWYS>7H)m4;br&_>0!A`DOhkOTFEhMQt5&EtiHI zV%mvHxPU!eLIl6wXF+I1QMg^z#=G>$W?&mW zX(nGP`Ca-F!5Ql16K;pESxn&&g%4O1-TEBm(k_XOiL6*^;b?xupeGxEtq6K=iHA3tXD04+M7CKJ01dN6#9p~0L-^2MapMag<~*Ujgmp1 zQq%}J=;ZK5*|-X~uX8Pd&dtwfriB&YanS0&^i!|=q6QD2I>p)tV|t>h`b3pPCjlPE z$TcAZ!LRv`e|`I1A%JC9=S~AGd!tQGUn}2ST`NDfruq2K+Z(_7Qq7-b%1W5OJKSM+ z0(^*E{2(}BlUeD+`Y*ocV>9GQ^~2Oe28W8)p6cj$9!kf0p-vEdv2v|61J?3UYV+jm zIwdluZO2XN71AEG?_6ON4_2_{We`{IWM>ffYW21EyZAsB;ui3Ca|o(Fb8V>tpons` z7AqPL4O#D9Y(b|-c3_l%R?n=oJL!HK80#zJ@-M(tUigMpB$}`>#*JVe$+Qyo zw!B>tB>(9?lz0c0>y|C_W;{v8)G%Cb{0ml1qa!Ztkkb4oM1AJX?Qc`cjp|)dKyW}} zDqM~0hU7{;Z837PEzYQnWGFNHP6ZgiZun}6O-mk_-ik1v0^I6a7)F7SV?RbdM!SRk zlDkYAyn`E{BxnQ{)>8-dirVIC#yqrAu89>WePta$texzJRxx0-39P;E>Zq3bDZz?X zvXeFKRRA)pFKLTX%G1UxGs^?KM?8lL+JaulT5F`dTd2aPv<+Pv^-f1LIq|ETd70u#Be6W( zazKZ`8V(aDKi95T@sg0M^R$pSv?SKd$SGBhJi7Mw1Xu{Gf2P5x&XqB5g%X;%^>Ww( z@>vu+au`KfV1(8XQcPpqU-#2{M3)6CZkE_I115>Elw-W_x0KV)~ zz!DK9drv&0Os)cu;|t}Z2>R)CS1YDRrHrr>efTktxa6G38Fc5e!guWKQ zDALR_9)`yZJ#+RqwJy{2dGj^`DQGS$`BQV8>U_GL#Mn9XwCw`__q`dg8weVO02+$c za`fxpN>I})S)u5kfrYTE+gx(HybTM2zXt=AwX}c@?iCOpA8$MfJ;Qq=_vO#5<*i%0 zZb)$%o3ZMl8V)o;0=$M&L|tqv5hEHZiB0OYo@R$=&3E_b9E9i~>b-zS#$#&)$iP25 z$74H2zGnlL>rv~n#TM}eB2e}<<(s;`Y=nP@l!lP~Cn3%s3-{A1__~x&g8Mv~o&XBI z&oleL@OiPKfD-p}-wCsAyOlbSv(=cEiWR9W`z|$iYoz%MS1!Kr|wyo{_GvIV5QQs~bLwz|w5?PHI)z%^k+^j=|EexD|8$Sm%jfz6m z&1i8bAh0nCAm?3-3@vLUzJTCVx7s_ABjaBh4~Y=4rk?>{znAC5m?CXHncFIq&5?_Z z{t4}}P=+OYKDoS5Bd57s38?5;OjmdJ^8$JVpmH{qxnW&JtG3h#^UU!W_1VR0Kc_ws zQ->l|3;0rK#gj3{M&x8Yxt10mui%&NT2}*TUR(`?OWaX2PNcwO4j1WlZZUs0=ViAH zW!xswk(nSrdBGcnf}(qeuvjEG#(_=={aK{+N1S;Hdc}D?y&T#z0EQAUUxPqlnDyNRBRIq ztN@MP%+?`afq-wUqpfpyNvQW;%}`3|I5orJP2~aLN8B9@qtG zcwgG(e61wu(^DS?1oVpEmeM!K@UXarI@{W*K4j}0k=svx)aAp{GkJ}nOw^ig>7Bi} z2=7KzT!LkHhWb*EW%d!i9n;=Z12kRTRLs}aOKQ=5vLYt*e=9h}42GTiJ=t_;FMckNFJE9uzK>yz*t zu+E;pT`JV>%{g?_7A~X17`Amqjjc~H8G6oKFm>vJaXZx+`dOm7Ut(y36_$yPUyqb8(F7SszX}n!wY8b5 zWqt1k;0cTas};Iwj2^sXti)Z7JH)w{-c37W9>}6}?@CIq^JXkjKUGn(5Vg^=d>bT3 z%2=l54(I%^HvW2H1thQl|2dWeEQDaq{LFEdRnmWTE2zv_m2V14&QL4=>&?8E{&MqI zK*EEEuy9Y^4?*7p;LJNMN+~vmJ++I~9JmJfkdo%G=Pk3Pxv@#$blFi3bn2Hk2$z@` zOp3p+wInFE0QrAgpRPZ zs(sdO??H=-GCXA7Phw!JD3|7AsL+8D+n6z?Osnia<6_9L+!4VoB(^pnu~+9rSo_Fy zQP#eSu6yA?@=C-9&+}Kx|5MQhJUerWw;z_-)I_bfYHp%lVlO;mY1zm_sQsyl*+Hk; z@NCU3iLobs01PCm8$5@cSW0Zl`0_N}6o~nv&6^$}2s(S#=So$|RO<6wQYnCKHPMK~omxc}GbP=j1qBNx=BGaWOtAG={(fvZ~_S=Vg`X|YY zUQJ!jiU>2%BliMa~ExX1xOfn$)gL;RtKGkOkxnZ~yJCs&l;kH#3T6EiJ=66h1uut~~EI-1~<9 zkV;}}_#x2G8m2wXd<>(XMhb$IcxI@BSQHB`ArY5UqQr*g^l~t~SQY(nAsJmODMH=w zvIK(jLV%*%bMm#bKc6PGY%*39VGqJfQ%X{woQ;&vM<^IhVc|`K4|XHS#MaPQ2N2}Iz4@gB#*`VyshGq?3DFf zgkMHK4dI_=u@4AcQR;=YUm}SyEio2KZry6*3Ircp!&glTs~;unzfhvAkP3N(nhrFK zm>BWSQ4U4s@>>t?{%jScZG)~rk^0u57Ebx+Pd?|#Tps|5gd}?o*S|7+_JeMJxoD}r zZ`}LhG_YlBl!XLdxvgiFn80!Vmb%G2eLwZ?uPXh1L&N@WTH0tckmaM87wZ)w_LF%Y zgHO?uz{aa@L(0p`-?2Q%cd!fhA+o972zRVVl35p**zuj^0v;dpULC-XFQ8AdZDvB` z(VNzW;zkiu3#;g$yt8TPU6+l+?|XCgTdnjyzuChbk)7(pYvWLPIlrW11p)MA}-NR%IZdJM&ZR^Fh~vwWaC*y%#O40>V(-rkjG{cDXqes;&e&GorI~2Cx@~Xp(bWN zlZKP}VE50viacT+E?6_e-8a_bFZ#HeyVWo@;LV88}-k=mz`x*fs%);kh zg9ZGSHbNIZPPmN_7`;-A4Ej*5@bv2Ubpxa?`;|`}e%#?JQ8V)=dP-7zLMa%V8GJ!R zs!_=)1NNtm-_jbzuBH|srMc|N-o~3|0tXY%ip0>?enhJ~PoH8v22kEbDFYA*W$0^p z!K&etn^mtT)Hb&53;A*sMBJ>14-@0`ul`}97B$Jy3T_H=(}sG zVenDr=54T>gS~w#R*&GjX|)1&*8I|!p6mk7ne-zS(G&O5Z|+FE;1Ag2XQ92-nKI{y zz9SHYjl0JyJY&xnqf7@YkaYc54J&Lfx56l!j79qziNE_6&7_{Aal_DQ{^dR@D& z5JHL*`g6(tB6gqeY65=j>)_2z_A%_EE`WNQBh3H2`LU_;71ZbY?H!iX!AmzuD=Xs(N%wuks`lNny)eC9j!+6+pU-A%J{@$@ z09yrwrV^@KIDWBYp_cU;@z&x9jN_Nws?WaB0#NzHeqvY%5MXRk2PfsEFwYWB%>p!dt-e zzq+>TWZF!q>cPVqjX&P!?-vL80Ym0#ob@|C9^Ok66FS#^S&)EjM*s+8=-Xnp8>MAs zszC6kr8TxcUJ9;zr|+X@+lw8p%zOT|OZ)Y8j+<`>&NaDvw3w$oMNA`Ye%>UaO+ zQ@Hk@okG#ab1%V>vaSi|8Nw3vi$!S8jt+(4J}z6(Dg%y{<2^G zPvreJjxWpkqan;x((a5OA*x>_$<`D9w;%1!cO8g6Vv|F+$`bt_=hK;|tf{Ga)Q|IJ z)W7{s|1&C0pSdn{^xVqat5*U4nJ28A?u;d|(T=Al{%6KNJbe|=`A*j*{xfVEFbY&= z`~iSnS-O8{@c$!G|MvCjBVU=+1NUmH7&t)DG^T)ZMJi;0D+kx>tBCu}e!m*qFxwJ! z!;A4O)4KdO3Wl^V-$_0TzPptxzpK$=_A_T<2N@Seg{;q4FB<)MGE9U z#U&YE9kB&Gc=Marna{I^_U)x>a9aGu@cNseSur|AOV|6YmRvs=*XMtFK>y|T1JTN?k%&=Q zY@T1=FH7`a?(5|_#bwAA_vSZL-XZjK+_3q{l~vSA)r#GH%=o?E+?=j|YX5~8oR(z4 zbu$DnZ{Tm9jo4)$p&6`Z*qHkp+0=XPx|=*=uFJ%9Nbd@2u>x@N7v)NSGx4yS0j->%9e$fOMGj&;ULp>J99O*jun}K`JcOtzFq|hBK)EJyW-fpeqV@Yv9a>8G#=I(DS z^W$yXGmm$#9o3&bdAId;wc~ubnwh=On0o)#D>ZGNrsR^_@l0STXEdC&H5popmEq&M z3O>h%e_KwHZ23(T1J8zd4V>y4y^yJFYY|TNRYr5k7dXLzu=K#^oX4XsD58s_{64fhuGJ zD$SuDj0m3hi)CKX%~m%2L#bnIN3Ze!^aA)d&%%89+H+tTx*Gq2Tl=G%rCKw6L_KUV zFP7saq(|adcI|9z!eY5O%@2aHZ$`_#?kaBT)b0MhroC|EG@&=J!~9<|_eZ`fg*>Jx zf8eK)s}#C5my}tTFQT}t6Z$N!r?i&i?eHYiN87$7lwYg1bN^d1ij zqu?7z*VD?YQoHH6jV}| zz=E|48x_wtQCN?MWMz8zuCClUO}cY}Yh^>Fu25IWMX2{YR2_?N3ri|bQ`gYgyO`cC zxKPR-H#~zb`$}oG3RVng%|7(tdv_`pel&4`l=EbLCNOu_{#VEPZ?^ZZJv+?$NOvo* z#7ebKPcS#IaAIO2Kx>2CBHLe2j@$ zp??7({x_NX*{_-e-(E0aEbYp8z9Oi)9M7_2*EK7{o^RsQJ25C1%pL2gtF^izV|Y4G z_m9b(NN4~TPuGU~oPGLH=tFTk!%Nds1E6<$`SvUfz+Vdl9!R{6 zjXJ1WfN>v?=oJr4X!l4?oK(gc?j@-obWZC$+d0kZF5S4zaL$_#fxV=qFh;Y{iN7)~ zt*LhpkyCWHEm9q*H$yj7MHpzU>;PXx^&ZLTTftnK`Kqu*WR86?3H`~Jps$J0I{jQY zq`aNwrMa{t1dwj84ua!c^qaU$OsXyN549VsElVBrMiJF9KX~ykcEv+X@NdI?{k*}e z6{k3yL z^CwDOs?YkneAdqS>URpT9E^hZFx1hf1MXqoN6)wN!h@=`0Q+IcX4V4NNobg){NTkr zWWn2kp0guNz`a(dzVD3xP0oH1wOH;4eJeD2a@y9a^QaWyQj0Kx>Y@(ct#}T3uRrH7 zPY%t{yZ(1WPk>4~zDxbj`}t%OumDfVWouA}w3Ptp+ttP{LU&=L>!+6OvSg$QcpEWz z{5L=@8`WI!LMzFo>z9t;Zr3~{cA?-Yp#*R^$;j~2&)=I5)oupSWz@!a4PR0xraN&URV>8|$>ex==~|JSqU?i-r^q&U!e_eoL9_TlLPOM7|q&(`eL%=T>w zi;dF72Mta_Nc#lIy<|NCA2pp!?5drZrXqKo$#1^cVRPmj}YlK~I+^`|uI z7V)Q>I1SO4$Y6!oPDwWWbBblEN*UT>jWjq`a_ zKR*61c=-SPiB2^wfl!sVIFhJsFuA(!VDgt`mc8}EOzt{7NKtS-`|;ybAC#It7j_$P zcm;UAiPMAl{;%hxX(JR?_H9*`Q8#0v+Dczx7%5IaxQaeX$%*G}Gk>_G2PwDOW$YXFCifSYrE_)dtNmhsusu~M`3&E-!QwMwji10A|pv1BKx^Vo!JM^)$DqfPJrtTh%{(TbRq4zL|ab;o0+=%Y+FM z&1tr+ZiB-50uJ+~BwhB?zoX`r*Eh2&EqDtRHg=C(*{ucN1QCFF@uK?6n-ol~XVqt4 zny==R|3}&Pf0%~Uhvxp)%qt(vDC0`4^Sgeaj6N6K4>B3)U$!nyfZscHL~omaP%TIO zC~bVDwO?RnRG2!fYFO}2wE4eRDgWmu z{F^S2iZYHIgnBJ- z|4S0N$sAHZ% z{OIHP6zD4%puF`-T&XUtodxugZR3i@s>&*Axc+3C$8@7 z*o{*kYQ9aQ3j^?}o3e7-Lv6O55ZyS5Pyn1}EAt^X$0|>UaP28lha_t39x>IFiVBaj z_bz5AP%}WK3Wf)FtIU-qbPNj$KU1InT3s65#uLDyi+~oT{)ajJJ7(>VZ(eQ7tY?G( z4W459OCg+u3kBJIT;24eFd>n_%MPc)1;7VHNd+@x-&UWPFjsIG*m|M4XO+dld5{;b z8Vi|KXW&uz%V&))9G*T2Hql*#{B@OLuCH1I!>K1ls}y4vzdFl-hJdQ)XTzU_N7 z%x;IRO!YYR+XKmW4z=LB*$L_?h|=xOyaKEr%%7tIpcmXnU;c%(26D0>z#VCE=bg6a zfr0fWOA)s6HY4H|cI;G_b*|`CRaLhI$8sMm2hAnJ(TabeIGPiv9=3f}S7L9A8`KUK z9C@cs$H}7=68CSqoqu1QlYpp1NcdeSR#9YOR-PZUo!7!{E_F_ zn_@Z=L_OU~YC6)oA|C=2pVaDKUeS0NOM7D1VX933F~I*AyA;zoNPDIa8gZLJRb^LF zo%i%d&-nA4gE5A$UXpaD9UsslQ*&p?{L7AcD^+t&ur<5uRh~=w=2F8)a^N`mC)|F_-EAJ!vHIt}zH2dFEs-hA?Y@Xe(u2u@=l0F<7+xjo$6K`Z^J`B!Wz20(AZt7VQtLZY^v5-+QpIWRN;zjq*SnacEmHBo$Z<` zWg%YLhT)$7uV9nx1;Q_KXejacSY~UM#_47U6K)ge=yCm{^@s|;_Ju)$AJEaF)jUFi z5nv93l!d0B?4g~|){fK)n6;D}uA7Q4{@6>Bgr{HnglBHfzDRgG`!Yaf{rqX0MGAV} z=aby7d!AX@6SvC*$NH7U+C5$rpiP~j1$v1nm)%n|t-(9O+sMT1X~3HYQDf$~>BA(a zUIL1^`|%0U0L>l&CEUH(aWjxfzeHFeojc@q6S0+C?#i?5jcNm@2)mMF^Q^1GXyA2Wwz`YdnAPR-5JAC z@kR*Wan>zD93M{e{1T%9QU=5lP8?)&I2x#15N1b#Iem|>TD5^T8*9Yp8%n>>59KIx zqUamHdTq@<*^*}BR&~wPtC$Vt^(`?h<(hI?bJ$ua{i5UO(_2U$DvVgkbAddd1j?yY zoqx4~9;)sx3nLyILw+J+*QAYV=fcJ2zPKU`B^`XutTQ-4?doRg`VZE0R-p@L@g0*h zhjB>h!qo`Sv6t^U1segnw|U+;aP|7neOKPgG9TV^IXrOKgK@>K-!<41jAc>uh%C>U zrY?`Aj(u)ZmNRIU{~}o-?nXHkp|kOLClooA=pB!r!5MEh9>V&Te5{aP#+&$eMy*nC z;vE{EyCXWCzh6mRDsHq(aN*R$HJipKg1_O@&I;t_>`92DQ5 zuPB_W$H;keW#2gy=1qK0lpI_DDsB|9cojq{9!t**J=zMakS92Ni;?ep5yz$XMU?f1 z)S0vA|NFi*i21oz59OPS^+oJM z4=f5Rl-T_C@7{d{vwBLGc(6YwsLl2X%$1s%a(|)`9I=dMOD&3gnc30#JMiNeEC;*j z5zmV_oN!eYAFHVWJCCinuc5jps@7maY${*g#i8~ z`GOr2gP-FOLQ`;0lOKCre_ET9-yvnr&Z>7J3at42svM_D2mBqB@*y1?8398H+mp!m zV{xMnGe^aGF_w}9XPPkiI1asM3i{Avm*HT$I`cT&WbF`QL--w$C~b1Vws5-%EbY_i z1Dn7?wa$TmnciCIq&Uu~0-p3>(ms3SWiM0iNLWryf@}HRXZBLW$vMB#t5jUKGZt2C ziICTHHBImjQ*T;!Erot+Af%W2pb}}ubEx#q@we@of7o3o%UpiplN?L3+9$aW!q;{g zMaJ}7zx&Xp@P4haLT%i%4<3+B9(wUN5_A%eOVo zwvZ9Rb7h9>a+T<#ksiH@h1MXTg$l<^FuT z^SmW(D*H9=YuamVyBbU99Urizch-?&F>G_~s$Y}QP?H);`NdrNWIp$L`w48A>+RxA z$IXMA(7AR`eTSURV*>O=iJ?fg_YV9^wT;7UnD9(Y3OP1x`70x%NSA`jex|tOE5qj- zLk5|xC3ZeyOyRb6BsV)Ftq&~$Jl5wKFAU!Xg6Bv zn{X#t)%07kleg{mV(v{e3rxa?~*UKdGmfS zY(Mwsp*#^g*P5x`p6I37^<-7M64434;iAqR>|A7c%dxQ68h49A_to{!!*Erow_m#^ zAmf)W@*Z302xp+$xNp_vj-moupnm&F@qazeKVS4k<~drv*S}e@VzJ*Z9v)v*B#Am$ zxjLUDSkTFCXLXoy2sA+Q+&f(SF2iTP%v`r#-uAqGhjakKUZ z2TLXoJU10t465zVcEnM0Ry&}1GCM-!<(OzAsmUYEuiSgnbwwLKH$3sWtsJLr|GSDA zF3wgssMsUY__Gftrb%ij&2 z8`Aha5=4x_p$$0bQeEP0_$|AJJNxPj6C_E_Rbld2P$p1V7TH4SKwfH4o1yAV*jS%{VcE7c zxHVy}BcgjSyIZ-+(AIr|U8g#fzmy`?Z?Ep?72(ZvjDb_}-9&yXp^CGqXecqjcXwA- z#AW`I=0g*tkH4{!nYlU1L}D=TC!?mLRl9M(6Cc@J5EuAmoc`=XmePv)E7TCv5Y&=k z(h2S%Z?9A|^#_vCV&{)NH#d63u`Fg{IM7J_y(=Z)O)jvjy4J3A*5RK1y>gI3N9j+EW zkN&kWz5_2ZsF`uhgk@B!#2<7sLGOH4Eq?Fq!^5U>WR5A_?-jn_ur`z9m}@^isBKj^ zRqlzFoHWPp!L+xV3$yJL2lvYMaa8tx^O>0vBXsYR_NHFfW!qBa`r*SF26t2N7DG8s zU+Q0xOK|P3jl^>4l|OM0Qa-{!i50%6N!*WE9m**6Yz2jx2Jc%2y?Vzj5eBb^+Lg<@ z>rHrSN)$VzSmv+TiT#q*3dS;qVCzLMx{|UU;pQ2%ZzxbaT_t4VexTz_2JA{>w->s* zyq91!*h`hJ!|^75EQq7>5tj*WUrEOV5lZhUSX=cBt{%bE1O0I1vEaZ{wwjH}+gi=RS#>?$9~^=OIu+)!-ErLU0fA(b z7{~4yc9!&6onzh4WKEiRYEQ*vD+YpxmcgS6RGcpcGEhD<@MN#(_LV6abbjg+zh^x4 z%lGotv!e)p)2$Z;$MwJNr{(B^d1%h>N7^-%m6*0CxoACy?v$1)|6KY3k8fb;}FjBgLAmV081 z2WmB*b{Dy12S)+TNBasym%p_85iE9BBQ^@|p{V2TjlQ+EDzELEG;E1xn=7)iiH0x; zCNAu@l|;|RdFS1tpK^QK)0 z*RK)Vv3xeU?D>&BmP6}z>*wfOHO@?dj;iKhx?E$pM=?WgS2SA$L!f8JTBZciv@CDu zR?yuf*U)*_biqqz$wI~FlA6kxS2~ZPwz-lRWGTpp$L0=qO}eTbCf9WxM~n1|&{Xpk zX4!2mWQz$Yv;MXRE##oFGDSjD-O;wMb}0NsREmgs58EF+yVM~yGoy?+hc23v2$b?I zt1kGdZ!h$+H8L%)XkKR$dM+Er$QGR|zBHUDX{OSKpcrTh85xV7!O)o>?(`w%ML9{G zTdt!fA!|qY7xu?3BTSvCa<|O*C)n~bs5C;eY9r=;|7vl`AHm4XJ;_#x{oQ&$z=2bj zDV2gPygQhx@XO*s@iF(W*~cm^P`1tb!brBwbjYGY4A+uPjlzMT&G@@-< zcP>}VbKR`~dpyx-6~U0{%26By8TG4lN~3m#j`I_bDU_$~PvG#I1ir98pCgx;KQrH; zPyW@ziXDpow&{Z3sHwNwSh?8}r~otzf%!n#OBYZMlM5+exY%x$BZ3=fYG1oWv3}k@ zXW*lID(QyQEheaftR$a)O0rOkKov+(eyC_E_rm$J0<pLk!pl%3kcCo2xM;86@`&4u z@`LeXb=G`EofN5C59+s_cCx))Uw@xd?QDoQcHYaRSe0y}+m#m!`oK9cE*n6znXy(E zeXvsg?!uKHioD23dMBO*0WA%q8skP$6{Ff9c8%Q5%*=LD0dL2y*0-Y253HYt!6RV^Z$n|!A*?Ly-OB|)&1=@zOSxHX4XWcE* zf;Z)MzCDJ(m{VqO5#pk(KjGht`ZMv3d}&ZnZeu&z zU_~aE8s<;J7(=!(nZ$wL0h++^c}$%ju;SAl2+vXl?bZSTV1I=!YHg;XW(ll8Z>^53 zt4NLaU=S7C0DK9J-4}0|?*6D5?V~qu`pri$aQ5hw*sDdzV#+^5$`|l+t=SDI*0S1| zCW_-pI<;)O8a#|ja1)E1yvm|^)Wvj_PI&QUqQF7&TU|8(Xj^Q4NmMyk-&f@Sb;=o3 z(XwQPq$Ui_8zlAflrY)$u@(VrRz(4>=10t zmaS$nFk7=QgTEyjnCQ{+ku1s)=k~Y)X(jNOA6NGt&IW^>Pwd}U?NGs;4};{jP(*+h zuNCAJk~3|6lGu-dYAiA`@Od@UsxB`{IyHVg?3o&`wUPSrEOqYjsB2CDOTBCvC?l=WK> zb-swPAVQVJjybOcCgwAHyV#&gN&Oj!h;%WyOj4gPLjpgOU_CL6VF7hm;Z}?CPg4ZpWKc1Geo-JO+K48^tSL6dJtcFm*o(huP4j|q0JQi>^QHZB8{z4=0 zG@dnawLibm{$PczkB2Gw_v;_8{U+2*f`#n{6x=B9c+&FkJyw0x+NhL^HmrT2KQ%2& z#vnRx60_`!ZX#KKZ+-mH=bBOd3>!c({N_~{^{qv!)&Byz5bML9Z{B2Bd8j$i8~{p8 zt=7T`X?LU>!94=?M@n#PZ-!J}r$?Q!z4roVtx@k!9>;SP4yjNRdw*VWF}J&FE*zd2 zsMq1U+BnrD9iP^DR2i0H7hi(witJiMd9{r{wlJ?~M$}Qt_n6ZvmUp zb)J<0f@H1=1`M55wMrM=6zSRb5eB$^hds~F;e6CZ%bo^v@TBfO5OG%TPA{R}e*6mUUVqD3hR&XkyW_V- z?cet#;xqEgL4xcidB7~2ZcOZ|m#GULtmLLjtgR5{RNmQAZ_YHziF($ddPoVwm|#2{ zcg4Ht5Q1v2_dMErDlE(L2P6O-nOR9^oY{FHX3p#ky7{VzBl#?|d_ zc#4Mz>cQa8@jM)+c{ z2%~u~Mz%q8(HV-%AgQPgX*YPbyETw7PLS}aOJ)P>M_)X|i%%OKv4Y`YkgcfLLP_kp zD#{(#?b5+7e!ZpVIR)<19>Fi6#q{Q%m!J9VTb3I%p6W>JXNV+0Td%a;>{?c34&(A7 z?D~kDvCo0lR)ore-rWzDl{=wv0Kpj){&|yUFXYezwsF&@(l2wwyDe3zK&Nk$&#@eS`|#s-`chAwi?9?S!ol0t_q%JTSZ&Xm-}X8rw9{ZLS^f3m zVWv{MEv6778v;M1eaDh-IhXX(6o51p07`Df#iHA5_2?;W-*>20Wpu<$^kzl}c+x>o zM$T^VR?$wV4HQF=kRegp%#fcw@_(efid%>`8Sl-g>rkJqua9`llGD4}8_Q|cyeJ?A z)IzxA`c3U$MpmjUS3F6Bnhf9vjf}tG%B|TbG~OMoRs5!(XC2**bmAzkPrEpvZe? z@uu>P!X@h_&@^6fh+fE-ok7$?uwpOQuLB4zx^||s`|5~a#5o@a{25Q@^8iepjWauh z+uD0Jk2yT5(Edut5Ef_VBNWcu3f!jp5qfq@%JM)P}`x z0i*^YFUDjk4|tAZxV-y%QnpkZNo|WU!-U5o8)vXxg{9*iKP6>d)h6m5YKr$x(bMq` zjfFxdC;S!W>~qeCtURFR=U+?e%bJP)X2#^xz#vvh0i9C2NRMAFEZr~?wDXCtv>)hM zA3Ycbza$1zH;(3u(Np+bS1uPqRBW1<>$2vQkQh!+7Z^2H6!t|0QPi0~J)VmYVq8S4 znC)DrAI1p`_@_--j0eYV>eW^JTJbVeXmhBfNQF;Lm)E`SNf@XOWo69kt76S@rSatA z_)-UksSVK?xW#*G_Y4~?_Q>C6R>a&SVlGTMWO`F)23=g0Bm{t0B%XL+?+;dVKvFQ* zl;7_Y$Uzf%D#h6_(gns{xo^vznO_&rNH65~)?LNa9egy|!#-$$;laCv~Q!A~4fS`F%tusTPfuq|SKWQahE`OGvc%&NoYdv%}<% zGLMRdpee6Awzjo(zV(-$U(i_uPbAPXT((&me4ph$@zlCg%t^lbDsN@-vfu#nX-*G# zg^K+pAhXBmDj4dx-eKR(XBb{YCbA2o-7-%gn~fDq`><7K3{#N`t>MoHD8cH(lvr-rYvplI0#V9ia(FDJUNq+Jp`o02@FUZ_ z$F_WU^^#`8elM~i@rnCt48wz=<_vb9;vCgvu0%cyKCM~kN1YNc^vb8lQ$Bvd@ekK3 zA&!UFR)+H%Tie_9@yfLqE59|LC0B^p%oTfRYt~}mRGK;RGM-MbAc(a_pqf7=m4!P= zxT*#Rq!heF?W-Jy^aXy?75SQ7I8?HFWK=SFTiBx#!Z7?InnzO1Ik>TaR1i%x%_mIB z?ZEc&GmR;8gP79XlrN@is>7HzMczhDZT-FufDYuMF>;Hvej`$&m5XZFW2kyfWWrlu zF!=e%$d(Q8Q*s4N_N47dRfH;0Z+jE$VZ{tP9#i0182XVQFTbJkVpaTQRqp7(kpU8{tdZX5UlAQr-Tax}6cdKgw^(`ysE#!j~SMbQ2 z_dn{x-V_*Yr4TYOJJI@`7l3AnX z@#14L4|2bp>_*spZ?|nXv4s$5LT8SL<@L2g2W& z7yIX7pI{pR{NL{S5JWr*A^2{Nl?}OGuN-(MZ0vsPHWIqwzA~MQurk6aRc<}P3EfK^ z^`F3sCa5^mc@CaU=d(iEcbKB9X2mx%${4uWX=_#{s-oRi`)3%BR)DKd_V)fopxJ1! zjhD$1!mrYVlzV>p0TL;$EhH<+-FnSkirC7Ded72PvQEdQ3DUp{lP3#bjHr0paeib{G-%~j=68g0X;=a6?XCAgSno( zopIdB8ccwXCW3t!8dl1j&DZ_dCgMxFxCJ--bKK;*<4a>e#KZ0t>4o*Fq$h66U#C!w z@f2+R7AJ`4A|AGxy5vZ2@AJzbM0_OahsxZ;$B!QmBA_NV{b@lIuEUayCz*-qrRO@^ zxGh?NuLw5;BDt~A6yht86B9Gbbmm7<;p3E`K1miJ`7Wpxb-#nfBUOF~r&KzJLlb{u zLk9f>HwV8yl>lp->#Y(d?3|v2T-DtYhjMXF)XE89a4?cr=l*QdH>8-e-Y#YYU#}DR zK)oE1Wa7PYVJm_IGt3mG?jSg)<5cIu?Q?i3{a_)wgtE;@*QcOr6gOKJG9e7%`Tka-q4-0VJ-cjHpH`iH2_XS((#@fV^2XMa4=b zyNT13HLFA_U0#vF5}DYW%ue)CM+4BRSYm^~Pdu6|`#x;d<(86o?Jyq}G_{ZlJ$CLR zg#nr8nhNP5INc-=U6whPLd2Y`XmPSa`mlZg+ePN5vIY)=Hj2`4DeSBdDSIU>t0Uti zCo3H-Je!BiIedEsNAt9ENh%g^S4l_4acQ%WDqlI+Zm26?4`AWLw2j9(6s=Dp(3_tt zJ*Gt~f(dnYC?32<{>S&GK&;K~EdBy@oWh&BG=oCw z!$dtPl%;CzP>x~)Yhq5km6#8m(J9pc(b%*)Qh1*~N3{%Lj`A(K7kHIM>LeZ8CrSKXkq6|!knU)6mfJ-yGwZDm>Tg`8kO)h7 z`Ue~&b;e(lf|)0_5>Ql2Hm-Yii(ZN#^N1PFV9=PtfhJ_u!jp#tR zYjFBet=DpDKE%-WD567fHKbt*winY(C&RN!T$jQ<#AVI-iuJ307iBoV3$3 zj~>;FYl_GN=|2e0NJeEP;%DeyW0gve8{(jwdssRP!+iFsZ|juP{GSmDoyP zxOmz6PS$tmokKDsbCAA3PJb&+1s}w|GBpYjp$cSDU=mr+nV781n=Wry4VOUJoXLf< zmFcF(n}=L><(MXS0Di|iihQvvR--FU`332+9{Ud^ms!Sv1~j?LCC$61Xeci2pP!wb zeUMqY8QNo;OG3Z{Y)!e#NZ|H>T&kCBq_Eh=Kt&B9^Y8?T7Em4xKiA5s2pTsXDTtMU zS~~=Xo0VRMm+*SPBnBJt7n)dm`GP7+>Q@!SX<;dCy*uuI`B3Pt%BF`eMcbTd)3+{%#)m;=I^lpk^@sO^(LeEnd}!8*T$x^j}Q!( zm0+ZHm2(krjUc`1R{=HA{aKwFGQ?+8jk(zLkVVF;RlUPSrH12^k$Hx7?~%`Z44t>O zQd;oe>Oo6A-cJR}rdUn*o~yP%t(2sCxj2nh-K_ZeOJReSeP0|crTuKxdW;VDyqlx% zXv802z#D3s=^40VcPHsw+{QGo*m2E}M)6bGp#FjifA1 zIlCPw+OB*^$2gIfiOYb;!~i|8iJ3L+00SJHYMRdEK8DIuP6#LDCh$c0^D>WC;q+?C z^@Py}(9`((Nr10^elJXMq{N6*kA`2@cR9{h>-FZ8H_}6p)asUqNUZ#q--r&?-hHh+ zX$;Yn2|g6I@+FHTX#sJxt=6ki*|c0G^JT+E{fVbDd0f`6D6`fB8T5kPmmVVl=U){R zxlgoMk<<=7JxstQ?raMwN3%Os$g<`4pv5qXMJ&TE*DL1f#=w=$h9 zNn1x;;NNv3t|o5UBZR|LMS#}4xlwUjSzHZQxFtm>;g>OQCNSQyw%kCQ2z=cPAk`j} zWoYe*IpN6AVxeC9FI~qxrd-x*JDw9Ot<{wno^Nc%aX(`nbknx{6I%HB1rU13h$}d) z@{go;5u2^cYn;vH#z)wQBJ8QYhxuH(U;9_qumCldZBgh^{^px6IE~&RVc4_m7zea= z<^itFOOdYYrZbc$-r_v=6E~L)a|`Dzb0>79Z#dO{qu*gS7@fqZ^_g_z&;(Ox5)>;@ zf{2Kagm!I%(B5kGC2eW9kL^y`4 z+_(e`eeXo}T%L_f%f3xlmz6?~aw>}4gZh6*@!#z_G@=;5Kr3_S$ z$rUP&pZOD;V$h1;@2>JZiUw$CW_g9Wbv~z`OUX`6*WrgaG?>D5Aq2>LB4G&c>J^M` zHcq;!VJ2MF@&gbeBy@fPMd-oa0}R={nWyKks~%7OV$&Vc*vfsUb+H)EY^SXX`8d{( z@&rVZ>Y0|@17vI`5y^Etgtx~d-3mH@v>t4e4kYu|#-VX3AMRQnAFZh#KrqIAgPZ~4 zyx!Y}i#8O!p&pb4PVR1xW#rZY=~fUx9oo+nf<`b=vKs?3}*cC=WZ zbUKif!K6BBPtbNsDaG5Pd`LFBY360F|Fzo!ngTBpPk868=5Hj(L(z1GYrM71V5i0I zc+^mP&-x65q=&b6ITBaFl+pq_blXHNz>s!~lz&uJEON#<&s zKM=~zP&uGRb`~YdjyVo+2=j`00mP$Y@?!!w4H|viU-#t6&4=_!?!B=wf$<`ax=KP8 zjf#j81RxM!ANO;yY*+PqrUDBtLPQat2$Y$&htf*GaUDg~j)W28CePFw6Bq&}bY&FO zXDsp^3M3GWFA|0%qps34utMA-c@8nJJreApJ)Qe-!kN{f)2;P1h=0H1n*W$uFt|;7*^wq7OMzxI3?zRPY_TRmnS!UH8r<^3% zs3-s=H!dEEZfHaHBd^{0oyPCPdIX9AdGjG@VKbGNck3Jp@n=IuOVK~`;d>MJkPW2Z znM%I|0+6ifUX75XcCeFOdmJWkccgLj0D|w;QO8c$DOVBdzB8Y!X@#6RU-#iIX;+XzH8hQ!ya9l z{i6?YG@Gxu3R%@VKqr!1BupE6GC=1ap&zT#8v{zbkz zOV*e>NM_+}J+{I(-EcIqQk>_VM^^}G9??1uZcID5?@8+Jdc&GQ1A0)WV2 zz!NRc9Z1HoS5(d!{M1IA{>5Twdj}Qd)nX}%^SSoB|8j@G&>1k}tQo)-up?xd# z08qGSFKezjS?%Px=zb4++Jl*gOo^|CuLeDXQ?xXxvvJfiO?v#)KBL97+l zfK@a(nyOS@&Gi@^@-J2LCWHz1W)Zk-eFY8Wk^i8Bi0tCn*J`O^4A-_oct^WFUN^ZQ z?g>!*s(@6BtJnYy+nn_WN){s{Bn=%q^iaA8COs>H-z*%{Kyuyo2vW4$2y)-9_{Brs z{l|df>`CH10gpROm=oq(N3Ja8><{g4#CNh?oHvfv+BFbR1~Jsq?+ zE$Xq3J;Nhf3L$CPRU8n~2X3Zi=WRSHsH}&#tpqv6p!jO)YDY*p^p4lEr;8HR2RA3 zSL780K9lwA!qu)`;pt_rh}ZWfY6HhT)X|va-Tmi(v<`qcxy1XX{nnw;n{OY=ecZoW zKNg*?cHrzIpWN*)f8Dz(@;y^7Vq!H`*O!Inc8okisdao6iF<8U{B|^|1-d1uxgTk^f@$# z5X!2LAI%uWae3=7GKf4=3M5l*(%BiENMR~*nyhc5yZbNzT=jK`30f{&@3Aspd9Vq` zoI@f^znw$65L-cPs)vQ|kTg3Nq6H$;l3w?ve4bj%j6ivfa=$!s``MzAc#dDD_(2Ft zPkv|$^a(SKf0`)hnlz7uO^yc`CkM)gVjnCHeE?*Z9ux1AYFFCnUjr02_*HL`YPS5G z7;Nz{;7Bd|`Bt(-2u~wco$~-lVZb~*f+IjIGcRD##O-v>pp^WO#R{{w?L7|yL!X<0gMN*ITQs0W$3DQq ze|8o$dz5~XOh_5s@j$oaq?1B9wF(}l>Y^iae9atGBfe33 z-jmkIOb?9%!S_0XTHf&i&pJrMe+3-M5` zj0_`%*@|z+w1XHF-j@dW2%>_d$&W%?NN~$&KTfTJDiTR|*F<)#L>(zM z4(zxTFjZA{6tnGi2;HTF>6YB5qy!fguFDj3;NkOOya+y!Y4Kujl7cqciSsBd19Fmy zqvqDvB)hXO9nL6WNnnTt6s%*N1Z;vpIR5vKm)cgX*~q)A&EY^R7l}3!_q5u~j_|I> zYj>_vaXbJPDm)X&LU7Z$3d>wHPZr-=`6ODBJt0Er3#SkWBDnRV;Sz} z+3yk_YCcRygjMtlraN~8YpZ`3Eb+vw70WtEw;NJ$(OA-z9Zv%nSj0HxBp9y zT_39tt~=y1sQzBzsL%t@nql$>HTeNEwRrbNfQITj^8%2^Q+p0RB_4`GkM^Ba-GR8J z(J8|lff*O!|Fc;D5c%l^H{ZmuG)46^_2?0sC>GCrbXr*`t(dW7^{wy4hP&yZbP_5) zxRoWxd$F9U#%v}tz9~MimEi+MZ}V@@yd5X5txP&eHE+M60$2$eWnGWu{=44$kuNiN z7p7&PZ%P)@Z$`YRyP}mP+pDkMCu+?9ES!{8;Bi8elxMuS_x9NR#afaZNp1>#in#2{ z%_%;Ida8V&joQyKfWQW{aYGP{yz23+5Flt}NXh6{C9jF;ro%2Pb$&VU<+p)09V{An zJZmKqFwhhqVkj%G+eHJngWrKnRVGIrZEY7q2eY~fPtO!9=JS0;;EwlK*TP&3it7Pc zp!r_oBj-U)KpPa)0~713=;ncmDL8U|Gd62OuPnssm{imh-j}tx_bu>a#I?F0`r_Ab zH@ANPLin?>s>c!@7cc-lUJmETzp6B>S5I@R~vAcT4n=Rf`f2<%hfD`)kc1}bK7t;1O9UqKni#`da>ex0Q{u(gS7Y*rB-U!Jrcf$tf-l7F_6!e} zGgbeQu=eP=PW4I*O`PqfBw)V(kdy5O?siz`V7OUqP_wBHS0TyQ%&wo(Y^Ypre0mBs zT*-D)PBf=3U-zB-|MB*fQFSd_)(L@N!7T(Q!GgQHySoO0yE`WkoB+YyJ-E9BcXxMp zcfOr_U-!88b@IOM9xpw{`LU1f+Euk`)si_^sR4WN!?#B`Y=(C_R?)3K#nw!Yk2j0g zQBBg5-)$JO(Tg%GuN7i_^ap)2YJ#8 zW-yvjgT$J_n~VvT`1)8D^$GwQS(P3~wSt8$rk9u97TM|36%3j$R}GfU6c8P#N!YP6 z801gE3pU@T&)mYM^2Igh=-(%gm&VZ;;6$9HZhrUbI+9#jicGsH(XiZ*&LSf5?24op z%ecd*5+$QEoJ*yyKLpxE>K!J%W3?Hsow?+Bj7q?zDu6+#vE7nl&sM25fy)EXv*USF z!+4XKyhQJ`Gq?J#24#ri_s@OAivrKIE4(tW=l5Z2>DA}H=T$m_w#_;QP9xjnGp(wGy zu~fe=+Tlpa<>HV;-Q%|BQ2uf-{EFiNR58>AH>G`KY-wOosLGGKJ)wF3U=IAs^oo-9 zfX_XeY>hKyM6Z+m0c7_q*_pa=Uv;9PYY6Zyu9u>!E#`O^0oc|<2$1u2?FEovPLq?(eF(Rji6qpBa@kq0q2WVqpVB%bBu$oZK^kVH~nws zO{R(#8~`Qv!}qHX{roe?)*neM&tWiH+R|{^^VN0god+I-oAn6BLEnnEp~O04%`zK@ z=sBR&BF`egRAA>0oV<*Goo`som8JxzUhMhe0agicI(cl?YudFGnk{gg4=R}x4FJp! zi6xbr_zyblWTE!aj&~;YbY+HTbQ(WokEWzL+n&#ycG7HRqJwDMYk)?(tz9zOq=_Y6 ziCg@VOkyMi`x0;rgjL%=f)RQ+RV1_eWT^V5;cd+fA z88FHhwO2&`{sp8H%5z^6^*mh&U`-zmz71Q{n<>+eSVTCFBuR1UTx=k=X=oF>&w8E% zq!`C`N^~w4YHcB1>1JIeltV7-7Uv4{DM}APmGm2D)RTdaKJO9Ecagq2Q7X(?T?hug zvl}0CXcOij#8Y2_6^6%yt_NKJ*xye{*JEbdpRH~&3cSU(4QJtTIELSdn%3HCp1WMQ zT7B(LI&0tzSJXBIFJUrgkKep>3?{}OaQIO5>62#RoMi+6PoFlws57zQkheoEfkCsR zEhoF3X&39yO}d%SlJA0FMHsJ*Nic4lx?nf`LE3o#;6bXDUVu|DUuU1cRWFGZdlU&M zqB)B~V+T{vuH)4OGkQ#!es6cDWCF)k8q@GdryVMzyMu(4LUAbZQN!b{Zkf%-w@+)f zM?B4M(Hm-qYpd$|-@UV|hGkl)yI6356gV?8B5aw`0`dQ#1WS8KX)3=MwBMUYGNT{= zdFp`Y4I(}j8V5YOxyJiZ@i$Z<9jNW&C6F_j@fHWBgvqM&ft%;=W&B%MjE1!N$e!2C-e$g7zHj4-Pm09cY+Z-ONg2W75Ef)k!JT`2XgD7YY8YuE>lKQXCJvoei^c#} zJ@a)w*yfnp{rlx-?r8BGQhEq!VgbkhYZ8;DuNcQ&o!t$KPbvXk z-!?WMz`!uvASJOYNzIE$iL$a*Sg1(ux>w#3Jrt)7wvk?(kfT4$7CxQ6rcIwBQGmw4 z0sxKZCfZ@+Q^m^6M&&xRXY@GL0hjlT7EJE(%pu!cc~+Z;4q;M`+ryJ%6+lQh`NoPK z;7Kr=yyL{p?V>q}BYClE%XS?H;O`$F(?9mC)``^xLSF7$Hz!Gqa2yEh*mC7f^PmOeiUlXN{Z#_Q?}z!L^MMK#eEDd+Fd3*@roctGgo znh)3)+ii!cBhR(u%8WqRI4#}Uy;0;?EOe;b4y{?TEw+cD6DkJn`J&T1XhifCf${V`@zvs}mcHVIt;!79z zB5Ekim8NrQ*(yo&gX~8fLn8+LPA-dX@jme~W{>1&nKIwKvU?9HGP$u+7)|R)cq5wp z@o3$0C6dqWhGh@!pIjQqqZ>(>Ro@QQ_Z3!8e#O`vd?gZ_W!@V_`F4ooqQ(fBfuTk>MmrCEJ7Ajp+GS-}qHn8#z z3F0uy>gkGJ-p{?NTZ4K}|FK)AzOm7Ww>v~~R@QKKT$FC_#@Obh1B0Ya@nBi6_s7Pg zTzJQiB2ZWC`FQM6S~-NxY7?7%Y3Tb3de5YTpC58=iuVW(G_r0f&B3LW>~d;N!V{V3 zN|84;;m$EDDw^`5F_gh*gG<>w=PJ+vTm60#ivR_(u6m1U{PxS1v!=vcfol2eRXR6P zl0)+DM7e7^Zv*cOJXAQN8~2Or3oduVlZ4BhnUtq7cRZz%B4cH3+3{=ZLLO&UpQ6D_Z;Ch2?7n7!hZ^QHCk?fu6;ugw9M~IL3E#r$1Ii@bX6MB89 zHb#Z{LNEMkUP{P2rCgcTt9Zi>eEQ4E61M3b$CRgAQ`-ZLo83NYu`MZ_#LA3D?F*OY zi_JY`inO#tb#^BA8k@W=*JjZOq4b`27xVLi&D{3tKX|wGv-Iu*jLLn&cvKjYh`9mO z7wl<25T<)Tsfb;z8vuYDKBeu-im#e(obmLa)@TwJNhv?8a1!wIY=g1F58xkc#C(lH z=1IOu2?%elp-66~+PhIVy;9{*g;~jyvo~CPP9Y~0;*j?R~x%E%!Tc#71gfkGca%!L zu9#_f$a`V#Lta`+o7{ovezN5Yw>vYX)U19{H(9FdwIXI#aAk-m3dC}PA$Kb^4IYv+ z^!yxn5sD?^Y#$%;r#c*;?3$C^C_w^f%E`Z zfisV#83L4F26G4?&K+lHpV%LV^5k;_R@c@xK58`VPrLJ+Z>@E}kTi57)cTO3|Hyz{ z-Zv@Jsc}zF;-#8)C5iL`Trf)EP+Zts{vDA?X7kIVr?%O_5&sCChl?p$pin_5cKIbJ zYl8MiaR>wX58MbiZ13tFk4jNCG=T$g3D~>5XGN;-T)I~~j#z@0)XTczb++wiOZ9Sq zII`rAssx74HPH5RPhB3h(`6y!bB&y~RBAcg0?p%MuX32BP0$X8D?v{l;h@9)Lq{j(6aX9N<`SrD9W@pWFs8 z`UO)8-EK|;9UfW7HinuX!;>Z-Tt8I7{viH|&L*93+Fkok)b6>Fsid}GHX>X!EtPLM z29&b3XxQ|0gp(UeojCeJJAmC4xXMdj+{>M@LOYlp)&c3Yu3M@{O~B`Q7r#wC>WUwK zcX55PcG(24HspIq0^k%5`JrPc4K)rBa5+e4jmbw{&!$WDF0Z_rQC197Km?M9CM)~G zpS%0GR95@zN$jw07Yb8uaS}*|^e3+zk3U8oUi_32z_Z*;T;kkE#h$EyZwXH>DqZmK zsK5^ieI!_jKi-@M9?Tyw{p9~L%U|55Nj=>eGGCp(6#D?%P7u{PZ&-L;^K>*cs&cns!wKJ3;iC| z=5rPujMV<`L;eVc+)03vcWNXnwu-y5rquQ1j9Eia0l>)sD2QS3(eEMw{DHDtaHd?` z6YM7GoyYgXh;wv=@h1?gQHLU^dNu!ci5zE|y3}*tD~Z|uXA(aGEr1-u)~LTK8wMqO z1}{@>s!QLV@d)Q71uZozLw#6nXP|3U$?oA+( zPCweZ@ZfaVw*!$~J*IdVq<;bJL+9)!7bR@~jE$rlde)Qq3QW4wu#rJ32C~f`sOHT! zNu&7#K)6tG?A|NjB^a&#@DcD1U#t55d^3Q`H1rf%m7N^&Z$lrDw4X$|_2DE$X9G(^ zzGa1r{iAqE3B(V~H$b8q5Ieu|tHggtO0r|MXt``93-6pc)nYq*g>CKUi3M zmQ;$x?z?k#zud9*Jj75jlo$d{TyJW@i+-$X}9`VgD^Kbts z3FFB?#lt}ptc?$k@C!7v$P2L2(o!4SlZ1638p0+#R^?9OdfN(1Z54hW=cA_Ftffis zD#W#Z#-umw$w~1b27t>i*%&>SfPf&iCY$5e z`C407<&W^c7;qkZT~DA;jMJ(zu%`q$Y5s$Z{T2K9s%OuLp5{;GdNlOeN$$CA;pl4E z?gPDTCxbJPHPauQ$IxHPmedWu0ccG!foSzoVlh-?0BtNnB91QUM1C5mD^ZScuq0PF zOPMYTNnO8Bmy`U9g#&<&ZTWe+tOIVAPC!ygY(&U-c+@0otNLAsFVffQQOOgJ=2^rC z|A4tIbCVojErHaZG}(zTG`?PNJ02#|{8ShW`E|~sH61wecown43HS>DN=zV*(k zS#M}Bvooy#bb)7j8_6lH(Yv{f_m8go%K^(Y(yHJm>LimN&?Is>(m_rNYz+CkH1f;LQv5zgnxw^_-Yu0Lbn{X=8?N@{+n%Qc{%^@ZOrqW>MH^NOJMx2g1S$Bj;#B|_V@ELdjIOj ziSC})*Ydzlbhp2c^zWFFUk@*SBW!zDSHv)NqqaZ@-tTQ|c^?)~0O7+&`{m`rzkRw8 zQBe5#n$JCuSUrAoTjkVJkF*pG3ADFK1@n{z`%Udme$u1;amh05}8n|6;nvk^Ci-7Rr==uT(q-A1&t5m=`5T z)4px=z-Il;1Na^q;1-7uQ%CL3Q2yqo*wFohiPE&$n%uD2esfbM&;Tn~)Xd}{@!^-z z&3_i#pMswM|6=-83qn^<7g$+Z)VN*0#JK-2Z~jkz`|1LgQ=r+Ey?8i7|9eO98Q6~U zCvT6Pt6A%RSmOVt;rgc@0dMo(A)>tH<7-xEHLU)Nx%4~Q+fl|RCXW8mt<&G%Eue-7 zhA?0Ac&lOa@9vg5K9f5hm+)`a>z`U?F#H1okdSYa+#N6d|Nl$lzs~i4e;~dN0?SHI zbUS9Sn85EhckC++0CV^ufmVhw|NSTYU-fQBV|l%Y1+WIsOuJWpvo)CM#Uml{3i?6r zdy?jF)`FR~&&gBppdUtW7}t+~vneCTi_i6l`hV0dPoP%K|J7_g1N!v*w@+0f7Fg+4 zr?D0KZ_bT`TsC)y-3d4?L!jrb3Fg0Zu(jU0aS24*lQd4 zl_UPg)9z>jyd9TjFKq6AwbcSQTV0ce08WOfLP*H?RiNol-&Mr?IU85jC7RCDzZ#Af z5I>Lv1Ff;yM*pjy@t8orW5z}M!+{vDbK1xFy*?QJ1I!;j81;h|R|xiRZmSYpSNDfW zrFQ+l>(=AYqVqE)S$+5W%rHKeqpx4R!-ri_P|-?W1QvNjSALkPEK1KWGF6`{o2*O? zLPL|$zcolX#boH(@_PeMqn>$?xMWKQC&%pj&uMo*k7l+t#!^K%yKAZ06WbU^+ zVBhld<%?SrS(!z7n_Z7wy*W5thhc}Fl7Q4=ZuDEQ|5n?V$k%&qSMsW=tmcai0|pTU ztt1^6z_tPY?|LQr@z~l%tU=$F#xCtyHi)OVKW5F4PmGVh6MR(Jwj4CS8tyt<%J6WH z7?>0!hWhjj>QhS`(J+4U3@chkeV7QaUu>PMc{Rug$>)ys91Vd;SIWnG}x zQ(hr(wnPnb%`8ew*1i8sHr|z@`+{G9WBnXqoZhZ;Ef}t%p41P<^nG4UcHq2*W;qs^tP|nBkS9 z##T%`EMCfHPG8TklF>%pbGj!6LVkhxs|b1);SZPRAT-{do-ten7#eN#GNL1}nv7ey z>~w&>R#%_7;gv)23q!aDo{?s-q=fi8*Lh{=kJ2TB{1ML-UbO1vft(UU3M!W(FPFGK zcU%qeuv&I4aldGAnFY}#jjz{!yQsZu=a3{q3#^q$9tuLYWej`d9cQOW?7ZB~M-gW? z=&VbWU{g?)5ELd~*YIi1VHOOyX|P)2d4rO|x6(?oYL>R^MEPKC#T+%EC?Dojg&N3; zjY~fA{QD>ZP2&-bAwS`PVsdq_%8CSsWs(hPi_yPW!R*kaXWx$XDxd4&MSpl~^zObC;t~3ix3{)tz9#N|UU}>&qI;FV6T7 zzgP&vv|vR=7V9<*O`eRWxwW-%ZxZ6kic2(bi5OYy^n}?ZE4P4!)_8ZwQEr$(zeQZP zdMds%e?}$S*Ax;#-Sn>zNKu-%>BT02ZuWU#B$^@ zBc<7C2Yr`*6*6=ND)y3y_ukW4#yaR*0A)xV@(Ug1sJ@G6r;u6`$j?nH{>|(419AD= zSIByACn`i7jd5X@pwZP~;A1Nb{Sw$Ek=9xC9xSjn~NEe69 zYLn@1j`H%c?NvimqqGyhn>jojfym=o$s$ET=zg}_ZeB}lDc7Cr>GYdJYS$elcl;aeCDGHIVY*k0lT?*araK?AeA+(&bK_sDO>Kj6v80PyKX-5Xk+ef=pSK15d4K*J6fcCnSje2^2%{nJt6*A` zdFDQbeBie2J#UlMe5T z^O;=ZbqGr6CPcxN%qYh{tR&@;wb?bxG*t?YhC79~$QcQk^cTU7_elud7%3_|#e8u?G{ne=eA`UFY+7u~?54Ehfuv>QK_X zk~kut^(?#6B}C)$&QtSz;P8S;QinHtu2UjI%ku-%9-E2JlZC33I;B5w@QbeObnTW# z+Q6vh{mh2;SXjJRf&*O84nOlN?k)pP;lks!MM_=SbEW#aC2gqoMJ|InO?#ZuQNILG z1UGs~&QV_234`Idg6lW7k4e=XhC5nVDOrIZFwU_E(ESkd2-9@{Mvu2sJe zy#oK6+S;b@3}N|pj=w#ns%3Pf0)BXN_yBKzeIahKBjYYypkccjd;NHmx1iaq<@SVq z2)@M4PN&>?p zsOlksUt{Vv%g-kG8B`)6*yVNBs~q3dC9*nj7BgnTPtJ;KLC^7`X%VEplZ+%oA7bed z|Imk4CP7X!OKvBl+^%hBV?{(-a{$TW=VnSO9&pnPGw9pO3WkXMw*+Kll=2<-HA{FN z$4m<@eQ-j==f}sX%Gw^uD*MvV5Pq;xq?h2Z`ar~l!sQd zN~g_%eKemq*~ldG>0m~rVOq4Q+}(l;&^H+&{$7NbOgb-pexx783#9rx4M>ANth)rSI&RH~>j zcl$_ZdTTehF3ua(b?Yrcg)FfaF|l}4`f2sdlWs$@n!e1F_d38QSVLg`Anf@nAaP_jjFM$Zc-)3f-SVmo4SiSmS`#8GE6(LF)I7_&C;l(%$3b>R($i~On zMCds-+rgWJ1MP;Etq&_@dch=Yw!Ich4j|(Xew!xK_=c~^aVo>KUv^MjU|(x(`^Vyy zZ*OyM`QNj#DNT1q7_a%84IBPV3jfI(rV(ELxG5r?9b9YcIMom`n6tOw2azIh7v@5D z)zVX84B9+Q_s*jOe*LdMW*Lj*~AGjyAUvwM>>rzFE?1@3ckek42o#s~$ z+40g_&O*?deT2>6s(U>yTN0bAk&8J(%p`wyW@T%G-y@mJP6g^syl=B0);M z3X;sOX+ea!IEfhw+&|Urecz+J=T5O0!hDrT-mT4{e1Uu!g*trtf<3q&6LBO+t~H%( zdM-x8JJB@@v28(J1K;}|KJVhX3nH!Qah#k+W5D*jn}GK5=8b9Fjk}*Lp9~98U~|U% zU6UQ14kR)}H41R~s1lI!5M?0{wCU=J~@Nc);inG9bCmxSG>L2FCR*;4doPh^zd*P z7m7OMS=MnzI>8QNI!^2#js?GIj5u@FGEnDbI-ualRa#@>P!4;IowvC|rn`4%Sato_ zv(yn2c$9K6dz6BSWqo9TO1U?6S8CEvRT-J^!nb{rBr_8?ebu#ha@L?8Jdk{T@I4 zy{k+P%i^genfTjx`zP8vGbEmO*$){|SCX#8OZsMXy%k$cGdZ@}$w-Lr{%XVg^?ILp zd3RUG%Y#BL%{wuX!^Fgdkf~LJl*|}K;PiNS3*l*CCb)r~A3vuoGbz`i zrJn?;J$>W=hX*sx_Q9VF74Nm!2fk0a_bPBvQxn4&>`GXrIv&-*$p$|pK3mVLqt+lh zBs!hlOr75r<=}m97PVthx*o}HR&9R>rq(DZGb5q+GR6GXW$F#%0Fs9iAd8Oa51&7B zH6u|1F2|;&R`#U2J1IZa_M5!7&xcdm!8((C{1mWQZ7zmI8HlMmNG;tLxo+L&@Jw*4 zSE|M!=o`VS{89jed230sEk{OSFIMKXd1zj@BGz)Jsc>A_t@9i<}o03VJA>T7=ev5?RGu@MUY|Iz|F5Ki<6L_p*G)pISqtk-rq0yjrFlnN5 zG(Jtr9!dtwF`JBzFZc5epj9F3@5YZiF5_8IgL~yT7n&zu6tdKbU@U;y%Ign7CY6 zjcE5#c7F8D=iK9Xepe%tUKyD4-MmRb@W1=use91(k9T4_T`rF^B=wKWEURP$C9F@M zMy#D5FE_*FznrS5q%?y-_}OI@g!1!B#aGLqA+a8bp(XCIjt0e| zV}$pfTlSWyXLY?A+*>)mT|L2TYH3w~>u1NVG|gmQ;<)ImN;kH`cKVqV` zT8f+%NzU}*9+Sty7^^TK#r?}XTXmKC& z5Ls)YHE6vWm`!BTPOiP+2wa*{1uPmq5zoJGyZ^Zh+j&3RTd8%-{2o_?g@lytkd~ev z-lTc@R?}ez!Xz14^)?8RX(q1d9T{QkaW(*Tdim$So!CKTIXGJl6otMOv-p{sgDuGw`=b`fpaG7?EoeswPFLPAqR(9;l}NAZ1&6*7XZY>JiCT(yXA_U-i& zHOHbzzjV)*>p^zd*6><0s_exHTb#RyKYvr*F1t-NzDr?+eWbe&V)KNr?8(EI_WMXW zVh%=q{}IAl`&B=pn<#U_B{5Cm1-v2)6g~qi;>*J+ss7M2)n!WwH#*93s9SSXP{jH- ziguPL{vjHz;5A>`9wJ{iu5<#6+yOn6;5_@;!_djgLi<-aw1t);rbB&@t9AFqEA*KM z4dz$krpeQcfm=RIUxJy@KP&b+J$Fx87Ev4yJ>y<1OXNaIpLKzLx%$$S@PQwAvP#-8&DUhK9*5Tr)2VN|1$8CMOfFOu6hR0GpR#J|$1}9s^K$C( zOL=wi3l33J}-mFs2DQgA`GDxr^Fh?VZN- zbUe|}?HDj(1tYb;A_Z+lQ!^+lVmN#7Wr~w;<}kkJqETSs@*)$4lC#b=&&`>d@+dA$ z&v*J#G9kB(XF>5XmNK@X{EP! z3+5FJ{%{G!%f5L2I=$U?Ol{dPfT=_$PK*CjOsL?P$~^@We&i+gkmBC)8DDXlvP`bv z*eV!bZq93r%8Ra#NkC9CQqkagQKvNQ1;#sYRS%_DF6L0?WJIsHTWkyh&Icc;vXl<; z8FJDulg5kjBCFyhmwu$^SZq4H1vQWb5MzctVe#+9po2;$!S(;9(3j7_uYF|8i(^F- zm@L!w_pzgd`S_^Ckh$`KvqzAdKZ!w)WhV*q@_LR+N5#!BDW9~3iUZQjv%Bf)F%!b{ z4wlup0IOf=8L{@ zm;-ZAbb~D&=eWi=$h#p&w1UH-^huu3bH;~py*JnreK7fba1hrRf8R3yE*FXZ&+b(w zsjGG@`y@>hZix~Vrm12-ERY-u0gYH=X{t`WBwx7;LK zEJ-=gPQAU#=n3_=f%vQ64Ai!g8kq=_si~_QZM>TQFs?5+A4>0R9jOH9lf%Y4__Uej zR#|XF7JYCD47k{Yc4aAxLW#VLm`07OuSlS<*Z(x(pWY3s%x2GB9tZC6>&!9k$X3gKdJ$g&goG_x_83VHds5W)>E zQcOsP^fYPxqJjq_^W;X*Xsh5k_MO#mwI|7Hs?`rmyM0B1GXn_Z8u+H z>0}*cO$9K|K|~{FOjG@l5PHeux%fzj>;QLWEZF%(QO9!u{?8M0g}3e2`5P|p3%IQN zzp*kh^%gQYl(c@{5T>|fsc)Fpja!6)`6gBvA8D8|Z=wfD-k(oVKD+i!&t9qTLP5oT zzOHbPfyyRdj6!P`hT%kYms#^^i?dvP&Csr^|M-_#pnMRsvo1+vh!9(Sy?!Az+EhPxU0(#*JT+O1{#`a zmq$Z`g7bXYoi0?H@8WD!pN`9+pA-g&MLCOFm!7$C(}Jz*1Q>Cz?U|Y{j;h6dj$24O z+*DFc0p)$G<~mwPi(r+}H?>9NaFkV(-{6_FlT@BD=%1@FG~UB4wGXZ2PUo^I;FOo_ zlSrAk#eYWr*P;IB>lU`>W3{qlwesesf6l7%l=>qj*_`n}Oa=+On))BJd#U0QpkB{h z5Vh0cA^BB1;sw?mfSerD&52 zOmaIOZc=V`C6ZzMGIb#%#W?ioZk}Ljr@5p}KAJrutHKA>f-eL43`p6!rToe#N_Z!U zN}q#7DxsgqtOtq0EOU*qE%VzTSKe#XXJrXaDyzLd)eoLrtB&>ub8eXIoV|5>XN{k6 zW~0aNeo}m&A}>G^|0cJjj<53uPaQVuRI)uD*^97y!52T><=6r@k41?;%U*awYf~X| zv|Y<&lvK{C!s{DjEBhiYCy>;t$LG-Pv z4nYYe`H(h7xU`4Ts5R@_G>9XwZb*?OojbS8$)=cluKk{?fY43tBHL~Ht zns^x)I`8R~)Q4nO6V9&W1Dv#MaxKm9(P<>0Hcc0}u-`LlT_?Rkl0NY?hi#jywn|JS zrlpD2H_yqAHkdIUGxW?O$|iJ-KpyK}8tbCThI^sPB->@N_mK9*VlZZiUsfEmex4_f zTG+`Hi%9#>xuF_YTU{87xo{|H)n;SfcdY_flF5uR;zGke1x@=o=K#0lG1tAxLuq-E&Cn1yTdzc+>^NNsjNTP~| z6~+Nouc9Oi>0{MvMBM!B$}l&S4{hWAEb;Ml3iMPGDRaK1mMkwrPpVG71>4qs=zg;s zTfF3AraFTdBOC#zK33Sp{IPNZ0}p|?%aU@eV&m>;%p5d4>Gi^QEC|HBu0K+-PGF)I z5Em9(iZ#CzTy$-SeY)r^hS7)uRF%=Tn!(6GwNnVrXi$uh9 zKi^jslT*I)sh=DLT;*?)bMSLd4I74xV82+oe=K1ZtmoIIv)U)1#}l}XAZJJThRfDb zOVWWGqRnJm2*K_Bj_wAoH6SUFpIUHJ92@1(C}ze(%E@8uJF7$;=I{u04T8Q3KG{C( zcW-O@Fg008)F~_o^9xg=MHRXRs*tqY%R`PjEkPcWfhNjnO-4aM!q3KrjEl-QJtL#e zd1!=_6B+6Xjt2R>9Ejae2o1kP$B&O=QcBnuKB0CjK!>%z%w@7OOB+Ph46tiVMFMhg zun|o_%)?=1G`bDa*zm(#tBmi}c&+k|fv37AKj*_mPUr+}m{zQ0eg{|)wC?wKW0lCJ zWHHlMtp*yC>i#zm`m03Q6WB}xgbqjM_kssco%4<3+#H?zUc-2o=8AjPA0^zhvIb6`ls`WNYkmQMbt0xHm_;wbrqjeG*b#Y9^&gACppp_izXx5U8_0y{k%6~4uV-3yJ$tW2Mc_{Y8{8uo4Bi(NE=HYvW;)gUQ?mhf|{!}7+22B$upg3 zK-t;8T_a7Se7$HvEjPB&f_hOjEbn=lL8kASKKwPCXJr6o7sZ{IA2K$9+S@z(xJX4x zni-r>HJlrE;FIT}b(`R_`vUS6*C!M>xYH~JF^S$Ege$e-+$fv1Z(7>slFlE^}N*TF*c2krtSfqTs@TlWLSonjNOrOPPA#oIbY5*AN+6v|IA$dDw97bm0JFonVn61 z=H(Icl8KHk(TV?=C%s_m0(i5E)$wy`7JvVo^{*l`g#~4VV%&u2*#30p+j!{WNsV!p zUF>5g1hNe>Ig-QDs!px&rKki=a>VFN`U$GJZR!3m2v_YobQLt{D0`+;wUB)Tk6Nr~ znN~^5&uKOSsy*GS>kHwPaf#8lj#qIT!SN8JOFvOcQVfbIOWvAvz3*iSmmYb}yNVkS z?G@`Bl~qyvPP?!z?4IDpFB+7klCF`${K@(Sw7{JXk8V&likOS#h5(+m zNTGCBWF2k@Q0QV}v-UwM9Y&f#Y=9M(MgEl4=n}X6IUo6$>E2vh(4aIfAFOvXKQu>m zy-dTGcD3O<6LYJ~wMSmf;9cuCBr zyhm4G8RukQ{v!DbIG4-w;Qa&nZ1s4sTm_d`-g(lkxKB~Z?#MNkv!O`9(g6Ha;~{X? zpRc)RU?kEl59^S3uc``D?-x5AvM}`f4lrg-Ci|QCt}W~unt(wVP7q2K54~qt>fWUE zg0qZn-T#h4DkDr7YDO~G=HUJg94<!4At#L09a^xF0??I`iuLgfeSD+G3YdBbrSOCR#B8inXjHBd;by_wLn*Q0U5}?A93PQsdGfgZy{tEU+M< za-&?_Hp;gH`@i}}>a~P7H7zad z^bD4iAT1_1UQ<~^Q&W<$(jFBJbHpC9BkYGu(;@}-A&nsN-M!e|RdoPtp;lvvQ#qY9Q#FI1xQ5wG-&Nuwzi=1K*)ck` z2jAbF`5#Yi1rK&C&e~<~8}+C7;Jme>JNxExCE4Pq&*8fqL9_Xt>`xJ+HL#((8d%;2 zU;F$M4ZQpnd^yynyU$nZGfy>f%U-}daLBEtv^BN5np&=^nXqXH5-hj3&$YEfHH?ps z;Q1hk3xCn^k1>?qc$o_L6_I6d%R}H-EVAK>lVdAkG%_uw+^oMZd+vyTE2WB`zX!|3Bvg3h zS)LZw*H(x+1(Oxg?`P7cni+^LhSb_J)1HMI=V+l0>aUhoGag(?6z?Wzw+~DCs&H zMBOL^V1LqkB1n>Lv{;@)C0c+HZA^@&pe}Do78Oy+wM$(mtuGE^43^K63m=PHAEBV2 z7~h<7=kjtun)^I|aXX6RIM1i0rF9yot!S^nAt~1YQoE3;_kTLz*)-!1Mx~s84Bt*&lXHVolxywjVbI7JpH1h z?ibI+!S|Dt?a{f>-Bb>QVcd{^=v`U^ue(kFkTrXl(5B?>EY|lzUywngz;bt{O}wWS z_wU=#Gw{T~XZNxsjlvkLyw(m@Y`h7dmcXIavOd?AKv&>DAaMN>MmB86 z227pVH-Yw}O^WCG%C1yg7KDKqoT{GdMaCVmhC~|IBl;eT%kv-#NzpeF6C@$>9*TK_ zwt#^iXo2lq)M3MkdJRiZRqm`&<1AwkaAW;FsLldqC?In9HD|2Zh_BI;PJHB7A$z!s zNW%{rU-lMK4w1nGPIy<)Lo@uq(96~g4FeEAzDG-_wd(mK%NM(=u@HDe#^iT?j>1>` z@FUf%I6fgGA9TVuy~vAXSBU8J5i)m?-;(w)f-ij|)(FTJq3FtkHA5GrAdWQ3&*RZb zl{ke#e0GKKl~>hdoM2}3hZvQFfeAc^3-?NK45{b2x`MzS7e^oipBv>uEpc+Cg7msNw!omE17dFq#|%~fdX9_pv&fhjX`s+Klc120O3}Qe zxRb@@XXi8hqur2+k$v(yA^)fR;^wpg^{TMu6g&tBh&QT3H+>*&va{AUKI8eC5uuF* zR_kpU_yvcq2fJe(CNylSOst~jY<5Qs_ZOZKgu|-BQ5h7efyhJqq7lTyy-}vQRaJw8 z`K5ZoBl*P*JWZT%k2x1u|Btb+j*D{Z+ExT5BqSvSC8R;R8|m&wrMtV8PRXIWyK5*F zq`SMjyNB=Qc+Po_9-rs^{^2(xx&1UV3+86@yKjCQE0y`f|NE++l2dUci&U~!~>`hJ!p<%Vjt^X0G0PVaVPIK zm4SkqP4eV&C%0i{4dm(4m=AvfH3kbL5jWsJbf=0q-U>wSp6~XX(U|qN*oTI3uDMMf znRHbNl;*E3oVrn7Iv1DyaQpb0*cX;3r{a=WVjs7N=PUMYv)VlE9_}}^am#t)PUs+f zvF4Jsrp0-ElX07<5v5^~vd6Fwf4=f9R&Xr@c1Pn#5VG!_g|PCT$0RQYX5l85!^){Q z*7^5lXJyRpG-frbIwJ#*3Fm9(oWhcwt_~xO!-QVG3u?)1Rd|Ji$`2&i$}J9BQ=s7b zJzqR|*WP{*D@gw418|keQexi#yux8r5Jh09l8mgR56b0n1fGiJ+D+6e{s)8d$k|hs zi!&=<&?#GE&VpDD4%8iyqOip1@U<4cOT98sJ!ucJfG|1|X8E+smZ4Bl78j*Q#8bRt zMiU8l|A6L#nPVMeX+HGwQi4^*-P^GMWl1l9KbMM*_#AODXHZgwB?%orTgw#_nfx?Db~9;^{zatQffe@aQ{J2|7V_nl*0 z(#Xd`$U;^`?{>)qsmyd*aNE2_;xu+#qzr1Z&gE316eK|G?|pFi3C#e3%DxNt31&0r zn2Pk`Qqy}n76Sw~{&as9q%8iG0Yz7RXpX^SIhV#uKa>kPZ?BG%rf&+2ODrmdmq1k*e~Bj4d( zJ6fgO^dkUuxd-EJvl3d^<4zz_3JH1-XLz`IR+~>tRp{H!o~8g9vkJ1ZqO!8#QLz)# z9Y>-DAvxQ{w`ijyV?#{i8b%6ZF97#Gq|#=cW~$l^tMMEnJX;pDfd&xoqNpMpvq6~d zr*L|^JiKw&XT!-{aSAFbB5tT?dD_kBVxpqyt=?KIYirrb@B4~8vc0|MM!tO$=oM%^ zge`r?X@N(PZ@j`y*5b5Ane{~<^5wk$OvbTzuUz3q(^$;6ZTl&deKtv7!rJAocw4ti zlqVbBBe>mTrS};-HWWcXXL#`_Vx|C4Bh^G%{9ek0-Msk7r(f$u20|a)$O#^ZSK(sj za6WP;pY{jrV=pYzJ)Gs;hpxQO%f~LR9`nmO-?j*I+llnN>xzv!YoepEnnT~iT{f{e zSdBZs-lHT>Wf{NCWuA~v6b6zlskQceL7e$AC_g1!c|{UG@IVJFB%3Y!=u-&UG~izT z@yA-Ccy)9lb>OZ}B}KDoxvxL}QE20F$9Hsim=;8nC`9CooTb&cWY|CFR{4JU_0?vM zc2*I~yz8UhrW<;(`9?oX*SgQl<}-xH!@~>`sxJ|tG{ty1zU=RWmH~{UKMQmOzg?h8 zQUz@v_VZC(f%NDHL8FLai-_lN6$?ccD#7w$$e7l;hum{0{+zR1E3uYmR%yX7?()PI zu!8UTD`CIzz8q;sCgV+g@zDRWO5o#DlmSF9S|7tN@rhi!JF?Je$^=saXwK(3lb>E! z7JPb&0%QsUy+s8Zl8P5LH$@$0owhgGHFNrHE-YWoy070RaU&t!BRVcPM<=JDmdc0L z6*+!8!vKIccGkG!LR+{o(oB1`DIY%cN` zbMCLFg@o$KlmDqjrcoSFa(XXFZ)C?VQ_-P&p1o^)?qCBm%XD9*q~&qUBi9pleE|WN z$Xi<{Jdgu|#P#p4oJN|pwVhW-SvEf*L&V+WBMgUBmyIq;Uomd(Yz|d^{K(Jl-jM8g zi17#Kn+OM`l4$cfcRBH=fTN28CMM@fGpS7R8w1f(efRNSN3N7|xpuaL+w!XeT zzPweO^K5roIwT|n@Zb1=88^h*^UQq9J#MN|DayQ;moVjK=H|&$ps1!!bSxKZsKwr1 z>Zk;eu&U}4GFsY{kDoq~k+20kjy;K6Csi(16AwW|Wc<+j1|HV%PM{$PY%d>B3YJcR z-kJr2!b8N;^YTQS5{VgX2u4ToGd5z$a5(JIFCASd6{mKk6IuD5AnA5<$3!d32ns$& zd_nJ@o=!MDsz_hkJd^V1qsi!?@g!+7?drBZPLw-Cd+Y|;WHS(f?=oIbWDqS^+%hzy zq^8bz!C@Z`_VY{hD=I3=n8kJ>V_*mZD#b(|-|%AsWfU3m#p=zn6I#Njr=+@&z9evG zQB_|oT}G~fG(owagPtCS*-WKRU|{HHFqosQRd9GimZ+!ib}hiFLi$7;yJmEh$vRPA ze=nz_!xCqpImOi~SXP+h^TFX^_Qiz?fQqsXm%n#xUyjVD?6*9V!GPvX1*0wW*JvEF zy{8ODPkDC0H<|8j{g*SH($ebvFiKfb49HCx6{4&dCg*+=CDg_zsO$s{VBLmO+`Tv4ij_4ILzng#GQWztrLx)ZoZSd0I5js*0Uw{#o2&n zAX6o6oF`lxhMcWb7+(Wu(%E)zn4ZgR%1H=F5mh)pH_*yVafc`tl?bZn?tXc)M@JcZ zwr$ZoJkx$xte|+#&CPu>6x2V^5&lhgF8%HNV2yZ_ayN^`oKS<6<4u{Ll-NK?{uUY6 z;R=u8?Um$~RWxirWz)gUFkoU{SE#t|r2+Qt5P7}POle@h%A;8l@Xc-eXKUgxPIMN( zHgg^rf{)9J`nj%IaDY+v*3NeQ{GX8TPT`iYqGNr*`-uYMS}xH>%+auEjZa#g&fp(% z47XT(c3yyh^MHPw#^FQze)tWb3un{$xwF^ri*0Z1lq2PYO{Tx>2v~Dk-mN#@y`H@W z31@!JaDMk}v2Lbj-qq*pw{Igm1}WDdSs)srCDCAYan&7`m6}35htQ;v+4rd63FfoC z?uvd+K2GUEL>|ZmLhto~&XSc28L4upq8VGe#m#Y*?Q|lpWW}ynh2!ei5^mXTNYjUC z9AO}{vZV};>T*x`YGs&~jAgt!mO#CJWg12)NOgHuYdzrDl}DELb<4U+ z2f@BDo%Pig)+$!!+N)p6D+inaI^_#3OtXRu&&wORB#-KapL0c0pFmX%eMb!nC41FK z<~QaKdK0!ktNkxmu?3)IgumPi6i`Qs$PQu}_Uh&6qu(Ki?9(DiKjQ{X)@71LSbU9_{0AQA0FgsUWgsa#)O}nc2 zArDNwWM=l&*QWdA8wAoL^BQir=Se#wu0h&P0ziJ>VYN6-a&ch3*+gxedE+jAesM9K zaR$aQ0z7<_S+-OX;dZIx!m@{p@5L@Zo-fi1;(lB-G?HOgq%2x;w@5uLVaOufP=a}# zJjOUKy)KI8Z4M=vD@|v+Ro!LL@Z6#kjKbkk!BNP*N`LS zr5bUgM?n{wHoLv~u>?U+`{JF*=_rvb8cu0|&eG!3-k~oz%!$`nKD5dJhUHRjBb3tp zc=z0PoC{f2Ts%mYL#pBQ>>4malTyi?;g6qgkWN<@7)E@#Rc^f*8hSiH0@C2^vRkT~ z0VdJ(a`>*bdLZP2nWwub zs^2lr+r9QJj5|%Q`|eGC7&NS>rw!Ufoe2xq^^CZE&?OrSwaQ;%p`1|9gaTYmrdE~8 zrn0(#3%{hF#p3~#rZ8ZeFR~Uu#vVLhXh)Obtba;|0OF1($YEKc0lxD$5}{gJS-o-)-g30`KjiOg$M=XguiJD6a3 z=S+T3L&^0i*#$x}N~QOHdyRT}^lgd8b4<+iF}`1tkpGcURZr<9>7+_JTP1m^8ij&q zHMCpzUd`B}?%qRgj)koD0{I;3y>@A8n$)}lmpcjCMs$nx}9ZkWNU&I5GX8a$R&x>++qr41yZu}@{an^O% z&UQFtJnwcmMm@;pPO{{7t#^7O6ubwzb=vds7-W#v+k{^;aXnLu78_fX@_c_hq(l*?-k z#g)(6sK@IGd!NTW+oz*!Ugxa~+^e-ZIL^zcMW^K%^mkl;`pUM*P;h+D7%9#0sKvAk z>^I&yg^QG+U4H*~Yz!m#lZ-upW)}pIB0peF-{>xY=q)|9^990C6dwOn5Rvopjr>K{ zP>^+QVX@lO^he^u7yW^q)O>#IT=DeDYjI zd&kG4EKE;i$ID~qMRM+Px@Bj3n_`hczOKp7GUJGw#N-sOlIheOZaIICL;!kyueQQ0 z+|t#xaL@`b;Ncbge~Fm@O71KgpWEmY$8dE9>FwI|UFYkX-nv1No-l^%^L=q-9>)?Y z?S>1E5AWGXOsA{mh5C~@2Ss@Mfb=J=yL0iAOM~N$Vh#(%e22~CxBF3VoKHl6^ahZY z^{d9)HOk7HntiZDPZ%;DK0crq+MTFa&%fG8TPeVI?aqRwfpi@EF3abfWRe)i%Z$={ z<*|#``;C0Z+>Qwqy1Du6VgOYXaoEg#grx|qM}_wwzQAA@7$_6~gU;YRkZ!baJY#)~ zC^Y`HGBoQ%52Q7+Hx>4rE^4n~8FLaCL#Q`0F=3cjH+$Jkt^R6TEarm-`I28^C#@sU zP`9o;5s3MjP7p6=-}Sid@MW+qm6pno>vo)~JT1-2YO9312S-vOsS2>gnCR&FF%=%7 zPT}YVN5@etB$ku%(%eE1A40@1|C70|De+G314T%vG#&dE!INPld5C)kC-E=hA{EMO z;3}SEG(9-?l~#{{?p}SBTV$qU{zTJw@(RP&`gehl@eD?Eh2Jw5^_$(faAt^!{1X-d zuSKAe4$1AZ&4drX5!^p418@TWco-}4LkD5{Xskr31bdppbZxT*pEzvnHB#{RFkDG| z{5@-{*W=5Uz_e521R|vWA{q~%W@C7bb_XN()D5QWS2Ei}U*rIV!CkNA`&sT{CIisg z^ZlqOD6(T?$>O9izglzHXAc8?uO;aQ2W|VpUJqa46 zZ8F3O!R4r*Jxp;~)VBR*H!hRH4ObovbF30vT<~p&Qa=`>TU;EM_fac?q>6<3eA6wX zDR2R|yuG!o`-8b}Hqbr{HY_Z>j9Xt{r}TkTy7kN$ppfgz<{kHOsjCw&1LW|@O@(xI zw=%s@2o6mfRJ5(|83PTt!}JvJA|)&uZ=0w%q9Vmb-B5eSDp+jRi)YIzg3!)(HiwH< zfiyl%+eOAJh+j%T+cUOeL@NE{vMTxe$YahQuX*t?gQ&NiI-R0mM?% z5VBKps_)g$5Ay(2s%WqoLai!A$-KAoaXtVNUeYgGWC9Nm6^?)Q`yZlguzK}f#IO%n z6LI-yce$(GgDAZ_Lq5r$3md&cQA9%gbAZ74Fo0l;D}W+D|KnTE#!=2+HP{r|MzC}q zgW2?Xt2NS%Y|LbA%pWRfGnN+zIx!BwQfO>ZsRY`Ee)zS18m%5dn6zb1yU8wRBpiMNcpr-gmNdNhELinZ0-NULS&2!FFAUJJ(e5AnFtZrWCwO4=5 zw*<1{JUw6E1V%crgrM^~6A2^bRJ;zo_mjl^=n_0?OZ|ba#_y|x8J@r|a=sm~xHw2- z)ab!7pR7-cq0xNJf@zAw;G9{=;Cg{#?XW*ZKB9GKg?atmCYEZWozPY+7AV^$x9@O; z9PjyA-$SbqRM*!@Ovw?E*JO&T?)~`Rf~4glB75MU;3zUj9-MJs5}p*z(*E#7NkZmzWKDp?qk zw+-2+fW6AA1dh<{85t#|GNPEcc=X2{IJm~qhC(H}>4{jwL;n2ZjrA0dtdeGkugb>o z@bF8i0wth){4deyhOGtH4@Q3?9WW`l%fUYulqYhl(_xxrm}?lQReSdA=VO29M+z{! zw;+^zWVAy-oeTH#?H-VY0wLoFgTq$jRu9!CPaJg~QO`Ao78BS@2_yRe$)!Jid^Q+B zMrYb6e<&7@%GB4e8!4U%2?;=R5~~~nrwi_T-fdpF5S`Esy!t_V)%x(OjMjkj>Q3DK zr6o!54ZHxfvIv$0PYMv@9d-Rx^!}q9Q#sIJcQ>Wmm=sAz--y`BW`559i%fNAxTV_u9F@apY0ET0$UrXsr8<*qUl_K^9am3S{E=k z=PpvK5^C}fhT z+el~RUpJp!=q~^bHULnxj@R>FtdI+oIZg3bZKjwtGl(ShOoWH$WAC=Xj#^zNJooakKXP`}!H`bw!L2$LEj6?olvoZ@r@^I}}vp{h=xsyiqsB(1hvXKGcw zYhy6u$*lG9={*ERZRRr>FMg^9xhAM|I%Xyxv)w(l*=Q%gj0mf#IegXHkXa`qEBl^C zy|*B@P+>Vc94JDKi;kFS&-HJ+f}FJyog4_9%YIL8Tp}Uel$!}_10t1STxaNw=X={L zOH2F#aE*HEMP#XiU!>lr7dG%?V2&jFlBS>U^N>}bqB?iqc0$lFF@*qP!rBxa2wi1n z3Rd`ab$5d!GU|iK?&ZCw5Ud*wR2T>A%TTGa%pL zBM&?zxBB`aB$pY}-^&vpwsbD3AOrVnkb({nNZ9!71^ApWkRgZtG>>KoLA?7SRlQvw zmx9)Nr|`mz=`hHDlZuUmmfVX-EaGj6=};L-2@#osae|V2i&2mO27}eKapBS>nH6@od$IbxTT$=W2(|5Zhtpu|t$K-CGLe;~M zRev!21NQzn#XC@PGT-RvD1HA4L3Mx+jES+aWDt9FpW$xvCLg*LSD$qC%NB#F?{ZV4 zqia){683cFoM^AuW8178NWsjPp$e(5YMD{&^mSXZ!HPY$quh{kZ0)(_%)7^jd#n<3$ zzvlptTXWIj#)6PN!n!vZ^d5dMfdZoz)Q4IbTL&NA1FclAk%z$hZh~0a&Lp#r!!J%I z*R@eS-T?hlf7U#Izx556LI z8r|L)o8HU1B=C@`sFspTL`{&NK}u?Q+)Dm`oC<(P}@w~(6Q`cvGh(Ew5hQpxz#wWM60SIeR} zUmAeQ2!-xw*r1!6MF1QjipTeG;;bTva%>{xx26PLSBmr)=KPUc#Q3biWdB2%V!ygZR(BKMvnZ#(RaU3*b$KP?g! zXZK>^SU+jpn@c|)(ktR>xY>AgqQ3#aKpQj=ydU1-TMh|Tn;+o?x;Zd+2|)b?H2%Ez z+`zqmc2CPiotb-Si-|w7`bBVTpna(kpRQ6q2;oe%rq}C$T&i=AwDOP*<-9+!?o*&!qZ^&&j&1h;$W;UIW zIOn-|ZZ_W(sUlbcu&U+7AP}h=KzCJYHxw@WU}?$1Tmj5rPSrNEKgiydWLq-DKG_5RmFImXFU^Ze`Nj2VCd*=`05k1>}?I9tuUxF6DL2Sv|8dy0FSN24k0d~I0< zd7gASl@2#0MCC0uw##N-P6{YdNS9 zB+AKp!G`;IM|`WQ?jqfYzPSK0S;mkA@ZdZm*jQAMj*s51Nvwcde46P`N3jm9JT;i+ za_`9`kNkV#tYmwSO%kl!bTylGZt8Yk0RbXFLk;dzDv2s-q_o|955>+h3;ctLw~c+^ z0ckuwD~O6=_5_$^-D`h;OXsCS;U4_$GGPKj2M31=y$*cLc92ZJu1r`0075uzd(QjS7rI zhPfqP!&Zge`{K9OwUzCb?AG>Fu_b_V252610#t?SY3{LDh{dwL$BT{ziI;Ja^xN_P z{S(#dZLxcswjK`?28M-Y89*ScKvhd8J!Uibx{vK-fJj;-R5=I~e{pfqLBCglYTmr7 z53n>WkW00$ZpzR6UR3lQxHZGob(h)OWHf#5;UXDmDk7x^i?q!&pagPZe9CbRF0f{| zO&@oV66~|4`wG@hmLP7BPLby7*i(EWi^fBGI%G_Fh3}r#++m~2+D^$T=)e>Q;NaNB zQ=3sDZVx`y6xUZ7*4@HcqE|B^G3ssjz+)@7JxbnMGmfPTApJuL()+KhQ4r$*@i6J+qT zL9Nwj@H7T`73FihcYJ7JcT1;6C3stmZyjR;rZ3B2f?>+$v%*^u-)Uus9wfCfz zwR4h2GybDR*XjgV}cpw=9G?Ss8KZr*`w-R&S-`e6op7RigKP%F#;Y-%J z4%HM|zt2Ek+1e7@_c+idzsbQk#^rH;+FN%jv^73{L0x%1XTwoeI`6UW@%rs{R6+u6H$6Q)2jCO8U+xR<52#x-3VZlp3L}Z7 zsG{s;%ofuw)&hMQ;rRq=r2qw;QA5 zb3^zs-$PzVBEzZQ-nfPw0j7_)r11*sR@ncj%rQwR%A&>7y<9SX!sHRcL+-PUN9d@i z5&%ohi%Gt#!uWYNo_m+mERrVR?%2m*;}T0NhA;qLnEL>rf`+)xXY|kTfZRTDL`1}s z?Apg-2|!#~38>fS6%`FQ`EqSBgllo*XCK>xU6DH0cs>Ux1K%3?IIgld3GwkB2}N)@ z`gSWrvPcbxjH`2(zWaz7REwy7K(LxEi>gAWxv|-S8lR6bOTV61*Dr_>2B{EN1xWk zMd3UX{*;0GZ&z;$h}Y`9d*~76_2@p!A9L=|&@GLhsKim%q{*6|! zTYjJ4@=rYW-vF*9@3rNPBUf}xw5*8b8z&c+Dh^E`ItOIdig+<&G6e-c#p1Vf-`z4| z01|Tj+ipUYl!LHrPtbWrLQ$7IIpvMG6ck@%)$6pAN%%wTggzIkC7ySLqb_w08oruZ zU)H%Md38@r0-b5$pFS;}6J^K(G7&28c$v#)U7J#0PA}QqEJci_dr-9P zORjOBM#M8?#nC(A^)}en*QJ|BKjBfTsmI%RdXMJ^JZh+NieR27pz_T%owPyWXBm8zz>bj2!QoX z_FS|RSnICWqX8n>R&7t6w|kX0YP4epW`qe+t#l4Ew#}W&2FU+{Zht}0zqI0i{@wB& zltt5RGWxL&nwWTZ7D;o7iV^WzPOLHzM(uAt2#jd`kJJ40S!@KOzi-oC8vY@5RgWhDjvL0F*@(i8!&~DZ{d0APKWv_?s zawB0tr4UP1x&KX>agqcQ_C!h_k3)nSXgRT+FOLW<-lMWTBqSiSn1<~< zCoh2P&#jtxy)gbQL1jc5cMNYzVDl~86jkdl{`ueQvK30r%L~Vo8n9SuEn_rZvBZgG z_MDlWwX+v}hxF6d|8znA*4DfZFJ+XJq{KlqCgai31!L9S^7KlDDsKUuDu(Lv*Uow| z2rlFU{lp4$ng=JFr|NvgwnK4NUp@SPLe98T?baI+`TgX5m_=_w1H(%AV2v=L{4?<&$$7rzJ0upzCsDgBc@H)3- zGxhZ+W0P&X-lr%3vk?kjvL^_H1>~H|Nk~L}n}&LHzu`cprTdrnOq86Q!I-o+3fVR0 zv&C!L4!ff#)3o#0Tu+XV;76?gbG!SVKBRR(2D$?ZW<-uNjSPdPm2rQ!XMbF6>qHZu zkaN&XNE3yXYZeS3Pi(tpfsLJY_{BV%TdaCL1MJ(4>-qDIovNJoR$zSFd1dzOc*Uy0bh-*!>6If`xfCtSB9gQ3gtTZ%Z#^*p_ zhOYq_N$|g9EYTeb$f+M1N@-%dCH;-5#KS58=bWl?fee*&k!$7F^*N5sRt6so96KsVk|<`?Hm6yHC{%`Brb}R{i;z zzsCbwB0pS`+p|iEB>|=_ECjbKkx;HKqoKI4}3}aZO) zr66+dv)7|5(J*{Xl2SFMoX|A1|20v<^8r-0XGuwkYE;xRd3}TFrC0&=%a^=cV|hi} z0m7jwyK{4MN^wwsJ|a=ut0{zt1ak3AwZQy0YL_v&^geu2%+DH>xre%@nGV=mmD0Py*aKH}l)jujT} z&+92p3Z(1eqHJklaHXOn1}w3%veyd0jH3}Wd$?O`YwMNmefO?;P0|N=wwGB;tE-Cd z2oQhl8!P2NhC4!lls_m}z@v#C~c3N1vH|e2Oos~IX#5trKO}Ua)7wlXCkA#G1I2W zN`FKg7=%d2qflMTAb=T(Xy9CpI*+!)kjsI;k<@#};+xwuZL zobC6CxAee1(Bq%|VCJmF;c-UOv&E)+-6<#1N&8db zpNg7Dhlhw?+k;w7=SlWGPO@e!cP%&PsyCDW1HJL4D(PSW5=BlPS~ zD6r@9#jX6(e>cL!69FN&8L}e8rr{V-Engs)RsOWeIE?G; zdHgCWnqYQ}KZTOD8S3F&6MelTEm$;>Gy2uMsfO{m5X^s(Sz%t1)$Q4Wg5bJ+<~aI8 z@;rPM#ib?W4MAsv1h0~ku#>GpRR?*v+YzNYxwp5;$;oN+FK*wQ$GP=#&&_GETcyVF zTJko}IcrgDrcN~_F^%tZas0SLB&agTu{hX+vwIUh94wt@t+)1O3cvfNGukahs8^HL zPhdtr%M$r^2@mIVB~CJ|0+~~w?;*HT_G!WYbMTBOZvZrq0kKj)m;ujKEuEsZM6h5{ zbGMdI40_;k%?w8R>#r^}zyg|+NI-3c=7@>3l-eq#XSRN<@aQke{6)0a`C8iBg%wb_ zs)|&>U-Ga=aPY8uFM)Pt&Sn4e!9jhsCfWZn-b#kbOWnLli>5A9*h?qb!~7#OE^^Az@oB}` z>CU92Ir#K(fz)4@OhY`?Ba(S2Tj>#4^cEki#r$GM=f8@InDV>sY89uQPSDCMa+4+N z!RBy|or@1VM&a#nwntjnWUW)ds6HleIfvTxC66F;Sd;a2=ITx53j&-y%oSm5QnLH1 zLWIr1!9D5qr9TE>dwqZlHlFP*zWXwwb2L20^xq^zx#in8`Gy&Xt55^260O)7_wA4? z3|z20Cgik6q44=aEkn^ShxhASbixH7E2l)tRg2jyFot^iL+gCMG<&55B?W#Kv$Qm_ z(R6jy$&@G7Qk2?(AHR1 zV`xDVn~jkDZUBhQ=5B!0WWKn{Zb%66D~Yp7q3i7~(6lp(QaL~O+$=OSoTS?(lAy{k z9Lr$K!H8D1O8*m;MgzZEmFer=5Z0)vYBQFx7;3HJ?))$Yb-?5%4;vBXr2uz- z+MBCC*O19;*_LmuD9Cb2XY4b&-#>vkL_sWpGYVTZMfT$(fQkLb`fGDM18E&~b(572 zkvls(!wYxt0(cxHID@y1CNryDv_@g*w=;wzb?0t;%1s;+@wj3NKk@X2yp>T#+M$F% z+>uI#CfnrKz8KG>tlz$xcG!tg(BV^TJYXNH6TsE+Qo^d}R-F&x@P*gE)rFp_Hl3w` z6Al#>k+Cx}f*$Zi+M}KO4n-%dZdKAf_eiGY>mpDX?6>UlTe z1l#ck4l_&DMzi=~q#GB$e}jGFluO`z{HCjp1j7$?kVglKVCddmC|>i1nPzMU8Ad+wGFW~O{p26xO5EUJe|=6 zFCQykoo&((`671B?^xR{anU%4$D#lWllkCf26wGH)up`~YN5&?vA0V`U>SR_17s<^luTlH^8tn%gi)N30KyRAy@9PGRL#i_-iMw2HtK#>AkyLIRE*Gxdgd-20$(Vjzc*kWh95WX!Le&bT0vH7>hk(NQdaXAYNE_B&cRJ9Z~@;}OXz<({2t zq)i(C_vSBeJ$MMP;xXj;{)XMZn)1{YsDO4kJI*{~Jr5n(5V1K>LJKWz^=HsP|Dfs& zHI3blO2p1gl`wyBY)~DwT7yDU3RAnIzihBVk=omQWn@N&y54JZqO+6T!aCv|iuRY^!>brYqVUGA_lqET0E$m5kBkv5uxf8dvkv z&X7-7?XD`RE==O^1$x_E^PoTRF+pX$9TuW@9ziien=Ef}(kSv`jVYLYwsvoo(Wz1J zpA(Cpn^v)B>1N|vQ9N5xz=VVOH?&Wkfk_MyPNGgr0a_p`?lG);8(>`6es@SuUKs%! zU}4jlrfLyqeH2Y`KP-}($VnEnJN2h5vKm>+lQwWI*fu^?Xzq62JW4?TbtF1@Y`OKu zGe>nrQ>e8!+zo=*!?nBDBv<;>g|{D!R_}7?ZMmdu=EyQxj0sL9lWZu=(COdZB*c}v$2R)Ky!A}0 zW#6Mw5W)7doF)!U{ho^{9JedKl&*tC0o|`?VQOZ3G83kp-lAq^YBitF%+xo_oiF6> znm`@%-AcGtiOWJ?zpChHd(YK4cEaDzjcs^1HP6)-y5}Cv)!vrBKUR`;dyKqgu*-k| zAVq!ItueUKlF09b`KtwEonvOxS&Big$K3xka#2++tCCY<8rJEi?6vLeqc^+TBn`%& zD~lE9jWd2WC4YapEK(HgL5&e{k|S}>c;eAuU3d5I0;%xR08hFK0b5{3Cm#9_Hp{g= zIAp<>P#j_IaBPWkCLxd>oXy8ZUbC)L%+nB^b6b8Z3^x2RQ!rHm##phKMnK&*CZ)Q# zx{tx*n%zi|L1OEPuZr1kHP(zcZ&5<0I@_|AP4hbgFsXS;ZkzaMzGAqE5YkxZ%}CoA zLIIIL@kU9Bi;ZpY?CH8TXO=~wmCfi9c~z>InLdHyT$xG9p=~~Ko*{JkUfuEIq#o%i z7M5guyT(I7%BtI@1&dp)iLj;6v}Bno(^Yn^nF+sr;K>SaNlxYMs`74gq>_g8PQN8q z)RFC&j_bV;`3uhdPQjv(!FbgjyAJ~^lOZS1b8elONV4y|=^5@xzOA@{wDVVNVeW5j zY8%TV#2i^f7gf)28{Zvy=x{aCZpJi&W6ktapkClHGMWvE)Wjp?4c#3wdo(~33rxe~66 zR!(b&bTImu_)1{j1mibYLU9OLrW|p=`ez^}cA(^0_CU}x=!#i(JAd?ORtt+6cTrKU z_u%g023Nhq?-S@%l7OR4Tqs5TLa^e61k9)cc&g+oE`iP97^lbn)Vw;*&GcMW=)Y=s z;1_+0F9B^fcej9M66@_PsHt_KyomfZ{^&}fpqT@GO0arlSfkFl(S0F`ZT;f*iCv+{ zsCt#*2j=cWk4PM5BZYZm1_b?t$#zrP9nCf$$dyao+-xpi z%T!28d>jn}3r&?t#_t@7f7~8kBZOd6v%5EKT%vGCCO!2-+=$D+o6i{)$*ZJP?HD~= z#~Km|1+;tt9M@a4h0!!)+2MwH%njM88Z$kX__{Y;8f1FlVN-_dTsOD?VLOn2Os^?; zt2`_$EVtFmi#0n?G{N9;+ zmteB*PhasLu<`G^4&WdhDDe3X217s!&VC<<#ppL0&6smRU`$c{P|i8YQCo1yNmFK~ zuBez)OpEcT?d+(B_jnPto3mZ?TXChXiyYFxz~;;xgN~+0ekUVOPQZe$Zf>?e2(9yD zH00BXQr84y`RgGDdco78=L;66tZwY$F*Mp4+rMYDikkk^2xQV;F-+f9y4I3(=c;G! zr1ETp2||a1vK}*;XeY}rYW)7|{Bi?d_sx&8P9UmOf*kR= z!=zH9c!Ko0<9n~Vom_Ju#-o*pWX&QXv2sTW^2=K8CgV|xG1h9I7GuR=Z+F7Z`V^gS zOQBXhDlOU7`HFZc!=^0P(JS?)C0_LZ4JzN88A}={I5^?LZ!S1iIpF<Myp&CUY;hv3*F(u^v6(}` zNmt7-CYUM}ib7*Voi7Sp1tEV?dH)cozfRzf|C~ksCe?`Jwloj88Dpgt%q3C6&PZjy zhp96HEh_2D$-pG$q2blRGBn-UdPMu75L}j_)0&(n(yh~jZ|B{J3dOD$ z9Cx+);K>r=@n{c;t^XxMyrM8ti5)?ajHUy;$Y>RAezTTI?A7C^YE}G2XF#31s-7~f zX~^WO{f4``WPLDmQKn*0w)NGCk?L)~&}1X2mR9^pC@0I}vpiWM849J7@mqR&282c` z8*NCY2gP^0-HtC~R{s|>wo3hmy*#ItlvK?6N_2Y!&_>aRUSH(e#t)l|O4;T9g#~{m zpi;e|h}0b-$vyhZLg(yuKHoe8^IfrYy1-^sMgH#OJiFmnRuZ2{gOW5~p~-jN;9vGH z!$e%h%}S^A(FYxksSoRZ`P!y5I}1;-IJe89P5J4G=Ibhx(Wt~kJg3zvqod`-`9g8> z&Lwgl9&I;QXCYsvP_tKDTs5=vJPz+;cDXAwX6Sl+)UmNcv7F*|^_wF!Kx`~?zc*(; ztbmsdMy_l|JyYuu1|VMMCjt=Q(R#XG1fYwgXEjjtXg*up za;YcG?%}JtIlW>b?M}N-7Ar#VL>>RsHP9EyZ&=)ste#WqF+&4SO z2mF_k4DQO`8LhvsHp#PG47Fi))Amr!p^`h9IF^0of+C&vvxu0O*DQ0cIjwEG6;mc- zPpi9%HAKY4$LU^SxNMDPRLm+UqFBAVA-f1xzJH|w&C zDXYpcQ;K3t^&rS}RHENieuVi}E22$)v|#o1$#fm1!^0SAA2IjmfX8c|udjkxjo}d7 z;(>OxJ5krZ`1yyrS+#tJ^FIY06?UXpQyd_QG&jNyBEI;hg0fPd@-nYI^S z@07TpAs09jQf^ixNDx@@|AA)Ug9CT;Su}PAAC+6K1FDVU-$MHUs+jt74ODy8dY%Cm z76Gl1kjl6v;a!t)W_}0Na?>g^Wz9L93ITcsY0*)NXcE?3XRlj* z0jqZZ3zlc^PsS#o5GqFasYi>MD^e&DY?w>M+InZ z-5_<6lc11Z_2(m1CZu_Cb=GO+k_pV!XIa_FrCr5ZhGUiCnFhKYCC6Bu#axGDwiUr` z65YxWB8tW2DK!8k?=oNsv4I`)8^Z^rse{?0ECtsfS2;{lM~CQ_E5{agjdyxnMfQrU zrYEy?98yw=J(9U9Gj#ciMTFD|>wT9=$lT*W-$rVU!zU^?wR6+w0BnCx4RVJ5sY(BF zLH}X7QW*he(TJKrDurTqx@Pnn3^a7d=U2)dl(amw$;tRjySsW-1@07`DI8|Xh`5Ft zemVDC;CG(W@&?vJYNs`y@s-VW?Z{aG?0sl^u<0>LGDb35j6v8~?=W(jx9^sHU7(|& zYG$0W73m?59O=B5#Zox#Z9v*dw5(kk@gNk({VhZw_Xp!|IR~vk&l5e;Z!a#zLk^hR zGPCsmD=?A=|I}zu7VvP*S=I`BDR;IMe)l~!CnKT0wP=#+^r1&R-M^MLy4Ep`PVY-vLhWn{8hcziv`(SITBc(}W0mtyI2Z z0pZ~_(w5Cgv7)@QZMSA{){{5xu8`*aQ#|wLOPtMt;wr5f#ThywBm!cN`H2E7PcG&~ z5*E2|8q~Ge0dW(V4XasaM^v+KTuuP)Xc|I6{#^h z6gWmXA@;^IM&;mpi0HdAiQfmo{P^4xa{Mbw)HR~Qylk^I>2lOAJXP3_ztTDjVws;^_s^qWm-x?jdYZmUy=wtr>qsG` zFirqbP-s7HZ<3>2Y)cmm)-`=L12P>t&+^tuy1z_hy=Rfri9v-<{#&S#LiSBZv#>I$ z>fnI%CD(U5`7gO`;1g_`3|0(w_rAvfQ&|{Fk2daZ(uzikf6`)#4NFR{@%WNsf+$rz2_i&``$9rJkF{___G5%8b{Ev>CL z0(?9A0A#u$6ZR_^l38pr6D9g>y$VG(QcT-MrpV9lo|2k6vIZ{Kz<@NV5@YLhh_GIo zWElaG{Dd;U!spD)c+*Y!qbKq>4Y<^O6fMs((s3>?zzU0sbUU=Wyr2;gRUG>xhn2Qy z6YV)Zns!1t%1iQ#+jPnBHn+|#1u0I~r}3Phj8eB)F*|)u@AV)1&!2huXC8#kbvl#u zcFNN$j+W=KlVhAAKa(Kiv`ne`X5xFZQnjJXwK0YSo)wF6T-$Hb57g~aH?LEYI_l0~ z_2!wv$9)zSF{$~h7GGDUs-I*yrb78a&=7fu3jG~2=6&Zn4l!j6FO9x2}W>;4tu z0v5N8fGkbG=tZBH%K2xlD}o@6@MdGi6b@CXzil`GE_-3nAh|IR9T!voz6} zF!yh3nWQb-%kjgMTMwJ1v4vzeGXa@VzBu`ykdbO|yzwVBqW%xYz#)Cx(&Oq?FyRpW z_EnK#q{f|}+5Z1p=TCqEk$bKq$W}RhqFe}`P+J|%_}e)v^LKB9EdY_p?ME5Z@vhtw zEB%=YDJhTzWY2bH@23~&d#Hk~RSZi@lx@15sakyXL!Q4~AV0t6fh9N<(se|Aj9Q6) zn!k_|)X`;!s(W_W{Qh4%BM9e*cRR5p7&=$_j5<7r9+Fgk{yS z*v7GY=qWg6Q~t*W3|$Au%(C{at9PE=nkr&bq;GC>GXPXuqbVsUlzp<0pr>(LSu;sE zbM2n=moF<7?~9|mlC0(-z1hyxUcLqk3rb(M|6fq}%p#`i;U;xHlS%KkS8u)#HY+ zY%R9pS7_6ijRiEv*C!}%I%mH`n&vOI%5*m{B!n@J={|OPy2V1rt=6_St3AZ-uGMhf z!Qxzu|8%T0H&rrLRdJ#;AueH{#zif=ReV*S_2=K} zf%WumcWp3uTkY$r{;8>LY|-H(B{KgzwfFN*Pz9bRZbxnODiXag9~>O1_je)1)Zt|Z zC&laeTU_sEVqL~c*R0x2k@y=4Zq955(o({HL`>v)x9=Ifz`OIW0~syVO#9gj;6K|^ zR>R-1tL)`JN+%LPDf%^vthW}H3Ze$3RWE&g{r2})qjj=3*_t{!#0|$Y61UeUiiT&) zR?eL0_G(;ELTKX9@3?Pn5X>I=?? z90e^V^Il2U01b1E;rC}N=K_ZBF2hp%{v(MSmvb)*wMP1Z50cxU+vO?igNOmQq~yg* zL@l~Zy&afdSTyIEfoEmxS(9pex#{#S1I^c6l6j&>n>33tOYcBTM?Ix@3Elb59JyZ2 zvR?wFpxk*oZaL<+$a1s!$EE(q;Q*Hz|1GS!xw)2NByTXY-YZl4G%-{L#j8fKrHH5~ zI@~y?CyKe6#(o2Zx?5OOiLlJRblrxQI}~JOGVihPFyO`!8Ed3--R!S+HEkQS`qurT z+-#c$jHG+RB_7QY{u;35;oL_JMZwloA|&XpH#mw=Ne`Kj;E?(G2(1tX@}SY#*(37A zL^8~SZg+l_OZ_>wOs>X;hB6c_9=<$`tNsGW{w+5xn&`(ukqWWygIT`~Q1ZEjk3UXC z49yr0Qe|j&Yj6NZlkr&;Ccz=BSdseY+53TG3Nac|V`^E!2WV2d@ulk#R=KFpCco|9 zn_BvF(d SJK@5K2D2?BaL1b3Uy9T)`CBAqdWZa^#H4*N$_FPJ1&ospS!JOy?Otm zMCs=B_dZmK@s|!iUmz7j*_ozjj1B7H{)H<#@z_%@F^&(5K0_7=u3x`f?PMErdmvkE zzAem$r!NxLQ5d}c&T}XXpD{`_qLbK%r*ohCIZ%)m8V`{e_ND~cYz#J<(TO$(+pzEr zl$oK=SGweB%A9Eh3@bCND=InNNi?72UaY#yAi?CJtgP&O^9Uat>kg|`8IS-;GZ93F zg)y!a<(6`p)t2)=t(BiW!$UU>1E;_ye)~e-jV<4ix&yXo>G^~|jC!65JeRmAhtTQ^CB1leNfavL zd>5+RJw4N%DYvub%Y!p8p(6f7A;rayD(Mw`oVK8>z^Ncds-5#SU{ZY1WNVW#I)C>| z|D3VEKJ2mtI%iu+zucv6?U^la%{7wWj97RvkZQdpZ77|c#iib)vRG!cqdFmip4bT3 zw{94#oa>@eDWqU~p&ZX!tb z#uFS$%rJULW6~ zcyMqq7F=<4_v2c@0jI(jR-6O8=#3=qy1qU+5)$iLU$?_s@Pn^&u32PFdpQd*64xcy z&2QgYVB-G@kk2vQ_gFa-Hb2@zf@mGZ91J5C6$>+e%owD`wf(1hX=)uDC~vn5USfE# zoScBWObUZv8t=rH$!}II`TfQu?zwdtgA=;#)9j+H9cXCsvP!y+V*lmxa&&6x#A$`z zlp;n$vbS612azA^k^ETC;bc7xCk!KE*;b{`;gj4kB(ynZ#F2Z5EyR?7wk@J2oH4rf zE1L$h>6q|I&OZrXCKt4JO{?Nn*f1ad5{-XJYERJ}%8J9oRv)Fg_8_S--4R&f~V0(Ce`eU<4| zyt+x;oV%jgxu3qIC~4gsi2pb2J;!v-qqO7>x)9k|HqCM1YGq%0xjhBc92(DsW={PNFF~X;dI6XwAgxB zH#0rGSQFn-F$EKM^@6V)MQOH$QxP=-%r}F7}kj?TqxEU&C*Q?M} z`v>ri?R)&ThnussvL!}%aOFST@~=Z%R#;bQ{kUbYTBM6p2ngVxL87?t=S--e!cznw zkgOc_65(q^>;@F0Tj7s`ZuDj;U~yQ^q~vH;D^~fIPDX57uy0RRZx(XUsRCsAELSzL zH^&e+Q;Au;KSZR%bZvB}3AXOvUgJ{kg{AP4Z^xduWFVV>3FM{v=ZnxStsLZT=n`f7 z_73h;n6|dPinb6Svpzpzoofk7F0`E0tFASN@g7Xs}uWXfrdZw@VruRs*}cuN#gemDfBTD?miVZhjacp-0Ui)krKYHwRfC znGOo}3rP2u8Wv3(Q81bGXL$7IYcU^Z&V@cWX3ahhD%*1jj*K+yC`hwe?UsCf<;`LA z8ms-LS;9MrrHWOP{=P>ix_<*jzS5Iq~%A>mB`c%UNL-o0hwd3nRxNWo0gu z#FC`?T;^lWx?Bb_k}D5!0moZVz(qM}k)_Ea9rf6dfl=)-lsKtDmzB@lH4)~~i; z%r)ZchSx}VXbgk#U`~ieqYGb=k%kqj&~)!*7~prQd_NexV4yn^*?@3cHK@Ka z-ktyH$$vwelUGVNrKMu5s3PMzkh#tQt!!?MEhQ0;A4Wsw(Ggm15sPv0%FlCLh3{2? zxUV%tiYFiU4x=i2S6+ZqVG9;>4PEWguBS$2R)&tli87d)PHrcFZ~y7hgJ8isOqC20FI`SgX{(t&F@2bntVvrT-tNH@gh zBe=PD?IEHv4xZqF*6o^PcX6o*`5G{0UMad>y=WI5KK{~@Tkq?Es9sm3vEK{$=Js1l z#izAwuqY}S88w{_0VMvjC8!x%*wN~XwcVwRjx!rI@W7qYv(^wjU#NBq91^>n8gis12*q>^}7Bf~j@B$pxAYQJ#NwH54z= zX+7XgF1-Z5Y{Mz`2J(^3ZZ)Lv>obfQ@#=JZrfFgR>a0k>x=?PmV&CQ#@6vjkijnbah1m|VVy&kM6d=RkA(%sR zsc6K&*>`b-#~C&cf^iEqUSR~~s(CqOu5~A#Ls#-~=lFvx6nv(B%KP6-u1<1lw6t0W zkwi+tL(djjHOc|B)VE;z=X}yuQ%><6Wj_B{($2^(=!cbs(#m|BU^+4O%oAh3F(Zpv zD^~nFt_l?g@rgZ%PnfBtbeGP^KJ3#ST$r~KsGOv{6PSF;_-ORc%*Zq(cLWe^(#R!E zac$B>v%2Jj6r$WeNw)ddr_$;BjyP2G`*yNKR$HQSNGyf-r#=gSsPmJfb+Lj5a$`m- z%=QtTQTBjlk1}`5PlDtJy8QR=anHtD<#kXG7hYrDeH39bNxd@MJ9@OQU#$W10Mg=& z>=!Rx3g;tW2xfyhLA&LuAM0j?b>stu--)-B!CsY)hCH?3DS>`~IHZ+|`OX;*sk?+_ zG^iNK&1P3P*&4tUp&VQF^$t;9jxi%zlxr+wpjTkWg0+*9+doRJm(QNfZk?jP(1!Ph zX-M?yKtlX0P62!db@k_mGY-YZ1euGgEy;#ORG3YjuulNOJKC(CqmPVdS?WuV7%)8% z723nPN>}!==vreT3+d~~jG+3Q2K|+3dZTy<=i<5=AgIe{^DgA*xB`&V2HNDAQU<6W zB3bqkZm`fj7BJ&sHF)24b+~ig8ZoBlVpTnP|@4X%UhLVy?9ift6U@!(_7w&VwiuH_wl?SWdgE zdiJ|~M~Cg;{p3Ay%!r`NzHp6a`y0ELcc%~QFtPZ2(v6E(uLk7_zZ41H*LVbt!4mqx z4?OcoaBs6RjgGT(@lQ!zN^!OGJDrNLI19@38dCdVU0z~g6A@u2u6ay~z>-$&YTIv< zXuRL8WA}L7P~p&S#NxTV<@-eDQ%vKc(0AuMBcqENASV&xZrjBb=5A9=e$}Qq zZynXkA(s4pXYG8&@n@0w6&dmr7t~`}W^VCP(=jGvzjuwKuG^6V`6IPHs(kSeC|=1V8Owv9Qcx0aPH^sTW=QJ*|!NpH4D(|-CiX?tZvL-W-% zEqzctqGHV-CA1d3IWG?MQIm4!KJdg~sw^c@ZlLnk?I52m$%iEDO%}6J?!jt(vQWF7 zm830D7@8(T%USG8{R)JDoI~MAg7Utz{)%yLx!eWgq4ancTF_sqKyo`Br`;ArsiTYj z?@Y&D3i9v^n}%pQerB4UUgfZ!pZAiRn=m9@dF#h&B+tA{$%{H{2VAbA8}H<+SvEL04Jt1GInO_i!#6jLI z4d${T;P~>;twUq5vIv?)KeWm3_KKAw`h&s1(|+UiDwrVU zv^>@gVzj1AsT5Ca^e2nC4=-5O3my!z67e{RgGntaBW1J@&BIzH&})Mi$J`uxxgeAP zsur&wvRRjrE1a{e4kdeY0pebJTz;*7^IxN#62@4AKMLNP7190d?>Cq;v<9P{9(X-p zC|rI_S~vRSv~raI|1Oh|x_6oUi0czCF+bp%%i|x+$m*grv~7L@m#LT6mz1Feg47M| zd?-8R2rhb~cY<$0vwMBaKLuZTAX4@QI3%MGt%wtFk3`q?%LkE2oO$H>G+A(ERNi5y zqolqp);ZwgRJ1dMyv%EM^2T4aPxPXCpICLdV2@F5$q{qeuHHQ%%Zd&Aa%Va1OsD}N zsu=q>brPVb=sqzXDSM^cF*T3I$x}{>iHY?|FxPx54(pI&-P_-9dnn~s6g)CQlHSJG zd8ER2mGtp2Q)Il62`tYKOij?}EwdCDDerTMzk=$2+q{~`$Iku?G>g`AnNTY=33;gB zxm0){6GsAPGZ_@c9B|Y+s6AE%nqZ9yD45333~76Oj2zc7Gm2lctKS&{DFr!{eA45s zjbfCqpv8JkrjGN%V5%5(Q3lNOYPD=y^;QMLp>64Sw4n9C#3E=9r8SS=5_3V0{CnR{&EOIa78X6anq_J~U6iZ@Sq(b- zCy{QU>tXH17~5V@O4X2R!g@Iz#P5$R)A46y8!OcsQUyPV;cYw=F#l~vxP(1f*?W%r z$`LNyvnhZd`&Ur-{pJNxTX{oh=e)8S?u<<7ZOrzDAXN!!I-7DGg|qyz(~C_dO;Cj+ICPM@Cx$HcpS0MD~rap3&T`1}SNcP(l# z{nJt+94;?f<*bPg^eOkJ;RL)J$knbCix_}SpG2EA2M1i0E}%-MP`jCF!VYblyt*41 zc2eQjpUpmYf?=0$-MWUoxw9Fx80XSET~lZv-+D1y37g@*&8+a%+)_|Pd=k*o(qqE~ z_b)HFzz2#d9~qBQz%*}YX=#-&H}xcOvzhwSebQnrei+OIYP|1N;D3#7Mc`%6O?|E( zTvx~*Y+H?AP}w`x|Np{k#vij79pLDk&oQzTbW{q93FflJsEQ}W?`Fo?D$mAd2$uTO6f2>frjs;Fqao~sq_t9j6tcB8 zr1D_sto{@$_hLRHgVAXSWO~+caH7!g0j$1Of`N?^_SvX=_f(@Q9exKh{QOwHW@BPh zj0aCx3MJLlaVxXW*)|0T6u?+VQXU+(QV$}^1^8o-q%&7ycc%M z8Jwy4*vx!UQ1d&H?~1mNxrCN~S{KJtf$zw`^;hoV$UZS9#aM0}DA&3{fs zZQPq8Q^VspaQ^BF9HKtXD=Hxo))qz&uh>tn2>Q_3vp_nPAKewhp}ody@hy-+`BO{Q zB6IQM;CMW?L@iZSry%XPHg4O_OK46T18U+?XqeleY2f}A!IBcVvr>#BB%NxAIg9a_ z^Q-t$3G^lP0-=T>O-VRpoJC-myP>VKMTc^>x-uCPZw;V#XU3slniz8?y1JmBG%7S0 z@lmJ^-9l5foQ%T#gxGu7bkm(P<32^P_W-@~*sM*$gu@V_hL{$K=iokJdMjMI;@CY= zhQD)0Wo4MJF|t}fo^`Is4PW*8NvZcqVS^azwP;PQ%}#|c{B@X^M)Erm4Jltj zhVWQ*ZA}bKMEpqx>dz@!$Bav?Z9_$$>&I<%CyuA%0MQeBY)1!oX$F!y-a#HP@5FYS z+cwp1?smdfZ#Z=4r>}o87>BymPU@oUdk2cq$n zot=)29at>vBTEkiq7uVFe2C79F7H;U6b&I#iBhv%Zyf1#o@;rK?E@iHmG6}vc+mLFz17b0Qifo>(pA!X zov-3!m#r{lV>W-KTuE@Tf;- z8Cnab9i5#_Rx+O;82=-dti1Fn8&`Sett$v3hk;AP3aye zg4}U^iW}xNtE3lo^DePV3Y;2}F&2Rgxo-s`!bD#5fg)$G8gta{Jk_pszxlDp8%1kn zW#Vl0;HSzHoH&nH#+zE)G=akU7OR!=(L&Ks*BsA{_EG@ZgG~qMP@u=7hW+F{`*GKh zhV^0EXg2epcW#W~pb-L`!iH_aD&UZ1!}-!TWW-EI=8HE62SgW4g11$u8B?TdT_*($ z^<0iq9h@BrdLKeLXlR&ewS$P;9To{5>H#F=w7o?4CZC7~hzi5IqgWfq#>8q+uBGCx zYq_$qLMIPjk_ZP!$JTLrKRv}X`dRjRhIA@~QsirKc{zU<$pk>+5{0^A;vV!eqP$ve zv&6Sva`PJvchgf8+HQt~;uD7cTfTk0>^bIp=*qoKkh&gDzK~;l_`oUktrAwaFzeIY zKMJ_ZqW%FUVgI&F{t2!KV?*lYtm_eU2C}N)B}6RP@|0EF^vH6>)0G!wi!3+Hv=tSz z6A=S<25=Tgn58Ng&1u9C_uVee{Im-N>30tDPeOWui72QB6AZBf)%DDBXGBbhwJ z&rFruMZI$o>1k<4=%U{(E#>NM#=zRg z>Z{C!Gz7%Ob87NHBEu&?e}hA7cAto!((fUZT*N<02(B@q751?(Ljv8Sj=3j~^Vx8t ziYY|PMaEu9ly)e8Ou0Yt8j{s~QXZP!(x7?AVg239Hd>{ye$%rHzvGBf|KHPp4NDWT=ewY4g_Go8* ze*U1@f<7KhPFoY|co#&?tId6zTMu4l)cfr1FKW$oR+5Ao=T|C#8e9?C%ll?r+#iMi zMUG_|=kiR!kX`y=>ZK#SSsaeASX&tmi-O-V`Z}crQ$eaV$Dm@XuleM99{J(ZMg>l2+x~hVca6j$tK!$dIL25y!j=7OsYq#Dj zj-t9i>qRsb2u0|-^Dr*lxWQpHe`yBum|7ui?IJ^lq?N za%(7wQc(p@GQKmIRKKglm@5Jh%nli~3%AFn>pPEgi-dgi4nF!tC(R-G@K*}g0tCsI zCoc5y4M^l3S4)+mCUVt*yd_hPn(a(lGCY>2d9(U(9W{dJ{%DElY1X<~HW$ZJsbUJc zCl|GK;@@U7Gq6QFEg%&~7&0i_l>DlmxLv6ExLIPR7#{+1D;0;Ix1~Dr>^8(A@&ZAh zZ)M)&8G0G)O4_eqWdge*H@~Lnk$rxGS&^Oc4hx@&soS;YcK-&8NUNwC^azO@5Q+DS zvOZb^6rR=41a@n`JzwCS3u?`dnu;U{=qoB8E66NzSkzhGYt?QJCW=e1yZb1#l7CB2 zV$N&xIEe3fPqZn(S@26e9RFiIknQXC&atIx9Va5(m}{w`u|(C?ruct$ftdmvQl`9w zFm&0_zS>igq8%E2nW_N_7d+L%#bb+xUp>oY(@X3IKp?uu#N-{G475W-@&}O{0fons*M9&}nlV*S z5Qw7Omh+ieuRP{MOxW{zJ6RF`-Hi}b)Gf6~iTOCO#?*)pC=tu4s_DQLt=3q{w=Mc6 zQO}zAHnn70dt49pl^l=WDa|z=N6Rl|u2(Kzt2VEHFM()ytDjrDoXPjz?XdNVN+|=9 z)W?tLL2>tkHY*Xo+XIyMKSl92(&yLY;qGOoXaJ3YCJ8Yrg+Z$zOI}J#Helgv^ok=* z{($jOkH3Gg=ZIvfMD$>9saWgb@Rl*e$os3PSq zjrChD3<4>8(bBfFdu{EwHPW=A7DBkUtgi(T7B=gJ@;L9d`7leA*5C@9$1ZNFM(;-3 zIBvq)=iU)$l^kR^g91EN$L)ekNi}kGEen8nCsyixx~7_##CyRAwJ=61Na@V54ud)G zE~N!1d0{0dL2qB;wicvZ^9_JeWAh=(C@3ga(2H9lAyj@jeO(7H{A+}FV(&u}1@ii9 zvHMH-3@9AO3$!C9Q}cwvn*E(2@~=B?J=B9p+W9+v>^Rg5SLc{Bx^>^+Z3c{VA#Hsq z!`Li%nmjK;iMrbGF&qh7IHo~1fleu0hTOB&9`=fiv zkg0Kj?ziW?7;^#OXkAZ$o*iz&Qv{W%!%$rB9ZuF^G||DHeS)R=Zp~(3mq05jg&?wG zOPgSSWiDzxvj9xm$Pz9CS5*cKXM2WFG3PHH`}axbclIEnV?ya z1DSGSdAE55Cmro8Ms%v}SNb*M;_gcxZOpe0TGDyMnHJs;qseuvZO_qeD*`iuX;0Xb zxK}HVE~8%g;sso20Eg&KXjhG~a(T!~Pp+CiycnBz`y&${ay7)NF`+$o_Yl+EoEazs ztgVpM+BPhO>G6&a+z2$>7S~#F@D+!qdF_p>P`|&LWtoD=SYR$}18M-vuH^mMGbW3hSqL>OVpOieK z1^JoVE1g_srIi;ZD(u3KdAG_W7uf74&670u7gMgeuGdO=S9C2_C}c=KIcX&(*`LYK zFBWTll+VY>vkjJ_dRP;aiGsN{qZMECZ*dZTg)M&;%hV2O@)JVWjDpNx706b&f;qU) z;#`fYcm)g$K2&kpdXGCI1#s|6gz{=P{V|3TIe7s!c2d^LN*@*@WxApYdf!tEcxooX z)u2sF)|uXryX>8N8nesGiAcu#!IDv9i23Xkl|CxHFnfZV(q~HS*6!`VgB~E;)n}2u zPT%B@1j8!rH^M|g?>Krt*jLbIhRK0a{6|SUsNnXjQ^>7=yh7X z?Do0A;y>h4QxKpMXC{UC?9>S*}(3F667FHh^fl=;rV zNG72?6Y=TA8_GHu%w*>8DN!h%v{b@vX9*D*QPk_RXKh~6gb~q|sk(0)X(%;mP85g- z@6+DL>vlXExrEqH-)IN(h{z`@ZG%pfvE?jRb zAys2d&38oRwx4Kk4nQeLUf9B0(&MYBr>7mgkfkPG1sut`n)a$Fi2GX$RlIUhaS1p6pwzqnQU`r=lX1ONdQ zUq|)v&uei=%l8ViUMPvQmYpZzsc0jJmx=&A@G`Ud)MSvRhh?58`G}l?{(XNEo-{aJ zplzuHWeREq46p@Kg^KJ7;VsT)ZkzmZJGfs(bs2JWcUE;fP+!$a{ z6S~aT!JLFZrYzW-h}~t~$6M>?F;=|Z#c~!$fTlN5%-k$cs0x13&BDka_+j)dU(Cxhi;j!>>oQvEE~v@6T5_MNx+GKNrk4 zvlAf}=b^GL%_;q(F3+9*yQoIvE-+W1s9Cr7JaM;>UA5v>|27~wA-NTq4oD#K;E)h< zl@Sgcw{IT_y^d0JLq>J&7jXQEs&%8s?NBZU1|=<~?+cz=!b{g!%nti1*4{0~2iHXG z1o06ZQg-no3(cH&Yo*%4l+^Ru5BaBFU8Er9OO(2!T++MG&a?QNxA{eHv9`UvUnr?TnK)b3hM6Rr_W0;%I4r;{g zA37#_{;FnO^Q*Wgb;RSs&%f3XvuICf*=?=iOv;-XjE((At{5L(9zZ*>NtC`K3`qfx25~W|TW=dM<$QqipXS{uHcBm4S69F~qLamQH7kBj>I37lj!=@ovI zOdK-!cYM-2OcloMGSw)bIkDNS9ivS;BTiR8wuu4p-Le>N1f7fA*bQJTM(kRk=tdt9 zn_aJQeqkm4<%`>fgk(LQGZYIguEupL!mn$a|J&fJ?BhvXaWp|qqHvH_N{$04Zi^am zZn`euG2(<&!nl2X-OR$eyX*> zCY)0&li%ykx0Ic7X1`es^=^y@W7_jQ%~VUq+#oB_vQZcGb9kpI3^c5BS<`P)#TNa!m9wNN?f(5O zKs`I8Up%=HH2KuC8y5$s_u?{7DF0p;*9*@HlPp19d$$dj z_by|h$jXPf%;pQX7Lth&#`@i059`eDJ(oL!{=yl1G&>JuZ7s&uli_^hj@jEQc-a@W z#Y9EJKvEt8tEtunvDx|OlATX54sPAn`OR3JdSwvJuWsVYy}KlU7@n1C-zBb`JGir= zmDOWG|1eEz;LUB;ob(?hneL1iGZIQ*oyRh~=xs3>W?v(Q%m{G}r{zW#^r1B+1$#yT zQ~xhw{Oe`)$os-^T04IIaqKU)Q4EHD-0Vj$E$yrxueAJr`gf-?FgnCIR@l1A{*(L| zRl7UR#;><~iwU+i^4#QL(Pb>fJpGyGW8DvdzY7g41kZqt*;Lc-IN6wdW@#n+rzUg> zTJrKr%ac41Fpk7Fww(0UJ^RiYp&8U}5XgqD*dmXXpU{`r)%}yrNq1^1e%(aZ`4e_9 z7Nz7od|vDJ%%m1N*(QaChu@;dULs|VP`64HkLGO5Apg-C)IImoE5wMB)BV~e|4RKX zgYv^dF`d0{WHT!>_pA^pH}UaR>}{>?b;p-nX8qUxpHn4}#8gzl4EEU#Q)Qx+RPM!_ zYLP2Z`?CJIGc6}OgMfAo|95BPp38O}6>{;3^?Gmles!(3jy<$p6%vlT^6QZQgW*q8 z_bQa!74Cb|nQ6}!Q@wc64{S_)QBlaaV{m=Lu*+If5oH*q}N>p_6lFUxl}`e_A^S0}*y zo$>>3VS9%mQZrmq(hcFUjK2UCupJ(ySnM1eqKlo=I5#%q-C3V|m z@n~MLCMk9;5~n%Kk?5)}1L_|}2i||N;@vOI&(e^$je1;OwBffhF&Ac>ZoB55eEB}< zd)gdSpndJb6vHHj-xa}kylf_*vrEj@ntY556#sZ%5lr-%i?J4N zc?c$>M`$<&^?05(sDF+3cY5`YSNd=2!Y(B@Hnt)(V&W-tgDOI(yWZE&68`OYxt{en zJj5v9*>%=gzYyQDyT-N6L&9MtzwSJBqqU{wk^l4MUOYrPA0JJsuC6fgt)C=9LJ7uV zBb9Qs$x1e{SFT1Z7!~-(-|+oY#*6G+Tt3EFE}f%#d|Fz!9=!Ts`3f}rJ@HXHjTscb zHt;V$3l`v~KUX1SJD^24;GOr?ZWFO>QX2b{J?5{Y=pJE{&Lh09$}6g>n-x6n{c`_R z^X+n@I>KcCzwMPf`f?TLBBQ9N=)eVKdHEzaCanU9mGxH6c@0%nDk;9L*WAbsTt!p) zUw;haCG}DB6zbzYe-9th`*3NH>sY7KD2!!q+CBag1 zKA6+M26NRK%+sLu@Hk^NSuUs3Hn$1%a;SD2Wvm~^^yi*_Plx{gQ1{{-Q;osRXYv6!ZMCZ@A&kH6ufy+s~7$a=iZ6gNPo21#0owWTY1NY zm@&lWzCdByWy+GJgqwr%&+-GAaEJ-h7!!L_wLc|WF3o! z?p1RMtx#=F%goF!Ob0TxVsZqhYKWwvOie8Gmq~`bP`P%sUkBB9@r;mTD^}&TyVjp*A-A5xCLmheM6XV~~tL&mS@_6bt89_nmNzd41beZaQahFo3pJ=x! z1Lv^gbV!OqAuoO7%TQFYJ7`Hq%f$Y)5+-R`hFXi@!r8f-xNv^~IVQ?;!2lb5jm7-8 zgFiVJwbFN~p-0DV83O{qL4i@t{m^1tGhj|5>?Ch1^2-i@`p!%{)cY zIa61RHkC$%WN*{O(c+N7^J0G~xU_&t^)mQeHbC~()=Ebk!_!SxeoVj^_={(iVv#mW0SKA;-=?U2)A`Z@opikMIog zx2!eg=LfU(emZRrJ3Ja1cH(FHy(ybGgoJnB2{p>9s_L!kFLZ33G_(=ELQ1t&b0nGH z#U5xFat7_~Bc}Tqw2X=iqHLtp?WKLB?9?dSzMUD;(B9rhSmdZT5OuZCvfZw=qYV#s zjTdLEs8apDi}yLqgJ}DQ2wGIH?y@&)aClti(2lQvu;{FaSWGGDmb`)jJ;Txl_ z;l}cO36?5PgArrkSo4@-X+>?Wo%|w1?DJtqb14^JJ6T?0K!{=qAuz!C`4Ya51Zym? zL6oUgqV~A?8lqiK`nTEXhk;T;PfKpRc|0dq(;27a&apAI3PGE}_IE-;!qs59dJr_M zV>0xS<7(z{+j|L7)$T7ime$r`RRWlWuLhhP5B51^6*ROT+}vRp*4J{Sj_*P}VY#N` z12AH!l6+fQF4tV^qGr$=M@)RQ!i%lJSOfyT(YjupDXZqJt|hNIkokDa=CI)sEe%7d z>NTB(mclSE#K9P8+YpTLk=8rzAHLL%{5mlq)ne1NV!|$a=f^FHS+YKyf33gDC9trw zyD>Cqe~fn4(~EPJ`xF)Gv_3+;{buyjix5i-&?+xfOkacIB%PA+k2@VPXDIXZ^b29q zU+4cnXYv33G=>oa&JseI{0KH<(dl=G;=z+?9D;F`UNHn^bus_K1}~Z)IX$Y)Vm`zf ziO1LblE;}A#4}7h7c4B<=@>ICjB)vB;_V?X#WiN13sn4IvXJ*PhPMj8OJm_?aHzzOgy|D zNAFT!(Hh9aV}r{rVKORDnYHCPY&ROuA*JJ z%$qs2tLU^VV7uMxj7JCP$6A#zd}VckUDrHicj;5X(3BF+Qa^3OFyb{Sf#`GT1P0aO zhKxJ+?`p=x#OQ1W&liGJSTgUUN5d^+kcDdO+E8%s-C}bpQ)jWxDyyh~=-K5}AwLs1 zx!1n)32)bp5NCT|!mOCB;s(ApL9949tnw|Gq2hT;@%9XB}CI_ zXU&5JyW1b8ONF=MHZSc{wkx*VV}&o7S{C%ojD2oa7SZMA9-rS&CwZ_UpHTNz4cgv| z=XHQXFeZ1f>;GW1^@n?Y&W!QU>1xn~XCVbNX_&CLDi%JU7u4s=@(W!4#y|kvUmEV$ zGFTwEc{@4!{)?C^cQ}>l=(8!<*t#-mmz#`JwO*0lVp}ItDYGchtmQ-ha|V5d?ElN; zKA4Qv==+sF``HUXZGkx>Udp(0Hjc|YxX#^QI3m<#dGxHfF$E)!Tt563F=a?o0RGPP zP{*uZl9+?8cJpYZWk--o@>(BMfWri4Pz|ajavt9;+MWC|!&q(K%VD~*e&4ds!m*d1 zrG@{)Od46~m?=}s;u0ag(xY`);^ZvGg}C-C3g7)}sCo%ogl5Qn$(L{HB@}wuihXKA ziSvT|R9c16qi0)j!mb;IuF)3l)@k}oUxAOd&!}%AtRp&I&*03=Qk&;!(NGs(m{*Yf zyc)VZ#l*8y$b*)%OHozST`eT+y(&P}I@OtejFQJ}lJ|iuJVA%2t$iAEca64^WfZU2 z^K2?J2`IOs{I~703b4rWC=#H-y|N>RWwGvw%>9nR5Yabv8n(NuerXW?ftf z6Xe&TYFsTX?ZUH5P^K}B=*O~^Fkx@<3G=JhPjCI9H--i|Igk&jfhm{U)vxxZ)A60} zxO6_FWnu~vIXZeP^WDg7jBZ^r;zXj@uuBaD8X7W03)h&*0?!zv`w|7p^ z;-5jgYF0ot?04oL?mTzRnp&PFvmbZz<33!nmQ|O{>QcybqzhBb(@b}x+J-YON|K~6 z4)D>%M~2ahs=D(J=rWk} zZ72Q3J^?Pf)sLFZe7|pnzrT`ZmX?vB#eA0zE1nE(FBnx#Hazj?lb%{jx_$K$mB=)2 zRkMn9t6MA?@jb{rFI)+;V}3n<2DQixObjB*h>p3n_4BuXoF31cE%|h~B_CxiJpJ*{ zjEe89$YIiq5tVA$k#atl=d0MmB{!Ff47qwfiVyC6YVM_&eH zCbl;$)%abL!^{_38W$-2h-n*LX2VpQOlRVq$Tc zyRK5K6Go8-V@Pv%^@2lJ&|sRaVUHG`eC*|=^n*wE-CahQx%VEYd6IPJ=Ts#X=&k&K zUZ1c$2u+z@B<;>*08J+0?7q_wrx!My?(?MUsd)Ib%L>N?&e)VbK`UL7tSJMZS%r#R z_)1tgY0MFM`4M`yQ7HOjYby_pm)DNDqAdN}x99G_Pm?64mih(%5)$2`wCI?a43#I+ z3PGH?z1AldpKsLXT`RX(knGw1(fU1W1=9EI2;vL<#)s(a>~jb9V2qBU!ky2DdXn)B zA=Lgo@CXJqMi`@V611^V*vI?=sgJ3XLs|Ql6wk|k;tu-2|K+cz3@`vD#TW2jbvW42 zX1FbhcUaBfHW+mw-6*HFx?kvmoskvI4dSznuy&=kYf86Wh(0&M#*{cwn76gfJ}%$5 zsduAWs)Xyc82=mNlteM5oR_}iPwHSm&zMu z85dAk1nvv-frShq5?w`P9$&<9t^;Xhr?^D728wXVcedwxxr6dxMl%UFZjeRv7m zm~*(})ZNU(axz5-bI}+-1 zsGTr?z9%Y7KWJbo{Bw=K-vTu>2U0qTkfCDX@$SRg!w_wAZXlv56&|S?4C~N&% z2c^O=%%pNNTXDMQ37~gg05R_e&cWhh8(z}s4I@~z5w}Bb0fcv;pn9QjGIy0A_DIe? zdu{VAMKTik+yy^2Cy$rW>;}j3Jea2q8pMJ5H|64{!K9Iy`PU`uiQ0$%`WBh23QYI8 zr_7bv^Ak{jZD%mUS`F`=a3=gcA{2uM7zh7YpzmS=7OqKu`lk;*{)EIM2V45N)amIG z(RaPhod)h@-1u1t-*0!J=8RrOI8R zc*mKYyCbAgQBFbgEXgs2c(qh6uxj;5*?|l4KKF;*;t#^$H;Y%FNR|k8Fj}1wm^l~{ zT8?XnK)iWGIJjTf<#k?{SHj#Mi|C?qVUynv($yq@PDPmR$LWRU9;ar0U4i$ZLoVQp=Kv1N6u+HsXK$-yj7XK*epiE6IMJnxR@Fzt4?zYnLQqeHl2 zBsP02_CCb?D^t#1@nqvKI=bxL;tJIyzPb;qqyy<_NJS+j)eF1w=g|32Z0c3Jk-1m? z;#?cQJTv-1oH|!27454i32*sfzItQbyHyNAFza3IHH~|2JVIig${4>#3kCYox<)Zy zny<5UlvqJkT~=U>t(~1Ew@1R2wdk06Q-p+Q@27zd4$*E$lIeH8#t*;u?q6=EJuez+ zH*n#+UHn$Hl{Gc^b?wr;4{-WZVr7lmqTmv45(r7RY~PfK0x?*ui(Rm3HX-8cr*Zxx z5M||g!4z9CE6I+Im>v?wfYDEQwKiN?mJZ|IYX*%|t8E-LCMte^ZkM~}ZBpUE<#|jm ziwo{5i?O9NlMszXg+AStk0#gDo2z~}%K%?ZV{&X~8HuTxy4~g6X<{nzLYCbSb{Ho2 zyhj1XUqH;M^-{Q51vVo1t}^{mg35Lk^DXCjiQ!m`>Puj@JU(cO0}9PHH@y|qzT&&d4OFyz5RAI{rdcIUINzEujn;O9}fb$ z(&6DD06iEvrtIQ1JSM`oBacWTF3+~Km1c!n@HNC;X?EN}C_j0q`_5c)lmU!posV8z z{4}?<_^F9C1O8%i5^?Sbik93cDBl;w?R2tYSCnVk05hUQ{7a6jd1)|9p4N#nCRhw;&-*}>Ga z6bJx)8sq>QM+sw&5iDo_A55z!OdxTxZtewUSB2?hwS8=pe>!NPcZZpomx_z4DVdLv zQTQSj5gA_w2~+Xtn?QxsG@~}J4kBw?`|vG&5quF%O zs<>*NSZJQK^I|K8eG(DPnSY@rNZC{4{k*11T-H9#!0i2)`?&hq6ajVA@bt5yQwXkn zj)lkGl~;wAmNJ_2(E@~!=%R(e1uz&%zjwG>Vy)12=Zm*hHI?x6y`|)Quk~~BlqvVM z&uj+Rw$~%lYz)tO0YpIYP^(@piPtkK4}Ci}C!e9@)>Kx`M8ZAUQ*v+vH&a;2=ZHL2;;NUGHV-JU>uv^pr{wwNO|VKoqiuuaC|7whU~Nv*qGo%pQ>&HWuzrCnO#7}h-+nf|YLQY`BDXBKWmAzQrA$u3{8Q=f zt!M}6!WYNh@sT;npZjZ|S;8W{9*I@z5jMXhD<~;+vQyhSYtWcZc{m;FwB1xodTGh% zo#2=Fq9FmDahXSMa=h}>?U|t3^V_fXY91+D)Kgb6i99}PvMK0cyfIHozco4@5nPke zJ0#13g7$MdRnyFDZC?U&rUwk# zMQZhDry_Om5OKyZb*p-<7vA0hjJ{YnpUeuNR3P0D9u}rh1(=&3ySvNJKj=6rcduQP zjwgeA(aD1`#U4y;WArkKS)IFCqY482h-=|a0#Jae9PYLsrdu{=T=^@L1ZFev0wd(B z^L}RM)s778BU$|v*4K#Ow^dAHke_D8@stcF6vu1Aw#pr4gjXA5^GODYzVV?|57Uv{>JiH*sz1~;%jbgiRDIyc8L*ceww`{NE=Kmv>I1S!wm`L zQj~#44!IX#S7e#pZOHM~$kue(ixCz^gv1}J;x4vrm#!s8EQFvyC!Q%22dE-$Ue%PA zdCR^!B564_;XM6%#Zl!HyJK|EPyI3kYOdVJ>F6#6gJ*(bii=$j=?>>gAoDL*@>$^K zyf+7FA0zhzLqXhV*phF6&s_;UaNOpmh_{E*&Tc%K`GBYWM(-%|Hg1baG zsMu_`VOIN(m`QH8SdoCLtxj-muPLnkW!J!hHEbi9n98l%tt_`)qWpILmCCVu2_7*&5ye_MopEm z;3}!l2DR++CpI3kjZSBdgm0wp5OJ$ zQ}8mUiAU~|c{>GrVwl|QU3&Tu!_hf~wt59F&{<<`y!-)Q(El)3eq08=!gbHa?ir`ed1m z_iBac*TGQdL~ca!>Y1iATF^yJHMxmA;qYkp4JDlLys9kaPe@rOSW{|pq2g+MU;1hJ z@Zp~BV)=4m_~*mAixnos>MP^CNue64nl}T}((~W(h_JhNvXx&|&of)8N^V}hG$f^Er*RKUI=4LOPI>xvOPL#ot7TqRJ?v{UCmm_Dk{J=dSn+nqQ~La@TR533 zoq_(VCI^y1^Y0S*O0O&o6_#8v-){)ErOK$S)D4{ow{7#Ed+%eL_u`O^XbG8X;G|Mw z`%h{gMbIFXKCpdMAMxJ@TMCu1009wugt;bF0SH@>u+mihc+gl+1r0(34{ zgBinOdW(!X<#16gp;wu{w-p4+nV^3yZw}g+WBxM?83)|dg86&8&#t^nt+BGk)p~UF;~W zTsTiYni78H$bBTSZ~w-X~L`xZk#e0Wsa@J|);ID~s$ zobiD)cApVJBNv75lbM%!HcSxh)2)vll*QteVd08ToP^RQ=VR_M;(~t0@{Y?yBy{@1 zSKki2ik%N1nu;uxe|UgpVk<+J#XgXs%k8`y^qAoO&r1v{Y)43 zb?t@fUgy)$x8D!WyP?kuXY(15`Oe6(6uyWqdqG?1#X8~4+$svhm`y_Kz#P;}TC8MjaA zx)~nUvOu)5LY?ZJm|4Z(BK``xSuMLbn0AtTX4y&N>fUN!!go&yI`nLUh)L=kVy9WF zfKdO9!H+X^!Cb3h0S#Gq+(y_eD4UixkHjl9Xnjo$_4D98v^spYt}a>L{~tl;cMm5Z z=;eNbR8yF6>vps0;-WBEdh`AU@r2~wns{iZdU+cX5lfG3+F#R`Ef4=NG{p$Rwr?(d zPGThy$ z&IsqJO|!%r%16WJ)?;d1s5d5Mn4a(8Ym8Z$d1KM*r90Z_ql?A0w{WrZWKb<5g=Syf z49E1}M+T(C3pTdc1cdATG*aW^8uN3aICL%C=;-M9;bmoI!jrfxa6=i7>Lc7k>s}Vs zI)_jaCI~>J+?PP7ew!^H`81E(d7{vonws&m3?74Z5$(3130mh({<0TPXd(znBwlUY zG-KPnSB4C7cQ1Z^NWhG~y|ei&lJ=%>d+83f$}R`?MHLkVy>>cDEiTP) zoBUfjk;wJosCZLm7^7NJk=c!AQ^-y3ljN)hKdc)Wb;c%LNYhr@d-st!_G`>ZQ`rH$ z&9@bW(RX66a|~zhpmJrS{+4uem>!f)!UWk(SHbj_^NY9 z*JO6c*>QRxJT%GPAP|4PUwUTz z&PI!oQF12`c*fos?fpu&oG;}D zKV_qTT}L6IS5i{{IW2apN$SHx^cw^OdTjNt+r(5WEK_7Rzyzi_3#t?ny;wf`ka|>( zxvh=vF?yG+wY7=OrS)}7o3T#im4{gVuf@~6gDajpIkAsuvt>58nbO`X=s7xc+%+qO zCbDPjkNTgPmj;S`l_ilP8ML@VZ;2vBkKx5(G=ZWg^sQQ9HKY@yw73dIV0zuHEff79 ztUgpxEG+-0tGBp`zH+R;eKFdxsQvgai;e|A?!d@GBhBwcs~I5TNmgD2)GX3PsKsOx z;|{!<8GFHqzyM?I7{8ZIsh$OMsX`4?2c$8j7_>Qf2{bsgM_7IN*uf4LR5A>8zI!dV za#iLhT4RIiog^)41Hcf+BIYKx*Fs;5-GO7uWe90bRa*N$L~aW1w+gXlw0BlaQq?#N zoNX@(2uG02buT^s1~dJuF~9!gg?nNBY^82{5z0r&#>U35dkf6Ci>Nt$rtW{z)r_@M zubD|YXt(y6nqw$E1DnU!w=GIm(7=A?sna}SpK4X%TD>5;5E7X!i7<%*d{^pV-os>B zw^fxqkTY7@an0WD^Y7vq{q+0D^BZ*|=uS_a3y1%^Y^N;H7qB@qCp$O9V$9)_ctJ-| zRKe?Y62sl1rhp7z-+%0ju{4HZDhf;jIL8GHSy=+^79$tkzPgfU_q}Sx+Q~$V9>&K~ z8t3P=hMU*E@9xhSx&9c#NA&`=S$RqP{k@*%aSgerAa&P?D9I>KMSgeQ`nm zb2al&X1DExO6+|{i~Ht03WkRzZO&$}pO(IPblJEcf9CjTt$xjgk(TR(bXd^$Z{P@N zTHCschI=Zl7nkPi-JA&#RT$U=PCw_cfBKXkHosI@XByPNoVpZ<8yoLn-?ASfi9yb# zIHqd5CJvhK<-$uK41(LGk)}={y;jLgq4uEs9we5QHC+mJlq2A7D!Y=+J@7OEHr6DO zRhao$LL9hez`JUn{^$AO&P2th%@ggvpp1w80?P5avm6-VcxXPff!3 zPv>l_X1iPrf$>O@LTn88cHa&CkuVz-pH7V{9S(D0h4`4~cj{3%C_HoEK5=9UyxQKF zwj629J~%}JSL4QxQ=~kPA#T|jhq2Dch?V{hy?DC12-#I-nfoLa=y+>r1bid9lp<{5H`t3^oLr*U-5+Hyat3Xodat2}<_#jE}pkZ>@B7(r=$KE zq<@=r%1ZHAy~s?b+Tr6_R2N&!k_xaDJl({*YL7G z4aaRO^h=P$%G-V-8EUaN+OujeuclMbXlbLN!7+Fr{6}q3W%)6u&yq8G-4!vnTpmVLzeW0t21v($nVI_KR;UD zwawk#H||?*yJcPDFSw z2gZaE<%fiQ@W$15*BNi>OG|O%ol4NuqCC?&3}lvKd&;&aP=F;IPn(iU7o32#gqMyU z;QD+fE&XZD;j#IVsc44;dvl{b#r9k=gbJE1!ST8JI#=k5FnWQD@dx_Z zV(wAQ^RxfzRH5KGhJ-|reDi<(I?T`SS!-vWN29kB6F=f40H0SZJ3GffhPJNt*OS6ztuI#tT3q?=k@Sf|nAe z9pVTmAQ*JO>yW<6D2FMN*&Lx|^Mo{qV24ID$56Q7{f(uy zdy|&yARS0srB-KY=;!zGr5*dd5oz`|ZB34h^T;f-S+lij{Oo+f&c{?DHI{mUcLKl{ z9&2zwkE>r@#!~*rA+pkPb^V^9z`wG{xB!PsjVcN7vu)Y!NDj60pCNJwA~VtUvpn6U z=p^2$R&O<%MHjN{kp1@zEtH=2ID5r3`p!c<+*HafC5u(EjJipj59gJ&@XEjtPtv)V z9LAERugLbVfyuvW0jfm?QAG)02IvH0{sq3gddU^H?;8#%wzqrPq#TIa!Zb(q#M=8E z{M2H^w{&Hb2g_RQ0JFPTe&;TahT-1@x=GwA@99}fHke96+zcVBtP-a+PwSa8-F&#V zUzFdEM62cglopf5n+|R!21f1?P4*>^YM#RSG~jrXfh+0fdW5zb31P$1AS&FhnX4|^ zP5NPQ$aMJ8==S1s@~(fm+kj!?zZ){!+5 z_nB~!H(-aog)l|3*QuAj{2SzWEnEPc`Dqw<2#W6XbUm&I(mr^oRLq@6x^PnHE^?=TTye zV-_0MAmk^O-%A6$KEREuJB{>g)9pLx1yG{}Gs$mhqu;eaz~xG&j=KkP$2%mfw4}Fl zaFB!puI+3R^pE|OaM7DB_`lDgf8QDu2q8uWV&#R})1XPBi8@gCymB?rAulH<6jFaI z?65I%uf}2RE%stP12Ol({n5y8@!>U;xw0g6$Un9|9kUqyN3A8HKb|7Jt-l>=ins=W z^E|4?ursyyP+z%CJS@sM*nH5rj>zNN9f^6zn^CUCAw|$^0aALbug1A%9;{VI55bwU zZL?!NjB}30)LOJ{CdRo!R+^7p9R68pcCDTJerC^IFqdzjK98h@n-$b+FvhaU?``mt zfiahTWoCHRY?v1vSMoU8{5}h&dho9_IF@fK=4n=_@*U3b_%|w^JB7)~+2l(ka5g71 zC}OrL%cz*k8fkIb%w;;sVlCi&+JV&3qKFSGicEEY^MkZu+IXX3z3h`L^=3g%z2aRE z@EDVCP?rQ^H!cosF?)*L*XCC$&K{&I4L+i$n-4HUC(c&hpvviIb8kKeZoc|2k*!_x0Z zv%5qyab9r#q_aJB?pb)&D7-{lg`q;7kGt~)2)EXFz>m;YWec6CD+qH;d9@~D%)!|jWYNDrXBosf0h%tN~T z{usIY`YoVW$SFLln{zw*0`dT`Crw!+fO2<3A3nKcq+YSLw$BfK)wQg`lXo+6WOVCD zT+}4`!TtwA=Q>m9c5!rbeV8|G)KtfEXdu~3@rb;L4P5%(u^GJ-A&cODP1cXdm`sNh z4b>BbK|QoI(*ENa{Cqa-lP*F-^M}nJw?N)P*v!<|cx`E;R69t9T|15%wiwEVI@$plbB4E1J zrQsR@A)&On1rnHV6~rFOtbw?bRp%lfP)uvPo%*S{QyrBQ1!FsK4S$#{0T;|n0k^lO z4~wZdG`H!*C<}@e;!4ka4w2%O+DU&0`9&-VtQbX)9dUL=tYvxHf%M27O!;y#cg1Mn zRYf1#R~?ul+EU~(Jh(X6-;<*~i>?o~JQqKAYK;e|cHQJ|~)mqQ3 zG?QCK{C(pb#w{JbwsTOsm!K3F>)w|lTlS=>^vdd4h!x>p=xu3HU#~Cxqt=Ehkx@2TW6#Izrw?f`;QR!FbF*-ib?Y=7Q0XVCOn>jjSazXrg$_P%$r+hkm)U? zOhZFcb=YiX*qcn1{NgYxOj|}kfFG0Uhd%tgfO5KqT3ED)Ezqzka`i9fO;TqzJ#TxH zB3Sk6J)tA@mxPuv7K&3ULONs~gndz%_TRi-Pdyr)P9g>Rnpt2%3VNnl>tl58+RTm3 zh-xkco}oa*P^Z1V$p?G=<#%GJ3j&M`P%S$|;tx5xTw&3K#i&srNxT;{N;xgr@q4Te zUk_|gPn{OXdWVkYWWWR~G4U7&N!ljvS=FD0TtG)>AKf?4+eIMW7O551|8veQ535Mo zycDomKdwHU1qo{|*Ev6uPu>0fji&K0abB%(tSF|4U@-&K1o=1dxHjJr+=W+1OUN+% z;82Y(>M49^&|-BsoF2}p_~yeKo%RjEa78x<%Y;mK!Hb9?$I$0=e@%0iB)v>O$>GN7 zkw%awC5rk;|B6xow_WJy)ug=^M!Zs-`%+a+g~4XwpQCMN^aQ5V1J z1!L}sM_*}`Uj1lUSx12{oZp5e78GPUWj4#1n@dw9X{WJ6AN@-W_{oVh45CLxnkHJk zamw1WHn{gi_!;P+f|l};%SGScnJG`tJWM9i0lq1+9oebb?nEhH zZOnj)A6-t~cK8_>jri8_bpPFh=Vx`o@eBseEr?rX_ahXp@r2*0d3?Jw%@D_VvSmzM zDQ|?#B}9H6n3cW^$AI0HG4&6Pj{@rHa;v1cLRBH6@H~b}Su7ov!PC~sI$E10nR>e`SHs_X-%ORy zkdfbkAXf+Ta-N$(#l>%bVPeWz)*g0gml7*|*_A>oFDzo$fOGlUP|@rhv)x2e;rT37 zN^Cb#G2MBJS}Vf9bn#n4@mDSJD$(?GqFqSq+OrLtMfFM{QbkQ~$5B>R7NOQz{dSoC zbu!>52eJm&TRXB2&j?sAfDdbU^sS`2Zf9M?|KZ1${kNzQL-tZqcfjZ%Kp9IP>Wtmb z8|OND%D@y~(A%QKO2|%Sf-OOMi|=knrgHNM1s?<_UBebP4@?ke;Z zXZ&muTeD_xU~3K!mrzt|s0KWp#-p?|zIzlevBN)8&=A<0qOHtgPrVg~K($acCP*TN zOIjeZ5++seNG1Igfz214L5jROq(PVe6k8<6wIY+z24I{4q^ysUYeYnygnV*E$M24n zZ@hI}bY}#;V)|IQ#k8T-*^_DBxVH<7VDDQ*3i5MvO>rsaBchx$bT)+B71RIW!P>phdup*-08PeBX^i z1S@p5tPJT6yEyfH$K%FeR%o2ZX%+POQSR49fdb-aZ`A~#pwuAHH*=v|o6M9s4V(X1 zVbXO+Q(pE=;e^K#tKydi1^>D`&%8@akfz$Oyto`9RK2xMJDPP7^LBU3Sw6Pz#^fzf z-#g-5uUw##G8xg*QuJ+B*1zvZ{nQip*N$w52%Dq(7jDsTF{&~iKrv$_93z|Sqh8WiSJm#kl7$)sm<2T8au9=BCB1-7h}qIUSarEw{J>8cSb=V?YyUa*bp7 z(V3mE5Fix!?Y>?kM`h>DC(Gprt%mh3?Ct=-YczY-ndt#Gwxd5n;q&Ha3g`I9$VkQ5 ztmM2gCiDd!aCtJhiJO@2EYDAxh;$?68h!3jR-DyY8q{?0cdd&Y?i3n{uR};)sa5cz zA*pCGZofZ9AvgH^?g7>kQ||lT4-mT^b7fps?E%a3RCn+881sZmn3zPPjL+Hek?7@1 zn?oFF?!LRAl}l^!e9l}EO+o|-Z;d}v(D7RbAZSDb1@;6@$=N0i?}CzKfibJ6&3ALXO+o(6VwI2`_QBm%20Ik}Bf!_jd?z)o1-JAfcFFMWGk%xT?+BX#e<8lTU= zGmgVaBlabW(~NPQ2Oz~3X$c63@M^0%jrJSESmtrUoqJ*3wVh!cWn~V84>L%r84EI* zEI!QiD_8+y;(HM*4s^WICD&{nQ&xmUF825E=qHN~{INkA?#T>!Tx<0LkEE0++v`SO zY_@GW)}0T_EQ$f?IfIeBIKQG$#;a%IS+h0V!Mm0S% zb0>eTtY}J)=iR%EDfaM)2u1)RiYHE5E7eFz^OG%L?_9*dP(>8^T)`<^uR5zI_YEd` zJ88{3U!7xAc361+{P|sbQ0^FLfBu9=Olj}oNMZu*TTO041f4DDThQ9Zl{o|wVO}G=XeWVF}6zx@aUA%Jd49QSj{n0?Q2&-0X_j(^ejZyL2)s@D$`X z!s7Rb`0`*bICmlWhfRV!KpKt&BUB&m@*z5QY-SNdPf(Bu~?)wewX+skMr*`IWf_@3@n!= z2H7%nwAwVhzYxYfQ!X9v_Up;|S5#Dho|ti zt(Z}9J{M$1c7fn4crz-Fsz^rx$AQaP(ozF382?At{!Yg>sz?pv=c#FHk&aVGPxy{E zP(WW zR@?c=f*LNoDPK?btFm9GvEIKYBd11vc05#qJTI@`5=T+OSS6qh6N9HoXlW&M=1Wuj zlo|R-?xi5g%PNok+MLJp{{f4#$h{e1>EY2yng)7AO^Btp$2Xw7D^M)dmhQ4 zUL}Rxdljlxgz&--1!Vy(*~lzD%KvL+09l*+qLa9ZE&@W344hI3=pI$OJ7r`D`u4Ob z@6?COF*L{mtfbx*IilRBc;p82KXX#ML$Trk86Y{@-8JWaBBvwZS&wN?)M9GZG|?&f z@^AdR`%{iqp*8DMP^(aj`(KltJy8O3eORhB4t4dJdsQ2C^5d+ zXGdh5p2Q50J78^4g4s!BS_NnapwLmgt={f%-yaN;geKZ;?nR(bQHKF`_thu*gk4=- zHk~+lt!I1(k8n?GZ2%v*%J@!v9QCLQ(k_8f9%|DTiFng!j+Jr z!ts-#8c0XJ`B|gCJ-iDjr@`O#2iX<-v3psOPf^e|a$`)cf3LkO-o;>KJG|IwhaGhj z1*t(nca6<(Fu6f>b$hNg6xUGxU2W}nn8j{MYHDe(vto33d`d+Yzl!qvV};kNpqWpk z@RHNFT?1GGK|K>4XXS}|etFAQ(bfN}WMD<3>fkbFCi~N7@_S9z>CMMFC4NfpR5$D# zwFgZGMuj=@PZ?(eIVJ}p!L1~kSwBW14z#U`f||noe_-!F?XFjeGJru>HeUX~Le+19 z`nXEYu~9D`6RSjIDcOM}t zC2=WBw?aPo7MG_}cR^kL4T!Wfu)96phldBx+l?8RrZg+GAs~mAo{!A9(&o5mF|_P; zj0)X#+_K3*1!UEkwBwUTUl{1vN}9Az;Dmf9+3~*pdoO?`V0Lrm{T|qyO@OB7Q6wLw z(f8zmFjWU~_FgWxwLfhO$hwK}^q_l_sHU*V59(!pllAkg!`vkvoyWu8k{Glw&43$T z2SK#Wa&9y#l$o3AK9%24lb5F$E4SoO+TlXf)FdbCrF1ZOC)tB34uziReA zm%b`KaMS{LVr3*aUoB~AWW$^H=NZ_`*sZ;VqJKX>ZI2rGHF2Y2OZlJOiTGfy8fAfrhrjiSy|TY^tFAsRARC?TBt{w{1H|V6kl1%xo}6D~ z`EL`!pDa1qGo>qWt#N(Pxns93?#N2E%6ti#dX&!5&=^@;tcV$jpXC%(E96((M9j_2 zfdJ}=l492Lv5=71#-w#08;e|AyanV}2I%Ix69GOkbgJiFH zb--7&J(sfI{<%>kHM?5)g*O_(RnO-$A1`MOjslKpS%o9Int4gt7*pP@)V0}nM;jrt zqwI=r1j?j`F227g=_Z-j-xUjPKIq)L8%su}GrvI|3SGRqWY6_^7$}bvG3H3>E3RbP zk5RZC4pbo3r!oFsqN$j)scS;HWs@*}fAIjE8w}EER^>?6T_dX-Ft_kd=cQ z!B-@M^QKovhk5kb3EDE~G>H8;ha}2*`n`uA2plhPJU;f$yEX|VduU=y6yeac@W=#XAph37y*efSv$ z&z>CDACdO%7ofqxr3Aml=FkuikeU2s6WHxvyB_o!IsZk8b4i9FJr$WX?Xk0XW}ID& zjC){GORrk}=yZ1xs#=!yI#Sy?sG^;NPLK*^U<6z)!(gyafZCeNo&hf@HqC`g;)nzj zvl<@$wr^ttH9&2Pk4M4FxAZrF%i*8%0WG2wnlpR{%n1+Yb&*pWe+U2_+!I`SmAf7; z(^^}bo5t3f+`l^`WY5?yF_9V`GJu!mhp0ffQ0SZyO-2b%(iCdK3Q(tc{4w|aHKQ9O zgUbOGvzdgOh&3`mgAPC4vJMh!K(#&fIy2g+Z_Lf^YC7j3Z!EY$CRu&w_G;#^>}rgP z-YP@yLHmG4zkcm2(fp$QVVB0tt?XW7y~dZ#FRs!i-;sR74tv+N$>XxZ72VkJSBkLF z+(h?8TvW%2YaV%6#6Ufr zNNy_XEROdQcpP|cLuxQ}%VmIaxa(MJ`j1oW=zjd{vUYvUh%YJX)_ToW`q(Uz(6UvN z-F6{&sW(MEzu@8j{ph58%;Df-QpKS&!ZJP}B$%*{J$0212!e8yjnr^(aEh{P@1%D{ z;h{%+opa;J?$kJYI}Y$awTI9%zg$tMm{%XVfB#sS<;ZGIZJx{Z|6Tqm1sW*%do9fu z9e=2eO994g(T3b{Tj5s9Q^Uc;r4Ja)Qy0?J{aoF*(;RxXWz!aBQl#_wgYi_orrl}} zIjhJvREHb2bJHugo;%L8EW689bXg>4W-^_eZA4>>3O(GGcD`jWnphsf_~i7= zS#u&1X;*f3>Ns;m+AJ%QxVzEdT<&UY%KHwk8gr81yoXVu@l74R3wWB4Tt^#DxMj3^ z4d}_i2eg$E2x3_hKIIOpw7xl0c~dH{*Z63yBCyUE+duy0`nAp&w$66(*XP{#{bp^8 zT-NKUoDrj(Lqo&QF0ATXaC(?Yi~WzRT@TUrQtDmhS#OXDB=KFz?RHn#soZ5_SfQ?Y z)%^5rUS#L}G|ifFwzSv3oSkpNlJWLD$t2ME2lXvUgJ`1fq0Z_(1%MmGY~0g;a9#?b zmK?k%edGIy`!3?2#Nn0eIpeB&8T$1|{^l3Xp`Fos@kL`xuGMU84(so0CfjBNt=Pu~ zvcrjnwA@TU7cNff+I{y@W7(Qu*8Cw!%HIm`>sRJR3OszMJHfbAVI92A#`h^zG&BXY zhp=8E$7orvStHWQ%zoSU+eLg`UjyE?C>}?x2YbOZvp#rQK$Q(z*+OFb zIPS1tyT!6*o#<$lm;SZ?%34Kfy=Rd4?>6Dv;ou7vD9|Eo(O$1&bG96x-O)(U>aTSw z8FtQjpLpbq2NdKdVf`XUS8FeT^;c{5Y>Z)SB;u~PtZvcFK=x1B(xnsM?!)w(0|Mu2 zr$4mMG@RcLJij+ZgM3;qHviwB2Xw*kl0?D-Huq=n<>))^J3Hy>Ri=ug(yx!x7X2Yj zq#hm)_l=V>wMoLTep$#bW=fz8O-M+nH?3V*u^AVlbpsNFRIc4xP%qMX|6$l6Hm|Ql zJhDsC2K|c#{=KB(F9qT~QZfzOajic(V!vv{K9Z_EMG|f`czgI~BoIVrC@U%9?vLAg zIAalUl40@AO_yHNnQac--nRS0r(Vh}5Rhy-E*^rYmp>Q_FiLP@T(4iO=Uk84nAaot zgZf<3#^tNYNrq%&eGRW=<_ zMO!ttU4eD`CsG>DhXY%u7-y3W*&+1*sTHV$c+qPIQhQ%ad~t}0ph&Ojb#0NlWmSn7 zJ>;S9?h4Z7dUoh)__{cfi0`)`3#BHux)QnT^C}0`v_SoWQ zUQTHZ7aaYA$m|7@3JVKQZ|&x+4%EBVa4!FoGP@BxPKu|s*>ao3Ahxa1q$W3)UO1o< z67&F`s#0yI8gBjH;sT3iy9~z1&}q4>1&(j-OY`w1xXygm;5R8X?tK7SRrhJok0i!C zFjV`kTl;Z<$nF*D&9_y~_2m>#)J_>BF1PV(lTwKACE^u~i`uN$ZM<(IxA-4#@Z-&% ze|d3}$;ezolq7+c!kL+O9Y&m5DyM7tKW?><#$P?6`oorN`dpZdJ#b$~f?>a$rQb;=JrJ0y4W(paX}QZ1pq-H=TI6F@+RJC^}LSs`&Us z_xWJ`w*=0itSYmyuER3g$nh z9Fy>n=3cJkTz%s`6RxZsywe4}zcG>NOIl5%cHb&tVPd#OS;OO`)5K+U__C~)76~vY zPPWUxn3-QC0FTETfo>j&{m&#fk90#_=5l6M(HfjoG~sb%gNoK ziGOAX{B_G@qi>VCRp2Wq-=<7V^-dSh!s|mSuQis9Cx)0vs*{nDMd1u7;*j(|C_oa{ zB?I{3K;jGc5~J={zNdRCF|ilM>(+C`L#y}?l_(i1AjAG4^i zSL=Wf4!a*&*rK1*mmMaVbDmfXWE*OE*ynbwto&)$>diD=z$Pv#T z>~z?&nOeji_Q4$M-E{sYu6Da`-jme);QSvH`@*0|lH`gKv+DuLR%_qs|ZQ21yEi@Pm+M63xRnB(`GGIR_4uAHzADt zzt8r;D0;|A+)RNRj+tr$+tB3giV1heGJGm3D(i#KQ?G#EACYd+26i2<*RQuTE6`8ar=hVTG=I9!@^XEY&KBdmp;J5;v6hq#HU3*P|Gh$RpatBn-vw>F#?Vi$ zU|xaVYES+EF-m|KGE@IS#WQ!%cElH3?1v`85>Afx1KsxVNoqFAb*yZ+vqSw z8_0jSyR+4kBAu=ew)OQwXUsxgfo#f4>)tA(c|FqZsPL*5^)1*Z+2s+ab|O&Q`YP-H zcB2g(vJEbBQy-z(MtA;ms~;;UC_E;=^d~oPVNhCUcZp+m+!pe>ZjX<%>v*|fHc|Qk zu_2flHPvKKzY=XEl6Ft*^^OH}B0^S0<@QxVc0b~m<~ZtB%y)@h5M>;;IqrLhk$rp9 z4`Z9P8XZJ;Ld`-PZiok&OO0mjN{2-9);KKR!XRaO@Y3MQCF+*StqsLC80CL1`VX$+ z8kvm8g%HQ5uUEQl^1^;~{=dAfL7Acl6>&~`y3J-~2n(yKs+MuMefEjG!xgH3u*s`e zz`O59Tt3DA`t|GV&H}Udi(1dAH2b;)eHBzknMH_i_`14Gp>DsH=CJmZ{yjz>t3-c8 zLebSu$7Z3Bk~6->;?HHLdn;o+!Y5{S9omJ@@|-UI$qfFox?dL#Q}lZA0uB8H4kvA? z{(}js=ksz{8*LsjI-&1E4oK@AAH3S?gK7nWv>thLP`u1q^66G^#vLwF=gowr@htr^ zE_>Qa15wpnjWW7w`(+{@AM~vm@q(tx%Qy8$igB2YOHPXplO$8@b0VC?wF;lfj&6*( z%+@~dYi%y(QoJ#E2`JA;*6u*DlscC^6@7)sUzh!dC;H`|1Wv9!nGB`PClxOf`;#JS z*9qwA>Vg@p{JhfKpO>OI3hrw;ArQ~4!N@Q)4~USe>WDHl6Y@DI4HGxL9=49{@sVluZa+dUQu%%|-K}d1hvK1K5NpWa893yf=y!roe_TF(#W^2^w z8I`fis5C)9r3nZO(mNIeL_k2K6Qv_1(g`Jqjv`$_np6Qn>AgcxAdwECw*(2jhmrsx zaChdE?|kP>a_+tV&F`EUczNHwpS_;7*0Xl3unCj8b6*s1^#@RLTTW+~Ym#ye3M15` zvyt;s$V@sqU-z{Oaw}C%!Ui<(7p;1$?0*3iRo$LKMe?`280v3pa*5GyAV+^|zE?pp zMN~|2&+b0BZw9|))-zW}+TTrO+9Ewce{g?e=EZtp%vnr2Rs?eX&~Kw!Eo9HkePr9E z3)&SXnQwvwVU~S$QTJc(4c2+wjAhs|DYJ7izlE3L0Y0vP4`M;1aIhK*n$N_Iod_cv)7OdA`lkOw7c!$BJ~%00?lihpb*gaQW+)_$Tad#8Btt$8xN#dm6#-Qm># z46Jt`9)}IZX-RLpDcF`sc~A&Q(C{cTFf#fV$TYNt-m?uM@U-kl`G2*Hl;@V@tWvL0 z-P%!7MY@SJT#y>Sc};i+SLmv7pO7470ayQtXcyUc5;m`XA7&kCh2S^oSW6?nX(^iU zx*wF{x3}v(-^ScaV9D* zI?8P(M_-hT)6OXhV<(!kE)7*0I6H3MO3Yl*5kbU)b9cm0l8+5CwwBXTA17qeP{CkH z1I7=Wc<@nNM!0T%qiUOQejseHzDI5?LYuj~y=TQ@efB8&w!e^xc;uaidMGz%nsG_y z4V&(SI1_LCg_mU$Io6xvQv8_8*#wO)@f81q&t-DnJz2#=MP{zm>TOewD$SZmljypHOn~ZQtNDrkBD;sN$ojP^X_tMh+n_ARMsPdCLOxOAOgJ01rUMV=( z{ER26u11P!DM?7O6{#~YF!Vdb9woBJ796%YI0vhQ#!aWp02qx6&W5Ow63@=Zh0>2X zWtWk+N<~_Bh>Aa2q6uI--6xGCjXyaHNYM@N`S*P2moL?yev4oq9eBt8fcm36jBW%l zp8;C8tEJiG!HX$XtsI7-oGj-a+(NXey6EU^&0~1Z#&jK)y@j9?#45$Z%bogU$!0@J z8Ri_xS<5Ax1byAoVn?l*Kb{>S?-8^zfJ-RP=F!{#D0cs6iM-EUc(y4H_?+_$!S%01I8o3It7GG$;-+ITXzxvK{ zS<@hX|I5%6c-i4vsf<4p0npg%Xf=!~oh|m;4cVDEH2-+I(6IQX&=o@vkBvO1;Ef%R zr%v`hxpUrbu+GSR4I?qzkzg>B{ACdny*N^;dS47QuJY+7&h=asRm(5y49%97OZwhD ziz@>~d}lr5>w;li7rUE`+iaJ{SU8(h2tr}+uHWzW_r>ke(x3_CeD$mI1)-asF_Cnq znLkf7)Jqjy?h3Vb%i+#DuSO_JfvxsM8f_nR_=Pi=QN>@%DaxSC13|=VLmhR`^|7Mj z&J*1vLWUR@|Dx2D(vxl-z1YxiSXKtW@C5_%F&h$7vl~0cHInqKC+$`eG21QOzqTSK zyNCDRYVCi1?1w5(wigF<9zJ}Bto0nZe(<~tnltSeeWY~=0pASeZ1Ja;XU#Z}kj?U! z7xS+JYG8B3or(|u8O&!~BBhtp>_*a60z7O<)4J}T0d5P7WMH9-A={4UY~O6Ed9y% zO?Lp_&BY?$);dSDiJX}c?)g7E^1nXh@Fd-=wIa6%W;d=`u&|CJh{N^y{`{f866SES zNsW;3%-1wvg|RnFb7|C^P(CB&IQ)Br?9`acv=@DZwoP}qO#*ZLM+t|T!ENr>q$sz8 zm#^*3bMKQpVniH!>x}ky(Mpfb+5eTg_>U*?<9%1hx4jA3=Ow1}Gsc;*2pNla@47Fb zWui*;b7S$*sRyztKF_QiD^~_x)^CwoTKPCGa@`w`W7-q!T=o$9u{`z&juMbkXLpv5 z*?rN!lrRN58xo3JzeE4S#D1&;ZZZ@us}ju{4#Y*TFmN9^s^4C0syIOLqL@ur$Z3&! z;Vv0cN0~I1g1a3w1Q-|F6L0jXBcoozft=kXI3LGw@v;lH$ssG7?r+2qhsx_+d7XbD zum7X$8pbs)KDb>!st;iBhpi>u)>j^Dm~v!zR%Q`osUz-7)Y-4<(Y&?=yV5ltOEtpu zI2uPDTUuii{h`9W2tP&tjj^>VIl{32T$zG(TbZ%L4M=hN;86eT)2D7ijx6_%LhjS+r}2OV2}1q*{_qNI9XtPsRpMxij7-K2CL0-8WS;ybciwMJW;#rI}<%kRFN z$Z{#nB~@$1kn*N?`K~zXGF{-uW2YQgzl7pjqqApYW9pP8ERh|6R^l4zxgWA?9od?S zv(8;Ervb^1HH;hyWfp1mZT#FGJG1RUqs2JkH*zEf>t#IVtGiaW>AX6ap^8YTFeo%< z2cm0xOJeMY=~0jR_Y57i3l+X-YYwmePrcbgh|^334l5KgHraDrQd8s99*^p#jbBc0~kqx-Aiu4m#Lj}PmVGH$u(?h zZ)>08xuIB10LpM5>C5hZ3t~Qe@+04w_7z(OmCv%!V5o+l|NZEwUn>AU0Ov9&R`|7= zBFpyp50oW1;>uszk5}pBZ}8BlW{&Yk2I~1dMrH!c1(A{_P)0C>ACgb z$!EPdXT)u`r6msgj%kQZ(Q$6rvhq{4tzoIl_I4#IC^`!%stV_8kg)5k`x(3z5KkZx zR}w;@igwX|c6eXnAfb28VWgO~S=DdIL?vx2Jhncy3(RqT{(Uo4tr2Wh6db@XDD`SB z)z2?K)~};iwO;^olU75;_t4Pro#1So|6Zmv1e8w)4<-f%D-ogwb$qG(B>zY`Ogkqt zliPE`8fDj$CJkD*)I{QsHTD#Tp#kJ~l~COG_JYuugxjz?l~~zx4 zu(+(u&0 zt_==$&!_CX2zEvC6~nU&->KHrz(;9S4KkN~e%$IUu@049l0rb{&>{`<9T5Net_?i*2FlCY1&D7$lolB!FG2y1zZ2kGM1F<7CFNzgb?{62)V^po`SpxdJC5 z;vO3fQUH?zaablCs${j~JzE{uX8}jZlj`Pcbh59T)QE%9tA?T=uOEHpzmW=H!HQJZ0uatNv~=ph zK`7sn(&QN$F131I1hM}tj9p3*1Dl(0znJ4oED(LtnAM92z_Qddy`xyrVuF}xfQ~Cg zS&dju-)q1l0PTF9Poh`w)^=a*FCHAKrnS797=|6XCo*ii!*QSE%!6G(GTMAE^d3c5 z!bG!z;(BJd3_@|`^%j_oUG51yzRadXZe1t_cA#oQGv^P&hVdqtaoFc-&l%)6Y}0Lm zsWY+VaDOqZYP*YcjUQZZf=gI1BzZbnR3=wOntA3JH?O~KIu{ZvWZZnQyY9D<+i=P{ zQ}AMAC7r5-TD#uZ;AmH1h9<}?l;uEbxVz6vUU2(J@BdE{EZ z-3=Bw&)Xd-Vth=(#+MVF(IS*)wr-mc&r&s#b!vZrfH<-HKOXnLci2Dv7rz;baBK-2 z45FUnI}{i-U+qFlEnXq3~3 zLC2!#85oB?ZRZW?0v^b~6lON=L4@RViin74OBF`l4#-aO@fnAYZ5OK_HVn+3qIG(! z9ed+g>EVN>wJX>4PjauRoB6M3x{Nt_4S2UtvwsyVsN!W3Hf2zfpJ`SzKjB7|Rs@bx z_CPCAR?+GWTk>Pq&3vx`!w!*zr|LG*IU6n$+foLr&uE;SzkMlh+?Z*n48BAJDB|76 z4;!2CtHbz(%g}lS-Y9x48CsaF|M3-=_A{rJeSvNe0Of@ga^T-LkTFQ4iiMRYb1wq< zki7*mvC@zvN5&p1Bqe_FSbB_4hH|n#-Wl zfgbg8PrnCBNU9cf7+g*o?UXWSXLIW3FHD0p{d#r^9eT(>S`DzXlFG{pkiT;ak@S(q zHfY>C0Zze!s*ReerB%eEL~}5r$h50*ik$4axZpx^8ba}sNski+)o2v-w30^Oi%LI8 zY5kms&piRNvl^p^CSW;W@(1gv%|6c(5eYn*-g43=@o_7yrL*I6476*nA>H{(STj@v zdur`-V7%)6tT6|g1Yi-kUNP?aT=;{~a@=VRXB;rqMhJ%vl1QLuLVP zGX;`V%Oa=-taLWrDbZ|f($AI40j2xLpQaG6wU6z|z)Mm_ zczM{f4{>o6_m?2_nFN4NZB^9QF8HnGC-*5!md$yhMnB1Ys<;}Cwi~Z*ySp^6}-S%>%IO7p$edbaIDil z(3DYQ(8yNL3`^9x>Ixd`;7_$4t(4&VJ?Q>8J(dLNHj@>f+$;3*$@SoUn-CQWO`K#ljUK2^@ne-j(_%j)OuRafur@!Sggsp2#Txq91rJbSDH&NP8rcqp8=qA zTU#5tAA7JmUbVcDYx(1yQ#v$N5szsm;vk1U5&~;V;Au!(#zXx`>I%fMhTFi{GN7}= zh*>+0%>kNQmo&Mo4p!1aj+z8Uh)v*7D;7IgDg#}U+DGaXH&}v8JP%<3_8Ze*fmhEQ z=K)G!YdBb+S7^TCD-WZUGwy{?4O=4Oq>>oce1TbLDnzg_7{wWItuP)EQr&3tz%dP88Ih3D*!l==0$>e}2GeF=Q50U{JtK>%=t*j9?$LOwRr#qsBb_w6wG|vhjBWaX?V-4^?tL|)b#x22QB_)b62Jo@S*;kSp-G8{u zb{OG%r}=y9P2z^_GP+h14bi1K#65M!ypV@X!m$Eo1 zE*&?#BQESvRw(MMG)+xl^u%TV>7VxB8i2{m-=hu-eCvxC^z=H=i8sr^%j2?jO z;eM;1y>a(hwxqBf>s;E+!!Bzr zc`}>ncWNa?pY*|9CJ%h?y_#BF(ikLE4_25{m&$-vGVBre$)y#z`@{k^ay`slzwHLR z<;K!DiIgWdPjGWaEDq*7_`p+^%xHYJ_3aa&Q5m4@OFeKHNH4}m_r+zuS(VN-u7018 z?uj6gQ`7VE@<#DB9HyW!k9!W0@rz5)Yz?6sH^P9J(UO~ijTpjSzL=frd3$T6-UVY> z_fI8xR~-k$ufEMcEYC&eS6==QcZd%&a_OBJYT1|(M0@K#fTC6P`ZjTw#BjAi993O~ zUIU&H*6p#V&juKlKE;#-OewHliMkCYZTUf`g7DZw4_9&L@$1m!a{q$5P#Ux!537XcE@26T2MgX$VE&d3m~1oTqxAM z!oOFEJ2ytrsT|xA{&NoL-%wHDVH)L(C4&xoTY8fZ5t2&Y3X@*$c~$z!5O_aKT^IE6 z^Vq}pp#v!7{Da}S7g*VgB7RBS3XhIdx>i2~)Wx@gh1C)%oZH5ZXaw{O#!p!oQFG5} z&U+minGK+g$NqkY9>uI6Dx#N$f2mQRiEG_CAH@Elc3=)xFy2Cgz!gz{0+e4BS6);{ zLg`dSt6sWqrEqcYy<|kDT>KmANM|xpc%6t!d3&B~mGnJwx91h{?wl4oVqKn>Mjx}| zdhFEc(De28gvF(VneU;(ks87zHvq3txrGrCcj%R}MlIkfueX;(u`n;cQ#C+AMyLC{ zPS~z=?3F*aOK9j#tCEhr!5<2kx|yC-id?Ml54reSt9Dmra&r_{Vssf6?C_3c16Iw% z*k*n{&KRamjj6<~C3aPg1N&R`0gBtE7jp1lRxY>46~1MLa3psTqs8Fwz`rG{u7k)- zz1+GJ!YGLL+|c&yTq2oPpQdpl9bOI8N|tSYw^H%AV@+w=!I;+BN28Q)Yo=8x3RP)? zoSex(QcDxP(nk}50&$$PTj`KOZE-QTOB&mTv?OoVmZskcB8)t&-&q;SFaf=;v}YHX z`0!(3W>kq>HABDj1N7}(K$W0>>ZCHZjakpF2xe!ma1&aOU<37au-!o?-nm(bOg!nWVOtJv2<*TTWL0T)~QEH~b$bS|su=<%)YtQk0) zq$A5jtrG*MW(t$rZ0w+6Pho{yN5bZUf)r<&`l@*ho4P#zycDUloX2uR!Z!7jD_kkvh^fj=DL zeeNO+$m$29_zpK%J@7?k)1KgvM#|90DTSrZRSzcVrT*);|9|=iWiy7I z$ye$wv)Tdd4!!|=wX0xvvAA?YaO-Ov%$xV;Y@29Nj*BlS%0b>CUsA&xI;_vw1pY@x zWd3#+sA)gglt=*wze$aIYnU(ZITXH?bTXc6S=6)LN?b!8r9b2{+lYjF`;~#3TDhO4 zsU$RA>A1UL>ezYD^M=WAp$qO_u`52uu*T6y{Mn=JTvLrWVU27%bmr`}!181+-!<#@ z9Eh!CN+(IayL{Gdi8@psG?;A0MRxf;S{Q>Zfaun+(f|@F{-(7txIe8KPC5&a#OSpe zuO(JaKWTn*UvlTpoKk8CaG$XJo)(a_IaZo(8AO1&&C^)xzkN}koQZ>kM+dBDR4qqs zrn}8)4P{EBjpBOnw~cjP0S)#s4nCu{>O}M z2oIvfeDlofWrb^|L&nVqJci7ffL*Nfoa!1z!Lm@nE7G5U5z~^{-lCAcrr`bkIm;-l zN~0Hg0lZPXnjbG?Un-sJ$d}KfUVp*FW%3bgYipP9!AfDa_Y_lSyFf1i-`m7qpRLrA zIZ5@54y?JFmIj&Fk$Ys+vMjSXHPsGP3&o%1tZ-W{9_ta18EKq-rAXcz1VUgtD6|v{ z-6cR-H@ffdGDBKttl4n9b(|E$5i9gj6&%kcKLrq=tC+MQ_sL+`r9^>YBt;5>)}Cs8 z->ET5IZdtxTSq$HNQ@4rG34lX=?G_?62DaE2mZdCWvJD0W+CItpFeMwPJrSP0Es*O zjMnBcyz?X@Tvjzzv3?^Ru`_en3a z7mUVsR!$^V5XTh|FDCgC##=PnK&|lX&9hhU_l$TfWYYXXa}PO;zlh6Oat;+cT$%=Y z(1X)V=KkcB1%+rlw}@{)p}J&fm-_gqpH85plgXSWehHg&kuTNTbZZUE2THU>OIwU6 zeBak)TS97frrgP7^LX^e1sV;^F-g0?*aR;-=emQoozBC3QFHH~pOac%(H{s6bxDFX z%sRKfn%CibC(-H-&5Hk)GDOdC!=%9#Xx{Ic9-HW!pVzbP2z~Gg!P4WEAzRXM7J4b5 zX1!aKqL#g?1QtQP9pT;3X->IwBLakR%Q@5a6cR@W5O8A&a@HZMJgT}yA~K$%PnV>p zie8~T38_O^Z$9S+a^KXSmQ9K!40v+Thvz_MgeaT<%>JNfDqV2-_IU_7&EJP>wxp-H zNDZxdlf8KZ(r}Gc;u%Y;zhVkr-HN1ixTcq(hayz_@`jHp8em#HGWBYnxYR@q z3MCG_XEdTlOYT@4S<~8=p3q(#tk%q`GJCprK6P3{m#$T5LFb))!03I#r)%hdYa<_W zL`b?bGc(1gl;dFNWF(tjcL5uC^muc;sHLEaqEm(QgaF4O>1fR5oXivbdcTkqwzueQ zNB(+~KU||5w1q781?2^hbVii4N<=&cQlW2aR}VBKKM;NU-($n|;LmSU+E&1yTsdD9 zIfFP#rBbc892>M%5&*KFrq_K;fw#V&jF^UcAlZ$dkZgLSI2ZF8+>#yaPCN!Lbyr^4G)#5gnCaUFuT6q zk4lI6u1bm%E;X2#JEPS@HYC7c-aV^RzjUP{ey5y34USTvH*y*84YCf|mH1I>(>1O= zM4^LB>nhy1TlTv4Mk1&764$g&GimMFJ(D#6cB~e9E%}=u;3+v#ZcOde`N7%$u}97a z0`NHOyY>{{c$D5CA*%+MqS0{DN`5?qQHbj4_9siuP0|Gn)3dGNDw8DNRTbD*gwkBz zu7nq+0#hL56J!QQ%5SEjabxkz!uQf#op>hW$g_8 zf?u-ESm`R`w^9#;Ss9p7*31VLqcTGhsE^F~Z5;^=Cm*aDC5?ESre;)hmn*u#8D$#W zxAm{rQenjWVvdyWZagZXXMBHfu{G zwk`R?hwlj@8$)ir5&zd{vf=9AgHbXD$>cBDDR4=QH*Tf;z}nn@WjkKn-c>joNM*%y zMH6o1>H5?^*Q>*zICI}{5gkZH84d{0*8Xe!4KaPdm|_ztmd%E)%Bzo9^N8Q|P2 zhAlS1qDT?-D-1xWl}Fg0r4BbwIKDUnMQl2c`(lrl`)r`myZQw(8$X&rcN~*WT?TFp zcno3_eqS`Zg;FM5_8D$$7fpM6jW=(}|BP?4ToO7Y2Yvw)stHp;Zhc7-hr4zgW!`%u zItjO5$TfSN8@26x>QD6p{Pm{!Cy}sy`^iAg21RQ9{ztIPFmR)NZrKNCx@&P}Z_%w+ z(z9Q+^Sb?Y>6j1K6QLiuy(wCnvcx>oW!$CGsq$WEiyoKiXWK)#zeTAgX_nSF7WQr+l(R0t zQORmdWZ%x|=Gr4#BK=|nKo+;i0$_5zB_zolBpz9GTEIuX{dzWp3nqHq1YE?iF*9_JU3GMu2gAO}T5!Y5W;B{^!OXbakt60baln1aHZ_2s zomJkhZ`fg27;JL|SlgEOX0prs>19NB(YRrS4(y=7OjgBJ*hrU&;!sD12Wa0y-1q>Y z_T4Ah1dD)|h~}(uAT(AvD+R(Zn63H@WLr5`>t#I%1P};2=7pcbePHe%E8DxqKo0VsbDcRS z!Oa+Q;a!lTqK`UPsr>;j8sBjJ?%Oq9wYlnx+dnPR?K|HtjNm=kZSE_6{xiLGJQVs@J`oqaPk)h{Cx3sYULGiUn68@eSy;>!?b}K z`lK+}Kos`_4yU>gAOlN{9Y1l$GBLmM?bNSlH;^UC-#cbaKp0rbgzRCW&^)oL_Tn`_ zSdCdCRbL(F2#1iD4^>d-R?zGJnu;BLZ*&o~=|Dai1}i;jFD@nVFWz~dW`^HNw>l>^jDGH zVC)w<-mU`{d_)18M+mPbD@gHLWl5H;i2T}T(`&!W0vGbNU(Qlczv2V zn}a9j)b`9T*0QaJx;@a|^cEN$xK2XAqS>FmFd>EMZ{xOw6Y1c-k2WgEhf>6!-1%(> zcWC}F7bU;8ABq#OVne$Mq6Ktj-IPUt!@Wf)ZmRh12D&rRj@iVU5)BE!2A)+iTs1880G-26N}he z{Z{2#xzzq@=! zbY(PY`Kuflfbk~M$Dl`KDTZN*ggGD7Tm~rViDKNLk}r|n)<9qQ%uaIDgPRNWe3{G_ z&RliB{r<`u;S*oJoJhaI#Gq0i+wF-Tt@?8P3cB{ni4)%?UiLpctER5D#+|9TnAz1K zQu6GA%jBWllTuljO3$ILr+%^DH zSWIggr*^9UiADbEPp&gKvNQyJdofap7xdm2>E+j-m;xscDkD%_ff2uboLtU_TqbfV~M~@$8$*4Q~ z7m$hUfFM}=WLR(GR9Ee7@4hfztXSDfJ%nWW!V!&F;m$!(@AXEfklmSIO)8%;D)_jE zf^@R1PmF?(r{DO|0OaC-3j{k22>?VZ+8V#r*WHq5C*ZojIVQ{u;-AqFaKE^;K6YY1McY-K1EO0I%soG9ZWM( zQEY{tV^}J5O~OJ=p0uwa`ZIxf>O*uy>y$cIFpoi$9@YV%oA(S_?o=)L$2?VmMMci4 zJp~Zeb$g@JEDg2?DVkC1-<8bUfIEi_5CShmnA+L_C&#bX9s(*t`t+Xv+Hs|bD^2C_FxnZ*Ikj^iLJFUIrBt$A?I2gX5L`J8PLf!%Le9&7qlOED>~7$%U;i5 z@okPTOT%(SDzN*WW4jD)Ceuclr^<41z#MOnYPl}D>4O-FdSYax=70+M{{4^lz%=8M zTO!p7jTeo=Ts@W0)VgxNpP`V@NdM)sVXv((c4Ju{AMy>)U*wf%mcqC@n44o2eCBA* z=Xe%S5+!hg^Tat4=jbO3xLn+DA&u4Xn_c{o;~c-s9vtk575j9K?#y}xTu`X>3g7Tp zvVe`WxqnAR%H0f~vBB1x%(1xj%r9C5h%{Rpm~xt71-^r{7qmFfB@Ne#21&W+fa-dgJFF##nSSq(*UC&3u1kfJ|>VTqMJ z2t5de)=u|k5F-i$R@$M7v@pP=lHj|3l%OHvsh-a{{sqT^FJZ9LajLhr<=>oLK1fa0 zRDe5ud-)pwNl!7>I>oh3T@;F`^IokE$Sl?l*z1_@X)qgiUE%}~XsEzxf6qWESMgZC z2x!1cNa82<`RLjn7pMmmm?g#@wx({I{8fbnf72wEcYU->3Qf*5pBOb*`^Iojw<>>6 zMRy?8DvrPU6dH~m)uo4O=+s&12`osx@&9VITH6=1?-VO67#cf3cQR25`nd3Op<%T^ zrvq5z^&4z%QREcl{*aj0UvFx=jw9P6aib*-$XZTtL-?B=f>!_oNYs0j9FTK|UO`&; zpw|od12elWAFa)P;h#6Lx#m3Z*AKsrIoS_rLAjgysBT`{+>j*}hj%}L;%v2fA0x0G z9xD8HroDaY6)GtSY4RZ!8Kf;EswImbmL}}zW#l=knC`W=)cYbo1#w)+PTl)7kN&(lHmgB>`-7>BMCFZ}Uwk z!xbx@HX*$yKLr5?*`?z7P99301dF7V@@2OzQie(>+IWb#6Wxt;JKVADNT|I68rt)( ze%%VkMJfo$mO)J%4nBMp!~IlE4O(El6b~u?Z!8f!`O9Z>3O^I%Wk@wtz{>3SU_46I~C;GdP@`qH0 z3PSbI#tat*=p{xdJts#1c*sdp!6!vBi+NjGz_|6IH+-rczu{1b8WNV4s_|;a zCi*^|5_Fl+^s?&KW-ZhN`PyB3&Gw=`{cqiG?Ap4is7S`$*m-P8NZQ5!u)LUa`WFrc zzEo-FB^u0-a{iH)@_TG{McQlTBOPsEBlY)nhXtXq%)YBKH^4A@v+z!vlx6e!Qx{aS zmu)qhlye(xA^@WiXcf7b4)x=MAJ(?BPW=2zM1L!#f$uy`Co!ah3t)!9gj*y!r`uyq zp;8rOoG(U?K5;#8$KJ93r9Ne%7OAR5$#q#^gx>HIbKY%Ic+b#NyOe@x9KV`9?=m z>N+ymJSr`-*YljxJ|T@Oof-L3{ccOvPd|U8qoYGX_Mw_dJG$e~ars6{_FEv;lJ?YV zT9&f?=B$pfvGJOAr*AX?Xqi(|i27$sMbwAi0M3%7Gl$QVSM8vb3cW-TvYh>m$IX+) zC6a&gbIS69L40>$Ex5ob9XjJUT*2_S~?S z)ko3Y?S0rlm1Z>6w)x#jkR)=?Wzc~;+)c^%aozq#uBbma3Be$q>=G9?z|hpcbDI*< z?DQCz6)?Tod-<9)u;njDJWg`^K5Wfy7y_gHID*_N7~!pvter`)O>O@lt5s{#7l5P{ zT~@NUzP|o)De-MtBL;*dPUmMEY>yOWzQepZ%a&16a?`2MxSn^m!|YuJal*E+ZhtC0 zU3$8)7atJdE6*#xdHc-#5FdN$dPnmXspt-UN4vJH`toN3UV}O9Fi=w_Z0af+(*nts z-%BrAwzTP&pADsswKtBTnNQ59u-?ix8>?^u$wgtM-FtU|(khbdQfkA4Z{qah8!dN8 ztb7UF`$#VYd7Gv>^tV7S!5+%|=-je)vyN)Ll5hWb^=3w0o&1smjWg=EFB(rM3J~}V zj#VH#5@wqb0fZwp#cDwrscrI_zaS`G$)_bk*1({S^!BtR?n5+E1ziBsOcj*_;TR2O ziDfS!H!IwYj6R}k4TyH&Uk7nu3Vy?rTfX=x>yhC${oFpnAl=dEC&IDqt9<$}buT$7VZ{qPeDbM;+?*VX!6cX{zQuqm!6X%^I$%B3tF#i?B&@ihIoz14wjuKj9 zfkv=cHUR|P8;?tSOH}Mf&1$pc$>!zHH22JmGaf=Z_cN2jc<9KF3(cbqdJ4hDbgtcO z$nWbr@&c#${4N9Yny%_vg;6%uZ?}#)@kn1OOJ`NUalDLw6><0}UL1D6BNcH)(g3k- z=R2eg-zU!x7dH`f!>Di36Tb~V4YVrEnH|XXD*R|hBdGhABju;u0cRVkowQ>?S+n3U z*jk+sqaX}zdHf^OtpO2m(ZnqvCGxi?-}LZVmayo~!?Lgi?BM)Gfd*iwW0th0F_#*{ zB-W9iQRc4kt-)hyaPBq?tNyfM`q`kPhE5Zc(8p}@Hk)K7wwxTzHdgazfJG9#&1FQ$ zp}pO*tt>&*dahT~14LF_uydy)&+2oA?4jwHTVB$gt~92EoBVWQ{S7iSh^Zz+LTYd`gx(cCubD3S_@i?59!TwFc zxSO4E4-^o4E(2?Yq4fk-4tg?n=Z4ozo4!%4sN}&$KxFg9i{@X19~rVR!|_RWfDORh z1m!TAU{GM3%-rokSsIdVuxiqhz~ADz=a8<|)wUA$x|f44mq7~>;hg`?ddag>^;V@x z0#)$sJ>aJWOAWr>l)C&-6fw#qe2*4OlhycL1&Z95v6i^wQ9;?LKfkNEjI9KOE%e#i zz<^sMVruGMIXSk|j5?T525n_exx<|FdLwyiAv;wgV25Jq1I_}LhPfi|^>0FS`vvu@ zSx&qI)ov&!i*TOx=|ARhfk6i;TEuq9j=TE`+CK3s#qSc{nIfhXl-4)NC(-Nb#25{L%8+^5?x#YF(K;GA2s7Hs+m#15!ko(gg8go_VPx z#-#bg_vn}$uQ-n=%FBCZdcR&Lxu(wdA=H2mt0lW@B2!#xs>djEC1d}V!e9N;6JLvZ4sS3F@ zjqKfBH>FEt5~0AOjY7ps=9_@yH`fxq)MwfK>FDMLm^FA^h9Lg6A-Ejoy)cU2&IH*;@qD0Dkj(EYJndqIQ=(8+6B8skiL6+EF zUsacAUYKRI*3)g1SW3ji(jL_}2!Qf>%IT!%--}(^T2Y9(?rr72?!W((W6TVmOg0|4 zw9Le1(d|n*jeZa=18IWzi8Vhi_!d@a!saJ-uP_wo2i}R^cjzA^D+<-O?;G;x0{Thx!Ah9TC#GIFb}&v17agszPtKBGpKL0A-aB=j-<~z&8N(Lae=}^G zkbh^`c#f~G)(7}G<_Isw?Q8uHe(i}Av)v;(>1rv>nFAYU|CRP);*ayy1yspr%5FP! z3Dn8Bha3{AnN&Kch12j-r{PbZVZV93pnk8i8042ZilR7)-+&>fp0bfb?fY!+0dwCJ zfN2pa3N^Me;h%NP8-ziMUF#TO zzEAF);?4^n>}Z}*DM;+{U9QA_p>UUKUBy+>P0pwg9B=LgVtgu=TFh{X-Dr`5iC^|kAmLMId zdDLkx4T>JDY2Pb&2T@n=lU{s#$6~x!)e5GbVI$g@KiBuwk~BY2>I=e64n!yOkGz6O z(TL}-xS&ShI0f$bex$F@xPbgI8`2hE`5eZL3V(CfF&^qzvt==~u{`KCpJM(vLECN~1so&si21ZrH z1SAdaVjKL^oyH_bQZ0==_PdlY7r`9M?GG{e4SAwbnsJYBh zhqW_NDt8ENkY^e*3&IU+%y+|OS`{B#9xNru{dFM{KNh&RtUA-BJ|Kae_S1JUdv#W{ z0Zx7cq)bbTfgF%~d6XX6qI3Y0-y6Q@G9UjcLzA8DM(elYSM;MwQBq6V{Bi zb)*R7oUQe^dIjBv%N?Vh2)0vs%CP_*td}7$F9i|-q&M?6Hy)<=EGDQaj@7Q#&k^Pa z%iI44Y@c9w81cPnhWEWLtmCh5^1E=GbJ8E>%-3+Ya7ZB zMaWAlzFCtI2PK;sh@G|LtU}aNN0pz7KOLrKT*8Nd3PYG0@P#ES{s-2|)H2N1ce9@dv-2yUzx6&5skA5Lq9{^nf?0K0E}!@I@>&lc>dHpub``*ILv0P z^3AW{1{c%(3tra|fB_uH4eypZp29T1vT-3i2C_F%GkBN!VF->hwj&WPH?GBj+I(g^Eau*W27YdvZ zi4z+grQO!FFPSnq4W`dq=o=1Ks@8K48Lh1aD>w#eaV|8r7ckQ1QPK!r>)ORj!#dF;eN53E?egA_76z`3RkpUCDKP30k#W@DGzLO&C+#qul~Y^G zBV5A!ZOrH-V2^N?8oEM#NmJj=l=HSWTUke^7yNGM!9E=q!%wm^cWkovIjH z^)pyRae6J+)?hnnbYQjFjpakwk_ijAgnj|yU>2MV++7F#D2F%YG`17%_w|}iKtNLU zr*K_^^v^#i41FXvCeF@@##0>r8VH2bW=*MySmHG0s+VF^MCfT@X(eR1oIn)3a|xuV zhE6NeDBU#P3uT=L{W-9;mZQNg@yyDPoPOGKV8)2Xk84EeJXtKeL}?z#-vbWkYw>{@ znAB~za3$>F!~J#MeF|1tR|uMY<4=P>`pw%U@RFEK3m7%G{KggvaDqkcE+_d1 ze{YR`?h1{p)wJQ%qJL%qfXi*WPckq`uD^u)ZY{7M=k!yqR{^pUlR}MGB$>d*NKpVN z7XUUGT%%D70+Sk}cr@HPSrq*Y^C>x86uBK}gF>PJn~DdFl+29yQ>O;N53b;QSNHqk zT--h{hxg>SmCrNb$Bt**sdc&F<;xjdfj!m3cO`!(1d#9Wu`{=#{vXobJF3aF z+XJ1kI~J^2z!O)a+8C53{ONKvz;_e#N0)0RIgJs{f!^Fm4Kl42UT>1SlH z++Lj?;9cvR^g#$hljF9S{A7H0frnGS+ZF}Z0#<^?W%9CaHauUS9}Gn3!Li4>=r~g! zmS?v1iM5R1Jh?M1A9d>lX)v&XqA?`Qfk*yg(Af}Z$icH6R}I^@e0PK??P_W*cpoc{ z@BU`cNFz<)~<|qo|Tm~jR0GI*80gz?ReH?)sSzgwG%VNK|;oPg0o#V z;7+E5(A!*2SNV^O9j)u&WQ@!1nPWxLu0x?SM;G7CxW-uf?P})tX{M&b_=>H*u?w$J zU%|=z(PI6jtoP?M0 zh6e!3(zLJqSFgC#)Xf{oZ3I6$7-j70(ug*_wb30Op7xq^zq+DsdQ&jQ8xVY`b3}f( zv72`XLm1Cuer~5PJ$|qSy$up0v2uYxrH741;mYI>N)tlRVM`zU1wG%(&$me5VXXVBX6SJRxAW zf6nW79W3$l?z%dEQN^GRoA~wmFg;@F7!Lbk!d=BqNoIIGy7OTFZ{`DBAl%0)aq;-3L#!OGLHDA)0)H!)M z(Q`OOFdF3in;{$wTx6II8VzQ{MCiW33d<<3OCJ7=&(5#g4%~skZlgxyfUE1dNSL%-Xcb~?qG*~-^Kn3T~aNu9;)-k&061IvyAs@J_*E#N8aDw z(wB1EijK8YXTOGZVa?*!LKRIBV7FcDXxpUs>Qj6gJZmkTc9Cg*{mYdw9Tp^P=C8iX z=`Racd02lXH&({7PKn_;@FU+G$`r%D(Ds=bUG*I4vG6(5ywQGg^}Fq3HDG?dRO)v@ z%Vy;(dfZQFi(Bk8#y_bdHl@kS7O5N;|VqNvuoOotY_}@v)y_ zXY$IGMFxqOJ>J0?=tJ%i@M(@O-FHR?tJhVSjCWt}=;DpBz(5WqD4#vTG&j`bPiika z>MvC3FZ^;>IMI93q%=O(w3o>P`W?Q))w`2P4iiwTb<1{^m|~R>%_CBHjOUvCxxhC zw1Z%URGsr~yJ>ZzO0q%MroVnrl%P5(fQ18lzzWn6$!?ehQLpCByJeYz_x0@$cDl|_ ziA4$zEXR3;oY3hTJ@XQ8kaH;#D^bjM!EH#u?U&4nkkY%t=@Ze69Y2REj!`IeT0vrp zo>s_`+c<8;voS_YWMgIexJtnOP~Zn%*P&o?jWJrW>=>-%Ss>LOuM3sSYc|USCPJu$ zeP?Fp>bYI@cbAWR;*;tr{%-US1;G{BY~Cp(RI{N%G~=XH|II-d*J09wxeE9t(Z&Ln zXgqX2WZIoz-C0EpaxdE!TeitUjVrM3D=T}8sty##=r_H~ ztVqV+H7+_+Q49$qXfZbYctxDb!yY~+Zdk>w75fQm5NLZWoGK4aCxfKt15IUzVf30%hkv1>N+T(n%i~gPM^V^^q=I=2nSf@VjF;QRoI+mkn z)CDzk{8NX4Z+_^Pz|yBdrC2wo^O@N)K}_2CP4%Hfr7a1es$$}Y3X=z03UrB^>KWI9 zCM=z4&kqy^+wC2%EfW5zE=o^wG;}5OE-y!4wl&v?krm6vZcIpzu0;GKn=sRgmisH4 zT{HVzpBPudxX;_cUaaisn)aD(#X!$!kKN~|QaaP1^?Ed7-IW~z;UAA^hRL5Uj+C;U zn<$$mZ>+lT2!2<$NlEba@v6IqQk1e^1Jvv%U(rQs@URG$@`pTWPU#HrT7Ws)U109y zshk0H#6cf5i-EFL%S;cF(C+*qwGRj9ro zT%!e~?4+e>#KmM4gWMcZKY&-RW&uzbf+pDoGJ?*Z(+}52Zj-5&Y}<_wP}@5;z8T6# zMafOQk)!DKX(H+-TNx83AExiOey=Tx_}yFgPAYAU6PJ&4W(#RkmDX#ldthanrYm*kd&JPrOIxYQ}0>d;P zy9mY>l-*}{#Oe_<_VXy(1a#_vy*B2I%nOZgG`Ar>N#kdpsbz3gH;kQp;_)_d%pLhRSq@Yn^ZN?|3aO?j` zkYI11MO23i)PE$tX?#fAIIyZ2#W>-!J9Wp#+WgTjV_Kh)l_o2b2gbECJl3+NeB+DA zM(@sBhFEJ65^z+x(X_s!;47N^iA6i4ff_OK+xY50vOX)pYito|CYP#p@ioH%+|e}= zhz$$Unzg36WK4l>WbkfNGZY$1qCf9Ku)FPY!ODX>O~rm^cNd1cJEnTr(^|ZI&d+7l zZ7>$@W3!Z(kEB3OYjw+M|KyyUAzKoM!Izy$N^(A}y0#?x#1_>u)5w5ZshncaA@bnj zM`QHESjn{)qLx>1s@z_(Yn+nO&-c$H)&9eoh}7*9D-QiXWJ$$Zt&9QUxyWr`85Stx zG^t87R(KDKqViO~YmAE}dxWx!0`57g1*4Bya9C+oP0QZLR(TQ$#OM`$grH=C$nEW+7bL$~q*-lN}ofz(~Lk(s>?6tBGlkL*8eB9xy5L%-TX87-& zN}tN!60+R-Ie_O7Lgm>sKze!EB9rk?C2P;+eyrUhD)BXFv)kX9%>JlY@`f|bs^`79 z>&i()Ap1~dS8YmHdX2rWn~EW&#_7jb6kzQR>v~dYxHrN49;LGt^2Z{*(ijc^kR86m z*uzC9o)jZ;71m}WDM!PCBD57xL&$p;}h~qL~nGdNjV=lx_nOaV9*~I9@ z-wj=BR$CE*Mt!2L<5^R+=1zUkJP=XdmaKy%4!Q`}DctA%*v5aNXAImLs)1M!xdp7; zIW6xC-@o5^v}67gIUPb=Pl8#jW3V^jgc6scA z!^FMG)cMmYyUdoJtCTsJhaX$ykpF-}t}kETX(BKPI$QI~hK3PY)X_g`4=SyoYFHwk z27qyl4%nn}Ee)Y~g7)GyG>9=$=!c$9K7n_s!=hg@i8bQbu6QxGEAh1YHj|_Z)s%o@ z_&(C(#f8lcW%qS~;*Gx{fWx^2YTYh7(5F}RL`Q;MmSzo>R&%>$y@ zUY&4TIqb1spLl!Wex9=jEI8d}x)nXia}e#8hu%MhQypYtee=NWi2L$Ki;*uFx_*|r zRv=Yjb1`{(5-qZxBt15?-Kyy*vj8QqgzT_z2y`376DcC(e~^3*IoG+8QI_s&3+FEi z_nMzY$rE*#(y82k1d+0U_YFkEV9A+F~LlrD@E6;E6q$LE_R&(uHom#_us^F zxZ58t`B>h}t69YOJfG40P+Y_r?(^ZrO41FUfXMZl71Y3o2110pDUy0Xt&YEfq9(!8qPojWxb(i0EwV-;+qjuu#VNrI^0NW{4c zZdeE|*Lto@vAS(7MY2;JJ-*78zeCh=i(z*4|92a+nD`r_mUGkkl+B~neEWEpME9#v zv==3p(pik-*}iKf$iTkxT*8bQuHvFy*>sUjuRe`lCOw@pI%+_`UJ9BQ4%uK`Zty_J z58>KIU0J{Ido#F=_d;(}`9u@yP?xcry8L35zvcN0bSawDku25+5tU@9R*HSvE0n`-g(m$wY7kAiM`au@y0^UgU+7DBRT3 z8^)*fNHd^S@Fw@6g7zLw3DhU?|l z`Cbqb9$v(=P942xGh2Ih%d4mJG>z*RWWAdO%RDA@TT_O(u)4BLRufEr%V1xoL9y^Y zmn`3h?VUB7j{dNaZiPTkLn){PdCU?us+!rLP$05B#Qv%DjPG88%%t~4J@4g@>21WZ zq_L3ONt@MmdA`eQAM=hI3@X3bDdBqKL3N`4C~tb=A;@SPct_=9-0CnH)8MyqvXs+9 zx$=jc@HE~ue00pJwIra75^367U3bC2*ZQC}lYe>c5iCK!pC7Du>VB7m!n#{Vq7g2X z1ztu>(yspmSmrd0uz62!p3qg0bn47>U#=H=Mu+5(qw{NaapO$TRoG}IDw7umM%paU zm*D{xMHMyOh3loS`u~3S|Gkg25&Ef3Z;?q_H{o=kM4y078lS0{d1K&9k;-E%iqeWA z7{VR$_<^2PzeZm^(V+JT2LBDstGUFmax8a1VN@Ol6(|{+~!(NGv%cn z>b~`J&56V$p}DqhY%VQOM+((2>0y+~2F&$q*J?r)wV3McD7Dv6p&$^?j=CD|)_RSt zT|oZ`<2R=Yt@RcJ1c6&lO5_FfM}scm9u-(tpG0gkX8A*4z`M3A`6*w~#}`5zlsIO8 zr0RBdG9g}^x{2~b)=3j(aibG)_S)okj^qTdg>+N=LzR)IB4}RlIH=X8PX_$tRX=3h zOTb4Syz{o8KwP+D3_a3Epxu(EQ*>P>cpzxcVJWQAph84X$0C&RPX>???@dTPDfw*! zqGN@w-{JYob2?Su>Ntnfw=20GPS+ZtLUItSF~hI>CmGLI@P_hkQxnCZP;2EST$vq92l5t^{VrwE*!1@ z{4uu6LW%V8KZt);kCd!!7|aMxM9Dv}bvccT?IMCS5qa2F&kLBeWqV-Y)XB70cKH=I z=CtX+Aw`?LIN7$TMhm4N`^Ydx{ zZ7UnX0?Nct`OQ}+V2CgtL==+Ys4Yd2NasJ)<5Y19p8AvIu;H(}Y{i5b(;Yr&f*at6 zC7`0OR~}xXW(Xr3-*YhbeDq9C5l3`^B||}zdN|8ZZ#Q(~vn5_`%|t1Mkmn_^MTJb1 zj!^%ytCHx>D9J$(b4ahN@K;N84Mx`>`}EzMIrj3TMv~@M-ypE%};Dw2(cn)d@9;a_@+$3i9KjhU4Xs@xCC1gKbs;U3()gbU69#cTz z%>SXTHdMfk{l8aNcNei6+r}IakF>$s^cKh{Xh`_fHX@I8hGrToy-pjxhgxJ0*R>$!l$jou3Qs%$Y-sq~Yo@+F7qZGB!>5U<6ytOM%urR+QFBl)I>1 z#eAsy%twp7dN8|6A8oVnk=K%4Pj;yKm0HWDh_-W{=|0WD%!}#NO&%m>PtdkG-UD=r zuemqtpGvT+M+!E1YQ~D!GuKWZ@e@vvo4f+!jIgAA@84{FMzR(@BL$%IRpX;Nu+Rwv zBy^}x&}TX?PrUP;Pq}Ta6@=27o3Ja+wQMgwsbwNkaT!8^|G&$l!`b#oe1GbTM#BQB zR%#11XyTXvx8ZpKgTqMkW9((?xVaFBx)yM7-sx-Qf2gwH#hDlXh&Y|-wRMC)!Ciy3 zL4r=igjGWjbL=dHPOk^#=Kac~>i7-Z87dhK4F%(entZ$>4@@pP`#D=gkpAy$088KL zh_Op|LAEXDtgWIhe8F;~NcVo3jYn)m<|>{gIP7Hp#C615l9KZoJVahS9{6N7D28Z@ z)^@KEctsMO9diwvCHER2h9RTGFzp-3AZF{ay3IH#3R+z_(}?3x_o#Nqy+)CHCLZf$ zHmL|ZGy^REDjiyP-qT>BJp8k&Z!i1=O2}LaBddlkdLw@e$Tg)x<@2qoJYkbbTdEph zWx%SwynBTh$2@3`ZyVqcf%d*M0gn?t89_BhUaR&b6Ip{Djyq|_9=3n*CH1c^XJAw# z%6VRFl}(XaQ=RI>v1?iRj}X@`IGl!7Ymi`*3;tcI;eGE5JS2-O+a}x{zmP0(0C}4? z#jqVkc}qyz4st^3-3xF%iyCL5ZJjxCK65bae71GYyIM@;#B=P&v-a;jS3A`13HG>I zf&mZ6ac-Ep4Y+7~FJSZALNJ1AOrMl1WcTbFeJYZ`gW9Tf%g;1)!0}yz>L8eCZMaxN zvR2^xn}f_4I724h9FXU@kA?_|L|Fk721F8(9K93e&@F<(oUJXb=|yracWwhw&E+vc z*wdAWXo7;sJibpr;CTTi;}b0ORU)F)qpYXmf_S{iUkaoNpY*JCFhAIzZ4~X&s0FAd zLmyKQflVcYu9H3n>FGOvsq-0nabDQY84*h}7P>DI**<)tzr0?UkposO*sr&68{^ue zf6~YyG!}1kn%@2U?8W`gF5Z*^?d#CdvnMGLL%;>+Nn|n;*i(6Ee#b$jxmOf|I-Os5 za|T^uWVJb$t`x{eU@`(AeC&U`&omM0prOZlYT;nyu>`NJ?$LZF9hHECp~ebc?Xl$< zJ6K@Sy`d<9X@(S{#fSbQIP}IWY;7+aCtX%p>+!l;@VHf8(*XBSrD+B0YG*V19$l|q zsiibtBIstjdavL@n|UqbTJt@_K2%Ig>B2$T2T4qgKcbW$8f`xystEMko&rx8?00kL zprAnj9l1&{`)Z|N0R)C;G7HyKep|UMfYV#qkVYj`1A59m-&@#JF67bLJ{%DCl3?um z(!|%}GBb(`@l921p>@8AZ@pNQ;JpoFg|b$KbhvJVW!xJ)@>1TS91E>_&d`iO_p)Ks zr}WbZFdd8l3!Xg4{&T3+lqE>SXCad^R;Q(=3kyHG;U^~OdjjZu57)SaN>)Kwap$9a zL>AcTTYi1{+(jl-PM87DP@?S z-m)Mzj}}~PsP#jMZ5O*V_pOq+=jl5WyH^}mk*StemUkj8i$0oF#0XhYscqg3#h07f z8^wi=M(BGrC9p|d{cY#H9aki;oalVG%Y0p7vYRB1Z_N2P-MFaWdl2t~BD*9xEf6UL znoL(c_Hq!O#(-4h~>zM|K|*n5WX#ZQJCL|tZ%mbw?)d5tr_ zsRv&uFMql1;^G2$QK|@)k7ndEJsHxEXKa7>i(ll~pRc@IVqS)Th={#-A{U0*mv7&vl^t>TD9f`cR0dhP?(tO<|RjpXDFU}>%)bCtURSF|yDZEQt)JcT^| z(`ZmNJU>Gfq+cMDUa%^YXEb^}U}3v4C}q_VzyJDv9#$avytdIfTi25$tE8p4?q7OV z@a`gFqC*^sG%()M(YyR=EbN4$cofr$^FV)R_U*gvt`nV!YZ=?-C zhqJO|QE^F%J84a$ms`T>s-0RyXnZv5iq}*tze!RnuPN~`2B*F@f{hw^r<$JXq1K$u zS-;OMg6MOq$SiQ<&ELmV!7#(sESBLH0}to%ot?Daf(tLflaSY8zy()N>sct9O*Eu_ z-p%uJEYr(-uCXl{9AoX6%pzc5qP4Tgu8&n|v$X@7S)Y)Jb3E@nH>NGxoEG|bIt=fe zRE2&pnfb8&+i!yWU5m)GDMCM88WRL1dlPIUikkM(CR3&k6S zg&wB$3cFTjj}l{^+ysNE^Y$7HOUbF0XyrU|%N)QNdV7?}J=&_1S_va%v-ZKjrrl*N z0K4G)=8ebqH!+{zG9&Q&C4ha3Ud`VZ$P(WmZ{&LL33f4yW~)oCTQrvHXDC^vaGD^4 z(1)K`q~FFiwOf_2?@SvG4E)~z1fQtjxMcW*{KoX&n}ers`8P4e zjbX}^s@BU?^(Z8&$fWgslqr}eAhX|z799E*tLLqY*5i!ZYUKyy9f|0NT7!S_hDM)A zl9`MUb^i9YQStV}+xq%-SdV=pz(xi+)pCq@ai)!t;N6@{&slh4rSutpC!px^@w?>} z_98vWyTtb{E>U?|G;3j?tTSk#q`U&e(1~V$GyF0ZYj?oR6K4;+tor)r8h~&8AcY)` zX4*o%t15GuB|RmSkHpi{A4)+01?8Y!zB#1Z67cE?AZhLP(ewEo2yl2i3Y?t*- zHuA+rYf4EY&)CeghEnA|MF$E0;0vSqt5GhFD|M=axz zf*rv0(nt`=)$}^=$Czu0t}|-4z*B(N|96I?JRp+nzwPId6la_3D|Ry$#q}$vfg=dG z_x_Oi{=GAG_?^n`E-q#w?Nd1_eyZFt>?rC+G5Z*TyM~L&AVMW2wD&bEwQ4*27_)aD zo4+ka$4#^RE#auPA{Ur2PsZJmUFc3ew&K+m$OKBGL@CeXVukWL(zP+tBQIY5Oi0Kx z6EFd~EOHokS^Jo8IF*|C)^R%Bb|x0-`*SiwU!{aw!pW(0Z*m3rf*BR+#>4we`NAd= zO7tNcIM|qLe`iwk7CZN1duShGV|&w#T8LT6j%OL&%E&gXkL_-Gk)Whae{|H7&N{^- z2onWxx!U!lEl0kc)PtNj)P8RH^Ak-5huV@7PU@!hM>U^R@O%_c`WQCZ#MHSWhu4q8 zm(<5~K%sEt7TS4YvH_=G+ z@#3F%FQFecMz4oCvk3HL{1FNc(6uvNo!|!IH9ldN0NF$ZNRZ%;_)patD6A8I6QT(uLkUYUCB0MDJ>NY<^n{5cc(9mAUO zFMxOOg5P?~h__1^3gxDW*vhfVg2@oCOqld$j`Zy4_KfgZZNAw zI(}CmVC!K3*JheHvZ^Yu?UQmj5W%E?tnK$Z?Y~Hlyxs( z5*E}zL&Ojhe|_|Z;s4gp{0y>r!Tz?<6t|@lT9oH#oo$4>Wnd7&N@}P@-7h&`TVZWe zG|S{p`%^iwDnLv2ba)%%uNusS=MNz^dxkFKKlwNuj2a4u$pesXW{Yfpo~iM(A-%oW?EfFfUDWSd5NjO^+F7r_o**nVCFL}cS@L88oq~@zMidY* zh$7p(d1Ejd4xXj36$#&lF7Ed>I>yE(b%M!G_z;D>k8gG9K8Ku63UtT+AG}miw z|6(lu((o%p%iNeqGLc^&6Z4Q!vuIRIW@ow@L8DF0p52w%Rnll>{*DA3KK(uAzRjH`dniPB_k?LM0I{9O8}bp zj@us0J~!jHe8(PfCj^+D&}$J{qBj?dyc9u?hXX%@uC-1caMSQ!9ogp^%gmJfPh}%N zXfR7w;-ZLmL~&)LICU@Uv|on*rt$=ql2~i=j$^I^H^p=eVAtsnFI&^y@YkbWk10~V zwcpKo;vlPN^Q}sHLOHsH(U}4hN zB+7U{2X+Obe(U>;At%-)iHcI8A@Zjp^oSz37b2-uyd$VJL;(fSciX6I_~MHR#(lhQ(XaHx3K znR>{9dFQcImHpJHbzw;Qz1__~Z zFQ(xsUhS#xoW7Zw#n3AEaXpmCj;4G_tqu!6HqQZ? zeou2#W`US{u=o64^Dgge^qDk3g(Wt9xJzj6L>U=z;c2F>v5`L=fPsRTp0Ml(feD{F ztW6ps16NE9>bsM}lwNOEm*ggobgKoV&yOXgQ~>`Q2^o!b`mz+^XxeifDn-#rV2b>K zZ;ER$?bQ`CX$~Sm9@sQvj*HN(2QZ3@t|xB2oW?7%@kkF-qMvksM!r#p*(|rYPRD(h zQPHx*{`_R03Kqfn&TGs#KG;-nz_^Aq-TfXU)1JKJ_ExR+*E>K9cMM(;`x)7DOiK2g z%(m^j*TT3J%IZFW_3X7Sp&MOCj)kv!Z{=aGKQtG~qVGc?vpKvjA2R#d3kwTN$F;m1 zulFi$Dg=y~^jtrp4&$>-2y9g+I%r&?-iT8rOr$Pfdl?=_KUV%l9E<$1E#mj2v{_He zaGlBWKyh7Jo(p2AJ->DzFFo46iz-*{bNDEedN`=#cgKFZV{jyhhWBBq2CK96G)%0G z}DHIMVi!X-~Y3w--)ALSkvrwC%_6JOABwBASf7URuul zYf_d)Aj^TZnOHWa-n)t0Iy&@PQ}%60Xy4IhvMXshvg4q_*uc`fJx$ecX@IBBpG7e| zQO=+X{AZADF5%w&2oChh5zmdREb1nj#&3b*f*)(IvmhfCWv|u;>~qV4w-0qr zT{_tZIIWspx$LuFifuCjKei>RO?Gv5*1oU7R0mHchS}=ri9&sdcJD5CBDelm8%Zz<>SXKmSp1)o(O3;TW<$Dk}i{Dd{Jh^xVg-4MGkdJFhaFQ@TeHb`!9rN9i-H z8Vvu~sT}ofkWFQW70_yffkqh7#K}fw*b)yhbg^mWo6}N{n@D8c`(bH0b}*&wY6moYUp#uEyP#; z1g`oZdHc1;UD+#5#$UV{kDPuAH{O<&$=YF;+`JkCm3(V2|fy8m7o7$lHiraIfG8V2sNY{_ffF+E`yzCEWg7SHby7xNoaNV%iA9>b#e z*qbk%3H|{~)(eYY=GcPULxxthlJx@SZ)Y&5%N+^${QL&&7AUILezTTUQoWwr{U@}W#tn+&CNI0$ml>h zx-$kmcx4%`jj9q)U7B6*acH)vJOnRLScI1RX#{0&EmWUWcsSk37+QOL3yFwF3h`P& zM3mp1tovNZFje%)7TBNxQ$_k+-4HM5{o2aw@d(4>2yP&PIba-s?HBPK&PSYVUZzMJ zsVfBr1@T@eaRWkqwHTOn>a<`^<>z+)vs$^69XMFwIVK8JcUd@nKjQh^^h5m*aiuRr1yex;P<4tyy1+izB}H4A}*fc&hv0{fK5jJ%8K<6yDB;kn2^ai*F3J)Yb~q z)$&9MCyIyPb>x#N_XI2!cKzeoX$_2x*$U1hzNr&g=~!=dV-yoK^6mPbW0C=?133<+ zhK|$YOXC$vYrD`v6VBF&f zlaYQ8-?n*+dz&6eJl{f4BAw=%JJV$$avpa$fd3<96rjz z#S^9-$KAELoHn(JKjST+UlBRMXR4+}<1HODBj9A&2FqLwem1UG7r*jXh)6N&`ul>)!phh^J4R z$ducvHoEn(C{EZ&RuwTj1??gL8v-#-mi|huZaDHNFqNtUBbS6`C{m{YHjT_ zpVF#8I@0^6ug{3W(SzUT#t(ewVA8V8?cElHGDbX2uX(5&6+Ct@^yttgnXJkoPl}#D z%eV)Hdj;08ZQvg0xoUmDI8b&j$A7dRAI}BX%WJaKM^Msu(H&8nn`~XG%fIWbm8_D{ z!9?#_>z-_eF|R)x2Kt2@Vsr(sOhm}n4(splozkLFagt}{R@8nYpPejQ<@kXGE`($( zAy`%1SkEE5WY2t1%vy1e@UWWcE*BB+@F?Ldy~ zEh1J1;9s^lsjZAE)Zkm@;LWYuw~tkLI`@IiM%it()42KLq>Q+9CXFD|IXLw<2p74U zk%ldSdHA~*7R=!UUdyk9hQdOi&O(Vg4H3>9j+W|CLP0RZO)_^0bLDGE*CtX{(iOR3 z9FY6N`cfzC82lOMQou)p71vtwOwbhLQxKbuU@pih@Lms$pUZiu@?Irit&|?hZc09x zAhkJ@krC%}1vh4v8)sK42Krm>$pljFR7bMGAbUh}zsJ7O&#Gy)PoD*~wFZIF^(2fQot+D7M#Fsb&E&REY<_{9LBZL@MjI$Zt7^*w>Dr> zCYO&3jIOYtFS$+>m3Mvk@F6$@v+g2jRC&3=0xptF*gJbR$KfssZ;Z&arfI6J9d08G z80il_Vr;O=9KCK*9(vXzQX762g8<>@$OSA)%kIJ45|=&K=3WOeTMCE^0jYlmRxucR z!r)RET0ZF$gtJO_VhD%oyV6}*-zpDcRCa`Z|!SM3neBXGs!#oBZ#Y*C+ATLT!M)15$DH#kR83$VX zdg#h4+Ir3@IJyV-xj75ta%&fiM;CDYNvtIG#8GP$-3G{JGO)xC+S;ryw3I)&_3b17 zgx%`(&Np$HjFDsaqevuHh;}@!XQ1-S-?;vh1LabLijM=vIeQr%iC?$b|M6e}yN=wu z-;R+C*r74S3rxAKA6E*5-PVa15B%gZ7~DVKe{v;l!HjWW+n-eiA~)f5J+r5o5y}KY zPl(DBO`_0b)myr{acmg`4~K=#5_*@^_%kYbHm=KFE1{IccHKo&b572j*qvb=b)AO> z9%45}M{7d^P5HUF5s)mVAmXm$Bd72+c>7G7dh=k25pR~8Yy?*D5rS8Bi}Ywg*S;AV z(Le0$yLs+%uMi+JETOfVZ(zu8_BCq;t)ERu`GESN9s0-{U=d5Xb$)7Nd0BSVCe{>$mnWW8Ir2IIH0bV~{C zDgj8TJI6tH@a{k}oG~6eF8V_4-J`&14Mi5;6}Nk}N9x_fqZIP+@kT0=iJRsCK9n)B z1!B~!|Lcy3Evp&_O$+RX`cmsOmjBbU`0(*#$Q{ku*UL$12E`R4D{WffyR?+vUj-?D zu=()4070tqmt>u%4q>o)&gF6X7Ksj4c6LrS1s5*#Oq*f|IigJ`0W|UNw-Jns;LC)_ zs3s0E&qw~7BO@cgGSJ3?cno1R$htnpz8HcBP}pURo2)b?+daYay{bmtD>_3;&FLbA z-(8Ezx4vQ0!^_by@o1C@;Aj6#S+8r9UeT|2WM|M2e(0lm(HDncO zh+;Bl3?&@DVO4RwGCwSbRL)jx$EAdu;9sJXd2pmLwE5qWk+s^{8xJ|X8gG@$rU+>i0ieo&2!bqC`5{&Vr)0gGVaVCpFtMhsF8MIUH1h!!p8m0kxBhJD#5Ma zb$ZwSDK^x`$ht#Ul3mE&050qRHd4GLdtmn2=EaKw#pRiEcZ+h6e%5j!GBEJ^q)pGV zC)T!ao^5acfb}Dy(XCdBllf>5Rw^(1IvX$J!$6VxZ9k{V_|Qj<0=@}cQ^C|!=gAu zIC~Q!G|)g8#5UkP9E`En1W^xBrmfEE&JDO9*)~RYq9BWv;thc!m90=1x{IRD|G99lC~!B@@IbYcF1tU zaC;mRxRV_k8yhRmU#}SoTJ)N5{m44?eQc^*zUy)B(23_ly017U*91LX#ZhuS3eCD= zu=u0FVXl=}Z+wm%R~^BNyaI2Gnb_R;6)QggoOra;fY`n8Ml#C&WdM(_IOw2Aj$psO zyulDOL%Kiqqf@{-3WhRk-W>ntpa_t?klcZkc>sNPQE%2OhZA6K5NG1|_v>en^n?vlbXq#?Jj2|4j{PX$*fGAp=xU}U}c7+Z`dhcPokLY>`15_ zv3EfRA%Rw2m9Uu_Djr#5=30`odynDrD&{KaW;ikn=&GsVfAJB+x7;g+Q2u)vW4XU> zBSynJ5dxk@(R2g%Q3UA0thFR-S3?W>-ALviq(@DbYVjLFg{}LphpDL`(}bdMcC_b| zrY5%(nrUe4t04XmeX&vzq5B~BjY?k{sJIS%K+~1MuWhAUw2V03^&}CQa01GZ+*gnQ zRx&-jKO3w$c^t!z)6ebqAvr=NAGrOkYW4RjFzd43RSjL)K3dD+d)SA%HaOhIKdLr3 z^m)5mv;~uSdT5>v^rrjmk5$kX?AN*e7mfpioo86e1C%3zTFIFyH)#a zQ6Fo-3d(t*U)1@Z7;K#Y3&9|5pUnd42e{m&>)8(9)#~ch z^+iIjiQtZ~p+~7P7BeUR!IHN5*Simxx^?NfF|jotnm>ZjX}sq%*kH2cqPq_K@L^Kv z?!QomFs0GwsI4>Ho|N2ZiP?2UCIAm z2Nwv!&VSoZTI^_2!H1j=pG^^uQU)B@1IrQrxUNK)4wN0p_5E5~aD#wsFOTxbNdyKN zOg4GgYToPRX~EeGSC)4{Y?GHEB+^v7;MRSR=}%}b$}kg^WbCkz-u$9s&8j4~ql?eEGMwoGUT5_>EzblW8|{JRLGB6nmecKy%x z0B!mM&vPCIMYpfQuG>|-hH<(6Q~Bs&=t*Bb4g79fSQtZo6|SY{qKVBjvE{>Xgm4e0 zzm!j_1D31HtW=7wtlLb9x^9GKrDj}1vO(HgW1aC_I)J8Js4_|(=*sjqySAuWwBZ6= zzIA)j?Kh?7I((N(Ei&Fe-}&3@BtH#?UehjjeiO40O*H<<_7oNaH#1N6`s-A^zqoOPp`tBc6*RtMA?G)Bg7P*k!cYhutwp7RTVC(*N%U z!7q|GM}Vq>!4!EARkMr?SR3>+gGH&q-)T$S9?n)8NpwSa0WO5fo0#n9l9dKT^OV2? z9sz-2M&JWh)X%6V?0Y4DVTIf=R@Uno^9LlOC`Gn!T^(~u=c^{?#7cw|J$)v>9mAUr}g8yBh)7>+3EK z4MN4^KOiEc7Q9S!R5E^R~vf15VKItle1%(rSvs0+Ai%J$kCU^~7!u>OCafuH~K<88=#zX{R? z+VJumD9T8U=AZU>kH5eesjgauCD^AfxZjD@HkDy1XZ-n)Tbr&4o8}HcL3|_1H;~b0 zO@&1%GN{Aea5cjEzQz??Z*OnObflbV{f}{nLEwdeh^hl+Coj4B(S4%_R|oms?^UR- zq9)x#lqzc2%Zf5ryH{~LCYlXSuqa-ZU==is4`qQpN2sF7@4=j+d?IL&?>Thfv;P%v zUL^XcW3lLZ58V?@3KE-EhkP!LK=ZGQ*3nh7M`vUL#AEZEa6x?_`-kV+zC~bhVPPyQpyG z5O%7qTy@}r=s#fHT|hfGs34Vj9dD83azB`Wwh_i%)YWk4n2{*;9jI*ximFu!(`q=j zOoZ&$>my))B%mg^mkcpRhBFpMd&$X$; z$*RQO-J$0AL<6*EuM%YZB|D{Sg@o>9GWi_(Adq9#VO_fL*WQ5Y(n;?#08g?5Q5Ih# zLisUiVq$KCOn@#kv(M zdWD@}KOXZQE!Dpg5KSA|ELrQq1qoEHj`tUY#7RynR%OrAo1Ihuo(sn9B=TG z;+LdA))js7U<+Hqq=Wy(Z{V=>XfjXeSbuA-Bx(2~4~@d#diM$rW9)q;-f{UQa4m9@ z)lV>9MIJi!>Nk+>U*H#gv^Z3t;5PWwP|%W7+IOpfQ0|5?^aciGsjHJsV*>8dCu=Jc zf~Z$r-Z-WfRyzkGmvAhKk+sdz^VNX0{jk*4IWn2xWbQpGw-wWT4=8)cg0abKWvMHO zE0ja-VrYW1JG(kvtruyKVq&)WsWtDd)BYY}#sM&1k2yHi3Mfd~3x`>1H+?(C9iRRd zrKQTSOoK~L9$^u~6)k#x#@=#^fBKMW4Iqc;FO}N#Tv#IGLp1+8t?B2S z;I<-XLTPb!2R@VBA7YHHmv11iU$UN4-U-=9PyP{GgeBPg!E7Afvsu0a;z>F6jcBCk z%j1>1ilxb5Ji)Kza2=eFGmHA!Ga37VBK%{vseufOg)~s32dmY2Ujm3~w2sJwY-iWf zmDmu&f{@j@9)&Ku&=A;q`SQ#aN|;UO?OGuo1zOmFNa=H=&sjM7d@e$0w6j6xXfI03 zmD0OKuS3k7@|Nalo$c+_U&A!j0|LwgFUm6RcjbLDjyU-nJN^)Yt<(s>aCK+4s>-LSB<550h*DZ`$9shgD z{-0|&ciwG28!MsUEME(YTJ{7*hcE9SOOFeZ9hyUk<;3V46NO{Y46jZvmpLzVPhFOC z@l-Hg!(*Gq4SryM0&NTTXuL1ani^cZc&6S~zgIFU51>7b1kfvDva*19jCy$zufWp> z#@<7JR*Ej=xJ^1TaklO|`k`rmLGR!L-C&H6LDYI)d!+P2N%ANL?Q_Yle7-qa-s2BW z*Y3}t>7TsLBh%w7^ONRBbqxvK$Gp=xBUVHS7 zB;+n<@D)|r?e$*R#6yAh`S>}0X_Oq~#^bIG3a!bI1Zs@-#HxXb1vtY_=Ydh^rcut? z{2y&gO>y7b2oQRcic59*Z8grKTlFQDUnn$dGlo(Pi zLZ~NHjKoa`>3VEu3QP>XttxQ~37N%|pY!#YKOkya+lWMFB!?-U5vGh-fOG9Br%L*a z{*kR|G);Q2kQgoHo<1QabkEw+rbnlBN`?Q~dN?oj*KCOXNuvdR|GrY3i_SA$4Wb`s zWv%^5sLGQeCHD5O?=xM%K0`K2Y{<0A>ACo8sRLuIS=kg(j5mFHi!u#5#O#7tG~Wrb zHb|O6^K==ZP5sqZ=lkR;J(r$=xU1a#;abpv+I+vK=U;%z@*0q1B*z%d0LYtEb#Q0+ z8J{lt$P7$T^~V+kY+h0Gljyi^iTG8D;i53p{th8E z{)d_T)ZO_ze8I`dfz(tiSvF- zZ!l~FfoOzHvGg?3S+AJAx}aYHzfhq|}r@JIonkTi?LfJ14h z24MAWuA`ngCR^2*9{47s&EzF;O037vc209T50y|z3gkM702}Sl!(0QA@=UN5<2QI2 zxg!wS`n#{stI;SYGxMXVlIXK?(=PKrJoryOX9BRSJ@NxK+d_Rqu`9!O9Bc$`oVqYV zu2a$sRpp6e$15rE18(P}tphAN)7s!bGPl$PE%z-ir=`gLsllwDxEX{8pU6iU9s)b# z#Nz&s+8WwaY6wR}5K+#R=spt@BRXF{4d4l}p(X-&zM*^;`eASmVO`wc;mlaY;0Fo? zOo_{^JK1kHC7+37Dzmx{r8s-My)Hxh^1GI2(}*ulT4+`-2M^#32)-aD+xd+#4_weBif1r!9d z3WzLGhHMoDF#-xAvK3^nvUgIn4z_|2Wd&u6g6vHk5H?}&q3j(XK!8BBE~LApdDLV2qI z5TD7+%VsgJr2&K#i-@bqUSTYS1t^k)Ef2Tvd-`RcY+-Yj;a0~P~elyPc{$|SaEOG z5%CwKlf9qY-e+1eGQBat?EKEfHa+TCQL$PtjSG6MwEc?aZy5j=M);>l?XWNsPE0H^ zGn+Q~^x%=0&uUX?QA3{d!nSdHN^@YKewBrSt8yD45N!Z2t&*`U*Gz@{lXRML0d`T2+} zgJOkA9rO1uHQo9NQV))D3ZZO^`E)&l-sdc=Q4S%tmpo{Cc4?`EP2J+UaG4e$9r{aL z`wkF&V0AbD4Kl#Xr+6%e0j3Bp+5M2;n(5Y8!WjR^dZ?_T|#el&hk|zaRJMuY~gum%r6$c z8-2)Xw$iE@Z*YNOfA^O|6`-BMlzZsu2|mJ!P&w|p$oEgBoyQ2NH&1ZNHJoe3)v=Og z$6hA9@h&Li7-9CdOP&ADc?3nw_cc~!)czeKtmL}A_c;Ki6N*SjfID34e6edL#_z3t z2xFQR(i|KJm0P(ClqGhPg)p<5dOecLKXV>c;gLALPMPgLMf@{RY~de3v6<$*HFblz zR?Y^?In!hlRsN!?|0A6Zm^`yR2zbMEprvuWO9c+c6@<2Wo=!FnNxVDgH%zH3Jty(s z@V`CA5khwqR15%m9&3XQE4S(uKxe{upf?qm(LlYnC}{@m0;VWl$PrJG3Eo zpfC}VYeD2LVy@2H|9yR+V{8ac^5q!h0BZsi#&ID%7!o(r?kmc zgpeS`Z*{U0zqkWCW&+dufXQ<-ZkUM*%d3POW7qhtIri<)cY2)R1LWGXtL1@cL z#2voB7#W_lo+MS$jh1)pM%PI`tB~dT$`e}MKs9>k1xuM|oQJit?SKJyy0Jbd#96f} zZr=_6CHKCrn~pPyUs~N3HCl{76|_D^fP`C60?lpXMXaAmKGP%L*2V~(ZJ;!`_NFPQB;+|?R=3qkDe9*ARzpc9N+Px^n`X#{%myd zV`gk2hxZq5jv2<71OHc-=FP{=p;$Ea(n^RKSGcQSxKsoqrt;C~_AjWeV&wL0JP~wXPk!UhNY+RcyQ|1nNSD-@9_)om1M&}{wpVnRW^_*6 zao!F3ej`_R&jrH(6et*KJig9rkxK=3(ULcze!nZND)bN5TT6aXj9u?rlc`*b7Booh z2kSil7PKUuq=vk&#(Wz2ZpT_;K3a;wVm0u6$b7EbT(tXYFA zK+D7+-WZYGP>oS$N3+Rcn4splZ8J=*1{vL;z4U&VUo{O4y8X(V zNy+IQ^>L_PwV0=#HFUHH|SS&&*JhP%1&LZTxZ`-CD zXCvc_^AWEKBD3+6Y)icWkh)$zjsdA3V&x9?^9p=N-F`z}W1rVFS4rh_p~X^XVhC9E z&34E!yUX4g7eM97p%mZAmm#`+y%CI%;a~wA;ne`?dNjW`H&}+@)2&~xp@odg7 z7S6xPL|Dbc*iM=Z`9PWmq85E(E&dit#z?nVjz;Z?Zsm>L_%uA!KRnoe*Rv+7H{a?Y z%wf;+eA8n^qyp={O9e)ULU+FYpC&Gg8EK4X5x5l- zma7)k5-}%eH+jh_>jjry$FFaW89b}pw*N}sjf(~sGTB+BN`-1g;@_+u%uLnUfBAmO zjeN~(`nxB~*-Mgaig_nR&&@YBMDy`#e^6VO#}Qo`JsZyf;X#caO_U2i3N1---ifQX8;~7m<#CL2@C}vgdp|@U+x!uO{Cw!GWWy2wg3}AdAkY`m_mcBfxH`=wot2v~#~9tu)y@l)f2`tBj2L?3KVGdq!c^Z@9plXc~GX zoNdW_rpCf_@Sc*%#8*En+H|W$rKv`U231wvR1YdY@V)yo>A=oj5CEQbQe$TsPJ4dv zGe;Et5BXXvh~$;!lRmr#djd)!ZC!t;Q5K^`&Pohk7!6d!m!awzKg^vQ(O@qT=+^%L zO$|MIfU>!UF{y3S8GibO#UJ?fhYKmc7cM+bPbl`9-ggtwy!W0g@-hjW`z`0TNcFF$ z-@(%whW^NmXb5n?(2MQzeJWn>s6c371Vl;Obf4lGLNIQ>RG*WD3nqQ%ASVi&Las3g z(<-n7v2cgkhUkKd9@lA`xHavRG#;7dO;=GdKE}1D2kPsyhb;9%b0wrq#|3sp_D7FE zIhhHA^6vPa+^)5Prg<(G(tt$RiB9m9KC*+y<$`@zD!C=8?hWWN-Yg1Z)*znTB5WOp zlAzo!_fpHRWEHH-LC-eAJl2|Jc;=kC|H^Dn<(E)JuA)om%F6dctES3T{`^P7vHExJ zybQ()8^2l(SI0KSzHuPMIgU&ynUMUvM;neXiG&-tk2%EhXM0b>Ve5F;EoRyDQ7D;l zpgH!z8Rqk+O|c>qI@lE3^`O-y3la4%3Cd;s8D;A`T(w#pf#Bvdn@tbcbDy)6`#%5#V>vnBrbMOBr9Wc1k;&5D&D{@iq5lJGWdH2AC;wEMuZ=IM!|ZhZX>nN7i)M z?{NTG+qP?e5=iNo`tPFT8fr(xF~mywsz}Y^HAk0!skbULj~^ihfY^szL{~-)^_f2Wa}#ZA!00AvT4keYuly6mwJZgP~ESg@U^y zIJfo8&4s_gjAIs^9jApA{b}CIz4jTZ%-)Lsg~hB?4fIeS0$qQ2Ojs{JsNC19QbB2l z3Jj+>>(4P}VjcTH{wXX)Uf6Abh^ONF(se>t31--Gs^SPclVB7T`;jHHc+4(vZB#P$ z&?fa;Xoi2UeVGEg6O*8MtSSBikOGEU+2aPkmNG#E`z4?FP{+RHP4s?TB_%??c3Q@} zv2V4XM0>UpZsI#0OKtW_3JeH%18iTh+_7n`_xjkjXeQ`>Sfd;VrLV|}L{+Wq$$PMR zdSwyAeM0$X6i!LlpzxH@D>(_YH$`5|d2B{pv<7^fRF}Z>uSA_mK>z)M5^^k`m+sIm zui7v1W`Eiq~QWsgWA$Zrd;4WjyjxIY;_W0FpEk)W;hIAw)ZqaWkbg{?A zO!p$*zQ5RPp?^%&Jb_6ZqO(!EJ~qE)Yj>k zEre^JF+R&JqRKE8Vq?OB-rpsG=$5#{1;|SSHr^pTt=-Nl)m2q>R=}6pIVQaXs+vu9 z-s62-F(7moojQqF;sM%4<9hV%$j4H)U3a|om@WA)@ICW6IhBLMpB$@yg(bjTFtUL+ z7B}#lO`k7C-ZSg|JQlwJ-d?x^1@xKiS2pvTnFO901H?%w8TNP|K(V#s&@xKT%*+gN zEdq00R%B4PMrOZ^NBf%2$CsIs{6JtZW(si)k=5zSWPI6oimUoTZ)8Tlq@+IObOPUueIDUr2BGl?r3Y#l{&uWaQKljjHX zbm+$bT@X{r)Z1BHIbMTgq^k#?+Gp;KXq7HV9FV#lJeH=~1rd#(%!fs zUS?e-v!7_^bzfIKxrK^Cxu-2HlHIH2@T#WAWeiK)5NY1g#|vcRjnnFivm+pvP|LJ6 zk=21l^;nbvFr_O~MGZHWOW6~qOs|*AEN3|@vUbv!ssLsdzph!qB*g7(6KsNLcv#x$ z^7SZj-dK$|d0$Fx`cy;1HWl!3MYyMXW0^ePo%gr2rV#7bRmZ1|sZKFowba(G+K5p^ zM9-XzFwbl<*X|*_4H5d7d-kQ@M@Q35CbLHY8DAj8Od0s@_-+Ka{H?L<5f^scf6t~}MF`YG*lkXDrYn=* zIQn$@^8D!{ueQ|Zj!hSLT!s<2>A=Reh0l8qnkVa`dns%z_>yoi4o{E>vPeuidJU)3Y zd>!Nt5iH+)D5PLEm3w~a+18vaCh_WqQBPi&=iN{r0Dxv=BAl+at&A4F$9i22}KV{mJo9#l$3#8h0eGr4D#qav)*M}@m z0UMjM0F_`iy2Yx~KJ>3XhM|9X;30NzOedfvd%J~&<$r}v3Hm2bD zX*>ZonxI+uxwOqRggZ8*^PMiIhTNJv zLd4+aZJ%j;#`Qfbn@f-Nhr)5^`Fry0qJ?jjTWj}uw9a;~D&p7jPKk}3|$toOVV zGG1{Dyad z>P@>P6%ztlBpT3SW(FN&cnt4SegWl9-vKC!`VPNGU0XES&g|OJwEaLDi;&m3aV%qF z0LoU%3mc%YJ|!8h8D~*G{#bNlpa|@`92?pPLt%Y3Ub&Z9yxa?=1HrCv594zWoFwR@QNFp+bvD2-i>? zjIVe?l;hn_>Q{6?SJrATV0UnbOr9J6J_h2ZEeAYg@z6Lbz5cAUbatx;>&haXlZN+1D8Ng%C}?~Mq{&$(M;zg zFqx|%r;b>r#-e*__Nw_aDM4p0ZK=t@tqZ2kUXs$K-rn9JmstF_p<9(v%-b^M4DgAn zGbqrFv1mIqs$Xn-<)L>sOi2g&hImoKQ#hKCq+L%8A>72vc}(PLXeDakX^z6uC%CZH zCCPJlRXVTEeJkdid-^DF@GADSh&`)=kYOA*RLmi$^4~7D`PSHdt`JzLD?#JN*xA^U z$90UO57ao)q%8=33Ce9{!ln!l*2jH&p!&IAxe*o^KF$%yE~?t88fOgMTEZuZ^z?M3 zet;d?yYuK7vAtuj{uKO~CtVk!Ze7IR7S<0EF#$(kEC8TRuY6BMXZgmf2@s_E9(&7II>h7ZalQnBZin}V1qy;=?zKAzgf7#n zMCVXBNs&3E&M^UVlWNzrBg<7)LQ2evjUH9@1j{C+eo zBqIxPa2qS~pOnF(CqE;9>}tR|?{Fe7xn@wVGwvwGwuejF1PAl;glu`<&6AP22I?~N zEDWRM*Fm8V_M7XF*%wJT=!auGT4VaTFWj}*by8wbZ{{5jrerV{L17O)Af||3 z*n8ycskx0x;qT{;v_UNGPwK57q>c|>37zZD_m{$6(0t|ig%E7@sRS-@L4U{UIA5YP zGNac!#5y|4{Y>h|y71%*Lwu2J zneAw8ME7VWUO~QmBf{bSuz>{#&nzs~g*$&)0zr&vrsW{xDge1o4M+oaw^Mk+on%al z0YYiZi z68->PH&9$~GT*DAXXMbs?Q;=vHuUhoQ73ESB;#;MJK_f@7(%OtVo5_1D5ftHkg=l6 zbVpwK2PPEUzjy>U5QWm+?(M#=(^2$n08(L6M%%Mr zirLsBOPGbS^o&sd@Z_<6)3vwllZC!iH_wH>c+)3R!|4OHb(JLp0t{ucz4FT2g%sC{BlK zeDk~2jokbg7jk!Hw=DaZTFQ2>Y4OMWX5cd`$UeR!_`iK5mK}&%af$s!yqjGw!OXbi zB#EU7pM0a=u7D=4m)m7Fy??Bqgts{pj~QH@s>C%?i@5tsDw;lR9me8mzSliGugOt1 zP%r^Z{P-=>HNr})bZF?dXD9DNV4x&tb-d>kNiImR8QDz+$zH4ILDZHa50OkLRx#eg z$?N1+n}Mi0LoL$h2MphwpYraYBhDThMAF>#oD?;|K#~vTi4~^$*~Nu^l26Wnb{LDO z>-2yy?51={rHpIO|D7=Z<#*unfB0YtmtTj63S!*D;20dpf}Y>HP=1g=NZq6a0)B5@ zvvS~Ej+q3l>%TCN;rDIL*BV z-gT#2sHBxqM&Vsw_R%q?qUF)2jB_G~;Il)c(|8@cxI9Jd&HbkL`kg`pU3nvn{||Wo z^Ta)Uo}Kby4xip^XD^&-A%Z4ndg)sBWX^Cie_ROS?7INxGjKSBn@edsOLd*T4%w(( zqH{2g9ko3v>AmSkBVU`v9RzTgWEzddPd2@I?QbY%bX)RV*?a1o_pz|yareGM(BJm5 zI=EtsQlP<4rewR#uFu5DxLWd%*@Z%MC0J6RUVK#<-UtX_Q`+ZBt9Ruln4%Fb!-Qe| zZJXweQJf_Cx$3^N-O~R2!dM-^|3ZUc0x2kKBsd8MOr0(Y6k?cE&!g#yFBC*BA~vbC0)+csfL9a->vpTwid z+^2ZO^;;X8&mA4RjwcK)X_0vjjqV;@9!%Fz&ZAd<6SJzd5u1C(J~VNHrEW-dJTK~v zf3&0>;8S{(VIjIWX3YY*_8WDde<6R%le@t534lCpTXa80?kGwxiqcV!KJl197F7>e zAgZNycTxuf$~~`{sG^+28JDRg0^kvUgghqv^vF4j%B3SYu&>|NoM}9GSk98v<$agl zWs_MB@|H{X0}q&inRm`eBFuEaZYQ1@)Sy!XyeP4PJ=p6R|5_w=$}M&kf}^%dOA%Pd zT!#8`Snsw*#5@Gqpj5> z>iKnv091MU!_fN++UcDYqUhx@Y-)(2n+uzU3_Z0bR>A`PPT%-B0WunpswzLcc2M|O zykLP382O~v5(adqO_^DKvZ_%=u>4rV6N^y!HQQ1J-`gTFE8%5)!q{-NDaO^>z(v1p zd)OwT`B{R{8u#b<*t8wYX0W_6MHhj?oNhOZJ% zc1h+1&$THRGFMMQFpvOzRqSHyWKGRqXoZYPT{KGA5u5l^MS^%S=TOQ$dHeP~l3`VO6{3jgq-{9cSMd0Ud} z0_|XEXruR>E=i3YB#{vHvsfFEPi5;XAtQn}%~~z0FvgUeiKf?vGdJ}(_ORoh+l#%D zU9bLuLOichh5)pfEHfIJk;FiO=zigvxy)wVMMmKA%iQ}SHO-9A7U}Uv!SECUR)pqt>sIO7r-aAo1Xx=5%=Bqg zE-P+2Hk^x=Qv9v$M#g!D&kTt+U^!O)Moz6O=Q-&QUXn8JY^okfBgwD8Bs{q^vRu&> z3SsAOvvE6EI1UfvaEH@xXLj4iF?YXXKq!r<>Yj!p6-w8H^zke>l+u_HyE zl3WBSOD%AT*Em*&WNL9a{kAZ9(V6A*`pRTPB^-RvHLQ@rd)@3?2^>tW+#dcJtvcNg zVl=D%p%ro7_WB+ROn@Ezfs6~Aud!@}>rvB#`7e#z)FKXsnj| z86S|*ps^YUL*YXxUS@4B0?nFi_5R3PXanPOgV|RCCt8ZM23$-#s|{Zqnl0H#$A#8L zNreCESL2YMs%3iy8!gNKh#Gc+qMeS&n(_bLCc+rg-=XLFsL1~eK+#aqUkx#cmRnx7Tua%};vQb? zIvex2Q^)oy5%Tbqujpw{ozt&+fi7{f$nKi{cx0fk{^{Y#1<~YTm@5-vJolIk)oGcc z%*+ri0>V+p-y+i)gGel|-nD7C9Qc^8GCJd9FY97@NzTX~?V9Er`ir4vlWh>{txxfm zp}lR|%FYN3b#A`jVc|N?!67)(`7DUx6`NPzQ>vMM!#I0I0@i?pAO#_k1%h((n0H{Q zVjZMiWW$|x)jR4{?bm&W*^>MRKdysaIa*Z{aIDwMTe3hD8X)ri5P>QlVlZ-%rCH)M zYB8?T9n>wroIFZmx}_3j!#b5twW%=xv@UE%0j&$1(cwAox%B8bwjbmc%Bn60vKf{2 zZf6WHN!5v0mDfI%w#Lyi|Lx0E|5c?=P;-JXhP|a;>47ceanWlzD?HL~4s>fW4peH! z@!%ZZ%?IF?Y&CF^9HFWo=F|bwHr(>(kKw3dqnV-|0OGR$u>QY-t6YwjeBX+QdbFz(r^m;p*fvoEva-`l;n{u562y&K^ZF2^=7b5; zK_rf!-)P#J?a7!ac)=Ihuc-kI06ag3*xmbX4H{JpT=C1dqdXOpVEMGdsW4)=!HQzs z3A=Imfdi|#RE~ZBdTPc1$D>CQ8l8V$j--0VwYT*SYlMWR#CaYcaNlTltiE`npj&-$ zOKXCL9M?GuB5M49W}kA$M5P={#@2huCN;-AZ(9GYE>0FTv zq=gtRLE|q1>-zI4+u!ncUAKL^=G0Q^xo2_CrF)Up)AS+6@NPx9($LH~g~Jfr*E`vB zwlEBq@w;|{<^YEdnxa1$d;8X{3Jr%s-i~*M(eC4;>9;FG(LRQ3RH6e~7%VGt9JOZT zr00rOzuw$hS?q9-4@&2rKG&pZ)fSa0Qd9DsOM$40QT#@6aRLMD~e6ck)E!T333O8=eRw-zV1pG z`&PY4*;MEy9I=Sw*8PyI)%NC8xkqzK0+6oVJh0RB&FB2X&-n>e z>&vWr2YLawIgE8LTQit@!4edlRTZM@%;RZm&`14vVzTeqr>!m6Xlqf;e^kRwPz~Dz z(93=a?btAK`uRwy`%DQj-qwgo7`sbhD_qMru9}hFGZYgV!$vxirNK=IDu`>|d!$V< zkR)YdDMuelgzD;#^P6oHi-pASim=EL@qF!$LyNtCi7qy}h;N9Ns?x#Ja1x?QYN~V} z(3tq!K4`iG&DmR*KU4mR#z-QV3@q&sB#=a(0P5H;|}?+Gy$1LBZWi? z{!wBx-=R!V5|ZO#DO%+rOPud^iyME2Cr7ck?B$X>6YK4}{tjsftrTmluBX3!8{kdC zoX>9q_>F==`+J*lf&m}HchwdAoh}GZ)CS|Eb-SK4OLIHOS9-M5$lcUnB@Z=Wxr!CbuzOYbR4-C+| zr4o>WRu<-}d1`thk#*gCuhoxv?wVRiA*3|>ZBpA`Nif+^b;W}FOaBSl^rC1blqCTp z+X|5dQQ(^EWS>Bz+$;=;DBNXxiQN`4zwnolx~|4~^FG=LI|0qr{R}r$M}3}IosRO{ z)i~GL?lh&NXPi6?oSONE=apEhlcX8vG>${3PCd13{yHOa9&jOVAcj=W&4lziAZXR- z;P6IPkQ|O#Egv3wBkIE&%)b`MCK{qp<~=&f3>>{5%C4_~N+xh-pj8x(w!^yYF*>=X z0;%#yd4O~)dqm%D9Vf@<%qeLfbh1FrYTDKTgdGX3!^YRE0LL6GO=hd8z@`u)YikiA zV373CSEjh1-=Rg(BbQD(v&V7PkdsCQYfVEXlYshKaO9J3<0NxMVMTuDul(w`i2xw&`@9 z**4ojun7Xw`PKNX1CkEzs&{hC4U5}HD$^e8oy8tn(l2o{gxd%X4u#Y>YJQQBzz-fn z-l6_%!clEf)%o2FZ!%I&m+(LHx$_n^t}eT@bua5;?`vibfE)tPV! znHZu^T2=E|dZz`alvShtccxf6#siJ0pbHIxSJc1{mtt>tu5WP>%q%FFqgeFXp5_d@ zUZL`AK6HC%W?(=RyPwm0{rA&OVhk%FqOch2$* zQ!u5*h};chKnK&lGx^sWhGltHtV^8df4czK!Gy7GZ+X)ez{c-rjpJ88stRmROe+H- z#2kkb<>)6dUw@~0iZT7Wr2SNQyw7&35f1{dv)E5y zD|eo*P!Z83kp2Cm$cbmAD6PV} zKD86}i6F8hQndQU?kxXx4{5|A%ns~v{Mj*+77cC z{0KwIv_Gmo{=8b@T)1h+^TRG0VeQpY$5=MY|gVF_{^=C9aW0RAR} zr$19*B$|dg3k3x5ZtX%4qLNUlCpq#?iM=m!{IXbL*J-v)QRhr<(FLtvKoKE;Pq#_* z;($X%`Q-B@Z0SPiOW=LL96=Ta=5c>8o>;>-rssZqk=8o&K*R75g1ObwkQPvvoqgDx zHugocL`(3rP@j2;1+?3P}2%$SBw$z$51(y`>B9dGRW1%A{_3wlx*me&kxNjy#a8+ zawAjiLB^-_Z=e|W00c0E011>>)<3Bb4Ze_*`YXZ9@Mb~pSDj}YBb&L*N4 z({B%}^dSvkw93Rm1Y}dB#DrFyz~Du_mZzRq0;=c5GL!w#zddOtLFs>g=_CF$;`RWe zc43$T^pcUw5G&&v1hqXnR7bovs0m7yBw*AG+vzp|w z-duqOrjTA{-|twH4?>egCgqSc?_+{@(AICb^yFyCEj69coslOULFD=t=1+uHA$qTs zC2q4Z%pX)~>_6C7bT_LpX3PaT+*j8Yy&F(FYh3%3{IC-;ECtwh-a^e%50$Agyydh+HV z?pwZoW~QhRvn5UZ%`HIF^Jh2m5U864W{>0s>h8)+QJ(UFnjJ|9Hw&DmYWN91!rBTGLwhcy;N2LrB(2THj5)^i zv&47rwte5N8<<>J0dv7k`1k zn2tLS>~w;h8_UiZr3oxD?W7>;Kz1>kG&4JggsbjCxA9=9NOM3GdjN+rFJ<|^jf|Fr z@7tG*_`zkVzLp6^RRGBKxsdIG8?lV1Fvl(&I{=#aI@}fPt$?n|=SG0Ntvd!v160+N~z^7hJ1y-FQ0klnO<9F`hhfF(E(C1@#^o;d=Hq<)A_9YMNzEx0=#J{RE_Fc|9 zKhyN^FIZIt2NCYu@Ht%BdE`(hb?DS*BJA0<&OxD7EY_AuP-Ob03ps43Y_F9}gEfv@ z37qn3aJEoua{(Hz2l%#`zh0wk@A-!o0KmEaVg?m_U;@ButD{7RkddOc6}_{#k!8}L zgSQnE{s6PfvU9(sIh@OF&2I!|tw?1%5+AJtQ|k=?v=N8!n>U*!^%4D(lhUfF-PC0g zUPn!X89@4j=@y{MKgA6?I?JuBYKfWEws}k@sUj5skTg(191>@hf97GUf;GbG$F`87 zT4sE3CXco0=y&-fsD4^H-VfK3Xch+R5e|vlsOb3wo8boV32N2A?&qOXuvWinbn2{v7PKR;nUSbT;VHV~7R#wL!a|35XjPLw6 zkCmeFg4ZNSD?)m?CuxgVeDZguQl`gpdnY_|?MOUjV5>=AE0OT@+m|sm2ua&GG2<+j?YD&;km_Tsps{i*t`URL6S$Be7horAEl$8k%sMx zk7LV@0W5PKF|(5Md&RWvX4gi6)e~k%-Ob=GM2g`U5C&^aj;I6#dkfS@#?OICz6;sV zx@VT24hz+`V)i|l1th31C6+f1E%o}+`rNKDJ{KQOZ0Q{Q%|`E?Xi+lUGp|Vy27Mkk zO$Fa^I%)m0$$$IzLqLQTPP2*5KySB2EI0pAOdsAQP__MYhM^1{WmCw+dm3SjefaI> z^*A|+-leA34_j&HhH(uhsur+<60_6O z(FXHrfo`jjq)jsEjS9tH)+crklLzjm@m)!P6Q^Km-h&xw=FhnUZT%b5C;KJ~ZP%BC zjHtyzsm#Whj1Ms=apxTRK2HSw16>-cZNUF-<^Sz6Z)pFFqXZ551-hsup z+M^5g=ZI$HlsGS^rI}{=70Xt>K&B@aW(Fg5cW~$FeT9qOI(Fevhvrbb*I5r88fox_ zUN~?>CiowZnAy+sAO4JAzY?%dieaGwlpY&{h4-0ul*}C4wSc9{x8rf%VsSoB1{;)6 zJUeKsXZ71$XGR7~75r^cl@!=+(^0Y9IT)sfAT!WQUr3h$7^o{W2^z}8ib=YolTrQu z#~<>a{i5HPFl?#2U?e0lMr=+Z$1P-q#<2nj0$Frz?kym274$c~M2#}L{nZDd4Q&iM zr>@8g!&XiJFd{D*QDuvC{)CDl($s>BD^-5$xxfeFzYo>a>ZIkf-zoF7!;B!L=MYC2GuyjQbCqSP2H~cqLG3 zD?j>ea^}1^%6KgO&sX;!|0U}A1!&4!PftkwokGsBaqyjCiHI)&+&=k^qP9ct^ib3u#ct+Djx)FAOo zKm7R9{tN&6m!aL)(R8J?FJ%;!3c=Go!hmf)L#L7aF|{~SiAtl~aPCu&pN{?h!umsF;nbn)H=J@pl^Y1<1f;Ywjx#9Aq{Zk3I-1}Xl z4Hjqj{1TvX@;`o@|MU_6}6b_pH%NC2y!f;a_7dremd*9 zN}>my0dFt=rMd3@)al6+N;@c_hc*7{sT%#1TDACwAkO63Kl|Bl<9>Z&#@O@0_=}eU zPYcZmolp*XHccP5o&<^hORf6_oEYzFdgRQzoFK(A4ZRHa)3>Mk-6L!A_f|TkCK@EZ z)3oLox%MS;Z&JLrsr2kSG`uD1Eg?za@wGlY+cm3&;{t;^B1KOGlZsW##cc;}MCIB4 zdQgNz=#imb@~9WTcT&FHpeT>J-tirQEOpH-2^Rwib{r`3ZM9K+hP-rl;Pu|M_qrwe z=4$$aW(1m}3;kwIS}L1BH8z<*yV;eVXW*mi73rAv!(LIT(5S%bb1N*hYWhWjgi7xfy$oz8vGJtd{o?YtZ%f7W|F%5-$>KtkWUnjRBKBBta4!)pBp`K8?wR8E8=OTTiVDX#Bzm3|t z4U%$qr%`>Wl!%(=Lnl7TXdB{v<{mvvvbpEhCaSNN%KyRokM$FEy+^H@-aKCrdaz)i z9N8{v9Uvfmdq_&JZoWodFTYu*tV@{-X*`iN7i!i^Mfd!%sf_vw{e{9g ze8exok7^PeOeu}ZvklWGm0BHH;S@fwZie5bo2sDAPkz3Tk&0H-!Ib+;n0oKo%WyHzF^$>gMq4}+{z&Rn~;Q$+p_pF3@g$X8Lx9wTgl zlWv^B$@u1%Qfaqx=tRnZKtnWZB5Owi3-MV(?>>S-%Hu~3BV+niRYAi~o?}WJqHfJ9 z9F-7gSH9P3<-x!9t)2f$@bHrZQ|7cfx|D_!i?*_wx*9s;XZf50P#ipCeN-`Mb^eR? z;_}jRn3k2e0ee!qeUzxqrbjMG5M}Ix&YIb`Fb@QzlzPLQ z&fUFObfos+i|FHl>^S|Cve?--ed1SXw5Ffax*FG#Yq?%T`}tnh9xGd~*myY}-A-5= zo6lLVE*jsr^Lhp5PXW|g;DgVsoAbVY*@EY#r3N>7Mr*|8*2YpX=2+8x=>r$?)W0gf zd^=q8!YeJU)x6daPb+)HvFy-Nk_n_mt_NR=En1U>oz_?tTOKZApOC_{QbKm`qo!5a z^{ds;wk}Q&DxM1Fka+QgwlsaLa)s+kwnq*2tR2B1CuFgzlYaH_&r|G2ar@-^3WEA} z_Z0-fiSHx1yL~HHOWZ^8My|rBT_S2|)Q%?sE$ux=xv8=LmCpCyta~9KXttKZ=^^q- zS!pwDZ^hw6G;ho0M>hs!O7;i*^ElkVZ}D$KZRGF{E`b zD*GR|$?xYwR}&RZuh!lQS{m)&j0O|aU>(sL+MJjj`?w`Jmuv>}J%ehd9A4Oe(2(e{ zpx4#a$*z2UiPn8b>j>xVH2NBDm2(}va>!o99H*o6B} zClFR@+Y$)|q<-((kwFUaMNGiN-mbJGBey!M=Nwj49j_!Ukp>mUKEPpn>h14jo6vTVy2`EhqQXzi|8Mpyy@RD zI=aLBrai||5?-Syt*%;ywjnS&Cib)T?OV>}R@Q}rQUz-(J~@`|X{C!FXa1;d_|>&s zcXE)dW@tVi_&={xYD)C7X(v-vDN8Jys}>Y{P-6a`)T{y(4)^Ml@ol|);!OCi&^+o z90$O>nvXyFCKVP|SY9@LA}(n8>%$#M8nOPxVk19A%kowV5q>6W@05j>M(S7X`=n^iyafquEYT3(qeO z9|^i+C@F`%tA?)?Y!lVJayiv_7o|xFB1rMkz8jy(LL7e>|MQ0W&FjB_7&xMwhEbLK5_U# z&sLckDZO9kr}Os_iKM62uWFQI>rYSJ7k{#b^1Xie3AOlT!0zGxsp`<#$3%&oCw;S0 z(LwI-N>*36Y|41M9ddud|4#`rdF{IH=UfFd8N31Iq1N3i?=6$HGOn}KQ0oZ zu<3JoNgCIH^#-SQY4Xe-v$mJ#MpG0^)D&JWs$Q1cau#)W4wN2t3XK zg`H8H`PVx2+50VJUT*B|&u~-VXnnepmp9~)tlQjK&Sb3IZ_a4DyR6}imxsu`huqgEI%lQTFP&4%xoS@i(DM~-P1MaE&S*qwXyQ#&G)L{)?cIqv zt9c?V_FvBYxxTso`1g#27T4Pyc^&s;LR<}U(NkG(Y7%t{d#SSM%r9@$e?5!wD(W0H zi>l^Lao9;!Tg?}va1QkER9eVp@p#2&``Sw3E1WV?6{j|TPL#~64+hg_Jo8j}w@z0v z<+w%X{sQbK!LIvYq` zl#hgW zbX+I?Srn9G_u3PLidU@o`-5l8zx>u^zR^Ine1BA4^FR=#$2o8`8TSP1`sw+Ro`jbB zvmBDvcl8c&P*p639mvIH*{+*LuPEQ5?uwhG{EU}%ynIHe)%zMMG|IEz>y~wIT2YLL zo@mZH%YnE4&-qtsLe%_xUbjXIn_c;JbS(0ba#44c#pu}QYSXLm-~W%c_YP}nTla;R zSP_w>h)7pK5fLIabgaC zi(Lh}m7xb}elF7b>~!+CUu_xt9lF$S#W=N^O7Dn7Cz{>diR49W2|jUzRdz_cS=rgI znL2nHqUQJxXph-7Ow7@9EWq_e`na~NYB@4m$i{9I2QS#{;QB;2OZof3;!5}YXZyhp zXaHVM^oh)Bp>w2Wt6~#NB^o>3mlGTAEYkn5LH*6oE-o+kJfJyLhk4-~G_dA@%AwSWn(Q|B|}CG0#`*wom9vG zw%cAU`Y7+Tzk`{(l-=K+gb}$|4_WQ-uG8_sh!-*X!!`)=335c%9Gsf zKg7;I=5eakp}B}Hb*^mV!OqVHuZ$(-ir8%~MG687&`EyyvfD1333&lF?ow` zDPo(24%L4)<}_o4sDNj}1ZOyzbt4Z0kM-yzoyFW;2 zYI1MlD*rE!jsnO(_i(GIX&d8rT?g|e{ek7UZKg2>=#Ojm$%94Bu*n3rixXd5 z^^>^ifT|g6Z6Ou|W~r=fc5ghB^;22jUc2@jo(l8TF%5M+F3AS^?mA6X6)MgR12M>( zNkhN={Fe5Dc0fJJ<)wPHg$Hb8rab-*e{MrU#4M!8N)0TuJedkpI1Dhc#W(%8W4tH| zgD@r%R%TDsGVt%~rF?iFJg}e8kJxjelqxkDzKL<~@}VCPnCLdp2BUMWE*0@si^B1C z$U0$NK`i4 z!0$mK@w?R+cqsqw+kkhae$ z5#@NU=U-*gOe=Hv7%`d)TCZT)*{8A1_uv)t+jmQ(US;ZH@|;GQ4lI}mJ?-!$X5r@4 zQ*VOL2|cw^j%`q%s8&sU`U++{RbYedleTMmyiqH>G*+VYz6^0tw5makssZr)yKP6UEfis z0pS$KY-}~%HI0mTN}INf9}Xcq68lM`3=yfRtlBY1!bAJ(0%^iysj!mGGFvD3Y{3Q0 zz!E@$_dVF~=5wrGZ@n^JyiW9rurDwfB|ao0?m#MwQa)lL`ta{{PTNVNi?!L2n>kH* z7qW&!Kg7hh6Fz`@?fkBByT;x=ii9zHwq}vcWmuZ(^PBTi~v~=ieSXWRW?Ds z-@*d6?};RCzIisSsy&c45MQC+eg4EuV2`BM9M&oXkAS-P^_Fgu%4b)mz8>_zXjkVg z;agZ=3t;!1!oW3z7Lgg($O*Qhm-|Z z=o{G1e)sjiP|*vS1j?)q6rZ}9PLUyt@KTaXe^ly}Ychk5G3?=tCnqw^1c-1fZkWto z`)&gQ1*!%>Qyd6F6HeNtQ$p1^v@Ly>@uIqPNsv#s?4a{Q9(O^ zUG3ca3#aZ^@s8G651ZS1^thcIs!$%zE1a!2;3jIc!B4RYIll>88LzhJy(DNiacjv# zIwUw&$0D0)2dCMPJe0BPZ=F2pj+CnMQ`M`w)p9mWTNuH(%zc8L&o;5vnx%Pa4LN-a zysY6^us+jdVFq_N%v(*LIydMl{QZ}Djx|Evea%sc6FQCviP@~Fa~u4-73MuTz8VsD zydEsJQm)?nm`hP?AdIu=R=E66xEe0zKZ%@PTw3Y|rcqrntmn_1Yag*2>%jFtKvcjCaDO?1cM}yNpOD`88bT-3xn}(CI^TSKH5^TW zl(+Cab(Q#sq_SZTH}he*TFkU#&}`}Od!fy6j`OCZyON{hSMO8rrA-)_bG=&pM(Fq* z*Q^EBPR|~t92}-dpX}J2tWG>de#sa=INYS?U!M_3bGoJJYt^V%QYiLPZcCf16jUEp ziz$QdRZIS#9`JkHFwkV$j@HH^sKBbs?hi?C0KtmZqlhAm!4vajmsPe|WU z(Sx=ycpr6^CqpI!AK30(`w>A1Z>FdhEgvYPjqV!gQ4+M3`#g;2Yk(na(0CCR-42^C zS4|M14Ed+~W?crPj4t2Vzi;e8RQ4qIb=eH2nT(%hJYHS`2WVlSL$!TtL-upw@o$j< zLOfd=)0Sqipx7l3OC1wwdN<2NopMFGd5$cl1zAc=?5Sz3fb4g|Kz? zWsnwil0A60cKNVP2S~QU^IR$Msmw(-LAoX84xUW8Yh}yX5~;?g4RB}4KXk~MtKl;g z4UUh-v_*@HS#uXKB1kivpx#5F7SQF&9)wqrhfS!}Wm>@p@`#4hm+cJS+yrmfcJv(I z+E$x7Y5w%}_pf986+;`l|3Mo4A`jTdS-Zj%WQ9k2o~KG)XZqwb(+TsFbhbST_%scf zZ{l8(zOcYDC}Pu(*w25`5oJFGIf&a-r2Q9{@lc2&ycKPx(`Eq^|0U|#RNbH{eYuHG z`5h4zd=jZx;8lAEo3zAush1laUDwyv<85tM6d=c-W}=41yy9+`6_-_5+H^cR z`lmIFj2sY(fmFjyOVrspBFMe3fF;KN^kHNfbo98bVU6o&+0)roi)Dfkw0*e?_Ru~( z+{kH2-|MTw=#x)Mb`spu_ws$8ex(cuRn#DbP6k$FqssF|Z1u|7QQduHz!n;+pPH)9 z<}j#uIOSY<=Y4nIE0P%-`z`SC#?QyJ9XE2Ov>5et9T6h4Q`I*T`@z6>=O?@SjD065 zO=h|h+HX_J{y;D)*7IY7iXf-#hU*HWR$mtzL-n2q()WWyw#nGiixyCmNaF5j#ainfJO z7|NZ?!aabH5t9D~HYQK@-zktjlW|2-TsTGnw~&O*s9g2DS=d!lyn)dz8s4v$*6}P% zvErIAy8IXhjr3vQFLQYw$NDcH(RbS_P3jLpGXMyhI>M{@reRv%m9X?DV}#oQTfGPA zzo(qVu(wIhqmM-gRur4TgQn&IFm!VZvr@52KFLE1fp_H);8m2Hinc)?Ayed=Dn`nC zQwMy2%d?(kdJXK^$FwD-#c}Q04~n(<-ZUtBhI+r+dQd_E`c=lJ%tUB$cTPU_MBwRj zE1WFiZy0^JrI~G?D9hS@NxOHKS2CU*Xl^5;SGGbGFYZ@v=+;Fv>HIqDcd3U%a%%*7AdsaZm2k5Y6mx5bdO>BD6C_-vlX9ydO_E(UUQ#K zzCK?VQ*n~7yKlt1t%j85671~q(yzNOaN|(TnMOCkCK#a0ajomJyUsYB%&E2cSZCY| zb;tg*j&{+b*65{e**UZ&bl9hUeTK5tMxePvxt@rB*=O2?H>xL&+l$s+b8QLlLoY>! z^+r5Mq?MR8bP%82(W_rw@~Q0HRZ}Kx6axj5r~c`D{=)&5a^_3oaVhdp9rRwlF)`7_90JsVkxo_{waXWa zVvYncXr*=x+WiWCyPvw0NCv3;vdM($aUCyb*$Fm zOy6l=yRr3XMb%!a9F9@aZOk-_MNVS^#lm#5^xpC`OENEpz3SmgEcvE+`u=DUiajzl zj_q79)FhaEv-8qgSIk1+0|2o>#V&b_<=guuErhI-1KtCk5M~I5un^Nq9h1e{v7j79 z>MBsV$sG!A+NAx^2>4RxHkFKBhq(~2VX0>+@ys6qZo(g`zbDH{F31P|1oOnG7ISgk z)QloBOTCm+3MpVndQ=Q+)KXt!*TKp6*?G5+ciXu*!_FxoGCnJ{zY&L?722g2e(7Iz zS%ehqWcdmRygHMPBl)lgrAH6T1>}2P)twwK40i zpru4qTDHHW&6U$w@W#`5n`_#~VlZ8mX`x&ueK49ROZOqV8oNgny3xA z8!K<3Wh=~-g5rpugX#8i&ylPA@+1!NMIjOHRo#!%CQsjNE_)cthSC%xSo83p1fzN6 zEYv=1RkSvRjp}neM7E$g0W>heaE_3RjH+@QC!USz8pDFS77C2-?k+I=IA0{~-@poB?eKHga_24ZX!JwqG`7=opn)AC<`e zv`$^;3FA)B60Yx_T>C_-0prf_G7U>`Z0>w2#EmerB{+vu4s;$410@E8mi!w!VfLT) z-t9iEDdi?q$=vl}6GnJuGno}sxXORSnIG$jjP007J_ypf60$F3i&PVH%R4$92RO2l zXlYvxcRYOqwF61y?@d%j$ z%w~j;$wrxqZOjM^s?#i6RjR5-18GIK&aSb6O>O)=c9^bEyYk9ImXc~tc9HkWX^RSRa;Mhx>y@oqN#XAbZ7jI*hO7$ zeYqRONZgTTi=1nJ6SoEQQn)T%PaG{fb(Eu;e5Wsg?!@u~)ul5{`-nzcd1KRJK8)A$!q)YpG_oSmY9ORBeOQi(G)hPsw0qtK;4x=^v{_|Nc z9QVYx2}|9=M|v0Lw~IeNK=7G2Hkv7HmP;;*$DXH}+sg_Aav`n(A!CLFX94pqLZDRi zyLF577bo@^-T3;!5T;a_-rjfHx6qc)UwLwYOB)shSEssCK}jb~SML3QL-ilGtNp{q zTsNoWwzr*cfWc!vA5FBSPKsq-#5^f22;^@$cy_ArQNC+&?Aapsm80(HLNvzC@!Uy{ zal(dpDdX}K3vF<+=in4_I%-Y&D*TZA%JMp@mdfWhMQUbA{cG8$dw@|vLI-4S-Vc14 zDq79>8PEKMZ&+U?EaICpd9`Ezd?6*FxQH z0D^`ct!i2mdV0I20UUc(>S-?X3STG_vYPiN(JrrIZq&Grbjq+-kRBHvD(&I@}h zXbPtU1Ahdy2W#LDH@~APR9+rFHcpyPtFB@i5eJuE*ruud2&a|U)@l5EG|e+U=O3Xo;hN~N zk{}QhPSexwd|C8Qj9&Gt7m*Fh`*N!K{dc3`NQr=7<+d~psA#JCbBdj#i{l#kMb#=@MdBMJb2 zj~VRjtL;%yrMhB)&Uf22E>vR!HwU8G9S1>0E>Ni~{01V0m;n2h*wq6Q*pl;OgN#FlJWgAV z{J>=rRC%Y4oV&xckU;i8dO=A^Om~6pM1@)El{x-86Tn%jvhGSo_ z+u~r=tZ$1Tz4x|>xFl}slX91BiR_#y(lY%Ll@O!|>`FOg_L}EhK2f8Zq=sD7 z66%etyomy|KIx0v?}s zR#GR7tGSiFvH|px(yb3!t^bFz=T5SZ>bb*;xX5X~x%LdtQ@j zJ_V8j{d`w+%fl}f^2YhJ?+?=?|MGJjnoFDJ#>G0CoZHz$^~T+p8fUa^{eA*d@jXgB zoYY?^_h6ER_FdxY2mb60#Crj}I^cT|q zNJ)7P!>--G^-sI{g$(&DhX#o5NqcW$Sb>S2A1K+YXw3tnh@OAFnQz%DF78#DqjDcm zZ24hlfJ~^}#OE|ZS-Xig2ysZg(~M{1K0Y2}o4|IWeVuxL8V|4Sxg6d7z;sKx z+Yp!}QQ>V={HPgZwVj2oa9U^O0&&GMwrAwrOZi74pu=@~AFDXmjq#?LvGNif8A%1W zAK{*;zLyqY4L#Cc@M+KR7qpvx$eS$EMxY+Iv4Z0Ei-9QXtIvVd@6UE|mquZL=uLW+ z{p=lX##?^%Ko%$Y^jQw8NaYhxqf zgomYYO5!LYeJESg3v8d*+q*vn2co5Koq>G8s6w|j!R|iyTj1!dbraebl2n^(80kN*TFIQY59z8Xt#7v0mVtnJ908M=5WvS;s$3evS5}#lO789!Cd z3RlU6s*E%|{cu}v>HP~h&;~@-*@YZ^vot?_YUg%`>lyRd-_VwB4iJrh8~gW$N&I?>S4&zaXAz z4{N;ey~P7o(l5D$=eDWWd&2dTtA^u)SN?Cb)cYTde#rm7`ZPtwp}|I1T6{}LYL=XV zwF1VIQ^}G)V_=7siHr2L2O>I`5a02)&9&c4U#Pr~F3ODlm=T($caDOASH=vMPOVVS zP?1J+>_i5YnxkB;>A4^BXZu93*G;hpU)!i|o?zPX-pbas{t{;RL7QT#u)Cm7`I+X` zk5W+-TB-dJP4nNg*D#M?_~!NJ3Bc|lOU(~%avb|1X{9cw8FzOu#b*6%3jC}^|G3oV zsv2rP4})RsQhw#i;Xvo?vCnT4(|hJ$2mUV(`Vlgcx!Up(n27T7!}mlRRPE-O^TV(H z+l_xLZ{0|KJh-{gNy#pdROu^%qd~ zr(Wj2-TSLdCx9L-*Wk@0-HC9mp&toCKRo^a7oR##Y;SLKuu=cSet*Skzn`JEo~kQ9 z$08;o@kJO}X8K@tqOuWaPN2}A_&hYP8!Yy#8~i;rbg}{!D~y2SAf-?F(LWY+su`T6-DzDKYzLU!318AE*M z{eM9vzo5mhen6>(VHd%VU-8;6C@6?>4W)ZWQ!3$hst>=inES>Z0(r~5m2zaP0;ox` zG9Ox`$*Qa4xB?rLT?SIW4j(gu9WR~B{Gl^`#c_YR0|%h+$jAq;V2884S-=1FiTp`0 zS1^$j~LpPS7uI@QXt> z_m?p?W~JV@Xmz_8^!L{~ooF#`xo_DU$8s46Fuwfy%{x-+%q}+NJj*237K2bO;m#H zdoed~OzgiI2->*nPEe&XY*BUp9AfIRBjU~)@ON(qQMyf`=e3{ca z2MiH7Nzzt*f4Q&i4Z~l)(7!+U?=CqyySTUrB(wN|f4L^DrypM&w&ro`6vbGWl->=T ztp@xa6e_Hq8h2ALdSy?Y#-9VB(Dwh0B`qyIYVnJd@BT|w_TzOF9;f-irA#lBHg9ka zHGAs9RT^3VSrRjxR0Pm7%`~LzL78Lx4TnGdK)mBlpwMD=T zVv(R`KKNXF;G=`a@;b zUl5keRX%@22vgT_!Ynu71r8BwO@{BwBAskM(Uc@yagkvEd)@tu^N{&yLLnsQ4D68! zDhm1cLeJyUivGCl;r6#wpkC5toLRrt@kW^RF8wMh*ZoNyD=_V*xoNLWIt!SQC-(M7 zvB3W?9_+m6e{e^Uv+LpCZ}ZiXkCYv3oJXEySv|OE^=p2KD3?hVuoyVZ&tvKZR-@oRsz6FdmXXl4)vl837`wG;*&|)Pg0fCuiGCQ+m zQWXSh+{v)cJo6(-@&{l1=b!xVT555B!>1C*_43$DZpDqH@P z0QTRp^sn~p*S`qYrl{A8*1z~KYxjSC%fHmoG8cif3QV=cS(iP zRWLaA6uH7KGE)C9rNIB%0{qR-EH0j*-oJ4?!t?*p&i(TY&0}ROEa(8_HFlG;`tOm~ z|M=Uk-vL@rzXvy$;ivh3yn$;M?@r<(57r*>=gWT7d%D?jF@EQev%+%v6cc^ER42fLoJKJl9kVQz%)+lp#5TjVc?f@g+l0-Lj;Z0qD)zw9(@M&t@ z%~k(Ftwm%)p#DY#s3j&OvE~sB*0Qrc`~VRwruc@2Wu@v&Tg0v3K_*&SI^Eup(jVx! z#}o!re23DFm>4AT;69`_mn{GC;*0B3i|_GFwVm%la0cjTrmE<@7U-yrdWS&9F2&Y% zfc|~{?)MM3>6hcHXH&Z39yCdO=&X5cE;$uNXAA49yR2f~{Pri`%L`rqeUT2RH_e!X zPwC~y^d=wItKA$nn{~CdyHZ&_9v9fzGV7MOoxcW4<9?JyhDi8%a`T*)?Yr3?%V+r`X@c&>)+;jU^kpo!U=z#V@GR z;qgxz8t4@|yb;Esx=>JTvQn^ae`B-byPUYrN*X1&A@3%`z~X1DW6LTdj@an2btP58 z-&Imq5kYj_j*9zNA{-#xy6B#JOU49~S{$+2QwY_P-(55*f(#)B*|r9L*-P0Q7Ldt` zJ~33;p*VzGE(k>M>-uTT@@tQQp;VZClj%Sm;=^fy?w-Er5+m^*ceqQ-&f1Jnx?o-Y z0#aac-&iTD10psJs(Q!a?AOhhdbmiHWj6il5qdCF9!;jnP3-vOfFQ;3=nF<3LwJu` zF>T7ZtxoX~fA8hXk!jk0T)SL1czJ1w`K`;S^*cO0D=4*YqNQBpL#OBO1BRb37Nt6E zg@SF1fxyew=*&7!AgK~TYa#KcI`yCf`rM@7lP>jmyv*jmF8*#YT|Om(T|P7+NP{{% zFEC5Ibs4hLmH49|JOH;D7rva-DgnY2D%W%4)BwJ{WqxKDHK=3kXG15CHFwN zC#Ez4dx-T0yuBPIPnXt++o|q3aRR&(aOr2q-pAgFv@-FTKBtS4gBG;Pr+nJFNNm(I-}YkyFBITJ z*$RLUaR49Yqeg@JMU7JwTn!KgDX5C;dSh){qwlwVlJda0mAV+#5}r>Z2$)va!IMpf zcAN_{jSVxJ1kVhpZL@2w%h*O7!A`5`nHkJAAE03Bl%j@fwFGRPrK*F}H-18S!33TShN*MurLpC-fzmljG3F<@BQp<3hK>m6?3hDy6lyPs>UV(){truQ z@l6rx-x)21TX!H*9&5{?7Wf$o6HITQbT_C?o0lfFVYi9&CW+j68-xOPN+ct0kM*o6;N&QLc?9d1K-;WGG2o5(zZ-sL-o zLmm*v_$jZRBaW%7Hkh3XtNtyFz;w!jT%?Ql`A?#Df?fNRVX>-HjwZQUb)q!$@!XuP z`&94Uo17{g%(C15!Cph=%zv^MQb)#DP!wJxVCr>(-{>olp3cvNW0ELKo%j;n&{b*M z2i{(x9f%LPLCyR{6=)u4e^Yb14z>bOjSnGGGx5v7o};seiqi7e_>EgUd#!IN8a;WO z!mrKSxOh-^N7j2c-f5!=f0Ju%i0gU_?5=*;b0!njj#99{>i~VSSXHDvTT2I@Q-M?W z5qX_#DXSF58sy8@g7(Cpe05eX}%OTH78w?)LPFBfdcQvPz(`!3j+a9o|{ju=!^>QGB+&-%^I3hPnk zJ(XeFn7S7zyXV^HZ)7@l_L0R(CTM38#5vRYT$#jF%GmR@jJivl+b|o9_@|wEWJMK|2Q0Ev5*|KsO~~bF8^HmL>v+5h>RfR3s;ybTH^G_!TyBO}2Eq z;eu>4W{ODAcOJf-4REna3!}?V=409}g=0xagy)}JTpeqAUjJhsz9!+O9$puy*#t7` zF)TImtOv=)$z>*F7}FTh^bQoL9(J5tu&M0zZm=ay??_9B-#fnl2Dn;>a27#+y#(18= zPrcrkiD!gir)h!-*L6E_AhJBneQY4|S?l8rAi|cKpX25d%H&|zUc`|1*YU%bhku*;%~)IF8l- z@#QDAut=gtfGu+A4Yq~NzDZ6f)OF;Oj2Rc^RL#a{>8!n!2Y~tP>JQe{s?;?pN7{EL&y**PR5L4Iyo=LDj+y>QCU_(y#^#oVI4NR?uQ8pU_A-AN`tWb#ecI?xhWgY`aas`))pSLaH7oM_g+ zEKaZbT;*!I;)U<}w720J_z!*By`+M9tW#^!_nWbWVVfP}q z#@JTFf|!XCa-bB|5O6~YF08wgz@`$_dYlwb@E!@ILw3w|gfMUw@O98g?F%|Sn?gD{ z`?AGW_FvD!lJB1k?0q}0b>p!ciW%y6tch`;-)m;jZd2^;W89r_}T%M^KanRIM zR?X@;|Gbj_+3=D>hCYSvbb%1Ica~P}9A8KL@s7j%Qpr4!bexU^ziUgCI4p)#ez_IOkLLY2Qd{raVWE9hrr0H1ggZrj)*10Kfn)&;I^J*onj=O z^Vx=*ctJJvHv5j7%8rCw-?Crush~|#d+Flq3;xau0jnkQwI4l$S(m_`6hVtr)gdGG zFKn+=`8EohQt7teHVmm1K81Can!91LCc4Y-i4rbui|LWEJ$bQYPuTS#ecpQ)!(11;S^|C=5ti}{;X(J!xp;kd zhBTN-w_Qqa9O)-{q(9!l0AvW-mADx!v=omyP6mtmAiKCzdRC{5UwP*@pDs2>Jpju59avc;F%Mmu5BC~T7CU(|z8asp zFQ{=+yMqge& zxVWbf59@DDuw=3H-E9>!CX~*W=^=@cUO@-J!-$oqFs#f~y5-v{V?B-o+D%ESW5?*< z|KxDI%Jm)JHcb(rVjy<|5Ly_f@jOmZO~ynCYlr=MCQ}}0Y+!3xfhoNYy*Ps{t?RFK zEJp4$HqRQ^2)?U^l2lwQ-cYmrUarBJe8po~!9jdlblOU1;SVk>6~Z2Y=?GMr=nF=| zs}LJhV>emOVa ztWfyacAvIzz|fvoV$gjuLi^40{)7aF4U3W>G_5=IkqYtCI>3xo-+HwL^?Elwulzh_x=3Py|h`h%jdVP>Z8X)_kczwAJ;(ElMgNX^scH(ks}V)%dL82J{40p ztx`@Q#)h}B%2!8-^MJ057qmzy(yP5E70+tzqgrgkUxP!cS|x&<@z`Na>$on|u6sha zL(21nK%t`TCwl5t-l}&+7%XI;Tb`F3iIF?lrQ39Wdr!^bgjTjpli8=k10BGd6Dggg z$9q~<;V41GXMhLHB_8E|DISz4y;qyNxK5A~9MERgee*Hv3`Z0wRH!D-y1rDWH@|6o zf!|N`MmUh$6}|Z8Mii%ny;82kTuo6K8+eV&z2S0Ahv}6cQ2>9fv&he)CByaADAK;; zLhjHVgXMMfjNu*bT<=Yc6lz%s9y0*n6I)w2=e@fjUkFjWNk5>{Vigj#guc%IGFROv#(bU_j;Fh%L}VOnae zb0=46U0-HFD+lx_sO0dZhI;9W>)KYtnAV{-=wbfBvvnYD2Trk~WPTOuzGodJ#7pj? zRroAvhKY@+^&N6h35vowmL_JP>B)w#0B*BQZ+B(Jir5_`ZmRH|9*}l#+IsxpIQG`Q z=AH0&E_AtAi`wPeTM_H7QY;Wg#7|u|!g>EIyEW|XTS)FySGCmCSLnk(g?))R~PU%QMV9lgOWsvM~++a_!@ML3{W zQYhncl-Hs{eMIXrcBi*grY&dU$Ls5OOyD8i$ak z_IEvA^e(J@agG5WDD0u=M!wrh5BeWnt$hi9~7Hv)iRYp}4T)>mEX zwP{`ZH_<@3qoad2b~v)-y-#v4q9BcUVrsj&2N5zk^pADf?d)v?{#jFj#GPJs?|Vf9{ufT z(YnH0$UQ6m?sxZ&9}juXW4xVhZ1|0UyV3KKyicXq`kR*qubSIRS$*)$5GHZqgIv}o zwFRx*g@Ra9Ez!YTUBcJcfSoM`w$xtAJ4ZWPkC*j&Zg~wWeC%;^{jTRmQPU|8lT~-N z*B0P_yT-n1Jw=+Ve7N_~Y^lEQb*1V;0HwGV3-u=VdBK9QiU6Ev{`s-3jAYfiKKgyE z*6nyu(?Jfgf{0Kyu)yS|b^)4S$=G*cTI}LeJ{1bDqY+Z2Wa!Kh-c5HQxtl5(;wtqn zZlK&JcVVK#CB=q5A8y(lGWDHB({aK54|XrDO620wV(m;x5)5)b!WmbiDWFcFSXamO z-If;AUcO+@s3#W7>^p7d{$)&2Of`SYakH5K_a zj9+RHo-Q%cBp=}>bQk^MQZ|AZcfl)T`SQLT1sN4XMP~DvDk}H8s9n6NH?kc&^I1Qx ze>W#18>g|)9F4oLM{)HiuYw1QVUY5RRFe|JmLcQ5#I z8zy^xD>tM(%(5=!}cg63n6XVl3A`*ODqnhffj8o`5>e6axcR$r<|3vP`{sT0v%el3@h0;Q(S@27Yk3ITAberJ8U zJt-Hp*GiY(5h-J|_&)V$M;}ND%hzrxo9|T%6#k>kK-wxCJGlXo?B?O zf>wI1#`d5;>&~3LuB9CSR$yelr`mnuJo6c5`DeZ-6+$%WGB9zPPj_fo$5ny0mYeO} zLC1j}Ur=NRC+RG9A-=zIck5hk;EUMx6)m}y^`hEFNvK%r3hoMNFW`L)P{b(rT0Z5j zA+N~h9dE%mSOpnB_0CnhXSQ^%b)mU!N&TEtOH@#)NjL;ld2Et4jO}&@HPanTPm&1_ z0JSbjXj%>!-6=Mxj&d1bD7~zx+d%;!T-TOCVrR-ZmXe>@dq=pkGzbtH$USrB2Tg`l z|Am+}xB#B<;o=!U0zn$9F4!LACiRypAZwBDq%EbnwZ_}&vU z?7(S&7qw`QWcrRbi5C0Vi5qQIJ zN;vWU57FY=NLg>NB}m?nwqrzHg=m^z_r4g2QMk^OEXZC-VT)znprjcV2G}K zq=#q+RBUEt;e(Xagsw>-)+4EMGT_ReLf+q;Do?lr$bX$E=mlk-_>MN{PILF2ieeP9 zy;8mr7{WACU^kQ%L@ZPpf{;E_J0G>Hb^^Vc(Hq{Z{Ox$@k>67H8^UdOK27SGjH=Hy zdqZPUey~?U?_4*K#;0~S*#}y_HQX_7c)SGKlNe7+MeUgiSbnUQ$yubbYeOoZ90^av z03Krr05U~h{VJ@QCp+_eoq#@sOI&LttVNPoy(H{;PEoILbL*By0v%)m0>)~JRwkMY z559WO^1;OfJiA@h{Tl3s>dLpApK7}JX84BO??8izz-%4=1qI>iT%W=cwXa3vPqwn}j-08&Igisb4!2+q_zy39j-q;th$ z*rC=C1Pt%4mdl2pKe5wN8oH{I43M5{(&Q3VbeJQt%MUwo(ocKg<2tHZi0O5*koyJd z{gW1$8cscQKtEWFZ9?<=F=9Q0LUE4^70A0-hpgIoUx)A9-T}M}Ko3Q+13xE10yRS3 zsh_Z-CFH3|2XY9YcHMdqMDP01UFXf|6x}GiHZ3UVsxC+tFC_K*PVQ+oF!l-!>m4fC zcq=0j5Qe>BV)--z-_$t^A7l3M)zvMdH6TUc+--gMF>j`3N^$xr6T|J#rzt(S0+Evw zJ#@(gSL3Q&8Q_xdlB-mv0m*%y`HOrBaqgiyH7TE_Gv8}d+|L_s=#8i2Z`=FAY~*!j z#n*5Xw_80lCziqr0clR9s5VL(ucEgN;1rIvmBt2kuq}PLRnKBR#wwt_P9yQ&^wxqL z_9<*wAx-KJ`!n|fOW}{+$S-8H{@}t*l78tdvb*jNKD2$wFsJ{q2k!=$oj{8eF3iAW z{&HvF`3=y~<{`YNWu9Eo?a^}ZX(3QAGmdPyEFYeA2e^D+)G9O*=sFv}c}4=?3vVAS zmM7e=oI^BC8LCsWul5^<<~^^4CK=A!_3a!%y?r#eDwZ#R(7O9QWp5f(?v3${%l>gV zC|qEyM9y+H%+GbiqQZSsinxu9u5g={BNFU3JJ;%|`Un*+A=~duU?-dGO}tsRGytnq zAC8*t8)~*U5%Tkv+Hz(!H&RWhudvP1g^xKf#mk2_H?GeoKknBX<_47s|EX1#WsEAF zM=-U;kGu>is~lOZ{|{~70o7!-wS9H$*l7v^q9RR*NR_Urpa@6_9ikv0U8EBTVnOMm zK$H$rLy4icBo-jjkzT_{ga`p51PCF7{4b8q;C$lu-*4_+E?q21-glpKc6s)*_c_N0 zSu&qW@Te+v=Fz#R2jQ(EEvCGmu-1u|shfV8Pa z$dC{*MZvO)-Ajh=5^p=U+*gtY)L>sY>L&y*q)*e=3i2?2MpXE&&a`x{S^crDz7K+H zr56(}>D^N10|=Wi(_5!=IfK^v1{%_(YqKv+y2%%I-tn*m!XfmCh0DZOoqBW^uUtAD z>8I>hJ*b~eL;_(dZ~Iy8!)MR0($$ULL->{o!WG>rXbXt5m$q_R46~Fd^}Hvo{C@kCKxB&R(^N_~`#~oe{TL~9lBXiwM=75Y(W)+Q z&YZl>qw^>a(kfZNwJ?G#kH*_BO0Vf^Kn-t??lW$mHDuCvJ+zwwI z;zhd8pOLSs@LDgAd_gX7#EyJjuCt}1b(dM9$J^7DD;+GKbf`l&dff9sIPK&!E%t5? zx}V*};}(=%A$z`lpL8P$GGF;*Z!fm0xntI&qSLj65UX$gcG6JQ6+7T$XEE~`NPV{g zCnGsVPhFU^PJ_=I_;WXtL#rNsFv)G@5Py9elYq zJcaqml)_Uo-trr{vX2OVf4f9pyO7NKK{HD34d!ArTG~Xd62$WrNyDk6}of935C&*$n;WLWXAIKtLbD5(!%eu(wj?% zF%AVDm8nfTv!%PgK1V*>-B2u=7weZW;rzM8@aw5k>O|=P^CH{_oA5|G9^`nNq>*9t z{ABN7b5mJq)&;((`Pl|}?FAB`d=K4P5p18owRRl^Z=S@M!w|Nu{s-P~36d!=jfXH8 zwv3Y~*?Wfi`o|N>U1Xo#a9z1F?2+u#|8P7-I>}XM`Tdcp>;4h%9f5tvj_w^D9Yqgp zKgz()OSa5uyodws1zL0TRT#}f4sgpmmT|7=t`j4U$wB}>CI0+&9L>(6SeP%+VXxOz zdn?xzLZt_za`T#sZeUMgdXZik`P3P1+oHftIIgJGt{pkg#JgXQew@40f5U0J=Mj__ zaB#4U=mqc*I_I(c+4H zvgoQf`Z*!wnZC$7Q$ELb*I`-iF*Ca)4wMjkp*&C9k=sk~DSzPF7s=vtSjP6f@q0`Z zPCZR!+jSzZrkz&rygI5V`H;JpkdJoJq>t9bvFFxslp&A5TgS~-9MHhI4;fQ$Cv}X= zU^*3dgn_OlI8Gbjp{^r^5&69Tn}X8(qHz@-`5}5?K~;|@l->sYCuX}#+?5E`F@Su$IRi+i;-S5ENo&MDt4v)~5$h?|NF59jM z$;r~8SN383gBT973gYmEJRtwG)Xb(LdkN2^!KK33d`g-MdP@gtCJorFd1t0SyGhiw zMlg&ckpKR+c`Z=MDf0x6Qvf8?LWV!jw|>w|Ihy%K(r6-9a0>A3&W=g&UIGU(-|*t{ zH&Kti*gW~Jp|T;7pK|_a=axu5i7xZ8{uHrrE(lsv?y*d*{=UuH{8?hGb!^WD(jvGU$6s>lQ#9^T zMDf0gVJgI*rsZDAr;}u#66;pHtSOlie#WvSHIFao_7WFSr zMLiHMXB(GMe&|ZaaH4OJFG-QxS@}UPQnje;CB8Kz8JB}>9CD)u+#$NII*s#Jp9jty zJsbna3EUgb5)Xc~_waRbTUukOo+U4A>KagA@RUzJ`}>zRXUvlAJ6lT4{2G-Z!{(5b z>CjwI>$5`;ICtXK;}Wzd8^iO&ll-~!MDB807^PW$pk17U;Au9%2@s(gJ*BS#l)eM+ zH7fL|$>s&mNYWy2;owrk+zn;^O`zU^h6<{s{ZJ>EI@UF^%E(M(m+vX}o8DH8bRDt0 zLFi(mobSC1_9N+z(L zb+WpwX?!Qsm%B+zo&m$g7!BWlZS^CeQt`c=3(Al^ zN24v^JG-FCO@;+R9DISHQR-tXVV-p|V@=}b45i9<`;>%qCXFyxeZTCO|3rIfN+t#P zPZsocb}y$#{&~CBYgLvmIxN3jnOYz#4tAvndGWZ=K^V9=rd(VFV`YKTGVS4>%_~Wg zY?BvcUj4GDFr!_}-pSaf7}MseRDA{(D}ruArcP2`B-cPxXkD&jy_}hCa|1d?=AHqT z3v+0y6E?>RgFlo_rLz0qhh^c3*{yqXmii3*^F>^Z@WZ zZ48=w2Q|<`yIZReI0O>OnT=@dB*!i!kF?4g`}+$iTgH@&_OK6T*jN_FvFusBGdslI zX5$<6$JiU2lze$&dZmWD72pv-B1JRq%FnjR6+S@j&D9s$LP6?S!ayn-bOE zpV*x8sTisFsvrQN0r6OE=*NayrDF`ryQf+Rbz@D0M(oi3C`B1r@L1>Di<+ZTkd>1l zR~5Uw?$U*FP(e=n@u1a1oU%jnR5?L~-Y^aovq@_-;aI^^4NK(}Sb#~6_tlJj2QNi% zvA2m^a9}IHbQpJc#dw1RELUck$=q!!%=1%E1YF|J`0C{jqAA9xi>rq`8*Gf~^>x}n z&I$}a!{x2mFqwniHLEiO>~%RBP+AS6MIShoUj3o@JHP zERiJbF$1I!KU`f_!qq6aVg6%vKIpN+M&7WFt-khGAg?tT8l6*OvJvx58d*UHK1blf zlEXnr$?fC*-sQc?iA{K)y%P=4k28^VcmBG{3oU$&O#hf%Q(v$+P=#+>AUTgD02}B} zUL!-N3v7F-{ZM@l)+KBhb3do0zlpH&6RU09&K0oL{-H`NM$Rz*79-tv66{cY`@^VW zZbP_ztP0m6u8BFSo;09sfsLCC*oS}Ccdb-T6`j(%@M$(5!atplP(??nb=O}(TbDSf z8|*a=vTAHk!hEBhKux3i3-)L7*Xp z)Y)7?WcGH6w8FnGL(kctLuDB205-f>RfDfEKu?SA?P%s&v+QcwQKQ^Wv;5VoUxuct z$0iiU>n0)thq-(4w>6ckr^}ps%QJV8DPdO_P%|=pp~bf4J(6>YR>?Wuo6HWS!yR2i z1BX_Thg4k5r)mggb(1-ZXWh{f+GMh3qFVYjGDW{s;_2QJJPyepB>7gsglq>5$s2Ht z_QUnXCA2jnoiB$lI!ZkzOyi|89nJObbc6+Z`zm8e;tHS2R}UKp`L(&aDh2zr$iE_@ z@#tRqkq`ZHxm3?yYA&bXjqh zyGN*1?6x zBt?5GFML$aXH{24!zt8Yq}xKN?0D4W?BvCym097f?RrnkrFa%6f3qe`-88`WDIXWdC;(B`hQkgcnT5iklQVLsf+FU9M)32PbHr8v!cThU^1fr#r z6R95lGhrj)FC??-p9*MFwmh|`C5+tm$dGX48rr;&jB|)Opycc1H+_H^C-8`FG87|l zQaf;B^GBkk4?myUWv5}!p3wXIa;|DCRtP*YB3pWQrOo~xsKT{RWzJ`%_cElFmsO^b zOq!@XE|8|(6sB*76rAMY6mFs)K%SM`=VJN9LUFZP#ry?XR$xhUQ~P}4LKy)987dgu zw13U)yQcl>jU33Hwt9yW_0hy4*<>}pIZL10lN0RUFX(%Hn;p>n+d7s6L#VR_nYg@A z##cymOpVIJQwJ7ci^<}*mnq%7#7C7A`7fd|wTW5pAe6?b?Qd6QJLaMSmNg|r>1hwM zljBnawXZZW2}-U7OS%u|X>GB+L(e(tB-G0S#AA$>vLRal4`Au)lw*1%72ihkoAc=b z`FM3?e)9kW=Kvqjq-`RXvt=?u)N64_pKJ`RYodm77t4K;q;S^TY1908W#do7{3ohU zO-T20TS5*Kc@1tKFOghOU+cI!eRm~34q_W(+eU8@pjjJL!Ne`}pJnls4a%1#qkWl2`!wNzrj6kJ zcF)F_Hg%r)%+d4R1w0{}@2N^_w|_LLRNkHJ+EGsmz|X~(cIsPg`WD7nHt*RJ@nNaI zEy@4NfMKKFNFqZlV5Uy!CWSj+_AEGI$8Km)jF63C+;wu$Bi<0Z6pJ_}`>uz5_H^e_ z6+ELygKtZ$j+txe#qg$s2*oeIzeKHM!sj3Ye6a%O`yHc_2uZGi))`@^8nbEroJo8E zDcv>qdf3a}&;3 zB>U!7b)HpMlk**nM(^Aq_09Vfmo$c`uir`7C5Ty5T5Q2nHuNdqRDK1W3Ez+XnN6dW zQ}>!oOF&ie;=TQMw=gNsDp3{e>@@h$_ZCPF9r3guL{dM^&Pn`YANI zt5Lf4M`jWQB3E8RN0PC;6MRY0)$rE(i&us!>Ea6YjDBkkKfDH&JWo0=JUgnca@)$O z;*Fm`Nui}qmx6fNdsu_hyFEQo>P2qR_c-ja6AR9}JhE6C23720<(Qg;Rs$IIinr`E(XkXAkC&tC`$*Y)?9fw*i&3Y-7F!>_CLF(0arWQaKx@9%K4X+-> z%hNl2TND5A_&zB3YT{{S5VCw`pg*d-xdC=|^@F1LbLIOcr4C@HGw!A}O7!T|g0i9f z^g$pzAy$m0${Vbn)j^II-nyREw)LBLDgKHty6HYW#M@ri4pw|b2DYiV4hN3F!L@ft z0Y@gC^1Bo+h4GjrDy^qJ_utcu$o zM}3s(+G@+bI;XZzDL=1^?x4ikU*FDcMj0s2Q2Zd~~VPNYNn*#!N~ z#1Mv>#KiN<^!F2+7wYBESiTC0j{amQneukh?MumsA1}6%4*XJo%sGZ`m?~?vFZWRr znj@Dg-99x1WtFtM8m7*hlmOv0smZb}5Pn98-9E$ZDnCuU#yGMGJN0h6ed-EZmbGH<#j{?-2t43PNpkFLXUkbo^r9ZpC0pwckkjkh z#zO`j0`{Dddicl|X=D?!(!o$bi)%G3$R~6VE*O0c?e>XcO;6wSEc;ay!*a>oL2Cx- z>A%pT+vniAtIJOuN|C;qJG@YEw0uDLdJhx#Gs z6zdX!c}=&RsqDG%B~<&zDHGI zhr1OniOS!wZD;8^Xf!obncagjjEsIt%Vbfk+uaD>=3Uu?+dP~3CV-co=Us|%oph<` znmg1D!QE6rgRYS%>fU6yV}QR1@3{hGcG&drHy85`k{VZGkay3g>kHo=HRcY-02M>U z4pYDsX1#eMv8dNL0AkzaNtDjf*#-pGp%hporrwfd!{DaDQsJ*`h^o}SKL zH2KEg1g|yGro+DK?o1-}W?QMEx`(XxWB^asGnlE}^(_uc<-^c}Vd166x=c~+2lk?c8!JEG$u0M%`KYviw+Pts@abi9%#NhZ}3EAIodJYoV zTw0rHYV@ofxhqBF7oT(4;t-7+_jIaKoC%?KR`&U;(t8Vo564qO{Zary7 zCWV-6EX>A({&Vyj{?J~as;~d-0c=>renTPt*{B9~O0n%axLhhJp}Em0|Je(w*l#tM zN_h-k`R%_mMXIUy?>>O>Xc+u6G5-R=KRzd@aO~{g+;FyuGXIL>ff)5(n%5NzH$pk^iaBL5R(Jz>eT=UhD5h`#(SbZ~jlxF1B3{ z0V~tzW!Y$z{>>-;O+;1Cpy1$bI~j=19D#qdlp9V|5)0cd{xk?tF>b?;{7t5RPZfeD zH|H5jU;b>AbV=-=&BaFV{cN6kO-SQ&@7XAUe~hu|2va& zwEbLaWu-9S=wAQV9GzHuU!PDKr1wJHf5#UEMXsrk1j4$M>w7Q@3ff=640<$br=kKf zEHppt8qkzrHRxQ%_1L9PFi4rxxaQ{Nl@(4R4o$^#s`GhXIO5+fy6m6gwUMIc>&WO^$X7Z5KU zqpXs@S=o~}te?Zj)P)4+g7JDS8n zVhP35hA1L$b?mrNp(*&vI9w#f$I4QXxk8cfoy*WmNV8lb@-Rcqn6qsiH;ycY!g2W~ zlA4rV$JKxTsLq=!*Qd@G;IGQMoT<9#ON1N}H7abRm$nW#);UJ`YhC1P*=StApu6Y< z)!n&Ntw)m_bx(pPUv#>DSETiew`2cj&?XcD59i364CqX&x`;xg`HjyftoJJS)xJ7p zSvl>8mfv1@|MKtN@Kt_{&*X%(x3Itn{ms6>BUtpOj-^JpGT)#}wdW&GGMXGDM``i3 z(4@05 z{_%^~*Z0dYNOrYbInBG$L?0cwa~ohyY@J@cSw`I%YkW?xeKy-?9fe!y9Wii7I7mlN zKcLoAG4zPgn*o{IhS{`z=m~@`?;t!MI-ZiV6UI4M4;5{O&Y;Z91I99E=OroD#aecI z`U&lBKVP#$XE$4E94DG9bOf>PSL2d{LQnqG$b;U99W|7$Xp6${*$1rhM>k%cA53@K zl~fc;_dGV}Z8_wRH(md-(|oR4#Y1D9ii!#lvZPEJ)qQGshVb&i*JO_-rX+E4n)|rf z(*%`$@2o5v*%2?(Ed3@jD;BE~M)}HzElrbm0W9A26MM;BIt~d&FeTogxE&$P;wM@#1Gp1Tv^O((3u#jEN)SC%B3Yv zY3{SNg!}k>pEcD2ARHSqol8KcOiSce7pZ}@ojPq%ZiM>!H5KVMbK!k?DZ*i-L~3Mc z=%Duy4f$Mw+Te3ivsnf>NU`tM%RLlNS>r&oUUi*jTPA;#f)NA0+0)hxCuUSz zz%dsLt>=)EpFxdN+wdHQox8vob&N!}=pPwI0rW_%w!-v&fV%;Sx4I5ilZ&am{bltx z=~a?5)#RX>kp^iVcQO3|qI56b*rDpfCGOh2FWlwp1MzM~&Ctn-KKn=0cd%W=!mLNU zekW!yM9h%Vbl{`u@`%GG%+88iDzQ;{J6Y>-%24v*hN%IPOSqJ_SHBIe&mK2Dh>UBa zKAOJ2Px&Bp=0!wX!!rsDtN>@>6bHPG8&q-jlYal9z7t-pt-Yp>TDhOy=@jsgE$YKl zfi_#~m9kN%t0`q}PSw*rZto&wiIJIGP57sgKFm{**>ht}a4cK-%5;y<83k{U&DdGM zk)IuOVP`#gRme4KgADlH1=Zb`cjx*Gl}BBE%zu%idV;Z(cu0?yqrZXbMxQ!rC}0Ry zUado^kLrPZm;tiUnsF|thF`&j~4c2#8RCd+PkUHvatCMHL zJ@DN}1V4ODh-!=I<)O!Qpz@1b2i)q*u^fX=N(voenK3KV$Uuf!&3s4bDYt==KJO8< z70|zg@|i8B$qR4l`4Vx0Qt;{RoROfE0Xz=ZQBx`^a;<{l@HD z7Enz5kbfuGm)4m=J8$k**PXc>29gKi7iRW(X`EktsIMKWR{ZI{-RhUX(QFllZ*G7{ z#szDL3Zo0~7Z#$Eou~j}wMr;tWzL9wq3%UFdb(wnkF11JORq?9r9u6tNh6Us-UKrz zQ#WX{gnE4->=Q%6w)uI*Xd|{ZTSq?A%9nQa3h&Z0zCf(OLbWDy{|Eygb!Jc?v&xD; z2@ag`eWHrxtqz7zc_!A2W2AMn@I~-h~!t4%##&hv@{4$DGprIHKuUcU~TsqC(R*d5dF& zf@#jQih-NY4$oq!nBr0Yj8*2mph~`Rwp=HqjF=c;2!rI6VWnW=m?iHz@v-s=W9-~m z8?j+$7|TEka#SX)sq;DG^>${S95;>^>fx`b*+*L@;5#Pdv?Drw21qv5@E$rLr7#?s zyx0;-cW}GmXTCHC*N)stz;Wgctp^g<`*y96Rs|_O9nHBUTNQ)${d@N8=_hX2T|9iA zKSk$X!h2&G39Ah%b_d{%!YgWjVENq#Hc6ZS{$xaY_c%x-VIH@!6O_6a1%tb0YjXJ4 zIq0=Apn!O{-_)q?JI~#6;$L0w>8D$35o>?sl{XuN@q~aY@wo&I-EYtSs>DG9TLH2u zlay5z-%$#FS>}f+w8$i5K{PL|*N?ZL`V?f>-C~+snO^FT^XpJe6ZOIycY;kO?&-%phhs2=-BOc2do_w z8OJS`dQ-v?VF>}}GkJ8YMDSm9>FR_~!3)rck?M#sc#Eh|O-R5hs(N?=WqKdZU2 zSb9j(&*RZp5;#NI(yM`>~l8^d#BpgNo~OmE0*kO$m*nYi@KL`A#p z;N>!)&&d47n|l}CCgB*v#1_|m(3U*W@#^>q(ZSY58U>PQB<*`cz9-6m{+U}t9X2#V zX5dwEHx#`Z@96p%DBn3`529C>6Xsw6bgT}%3#l*gbH3no$(GtDh!l`Sh76}f#*Q`J zD1$yY_#*)Oo~X@d-8BY#YM~G^oG1~LNUuWaFkj4i8sc>O<~_d+Z=wr+Q>EP{uR~)+ z0U&B&I9V@&J94;ss>oVVnHu6VLT45`oWXWgJa0x;j4F)G#sU36p`9t>*fS@!;@OZ2 zFBv<6@%5Y>@y1f$&7E}n@@9K&U=7&S8WF z9WiQ#x3N8=fhC2OGZx1J#0r^%ngjLcP=!8bSI6PuWkYu;R-P~@si3^h#EwytUReEN zbg`qXLuQaFD3EVfaa-43QZQhVh36@a$Ez<5MW3mT8OS()Wzw67ohi%_Z9PGlH&O-~ zjzk;ns!vg4o$VCRv~eskY+#UWkU3W~!WO24QBsstoRWTIke{+>R1@g(YSoWcq%cz> zx=JFX)k(J*xe4BfOYRY9(*FWONL86uJ%do6Zyzp z((5ticO}?=^i>v+ia6i10t5fPOtZe6esRpLo$I!ZsU57nKiC8%m43)tL&R+$L z9)zE-@2v|1iAU}8|7`8nYe9{RQ(5dA(xcsD0g1%we>5VlN`+pgDldPe;_@KwSM6z_ zHYFAOQgH7@H8uX33IZf^*Z{UOv5ux5}Xs})oOxTFf1mN4U!*wV~J{GVRI*fQs~V%>#07} z?6f3oKUN+qX7W*OpOX29GXIkT&YFWsXRZA#8N=ihaPVE9+^ifo z*KxbloYmX>deq}X9UOqK&Sr@P6-mkg4*v7U`5p&QeN9f8)|}{Rsn=D~hxB=sGCMKL z4}I!Z>9*GPCjJa=yH6pS`P`+!&nq)EF%G@*?;8PtQlFrU7v@pxEB*JNLPp zC#cdrMaa`D$+IW&tjS#ELl#c(i4-WcTKjQIQh;G%vH&N&AqvY!_9qT%l43Z^`fc+% zrT|VMwh?V2H(9D)yN!f|3-mfZeiWUey6=<# zMbjC7d+Gzb7N5`WX~rn4ix(}tC2>4ZgXCsVX@W$6Y0YvsGT(R%Pv?D4Bv%qKq07Hn zq5{44ridjWO@J$eqH_B_4>%%09124iQj*}O5Vp?QY&V0pE~B!f1^$SpwWLeMh-6D` ziP=)*FM=h<^-?d=_?Q)Ft6~M408u=IFJ--DwXplqg zpxUI-YpXuuSoY#DJSv6ne?Sgi}@qqB>Fd~{< zR01EfBwf743Dci7aWZ8b?p$u%%UwR`T&`s=see+Zm9-N6ZvFkpW<8dGskYrzQv zd?PBwpRCn+-2F?lGOHejan!9*ICqVvID0L;t#en`vQbdr7%7t$v*QaGsVGEOIISsf zEY#g=TJfh#S!Y zNJ{01cGza7h)9zyz%d;J=m*~pT+w8W&+nV)rAUM?2I-_gdX0x-^Q}HaDm3Rlhg9CN zsq=@l0Mrso^g)?89USIk!B{a*BZad>snEkXXM>7Q@B@JQdjOcW8u+WNJ10KoFEtVR zt5@@{z@&Qjb^Ol9;1F>4nR{zEwGkI$46Y15vp(o88>QyvUOtaq6)2beV_~nK-qjpv z3(GYFVzrAUCL3s8E;M;sTH0%w*L9LzX4vCd=mkG^7NfSS@lv^_3#mB?vgF(<`s@m& zjYvA;TbqVDrkSx=iez|qJDa<=EJUvs)=YwCY0p&HS?i;a1BC%&YcP*fTS=_2Vsvsb zY+IfGmDjy6Adh&Vo80dD=H9~t(kJH=B&_}DEp_$Wt_Hf)`Odaa6dlFcn->GbB-eTw z0M@QOZDMJbAm6p8Cp3gr1gC9nO}Oi^@S+I!*i_-mkb40YZaV0w{&VHNuLJN+W$wp- z0B5`dGVh?Sy|>f=CjhXjQqS|svaE5oSXp0wx+8$P zRF8ZKWr$1;v^iCdabzNT`P^?#Rkt;bE_1JPm5;2pRZv>1MGg*T1{+y;YOV1Xgy%1# zgbI4WALFpY1N<*WR_WvfSL-G*nJ9M{%*8yAp=IHmt^*%V67U`JgeP60YxJXBv5ZzA z(li5lZ-vQwVdjb!>yT-D)-?=-K=wS~&2h99Lo?^Ya0txCzQ20J^L%sS*_Tp~g4148 z&mFptXSqytWU}Ly=R2K46ht|?PIoHPMr{*XLcJ5e^oaKkd2|lo&cnHjo~&mi|C-rt zS5^OrQ6GUc3;p4`1Anm8^VVR@_oRP4epbD!Y6M^_E3idG)F?nEq}R4ru;+1c5if(* z*MZtugW{Yrb(Ks$$bWZ2A5Xmc5bTV-;K5|<8-G;RB4ZZ2cNVbs2pm!Qz#6^Nt+e#} zyRYg0c-TW=DX_-jhdT!c;37txh6SeG7zBh^9zPr}R9Mj&92_k7X=JZR>v(yaqNK`N zZ~|0c;-qchvyu|MiKR&5>~yC!8NJv{0tgU7G)T!5RfDx#jT1QHPf3Urn_gVq&O3Q}Tb53O zp{b?jN1*8_YI@vB-@&g*ED#i{er}u9@F4}}s-7zTm$6HQ+-r6&A9j(WwUsSaQ z2;dPlZ0JsPxMpvtckfMWH_8$ZFFRL(rAnV zY)g>G!`?!V`?6(+iLcm5+3X}(QkMfkhIK%WG`d28adF#TK45n>g=5fFHv3rGNLMa5 zd?50$nf+~A3bJv)l^ZyxH%wUnByOnEUDH|r#;|9va0~Nelu<3KPP1ssz6&3hNv@#~ z=6Jf?lr)orLIj0(YBOyw%6biZ5~tG3&ac6V?4;EKxrMNl7KV8BR2#dO{cyioS>!t) z8fi@#4dD-u(9W%~eY*MB31nc{zJMh{U7bY0a@P`;1!fY@xAUQvZEKEPGmChIP<3EL z7*F|#IB)|j;;RpdgSUl?Yc|6t`JhfND?mgJx9^mR1d`^{u2r3p&N~?$jAKdn_XU0q z@YTbPH9% z4;j=ESxpxiY2={1rZ`-&V;@$HA*31xnwEylwE; zKx)O^nO%M|Pg99LX+ILaX88c^ic(B7w?k_+bjc?uQzoL+t*x!?XD@L(KM|}G1?P(^ z0%@#2WST^`hNYmX;m9Pz7mrU1NI9l7g9Lb1J_#zDPIlx%R-7^(*o<`+l;eAVSjim; zwU~OvNYpC^%CEBOQ}X4RW$?mJQSyS!lrvn?53A`WU*YIw*c&QEpWW7dx)cpOiOu!XtO) ziQ3-CwQw#HnIk+LwNGKHT|0`#%12h@w=>N}JG-e-^R+F{dQR56_3Xp4P7JYS#~7oY z4;2~1U9gOiY;a=roK52obNnYedD;V@tOiX-b984*JF$nzzHK4w4WIN5mH{vzPL7zZ5*k1q&I4lI5&tinW?!C~ z=$+~}Gw8|=NL;DZsYl^>Ep$_C$6KHxNNxqMtM(>#A$Yy}a~Fa#*$p`dK-{rBYDS%# zw$~`?94QYl8AV&syB@{l%m}I|OUeK>AuCTOdBx>KJG1JUtDl;m z16;Zuyx>X6ef#d;-}O$RC6ZV_oz|>)HYqpSd+Qq!b=HUK*L#5nLrS zAL~qaGn+c^O&2W_#lsdeqUx$g7?GhDLI4nA=1%DWPhyz%_XfJ>|e0(o+;7*G<# z9%jI@uTT46YiX0?`eTUyVnQ7(4TixH&lc#|(EC>kf76Xcm z$uCq?xOVM9^_c2g0W?Iz!MRMM;3OSkwRzxZT&p)LTP5u0GM*<3~YeL+NC!t3SaJ(g>W6HA6Fgb^8WTL%yU1%iYJqDHbZAncOmU zOz$2x=JbcIlTV!LBYC(9xG2ZGd{j)2R@BakRYjMfK7=EBX>`s%98=-%tGrjQqiIIm zFt3U~cKvD`O5e<^Vm2ryOSw;0_1kgpq0#&2c}u62VEln?@q0maX+?pZDkhZzDLN@p zk2S|mtbR*5wpIR-8;%`iS3}Gna&WiOP@4{)_`&TSa|qEal@C!r4Ep1hufMRaK{E#x zL>*!vYNq7Fj%1!TbI ziVys0;GQyJ0THK^{8!b=GBPsbI6d-gIIogOmiBN(XA82rbs&0m8zJWDk=Ez<>IUQ* zTQq^}5nkYb(Mz%0(%B@48C4Zhe@j`=$6jU4W=LCLjrP91^j%~} zp`(VS!FS)?^h6-zr?>t|2;8wCGzNqN?KQw8Qp@6&_-*>Y|)!ycga z_5fC~e@CW2h5O%s2)YxLl?4ViDpWrHp@8t8dtJ^sfDi!Gbeo{of9|2{S3~uos@nYr zF!rOi|E1@Ptu;}9xQ2gqP5I?|66^2QmKwFCHgkDLkL@p9)}2kWLcaxVtSPA~Tex;T zYDsOZ&Ww-_O~t6e;4kn193Q*bC$Q;%@NR8;WWrtjChs9VUTn^e&gKX(i2tJ+RWOQm)h^T<*Xn2x^V&6SAMJCabEC{jarO& z;T5BrPJnJhc`96bPXFbOZ98QRLvp=)h@Ku{O zA5aR_1ajZ+b)uh*ReIOF5HHwf5TLrauDBt(_W);`#=?Q)7f_8Nh>cBT%cUY!iD0Rd zbuk0mz2in zhj|^${-Fmut>+M1!&1UHA*LqIN}j(M_3>**>mv1b3u_5y#V~vfR(mhoV$Y<_X=c}E zHeP4jSiUWY9bJ6zgHedLIlqAJsjNZE1l=Sjp*-zgW59+S(JmrQ6Go5SUaI3BxV@y5 zj<=ef%7qYNzu22}DO`1zUS^+eyxu9{x)?nt;grV0s4JUt7WFSCRTw~df6i9XG4IE| zp9S!TPT6c$3IP^4c9Y1jawOrk=``Xt2XfP0paSFWr(Dvqvg+=dno`ozb&auFsOz)t zs5@YH%<3}fYN+rt9Iis*Wzng-;KH|)4xnEq?3aV$PI;C1*CC9nrs@>EV)j}!=L8#r z!gwNhhYtZ*_`{RBNG>kZKs6D%Qtk?8CW6Olz|id=T;xi{FK~y(X7mAI9nQr4LjUAh zKS%f&*bQng0QH+9#~jn5449Ty3kqQm&NqG`-fGGVvT0y63QnvvO2=%x=I@MB#kN97 z5|J%Wm$Y6eir0tpvcKd~x7o?yN`E3iaWv*pot%7>W=f%zx}Z$V9hUZTsbBiLY5r;8 zpM(Bz0e=5-W#7=Nzup0y!Uc$K@NjAXplXATUn^%hO_lfCzY|C@{YWN=K#=stCx&nyXMe5st(iwL*1;4FTnOhm?#P} z*o$mT%!Q>Jv-Q%9b=?xm^uwhyJ!>;Xe42ma^nua5-odsX&J`p$%Vz2zk+U@cp^yAgkQ^i5bzn9()Ag%Ob)* z5`;Fk*Wq3Bx{8Pa7>lT(Ol-%T4Q;tdShKr)x$JB;a5-V?xW0uZpjn=@$!*TGmAPey z1fyS&45v?QF(eYr0-jmOcKgj5G!DaI0)RR;tjukzI{~X3T#kBmC`tq$s@d&&YtPSh ze@!``uo?3_F%9UnbIY|lg76XLl|G>!roAyxnB@GN?PGwl787gHjcx~t32nr-$15OU!V6lnOnbwV5* zb9;l*CZL&z&TVEK0t}k#9HB974V4hJO(S9@zz{n?`EZy zo@9y^lGoAZf5#Trg?8pg8f1!RAAzx3fOPOimW8*v2#4Krc{@#_HyqgMEn6Fp=`z^X z#Jl(I0(@gdP~!N^^fAZ=YWET)I-hz8grZ}A7vV2A{dzy=XT}BC*wInFF|G{?ivYl1 zLmskj!m~Niidjb#Hhf&Fd8#)-7wCEWU~?WjXOVr!@plnWDdgt&O_)DP6|VQ~ELr6O zr%kEnE|d1xWiD$Dz%~wU_s^v=*C6fvk2R#wM#?*EEQFd)s@STe+%mq0Z#L(R+okypI`n`iyt3Ww zJewjtsEu~yEaK^nZAa$u?Cv_}(Jk1t@$`FLY>c)q3f<+jfLcFv8h z@AoxIEHe1b@I~~uhKXOi^Z)d#`#QibM2SlUm&;8}du}?DHny1^yH5t4zj1mYs|Ylz z7t8yLghb8c`sw<$I5hXT!+XQQsb;GFKia-Cps99C_Y(ybL=*(1qco8wy*HKK1f&z9 z1f+xX9>hxTNH5Z*O7B6D-a-!@X$ifB9s+lB=A7?4Gjrn1+sf30 zwPgaNDQk^o1Vv0#Ysqd*0`9lGLE>NK@$7i#PKNYleJi*f_Ey|OX|mt!_qqH16eJI& zGtPolDmTCq`KLD?;1*jSgJp~)@=gOzSm{Ul`^Q`#H&yjrQ;$u%X^wOJ-#czwva5VU z2+J0jv2zPL$;U9^Hv67aE>G6PcszG?t;DH6f#6)f`%YeSP^=nV*?uKKp4fBLjHg{| zMo>bevpOw1&cpITpYV=h_``YwP`*=4W89dAaXw)Q?z%bO18yy+0fQM1xT|_I3g`ZO zCYRncuh}~Q;6#;-I!2^TU5mbU`#NE=zrmuv_meG0bd*$@x*p}PdyGnaO{;lMm5W<= zy~w)0_vAviXAwVa$1T+#kS%}mc<$(s8T7$ra*#Uvp-%Sr5>HWpIh-e)GOi>bwji-g zD7%&LihP4idoZPf#PvV^^|IYn#~Z&om#HAwcH{^#-EDE?wO@~a5F~@ z%-A@en>+OS)0N_OTr%N?g1=M%pv{Tf{paIPv}7dmd0hX&tN7De{`&=iaXQJoW-G+n z(lX#;VLgLj*0TA>!Jpg8yG=N&;10fzz&~E%#xx$;;!m9S4H*J{3&EN?JCLJ)v$5YE z=6%!g>t<-he|*|s5+H=xea3U(8sN4riu34B=UX2*@a@+_PXuMzuM_p{fLHh z22z?BM^=OVQj~aE>Sb)E;x)(d4YW>TnI8V;2o=Z#QE`DwAAWu%{YNF>b{)S|zbnm} zV^`x=AFsKggl)7RGSFlAnQTc_7!=F=3w$L7C-&E}R?{~rW`FQ=B2uBz9n+1zFIWf6sS`pk7+wfQ$r@bT5S}(5We0Patr(;Dyg~2Ds%BlCcW8X_X zm3a8~w(yK^{^~>g=hdyt{xvPx0Sc{u#IyfXMgISEuM8<=fQm#H1L#|Qd|F47Jl|&u z^pHHSw4ZGV)4%%Ne|)B-B18FRa4b?Nl*LMw{r6O2F zNB-w4#Z^4VV3ph9%ByJ%sSN-5dzn8w+6AaH+V4D=wGbvekrS}N&u`*6v$<*38Kb-R zR^Xo+z5Tn{`}^-bmw_lyKN+OBtzE|*$*$SPr_~oG%CXCUlA70wP;rGV_`+I5X)TW>d;Neyzfu_XU3Ejn;h{Y22|*3wIU%e3idm z>aQ!s3_RT%N)Y8&SSgEFF$E22Y!T%X436v?bSM9ESbr{{z5iG{u)ekUE5Cn_r!2QH z9x+?x`1tq=clOGgbr3&Gx-0u1IlFaj@Jyy|WfP zwfFO>aTm#rf9{O&=Q95Fj`VoC%j|BB?DLxRAuj*akm9es^5@m*wJQ|iPHCz{mkEs6 zf;x)Jfa(By|LO$%(`Vav`d57i^tSoKf&yg6BOjpe)}uUi|BFp_tp-0M6gZ|%?*^Xy zc0vPUWh!pv~m#b+6}9|7YD*0>!PBp);V`vJkOn9^Q|tKe|n-%3S)OW?-vT`7%c&mt)H zFeR7*Ncw0btb@E3CDxu`pGMt z>6#C*ym%V0iG7(2eVBU7-QSK;W{_f=44A9f3TX-n$=}`j`sbC?mdp%sKaZpRBaY>2 z8-#nA6&TmLfO8q}F?ftkckTKz=V z5|VR1fRoVqh)>TGH^ue$KcYIFdX{k5iC5x$e$ow1!^cXb?0sJ!FYoS{EAdSEDf)Uk zAmoriM87Xt6hdecS|j$11E&%dto3jK#o_1B-Ib#LSg@8_Rb4aO96x)xA7vO65V zr;pq9$r%2st&%!b%j_`IFqjUNR7w&GMa6h*xclYA8N+_8^Q-N8&4QNjW&^J@+0Fxp zg7*~RyFPEXw_lIjF2cBs8=gW>RxCt4w$rmz69xkmra7`zrg=0fEbUvK5_;0VI$%>v zwO;JCD?MyH*$sBuYV=%(KBoz$;E6Tw)*I7K^*mws-1aAQlfGwrgIeObda}ey-AL(H zBNr8)+3QeGw;a_3RH5 z5gTOXRs(-|h4pwdjKq&duh`gix@5+CoG&{&WM^TV8`Q9vSb$IKfIuD_`<-JCH@pgj z*I}$039IGtX{?6F9A&5#vuV}IQLb!{9aCMznrnL)h|llramh}BUdc)0XM`ESU(5U- zuLAu4aAZGMye`STbl&;Y#OqjxO47PUVl?mN^CA0H7_t11`e1n<&ML0{1yk>onx6CH zIIyv!^eoEI{w5;NL`~{0M!llb00y69 zm^)VOtA5yJEQ(Xu}2$rovI30m3F|areHd@Y7AmRoq)lSQ$WjLZcc=QMHkd?0)V!ANEpL z1{9o@dRCn8J@jkmg)ZQa(tIGs>@zSksHZ%j4hd74Y&yS6#p_hz8w50aebx^jeSvcc ze(7Gj6<$ZaIsoP`-pOO|J5{207@R8jmR!QIX8IK4ccl55+k_F|vhN78$cC%Mi?r$t ze^XmyGkx93%dQsx=uR$)zsp%tGI_yY2$-TvUlHY(hLiV=nnxKh;~&Gj?V=ci25 zb%)yzIo;us?%j}3YULtB!A8PEEA>7ip2nzcdZE;9rQF}W)T%Ovj(FMW0v7Xv)kE#z<3OFC%O;z zDea?g+JgDKy7XNoj=MW7MSKafb*NNqESl}|6~m%IzxAGO?R&Weyz_ugd@)=)taGXR zToLBu$>MkB;{=BJL~$DM*(4s9%^ee4NRD$lfcN}bpo1LFAusmto)2h{C z=}g7adxxPu7FSg|quiaA`|pXmoxaafPw9$J19g37XBjUuM<;KV`yKC^qiO38eH?&{ zU@VJV+AMeo&raNJJ?e7P*~47*l&BCYe&x-n+7R!e2kujjpVl5#O4(1vm1B=lX=P4J zxyWZ92$z^`Mhp9<2kbS{c)M>rlQgbWu5fmJo9i6=FqZkr#~TNwC#iNbw8!I}<`Ugl z7L|C6UdgfX!+b%%F*iHcaEp>5a9i=U=sydJ{)d zJ|#?2Gmb(?7(`9`Mw+g(sC?cdB=n}w`wZ;U^5a7dX*N+Ov$)6jM9Oo`A0%=Iae1Sp z4SzU(ZJ~?nf@-*}AgZgeqP{C1P)nh6nP#W&l@7+j=)^bdQ1a=s8#XtTrS+(7>R!)f z+~I|Rc}yDOsXo0J$*5aI;s?ei3 z1#!2`+Iyv)Ti2Lp!w4FZr z7~RWf-ercYv`S{LvKvhf&oXWO)NpgsZt;(e>3X=0M83a_sVuKA6uw3f6`si}8`@3B zJ8xpqmwY?all(yhm~gQP9s=?-`MGMt`3#LG$n&ry@||v#E!Du=C~KF!Wrk4!{#iwI zSh5-fG#Pq#H^ z_{v8DRb*enONu_{&7+ewH9nWIU=x2@n=lFq?^chQJM3EePfSXvmtRX&3(BVX$(&1> zv~~(OW;@5__S}CtYP=?BHzBZlVC0~T^>Qt|=ee?kXxQA^Tj4(tlui`qAH~P+EjD8I z;!1>yUCEKx+zml3&Je|V2@s5KABv_L|WYKzn1 zjn=JN<#{iSGG8p_s3n0gDlreZwb?Wt;W3FCFZA{8l5;GrSlo|pF7&02Svwn!)Yz#+A-c((A`H6DWt{NByTCX*^p5Cp zoe963(pQ4qdG8{m)#&gl=WE67fElI!!DY^X7|K*Zp+&*$6=CA{$GJQm8~`DX%z3)r$)rx&@PAe zQGDjg!i5Sv5k54Mt$;&dKD^9pvU7hrw^ltdJXh3c;uT=$3|aK>Ri~UwShUnu?5|8~ zR@SR7o$x(eioORYF7vaNHte2Q@|ref z_Bwiq%#D^0^U{_wYHSk(6ImW}AaltC-)NO;2_6F_RgK$4#V-@wH~?v9NkD=O?F)qQmj8nSscvn z9=-SK(vRG<%_YK#aq;uXezR(}R7(yNJne8w4i{Li`0Z~;5A?UAS7&Oz_!uOn`&CQM zChnMe*&PEe1hK*Qw$HH*ZBeU&9;yc$lUsGEC4EQNqm5fnUHTfrUwN}|9gFEMT+y8V z)FzuK=)jVwzi2Cc?)2S)S2~5?vrB*q^Fsu+C*qJM;W@~`?dbP43h9|70F)6qBc^F` z+27X>oi!MnVS)xciYM@oA|q)~}NF+)ZQkHsI<9j+DfIeWaFm9`tq(_}sNv zJ22C;KvYVmgTZ=!Kbqx=VNGEs7weT$QtMC-^x$#NOL#}A*f%&)xz;Pe(`&Um;^H$# z#M9kl;Ow&j`vOV3`(Y({qonC9Dje18ep9ZNPLcCL1PamGjMv#dFnhVza}RJ#7*yK@ ztCfgk#F7qt$@z+v)< zVWEcJc4=ZCLMM%2Z;Pp}Iiy@p$4pI6eNeajm1~L4dm$Qpg7${}V&8{cuTVFf0FzT! z{-&Rr*P&ONab-th4PZg<4#AuBL5Knh!jSw%UZ0po3{YueuuzTz5r;joO%ZpExcV@r z8nq%1>@oAhO-ZDFFtWF${8{ozh22os>5lPEhwJ_Du;N=TfLk+}d4Zznq!m|TguS24 zG7wuYW4)oQ0y`EnY_|){M7IX&aznw;rPwL6jq(|V{X(6B97L_)gA9L?0?FyjY7yx) zu^FIqbV(L3*J`dDjjv#1jw{H<4}0QTq*j8cX*e%3tlAb!+dl&wx(=JPCV#C%1!hwN z45|-1HX#7E=nJ{A3N(cpQ8xC!3w3B{Pn8pQZ7tDcGKm8WKiBE*7A5UFl=xWr&?on0UXLeacXF<$sZh>&nvCX2ad9Z;PElOWq0juPj_w5 zjs15!zFVY4=a0}k(tYI(G!}JEgro-7T9rO+R44$7vISRK!KBXgnfO0u?A(HTgtv(n z#_K9728jA~4O?Z%k)^0X>O&bE7HRp2&eT%Grs;{8P0Sd22yj6XK=_A|KDK6Fvpt-_ z-S@Mg2C`3_zrHOw1t^d$Qva%FDb4T95kS%exCiUhhD&MuKK$A<_FtSl1+1K62{K8I z@|;lfo+PGT{osQlA)l59*NKUv0sWVRkwBO4iG;#q9%%N6G0T_e8Y{E;iP+V760ga? zo89_qM`_mtBlMp!!b=cD%nS+(_9Y|?R@24D6X~*&p7z`2T038^f);dBlWx*W9M$iw zPQxp~8-n4zUA}viL+DuT98u*Iv8w9u5wbOuG7vQt4_}*i!EN1g-lC=Dyq$2-W}=Lzsn01#<3Qr({xS zw9*(E2`V;ee0bsACQEo~t&V=>%7rI?)@D18L74b<0v-LL*M_0btw)L-7!Fq~3VJiV z58gnYG+hIu$CYajXC#n$tWzRnj{$f8!IMun_zpLwD!U!CI*c5`qA;7?7GYM;7K*B8 zqk%GIDmkiDa!n$Kh~Y1K@LU!kWuEUa(-Uc}Flvmwk3Bs`N8NiuFmA?NO$%tH33Jvn zPEf;l&OKM)`0;zT9m}1UEpcQ$|BC5#2GGUXvKO+8tMau@OHrCkv)|z4L!mtheBIl^ zCcK11RaGP_(!UJYw{EAGxzD^O=2FkyDycGQ#B^H}AZm&;SWiSHT$aB*FEsA0-0I)@ z#8SPp4oghcQv;fNva+cs#}I^4*EhItPMJfw_sS1iDc9DuE&CUTbhEn?M(Vs7X3oW23%HkVv$ePL=KR4^1?g6%qX4p=lxsh} zd);}T4_mml1wyJOtg8_0)>ALf#yAMsRh1OboK)L)W$i>scsiloYXOvhcOhK57O77M z|6|DrBCpiVmY7rz_FTcY8qZGwDQZc-GfdZzev*n>1H9#9sTF_XRYWwmhFjb);F-6D zP!*}{1mQ5JmB3DN`eG~ArsWT#MU#w_+$I$Zj}KZyi9tU3Du~U#dsHtu36KVN`vrdt7}VL;X0pA? z7*>R6W~QezQVCeT5wIS9E+Cb!2DxHXWzWBm{)vRav9-eGJgODFA+in_j@jVzfTNtv zAtdKFN?y|aCcr7&7nOymGlcl+T`2R$3+L{YPfJkl3g&1?Ls|tWs@)?>6QZA3E;*X# zpT#$SmubeMcW*?lu28qgOUDyH4vLD8#kvOTRi>KZcf2p~^Pr%$a7QIwPYYp$dl+Fp$vzeoe(!L|Z7hiz$5g(SlZ=T)c~H zZobaLNoPqo&EJd&xOM!MsBq`Sj@w`DId8bNd9;zqhZ$skBwif%zy0B)PI^QqD2@}- zM41#q%f!L+8WToWtS}-nnNP053_ydVK>Xlcn)ggBCOcXX{4B{rJpoA_N-a7SVzHX6 znc3bkM#38JJYs^bPZaW;T1VpyrGD=v>-P!&mE?XBz;DC*)svx@0+ihW9=a0Nre+vm z@iqi?nktzpL}pqs210PtNxCP2eb&;8&G=ort_+ykCkfjL048yeLK9F7*}$d8^Vg4e zS5rU;x1R+2y%~0+FHq`qg=%P>ro1MnrJ&jkgRCNj5*U&abrp)$$=54jEszFrqfxz) zN@P+IpXhzQyV6@I1XEaF;^R^sE4H&Kmq~MO(rIx(xzCDz%JwX0Juvo#7*XN(CT~nS zOoR8t4_nPK_aK$&xpl6U8edweuTsfg=1_dGRii`$s&^BL_7Zq7nxm$I&=IJ~{-I^( zxx4teom$Xk1ChnyR|NUw_6jiH{QwlLCpItH`EX;_!L3O+sx(=RNXhy~+fR8JdB2Lh zOafTpLF+`vyx(a2zF4{+gJ;Dk)2lz^EBL**|>g&e{qNrevUcm$6A@5QV4P19dgU zZrQD;6;}P)dhBRKl|5#(vcRXd>;R?w&PUMtx%8r1A42rG>WQvDh_c$8}5E@+a-w^TsZ!8efC?L?`vYeh{}OPky#gi4R?= zAtb*~v@IIGQ(44YdyeJd8!d2@4P`QN6bmIm0GPUO-pp)dra~{2apykfsqH@pe*c|F zWVX6AuNlZjPwvGvyl_ISP3osp9D9Q0YW zCUv()Rt3|#OCjy%zuv>e3PB#4SFCFdU{@^48N#ua0^SyOQu*^z!nQns*C1mp)wc zq7$pAguDQjp4yW0K|hLwnITs(vYF5ERNvsyIn(h;w=1xTLjCC^Pd-JWDtfq)7Lr3d zWNf{?z8L7Yk39&A-lPOzVWR=me5dE7i~7ty*tnm%K(9KCRvg+B5^2S`K9{dk2tpPh z4F+%;8TK#$=&yM{b=n;OptpcO4j}JkKlC+GYbC-71@#^#^?F;-D1M8ZdRl>kxfz-w zK>G|AT?FU+g&POaN$5S$_t39tq@$*Oh(`9t!9($^y+a=B_Kk$ED-GB_FFcB{`B>~0 z&E{^e_v=?2_@-hYX=}FnhJqXsnW0^Y=Ca+da<~DA-ylmflb}sme4j;R%$-ioSDtIv zyfPx<*4O8y8QsdW0(P_ZllE%-;FLfSv1b`ic@a=9WVRBA;nAjiwJiKVINGl8J(X)m z0#kb^ECh}w=YHN#507N3Z!Dsb3#I_thS!*=CQ|$wdJ|M`HTT%Y^*-G>fOR_`7K1jM zgBIE}?qGKid(L?rELN{u%SVcgCY?JR&fPrE1;>?&3U%^wpdz4(yBXw`Ls$Es@@iIo%DK|U{sSNR<8UO;(0^Pdg-2dw?iirWqxy0TT`KuTs_SSNEPLRG`V z`5VoKkQ1-DdAZ49>Jr0^+cra}0*d1y-NuQZySp4Elg@km!cN0U$ncxid`SdrhSk<9 zgkcj`zu`i*m|p`rJLWzJT1RNa}*w7Vpp2QP9N!5&wgS8qqKz9+sb zqOX;!Zr&nC6Yp$2nm1S1Q|C&Ph0)gNvS*sfK^KiyC_(ByG6X3`3M@#IW_~^)X9!!p zb&MXi;-8_hYp#7#dRpSPe_%BR0uDk#2zYO$^T|jrb7!c?@NYKBjboCbkt*3+3@} z8492iep)cx`9$0cwwbQWR!u$q;(5Uw==$>Hllf?JZE^W(^RuBGxJ#%(N=@5aQ_QI& z;HsmB#+FjI4!xF04d4qtmAiw5r5Cyea21KDj-5`VL?KqA@9idGl|sFUgSNLunw4bd zuNDj4o^m$MyMZnmwA&xzvC5K{X%GO2 znl1G;!q5v^*#MYUJrpHYVFTGZth}A~vgB-}5J(_}9YF{``wG_mKP ztH42V`XuyeTJXnzC&>Sj@XWdwwk-#Dtf=-Y{vE~WaB6`(Ho!Vmg8~1ywopK157dCO zcjk=PI*@EigWpxd`@A-<=^`+I{AtCX5kEJxkqTu zee$h6%Cv7`ftxyjxq?ZTrpAEkJp6Ag&$hdcg;14mz}gfAsJg9_s%-@+g-=ds4l%jG znXNf=fvjKq5VhRKApyBpNO^W$rP^?AiKwbScJkiSg?D)&K*c26hu()>BL#XONMD!* zclf3X5Up|!LR48yvFQ~jn>afyIicPgkO8`BU_l|w12j=(WuDTtpI=%4fK73L@zsHW zwAUX@cl42QCDyASBIBz;!Rl7BKWO$>$f_QJ}&$vTmVC)n73eI&DnATy?=rL`yErix`FHD{vsfH|LIepIC_D= zEe>sV9Mwp?+Ci`1|X)s`AuhHTVhE4KU#Z?*#aP_xXV|2;GdxOg;n10 z!_l1Me0ae{ho&;yV?t-6b1ISalEvO6#3p7!(fp1~h)sRUjGtQZ;CzCvbMcGpkNc}5 zrEbSQp}}8Rleu_<5O(8bYA|4bjMqBH+44gVlhrPVYS8!vL&vHoxrgsg&W^~O^zdP~JTw;B-_GKb;;qwmR{3xIs=&c?y%z0x0hURV*x*?``U zy+EiGcT_eIv^URKjVdw#8gn13|z?pERh6Axa4TR zs%aUk?R1^ms1Iy(HIXQG8eH~%I=oYU?(qlXA!?yQ2MQ_|VlS5^p5CbX+2+PS4?!#=P4OQ}Wi#UPa z1W`L}7O$r3h{e{evp1V&AFR4J(@$FY5D+fH9S$q6rSS_7&b+ksK*ogno~Jxmh^69t z3UV3rw6DU+PQ|0VCS<)bUGWxbHJBA!0y}AgiBH?l!a^4h^yyf2R)-I0r)yl;?_Zmz z4l%dbUxkAdY|oG?Kq#vR8BZ}*j>lE3Bqer|?N!ZIKjsabK!p;BGpdipaCvKeoWHFR zEVR|6)%xivnM?(pn2Y`e3yJC85)nqiu;NiMK2{)oj&nIzmYj>#vNEN9>O-@D>;q=z zgv!Z%uca<>J?Z|w3+M_609f4N+oMw~>q`<+Gy5VzhXFWi7o@F9BV-SDYzC%7vwHY? zQo`3q~}tCpPE-rtY}eDP8FV>w@zl=Q8S)t_rzqv%A6(#l!0LBQkeMWw_H$-hvrTCQ_vty8avk5K*=Zf;v92>qq^H>GbKECS!(~-_(v@O zMZhudf$T|>sA6A#Y{06U@l6Mj7nlK&GC8W6a-I%c5a??fBH(~}IkIC#tV8T4M;$a9S3f21rb^ze%<uSt$#w+2vW22Uix-f1Jq-p@>XyLdRV>#0hcm*HdV8|Et(S*n~)P^*v9RDi5 zck7D4?NtE#kK*z`bz< zy1ZPaCL-KBzTDYvQ18~b21E6va*q^9+J=4j@S(HhD%5$ST8u@7LKwYLc=j#&*UPeYR-siQK|Kz zZw+g+T~@S!pg4fGenSz|eL=YhHNp+UB}@tU_e>N*q20BUpmO5yx2GZiyBY40jh;1Om)sx|1-u?MAIfv9fO@I@fOSJe;6AuGc4O$DB zUm6wueUxw6cUL)%blr@nj))_h5)$EHtib{px?fpgKlCH@!c!b?u*#e!abe=#@=HgA ztk#ScrM_ksdDBQ9@CDft{LNTL0c5)4(N;M6yxV>NuXd;H~Huc=2}R4hNcD%&(* z%sK5XYa&qmtW5=u$4MF2efr))6BlzY)t(+sTTrYe3Hj#uo~P0nRt!7@gwzi`Fby{l zcNtdQ9r|SogrPu}Y7RqZ8(Bjcq7y4u1Ny4}Mo<8}rrx)HBLzCHYYOVCw8 z!j|AzQ7OOPU;90>jVg$eBWI`~k^5CFhn~8g@ncE`FVys*IY0w2K}%lkisL~&To(3e zv1EUBXRZ4)S5m^Bz#-Eio`LRTy@C55K)Hi*;bJc9_vyr|_#t;7GhT>F>4?6~X>Vq= zRRQFexbs?0fQl6yLL)uk`Y?1POF6cSUM2GW2Tj|O$i{DR&b$IC!$3^KySVa8yGT-- zy}0}8i#90GP02bH4B@??)TtW*%n2$os|n`&o}0@9(pk`-?I6c!uB4`z?QgFU7}98u zNVL?LJgy`J#YDW8Oi~L8We5onGZhS)1@TFbolI<(<_s2tXaFnLQvz3JT_@G=y z+Dk5ixC`7uR@#Ewpettcs3(f0d$ClWm<7^yo-)2pt!;VTuoVMB-b^2Eqy zXse(t5ibzmZn}b2y>xt7Qz+T`mT2C z8WB-!l5W4oRyBCmq}Wu~&}{XcBUvwlAAG28iR{d+)l!0)xy4uqd0~GZQ!9SesfXPG zdL;IJB@4uqTk)%F*lDNSGu`1Q5g+uscl`thND}3lV$Yihvr|8Zl$OXl-{RT zf=JyY9{ctZ>jlWA1vXV6auY{Y@RmG=PTai?iV(EoRQW94%Rp?|hIAL?_R|(~wdDzp z<8<}CS)p&HYB*U{)cZI}*AceD|Elxthv18(fdi}&YT#-4$^NP$kY*w=kWtHFRoobv z1;oQ9jvA{8uNbxq9`k(ZT}9&zk(m8GL^2y!ZA*7M34JI!qA&ARizU=7>-)lolj*bF zrGoWE>QE}3g0nohije(jO~TQlb1rY5WBHszgEcdIqoszY-@3g$>Lf zDKTodaR=;&^|#Qz6l#r!5z;rSMNfv{iu2kLc9S8AlBh z3kE6?F;m2F+ZiIhLIB?sxp0TWa4c4QJO`xU+0nr^1(4142A(2_sZs!4sT8_8Vut+~ zdQi-+of~-e6d{nSiq5L&&l2)&QjRTt(bfb6XP3Kj2eGj;>M9q@Kx()KfoM75VFE@uKp;UJ~L3Qx@=`t?M#a4gdUzM+N+2c zbYpYb;)_u=cd^kZ5TSk>Sf~9?ZDUfd>21u~Q>d7u?>RPENc|@O%ed3c{?HHQ%;CEA zlUgu8@JvcHDbYqNkwUj3k)nil*LbnZ)c>@Y;6zxiL=vzOP5fvIy=kagXWM~ze%Jhm zv>K`46JuT8$7{4FV&0=J-r40djb8DscTzC>cj2Z`!`IK>W#GzvWh}i0*sFyyiK$&fk>n2Y4?keQcD zJ(R^oW|CoCxel16$p8_E1RWxLgmFQ2rWlR-?j%gPgQfhm8`@@RB_9jub%F~3=1CKX zR1u~IWb>E}z9%t84g1{TqR$Ps6iq_zS`A1RRQhDpR<3wWqp>D>(n2Y0hBff7qUJyj zP{05?pnvdBE-;vi-HvWeaPP}ukIzD(FHfuuZ#ZS_&>v%rfy9_EdiJRlbi<$T%Ml*G z?s|HW+O#&DD8AT}JD5UU%>fXgZRqK6y2D9K>9thCLgGK$eXE3nyzEZA-d*^+7MdJf z5u<(a<>u(P!HUiWslHphF{d}Tbb_NqNwt%&3SIc=)cjo>_ZIyLm(0hbJ^;l1czm^w zH>sH4T_t{9_99cO@Fixy_2m;a4X$6v zaRJ%ojcWPs`mKhgx~snDg%s1}`sm~mN6+&VRN#u+>(@_zwI?z}aqjvKlmfB8TfR`P zk9n86y!Kc1wS8e;te;v(pGjL>aFN@>z2O#bRJP>Ks|vyOhRUBG*v~!zctRJZDFTqt zt{JlG#J1LhGXNu?JIFlPhqZiM*xJ_ejr-i&@NC(4UI5kA=)4$O=~z^%Y$)ojDy_oM zo5Fs9oUJ*et3T9Fe^cu)(_Sv8=Y`WG4O9Y5(w6#!y9-({sa&~`D|fNQ#+1Q^Fqbcj z9g)+i6meSz=*3R1V2U2}F}A^^Tw^O$KE%E(ODTE+mfB`lhz!A4N-P%fG8KW4Yd})d zQsW_0RNg5az@MDS2tF6E)t_~3aNDESaNlCpW(^mPc9USUbm{}*`MvS)+kOe~DifW5 z)dn~SlDP`w8uasYxvuo-hgtxYj31g`+F1+|6Lp`Qq%N=-JmRf)up2JXLrl0dT5~R^ zR4ZUO)jbwFG`;Po#VUJ6Y%e@pUYjRdYGl&_+?l*G1^A>qWnoL?INeDrqFdoX9_M6F zB)X23Mm>I3ae-B~OyD(6DTShmG$2rIj7MiMpekNeQV6(#qoeO({q)lRi z_k2U{PlYg%dXvf2!}a8J6T^57bm(3#C`q?(+GJ9e{#eDo?1BnfIRiNMqR{#G#tpAE zfflVdFS2+Lgi4wzsP%DYC%`1U(1E;Ctoi6xw=@&!Y)#r{@2*!H)w`^e0r5=L-I*kW zP6&L~chzDEE`5H-msO2#FvCe0&2K-g0B~{EXsf$z(m&P(4PRey|FtW9es@ccUMY?n zR1tm$Ku^cc)JpAt0S)GzR)^E(4Q@ECRXJn>M(wCT`J=fBxO63^k65yOXQ2&ERdV9K zyjfpPm8RsbDTnfz9+ln%2!Jd=UYLM%IJL}Z6A4Z=SB!@tq2*sts@?3gZIKBf&kD&f zZ$r!@-6L-d#H`K!&Y)xhTCHxqVMRI{8t6gZA3Xm||Fz*SFnze+pdZ(ny`+mHNOMVR=9BtOW?InE=T@Hs{)edJuBV%Vox}7co}-L-_`Cga=SXeULcJN*xD+BV5VWY`i!%1@6-kPJ%|@W(>YX8%ypBsiB{x= zi4c%w$Omb=!#|VVDX}){@EYJRC>`%28*f)HAJS5@jhCamkGu7cdJTFsNGvC-DrXmx z#rJ$el-30yZ6Q)*3CXD4sW7{S4zvgE$_z?IZ#;&3J& zdOdq(&~`vX;2t&qVA_~Kudh-xt6O^u^3=bFn3>{E2l{GMcr>sbdASE`tVb+%+qN~G zfK-L(F9(^GX2W^Hi^ZG1bNZ^FbujC(af3%Eb=8I0O23BxVf`JXrgU`(Znli(@#-zsY)lk@Hbf#sF5_6l ze*`O;U-<)qX`=OXPZZ&E_ThMeXEx6v%_K14odvEVNg68iI>VEc{-T^sP45-@qWypy zwEc*+Vjz*gigfyuHk&e_BpZ=@e-<_QD;WCMRm*e62M-i;d_|OY7yCBETJ(6EK5GcX z0j^0Mayq0B;IB8T7nDWMGr%c_H!xv9^F6sH1EXeNp^@kTUP;M_~xq>D`n>0 zx}|Sz67zEKPXT!B)s<1PK!OEJoRh1h09ZVOo+S$yB_P+Gr9j$<8!ctP2sHPJ0ZFc*4r*b+`E^0qC+Po>yhG(17F9O@=CsqGS2iAaZh0`b7%rh9mC62lin9^z;|k zPY$~(0VqEhh?c5Y>etYULUltP`)O6k984be)$(7=ia#OH!dAL%c5*F>Rc-ak$(1Qw zfD&Wb`FCFa)R?u@9w52)+m)*{vTRJ>?_{0Fb9Jn*<+ObX@!MyBVCu%%xXqomN$_^= zr#CqOIx`9gz$qzq6d7!706P=8CAAaj;n`h_tL9Kd-W5~QxFC-g08FqNih6lV(G>5? zmoFK-l@(S)i93hP2S*azIJVDg6?{|D@G|Y3)2XjW)#=0#Vrk))N5IVyWB39FVYnjt zf7`?@ac?N5RDtpOfcj9bTDh;jFr_`ZasRh_p7F)CaIS9bLO(-Z!BV2vQ&+#G^^+1+Nj_P5pBet)k1JKxGY zrnp8(n2`>C482_IjtiW?buRyBQ|@oXBmj*Q3X-3^ zQ2FH`{r66mUm!g~`X#;}`M;aZ|9w+Q;Qhz@3j|qWi@)CzgUH~Yc+velNc{gWH~$+e zrngQ&E>>=mK69)E=WjNSL@a3DHJ2F>Zu7CLmJZTP`fAdfx1iG`p|9_A5 zC(CtZJFx$s;lY2)c)|ogalKFw%iZ+aMf~62PygnJZL9l&HWuvo-rqb9QjEa2ZMTHp zTaqqZ9vTNeZ5mPNy<{|LY**gZROSQ2xu3V!{08f(bv_b}R0Rv3 zxDSuX??bIo8-rEv+=k~9S@a-1nTk3z=D`2GF7AKlarEgxoj1r(ZX#M#+sAk=S1y>W zx20Opu&9pSC)V9Q^vkbWy~|(B9mg3duh?I#^)Iq03d1815awS7{S<%(6C#)ufFyB? zpA=^7aH;O@a8W;REMG5QUpY!!nmNBUH~7A6a@v-W(a7DEfqQo5v!5Djo3?Yl<^%bD ze_FAZx!cn;9k?7$VL!kS!MjjD9kd3d@f1gthO{t)D_S^lm$Vko%T3eIObFaoy=;*LQmB zwx!o8ndQ>geuaUDeU|&_RjiBdslDgbOIth*{-t-uNiC(_<|895JEln_eu)kTojKie zJ8kZSh2@c$g$4eTyYvLr66I90G2SzeIAlan^F6nP3-tsQZN(S9G7j)P0>GUc9Ie)H zouo+{{L9B|-ZH=t-vk(|!Q~V09*4$M;BhdU(rm-80f=uA5hD6h6#Yg}KOVPgWPm4} zwXL0SC-+L(rJbmI4Hc%=CnAynjyQv!*i@XbB?E=q$Pg!TFeHM1U4De(zIU`2bd(!E zJSN7bJQ~Y)O_$Mdbe)X9ld^;A604c5>jk;@#ki9U*v9oqnwkn;Wf#vL=~gi*S2#Qx z`J-K`_Y84~TIN`tAfE-R^gW>D`WGMU(nDD(%Dgq(Chy@qR4=tg-Ve9CL=KZcHFU0(z*ZsOG z^xP6A_|=g_0Q|pR3<8jj_jkF)omlEUNLwcc=^r@-WUK@-#SFx`8}TUz9uUJY(2Tj^ zodhy(D0xcy@4lYWSBU`(Icm2#&zI&3IONm=ti*>C3>E8UV$(1Vs3NR)%F;A!t8=mX z8l+9l&w4`xDGbSa^_A@Xty4M59%_&9sn*qgjcG8L^1B^M0hE#4s@GWRAxP zD0+}zM^M>jw|@=V^H){isEs#ZN55NY)p)Z zm=J8?K1qBms^5IHwIw$o=Q8d-&(S_puC@HyNbk?*x`aYktJb0e2d{sWuz(2nJLOERaxZ0L6iwgE?N{_?ExX{i1Ny7Kj zw|`u^-w-Z=zyMis6BnJVNs0JvTi%W@2}-kqqeBBJs|keiL)}VHl(S7Y74Y(^8^syU zGV_qDb|X>Coi{Icnc{(m64)|n?8wOg$FDE1ukuO?!O7Zg*sKGfA>U{K-a~F0nZ{T4 zJNNf|rKdWM>zEt{Q=WZYrz>+0hjm8b?^6&yF`<`!tPCe_>|K2|=6Ru6Dwx!=0Dt)N z_bs9_x%0P^k=sQFIY`SJPBuWG2!`#2G7u3HM@rZD({8?RS4R`n+L^a;PLg)lFKqw| zKXOF>zJ{1Byi3;;+|Og&rZztOfQM(KXq^n^wEA*Lp0_P36m%F=E^<1ie&3KP-WdsK zFEOv`mJb_Nbm+eeqF1y9zR`Po9l=7+sIwxvJn`uGe3Z$`^p7ZtX&4^UQuWFtVIkuE z;PR>qrl*dmn`QF3H(>3aeb1n8UlPL|_ukDf=gX?ykmH@33SjLR_#%?U9^jRU%4Kxl zm31oOy~XGuud%p2L~MKYf@771N9r+J0;BnD+|cM7jLM`57}Y`A-Rc{~q5 zIRc*TTplgf)Cv*E=HZEevK&$z`oWM?+-}RE42E!nwWEU#zd^q{%D86pOKVVyqAq$a z@ka!FRR5LnG>b&xjkZMETi3U=iejrnA(sfLV3o%c#moej~R0wHRdLmPq4=rVk0Q>Q=Jb!2hysa z`e+PpTAK7#5&4#EF*0!bH>T%N`~zQpwJ_IKyDAhqCD7fEm}_3%xjfr7w|85=7L4tU zmSCckoD>lU!EZcS<7+JAPNd03#QdVCPY*m~2ya=oQi3JhTWc-ovxJn6^<|V*_3>>Gr73q`K$g&qo;_txc+c&4FzSHfTa|R@kDwq z?uDrxrAqm7c7DrkVHO4QuA!l$5(yCzQMH!|SibMZQBi7dZKrxCbjVk9z3B%YfZfsO zVM8v?96E05k9&KG#pQg#z90A_N5`h49ZGrG`Rj13?ly+h(tk<;ANz%_c8oXE+xnm~ z{WCnYb%Lj-@$B$de73SP6=aj)lWb_aXWLx^AwHLMx2{WmoZP9haiD@G1G|L+%jgJ- zGCi~CUaS|SFPrgoJ0Kv%{NQ#j+H!Yc2h~P{ z%vaT#GsgCtD!;lGaZmqq9c7EBn93B-yBnX%ISpzA#Ui_H=~3zN%0qh5@6DutB7^QE zLUD1#*-l8tKz;lv|YV1YC;21af`kwtll4M#W zsg6s_)EBFvC}*1Qc<1MCy|i86p6J#j)K-u>l_hfh%p3+4%hCgTy#!P&z3K{Dy>3i0 zhWGd|ul&3rj&p8i6Ia__92DQIy?5_QQFnVl&4?y~mgp6ey_W1)sEs|NHPp zO$3-hmUKb=s}BD{?0W}4tkxTNvl*ZzX9Yf^!kdCaA*M&VAcb;2`gjeuytF^y`$Bfk zJO}=yzj#(vGrgBQ(fLr~^VgkGiFR^$W!#>R-xqRQO9##Y#AXH@Dk}k1E_gyR8Yucb zK}5OHYxBefu7*cqvkNeU3J@}lH7~-q6c#1jv*j!hB{zsPNxpqHnW#V{a~v3M3B<fgVh;`b%0+-h(`K&nx*MsAE*hh-Vn>39(+d&S{r;skYBGuGBJ73$^33| zPDvi_4igd%>5S+@o=sIx@Y>wrnH@k2v#F{WZv|$gMin9qj`rDv$MK&eO*T+*ySKcGg(pJU9Trx4`p5S?#j)aWvOXNp<;M0xmTatG_AI0 zLW&jxhkTu|8!5MnXc@v@N}%Q#SfjAKshTF}Hx941I)-+x1iuIdqkazQg)ttW$39iw z8oFm+gqb&5jK8qFD_*A#%9hbed!19{p)!Rexx2wjI8$m=<)Xmh>9FD5<5l7ud6r!d z$>g|mBh$#N1zBhP`}B|rs_BO|{RurqFs?f{VEOg$rZh*XQKefA!sQNgAfuu$b|*Q% z+JzXE7l~fh0jRlkOY@2%Zlg=237=3uN z<$mNx9|&`GiF&*9GckxVwP3Tq19d@c!EEWEA$xY+HZ5bCzMkE$-?4?W^2}smDg4(4 z`jfEZA~rv^#8kT^Bj_E%+N)V)Wqv@xW7*s{;df3Eqepbfd!~XJ zJqe1)bEng)!yQ>rT}J)NJTWu3AJRp)7QDUu1*p6B=#rec6HrC%M>lYv2QC^)c)l?c z;6txd#x1swT4`g^Gh?%tS0oIL&*f4P)!BU3rNb@D(raMxQ}gP+$r)O^vMBxD@qyCJ z2#>cdnQ!gFK8G}MV%#6?l&(U~#i`|W3`Qrftf!-8;#U87bY#P7ij=%zdcv~>Yi=&O zk7&-(er4q-WTWFH$}RT%Mdy5xzLx+Orb7LrdR-lolT6@J`3!u+YYh8^s9C|Y!%o5E zK0EgfH+yY+?R^MGORiinJF0=?fUF&frn?!&Tk3Fkr&>V zn8Vbi3^sQxk$8!Ddv5PL^r-I*s#@iVRbs;+A?Pu;qqFl?y8~KDcadeA@dhHziY}!q z10^}w!T4Y=DU5xMsXZ4Ha$c_ntbkF*QIL+2G&)h9?@e=xqVsvt(=TaU+=q(;?#UG^ zce9@u*x@iHCOf$;+sxz;OO%YEG0^gXq_e=Y^BX}UO9{4<{&llZsmCnP2w;S*2I%_uUYSNg|bEMO=_E3_LlD z*sv0_lSmd7a@!c@yAU^to_cEk9WHhgo+zj^zz46^aSxfK$y+w4d_0kr7*vL~hxy$8 z0LjwmoKw=EC>kQ1*pQMz{?z_q#Ds&^?<-F~pG}dg3M1xbFuBNfdur-%-EdHyL+lR} zN;D`GYV*0Dya&oaPFc2?F0cCW+zC*fEb@dK=W?B-wK=RlvAnc}@0e(0TpO`#44>IJ!#a5G}0zc(gsR(f+0a8Dhb z@3(z^f0#49YZ7?NZ2r}EQO7IVFicg;xb0m?{7+Lw;O8f^>8hHUt7V?8qnDXQ{^_)X z+~wdte*H|-Q~X?lnz^81V65WalB=m`d1pUb%kQ4jYO=6xf*JozE%Qo2QPW|k%{DO- zc(%c(VWB4+TcQ=^a(HsvS9y&zIx=DlvS`sx95Nz{ua#)dUG0cCWYjuB^i@O7}=K}Mpv+2|Akr~BmSV?9wt&A3A|LW#9;SOJg-CUvvVo^udSm? z$f3*U?ov_<2hDQ}^ESO(J%yaibZ%jvM5Pl`GI>`s@`dTf-onk>o7xBS+^x8j!W{~Y zJrYccN!V^~w{qC$p{^MCBdCV%@zp7(Oi_PR?mO@s=KlPNmtXLSn33u?QH-|pxsMm= zZo7m@P7TqRL`P*9Uk))apzYECBB+jlCvc|)%|y?3ofFx0)I zdw`)DfqgGeikZGl((c^qx{;nL1v zA&rLyr`zuh&EeF@M|EK-5Q;d?Q4D4{J?h=N{X3*l%DIFay$rguf1je5z<5(QB%FYm zbj0Vhjzm;_Yu8}W6g=l>71pge`g=_!Cn0AZnKTX@V1E%MTcG8YB_S(4h{Dx7K1X0N zh`mUMesv+FDc{4u%B;j=WIsINEw*5S5^H5;2WxFS36uVHP%S9<& zsekqY5c!7Kxko(@iP&X+I=TTvd5n&R7XBG%Y?f$h#Y~kS@(E%k^l?a}7ICoIneYqw zOmI-Jshez&$=LupJF@?t(CcqqC+)aNlBV0V|E(M5XzP?tcdbm zia}W^5d>`(>`OIuJ>OA&p#lB4jdQAL4v83?5AK-{dKFwtU-rnUNhMoAMsesY6AMYj%yZ^&J>Wp#{&5#rs^aM z7%(oV=z0PjU!iqu)=gT7651xHM3ti!?X!^_29A?6PTwN}a}=Gf)%S`Hq8(1|m!ABg zuU2{-eaeh%zyEs_jKTI#_rGC_+y0_iedW_*<`{4E{A&6Vs$tlEqY|k35D%WUd*i@l z^xnFcS%&2D+Sr*-W(N#9vId$)a&e3oF?&3m;QaEID+FW9wrE}A+4t}6wn~cxOxp&x zU?b&8(|6l<9EjA`wHe2WX(FyXjmEqVif?qkSt>`C#biAam*C9zwKV0d8%?;$B$oI0 z2Hd6M>ZiVGMx{fRiZ@xi1c^2jZ0@({=kU&P?$3w55VH;&^0Lx4{R^f3@!^T|Qmb1J zhlT~p^&65s?AF652Vo~NoQ@9uVBby?Zh2$MN`sx|$691)Mw9#_mry(kypoFkeywd@ zQt*ajNzL9|iKF2Q6;3vd>o^$Nv=svAyT+ZmK=5>SyYeJi`po36CCXBBEKNE$EmE}Q z*loOPhw>UNNIw?!(XC_a`yOQcs{Rc0@dX&NicHyXcWf@{o%0_5kC#27d8joFAAE=h zglYzZQRFzO8cRK1SJqN&JIpFWvG``2-nBZxDpd3>uGic$5nQ36m}E*Si!HiMu%T(6 zs?XZeYS_*o_xFwAoJ7!WJ)Y_sOv`~akk3=81`O2nOGK7E>(K3YV|cVu`#;=lxNR!Y z3Lz%g+wSseXXBDR-^n(5Qn{DzxUFWXm|QMsbsKZyxvkl;Nyg z4IcS$sE{3WpVrze?)1be-$dB>H*A#<7#bK)+;HsAV;!@sIP|XoHG1N-<7vy$Db3e5UAsf8*$t0IgOjNO zT3+AD=TGTomV?N5_*715`d*-(PJpaxH-GsSAf|>1uJ9h^?;Y@9FA3H;(fJ}%=2s=h z-L+SUPs~Op31eZ-MAaX{g?Joqr!ZO7(z2HT^Tf*XU7mFY-o)(CZr3oqB|8g{v$b!M z#4TCbX4_)!i*sr=F@_ayd6g@M#WFZ9LM2*WZvbj|819Gkwzr>0!EdY)wN>@KDV2Px zL#L76L#9!DiEb`=l4-1TjCH%`S!J(}PnLA+ab7)(Jm{ED-3MdLsy{J%@j#-pu&beV zf*BpiTtwgZdso03bWBBm%>*;~Cz=#popQo(7Cg&`7pqsh-kIWh%RKc@B+(u&k_^^B8!_TgLOe#pkE$ zeMkZ(o2i`7sO5ba`6->ZOzoYITZvAT;^?n{?mr{DUy#9;n`B1ku6JF?&-}^uJtvIy zx56gkH;z5|&4^B**q04fcR+#su=s|FI+raRVD_~G*Sero>w|s7o@)sC`eLQ=-0eJS z6FnPxZtgtGlGMg(dlTzPTAIXY%pKK58@7o-oV^0g07(bUC#k)VuPLd?hUfvj&&6&! zChW)`|0Bfw=N&l;>-M}UM6@m=i-irrsq8O)t04kDYHfrCwcnB*Ha!Y_e&V9-d$Hzm zY42;VY)9-N;Ga&7c(Pj740Gr|$dP?JLB8e{>JqmM)bYk{63eQk7EW+HR@rAZR`8VU zd`l;)K>1iJeL?({Xhe1T)+WkBVPE1(6QE29UlKmwk#|17(SWDuvx_i zvGOwM>Xp36vaeHwJV2=^a74iE6U3JJH!Ql+aDuOqlPFhU8xpFoH}puwO6tmovUa*YFQa=K2!WJ5;OD z4O_XByYz7GSnfj)yAWUVy$*z|)O4vq+e0rL1Smg}np$0`Xej7p32NIv>V%4h*-U-f z?Z+VM4ARlo%!@x8$<9~46Roz4F}F`0Z^bR)jM}Q@L7evS8D@g*55OFe&-D~ZIl|a~ zlsX$!E2SAeWX{ZJq@NJ}a%*Gcs+a2dZnfQDC{`Gik~K>7`OQ3NvCs`)MQyn>bau$K zqdD9_;c|X9M0zy32@x1iV~E{me1-9HmO+d4v#0NAXKt13ATlleMU&z)ph8REk;1ym z5&G@&#oX$vu4Wzl+tZf$!}HMd_ua#bYt$|p0jphOuf}%z-3_ou9qFRrlKYf6Wm-Aw zMEfWo;@#-Dbt0)G(h*kNX|>>&q;W_4Va9r6J?h$U@a45c^5tA)2^I9$nt0(IfU}->RTnlOhQV6MO_BLg(*j}X&@#bzo zIghSn_UwMi!ZOU+SjcDDc(_v0_d)`JNwzck`Bid+>vES{Q?&dgjZ6{q0&dO*mN6J} zCn4dtMLXa1n_O+l%3D7@keYE=g;q4lKs)IOQ$}JfOC^b>{q?|rhh9DDnx{AryT`C( z_;u<1(j;xbHL2hB(TYa#ZH?6>GcrxRs|W|XSA1eT-VR^+wn87zff`Bw_f2Hvf8^yb zz(2jbyigpnr&JlZs!>=spGzt&%<8U0gD0peZB3EC!JE*eM?}zbiI-@ob;Ws$7kQdl zY?RoIi@cv6@Lc8Ko+TL#E2rUbn%G5OA5wY-BG29F{SeCw22_NOC;2uA_HYG7vZLSB zMK1t5S(1kC_6CQXTg1w#1WdAg>%7O*(_g1=P>(@KL_*Z#U!VN=M6}b|Sozd`cuBAj zbjT7^#z#-)f11t;XX5!#z8#6PdE6-#0e?^z{xR@J&iKW5P!{vU0)BdY|Axsp6lb*4 zUAg|+!CdIv=RF%%CxV|l3YfzGg~G@|PIfx!R|eMIZ;o%vj7~w=P5*$-p(*ndfC+0^7X7M zR;cx=OMTl+lZjq@#FR)DE)G(0tlv~ucOAkX)hemy{dl zwuKa4K#qSPgc@Hh9uhQ$&9h2W|scPY=2n9TH&_qYbUcs-PvdT|0)y5A&+C(B z6Ij!mrm|cUH$!~IJGp`pr^2Q@G=U3y{ugfxi1zKCv>?mjJ(S5J$HBnxEr}n{8&WUY ziRtRVynlOBd3bu#UkYzHJZ0(34~1kem1}C^_NFZCFENv)RHsa~-uLv9=FcDVN3E*k zIH`AEy}z$}k+&KX2p^nTA}3HiwcQ8wagT7%?f@F7RnP2;fp*ILCa*v1I8^tJ3D=cZ zuASyMZa)kO;%eQR86JE{hjgAR-*v#uFaWQ7Xx=_)-p#?^IqrnDy~5$Rf#R&p0k}=3 zI^5p(s%!K1K5}jin4lie{+jbLi%R0j02{>uoY(zi*#5#nv?=+g}O- zAUEpVT&@5e5Vda==WFu8+I057^PjET`^OnoF50LrUbLrutLH@$&=h=`0w#O7Q2yh}4e z5A@d?mlQJYr53fMo=9O1{c>b55feLMjIf!~mM88*$=EToEnx;Gw%=~}q@oB%QlF4= zg{8TjJ@p93KO>zPVonQAZFS3>pkMeG&5R1OFwsrhVaG>&nNml(bhM5&vVJ{lspVFW z(Yd_c@&vp#AkC-zm7xg61Jls~)tJB)jQmW%h=DQ?r&L~U@W`r7{P;oGKR}NGLr$JD z>9ockHIY>^U24a?I$L@E!ib$^b$U}#ZR+rnV|*LOcv@b>&Z(|vdA`XpyD(=>uYH|3 zyi7Bl$QJd21&9!na3RE+^P$g9D19d^Ex{2Y}6^`6ViI+rKmKYhJd8Ea0~33 zXeS|8`Es*)udXkJp--HS9oNB!X#B5y**}C6588jiRW+9f{5j2eFOJt`((ilAbx@a2 z=g*y4j-v^yICXYtJCSLl2ge-+b+sY(I2%D8E>2oYkbpjqe=G@f)%&YW@=Yx`fSpBd z#S)#G>MP%wvU3fk!5UV2ltgaE1YPs-6PxRAS|hdQHG7P2|Bjg1!r&?}8b`6e?39-@ z1lC#^RDa*jAB8-1?pX@0EVm+o*NidN3;$ecO;@R|Ya1|YUnkP)h$*w$Zihc%lUF-3 zl&Om6II+K})!8;oZ#I-u=;4Ikx9XnbRR`?2YS+7Qx?i=`%C~Hnpv#!^elJa%oSG{; zU$!(0s1XD=F{n-NTT050L6F`5aug5>)NtoI56G9NXhkd3QvhT0J~*xAQbYtnZq|OL%UZZgw#>_lX>zU*^1O48zQV*P%bf6fVKq1qE=@+}5n(RR$o6@tMvrYy zTSrb05e;KGg4~8@gh)!3yRQN6;p9ZKfodd~ZRM-Vl9dM&pg*mxtui(IMsI3gu=Vl%Zoc?(AeWHI)sP>R5wtrJzNVgBUD%9LokTpZfiztjVC~j;mt)6v%=?$NRY; z@nPcmvj&%m*Lr^ks;N0ECe7{ofrP0G&oi7mS7e#;AfGhT&(!4dDKHqyJYT?lJ z=XQvVx36=FUr-TME~t8f9BLc9=4O_s0=!5IpEZN&(uc38AjhFNv|9Bt zm5T~0N3fA!f<)CJIps9MgN}cV=bP$VuEDLV{t;Wn_;qK(y@^=vnYr(^H=B>j6+GK! zNmf?L-dx_n!h~1Ux%18i@#Fn3`K%(IG8E1ACUz|*G=u55n^5TzU>h~O?%p_3#akv% z8Nk69&v>uE)a`bEiO##K^Fg#z#mZ!YYQAg2Uh(#MMd+g#{J+B^69^vNT)H2kSGld( z*aTzN>mI}IEnzyiF9{}$dd5C#n(H&Qlq7G&yWsp8d?;wdm}nfhr)yVjhgmpCf$-SD zZH%yki$9BO07V`Y)9TG^==#GFG*+al&~`+&ZyxFH7kkPi zNG&4b5u->b6va!D3Lk?M?D^^5C_5(ir)i`r5~W_L?AqOJk>dTFr}@z9UKw9pcy|7bPp7JC!C?SBuPd5;@l4d}8V#90FPe163PaKg~2NrynYj~qSIwB0mIVvkA1Nz(cMvnB zjkWK`EXe3U7#0GD=Fau*p+{v@qe9LdINCx`DRFax7Vweb@<>=lg&|+Aa@lyUbE+M8 zB=TCDk!#5X%SB3$NesmD^Q3H6RWEEvMSW6!ZX~R0r{48M-e=KlxE3DU875of7T!Tf z4!;@PV?9+niANN-nyqKm@s0jG7@PtNje?Aun~GX#Y{Ju`1=H}lN5QS*W(SZ}dl!a& zXCxq>bGA-WSwy(8+)#}fH%6`^Mui*1Mzm-uocHoh_~yKWIg?P|-)LpIVE&wh$OLHl z7}b1z(3u zKEthfw9ZV2GYPsa;`k1#P10+`wl^@1m*z&?dReoCOtJC${@1NZOamnLG52-L+dBG! z>D-OsSHoI0M=Clhk&*BJX#>HkfOmB8Rx3|nls8Nbxy4|mM$vbvhtYRx_^qbX7#hK< zny=5y1W0Q->tDPH55Fz81EK~oizZY*y>@D~;28`={x+2lc6q+g#D5@+KiWoJ;VI6D_T35YFVv-FrUlAUOWjv2cTR8jFf!48 zX^=h}j(ADr{tm*{W6zJUv1cl77r9@KEj{*o0hY@h+HE#V2Q3>P`l0L!iWk>R%b6Pq z?%dAn;wc@1L-aPfooQ#vHck=mOKT>u(-@^rfSrp81H|ye9qpT(Z*$uCCe@1n+jt9;DRhgnNI`#ZDR>oXu2*j-IEol6mDW z2OpJKxOd3hjpgM5yxi5C0Rg;a-}VihX!gmMqA(dpg(fG~Oi&+J3_Qi!D=#!3acDRP zP4td<+*B~LaI1E=(EkliV}ETD{-NDi2)`KY*fF+3c6`aKP-!=*!=j+F!&fu zM<|WSkPAB^j#T^PE2>E;rp@oVAvaXfpgdC`umUH|XyT6$u7fqQ0}>6HQdy&%g*A0A zxUxM`#c_U=aYFUn;Vq`MzD#>ib{4Un|e_`j180q{8ATYr_6KAcKQXS5%& zW_yb|4#{!HG5i4cpKg<}_g!s-Iy9cvKM(eYz&YIkYQ_1DU@={t$`n^JD$zvC5ARrlMggsx1gF2Q@)|NGH+AcohQA zZjC%>f7ed;*sioV(EJX5lKC!9e(r6S$d+6zz{B3&pwC|k;26$5W{t9P-C22!B}y-i zK&qm);kU_bElWGw$~Dq|i>+zRSnC+(xyk}1Rm4)1#yj{4(EOA#(%YPOeyc;m!72qf z)>v7s_`ZP8v>S1<16o13T}UXVVbg?#VYl0$MUxs1IefIJkzW5P&eqL*mD&ogkIrXo zS8+h`0?3VWMhPL@_ljZMMWqOTM`T9+xW3r=GL0Ci;suz_rXWU@g5_=TzPi5 z(+ht*DJB zU}+0?%rE_T^SRoala|*Y*|={$SQ5&9ZLREJ%p~lB-3*L8=nTCjLJt-Qq!NX!FJM4EBab=&#mz zhr&Z(B`A>u0;qblXS48%FO`e3MwrL=tJGi0(~U5TXL#@2)^#3|yH=xUA!tO|v=W_f zx2IB=+2)jM3GurcvteygDth;1f{J1!QK)UB9LOnW{?jX^B$uh4s5=Z_XPS#;?3N53Yd-Iehk+_n;pROZod`Q3Z#=&P4#dsIckifm8GB&yR%ma% zs+;6!%3HVULY}15-Bqs^sim@mlXcnChU(`|tPOz4pKF>c9>{kil zX0+C@t8u+}#!u?rysx6*AUQ{ftZFKnV6szsdYZ4DKG;qAtf?OUouHm5asFf$3KNq{ zGL6hYZcU?*!M<7W&#sz|kM|w5!`m4W3YHi$X|chh2^55Pi2ff7oG7^G&547Z9=D~^ z+1Mhf1#cpT?a(e&IGYX+zZ$&@ak#g)`z{j+Nt6zglyzUkr3JwDuR zSC$zQXwmTHvzt`GM?^r&r}RPk73oiPN`9`QBkV71_1)y-xdk%MYH3-$w@E=(o-sm& z4h@S3exYiw4Yb|uu5}0Hesk(ZdcPO89L3dOq$QDbwAy3Ch!oHO{&M*heS5nG#n9Hi3qG{*6^>lP`K z^EzdN)SLIvRy&h7+OsM0@Xqft@r)s0Wc=5}OMoVxS2BZq?=Wz8m8#3*yyL<7EjR#3Mxur14U*HjTKOFZYZfqW^e>Ok2tjtfvXIDRsqGD zhdrH7hg}W%P>AJn7;#*U`G%gOlLi(`y7EKPcXB;7*Wx;o*0Apqko}FXNz?(HWiJU= zKh!wLR@9N!dfnVNg2gc}(;{es#GO8ll;*ClHk|?^5%Prm<(E_j%XRwiFWv|9l| z@lsq)dv3Q?(-<(*f$Pc+x1O`c5wepvt!DOB>vmn(xLo3nHaTGmRY@X{2+e`BZidLr z;tm|=Oj%n1S-l^6WhOkMz}h6~h(4zRI&=9Ua`lF^amzVRU+CWi2W<%*$OXK^c&NcY zd_6wd$8A?%4a(Q2Ii|^}FNAA}n^)_LLv^lb=YoU<3=Zr($j#2{EI{>pTE}URL{+M@ljgpKG%5OA|$77O<6F6OP7UJYVaWS z?BxEjpNotNw%WWPCJh?ZVo|sg?h8)4j(>7Zu2>9N%AbSshG|cuRSowrps#!XXNZb@O{%33Ez?OQWl>ETM8aDqTERrkzok4~9TM zJQ4Dc$UV~TS{q%o>thK8Sc!73jZOTgIvU$t$Yz5Wd(uM_28_*_sU=z~rC9EN)Pqn~ z2@dQQrWZRHac&U%MUTsfPSW$yp?P~3q6(+u*5*u^;)F(HEq-*!((FX!hS5k@{){{j zykin!!X*tl)KRwStXuVDxR;8l^J`gF`f&(1T}r^@FM$xV8w|Vh0#u)8U0hJTMjg!8 zi#{ilNRSlbE`Hu>_advJFQ*50zI(ZoD z?y7gDw@&%bI)?iyepeJ58g5A8rk!UtCNaoTEglHFExmnprwf;&2_PK9W+}5hBR9M7 zeS0|=&+QQw4&OFF&c6G`6~O4>@1(MJQ8xkXgle8S0QoLkcM-~{RheT7jT`r-Q=h;~{w?eWI8WXi&&MUcN6A~EmtJ0kIc+}k_mveT7 zM2DLebF?G{yQ>H#|18R)*+Bo1=JKh1WG|XFkquL`@!U2KZaFE9`@+#|;5r(lE?u!- zQ3gb-CWX2Dpp71YujyE_cNp*{7zhLS?7K$dXIg6d$_SVC`Pcfqn+D8Wv4&TqI-^IR zZOeENv%?q;%c#bHT~u-TvbK#_5TmDd zlJ9W6d8!)?a6Hgy>q4;cbn2~eA8{d@SamGaGz+oM)qH=AnrUI)cY2?S!&wWjD8Wgp zT=H{TvHYAl>*{o}WAe+%B&Po+eak$SuF0lqBTP9hW5Pe6-0M3)7 zhvu{Kcs@QF!(1IBFEu^iZ@ylH`_dga?0?MFw0#b8U?Aes&dPqW=qR{B(AKVjE5_bW z7q+CWOyT|t!^BCR?hug9j(W0~ryS*a1zan(a4zR$Af*1v&*eZP6x0zO{Z~x<3pdzu z-j`=omdq~hI|@~QZ~I52e^^R&64lH&lrLGp`+M7QIr%kTzTgYW zmdg;T>Ow-Z5|H)7D_#e0y=U;kfLVtNWX4IR=LSgn_4Fav*=?$QhV5KCMAR<|*4BA| zxFup*hA^WfY`z$t`GJ9I7d~#Qi|;%?=*V)*l2g(2k=Lu^5HW)B;qwh4Pc8gVnBT+R zqaq{i_lvf2ZXDb~IbW-js_~SGfK*(DS?FlHs~`5V9|&Z4;=4|9#%!c8*Pa>bj*-5Y5JSXOxSo~DyZUNsG99065@w5b8Ul&*$j zJq_>_U;G|By#rN;M94=Qa9Gp=ufEo&E!#6U;oGK%(&CE~>In)u4=k8A?)MU`-hI?_ z$*EWZ&vEm}>lg-)n!)AQ!SBOkrIB1Nec8M?h`6i76A6JJrsjl3u0;x@SmVeix8+G@ z{WjN+j&oRLYjJWa7CB7Itc?i#E{m}UBdodbkL=>57ecny@pCqp?Qp)9`6eJ@hZEW5 zRN-#8=r7`7@@YIHHRw7COKIMbb1WqjD>B5}{^tyfduW1#xmbRno{M|~Q&zux#=w5i zCVVoDBT7ZuVmX#Xcc*caT6#4^ps9@52p=Asl?q`n9B^)8Nr;BONvICwT2PgpwM4qO$QdHO3~Z z{uGkavPyyPb*~;wplNZ@;zORPF@C(*BBKt910>>{Sg@F#mr~Qyd1R`XJ zrq!A9M~xZ>7ld*LYO%RB3e6{aVIRG#COV?_;dhBceZ9ULf$IC} zlgBHNL6bx)^^xz#KhUl=jt@6uZCZ?!ECD+K>X8)HDYmMxf430U6_Q8L3$fV7Ql1J2 znN-RC@Y^N{QfyV$SywH87wVk>Y190j^g|@lQGmh7BGh z#N(xS1%^{jJ5V!EM#@J=gG9Wez`#q3o>~*e<|ZTJivsl6>>h~y`7;uJUDKT?{H8UM zpZ}7A@A-uqU_TV}@M?2$*@|P#g4n#(ucHS#r>FTgNoQMp0bmyXfahgG--2;_3->S* zaKBy7jPB-@@AV9yo2?6MYc1u{+qI8%TBWjvyswlu-D|BXECEkteF$6U@yM#9?M|c@E zNN!}MAqCiBhJA~U6w1y@oZQeYUA%X!)Djx2Diwt$oZm8)=4C?GCls{{2@)Y-VL0^Q zI^LvJiIy$5wh}S(;*D0C1Nngzwei7(bSy}Ee%%30`Wri`ptJ0=TMH0F%FMS;P9iL) z`nP-XC_Eo{nHDUj>d8-ThwIi!7%m|v@kBjl@29BDVxIVlGhdk2YQ$TJ4+nG_$={c+ zLP1K1fXEL6rtq~e{WG9q9S%D1Q(!aFodP1#&49!p-AFfs zD4mj$Lk}=?*9_mo-e;e8?{hYs_r1>d57!V6Gtcu|>t1W!tBMm|^gn-aOY&_l*71^T zbw*LqyIi%11M+|NBLFXaZ%V)4YH6&0xwuTk8GPc_9tN}}3 zD@~^>{;mj6Kp;otd*b#cl4P|eEe;NUM6ej4m(14d^eTJcjy9iR@^a2V;K!CPu+SX} z-<^jU`1)ea>J9tsTkVDEwU&YJu{SeZ!9*_}`e9{|lL_t-{b2hQEu^^1$yI^RfMW7ATV%hS{;cXTIpP@XoSLwmiN@1}^9K`Lp4#N=r^>yr%)T;c&uI&l3zPO9KOxwy<&?;kw-1 z+b8w+6m)d_kB_;GjExP}6Mo8Jj!jL4`Ui&3Hv5XKtgZ^%E0LS@C5La@mU?+zV665kOdoUHIBms>kF~Xx{QS`|Gcq%=OG{avCMNl_sKFT2@9I># z6S>#bvsjMa|M1~M+ShFw=gl4o2~%oTHi@@u!<~2T-%*esH<_eSLr#|(;&pY=4~&eU zcG|}0n##yj$WG{-pyoclKT?N-i>trYgvia$SKE~ZbBN7Z#*_*+PrHwI>rtpp#*H=B z)L`f3btZ7>C)>+-n2)^JgA?Q9=WQqOnWt+I4cphWpFT($7@hdo*T+N!FV;cbenS6A zin{h=KmeV$3xt(*@G${_-|HvshBH&+$2$)=Ym?&swUYEN1t`B2bFKsS7$Z$5*qN5M z8qMrC{^9p3Aa~NY+`A%}>?TD2M6o|#-DHDOA@P&A)lKPeixp`8blBk-Zf^(qdC#;M z3j7nt|K`Qh;M{z7|X14((&G7v#Fb2SdjLs%N7{v_kfVYaw$J`2)Cy-BjOz2 z+uK_z5<9IPUVTJ^!~ZzgNXE-M#P>A1H-xz{7?yeg7OSb- z>(-lkPv~u5R99eif!x3N&BUBxLcRr(cn7QNc?^;3Zcd#SfEVg4OUmvZW$G>`W|_?? z`&{77xbErfy=`SKf#QJlte$MH*X88o%&q1StBc+o3B}|;|3H42y9q(`odIe-;|9lx zKt; zLTNk>R%7-PWohEIqVUNZh(1N10Q`PHmdxik2oEEK*wXBcj|6Cz4p3(9Gi_06O!iPvu zB>vwAz5MmLCDB_rbOzP;Kj~u6B%%RfOILu=K_ZMjK}ddA?Leq$>VHsT#1L{FkPkd zJy`EI5uaN5C)H;QB%3YF7toDg6hAhakf&N=4GQ#Mp~@N>AA+8=%>_XOKIG;~QmGIa z0Xi#Os9P>KZenagL+-}9>$*l&@-s}ZQO>g%&(Bs|xCMN1PJO&1Z~Y1gQRA7s2%iw2 zl-obtwOl3Kn)SyNR6X3P+vCu--$9*VkDY%nc-C5kvB0}^N|B1#VhjE{)$eoogsKtS zA-4T&E)Il2)-ERX6!JHi@<;c=@4u2Gx_Jpm={jq}(>{Ex*Es|Ln5_5$uEeE%$qMB4 znjQWrL4#Bru$k4yOuc*EmB~sd=;3i5Ugry)@Ks^KN678+rU;|mQ5_b_xZNa!;Sh_&zyTK{OmGlA3lDZPt3Up?(35?GBu_%m)jp}LOd`1 zk;s;#h3)e*07k~hj*}q~A?oUyAeKB;ySzrv@Z;R*m(!ST04LO4{&5~XBV&wka18k; zJ+Gacqs5b#fHDC5iIJ`CBPKqdAo3Lu!~^sGM**@-)B2Z@*soPu&yAWQBi~MW^xN1i zsS2uvS6d^*W742@!_pY^pF>VM4UI!3+eg%OKEm`|QGq1^QNo{NUPTNt>NY$A=^fr; z)ONRbD7QNz@y@vOaC54X&>ppD&O8s-yauSmp8edM&rVos*ZmM16#HHN&b#dF=W~N0 z@uc)@)7B=5-b14)G;~ZNA66jZ%SQ8ldwoB?{xYjyJtE=q1DXqG2cpQS1gI@<<1!}) zDpHg)3|3cE%y*immfwlt{qlvZqe~KRwVcJeM>5G3?Me#()Y}rHv>R&iq&B2trC&N4 z6IpzXmI%JPJpfp!kZ^M!yWg|lWI+576@j)~Irrv& zW*Gd{{9S&Q=GWA=g_WIfLt@}RJe-)B@f8USePv?`cKSG72rP9QZK0{cXlS5)9V%K+TrLFUi_k z-4Jt#lo?FAz5~PGneVJ=jpJl0kF-lt3;i4Dt1ja`pb#tN!}_ z&r#4ZiAJ5Rn+`ZXL!)wPGDV;4pN;o>hbGz7K2hq~M4}UaTaf1qTYV*IQ}-xd>xB75__|+8Z&7j+$@W8ol zy4(~z1b3Z|@Rk%7%(;!vjeW;zqD&cR=y~N`4c%2X%FOwaSBnbvDt%@-YV-J&=hj=R z8A)L6Hr>c{B1HYkUOmu@XSm;C<>=@<9{_@49YKZ9VJBnT&5e-JftS@476#sUDK2Pz z8ZY&Nv<^2cJom?0sjP=P7(_n=n!9C65N`zqUgQSEsjJ-6Z%)x@GDz9QXJ?g2Rxiet z|5Ih$zavDlBua&JqS+vmvB8&9Gmz5je{F#M>$zQ?>MSD=TFNY%MX;7CcvVQ`QKGe1 z<>UZihyQ}o4#VF@D*r%~*)!@#c(_4p@!};9Dfd$EtCNZDtEj7~eQ_tUP6{B6TQj*c z*8~HfQK$OM`2f3Q%gNWP?ME~_`k%-P_$PUvC~Nynvu_{ZbkEhyW#46KuHS6v)$an> zTnoFho}3HhQ{+(>q3cm2rlKD7eM<}Z(q3EA7P-zRQ~rZRil+j6vfUYOi@SWpHDkIy z_xjHl1Ua}3KD>BqVS(YiHDmZB2MuW14qnZ(WBDnrFHDR3YjW~l?dizQaCf`EyQ-QR zZ4MCK1rI#Ri2UNNyFB?rG=s*_tu`+up?z{s&mBlaaoIIA(oo4T4(X$aM>anq-9Fe= zm15kiIS>zhnwo!1LD6EjWQ<1&c`Hbe^jY!i(T!{wf}9_Dt0hhIIppkj49qatA;w zNWN}n)^l3$=qN|wWX%JQBcil4uz27<+u8rkXM3uB`_dHvY{8^QyfdxV^ZR7~_BX#5 z_j2>QIspQzWv6Jh!_3EvEB&N4v+CPvNIC#F-%T9bX@5<=S0=!{d!1|L5$D@sv^|e=Kxr#F7ukU0@Jr=;{^vYjqTwwkn0P9Wt zSQ1~!}Xom=yl z@cyaHKMpnTn`8T~_I0`lnEbcfkJI>r4{3k|8q|w7p`V*E{vKYy6u;pK^njh)?J*s}4_Ndhcx5113Zdddp>XVN8=LeLE= z*?B~m{4^?fnotJq_>-jv!)BSo| z={@tyA2dGz%`1LhSwG!iObCQ{>up3_wvu;A*i0&>kGINomtTb|#SWyxH#fh{c%jGU z@{t)x0%abv#J;=1bX0T4r5Os$x7i@TkhK2uGpdGTNcC4YIMaTRPt@bNNCU4yqJkpz zs@3nxq^SHw(={w@XC-ynY9SU@7Ha3U{2jF`*S>z;u)18 z*VR67^9>*mQ25Aqq6j@|3TGF6D@ z;viRxs;X*%up+n>a#b+4ePXy|;#b@)_VLV~PWsz(9izzfk^ zEf>Pbz|fK{tMzVhy^FaSrsrAo0T#w_S1`5E{k6XML7m{iJ_KOvj2*)JA=|8(H0h2R z5{Z33`Q}&(ENzG-F7haZ>WA|TnIj5|xd39(Pf&2*#q)TT^Ow);ovO`WVIVyZbWHw3 z%!;Z?OX_h_(TmKGpzz_A9)3l|He1?3nfGtvWKX!8MRai7&uW6TCm+!u5 zbbg}y=9JhQQID>uqW$slYF>h%%g4{LT7S{0Kj81TANmT51GLU>%nsW4JKkJ*&|$8y z*NN-yb!R(^0~k!RhIKhV&zZe=iapnGK*%w-DTsX286Ej3LM%jXs0>`_ z-gyhTZVH53^d)otnEXt)+aJCP#+LGJtA@IfFgKppVfifKfJiww#CHnxo=}IYH;{Op zp3$ndBXn=|@;PaR&8I@AgTcBNB0t(hh1)I; z@-EDBpuSHJi3tH5yyf&}FB2!Nd4 zrHsYv2m)iLDUytJeeBa-rYP|u!-9PcHE+E)*rb9CqMyC=I%*QP|)ZH#Bfa0 zMUx;YY4b4w9}CM(bv-BU%h*M&r1@h)LSW#wF7Ju=s*Q~*ZL1bMof9NsRQ$ohD7)trWjsZ|71 z@QY_pgyCkjOL8JxHf@W4^^`NH(d-Y{%6 zQbj*Mb)Y3+&#rv~qU2J!kv@d?wl#Pp@>QVv`F6Y1G5Qvx>O^AvCt|DtTHl!&;-ckh z1O!Y<%_}l4FBgo5d|Y$!CFjE(6Cz-wc2sig4L9iPv6-1KRz;8r-q1NEN!7ZqFES$a z0-vy`u*=~bDtGT69JI!PQcE_|RrkM~VG=*~OO@CL!}Pwht0QkXn8=RIuU><{Pdx$q z%c{dRktM^B8R1MTO+0nIk^?fa9S-m;&#fyY5;Y`AHWcIeYFy55dqzO+T*=e@Zk1mQ z-|4`~-AwR#oN1=_$`#wQ6@z7$0@Yb4M_kmuE62`c&TT2%RQ-i`qQOsdVA9S zC$N-Tw1w0G7nubmHVRd{mYY*=T$g{z_x;ugQZoF|pS0U>tfnIt)oRYzlII z%2-Mv(wl>Xlu0&yL2Tts9QunFf(QbnrlHSl`G-zVhh;Azt?uR~K!vt8qlDJso>>FL>^)1m^@ zN7z8CyjNkYwG{NEC zo10>l&zDGV%lQi#eMdVj49g(UY(4KW{&0H?#MZx(?o!=Gz1F|It$;|3OELV&?X|qP z$kU2ChBnla0Q1F+isIo8 z*x=@_k}+pQgG%BpH`*~hlU=3a=lfSLs+bMBagxi*xT|RVa4|#M$D>1{_Ot7RVKwNJ zy8h3o!9k_R_0vqPRL-wo^Jl_V2aAJp_8vzxzsBk4IECN*I&eyTz$X*__scHWCDOir zm3;V&kLCe6IVEW`)L7ryBQG;22kz%hXE#t|7ke8Wz5WNcb8Kwvih=hyH#ZhGHl=KO zhSOu=_NOizg@sm~%ruWw&%4^&+jS)4PVGbYHlbjqd8)Qr!VtO^7gi4AYD@L#TuPzt z_+EPc{sYb#CPGf@_)eD@I(1#UJb~x5v~SA7TC^3Tq6TvnGhOjfiRdTgMx654bCcVU z2=mh>^xL;3E9O?Vw$#UW3t3bD-@>AIht0)kiLmurGoYOjP42o3Xaj~MVhT2zlmo0l8#hh1|)rJzV zXaF=~MJ5RsWdt9$$Qu5|!#>wTvOo`A=apz<`la%cCJ^y7Pp9mdUNLXZ%tay zMV)ebm`@H-^|06K?hhZ`=o>yhZkwy-?leQkN6r%z7dV1~dM8k}A)@a^hmagW3hr9B z-2sGhW|U&+*KF&>YKyfLeVxBuLs5ef39@I;v%qwtJyKfCnyPo5(28qN8Bbo!;H#t} z_FcOZd66GZ(EhhFqwrivApcbG?qbH&WK@Lx*1Wlm>aOClgAz{fyK=YJ2Vky3GquyJ zS2l48qvT6!m1pDl+zdMvamf%@JXIZ0&TsL_zme?jRu=H_<0p5bt!#{k#04v}JE zCF?xSR(eHwDvDKVMVju8>v?rdl{86;ktIAw3PglBIC%oU9tq7d-z;y|eKjwqh$>G6 zQI!p_nu$)Mn5+)@366R|LHUwWqpZxqXm3<>bucewlM|{|7&_FO%3t?cXRuLA;tgVw zCrAf}`Ux}N*qZu-ksJ;j<&mPA8VwcJ)CX5=-QkKtSHFmGAR8C5_I`hc&a9{nTeqWk1yMHei#Vel%`Zz;!#?r=%#<_l4 zbGTv4J9^sVXcfUx6oGs4jNRbtW)cFa-PzMsH4nS^Dyejo6$A#CB(EwA*eq_7@tEuk z#+5luI@9Y`;xUJfoSB5OYY2cB)AqSe9K*W zeXX*L(+MKuv+ia-!=TB^R!&9FD-j6Ht`;*WCqn3!KL4r6YV_9T4KX1#n`t9`*acln zHS@;%aCJkv>~l30M-5^(`;Q}D$J>uPJA2E6AL@F})s8-W@Lz47kqdn99{$nKJ4d7` z76Rf+Q| zqB65ijMr09neCHp6|v?01PnwI?KNRJPp%L)p)~6|9|8kj14)eAw~xod?k&?j7HWQ- zChTwPw*ReuG35x>)u%&SMsHqCY%`i!8cM{kUFWi~g1rTY(;p%CaNV~2`;8FUt|*HF6Vi9`9+bH_#IKO^b0d2$osKbl6|JgU4kfMi#3> z3$+^?wg*nx-4YA0(rKX^zL3UC$Uh~}5|#K=T`dcv4sD3ZT~r=7q5Oih$mfgw7ljiUU1`R{S;^W*scBl8u`H z9-k2zA+CHXIa+CSZh2+w(Gfh;N5Okz4{q-2IV}h{#9eWPkPcR^lt7oKTs}G8foGV! znEyVQ*cXh;6c-?EK*h`qX+bU2saC`T&T}sga2jZ)>z!khr}$2Ga;VDI$Jlq5*CUq3 zsW+0_6rj3nF>Bz*$g)Cl^p?WaW@>qj;h2z@5=!UBG zuL{*8Ou{L7cgHOTjwIPvB7Vm6Vz6NM4k?^lGJ>`pJkG1Tadp!fTGZU8i!X>u!WG{E zsLm$7wf*t$eU&So^Z)se74qIs>yit^iNA2|LM^Vhh(10YeZtJle4_u2xr|ESr}2X# zEe;T1%<(O-_Z_A@Lovb_wO+>kAbK4gl}H8Hs(st_{K`{@UjsM8=hUD8%_rI#O2|8C zoc!>=0<1qN=@r}9)NdyBCi!_6Gvrja_xB$q+p_AkHSi&_o}yyRiP>Xyqk>k38mbeIc^UtiizR z{Ji^{Na7$({uf6p5(-!tw-yS@`LrB9Q?6^aU=Lq|Zl_ zCxYEoKT@J&lBh2Qzp1e=5-=>a_gp4ntIs5YLza@ZyyJVds$Ng{ieQbrc*Wyl!HgG5 zNOj;jC0GSpb*j~&Nx4So6f$mGabTQ|;je6p`p0*bm`hT*?9oV_XluPbv?dZ^@paAB#b-X`u; z*jJ9Ny=a=W9M&`9wRV%M^4&yqn%*Cl=_t|0LwRVi7Ece9p8mZ~8fR#-mR<~Un7tVz z&DLOBa?hd_v%~c zYt%fg4Fia?KAn}E=9NmD=!c`w)*p3smo(uW(gcb=9 zGN$lW#SoS>%Ba{i7EM-l_q^Ha+Wp0~`s+)|{>sdFu*=xCV|WP!0oXxhxPsVSik9z- z3gX#(XOJ;R2mxe0dS^5*-$7^e+so^ooA|w7p_(?vdWtF;pw9WJySX1m_L!UUo@i!B zJd7(3#B|2XKC5$q=L#CCx7Pkh@G=RNzCm=2h+YA8f4Sm)AWD6-i?pt86R@naBQt2h z5g1r1*1asdbnYOrI?iDg?DE+OFmdh>iE26fz7BnZ^6`D?N>%Vg&(jgPsVGWxOk+s} zg|sRA1)RDB@Y>d|rZ8=Ryu!2@`H=X$Vhm1s7!4f{1Eg5909J3>)eHR1grXQ?xM^be zc zwhv=~<8wExC*|TY>*PUnxqsFCWuuE&bdi_yt8 z``HjA4PN_%C{URB`sJ2(Tdx3HHiLj%d!A{bXG3F3`07wWJri0&Y=gw`o(9gl(gMCD zLquDVLG@&o+mIRH>CU|@novhrXtyRN)tc-P^mreb1BNc#u;QAJn&y1xcsSg+OiIF6 zUDre2hc|9*5(}bp8FnmuwZ>e7N{grPt5he6N_0m0HX6HGCHEvB6u%6&$UQsCA{qc& z$h3a_Zx?M-ziMu8mw4p|ub0URp67;wvlY9sy@I@?sSSgQw5yYDSy*!oOS#=>f0)tdZx4Be_vk?ey6 zOOBFn7#sv9VEhFxal&iNtVPp%5a(?o5 zGzHf{G`l%q-RA|QZ#7VZ@-1Zhg#V)O{~0|06*k@z-c%j7Mn*t1C;$(5vtdIs=niJ( zX<5006Yl`cu=>yJHWgt=abm+n1+IbkVQt^&Xsptasio4g7^*ak6UCk_qg7VsYcBa;a0gr%xqcpF zdR}>eoBQgsC?^)cH}>-#<$JPkNzgOU1k-- zn0In(B-3&n5@1XWju5$j98W#&>2+|vjG-`4vOGhm_TNSV!|pfrpzebOrt0_}eYT0t zP$E_YG^W+0yt9Q0BBl5fC?LCZH*(&5=${r#GBmMrb91} zQ#jh3zWe9Gbt{)4d>8|qbD^j5v!#nmB)3UhUC0;A>ohGJ&@>QmHzvT{1pMD6=r32C zGoli32FGsd@T^#BLF@{UDwy@aF1e6tYtXQlIn!859kWhE-cy`{s!w0b{JbY!C~JR! z;^U=uHyi5&8D9P{o>~Wt?KTA1IBpF!mYdr*KTNV4sb$K!d!38rOTd`c^rPdQFr>^; zJWQ82MC4jUKPJ2r2|6X55@ou1&2xE_`we9=Lk`+|a(EWNdVr)h{??LZji=~%{Au&( z@UW__9})7BC0;2Ot|)9*Hps#$)S= zXwrZHF}a~UuaOcCHo3}P_N1}2)1KaSHp3q8>r5G7A9AXE)cds3AzN{vzrSDoFpDU1%Ui>&)zrken|G^s?trmucDJ@)F!z9(L#6gQz~D?$PsI_*T%g_1Io+zdF=auX>~=n2pn+SGAF8kL$Vz zFuQo~nT^NV{alwzt*T!#Iz{|TOCBbld0}4Ey6iNwm{{P! zL9ShU?-1OcFP`I?I~=yU3Ge|s-nOSA5xK_k@$tdauEsFjPx;tS$4NDu%E=TAZ)1dg zh@U_?_pHn~^IvIgax?+ziPpuEoMcIEY4|9Q&)}koKkNyps|m3h4bme`OdLPuuFCB|vtPQ9 zjl7BIb9|#Q#zfR=@+>K~Oah?QDLI+-@Hz>3EfTaHzdZ%Hs>+lYhnR@ZHS0vj#bxNN zO_@4w&|K7qkyrOPum01?M~L`rvbQ*_wNWSE~N3D256ZNmgo7zLoNVZh)ACO1PBI zf`VO;j*=4QD*9KRYD=Z@(oiznE>zYs`vdOpB5?4ogTt$9j5!zGS6cm&K5F)e@JBW_ zNs7b$YWl*0ae+#hD=RLBfeo?Qvqj-|BBA*doS(Zzufi@aa}?E1>9~|+&*9hgcd2dX zThhsOj+x57bg{Xsn=b=QArT%ffl}5nK(^@I_^R)38^}z_>z+$j$LY34q14|lp?kdb zT>|}?X8Y&wWGb8?VceL{dLB8+fnywXmipc54m*8PnB4k8{(|U#vc0xtxAOsNQB7D- zwWA+q#2D#zjXV3>T>zNXzzbu0Ej6w@XK>-wFZiRse~jShr7qFaKLz)06aPbBYwYEV zTU)2{T?{74d09}ucp+ql?D2wjC0@oPkIZvAD8Osr;qmQ=u$$3uRFaW6kYLFU;=W= zs8)05f4F5X1PURiO^jbl3kIGNU6!0-YTF-iyTdOl4n(cFv|sL+le%p5jHz?^GBXox zRK>pkXp^C#`k?ijhL@u>x49Iahmyd#M6Yv?0oTOW5QCB$UU-N)kIBPRrQ=5`$_0!wUC=@?ReCz|#Y^ilSH>>)A1F0n z!@IZ9$3SGa&LoeDiNbNZxUT!03dT3J;wbK3sVV=E5?@G)khpk!Q})+^w~7I0Q;pA< zCx(uJRKVJI4@Wp9EcBU4Z^=Zy{5zA-89P@8ZRzstu%(tg3F!*~e#aj`&(||@^Xu&_ zsjZc-wGK~*F-V&fSWDOb@Hxu02G{SB*2Ug0K*1)v5=npm#kmgZ!)HAMpixrt1}V^r zxhKHqy3go~px5-+009`&O>3TsYRe1{w(_#+(82%8ZEMbZvVC}n3s!dF>HBb%?*9=t zu*=Rie-m+kjYN9yZk&US&-#q+-q{ASK)jOG#Y9w;HBCd&{9*lFeLvf)Er+_yiGPb1 znQkuetUK4AmocavRhdthP0`f;A=(A?lTZMTk=Q zx|w01T3@*#7gSpWtx;X`;?~=Q966g~j|{Bi%FplZ-rKkPoi;Y^)#p$F6VTHzVB-*C zKYjaf6vq2J;eKX*k6dlhLA{OLCS8{-)x;;4x|6o6*J zl(uoCcO+sakefbTIW^HPx7 zMhF$N>e(hfz4%ooRcLk#s6<%Xa+XLb3G|FDm(ZChAGfM3Pt%j?vQ9*9KT%RL0C8_M ze%YF95tCl>HIL9ZVgrgBvu7M~LV0aMMgdc88 zwl6;(tTr?>CnC~3=;Zqp3XLZ%X*kV(`HsMA;@&CH+aE|5|EZ3>q(ZnBsMEsJLHcnKW-9m7abVpNlFYQo+U*9}fewpx*owXGtKvybI8y9XKFenp}xyQ>A*BK*b)&8{LlENACf?UlgV@wwdSPhDNz%91oF(By8k8+%3xb$u(r-;-Ch ze+xY&_#{t&9rcPjQ?&q>hqLtUH}XX1i$;J6Hw_yS zO5?x)wzyv^t?`VDATQ2-!HVWoD>_hHHHV5CfCFqFOu)B98!dn>D4E&rcj%X$Ry*w? zCGnyhL194sh6bAYnA8*!1}tn;+^25-KmXv z_Q$|5l8=Zm_1O%Hd?FGym zibwq1Zq-O~Fk79=2+R@B@{oJxC^GWV#?SJ0e1megM6y$drF`~iFzC0~40(Ex^kdRw z=-mW-zL0*yUn0*`YmQGl|w{RuYK z@&d;POA8~Mp#UEu4U8@Z5rr{5wTwq)AQSBk6EZV6?LFehKB zr$54R20Xa}&{h%Jzc zX%iEnM1(0|Yg37Fnup>sMB@EQt?0D(^OzM-vniSCcB-i8Q=^_lC*-o_g}HXfYtu+B z&%f6|Ng#HIh*NcVE03Bup5vV+uX9M5o9W>*x4ojHWKzX|(5Y0?zjv}Gp@>G=3yaVAfhvPD)= zbnn@+X_TUC)C1oM^6fRkt?uv?TKkcuCySxhDar9g7-{)MBJ~*;qpk$df2lJw_x`=i zOcuwGkzvuLFkkn_-}*xe%BUUEQ6O?=)g2pZx4htYPp{5crsV^?SBFGYME-GgfTv0; z#|VDur1X!oZ>yO6=?~Q~`^Ll6ovnRc@z0_j_^G;tO;o*`WP)B=t=Bjk9t)L;?$Z$h zhoO~y=$l}=3*^{z*`O;aD^*~Yq&d8RNjEYKTGQUB>%a_Q9$IY#h)~QxNC91YluWXt5keZi91o5=-kL@o?3K}$l4~->(nH6@rf|srszpl16c{vmz zRK4JRArevWD&W@X(c>h=eR%|emyJytsSOd<%jq>KkKgNC#|$;_-qJktM?1hf;B<0I zu~6P)x1N&Zsjx9^?KxZa;D=d%w+6f|F&r)xF|;I(cjN%F@>uuUKnTUKw775{?eEtO zi!Rq)@LFOK&{oJs;UlkQN@v;K0n#mO!2;d+ZO z3i10RM{+ngDkX6RYTYXi;ug|4u}Mkv?z(D!jv)i79kfXI5wAbaG%}gMu1|+25 z-A6A4%JfCvAmIe#i4~K_)eTuMtsZ@Wjaw`t1rX<2(@lq6(v)0WlGP&@n7GVAI3y%C z`26+>n`}@O{eCwnf??9-`6_fSsIAUoSKPbcIh1Jh@3?zgo%@FGB#}T!_L1 zCdf&ghW&6+sFmKIj|B}IG5w8?;~N9G=E0uWC%Iid-#a9T4)UY~r1&{i$4$!JLgbBa zvcHqze`aLu<$g4X`Dufd*xqsK;{(D>mwLxdN}%9)bc5gHXe|(jXu(3u1Bk0mW*3;V zlmn|+&F8s5O9i3}^$r3ti_;!U@q{I@ZHmRH_ZO-+B7q#0n@`n> zPvzeo5$a(%w5oCv1l&+I?n4K6q_|9_!<`mzLnjZ{jE!U}$Z;yL*G6yuC6@ut>-+1?0 zW{Rv}>_;aMsO%>MdoA>i*YN`}iQ8^aVBx&;&?ZFP8qqFjT&_5^nFGd!&j*Zt@L_i* zKrQQAnNdwW+ls*=AV~MPhk>#5Z8f5M7pL@;E!&A+hf@9lalccZhvUKnb;1(MP{h8NN6Hw~jeK_dHq2s2xPCN*oXjPfC#ZJlFF=q|88E*02+Sxiq8vDy=td>Ws@c zQr)*+x-A@l9QA9HZ0h9N3k<^7JV81ZR0CnC+w%Cus<}tXxCkB%-%r?E zf!lKN&F_(oOCaL{N@`AdBtHV*94NyCEO5t{PzJBAz4p|ivz|Q<0w^Vq)W`eljNOI{ zM$3gRMSP=86}Q}_*s~3~Y{c3?{QSF%_Y2Op=P2C6oa=RtbgnB^&D8;t0GGBQAGyWg zmbW%(M|q`#J^h#za3O*{RStZhof4}3#p`!#*N8m2B3Ma?Rj6m;BXj#9wm+3Di4+y1 zu!wQ9j~1%mm7fwtl=E0BQs|#CC7!HVy_OcF@i?p#P$(eQRcbw-NB&AP3=R&~E@lF1 zF5S#Wt;Q>;gu|cFjxvv^d0B*BRb=_=vwiNwopy)99BRZG+~$C+dd9v{nMH79JWmPX zg|ue}aKlPf!*f(vX94qtJTCKjUseK`05ZS(8gTDapd;!C@P|MUg5MLEDVQ&9lYeL4 zkEAI&F#AH9*vIO#YLEPb)3dWq)P=USng?xo^S?H->U5B@IIkVg>)nCSSH@>s0Pa~z zudWsN3=p!GU?7|u&MeZbitN7FGT`@_KO`D;QxU;&SD73)1yg~vJ--a`Ta6Wm@!4MR zyPx+T5Q=&EkLJy!UO>CkvAitmVVk^8!rzn|(fR^~oKOLj>=rqak77!hSVc*y5A%$r zTgDrI@#?uOmwa2YL;TQiYFmLnbG=bRC?VS`K$gXDc9nm7$~|^$A)fh7`?mrM)zzHC zfoMHOm%pw{$7PE2))@(-f$erU zb&exnySw|r?@q?e#M7~%1^O>rc7)J$~TCp~Tx{gEn4_?08>HRi8eW?j~7zp_J>Cb4HifKgc?e~lhlWW~Q z&)q1D7eA5JHQMgjCvy6HA%+hKi2K3ORk_e_{jJYIx_yMlm7t@r5yA)D6t_80<-~t532z@F6~H^BT08Sym;Ax3ZEAqa)A2hQxb6@#VWgQJ~x21gF7rrZCS*MwPHY zy}fe`+Eeo4{M^paX!gCg`;;9rC)G`^xbYOjd?>q;cyD(%dZy7sjZ3~i)wCuw&+kJD zkMko{ZDw{S$WRU4KIdiwi=0&5ZE=(zm0n4g?>Lb1&NWa-Aou-Z`q<+mCCG$axFLMF=2eRD8b&S9Q8fk^lS|Mo%z`a1b~aZ92A3wU$rx zOtO2x64%D|Nk|s^&i(t5K2x5RxjxJQO&JN)r=?@Kt5vuWlq}=(y4QFcn;65*zrPZh zk}JVLYhqont2T7}dn&aVDl+S8FAZoiwfkaLS4D?(Epqs>wd4!>-$y-{)c5D-wtU=K z3*4hm(1DgC&C8Y}i_4ay;eBFeW~~jnm9a8o2gK}BDu3R@Xem&+q<~4VOn^!H8M8O9 z2^g1T{xdz%VziEtACbnijE9R$p2AxZ_iMybr@;-}pQk+VlD1^f_$mp}>@3}U_Qx!MYHM16$Nb6C=zj2sgoLEpLF_5&>D0TM;ya9$ zdGlIJzyu%1Hx;gVRudIsRc$s;+UH$O3X{Hz7UiWgKF^LLp7^RCgJaJ(Hj*a%fjz?T zyUtCP@=qDTmimhrbQ3%-n=}w)ofL;n7^u8opdkH44zf3?TFsrLq-nQI>fR}$=Ixgr z&l4wp7{Db0oRPf!XE4!ii=_8-tOVl&h^?G@%bl0Hy^4xtf-ZYQfq!`T|3WDNY3p4j zi6y|{s(hifm?d-fx^!?_9T293cSS|;Sm;-ENF-uaE)1Cz7^5OosCwZg^_s*!^MXt* z`LEo_Ln+1fk+ye27rLyjZ%Gt6E!vB*t5FfD?)w5eM|(q{qp1*^8paj8 z`uxI2vzLWmPgO22HUKJhTSU4_--3I$2^~ZmRDG zs%8r6OB8Fiia7P+t7p9BfhbiL?@+65U0tyRmg@7`y8Zy|a+Xvmq?6|&W&CrRc1E@0 z{cRvD>^dNx-k50&smxgR+zGho00vVqfPHot!-D34}l(N(10agM z+|#I+wDDzFPfWm-1_tI=8M)~1|83OyJ996@4V>zwj}dp4^}@MRy7u#c{}loNB;}m| z&MOL_Dwa+sMFhG=7DW$oVH=)u!$vt4seA2VQ9y}{+iKREQQ9Pquz1r{Zxs}jWRjN+ zd*ND_wfkCjl|_pEuwT{f49n`{mBv7&`JD4R&Dsx%*A-MMnBL}j`JlvESkP%b@0Vt! zg?`F%NWWmDyTC!AmrK~k2NcP5K(z-sbK`a)Q*O20kO`1J@V^{OSyuxs9Ge-{`)c1i z0^%i7{wcR-BAa#6Doan`yn1wS5SL`#AZ}fQq*H{ZRqB5?d2`;a6clnM5*_2xtvWVE z4(-2a81!>uiiw9GBaQ?M4ZImOU&a)a)M@j$tdYuwLNW?ox!%1yxfEPr&EPWpbGoOe zCxdrMvy-;oNq(}5MNTi%fv%Vya9zDNFU>{ zTO1X9F2lTdEubWK|4!;!Lq4Y6S+5mg3bDyDiy}?0!({Btu!5x}a-xaFej+CK z3&6~DPycN2;VtScd7r_iFq+dF&t?74F;lnF29tdxN+tb=>O!THMdT#Up^zo9ux{5|j!$dV$Hr=E$#msENH}q@aF4UyH>6f5g|No82e`|XawNlcz1`afxOFI2?9-Z z&A|OrzVYlE3kHic@w7hHg2v)C=(iht-8RXD!EFT695$0$vGU}ESiCxmj}bgdvy}A zBH=j`VYGFoy9p27L0?{K?0j;xUot*qxwAf`NuN!k0$`{H zL3LVynJsN|7?w+g>+J0n9nlYmf##K>$Dqb4RP4_+b#FNU<%Ll4bcvj=tjITIAt%FUp1 z&F}5%;;1p%5+ClJJUMHW9mI~hZj7yLiA>Fep!JDne;jSjli8rlzf&3H*g(lB?>V*1 z#T?PxyuU|Xa~W)>w)f~ECCV_F`g$p^Jg4d9b49tdT_db?_hV8`3WE>XcLQ)-mPU%$ z=L6B%iVYqWTfE(!B89zxS%C+1p3m17dC*;>7caTUy_ZJ^bX)B+1*OktQxu9^Uyfw6 z)W@ZYJgcj;%>r9`tc(Sc;t9`&Ltmciy1yLv_7DdUB;vevrPw|K{NHq=Z{MDA`S8K# zJ{%P^5ueX}V$ZNlTVK(s?dRx7R?q-wMGQuA7pmQ6+^mfSe*0s|dJXHasD**geLI?; zELqe&fmj;C51F>Ugi9&{z+b7sH9;ctIDrM~7?CSL+v~CrZy^^<-pvRmE@Fp+PWX8@ zI&@{-_W1ySg09}FqhbBcd;nFioSSZ(fJO@2LLEh^)WO*%qajeZ_0h8lg>ciX&^1O3UBzjx5 zd2`L(eXQBVOEU?d!Opf|QJ7g=+-B3k-NX?UE^*j3UKD(tJHy80RZ|m?`N(5p7oNQT zHzBt3M_AogS!h9WCG+Xe1r*}O-|dbM&XV^!`>^<(*4ISGrHu`<)qzQ@Bn3kgF4 zxdZ{48}T-wkgRXBvuh;T*CxB+M-VDrw=@Cs6j?H9FC2j3;P&<-vj9`!su^S*421AJljM4_FOW( zd0pcT5~fnAL^jmqhoPI56o|@CQZIwrX$>F>uAAjmY=^A7 zlUinp9&d{9sx;by+wylr9WzIfaad&`BlcJ$k;gJ&BKjY>85woW8$_Pk9igEfWQT`` zkl0@7#=1L8Ob8g3PM8`>GDi6((eyly>O0uUV%vlD3T;)PeBmNY|Zb*qY^X_7;6LC=0xcwO+eE-b!&@Qd7p zSKa0)F#ZPfKx?SpVh?SmkvKi@52(P?P+z~pU+fZ2BmBI=+VjhV@})0ZBXhP+oQ`f| zOtVb$3BGOSAamHtNFC{{Q9|YJotdFnwuH2N#{lPOB4eG|0}!Zh#I5 zc%yZv_wJ9w2k5;qH-8s84Wpx@W4?6h6gK<1M&YNg+IQgoBO_dSv6IHn{##nl@9)F& z_^N7Upf4O8G`a@cvx-xn$O3PBXE(~;@ zraMbz1z$)>UEBNy=&SZ5kC!xS<|`kRf~+`{GXp%_^1Uy@{{C+k_XiBe|3=1Wie9Pr z7P*k^Xi^++9IeNkW5&zlo;yp~v#8rj|HS9LI8FZdU-;=yklV!*iq^)Do6^!Aox@GM z&P!>L9@r8>u2;{}@-$m6EDx!X0nl|I`09%cvMKk%;kB1uSS4A+Do z-n{U&{XhDJz5T{Gq;JE`ehd`Xq>0_ks*;D_H&t3T|My?xhu{7q;jPhfcT~PUEz9!q zGLW8dT7*ATlt~d+k~nx-2#61lK;;8}(({G!=YNPr`=cFqfx(rN+t_qz#W|Ej!(2KM zI$2lQ{Qqxe6T8{Q&HBD>!~M~4A#~AM3ru)+P8Inq0zH)Dw}@+I&bS1kXlniCoz2T#vu|)^u_l)O$ zM%%sAOxN#!HvCUNBlVa?Yw7`w9trDW=NI&|w^I`nS$dmxvNco33BlMYPMb62K(N2U z$urhL3ic?lfqI>fl_Z7zh# znFzN@x!`E+|V52ZN!bQ*E}; zR1zn{8{+wRRu;0KIYj*8JHVcX8#_#zVsdlY14WYiU*in;G|;=(?5DKPtgWr_%Wp4q z1M=Hh^h#lq^4_XEf}VmS5`f-HzwKZf z2Lb{+ZbX)%PeqK_3pJk_=YFYpv3VmDH$T6WUBm8g?rRlQFf174L?+c6oD&~g`hNa3 zA2tvGFw7>$l`th)9MElHkAMtVkw?<07~c2wt+#f8k%@~UFvl%$QL!r=%J%(v_3;Qw z_Ry_3Kh4{+mt811vua(GpoNR@H(VIS0Sf=sKMO>GEZH=^r-+>%!M$;+AX%*qT zGTicDDNHn{1EAxX04D1P?cP}V;n`T-Ms*(Q%y-uQCIa~?h#=^-C-#(ut z)gzp`TW@$e-R+*5Tycqx93F$Jo% zGKkdVwZ+p2yDb%8hFp7(-?dU~5E01ILPnA+&U|Hr5+g}W%VSH&yA^(&jgutjiaqe3 zWc1AwXA)3$9mzLRwztK02|9(?re=7!xKwiJ(S4}Pd#erO_rIu({(HZCd~mtGp&|ds zu*|$6>0ty{N(!BJqMrJ8y36W2e%BT>dLmErVovP&M^xhp3JaN%*gqHtY|UrNg#J0! z;8~Pa`m5Qq$$JaPsvk z)AKbMLVl8?hMmc~?C!>njzM&@iw3QCtPLI*2v&(NuU3;T1NO!j3>3X;gU+iBnngB- zbSbHuG}tgBlO?=mv}N)~-pnujkcbZ*=z#cBOK7ze$5Ww2Qt`Wf5ON0AD| zfIiXyeByRf19*0p^+?zZ4##%y9-?4+$opiydb;F~pNG6h(;hc}CnSs<$Wc{9us!Z? zR3_To+l$P_9GMPt`^ZgxbE6V4FBRM0VMw?yAfRmD&`?j)@8;=_+apCgnYbg7=-tK~ z<@Cn-t9cTLK5ovnYUq=u)m58#K@+>FZz7le>ZPuImzX#ZAhIn^bp0m*>*dKcEgllQ zfYsn5LHnt^TMIqO+&HtC2b$UKaXho#&<4n?-)n-k@rw-&|Nf%YwFG*47R}4%HGnOo z#_T1ep8_|}ZAP=)W*yB|R&+mW5Na9t@-&=~5P4ruPj72Wu~#t^_v{Lt?2oAj|NX=x zQIDGH@N=G%3S{h*JQY@3Q|JuS{izqi@MC|KoyFz&#A0p+20koL-eaZ(%@#~U`ILwI zd@GJuHD&N9Y^tlVUjA$_9qPKjW=8AyS@%0TuT_!M`Zzl_#g8%_%4tv4aW0&FNl%g z$CisP<~966(8GMws>>(gPk6c5;SLcAHMP$48p;$7L?h8`5H^a3Z+>pg=Zj*P#^Evv zPj1K7d0JYIrlr8i-W0hMBm_{kQvSo2=kNuWRCQEuM$PMLl-8e)t6>@~dL^g?k2%Mx zxb-(&SBCX|+iB9l-62wiT4z0R_et*KW@3_-Ot2s0^{A7?r-6|2E;u+C!>}=yXg#x$ zn0TPN>sei=C}W=8OdCdlVC<`Grd4?lPM0|IMvV=6Y}laU#r?8{Q!Y!iYFosC6p~VH zsxndJXBf=17Qy4kzCh6bLa)>mIPaE9pW>~f!1<7S^yrG^czFcB)##&hA2%|#o1_kT z#4(A|7gvV9D>8T4*%c>~4lOe>Oy(YSeIk;068zm<z5Yt6H<~L@RgC#kt7)DG%(~sS!9z}72u*K2SJ+VcVp(C#+vPqav^cN7 zz{wK{W#_;iTK+VM6}tK|$j;2S#J*89HI4T7*BYjYk7o(39AOj`?3vLke}M!SC&sT?o{4oAG6K_IR&c(8*GgM zZluCk%X%Jn-NSHz`Fj2~zm=}+a3PlQmbIW9Rzk>NEiZjsOWov}!Js&**Y~HV*N`3P z<{SI>_Y8Iw#WjK4(9Nydm^~cr^wW$!QvM1R9PGrrlgPKP6TfxBFZ^=)bNlfi%R`I3 za1vc)`hZs)I#R0||F4K-*h^p>N{5O%eBdW#;>!ey z;egu3cBu;8u?ORbt<$Ti?XvXswt~Vf!`-^9dCwoYH{2a8r*fM6aLH8>sll|{(3`Mb zM&#O_Kr0j7orc`Jlhp}iODOjjqsR6j>@KbXG}oO#9j9)Z>WmGKPxPZ9L1~y z;^Vr1Za}b3ThbvB%y>=zS$dD`PoMtgO<|9nxZ_Q9y4USaojK;T&XH&Q9MIY)s`(o7 zTS>^B+L}5qVUO1~W8@FG>+#0OJ0u)$iCKVGRyI6@<+tlMDNM5dEGxGr<+^1p)bXL3 zVGBQzs(|S5jZ8{ndw{g`X!CYGOU0x^9{XPE|6p64|8DdyLsJSXqKEmLW-tVqjvtJx zpPy^j+*+t($X@`ruLTErnps$^REpv!ZFbdv`tV80e=YVvw?2OSL;;)l@BuO(*62OA zcUA{ch-P(AU!1=C)5z-E$ujM6r~)(V*#TF68O0Mp15l>sDT9QE3b9;F7||*xx2sk& z{op1>7?$WM-2gZoVG6jMJ&5{Aj!JSrY`4;;#R_WQUtBoZ*ASKRXdZ{lTgmHo37Pu# z(_Wyu=gN&%y3)%81Z-`+lHNu8LUxm;6~s$eRq|6|o!5T97F5Q?>7v#-5D7!5c6M&D zXN*Ir+^G4r3Hpqv!vHP9$a|_1j1^Y?tRPn{%LvfX6v=uoaSbr&ZoA3 zz4h0M0SP)XIy!%%7PgXK1t?uZ29gZznD-Vb?@P@(mriC*wHuRCLk_;f)T7e0^s1d9 zjRsTou$&Y*NJ|{0_J{f=Xw$gP8qb@EI}}s-5$oX(6MrezL<_pi4ux4wl$*WH1x#9( z-VxQG+6;k~1|%rm@Pg-RfYv7Sye322Pyx2L?p+rBV3wi4pdvb6viIxk{#rOt<>w8T z^k@*?$YU*P*ojVR?}%*9kWZh{wqsJb?RJ!n#_oC61Ygm8@l4aJR$1YFNV}f-J?@ zN;>gf8-iNME$e(iRaI3a4Nc}gDG6!8UL=#EKFlINml2L2=tvccPhE4Wp;UZ_l+NLb z?&{s6M6?y9nZhe)e_mvcl)kDeX;YVzGgEiSsc%tFOi-ME@eD~wnlmS!^beK`?5yt* zhTD zgW1;W&a1$OjH%S?kPRjNQSQw@#O6oSPY57vS38e38koR4?tcnMNXEDd86C8TA zZjD_D!Vn|+(^ABDZVnDDW@SnSpJNF{I{3k*m7RzPb?xM9KReB@J`UY_StkqUV zU$m#Kc9_Mc^OD4{sy```flYsW3}}FeKfJ$DIly2MudXdJ>q)PVbB5j-t_p)KD1bty z(Hq?H{xjQQ)hX%%dud_kl}RJ3k!zyZg0B~`?9Yq37Tu36Ez&fyzXdHT zU%h%o&y}2-n#GUKN4wSQq-L#z$ERol>-=j9Q1%ujAcl4C z|Hcr%w(yX2&ex^7mv}a2rSx!&9kwzUY2F>uewTKFij>pJC^>N^FBbCg%NOW+!{QC9GmPom z#kI*AKestOR?A0c@R?=x@AnmNs7f*XWTzgp6EtU?l4+}WP+i$u3nmwkR6x9c-{I1J zY{N}@M}KG>T4(2{vZRwPMQGWVR+w+FAG@w7r^GQ#c%oe}byqW|w3y4ja+i6x^v^JTfXNVp)k=ybaz*COa!?lh107!X~7Y zGewOb;DiUoLnwt+ZqSM3s~UjnSC}R>*SIcyufs`I^8WgI)*4sMvsv=^Kh0|GoM5ma zgMnv%oz*ec>piX8yck@&ZGUM-z2#`TCek(MbbUjM@PrMZYJkesfg4&WA6V!%kiMFR z8;QcgJC&#RG5!w@|M-=lW6|1a_>CjH5kIV{LCf-hf1=w#V#>(FOGd`rH{50~-h_xo z?jqdb<(13n>3ed`xQdzCHO?w5e1fd{`KMSl!il|g47Y%_c5J1sKAG72lqW>TCdalu zE5mF3^?Fh4F@5&<5WUEVhz`bO^VJi9RZ##S>g6k3UojPOU%?9>2qOQ$%%DcFP4NWzAQ&SyGdk;%o*#7&@ za6dB4JMfW-b$r{L#U&kXQsn<=$JcMz>;~oTLxxSmzy4xEb?1ZoJG=8cWEhx{K|uy~ znA$H^`&&EZxR!!Qmt%iK*GA7-ot}P`O?K3Z?PNKm@ysEn3qP-FIb0rbaD=F^6PMVG zD{R{OJWE0ojcrzXV?p=5yLto0+vEYW>R=$AVqmM8>VbNi&W(_oNjLw7)U3^T?zR78>a~)7Ru` zkwo?5H+r+W^71>yz?-qPg7EA>MJRRZEW#rQ=T6SxIfGoB?-8|&HSfNoIP{*a)M=4x z?E46|HT^khfkB=vW45MQe>DB>BwJZVQVAu*fm76FeYi@y<$(TG5AB3*)mS!!Pp|4( z6o8^sD{aH00b;A~EieC|wvc?RR_zbFb2!g~L%zOV%&d=LKhPkM1V1WLk*C;H=doh? z+J{RYKIIPw*`hrv$8;zm6feU4hr1HXwx%c>GIiW%8*{7nY;Q^&fb1F`lVA?JTPgpg z*751SN^RkkmN@=VKDapg>0q3Zc%6aw1t{Cv-B3)(%LnuC*5ZGFID$`_j#YE6}G ze?-`drZe(wXXXZ)nyVk>LCM6|ZDcdvz)aWh$|NP`emiSU+hfC%p;nsGp&u@SA+kTd zPOWTP7`oa8wN8wF`DAb<_1z20$;v$Ejfs!AjMpD`@BV4M$BpOloEm(3x{dGD_?+~| zbEPE9TT@Ew%R*{1v!tenK@i5BIvM!gL5s<9ONJB29XXSx!+v!>+y4ew|Hn@Ox9@U6 z>Y&z+;<5<$2Kq8$V&8JnzJp z?D46>mD1ZXTeGT7OaAUiOLSI9c-5F$6(>$u&>n-_&}4d$uQr8UH?%UYKvSmX{6|9* zrL6IE`_WJ~2_DJAxWfk-{V`wi@G@9V3B?{~Td>5nUa2_%>jSH*8E#yq!g**n$ttfT zW@R}!zQQaXVYQ1pFK&vo3iPE#U^XlWKfipQktZ!xHdIKRoNOB`6_asjJY%oq$-5hB z$iIe`N}_fd^56nJ9GE)iKEe}nZUfHUl_Bzq&(Un6u4@r3o%fxg7ca5GUkjtKQc2!# zuPND(#vNasmydKiiNZL$Uite=osXix{p(MORTUH>q=RE{wfdu3kNrSPPD)G5U{Gl{ zKsd;z#mWsNvOwO@+w@9aUq9hgbgK|rH{TV{caBk&TMa!qp9^ivt_MZ>@sv1z|0~~4 z^yS^w+E{&=nMyWPlt;n_J6&4L!p=l`N1LM zH+(`^Yl3ZMs%Jc}S-I>0b7*K&Y+c;b9hcn%SS0*D^t=Gs7qXvXW-^4rpfw)u?&G0N zePOjD{3eladFvO~8?|{Qw;%5E4K^59#EaOz$=9oUOm}A#yZYSo`tLRqjha4%goK3Y zjmDT-7eR>)m8}!vfvl%Tf+B*j>tf8|7eR4`>X&9T?l)(>QxwMc-->n2bhND$$G7>N zYX~TC-^9elvz&5VG)glQFJIQ`b8v+H)#SOsHn^!{t%eyFkZPbILo}<9O;CDiIOf@H zZ|%IFXCJ`{YXQJC%LtRuUkrybv>HF&Pqg18tl93oL+O;g6{C@*ATNiwJ4WxVMiS0U z7S~slyZGl~xq#Ku!5OJmox)P=%e|>V@2t%1q${5k?6<)rg9sSfncE`WDKT9zXSH<~1aVr8x7AReq>fjgP8~F4hbZRh2 zGeCa9LIGJqWMPL`_oj|hrf4{^o@GAlrQXm-=j7ycqKX=__CaL(!u7#eTRW!yr04C{ z#0F9Rrg;{m^QHS{fCUZnh<@?QzkfK)K)_AAMZH(1}Xfqho?S62v`poHgDXLcJXq3@$yi`+WP*WsVHAGa`)9ocaZ3B z#op(Fe5dfQ*7_tkqTfsF?Rnl3@*eNH_8h%n^Tp~gNJfC>a>ZdNFJMVGSK)WicCKvG z85oL=6k<&|-nq)5ZEZ$@$S(OMIYVR5rcQWW%Hs{)!nbuUE-M-1 z6aeoV0}wU0gf0Hw1tlOC^p)G~P1YIpD?Z`xWXWutc*MuXgf*TYtem-P(&jVwm{AuE z&Qhg+CLrrL%w2e{2V%zqlU9}YlBb3oR*@NOKsg$PPW4i0yd$8^tb%{Mw;n9WymloJ z|G{B+YlU9X`TfEIb=|1=>#C|)e<52&^}7AQYm`jX?5arl5QHCFyOXN8jS@-MS=V*k z$Soa)YEoKKl#a6q2vb^HO)26c?PnO5D9mB-ib^(*FNBPEU!!H0yoURSZDf-Ebl)kX zo+;xZyOl6W)cqkVotyMn#iO@dO0)J&xQ&?gR!Jnfg?6~=LuBm`Xkr1ghHL1{lLCXI zxdCpob?zpdw}8V3gAo;tDY-OqQYW?NCdBQ)*fCRe!wB!S@VK)5oYX!4h7OvU5OG`e z#QSh(d7#vzTcoB!N7egemPKXB-v)^IBV$|)2Lxp{eMp$22n2Aco8eSZx6(6ALRMm8m_w;?r+gNrrk|TPVBTMheOBOz++yVw z@)`Yf|CG27%+$xgDG08jqocFZk5xXHl3Nh^I&N>FG?lAUR0&rZ%I(oXYDgoYsB8iA zo=M|fVd6V3oiRluh-tOt(928z9KDsc5i>hS~}l|y+FU>eGu6iMaJRxj9Xis_1IlXSU7P18%#}B zV9PZ^jpQS!?UxEUhtg)z;fkSmo|W2q7J34ss!XSxz1BrtRltri+28)4>Je!FmKfa$ ze1WnzET=ynt>trV4z{d+_cyT=NzoccKQ)9xoyDGZiwX-JN>z|~P4tk&YP27xc(0os z9&L0V(lLwG$Mf^Uv$Y76A%MWc{j7BZS=?u375n-X`Q64AVuByG`e9f8b!O)e>eNTI zXEgR49?07Dkc4aO7m_=yOx9#vzVcg8c*G>Pu&^F)sBWqLV7~W}i;U6%xqFYUAzRx! zWI{`KxAJeqa9wmqx1h!NI)^5c~OdtMxBBEI#+`y zhBcIWNMNQoXYPB%<-?;?TbcU0+5>6_9|%0YNv*W3Y*$yPie%WmtD`X2Tg2h7Zro6& z{?MfVJM+{UP{9GlMy!9cNk5?MBehCiyWg=!EqI>n?vpdcSQ;wNO4J+u) zZm;ztLj`&&f$8{f=Q_?|&cvVuQEfvaAiu=7zcl_)MsvUNPWBe4+7bH(>gC=u>U*2H z+uczbrB*5kgRk$3PM7{;Jb6P2DcaE`W?9}~uGAk=X7>`HUBCp7`Osnf^5%B;^*-HX z6%8tZnPh^EazkNBci2*tW2@X;tQ)_42lbI%D`U?#B1Pu;qg@3-W`VpJgO44Wi=tP( zfAm>s66e;blJyeq2 zF{$P~U)Ss#gq1u%zPnRqBAZ!q(76o;02~>Or`ksD%fhG)aC7b;3^8rnky)ZKvx?O+ z_C9p4DLP}o+jnU;o~ft6t=>!Ih-?s=INaW?THKS_5|Z72o_tJzNET%XZFal5n;S0S zHW3%{^^?f+y(IUosiV}6+^<-LA_Kcf$NA#|35fd0nbjOif2p(+3d(eJgiqWo_1rho z1JF^q?SR5Qvc#k*Ic?<}+;BZRqGzwcSQp(ud{Px-p9r0E@wr2^kUJOP-YH>HlGGY{ zr;UZaiQTOC^tzrhCFLnzwDh@||5To-S%(@z(Vc6TN_^}4FSEO^Ky@i}@0&^Z_2{ct zCAa`5nHPq0w%j>2z>DB)aphFJ)_Y_wNDpc#kc@VW3kt^3lj4Yp^Q3XO6O@Jk3O z$AN6lD-vyl42Le!}2sK_{@VEJ0sg)shK*KWoJkhf zTD;4v7{g=S7GjxbTRG85wO=m2fyhO(&>*;Fy>qx>6P%bVIL0aXE3&n??O^_3$Z^z~?+1kJV=V0J`^`zM3lM{kW>!xGFX}x+~lox`R%+ zrha+3!nR>SV|HQNTOy)Ux=Y1r>Ew^KTEw!`9Lj%8KY8>G^gXx2pQmVjYh+&lSu(r1 z#TN3UX_Cs3!u1#;j6;1jf$>VhHl<9M82)3ZY~?t0MDJz3ZWLvJXjUzF0{Z~Q55z?z zhY?-9+85OntiHdh2U1*jcz`C~O)oP)ODCohTe??g3ePLC!;Ei5g8Ls3sXi&}R*`;s zr>CA}g)Tgi%VR2D-*Q>sDGkFgEomkXtt^A89>+ym?^TH}2?D6jVjbhYlQWwsHmfTI?CM&PUm9KaVtt9l zx#+!*Yr+(BkB**oJOmwZ4N28Ufm7*AyR>?hHV9Y%K!aDXWZHh}>R7}lKl;i9t>O`- zDN6y3i|XT>Z7eSzlw>Ii3t~eJ(|oIMJ3N@tpg4%^^VYkf<;4aFVNHXX!euG025R~H zrBhu^&ZQu9pTlZ%JMnz|Z1p9RqYau7g@X;&p5hX`I76|q-lBXvMLzQ9PFfm&Xack= ztToO%KwMVXBti(Hp`l5e++!t#K6LY3b})B*EPFNHdqG#$B1?HNrTL zX&1s6>7>Pi+_co21X^6{4K^Dpj$K`LmUs?l!=(>JVv63ijhG9bPt1ELAJYj5<#=dq z?~VPiQwOb=j?&%v7kFvo74X>|(nFHP8&k@Fv`eVlBn4+B+vyhfGF^<`|4eZMy$D<~s1X{I?|QoJ~R$q$$~a^o&T?Hf-Ty>{9u z`ajEMj(nEm7%6!wii}>QUmz068H2N~7w68|UO~LMj?*JNNf5GU1K!XPO(9Jdr~vCh z#S=^|3`Optw7sBw%`mR@Y*p%2{mAC`ojzqNf+tfX^r?4)$+@F!CtTWk+Mv%9X?kf^ zri-^vImJ2h6C|8FV{8{5%xR>c426AG#45=^Set-Cg`ytjCBNThR6qf@i+ueGnaYij zXgiF^iV62lrT0?&Mwy@^=VrrC zJwJ2~7>8U*PwzQtw8Yc~MC5*zRXuQU?yRsHDki~aWzo9+jFHSjdY22f{wo6)tmkw7 ztyo^BQKP(9`f+QUEGcCMFK`;YdNkpZfW7M_=$ORFlA}eA(d3t@H)gt+*)p(}wIgqQJug?N5wJf1-VsNYiBWZ<>n9Yc5^R(#P zp-a-@vVQmqY4dkBfMEr&l{Iot&A;(il@X~s0{INqBleN+1gJw6YY%O#*JUb@>8)x% z<{(YuZ{4MXt(P&={rw%nd6|+-P$ZfnkSCG?m%egX-A~bnJh-=+i@|9&cw#xsLhdTA zXmgq^^g8W)_dd$#6(#&C#$xcpP7g?wJjhuMdNdp;%SE5v#qS03+If(zLRt0?qO){IYL3P9* zFPDO!ZdD{+54|%agu*8od!2qzN)S_qCkPvyK|QgJFOq+;84s6~2Lu7C&E+EiESarP zqGmLzk9g2NXJ5|dIwP=gb;HBGa(__L&@dWQ*;S2iX-{IdSqAvf2ZwlE9^Swkz%aRY z{Yq;`7ujAozHt|ySo`)xcBc?TMmLW+X5R8Op%nm)FX28sU4*N2HNLL&w%_0cXOAP- zpv#H;;m0L4`QK4G#0ZKMAAOdybNB?mXaxvLfcsjoO{-wcLk@20C|y@M>3QgIA1c<% z++Qvd5`>pn9ld2KaCqQm0Au@cxeXG>e|1NQv%1HIY)$REeOo4e-fDhCYtOZ`T>#-zTIe#k3pj0*M2iB^Rx)BxL}&<~-fsZv z7({6f=mI%=;~hTv6d(L82KYJ~PER&GIiEWNKlHH7d87X^3y{m(R16mB7~lr;3hP|f z$1_qPYq>nPf4pU?#r}rwZiRQ8K|#dB&N)_qy5^zIlO}+}8T6)DU504sk(IPsX_6kY zQAgc^$jd2}j|1}%%OT`N1BTxplILnna)hj=O?IT zYq0ecfsWt+A2W31j!oaE?^6~CnezzXR8ABm*{wAMgtrE10QH;2ep7zZ)XC&I->W%x z5H=BWt923o{o|2sBICbh06uTKZ}4fGt(W~c>wt+_8yK|)fl3T{j15k&ycx@ur@Kk* zb9_M9KnZ>9N^aBaJ}|)N>}3$D9$XDu9X*YF-f;!Gg0)E%_3@Qj8!O`ekaE}%E<0am zsP>n%`|5{D-3EneojUEfb22)8IHgJR+s=1YJQl0dV*wZ~TCX)epD@(-uRzUe6$_NghQ7XBsg zv8R;o4x@GHg&C3LDIidu^Y-$vl>jJ^dt3Rf^!{_dkYkT@E#64NymXRVd4Ow3c>y8D zkPeLD&#_}D-Zjuo>)Z9AbV<7adibuacE0YX+Q7r6(|f1$$MfNmgnP;xfgE3InrEgdZ`WILfqsuUc7Q=utX=_KOjYM(1mw9Qw#Yl^(Cr! zKaE+$`2|+Hi4N}e>JO@|NPs1wIP}Z4t|j&r6_0d?swgw(0^|seOlvJQV+WeKqLs|o zKK945;}zD)`|qD@*dHI!i))Kx2k9H5G~CJS14G4~r<@9~#p>YNj2-Ow_KnF3>ngiE zog$Sfu7)#viCEkFvWVzn>0tB2^=~`Ne5EFfTo|Jfx#tJ=x5<3KMdE(ZoSHJ{jrSMD zXjb*lR<1Bu2~I0X^%2vW4WO0S2*QPOd0p4NPIyyI0da@dyvxl=$9@RhP4cKt@M4kS z7ST-r%}N`xo$Y_F45*GSXss{^m$+#no)omH63?%V7JJ*sZ&*d_v3hTLxT5UbQ) zTReHRNPhN>Mx_na%0r7>#+*$3s(5q89nGS8CQ(sz;qvk);*R{9rjb06S^0KXU0!Zh+Ohe~LtC-4RwRX#=jxLN(kbnSfnDlLXPHoiZjzPSIuswlx=5zsxJOI} zw@Qz;1=H+M8gUOLBkI#i+cGVrqZxDLI5hgAOL0H8Uw)m3m(LKqC#{0Z2~$TKtpk=N z3(%mroV_y!;~IWJ5_9C7r%5ZEh2Cce3w*3=94nMgPh~AfDiM=ktHMunPM4M_!6>QL zW~>(4cyP>sRBKFvCFQ(*>%7#box1%q-Bf7NMrv5Tv1%e+nk`yX;I%%Jlk``MvI{ zU(<{@-S8`B+R$d=-D5jI4N>FPJ=l3hpz3`1%W00Mb`~|5(N_ zs0-_w=K$oODixvaMPZQ$ZGHW9$t6_STRL3PQ7or1lYP_n2gHk&x%Q}17hnZ`+VTus zt6;9)zR;Cv56Dqw!>jJ46LH_af4Z8gM~LU;Q&j*Aq^&Q5%lIU#`~J2_CqZ{i9>m%d zK;AnQgRmg|b2gIoi0%6ltO}SV-k%#>9>Cw`xoR>$&?}>#V~xT0lY9&ivd`2fzeQC%-S2Fj}zU+#L z^V3^ceSe`5B4Xs16ffMBc;0zgZ+bA90hIT2pD-hFYv95wUe_EUU4Q#aaNwgCFCg(i zH+1>x)s+1(E#4*v6Ilga-HPq74AKjTDvzd9>a8DbADC2=04()fZe1 z4htKGRkS4sb>@}!yyHpCa+sB=%_C19ud{C&^Mcwy?l%!JZI=b8ZTD)WOUMGwdUZ7e zp@-W^t$;0Y8OnHx#>Fp`7SUX!@#v6FE`Wia!Z@32lu-5|CgMIB~&rN3MqEuyZBeqq0(cg+1GB|yEXTY zjNs}tdb7Aj0l=)Dx}0d=#O-rjBG&{a=M_lzr&ixm0oKt!Sy2hCbB@kZ)On}i>^33} zZn)9o%Q5;>J`wi1jBIy%=g?v!_}T(8wJIW`^<7AZsDc#J_R+x?*Dcq+ndl#BtWGf> z;BWbD$K~z_*xXGPt%$uw)*(8-?J#gbFY$2*5MaQyq1A)JL=Xm$hdWMLX2vH`S|$G< zVQ(20<@Uu5A2Cru0Rd^0Zs`tD8bP{2N$Fz5&kdSaO(+kXw4^b_(Xm$ic%Ash3U-V@?KpXS2IzqWE52b$A+v~q~ihiOj~ zC#FK9vyUebccvz4%2OZe$k}$oK~(k!J*Wrrlv+3k1BN= z5#c)*5qid?ub-@OMqB;(j~o)nz?#FbxSs2gV$Q^9o?>vFP08CsjZMuKsEQ_zoyNUs z;!+G%hKbJC>CMNpqB5(NQ&`mX)Z8Z>B66DDzkm0sndFHxsC6kY+0H1&C7(iU#6Id3 zDvYRyWw_*y(C(=C|AfYJDCBC~D;La?oqrYgdvaJnCV8~j%OgXJWmi4PZ03DYrb?R& z2-*|QGkb}7+raY|QC`s#e83_deuQ0v;I)PVKkvA<*MhUEa`XP#F$Ku6!rYElFZeN^ z_c>*0?qh`)kiK<*%#CDQ<@Uxc-HKtjPUGPMNm-O^Mpl4q*qi9u%^JNa=nnVnBAxfr zY!*pv7f@@JcoeqlDJ^`F7~?S?kZ$0Gs;eqX?TB>a(PslxD5^-xi*~;AFad5=bmfZo z?7rmmxNTJB)I-{x1%((BIq2XxWQv#-GS%;A3?2Sv)=l;2ZuT1zARkedin@%$K2?b7 z&ByjIM}lFC0t@7QOsoP6;i-%c6&hfNB1ROMm1DW>nJiDu@+e`Rcca&`sgLTve;XQF z>GWn?oR~Yu3rEWFg2l#s>EO&vCGwX`W zxAONFq-AZ5TSeZjLF_mRVZ^9WGR#+rq!?&zcDd^-ToB9HqCpA7Yt-bzjPoa_Elo|r z)4`@@i_+ra?{YGn8K3H9%3hh7osFlKYJtmD;;PR7wdbTg$lvw z-U{vPzN$WNs70~&_ur)EUaz{QnnMY^0$`xP7pAY$g)J&WQVofvLYh~5C!3m{VPHv> zQ@(s1AUn5YNPWs=OFdEB$BDn-xl%nli$_CG-}kHc&Fh|DK}Ho4WCL3nj6P?rkX|)9 zWmVC~i}HFw?i&#>zQ|9|K~WvR(gyH9WJ+%&&!%|HTox~M)PA)ldH=FT4Qv_N>a8W_JdYug%s-y?=Ul8Nt-UpeM|l<% z`u@frub>O_Ha8EHA8b8kHRd+L$fSi0TPI!d8&a3PdgjS9<7D!^_mLSzWIXYiJNsjq1LI z;_of1&WJ|+r2u+5U=E;KafV6Ikk-8%_%2ufQ9yqb2~$~3Q^*W2QOi>=mu}Ms-y3fx z1}WhVQLfQd48|O|36sWlHQV?L$24(FQeIqbRxrzjzOWd2PLAJ(d5YMdFU2v?S`6~% zrw56>6?;kLC3ai4waORR?75RS=LwU;0ERUt+}X^)Ni9G-R0wxj#Gj1?SjZ@k4BF1x z9vfNVVOwTXgrlwoVlCOqEkBF~3j)iy=h1wni?v1D;NY_#xgQ?R=E?cG6Yd|gOv_wo zcI^T5U(Er<^%>=mbs+z8`GV9>EyZCX;#re$+pJgI6}QZ-EW}x?FPfeN4cqzXJ)XT} z&l#og!+Di27cJtp!v+I2;WRCh^&egCvNuJ-Dnw2-xmG zg7)?2HSl`?jXr%T^l;EUXf4qy&qlq%W|{_o{0lY>)*%o1ct8Rf3&-nDr^&Q%hujit zsYoc+nm3TbSmul)#^dst{T2Bv*2mTNq$nbR(lO}yTkCny-CNgQZdOuY=v%DN$*_zG zDe*e4c18SrdKFa%n`ct*sIV5yFomx;SQaI_C#r~0^In`B4$NS>P5;Xrz&(N|oY$fi zVn;?w5xJ`V9JH#Vv^#^rt>bH>jnb|=v}oeR6z?K5_Ftnl>Fs=-MkO}Js7g)_4q5Vt ze0;X0O)PBI(8+jp(F^tc=#Jr=*7eSV z1L;-uUqkC4#9bQ*b8eiL5MPYy{e3e%kVA(K*t0}K)W5wjF)``jHEJkz2Q|^jYb$(S zU1zE@J0-Y#yjkReJ^?L*9JvLM-vE#l1nhd_Wy%tNfi);V+!*%r=eIO+_59YNAWb&* zVtZx&oN!k+H-Wm!jEo198#+T$sxu-|Y~xpB3N#BK30(P1yiS|O!5YrUtN?z=&5^p% zHu0RFcaAC z(581fU;MpysR11Lyp#*ztG^!!AD95=M?MUBYly+U?T;aB_HMlmw%%p2GAD>Q3b(nZ zUOrKI4s=&wNx(ZZP^}^rCuEYlAqVy=XUrKZ8E{gLB8xePCuWb|z^;-LA>r>SoSu*oiqFUcS8I3Hjt$k272-5WprV6Uq1^gk znfl@?1o1M@)Y)INRtanoC37CU;HJJs`7#JxHTbjl{B&v=F|rj>qH$6}qvJTu~UNW9uYys2Jj*@{5n18bM>YPP(N^-4^Nw{@fz?s3$5f*Ix79~asj-E&#LTOSA;Xl zo-n}=-r4C;_#V2o+13{A5-kKmKIr+vws=hVIkO%<; zYK0&VNY>c|$vW^tz4ch@g;>w4+gv%vIweBlmFm2-s=6juGzbY7WtSi)2lj!?%v`F&RFL(G zG1W{7SI&BhhngK0qV6urpOIo0q7DE1G(JKY<(9}u(1;f5K-NA*0w!|^CE#qKweE&p zZR%19YPU{>gzPAXh=W}3M8?PK!ijNxioqIerB+ilDzaxn2Kr=28LD^bixLzw%$5rL zYHO<=e($K0DE~KTM@TsT5n9zBg|mu+0`d1+V94iSZ`-IrvmR+=*sJBf!c6Yy%iaUZ zpH>*?H`9FJ-jFpN4bAFN$$VaZMO~CXUSmw#P2ssG8{rVjEH6qC9z(==N^zN<)efdn7mm{Zd<%pRa&-AM zlf5?>gbO_nC+3_8h1z9qCJH#q(kjG#*@XUlTiaal+!-p(}5JD=QG%CU2RmY?K(xGMG-rhSqrQq^X3sbY?~cwDL{)I?J@zh${@5!K7pNg z(=O?+uZviE&2TtOJn1mm_s^;dQbU66Bl zA63F~1;10q*S&nMkpjwqj>RyWvqAF_;9gjI4JMK??8>|ZFSm%Z>YAF)NiPpABgKai zh{x%BvY=Vp25z$XhT3E4@gaBt^x`%Y4D4??F-iRuzuHvF#VDYaYW069TUjL{MSg!j z&V23bJ^)h@JY285UgOm}bxOTk`u<|l0sXKv48FBUG^19gC4X&F($l|;=Q7v)c?GR- zL(5nJYicQj381%#4JD36lt+O+%Xor)A}VFM4ubIkHRH0il&KQ()iqN`=9tp?7v(pDF*vYOZN^VwtoQJI+{dkc~N+u@2l?QtoDtz>+p?Fxl z>H9N3lhJKt$z<%^C=h9J1~tia8~ix1y09^$p7y>;DrllygMdYkp>}_PRw)1fcH{h{ zikDehL0)s=w{5T&v|e?2wA61G?6uS`ze^b9)Dzd0=yqp!-OR+St1Tt8*dr2;ZU6;R zP=W{ujbLA2vk7P7osVL5ma6nj8&pygZ851K?8!Ga!hz@7-ftEtTHf05PS0S|Nmtlg zb4v!Z$eSb6{JZ0iYct41A4$#NWg3bd{vf?PbtqL6Qx(m7rCh&5CvD}8F{|bush5V+fN-d&(H?|XhR85 zpK;7Be+SWGhII}UGUeV|hkgSixAgTa=U=V8KKxx;gqov8Srn1W5++M@}X!*^XDS|zPz8BFz|JXE#cqvcMx+3DWM(1CHt=BRYMJUo!>R+FZIh@y527<^6 zPidFlT!G8r65d{tcpR*^#gEv`*v0{?fV>!=0Q$Nvcqj)CBS>i-|-!)fc26C0=f69fqT_wgUW1d{=ApcJa_ zjtqZIHQ2kPxkXgk=vUkq*@zR9_V-0};U5nuz-U5f52jt(U(18pCdYfyK&%jnD4SIV zhPZ(xGuF4Cj{`4ES1K-`6 zNZxFeTqtMw`z@!Z1)-0HJ#l?(0F!K0JkW1AKa-MCRIKE?iRG@T7(~3i)};)r{Ain0 zrg_9i_4D$Vqt%v`&>+(nE8{N`m4i(@>oP&AgTerWe&Z7&7bmw(5{MKk!9dfmGtT?3 zH?uVA&#c_PE%MxLK%fK6Gr!0HotcWJcZY08=z;ko92g%LjK)Ba+YOQ3Dxs6#SGR%W zQLZDrr@A$Ib@aKnWT$AYnJPQ%yiVXbEmZWG%kz!TzJA!NXSe51GXrrvRuEsxCtb@O z0U@1f6~|HXsza6??-1syAIiF(xfras)|y9|rG<+d8mCsTHhc?4N=-Ii8BUDM8$}gg znySHlhf?A5|tR9+jbbuGHX{S`;gC~ zSrGg9&GUa@ls^qrh1^#Fj^gI}>ibqk%bi94%F5yLy%C`ccD?+sblAafC9*p-Rtt;| zdh%}hVE~b~8UJhQ?NS!N)tl9>?xF~Ar+C46;C_clEj$O40dv>T9P&>^7g6q2i^+}~)%y)HXRZxN zo0s3EVRs1GI$K}p%q6hTX4*Dh8Gy;LxdBqu`1?BvcVCz#PB43+3W@S$u0%_G00Dy& z90=|=f#5zfrn}dL^v}fOKM(n*3$C=hknMhrMLJC4oHYvUSf3o&qOFZtxOUkAX!pgi z@Cvrn_t-Fi#+eD10E}n1sx~hu1vxY*nVVq98;3gTwX_$!0)+ zQXI|W$I2(CaVx;eK!=v(^vRFDW_=o`Ba3oh$6wmv(Xr zB6r^%+0vo?l9Kni+qV6jJVsG6D4MKxuY+XsE-(KsdyXg3sP_|95J0wDT?vtW+}OOc zSL-yYZ@gy`x!da^bosZePWXvqMwtl6O783#C1U99~v6-_Al?r{2@gEm8t~io`Y2EzszzU#qb8wgLw(6iT)4BzM9Kn7tl({m6A$P zx(TvET8@^M+JNnaQH3tl86k1$8lkt}Uf|j}IDpD~iny9U!^Ncwx`bu`N?DZ%N=iy< zEgo*qm#$RGwlqFxU!E*2JsW8lWNSRjR1Cyt$q()91~Is}xOnpi{FW5FPJTmS)!1Kjc< z8omAV2|)jaod@Q73Vuek$XCBcHcGap!El~2?}gesU#6~}BoC+YWZ`3Kkw;JKgoM{y z?Jhr3c01Qp&v@EKf7?uPnz$~`v;=CO_V=@Mm~Bu95G5g9Gq;DQ1J^LLTLQ=Fisghw z*piC0Dz%cm=YM>~Xvp3PDNzj|EaWEafh-CV2WW+kz}dh(la+K@}02l{DgV$dl( z*L035+e|1D8C=a6Dx7>(p680pz%-(!rXH~n^rY|puL$jSGK|9NS$2;72l&2>(qeBL zK_8=Q@Vnz{ukqL}(NIeuAzPI5Do=ZBa6$nOw@8jS|Ef@t2BR7?-D0mnn4ZU8pzOx* zS18M=tXXez#OG=GK9oyA!f3r|?GPL_A|auYA#)~NlSH5KrvnU9vhM2ZM>)xhFg*s4@08D7+1VV575Fu`j8kfv6o*>!YriT>`J z93G<&9mM5|IEH-`_Sn-}H#PZPs^}jP5#biU7z%9=0m0auT3_E(%O653x|0PB!2L-5 z`d8a7t1doMWKrCP`)iYy<>UHhml(hPz9g&6K`bQejOXA+ zGMuE+VpLv)WJ@WlkbJMh10>;>$_K;cd~2K=p1C{Kt87=-bXGfVwQlH0HMdB+jAXnf zBidE z6VW{UJ&WT4pznHp_d^zbCq6`l|AqMi|5Tsl+Ygwun^$zoEeeEw_Ze}xtX<11a9JmI z*qWg^G#()=aogd^tAF!3Z&)k%KOU-0yqLqbiG95}r1yJp0=G5wY{Rjv>B;X10F`I~ z|9So>*rJs2)VBt$(T5o{h9IF#YKe)78P=<&M|fn8lB{~N;b{`L^>*+Dr$)6Abgi0p zSph|G1^wZ=*ejQw5f)~kw%Le>wuIZ#pvm%=TI%$S&U1jj;faHJXRyr zI5?k|8|LfW8g;xZd|}5M^-^uw;J{mzZ;q9B{a4KsqohJl^KKdEzGzEv22mEUIll+o zfr5+IJ<$n8g!AR4#b<)*=h|8#1n+2+0|YC|Bm6EeAaBK7I>fB{{>=io7D6Uy4jFxW z<(^DY@}%*44c0c;9WMvICZwqC#y#b)VpqIG3dP-s1YO=0ZcbE7fvZ~cxrxkw5a{jF zsd9_h4zxV#k|CtlSa)vyjtLcYmjb9nK98E)9w56GC-v6G_%84Js}3&uQD zpcHjfe*XAyXDE=Hi{LrT7;0)hQRNfWS7aKzVp=M4baXV5WDwouvY7ZE?~@(N70~rz zViz(Kvgw003h6XFtO}sL&b0d_zWwdgt9fv6R$Ha-^2LRA5!ZBebsZq$jR|ucje$5mUozgtx!*4Z)IQP|tjaW+vHfp^I(hA!tEkG|TR(jG!vRFBND*y3xE^h$eep{#gy*XpD zz0G9H@3{`5f8@Xj)1A^N=CU?IGaYiKe4CJU&W<_wvcmWm2Cvk&(NUUB+Fd4%!XVWm z@^A)zHpO0fuzU2f?h|}8i>HxCe2i35Aq1!k)6f3-r^8fyXyi095umx3SH6ni%YvYhX1{kBtt zFkc+M>ZbT=HjAai3TUN(jhs}-RWsM`njAbHndwzKq?{$6+C(T|_cP2B1=sZRGEE0@ z@pY#|dEugsm7~UFczC^CiPeq%HTz@bBu*Z7b|%Z78aJ2wzSQ#x3ThdtXrO_+b5?!Y z)gjwRqc#O;-y6=E(OY$swUB5_Yax&%Lq!4Q(`BWhAqr$WqXRL@a>Df@y&?Ym{lQg! zZfrXTZ4};sVmewUriypjG@^Ic}cMGA;CH1%sd+%O`& zkuBoQrb%r;JbZZYplp>_ab~8cv#Y3%h4E1;BW5pkte#8TT6~U-O|$SC`4AsJbS5K7 zCV1r$%ujQX-;LK2_fpzYi~!`a3Q{s@6nw@w+>r|<*DG~Jp~xDn4rS{*)WFrB0jxX2 zknM3No^tzGZASov7m!5vDYn$(;^JnwmC`CVc#f{JrbIoQaBk$s(}(z!n)P;oF)iP% z@ni?(csF7lh24H&sEWHoyo*_L(jPs&9JAC(#*+S(b44{_}H%D8rV3PNUGh%GFX~ zhL@>t*J0E&G#!Jz4U~eAjiL3GF>UTV5}9R%C1WqfjuhDyUWd6i=+3^@@|-(-FRtU{ zoo}9W%9QZ#De_X0^*Ln)2?49ka$p@cY7%8iRIgww5NUlGgTeWS7c>C9R zLUNxi2%y&lJc43aYSS#?2KK~?TaxyKgzf40OCFreUF_~() z;aOIuI1ffS)ar15O8a7Rv|HmT0|<#$C~a3-PtFoylpZb6p<5oP_PwS?pW-5}{r{qN z{|x2>_#>5XB1os9^e?={yS0>3jK;BLJ67gta-0jej2y;Napz!YX6Mji&W;IFAK**q zsdHel!4Cy#Vp1$v4*EnS{FP%bB>*V`S61T#U$Ndq~zxHqA-{&1$Fl-uj} z)e`W&fMv>rN%UV|eb2+ZLZ^_J>v!XN)NpSCD7qpVy%Y~0Qa+nLl-}DErO#6@0P`V9 z++Zi3q6nQuQ+#*iTKvQ(4?cHjIeTvaex7qoOpM0I&A3U3qm#kd{dWIvKc6aoI=a9Q z4oas@{x^7#+~f%Fyv?mSc}h?;6DR%iY$L_2*0fgDZES4RPqm}KG8s#(FBBJn7T+X6 zY%SIewQC&rDaoU*^l;aJj&xf=Tyz}5pk4OqF4%HF4*e~nWy5?c5j1&9fh^X6+SmAv zTA5F^wl_Vuc6Yz7XZ_LPgdV!WLcUd0Gf@ld8Vl5GB&aDjz8`T^uGbmN3+B(Kp)(*r zwKOs&2~3*P>_a2i#+%dh(?>B@!84s64Q0} zL;Im#7tB+j4Q2tB1Z5y*19`&5LMQDJ3nngYiLv0D7!l652M{J*(?@Su0)^*KkJK&h$PZB~oZ_L4^6CMBNxN!@9jS`@b$Gg#8g0a$FLbh zXLhM~W(E>wDy83O9lN8*@3iz4WG=tJ?M;bsnD3OHtSN6{F=%kw^jeV5x0g9+x5cy94sVX|QEaVzi5>vsqcdiIPW7IZnJ(IY)1}RU>PYW#LUhoU#eqaMt54ZdiEkDEPFI`|=Ufu)nV%D;# z1DDB{h(_-%F0W`-4lzKSR^AmzFoQ3ah~i= zgSx*eM7L@BLL79Og|*-KjlTbCx25g8ZnR|@n1z+$+(nDMS?qL3tX2Cu@cl=!D1c&T zD!=4k9)Q(9V2yO~$%=o~JLLker2zn4(8A*jq6DbJ|EXv=#(TDoZ5+`hRshVYkt zr#&V8QM+3CIwodeWLC-rYO!`53|>ywOdcxt)%APKUk?sk-B2jVu3H=S`a13r4Y&ep zH@zP3oa?>{=4G;AX$m8};U7Sg$$IDPP($B)b`k+^g(T^3FVk&mCCI~*g%uaNPvOLs z&{J9^3biTM^%g5&mdD(i@;vrZ+JYe@3cep4q(hz;w1MoCRFADpUMH^~RYmhnp;Dh@ znN4+6l^gF(d+UG@TC;KHPSYRFuJ6gjKr5F%T^nEq zJv@Ap^q{Zqx9>f_RpZcwLwTc8Hk6XdP^gMSVjmk5JKqiw-vS8sGFCZ#@zUE@b=lSm zV>n$(WA*#~rYI%IHH?6%m}y#DcxDFR=R029s4d^QADWwPk50{!JvZn;lFukE_I>FK=k0b)%Dn?~{)W?+t-hqY;2yX*6n)8~;mDZ%0U zq9>|sUjsgUDog6jrQmm$A3icDg*f{`j$Chs;fHLFA7%3R8F#h1of+AGTj0s3VE~!4b|Rm7O=6Bs+=$BDe#K zK#^2-wD;qgv=w@xk-gKuQAVpS8lx*YHIS9wUwu?1Z#ra&PA63l-8MYOh>_z} zjoO2SJs3{7l{LW{Un_s*ISavJ2U`_)~+W2~i`z`@XzPqI^kHUCM$- z_o7m6AzQb5Uv;+CQ}8MD6uz}z%~+ibetgKY%yL}T%E;TmOL!;%Gk(9T!vnUjwy)xk zsaC?}ELwV(f?c`7X8d)swiG@Sm-prh5z+(p9GaU0@3?WkNuz{$1D*zLtMI?_O#EHZ z3Au;#7jfvqS1YnoJm0RN;HssMcXC`U8ln4Rlfyxkxvd}W5O!5ghg9O8!74z@jKj;z ztCo4;RAx*m1~R%HY~|cN^T}8N0V21l6S50O>o&6VT$TrDv>FV{b3P;PYwn^=Q`1VS-(@$n{lgwl&1ELfrl;1-daH;`?o0 z|Mp8*N=oq)THOZF%?x2dt z6p}<(@EIdZdpLDE3S~?eHD(>$L(#d6bSKnlXw|dggG413C~|;Z_Bv@MSEw*Dr}fwM60UL#*A% z_079pFI4X~GuOJT|2-Cg(R^;Te;Ta8I_+Hx7hO0nSY`B|LUb6lfGaqq@o0O;;r!~= z`KA6@fw;+1;MH7I-ANWCEE-o6e=5~$_yQW-xiRUH|KjUMuam+ui>U3S{2HsCiRrnf zP|5b;X-|-}OW(&V-u;35(>ty9>|#(l^Gbc>=s#DYVgCShse zTVB7J--_pN|2cE=hNApuwt2*(uQH9P*jZHu_(+abed%A8!<(_k?_<$ zr)dY9BXn?)v0`L)gLP=rZo1*>_R_3x*%o@_FP;uT6t}gJuNSrD8HcPu_xF|=0B3Fl zkDHWrF|r%2rx>1e^|^9-+yP!Aw#7ygdCcw>7zecbV?XB_vc8QFx>u7kyJseWsStA$yqm{FV1g)%O&h3jceD&d1B zX90Osjt=WcEoBP;Re?NEh0i{r!g&!#FbTm5&{ZCB>=tOWbPWzxXgz-Xc)ce9@WA+; zF(9oAtid}PT4~|4_#TxVlPz?-J3BN2Zibo$lT{b?h(k4)Zol-Dh6WvuZi&-}4ez5- zLgTeqwoLT`;-PY>Q1U@%QL10B+*^=HHN^ffh%Us%k8>#6ZOs}^){EF(a6}{zddMdU zJY&;U-aMN4nN2$RUYLJ8}5ljx6Fs|jjeYeVG`Tf&xa!A=R8?d&mQ39PC{TU&IZ<@)!V8xa)H#DZaa zQhoWCRt;tg2m|*(-sfh(bD|}M)N}?sxXVOLn#%Z5)cxQl zs{u^H9Gq7_Tx4H3f3wm78J~xF>hN2iu{g~dL~^p>r>}TS3v<|A zjB~3TR?^N~gkGKKsCJxR%>BjTwadse&<&ezEEk5LgIEGw5lHWQZq*BObBVQhN3hg& zkgIG`firQoKOOnuX~;Jct{lrX*C928f)ltU_=&|Y6is~NzJ_bmt7r85Xp+C02bIsr zJ}n1QX)Fk-rA)xS1r7(qL$}j%LK=gHyyKxrHUo89MbdPz*I-H%IY@m9`BpbgC_ORin1;KlcBgRd$rl5w39Y2}iZo++2KyH8RGdYDyT^Q} zD)|J}tE>f-3sHTx^DDte_Fw=?Tqsse0P_A;KHv{oz)1fRUaYB1vm3~dx0;i1!9wr$ zs~G(LEc0_?`F%in(0O*s;6JrdN45Tu+M;j)UIg8A1B71=H6&M+3%4C+Y&+PPLUV;i zPBwvurQkheROYP06z(3!xd{=jOs7Dbd(pYvtmB8GC$2z0`SVoyi#Y#ewxKS-+FZCk z*yQQen#PMng?+V%>TJECZ8>+a72$HqNQ(WN9}rKn@`qESAzAr8xrd@t{PFXjbj;i^ZUMIT(Z#A>@3ZVICy_; zb^k2vvlv{dIvuPv+8U)N6P>W6CNA^hk(z~9Y?^fsU}D2}5N%I;g=`3CyJhaOq9zg- zL0A83yTQXFKsK@3aaf;9AF2sJKt#tgxtlix!HHwCl^0@^ z2y|5)JGb~GmC4<)&LSftgQl;R*k{3ZrcE+|+{sM${f$SAzY|A)W;gj?EM{!y#z6B; z8u}z)zsJT<@9vT1vkdbHN#!cLNBj=EvE50>weoQS&(31cD|1?eda1wW^noq@HnDb@|JD#2a^7m?K{~6*+nHKDodq zNqb~3_p*EfGqV_>>eQ9k;#-ctW}?D-k!l;OgL*D& z6RW?G=?W67djmc+ASav!9($h(ClyHFaNIgq1o23+LAGCH`B--VSb4}kJ}5{_N7vOT zr?Iked%iP+H|U~m@RV&B$9oiC7hFyI?x+jb%WAq-MfGj=OHo9dC6lG`dJ-RPNO4#l z#3)ZoXJ|}=2+cG%6$Yg=P4_`QD^akWidna6EcKe231m-nx8bRzu#r|I?nHPhmhf|h6yFl*+BE@RgWu-mL@xEC*$xAtE| zUrzL3kc&)(-}mCtxwbO4s-#|^&oo}SiBJLI7*$+P2)N@UXoft%h}}FsE+-jE#5Ua< zOLMxhNhJ~RfXC0+b$5F=asf`M_Hut#G^HW zEIO4y=XN5OLA@*Jd{ox7s%oUGEBly9t#_?7x7hTM?L}dmF!cCT5xuP@c_k_)g>d|u z|H8>KnQe1zCd76Orz-jz=rHHMoGI#B#x_CAZ*2kEAhT^!@A>+JnDIdExBSq7dq?cY z6N3`lB;IC&Ozi9onDVEdcLYdhW+Mj3y-X&m53ULK3^q0Wn!btReTJf;rVSuo^)gY) zsgb5R)opM{YS0&+{nBSQT4i3VTjwOx8HpVRHoPv0K>s`tiA~|PW7)$jVPw4FOL6Gt z*pz$HNOuCsmk?kde7wPgror;{>lNB!!LsE?AOfjb+HKqa3R-$@=I$HoF3ItY(C@Co z{uB_(mL4T0CCzoQiG1!*F>O~YU0e#z#wNRsk3xePe~agVC@lo{I>r_HDTO1RMOX^zTgvHhlGHjZm#>iCFnz$Wfs%-DXtO0n#6j4ppya^|FO< zkf|jwo7zOkWo^ZqZW#c79(zl)AaROUagY?wuO_8nXlG8F^=SCkbBUzzAj7UWufEjV z^E=P)GL~*OUF59!*$80hzvG+7ytSIs2jX>$2=F7ik(j3(?){+3kZJb32^x)2G8A*X zEA{88MeL^w;cqPZ`1SWt^htDCA4|_>P|wc+wQRf^)W{srJX9pL9uUA2MqJD^HSYMS zV%`%q3}#Y#Y*HL-L9ding|yL83VaWiQ|zK)4f?!1*R9C?sXCJcWOPkh_`A4FJKBhQ z@w3RSMxKskVUgn#rd9jKhljyxyi6oKHbcl!(cY+n@ruBr&``j@GS#e0)+HR0lHyc- z#;{PD%Wi6n)HK>!0GzwcTtTUG5lxqRm;WdFBt>)g_XT9 zJr`1JOF%5B_4M>eDmON`3}-;ncp7fk(NWfKaIFJ|VSDMDpYb=Ud+iOUH;ut2j*_Km zni2rtVcrpZd{1b%>SXI!k%%^5j?+B%BNhn{;80YVs*R#wdA<-3s)s^wpqitAD-k26eoXX-m+nDSC2t#>nds<%)m8I%)4_7}efjNyE#%UN6eFNmXr_$lp^RC z{)h{xI<2C$%Pr8aY$uR0)10&`DFwomV;ax&a}qFuTI4?58D*Q36&~t$Q;;WxFXph& z?Y|6+>n<^Du_%pSc!-0;urj;2Xo;GiYZ#(dz2Dw~F%1>eUqKWylv}FxmMgj~$R~Cu zA7?`w&hG6tEI5K)Rm<#{nEu#pxy_!rAXH&By|OY}gf>~UC^Q5b>jjHAgS|3MNlq$| z>ml;C1!i`7k3I58_SvkCQ?DAi2ubG)H6me&X_4%W%dkiu2 z8PFAC^kKsyMns^62jD=-0!A8W_+m}9%lq1yu~rOT%&Dfnx)R5`d2bR~VJ%nxq=Pg& z1P#of;f$;rV9eKBAxBf%=)t9GD{SAw=? zv)grS8y@%cXb_UYBt#ldlf&urHofZCkMd;-l{)-8xU(v1934V=r(HXqlw`@O#DV!m z;bRWL`*MINdwSm1Hga$XejFs2^uB1E!`*<4fHMtx4k$rm$(9 zlL^_%8n8DAy_OKV*{JeD60 z1H7k`hiVFyxpis>v{LY2GxN&~@C4p|$B!Q<%E#1NTD=P!N1+Qx#UYf`Q4NdHmrxbX}kuI5Fs1{!rg8a(%z zQZ7<(o@~AM=R3Np{yJj?jAe0lX5MM3L;mSO6a(u@{HmH2-n#JV+MVqmJH4{$A5kqJ z6v;4nPRaYMTIz6u%oac6{Ra$u(@XH(*2GO;Torn z*k9HQBzFoCkE@80&z>KSMkh`TyO6KkIw8dH$;6mTzc>BaET~a}(cBEkt=xY5G$`k( zV=)+?kSU$(*-n&6NP61LyA-73c-AT>&W zx?XsA45ee7gk#AO7$5~JabGtDKM}@dsjE0vVPk5=5fvV}W4DBp^c$i3%0eIVv$IwC zL(uia+#D#_AKyfy)K+mK_kh!HWp)eiv%r^B;s|%vS|1)dtkvOggN0KDG>+WyDaVPo zwxs$!LL{q2_RS39x5EC1SWl4LzLniX`wXJFInD%CwL6jqEdGgt9{O!_YB{jstYhbB}sNR9b0F2`km;?C&Y8$93n2n=#{Xxo5Rh%H=b%@Mo?J& z3qvlZVCYV==WT+pEB8>JwRFJ#>a&{`nL5jB8M4=%|eTBcgeB?L5q3m^&_|CJwBf^W=4j)PIN% zdJVS5?dT@6TelgD2=_-^a^dno{N^LXxg?Q<*evaB#6=aeFvd++8Z|@$_0%Yj9MIX! z_xs%Ig3Qut-AP=#@sO@Sn>$8BA1dNpDzy8`02Av@MB|w@y(m06Pqe}p=;zTx3_AgI zzS6qKNtli{uD$~(4b#o4wf3ENnadu9X^XLtdM?lN?oQ(&dA9=gL=ylnVrY4l3SsW?{3 z)G7;fxk%AmBW#epruxli@iaqKvmoj`LC9u|g&NZsb`01JwhCChLRP*!rTTz;U>#B~ z)Mpc}oi^dsM=x(MuE?1V);_r4yY;DKv*VmqmMt=T8Fp5vVLg+^6QxX1{Hy zgx7-7w*IgLVAbL4u+Zx7kp*XcmHJVhhsx1rIdfiK!C0xPCAH|wJXBU8+t9#N$r0R0 z3E;{L4xY0G*}ZeBL`Qph4nXzNy&z9^ythsRsQ1*ybn@+))uVVs??mnJqzj3eiN%bn zFIun#4*md%F^t-C#mIwV+&xzg1v^sEqapWn`5hQiGauM1N+4=rkhcl0otiIWr1GZ< zegL};xsuD58gK~PJcXwj`ki}hnC~D2D$FOvL2kc4w#W4GSDSN_z5Sy`PRsjIuogA_p3zQ8Fh#<{2fZ98_3{WUepD35OyTOooNN2?b zv$WxSoX4CEDU@V_Ws0R?(lpyDcT!uu_seryUc%(0rN4TLS|{rNOeH|ZO0a~ljGggBv?4SU!6&Sg`;$CjUv(Vg}I4e2PR2P$;Ub;0MmhK=t1@Er|Z-B~`@;9<9 zKUF1Iq|06`m!5Wo0pT>uEmd+gEB5y;=LV!)~LY_J_HDYM3KIkF)&4| zX+-rT2`n|cTSO45AtYH%&Bw|<%f|_+uORcRd6s8^>}|!^mJyc32v$U@KCS`^Qkf68 z=bcgxslKYdl}~)4?M-K0u|84VmT!8Lvk=E+Ush(-kEm(&G(}-EKK%t$CR$!`FunkT z|Btb^4vTWz`-c@p1QiuUM39hf0qInf?ru=JOF+P(+=`%dNh4Cjz);dLAkrz_Ak7Rg zbPV-dv(MS*JkRqgzW?lNU%EHLea~9o`~*~c{QJg~^p?3oE>j1vLVr(L>*G4hKE@v{ zQ2xBZb8{d&iq_XWK``gl^rs(2(#mf)OFK7>s$(avsV0rP4&5J>Z6wtwR9G0wa=-53 zzJ&5Lkj!aMZ%A6jE=zh_uXWY}f^*ye%3Ge}lKX_i_rHdoO|PvbnbjM)%paVJMADb$ z+800$6-hB&0lh!r6q_R?M(vd4hZTMvYEk3Pz<2_I9)W;w}IAkMk*s6fw;{WR)VG-ctW?+k@4}VPRJbwvzJpHyJkbQ#al2Zz8Q*; zElshg4 zp1Zr4o~R*C@2+FBcPB!oJo?a%Qy0H#k!=Y`<{fkFGVC}Rl+vYl_A=bS-XR(Q3 zBX4|P?`PaEU!fyw*r!*9X^Ke^-`)}ke3XIW-VF~21zJkbdFZ~H9}X_Ll3Rv`ohtCt zYHVr*G6iKJB4+0G?WD6_yEvR#pAstF>`gM{31(tS%IMa;d**kOqF+4wa4*4=xFnE|-}@`J z>{&w!ErTDmjh^W1Q)?yw%47G%v~x6fs@$F3VjjG`Vz8B@YS0D^7B`c6qY?! z7%6xjc_h53rBm)$*hw~~HIV7Hx4i=AD`{Wx@!I8fd{?(aOm*T45sAC@3n=RJE)iH@ zA5ZaZFgCk=|3Y46TEfG)jYas4l1S%;+Dm8lX^2lmeN*IHL)ttr&aHd&vJQ;vW`@m zgaT;ZfW&Lal{SdvrWi3o)<9iVJjEZ^tRB(cC_lHjwno3I#}^smURp}FX3J{-NY1q1 zsyHW#gY6Qq0 zW%1^zrsUqHOz}?>6<}ljIb9M#xUfxu^fc1~`nBkH+}vdtQD7{=6-R0vT%m%_u+Oe7 z?&?A-8|dX~tGK38O)HBZD_|LoCr?H9zIGh0D#Z!7lqynKdDR0-fh$qR^AvAtU?mm- zSRi*fBQ{GVeuJ+9i;20LU`2qRk^~U@VsWZ@A(qcEPrk#4tJ$O$m-_Q=rPZsQEiN3UB9fV2O8Xwn#7o7;9R@_+sbD%njG z`id!t@kH*siG?y+zK^o?)EsU{>-gt(Ic@aP(U8vK01ch|r+3LTh`D*Q2;jOhm2UPN z2m1Fp#@dlyX1gP#0cSi3pH`id>GXnVWUbfhC;msAK7N0x!aTeX zInaxL40zUNV<94U6aYFywbnM(m4eJmb7+8P8Hf%MVHz8g=sp{HO8>?@^zYBFvtw8X z^JcT*EF)87O${K}YP4rYaHPPp?{@(h%8o0*&Lu%nTS%%B4|Nrj=c<~ro`FY2TzDpD zG3osD6vXqAfKMXyk*%^4y?i`<E~ z&kWW6oI3%7Pn9dsD<)Y5YefTXjb)`%JWshA!GYB#N+AmB2E>tOR|+C^OoOXN0<@Nk z!yC7H7n9*>GrFYFxn1EP@QYIND29*=ea>=qcaOYvQw3A(KK1xus`vtEk|)+;bRZm6 z9|V5grTra6{q$MF5))}Fct1}~)*PA*7j*L&`WE)}aug$CA&0@nO-(1*BZ~}6PIPziHKCm0G#L?z)!WWU(>)rh@?g3r-x-Cr6UHu;zP_1#q_o+mk2Y{cf`)Q272Y&3mW*mE?(TI4g5JMsVs zlqimtSiuiZbiT?joScNN!Stckw_DJ52HfW3kCHk#%4MIC?yuKi46F7i!c@L60EI+U zhU|QhDonC~XHta@=F)Mnql8soZIlMdJ~X1j3nM~8)32Fn?60(BDTp}_C96@OP9_F8^Iqh;Zs z1!)78EoMV&B0w9`{C*ZQ;M%I^8yfh-G$RJ{;^o30yk$#+8>~f8b6n-(HDk6rTi84N zW`me75EQq)h@E_c2sS8lgw?6&GcmI3NrjJ3)O>j4F!^*G$d8~q<}JqDRtA-Zi*zJd zpvj?yP|fZtbcBWtFIFvp$SRkHMK?W+qRe!J8Ir3}lQaGUp0VSWLvhbdo!4QE?r$j8 z%c+w$pPi8}zk(TT>+A(I$q);wCr3Sp3gYD+iMHs9Mv$Jw^zAL~3G3WD46hkd`_#kMdrkevW!-5*62miSs=kA7QD zQL)I76EHsI6CW7}3&Ypy?%co61_+ZyO{VHl6_Md#omP=A)E=4Wo}Z4#xn{C>!$2Y@ zn4(Fjlq+Jt6ElB(qzav?xU@JoN1Oak59BLyv76KD;2M5RU z0Lp$DK$tJa5I8=fRr(suaw~g?t>hsQX5>!vE2X?p)z{TY3i^G+WGQ&{f zyVDLLWdfgN<+Dc{LMcdi;D$-}Dp_D?v##c|^i-S?zHPG$@p_cpuBlerpPbx6J(rZT zg^xS7-0YTv^3fq$wOF9D5Gw~Uy9NhbB@<9ua47f~+E|WMhc`$mN=rw* z321ON@;x1JH3FIDrCuX}S)aZ|X`D&F@B0=tPkm{}`A4%8rKU9+Q|V*qem)tk1+`VI@;srudLoj|R|j`A!Wr^Z zZjo#bX+4xVT6JN#X3v*Zw@5Yg4>Bj`aIA1M6;haHo0MYq_xB$q85$aLIZjLT<~yJt zL4Liv{_jyXCiqCftw^tQFezLjl=DdqJt>k7#1V+Jnd{(aO_4ZG8#pZkgIpd`qY+?D z5DNgT0omSOzrm38HNhInI}jW8iP1V2=*K;6PW&;nzkmCs^!%b;kMt4)(U)diLGs7} z0Y$0i^zq`2G2?(b^ZyAkU-PmS=M=VTkn zj+75R&Os&w%Z36EGf(-Y%sb*40GRZy5O308J>w4leA^{i=@M9#Z1gq{q#4Ul zd-jjW^rwXnFwp;Bx-mdG7?<6smUZeQDMuuO5@PgIPG-bWFu8y()|jcanbN7efN_8> z@z-m{f8yWxI~*WcCBK(9F);z8;ND^)*HT&T&o+6}0Z?+~V1fPwVts19=y{);3M$=m zs;|*=5G${?W=4yY%g+{#?%`lx%LU}>HQTmK{eyg3TzQCrw}Zn(dQ+BGkzg|^4R5yW z$q|!FR`QVT-)~j5yH()#wZP>$!}BG9D&Tl#4d>u$g~y4>#{f@;_U9%n={*IGI@Pb@ z=thgB_+ZKQjV-#CmkfLFM>Y$t0k4`M5*B6`?_)VI$(7OG=RCfI`;kidjVI6i8vK4Q z>zyi)s8y`HNK+Ucwd?ssZv{4IT%6u59f{AD6D0|Nr8 zgf|_<#>|nwX~X_`v-)aOf`XF$4BT{IzWc^ioS27>lzRjm38OiV?{*6x6ckQEeRrfM zCz%3|07b8CR8^}(lzTZP=!b!@mkh&!noWjkEb#rFm|KqXj;PD+dOj({`D4Q+es!UI zrCJNQH%P9O@;ol$Fh@TI&e{OW{Hy4DdveGxT1r7>6BFis^JB zHJ(A#HJjdN_s!T`%vWD${E`N=QsVtxl!qIf~qcLo7Kz3-7# zueQH`TPvtaO#!6V?FuYYK8|{CYDjK;f;(hnSfTAqktl2_7+9AK!81FWqud@7eR(QE z1gL5g2_!A(yzWlg*KSE#iXEaZxnMQ?JxPSY$;qPehb|OMwJ@?g>@^Vs0t94E5*l6K zGjo5)isX;jhj6D1yx#4f9jF+w2yuP%?l)N1zn7&gNkC0Rrb6s<3Y!5`_59}1Y4Q&R zfKw}6t+Yb{B#dgB_8==cZkD~CxZznZ{)Qt}f&0{XfLbf_ob*8}V1cHn@!TWKSPE8} zW=W058x%A|fL<}uc~%m{mT+v-D|4?6X!SpqJoP99Vrle7!Ew2iHBv)D8INn?tqdE$ zZ!9b#OiRtF5|Z-%#wk(bN)xCpn82ja^W#03EVU6O{uMELJi>Q?KN{gS%K@Ur^CpN! ztEGsB=Ats0AGGMS?s>%*yDJ7|$Dcx5wxFgsFj2PDB|IhL{oPd9C*K zeN#}ZW&Qb6%5)Jv;k@MdDT+l;7nGLapb3~+NhFFYyrgzUFM~b8RFOD9=60|pEX+8d z^{C$$%n(}UnEL2I$wlFV?6*P*{=T&S*B$(X12(?YNEe})mh3*RnRfI`u3Dk7lCaXe zgp79OFP_9Y#rDOy`am_x4bg6&Xsz}vm{V>Q@C7`^*mX)@E{748+gc54K3K zBT+D83o}SrmC;^dv_H~&%L!qjx7uNk|bGPTZS#P=(Cc8`H@GIJ4A>8PE=$TUkDu7rjFE1Zw&j051 zr;^XaZ@9d8bD3nStx+yEU1!#_w?ysm>Z0vXWyPA&SJUW~Nw2zlFeDi8_b)EobyaPa zUcyeE7#^g}l^vXF&zf|7Z~Lp23DrJYR;Wbvs`suJP}WQoA<1vHa3wTK@h8&HNUPn2 zIWVA}zD3dk#6~Tt(6cg_H%}Mq0=LC(O$UnqjD#b;Mj|a+NeizyJf$n+bP6 zd{7^^UaJIckLpnXJGk%JVJhHG=QIfy!82XLOUa_P8qJ1(br^e67W@Cn z&{5?{vcp+HK-jGVC^fL|?Jcw4%It_b@ZkuLhVcdEJ3Pi0bJk}VW?44UkG~gq(XM@N zSxm-qSjA(mep0o}&9$|QT%^i9>Ox9D+vkR#TyrJYKUy%eH;1G|VcF6b-vE1L(;Yxa z&G;?H9>mHDy}H&`0W{rq!b2<1cR&=al|dn%9vF{owlo~u{>cx7D(tg3V4{8pvQGVy zsyW!H`N2%P16B)2m6K6=cWsQrW-vDrpf7DGcxr(z3M%op45EK$ys|3s?KtfZ)BVeq zFnc|qGiBYOP%-=hRcE8uVd^S|uaGz69$MwBOt_2V?W%FWX3z|K*O4rMv|lo5XC5TT zQB3LnYh=sc0h4hO2f0p_^-;|Nn7uzs;eW}?Ew{TO#;VvK2+EP6civma1kgWq)YR8uN&nY<;ui^lxg~@lH!ed z+jfUpWWUaslt0zz^JwqV=nZ2CYII+OTkdy{=hx1l{K*ySV&vYjlikkXzEdr*n&Rs# zI%!701C3g_CpO=w1fzLxqta@err)Oo)$T#rJ0R- zZFOIf`F8!L6aO zkOF?h-DOX@W^htI2vu`>#Y|gF3syG zQJ?Wk{GC^BQ~H65Q{>a79n_ta$DBlGe4eAFpRLI@oKWP=6T-nk%`pTmG?n043w12bh7%l^uBFwm-m0eq7M^d6w(co*5x3? z$7d!Jxw_Aq4$PXl#@B?ooD(|Ygp4X(S8b!AA9d5?ciPbrVFg3Xd%(+S)AZNB-hY01 z#vEUQQLPedVhC{w$Lg7%2@)8S}(? zmxkY;cb^^kfcl@q_p5^AG{(1ZRhpbR)kxd202toLczRayzVeu}!B(BpTMG)bk7%E! znY=LTj4z3Zk2fcU?tZ3bRn?*T!_zq9KYi9L{bJ@sfBqSh^5aw85?guz0e`kEd8Ppj zcp00-!$cJW@U@okFK*q!zdjZJoEd$c^9&3Y%>>w5gx!4#lJy$1OcIkwFv(}p^*WAb zE01feL&SZLcp&r-$4uNC2SJ8X=*#SE$*=60FE;mPh(2Z}t`xa;_V)n4@Au4yJ=!A0 zOJL})q5LUEg#`B&jbyFIaa?Ab%$a9OB#KWH;G3G82W=5!cAxpUfq-IK=UYWE;L}rg z!sRHAcv6ya^G`SL?AJr(SaGqasEFfW;QWbq>=B{iStsE#)jFD>{G=+s>d3*x**PMB zqFf8OHv-)NZ#v+LRUwL;pQqcK;1kD8c<8|e{}dv{>kOy2m;1Q9)*b`~g+zWo#tSYf zS0$n#Vg&XIH&5H5SIEeej1=RjH@t{kq7!htMGwNttE%EcG4RP6AUP5k{9&k@`tiU# zW;c&cn6(8yu`$bFx`LN777fMY;84QPQR%d#WOaS;&3QoW%;(Zy#gTY7Zj&4L%3!t6 z)caSr;GaM9mB7y)enm*q(|x-ZhF%pk2Ah(=BA_}R7&=8W0Mm-ru^Xj5Wl)cQzc~etn)E*z^Xy&Emvvjv!K0CgVYovMI(2Cy7FI zw_n8D{EY2$Yi4*4*4+mL0TtaxX32yLS~a@9!VmY^nbazyyicqK(O`nadw@)!oSR>y zEMAC=j?Q>DLnNyxqRRzpfGAjKQ?JjN|g z*qsP<_Db>kDE`Wd#MUVB9*7ie?>fh}!#a$;k)QQ-94czul?;-j5+5)qnJ-mi!s9)k zE<&p1P^kgTuZ+6dt!+(XSoJa}QA2rjd@rpnN;Et)G9yML#fFaxAP&*z#40K*NUSE) zYwZgmQePG1ivGC+|HRh+8CrZz@T0g0g{;R)qiccB*qrtoi?3(>_vdh8>PCv=W~@cR z&wRhw6C-E5gDm0NKarZNai0oni$2bE9_u(c#+!>)acINrklB5>PoIyo5KMXy#ZM;X z2URdBg~~6h&VcR{u&85zoOYiv(CUW*PDyT?*OV?7$YRyN`? zuR-%Eg@&QTI2&hgK3bFX@s|2S1aK+?WttU_K$Nrg;=sEiBa80Xq$(l+s**rH{Y!2_ zkjJG4-SWev5@P9i4RznViIsco)BM3iaZ%A+cLs~AtE2JGQM}4oZQ^DAk9El+US{9h zztC}W%Voaic^v9h|BY_*=n74q0H_pN*BJt2L&>Ui&Hhjd1O@mOiUjz2Hv;Kb#j=Kx&IU+1K9&pePZE<7OKD&)l~9b zb}5}54qmc=i)Ku|KCBAsI1b+zDe{&`PZaRd%+b0M#+w(v@cMrDS;rit3){&ejdvoL zuh~1TtRqlc=a720Q$$nLe5lDt_!~?y1%YwGr`2O^PU3ZkNaUO>Dv;gLwi&{{hXc> z?wNtL&WB?fC>3g-KL+hJ{V>*c(w0k0qXz$z2itJo9xiDXN}UB*2tN85BqD9B%5ctkcdwQ5%BAa z1LPv)9xDKd(!Unffg@@scu0F38Zz@X+gA=qj+(i*>;2w^mJKM{+3S|Ss`%d2h$;$8 zMLI(c2Z<=|n3hog-e#(9{`RZWHycGlqL1xsGGf144;(prBgG(lXv8V?7Rd<|F#06#pup6u_VOuumx-i*|=@qsFA(jf*J*RN+>x``0JLQA!zZcJb|4 z=e2$^O6hOO5Wz6Ry!9}gtXYr`>~wjebr79pIGAX54b?pX4=$RiTJxllL0j##zii-j zeg=XikvukhZ9{54QOjZ{lHy{wJ_w!h!ub>H{4U50e$wcvRTA~o0=4v9KH{XbEyc&a ze0&@w3Cw7o2YwvSYAcXP1A$gEtGUwtri4f>zx@6C3NZIeW)?f%ZYQSf zEt+T9(bk0Px->RBms~aOTad;ocdv{>*4E=rUl{gT9Oe3iIyqHwv@h;b@-xyHK@7U( zI@v_MyUh*=Icm7D?hTtu1$c7@ivf%G>R|cRsVI1iv9|!j(!v5gvv0Dj&5&J(PST>w zf%E)J59?7Ch!(>~56@Riofe07ycuyxdz8|Ht~tThdY}4pWgsf`r(KC6EO?QG#FC zzwLdICr2w%(Dgy?tqkwvg9LD+b@oa0>Db0f?XhR2(}lOn4IS<-mdHq_Z;+7~T4wLE zvX2j(vn#vyDhnfDB8Mdx|7ShvIjfe;k#XbK0U0jiXW|qX@zweRd2mSV$GJy#(<(ot zsvB&i8y8&DUn^gOKbIZmoxN04ZjTL#(=7gW?;$GfB%Yf#mN_l10K zvbm{pzzvx0N%PH}_^GyC=3Qj88Vk7_w>|I@KUYPAg2LGy{ygPi@f;KJaF2Y7{J!oC z;Ch}w9Kun^6Hm^vfYZ0>L ze^$Bw$qv4CC2R#-V-?PhBk%MtGhC;*<9c7a((q`MH!8K(z`5k}IX@d2f#7&$V6^isrVgh=IS!A#q->@ zu&`+D>Wbl?1%@q%&LMiBHdh83S{GvgHBxZKPpidC;dvka!e(qTOX zl_0wh#Fry9nw}f{ROM#X9$I}r$%Ng?cnoAdWa8#l3tj$rv%eb%axfogGRpIf{`vv` z{iuzKb!9ULt|1z*lZcbOaSjy~&Ov^ljl^Kll^E^b3`yTpi6bUvNkm)3IGqU^yHW0p zqoXqt0=_bDcYopS^;x$U*m73LWU7p%{otX^g1hQSzG~MDY)!yk%YTK7S2NntHJZ>) zPj^cX$PRUt*^GT-=H||k$K6)5yS!wPwIbj?)&@W z1RJaH*d@%hQ3|=qzj!fAD=4Vhb?^M={;ALe9-9{=zAVgwlDlg%Q8iw-Tu=Y{OJq>{ z+c${}>u6tnG@HC1rs4IsWD%lU#cI1NBP{c6(a{AxHv(HY&55OLmW!gDcRNU}Caa;Z zJU!ds231(!`Uodv)J1S*C4=w1*9&yPtD4(c1vUcr5(IhWW@?X}M=uX%TumU`0yBOF zEf?Yz){%#g7Bf$FYavomStbDWLA@@h+$pM*djTU zIM(w-CArw#cHcv&mEJpbJ2gaXyfBgyy9j^pD|j1rcx`pQtm1=d&dpSG6{UAHasbB^ zY@!E!gj{U`+Q`@AQJJk@UdArx2f8y_~V@xD#Jq&4_K*KJM%5o39`-{Lwv8=~fC#=D0Yf{18vIg^nbL5-|a_(`@M#k{_ff9ks#7U%xVLp(1@$fH=rTqiaqBpGw+CE~a>?ns*&3 zWWL@?GN|!SS_>V&+8beScLa3P(p>@u(`p?O5>N4~p=}Y@@0aEg z?F3tE9AyB1C8CJt(O3f$inHqy*3`iOyld5ZU{l0B#5iy-9Za0(=1jHtjOz>rD~k+p zumAd7{4x)Ve|u|FgCW$w_*Cn75XZAJ4x~TH-LIi(qCI z?tg9e84Xf^Ga7PT?#Va9i7fA9Pa+i-{S)28GQ$2c(`AB#g)#Jea@FC2XBGiYc2g=2 zF;H@(5=wjVa=pf&YR1*Kj>$-&V61@ipxt5B|DeQrKwmbR8M+8HJXyAgOn=cx&|553 zraz@xztiuf;oA_y79T{wS`KveC)U1%GQ3YQqO174bx>y*%f-QCM0`~Vm)^E#T2R3H zqOg8}W8ul5kcn7WJWoTq;l!w$$!pZ=UhY)YJrkfkXL`8HxSC^22|2PlnAr+#1m(+` zyIQxsb3gyKIp$-^j!Tl@&C!W{RCyGO*5KO2GYBwl{cyD1$5A=-y2VcO7FN=6E_n;vt9QLfK691}Q%to8g*(qJsT@qd*%%xL z$pCfXr!&0fDrD~b@-ZS=Q;6&A!`Uby-stR-?dyGV5=BbFfv@b?*59N{i)9ElE)hY*-x4p0>X(dh{3J?Y)it?)i}{ z$}*&P%2q&Ez+V>w?QT>rCVM==>`>;uSx`7w5F*92+&EU;nFLPat{yft`$mQ)g@)dK z9U=D@{kx#%4mBG&Umd2Jken`q4x6JWllfUC(O3#Tw`i~f)Ny70;(q|y{wdV^RfY!k zdNX#aWnT%=Q-4n59QIf(3l6w}lGC+T0Tsh#zAdLI4ktr_PK^*|yYz~5HVem0GiVu2w?CD=RN6tO$K6zpnA^tzUC%97 z1C-3MJHV=b?zw7RU-$y|@YKN|+r``Oh`m45^Eb`p->b-J>)YjE_u;IEHpB|x*3|0d z=@L7+iXi4~)~C;7!m1MS(hP#{bl{&=!aF_%BP~|!Vs6zy^4;A8;A(;Mqp*thdABIj zbJoEUhrVy{BGXnEzauWiq#~9w$U_tX0mfo1S@_r8xPB6jRGOR7_ILIS2Nf~QR)>*m zEZ)1TMOPNG2y6xjVzYvc9k89OH`xDqv|YYzc?mLB@Vt0!sQz-MMGO=Nl;~I+@cF0> z_x|Zr@ri}0lR_HiCQq|s!1k?f+pb)egc9AL;<0%r18T-qWWR)%$<{k;QQ_u(Dl}h( z_UV6&++9;peVkE91{e>I_kT$sTq>h;PB1kyBlFu%>~j5j z0QINMK{O|{g0ZY*_5RoG3K!p#$u?tfeDL5~@HKUXbosbmO@Xt^q4O7m z9spJ{d?;xX>2f;l^~WV<>Zi-u$3cssHq7*InA;xqFSOZ>rO_VrPz!jjl=pM-3Jr#2 zGg%iKCXJS?@S5J4uL&94&58ro91bg^kH^Plhp!>F#S+Ank~<3iJ_a47rLMo(UQLhQ zY>`&1T52_vol1MHek{VxyQ`mC#?JS$t=NVv;f)d@xik^+oMMJDjc+36aHCAkLfRLB zc)2p%Mexd?y&%M?0LK^!0H(?9+4J3X>oYqHv4kO27c%^B3knJ8p}DxJsp|z3!W`{$ zk<_5aMeTWq-t2go|59Qxgll)=x@%9pB~4H2>hPwuLySTauY|g9!%=U6)H~_eW+PrJs>~<-oV?bz` zkSwA5-4LQthl<`Ui>F%Zoru-^Ry*y=hzag?6}tBPW=qdc47v>)C?-7@AyzLg_S(F- z7-KV*8NENhe`w{6e$>9VDn@mMgq@etWdb!ASb&4!vF;bY$CJz91Gf8H3vB&b#>TEz zlevNRec39mtHMnrcRX@Po5 zaaN!&@5SlrVhXinr`Tx8-q?QE`#<4%4d=z?j!NBF*hF(PsP(9v1RMUbNl3x zOGvUL;8eLPBdQnF^X(OY8NwF;u~qb(8lQj%g2uFj`q$qpn8{!VYKj!XuT?JRpnbx3 z$sTWaL|Kx%Ie!LM+zBS5M&mg3y<03I(C9TCOe=rDN6rxFhG(Oa3MpIOTpwrI8=p{0 zOuFK}FJnS;cUrB1vSc!aTMck`VbV2Q$9t35DJs3#5x<(l_u!+xICD#~=wLUP%! zpj5#=5EdHEH1nKw>h)pGhWoZs-kN!4?#;Uosp^a#(3HhJt5~CGI?s8KQ6#$P-OQ|= ziqWeEsl2pu*n@aJEbamxA@aG0heu%SVukoSkKkg}43~h>l`;2|DH+36+jh^XUO9Lb z`)Pw;hkK4FqBEI=jL&{>A_cO5&(ub4i;$Ugx+ody0h4|Mne8mxJpRh@p+BJMm$lb_ zMm|Guaqs#g`S6b))yy?dj$EMf$M)~W`%V>MAJ1Gf_=<1ba4e^ZqlX;W)z%-~UdE>h zOR>Y)ext3y?=4-iZgmI^imqwOe2Rr-4wXKu?L+o|4hHGZvXvQn|0X+6gTL$8{U1VD zOoCwkXxOitD=^Dpyrp@Z1`4U#(`Pv4qvcBpyJX8pz{ye}LIZsV{ z%}qW&rUQWhYi4xkxZ>$x-WU}=zE{Snh{W99h}iAB1?)p|F1L@4_b#z~N+BS6<$hX= zZCH*jFr)UGz);=$7;kaO^@Nj+ZS_bZME_fIO(hVumd4xShMj)!z{MTxNl^ibUb%8B> zW_Fd01F@Z}(>YOpF@#d=^Xb^5fQbs=6$bk7EtM$-pN+uR!Y3{|))y~n$lxvugI%X= z%yw`0SulI-O--fpn z{mcHrqET*>Sv%$~86~^5u|wPg=Y4aK&>(vj+9M8D1x`eQh?Y)HdLbs5`iZBlP=y78=qqMc-c zlPVUW#iiDuD%$v`VVgrW&(KYrj!{9q09zw|EPZChTAS1SW$4T}Rp zKo%i|3mYr&?t50#xAN7yq2k2aTMdy!%eS*a&wMTg;5+RjK9zUd#xFuvD|aH2l9DV8 zUcSs_4}G5a)Y9l`4RHD2H4I7jmNHjGT^HaeW(SkQp*;PP zCf1oXUmStcyqfhRM-@L|J2j9HJgmNRmp&s(>PDzkN&X46wuNIItaksLMdsn9>tVQC z-RK0>d9${tn2nT=+zCq!$eG{^v(jhZ>_#a7;?~&=#nF1*WED(%pd6H~;AkHIXyew# z-d-dJJ;d%#pk5#mHgfgWH0KTCYXlzd$~6KDAzm#BdO^3?6|pedwKe-*xWd*I#pRGO z&p`J$F0Rw=d1tC+eP4-zGB7mh?Yw+h`gcc077tfCgZJ9pbkP>sC4w($nC#k9H(B{{ zj<~ouEHCwPKw)@^pE*{TC)!>Et|RKn{u% zw5zlY9H&Pk_F~j?l_zcCZzf8t`cx6z&y~_N;9LOIk2#pGr>)vd6Ybc4p2=!Z`2=1C zhhME7I!TQm%+u4(my;2&o#&u;nfYGf>mn*TSwZNp;)gl;gvhQNS{o(i@HyTodt~Fb z7IwFIV}VU?eow$>sTtt8I$j*)FJ$0w$0PQf&_1k2iub_m&wh|!-F$|`2-(TPY{Y$Z zba$XQj*t{}H8uiU$lqLlc*-Y#;vAIiQ-;+g1BFpgnS0z3nVQ-PZp8H@v4_mU!uO3b>{u~8|kBeLZqKQ&JWH-LJc)yEYEQ|*?R`*=?xiQ>B)W$ z0YVyZU>W|51iFJ#o;BwC&9(Y>_{YX@H@5;`@3GR=g1P=DQKRG;yi^PF)-DzjCWY2u zdr`^Evx6MtC%!|(NEu2N?SjM=h1EfjvO>=4Wn0f_p8FZ9|B{p8$VPB+55=5CNE!Y$ z&*^P^t*j_lvXExYz!jNnodC^ zkZcEABzx&hzCI?#&R!EmyfjY?5h_j9yCG{cV3#H6W^3Vk3Qmpat0~BZx$w^obiBNZ zlEEHwYsev~Z%-uV!fsyN=oX7@nd3kV%pzS5*;L{BIyN7fzu+(d)ew2}V=g`5u)s_w z7hQA(X*pEx8vr2N#L6sO&6hp1aWDfgJt=#nj^h}P(NnX+8`;LU_PLpvB_EX8#|oC% z%-E|CkBoM=4U|@hbf$OSrOIZbfOSZK&Aa{m{PFCB4t4Wdz=U}7zKc(e= zvGUk|Be?PY?x>WTw~!Vg`gz+5`}^0HCWWe{#2?-J)9%oS}i+P z3WX|jbY!VCyc?1MfO%T#=lO)+vT!y=yqkGbhFIcx>~h}_5<<42)j9JuP7cyK3C3op z1J(V;@w`^FNO!@_fgxZ3^%k?ax!Ie!U_4gl0LIz71qYTBLT;9z%YljqludDp$DSU| zsvn~}te;-;BggUc8(5X?KfQq2tucsyWS>2xtJ>FVI^TwvLounXj^Ykxo9}g;jlevI zbX1GoX$3Hog)fuYRwBRuVdbgfjtIEw-g1>|k7&2-{P$LV z{bvTu=%Lcja5X!2DQ7pg2oBLxZE)DlYrKIWwWgt&=lHM&-r$wX*}3g@Z~mV0)}C1V zKe8XMgLi*vpy;okR96;?27_p*xZ{*!93xm&xIuC>@xxjpn^069=8dIxD(0m)9ZgHk$};Atiu+$X-hQSyUBXP%wC z;*if~P+JtUu75)u_Bk9MA3s8=8NmQB^QDc>0t;q)e&p9Ds-{x&)E`PltNT9X-l;gg zI2Izqv)$2|7=+Pl-v@A5&_W ztU$&LKxs5(oyjX0-~IFFXVoH886AZ87lUIZvDYk$lG{%rOs=F;2*4SX2dkn?l>Yib z^Uq@Ae+3-z&$wJ%imjicZZjFd6T#+l4hf)PY=Bmp=06BM=j!cU3oHee^;d1LaB*|H zK16(J4p~Mp9csaCFZxxjPlbh&3otJ;D9M724ls2Z*o}VHM#)|4wQgLrLE;H8joj|D{klzl9J2HHJ$@F2yV;u1|rf5g?HB=;@IfB7Z|D(_ND34&8Z;b;5RPJhU@4R zaATvQbvgK7J(M|}6cG{0DEhhd^QR%BByo!hZWbsvE~~eWKK|UXY5kSQJjGBcN4Fwz zV=B3rFg=^UJ3$Z-qC^G+fr#AaQ#*mS%BXuKqjz~g7h*P1c@0@um+t?*_ISZ^_LL=d z5wVOTrf613Yz%=7pIG0$`|HA&%GdYJ<=f^4$Z>UY7ZGdh{tg6@w4FdK_v=#f9~2Kb~I) ze$pQcYK<>#so{dHzGg+7$IB%N-h}23)wTcirTrK5a1JMgD%Jn127b%wxqHO#^TF;M zLhL5Wyq-dEE(@MU3xKa_a5)9$>FKxrgoa2ybssaWV)Nl=HL|#7FqJQ!;g}PxE!8)w zC|r^)A$14@!jeOV@Am{h+c#mhsg|AN<6SzrSa?gB67YgD?a014vu0Rc7jaPgp5W}k zl#T54NLET%R8+%TLE{|nIEpOhyWVRpJD7!!I zESn_H7&9uMzIOKif1^c09Cz6Z6|6;PKV&~rE20Y|teJ(}n`D%gQ~UF7QQy4DL&u-} zj_^^OlzY&hewJ3MY3sN94+p+l(Rdto{+L-_4o6pI|L@=U|Ne|}E*wS0F6>xErNn+f zpWgcfwk4|^-qGc$GkL2;ON2WpRk6a(^n4>QB>QFwoUzko%>FC-)ZnWGS*i4Pcq!`P2X<=CPag8!Xhn zA7{Fa0KnD-&BetUHG#%51bPI}bXYuKj>fecKBsLtXR^QE-eyG2(tr;1J=l*?d-YuP zvr(cF^$rE|Jg@pdJ^+RQut1LCkW0Tk&;R<1PdG?l==8KW#HlU{`t5g0e}8`;j^yXH znn|rEX*#>Q?hwZ*CvnY#aWGP6LgtLmQ0Dh5M1N$`m(ZnlyhhN0nRk!d?0h66UGDf$ ztdaX)$d_Io#>S|#_IRL1A{tI8S5j3aBCaBO|Z#$teDiM7WCxopx}SekU}6c)f)MKZ_e5G>i_=j^gR+s zXCf!JM{oT759Slw_xgOIu8U$=EjZ5veuGPLo6&JeIf#~it!xyF7;cN%DNN2s)YfFT z%jek7wRe9gb0;l+e-^m(4^=xh#p=)FSah2Mf5py?m62jDuiZp_iQUc3h=Ky+k#Z+F zcx8plV!KHL#cc-S+OR)S+^8?k+}hR7!?^%!cUNPO(;v65D4wD+m`rz)sF?Q=F+)r2 zwX)S5%2->+1Dd5lr8~-YhvpA~#h2-Z3M_MbWn|*@*EQ6TLyK#Vx~1j&mEoIaS`-u% z%wUJYKo<;A{~dhwUq{<-2G~%IV{vjVd1FAy4OG#4*C?p!AM<=48PNf?0v*6+HTmqm z1-3?-Wf}=tK&giI(W7BF#~*MPm**J3Qe!wLM=h&VRG9f;!8?sRCb?ozb-FsEO1D*3 zWEhl`+dJlY=+&FR<_vcKPrI=w@mMlJWV_~UcVqh;II=^}%Ep}|uTs1$Q_ohOw052r zk9aNY?cb45rks}cV(#Sdl58ATMxN&%d#t+miws>_-gnt!v7^$ zK>nPWc~D~gwjE_6Ia(qokZAqq-T?RS-XO;i;r&KbyKQ7dCPxF7)(-5jr~yDj5Up33 zHo)7)|2pUoC#LT0#a^)40+fQ@PAoPX$`CMuyQM}9>bOmSKGMm*x6x}U0Kt6Sk^cjp zv+YW@h$Q@9&u1xJFu+fhT2x+9p#!LE5p*@_wmOtD3JQIVSWwcyZ(3Rj&BH}!k9qpbjFDskVkqqRu z-RPv-em;WE={>f7hua!#kWZqd6e^rm1U%3WP-q3BlrY8&x#*~ZF!5y%6ALDzE{5)1 zl^;%62XrhQapxa8;`n}uogmOH{&+m?GWH;8Z*wy$_1?h8-Fj7q2dr8mzX6H;t7i74 z!T-KCZg#EAR>#4~>Hm@T)^SmGT^F#Th>C)ufV4GdF$e=ggVIBcvPNk?Q_oBL9=-6P1R3s8<;ejp?yq$w%k?=N9B)AE4>fC|X=g7t~4Y|WBi`mX^+ z`_rof*NsUPHqENk@sKw5^p4j&U*)fjkaS6c2VBwI?FA`W& ztz?pvo^n%obQ=9CZKoTg-bx5RK4L#i?A!I7!gBI@cDtmwySa_*mrR&GHaK@U!}Wn` zqT$E_t)i4Z6)!32)lDW@#{H;Q^SdY_Npia(G9+gZN7Ky9lHHq%o>!?U&W&0&7{y0Z3q z1dYUV{Owg&Ql&4azH1MBYlr}&(2MxPo`fC1mZq!!zdk~L834=(ke<^5+C6{VpB9ca!35?*@! z_Cn8Z<@S{`et^XMy^mdEEA~3KI75~UJfY}t8zGhx^kbp$ZaaSC2dOHh(I(brU

9x-8?idrA0nFw2UviL{)YlwPYS(OXzJPWG4eQt<)G8RPSM$lHj8;7XsNBZq0Zm+sAnSJT#VP=H=FkWwYVn&xWY_@# zUoVR8&S!1?jz$230xW*V8qlH>OSsJ7PkjHcGxlHqoQ0FV@B8^FN%mu#T^#u+@K zyU#Knc{ZvP&HA1)ZwwL`#OoRwo&wUT(^WAL?<^1o`8`x4Wp=}KPvwR^N!Jj4eSK_# zd_eZ)Dhbb?-#&XSf?6!MNGixCzOT4Z$D*d3ZL2Ha5m)b$Q+k!CI8~WF1Ty?|TzeM$ z#8=3(NtD;6j**FJNn}~l)WB?V6xB8ZcWSZwbI}Oy_coDqqYvoeY>lEtSoRz!Ukp=I zVLL>^e~sDvtK7S&FM@Z9ynx+imfCl-TBy6DVSuk{ZF^&OMHE^2dV)HQUiZUFm**(~8sH$S{@-p}Bo)=Pdz&I}yoK%TK z`l;4#0|{oeJ&dn_SHqo`K}vlh%5Vv_+n+4N-lJ7IYyj>JbFCv<9XP$}sbFZh2>(fv zrlNC8xFysEZvAl{d0ar3s~j0WnnFTK!!F|XxTnSUFwC`(l7x)%P6qvFFsMC#>A5_S zpw5M`e}CS;O1|~q;8_!g+c>78PV6`6(RUU&KY`2ucz|Vrl9Pq2zn|pVEK9SuYjk?6 zwWr&=kno|TPbPCeU45TCbFFXjwYfx0*j*|125OVFRx_rPAzH9riD4%$nNwA1K2GsF z_3Qo>zTPpSzkl6`N=>yNMx?=?AY+r0@8B?K(^wG`8GK}t*uJvOa(_E^Xn=s=NqxoA zIZ80dP5}jD(;2k3Oky=Ze@1=f+orP&7>kZV7zzYpT>|@vHS+MVG$L-3T~5+^*c3HlkRq z&%ZBBP02<@MVsS*A-BWHL(jPs%`Ld0!LEK&Q$PNi2oMS)>I+(Z*uZE6wpbw9 z#8BiZt#}(s^fn|vJV7RErcEyqp9nucuNoHe{)X$j;k+C0NIzfuxVS#5h25v!P(|pe zs_p0F2D78eIH&TUQ)dlet!!xPj{R$z%fC0M{)MyEZ|6Rq#Q{X1r>t_R3#dpK`T5sh z-DfcJ+9=d5#@b9V)ATBX;Y_y6&8k_tq^E?t-qgxxab>!e=Qon*t8L!A2h&+r!4uJ-r&za`DHhXvm^M8K(|@2$7P(&tHr0IVXETcJ5!njk&C4s()met#YHQKziw`r6o@xk9pRi0 z7jI?)?QWmr1GCjLg@8e}m3AL0(4JbC67Ul!q1*6P*Y0cF^88v*p^ZwzH363Izf~JExYO(u_W-O6J{#C8Na< zVI3qP%-SqouldBTiUIzYIixQKUEA28T8;dHy9)8rD%q0`b{+Pn9of5KZ%`$@W8BoMwtpV~Prj~ZZ&^MTqb z+bU}{8z@!W)-QYAMT_*`TGfOf2^iJbMZ{%G1-GHJDtRPfUm6p_}b(*8r4+QhNuJfwyrwP96Kj< zp+|^d$SQ`44UA%im{(p5uRz3biCRzHmmJ{2;dbr;m>cg$bhY%kRw->SZ>3`C1?YA( zDnN28Lu!Nrvd^1pry@Y1DlM;xZn9R3j{$P5$}mM0Yv&lO z60nSTvm!$Uv06YnPY8}BqbvHc{@?@PKmjH&;G(8gsD(S$COPT+v9X5RUG>CIKXA8S z?1sf8M`4~h(;inj_(wHuA6x!Ih$o9bG*Rsx(Xt2VroQ&ga>>cbTfS+9-~}UZwfjC$ z+1n6FpD7wCC1Ru*)N)Zs78Q4SSvoWP?<=zzYfxC_>K)c{VGnLVDOg<8^Y_;D;E;wh z0o?T`FihB^BD`Bu;5c`|>CmqBR#Irc9k#rLZ`-=0tt_hSVENa6Rh9GEs}VFJTxDUN z%G~-1(O7TO>=^b{P6Uy^_ERvM{wGi??M?x;65}!nW;jW_huG<@6}h<(W*Aux6oV0f&{9Y@4WLp;6k&`}(tTyPIWe>~^{W zaR7Vh3Z8@Cg!{kxRd7|2tw4B~*;19NR3@Clk~B@+S0)@3#vfKkk{b0~&Hna=0bdCG z$@OxHrdiqm<)j)cr-<{*1@29%x1|O%zBU|>vCzew@rUc%*`YGk7eG$%{qxZs>$lyr zXWf^pIbG{wbdywV)B*Q3$FKQS5G&a(4WEBX5l~nGcLKodIcus6i{L4{@3}gq>{?$4 zpQ|w(866geQT+R|b|x_7)UHyn=rc@T{qptI<7P-3vv8J|8+YjlDBL}?^QWE|(QX!3 z0c{r011)(U9BTFReN34OrC$E5|4B6|oA-mFdM&Q3vFUg3z54xBkyD`YWUo%SgyPiX zW2yQ0(l1MmQL|oQQby>&roW0OBzUI&!4f<>mq^)ZKD+&7lwtqrKG*v0;%(Q9$kHiq zmjTh4kOlM3X52iMsAN6&)J8yAOyDuNK683Beo2t_B0BQIL_LiBt&p=mXC7B(jTa-c zY-F1~pW<(+ff=4jT$NLu+2a#f7OJG`UU}avA0av`b$Ga_eOSHuw#?#cJ!EY|#Qkz_ zO{c5#!NRZYyDxxUGbrm=tI6-?069Ol)iGnR;wUXfLq_ z6N_8i`#Ebuv~Tr``Z=autYUL8_TDh62!%eJ^qSLXh)<);&-Ak{PE3^W`Tc35NTNrx zc+ht@Y<)-NYcDRpWplExlZQJK3aqE4e`etOxJk?;N0xjnL#pYqtgM`&VN3XfmfktJ z!{3}X8YeGg8aEqQ2XmZd#lozp%rWjC59v~KjjX$;(pY%xz^tsSqg@|!jjzNzVM1A- z(j5K!p-LS|`J0^xiQ7rMHSu~gvCR`}7zD1%%6_Ir-??8+q%eO5m}?`0z3kPswK-HG zuLD1$;n_GJAKk84m|{#~BBjvFPm-_JxSt#x9`eVRG0UX!JfeFe-6qVdesq^Bs1B`&R#ZfaJ3n}@cS6ntSr4TXMC1^M}HE)Blr}21MGFKuUTJ%^#VI>v*@7d*| zZiuYbbL!Pjn65OGIlX{*CjpZ3q|0D7_7zIxiJ;w#iT`i1S%x7zmE*o)A|$+T3C4BYoV?NOMR$FBOgM)Fwd&uz6sMfz4weCxHM zt^8Mh;J$g{>A9{IeMMz=woo2+-gJ3uvU?({X2pp({PU(MBKDBZQxk-it`D`!v3r~4 zTSLkOJ3%b5?z;=*LSg|SAKu5&pF8Xf+2QBKwNVTT2&>N6`%j-d+hTzMHH`}lRJuvcmfGfSPtNiPXDQJX6JpIR*6;BFIYv%)6=-cfWdavs7*$Htt+=`)kqbA{9(62E`OwDIlpBOQ}@u z&?i0Qi%Rl}_?3l^tFfD5%8Q`3o@^H_s*%vL(JRYSxnsl4f*xHU{h)VN+c1KV4 zU4$~b>G*;U>7knJbCq>e8m0HOg{=!v8~i^Kg1=tT^e()^yXm&=G#pZ=WE3X>^eJO7Y|V(t{UhG1W$v_r0WJRYLOMpaQFMR8tBiSTI(d^Qh&=`1Whi)jZfOeCcD|@1Q#xJj#;KW=kml|SmIVo zxWSn})IFhRVmeM;3Cu6wv(3x$NXTBtLI3AX82xSr1PhexEt<_JsZ^R8&jQdCDPD?ezVxuNCX13wnh?_}$xrgYZFYFF0 zEs5?v{x-;W^ujG3V{Bs;u8km%FD%UM_kV@EhTe^&?)iFKod%n8{Ai7 zD=IYmo|&_S@SkG0Oci?SwU1^6oItKxlX7jK*#$BbjE{c*jmQ5Vwhh#`96t$+kH6K` z*@=|M=$8$rzV3iAg^$O^?#gcpx;mPftx7m0upCX(Ow>kae>>kb*&vmgyjSu1&6_9B zBm?HxCdyE`i>KSEbjZ58TY3%w6P!+DF!HHZ05|_IYOSkl_{|=8%bn?GeS3X|RoT z;qpCUzss9ssOCc`#iKv$DCi{mG|;mTWcW4>5jXLe#_7AZndNCuJ$(2)0}P;6$a|@; zUpzEAL|`~=xLfn`D?hBeBh9ZMbeoinEL0fp+`0LAT2>(65(0IR&j+^drPWpT%BB9H zdg(T%h9^ddDtq38pM-54d9gzd)DN`NJJ#psdOg%I-)j_OCVdZgx4Nk?Xp^AAPifZc zCKKHnpr#rr`P%1Am2!zZJaXXUHJwjpIk(;%fo(lsbv?*@hk_yOK2$w7`y7ufR9dt! zJuUd4LLUkoI}=F8_z?!<{{CHs^F@a(DP)YF^}q*ySX>TG2Q>-D<2HQXOz0GENoc+b z3hJ%1mH&2Pc>+Z!o%q!ItvGmYoREIkklCVI#6CD)0L* zUA^j-U~^tgjb!1+p*<`l(EUz|$;>edR}sb?B&oszcA7 zKb8#aEzxn>_cfBh0BrSG&8?Ml+*gXv6%F-_;+&i>d5g6zJhHp7DPl zK3cQRBL&|!iCMLkm-9Fsm`4Lva;{tt(UmJNRK>fX&kd(utESx$J~rl&r>At#t>L|< zg&w%TlC$%^+5iHX4h3RdyghsOY&O|n4KM%S(Uu%fC9-7U;6$9$ zebO^+Z8~M{&R5svDEVV%l%aFNs$8Zb$weZfD3FaljX-8I8_4oP1hv}(9|OG7IvX?O zenKz*#VW?YVmp!fu@g}vhaOMQ1FpGUlJ&rm>px1reEaLn;(s1`0M9^}rBlSAnHkgT zWwhw`s~j9nfxCRhk`ndvKjCs|(_&P;&oiy?tfrzL)7*zz`PqGvPpIwfVvw;5T6WK~ zqV9X1Y)d4utEfaOwuBS@;Xxi42GWYD0@dB3$50nkj&c6liwryf-8i)^M9){SlFPrv z`4&u0;+$q%=~>J2KZ2mhRN-nPr-WvU1f~u7*Cu5C=hOZLn@d!-)uLzVQeQu8(zTz{ zhW=iq*R66aIo$^C)4Bd$9sLGd)82H;Eo>u#o`cd{uz5hGS^sImBqXGAgv04C{%QY1 zEf4q%fs3rOj{iuPm_$X3Kl^_uEc~i!XlUQRzm~u(E-wCas4$iy3;K`;1h5C@caAt6 z$5-wm7yA+{9>N9e#^W8eP}iZ~^7mhYbIw{=|QI{5YDEATR7 z^W4lqneA^-m+Lmq2Ns;fy^{$!BjCZu{2xF4e=aiJVo6n1El-<8cCV9TKR?cqzz+~m z095VxuT(j%HGlv9ou zPE|cDyH8w0c>b_)(s=?aDxB(f_ZrRD$6Y_I)yZOc`*5H$I3MU2E0oaZAr17P4Uk*F9s1y z8z*uWeThS}{N@X!0Px{u<>q$p-rU`FrR4j=qRndK0kh*Zp3nn|eeKFc0+jYQ z&))jnTp5dgtYpifU$bH5uyrheE)MM1y$<}QWDYu9)v|4t!j%rk;>$JI*w|A{!hI7Ro+%}vVCX&kF#@zF$&tb00a&gWGAvI=&TkJ4}hVC%TXhKQoal%>RW!upz=`yF$ zS+#7-h?`TyS1-kt`wPiy`c`UocXuy12^(<6$Ct)ZlTj9jVpkqA_{WuK=U95@ zx<(JlUghJ{knr9&)cJR(hIc6}-1K>?o1>jHjkVayo~zw-1tr(cb z;{Bg1`#-Ltz_;f?%F|cS?7hFTq*j_LrlAEQiD65^M4<+IC5AQSxfHfh-&$HaXKl1v z7SYyL#p6sgYII+%51`oMNpQ&;%p~XWu^$M|j8+9*BqY>ki-k&{T|n!;KB zgHYy(!_v*E^6+b^=&-U0-kXIz3XwSRd90c1pI4?eEmFDPIZh|gjgSq061?ZgYxYcH zE)RNl(9+NTbnJ30I}GEK>6UP4T&dfZgD&WPJA=vf-1}V1TI%W?=H}*bxvwVGPxTH% z)k+PoVHE|%Ka)H3jusl(TEC#+SDm|GZLxmAb9-G#*rGZq|9@XZLp;aOk?Wm{(lVo? zBTr_?LBU=ZOWF#9sHj3z^bO!>U!wHpNIkq8Ggu#u_Bz+>=>Bgn03W?7vm74>?o<>2 zMB8z@`gypj@QX0Fa=W&f8D%9J@y=rouBUtR^WEe|oRI*t-kPt1nWM#Omw)=SwdG*P z&jdg6RT8WuMkcc@YpJTD)d!SGZzPND4>hbboS9u7l6_a}YX@1WwML(RdxhdI1}-SY zEyTc}mMi`%e}jd|HI^WEdfkbA+R$*Y{g{U>O|#^Wh~tAzJbPSR4;9~ZBv8&ATjY4A zHL>vQ5oq=06ab~Fykgo3XoJ-mzWc3HRs|z&~DMra`ckjk%6t%c^Irj7k-VcpXC^4v&6UXkH z?9i6M_f#)kz2r8InGN)nrU~a1F09VZW$c!UkYEYE9AYNFD6rz|lz9FEcD1UzkgdZd zuZ2geb~(*!n%{3t$iiO7v);^N{bO&5$b1fJIx@69jr-i;zQEE7;QOV=2buigCwKcAxuMmKVy^9(Hty&r6tj)iD= zjq;TwC5v0fClq1Xa{q`gpTG7oL+U~|pR$CPJ_$m}TmS79+L!wE8_C(17n{Ym#hSl$ zk>fNP7?CZ{+(d2mc6TG`gRm>=8UxDwb3v+rR^YXUjsUa*N}&>6&($x1GG{;Yts!cT z9oKIr+;=QiO4$CfB*O-ELrS*Joo`@b>8>q;Ezg1K#!1)TQ~J$NJT#RTbgQ&EG&kL5 z7RoE$o+qN_7*H!=_(Jv6F(j|du&Cqf+Y$fw3T>xt4YsA^?^(&ErXacf`;4T@CGc|) zwuc><#$XT!Pew`&SOCPtEa%}7zk?oD1FbN2P%QAzrH+q9S1KPL4k|Ps5%!BnVRwZJ zy7a7Qu4k07-sKpv3~jpuia}Kn(drMk8FTHbhQyrz-9g&-7-#kMK81Q&nR3jx)TYl` z-JtOlg+)RZ#Q(Z1K{i<7_mvr^09sx~nORvomHD(*Q|8}((GP-=qt3T#r_K{XZXMnH zfMN6^K5qQ6to+lbgO0duGc&V>-qjg++3PoN8o)K3hC zrNFJI3Tbxf5|Pum?!PX#@2sU4WO_RbV9+(diywGm%1>{&=EpUju#8o*$o`z07z-V$ zwi4hyARy`*I`PyXM~RpspHT>zybSX8{t;Vi*3mEK)b)*UKD)|Z$x~;-ZP`&3rDV}0 zt6Sl-JtcfdkUP>jx{ctSE6g$}EJ&WS18s@O?(V`lMHa|OSubq@o4uVE&^8V?HNGLr z3pQa!Tmv1&?lS;Mmf!>^W;p8(G>kGSnGQhYrYU2Zt6a~2&K$F$Ulh}@-Hqv>^_S5n z-D$+tP?@jcn|`ydzVAjDk;HcyYd0FhioQ1v_(0jivfB&&6DM4DnGCLV#Z8aWaJZvy zCIy&u6YJ8<3RQJ`;{dp$2o%^1_O9!B_3Q9O^-g8Gvbt>bRG&TbgE7Oq4!;7#ouHxi=lxaaPM6(&3#iK4fO>a)YTCQbxj)(>J!G-BV+PJMPr#$4% z!%#_3F6s%pymJo`ggsn+_wuyg4AQlEejoOpRgHjcxH6C7u!4zY-p zCCvp=Qm6d%Cx|o=uk3IN!T0|p6pV)AO8(iUl9f=XmcRrksW`Lc*%uWGuT{l;4fY>_ zTUCy^pp6g`MH@_EkUKGg#A9bOFG8mmG5V1WyT5Fz41$)J8)I9?kX zn-QcO$(14^+y@Qqh{_pbruB7ziB|o5ObjE1`wwk7dHF~;$MUG?N-aNqxXN^jm{yJ5 zM8>vy3-+Rht!6>CEB`^nM_*4YGkgV z7bS0gTJNDx;4OUIs~|jnS!rqWAddFr$O+>+Hz4+DfFvP!_2rg{>b(dxt5lEWer9e1 z-@E9BB4(hU{{Z@cw;u+c1tA-??5qAm-1R0c=j~f$ls|dFFa#gJ@gT0Hi+^e8_wQ@5 zPue)5**NX{m#<&v4^|LQ(s2o)-$BTJFZ`B>f^jKD;$e4B&#rp^wC~LwzK_t`&HlD= z`8yAVhw$!hfUYi}%xiE(s;(2i9ZeT7C<9gi$-Cz1PS&|Tem(8{@Oino-r7m`e_or> zavR4!gU$05(OtvJn#ca`Pt|D3-tfH!c)BGqu!Hu%2`b%*CbWj1=F&)uA8-cXEXH(&Xh#& z4BMEk9attf4y*7Cs}n)@j?y)6JFg0`gaibf5jtGs+i@BwbykN>9G03 zLswA;0t%pWrNnWa$|-~B!Gq2)ij*&3?u=F2MDW}MrUI491pi%b{>QGL{YI#+rPb*E z5DrEdb%rHiy4lNGbd=cvwbmZK&U}c`7^piG+3C`KS!V2#8``3?LgMmjCQm=yMr$roMHl`Xv z0Kf~PIiQ5*cV47$|2*cjxbk&XPND8)ShDkC!OzuIhQg0&!sV4fM=Uc6L43VQX9MbByw_8%e+h5T0b zZ(h9k3$|LC2!xmXP5}NokALAE9Bz~)!GjIEo*Din(Qi|`{{HmR0a{7!ADTO5AHIE-TDD(C(cgjgC0GlbCVC1nc?sbXtV50Xy z;gi&^8V^~IT$60Q`AiyX=)da;v~X|0R6~`P6Tg&vOEth98EkY{26u6+S}^gCud2DX zAaC8)=JVmy1#XyEe*Quy)G7qf8|h4-glc+WAv&T-Y#;hiOQt^z1jAJiR`Hisq?k0+ z)kDDR4?0kQOnENWMFg~&ID&`SkZOAhz1{x!)j$cQ(*&xpsA!j1T~lM^kUmtKk%Obk zFd3?r1>~dmH$Z2^5fKZ4j4fjW<8@caY73(82Jp_}dIg#MU`36em9@cZB(v9TMdS*Qdoo&bNV z9Z^K1esib7ep;DDdyj>-x3@V+Yaem6A+L@_-p{tcM_;g3mMf~-;<7lyJ@2y zLtju@(>1|o^gUFk?nT0+>ppJr3mzWce2t#NN9TU=p|I~zq(X3;gRW+=-9!%fAcjx# zlxV)q%#;~UUi^*yeaqkvg{b|V*>&bsV+!b1zE~IAioKdNPbYY+27f|IPM(E|^Pf#u z*U` zUg`PNq~j>Ak-WvrmqT2-zr2y(9UD#yru7><)<=_SseSvyiGE44JkIpl%BRg7_N*5n z_Zspe%u?Wiya~{g%Br%}fr_cnmC$Q9hP}=8p#(sg5DJH72W6iumBU?DgFFtQPAEtt{i?hJcZKH*S`Z8KWI~%5jW?0fVW#r#%o#benIxu&hTxk z=T%g6TlM~-ogdhKeh-7-%hUMYLVkQ0Hfk$yus4C}`wbW_%zV=xa;j=-y`!ZmjeX*f zmj?JNlq4W|*(&p&wpBuSxtFSIY!by>dIXvJ{QIEwocZ3!6e|jFYQ|J9uaIB6;YJY!Yf~D}x z?LXXOXJrHFP!2JmyZG|T%5i7pS93rLKJ7qn9UO6+52PQ18Qq%P%J}Nn!5rtrI}aZQ zaxGngECDYb9RN<_Fpdz5(~MhQzWY8j^q{2n2js-CQ^MypN=lOrH=7ZGDI*Y!DAW+? zVdMq8wf6jT;i!a%e+ZMDhQ^yw3&7rRQicXpnC72fwS8DrNcNz|$5E1+K<1yno$-;f z2~8)HX-C`s>w6RSHytn*@IDE;I3vimPhz>Gi+Xl_BWMW3$}<}=fj4NeHXrQ`B#U&B zmbo}BFfGKmJ?oBtegBogKg7{L?N$p`#>U!y+2iONlO5xE6f0GB?vbCwCA~ovJgM!wNpU>q~ z6|0LMy-4*81uyTAuh4BV{!dvlbl|;s-{CBnp0>}u3B9!_ zgHPOC#38z-{9_>5;Agu;AJW ztI-|3VELy` zG|+U~@IH~oH~*#F6b#Zd_z9c@0rB{TgM-7irk1{A!Hz^u#Lkmd`*zV1HBC(}W!w^JSC2$K z%)VOJ)#!u&Zyu>**Pdz;N=jS%B0vqAKABb1iENSS&>a&C36Y;~tX?(8<#IYre9)2y zjQ@l(VVe>AkAgF)S*GaYLc8(goCsD}ShRTapo;=dNY%iuwCxJ*`dW8?WLwYR`kONZ z-T0<5s1yrG??? ztoFmCjX{TgpGf6mr%f3m2FwNUsy}=7tWz6lv~;tv^dHJ0z%Blb#R5bosz*=X+@E=2 zWqnQ=j>O*?Z>x#DG}j-kMDufa%x1vmr}h|3_Vs{RSqCq*WiTsl}Nhn(E`FBV*ZD0THJebBQ6{^;^S$| zj}YAp3&%{r4s9IP$xwEn$&cdMftX6K3m3VtDve92P=pAZ^RL0aSjx6~CB@ zHq?e4OjCZlgPBmXw4MIh#1-7L40#dL(*FW?xGRrD_2|!^B+ZL}zo*o86!yVqtIKk0 z_*Gl`M`*=tK+?s3G)JSWsrPxO<9XyQ`jcJt5BMya7*6TXV>#q>TH;W))~BHGgUevh zj_R>zhgdlM6r#76#5JGn+O^xtqQ?O{s}p(=Vk;5Y2b!4ZA(z1BQh>H|iivZ{bQBd5 zo$BRqKciGn1K%5NtO+j&e0+Kfs@euU(v-%Ew!1&`$h_J}Vd&k`Bd=KTA_)-9qknvT+pXsSFET}^ z6ukQK2x!OooR^`i{ABI3yYwuW8;!4XaoCaK^-RNeyt-1{(!P5Ku&r6Ch}HYCX#fX5 z4Y>LvYyB%la2TCm@4#VUX-)m)%s=^_OUptUT`JW8GTz}?h;kgv(@G5Agv`$+(=}&z z1*fe^+QJelMN89-q^OP#Idd8n`VJR)5vwH`#QwJ_4Hw#Q;wS?`>>KdZ;IkV1mKMO9% z`l5B{{MHsxygaR_N5HB4O9*&(0Dv`Nlj_7Vb=qc>h$tUM1vQbN^C{0H>%dS?xJL{CqTU@a9b zEi<{HN8pb50prSOL9=boIK2(31O~`FiFDcH7AKwR$ALj4q+{bv{WnAkJ*Iog`l7yk zF?s*Nis6(HQ>&s6_UFUE(lmCUv|m1`7#xpqIc?cG21sRyZ(GQUSSyk40Qs&fNDnK= z%=RXgS94eK0}u9({pa86w;Xvy+({^TSFDR%9v6ESi=?|xAgVt=oFg;)&A&c$=p zoZTAUI{a@wPZoBpalgCaYLfIqGM`tBkSyd;c+rKYv-i^{e7#yLSKh}*gb!Kkz^&5p z>v_<8l$=(=CaC!%xR>{j3DUY3d+kVGaQE*=tmeLJJC41Vg?}DNwpNs%fB%t^rAE9m zzl4O5FVU49)Dqx7`MT|P#24x9Ab_g#cllC0EG8BvpWFN~)2nOcU;HPGy6u2MHYAko z5g@rba($6)NUJ1HE}FShmd@Y4UDy?!o>qT!w0-?xF$vS_VP=Cku0#I#D$!HCFCND) zVLRYm=(I^~)i-{1YjMJPr^(AAdpx&K2OICy^Rf_};<>Y|~#1v629DOqr`M*v~I6jL+x<)2>uXyrG1PGImc7@~q8)SJ z)u`PSN`}*l!#_QW>PT)Qy>U>qxBPYr3=`kJ&tks&Cf76VSQ+#JdFGx!&#-_CxdO+5 z6%(J&4+EVx#`5^J2e<))ws{@2sgM&bA%LpD7W~R@*8_5M6Oz7*h~RghZt)fQe<{46 zSDT%l{w#Q+`fx$GLsWU?1am^x1KbNT4Z|ARj-w*Ih!#e_e6>kyBqfDCc-!YECs(jR z<=MV_mGq2y7w9?LOcrafJ5Y#zD&s*e@vYGnV}Xo&Yow8`JDFG_FFh?9QhD)7WTb}I-V>`|g2Rv1Fq>VL zMrgosr$9+K)XUsiLtG&qOQR6q?3EWTU1ZUJ(0)YL{asX=d__@VF6{D=g z&3*ze5jExyH+CPXN%eVT6ax9et}3vaQR5DT%sK|}@Ijc0T3#N9WgvsI!ydW1vJ%mX znvrb}y*U|g8&=$m-voD$*)dFh$IGGN*vV@3r}?K(1J}gh>>{$r;2LxdFgI|$`*WF~ zmSc}43bfBnD#sYz{SBvFyg7^z1=O+LqU$j&V!MR8Xz8-FEh1_J(>&yzZO?Lzii$zZ zJD0z%ls<@{8;Bz-oGsV4$zw;eWDE0GMXQ1N#7FBx=PcTSu0i2DlM4c;bon_z`R!WS zix4XyRw)rC^uQB^N>*tH(cMi<(@gCV(R_x$G6*2w*->5^S0qpK+>}^#itR~ zAfW&06X0ZF>N8;JVX%DlsK^Q1kE0hM0{87-?D)uzm{cII*fv$Go%VxemtjXZ)=oLZ zJ#qe=f>Tbx$8TO9_6S9Y^J)Nu-EVz0Q zm5O`hY=v1AkBtUh*Ro`=n19g!9qRG+$^T(zuy2&ReK}8|;p7GNA>B`Lc)G?6z&U0B z>aU$otOO#Tu`R%ok_Xe9PF2_(c1~yZ*G3 zwmV%@X_hCWaS=OCcb5gNzg;`E!>BlA+NDM@cD+w=J&pszP0C%Sw1hf_kmve6)3^ul z@rN;0@54n?dpaR8#!1!mB{{1tH2cs(8_W<^ZG&2g0DK=Iefy>#l-~5hp}2hCUH03z zC6Bk)=A2X`jKmA)FJCPYTsVQ`YXDV5 z1qdgAKKt>bF-rP8Fh)5?VC`R-5usV|JGHq!3YchFgKX!6*n`qx@Z;gmP&~<2zVjgG zPHQuXTrI8F2c7MOYLo?&;8FN?83W-tFZA$51^a7t}AI$kB z5Db{@cgCSQi*;*9(JStx>4n)g!g$x>TL$q zOZB$;XY?F8Tb-O0R~EAmsC6UbrXasNxK z+S&i^GE_6T zVyQ7r{X%8mV zGe|o-Evr{7r7mONNi1J^e4DUV?|0!l?NT3B`n2$;^RF~>eN(IvdA#xeWD|lwgcM!A zTAvDR{`s<==V{1;yxJ6iCUL|{8~uJ*?PkrhwS{K_EC)mzV%Q_>MVgvK30xAZ@k2uu zU|2_zs<$}ZI{Kt%Bs^Tl6ZX9R9^^XU4gs)H(X5&@h^gbMR%I~TUJI*Z+$OuOvEQIM z^4o$p32@>5;3!n3ArS>w(st!{bN%&LHNSqK*p?I#7@jSI{M=t2f+#$&N@f#RThd9Z zyoFuQPCeYxr z2QSTDKKITulCsI3q<2mPVoVK_IrqZs&t3jUz4z;=pPPdG{P*Z^A%n^5x5Cd~mU+d@9h5 zR?C(+>E%;&bM*F_k<@fe9;$NG!)2^WKVZXl{wra1)VAqc{~PDmPkJ(+WfQdz5=GJS zPJ>y#1!fgF^5~nJcF^VIC-v{n>|xvY^N}+e&wu*g|B)v6v&uSB%Vuon0R9W7OjF6@ zw$dwWfK25dr`$D?)>HJ|R%9DXcP2(0Mz*$pg@Gr_h9|i3c9|( z*`QN}_jqd3>FiW58?~gA7!!99#ly^Y`~0V%L3Z-?ssJLg7H!==yE-Dm|C}%&O!~=q z*UQDr$xr#hOr`miH+TMA-oKpK5a+&VRef|7!Psqg)q6lGF|!KW$c4~>r&7LZO-~Cc z%Y=n{D1RaJWcZeTT>QRqbLUB-9ZWKHw8pc|1pUw!^rFr_F%LDXbq(}O6oG1C)+RDs zmW>t*1`7SD*NysdiHP~l4cvP;afzg@t{&G}Af*-YFSqv3<>e%@jaC@;p@U(|14sl8 zf{!_Q#r2DHUP|D=qQCAnbRK+T+-$zyuf1jmiK9x6%<#lZ?-Gm;x@#g%zv0>Pe?-Z= zYTfnx$N}YgzKl)qgK4e|&U;dnl0;U$3Ym#o~-rMb|g!DCxC2pnY3A z5c*u)P>qXu0HIe1n?)ffybZXMtL^CMJW{6^Cuzx(tn7I%p*cFMEu*C5QoFW$Oonb= zT(R|}gslA*EZ1B$f8C-lzA145?89jxuke05%_;$p%TD6IYS zlQ)~4>Q~Iod9?DB-qF+b~SCu)EJ?wJ87TsW1PJWVJ&#E##3Y~fpYHzdwGp2i?f3)B?Cg2t_=1;*_}emoYwpf>G+kL!H7j>M8nT}d{;Ai#sT@tV44D0*ccY{-4~TFf z8b7dgs?{etUfs*vinN?`;NMzaV2f&G?wMBC!%l1^%6fPOJux*kO?uXIz-{MYsAh&{ zt@VWLWhW+n7FY;nH8d7p5_Ov1I3opM9*O+QzgW9>LL{%cr zNERLVy5%jibpYEu@v&iJR^nhG1&=`SKGuEzs5mouB=5aB2CjFH-nfqukXB@5i>p)mfwgvMd}Bt9wgvX>k}fhrO+@!YM-u$lFf z9$#AcNZR_S=;-JwYDaOgU3-lQ@Cjy_xU{po7%jDDn&6r4oFDH`NEl~R1;=ac@ZCM7fd!R9G2vSabn$uBK5? zp#*vNCEFkAGO#Dv$Yky{9hlQVq0Xk+>_Psum6Iwta0~o+xNYyp_Tq=OzGZDE`g9aJ z4b?APxL{-JS_j^j|HJG}TGngP(lZ^fS7c}w&TZqD&mT)rDSa67p8en^snyqe-f-K@ zg_+`{tsUeZ95>D*0X`1-$cK%GJNJvJ@8a?ct}zokug;O%db&33mj$94C`b_4-Ay^2|uJXd`OOkt0lMvt>W8}aQXd*_+Bdo zkV_$9PRL!)JANCBKC`i+vXgjixBmV?%)Ct9IRRXE25_*KQ(wkP7@wdRAx%q-mBn6A zCUO%XhR?-xZ}x-Jb4{_au4cNO|X>i<$_* zQ{EFKV#1}_YLiM>V3~u}ZjGVW^+U|A5LnkhE9>S6Q~aAv^<+g6q1QFr73v?+k|tTj z)}Pa_&W|CCU)2ovdNfV3M;=3Nt%NaPhAXJX;x3bJ9z=cs@=B zauoFb!l{I1L4)j$ml#3+Un-o3kBN$k>c8EUf!|40yL?!Er7K|Y9doY=_N*k*Rp(oJ z(rxCU+m9c6JQoV;4l=W2_fpv}NK|UMS*B=|9QejkvXglhhBN#LEdXP2bvhq$Y$)$Wn?aV^IdJfW+)~Yt4rfW_}m-Z1pCaK1M=}wXuye#eXfdC6vrXBKAXR-A?wOhKg>ay0vY*V3d&!zuSe$M;6y_~!&d2OT z8J?j+qr}P}o0ANN&GGQMi?Me~%F1Toqa9RMitZl7spbh&p;N+T0Wxo4q})SkR39U7 z99_K_XHw^*9XZSeYzlb$w_ekNg#~)9;TZ%X$L4l)b)laLi|{Kg!Q zty?e_`O+RXT$#qQQNh&j%XDR$&u+4;f5+GszBM#c8oe^=*4-5Ub*bN}#F+0Q0Nu?; zBOeE{P)X(o#}H})jNyN4EW2>4lmkYE7AJJSy}w}^BLM?RT0|j<-m9(%$Nl zKpv=+2?x$Do2s7?6}hQK`8))-rh9Al8n6SHmNA1O2(pjh#J&&zb@Dl>Q z;V}%$v8*P6F-k8{-NVe!yFppxo~fxm{UEuXyi`)P;Dn7jb=mGFLU8Y3i6iu*n>)%o_2xOg#kULXX22Q?6hmF&Noq}3#3U{&$9qB$);W}E8an_CL zw}Aw_Yj8r=^HgGC_5;{h&CtWE84pAD*G69mWg#5`+~;5%soUzXzHhO4Q$ZYpg>I=B zu{-%k+c=sd6OW8KCw=p{%ECRa1T*ZQg%>H7aXP%N5-*s4?77B;qNkHnY_EhY+#CZ| zC|vf%5-2(ZABx3tng{>bBLpl1NO;83F54b@T)9Rhf)YE|7uiQ&} z*m$K9kXqF#wo6Dzgbx&$XZdGY`QWowMlukBf}3;gh)2-=o~*WXgY3h@2`ujkC`6$> zI~AZAFBN-&^53esnA*Fh=$m=2mbIDGSqY;@cunP@2eG0Ktn6scFRz{7=K5I#bjMHq z2>JcNAx9P>dBkUwO+dM#voLV#mALIxX7+T;!%z^*@6H}1tMbOUGrp<`YHGIK=}o3< z`NJOETWxYIqFsM0M*U-g^0qexo?00YlFMmGq-_Q{^j7GqtT$XA_Qd%O{y2BxLKugT zpPZoo$}7o<57%q|A|fx?2SR6)*9@}SU>d5+_Zj7@&&sRp>3WP1KTd5WE%-dveKc7X zKAFgmIk?{=85*!%s(-(y>Wqr*+?bEg*tD$w8bxlR(!2Ad=gRuYE_9byC-`C;1fi{`!hL-|R~S$y z9b5Y(U#pc$2r)s)Q&XY5Cpwzt){5rY!#v7yONQ6bAUEWdd@$}cy2>8bh~VRqFfI(! zK?V9=tMezivInyCc*@5e#&Yxn)^-r8Bzll%F(5qyU zd*7EkIelMk`gGa0cdlK2iqt?DN`ZcyZ#A%biJkD$8j+TkzS}9In|PuXN8w66b)D-} z^enV3FxD9qYE98kre{gvQ*SIjeAdSZp2Den-swNfH1&F}QGe`Q>xnsKI)$srb8tKX z<$Zq)c`al=zRhM|%*N|tVCSN~gC!Jg#aCzyEtCuO<`K-sN zn7eJg%t(LS#?xN{!ST$ZK6>`O!9_Jk@((Im2?f*r90FA2Ty31kOi+!31>n)YaFXZ? zQX#F?+o`>ccU5QqAap3<#HR9gX16T4>gb|8m+Gan%@e!#loZn7IERUR$Itb*Z}VaF z;7_%A{2#ZLB&f`)O9pO(WX_Pq)iUm?1 z)i1sjJ{&Hd8t}3C86#f433SxyD?6(&BwwQ*Jn(ZbaHh_~W?)4TKV+-N-D2srSlPq= z>D#x=yOYZpkhf1!5GjeQle{6(Am2@^C`1x{F?dWo#phBqwj-*TzGLugt4!p3X8qU@^K{Cn-b7vfQ%q@rtEV5We`eX;vQ1a= zd0M1!H|hb()y(XeI(hOjp0X*^1fIW42W9Wmel6F!OYMnUP(up~ZVmxC5s)lD3RoDs z?Cp45Kae7fw5V2E3;gjWK^b~2-=bVh$;*KkK>DI$CX_F{mpfnJc^kAzB118%f`F!8 z4+Aj2r!t}h1oyfRDzdo7pOfg5mowa^H5WCDcLjaQ27+M{?#mBa0ge5#C0pXo%v(8J zLPltRi=K`4HMB@}MKDZWx`mxgT#n({G6w}wmqr_=5onN~=k(4dm*%@(Ml*U zmfA5mHHsxak%XWwDa{ZL8B&kjSL%>Xxz&p`bg;9i9J+0D@kJ&eqRc2r8th#t-7E{Y%`lHCrUapI8IbM>ESMvc3bVLyboxPT=KCl z1M2vL2LLejcB$kQ<0E=XBono4&0otkO4JAow#R!Nz?)-vkxR@g*h`fSV9*H!^y${e z3e3tQ2CYWlH$`tJfgj`}Sp?NZ_UzHy$-ny(PE62xD_ur;Hs@s`OiSm#emC{7`5gQL zh!SD}i-ZF3r37IVsb#i}(IycMB!E!vjGu!?Jb3TRW!cyps3QPMq&C7Wy%v802T#1)WT9 z!p|ZDgpI#K_2oZ_m(ZT?p-#=KQ?Hdl>14YP&S@!EtUB6#r<*q%`g3n4`I1|Qo&CIU zeA!7p0b>EnslAZ~hMeTc)QjiamH)I+gCeUWP9BVh%$;zN`5D=aQd#CXasx`TtK@Nb z)enPtT-!e7B>z!`f(-NcyWN@Ej;Fm>^t(UV?wV9NXpa$*TDGk{kMS{iuoLlt^Ae73 zD8MU`Nj#r-KL<&Uj494c!-5Iag9pimMn=u6-V=tZs!~5)ol_O=MOgKpk|&j zPW4q#gHPVvUWlx}z|_t$>J31AbG*TL`6eYC-y{>L3Wf^vIqT znGlxVEo0NaR4yCXymEEx$Jy>O#~3-6%{VE;Ud|Cx@zPCtSa|q!{sp0`kpy$0Bv~id z?+J=mTzA@W(_^J~!-Wx7%YIlXF*kwaUy4L4VH?SGGAz*75~s}~)7=~Ni0ck;55(S7 z>XcMCX?DKWZ~J}K+z15pl6D-`9^g6|>dMoe*q@*UGQTl@dZQ!db;#j!Cn2CoFoGMj zM+f`#v|=_C<&QC4(H^$l*A1I8b=>IsSt9=HalPi2H(D43%*Rw=H?svhuSV~`r6y^( zy#PwblofIHmno{X#)ohotI^TTvQs&YwkxV!cI?#mSDfA}Iggb2h6<9316HT+$U~QFDz6(>0jdG&pfO+lXi8b=z50vptLOfGovBV%J8jr`FiS9XAo%# z>L$iLF0RjFbd2!pRha2m(Y7gdpm>=%kV~Bzp+awT-E2u8%f>UyR)(qqDLIzeafY5OnE)kWk*@@$@RUDVELj-)bp3NIa9etVRbFLrhOa4_^W&ic+;H?V zjR6g)t8u>hY^AHPLQa;c{A(ohn3V0r1{3+^mxgw>veha&;Wu)By2(6%y~nk$!X@wJ zl;3*Fummmp_6L;6PH8IbjB6DwcV~wr6n1>V!y;hmxX>%?n2)Xn2?j#!qyYj`RKGxokh*;si~=|^~*w$3I*nN1{RgB*GHsBwLhRJL*#AbydAF-^X!sv zG-yLNajFeM(ky7A91E_+Rja4?ue}g>0$_p|A=*>SVGQwO&@!}6UYb02Vv!>|x6^50 zrP|R!18p_j1%MtOS6}Jf?XV$fs>OA-V!XX3DqPH+C+Z&CpKoSv)jh4!K(T-wmy-b5 z6UsaUNSk033i^@3FyNWLJym|@AOuDc+sKCeIMs*G-p0m0{tzc+{%E!S6QlbZuu@k# zH6x3;8Q&q$n+`LkZIO3&hjvRH!OICEF3^dRX2LeiEk%%FWH>L;RORc&*+aJuape zLm*<&a2_F5_ZuTH0Od$f^SH~SH-d;rO(1M44*xjJ2VgX^gcJ^2r@|bFw)Qj_Ssg!o z=>_w;gr|9$9?q(}W;@Y8>$Z;05`oiSnW-rL6lBKkzD-GgSRm{vH-v_yuCy!6C~z1W zxgw^f#w2qE05pZsu;&he0@6Q z<#DXPMa`>E4A{&L026s%?WCBfd56B*&-{A*KQ(~Kql0z?MsbTuCfv1^>4Y2sgLjIs zm15zkZ$cK}S^Dyhz}HIyqqGFe-KD&?boUt?X_Yc0v%;cr6#hl-U4catw9^(7Aam_%y7{LVSSxwsI zi0Z`89~3tFsHk1YJklzXImqZqB@%vo4k@vLX+Pa4?R;#jJxx#cawl|u%7{`*FG|Cf z)Faa%AyZSqq)LYgN!oHEB*Gj9x4)ApE6!72A}0XF7V1W*_?eu(JoPe|lIcM>m95#v zBQ^C|O9&Bg77ZMc8>MAZcJ8+~?4%~cl*)jn+~DGwQ>rzduQEc>%4EVY()tby+n2h} zsK6>_RH*#?-K!5DfI?Cu1GUvWR7}(?p}h@wkXs=Z?41YW&Y+CCO;<%=e!E|zEU4?w4Ve;tz#Y19x?5t#WgoAz~CM-5D!*s3DLihdKxlkw7d0eI4YR$7c!#1AsIZ^h#$l4|U@~8vM zvl;?Vka0YU&zQC_&)y3jtUz!G1!SHvs`uznv_H3CEO3*#b1wpnbe7l9pkLi2RY^hZ zH@!b5Lo!t7k+C}FJw~crnk=Kg<5aVf;Uphgz>2TIp9YK(8>$%XkS&;P%n)dCOf9z3 zUpZd3%idH54ejANt^Y=~oiV07wO$i!mHq#PYTM1#z@h@Dns~E6_QDCn=T9|;osgKu zW5gd*LGxe6#MW;yYjN15#{r9Sxdw;gL^z{XN6Uu`9M^JQV_nB@Tw;1b%;gE_c#zUB zT}4rKp@Ty=gJ6M#aPY=;^GfyRw7oI*r0#8<41;U}2y&*t{L~%X2920}L{v1gRM~5B z?5yT#MLDrMNv8)X8*vMLA1swBo(+d>B}Is`fIc>$E?j)tkSL^cTaC|i*##aJb2mWG zg4mXL@K%%$@gX}^3!{5(!F$EJJ?p0%%yo*nZ2}oZgOwy`D;+&Z?k`n;3f=|?Slkps zz}41o-SL@v$B1#h`};mr3O~F$+D!My`cF4}-s|*zY31_W$T%spuOSFELDH`<6O15kva2zm)4t0ffsyH$Xr*%&DvjR_>GCS;Ylj$as= zA8H{}IF@@j^wrd0U+SUhDQ-!lGV`IBKA`$ZNJ%Wg!& zo{;^`2gD=7I0SusLOs+LGiAGT4cnekCg8L@fHpd&LeCKLYukP=FfqoW;nJWc+Et~W z!LS6xPl}0>Ohwch%6&`iM_-Ye?)P5}+tEgj+S<>ShEQ`2cYirZTHS{^!tDPn(mN<3 z^ng5f1;qzA7^6UYbMT_Wc#UBI01`j>x(S{Qt7-a#Q$CONWZ8qe9yD0t8fl+O^?n-< z4Fhd&gV&V-q%cMwR(7$~-o{B9+LcC~PRKw+SnY00w)8TE3;cW}haWu56T6+42Jx&Q zZSpn;zX;C_b=u3^2+NGbsAOzoWDYIz0^c@WXAvhV7DON1$5u-4;zog0f z0EnlT|5-&Xjw^Q^Uf40vjI%j_(Sr;>s%9)fVQ56X7{s4 z2M1znW=fVO^XZjntN8h7j;5yycNCz z>3Npr2U)CT--KfjFC>W%w10+e83{&ql8V@>cw*feYBv?QmaD|1(y1OCOaee4N_MK; zj@yirw@o3;127FxFO_rXI>Wa{8XVfbV)AD9SU+glmvA!9et8huf>M)z(pS7V#6YKa z7MNFt$-pK{yFqQK3@60u)L3oe=ek}tpzG2;Gs$q2JSax%+RC8hq(E|%5(x)wq#44E zK&4eAw&*O3Pzrfui$v9^0PJ(hwmkD7ejg#9fhpt04I2;DXLmx1F4i)Vwl|U%mhjci z(jjosuY|1d<2$3^Ir(NIq}6d5-DDmHMpcn{_v5dw$w!?1%(j&%ST5zMl1obm?}0ez5MU{QVHIKRryb4G{Ks-DnhQ)<_# zJ33zD^@@lhZokM=#!>v8LCK)4o0V`gcXkZls(ii(R5gaD-^)9_2eDoi9`TrZSYQP6 zoJK8ywehrLux&Yudx>p_mhyLhpDgbhZ{A9V5>iGl)aH08bHOX1b1&=G)9Xgx z%Vk#$5Tm}r`s^pcfZiZb8EG@ zZ8q2yI-!EEa;58oWn=;izy24$nm7>jnPUaAp703%0ET$bA0#}XDz`e}O%HLKM#A~Q z@wNUA>huD@AbcaU(jU-}2jt9QM2geO1b+anG&Kz56UCXkadV8owHFi`?i%2=9TfghGU*VGO0U1pel%{JfIWbm*>HE5ITA!huT=bO(p#*Yo9_$Px- ziA?8Eq2*}6WmWN}-Hx3GM|N43Py?1n+s7URfEr&Dh=Qp!FM^toDlPW`y?^>lIAt^6~!{H&Phv$Rk)Z9Dv7b& ztA=h6qsAdsIevQvzRDwkk3g-3q80c~W=1A!hE5j}HD z4~%CNr-=V!#xA`Du2%iD*doj&vw(9-c0=ff!Rhl^321A#x3TiCXo3DsIn%#u5et)@ zvJzxHTvb%o@CmBkFeL^KYs@ZtQWl_N%r@Csm~nzs5M+ESG(jQI%Xz%QCGBbqGxgw4fy;9}R-I_1`zbbq4YnT`||FQix z{LgC*4q#!Rg97!eoAayn^-WK492Pto4)K*YDm1g)I|<=Zk8AEw-0Uk$fb^V~IuC*` zH`jpWTJ^g~ZMBQB0Tve&oAnajrf~6pD zXrRA9Rq0UM-Rss@-6mjPL!8i05*1Hu2MLdfsYuMzdc56>h`w;TZq%qx-= z_!A|*9@2)2-`Z+= z4GlVJ+M7{|ekRvoJ=%W*?z4w&+rrwY@Eo>eR>J#gIDp4-N7R=*GIe!XHfD5Q9aYYM zyaHzU7ICqnI@9@Fbu!VacFM|LM8Q^N3(t0_O}B(j@2J>rU7WP}8=BpmTKe`Zr}|Ma zQO=G?0vH}=gfXqr=zjnT@4rSet+VuT1w9f-C+Jc8x{0Z>9!3`Hi!zU)U{ZZ!r%49( zj#gqV75Qg@B<>CQl;335;$pZ^%RiJ8$!mg6F^dGTu4O| zrn2Zir87!(tL3+o{dki1A#O5?% z67pm`_vZG8G9Zo1c#2s+fEGE{0cep3gg*}^Qv66#aif})1QMR6>Eo%|@Z%{yO0Lvt z$g~86Zbkl_`$*UMhHL$I<{i5;MZ^R7R#Y-7hp;-LdA|-xMlMCzcP0w~TNK6U!v*Ul zCGu?QG;ZsuYucohN19L_zb4Iv%~cV#snHgz^ADSF0WG_sJ{*24LEV z6EbUcCKZ2NENeC7_Z1=BslYo5*_p{-bLTPz=uD%(ZOt^0p#w~WG4v4~0oh78s`b@W z=&Gn$$>b9HgorPAX&aN?lAU4Yt zE{=N|WO1iX0r1NAY*zDrE23vLM2TamkkKeiY`3~{RoofM;ZhL!o zze9?y4j7t;=e`G&51ht30k7>>n*n>xK&w2fAlQaiHPA}Uw;Qj<-ywh`73*&5kVqcpoWnmh>f`&wB9^!9)2ZYl(tT408D^Rx}wBkMTe(qr}GB$bw{PlD_U#}`3ua;TTX0+o5aj{B9-2j1LX#A0d1tq za5}+$ZkkjVIh)u+5zESYaAji}>%3_!`Cz}mu?n|nlS2%!8G%MPt@L_3W-l;ER zuumaa`E$wLy69bx?=V~43kRIX?xi#*%1h~V_R}2)wzj$M&8puq3{+Xft*LGZp`Q?% zF$KAQkjE656Ukb|UKQRFV3Wjr+UY=MDHfRZ0m$GRj9DLLc(`G;jKnyx;X3|D2$$A; zNAh&2aln<@Gs8bTs4~#7S{%tfA2z+L+4|!=K=t#&w>iNKaP;h2WaO#Rxn{6X1Eq3A z(r(bgXs!KcxtR7lt;LSLbHP6ScL9@&x#yik7O9?wRT{8Qi! z2)*}7DO_p}Pk8_}Q^Ozjaw;ZfdaL*D_bF`vLeq*a&BIh!oJF@M0%TmCWj%s92om&h z#Jg&Z5mh@nyxesr^LJNmt?6p`Q9!!TN{5|I30N9-<}xhtc3%G7rPy(E?%a7ti>H=7 zt++%$6Qmtk9ANE@dn1FY%#hCuP)TJNr%nK*!Z=xwiYf9WZx5y!-V#b9WQ-#`Y?Epas#bpNic^OfdxQ^=@?#%Dr4xJY1Kk(72$Vm z)@d9Z3kWW{ybZIoM?uxD8{qIf%}bt{M&beNB->W|ZuBy%EVAfw&@_TS<*+#aM@Bz2 z3)ET~-{fnF@@F0XbiWI_)pFFaLwH)eY3rRw2_=)tAo);FjXAWI2K4KwEzb91#atL! zv~%&VkWl*w3PIh_e1rA``74QL%L7uq1OTQjG3nRb_>eo(GH)o*R=H_g>xZZSb6fF+ zmc%(TQ<_z)A|O1H2Z(8b4qo2;_leMX3GgriRL9T&U%KcP@sqTtT98H_ViJrafAz98!>xFw-rV{gkbKM)md3s{Bhivw&&B8J}t+{pbWp-@0ov#&Q! zcIWw?MOCZ!3K9y?iTh8{f3OLq#+PxOzI0Ks>8rSS_IxgV#+HWB7Bj{ zZ$m12%&i0u?ve*l$Fh_CZ1~K}pLnX!b~2p<02mU#nM%DlGJ|@$)vhDmc5qLjRlQi8 z6yzwNjr#7s>_1(@598&(5|`bZpkRBKfya~o`0Rn}-d;R3VDb|vcF9h)e2{%OHB&Vg zUwH%YT=Y;LWjt^fvDJ=Zeld%Ww@m-!0sxm}#ULZOfX#OU0KNagyvBfo$~oRQ6GlF< z{(eAMm{ed|D}AW)$#DA8(*ajdTD0))CzhaC1ab{1VStXuo%HVvVNepeEu6h>17`Yq zT9IJ#2L@PjGFQP<>Go&-Uz#G0Ebt)NhpS-J3DgH-YDnJRnX3$wI4d4$?BSoQFhj8O z{JvUzd!U+;ZYvFfJkVxo%hYWZ3FC!SuOENo+?SW1AHhJ{1{z(m@>F#OMibw6xpQ_- z{`}#Sa(_@H&FQ8piYGhuXfrn;8r0*U*_k`aPW{;FLv^}wz-6#7d3uYO8hu`!`n?qN zPm=-%INTw(pCmTlRrI}M)FpF((NV1j6cj~0%-=~kn~c7Zyl<%5p*Gz&HkkPb z1Sm!No~SL5@#&p6jf`mu59X8&AQ)H)(Oeq40fXSZ{HXd34_!}D?=HfkBzj?)_Zg+Nx7o7qpEO_Y1^q7gB~XyX|rga zq2-=x+tc#S4soe+(O;f}iRLIovbWu7zxCH;C$Vc2z@ImNP0E|Y)W!2Q-^AAZ5AmnF z^wDajENOWDAQ=Ouh2x_SU$v$O7lVe}C^$&_R2)g!$vSIp!<2fa6%Zaf4>Zu$P1UQm|c6v zec(>YaFJQ@=Kxol3IM-4;!zA%$FsY28<#r%%{9@~{fT?TFusC6lb28Z6mqR&-${*Q zXZDC)G{`*3ed{*2i| zy*hSY$L26w$gQ75eh$7Na_r6YnL`(QJq%S>Qr6xr$|e1_R+*CBZAhmZ`{mVi89=BI zMkd@)E%CbDORLRif->6{e?mbLt1?QZh?wqj-3?&2jJ5n2JK^By7|LUoSH3VKxZc@B@BFGw4QAie`KZgZPQ&C&|1Dq|9tWJUD2d9(D;DVV zYOk>grZ8LK3l|HIlPznf-dC-Zh=N=sj_p_aBiNvozpllz?ibZ$b?O-XB{Fc8|3$@O zi~6p8YD7gvMf9cPf4PP~PxZf7_0OMlS+MnH>xI|4qD2eq?R-5}tLjCWX@KUPwAxw; zGfn5k#-bmsF{4v->NpmRwSRnTIU+;vK}(s(8&PHu@LZev+syK}e_6o4e9R#r=!CHh z0#0s)ABz#weL_ht4`sH$hMb=tU6Pts{s75+I>|l{224IfG3>mO7p}ci^*5qa(#fH2 z!#$#+v!qw-oO76X)D8(SOjw~>l>b@)|9YkWn!udo35tu0OSmYh!#DY2%%{;4&jlgf zcOI^hBH+}IaPoW)2f&P|SI2d(sOzo~U+JkFF@}_@tkrB15)?g}e}=wmVo`DW4PlM ztH1motzSc|_m>aY^=LB|bXNbtCgegiyuB-bgSCS#2>;(~0j<%tF4J?2MT_J=kRlCR z&PSKtz3xI5BZ});)V-LC`CqAJ(9t8n<-F;F?z51J{tr%?`FHp%&cqxzK;@&H998}M zc9+EtPwojSEOb3U)okehh50oclIiMQ_jll6{x9}5hdi(9^SOGkf;q=lR}~vhK`^%U zk;sQ5Ng^+rMhKbwGqfvH5aKYRsL*a(_PJa3@G6U@@=Q1yfj}Ol+gi%iJ&@ z&5R~rx#Ii^lM5V~AIXHWpgrP2@rx5Dpm$di!_yvlVjR!Yy;064{;?shLepa)e}GQIQa*Gp&w zb-msVH|{+<=evcspZXjs)ZQ-zJl;pWM6;6oiVAJ~E}EM6qNLIr7ang^e+;2oeTis> zS}Ca_e{191*8JO71YAXilp5Re?ihron-8}&NLpRGP`mZPEBZpM#t9Z4L|5YJ&U*J4 zs`I^~YS?jN>|S5cXLC0kL{?o=3&8Diw)fy&M!lQfmoE#uYF_IJ28sBu<@9r zu$S*2_ls6GvZ{N8wGfBy=e_(}>wVs^aNtqtxa`9%BYR!pv+JYuMJ#5fqGBu^PDiK< zad2&WrCqQxM(uroy8gh;(yYR6m3(V7V2kD-o)^I?#yWZC>5m^DEQV)VUGN2=La*A* zE4BQ0K~X7pw)hv)(cDwL*|Fa}woJ5K$s1YmZ{KDgCzS*w?m0w0@hC>9#&2pdwz?-P z-f9dvAoBOTVNmx82N##vF6gt?P`C@}5iB+?3HMVh?ug--0wfMzTw=-~=Uq zXn7>#KF0JpxMq8@u`v6h8ld2$3ge~+OwRjS<&UNQ@l!Cmc!$B&JZSYsz#-D&i&w%nLh352}pzpYSIN4%1Hr?9(V2_sIaA&l0wF|VvVIG z-ePw@*Sb$5)VD3_iXVD>P!WJrKE+lq1|d-fX$I3hZj~Pws>UQ!XmJLqsnHuXH4u+R!pA>E_|DXm5(TB z@Q2narudLa7MIWvS~>O=!_bK9C5K%PMa(IzXsw~ejpMN2HhHC9g3^ehHi3Ab0*8}d znC#p=hEm-m zJsYfSP_ggs{fzqL0Ty?Dk;ZO!CzS_Hlb|c1)@PB;AU4HxR1#+t{AhKG_|L@pD--ZR zm%Uz7sjv-OS&!xjpP5(o!l^Bc%LrHq@ouIP1B)^Pb#!zd`q6`~zra5evBXSqb|Q%5 zzD^buThY-lihC*e|-Dr|CI?YOF{ zDj>I>Oi=K=T~?_l?Rv>tMRzP76?IxQE-z8uqxrdlt{b>A7*WVW?^ z#yX0^C;|#1Dgp`uD!oQULAp|$d#&v$e8=)H#$Gcw&&Pg?56_+rd4M~R zmaUvNcJwc*$DhqPyKCRDDLeZQkTSVHF-`x$SC5(w*4EVlCdSoT=wGYwpUL=d&I)|V zYWF=btj=->`HQyt&u@aIZsrw3>;%fU)DXb!_|d3H=veLeJzr;o~TnSM*;Ch5p@H$LhZMnkOm8<%$me8Qk#~r3d&X zSxgm`l`SunajI0T!20}4;f`&iH$C zw>i)Fa&(5tFy%Jo7^ZS0n9IOSUC2H|`AXENR!32ML?bo2HE^8U_5F-SCkSTTsQ~u7 zTI*v_T%yvWl^089E-3SY_wenJOiLuhtg$q;?pOh@E4HNU4B?vXwcK5W3#Qk-#&i=%kPEd$8J{h=5*4IAP>)@%aLa`vA2EJq`{oQ&KWowQGCm4IWnm869IQ;+*wGb=iXiQ%k;xJXTbrzS`HBx3ssTNMCLe1`v6>H z`mhRf>K6seSVe)d$>(Qks^f;#WlASD=`KrR%=Y!*ma!|YLDlL;@*9O^;%q|Zl=%)< zC&JXCqOTx-%kY=&iaVI>%0y{rHB)FSTdCcWFWUlmuss2V6pUJvIW?@C_Z~^ruo5dd z;afGzTGdf4u~PFG{kth_QGS=6I6UMuHR;I4;2g^_Es(w=lk}-$oaNkDj*dNp`Vrru z-y4=4or7|T3s!RsN9@`&Dm@Zm^iFTemdHKe=W<$RTb?O#Mee6C#O`4)o(|H=FR=wq zm)UiP^I*<3j?fX?#buK%FrF}%jI+qz+`@PHTh5SiugY7smFG2VE3C>?n;f20@PqW^ z-M@}iFJ(#Tncs{ZI5*-cJ*a?^?7n2Kkd|kulPlM~rSU3$dpl7aqBgcW<1Lx=YW%l6 zd-ARGDP79*9t*?i;*amkejP}QRXiBwzkp=-I=H+ ztOniDepVxo1^Kg!q-cMeQ#p!|8fufGjvAOA`DXJ2bSaz3{$q@Q>7_xSqeSb zDD%CWqpTYU-WyOa^<7IZJI%^p+2X7klW9VzDRxS+De;;9W2{*SOE)z5Thv!9$N8+b#nlYWi|&otPA?0!8b0ygDET~9=$M^Ly$dMQwK>UW z*}2b+pAp6vLOF38KroysANfj+Z5gYz-H$BWm5Pe^fJjt%G8 zi=LHvlQx&ZstWtKKA~+oBlG4W%6P1|x}yQ)rFpf^<-ym~E(JkziHaFmVU`$*5v=k= zr*hBzLR+*+Yxdpn>1}PCVnv+zqG>d(3KkJ+CeVTBt|}83{MAVbbmhOVZd&La+nm)h zoLMeIJFpy?L`s2l@;9TGvk-I8TIo9(1=LRvc4R~iS}$D3o(nRrrckI^GjGT$Sb|te zMu0VbDjB3-W4T02&%-!~c4CWppIj&L>^flgLSy-7DN^VKd=5#p{-=efT?oQE_#QRR z)rO4E2H)S^?bb>>N!}~k*yU}WtMapQF!!}`KI`XfSy8z)QFO*h*xn7z1=>X=x_?^z zR2cUImsB=;7w@B&*`XI);z(mbZ?B-=4CZm?m$j`7ZRpm#fD#w95Z6))-Bl;ww5CUC zrc^bPgy0d{kZBdSw548VPxS=TlVEg%!1k)#FRZbbOgcm?Zn$`@u+YbqYAovEmA4Li zc{jPYiCW>HxH1RLlw7(AjOJDhoiEAeHQ5C{)rqhS(NgwnTz@Gi5*iwNiKMRC%VnCu z=xUw5v-yi%&eT?0`36N@&T@ON;5zJUgqmhbp$Kj4+=O@iv|`@E+;-&Q>B)5FP`9w` zUd)=K=;~#`GXdfx&n_V(uy2B){9eug8*5^&dv?Z3LhOrBxNiwU^2Q{8^WmoHO zy`=hXR`h1V*IJ1Brnk==8l!{bW>H|}fK*8R1cO2ezqw?A8&^Lt?yI;EZM4AJF}pc! zR6o|8nxg_?e;096b(KsOw=dHx&7>u? z9KgumS>ApW^Hv0sp4t04It5-$dT*B^U#ioWn=d3U;8r~1e$iH5K*vKlRbyHtLw!a> zf2_$YtS9EdMxjo$ah@#m+2{oHPW0CiU3!RfpLGsPhfOq3v}RFNYmCWWkDbHj77t9= zxIB(wF&VFR=C}Fpe(PO)b^jykg>w>#VP&PK@}+Df<42P%s&)*`-&c~233=g4TYiK7 zpz2|2P&Ha_bm2pF9LlAcbD-6XSj5Fv<+IKt+L~-zM4s{NBIvt!i7NURMu#`+NiE~v z=Q={YC3|^P)!kXIqUn3|aJxc#>>h=gYzd>JeL1V}He5wNSuC={$^S9LG+@dC9L{)boZqpsp?ZU$Yyd@uIvfZQ?bbU&=CNCmER>5<4!stTi&o&-Z| zUw!5%l!OLZVCfLK(v{-PYXN3V@*!MU>KP5zx$K3a3vSE>Dhf&s6QrwDQ->5Ny%+OX zA;{5O!Fc54X=q?(fT0nsb8rgx+Wl#${o#5)gf9z26N3HX{yJw~6S}D00An4H4I=nL zbVTX9-c){v(Xtvkf|mQ|c|zJ-bHb$f zzGt}%T>^&Z)ZO(}qRt6nt@=Ac+;Co(i4l~j$n~QkUg*V=6BC6SXdf3PIpr~BjHW!l zo9nC}VabiF&;&w;g>0*y#HKf{x z^(yTF&-YsL?iVFd)j4oq&e9Dg3;$C1xZ1cR?U{+09p@jhOR;(h>BOIYRmlBcBS)`yPFWVO+qXii~OH7CRZ_;By_t^ z1dGk=sr!$f5=^$6)vz^`r}a=`6w>RS`i*U&)ZM)RhqV=6#oUZ{4w%U zRy8WuJhoi}AwUvZ--p`@K;19W?ozkhshfQ!Gn45PD-RsrrXw=;5~`ZBE9YqlyAPNW zNAtCecUwe5`D1=vqtHv~)b5wJ#jy4Jf=}$r5_xS-Os5zuF|roS#KqwLgytH8V4qE; zz^B*yHHxu*RRxGO6s7AOFEPuajg+TjK_OQaopqU_u37|$+lUohmc4D1aQ!>ms z%tXMWjQ06K<$V<^R0 z-2BJ|Id1C+)bl=a32I@ZH0z`&Fe~UuZ6sb|A0edU-z}s_4?gQKg;m`m1cPNBo@A&K zg3&Q!hf(5;rom{4NledPm#nNm6jsvkGDFdOJ z(Z$)RSzq`x?3nE4G#2(tY+0WAGCR)Cy7Qs96nS~|p6r1&nbUO!;IP=k)RQPQY0S}e zN`FCxS}`A??+o>I^uUijSoShGi8GPTD;sTZT5D&r+^kULBPRb-p#Es*z~;t>fPiA3 zwr~0S>DtoM9E?J3NItnQMTYq+17#yj4oZ=sUt6T*%o=SnC3J^3<2#P;d}Q`I-iLMm zhi>MhYoZwWQ$B|xQrA|sC@uXxd77&=kE9;L5=TL9z8Cn#fKOu*XjN)sKWDhn?)Y(6 z$)%z=o@5F3a>tHLpNmWW2J-#Aw)sX>DVF)UWQ&09w^13gP}xd_Dv>Z=0p0oT2qu?@ z$xUYScSpCjr7NkA@JL!Pioqr8jgROO6@8T>WoBIakw4LI!%-*;X$LY9(2NKNt55qg z_3ccgN|zCDZjNv?o7>A@i)2DAsDQ5|_g(%CVnl z+5;xmHk1nZPJ%$$-1~IuwiG}>dCv2D7Hw_!H=j{Q7AmDYZ==Ph#tJVDn{KRsZ4yzy zY${Pccu|rS9o^)&n)P?5eI!cj)|3(i<}9hhSDboIM-)RI`?neQ{iAh_EG+sqXWKis&CakUnp8?EMAFWp(>~3lFwG$v zsNr1b`Pf{9^J+2C!)2VZGX~@5? zhp$uPJfInSq1&XN45_`Q8ym6eM~RC`Ib?qWEd-^{@cDya-E7wx^Fq^+7#iZX4!W|B zyA;nQG}D3^GwZEP;+KSa>t{3XUeE;U@Gubh+)ISr$J+zy7a=*Yj5WWVqyX2|fPlCc z(1XYSAYnwFUw3(;Z;SD2E*FBmwp?6V3N0D+YAPH+G!Mh!)jk^sU9sGRGaPrm1^9sS zvviffG(MzLo$NL8jAjaGy}Y`6`|ZaZB5skr9j8xMNDubF!L2bC_S!Rq-OTBR zb?63qpsiuuMsqPik#K)Co-#nGZ!FBKZ0RCc^uEQ&WtS$|9SJxYWU zWi$02U3Zv@q9j$R0i`Qun;2|1XkSvx5(_~t-4VA6{E4}8iiI}bR21e(X^D3Bm*Zzs z*i7Un)?HH7NZ{e`Ogo_)YdG?g9SwxKe{UJfZadRO0KZxxICk^ck8f}0#+=4AhYmM~ znn5owNM3REpBW~((p2CbQY5WEFw2kEj@G9n4qtOo?g~H2C`=N>-aq?Z5kV&dSOQNy ze+|f!wwBOe_4$xp8s2-Ohe3~_x;4w5pw!0s>7}@JA^7!-(e~r%L*-d5ryUs3dd<`2 zSf1Riy#i~stGVnsC`tQ_^63j$^loFv(Ytd`u62!|WgzB7KKVu3#AP#0^4QmxmnPn} zXm2VdcM{sEV9jY=2&8M?G{8I?;c;0@rwTGKpR2y;{S-T8r|=aEtAK1rJcJS=ug~n& z_E$VI`t-jX^vafwC6{T-|j%5Q)S(3O`7tM0JTSZa;S77HI|Ef)d|$4#+ye*X zELbaMS{RepL=oK$VWSenY9L~XhUPe$Cs!;D!ve&#&aTh~ys-6|aw)MNpB^<0*xmbf z*A6YYaW;W1_5I7VpylSZ6z2fwrdf`3lEnr+4_lv*F>Jg8cY8{3#Sz1v<#s2U#&ja` z1Ntgd5UTojXV)YSox3TbA|8Q zD4BZT9UWj7MH;hJ=Xru>oG11S`r$G9SKzN(YQtD5t}AjAr0USt{(1hWfrWlpG2DO3 zUv`WMcDRSgOv7Z4=AawL<_AmB zh}eO5VpslY6M;ux_7V7PBxmDL;b)rB69>(2I4Y3)nlD`R=4mVcip+4wcMQ11feR2O zK%nDYN*zhvED z&lIk7tf|?(EAovODcQ)|@+@MUHVnfU78b!YBd>=zLLsfCBNA$`L>+DH zo=&ubE_`?3#i2pNTDV~$S9NyFRr{3J!o#IY;q40z_hug2o6c8AtABFpt(cG(2!0Ob z?Tex7?E?BR5N|jEOcBjBY&*cQ%9ZWic<=4STHSanIhrb-Zpqdn2nrb;hR1Xf@Bcgpsqzf$oxQ93t=^0C@JgU|m6Uyg#09ajbQCJ9=(jj|zHxJB|=& zS+i!@fOp8#XR3=)>esyyr=hpQBB7fJXFN%Em5tqde>*3WA#uIWxCWAAUGPV#!L9S4Je}x zI%aKAl2dp1Qq(*(@9CFy&=|Q_3pDtLNE}OP@N2exXQ!9<&?Ht8!-B5B*MUmfwmB8<`Nu; z9NdnoBI(uPnu@nx)$o`uKX5J_flNB255(i_NCS%C0YyaQ{DTg<-i;zX!;UhpQca}$ zE2E_ci1`cry32g*y5G;(%VP)SF zT!HSoK!KY2ZL~YFX8<*@#4!#KU1tD#>o>OO!-}W3+B)mVtIaJ}OyyDjx zdr75hU69}$G;MI|A(S>bT-7J5rD2g|4dR-BnEeEXD)l#KJ;(A30 zac~wkXF=Z&s+l3NvmmJ;dVKDnDY1Q2uc*MIOMO8BT2Vf7v7hz)wf23j(Qmb-)2Q$= zoOhgCNcM@tEHr$Bd(Y}A8tEaB)<2_MSONw8aS;6gT zd7K5E0C_`4UbmI4mDTeMIIGM-neP>}q_p7Ayx@}Apfpm51(SmY=%UZc@(`r)RA(OW^{wdEm zk@N9hQ|H7SzkaIOUeQJEfp#@=aPx&jn>9T0J=r>{NNW9nypV9+iIs2mBtL8%YdfE8 zkzt4&$_H@8yoVYED#!u{Y{2!zz~^!B-MTr~SGu-+Jj(6tlf6Fuz8#{18XVCcUa4W? zB9@D+((coGxTf=#0^12KDGBD@q0$5AwZeX#J@!7#XO?aB7< zXBL-s_P~n9LvszPCsU7yE|jetO82+-HMWr78$;l@`fRmCL>vk?ROnL!KBStpV2Bn5 zF$$_LzLv%#Q=P}#ODyx*S+sSDmvnnR*^VKa zYL#i0<2bP*x)#CON;w%KL6tx}vw89HGE;r2&38yT7>PnYhFwKZ?Ip@vKgqlbDzllZ z{3h?nDEn{FjhJRO3qF8ebxvq?6J@4iiP`2YeY#P6+X#B8VSY_$xk(!Qb!%q1!%&0xT(D7M0a5NWedOx3amw4$m5c1A^6=13hm?a6jx{(7D%j_P-yivee=-MSj zRdlCV+;D#WM+TJl=VRW*g+)a|S{d-v3W)ePfKlhJo!jjhJJfVwr3SM-F{?NlEwKQp z{K>_$Ne3}!AZ;YnY}xdVN#jD)fb9d!(8er%Z6R!Wn_4u+BpNk}u@L7~B!&};Y(0$qYNY%# z;^A}frJRjqy@_G1_y*$J@;m*@zzek%Dh^w`0DW4n$hC$tU6RprRbO z$ta3LF$C2@@1jwTNmw%GThVmmV(50sXPJd$i+86zX5$DAoGQ4XhxzI=4+NOKn)++@ zBX<4GVMRS6+)L><#1wai{ngt!A=B%4-qP(N2;{unHcw=fLWm{h^YDHz2!U(#eb(aP zx^8}ZFuUoE514^xXMX26wA9=LhzS++5DO{^cdx2kU{|KkX;U_SFU+1lDIN5Mqpc!s zYK%1z1U8o^(l{(vD$`0m+M2I}@u_24-}uXWG*Ez$6ul3$+m@&ZS(YBE(I~b+7JcBh z*NF`Bk5(ZM;}gYwZ+oQ6a+wUSMK17+pW=$)vS@Aupo-{WVl3pI_9TCRW}2dm>g_5y z+qbo;vQU06C&jmWYOegfEYugFC8{@&kT?8&zW6!_Og`5cfhP7=Kecx=7tb`Q#W=Us zc+P$d{k*@mK-EE})cLlDx3wkU@s>jRKHURr$Zy6O_AP&YI*bgzsClEm*lP)zw_v!j z;AQ(HZVwTY8g6#ovt`yaBu*2t7Mh1bD)wSLp!duOlqn%#|MtOLQi>t~VJr+vh|0)0 z)H5TsQ%+H1wf2R?FnD`2S0zMMKkqhSv2!D{4Et?I^OBYkK3k2*g)A?mk!IRgbGI&a zIdS}0z_qgB^f3ls39Ipwz7d6u&oe1AaRhJ&%*vhMJ%$^@5l2P@=23a4;JyOgO(~9E zD(a5vQ+4fwBx(#J+Pj4ncUiO0YlfQ86s(?1_BW^O%6o1)tqu((w5uq zg#W~GZ}Z-M>~mf2G}q;>u3*eefx_YGCOEAIjp47Tx{Gb=mfmU49ok*9{S{j6uBdDd z!$8IPHJu%e(N|P$^U}1@oFxk5G70b*ftkgZm+qzRLE=>v>x5YanliDKO>~~(aI;X0 zjca85=o9+f{@8Gis_Q=xgwrhhs4S$3l@yr0*Ql)sq*{62Lq^#_qi&+m}X7e*;6!`@p2YFA~`08h=8kzB1pA4L}HlL@FvZ&{7a~D0&xR*`HpP z>yNisU#a$$~dIGFsA9L4_Jy9^|IkGrH3~CjL(VgJ#*G zo3qQwFZ}SAaKlTxoWDPq>!*OUpZ?+veH*#*VJ9ms?{rN|J=KemP9C1NmaX_pKRvwB zs4p9x@K{bNoPjT5X%Q0wT>ib!2OEY9$g3-w4zAcWsa6newzZ`TU;u#)S}6(C7|KA| zW5WrLTYEj)WB1kjUb+w+Hih=lSiAK{r)m~7!!zhPEP9TEr$`JMmPb`K(_;{c05Nz7 zk@jK&SP5-j$#d-s+e#U=l~QM(@ILP^)mGXatDPt9%VS}{@E`@_5U)#Uui0cnj>MJ& zFO5D*fEVA@SnyH1P!{YhK$tP9bD=qI$2DU-r0D6Y$OlaEV?%zvJAR+TryPoY3;b4~6j*v9pHF0<&U*TRrTdFwdXNK=9WN z>9UCi0U2zZt=nbn2OIo~SYN4t!IOrbTO~#J-sv#6rxZru3MORi)LtQts`=4?!jhghx|oFTXQ;_^t)VMTv+vo)@o4FSeniRapcLPoXn z4YYUDGVNIIg1sM#^WwsN!a}7vLD^F));>3*(eDtp-mjv9@7mrzrCs=RGS>fWF2*6c z4g~cyJ3OZXP$qm7)`wG=W{?p(>DaujKpbTW70THnYulaBN#M>)QFQnA=w8&!x7cq6 z54D0K)$D&SzIiHg6kyV+vEG>vp&e$vOZNmatet6MLN2xRf@S^?A(vf1+Yeknw~W}TSRwvxx9gnuH#V5CYDSr@GgUr7h2Ae zWMA=Yox}QB-XHTDU#2nMm>@>Ocp9?cOzla7+qv5F3D3ugqWGeYwbd71ZF|cn`~KKJ z=3~#n<p!F)v z5gzHl6v_czjBCkQK9ekwWZ@w0|8+I7z8ban)3Dz=TdjMfk}mJV`UEg7-VA!&P=%NF za0BX5Tk1}a03vcLA?;YsJ{$x8(nrxZj*DM2{WNGVR;nqci2bc&Z^hh-;aV72AY)Xm z(U~k9E*F!KsrQIn*|@QuV9@$iNkCmFELX&&^cs*X^1SZb-t=B4>%h+uaW{pr^<=1( z?-+fmqt$`6bD3?v@f}|5dl=7$?Om%)bO}?K~8p2xllT7Q}?Ue-o4@Z;dG5o^i+E_g=QG< z+!w)yp<`@$>tNtvvju~A<%7Q_8n1O9a0pc=xs>_zOUrpk=7oK%IVr}7q?4h8wqxSrpzasE9_3unRqgMsXX7)$-1{{x8^7mD>Bc-%Lqv4E z2B9J3)4WR(%pBleQuK2qO|VYUCEBR7tT%=~<-1wi3TTCzFovm5Mpg@~NArI~O%b`@ z%$G)TBBK3#rUl#i0ZXCv?ZHOX!|7?RPYI#YAM$vst`pg{v`-djMhb!JuXUsK-bcEr zEH;&P`|K{2xIQA6O23t_fNbt0CDuJP&W3WBDN4a>mp;3d3u+%QfPyX0s&&@{wFxPZ z-4@KANXe;A3uGG4>0VlsuLQV(siU71S}ofvRIdxTrc~J}f1_SlE=N?hGuZ)IgkN?k z>UXjAv#9RWgSt<)pWB!2Z2AIp;!~9AJ(?42|kLB@n&WRfF6_6-#AYS6(&Bpl5;!g6=T{p_3O3 zdRJ)a-acRzLQNIpjs|3*u6+z(Fqe3X#_b{Z;gZoX{wUOjfmO8Eos}ilns~FdzW1Kn zoz*+(Dbq1z5yUlbcSG)B-)rX7(bk#OK;Abp(5uFE-O7g4e!CaQ>ad)QT?!-T9DC1c}&V_4__(Q;!Vjo zhfSA|ZJy}HHZhivZPGXsM-}4If^SH>?3`mCv*Hp_V#!_7-mPiR{o)hRxvt*idK3C? zvW#kgA}yjj2_!thi`QWng@~xu7hcsK4wGP1^E0mv@qA+-OZZFfEpsd{{7$wsytE~! z!d%cLfB0Y%dRfjc4iAvbj#YSoeBP-dW9YPrv4oM3_23NOS>zm%>(k2HBcZL zWNMqZf+m_f=I1H549#!54=l6jGB(%&vQY7u1ZYjnqnzHg|C$-`@N2!R(q#*F#WeGn zFUXlYR^1-T{AFLqZ(KJX8MW-b%QQ`)B8sG8<@)D90XGaF#Aa##J-w#k?!?5UC^3bS zH})xKoyGE0p+imrFKE9~lNX--Sib#$HxU@*%zEUP)0Tnaa0{iE{nsbdihfJxB= zyy38l@NX8Yav!QFq6CfnA@i?i{>Gbl_VEi-HHV_OB`|`b?H)kj+AH1^+iuUbXf6N&{T;1AVDL9)WL?QxeV`68Rg6M_Cy_u1#*E-(({7 z{_iXOj${2NAM88=wjNPA=i2VCwUYeYbZ38-4HI_K|{z2;duMh7( z5&wM8I*>0EK1q?-drI(m+nyW^j-xttRf|GuE^w!^^X{Wt@IzoGy*1zxfLY4o`C-lzffN`?5%9_9r zlk}gy)Bk#%(;@(?L=KojBAOk)^9%pI`v1>I7?^wFJM|1^KLr_=$dxubTv*UwE*XRG$$@BXQxykyohqpICQTqS8f2Df( zxAv8(e^>j;a-cz`cf~Q{4dJNYpWOfI2l0BK&noZV>sR!|UM;mAN^l7LZto@;wgkn= z5`N6#DA2JJRza7)Ogw+~j8)(=zGPr6r@!M@V9CvA z&!8rsZrO00_?vF=o7}x@`8s!BJcBMJmr4E|Bl+X;0AqTm7FVbP5gO9=`ugC}r_ars zl$8B*)FZK0!<%fqwfgSE?p0=U&uH6WrhQvU<#SolpoG#HfiJ)|@;MJ0DP<-IyxZ0r zT89XO2TV&VJXt(G;0 zARJ>|_ly|+aFUE;R6o2S%}{&f%M}4`UefYlC~_AdqqjZFGw)2Q!k9PA^#rl3FW|fu zg33IGH&cB*m7`tcI*zoSOP7jXfiAZzZg)qEhD66)(Y3udE{miQrxLT6-?T(>&W^K- zF)``Al+-3qr+me=aacsXcEvF+uMCzXaC;A#1DigGy9n5YGqup&2UW?Cq;pMo+@}v&3VeIQi(I!1)EKMqN)kq-1Xa}#ry%~+?x1= zTK2YwHle{$j>fHxq+0v65#;8)9M3BesYZV=!VnSVu?_!;>c2Lw)#Vkj_9lA|?kVZ@ z_)8++`jm>&>EX=uu{VQ!;#B z*V_E8LgRdnxGt}MzNmSQ06=6vzSxOH9aJ}iZ^=E2DyIuR(p z502&90)Iuv<;gZD&-rO)D5v!;e9_JA`eKCYp!>m{>YR_Ck#UHqpC^&oIlJW+JkVe% z3q>r=LxF?noZ@?TA3WE7E0f>XCf>k;-4p&~U@vUTRQRfHK7u#ZA}>~+$Gs%>!6=_F z`sQ7{(17hDUer0^*gTDd<%xw?vK3%q>S{wBWBB!+f1CoAWW-4l85LbCxQ%f!!}+_% zVdkm@dG1Q-=e!{LSic>C{5+0Zl7fw#5OD1Rx=hh9Db`2l?WGmdU zJp_(Iw)z^JxT?ZQj&`N$I@j4la$_Vr?{pB5J??KVwO)1ro30??Sv_J)`D>T1AXbRA z`D-!p!Z&#gDnqpRWDcvrgHN&MzoKo3;A*O9Ur5Ww7N!VIcjttyCxKyuQ77^;cZQsf zSO&vgdu8*?5U#z|h@P35+VP5QZ}ohx)&2W^KK}v9k954mpsvCg_9zD>kTPCZW0SSjq~ zl9-MEE@6X+FmGsKd7dZrnzcbRn1!@Ydkt&LLfBst97H*Ob}N)|*Ue0F8DSd@hpr2b z!X2R|B0Gh14W#YER{e{vWdY4<1rIE_jLJNcG?H&G9Aj@Ej^6 z{jIP0I*5@vT>W6a+vL2(G3tnr1#8|-u}`EMBGZ2I1|`O80}cMxTMrQ~et|Ucf6OdP zI9hF|`c5cyV;X8lR5|+*hOfOMs`fZ6AlycT3K2121HTg z9Aw%zNx>Vnm{L{Q*ikv+@gUW-E~IlWkttxS?Y=L4u4=DR zE9j-S9hTqmC#+=xay>WnQfsV#_~kZXAx%)fXX`l2Zs2Xw#MGBYiuKx~81k25HmBrQ zCLswv&SRqlXd>}k6JA){Cm?08W`A+>czT>f39W*(0kCfFrz}tu&mbkRlG;Sj=8pS~ zFHDPhggQTqOfm;$=9tn;<^&39S*<9(D@!siZobycYzT?6aejT|+u{{?ROlLb>IT}0 zv@#e|s9&^05FUZt9}9VBUlWcXT-j2e+kPCC@@$24hz2xEs2TVWQ)7l$>ML~DmM4bc zGVIAwQ&=S`&my)s5ZHYlSkwrT_90=00FSvMSZ(IC6C8_Q4b7 zz4`9739h5e$1AS4G3jukq<+>CHL1MK45|QY)nD?IFQIiBUA8&37olz3dfvsXT5W>^*eHfA#BY*xN--JqkHN~Ue^gHcyuaLj_| zHw$UePURJews0M}&eX}F8u7$-{zS$A! zyjatj?60D6R(1BPVCxd5w_Je7Fw}csdP`-F3Mi+QicqjI^ zp-b9`TU#*fHL!8y4$tR?Hl~w#OR@|O0Uq07+9T!YV?Ny(iuinbFXJ7Jwm}B%+%bm` zAzyvdI6V7Skl*HlyB2xB;U@_h4$-=Y`5um?#?zF~nD7%C=ecl(B+0}PGOWT)Z95PeyH$wOb*?Uwp zBFP}of4bq;e_C{LnWZe8V^I+II$NY>XLeMQ=*DFCddL;0xsKCypHp*NeLpzYOON0J z-Aeb{W@9wSJDBbE#=K3ajn@`$@O6!LeS*r_*#n zf5NTfUf<+9ZyYrd21@`(n@;c&O9WiFU1}S*-4=wg%5XJ8E5mCbl8(H!BL8X6W2$)>>Suj+(AR^|N2e1p`Yd7k-5Mxg*s+D1h z`IKyGzom%y+Q!$Q7ul6zc? z!~Bl^fnbcn3br>_pNSD72;$z%so$gcZ*CD0yP)m-jG}g_>TkAVuJ7u2y)?$flL<~} zc#z|!fUjjvAW!5wJ8-UFe9czBk%gLbjm;NJ{?%dM}?J)$CR!)K%rmO`a2Lf&dF?#QW_QqJzsT4@NbrgmX(y)?9anJfzQK3%zqgMwPf$+Hn7-FJ{`nxkM(Q-^ zA(ka89nyl>djzfR;Jmq-kay}}W#8dANuYXRfaOL{^#diD6>s!b(C$(_cf;fX4vY1} zpwYuT5RneU;)=U&D3Q(QjHMncY70H#{#FP7C-nMrI8a3A`1%FrWz>2sgOX4VTw6Bt z7R|%>a2k4$>gmj-NSSqqRoIe6-0T?p#pe24HTyno?y&BK3s3sVSCl_kDPm6W@zh*N zW#;slB%7aa=S~)nH!5Ffm&!sD`-rp@^p!-bSpHGlDEkligZn85`+{a-^SalAcAa$_ zYPaOxX?J(k;Pc>Lx@8m&lT7PVwCof0qzw?ZgrhQ)kHcF<9Jt|Yn0jBP zy_*i4;`%G;9h1i9%gNy`OPeh+aC>f+I{q;K@rqAO{Nir9{XHQ&&s0IXkYxk7-iZN(Hf`&1c9LV$^ZUe6-EbV>}a)m>X zN*3@z^eG{ z+tT>j@FNLO^OE<9(v+%AgQ9w|Umb$&V_COowQnHCelYtW#;s@fVMXIG)E=b{TFJ}2 zA|&D9WEuX}$8%g8>t5P)NcHjsz#*{VDIBPhrjhMQ)(;lc^a9<~^S@vQrnfxreB$#} zoHzci;Lz_1o^y_3{na)M3hn)xWQ&w=bXj5SYm}V4Xu2b}wj+qh z?jV$I^k60V+(|rJ<#bpZocH^1pWQ4t_ zh$6kK6e0B9l8C6N2q-Pmk={cOEg+)O3DP3H6Ci|02_Xp~-wK|+&pFTgp7ZB@_VK8fYJoI@^kEjfk`W81*&K1K%cRL-$<@Hsy z>p9_$ob{1aYXT*zZwAr}$Moi;n>p3uWVF2f4F=eQ`h`6C1^JY1h2I9(Mo?e%qc0)yO-s7JHIOD{E06Om4_C*6l+bKoyPhjySP!H-nJ->uY}P>3rrAqU%!auZOGs5t)?wklH8zmrOlK_%a#83Elx@B z`ihGgtmn<~VlHB#h8B*PTYiy$43^7uWo>Su)+k_!1Rg}goh>CPg{7)PbNwx&N_^2l z2w!nnjQ1U6&$LiRXx3UiQNU|N1FJ)=DY?Mqr|RcaeZ7>>BmGZcncKHOPuJHzWuBu5^TTcl>G~++{ODxZg>Uk(HK= z#IJN(j_uqzaOV1-oZO?Mwbt%^%|^#~d}(GX@N!EgKa?A^B_zQi(8oGPiOW~gbUcrf zHg~nfYn~eehT?Kmhc6K;CMx)g}oo-;50EouPDh zS4--W5|p?g-J&|q8qm_yd5AD=}2%=z3B@fL>9Vhuhb1)Dzdn) zp)r2JBHU0#px7kOAcm`@a;_Udw? zWqS47!huq1;`~`%!?Vb3nc(9O(U+d_Gj3TLj`ny^n$0R&7v>zps0j+ZzH-m1aA|v4 z=dD{_>;-5Azpm;=?KF&0ahB;d-3O;3rcTx8OChHBT^(YA9^-4O=UN0E8UJs9{|X(6dJBSa?Gx~F>F-F0u=Pq1a)NTrRE=2 zS(@xlLtetLrir)9i0VZix#Fp5^sr5R*~|!+4XOF!#wr`aB1X)-aZmt(vJxln3`ovT zvZlYIPZHlf*_yRIA!hMOmY%_(_I`azKTdv%mRHs17mo7?BYD+;{yP_x$8R| z)r;G;xYLY=+&rJ}v_I>f@&_Q25%p2WOTQ9T4d8lNv?B>E-vFNV6g|SgoOPA$W8J73 z##^WZYF-!Md+OD|;t1Il8|=ZhAF<}HX|BR6PQ8aDr_+ybPv*}#xnioDR%*`v#lmv| z99iTIQa(`IFS(}%;)5nir^1fzj{uz7K(;r0~u zF#Ffsu=OD%ZC;QAhntXgpNqzhrs2cz4}jfxf9=1hu_F0%?*sck+alx$lkk35xs^eZqvGkK;>)HjiGiN}VBDEW$}b+g*f@wNaX zv&q2l0}~Z~Eu*ieOU;uOj`UV~;-g^%n*MIbboAXEqc$tjK<8JmN@zts*vYCAJ9co5 zb7T1`$Dbs;2W*ia`tqb)HeFQgv(G5WIk}SK!b)XA(56!9cEgyop=>**WZwGcpjXX32mV}pNCV1M}jjVd3OyN#F<<*XaiXtEF+5p46` zuA!8gj7aIe$;kFUq?otNoc3;uTYQ67a9v|LEiQ5NkWn)f)qaUv?y`FK0qI0-xw6gJl6DoSsysV{vI@#b0W5P}PZNN^(?7h5iHeKhV# zdT&$zy;m|dFKmG*yu+pY2{;L{@m-EZlb@?O#jGky+}hxe6a5L_FOS4LqJAQ-E17Y!gMFaby63E@^bLb5ReOoA_0@ht~*GvReb1i8rrbsPqQ% z`|o7=)FQvNmssgk8vsWX_6&q)Q9QKA(gBjt@#x&>OW%y8 zlzVdj!gun7-(|Dk&gv<$E=j6#ne3iANh9|D{5gWPA!`>IBYIWlv>!Lr8vvq!1kb=f z5dBm2^FS70ry$>GEKiBlyi!h>PnxXmU8v`(lFV3Q{V^FxfBb#V5Y+@*sWVw9gpFVD zUOY|jGaB5xb9nc*(bU214!hT*)-eo)06-xZ^PUzt#i$MDV|h!_-Immfd~ZdLz?`Iq z==ZC22DLwdN%w&oLcB|`Gx%G2o4oQmIbOM!mfKzzIvR77Sih7No7i}PjpnDK=&kQC zd$?vVnw~!yjXq9*sS7ETE=CvnmoDgU?D0s54&LvCh@ z#g;P*z*vEcJ;${9NQGWpbE-N&)BkO`^^LQ%Rag2q? zz7fsaiOQt=L{V*sr?}&fFem>57(aF7z0>#)rEmrI!ZLgIQml`mMND>7uII0)Z?NZc z-9E&~Y3Fp*o3rk#Iv;Yf$ouqWL6pXa;X&qqyo(=&ZdBNJ(M%v`5Y3N1@?9mV?L1Ej z>h$dY#CCNXP{+Io2lefYPafO$ADm(BdLPag$N7i8z|$J1i5oH}ET(9r1V2}c;O`iC zXWq@Gxc6D#I&Vg+iV|0b;*aCasW_jWDPL@qS6dIp&UN4d5>xP?NEZsyQ+6UvZ+WPuR@k$yBc%ys-ri$`-jY<FZt_3098%>F< zdNMgk&x|>=Xwg`Exqa#zJC9V+n?hD|tdj2&94pIsiHZD3b+F0z!(&q+%Drs4>+eIP z>^{i2+_O2ZobB$Q+VcL$=}I^B->OeIowI z89G$gB$@a9TdrqR_965espegK!i$H$>vA+{<$m9Lj+E|em>dXpM4^vB@9S*77&FuJ zR&^`}GGcwywC!?&BmgaaSYoOUI8_ItP}E5$X@?HMgK0o^p3KqJGOKg0ZrlXKmrp2s z!6cUnQK)~k6bz~M`o)tog60dS2Wm0{CTfweSK<?cYq-?+@oDrnC|h6TyJq=+>1#vCZ3&Ci;TZ*)N{n8(rvb|K0B=uY8D%2*D=? znvx&nK{(~OeLvGCiQ69QfrjvB!qrS;M`8ugQR!HeEt*Y4MlE?ZR1$pFqySebtXS5 zaGb&644wqIHTI$m-5^`?!iwS>hI9a3bLy&@tSz3Xj*2%CxD}AT0U4GmyxXvrr>b1; zcx47}QNO^3b~L}(;Vq1zw&gpXb|#FbuTTsyOI6BYoWtvDwY;Nv)`1-c*T{N{t+(vA2MNQauA+52yOpl}FxTO#*Q?_N zC>4g1NvbUeeIBda7~6Z2#)uL32K<|6;L$p+?xHzvbpzH3jzj*T zo&Af|PD3~DQokNy?C4!Q?yzb4$mEKo@lZi!DvTdUHRu?@m9$_+$h)L4LcZo;jw@_- z?N$f=9%gpbXfQ+@O|!MSJy*Xh->jm2TFmrvmS%LUfY6-;;dIDXwkm24tSA4vp6g*Z zlL5=F^ex^>{ANMXnicWh}m))s-ta> z+}x5>SnbO$_rZ;7?*-2BRd{^=o!pBP7%MR$*`9{&GK?!LRf!rPgKAj%@0+sc18C{{ zk=}me-G@u>zQ{zX8DbnAv;l=stH9eVyrEz3hxf(c(my5-0Psc*6fiC;uC0pnT?l4( zZ|i)xa8wcuBrt8|GuFZbIe>xr*d3(#=$wEA`8sVo-m2bjTa8C{k{a4h*u{b$qe$Zs zdtM1k!R73ikho!g9h7v(MzCJLQ2cf+ZW5>;R-`T=8F_ML$MIun>qy!JUH%iXo zU#HDJh0Z|AA!U%GX!(OcVs#x~d;u@_HDi3)z{#sNo5vADQPDtFM>>H`ih<)Of~$dR zE|(&VkHa@crD`N+Tu1B0_9OD>2XCjSa4WWv>idRAT+;piYX@*MuBxZ9aYm)aje#iA7AG%=RoLGh z3rj{29lH~hD+JIH?~IwhOTjtqQNeS+NeoS!D$tK?lK*5wfVg1 zJGy8#c@g_)Fi2bU^zBFH!;t*C(W3rsdo$IFAfw`YDh``s?!TwcR$ntVKM)*chmQY@ zt7Ht#eIOa9U=E=08p!^n5W81W7ucFcRl0am+5(iAj6tj9`vE0>G)MC1P1n(=B0fi5 zqzRCR65J4!kM6W%9R%p6cO5>r$S!&!XeV8eJV?D(7!npQ>P9Y+Fq?Q|js!+_P#kJRVSSY~58Ym>vweBR3+b^YQ?*q0 zIXTJ3wn0TeoP!7G}%)iE&nSFbo0bsZ!kFs5?dnwx0bXeST zJlJrop_Yud9$K?<4cxyYm}Ebi6Zshe_`^d0;d=31HUqaj=aW_gJN?c{9qLt9=E%|k zZ;Bxnuiycu6BwTf%$YmApsJ>0RAej{#i+O;atFJ(LaKqqqY&-sf1nci_@s3hPzn7E zNv(POuuVuLdjBrXX73k7_CP^o7VL)p@tKSde8)gTN{LSc6NV?EviL9_PWz?dKse{= z5wBeQ2MfN#gv9-?O0KDQb`8xLD;jzTMAv=9izaXPE>ql|hVY-(OrF{1!+c zb>^TDWyCrcOhUPonc3>lusvBU)nuPT6*o~&S2UXP@{d;a=6o`k(exxEPC)qXdyf;L z=}?L`U^!eyNb$-Pnho&H$Hhi%)1Qrnkcs}Z4nC%4O}-QX$Hx0vFQGN|UB+KJBs@3e z$N%Va{~R65ut;7mchkePY%F(VUavAPu@(osOq>(g>8s#v6?z0ANo!N8_Q(hC@wta! z1_!IS@-vJE(jCAcr>K4Dc6s%0~*k#mPj@M+MWwbm1H_PH1#r=J}^5l+mT zmkM;XAaf@45+ykAQP+CGIt)eESF(lA#cev{M zj^Lw%4Q`Spw6|93Qj34w#zCZH?=%TaPL^b;`i1v_l;g07~23rsPiJg4%bK*tBU#|cyEL-LE!hL=Xr z+1N+5jd!@%F3O5`sSSppyLATO8mXdcYw`ACC0IReTwPHtI52il8zc3;xlBFA@&0|V zuj<}?T$xM>4@EH^@e(H3su?0G%nzs5m4e9y{<)S=gj1DvX&b6R7t*j$i*=y)QxT6fZ262;_{I2Tp)ai+Gpr8H&3*F{}i}x0`mc z4g6X8zr%B_wMryyl7IoIAi9u{#jmGscTErju%fBM4=80DM~q4XorWT_F(LQO&D%C0 z*vSO#eurGMyP~WJGKy=KE0d@f)lAO}3~+mC@5rXW4b zYCEYb7Deiaw256S`g~7L|-4+3`r-22+RzE73HxoiTJKdeSu*rIA&%^eo&7)IqY%Qd==Fz4=C z0XyP~Y^dU_KDhpPf__`D&y<;sU3=fdJ@C);Um6-48zV425_NHt3no(+i!gQqAodW_ zOxsObBjqHsLddf_`eWb-=HhtwNTy59Y{%M=vVq?r)50-Ze{-Tf714 z>BWI$AxqK&w5%#t=E>L(f>4|(F)y8KNJH6Q*Y4bT#M3&XEjf3e9^t?q_AbSN6fU{Ca-1$rOuJ(${pr5uV3aA7kMj!3h0de!g@d?Ah zcKu4lz8-VmB4=Uu3j-^E?39k_f&ndIC#a0EHSos&h+&_{& z&phnQ{S-qbj!3JBf|WY_tZ?ArLy3Rc=pP;ar3${~CQ&K_j(juxREp`5%m?UqEo_bv zcF&(awShnst#-nw>6pU^?}>UM)S%j#4Dy3#?;7V7N3kGXe<=h$%>7SdV|e{BfWrsn zTY{}WUZiV`e1@z3^Glru6~!a@gq7V|eg{;7@<7T+?RCIy6)VgeTziQtM9-jYU=;oA zh2YJ*p;b|#LxM#nE$qMtzXy(sGQT*Z^=Dx;{;$AaAm@{+Yn;wVUfpo{#!A@LBPHOF z;eHvBy`l-8QPiWdFTW%jQgkV;z=^>WiUs(H0tLY1KdOa|9ZQb0Ztlwo-hBT1hQU(% z3oz}_s&T7mdB8Cc{WT$J)?D68vDSL?60H{!Kpo~cr=Cf1XUs`mf;3QH#2$$=QFh3= zbT>@fB@yA2GN8TkWMBVF{x4mxCLt5LU+@}#_L^c>QMwd%htee_6(I@ei90* zq({KT;==`k0l(gS22E-?wNdis#FteRAkb{D!~4}<3S!c1|()$Ysw$I!2)Zvz}!tX0M0rwZ@k4%8r~eqop!9h z5E(TNkb`?lgnGg?`p2fbORW${Kv7sP@^YurMDx@hWj21(8sQvVT>`>S`_v zmjz=w;|iqbZxYTpUsdND4nD9|Wxdo_ev{|>QeI2TGktzvQ_#paQLVufMi{^|hyi2A z1*1X2K@y`s7stZvhF9zM6pOGDVGW-apKQK7#0xIRj*&_i$^7vbWoldN4o=e0RMX7s&`=XF^OB=*9NS zdgI&qUcLHW`=Wu~AEf$%n+?Nz!4-$L2f%U=ea!W#o4ZAkzN%UVUmfhtn6xJa2b^KXUv@JM4V7_0y%$H&VwZ&s zI6Yhs_B(Hm*0{|~S*WaU>1GnqF9C@{L{Ka8y}2w{2hDFKmKYrImRay0D#5+)fDa}b z5D1hqx7;rwMoKYT+AEfWC|khFu&XwdmmX}C5J)SR3sH7x43U}_g;nUnXVr}K`k>bpL(&+EIZ*L^x4DNQjX5@wtY|KA?3AwyZD|3M>8sT^i3G9x#Ji3_T|}hGKln}4 z;N(7+_sbbPWr?eMc7MvCKrY8z+uT>8qddfaT8ri2`D}*zS813p#(U-6{F&^1>3@Fa z+{r(+zgL(35Blyg-(F8l$3A`c{LvR$u{}cuKwm_g%5@zmvg7fD7|#UJKj0EyfMJC= zM-iu15i^Z(!|{t)Ux2WieWFoqq1}laPhCnlRi)FgS?9Ezzym7P=E zIC9a64WRik;PV*5IJVHHl=!teg}nNK%jQ!x-|Z~E%KnpiEf;ILO)%a{CKj{iS_2FN zP$>=wX|2@#kUnwvsLOcm^-RJ0EZ*0eh7KE+m>WTfn{x{fB|UzO5g_xBSJ3A&PwwgG z>ZLEh0>F6=%AHLRKXic1mRe&W*TsXN9YcQDibmjfHvSxrrM$bz%UHsXrpVO>G=Ji* zQl^0O&?jTi-82!54Wt}|&?`FKU-v-yES+|XjCLiF$BHW_{Py6wGGV>AV08fyV$ZvW z-WwdY5b-c;x7n(}|2?3JQ*lbmJA(6VW4Z0w9Ru^3T?np;=ETay9f2=HpI$0~6jlda zSVvDY|q$6}QUfrd$IWhjuv!E-Aan=%|XrGVJ?q#*PY8rC3p)aYK>Fc;$adgys= z&}}P>@;AUzcgOg8=F0VI=b`xzf*jjn%%~+6_29Wwj@_V)1A8*>-j!nMP;zB4afvIv zD(wlMqAeX&xyS-IlInXIt|RQrkZYf(7USu)8s;@mgd(^kiD73~D8PL@bqj3;uzwY9 zn=)ndvFN5*uHsy-Gjj}F-)1#drs{_~9|j_iyIUZrBtEEe(E)MUjI85Ye3Oy`{L58P zPXetaeL26%X~JMj^Byb1P&nuQ9A*z#%o*MS@eg3?gC~yp;1|zDupt<4kckC0Xu=Ti zVkmC(HSGnjKbYjoN(-Fvb;7euR)eL725nKPDD^(MTPRF@f(>RNC~9OoP!I6v{V5C# zeXCCsTz0OkDSL_wwll}08xFE^0okC`Zw&^H; zI0uM-g_Wxw*qU_#1)#IjsA#vzWFqfzl)?{vwl$j+4$$Ig8V*{Y7SZA*#V`Ku%V0H! z?22MIPFfnnum^0dm%c41MJH#jSi}Tbx4*&G0`~(Gf??46xxuUEHqpw9_Xw=lS=)i1 zcZvE_{&0llGR*oW29y5~qFC#`9-Xqt&#N97rDIwkzcj+KV{h{Wr-P35*E?XX&!^6{ng2O#+#epOm)`h@ zdqe;91eGWdN2;ToI=ZqrZXkKEl?h3bg?EKV^f8WN^{y|0t;&(JloVZ;W>&kMR}W=u z_EZIv+$-=+r4sA~&ydVfajV{(#-yog$s6#8mr+lPg3VoDfd!090g7(7)HQhdg;|)c z#k(TB7wWVZu-}(b765Z#mp1;k79%ed@d@6&snmwJfcQ#G=^aX_9sXXmCTfXfSbfMp z?(g?0hWapX)z^=5nppb+$93hULt`Q*r}`I)vfs#0WP4iaIsE8kmdUpQOMaSs{yNsa zBgTHuCSJtI4g>V%)j85MWq#;*ECI~?;1*M|-j3&+V(UuH(~@Q)L#Q{^B!1O}w^MsJ zs$y8e11I6%^6n&`Zy>F#vDl9&N`ui8!9k%vhTB(1Htp(2Y#3d*IDE7k8H@6p8iGv= zSV!ybRf92I?e`z=o-+;SZERlJTgnKf`4NV0LO)#Xpy#;Ies9q980MI<{t3u$$Mv`! zI~@fl8l_B#2^fee;2{ztsg37`PDClpt1Hg@Xcgx{9097!@I%pqw)Ru>tM`o&)^h?k zUE8)WK6@K&Q?K`!u6wi_af~9tcs?B7eq(SslS90U{|Vpl)9ctYTJrC>z@_hwyOhB3 z`?Q=et|}?ayP{G+rx^yI{n91x#qM~;NpjZ0K*kGhm(4Ak^b4xNJ{?BP{f`gF*(W1= zCeLZF#1!cpU;p57`V7$UMCS$BPNA}`QA&vmR?$|a43Af%`+f1Lyqd8u4Ox^1$ChghIY*bfD zVBeMw_=3U~Y*iA~o8-_r?6-@0ip;z%mKRud)07~&u!#aRq)K9iMil5(&{GN|d~G>j zf?rVrYLGJCxBDhsL(9-WHaPi3kqt6|>yMf@u#%kUDg4<+`Nc@A1c+u(=lWqzVmb(Q zoqn2Tu~sb>d;|^-vg*%aSQrM?Iw0GVJ=BwLM=ES*9yKGp;xSsem@O><=({Zv^p&{6 zlJp0FZx|$WscddNsALLY-CP(=Tl8cYm9Lo||CYsKsb@vK=M5N`0v#47;qeU|kxE=v z9G%M57gSBy%;#5d(~55Q3O3&64VferS$RX$3h_?vgi5^!jp!ILi<-}{sUdXk64g_m z&~}Ty6+T5t2TRRZ5+$@jabSxl_S3RW>P?PFz^v?~cGEYI&|}0vEN|{l&0>=K=evn% zIk-Dny~{zCQ47HCy#!J7d9%6-*?s`)Q^dS;;PW5ZcXpSl2l zUJXccR?AVcG7WDRi2;qD-vPUk^E;g4n=aMD(zZ(=Qk96Y=OK)eF(5*Cg1`lZbt_dk zs8HZH1J5YuuUB3J-3cUW+Y&*q?jKpJcyAUnQI;45b0~Zt*!sd|S!KpXdkVEuUaP7et(Zz?X0#!)7LPS~wtnLJ>9q;?6mJb9rlw&| z7yTvH!w|~{(UxJ*kCx#S;v7r-+gO`0b~hZ0;2>Lh{zDX3yZhcVjZA7`%lPau?#6rJ z9@Di7T`|JVPjTyg>LI!b67XDQxAe`f+x1^>5Y<5;sBX5n)5u=zRK#b71+lt(ILN$> z&CjgJxaUT)V^fxTVs)T3^?~=8&!`Fnkp?tayI}d~LB0_On_l?)(kMXT3RoptD|eSK z`gRNnd$nFnFh93eE;=|_R|Bd$de^G!QsqK+n<@#g<$!TO2ck^-h6+Iy5z5sqIpv$x zX|F25v56LDDs3V@ zgysEKz`j@OPY#$2{D9=Mq*ZXQqL>?`+7;)=C1E}bOS?Sfn0R!kp>_d@Un#;--95~{=}Ml!qL5-~AHM|>#0?q2 z<9vTg$Hq~o;ib%qlUZ9;o1#!d_*WFO6jE$H(t^DHay|aO_=Ag1`XO z;Uq~qUIkvXTP?p9n7ZiwKE(OOXi4otwd=*@h%);?J&6+-RlM9qHv!{O*Ib>tDtw2% z8PKp-!}4Mu>APkfgfoK5Ryt?l0^9^p*X?2JyfD^2F)< zS&d!5d|>**=}(IEPY&i^2m8PA-qFKAHTC`}l;!P*$iHnszldw~BcaYig(v$E&yODY z-@j>plHyYU>vW` z-;>qkulUuf^zS47Uwuzq-4+nPZ>Tr_b~x+ro~kb=^9^!DfRI&x|KCIQ|9!qfGt`F) znYY-2u15XcYh5gqok#BWkf~zF^S}90zcHN+Ei@`T(I=VJa`;c>`R`gA*I1w%8%B|d zaF@S(S)4m@;#`K!Z(;ZU-snBRJbT!%-~zDJ6%6M8Y83jL;`rRTdpSBrOcWNCGk>{_ z{;o?Ue0s^wb9jkM_syNZd#au@7rx9*y!HPcpZ`5mhcYo46&jvoqHwA|lKZY5 zihl2teEV7E@4nOv=3k?_@ks6OzSP4|B2FI26#qYsssIS98@Idv5|Bi)7>jZ~(a|QZ za_^_(*`Hr3E8He1owYo1XaDQm+p?X=AULxryjo@YZ?~w7lK)z$HRhosfKeAX;Gkod%x1qf9$4|{>(K(MhMLu~o2Q)mv&&b98}bH= zOpt?W>FneiZYaD2Ow|TPD_O05d`fZaU6>Ba+W4uuIa7KFr7mO>f99;TL-AWaWoz>q z7m0~_{DlS|ycmsRO&BncCi_2_Yoc1K?d?dPmG(;s+3Yz}@F1_I%6aI<@fH6JUf=nL z20%U4*d<-L#l(GiE2gWoyZ8wekAyeV@rXnx&HtDvM4Ensm~hh1-2dDos6I8c=qb@v z(&ulKP+$C?pwEw8rme@WQ12SkYb;A`g&*3!<``~0u6y#H>z}tRv{SUqb55UmtEdq; zr|QpcVf&MPHqP8zEm|9+IQI^?&2dT7)i91VQDORO!14qblM*OrjeW-gmQ0=Mhn^TWyX1(v#THPL9j#-IIQuK_*eNH)FRYe5Hed$H`H;6f;? zKzzemqlS{-6L@_1YabRlH{gjX5ILF3{>7eT`)_CeV`9&*W!kce?@-c21(=9^P0Q5Xef$DGYIN4Q4jI!Q# zbAJ7RzJ32#wQDM8AK_Iiwd<*HT7pKzY2DVB?DHS8qTA;u3^Wg^tiKibt#=#yd@kxj zM*2g;K8!4QxINJ^9qv1x`KBLSXnXdPZ!+iYmIgU&fKb+Ob;9m zl$u_r=GaFp&Wzmo#~lA(;7ZxhQD8y&g{L(YRaA->$qx7%8CMkl%VPQGvibF!{{c$* zc+afFb&#=T!JF7E_WQu z)L1Y<)jpgr={6v9+V_qJNedsk)MbOeH&w6>yKTL-Ljn$>ybG#j&blE{6M z3$I!^I$Z208_AcRk$rK)M#n*`CkQG@q6ZJDq;?eH>hR6}T_y5#(b#YQ1!P%N0-+pNUDQ|7v&uzI4zz6_XiSkneX53&pX|WpwhG1|D2VJT&8u- z@w@nqqRMAv;@ZT6y{)#&>@f+e3nq;ZTMv<^Tca16r~(NC4dG-p2%Fc(~nbj%s zK*VXugqc>Yjvt5&wNx9N_ZaZdf^Hk+I zWa-<}DC~Q+3m6;xSuznRwMP}$-5@Sa>eY|iSFIt-jJrIEqKYqR5A9q3AT!t(1aw^yqW!`mF#{r!t%63{J<|RA# z?Meq_9YmUHwsA>P;#Z-->qlW*!ywnuw|A1F8bM2f1vbrT&FS^cEf3dcFQv6TNmO+# zEe6~X=1AxBuI9*%O@IoM{V*i|LC)1dsKjQ9w(AuwKo2`6a81WtW=h*{tR!!+#6mdM zak<}K>T|MuV5gzeNJZUhd9XXdbg-uz^FAXul6$QE0F@vJQ1`L-voxvHff_wgMm{Sh zI+UD~`Pe36+6$qq&hS-o??It-8gsM66U9N$RK^7m3N4!o77dxALe5BAsAn=t!Jm5QNSIGGAuDLQu1Frm#XB~ zzU(+w?WYd6Xm&&SzfBHkbHR2ix{Ziq%83GYdF-o~k8hGomeR5y4 z2FTbi()Q>-^G@iSE5LSjsDtlC&ZC4xgTFF&{Eg{mih51tp&o+(suGR5Ov$@mA(JsBY<;d0HWdIC>UzPod*#$BE(z@ZE?(4xvMB@8 zLmYEVA?Mw(=KF5z7OmzLy;}7^8l;|d==8DUsmlIw$!?8zlVm5ZeGuzP5QjGhE>JhR zX3UnAKH?fFgMJsw%wA#s(1p*GHlCIkLDO`?uf=ABf96Q|`W$Cj%RryTKdGc|z zs*XhSDgy8#txbm~Nm}*>6Uc~hUlL6!Xv;J;^=!Q#Ud(@&1iHj@%=sm7aFe>*4oUp| z8g;D!X-P*H*)^C~OW}@Uig0_LIV#&bu~IE;NshqwG?s@>lS?E9eO}knO-DswiG(S6 z@Sb(>TAD1Xoh<}vlw6?8AjnRR2k)QdElog&DMY<8X5@rSSef>BO+ZS(QlkR(WiAj02 z@75lqwb~4KSU-e3ouxJruW4oA)k%YY3Ag-LOx*gp&KhE8 zew~@Z2tSd^PXNfBk2kSKuRc3;aNubWP)x;J(1Vd%pe<9-tE5Al_4H7!`4n%-cd`29 z$X&7|7Zt{#x?4Lw%`)8on}uBC9z|I$X$6<55ivijTY9ov`9?vaPCKtwZR5GC?S*J z1DgLl>)?O#B%Q`jn~Gv=o*8&jO5fo4ASN0#An9^qUQeHanEdNOqW|*``~TR_woPH2 z5Y2VI;tO0&VMgcN;rgb0?wH1pa&!O5v3NlU=C;{fa{>gw%KC=eDlGVZD0$$kewf-7caPmU4 zbDz2%$d(SN>}S*K{%}p#XN>!m_!;$k@PP~nqIoZ&`3;}n6N5)aK*(PLy1F{E!S||w z_vNHZ1hx2lpRYCrBZ_6%SLB1b6+n6iqn)NdO?!Mf8U8A1d5<}~VXetVX32u&WbRopF>Twm$a^gFA# z{Ud8WlMTJeRkxCav;R50I_<|X4$E6zVVO%(dz_mR(2uAvE^$)E58hb}ygr~t+uH0_ zVgEq-AxP2&n#RaZ+$n1eG}jGV7?RHcK)l`F?h7+&sRYK7C|_WZ^M==d^?iS>ryzNE z^CN)NRe{4`OU0}kZyg5}H`C?a#{Hpv*DaP`VCmW`7=&Z2l=~#p@|Zu&tk&bbm}!~% zUeHXsJ%|vn)JOV6n>T4z6O1K=ae!h5V96+Vxk_)KTOB7Ze;ZIm7hVge#{!{&b|53T zckzQZDHn^3OA|V>eh&K z?d?g=YM!4vwEhYWZ_re#^>1Ge98BvKlm6npJ0O7G%9{!#(eBhoS+0|G=YKqo`Z*v` zI~~1|x4D;eC4%3C-2u}WSXpfEG7Ha3y8xn-U-!4O-K_=Aw9<_tDmirfd(jU@$F&D< zbO^VPIHs-fk?IozD;?22Z*i}NBlAB#45OHJcw>9Jl8)=|UVZq;xc_W39i%wPb|?QP zJ&e-%6>dEvAXpM6cM(X-yAhJ8M@8#4vH>~6zI-x$3j`>v6jVxA+nE+r#KZG|V}6=< z&4sMAN>PhminBj&?pE3C%{p#uK7iq(aUj)jF7a(9O}WcwpBrH5)R*7|b;)=0F*#lH zAo-~@&K-k;fulbcOaxsAVH57nYI_y3fbS(i!a@k9fDK7Ju~Es=M0_TDC|ne!G+ghi z3j&^7w&Drc-=q9{he@5~G9ThS|7SY>b6*dQV_9nWo!*uP{QO7|p?7FZ#qWR`HK#Zs zCS>#XYL^{stSrA0J&T0kRV zo2U$*(RLd+{JEbXp(R44m>z zotuJ?AVPXt6#jsxVrCUz=mX2cCFXAqrBr@;ksh*<2oHJ>FmAEMKB=(v9FxxPT6_}R zeLq*FVL1A-l4bZFtH5On7q5)RIcP@LKQ&+p}@LQI^8iZ3~)l3~z5U)drPM5nn0(Bn~&>zWzli~O*_ zH;Sy(pkWyM3ox6q)n4kT^_8~Xw&%(M0RkkG(CN$#F%g>C)|ncz6SxD5i)<1_ z*57pdk87MkOn#5HmwgTui}eW35dc?kXo33hPosXVOHMu%e>-mpglP(qHQ}%05a+^?6ZqMl1_4DzYMzpc2{C~AQ2UL^E)~n(o zHV{OVYN2h9f{1kKJ&{F4xaV8dvD=z@`X%h=Jq@H&dlY&#oHUbxmN@v%e6(fhXN^=`J5>aE(YK+HZP&l_h=MO z=y`2u2de;!HrjN5n2atRrk$L9K%b9$olZ2I`~tlFMS#GJbldI+nrF|VUmplNp> z_4)o<2b30FLkKUKB;?T~q6JG-B|#)2447o+UDfb!B$2x(-9bX6~`x4uUu5OOR}D3cMFCGT^61K4*Yf&GWV3as)T71eemW>f(dA zh;vs2FTVi8<^2vb#ITN5-qqMU*#qzU9N)KT^muu+cztv2AY_^m$65w8P(T68g{KQ7 zEL?r_(8+=RW2)Xy*%E}ESUUJy$%fbz9QHhitl3K5Th@Q*LBM?=Xba%-kCrk_{upKW zsy7c%bkV$EL*94>$$eiE@(=ZQ25=unbe1+UJ_lJfsLwb8$90Cl)6Vfk{YVfo;p3E8 z;V^Jyk;f*5VB<6SiR;q(q-wHwz+?P$sZ9&Yxk_Jt*CC6YYC7J2)HY)UxJ)*;SJbXY z*xrOIuE5CrqJZI5;TsuKw!Jxs2wcJXjL_3^w;5|heWFo~ztWwzfZ;IYlJT17-ix~L zOi0;$e60oIr3P)Fa+i*?;zPojB*wG=4dc{TCFM4KS7Z3$veo?o+swP~nrJ5+tIo%6 zjrs+PIt;w1lhxRse*VdIcZsyV5Z%Ya65Y229B12Y8Aerzbj+=~3Yfx<>twxS3i{BR zSRcq7G*?oJq)&zcrovidxbFR~L`%%B6Q#I}3!7eJE$%czI9T$>KR%gA*( zG2{bW``?5nLL%;Q$?nwy_^HBB7(CMHMURf%a|MC0Y5$foS|9KED49(2Uk;W7X^Un@ zx>UuzrSP7{sP`&-FL3G4E1!TEww~;Ph|!zX^n*E#om}`b>G)_%Y$sJFUNM@$kb%H^SPG#vMFexwHsmG68&4_ z<#Scf982@QX!Yfm=iPz~K5`wWYWz3@hw=b7@t9nX#B)wqw~V;01i5}bu&Y|>>B!Hs zvH&dC1nD@{TPHtR-JeaPREt_RLs&I#x^A+y3l&AEPqztQhTtjYhDzM-s?kCC1(BR~ z56XQ#UIz_WUsete-(B{bV>xoX90>EC6SH$SXz$B21umR&SAhX-n!05wSwGs4h$%R^xA@ zIoX%F6#pyL@n3HocfL|p4NvjT1x{U<6GhI6%`=^o^UY;AE+W(UIhYN?@3&N52_*){ z+c16;(I1~)Yyg=X`g2`g`elNjyp;C5po_piocKNl{v?C3$95TeS(|6<1fxgxr~kn< zKos#y-0#fau^9~YprPwyq@*s<`X$BJ|0^KQ+#AWdZLlMDWFTLzLIp5?A3M{)JL~eR z2aT4h`2l-rRHHEI00cm55pWh{G;?P+Q74kyF!X3MQtuT0bajsoFXH0V+t33rK3?o~zr%HYYCeaL zf1!UW>-A~|%4y?ym+dvRXH47j)@-X3snI8(1Ik%B)41b^msdMu&@vP$iGM1Ic{uSh zjzbc^#lO=(BUmM=m0{p8TLU!}wYZ8J`_*gA!>hM2&P32zs~Ve;wAozbj#n#Ej;nS0^wL+S z3?}MIB5Z}U^XM`z5Q$qtjpo9NGaFz6!?_!a~6k&2R z<#yQlMPE=~SEgPLL$`=1n^#Wt6x=CHS4*ns6DXx+sgz`&o_xlfgzJ9`^J7SDlecOC zo3jcDfmw%J6Im#$9Z6L!#SXWKqY)B~CH+JVt5})kvMV_Z5b5jEV_wN9MJrR=+h5*S zj!!@#*VW*6xJK;<)(MOJYSihXcx&XDH;PUg)ZH6=m^l;~VO$V)r!e6ds-7>YK{c9xFX7%h>#qLJ@+xBooHmRk3O7Jp=m zAWC|0)+Jm2#*Gd;U@2M|AU&-k25MrkE#4N-Np%psN`x(vP`_mGB z7NQh&Mf0KKMnO@WF8nV19TvSHF5n#$Jp0?9BUl6+g|)MFS z=2*5T8;f|@8K#d6_6{0p9z&Dfy*DbJoHKg6SRaS;&>!&0+!3g(z=xtDDPLz;)w{1~ zt%Pl{`dy97T@1psUy2Nw7=yZwZ3M}jX}BHC#?n}|wJk}k>mE;zg2TBE@mU*>=)5e= zD;>)jxF(ObLkciX<>#|T>G=Ssc+RInd~I`Ym0#9zMZw+_By@?{Y9?*wF%k3cnK-Wl zc32(~$8lRt={aiLp7#mx)m zrOK(TLi)?Zq)|pk9*jwaIZvW_QWqw9tLfPIHl1d~7BkkyWmP6J97-TkGZB<4p3+LS zKQGm2ndiAZ0UE)NdVhWwJPvmzL6Uv?$_4rbJW|oH)@2~e=x9u;aQ46AR5i!8?gFPh zn@T9sdc!WFPBk~Sijy95WP6+_>87r$dcLgx`If^n>#$>~ zqmyJ8CRP4JwDopE=W16*@|qgR`axEx+C}4bAZfl7Og?L)6k2qrU_hN0-7J@_l@}nb4iwPAGyW z1_>shukVEN^O*S(rj!`!0x9t>H7kH&V|UhSjEO$d4o4|M9CdsGwC2ugf+jk4<-%bP zRzH`PMg~G;HgoV@9P!G&SP7PZo=V2v75TN*?d3eu$Z9o@TBz5sBZ(G>c7&isIV{!r zGOU2JeF01hHPMfN$|h3n9npu+bOTu&Rxp0tFw_#hQ?pwm<~dZvWjvV{Tm{@$u>0IJ z64Rwt@ML4&Sz3xIX6Y47a&6U%l@X2aLyK1gEGDm8X7c|w^~P4$>eEZ8b5G_Y#WBog zl`Oz<2J-9S)Qz@m@-k>mU(>SHWqfbeJ(B?_Du5Bu4f0iO@da|9ex7Yk&Tk}yk^}mb zO=%y9m!7cM=~O%!>I~g|)xbNq?%mbI<_M!SNvLc~9w|JlW}BONEtMyG60m_db~ffb zj94co>z@U>e`J-~I}9|Hp?KuLa+-+uH z#1aI606h{lFS%Mvuv{svDMvUKRBwg@I`Sn#kUoiS1Z&GY5vmJvzgo32U}dryO*@a( zoc3CMN7D{M#ETKwl4@Q&_AMN_2vf4 z5)U=f>+i^#g~2w29YGw~!|vT0CPV!mU&IQGg+B|THXa?j#G%C0zVTS1%CmMk(|@*3 zw(0h#3k0!L`x;-Ru-{yHXbb5HUHIaHTg+x=W^MYH%pt>pP-bx1wws~}sk*U>i-`$t zJ7+2wKM|JLrT~wfZl6irMUS^R&#U}0IMP>ze@7P;cKDd5ZGJP0FW0(S(=2gP>!jlb zQ|&mE5nmCq?^GH&YkA>(WN$imWUtjHKNV(V=?!~hW;JG{$2IQn3epzVP^cn`A3_$6 zp&|cJV1Xfgg&kwgwo>KDf*MZZ`ZMJT0l#XI{ED^c8&pe4nG!V^ECy?zAFc(R7fM2| zKMb%*#e9(@3ANj1YduQ5a(8lgh;R7r`o@5j*0mB7$Nc7a8EI)o4>Plrh$+}W{%B8? z`MhDa-jGMs>vmazcKL;L0w+_lg!A+56*%tNt<|}8leaO^Rc3&Ou zqEHx|C#42GGk_nr;eKGQ6t2HOBW>? ztph(ghezT1S}2ezU~1nv!!!s8``Xg07xs*FZMv$( zW#GQl=#MGuMcwIc&9Lcdf1kcS(|Qju2`M=}>$PR8MsF*7YrTYzQRUL^QjcC@!$532 zl&4*i@J8MWF<@?2iOW&50ysNHA@WXDrsHyq*$nLSYt#cvMmU52G+uIQaw1)iSB%AW zGDNQ6V`K>ms}ubJR=27+=)3gli}`E!YIzb!o~0UPKZec!FtN@6sjxOoNs&VfKns_u zwl`1opYTrUlFFcXG$);TErRpsC4)>F45C8 z(l#^+)2~{6Up&CBMibXu|HgkObelxN z+;{izsAqE`Q7Wpsm-u3nj4Ir1-8E8@IGBgav}g-0hZkJU^ZLet{a+Elg7kt+>PI>} zg8gBTM$^<>COl*Y?0w0^=Qx0dS&(50n^5BeBLuA2vmdqMJR3)lp{=9aG(E z@TSJ4Dj&C94c-Airb{dLKUr7<^)Xhr=~V`E6VgV$0Po!!U{Dh>hkOI zeW^wF6c)C4Aa+2XbV*U*yOQ4vx)$6n**Hvya$d*6oj>i)v!hR}LaeZ?GUG4%jmg>=(W~TUrp>VKV6C@65<3}0bi8aW&5^> z*K+azr`lL-bRR)pZSAe7+W9!z7{cTjya6y|6B9GZgT<-u9}5ZJ6t>N<5x;pA^~|Zm z_eWc5A$jlvm7dD11ha9#S9i~f>%6C!=Ub-nxcYqYI^=Z1*AMo-DlB#QF>QQK%Z*tH zDdi`xITikpAI{$&NcLST3r+VrIc}70W2^SVD8izFX?5wps?El)5j>7NdinmTu8$jj zuF^`T>(11OS{cD>Md-5yY+%af3u^kfso&hkDQkwf^0*#x zu&%cU&c%lNXTX#xixZ=cD_TVh9?a4O7gt&D?stJ{IPq!wD z@kc13@V$k&1@#}4#gBu$NCB*w49i!N{cJJ|Y6{Hu0Zqd~fB8^2=^#sbxybOve<1S+ z&Fr4R@>BAaTm7sEWNf|a3DmMQYH_kGQSvzN^z}GXr&GZ4RuM=Bs#RGRNYuB>v^l>q zPB?q;wT&}NhwQooxMMG>@)_jk_u8H6wG;cQ zAamtC6G46(Tld0##M%!CWvZ$zfL2OIakZsj=d<*hwFToZQOhDq{duRR-Xx6Q9Q5;T z0g4Y8-{PHFz5c^Df9O>BN$t&X9jwL^e2vrv3d00f$u)Pdf{Q!Wh3(x!;xw_vh1g^G|f;TqwAw)5~E9`sG z``^K{aYPR(Mn&+IcPkQlE3yR=t^E%c z^uHcek&Zi7l@@m*LRIK*QgoMY<{6mM;bMJ<_NBtvD+gS%Mbb-dlb=SQx`J%8@ILSx zF&vClMTn)LD+aOy_Mx=8Ltu1fI_KtLPfxPw4|KVBUQkR^@ZksY1FGNLa|v>K0X@z+ zi}f-g+u46ZCgH~ir(6*{X<*yqTX(wm8G=ste0{>2WVi6|8Xsn*MLs3dlOMLW@bF{0 zc-kmN@dA4C(j8-NA&JQ{H=3&AztJ0}^o+ce0+|NY>WQ1xE$Kyc!{iZ0lkn!?xOU8D zmy8QpGS`;T%r2YL8DB-|Y@#;It0Kaz+-UXzd&2DeF=4TBbwz0dm+T87b7Z1Hdp&gW z3Qv~7y!H5!Y4<_RQ;NsTQS+50I@!szxDw5|G^B}dZ&zgqdFUS~L@Br(&n8Ot481*l zhjE%+P)uETl)O!exnUtXt^*+AUah1)c|-^wzJ7@{*3(!p^C2W67}<5n5Rs)fFGV!S zHM!FIp(};_ge+bjJ1vqCSt5ckVsfy1m^^eqR60bh#Hwo_KbS`3C4d`P+Futv-^r2i zwZK#L>9|2pFE1|`lS@tsONF$|8p2vgaK(mRe;*pf7{7RO!Q)ke&WeKW$!=$Bl)$)7 zj1Rk%7g^vH`~siVA$*l{>e7dp?8!TM>UV*5>9}>?cvbCui926%Hb}Xm0lqfoB^%}O zmOIV8guKkieGo-^G-E(J^a6sX9#(9mOJqF%8XR+TJzaNPM??4wc?weCPMw9^QkBhN zyS^XXhmITvv5M6`E}l2p%;DNVf+S+6Hu&m$cyujsJv=)mQJ|gV49KBfTk;-)I%DAJ z4Ar7^QG}6BC=X&lM_x>hEjAjDO*NSZ5VX$ybtU=}F&3o?XBXsP?WMT4kLbS0tGzL< z?I@8T7H5!e5<|PIRALfgmv;sTjTHHMc<~1;BaEtFB^97{UNP0Tp6j->vr&ebT)gG; zT7oR~ehH-FzS&}_%x91n0&qu%mGaza8JXrH<1;czml3o;LaNz#G3!=7=|ndF2CP0B z7kp!wm(wNt>icB!v^q}}ejPx0^M0oA?4D$4A99qD)9Q`s6!LqV6UTvFSk7-qS{5s^ z^YE3lSITXT-WAh2BpcK_Qh#|LH9$c#tMbkel$g&Sf^I#ho9?En?5-ybgo>xQt()-8 z_J?jP5ry^S;NXBTeV1%1Vd><3mdhIy*DnE-5cBQ-5cd;8{Zq#1H2#=)CtE|0E{=|aLvtX&W#P59zeM~UROx^+oi(&IXg<)XAd z)#0`5G&J!^6byqrCymc5C7Ig-naJY9;@~mSaaF7v|4Vf&NLDr3El z%$-9<_S~d4pf~F}WWYg>olfoowyFCl2aM85^sJbi&cxD(?(2BO=Or}m+74f2AXR#P2O|qBs*;2mt(o<-g+(;v8n|RA=zn1 zbb8|#5^-zSAU=xE77J=ZE~3EIllvL_Ao^LBtY%I2jyVQn#kV)LCJnWg4MC01xYqf? z>kvn&_8}TOtx@nEqo|1HC-ag8=>?5ZFed9wi^&-nZ=T7hS;vqebKQ`S9sjH8&-ytF zpl4t$lBFE^VSWibp=9Bh!OP;*{H5P@psi^)Dc)2%q6~1bEv5N>u08hbfVe{7s~bJi zd!p(1;6vR7@}}-Of8p|k_94ygEsU(+hmR}>)Ecj9Ql~6F&4fYn7ZBZv5#%3#5Yn| z*6xj?V-(rOh4K`>>URZ2_cn`jfsSEOoO&bNkyf2>d8+<|DS2^L+rnN6o_HJ$s7CfmSDYCjhovD zu6jkuX68+Te1NZecxI40|K9?rf`u#)G3wW)xsceAk)L@*nS&}qjZh;q8-?YPs}`YMwpryj&uc8xb; zDTBumHHIeA@j)j#W;(XCnyZp(sQpQ}twt0ILc9UuL%?J3czt|T!nJu_;(9t9)K6qK zW8+e3=s-hAStO_4bt#ppaX&WIFwpVUh*+yak6 zJ;*(T?b;A`JH{a@wAoraghN~KQK%M3*jkqWi6#;C@k)5aHvegO*j~>Jn0QgnI&dhQ ztB$P;1YZVKk`{@tcRThTl8JKnNuLPHTWq6HehAc^RJ0v%A*3f0@8z(?#UVMv z2EFh{8!9R-^(}i-?n<~%%HH0(v%0GVRLcqHVgQ};8Y>shFI#KgZnlmGt_dZIilhBo n666W`BG#%l>e=pf&;xo?<;zz~Rvdl-epHk+ujOC0`2GI?#$j!m literal 566083 zcmeFZcT`i~)-H^QC~8DOL__Z)O?q#F^d=zE5u|qr5Ly5MK|p%10i^d{g;12CzYp=c5+-uHfKJ(cLQB#ox+y~yr!NCE@ z%So%_;1Hv5aPITn!^dt(i0^R4{%Ew4l2VhGlA=~~b}+ZHHN(M?3yDv>tEn;jENHle zKRxi-SC=;q{!h2ZY;f*uf25(vS z#SOW{RxqBWUymsP%Fx)D24`~O3JlqM3wgItM;>{Kgx!2#t`vOp3`gyGUx+OY%kA~p ztu2$^cW7~<$S3S8lzvieTF1S|v;6$B{u}6s9vlu@p;u(|rtO5NVQ_Fh518JMxkVkh znQc)SGb&&z)HfxWtvLOsm>ZH_KlWa9NTx$RsV3_}mnP1wCUeEl_ketxGh zKy>+2l{0mlj8!jHjKefEwgK}{hx`ehbLbt#PP5;FZ(v`U&F|-dLdLUyn0g34)EU@| z>q%lBT9Fw}H8IweKCFq19AJMO+;6QybkTp7M03^O+VC(L_L6~1txk5s#g5##qy(R@ zds@|e^KGy91+9aQw~uGi05q18y81yit*Oo1txmocJ|#D?!hy^RW_%iIoDs>Va(8K| zag>$_8~pAH&<;6|Uf_Et9DTUg(92BQMCutJ;DR4%#v5yIV`l?syMUx!H6z9u4_-(& z^V#VcJ@A7w7ixNX&OLJ>_WMMD69vq-%L~I%Bgb1(AX8-RNvSdJf>ms>eZYAoL9vxN z9LrpRSJ!r{0atbDuD`^~uXs)$IX`}W8ueML^I{Jk9IT9Gwukt8#=xw zC*bgpT~-nx8w%j>Tz4e#es1qS+&R76T!H6vCz2K?TFUY(rAdeYjhNg^qDXogTvLF$ zUmVSQInl9D7uxzK1V=!Wf4gzPbD=Jx)lh<;(#G0JN&`TpCwaJ_$K!#GUmL@>JHLJO z`N*uzR&rMJQ0`eQe=K1XyqB;C$^0~w^H(g9>XUbT z8rICDFIAbL>xD;JM-M&fu5?ifC`Odtk;Buk_hs%I-VY8rALC7L3+?y63jAw{O&pBBYsY38`dZ5NG2aT(5P&#ESurse-ILisz3lVkzaAO);D zp4PmlM6MEd@=dZk)a2hYYYJwMm2zbll?dta>bf>s=kC0CPXNezG5);9MVE75pfvH! zHR$YN`HQp{spb>I4ZN$dDS0XRK-p4>Qpx?Yxeu;QO;FF2ORZD$QzqbZ04N*K$Vp5h+8dJ(%K}zCW#7SZh?QXrrkoD=d*(-lBo_KeM4oiO5$eQYjqL zNjEkqDr;u{P_KEOcA(hwY9TB`g(Kf6CvwYb`_4|t>DjjHZuoZUmhATC4*!-oC-n<~ z7xXXUfG*F!J>LNi@#>ptTU?BMwOlieGpXq;7~hJm3~~DQTV~aKm4=v?I7q%uKE3yo zMrdKMRi0J+HU)QDa;#3utbKLrMnz+bN2o_G3h-d2qut-85}s|r=$3b^v^Y?de9qdN zV3?qj;F4tH$+1K4$9I8tiOm49_gLoBP>!ZWZD9#WR

<1P9Jqf1Vs=;G?OC*3kALi zk_Z|&bqRS1m%G}7Fe@udw9bMDNBPCMHYvL_(^-OyAOTR(=1KE*Gv~rtqx}5#0l@*R zK~dyHB#H7p<**1qWHy60Bf!wyu+T8LWzk*F>%kAQ7I9R=Mah}f`CISX-VeN+uj8(> zuU=hcT<)To(9@_$yqUWt4=o9Q;^W`72mI(BF|T-D`z@NfJ9AQ!G@!TrNjpjV@S6cC zJepF_a-$@ueh?xuY)R>02zq(XEYSV|gvgvI;f0&0n7z-;RUe9@!>;4Q7qE;PU4k@u z=*9DG3LSFP%RU|j^2sNqk6T_h@m*?sb5N51M(?Jzw==Wr1az8jNO1S|cJWre+QNn1 zfs;ODtuac1Re+;=v)9AQ*r&A9S}z8OzAy|hFcDP{a1sO)wQ@=&zaJQtmRTwL`6PkR z=I$;DJl3F(a-+dXK_EchUYxz75f&0~gS_GCD>EMB`mkcM8L-u6jhX1HqNjOGu? z`NZ{%_sORoIww`c{qYIM3Ey4Ws!eWzg!~N`12^Gac^b+i~^t zy3i|jAum1E=V`@*G7??V1QH(>6A}aT?8fF1G&ePt4@@fj6gle;?|_drPk!2MC(4c4 zi^14|>UrbG6dx#v+Zt6}ThH!QwFt`z{}iTQr&(tc27v8nQKhuGEB3iyvrhI>gH$)j z+~6X_CUP_5vSrTe!MV@%7j*wM z+@m0>AKJUxdR}t7YEBgTOl4$ZKMoHE=~`uVci48%c}IZvBmKXxeCLQ{Am0_G^!~9L zI398tE5iilRVRCpl9@-MOgG3p7?aSDkf9-&FQjXrN2aQmE;f=kt>qzes`OiDZ1zX> z7-)7=29DY^+E$2wK zA54wIt>P!t*X{6N9l~zPb&)PHcK7UyoV~)S@gl^ak3*Dz+|UW?%vChZ{j2~wd9%}a zh^qhmgEWrRETAc%R;o_Qt`pPAZ^Z5{co=$Pz2}OdQt;jL{B*go2F>tw3;!AM@CV6{ z_*NFratx*|c$P{?rc(y$GjJhrR=8Asxfx)T*6QLDjuH~6+ats1p}^J1QgMG@kpy$O zT<<(T!O{EFTYj-IIPPE^90hV5&6;3pwxqp8COqY{3t~JBvFh0bu`^C4WqOw$9n=jc zBD+)IF3ufQoGy5_oGK1{wzo^1L8+=b{o7laX1P6!!jl$0oC__S)(1Ibl?&?I;1dcQ z4;%@v4O6HXJH<)5@n@oxU^x7U?(S6>=2kKipmc@-Zey`5fuo!b2nXjG!=Lvpd3E|j z92{JHD@|<|ZDl2)PY!nM#-!VZw*&mIm=_SYQ$Z_Qk+%>O@{ z{n_)+X8#!1Kf4q8b21?{D|a(n9ce2&GkXyB(!{s~1YV2$qo4n6*MDB=e`%`ypG|o= zx&9wb|I4ob()7=@2&p<-nPI2t&t!;kig5gI+y3Kt5sp7I^{U7yub5<`V^O@kjnqb z-`U4Mh9Gh09%@zWZy!!L-aV8eom`OQ-#l-AQQ`-GuVt_U7?bmhg7Ns9KL1;90c=ND z(@_4~H2=yB{M$7D9gp$vRr9Z|Wa@uAwEvEq{kKE=SL5IRHHX$Q#Mqt(7Z0Nnlftj| z5%PhTn7?+-05%Wv9oxP5P=38CBR~OHM0yoVfOJ;PSX6^!<(U24oHZ)9;XSyXK@wzjJnw=)bd~|Bu5>!_po0%P5#Wg^hfK)_eAg2k~jdTlJ0+ ztcYsiIz`I@(|dp?y-_rRQfV!9`KtZfvH8*}88tM4UJ)|A4_txiEvuYde`^xq_~?$( zCH$9O6@Tf=#072SifB8I#o4dE+{#REqyIZ_HQmTl`y{K^uys!EtOU zW-G27tk|o`118cl(jUYw{!r1ZhcDREh{IBgh0h;YYz#d8TW=FN>c6zYO}C?o?P?*+Ecun~(6v4as!Y`-LtT2O4k_dYrv%}sdo<-UUP@u=B&UU-hy z;7*LFSKWh^KEsz7Qatnfj2@$bR|akxklv{r@B8<*{y0p1UEJ>Psy&}?B6^nTx^vzX z`X^5Hg6jSrBR{_dI3l~4R706vF=4u_lwI^GPllV7x_In}}4VSX-q55Z= ziq>}2j$>d+IDZ%j`6pk6oagz%dQt?L2dx7B7C+zimdCPVa~=2|8KNVm$QlXbYQqZ(==khVTch9ATfKFxW->9kGLDPGACSMcwr0ExkmI(qv_t5$q_$id z$E7w&)B(DZ2ngH(b#QVr%+&cZ?jxG&6QQ`&MmIz3#n&%z^<7V zuj$OJa4X-ROLT@6G`=s6*I(cAEtP&F{d;Dlo_O{t-9-I0P?I#{9(S}4sF+VJRiyt#gBf|-m zqx#=jO=gF<*di{yGt`>|&rXt$O-~4k=?4O(PCZZ|JTQ!GgiOCYF<+dZMv`gY7MVo6 zCSD8XQ`eQL)E@4sm9f7^C<(DnjeFrd_~yHM=U??Tg7AV@

m+mOpt4t?G}Wd~mm8mfnTl<1H# zO9gvJZ>8Z59(zxFu(eF@+72m7?J}yQ5FPrAAiLNN>|+?i$rPleFJ{xa?r@%k5Hqc9 zTNp*3?()x|Fg*7D-u%uLfx(|ZlKK*iA%B@m(#OFC?rmZ*kqaSJgu-MA_+WlLV)@&3 zXVNm`D&4i2Ozw`f#;DG1Oor!1uI9I>tFjcY9H=V(53j`l40}%$>>*>)E5vO!238J! z=OYK$lBkM|Y=0b@GX4g$NL2Ao+g*!!s;2TOCk@vfC3Q2)4W(P~cQ5oMI!CePKQl6N zQ8!l0PSGpQI?Nu>*a*7Y8^`=<D%2 z_dTorrVr!nZC49^L=oc<>}zolOSkgPY5qt4kPPa)?UqiXNiCqeFNUFdf(zLYhi|s+ zDs1_t^#{YNSFYk)KR#`9ZziqvCk{97`s+qUgham$OPCRa3VA5(OcmStGijVyLrTu;zpofd_Ohu4N9)azno zxw8s_ex&GC_l@^LDeU-B4cRSBlK71(%6aKyp?Yo%Kw~f+U4>Js{*L4vvNo_qNw$H!2z5t^qlZI5&hl znjy?^$AiBx))taFzPWJOW`m$l>r?mP26li$;B$a* zwAmHC)8(AZ2I1y&sP`4Sq_5LUI@xe1_mbXJhZ85j0)45`o?0rm7Z)WlE)Q^PkzsvBV_F~V~$#L?hOFd7E4%~r^x#DAE zMS=SC!$T!Hp!L~J!%9|bp3CMe=0_;>N`L#&WM-B;qfhk>I$QF4i|1nU%5K_PKze?V z@r!Y!>W=}Psx+qf8d2K<6#GNX(5LLIv5enpn@^e#TF&qG1ct!yty4B!S+q)G4n(P< z9AGbAF6)eUI|T8F_qvE>;wOn+j1X7ZqC)A1Pe!|;@jeivxT(?1`PzN~<&9J*_$g2h<;g-216uKE&{ZCV9^@ zM5!@HdZRx_Ixj8zw3p4Ji8tX;C^rTke#ZRxrMV%!ZiiBvOisf zOa8u*XemS%+~_L($F*!SB0asR@PoIX0auPd8eWII|R6x6r)Ma zCYMHeg{K_mh-AHb`&eT{L=3j)W_95G0?A?u;Tq7cwj?zh9(D!%n%`&yE7a{3`sQzG z1A_#YR>AZZLus`6s$ux|C?g{hzC0jB(>FUHTBT&dfh^z!k5ukE37cvkd!ihO@vdB3 zR<*3A>%!LtQ)N}s1ZXZ3+rW$0Gk}`$?Uq9mBWAt4nmBfYBl01>YjTC#&QRY2g2wB* z)cu@L5*BOZ?-On*^S_WPam>2EH{aMlSmkjNy?DmMGc&B0Hqz?6-uE@==VZ})slG%O zo79ppeU30vj#?Vm=x8!r{3|QR^k)>{r4LeeU(@k%)lKeP!e&1#dinabJhHAa?R6$Q zOME6~^oZPc(6vO*zE$!BIPEYpkB`ayby4_YwIt|DkQnZL`c3ayM(Je6a2Qc~Y+;&B&*sI=atP4lN9PH4Tn_CfRuh>j zne0|t`5+;Wqc}^sX#6tzdQ0DZun@c7%f{>4meuTAGNdLUAt9qzx!k~v-Q#aUp7YK@ z7K8LzR?nZkprD9d>pwxl?wYpye;KQ@+m%L_ASyT|<vs>GfSCq!6NqT(&NAhhrR0qRj_WE+*a= zX}&Y`JvB=nZTcdDIte>yRTZOn3A~py5v5R1$C8*P;ptI#pM>@06QAX_={lH%n z;^ei@D7YlSNnACGz1}ThAekF_YUA1$n7o4w8X0*E1uyA{I|3=GOUsaRuF*&9Z8Qf1 zwy#%Zk#e(DxeG!Dg&*qczLAUdU~&yKmeP+d$&fu3&{ki`K=}4~1|~tSA7L$|wXMjr zHqv-koA$3m>p3lcv3Jyp&0Wb_H_6+@w}uJ6g3g2$2VF;o+4#YH#?DgnZ4wqR{Hs4X z<^s8(^*77MnUu%5q)@k%3LacwYd%dV@a(+*LOy#r%ps*DX>YbVw`X%Ct8;96Eo(4| zQ?JS_tYTGon&$28j4vvi^lKcI9yT~j8>@<@TdfTCONjVcMFnX&8L0his#aXTeaWUq zch@Y5fE}*h4~77OqaLH`6u@cf@3mv+kE`Z_PHP3yn8RvKq-$b5^RE0;0gbPQt3j^o zGnK1HtHZJTUqAVzQGb{ye(_q(Y<x@No$Qs}AILd}a7-i{OVS#?3=1U~m>rZ4q zuPbe)DN(LFtU3+ujqnfPcz%d*jST~XA|4^j_-hHkNvaSeLW%Q}^jnI`?nyz-QvG*j zNcUPxOJfrTR#vxfR9(smSOnDw>M`jE*_kL~oUUnAaNZcmn0d@Nvz4iYu?u3=sT&)T zB-=$98CIs%*pEv0B`_yj-q^vxeKp&lw-l%3HI_I2caG%yH^Orb(}8Yq;U44hgX>6G zOlR=-wbqP!`0mkQ50xprF5Uj7%)maX$+f6?A2FR99-Hq&NQEe0|QNG>nPU*D8TbLu$^<}E^j@?LR zhElqafsnpexS-(!5XU6fEzRGpqobooeK&@r;XUJSDyYE{DuD~=T3>SKe6z>;a_~X@ zwcFkdGt&2>5OB<*o>OtMc{sai)Yz`uf*kG9Xw zL(3v*HZkKZ=|Xjc?$@hc86Ip57;DUd7gc{&XRsM!5pr~*5y^N@dz{Vz;}zz8GP>C% z9y<&=NPqwO2HrGJU%xmeI0{Yzr`70-yS{Q1a9r;AvQ{Ze8AWPzU_n@q#p<*6tcSk_d9k!^a>l{*-77`Pt-*4s)t8{%!HeD~`<(lzk+HU^I z%#UzsacRxc@D~(72e3_gOcYd#H6y&QeQzPf?Q&q8Ct_pZ0?aRs{;G8rQ`Aws`uNr2 z6xYFK$PxM^Ifhp;p#go;>L(fMS>8H(1Mx!0QbqD17mA#__v>dk)5O(}O1u_a=UX8e ziLilMGD{4NglGvX`p`zAdb#@UsG6iP=YXFP$n&;BbK zg8!eAhJXVu5O32o_~dmXoyzEI0l@0Gni$))@=Tg}EWH-bHJ?%G+?%ke_>;sO zo^Sh|(>H#i-}Pg*B^NPf{&G7nFO~R$e*;S5tXy{AS$W8rZ;!*K)+DC>L-oW%WdzUD z9$WwN9T7~_)gLfgcO|CrDwR6=HF1xmyw_)QZ0o`F=);W^gvp+g6F{oiFHQ&zpBm&hZMGqYwvH#N|M z1^a{)-Xi*~ViMSJ5(_qPBz=SqeTpa8A6I1{J_DB%tc**DI*jst_f4YaHve_kQ4sBl zP$Bjcu)WYu=CZ33LI1oKyA|ejwnq$*o8a;pL!Jq!7#Udm0-~JzpkWEUQ4TV~sR!z} zpX4V;Nw)-%^d~y)j(h$A(iB{@S64w-cC%IQv7V0!i#hJQhoY6YhQWwm_zYIs>G%@y zuimTk+0Btxv}lzXkTQc^_SdTs1P9|$^w*ZJ5g&|vSQ|k`8+GssCs3OcDZ9Qc+)_KL zF=iuH5_4%2uLKqApE7cKYp^|z1SE@i6fL-6X6o#k4NmJOL0>64tr)UDD^U?%ylJJt z7=uPFSos=WXWcpVu{Fcb|FTY%M*`Id?wW1YckJA;+T`L>l&V0Y7q2~ zB{AVz^K2cwBDpL-9+O%=Qh3pBM!Wx z5O7pG@Lh5uZmp$hcho(XxjEmH^-a6`fMlYgpln0dG&8#$aybg3IQ%Wl7|3IM&!$4K zV1J1QG3Us0O;er~ryH|lPL?Wua(%Ka3q{Qb3_%=_&`ACsSt?(44w0KUK%dK{ME-35H zE3fl?5Ok1xL6zHLu=3MR%L*G%poj``VC1nb*lXG`_Tw$q*(OuBV@V>9;{B#M>zN#% z16X;HT|Xhm&iv=kdeSn>wVIfM~j>l_AgntcLK~Q{x@4e{RAFf{Uv13UYkTq#B#H^gU1O8wu zKUjU>I_+gLGL1;uEo-V&_zJE*TmF zE#HwcZ0#BScd2|7w2~cV@&yp5LtgK9??O&PGz+~O$A97*3Pq3&IuKmnB?1(=^o@S+ z9^e-JwR!G`k9x+e-eYBgNCrOJ8ZbcqzDIl}`xjOV74`tsb%HDTcRB@XR zRl+Y3Sy1MsVfZ_^H5Jyqaq`^$$?W-1Gy(tKPGu~28F$yO)`{1xRNWC3lD<1GH@72u z!x&fT3$=icE@}ua#&Kk8r~F_iz`U(gw|JE@+lj*GFYNp=O%9imjAk?JD6e`YChkwb zh&Hng8fHyc*@8$D7)s7pm=IS@_xRZ}#=#Um$Gb+A&ZW&|pI<_K1P7SNIpzb|_+V98 z`r{j~dW~a@(z9vYinU~gQr#Lo_dTJ0uo9iBnb)vgAwxFQ@wyWnBeKjt+r-94-c!oM z0{nPhPS82FB*_L8D=_vmQ%J0U4^agKMO4v94b|N^A6&gX5PZs}D_3T}pj7legwSI2 zEFj3o;`aF!n%$sojA=>rHfU$Mlo@E9#HQzc(f5jYi{}JBGog=suHg$^B|h9dfz=r( zLXSsY!<<%qkKJ6Q`fJn!@Y4VA>CEa4nW8@H3hQ>K38ipsZarCGs8hzdsoS7-3vS-o z1yj~u;;~5LG3ZJYVD66SPKxS$NEFShkrI&}*N)BkCzu}Y=R2+1eN@S8J>Ixk)}j)p zWFujTJ0@6k0(X^S^9g>*HmEPz!jxaJ;kg*A%Hd>hY(6gUaUqLoS@IM(}ewhgbj^=BEgZ5TRwNdvy zUStb*JcKby$=6YEy=y4l`%P+^=Z)Fo4-eDDG{m08Pzf`^o2TEue_xO8&X9k6upu5{ zZ&^w1WOGI{x!Q*qd;q_$&K@?*^b>bTJr}?D3GhFex~peI+PK*L6D4+UYO!!Qk)s@- z;aZoUe7Hx)c%`iv%lO+E0`zb2Mj5GaL)W1h=TWUv&f96h!d~RM=h> zDT+x`ZG$?%FG}xHdUtGkl^X|m9;iUT2Q$m)^MnOP@(FP{?aqLfx3@_XSq%=fc)4$u zvSEcU|3XH1Td$4asJY6D4jN)@A7UP8DVN5dGo1g9mQ1t>Tn%x3=zt&U<`l6`E*x#l zK5GE%%U|~1pR21hhNP@!XN6e2!utONw3oO!+7fX>ewe=*Q$rueoqnn_M@59iuXL#dCyssF^g-tW`#OxOnF{)9X=g&tCrNOR{wWHgMxWSb2qfQT zZO~^plpSucpl^7M&=@-mojbr_lTj32ap_qghSyq6_7ZlMrVp>nt+AYvGxR<)hB~%e zac?xO3a|j%@)&*wz7joCQ}s9+^|HN@rP`w*JZ*(f?P8LWh>yBEE?%>jKG1AhbPEtU zzPKL4q&yod_9FEt9UfON_~--IybZVuc(G3W)OAApAsOcsMG>~>c65-+(MMrWmPl6a zz*L@!;dgDFT7WtJcGe+n99@_~MM8Nd7tYQc#*Y+6kGI^sEWkG8U|evQZlmSM43y~Qo`HvsNLqp#?RSH0_RlP~+Nl;B0${eecY^NHKe@WJ%?Yl}|| zJ3UUqw$f9_$6}Lhzfv8V7Da2BValX{&0`MWA+PsO%lb!(v@5>ArY$ z1yb!fv07b^M8Wzem{)W3rr8e;*!1f9RGqRsbgIpxX^easK^CgfyXDBGI;*jUtbsJK zUY`v2D;oZ_VXGwo?$}|6LoguDs0+e`gq;V)@qZ4qc*XLeG@9e?Bd1g=_pyBF4-2VH z^Wn?)V%{)Vv+4(Y@5@|(%uyi^nGoTA@p=T@p>k8m_dpYc%74dbTTxm%Eza|NXZ4oR z%o10=dO(7qcOkUesvC9jy?&p3Vn3L(Ggmz~^uPzOtyk$>+g!RV3p`tkqkVh7zh~J< z?>tMYHHs5K7^|MEAk;iaSTK4ZC~~^?{Y>D-Yh4fw3z7-HL3xdiw2UGE@rU$yF@iMO zL)2Ji(MfB#;UNG}J8a(7uq5Mf7l3{Iu`F5x$lLU$D*`pOsOo9-<7$k1h`rf6cX;=p z(drBS&r`@L8Dsb8No4zONVdb4|U@(mePW7PfbhH$(7pq2{s4 zqhWDU^guV6%WgFtfNw%t+{ov5G$iA6*8O~c+FOS5Y*0>TwejH62fPTIQ$sd8iATgN zBOb;{-oE>Fk^hq2sV^$46O!>DUyLnbs99q(6Dizseu`efridpmFoPH*S_B~`e9gzR zu)u7skuA+>ar~`+XR@ft?j#*@^pl|3Aji=ddPC~h3sd1{Z2g?fq?!>ILhS2`=I29} zc%zPH_b0@5hcbnj97d60A*aJDMG$QHtTGnhnlIHwHOqho;TKOl}8W`Ox!bR1v3%-@wNo!s0 zRz2HJVbkMl-Y17!Fp-t{0b5U2#>c*Ueb75!MBmPF5J&7$)K}_kkDn{2j%T~h$)b0j zZ#U+^qhNCuNUV$)g+qz`|Ebmu6a?VL&XWK^pSy!QS`efUI)p^kk^ z;dd-arraiIX@>M_QrK4i1vyLP&{Ggf;!Lmd8WywQT~e1q?MxOfS91h=d=|6qz)eRX z=WAu%_U8BNbg)%6Cx86ojb1h|xOui_aO+_D*kP_9154;ll%~E$fv2fK8%jq#w?%V& z7J%wi((f9Jca_DiYcJgM-fc|Qd3~`qTpmP!vm|fLwZ)XEm-@6Dw z?+4ZGLR9&G6B=26?07D002h)()D(Rc0@?+K-V+z6@$LSmx2}-b+-?MH;|6JUEXe@^ zbzwdM>BT{>d9B8J8oGlh?o@sKHorvNHCc`fV_YgrC-X@Z^>W*W_^OimZ=Ou^EUtEc zD*u$gnvCTx2Yk}5J&jEJ;^bY7Ox{X8F!DMjNi9f2;EC|rsu^*49Ka+Xr;TJA1l{A* z1;$da3K|ulNd9$sLv|U!1$1e1Zyw?6;K~O{*qOOLC_9os8gAT`bt5a$$&~Q%IGAOU zzI`wK2tKjRCpb4d6=y*)&1~d*8ZuF=2ggTP8AQ{5u~n$#FR&Y1L!@m?o%b?PJ_EFk zgPvRZw<;vEZy#`Il@wUcm}F)T`-y(|w8yryzjus9A%wh0w*0M@82A8P?b}YmKRlJN zk}EO!#Z)RJ*HZs5Y3LnsTI~=sP)pEZk!mQ9z|er>0clro={8{pR<;wT-{?HYm$=@? zaJ~TV+|0Pbl8vD7Pl#^d*`{*579uM^Jkk0+3mmPEj4n>$tz5P~kc_Qd@g=k_NWpj8 zJ{*V>^?5oR# z;`Z3fZ(GMD!!oN~0Mo-vRR~s5bRmCmhPl3(aa7M=NzSK?_ji(P)y+Q-5Axj+Egv3G z<~MX0;tv=XQBJ%(nDB#P^K=^o*b})ctclni7P(IHVuiGlvgz*FGr7L)9z#awBvh>{ z+_f#*M4*Bq4#boX5Y5x)=MzH)&5#b{T#c3S!q|!qn2@|a`+Sm+@kA5Gag>BGaNU`R z^Y%ENX<1jQu)rej{U!`2_`n;ypfd^%)(9o#U^MHGbLJy9ka#w1YyB`_l1A z(5v@!G%bYG$i2^;%S!7P#e!!D2=Y{Fy4Lc&O^9lbyhZi?0!pjUQ&|eC zV|A}nuOAbK@^ZVJsCM$fQ~CAtCzXIyQ%n5Hru(h(bRpNi^lPkNR(>tNSBJl=S*9sT z38@HnX)P;-cQt2!R=gz8*%c{0Y=M;)?9wQi;l4)6zce7KJs;}pn0e!~U_W;enwjNjGyN-Q%1RiZ zI8l)-k^3&7Df<@4;=43O2%t8s$J4D#d^|0ZQq+8SkW7nb9?we9*lW(Hd^=Jcv+`(i z2Cs*t2Wk}Y>&{W5un5cI5+`8MdUoa2@Z!a!us!S-fE?Zm3ASBm67|VPq!5#Df7q`s zq|pQ;TxF|n7d#>tdAV3oZEw&lSDF3RyK5@EFaA|1{zuW@7g9$(o#%>5N=uni>A@-1 z67lt0XPtx#o24=F#aeJX0B0)ar@Cg<&PyKsewgWC%CA5J(H$*SEDa_iEW1}Xgu-TO zYb{{IL~P`psbH!%o)0}2o0e#|gS%bu%U9b$R0U`}F##&+d{R3GPVYyCLBlu00I#_k zkFc%l<+$MRmLQ2sQULe3BX_>#$J{3C-}wGkJt_F{cV5-cdk3hV8u^yiz|rSOQoxb3 z0ut?+^1AS9D6e^91cueWxz)!uIUg=zIg=%uYs0E#Z_M>6aJOYM&Z_I(@H_EiC5Z%$ zlSZ4Fiq`6F_ES$0n~pIo-jwvBvU#2;wi*&&bEs;2m9vLFNBClOY=idW-IUwud6J4K9tP&BI^8Zo4Lnjg<&5G2t;wx|!zU7!UBD z+V}ZO(8d55ajc_!FQ>ISEqgg(5s6bejrKhHNi|@U(nV78piVDST-UN=-_^2M34hG!d5zi1&9z;Jq=sKMhh&V2dEu+IBSwN+vmY4=^n zB8Tvu_jV9#s4Fz!r`?Z}j&b|1Wj8+8LzZ63-VMh;6nko zb(8CEEZ0N3Z+;sE-a<>FWGngh(+eYSyCR{s;!S0)U+zDvuv3p|bZ(6zW}HqdPj-*+ zawv`%LyZcH@>UiHOqE8xMZ3XO^JC1`H@HZC@lU;!Bz-lM-6n2ByD-YV-m_6w9dm}e zcqjyzIJWnSbUT^hoQ2&O&DMIAUwwL0d$y03O(@s?^hPVYWpJ-4==(&uo)qo0LlvBu z>Bc?)Q)WFU@hXmk?(Kb2CG{o!B!aC6T2&VP=5Opf{PE)iuXm=(GPWvT85pYgBnwRP z-5_BzY6)9g&xt3Vk#*&EkD%~bbgE1fOn%*mgG8-x0ldkRWD*-EVId)$_IJ&O7a>#j z&`N#M#&>Q9bE`ZAO(IUTj@X*ld5Iy}jhSAR^l0X%Es?Ni%%*QrF^}dL8H6J!BBPUt znHWB47Z3=41Gp*m3KZ^tM;QX=H=hDVQ2ltkQ-vDiTKimu-6=V{aVivW_~RB0CRL&L zVv4m36~^E7>fH=-28<46{n4TWY3Eo4ZMGyxWz;5pE_;=+-f}AjOc^ekCAC<|v$TD= zE9_p3TlS$)zn6)pAO13uV2M?)?psMD`bk0eRCboGo(N6wWk9uKmOs(HMGW&N8J$|s zQsJDG^oP!D7}1Z5{9fl_K~eiNjr~D%R$o^eUwJ|Z$pxPCc)zOja7RQ6ui~cHwBVn_ zztW-o_@PA%TlHGQm--{|ji3;=j)V>3l?%S@taD!LS+>1ovLs^{z0_{sxj}6r@TQFrvalPmaf-JA zLds9`A+0~oRa5!c{C${sZKi(iL*xGVhdw7F8&D6Pj|XIIPQ3CHlbKPu7nRs2Zon5| zxbF*jR=@HTCL9f^?d^Yqdnx4l}3A8_ruk^317!=5F!USHa9lSSy&*;*Y( zTy-;f*VZ+P|CRL6JptSl3u*Zl36EI7;p)tjKSeYKF6V%g?ejcg%SLB2+cxON2YopP zccEzyp)f5H>plYr5q^@=Op|<`Z5UzerPHzJ>=RdQ%Ho6*zpuwG3Z(1Cs;QazzSG@z z6TbxJHS29>yG+L(5yp;ZRwq~AM1{aG_5lMipq10zskkp;iTx?HmGTu>Nq7A3*u2@u z2n{SpV>SDua-vv6>c=gf#ZPHp3CQj9?PzJM6fETme##y4&9TqSG^zF{zj5XnVAaT5 zT6Puk`Qn^w*8}z3=fA~yXRuN5kAC9lI1r(<)UT5NN;y&G<)uBA8vqeJ2CLk|4dH^>S1sbZvYVMFq?L;rK9^{$zuGq*6+bmn6&Gx zESeR-Xo`?)(-u?X+kgTdmz{mEn1cN@k3%_V^y7HPmj?{bg~K)}y+tB2D6#H8N(%kAVn_a92$=g(B5vs#=a_M!<1l!e3g9$C_#sa z-rHfCO2jjj*9KR=Z;N;TMnk6SY!}RLzb6(Bs_)(y)ccVtwtHFDaJiFUpP5fQP$-$z z3{E`+5l?K#73T7ARi6U|~>vnz+Nb<}`amQa4>P3tEVRHG)VR=y z)lR&`3V)&PN5qCjZ(uoYuJHAtbUo`-1X;v%Om6@Fe8NrbnB8~d*k7St;?obFvBufJ z>*JMES8g7qXycR!KW6zWSyY)!wRYSp(6l|44_w56H-~=uPyPv}6P&eM+KVd_Hm@ld zJaB<4=Yu00xmYU5><`oiHP_j#Vbw+|ixS&8uHG?9LP;YeZ~Nt8?MV8h-W5o*nf6){ z-l^~20s{wI8l9{PJtcKQCLKxPvzdD5+C9C>xro?OHOW!J^*sXC87fx3 z(PHHgYDDBU!^buwEn@q4ZMg{i?vvL1)Ok-0+1>;;+IE6HECCP%pkgUMyV1`6{wZLE zh({r(V{MzEP&(PM{by*<>YWE%iX~96k+yaRwF2OZ?79;Vs~9uBbsIC0k7X&`lCU~3 zk6^{$mskl2(LNTT9#(Wn3o}-6V|mMFep;KkG%4C(p;dO?$wS8cEAx(Ztamj-mSd&* zzX}uB>la^QWn?XC9TMjOUWX4X8LA16gcGsMt($d7s1PmK6-mK^E#1@%x&4NTYn2<4 z9Y%!%rxKILnR@qhU~}v9vl=-n>AF64#H}SJP}JHTFBBlf@}j^O9!HK`3yH;arq%Ax zRCG*u&|5e&|CSrNkhd$&3Tp2|xkuJmjw z^>*;+HDg}KA?8cW3G^R)MwUD9)ehdc;Ahvl4^qctD;(#A9#gK16vA~NmA8y4mxDnR zJK(MfEADwu0GrZ2QV3ijt@Y#9h^JwxE-zS*L$^j#C1vCY`v}gQkShl^d_8>`Wuy@Q z%4&Dwe5Ufdy=9ixA3~#}vwH6O>hoXrfB|(B=Fa_JW}mFO!t3KWjHc|_`EKky6vD>q zwMv0vQYCt%WSB%zJwEKCI5F&*I>62#Z)0&%>o#bHUB^Um4q1*>zq;U&Jc0wE@Oq<5 z>h5|A>{&>V)16nlk1#A894U0=6ZS8k7+X-&Tx@??md}gg!Ei*kIa!m6Fhdg{| zI}_K>`3Lr8cLV?<0+JP+-+w-7kn~72r_8zUT6*Ae<`oX3~$DuVc@fZ3cPGssw(A z6G*-4KN@I6L#B7-8fF$ux4zS5q4!Q=!OQVWo|RI?CymRcJ;!PkM6jGyg6fkY3tlVo zyXsGtK6s8GcXY9H`@dLwl8_)_dUd=M8Qh`5!mIKq+1T-s$Kn?86C)Km!JeW3QK8Ry zM9v&1!}lm?sUt5fX4GX2lPjgg0lgHoK6_|GOR^{P)SZI`V~z}RR}l`;cgCWfIWA5j zi=7{0Wqj7~Y2QXtd!WEYdW49oAyVB@`YQP|Rd}yUTynKm6wmowL^W-r3$1WK$}o!6 z+qEYzU}?X=r89K={ApHC$YErZdD5fKtaH-@jCkLuLiPG|pLFZ@iHNtP1LtO{7l(qE zKh45#e06l4YTCvh7#X{IVm5A7%@y28zq_#hV$1rAx}_X9W4&z(TG}YD`*jG-6ib>^ zCeND7%b)Z?;khV;0k7thT2WX=-yK_ zJo>dCprDGlbK~r?=L-EPZb#mVW*-qv)={TUYPGzPjOy~+5(AurN#8pmn_erFvDaG& z$Sd}iq04-2?6~g>XMbY#INR}S5YO1S=GZocjcb&hLBzC|m4x%Gm2#F<&ek`M`v!Te z6nrP=d|x-}e3a=4XjJgc#-kBeo67ODV*MU zp+P|lq1M2lPsA%e#&fPX4+MEx_h8u^;m%BJ&7PN`*P3Zj*b;g5?MoLgDx{cbAyPjm zkdy<*0Zb2dY{*u_UKQtqwqbm;IS#CnK2Cw7X)=#S7yL(ocTdHEWSy4&= z99Zu5u;{KjShe_w=fPfQ-*mwtmSP=i0Gw->3q9ibOW&K*+7A{=(2w;UqB)a()WEp4 z4jiq8+s#Pu2_IK_zcl`h85(A#GLeuui%XYxJxZ>mgmrgkU8!>R$~cOQgwe`~EN|yqUXl{~qz;n)QRm@C(?zU~;XHhKRy{rWq za?b5i?hTmp*N+pQ^jqG`eyW1)hLY#0mb*bD>IV>Bz+o}oySG>in3KP=;@iM2q`%_t z&k+smnF|5FHngU9TGa$5Vb5+sk^*Zp6b8W$Is^ws!|)Jh1d@q+aY7QryJMDWtKr@| z{vvo6utE+Wt=~h8IXf$MP{HjPQ)H-2=d>f-nu2d@feb?S>NZ89bmhKui*E?f#3|k{ zBDX0~L}lt@DI{^P`zPY3E67qmbb2Y=srCU2d*C*Zt`;)G>Q}sS@<}mTR!Grfyn<{K zF~+M-K;@GZwRe1qnFa^OyzgoMuiEf`_s_S`Z05-_04c%QIVo0mmlP{O^O~hp+G=5u zf#9>w*3@M=Wh<4)m>H?g;#B((a&ee5=XQ2wT9hv@Z_5QS(!%Mg+x)A_l)HR)wnpCW z_*^(QlA}J})6b#~8^HpDi3ii4-MM%}ZuV9w@E5Ts*$NBwfPwPO+$je)4h zh3?#INxhO|AR?qAu( z!3|#wj7fTQlld{+r;TYTrG*laVs*c+o??H8@7q_u~U8k<%2%}j!Nz5ZV_H`@3gtIRhHa%f_->i zzai@Ey9+k`d*gP>6rw@v)=XleZ%Q=X*{EBienxVzGCam3%A|;u6Gm#E zDtV|sbITcv6Z$X(@M-2*VYA_422@+K(6Mj|%j~qrX5Rv15kE4NReeu(LY2Lq(bORc z4GpPY;3eNc+K?<5xI3+V#oz39`qiqe;BpDVkct?0$-1-(z6d;a8Vp9`J3|H*%NcsC zyt$TM@>Th9)S=VbRCaCCT%(qXzSoU6xt9=(LD7-xFTN$Nkl3z*NsoBeQgg)#2z>|2|cP=u=n)5QQus zhu_}4Q-k?*ZD)J+9P&~`R4AWJ?Il)JPrDrUR#ksxWR2J=I54G!s&E^YFwW`l!Uma_ zjd3RSQf?tyV`<{Y31uJ?xqFzwZWn6SC$D8j?_s}^o_TF;^ynz9L`T`k6QWw1vkXkA^e_4vg zHQgo6>K68kl?|(#X2*DK;DOU~AU2L`E;8@;b}7%KfdQ8_lfyH5i0!`KC;7P>3zwC1 zCQhRgr^3)&o5CCrwTmq|S02oJ@ofdkXok?+=2*>UlY^KqHl}s;_Pb9FSQFs_Hp`Mf z!bWy-S|r1tFxs+`PgE2!&~<_3tA25G7*agV*RBcfVgbc3TGsTt4}aB!2-Pl_vES># zp9PP4=XZ@YX9RZAB8O&;=Wxdy)5VAolbS%;jgX=|_;Z9!>yt0RyB7&d^!L;ljAM1> zj>wc0D>H<&KkH~MGE(6_70^SS=<7oHz_Dc>Nz=r@oH#P>!$jyeHhos{;T*5}=I0tR z@X)HE6B-$NAAWk+;qsPzb?+W(SCso7xA{l- z6|VjlZEM{!0MGPCTQ%#gL(IL9=`XUE?VFab@E*lnV<8KrI*)lHmSs0BEK}`OsTMZD zY;$VUF#PV=TkmE`hrgpsLo?lCRZ>5w7r(%R-QGCQYUw1^I`hQ`EKZBVH;SIVbeI!+ z`5-?ibJ=P&2MCi)()(h(!AsFa<%LJggbJ1(GC5(K{c0C^Wdv!iPMdc9(Q3>>h-A7N zq7x8>lFB8HrP%ZO>2l!^*U+tnCKjHz?NJw7P6J^W0YV*}2U z0%o;JB8wQ!BPITb19XM0m#Umv=c;u2d!{PfuLowIAu9`T%P$kMQ;H0{E^sU5S;#8X z$bRem<%ns%$rk5kHJPF9z)E$fOM!`FrwsrbB?Xq{O;2dt35sK(=5mkP#RYHq?aZuY z+CY=Rc*_kforqtME2&$#_gs#RNh#vTc`{FW^1jzNb^eJF*y+(-CWDA@mwQ%pYvLNA zg85=ERxeeq5eYR&CVw-SYHDL;M@O?4Ek9nTmG-eZAqeVfWA*30d(IW%Jkp8^EUGMj zG|MNcdWJi74}bN%nMD5PEcDjoQ*fx^L}YZz4Wg^(y|1>J+)*2YJFrB#uBXO+Ji)@; zr2g00pA*`AX5Qwc2M*=ze2N9Q#v&hfs0e*H=6;QnJy6_Jwx86K9~^>Cv1B7p;8=JMW-Rg&$nbPH;HGL;tvXQdwS z&CMbBs3%T_LsDb2z2!jZxBGm9))xdIBWL`zh~GLD8#r?53jWnKu586M zngPMQ&KiT}5s@QPi&sj$dJdBhvQQnq82>DCL@bs4(4u@liq%;gfHln(7P`z@@fJE< z%x*(`M#T@W0YYF>iLa4xx!RTN6hzg86Qi&DU_B3}!atuh7CMoIQeR;?IzZ9jZE?6> zFsKJ?6=+pi*lCJarReuN+Tgt@0`=+Ss}JyRbkqd=gWB1Lg7DUqR5ivlm%3J&E2fFt z59nAYA-}A*`yL6^_u;l@k0DMh>=hGdkB8jg!k)`T7L83QEvayD_iXMJy<}C{aDJaj zh9~#h9hV-N#-j8O0B(tzi6+(ST8F^PL(W7^2v=ewUkQf;wGMUk44hjLv zow$pROZ`Yp>p~wp!^N<;Am~HAoq=&6rb9YC!1oXVdOwQgRl(@f8`CXQd=-mjeYMRR znH8O3f8+*X3kD|;Elw`1{?@c1^K+&3;^bK%QLdf#3U`V>Y6 z#Ra!=?3HhjU3=^oi^UTwG{*U#`#xB2@VEZlQ^;8_p$;s+V@6Ani9adcM+sipFP^w@ zS^Vf5HP$9FQ-}7+W}ZqaX^u({3K$-+%F@04E!dycwXX6O^W^;l8BNXjc&^mTnJ+-0 z@}rSx=SLINzA&V_M>KOCRfh^~z*p;RJ1l-PsJ~&aBRa5nJU8Q*@rLJKUK!c-5Xn&QY!4 z`2oJknBovodaBw#MS}0Wg;g-uY25E{Lu+3%eLbIB!Y{IBV@n89XSzPqAyo*Jdk4zt zEYm}YkUr6hos#67Eie?fp|TsmnaYu}Xw?`C&eiB~90 zPL`>6`Yi>HF94sA<$#>~QjF?U-9#HoUhX8%23G$ULWGiFBbUp*E7UDTU?7GjOF5W zvNTS4ErbA3iWKO8Q&$0sB@eMS{#QG9!(oanaumE7m=P?X^JL{+lGbJ6t~ za~nQ7yCf^O@T9BMxa0xnUtmLCSr9)S5mlVs?$7&=NL<*MV7tR;=e)iU?8kTl4!sp|N1c^^moqANXBipJvbJ8{UJ|V|A z$Kak2v2xL3h_CJodAiR)?G$;8{0zJNEh;0v#G&mLBQ&T(b>%fF0G#{|#S9snLwS1L zP!m#^Pt!)5Q$rA+U97bzH)D5tkWCcfMePX1({-h-v4ChYXL;W*1^L)Auh@Gf*S#~S z%|Q=;bfNnsRoFMj_+l4tv!F^@E(5pK{lgV{>p*z8B5p`$Y?Ix=<-*6XRHHl-9U+Y` zyF4hJtI`-N-0hpkdCz|~B(5o7tQ=Do{H<6BEoh=2x^Qk9f_M3nt-hh(v*C05gO`G1 z26&+cQC4J+@)QT%^Ck6CZycP&%XS*G$R(|in(|lULG51SHv=f?m71#Q*;V`z&2;e22~Bo zw?0LZW^iQnE$2^UZ+fslWHB}R2M|%I#rmNlk!&_g?F;EzI3{Q`&!nfs7n5*a1~7#C zYF?ks?!z1`*eb-FvC*~b_!WgM)s|rxnS~k8O49@1>+D}pD`MfXf!7*cqPPdFg1{E~G?;CNvZeceM%HfH37hR4chl%c?NT7I z`Ji*jxua5+F3m$#zUGgwkYmbOZEFZntd8b*%~P7SIih%U+a#9Vd_1aS$$`>Y$hjD2 zdC2}+;n+Qt;aDCt>w%o6WBg|>r|+N*G9N1NtvZ`joFr?r@V?`SA60b^!sxdrjt+Oa zD}q@&4AofN=eq^3Cs6GtjCu?{9G)a!b+WzPg+P3Fr2~#~SM_ym>+~%*qoLoJrC{kt zmhb#g+fXaNDel&{EeEu@TSwkM7csb{|1sgZ!gYnfg?S52=gUEvpG5Vpj?9D7Zl%e{ ze|?!=y%hHD3HdL%hm_4x|b+t`ivaE`&quo+V0f}SU(G}#MPQ<%F@wT&aD z>r$CP#ZFP^jgaB?QUG5Fp-OwyZ=+BoLCWLmM19=kN3O2?ed-rILbUepMy_B%(tFfq zNjtQ~;|A3HT<^)|Y<{p5T@*Z&xz?zA>Djt1O89`ev@oF+oo0PMMY3hik5J_(aE*^x zS$bBu%p_>3-Md*-Bqt-x<%Vj0TNyl+_{|kYH|kKc5czI8%1mYw*W(Y^9B;KCGOD1% z00FQ#y%V+s^r%)B6ja$S=pN!Z&&_NRQ&A85>ZH@LR5kP^T1c_!IF$Z;dk`+EHS+@N zYdB?U-Wg-8PdD*4T>!5M&f1n=0Z?<3Ys-zkjU_Kk;CDAZths^=+n_cU;wuX)^CrRS zu&y+DHB>+!?b`M||85XZw3L1jkjDx^Nrv&8o7N=GysK(&WZIiGx-OGoA=d5m#YFpA zd}wAFD2!Je6&r7sog{oo`dTlso4&55?9w0B*b&BeLgUddyV%(G9sK{ksO35Hm5B0uv5=vzHj57i zT0!eElTQU0CViAR0~Oh@^*AP<@@HvgJGy);Xsf30y{xCyRVoyNBb)TUiC}DvxOUZ5 zhZcn1F;3Co(H=EB*Z83^RlAf0lzRIZJUXv6^|8vlKb4ABP!j?(*ISZF*4ArS0mY`r zIbmZ1xcKv5t@qe4s}DVud3#@cpL6^C?x`tbfUvo>_x;p>#pnLJ89w&D2m1?r)%mpb zls*UhG6DrfrDeVY?cMyRhR5VC?HTVtZI1@xo=wQ#2*5+&+ndMFH-jL{_43&D7j9mI zj{1^H10lv8SU}(?sG;24Mz|ixJbV%6w7$k?Kl1#1KlkI7W_9MqmC5?J7;*N40sQfp zo}DAuq=>@+e@YpDK)GuW-~J8d`PG*K3_an%TE^3vlUjS5yZIXi;+&^+JD%dmL&&W_ zwOn{9l}AXSz(kHiB7uW8!>t@TKOG0Kk=S^{ckTwyc3%3;=wMxE(-86mh%qy5;e~;p zih>WM_&fsfBvRJ#boU$cCdF<%7VVjLl(+LkTPHkV9%ELhJQ+09rOzYn03+XAA<7yT zhQ&s$Mnxns~gDMS5#;Xylr&8qo4+sq!uBy<>j2BmqLVdR!r-U{etG-h9;t< z)V)RqHy1X308Qo`_Z>b)AHO&@;p-&xc_Z+4pwR zksGS`XP@v)RBwe9DmZvalcQ>Hj?By zIv1U#CnEC6X2aTHYs1+ z4ue4iDdku|7Qj4SwB8xeD>R~lffvYnEYd!$vL3Q6!dx2M-hS?``5_46-8z>XF;AfO zkX4VYCX(AU{boor{&9fKZvptI^{q*~A`VhGr?MW81=7{WO0pOkJJ@|U;bEsWFUbZh zt8$4PA?ad@3dv)ynKo_2jvZo5u<=$0F%i!kvtHRNHjAmdOB4c)s1dJJ6f0b(NQoP+ z)$ZoK@Q&L3d8*>DnWcnFC}{~xa$NIrvNilAR4R9RQv9;RZqyhaRNKDP|aUtaRBc+ z+^YzkmHD>AG9QLJ*rr#6lnB4fK}}$9|I>AA2@0rL%-EPwdx+X#txG7n$9zeGK9erA zIs~iPvh1iJ6dZfYCOrEJpfXm5-7+w;Le2vA=X5L0cHorX=@YNGuL1a5dGh#93@+TR z(E29TAuSM7ZR_KH%hXfO5x7IX2@El6mK1-s3`e_5JXu4=*Wt##l9ycAd{pw7Gl`(* zOd5Toxay#j!i5!t_DMhKs7$xEg&hD*R>31wb{*I!Djqn)?fK=vUaTc>ozbz7-nuIY z<{l(9_Ws(G&#{5Q?9duKgHUzt*re+M#0k!Cm>7#QpUc4R4tc8fmoddYbPrk za<6WR9i75m2z#pc6!UF$BE+Ba6;@NCtl%Cj{!WZvdA|4x*&s&}W-NpE>;f>O>eMnk zDv!OblSdr>Y*KI;Zy-&}J$p8o%&(#JQQzrdu^SREU9)LR(h zkCf#qhh>bZ`ut))CJjekp}xbUaNC5gWz{W7bLvaY~c0(~iDD0;Q`TCs2~3AYEH zMMZ9qgM;YMTST3d204K*TVYGRC#%PPP$F4eg<#d$~b&gSReVAa+@=rM=e!Y!o+G0NJ$k?Y1s;wso zkzUcq_)q+V|5~_1!+R*k3}c=N>U^`l_zYv(HLjkbzrFg|!#ev0v+@jT6OKvP>Ii>? zXTd-a@l=zMs@R7WaA>D?)%eF@h+lw+d5YF?UNJHuhKsZ|mau$>YlRc41zumrx;bYOwE3SQ*%osFD(RltUQuNue+Qam*!|91=NB_#Y6=2{M|bj zI(J3KorlWcUQ$g3un*f1D+(9a4Zu0p0mlUq%e}}CWdvbguj-qgp;JQDrLK+YJAm~c z_l0>dX^$#}Q!DUc)By6=r}Pp{gAp6ZsuhSQ#3iMg_%?zt)?ZJK#2L%jG8UHOwRVXG zZ5CG&C_+=8jMasq5K68*V%E0Tp-t>UVHXLkU{zRVJbWk1d^l3Sb9TJGC{ipSdoi6t zZd$6!CyFb}5ui}=Sm4<`*9mV48FsZG$4)RXz6BObs2N-;m%@}ADB{uUA=+RN5b16G za;`5ffPZOdgg81zP;oCL6nPLAT#@+2sj(FFYg)fjv#S36;AU8(+$!cpa9X|UI6ma*|c4_O0Pthr$=aNtg>waH9pb_K4-b~S&4 zVG;0rGqE4)zr407F_~)xYfrYO)}%4lrJ0KB2HupHpJFa{QuH2aD6;!h;_HagmzIO3 zFtay&eSK*IAiZb|y69}>Dj4nhf=Nn4*slTTUrnfMVpkOe1qE-nJ*>#6^@NfU+l!;X z3eaxhq(8t={qV{^6xCwK6jV@TUhvV!jKP8(2dgzWrU7utMlgf1xsb;5G{kSl-kVkI zyTM4yk+mO_7>5-Fw6zLvCPD+6oKv3AR@4I%x2d|9UN(_MZ0^%qU15##v1-C-h_`(s zWz1^(8=7hK9pw2q@8vJyBG+uEUKX-gO46IhY@nei>!|znk>!Yvy=?3imt^cI$Fo>R z3j~KzVkxvzDgn{_QW|Ap{A~%utll2#kL@pje`Ipj(AL}Nu)CJm|I^UouPWm?`;Q>u z+66ofh!z3kAOjr7@jK(7kH2;OCw3RW%lTZQcz_8H!gLAH(knRtfZ+17|Vc+KmvYq}8ncTvn zL^A+$kGJc^7#4Y7SYE{ri0Lv7xkJ~oMJu9}6D~5Ms-uVfG1f~(@V9@EVAx_gr%#|a zI@MJ7Y^ELCn1!k`yw`fK1%h}smfANbTAG_*EkH%61Zs9Czxl)SN9H$PqptvD&Z>uv z9ha{G14tX&m~2PaLGsoMsoc7=OJO1z!PFtv?#K|DWy;KH1oq-o;p@RxUWk4ipgEjtD8D4+H33*{G}6(O*I`aAYUv<^+)o z^RV*5tO_!hPW1nGxc?7w{$*GiWOj<&G^|>u%Z+AC!%Z<2ZE!p%{UpQ4cl>?#j;;?W zzPgy&mtYRU-tR0N8nnZL-$%M$_?OrG&KLftw-)!gmA*y`*aRsTQ5Mh*x-gHTzE>y^ zX?vrKMAxj?I204smH{stA22^%q4nA>(EtFKh0E(@Re-AwtN#C|LVlaP56pdTaj(&{ z{L=v>d){VZilRIG3bT*pRrWzgzT#rgQarSZL$KH>2JJ&#W<|~0I)18eH^>E;8J$~R z)ls!_?mx=W{03pm^K1~&b+XHTU&QQM)KsDnqY_t`9>@T|Lxd>RyE2?Z!8NYa8AsR{ z6*aWmZo@Pe=6-71L|Cp~mAmp28Mr)r_z%+YzY@pr@Dnm+Fax{qA2ek{Mz>MwuPANo zsO@ylHPS$AV=R-N`^?<OA?FWb{lU1xFR6fjo;cl85F6jHXW^orGq~V8*m#w&;w!!yFtQh=3 z+U=inbm3uVPfWu=)-hx5cX)dEK4TEsE~o$b4}Z{l($Hp$P#tj+`h#Bg^Xzm7?K%lf zgB$%(*6=4z`(0o$NlR3S^FNsW-yXTf+@2>i|FPRTf5xIbc%nO#b?hZikQ>YY_?c~g z#4l+A2iGw{l4t)U-bAroW2j6QzxgvrXL(#U8s9;4h4Ft9Z$$R*+gWbo)ok3Cy| zhCjl}P29BY&I4VIyFBm1pOy<_-S@OS3V7Y0BXDWvl z9b7ZtM-eI$Nx6KGH|>FOE$H^P?)k)2-Fq)mIVJ}J^#7M{{U1?xEdCnfc8{+T<>t5m znx@xE5fYAAXYS3h=Wpn%DL|uknM?i|L#{si_3TW8>7GW@i${%SZr}5XFh-4bXKL9e zT1WDS@g9F0241QRSbSUC&93J3{ll@;2uAOoHcY{6oqz7lr+U_#U*EorY~AJb@nq{uDbt z|3c&Bl=O`Xdbk7iZtLop!=sd#cD^KbSZ7eeV%5e63q{gb%%X`HX()nL0?~^(|y1$ zOsSpAZsKPy&T_qxzSBn3UnxBJXDq&bZd&1~$1w`;x^k{o)!g@@Txo1~Z(&NZ(`H^( zCHSxyBZqNh6Tesdi~0rTB}SR`6O@X_N#IwQg!#|<@2hF}3-y%31hYrAgL^i~Zn#^V zzr7g3MRaQ`7i0X90Z#@6&2fi{-YWe5)Z1eBZ4%}V8zqBC@q2T9o2(e1WN|lKuZow{ zG)yp`H=#6W?YyJZ(K#UOMr_Q`)~+WbTzDZ8`HOeJxu0Sfm4i+TpVx?Fo@W8QdX$iW zUM^zU@2HW*eaFlTBkW8M%M>jt{9F0@hl?4W&gDn)<&>JqkHub&#J$~ZzK`Y#d1Un+ zRBi$QT|&R6*W@PuoPzYb(A|5tZ{3r=i90}|`l%FrYYIR40qtmOrR}Ks+p^a!z}93+ zz2>i7(8uCr;6T}bQvje_e^|=Uy|CO<0#vE$y%TI!vvuG5BosSNnd9Xzqq*szUjnQF zUSn`%?$@k`z8x>N0^sTY7}{T?Z{9e(L_bLmSkWKcKMH#7_>@jsaF~yJw?tfs61Wlf zJD{G5IE~?3dENsne%zF~`_cJZT}vNLe_!(q6|)BueL3C3!yNnvza3mR=g5Ma&v-Q^ zWY9i@%@{bw46MIqCcKDms$lhMoIuw(=tIj2yX3*4YpT9(4nNTnZgbFyem-~w-QSm- zz%&=RJ_I`Q{SmMqe`WkqF5ju2MC6|yp3i;cJ&?Yir;;9>&r_+p_~f7N{TpfcN@uUA zpF8}7=8kT|<(?J*yf?gq9Gk_j+3Slnu7WS}; zCI6nR4;c1W`CEcBF=lVP2Siq0I7^4uk*)0h4dH+1z*l?D&9%A1d);;VV$POKm2V~C z8K~86MiGK=SS#wl^GvO%rtxn(n)DbkwL+BK&TTa^Ez*Knr+Z|d2*&7cKif}ws@s4) zPxZmg<#OP1DS5RYWH_dw37rw#ecuM!rBV5!GyEqR`zP9Lft<(8ab~^rB_)=qV@TbC zzctSPS|$ff!ch#Xy6*7(@J|`${+o7;4|PyEx~xs;!c1K*a*Y(yw7R*<{AwNLA%D?J z8{QrE>-WhV+_R1*DI#l>6+X)_nY8+h{h17yTbMlS7)pN!<{t7AF{xi-5iRNg8Tn&aWD6 zNUo(gG7n0lOO$VZHe^D!#_~VnKOohgh!F39$Br%$hl60qE9ZYE>>p-#US!u)9&&0Z z!&SCuBm)*xap<3>>R(ZmCG+R7J<3F6mU zSA)u?+zw!-01T>lPmuSNU9IUZVZmM71fhgLHkO{Qam{Z0X<+}%f4WX>r3gTE(HV`hQH}zf9ONJIjc0EZ$HkQZa-TZ2XQMWIb9NbEZ2bLzk7zGk}Gzo!$?$ z!5(I&Kx(X6E)s{gwqkDmtJwVQ z7a1>>=Hf|py+^$BDu2+pIOd<{`roj+;+=+P*d@*H_=;+mG^Ngj$@7POhUM@jm07DH zhL-Y9hK#Xm-5Y_wd64~>r;i7+`2XCEBz>ID!JfW#Q!NHpU z5z746kZO4@b@xht0NZk)Usdg7y?h@Ma+_=Scth&XR_LGATKI~Tt(AWWDBMOh%=yAV zr3)-6@7Zrp^Q0Abid4La>{EHW$s;OPep)?$TM2(9efa{L8r|ygYjjvp)`lYQ&9+Z87^!Wq z3;)l;gJH`x_|OmN#xxr-6%KaeOSxZ*JpS$B**fyEsHiQf^d8t1pqa+=)9e13ajaVb zZhxH^Kot#`hj#fITm>j&0aoNZ-3Yu=|LTZnpaq6bQbH)m$p9x?-^JZneQVo}ouL$X zy|U_=-}zMd${E%iseU7Ger+-hk*G9Y0R{3jT5Rk4ccfkX?dLRJvML#j(DR$0KA^MT z!JET4P^WoRwnd8Z3ma1lE1MsDp(v}7o4;mlu=NQtH$R1ga`(I@EMr>VY(k+rzC%di zdS9vD(+pCV=d;!OJNh`M*wBrSL!N$%yM-WzsbTaNLl3QOQ&J{@jw10fDKU_7P4D_x zjDH@I{?V`+zOH6giBC?pqer@D4@&EUPXC*Q@fXD$9(ICd9K@`i*mykl9G5>mph=6ozV4lZz)bo^KS%EEiNSqPEG zLQU_qvW|`o1q%l>gm3|fS2uAB_3L8KrLEC2gP&{AW66V~acpa?l%#;|u*}(V@3!SV zXVa;(p{GQHP-R0oS2|o1o6o)+;qhKMFK|)+Uska8$US31NE#a zl~qfXT{QNt7is(GY)>}>1a@dk5YiIVzf&CYF@#kzZnj+Z)3Sdl{!6KyX-HSGNunBk z%L2sR+m)Dtxl~X&NKHd|VV^nqhG-T3%gYKB z2&n-4ISl)|mE0`);qeCvny+-j9){*dtQ9YoTtQWp)K`bN+JjzIRVePQnQewQre#G+ z$MzA%6y_{c9zc_1^@l-4PXhk_nt!>dsH*LD54+AGe2}d}2$+7=8jXrDM04j)jd0D~ z>{~r_NNBM6i?~3ua@5KcE8{FaPU_m)ca)RuWTZGstbE*+z}VbjM27?=kH7Bi~b3~q8|5U94nj&$>*tfb<8E_PE zRjpIm=K7Ea*u z+w$d%KtT6}cyNVpjxqw$6lS7$`efFIjB^sp?Je)9;HFLjAXi5WL ze5Tq*H0{Fh%){R){EN^GDYFM7(T?@4?|bgog0hxgJ)djJi+;Cs@oacxkF5XAqy|n* z;}b|*LWm4@bNg*SAc6AT2rxY9z-6a3;LF9$5%cm&+ah2lS-cnu;AR7sdb#d`I-Gy| z&@pY5PzheqSQc=Lktc_qJt_cO`Zyr9%i~=Reo5Dw_wy3z+-5=DuJtkBm5#PgbVRV$ zMbvszwZ1BilpkVd_8aMxa1_htj3^eV6|w9dW*XTa2Bu@aZEx{NZ`$dQO4n8XaochQ{P~rP&p!-HrC=tcAM@(o8R4 zy1T2sO-0@}oyj{2K72n%=Wo;dH;Q8lMdvjJ=pDkk}5i zF|%_HU20yMY%_iVnl!9%&PjKF)>4}B!ts(D!AQ))@w?#G7uv^Hk(s6<4hx#^buns3 z1mxz1zDCYJAOjtFa0rKV>!aFTsUYB7!-6ci-@E7QT2&=^w9U@j^m!8BT*DB^TG)QC ziKkz+{*jZfPk+3BYv4I>8OjFRGKx#E<|osGE$^s*(1*AtHlEF2DuBQEErtvgvHY8m zm-tE-PaVPmlH99w{w~^L?&ecx=Zm4Y1nor(?VGGCA2*339%cPD`pDLnbGbn4!R{rA zt#P+m8zm$o;+d&`5eRvP5IkO0x4WrhDaC$Sr_cUcqgH`~s$AhKAmhG&0d&5kikevgi(} zx^D0gH715E?EOI4w}1OsmG&^tf-o_SNq4%vBAIHxp)N}*dtUr-!hNlf!{@NM%Gh1w z$yc#Rc>;5gY!7j*v+-T5PqtjH4-WGWb^Z1t9-ZiNEA8&-SS7V=l&f)xt^#ikBipKN zS5$L9ALH^lxfnOq?Z|R(qFUS3*f7_~U{)1ywj-Lv!Rxx=f#lK4ecIFM??g`J)td{o z8c?45^bW2}niC15Yz7+CS64zO>ii&~%1H+$T0ju_}Dv+RL$HEIveFFGdn zO19qesFs*e%H%gO>1YlyOA%LvvSq;RO0M+kZta|Lj(UTad0o_o5Bap1Wx8+-RX*B+AM8qW)Y0HNqFPI?ZQb0CF*w=$T4FGsjxr zhkDFV9f~%;g)Fk)5AZ8fM}gXSamcXs%`n7eB%bkQnXZ5YztSUr4~e;2LMJa&V{9#j zic=Eqe7ra`8OhvuYCItjJ(ZGTdjdFhyz#v*B_OehF>QHBkWip<*a}* ztEUONZ=`i>!dA*Lb{qMy#%jlmSgZ9k`!OpCJThsvl3W08Xushe(zVlrZfxOztIG_t zLiQqMf(l(k*7Y8CaWc%6P<0_j9lmmMrUgTjnT-J+=YWiVtf-Us)o$)B$3H7BjB*e2 z(P`hVots1@`!pVjmL+TBpXWC2>XUm7#HHJ{tmEMTiiz+Q*2&u;jpyxVYiP9rA$>iv zp2K>wL7RiZBUpU!uLs*5!j_MrX=jSr_M<|YS@k|+vAXg8sDlpleN_gT^M!GoHj%4b6o)l`&qSMf)nTU;go?{u0$v1Cq#BoVbz0cW*7~m8N56WXs#Zlsn z(B18wn_L~$SDP+YUG(^Z;r6W?SSwA*&Qd~FIJ5jS@7~WFlg}$m<$aqwYvgCG-#^B+ zR=6Rh#qG94n1?ge^5h>B2D!H%qkproGSgmJ9$xD^pVM%bBQeo+sov7JIcIX7D={%Z zb-KUQepy7ZDJ@Ih;mVbwml+-U;jYf6q%emp%ZEUuy(A{{%3P@aek|g{MK>5_NWco} zU!X$%Sj`jFzHNCiRV}x!D!Wj~y!llGz^E8X;7SF%AjeUDc&qn>l=Xu(O>I+-y8618 zfJ>i74}#N3g!iU{QTJSQr#35ndaElRboTbT!Fc3-?H_A1yv_Q-`K~fYym7b{iwxb>U(c5#X5E z8CTESq@(0ZRGi1~BBN)@o$WU0 z9s`OJWLF!63{P^P4UohK(q>8hDr4-DRNa3FhgFmkJtx8TAbNnNb&Ub0?R7@@9pQ$<+~slQ0}$B4S- zr>mhrFS!XefFNIrUD|Oz0IqYVtRJ#`7XLiRF$NaMoSzp=^=aAZ@tZMkU33e9xyxD! zDW-0JtE`B?Oey>JQE~CXM772ZQp&$^EW*e z>y8U8u+eePi>@60E{SwK`{&vwF=xjZUcu@Q@FsTlnC7@V>|GW8;dbQ(-@O8#yN>(O zX+Vhur&sMt4jd8CyVR>)F>?Ab0}|56)BOBYlZI$ z=KyC~>-Grgx?dpbCWq4Fk0t3NuRf76dSI&aDN|nNt3UDl2-kKSb}mf->Z`rBdofG! zc5|U>UyuL%v@%|1D#E*7YevNBoja-`?Gbu3{roKClE=39Fv?$Wn6^ApVq0c4zO6LZ zuyw6M(9UPSYQcLm0RNIo4|D5#$J`+AcH6tcbkLzy^Se+>r(h?^UC^g098!Bo!-Jz%hgLC~RF!gP z=TWN0akr7V1&*T$Pci;hIyqO($({6(!mxGz%Rwza-hX@y>_B;&7ScMFlL6}aChzo0 z6}X!*G8WM`=BlXJ$Sv+x{^=1qv|Z?-84^G9?&sY5-$Dl#XwQ2f_-d1B-0cAiFN0>& zC1r4sb>lJcNJx+Q2umL1bG+ftecPG|E&Jsrao}jQafOlz{hpfsFm1Z7 za4&5}V*Nec+8}`&Wj^5gn`qNxLu~X@)5M;4u}7}a^r=f-4L_QQf_7NFA;7m?8$s4% z32oE0=o+`hs#+=Y)FU9JrGoc&NxqZ?$Hqwyo>TI|SI-`8N2)yRx{CT39+m19&|WpW zSh@aUv)fNFP~X6}8423H-l+KXhFsIT4HO?2vGUS6^JSz;w)G%Gt86E{_PozdQ^K1; zUwx4b(YmpNSK#fYOI(lr5 zZpUK^BNOOZ+t9CW)%Zcw&c@oAaT%Doc~u>~SG^R_(N1p#QPJ|f7(%XI=beUUD;q0S z1tQxvKP{{(F6-oVch1U|Uc)IwiB_I znsn^18R#UCg3Pm362p5ALcGR0Qx>|VKr@(uneI%|Lw4!z|4Z0?p0It>A_LR_50 zG@;Tc83Q1XE+dbb(bP>7^%?P8%sA`LH*du+e(+RGJH8M2pg&WY7ByI|@7%s#2OqP) zJx+P%2(?$huN%v{5AT3_BNiMhCE#`M**uIu`JoDK{xh`p)3)frCc5iBdjvLdiNrE* zymu*n`(vs|(Sob?kX9Oxd#Mhls8FyO=ChWFFyB-}Gi~)I;p-h1eK$L(DXC~0{LKrL zS0WWlr}{I%IW<@z0wU5MES0Y-daKQUgwf5K4$<7S5pa^a6F=0Jax}5MT5oZcg8TFe z|7KJV)pWCY0^?MA&FM#;;6W>E(rOGVn{!>DA%f`c%+?CXwr2#WI1srqS!RN=1k)Te z7}QXj;kvQ70&g^ki)@rc6@ss!B>LnPlz3x49r)1z?Kh*KPha#F-;*N*?f0jqh?2>R4CBoa9eNX=QVHLAFnvtun0J&V1s&;uP>Pj1Lw`nM@H z&^#+(B%=pE6-{lc$f;%=XYO+#j3xO$YmY5#7dF|!ojISY8Ga(cG}ryhBGN98Ka`3qdRc4AHZ9R#(FcTk_T;sPeoEAe;}!8_lg!}OASW?f zZE1&$jc_pt`dn{dWAU8+gd#+Mgt_&2Ig~^ud_Sq!&>8V;DNQi3a!CsIN=p#t74(q| z;bXFe{7@fbP2oj;AuP$PG?RO?;0#LS68+X?o27b$I=mirteBoApY5 z#gY=PwDOOC0GHQ-o@eyf`nQ;{FLlbc*%sxavBt_wsCMy?s3M}QPIx0L92*|nBRu2Y*C%Y%sGMPbWnn~7v3V9g4wb(A9!wXSb zQlaWfo zyFR0icAgT=Ddf0a%w&NF!)p4#isb!^Z&+(01-^ovNEPcDk`2>5;65##_9TeXxx9FJ z);8(^;HYv9oY8>O zeEqSam@&~E?I`q+FWky;Rv~j`ZvBd>L3QLxsTo^QN-pZ9{DV{^6S;&9Ehnq!ad+Yi zn5d?ceX+@XX8(dnQVdc;DsNWDOv~z#mOWQFp)OrMkQnEQ8lu~mwoxuNHIiZRpPA2V z7Y&&KdwQg;Me^QT%bU5Y>t`CJ*(Ve!Up1}Z<5Nx z_S`Be_#9SxB0DHML$hay@t%~y@aB3abG#6t-VovCDIarZcU9s#cVKsS7GD^nX6^?> z^+7*S>MOb1*WB?t($1xx6y}w^7NurYx)mRpn(ozh8`Rm|W%Y>$r=5sxNn4SEXR*tA zZ#f-*yK#Jc9cb|>86OIbGCzkg+pe#xECysZ%(T1rhPS&9x9bE-R&E9F)6!J}7GCm$$;zF;~rpqfT3UUDj zD}-$)#}@Msh9|Qd*25}^`?-S(arzQc(P2}PzXS?1_cqqkP&`0#sXtP&oQX^S)OMF= zgtUiox79MArV*CnP);IPoft>PF{R#g_oC& z(h?funX4B)%~>tmTYm{M`WdUsOL!2cwG&sW>-l+NiRtv%ImOXOHY>Md+E(-jnXfDeqw9lYGU ztuBS9WQBPwuoGptMFCzJ7j@u`(h_wUlrHUiv$Ig9A zxx5yya4EUPr8Uc*6myot`z{SD4R=D#H?Bx8y3e-1za30)lnThH5)3)i zn-p-b=>RanS|6oK>q%!dlW5G;EGSRbKF-B$*UM(A>q13(iaJ=&_cx|2H^VYzxU<}h z&*<_C=L3g2a$s4Gyuc_n9xJ7kNBaY6 z7JA_e_Ann~I+MBC>SJKa;iO@zzo-26m(@CN7w0p&Z3YB-dVZRwW^O>NSz1)OM5*xS zg6av;kSHB@XNb5?vCFkzBO|5Xi=I|9$+)VtUvU(qwrign6*cN^hh*0^UML}H$ZoE$ zh-Q{Nd*bp*z^?seq31)Y3X`ZXvMHzG0VW|@p=#Kr`yKic>8WGj+Utans}1_@HuEX& ziUpf#C{0aNy1NlJss!mQWIX#?Zv(R2tdkaV6KAAfUU+vjfyr9>($+;0XA^G=sf@w= zdKTxQoa3;k>KEOo(a9nD=J~Is{RdX&l~-++uP%MzT7(MY#d`p0Xh3T4HoK&+-)MRN`hiT4Ojmbl^ARrQ*Wx%pt1!iDHP9p?9>>#xOC?82kxfC$jq znpQknP*m|A*>p7Y^$}G2*D43l^g=Hn2ea|H|Gbsg7%_}sw#I_wo44_qZ6buNH?FKo zZ$5tqtLrSuX`}6XH{x~R`yDo*E{59g+nb5$KuYCC>Bsy9#~XgY9c+fm3)^aGCg~fn50P4Q5od954Y+uRl zh|Ibc^^UaxyuX3`9HDF5AEcx$vk=OM_7&+9Fi9ab@Fh^I-iF4hGR z?EkZr`(G6)i`jE*O$ypuVE|LzliQRDrEw#vNdS$8r^5?)xjp1a{H}De3jeM-`Jp?J zCJpG>SjUve+mp8xHvy$?M8HQ-$Zly>Suj;k7!3EKQ^!LWi< zust7RLhLS-FQp_Di@aPOO1s6#bK_~@c?Zmmrt}MS%_!6-n_47HlHsa3OujT}XGMDM z)2kBak|hm?r*ke%=-p7S-K5UwiT*u^mS;?3;cgyD<4L#zw6NFLXIX|3o5f8m42~Yl z^THQi;ueX@KOJdOb$QsyDKK%Sx=85ouY6I_qFD{YucthFYo$J&H!)6sv3OFvl~_q1 z$W|#(Lpx)sE8QT2H6#*V*y>KIdp%q-KcV4mF=oBBG;&m}%TAWH zJR~Z}zm8Ay3$!)$i%j|}-uq47cPsB`C-U*yHjQ~+(!p+kOL>4>)*~WePo0a)%rFha z+(=Jk`l9|A8^aLs#`2(1GZ=#eHp*xlK)z^;NHtOCq$``2xVz9kOAWNF(bs2cMRX^W z6p~dfm+{y;sUUUM9O4|In}8gm+m)UU1);5Wq-s}feCE4E?6iGd{hv&Ytv2H1e`^VU zt!9;o%BQx>=`qp~r5e@1RMH2Usu90ubWeb}n$3VbHK#(9)GPDzp5}+#RAZlfG14;^*Ff zY7-hfO_UIZR24z0`)g^2G$c)}=T!!a+Bb_KFDfCVZk zh}2if5)P2wAg4(;7#4m5Q_C>-bQOc-893RkPR{`knRT5`KUjM!tAbH7U`O4ohgCRF zHx9}_e+Y+J!YdA(R$Awk@p`j+>qMbzo1tRFFa}TFNBLL#r|z`o_lwHJ8v?IYOSl-8 z%g#V5U{$%!xiT#H2VRJ2hDcSUzW9Ej2qsHOXWm;?U$Gn(05QhAnSbG{6xu;2ao7Fg z7g!Es)ukjCcjYCe?CQ+d{VSu`j4<&Gb5@;VO=?JVX{aiiZkb#(eM-UZh2u2}d~THR2v$1bX0e8~Wg4x_5pG{?q~ zO%wuW>v#2c0yiMIO6)9!~R%aV0%Oynd}OSY6qRZNdk zNbefJT)eu`9Pu?Cn}v7RsnoIdfYq|7a1(8+`p_shZ)F+uoE6%WSDa8UP0g=BfQ>bV z;k6|ZdFNX{f3VS0sI9qnsLIo1Blzk0zUZ7v0Ttyjgi3`B$7_kZ%IXZ){pWSALCNC3 z3x)sb0CRD)YVJvXV&R)C|5F9PyftO{X>j}u=e?*1`3xXOYcx$&lTgfNB*(?JsDE8( zInnO4+SIcR)sbtczH45EX8E$(GM$dy9L?XiVB)sSHx4#r4>*^&G>o1U+sluQ@ z-w*6)OQ*9reW=(5Um7UuDl<$0@EY)L6XUF+Qh8`ZjVhnr+4)KUqY@LNVv`sNSk=^d z83LQ^-dP!CH0QSJL}@#!8~v~m=hWSxkJ#PpnZ5(BskZ`956h-y=V``YyvnZBM*$5o zT$(p(NP3oK&X>x4mfe|AqX(03n7g)0#?Mgl=zc}z(!CE?;*(NhEy{q1q@a(?_+E?Z z(_b2y_=L;ox6?A2+)O+vT&hpP)AHYsCe1-wGolx6;}P=IAR61@x52 zntf1X5Y2VK>-F7>kf|H#8!?=7jj+S0=%QaI0NB~b2GAqpRX6pg!7CpIL+Zqa6#O2g zxlav&urYar0u*iW)5({g-6&v$?N`Y@8cI*P*Y^2{P`Ihw^e3NhqlKx}_BKGbPkQl3 z1){>vD(tl!>_*1xB&DtO1ir!A>O^;_Mn;QLWnYcE}od(Smxy5 zcNNKM4xZoIMzhweUF};pEYIJR+^310OSKrqZ)MIM+!=dz^R0&*`tdj?%E8k42pxlq z&byKqPp9rSIYrq$&B+=vbyMk?2=HtR=i|nyM$5KGXKeR#E`{*G#A=U%QNS;OYHrj8^yD0wZo~s@{Ehn1~li% zh8B*W_3 z7}RrBC-!~hs}nhIge-~JEmY2IUsyrxwJgHt%y4djz~sG*IcbeYi^LE{*Uqn1$n)Oj z88YPixj}dBJkt0-K8+{!-LrNS9Z0+up(+SlUJvg`d^py|H7XC@f)ty!@;{J2Zu|rR_GaF zQQPjh%Qx_WJU7OxN}x)c;Xd~0u6LWFXFeXGb9%pvr#SrIrQwam^4w-wg z2|g~<>7cdM%Z86OlT6uB*+RjpwMX?9@}W%@H+Ec!3CM>0k$RDZgzH_yW2&+xU?cgx zK`qhxJ?i#+<{BYLThjKjZ<`t~YZQR`QK`WoveG>7DDhqy;0j3cf01ze zN{y`fps&7r*)k;QS*(iVtK=6CJ^es9;Gs`^&1J$Azjox49HXWWeTJk*#lL=_B)QW?q{MxCJF;vLo>S(W-AqlY5 zyD4p@ODjSZiCXPTK9noCv~NRcsLK*v{BpBtOy6z<2 z#vbL5)Ag4)L3U~WM!v-ed+j)~_6y)}U~Sg36j@=T11-e{pPo|f7j0V6g;3zxB0$GP zv>Xwvl+43u8q*EKFCvLqH&1ld$)2}Z?ca61TnQEvN#Aex*N3lR+STj4{?vB)Yd#ZNU@wr%jsW_-A($|J}|No zu$pEXvj^|k>rDl1l@ULzZBZL@+zopFxFR}vgQ>jC!CbNu^)}$hci*ot7n2$V7^RN_ z-ss_@V`HK8rOkrcYBe)83KXi(`*MMS6-co{wY0niDt;nw)2^@jfa1~2Yd#y3BcT08 zD7G6cYyLUCFT8ReVoTgOL>AZx+}{)o_x^z0e8ac{>6AHpaD&p68ORGOpX#U+!C`dv z=PY*KCEL|vXH9-6xA&~>cy`(9=`q+;GJa-Pb}a%C1+zk(GDO&$*ry_ladGtP0-y2E z`$^`?9p<^$6!q`o($=SkYFM8Zsb3?KIa%AXJh=hkWzKc7+S&mP3b}aZ>UbQSW6XJF zpi>Zbqdo?b+!Qd3$%11C&eG57bTs>nwc3pS&d)yxyluMhY<^XU5VSLDVWjpp`!!iW zDdA?;oxf@UC@^j%yh39|67-NpLuxyjtQ^BA2G2!sX%j|B3p6ET8XP-a_!!T00FyPv zzL8!8(_a#qH#{GPwAQ-1Grwm~>HK?sFvEPgLc5GGSkC%}pe&W6n}gIe`)_>ih1q}?L+g*qtziE$XG^*W7eG8Gda=5?U&O7+8dMP4*ObH5V)MVrI$+055A zsU5S+pv#S1c=Z<;=BQ};0-)uFaN_I>g<<|66vx&%pQR-CvQVK#0}tPaHp{D*Z&}*z zwU?NmmFg|H-n)P?TB+QAdhXd;f01AR7nnO?s-cMZ38^{yRVCZLL&qBx^R@kzOLW_H zQ^`{4Mn#SoyvauLPN}JznY`$g9X^1-rZ-M{2Uqbe_bWwDK6l*x%d*8LpmM#<9%MSu z#yx6V$ci$mmt1nP#jIN>mgUf7*rPpHOC2fVMd1A?@9uI52S6jha%Y;`NX^0d+)Gbq zegTGW7|Ac@_T8o)=7VLOgIb7#yv=nglpS;B7f0^jn#X@8r|%68Z|W@<+49C6X(&rs zN(63LRG1IUM_XT^DmAQAR-Srsje6jMMQd3pnxofnIp0@PT&&Vt+G;8_vCbGXG$Aic zGOB=gO~2W2AKUbxH#q$*;1Och6FwUTHafp; zsgt6C+L})(0^;1v*+0nQ4+XW}v1qgCbwlS0*OPkXtrnhpr@F2s+huTmtC1X03K}?X z*B;}7pLPm!4t(mkmSluMwr=2976$D-i|ZiT_!r-<9Iz1^@<QrLded1d6&rW^DgQ;4J^z1VP0>qNrhBbYm~ z%FtJ1MOJ^PxB+;psP~GMsrz04@9pE*8Tk^8ArW@9XRscO_IwP^>YmivGR$e_j%>z8 zq=B{DWq61R^LtO*{ulzu>9wW}<q)LQRU^Us_@)Vb_vnZ1~2h!gu`bA528yv+Fh-2D-Q zC$eH1HP;>8xa-HY8H^*D?inl;cnTsJb}$jfrjW zLZF;CJW-cNij@Bgrnh#dAH~b)gALIR&Jhh5sLGs=;}29QB&&MH#d{xEl0=zD_bTc< zrs?~iIb*ai!wNgjGhb~+RCJKLC{h@`7-fLlsxV5(HQ>fg*Fdq{sKw91+8gp21GIL9 zMw0;CGMk(8o?tOw0_Rr!+Airz@`mCEUXGHeH9&{d8>46 z7n?cXjv*q~#FIM)2R34BhZWB4B>D6Q_!9QoVF6uT{YiV%D^XU)5w7M31=1ilRj-%^ zx1HDH;V09By?XAC+4~i&jcK2oT->a+q^??P<@-p#y6L#+s=h#jphauHoWP1`H7|6G z)K%nFXWPTFr&fFx_kFn?75KU=?>yvpmAO%I`hd8z1s7Sgy;Uc(LM6K^BRX;5nMtXEZ!%0FvEHjV~carVvc%} zcA%yNf4b7e0Xys&{$BVc4ouS-rMY#SV42aG)L1)M&6+c{PI9#fn$F)3GS=so;a)Ll`vveE_uX@1tM%zEcvxVZater`$D`H_nUc(i}0KWS}wP5`gI z%)p4;?FDe!q^kLs0XN)=mpY`_U0XXD`lS($*d4`76ej_z9oJ~j({Vnod*7twVhB`o zDeXX23CW4UY4)Ut-Ud!Cr1cn;jjvaY2SiR)3HP^)%I#-=7PT{HW4#PL@4n@1)~x{X z&ts{`n^wUuvbD`tD=mK2o5e$=MMyJpisC#0*NoiDx+Z1`cwXi_464z!>8(GjYq-$j zO#4wa3k3ZF3#zrld;5b)Y3K=~gv;qvI9Kei=d=*frh#--dWBj6eYpqbUeoi;>BgWR zr9_*;7Uq(!*5;Cc{vG%Cn|fVEv0H2@vCWm(vNua`YFqcjWW)~Uu2ltM(`DA1-4Et% zs@PEBGdBuprjEMfq9F}Yzj)#h-R6sgR5R(#s=6zU8*xJZDrp<>OWCW!*i3Yd zN(c2<*=5Ak)zvNALiq@xd{I}|$Glj_TvYrt2G;r%Dc3jsca4@tc5Y{1LFjvWeAp}3 zxO|&xjKvQM32WUn0sBpD6LGMjYKeRCHT=-C%r+g^B8B*6p*v!)O&h&c7BjLfJM!~E2X>bniQx6Nj^L8HWTedYuK40zTkeadx@?o$lHRv|Jw4{9 z6Tpz2Er0D^%{`3@U_RT1T{EZa*Ws9$fS8ReotQ+1&Mv=xBPIUoWmXKTsz{&7VR&MH@$y?E ztj2jrx?{ur;TlD~F`?8uc{^MM@a&mMn({71CE!X#VYv;`bx*pGNs>F*74?scVI$j{)gVo8${~9b z-plxsucHoH`*7Wzcg=eTukT=g)2#WQxql}OQZc4CI+_o`9cp#lE9gA0E*Is33DC>5 zGFQfCsWsyj9P3gKPeAQWNQV3Ri%2WAV)C<`GU z6>S=38y92O@$k!Jp~wY1!hMbhDDtD-g=aT@J+^?q;;}V0_%TVR7BZYBFL={=Vqm%Y zc7)c5^MM%U>Rb5uSZbcIZ*tYL&6k0EwzH?bU(*_Xc`XL2$or}~`|<@7s1T#(D|oMD zLt+k=DsRIHa7FaO`Uigs*D5|8qE&!eOs-Gh59&TP{aHbSN-mmA z-J6h}#3Mer<575f$eyXhRg!|oqi+$4@_|%ev+#YT%#e@Pm9d^wi8`~pt{L&eJ_J_; z$Ht-CYP_+(LqUX5^KobaRL|(Jqk9Kcm3_=TD`ikPz*2KkG|Qh3qoJeMY^M6 zM-q6v2NNx4!3XDP_=1&)@PBzhalb51;hB<^AzEq!E4D z8$)k9RoAYvXj(d=gNkXGr&GLdt&`sMyAS-=u=gE>Po6nbuH$=r{I2eAnwtJE9t$aM z3H_L6q*!jQcmaQFGyT|U&1jev@|1Pu*dGSeTkmc;_9vhJ4yHcS$3gX3BRz+9Xe?9_ zr)^K5v2G1UOymbWtG^s>HE4k^d~5c;r)^PpVkD2t#ktzTDOJmN;`1Q(pYP;L-3 zkZ-zb-LyH#2g`P`#l#GuEvFc~RnXyOs7Uu~jb@3;KdSqkGXI5A*t#{rE)(}tnPZMFCbcfn^oX@Usjp_+lhqp6%ecV?BI!K=PHcJ1JzWxOj`p!F$mEyJ@^PKMamBzS5zyUuhnh z|65U&zZg-FCGG9od0Kb6;S0~;V5By!`}*Sbw|HoG;OVIk92`F~+8gVC30ViEYbYMx@=|ooz@b2Utg>(m{<+p8<^OAjzx^R-ivR7gZH?$XJ8bg74-M)s zcTKjO__`&q2Bj+%5dPuE`PJ_)AbCv#sd z4%^WAb2X$N*~x$Rxj*`wpdco;^$UTqj@n`Fj&{fp-T$(vyd;&^3kd$g;_KY3^->a1dt#>l6a28w3*+wkv&{+5v=a z@qO7|X)A{axdjc-rxWq@W8WP)olMn`U+Z@NUjAcw@k@q@oOr@`U496U^^cA1M+J~S z^J+mKnWdlJ-d{y)2Ct`sN!^AuOLj2(wFJYBBFTE_-Udn0Q9FZ)p2c5)ACoqSv+@0t z6Yw{F+sXIGxo8$UUyQbZ#FFI%Yg}+VoEbaLPGeP96!+$`MrxLOxYYHARz$tJlcZ^p zxxPXm?Sb!ua*rQn4FAZa&?at^|HkDPd((7D$H?bf0A*9L|3$3*Gt>Gf|K@dSOX$>1 z3*wKOf&anDR@S@q7V*K)E+YJ2Gy3%B7Xn*J3G6ri)z-{h3uFSqw!FQki#{HT`l z4+SeWufs3)7#dA%TmHdW{^Q$kJU;sC4rie^vhHtt>;Emb|L0U&jGQ>WDz)U2{L8;2 zF0?#gKJ(Qze}bL(hp_A)HK(8_0vA5x%NuQuY5qgs@JCVR--iFAnV}i$zYYH<=KF8M z|Ko7>A6W18za##SeTxbZ73LpwFy3X6{RZadF7&QTe2 z%M+ysWfFkyZjAR~3K1#4mdOD~hHw$%W7mC59pyozp!)Yd_7+XyqzUQb_SzC4hj+0< zZ_g9Y*6Ec4C*HJ{P`V;Ke7rcpE|G<_W*&i1teJ*>P{3x1)NjpG$@6x@Di~CB%&ZHR zE|@r)=qvb7KPTkb-0|b9-gDz!AH-w5hue$K_eJcQB(w|Rq6%e5M(Z@%P!|SO)YvFo zZl3HYwH&G}7=aall2}zgtdavOuZuJ+?QTzGE@qJ`UPm4BeRZz=P0&JZ-4Iod#wS!j zx0F8Z8Huwi^+@!$!G+by_>yw9b{)vpa{|u#el8Ta90lv2piiwo(qVogp1u+v&U^bDmJaY z#A6D-q+jMBa`J7Wm-qYK9vvGC#c<`F4FlWdfi9wBxIWLLj~D2W210+|_x@L=)JoOirV zf9M10W`a;AXYIeW{<8NvA;J2{*Lc$2&^8S+jCCQu^G?EV^}+w3TKh+V>}ME`%FNbs#*!k(w83~Z$ds4-S<}k6 z7zlDs8(_f$63sz`xH{NWsgK3(&?`5r*HV~t%_SMvNIcb2rD;7NW-nWk-{1YVCbz-W z1dS>uqw_jWd&+VAqQ97QIS>ZcVsE*mNB5u2Q8OtkHDcE(Hep5JxgVP8v*)FW3+)rD z7Os+~3S8|c*mRUA{(Ge5WtdPw>|j`-ZrQe#*9)I%$pso|CI>n`NsAr^M26epph>J1mw)U?KQYvwURp}L#W>ZwS)>)u=oqw` zIa*5+ly#OXNMlaL=&5pC5>dE@tfjMZ#PKLKEl^-J!g2|{4L2--H+PL4<(t=6>wHbY zLG!ik?P_lkPH)EJYo(CfiKg6J#SVZ(%F{5_L_8-3*=<-qy)Qlexw~3Hcm<81_>Dh! z45#iEGJ|wt(hLL5i-8hF`DMf2H}6sB@liv`xnnVE=8@j~9rpcor2YI7C*CJ{JMAgV zXM09lz*?ZrCi<*vFp!3ZjdsEFuH^QC3bRfhfm%t z61)3xv#$P&8Op-kzDd$dP1|lf?N_nl(x~CK5^MmrXm5X%KnsKk=W6K^`0a-1Gws_6 zNe@CplE%yEN=3%Y-c)*{7WBFrd`isV*B9*YEM+()zzKHgTdIy*%UtfeFAM`I8luh* zb-_WohLizP(lg^HUvLI-|MbXz>wV&3K0hOE(ZkK>pZ0{1G{VcGePcz!hfHczLFI^n z{QTmG!cFL^e;oXs+P47UQQ3ht#=XX8OPRS`v51tNx@`I_QRxw7>*mpq#M|)T71;r zAkTA60?>m(4ERV+eV4xJIF{-}!NH8{hD`BY>#1?r>glN@F(qD~a!1bkv>6-GN%(%kWQ-8**KMJyss-8#1QE_r46;=Ym-l!y|X1Z)j5$XWEte!M2=kty?ku~Yb7QQrXnN8~{Ty)!vFaWhX zUF*q#PG8BwSB2DID-|-#GUmN^C29Qq#T8OiEuq>o`mXcL0Jl_G`0(ahUSbAokvQg3 zLG9{jBC$F#fLmj+;vHoe6|KL?b(a)BV-M134es~ZA{Y)x3tUsLh}`5?0PvVqUc|U6 zQ>!vhes^&LCGCo9vu%zhW}&Y~N4wC3sXVjL9)L?|NN-uU*<8v*C0~Fvg`%>ZJnK=cZaiKl_T^X8E0La|wZYqnCo)$WU@ zz^V%lMM4d6oS_k~A~^|2Bci*OUYa66Ur~<(m5vt8r3-+Gmdb&(W$i7A!ZQ((S7mJ(W%6|$ofmp2L)zasl3K#oW%vhU4?xwdr4+6 zN!79%HCpRdnLWbkOX&(*-YyQb0zHn@77xEP%^bh5V{I!TiDxh)Mti^6@wWD!n>Vp4OK)q}JrMhY2f16{yxQ7dISCU!`tm*F7->x6dS6sxH2` z>PmF&lRv{-0&~`@!5x`+QX_8v&xTaA4k(MZi;7BUx#NeYV`tiEbiFf?QrG9|w>-Nt zU4}74UVRsGy(XgUdMG&!$1(}P-<^L`nfb(P|N0KFS~LKkBGV_piQs0%HC@+N!gC?; z^>Up>cI`PdTIpD2UYnpm&8rnhT)o2ZOqT!@Bb+74 zmMnxOAoiTWG|fL3H5;HGrF+k4)z@{8#F&isciV5e^BhrAT#+Oza6&#w=9s{^nf>F( zcCzt*tnKj=p!2_8y7Bz`-qD5JT(QGhLYZDu1fQ*Cn$xoeatm>g!-Qsax|p77C_Xrd z^sxkc_ir{ZEkls&o!gJpW(hf>Q%g>_>P_D*N}hP&JK^YNzPTs!TbYh=&dUh`^(HY>$H+_y7rRG1kwQb}%9>KL|fd<=GwA_^Bu`Up&` z)MhUl(z#yt`={^lNDtByE4e|^+=En|b53RcK$@hBq(EsS6}3X*H|{k z_ubFN9`fX!EhA04n`-!1BzEm+>}(2LZ&K2qfM0;(rrnoU<*X)T1lqYB$B?5HR^Z%j z^Ly=c-S)gObeF5f^Gf=gZF!IBKbEj}?b?k>yL{t`ikprcuWwiHj>;^Z^(PgDb<)>h ztrc2JjEcZ;M6_8XA}j2-XP^8NfH4nkuW#`k@|7a}lKmS2k{O5h_{7`2aSo+Gc#h-w zEEHsMLpK(06Kn$xBZW1?%aKJb4xc)=9xg53mGY8 zAF$Wr`L60Q$NAn2OuyyYTK_7sIPSYuFEOa7$uArC3#S6vlVt$JH{;s5Y zQ-`+QOkLBJ6Z$q!S!o*p6Ej}R#X@aB%dMP^3=^!4_-Lp5b#GAmmp^=M;L(xSsv!#Tv*=l02tMKldasj^UK zVYLT!3Tpcq!%ywaSn;Xr%RX0hoj$!Wcaoz>guNJU9{9FgXJzAFmAg^ny7UNuzME)G zU0)=63onnB$Pw}q(+!yRT#!)i5 zI#>>Oo+WCBFN!J5AnSAa3N5-4;zi3Yo~N-a9_Owf;!kyrL^Og;FTN#|(ppI$;wmyv z_sV+uqkJ82UY-o|**I`S0JyI-(3Wjk1%BJo@s%ExmGR!;JH16hiT9|5pX}R~j2=qL zx(A$zDN0Svy23EAt*ueDG=8>B5h1oel}WU;#WkyB8EwZpW)_A#f39*g{qM5FpC&7jDm$1>0ArzIRKH_<;X>(h6|JUVaI{48D;CT|8= z8upPmUj)eHzvlLFv6DcE4<|--%aaQ<4*#mJ6FwHU0rN8jd294`+*7;`uR+*3CI(1F znQ(}T&J*G@Vf?~<2!L(G;@k(qhzFO}tB74A0TuPeZvud}NIL_j)yB(FY3B~6U)zh$ zCTuJxrdUoC(0FyFQE$|4G&{8*t8Ni9jX+W90#Y@MwRzDEbX$t#jD?P$GC2Pp z1bv~LHRvq3e&$?|B7Gd@dT1_ocB8?pHKoz&juG64)=;);v2T4#vGLe;c-^YNR{J0y zHWiS1?w|y8`=NQ+bp-90m;spE$9N4T}71ubb{K`pm_oWWp;1+DmN8tkKh>v6&vN4T)BeR%R97 z`HqMNtRnVFQdXEt$>*9&3MvE6K{3GFXkT+KaK)3R9$t&n?1VO1;dM$+WHmFle3 zDV3GcBEUax$^T!$)=$>wFRFj(wOEHm5g<%HTg`!yeen?yeS!P#55?T9?ADzpu_I`XM#Yh#vv*6aA3u(}5=2$sR0tl9#wz#4$K9J(JksWgH(Mm( zRys1i8q+!ri~t<=IPOL-NDQZ|z1Z->4nqyF>)h=}55=TnWkKYZriWyj<1j8yMqn8cVb(`eNf8z;oA+Zle6yiGnk zTVCcjH*QZU4C!r__zS7}$21YHYln|)kk9#@g)cq0C>|Yr>FqI0QU06(Cg;eRt7Q@l z1DM1Kjo9a&%xY&oDe~mlKWpxHj^7O%hlu2PEyecUOpkX^o8?+*^69;<2= zC$Ydt)T>zwDtX&4?S&{!v`N&`Oja@Xz?cK7bY70?U1OX%HOph{v=}kzT6MU?{o zOJ;}dR#40@PL8)y#>%H^SGp_vP`&Bo_7GkO6OCcqS1so<{t)D`8XJ%SLJsE3_&$o@ zmb1OJJ9zwWjKta&CkcPm0{D}b%62^H;@PhNhPm3Mk0F+=;)qB_rM-NtZ;s6Xbp0=s z;A=39hK!XqmOd)=0U3+#h%zNDrr^Zx2iL(VACK zTzAz?|1~7cDUoMiUhF}(r&K|{R7sfU;^w%5bgh@|pztr@-zVGYhZFAg< za4WlW-^xIveFTG|RLjv|rEoi%IuyyVPWL^6^zG}vq|t!ZEW{OeA<*6eA<<&aF;`Z& zuwA!XDCG8$(vZ5MRA;G?!!60le1Z#4NoX^zrg z4hM651#rFuFm!I=c^x8XRVFIHe}1Sf7AN9P>8pP4bto-rIEtV5 z{y*%!cR-U_+CHp^iUKO4q97n3B27er&_P5%s)9-<6zNT**BAup#Zh`y1f=&42~riL z_ZlFy5JIo1-xGId+}(HI`RzM9^WXR1V@YzJbMA6o*L|OJ;_^fY&iT{$y3w6({Th*O zDeITvxNVNQ^0>Xtydkxkw7jBP_O?jofz0smV_YwuJQ#!88g%}{FJ2v{Sg%->&R=re z`iH;$<0jYG%WxU+awZYHh%|N?`8iiyx-CK?SA&PuZwo$`Fp^|8R-0|QlqP*M*V~~B zd@*H7qhGooR%!2jSH#{+tXp!sXgkj5uk!R8w?*#}Q$25ipm%%X$I&65z7SZviDMpi zNJkE}?DogtgKbgq!!ckkA3Lu)J>FhGdfN$Lcxkt)*iib>aFzsv|A)c+u@C_u2=b(n zk9lBvsn+$dfzgX`a6MT+_Cm)qU)1u!qBVrM%$CSQv_KWq;K$!-a2u@OdW%MX31UaM zyPN+t@%jjPV;C?hR==Ic4&N1{ByzRQNQc`!iyfI?2!+!7q+sBb!!!wS1u6~M0KsWp z-3^rKIgX#uH#>w$V-JuG7o8)1&7uEkWcbfakS4w{o$_!3*yS_%inJ)x)#FPfZ<|kU z3`)Zn>6C0%)u6|KoqTO8UGUBYfp|alwX$pyK8V}$;w^h%Z&`HgU$TftDNbq{w?OUc zW$Yb2Fhfem2t!xB4F-J<59H{{kwT@JU+gQ6(8f!&yD|kn*VVqMfh% zQ-)%H(UvXaYsZyOl$NB9GfG&fuJyD2ZNu@9R*B9(norc2FytbW5k#2ml;nsOD2@=v z?8tdJhWr>`LseL3KZehY zSi*hXAIrRddP`U%*3)mZW9BXDMtPFC2?2bw_oX1b75{J?n5vhU6#W^__Py=l|+3|5?6)PM=?{ zh=yDB$`H6nH@gz<@)qcp-SS1Ag=y`J5CstUjB;0Wr5%f)K;U1K$ab=1i{9WLG!xU{ zME9HmdzVW)`!a-Pk{D*93f_*1ux=?IE;LM2lUV%lSIxks<=tqwpxL-OHP-tuX2iz9 zJ)G$%#CA9zO>+?DdGoLFiS(-DUQ+V{j2>T(mkspzZOQZ}i$J#Hgxq&yyL04H1{AHF>F6E&?x|qP4)JBs8?oTD3T8>;SZxG zqGS#gQ(UF~veEWhvOxmd6hsjta5pg49kM%O-RB%uwgIEsz)g_w?twgGBrtYsJ#|aG ziEwH1r4}~B5ptKBM$$Z;;V)X#vy@oLd4X|BvSXLY5Z*;vLVmf#uQy4zS9KkLUHq5{ zxJ-dzowQlPUCU>T1H-Yms*T-hw?aGn{f~pp*Kt9AjgJY1$!Z1QFPh1Fq#c2q()Iki z6FUCuV4Du7qQMAI+lc)o-~LLrjGF4uc2D^E;a`$4(-BluhiFhHBgYW!1iI!lAD<5&zcsuXv?i7YaFIqC<>Mx;pfAT|Zg?9`g)dCBZB? zedw_CZj(MMtFtgU&O-I_^r6vIYWccSlvJ^#JtlrV_!L7HqRz~1>W01CU*IP+21nT- z$K0p((6P*Z?hmk=a}lT)3C~u?YdEC{2eCq!kB6u-ZFN4avN!jF&SajIIdw_0-qIcW z+3b9VO}y%T1#3jgvxZVJ{VX9ngWApxF6oEu3Sf zsKH8|Lm^6SNsV!YuH5}PW}N8fwchx)`@?#HQEDnn!!`c;;)3l478%sR^JJQCCcT~d zcCEET$}_(4M!L9%N9LlV`X?i!;aR7yt$LzWp?|u&%fc_6+Zrj-M#vf*aG-WMnbc3< zX{}X2{PnlG5`?w}+twzMQ~mH2<(s`BRUjB%VcdC^7L~7MOWUi>&nrnJ-W<*SKz>w^=wVjNk7AB@`Z!fG6(A8wf5dv z5NRK-?7aA0TrB-$4;dg44@pEz>y`K4P$y*$!dO(leg1Pi0t)50Ht#r--wEyeB?I;R z9O8qaHG1}aR>aMz@++X}Xp8qO$s)J(-=|I&!zUPVZtF^&m)4bdvyI}{8eH9Y-qMX? zs_DwA@Nqq#E_&Bp@xd#N*ZOLWW4~s(5Hm+Ik8iiRYvoKHwD(6wZl-zoXeIUu5}P#I z9D%FlF%n*UnP)PzI{G+J#(PG%hjm&!9zU;$xRzObCV*Ed5a*oJgT6lYkVc>+*o^hxvESj_|}-jO4JGPupZ(e-rNwcbNJ~ z_fHR^1T>h`pKoVA?L;WWbtNOj)(eqQX-*Goac$e`C-#}AV`3#s`3er7|K~rKCW+IrRf!8u#{N`gp99-EFG6=!d`AI2`-*o8Sf<^#um)?fS91Oen*Sa#5 zro&nBL2#u_KjBQeI!V~ty>8!0bHzT6RGO#Xc%9( zn%woae6^yh_1(=)ypk7Tmp`TXMt1_lrV&hIof3b^$J#GZ=d-JeqSpe3-o&4~^43C40Dl z+#%Vd07521jScIC)jwzi8*%UcDWC=Vg%1cXw~Gij9B|=i2X(kRj?-EXjY?XceT^GP ztZ>W>V)c|HEXN6C7vO3|<{yn0A7*GwUroKlmpoF@#8niO)#*@Md{=e7m)O9$aFy3yN`_t2j!*!%0IgnmEb8b3O9P`8q< zH^un-n|Yu|IRUGXE$D`h#mAPlWna;5F*8!e1ocN&fj(W#17${dNBQ*6m{}ic34Gez z=U38FXwh%i^rmag1wFgiz_VR$Ze_!L_n;;HqbwZhJ+P&{|LiIUPcl9|K5Xp>x?lo0Ev@MoE@zV+M6oKjRv9cZw z+#W{b#~QE?7Cizk2EC5g_|IgX-@faAdH5=Dn-B6-_>@pwz7?z9LLk%WN(^%H0tRLK85TLF6Urgiyxddtkc2;j{$iOKfo-=-G*>8 z#RJ)<(8Z5uswq4pQIttd z{F4=aX!FUvtmdG|Pp=iDG9%C;mRH;}mwa#9kCu|=XV?O-!7GJ)O-%-*e~E?HA3jeh z?5WIGK1;#}?sSB@_ou#Q{@@kUq5E#&edLiZ`B$gj8hPU68;#vFFkY^@Udx+t1G!b= zas=sbtg2==vaD1363Gtb?hdkP_pa+VBN6&`NQBSGO+=c8#A&2^0soQWyx@`F-b|Pr zL15Sku)4i{#=!hTdM!y(l*~crh2{%?PAEMB^`S^{GCR!8dyrm2p=FW$u0M;P%i`q= zEw7E7S=98zQWl+|dM`ASC}YdZKvD=*S5L~Q!C2M1~aE#G7>Ct z_SpO6tL^2r`KBCcr7ST$n)1xf@gZqu50yPEhIy)=2=ab1UcHxL_cbvytUrN+;ghG9 zVyd1qE_Y`%*AVrhy{^v9K}BC*`rW1ONO5LlkDUtBa4HqoWbH~|IX-`)AD>W=9S(Q; zhPJkyO^MuS8jfuWizG?JR^8oR?_De3HCDc>&McKzZ#mS7n$?z|I3Z!Amh1;0p2h9b z{W6I7IBY&nAWQh9xIb-Bd1jKdw{zm%59h*1ADb<`+3BUv>n}udM_iT?p7QOvh{~Tc z7Zu~|`OTG1M9T&o5@uQbIJ{}nEv!%fFVW!ts0F2K9}mFq@>C@}J#Te5Snskh%8!a^ z;Id(vgs~B-NJRC-JJzO&FZU91IDM1d8sHrElZSoZ((58~Ic^yKvY6`na)n=ODKqJY z{R$NpO;v)v$)wG%L2^Y_N4|pPSkGNy{^C7R_30v$yX8?2t~SQRLU^ubBO)Y`ehK`} zB47W#h#TchrptAH$lkYducmpIZ{Z<1!pzG0AXw5fS3a=il{?ag?~dbBJS_3}y#DYi ziMDkrbXch=>MrvK=)eGeyFGhnbFF-(Ai^5`fxdYT5yFs)prh4!qSv1N?Y`!CbQdXO zXQzinjlR9Y%_CfeS_XpRay^?FXi7_MkH<^j8`OE ztSZ%x)OHaK+_rq#=b$lm2Rp%#b-b+Z;rZ~>f70atQ~XZ>Bp-2ZN$WGvSyX8cIBpMb zr#s$z#l@Y^ehS9#?NSxaZ)W)k0VC88oam|{ES4iJ!}=3nbDgMQolG%;nC)Bd&P8xD z7{)AK2&8n=&)M#(1X7nu|7*BT!k+KeG%RJJzcfzJB6`-WYcDLsV)-EE!E&W zV4V>a|H7{p*AZek?WneWi!n|lpQn65XS~E4qL}j9dH|*}Fe&)Bp`lasqETgB5!mEK zUbJ(m)>1hW$-N(*d)Y3w8V^*ke z6U2ufO>ESbdL+d#u_Xfo?}xkl27+_623oqEg0gCyvy!ilZrXJmzSF3*{W>b-?$!4- zdvM49PnU>}Kuw`+?GnnHOsOMax1H0A=8!(q5MovS|$-bT4wRINGZqdpcNi-95mgF4f_e z$NExl-3W^M6nT%ixwbxyzqw>EH9}O<8B?p1(_l7fS34Eqt!MA}6UZ%JgxX8&S!^eW zEaV#{q$QkNriRAYR(+~Az3tmE#=K;EU!stW22=eeI<%0ZMK}4YG7-d5V$k2pHN ztbb#+Spw}L_s^sG+rmK=$Ti3EV$|=&{(l?b|2b>#D9yY+E3E_!NUaD?^cq9SZ-Ctw zK8D>=25RX~8Kt~j++Q~+l1IQyaq=vSDqS*mvz^tF1=zTxN|!2b@%^&&zqpNT4B%wB zlv*kO{6qiy^!|$_{@w1=-6`28*K@K{mFwKs*ZOF*i;Plk!SP!xYRzAPU%dR80)xTm z2Ct|HGz{9)3)Ia2A_O7g0k9D45aj)n;Qnn8qK2|x5vUu}f2`nt`5FbVXlm_|%)Aqc z!^6XV^v|4T8lf)pU*DEuu1NcMkf&)({KR>y6VTCEv!q+v>`FJJGXNC*TFZE$BgXpM zFPyH{`0y(L?hrIvxl^E^dR-$eQ)ZPuid81{BmX9(rk{0O)8UX7Z8Xz-R;GNdE*rI3 z7h@N6hB*=F4%Q#=Im0TQ%;L5D;lhX9Oy$)mgy&L<%X-89N>Ys6mh@2y&f`3oX44kp zIOyxdKKD$rQ`;48mSZ_rrM!eN2)K;jT8 zE!4a-HuGuTvlzp0bYa~sLoZaOIr_5FtH#C)2fIZO0N)dKYlR(#^L5p{?Y>V~qR!%4 zs5U)kpeK0>tBAd^p%IT}FF>gdJa_sO%c9%0PPllQOt~NZws}WdTL#+~)iHck*yag# zMH`-|5P4O%(#ZW782F9SqmV!+_T-tTG?~*PpZI%}7fk_SDhghkUIS6#s8kDRB(K0=A+RVp=$~Wk-$th^( z>%8?&Wdb>D-e!Rp$j&ciyZ-fJN5xJ4nQoZG@aBSPA^Fq`(h>&L&}dm-z5>VQ|tx!|nIA3ImDSCJx0hUg*gwPVHFHD&j=SB3%| zZ<&^^<>$}GB+@4unR!MUhK0~16rOs}Y@fP=nl0iib?ajO1sG3nSMcEHhZJIQa! z5&G+tHE{RxvOz`&C{p6wAMFpbdIkk{HQa8E82&pY?*&ohJuArdY-n7UDfx>s;cZ`C(nH1 z*RT8p*id#~hN8BxVGJ;_w{<9MPh>1wy8}*>YO_MlDY93fR8^^W%$3Q}CPA-D%BuMd zZCAsq*vMavnUaF5NJr#LlZ#=%I`ME{oPrqZ0wZ(=v8uF3v1&l}vLXG4ssH10?EhC3 z{CjR);ofMW*Z5TAx0`2uura%voNxVifM!k!TzruT?6SzXBdmUgQNqm*+r$8Sbf>;3 zGn4Z{ipP)Uy+?Y+lhsb#EOfz%+447MK0SQ5_2lV~R;v!Gd@x+PD@_KD*wa1>g#Twn zMuu5|KjB|MW3Pq9O-ekW3rsQ(ReZmcDsu%p^1ahx?AI{=FNyi@^YOn?7HoDS^w`P% zFag-848yeM4_pDP;Ko|r`l8+zum;)Q>kU=U8^MJkf4lQ1p)r__qhAd)^|^EdwW~ojJ6%W%5nzB^zDyS<*`R ze#6hw`M+kH-^DQLMiji-g{ny+_PHbTs()`$`+V)Tixo`Yh{MQNYDVhdiLi1<3ZOY#q1X3Ipk-vM}D%m~5?m zMiP>Ea)3xUS&H&QCLtbf-h2<)T|%gkTlr4ocwZf){XgdT->*#i8U=7Apq;qKhVfLk zt^ePatuco}F^WYE=-8Ip?Q$@RV3rV3OA)U~Vw)zP@dHhz0^XXRKwKyJ)vn~`sV9A3 zhy$nk?Yl!jU5Ucza+B#F{y%>F%vI6oyt4+ltBiLS*QV+QV)^wM?>cGydP@n-ZKz4t za4Hb(vf1)kz&A^1OU3-QB$_t4(Qv9Y9D;b5 zmMLsIoLO1fhr%In4z(*Cof5+XY00I9>@5OvN5Yzkp}Z}{WGj)u4QRFV79#)P-b1J| z1(S%K(p}4LRUpaaJ{fxPx7kYnLgAmqNMlFd^R;{~xOXTv_R=M?SpfKeoYcMdRv#kU zBG7>~yFQlykf;nl>~i#yX4CrBS!m8fvrZlAms>eu*GRjBaz_MF$g(?s$5DcUn5CLv z@KRX57tFT0UI!r(@~08_U9bfSLbm80Dfp-P>Jvf=Gn3yeGxzq)P*%9ULBH|_B*|>7 zNa(7BnZ6d>GHBu$5Xx6YFxU-mOcU8XxMlB#@|0U&+vk;+cEREtJY;n=g2sw7Q2#% zYi)9vt{3wKOom{p%YXe>0&#^BdwpKOAJ5(^;7@1+u-)pcJUMb zvdOwG_#J&W2RfkBw-~;f%)umjPA`Y{=l}W5u>Q@%4g(Y*P@e#@Co<*SBQ~Uh?6Q>OgmmR8Lzg^gutsWSy4OG-kj9KPl7gbClxhx5c}8*p~z(;5U;k z3;QpXl$1;Vnxl#3B0iO@A2s?c0=*?X+P(OAgSZ*EjkUSu@Gm zALvCEam|xHn0b9+r2V&=928ICdwxrs>HwDnCwAIB9$%SAK{Ta+UN-O#}n!BBqK{KXsJL#T3~A2d?#^bbIc1HXIv8 z44QwN`QLr8@`7fn#AW4ZWoK<7+d+g4LRR-u>J9|TH&c{xh09dz^sFD(eQ_*=y5eU5I0Buf6Q#Sl zX7|y(yz93N{15;BKVVs-@x|(eSpELl=AeO6^G=@gt5bELhP`oH)Jk4ap^onT_v zc&E@uUkSMV>?mpM%?bby$HvC4l7M&22J{D)#RSVN0B{M}>6kfeiv!F^ghZw*uTP$} zFo`WuFcteqRsgI4waNN>yrA{q=f~E|y&uMKgu^tdRmm4Kve=F0vt^{_hUyEe8B-># zCkQoH0qbh5yfmR(E|D5^&xE;MoLSIRzS7SuDNM1Rg^F{W1xV;s0GLauAOUw%>JH4^ zy@+-Lu&XuxVAFbawB*=_Z{`z^M$ee)-?Td^C}#qvCoxEGmk`=3AC0PasE^80yjHpv zd8I@k!dFGo6vCLfp&LR%dW@w-v6ZZcOW&KVemtodQrYHIYAZpFiJJYPUX%}f=+)ra z8TpuEA_&C2Zdd6?Smk5Z%x79EX%;be_G*Ak_zmmk#B!04AQvL7np~FbyEmpwDg

IMO8F2k-zjGrIp(-YbXQGzjL=DI?b(?rN!KIvcZ>+C-t?*>)=BF3-*Hibi(Z){6 z;cgEkkbM;qt-d2Vj!xk#5lHjRJ*}dp$cNm4_wtcVp8ArkpGR;X4FjdM?It#Bt6QXR zR<6$xH0z&H?QlWc0H*EV2;in4U?WiP#2-}jtmApcV>- zTkCX)|1K;ileg2aB9N(;Bob3!A}LoPO*-tcWTS5AE3d9u|HhT}-9q^J*JuaJD0GX_Z z0qSG7J%5jAtLw+EGRvOsCS?xFB9P-~ly5t|hUDWrE&`PZm0LB}fzGaMkGC40ENQJ| z^ww%A;y~=unme(d1v z>o*miQeXN)LDxc`mN8l-V#{4FxR*i}OozgBm$OxqMN9I{hv?T{)3HmMcE<9LVGAqM zE`%}Rx|Z+CkGfN~(0n@2(iaqAX5r4+BUtNE59nd$CiV-`kdi3aQmQw${OqOnUXK>y z$0s2~g`IajG9+n`}i-deE(~-45O&Rh3viZi$jngglApPkrmAeo@s) z1u(Y;n9#=L_}xFz$ai;W+NdRW38W*v?$j_(*hlnK=8g6&N(J3IVL$AvZ@@HKX|M0* zOIB=J!;*2HclR+LA?HT?=Df7ai(*|FmUx{a768ddtuM}T(YRdnMr$RbZ@*rT?wp?H z&Oqm`j2SW*bE6OwCmxhniAeH(o%cwP28-T>omP`De?fV;C8RZffLVnk*PNwCO7tEIjP&GI-k%RPE<+c=rTGnO%b&z_@1F%o zkskpK&enIR$=q&$Ze4dc5_v8j5F6s`H3K;Io`o>!BLKQvTE=@(Nz?6<#)(C1=NeRd zL@SwY3c&F%Q^!)CSpsSyH;Z6YkI&*=>yG!_*+V%y3YQD?DsmUigHdoG2aR#WA}c2x zI^||~x~c?%+P$c&0N?qr*czOqOpQ!)?iNEO+7^D36HDA&?5+OhLBQ@>Z_c#}SAi75 zMc@Z>VPhOdVAr9ix>k?%_4VuRtU^2?2eUzA8H3@<$MFxSnnN%0mcD>%B4fQ|9Ns|i zo9zSnx@G-Mfz-I&F8J>FnI;~8K_nfgT>ac4samXdnp5r`dt50UD^dUZKqYc%G-UTjtXfGeIFlWUVhmCp413= zv`XcLa^&2**Vhx$8=d-o4rti09{2%J`E=MRnsMGCk8(!AalDz4eNz$igmPuV{$+th zrbyq%a|h?Xu=mM?DAs7+qAZ^DSa`F$k15Swdelc8m3b<@zS?~o8?brMp$*fFgOP=) zQsOteL$UAxODoefebsK-InPjMYY=4<5Pqhth`|7ijpdXpOl&vxd+g^`z^V zR&9^19)6S~&xBMwHdi+G-MrXm+6=+?!LK49)722timR-4c-c$~8eCB1sqN$u(8Zu<5(SnYIN zc7f9w)>&*Iy4bUg`zhBrBP1#0yl){@LWC{+ax~&VhF# ziaM$RK|>kxUwZ}oHpBQNx#V2tZnP?MI=qNXN{Zvxf0kpjHd}HvN^(m{oP^&lYy4%QSH#1s$h> z4y+jMth?Q!8MZOC4TZZF6J(eVCT_(^8AVcEx7s0oYNysUrHGh5a~jm5Xf;$ZVx%9} zm@KDdW4Io;Nzh1_fTsGyA}^nBUu*E*cLSjkr+EWH+WZ#xCLGtdUqn-NcGVV6L9= zr!GCxpu8Os-5`1r9cK1mm3r=Rj{K;G)cqGHJKS{9Vow5&DO9WMNO@__mBlUj1r#-EsSs=;=}?Qx;(L-KP`N#49=36_J;?O!v^UE={gMWS>SviRGN>Lz z^$wBs&}oX;1g!w$2Ra6s=SSM~^!2rT+LB6WVtc#;aIH~s^QXoO%%xgg-=&f8OJlBi z$EhzpN7u)q2JfhsqY^ArbI`8oa|<_<>D$k;$zL{Vz$vtDuV5t$F|E7H*{NQ+==54x zrhH6gW=I>X))^;InaC{JExGzsfE_woSHF0E60uiOgs~=9@DjzG0aqU2LXO;3E!R9Yw|y~+ z${YN%pJVZeCh&qO9?;45yq$N2iLK0eJcd)E%3X(wL07#7Zr z&|RmSt(Kyt<4v{5S?Y7V8Nh+?Kt@QNVdfPEHZ1!E%sn8LXvzpT<+DeBPG$4*Eclof zliea%!g5chvh%$(@c;=Vb98++r~h@1NBOb+!Rb3MJ4-w^=lCWU3+vWa-q}mVc5Qx` zWL!xxDVch3&L}e)u9GP0C#>=nOc}Mn%>edsdd5FKrfPoMcUrs9AR(4dx1Sg9G_?{W zgEtA4{ShT;Q!E>rOtx=54|w~4YLfxB5$H0kYq`K&u;^6+iF^U~y2`YDt3}_jA!d&5 z%M_jT_yniFDu<*bwl9LGB!YO*F0)p#t79*5qH`DKMX*w2L5!yQVF%K(Yzu2{P_L|h zJ9}(CAx)ezm+rEjnz`#A%-J+9P(T67nsBJ&*S?EfEUAW8jyafiS8VX?DqVBH+RHbB zO+J`TU=MpBsq9~i>Pi7_va=5%?O%MYRm)VBxNj=P{^G?%rTtL&aB*$KnFC&<4Jtt| zprpv?U?ADkv^|>52cUrw3gYSQ2ok`!Hu*e0HZ(LGV5B`+Kq(^}GXj^S{ZC@`uh|A% zk;j>(?6`%z3T7oNEBcla_TBWm95<+1q%+?hg|z;%S>wCi1qwsh9BfzEj##v>E^`Rg z%9CcuC|n$%TN##5cX!-ZN8b|H)`^AM6vR-5TUc7UjZr?|tT}UZ*b+ZKKdOmZ;JYxo z-o(4+Mr@hpRWq}c1z;nKK&fHY1-2l%PliS3GRDd*mvnuzheEdVMj=4pTrD?=@Zs1? zav}~h&1M)*%pUYU{p4uG3UIlID|c@^kTuUN^&?;b3QJTTVw9HLiy;?}MANDxMNFCk z@{RBw3T5xVYKqns1Yl?UIItMl?kT*0kYvkWf#878~83s-qD zGvyhcb!uSqFEJwx>T?d8Ukz%m?&Dmfo9IcE@@ACEn;c+O9l@C*HUPi4Q>E6x0|Q`; z?u#t=$e_xg%L-d>c0-135jg&j*Til>#he$(($J#bCo(YsnDl&ZUVr1c;OGFLC&DEp z=`lz6XS7-fuqB~W?ztE8&8Qp`D^NU_u0vH9(~vt0CgL_nUbpJ z525$Sg;PH~k~JHs2v#3pjC^4LS1-5f`&irMyf#^5{WY4+HOVN0>%yK4Zmh>k>U(;% zVIW4PN%$gA7n}h?WDZ)IGfFX_0tRp`&)mK0?z|#cVqo2lhul-uYkPEbqpkq3;%T$7 z8`9}1SzpaNf2q$h6!!5YyD=#0KIIFA=qHY`hIMWWD-+%Ef*jNfE8j}TZfUtmZ|8vt zJaL{Z=x^`1vYn7^3prlODO87tvu7cr*=%iepLYQJNp_2L@9-bq3`E{%7DNl>NFM#{ zBpG6>=4%L4O;gd%-iHfu*(S|zc6aAe?~up~{|e5P>hVzn#}dXM;PBPc)&LiJyBc=7 zF^rZ6>*~axJIz^$Ybi$tnPF?|fkIuw%ZR($5u)!KRgI>#iK*nUKK>?=;x))b zUUkEE*oPwJ08fCvY&S3(k7?TrBZ$C~vq1>2ziR$kbNo$i`HvoG6rfCw^@0(M!aUjo z$P=xwdX&(JT<)M5l!_`WDLl<{F@Z&ccbyUt7h?g9e@It~;t~6`3;`euj0wLeu8QSw z2#9EGhVeLUyXJ=}#5F}sufs`xfKNJMfwqn=f1+v9dRKpc|1ZZ0Eql+3?zpXv3OUWS zc&Qc64umB2aC}+;I%KR4>bJgMYZB&2S7Pf0A7`Im0BWr3?^+=Mp6Q=(girN)k^w)t zo=uygm=n@oGS|ug<`b^gMnqi;g6Z`bGBNtL!f4Q#T1nqs@kqE60rAMEyR8zYcetSLU(!VYFk8`n-Vv`519Mq1H4{w)~-pUwfjFXKHolT1+j$Nq;#_bU?p zJss}|^u($1%E~MN<;aSetMQ==tQMz{B5?@3@*+l=hOFWe=u*h zn{?ND2h4*PqL`vV4wIwrvYtpeQ1U9AdQJ5zr}DyhDyX<@a))EN=ht$*19f9w;p&{}v*_wscs7O=fCYOsMI)8x z+N<^MGhwl#I-?NKP-x}t2KGk>lLAKd)hmY!rx4#H`r=9LtdQg?ucy20)#)s3-cn*l zg$6Zus3{_P#sOhCPmk#JG_tYME8r-@)s+$hmAG4KdD=yV?Vqq1p^vQYo2?8>dc^t< zK;(b+K{FtK{uCmdh^$#k)i<%pJUMYoE0m~2$)7s*k!js6v*3P> z+GhD+UBMz_265|qz>sNM)F3kTvXh_NZ}~Y9e>mn;H|#qJ2rqq}m|U)j`?Kx*Hd0)X z#L0Tk?S5L&Wbard5Y)sUyl~{_EDUQA^J?(dHA5f2uVuJT3Jwcz3}fMj*?#yW(;_eQTwq4NHfs4IU=Bcri^{-BApg-&-(GtYx$ z;hSwtsI5+cq9;QeemBp7=GMn6^5$qikbB?6*Xy_Y0jaa>QJ9<-$NUOV9oJPF1||{g zAu&QyjJ*1-vY^I!DJu@_SFAviTWYUdz9;8|eBl^q5ph|N-F~c;bEH%qsN)&}5M8%eH-M%^t*4c9_{*2qC(F_U zs!Ko)8wHh;Knnp`#Zv)FM)_`op}XXem*}u_Yh+Dlse~Y3$07M*s@4@~8)$K30xjP% zsJ?x%GBY#+buW z9>dH@LBCZ_=$2SlT}pOVUwbq)YLUe4@`=wM>dFvIkelpfZGZccb1#Fz;KjX4dsivH z7E7+Z47xk#@5Rxbe`FtG91Zk^nYS<5wDW7rM4E+N;^)!MoG+%LND#Jt#t3pS5J!gJ zRTnE{7{B_(0H}tm6~VAJm#}&-O_`5o^BqveI{h}^8u;QmZwBJZ2*sA2c55fyJ)b`Ju*1PJQRzXgGQojFXxwW!(Iy`koj(5<%VMMlwc>q{!#}fglsa}|hk=&0_1UpKL2M9|*!sl#nKxHMB zO80iBNR;^*XTn@e&}H^@Q2#N{B#* zK&%7MB2l~MY^q-%yu-gPrjp-t@Hkevebx%R3h~Z>>()n}1kiu=CGAd6-Q;%m zylb`>ncB8T6{ttb^G?}?AL%UeS>P?Cbv?dY`|B>OpEbANuLJ*c!q@>p54V>rKirCO zxB!UlNAxIl$%-pncwp<<65V zAxR;~$GP$z$^peGKy^7Y_c;iqAZkeYumuUw;_jxKxix~44t9~}!l)RRBhG)g7r0TW zxm~x_!CS_Z!ZBEE5aN2yb&d`cr4X%0xhHR|G<_bF-=_A3+%;(E=oPu~rk?F|pm_?& z(I`}Ll2SiczEL;eQY%MO+{dZDH$!>a+BD&Osf*ZMbeR(}YfB+c8T6sOYZQd=adtCv zt0`_hkTi1c5+3uqWjVOK_v9{tsy{SoAdj1__XS`Gz6xl z;%-rAI_)zSqK-(2@*Fm>#PU2j6@}Y+QQQaM)b8vjuH~zNIO-~XQrrS;AYJ8 zAA3n_>@@nSgHqRh)FsZ%r5+O+W0}2rSWHD4r)-K;BmO^3j{H<=Dn*4jT zG2OzZ;Hw`V(uwQk${W8J3?X{g5W()qb}?bF~g#;XD5{_{D~(W&RV>G(-C% z9+}pA&kq1Rr1;g!0P!d5ca zV*(93nyI?xt_o2sDbm{sJ_{@AxY^TzaWPw?4*-{ZR`wa z#4#Fd5kz4vVoEi}ZF6tUrY;uZT0Ke%<_{&?g-p}vNBBDp_4!h@GnXnVYhs;a$>j~S z3V^3;&^~n43^Kp;>XUOLulrQ3#5zC~8Wu1Ut+4zTMl4I^bT{L(qZkN%RM2o+%hOQU zdEi_f?XAWC(}s`RH;=omO(qxtiD$r%p9nNxayvW=PZB<%8Ioi)cVem#bcR{%<@Gvl zP6y*BKX5v5PE<>T1v#kv;M}&4k#D-l9?sc3{ZdUn(~sjEG!kgCZMP=Wy`;6Ww*E%p zHkUO9s4slfc{jD;{l&|Q3XNb&>!(`mE}RaZ!;{`~yt>g7@m7!k5V+?@`8+9Va&=SJ zRutfZEK@Pn2>?)C?`}fZG8v&7sLqEZeL>#Xp|TB4lHPt#6@I!5HITiOV^q=&u+ILu z)-c{--Y3C_q`{4mC z#zQ^*2J`^$v*w)Exo173er->NPG=7XC*e?U6AzMJ9b0`R_(Nkl|(nJC<2f6BdVyMAr4Z_2x*tL4x@s=Mea zYc0J)_ddH)x#m|epQl}WiQ%3_$fF5KLO9h>hquG<@&c=B+CCLHQZeejS{T+d=yB5ZP8bi&+OKO52F$6ZJmT+y41q=I#M7x1@* z+1dlr={XyIPKpksD1O>|-F(SrN{xf4&Kfm+^EJu~yi?M7e3ikwy^;_p;PXN8Xl370 zC>$<7`q0(IWSNToA34g!vX?&nm zBVkGBZ5s|!562Jb3jjWN93+kN^W-h+siT(CUYLiRr0S!jA17(`Q}R!zVD(( zvVp4df_XuXQNYULsiY8TH%k9!`gU=LE$s0qpq*0F5L=$PcsZ@c2CMBp<*I$j)F4V0 zEh^G-_+Zt0>;32+y07Y`&)1A8Nmur89*trY&{d>z0s;Cc>=cOwx^12%yVxNHvefc) ziaL3kS`OfkSdQ@}M6cKWXP_V>GG1h-k&8j=jajxMxM*r@CrCASFLmWxKp z8*5AXFPo;NRDl`TEGl+Trle%9!Lr_i<)9YfXfMK)sDB%W4oG9H)LbPLEhEKWLOXxT z^VWB+Lig5+5WS+3OIh@!b{Kc}A-0sJ67A~Ix*zcw}1E#y!gnf?a)Y)%DBeTi?mQrGD|1~@Ep z5@z>UItRuq(^72v<{Zm6_jS!@PRq+I0fiO~K(CatnJ+eJE=|(0O;Fll zCDS&RprMv}j_>T_@3Q4(91t*H&s>pD>Z1t2K7@}Kz1K^xMoCdHZ3pnR2+h?oI32Uq zPzeApO=-8Nt(LInwyUiME<`e!t^*4FB->Luo~NC(n83rKEeIujOBZIh`e=3R;eH!H zw4A1m;|?a<_aJRoEC*ftZZ+)m^BrMdmyf$;mR#VuQi&!|Z zN74wZmd-&fZ6zFX8eV$2HL>SSu4o%LJur-7?qgj;r^81{^?)DN+%)r5{A?dEFjyvk z?K^pAi|sFc?s|1@_Jy^_N;G%eIgCp*Pi5=LL3z}wJUpgfL~VCV6nT^z^w`JM#FzG{ zHTWlVbP2*#m?xg3ZnX;dm8_YVm-HNN#le#$me+yW2F3}|vB}mm?vN@@$LI}Ee{F+w zs)-KoZXG96F`gDg@z!@oKxrIv4Y>Nw&Lak31X0_YK+n}vp$MWzLm|UOi%T+3-hyZZ znz%XU^ApeSH_Jn6G(&7DJ*6dLva|r1-qq7@k~5NbvzcKi)@HAVZi8VqT&iJu)b&b+ zKx{UI-o&cT4YMNt{}J}pQB`hxyV460Saic$NP{4#q_hYkDIth7h$x-X-Q7w^NJ^JT zcXvp4cX!^o&ffdpalUcRcmH%ST&%%6-#MS(Q`1qUP=BV~MaH4~WK26*bFWK7SibgL zF}&`<<-fQ*7fGk1XmI`3ku9bbTMw%cqow8(`G9*$aryKsu^OB84=!8<2&d%K`*tD^!xmfiwZ!G!tIIGf(E$r518m75bLU^l{kOi)5w^MKKBfAe*K^)qxDV4ud zU4ZETTO+oB*fNCewEASaue$F?p?3S6(BbSp%~~klPlYXTbmx<3+9;mdUjPqn#+yHE zYI;Yjy~dZv8$??_MN-I67tirLOz<|}_2XX+AS4^X{RWgu1`3bwz$M+UQc*2^FjH0o zFU5o6w}-uq2Bw(#br5u$_V0X~_~BZUOP=@BHpj!33dOmwL||bdW;r-t3VZv0bzNK2 zq7hA&z+c(YW9vP<$y!>I;?Z{%lerN7UoCSvi{|Pv(#OJ|Fn!82RU>7YJvA4thu85v zmL2+xfeFq$hG)HcawW8G%KT>3JmYGwzJ4(q_@{g7+}>~5TDAKHw#cf(PwfXKa|op> z9ZxpdzSi>8y{!l2>w8s8T(Kw7ji(M_dkM;uT6(q97R}h$8`doc&o7_Egl6Gg5`}&G zHSuQ7aIY%q*(P-q!b`+lclKtpee!;{;zqTQkE74slEA)0A-3e*L)ZCK@`@(s!)pXz zoM}JnkfryBcPyDx|7ELV2FnYm;rF5eQsG-6>eCP=ykn9z&P< zXxi4--zC&{>PQ0r( zt6KM?o1QEy>&)A&4Z<5&nOgdPq6cZ%@UsvI)&uE}7dm%4)`S*QNZc z%I5)t$4YlxoXIW%#GEDcyza}xMQ_308`E}k>7=NCc#p@djHaWJ%B8_979ma#z&s#N zJ1N?Td1lxFkiyFTG}8MG`%`A8D)e7I(%+U#EF(Y7ET&<1z#X-GKQ4&5JtX2p%lE69 zxAO{S3nEXYymw;NPG$d;Et`@23GgKzf9rQW0#5El4jW zxyW$(GFHrgBh2;qM_?(lH{mmuj|D~dIBy_*Xd3zc+;I;t1XD z@{|#C8C#ECO5qP_9N#lskKgQr!1x*N6SD7rKKPx8RaH6h7Myh@`lhXc^eoHYB!kI? zy$KiCL$`~v3mF(F$XLn3R6D?jJ0Yp+jdP#NFb`H;Z`5uMIH{fOuXvr$q zsulf9)uhGR=Du9xLVE`;o6_`kSAxbv>C%5bQBz;_70fvV9G(4^Bf7fyZAU(3S5Dt= z|0<0GPdIweA76Lgawp^S7wa-c*F3h%x&yM{Eyh35>q^tkN4*=9p9^KDD$M19xGB9C z4Ves@pRf|nQ}1=I&ZW>@!uzGMp_Tqy&JrXk$Brwuerq%A;gYp*a=j;42U&>7n-Is1 zp^T8kUglwH@U9(h$00NAs()5ye*bpQG3lA--jeg9CbWkS6yO7Ik!$e}&&nyx`owOD z^R>P$4o(?P*x#9&_YYnF$D>cd-s61f8dy%^w&KP$gvGJ5Uz8y7kK0p zs-VUzr3mkm9I{(aZxitZocSfxB4+t5-{aNkKsF+9vN%e@nl!M4tA=btEm6cveTVHd zN59vECcKoM>7d{lZ?oM8^69Aoaob-ppjrlKD(=DAA8DQ!ZOHi`c2*scHwrD%`W#KR zLd*-GGKEzgHIIm7!;4u9U%+{U8IFeKpPEZpqL_H|tFqLR*^o@xeYcbRt-F0k?m|t_J(Qhr##(tc z3dH#i3TaEk+^CBgqV;P$*1Yy))CLhVPW(7&5{rjVhWuxLHK{&@7Oz4z43-FB_RK2>YXT7rH9)V-%J zP~s!Xs}wX$RQ#9t$UQj7+ie5mWrD{}PX^tNTVz^nWF&1`j$YWe*wlRgLN!P*Ol5cW zyS9`=FG2(hxy(}yHF6vezXXcjGmD>)EMyqRq&d^|T&1GKY{sdcaS;gos)mN&uT|L@ zpUAr&0ST~2Fq~PwUasIt*ogG(0DB!jW-EhS;z!3j%KaWBdBa(^>gT6J&kkh-G4Xba zh0u}Y9tbP}ICNj^WvwoCX?FJeOFS=&Kz?<<0o8Yt`X<_&W>ifz6^6mBlaDV+=rdIA z6xua{%-TGUtRUh^DR&!s)~0j3L?w{0=%6nUC(M{e=w zk8>X@_{+`L@5Gy&WwSQUhuqV{Z=OQ0I9=!O09+qC^S_|p^FF`O*)y4~nE+k3W?7~! z9<;}@oIZ|0xNknnB^=zhb~W@Ce;{^{bs*+R5jFBy){h$tS*e?p)+KZM4AysMX<%Tr9MuRkY2sYPcbl#n^;ZG9{;khER zJmb7vz?nZiqFV5NL+Ivsc>1ae{`VJ3c?Bu@W&>_k`4Gc9umfb`$9``cK0IuAxvEAH zI6-QP*Ho;?=^M@yL_IT3=g`HR)zV=##S2gM2&SWhRz>H`ne^aBOoyKWW zwlI~RDD}nj?b3dh3cL~r{esVcr|+!c@NO=a>ilZ%2|EBzeCx6I)*%U%UMWr>t)Q-w zc7v;^CsT}n&3Q+t5%)B?W^9};$M~HW@0=0brL`?!=gyZ3aD8I}t6{i&%TT=Q44*f1 zAtE~cRb}q$VPP-+_f-Q!-G*4`Rhutm31%+B`2xZSDvf&MRi-?3EgzkDL$gW#mAbaK zjF4#mnMkIVwxWeM78Bn`P|B6_sDVUJQb6rTR zJKnttyotDhl(r*^yG6}7pM%-~3f)5(uHOZ)qNCZbDE;+K7h#VLI-nTL4W4LNo|r`e zroaWf8~K_&$6)yLV^K7J-v%wGos}YEy-qMom;?evFf8<4EL(yJ!f9ckUvBs?i&@D- z#N^gc_7}T{w*d%c;Bak*gS!L&P+2q}rRr2qSA^q*YjeAdF)urTxP}=Z5M~W{fWt0a zS&>l>!oLknc${fw%8BzI@j4{*b(7+R(mlb6+Erb9#J|ML-R*Xgt3Bf&dk67gfZy|I z<7}rS(4@a?2G+{o(41DptX+vP%_vhyx|DW!V-nztF~1&XX`*!6E`CMRJ1u82@yj%! zv@FRe(efp8u)tul(3Bp}V|hsGFzmi{DsGpPzb z<50d~?XFq@$PE9Gq<;0!tl*;mLwvn5XaJ4DNmv{TZK zxJF)YiQZ#Oe$RnHq%UT&KX-dtp%@gtdUd$qldeRIicaKF_~27pjQRhvA%U$*BnnUG zKyS9jLG$5xw_fv00?K~2pv;N2<9g`2Br0si`?_RiEmUBa$)(FqSTEx_Cepuuo&psz zLaDTkknj%(VZi_EhaHml771wh&?zd|5||H_*7F6lFS_1FV(U1(6Fwc+-v!!CXLbJn z-7m@g8bEnWuU}@dq9d5^Lb|;OS$yv;JE}y6lx3RHTe-v1rVas7Hd^)aK3rx-jH&`+ zAZ}vt>%I^vF>NR?r&fU>d6?YPaDgoykH+OVVkxCYjmu_zKuwW{L8~n&)=GhqQ;wK& zlHb2cOiUd?DvLMTXhUqUkuGJ;H6mDcoL)QLe~23I?Vca|^p*Yw?ce+Ue>s)btx?Bo5aIVK;7j9X$dVVn zDFY$gh~`Q)uzJXl<~}5undFf!+o#rG{o6zL5EXM*D$qCkx{Lan`>TIS8UgA_9@t2{ z+#6PV6Q~jnCtpQzi(RN9%$7E$fiF0`S!*n_T>k@juZvCjmJeo?1H7KwvgNCz1b?cKK{QU#WnIdM+5ND7eoDyidh(1xKt;eKSG~gnVirMSh^wp^x)6sbHUi1u1WHcBk~66}Ptm z*;}o+32cZ?6K~V*d>R^Hu*iB3hd*7}{~3jVmmYynYTfVQ%-PSm*yps`Cr=Kgu2 z{|nUiIu9y8Z!^93 zp!n4lV6kv~{dfa7i(WvU;(3VU@TGH?=Pjcf5`sutg=g5{Td|Z;?BZV}N$W2K^!c7w zPVIbP3d_4PnfmpJFwcBX+`z|_1pkuQB#&ho0b(VTGPkqe`=;hceX#+dDp4Pxzs?YG zDHHxkE*e*rXd~XF@hq${LROo6$#n$mkILV(fCTex(Oc#>vwpc~-d+veD*Ta?DD0kQ zt)s1>cV#B>kS^?XofLAUFiv-LwD>)Nr|9ZTlgm`jaeoN)Y_L-GPrv=V%?fUnnd0gn z4m)xI+lSvb_v72EJq{ZMX_Y;#1Bi#&L$Dak>X9-y{`bw`90fVq?Y1%jxB?c?p7`Iu z_7RSPD5Womzyye|UC}cRf@YNOp}2C2CWNgXd(ldAmH-9G9`XV3d4B;nwc%md^C6|6 zS|6_LhX1%K$O9Xm^gkb#LiPu?V{Ssu9D2l8`iPEfVgPLCJXSGepcQGi*0mlHo}6YY zIrs=zyUH_L@xS4b2mu}`zfCsiAMbp zl}jg<5&#*QuorhE2s-z5B*yRf@sXzrKL6eqmhWG1cWQn|Oo!v~`$xhKLpnW_`qJC^ zF$1YVF;so9Q0KD^OZa{*@D4YAWa1${EFbk(X4k-*xUtWc+rE8K$y)QdyT+=bL!pz% zbOp$+WIZVvz48x>y?4%T;jL+7^?nb?7TLC5h9|gyR8)*%oZy4=hu(DDe5y=0+c%>5 zdpZrG?_v-5b>Yok3b}8$aW>s!*3B21e9S;$7cJJ31WEK)zu{Wp*c{~kB60ON%U93Wg6#g@ih0wZ3{b(iQCROx7 z0y3gt1u*sA*H>0XtP+n~arcXn=f*=HvY%7wYY77;wl;w**=d)LikILBjmhjUK;iFs zZ>v!C&=ave3|v|e`Vbj2qvlcMyp|~No20#`9%>t9KLz2hfv87jn3+%g>Wv=Sb3Lnu ziQ?heKIu;n>!rqD_0xk^i;Cd~(XmEnRqcvPAB<|4qeXdn`!)+!Gy755sXcapgd*IB zI=pC53aLQjJOQKJ_9vPI6$|K=6ZhQ@$*{iL<6C+4 zi$8^~E7TwXAl(VC4T!D5^w7ma=9YTk28`eWqx!;E+oh2?IDPsf6px)i$;1zXc%cA? zv~UEn%`hoYs2RN~Ze#NjnlqxmSP~oz>rE0E69kn7W&`aKqgJ^VwP7M>A3izK2(0`U z*znI}t3ZZaSaTQ%rtKtVA!5V&qolpxz=l~I>0?DK&M5PBzM%H>UDPn4bb(rNnq>cga^H~uw5JK}qQL{vvH<}>-9@k_ly^&4Xo7Q0h< zz_(mj3C^vGjfrsAe>NIB(R+)?I14xWwBH^crz&8qG3?B62I->=0uo>ng8YC|? zL?HA+Gr$XW3PC?#MTGnay;B!{!~%k}mUo97cZ=U0H**Y3i8b>J@@uI_RA{; zy1_H`LRSzmnU;4wB&e`j>H4_I)vn8T@5dBIb_>6<{=nK5sl9l-=8JuSYEW7*4Y-yy zka9AJXJo~%Z@LdAtAW}dka%xT8$9HH9>l-nfWLVV8$2XRXJR%rogp0{!kB>^erAyb z%1-^=?Jlsh+Oy3cVs@rU1Wl{F)m*VKi~KJf$^qVdxcjiY@Jy=}@1saBd7+Dz*Y8#6 z*nNl)zx|jM85~}xA9lds{$!TMJ3*4#A)O}ydP4=MhuOzf%zy88DaMc@vV`I(&`{#} zQ}q5dfM)`u9`xW7mLIyyLI$;XR=~JgV8ZT=-CuvRV_rL<`-I#3>ABU2L|~)}I{Q4qjuIcWWrwZAN&X@@V*f&nYZCxwetQ346EdQyKp`o?7#==D24J5RHE^gvXO zcL5bc^ibE2D)zWscAP{kSs0{l-k8!K6>lW6VT6eKLNK{qoP{T}!p|2G>Np5{dEH}jOg;MpKolET~1$J7qIO}MLc~rw}u~Ck5GXiCa=`CZ=$~@ z@C$(E%XBw==kBXWh=;343gEtP+*1z!hNk~*F|9+9uu`dC^?Vl;P|sU`%(u71`?YvJ zsB{Jdi)(b%M;4dsfc?;^c_Z^bBVRD9LT_Y&8M6xVx~&EM>rX1J*FV$R|FvdAUd)3s zv3-1Zk@3kL*)iFBp|a1QA~nErZTiOnAfL$Idov6+#<_{?_mTcOllEa2fFt|;R@>#- zgvkzO?6jWJqh(^Cw7h4^-o^6pkeK&>7-}&?yC5ano=i&zOa~uIIvv5|IYl>o@=Jo4 z{ryMG(UZqBw2GUKZ34;-VzZFOrf|48zf8_iJ6RMJU|~c(Ib(eKid7$o!EljY3!_$Q zsYjO7*aT^1;Re4tG=gKN3fF;MCGe+~(-$cbbj|f8;C@~OB-y;rBIq@+1Jj0Otm6Q= zqO|89$J&!KV4QnBmB130|Iu#mEGyZSTqf}`Xm-W+-LktUl~6^GA7V@sm*B|WF@Ly4vwys)PJjAj=FCh?flix!#_lj zeg-Oa3rj9LE_S#qZtGx-0Vjeb;|2}46i4{&Ag()-L1OrQ@x}J5P1HETFw(hHp`fQ{ zAdq5E1AXZ7IkCsG<;z|Co;9Y!A_!GoIe;K)tD?8=D6AZx+Y zw^?}i*SPUN4n6Q1hYJT&@buXpq1sXgbSKtK7w)~dz(?#jW#ac}N1iY8H!bVj&ucgUu_{Xh%_i{GR`ws{s*k4=H4n1x)4e=%CPS8>VRiRsZov@xGlF;bpZY^= ztf}c*tEH*fmd%W-WbZ!cUw{wDKFw_jDhYohlC5Ak!J4|-C&`A&rSZ$e5<2sa`*bf@ z?GEgdI%4xb!i2bdlu~9zb-;YffLu7+smLb_54j(4&1nx&p98a~GH(Q!@X?b!?qLr> z1FUPc*!i5Zw7t2)YDsCKZ|?>;%$>)aMRcBmDA7DMij;!9;K|4kT|M*-5LaBsTBfcS zi!u@8QE$?&CV9){Y#{ei0VoKfbD=}EQ0d5&O`uFx4h7+5jBl`Xx8r8p5c#tSBO3b! zACfBYXa!X=mdvF%FVeX{E9mk-3}RM?KP?M(7&g*(ebSC>d;&-V*^?)k>=H|^S34D6 zVG8!uf*dbrFi#2_gUc`ncAU!sl3mvaP&(0Dp{MgTcC)>z_`1wn1QK_6vQD>NB}2!{?h z8!bVD)H zltPI$s4NICU?89J+~f<+t0;d~wki=TR&dV3aFEA?YGGw4P^8xNEf}q*Oquoz)78B> zx)s1(D3BS|l{0nDttGqdY5}4`CxQ$V;}}~(W4d8A<>(y(GMTFMpXAt-?LVn9@>G7k z5jRT{bX@|akPqVRpt+^z1gUe+rJ%hTvywW~toaY9G>VG_Uj(}pzK(iZ|cUx>#&Bc3ghc_R7FPjieTbjA75``8+g^XjV4fuSyQRCv$H1ZX5?|XK1AS15D&X zW{VsrZG_X?e3O)>%Y=a56vgLtIO|UFY{|}t0ZZc4Lzglav>fZR-FBi;mV1UXOdQ8Z&RK>&*Xh6R+Zha- zqHeNZD!C2UxpVb1_F~xbYGgSrBpDt_2)FM&)pm|z+_V{mD`*ion|V-6wsCNg~w)!rIyE`k3vOJds?#7WohF{y4SEyEZ|&8)DW zsPf8>l%7OS-w}D2HFPy|EjRV(lKi+|I?zdJO5a9qDkpE(`0ndwa<9_xEhDawMh3~@ z0M4*NU6rYq;x3?jTJ3%^j%DZ0#LJuNC3&;?RPNWvvYHfq1GPLua%-MHDgJp~0Z9N3 zDS~QP8GG>Mu>&|w6PL&Wz;RwpJK)Xte3b}H>C&k2Pu=u8Nl<0roqcb8nl|ge&u@Z6 z@=imZMVRFWwS3X|^u#TU#kvx@`5cTxT3^TVHR8h6h?upZ`Dz`iFjf{;mN>(RpriK@ zhj@}Gt()Q^d+mOGyJs+Rf$gGZ1bj-EG5=8T9Eiy{Vj`m)LHC{Ri8b-wL(a$y=o*eQ zN2T!tsovip3&htYF4Oqd2iFSlnG7!HK*pnZ)Cr`uaZTU^-33$(&&fs-)8UAcJfBeX z1+alvgVBKda*}TAe4ID@>dzzM$Q4q4MSB%Deb`hDZ$IzSgLY9V1nHu@0z;9<)p-tv zfEiH4U9}p7_v}Yt%^Dt)S{noLQ3^Dq+_e3XmmSB5^?k{Fe5f+F#O0}pScMajE~R&8#+rN{m_ zJBeZ->G*ZfX3P!Vs$OMdEcT#yD@oH$6z4HGYF_kf?ybM&fu_{WM-T40EXll{dP!x> zSoYAQ>j!q($TLbI1eW1t4h`9w!IzS?(D5;eReC??d?XviGQwfACZ5Eq(JvD~hC*bz z=O6pa^Q__3Ji;`^nX!uQ1QYNwcn)_{hk#$F4LhCnWEa_Lf zH6qvp$JNxN8|NkN>=iKbTF)V!G4rVKfASrA5W|BNTHLJgVb=A^)K637+Zmo-Ruv_v zdVJ-;2PR7LVc$qxN{@}^^=`I{`KPOjKVH&jaq^_nNFDUL8XZYge~37aHoo+&aTeV^ z23s8H<$w$W2*E?UDT*Mv_FJ(Q?+lKOwiHS13uxqdW90H@s)j#boeNUZ6-(wkXXIPSRXbwNXoK z+jl`-cpb8*c72ZB4_}dG7HDh=km}RCncLu~7IpQV9rrvA3yx#^^~f>n7kuTre8rl| z0CTx{r&ntonp2m|x`Fk!VOvx__j7Kok3Ak*Nm7LqI>zc<-A^b=H(6L~6&NR+Q5ir6 zW-I!0oA%$wC19X^@BKnF08InmrghXN!sGX_jh4ZXND4CIe^1|OHGob`X8@`*3pbyw zGGimHc!l5#xshf0WLm|3j+)SAXwE>?q;3JHRBI4gB;{tHp4{MvHAfTxT{l7<5k6j> zGNk+$MwbX8c6ic2eqaBCb5tN?heb#n?!gvdOZlo4Z{7k`>P*dC`?p1ECvM&_4R_29ZC@Q9B3rB%MH&vT>BK%9Co$TKjKy=-B=I@^f&UY?5gd7t*IuByqVp;U-=$z zi8Ef|@cU=}knA+#@xO)9<&*b^x(_rf;^_#H2*-m8tsT0>pl`4%_wz)HCd^j}Y8Ca$ zJvGd`vyvioZnbwfF(`kH760Xhc7%E$xToKb`#fI~a6c*;?{2!EkZ^?hCLB@D(n2e= zY-(cRJCf@!a=!?e1DBgS{lUm(S8`A$MOoZjvO#kwH7kh+H=l?)8IQ*PMv$<%g-@Id zf9C0rw&>L~yL8%(1y0N*%6JWc)k$+@HPVKveafZb14KL}B(&&a=&7 zp=?-gO7@l1p+&*`NH;BV=PPL&F+l|8`ME8)`yrR_+7Oy%9c?hL?uqK{zN9%app;|z7fB78GNDzHO$HVnx} zSbS=i&mEQA&K3G$guYS*W**rDH-kU?Z`WVVedG7qrx1YnwZX-G_e;xk%m?e1G3j6` zr!+NZHQbN?c+^F3=dv`4j>It-dY)zk488i6THiUz8{QF0Ey$mPV!IaOTmwAgyMT^m zPPF;-lDj1nxTkqA3aYid+t&)t{=q7 zG4XB|o|w+j6C^;)sb4s$6E1P-9im#?o?5HQm?IE8c<6obhG4b(=y=%npH(M>I_~cX zs9X$O)z?dEB?bZ2%aO0srm&11FNuLzwggdOyZWJg%cU5`$uY}ed^;n;9ey1^60g!Sa=zU74$VeJ zI>A**8BgL>6VR>YFY^u1W)eb|@Go`#%r!AB*21zug{tONvs<+#T}Tnv$t;8&-3Z2W zUUEzJt)F?i;?q8bGGuo}Tn-vFUo02H>_7#t@-KN`ZU-P_&(`u8+LQ}<6|!D=!DJpx zXpQm)d4HBpR(@gRv-1GSIflJzJ#D$6moeG7r07oP+sMY!c@g_?A4!=^qT@@5O`wR2 zmS57RpKJedBK&_tg^PCs2%maZF1#pZfMDI4{Hz1onbn_0hkHZ5{M=e=EO@^geLq9? zol#$UFxkz1h}t!+m|5)uLK_b_{*uP3PjC(RKto%eNh2%$q38Ae!`N}gKP94Pz%=oI zKUM8uMN=4nYD@-1fgzlWuFDCJktA0xe?iZD(M(pp{s@ohlHCGlA-Y?RKHrGRkc3^0o!&(AjvD0^plQ@HL9Mre_spXS(|?d zy$3P>YpjUS5 zPRk2-9>{5{t*y>$RW$PUG%*&xf;kn-`Esv`(RO{!WuKZjyS0)3hXx=+C0*jwN=wGU zJf&Ki2UL}xC%~?xq^P9Lwi=t?A8y;Z#<)I#>NrmmMhagtB49597kiLG9-sAm39yw& zw)l%VY68EHe zyY00s#=q`riK_N`Y387@{}?#^WSp4-+YQ{1>+fHy>t7wuzx6Mq66y|CEXMB8mT7cD zXkvB<`~1@5I5|{p@@trwP;^pygbT5NpVyOpk{|3pgjc*OeMyhrw@k4%dDKTb;-ye7 z_T!x9-7Lk4P2nl+qqUm*aeBXi*iaxvT-#n@Gr9b;)%*kY|BWn0$44TjcW(M1u_ac` z@%`s+@kVqAqfqTc!?bc_{ZD`YcL&RazX2sRF8hru<3!c8eyl)KC99LhYHe0F@9 zXRlm%g0iUDW;cZ?eEhv-D-ljsi5h-s?T^~udv#a%CGLp+w*zk^@Q;FT^N93X?sH-2 z%ULis#ngSGOa%pM4E7rtam2JnkA9+#i^`~?UA(F;Q$qe(k|ivbw*VU^RH1!DRnJ=F>Muk-7RBUXFobn_1n@T$$bQ5ZiYzx4}AUd5s$VN(mg&D%~8 zS_jRU{&Hoi->4Wxh=*s8U17sKrfEpqWtMO#i z8)wdW7rvK)ng!L=;118|e^+m;wAPnI(Hme3>{kI^PBBZk-0mXYp@JmhOt0%N{}i%R z5E!o+|InN8(Gk6=0TMx4-|Kn0`cHp;8px>9-A;-^< zgH<+(A|;w zJci~j?J)5a{g=av2@NFjBz#)dw&I1HmLnvq0C-3je(jR`KGyTmq&Tq^e04oc@O1nm zzcLZ0o!x`vnV-k3#y@oXi|% zCN;CigFJ{BasV#O54kk7SG1TDHTiotdv(uXdmEwu=2wB0W+9Bjwi?zG7`muS72^V6 z0XNrSTR^L5sSbTl_+*yD4(}@T6j)NcTX1QGJD@H{uZR<>ve~`EHty73Cf67hwK6}M zi4;xV`;k|o9g2H9aK1Od4m_{yU99SL&JOs6{n^Z)Jv5lgv`YEc8> zgIaEC4SV}ICeN}3%6)&%*TrxqSESR3v6!iLh!{kIQa~~$Eat`37t1dWpwjb4vXJB= zD2A~GeB>+cjJF$!xSVQvt-skmf@UVWc?q&uh(`%TCo`Pzk__%U!y1vEWWD3z%o(?b|&1qWZRZC(-(9-c2cL|vugGrqz;O`k^x`LUM&3P#zi-`uKhgH@`FigGQcI)Z_ov1&SU-%WvQ5? zj*DHrsJgzftU+0Jvq50>fYBaZ2sJ=53IfFnhW2U9_V6U5b0Db^pi(|dOW+DwoEHBvC7%2aA_asHwWF{z_Bbp zp(aH5NBDeTBg_ed$|gL=rN!Reu2*s!jW%y(iIEK7zv*LK0t*lw1RO|$A2Gjn9?#;k zUX^K&XK=lLp6)%_M{B%fe%5R5`s7t^hqYnzo7Dr;Wt0GtTeNeDd7}VxNfmG3JeA0b zlB4pivBJHNa~L;cAPY*lBSdH1^Nh#T#9t1MB-! z*qrA5+zSa+tn1BU^R-)Ac1*qnb?$-E`*E4r2XCdT6xvsjJA`3-jv!;HM3m+xZeiE` zsDhU}{4LxT_=T&){G}YiAs%UvB3;kZkPsVAABm6t!@N{QN{tr_z@7==e`X&qw{hy41=(XWV zCQWu%&f^f0D@tV1t!lYs*2^1&G!Oa_2wn1Q&c{*Ra`Y0%tAVb(Y_u&KeWSCK^;-~d zO1s7F)UVxMUb*f!Vo=dt)+De@wtft>BjpU;5VCrkNN#DCC*Cl%HjcgVBAX^CgRvzN z{JM-weQWU%O`_8lC5%RGRX3>sW2dhBM<~adsSX7t2Ng~@O_g$M-w{gpJIvc5XOZJ} zwI3`n70ElmUz|*8*0z&oTfOqNq+^(7dhoJ2(JI(|JEANE0Nl(7tBoe&vSF6 zLXvug2t9P6TQ^biGF;$$F!as1D;@C~l`yS?|C0H}onutSjylSNYjdy~q^m zo+0xDw>1k>4_-ydZ}V{uy80C9=s6YaG7jQl2PtA0-{D4adUQHzP+hb2ZttPHivirI z#fa-EyL*xULA3n7ETmWR^7~lr2U-|K)s2(l-2io*R;Bb6#8O?V2#I$uGZFrc486UU>E^MV;)b-tmo-6(e<69-=G3+9=2hNphgx_X2khQ=9 zQO?-xS3sct+d|jSRV!&d)d+*cLlA>!tE=)q>$0%Fg_aZn2*LxNun!88S?88FWCy-j zBZOq)m(GldiC*;a%F0+hXuDLTc)Rd9_Nd%-vFW4e$!zTIg+K|)Ix zg40r54gv=|-3`;%VO6EjKuDh^uh@dJp`{~cE4Ctpj$6X#@?IyWLz$)lImu1=ksnX4?W7Y_18R2)oMq@%N>(fR5=L@) z)rx&vpo-bRDmwZ(Dbpa}b)A)+BFuP~$>^l9(*{UydK}f~G)fjFUduVz=@)5~!#rw7 z5`t}^LSXX=Vlc)@K6Q}TG$eOWGPzc!xeVl5Mlnu!{e1LNT-XbR4X0A&n8cVm{!~`8 zs$(dlZIbUf$d2ho`^^%XnJf!RUIInal8cxApKzHoubg*WA4iWJP)Ey2I~A zKeAouYK~?XSCTw ziD=8P`bIl=V;)qGyplDgAH)*z=1ze=zBeR@8`n*$4PEHfS_ByHL4{BxM_|%fm2JbE z92)W+uq5M(3=Qr?zYnUzJG6uRQX^?E0OD|MGe?I1fcB9L2qzIGe z#q>ZgS}v53m-~V;1;&Lim@>t$pQ(RI5_YTOqvAd-CGF**vr#|^~`M+Mw(&57M1 z#o7yE7d75MW?(T&*H@~Nu%Om26*3HzI8)8SrgT+jlHob^OB9xhDgu3hc@#h~k?@&m znwN_A)BUW&eV4WDnqQTr3zzj=M|;Cbvw^noC|!}QK#cevcfKbIO1hH6GRk~!DKnn# z*3rbAtX)~(Cg1wq@P{RX$T2hV(8s`blSHSJ|7GEKuoCQqnIfbq`&-t`ICTW3L^mrfM}_)3ZdlKBi%uv-+f^ zO~+(&(lS=l9FW!8yHxd9)vjtxzQ^k=Wi>oj{Q`K_;p9g1$@hs`6CXzlddo*>E`y$5 zJZnj}kY@&IWHe$M81o2R%3`^yB2b z&xlKMOAfMDZUKQaZffRl5$$9mxcOz)iM|(l@s7JU?d~iHJ9ag}(qI1Ptieo>Ef+40 zzle*NdMiUu0_(A0uG2p-Cf@trmLj;P%?g;et6x1@4XOjTuKh}KdnN(p3%^|LxW{^l ziZtr@jibaQHUx>x`k}+o>BKRq{JT|2HF;evzNdCZ)65&%sN>l(>X2US;@j>-RURLQ zkb!B8%M8CyHcDe!a#Pa&B2$gzCe@WEnajdYg(EjR-{-gZx|i?i+KL%`<;@xm@D7Udan7y6q&_`kpw?GN~@1#N15l(L7m12VXW2Y{iO2y zb-yKU;CYtqIDR*#8`|IW^~0npwoe9}->WC)xs0tg0_DE!{r-E?1BS{0-!>j|tuzccoZe?I>)^?YPv0e4i6J|% zF68ehGSzXN!K;4*6LYO8#lcXVrp=&)C}r1r!;_s&B{{Ro*IftJE8Eq=fHZ* zz$Kkn0~mZt^Xc_)MqWu#^bdHD`*2>Y3Ei>-Z{|&y=Zt%4LI#@$eY#~`ujllZ_i~sl zHk6bIZz#R+5o@#|4JLE?6QRT8k_}=9905C!M$DA7;3|cFGEAZ>e*1As%pmR9 z)=KVWSU{^P_h==#?AusOw4}SMP}#2Rc5s4m+(*fHrtncBzp1vbvE3S-8FkXI?xLgPB zC4mV^@=&*t8u=Jz!Z z;m*g|fcd5p_!;I#>LXZA#umG0Dt!Y*A=`lsZ|!b!wEx*!{u}=QB|wtiqVB7Qm~8_UW0ptTlA(J4_RmPIMnptl$e^Y-1a{y{|VI2d|txAL>=Eua4%!rn40 z>aXwmmXeh29$HdDx}8zNKxJl8ZB zznp$P!fSxoi-Znax5i4zbPX~+d)+1VVk_R!|8XUFB?eF^3fj0hxuT*55u_7-&@7e4 z0`zHqTXyDCzqF8#NXA*)+rL`#pC%~XTJ|d721)HvL8qvi0O{yd?G$JZi810zME}i4 zS%&z2f=9BJF3IzOz4By4|IG~%+YTGbB(oGYNO8j+4x|>THC}?{e=;D+dyz2eg?}-){uN{JAZe#zrz!VT zsTYZIBUsM~v2v5|STuQUH0poIq{ds!%-3Woo*k2Mlz#jk48+bs3 zNIhUB+D)@qOXg0FJ1ZUVMTrLSNId)GOEKD-kGmi5(*hy& z>A!;S67JU>>PSXStINqXSS>>Y@|AsFnH^O$_MlAih0No64tR>9BytU!CTfk(6a!8i zTSE{vd3|dvjjg%cp%E{|HJ0V~>m#Vl2~fr)h7Xfb_A7 zv#vK*jPNN-dq`+>`oYI=lQ?qIxC<_du#2!N>SuT)!YbQ0V^u>$|2ww0P-3$bFvF=s zv<*o`f2#Sck8u<(LCjBtgmcSR(V*#MUE9|!1E6TB4asZ_K)=iqn40;&m?z?;sds!{ z>Ajm$>ZR9ueNBwM1)5HI9ye&NY6%A+d<))*7~5m*b^rEOT4&>7zM)uk1s}O^CWIHW z(vxh9m@st&ZHMGJhRsO|M;cLvB11A?ApIlylse-B-T+_w#Vf}f0pG|OIC{x!CU`&- z-kc`jQs7b3#GyRQc+DdH^4+~f-aDL4{7;cTnJr$$S-H~G;>~JhRc@{yB~O!LA#&vi z4oeE7Ut+7qCjjddy8PUn+b%P|sarMe!V?#4snHA}z5}^HJQ%Qa{LuWtYNqxHi<3AX zWTN}-<350k{*LV&oXK(gUW()ye#Z2Wk0GwP7_K|Safo~v$O>OCYAyfpM>&j*8kLoK zc0`$1GU!qiuy*G%Ymu%?M#*|R&uQtT@J`&t_mF@ATjdp!{F%f9DXCa(qy^x#?y3*; z!Z@`3{mPEW-z)m*>rJSjYG}}4?i8Fl!)368WiTfew5|d(F}mft$*=Na2=8U zG^{wvwXkCDw}>P+bqY~x=88S|82k1Zp=JbS1XNFU)WYHygmc((42v`>{e1;<&|`Yy zg-*_^yIbL0Pzp2LQ~A)20{SQ?-gW<#AIyOQI0^Sr0ymmC{E+?^c2|`OVIQ!z)-{v` z`bZ5|oOT3ugeP9&qr-9f7A5?xpAiij{qu$D(=ii^<-;9d5=A=p{8Vwb99f^;@WEoe z6f?KOuewVeMam_wc7KsfOTJ=mNVT1WBZSvaJf8KRuhS$4%A399CiAr}W;? zK?2c6pBx9GNX&1hD#s@tF!@K!7K^fEc*`eYQ4sU*fAxF`&Yf$`h=*0aKi(Pk;*Z_- zN%M(0jI4)T+4PUDF?riOJWzf>Z0Bm!(;5F?ohOSw;aoinyipL`HS)L6`Ljd-_2#{0p0vDu;2)7)AipPNOnQyO)@{Z{kRK>4h zx!rjoBE2fnJV5U9{-$agR#RmHM5eCq^Es}cv~8R*oUUE&j;yRLd%hZ21fJ$nTKGbq z>SsKTbgku5V?w`PA0Pj-g-fDZYFP-S{%G~?#gm=j^%4Rh#>db?l`KjO1p(&ig?yZ? z7x=iBI5e>+ec#syBzAztMA3iGPwE@N5tb*h89J2!hB5=79MN_VY$xL%4?g+Tx*u7u zWFs8ca5rr+L+h@^hxBbKZkzPFZ1AO$v0n_ZPo-8P$sY#&*q`U2PSFS4&BwcjeltXB zPbHP1izaXZtoBmxO{K8w3snXe766x%!leuuGLHGE&vj(ZTRu={>W-uJvZ;?pzi0^g)*9OKiMcIUgw&ZT6^+8feaqJE)&$!)O%>mf2s;l}Qa|||}sq-2T zSFw3wEfvXNQC8&_{a<5BbNGvGqPNHGPzvs{cM$;*5x+GN~DAA{XLmW#$@>7pjgxhh9Uwyg*B^r+;2f*~f1;ICQv82AKG z=b!F4jaltnDYDIq`Gm`Kz(PB+cYPaZC#vu8D%Wift<%0ifSS0#B$gwvFE)lVa)KlG z^}YOcCvrd_HJh1XP3@?q8kiMQN!Z3}YDUS_1-Fpsj@H6fTkkNW`29_3nSoDaWbYE` z{11<@+qzusF-N&rwr!MiM+#ZZyZ|#Cct6DUt&Xym|E=m(WrT053_D!mN7GJxHP88` zkCRh62w5H(y+Z3KtjEUgTR4z^vD9*(CUa>sQ=pZ~fnp#@7BM-pHJH&3j>F5atP+c6 zxyleJ!!7&?1RgX#GiIM*2o3-PC`;*hL%fRPN}@gICAKsDC_ z_SqLgwb3krOg~5MP$QJ7S6`PJw%Xk=9r29s0o)pSeF=T+)b|;Jb7`z;FONSz^*eV; zo`*`QtReb;eaKB$CulctVedXL}FZh4#DxZX@C{s0dX3ur(TRiPVfMS zF@z88LFrgN8++ldmsG`;-0p7ZxC3M(2!vYbQ!U+-b&up;r-p)xAvgz{`Pz(nyW<$p zO{$|cU___S0lp;LqKZVAXU9VF`|2@R^btU=1n9cAz2Y>H8$|Do*FsIx21Wv_#ksa* z6F{uV?2XsW7LW|W0*X@JMx=e1*PZ6z6}`4zYj!hAu2kedY*ruv>QYPTGOZ&5A@&E3 zEY&sw5)pOoC3hD^wT^QJPDZ z|3s`MWVB?%a@PLdG<2LkU8%r$yXfKcHND&KU6(u~h z2bx@&PElZG&75X@&?jiqRqUpmcTJ+W=IHybhav!wXQ!Yhf~rl}+lH^lg?;3D zKFd+0xkbih?*Afcjxjt*v&Imqc!UOgwZyDFO6THpc{w=|OIx~)h-tZzmDzBV|gI>tA|QC*w$ zcsLGMtM2KClEE%lo!&P3CX$xn4Sa8%ssO}&yhta&8WGF)JTNfrhc&_;Zsdfrs zSu%OgBLWh@(G~B}^U&OvS=e?O4CU1O@LDIax-Ye(FKK#fwKuA%<4PI8wtplc4iUr(_8 zN7?f~o?g-jaSl7xouE7hH1zBorKjgCNE=#(slO7sn=1##JneR0&~xA|ggL{U7sa2g z@|JT;r!W9e!z#W%1avw&Mdm2z`Ok1~N37~zmYeal8gMM)?KjHs$-^fRow@kqO{JZlt*@p;}v{Om=Atj7L z`!ED4X{QNcNR$mXrF4wwBm9pJt{4WGoM0z27;b!#K5NZW}0gK^7K?u7K6vesGac8!o|sPAH3 zi>#0jpl)jh0*TiR0SUkSePJsBg)KIpSKw>Jjg80k+aF&*>ZW$?z{asbu|3ZgB-HSc zQqmU$Vb;PchJRr`iv8M4FZ-eIrR|s)BA=T)$HI{E8#737UD+ueg$T<(t6ycrg9VZi z-QAo}%FmHV!{9XGPG8QkDPnov{oj9B03jrDPhr2Bt#7@lPSJ6h96Vv^E6zimIKz$r(b4?qz zNsEVf4RoKU=lLA@N;y=eKRfYZg^S&-qks-2?XLG8lde=9>%0~lkI)cudw2jDxe(FW zqkPJ$8VRq<=*G%rH**+123+pL;@Sr!W4FGjMDBzx3P5;ynY}|*jQimT`H>h%6$6-H z6Z9zN{B!U9)5ZT67lInjSIx3RTpIl0%)dI;M*1q2_DX4E<5h!tiwBMZBvo3BBaZ1* zzUU44Waivn#VY{%BK>LQhAgy~nfyWT4d(a2TCGkOoDVzFXK->2qbR*jAJA}c)EET~ zKR$cg@j`XvgqzifoJg6cMJN65mW9Y`*)Uu8h|*9|oRNBUJS87{ZR$CZa5+$(e2C*j z(m~4Oz1rb<{3^WPTwVG$u z;5mzn>q$F_Lo&M2II-NK!S0fVC<%ax+35@9*P&v?+j89wDP>#ii%lN_DeCvv*W5C1 z3WbAs$5ms^cP#-%9VfK{`CF-7Ov!!S`v}wh+n>?kk_~(m-q!=9`?wXc$vg@HcH;SQ zc#nubLX}Sk?fwFKqlu^0Q~x75jIGr*+=m_{I|k#X9&I$!c%p_~LEoC#AfkP976DtP zwp^$Wljt6MWs4+4Fz1WU?b4N@<$a!=1fA_t>ETStH6_`vaF6*?y(yFvNpn!7Nb-?V z3YvXEXc)(Qi)HB!%WYAnOb4))wjJ{b!*3ZMJ8n~FG~mSeKA^ocURzN1e>qJ+Eoz&x zao5k+TqLkDaELMDza*dbjy)`CuiOf>UeYX7R)3J-kYQUId4V%D&tq~Q^h_nO`0 zvc=N=kpkc*@%24Q;1TAn0i7D92cS`Ed`=m40B{?k_Z=4hErdRaPMfCk5Xo1?aytL1*F#A{J8bsb2cBd_5?EN)8^ar z#(5EhCYOygFVK>~_2l9&bJPY4E75%Qx4)WP01i7BvHKyFAMNpVgeT#Xtfln*y z^8%%4kJzYVd3YfRC{-(FVZ)Xfnj-@?7X$?-7V?wBh1w_b%g&+3f`E@5I@&eEONc0fG_Orc?#hVBhJ5 zy^tT-0%Mzth;n3|K*K~DI=vh-u|Aa;VfQU?E=c>^rfl2JRg5~?X019xd|PGhKKF+# z@*jTr2s8~bQgBDuwk`NBYd>mzM+yT z3&8e+3Fs!_o#TIH*xr`z>T_WKt?HtYR<;?kwIx15;|*^IunJ`j3eXT%dVHOeb{By1 zDZe&Y^LPL`5M#4Pzv-))5KW6j@~jh-!aD`|wZ?3>qNDG{HQoW@kr@)A?mA*$1EUlr$S}j3 zL0ogxWVMOQBk2@Zh}|(y`QoXj7O&{`*U85e!1Bcd|8ALuHzwr#z4K`jST&^=C&{k> z4PIJV>bCAXKaBx}MoD*;DE(UL9Q!zNe(#bi^=9zm8^^z~4y_20r^KlU@ZKjglfv({ zfsBT{8WqO}tv8j60#$CO?tei)s%bDsu|*%!PnHIy#HbW2=iWt=?rK*U8S3FeEdmLU z`UKzA_pVg9{SXzU+gZb9$B#Yx=Og||3cu(!ie75aP|jJbhx&$E)%1z3f74>ryQ)Zs z22maHISwQ$kpG;yppx^gBWCtnLph}3Q8#Ybi9xK&j45S|mlcRdA?xs}?N%2lo8{ zBH)v8h3WXT8J|>;Cjj};@yj+P+&_UWVqu#Ub_;5|vqjdih3)D3*Ot=fUtnzUnSWP> z4W=SW`vV2F6EN)b!Dg6GG#_Uv{_xUR!XEBGR&V60j3pOiM=+}I_(&>cWxTv0o66pe zIo?zB?jwPrqXsN4m!EheYCsZ7y&EZt;{PTKtQ|pYd)mfdPnQ2MPI?Ti7dCxwOIaZ8 z=A%=;Ea{>3*fmq_`h#s3E&)Mfd@n7Hf_ThVR8NAdcB1Q-&2%P3LlLRA1n0%%8CSqT zSIpj7Z=HSmsn5|-MLV!HjXn?2Pc2iQNFOO1a>+q_N0C)MKtHdS3;|J?>$64WN(Wmo z9tWusr|g(=ia;A4A-GfLC3C~@GdS^oER6rX*~uP3arK%uOPW*pVQpTe;`H*jf#eP@ zE9SuJ$$LNN-(70i3Z_$$NM*tSC-n6$IFS?lS-Yr_&T+T8bhTa3%}^>{wg`i1bz+bz z0sO4(;7KtdIdQQAck%obE)^Z4mfY_)+E*jtB^d|Z-d3CKYm5aN*uIOaO)h~ku2&Vn zPQ_Wv)Cj)>KPh)Yue%1Plo?fku3C?dfrR)z+b=X-jn{GAZkP+x$Rvx=?k4w1clWem zWBk?dyKl2OXTS4ehF^vDXnf~!?t}~hlH2#=4(^>?x4}^2j zEscRryQ?Kuw{#cJ^hVwei>A>OC#tqrYMJk$BU=qpmi$o7T2KTI=?khud~<@xyibga z-;ydaPUy}GL={souDSUk2FuZ^lt9oLfg`q@!ib&G?K{%OLt8v1^tjXh#5fA7YFTw? zC8zIh(tVQaw$H=+hK{NfUkLW7H$Y)1jVqfx74B2W@~dJ-UDCL^D5B8ON-ew46see3 z;ngK%;q?hZajMxAf_4}mTl~h#Q@-jE_AUe)PyG9Mio1zFRA9w+c_tZpY22f0}L;(!$)Ib&x<{akX@`=z4g>V?fCC$#O9)(UuMsAzUc`q15 zLDdBUz|(N60D_R+^@WlVX>&UZJfOYbxRxB}kb5O*K`9VR*!-TvAN^3=VbYvp@)D zN_`C>K~JSay$r(YO()v&OCpBzo28-0Qz2R+iED;=8^);LbGMLt7fFT4XbNa@pK?(2 z+o%Zrg%rgG8{L7l)-H^hck{lT#;UK)ze*H?OJ(%?1F zyErxzlVlQAOy*frZr1}}e^2=3Y_M>^=8NH%5y#(8xaZ~5ZlqNZ8yoN|gGT91A&g}! z>C;>SCyx2Npe2C7{b<|CuW3!psE2YV=&3T#`-7)44FCr?AWC2A@NFslW61g+G2Hr95%*R8Ox^Hd$!1lsKO}8q=VhQAB5tW4 z9y#Hn9S+SmQ@mXuja5x3T$#|39KpM*2+mqJ%W1i;&t{Y;beFQQ_5o3Z4U>f*Bx#bs zD3j6hoEz8r+ueCK2!+!T!ai=X$fSKCu(5eCf9mcIpeLL3HfzV@pg$g+0?6V#9!}VJ zdGibx7MScGkGv+Nk+! z1pppot*HEX7Z%4hhhTjZ7u{mkhxQ!%`74%ZYen{D)HgdGS+MHHT-d0zCj5_eW<m*)~TGyzO{!{MuwFdggm!*jLuLM~zPHTyrsjgrjQs_xMgZn8Ye zZIxqk67#7979H*S@MHlF%pp{JYH^?Yr_WLm%u$C&$Ts9ytxm$kdu_hS?|GSoT4 zk&W7y5Vt}I+{!IDMP>c~Bsk{}d398+2@SRIUBa~tEl*ccAk*qu09Ds`!=8C~4^c={ z7fq01j+DHQ&7qMfe5n$?URHKT>uLQ;>+#urQ9_GU3nGcd$EV`A?kr6<$1V?0dU$dN z>kP2~x_LoIs3lrG?0}oKSE7C~BG~NJ5g-TU6A2o7v7}_zC0d1xrjB)VZWxxazj!et z7BVc@2vC={CA7{@qkO+43|pSRohAK>Fv1EiPiIeW`<*kGvu3W}jG}&2qVkB!ti8*s zPs!W7s;6p!6~cVyq1hIq#b_3&zHy;dIZE~HZ%(+s*=rjBNJsl?%e#VpVT5S|g0MRP zk|wie-T7tF<3NJfr4=huw_8o845FIIvl1LY&9#F(d)8FFz)yVftQ{7Msla=hm63Pw zMSW(42@mW>7LK+_q=2_Y3^1qrt$*ClCtpr0av(u3#iGcm)am8)X z>ix`iYU~xy3cR)Ed)8|_YZ8_rYdIa1QXh3>`8Wt3kRQFLO3>AX7&mQ)~3NPvz^dT)=ec`G()qU?m`+cS&c&hLr z3|_#Q%=$!-UK&FwrG`J$qnI07P;u%Bn3R+XBlC^{-{Q9;VSq?^1~@$4+;()K2w`B; z;M02bU;V3p0RS1yw6_PUr}|XZ4uNAPS}49b6NJ{|3_J_!!Ib>``%9rR+h9hr(vR!T zgd8=mCz6!K=H-VC4BZ>C4A%ak#7`jS^+Fg$@+)#h#bD#Yo-0C?{oRAno%$8Id$Ww_=XLaqm%t4dBh1+CwF-0W7zJ z?{R_PR{ntx;rXP9Kx~Ow%mL81LCU+50qF4{DFbks2Ru`z^!FI_XUW5|MyWCZZC3E* zuosR?cx`mf+eAs62Gmh6kS`!5OyrGi0u-J?^JR1ypic7ZeEFZF-^Fol4Y%vw4a3o2 zk>p6dD!WKP)d|ADt4?G_Ei$-<0$GCg3}7=O4{WTePkp18Y1NdZv6D9vR`@?ug>&}H zZnfCU$7!PF@m0P+2`&y@Hbs;RjilKL>$apnP;5_$?D*aT3TO<|&%toJHh+0(P{Q($sqZ*X&bdlkV(Dg}7Mtx{v{ zt{binxd3+c#%acFrB0doMFtiLEGO$3%^96jg5Iys>zk@I?MoNMEkrW2HS?}x1cVCs z`%=L*l<$W=09F{5^C7@I8h+>|Rlo|Q%W0x%asmgdgjiK(K?tSwc2(G88>we)(wxK1 z-+y6wUF}2aKY+UbURVMqN;^cy<~v@(yq0UaI%Y^XLX=8%{@Zq^jP(**^S54-VHyNe za!ebn>5uCyJCcdPn!KFbJB~PnL(h287C;^#2$G1XBX*pUF?~rEAc*okHR_F9S~PiF z(Uvg0JaP=>>;$ul0M^_^^YTUWI+BGg_TS*J%v8y9WcDj(%XHb}?%5xhU#1J^K>PJ#y zrq5*#xlJ_9eHdh)S3@-6gvz7N{XjO5Az)N$TjVcFp%1?AFDo+@x>xc(a#8KmOMYcZ z7{EGJeF5Kc@f;wS9tS#QdvstE4DL4J3pyd+dJza1NF@_%L#JsA}LT$X~9jXR3f0}L-UMm6aLq;-ItdiE_oGQn4m-gf0pQ5h+ z&mQhb3k<9g_l1aa$5-`u7p<;MXAU_0??=?7xyaqS9;oT8as;aEQXl-Ca7@-djitU# zc=2`Y3E*T2qTH5A8kU)@W!}pk7g+bNj^gR^%^EpBJib-&+$yBj$Y-{ zyj&auAI#<;IHUesGg3mD@li?F1DxjlUw9VEXizHW_4Bc|GV~S_rM%wAiU8>*E?GDc z6(_#)r~u^J%8y*=r+fL){U=PL=KW0XQ7=`jmupl*81pe-wHC>03uTTJaiID=#UJWv zrq?!R`Hovcbq^8^9Grc0UYA1f5Bc;SFYe=lTs2_WlE3}WW|D$1k!yDn-yZu>n^ML< zIOvt^w{chWCv(;gbgRFsHU;vikRYw7(2Cv8YM!S!s`sQZQlTXb59X&?&hc*L!Oa6X zRfJtsqk{VgoQ88Qxp7?Vx|N-|pW@#DaStIw91Ke7o)v&yh~DoAd(j^l2p2fBL52ap zp2AchrUDDo=I z`+iXRn8@)FoewhMc(Y@Y{&*9e)Dp>_a#)ZhI6a3JE6cL>FL2@i_#THviif4sIvmw6 zF4dm=6qMuDpBV_?QE_6fXD8k5Gi}2xl20fUyeF*GbqzH^ABb3VxsF$)!U2qh+MBfl zz}9BC^~D(KuumM2?I56cGEha)9VZy}sq|jG@kz!6Th5$1Juh>cSaRhXttgeUbH%a^ zXGK0R=*{dJ`b8CVgKJHlj_-5I?Ah0K2$;w|Mwxpsj_0|xwE!rrH%Yyi6i!a&J$iDV8!-{B2V~T%9z^KAh`h_C}N!phG}+Vw za%%Cu%kM+oCoNg|Kcjm;1yPQsuMALWXO1n~r4|>Kc(vw;cIPb559!IWo<{jFZDlF- z3ovvum%PDUSHDft6*m$W=G8On?UuHj2055(qdhNhb(Z-Eq8nz;u}2?+lf&A zlNh#_nS-K<>{j=r-6JdExYvS)9`~Wsgj{^83nAirzD{4PX!B)=t^b(BzL9kS=2i6O z-os8>_9Zg0T&Bs6rZt}gwR1cA_JV>EAGGRRe1#~ac2mZp-Ns^dQC_d?=3MIoyUQ}q zywTpwLR%%5xFZYO^=pHF=n@^Yo#|5o`{_U9*4%_Dq68{MKpa(QH(YctOTiK^c7-rr zkVSaD3@ZlaO{YrV?j(D!)=^w*IB;~U%w(zy`U*^sUmj~y>k%ct1m}& zvWk=8aK|uo%dxHE^HPM|tsjv+%b}RSC~BG=Fy;@I3)gp%hYi80)#AzQ92>*DWTBQ* z!g&T_H&`-nz`K=kxo*wwV-NO*$I+Zs?D{v}b?w|wxAzeioK}W6z~EOotmhdba8lL{ ztI>`T6Wi7*Nq_dKKNw&3HFj}ve4{)FQj+ah2{)nQVl<-&{i&_?P3cDEjXM@9II2g* zYAkh^Kf4jH>lWEKes&=LXQQAep>ZN0r{@4=u;OBgR$+4#NE-CD^iKqdCf=j8Uu;sx zYWsWi_b-NMQKrTnEuMK}13j=mNWX5JMM8X7m#|tSla0mFj_vR8@OX6moCbh_#}DZK z1qJk59$BZNGs$q)wgIGwKa}3o+YqQ?8d-EPni7T)0|e|GbVyw~lWP)1T(? z-H=)KG8X0p2Zx0m(;?7if%Z93%vmL&CJ<$#Ci!pysh|LC$gaE)JpU1ewEro}Yc`u{ zKLAn9$uSf(h|4v?fQ}gm*`IK%ju3K#)a4--N5orOf6MguLHwRMps-dv^MpQErB3n@ zqFS+dSKHL?PE;+s0p-=>@C~p1=yFUNnxI{~h1^9{sId{Ez`M8go8l9#zLvR5ql#QZ zxpTcr?7TO>Gm$fsqi?%G$I|HSU&sUzdr#}*$zvhqAL5uXgaD)W2DmE$(SK$5q9z+8 z`v;M8$g6VV?}%4CX3hruv7wbqB(xG+&rp5o2?p3}{SKiaMZ=i!HjBWzt)a)xvr8QL z22qVZuwUsXUb&~T`9ad8KV56xD+i0#2XXP^ zM5rhF5j%2Jm9ng-c^SP>mdc8p*sCT)d%9y^GUjB)79fy8@#paUCEvj>Y9V#*&?fxi^hkm=L&4uEv^gG;lYuhh^d(YDmUgb}}p_IZ2bLoMH@-KShv zn}MCDPPI^B3^ww)kcsqa2?Dh-V=1lBUy4E{gpi6N6L|6|FxC!gG}%|$!p}bBm8A=N zevZ==EulE2pjy_Io2{&1J3=`n*oaqR*)$Ns zCtkVm=@@)&FlytJ65BQU5pFm9{kM=&mWa*aN;(MaNsluD%&(%TO?sl^FriC;OppK} ziZ%$Z7R4_bd+V3^CQZBHqU&PAD5_r7dpCulz3Gia$9b2cibOYyJ$aCEA9BTk&@r8H zqEGxQsV1T4Y+)e8Yxv!Fa%I(rO)+6PV^QCStKPFhp9N4L*G6cp3yyb26VuTHV8Z+1 zsdVha0FDw+n#Ug|FCF9O7eZE-B~c}nq?XABpsWB;YfluGn;F8aRY|si4V|I}Qn-Tu z9EKE+DL`sY>93d0hDG(bx+r2#PYYlhu(75->;nP5N3o5AcW+Z|&OsjAo_K3wtVZCy zD7)HR)XWFk|4;|~r%UBuzr@A9h}jW+4(S5B)1KX-cY^U-xBZ-~WoPA@ z1~f358728Qx;bi9J~h*X7;2EU0x!#5`fMeqvw|(7-LgrKWJzTJoNS9boqy1)U*WV$ z>ovl$c&?0vPPn1HG2({GHtx}OAT}}^J5D#s;;e_f@hMddC5acvZp#;~GrdcbFHK2e zy0vpA24iaUv&>hGXK`BIVnWvm;K&b_uJ}F9KKzurEm!fsN6#H8t?^cP80fE?^qEbn zT7;!>St?XdHH5g@7%ip zkm%GQM3JcjZA|#urf0t*K#&3uW>RUeO<0D6W#zp@y0ZAl{|)q7PP62Tw4d7*QCsEj!gKc2@W>;n?3>I-#Da zE|hlsT7Vrf8z`1Ak`z#n+p(cKb-ejcIkUD0O`(9evN#mqkOLP~6i8aV1Sd-T+_ zb!dJ*hdJ=0NpE0ZC#b<$qUc>`@+&-;eSx!$C(HYQ{!TH0ZJ6#x8)t=Ah;R?eUGOZN z`03fp5JF@T-hUr9^ytekkC46dR5 zXHhdIliV?TBVJ4(b7fufjD=A{RJwCNNwCksaDI+;&{r%t?#MNuSQN!Z^na}zNAhF8 z?Pi&_Eg$>>-aEE+wamb~i#_LNX=041BexvE9G1So^ zzG+WiU7PryFZF+0rv(V&px6s`;zS`$3lc>~>|`Oa5!yq7kmSf$j|d6l(`a%$R`Eqz z%8-@6V_y*Hm0}*Ivrps2+yTn+pZrE4nKQni$qJNbWl%V+0*-8Eu5P7#m<&W&rdR$H zCkTT;)+;@R&J@ur+BH9H?5h-oC1}Faex^W4z9Y%aZipsCN;|WMV*K25Je41D4^`RJ zd?045&Oj=L=UK~bG}~+h4|j4^AZH}Nnn#5hCR)VBW-Qp;0F)%*56gyUid(ducWKTl ziHl`#=K%d`(`1Oj@@=bVU?a%5XH!d^4L&NCqvP-A2B%F)*$$&%6FybmyFVYt-%*BL zM5g-cG*MQN)-9S42?sBwb4gn!Ri46D0n$L7& zMzVA2nj{Pc_^91v^b`RXE6LB65^$0+#N7oJyjBCaD5S{{HlcN^)AESxme#+|&QO}; zVT8i&$06S$DT*BJoS5jmsdX&B7?Sb{hN_CLMNfI+T zd11u!g*J9zW3c6Uhj#`J|X^EfBfv;pQ&)%qiG;|joB1sO7=Cv003azWyJICmny9K-`T+_BevZ|;c#RG}Ve!aqI2aRNj< z;;v7VnTGss*1=95cc>}*w=2&69rI2kAsrL-j63eIE3v2kwL7XOsmpr~u{&gs0b1KN z@6#JPyN#W*y8)^u{|7O#&;GDj4}m-F4R430$3m*VeN>q+^xIpYzQ5f{(^K!-IIi*S z`Fy)gG4b?epa$l;f=5E%@%MI&!Wnu*1sjJZX(quQJkACh*gVKKU|jFt!hA=fNj)2d zOa@-E@!C-M&C2mXi^W_ZM*3S%pR{>{shVJZ5XB|*2jl-ny;d$7#d~PBU#Z_+yAfo1d@z;sc1m<)Tr3mCWs=Li zM3k*kUWsXKjQkM#x6*hgns0q@49y(-O@(6ds_>BzTe8o^A^jmES=NlRuXzt`41aF@ z7}p|hj%aq$u)La~FBHMqxw_dcGhpm;Lindh%x4dKAH<55(DIvzin0>kUuV4`W8T0c z$zXw`Wh zdCHhko+i7j9i6GX%NFvp>?#?|Hf-Ih!-*9b|G6!dq)mWSBUBQJ1~>EabD;gGFpLKB zT_jWmfSQ`q*if4>vj-e}?~jw8D2qcwIR85W&9cj*(RAu=I7sK;K{)EuLYO^vKb)Lq zfz)aJ`y8DeHK^3jbys1-N*oXeGc)$zsdv|T7?Qq>v5Q1XHQxNc5vCuMgW9O#4&N$K zzuC{;Q%1~f0wO3%e=-UBx!;^Dg>#rD_|eM5n>m~USikXWMK;`|x2!JVqgAd3FHPGW zhvQ#Iry*x|;B9&}D0WOE!_7o=?<2^aClSU#-H4Dw34VO1S=XTE~o*o=mv7U|`S2v!n4bR$*|7MVR zue+Tgi?!ZkO>CSz-BdjNOcU^odR*~r`LS*P;YR8jTD+L~L$WJpK zAuaMkTMrZd(2i9O4MV?+j#cBQd$+Su=bp6Wg_f7A8OPWY9|*FZPkRL4&hRO4<$ zmbtoj#{2XZAt{Ov|G`fDrz8CT%muSUu}viA_DB2s*KXHWIE`mjQE?b6f9u~4Y4cA6 z+Gc*W)*=I}4ueLaqh^!&c*xS^()>!KvQBcaVnVrC>PK`OEzOMbEj;+Oe+85%C|mE( z_9uS^HnPnCf~j}&>VWpH>Oj0>({=z9`2dWtS=FvBiR}=SM}u5tw`4nYV!li(IPIwX zYHpDkVi8CXRbgWEw0IpCv712`lXw0s=_j%`YuL*uR!jxJoDM72UCXk)(kq)a;VbV* zH_c9zl5sT0qo-xJ23m6ce=7>QS&beY)|3tD;8c&=wLXYNi4XP{LeEj5w_rb=iLTUI zm{y{YaeL~Q*yuXZT(P5w*e`F>7}wKc=`w1YPwmp@8jN97B3`vEn;~Sl$TP&AJ3C&= zZ7?82k~xyndlML*yF9BZbNS7l(d%c{Vvi|JtoxRBz?A+B7^0)%?(d2?HjOi&r3V7u ziVuqCCdt_0#+k2(qZ%XO9)@1BAkf};+8rhcri3E!N*lUMXJR(9|D%l#M~NaAm=<~} zQM8_i9ML@l4w?fRySfUAh2X;J*P)%g;dnypZ;TjrVOecLa4os*;0~B&8_p6v5D#+l zW#sJJSG14Va1AKL=5~p|U&?s%3EH6Zqp=|JhHBM}!Z@ zCrv0Ju5F38q;})07PtQtH9ofKw8!T%o|00t3f^#|;J-~d<*VQxaoijAdB+#T+{tvZ zst4L0e;eiSS1a432_ISx7R1tGzb>u!I$&^J`)YiYyKBt1x&Qd6U36?1J+si1K<3a0 znu9vG$Dkc(O{R{&)|keN^C*HptL;#aGZer#jN}D!z^m_1D%zK?T$R=uA$=TvQ%~nuut^6X z^U9Izm(zk-WW7iE>6Z^Hb7sdWz30uUHNcaVlc%k_Y~a{Nuxu;^2AzCc;F0pr^C7xl zNBn&~<>tIFo+0F-tPT1oAu)z_H>1&FxC^AkVV#ikCSfkiJg~^EQz@1k9JBUz zB2u+=2g6xPtA3*i-;^&Gux+O~W01o%T2(;VAVY7BCyj`qYwf*4ndQy`KCQAZ;1IFJ zvr`dW%SF%J-9e&g4>Qqa@=2RLq23)Tn#%&&`G&->LimR=g%LCTUEunG#K0~^8jS6r zK*HWOg-hb+HJy)NV{Q#Qi13B7Fu;V9;BdiP)#6?8N2&}M({7VQgKE!7v3+)V)s#T- z=huQszmCyrM=M+7_YBnH7J+F`D>83^76MZ6M}IA4nGW+cfOoup59q8F_lK7J`fpzy zc#rY*G7rBMxR{$1VMtVLP)Rj(ds;OXn@M-LslEDB0qCVBYEPA$EB)p48?Uw(+|uvu zXx(1vHz8gz6fI!Sdl+&TAzvmu@aYD79g>FfE9&o48@kOqH!d$Y8&%};28@>#Kr@OA zmplCZ9of@#%CO2AESPK8bA<+Gf^9J&qWxZrIOW9Qu^U z=+tp!Q>$Xae=l#wXwhvYx1uW&cuw;|%~CDxE@W=5~HGheFSo;{hY2SBG2lZMCBmg06!=S!0ftyb2&^)gpU=Y`ph; zh6gWwh6Ms@6PH{xb_{Xh(Yn(_yz99&Sw1$S9W((wQ)_l6ARzV(Fn$OyB>Ge6o2Onb zsC~>;e0m3LkWUSN7uh#S%6^bpd4rUjID<4;{*ah!PzS3o*_DRtl-TqH9-MZMDvg_0 z+{>{q2@F?B>SLPN4>SkIfw?a`aVSfz{)peNS`s&$6!zcDZi~MQs0fSoj|8pQ%}qx% ztvdSJRb1LsdK&dt?)v;DFsRtG?dz6ZC34EqFxG+7?ebV6POsxFJyN(Fwfmue7OB6a zEx!NZ=<{U#>v9ubdkuoHvLtrVx!ZiO-o7;ue`kV*!BWfg;vUGkIhRBzQHAuE(09b@c2?%NV58&K#7t}W{H2mxnoWJ z+ChF0KnjBA3+-bEF~5=1N@O4Zjw=oXqF zT?D1~8W54*dj~-SN>vf0_g(@52@nWTP(bN5m`G8ih5!NyB_!O<%$@T;XXc%I?l%Ho z;K$x;ul1~_sNk9x8eHJ*2dOcy>P??76-@oC#?pi4mG>f}X1yDpA<{f)*~xe7`-sl_ zrdsgX+RRpF!0%ZaDvCWwPysu}EVEgkxI9`zah9F+{_A2t$Ks-A;xPFO;PL$tHR3i* zFG$Dv!#Actcnb=6u^c!-zf-x43IkDnc9N3;1&jEZYcYL_VY7l(w_x%WB;Rxu*RKZ# z6Sas16D=GIQTiB+`sV52YWabg9pSOIDfG8Ci_`>wgmGiTx7_kn6u0pmO+0c|3ym{e zee(VKRrA!56~m9&eS+X+kz7O1OKH+P%c_cOM!l?#?d`6Ix1W8FPJs zG|+nOuZEDYF70KGe!fG2!Ifo~rcSz_{rA#vDB>G?BUn~s-pSLsgBc2weqX2O%guJ; z468taHTj6=4@r3RD8JKIeVe?`k*!HgaDh=pDcxr{GVI52{OqWim^<23NfZ|1wY%vk z6SP_CKRBDfEwc=+cyI97dtvjrD)SdlvkHb2XAlZ!$YpECVZRN(<&(#eBE-Lr%1+ee zU10n?=dJr(v~SijzaSrVrb{e~ERW4tpz8Za^kLAi4b5D4B_Bd}M+_TA(ALGv(18`YuqzcW48BPAf$n zr{TPnQ zpSDN?2+s;+KQ+IULcBB4f{2YXv_cY)t|GRc+{Y^{orsH>4><^g=f_!!m2?+fYrLd7 z{6ck$Ecsx*v3N~tfmq5;DLGI6pCw}G!oZ(rZUGv1o?Uj}8MVs>sjU8TYhb*EED2Zl z`?j_KpG`v=rvvNj8k-2{jKc}qLaJtGr*u??xU*4ZUFFPExRXF(2^T&GVl{xSK0drK zw|cFeF18Bs8{Ww+>|_7DYb&1n#_{f2`yV8)n!vQeysFRhP=2?lF-oHAV>%NuQq-qa z11IG8eE_6V#e_9bs%0J2uH14Q@3_Sb<18YZ;*9xOCHwNH64{QLpS+U0JE7n@26!0* zAp5myAexJPrZBXm?|C$g*Q`g3W4FeP;sdK9Dhjsh?$c@KPtN}7wCdRxdjDnNi%eyo zWCe-HYtI*0Sw$;mP#{0+*Wn-z;G^ zx1qp8GnX&yul9@A+`}jK(y3?nk7QtW9JSDquX(?k4rWjF z{k8AMom~hk`gYt5ZujqD2y@uE#9o)_9C-`gwfXQM^7DPSe#?dlGqJJ{Nxm$6D`THm z+xGvh%m3%c`{xG|KcgFm*gERLE2btXpqlaIUMRo9H^a?qD6f`}=8~0y&u+x8iNfCH zW^@ii(~a(09)0t>g&3^?<0^kI0#5x$GHvPj58&>r(t1K)^4`MniATFxF$Yne)DJ-}sQ-2-7L#4bf#GF z>o)5HanE0$H&TolHx|kw4k9Czh?^k)I7rf=@Pidol|~x*jGyj<^uy5nlT4Wc*SJjC zE1P3P9KM~3F>1b6+FQoyai@JJvO~}qHl8Nqvwx9F!xCHuIPKtzYO2kyuGhu zGcK021fJr0w~k>68N@kMb|ITYp`ZV_GU;nOG8D!ECysLi!bDdG*G=@m*zWps=$da#MgkMO^tot70KbpXZLeT7^&c(R(0Qrsm z!cI*6oa+1@Ptd}ZRg1y|dEYu$ITgt%W)88g&0udX>=Zmpu&=~Tkru@rdz6`->`hxi zL>Il_zIq*&2qllMN;(QTBLYW{c(sDmXh7)4{dtm_;oQ0@v;HySNEMI)+Xmh#9XreT z8e0FLa|nF)l?&(;ul_!<$=Q-H>MN_xLDZ#e*6nNAG=0mqE845_4uMGNtUc=s6*8^8 zw)R6&Zlkb9g7Kjpee7NTn&)PPt?0Mbk4Vjz1w6^pr%C!?cQPaUR7-Ne{YT@V53^aO z3Y8C@>KJT#^00gQme+Xk?C$9ylLVxkvRwdnd*jV=m{ZWZ`STt>!^{CQ&1 zm=Q+p_nlB!xhuFl4Bap-Cn+JTS9eL;uJW??mFJm#viry%Cqr7Tx!oNu4S!G=>efL7 zl~pBw{!mj~w2|RtvyiFwZdTHm2BB%-sP};5w53CHYqgXTfh@bor9E&fV+;$$U3}*x zJGx%whp;oa3|)y4i*6IM7}wLH-QgV>z3$yJ6O}_)q+-UuWG$y#XD#h(%=Rw!m=)btxe@sv=)sB0 zuXCS;sSSM@RE!WzuWw7=oN?k0JJc%<#>5lUPc`q@RThsM8h=dAHpqHV`pWH5;`+OB zi;gBa@80)r8d6@r)dcb`H7yyP&T)hdN$1;Yi%wjl0faTm(&D-dqwL~Wf7Xq#wLbcw z4B>iZu-|^sc5@!w(vHKKlN&`Egi{W>(#5|ryo9XDL-z!@s)u4J`!-8%aSS-1 zH#waFob9|Nkj$WSOkj67H~ULrzN@^lfN~OIdlK?%{YZ(Aq6UYG4if*Ag(qHizV zf}P%!a_KJd7k~I(9zyl2>BZl*6VMEptBjVqpE$G zbG}!Z0q`MEb>m!pujWR;_0rR6E6hJJ_;YmqZtvde*7LI8&DgKovy-mE5_S>os5{?h zG=8ntNEiAp=X`GYBCZ9isebR4FtVQOeI5N(rV=V;<@&O)p`>Xk&vEGi1mknQ$?ayq zY;uok#~jDE7EZmyzggf);2o=wh{nTrEq!KSa@bdVG*~&t z=rl^Y?|?$vuPXA%Y8Q4j-dEL{BZy7E-ePgw$eK~QKacY}Iisd8x-q8jtYE2HH-e#Q z!;}X$qlwO#GnVXJD)QCXsPw)HAwx3kv2Gkj8&xwGv(yJr*Q?%+)h3Vay>pV5jz)aE zh}nz2xyXeHJ3p{KEg(IgYpc+W4Qn2xAh{Auk@8J|J_j=_F+X}(nA5C(bI6@5NUA)n zeRw@@8XFRm(2k5-*a~vJgG>}CdFw;SeH|$Lo^s!A0;%D^TlPNXcouOu%nQ_$G|X&B z^%Pq@m%}9;PLW6a^Q4wO6~S$tdHAT&C`FHDSf6mkg-{lV3z}Y)AN5n)h)8x6TJ@~& z&KJ7+WwSuR4pUxcuJl8;Q9iUrW?km%c)LKaJ|!A7SHyy zjebS##(qCiUTtRkZlxW>f4E{~7FbS7V!kyQPNpYN-qR5xG%1xgUVrL6g*)iL-Donz zA#B7FN0zfznMzzK8t`mIRGrM=C1F>ACwR?ZilP4{!{D;bjZocI-YV}PW?s1;G7_T_ z{5jri(h{R{QNA_lK4rJ(I-2%g3w2vA)1`6^n+Q4QhSg(4F*VweqE`DnS z6Seldx?6E#^Lb6mRb!8Mr3=5!zvZ9dH6DalTC-nojH>?amLcixXJjRUKCAR#)~wC# z;@}s7v`@CP(!8Jo4KpD77}*%h;(288ApezpBzCJwq;}|hL3dHsbfwEB-%U_%-WU(5 zNLEI{C*Z93(TFa!P%MF_E*2c9Z6rCz!YR?yytAHWpY3_Nnp8GsI+1GfE#Fq3eOS<9 z8u&JznkZR_^fS&dk#vaS7F~SMcg^kQD5m6z1HO9cKC2d(U{r zo!2)j!g4o555^$HeInAp#Lq43|k{leY1#YBl z(4w^fdQO|lNvqz`_lI3AU)3NPa&H)VH^Zi^${z8*PwpY3IQqBBdVlA%llu*yX7`Wy zBWx|YTj)6Tsc3r1Wt}nxAx!dauc0ocx)gK8#%*rAW1{3XoxV)^DT~@|)2@?Cv*D!t zzBraYRj5B)Fm}T(jy(G1u;i(wRO;}|N?hytpkS9YTDZKKx7%-||MyYuKH68A{{$)l z8o@g7TyCLgj0pENIdf|aJV@Oj>_TFst*T!A-a&r@p7jug8b~j)ac@l6986hd% zJmWNW{Ds@`PMiyBx#|-e#r@Y-hYr~9>Vvsz#+H<4E*^Dbz-O)#o?h zG)}+k!ZkVuqaK=gIW6ERT!(Nh&4~1}P!uxbYe!)ehdtm3ffpKwtp&^`Bk?!TrRwZm z_l4DVc|QHt7Obww5H8?*IQW4C9fYTi`zrAxw(7%DlAmM7oQ(Cm)dm%V;h z-m}_9x&wGn#oh6Mc0IVF=b7x}G-CyRb8jL((GG}=n6;JhM{DST)a^U^!ISF5KlKBA^5bSzAlOXk@r>J z1#UN4ohQm);AIgTe_4~&D;)m!0x^sF?xt>EgZFiX+V zkz+FM9dgvGm098IzrR{MPbS-YRwe1$-(J3_3aq9I5@P888~(i3_mEhuJF!;jJt2Kz zM19paL@)je%f&zQlEIT?&WPPSgNA2eiGSW7&T__iO^Z^Kx#aXGrp%_CZ#SBESj|t;2|aN)Tl(d) z_nTL_Y0RJV#30*#ZL5i}r{*>%sTIv1L~!oU zqjBRbt65K~pN@F_lI$?qYxrra@$7F`bY&+NR9}92emq)>2z(&5_in(9ud}A!bf3Iu zENavRT5tnVJnJT>3mJb6oPT{XLTvh6bLt^%`Uf>@p5jGBw zbCTzg4HAo13gP9SuE>o1`YWTZt)tK{FMD!X;Cr|CI7+dT>Qs@eJh<0{@-?$+PvHD! zE%!+GIAdH?Ry2fZ^ilI9I%4|3AW+LlaT@U&;5;5|RiY1tr#z$HMZ3C>9vk-b)>G*W zt1z;)#2D|rD=%VBQCE^QZH#HHcyy1Cty6l@>reBdB8&CBXL}sY^N;+$?^*v2kV#`e zQ)CgusXLwB!Ju${ysprdqaN+Hc*5tB-Be%dP&u#c<9*a)a~fat*gfa)b^E%deTfXa zcIs?vK)~pf#)t5bK$}o(MGnn8c&&sSK8D#ziAUetsCHCBjqs`$tXH+okt1Vf97-ORJ^&mIH#kDlRRhTC{NeaR7I zSGQ+jJ?In3B2+=BTdu&zE{1jUtl~2 z_2@9XAZ%vvmbad5d~M9!y{UZ8SKmQJS;%azjp1T@q%g!+|JfspJn8ZR3g17Lwf7rl z@bgX_0HWyKd9)FEn(+cyQ%ru*opJ@+=?nJH)MzgSH{-Llmhjp9hipMA?5n=4wvIL> zoi?Rz3pNAlGzcC#wXAZ*8S=yv&gB>o&zCag-gy|SgE393T{?q&Rr*=Uy%6x zRwrS8e!6WW3u{N~PQizAgK~Y-1hDm!X=pG@F+y0Rjc=8FM9KzJKBK!pZzsh0z#5M@ zLzOzRQCE_+IrRmRq`OqI!G)M{C(YDr>HKeH{6Dq^|5`G387r{V`pNc4PyHD@IL2pG zE@LYw1#xe}&UBgQCWVr}WAC|_u1@*a`DS@UYo-niBhuGi+R7c@P7L1_CJt}5O!iY} zqOCZsB$sg{mZc~R>1Ss@(QjY7*p#ocW+`w4hqX`Z7qcQK?RO*4>!+z5``c(Tm)w`I ztXmxs;o?_(LM~xsrsVGZwBroQvb?$+^}%;IcykZ!Je||}rv`RbFMR&~!ppyz1ayoT zfTQmR5LP5ouLblt4d7{wrm*|7Ko0BPv^2RS7t(m0?J}DLsb|I7`YyzMNbpsDhWA0; z`doT|cJ=)ccsb~+-0VI5lDol`Fel6eVT!r>S!+frU@e#b=IqXVj(^k{mC9d?7)Kg} z>E_GeCc}?$yeXcF@Naw1!HJbRa@{bLmWm14Ss$6duULW@fEubz`BoTJ=~bIIY3OtZ z>*zYDv?^LE&U~Zq0ppi`dTA-PeazIgolWG;ecdxXzrMt3QUSI%KNrF+<0teAsHOEI z9M1D;omyV;*TGB%%*5Y6a)#z;*tRb&E)GtDq`e_>b);3MEMGy8bUrdhiNCGwR%8@e z-XF=b$Mo8Qs6M_sr_Hw!?rQ(Mt%Y^P?|0W({fsN6P?MWqFK6X0Muj3mbGwy^CO-(x z%hLRS9(8$#?Yz=5Bxz6#X;B`ZWAIR*NAqW|Y|tj~9SnO|-(GLw{KJzSCtc}i_=r

`0t1_V(`BA<_Z-{1%7%u zx-att7bF}SL*#I+MvA|ka>9VpediR%c(qa_`2aio3?zc7Y9{6clj zHr?6b+y%{JlE|-brCKYaeDzY+JxLj?F;n&Y?7DWM{(JF%bCUi~qKrZ0Gh&{*!#<+{>(0l8pz%HXO%)axsu`4LLck-VB8nKIP9OqTZe5GY^!mN z`tF`h%ZB;l_LFW!iA&7v#L1KWmbaGKSw`(bQ_1s}>Xc1+**5J-V!`WHSo?yY5mqs& zBUk>5;T2(C|LcSV>&a^y9_u3Crjb2}ZVM1I zjUfvf8?x5Fxu2S*B$$8n(_Fd!fIY-z&`*UBlbe62^%`mha>m2;PJOs;mjV8O3ADu! z(aum@KeaMamIPpNC`lk?b~A{)WDBT0ER`9p&hRq+M(9fZmG8_iIqjBYzBR z!p-_=u8$Bq`p}HAikfL{@_B!$AjIzPjWkLg@VSNGnbz&B0UIps$`v!pZ|Xrft07KK zi^L)ya_`%R13JFTRBNc^OC%-F%y=*VadVz>bVuvdpl4IX3(|Z&Y^2rF^)OPrme8Nh zYwUq=#w$*=wY9b>^&&C8$=4!Jip#=BJ7FWInVjvNu;RAg-kEG|nDu!h_kX2gogAOr znmaUK8UueTD{F3+Y-=u7&@<~)`um>#c9bE$@Ba5byM&~zziTW0?R!OR1L7P(Yefjx zQRK8WuI!qwIZQt%R8$?YxWMsQZ$#7>wtedG(Q@TnPma1j<2K>$ckKJL#HY14iX7>~ z+H~=F)2AG#Bhq`K?PXR%(R0rGPu%7A!~1_$r>&9m8<;zz+58`qE>dUY!+Wwr7BvaCHf}M{`%eBj{jaz6e;(aZ=?JiXlpDGy3z(oN zkUFGByD*&OW|Vl&E-#~xZQWQzMf)3siDy_dA2E=lG&c+8Iteh{C>@Izi&KI*5&JmN zF=5L-@TJBmW@7Q7Z_61?Y)5Z7j|ou$CC?GaE?|Q}1 z{^y+i^Q+6DhhfAbqLWYcTSV+ZptcZhXI6#}WO^t1Xy&d|4A363f(hiZNJP!cT9e{C z?sO&hd-C)@EUpW$ecZM~f_EUnzu&myCQOgCLXp+u^thn$}%0QCuhcH*d$o-3-Bu?A*KvpYeLKxf-7L<$;45h}^4nyH z`h%KEDh*~#P8UH^R1@hv^aYumgbEcHn^tytg?cp9cgLkt6VPS)emo6NxB1I@xc}A( z-oJa}49XNhtKfQ&b)h+AT_**yzng(siOWE)V)4yFsaUt8W4*HwhgW*QnWMNiSUTBl z(+cfVR<{cw4<@>K9_@whDNC*kUcT~msKQuO|4_2CG~{?AASY@{hISf?VW1I-*4_C_ z*H&{gd=j~3=4g*)JaTy=&S`rxGCM-7eNUIGm_Xl#ZIb|=d`I0*hDNxwVo{hVxPMt3l&Q3~U~^K~Bvf(w_Vn#R0rdp+rIeeS8 z7!IF>di1h!Z2;q}w3O#HuPb|ik&oaZwJUcXUO?&t!%|zIYmD>0ZN>uJ#9e1P;sqN+ za}Vh-?(x?Pe$`ua4VijCT7tT&h4ZqhHf#Pggm9M}Wh$lR&IlT3kh1(IPx2_j*qL+s zDV=v~Q)L9EACm4EtNj$LZuvzD7QybVj~62z8@ckfJ$mP{kS!Z5{rm)5TPe!Z#9Y2o zBy0=t+X6l%(5K*gycZVALW?NE2hm1X3b2na1`2keQ_uM=uks2aUB1_*ejQ<{*x*D+ zID{rLw(1^g_Ur5-77pOIjU#bP*5H@WO0dN9 zMGNW1JaX(RF=60BmMgUQKa0{3uX-kL*q$>sSkS5Dq%vR2+SsTGOSObaSxso38)Tr@ z&gHM%IK{jge^vFPmC@9Syga9Iym84o=Fex@^FAv7LmT~HUqSsN0CE%{>8@H<(iR^^ zuCV$J>QMeB4?Zyr#O&C{(mKQURDb8D;_>*}Q@8aOk{E8ZeFGWH)2DivI44(IAAe#X zpnWU$?Vs!mo|s8@MtCMzNe0N1NAywttCsfRx-v_}Yfvyxqfav3)Pbs-D5QiHjwT{K zStkmypxK)*4cc0P>5RV~WBT(TLKn`Zj1;IQj?WPcu}{$a9#x@KN}sMn;Gl}7HRQ~qk;oyL44jY$ZlY?RQqcvJ;3A&tKnJV%!#u=xJtve)jnFKu_u za!7=sul~&x@^9LM!mAz&16NkBz!h=43$09yhl&kTL|_~{a*0ZaBu!_z)YA+n42l)X zuY@N*ykGU79LImMVSY3ED6a#9F6HMcd+7^y6F^)_0Cpv=GJeZYC{$50N#MtWhzKAU zUsvVc#VR2m#9cg#w<-(LIb>}z9lw_y@arT25TF%D4FcXO<@wb4m=%Gu(8oD!$TCXY z!tP`EUsR-Wjne ze@|)NdoX83P5wqqH-KsEf<}?fdB&T7fZ8zad7oS7r;GLBs~qo@j1HvoYZNU)EHvUR zB$1ivPQ0}HmrWe#-PIJs@qU6YP^mP9TV$d4)@(N`_(G!CV3#*Rs#w&@Mr21pjR5SK z7;x*&wOo=n{%B?L(jv6~>}0*eU>lQ6{D5<)DCC&IwA!sAU``gujClO1=5j&HgH)Y< zv;JWdJA+Wtu{*h zV&-(O=sLM?Tbtq^EMX#_j%d>E0n5sWP8G;Sjb9f_hX~tr|7wcKJF@EGIFRO4&2*Y~ zOiruwBVvsgtF^c9`1&c}1v2Ho$KBVqSHLqL!S5Dt_a**&~^VF>vh_C z`eQ`jz}@f`NDdQ|-pG+lBXkiTnJUM!73s0l=I-^f5GKA6^klV_eE0<~dNrwfY#5Z= z-^)C+%Hi^5H!X|@Z{_vrHpMJ)p?IM8EIOsX)aS6pZ4svE66;^45z^7V!#l|p2(&<@ zWHl8iahK)yH{>xhN3!G%4izMj48*WOjuQjz5FZVMx2<&bJLkYRTY&F?v7Xs00n&{$ z5y-~qEeoANbUr6X41aQ?R#b0wUrAG+>Nmqq#eXc6OaXhjaEsxD8{$LKXCO;B|8swX#-@{v1A|gh(5$HxOxUv_EVnVtk&7PSL8YKI`eVo=Y;SQl#@USi~mgMv~mqT&}x<%1>uQhywQN44LN8yi$E0>^KQn@Q4OkAGIc6yv1K`Wo180 z?Wgpyv=|OVE1eT-Ns)1ttjFkdy+Zl!xQQAZCoz31gZ^H9&LUTnCF3t$Ar7o5MYp$V zyG6Vy#w2dG9}QrB8+dJc7y3g*6nV8i%wfNPtW1QX_RUg8ZoCdP8F+%KXwxr#I8ENa2DP>^tPIdsYO0*rtSiUuI9DcdN0C(_BxQC5A1v$gg0oJzN?wr|kNm z$$|HmfRjBLbUX`}ui(V$-2}Ko!Kw=}`GhF(s@vCMz#o^(kH&A=a#Ee73FPB>ztK#qb5bJ8lk$iUL6B$U39 zlgR2+E-i4zN|d{#OGU9BA4Mg}a`!uDl)mPNqa2&rkq-By=g5Rn-6(w-&FUJztR*o3 zL%B~}l=dlY$a0%NBexplxkq8701}opBvpGMGl4ljY+l;EXvg40fQjzKTuTVqpz#Ui zLp0@1d0lv1YCq$onU>)yRK-Y_!2wx)z~OArC}l45OPVw8jt=p4$+I!rAAd6YE!mQA z^AY#26;)RQZgxS9Tk-kPF$;TfeeKr_4_35`=PA#QXAKY4rUkYNdT&El0Sf8U`#xd9 zq9~7d3hlBG^?!x_-#vd8b_Azi{HoM^o&&yL>@G7I+B&Y5xa+q(-V%OqlzCmZ{g8n%qweqX z56;@sSr6qsPJQwSXv8*7L%K7w88{NS?&^6sXwNmi4XJ(|ec*krchg2kcJEAY?g~6a zE^IGgSmKpe>$9=$5EL`oL$Ufvj8Y=2CEIn2n%9f0wU~_~4UjZT%1ylGJDb!(5ewam zBL~^u1J8y5YVn0>!H|%jcLBb^e@f#@oi4!;|Gu+H9*3$273x(8Bjm|2UHs9BHw+4_ z2z{3~WvF&tf=Tj)&v^q};c2?1Ht+I7gIn33!{d!zSDz?fV(Tb)U0+IYWMmfx%c5ZT zsHm|&DRz_99L{?k#yU{saTR|4hH1U1-nQ0I(d$slrusj3T#t_sfyjiw?k93~kfS3iy;$nR zsuIDMqZ&1Q;6G)5E|2C!$a0s;>kEgrNC;&P#rnafJrxMt;VxY5>+jF&#sRN*t_nhB5gW&8ujl$Z#(X z&dP`dctFW(#aNyPhc6$%UxPD)y*S7dXff2F_FPOGymbvO`cBi3Pdghh0eP=CJVP-D z73tzpu0%M`;*Gs)v2&`{k&f>hQS1*#%?Vc+GhVR4LwizhwZEljw=L-|t$;nMUnjT! zwF~w0>GJT?Y@8!=9N4x9Ryoe1g~*adJdme~0E$&L>|itqQF|5sC!-r$YTd&GXdvH_<2rb)edts#w`UvDCNn zpOGm$GjsD4lDN(+Vic@HEvt_a*){SA8&c`C1v)d$W&U-1r_&{Vi5DW}%HqgRV*QX# z%9ei9DW8@L;xF&v*68-2soC}I-?O@sDZ*mv1S|fxiTv+AzQZbD!)PvR)1Ly34Ol)| z)I5%$%}HWEbn=G(2nIh1TD5+MK5hdxNyX7ii(9h?dM_rjd80=jZL>t4%#+JQ&g=Tl z#wqS(kdLF7_nymHfhPehL0;VXt{kxGLWx*W9hC zX!@Bv7AW&GVzS?+80lhWAljup5 z@TFlW#7DsJqNChK$-tRWaTgf??OrjjcX;FYUFWievM}U^t{Mr9Sx#WY*348SJqP85 zjcYqeo3SA31RyaP>%Od=)BSV}k$P;Z3-gID;E;5MCg6wHe>&U7tPJ;6L8w6dIUL=R7}p282iiJE z142erLRHL3_u-ujNZ*55(H?4?d8cqgL|WvX@f8&+KV#>Cp9%aFPvAw^W|g0@S$7`g z51s`a@Zq_>EKY(C+jiMZe7*80SY#B#A0zbvE-+{#P0K?-MfAavJd5w|F>OfEYSb6$O^Mk>-y{;?m zyYv*OD9TvE2RDbHfZDUEWPadYG5(vCBi}XX`q90e6XnkDN-Pkjbsc~JGS4#hc;7ff zfm&O*C66AM2N??L!fTblj4E$J zQj=)dpV$w__jZzj`q6nAMR42Lk0Xay85iv#GQ=F8KyFa+xK_J^VU_{Pl%*KT0-BQQ zuN4NLN|W&&{SxjtL>91B7JuW{7{^*~S#~A=yOHBw)doa2W~}Iuh}p`B5%=wkg7!vnt~%qTrO-T;dEI(ppVN@dn(O#m zE_UJ1LfLsrf1Uk!i?8$YLRr$A4l(Ni59-+VtFiLAzpD48I?g(_ZNB&~J>|Q+XKrqz zn!}Kd17#rwAOat7dXj$<0K1trRmau(BqVPr(H+oiY5*qKeMjhmPJ}*y6l}h_1yG0w zvSiWeUk4+~b@i0gwwYf-yPs;q_vtEAdpQ+aAV?_5e=@MMA{Y@Cv*QBRV3yPBZ@cSK zj=Wka@W0I8^lwa4J$Ea1Dvk0{+Go%+K!>IG1P;&4qEQ2h84+lFDsv9yQR#;kY@B_>)xNzK4;>Ay- zrqPM|1WaU1g67a?P?M^Lb$CAc79Vc*qitv7b zftE-M5PXG-X&Fr!Tfe>va_B7{8}%H=m zRpiLSA95-7LEQ3TKYS2so!Zt@v2DZkqVK%lep=e;iQTP=l1Rlb;oTepyA4O|?gAa1 z%X~EG4d2D~y=lU`IL#yr_}s>Ab=d#c+V?*{7-Wn(&AkNEKRfSB8Z6=YQG%G@5_8b; zVDUL!%Njq}w}OJRKtSwPB%n8<^LagFWa5 z_Xv~VFf;DqyMu6X5InQoo8hJ>YS%Q-JF)vgFM{vkltRUHB4{d2U0q#i>lPZ@(UBRf zQDqqv->beHD#X5#GJVW5ARHRI`~1#rB6uFtdgKM?Fe%o;oI#6rn^oowL5hlBjv;mk zSK$wm^-C4>h%V#oJe@waJ0KWlg6ZxMMe8sNoYi%se(Eb*NZ~+y?zzr;zd0I|%6S5& z4^sgIiTPMn^D)L^25^wZIBq|E>DZiYl=}4C4g6RQL0yfPJxSZ&|eAil1Ec1bS! z-5=OYGO-jFb&?eP>;RVB|9I#cD#{xeT9B@qGCJxTd2522RzH6-T@X6)vG}ba0olSBtkkxPLTJ@FS zE$JZ4Ii?MV)eeMW=2SYXAd20iH~Q#qu{3j{#+A<0rs4`$6#gE>UA=b2>3BT1%ve3w zV&-SSbo4glTemN-!;3!5s?gj1prmGK#jVX6bXtXUWz?{<^Lw`so){p3nA2ssF`!Ot z16`*DR@4CI>smY(NMf3qoP3HaO2t;>F&C3Xfv<-Ifb?T z|F)abX<|U1K1d^-JhIHfC8e`|DNV{V-=8_~tDq7ia92`1Ay(dO0**#zw$zTNiD=)7 z&HkJyW<{R9t}Ia)y!}O@yTPSaHEgF5S?*{(y#GtreO#*JXJui*jEZpjU38Q`{?8{l z=P?8JXvw-_U-nl-hSrXF&MbfHsgkL-5-WJ?IT{J(5H@$7fO5u4zQN1Ahik{l{YT%E zo6k7rGVU0^G?#1s{;m^j6)wxW4TWaeIEAHTt-kVNV?@79t}A)~gp3ZzQ{md9_2 zx)7&7JwG6P{=>#&0}(!q5Gc>^1KlSH<1tG-D-*IBb{j1FbYsYblsyO^s5j4B~vj-d-Y!b|&?q-Nh%%V&;8DpEEEZO9orr-D`MW#vTE!%*9;pzczdr~ks zcwQSucnQ|kW7Rg+KUwJ>MZ5dpwxh!L!`#1j|44Dp(tlhyXWE^LV#6mm2j}&xW2yv` z*@u}g44}-3@O{0PWiewX8Qn`AF6j+ar(DI1WDCseuvQQ4C8a*2Y~Z(csPafbbMpiUM132%a8bW=%gm~NWt*t&SG2e5BtNt2{>XPyb-vt3 zV_C-Dt@<{R)G$oO;um(UI-?wUMY~OW4Q}p&-61CW%+s;q@aoVOr68pC$RC%tpI*_$ zx);NRqp>@^?hF-TP9sp!*WxwNsnP~dI9-4tRK%4ACv*PsJ6~s8f8f6AQ9su^+)h7t zVy)TfK~Mn!14Ky`m6A?rQ9wXCh8~pe z24P@eR6ts!yBmh?H0aKuL%MT_q2A3o=ebAm9QC=s`~IU0%*@{3wO4#rvs~|Fw*YD@ zOMnvQkR(0F&MflzG!Hj)K5T6{0*!pqNB9KOE8vmdKUWt0MjcaTWk@*1Bc{_~f8#=hI2d_UJrM zMv|Po{1oOn8jN?Z1)0&I5b-4}Oc*tKd85P%(69GKzxY;StM!vrs-}tPGf&@5)XGrNRE+z8 z&aJEHmk91!tcn*3x$E8h7gqYwxy(@4>WJY}U)AdA9=pLRRRLaSRADyIhiI{L0gu!G2r0ov7rrOtKOOA0 z%pkhs`pZA}D1Vsmdqpko$J7KJYSt_hcBV`2uj{OLs>C6Gz zqWU|bF8CM;=g}_(xt*qwPHoVgQHXncDN4R9%-dQhdmimyf+}Yc%?9t#Mg7T(0PBCB ze+jq|77eDG3fsNofMHFk?49 zK7s-LSFbp)O=C;+;$i_9r2yCu5k(S*RykZ`97@JzaeFQ*!?~}-d^~D&@5-<5D-MMb zaq4^mJMHy5toIdwnhf?T7Vl%T-n0Okd+$$KE~r9~_Kr&;3NIJHrA2`GeWgjBc+fxF zC&2d`)hB;E3x$$e08yCW5HS=M86$>>s@E}>fLf9S)UasR;K{?7Y*e&XfPIAkae?Tbw8{8(saQaAhk=21CO`q|qXU53 z!+~^a=Eo7&I1&b>EaiY6AqqTFE~cV$Ew$pEzwwOXrqQvtdc051tdJo{Yne1&W$i^X zzxI`v;cL0+1QTShSS)x^yy|CK`CE#=yfFZTlleBjT-U6P6*&Ut>U_l>R<2%~!0X~z$1T3Ez1}cqMt{<3W0Tsno zel-9`V&p$^<6jv7k`l&1IIx``pNv}v@E@B8vxx;pO3c9%R*)`XqWk3PD!wVL*MFT$ z{lkkE+{a4Vyt$#oPBe(0!mkXqmiB!~I8eQ$l{KZU^PM6Td|x}GF@$OR^)HS+i=Wbj zU_fQ~05Ip!1lV{y*ER}lw=)5vGJgc9CCTw)dCl+n2>=u6Ob>R~?6+U^S3&Ic?YaNd zjaNczfv0K;7)TnGW>= z<)3D!W&Be9fVZj&q@%MerxaqwqYLm1o#(OrNI6WxiVV8$W@j*w{kE36c0KKw4t6b3 z`^$G{|CfNnDU*xgkn+Cjgq|FXgRiX5N$;*te%=9A%SNJ~e0_*5rwT0bvJN8BunDkT z9T^T~G94?5X=v4Q!?z0kk1ww^&mvljcVOMMizJawppg{OF-}M)Lf@@ejTwgN!0N#WKIT;@0QZe^j-uf~B=U zS-~=3hug^sw|Bo>mmUDNgk}NJ^LFTGZrW#tgZa9}MtvE%npIaKfM%|@JEHi1UVwly zF1HHM5$=9M@u#`qB0#;p-C0_k1R}tBz9gJOQID+Es~kpwq=PXKV7a{FPtH$hFjAW5 z3ru7_U0ND-&%AQO9SD^5^@59T6cxN~#^oH*YKvgUS!|vA_7Fcc845vyv>-HKY1sI1 zYj^?W#X~WfqZ6RXp(ueV{o!wtS+Eiv1a>Y$&UaDTBvH5==J9Q{vI30-PV)2MYT-%f zTIH7C(czqcKf!wHxd@>6(~0WIU(>{<={o_bm)}zf+62Zdg?~B*2f??ER)^DKQvjD8eX@_r=bvGbm z6~I_gE4!&Dzbyl_vT=sQ!7-dJ@tollCwm?oHjNXVV%1enZhV`KB})wDnpcJx`Tm&$ zeiRgi96?~G#4=FURt(r(QS3D}U=qkeA5fo9!ldO&^X#;hDMg0gcL`XnGIoN^B9}W3 zJAbh<_ZH^ijQr`AN1!H2k^fC69o{nF3Yd4 zVFb!qYgt1>w}2E^Atui292}+h$wNlJQ9bsT-p>%e9sFK^f=;|P7KJeP8Z_Ae?C308>K*0a|Hl~DOYN! zXMnAG#dY39q6_S6PzE51SaFP6!qRO~TkSz35X`Eb0EVt;FkNsq_r5`&59|_93|<2~ z9`y5(x?RBkI1l%JL}_Q0`d?56CVt}?`*hBS_%xp1m4XEffN@bF_2jEYGRfAlm1zNRGnrrm4RMJ@q{kG6i4zpt2t3!tY)Rc%NYMr6l6b z-JMOs0QJLTpeAVs^N4Xgf8lk9mGi`|y``iiP^0wg+KE4fPzHt$#M+7hlR3bSP!CjH zA=F_r?7l|=#2AfwbcFuAEsQ^GX1yPo@oCS345OzLzvH%nc|-*NZ)CXtW|Uf>@FH00 zo5G9Y3Jw(w0N*N}G^JIaH#tVxuLOYkHBVH6I03XMvfv98+5i3VpZ!GpRB%!Vs184c zwgVZ8nI-_N^Xzk)ZVc!L(2X(BuK2P?>o2=ZaJLiaA_4SVB;d7-0mV)-jnsE>t$`E> zrc#c14}B-S;hjq&G$yLUhCit0)U;0x*V*sm56(kTr98#iUPr%wS9|FqD?;l$O?SS_;_Wb%VkD zWZaufwGd#QaW9~h)lP;0SJ8nrYl7bvWC(yYAUNE{Z8NVGs&3^8nD=%9Qeer^)Ry}s z{+}0V)(|`>1l%x4&gmq3pcAYzbjJaxE$3pyC;>dQ)2s?gr5p(RRB5TL;3K=MWu_AU z^%?%t9|#zLV}d99w4eRvsn9SIaOPhGIRf@O5gI4Wzn^qmg?T#w#Th`#=cn_Lmp)TRab&#<;XE(H_G5yAD+l%=MEGiv%!f zndM}f?@v{%$QWm#R(1HPx-)db<+l$BR7c)|ZRKc5=@I)7{-{2G>-K;5W3UT%1RKF` z_9DW?{)_wjnX32~Mu)MT((_5U;XiT0|Kac0E&=1!h`%6OpZ`3v^Z$Iwq*KBXH~(w- z#{bb{0z&XtHbHm5)`{5ZRDDnXf%5Mj)b7U^NNv0Q2=Kl?BreExT#;nez9Z__JRQsc zoG#hrO)tgoa?=0qeQ_ojcij%zje0F&T@df*s!T%UXn!Mb@l#LX`&0j^ssH|+!aKpF z_cafENz59-PhxhlRov4b{3dYv6@kxQ>d%YHaG-Yy9Y;J}%r?=ZZTDgW_MMQYQcel| z!=wB^;u+wZiC+sQZJ(xERC+Glv`cm9uRIMx|L>mBZ+`6E-77TH(v(L1S)S~Mf-w6C zP#f!igaGL^F8Mqw5 zZv0YmQE0tAYX3{SlT|;^3liC}-CR5lG=ZuF*4yTkI~c3)3jF_01}Dr-y!{>wg4c*r z%j?D=YrXRnFm%jzQUNn6zu5d9+s~ZYhKAXy2m-DL7k;C<=vxy1mpt>~IyLn)W7#5; z9tI1B-&z5o1Y&S#<>K<*pihSY1R~bZVzQo_nGI>c`1+t@xj0<9TDM{`Ww=sX0HWoz zhC^3N_0LlD{~+;y%RT_^L(biCQMrAnLXJ*hs$p6aT~fzyrJz4P7QM5$9Bt=tV!X2T znfnpyVO&qTyxn|()<=Il^4#mTiKS_-UH4cT!_V)m=96hgXBk3BcndSx#dL&x2>weF z{Z}lwNqBpj5zLH|*3??7*m+W-wUO9^RcKABHYZq2R-aYTX=7 zrvl$4M8zg4`N)oAz<(G8$sCL zlgqCJT#zCD%Hox@mh6MVUUeg9jdBHIq7+{}L)EuOE3HMY*?q!U`!F zRBPcFKvhvKKNm^uU*St;8kQ3bi*;8s81aA1_J;kDKT(&Tf^SETrQv6G^uhhuFqO zbIWT_Js39$EdhqHe>+WX4uc%J=Q0Gx=PztH9$!<7<*#bDrT#kVj=MH!f3haJlFtx2 zByiN@?{%~1q+=|)7Nj_~PjT{q^FZYGm1{RtKHqJ;_Eh1$qyj-5X0}phUw?6rDfi0r z;qc>B)|K&v!XBw2m)-vIV%mg<`VJqpBQ=&T)YO0zQi{BdNa#IS-yia^gGma z483quH|}opq}Aw0>Y?dZ2fiwU!mIe`I2J4naoXBdXJVTak2BP9$?U82d?XFx<&CGv zXxZv>z@eFs>-PqU8ire%74@v2xyuH&DP@Z9GDF^I1mb;L`7YSp!6@@FT;zXr` z@1Q}72xU#UXI)3jdhD|3#*;?$b?($K5IXW)h8A6-E@1bCa3JWpoFuvcNEV;16 z!AZYPL;y!~zRsRzuM_wZHh9tA5aAi2hem2-=~QzM*OY_5;bskAW;fs1%Yl0hb+>ZX zMIQOEBia0rK3%Rb8saN`4++2BLQ_h;UNO#>d~fQcpxkS-%xkO6YunbwSbf5LZ#~{| z%D2XbjbQ30n&_9xmX~2dVJyGKpsv~^8u`iu{RcNkPz^(9sN0kO(ktn>)Cb@mc`)h2 z>i796&y4w1)8CGX5l6GgoJUd7vSi^F@^l`u?Ux|GV_LgzjPU3Jn}%ZV^J1;1C;+8pAN;KQwF1@qq9F1z7^vo z5m-&Jc-L8t{~rTzi3u%LUTSJ4S4B}?F@7^&E|?&;r_8zyTt`cvBcofS$WftzhbTR# zM%(jG12nz?h;c1ATrJy!U)_en8b&J_T;M9Vzjvox!8mXCkjr7}C4@I^jwBs*8pTY< z!r_dxB!oq*PqTt&nj3j%p~7|d4N*Q~;(n&j6%&^$GrTVfv1{)P)cgAGykUn9JtNb! zZPlR8NvZ5LSQ<~Oa?>!5x1wbv#~16R4_uPiXJ0ZQK#?Hi*C-y^Q83cca6;Wl0?paR zUJ2MX*Xm6%RQnQV9hmvadCGq2xYjT4i6lH>STQTxz9RaKES6>oYQ)!29IjI}H#gf6 zp&+Y+0<`ya2Xq@siK*8SwD`XN%uKF=T9>%!6dmCTa}w%x2VM%wGI3c|v5OW^Pg+`9 zU0Z>Kt4UfCxvy2#17t6Cz6yz7O%!|_!X#YxCB5OjSUGfAaWS@64GXJ^K%dlm?P}(w znCC{a0dM~0V*fD&VKg$;OC63-$(Uum2X{EWCpz#Zby-(Y!<=VNFM_e&BFVDUR&PCo zhy_%01?2ctqC3l~_ULd2Cu6E^bs0%kJNVV_;8u0&@nteDR`k&d@C;LboqM0%^b8TH z<)$!GhI3dpHrUcULyLQJ!O=RrEdrF5U(Nw3V(Bi>WhU3G(J6SFM!PEn69B1oIe>I) zG1$q?7al2}SEU&v8syCDD^vdvc>bI76w1a`xg7&E6;b{nI@>7%%Scp1is_|Cg@m+F z6)`_AS(>%^V!XXf!p@d4Oh5Vt2i`lU#z|Mvo36!BV^>Nn+~(-l)y8>wmfVb|HzU8q zcyw-#ka)!JG5MNNRK*vpawM>rW@e|dp#Y^OsNZKuCN`YKwH#gB-`h0M!dc8FjeMI{dvh8Qc#>Jv3TQwSc;|@bBq@PSTj!is*8QMU*+t1 z`Wx((daz}XDDGPiWhg3r$eB8@H}1*6eGquivta*TOU#?+?qR9U*>PB+mu40s~_^;h-m=xB0V z1|?TJ)Vx`WTskz9$(nlGrR|oY!gE(VS0484znnrY$W?uH6!z~cOs8a9j%X^k-0WK< zk}Rs(vFIlHk0Sp@6Mq98U@cg^q~JvRe$s3H7u2QRO`T=bS0I1~$B+*qFJj*H@abFb z!Bh>@b_)A6kfl3Q@8Wycr9Ks7F}4F=tn-kEil$$4*rIi`!tF#^h;Z=Jjh80|0vM2jP(b0=yby*Z9sm+SzBB$bMFwcpX|$L`~In;VW0~E#6z=;DDSw3(_?3N z1XH-AwD zp?&U_PaK~mT$k^G3(`>@o^nUp`ZAU>9Y2rpVp9kO$8Y!>!0)TPdRw*fY5VW6@BF*k z`)UEIxM_^FU_s1Z=me#*-1o#b?0-06_(|8#fYIYL3YBbRONUKg-@2+%M zk1Fc3f@F)#1qFQvvm$&qvF zCB$B=qoR2<0!zjCahtBcqSf!UVM6$yPFDSOPy(@02_A5zy7h z5%=1ZRutWH&QV&Wv*@^EIdQYC!q8%rdUvQKXCT`Ld+NN-W9A6E7D@4i(X`shK@)m# zEc|XN!HrSrt<|Wsy?SedcVGTC(tptkY4c|TN+97;?a(nP1HG{(9_ z2d%P3eu!etnA}|Ary6OYv%Qhk)#B}g?`z{5VXfJ3tj%p4z)}oN3k4s_s3>{(sG&4W ztf>VU8(tmd>_E#!{hf~ZN109EZ6sm-a$<_QQms;)r1x0QY-P(%+>dcMr+dI7r1%(E ztc%v7s2xmfuWFb~G(^{-v$SF_MO$W`@BxB+FWg6q%9nYhpGk~8dQ0Oo%CBpF&pj*z zs?DBl4ws!@`$VN+)xA5P9Tg)2tA>jEy!UF4>Yt2yX^&Qklla>9a}pilUPULX<)$rh zP?5@`)zlf|qPakS+d}&f^_RsJf{cPwu}(=ZtJZjCUt_lUq%cUD_uf+5>>Hpy+EM zUewL>Tc6d^?#(aO{=D*{(+S1wpKr;}~5}Awn`8Em1k!WqrvrDD*YaqK0J*y=Q9tsB3)Dtfszy#Ck$Dvi?AuDor&hb1` zkwYB>rC@r=&TE{{@JD#}KBNRin#)b*w>76#cIxCj?1#On3*ELRdj@Rzpz-y>C>}^Z z*7DICelF~k8;6y3VmY76|G?bT@YRY8|8P!kPY<6FD`0VDC-HJ-z-IT1FQyOKV70Y`}ZzrQ{^E#z1D!D9_ zpxd~2yxXA0jMFX`SRpMUNq#dmBtm2K8Vaws5@LqftET6D3AJ=GstGH9C+Tv*&FITK zmg97Pm!v<~DU@kLq%C$pT2``Om*9ZMIxitUfz9UG6BCIM!TX}@Z?TsU(w<1|H|*T^ z%i_BRB*-IrbK!AZzT^W27J)I}hR?o%ZT|sv2L7%+nsku`e3bLvu5%d6MI0TNl-JO0 z(UW71W+IT>awo!2TinCtLf5S!S*i77Hi7jSN;CRiih3o~-7iD?_Qv-1#`p;B$`)O0ANy=f>9=>jg7}KJ z$AtD>OJ*`oUY2DRe^+BATlKcSF?&TUwz#h$8c70rYI}-+jqn44rrXvB)XCd8p;tI3F;-d3C5MLpFtdGHa ze?lhNay%Fptphs>G}OIYw0tEQ!MkMiG_wuiKIf9G&lwZ)dFtbNrnoJi;_6K>EzPkf zbf@uY-PRZRb1_d-e17@_Cd6P{ka0vs3tn1p;A77pllbI>69FK9t81;7VN8iP!TB4D z%QtSt#x?HY$TA$yn>2b)Jt6Gjlw~IK)x!c+G9Q2HKc;?>$BbQ}ZkAX&K4XkaEPVYl zgZy+SVTYCBMomldB-c-6PH-3_O2Np8grMsA6$?4)R*b$?^8CYfTIbx&Fq2WTPd!T| z1YXQsJ~AftQJSw=b&nCrAeJCLP!)DNwm zc7NG`d&~0-kz9!|RMXdI+?JF6*}?gbq@4b>JV3B%5WCMV5t*;xa*euwP#n(h!cB=L z5W1G8)pRTCC258~mVGzWw?u^PkX* zxDOX&i#VpTjLO$(Rfx|LP~$P+5NJ$3%)jtcz5>4W(mAvWBO|he2eRj)GT>ao5MQGe zb!Ux@UX-4s-AtB?L<`=qQ($$bUQuihJQSK7T0GM-sEC*ku#N5sAe3J6Z}Cg-rrfyn ziy8^RiA%ktDhaxfeCl;Tzk5ub?6`dXIl!V~l7n+H|5+x`R49*WZlyXtGjzD)YEx+5oRDd{%BNAY! z&6L!%`FXX&{5AA`(rj?KQ0xsG&%WGCXQ^0Tc~1Da{E$Wu_A_g7%0d$q=y-iP6f(gs z&)rpQIMFH;8}R#WN)!t;Suvtgi;jcwgF>9!edb3w^ty`ekwcq_8LP$UWGZ{NOjR~B zj-k2vly7eRN@u!aaVg}YFso38Vy7Qk;(^wWK*-hF z-moR1#(=2rDx?2XoU;u19hn3XR~o@^P=C~wlH-c{1s%fg{(265^a;Sdqf@*E;%Djp zomK?6cfCw7J0qJv7UTMS3VQpHk>$Q^PvBaUZtQ_FW94pocZVa30jK{AZ*~z5Xld#> zgwtbwZxaX4q}SMGFnQC@L+jp8Z}c4cG5th&PN_~Lp3}z?@cypnOS?1odWnrNt`RJc zKlV+e>x^po&&%0M1DT4#!R*#1o{qw35L-gwV|dzAkABSNqK!65ZlzvFVB#>9Or?IX zl4)y5qVwnZ(WkZPhv!KOw{x?bWXH|`yt6Mm*#Y+sW#gt~&Yuzi&%3R3HkB(_a`n;z z2c7P(^MbC7m`27riC%$>9fBq8rrCM2PqWm(Xwl%q{gs@BDoGE8k$st`Y1h-5`l!4? z)We$gwYvguv_%$E3=@NUsUB}IPh$JOQwY1?7#1e)r<$m2YU`WPEUuvNN`07f1@Wk& zXE)HUEzTm8!+ap+QKCNW;8zOymp9Im_RI-iJ&ik*KU!g=Sa=mIns624JDqr{D=Mic zc7=~Q%*SSD!hNeLofXLlf2Y zrOCTf)ey!jG3ta-NK>pv*2oZ}p2KvE3XgI3P=+pd?Gr zP$MW1P#xh?wnGojMjkXfvBTiuh=82vSn^Ot#YC#-eZJ||Hshv&Y_~Iz3D7p_*Z0}f z1L}<@*jYz&_Jtb?br-}}MvBEMyd!pZx*-rhJNQ6$1(ZuMPg7is_!k1)N{}{yObH=9 zR4-FvEw}=VI6EWZt=HCv@484IA=Zjs&Jfpqd0K&3rQHb)cTlf6+>H&_eXM@=6KB2v zSmbsOEtR%Ihq|geX?-zxb`JgLUdG}K*#`gF?pJ=~9UAc3{`Z&#n>DJ{`dxO4N-tksG zZZT~=fuuEF?k8_3pYU!Pb3A;JG|L;FuwdWT>5)^DJj0W(_;q_{bD4X8kbH$MB4Yt- ztX-1-7dOxQPzL&}B_tccY}W61GsNNt=9R8p^EwO;4qk!??0K@VukeH+rWc#7!dusTQn@_UT$&*X-Gz(yvaXsd|`gmzc+c zt!!I8QJIdj#y1s<+!lDQ)S)Hcb7f>0J-DIp>*#LbK~%|gd!&;R*=SJ82r)$#tKREb zzMZ6MhlAU0j=avfpHNcW=LMv@-r;NZ7MPoY;v1~h?`RELnht-+S=fC5j;Cxpd%iOY zV6VVcaWL})PAKYRDc=>V5%xn!19pD`an&Kpj4)h{qPs(BC3-=* z0Dn;@-QKEC-?K)_|9H4&F=jGA6IDc^2 z+9~w*>#BPn$(<+HU+Mf}AQ=`zhc3b73f^?cK7KO2ZjJrK>9 zH0G~jc9U~fF+hskwK~JsXJ1adK#R0OFm~0O4t}-E_AtcqIO~kyV^nSi9nrZsKXGwJ z((i752n;-Z-ZpcU!_z}9i#5<3LOMh*uryT|Am=Y&4{J%@r6G z1+OwZh$O&qnw4gxX5A`xxkKI?uUJ|paCIhS4~H-epEHA&U0 zUm*ZNB@^ezBSST`0H&&VKVE?&P-+rej|;yG^Toj|ACi-EFY`Vrvyz|A$-8mzbGZfZ zzb%@+@A3_VcBh_cmF>}d3_tCJPJhI^B^osSB8@wGno#E)L|RNW4aF=CvWDv{++##is4!k0d-fF^{&Y+%$}{ zA{&l{f8g<;NuQyy{8jy@00DIu6=O|2J^0lI^rg02+*rinUdL(mzbC`+QL$RO^=>DL>K>wOGYg-g8- zv(<}~Ain(J;SHk=>MMW-MpW{cS)bUDjZ`{BcJGj-t%aHpTz$^|vMtg+5_O+yA?AQQ zWa;J)I{gOk}~4QYl3fdMChZiHtB!u(iTd zFueHKHd-nMZfX_8NluW~+&32OMt*rfHSK1yx^vG(kha82Tmb^Bijx0OHw= zFaBc4AM)$vY_3$8QAK^+NueCuZ_kpTie!4c zRl_0g>~mo3M;zIDNZcY3XnhvV!{BsRmVJ|fS($y&dfu}09cpSC@bZzdW(o3NfF@u{ zRGDi5FK8eB^2r0UkW1d4U07tL=u*M6H^S5vS`seh@H$^9)xUFFPqR$T96pp|Qh?Lx zwk_LCHr_Q=B8eyhxn0DNtd(MUDE8Sy_@HU~O%T&pV##OgV>VHGM48)Ta*h8sRPawl z-kA(|bS{&|s;II-PGiP5H(8$cn3aL7J=SqmL$7{i`kooip_AQMZ`R&nO_8>iwkRO- zKJ1&xXc>KR=fYVV{~tf{Z-Iy=uo%i>DXIs{1iefP?rSRORrKJ|Es1bM(r|H$s6%1U zqu%*ih5TrCG`0MA^B*xzWmX#`>m4YW|#=R>ynqp zEG~9yHbz%OM5#f4xIV!4k@_QzvcX?m2~hH2>;bwKoyFa352RcN6Bzz}rma`Uz~{fxU=4}T|4{PtJ*jOj!XiF9F1gKcE6pa>)%$dwA3yODk)7-i zrE)F&`)T~~lZHmEvCE8~Z<&lqPFCfiR|?`}Gj)}}A_ny&(|HM1#?8K}7MjSQpZVC} z?%OFddn(R9Z4$0iB|^GJIO*p}$cCkjg- z7akQ*5hi7tK?HZl!l-kcD3b?U77Pv>V-_bJRU7)d&Y6-CWxel|5y(uwnefgchcBa7 zi5m5bxWxn|j5s+*HF=b(YLos2eHOC*n;0?}8>*XUn6qk;%Va$i<`uWjJ+{$|jt!8{bz4qNI_(eVmz;(SiTy(l6ea*5iwQr-} zKf5o(*@Q7ri@%VSo8GSnI2-R9F=Vw_m~sf!RxeZ?mC$qR?`*$uH$W|8M%V`9rI$~|pSswwqoshX^MHC12!`gcmL{DYv(dkFjE`i==L1fBAo5G@s< zhxHv-RD7JjtwH;PJJ7{z4MD!?9eSd4>GrP#1DI48u?LKG7H5b8?=c84#z^}o(IVRC zVtP`p&yaietG<7mxz=e#Y;peqRbxU=eq^~_svk68!eJMjT`D7gz35Tt z*76-)0=40hnkll+eb$2D4aO!iBAuVdx?LZk&!~aB3o@me^rZIap8EFJirFuc?BY#o z4iP39i2RRV^`}e$HAb2=o1AxbOCi;2#jBkqF-{}$*5>SfbfLx)NG;iqO4qxoZ`pD^ zya8gy^M397lJti6mJk4XUkFUifWUYi``_uOnj03O`__c})Or6=t~M}u&NiZCkTVHD@_ZLRDywxY)ITH}k<-E`9AdvEkWVQ=L7 zkIW5J96gC{^neg!C+xo76BOGK+6|Y>l{j}EC1ry-%s18#4sFOdrI7RdJK-0dDouv*;Xkx!;# z9@=M^^itT}iC`*K{noIQurLE%9UTXotEU(NxpB&QsH6ORD|-e|yBNWKrad#H0cp++ z7lMBL_z{~0+Y$rw(TE$@2>Y=*y}~~00l}4TnxSEEO07f8&wFZa8@t$3b9F*4@L2fD zCzpzLITft$nO~6eN^XCn*=$w*d*%B`|K$tsALdb_D`k%MsujgsHZ4+g1%xx#Q=#`= z+(xx5*%S^eFXs`nZHe)5)6_3NMY|=yJ41~0-u%=XJr`U?CA!0N;T9M%zm)wvJT_LY zj3}kcdZ>+RquRUM5zctTQhnI+5=-&j8l9+v*@gzg2l-@Or9nxxP)jfui)IYnl%BeEy{&%9 zEktaO?U9C~$Dr+~#-7|I?}zbspfaVcZ0gt1hi$g2@R2HG$#8P%epW?%K4xLQ*L>t< z#u$Z{d&7)#k*JzD0Pbn&P*i4l8b28zPRb*U*j`H4!Hb~JZn1rsIm8n`v02oP6Ks=yA1fV#m zrkt{CkDCx|%Feyles`t7@s7)yTH%B{2IIZEnBU9l8BKEz-IO4g4B-VLG6E}-96-v| zre!264_;`jePn#Uy-ncxgSrF}0y0wrXca)!l;Mi{+%zlK)xZNufmR0wQrs{lW6xnt zGpy@#slO7eT=ldW=VNH6`4%_B1PPgr$t@>cVCCm#eZRk*&J|1(+7{^^v`B|5A@k&3 zX8N!6B?IzzOuA7k7m>oU$wpG7@*=h*Z+eN3GBOoZiZ$p8Nc^!7?*g6>k`pGs8>3{i z?Y}H}YgC%~&IpxB)^y*|5KFWa&%Fvmu_pxA5v!TfeZt{G1(sE^t&Gw@>a>|ZBtC+p zJ+FUWMME(@-;~a_awF{BRpLiqsQGUZ#`9CA8qWIA5J!^&X)W((ekRU)T{l*^6zxx{ znPc>KAt~*M^F4vR;X{cr(E%I-H`+H!)g*ijW%4Rz3b~Eus`dmZV@f zyJ4y%J(nXIvu2=qOp0YyDe8H3+NGaE`c6GG50-I9c^>RxM^I%OY`CAf-2Z|kDkJ7O zuDP0v;}77>RTQ&QZrXe+#B^1xBaFWboj1DnNKkSR(7=2`JW~^bzDpq?W8|{7) z7UY(D)|{LP9`6+h=4RC;TZM7eO{`lKE!3M!dP*g)_2?TO6xp{Zkv#&@RfsM*_fbzN zqw0cJ`^J3N=2tqZ*M1~e^eq2jc`D!5L_J#0k*^`62*3R zIma5V!K#Mxk=D_fNQ;G!ie3H1p&Yt7%2~F< zQea2lSEy&P3yu@VgXJ0Yp>C&^obsC?c0R?a(#2OrNUvmahMQBLsYDFd?yfBix9zs8ta`SuCC_l%i;^Z)8^NU;Wttnrtk6P{kwQTn zvs>xpAESNS_c*WyS`-z=Qew!K2@?7FR9%*9RU+d3iCp5^MEw_Q=jzB>d&XYi4Vo%N zkCrH{m1*)d7#z;aM&wQKkMiD?8eQ46cFL2bfDa_R-eD=OaKV?Xo-%7A>vwLUDGq&T zb@-;-e)&R`)4*q8M#k_)2eN^3aYhl`UdHN}gieW}Hg1_@4ReOxj1|35=1QiMq;Px# zkpvavI}E>2Ln{Qi(cMGBbVZaMt&DTVx>A#rw!@=1Y(@5T&IaE>yFYA^Jf^D4(Abmo zo*gm^(FhKDIDILRbQ3jJdsN3vT7R{o} z9RCY}Ek5nMAIqt=K^j5ppJPklKoQ!_{~LoK44 z9=F|121W38RJp=_<&|>cfGB#%ekL;jiOa zl~fb&i-zlRFKcg3o542~bhk}(09q+rdM^-(V+oA90ksvZ&srJ${t#&rfX6VUd&si!_ z+gWrcG4Fg$HEXC73coZfGud9JT3UxgLF`GExU}XdGZk^7H$5y*er0e9UZ!E+F_x)K z=hyOL$A?bJXo)9h@i0#f8BNjFr>Ga5^I_C+KODc1l75s2^OzuUqhQuZ{ zsh(k24+XOM`23}UtoqLbGq1#Ez8W7ZJQ~W^tpKto7W&Vkxir($r`WYoY=HQTIA_8A zm-O{!H*Orv%n_A(V*)$Si>t%p=s15Pqe22>3GRzfDW*}dbWS9pZ%c2c^xht?Igkmz zubW}g`xRW#$6aat25+sUvw9!gbA5L_4i>wzJAzs@fp3Lo; zYGBG6PD`++@@(?mf;+@qw$o`6|xXI3}lPqwohy|2=jBLd@iZY4CtPGcz}O31`JbVlwbngr<{jFiRG>hMU93 z4C^BOE^}bY_$X?1m%MNJ|;MLG7x<|1<-4SFmVRBP`WFkifOM~>ob zD50i`ep7(|cB_CHqP=3RudN`3&Q_Vx_At~{a^Hi$tKPrF_++)irf`H#!h#BmoJ(Vi zV&6-|-f43z^5G94{(B#<+)Z!;F05L-`cB-ba0rTE?0jO6cU4+zZyw|QjkC%}$&= zs!Q6O3q<{v|B3Q=<(<5E3-v_)<>J$Rvr1NgkluZ6Eo(_*Co4UU=H_O#{~u@X9oO{s ztP5{YP*FgoZK*2Kn+TydML_92bW}P>?=_$z(nWd=y+dfBlOPC4uOW1hPUsy1gg5@~ zJ@;;LUpeRfkMAc5$(r@dGi9xrAw9C{D;$W(>RqYQzK3oNho`Ng-PXB-KC-xZ_2%VE zf{-UCH|NolUne-EkrQXm3Sm$9ilSTphc*#Pez3uFMq64^?I;na?h`zS}LzvBZ;4~4+p~&)9Ilpzv2VDF^u1sg|$Nh_je2RRT zKq<#_JjCnIDuR7gBJnEq@NUODia*vKjH3}cX zmz36rvnO-ZRZSuTK}}H3+kDSmPfyR6zZM)1raLq1T#R;q1#msnD@2;B;b0I6tTvcD z8;4{AS*6z8P-Xn&H~p3$!g?k3!Yu3=ImB{^HyM zGOdZYJ{PX4Pd&|N+6Teii{7kK9*yGQ)CDP}a6|tBsyq3)aC#eZ6%o(lf}AUel11y) zz#_oZeA{y!rOehLz||3@oU-%E7uR;Wuu)yf^RPkDa3wXa6p`%-z+KYpw3`_H^B<>0 zDIU8#(H@)*BeSL?t|69PxvSyw9S;(_hYFOAgAM!WrbTmE!@H1l z?}k{pxFqF#cI6skG)*@k`jIhKy*jzEz?_xL?#!#suO-pTV{PD}wamU+`qRBQi8yJF zqxcl`0cne_TVW21)#rCjGUi{oFbYaj6FC+noBwpFF62UgK5k|C?&oSkrm#r!+Dnz( zlIX5E~Q;h~_ zMv3Tqk&!A$F>FOqR3wIK3K{M5FB9i(=p-j z#D*)~QBZ}ml_7O((cJq2NZw1~DQ%vLqiAuf(d{vpTRSGe00$uZU`n!fS)xejjF{Tq z_Y6mXz{LFXNinaIyE#6FaLm%?@{iRz&onr5X#9CK>}1t&1rwp?Hi?PF|Lafm=L^4) zq@M#X7JZNiStR38E~jnKZ}5%=*Z=k*J8f*`f_}`$ODioTQh9I{li8ph{qeUay$k7q z7 z{lu^;EMyB9#K{lIeLA>@0C_4ZozIDcDy?OF;H+xWBqv4c2GVD*Zs(*R)uwCpk&m|G z)Yx=*e`Bj(ypf}4jqy2TT=f}ecmUXUPQ1h6{cw=3BO3phQC#~seNENy`>d&Jak;;L zdpXrtAIcYyL_^(OauYXDK=W@pe+H>i7Tgzx28Foq~~qDU|9o}%sJTXtK(7{ zj-yio*29M>9LddhzeMZAs*LYE5pmnda*%R5xR7i_) zO!8P+)%OCmEt@jt&=e6VqdTlE}wE-rrS!(Sk?!w(O+FGBrSvw?lpZxMG`B$;z5aUikWY2Mp< z!?aNuXqJ6l0Tpu@*cI_S9I<-)O6 zqpj4ty%i=UHVK}P;?R{O<_zHnxA~v*Pwdhtqeg_r1CM8+w0{2IjtUy_%euR)Kt?EhEX0>zC{) zP`LERf5pH|2iDltmE94&Tn+~}1=fY&=OxtZbnTzWujY#xX7D2oa==q5%yKu^sV!M& zN}|m{LO?^c=rCBp&<_pU<+=9rbY0IABw~pjBfkmXjtE1#I9X%wFF>}d#8Lww;nu5v zq2rlv-;GFp%|8VJ{|yP^B0`ln1UQ}UX(w}Z^@sI7xsp3$Xd4>u1w}LMtAH`h0L<7b zZ!H&C;>q^F1Kx{X(JzwmZM&KeU4k+QsiHEtrdEZufJ*K!!iknTnM7S=Z(O|n<9h?w zYXN#A_rv81VJx1bW;i>;jbjy73E!?CCPy#hxQBCm6ZTt^5)@iZR-b$**WGUIapoU> z);Xk|-%JN9B0OFMznhu2PuSgZYKaF2-C8I8MEh8AaI@a<=0=TLmHfTDBbTs4i^J3u zO71hFN%wH>^YI+jncf_x_w&Cj>lc;(iTw3D*z5N}Q=^XZ?quut7HVK=qQ!$5;bC|E zaYf8zA6+EvuG`nS>6y7Ns>JWex8a(>-d^ZmClk4;9AB&uTxpIbHf3%tkEqk*4QRl2 zBS;Y~S^(P)d5+r-9Og*7^VtQY3u@Rql^W78A$#Z6QcAYCsU40=`OqSn#-K4Hw z!yAx|`}4^i_MD%2Jfo$+g{@Nt8{Uf=9C|Hqh6XMxE*DxHE;m`$Kf+!i29`sAo$yln5ss@1;#%HVa?%?CXDMZzS{+W~{6kfcU~w0DK?$Kacv zi8l2hMNF3Sc0v%59H_~W;TC@ z+@yS}stgd63pnANn%_aA-bZ^i>ve;hsw&)*Q$Ae$tdj(`5{yQ|==vYk^(U_Fr2KTo z$?D=JADAl#Nk9LX-y1iYAiRVhsu-q`tD?-2tAMDriAo|y*<0l~99R$Kht@gIcHW}t z+_7J&-Z{e#pUub)t<#mvJ9QeB`<@%TG{>POsj5nPCn1-czZa22CC$RZxOZOe%Cw~t zeTZp;^F(@I!@VK*%=dGNWE1S>cS_~ar$uZVQ&W}{*0%cx2J7o^*hW!Nk#4Y#?)aNY zW$mj`G!YE1r*U6TU%4@Q*ahk_XD0At=P_e!U#d4~ix*sSPnq6y2b+B_Nale@6qyDq zIk3aq%QrPFdQ`HC^wKpF!&!OGe2JpnU3A7@?ooRtQT_Y8#MN;3VobNhJzFl=3U_Nkn86;@f91+(_$>ro0 z1-Ng>hnmx=gI}*)(!$PH?rO*2d0s50QqrCCUQy+HEz*Ab&l?H+@=-?xMKtRdsbMSR zr~fynsD6=3E?N!qd0aAWLDmEHG=LQwVfm-JzODBal(<#~b($W9W01y5T8(zbNAuZ{ zr<6jEUQQZ4R6krWiv~THAxt@_##d_ZZ=W=@L?kev%@5p$7+eX}&wVp4#ohR!GCki z!Q8cq-qIXfgFG%(Q}dk<+^BKB+@AC7YJfKWpM!XFT->(3Lr^BmxDnkr9?N#63@>l> z4P_pwi*ln3#0r$M-QSqEJ<`j-JJA zMv03z?~fiaN%*S&>ZCX2b{YA)hsoN#Q3= zP;iTt5b@F9zE(ZGDW-yPmOf*KzkP)yx(- z9iGhLaK-ptXZtovYZ1-d0a;hg8|8VEpWADl$KEQuxMk0y|3ZZK>tkvJ zK@?c0C_Fa1{lm0TUG^)9(^rHqv6_GS_b|X);L`LCbnQ}R8G)?2W(veH{&>HmpI=0;l%94FG$H(g z!<%EDvVbqyI~{*Hj41pk0m0dG;Gia)aB;8o`>5N%&JL z#i$OSjI`t>`sfj>s0|Mk=RQHc$~6l99knin@Z}sBUqk&2kF}W2#_Tpke4<9O&M7lD zQb_g3%9t`A-SIt7iOrR$Ab2yJP0~1%gwi6JXjV6ewDs%fwLHW2t6ZD$ zlUWN!QEHu>C;*yP)Y;6nmvj`Hs9kRJVKoHDLSK!N)9^bUkM^SadW=}Zg4G(a2lrlk z?=<1Nu$Xm65TJP`rOI-#!q~sg4gZ#_H;$)8?bHd_5CzH8M%sSY&XFjcn?4T>z^Dl> zft^V2t>-+ZdVC3;R?FPCYN68c;Vt-hXkRUMP4`*QM)KWG;`_BJF~7x#c6Hbdm{64e z>+%iI!PUf*YGwX9;t6tu6>9mn9HKDqycUd2P+jd#Sw1xy*AxwueO}hEvUWrz0^Qsn zPanOmJ!48?-2z5`l*_!q#`~Rz)gnzKq8*NriEgC7!m@ zj>$*#bEAehw3}PI?JJ8r&jq3skUzgp3|=>#gSS*WUTFi1#>b) zt21emLecS%ccu-_ClgZy`JfSW_^Z%?&vkUe?afN75bR`QaRWk`ToLRc#gZI?WeoCB z6g9Fopy|E$wQX$WAP+BhTp@$kTfI|=QMRh~`bcoq^5OYOt=P1jAH4SHWy@IAk@Xp8 zTQL}8_fE&2NqzF~l|R?L+d+LrbZo91eqzE_0tO-4FdNN+K!swpuq}M zXE~)XhbDPdQHaR8&W<1K1;kGGL+6!%!+}rt=A;7QoewuaU+Q!>VO#0gGl`TFqe

NZ$rkfL$ZX6D|3%7mUYj2%63%n!xT zTWtXH9Dx>;!rElRVvqx#QBRD=(q0gAS3U=huWKp?sK{)SIvmg}8H6c^5TuO}57 z@Q`zz*560tqCJl`TCezX_#|BagY$E#f086k6Q3}53kV39ix*(mX@Y-_hum z_v^aATrgsCy2QKxaJBUol;9wS;Vv$)54s;4?lVE9&HhQGYD^ZN3<_IinbF*lKgy|h z#X>_PRaa=3+|q`dIEA!{#jRVn+Km`Pu3CoZtdZR+wJ;L7rx+;j{#;mBgK9@#-!ZxJ zIc4Lg9aLtcTiU5%UESdIJCgh>094wNIo;e1V+}7t+(L5OdI^rVd>(U65UBKj)E-CFqI zH<8y^h%(p|8aZy2k?hpsgfBRx zl@=dFg0@5LVHB^YWs79J&~NCe8QyX^-HrGw=`VKa8-8|deCH$5x4`#U913z1WI?dt zb{=n35j@4hm(EPdzfQAJ30!<}+J-D6(0M5uWBLnOwqc`mv8Q%GMB-y*j|eLcZxn55 zYlRjS{gpe%<(JAzg8*~>t zow`-RU97Q|nAXnTo2+x77XPOB1~Bh~*-h42+qFX#t+M!zlJ2i$iUr5z&t=tOt>`Kg znG8!xd#5Ws8)-VX!}ub}eE2hlBAxLHKisQrIoHmOL?9~tazg44N*L(;e*H1__r=GV zd`W?~ymwH?{>b9HKsuVW-2g6J9!xvj-F;SKPbxZG;fQW`hmRkCizW8F;_HpaoG-ob z?L}wPCF1W3B+%~Ornn7@5?&p?nJ@2G?&r*_pQ+G`%DXjSYCqM14M1gF=Y>0(QdXYR z7FKE)hV}X6nSFxA`W5|$QcBE%#TUrq&G%DFQ+2O;U`tq*gbpIPkL+5oHaSM4ITyE3 z%^7&A%e8AY4LRA>#L)o7h191JhOuaSa9|pXuIlu-8|{(;huNPmdNRy_ZqTLOg)`Zt zUw;P74g{6%_J4zWAFr0AvW(v6#n{_UW%PP78@79Gtt=?8qB!@6-JL+s@7YNXbLc^&JQE2BE>M~?F`zDmYZ#i z^Y)RXi}99m^q?`-H2`I_34~}ehoqN*@ptvFWK5=<_~xhs1G*9=7PC9O_Qo`0-CPWu z&JkDKw_Ic0-x=hyK!0i9WJ*z_3{KUIy^`#jXdVN8#HFd^<;(e^`TV|{**V#o)ZhTt zaJLPt?aNqBjgVXm!;M4bl{xue7>d0YDXnNzjF{Ugg)vKZCaC~Y zSg>62?y{ImeOI6`e^JK6!}zS9Yj7ESY`-27Jr)fP=XjKx-te+W3?4@Cg6hUt-YK*r znOa^9M7Qh#b64=CVxg|zRl3IVMSZFx8RS$K?DaaZ#vBeTf|L|1$F?oFVB*4qP$2XUQ^ zR=$ZwuWX25-f*z;9Tew6K6T;pR5TnFOwr4O))UbIz;6wR9n9&xomnai-ID{9ece28 zk#Q%h0#U2ud#aeLV+=!LoJ|3COz)Eu#Z{^5+jOds*HhtOW|(t-9yQjB-eb4YiJe+A zLI>t};P`w=InIqQ)Ql})!35Hk!+ujUJO51y`-c-8MNb`p&#l$z8<|^*!F$!8TgOyX z{3IYKco6Z-plD{cW*8&Q_KZPi5+FO<=FU^aG(s#lyR{PSRcf~25Xj$tuGn)|%# zCHn!0^dgkSQj_dUKK4%Wc@9)rVLI`++r_)Z0Ciq2%}+mGY1EXgCh;Ngo@d}S?FYmI zNzKR;vs<`+5u|Fle&O>$VZpT7pX-RWXQP;x9gi8=3$IbrSn-nQ90eBHE=mngYsVIh z4gG+Ub#G_ zU?-f2SYzreuV^9a-oAa-dD%XJWEVr)og8dAN3C6>*9H-S3$~mm^5t-NQOg4gRkRm_@$ciGdKn=<+gP&-cs_UcnA)a~64o z!3^sbudhP8EcAF+Qf6t(WAbU5w~AVZK^O!KuE(wC)akX>o2{K5z>Lw=sh+QGn#UMM zm5$FXf>TX_LoZuid>Erir8Gam#L}4)irwWBRb}C=v>d7xv9y(F*+8K_7UN9c$sbJi zH=H8VosXlStnlh)`L(I*%d!q1Vkgf=BJG+xDlssHW zAa04@5nR3vhQmf*2UQIhm8f6jz3M=;oM0x3EA{+XsbaN-rcf21EMAfRSim=T&b0#? z!Q)yVTh}13V&SFNB?pg6U34w+$))mK29=)GWasH95D6VzV;P)QQmWk(9Ap}_IFG2m zR~gX2^E)^bqoDS9I%|DVxj*;hr3QrB!dW)rsC)e?Uh-U5oVq<=blg=?kfxS3HLugI zE;H6|UsS_m?Mhk&t_lZERyI0~DRuiyp4zV4`;cx~x;Uv!qnoo+u>9T0stU9iLrvw9 zh(F$Qd*y)n?+m|`_Hu=ClS&25r}Md{l$5Du^gaxrYk~%>NiN=NXJ-PPpF9W1;7vFK z@KFp^_#tHz8ivVdkV4Jg@Pz<2`NlQ0;y@ib7}W`~8YSunv}TS|76M|HXNoW+=2grv z=dT?pZhfE4=OSXyN14lKe{W40x7R`-A}&N!gQ*^4RNh|lSnfR-d~)S84S%T{%yxVr zfM7=s=iYQIZ?&_dcF+i#-ONK2dPi$MAJKQR$6knrqR`*~3m2ln)P=HNAC~?H>i*1m zDVpl@N|{sg^4vi@ni~bZudL?^kdA4H67qfPzJ@Ga?VQ2fEX?4f5gUNJ3*SE2pD1lg zYt;uWJr?1C*7=ffsr@{41NoNYXL@B|hpdJs;ub%zYpfuh8vEBQ}yqrBJ22J1_X=`}a-8ioE)<}E&ysi5Z1@l)6MC0JNaJJV}2Ulj)`@5EJ{nk_Q}zhedB&-%PV|! z|0CjP`p#xQb7VE_zypLKei!EEQv%8SA_Dd`6d=sWY6a=1@bg5BcihpcZ7qW=Lt-$3Jbnf(B8?19_l*^tz|x553?MGL#Q<8vc52^QEBOwaJ$>X?havx z@#<3ivewb>jB|r1xA6Q=QpVenR)+)3H z<|?mNqS?!c^+Wvj-<4hE${XPR+j6Ss!XJ`Lri3#mD$b{|>!CY#9b;$}mI(p^)}2a& zKPpr~X=oIpu#k0QghDe#Pjt)7_l}oF-*m%M48P|O@Gcx@b*E~v+Lss zHd6Do4``X$Dnqtts=JjU5X7$B_q_k>#lL}K)47Y;M~o^Ynq!$z-;qbnu$xx`%wS-__{p&Ob0e<~< zLvQszMM=MIsyDv&wFoG78`yBKdq$WL<{l~cJ0ZBh2c9K8#HGJBnp+%(j(_r=1%bFb zGI3k9k=U!MUiZhaN;wN!)E}RH`iv^A)qHh!Fn8DvF<(D@`m`=gQ2G5jd-y>Yl>hre z^hK8vb;iS;jXz8G$4T4B6-;pF|H3ZL&l#ohpm&S2_I*i!+$CWLt>VO4qJY3?HvqAk zih7@7VT3h4mMLhUgYY*T>kqdXpAn2482DA7(obPk4s@UAav%M#{4m*@sXde3zx9?-|8f97nFqRaJ@@Zb|Y=cXT1&h8aL+%yQ*Zx%L~oRC;VG$TIx2&d~K3zmmJ$s72LwL;D05+V{&gRCh;@&;xhI=N)j>u=r0-pqcy-=!^NMHV)ZBNz)o9Edet7Kn-cpoolD$t?H z{S}Ut0&*au0*K+E#dsZkg5kvK!yz`LbMlO+@`rUZux73eY%o$j{Hbu{tPkw~pv8Ku zN@+u&t&9C4R^5;4=FdZsZHvMnaeFKo(hJtSg>aX+q+fQSuXjlNC!x*!yA-{$BKBGp z{s-V&lOgpD;SR7ek^7O$qUPO4SznLMt~iRBn@Y2y@9-RviCt}UFv^>wG?f0n_TeWT zp7>!JWuw~8`KHkI=0R!CR#dr^4S;%i6n%V;AU`cmTZw=GrO^0+fE%^lA- zyUk1{&g~opQy+QeKgePKABsmdH%!%O8r1gZ*MJ>MCk!Om4#(+XP)UhaVh(gO6+dQj zj(KU^29zoKD7?v4rSMpF?7;3~+b@`L&;-s#^h%)illgi!eixgg8#fW>FcPslVbJwr z6dRY|AsEJ$342yq{TiF`$xc8}ATF=vRLLoy3!kdp9;{aZF2kK}&OHBjviIZZk;Wu; zzSo++TkHzl?MW#>!t%Wki6&Gb%wo9g#_&ZR1zd&rYpJj;(neK4A<=q+=yE+Abk&O= zt2Exea}MY2gxN;1hhEcvumsD19$j!VACf5(b5b*Ueb%aMyG@DvV41bk4CZddPxBn# z)${J(f$hB)*R6@AqlrU9@lZPhkFfxWpu1OfOIOrYqr*&Mh?Og${!)rs{nhkRDv zCDa2nimMa{3z2vDC&{`Kn0$3V?jDQ;E6idL*q;jCgE+Wx-#(m-O6=Np&)F|3M* zfFkOkjP-woNR^|i(f96Mhz3NZ)CINivE-%UXg2r9?wjoLz%`7?vXfZltMeLbXk4t> z5)J?qo#H>p+pA&sS*0}htE45cTtN6fqrq7D8hC0YS`Wgoll=GxkHJIy2zndS~xm4>g8t;y{&rHu3%C$};Q0R6FLr#6Ty zeSz!7orU1ss>P`zDRwIqinLvcYw*`=4}kVinWn2N-I&krjN;r|)a@+%GX?6QvmCpA zpcGAlFHSME!6^cMWk{NAjCl)pu6T3>YZJ??OL7ao74Bf`Js4yd_~BP}@o@;0u62P_ zsP)SiTMW$)90Z7+qWkT87-5k5u-D0aK@}(%lbrC>mpNsQpQtd^54kp8@M0MUlAj?s z!4k+cRtoJwL!NI&6#wV6_N66#Jb@4sp|M~78Ir_2g8=y6%=#AC87X~4-p~^3<>y*-U zuPtA6pcX4#aAff6x?IXFw079D9=eN5dt0M@sk1IeCsqfr-HE^vu!3vZXn}j99BH=Ep&0aSmwwj?S#FDRh?3+*w-fm|KqTH*7lNKXBva z>h;;sIdJHiwwVtLh|3=C-@gxg{#I)pX|8W)nvM&+98@P0=e`4BVXDkXR_s=Xd^Ly0 zp;LUk@z}tpPd|>Z!r@U$62)(mi}?(5zp>bGp&zNRFfo5Fy0T0>&NK+@_fyp?bJ=c* zQ-uvyMwZ76<Kq+~Z3;>*ypdb7BavMni6#-+Tow*# z6pR^;&=&&HixI(C`IX!Xe#^2B6mzxFN}{ffGLJCNZ@0FGObDr=sQSK3NM-lO=)a zDK`zpo3)temd}(iW``D`REvF#6cs zF`^{do!|=ecxoVNILgi>_fN#LvBuVz&bT@~?R}+mn)}t4<2(G9+_Z>o=n8 zNHIZoYf)#1KNHa z-5j&u&oGyv2u+|dG2Y+dnT0VCsZVRU)TwReK<*xD~K1bB2n{XiL zf-#;~Swn=ZR;ZmQ)MaF#ONs^K9YRA~I)<8r4HrRF6LPW@Xsp43>PC`EFl*4(L(ur2 zLe;-Wo4*J%bqBTTXnMPHo%OR!`21W#o$mjVA8BkM5ZjZ2&B(DjB0Fscq{}U-hgJMm zp921^UQ^;uF87Bc1@NNny)|P>1`ayyiM*!uc)5xNGIkinmQ#aBMS5x~#Y>h}0St&8 zrdKl{*NpA7 zgji;DSfEKKvnK1vA}?RgE%W#5vMCOYmo*UMUf#lFBG{evMIc-P!s*5U(nVokZ;Rqr zZ}h;~a#miGm>MTRurFUw$MrrknJr@Wp-nz3K$@v9+4-VdqkL?;m$mAJIYGCelf!|n z0&XO(+?fczAXL$f-llMj8wztRw5c$Arqm{4ypBv+WCl7o;8a)@6+s1ii~k{V{~^=- z#s4M{LK*X%RJdqH(2alcUaH&k5a?x&pIvsuiRPM172Af&sWis=(ED58>yI13EFrxv zDe|8+Z#_{01Z!%|_XL;gu=sIu$!CEp{ekOkwHCIdSJ?%$iH0o4Yu7&W+*T-+FGEmV^-Xs7A>{TY+IMFejX7I_zo+d8K(9pSU?QXkWZTmm;MA<0t zotq>TqqI8{O?HX;rB6IOzsp1c zJ}G4D-`KE8H9a_Z@wE)|L)!4ttnmQp2BF#>5g@_t&6Z)F69L*$D0Q!o6gMY$0bGKF zD5bt`SY)Dm7nr~YC!Ws%#Jp&J)@qi;dO_N{rP2O$?2Q6?pE-@blzQ7SkB0}7z_`>e z+yP`~*44r55n2uNX#vcVS_V$~^p4wrqR`lUhcDx0zXIeoP1R`;wEOb5f)n~_@_L+V z)jv?|AE~?fgkX2I7HeFPdQx6==``qAUQjKpCW>4JY7@z*Ct=t@-8qmBSCPH(`q_~M z4-M+#DA{beC5!(zuE<-3$=M2TMu2)WUhng;s?+4ySdZOAm~9-2o;__CnxZ6> zr^#9nUPoWP7hQN`3chlWTlH*?P_b!rN~3jgTG+H<|ISic2Jtx&*L}-dsk`Pl>EOM4 z_u7PJ^k^?Es$VqURsRRJN__rw`6jXSM)vX?FJ5~w!2(s!7}0&5(N}cm^3TU?_v6)N z;>0xYP`S9dT#%-Yp9-*q2@E-TQ@*|)nd*#hWv*X;>ZYsYGw_p?! zo>>^1HQWyPgmd&_9pk$9A|fKuQP{I8drrER0Cwm!;oq0(juzFaUCKB&f=D_RhYVV2 z6=0u;0DYbDdl?YSG~gpab!^ZIt9rEy9w&9zrNr~iE6b*2Rk;rzLLNkY`oY9=sB)fk zUY%O9$^1-S+zUG1$YwHTc6RoAWfypkN9q62Sx)w2{`A9bCstB(Gr0fs6RRNl6 zYBwlhVZERhc3>kHJsHgGckRFrbDK{`W$_B_qO^BoYCwDa9?-uU6v5z9xFm(DN_o_c zj9#RWq)p(JIorHs!oCZ?yITV=IRgx zSax;1{axO(xd|tx%)~QwOwo92)xfJv0=;VOzzC=uzWM2YUsFl1yeU16-HiHog=#9E zld*^Onq%6Z28>Ts*gYXTDNkW`yO9p72SI%%XSIET@YoRLO{M1BRiLlb3BOQo<1(fn zEmyrwQg*8YLjU~0Vl5y7X)MaSyg}F=8C{+A8tjgg1TIHXS1xM8awYmVuzgoVcyU3J zx)4lOZf8c0;NGBwh$b0Xorn9zd7{_rOD~<}N2-xYM zfFRw5R6$CBfDi=%=~6;(>exU)q=^VfhXfKS0SP3rQbLm&=_);;LkJ{5zVi!AdDeU1 z&&>PB``71MGi$k`cyiixoxS(9uk#j|q{u&~EQK~X8OwCRic%9W2C-qJrm_Rz)DEpd zi;fbzXB1;41?q9Kg07;L%X`r!S?-MqgImsePJL1w-?pj@%0S-i`4I?LwlD?i0r?|y3Ki1eyRDaT|oISt3UQ-RYRO|e@f>(f%u*ENlp#~; z)mtBrA1@w=Jr4IjSS_x*^~aCl3_RP z9ZJPR!F}gp_EQJ_2cuI9?vu3NO`mT%{7I6}W_0U`w~Cr#^I}7uwD=h|RFit*mw%Z& z0mw`>MN~l&eQj}~`B^&6nEmwzXrx-uQ>yvX*vKozx#!$iS(-#MY zqMi?Yp!)}3?&6!D(X?y{lF?kb-HTStS|t{|D0m!=?i@ihrMT~8L#3Eum7KDa|F)IS zB8bOA+1^Q2%WGz_%RhQLTJH?~zCYfyZa_U5@79HC98vsZjYh_Dw0w0RnP60Ihgq2%xyZAE8Guty5Le^g<`Ou>k z;wH#3#&qHA+!D=)m)Hn!_kEN9C&2PAU%7X^*BzbWQ9N5em&?G!T6J6^u7jPoS3Mqx zCMQJW!d<(5Tupu9YG(XaRaeT|WjC7y7~rtLfB70Yt&m;m)lh(s2VbH1*bU2Xpg&RZ zoged^T8^gqCKKdXGH%@Ht)kU0tY1E`v75La=eD$*8K=<_!OiwCu~!v1+jx#lECLz8vbD@6^H;Xit-5U^>PTF1nWBOY+(WfdcGiY#ezn7Ld!ov(q+n z@s<&Db~_fTxn>O1SoEd;0t%~}hne(Bgm*6}!Kf-;a2=l><(BKsk7+Sf^jvrg05)JW zrvkZYLAo+9xOJ}gKQU{6fhXr=0UkjvvrC2}#pUh7DVDaDozTp@@f!Lh3dDCi*rcso z5_$?(s)zJmB2brXM{CDqtoXzk#RX_~@SVZx$eH84Pf}Bzi~pzydj3G$;W1I@pKi&& zAc$`bF?d^mg8lwnOarKUKo0ftuzIj*b+w55CiAZo;doQ%sVrKC$Lp&BHR--p>qJo? z1GQ_m(?$zQ~xAPS?H9{~m8;$O1*jdm_ z0iZbKgg^myE^wb|?K4;_a}zPJqkho0H2RO7f%l-3`h|k82D_^MqRJbI+(lQR6b>AN z6oXJAZLh3cLeQkiyQDl<4di|?|2QaAB8GB-L}8dV8#I>`RFNgprn(z05AX-G3!Pt6 z$YP$Fi2GyCS(FRWa8f__|DXo@gf^Rl+u+=W>W2Z$Ux&T^)CiP71zO*lf{dj^EEA;w zdD?T27wUfm=X-aNLTUG~yr7_jkKAYB*IR|mcw+${R#*nFXL9w`9$+X(g8W-Hg**eX&Nv}H0NQjjc-4P@xILR?#KKd+8=0mK0JRGaW@HJSu zIal#O!)^|U;B?)r(+?|$w7RfCDbI^w$650<)@&{!d9Y(_u&@WbcBwI$HN$44kk2&q0$Mt&r6%C1PQ=@YR4W^xe?~ok6HZM|3fSlLKou)- zp132g5Z7FySgWMaQ-KVD)07L?L}Y)s`^#T5XR9~%{L*~ z;uetlReFs|y%>y;0~RvPEnZ)KzK5Hua~ROGuBm0zWK8EH1r}Jq1LyPp9Qs%KiUVH0 zttg~=VHATOdFI~_#E2bLqh$OqOf_?gmJkg%nAHZ5rW3m!WKIvP%P(&HlZDplN(=Xt zpG~uqY%W{~NOx6)I)}A@oAk{WoM{@d@D;xRWG#5wDZO~vQ`hf_mSqnNK9@)V~}x*JVdPOFxHeK$Vmbms)A%R@{P8rFs zR62z7pBZ&*fxF@)oExv9Yw~JPH3bv{hu0mHH)ArA7;4d&vr`P^Bkpkje5N#!KxA)IIUG;kbsgv1_it*zw=6_fqb|E+3@c<+FVT^}$D%a+~ce9(ussA?RdKVfZ|mRnyqeVifNgF7fFc&2CU zjActOjTQ=-Aq}-PC#^azE6Iwxlbau|O~7TB#H=tha5#ZMW%xgsN9lrA0~_uzZL}$B z%)>YtzzNUhcykDEdysk`H3bMlSZ$IV>EC&+#h?3s>a|vJvTD(E8w`PP@a?ccH$8UN zj1B}ox|N=Hvc@1YJO|&DV~vY~1$>%6rS=GyryS z`61AP{9fI9+_vn26{szKMg1FYJZ_pfU^%QM8NWs|VAnTH(N5@auYGx5Rgy4NAbtUm?j1S_mTl80%)9l&DNp#bQRAw(JbYXaCCniRty>_}o z54f(6Y?K=SKzuq1aIJI618TNq<>Kz3i4kdPN>JOn#Bgy!^)&oq=jxaTb$N^^@765^ zc)udid(?(fG{tQ_g=FePWLfmPI#)Ug()=B@VGj3GK$}A5YRg~?E&IX9RB9?`pQcUe z>XLy!vqE%y2nkd|iVie^X_xqD5#Y+5;!p~Rzx!PuzV{qBCI8yql~4>;=~*p^ePNc& zmr7YUX6ciVP+@=*CVd!zu-`76yYZOH$uC0Xh8+q{E18&@?mYL*SkjteMrw?T2- z3LxKxLHhAtB^2K3WE|cOS#(AeOOu#6qN^6rYJE0iKLfqh^dX!)N5xEo*DzBzUp5{Y z-=xJFvt>(itIh>_^+F{9quD*02?~--!ju66J(@F`*W5O!1Ilst+ZWy|-Dz(u|%cTmhe61H^qRJ(xv;4hIA||pGHSNqCAF-v%4>8e&Vz6Ei9L=l2cnJ zX5LNWyDLADuwNi^l;fH~{fBxkLh1Bg0TAn-9hk7UCJaPAefpv+j4{cmotb$fn(_UC_{8fXGmS`+7k zbxqRo4X-l3`1xIXh~d`thg}0$EP3p9(01Gg42$ZYvKH-&aRog8 z*CcW4^-f!9@IFLaV4 z5J=U#2sv*cPzn4B)x+K&^Pgl)p{^CzyGEFU+^p7{~!!bFJY zQ?3)bk18{AbZm_y;DC*|9xthEG-PxeuEO~qz;pi>=2ocI_vggGtZ)cw`Mvi7X9p>) zmpc8Y=lm13&dSanVgCoi&w))EBn9m1k_&_i5(9a$`gyzD)* zul|%=oE?y)8D3`3F{cZHw#PXR8u;zXKNN6D+w}!in+c%OELd&-T#%b-#F^z=kC7tt~{c*CcPV`x9Zc{BNE%J+auwGsj_8@0<4wm2hQW7vp z`C6iJ=U+FKxj;L!R~tHMywSS)G-ax3|A*%1os;7pzV6H~-iD0%CDWS%f3s0R9$pGsj7Z(?o>-z<@;bdi^aI@ALj9z-T-J0y?^& z$a6?en!y8gHP3}s&Bn4Fmq8n`x#evFT7z%^R{*?T^_Kw%@Pk^gOfOi<_((T&vmsFN zKKDFr_41{3J!rDgz66*i4diVapSeD@7!*aA_>GBuY7FM}9t;t)0IyY>pZB2MzWeVzSUn%=u z0ODLbZ|{bJwDDzAIKz94T@GoVptdGi04%Pq5#F8?fWfO1fMNap)SU+f%SfT}J;*M+ zYk5J>8>9}9n!Rv_8h<#txXAQ?!c(deEs%CjjrBtrY-w4F3AT`!kV>-NnoaYru-1)e za!XD&lT$<&V%i326B93I9csjAsptH=7eNX9;ecjC%DCEs1*&$wbsqA&`9pOaJBp&f zvE|l`G3QXIzxEibd_DHO_|JXGrcL4Hq|o#7F5PZ!L5M0p?M}>qjoV1M6+tX;F{d^y zK_b4a4E?=u--h4gj?ZIbc}v@?Aa*(&=V+9QaI`Gu+(r91Fw))F$g-0hq2BHHMiD8H zP8-w>7$o>`dW0A`>$}~BeB>LI`bHqY?zw5f+2#(LX(3+HZJkt}c(vIqd$PL_;shj_ z5QS40@zXe(eDb8Ul~V$w8P=!=n&D;ULI&RusDX#9o&E;^yI)RyZGnGY^F|>h0BRmV z3|@0uUa6mMT+IWXiN16OGz< z=630c!s)xI4hxFngeZ#;Ao(Q_DFKb8cLIShTXcpRK=8qn2&_|0wDxh?5xUyaOhnzP zqoXPINvatzGlS>Q791{98W&1rdsx}o{m@Gk6G1GSy2Qwy)*XT*%4A>$UOXg?O`?1m z{Ico}nz4+PVOIaZe1#jI2a=9uHD#f;=vvtqC5(IFCYB-Xp-gsb z;F<1{Sg(!c;H8h+tQCs6K9yQnMc_hSK# zU`MXtB_t@JJr?}O&Cr(%y?yLdYigab^`+-9z|f16RR1q=>4Jk1Sz08fCUuEj7pk(9 zx3VxG#G7JRUQ8B-uGHm_E>vCe@NA9(Bap=${`y3=wY}F#rxJ3h>-K@og^S%H30tCQ zQCf)G$$p$5$aN!Kq**K$kjVKKiBfi3IF#23HSpPu^awjJ7g!~)eBL9Hoi6zR3feoB zmaqaN18J~>TgRw*$qOgAu|s7CHUU=0ulHMrP5dQG3+#)GoCM$Fj&;Vmah-%igh$>W z=8B3)oRO_nn{Br#;f`$jcF5{lhfN;uW!$@bS|-Ci#TK-Xxb@z+*(1jmxC}zr&+M&D z9T}`vquai|%>|~#4R2TVuWHi8>dHhmN`YGiWV9z#lSrlT?Cz%@)=naNb@aa}mu8B9g; zA2=W*OQX)x6cM`!!U1Upji#L)tH3s3Z#lgifTm5qyYSRcZ}~r|{HC=`sM?e9=zp}@ z8>CnC4=0#vTU6*necOXp>L{S-;{>cf4A^tgJeO)`XG~|aNpW9Vx=wa2XU|Q}(Lqu# zN4oW;yHg4>J?_0H1HI@cy3&r0cWI>4fDM8DMt_7id%Tf!E%@ApSz-Sy8w3!Vg#*^) zi3SM8=3~F;%Xj~+Z%9&1Ngj14cACfrh7e8%>26qUvWz=B-8H6YCY~ug z=3r^b0*mM1mojd?U`}^lAfnK;2I9g2`v4+n$kI>&5(}}EWtc7|Ad1a!;7*>8?zJ8t zOu|HHL|+})k#eDP@86x49QLn)kU0d}QB+K>_Lul(JVl?hlB79xEz#U#PeoJ=ux;Z3 zpBlPgIURHh105|OD3%=+qaAXd^||HUzTcJZun?n}CO_KS(&FFa51%dqzU65&P`oqe zibb~sCNQ>hqy$>dmbsbhJyf}TIfvod*99-aSTX_h%l3OpUq}R=ZNCi94fA?=A>3ck zT*{cbyu$ja3F5BIL~PAR%bIAxnu__z=P|}7Di^b_CLpC-nNy2T)6(kI9E;DH0DY4bb6KRTb9Qg-df zx5Ztg2LRhcNdook8~aS$*zy>?orYqS*oVVFlp1t)blfGKbfd9axesY*aUP0dRP=qVuB15RL>0`hSy&n1yb7PuoGhdw+Z+akGTQ7f|vNOXn}s z4rLc2n2*bWLr-0kc!~r~{%kq9(`surC?&n_db-W>0BpTXoyg=!s<&tnuyd=$ zw~SNUkyOAy&H-aRPoOt-?eYS)NxTxc7t23%vB?MR;zK%WK>Cq$dwHWZi0EyqbM9fS z*nySBgTV3%8?u_UvYIK~C=>}=yF7$D%fr#{mVqr=N-s$e%^MAj<*a62jhn~0ujqTlh5%Vi-K$tNb>^zFKlLd*hoTR! zA%qN;)p-_K^Q$WKVUa5VYWRjxZeYu~tOuR8fWsDJxIoeZFkHCqJYp5xj5}OFk!2Fv zv7m!innTBc`Vn{H>i3~$9K9stq#c16(8!S%WG*Pt=$$mo0-CpkjmMu1M`4Q}bQR2qL+}S5&O^3`jl)rW}`vOH`p#Oup(gKhL77#d5}Q zH?DuClnsgs{j5_Jy9vmnQLB zT_QLKumC!MZU@hGi3q^e{&$m|{p~n0gnoRlPS~mIBc6$Pzn}+k5>~im<6+sOn?7#uF@8meA z32k|Ba>P7yM{0>cgqkL!um*!g*JM1fKm+$lV6h~jYaz+6;HuCw#svKJ*Zr5E9fqF* zcU`Kdl!aeMaOyb^vP$YWery@4Ozq_j7K)>FRcaBLXsq)^>FJ zUb+SMb#c*K>7YYOz1*f(i8&*@+dAcH`{Q;x5@cr0Ds9)h8H8Q-SzPenR!}cz*LP1< zu`F8*z%wTjpv%1|_j4_H*co3;iNdrc=@xduMlbCs#7m>U9@1uDX&n6E)MZ{>x_>}b zOwC^SxAtLtzZ<(HN12y!s$~?kZ%X;>b8Dz`;&Yp-`g7~b_wV1&WafKU2%?GodO4L+ zvo?f&J@tM1jf*9+Z7e&h0cBP9TnfYO4a>G3B;5blmY1{HhumCUWAEo5oNEe9tNk%* zE%W)h!B`OwiDZGV#6C##@V%UXeDvtiFi??#68=-6>DW;V?8=?fmQjN0u7Wj()+KUJ z3ZzPmeuB&)kf#?0f{=foh8?m0!Fxw|>aNup+4t0jkMB~}NmoZ#8mN$4@4XDQbovyr z1~VdT>kO*UxYvO@6(C!Xnb{^mvJ4&O;o?YN!_oAn;VVV99V#vEs{z^k)O4S_OJHJuqw7>ozN0hMD)PybqLCXm&vQ;)%`h~~^!v0gb*6Ut z$Pcm9n0f8Tzi7*y+MbbdWzT*MbrRtr{6K){;@nIwVT{Sg%N48A9 zl~Rdij~aL`v&2WvZhEHtb_TTjx?FEUGSs%%VqegU8F07AchMr5QuplhuCd z`g01y(QUYB-(#|?@d}YVQJX%g0~^fShbhLwHm5`B3kQY=)I4e^;mkZ|!epfTY}VS7yGI>s#o6TzPG% zDr4*93w@|Cd!_a&JaI69s~b~Z&k_pC5ZIw{97|YBxQ<^S_|w)*EGe&pUG@RG@4StN zQDpDq zX`mZklk3jFa0U-`i$5}(_q-#aP+7P%k3SsGodowMich%p5G`4Lr95BhZLS&0O`EEF;4VeRENu3ix3>|{%>ri#SkPGaa<3Jd`OiEx!2qGP z<&NxyTMx=Eb0$)jGm!{r!rR(%4S@0Wdl8$lQx%F3QxXys#fuMscJJbEzTyp2)K`|aB!0I>!JD(#?C-xxT?O*MZ#RiyX#_0Q3a7OZbfE+0xB z;dQL+mtrVYK5cc&05c5@P%v-sA%)}~UqbU7o}jM5km6`KR2N&jw0^%G@2g9wG3kWy z|IDRM9rr(C+3FMNfA1JH#Nn(0%RM5p(!03U($%i1g%aUwO15P_DV-`KuNBbE>M~fP|pjwc~-QzWp zj1=}t=iyu1jf1WKab;FZ=LZMY+X~8iQb>SY+pds2# zseHOOo^y?<=x68tcnC;4pFHT*4{RTH}tn z329;7?lNytwd=>&4EAbbfkB_x|J>bM3)RcCmr*XZu)f%elihRs!F??w$XUb{tzaqs zwPnck$>VCFp9jtK(JN8O#Ad!zfy8^iLM!#>p`5udY>@g3`}SmB8-bui zQLb>N2J*lXM_!CwJ*e0{+oWYETxo1~9XVGSlUD@4>Pi3?vt_rdM!1qS<*RppuhE2& zojEMLL-pZI)$B-R^=vH}_0mH-_>%2RaO#Hx&wlk5T8uJ-m*Uu5dSi&l@`H%1 zKcX$VS1*-c7rIl9gD}{+_$lf7)^~`x9lITC?5!d8j06t%mS+dt`l-(x+XlWw`A*DX z*=uRVCtVW_$)37a!gg0tK9w=WVs`h>D4tGOo%sk`?wdw*_Ooa1H0(KF3f@;&2H#pc zm?eT(7t5{2%q_w*pAW${+x3-BRt`rhjMhaampACvY_zvsnd(WXH>wcRB%6(rpG;(S z|KKbS6!N&ZR=~7|{SFoDO#Bf=O`$`tS{YkxUK4PbvU#uWx7st4<~34I@jbD*I*~m7 zn!53B09(fN5v_7oJn*GuWl5HguR6KpRX@hFgi>95e3L0Zak=LY27ut!@};LoT;owx zExM#%MvXs-wYYU|_&GK!Z|U(0Jzl}iV@_v$O8b?^DX zY(doki3ncomnfvSp*WRyKW}t?9>3?bb?(Y!;c|CRQGHUY=X`fjei`OMAPH$W2;+Lp zE4-e!upUigS40pJ7N0(PT+99=fr3-otyWd!OjSS+{H|xlg!xwNN<1keS<7C zjp#pFWISvM8*1%KkSZb`DhyD;vkG-V)by9+nn_UNJhKXmQY}!h9p517Dw5nYoD#YFkNZKl>_?UqLy;LNJGOwZ6l) z4;a~1ZZ^WnXzII?6HBsT-L0H`k^1Mc1$IT}FCK7(`%d);ttTdojlAlQ+_=b1&dv%( zOj#{wln%5(kqb)Cj$|#{M656sq;J{df-*NR-Zv%@SOno$PiJa{59a>v;^Pl;4b4F(5 zL8ji-ZfCcO6M?eZv(|e3GvD^K&7TkdNqFe|;)TJ1h1H5y?=_qD?Uhgn(y{<&%pGTpI>?@q@{(lAR-g{3$vUnHb~ zTB&t}m*WT@tA647#9I#LsHza{?!EpI8T_U5E5_)<)M`ci$`nJoo?HF;S?u^OdU~wb zH>#UK;+8ZinQ-eOF{JIw#gIpjJWhn&26qO?@Kn#9`3@T0%Q#H2s_PCEBrSJeho|8? zL>jInzdYQsge-CCE;H+N?LL{?WO68W3FXwJZ9jF?(bYK-%)hpyf8<1e8efoFmF3xf zj-?wE{SNy6F<30B0ETy1|e$qsgt4Amu&g zO6jpeL_Y_KMzOMJ1hSyUL-mNq+k>pU!JE{#FDUIrvVD`|d+Y72=-=%?$~d{YySa4S z{XneXrXz>iJyfCNJT^WaLtx3+wMq+f2Trrp*^9c%Gt+6>W^v&~-vw2IL?{+LpiuXd z2o2Q{;x)Hbm%)^wk#c2JibNzM z4hq1c1nO5FebIRvhuoT9vxg>(NYlc{N=AdOv+}=k71e5wFY=KBtjpYVg^G{+c&a)> zF-07Fr+ep<{2jR-OX`OUmy9;V0$SYmbIKmD>wcuHr!`BtY9fX;_*X;ygr=i|r?8)N z;R*{EUQUHP(kzt9Pc_)M=>#aopD7^!+TxB?=N4Mj8SmP@JTUHFOBp4dkv^-Yq&%(L z@_pYGIAf%+r`Q>RnP{v{j9#nITU#5Kffoftln%UgwC>(0YF=uL{5GJE+#1EN(RV!A zE4w)7!rv#TRHN@&JEQkDlX~D?i zR?(z}Oo0?&1&wi+q&>ux2Yo)2#QvUJZEKho{~(WzCFT&zW$XxN810w>{(!Z1@<(d% z4$^hC(+-&^l3ksR`~NzM8C|$#1^h3kpwVoa|tcF1@9V zB5nOu{`F&D8rFIOuZS|h9k=(Kr{3C3D`HqEO(HIsRgzUurNb*}eP#y!_NCb}n3r`C@)YBiJXC{LyP*?N03zEUTh9aQk1U4qU^En3SoS1by-&njB^5IaU-od620l zgG97TZ&ja&CVKjTPNlR#a<(K5HHn_iFTOMTeQ!S6T~5%edvWcD*KK|*VYY1caDK+j zq_S_M%>=W(u$q=@%?I9*w45pQOMZSevkQ%sYY4Mrgf-OdDiFH|&zgvzLHC#rRCCs(&K6q0-!OU1QUtF|x$*QHI)^w3SNry5!Kn z=B4wYRlj2kDjj>&^3m+>w`o+XCE%Ul(i1OQ=-Q$fs{npH_!Z(gf8|m8twk&<(8cnu ziAlRtgb|c7Uk1rS*kxbRIb+K&xGPrGqV(m!+wm6kWt`YO6wKvPn%yH}4*7L@^GDc0 z*%J!WuMPWm7Ph0vsVE7Q+76?6u}}sp@zHf_$*f$^VSG5gIuu>;vQv@EDI`}c@gW(F zYDeq;!jG@YAS!gm+M-=oC|;qb)ymDh^e$~H{1qLZ(+RuLF=!aAtExtS3kW%+0CJ#% zj6a%=#RUb{Jr*k|D<3#b60f%FSbZZ-TU#DZ@>~llS>`!2@(u-aE$q35Fy3+lw-+mR zEwt!%lDXMDthopueLNnSQnd!Q-aC=ehk2~u0wzBq_>k<5Vc1=BLjg&;N>qDCxC4-8 zY&z2aHpwrSgI)ov>9R86k%MkrpQNFMxeL|bUruJ8wx^a-N^K>r+LMB9ZP}*M5-fKy&xGneSuG-ct#|a)PWN3eNf`P*GdjFuOntT z<;mo~G|rb9>`<&89W!;pQLbG$x55m^uYw!yfQBLL4$RIB7O-oZ^aG3h9uqI6!Zd^N z@HbRvQkqQTxvm0w5o%xS!@Nnv+b=E>yqSV*-O$uCGtdg*x+e-0`eVQoWNTS&I61w; z9#-(#UPE=%Y4~PeaB08(y2>BD>;Hr*LDnYxw%8pRVEMT6NGR^0%NDW+z?q&(5&T!XGp*qu5R?91HaL2#Gu-UzkIFAADHCeX zq-zWk4kCIgge~mr~f7kOgIHPj-UQJ;9VO zzbbp}9EpEwj2g`_t%0?Vwn8aFcD>QV0(rEN-y3tc{)szQolwU9bf2Fk9J?Vr#A`KX(2>eOLM8>NYLdb)sV4UnL+zPGyyNNk5dg}9S-;wO*GngJ2X z(;tpw9>CCxzAJJrH(xd~!((Yamzb-shta`y#@oR*El#tSY-+s@*$`6p;3CbeS9{(} zqOTK!G>8^Bx3AZKMh4Sg=CM#j2eVFrak^P^rbUq%k6*{29~8s9JjIukMDY|2RpLJ3 zrdoA%gpEoXh`eqE39lai^$h%>eLEMGd^=ZniR&k>l@EVD2Y=jGnt9FNwhj?jh|)Z- zbDx*X=cd>b<;|3vT0c*1E;mnC3u^6i2Pe!H+1~ZIV{7QV`bzuK8y#P(c=f6Uv%$@h z^!EwOFFUzDK&wZ4oBC3MG4uV>plZ({-1A94VEz&BPO3bnzVg-S71xEUVQ;^z6z&&N z6n*e0N?QX-=#BpIWY5MKyALugZQZ^tqE?CG+0I_WdM%Ee$Ku{t=q+;0w=+0havYU6 zU6F2Du?uO{?jS~$yD*-UXE{wc12HJa#fNSydEui4S0#W-F+eugHF+Jhgf z=c#@|V$arnI7%^VM}E-7y5-m0FzW;*8ZxH$RVhn2aBpp|LHQjHxDE(ziwk~Dy^Kfk zv6oD4n#EgoEM982%heBb{bQMS;acDHX%jobKYt&#rw2R~L^Ii){(MwVr{U}LS5XU0 zacW7~moiYQLvBciJ@2snHLdMtaAbScFZ8N}!^(~!CyM~G9roMrJ}CSXPdtQjYr0Mf zM3M1N>0F;6Ea!&+*sMk8QzT)*Uo!b^$2s_ik*T$#wX%FZcf2=4RfSrV$K7(VeXGT2 zvjV>mDt~$$vrm+&M8zZNk=12f=l?*D4R|~|97L$@!@7y2@sb{KyCqJqiAW7Evd!1+#o>i$lTC{=(0Cxkm-$H0k7?%Vzk93 zn4!j19NsCAwQGw zQ8W4BX{OW?Uz{hcW(V(X_>;3Hi!cg*gcf)M%3IBhCwk7Al<4X_#fHFkXf=LZXZspnVK zT&I&Z^okyZM#*Yq`=l83XjWq`c_qzK4-XPiSdxlsg4`=-8B;P$c&nN4Z``VBG1j3- z^>!37Q7Tw{MwMQ&5044hiF(Sf)a3_5rWoGYU08)K%TL|WXM6Q$suvv0&Yla<`8vFD z|NV)en^C{r{o_^y)iUoc8;Mhi08;b`vP*0xY6*J&(rG^Aeb`apQkj*zLUy-Fb_w`Zq|cK| z#H?9>z(h_$R(MjsY3CQ*_3+VZsoao?dF5xSk#9C+>1jQYR97iX#BYa%9~tQL1yrb&w8c)**;73v0MvR(?0z+ z3SR?uH|89_*u95&7g5Y0Rg*;!z7GKF#Bh8xm55>$rbY-|rds<|{^Q6Z&E?=A9Ek0R83geZ&gY-&Q&FrIOb- zMOe8P=s0QHlRll#1~O4RmP+p{Q7}$jjy^G%^$qw4#Knu!wx*71VMA~Cu;~NFL)_A< z9ZRWrw>-VVHLImzPuu=`VwR8GXkCak#=GH;P&8H;HPh@4fblJ1e*3!f9~wL?;RLTC z&_|=YKeU=3@Dbo(ocIa!iQ$@gE_NrsD1muHQ=zOF#5CuzhQcB}fz9oG?3p}no{mAq z;G71!*Y^|DOSr6Odn zRkr%oU=48FQr=#7f5ivqG*#nzjN}d!Bp0P@1zcHk9{A7Hx!w?Dgjy01i0Y@yBiy0$ z24L(B*ac&RnRphe!%VZ@LLSxw6w=@}Ltaebx?b3N$eJuEj*W}!$R9LXGGQP~o9`<9 zR)NP%&7xY-0aDcg#dA|rZnnz!eg2QE)#=!PwM)Q34y4>M#N13NKD_jkC@9GSxaav} zwcK%vKu>$Vit||NN{Rcd)H(Q8kV`s`+p;~$wF7>GWPxis2ZFsGk0@#gIo`?`;k8X< za_OZQnlcW2$TW>>XlN4ZnE!stiEcwbdMfNw=6bZhAE2%hy2cNGS)~&tpe_kWnQVYJ zd*sYe27=6f(u~^5uB;KEtA(gAw+V)NgvMFpvSa0xpeT(=GM9^5MqMY^@w!4Bs+MrhE@6`Dy8-Di2eUUqnJ%Z}m2l*$pa zGrZJg#KQ3Q%%3BlKvgSOI7@WfdHN1V%y6V1gp)nfAf(Rd$n8MsJ~tx+aInELJQ#G~ zgC2e~%7INP zjxI{l2B|7%-9HQU3Q8ZIUYVai+1l4;+i%G=tIxPO?H7;iKQw1PHToAKsF9)#)8FGE#JYOwlA-H-}{0WEe;0iN``Da{2 znGOSg(CdmJV{v7BI3hd?PR6rN)Pv=E_UqhcI}rVW5CMGf*w;tct|*Fr4zu;$Ht^nI z(|d(Z$ch_CSuy*+rXtQFT+Wz2ZCAY_42cXPKg>PY(Fj2M(RbtzR0MtCDgyDW(bA{Z ztC?*W7%XhqOou|B&!$fb>)idz_P_u@22FgeFpElf^$g@@5)=$hJ0nFFS|XrMGxr{> zmQ<`HXrW9;YKtZx7#Uh&B`-snKoKuzF8{_a{D2PKlfNaD5WP3sw9d*Oo6RV2jdsq-#55!+4=hzG1~WG0=M^MGtF2v^DhqP37CQr`4~%+Ggpr!&3l0en$rw^ow?ao7 zLgSz8bGUWM>80U0eTb>A;UPO?NhkS;6}PQ>2rNdWT~~NVx2q-@F#p1%he-0}KOM2& zU~~@9@?*CHRR9@KI?pS>5ei+aM^{tvXK}k^mVHALAS~)YIly>ayMLu8&~tu7a=vvodSkb=`Qc5; zokQfLjxNtd@9eT)IUC$*eS^;dLY|8=)0e+-BI`}-&0IgAP4eU&L<}4|2zhHJLo5w38khHfJ23q9LgYSQWz2Cm0}_u+}) z=1u+!V=*rM#h3bDtYUiKdbIr|-$=M#;RzG-5lBGAEAIVuZPNTR3J>-~(E29Ef&rfY z84B_DR?a7ZEwPbzr}SyV3v5-RXq)a_EcEH=>asg5UZQ*3uInl|Q>7##M!;Bc+XJh> z$w`HwVaJlv=430Ks1!Nut|NjQYyaAGRn2eg@yhscQZWEU8`$6WLEIByd1BfA-k`N%xbD52C{e$0-})90p8d9ZT4u==5Y8JTv^=*>BRah#MK1$ygMn5J&g!G z%3hm4v0PsYZ|&{1u@=L(tBo=vEsNFB*GvogkMWUK`&aZymA=z;b8(Gx!^QOX!EKWB z=>84)kLmT*bXe1rL;@7Iiy6;MOgbHP*N^CiPT_w$qUR;v`V?O6Ph$8^9uPOOX3p=l z#aZt}&YM2cOI~}psMux)o@`^I z$_k*12U&v`Ql5RgQ|H(f`1*XSkNr+j+Tx@qIS9uMH`ado3Kr~}sqAmVc}>e^jUjT`0%68`g?NXV-av~UKHK!oXV=H6>nC=0%FlOm{fM0U*gq>qTLjW7VS_{+eYf;pe8&R4}3*o4P&*A5gAj~uLJh|Q( zw?zcp*e5zUb*)SBP#XJKfwMz$A2WL&S#8-va`;GuUlM`qzo|R126dqkkuqL_jJC5X#SxWY2u4$1Aw^C8Pv;-kZLg z_>^q`&Nmm=`6^oQSMh;31syn0Q0X+rw%Xct&+UWMYU@4%A&`&2dde`gAyQk^Mba!I+rIO0&r%{)l^Fq+EFTwHF2R5w+p!u&SU$&Z0MzS{@QRAdsfUi@;Y`viZ$;MjCa-C}|ec+{j z4^#r=LhPi~uMHZVRqIeiK(GBD$so^^i=wIe&3sv^WG)Y^!cVO_6<5tXBGtyJUsaf^ z$;Z~tVLNqz2E~6I;uxe6%Z3Tqew$nKi>t+MZBonMVzZ0A49c!A&%X5E8BWswCeEh#qzq1< zjp6)f-etPG^_Qp$?!{UdRmTaPU2|JZLWs%m)@WR`V&5ed6E zS4Dp?eD2%(&GW4-4w5t`6+-ZN89&idKZ)L4Psx-j$IWhygY zSKp014bruDzvbtl+IZ8zNcWJ|g(Ao46_6*wV~~@CUB2zP1*{a$ywcv9MWl=K#0CK*vM+_IIE(n%KfzdDIajt>20(uw?k5W z9NkHFA)hzMIlU~|yRwi3L0n1!dAeDq1)^{zGNm}87N7uBo%QZJ4@nMi1BDH~|YsbVA2VK1kU*8s8! z0J98u&hwB45p+%V?)3X#nbgbbmxGL=Y3SLpa~AbkZ%WO0tM7`?DaRnRgY=0;FJ>V7 zCW7~jsl{J6{q8oefvtMsfap>E)BRyu`jKX&jYU`z4$!FKA9BFB`iKq4X+$xm@GpIJ z8N74QPGKS9Dzx^`T6$1Hrv1i5*%MRK09a(ycA$tAYH)lNQ2DhFFd5TZ*l#2 z=TUXQZIJXLp@?SZSX4ewejWV(!9KpIePw56My1q@*0?t~-)0K?NYji{xEzBk=Y_ml z7@#-TtTzk-t#e&wPQZSP#)Z^ryqYjF>;F@+POnteH?a!xeYtr8kIqrx42DEme zbM#UX&*WZNtj5xn4-~s+(VnF}HS+35Qt7qJ2gh#&GSpa|RKJo7MjdxWMKyQYw5bEg z@tR>j3PB)%a-d_bBQO4j_Qnj# z?031pUoLsZ^;10FAXl1Dy>xzbI9gS^H|K+>qxYWZecgV4$e&Y+vPOuzjv_icd0kIY zs^p91>Cj_w8pbfuOeND)PfDfUa-BS*tXiIG;BOO!AQLzeKHf%!C}JcOq3hEg+XtUL zf-KI#>P>NIfJB_K4T6GPw+tM6TmWWzZWq&M! z`f0kXxd15HWOp|z;|*Y-WDdVJovTOzalG_BaebXeG@~XB06{V7h>7~%e$k_&Zz!{B zl*uXZqt{mXCj6cq2XMumnYYr$Ijd>c-ecfH%)v{*?nsMUwQygFo3ICEs?|R@`~Ri1 zy6LCI)su6{#(jde8bE&S%5`8tpVpDrh^bUh;dIv)($*xt%d5c*2MdZi3`b8+9gaGnu5Ru`TMrI>Xv>K{lXAJ>Py_2e zt)WF&&<)totTS4PA!n({(H-w=d#fabMGGdz1xVrEvm5(kQ9gRj&Mn4nr3qv!w!~1< zxMbwz8JKdiq-1T`h4$LFM7lEAN4T!`gVHAGVV$}n-Lnke!ZCx_}!CCXtH%BTj zg$h@`umZ|+6+l$Go?1+n9p&cR@qXzsS+@nS>80{WEsg4S$&;E zaw`$)G+l zy}>oYWos*gct>m0EOXBN`FkK+o3&>Sse3gQ59V{8%U#KLsE$la`CMWVQ=r4C(}kig zsWOh#vuJE}&&xT*OmW~I%Pn_Q#BrXIF=ieO@YL5SFyI6DSjp2f9AX4O6ydBranB@! zj4SU;xq09aO}D3DMVty@8Pkg1`l01|$~7u$k%BO^lyQQIT5RUkH=%(vGB`%}?0E8K zF7%{on@D*zO@AKjXIZjo`yaGRxC5ggMFVsb9$CbFyg~dqs|7fxbUM6PC}$|IVUYp2 zzljU#{s8QxE1of&UOINjb5Ys-1?4xu#WTDNF}$WP3<@K+3?J z03JZr{#^XawAMB@jTma;Kp5wrR2MI|rDk^aI+!8f&+L-8WaA7EpYH;V8|ltQ8ViR# zG6~>bxm}~W%}lv+!Z))d_M5e@=s0CK9oqwR9fm6`{>3lZ&uxqlI}lSpr~k+{ieYLl z30IcWt}VZ>+!U8^G+V})!`<2&BW7i>#~EJ89pg$Uh}{a+hb8)hWl@ZF-33T++6#7KmTj^ztyU{JryAmn-(D zc39ayr8QM3XxWCD)L!Z8LR{ICokj84@Zp7W?&Jm6*{rZW-pC5WzX<%6%Y~Q!48ZWz zRGY4OeU>RT>5BFkkC>O(yOHqyBl|iN@_zO?21fKGow3Ew5X1y7P;sYQz|p`am@NWmgZKCeyh z+yOHVaKQbn9FVe87;gSbrNc5N&ya4>d z4kN`(8@rPMT@=2 zX5joavHeFl{u=-9T2m0^JrPG72j4NY2w^Aii-zouxe1p~?@pyp zzS_FgrPiFap~{aMu{Erw759)YUOlVQ_3RY@dgM`i6gNwM z%FM@LwkbieU{y{ZEy&hd)~Gcu)n{dk1X)LjdyqHORfjrvR;1II<&27lB5r+qjQGdk zICT5RG9+(NjOl`P*yj-cK5&wbLxYf(I~S4M*dqGoHHvL;jFe332K5GXM9&6$nE3AS zR03SEIug>^VMqtz<-vs^sOFe_^6EuC*q~(Epf>*z1ToMAAwj~C$9MKiav!Dq zANMr%nb4%2dz-{mwyUJ@R1F{Xl%1(Sn$1A;hT|q`k7TPKUu;4z6Qa&9Vg%aztbucR z^H_N6ceoa?RyK8<-TdCHGqIabqLhsd3VIj$u$P-aWD40oLjP<) zgEkBE$^SQ#7Niyv*E{ziM=X~HG@Erv?CyVhQj_kSa^E|3@(mqTSf6rTsM<`2 zt*=7n=`9fLK`~Fa3-Q9cF zJ!pNaUM>|EXuI2|=Zz-u(xC_mrppHxi+3+|G!j7DKv;BsXQY|F0uuOTP4BQ=&`LCB zoRJw|R1-uf_k=WJHl}qUFfzA(S;>CMyDz2zyi`>?a$Nj(+}!2@?6>bSk*qxT5zLbQ)^`v>0N7yyZcO&eTIVewK}h5LukLkK`3085pN-6 zsS2jZmcbXj3ScL$twXLrKx)Srl$F=+WZu*5r_Oz|w=^N_Jz1YK>j0cUbJ8Vs%TKut z%GC=@svZ1z_O&32r38sEog|ZQ=$yq&&<>Sz%kU11NVatZC=y`khp3|9g2;aO)G!+e z-BwS?SLiT%?AL2#at{DYXvTo8?pSuzLu_(%@}8wV{3%*46Z4iX8Tpx z1XE4kP(Sfb0$%`IF4q2ykESj;lTv)N4GpD2+GvM?&X6zN^GsW}IIpJU_y8=$;y$#J zv78^h3t!A_!EAKeWSgeG<9QBM4YmKO`Y5i|AGG9v(8l*$H3J_GYBQnteV@CM@+0<= z`3-l))-G-SAf&cD)j&rBpH<>E=d35ZoX6it_uCmhe83)PBC_ewX_37L*z8)n$<}lI zPt7KNBvtHB!=vDH2eeiXDI8SyDI;-w85!DJ4>_-@x($R*>ixr|ekudxGTzdAd!uNXkaBpl*xwU- zbLAX;OjwxYv~bOS-gt~in5&Czb>D;)2`Ge3)Au2?TJE>nW{9Bf0IU<+B+iv#-Sp6U zdq~-OgHde`<5I?Q15*3`)rbdZ+~0&D__^e;@pvP1U&1%b>+f?nEw{s2N4q5Qm45-f zkfDXLK0oz<7x_A5(?&VCUolmI0t|RUuPHEP87VLk2Q^eqWLLVBgYxh$i@Z&+h6=99 zPMo+aVVzKPhuYMXcV@RpbFQB*Vld?M;2%)D`gU%gqS`mzP*9xcENHmE=|o=LCCC^` zLGg?G^JS2R-v<5pd+LF=Wp?a>%%?6Y0u?b&AEjjCHyda%TYM3;RNwy%ZpUI)%Vshd z%Wk&nTC^2CYc4yY?V_Hep`&QLM8LT+I7Vmcw;`>kVd)8Gx z(q~LE48@e%=XT;c^Zp3Z4M=vUc>E{gpb?egG5XtY;|9g!zhe(8o&!i!n8K~E$H>704n6roVj)HKyQv|-=5@R*7h8^~m(wVJ`rVyI3pkSXhW6>>LM8nfXMEYzX*@S=N{f0f)^`IOSalZW;LFr&+YBTb1Rv!fR3wa-F*kjM?K@sEqIbaDwmb6 zmCEdQL9$v~z_OEUa0!2W~U+pIFl5Zvu~jusnR4RTV0!as8o1%;y1FR=)G zbs(8Sd~Lcv0D-joD)q~}_$o7cEQ0oI^dl`}EjCaHixgfuXqLY6Cd|+iDTS}NSI{0g zA$eALV8F)TTUZmO&(_D*ngP8FG23|XE*RAcS=uVYMU`=#f7oY(H=*cvKrTab51=?i zmV?f&QbQk3WkGv}oJk50KylS4CVK}W0yhVkhqhA#Nf||34uI-gHTWg|cF*B`8Ff2N z;XQa4q?`SXSL$qwIaM)hF#oh$bErw>i5lS@uGt*;BFQ!*U?Ct|`feVN8x#@uSDMV+ z{ks@mfVig*Cc*4QjPC4OKrCYj%)x7SH=GYjL{RbTo&Sq@dgOj|uamPwj1%gym@K&M zvaT9a_l3F(%A#5^uYMCKUfEyr;TvuX14fj;W72L9qgw|#Iz$);serbxwd*DKm z%YU}EtAKs^@!YT4 z$n?l%{pFyIn_Dr+?%;^rx>TLv+^O4SQxzI$$Z;msF=mTLeDDwGF0qY+*hY?$*M6Hp zK}sOMFTnVbS^QdBye779UsSy>L@(pT&PJq+%deCv`(kDdwD z)fpw2=re{A@?%~`*TN7c7xL8y;+D!Yp;=LvRoy7CdI(e z>yLXakCYyP_QHYaMoys-zl#70ie2&}UaQ+r7Rypt-<8QA{!QP7rsQIa<^XZ`Oc>Pg zU-{zDiRdH|ondW6cAj;FfBcbp!dgQA&&%X+Lg5gdTo4Uh7_d54UFG0$*MsvQ$vPv0 zbMdP`p8kpXjloJ~)>B zGc_O1Dtn=8nwevgqtdCoGfgWl8dxi&X3DKr$P?wtkcZgnBOx93uG^mw!D=~QyT;~8 zC!kzqZED#v%_k5Vh~j|^h8@U!4)VkM1^q{-;6`4a?=_78S{SyL1Mm|^&{)fD)In2> z)A)3UA*@L98WeB8tpDLZ+xIG4M*n)5Z!q$ENq&=Z6^L{o@xIKE%z%oPKWXsUVorKt z_I&W9vdv<9=h&jw^exY>VA}Kw!#IPRfMN^g81z@A|M@e)_byntz^}ij!a!LGoQHjL zCWwk3_dRA{i%uf*5|1~pXRD>4RvhY2^#=P?^IPr8XW{fb-&L&r?^k}G84L|_ zSyauBE^Lbuv~`*6Eh-rt&rO9H>oAp7vS2<)8B_0-=b(|KX2(=kfhRTQW{Y(T$8kl_r6=Y0jqBJs21NVt?fSjFuQe}G2Pj7gUxtTO&b%+mS?vDF zXusJfnq7cM_?!h2>mh4D$9$pM1h5f6vJbS221qA+$WzhqdFa$VEBZ(#YdLs4oNWkU zp2&jBdjc=mN-0o<2u+EDV6^Ys1eti?S4$jNS90-iEdbQB8F_}*c{=WRto?xRHB)Tn zq7b~COAD%AfA_ZDS^2SSR_Rp!cPnKn+3;nN-z|&Sl|1HcvZe)n04zvSw=FJQ*=6LjsiRP z&2Li~_^@xJc=KaFiGNfFZagsIPYLoDQ34n>4+hK}r)kTU@zI&nU5v@pjS7W3^t5NV zET*4c!H1z#f5LSHly-7@$=B%gq~NB+wU2=FQ=erx!k zo!yB%{Q*QJSzxeqG2+|W-(VkHOLk(Dz8wEDP*&;kaP$EOS7G<%hi1IOXJEz#JnoVw zCx?f%$(gmb_zv~xw(^`Vp$EJ{Vd46FM@*kh481Y$T1k5HbaDDcd@(VXR=hO(rr||! zx2}Nmzi9LS1#k13)gCO#HMnoGF-+TpEyF73XX7`$V9wdtK1F-=pd^xCu25}x9ypv$ zC$05Ljcte*txpvd#Ud}`=VRv*nedD$2XF({=|Q}!zKCmm*F)sx7v`` zXj{iLEcD$yM89%JeH0AsQYe(u=VtX2;nw9}tTZQTWea`nT>IlBoUdLO@=}Y8ijwEh zIQInloC9|>d_iu|g-04Je4ks&(@$NFG^di zJlC&syVWEcXPU>;*kq7X5~ett@=&~H>g~K~yzNCdZB0)S+-`tsoA9ak4~_wOB`^bM z8|rum-e>ZYF;^V;96|7G{LS`)4=QB&Q|>2u*HWBU;zqdVYDB9nj6Ag7n7M47P^JnX z9A_wyvku}ogc`tWQ4ZC|NS9WEqw8QCZ4vF}$=xBMT>T>ZMKmZv8?64na1NL>ly+b! zReV^KX9$9^u((3TgXOcyiPsTTR2vKFEga#Sna+=av;?s9;aXrmLwWCl zG!k0+drGKlWj8?}h|D)#FGN=RE5(`@bVjAA-AxacnJ-wm9TwxVv;xlA%Z~4$ zZ(QEL|AOprKfoANz`qk(!SwN9BgW9$ZsZ@9iiCYG^k{9$;mwP<0h7`lWxaKB=L z>??qa;XUvufvjEhYZ3+c^F7#qaUb0gcwm8p)KdNHYq{%6JzOdwF>Zb685un`ck9YQ zm>qWpYh3W*Lma9+(F-cYp-&wGl|;1!U@rP{U_+0KL1oEfhJUqffc@M2yPXmAQjd|{ zN#J_}!8Phr6(+xSbxQ@<)%c7pyRzOz_J}4Tb{*kn1*kfdj?zw!G|cy{o?%#M%ss24 z;OD#%x%_3FMIX$C%g?O#cP=;2oNS5AKUUVr3*zfC)F-k(p6Y*N#RRaw7yBv-G!!bK zN)2oT|G+FYidg&E#}~mJ0J=m%3qGX(mZ!N%Ip-;{+D)T~c3AJ4WGu9;EHpEh_q3IW zOP8TQ250||1KE2pF3=hjE_Hj~6QDeprIDI2`ioSL3{lWWRi&xhtc0uV(iFnVa2;|`}1(S9IH6PH(YQc>?LERapWlQppd9?pyTKBI( z-){ar$pyTQPmr%0$~mQZiLb#tu=RCi?GEu49x28nufkg1F|kdp#4x1meA~AeT!Vx1 z(iW6U4z>kJB&TPPb_|e0OXWH2?{N2}=~j;5VV8$9*Etkw^yM{0{q@VCYUQ)xS?Jhe z!1ZSl4g0tXQhk7R_7HiiciTLx+Sd23J26$x=|0~W}E{ExLt z0|^9zET^W1U(q0E`zC>kFbW-Xe^@nI&!*&$t+e?+<@1rgfHN`AYmKpgQxfuYF%uL? z+V0@Q{U~SD0RZ%T8l;Q@$@Jd>P|1RIXhk0)la@C z@jNuthJrjbih?3y?4VHyU|*`=^T)skzJ1?&w^YEkUh!)1RKx7ai9IgQz$&(@;;$fy zVB%L7^8~QKa1&+y5m@dI00I^V0joFEKYLw-}_hl$_|Qg-v<>emx~( zUj|e&SZ~;b_b!6{V!_6lgEWN7TaU|1*tvT6B9^bjT-PORvY-ROWDP}x=M}$&%_l*< z{aneO)muH{t+K3nLlu%?fe~&=vC;ZbQ}I@8Z9}s&FJxa(d>s9yZ+O2IEgd~;S^6fy zi~r@77bAqTU!Ef1lcw-Y6&Iz%P3@0qR!cM0sIF~lyJbn?`aDAO_TSIMK*b)EDf)9n z=H;@YayswQ356$DtU;i?IhieZA>NBk7X&`YhM zXaw@D+j-|B7uqB8>*qVzBOLjRBiTUYMl2nWD3M?~8dgYgZI&||7pO;l*&abgCk_(; zm49$b)Ew!H*S@4{;r;cax?$&?)rwq2jW6A3I@^{6J1Gsg5eM|A^EFFlcQ>n{z~^p`y463LG&dG6mMqhYHVulGKq%ru`b|rU|2dZ zU3YA?n`Y-%qxu~I7|38XIyS5O8Eiub(i|AoN_4+KJh#71X0PSZ(ia0k$^&(uLCF@# zg0p|q0e4s$#kILIJNiS#dhg{z5OvNU2m$0YM&)OSt>tMXyl^OyZL!$q|C1tM8tPc; zjK&qMIO?O+MWk#;G9$C$&W+ob$9wH7jr6Z;%Nrnjwr!YCm||;(9?F>3`*{v+rzLM} zCePXD(s&Jr+V5^w1EbJiK_F3%1?~c8JZ{r{f!N?n=k8L2l%m~vH4Q}DGz$0v z!C(3Z47O{l0;LzF7?XRV>*Vk&e8y~r90L~z&7NBi1a?tI9MvIuyq)ZH#F6~w&ZC9Q;?hQVY|g#ZTyKQ9KuoOro&4?`l*Jb78TZgu+(k32MI`ZX&uwF1W9&skCLKy$jB4J;<%Z zYj>gAstTpHx}}=Ra!O=Mxi5xy6-F@(Ec5pES(hbrCUmf6^Lql+M@MNS3!_gD@wIEH zBQRW`z533LVE>$*1^tmi`$hcYM+Cl0=hmIm`@A!5tzd*nWfxx+zRBw9x+G3NsN*y$ z#q`s4y=1n2$L)z+;%W4dlJ?-mPzvD6Ss7X6n7nyTI`*M4kgJTMFR<85o zXER)ilJv9H`IV{l3zmp4Q`OTJZh2^`R5b>#?L7fOu@P#ox~JW>BIz5+b6-OjWQ>?+ zU$|rDR%YiJw0O?>@^++>F6^@YuoJuCG#WLUD793P8tAw=X6CY0k#=JpTT6V8mJa4S zTh|OQVd(lOyGb}0qoGhDYsh=`$!cdnnBA@e{{8$OT>|`~pGlO->0P@_H2p@^?f`1<@m{E|e!oNtXQa+*ZoR0T^=XEzE6w+l=Cc&|UxqsQJ|m=y z5c^u!;u<6@O9w2)&NVruyP)J;t9JsUE}A-__ZU`XdRyBjJj{j*tLWSQyxJw#`qiv< zu_>c_Lz+6+?6u-W@Gbu+h%2>r%aQ_Z-2*j=edglC0iA3dFmJSndEWaQ#VL603C}SL zVsX;$Q->RdR2Ho%Qvg$ENCoK^qqaY^!w|(V0(Bi%--ssAB*KQ*^7SYk$c^yPtTwWzo%88@6`-8S57@LrE5pVw`B-no~{4f zEV^vOD7RO0mL|&`fT`Ev{2Q(jE`$0UU@$p#k5vovg2z!oYlr79Z#n#=80}e#monZB zT}_~}cx($siD}O{o5+$P`s%OJuuLcNGQddJtD$)*$4Rk&CjS@~@BrbGn7Tx+Rp){zekGf@WYUZ^1Js%I3z2HBZ zf-|T4Z+UZ6NLQnslVWfA%rRT&Enip4jN`h>tj}sHoeH~N`#q{oI8F3Iow~^B#7CLv zLiyfRLF^`vdTR5bPF9EYqYSHGPbAuu4St=wFs-Z`OQ`i{Uui&NZ?C>obMUh)uB=78 zl(mX%J$t*A-(oiQ5-Bg9+nTDK>-i&-)F-63l?+`qqOGGG*PZ}2nXHwYm9l2$4gKY} zS9a08&*s%2ap}T{Z1SSk&{Gm>X~*(WJO57Oby75H^(iUjI#IjiTo7g#w(P<%^KwvE z<7)B3{ab}^7R#AJC8hiWq`2|eB!p0#m=i{2+AL9Od&WU|X@+C`-CCUp2ffapw6vqA z>4yGXwOiVi^U8i1qEJU8VR8o7^SHk5P^|D7KwUEmMAq_2+8Z)n)}h8K&I; zn{umFqp(Ua9j?f8si=ctz2t2mAwJT%aig03=P18EcFk)WKikzEfgVyu3VCl3$|A$x zyv%2p-uCxga@W1OHHc=XN!S>(&)fF|>?Ot(JM=~D;K#05eB0$7Cnfao+x34fs=d0P zhxcsD$g%q2PuE{u&}=5w?1r+XvwcM%GSVGBv*N};4Q;H#^<4F40f*E#Pbh_KHe1-TeFn*DeKCnUeVGkf))=7gkE(;5b*G6yEgMWD_Qu2X9wYhX4KNrwmbFx zkFd{6t<;J!VPoo`H&$iv^9m7X?I&W}NCsUo% zJ4vln{I+4}()lM|*aPdm<2-9x9%(yIzsa|<$Uxiho9{es6)tMth+|eNC>8%QYo0o2 z$VS6Wx;`N->DT^lJv%11<5HAK^d^HkL&dfi@NbVai)Ye@yML-&6hAp<&lPEouegnx ztNANqrnxWJniVf*-=w-$l`~Uz%iuF%BXp@x!!)||%{1}l2`=P&{;Bxb2f1$UCLEDx zO7bSeNthSzQUYeNgC6j9b(#R#W6jx?DaOp&ktP9bXeJ$XUIv|lzFqob&BdX!*tC~w z*-YES9!tN15h{T^vx)d)$iD5^F#IK(bpCaZ?GZ`?@5RP3TUqb1l_EXtn%g$bx~q`I z1E+1eUDu1-z90BWJ=Y0u%BQa3Nu4Tu>!u3%H|e)=^T+K)HvEV$_v(guB99y6MEFD6MF6u_rxP3AH#&tI{xK+d+61K8xzNW4&-T{^pgM_Twxsu~Kc%H4~LwvHe{wB4_-;0zNt6&7@jh8z*r?9Ck^9 z@sbL~>EeS%&RRh*Z2i)Nw5A}(&{t2xVA&$oh&`nFH|5tykCA%Yu0CrVxVCet=jITaL{5$^Xf9fRc9g>_y*9<(D1eeiu<-@^eUS`pU?})0x0@FNs~cEmt9o zO<=NcEala2mwJtNL$5yE(f5`a-}x{y(^CBII!5{>B~$?9O&~x-x7Tl01`&#r?a+258Szy2190t!yY7sP^RB_>Dsgm2iHu+*nevOL(;bJde z|CvGhfGA#U0CP`3(Qyq9ZYNC{G3I_HLIuctbUVD`l%NF=D_TG~{HgcWfd-~%_Yc3D z(FgVCuJ`i3UJ+0lv~(GcXj6?XJvH6G@G~WL@=04)oX$v4%;sr9sV z8!cVl5-GoTsSMt{@ZfpNv&`$nwFyT5cP&Be(Y8i0EWND^XJY#bKe-*9K4XX9j1GQH z`4{O-^7(9%eo0+G*SDDZPnA9?J{e`%>byhJ>=Xt7c;+vp4;t1#eArsGiu`7IWbKeH zW@_r|R4UyRbAa&6D{)uotTTH5zMT?&zm!zKKF^n46z)3Z@aEp7%$DT~zQ>JSwkg{d z=2CjtrDS)S^sw$uraoLeY@Xg)x=-tP8W~=di|fN|7*$8k70ECpe994+43N0eX51Mk z;k0QbBDYaXH|xnftcXBINQg~u<6N?-mo*&lwu#I%3GIA_N16jWo(Q$PzW4lwFyV@k zw+KvWpl?Hv+Kg~LcuxW5t%2%sTTGvSgknZw@4|!Lb(m5LzG-o_u z)9MbZOkeVyoVs#y=>jk>{zFJr1@6W6#fRb*MR(V^foP8bTo_JtCixBtP;)pGs#KR?Fp55M5|poC%lyIN#2)kXAlu3=L0 z%#i*zOQge%Dp_nLS71wJ@gEj9cLgL!6_2hu&r`lwz9Z`?cdXIJbd4qYMlwtBHH^I; zn&2g8hG!1&uOC?3u`AxTQ`qvShTi#c1S-~ouJA^G4@{v{!wmjwyf z)^(n{Jz_$5Fe)%aNWLUsbhE`Q?}+ITfASE2yW&Ixd+7J1qFv(&zq~@qQ2+Oy;HcvY z!-Qh3jUJ__h!kQn8ljR7Q(i2pm~DxhzpyaZXG z>w${?duQR}+u$Xtv&FnBQHOiLu`HfZtJ zI-{>f8qhC(=VI3-ndD4%du%&0wpN{Wv}z#kUMRQb`Itkr%p%NUSAK}axTg!hbj{Sw z(K&rtB{jaxAV+@9^?Zi^d)?-Rryw57)3@oRzR8Avub`50s}bHt`hyaB#pd)8vK=dp zzQ1}D$CIU!i~OkQdeq2uPmxINaeN5!&v_r*PJ36-tp zclb)Z>mo_`{-ze@@*$V)sCuO!d3a{qQ?*K%&-dWfOW3>@$a6i&d#kjMDD`B-PTVVL zjm7tOAy1ASraT|Y+!E3SV9mmROD$M0A~ zuREJzfQTS!faLd*%y?m4{Gi80|AuFds*-?XSNo$Ti_hZ87iE_%jBOv71#DUG;M0_x zTgSS3+Y&^c;7PMT#XU&ARI@ACv{#>J0`K*9jo`R2c`4O5eU_{o%a{Yjv`tc^+@xl; zLFb1Vp*xK4)y1a|3-a*Y8~q?7yH{ScO)>PxSnPgW;DuwB5?y!d%;qHdtodG)52aeM zc12FkGg{YRSZmX{xvmSeRw;5j8)3_09dI>71C4uTqM1&TFXP|xCz(-cSp-)m?=mZ4 zeBUrL-DN|7i~3}Gb0<84Uy=G=o5k~os4#`2(w2Q2`0p^Y?(0bxnthU!i56h!47^TO zS6MwJ=8|psmlnZGE0ZmhtAG6#wt$Gsb?#5*z}rve_24Xk<2xJcraRLTS;{D0ZfyD- zx&`8)@V<5rE*_KS!B3YAQjaCMyF?}`dFWu3Fdk7E^8ArL4K345cCMwA)5)q8D;|v7 zUr)rPcf4mKRtMPAsz1bAM}~xdX5G~nn9a~{V*c1vemtCK2QXy!fVwP zrF6U8Q3>-#z)-Em)=Bj0g`2X!$;@R#EM4Or+n(2QvV}y1CZIJuP;$yWvhV@E0Yb@V z!31zV)lGAQ`0xfO(YZ$fyT+p$SzSd#qt%KC&z-8OuS2Y%FWM}2OIseu9VOkNCP;w4 z8MrQ=`VRE~mzfwdG8_}4FupL#ew{ufFke<7J#5g{TJDqXR8+4Pon;nk@pu2VF5XbP{YeSc1NAG`bGAeBpq*s*Qp>xU2mF zr*hofh9jH(yGcyHSo0cgypF|Dq?;#{-mc`%fJO?*}gC{m_vxW_*R?sv)&$+;s82+K7N$pwG=gZL*aZ8i;KgFOZzdNcd`@UOH zL;O5tjPdrocy(d)X@O~?X6yx@YUJ9jpveqAOyS#g*pd~SpNU7$Tzwl0Lh;q2b9mf$ zjSvtd)q#X!BFzV)9en%yy^e-zs%Jx1#dKrQ267!r`c!6AXh3z!xECXhh0yaKfw?BV zG~6{uc*857G;YPJAsQT+afYYK|AZ;dI&Y%*dr}zN!?$_1SG8DEEAqYRXz%n$yZXx} z%QQO#5*UqvPM3&QiLqR5GwY_QspWWQpTk_s4*2$rij|tuoEgsf=0WTDKJQs!5FkxB z)Xv)X;5IO#7PyFR@-ZvHWatz9B))vmo-slb?tJZGMbHE@Gs&Sb8-j!>*f%<+UsCz) z?bj2<1@5OwNRej9w#ZwGD8V*24iP-3CHuM9qyo+iQK}$LA?Oe=&{wIliukke|ov*<3U+alX9Hk<7*OZP-*$6KPscr=|_%D zSJn%)xK)=w>g0q{37w|^kDOq^n6{OC|Do(y+;4F#w`4NCo|sLP2hDfpG#->|#u^Vj zK7>0LX{hnK2E6U{sdWbM!u(NQ?pj7&zxblJO4e{y#2JjBV1KqlaY>TdtTgs7gwXc7$`3w&q(p@@2x5h;9zMv+7@pQp>@-ERd0rbsE}cmH$k(dM}|@;p^33NeXbgM*`^i zV0Ri1ws%4DEnge2c=%KqiJ+wz@oP=lU^Xj%62fPQli9wYtX)DQn2<0kbjO-u?s?RN zhq^c!(1ZjS4c3^geDoNVxfoCl@Qlk#v)8W`Ks6iWVWg3tR_!st+tM!03?@Daovi9B z3oSPDEZ=tP+O*~y{#ASyMMD`6>N0|(WlTL-hzK_nZ|lk3J=zw7C_Ye=+Nh96Kc(*T zxquqD&zM~-|LE4&uFT*!>iEal`PpYt!Sk&W>2ZqEPTcjH~XX0 z-DW(0R~imnP&Bu>Bn-OfntbRh;Jkc^glFl#feSG?m%takDpWUjkq#QDzcUMvATCR0 z!fX8JrItAQD&xeK?GyrEdP%rzgHPI}S1fM;F7~IJs^CtVSbk1=`joV@eH_Jaerd9& zJ~hCxqAqnm?q1*M-xksMd67OD&~LxD5u>WHf-)T0pOB`K}>+~ zik@ZZ1Ps5LD=9DPY+-!3`TPZigRUMLJk(fdEh&gB_->p2o+PwUmYcs&EG?}vSRgqZ zS#@WBY9Vtv2R+e#%p^e{gW!o)6ZP&s_VwcGs&d?FI@A< zo?}-`==vkL)P%>1fyN8u>Aas89+bU1NS2C2w8b{VZdR0oi?ex!EB zSbRfDE{NoZPqAd>vj0?87_y(G!v~+DiyiW~n*c})J`8jD2(NW5Mr5TcYOTnYRad0o zjC4Olihj4z@f<>yHE-`xFRDmo)|t%K_{bS3_}#?@1@Jl^R=oeqx$$Z%kIP*Re$~Os zA4T_}##4h#fqbq^X^>hkUW|D7xukx_;Q3Dd<5RIKHa7-88C_gQbbo6WA76JrLGtci z>`xO;c@6xdrc0!E{8J?iEz8$)lLzoM&Mf0%9cw#o5-A>}tuQBV+Y{K?(UTp%RxMzX zGWEdM`;{;8=o2q@^Tz?uH(Aa*fVB87%PirHw*s$ZG^IJ15 zX<2H#rtV91wmUmczBE^w$Y|;HvE(P-&j<|a#8Zc>ken7yEMEgRE51ydAL?em3bw>M zwgu;P&xWr%l?!p51_ka;x8koib~yt@r`tDO&VX*Xz}@JI4E^g?fTey^B-f|!%qdPx zbcd+)1?3#wmFX=oq6r;MzZQ0#@esN3foo-B*-Tu|Z}_!=J_=mzq}*o9>~C5yj4w@j zTMxu>sHOSNcxGO%a#ap8x>hG2nP>*&9hNv?Q*7!7Rt34w%4(3VBlQm&YIxRO&pw_x zh1t=nR4j46*Hdm~geK{27Au3!fU)yM%4`Mh8)DxqT?fY|o2*9KVz95H7Cy1w&iSTV zQCyHDj6t?xKZ(Z*1mi>;+moqH7w>r#(J$f_cyHTQUaqM(GGO+Y2KpZk74?dR(uT7#o;f7Pfq7@LoNZRzIR+WF8-Qeins5>v?I;*z|A$ktZOH@mu1 zCwQ_e{JPh`lQtd%=ds2UM3Oh&{>Q1~9g-%r-=<&7YPEhmVGlQN9Uk*iT-`7NcznVd zPf%2TvDtWBek-}kknz+}^~b9Zm+Hc9oTV<7(EDbatDZ?&m2U-D#p8umjsV+?M&4%( zjm#%lm#oTf;a)d=^Swxr#-cNxI=jg-F0DIW3~xqbQ`4=U$x@xAx3M+Zv)yW+%oZ>u zf*PQ;%Dz${uz0hkOBK<^v~xOTvvjYRGcQll5`fg3MnBGk@o}4_TaBEmn-SYy)*%Ew zBXrjj$CRt3m4%dFo-MbQ9(ewY_;Vy->bAQ21H%p4;y?C|lTyY=n?r{u&XDZo%}&qU z!N2o{n~$I)Pjwi>s&4!g`=pCKv*N=r2c)5JVlGoyI4(@(bCcm#|0nz?6WE*1&?w1q z=UV)NsD-KJJ3G}OuEeJU74G4F{@>GzFb+awhZn{9Adup<9h%xKuu0nt#9a%kl zN*mJ=J6yKu;??%|ehtq2_dc->CQ0B#PSQSBF~(GQIISckDErq?phyuAup$;jQ3x#{BE3nM62O8e7_b2X0wTSJ8XzG=K|w`& zCnTY_00BZ0AS8JwL3g{i_p{G?zC0h!|MJ3=$&@uSYu2ptTfwGA$Lm$g{R>mt&c60n zIAsMLl#lx2cirGk)TXJA1+wLDwkTOZ&#Ac{J>bYou(3|PXt_XX$L-UPv)+Y!GxuV6 zu>_aqnHtjPa6}V*PIYQuIj|hxzVu}{rf*QVF7bYcUQz5M^2iZ?!7YP|kW!GLTi)ts zRi^V+T$8@Ro~RT*~?WPwM@O+X`y;#R?LhqXrtzG#}^A4NRfPLPgI#MmWX zBm}P~@AYoHL>S17nkD?^qmf$0g4w_OiuzEu-K17kPUeMPoVf{})$3IuSh*S@?5^-o z-MohQTej7s9_u@rN(;;3#GMV#v)3ISeEK=HC5chtqnD#1PMXqa1FjW>X-NFjh%@JI zOMRHVP~)xCcn%;XNCuLa&gD1kYC{NYaaV8|y}07xc$VW63p|=%)DhVSWQYNBQ_9Y~ zwI3qt$-Y0rKK20LSdN$X`M?X_jI9nAl+Vv~3}3pLZF~V@ew(8}82GM0_`~@>T0vSZ za|853>&S&U;4UQjYRG5K&GyqTb;Emfij{!^Sowf|dj>~G@~UcUrhUfCny-ABd?{b< z$BbC&Nnd>9s&{z8e6K~Hn^s$vh{T1jX~Ts#oo#u8Z{9F^`|XPom9D6Q)&`FGMT=F7 zeb{p^o}aL}>A6WN++aZDlwoE$8=3xfd1$8d#DcLzmWa<*6Wif}CS)4yH<9~|K7)}; z;}y8Qxk86hjx(iVEM)xE8P7#ar5_8J+>^Ut?H_f>$L2o5yxPakIpbMNRojQo=8C7# zehVGK{4|&?1Pw!;W z^H|L8K9(l9z{p!^Ux4g&`_kI?_Lt+Y9z1CYNA3#P^WuWM-N^YD;#V1P7BkSU-^~YC z$af>ts-@J)qJhLr9hlW<$dug1dVup=e5r6S?}S`#609f2^n#Cz8@p_%TV)PuC1Hyu zKdqr`YjZT(q61Y{(9mHWhRVi87ld8}l&-i#k-N~!s9pUbF}K;UXOKS*CoEzO#e_z5cS{mC}L_vyI{m~ zN~Y+Q(ES(%Z=XAAo^Fd;Gd5(cOEW%)UjSu6oaMOC@Dx35lc~}`BlB5g$NdYw*Q^7P zrb;Ql)F#=?ll2J^m=HGn$PB?!L$`+PK9+KxWAd!;qiBv4=5+#NmpZF`S#&R^R9n7{ zvdy1uw}}P6DySVj)Z`bj3pWtaN_=vpU;4zASX`h)EMl!hD_*I*ck?pTOoWBHp0G=r z8=)hHow2?_xxL;(mbZItk-Yde8aA4mDaub2RpWP|Mq2a zX#T@2QkY^`i?dFfY>NLV`FD-8Db9T+z*JYzJNY}7xi(17v)^0rlJ&&|N9ZfXt1bA*H%_lSBGLr8J_9fE zf7irrmR@oe$SG7fe$DnFa5~caDth@h;ZJAn5noXk9r`OiJQ+tG-S4b&@bH1^eIa%) z6m&z|hcwc0zuIr~S9QGg&dF@)MtFqh6|7y?&?k!vFQSz*F9bB~EAZ^diHgqMHoIr< z!iiycvFc5m_>_9#{zY-^7vH*E%`_#C+TO5&rWT!6`qk)~s@{v+0sZUudhwho{+=6} zVyGK7B=f7BH+*wR>`OeKmVqoSkSRK8DN0U9-ye)kl74AtdF3PdfX7wN0UBsGb4Oy- z@Q <${;ENeKxRytmfyVu6@@eM{7VUh-&sq-SJ9S{o~}cde|1q`hJpKMlJd=-}gK zJ?`Gy_exn&`lAXf9<}Gw6{7T>%JaVjCcIg8UK?o8Mt*llCAd;aFQ%O~DwkSS@$n8= zb7C5mS2ui~TaLiwhzx;y4sd|OFN^X5M~Ek|Yfi7Mpr5*lAxt0Z9{WsT)L8{BfGf1s z=sdi9YtD$eR$|}XgTuv4zWg<&Pt#9p`IEg1>a&65p)IMG$g0Yq%tqz)oly9|td}g2 zihB*zxgTI=3CXj_P+=)Z7h(=^w_IT3++0~agrQ$MIM{c0w5)aX*2m6c!r1etM9-XE z{htn`(Vn_fs=vi#Q=Yozg&vxizOffi<<%?9)iyEau-mOG(AN@w=xdMc!#D}nObDGZ zII+I&*vs^~`}2Huo=f!FU!pxD3FOd6xrST59&6Qzthk!={>#JcXO*&cvZe|isT-s& z$V;g}V$Zy6>~*|e-pm&6y5ey?JLs20_VfMDsO=Sag?jfCgI$-he~nycdifS*$u(nC z?WWNNSHrfid+JgbZVg?C1h<+UFeg31O4R3P^N6u)!?)cef+W8~0pQ0bDmM4(2G|;T zUVC{#uKwk#_luuje$MTkX1|%VG<7aY-sk`6-G|GuafkFrc!1)yvyTd#j%+1HL#K|X zX}+|U72YXP-osfP8>RzWs|<$t_LVy>+-ze85PX`eo4WUW>d$^)WSMgqqHuguasN^P zN=(#E~q#^n;Gk8*&4{gUqbp$YF}8I)Ujzl9L7 z<4gLl*WFdO-Z){adSp4^bwMTFFfmXUWXu9g>8!=F$n5BWotEbY?$P;0EDw+l#S2Zb zHEvwf3^{mj$0*~(Q;;zmD2yLp!i@N3P8rI*?h9zUtLfzKn=d20_e?Zy^2rfdU$3mg zhaHdV$`3kMq~a6TSw7WWS5v(WSW)-#S^DeJk|f2$?^SdmP+}4h$7Ma|eYFPZpE(Nu zod6#8mFNDo-{X3E(VpjHFMb{V*l-KzGxnQ&1I}uPzsf^eWR4iLv`0n)_xWdMISCcN z$H&}FK|oYpinT4Rf^P)3H0=?K*I*|nr(ZIbdnkTA-n4QH?XKyL9jATO&?yw>KwnI3 zQ?A*A?9p|J?5~s-UvJTbKu`3D<@o%7lOkV4a%qu{tnx!7L=q0^xm^*c;72xlK60=2 zhGacN-GA!dFGC#9{ApzP8ptDz%{uq~P-Vu04GJFEExiK4QwqI1R&O*T%jpbOMu^a2 z*VUdE6YssLkRU-)+V6WgYr5`PL7_0DrqA$gr+?**6aHTxvEGEU3h0lRm}dX>WVKzQ zlo0XKL5AX__XpBZ(hNPpma^osy|EU1hNZ-By@#d@E)?O?o)74f;;a$)HO@Vtf?tC4 zX>w;3JRg=JjNJq~AsbdA*}Sv%a?{QR%F)VbV7IP4xvjul%qvHk7LW*ZhaBAaI@do! zo+a{npY@9EeL=H|a%Anfj$F$I%vq|OG&j7SYv#Od_!mnxPt7gBP!S%uPzJw0c%jJ)Y?oLIiopS4%G{vYWLZnlA@-aq_3 zmZyTF!U`H&u_SKh0I32L{J%z5mPojK{eZ9C%Z)M-Z;N`t39pdf`Fp73V;OK&zIl43 zv%5%=!kocu2AY$5XE~@P1Mys-z&gVp!RU`ul9|X?LQ$NcwbNTcU8f)Y?xmgsE-C&E zUw^%MnA^=CIOVT-E&G12Y~=PC)Oz zhbtQL$7?x*KO6CTsd(h%0`K&C#A=>_u$O-cB{@I>QHhe% zD|bAgi3B=}o!J?{UsJw=1GvRO-Ui5NI$TlRDn|&$85ZdKX(OPJUhm5NnhO(TDMwn1 z*na5Fkh_63C_pUu?)d~tFFT}gngpLNhYk8RaKg}h0ca(_b_IZr3A3sz7t))+^6^)~ ztw5#3w{`XqIH`d^SW=S6=r{nN1pSf-C&6Y1Kup{pvU>k-R!lE0C3*G%#s~=hk&}!9 z04}Ux%~%4J?8~K{BtWbm0D3j9>V7bo?oihkd4T@$x!u93P&INTq5@=g`y25=6e7jQ z31Bv?R#I0y5lz4&OX|tpkL8 zo$mdU28u)7^p{J0 zoYp`0iv}9zg<6DIc6kM*|FjR|f!yte ziomZzmpU)DE`|X+q*cYHmG##3HV1^r{2se!Uzq^5a>*&sC*W#u0rn37N!x0vS~cHE zF8t@-{a2FPI1`x{yvU6&IT(qM3Y(v_4?qS1MA~8w62vn0sd??)#2w;7qVt<{5t6GZ zpw;`p<9R}AKVOfW(3s`g@s!FA+7Em+?tB5Fab`=-YbSz}2@5<*f7zj2EsVw(*cvlp zC84ok?4Sq;_ndp=oKx$n4&Jc)%giQ^m~m1Rg2(adpXXOf(Y&#ho6?Ze`j?c-`zK?3 z>_D+Up-es*^ey;sSB$$ndGb&FWvOvLd~bNJ{!5AmcOU-1fO7qLk3nLK4zT|;Y^(sW zX2j52*S%ZKCtN(${&LR@?V4p371I`ON%^7MK)aT5fHpWj${X7;iYG(v-0$BB+_1k*p|9~&_ z(G}Bm^CydhyK-;lyc@Z#Ct=B%nLsWl-%R{3D+6RnB!P@(iAC~YAuNPLpFH4BFe{zQ z_cEZ_toNdi^Rn0_{V5%zs$$6Gfb14m8{ZDi*g$wusn)-7z zW1!QV-+s!gNcuNR`rop|5DccpqtdA1mHs6hHSW7Z(6OJaR_+o$VsOn}J~N^~9PErA zAdI4&Mf6t8m2UUlx*Q(X*ZT!jF1yFYXhE1A*ywj6)s%ubj%QF(vPqR740+d2_atYh0*u`Yu-qxJ5k(HEg;1^u&N-Ze25iU#Oo)Kr@P`K> zbMu+MP;SV=*vXSUanf{E^tVfQ>;AdJ9Lx^nwLVb6f7$5?$3Uvd7f^tkB`y~U4%FA? z)Tn`tZ_J<&WJ=t6 z+)E3YZgcT`tr#V{+2SX=(0j;0$n5mewP*BK~=t+;mJFCVKp*fYMD^V+W)zi?+ZrVX7F2taZkY!jE#;MM;`XD80B;lB#3Kkqn&3V6p4 z9No(k(*J|2h{(YiIb>#YWygp? zUoaFPJz_p5Xuu9d0JL68*8;ow_CNE4KR`A1Q%jIPU=qi;WC!(dghv{Hp{dPw;$(ps z+Wt$*Fq)jI9BO6!^HcF($fNdx_>rhfg%)+rDgh`{kSM^adIYa`y>okspcnj~FBbo9 z4-@VPNYE}?PfMz}BQFBH(xES{>27)BBAnxEnn+fX8F7d>fEF9zL7twI@FdtFp$%+a*Q}sdG-*_mrrIm8Bg+6-W z)U^%UY`}bcf6ns$ejWc$w$)7n(2(EWoS9=0h3YCIDqlH`8-ZL~5sMsA<$@i?bEA& zE8a81%qF!$butfLz`qMdrP4`n7}{A`d3jmWQ5Ru!eZXDib>B%$WM^c-34nF-#O#?o zAvejnPVvNq&^Zc(@6T>nib9Ubg=BCs*ga^wz2vM0=Sm;+t;OiB)TC(yx2U`TnRB21 z{+#q}8l~z9ceL|?&z|{gUA$_3#W}!(bN9J@|8^Cs0s$&`7IW8})7bZCN!)@%%(823 zpt!^+hlj-k=X2nJ*)w1^`%S}XQU453&u&U^{Ah4IX|@u` zt|v$OVd_7A0Z@!24sPTq0CrP;TS}@7&FUGG0bf2lSk*wOYT%6Yna^MP(sKS{H7Zhp zBc98LYhAlEbOr_reLfr?tPIL?i|(e(a2opYq^yIP$)#FAb2;~ynElTMsKY}e=Q-#* zC--UZ%c98ik z=2urbXCbv>M`4DSTvK=~mFqC(3jpl6c zvH+}dX|cyrFEzTAytFV{R@tdQ_kM4ZR^-Vu{tg3WOL+K;Dfl(w>mU<&@@!s0wUbll zt-v+&rDp@T-3R{*uW4!DNG{K%MD;C(Cp2!{2=BO40?;Z{-I+_CWcJv;Y?rc$jxGL? zV~WX?15BA_hhMZI)8Jl4*-00kNnrbmc~FIC#si=9sTN;}XaB<9F-BdTl1%E9Vhe=C zlg8M$m;vOcX42E@l4O@t%j|kp3Df{n7vI)9%iObDY#b)Z6pu(B%}c2Jz}_~n$UeW& z=#G)Sk7bt-rU{VMLH92I+wD>{z9y#j${VE9q8~n_asESLY>#Rkv4~g*amrUDm3Czg zxbOJ&XsE_*1D~WGugOFCg3_J19;(Syo1KhzwZ1;}9Ig;nD%1F-q#oy0p162tU(53< zsr_M%J(bK5Xw%twe|!SAG0LZr2(ru@&&F(}Thtx#HG_1v^^D}Adwu7ZJJ-$9B~1*@WBM){aea9jl`BhKC%xQXOLs;;$t#5<$o@c zu{rQrKnHP^I+ltK2rI2H<2O!cn79?l(!6iJq%SoU&XRaq?j<0WnC5r;9{Y)nRnvUM z-pCwu$5uz@8QS>7QF3!C=AtN)cmoT9jtOOIzFSXOXB8FdN5?&?SL>b9Pj8GW1FNl> zf+?=3if43oK*N`zwzkFUydjRmJvwH?-ThMgO~;fH?mrF*7cDIzl%G3_-Yg5 zkcN;ei3dH|QisiBNM_rjWzEMokMOqKlTCZ;zHov}FOxvF6CbW2lrK+s#>v>!YvBTC z9{W{#YYCvqu7NrAVriBNC50@vaLs?Nidm zGL(JT{F9n@+u}t&wG#Q&>D0g?f?5l^UUr^TpPh@ojq?`lDxCBru-kBxrWeW?IGz+K zjD+vd!a*F;k}N}Jn$9QGEn#U3Uye;z9Ms0PQc=we&GX^$Zlo=kG>?EGw%pZxc0PaJ z8Xnc?f5BCQOzb>Dpnd{f9}l`uwaTUWBJP1qu-|&&ILFyJ#pwsue0H$mdIZ`-#W(x$ zrD&3q9Zi+q@5gI`bR=3P>b#k*GK!WncRgheyGgm)>}rC#m209jd4_e;yk#AUnl$8+ zX49>FY{cZ8RS6^Ct>c|2UHB>w^d7F95^b`$$lq+@nQ~1?@b)fsnghM3IYgOi5rEe^ z^|MTgatk)OLav63_q>#Pi zL=G=9pmmebiRO^0(c3cEVb80^W_H;f&V|p(;qFO?4<1x=aj(Fx0?CI$nHvurR40$D z8b2$wH{rNvjbEi~k?XcJ)ScWaLsA7L=HM}*G9uBBZ&ObxKcwqJb*=LTqwzpqW@5e{ z@swI$J=^O8pHNRr@KulJA#(fbX{_k3;i^jhsGQ=B1k#03vy-SMl`z?iW8Dn%z6TN5 zr%yLesRvR|B&fT@Ff@~9`nE89CrYP%M70q77y}LFEfic#^Hc8i*6_p=PS-2ga`WtB z)}~1si);`SoiE$+Bmse@i`{9QwJQ=b($Rr>Tp6l5fx6q65wRadB=hyJ9cPO;^`<&RRiiL<2Vh! z=YG!Sm8N7f0aZD@XOQG40V+P>YKbi&H0lZS7np|lOXbbO>#Zeq#>?}r4QzkcQjU`7 zz?bn>UHfnL6dtrpZ4rHrR&8!9iMnK|C#2=^Ue>6v!8n-C$LrXHh;EHaH>U&v{; zP;r_a+_?XWcmH{&=G*4Go@%+R5>7(e%1cCVmwriaS8=AM$giXc&$mHSZshW*5KmkM zWlubD%qMrIT=wf*_WrYobZQ(DS0kf_Cr0I*>z=+3@tr2Q)ZO2kUBND*ms{Nfs{Fuq z%%*uiR*_uVr`6@EAxgMHHR3+)kTSLcPxb}&z3E=p1s!`vrL$9;qpnnR9Usu-;pfui(WT1O8T-e-n@0~u*(SUPvQ z1a{Oes{S?lxY9*(`HQ(R%&Ku4JDRbwYKCs33#@5jK4xp38KxQjG+SWUVW9RHx80XAcYB;4RGjJVa&X z2k2c3&uMFA`LWbGh$E4;hwe{%F!Am^`hI99hO$4{Uz2U0re+gcdNbJRGp=8j#*-o) z&pz-tH9s$a9oAs8{e27BDZXxOkGikZ82O%7ER7Ah%9A>BD;J&dB&wCTme-%Ed@}jP z()K%$w?`KOe|aW5&z^kUxW@vTD0_M9A`$tyGUg}|{wjNv0Zve-;hq!T;mPiAH^zAz z5~AXr%Qq0n0Xo-@JJiwev@Z(>r|+Kx4V4Tf9s>*)+ZY!9CjT6PT^(QuVXw1oqr!qi z@ELExyHO3kB$7Al$#om2mSPtScH{HWl7?AD)$zH=^65ncRtPl{>4FQ#Ob@94BJ?~D zsKSwrm2bou=5LYHh5UUJif{SlZBsnz9cTg3y747VwC$oEb>k|zVH!EJEb}IZ^FqNQ zY8F{K@#XJF{IKlk!{#K}k>nXUp53DV?E-jm^u7gtH?Q7&|3I!9txO=Yq!`)V{i1M_ zL|I$Nf_sN!aYT)dn?&D@yO3msL-VNu$HO$*RQ5Z>OcDIvGk;BqyJ@JbEz#Av{$yM! z*(-UyqJjddDep9d@AkorjGNI~H@@J@)OU2~YY+GJTY6=TJ!D)RL2Wd_Yol4(Z6{Gr z1V|HS7{b@C^q=L`QF4O&A6aY}_7yVjbU1nMFfVeMNaagA@HTIJN$st`AR|eRS2B7y zrzjrHSK*G(4ieJdA0O-)h8abht&@PMet~b#!tyRb&5X^uB|U~iJgILwwK2jMNI*9( z+oxgKut!-y8)9Jrh2B0js)X9v*k;7vtAb@Ijb&@;|H=x0tiNVa^W^1d8ATkUWZh_D zpB~zXvO2p;F4)sE;FpxR{Cwx?_H3lnsF|`GN=qPjHlf;=;NUSv5!9D`<2iY@Kn;6P z)7-8$JTV;Xb7K`U#$db0jfG3>b<)MDWaeA7XR-s;C}Bm9m)=)WM!mAV2`{lWfroRl zN4;abH+hV=2r3VZeRGNa$P%}G$XPk2uf1UeFB7a?2y~-q&TYs|^^>Z6k36X-+HKK% z@uY!Z>CT}~Rj4Iq;F4peGV=u*>Td{1&Lj<}^OcauAGOFOZ|Mfqo>e>#ubV5STHqb? zzWxes!>+3Qt}{s*99@HuSAvjNUhT>?8fYhi8iIp81vN~I9ZUFKcr|bC(oK>M_Li2t zfqNCh?^qYEE}N11{4BK})*RA1pY*M7%=o1027WMyuPH)^;#8G#*@xofh0J5Lc4c?d z3`}Nu>KQ|bgkeWWq)YE(|2sxf#~R|XRl&$0kL?m2f|#`&Sx4eX$GTZXR0i9^pVxzW z&kz1)c%6t~N4s|D($&JMgGCj%g;Qosb;AOC*zMc+F@@dn9y>bV6`N#DX1lj~_iusA z3fBmbLQl&sHC39)9l~3GeYz;t!JqOnKR>U^gi3`#k9gNF$xMr;7i4zV^S6|T%l5r} zhB|#1_3Vk3RJ+6J7%P|fl~fZZ zK)N`@eEXUBD^o5BN2=QR0V~B56b^JhKnHnpd+5J*B=eU8rzMOr;{! z^7FLn+aIGS(K(YdqV(}IG(Ne?nK`u5t)UR50l0uumoynS(|O*6HUXFIdMChSNSy6Z zE!Kc5@uf&<=47Az5-CkJ(DNd|#tgSNw5)$3ys?>mr=U_?#p^4q&+MLAGcg#E_RUjj zEDal_RV_M4aLc^_!uuGl5TI^Xj z&Au0HCSuhXakrKrrv3q*kb#x_&>3>yRE6NMM`LFFyka~8^oq&q@H-{PCP|5~YHaa2PFWA#SQgk*O~-W{F|i6sYWW$%ujsZ8xAnc9kJ zLjnv-3kte9_Y%3v<%ErauvZK*_JA}Q-T48qBun;w2H+E_AuZ*v0$tbYn3P(?P4(*E zsdHMzqYPw)f1@&t=Lc+J6%(*@!;S$_`YKD5eFE*jHDNb8fYfE6i@*vX4u5`(Iv_h#*ln_0Lqdk2$=> z!ycDsp=##n+fjWMSC>DdgoABcihX2@-!-QT_#$2c3QW#eSnZDQ{go78^U3BS{(#Z` zEAg&L+hMjobMuF#!40Kq|I#xI%iu<*Y4IX~$Oo1Vh^NmZ+P78^sY`bXS+bWCi#`J) zO^qDvJMR5~kE~RY{%9WX4Se8ChRz&o(^%DS;9Ph=HMGmf>m$R@b;L9iy>LGPrvX-^ zK%bE40XM)4UG8bT(e!4ynMA!5fo|2-`~aAOf%)Zxsep8nXHpp1w%8P&hwD=xrEeE? zlgcBJgIUhsmb^02M!N*#{v}qtcSxdZy0RlhA%Grg<)VBTZ1ea@gyn zIhZ0vkpHajGs+ik>v5H-`_kRbu< z*D`Kf_m-Lzuv<*fuMq;v*J}*qZN$D&Kvz=&zoox)@?&YxKUfCqZSUdJNTja%Hnqs> zybGf=FMRyY*lXC*Cj}Aem$USHy09ZJJ9%0n?~m|BK3+Y7nyKpAaD7Uh?7h%6dp#Fi zGRYO0cs>Eqf?4xMk9(f#jnpK6W_Tyrm)W2h$hz;BkUd{&H87-7-~%wm_rASfoceq_ zwE}VzV&S1qES>IhkbuVx1w=$FPKw}4=s|uk+gHswpQP1HgDjfo6rC#%d_-%wpuOY1 z5Gd?RCVev5cle*>d9Yq$?9WX4V@3w{3LS1EyTp&m(GrM!Q%GL~oO7e>%MC~*oz~#< zhV?NeX6}{tJ}nP}zQ?oG-gdTS=vEdsTVe}U2y7wM+SM)3SCfd}KD%MD)ZX^7cSKp! z{si=rCWI}a3`8i3e{iSgsj4Jz(JV$ zTko;zsNCG#q*aG?TF0ax79F`dPEEQtzHn7u{&|2msroaXxrsdCjnPnTk-3G(bJ#L`m&^-b+y_c66h$5gxN1k z(#(zP`S$=pnMaMye{*+BrtTiL?iwCn$(*=)eU7hy{1qF?O%B7jkV zvpamYGOwDS(|4NR0Z!S^+bu?YEV$;A&nNzBMvwxM)kR?pD6|XQY4^@?BrBfVQ4Lih zp!|wS=5J<@2O0>V@yat;&!N-H&ml{0Zj@wB3eMfze%sbD%rUV9ef#)l>r4}!Yr%LA ze-{OcALp1PJ|BL_>E@F1Ukwy*D;Xdn7onnkTKt4_9pY zvn&Z}{Qdy7E5#R>itK~I2cJ(o@z0RkudInu0Po~a$y-3VBlvvzFJy&9a1AZJ2kb%d z|5#E#Y6dnafr+{_h5t2Ed=h1ETV}sbK+wp+!NG&CMd#9`Y{5hgOHa?}Ni?}K>H>c12F}=M#I* zTWS<_yN}>zx25M`n7$sFkAWc~x1iulPfw5OSP=$;9|=Ie7Y~?kL|P1vjOlqdz(tgE z%F92+#>P%9QNwYe>&23nm(`W#gCUL+^D5JZcv*E?eSQ6O`CBU2+I6I9^Z#H(d#h|) z+zygF$Kok*nmu?d>w)^x!c7MAjBd9anHA4mstlQW&}=#NHPW{qkbfdy=e0~?qdAxzp`8ZvinYE zMMg#8qym@1n9~BfT_~!L7u7yl7ai2*! zCA+y_v$L|i>XZ~rfl5Qw!OqT8YPO?Ox$H=KW#@ssSaL*V*0np-{Z83%g5)S9*baX$)(JX7tsn!VT~-<>nUR3XJZq^0YuysQU~`Am)4hsys+vv zeCwnO7Fj28&`?uZNePws$vnb2oocJ5Zz1*7UUQjRS^}jYOFqHKF78(y9J1qtPH4Pi zG%@Ysil2sKu*`Q;Ewpj3o^`oug%MNEm6i4w9UYwlSd-V-QTPej=gj6QggJH#?5S|C z$CDiF7cmDh-Da9ytaG|kizVV29VVb*eLf;#?2b9>Xj>sm6|evvp0S93bK?L7gKp?` z&DWQn?{*;vehdu_HwH$Wx&|Xl^UH5;U5c{CE%RP-8qV@WT2HNIG$s-T)0}!L>H`L4 z*lgyI5bY(q633cdUa#gl@Cv>-MGMjlnJ^GZy7^1xn6@gqLl$wHoI28^sGu1qS+HrQtJbo=b0RU(chaz7Z{TnMC5G zjW>RDgx$zybrg=s6%-ayXiFmGo(MJxLX%)GUSg0FnLX%;NZHp}GX+Tf(rfC}Q7kUX zNiC-!^UJ=#W7Ppm6k=D4RX1&(XjaUgN1m7BYm9wqg{WkOn_y`^Ba?@{+3PlmBi9Ac z_cL(M0((A}YTQ|6T`!^N`=-64{al3Y!_|3-PviQg{o2kC_WH6JHuN4S*8hD6kUl%o zr%ce!$#L`|bN~r?E?F>9`k;G%N4-fYjtS=F3~TlUliDpbNe}dI@fsp~l?qN(tC0h4 zN3iVj;p|&4)LCuEoY{$iv-;#&V;2FohHv{Y8Y4VE0 z0r*({l1)E6-(7u$%YQ#ScSmj#KUC-!z&szP>V(w4aRc>iLLE#ge~`uk2mr;hM$LrQ z=Vq4MvPD^sFv}ArvTY0wgCG$#ZdaQJv>N1^+32?`(q{J$x@;h^2BwMKCgi6`*F>FS zMj+i#p_fs}|B+=mwqEFSyoP(8z8{J0xC|ixpaYk*Z-rG=4`{4)iDfs(Lnqt4lCpXT zG~{5ZzzKUw;SSuiIxlU+B-!z^<|7Pmda61x!N144F@`KwBmgy}l_(QR_=U30RHOLzV&~_urcE?*BeOMNT1FFA zW2(H`1!95E#d-ChJVmBl$(7sN;z#gW5hixsJ}xoMw61M|o)#`*e!Oo4yEFm@UYV?T zn=pg_52PABtHn@#+0DK)H=pO$;m5SXp=Gu)?d{M)410Mf?*`_BSy$QB&~4#>(Wob z?t&m&45DeRrg|Ie#DasB>J&@PlE(G0O{&prv#;mX^*s$bVv*rF<7I;AL ze3G(r7g#8GCT6+E#Ne9G2ecEMzh&a}8x_BXU{A%>1!;B)=E3frE?q;bKe}MldvM_n z(*d6ZfQbjH{ME%FyTmv3{cK~PYa(t39-)O{&QqQseJEaal<<(#rNS_J*X%agoa{R@ zSc32{?O1|DNBhy{qb^Pk?x#k~@eIE>RTvUi`QnAV-;i!#fel;Zn^-l_ebE*tySLI` z+Xe>EYxkR8HR>niRiSu!*W~~u`y=eKocGghM*))_dmXvtP9#FNPKQ8o{IZ)>^ z$!5ua{Q9+Vzi0=H^$CJsD*mQMhTUc_wxVLOf4Q7-ALbm=_ycmvT9&UsnBvg zva`fch$nkYJwP=;HH{*4*tOq5J&%tR6%~c9&CJfvyI(388R^Ab+9;HxU*-*DH`HLP zqag&BZ%6S`R-HW)@$1BlVV1&HIS&8iVLn+Z1Y)wayS_Dtg|-?!ejvaJJGxz&PpSA1 z4ywQXYWy+pN+v5p7j-A&ega>%{X-)a^K0X$Q^h*KqO*G)$Pr5);ae*l=o)?jUD>5z-aexmu?wN4PN~yMU_*ez z$G?r&5ZBYw%M1kzmL_9dSQTqx+`C*#WH!Nb(6+ODag?dmLiX|MHkBf)AW}OdRQ*5F zCS~$_P$&%nl7UZcU)_`IlbS4w5WzPZ#nj(yysDR@sMMA{DB~_gnmDdW1B(G8pnOJH;Jr(LG~x_GbG1}p``)LfD_!e#~0B!~cNCby%X zQjG%J$j>zBu35*eQgam3GD5(Mj&-1$DeDzzv7nW=BD0^n1oU;l3XsS~V1O|48O|!< zNHI-m*O!}yS)I|*b-44^cVP|&1gTWsbO(!os9O3KX&7jIs#nd3)xktl4I z2(S+foZgEjMGJI+Df!rO7ngR;OV9&~^iNe+8FTR>u8HVIkilG;D%uy&(m_`}qkG3t zs^Xf9WHeOUh><%}Ako1&WP(#m5>dd-tVpE>K(Q%YtpDWt8PbK4tmb`>}jghuVCy7M_CR)os<)@&G2P-G`#E zXF8Z)U)DeCxuK^TuRE?Mue|vVNZnK7&}q7pHUMOlo%);gN!Pk=B$?+zDEcVPU_Svd zje*Ju8-PfQ59#n;UbvvfA96pxr)DBH%xiLCg9}3!-E1$I z)lNeKmpfq1%}Gi5CY)#HNxHhbtQY5vPs1=#C4Qxyb3Iy952{dnjVw~VKreFq^?}Vf zH}e8b{R0f?ETXz~dAX0XNrbq%MXJ>(9v0@@+S_|;6yu~ZGSxaem|ii3?VG+ti5&>n zJ)x658=i?Q&&=$`Ygu%)6wVozK}f2Bl`XslR3`8%a0X%6stLoxg43_ZeRdm1L}AC& zqf`ToZSbj=3{3qy)RCz8``=J-@$+_0)bO~{D`It*qUF%Iu}b@j!Hm&x@oaZOMNN%X z=?N~EVQ%EGtC%U#= z9P9+56elLI3A>^a;Zh%@T944+|8ZItKMVbS`PbI`@@DkHpL}>z*8NpQ_WZJdGVmz| zm866a7XHxjjY(q!x%M^RzQ1}o!*+bvcQx(zSbcY5zTD8MCpK|rL(=a)%w-hk(G!TG z8Lc0F!}A;e+GcaBc;27nV>R9VffkWKmG>L)Q5F1RUeix~npOo} z8*Z=C`FGCWh@=8wLhfW&nE87G$9K4Ca%twL6>sqKqi(9{t>y87)E%&m2_!+$Temq& z=kh=mN|LLqUD5u;Z1pk!UETP-H*b{}Ebu#oI;M`7Y59AKbvRv5E{$9fwRQ*J@sv$> zM>YNM9e=*Z0&mht;p$w+B>w8p{(w=Dz)wOF%?u&cb4p4jJ>i&hUV}C8u?ZlxJ)1T* zL3F?QB+^^{reS<=BW(F>S40%-H*qrP_%{185cMwGsM ziD;(^K^uC1ibs!&UKw?ZkKgR&l@~opc>u}@x9T0$!8R`2EydS>TEI_9$ESv3+`KEJ zKKmqu(y6a&idiZ$&F<3NFDdEc^bk!QEaY`mW$Rt@2yP9pzyA_c_Wh-|Z!95sE`1z! zi2JKQzIbjYritjhB@=Jzs8WgANXm*e>B;T44{P_8M&wl99u^eJo%b(^eC4Na;52Hg ze{K6Y&Oh(sJ)^f&_qUeEG&FnUrMW9{Mv|Ak?Q{e6K7*oJnGhBSBO_-aq@)1QB|8w(L=q}+HzTIsgc zNootj*Iv}T;)aV5X{Doo`x> zBsF^(TnP4jkg9MeMU|k!oxkm#>C$dyJG>e?S_e!cxP3Szc8L1tVWsK?R@VBgO!wbv zZkvJ_Y9i4Su7=;czcPs5|6U~9J0<@kEe51>u)b=aKBN9tkf8W zF45R_s?){8c42KCYWAE!^dF2NceK@`a!R+==lBoq@OuRuMg{8fQfpmK)YnL}qJgB% zamh>^?Y%a-AA`H;xvOKNk`Mo;_(Czi2tx-_$rzL?;&FN9NjAj2013%X>d!(;1bd^OpDU3nQ}Xrhk-J12x1dwzn4q;-;61@w{GY8%ayb&a(!^D(q+YvQtGI%izlM z{{6O&H&gH|w8y6r+3qplVvBk+-?AUy^6;!h<(oOU+{g*U^$>=6qnQ)(z^_%I)U@b} zyMdPXA4B6=8dkLyF3m#4F1A)hP34?bH^z30I8OgZZED%Lss69+BT5c-4y7Hq4J3PB zNSrZr>5qZ&tbLcC=4iMvz&ArDMoEoURLLeCYxFiuL+h=Fs2fx5+l!pgJM1PWr2j^^ z#F8QuUflVLb0yTtu_UU)%fSg9pPyHHKU+tpnIm9+e}eAq&pDXggGqlsr{q%PzBd)= z+G+r-7t`)U28D`AvrDM#EJW$t5t|hR!!0v&vNenr=fs(h)N1s zfquE87SN4fNWvIG=qr}a4F`|l4|4{sE+rkEU71z>(ue4@W2(9IVyy_fUiEe%HXkA$GH?owe}u~L}^SXc871* z@6CFf87Atti>RAw=HMo)P|x{gYePJkbADRTN1i2BAKSVLCE3nwGI4;!ptWUq8VEzP z%rkI~+t$Lcg8{60$+-O7eW;Ui8K$<4Wei~_-sTGpgyw11`8-7F{n>j{Pul5|&*_D^ z^H&~vso`pH9beo@A#95?`-e?n9+_sX#@6T5C{DEv195cyohs98m(QoO!>@1xIl0eC z_BP@(xT(`3Ytu&DJE>Z=!`pKDPGC=oR`|N-|MooJxk}v>n=S~^To}F?=kr_ZgV)N7 zuoj7mf;>xd6WM%UPiwX`Qfz`>{1AGLki(|2H2N5scuZOkAJI^H6lE?}YKSPcw3>HM z?Of_SEg zr=G)>zC0_Had1Lf!F{U&-lcV7HzKVfn?LF0zSO$a{3_9>b-FaiT{*6p{;Qvw*K*>L zok!0?m0HWyJdGDFyrX(}Uy$E`N|<3xjW&;V2t2Z)I~N_D@9H$k)Y6}p({=dKEuM#= zE}thR>K-JD`__3x#-e=UO3VL0_TD|7>Hhy8?|pSuR|mN|NI6z2MMyamp(9;NDmlkU zk;5Ef6EmxXN=OHa5Xxy|jvI3dWtHT(4YMuDX|p+QW3%}^r@G$P^?qOP&!4})zWYzt zZM$Bt=izazRsi%pT$6{l6b z4>(ieN~>LE2oJ8~zOyNszH6N$_@%{cSFaIWWV|1Hux$hKy(xX_(iZm+SUdH~Gx{iG zwUN)y|M$(>-^m{A0;NKoOBSwnwxf)!cFM8+%K(_)+f?(~A<^hV9ZA`_vf6Z!c5-UrZZ^s{Y4x<#8D$piEDqxB zX!w=)`{Ya8sCspK#!PA->pZ$1EAuJl@Y#@e?Q>~@hC>NRNXU+vfV!)WFD8Z)NyF4T zD|AH&J@*_uZY^JVP}!S5Kl*hNiY->8AJ#o*c-W)tvv!0EabNGV&xW#f^jyt2$I(z4 z)|bjmlO30e-)r?S!vgx};@{d{yG=M>WXq0p#nSdWwNRBsvzo!AL5A@}t}vWFzZ1VV zhl>81g9e%24or%_wEo^-dkH=Cz#8oP$h&Sx%vU+}XWF0AwoD}#XvXjDE!L{&G0$RS zJ1jQPpe3uaHe5y$eAMsb{L#T@Va=cV@|L^2GSjnXg@)a&(Ra&`2^v|wtHV(PC#bPf z5p|YdZGXN_zmec9@-HgjX%#7KBC|0jdBTu^jQ0kYDnjC9E=?rDgs{?u5oPTA@DPXi z6GnhVR(5p5IHI~8EOIf+Lkg!MmXO(U?ef?is zxT+;JqL7BPkVb@04RPANZa?9sYDe?Ja|7_>3JolDX zU(@0zx-s)izR}q-ow$80emi(_DY_zpr}A+I=`bZj~lv^RsaVg+|x& zF02Ezh`arA#blwenE9@lJ(p(0y;}Qpc|^5#fz3WK=RF%08tfw_PwzvN+o7}{98lUW^NEfygN~_f#bDK9F%`}Q8n@M)hns5)t6JH zb=bh*#vk5X^Jpr9PJk(Vm8*EYTBT(SvFoIgDnIOoO37zFE`(2^;ob&yjLcj_P_sr& zCX^U$%dbZ_!Byk^yj{y&^M}DO&`;8II}dI#jJ_8yH7PX>nrf96inmNQ6}_LFX4MB2 zOYi-8V3%waz16?c`t%9G-M8o-T74f;9}XPvGVEuJdyy|1Hrsjo=`}ljS65fs*F4@6 zmKCge>%`suQ~*# zuNpf_7&&U6jrE-|mp_!sTQ3Am+ zyYzB=D2O}&%L+Z?ciC4j%b;svEp8<>(^fA|H@4Q}c+$oyLq90rFSvBi#?{Zn6S~dQ ziT8A_kK^|`Ns;~F`Dv3Wj}w}n{PNPPsWQZEo~?N+rT?Mp<>6sbpR=D~lc~Jl zDtcPV2G55JRF~!{`Dd%MgfiE@&TYFY8^)b&DKl$wr^cnuIbWsTsc(1xI^p9tUPVQr zYL(JQ-1_xdx}knf@K^uh=$jga56t96(x)b4O;IM9Dho}wKbwS6;bm~V#?e%L14A8! z4ZcB5Mzw_evNV;`nOUNyU-~1U<$|7-SbXX5L<_OWNHs_mGz*<6`xmO&_|LW53I%7* zT3#Q@ZYv_S64nRKUw1H_o%)F>H{O%!$zUFTE9yzDtN3IdUKt)wlWP<$0*!h zbKKQl+`lS#JHwjYO2_-z=m5D52s1%A5`HFLtTm9|EoRXoxj_-0yH08V|nfIZ@`*}RN|H7&==aX15OW$XF%Mh&&W#V^2 zE{?;jR7}2dUQEg+$~GOVC`M~HYY+=b@CO~O?IPaWV<(d}OdC z=Uzu>VAXP|s!E94aWFgdwYFZWpRPV?-!6uuM{s6>Uowlrb^toW+r9X46Bk3!>KSt?> zjwALZn2xukH=3_s$=cP|$VE8t*W$F>)B2v-j>pf8DJc#&B)B3mc91sd>*mpE&ly?P z5G{k=v4^gD7ix^T2U}b2JuqboQn`tIo1lwr5aTN<#IxmBQ{wDkLGO&11x=$x(y=LQ zqh)7g*3#r@Lu-v{GzE{h@dx9#kKx{NgX%m~7;W!Mv_n4Y)3Ai*pB~}}?4FE6Du}KhXBnqIZa(RXpSnEQD<2+4XIt7N*k`gB`JS zN7>$M7zo<59GCHlTKnD_Lz5}0Lhj8}_cuUYGSE5Gn0ES}jzP?Dw^euqzg^YmTeoX* zLhJ^wpr{thSM6I;$)kZ139|1Wq-O0l7Q`t8#Bar(C(Yuh@!?@fS2ZdQSxoC%OwW5t z7#Dc1{M*T$HS5VzyqyK4Df<1HyrAN5MaDK5t%JsG@9(qj&DCG5gUF9Q&R0IzYlDsb zb)Or{XD^O45Z$dJ9d1(MOp+eQe~9*tBPU<<(>*(HT*gsU9Mux`Q@$S>SNDGpCk0b9F0De`F=hv6*v`y0|EjkCSip&BZd3t4frYsra2dYg`(BMk z-}mF~imB~#lVL}H)F66*VA1o%Rj68=lM6w$^{JHW^il%*D5AM+lLz%qKcBjkbF4o> zP@lD-;5|E?uaE{J(vTUG%%dJ8KJ;y`W4v`YPuLlBX*+R;rVo2Xt6zw?y%8Yd-#;U( zU6Euuv)>#LuFV&AWk25aNV&{Fj+oZ!QQEz35HhbsuZ`YL1g{fi?Tu(eJ3qKAHVk16TdyI!MUbdWWi4}zohP2dW; z+j=*yaVGH--IGycs97A_Ur42ig+!z4gTwE~!cx8@XIK@yXB6Upu{Gkw;i*`G%M$&G zS@OyFg$c@7&5|>JroPQ*nl`Vz3!bAHJYZ=^>2j23HlzrG|IHzU^9Yo`ybf zw7ebr`PZ~Yo$sVk$>Qv{3Oml5bHx(wr;F$AV4d7-V=p;n*fY?@@^zOy@V1~<1)8|~ zm3-|W9ZV>9BBcf`IYF(nvlk6zQiB3}Uz|$sa>R#5^AF#^^L0BQ4<3*O2dZ+8V}Wdf z*J#2uz;dRq+I6zw0q0ng(P%+aB}{qaFL7}da#he@L?7COQ-}w_)TPp)5Zbl+_JqiB zF3-Bz%q%uGcD?*ajzCr)-h7AGY$O&jZ>YZ-P2A$soSDUfch?nxK+s@D6Xov4GsS0W zgFxCd+^>TnP7#f?ahpbgQ(G|Z7Sath*Ed;juBuWht9k~1E+b>6(g>T=>xpG5^d#B% zRWdK5UJcoxo!1%B4K@V`H{wKModR{r~536RP};gy5h!yf2XC@EY%V7s^ML!(M;r*eg9PG5BgwopOd za}CKc&9n#B=^J&LbR@8)dIh8uV=l0TYP|FgPJ=x zV`nCxT6{jX&ad@>oJWY@+|fR_Zd%|oQ`H~06?7;7up&Q1!hou~N-(!|p;vgK(O*c< zB6Md*GYa=8=xMbB{ANClEWM!8TPMZqQDW*8dDv`Xp^f&1SZU5AuD!39en+ z9~v_5h~O#p${a-awRRgDFsQhv&2@3Un%bu z^^5c_k143%<>Z@O@R~55SISa@pShgTeaZyZ(?H40%4%AnZ^&!*8#NLbQAgmg?ir4z+|FuHB-aQkr)Pv8(ZAq@X*s+R+F%}ntI^-xaUzJ@ zC}h{jyi16>WOuwLeMtXAGo=SnxRPxl9NnN7$nJVmJRR{-KR)t~o>}WVNJu4Glr%dR z5PuSx(K1#v&cJ(A6DjNv)%fuiqUOHK*iIU5wjs??65p*UeQp>L>oVSM@>Nll(#KVL z3?j1Xnsz8NvpvsL^sU>Ci$r*J97`EZjL|bNdaWM)4i`9LK5pz6vZgA0ZRZGRpZorK ze`Zn&(3oCJNJ$<&>Xf(HFmjjmvf)uZLIHW*r6%l&M#4(IzbMTn8l>A{6I9&TiC6e7 zy>3sMR1}4`>%((4R8(9Ky3*qU!5;tpVomGXn$CryjPUsLkJuoN@=j*a=%$PLdf zH0kkL_E_n@^Fskbum4<7iSpOj*iB=TIP~!w9kO*;6J*1#@mOD557Cq(Py6?qsX?y> z#F4-wZW?h)bC|>#4gAt;*^OW|8_etyiP;G1FD*l75p(+7*~;|{H;%8kZdqtsS_jvU zYSpe(WL`7ZtqtzaILlqKN=cFXKQlTAkU+9=dv!{dq^Yn$U0D1j7`{+ai zA-F7>CAhuE>l=*XR^3AP`pP+inu=pL7j&s&HH|O7E_SX|{>^$xr6dsNgP4D~Wyqgq zWV=3@F*n`FT`;UdB322?d=;9^|!wy8*3W`n0)$3zs*IG`*l0n zm3tUIk5yw!F%1`kE&ojOmi!v2d)2y%zp=Z?!jUGE$ki2lH7B6;84TAgv|SZ(vyaMF zv$hXxw5X)U#t9A2EN^8V(O{hxQWs#nLZKF+s-v3y?1NAiTc zPrJuATZ9@KZ0GQ|t5E)gpkKCv5{bwhCT$Cdch>($8Dn~QLoK}Xc5{&Js{UQ;$*-eh z3Q5#F89(X)5QeSq6%7Jo6oyOPo=UAr4of*aA1(~hDHFZ{A%CFi(LbvfH-pvzoE77X zkN%EG{ktr&WX(lai=LunebhY>C=kGQTdZ~jH9eh0_3j^+W$AeUA4rNMg#tXFWU7fI zWRZXWH!B=ot-a{)^(e_V@M@CmP9pmEfq{;v-VzV-i}cX3H? z{=fB=ti%7$=V3dNRxz2%UxEjsy!x3|i#zfBRsL8-s$nhB8cM1J?R~$=&Zh>1|QKV^Kh>Rrztd&5JAGU#6Gn5Yny+zfSBdHb8xw z9=Wt+B)5FD`so-dr*ZrN^T0H_DV82Gu4WYGF}zAla!uEI@xqr~kd!$MY*|P2591Ou zGuS||(15cYP_?0JB|kj_A+FZ9fUI^qvgP9S}^3%A>(^=OGV;Bq9$OHE+_iCuOY2-#VUMP~|gv9|j*Zk3a*Z ziyJ1`@{%cYN1$CZINsyOm9j0!Cy*Um6%50t%AE52{Og^KqLON;FR+*rKljggD-ZKb z@3R^WgvFOG+JkWn^?#yBowvh)Uh9zu4TRxUX7Jh6^DqH5T$yZCHO^ftyc7}!xT}EM zmv})5$nYlAF1BTZ)B?~`w{E!uTgm$62*kjDqKHkm`XbU4e`d1ek0CZBXNNdsV|SFK ziV}F!pPmQ8$GTU7KGN8;Y()wdf{%(quQd7mK{H*`rhwL!!FdAQ0(fckdH<9YM;}&P z4gL-+rDnL?v_oT$;kZTJkYe;M{i(vl^SgsT+%E?zng)cj9znGtt~NfExse7$oCa^;v=n4dNu8A+TJ+v69w*>uEy0Y4Z(CrIizmrAcQNH~z!#@R8y+Q|A~Mg?(nGP#l`P|SA)sZfWUbw?*m%BVYbjutK3vm40Dr#3 z=JxBu`($y!ei=@+VeiCK6qH@RIHJ8$-!pm0^Lg#V5qNflgiF0EA2$cj9jyv)+*LJR zPaOMj6cxy=tE*-tYBpE0VZlRVmFwks9jqSF+}SQb=X zRpUqfjMQ`Ed>ygOJNex|F4qJ5|LCZl{sqZfcx<#mvQnjK%aDj;+i3a>rK?(Xf<&j9 z-p#3U{jI0VC=Tb(d*)cC$BMgzwJ#37vwn6cP_}z@qjS~O^w5~Ngg9$Ir*nsDv6t*a z>bZAhx|&jfUT|SY-6_aFESYLtmreIn=ZZ_C!nAWsC!SL1a0_zKTGlQ?>gZN$3r8mz zL2E>MAOtx$tUlJWt#PcaU!{EycyK&_w*)@HoACV&SF>!aA!X9UaHxIE^}e7QxZXD? z{d`5uD{+!2-<-$1cHG2OwQDcOX#Yg>A9RD4iK6;finN|`2X0;gzcEs zE-(K$xnR>30UD2DJLN6)7odqvYI3q4FqYH4;SsHTjlVGsjN!8P#n1N-ur zLijEp5u42p_SwO>rTN1U>VLmo4|~9=JGI=^3H#v~-2EBR#tSKL2(PVgNEu^%$rt0SzQJ zPEKxC*`Kd>>KrRf&Z{L5PIJuPuL@_P!`GSz86s%~mQ*yG%<}`SHcnEZpzEc$_KYo_ z^7KK3?Ex}0hzfe<@Z-Io&6JgWHq@mtv$+?=g+>`I5GeXsbEauQT&by|%`u)7Re5VOyF9p$VT5A--ga% z^SvYZ>`tCHVF5W`dzU=d(q-=}AGC&aAgQRf1b13wQ%CG0xn*6A5WeDSIaK#?of9_y zKo?|3W4>FcD?e@`&;(twLj}{$N*daEeA|b))!Vbq?E-=mRY5(vLePTMBIyycMhCJJ zh~o8CsfC4yXP;;2g?v1t4{15Bd&>+plLuuKH)||RWTD_K7U$hyZIGynrmV#D`Ia@5 z3E=2PhE8Wv_e`=nDXPnjyob%rY4ehn#dOi!<6V~cb=c}H-evG$;q3B&qKtxFGu4=P zdf$|_Dv_kSZ;W2AgTd+${L%3%H&nt~dbu3CJZ-cPF-OAt%-{KgbH9V|6&EM08jlZ{ zwifi%h4O$g<@L4o7ZcA5^O`0DTjPI|V!`p%D3pNNsXZBw&NcyULmWMC3bahLVl8#& zc;(D|47NL0nphb%1A3YIjDvaI+2)cH6DX~348-EfZ(~ElKLK^wNdNLPfI~;EMAWUO zrR_EL2IF8#8qMOWhGEB#XIVV2d;{mGNlYP#WGL`)qc4ih@bM74MQO*H$mmS|Gl%bH z$;IV|`%(c`@y(HhkKzKsje)vn-$GGFgM2L#o)p?OV1?B>*g8&xk^H(&-YC~lVa&f- zwMyE~&CRN8LBF@aEJ!}~3tG4yB}z^^#oz*+hP!O6pt0WB$J)BQX5W}@GozfMC`&Ud z;y?T7d@b1M+ZUv;EL9vH&2H|`%;LQn7k?v%0Kb@`J?$tjXlO2ED3NXB#v@iJ%PTJB zUW|~fAlFtKPdQOg6a(?0c`2d)Cy(MIT7<+Yprmql=7&AsPi-mU95loYJ62sPuD3qj zXb%ELoZXRd4BN~I{TvZuv%prdYk zadNEJ83A9#%U3N7Z8|#hJP=x+d6k2h%#rj9i~4%tQOgWqj!q$VcZmm{WSMurgm=Dj0^)koWmLhT+e{t9HEPbmy{H(y+;es2d}D5EIgt&rGvO+7l5~ za!+kqt~*)u3|m^Y*-9~q>0!NbN=EBa<$LrZ-Q?v82?J;m+4x>vx_CeVTQ#_0C9BCV zp8OhZgvZej+k`rg%(bTowqw*mzWe=5Ii9z_8ht;G3Oc0VK*q2o8Q*23bO^2A>oYDC zt%$b^JRKv6sHQi$Q<;4&IF}FRDUZuPX+rY&E<2BY^RaHZxKyVT=`JK zZEWEt1)zmg4dg`hFL0Q;EE+V-Yj#xajX;i(+Z9TBC>3>3lwBzINFp!cow$75Qp$-I zpZq)(nv?uw@~iv{}o&EVtIa#%}%cD=axiYJtb zu_2C`f!oVI7oq=P1&sL46$w`>#T3nDimXbVsS8l@cD$&5fGYnRizkKrz5f{Lq+uYg z%P0rvnw5}PdR6`f;pE)}fP@zpQ2E`(8**yg)`v)qsr+$ME3`OQrwWt^Eqz+I@jvmTCNIwypr#;ga4i9kYB+bQ+ar`rP`i zwd|_3-;WW4!d)heVx}@PTbZxbPUP1X`sS>2!CuO{%V~JXOUp;jh9r*BUb< zthq_l#aB3S1CW0QC4qGov z;(9uSL6n>%nrfqvS6V+0%WYTM?Y@+jyS*jWz^e9T9=8kj`xc?3ikDV8=SmxJOq<{d zEhRywe4Y<4KR~uR+28JXYmR4f&T^Kd6&}IgWIB9e_hBaF=%L#4TgV${QV3p}#`-}O zRUiH5uhoKXV;J($6`U1I5*kq^)^q?p{Em|AeCw8$t?YQ5y^um;!x)pXHtZZb<^+f4{pfPKM6K-cj7!(mBb&9A%rtg+Hdr_O)(}J=I5> za^=e&-sCzhl3spT$d_fOp76NlHS*ec_ZFoSvb`o*x67^fD0<4><=ndm9GrWPTAXlkaw=W(~{(?}P!#{>a9v!C77u z$S2lr1W~z-jkBk&EGyLLN{ZS)I{k;h>4&B&$Ib06lTKd49qP(j&9j3Y?a%9Ur?ONS zfudtHvmg5+BlFaEhB^s3bDtJ12!~iEbI90mmtdqL*QuO73lnyh)vS{8ws&f?3xYUt zmAEyG)z%Ozqc1MX=0;zOoO2naaSR)-hDg{6Ux9ez;ODDks!cRvp5AyI2TQR4>L3^a_K2B)cg*BgEpJDp4@U48c z!S}lrJ}@F&PbS2LZ_@*;IG`BD9@ygRzfA}pMA^{FoB5W3Cnu5RwtL$B$n}5;%g`Ojy{=q(|}Gdi#ZI z`d%0Y(OP;UK7LIJ#jI9-H3d!yj+L%3_jjPZZZ1@QUV5FafgCBKXVvl%8NK0LJxU>U zgj|YR*oNSZYY~vES&?2Tx2gF9FV9DVjc>JFD@c*Iu(LODx&g#LjW-%LO$syFq}`47 z(@7P^*l>CYEL!x{R{F<9otPz>;%!lm!b{<`nT;jJ7AlyOiYL*q@?-xt!2gkAW=KJR zhdr_TT7J8W?jwvACS$l$#{|RD|7BsK&5GBI2p_(k@3mg7LhbueD1X4fT+9jpNn+vi zyr@EQ4*GZWJt_&Fe@|gAN_d-9HB3SIOSJ;+DZ*$b+jhj7`pSI>bI2Zd0A=ZuQdL!h zW0g)qdMw34UmGO@oh9p@k+bvkiOQSTrF}pj!w$$E4I6bhlq&g0rCfjSHD*$WScD1q3B(Yb_ zSeX1HSl($H73Dk9t@dIOaQM^|wx902nU@RzixG1M%2>?mc6*!)thPB&HxI2Cjfq_F z1p?3uGk=^odhvfA3~sMZ35V_ep)18I{<)aOsnCgO>mO?@7^~uWxtbWh%_5?TI zDT`G&E~o7Obk@`3^NSd#yCEleOie_5y>l*5_IEB#w6Z*Zi}pD* zqj#6n2|Hn)+wTn4%rM#nV_a;y$0ohBw5V|8YtyRVycb|TM9XL2G{b@4wWrFAQC29Y zEJzAfBdsWWmYHQm$Yk^VY|n+;#9vcEi}6lO%5S3m*L=Kiq2ur9y}g@+gTGsLrX)L7 zNA%uk*3z!IIlpTGXy0X8sq|8727=2!2zPdbHCJB*D2D{~dk)O|%`3l?cY;5S0$$-7 z64Q;pm@`z5+iH`ah8eQ5b{xBP-f2+Zx@Ha6<0~cDkUEOBghZ5Snv5|!Mb~s7vA?lc zW4z#G)CmL`-Muad)xNWJ z#fCNQkTWOdMV=eKNP=M8>jO;doT-Dk3wg%5aekJxQD^26psxkcBvGtfR?g=arGsE> z4uArn03funMouQGW*x%;A=X|nN{3d0SS{W2bYyjb1P+%`#LJ-dx>xzp6Wnqxjo5A+ z0}{G-uVU#g-q-QnAFMoRgwUnmi(K!2;DnMk{EAMTFLksq`2{D`%}{qgyN)h+Nu zcFa_R{99G9fzE@OC*S$*sEZdu>AS*=n)Q5oUBMI~_$|lC02WK-xR>y=?WLlXke0G) zjXC(23GHTwCvGWtHe7|x=?QLg|K#Kox#GSLq~A5=FfwiRxLQ$4T~6B&K*5Co{MP`X z=v%*`8?5~Mg}UYcjoL2Zyuf)=_Id+IfsdE&k?`I`lL<$0H#~7EaksXmHWGefcz;Wl zm$cdH>@U>(ig7LqZD2}SJ~wEVlTXP!?efxU0Vu9Jy+#RBxFJ-h39>TVCX1=*fNP3N z-3>R1>6kd=J>>&N)X3f?m6*lLRwdl9+>~C9d3OjtF`=z*2_HB7lKnKj&ZYVKb=rFZ zA=cdW%NR+XcKv63y#Fu$Z%N;wQ3WzP-l$LfPxgMv&7h}}B)OY`p;okP(sCU5rSf`4 zep7a@!&htxm-$kDrAA(l-&>MWzHL!OJ2EcS5i|2^8 zX)zm`2&ENM&dQ{hziX!SjsT%t3&-FdE-NA1)6p@-BBi|TY`O-_N@ai6AQ%RY1t_W2%F|y}p?1d*HEEur?U4Y49{j)-K>4*xH!1F>M8Z@pQanH+bN9@|ZVYIIG@w>^ z=ClA!`;Q;h-BehK>DaQo(oJ^t;zpeRsFyl`>$77T2pekCJSl}vF=zh(om&#a^H)H0 z$(PRn11nstKMVhl6$6v+a`Z4%WiU0ScCpG{4>B*VK_v-EWF-CP!>W@-0`X}wWk zVV5atfBVPJwhjQ@lx=8nuBn$xNrpO{EYm!#=bEYX$*g3#pNUUzwYcG177#iPG1|*ts(nKV5T6WkD>hx_#5fGD!3^qeeJ#{1k z@I&*9IxMNM;(Q29o(3N-Z0O!y^*?STavk}pq>fV@O@%D#s4cm9>xa9E-MCmoDqJk5 z>@v@wk;&w>M|;68K?jo$SB1ScHh5S4m?lpqZ(8}a$?6Ec#^~^F>QGDPshXO5|9Ihk zV`Zv-H)?O*09^RU{@+-piwYs9JQi6OhUa#dp^JRm+aHt3iCa`FzAw~YD>zHuq;|>z zK|Ox}7p;Azi$+0k0pO{l{np>rDHK&b_Vjt6+^2G%zQPPo-N8P zEDR9BMyIX{IaPEc9MGpFcXY^!@(>?1QB|7Gm~yLk9-*Rxr~Z%4F~S33M8l90U|Zzm z3h5okJ6n^(RfQq01nTFD6+qic(GcEHP=^m9NmHuny?E+tw=6c9awGU_#j?594|L{0 zj>CWKE?9^i;7!10zdzyC7OTjQWYZk4fmw0I617d6iUpS-j>TdHS8E3$6@MD}Ts!?i zFe$|-St7XzvYXzK=wMRJg z$;m})4Wgyc8T#PtsL>BAG2<_}e3H}lw^hHH)_xMk2pv9d7&!C-7}GgkuH&&vfqf?e zot|{}1nz*0nz~l^;|TH4?fRONHN)xid>YX2D;#-}qNCN0^sa)ptd&(PZ)(aOc|wQr zF5P44v%ISf1Nv^y4`1<{nM52vX$=ahx9)s5Dl?L5;G>gvk`hdxC$U+Jntyx0t)NzQ zV`A7~IUXo{?JsB~-1GHN>#GQ8wD$A#^2LE{&|AI47Qx?8DYy=@VWgf|9Y7ntSf_+T zsSO0zSO>+JB6VXvu-yOXcfS`KH&%y%Vx#Yq4oUs9BsH&tPN$<)sQG?#5;?qhW8?0R zt+pp}Os_d-3bUPgMM=)mQmwowAZXb^C2H)(ta!osPKNvGt^W2Zdo-XF=={g+!e&`V zgD2UZ&in7jDU=2?7P@smgAoXN`uOfguMhD$?k4C>qW8eXVXsp(C0f4K7LIIyAMl#$ z==zc8)U__!!(g!%AjY%k{H-$loHdiFS(#u>s_3#6DLfg03kZ(sI9qA~n^6={nhNBL zZ3-P&g8hV&A|RN`j;S>P$Cj?ly{FEmuyu62HOakgvd*=yUGtBWn5J--qEp!sh39HO z#Ob}Bg&vaB$&7XxD>^E=#gfrbG7r^rau!!L7(qM{^dhKQ=U7pl5g1U^UA86A>34gg zt!*rM`UvYH5Ii2>Su}g2x<<%uOyyuj?*+st=Mda5{xmR2GLmlG)6)9?Xls|AR1@M$ zwEbc%=0o#Y$ekO=?0mC)daqa%?L*-p3m39$>0r(aoab|oHQdCf-WDCV4nx_l?>P$z zW=$hv2scY{Ib~(l$4&Noiyy76`A``8+9-oQ{jzRNv1OCRUG8gSvTPszv)~zXsioLG zN}^oZD=D$KIYSs<61l>$%u$djJm5y^S_;oOI#LD$It1mdOekwJAb?_IWE5GylSu|J zh4OHtT5-SzzQRHOZk~+7UBzJ+X}uea@K!tgc|W}~^KRKt0MWx7pK5ixom~OOUF1oz zw%06LF(5$pZ%cdAaOd|rqZ?48)kD><=OZ&+X@t{BPMy=}KRSI{>AyJsPysKd=B+dQ zS!hI!RcKv`@Rvxj^AxN4rX+&Pl#va(4y4(OS?8M3x8?xH9G{#V<68?X#`-#AB=T}w zDZKDiSBnX_$ikj<69DPSPku}(UXDJNuQtgajJe0K10WMePkNqX39lH*O<`;hzb72< z@Tgn|YYc*&DO+eYGHEC{PP{;zNpEBnNfX0{g)z35i@ zNFXLB{xmSYKWQz0izRN}+Wu7J$mKMlv_Ejic61+KJtc&Nn_#Py@ znYv==dlSPMYEZG$GEGvI1m;|wg>y=% z>5YVzYfK`!?*qT+;*FtIy#7g`M=5-9s`X%Q74Zy#shzX*KWo!}vnDHnVT}G+BD_;L zf|gVW$)o1=UYKR4J9R9ZbGPKEk1kJ1^?H-HEq`nN5V}6sG%MG2Zl+Z0Eyrx*L+gPH z7ACq1vU?rK8O3N%FP^yvbqo1zCltnYrx{lm7c5LqLL5QnBb2K)(OpkO>S>c*r1Yf9 zwY=a!gdS!hWTk^5DL>HC^OdXaCDbH(1$&S}zizvchvi{}Bg|*BLaZs)vc*>Sy}Ftj zP3Ec03(`|8(%PC-s4Yi6WpQP$P%aOE#im8Pb`#&s;k$B;p=%oCiV0c^+HHKA5z%)z z0L0Y)D|lJ+y&3~q6`Vh=%8c1_0_|*9ghHq5I!%k5?LCYxaF3H%ohK8yH6ybxWQp;3Tqu+OUII6mKCM<-qmg;8~{u-Y$a_D7kRUJFL)kbB9 zD%Fj{(SBSQ`e}6QBJcPgy~s-Rs*lIytLr=V-)q}l;5W|_b;}?`?y07Rq^CgSK5OLUXQm&XI96wr)V~NxiVs`kBZ*;QO8ny1Ebh zPxuF!-;qo8QnIzCRJ`%ncW|$lfsm@;BNwInR0NG5_M-qi!WPpYmvofNmD0>bLxlq> z5qajWORXjf!^^38v%ovp>cp-PyMwqpFrMGiY{GqE%%-ZfCS$vcqFyDQcRTB9?UZ3_J0az~(xLo1$$_H!hr409acl(>GT5Dy zUXFZyb&!K*oZxw)=Amo#q(DJ>9vYw1eg(GBYh2fm-0s>nL3$bo31LIg`GuURXI))g z^pb^oH_WbTxje5ZL0NbtvQaMY-d^RyyVm=>iZW92a*!y+i$?F|(AZ?4BMuc3x{KG) z>BGw2ij7y&-8y;()`JA-ACrd7zgIWr%gvbb|5T43kW96i9ayNi5m z>tWPs>;>x!>wA(;;H}Dxxk{vnnPtL+WbCHxGu zxU3PGP-S@5!Nbmue~Tgd5SuIUt(sTHKv94FVVlX;e@!Y+UqO7L8M&`Vp~QiDv)$bC z|DAjUH%v}7XGqaqJfENV^lT0q-Q*Bfs(Gq&e(05N&Z-Ls&V$*!>&id7sOVv~R6^isIt-mR6^9+0+f5`_HBy(#N&bXS)J2Qytsr^>W_V z*FB2lJzgKxUZK&7!LTz8Jd+y_PM>aO`yCgLn!e=D*=ny^J7T8!-E*FU^o{TX+%rWLDd5o|=3urb{-+Q!EYO+&v@tejdGFH=+`Oys%B!y6%r z*-lhO&ko<5jjs%S$Fycu2xo3wOCBP2@(zPxb&5D^Sut58d8lsa9(_eJ44TK=Ady(^J%xt=0YFFc==-J)5d#JTN5j>5k)J*Cg@IuFGNH zH)_7=Me%IJtbr%-C!8EzcB8PZt;rvVshS41^M+j>?+WyYvmAH zk+C3Z0yAnV)V0;S0W*h*bDA!f0xpuh8BmdI0G(45HfUZ$HCeFBpAikUP~B|dWaQlR zV`SXD?45!N0F>cPssaY0oTk&<#BTI0HOpr%tkyRDzfAtF zSSQI5Q+e8?&I{>WP~PtgALU6R%h*i$S6pMud& z%K+z&HV{5}nXN%o6Cc_tb}NJ?gV`NG<=lw^QiXD)TsZ|5x6Bg+nPMFC;I%vb>Ed}x zv5=Kd#0Wb>@zB;_;xUyit<4S!hQ6>QO)AJ-3@`Z`kp3IskpK_CJcDf1A0!k`($HD2 z%u84d>Y+%?0{(BG&^(7NQjUXG+{C+yr{S*5PJBK~#Z2u64z*EZhoPtyRh zUmiuNFf>gSjQE{55*8F_tiK?g^@V-wxS50@})54ac2H~r^qqy3rKt`i4q)Xqr&RPd@%bt5tx3?Je zVB>Wgf8B$E;$O&w_d)w+`bgk}!DPXR05u)->TR|cFOB$1-1qvhPcjuw)jHI)aNaWc zsraP6@Nn(PluRYz zXHm%TrM)>YPijPviCiVFfc-fQ?fvab5p*U}@$r>wqWlv(tHOfIXuaaufz;fKCd9BG zu#N=$1!Cn0o?@9+-E+5ry5xSg$8c*gfa`f5hONe$KLn0lX7BX&^(^j-rSA0(h*MNE z@MTTIZ%n&80<8eyk+)#}o)71?j7?G9`|Hyln_49TP# zk~i5br_a2ZHP`M)%+Oyf(kPz#Q7&Tu+;6M>_a=v3Jp^cuqDg?7z)HZ3Wq)!?_mITa z=t?_Qax}plTUdrspS$d`6@%~qBcXdG46nv)MZL+CL#bfwr8#E|a}}q9D3FY+j)a|V zR`aQUWDN&R9*CO!Xai7tp_ajtz_|KiP!Q_wS5fUd?8J7=pet6b%Je?-Pn`87AMC4q z-J;vwJI^B!h>v)ytRA&zDR@ux>bq*EbI#w^Z9s<-Mv#PD?nu0G`LdWqFrN*LP>^tm zCG2kiq?|}%qW(9AwDmy65yt#ZxMT`|MCwf9Y<(s>eDoEU9{-7}P}30=?{Zp!PPMgP z5G@Ld+iOUPOFs5GpKP7K1_Vp4NLWd{VI^M=R~p(j z1sv}|n;T#5@)xFJ9l;oYZ%jmb1EI9m=`zvs1@8aj?#<(&Ui-N5&grNVsna5rq)iK< zvSn{mr-UpslV!-BWk`(4G8Cs2p~aHDNMe|=&M<=sg~l@W!5CwS!7#`&7|ZXP>fFn@ zo%1}e=g*(Ny=Lb7y{_xCyqD{<5DEjs#6Art{C<;5f7scSZ1^{P)HjOrUpnBweBpNu z1Y@PUavaRtKF6s+Rd+pBzD&osh39TNtW_Xt;ZM~}K3mBrorR*a@?PXk1OLcFln2zU zfIm^VXX>Rxx2FJFRL;_-*qi=0>ia)Y{rLA2WxNJO8@KLxSyjmdaza^EX!pwHne=#T z_LgE@ssBZyz=Ax;ab*J3s;wH~c+Ex>LWmHjL;3?yRQa^k3UBa5$I-xeKQ?ae=-PbqpQnV*GzUQaQGIG& z;CgKi3lpY`cMT#;tAU%N@}1hTaB^GTuEBdPSkfa-U+S^$-%A`CqB@s8Ni)V3_3;y3 zENr(qm>wR@%0fMW*Bi-LlvTC+uqS@x{l73ofZ*X%rH`71i$_UH=758^8n8xz@Nd@i zaycC^#2qPim~o&35C;RZ0n2Q2B|PzISQfpf$F;>?F0W$!m2Rpb*du&x!G%(w6F0ls zxzOR|Hvs|=4m4!L9QMF9Jg0(A@yn%MK9)hX(lu({i|X{!iPtig#XVs;?6q_Q|5+%kI|B&vnP1kRXn^bUTSz=i@zofzegxkTUW?D06W%T|ofE%{?LxkelZgPX9_A=i$A%CIam z|CPW6QFmD_OGhJMNkoG=@%@9&Sy?4#&Qzx6aOQFL9fi)%k?GsNfAg@}zsag~&-Q?l z2J@TiAuGm8N9DNO+War}LML?Jt0 za`H>Krb&#frB|Q1xKKt`$t}M2)miWGGB_iDhXFOp19E(>T}^@*dc=X1wQ1aA)IpcF zRQ96A>s@F_$TcAcyfRC$yC1C*?gG0Y69c#4bgqlRh5HCQnKe+|FQ z_t8o&8d2w~m#%1))!H{Sj5Z3*vG|tv@fBnVXMeIt+MQ+y(yn+-5gy;1wRnKVk}y^;`asHbxo7-Wpa*GtVl_TF~i+Szf&w%SRVx z?Fux!!N&sz3hh|R$M8$mI&QO*&6fV9%Pai~XmO%UE@CjA380?{JUL!XJ z-K6Qb(FLN&!vvuzZgDx`sj}KYz)bk zKX7sRGP;ebIcvk6(6S|YO?YUuI?4}q{UB-q9gi{dDS*$S&`(^_airM{RObFnpNy^~ zzL}G(Tfp2qRv+S1K3eLOGzaG`@y7$Adu}D4-LrCf6#yM`ta2*y*P+Gfz!p_s^@_z> zaLr9os4cG`jHo-ALXRUO>3ZB!pU*ncLq*Gmmgc1{mN&`1+FsSwS0a{|9_lby0)flZ zmwadp4d_&0^?A0s*V0>F8LpD}UCX+bkfm2|lk?1Cn)m0MV02x*WzG?>J>H)<3lL(c z-{SQwZ?U(%9AL16r{3X(!?EsMa7iWp-sg~;15m=Mb-!{CagKPocRiW+QY;bHkf7qA zzuBip7S#xw0Ggp;iYQ{M7G^rsAYO*Q3$7gZIgpmCo=1tFxFTX?-AwJ1Ox$Mexq;!@KaIZ+CB}%lyQh0zE)yrh=-5ffq8I($J z;(2a%4W85Gy+@9mU5t2A#$`E*d5+EA{KdC@ML{4*vW%QHka?;QZ&oYSoq0d^Lf$Bw zebzZ(=Um&e^N}yT50ht$PTazj;fJcZq~+>#JibArp=--(@oV1ZM@Z5r9L2r)sb%>+ zY=RlHTGEQ1kI=RJrv&*SF~@D7vvGr4PQmpZHZ&w{~I}E5W z7p29(`o^5`ZL=<|1wAF+B`aga1VjXfZzFlIzGMw>oVYV#F- z1ZfN2{K!Omy0DD1NZO81w93}qtpD=jELfw0alW%tD072^{6n|p4+YUeJ;A_279PA` zE^KdBwf+O!+1X{Aw}XY3I)6z54Hi%&{PaVV!}3u!~FFtO*-t6o=ND{XDawhxfhNx%a#`>s*_ zqaq`bT_=q%8gnzMFwB`*Ac(tHi#YOpFsS~rWzL?xcn#t*7#KhFE&zlgukjw*o4(y8 zrNj3YbgwIZTAgj**xudk-rCA{)S)+jchr@p1F_|c-~YDa0jyUrvJI0!zIAmbz2RaG z5V6%}G#jrO#bjVR`=AJq*R)#IuF3D88 z0n3l9^!vg7h?oo6s#`X06)C1WC0)L(Y3|t?)*nyOlvDaSkE8sa(`?7R=}fNNFQm)+ zgxg;Lrh3;U?VfQ7W`(%EynT~Es+Kx_*3{$1q<3e`H)Zdi7p1&*L;lLvGk1&$X)tlt z&c?8NR-GB3@ZYQs23$_gAfepVe3S%7*W8<4y_$hmCUv@a<&U6S=wIKycy__(;M;B6 zfB*g0gPZ>7QG2Is(-J>Y8f)=1x4deDd5-WG?x^Nh_o@&V=UXnHo46iuR-U5#Uh%MB z^yi9;sV-WrGpMRI;-jj=rtJ&0#QbbOdilJsCfqefu3ce&)IK}l^6=6QZjcnd7j&`u z?FG!{jX@us-|V~ipns)eXz(V27D5zc?@V%%bP!1RT(EPO)XCYOEc%^Dg8n;_4`=Md zMFkfc;wmo5-5k#fIo%s+KZV}4~X7Kq$CmpT5u<@ZVj zF!E*!aq7H@=sBgwXUGuQPA>hY`n#33CYi&zcxN(IeusQ>uQ(#AbVF?><)E1q8y_|C zC^r3F6MG}g!$(-X;p~JR;_l)v=YVBq^OS<-Vf1CO_W8-ojH#C4_^+? z->*UTq#1eK&Um}`?Z9?iOiwcBEnBB9g*rn!nA*L7_8OZwzHesT!I1ZxPw39%8;B5SLD=Td~yHKk)TXkYi!bd79nw#Z0Q{@-0jD1eGT&naa z!H45AvXRrVXAtj%t`$;p!@0a2tkeakwEoXV_6qd@-~_l1T1lK8P5;?m;@XCb*Wp_k z}b-tVgi%wHl`45i(*6bz5#!>$`s$XitX!Xl|a-CZl$QG*eh!|EhZOBY$q1zD7E1!hfzZ zA}H(am#5O%{tFN-60fYv7J z8m!#2^kL<0rHpQ@TR+PH4j&LK0rR)LB6dvMJxL})Ldo z%V&a8uFYB*3oTQ!@3uuDUZ8iCBUXIadSs%PPndBnaiv%W4SnJXyT$lSqe5sGKRK^< z4r}PfB@Be`U>v;nWq6bB>fAZ4D`ByXW4?Q%yuAgQqLI%#f9z`?$!H|1^mL<_7L6th zUdxM3(MTaJ@sX9X<9;krjD}(Ny-T$#o9!4umQTaUEYwD@jqZCvEm10ty%0r^_sL0?F&DZ@md}=^+HR%T4(TH>D@> zidzjIKvnXR-6p4R*k{w)#68e`N~bO7JYAzq(BTskd)4hmH*;_LnV5JJG{q9lwCxAy zQaq0MJ8UP6_`JWK)jZR8xY|&bea$Qx@@y!RT4A{n9TAuu7SaY!V%rZKyN;}$pu>jC z$kNa(_lQ{|>a-p6_z7}YK^A6C?u;l1mEiApIsS%E$~NAbmLgynS=pW!71oeX>Vroq~n!^!EKoXk8{-XO+2)(Ec3 zh?@I^WiS$9&sA2gCqvvFRqPlp7r+Yvf6X8;+|N1AHspuM#PxP?bD=dJaNXO{n&&oi zRq+xX%oTSMW1gxuUb)}0BX{7~UhbinOR<`mzl7QpkTXtFh~QDyont)<&%<6T%7{dM zz9au*U20tUPkG)%S(E=b_pd9;;SO}=$(|AW-(_3pxh2-TU3&<8B>xw8hJjyv>NvY< zBmZBYWkfPBo3=xE|Jv_w`QKn=(4NNsch%s(Up2ttNPW%2>OHR0Uh7?4RHYDKTr-K; zto&#G7`qG-;OkjNAv(1u*!DYqY|j5UBkP9u9cO!$NW-ulz(|`#xE)Lo_pi* zcok*pu0dQ*dF8PVytuE;DsLeZ0WMkc7eC!}cN*69IJd>6b$$d2gH6nh_xOHz6c%Ug zvFl{+^MQArZyi0d=bF>1@-MHIKi8c*8p;ng6Ul8E{o4Tp?vU@^+t_3;eM0&JywLS! zeFCWixJR8#V@)U&YG;DLf)c9yg}t;I`&CLuF-yjL6zYl1%yjJDp|R#;H5;@;HYrEt zagr4)>tjo6Hf)W*rM0Zu4sKd(Dw;*)G0m9y~dX#B2 zOeqG^)4AHlDZC9$6Z8J8TmH~cClNS}%fNMfVoE+CgFm`kS$VYT9+6nMF}dP;1$af_ecA&zdTJ_TJM$ zIWrrfX=n#mOPByIjH$ZV2lNCrHCF-bBNeaY@kUMd=1|!7H4hFr>dW%ZMSh)CdU3G@ zS!OU8YnRzBJG>OTAt}ZU_=odiJv_2!uE)}knHqbKJ{7>$V3L9S#FcwjP~m6H#wjP}cxSa8s|arh_ZmbBz#|eFtL(76sz%W{LGmJ{R-` zQg8pLSpOPv_=%!Ii-dvUh@>&#DDTh{i6J5c^{<2_yT%hZcOwREn;dIn3v1eUy5O(2 z40TQINH_oOIlPSajYh2U*wG!1j z+syvvyA+}oyy)g&U^m2Bxk?rqM2A{hx*e{%UbsFuytvxXZ}F*aa&hA>IXJ?|;bcyW zq{CkBt3-8V*Q4+_TQQ}H9FysTV{6m5idyAOHCjn9t zg-CREUHMw53#DWgTnuWl#31evb(ZrJ$hK+-)EZuR+88`e|N2dS6-=l$Pr zZ~{mv-fAGaBOranUR2indYta<__>i+o>SACiFXG>;$!?bI3|h8L6@z3kG8-samS?# z4qpi`^woSj&0c)p{VF7<+7d@3s?zhpIHk`0{|+T8mAWU{Qd`?lI!sJvrc=Cpz?1s8 zWCu|jvaj7B%ltHIx*g707-UI}u?`Nnu;&(mIm_AE4SG#B zKHoxGiCyug)=EFdXYm|hMrO{_qB8k|Kq@gnlIZ*%~n>t!|rIrB4V7jxcE$GpCbQZ?weNei{{4vcI55@^k#L34QqM2jT(< zw2gaCTv{qyrQ#i1pqMOmH)`o*9D*@dO|o$M_KJUPkpF#pk*?)RC|R-#GwWBN5_(3g zu0)8tb#E{2?{D#%ze8W8zn1ZFdwG=Ak;qlI=GUY8n#(B+G}8v}qkEnt5JPlL_Fq9# z`p_K%m6`9eJhkm4oY-8RgkSTr%hqo(PAD1~)yZL?8kG>8j*5zf*gL!?hvlqQ{lhLF zUuC$Syjjvsp)_=c!+9<<^CKWGgbVLg>ank{%^&UXFiwI*t9kWr7E^JJ6W*`c6otZI zUaqeHgZ-nF$>Y~iRyW$iwt@$~gD}P~fiBARIkR|rmt_6-Re=Xi&n%T#pqJsWd%{i= zbp|G>U$yNbXqBv?<&B%2C~~DaDxSu%cQgI>D0GL}R_VWTVlWqLWK!tcx_HxN78JL` zGVIJ{oO%uG5%}SL0o!G>fq=Mu=YFGIJa4kjtsAp7Tz5(*%dh(Vy)YTBt|7_(T~s2M9zl zm+RjN#WIF>SwN3s66S`dQaX}5U+NBceva*!b<9~@+#nskY;kY$J&39)or$PI^4pm# zvwI7_kEwveNih4IxK`gC5BhF{s?Jna3z79;*ONL z-qcj4r8Mb8V_mxUiYf(%OBv}wobBL@4uxF5?xb&P@I4<$quuY?%jDTf(~2Rn+E$zy z6QOZq_a{Kd*O5{pGS>-Pp9NzkyUY)t@X8x55ORg|0;c^PdTRC@FN?b_UIFbo=JV+y zqrWAMqet`!Pa@r!3i09v|NP^4mx3eoE2w|Kjv77=86&9h$?xM$f-b5CvU@mD4b}(!3dzYx_Sv^HAsvO!>hAI9+9)eW!9|vQG>=% z65?k{DEkAt5aw##RYC4`fy6glg(mE_G3o~6Q;V< z*yZ34#wM^kZ4Pj0c)ncOQdL;*Y|CuB-OpTd-9#uv8?05~b{?WEL8E2OM()ZFN`M!c zZHJ{y;t_O5FuBfaPftzLjrNx~ji-xBvN=|jZ#5{278@#2` z8lw#HY;!(pU(npeK3e-*l#CRq)wjtPI`n?*^l9p5aIz`*WKMHixVTnR5i7zDUdoL= z!}@rA!Fb9sULIwYFOV4(B^5N6jPsWY2JY7y4Oh0jZk=6}n)5x%$g%5j_Q&*gD%N_> zl9HIFRr~x9^#%Z2Em4nUe}2{Srl=qxk28Dr-ta4uFP2i2wDN&gr8(Iv`Wb`4M4*52 zU#;Yfbm-)wfm53<(P8|f#F_bbzJ8s0M962kvFwyR)#MhqCio6H-L$<;{FF$I@cuK+ zO0HejLc4}KZS>V?GwK2rRPqc_SX{Ge9Cm79Y#L{p?B<`N=u9IGNT8QYL>rz2mdjF+ z9_5+g5~?l*LMN$7%jm+9UUiL!WIG)}Qw?tki8>&2Rp_@RIlA*`*n2dLEJlfgRg=#ORG0d(=l<)$fR- zeVV$?1AI>?HhG9%NH^nvIaL9r0s9r|O1G9W`B5Kq-{JdIhA!9!h(FpaZa0CRbZow1 z*`=!4srBoPUiRw2`~CsB&L|XG!4e%F7drITBl8b+pSnxFr95E1e|yTO`O7|3u&p>Q zFb`W;Ca?J=e6Jm2rX`u)+<{6RRb3hLRQSQOEG*RJ1==xg4P`Bqt@b%6O{O2@6z-581f@reGmm<``nV1(e3Y7=Oev1aefKrC z?A5bcr}#&a(MeCx8zhRUG!~`2j!^j2B$k+mTy^`oz%n^>=$-SkVITP+&nNuu%T1}1 zh$bL93YND9sMtyUZztvXN9eKIxD^hqGm}=wt%)cspC_`fP#j1gsA~^yXG88Kt3r5GRLAU|{3HIFi8B36cf%iRWt^bn z(`E)k+z}Q!j#HMoSx?e*Fra)18c_)6p*7z>ZDYAFX4Fxc4CtPukT;r@M#YAEumR#S z1(}AKcbWLFSFa|d{~}NSs1A$V)PtT#0x!mw*cJ_Y41E{~0Lu=zi z`BSdxFZtGk3977;g@_WkyGEmB3GrR zjqq)}L*`kTu8WQG03iEoC#G64qPy|WmA`Grh|n4tzi@8qO)7M6yAuJddl$^Yzu{q! zkmw+Zbx+U=nQpv%eREgfgS2#;on;vX3swH&f}zFI3xPzbXvw|mxu;b1X& zob_8Z5bHN=@#@1_o;EGdCTjw00CQY)|JnIqwoEx2vmM!wY*hJ1)g+J227+bR_ku@y zpO~@CwGK0TU?MHgV~cHW(x$1J)e>vW*C@abh+T?hhI}RCcr$L4`pEK(tjrSGSLvgG zrwQo4P@Hr|%Q8u~ZgP9R{#2}`*}~f+4J|Pmg}3r!V#ryYhZ-rrM4jLTzCV7^*dMbG zhQn0kgj8DG3CP=g`jx!XF!xrK*cbWUTaVcC4X;0Db%@3z)6K`HI|m$rTp`-o`5-5Zyb{NvzDJ%o}G; z-xk^sowRk)I2t`Wi(-V3%cEW^dJ;?qk35;)8RZ*vFjGSCzR1~8MMVjL^z(6qA-wwl zl=mecmxafBtK6MS5OB5ljD0vH@h%I)#n~)3`j+}A7J`ec4i!?W1V4zRl!4MBph$CX zbwu*@y)GMYIBd|?dW`__Kcc}4ay@}b(oK6P1)6#Nz zbCS`wh5I``Cg^=FkhXhz8X>@nqV# zEaQxuwLeC{4?UEA{YI$5MtM^^l4(sR8SB4w*YzOYOS{MA2~CzS!IHhrg3_d3^&Pc< zHO<|EW~mG}5T(i&Nn1b&Yt~$t36)LNE72>n#Q+s2NlpS&ld1g{+|j#%i9uR7L!d9DDSSf9=cv ztQ>z8)sI$OX3(1(PiNei7u`(WezE!hqD51DU_uiJgmiyO2rT;eT9@jWkwrIb6pcKq z&p<$>r=4c)6X{#)4KO>Ue{Hv^SDq>nd>Xu2ylqVHLz3men+J2CtHRM&B~Sa!O!WC2 z-)MNkJHTqXw>h{VE;P{mVP2fknI|-}?Krpo%xdD6C;TDTHGNgrK^!P$bYc=B%_;XiC1X(t6Rw( zk&f~V=ix%^pu7lKx07(KQWd&D{DrLZxeQibER`yuXn!HUzu>C{KXRtj{3y{}m44Kp zBcNA2cQX=sf(-`dsGM~`w=l_1_=M&SBUH37);0d5=S)HUMmMSG%-_8y8@CYvo=_$5 z#HLEu>y4>(PCBc=xLriR!?cZ1F!R(mYx+c8Jo%P;v$xb+G^k`?6ydLu76Roy^(;#t z#>3Q=k~mxi6Hek1?--)k5O+e^oAP?nt>vTKvI4{0xz)3iFw|41SGzNM(OUwgC!sm2 z;n(7J-*;v9#@TGH$5-3uzF9QrwuPzmBor+xGqWqZS=|BLLEV*~j0vd}iHZs+>e*gW z#&4Ir&`9xu3Xgt1k4hVGAeOkOd2zf{+CxN~#{i|~jys{bZcf26`>2LD<>|Wx9MA@? zc+l7DG8LDNC$V{iVKgrfiw$ll_0fIci`8UZed*E7Ixe^XV6?`pdyHKaV$rU(BCpw{ z=gg36$)=M^H&?Dl3xw=%H2 zGueYBo87SGg1 z-GWE-qE5_{(h)1gapb(&?oT=lZ+@2nxAbl)CG?`INIg$YI&o)ip{wFBc~;{sigVt% z*ek7v_^p2E8brzc@VjX%cbh-J=ml~jri0vXd}vfrTBAWheGC%4o7Z@FHQ#LFUgN_@ zf(O{6{pT&d?Hp)3r05-~R_ZB<``}pjLO}=?oPO`oLNF_VlKlB+=))L(V;1E+8@Hen zP5SKyt8HPnLu&%GKi!0kB(^!L)*AN) z@^aQsBUmdeB3j8UDg-g>6`WGELvO;=CUBqZINnET*%q)D$ z4lY3q;4#j{#3yRPt@SmgQ^Jx@wP~Q3Wfw>T*kJR<9cf|rn6h1Cl}M3NH2!UiY!`+G)ypIB^`+)Cj0h>i z_2-kJAi{L*^1}*}D5Ftyr#H@nv?t6xREHW`+-bJjo6R>(a>`(oN04Ud1G9@{=PfIx zSF9{7&KKChZI#w2&x1kc`tNntMK}M``1ueMgaIwYu_Q zdHCb`ZLi;JwHQm5C53#H(s!1Xd7^6Ls{aE6Tk~Kv*tU%#@#IM^#9JQX5PM8D22hds zD~~V-(Bnkm_Q7ITuabP`xu85UhnoT4Ur*0RlRly%f0B1Fxp{=w7jB6@3 zs@p-k61tAfDI&6S1=~RM{iMw z8=eizzFAzQ1qNceFjp>cw@NpHT*$Ad|BL8e_u8X5(S7=BOecsjx#aFUp$u>8 zVOh55&dr+=Z5GKT^xq57~v40i2wIX*2SLu#?!1-M|^(_ z%yw5Pu*@}gaOTCamIx07)9j{c9lpR~u7Q`_aYe(oxM|>}9HOr1Gt^ASzZ>L(wVvVH0^%D<@cd80 z{y!jS@E&UbV(DvJ6f-({5;bMWp6epbbqnDX#Q?1FXnCgg1|}l|p}tpUEvyKT-v4*Y z4B_1L83LEfm(sk(x*0BG-G$WvgxIC_=w~OheFE>7N~IZJ3V&Y z#PuwXy`+}mpQl!txw~I=v2;1s^@Gd!FZg-gftT9<#L)j473mgxT(6Go5j%A!hk=|( z^{NabbglB}0b@);j{~lBs*IE`+x3I2`pXv>)qi6TLhIJ%vW~_e=@&0v3>uU%agETL zEtwr&Nc*q%^}PRA?(HAWI#5nrPGgN&775(3`P2m!__?Aoh;iX^EagH|J|x)XJWxSKh|M3F_Xjaohw!w zwrpoVi!&rPPn$ExBvIjda4 zYR5QA!&YK;*zTBKf{VIf_TTLP@AR~`JrM8l&)$EOvg__Q9DG?z9M8!6S|Vea+vP8Q zhO%MvQrkOL9lp6aKg_r3|NXp1?r}9SDV8xIR_GPe-?8{BWcv_W4)BnEVa}I?7(x>OR z>x_|&0`i4KWslY$Ezsq8UMJ3bZ*a8GP7h%up3l#AdC&C+H3PRt4xZ`U-K81%{6v6` zB0);!i!cD+8&EFJ}iC-U~q zPE)16WtV`F@^$ChNMg>rZ z^7+T+iOXlKA|`JCdFYfWn_=FmfvdGKa%O0BDFgy3&e3rH7&;FVOMV!=R^T%i8&u=B zoHE^NsGdVHB*{6N-~ROFk?jfT34qSyL&ssOB`tQZD0d}%z67`$487kenvAaurmt}0 zGeSoF7WZ+=xCV5~dpYj469p47=PSh|3S~2|t3YJXHEVqx(KfugfFFeD)BjvT#0Njz#_tg%lZPNMrnrqZ(I#@qM8&Q`d zaqD=bMI`ym+>+!s(z?nYYntCQj={O*05K2!QT_OI#O5{l;HFHj1R+mA0F)`1mhIfu=zA#iZfHY&OaV=muzBh#ez)@jE>q zy&nU8kTT+O2Xwv*}E67Ja`H7$69`_VHSfJ3l^2smk8P zW4=F@)Cf?D@;A_eCE8iCd)B4{jVF zYIP^AxL3W}B=55PZamDaF1&guPTtqRg|5UG0*Px_w9af*+aj(x#Cb=;P3DkVIByP< zSM5x4+~Y~oI4z}XYf*}eYV-3S65g$9&Rzsf4Fgz8VM+ zD!fLGOD;*9?(y#Y3UO`g1!yjUNFN`0VF+&9%@US4-HtHoRC>jHe_PGJ!Wb6brmwL@ zupu8n1$-tE#2EBI4>O}+ag;rw6y-yYORwl#zj2Gn1di-+(F4ly0F>jSEnN68oLXtfFAvLMzWlwzIZDH^;P2*Mv^flaq{Kc&R3h3f@`JMn<`Ka*q z!v6dKrhgJqEcaT&qI$vZ?BP;CSvsfd$8-SxuAA4G=(FtKGyxb^3|0R;$s#}PE5f>h`7jZ|PzM(3WPqaf^Pd!RyqV05cqRrm~IOdt;2aGBbUHKeceY=~z;s9C_4% zU$=-cXIDRSN>`tBB$FamCmpr~tW|&IX-6((pM>L^?LsI%rcy?HD40w$9m*{604im? zf2DoQR;gp^0V{!Q-icHp`?O|5&K|(QHsG>un7BTh3)?GSemNqxW2Pu=pHb(VyBF=s z7BjeS)Z1eMX7|SNgyc%CY^wC`s-)gt9a9nNUhwP@S3@b6Zgm_X7I>C9zoDLIUBef7 zTAL8k7LL?LM%l4sExJ54lS@bU`YfXRQv67M3wN)ntnew;!e+%JdBOr$hq+1S=PW-9 z+C^MiG6Jpi;?*AKZG8(ucX85UZu;M7@Anyx&35y)m#j89aH89s{@_i~$V?}Rx%vLB z0mCWAhIiW+SJj)}eW@e-M1Gnlu`vwq{?fkdbBAc{>Ol++N9apU?^szM%&}RIxcka z&0u7PeD_2~G?EH2CQc$IpFPLBx9l>@IYr&?+h6>Sb;8AOC5?s{o;>YJ{@H-B2~Snl zDhkXF4*-*U;IE|xM~LdQdI7Ymg`|l-pj8?vRghSI$uW*ts)Zm72U! zI3KtOy4lRt-j{f1t_22*&E+%G-Xmv4uG)QWj^bw!GfuxG-eJO@+vE4-=1&=c_KZI0 z!7rnV0&}Bc6DEK;2FEEEXytAAatZi)#))~;k#M3Z+NWg*5%BBBQtjde&R(beKBZi( zr8>R>z1~3E6urOHr+S5Z&4v7Ef5aZ;PPm$QDz!m01^s&QdQ8kqe`P+S$-U;$=#YwD zgjY+Qf;N^Qc(SO5xk#V^erw3z&=4<@|A0NWbcLsj>JV1$u~%k*;T_XVlyaCaC!qUs zMB;G8bolFlBR4FQmkMW!VNi=4%CzXpjmMDvW(Mv(cJ<`}<_A@ilTu0R39O2yHOj36 zW`G2d+SpW4PGMX!u>-y0H`)_b05K`xnMrhg{M-Up>PmHx^DU;+>+=kwE=4g;aUW{FrtssTHVX{8R2+H=8CR2Chy`PCN4e?o@lnmmg%;!=%h|; zw#Ai)9WrJF(sfwqI%&0bZ{y4GGV4NLre=IAvdPA-kthpB&bm@kUM5bME>N$2YUQIg zlnQO0p9!JR#au}Km_21t-BZ}F%=}*OYlb`RqOPQ)@G|zKMwH(YaD)`NEeeAPs6 z{$%?6CL?Q!o{6xL_Zhal1(;S>MTv;)k!);6VM!VWUSrYH(F!#|eeB2pimcPzo5t;J ziOA`g>|CIYyLok_vr1zskCW5%643&#PXKieQ1iAF9kXbMoVdw)y4H!fFuO9Ky9)36 z2KR4xL#lFum`|l$d-z7MIq)Lg&jj`$5enTB&D&XY;uQvXU3g4huMvTWJ-*ZUz=-7) zz>yFBeDPthpbwu%_7^4VTH%f~7+G25ol`ZCnl}D0Hu01lbe)`;--D^R{xBk`!h#{$ zVRU=Zhsy=mP(l6>Nf=E}KL?Q(a@OuMW-)fv8IAtghbApGE zS{z+g2b3&uPgo7~%qv13XFI>KnbEwa6F~jwi3Nb4g5$HU_Nf(L5kKtEZztJD8`4Yd zbWC7O5je9vccO4*>fu+qCORM|IbcthLIDL|CL#VNlUSwX+Gz#GwJcveXcll8@4_7a z+Tkq}L$m=>I9=xGR}T@q{qin?n^n&>wL6oy$9Vp2rR0zf)a~V}aiA049@$x5d81D_x`J%sJj^{J0Kx&+X$Ip-*7EiZ28GEI1%x(JOJm ztKq|48*7Q#XeBH8q3hcmOs((z%aT?MP#SfaLv>^x#jZ8YQEGPk6Jw# zuj%|o=$?kSmS0`uJ2|V!HOj(mlwCU&mQjv6e50Lq3n(`j1%kM(9R;R1XqWI7z+FA` z6m*A73K_0TZ_e~zJV)L5Sk=vX1X6wcneiJg@JAFi%FX+jmUjey0({-8^lB+?;U%h& zn*P-E3)|^k;$%0=H-mB}9E(casqEKA(n^HL@go~BPdv9UewqcPTeE_xkSwI3jR&Hs z$TN|=%-z`spa%(oh5;Ii%H*H(Evkbvll-}ZowgGflV1vUd>(4~zD->xXJ6E(m!_p= z{R=1)1NT{=0xe339~zR$jYWkvQOTGB?FH$v;N&Y^1$%_z(3Zv}j3RH6**WiOEEp)6ILEfsM_p?Zw^G#F)L?W`<@Tg&-sfQz(_2dJ2Tf$&Wj#L$YsKHP7pwEo z7<>mNnIWfJ6N8X&&!^bXGp)TT%}-t=%Kgp@TtMh};~ECICopplot8P4hofA~Cp4xM zjWye64a(YAgDqV^B{bJ5ie}8VHag(gp4kgUA)lnCwt%9tzFcUi2$UfFJ^4d;;Cn*_ zwfv}lZVt`-0|v(yvsu7Y_422M6^fNBCjhuCCluzvVuZU4os5%=J2sk zvbT|AKCQ+5oTnZ7--=5-65E2DBU;Ys@(VkE?GFKv~AJJH3+nS&~nt+b`hw`YOJll{q7JtHr}! zIXfiFW~ZOj@3TS`N1J)S`;{Ij)vAZ%*jF-Do3LFEBv`I~AN|Ffc#$lG6cLC_Q|6_4zoAU?m+tQJ}BM8{HauhMJWBq0}qS+<+bk z629`hrYF~Qu#iuiJqp_mZjZoue1eL%G$S`%Q@1=MqNlh~Yew_MV7aRPq(^f}WDw@# zsO8}{7xk%WXy?tefuN0BtLJ9jJsJxwh%RYr1Wp}BO~}$&b0wL+|IPxp1x{2VLCg0M zvZ+U1suDK+usA6@NmXXP#cZ95f-${BX8`us1qcpqpolSA4spmSLPxdY8#4Evi&U{qfev{)uB+IAjK%4yOsS2$?=)F_nePd;AN^WhsAR^ z6=vpls|3g!w}>M#XCuPL#gv@xj_nhQV=Sty)w%uJ#*0w?Ge90pt5B9R`7q=NG}ODv zdG0svhX9-tdIBn$ld|iVwMUc!wm% z9BD9%eFlBTmz?>Y^hty)O*VUPY*XC44(8o8n@mieU zz6fKhJYgAZp#!NgHWDKcAN5>1eg$X?IHf!`5(GJX#!WRhe=Kh^L?QZCIB-y>E_ep8 z4|7#5nlh|?=W}K2lU`o^21^^XY)plGoG9U0iH;rJP)dY&_--r}^cJb%TR-MR_j|p; zLM=7@zWkw^T-ex<6c%8`A9cgexRzsQ83we~H^x_?)TU{nt^3`}aX(u%Ni@GOOyoTl z3XryD-IiMm7^vPjq_9kI>~AbHK7PM7^OGQ}#P+B7biP{eLe_<1zW5AH3>|l{oGCm# zaFlfG)afren{P<&_K|vOJPb4SsnVE3eM&lXv^|yVTZ2tKtUQS{De^0m#-`v{eC> zO$exn2q8gcfG{4VYEc0fdnw2!VJ9SEI6=b*JA@EW5dwsS5lDbA-s?tu9^2CQ*FT_= z&g3FwAc)zf0_m|Q)DNJts0fo?*!d|s&&uP~cPb~eCfq9fHObOSA!XAN_ zs2&WXK?5-x&|eF`bd|*i%%)-Kc6e@P5-{7LMGuzwr1B@F8v;IOR^PB zy1mK888Oz#*7LOn3LE*`g5+c2Wm*{z2m8W}X}!t|6Va#a{8r(01u z1tMP1oJXNAAGc+%cUHBBBeVKefPUbde2y)Jtz6o%SX$?UAg%mow!!7#TcbOw4{T3F zS60*RMN3z+U2N_-Ftoyt(-2dGNrOdFuy98XhPR@T6&o(aZZ7kacqFChWzRpu z-AU4gkh*kh`E*ti63eJf?C#f2p0?1;+qJ=5FDKs816`K(gp0KlT~dV{XN+B|*%LpZ z%{54`wTXxH>-}Ho4JRkRYcrs=`*=zlm!-VLvdPuvB=*@BwPFZ`K%wb&J^fb#%ye1V z!rb&PPUgO$Hy5ttlAY`nJtZy3(Qy!$@%jsOW8~_i8S+ch4f)9=u3uHK$~x1BS&cbA zUH1?9JgaY`!f%RaP3paQy5Vgw)qPv1G0gix<eSMr)LX9e=H>Kcm=>Khmz% zImEJ22paIMwks&@hePJEEACM|8XInx-0lGBazPkf-W@Nyex{i)df3B~ZQfeuGm^Yw z*zBI3_uwBho24EPWnY>lCaMw2rMBjjynTKTtd;ny<@KJ{9Z;d=4D~;HUd45TK@2&@ zV*{N&Gr^TlV!-SlZ%&&(Fc=6ce!6wLRoZSp z5It3&t~^a`55f_i^c>RDHd{L2aq9P)Wd_ojNu#I-v^6<(DJzHJa_uR)e?hdaCr|PE zfF@(foH(4r4b}HjQH{2r{foz>x6$0nBDD*_80gyJJubdNRb zu*Y$4^cr|>t*7EmEnB@-)}^Pq*jO_jco{w@oEo&^HOLXvrU}$mf1MIT){#x6H`{N7 zZ#_ZHQBqtc1LsWLV-7+r$D8J{vpO0)l6o>dPm*mcZ7Wi=<2Tt@c*Z^=QSO*ih!(&)%oKLAqwwSHk~e(EW4KI}(Gyy5E(tF-tZe zg|Tnlk2?}oBYYJPn#NF4?UNH76?si^SJc|?Cmq8Kp;g znTXy^&KV4Eo)G5x=b74rWd5{Y z>4iz_#lv{tb8L(Qm8@M_q8xG~m^J}dM1H$PCu_EGVjUHIol%=yEwKrz1AOSBO0>Vsj?SLh?#OVF)&;1;;6O=lMmjKfdNE1)>z(+K#x(8p zi&-G};BWdS+xM%`6?;`s5yM{tisJR#5v-`SuYXn`(2z}a4o8&xm@ZNJu@u& zt@@UniN%Jwt~y|ta*!l8MB{SinA@P+>{;4mqOvwmSR@T_=?V`%%7K(z2ft|9B3IAP zz9($ebg$|35q*hovQXYQ4W917wvn}=g#E^dBKxy5Wbf2LFd+1_;9Z_qDjObl@SW5o z@X8W_=ct>LJX*@R-uln5$^zB^_AzYuN{g3m+m3~^#RB@^vuhJ_p6K;fXnQC~9k`Q> z`%(D|H0U2ho5H8g&OsF^dA;pt^s;_&E%=eto6ECtO20=s_8|fKcTj-m$dTrTiwI%fBX41g@PawBfcDu~WE$yFXPDBCcFlay|QTH3150F4pa$?Z~kF~qM z<-)~#8t1B^J)=Wwpl7X_d^VR6m7x0HThU-t3 zj!%03r=_`7T|Tt+pS$0u#0Spy=h#cg@RBW62)tN$kx5}NMCK^M>s4@IDKGETqE%#T zzXxr}8a-I7y(oL)vl!=j?-*D7&@9>*gm>idJL@40_GSizvjaf+Z0(`(A{m1J+oPbXwf_;)G}xF*t4vu` zfdgE`M@tXqd4!V1U~}eq{0;6<(8NnwJdn?w;pbuZRIf8OSsW(;cM&g}W@iirJNjTN zy{AgCQ2x!U;O6Ap8|ft)jpXP`^l?bU z4qC_Oy%|9j{o;$=3L0Hbx}d+cwB#`2m;ZBp1Sms6J`&!C_5`~;_{oDd!bcc(=Pd3? z`M|_D>M%LlB5u3SWZ#bQPvDA{WfVdR4kg}W=*_8Jx9*O3($u8j}O5X(9Q*f@YqDT7KFS~@K&ww6c) z2@=2dNf8g60ssDvUpQlB0YjWYa2*xO=uLGfGVLyP+>Bg&X+eM~F{suu@IxV|1o@y* zO(`o#SQymdAH@x19r0$Bh11-4-0(Iy(>|Z_7X>3rjNXcmCZNB$d|-`3{CV~~xY4-B zubT4uwP_;DHHa>#n`?)~1}qkPO8(89_rYLzx*@?!B240QQs+0*~_LVZ}XTu*^zYUby&caT$%cenn~rOorpHOvmp z(P*yEPu55N5B@>#dOO3&1^mJ94&Vr~o)*7*sR+^iB+pBB%`4tJH=sjJ`==;XI$FQL z%iY-EfS%Fx9SSxU3~6vX-%V82UMR_2?0i(>4d|$RFafCPE#GO?x^c&{nxA&wGNLw| z_DoO#(~^JltY=d**oo*#eU=|?i7f*);7I2@5BJVT;moWgMhM7DK-Qkcz^B4V$3%MO zXs+hmW&FoD=BJ0oqZTBa{2}R_3uKnOeh_%5mRZJ~;HWGxnzdEyS|5{U1^Y-$9 zYdA3ae?FX^6of?{r^iR6?aM=+*L8z^hWlFtDM(RNV*c`Fx?uP%d5*#=eid0jT3+&H zko>&c12GyB#zJ_5v&)i-HrNF=!C^sn{@E^X>rM*X(bkgf z@sS0Uh{cCpFj|?iFG4X}2rCTP2!?oR33e(@p0BciK+rKew3cR%!E^N!xjCDr+R=2GQ^88Pqm-9^jr)^vwA25^n_ABhm7$#M@!xg?v)VWh= zeg7?a;f(rM<{gr~*Yq1KK|G*zZDH{+gj4&AAdG^n8OsCZ@)+pQj*eN}Bq67EB zrd`~pW6@C--(r!&Lk?n-k%Vt=?vvLDyg9Sarvyw??0D)5BIwGr`VH7c{Bp;rewnR` zOUKFgqJ}W);FSAcW}XaD?_#(V{l(?d>_kD6huR##g;@Ys3;|>+IRCj4Eb#n26Ix|j zk;5SQ<%-}6HN9=No44wp%PJc;l9BA+Ykb@*(H6yP@>g@MMK1HW@ps^uh;xr=O{_To zat@N0CsAcuQL#7lDB$re=^ihI z{fI95t$_9Q@zRS^D+8=7ayOI)CSx88W+k;KGM(2ysboRK##RWYv#^L}FcbWxTrO6% zbnJTQChgs$vgL)u9F&O(25xu7h?QXZ3K_M4-l;)kG9yj2Fg2xNFKt?EhQI!FFQvef zeLQMp^5o8(3l3;a$f6;0FVy#%R)IUQJvl^y#ccMIzGljFxI~YxyWf-0Nu`T)81#N1GjuoCHt!>{x6-8%~mKA z`fN7JHn8b>_*TbUd{9@XAH7Op_Rf!*|2!#pKDcl=SD}5w^@8}_CXOXtCd&N8>GdX=Cms9`Nz9TT=mn1la^F_5X(g{iL|P-CDxd6~7mW(Sus5)(>1KPnfs$<*yYyZF3xk8(Pk&zn?Ic8?(qk z;y*6mK@6`To!Lx^V5;7SfhW7)v0$1+j5n2zTl$j3V1lFWW|>jFo1=ZMnDR`nvmucm zx!*pFU`+QO@``b{o!u9;M6u8`F^9KX!?fHcFEEAfn^CtH2H^zTpP!FujxmF;Q~gav zbi|xUO(mY({~NCr)8`+X-P@5Zp$PNmAC>_X2BUF&|Hx+N(iveDlu8_=Fcq?Wo$EIH z=>V@%68Nprdk86f?Pp+@6LLR|{jM~X^vx`IG7!^?^Bi^NFl(vnLt?^5yWgif#UE48 z5`I6@39TNPrrY+jZtgFP{o>aO!>7ce159|2bS<(^@+Y5)`lt0*PqzSJ zn#+8{-`zH-fA-D_YcC$VH8Iyd_)6YH9*22M|NfG4*0vEfv+|ZKmNs7C)N$S%c&6sD z=6@=Oi0V6T8Odr8Pbp8W9JBiE9mdDc7Q;HpGv1!j>X^avRg~d}RVVH{syv&0$8N0S zf+z&ppYI{}kz+HHr=x=)07LB%i|O(OTX1k7^v$`2a?_q*fB*5_`3uWnUPH#8n}IzR z=hlho5uHeC2@%$1ZShbvHcg9*?%KV~MR{kL|6~DYLq{&JSH*UKQNZ}2_>BjcfhopC zhLaD3UuRP@G6s^eZ2(Luk5REMWjCpvirm%C+kYhCh=F-fy0xx_hrI5^4n2UFM z$G|K|6Q-n7^_zNn()ejff`ltet7)4VEnZxm+TT|kP|)#wAwY)zSm>CjEE_p#xk6ov zx!U~U?hYl8*}~__Dk^)qhb>;(aKG?7EnGv-n=Oi zsz!W2v;8#CWU!s&Y6e3ocJ}+5vwNSn3J5NoFkN#(|C#RA359na`I0z4Po zZl*fc(ayN#9o(b11yd(08$r~w(~RzwTX`y=Ey3B!f^}F)XRhZuD)wlBWX*$#ShyQo zODK9S%QJPCG;F@-BG0I`d3xJ z+`kyAw{unRZN2anjUEx){?)mPS0U356G|uWae7w$1Vy{Cg?_UtdDfO~j^#8_wy-%{ z^7xk_ki_2!Z)SUZ)s-YXN{|GEQ{zqWRja)FuZm7a{yuebZv?Cm9*xpfkv0*AN`+&r z18jbO@$~GQj;o&jS(`G*kSFb(dKuMKvLr(ny@Gqqr@tVgHf(&1UN8~X=Q6u#J|Cmu z+>)>AT~|YG-6`IF&}aB^;TJB)kp7Y2>!Fn0nj&RK@sDw8`b_U3-TFNTh~R2QB=J8o zJzN5X`{FiAsdG=h)93<)+dQ$2ivCm~)DZUs^5sV;v#5EpD7N62j_-9_r;XzGxa-T7FYTYXROc5&)V0e^*hm`)7@!8~ zO~vdP9v{;?V4P4LP9A;uf@S*K>}y9ms%(02(Yqpj6*qafnBvSFt_?pwdb=30y*=S5 zB*F91+up9$H2HjK3xm6UPmRZwX^oksZDa9lbJ(%slI9YBTH12@_($Zi;CB`}>F#mK zl%A;t>+yD`AZL*)5zwq@IoY>e7|okP!(*GCm4;~A7o0r9dBE*gDV#m1tLn3@=Eby1 zM7$b1(D;@vLKO;n<*(*{*b*PoLNM7eF@zfO@O@OExXR%Vu)r1|NoUaiAOYmVivs`NBHMx;n1-R)sC10Z&t0AyT4pkE#S_s<-M8>DLbkJa{j{{~srDv9V5(yftNVp-pYHhVlyS1mG^vbXh&jBnFlMeQh7vMw_>W2VA!>GPR>b&ZQc5Ee6f4>ya;dQ2qOGX zwTGXdx|lww5}m)}c+Jq6TC24l=m_+<-)lzhVTMew!#S>#MNIB!-5b4`ayT$YT~jn! zS!Xh|bMKAunB=6O6Hq^+>HhB5yD%;hT=dQEo$Xwfq>iS9y*gCP-EesZeLEO0ZHb?j z3lFaHn@T7U7XRnk0fzCStX zbdNx>f!&tj54)(GHGNs0ORgaS*pbeK*;Q5@KV+0~LQYbJJ7|Ih?yslZ*8MN;}Cv zn@^IYFjM>V@E%nycUQH!t#3Yz=)i_NL;uk4%Or2q8XV`|H>s+l_v;3xRaYa^ zo+#|@L#&$(%1c`O>e7=W^Uh}~e+KC5_Tb%*NgE1D%$7|Lpq8YOTXz`NxjilG!_|GF zr?-)qMam%8w79)GxyXnNyu%RVznP$TYk)WYr=#0jm?)SVwKoPvn6z{wZUAgu$2F1< zUvxrw!X{7{kFcq@4i?mhVxm%8AERJ$gPFm*Fq_w&*(ffHX`K>CFN zcTaSl@6eaVB_bz-^AY<|aXdR*Nh*6-v?6f`gyMp^4)K3#5!(2MT012fjM4J_Rbfek z&(7+@Q#&WUf{Q}l_z1Jp~ z91@6;SDhOi9}eBAOUDqIhtHMGB|eCVptBk<&a(Z5`BlrCs*Ixt#0YF$PvP3T-%3{T4%;}!U>jl3Tg)QdPMHu_11Jl0fANPL!F0}#14P^H-K!m^=ljq<< zkJ7Q^L~O&1*p=;UfSM55fesm+v7+j4X3BwSXU($c^yC!VRbb-2`rk8T^q%*4a=>ft z{yJpg(Y1Us&N?Mk8?y7_aXWT7~OiXfGw=|7g6mu(yT+ttFgHll1+w(nO=h-sgFN zn0DnNW(g+@d6QdbV`F32i(W;F`ymN4SKO$1=Jl1e{c5>9ueAnuuN>9g`O}6ExBSfS zv&~A4D%X_g>@4eE#Su;&0Uz<!Wqt;uXT!b9jz!ufv&4$Y4RdSk{=wC1&M+KxD zZG^|({DEGc@H(r7?-KO(Y2~q)Y~9|NsEQiB$w4K2x_QrG2o;sIT=%+RbK%B+^V9R` zvawBt+yO2kVS6`K2+47C0pT+h6*E;cB<=lke0>Qu;(55-obFBok43(#&oWKAlo8FC zp7EoO``JJCE{Nk9+1Z5-)fVhyy5)J4&Y2Rn56Ghky)m0;I3wn=&PzJKBwyt2kVHMO z9)hCVd^P}jlSi+vFfv%EFz)to!UOLZN55GBVZZho z>Mb-I-n zIQH65^qmrXZQqRiw~@x*YK;K=B&F36RNDLgxWZf_0xRnoQf zi_924d${fHm)ll;qRb%k3C>WU3xs7@p;7cQEWS&c!6nSCRhhsJ6$tNk@5BOMlk`v< z!V!kC>MX?C;LsyWcB?khwm98i*#_p|_L?QaXecJ;vg=NY4dTr=T zsk&v;m-XZD`?kr8OlBdR_pu$1WAZ%`To?ZWfT}+~N>OuosANuZyVe1-E_Q^{NI`#p zQz}kv*+f9ZI`d3eiMR7p+l&q-U$;wOp31mUp)g zdV3i4fc^p@rCzLw=L>x}iKG|3m*2PjuGCgi+geo#W*yK=wJ2DiaGU$3?Fm%k-`h_< zC-O#7&SlHW>%0rQd%bNMxQMNU+}L2NwtNxzi|QHGOf`9~n`w@&7p<9VX5lfoh?xfv z62JZTvUAv~|MmU!!CSUnZH99+4z9F+H65TgAMgo?HfLWIhQf88k(OH6X}iC-q^nwY z+=CcJb*-I~l6fvg#8W+h!^Q_SIH5`}L}0n)=~jVR29dXnliY5pyFv=US+$s{wr=6q z`gAG-s`y8B{uHSCX+}v7_>S>B?u7BR(vcBLP=~NG_sFrAJE9XuGk<|b?rPT6MV%wS zmbmHO7#q8pL-R@xmDhfKeU*YezZF|F(55bc#_4-7W=~Z%1`O<-0JdbO#jAwEvmrn} zehM9s4i@$zs|u&MnKAxGiYr)n#r!`*5Lf+88U)@84|IR>iK|1)L< zN-WOK5KDyUd5aupF+(Q&m055uJiWARxjr*qx$wS0y0x5RHG`XfY4PF=2!0=@!KV4n z+|;x^hbcLLyJC2ulf#Z|Y%0D5+yQ&!cGP6X1JBSxsspPX^!vJYS+@ z-A^zdsL5l==f{^KO#Co;eJ6yfjT>?FzAe zC;xTIi$Bc^%JAvW@qNP$Fq%|A!Q85-D$&1A9`fyCmy5<2^53oQ0-Io& zXXc32$LZ6jz!N7K{n(j0BSX-`hjo4nfS1dKyZ#hkr>iP{n=8z=C$jK9CRfMf-i~k-UJvS+cX(;Vvf|Ekf zXsVo+=VP~QaN9(ouSinD304kgTkMN&FS@dTCvBi415I^*2`=@b&-GW64_Accl}`8I zKEJ3BG8-051fj?9rLYDfjR-Eh#9u5*%&0!lNdh$iKWYcQdtewxeFCK$Z{3>;9eTvw z4;zq94M{1a`Py%`@QEZ+r%_aVzTL5tMY__}>WP|*g7N1GAc!0Q6eO4FKQhG=_n92T zas(n%c1A`Ka*PdH@Y_i?E}|nMzAog>VPPeK1x1-rOMw@;6Gs5PH@#s{z-#Em37T+t3{4ar&Z=nl?eC#> zp}p@LO>uSJ26wA zdQOT2drL-4I?&$#?w3J9;{&j*$qIp6UAhAG^VoghF;v%eB%^7~dP`WQyN{?q=>(|p zsD{in**T^4rZ-#4J!B)ilQY_kq7sYS4{frLDk?Io51PT-mTt#0B%ZK&?_xcg)?Z(W-eRS}BM_e}9%_m18of{qbj~@MS&L+)2 z_Q%B^)`hJw>=c+QqEuSc^nQW5p!xoYznv#eSmEbpgOS8p4mjq)C>e*05dxaG@bSyA>c%;o<6I{*JVj}ltMa&*MVm_KJUQws`S^nti~bwShK{(B6al*{biS7A_&DFn6d zFp9-BxnJZUPnfWT|Mp@xi6CFxX&2zw((!(Gqo+JbJE=4^4Ozt#6oN6N$fXP!&|sR`SZ zMpW_i7hYqz@X2zagrM{f7?l=ZTh*R@^DYH3;}Sy9nYT}LBTk5vsxS@t7#p}Z01->0 z$33-90^D%2udQ(v274ZRXimw?A=i`-jlQg)bGjQYt*_4^Fk>)xQr(H?Ir2l{sQnbz^m z=UEcdL8cKPx9FQo>ZXdpN~Fa1ZXRe)SX7QzKm8tb6yhH5#{0d z^Hgh;c1Dun(3DRhpqV#R3U#G9&^V~_tI2S*vlWFbzW3L10WAT!8hO?M2LhbEhXK>S zyCSrl1eM*z`yK1rhrhGus&jwPDEVT9>LH6*d@bHJ0~6$LE(!06;nP6+XZ7r}zRS*K z*ckct&9S740%%7E)plGHiUy)%v!F_)v^$`&%3{mS($0`!4!|AyQj_6h-$dYn`b zB9;(Y^}c11ofTm%n2fVoN$t6kEY^x`|6PA>fMSkdBm#jczgj^PIW2evMS8Nh;d;WJ zFUIDhY>S#l?`UXdLS(V*fU^aBAthm~_Zjn{tV{w3K zM*Kdn>(a8~H7-BL>%hJHYU$G>N85pFX!G?1__m-eV5$a|jM1WWgq`4NuG(Tc(1%PwGp~n|vaLf1oozH=< z4WLqs3lOqc+0+!>Fe%mc#M|j?*HT{ZgF$L6z&2x_BQPi=lZ)g`pJsp2f}~KOo}eqj zH!9as05~<+DKQ``}Ye4u|z?q{+Nvq06BQpRm7DtaJclc9AB~?lOPLn4r zN`_|E8dsd9ba+=7Mjs4a5@m8|5exb}IOb-q^+OBI=v^i!%&)c}ZIMn&+stO!GejBe zyZ8Mn64OqxJB1S0^AG{+RWCt+j472TFH;}&K61YZ@lJ#^V(8Fm%G({n6K(4H^KN&C z-YSRc_Fg+q6rtvUI1;SSG5)qe7GDER+Pe(IfH|dPIt|&6D;9H_|Va|)? zh|$9M{^W(`uhUL{1{~tpZ@9!RFcZpHFpVn;n1u0Ss>nk*=(YQnpNB0V_CRN6wJZ^m zn-;rLX+2{<)BUe8;}Jb>fK>eM`ThtU*@7iE$di}PSlt1v#r1^c-Rnldyh@uJuxY(waZI}ImzfCL3+>w+m)%}y@NMzcq;VDe(aQx;F{XbuE+D|L| z3*ozWT|>f-$PXvw{>=mJhG7A#!R8;YJKU8%*fmFGM&L!FD3rk+5S=$D#kJf_U3-GGWwMd4lh8SXSF^u)VC`>p{vuT`nUaVthAK zNm;jB974`~oJmhPUf@eMZ8b|wXEkc-B+xmSp%U#D(CFXr`&BBCkz4h*!M@3JGk&6H zzlKnWm-Mt;pH77;m*X%)CphDT%N4yFE1F!0($cHc;y~xPeKuu@jFzc*odguy7b888 zein!;n3h&A<8{3rqho$g3rM4{%LpsBNYX68tCJDji5&Cl(Mo$U4r6G#_=VnkpK5E$ zOJNhG0(>X+kAwP#kNxvR*Y~y5gZI-yCG)j91Wbh>S@UI>i2kG`S$YFl^~-~nyKPWm z;F%-qdNa3XC50T$sf)8zY1zB{53@d)Pi|1T3_rU0Iq^BS6QYyrza8+0Xh94;1#{v)~jHWL7BOSaj7m47jOX*;1PE zT-vmuZ+wAzPs~#tGbDs>@_J+Nri@)E(e~rUQs9%Jm?posR3r+Mv*=Hp1Mj&czIH#- zFlqXg`44R-c1HN?X6BhQQ@U-Bnh1?wG%%I~`<@@h=N6Zq5-sngJatk3jfV`mXxbHu z3N1{8eOLWDB6|mci}AHf?6kvZ`eFs!@yl$=(njqZav5h|c3Ek#_0YjD3UDV_Sww!~ zt{UF^B^8cOsSa0>JBpJEe%WzJKdJ8{j408cVQhBX(Z@X zedVPIdij7qtqF5k_FRK~?GQM?CHtf8LpsBgJbunFTCXUj?mY8Z7K=4K{oDGZ%O?3* z_Nl~4sc30#y1At-oCOfhk2J08vp4{hEpK%#Kz0SWl)HPzR+7Tx*7*}JFk9kh)PDC4 zU@#b53_hU8aEto+9HMnu9XF)SuJFYqKYvb#Gd*pzZsu*Fv5uW$L26Dme-f;_gNSN7 z@6(p@yIj4xljh1fIO=#HGC#~Fg>`+iMR~#J`j?vt`}+ZSp(x;OJfL?x(E#w02S~`>x@7WNROiHzz-+haiQn-qS)z3b#@kJUmRU6n!JfcWeGeJWtR)E% zE0&60ycx2^_&(}QnF;K(o;;7aQ^x{@&qlsKd{y}dT_b<4X{W`zKx5G*rJWYLEtc4# zL01sM=UdYU&>?{&aXY(SdgG0v-qDpo;J=wBVYlp1jDaD`0?p>0NXGxa|sk5$ZixZdiHk{Y17R|q4lE4jQJ-h*g8jPhh@Sgc zbb#1EVLs&n?Cj_B60sd@QHlP&2CO!t)}>Vni@d5SIdaXaPOq{b1!SH&B?iBd8vVIT zL0(;xx`L5VRj2QlqIsNv;w1dfKlmT6tO;&A`-a!QQDLbP&iq>r$5Eg1h{lbUFDNO8#mvWNyW7M0jO<3ov<87nih5at8A-MUI!5m{oh!{z!aCf3y3+Ik5sEAT6Yjm~EtuQm zjz40Uo6&MIa#pG>)WI8^{!1Nv^@a-Yb0bN6l?^K|{(;;MJj-8nsPAI)$>Zhs1WB40 z+ooq##Gdzlsx*3j1*$;YznV;|!wOCm=Wt*{ek^$`>Fo;d3>JRn55lE;l~VdF5E5F0 zo_vq5;==7Kf9Thwv_Z{-8pgh3fQL0?k5F$ON8H&7I#%!H`RVIBas3`t`2|cfNB%+g z!1=luN`3i&C}8l!C^7UV`mss6(c01L3%k}QNxA=oHD1nC|6i@U&Djk$k_lT^_RdhfLW|G11Mbgo{t@A+Bgu5l zteq4?ZOT~H0e@xB}Qb&r4ivI#*hwCG7 zN2&2b%PoWVwpVxmitOX5#M^tLuiPvsKD%RA`w$aPd)%yCpDo(8);ug@@^?7B)VQj_ z`?2!$5vw%Dqr~Ou&yU^qqNd$^0+&wDA!F*L1lge~6iw^)EB3I8L4=Y%4@p-0Ab}Nan&$@%kS8}Bd{n1M_cnq#`v!;>23O#96 zl3%%%cx!xI`s%Fpt@03uAd~`FOFB!k%&*jKHAZi#nDBf63={IPdVc>Amcl_|p4`^< z^_*)T--%Cj<%cN=${qG_nk#wK^}JrO3>cqp_a$IbTilENaHdw*pS^k^LNj${CjCDX z^xMP|?${oKW*R1AopNo(c9zKZj{u@+pTgG}7XpY~`QqsNQLqp{&IXT-X?WbvEwu8{ zNJze^iP6;dl4VfO`47ySUkqgJH%>6#cDJDJ4W@5n#Mywu2b+q= z%1c|tQsy43Is#F8#!H!nuHtLowfug_1tb@3PzDu7M`bZCuj(7bP0S;4mCTBj9@!UI zEnYQ2X9t2SzLmaVCS;$S+HjjJr|-)U%gPskC2&o-Wiff~$vGvR%kO1GEt&vp$p>LN zr@Z`;8)j^g)J{weoF-td?&AM|+HRi+mOlgu@18xTsGt=o_RJokO~LeDdF-kvY)RSBC(+#nr& zSzT)Ia=SYI?HPndjI_{#X`u*pF6y6>L*G^a^SF#Y*o3SIB`f)Ft7w*B>cwdnAYoiZ zq)r(tW8LC6d-bKb>qb&OQjQ`INDV^T2@8!`$)FOvzPY%)_KVtyKFidCNJrU7?=mrH zt2m8WkrC^#j`#Gh-L^$hF6F|H?onB{8-S&fbk3E~<48B@Flcw)8Yg)2^a#m`+i9AE zF7{3tpL6;nH0I~$ii&j_!VpezdOg71RKz{I3!vjSvcjLJT!Vs!XPz=tv(}=DY7mLz zUR${nXgZ^2d@iBdj$FBZk1g(He!xzn^_;xZ_p!`!v6WZiKfjXCv~GaD+uFjScaRaf zce>q}le!+ig$1Ap=O~q8CT4E2qz99{tn4hOIin0gu}>ak=mtLcY=gQ@K{cqXw`@^J?MPJGaFkGGA#kRX=J%U|o* z_GnubwzuOYpeQaki9EyH?mHG&OBZZRe^b0Ztd)#?W|c&!3kI`$?JpYX4J2WvDZA$e5ftnoH3l+oP`nnAje#*#*mKdS09ULzz)%|Z{Zy{jbgOYw8&HX=!7O7in1{rp^e9BGvY!LBWa$jEZRt4-|pXRE8OU-6m(l;FF|8?^y3_qYf7ad z1#0UzQ!;W0Y56(y_KSf3*bn^$Na1&jWh=Mzd9Si{yGs{n<_G}d!y5D?>09{6&wa2- zeR#U2mPB;{LKL|Xw&~9W;9WYp11qGR$FM;51MU7J!C}zdhZ&o;^@u(9*$}oX79Zzs zw+ghJQr#^ZtY*iC;%4hC)zWk2Y`Uh0ZtJ70B*UFvWY0>O+F6oL$)icayu7;5{+)tU zq1W1#w9#}pkX;#^iw!-NiQC|Bq{okB_+Hn)pQ%Q0{>*{`ANVB8>Q9gw7ID=iES;K%%OF zD^%vJK5j(6Kp_|iR^7-m@LAuU527(pO-iy>qF}UyMEUPE?l(6#myfG4paa(wr$U2T_;atD~2(AKy@dUHHWzzu@3)C8=oEYE(3S}A@ZpMB83*Cl4v z7B%*0B*`1!lmKfCk(1XFfu{&MFl+6@EdcAHWZ`-l|CS3%y;5yfbM{pdnb(`^DXohS zon8GBzHKCa@yRiCp+^M4L^xxx&mQ+9qg7?qAZkQZQlW^)M4fwkm>?2_4{{}b)&>R+ zpLE-(z$g0Su$6`$@`C)Q?nmH75WXt24zM!dmUperBM1pKxM^O3x_h$^it0|}O5WTj z&hi;UpZap6sE+^+3c`igsw^7wrY2mik98&ovq8M4I3k%cabYgph+Aj=W9 zJfCzR6NWywI1~vt3l1$HoB%*`?U4Z+1j&SaqQ605Ku6n-c0fBM#HqU$B5~wdNsuaP zD0hmgLxBNbJCUM)sVSYg##8aV|<&TroRi4moN^>|n`jZ{gNCOBLCL*&iL=m~Y`4Ju$D(YTf^! zb-{IsaecLdy#jD1fFX7kks)`SjPE^OswgP$5GVtsDQ%=LtXnui7=4hS<3(%wBmJMl z#J@BgJzR1V;v>6}eFQj9>Zpoyg#s?U3;b-G!+$|7d=hWauD@T&pp6_xo+!`t3x@zi zGMe8q3Ecsx!n7ylz-&?Cnn{#UI*= z88NEqR2$*Vn{&_`eIr3p<(yjYoqv4<3pnlVC(Hp|2;JoG*V_u4B+KY?6~=5d0%e8A z$=Mn34*zTR`RfnA;{&?q4A|FJ;8)nEK&X9yzXcrezaSIBw3Bg8+IXQio@=m3{{F9a z!cBrv*=zv}>hgkSc(#P$x9LQs=KjNDJaR43*D8Vor@I z7U;j3jbB=w+n;>xp$4uKxWDh)2Pb{WE)G|ecmvG4fhu-ooxOWrQG9PjvPrtvyn7h3 zl-!)sXGrA^>{=lLlrvqjo{Wl#{IDKg_;lO(UJIBLZW=A7b-p9#TNDb8fgvKS=J0(d zOk&WE*;oo*zVkaRttNB*eNE*GA5Xs#Sy_tGWR`{)VHRDz<}3Vi%K@K~8Ohx_q`smM zX+NWM&OQXt46lu!E>XQww}{I!;qG$Rh5DKHlI>fU+(F8PP$g>Y35WXO%55lf8~^sz z3OH#+zHY+)2$7$bx3JV8G(0(#Pl5ZinJGvJd$+*#+6w@o$c3uo>dE^bEXdq^^Oqff z;Ix8}RU4n%McJ7Y_|(>S92?c$t7`R@QPBVR3t``gCfS1-sC~IFqo>C90(DY}IBk=v zY*YFS{LYl%8{zD!P>ujOL72K_(xpPUWMHRq4Du!TSFPAK=jT<>uW@gGsAK5*MRtip z2TVVk`DnH9_@C8+VzD~*rfF}??q?SpUr%5XqeCPRo`D@tL%v1R(=)BiixYNR8u+U% z6chC6LXC(QOvx=O%Pv1+K!mXX-^q7^DO^m#&43uVF6ZHL%P>e28C0NQ{MRo=E(tRy zxZf~yi66KgSg~F)CUCfcrxIUk%i8=ke*I3qqDT_CX}jY)1MagUxTNE+n;eykpzi6wCyumFHm>hE26wv{4fa*@o{ogyP>N4& zG3r}VKYm?5(R&$G1jLW?&g#;>6;@ZYACOKq)`?UH?!9~a#m`Q-wn0$d3RD&)%Zk^D zP?Q4<1fKOM?atJ537lMPK3mM+`7p(Xn4AC3DvAAc$kp{z9ER$>Q+uoq?p{9S$?H@t zpRR-o1Z)B1@F<_F7C=s(cxgoqdj@q&V0QRPRB@CwdNJv0U$qgn>dPj{8E zW(_ip192hB2{B_Vlab4ZwzLx2J8Cl5vH+>!96Lw58mdy#JYwxOG2bS8iq|j+M!=Ra zdXae6E2lTb*SUN%(1~g9erPua_1x?{f{Y!9cK3M}p7UQJ8LYSg_{v8qJ2*&hRA+Lk_v|wR4wX}v6lko>nH$UjUX?sK@EuUiw zH_Gv=^BLHk#xV_^IlJ)Y;_LurhsJZo4{l&cs(1oN`3`Z~!h=)lK#xoBeJIJ?g9Atj zPCj_43|`ao6h_LSc|(a6mQfTVhN(5z!x*TV0@_7dTplUCeC>Y6+Cmy_g15G&Xr>q$ z1qG-cxG}xGI*ye4RRv0m+-K_6G;VlQ#Io@u!In~@NfFQd7WLue(DUrtEiuAL*pId) zgO~(-GX=O_xn!14jITmA2ZYN2N^`jpKdUC;n-9yuUp9n=J{EhZ^Hz5lxLtXSwbSZg z<{5s*-jPGD;P$}%m)KzZ_6=N)ED`w!Dm+lI*(=E^TAX=EgC#Fiet*M~TZ&^L49ez^ zb?S9-Nf>Bnq^&qKZq3LUYh&&np$67jzqa_H7u*_-$iZ~QdJSyn#SJQ^$VynE$sYmd zNe;4e!kVoTZ<^62D8{=qzTc{0QI>x8TW%}j*GO9bqUC&vAJcD$w)B$z$EGfdZl6(c zlVeRjjE>uIv`G~LbSiIA^E*FCsAxjc)pOrIpL>4GbC<5k#hIlmiyPLu5B_>OpMHz9 zoTfO0>nM1>zA7-Qgpci{aUviHcyKT*JL6ziNtFwPZiG4?kLv$?)*RFs#t}-#er<8y40XgrNdG81)&Gj?MQaWM)|hAwrR)2n&yknw%_ z|0C_qjZ zrs|xCpXeSSniMvzmb5@EH*XoQT#5uzfW-Y8l&AX~RT#p~Ik-`Ud%@=V3iI;2K7xkU zmKV0;lMQ=4_z9pX&-T%`P=pM(7PgQ2wpvQrSjFX_)NQAlULKEky_vi2P9qgi%b*X3 znh9JiB?Ef-%H%7NkTF@h=ywC{RM&cbU;b(1QKQ2AgV;E?fLV875VtLB*0Zi{>`obIX8G1A)EnG z(gQHC8{UqR{rBWsu}=UXT=Ufl`w4QMNpq z!Bo~NBh$=0y(rx%1iB;r5UxT2DddXOIx8Heyk}R^3a(`LzR&{$_Q!xFaJPLTMX?uSZ{Ls%VX4P5N_and{Ci&;6S#*PML zZt4np^*o&&DR3Ez+Z&BS-7oj(U<0Paj9F2bQ+Lv4LqCC^!QM_(jJG?AaME}1om_1G(R zLuY#`{t;2XITi_KXQl2tyGpBDY*{>#Ecldbna8^2V7Hiw1+5m&y!4wIEn+g6wYYKi zRLUt`i=_CbEim;7;Z`EnvU<`~4B68wiT{kT zHTnvr0w$`RP)rhyyRW*O`z;+BG%E57hpuMI%2=sJkP_pixkNzee;5pUQ%Oh4I!|$f zYx@oB=;c(;fxOZF4~8q*CEmmAHxUtj=EAwJy+Zqn9Td(O=?{Io8hQ;nnpygkmr@6$ zUH8Jb`k57&zP!|*aZlaxYAm$CYOuA0b4>CKpEcxyA$br6_P!a2eddQo+NF08y6?zp zkoVFfpz2u53&BQU?DAQ$ZHQeBzSYsFLgi->d;OF_i)o=!w{!v<63FJgjRz`|$3C+D zmSi`Ba=+oM&vW2X#ASYY+R4tJIE@V0NZKP$VQ!MeSail*L)p_c*}kvo5Yz79PqSdM z3GF;vM;j8v2gId#l_#%82e=#7yxe67_-5M49P0IIk zzAn4{Z4S)F&P}B2wCLLn_?eXF`Z^`iUwlNIMW>DhM^;kMIzUORt#oh`y}%J8RMw1I z06$&?XrO8$xv92KM6yJaB~L0WnOtY3AiUc&iWs(6|H4GwuV7A)Av2TVqrSrCcK`s7 zzy12t1lc;LojNNa$J%Wvaavg@O#tDn!Zn17J1!lstt%oTGa|e(GS?8Q=7pM>!KRn& zt?!1KU%yq6aUOmh3%ZfMj@+Wz?g^t$?g5eW{2Tem4upe(s-*t9>ae^ONx~ zr<{?%c+T)s$Szh04U}ooi_96nz>)13)0tU8a>Z^?KiH-Os4IC@3)B^-B*?Ovge$XA zeM}ep+rZnCCc9z%&wtpBVeJeEeUFqrA#AO@;v_%ulz7N+M1sMAJ-xB7?#gP+79i{> zckjII*=o?JZrT(-JwK^Y$xS}HIX{wfN@Vbpe~py~U4^DaFk4%67lO z->LZB?edsQWrx&$t?(oQmqNAQUimm**eZa1`)h&qBNOiqs2rZPDZw5A_?Oy^uAu#) z-b})u&9str4W#mfglYK4S;Wxnqe~0r8J&TD%c_p+?n~mBes~BwHG3uHfIdcIFW$iq z@;LYj6iS%_oe(<#1p~e&Go|~E4JJ|m7+*p{_HW6fOEi4nuJXpp5iAO+LVAH7@beFc zhh{{B0WG^fkT!uDjdv|6a=aw3qy+|E;M;^vKS7VaQoe?F9%#{UR-{6xBd-${_J#cw zHtYh)X;fIi(aoz=0Y$XZ7J@8gJl}-7@LgzX@WI=i4TKt+)AfA=+R`nFr&M4}g?P=~g@87E!ph_5iZUb^A}_oo zP{1To*%o7^nOu&rtqD14l&9(F9;qM^-lXn6`G=-&UOnI}MBRCksCj;|j=LlOS9B(j zL!XnLc8Z^RdD0Fl;$KM#C%`WBdx|`|SJVeK>h7ueobn z`-=jHN{ImbpoaTNF16nx;>2H>fKlPm8#x!E_v=4>?QC2!Ae>TFRMv+NwXoD!Ak3^g zOa+~2dJkVp90VF^PxY*Uy^4(!ApZFp`pBpJT5MM4a}Cgp045DxYZ82!tes4EGUyNN z7JN>c1s$65m72>zFO-d>fZoH`$pga9m*5st^9#BcJ6U+PY~YQ9RqtTG7*PW9Roh!p zWx3>o!s3GN3bfuW;T3s~TQp@leaxKpxuq@{)eI=`-1d_4^}@T~FF;WC=~$;cD@?SM z#}(1IRO1k!b+3D?^0QnPWQYXDoPL-@%Nu(8;^QNd4^S57z0Ec`-EwZxhcw5;bcTN` zmGAKQ)ecjVx@;t6GDt!q%G>2pBPp=}S%5)~DpMErG75lZXs0O)FSBDU`#2c{G}n>|0IWRFa;;y8DY^wYMY} z;7o5KydX0;hn7#&u;*Eq4X%`=D-QuBRs493Rgj<}n06RU;4%!NndsMLK4&((O#0gQ zdd71j`T@_`j44Vi)NZ%$nK`D}KFH{pxDw^VsQP`mUNC}u{X%MeTc_b-7sR!)zqpL{ z07b*%7=_>3cMBs3m?;dXnUGbl9bKZvg}HBSMDkSx4Y^Qy1DXotx0&#-1omvLuC$}g zM1jCCFsNzvv*RU?b$c(}2(t~Pc{%U(>hg1KTPAa0*+n+_+!2Gj$353bKX!8*SjU6|AMl zKYVs+WYapGEfxn)I> zrR3+K+ah3p9^351ieJgPzOHH!FtGq%y-LakF8sI+a?Q*HrlvQ{DD6%{59s)D?=%k& z*$a?jQi??&HtS?>_4`mBf0Tpw%Wc{P{t?uNwn5ec^yzRFsq&18)RKpP*xAKcY@5{8 zo-g6o1woua9Xl4Dow-U}=TMe?R~b@s_(71Ioy4)}hmbi|o%2*eFty#+UgFKr9=r|w zWzZuMctP;3$KAoV9stj_QV1YUKD?iUKUti67o~d=28&TN%d66w{vxJ{V&0F~Je$a} zD=I3Y4K!Lg3((^za2u_Nh`6<8k`)hUv>66kjU9g_u@56fVV+VI)Wt@czetg+qekR_#M9F_` z{pAMk+KE+oBg#4-a4Jo2#wMCS;QgRez#nfO5zKwrJM|=4+lfG)FOQ0W-L0*%{)k|n!YYUa)GyZ|Wut|O(hX|UR$P66eKH$^mCxQYO9mDiiZE)}cUFr0@sL+!? zTSlpl2~B0eQ~mxLf|Y4L>6&dIQ99TJq~pj^WaS5EOeS`v_{!DsWb2n=1865F7LwD^ z2-?H{W=?dv1EqWn{=FF3v?^lWUDLg+K9AZ@>V|-szWMBoCXd$pYX5np?yY7qdtP(I zBaBT=WnFgfeyKVW8aq{?&ByV(1#`jt14tqTj^FwybbYt$|9-04+xx4Ey7giaVt|4Y zQakW|O)zQ}ROTsOS*aS6=dJsxDs4=acqC%pl2(lm@)z;8Z!*6g8kta#pg6-1Nz^iT zTEC|`m%*6cdSv~gkNXVHuXXVX);i(Gq3woMq(D+k4v9o92eZ-xzfS0myfJ9*1k=SW zMmFSbU-V2v_kh(uTT2yJU0BXjuT`*^NjAS;@NsZ-R1WMRLPizotsRc8Ogw0xC9A#p zsKe?k9HvM`hS&jYmgq2JMq5u%lMO}Xix1rs_aTKnG6O+Z1-bs6%Yk;Y%9_$mwJ`+m1rA|nKS%cs=qYFzUd2$IiQq&McPP|}_^J$Fw>GKl=>sPa4aPr9 zT(pmmpO1KTK*WQr^5+wFd7r{sxQ;{safDq;Py@@gXt4PmZNGL&;p>0WBfY8`a8o7&S^ zlJN?SMvqwctTZpzsJoQ7??(0Yckt_b!@}TWuu6Eazy7j7?KRH^Bo1#Zag6xmm*)P$ z-2~QG6E5dD$7x$R1^BDUq^ZHWWTJ$YG%`6*OSMZ&h93b&b9A85qs^g^I^p#M{&Kfr zE@%@wOk9i?`%u8)BiWa2WXsihvO@(eZJ3+U@sG1<*WWPg`vAtJlwxf?F zSrgJ1HQP?iY=sylr+C|JTMS)Z-_CJig7fgNyDzkl$6jTQ zdU&_c1s;8>pyuintRqpKUC#`vNDdhy?*s=(_}>4#<!O@MzudA9g`O)b7S8dKn?D`vo1UoNYma0#{ExULpc^_mI?||n zCgVaJ6RwR9wCYP(Qv7waZbB#88H|IU?wA?|7d4ri6V4#VM@Kw!*go6hLX(mh?_GBi zva;IGD?csaG0vVlV*=aWWl}{t3;&PBcySj<4%=rYq%0CIp_=PEVgqTcd)PjmzQ&AX zW_SxTA=}`Ld9=}bTuA&d#~;jvLRegQdYTr^)>*s`W7CTW&3uE5spJXd;!kWV0rs&; zsfq+XZj;^jP9v~tgTnq}17Y{|1$|(4^Yokd?>iS?YYgaF23W!n7O&Vl=A8Tmjjzz6Sc=aoigZ@FtiV?-O}bZV7vIf;_9cmpP|$y$s46& z+M=k`_X^j+)X4&vrC+m#hQ=wv>#a8MF7ZYCzk0$%jRV5PA3^NnOSkIuwPb9Cp={!4 zpMC{t=aQ^$4(}{w{Ay3K{sT2Db%W!8`w#yA~6ol z4(jS>Q@u4GUs14*ce4}_>ESIQ>=Xg ze(R;w+u=6`0#C)fJz3qlhp;lZDIc{|ijm|8=mB5G?cMvj59f3@#;d_EJiWh~b>)lR zueR0zZ^g>*^UJTEH6RSBh|5H_+J}uyv~-iI`rWEXbUGxOyr+)g!#WkO0j|xDU8`G? zj+$Nr%?ENlcE1D_rZi;l3rAz`5(cQtAwh;Ps=|4QxtyNyvOkPv0R7FJkLl*mO$<3Y zI}vH!bFUiXlip#g2z6qtjmes>rU=#3iTJS0I9*N~W?Rlc3A;l@?V|oI%kmwa^77eT z?9}Ggf+Nl}e1J>4V7#jVv<^C?Hf$+wbeV?!z~c>v=i+B*^y3pLY+GY%IHH6@qLNoh zQaM4?FN9j*ao|ZBaeSTRD7mUGZ&9psEFG3^cXijyg<&wD&wC;Tm5pLG3U1x5R=STF z=OoVcyEYfIjayqL3-~_T51xYXGC0Qty_kM%+jtjcC;>df_we4jt=F_7YEHHk$(&Tj zC#fgoj9RO}DASQ!we0|P;08yBG65Ph<$wJu3TuWUFBcjr|D|CP@u4qSU*C8NE#&}D zENp`KvyGszYq)JUx)> zj6rfkQ0DjoQg2VeW{(lK9)r#T_2&6GT1GY7aC{_o&@wMJU#hrAv|8BCV~W$pcJ7|P z<1(ks@81V2e)9IMlMH8444;!d4*J@%t1==Y^jwOk2V2v631NW&0Ri|Gz$kPlW_laI zQ0G)Ncq8E?Sudq`B)SVZ>S2W4f7Ham3MdX7+)Q|0bV3~L&% zRka6F&e4KPlcvcJ=4<(*jZeZbPI9hEDiGI1gseh=xzFd~!a`KrGuJ&NUn-j?mn5KJ zTx2e{z&mfE&sY+VH8f(P&m~KagxvAjfekM`u@L+o-@k&DE+>q8yux$v2;e;z>;&3) ziK9(nUVGkQdJTCnZy-A;c@w7$p1opf3?tpG0LVcXVhCP^1`r=^vT~V=VS1B$1;Sqh z4qYFCHOTgwo)aUKps`ZJ_Y?FD{(_<^4R!3hJSTnUt#M9a%o{YZr|3d`N)#vd6y=PH z9wm`O&~5#Qz6?Jkba$(a454jMRtgSB$2Hq02kkCfZPY2p)O_#8$D@lwlr74RSx7y= zR$^4~H!d{Akhm_*-6Kq*$a0BNyH<@WNLY9Ef;k}-q?-ka7(AAj_cRLbo;=hjxF0() zjPurtB=H?PxL3?CN!}1=$@9ZM{v!QZm+~^@P?=y$relIh=Cbj|;#W6DW3O^cVV*|T zP!WTmR)nPqtVTuZF$dCPQllp6SxPFUyGf3G^vKT4$vpXztDahwBzj-IH|rD0onyw$ z_aXT9bk@&o2p|rexCJ+;gaw;P-mEd-DDZ^dPdsoVJAO2ZY7FzI&K{GMO~fC-?zmpC z6dP6!ex)E`zPFbgwm&mm%aDa94NQ%n20fk>4*5Y=>NbUz-^pgijk&Y@d}itT7UM@d z+egumngvvWgD!$b z=u4PREyapn&t5$g5b5Nd-IEoa(eZ+rnk|W*jAQ0nPOG|W)mY_6UwACP zN$wcDTxcM^^-nCO<7z=iAN?<5L(138I#U79NW9ZL`BcDi8o|oDdajzo=)%n??T;@) zhGOjeTGx{Y1jitsI?_|2~IFE`Nvg)$rknGRL3kS7=a6yl(F(1 zA-hc*Cue0y&;DMXdNl|A9`NuitmnL|bhH1Ak4Mxs3e3B%lHHOw2+zJ3!%;-=9dPiRLZm{2zM%RPUvUA1@K%266!_K$e6U9pOU2U)~Tn|t`;*oh<)Hh59XSdit%@*~y2t?1_(l+2{xk8Xb|K zuRNW#T-9%bDo6VdGnEsRr+m)Ypb?MEj?94>%PNv3q}8gL!+ajd@Co8I7>-VSl$+<+ zj`mQ{mkUqhn^Vf~@IuaT=j(ZeJ}T{CDAUwzBs7gH_ZY|U2;#(Rmzoioujb2o!0DdY zj9ZPN9kEDWi=3ZKJpFBNGXrI4IrtA1-{a2z5frZNH64boeJAi_RNhVicg2QC=&gdB zF%yTg55pddR%9QLHvQb{xm=VbzaO)Al$ljMzxMC1g%~|cnq5&|J%yz0}ua%j%x4`X1(oyV87*Xknpn4_CX+{N4E5I@xy|yjx;K>$I zB|m-TjeIPvY<$PysfOwLv>;Tg8Ogs;77SLAyivHnCAuN4DpxdH{xy1s_J!m=!Tz8V zDjfxs26l|qgQ7YhxFNfCP9@%AqYyr`V-?+L&0j+vJT+R)ays@xn7M+#AK_-c`CSxT z7zk9aW9Q(V?B-vwju###G^O`spUSTLSl^Ku2x~M#mDOulT^lhxV$o_C@pWr6*@8zG~f%yfj>FzR_YIr(AAJ?Q$6r{ef3W zvmh-nsJm!4IlU(?s4+vTcFKptspohS3j2-LaC4M`8NWWLfBWVyZ%CFY7t2y@3wobf zwjPM+<7lxmQWL|x<$HBD&P*oV0%q4^p#NF+>}P-ZCD|D~=1`;M4I{mY%nV)38f>>p z#iLeer4L~I@zG1CeDrw$S<%r^{=^)Y%C9jG@fi<$GH=Jx9_dK)ozRYI*WQ|~F!bgF z`g~zs#eN3*-jpoN*tk>M%7@&oG0tE$KA|QD#X`@*P6Rx6M9fqAa*1LO1VarAu2wL0 zc-`Z*RLLsR&|>-Orh^$q$+T}KzsESpGc-ysC?Us1bRlUhTEQX-Jygix;;*S`L^8N&Ipsi-g0Z5vZ`~7N>{ljphhhYI#PY~wKhMu^6@P%WLd+cL&bFDY zZho}kE=O(^F4=peLu&M;Pmay}%zdIF2)7>?+fxe$6iwElW=m=RdqB3OJ6@I%dPY?| zJXq9@X-XAb>#7Wk1n2HZQ_15i+}FJy#Oz#5?CoO$zP4{N&v7VGX#2ijskdLCX+SOr zT8p9OO|q9$9VW7Ni~u%U@5z!t%fDd4BbX$O-SI*gc!gDfpowISN3)XK~a|fW4ri`)dY^Qk5pnD3R!^=zU z8uGimapRmL2+pfvHcB1D>NnKBrBnlLc_q;T&T=9j!-aRwHpYA1=&%Ao+M0g^X$BRN z!3L6ElcA>k!owBy9apb4LIq6FRH1S#Q@dc_onX{X#8XQ}sDx_yhYoa|Kl+5e@>5m@ zFV(3yo1GOooh+ERK(ocd9!%1-LbD^Bq@~NRQlzDh8!K0s)mAz^@V3o~%iilA@b+?d zwplB5%!IsKw_JC$kcj2sYYoY;2^`xPWlg!G!?B^<71D!Mg}is5mv~2?{xMcMW{Bm@4iJqD z1g#2Y%LM!(SLct0g1mhD3ta~cZg6LU$WB6Ji7(8#xI8hc-mPXI0Iqb+N^UEMS&p|U zSfZIqw9*V6md8hY(@9{)S0HB2q4D*9c|yc-vm9aq#X7(d5_e_8oj2VqShT5m#S%bOJ}`MWXzbNE&exalx;iPw=gKLa!8&skY? z&hh#{Zn#RA8-6c(A8;1t?dS*4B_EP^gEA+22O@kv4#PxbbHUKn7P8X(`}9>Csgi^< zSwoq7uo}q&`a1>gRc=j;Q491m8(;?(!dOP4v7nR($9*eSJ^;?phK$9mG)R<3u%Cz|aG zkmm@#)hZHZ6&*?&wpbSXl*s;hbPHl?;u*6no9m=`g%A5?OSqksaNYBZ^`W!B zDjl?#Nz3EPrk^8tzDFlNGHxv;u~+isJtB4s@g*1PFDuqZdq#$hw%Z}jkzJ+Qg{joVOrTXhIk4<< zY;r#w*}*EwrUgyan9!b#AOFB9z48r8`4x0|T%$dodoxjCpEy67^ubQ+k>x^Z=1{E5 z(o9zeqL`FIl}-@Z3zT!+RR=qPsCJg3@5(51q^QIoSyK?NvHF#)QMr;=hZm#4mNitp z0FeIu6ABJrgo4f9?F~_O?OZ+k<%u%fwLZH!tH_*_hmpI%*1aLYx{gj!qb$~;e=aQw z5rfS(@aC1e<9Wb){{-7D z7G8It{&P)&-E09+o^4*_(*7pZL+OPdD9Xf_xQpy9AsvbhwyLpIzPgm7;DO znDy59x@#V@qakHGn4`-^^*#7jU;o8Ve?ts^bp*iRJYgk0E)L%YmVDUXu_Ov+6kJW( zdnpms-4aE`q#SGnG)1JxMtniYcldpr=&wEe2wZMZ0SMo&_au$t<=Pd zqYX`o6%M8>qKTp51&6Z-u%$jT^;=FYVo+isX*C$;yz9CNkhJa3* zsFB3%B&Rsjj-cPWyLl}6&2?oH$K*f`8QE4q4|av&+MQJjV@}z|_xH0sw$sDjN}E3_ zYuIZfpr!lXxQ?UmOU3^5jyr4hMmkykwDGx)q87BQj#SGPj)u6S0wg6 z4o}%v_ib5!9MZpe0XzOr+=jzo%7`K%Gp_`kC&P)TS2GiO3i}lEV?AQp@9y((es^~W zNcSySBP@?>pzP9}!3)*vn+_n>(GtcwXH3-EgckQVX!T#`DXN+zEs?bd zn*8ej|2vadvH;5eR5ktK&VRs{zkj5vt*1sny}ci(s1}--`{{nVId%ODW!{BRW(Vu+ zz-7&xw@#c4u@t{@oLJI-{&`_XgbY6%M-B)WkkZmxfsb;O zS<1F5x)Cp{Zuz;YBK78IWmTU`Tdktz@HK;RSsRAWf1a5I*z`NU#u z24A2RuW@MylZp!24;8HvZNa^A%JvUXBrxa|*cheGps`Fv z(-KCoZ+O#Fp@j{98E>Voe?~k>R>)Tyj2rlU$r8cjxzi_%NHhsqb;s80%DG|LDXzpa znSVn(3!dyp4f9`@!ttL-2+ZHOmwQ&ShM8U!n4&I}x~~_{`Q9wtMP&6;itT7fW9RS7 zOVviMfAZ#($CI^aVHcE&-CPZ<=VWf#q$Z(aa2?iBltQBF0Yy$aiy`G8&mgov98BNr z`pbtp+n|4W(fQR90&0Pu_C~a19Q1~fK>ng%&(&bo%A)isuVxYr56@Q@GwuNQ zK?>}hxE0wef20lm>2?W}QrNS^1@KfF<0`5m6OZ;SCG+SWy+*lual}`8hZ(=LE+MT6 zTsd=TH@Rz}}q)w+cBY|2j0^E7#k04|fzcHzijbu*NlEWSo2s`A!VA z_-En$2Zq%#p#6-D+MzUjD!bCENY4w&cTrJMF&_%f(!}Y%p8`DbLHtY4$u;W7Eh$m9bxqGAt9QhQnj(?wv|^`Rq^s^oMV>AjohCiZ3b zId_(~3d?9yU$!RY2&+UwvWw&Ty?XihQ5Ur)G80h3!Y(BjHZ@J(y-6q_k}i*vH@tv; z=1;d0hC!h*tmBAt=IuGRLEBSJ(a+LZEyP0!<4=Tf+d_=;-RJ&&3%jhPqJ;H}U5Rp6 z=HA%bVzI*?ZWd|~Trzv!^d{>&mV9sm@ZTauPd}2Ef$5*`$*m|2JydrAiA;o-9rd(V z$PJ@SPC`yoT?&W6K-%+|PpsbE3L{Z8Mt)>u(|ZLjA))N{bO?$Kqv5TJf*Yu9aS6vt zZ%hc?E_GQ5uDiIAj}F-_fn2$v>pm6RLotJ(imX5xm=38YimZeM0K(a#MZaMFRqcMolGVlG+A9IJ`1&B3X#D*=arEHdyetVS$U|S3)7ZMa>e%;kSfKjVg!e_$GV$k&2nfjLXqXB3E z=>Jb=?Nt1A9P`}*egL>|MSWDoEhiKYatNzw(g;PVbH1X--mitl2n$Sba>w=leo1^1 zixBnpI7(kz;P1rC);lv*pKUX-aewZNSae9x*39UvBy>L2*-gcYkLkY*p^6EZhmWuY zKBIQ#Ic~9-p|B8wdBq!0AjGe}o-KM^}bXLTVtjmVDV>7$Ax*q#?3U>4K zJ>xH&xDfHsuxJJ2>!r!I;w++tBdUhzczB?rrz(x;=#j*qA?Sy8XPo?exS4$Iu)VTd zHFS$V&_a%|a=S}z;%Wu0R!Qz6@GLBrXaE|_H^8oyj!QmH^c=LEzLmjQ!LV{{76z*dLAUG2*L~9yWgATrRg!1 zV6Lis8taA;ZEUU>i&MA@s_WLEPe8Pt9ia%cA~FYHuH`gW#zi(Wq zal>cMflZlXqS%7~Y^@1SR?(hk`|sKfm`-<5tqauVB};xJ9^Z-LuX1Yg12JY9FwG}I zON0~rP(}4|n0XG@0YmEg4iKxn25R1}`I#yf-{~d#69L`8VJ3;%J82nt8;KjC^p$l7 zll9s56wl?UJY1~|Hag3!fQgAyqsXfuDF>hpMtX)S<^fHiTZ0^RA0)b|z(p*fnpDpX zN9ZL8g1HM}50;bK4ZTA}n-=@{7H^bAqP-P5xSxYjU;@Pe6@zZ4Xf)E}TW$)sH#1k%x+;_k@r*$3`uHQhA+z%ZmX^LF5H(}~acKdMyl*TP z6rz+vL$aC#GhbZ0>@$bBBH_`c>??h&6CI2>gv^JpLz*AGW0?!QcSbl!_lUl%OMssT znGBnM4_#7`I51^+*6XJz+?yu(VrR{vWciI~NFURK^Vy!A)nsNYsSUk5ndvqZ)SDAljPA$@D?^{pIhn(w zrMY3l;?X9~*a^s%N8s*vg&Ju?J^f_fw_-TE`fuL}rL%!aRTW3S={}W1eIi;Xzin15 zFEBeTK-&>r!M;QQ;}ukn1r~76grGR|)kaTb_We}U{!udcAHaq|qmTjRg*syZ*V}GJ zImqXj^YJv5E{sQZEt61^9hrena=MY-Fm&RzCH#^^KUADHyG7X~TO);;nEixGQ!BPf zrEN&ypp!Yx8BVvdSE9GK-dY81m}FAWnR&W}W+K6SR<+eu%2x*l+Rv4?6B=p^F=HKP zy{@o4QeKsZzL|ge65GX5;}NO_%-|@#=`s|2sAvnI^_gn=5qBN&{DSsk5M{kr(a;^B z)`l@xNWdhaAPfX!a9_d*WQlnLu7fx)3s5Ze)W-aB+u$?~ACpAr$YJbds1DL$4_EgJ ziCJofUmBD^wheN(WnOYE)g@UW{|=FNo%HDEjpgwUgBkXl-ygC0U?C znD5O^O2t-Xi{=K3Zu8sz*$W>s=EZSm!3`S(k?;Y{IG4){B0_UNE=! z{CC>zzw^iMh0#sXK2%p7PC21GX$_u`g->6;46|(T8@!y|x$i|*k{#cu&hV9S<=c8v zg42`iVBV=HOIab#ykQkbOP`#bJ!naQ!36%NV>Fc2TDT%CN;V@N2#Nn|AF>6md{iR@=~#* zTvZXE>E@9s%yux~$;D?rlAf}i?+BNl##(!PR!s>ijFil#Z~?tRY-(x49r0FopN389 z&8f+p03WXS>89iX1vr}8_(tI`S5RwoxHH5Y1r+M?vDzohUxYn7Ugx)Ac4P?76}5yV z%Yisvw267|?W1602nrSql^mQCId*UV^Dx+?(e|;L7=|Yq!%O}HN4#N($2>XRl!4BL z-nufe?p&~mUVeT)qHSUy!~fi8e@txwxU&{yFT+La;hBY>tWy-OIc<@=B6&zIbK}eY zO_@FlW?GG6KC^pB0^Rk}FH^|I1i{>N$D*8t2S#1dG6N zn&(%-2z&c(G23?!Dxa1eHGrFN==E|jl(P3k>I5D>+vRE0XRK#Z*i#wes9rXr=$@pb z&6*t>mATwTYp!T~sqw#(Do?^#vER?C&UwksWAe|$!BINOcoM;%(?2mKHFlc4`A+~* zZQmL06ZmLiNHU4$+UBpjebVAw7DP~mz#l!@HM7CBe3yGU)Q8dIaQ*4tGU1E9b2w{L=_h2t2tU1p;3bs(o>@e)TA zGq{vzE4@FC7-0+{`Y19uhf<`;PvI)x0l*FS%!*!t z1KRfnwBfg?eFpRyX2R1Kp?ty{y$usB!{fC{}>Zz#Nrz)12M%`V06e&hL~0o20;FWP`a#7i zLc9a(O+F;Z8(gj|Gkv$IS{hrJPA48ibx_JCJ+DJzO7*77D6@1U)SD7DU7NvgbH)s2IDc@ATj8ifxT@`}bE#&-h zz-e7)8Z!~91d+xM=};l$xU`cmU}olNO&Lz!ObQfrmNGjjr)S?(R^y`e@%Pcoh3_0V z%zCr@0axIL=(9R~@+MtWIc$LZia9WW?rsbU99zh9b$7Hk;yL?G+RTGh<*T91k*aeb zqboh`{F$^NB4fF^Rd!}U)y_IN&YT4==#oz7sI(mrxSx)<=MN**cv~pL9z_GC9i!uY z85Ry ztM;)e@7W>cKzjlI{Z9Of%=g&S8+Ys!%S^pdwlpgYDNow>dS-#HW5~wHzXeyms)wlf?D zm}maS$$aiL2gPPU>hYeCo-tyTzVzh`(9&{7iu(4JHVe9w=WEYEILZqV$Yj&Zd)}3` zMturC*c@DicNegUz90hiO#`9aw#2+Bw2m8ske&Zhr(LA(A=Uo+Tx-{n-5qmMTaGzb zO!sfa79Ty@EF`B_KxVLF>sgx9*SmIkd)$of1Ka=K5auSL&qr6C!m}I`R`X+VBTOqB zO~;hZAn@6R{Ll6eI>3;?>cUpw8?-%#THIXGs2CP}g>kC^4ytmxG5K`7zJaXq2}81O z;aSS^?f}7IHN|G@@0PJNJ^LJ!4|4s|xD@6COPpc#2I;A2Xaj-s+&7G9xg*27Xc;Ce zY(V?aw1yF+Q!FQYwG6U22tLnzq+K#j9Avw*Czu6hbwUD}%N7tWE|(dwigcL3Ci6QZ zmX>A@BFfl%^}KJ<>qp)``AcKWt>!<0sj~$j^rl*rFjV-*wxDm1eH`+zNEvk*+V_^3 zsA5^TN>Z>RL#n|)`*P+1_VK>gep~w@?Xij2QTPJ6i_`4;r|Q3ojBa?_o^xCX-MD&_|T!`v&z2;z`sc` zcj=8%{ek>Yj2|6`x2j0mIC1Zh_t%e(hJ@FkvZ1sq;AJ6&Q;e1KGCa6J_T2wLdn$Kj z{o=vAYTGI}_EyekY`fny?Lqr6V3FkKD;zoF6z*pdbJF!cRI~r# zz5W*6{%?xoU%~W0(2PY{+J7OIfTsmrp$62Z-w{ofI1ReEQh{85b&nzVrPT<-GsLl|3YDL-zzM=$|px|J%x5(*Q-wuwMxN{;w;$t#vI` z5B9$==N3pJ%>scdxmsg73sl>i-WM`tdICZ^a<{5>ac$@_G}n-rqWqVwVH;ic3gvVk zR{sc4kEid%#^XUC{u4TXlUei+;&}@_W$O<^i#jF@9Y*c6>qJI?F|F~i7Qusa5a@kSXv2q`S|ZmaovUMM%jwm!n(7DZqG z?|ZyOxC>w}7hVn2Y}1n>BQJH9pVj@6DocG!T@Ex`7@A8iAStwS zSTuSLGp=D&^WzwWMQkg-z4I0dt$2hoy@-VUAB<$R@ECj-bnAboFsT_z%4yn7Y$SN~ zm~)a!g;+FO^@wUGr~x|9Ht~Uwr}F&yhLO zRd(e9PeP6>^s;eJ2))d=Rm87oq-`*L{UYr4s~=tRuf$?G zSnk~K8u1JvpSSGdi#7N-PcN^M1EW9?>oxq^(Y(U3RHdk^JcTg!WnX-eLt&z3P)jh1 zB@=h@)Vrx+O=qzfyU@V!MMlc6Z2mZioMX+t=t(Us$C7R8!XqKM(3`=n;^>XM`qi>p z(nl|m?U2Y31H^hEQS(yX>qE)h^@>&q7R9agP5axa*5{bbf&qg3_ zyT%yU_paY)J@uZT)CeBtXXmv*uh85g{{?1DF$31_z2PEs($&!srEhB)|HQrq6jMOK z_Z6(q*qGAB)9ZAuP9HJ$E79`rJJnr?a6!ue*3(qtEUrAIT@SJAI|T@w>}|#itsh?T zkE=W!U!QJb({oU2MF0_n_69>8VKS>$DiLVrO1yIcX996+2v zkB+iIM~RpC(L9JcGnt5>mA_ZmnURq}1KJ48-N0nvh@TKy0m~nB6qttNQVzD6j{?5X zegu6ZEQYg1{+QzhV{HD!OFN=71%x^{3GsuSh1`d@cZ>}`I5xlVBx@F2mR|*PXrypw zU6^y#(-QpgPI{}1^tz8-{xy5_;$2zp#P<0+y2#N~3X%P3EsIrpeQ$VE`=t5>Bzyj3 zXUX7my}0sMO)=5SjfYV{r2glDQTa|X`(eLxyN%)X{hqDTi-+ZZSjR(W`#1!WUb7xQ zG+3HqJ*3GFZ~{7`eX`UDl$PPGfeSr`!I#-O1t?2XQ>3t5EvEROfCZX0w4Flm5ADVR zVex(&`o))VptE}hGW#}3yz)8z&%ZEZICKk?AWX4{J~L+A%LBFP8yhT>5rF@d3$S-M zobK|BSs@fG0OaW55b#FeX#RXtK70aO)15QQ$L8j?i`)Qwp3iaGSWLVq(WRSpvP}L( zcBZ*!`fEw|24!e_7&b!bDGTz*-|B>owRHT5dq5hlv$#?8L6Up*N6^jss<6ewc<=YF z0zVze$1i7jDzoWs7`|g4Hc*e?*yfg?W#|kvSX7ZcKq)>lI+{DIqCN!*933AW^Kt3v zO=Kl7CZ;_y(Qg=J`vGGu4)I4F*ELanvKe)j>1OE zv#^TU8ja+nl=O@lia%n$Xpo&3F4chSOYd@nU(exUicEtZLbI97yncl|`dqSh zP^Ic;=OHyZaPHipkzm7Lkw z%t#K~Y=~LR=Jy_Tci;E-{(XOspTF)~+sF3#ybss=x?Zp6HM$P^022J=zIT?ArX8nK zhh8GQQD~RSQKh^{sHQ?fD@rQfAW_1CzVQI1AxO~Y-v@o^u9HgccJ0d{K8sR-|9W_T z`OurE%Es!9&1m3gQAb3EOJD_4e{z+VVe&Z#yt(V?rPVD_p=$YFJ&p3|Qe&esYFrSe z_a84BHW^_x?XYI0ZMZ+*#itDeu%1`AI%+KKKX%3tSlSYK0nq9EHDi z)OQT+(1ACV8qV`s>6&<$cgu=Mtf_4>;=Gm*ms{(j}B$n!CI zrLf7bsA%iv>V|mt?iKS9b?O-8(kcfrf@dN6ZCf8G#u1r>&%S}2-}<59y`Ty7^-Osd0)Z%!ga}Mj;8@JT#seaUl@i%^}tl zB3G)8iZ+E57h^}9HNT=XwN%iyP);exqpnz`lx)B`c~@>Y-yQZqU=L~pN?2=;t}U;u z$923Lqif2Dvam6L)4oc1#X%{Kg=kLccLi)^W}k*r*R&Lz%4t*0y8D}fZq{g zu_s^k2CqL$A2f*yg8VBy`Rm9ib?7)e{ICn7f5U+SeV|a)w+s`$m5D;|%Lcjn0#XVB zJ=-2kgMqc2$8f6cIj3|9=NR+kt zivx1xHJLAqkb!{l6O?ut?QgqIhjPrhqD^l^NT=)bfT5f}E~$x1w%GF14(rK7TZ~P| zEH6PL-#nhonr>EdA}~5*fq` z%a6p5HEYt2d2W&mF?NuZXbQjC-TrF;FKQ>p+@+%sh{@ML!z1A_d=&uQDAt{^Hm8Z! z_LMW)GjlIex+?^OI_R_UumeRwk-hEi%_M<|1P0{Moj5-BjfL}WWnti3he>LY zLxW(8UGv1v7L3UPRAe!*-FfO*9Z}9W-`Gy`!cp7hHbtJ#ZkDEo|4IS+o~Y=hd4e7Q z5unOgfNjOvyjTJP;2hO`rOS*>x&}+Wa%3`(MV_F<*w_T`1BurN>YTNWH3_X4#BcxN zk%9}mMRraNFLHsY#|&Avf3Yt^J|r}0J9Z@TESoDg@b*C?KS|U<{H2>Kcv|Npy`tPQ zI!nM^jE!v+QA%#M*+=m2WBPbdXY+&ng3S$r;hgJtS5D;Xx<-{`gs1M<^>0DYkK@Gm zR3gAT9lb6y0klkG+rjr_vYi#p@14`=(q%RlM`ycnMn+!6R_Ob{%~D`+Z$jgBk`Itn z0XPsG7Mbl78ZxTkZ|KLUss}y5R)5{DSIE0|D>g}s-ju>YA2zOB4B!r(noKCFSiz9@ zgLpE8lP8O|KmQTOK3oYRm5gOUB2YrREWVkgp~bP-8>~875gF@uR4_Z z6k6MK68n6`Skd%bp>wyxmN59?A&t`6=)TyMa$_2{kKulmf~Vx^CJ%>4u<@ z9lusD)ZuYea)>Za#2fnk5m29kxa!?X5Uffl0pAWFj|Y=p7h0SmdI7(U%n`%c&kYff zkE_<-eShg56&gsds1UdB$aUDdmv^@f0=`H|K`_{yW!hYh5%(L$<{a< zj*2*VDPOQ}vprBBnVzd{2U3Y&Qijudi&CzpUgzynisy2ZkOL6g;v6f&Pu-Fe zL&)J4(geAY{o~4K2d2Gj`@XYW9&Q8y?1In!+fr~&!1uP0CV_L-<+PW1$Xk4Yzn<-K z%9hR6g+?c+-!sy~H}ipqynKJ1JSX3&6chm^CBD%|#`ElKU7-3>>e%dKuqAXnEut~W zaDFOcqQS7sJYqU`(X*3?=8xxJzc>=w|7kGzWuJd&N({1k$QuAKrZcw8_lO6oRq+L* z{OSIB=V)qDG~s%!oTGPNoOos0rn5~^#}^O2iaXc4|!lA1HZlhpp>8;S~zm^04RbCg}uAfekU6^No68%+!2VFKOFv6cVKtL zCOa78s>HEG1A0FO>fXI`Jt65eQ)EdB72KdjNY;+@?reZ%zKzaX)42%KIV*pCN- zOWAnCP*;=uMKRx%Wx#_I15!}7i?F@-!PylQ3hY>aVub1{ezYE9_Jx1$q;Iaf75|S- zMfTArQy;aH5@x2dhZW-QW@lX&v=8U%+Cn~d9&Qm@K05g}k@{}%OK!|%oJV@0fb{DN z)`YPX4=3W24k3z3Hb>y{`lRGe~}5l+kgJ!RQPSh-HuzV?;Mi;24qD)he|;6KL!FpB)~!37o@)3J!s`;TuSK{Ecx z;r@H1OSM`4BSHRSPyX)&`G4GnA9bMrcmV&*k#9W=1m%)=^+%5I-)ZuNC`*Zvz%Ia4 z>h#dA>Dt#hpvMG~>f=^jRFR#zbsabSj9n~l&~J=TeSwtvny8DKEg<0Ym=UiA-c5)b z&P(>CD>wd`ntNWmfGavAC0sF__Lp`OZmahs& zIdA%Hw2_sa)e}b5W0KQ-MK8^zvs9<2*Zsbok76pC>W5AXHjF|P!8{2KnBZxqd0Z+L z{d@rpy7K!W^{**#ONmk#G1zQ#WLld3r4@tcx9b*6e}2@m!9>D~`;op};1HUa{w=hB zfkxSvV=*?91q`4#@{HVcmAH%|9_8% zn~N9!hVrxgM=@EVwhdqa7in$(`%KeV4BWnhE-n61 z*t#)wfzj%v$+dMs(~dM4bX7NLfU$@A$JkrW`Q-a8DwI?&{`EDNY)8DAqYGo4!eG?W8rEYZr|R$6g@w)F-(TnNLWQl6Unu1HAKB%;2>*e%@}R@mUB&gP zfoZKd^Amph!E;wUM&Jv1*F%5mr3!vSJokHRdJUfGrPVuU2uNi83%hpJ*Dns>;I6Jk zd1vzHml@GP1Rnlw<7_t8=-mI@%M)xQ>JKgc!JvOwP%?*Rn+FH z4IIi7O1DB4pt6zgQgD>(KoEsMAnYiK@;1n{k3&t)mw~Bb=4C3P=)c$8#i{X)7W{ng zKkAXkksI=gefx(WMBgL8-SJUx&usrO7`NJ`%OJp6zplhrwA-QN5M8v{+mE_cO*{y*kGW@heA`hI5i1aDfu^n#(1b^PPV>#DnG( zcD1!91u0B1FF;K%oFZSX3~q4*8aVC&gVXgL;?=H@B!^)MiD!}z2rRVB_lF&eDjzW) zP?F*apTqJ{MTD^Y6XDu!Hv#0Y-znj3wi{|9OBd!5oXh&U?{gB+@)W8?h4Ue3gIQ$( zNr}QQg0>PVdem#)$(3M=@k$kG>c_72$Zz?ZjCCRY`ZgxN0ga8MJN+_n&t3zh=J#Eq z4a8u=zn`i49TDFDmC)L5t$>%KNfKJ1GUA*+Y=t(*%DLz3b}XoT`=R{!{c_>oRK7A- z6vbBW0wr0&7-$i}ehdd9cb*_}=rEvak0tAc$Dyjx$V9Q=Nw$NtbE=R!e_gKJ?AZ}S zO)(bv)cS@^B@47Z=nzHdZXb4T$nnQgm_P(2J-k9!7Pg1IS|G9BNFZGYTeYC>g{4D7 z>y@g2Y_{SU(zKzFI@bX8ANRjhQN2pml}{2tR%xpkYJSG_MnFJ@YZ_!4-vaQiUN_kt z?J@H1e;%FwxrwX=qW^Pgy5Az!|8cim+FSE;m%z{f!gN8ia7&mL4O_OXj_h>lTKAU& z)F=7XfJ0)r!3r{%Zw##lhc(n~b&3vCVRJmn4Y*8-BqW*OaYy4dBN^VgqbfAmky zxG-{ja-(_yhD8?f_5^>rVlnb`t4z2vdQuv2y@On=7BW++K(^<+eqspnSl4+WA$9$P zb+yNUNFuSRm`t$s^Ba4}$pkep^$ex0)9tfuM@okej0&8>(M~sL)nRhoRbOZ%9;p?j z_^0(&-FVj5JObn0^)K1|h0^oGzm*mHmW>7NT+9Q06W1@sO#hs}x%jH*#lEjtd4t+G zK5(POaA_g$^z?jv` z2slDE^TDBK3Dh*?B^VBOtREDx|CLzE+tUN4V;c146ltjFRX$CG@y|<*A9kuE0#x<2 z)S{Wm#QE@)cQXRy2S!S@{+#d<=QA*`e4`&dP-dD#WI4h+6#Xy2iXZYjf}CLs3(!HvSMS&m z#`l<=ebLlprt3(qN3PqSOt|zO5`%D6gp0M&^I`o6YT(2LjuBbOJAD5UuEhmgZ8e!h zcVMjm&XSnup7+&Z*YZd1hku<&@J;q$gyQnjvIn4ccHAN7$sr4WD0v*oOwJyhcZ`bd zbbSRR)l8PjUwWe3$tO#VA1HN~b)P#BLicqj_la$^EB`>#*E{9<=b|ONPuyzDaLcOK zba>xN^vCEKc0h2Tmio`#cK3$`ak5ffU=}}LVxE&*wIw9VR?#H^OS_~mSQ$3?jtrJH za7_AljI^^MGd3q9I;d0Yz1FM3JpB~P992G;56lSaP_E624D z_2mmzuA?YMUF>|~15kBBSi7Yy0w{{>Qq1qXND+6AIW^;uOh6|h+`JX#YcDq)hn$Vd zjFtfMVa;V~&>{rKzZj8z9E;p!^9(Pc`iKGb5*y+am9?XKOKe7fd!yaRNwRowZB$sN z@@|mRa(V<_9cdKt^)oWh9%>YJXnRrC>Gb1KVCw2faG@6x0qR6-o$~ z?RMjvaWPXCZ7X2FI6i)MQLxIMA=)ogmdd}VkjDkJcNO}7DwW|(04{e7q z<-X(?NobtC}Ec7=90GTR%0#ni5c} zH+ktjnwk}EiQrKPL#U>n(~_8tP-QfUWum7BQt9Y9Y8~&eHW@&EHVylk8+Zd-8LV+M zDd36YUb}ubZPA=4lhr?_W3zAq+mMKFJ{Kvf1DSmrOVrV+d^;zxL4#9*@?Uj!fdaU9 z!;TGClaQAaME;j^yxYxqcxha%>}`4QX!^v^3sASi=G>ph4rj|wZzSd4q#DQU01uF6 z-UK0QR(|y2XuMc1AFHzX7|UZ2`=(Zz&t&a)01^cpqIS=-23Bd7j?0(L9B%CV>2;c* z-8`45rqk}BwJG*YMyp3zhmSQE`r3s7)hQ}9f3=Ec+#m;QzmpWl?d-r@C==+SXYxrc zAn`2x#N;jKoI#DnCPhA}QI334cj2DSD)?7*q-}@@oPRvVxJnepF%w(C8NUtzsu07< z*G|C}M?V>)T+8pVS9lRzSX%ztcWUZ%xI*lib72^@>NSu8{Sve-fpfW0WsFRr9K2#n zxWYV4v06O}^DCw>I)=cAg_=1QQ*OEU7-VpbJUb@Fva~7qZklIpF|X&r7ui*uWd`$c z0%oO)JbjOB!qM#osJGyV3JV=Z?XdSlK|`M>J$M?OP(dC^XN(RY!FN6v8^3%w-vQp< zx}Q2V>7T3H1_0wd?Un3f#*m7)oZ1XI$1`SQPDAZUPFEgUw%;AyXp@?e;w_xL$a&lC z!THmC+hv*O8HHQMgcGu{V{iR)GI}3&UbI_GgG7`yIv>CUDLB|DkW$F9ab0t}?9!N@ z8dh+eNKF&F7w$N?@$qJ+!?ij&=)4f?kAz$-J zW>lKR`V|LbE1JYa&o~ST6Z;|A&-=Fr#wt{%m1enpYfI77N^NaNs`b516iC29_S78r zHH+M@7fm}Zc_dk_9y{pM6vyIWygC>{VrSk@bSs;6h#r5^^>(Da{w!A$`=a8?uCb5h zq9Y+;gHxVQWOlaM&E#kT*exjMSX z9Uu65I2hS04ECIHz-lM=Y~qs@p^2kGr*PhH;7qg%8~SNuL;0lx$Z)Z^Cw69o~a|)%NQ-M{k1&12)P#(!-ePu8Pz20-rBl z)cn#AI|taLisW&<_e}V06TJQA0MOzE>y7JjrZ+}b)7!>uh@v-dYN|5$lDPu+E5Pe< z51$my4kWn~fevxz^@K0lB6!prQ}m8BK=x9P<<^Fu=~N^IeNLx4=O(8XAsSY{u1={e_=@crGj39lQ%e0$?-+@s^K*Sc{$sy6XO zl0p8C5~40f+zS2gTr+<==5-|!ZmmgTzfpV+@{+UdOx~MUat`F+bA5glyQaJ(6rMLk zpwY?#1WAGl%+Wio_1l2BSfO1;u(Lat0rT3h4dc#dDpo-ntW0fP{P6E6IT0q%?9Sai`mMmxFda4GF;sq?OeLpIEsAvksQmlVLp(1M<_+5x~F? z`wg3ouA=_h5ywsO9#%lF#R~JSm73#boi@elyn@$fT^6$YhQ zTcaQjS#5HF>%rZn9CAdm{;S=4U<6hJjnt|R^mE#t*i`QyF0 z?URI8k6nX3>hDGfKio4Gj_vXO4QeawZ1^@EeOMQ&WgdnuN>aP>j2Q)p3II=u8egj@ zk!PfQ44WJ>6`+o>4o_JP^;UUfhr#!fY#x%QoLERE(KVbr{ke{(ZasCXx;)5-7S4UK z_Qv{!6lRsw>Cs3TRnIvtCf8fqz>j%)d3(`2qq zd+-|^5pTm8+GcB#tv7cNSKGX5l#osa6HVC38~@^jt-M^= zdk8ZVfBmH>lTfLG$O^`Z+qhSKt2Ws79wK~9hCj7nVw!#7ypB1aNQ}_XJuXhnyvj!Iv?oI%oH@&Vp;-f^zE*wZTmLzD_u@0Mn{bv!MGnx+s8K)^{ zK!cUss>ITx=s&A0q1EK|U&ZO80#ES779N~Ey9@(^*)StIH3$S^ww~8%ON_NHF2><1 z9Mg%U5>FMft~qqDW*p2>Bn)?!{`AYe+D(4BxTQ{<+@nfWs#r?rMR$;uw8%NT0-qfh ztVU|vfF)yCsQWrtKu|#RVwHYRtaf`zv9obuT+I?ylitos#-UncLLFiyHF1AIVV0I- z-GqIapv|M~5gZ4Hg1x9CzX%Tovo{f)J^34IKKzX76PzF{SPRg>70vG5TXC< ztTFgl-RuF!;-_ziN3&nH@|5mmc^Yo40P*Y@Whzt8J`8sS$9`LLi0R}+)v)TR_y|qR zFl%Pgr045r6YRK6SFt}A2=zIGlJProMzsET=3=`4*JH`auy_)j;5}ObM18x>oi713 z;Lov=USNwqTRT^S;JgeMvb3sN1rM(`;P6-_AM)*!4!Nc!YpN^!?WIy7n?UWn@Xb0& zYlM>aCy%|oH0d|9x~B&TmfXo-pTGy=lPT1COUhqYzY+9kp&HZGQ+d4sNV@1RqSWA1 z1jDWozlh>Fm~25&k*3zN?;k}<1aL9So~#=cJC z=*Qo>@fjoG?@Nw}-+lxjvGe`E!8P#<4a)xZhVzfXB^G+C{rGrNJJc3)lRw`04)B|P zykKjfyj689vz5q}A+Z&#MODq-zzrRIFs^;Cd^|`g0)*CJp%%Qwn=Ah^%;*P0?%*T}hlFUNh`uG=<@-`Yf{uJ|0M<)!w z$5_-J%%u%S7$ffi1JuM{pIu67$DV~@``2$+nAwx}RNiZbNLqx*7)e@$NQ^<`Lt%0p zpsj*pV_+7?1)uZUr#lX75^r!!NWom>NX{eeHWvm^Oiw#JxF(wAuU0s=BVe)Gy?Ev0 zUpgh=w7-VKyP$9~Ro%TQAZc!v@(&>`-uZY?IZzC>QK{|{HIxp3H$;G`6we_;i}G0R z^_L9s!2^I!WAS+yAO&jrHr}07o$gcZ7Gwh+Yw0MAQ0uHDh zPvopMJ=dVncKp&hW@uQ4AJ?<=#y^}f> zkZu`4>kl{%4Vi0IRmD`#aW^J`Oly)2XcQ=1DLQbgvHESNyA?nUqqRjq#nOX3&0fr- ze7m`M+x|Jg9y1;--qw9T10Rz#E4#j`U1PDMv{baU8Obv)1Axkxx8l`Wxtd;0b@vaGM8`RDl6`o*QCVa`uUPIV+#wP$cUt^8gU% zAxaFw@ZLN%(#6a(^|Lz=c;n&dBdhX}q;rO)+vNz<5~%Dj5l@FoeEDhc~_*qOru z;=I=nX3DY$7)U(&O5jKX+csi*br_ z2Mn0~J@nq*)tffGNX=(&(p49rz*7$6=c|bY_kgf`oChf13^T>#fVxcJZ{QbW1}EP# zBq{IQitCnp?N40VDFKuI^YC*Hdc8S^7w94W7%my<1n>kh84PJ93E0lT8np8(tus|0tnYc74euLM{#%2h)%EXIg(dHa87lcDXC$d|Dz8~0z)N6c;}aMgat z94t6lamuvb9If9vbhdqiSu;`GS7)aTT+)tu5+t^kv%JQn9Y4Yp+?}rI6{8O7 z@y2^GTw9^%e1!frBIr;<$JX)b+j!^7!{@FIhb9gkuLB^WV;Zf^B`++IT2;Jxes&tV z8@)quselo}b0EWmia9DYU%u|kiS3@YewqT(j*3d|kxg*nBdX=xl+%2KUA0iqorrak zmfGpOP;ZXx$Vkf3{KMKd;Qi^4!*Q!Ryfk&Yun<{w;5|`064rxttU%T;NnG_+BFY}_ zJ%x9xv(XPSGVfN1%b|3Hy_r_rT+->SOBbK2FW`G6sl8ZoCw=WbVhuiQ^z(Cn^EG;{ z1|d}+bq0Asg_&gs#?e;u%G5bM5>b+pPd*A|oBf#u+VpX|EH9xH))BK=-oj;TP7Ay6 zH9FzN_3x&hYjj_vOl zc)HFI&mXOJOB61(mtbu} zC4yUQSm?@^Pa@D~YYeJ(7Ne)*&S{Na>GQkFcngzp_;4eC@o#1c!WrC zq}+{K)rb3|&e&W=Z0NCNd`x=7KH5-_iXUiR?wd5#ZtCHF?;Q6+|NHS@W1PPt8}1zD zm7fU;lQb#)`b;=-r`=JlLgCHf0?ehHYC)HY9>KD&-COSN8U3c%mD!+!4!o#x+UbZb z@p^-fus%?e{;_)n&m$``unyFwy`!S)d&(bma6pr=W1OGLAB}YuziTNFTjyFsruUcY z`_--y5Og|%=7I{HCf9BJWc|*jokF}l=Qt4q&xk_c?n_e2g4wn~47V?B$23KMON=xg ztf~g}EBd@tfy(q8hsR@1vVmV?6j&yNv7A=WiO3RIEVq)EHt*Bp0@$gIh2pU-t$b8+ z(q~`#K+~?c)MLtD>0CMTfDX3-q2k$2f#F>Ot0cBKBI>5lKiSfIQ~ra(?uXv)&9LR8 z(!686(q|syufk;2kJ)_2GQClLzEziHV&X`gOubYOAFqJn7U|aOWjxbzTc?c%DIJLU zcsDHDrJSp+KC2vQ~X%XY6s;bI^E9x9gIEexjkex ze}gzh4$9O#3w5z6p+h5LWJ8(7nd6Mwnu z6=EJaP1nn@Qt{bJOX3jcr(v?MwUsps1jGX73Q+aB>E z8}2N05p6y@{7^630EN|ZY;G0l&P0mJ3C#weH>xOEO6sCCNUs}YOCM4RGksptBI(_D zvcj}cUB|WQ5S`%$NQ82JkWo#rnTKzhSF=cHewdMpJf46ME z8|xWeU!&D~E&3U!X&)|}v&2j;Nx^EoGa|ySZ!X~DR~EK-tDL|riTo#HWm-5vH9o_0 zHRbg7k#alw%jrhv*d(^E~lhsD8RtwM_c{IxYs0aWc4XgOF@q-(3Ni*V}5j z&Q!}F?v)-vX+fd-*YU&VyXfuG;f9Ps zaJF)Aa2OtPo<{~1nn0w~R+`%C0=1V+TTEPi5U&^*mcx~gsJ7qI#c67itXSAPJkU8d z`P_k(FZ@OlAKiSQN`^*02OWY#sCTC>98e*!936x_;0=|SmqW0D2gVcGOZ0r(C$>FY zuIEhQ&j4a~g>WS(xAusnkvGb*^PJfn-q8!{!7pRxN8CCk#CUgS^J}%I$A+vKNiQe; z$6gpInBHISA$#WLbOz15=-r2s=KAvi!<{r81h&$jwMlT$9&+CwxJfm9I5~p#pa=8y zdp4x-uaT$fM}?k~4BUmz>o|2y+s9nCbACTN(bJmGbq&0f$s#_$da^edQSSyptf;eq zEL-8a3S#0&_nwY+gbKd!FcTv#_Qa|&GL-sNGv1mg+*rw(_tG<4vgRyqADrsC`+Nv> z9A`+Wau67>Z5`@ckS%1Mc8jz-qJZ1V{9W}>`hbE;b?!2JP$x2^`et@UINpn-r^>8E zX6}{tOx%gnbXywt9^sQVk&O*;C7qS^LdC=J?|0; zD}U8zp8N|}vpE;1&{UZJ*A0R{mK>M617ubBs-s$VQhCSI>=}JUeepMOdaPV*UMT~m zQ1J`dj&|jbU7joj|k}GtUf!i|ChYAp~;zQQ(5UZ zkw06eL1naK&)r^qCmVhtQWGxe7_GeO&B&*m2#VN_UgX=>x;CEwQbuuUnF7@`!>Kv5 z_h-_{D!COSd4WjSHWR=EwOHcPfM@il#XNG zr!hCNs#@uAd-Ktb*p;A}L)nYQ+N6hyzu3OIoUC@-!x7Frp3Zu9qP}N8FaKrMaV*}B zZE6BlZ}mO61;yv(YnGr~#NI$yBg^c>lqmHqjUuiNpTJeimQZ}`AKRVpahVnk)C zyt4hMC#KJ0@BcWGa zu!7*?UuepcuL;sYndTBFH^;enc6M3FdC@oL3quT}2Lgedr6vy0n560GycIq1PRo1O z71X=~Hoo9m8+Zd-1nswjS+0&1fM$#`(-TjDDrXnSGN7gu%)0*bk^0SzB0K1wOQ)8^BgpisZwpw(D1}3LfkBGo0zp z5WOZ!+@_>E_H#>mfHa7b7EdN- z!nNVG#^x2G;S!OwQ@_U(%Z@5Y0E62z(O$dTX_khE4hLSYI>i z^5c9bm7=}3oz{INwM=tk6?Wd`6VtI=NAOfGpCuf;r&NmG7*}w z$h>yu4c^%cFB?c=tI(-Tb-DYPN&n;wZzh)ONKMvRCXSfWUAprw9>#w+s2W|plg==F zDGUgb*V05ge?10;@Yn{w@>8&rt+WPt-_(M*t?O($PC>}USg{Uh7aoXn9xGpJqNUgaswXR6BK6o0i0aGMTLR%4yY+p! znNiU8!eXq(7nD+r)`2c>-fpE73x#yzYWn<62bEvgnMO)b#FP98s2>S=DE)3tdJ?9T zI!sKGiZp7Ax*#K4S&YTQ;REUS@{c-vVaVqb58^=gc<6;+V2+)q)f6{<3E_sMX#&&i z?B|Uu7*EQqHni&$r5B5BZWy&iSZ{NPx_peb3h}A1<-Xi9xe!+RAHHu}&z4U&6Q2>` z!v;!k6}inhA00cJFn2Y_>Sdp#f|$Zqm^pox-Zi=o|Xowl%q1Qf>!pAL7;CA z@{w3kh3YTq0cCK%u1bbV40DxMZ&?H16ni7PHx$?C4VWjGS<*OI`F~ofWcSE~*iw|V z6AUS17X`%%AcDIlyqavujxOGz(Q9~q)FPU)$(n%3zxQGTtk zvY~e0+-0XxfEgIy7??nmB4MA7h=?|?C*FzjiUi1x8mv=$v2AXSoy_Hd3IAfiF93ZJ z*B`Lw#no{@6Rlo^qM1m-W0O!iIRQ|uFksb_B*2L-5<;8CANfwq&+JYeA<)bVW+ffA zl>LBCTTtcU!T>^FrFBgooVFl$c@(pZ+Pvxbv9cJn=$W$lB!;ONVZGc&Ykolj1%yrA z-!N(l8z_o0NC{!mH*t1Ol0&U2QY!AO5J(_x?UsE<4&C6S&i}J17+B+gT=8K_(5)1& zBG9F^-llirDO*~vno@ypBHvQThJ04tzEe+^iV(F&hU1z}1gV_W9aDE8*D_vmlS$s2 zA$uFpg>oiKlXW>KY-ml0(TqS}5e9Cl0Hg4?!gh4>o1ag{NBLc_hFm(=>q~d=|C3VC zjKDcEJPKR72+U@D7DlIBuLiFobcA=Ilfjk1pwcMh7^%XUattpzCAdgd*^6X7ZgE1I z(fl$T=Ok!SusVF9<(vZBk?eaG|y zm0*@VcVUS}vN5uLS8tUqedh5~4(#9;Vcw*pEmWYk`Dg@9Cd|4WRt?&k90|QI(p}R8 z)BJgqBywQ@V=;ludFCLfMY+I|Q6P{MPH8J&W6We4FG0j&P{WAu(*iuIyQV&yIf0v>p$#VyV~mAikgoFzd#ELG zs7h(3*@DMS7n5$o_fEvv{QqUwJXt zdE1{xvp&PjmA|CC%#}U?CRo6FlgxKu+S2pnq`-MSP`8y8%}zhOi}xP4Y3yY8E(f9) z8I@{A1XJ7h_62hj8U=9};oG;=iC%3WYmx~j37iU=8w7xO>J3`a7tvO@M+fr^v!Z1G zPq{hzV`FI>-y|J9K_|o+ z2F<1Cu+?g^0#9@6p;rdGdT*W#x#d4i?D3bNUEeTXW;opns>)B=HuX|vzGCmew)7~3 z`LZ~R_`(kXx_0bkn?W#@q->U=5v;47`z{O4MCnyz4?wi8Ox#8Akau#l{ZsNjJxd8{ zIQ8XG zBh>HQ08$~F2(|ZBpC@lNXOX1~Pi10lC5?!Vvv05D%(4<6HmP?A??uD%bMfb%cJ@yM ziPL36*e?6!g7zJ6UvngcDxaUP6ezelQWPZz2n znqPx@y1zpG#Fm7SXAX4I>vFj;Pc+z35D-g+25JByt^&6u6@re^UnaX|-=P9bpm8UD z>fu#}kfXrKkHC2E)!S{swMn+VKJ_v{C23Ui$R~FBEPY({aki);J7X2*hS6jU0#TVZ z08du(LSt1k5vDERw$WaC5uH>d7xdmwgc{Qc*Hnl~wn9`KY01`^#aeQvq+Kj=Jaes= z%qB!h&{n-#i~jRVHYDd_hIjIHi0(|6kkvLp7c*Bl5D%`{d9e&kodc}&R)C2ptW4h@ zR@<48gh?ps?K5*M@266O0KmF2;tT{c=lz6vp>GkI5uE$;XH)ng!NlV{%Pl1ASmReIEAc@(=cd+ zmC?94851!G+!!^&L5LI;B;AO|_VlHE{)pJK^D({}EEe2m9E`I8Ihbh5bNl_B>)KXt zJp)0C8TNJ2$ynl64%1w%K;K(@jlhtWOjoKt^jO$bCTW}Pwu2AEyRBBXmk^O#IvW$f z@(|4#J2ju5CsnfbAXc?WYNupq=swRAILavVFDymdQj5O!$Rt(o1Z^#!W@m_|d%@&- zutsmU01%#KHAgmU)5KdgoF%$^T*2{ju7vnwbCqu+*4~V(AQ$^;f$LAV)0#SWcDYXJ z5atEgRH+D1eO&Gnl9k4k+Ih0$@$Z>ZH(J>?mwP>n+5$VAHrD<~XXvkWAK+_@o&QY}?bdNn~ERYnHO5X`WRc|)wD zm6E7hP&A;7hHWtU!vn%$pLmha-2W~&W=+b0{lRGIM?osq!T`uIbn7c^jRP4X^2w^+ zfVepGp!2B-)kVx(zukDWp6t$Wz@A!*=*vKUWv!1oWB{FoaPSYSlU?D>!8fh3}B^bb$AKO7c+Db0=jXqn_wmAk)u34W{tic(J^NyQS*dg&&absw@_j~D{$_{k#WrRkj*w|eYPnBB@gJ9tw630 z%_YhFxhp+w%IVcaJ6P zhSA-XoP3t29lOFzcc0OUu9STSeiB+m_}7`G!corI>E1m|8huMF!d!`ZnsP7UrupNw zimE|tik_rJ`ref~b5kQoa$}`B@vJesiOY6b92Y`K2>?-#Ly+ld8oRI8E|GD{{^+>w z$cgGtH>Kr%xh=NonU_CG?}?=x-+nq8q4-NnKupN_^e?>Gnt6N4zkl&*L2perX#rMMh1aNF>uz+WPLqT&p;-Y z&hJhEf931puZRBmb zjUQ8}es-y-T96eE@l8b8M@U9Sy#}$ro}+%Ue!PMnEZb!GVAC5XDHHkDyX4;yksU+6 z2C>UIY^3<>`#?u?MDMMObL+OYNcYcCANBAvYL4EEV@|z1!YCVtsag9~g3OLTf63NI z66DMBk!?`q*3dH5;j%`a{)G|jj&QA6{g9?~8ke*MJ%G*e(#vNew`~$grNz=2ru5z! z-G|G?7w$JbLKturQaQAT$S%IDeNbH)HaX=8LZ=dK)8+lPCyTeF5qYHa=D}X=c^F8Q zC2D9(?X;I{P@^J+xeLk1=@{Oxw|fL&$wj`qdGeu?pL2R~5zp==)nex@@EpSlagWHt zHC9S3B5fjetcb<#IwjcZQSR{!nQv*{Du*_mb4kIhy`7yG6TvR;tvHl?!npXXwMOyGfg#M}vviD|QfMvzF{| zf=ih!4I%F=bGE)@kqoI+AvX85*92oy4QDUk92}!D$I2ZPny7X0WG<9y8&n<3+eHCS z)v^+9*WO8nwk6qmhy2AsWv zbLXWiIlt4Y6t7TkHP4}yrEYw_W3woqqEMKt?t`ZaLY}53U#e>>We(!|%(!-=N;&IJ zG`ri(9Qqu{=18{r>5-_DVC~`k9DoDmj61^aHITyT>=iMlDOD{h$9}rAZX?C|h&Sla zYI7~E(s>D{V&*Pa-lv@=#x=697@3;CZ^L7&6&M9CFPHdUfn1v_Q#Lm*>0J9M$aU#M z6Pke}pzY{hedG~E{%4|XW>T8sc4(T7lJmJH=O75e(>Xk?@-?Kj6m;`SzQH-$D5vD{ z>~0P5=*c}Cx%DF=n)v8Z<8&}{HJ8O1mT6LDE`rkAu?bPfOz`;luSyX|?Sd#O=uja7 zjBDLPAD@wW7@65{yVF+`KOEV8BHdFs6@%#P&;4g=fz&6DfhD|*e!Gz}xz_tn05 z8Db}_JX%5}6vC@?U%@(eZjtrYCI-HqvBAR5df={`IA>J)&P#af778Pz@3!a{aMUd+ zZQ6$@CJ`;4V(Hy;__kyWlvPi z4aw?*INtYTcZGiF=4R<@4_E5#nL<)JOYWkp!+2qKU*|5+t9*$T3j2B+$G~3tHdP0e zhk9K;-L1#$n7DUxMC`2z#>9o?y7ncyhXDHv2SPZ6<_zFU{P{S zYa@zpg9+r^O`!*j1=7nA$%%)8^Eec<;VI*2%xzlwbrp$CjVh6D0Oe<1Afo?(-5%@8 z5Dd22Jy~Pzt3Zz>9BQG3B*iG%yQZ=j#bG8b+epGu@w#bu7EbC*sIHT;aNo}TfTGE2 zc~t}~-Vy3AyK-#Z5-VIT(O&p3MJX4)PI-Su1Op`DhCJx~WqQe?@>aYhC+``XxasM# zr&HQE3M`;-Uh4}kmtARSeQ?)ty%OP@7mE|!43|yP4`~av<#q5nTr}Z)O>y2t0^7Mq z$WfL86rCo?R{iYmxtNQ^JPTfn$Litmo|Y0!j&8d{7nW?-K@;SnNYPoO0hsAP#eP4= zA+Oe)fxJ)55qG;B%@L;5gAaGkOaX#el!s2Hg!vS%7O}?fI=U%AT#f93K%;?+G}SfB za`eGPn20R`RNBPTS1ZUiK89ytQbgLhYh5GPK3&2G>K7FzfF=vTK1IIL1iAr|CShiVe3H~&Tkxhyj^lB zS9**fB&Nb^*zapH1a)2exi8P^N@OQo)zIJ7UQBkY&Q*l@+on7EC_!TYEVA)HmdseJ zMVUp~rCMM+V5#`77i7(0kmnh5I(jMAmpgk}cHNa-me*}Bo3m9=lXiVP$9r-+^jic` z_pg1reD^G#ut~0N%U;y`O*~%?@Vh(R{|?ME4(D<1J4L^ zP0fwy8@aJQouf%CFs4`LC2rZFKh$z~l|&=JyL{eUzqRdf*WJ^1r=Ptqf27RJ^jKP) zk4GH(61IWz7~@`wcwd;8UZDN*827QM`KxiH$SOzSr#j_-szQWKqFDzCIMfOq)o@qEPxRYu3$F zxc?61?-=F!jZR&(;Lbl)&dnyi$Xi9))}`4BeLj9~RSwGQGov4I9MW20X9v=_J~8P! zo>~pphT1vGF={ga|HVyzzPbh*vFgzq&S}KEOl89^xvp@21#E#PUaJyf$XpXBE0^LU za(z(ce>^>6|KmI%PyHAhv5le)vGczAurIcKGeZYIAcvrwEp)BUk?MU{^)~Z;IXAYm zG#iC4wE^uoL%M+04ozCmbvK}{_H4NHl3U-w59RB#l@e@8JwwXpu{ZP$uc)d%)0T92 z11OO*pi%b8-6~Q7lD-Cz8j<64RykodJN)%~yz&Wk#JeegmX#Js+BNcVH zA}g>}U2W>q9YmK)!a`%@Q&Jw>70Mk)7EuR@5pn$g2x#doh?ze&!F%`dWyoBGN6{B% zPWURddayP~oUa0QGx|-fI~6PG17NV`q@<+0OOqgF`dAj^V@VFGcGp;PF&aOh| zTPUPXORg?GD(kl-h=k9W;HCgKU{xUluQ9N~dCjXUd+BVbEyUrs{ zp3DIPfoqt^ZXr9aE`%_mX{m=!s!4W;DO zjo*~6NtduF0eDBQEA2FCUP1(WqkvIoa^_wO816gZdz9Q*pvzHUyl=GuSGVU?HtV+& z?ElG!m)I-$&+N{B$aGC#215QNLG=Bn|87wD zks~c3@#OeFHUWGOII90{s_^qkhpyg~0l;T|9{5-8{{J6keX4*!AaUu1O-ac%V^o|? z8swSD3<>bqtb&6d0ATD|GipE^-SG#I9-b-bhaB~Jf^P2V=^5`S;iT;%04Ne2#~Qzq zvsh7zy1gNzP$RMn64{`H&q@c_*FBa|e;(PklI~7VXt}hOqm7fQ)}vG#d&8e!_>sc= z)FjWY!g-sr&um)!V>3gpLQ zFc_HLA9g?{yJ%!UbNm6i8bAUrNrUjBs*qk%BogYb*RGk}%k{qBHaR=H_F8WK#LM-O zhT<4ByF3)K1|)LRWZtEtTiT zxn7^TZ+?e92MBOVfPM1k7EXczDmeiF*veg0a+}wf!R+-=H2ItO;(0%!FJ#`fG1#VR zH=P1&KDs)oPk?95?5 z%o(_9Tp3$cR9JXhG&6lz2exo45Vu=-%NOpLG}U`$qehtufFF_!V1FkaU2f7|MY&ZT z91S`E05c{VBW8pOCV1ljSWVBO;G3VItu@r6dY+s*PNA^~0}bX6ypO`%VFk-MjR0h= z+dCIbGWhl~73}R-PI$8KN#+@PQi8YnVl}!)u)s)z{E-d7_@P<>qBJMll-IcNw2>Jr z$Tw)^EvHimzvVp}+->6)reH`Az#;PkBZ&fL+wse-YGGHaZUZc7Ok{E6hI;(Honv+Qp0zq~aO4X?-3SxYPnF{xReLCtvMzDpGQfT|dF#|sQ!NFY zET-2jv}D7*RQT|b>=QXRlHxN*+k@0{q=t9-Xl#F(>TqaYF#p8`$+^;;-LGIit@4VM z_nxQ36{q`JTU#@PZ)lZ54iu#dpq6U5j-yl;;oorEWMo@B@FGLun4UwmXdqUnze1(A z^cyO^p0eO!E9RJP23qWszwUgV&FFj>_?WL(HNY_7c?`%hD{VDKbD~=TxL=AdN|3Yz zIe?S(Vi$LFkGJ^&N^88UyaAx|=>al2N*~2$S}_I@9r?#L zw&zJ3EUsTKXPr&Wa&zli=EN&p8YoZjs`=mq>tX~8Xegmsi>B(=~=zrhF%sUg%waT6VEgY3pk z+iiGNQN7G}9f~~W!_2mR>t2SyyT_;d-K4Cx7`TSI3_pPn#U{BH6H`J3>@WqE(WT0y z%w_uJvQTERUhCpSR&_-RN}H8q5!td)`yj~}ex3(nZ=_-&2tI{g(%KgiRAN0zGq%X+ zES{-=;Gev4qPj?OUIkLmffn^~_0!?V)T|pdOb-J_@d6-u!Od^yF5`48JxGJ~)9zJF zV%t1q96U^C9vKlQMTgSL0D+)%^X(9ogI@|=Lv=j6zAAqL0i=b(`Eh7hzfz3Ytj<@_=r>pI@<|L|%n=*RtQ>y3a6eX|E z8WPye_+2b&SmeUo0rs?odS{$!}kLgVOcQQ52{Ev~0;OuYwlXR#`H~!`)*Xj}}FM1jAPX`frxoY_pE$Ri(NEiBIv##@eL3(QV3lLscEi zSSI|B*z|lDm3n)$er%6%OvR{&K@iZg?B5t?&$`&P2bwr2sU647wIe7piw7a|tbAEO z+;643p0rzLju@$Q{J}@?zJS!Cok@P_5wSjosOSPW8zGtZcetb=8=YJ1`@+?Gv+Zxf z7vDzcxrOkDGTvuj2ZQNABACzc?+Vc2SbbrK-irpK)RYCK3Wi=P?8q_%m;q$Q)es7> z1#Ghipp)k;-a&Nbo8x=E07Uk62aj30LZcE7x%zaow8rY*&pmCiGg_FvXn+_yGkcr^ zI|HncxsWoQI?E}QYcBQ{x{BRG;bysml;AWW>WMfY-6k5YsMEcS*#m&G!>ktvJ4LJw zuSBLv$7@X?&ENQa*b_4V@AELM4A^kyzaht0D%or=&JpL~t=Jy;dX5&D&L3W~jiHth zl#74vG8@^JWajeSlm^nfu+FVkx2l(FW4Sl3&7){3V(tzv0QIZ6`vnJa$-+SxgH{-1 z-vhin0aGfqdr62!v)KVg;yRvZ`&YSml5?0CV2K03iuYBxp{K|9LPXb;t_;H!mY|xI zFhyOjk}KxoW{Nj@YMRxZq^-vdxuSj1bfDenct1NaXAe7M>NYBDeQFMKmP%KNaL3dj zhGjd3%KXHb3c)=4p^+bG%)ach^YBH@p7l#c$iT&IgDBq8($Z{iizbUTPj~YsFwKxH zqoeV$L&c_FGPAooJ|2kbc26$p_S{;Od?v#e>dRVnR%g|=?Q(T8TmIPght-)aSN`~e z%rR&ce%9Vlt9?j~{(gW-pZ=Zp*;dO>263cvD3}DDjS$n87U~&8ElU-xI5q6m944L} zxFHp_7==1Iw>}U#KF#s2Dq6Gtnr-l0){?jy#_!W|VdoC{;~1ib2(R8S^DamY#}!J9 zV!EiTXPW!VTMPmmeqVYk1!Mv%kmsvyBd)`TsvOVr=w0YaX0ZdMiBJ%pwHW#eXP4}* zX2?P1N3-_CfE@8lepg*fD?*|wJ{K*$-$j6uT>v3kANV7sKjQ+u1oyi}F4m?~ zMBe0F_!ujMBko)Du&n|6aby%b7`|Vo+o!F|f)drGT!z2Vc|25`p?FMDHI%L^g=4`e^!QQ8lzn)%5bo%0*9rQo=RLEMhwpA{0kt)T1 zUW8a*XgtX(%#(a%eK&COxt!qJ?6%$$msPqbQumhTs3O?*Ic~LKfXY6Nbz=nv+=Vd3 z2>>e|1^~X@4uj&<-soPKcOXb6SU+&3aY;HZ+?&Y$w=_>6WnU4Ivjtl-Y``-OP&t){ z_4YY!E_XiRAk<5*e2w7SHBI6!?z4MQ!Q z4PA4!EU~%RyCYhyV)9n0n1&a4m$FUcvF0G}tQ?OI#@Zj%Im|gUy4d?(YhZu6li=eu z%`Ol+)fyEmv>!4qae3YIi;ZaJ#*iK6Jz1&f0m)8f znNOrbE{`ieEZL@}JeJDiCp%fmnEKh_0$=n%Ms zf+4K-Bh1L#scy8MJohIpvPn%yV(PlRwI=DFw<;wX7n>%G>UZk}bF16&0W3?WbL!lY z)yWWj{oX-@Y#*xa`rsv!%M90eX7P}=SCQxsP7{T5(5oZ}R!4T`8&0A_ z=WGaQ@+ylm%DO6iwO-@8(sBPH2zf0ZxtftR^fu|ByR)@rF(X|G#o~ znDA86R1ZBq5$Lm>R&}+t z9=xs@dB3sthE%w!EA`d&1{1CGpdrY;1ddQHNt<*310r-D6W*ZC$$6bSj14YX*GA+S zgo!%FEURr^>UrEX=r1;D&|jMXR;OO7%y&(wsAfrNig>B4L9>V2fC&XL6odxuLU7fZ z78jXPV;SaE{%`G+_K<5-NlV$tYMhv(Hwa^F1q8D}dz{`asC(hYonyZN(%S+8?0XBj zm2(&G8ErET!wauNOsI$3o#sLJm9bnQUEYr|jo@Hp8Lg4dpW0(omNm+qTYq?ma<-An z;tZQtKpA{0j`|yfetiKFF0dGvFRMHcWp^j^_7&#kF;Pz~YmMXJF*|ViW4$2+lNgf{ zg%P*&*t_`fR|>z)$H9T522ron6FAhW+lJwA#l?^+6;N^tFIk{z9#YHZDB87O|MObh zt&*g+Omd>mVq(HrT>{ikMS^OTY;k~cqUg}9rL2;gpZYPo@-O`Yd@~#=cjIhrWBlW7 zB`gQ8#i4<* ze8{2}DhDyp_m5`_8Bc9ie{;3Bg497Vlh!UzTe_Z)M-M}w=CaBS3|JZNMwui-KaXe> z_nNOT;@LVsF})<_h6WzL3E@U*a6-2n4^Zo1mjsPH8t$F`;*qI!x%Cz4y^J;gh6hQb zz=;86`o@rLo_-B)?TH94)vqmD*CPgCZF}JdmS%<<#(<{p^++3d(}4RezvY8cS4jgY zUca^&d=7RTsk0!x+z$oAz0VX33M*f?j_5yXLoabozr`h-QqN{rFY#I2`3aBiXBnV$ zFXGtOIsh2SGfs5Kv)FIArCb)xHpku9_h|V|sC=%Ng|ABNU$kLma9sIvB-JG4#iuSa z;_O_k$d}iAQ#s2OI-g%4OtT^xcRspP{2_Y8(Bdd4^y|6u>(|x5HDHxl@f6k@8F#Wn z*NGU^kY2gFSRXfH$Up9%7}UB;*={jma`W!?#Y+0Q$E1{WA&$8gGsCBCqfv8^DkDMIGXl5VY+oSsp8(|(SRM5F8Hg{_`8M*Va_aoP_RdjLR}j9d{-q zskrORT@8xs0TNcqVr4m?WG0>@#GBvaT}+j&;;9FUzOXBReyIpWR;&92!0q5p_HsrR zwv-DMEl}5jh%lk}eeD1v_p%UsFW>o*8Wu(`?Wi}JPEVF$pJ}sx2KKvvsk~4$bh<|P zQf7sq4p^g0-DsSv^4V=R&Q&E>hao)&&A%vGqX5> zdl9evhBR)|{ijB?;QYM%qS@HZAN*QwCRZP-i;Hjx(QP$*b$n16>)hL}`Y|%IFwe{Z zH|&%4wobg^^t2D|maYAjQDz|4KUZX10;E`0hB`6o_N(_g($>D_D=)MH+OpJ(<(61O zI|>X0)rVAH0hmQG^vBHiiG*1xsBZEz((qdj`wbOwfVg2TkN|4;<(nmqa{z0q2t>pAa?W zF2c7u;siN0?rx)3bb~q#&1osVF1NrJW=5;4JkcUi^0N>vc&11qAB+%BWN7XNte7^e zY%E7_WYMvisFs>@0xS2VSS9Xu18DY*Vl=|Z4rCbTmfV^eSPKE6?S_Mb%5qM*ds+b| zGon+#WvIwoo6WfsZJt5G$iR3PCTAD*3iUG;c6-FxVB)M*;%WI-VONz_^XA;^asW@1 zUXXLy3PRg2E1QsUHUVB@5-&+tP>X1JDSllce%qYDuzJovJ^+m6ea zxX;VWi(B1X0*WskJwkG66UpGWaLPl<$+)U7L8Xn6k1u)#Pmt~z=BxGa79Lz=I4Rqy zI$n$x?c|O1Avd7@I;w7fHx@{;%tufc#|E}wa?h(+M@4~GeGy4BvXsqFpKgs6kN9#5 zMr#|JKkyvW$C*W~AdPCrvNPk7Q?ig?%YREpvC9MXU;dgKb#BA9BB_5u=(8p3N<2r3)0>B6@ z6rsYETLZO*g*H@5uGP`UOAF0z++*w@wl=A|Fb{C?LEn}tXY}rlu)3F*XNP`|&S3FF&x7fdGc{KxAs`0^gfk+cbXyr$NhythSN633qmq854{fILJh$#lcn3 zH}BbPzf+iJ_&S$z1I@1%_6!~D4j8(Gv4GIZiZoRWZHK}OOijsL&sytj3zeBgnp7(B z?$;-Y)3#TZYwD9N>bPSaGg&^o)E^#i?Isv7&+0-iE#%SFIPOk%GWptV6sg*!If01l z>&YOJ8TEktm+1S7;?%h>*}fx0>s2N$k<|Crt<_UqzQR}9eH5v3_>%r=!9+Y%X-tUee( zL;7`=pgRf*LHv?K+~VMhOhhuDLbet@C{hQx;P55b8?EK6SjfQ#hu|- zon~<+>$wnKLI78~OlSyrTs~;T%;FgpSE|(Wl60)$I|bAM|F1hi#^W}X!#))^V-gIv zU`2wIBJh?k!bxxe7=X`aAx!KtzJv~~milI6N9 zzB0l-=^C=(_htFNbL*7Vits-Kz=a=cRy$v-N`ch@4#P)u<>0!!`9FAHoUmgx#woWS zT$3}j(5I-CD12a_Zc$LnDa(1DDTxJ|0YvxL2nxQ-2&SQ6e`K$kY_j0k`CdQ!b$VE{ z>_#EiuO|I%X&`GA!Q_iKZ_#g};Gj>fb=)I#FktZ=OG=F6NEXBx>D7R$l?+zLD^)H5 zG1->I0V7@+u8@lsx7u-iT_uhWR0PA`;{X%4roFN-FEUr*27<1aZsb# z2|r!i6kvjufoO-I0>9h}%p6PVD5TdOUdQ1#h~OUtIXyUiK^@D%7jE z@L3Z@pR1qw<-cxZ%!Ss|_y>Ut#ZZtcX3IsMDS*W%9n?_6d+9oxE$p9vT{2?W)YP;m z=1QGADTd;xlzlYg?RQHtKYMSE{P6P^a$tMk&-I|$`=&vYa=O(RU86c>#JByBOp5K5 z!Dd-i^r+eFn^-7n%ffsfi{TA5o1?}B^9{M+W};jTor91CO%;>GEfHK&rP;Z+Q@KM$ zGBQzI(5MYBbi_Ft!J4ZvPNgp`d?mnIu)@dlsIbVlh*wrM!nle69$dXLCm$<(NL;{g z-p35E5+(%p4w%j42ImfSSI>>7j&ZVC<--H*BJ()7wiM+;#BdAr>pG%-`IL89!+_z$_NM@9wN*@}=?pjTMlhNuJ*Ig2-it6yZ(h|;9 zZy;bZ#T#r+@M=#V%$v)z&Sh+?o5<=#Cs9UkIRi^8#Z`U3^0Uh^*eH z*0uH+d8;rp86&7P)2!A^Mv>nIN6ADi34~~3;rRFqxc2MIn$2Rn>XR_-wF0@@^MJ#~A*F9`At*yI4W$#YgbrpA{C&7H>sb&^oQ{CMKm_tc36H zo`%Ww0@lU2P-xf}-s`qdTu3Gj=<2Ci}Gus?NJ(^@_zIMn$ny1OSvR7ByU$}bq8cAhhk#0x0GHIbQ&mYmB_eKLW2{`5C3V5=OoUy2* zDUV2E4RkggoPUp3!L{UU)*P)ZBenu|_#u=JL_}HSlZ<07VuwZ+ukU48l{KU8P%=aS zY%IU#mYgx%X1v2da(;rH@)gAuv=b_<0Ap^Zq%>F+{zWRq0!AI^JWTVOip)=!on`CI zla$+AukpI!Al|VN?RJiWxM!qm)N;h~9LK{b)IU*}#Gb5IHUfo;rAKGk$5PfV{yo@A z-uCt?zU6IJH7gghQNw%=tD+%O_M9=xdGD3Ay3Yz%01rrqsSk|@?aeoC6ZuC22 zXU?0`R;Pqq)p8}r!gmkQ0W%V|!0$}t`eKXcV<4>3!amIPR~a&is1lb+YUoo38W0Kmzz0i4s7YMt&5 zV+`;h1T_l@bCk2=ueyo)-EuW$YO1eFp_SNd!KUO}#9WLqkGUpli!@TW&OSZFjEK>c zWW5@l^DrW&G!fAY9U0u(HiQOZM@b2BF>2uJWD}8f2{WopF#MDk_jV?{Rh{X6b`LK7 zx&{2p1|UYG0v!BB}yu3j0MajxBu#z}8@!-GGWIj&ts zDd?Q;V1MGyj?ArzA*7@#$L8UOvuW3By}hRGH!C${W;zRl7>Cy~!Ih%6$;)Y0cq}Xn z#V)ygl2ABRrp`Yn`w{Ry?-X#Y8!R}UUV-g2-P0x5HV8;{4-^NavcWf`)Sug;~q?20P@2tq}owRgel>Xu8>+;on+%>Z1 zQiotkIN%Fj8+rZ4(Rozn5Rw?J%km`oH@chAh;u0;<|uru;V3D^Yyn%IF39GUXp$rO z_V#{fy{`3Nr?oGDRfluDU8U`*gf;@Ek~S{MupV)aD8vWC+Oi&CTe z20C*o$PM}%ONaWCG7wr$-laLieI#eZ!IGu*2h*C5W^Ds0lVJK9h=Zr_7m^J!^|?e9 z@#0y0`C{iF5!k=a=^EvK3H7fAr9gr-WR?Z}M4|jdAq)|)v(jVvXBo)4ZXc>+E8*0b zCa;XXsDC4!JPS)XXj%N(5YWg#1ktE>0{)lV!>)uy4HaqAVb}{ee8}1R#E#aeLT>Iv ze3eXtpTfEfe(-W|p*9;dYuLhjb8?Sq;c>IqMvvlweR3_ons+4 zc4WX?^sG~tElvrCvF#Iu8e#U!-@pHDSNLvwDzs?~@lEe%E#1e?F03ZB4~_ zcy8cr{rf!d?~vv752kOvkN@vSx7+@z6aGFH^3S&brTE#H-!FMjewVB7*19AHi4gPm zCgNuS-2^9K7wT z{&D`(VNWLpv3_U*_VY0kx&zLVq#v>RzhBy$bjGFZ-*q|vM6#kGIyG`H8u@)l{e8J~ ztPQ4rLy(m&$lwpA_TLAAf3Gza*z-<1n~6l_Uk;)}r)``*{j)YZ4=aq!JCVZ=_Iu1k z{o3--emDsO z19NPsGOa$}W%utA^sU^N>cnX2+t72*z{D!q!_E#;Td{2C|NSQ&&Y|Hex=;W-m+t_rsqCh}`DtUaQ>W>%4 zca!G*bX3#b4xcNhUEu2>S{2rno*l#G;f+p!VpNqNew)g%Yr+(k{>&F+D zQ(9oMwYDE+%tFhOd{aA?;z>>JsNVo|*rxxv_SB~nLxLef`)E-v)>Rc_mv)0UC@}LN z`PXUKdKL}EH*+_v{l~+X@9#Zjtx?g9bPhf4@; zCPoHqRhSK+$F(@<6Lam#|F;Og@A?-1rG3yDpH$<%l|y#Qa4DJmAf52P)jB14h;X>t zVv`yNF&UtYG5hypbmgkMv8*Sh)wAObyv2Vu%JS8-4c=U~ZtA$Yt_3y9jAo&^DEqHc zpE_T8e+U;^)MX>1W&5vJl*jchE(qeAiT}Ru->-YZ&o9*YSK~v_h|G~B+)<8GlRNxh^20eL|$9L{b7Rr z`~l86+2E4t4_}XP#wr!6R@}$$x?;OHsYP4XeL35>@7X}<;i7!jT}>_9|7sEm3CBd% zXZTLPw88X}V*64Kt-3n<1FYJ~Zamju_Lu45$=T4=J$KET>%fpohTTW_^Xn3u$pStOgU{=OOYEJ@?LCLFL zVv=1+!Co^y3GypW%S!3)6ts9#^|!aLtGGz>iZZBx22~pLM9; zT3s{d@V2U;o9rrXY56R@VnwW+e{VUg>!OtFs-fupT|+ad0dF6l`~_Y9aI^Pc2A1uf zU@dF1ySSP7+2`ks`@}BPk6IJ?F_~4L*;<$vKTPUny1}E;FhA@4-f}?q1;2SJjx*L^ zG-naxn#_U^oc+_5?5d6ZKj*0BhRU71U7=+=3CwYCd4;enNsG5+7L{ z-R8wz`12W$&j;u&I|uZ|e;zdGb1qJz%*Vrjoqo30{{6(>w#Im5tG9R)A(uWXgP`jl z0A|2Y1u;jOcSs-8-+V5)g}ToGyea=nPoLk|25)K3(lP&Vg3wT(>E$SNW327nx3FT- zeeZy~{kktK0EjJ@;57zg*WpoKK*mY+ET6}qF$d?Z>HdjTR5(0&1oiRU(F{s1Sj$Ex zM7xWUN;p~@^?7^7m#tNvN6VsyA+cJGDZx%DanW}M`VFAbm~B6MZUR$;kROrHQ|HWo z_7;C7&jFI`9`VSnP-gR@kqEuCHC9C&K`P7loY`{0=Avi&eKe2118Qd{7aF~GN5niu z@PxitFz!c~>@6EFem=3!ys;roe96+wr8fDLiDwd>7DT_S!u-#VrgbjE|Gm{CRybStCX#s8eDy!?&Wh>o&`8-|6CynMRskeel`Z;@xY(hg( zpPjtx=G4>=th4M->mVH37NZ4SB%lcm`&_I{XRXCIZf@ z#)!0rV%{sqe>TD57*E6v!G>Da)9@U-r_{`q~PRdzmUUx{|S?| zJEVTGoK9SQsPrkkr8Fck=B}5URd5XFjOzRmz*0vEhDJUr3YG&|d6R;~q4*-hQi#gz zNmn{aEB9zf$s4#qD?a=4x{EoUCo;QyUCJL#Bx<7d+Uv!C6^|!&W=`T`mhdqLT%yoGu zP5&&t(Z3hT@9!(symo+h{j=rFK26QB!(n5^Nef$&LBaQ;kU{rQ`98pQ@v4PNn80zv?AdLQwe0B2@%O8-20JN(|)ilfklyQT)W zz_FXv9u8S(cUL{wJf67L+dAAPu9QNy9B7dXYl+V-J)2Zx_R=*Kr;(qee46@_?h?;` zRU^>L7;$!Y7*fJNPi4J(S zxy*SuBWDZpK!|f+Dii7Q*`(xT33j}0Vo-NeWyrOlB>D0MDZyi@N;*rvmr$RH0qcuf z+Pp#ovZ9d3Lgr%XZNi&ye77qE61|?WQNLpf)N%3DY1+em%`e|^#ArcHbV@?mZ=P4) zuX}7V=IQcV!;L?hi7vWP1QoVOMQl7#&h)DGX+0QpV8iHPj^6zgmMrggLmF}kRNVT> z>a96Fd}7d^n|O>_KkC5?6&llyg8aJ^H*qK%c`w-&tB+IK-E6wV)^K)ioF23r>E`PhgdtbrouXdyqERGnB zrA$ckml%qbxd)3Ak~$}BkLWX{srq4}sHFCA@1@#DSlqd7!j&FX9FI?hwwC7xei>qY zR$I@@piD8>+2wWn45#f6h=GZ`mtev(&iO|91V3x<&qfn5%95jVdpHo$1yQnbeC3 zJO`r{z2Y?G8X-ES?$H{9{tTHTP7GR1j~%uPO)$x14qgc}^`4juiln^z%$7_L($@t_ zjwrgEw7>F&-Gt*FUZVni7%2HQx9#<@59)PHFLkpAx^pJLc(k?>o=cl8N}s5+V7k}W zIMTM{pPfhCI5}G$9L8?5dTa1_--GayK$PbL*eAOC1L)#$cBshkmriuuZ15ChVK)$7 z-hSE^b5}1QAB!(JI6wATL6TG26G1qr|NQ)l{%w6yP%<*$GdUBgE1YS{RrB4d<94Ta z6gE5*{_Hj^YkYmH4A08aDZucc|Lq}_D1uDC{8+&YpME&Z>dkqD{ln*)Dva`5BlSgz z?E(;MydRtj9kUf&H|bo^dsp<{uuW)`bn5{I6W|%EOy5Gkyfx(+Le*Umi6bc+qqW9d zb(Js1EZnX%rEg4$k&1!#yQBpd1>SV?9%M9tBk~47tu9w&=Qpxbgp%>K5&ba&CmXpAh>f@pxtJm3(VJ?$w- z*zENRX_h9MmL$UNa3{lyiLB7*pSIqio{t-D#o^}YNNG<#spaDiB*@M)Cq%caw8%N?Hx0s5TUBV=u?tv_%_#JVop94FB721lg<# zt)q7UMiCL~(yJ{g`z5Er?>>uaNBS^&Q;V6(~ue*luF7PDIr!q+hAjn#s>Cr zsFNu2i|5&i@{mKjDot>@6;YT$fk7=b?zpaUv!geojH_kTQHmx&bRVp*U^*t{NR2V} zT|Xb+HQdc6or^J-=4ribt&ac?STtJ3w38#z4%OR@+6`^WdZwDpSV5p4Hr}0$pS)Xg zr0b;v&%A)65j=(tx4**9%3r|#4LdoMQ*hd3@?hRM8Dqb%ayGTQ2}^+$szIqlmSS+n z)X~SD*up2-n>~9;{b|`#85LfFw6=EzB|#}9P(Ms`wyZ2?VJ2?E>ggWqgFIZD6W+N# zJ~(;I@}HWqr(tD!ky_kyy%0Vp>~q|p{BU}WpoWy@h493i2_!$HiPSO53JBqLVya1j zZ%+i5koxPyrW1PFs`@04$1}avh8#dv|7{HzFKtX3H3jCU<*CC2R(w|6lv}li_AYp^ zy>p_eEbmxPa-c|sxzXU7wDXM-9aPIocl3Upo=$EqbvFAQ%JZMlNlFd}uZnlX@?^>O za3f-j&*ZTq%U!YWNNw~(tvz{3+mbpKT}@m|pz1~4N#pK(C|-I;iHY~v^l=X9oKc0= z&|=u!&Sp?cOU}_`K@%e&MqM&us#fZrD68Nn&&tN8?_B_qEY7u|ZSQegn*S>a5wbq3 zKkaKZ!|U;GrFKO+_|;U^VmVo`HDp}6>!|MeS1xa#$$7JiD@!K^sctyaG*wzQJ`7EL zVUfsb3Lx}US*6L{Voa1B3?gN!8Gu!ijs;M&y0Nf7M&qE~6OzSCJmv-P_7ZC^Q^2(G z0f)7pi9Y@9@KUd#dZgMSz#6xW5s*qjCVv^Ln;5XZqR8CZX}#b(o7<5V7g6$cqFask z`3ojMM|92vL=^+7}#SDPcU{Au%Mn2w#G z8dOXH9>Z?BNpsWq@+5|{ggYi{&~)sEypjQXqyneAGukxWiE-bhtZKSDWuYneS$RKF z7u*sB%+^V;?k8>Qa4AT?lcZ z57)-@$LWr*CTF3)VS>6{&ROs9tNvTZ`3^NR4@c{-@*h2bvkW1SQw$pIjOO+Dh?I!T z`_5fg@M+N%NEz!e8-4z;n>rtS)KDeATUK=Zd+yot+~n||$>gF9RO#ieOD?lH$T=r> ziidG{d=)|;gK+&>OB1*Qx_59^%7$8#t;z+m&ZY&j`|h{AUI6ARSpJCJV(p{~J$&Ie z`XT;CQFb1$Wv{Js5yQRED8C^y%j(9JBvVBd>yv^4N*3dFx6FPXsssE@>VP*tIctltw?-a&L!T@-(Jq7^k@RDm4mWR&yWRN79;k88(>`XpR9N>#pFbbZIL8 z&fMqD??n#fH0Dy!r)lNGq%FXly_bpd zKAs8fMY_2Dz9W=8um3+&*|I&NQ9!Rw)aj53(Edb`PvVzIRus@42OP}R@4%3bI_l~rgJymY#+ne&YOu2Xtxbap5fBesf!~p zB)@qJoz}yWHt30J*p$>>|2f(sdINO&++9ebgZvfMml_!CZtsbC*-OQ(;DrCAMhO)j z*w4%~+Nx+qb?%mmLB8#A2%S+8 ze9b*E0p5gU)zA$M8+ESp-Pz&(x>o(UT^#dbxd?y@^rn*?gICabLGV)1I%0FEtxH8M zWb|#LpsrWABo~TIV6~L~1Des;&o(xBqIfzy#2b`yG z!eE&}2S8Ir2ICa_B1inO9iP?RKrzNPkH~`P?wHK`;N#J#sKs&Cc;dSO%h(P-dvUEn zy)fh_x!|3R_1-P|mRh~5Gy%`~bXEuGb)Q|sv#vp$FQSwxkN7aDxxrp}zl5;W&WPCp zJD03XBagphHS{nV3cmPGR2T#%cYv)oYTr3HckE~-<|P&Dz!)z0NiBHpZr9zhY_srZQA(QpC^BG-M)-%*SqD1E4x+NkRJu@4IObAi(5dh3 zc1-`NA4L(nRF%|?CGLRk_M5sJd}pQcmp|UWo?6i!x{b}m?cm{Md&qehO>o&~UeH~% zuUm_I2^cclbbTeAe%$f|1o&}vid~Dds@0L-GGeO7;2^KZRV|vKsKA(2zMfxYkP#)h zk2j_{cbriao(PKTtuQP_`Fs4B@DEAOk*(rtUjFcJ>$bOV$?wMZdR70P5Wq`3)V@{j zO6QMA)%&h*e@8)WfCi2cC`_t3$9ndd@tAQr{QD7j^ z0cfTA=JA$)+WtQ;kZ^p=x=htl|Wxv{ec+# z42s+-__Q1W`)=3$>kg&d%Ria(B<`&GLZxyIUMf8Stc>qlM!whcP8x>w-+;l7wgZ-g z-wocx@_Yhb$GTemGq~seZisN?^*>g?IN@KV$!^_u0mbs8@gxq#%hWCCFdO5SlVg?_ ztwLvip1f1@;`~3JDMU>(b#yATS5?K54ZK2-c1Rua;gfM)qM)ac+N zv+N=K>=vLZ^YueOTm18?E5G)}-Ywo;7gw_M{w`-Yb0uh#TwC$86C|YL&-^p2=`bPV z`s-bXX8%{@B*N5xY4Ts!2^|jod6nuE{=;~akO=btmOFcP{cI@*pZ`bNy9Yv@|M9=O z-?sX0rTW(DCfcsbgd!9TZEa}@TN)E%sN63zBh0u=Xlv8vx?K=Lk;Isp3}%>NBq8?@ zgSmxV=TYe$aD3D*yd=;f^hK!7P5!waTPK_0ylZj>Ufhy6zXwX@QFW`~z?7 z15C`9rSDCSO8^A8`ipyXgTyX4^7x-$^`$8M{kPTsJorYBJ}b56NffXVnlSNz>{QWB z_(l%&J4^YjLda?`HZ~@|znDyRVAaXh_o_HC8ZhyM*=alpci1O4HDEs`fRg6JURyd_ z?86bCw<2e|`4*G8{~`3gJjp;OWmLSm9J2JJT@mY*jx#oZOC{w3DF z=mK{vsHpji^7X}Cz~V?f--bz2$lcGY-J4PFM9bCOdVH$yNPTSQ)w%1%4CjK$++@1v zh%s2s{iq4-9zqK?Bf1bHbn)rzFcY8K1DKT;1Eq*J^YR^= z=G)U)O?aH$0d0Z7>j%(T4N-)IZ{h=z61MIwd>i8!^o0`PV*CGbJ2c=9x@ZDyG#&RX zIT!%3oE*3AUfK#6{G1o8^C_yoJ3vaaOyc@>&bZm(Gkd~xF%k*gU$O_LbL6{yU04{e zf5i(XzsBkaohbX7@sg4$%6mvsC4#|0Wbx~RK_PQ;wB6Z|mz}=6%PO%}ShK&*Sq%kT z#;hw}9_pQS*Fdj9RqNpNq^NR;Ghp``;ob6<%ZyDXh(GOvbro=F;{*qkQZ)#TW)u21 zAoC}mU0_|sryw{FuOv0xwly%sebhpJLMNqco|!A+>Nu1uSf!R|`ykm|RpK4=yLy(% z5~4OfAWr@0)wfKRJ>oCTVpGGYTIzZ&QC!Uza>!RPyYAz0Z37J$`fg&X8;;*=$7|x+ zxtc`Fmt{ocupHfZ6ES4^KK+(3-C~a|y!tYgSdS`Hqjg3uqkCl{R|>}2)iWnmjC5dd z|Hh|hQitl9N!%W>pI52+3U{9mZ2E@px^J%BNM^B2u44XrHZEt&F6sWwOo#r#R}dyf z#A5&5d;>MT{1ILVgGsh4)9xy0pace%h@R!Mye!k*2C+fH=z1os^9eVZ8TnxYhQuh1 zw(AkxJ%M#YqieHh(zmh=4oD6{QEn&i&|;(f>D}O?`uc?5Va3~gf z?{R*?E^HzLyJX_v^(;A!(QcP-#fU7lqTDBaLy$4vHkA?zChxMG6vaM?w98o%Ez@`G zq``4*uqNmf=`i7?%1;BQLlU&l*!NqMhz#9(?qt>S=5|FWbx=jV==aL;jSl-6kKU}_ zYT8#{$t6e&(tatgRCXWO3loo)($OPDB&2=$!l^j5r5t%QptQR4ytGiUBvm{xgOHym zM8T7byPUe&ou>SIKmB*R>sNYi&T;CV#_Dq%@Ld;OEgDwuI^S7690XuYpNh5->%$Ax z@DsTdNoE-Ot`Ajq0oO7_ex5^1>iXmd_{3Qkt^<+emlgKhr!b7B+0N!?c)(!t9(s=j zspQS@ii(9(v5OU~iIQ6$cjHfpj|FqGZq<{tYMW6-_05I`td8iT4*v^kZNn3u%sfD| z2u-UK61klAjTgY}#ZK~RS+(NhmLyDbJ)d0z5o+jUK(%%Hl|~`&JQ-3_lg@{47<80F~(e7@G<78ku`gW^Y^^u zV?HvjNOskmTA@r1TRY>lR6s&f9qN8Lr*y49LsVo@F>UX0jz1tzyqR4d-z8oO%OCx* z7$(kpt88BG+>M%_ZnMk(i9wgcuqU5PM?QV$=EIi=!{;rzcgvgjPDvf*F`)JAIn2_GD<&H`v-GH8%*+qDm zOXI6(VsI`7+kgH2>-x&44kp6Z4Rc9ATDa(%w@~^s+2T<$e0#y0U+ZndleuxuzELyb zVK!C!j99DQW<1Yi_R|X~^$9qRU1G`lwGjnIT!GFRJWOi3DLpJS$v@V3dqiP zRJBW`SYg@i%vI&iXaR-K~Q96x5zy^9GcKU_#_Ne3xb(;lYpQ|90#QXJ-dGH00 z)eCZKM1vDEu-m~w=Tw_Opus)_22Kw*pisKqlcMq=Sh(^WaM)Fx|F$Yr6Kcic?mfcU z;klx16`SL*YBIf2f+WSjFujqpX%68FZB{#rl;T3WiQtUVKKN5)~ zyHd*TWY5T{Lj$dxVvkYrtJ}5=xLTAVC1gZ&0T2dPtLI{>+rmaeMEJL&&9gJJarfdv zirC@Sfx-gLHj9su<@fQm8jF8pq$TK~bEiof4|0QNu4(Uw(Wvr)9+R71@|n&7`Rl}` zloC>mZRUz{r@+j9qafes_RAS4!sJ=SCW=!9mS5?poMWQbu;V#Iu>Q~riZibjd{0PJ zGpU+PJviOu(BEX^G8D}u4;H6zPqpa5nPvbap|RbQ+c^2>r&B_d=t00lzS77UZpeyH zq6ES8Wx=&Jw@n4iSUFkw8=PKs3B+dj*rs0o4*SI@^;&Q16-k}}o#8;3{2wu_cKY?B zsot0=X@2XyAY4Jry=?XkUx1k`Q3HQr4UINvtl0k3NoV0I6}BMlP?9Jh}JOHD34oR;VO~l~ey}QJc&DHKu&Qs@08|FYW6=CkU z<)7y(1a3ymcw zlu`V7ctr4P>-0PV=ST>x2lO(GoDSSSQHDd5afH!A(OS`Q%V>4DL$8UaTtBSFF)4T= zbOhfn%ISa7pUdeWria&#Nco9nOgA@1+h5nJPz=P>ksn0Ibftz$d zSIuNYdgQ&t2j3AX)_!L_0zaVjcYU8R+tJUAgJWjO^%wMlT3_z$7 zGwSR|Eh_ZaV1f!e+6IkDIF@G?0jRAVQ`>wE za8s!V*&kaX?88pD1nbVWl)26SQia`+AA%7#A_F5vQuQRDtMicF(By>CxD;on71mTX z>#mG43eXTI2RV;>zztjRcs0JA@{Q>Jy;PYT?g-pz^n3Hg>?5+Xx*3MOR{oUsN+sFg zbfK-vZ0!(wZP8$?dP$y|0RO0!?PSU#caZT(gly zaVkzAam?%Ewxonq9kFRIbtfwM@#1?eYyxK^+VtbLd9i`tgr{If? zP%Crut-DgiHVGeJF3il9j!$iLE~w3T_=e;QHXoRceJZs3`MJLTpa6z6_8nyug7MyF z@nTDch_rW$B_}>St{_uaCYu^*d>I;3n`d3pfWV^f()9d^xMO0KeJ)-RTN=Hei&V6h zu%aX~YS}=u_0hG{u(s*e{#azpWIHD;xb_S+)yb??l*>WXN&#IVyK?R)MR`Qn<&_(> z@wKO@mSwe1lyS3Dn=KYo;!S@ZfhFk9*rdKl+eD--R*kg!LVYXRu>ayOkjr-B7Bo9G zqP!xS(C#*FIbF_r8%ytPCzXh1!$p-bA%>Sk{tKqoTG_Rp=UjdBlu37J^QaEvLV$TH zI0~7spcrXa!7mR&EX7xU)~~v8%Yr{+7vNa2Im`MC*qkpS#C6r#hT*46rvQ> zrScNxo5mnH@1*qA%V`G&QC?b6n#^#vXHb)ab`+j#m0;bUq8uGB&j(Lp7@?GH65Jzq zf$?0ZdS8vw9d-{$?d1ny4$;>myUjwPSPGoqyI8t+sj zvpu~IJsQ66$z7@bk$rN)rM#viWmUk-huvxg)Ymd2kh1|~>4c>&bN~N7M!Fdo6w4xqj5H)uOeJ<+9WEbX4$BCVg1T)s zSE^1Y*coj4uF2d~dD+|b*e0tbwMm+6uWUDSzQV}%?b}BPkBN>Ktv2F;S-2URQt3V6 z;_GcZ6qmd#K72`^r*ZUn&!m^MggC9XLAbwS2U!CbQhiYAU(b+Fr{3GI8^Ka5ifVqB zuQ#z|O?;5YwN9VCTQqQI_+ko`>$O%2$5kjl3>SA`beyGA^X+()>XnT;4jUAQM+$}~ z-xS0t^miGJ>mRtVZr|U`#0fz8B^{gnHmI*ZwsuVqEsN+Yf2?i@BE<5Irx_eNH9*rm z94qoy%P8;CsCyvn4{~xyQ`{_5m0MrRvsw)Nn20dMd-zppj5^NCpETw)I_fvRKrHX% z9&0SC#+i0?bPPm2HTDWD+nnXjN(l(nTq?y4k`Wk#mI?Qc%uMRwV9J!YfGk6}Pe#3L z?Q1IAeaAkR*I1@M5ppeFJ4i(TkeI$KbWmM3zFeb8ZiH!$X-ueQS(P1`x~TSnMj`z6 z{?wwSSZ2eS^daOGchmCXyO6s}4NZwZy-)gK%Qq2a9?{xxX6ju48?FifM`e>weTpb_ zmDX&gXhKu){LG0HGI23zmdO0&kQKNTnF=d65-rKf(?~UgNA38H3f4nX?^0)B~PrBxo+}a8I zSku;jIuODCF+C&B*7qmGjRvUs3zkx&wpOt_^nmf&nW!R^UVu2)!^xjYvK#9dp8z98 zT588seK0Rq&imc)DmT5og$Dul`DS6Q6V;~yT>fB`2S zb_$t7|9xv%?OfTK>_4hP=4PJ*g9g7O{Oq}{XU@)k%XP5Dj%cp#&WkFiKhJ;tblYo2 z9U#q)C^{sMRYNlBo%-zhV&~vp{mCmO)iVilLhmW%WgK05FRTb0lag5p#cU+phA`b0 zg6wnK4FUKUT{k^TW_)T|UT*)XvkVi~eA!?~?oI)Q{-nOpzHlRG{%yS-BMcp?(ol9@ zJxtH%avDuq?Y)qkj?|P8VPhV1$-!}X+*DJeOIAa3)h{%i(8r(qaBMsrOxt+xmQ~7R zJ+3xjzIeq<$X=IpkcMnYrJJ>MA|#A7Jc7N%4a5j17Gi`gVO<9ZKW|n;=a>~#=_NR* zskQVVg^j37+N3+v?%o87&nP zd5H5GD{&vUJvp^z_;SnE{KpraJ&fd@r}Ju`?C_d?dInXooi7F5&_=GYruxr4Cwn|H zlqeno@1kq-ek%6@Y3NZuEL0{<8_u23<~*hEZRt%oo^yvtic{|Jark^)$cmg8D;INiC1WEp~Tm1fau%Y z3o0~hN2O;_WO;Ew)~t3!F+3ry&%IP2tI_B>%9#UxHSOBeq`HWYuYmuKvy2ndiu#xH z>mDdF;Fu0_6Jg3*CS0iDfvT9nc;fKXqrvA|IqvQl{7w5Nomuyo^x=>IXDB={2o11K z<8}2TJ0(7YX~X#w?(PDIVkAjXld8FkxE_OBiY1Ut~Cf~;o4kq8CbA7m+ZkObheBCe&KJCRENU5~7VE#AWfrKRNRy8o| zk(!WMHvs-`_M=UB$IguKxngu#*C-|HvBM5G{)H`1y`DY&j~fa_#NqBysn z@r!7?Ae5x5y#9x|TP zRjz>d)xR+|DU8h8@?@02q{J24%qTZE=`ZLBoyRTd7`UoC6NNckGrR z;d5R3+CH9QmAJ_+7iZnH(kYNUC_W{TFZA09Cgp0xZ5pyoqvGbUk8$@R`?mPOf}j~T z`^z)FuE^LPFGVG-Nm?k?{&}@6X$jzJ^Ze=)f)OQ66w}M8)?4ZLS~<5ZizQ**;EKol ze2LV(O?x)v(?51whR!rM!akZZ@X53A;3@9ST=~azZ7BgH@eX!=5k2#D(M_EKzN)D= zxY%DU>p7N$&+^EM8vMKt+?h9=u!c@y*@2r`nJ({ zXI)bHta5WqGJ~;(ylyLeyfcqgP#7e!9LF}58_a81gVNB+v8=`W&9L#X6xgA>wn=+@ zTX1NNBO+QoQ?{Jpb$~S)cw{&F_8bLOlZxzh80X8;MO#wX;{tQ(s-{-Mr`R}0n|Pz?$+oD9 zEj6Q?nvxk^blG12YA4xrf#QEwparkxo}9`VdkNaT9}>i?eoRlL6V0gWl)!f54{eGI zON%_`0HJ9*r~b6vo_j?#(H8Vyrq|Q^&m;_FP@aoNv!p*Z`e-S-XWEV{nY%c1s$K6b z%0OICs7A|zyw+gTJ>ordigF5Vd1V(kt$F3n;wJh@^Z!uR=G%YF?Q|Cn%grj)z#G2y zO66@M>hjPH2P;G7v%KWXW%l{>a(NAr4XcRK;WQ%ke`?Zm@koQJE!}yVz;+88QR|Wu zPPP09XYMBql9jAv1m5j?cY(lV1gAkN#X}SEP7*c$w@v5YgETVhO{;Vn36z#(&5w@i z9R0n+f(c3utcDe$IBt5REqjSGFy=dVE`(>`KPI=>g|@og{-BnafZSRL+^3JL-?QFF z&h|);=8kKvCMRT4xH2Df?<#u=3;mF;d-If^{Khs?d`DZmuOh^6FSf2XIo&Z=tVfcz zz&x~~ZI62#kdBV}->_7@RbIH3xCJyMY&)hVajT+S12-Yc-tH&9 z@|%W3t-$m-Qa$6cu&(Y_FuRCIG+!@LfeBftsw#z3qR)Zls$-Qymi~7N; zq*g~LZm+SWc#?Kd-7B~)TLat#6YFp79~jmF4o@gp<4a2#M|QiQHpoB0Q&*I)@n{Uv z46&<3x(POp*_GTo)&hdubMe~(mGH2UGPH6o^wVBQoIm{v#ACY&HCLznQ(x&UVO%*|@h(Kqr@)Gv;lUcU{{ghC+}*eE zN|8+J^lIH=C_RI&vhuqy^5b-1LpEa#-n2jZd5O8of65CL-dvDJNTLd)zMvqDeE|mc zanY1MaeE6}9GTh^&yHvFpx2t0FSw?cvMfdL{M?D7VQ}0JQEFwQb71CQaYe;gB8)Lg z7X+k%d2OgWcHE-l`H{IpxJW5W*(2$Dj8VxOcyliG_rSwdtpgX2tA6XiPCNhHCw55!smNZt$G(ioNg{jeq*0M8H|5e{sWcGdB>VOH%wH? z#yghH)_`};&v4R}*ibX1Hq;y^q`GB!^Q^k&$4D9QM0nSq$ruL&@`kIdU=;7jzD!no zDPk8nP{ZdY4uj{=t30+?KWkVOG_hzRFP6kq)37`Ctp;>izOA|M$&&?EWq8td z3RM*hdv~UxB&($)sed%yIcFhP`?UGDWX7xJ2PXsAAbWi` zNH5SorD|EcPW;~HX^E<*f#v-t1qNxY7 zavcnVkw!zYL4y*-)D2H&>|j%9S&!oMG5d|>i;>5*IZ!&P!^x!nRc}gf1u+XXL`lY5 z^1M~~x0jMIPJXQBP_fa&-M_BYqn)td_~L?Hr=y2j{5C((3A_^u!s*L3G-S&Hw_I41 z?JMSnbdbTkVj@-TO~^!Xb0(1^lLm2=lk)-}m>orQ(C=+BVH>ETybeEqKSurZsWs;i zd2b&zQy=7R&sz2v8qKJjjyy%|&zPrW%qi0DD4mO3Z>pUOJrw-*VjEFs%YHj#1|iAo zK#6x#WC>|h9#lFpIa5~IAEq$d5OTG(wpMK|F<#p^bS~6NI#qSzite`mhM(+--iVTn z>*jQ~fLUNrsfXKdbJW8;?)6U!#$2@JCL_<%o~t5Ck1hkQZ7 zAi-VGhwPkm?@fU_mAq;5*+4q-c(4>n3H%jzrwgzzZcWMMo1eI6rQA6cts@dNHnJ-0 zb0-YOHzeHeC+C@T>EmP%7M@z{bjs~o*r(Muf&SfTuzKFVvIM?ptE!DdM7ii`-p&o_?Sbp@0*I3_D}lcOE)AW5>&aqqPA z4lud(iYHu#a-1(=bl&H-j;nz5XQ_`b4j-^4Aq4Thqb?UJN3V+g(VdxMw5D^F-W~gW z`m$g20lcv5vm1Ydsx8KvboBTh=`i;lldcNdYQ@ zFjHsOjUw@}<8J7fKU~AcdghIczKewPT>sqyL;?{5#q$G#tx&DTiOX)DORT6*=Q0~> zJan&&i-r?|w{dB2nhG^lv$;mfao@UDG=1dNB`)8ut-i&mWOMKd6sb7SsUXg04t8mw zmcDMi%(VfUfRLK5{$JUax~N4lp7(}O+`c-^#6=XB&}DMc3;Q7V@t`wpLuus@WBHi2 znNP1Mep|B$n39y;)0;5{hYe=NDSOQKg`yCrR;;1q!qz)_OCtsb3o=y$k z26eP10d*j)_Y-C%4)^U`w+Zs)?b*3gI(zO?{4(jq%PM3h>Su4yn%=iOdz%4w(h0)L zr`hI|Q`I=s!y>d~g}F2FBfZ*&7<6E|J({iPV`x8seLLWN{H#~miHJ}kk()_3XU9j` z#n@f0kin)EFynA8lY)+p64EbH6f<+)AC#z{f~b!1;2+dlhvtdzl@C5)lygcAp>xpG z+|%~{h-m?)P>su*p9pK=?Uxxo<}RP#IJv3p$8?(yQ}Uyy;PLq3;xVU&;f&}98RQQw zm-ar+7+2T_PL!p45zEF(!81+&Cq@*ds+H%mhM;9P$na~yB`kchQ9y#aIefmy(ioywSmBp z5VBf~f6b(p2Xkk#+UU`2c^_t+&Y}iIuAg=?b7tHP3E!t3Gi6%V)X;le5fY24yY94a zG>zu>Qb_tnxHFvV_#Zgi`MVjmaO=k@f#nBfwZ#V!s_yPiR^~co*kN;Gct++ojM89k znQUjb`aQH%_yAQ$8@o7>lQag02OOFfsWEN~ZV}J))@saNy&P{oQ4m*V-OJIN2vy95 zd<+*%1Z+|kie|;aPs(=9V*{)xD4Mt=f#;*)TrOql&4!{WUVK8xC9JuIw$Q&H^J zgzue~fja6bt$OD0&Bdo*kk6K6VvZoZA>C~}1jaiy_DfTMgj(7FWpF6_0uDW$@*J*` zb9H$JNOVt`Lq$($^ee!7g2amjlZz!kcUq;3S5sf5+J?Ptv)M{3uC;LNwmMm;s~GGe z{t~D(uT1f~9pn_hP8ZzS-WG69KYtS1f}u9N6%_4ya?#UV7!UgpQJkdPl~-Rbw?3N( zss)$(4V&;4!{G;U*(3R7sWyo{ar(9SC3m3GTFlMGWA%M2fMfnTQ^)O%rm_-(gVJ+p zP(cC__6m~UMR{^o!d?$`o`ywZ)E#WcX-8_qbB>cfLxpzPZ;m#@I?D#Jvs zn{gVs5)z#1T&AkkKY+@>JeKsTYVZ6OZ4`R5VYs2Z<0g^3BflXO9o`>mYl+Q2y)_kQ zL1&)9kCe~4j}_B&Ipnw*t6ja4N^1WA=^bW9Z}&rLVA``Y-AU`4V?}4Ka04U_?+EkX z=yF92_=ECp_~rZ<|q6od3|jq#z>8PSN%3SzTTXrzav@f))I>` z$`nOXD`0ZkD&^1J#YeV=sRx9-r=?FliZ841u?5|sL9DLYwV}MnL&I>{>yImkY75W7cip+UySo?Ph-0@Gs_;(ov^K-*O%A1NX zi(z5K>x#7A2;8I$d*y@B7s%OT5Y|=q`N9|U^(chgkBNIy!-8*>Kd5NaXmIrGH@s!R zobRG{Zb(?Ve?IW$(ovgFtF=LwdyL@o3tnKBH)d^H6pO2F(xk(&7G0-`b~?RWRgI9TR|V z&>w2yNrR^M54I!(Le6`SFB)qrA8@FtJ12DZUk_>_tc6>C_Xh~K;TPQcY_*TuL%(`+ z3iNiqKl11Bj9swB+V80wE7K%UunmI&or&AoRnio2f;8-|TL8HU+3F1!tS8S3ow48- zY=}`pb)_g;dU6c{hza45Yhlc z_WI4Q&>vCVE#z3oMIzER#ubxM*|RZAcPW*TbwbbQ^>aF))qPE883fXetWkObdNN8zni9 z$HePVq6!lbn%W*BYs-~RHVpE!qn9`UV+PDg{`+IO7~cJUY(@f$uNs;?HM5j^7kyFF zI!#(&mTP<#1Arygb-#A7vnIK)iT+JiZ4Ncsay82QLxIY&&t>8{<; z{TnZNS9S6J)D4aT-D0foNP{u{6}u}H5F`6z?+0pva@{_qzb|6Ii5v2?UXj!dp4Djx zP5?&#&T0FgL(P80p_uA|^S})^cVmR zSHz1d(Ma%0qFNV%MWq)eN0{$2SQvoSU=8?Ls=UFrvK-jS14(NcI zJyvryo!Rd4y@I@>Wv)}9#F2yu`;j{?ltvR`<%$L&8#eX{LI!JXI)B9-eE#{q==|-t zvlnRFthC7I#xDNmwXuaiJA0OT5*6DBH|)}KyITh6h9-W)r#~4RVM+Qr&YoU)E}lNv z+)Vkf+Z`kx7XZcx4WvU-mQ#hn@`o(n0}Eydgqp@os)Kz%8qjvQ0+>aiCb*A>69O5H z3?o85L$(@QSk!;Z*FzmDBW^bWhYj5Q&2Ja5Q+0{HW0O(5-TBh%SV{6S1mWp0yH()4^#2MFO$zGm|*XGhY4b2A5&vS*^f%-iu zJ;q8g$)3_k+VOnoOjuT!zRTlsWiRIrP1=^A#@AwHc8h2TFFJ1il4ADQA4&bsogl+G z9=QiPx|^oZ)j$E%wSEF*8WpGssN;Q*Ki6oEV^RXq5~$?eyZ zs5T9>Y?2{U^z0dt_O#QEEcDGy_4ggXxFFr$X{MYzU*kU)9=1%$>|YKHSm2Ej^k4wiccKM z=@1)yx)t!GtbS0(VZ^SJzqv~!=V*XorhX<~W9N;ia5M@Bk)l?pvFi$kW^fsc&-Nb= zVur|)Y(Z}(GdhXP$OE&pbn+458=vOm-TEp)z2S2f49y2wWd$9%-?#n&21|wm05Ti2 zY`}gzk=q#3kbksn1!YBeuVNXKM^8E`Sm;qlFKJ}(=)=jf(?yRmnx03dE|qKfnJ7WsDPod>nKQ98-U zwM#IY4LJa#Rh{!T6jUYSsv~L}jTuLAy)@gh;|1pO)nouv))K$q97?R|U_DV4bchNs7k{^DT$~0?% zR9wpRJ!~<$!r2abXhw_Pd-D^w`^!80x1c263E;z& zt0WrbzD91*NMT~hbxP!OXPXS1!`B>J;?qiSrwjG*D!tn7IRF_JFKxgm1UD%8BvJ68 zvW{aH-1s$51L%Ykk#4RVFSMqwL#dTfmet%S&Z8{az5~38xEzyDg7=LB8&HS>4mp$L zF9q42q_SyTTwRu6sC=`U>qKl+B(*~xR@^c*X&RQp_K zc~@wi>aUz^H|D)V+jL0J<#HGt%+6Qw>2Qjt6uMSVe+XK#2=rg;{W3(k_;A&&$U+?na@o-SuFnxglBiN~Hi>DRpEr=-q^n&tMAr%0&4*H9P_gLd z-c-X}vVS2z^l)r8`w)m6^nQi{D#oe8JC;d0D9eWG(>+{nRZ^tq+}f}ZAJJ~c7We%X zVf&1`y$*#rpABhjPRES#}3ZYAz zOQ&cs=x9yKqKcn|k0j|yfCu*__NHq@n5_Z0EUhEg4qUe;0ted|Slu1av~mCQoL3l* zRtZE==iyTwZzDBbu*N|GRcyT7R>u8zlf{|RBDBX^?P z@;U=UZ*FeZaO2ZdvTvOY5H$tloOmSHYjZ;5t7)X%^INCJYxg zJC|HJL)ai4o&1!3b#y7xw4*`=1-tD$&} z1V)%w%=B(I3DG)~Wc)WqFiE4IV_Q*}G21uK3!m(oJnHX1zOzuTVu;#b9x=Z?NL}_( zG_*TWWBwJG0*dy?2S|WA%#A-dxB*qLr-|&Z29SMj+My8n%z)t}>m((ZD4n_auI0=E zX5Dx91k@~%;DIkqvab|v)28|d2;j=&jEoIDN~tgE)2k&OHzI2N$5-B{rR#qx6kIA@ zdXm2LIcHWaU~&|JD%@UWjo>iv>6*)&Zwg|>*WZa+$G=&&uat1 znfcr|!Odyp(jA{BCq*3ot>tp5E`Go<>_V3P31KuD>&AbHR$gEJDNk*+2k2&?kL<4> z*^D}o1Xh7~Ty$b;b)a>$#2O~y^|b3kQA~4kDVIEPIy)_&Qk*=V$mFg%^f?T-;C5IW zmGJ#(Z%w=JdBwXnGOnZ!_CRcN0>(!ox=W@%9=!(TxpV7Mpi~O#X9HvG1JQ-KsTPtt z9Aok~`UvgEU^g`NXIM&XzGJ!Rxd(`;HrSKUq8$TVS-5M)Re3RsJ?yWlSAN-RKPKYx z%($Js{Qz4LRZ8mg^&3x#(LO@i6;_~dHN7o0>$O^!?%W(3HnimkRS}hyf zPOCGZfxO^A)nryiErs&t+eF;WC~Ar%G{XFp-oK?V?+*Ytqu_fmPZxn>05hV$Yv}z( z=3PvER4jHk56UAzewCJsTZorH=nzDAO$!N`>+6vEHf@n=XlXN4ecH5ll3sM?xc9ug zUrc!q8){*cgpJCX*h?3w*|=_R5MI*{!nrCBmTy_S{x>9J9oER}ZQiA_4cR?ao5v+B zse@gRVgN8S$jAdom`<8|BGb))lI+UW;M-j8IG^Q2>sbB@RAO&$Z^?*!rU zXc#*VvSrlYOZ_{HmF}aB8inilov>6O2GLh)YnNL*PJcmx8&37_qx?>4%VS(75AMte zJ7{n&Dz>vHw9YC0)6;}Rb-a-DOik(7?}as$fw-cs^AECb%+V8E(LO*l2$B0*~xu8G?@)GrfxoS+T?bPOY7 zFM;4cal<~LLr8UjM(t14BD|N_mR;0R zHY1^|g|Ax-lP>=$BmTceD-N@C+UOHB$h{WgVC9-b`${>Qj;Y0(INJ3_&R7jKv#7;j zTSef{PFHv%63;O zSBUo=B-fk#5ozw%PDAEDmzF>*Ci$UqIC1HMF%K8{Ltqj)e=q%EN*24qZx56n=>fMM zV=z#x&ECx)9yXr6jqF5}jsXS~eH+?-vq8sUaEI0_wtSFC*_4~$fS^oZvo=RsWH`W$ zdZt!tLob8#z(tnV1-CZ$0+mTvtuHOi_54x@?jd|`|5-r%M*fK zMy~8)=3#fV*wpSLAe_Oz3_Zy&H*P8Svuf6(m$4DX8U?!ntZB;3r_w0t3NZT`eb;^$tN%%8S=V@4(1Czx=ji zbD<^I)Z%sGgVZtciprawOzQ|mfXU}j-ZK^qP7*<4{L^eF(C|1>wsYJ z>pd1i=R;6HUG+b3#cNWUl-9}(fmvCAg#;^Dx^LTEm>o^sd}oKZGw85yhCPzPj$DLh zOUorON3g~13bPq7><<+@tA3-uulU}!C2>rZJYgRtPmLG?o_Mtbd^v6@3cdy& z2dTBv1(-@BOXFUWRjPiN$FZT8Fts7DF-_p_vkr~vlHqgn^ZngiRCCH}BY>yl2!dO5 zoY^1eYZ1&zI~%(nhyb?;Ej!gSNWPrU^>K5P`Qr@0Xf}`5S&BWYl^l7L_ql;?V6*hX z5C4)>9vC~@d2*q&1cbf&qn+b)rhi5`EsP9LD1TLhN$~;X1q8_!hTIBr=*-=T&E{Xu za6Yi`U^g#3*k5!+kd!@o$Hr{FN5{z*&-tk+U(M3(?MX|!l5-0PnjXmx5$mMNp?;T# z0UHbq&%HkXKiivURP_r68s{_u&lmK;YCaXQnlP?fxpXyVrO z>RHgnN)RCPC0P;65HWUB3WA-Q#+ko&p!}`kwcsw8(1hYYSiTZ<;qm}b>q6FaXffk` z?Jq_M4%I^Rpg)0L{#=}AAXr&)VX_NQt0#g& zoZUE{p|R(&X@+5RJfUX(QT!qRhMx@`Hi%6u*qvkkKjRd48-ZkkC-^i}!K;5EFwOF? zoi-KpBkk>}cPQ&EPjb65wxey__+XbL(jpFxxnN)5pN0dg4l1kU&BSe`3HQx2|EW}e zQ9gto=AUXZHqkUaY;xKF=0hojdVBz^i~b?V@jyJ*{^B-i{c}L-ewy2n3lf1H!7%`UqJ(Y@wT71Kp;Qrwi-_AH-w)$E zMZq(l>OLf{RgFfHyVvd;t6}RDOc)Pe0bM&c8NBBh;w2t8&r=Pxp;MIYPj%8Sr-!M& z1pCGCV9nYvDYMAj&82)=J#h5A5MNTsVZtTj$6xO zlz?2iDS+?IbU*~vv$r-J4(WO?w7SGK=^2umEC_^2-W!ltjL<^~hEOjiTx3C|KhEtY#5Azp7bkR&6=~vO&sdJ>98rBTK%PI3NuFU`0Grt~zsUNBRlt?x; z8FV%Bo(4+;<$RO(W3ck<1Rg8`pod!Z@fmTcPMp*bUnX`({H47MgBH|@|8{&9s+f0X z7XRzFr)#!z80exjk38SON{pOwy@T>Zd13Il5;do#yo#ek*y7US1a`${5UMAg zwho8&$GL+dt!PVX72}2HXI^rn<+&(SLaYunbc9p$*Pr&qpYufobgdw_oYi2_+}RbgWT{+ny+a;6 zc$@(>R#{5g`_7=yr7dGN$Sy1dFdeTs20ip^u0MYssv;d;?B#>dwZ9(L-+p>_e-8o% z;FSz#4aN(AC}?3x&g9{eP;Uf2iCC=m2R7 zop}_?Jybh@gHXf~Yvdbk?2|{}!?^nXRf_-TTmIt1{=W6kH~XS%3}6xFEk<3nL_O_+ zVJ!CwQ0F$Xq33#G1r)gdzG`t)%E5ms%%4kVe_+u)+wZC^1o{_!&)O@*36|L1pw>MB ziP0_#2k;mTBm@wR<*b(VSuFfVN&p`0XZo^cLjpe4q~~fx9rTD}Iu`20|AP4Zy%L+1 zAMLbwLtGXEw=kcKX(*r%8Mvw`vN65{7^0%*zFy2W)8|M+&OvJDM8^>Hc6gbv475D4?vM}`!( z%mo4Ps~261PhdnHx^aK#f&YR7{8{I01y2V0iN1@ccLJ&}fOotw4=C<4)41wyX7WoZ z`&z+b64zz|nUn=>9mVO|%3gZvvpgU9_lWtJy6#LoV#GG!S7ppNYTx~c8_yuu3-R~wkdoVC<;Ju^>2-TfH#toaF zRY=1X65Zm4O73U9{2%WI;xw#UR{u(kZCzv$|EVKnYKoD3HQdI3YgP{ zl%puZleTkq*ynKN>Qd@P9kfq(hzZa&Gb@LseM_J@HpqHDYyNqY)AN@JL5MDGpnEsi zWi$UH1zILUrjL)6>Z#%xGM)>h8#cdiLcZZUo%aplE}@+NqmJ>9>#}I-f)2I#8Q79d z!)gZnL6}7$RiZYmBcH3inTXf1nMHZ@gX$mI_TDZ>WCF)-5Vxa#wGF&g@rT{r$+?iKj`e-h73; z$;;?-no;<0KjMTb!j>i(y=5yPilyYhaKMiq}x9+I}_iUq_M7!thw zo!xtW#Pj{M6pEeDs-eqUT|F)F9@2C7^7{SHS+7(Hhz*@?O+zSN__8Jcw`)*q0pznD zaakH&$DqB*w~#J<4klRuxP*i&vPup~OuXacV}vc3k$mmr!&=AAcCX-L!&8%4V2sB~ z$3qOh!_Te|Zb2Kp&yv)<3&#_2>D)kR8Rm2YEeb4Jn*Gtl;jG)rbDbsreqcmMZz+z# zWv~TyCAB>_;zK^e0Dn?E3)gnnEdaB{5w?`1AGUX~L_THGD9xE=U=9#80i)Bm>oQPD zPy+fjwN*rbuJnv`c-h&aHg4`p&!ZHB(KF0*)X3T#Z*M-KJL1D{V8T%WOr)`o>VE^J z`s>OdNukQf<4V~@avp3!b^5>E@ao}nU>Z{*h35(Ah;M8$qITMT9O@3Lm0;`6hHgR+ zbD5EIT7_#dj2C*otYfR9>!YomJ-)3T7S9E>QR%BXkL!$|*36Y=J?nx-^t?!)HFU9# z;^Od4n~Ab4obTjxj7Bwz{DF0`ZVPdwLqVQ+eUPz(I#?MR(^Fwxe-t1ZiphVKD^ITm z`pt1)dt?6r9B3^x*9rH4_G7fzQ5m+25O;On_71wE~;5~FNU|9-{KsR1w zjT+G5Ox${o8olZ8E;kkx)|cCtnmArkTo&yXjWV~e zs3k#ygsMj>DE=mkKdv_bgDI#c#>PAzqM8S8$4iEk45X#O{TD6)ts5%pqf`{ohD-nJc{ORi_L`n^eW^#VrulcDo0CSYXR(iGMg6&Vz<$qHDU(rPTgpxuKcXwl?9HNs z+w>1A98gd_!K5t>CV|FiZ;7Rc72E2sY&=@dBd!(XN z1}Lu6Erjge@r^o={l7$G3*}osqM~s{hvqL6ht+3MqGmMEHKIRB_mKTy^suR!>qY9s5S9v{E)i~WG{)m1?n4RQ0UQ2U z?Y;K_6xvo4N#F85DzcI(pr^6;9Izj57zMO9_aM1rlz9r6;s*G7D%ff?Lui^_#jv0{ zev3^t^|@_wq_Cc8{L$YElLnqhL738#>=|@B8{3R8d^b#^Sd@o8%-rnTlSr0+{C9wD zp`6zW8aP!h+8Pajc}?yNGN7i&mQ8^kKZeiW!(paI4;htcgK2F0V1_+)qYgeCJQ!+a zUMafzVT3_HqA#R4siOV!>0$9ZR_1~+r5V*`w;uAZ z?jJ1*0mi7Z_I6dI+?z>W8dxaiU(+KRIUt!ASSYzXcyK4lYd(FG<UDX%*T<<@aOdrSkz_(&SzB4f}b zs1k^Z?3OBkPm)wCYkOId75k7dY@G@)h}m0P3b49}jt)&m-}4+#mXV?1V{omyhNt=9 zc)6+9Xq^k9gkJ|oAh>&&?e-Nd-=es9fq4q@W7%vK-1hvO!|Kh;RsNeV`iy^aW=#N# z0OWX*v(jk%a&P$>yb#u#<1YPREn(FGm*V}__26DMF7D@I^$e&l5N;!qimxWg>)I*k zs#>y6@(;ESDm+=Ye+#Q)M6;Eo7I3`(G8OBHbm@o7L1=}w7^-g-F0z~rkkEdM8c#GF z0k<|Z%oEtC@I5LWNS2VYAB(tWA~L)^s=#_ecIjSaX@>8h3(NAiIA5`!NMu_03Yh<- z1#o59V7p=wzCXOGw;SG_=<9pKCojc)rVzjL|L(s&dmr2BPmo24@K3_Rhrc(z%Wk!Q z@3;9fA^`s@T90IVQEVS0D%)?wNrE;ImS8D1Uk1*Wc$A|HsB_c{%L= zK;3+SwC}Fm4H&X6+Cp5SekEESv0~5?i$MOGs{X9)`j0i&5_-%}EPy%wKa-VTW~%?0 zQu{I%me-#;ONlvn_nO$QX}k70%5kX`RPtqO`e_-U zc(&%>TWUR`PWp)Z=l=mU{|i^~*;)DL9Mb)U6@yFrhO;G>nki z>2|%K9Nc3WRZV~0(cux)|EtAW#CXS0h}GR?YwVZDK@6Sx1<^+T^TD0ssu1%+V|2zPP}CZ14Lm%U zlf~ho?w|{_0$XD~Q0~U(o$c3xY__pEQ3CKsg<2lTzuNLV4=mFZEvVH5Tts6lr61{^ zWMgP(ctz3vL3Qyrv5DMt=Tn~z5Z;<1F;YKKQdBRDmrfCrjv?F zt*0$}t`DK%vsx`U;9KumXvBCswb-PUUvY^mE3p`|ukVcC@raL?F!=Qb;zmX;zCT@9R7i&wI?xI-EjDBVNl7n^--@jDuBpO)k)Gc!Teb-{E_{toy4 zeUCl-U4qEr2ViF+A`YF8=y$RF_^&j=#TzP2AGHDJTKH3Dxc6)b2E$HKesrP3g^gB(N*G3BO{5M5K%vgNsUimCaJs7 zN=j6revb!SL$s((`it4cHiT!Aih7q?EsH9r8Me==Uf83GTXA4GeK>xXZytU}bTthCT9&L% z(*wAgy-zs^sm(p*`g2=x!w=w=#r=~lbqa}a#y&fzMuB8+dEN6~RdJ<9{3^fk)Ex}?+_>|g7s@fNayD0*#9L3ZfB;{O z!>vxMzIY30oft}2fNF^MdQEY})%yeQT5<9j8C5<8sm6hCrET%5-Sl9_s?*lEmI*mo z8Wmg5jkUdo*mDfr9r2JRqGD!QA(l;~wq75Q2>J}s#?{&OyD0RqM%t*CssD$0ITirN zZ0-eX_@O|Wh6p8#$R6oLr2)iVK=J{n{OzJl)Od%B$TZFZ3|MhlTKz7vC|dwhv!~K? zmA+TbGJpK#7hIt)E?)NZEdPF8QXkkV>D;T$=T;MiouX^9?Q33N>dYlqZE*-AwP(o9 z-M_MrWJcC-yrOg#;qK+9WXA?ukp25!axcn~Gs~+!thZFhdwUbS3{_(LZ<*#5LqZO@ zylJc0J2%&=5{K_ET(4qtzJ?!iIxb!dg}a_K{%0%B*FH=$5XGraYtK;Z;;V=a{l8$k zWJRmDw`RE0ZI#gnNtS&K$1|0HQ@|e`1I8RyFJrgO@b=^^BrI;xX)p#fC24O za%>M!8S?na7L5Mbr~<=_H|Shd6g&@OvRS!px|WC9U$#`&c^^lN7)4cnM?{x{6E0}! zW{X^6PTG7Z?Her!5}ybx@A2K0z*>J{aK{JM3L*c+3;hqAT4h-NVxahY?%YOlZ$li+ zS+woQw$>wqwU_S3TjU=UOfY3AZw}5WDs-+*u*8y|%obQb0I3I%8`V=S8!0^j?SAWS z4`?2r?vwWHq)m34!t46H2k)1Yz}yn9w%B4lW!wBY_u8D*YW>>=s{ClX`|U%Xl5U&N z+1KwTk-P{SHBgcYdLDrN=_#17!T4S-(|FdLvpBIdyA`hAClpJcZROw3F2d|!gQb0% zODRcS{FX{C`|&Hy@V6JBSB9P}!k-@#F!~j1y4|9F119N`C9goH1Zdnvv=IAXk^;=N z)grImyfDd?`oyukCwF0*a1f1K}pY;j~1Z&Y~6W)O#ZzGb8YIC zX&&tlIGG;dlSt>Ewy-@*Z+|&~U$wGl_scrF0z20@N6MwTX!fSp-kB@~DzHd628PJ} zPcS_Wf#Vt~*uxY|o6gpD$IDm0?-i|H4)7+3_5&-n?KLcMy6ES)xCEma>C{+i>>16 z&WR4BDENiZB!|#JqquGUDzoj5b$z6`*{v17aR!cK29*CZNb{Ln7?h^lWhId{($dY7 z%NsIZE?|U&<|PgiRgIZhmGX%;k|-B9Kf-F%v3_uH z9MnP+hi=y^(;aHA96XfHX0s*fy92GS2ntedJY$pj9N33M!y$E__(9EEh%sw&)lb_xXUqgNRJGqqa-2^kL6W@(sObUaX2jak zDsNEz0PkB=j%oGojJEKn3ef~XNZf>OSC!CY*VXj0a(U=kc>24ZtM7VBhiiCrXwwZk z=9{%`B6I7_(;TMItamz5$JC{U z;QSgotf+R*VUbQ@^lOjTCt7y(U{}SIF3&SvaVk1}?AWH%tw6~gTK_M3=IT4zZQdR} z-AO8z%uL6nqxuUU)n?wCsudJXrf=T7xz6%Cu5bPrdv29<^X5yf zCZJh7UArL9XZ8eW|o75$`S*7I=0*6+?^T zh<4aG%OcY=c4fhWdBPyUBf!hf7AgNk%ebzxoJd?=$UckG1b>`1ld2+P@-P4&y5J(l&=8z=A?Q6f!B%kbf z`t-@-z!B%=oWI>}EA!_K8*c0tJ@Mg)olUsWpSrgBrS2FQSxDpAj#IitLbm3*k&Ut=Uxx#a3Qv#g)*Ls;5lq-3SB656Imb=QAJLl_UH zSvEvCR(@P|6g_&YmQgs7c%NNnFz_sE1B;G)t!Iy%jkG`QOjE1xeT>v!vQP}EI>8CY z*`y&}cw7#A5q9?B!R7lveo~Ew-@1A8w~fv~zx-v;Ps_I6IxGfGTC=)uadn|f>#r#qiO4;4bB(R(YSN^3O4e9*lMGECQ++XTxsvDyu=|s&7n^da8pov$v#(PNz?AQT!pIk$xEkmDk6=^m6gwXQWGCG^7Z zaJ*JDoRnXkNA(_b)8pJ^CP?PE^oxz)pZMDjQ8LP%Y5IB}ZnALbgsiR1b`oi? z#{Sk=KVIYRF;cZ&SKq9ynUz_#TPDg}F%;J^T^=DE%xl|&Fg$bp$J?#ucEM-YzDhwH zgKBAE*$&m3Uj5bT$r=XsV7|{fXZP;BfcHInL-AoCUQWZgcE#=H-Q(aa%g;9{w!N;R zeblixb0xaT%E&v)GE>Qi!s&H8&-OdN(@@vFBs^Q9$n>GXk2ITX?&D>CTxbJFx)-gu zemO?J`E#AK{V%^{zkVS)m~KCeS!r!`WsD}=Pc7i-&Dj|n@26Yl6co6F1$TnmCMPX? zvHkSopw3bG)a2wDhik$uVj}&o)Ro={*0yhi4~7VKE^>KNe>)09{P7)|9d&0t-*CBqgJ8zwrirXzX<^)L~sq8tA zMjdHrc;uIHm@q>(<8WNVqAp$(lfevL#KH4&b1R^`&x#IoS!|8Ej*e>-Zp4i|o)v|D zjhnS)-Q+Dw=~3J51?n0wR;bdF&6OER1%I!ol>(<%RiswSpA4kRY>^)_?S}bD{kEQUS9uR z9#MD31oq*zb1=Uf30|sjDK4CuCltu#bB9{ zzvhgYNG%u)3g41v2~c(iIs79^@GI?EmQ!NF15Zc0>#&8!VyER_b!}#gNlxLA#G{kQDy`AOR62#;Hre3d_*NxdpUtA;U(VZHTnw~yWfBT}C`f^OqFd8o5 zpYO?jI>}ai&8KKqR#X&LlZ#VQtOW!<|3;4fFh$(Quwp;aN_MvQSFjy?osXmo%%oro ze=cV(E}uHvC&%e`2%EKEd}kTnh4HP+D=j_9!T;p-wbPN@_Uzq@7mrUEHv3%m^8=e$ zzF8?2p9jDPWKsXH!c_e*WxuLwVa?++#D!V(40u^(p~5JAVwU34+?Kv7=QsxPZQVh$ z<)HcIhn07gbxZW^+J|nI`uJjP9gF5H^q0_%s`B%xVOJQmU}i=f>*AJc&qT-do0}^Y zDrEU}rEjO1Pg1S4?zR~xs38!0HC501)-T>$;$s<=PMrwBY^9M=i-wjKCv?qk*Oues zkH3SKpZE{(y;CIcfjspNyaos*AtTfdysDa|g`r0{23>!wUSGF}xHvqB<5`AxfI!xO z!G;O4)wlm^tfipQmO*@NdF|9kS#O;<7}2j3Su&pAC{^9C;r!)GAWn|F_kUr9^z$&n zU%E8gjzZ^Gl^h)m!8^R#JDxgKS0BVw-Sulu&r!8+BgFivqgd2S5teAb;^yi$((z<F916+O*y^F`LIjvta?X$?OU&E3}Ch=7xXhWj! z46wo95#wiBZnb|PR6`@@)vHs`HVve^p6&U9iBz4Kn3$_Ia!17c>A&C<1%R>CRND&S zk^A&OrU8sQS3XbTEM?=_^(LG;VSz*V^s2?TP32kFhqGW*~Y4@W`}#DaC7q^CpWN8nH7j zZ2mNi_fF1;e7KOyy(23lWA1Gq;Sj{K_wL1=-WVTGNB*)^%(1_xmfegSb+2W~XY|Q$ z%u8|zGL#Z7o+`E}KZVzIOsn#Vd!x8CgCu^OK_81gQt zk!@mTX<0owI$BXvGe-C=H8qoxa{o{w8kWcBe-BRO>aRuV$Zbes2M=C5vQouAuQGSp%3M%o_Qji;>L4cnT>97p;htz6#1E^|1WbK*N3XibNW(hI z9h=0xf8W}){oq0Y00mdA0#SX`Wkec$LuI7!4^?2NFi2AKAKH3SOdR|bj#fXG-{#cx z^)%s?cHMDgfY-ouk{`Uyqp3KQeYBgRg~=m(Oa12S8ti()c>k8JNp~N16aHkJ$(djW zUsIG}(&B=rD~wth+QAPmG_tlE(x)0 z<*%b#Vl!DKbAFY23v;KT^yA_{O8Sn6pw&oDP3>SOA6^_qhQG-}hZje@a@R>ubw6#~ zT4q2$CviG2*Db;ETw#NZs)R&L;L;`4g2#161)11#|EW#k2kejUlGcl$U3=yvYM*dQ z)AWj>ZO}Oaz)U#Qd;;i=L-%XX<}YrWetgmYuD!KA_EGcMy;@i+5~Cj+u6%&rW6{c8 zpWgAmo{H<~Yv4(0jus{+SdeQ~)UZcD$6+J5Gz`|D=1&)Ux3uZxQU@1~7?#KR)3^S% z9Bp6V^qX^~?3tP9OT$0UΞG7rb)hiy|X}WJ_cQL{PsU(TvHf9z<;4Yj3V0A*&!` z9y%Q49e3)S@M*YY9cf1Z;%vSAd+y9Eh75c7B4J;KPH27X;QbR);QqL zy7d)MHblH|$Krgo)R=GFf~|0l0hwoU6g$+yW(|vNiRK_F(2+ZO{;$(WiuRY2vz?i( zX2NxO6Q*tr&lVJ1_jyK^m3}NhBVo*7%~1jl38ODMXlu+6RW`2*dbOfao)f8+!40ZViiSzQu}(rx+oYXzQYN?> ztZUkzrnS)aiMRPYUw%U6FCljRXSE>^PxKSP;2}oNGu_S?G2%W78MOKSJ!t_So`mt4 z`s2;|iz5!)~aeQJ?YcIJqRPmw)?R9k{-9D2Jcd6xqx9numwdvuSexe zaRK8KRtQiRcDW?#q&OCVSh;=6n1b7n8qqobQ$o0}m|$5!YQoy92YgJva+XV+P87I; z-3~oP+1Wo=A_F|ULVol1mfr!pvcR^Yu7^W)P@6U;6;1S=;Fw#Idar#<2vzpEVD!L< zY=K((MQwa)q!k>`^Ut%+%;MH0Jb(|xUL_r->Kaq+(t^~fVUhfWD(+bqMRN5j$7vJD z51I{w`=P^=ceP%xeBU?ASp1%^=;{90_!xhCQI@$nO&gn$nhL;GI&4sVM}@dZ_*=1z zaQgjsv$eOPW}4S5WpRWb7=4vci@bHWXE}L}7rgDA&t)D!K?dcSlItb=m1sWw@>sym zBxV#_9Cyi>UlTdm=?Aj!ngl0 z>*nXzu*h=qa#V0a3yVs4cKC-2*Ds8u?|Xtx;e9v!BvDM0@K^79NNX?HWq+Pqy0Nd; z6K!PF+TGcix6pY!H8b<0!;N!dXo2O%leE!|bbwdj=J|jvrXtsLfrzfKbE&ilBUoG&#H&M~nEm|-W-r5$Iy7{bH}TSSHLg|ONLbCWC);go zi|`f~_O0^V$V){~ed5E($>HG9T53gDgC=NpJp1J2uoQ|WY?wa{u9GXc_39L-`v=Xh z0nqh`BD@-1&m4p^55sK2c~ZRJtWzWAynVZY(=8s8FH`5M!iR@nz1k~kiNI}7w`670 zlG?9q*}S;|u*#WXT4C3ojGh4&FrY5C2 zPR)F#4|(?c#t~&~{+nn|M)jT=%USx9f~!}R;YH>6)u$Y)@s{dCgzWi zr(pDnzjBUDoQwSNj?v7BrRSs-(ksMHF?1@&A#@Q2 z`Y06mvHq*Zc9xj-0dla|dyB?l-RvS~rNjik7n{Qm7>F=KQFfm|vLI``4#7Hof%`E8 z(5HKLt6DegbVj`Pq@%X)H8!*l>e~?iurPJCAd{V`=iR4(xnE`kg)TWDT1XuOeHe> zHaPbzHyP7Rbg7SNv_s(H#%@aW*l(yjuKdZ;2B&Fg@`ewYHNTs8s|OEmu=-~?001Gm zw8Tl$pIq&5?%lJ7zFMe7qg#tE@xyf<{)bKC&KZHd1N1A;bQ&}aC~Z5N1BB?MTu}zD zS|*t)T%ugvBBqZGrpd_2n?8TGUZ6ez5FeC6$dqB@&c0V!e7P32*+U)eTkaSa9qsPt z*CL6Kn64O@Z`z#m*bNhY@nt=wXTSs9f`9VlB03o#HmxA&vWH9%nxe01dC@RxmfqH~ z%%)wB3xTdc3?J{<)u`BJ7IZvjQRh>6`Ha}QM?MJP!yX+CjpC)Hf1#duO3I;70(Bit zS1HR4hsC8eQK|2?q7HcVuD4R!t<*ixQ3#j;2}y~5r$U*jR0#bdglKT|YOP4jxaQSi z+=OFaJL*lZ4R=56nZ6g6*Yl^DK%K5eq-Bc)vfB&@;J3lw^J&I`m6{#rse3~S2z-lj zAxqF^rL~*;Fc!Tpf%(E6I;A13A7wD46E3gFMfRw8v-8#rKEC!Mk?3r4Ju=FW#rRHa z1N*HGMPjx8P0tfJIZYobQ0|IxxD((EiZW>DX>48bI&anv?Xj56;(qUP_QLAz(7fAr zq_VWs`uOo(+)1vizmIKL)rE1H-qe(}OPz2i9wid+g69V&*yGbO%+!Ovpm4MtPDM2s zKfGh4JTo#;460)_Hciej?P_rlEjn0AK`)!I=0ZYxuvr@NMeo%TZG8=A`{@@0fGW>< zj1PD-UCFN%=u#1I9_;{S5kZqI2AWziUh;Bl`yv9Y=6N%+DDmx`e^Q4->o@3AG?2~+ zdHn*S{(OR-RV7!e|3B>&fnjEel9*Sc&SlKU0vPFv7vZ{>;4>*za?8~ zHJDEl<|!$8uQ#Ljb`ps5@%6}Ndo5P1BJGj6XPZP)gy44?s5mb2P#5%d&)c_7Q*Qfe z_J^k`v4Qy1uQaT1HKWYgdOCrYm9;@4F1ldxQqrZ3l9)bX@XhrV*>{UA9Sq*xp0&7c4f_^TQS*3V5 z*@q~p{?C#PnB13ENSlKw9&^xySk%!`etJ#xXe>#MFdr-bQ4+Nj{Zt%f^H&Q3@dB>8 z&T5S2*heKa6|FEA1!PszVyjw@g5rJzrnJCie0N(`2dy*jal$?g^~yf1ZNE-MkYPH^ zQnM}IFAlx0tDtii;%1toRqkAb40kVX&Hau_wWTKmixCqwJ>G`(uHU4K0J1+R5b28W zaW8_xV9w|Y{LbCa^s=bBuc*-xSVd+@e_eCf=-U}*qqD75JKu?F0AAct|3sS{N>6gk zHw2w-oRAq5Iy-9>xE7k1YH<$3V80 zPBP0c%C>=pE^=-B^}HjAZshKXGuAnU9(iU>s6Xb&6`UlLn3;c zMlE7ujC-7}7~97$+I9B&YjF40k0QU$2kvXw`RH~p>IiY3wdzxOUar(1hNVFwlHl8? z__}>HtBLFk+x+#QP-xyXL+vGe;c*8fb}6sTOIkWfXEd_)&Ye42Fkek<3P<~2|AY#F z7z``&l-z81;zV~p!@|=u?d*v39zoAqb845nmsfh0&mZF0q)!-Wwf_mvcAvp8-bPv| zXA#HD6g)WO7{2hzNbug~&(;6@Yul&(2236rpE={fk+vDcQB+ApM^PXwTqmL0teo}{-Bc%u)hBT{`Dl@vOjKff;d zLJ4rS#i?m&JcpRCs%xa})!ErCv2c=o3a@e39zYdAnU@17I*2$e0>MYb;DK~*4r&0;cpc;xI|z0&_gc!4lygVbgfR< zy97}F36{ea|0Sv(fEHt9n|=Xg*T}@g#G7i2*2J4;bhn7`9f;?12R3A_D0N3_mQ4{q z8jH@x%@DBjneWQiplB#=-3NkRcH6cK#@+-V#j@UV0HgF3sP`Y*X%zzq=0N;5^Yul$ zy1G_^vbHJ{OE$N_WM$n-+aI-6TsUjHf?Nl2=F~6H*Pxkzo9oO<2mrd5M`IFZ(mqu@ z`1&MoT#W>07AQ;`xeJKlQF-OPFecx6ftLpa#DB^%R1@aY4qjcRvtz{4*%xaY=;vbKQhBZuRHEQc*gTO)StX@c$Z!ZW=toYT z_xH!B+P^D0m>`CfX#eT8$XFCXe;iQ|%!=WGcJ~O_HJNycr{vK#-5P=qegu4c`z0hL zQD2GZzlBw;-|>wb<2}5+<69FkJpDO4ePJVKwj3XZ5eVnBfGTsovlBwcY!Is!1CF*t z`#r4=o+NSxRi+akVu{vyHH)XX?zqycw}5YEOE&}YwWs)`Vt9e*0H@Z}&8@nA2|-wv zfWcMV8rrYI(LYLy%N@3C*H*1oY-tJq=@G~pe1W@l@C=&VbB`SbdTkntiz%spHr-b~ z|KXAJ4uVQ~?dh59JZ8$Ou^Xq8CiRn?>28vS#-n5^o=a#=@?FT}mj{vR*`cHZ`V2gJ z!yYlI{V(Z*vanF6S^?jK2+vjsdw**2Lo@MphJLN35XIxnunHw~t+oCX^U3as7)6K? z;YyYPPgOWE^(5A>cL)7y$-uW@ z)8ylUx=YaSGC{jbjHqqb_15~NM1D>K?nCy-rIxY*Q+;-fh19ob%UskM48AtqctDJl zd)VMeGwzu>4ECt0$u&dA{9*cVp4rusmg#kTy+%!|)lnxB5<@#;{o^l`O$Juus@^R1 zMtjEWC39+EyB&aLG)ZlG@jd~V`QTM$2=|Mgk=3^{d9#4@(rCz;x-E~_3Nee)9>k~dF1@ul2cJIDo;wXpS*TO!4xNwTapj0a`N#xn~_1|rdMIf#j$rX zWVdeZ8X9^n0h%(;d*UUrr!wGk$#0Xj=y+xZn;yX6I6%$Q;=%GoEe@rqzbH2LEXVvA z5_G(Y4=neNUwM$5n+peOf}h{I$&=I?AQ*utWWFf)MNs*Msqp&R;{bR7qMsw@&C2L2 zRXPfk8SZ>ltf~Na6*#&yeeP6(W^A$TQ7v~Z-gPJ~b^L<8!F0!%_^Gb!2u{Cozdh0}UQ-sdr z6%*9w(Bj`vYMuh%;e?|JA-`y6bAsPt1Cc9*&^t9t6E+jar=>BIq__>T%bDpjnQU2X zDUoSp_f%Q}8+SDDb9MFi=RJG2!@Rp|ymyO3wM1aOq`PPcDhaw!`}LRA1-gy;aMC*U$H zgQ0_RC)0sOb}qy(*JC1elK0;-$#(J;l8n2l>75fN47&&Q9|Bs#+=4P-WgcUrR>7Qd ziF}mxd|B=N0zJe6e_?z3#6`bCfN=aXd-D?!V2Gi$RR~CV85OBIh z8Gg7Sr?m7|4hQUZIGN*yVNsi2zD(vSdSX|bXKp(9I345-z@(HXRsyv{vgP3eF%1LvIQa+ zm`#=A!c-g=2b|3u=qhqFytUmz1&GS7KxCM^4dP~|*HUhF9_2VeFtHe4xFLz!Y6C2d zBq$e?Q%RdfLW&6j)0ug^<3x8g@m$B-oteZ*j6pwe;IRM=kjBAQpn*C19%$$q+Z6=w z=|BZV74xl`nw&RzDpX8ecGFiRgin5+XX!4Q>Y7X%PrrLIAY{>t??ecxK?3P3xaZrk?Oa{fO|G$VlT|eyqFC6LNhK#hdcooKDQ9}k>!ZLiv zZiN#c8rvfJj;j5(;x7B5WN&3YUy0u@Y|SeUFp(<&Smi{8@7AqTpqRJ^1hg#$1qa)d zm-}aW)@|82CMNxgFsf>LoR~xOmt)2yGOKt?U%;MS_E03JGuB=Jbc^fl7G@q{Vb4&~ z;tYI4Kq$SsO5Cp>FS#UQh@S+G+_q_Vd~JvhDG(9_$a%UvvUeF#&U|z;KNr}f7rN#D zY*+S_mzV3LKPWIxL((gD_G)K3UVe_!_!cOLpf&s)Fa5>LA9Sk)UcUKhM}=-BbXZPw zn-_4ZdQ4O7aXe~xhp5YY@ts?(_++;MM$s@B&>CDiDV!z}Yu!OvTD9yUAJiWTT_ZMZ zK3M`mdc~%sr*{Ce?o5Y@FQ%%>0oX38OgiMz$*-HyC0*;(2nAVLPMq#%S{krNK+_o6 z@}LlySz;}*DH$1^09pc7)f|l)$~9R4|E7XtYiBnT&^V2c%P$zYE}Pok-(FqSKivs> zSGe6IrGf#}Az)YzCBN^gAe2nGmnA5>S&kQTWhBZY(-$9gA z{yRJK*OB-;mL>T!UX`HEp_W1!ENwp^5L|%x1D)Aqbc-j_t1Q%}L|dq9YEdv#G|YYV zw28k?emuwP({U+-vy+tlq)7z5~?gD}#dH6Xh3UV@!Ie>!;Oe z=1jy`BUS&rcjz6}3Z$~?4s#mJN8kYYhK}5RTsjdB%$b}2`Pl)k)TU_U=H-d_?4DJF zde!{`WgqF~|L}_>6JS{?nw>~aN$Gy}-fUUa5)RC!x!?g5?PrSE3C?0d=Ou;5SI z=}q>KhZ@5J_JaG99H<7Y_&LNaF(V#8E*TEKLU)ybs1{*ce$ z1Uz$a%Phh>F&zYt>8ZHfoDIIt{+O!Co1HD)w!T}LKn}2nh0iXiuDO3GprnxQptzzw ze}T2C2S^WmA2+mBn+yG7*`8l%mdA~v4n&KiWnib)qf6jvPeu13O=;Y4)?ez zcQbIapEvRtEpz$ZwV&B`S2G!;*RDQF7I15M_mo+7SH^JNQu78&dTVS;*G45iNPM&( z%I)Xa%k?_=1I!ccFO}os3CMpN4!;O%;cI@@=h`At)0vjs^ZUrCw2C0GUVbrk2M4U+ zo7@;`>DyDOPN4xo^ZC1Spq5wyPP__LufPpK91vra{l)QE9GqlTk(=uP1{Xp^43R~V zT`@G=53A|jTToj&G4dR-272@q zeiTNHgJUHEV~&%_n$+D2EoF{tzACEy>Yw*+r=foZ9Mxugr`P{TObm&8PWsvkEcx6G z|8%g_Cl2*e5ZfQ8tx^JpOI|HNxFNl|($$5z&-B21cj2-1A5RYR5pBWzDHk$N7AWDz z0Ji}2;5@?4L1r_~py83o3HCi%V{{r!)m0)oeV|VXqB)|0+l4w{mh7A@f?YkBmXcx* z9INdP_DVl)LZ>^4RYm{|oCKt9Q7V2jnGCkbgPjAXP)|K1Pa2ONkiOO|#?<-A&Y#>S z!yX$;mcLb1?O37Z?BnH8wUc`8fLjY|3tl8_gr=7886}~olvQDFp6sn3>K&D5NXWz@1RUW-9=9v~6#5ET*9LIJS;kvOJ|Rd5d9YZ9Ys; zo>R52--i@Fluc91uP<$kMUu43o!S#go!)W)$@5eZ+{?kPO`SzLcoZyLzZ2(ooO`Nv zbS>`A9m~l;Y8{>O#%0hs^Eq^!U+=WKcGN8eV(#znKFt7DPl12ik>2Q_JY7x(uz=th zi>{lzL?#@xV$s3<|4iY_m7BWF6;S+4Eh6fi$RiudiN()6LN8sw)-Pp>nA{zEzZD1Z z05}=TjUoUq)av=j)+RuifxdJ`#I6_>#$SU%y87o``c6Sy zm05wZ8YZct^{c0Zl+^wk25g^fv6a*qV%sP}E_TOweC!L))1~X}Kvw(T< zxOAzb-ooBAkGQnxC^CY9sXVU6r&{=ViTgIZ83$wU;6T511M?qHWb?$L6!9Ft*9cXD zpJG;WBilyz0o#?sJv=BB`C@W%`VQcj7a4pkz|>xRd_4CQ&YLA4JbBBFWuFQ>{ga-6 zK?U{rCo!@2Z>w8GZD|>33KRlA9HdRR>Q97omNF!N{T1`@iPf?P$7A*cD)Y{3ao(`M z4{B|KP(r6!QnO%mL|KKI>=%nR3wgd{*}Bdap!Y%rHH=Er!lJ_NoYU)1ulnzZd18FL zdp@Rr=0&{PSUkD@f?@M<5ebsQa4>}%6L`vhek(RA7p!<-+eJ5+!0=o__F!BHaK*wa zs^`T0{ux{pm@!*DwVsFH4V)Fdy~S_d97IKofRhLh2$*O|RH3W<^rJXtWy>39T5YYi zynn`PZU!pJ8)Tq=3nrZBUloe-n{cA`!P2@ovdI-nApxT^KyrIO4mridnFL~g+avY^ zi#**2kQWsIW%uF3%MSTuU>KRariT1oQdeBJ^VeX^yLZ`z80HKZ@lpZ&0zdE0%#foZ zl@~teFPiqMXt4KZ-xT*%4;z3w4+a56-4`ePL+$O`Mw2@pIY}ZNLq@zuMz-`t3|*1i zCi@1Eu89fe9w6xmCSm|@49}fOCu_J~@uK@WU_r&1oD5$&-PJV{4J6pE*8vXx{+4J3 zucc5tY9N!CmL^OW3yD7E{jF^&x!TR4bz^#g&(iS`l)QKblbUvr_OOvE?O!>GwwK43DQt8ntXhife85GsK4 z2_!>Zq0_#6z&fWG`X|QQKJ@RN<#HYa!@;7q|MWV#iPSzZ-|H_?%MDO7Y1Qlw(3+W{ znvaK;dqmKKIHq74S_Py<6WC(ez}Irnk@q0|vB5MWJy2k<$bV*NZWVZ9-8!L6UTR*O z!dX&RoRE=ZQ|g!K>U!PZa7=io);Zup%Lb7-dO^O;9S{+*KK4pyQP>X)C7D#o99QQ1 zaR`vzGp94LkhlypS40W0CQoh!<57HiG~juG_vU_!vd5$w(X3%`wE8)3#tgS{c45I1XEEQ{leW+SYdYu(pOR;QC*%gsima8f?p>bSXb2C#kXAKWf&5)B;IIKx%c~O`Cip{SEjBl^n+P== zs}-!NL<)CkpnW^vC8}_b;EJ+OTwPm`NsPw`U0&L4Wb*r>y#V4DId@QlN4quD`*&c2 zgc_snc-NPnON%iD#=?~Kc36im zOz)guk_s=e$2-FTMIsEF-vw@J-Io#b%iPMr{M?f$n!0NOARElnu&j9P=m88EeM%xN z@EwI==iSE*)gh2!g3ipmAZpU88bD7;H{-?}#wIy*A)s7mxe}MbvW>mt%?Xz0fVCUo zWwkxSV{3C|b>dVz6Qb4%(^+=dg7CmJRM8v1UbfqSn=Rpn0V zKQ3o@m{VWBA_tNX+Q;3z^z{C?>UDm^r8#9?+uCpG!>C zu;F*higsfFQmx9XzZmHM_7M>VUlZI#%L|g*{xuBzF7o$ORUJOo%Z34c-a~uPXAKT$ zr2$!l&e%ZG5M?3A&!bP_HX?wVpIz4O(AnMThJFqv<5&p0NsAkd*_MgmS*Zoa>)>El z3mAc&qcjF6pZwa9>mJNB^+P&7j_br8vSr|LO_9`B%B~M2ERC)KLca>p!Lu2F9)BpVE{;?9xAz-3gZA>? zy8{cksmMak(jN?A8idxrvt69h3a8*C`X`O=h?mFycEGQ!`0qbY8-JB%PcYq)rpf7| z@#t7E{Tatzctywzb3zyP_xCdhKW04@rwag6D1p1FSE%xx5pgRWzfYJKteFfdmWk%h%y}(9EVnA!@Y(^J#O|Q`G0@>>; z{qPrbl*kmZ2EPT0pCJ`W%r~HyN*tF)$)}guP9=1xX#2?520i}cPV#JbbLJ|%7WJt) zIc`ZOvRxkv0OikYOd9O?@bYG;#IqHK~|{;L9r=|03g=X)Sa1^&L&K>FxWwbX!8h60b;;6HxwC$D!ozB zql_(emOFdI6rUBt(wQ@7MgBsYo%f8I9cs0>-02RxUKo8Np|G^{IEvTk zIh$&nnv!zfm2yzD@MeOe_`yNESL;)^V%4@42~@8weSN@ibq<70VM#HyXD;w$6z)zY z8cafU0RXD3>u>Ssk&w?HMFa9G@#_0Ojao745Y#kLYI+HbqOjc7OU48`&W3Q`WrJd) zaY)CNn3Q%V<>EeOL%p?*sf+kVs`Y7dmF~0%746$1q!BE$1j$zqmYA|CL|*ACxhaVq6sT+y`!4 z+(OQb$A@o!Y+yfK4&)$aT4jGC*tB%@R)NUi0c2(YVPnwo`ALif7k%}XdmoSm8ZrlY z!SY-1vmbB6jr9F~TO+0TCbAd>uNUdML8sh|$m5G9mIXEM2f97M3|FI8T0)woS5zGp ziqLgbt6RD?A#2k`p%(zdx@SK-kab7D$XpKLUYVEmRxTXzPz*9%mPMOD+LPR!H+~Wk ztD~bcJKC=}&IZeP2*jm$V8NZ=_UAj{ibC~8gn!!Jl=1egu?fnzV&SexFI=81nMaUL z2m)y54(#lXexzg;ko!E=KQGTMA@$xP;Mj?YjqxN!(nOsGH8sl%>}fJLqkwr_kk&*n zx3DiVhlkb)J<)6;t&Dy6LeiUPQ*P|mqRg6g?GZe4!&CzP`oxJ6J#Xq(baEFE`DdqW z(FIlY$G7xB!Cb6|VM8QeyEKzrm|s*bmM>m$W=kFi6JP4Ux_CONMDk>FQFC}2AbcG(mICx`ao)xyTTw0d0K7!TSt zNtZP>Aclz=5}DyVcUDh)KG;nJM6I$%_7E_N`;L$c#;m~{MLzJzZ0S?&J8`1V{;xQGK2Q*zZT(~hit<`$0fbFvz6W6_vZBBok32JSp;%9enS9!!O|q zJ>^)l*OvFFee+p5Tb9-$o^5lWbaknKM)icDApzT>aCh_O#2zJfDs(CIr5k6dFLkrg^6W z)RoAR*BPUui3#^}-gW#~On>6(4h*(Y zHm{$CZ74_y7SK#)$iU1Rn}LGw*+oMDPz&I`3t?dbDqHLG;*PC2ap2z^%WkE-$=+gZ zjJJ}lMeNzUz>OxaY{30LJLM zr>FU93fIK-=zk@yHc_!VpQM0#r(L`dT+ASA`;EN!usoBl5IncGc+R5|_+;uV*Cfdl zX8N+uT{3zAHfpireIy{+_T^WTM9xTRC!|~_tnj5C3*qGS|FHL-QB9_8*RV5=I4VU2 z1*BL|KoAt^-G)e)-a$ZW=nz^6jH06SB1Ni5la>&Aw;&*0YUoIfkdR1Agiziy;5g$w z%=6sukMGB~*1ML=<-&{Pysqmk$FYyS_wlZ-AE;V+b)EX2k}kfTT?LX}$pK+CIuply zEIX5yhiZ!Ja!?F#OaKYcg4nlpl%vs&Tpu6c=8R5RN{slIO34nEgAgyYcY5=>-OzIm zV4ghzbh3y}UEjP_mU2Gm85w;C2gW#jZ;0Vub(8O0_z3F?bo}yQFk|&fv$ZJ}^QOY| z&F1D!z~b}oQ}ZK2Hm6Y8P(+bI@L92X;WzT0YN=7QmN_Lgif+rgfxr%@->=xC8a`Pd zAR?2t!ol?%;8{SE--lr@L^=#sno?BBR^0(NIV7IP7JykTi9H%|7C3|E~nhB`MLE_(i`TF%K;CRe`d!{)*kJn$9Q%2*1 zLf-C0ey8y60h|ha9og6zV}SPz@{KW)VwVDp#_z%{qWO&vx9g`f=THpd3{U%JBGLBf zbv~GboHY+H4^x{>?V{>LTSZjc!t$du!d_>V8r$lNx5%VWyl#X`OKe-iHis(sbXdyp z#po3}>cLJ^M_|fQB`GBID!$@A#ZzH%@es@d4r;C&GUNH9E~}nHRl3y{bVKO9s*XP_ zG1-`zO9O!QqERO3i+w|(Ifux2>V-p1Jf`Wn` zA6a;20UkN{}_()DI>OO+>1b1t~{|m{83Mxq^I9 zcz#Xtsw^+l9?O$r)rJ4`sZgh2?Dh8M8o|9O9N$HUuQBx8nl{;7Hto!*u5S7l@#>Gr z9pz|m^eP3m1=ZH>d*c4`i0NKw&);J72UaP$kd)VCiiw_@^fF+YW?%1hM`-f zcAm}gzFO!F_qyMi6p-90{Phc&_q|P=%8(9YC{vIg;P#1gm0ts9JfH+$iVh7``vREMCm7;je#Abm zg}ou9UB1jUK@Q_(t8cX$X)>dspswI zh^3_?6!RrYVU|PCFge+nh-jZMPYFv*n9xvx7qg*F$kK@h`~%rjr+__WkZimevQnf_ z8iu${j_!7+Y&DS-wt-*g{U>#S-C?#K9;!f2%9Hn6z3W9W#ZU(@Ps#A*7kfhMe;(Vb z1%j9tpm??V_Gb7T8F+BjHZM^QF!h9Pb544nmgI{|^0p(v3n9%+?A-E%;!{4B7@ z9p|;x9Sv<4ZqAVhzA`p%L_pcU)PeL%%yZp~K+`U{UYiBdg}i=3iQ2qy`gCNM3(yl_ zU-Ndl!GWPF=K|^BUKQByEatFqwJ#LW7)3J!j3!{w6G1^dz~g7iqXyC;dd%mayYqLf zs7;R)S}yZRHq}cN6tnG|>>sL;Cy!6N&e%EfOKmsQQ@e;dglht^rSww~wGIb6+n$cv zXMpx>TE!_Mqs=I}y?lQZIQPQZ2i;0NMuz=H!7b`}*7w%}_@~e`F`&;)8wz|(Db%h~ zfSnhNRSa*5e?OIee(-8W%B?iE^a|h|4$MD;Ha$pC?G3Q z{5_q9fD2#~JC&O16O6x@C`iZwTf?NtIwdeFxt?{&p3fXc66-bm$!%dBYtpBX7+Ol}$C-Ey__ z7}NiTZ#^)l^)UsWkDK_dH}ieKWs$`R{-p=FZro3;k`$yLxM}78;$|m(cF^;rgaY90 z0Z2|^(y!A2luf|t03IPwv$*HJyaoJvft8WAwRO0NL%25ZS)QH6#9-FO(n{`Qa82{?KWq%>SKVvkkxgA`K-otmQe*=(l+ z%#yKcdkQghWsIEqc;QKF*VBIr@sF-iq>L#EpQGDU2zD_E5U7gSk78_*ExdNIDMeWPX)V9& zInpa42H=e^-i-y`AVq4+G<)i8cJbT?QuWC%UUY5kS6FwQnYT0qDEcOc$5% zo-Y9$!W!hc@95j!%jCiEE(7yFw5h;~F!<|UI^W%y89aP?FCNBU%HcCfyZ-QdGo$TB z5PJlakpL$3-3y!8Wf9I$lZbonl_AiHy$n(*TUrP-o$j9l-BDpYUjEnU8yMK`FX!EB zpSaTBK(oiZ{Z6Qv+&ea{+~<_PVM!b*QUX*>}iz03j&MR*KY3K$j`RL;Qf5t z>-~ZJ>9WP>mpudxJ2=XO@6HxaaUDYs#;la^A~zovB^o?8=*g(>3k631e_XXo?2{3i z-+U7bi0_fj-`R$=d%n>Q5M7G?HHwZe%AVD#C1pGXWeSUyt3#2d1*J_LwsHoQGOGN2 zl8e?WKK3Y+ars-f9()P-pb=9>gl!`)?Av$kzT%Ftbi=})K>A<)y+=F#3i&wl9(IUW zik5x3Cl}zs*lU-Zr;&P^zXx{cf{!3V4~e_jeWd#EYFk;)I(pVuy6&vn_W5(K{veHn z{dz)Z#b@_>rP&-)GTh=9>qy4VWK~;jJHM2vTcuUWf8aXwb zz-Ep<_VKfRkTPoWGP^9LKRR)F^+O}e!TW0VZRP0rMLbtv%ZiH5W0B<78p>t`#FO;L z)Xyk#L+)bVJ|%4%0B7x6Sv!EFafh>$|3A;*KR$wWA@gHiI)3F@fS?zbG0?9@0Up!n z0riDyaMynF58yobHzG6GLu%npZN87NbA`4s?AGE02CZ_)NSC^eqCXu|CE&zs!|I2b$rLO`~+EvYIl)GkQ$^dMg0 zMNW8>&aE^YQA9d)*9k%mQZ;kbG!<8e>dr})ZQ}Q#LtNXhp#hnIv|W3_v=cA309SO( z(P7K^)E})4U{%XUO1BsqcOE6zpL(Y$qD5nAE#40>{a-^9NdwmxC`CJFL+m?F}ByD6ZrpojRh6M68SIdg4b`3@BH^8;jfh=tv9r-JP>G&w#g=j)4f2Y4 zSM(KMj1BqUzKpx{>5a&!Sc|Z!Y%OR#Kb6ph&w~Z8SlOe-)VRACb1V(uD@h`$`Cxs9 zZnhA|P4={}LiB3seRGJYFc&COp*- z%qhvgjRIgkB^adk!xK(}gLdRnv)g4L2bS_66Abx=q;RCGULPkzqS_8RxFTu%Eu#x{b79B|_M}06Us)pQ)3bY4R_`vGW zSgNEV-x^-?s=!0XM79O)ssy}J>sU22M9qU&RX3Q)k48G_ z;%xi64m(JhWU{RZ4|!&(KC@Q0SfMx_RF!={&$m& zrH86z<$x4V-{%xU{D?}c1fnQtJ~MkkRjrd7B&^gkVo#2%mq(>+vLrS#L()ePrnd%VpC@dr6V1l4_m-K zU$O8gp?Fb-*?QttdI84^9uDrky-nTLyN||Vw4`lnr-emIaLLi6yD$?nszId zou>!=!n$;JK-@tnV5G)wfxlw?`N%idlqj%G7VN(CKYb&b7Ursf{vjWvwi*Ccrqt`k zx-voDrYPg9wY;n=Uk(TdAcu2E4U;6WO@dT&K;6j_8n9UfL}i;pzF}+3jio3&0ItHk z$DC3Uz%zdgatBw}^(TJ;=(C%EfJD({?QKH!_kbhr4jcBQXZc|EG&{mk%Sa&^p1Uxg zeqvoHQ<=ajmX5Xnwl8-&36~1hn&IX>q3I)BA~SQ3!K;UCQ|3DIYNs8%L)@XcpgU{> z+&H*@1M>5c55*y_&z^qyenjkYQEErwV7db-T}XN*a7#o@^#K5DK}}H?Yh(M^E9ilV?Frd`Hs<3~EI1XdH zYnx2UNAx^_`2%3VDJnMatr7XVWzS!M_j~DnzKVe?4w`mFF+*hXTAx8QTs1ZG`CNO2 zppUI*8rzgi_2&E;l4;`dLbMC=^vo8l)wZ@M`woFC*2c1md0J~(Ig_&imq6DP!tOEfL+Ci%18i@tynu6gZs@RiscWB3fl+Or%mLsur4tZPPqeKB z$0RDiP_S{+u3d-XJLhRLY#)dO*3s@?za9f&#ARu1bcINNa!N`UFsz{vY(ZNa$=_2F z6G6p@JX3DC(!~f_T|={!PA0Ywl@eaU6`l5!DxJ0%-FG#xgi>w{&~@9lVGJ6efYk1J zSk;n{fcPAIb)M|Az77@QQp*l*0a3`*W*G1Q%jtQX$s=u;Ns+?WidYQkbapbI-tM&i zZP&T+Ow}X1d|2-0Lk&m*?hlWtMV^8?d}u>*@WN5jxZ%<&ST>sw%{urEyywBnEbFr5 zeil>%m}tGUKIIr~-m(mx#hF#bE6D}A=5qT3jLw}qe1{U){6W8q65Xz6Mu?{-o9cbt zSe`HJ_jO2dmjoSb{B)q$+W$DW@nTao4e{1|8+t z;Z;fK^ne23?+sLoCRXz&-W-}Ax=pdV1ch!2>8~`=Tu4~hfzB0BhIywx9;ysW)p2PS zhkY{C9JeP-vgQZqe2<3L{MoRvtHuQ-<;EAXQamUznVx2FRELO-yh&-Dv_=|Tlp>Da z^^Ihm@C$W3Jqwc7z5Om)N}NPlf1+C*Tev%ss`MjnoH&MUV}A~m|hfg|26u$p*yatg-< zUvz%t)AsF(ELidKpqwbO}+G0gkr%R$-Hv9q%Jqf!zfb#-$ zV*3^X9o-B7RcHh;c(e-0vf%}#1ve#0oVjIn`oMd7LDL&~kq_A&n|u)Huz;8Bz+z8J zJFf=7bGpNgHksr24>;Xv{Vv0r-A=xGMLOpdBF|!EWZO6LX}$DN&fa(=i2SR0RQ?dB{$lT!aiT}gkocDhtF)k)LHJeO@oN2`A=1X^81 z#zjM6pxGPpPV#8&P#O6T#g;sGVE2$Rw(X1jj(u8;q81M&UzD^4eUs+hpB05;Ai!fW z?(#uG#GgLN{FhDC;hhm|(+CNTv`&qd6~_(cS`hB|JBh>V&j1&Rc6!(LGo%=4IUinx z9_9EC_;8%E?!h54AnmRlH-ONLwH z;@Gg9=dFQ%=mNZ|b+?~Xuy+xDut4ltFK$a*N$96fhiH^+ebAAOP)jMX)h%EZrYap9`^3hdQLUOIebJp^~_7 zWoYS_vHc#QA)yo_ST^X4t(AvraSG5)&jB3>FhG_@g*0H50ur@+U}WPk$n059@B2g9bP^=JiT&@?8)ADe*43n_gML4eT>s_b z-Vd0$!1Mk%jvF1~X)#GV2P||!S#Jn-Ms6H2oCB)ax?n9lk#E99dq_%Dmv%1K0)LtL zygtJi&@%2|trhi1&#+Tqo$+WbQK1?*A=;qp&N~cL>3U}?#ilf}?3_EG<)V3G6&r_z zC>syhdE_9wPjc5==YIvUnA+RkLVc|I!)z8(v#s6dmMqDuA(&OrWe`M75DTOF5a)JS z8wrqoghXYXOhwz$=5ZrQwT%^kF1X`vZ(P_|vXj^U>}~(UPix9!4*~s8`OM!N&+VEX z@LN}u%kCUL|IuOT-_SE4?6u5if$y;a{TD736~=o&Zb`tU*>SIO>MrSqaqsc{Wm|Sl zY}Y05XC~TV|Hdk2ggIb>?)9DL{+8S9(Q>Sn8NWAV_CL6LFk^3@{^x`Ik9^|q-Oc`t z{|`Fq?!48X^zr+w@8t)x>;>xXhR*+2kRBjVe{cEqXU;9W*LVI097b7w-!1-k!!6e* zF!F9<^pB|M>t6lEfY!&Pv8pTZpLK^FcE|g*-AVL+g|9PVC#m*W1BZ5vXk7Lj-`~`2 zkBWCE;7{GxesGfi8?+KMZT+*O)^714X<}^8vvm1faYDF_gdo4ptMr4>wo(58u)L+g^681!hhLT#Ulu4 zh93w3Xi0;0AplWqO~)~n{KCBQw)#!bszT-E<>fKn3_w?6Qx<EpT@idleAsI_w~ zt1TVPZ_JpgK|h|}Hdg8Fp{Cpdr>@6D)q?S&rY-*2V$UW{;1a>Kx=Q2qFFx!)LCJqx zI}{~B0Z@5qQIuB{kqo7M1;i?&+GSV<0DePAq`>s94r*?m3=XW-<~VFA7d`^m5)*|jY`nDcL~-3L1bC%Tf2h(OZJ=uN^9T8kpM&3< z?@G0w*60s{iLuyj0qW<8va71jtM405_O4n0J~oP-5{SsIylvx-5J%C4r=@D|YfV67 zrm}@FbXSrT#r6iYKmuwoBFw4+hRTx<>@m)Lo!bN4v*H@7l8tLAEdwY)bUb=P*$qws z>V(F@8BFmFK(;e^0i*AQ6#vG??A)BShnq=zliiC zomE-sO~}&?Ra4Gg^GzJO>@ir)V=9QP>|kZ^gp&9|t=qRF`~b9t5!};i=sS<9Rx*aZgCU!o7LSQXF_1;*z9bzZ+_4Ob8AL2Ug4;?H_4a zE5rMW0$13?@7)Ids^Y~Q0%vy8|`iX z(nIUV9tbBVCZ_6YJEX&x96-kyY1k-WrZPM5J zAGfr1lyVrkeX9mS<4smK^eph6lN{jV&$$b{0s$zF!^EdrKdIZ3uLYQ&?mhKmz|b#! zh8mre8U|()U|s_R8rXn>yhlp_bx>OqJzYDW3uu9$g8;UBCT~hda6~wL49MITdYolJ zG~e$u2uTei69Y}L*wSI?@jTGpAi>ShEf&)F7O?e8)s}?SrfdE3SpW^aGmvJv`b8Ih zD?{jC+6n_4#*ktUR#*26&;<@4v$L{GK@%J4jM_%leTmiQMF#=O%r?;9FA5<%U;v#* z(g0R!XCvW6XQM)~suwxi$NoD-WL)?yA0!VK0h54B^@KN1iR|7Q~62Z23KynuOzxKgpeTu`aMG^A2ZX;&j^iw6~n(vmXB z=q%F-hM2*#UrRx{KbydE#R=datA?bZ?5_#Sqcebcdb=G^Zx#qAK`IWqm;Xn!L($@$ zdQm?N;o-rS0FO^W!R@u`E1nJ_YU2x_30zfKai09J$LT^(HC5I2I6D zyqD6rDu1VORq?@!*=wZrRA!sKLWDmXq*rW$c6z+XLakK)QgwpwN+|rCV^agW}DO_j_Ae%#h)2oa=%7g$fQsk{0t#J>S!M;coPFx;u%+dk9QGqtBvWR&zA@NG$ z@)#)TkzY`}QV3tyt9e&u$-E1MB8XEI6;IwjV+&kp8?qD3lChs zADlmhG~YW4hu)?bn2G9by>WbK-*LNL<$3aM59*)DdVenhT^Wk+!U1n9gL3i4vBzuG zK0aiM#g_w{u~OhWw&YPt)gVTAm0~a3UlvS+rh{g0pgF{RcV?c&AVq`rTzme$ABr;b z0NDpyhKs@8x_&pM@K2;^hzai}T^+)o>4H{zl27>nysd`j1HK4=7w%9!*@u?3k@W{MV6ZrIKpS?qg@=Ij z9^+Q@w$5sdKBWFnK=7v)uAoEG)&5YKe_KC8fOkxpwxB&jEZ7#c!GT@nvyKzYMlcRfD-`(texHi zG>%(<{6I|p{`%hjZxja6M{U!B!o3$5mU9jo9p}>YW~0I{r|h@{l5VP zy0_6|a4)pBF-`S$9^Uf}sojvio8^$g?`PS5KYQ&<@~3zAf&{2^M_>dwyj(1dP^%d0 zP}y8Ias`XGRy34}4SVKTnD3U45p85GQyq*7^Du-UDr3!W?|EF!M624589c zH49i6C$WlA=N0C;Phw9!F=J{hI1~)Mpuht^iOoGh`Bzj%M}xU>{T1qZ8#c9xE;P;{=f*Pv8?>%vWyf-&ih-#@<;p^94E7sGce5lc-eqrkRD}7l`>t~jdb zYZ*6!5Zp!}dOgm*L=X2b?Ut$nQ8EcMFNv58sqMUY59<;h>XMq3s5b)Ur zl#h!#59Qx|Ah)rFluKg*5{9ZoPGA!NOG$s{f}C`{dR+iGtF7i&(G7@dAd;& zjKNSE@W|4kJD=6^E;Oq4B-TUbU+!77R8M!NbI&2OmXzuNw{656Tb1$NUn`}TpNIXI zAvd4UcHrsnTiE?<1-9=mvO;+0bz~B5NAocTgPSV49wWN{4^e+l}h2{Qf`+>M56M(c0NzhqOSy4-(OO=Yotda3Po~W+MrdXPVIser$l+ zd!~pg5)JZ)*LH90KOeQ!NUynZjO^Y+{?u<6M zj-GD$?q{EeGVH#{ss2Zl85C2;qEcpb3EWgGmG;=)?^@0<2%4>>C0uJz&bu?fe|(5c zFtiUW8n8YzFy9|Y2`%MP4e{4G1rSZpbYNsSbarIm7$5?W$&>DSVy=AAt=Y;8Sf#WDE77767D=0t>o|w z%hf7sW&8IYd|)DYErSvFrJ?J}24$|srv%M>a*gUZlVvo=S8&20 zx>2nr;nbqD+Et^o+ZD)k>|u}i_>F4f%N7QbIn`1Vd1m<(0`tN@cs%2f56=`|=GC<9 z%cWQvdF4;Me_Z0SOmxrMvai{;`ro#Y!|DS*U!7GFMBMyN$$IMyp&(AcD#x{_7~P9b zRcX~JP)cu7QHp8R$)@LGSuXocd{`SIn&lF0l_jU7o28lE@nI@E(e-0+aZ~IifH_-l z%WA>TbJ{wBEoiR|5&YPX=DcZ>YEtCw(8Sn&hmnLQAxRNWLQ|4DM2*Oo;xBlEUfMaH z+sAC@iuxiWHZw?{OB~2}?nz^m&&^X;-0clCN_pDjYp=k&AZGt+Fj1t5Qbijq~W~nuR{Ln+6E{e_+c;6rdGqLmyx8y}<9SDw-`_=3H^PpJ*n*Cqa7wW!K>-SAb2S1sqgi64_YB@0n ztj;3IqZO7gh8Yd}#Njdv&w1JV%K2Hrn%P(mQnlYyKR1yLOx7X)LW!|)=LvJ=A!XG# z^U*X8uB`clA+OWXV$0z9B~D@!cTbN!cDhmIgGZPRxz=u+w^DcIGR-2B!T@DLRUV0L z1Rh7yCyRLrvR+~-O=IAxjz8ewc-D#q9+eE?0lztfkKKHw7l+C2h-VxR_;vi5CU5s_ zfn-9k-*CYHv==y9w@j4v<@8v07pg~h0~hH8w+iKw5&y68v%eZ%GAcT!k|HA-1ap~~ zY|y*tdAs3#iTzBKki+c8fR5uvhQ4h}NTqtdq}R7cANLDZE(52xDXcM!C|bKT`>!V; z338@O+{sLvGGC*L&O}ODu8#;oXKTKl3Zy-)klv)GCT|xmEFIPTu3i|-_X*pz+*RAj z-a++GiNnAEXZEg=Jh)&TX1#UIY`$hBompYN1E!S$^Z)WCbTZnL}j>)pek7Gz;9S7 z67&Ep&IA$1G4{@JdvBEE=HT++c*(mzM>QGIfD6|v9a+@=Hc=u1LzcU$&zu9HHa2r6TeS+pSLA%x94ceAsfKIXBcK{`k3|d$(PUBR{MgPX{IPA z0k4u_uXdeLJSAjr1op3+zM;{8#A24tdHWsMDF#X`Xuo=ybR4(V} zzA>}idSw~;8zR11OsBN~DVu0#XV(Kez4~l0#$|Cbld?VFO0^edba0u4o`kKNIo5B| z+6BdwD6#y`pLyRQjeN<>SGjY2EdnlA^TxoVmq|t-)foAWlX8GGI7Nx4zFG_T%=cic31|< zCh2n9m+$+RMV+4`nxpV&hC_qx!#ykn;vKcxZ>m0vrF7j0X|jc-fz|D;d_o~*Bf%Am zr&7_dq^9^xB(HpMbIR~+SYLGzQ}M{ z7AA!;ZHP#t#gF@ol1SYRsJY%3>t3mUKGUd-VUW#;9y+9Jb+aS7Nc8=sHeG~~?fSeAqc?)4)w}p1A++r5 zk7ttOR0Bhl3;(_$SS~gC$EWvtQv%{2zpkJ` z-q`>gjC&-1TytJwVK*ZDei@G-nD`))rQ|x_|Ja#|CfHZ%mE`Ef(NIF5?|+6&e}uGu z{jm4@@w|Ig##Jp%Lv)t8v0KI8E~(o+!T-F(eJ5}H>;K)cqyKNz|G#|J(+yR8Q&r~1 zBHVw@k@E_6{tg%WlQq=)R_y-zp#~+8@;PW?`CK&_p@!)Y z&By}`acLiE6Mql~y00t4?QANXN6Bmc^^cDXiges>!Z&2eXLfhFzQK$y5Bjl^?aNFV z@tqAu?I~}(7Bv7(Ecjaj+O*1DJnXTQ*H)^7e3kY9Bhskyc;u7-(UVAy#Vp>C>R5D< zsOC3nL(o00xSb^FDT6q`s;QA9hDVr+`<2TXus=ek{C#&gS*5{@nZ}A4RVN@|*j6_?L zdC5XeZ)NMZ#v?`NW3Su2=ayzFPLBNEnJVrkvhHh8_hxZG zoDs9}-a?V*1d3pd*?2|vD;xLktLv0jo~S)aT6>IHJ2EIR<9Au1p|7_eWT$9WMDL^KJE`&{&i_*5l2{A9(#q!aJe3eGnC?r2^MQI zt=VEaGp<}WVSiG$Zqm0?ph1|^|MI5#<4rZAaGbwJrJ4V1f_ep^2=b5#q3pMP!j1yd=-iNIs}Jyx{#Jqlu^%-eBy=3G?kNk%`+) zxBVO@Qu4kI{7RS^nDh=m6q6T=4rL_^ZB~lfSv$8mQ%|Fhm~=w3)_h#v3FK>7L*0U) zmn}tKGG4Z3{7gk(+pTg-12i^Vu&vK>a6#Q(=$f)^?$)*ise}*&|EdH=*qS}!8+K%K zY%{QXLr$9#uPzeO<~inqaV`=Xv}`g_v;6srQ=IL}%Z!(U9kz-av)%I|?g8&LYlCV( zB?)lqOHh&UlJT?rdI^ncDJRJG?UCuCBi7zE60j6Bp?U0}gsKj5lqr1C&m5Qo4AK-H z;)Y5Q2Z7o(I|d?>kz7q`5Krm|1rn1?kmh7BMq4%1!9L%EO6fjDf_6@BpdM>pl zi}PZlPNU42`DdENZqPEi=&$zAmPx>}y1PVwx#t5esY5v6mxG^W0WeDL;+IvD1uhR&n?g-HM8s4nN#>!HigBcPLaAF^1N7lC zoK=@gRk-%%yxvHl(=dvQFW-n=Vg1H=Zr->8)mB|ZFud{t-dZeNEkQ!E{bL7K(o?vM z?%Jf=YL$v@%SxrKPs76!IL0Jeg6CpVYq{h2iG}X>zcLhV^BYv1E6^*g11F-`aVGAz zEfrbr1+%d58tKIGVK6oUDy&kJ0f(qkSgaAB_%L^OZ7&6l(&b?;p|jb4*|?08%FhMq zzoKWHn{SZJsgg*)xiRgzEOIT3oZnbOD4MNtQd#KoLZC*0M_JPfGoMM-RW?b#bFdmO zS`{8)<+r{#FXIGhMBLmyul-s40``+mol z2k{xbvk0|_6lu~sZ$Dfo*`8GVx^nv&magfs7JmiFjFlUX&>& z)Z*<|a1_b0EduG76!KnAD)H^Bnnk<72kYF_5=>B6hIm*l8e9i7E}EZ~iC$=J)h!5j zVPNIL^?=?+;ftOlN|A1&8;$NXW2rcfyFYxM0d9sNzXz0>l1f<`sprZ694U**+not_6xU_o~6@6at=vhHu6^IJ`*} z7L=$_=cWAp3!BhwE%R?c#8-nxl$U7Ig)UrS)xH~-cu=2waB zFWzdhF^49wctrp|=iyq7DzkTbVIL4QX+L_Q( zuvQ^+{PJO+IXlOLo35#4ymEn}u3`{^U%&MoN@#EX_7}4B zvsb^|Y;5%FTuZUwKKA%eb@p0+{+K0?G&>$B7sIQ8c7*qQS?sasccj8;=D)91_jBsJ*2=PaKtaPA z{U?Ncr>ZahsY7#-whMAa0eL-gc}8IUYI9%XeMh&Ga;a)&rrev7)W5R`SSgO2b{MUb zq>`m&78k%LGEs|IyV5mWPtXXCgCp*@PUuzx}DfJIjyMrx) zCoCS{qzVn&>NVd?R^F$08iEcdXPKnZg_D*g*6-S;M(}1yzx$vU5>wczl^NE2l9n}B zRnw|X<#O$onL(wMg_J7l<0o}`izGU-XhWIuHzPfh~BQ0c$@? zhWOrIb|nBt1hKNxXZOgn&^yBA1ZuPt2XqIKmHahJI^`AClL9Aep0XMcSs&{IC@)0H zZ9+U%z-49l>Pg$rpImYf`1?|-roEqWwcz+ac|O2VGcOcy4#8tYKq{q170x$&NEKuWu zA^}Oln|G(nnb9qq%ndcuWTxt-X`Zq-+O(5ZkqgU7*m3;2KGA6g+Ate(^OaQ~$}cqf zgRyL5x--txVwfCkQw+}OB5x^rLVEJ$95(=<@mzQ3xf*>zu8f{j_rrm0-;5G^&LI_~7K6P`2Pv23Hz(nX^{9vrM1IeN8cqFW#jwtVemZ1Vaa@lEd51DeaHE zo~n@}W@O9~u%z(YOhc8>zB!>zNpigOi;knj2>^Opyp?&zHP*y4$GRW4Z66%wB{4lG zbRPzSZrYZ#icA>t`rQ2Ytg(*}s6jGa?J2>S45RMPDA>p8^x0RfE2KA44C$tty-Wd~ z+Z(EI=_SU@UX7Irk2s%oHDceQ@@bqMV(5>jDdVmctrQ?q8#k#B^=0bAC{QQ&qc-cS zv5LPq7_1vt$gUMOVNl@@;R)~fsNY+63sZfL{&v1%d&0NV<@&2Y*eQ05#Jg)SDqO0V zH&2RTv@zGfNi(Je(i0pq{nSZq%^=k^3=M|S0+-#Z1!oeZ>X*wIt zPu7YoLsQp*_|TIyw%^6*%ClkMsyyk^ctrhayxRLt)LXIBL%po@CAF1h5rHqaFJ3-n z=4$Oq8zOs-OB4Y3AH|)O@5VPk2A^oreuSwD-AUzM`;`bm(1&;qdjhBx%27=l0n54* zxpls=SwJSt;^8?c(YvuzJ->CimK^@np@_}ZTSGjp{cUaU`wP700`dDn9o9%bp8Bc9 zLo!##Hp8Xvz*Z(2PPJ*D`fYEvreBekGoqZz)*;854%5qjm3XM2#ndXlWx!*JYYoY< zSTY(qIDJX1shHsEAA^ax$aBAj%_5>B8S)gCvmx+a%tJCK{_$(Jm!Zidjt6B_P5U<$luyc&|JY2Nyn#=zpbdF(g(Hk>tJ5tw4iU0= zsziyYT7H;y1lg{C_k~qw_UA4aRvx&KXfEUwl12GkyBE%Pga=K{o^A4AiUX_-<1sNj zAvg;)9_p}AqZcOtk1ir}hMh(*MoA#eqxt*`C>inG?B`b88cN`6}XRf$n-ZsrGWPS2JmFtqk-IslNnQ1sEND&%DwDP z=EEBdR?MxzP&c6gn*kR*yMT|YdqU5g{6Pho_|!&YzcEY&lcvCuNCCP|%fyT!vXUg+Jv5UV?4y(FnSGmO+V*w$PErw<6F8dA*|yY~mYS=u z@(LD1enbD7awIT8ktmply~_D? zkv{(te8t9?^~j0klkzSnKc2nfl_DUw!l$iM5Y}|vl(*@3bb=K668QR2Pnj>wWX~`G zX9jD5Km6WCpagDnBUlDqK2*FKnJ;CrkUG#%MMJ~bO&%pTlvG)~XCokKRo z)428$px9_*L$D~PxZ0H^J@BhlX+`h7Q+ytPH8AxMo@8O(mq25?QeoRgiy8Qwa4h(e zB}u=wnAk|P_wQ8ysyfcFsiExm9)3cMsADyJ7Sk@0;rgyl=>ea^d<~#iWQm;Yeo1qk zMGCBOlWY)f3QR~ak)=T@#Dr;rRn`?INKU<|c=PI0ZJI4Eb%zg=^T)vDr0u83>JNw|(j_E*clltQqL#8$M-z zr=Td@f%6oWkdL1WKhK{`aKFNzYjo^D82ynT=nIut+B>J7xmR2nKF#YjBiO0Pws5Pc(a?BerQ{H;U?)x@XkDO`6eMLrE)cR{ZN9q39+p|g286`{Qludm5- zLX@X}v=ZV({nDFMKPK?{2`u@&n;-w>{u!p1#S!Lwh+{Z1wf&TM&T|Ide#>pnt{zat z09d`+E6wl+Lewqy?_Kw^FC=JwY$Y?>G>U-qZKA1G(~s}7%)xKEJ5-k@VU= zs~iS~lh`622@>Z@Er?820LCH0h&|p`rntBc3Zv#l!c>jZ{SE`C_VWzBv1MfFFi`XF zdTB5Dm~>Y|p7&C}<@o(;QgW5@;pm1-!`>+TDrTcm1Y(BbCuGtE>eq>*H9x76Ulzt2 zN4cx0I2h;McS2F%X^kfEyL=z!E2%%5A3aaH!4P*hK2dGo2Wk4e&~ARO{nfHOn+D+U&`q{aT0sd{2rm?#qv3foN63AW$Iy>09mwhpKD!7p1237 zAch@WzkRX8T<#KQ^{dUcZQFFEnU~-JO>uY-#E&jaAx774(}su$Ray*9t)P|$CNp^x zkVi^7=M0BRVWy|V?CncR-IQrtO07XJu6ATx%XKi~u>Gz!Mr!e2r@cm>ees{HQWwL& zF4T)N+E1V9HhycnXJjqLML8lownYJ4+<1`Bw3HtNI@hkBrQf*Xy??D7tV9j>rOs&_ z_lH-XgKF5l!&rx{l6cVcIjrEVXY#$Z!vz$3?2o=7csqc2Q-=9)H2I2^6TpqsD?Sd; zHjaVF(q&Z7f1ygi+QibliwU8mQE8)}-@2uQ;uDt~8UQs)zxK~5L7S=ATN8Dvr%#Yn zg5#_f7ADY3eH%)S5r^0h6Z$eV&_#N2kVX*3Po8>PdlLN|EL<0FBhjU;QEV_2c?(8? z%)00r1{^t$8faB^dzAMc0(7UCLY5O)*9Y1AQ*N7?xi~5@K)Y;05-C}mGdJ%ERFLD? z@0rUfO_!|HbIw#6c3E_xI$B)Ts3*i7&0idF{#3X)2cq(kjgu#_OH#=f*V_3* zRjgn`)dYj4SG|#rfXTC#(&x^cBnwL9C1%TIS=JgthxHX8Yb~qoWRYZ6p;H(ACQPk( zTCG*Hrp`y9^lz%~EUZlWq`@W++!&)^2+G_?z#GNSjWcIqrTZKgZGw9tlasOOLkWi213+6E?olA z7eF~56(I2`_rLvoit2!Kcr+vSA$k@~Bhk(ruP=Z;^jb^ea4>Xvn&z1TzCEr$4{Zc? zmJc#bHzw8+%|~T6yJ^?M469*M(|ncQ`vHUpYu3hWES`?P0ume zsMXm6SV8Y>B>DVMBRGAZC0%T^8=Q?$)CQAqsg{+VL95IEIp&>f$uXv>Lf6&xf$bOh zV0V=>8$ULjDg*H|sPI~YHl=8_1cCR5pS>2pS2xkG$>yIK0y zyS@iE7kxOrKdR>|O`PD3D3fZ;(9p@(1Iv%~6#dI9mE!boPE<4UT7aG$~fu2MDl)T$YXB*HQR*9Mdb)Tr{RWG5i?58Js3&E%_g#m1bU9 zqVP}Jho`>XyPl~zD6It|5GC*_YtVB}(QcvoZ)_n(hD#@2Ux4ycSb^Q`n&4iq+i^6h zgl6zPzSO`fY2rDGv&z2#K)MmFQeTyPi6On|VXvBQfqIpF0izijZ$s?>J*Foct6APj z^G3l2xFiU#>mwP(E=~~7akH* zsfxE+!Iu3Vl(7>@o*ks5Y7D>8DN_u$qS;rsu{rrA+b^#b)HCipXazWWPFjxOqe%o^ z6$#Rpb`F{m3m!;4j=Uz*e&*NXx%uz4l}++nrRhnsk9pk$G_Rtc)ZDzwa{%11`wCkJ z(KBk>``4$mi==8&E#hvl>RVsA)eUG(_-5jVFEzNKYk{URpF%zyYpC+@&C>$MMfaNT z7w2{;nXBRHs4R=u=sks@;?urM-afcN(L@5_wBJ(SN;md&eufKbXj z2M%`GCo$VVUjXshsBGL^TeN@Uw=#$BHYC7(MyIK%ud)E9RDNMfDnViW%Ga%19-H^N z%W4Qu$ZR^imgAiSc!ovA_vJjr^P;q5M>E5+4p4(GbfTlgzU?d28qa?8H@^J8&k;G zCkA7mW(KpFneU@>KA+F^{pI@)e6Pz7X0B(hYv#G1dwJil*XzD@>p}=^3oxkNaIty6 z_t{QPyj*$RPb~HwFml7l2MC-oNA@PDDT>{2@iIG91UVD5nfCf?_OJB4zHxr4&(m!m zjviSQl%4PiNZN(7K2MH3cLDh7p-Z(IUc(>CzfwrSE~TgY=NbuE4!olAvXbSH7zyzs zP_!xTaz{aB>(y6@?A@73024RmVHXdLZZ_{n@%Pj*cwOcbd8tS3ez+bt7$<NhpIK3Dtah14YFBt*4zVs^{V2DE8(dt*S;lcSdDhGd^m6D zv^Vusi9Ow;hsB9Ewax=Kuc{PQ{c-8*YE*m8M~#P3kIGzDj~zTBn&Nj2s1*pObsa@w ztf6-cx7n09BTeF(@eXG>)6@oV0nd$mRha9cP*20Zj@hd7A6y!IIkzvzL4D~Av|@S9er;jbVqEZiu6Il4pFLB z$k44jt#)v%bafIha4^ZcfAlcMUyp-Z&Gd~Mphw@c&^LxKr+HuhzQ4B%pwKuGd(MT` z18xYkaud17_U&`*9bjU%R+D;;f5`UIr3CbDZTeK00SNA-Y)$$GKq?!0waQOes}-o7 zxvD4+c;=x)uj8UV%_SP=EEJCDMIBB_30hw|-wR-Wl~tAezdkBglcQA6ObE1?0pn;{ z1@G@CW}y3ie1ShV-OCLGyj``O4?e5GRH|&b@__Z|gj`pfxz4@5#=>{&w}ozxcwoz% z`r!lmh#xn@!UI5O)&bA5`cMl5L8X;oD%PKz1yDd6KR_V!`}XZF=pBEHsbg>|0uYit zH&cX-`#$s>L-k6gKSP2)|mKd&zB)JFePXtQcG`sIpmw%uH`9Ru4N$8B1D*V>UqyI1Ok1s)$nK=D9+6A;iY6~*IHaBZ z{^5HN{TE4b(F=_>A8M7WWvjub^2o8_Vc4s$Wy@C2L}excX3+^>OLA1j?Zq96c@=H` z^?)jDeKt~W|b@u~Mi=dd96Rxw2miM=RW|~Pxa^WReI)0$cpiO>+hXpXXI_@w5$?y5f~v;BHgPIVm*YB8BddDJMgAzh}=ue*aF zl1D{Q#6sQU@ph|ZQB=Q6%Z0-yFY8wwa6H%zx|M9;95-75RHz*&;mQFs|J1d>!|A8gG9@XwvC|;XLZS zebetTR)9Uz0l2rhmOcK7Kai6uJ4XA|I{MO;Tzr#vE!^p)w72ib!uLDZNVdpbvhFPz zHWoktUAn6{9PBZ*jZPzpt3KX|Jv6X;-R1omcab{8-`PRI-!I~>nxJ{d^L^PqJG^xh z&Hdt@LXC^Ms6FumnU+yU5%qj zR1Gn>|q#wMj=Iute7N}}yEO4Kp)%5(VE zqg>t7PdbI}qf&0{m*OfE67T&bzsF;g;zHP(SRZTUr@hAIB^@mrD99dw2q0KU;I4{G zbo5S<=skF*x&8{~aSQUa$}0CW4jdl%%v7k5Ajf1%ze$0K?@RtFfp0y?Rby(1t2ig~ ziVna|oXH{>7m%Z;R~WANitM3$k7bk{KGBO3dPl`dJRr26 zuqa#!I7M z@5)Dmyt=D2N9@Db#V3>kjEv|1CO?c#UmK%c9r*ilNFO;?<^m_-in5sP<*J2SPquci z`2-(&c_N>Pl4_0Q@LAnxl89u83)dUdrdvQm?m60 zI+p=(te<9-k$r@QKpYgpQT&`6B@!6onOUKUQkLFG?r7VJz)_o zHRu5{+1@p#|B(buk`m*LyOJ!46V>{yOXi_!ICviiz(EFaV_2U$a_`gAHvU%xYFc~T zpS1HWgVyrL;P@cbGdlWLEKb&j?-kL$*`GAD2^s1rualMjsQN|I$L#s%g%2`fwpCA7 z_CkGwMJ^u1psWp*AF2{Byy%EIP6==GL{L7QVYX{L3^JVvU$sDPNgVUrxHh+z<6G!A zx7PvOJFr_dXo}@~?@m)t1@UlZ=4O6l*QoaLQK6vevL6MFn&h0E-{bj8oY#>lTgIJ} z2G5A`!cnCX#}B#}NZH?vJ5c)o@x{5^u~E_c1Skbp__9HFXfBev(E7|wGXE3 zJ(*(N{9V%AeH~d?af+~%o!FML@64XlsNlho80-mcOSjnc((01nzhd89qq>Hnyq$W_@21U5>C{Ib@jqLFV)PxDS;XAS^V~o0VT@eU%=i+BYswL2c??E9d z9Z-SG*DSKBqNb$q>V#l5ny}(Oob`leI2JOv78{}`vgFJ=$-FA5V{SQy?^Rj{^jnK^BVpmANt=#D1dOeBiH%& zFEjTaSplF5`_Eeq|LbP|_r3oIzw19A1H@l9fldpc(ZbLCk3MM4{fB7&?^XZ*eP@(K z*@Cej(BcU|M{Rl!$tr3<2!&=a=DKB>MWKZYob566`sd9#ui0Gu7Qjt*UZC>Jwiau; zHC&qM20uSCFkGewW0t6GZkneW?_4p=Pc(1bZb%Fpd%0t|2F-MzgJQ}i$c@E}>2aFmuY^l(qYpty@8QnVFdTx&*9rsS%NY(%nZ>&ovDXV`K7m~v_*f@ zR98naD5q+X-`r;0Sah6-rmgRlU1(lN5Y!H|7NqiFyt&oY@1q>{RJtk+FZDUuGz~8zr zH+OEgyq0F*mnR#ueE}#mT7-tayTqcQH@0-7f#sf1oi!5T{gTyjnVOa;JZFQG?=&M#Cqr;Ukba8@9-X;#m&Ep( z%R?|G_74gpf+IL29e4p8%9I{@qbibj_LzcZYZM;6K};wz{%n-|te9|6T&47=EUqM* zPxE|R-n^-W8!989s;Ci`1bu<`cq=4e=(S=fn?7G3X<`ekxQrO8ov-jWwNev_MGUXi zZLmaCP}dXQ=1cu_;iag5^h=7T`t2~0LAGcz24n`n3p4fMQ(eYS(rtik)~4EyP8sN! zNwpX*3}nXBmzJ!C7|!(E@ry^%%wQ$L}vzA3E9gNN<&97A zW?lmYdzS_<@O=HHuV)oJ20~uVbrqC^$@JO>+B14Usg_i;7t0B;uo3W zO}=2(bet9yu+*UH_(`F4XaE7KdF%&Nmc zJ*d`WdJKN644){GD_B7wexKm>0G{7l(l=D&jvErO#OClx2!S03B-nbl(JDQesbG

}Y{RCKF^Yq+;o^ymuE58e~R0N~;!Es-g59dc}fU*FPOe-eAo^AMlvixIFvAY&?U>d+3JTMT<@VQA`vIF?=?W99KC_WC0FB&sJ?1xuM?Zl8xQ;EE#kpGj)yPjNBW4oH7ETVGDoC^h$Y z#Oqg|4GlgqAXt{)Hjjn*(ahj;r6Se+CO^n;C5XF3$vR_$h89>w+eN}4PAG?r6l96r z=k8TH&&b_IBDkI$!!6CVDabuJGh(F^a-G}vdW^#0v6A_rB+_7FrcWLs{Ab`ZwY{4Z zR^hXfH~mwuP$<&uPOnhmk>7pv_lsI=km^r!k2TiWzU*dVT&Rm)2M7@CX%nDgJI_C-rAKT`u@Xn_)vY_S{Lj>FG(?HU`(89k)iXGBC2`%(&9s zBfIt_7+iZHcaH>*E6&-#H<3~$(vi@0X|JtSHfC3K8B*o1sg1A*vFhEW@ zC)N4>`r{NZ6ZGSOoH4uE*qKkxY#P$U@-lMp%#NOn8ol%`Uox-=3cP3k;Z$aNyQC&O zSWZ0zz-tV8X0D7(%Ub>EJhb44-p4H0gS?;ZOV z4La5?I-DY@p?tarPIPpxG`qSUhk(g!vMK{OLp)&|QFM8W7ab^PZxRk-_nVb(Eq*QT zL~ol*^)-S5fBZOSy};dE-Gq)~1?|A-17Loeg6(|-m&BX-crJW_OKWn|@Pt!f2toEJ z);N|CB~+4o+F>XBqO2Rec`1NKf2X3hhIHM>iRM{vpo72V)q4VEN(ORDq?w{C9F2>B zpKK=0E7^6DGZZY7dR~)YSlCYPPcnG|8OS?jfC4(Uh##+A4BObxn$U)Axq@3QCKkDq zN>F!t{hVx%IF{x~>^?3maal1KpSsN(TV?CWTDHXCszL>E2ulQuL2|2oV7Es>Wn6=+ zWr5Vnh|yC@e0ms=NBbFx7Nm>IOJm$Rm(@c@7dNJ;0^Qc_-n(f&rS_UC-{lFW z(>ZP=41ANj5yW)1x(~xeP{EcUW~vQr!(MbHohuKTP~%D=Hgi6K_$Dy68lD2>hw-gaH_}5uEfK@!R~QM_ongM*Bn3QrY0%r_#Ftr={cNMK{Be% zxFL0*YsZ(q6+!u#k?ZXruczI_tlUOCk;rt=%8GS5_M&nc^Wf{Ceau!*nM>lM3!ptc z`kq|*G1D651LLIa^@sNC?96D*faxrY`=GN1xP}JYEEN7Y`tnRtwz3EIw)vg9@auA0 zEC-X>Kh^#`V3!zn{)%(`eXng@21Ug}KqHaNsBOfHg*p++p0S?aT#vnyyI~@eelO+< zR|R>_hL2^U%W6?9W-ebHNS?ZyzMdLGA zfop1gpp{1@ybscUsE1oicn%16xm`^|Aq4Enipjt?I4u^*d4+Mei_~+pJ@xEW43M7{HAi+Z-TdOPWni+$XS`EeZKws z>#(Xw@+Skc;+MI$5fr?OXq^m}zO17fqK^GX99L5He;rQ>2}?r|nQBgdT{Q|=321oq zd_`TAbDe(h2XN!|3XGcMHnnre0s+xPG$?&S9%3w&x!XLr2$w=^P#gg=*GE5de434u zlZc2;#)O;^*dlm%@j%V&#fneqItniAMR$VXAIi<13MUnay-WZYl{_2&${lBJs$^GX zG10h|Tx{29;J+Q8J^jSZwhd(8ycM{awo{kqypO!U1&bCKVZo`Mp#4zm#4s$Q6Q|R|gthwiuU!LYq=yU5)1p<{_wGB8PKmW0b%@+Ef4@ zg1#kO6K*K zVtScElfM6_7u}4lWwkSKeW41#Yi3dr<~k8;%6BSZL=}Xzhy_E!=Hgw6Y6vDe#l^Pr zR5KqqDWvw3{7G$lXeZ(O_*Io}`l%YQf$fcsTPj^tJVkk@X!zNx0er?rY+xAq%+~X~ zv;2(F;A#)Vd0_kx2pQ`6&O^fncq~82OK_G~oCcdi{FFxK1uaFkUc#rf3;1**Zg8jk zNpFx7g{pL-`>*wb+bSo`{!IOqB4XM4J8hLw-2v_r{bb$2?Z{9u+(k=;(^odW$Xb?s zbw7)$qYMD%^We(Gz@o=BrC{`>Y%+=3;oVM53}Z{&e&>9u`s^4JDd6!oJ|^f{U%!5R z935r^g!R-LGU_TLJcNLkVqc!^=6vC9qv8}VAA~zJAQ!TeL+XxHJ2qUFl6}RVJXme` zQH7N8%|{^1g=4v7mwbdv?2XHvc)4;c&4rY7gUV*SyS>_z6ozHSVXSSxB^ocMNU5o& zf9iMar?x}zR2C3^DwF#N7H$Q|l>yAUxeAsZ?zV3QQDUEs6<51ZXZmNIt2p0(Wh5YZ z?Pm|b=B-`8gNa^XjL%L|5AzfqO_v2yma^5biE_@QTC@A}Bvj-J0Fr;f6wH6M4{Ce| zq$GiZf<{$EQmhj_rLq8{2P-O=%c&80{f5EdUmuK(H!BW&kr^ZnT^(DPl&cuDRtKvp z?=2Ngq{kqlDS9<}LNGQI5KGtcVz|N`LLY!)59h{lj=T>sx?)*Z;c69sm(DiM0 zw*!OM_ST*`P2!bk5nKGHy1GFbpB1D9)uJnZUVc~%X`G-li|_r+r^EjlDRW_%NGxlb zhJ*Cj8%b&3QSY}N?iUn!`=lD~4(2^JUrJ@_Nghx=RtX%P(>7*|^kiItcpKjkmyiMm z8sXb_09#dJo@a(37!>>FY#A$0qv-}8%R9~9=Hr+M7f~EtKT*%2Jku76$n;Cf^fEc* ztTYm%IBgVMXGyx623}>dpGQhR9fZMQ0;1wb$(OBH3CMnUo9r{C6}x^j5RV-oLv!@? za1wIKeaZrcThN;M^VO+k0`@|xj251XH^o*;f?p{izji&lJ6lVst%(4{&8tzlKI zxV<@eiN304>c!o1szC<on ziJ^LQxJui$AvhFV^!xw<8OQz zS0VCL(_I%UxYqCcxU86UkIm_7fa_6}>!=QORzP`rOa&mQ5U;s6vq~%UTw71%@d*m^ z)!&;{t7=z5KWNk2L^;-#lLbE0!#O_sG3d6>NnudlU2632AaZf185u@z`oLrg*Z+*( z4^>%EiR*t=A*lpvC+P)gWw>08c5>&pTT>XDiD3kkK-ewDKW?JBjR4F;{Kdq;;zrfA Hd$IoquqCNB literal 0 HcmV?d00001 diff --git a/metricbeat/docs/modules/azure.asciidoc b/metricbeat/docs/modules/azure.asciidoc index 4db38120041..42d4d619c02 100644 --- a/metricbeat/docs/modules/azure.asciidoc +++ b/metricbeat/docs/modules/azure.asciidoc @@ -45,6 +45,10 @@ The Azure billing dashboards show relevant usage and forecast information: image::./images/metricbeat-azure-billing-overview.png[] +The Azure app_state dashboard shows relevant application insights information: + +image::./images/metricbeat-azure-app-state-overview.png[] + [float] === Module-specific configuration notes @@ -120,6 +124,10 @@ so the `period` for `billing` metricset should be `24h` or multiples of `24h`. === `app_insights` This metricset will collect application insights metrics, the `period` (interval) for the `app-insights` metricset is set by default at `300s`. +[float] +=== `app_state` +This metricset concentrate on the most relevant application insights metrics and provides a dashboard for visualization, the `period` (interval) for the `app_state` metricset is set by default at `300s`. + [float] [[azure-api-cost]] == Additional notes about metrics and costs @@ -242,6 +250,14 @@ metricbeat.modules: api_key: '' metrics: - id: ["requests/count", "requests/duration"] + +- module: azure + metricsets: + - app_state + enabled: true + period: 300s + application_id: '' + api_key: '' ---- [float] @@ -251,6 +267,8 @@ The following metricsets are available: * <> +* <> + * <> * <> @@ -271,6 +289,8 @@ The following metricsets are available: include::azure/app_insights.asciidoc[] +include::azure/app_state.asciidoc[] + include::azure/billing.asciidoc[] include::azure/compute_vm.asciidoc[] diff --git a/metricbeat/docs/modules/azure/app_state.asciidoc b/metricbeat/docs/modules/azure/app_state.asciidoc new file mode 100644 index 00000000000..10485dc818e --- /dev/null +++ b/metricbeat/docs/modules/azure/app_state.asciidoc @@ -0,0 +1,24 @@ +//// +This file is generated! See scripts/mage/docs_collector.go +//// + +[[metricbeat-metricset-azure-app_state]] +[role="xpack"] +=== Azure app_state metricset + +beta[] + +include::../../../../x-pack/metricbeat/module/azure/app_state/_meta/docs.asciidoc[] + + +==== Fields + +For a description of each field in the metricset, see the +<> section. + +Here is an example document generated by this metricset: + +[source,json] +---- +include::../../../../x-pack/metricbeat/module/azure/app_state/_meta/data.json[] +---- diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index 2232cf3b070..949657459db 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -33,7 +33,8 @@ This file is generated! See scripts/mage/docs_collector.go |<> beta[] |<> beta[] |<> |image:./images/icon-yes.png[Prebuilt dashboards are available] | -.10+| .10+| |<> beta[] +.11+| .11+| |<> beta[] +|<> beta[] |<> beta[] |<> |<> diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index ff9bffda33e..17c9234ea9f 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -343,6 +343,14 @@ metricbeat.modules: metrics: - id: ["requests/count", "requests/duration"] +- module: azure + metricsets: + - app_state + enabled: true + period: 300s + application_id: '' + api_key: '' + #--------------------------------- Beat Module --------------------------------- - module: beat metricsets: diff --git a/x-pack/metricbeat/module/azure/_meta/config.reference.yml b/x-pack/metricbeat/module/azure/_meta/config.reference.yml index 1f9ac04529e..b06e466a01f 100644 --- a/x-pack/metricbeat/module/azure/_meta/config.reference.yml +++ b/x-pack/metricbeat/module/azure/_meta/config.reference.yml @@ -102,3 +102,11 @@ api_key: '' metrics: - id: ["requests/count", "requests/duration"] + +- module: azure + metricsets: + - app_state + enabled: true + period: 300s + application_id: '' + api_key: '' diff --git a/x-pack/metricbeat/module/azure/_meta/config.yml b/x-pack/metricbeat/module/azure/_meta/config.yml index 0f497af6fb4..f7215d4f991 100644 --- a/x-pack/metricbeat/module/azure/_meta/config.yml +++ b/x-pack/metricbeat/module/azure/_meta/config.yml @@ -111,3 +111,11 @@ # api_key: '' # metrics: # - id: ["requests/count", "requests/duration"] + +#- module: azure +# metricsets: +# - app_state +# enabled: true +# period: 300s +# application_id: '' +# api_key: '' diff --git a/x-pack/metricbeat/module/azure/_meta/docs.asciidoc b/x-pack/metricbeat/module/azure/_meta/docs.asciidoc index b0f76ecb623..01f6389ab93 100644 --- a/x-pack/metricbeat/module/azure/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/azure/_meta/docs.asciidoc @@ -37,6 +37,10 @@ The Azure billing dashboards show relevant usage and forecast information: image::./images/metricbeat-azure-billing-overview.png[] +The Azure app_state dashboard shows relevant application insights information: + +image::./images/metricbeat-azure-app-state-overview.png[] + [float] === Module-specific configuration notes @@ -112,6 +116,10 @@ so the `period` for `billing` metricset should be `24h` or multiples of `24h`. === `app_insights` This metricset will collect application insights metrics, the `period` (interval) for the `app-insights` metricset is set by default at `300s`. +[float] +=== `app_state` +This metricset concentrate on the most relevant application insights metrics and provides a dashboard for visualization, the `period` (interval) for the `app_state` metricset is set by default at `300s`. + [float] [[azure-api-cost]] == Additional notes about metrics and costs diff --git a/x-pack/metricbeat/module/azure/_meta/fields.yml b/x-pack/metricbeat/module/azure/_meta/fields.yml index c6471dc108d..a6476fcc957 100644 --- a/x-pack/metricbeat/module/azure/_meta/fields.yml +++ b/x-pack/metricbeat/module/azure/_meta/fields.yml @@ -39,6 +39,10 @@ type: keyword description: > The subscription ID + - name: application_id + type: keyword + description: > + The application ID - name: dimensions.* type: object object_type: keyword diff --git a/x-pack/metricbeat/module/azure/_meta/kibana/7/dashboard/Metricbeat-azure-app-state-overview.json b/x-pack/metricbeat/module/azure/_meta/kibana/7/dashboard/Metricbeat-azure-app-state-overview.json new file mode 100644 index 00000000000..b447a6b276e --- /dev/null +++ b/x-pack/metricbeat/module/azure/_meta/kibana/7/dashboard/Metricbeat-azure-app-state-overview.json @@ -0,0 +1,1509 @@ +{ + "objects": [ + { + "attributes": { + "description": "Provides relevant app insights metrics for web applications", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "controlledBy": "1532342651170", + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "azure.app_state.application_id", + "negate": false, + "params": { + "query": "42cb59a9-d5be-400b-a5c4-69b0a0026ac6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "azure.app_state.application_id": "42cb59a9-d5be-400b-a5c4-69b0a0026ac6" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 15, + "i": "307a1ecd-284c-4f35-9a3c-d5b77c9a9c82", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "307a1ecd-284c-4f35-9a3c-d5b77c9a9c82", + "panelRefName": "panel_0", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Exceptions" + }, + "gridData": { + "h": 15, + "i": "654e745f-360d-4898-89b6-57f788c5f540", + "w": 20, + "x": 7, + "y": 0 + }, + "panelIndex": "654e745f-360d-4898-89b6-57f788c5f540", + "panelRefName": "panel_1", + "title": "Exceptions", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Available Memory" + }, + "gridData": { + "h": 15, + "i": "5adca737-559d-4b4f-9fa7-58841daa99c5", + "w": 21, + "x": 27, + "y": 0 + }, + "panelIndex": "5adca737-559d-4b4f-9fa7-58841daa99c5", + "panelRefName": "panel_2", + "title": "Available Memory", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 15, + "i": "531cf244-45e0-43c3-9920-8f32397bd973", + "w": 8, + "x": 0, + "y": 15 + }, + "panelIndex": "531cf244-45e0-43c3-9920-8f32397bd973", + "panelRefName": "panel_3", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 15, + "i": "b9242495-babc-48a7-9ad7-56c62b1dc117", + "w": 8, + "x": 8, + "y": 15 + }, + "panelIndex": "b9242495-babc-48a7-9ad7-56c62b1dc117", + "panelRefName": "panel_4", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 15, + "i": "d311025a-f5c5-4e48-9f1c-710f59264c43", + "w": 8, + "x": 16, + "y": 15 + }, + "panelIndex": "d311025a-f5c5-4e48-9f1c-710f59264c43", + "panelRefName": "panel_5", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Requests" + }, + "gridData": { + "h": 15, + "i": "48974418-b1f7-4050-921e-a83771e125ae", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "48974418-b1f7-4050-921e-a83771e125ae", + "panelRefName": "panel_6", + "title": "Requests", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Browser Send/Receive Duration" + }, + "gridData": { + "h": 15, + "i": "39d20db1-316a-4ff3-811a-5571cb4497c3", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "39d20db1-316a-4ff3-811a-5571cb4497c3", + "panelRefName": "panel_7", + "title": "Browser Send/Receive Duration", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Browser Networking/Processing Duration" + }, + "gridData": { + "h": 15, + "i": "bc810208-0395-4c70-9057-d7307e064e43", + "w": 24, + "x": 24, + "y": 30 + }, + "panelIndex": "bc810208-0395-4c70-9057-d7307e064e43", + "panelRefName": "panel_8", + "title": "Browser Networking/Processing Duration", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Process CPU Usage" + }, + "gridData": { + "h": 15, + "i": "ecf6fbfa-ba65-481e-af85-07fd9d5feb5f", + "w": 24, + "x": 0, + "y": 45 + }, + "panelIndex": "ecf6fbfa-ba65-481e-af85-07fd9d5feb5f", + "panelRefName": "panel_9", + "title": "Process CPU Usage", + "version": "7.9.2" + }, + { + "embeddableConfig": { + "title": "Process Private Bytes" + }, + "gridData": { + "h": 15, + "i": "40a1b80b-cd62-446d-91aa-a971bb3769e7", + "w": 24, + "x": 24, + "y": 45 + }, + "panelIndex": "40a1b80b-cd62-446d-91aa-a971bb3769e7", + "panelRefName": "panel_10", + "title": "Process Private Bytes", + "version": "7.9.2" + } + ], + "timeRestore": false, + "title": "[Metricbeat Azure] App State Overview", + "version": 1 + }, + "id": "d5fbd610-03d9-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "2e5183a0-03da-11eb-8034-63f2039e9d3f", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "1064f9a0-04a5-11eb-8034-63f2039e9d3f", + "name": "panel_1", + "type": "lens" + }, + { + "id": "76cc1d70-04a7-11eb-8034-63f2039e9d3f", + "name": "panel_2", + "type": "lens" + }, + { + "id": "a89c8fd0-03ec-11eb-8034-63f2039e9d3f", + "name": "panel_3", + "type": "lens" + }, + { + "id": "cb5ec410-03ed-11eb-8034-63f2039e9d3f", + "name": "panel_4", + "type": "lens" + }, + { + "id": "0df175c0-03ee-11eb-8034-63f2039e9d3f", + "name": "panel_5", + "type": "lens" + }, + { + "id": "f0678020-04a2-11eb-8034-63f2039e9d3f", + "name": "panel_6", + "type": "lens" + }, + { + "id": "e2704140-04a3-11eb-8034-63f2039e9d3f", + "name": "panel_7", + "type": "lens" + }, + { + "id": "0e74dee0-04a4-11eb-8034-63f2039e9d3f", + "name": "panel_8", + "type": "lens" + }, + { + "id": "cfa361a0-04a8-11eb-8034-63f2039e9d3f", + "name": "panel_9", + "type": "lens" + }, + { + "id": "2b54b2c0-04a8-11eb-8034-63f2039e9d3f", + "name": "panel_10", + "type": "lens" + } + ], + "type": "dashboard", + "updated_at": "2020-10-02T12:22:06.090Z", + "version": "WzMzMDEsMl0=" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "controlledBy": "1532342651170", + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "azure.application_id", + "negate": false, + "params": { + "query": "42cb59a9-d5be-400b-a5c4-69b0a0026ac6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "azure.application_id": "42cb59a9-d5be-400b-a5c4-69b0a0026ac6" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "App State Filters [Metricbeat Azure]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "controls": [ + { + "fieldName": "azure.application_id", + "id": "1532342651170", + "indexPatternRefName": "control_0_index_pattern", + "label": "Application ID", + "options": { + "multiselect": true, + "order": "desc", + "size": 10, + "type": "terms" + }, + "parent": "", + "type": "list" + }, + { + "fieldName": "azure.dimensions.request_url_host", + "id": "1601559750853", + "indexPatternRefName": "control_1_index_pattern", + "label": "Host URL", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "1532342651170", + "type": "list" + }, + { + "fieldName": "azure.dimensions.cloud_role_name", + "id": "1601640368472", + "indexPatternRefName": "control_2_index_pattern", + "label": "Name", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "1532342651170", + "type": "list" + }, + { + "fieldName": "azure.dimensions.browser_timing_url_host", + "id": "1601640439434", + "indexPatternRefName": "control_3_index_pattern", + "label": "Browser URL Host", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "1532342651170", + "type": "list" + } + ], + "pinFilters": false, + "updateFiltersOnChange": true, + "useTimeFilter": false + }, + "title": "App State Filters [Metricbeat Azure]", + "type": "input_control_vis" + } + }, + "id": "2e5183a0-03da-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_0_index_pattern", + "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_1_index_pattern", + "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_2_index_pattern", + "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_3_index_pattern", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-02T12:22:51.232Z", + "version": "WzMzMTIsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"5788331a-267d-426a-a68e-94a5310af644\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.exception_type\\\",\\\"orderBy\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.exceptions_count.sum\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"e5c93c50-bb0a-4609-a7ce-7003f2f9a20e\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.exceptions_server.sum\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"9e183a5e-3dba-4929-b07e-2a3321f7926b\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.exceptions_browser.sum\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-4-5788331a-267d-426a-a68e-94a5310af644\\\":{\\\"label\\\":\\\"Type\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.exception_type\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"5788331a-267d-426a-a68e-94a5310af644\\\"},\\\"col-5-b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":{\\\"label\\\":\\\"Total\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.exceptions_count.sum\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"col-6-e5c93c50-bb0a-4609-a7ce-7003f2f9a20e\\\":{\\\"label\\\":\\\"Server \\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.exceptions_server.sum\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"e5c93c50-bb0a-4609-a7ce-7003f2f9a20e\\\"},\\\"col-7-9e183a5e-3dba-4929-b07e-2a3321f7926b\\\":{\\\"label\\\":\\\"Browser\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.exceptions_browser.sum\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"9e183a5e-3dba-4929-b07e-2a3321f7926b\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Total\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"5788331a-267d-426a-a68e-94a5310af644\" seriesType=\"area_stacked\" accessors=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" accessors=\"e5c93c50-bb0a-4609-a7ce-7003f2f9a20e\" accessors=\"9e183a5e-3dba-4929-b07e-2a3321f7926b\" columnToLabel=\"{\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":\\\"Total\\\",\\\"e5c93c50-bb0a-4609-a7ce-7003f2f9a20e\\\":\\\"Server \\\",\\\"9e183a5e-3dba-4929-b07e-2a3321f7926b\\\":\\\"Browser\\\",\\\"5788331a-267d-426a-a68e-94a5310af644\\\":\\\"Type\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "5788331a-267d-426a-a68e-94a5310af644", + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "e5c93c50-bb0a-4609-a7ce-7003f2f9a20e", + "9e183a5e-3dba-4929-b07e-2a3321f7926b" + ], + "columns": { + "5788331a-267d-426a-a68e-94a5310af644": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Type", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.exception_type" + }, + "9e183a5e-3dba-4929-b07e-2a3321f7926b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Browser", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.exceptions_browser.sum" + }, + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.exceptions_count.sum" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + }, + "e5c93c50-bb0a-4609-a7ce-7003f2f9a20e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Server ", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.exceptions_server.sum" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "e5c93c50-bb0a-4609-a7ce-7003f2f9a20e", + "9e183a5e-3dba-4929-b07e-2a3321f7926b" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "5788331a-267d-426a-a68e-94a5310af644", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked" + } + }, + "title": "App state Exceptions [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "1064f9a0-04a5-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T11:53:16.483Z", + "version": "WzI5NjMsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"orderBy\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.performance_counters_memory_available_bytes.avg\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-2-a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":{\\\"label\\\":\\\"Instance\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\"},\\\"col-3-b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":{\\\"label\\\":\\\"Available memory\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.performance_counters_memory_available_bytes.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"bytes\\\",\\\"params\\\":{\\\"decimals\\\":2}}},\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"}}\" | lens_format_column format=\"bytes\" columnId=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" decimals=2}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Available memory\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\" seriesType=\"area\" accessors=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" columnToLabel=\"{\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":\\\"Available memory\\\",\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":\\\"Instance\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba" + ], + "columns": { + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Instance", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.cloud_role_instance" + }, + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Available memory", + "operationType": "avg", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "azure.app_state.performance_counters_memory_available_bytes.avg" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area" + } + }, + "title": "App state Memory [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "76cc1d70-04a7-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T12:04:46.406Z", + "version": "WzMwNTcsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"82e648a8-6d9a-4ae0-9449-b802ce1ac723\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true aggConfigs=\"[{\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.users_count.unique\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\":{\\\"label\\\":\\\"Unique users\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.users_count.unique\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\"}}\"}\n| lens_metric_chart title=\"Unique users\" accessor=\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\" mode=\"full\"", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "82e648a8-6d9a-4ae0-9449-b802ce1ac723": { + "columnOrder": [ + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1" + ], + "columns": { + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique users", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.users_count.unique" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1", + "layerId": "82e648a8-6d9a-4ae0-9449-b802ce1ac723" + } + }, + "title": "App state Unique users [Metricbeat Azure]", + "visualizationType": "lnsMetric" + }, + "id": "a89c8fd0-03ec-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-01T13:47:34.093Z", + "version": "WzEzMzAsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"82e648a8-6d9a-4ae0-9449-b802ce1ac723\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true aggConfigs=\"[{\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.users_authenticated.unique\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\":{\\\"label\\\":\\\"Unique authenticated users\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.users_authenticated.unique\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\"}}\"}\n| lens_metric_chart title=\"Unique authenticated users\" accessor=\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\" mode=\"full\"", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "82e648a8-6d9a-4ae0-9449-b802ce1ac723": { + "columnOrder": [ + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1" + ], + "columns": { + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique authenticated users", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.users_authenticated.unique" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1", + "layerId": "82e648a8-6d9a-4ae0-9449-b802ce1ac723" + } + }, + "title": "App state Unique authenticated users [Metricbeat Azure]", + "visualizationType": "lnsMetric" + }, + "id": "cb5ec410-03ed-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-01T13:55:41.904Z", + "version": "WzE0MjAsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"82e648a8-6d9a-4ae0-9449-b802ce1ac723\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true aggConfigs=\"[{\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.sessions_count.unique\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\":{\\\"label\\\":\\\"Unique sessions\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.sessions_count.unique\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\\\"}}\"}\n| lens_metric_chart title=\"Unique sessions\" accessor=\"d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1\" mode=\"full\"", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "82e648a8-6d9a-4ae0-9449-b802ce1ac723": { + "columnOrder": [ + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1" + ], + "columns": { + "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique sessions", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.sessions_count.unique" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "d62f1bf0-71b4-41ba-9d9c-dc9f4e478ac1", + "layerId": "82e648a8-6d9a-4ae0-9449-b802ce1ac723" + } + }, + "title": "App state Unique sessions [Metricbeat Azure]", + "visualizationType": "lnsMetric" + }, + "id": "0df175c0-03ee-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-01T13:57:33.596Z", + "version": "WzE0NjAsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"8864c98b-413a-484f-a61d-336a63ef3f13\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.request_url_host\\\",\\\"orderBy\\\":\\\"9ec4d260-e302-46c4-ac09-50ef54627894\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"9ec4d260-e302-46c4-ac09-50ef54627894\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.requests_count.sum\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"a47e59dc-fb62-42f8-90e1-236c7c5a073d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.requests_failed.sum\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-3-8864c98b-413a-484f-a61d-336a63ef3f13\\\":{\\\"label\\\":\\\"Host URL\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.request_url_host\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"9ec4d260-e302-46c4-ac09-50ef54627894\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"8864c98b-413a-484f-a61d-336a63ef3f13\\\"},\\\"col-4-9ec4d260-e302-46c4-ac09-50ef54627894\\\":{\\\"label\\\":\\\"Total requests\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.requests_count.sum\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"9ec4d260-e302-46c4-ac09-50ef54627894\\\"},\\\"col-5-a47e59dc-fb62-42f8-90e1-236c7c5a073d\\\":{\\\"label\\\":\\\"Failed requests\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.requests_failed.sum\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"a47e59dc-fb62-42f8-90e1-236c7c5a073d\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Total requests\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"8864c98b-413a-484f-a61d-336a63ef3f13\" seriesType=\"area\" accessors=\"9ec4d260-e302-46c4-ac09-50ef54627894\" accessors=\"a47e59dc-fb62-42f8-90e1-236c7c5a073d\" columnToLabel=\"{\\\"9ec4d260-e302-46c4-ac09-50ef54627894\\\":\\\"Total requests\\\",\\\"a47e59dc-fb62-42f8-90e1-236c7c5a073d\\\":\\\"Failed requests\\\",\\\"8864c98b-413a-484f-a61d-336a63ef3f13\\\":\\\"Host URL\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "8864c98b-413a-484f-a61d-336a63ef3f13", + "9ec4d260-e302-46c4-ac09-50ef54627894", + "a47e59dc-fb62-42f8-90e1-236c7c5a073d" + ], + "columns": { + "8864c98b-413a-484f-a61d-336a63ef3f13": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host URL", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "9ec4d260-e302-46c4-ac09-50ef54627894", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.request_url_host" + }, + "9ec4d260-e302-46c4-ac09-50ef54627894": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total requests", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.requests_count.sum" + }, + "a47e59dc-fb62-42f8-90e1-236c7c5a073d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Failed requests", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.requests_failed.sum" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "9ec4d260-e302-46c4-ac09-50ef54627894", + "a47e59dc-fb62-42f8-90e1-236c7c5a073d" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "8864c98b-413a-484f-a61d-336a63ef3f13", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area" + } + }, + "title": "App state Requests [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "f0678020-04a2-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T11:32:22.946Z", + "version": "WzI0MzUsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.browser_timing_url_path\\\",\\\"orderBy\\\":\\\"be6a3d8b-9428-480b-a7b3-071127726093\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"be6a3d8b-9428-480b-a7b3-071127726093\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.browser_timings_send_duration.avg\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"6bc1fd35-168d-42d5-b9c8-7078896d8ce4\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.browser_timings_total_duration.avg\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"988e9976-3471-478c-89f6-11fd46458d7f\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.browser_timings_receive_duration.avg\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-4-4d4c068a-0194-4d54-a1fa-3863c3df9331\\\":{\\\"label\\\":\\\"Url Path\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.browser_timing_url_path\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"be6a3d8b-9428-480b-a7b3-071127726093\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\"},\\\"col-5-be6a3d8b-9428-480b-a7b3-071127726093\\\":{\\\"label\\\":\\\"Send duration\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.browser_timings_send_duration.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"params\\\":{},\\\"customLabel\\\":true,\\\"id\\\":\\\"be6a3d8b-9428-480b-a7b3-071127726093\\\"},\\\"col-6-6bc1fd35-168d-42d5-b9c8-7078896d8ce4\\\":{\\\"label\\\":\\\"Total duration\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.browser_timings_total_duration.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"6bc1fd35-168d-42d5-b9c8-7078896d8ce4\\\"},\\\"col-7-988e9976-3471-478c-89f6-11fd46458d7f\\\":{\\\"label\\\":\\\"Receive duration\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.browser_timings_receive_duration.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"988e9976-3471-478c-89f6-11fd46458d7f\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Send duration\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"4d4c068a-0194-4d54-a1fa-3863c3df9331\" seriesType=\"bar\" accessors=\"be6a3d8b-9428-480b-a7b3-071127726093\" accessors=\"6bc1fd35-168d-42d5-b9c8-7078896d8ce4\" accessors=\"988e9976-3471-478c-89f6-11fd46458d7f\" columnToLabel=\"{\\\"be6a3d8b-9428-480b-a7b3-071127726093\\\":\\\"Send duration\\\",\\\"6bc1fd35-168d-42d5-b9c8-7078896d8ce4\\\":\\\"Total duration\\\",\\\"988e9976-3471-478c-89f6-11fd46458d7f\\\":\\\"Receive duration\\\",\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\":\\\"Url Path\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "4d4c068a-0194-4d54-a1fa-3863c3df9331", + "be6a3d8b-9428-480b-a7b3-071127726093", + "6bc1fd35-168d-42d5-b9c8-7078896d8ce4", + "988e9976-3471-478c-89f6-11fd46458d7f" + ], + "columns": { + "4d4c068a-0194-4d54-a1fa-3863c3df9331": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Url Path", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "be6a3d8b-9428-480b-a7b3-071127726093", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.browser_timing_url_path" + }, + "6bc1fd35-168d-42d5-b9c8-7078896d8ce4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total duration", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.browser_timings_total_duration.avg" + }, + "988e9976-3471-478c-89f6-11fd46458d7f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Receive duration", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.browser_timings_receive_duration.avg" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + }, + "be6a3d8b-9428-480b-a7b3-071127726093": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Send duration", + "operationType": "avg", + "params": {}, + "scale": "ratio", + "sourceField": "azure.app_state.browser_timings_send_duration.avg" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "be6a3d8b-9428-480b-a7b3-071127726093", + "6bc1fd35-168d-42d5-b9c8-7078896d8ce4", + "988e9976-3471-478c-89f6-11fd46458d7f" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "4d4c068a-0194-4d54-a1fa-3863c3df9331", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar" + } + }, + "title": "App state Browser Send/Receive Duration [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "e2704140-04a3-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T11:39:09.012Z", + "version": "WzI2MzQsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.browser_timing_url_path\\\",\\\"orderBy\\\":\\\"_key\\\",\\\"order\\\":\\\"asc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"b5a75764-e98b-434b-a0f0-5658a4aa1cf6\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.browser_timings_network_duration.avg\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"ab158cba-532f-47f8-8450-db883504dc0f\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.browser_timings_processing_duration.avg\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-3-4d4c068a-0194-4d54-a1fa-3863c3df9331\\\":{\\\"label\\\":\\\"Url Path\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.browser_timing_url_path\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"alphabetical\\\"},\\\"orderDirection\\\":\\\"asc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\"},\\\"col-4-b5a75764-e98b-434b-a0f0-5658a4aa1cf6\\\":{\\\"label\\\":\\\"Networking duration\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.browser_timings_network_duration.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"b5a75764-e98b-434b-a0f0-5658a4aa1cf6\\\"},\\\"col-5-ab158cba-532f-47f8-8450-db883504dc0f\\\":{\\\"label\\\":\\\"Processing duration\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.browser_timings_processing_duration.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"ab158cba-532f-47f8-8450-db883504dc0f\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Networking duration\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"4d4c068a-0194-4d54-a1fa-3863c3df9331\" seriesType=\"bar\" accessors=\"b5a75764-e98b-434b-a0f0-5658a4aa1cf6\" accessors=\"ab158cba-532f-47f8-8450-db883504dc0f\" columnToLabel=\"{\\\"b5a75764-e98b-434b-a0f0-5658a4aa1cf6\\\":\\\"Networking duration\\\",\\\"ab158cba-532f-47f8-8450-db883504dc0f\\\":\\\"Processing duration\\\",\\\"4d4c068a-0194-4d54-a1fa-3863c3df9331\\\":\\\"Url Path\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "4d4c068a-0194-4d54-a1fa-3863c3df9331", + "b5a75764-e98b-434b-a0f0-5658a4aa1cf6", + "ab158cba-532f-47f8-8450-db883504dc0f" + ], + "columns": { + "4d4c068a-0194-4d54-a1fa-3863c3df9331": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Url Path", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.browser_timing_url_path" + }, + "ab158cba-532f-47f8-8450-db883504dc0f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Processing duration", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.browser_timings_processing_duration.avg" + }, + "b5a75764-e98b-434b-a0f0-5658a4aa1cf6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Networking duration", + "operationType": "avg", + "scale": "ratio", + "sourceField": "azure.app_state.browser_timings_network_duration.avg" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "b5a75764-e98b-434b-a0f0-5658a4aa1cf6", + "ab158cba-532f-47f8-8450-db883504dc0f" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "4d4c068a-0194-4d54-a1fa-3863c3df9331", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar" + } + }, + "title": "App state Browser Networking/Processing Duration [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "0e74dee0-04a4-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T11:40:22.862Z", + "version": "WzI2ODQsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"orderBy\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.performance_counters_process_cpu_percentage_total.avg\\\",\\\"missing\\\":0}},{\\\"id\\\":\\\"252dfd5f-26bd-4861-bb01-4b3530cadd95\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.performance_counters_process_cpu_percentage.avg\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-3-a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":{\\\"label\\\":\\\"Instance\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\"},\\\"col-4-b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":{\\\"label\\\":\\\"Total CPU percentage \\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.performance_counters_process_cpu_percentage_total.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"percent\\\",\\\"params\\\":{\\\"decimals\\\":2}}},\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"col-5-252dfd5f-26bd-4861-bb01-4b3530cadd95\\\":{\\\"label\\\":\\\"CPU percentage\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.performance_counters_process_cpu_percentage.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"percent\\\",\\\"params\\\":{\\\"decimals\\\":2}}},\\\"customLabel\\\":true,\\\"id\\\":\\\"252dfd5f-26bd-4861-bb01-4b3530cadd95\\\"}}\" | lens_format_column format=\"percent\" columnId=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" decimals=2 | lens_format_column format=\"percent\" columnId=\"252dfd5f-26bd-4861-bb01-4b3530cadd95\" decimals=2}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Total CPU percentage \" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\" seriesType=\"area\" accessors=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" accessors=\"252dfd5f-26bd-4861-bb01-4b3530cadd95\" columnToLabel=\"{\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":\\\"Total CPU percentage \\\",\\\"252dfd5f-26bd-4861-bb01-4b3530cadd95\\\":\\\"CPU percentage\\\",\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":\\\"Instance\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "252dfd5f-26bd-4861-bb01-4b3530cadd95" + ], + "columns": { + "252dfd5f-26bd-4861-bb01-4b3530cadd95": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU percentage", + "operationType": "avg", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "azure.app_state.performance_counters_process_cpu_percentage.avg" + }, + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Instance", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.cloud_role_instance" + }, + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total CPU percentage ", + "operationType": "avg", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "azure.app_state.performance_counters_process_cpu_percentage_total.avg" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "252dfd5f-26bd-4861-bb01-4b3530cadd95" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area" + } + }, + "title": "App state Process CPU usage [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "cfa361a0-04a8-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T12:14:24.954Z", + "version": "WzMyNTMsMl0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"85644d0a-8011-45af-a751-7961b8bdd071\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"orderBy\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"azure.app_state.performance_counters_process_private_bytes.avg\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bcbccc16-d042-40fa-a9b2-0f09268281ff\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"bcbccc16-d042-40fa-a9b2-0f09268281ff\\\"},\\\"col-2-a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":{\\\"label\\\":\\\"Instance\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"azure.dimensions.cloud_role_instance\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"customLabel\\\":true,\\\"id\\\":\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\"},\\\"col-3-b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":{\\\"label\\\":\\\"Process private bytes\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"azure.app_state.performance_counters_process_private_bytes.avg\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"bytes\\\",\\\"params\\\":{\\\"decimals\\\":2}}},\\\"id\\\":\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\"}}\" | lens_format_column format=\"bytes\" columnId=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" decimals=2}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Process private bytes\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"85644d0a-8011-45af-a751-7961b8bdd071\" hide=false xAccessor=\"bcbccc16-d042-40fa-a9b2-0f09268281ff\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\" seriesType=\"area\" accessors=\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\" columnToLabel=\"{\\\"b0d8f2d4-91f3-469c-8bcb-962a9fb48fba\\\":\\\"Process private bytes\\\",\\\"a1f669d0-c9f2-4bc5-9bdd-e40badd261b9\\\":\\\"Instance\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ + { + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "85644d0a-8011-45af-a751-7961b8bdd071": { + "columnOrder": [ + "bcbccc16-d042-40fa-a9b2-0f09268281ff", + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba" + ], + "columns": { + "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Instance", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.cloud_role_instance" + }, + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Process private bytes", + "operationType": "avg", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "azure.app_state.performance_counters_process_private_bytes.avg" + }, + "bcbccc16-d042-40fa-a9b2-0f09268281ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp", + "suggestedPriority": 1 + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "b0d8f2d4-91f3-469c-8bcb-962a9fb48fba" + ], + "layerId": "85644d0a-8011-45af-a751-7961b8bdd071", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "a1f669d0-c9f2-4bc5-9bdd-e40badd261b9", + "xAccessor": "bcbccc16-d042-40fa-a9b2-0f09268281ff" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area" + } + }, + "title": "App state Process Private Bytes [Metricbeat Azure]", + "visualizationType": "lnsXY" + }, + "id": "2b54b2c0-04a8-11eb-8034-63f2039e9d3f", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-10-02T12:09:49.291Z", + "version": "WzMxMjMsMl0=" + } + ], + "version": "7.9.2" +} diff --git a/x-pack/metricbeat/module/azure/app_insights/_meta/data.json b/x-pack/metricbeat/module/azure/app_insights/_meta/data.json index 3d1f07c1ac1..c9b35f39923 100644 --- a/x-pack/metricbeat/module/azure/app_insights/_meta/data.json +++ b/x-pack/metricbeat/module/azure/app_insights/_meta/data.json @@ -1,16 +1,15 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "azure" : { - "app_insights" : { - "metrics" : { - "requests_failed" : { - "sum" : 182 - }, - "request_name" : "GET /favicon.ico" - }, - "start_date" : "2020-07-12T10:52:11.831Z", - "end_date" : "2020-07-12T12:52:11.831Z", - "application_id" : "42cb59a9-d5be-400b-a5c4-69b0a0026ac6" + "azure": { + "app_insights": { + "end_date": "2020-10-02T13:17:45.691Z", + "start_date": "2020-10-02T13:12:45.691Z" + }, + "application_id": "42cb59a9-d5be-400b-a5c4-69b0a00434fdf4", + "metrics": { + "requests_count": { + "sum": 0 + } } }, "cloud": { diff --git a/x-pack/metricbeat/module/azure/app_insights/_meta/fields.yml b/x-pack/metricbeat/module/azure/app_insights/_meta/fields.yml index 40ab8560827..4e8fa91edbd 100644 --- a/x-pack/metricbeat/module/azure/app_insights/_meta/fields.yml +++ b/x-pack/metricbeat/module/azure/app_insights/_meta/fields.yml @@ -4,10 +4,6 @@ description: > application insights fields: - - name: application_id - type: keyword - description: > - The application ID - name: start_date type: date description: > diff --git a/x-pack/metricbeat/module/azure/app_insights/app_insights.go b/x-pack/metricbeat/module/azure/app_insights/app_insights.go index 8ffe02eb860..091a72f465e 100644 --- a/x-pack/metricbeat/module/azure/app_insights/app_insights.go +++ b/x-pack/metricbeat/module/azure/app_insights/app_insights.go @@ -23,6 +23,7 @@ type Config struct { ApiKey string `config:"api_key" validate:"required"` Period time.Duration `config:"period" validate:"nonzero,required"` Metrics []Metric `config:"metrics" validate:"required"` + Namespace string `config:"namespace"` } // Metric struct used for configuration options @@ -70,7 +71,7 @@ func (m *MetricSet) Fetch(report mb.ReporterV2) error { if err != nil { return errors.Wrap(err, "error retrieving metric values") } - events := EventsMapping(results, m.client.Config.ApplicationId) + events := EventsMapping(results, m.client.Config.ApplicationId, m.client.Config.Namespace) for _, event := range events { isOpen := report.Event(event) if !isOpen { diff --git a/x-pack/metricbeat/module/azure/app_insights/app_insights_integration_test.go b/x-pack/metricbeat/module/azure/app_insights/app_insights_integration_test.go index 3cb93663007..c33f05c2de6 100644 --- a/x-pack/metricbeat/module/azure/app_insights/app_insights_integration_test.go +++ b/x-pack/metricbeat/module/azure/app_insights/app_insights_integration_test.go @@ -10,12 +10,20 @@ package app_insights import ( "testing" + "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/test" + "github.com/stretchr/testify/assert" mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" ) +var metrics = []map[string]interface{}{{ + "id": "requests/count", +}} + func TestFetchMetricset(t *testing.T) { + config := test.GetConfigForInsights(t, "app_insights") + config["metrics"] = metrics metricSet := mbtest.NewReportingMetricSetV2Error(t, config) events, errs := mbtest.ReportingFetchV2Error(metricSet) if len(errs) > 0 { @@ -26,6 +34,8 @@ func TestFetchMetricset(t *testing.T) { } func TestData(t *testing.T) { + config := test.GetConfigForInsights(t, "app_insights") + config["metrics"] = metrics metricSet := mbtest.NewFetcher(t, config) metricSet.WriteEvents(t, "/") } diff --git a/x-pack/metricbeat/module/azure/app_insights/client.go b/x-pack/metricbeat/module/azure/app_insights/client.go index b78f2257d3f..49794da4d3f 100644 --- a/x-pack/metricbeat/module/azure/app_insights/client.go +++ b/x-pack/metricbeat/module/azure/app_insights/client.go @@ -23,9 +23,6 @@ type Client struct { Log *logp.Logger } -type MetricValue struct { -} - // NewClient instantiates the an Azure monitoring client func NewClient(config Config) (*Client, error) { service, err := NewService(config) diff --git a/x-pack/metricbeat/module/azure/app_insights/data.go b/x-pack/metricbeat/module/azure/app_insights/data.go index df7efdbeaba..1cd661cc3a0 100644 --- a/x-pack/metricbeat/module/azure/app_insights/data.go +++ b/x-pack/metricbeat/module/azure/app_insights/data.go @@ -6,98 +6,217 @@ package app_insights import ( "fmt" + "regexp" "strings" + "github.com/Azure/azure-sdk-for-go/services/preview/appinsights/v1/insights" "github.com/Azure/go-autorest/autorest/date" - "github.com/Azure/azure-sdk-for-go/services/preview/appinsights/v1/insights" + "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/metricbeat/mb" ) -func EventsMapping(metricValues insights.ListMetricsResultsItem, applicationId string) []mb.Event { - var events []mb.Event - if metricValues.Value == nil { - return events - } - groupedAddProp := make(map[string][]insights.MetricsResultInfo) +const aggsRegex = "_(?:sum|count|unique|avg|min|max)$" + +// segmentNames list is used to filter out the dimension from the api response. Based on the body format it is not possible to detect what was the segment selected +var segmentNames = []string{ + "request_source", "request_name", "request_url_host", "request_url_path", "request_success", "request_result_code", "request_performance_bucket", "operation_name", "operation_synthetic", "operation_synthetic_source", "user_authenticated", "application_version", "client_type", "client_model", + "client_os", "client_city", "client_state_or_province", "client_country_or_region", "client_browser", "cloud_role_name", "cloud_role_instance", "custom_dimensions__ms_processedb_by_metric_extractors", "custom_dimensions_developer_mode", + "page_view_name", "page_view_url_path", "page_view_url_host", "page_view_performance_bucket", "custom_dimensions_ibiza_session_id", "custom_dimensions_part_instance", "browser_timing_name", "browser_timing_url_host", "browser_timing_url_path", "browser_timing_performance_bucket", + "trace_severity_level", "type", "custom_dimensions_agent_session", "custom_dimensions_agent_version", "custom_dimensions_machine_name", "custom_dimensions_running_mode", "custom_dimensions_source", "custom_dimensions_agent_assembly_version", "custom_dimensions_agent_process_session", + "custom_dimensions_hashed_machine_name", + "custom_dimensions_data_cube", "dependency_target", "dependency_type", "dependency_name", "dependency_success", "dependency_result_code", "dependency_performance_bucket", "custom_dimensions_container", "custom_dimensions_blob", "custom_dimensions_error_message", + "custom_event_name", "custom_dimensions_event_name", "custom_dimensions_page_title", "custom_dimensions_service_profiler_content", "custom_dimensions_executing_assembly_file_version", "custom_dimensions_service_profiler_version", "custom_dimensions_process_id", "custom_dimensions_request_id", + "custom_dimensions_running_session", "custom_dimensions_problem_id", "custom_dimensions_snapshot_context", "custom_dimensions_snapshot_version", "custom_dimensions_duration", "custom_dimensions_snapshot_id", "custom_dimensions_stamp_id", "custom_dimensions_de_optimization_id", + "custom_dimensions_method", "custom_dimensions_parent_process_id", "custom_dimensions_section", "custom_dimensions_configuration", "custom_dimensions_dump_folder", "custom_dimensions_reason", "custom_dimensions_extension_version", "custom_dimensions_site_name", + "availability_result_name", "availability_result_location", "availability_result_success", "custom_dimensions_full_test_result_available", "exception_problem_id", "exception_handled_at", "exception_type", "exception_assembly", "exception_method", "custom_dimensions_custom_perf_counter", + "exception_severity_level", "custom_dimensions_url", "custom_dimensions_ai.snapshot_stampid", "custom_dimensions_ai.snapshot_id", "custom_dimensions_ai.snapshot_version", "custom_dimensions_ai.snapshot_planid", "custom_dimensions__ms_example", "custom_dimensions_sa_origin_app_id", + "custom_dimensions_base_sdk_target_framework", "custom_dimensions_runtime_framework", "custom_dimensions__ms_aggregation_interval_ms", "custom_dimensions_problem_id", "custom_dimensions_operation_name", "custom_dimensions_request_success", "custom_dimensions__ms_metric_id", + "custom_dimensions_dependency_success", "custom_dimensions__ms_is_autocollected", "custom_dimensions_dependency_type", "performance_counter_name", "performance_counter_category", "performance_counter_counter", "performance_counter_instance", "custom_dimensions_counter_instance_name", +} + +type MetricValue struct { + SegmentName map[string]string + Value map[string]interface{} + Segments []MetricValue + Interval string + Start *date.Time + End *date.Time +} + +func mapMetricValues(metricValues insights.ListMetricsResultsItem) []MetricValue { + var mapped []MetricValue for _, item := range *metricValues.Value { + metricValue := MetricValue{ + Start: item.Body.Value.Start, + End: item.Body.Value.End, + Value: map[string]interface{}{}, + SegmentName: map[string]string{}, + } + metricValue.Interval = fmt.Sprintf("%sTO%s", item.Body.Value.Start, item.Body.Value.End) if item.Body != nil && item.Body.Value != nil { if item.Body.Value.AdditionalProperties != nil { - groupedAddProp[fmt.Sprintf("%sTO%s", item.Body.Value.Start, item.Body.Value.End)] = - append(groupedAddProp[fmt.Sprintf("%sTO%s", item.Body.Value.Start, item.Body.Value.End)], *item.Body.Value) - } else if item.Body.Value.Segments != nil { - for _, segment := range *item.Body.Value.Segments { - event, ok := createSegmentEvent(*item.Body.Value.Start, *item.Body.Value.End, segment, applicationId) - if ok { - events = append(events, event) + metrics := getAdditionalPropMetric(item.Body.Value.AdditionalProperties) + for key, metric := range metrics { + if isSegment(key) { + metricValue.SegmentName[key] = metric.(string) + } else { + metricValue.Value[key] = metric } } } + if item.Body.Value.Segments != nil { + for _, segment := range *item.Body.Value.Segments { + metVal := mapSegment(segment, metricValue.SegmentName) + metricValue.Segments = append(metricValue.Segments, metVal) + } + } + mapped = append(mapped, metricValue) } + } - if len(groupedAddProp) > 0 { - for _, val := range groupedAddProp { - event, ok := createEvent(val, applicationId) - if ok { - events = append(events, event) + return mapped +} + +func mapSegment(segment insights.MetricsSegmentInfo, parentSeg map[string]string) MetricValue { + metricValue := MetricValue{Value: map[string]interface{}{}, SegmentName: map[string]string{}} + if segment.AdditionalProperties != nil { + metrics := getAdditionalPropMetric(segment.AdditionalProperties) + for key, metric := range metrics { + if isSegment(key) { + metricValue.SegmentName[key] = metric.(string) + } else { + metricValue.Value[key] = metric + } + } + } + if len(parentSeg) > 0 { + for key, val := range parentSeg { + metricValue.SegmentName[key] = val + } + } + if segment.Segments != nil { + for _, segment := range *segment.Segments { + metVal := mapSegment(segment, metricValue.SegmentName) + metricValue.Segments = append(metricValue.Segments, metVal) + } + } + + return metricValue +} + +func isSegment(metric string) bool { + for _, seg := range segmentNames { + if metric == seg { + return true + } + } + return false +} + +func EventsMapping(metricValues insights.ListMetricsResultsItem, applicationId string, namespace string) []mb.Event { + var events []mb.Event + if metricValues.Value == nil { + return events + } + groupedAddProp := make(map[string][]MetricValue) + mValues := mapMetricValues(metricValues) + + var segValues []MetricValue + for _, mv := range mValues { + if len(mv.Segments) == 0 { + groupedAddProp[mv.Interval] = append(groupedAddProp[mv.Interval], mv) + } else { + segValues = append(segValues, mv) + } + } + + for _, val := range groupedAddProp { + event := createNoSegEvent(val, applicationId, namespace) + if len(event.MetricSetFields) > 0 { + events = append(events, event) + } + } + for _, val := range segValues { + for _, seg := range val.Segments { + lastSeg := getValue(seg) + for _, ls := range lastSeg { + events = append(events, createSegEvent(val, ls, applicationId, namespace)) } } } return events } -func createSegmentEvent(start date.Time, end date.Time, segment insights.MetricsSegmentInfo, applicationId string) (mb.Event, bool) { - metricList := common.MapStr{} - metrics := getMetric(segment.AdditionalProperties) - if len(metrics) == 0 { - return mb.Event{}, false +func getValue(metric MetricValue) []MetricValue { + var values []MetricValue + if metric.Segments == nil { + return []MetricValue{metric} + } + for _, met := range metric.Segments { + values = append(values, getValue(met)...) } - for key, metric := range metrics { + return values +} + +func createSegEvent(parentMetricValue MetricValue, metricValue MetricValue, applicationId string, namespace string) mb.Event { + metricList := common.MapStr{} + for key, metric := range metricValue.Value { metricList.Put(key, metric) } + if len(metricList) == 0 { + return mb.Event{} + } + event := createEvent(parentMetricValue.Start, parentMetricValue.End, applicationId, namespace, metricList) + if len(parentMetricValue.SegmentName) > 0 { + event.ModuleFields.Put("dimensions", parentMetricValue.SegmentName) + } + if len(metricValue.SegmentName) > 0 { + event.ModuleFields.Put("dimensions", metricValue.SegmentName) + } + return event +} + +func createEvent(start *date.Time, end *date.Time, applicationId string, namespace string, metricList common.MapStr) mb.Event { event := mb.Event{ - MetricSetFields: common.MapStr{ - "start_date": start, - "end_date": end, + ModuleFields: common.MapStr{ "application_id": applicationId, }, + MetricSetFields: common.MapStr{ + "start_date": start, + "end_date": end, + }, Timestamp: end.Time, } event.RootFields = common.MapStr{} event.RootFields.Put("cloud.provider", "azure") - event.MetricSetFields.Put("metrics", metricList) - return event, true + if namespace == "" { + event.ModuleFields.Put("metrics", metricList) + } else { + for key, metric := range metricList { + event.MetricSetFields.Put(key, metric) + } + } + return event } -func createEvent(values []insights.MetricsResultInfo, applicationId string) (mb.Event, bool) { +func createNoSegEvent(values []MetricValue, applicationId string, namespace string) mb.Event { metricList := common.MapStr{} for _, value := range values { - metrics := getMetric(value.AdditionalProperties) - for key, metric := range metrics { + for key, metric := range value.Value { metricList.Put(key, metric) } } if len(metricList) == 0 { - return mb.Event{}, false + return mb.Event{} } + return createEvent(values[0].Start, values[0].End, applicationId, namespace, metricList) - event := mb.Event{ - MetricSetFields: common.MapStr{ - "start_date": values[0].Start, - "end_date": values[0].End, - "application_id": applicationId, - }, - Timestamp: values[0].End.Time, - } - event.RootFields = common.MapStr{} - event.RootFields.Put("cloud.provider", "azure") - event.MetricSetFields.Put("metrics", metricList) - return event, true } -func getMetric(addProp map[string]interface{}) map[string]interface{} { +func getAdditionalPropMetric(addProp map[string]interface{}) map[string]interface{} { metricNames := make(map[string]interface{}) for key, val := range addProp { switch val.(type) { @@ -115,5 +234,19 @@ func getMetric(addProp map[string]interface{}) map[string]interface{} { } func cleanMetricNames(metric string) string { - return strings.Replace(metric, "/", "_", -1) + metric = strings.Replace(metric, "/", "_", -1) + metric = strings.Replace(metric, " ", "_", -1) + metric = azure.ReplaceUpperCase(metric) + obj := strings.Split(metric, ".") + for index := range obj { + // in some cases a trailing "_" is found + obj[index] = strings.TrimPrefix(obj[index], "_") + obj[index] = strings.TrimSuffix(obj[index], "_") + } + metric = strings.ToLower(strings.Join(obj, "_")) + aggsRegex := regexp.MustCompile(aggsRegex) + metric = aggsRegex.ReplaceAllStringFunc(metric, func(str string) string { + return strings.Replace(str, "_", ".", -1) + }) + return metric } diff --git a/x-pack/metricbeat/module/azure/app_insights/data_test.go b/x-pack/metricbeat/module/azure/app_insights/data_test.go index ebe4e7d98aa..f65f9f84b1d 100644 --- a/x-pack/metricbeat/module/azure/app_insights/data_test.go +++ b/x-pack/metricbeat/module/azure/app_insights/data_test.go @@ -39,20 +39,32 @@ func TestEventMapping(t *testing.T) { Value: &metrics, } applicationId := "abc" - events := EventsMapping(result, applicationId) + events := EventsMapping(result, applicationId, "") assert.Equal(t, len(events), 1) for _, event := range events { val1, _ := event.MetricSetFields.GetValue("start_date") assert.Equal(t, val1, &startDate) val2, _ := event.MetricSetFields.GetValue("end_date") assert.Equal(t, val2, &startDate) - val3, _ := event.MetricSetFields.GetValue("metrics.requests_count") + val3, _ := event.ModuleFields.GetValue("metrics.requests_count") assert.Equal(t, val3, common.MapStr{"sum": 12}) - val5, _ := event.MetricSetFields.GetValue("metrics.requests_failed") + val5, _ := event.ModuleFields.GetValue("metrics.requests_failed") assert.Equal(t, val5, common.MapStr{"sum": 10}) - val4, _ := event.MetricSetFields.GetValue("application_id") + val4, _ := event.ModuleFields.GetValue("application_id") assert.Equal(t, val4, applicationId) } } + +func TestCleanMetricNames(t *testing.T) { + ex := "customDimensions/ExecutingAssemblyFileVersion" + result := cleanMetricNames(ex) + assert.Equal(t, result, "custom_dimensions_executing_assembly_file_version") + ex = "customDimensions/_MS.AggregationIntervalMs" + result = cleanMetricNames(ex) + assert.Equal(t, result, "custom_dimensions__ms_aggregation_interval_ms") + ex = "customDimensions/_MS.IsAutocollected" + result = cleanMetricNames(ex) + assert.Equal(t, result, "custom_dimensions__ms_is_autocollected") +} diff --git a/x-pack/metricbeat/module/azure/app_state/_meta/data.json b/x-pack/metricbeat/module/azure/app_state/_meta/data.json new file mode 100644 index 00000000000..c4744db7f60 --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/_meta/data.json @@ -0,0 +1,32 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "azure": { + "app_state": { + "end_date": "2020-10-02T13:23:11.221Z", + "requests_count": { + "sum": 16 + }, + "start_date": "2020-10-01T13:23:11.221Z" + }, + "application_id": "42cb59a9-d5be-400b-a5c4-69b0a00434fdf4", + "dimensions": { + "request_name": "GET /auth", + "request_url_host": "demoapplogobs.azurewebsites.net" + } + }, + "cloud": { + "provider": "azure" + }, + "event": { + "dataset": "azure.app_state", + "duration": 115000, + "module": "azure" + }, + "metricset": { + "name": "app_state", + "period": 10000 + }, + "service": { + "type": "azure" + } +} diff --git a/x-pack/metricbeat/module/azure/app_state/_meta/docs.asciidoc b/x-pack/metricbeat/module/azure/app_state/_meta/docs.asciidoc new file mode 100644 index 00000000000..4517ccfed0d --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/_meta/docs.asciidoc @@ -0,0 +1,12 @@ +This is the app_state metricset of the module azure. + +This metricset allows users to retrieve application insights metrics from specified applications. + +[float] +==== Config options to identify resources + +`application_id`:: (_[]string_) ID of the application. This is Application ID from the API Access settings blade in the Azure portal. + +`api_key`:: (_[]string_) The API key which will be generated, more on the steps here https://dev.applicationinsights.io/documentation/Authorization/API-key-and-App-ID. + + diff --git a/x-pack/metricbeat/module/azure/app_state/_meta/fields.yml b/x-pack/metricbeat/module/azure/app_state/_meta/fields.yml new file mode 100644 index 00000000000..fad928c090f --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/_meta/fields.yml @@ -0,0 +1,86 @@ +- name: app_state + type: group + release: beta + description: > + application state + fields: + - name: start_date + type: date + description: > + The start date + - name: end_date + type: date + description: > + The end date + - name: requests_count.sum + type: float + description: > + Request count + - name: requests_failed.sum + type: float + description: > + Request failed count + - name: users_count.unique + type: float + description: > + User count + - name: sessions_count.unique + type: float + description: > + Session count + - name: users_authenticated.unique + type: float + description: > + Authenticated users count + - name: browser_timings_network_duration.avg + type: float + description: > + Browser timings network duration + - name: browser_timings_send_duration.avg + type: float + description: > + Browser timings send duration + - name: browser_timings_receive_uration.avg + type: float + description: > + Browser timings receive duration + - name: browser_timings_processing_duration.avg + type: float + description: > + Browser timings processing duration + - name: browser_timings_total_duration.avg + type: float + description: > + Browser timings total duration + - name: exceptions_count.sum + type: float + description: > + Exception count + - name: exceptions_browser.sum + type: float + description: > + Exception count at browser level + - name: exceptions_server.sum + type: float + description: > + Exception count at server level + - name: performance_counters_memory_available_bytes.avg + type: float + description: > + Performance counters memory available bytes + - name: performance_counters_process_private_bytes.avg + type: float + description: > + Performance counters process private bytes + - name: performance_counters_process_cpu_percentage_total.avg + type: float + description: > + Performance counters process cpu percentage total + - name: performance_counters_process_cpu_percentage.avg + type: float + description: > + Performance counters process cpu percentage + - name: performance_counters_processiobytes_per_second.avg + type: float + description: > + Performance counters process IO bytes per second diff --git a/x-pack/metricbeat/module/azure/app_state/app_state_integration_test.go b/x-pack/metricbeat/module/azure/app_state/app_state_integration_test.go new file mode 100644 index 00000000000..8762cae440d --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/app_state_integration_test.go @@ -0,0 +1,38 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build integration +// +build azure + +package app_state + +import ( + "testing" + + "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/test" + + "github.com/stretchr/testify/assert" + + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights" +) + +func TestFetchMetricset(t *testing.T) { + config := test.GetConfigForInsights(t, "app_state") + metricSet := mbtest.NewReportingMetricSetV2Error(t, config) + events, errs := mbtest.ReportingFetchV2Error(metricSet) + if len(errs) > 0 { + t.Fatalf("Expected 0 error, had %d. %v\n", len(errs), errs) + } + assert.NotEmpty(t, events) + mbtest.TestMetricsetFieldsDocumented(t, metricSet, events) +} + +func TestData(t *testing.T) { + config := test.GetConfigForInsights(t, "app_state") + metricSet := mbtest.NewFetcher(t, config) + metricSet.WriteEvents(t, "/") +} diff --git a/x-pack/metricbeat/module/azure/app_state/app_state_test.go b/x-pack/metricbeat/module/azure/app_state/app_state_test.go new file mode 100644 index 00000000000..a8dbab88081 --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/app_state_test.go @@ -0,0 +1,17 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package app_state + +import ( + "os" + + "github.com/elastic/beats/v7/metricbeat/mb" +) + +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +} diff --git a/x-pack/metricbeat/module/azure/app_state/manifest.yml b/x-pack/metricbeat/module/azure/app_state/manifest.yml new file mode 100644 index 00000000000..5c1d08a2ceb --- /dev/null +++ b/x-pack/metricbeat/module/azure/app_state/manifest.yml @@ -0,0 +1,29 @@ +default: false +input: + module: azure + metricset: app_insights + defaults: + namespace: app_state + metrics: + - id: ["requests/count", "requests/failed"] + segment: ["request/urlHost", "request/name"] + aggregation: ["sum"] + interval: "P5M" + - id: ["users/count", "sessions/count", "users/authenticated"] + segment: ["request/urlHost"] + aggregation: ["unique"] + interval: "P5M" + - id: ["browserTimings/networkDuration", "browserTimings/sendDuration", "browserTimings/receiveDuration", "browserTimings/processingDuration", "browserTimings/totalDuration"] + segment: ["browserTiming/urlHost", "browserTiming/urlPath"] + aggregation: ["avg"] + interval: "P5M" + top: 5 + - id: ["exceptions/count", "exceptions/browser", "exceptions/server"] + segment: ["exception/type", "cloud/roleName"] + aggregation: ["sum"] + interval: "P5M" + - id: ["performanceCounters/memoryAvailableBytes", "performanceCounters/processCpuPercentageTotal", "performanceCounters/processCpuPercentage", "performanceCounters/processIOBytesPerSecond", + "performanceCounters/processPrivateBytes"] + aggregation: ["avg"] + segment: ["cloud/roleName", "cloud/roleInstance"] + interval: "P5M" diff --git a/x-pack/metricbeat/module/azure/data.go b/x-pack/metricbeat/module/azure/data.go index bf77f657416..4d479ef45d5 100644 --- a/x-pack/metricbeat/module/azure/data.go +++ b/x-pack/metricbeat/module/azure/data.go @@ -120,7 +120,7 @@ func managePropertyName(metric string) string { // create an object in case of ":" resultMetricName = strings.Replace(resultMetricName, "_-_", "_", -1) // replace uppercases with underscores - resultMetricName = replaceUpperCase(resultMetricName) + resultMetricName = ReplaceUpperCase(resultMetricName) // avoid cases as this "logicaldisk_avg._disk_sec_per_transfer" obj := strings.Split(resultMetricName, ".") @@ -134,8 +134,8 @@ func managePropertyName(metric string) string { return resultMetricName } -// replaceUpperCase func will replace upper case with '_' -func replaceUpperCase(src string) string { +// ReplaceUpperCase func will replace upper case with '_' +func ReplaceUpperCase(src string) string { replaceUpperCaseRegexp := regexp.MustCompile(replaceUpperCaseRegex) return replaceUpperCaseRegexp.ReplaceAllStringFunc(src, func(str string) string { var newStr string diff --git a/x-pack/metricbeat/module/azure/data_test.go b/x-pack/metricbeat/module/azure/data_test.go index cdfad1965f8..cca7edc0233 100644 --- a/x-pack/metricbeat/module/azure/data_test.go +++ b/x-pack/metricbeat/module/azure/data_test.go @@ -47,10 +47,10 @@ func TestGetDimensionValue(t *testing.T) { } func TestReplaceUpperCase(t *testing.T) { - result := replaceUpperCase("TestReplaceUpper_Case") + result := ReplaceUpperCase("TestReplaceUpper_Case") assert.Equal(t, result, "Test_replace_upper_Case") // should not split on acronyms - result = replaceUpperCase("CPU_Percentage") + result = ReplaceUpperCase("CPU_Percentage") assert.Equal(t, result, "CPU_Percentage") } diff --git a/x-pack/metricbeat/module/azure/fields.go b/x-pack/metricbeat/module/azure/fields.go index 4c0ad95ad98..6a308a5d2ae 100644 --- a/x-pack/metricbeat/module/azure/fields.go +++ b/x-pack/metricbeat/module/azure/fields.go @@ -19,5 +19,5 @@ func init() { // AssetAzure returns asset data. // This is the base64 encoded gzipped contents of module/azure. func AssetAzure() string { - return "eJzUV8tu2zoQ3fsrBl4GSD7AiwsEt5suuuteGJNjhY1EEuQorfv1hR6kKVHyo1aKxIsAEcnzEM8MqUd4peMO8HfjaAPAiivawfa5/X+7AZDkhVOWldE7+G8DAP1cqI1sqnaJo4rQ0w5K3AAcFFXS77qJj6CxphN4++Ojbac609jhyQzDGCaFYlVT6VDpOBIgX+n40ziZPJ8F7n/fXwieexvETokZ3MDoyJvGCcoIUw9X0AUc8JaEOihKpU7tjiwfLY0Glh1fkBGktMvBHIATWbPUU4srcMfXkGNHw1j6p4dZWrP/QYInQ/3D4pywZEpRo7VKl8P87cP2NhN9bKKNTmwWmvavtziTmptjGqHAU0WCk9wENt/sI0Sh5P2cKSB8/ZIRSlWT9sro8T4t7NGF/bl2b85oHpVyIi4T3k/xTw836z5UBhcG/1b1t14MOOLGaZK5XLS2UNqr8oX9xf4T+/CeGK9TgNZWSmC3zTM857pSsnQcObi/R6SykvSl9J7RcSGR51vjzMAVvB1ovjZwkpZrM5KWy3zzYYUbmuE0tLBqK2wNDBqz5O5VVSldvkdoB2hALaHxWBJIYlTVtckVjXOkxXHdzM6iBkrriPFXIYyf7sbyPl3g/H+KFXszWXRck+aifbCuyxM4ZOAns0Y2WS7vJB5A88tQYO2SUHQVvGJ99vm60Bd6atLzXfAe4rPtYaiDwpJTRq7ehEOZ9fAwgY/HgBCmeZeoxTLvGZbzhoIbrFYtru4Q6mAhgw20B+NIoOfViQPwMnUfuJWPoqGVpmtjxzS1bZiKt3pyFo0//cYq/vl16qTyjIHCC6zIE38OJ1FuHJ/xphmVJtfeFBm1oI9tbVALQe0ZQ45K5dkdP4ehoPaMIU/uTX2WDRrE5h9/yLhHT8XQmT+ym6A1nCL5B6HRio27/p5aXnlLzYGnd9LlkvZsHJYfOiaDxPhe/wQAAP//ZxBMvQ==" + return "eJzkmU1v47YTxu/5FIMcA2w+gA9/IP+2hz0ULfpyJsbUWGEjkVxy6Kz76QuKkixLsizbspugOSywenme30MOJyLzBd5otwL8Ozh6AGDFBa3g8SX+//EBICMvnbKsjF7B/x4AID0LpclCEV9xVBB6WkGODwAbRUXmV9WDX0BjSXvx+MM7Gx91Jtj6yojDoUxXilVJuUOl2zuN5Bvt3o3LOtdHhdPPH68ELykGsVNyRLdxdORNcJIGht0MM+waHfCWpNoo6qL24x5E3lk6uHE88QmMBiW+DmYD3MEate5HXMC7HYahdhsYc//8NGpr1n+R5N6tdFFMgXUeESVaq3ReP//49HheiFQ2bYwKdlA08V9vcaRqzi7TVgo8FSS5UzeNmw/rVkKo7HrPriB8/XFgiNYWSuJifh29MbtMlaS9MvqwLI6UxIlymFsKE8gHnaMDNwBPj/jnp7O5N4XBIzcvpf45wYAjDk5TNsRFa4XSXuWv7E+2u7btr4lxHkF3mkd8ppqgZ3QsMuTxVjhyY0YvqkSH7zaepLOlHUlnx/3GqwXOaH79qoFFW18MUDOOlo7nw2Q3qZu+yX+9aBx9C+TZC2mC5mcfylHnsco4Yf1bUoZKeNp7g6qg7BbmSXmCIXhyTfig1bcwPvIXIPzpyU0Ye/JV17+J9+9J/GRuDPxKmuPioGxhhpeudvKb4Fk78+7JCVal0rkXmvjduDeRBVct3Gfc5kuR/T95Qe0FtRc0XrMAfbVS70Dnq/V7DpojSWpL4g5wtdV5fNYZGQtU53cZwL3deZhsGIu7EFZO03D0XVKld4NO/VOjPbE+O/71ON2QAJCb2YCCtlScQvLktjcnSiYTQJbcxrgStaQ0SbHFllQatxO4RVXguiCx3jH5Javp170tNLaQbKG1hcp2Pna9aIR1aot8L+raFWrXS6GlDcKSk6QZc0oL+W7s0gbYm6e1fW2Efwn+bGxlqhmL5MKTNDq7G/nXX1K1RD5I3oNdxloVhdL5LfYYtTSgjt86ceIzYlTF3A2qDM6RlrvRsbr4tGxUtZ1IR4zfhTS+Pw8Xz9APfa32CIYsOi5Js4gXlk25F4eB+D6sycJg93ulcS06PGLdf2XH/lNt+Rbc0KX6OrGRTNak+7GuN57cT9brIHYAZbLD0z24fsSbZZbkoSffnibIqj3coNTaZZ4cjtcbSg5YLLq4qpPOShYGso3txjiS6Hlx40b4uHUquIXPLupW2n237ZimtIFJbMveidfhH5QOKe5+arqnnAggvMSCPPHnSNLitvdHsmlGpckJpT3H39gfO1pNCw3tRCBHufLsdp8jUEM7ESjua9RnmaAadhAnQ8Y1ehJ1Z/7IaRrW5rfIIExptGLj5n+n5jO/UofC/W/S40vas3FxK/KBB7ZGbMf1nwAAAP//oQy/EA==" } diff --git a/x-pack/metricbeat/module/azure/module.yml b/x-pack/metricbeat/module/azure/module.yml index a51b202612b..4170154e246 100644 --- a/x-pack/metricbeat/module/azure/module.yml +++ b/x-pack/metricbeat/module/azure/module.yml @@ -4,5 +4,6 @@ metricsets: - container_instance - container_service - database_account + - app_state - compute_vm - compute_vm_scaleset diff --git a/x-pack/metricbeat/module/azure/test/integration.go b/x-pack/metricbeat/module/azure/test/integration.go index 7187e3b93f7..39e8402110c 100644 --- a/x-pack/metricbeat/module/azure/test/integration.go +++ b/x-pack/metricbeat/module/azure/test/integration.go @@ -40,3 +40,23 @@ func GetConfig(t *testing.T, metricSetName string) map[string]interface{} { "subscription_id": subId, } } + +// GetConfigForInsights function gets azure credentials for integration tests. +func GetConfigForInsights(t *testing.T, metricSetName string) map[string]interface{} { + t.Helper() + applicationId, ok := os.LookupEnv("AZURE_APPLICATION_ID") + if !ok { + t.Fatal("Could not find var AZURE_APPLICATION_ID") + } + apiKey, ok := os.LookupEnv("AZURE_API_KEY") + if !ok { + t.Fatal("Could not find var AZURE_API_KEY") + } + return map[string]interface{}{ + "module": "azure", + "period": "300s", + "metricsets": []string{metricSetName}, + "application_id": applicationId, + "api_key": apiKey, + } +} diff --git a/x-pack/metricbeat/modules.d/azure.yml.disabled b/x-pack/metricbeat/modules.d/azure.yml.disabled index 23211f47206..10d00e003cf 100644 --- a/x-pack/metricbeat/modules.d/azure.yml.disabled +++ b/x-pack/metricbeat/modules.d/azure.yml.disabled @@ -114,3 +114,11 @@ # api_key: '' # metrics: # - id: ["requests/count", "requests/duration"] + +#- module: azure +# metricsets: +# - app_state +# enabled: true +# period: 300s +# application_id: '' +# api_key: '' From 9aab0c0de9fd3ff44ae3307f174f256fa547e725 Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Mon, 5 Oct 2020 10:53:08 +0200 Subject: [PATCH 122/216] Map `cloud.account.id` to azure sub id (#21483) * mofidy doc * tet * add cloud * changelog --- CHANGELOG.next.asciidoc | 1 + .../add_cloud_metadata/provider_azure_vm.go | 3 + .../provider_azure_vm_test.go | 6 +- .../metricbeat/module/azure/add_metadata.go | 5 +- .../module/azure/compute_vm/_meta/data.json | 115 +++++++++++++----- .../azure/compute_vm_scaleset/_meta/data.json | 33 ++--- x-pack/metricbeat/module/azure/data.go | 4 +- 7 files changed, 120 insertions(+), 47 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 68b77a46037..c72c4adb04b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -731,6 +731,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] - Release lambda metricset in aws module as GA. {issue}21251[21251] {pull}21255[21255] - Add dashboard for pubsub metricset in googlecloud module. {pull}21326[21326] {issue}17137[17137] +- Map cloud data filed `cloud.account.id` to azure subscription. {pull}21483[21483] {issue}21381[21381] *Packetbeat* diff --git a/libbeat/processors/add_cloud_metadata/provider_azure_vm.go b/libbeat/processors/add_cloud_metadata/provider_azure_vm.go index 9cd3eba55b8..3028d531c1e 100644 --- a/libbeat/processors/add_cloud_metadata/provider_azure_vm.go +++ b/libbeat/processors/add_cloud_metadata/provider_azure_vm.go @@ -34,6 +34,9 @@ var azureVMMetadataFetcher = provider{ azHeaders := map[string]string{"Metadata": "true"} azSchema := func(m map[string]interface{}) common.MapStr { out, _ := s.Schema{ + "account": s.Object{ + "id": c.Str("subscriptionId"), + }, "instance": s.Object{ "id": c.Str("vmId"), "name": c.Str("name"), diff --git a/libbeat/processors/add_cloud_metadata/provider_azure_vm_test.go b/libbeat/processors/add_cloud_metadata/provider_azure_vm_test.go index 307ac60abad..a988cc8873f 100644 --- a/libbeat/processors/add_cloud_metadata/provider_azure_vm_test.go +++ b/libbeat/processors/add_cloud_metadata/provider_azure_vm_test.go @@ -40,7 +40,8 @@ const azInstanceIdentityDocument = `{ "sku": "14.04.4-LTS", "version": "14.04.201605091", "vmId": "04ab04c3-63de-4709-a9f9-9ab8c0411d5e", - "vmSize": "Standard_D3_v2" + "vmSize": "Standard_D3_v2", + "subscriptionId": "5tfb04c3-63de-4709-a9f9-9ab8c0411d5e" }` func initAzureTestServer() *httptest.Server { @@ -87,6 +88,9 @@ func TestRetrieveAzureMetadata(t *testing.T) { "machine": common.MapStr{ "type": "Standard_D3_v2", }, + "account": common.MapStr{ + "id": "5tfb04c3-63de-4709-a9f9-9ab8c0411d5e", + }, "region": "eastus2", }, } diff --git a/x-pack/metricbeat/module/azure/add_metadata.go b/x-pack/metricbeat/module/azure/add_metadata.go index ba8f35c7db6..1342170aec0 100644 --- a/x-pack/metricbeat/module/azure/add_metadata.go +++ b/x-pack/metricbeat/module/azure/add_metadata.go @@ -35,7 +35,7 @@ func addHostMetadata(event *mb.Event, metricList common.MapStr) { } } -func addCloudVMMetadata(event *mb.Event, vm VmResource) { +func addCloudVMMetadata(event *mb.Event, vm VmResource, subscriptionId string) { if vm.Name != "" { event.RootFields.Put("cloud.instance.name", vm.Name) event.RootFields.Put("host.name", vm.Name) @@ -47,4 +47,7 @@ func addCloudVMMetadata(event *mb.Event, vm VmResource) { if vm.Size != "" { event.RootFields.Put("cloud.machine.type", vm.Size) } + if subscriptionId != "" { + event.RootFields.Put("cloud.account.id", subscriptionId) + } } diff --git a/x-pack/metricbeat/module/azure/compute_vm/_meta/data.json b/x-pack/metricbeat/module/azure/compute_vm/_meta/data.json index 1da5cfb63ab..c38407c76f1 100644 --- a/x-pack/metricbeat/module/azure/compute_vm/_meta/data.json +++ b/x-pack/metricbeat/module/azure/compute_vm/_meta/data.json @@ -2,62 +2,86 @@ "@timestamp": "2017-10-12T08:05:34.853Z", "azure": { "compute_vm": { + "disk_read_bytes": { + "total": 0 + }, "disk_read_operations_per_sec": { - "avg": 3.3875 + "avg": 0 + }, + "disk_write_bytes": { + "total": 2969709.4 }, "disk_write_operations_per_sec": { - "avg": 0.6705 + "avg": 0.7809999999999999 }, "inbound_flows": { - "avg": 28.4 + "avg": 10 }, "inbound_flows_maximum_creation_rate": { - "avg": 10.4 + "avg": 10.6 + }, + "network_in": { + "total": 1478232 + }, + "network_in_total": { + "total": 1569665 + }, + "network_out": { + "total": 793344 + }, + "network_out_total": { + "total": 1074624 + }, + "os_disk_bandwidth_consumed_percentage": { + "avg": 0 + }, + "os_disk_iops_consumed_percentage": { + "avg": 0 }, "os_disk_queue_depth": { - "avg": 0.00125 + "avg": 0.002 }, "os_disk_read_bytes_per_sec": { - "avg": 602589.1825 + "avg": 0 }, "os_disk_read_operations_per_sec": { - "avg": 5.28375 + "avg": 0 }, "os_disk_write_bytes_per_sec": { - "avg": 14137.59375 + "avg": 9899.025 }, "os_disk_write_operations_per_sec": { - "avg": 1.46875 + "avg": 1.5619999999999998 }, "os_per_disk_qd": { - "avg": 0.00125 + "avg": 0.002 }, "os_per_disk_read_bytes_per_sec": { - "avg": 602589.1825 + "avg": 0 }, "os_per_disk_read_operations_per_sec": { - "avg": 5.28375 + "avg": 0 }, "os_per_disk_write_bytes_per_sec": { - "avg": 14137.59375 + "avg": 9899.025 }, "os_per_disk_write_operations_per_sec": { - "avg": 1.46875 + "avg": 1.5619999999999998 }, "outbound_flows": { - "avg": 28.4 + "avg": 10 }, "outbound_flows_maximum_creation_rate": { - "avg": 10.4 + "avg": 10.6 }, "per_disk_qd": { - "avg": 0.0025 + "avg": 0 }, "per_disk_read_bytes_per_sec": { - "avg": 51985.035 + "avg": 0 }, "per_disk_read_operations_per_sec": { - "avg": 2.92875 + "avg": 0 }, "per_disk_write_bytes_per_sec": { "avg": 0 @@ -66,26 +90,41 @@ "avg": 0 }, "percentage_cpu": { - "avg": 9.747 + "avg": 1.8719999999999999 + }, + "vm_cached_bandwidth_consumed_percentage": { + "avg": 0 + }, + "vm_cached_iops_consumed_percentage": { + "avg": 0 + }, + "vm_uncached_bandwidth_consumed_percentage": { + "avg": 0 + }, + "vm_uncached_iops_consumed_percentage": { + "avg": 0 } }, "namespace": "Microsoft.Compute/virtualMachines", "resource": { "group": "obs-infrastructure", - "id": "/subscriptions/70bd6e64-4b1e-4835-8896-db77b8eef364/resourceGroups/obs-infrastructure/providers/Microsoft.Compute/virtualMachines/obslinux", - "name": "obslinux", + "id": "/subscriptions/fd675b6f-b5e5-426e-ac45-d1f876d0ffa6/resourceGroups/obs-infrastructure/providers/Microsoft.Compute/virtualMachines/testaz", + "name": "testaz", "type": "Microsoft.Compute/virtualMachines" }, - "subscription_id": "70bd6e64-4b1e-4835-8896-db77b8eef364", + "subscription_id": "fd675b6f-b5e5-426e-ac45-d1f876d0ffa6", "timegrain": "PT5M" }, "cloud": { + "account": { + "id": "fd675b6f-b5e5-426e-ac45-d1f876d0ffa6" + }, "instance": { - "id": "d5d9444a-1964-4d23-9c62-5463ecb16fe0", - "name": "obslinux" + "id": "490fe4cf-2b33-4ead-a016-7e614c2f48ad", + "name": "testaz" }, "machine": { - "type": "Basic_A0" + "type": "Standard_A1_v2" }, "provider": "azure", "region": "westeurope" @@ -97,10 +136,28 @@ }, "host": { "cpu": { - "pct": 0.09747 + "pct": 0.01872 }, - "id": "d5d9444a-1964-4d23-9c62-5463ecb16fe0", - "name": "obslinux" + "disk": { + "read": { + "bytes": 0 + }, + "write": { + "bytes": 2969709.4 + } + }, + "id": "490fe4cf-2b33-4ead-a016-7e614c2f48ad", + "name": "testaz", + "network": { + "in": { + "bytes": 1569665, + "packets": 1478232 + }, + "out": { + "bytes": 1074624, + "packets": 793344 + } + } }, "metricset": { "name": "compute_vm", diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json b/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json index e8f59859d8b..2d99d8ff6b0 100644 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/_meta/data.json @@ -2,6 +2,12 @@ "@timestamp": "2017-10-12T08:05:34.853Z", "azure": { "compute_vm_scaleset": { + "cpu_credits_consumed": { + "avg": 0.006999999999999999 + }, + "cpu_credits_remaining": { + "avg": 84.72 + }, "os_per_disk_qd": { "avg": 0 }, @@ -12,35 +18,34 @@ "avg": 0 }, "os_per_disk_write_bytes_per_sec": { - "avg": 1872.1200000000001 + "avg": 3846.531 }, "os_per_disk_write_operations_per_sec": { - "avg": 0.296 + "avg": 0.5519999999999999 } }, "namespace": "Microsoft.Compute/virtualMachineScaleSets", "resource": { - "group": "testgroup", - "id": "/subscriptions/70bd6e23-e3er3-4835-6785-db77b8eef364/resourceGroups/testgroup/providers/Microsoft.Compute/virtualMachineScaleSets/vmscaleset", - "name": "vmscaleset", - "tags": { - "environment": "staging", - "role": "allocator" - }, + "group": "obs-infrastructure", + "id": "/subscriptions/fd675b6f-b5e5-426e-ac45-d1f876d0ffa6/resourceGroups/obs-infrastructure/providers/Microsoft.Compute/virtualMachineScaleSets/obslinuxvmss", + "name": "obslinuxvmss", "type": "Microsoft.Compute/virtualMachineScaleSets" }, - "subscription_id": "70bd6e23-e3er3-4835-6785-db77b8eef364", + "subscription_id": "fd675b6f-b5e5-426e-ac45-d1f876d0ffa6", "timegrain": "PT5M" }, "cloud": { + "account": { + "id": "fd675b6f-b5e5-426e-ac45-d1f876d0ffa6" + }, "instance": { - "name": "vmscaleset" + "name": "obslinuxvmss" }, "machine": { - "type": "Standard_D4s_v3" + "type": "Standard_B1ls" }, "provider": "azure", - "region": "eastus2" + "region": "westeurope" }, "event": { "dataset": "azure.compute_vm_scaleset", @@ -48,7 +53,7 @@ "module": "azure" }, "host": { - "name": "vmscaleset" + "name": "obslinuxvmss" }, "metricset": { "name": "compute_vm_scaleset", diff --git a/x-pack/metricbeat/module/azure/data.go b/x-pack/metricbeat/module/azure/data.go index 4d479ef45d5..eb7f1433142 100644 --- a/x-pack/metricbeat/module/azure/data.go +++ b/x-pack/metricbeat/module/azure/data.go @@ -82,7 +82,7 @@ func EventsMapping(metrics []Metric, client *Client, report mb.ReporterV2) error event, metricList = createEvent(timestamp, defaultMetric, resource, groupDimValues) if client.Config.AddCloudMetadata { vm = client.GetVMForMetaData(&resource, groupDimValues) - addCloudVMMetadata(&event, vm) + addCloudVMMetadata(&event, vm, resource.Subscription) } } } @@ -90,7 +90,7 @@ func EventsMapping(metrics []Metric, client *Client, report mb.ReporterV2) error event, metricList = createEvent(timestamp, defaultMetric, resource, groupTimeValues) if client.Config.AddCloudMetadata { vm = client.GetVMForMetaData(&resource, groupTimeValues) - addCloudVMMetadata(&event, vm) + addCloudVMMetadata(&event, vm, resource.Subscription) } } if client.Config.DefaultResourceType == "" { From c91216796739bea67c32c6d6c5dc349abb7eb017 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 5 Oct 2020 10:53:30 +0200 Subject: [PATCH 123/216] Do not run symlink tests on Windows (#21472) --- filebeat/input/filestream/fswatch_test.go | 146 +++++++----------- .../filestream/fswatch_test_non_windows.go | 144 +++++++++++++++++ .../input/filestream/testdata/excluded_file | 0 .../input/filestream/testdata/included_file | 0 .../testdata/symlink_to_included_file | 1 - 5 files changed, 201 insertions(+), 90 deletions(-) create mode 100644 filebeat/input/filestream/fswatch_test_non_windows.go delete mode 100644 filebeat/input/filestream/testdata/excluded_file delete mode 100644 filebeat/input/filestream/testdata/included_file delete mode 120000 filebeat/input/filestream/testdata/symlink_to_included_file diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go index 5e63987c868..4979c9275c8 100644 --- a/filebeat/input/filestream/fswatch_test.go +++ b/filebeat/input/filestream/fswatch_test.go @@ -31,6 +31,12 @@ import ( "github.com/elastic/beats/v7/libbeat/logp" ) +var ( + excludedFilePath = filepath.Join("testdata", "excluded_file") + includedFilePath = filepath.Join("testdata", "included_file") + directoryPath = filepath.Join("testdata", "unharvestable_dir") +) + func TestFileScanner(t *testing.T) { testCases := map[string]struct { paths []string @@ -39,56 +45,30 @@ func TestFileScanner(t *testing.T) { expectedFiles []string }{ "select all files": { - paths: []string{ - filepath.Join("testdata", "excluded_file"), - filepath.Join("testdata", "included_file"), - }, + paths: []string{excludedFilePath, includedFilePath}, expectedFiles: []string{ - mustAbsPath(filepath.Join("testdata", "excluded_file")), - mustAbsPath(filepath.Join("testdata", "included_file")), + mustAbsPath(excludedFilePath), + mustAbsPath(includedFilePath), }, }, "skip excluded files": { - paths: []string{ - filepath.Join("testdata", "excluded_file"), - filepath.Join("testdata", "included_file"), - }, + paths: []string{excludedFilePath, includedFilePath}, excludedFiles: []match.Matcher{ - match.MustCompile(filepath.Join("testdata", "excluded_file")), - }, - expectedFiles: []string{ - mustAbsPath(filepath.Join("testdata", "included_file")), - }, - }, - // covers test_input.py/test_skip_symlinks - "skip symlinks": { - paths: []string{ - filepath.Join("testdata", "symlink_to_included_file"), - filepath.Join("testdata", "included_file"), + match.MustCompile("excluded_file"), }, - symlinks: false, expectedFiles: []string{ - mustAbsPath(filepath.Join("testdata", "included_file")), - }, - }, - "return a file once if symlinks are enabled": { - paths: []string{ - filepath.Join("testdata", "symlink_to_included_file"), - filepath.Join("testdata", "included_file"), - }, - symlinks: true, - expectedFiles: []string{ - mustAbsPath(filepath.Join("testdata", "included_file")), + mustAbsPath(includedFilePath), }, }, "skip directories": { - paths: []string{ - filepath.Join("testdata", "unharvestable_dir"), - }, + paths: []string{directoryPath}, expectedFiles: []string{}, }, } + setupFilesForScannerTest(t) + defer removeFilesOfScannerTest(t) + for name, test := range testCases { test := test @@ -107,11 +87,50 @@ func TestFileScanner(t *testing.T) { for p, _ := range files { paths = append(paths, p) } - assert.Equal(t, test.expectedFiles, paths) + assert.True(t, checkIfSameContents(test.expectedFiles, paths)) }) } } +func setupFilesForScannerTest(t *testing.T) { + err := os.MkdirAll(directoryPath, 0750) + if err != nil { + t.Fatal(t) + } + + for _, path := range []string{excludedFilePath, includedFilePath} { + f, err := os.Create(path) + if err != nil { + t.Fatalf("file %s, error %v", path, err) + } + f.Close() + } +} + +func removeFilesOfScannerTest(t *testing.T) { + err := os.RemoveAll("testdata") + if err != nil { + t.Fatal(err) + } +} + +// only handles sets +func checkIfSameContents(one, other []string) bool { + if len(one) != len(other) { + return false + } + + mustFind := len(one) + for _, oneElem := range one { + for _, otherElem := range other { + if oneElem == otherElem { + mustFind-- + } + } + } + return mustFind == 0 +} + func TestFileWatchNewDeleteModified(t *testing.T) { oldTs := time.Now() newTs := oldTs.Add(5 * time.Second) @@ -201,9 +220,7 @@ func TestFileWatchNewDeleteModified(t *testing.T) { events: make(chan loginp.FSEvent), } - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() - go w.watch(ctx) + go w.watch(context.Background()) for _, expectedEvent := range test.expectedEvents { evt := w.Event() @@ -213,55 +230,6 @@ func TestFileWatchNewDeleteModified(t *testing.T) { } } -func TestFileWatcherRenamedFile(t *testing.T) { - testPath := mustAbsPath(filepath.Join("testdata", "first_name")) - renamedPath := mustAbsPath(filepath.Join("testdata", "renamed")) - - f, err := os.Create(testPath) - if err != nil { - t.Fatal(err) - } - f.Close() - fi, err := os.Stat(testPath) - if err != nil { - t.Fatal(err) - } - - cfg := fileScannerConfig{ - ExcludedFiles: nil, - Symlinks: false, - RecursiveGlob: false, - } - scanner, err := newFileScanner([]string{testPath, renamedPath}, cfg) - if err != nil { - t.Fatal(err) - } - w := fileWatcher{ - log: logp.L(), - scanner: scanner, - events: make(chan loginp.FSEvent), - } - - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() - - go w.watch(ctx) - assert.Equal(t, loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: testPath, Info: fi}, w.Event()) - - err = os.Rename(testPath, renamedPath) - if err != nil { - t.Fatal(err) - } - defer os.Remove(renamedPath) - fi, err = os.Stat(renamedPath) - if err != nil { - t.Fatal(err) - } - - go w.watch(ctx) - assert.Equal(t, loginp.FSEvent{Op: loginp.OpRename, OldPath: testPath, NewPath: renamedPath, Info: fi}, w.Event()) -} - type mockScanner struct { files map[string]os.FileInfo } diff --git a/filebeat/input/filestream/fswatch_test_non_windows.go b/filebeat/input/filestream/fswatch_test_non_windows.go new file mode 100644 index 00000000000..eecfeddf930 --- /dev/null +++ b/filebeat/input/filestream/fswatch_test_non_windows.go @@ -0,0 +1,144 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build !windows + +package filestream + +import ( + "context" + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + "github.com/elastic/beats/v7/libbeat/common/match" + "github.com/elastic/beats/v7/libbeat/logp" +) + +func TestFileScannerSymlinks(t *testing.T) { + testCases := map[string]struct { + paths []string + excludedFiles []match.Matcher + symlinks bool + expectedFiles []string + }{ + // covers test_input.py/test_skip_symlinks + "skip symlinks": { + paths: []string{ + filepath.Join("testdata", "symlink_to_included_file"), + filepath.Join("testdata", "included_file"), + }, + symlinks: false, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + "return a file once if symlinks are enabled": { + paths: []string{ + filepath.Join("testdata", "symlink_to_included_file"), + filepath.Join("testdata", "included_file"), + }, + symlinks: true, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + } + + err := os.Symlink( + mustAbsPath(filepath.Join("testdata", "included_file")), + mustAbsPath(filepath.Join("testdata", "symlink_to_included_file")), + ) + if err != nil { + t.Fatal(err) + } + + for name, test := range testCases { + test := test + + t.Run(name, func(t *testing.T) { + cfg := fileScannerConfig{ + ExcludedFiles: test.excludedFiles, + Symlinks: true, + RecursiveGlob: false, + } + fs, err := newFileScanner(test.paths, cfg) + if err != nil { + t.Fatal(err) + } + files := fs.GetFiles() + paths := make([]string, 0) + for p, _ := range files { + paths = append(paths, p) + } + assert.Equal(t, test.expectedFiles, paths) + }) + } +} + +func TestFileWatcherRenamedFile(t *testing.T) { + testPath := mustAbsPath("first_name") + renamedPath := mustAbsPath("renamed") + + f, err := os.Create(testPath) + if err != nil { + t.Fatal(err) + } + f.Close() + fi, err := os.Stat(testPath) + if err != nil { + t.Fatal(err) + } + + cfg := fileScannerConfig{ + ExcludedFiles: nil, + Symlinks: false, + RecursiveGlob: false, + } + scanner, err := newFileScanner([]string{testPath, renamedPath}, cfg) + if err != nil { + t.Fatal(err) + } + w := fileWatcher{ + log: logp.L(), + scanner: scanner, + events: make(chan loginp.FSEvent), + } + + go w.watch(context.Background()) + assert.Equal(t, loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: testPath, Info: fi}, w.Event()) + + err = os.Rename(testPath, renamedPath) + if err != nil { + t.Fatal(err) + } + defer os.Remove(renamedPath) + fi, err = os.Stat(renamedPath) + if err != nil { + t.Fatal(err) + } + + go w.watch(context.Background()) + evt := w.Event() + + assert.Equal(t, loginp.OpRename, evt.Op) + assert.Equal(t, testPath, evt.OldPath) + assert.Equal(t, renamedPath, evt.NewPath) +} diff --git a/filebeat/input/filestream/testdata/excluded_file b/filebeat/input/filestream/testdata/excluded_file deleted file mode 100644 index e69de29bb2d..00000000000 diff --git a/filebeat/input/filestream/testdata/included_file b/filebeat/input/filestream/testdata/included_file deleted file mode 100644 index e69de29bb2d..00000000000 diff --git a/filebeat/input/filestream/testdata/symlink_to_included_file b/filebeat/input/filestream/testdata/symlink_to_included_file deleted file mode 120000 index 40824f3f7d3..00000000000 --- a/filebeat/input/filestream/testdata/symlink_to_included_file +++ /dev/null @@ -1 +0,0 @@ -filebeat/input/filestream/testdata/included_file \ No newline at end of file From 77163970c4e0b23148d583242e3aec477b03e275 Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Mon, 5 Oct 2020 12:03:20 +0200 Subject: [PATCH 124/216] Ignore unsupported metrics in the azure module (#21486) * mofidy doc * add ignore * changelog --- CHANGELOG.next.asciidoc | 1 + .../module/azure/compute_vm_scaleset/manifest.yml | 6 ++++++ x-pack/metricbeat/module/azure/config.go | 2 +- .../module/azure/container_instance/manifest.yml | 4 ++++ .../module/azure/container_service/manifest.yml | 6 ++++++ .../module/azure/database_account/manifest.yml | 8 ++++++++ .../module/azure/monitor/_meta/docs.asciidoc | 3 +++ .../metricbeat/module/azure/monitor/client_helper.go | 10 +++++----- .../module/azure/monitor/client_helper_test.go | 2 +- 9 files changed, 35 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c72c4adb04b..2f956d70838 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -731,6 +731,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] - Release lambda metricset in aws module as GA. {issue}21251[21251] {pull}21255[21255] - Add dashboard for pubsub metricset in googlecloud module. {pull}21326[21326] {issue}17137[17137] +- Expand unsupported option from namespace to metrics in the azure module. {pull}21486[21486] - Map cloud data filed `cloud.account.id` to azure subscription. {pull}21483[21483] {issue}21381[21381] *Packetbeat* diff --git a/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml b/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml index 9369a36b79e..37b1293a2e5 100644 --- a/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml +++ b/x-pack/metricbeat/module/azure/compute_vm_scaleset/manifest.yml @@ -12,8 +12,10 @@ input: - name: ["CPU Credits Remaining", "CPU Credits Consumed", "OS Per Disk Read Bytes/sec", "OS Per Disk Write Bytes/sec", "OS Per Disk Read Operations/Sec", "OS Per Disk Write Operations/Sec", "OS Per Disk QD"] namespace: "Microsoft.Compute/virtualMachineScaleSets" timegrain: "PT5M" + ignore_unsupported: true - name: ["Per Disk Read Bytes/sec", "Per Disk Write Bytes/sec", "Per Disk Read Operations/Sec", "Per Disk Write Operations/Sec", "Per Disk QD"] namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "SlotId" @@ -24,6 +26,7 @@ input: "Premium Data Disk Cache Read Hit", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", "OS Disk IOPS Consumed Percentage", "OS Disk Bandwidth Consumed Percentage", "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec", "Data Disk IOPS Consumed Percentage"] namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "VMName" @@ -40,9 +43,11 @@ input: metrics: - name: ["CPU Credits Remaining", "CPU Credits Consumed", "OS Per Disk Read Bytes/sec", "OS Per Disk Write Bytes/sec", "OS Per Disk Read Operations/Sec", "OS Per Disk Write Operations/Sec", "OS Per Disk QD"] namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true timegrain: "PT5M" - name: ["Per Disk Read Bytes/sec", "Per Disk Write Bytes/sec", "Per Disk Read Operations/Sec", "Per Disk Write Operations/Sec", "Per Disk QD"] namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "SlotId" @@ -53,6 +58,7 @@ input: "Premium Data Disk Cache Read Hit", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", "OS Disk IOPS Consumed Percentage", "OS Disk Bandwidth Consumed Percentage", "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec", "Data Disk IOPS Consumed Percentage"] namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "VMName" diff --git a/x-pack/metricbeat/module/azure/config.go b/x-pack/metricbeat/module/azure/config.go index 63bb5450b57..00f1af56126 100644 --- a/x-pack/metricbeat/module/azure/config.go +++ b/x-pack/metricbeat/module/azure/config.go @@ -41,7 +41,7 @@ type MetricConfig struct { Dimensions []DimensionConfig `config:"dimensions"` Timegrain string `config:"timegrain"` // namespaces can be unsupported by some resources and supported in some, this configuration option makes sure no error messages are returned if namespace is unsupported - // info messages will be logged instead + // info messages will be logged instead. Same situation with metrics, some are being removed from the API, we would like to make sure that does not affect the module IgnoreUnsupported bool `config:"ignore_unsupported"` } diff --git a/x-pack/metricbeat/module/azure/container_instance/manifest.yml b/x-pack/metricbeat/module/azure/container_instance/manifest.yml index a0e6cd5ec27..c767e072a42 100644 --- a/x-pack/metricbeat/module/azure/container_instance/manifest.yml +++ b/x-pack/metricbeat/module/azure/container_instance/manifest.yml @@ -10,21 +10,25 @@ input: metrics: - name: ["CpuUsage", "MemoryUsage"] namespace: "Microsoft.ContainerInstance/containerGroups" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "containerName" value: "*" - name: ["NetworkBytesReceivedPerSecond", "NetworkBytesTransmittedPerSecond"] namespace: "Microsoft.ContainerInstance/containerGroups" + ignore_unsupported: true timegrain: "PT5M" - resource_id: "" metrics: - name: ["CpuUsage", "MemoryUsage"] namespace: "Microsoft.ContainerInstance/containerGroups" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "containerName" value: "*" - name: ["NetworkBytesReceivedPerSecond", "NetworkBytesTransmittedPerSecond"] namespace: "Microsoft.ContainerInstance/containerGroups" + ignore_unsupported: true timegrain: "PT5M" diff --git a/x-pack/metricbeat/module/azure/container_service/manifest.yml b/x-pack/metricbeat/module/azure/container_service/manifest.yml index 1384a268868..b7cf7639d42 100644 --- a/x-pack/metricbeat/module/azure/container_service/manifest.yml +++ b/x-pack/metricbeat/module/azure/container_service/manifest.yml @@ -10,6 +10,7 @@ input: metrics: - name: ["kube_node_status_condition"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "node" @@ -20,9 +21,11 @@ input: value: "*" - name: ["kube_node_status_allocatable_cpu_cores", "kube_node_status_allocatable_memory_bytes"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" - name: ["kube_pod_status_ready", "kube_pod_status_phase"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "pod" @@ -31,6 +34,7 @@ input: metrics: - name: ["kube_node_status_condition"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "node" @@ -41,9 +45,11 @@ input: value: "*" - name: ["kube_node_status_allocatable_cpu_cores", "kube_node_status_allocatable_memory_bytes"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" - name: ["kube_pod_status_ready", "kube_pod_status_phase"] namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "pod" diff --git a/x-pack/metricbeat/module/azure/database_account/manifest.yml b/x-pack/metricbeat/module/azure/database_account/manifest.yml index 39086f6ff66..3436008db7e 100644 --- a/x-pack/metricbeat/module/azure/database_account/manifest.yml +++ b/x-pack/metricbeat/module/azure/database_account/manifest.yml @@ -14,12 +14,14 @@ input: - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "MongoRequests", "MongoRequestsCount", "MongoRequestsInsert", "MongoRequestsDelete", "MongoRequestsQuery", "MongoRequestsUpdate","ProvisionedThroughput", "NormalizedRUConsumption"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" value: "*" - name: ["TotalRequestUnits", "TotalRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" @@ -28,6 +30,7 @@ input: value: "*" - name: ["CassandraRequestCharges", "CassandraRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT1M" dimensions: - name: "DatabaseName" @@ -38,6 +41,7 @@ input: "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", "TableTableThroughputUpdate","TableTableUpdate"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true dimensions: - name: "ResourceName" value: "*" @@ -49,12 +53,14 @@ input: - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "MongoRequests", "MongoRequestsCount", "MongoRequestsInsert", "MongoRequestsDelete", "MongoRequestsQuery", "MongoRequestsUpdate","ProvisionedThroughput", "NormalizedRUConsumption"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" value: "*" - name: ["TotalRequestUnits", "TotalRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" @@ -63,6 +69,7 @@ input: value: "*" - name: ["CassandraRequestCharges", "CassandraRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true timegrain: "PT1M" dimensions: - name: "DatabaseName" @@ -73,6 +80,7 @@ input: "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", "TableTableThroughputUpdate","TableTableUpdate"] namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true dimensions: - name: "ResourceName" value: "*" diff --git a/x-pack/metricbeat/module/azure/monitor/_meta/docs.asciidoc b/x-pack/metricbeat/module/azure/monitor/_meta/docs.asciidoc index 19254f4ada9..9957b6a2ddd 100644 --- a/x-pack/metricbeat/module/azure/monitor/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/azure/monitor/_meta/docs.asciidoc @@ -50,6 +50,9 @@ Metrics with dimensions are exported as flattened single dimensional metrics, ag `name`:: Dimension key `value`:: Dimension value. (Users can select * to return metric values for each dimension) +`ignore_unsupported`:: (_bool_) Namespaces can be unsupported by some resources and supported in some, this configuration option makes sure no error messages are returned if the namespace is unsupported. +The same will go for the metrics configured, some can be removed from Azure Monitor and it should not affect the state of the module. + Users can select the options to retrieve all metrics from a specific namespace using the following: ["source","yaml"] diff --git a/x-pack/metricbeat/module/azure/monitor/client_helper.go b/x-pack/metricbeat/module/azure/monitor/client_helper.go index 82875f46de5..403b971496f 100644 --- a/x-pack/metricbeat/module/azure/monitor/client_helper.go +++ b/x-pack/metricbeat/module/azure/monitor/client_helper.go @@ -78,20 +78,20 @@ func filterMetricNames(resourceId string, metricConfig azure.MetricConfig, metri } } else { // verify if configured metric names are valid, return log error event for the invalid ones, map only the valid metric names - supportedMetricNames, unsupportedMetricNames = filterSConfiguredMetrics(metricConfig.Name, metricDefinitions) - if len(unsupportedMetricNames) > 0 { + supportedMetricNames, unsupportedMetricNames = filterConfiguredMetrics(metricConfig.Name, metricDefinitions) + if len(unsupportedMetricNames) > 0 && !metricConfig.IgnoreUnsupported { return nil, errors.Errorf("the metric names configured %s are not supported for the resource %s and namespace %s", strings.Join(unsupportedMetricNames, ","), resourceId, metricConfig.Namespace) } } - if len(supportedMetricNames) == 0 { + if len(supportedMetricNames) == 0 && !metricConfig.IgnoreUnsupported { return nil, errors.Errorf("the metric names configured : %s are not supported for the resource %s and namespace %s ", strings.Join(metricConfig.Name, ","), resourceId, metricConfig.Namespace) } return supportedMetricNames, nil } -// filterSConfiguredMetrics will filter out any unsupported metrics based on the namespace selected -func filterSConfiguredMetrics(selectedRange []string, allRange []insights.MetricDefinition) ([]string, []string) { +// filterConfiguredMetrics will filter out any unsupported metrics based on the namespace selected +func filterConfiguredMetrics(selectedRange []string, allRange []insights.MetricDefinition) ([]string, []string) { var inRange []string var notInRange []string var allMetrics string diff --git a/x-pack/metricbeat/module/azure/monitor/client_helper_test.go b/x-pack/metricbeat/module/azure/monitor/client_helper_test.go index a15ee0089b9..bcbad0f4c26 100644 --- a/x-pack/metricbeat/module/azure/monitor/client_helper_test.go +++ b/x-pack/metricbeat/module/azure/monitor/client_helper_test.go @@ -108,7 +108,7 @@ func TestMapMetric(t *testing.T) { func TestFilterSConfiguredMetrics(t *testing.T) { selectedRange := []string{"TotalRequests", "Capacity", "CPUUsage"} - intersection, difference := filterSConfiguredMetrics(selectedRange, *MockMetricDefinitions()) + intersection, difference := filterConfiguredMetrics(selectedRange, *MockMetricDefinitions()) assert.Equal(t, intersection, []string{"TotalRequests", "Capacity"}) assert.Equal(t, difference, []string{"CPUUsage"}) } From 6fdb4ba899438c9fbb0e748e1a9643be5dd46437 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 5 Oct 2020 12:58:03 +0200 Subject: [PATCH 125/216] Skip filestream flaky tests (#21490) --- filebeat/input/filestream/fswatch_test.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go index 4979c9275c8..d6286a273eb 100644 --- a/filebeat/input/filestream/fswatch_test.go +++ b/filebeat/input/filestream/fswatch_test.go @@ -38,6 +38,8 @@ var ( ) func TestFileScanner(t *testing.T) { + t.Skip("Flaky test: https://github.com/elastic/beats/issues/21489") + testCases := map[string]struct { paths []string excludedFiles []match.Matcher @@ -132,6 +134,8 @@ func checkIfSameContents(one, other []string) bool { } func TestFileWatchNewDeleteModified(t *testing.T) { + t.Skip("Flaky test: https://github.com/elastic/beats/issues/21489") + oldTs := time.Now() newTs := oldTs.Add(5 * time.Second) testCases := map[string]struct { From 7400f430128ef7aa309c5d9ec4c9e5331f046aa4 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Mon, 5 Oct 2020 07:29:25 -0600 Subject: [PATCH 126/216] [Metricbeat] Add latency config option into aws module (#20875) * Add latency config option into aws module --- CHANGELOG.next.asciidoc | 1 + metricbeat/docs/modules/aws.asciidoc | 11 +++++++++++ x-pack/metricbeat/module/aws/_meta/config.yml | 4 ++++ x-pack/metricbeat/module/aws/_meta/docs.asciidoc | 11 +++++++++++ x-pack/metricbeat/module/aws/aws.go | 3 +++ x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go | 3 ++- .../module/aws/cloudwatch/cloudwatch_test.go | 6 +++--- x-pack/metricbeat/module/aws/ec2/ec2.go | 3 ++- x-pack/metricbeat/module/aws/rds/rds.go | 3 ++- .../module/aws/s3_daily_storage/s3_daily_storage.go | 3 ++- x-pack/metricbeat/module/aws/s3_request/s3_request.go | 3 ++- x-pack/metricbeat/module/aws/sqs/sqs.go | 3 ++- x-pack/metricbeat/module/aws/utils.go | 7 ++++++- x-pack/metricbeat/module/aws/utils_test.go | 4 ++-- x-pack/metricbeat/modules.d/aws.yml.disabled | 4 ++++ 15 files changed, 57 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 2f956d70838..279eda229a7 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -724,6 +724,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add billing data collection from Cost Explorer into aws billing metricset. {pull}20527[20527] {issue}20103[20103] - Migrate `compute_vm` metricset to a light one, map `cloud.instance.id` field. {pull}20889[20889] - Request prometheus endpoints to be gzipped by default {pull}20766[20766] +- Add latency config parameter into aws module. {pull}20875[20875] - Release all kubernetes `state` metricsets as GA {pull}20901[20901] - Add billing metricset into googlecloud module. {pull}20812[20812] {issue}20738[20738] - Move `compute_vm_scaleset` to light metricset. {pull}21038[21038] {issue}20985[20985] diff --git a/metricbeat/docs/modules/aws.asciidoc b/metricbeat/docs/modules/aws.asciidoc index 42d24c65ccd..e02a7a81460 100644 --- a/metricbeat/docs/modules/aws.asciidoc +++ b/metricbeat/docs/modules/aws.asciidoc @@ -19,16 +19,27 @@ module. Please see <> for more details. [float] == Module-specific configuration notes +* *AWS Credentials* + The `aws` module requires AWS credentials configuration in order to make AWS API calls. Users can either use `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and/or `AWS_SESSION_TOKEN`, or use shared AWS credentials file. Please see <> for more details. +* *regions* + This module also accepts optional configuration `regions` to specify which AWS regions to query metrics from. If the `regions` parameter is not set in the config file, then by default, the `aws` module will query metrics from all available AWS regions. +* *latency* + +Some AWS services send monitoring metrics to CloudWatch with a latency to +process larger than Metricbeat collection period. This case, please specify a +`latency` parameter so collection start time and end time will be shifted by the +given latency amount. + The aws module comes with a predefined dashboard. For example: image::./images/metricbeat-aws-overview.png[] diff --git a/x-pack/metricbeat/module/aws/_meta/config.yml b/x-pack/metricbeat/module/aws/_meta/config.yml index 618ed4cd854..6f604138505 100644 --- a/x-pack/metricbeat/module/aws/_meta/config.yml +++ b/x-pack/metricbeat/module/aws/_meta/config.yml @@ -44,4 +44,8 @@ period: 24h metricsets: - s3_daily_storage +- module: aws + period: 1m + latency: 5m + metricsets: - s3_request diff --git a/x-pack/metricbeat/module/aws/_meta/docs.asciidoc b/x-pack/metricbeat/module/aws/_meta/docs.asciidoc index fe9aeea007f..e4e55e82136 100644 --- a/x-pack/metricbeat/module/aws/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/aws/_meta/docs.asciidoc @@ -11,16 +11,27 @@ module. Please see <> for more details. [float] == Module-specific configuration notes +* *AWS Credentials* + The `aws` module requires AWS credentials configuration in order to make AWS API calls. Users can either use `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` and/or `AWS_SESSION_TOKEN`, or use shared AWS credentials file. Please see <> for more details. +* *regions* + This module also accepts optional configuration `regions` to specify which AWS regions to query metrics from. If the `regions` parameter is not set in the config file, then by default, the `aws` module will query metrics from all available AWS regions. +* *latency* + +Some AWS services send monitoring metrics to CloudWatch with a latency to +process larger than Metricbeat collection period. This case, please specify a +`latency` parameter so collection start time and end time will be shifted by the +given latency amount. + The aws module comes with a predefined dashboard. For example: image::./images/metricbeat-aws-overview.png[] diff --git a/x-pack/metricbeat/module/aws/aws.go b/x-pack/metricbeat/module/aws/aws.go index f7b744c27cb..9786c4f7b38 100644 --- a/x-pack/metricbeat/module/aws/aws.go +++ b/x-pack/metricbeat/module/aws/aws.go @@ -27,6 +27,7 @@ import ( type Config struct { Period time.Duration `config:"period" validate:"nonzero,required"` Regions []string `config:"regions"` + Latency time.Duration `config:"latency"` AWSConfig awscommon.ConfigAWS `config:",inline"` TagsFilter []Tag `config:"tags_filter"` } @@ -37,6 +38,7 @@ type MetricSet struct { RegionsList []string Endpoint string Period time.Duration + Latency time.Duration AwsConfig *awssdk.Config AccountName string AccountID string @@ -87,6 +89,7 @@ func NewMetricSet(base mb.BaseMetricSet) (*MetricSet, error) { metricSet := MetricSet{ BaseMetricSet: base, Period: config.Period, + Latency: config.Latency, AwsConfig: &awsConfig, TagsFilter: config.TagsFilter, } diff --git a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go index 42d68acb3af..07e1f09acef 100644 --- a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go +++ b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go @@ -141,7 +141,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { // of an error set the Error field of mb.Event or simply call report.Error(). func (m *MetricSet) Fetch(report mb.ReporterV2) error { // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) // Check statistic method in config err := m.checkStatistics() diff --git a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go index 353ffd0e236..393ddecb07e 100644 --- a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go +++ b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go @@ -1357,7 +1357,7 @@ func TestCreateEventsWithIdentifier(t *testing.T) { Value: "test-ec2", }, } - startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period, m.MetricSet.Latency) events, err := m.createEvents(mockCloudwatchSvc, mockTaggingSvc, listMetricWithStatsTotal, resourceTypeTagFilters, regionName, startTime, endTime) assert.NoError(t, err) @@ -1399,7 +1399,7 @@ func TestCreateEventsWithoutIdentifier(t *testing.T) { } resourceTypeTagFilters := map[string][]aws.Tag{} - startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period, m.MetricSet.Latency) events, err := m.createEvents(mockCloudwatchSvc, mockTaggingSvc, listMetricWithStatsTotal, resourceTypeTagFilters, regionName, startTime, endTime) assert.NoError(t, err) @@ -1447,7 +1447,7 @@ func TestCreateEventsWithTagsFilter(t *testing.T) { Value: "foo", }, } - startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period, m.MetricSet.Latency) events, err := m.createEvents(mockCloudwatchSvc, mockTaggingSvc, listMetricWithStatsTotal, resourceTypeTagFilters, regionName, startTime, endTime) assert.NoError(t, err) diff --git a/x-pack/metricbeat/module/aws/ec2/ec2.go b/x-pack/metricbeat/module/aws/ec2/ec2.go index 36ad9a1ca02..4e0776072e6 100644 --- a/x-pack/metricbeat/module/aws/ec2/ec2.go +++ b/x-pack/metricbeat/module/aws/ec2/ec2.go @@ -88,7 +88,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { // of an error set the Error field of mb.Event or simply call report.Error(). func (m *MetricSet) Fetch(report mb.ReporterV2) error { // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) for _, regionName := range m.MetricSet.RegionsList { awsConfig := m.MetricSet.AwsConfig.Copy() diff --git a/x-pack/metricbeat/module/aws/rds/rds.go b/x-pack/metricbeat/module/aws/rds/rds.go index f8bd907b3f6..b381dcac943 100644 --- a/x-pack/metricbeat/module/aws/rds/rds.go +++ b/x-pack/metricbeat/module/aws/rds/rds.go @@ -79,7 +79,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { // of an error set the Error field of mb.Event or simply call report.Error(). func (m *MetricSet) Fetch(report mb.ReporterV2) error { // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) for _, regionName := range m.MetricSet.RegionsList { awsConfig := m.MetricSet.AwsConfig.Copy() diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go index 7c9d453baca..53248284d41 100644 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go @@ -69,7 +69,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { func (m *MetricSet) Fetch(report mb.ReporterV2) error { namespace := "AWS/S3" // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) // GetMetricData for AWS S3 from Cloudwatch for _, regionName := range m.MetricSet.RegionsList { diff --git a/x-pack/metricbeat/module/aws/s3_request/s3_request.go b/x-pack/metricbeat/module/aws/s3_request/s3_request.go index afe53ac49ba..63b93f6cdf4 100644 --- a/x-pack/metricbeat/module/aws/s3_request/s3_request.go +++ b/x-pack/metricbeat/module/aws/s3_request/s3_request.go @@ -69,7 +69,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { func (m *MetricSet) Fetch(report mb.ReporterV2) error { namespace := "AWS/S3" // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) // GetMetricData for AWS S3 from Cloudwatch for _, regionName := range m.MetricSet.RegionsList { diff --git a/x-pack/metricbeat/module/aws/sqs/sqs.go b/x-pack/metricbeat/module/aws/sqs/sqs.go index 7bc6a8349d0..6dc0774f66d 100644 --- a/x-pack/metricbeat/module/aws/sqs/sqs.go +++ b/x-pack/metricbeat/module/aws/sqs/sqs.go @@ -67,7 +67,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { func (m *MetricSet) Fetch(report mb.ReporterV2) error { namespace := "AWS/SQS" // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) + m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) for _, regionName := range m.MetricSet.RegionsList { awsConfig := m.MetricSet.AwsConfig.Copy() diff --git a/x-pack/metricbeat/module/aws/utils.go b/x-pack/metricbeat/module/aws/utils.go index 67e5809bc8e..d1846083854 100644 --- a/x-pack/metricbeat/module/aws/utils.go +++ b/x-pack/metricbeat/module/aws/utils.go @@ -22,8 +22,13 @@ import ( ) // GetStartTimeEndTime function uses durationString to create startTime and endTime for queries. -func GetStartTimeEndTime(period time.Duration) (time.Time, time.Time) { +func GetStartTimeEndTime(period time.Duration, latency time.Duration) (time.Time, time.Time) { endTime := time.Now() + if latency != 0 { + // add latency if config is not 0 + endTime = endTime.Add(latency * -1) + } + // Set startTime double the period earlier than the endtime in order to // make sure GetMetricDataRequest gets the latest data point for each metric. return endTime.Add(period * -2), endTime diff --git a/x-pack/metricbeat/module/aws/utils_test.go b/x-pack/metricbeat/module/aws/utils_test.go index aef35f57e61..3c480d347db 100644 --- a/x-pack/metricbeat/module/aws/utils_test.go +++ b/x-pack/metricbeat/module/aws/utils_test.go @@ -176,7 +176,7 @@ func TestGetListMetricsOutputWithWildcard(t *testing.T) { } func TestGetMetricDataPerRegion(t *testing.T) { - startTime, endTime := GetStartTimeEndTime(10 * time.Minute) + startTime, endTime := GetStartTimeEndTime(10*time.Minute, 0) mockSvc := &MockCloudWatchClient{} var metricDataQueries []cloudwatch.MetricDataQuery @@ -205,7 +205,7 @@ func TestGetMetricDataPerRegion(t *testing.T) { } func TestGetMetricDataResults(t *testing.T) { - startTime, endTime := GetStartTimeEndTime(10 * time.Minute) + startTime, endTime := GetStartTimeEndTime(10*time.Minute, 0) mockSvc := &MockCloudWatchClient{} metricInfo := cloudwatch.Metric{ diff --git a/x-pack/metricbeat/modules.d/aws.yml.disabled b/x-pack/metricbeat/modules.d/aws.yml.disabled index d0053297885..cc3103643c7 100644 --- a/x-pack/metricbeat/modules.d/aws.yml.disabled +++ b/x-pack/metricbeat/modules.d/aws.yml.disabled @@ -47,4 +47,8 @@ period: 24h metricsets: - s3_daily_storage +- module: aws + period: 1m + latency: 5m + metricsets: - s3_request From d987d103ae888b46b3ae166fa7eebf99feb97a9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 5 Oct 2020 15:44:00 +0200 Subject: [PATCH 127/216] Implementation of fileProspector (#21479) ## What does this PR do? This PR adds the implementation of `fileProspector`. The prospector listens for events from the `FSWatcher` and processes them depending on the type of the event. Possible actions are starting a new Harvester to read from a file, removing an entry from the registry, etc. --- filebeat/input/filestream/identifier.go | 139 ++++++++++++++ .../filestream/identifier_inode_deviceid.go | 108 +++++++++++ .../identifier_inode_deviceid_windows.go | 30 +++ filebeat/input/filestream/input.go | 6 + filebeat/input/filestream/prospector.go | 176 +++++++++++++++++- 5 files changed, 457 insertions(+), 2 deletions(-) create mode 100644 filebeat/input/filestream/identifier.go create mode 100644 filebeat/input/filestream/identifier_inode_deviceid.go create mode 100644 filebeat/input/filestream/identifier_inode_deviceid_windows.go diff --git a/filebeat/input/filestream/identifier.go b/filebeat/input/filestream/identifier.go new file mode 100644 index 00000000000..736c66da2f0 --- /dev/null +++ b/filebeat/input/filestream/identifier.go @@ -0,0 +1,139 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + "fmt" + "os" + + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/file" +) + +const ( + nativeName = "native" + pathName = "path" + inodeMarkerName = "inode_marker" + + DefaultIdentifierName = nativeName + identitySep = "::" +) + +var ( + identifierFactories = map[string]identifierFactory{ + nativeName: newINodeDeviceIdentifier, + pathName: newPathIdentifier, + inodeMarkerName: newINodeMarkerIdentifier, + } +) + +type identifierFactory func(*common.Config) (fileIdentifier, error) + +type fileIdentifier interface { + GetSource(loginp.FSEvent) fileSource + Name() string +} + +// fileSource implements the Source interface +// It is required to identify and manage file sources. +type fileSource struct { + info os.FileInfo + newPath string + oldPath string + + name string + identifierGenerator string +} + +// Name returns the registry identifier of the file. +func (f fileSource) Name() string { + return f.name +} + +// newFileIdentifier creates a new state identifier for a log input. +func newFileIdentifier(ns *common.ConfigNamespace) (fileIdentifier, error) { + if ns == nil { + return newINodeDeviceIdentifier(nil) + } + + identifierType := ns.Name() + f, ok := identifierFactories[identifierType] + if !ok { + return nil, fmt.Errorf("no such file_identity generator: %s", identifierType) + } + + return f(ns.Config()) +} + +type inodeDeviceIdentifier struct { + name string +} + +func newINodeDeviceIdentifier(_ *common.Config) (fileIdentifier, error) { + return &inodeDeviceIdentifier{ + name: nativeName, + }, nil +} + +func (i *inodeDeviceIdentifier) GetSource(e loginp.FSEvent) fileSource { + return fileSource{ + info: e.Info, + newPath: e.NewPath, + oldPath: e.OldPath, + name: pluginName + identitySep + i.name + identitySep + file.GetOSState(e.Info).String(), + identifierGenerator: i.name, + } +} + +func (i *inodeDeviceIdentifier) Name() string { + return i.name +} + +type pathIdentifier struct { + name string +} + +func newPathIdentifier(_ *common.Config) (fileIdentifier, error) { + return &pathIdentifier{ + name: pathName, + }, nil +} + +func (p *pathIdentifier) GetSource(e loginp.FSEvent) fileSource { + return fileSource{ + info: e.Info, + newPath: e.NewPath, + oldPath: e.OldPath, + name: pluginName + identitySep + p.name + identitySep + e.NewPath, + identifierGenerator: p.name, + } +} + +func (p *pathIdentifier) Name() string { + return p.name +} + +// mockIdentifier is used for testing +type MockIdentifier struct{} + +func (m *MockIdentifier) GetSource(e loginp.FSEvent) fileSource { + return fileSource{identifierGenerator: "mock"} +} + +func (m *MockIdentifier) Name() string { return "mock" } diff --git a/filebeat/input/filestream/identifier_inode_deviceid.go b/filebeat/input/filestream/identifier_inode_deviceid.go new file mode 100644 index 00000000000..25254d97fdc --- /dev/null +++ b/filebeat/input/filestream/identifier_inode_deviceid.go @@ -0,0 +1,108 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build !windows + +package filestream + +import ( + "fmt" + "io/ioutil" + "os" + "path/filepath" + "time" + + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/file" + "github.com/elastic/beats/v7/libbeat/logp" +) + +type inodeMarkerIdentifier struct { + log *logp.Logger + name string + markerPath string + + markerFileLastModifitaion time.Time + markerTxt string +} + +func newINodeMarkerIdentifier(cfg *common.Config) (fileIdentifier, error) { + var config struct { + MarkerPath string `config:"path" validate:"required"` + } + err := cfg.Unpack(&config) + if err != nil { + return nil, fmt.Errorf("error while reading configuration of INode + marker file configuration: %v", err) + } + + fi, err := os.Stat(config.MarkerPath) + if err != nil { + return nil, fmt.Errorf("error while opening marker file at %s: %v", config.MarkerPath, err) + } + markerContent, err := ioutil.ReadFile(config.MarkerPath) + if err != nil { + return nil, fmt.Errorf("error while reading marker file at %s: %v", config.MarkerPath, err) + } + return &inodeMarkerIdentifier{ + log: logp.NewLogger("inode_marker_identifier_" + filepath.Base(config.MarkerPath)), + name: inodeMarkerName, + markerPath: config.MarkerPath, + markerFileLastModifitaion: fi.ModTime(), + markerTxt: string(markerContent), + }, nil +} + +func (i *inodeMarkerIdentifier) markerContents() string { + f, err := os.Open(i.markerPath) + if err != nil { + i.log.Errorf("Failed to open marker file %s: %v", i.markerPath, err) + return "" + } + defer f.Close() + + fi, err := f.Stat() + if err != nil { + i.log.Errorf("Failed to fetch file information for %s: %v", i.markerPath, err) + return "" + } + if i.markerFileLastModifitaion.Before(fi.ModTime()) { + contents, err := ioutil.ReadFile(i.markerPath) + if err != nil { + i.log.Errorf("Error while reading contents of marker file: %v", err) + return "" + } + i.markerTxt = string(contents) + } + + return i.markerTxt +} + +func (i *inodeMarkerIdentifier) GetSource(e loginp.FSEvent) fileSource { + osstate := file.GetOSState(e.Info) + return fileSource{ + info: e.Info, + newPath: e.NewPath, + oldPath: e.OldPath, + name: fmt.Sprintf("%s%s%s-%s", i.name, identitySep, osstate.InodeString(), i.markerContents()), + identifierGenerator: i.name, + } +} + +func (i *inodeMarkerIdentifier) Name() string { + return i.name +} diff --git a/filebeat/input/filestream/identifier_inode_deviceid_windows.go b/filebeat/input/filestream/identifier_inode_deviceid_windows.go new file mode 100644 index 00000000000..4ee8d866124 --- /dev/null +++ b/filebeat/input/filestream/identifier_inode_deviceid_windows.go @@ -0,0 +1,30 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build windows + +package filestream + +import ( + "fmt" + + "github.com/elastic/beats/v7/libbeat/common" +) + +func newINodeMarkerIdentifier(cfg *common.Config) (fileIdentifier, error) { + return nil, fmt.Errorf("inode_deviceid is not supported on Windows") +} diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go index 487a5f01c2a..bcd143c1c5a 100644 --- a/filebeat/input/filestream/input.go +++ b/filebeat/input/filestream/input.go @@ -29,6 +29,12 @@ import ( // are actively written by other applications. type filestream struct{} +type state struct { + Source string `json:"source" struct:"source"` + Offset int64 `json:"offset" struct:"offset"` + IdentifierName string `json:"identifier_name" struct:"identifier_name"` +} + const pluginName = "filestream" // Plugin creates a new filestream input plugin for creating a stateful input. diff --git a/filebeat/input/filestream/prospector.go b/filebeat/input/filestream/prospector.go index 257574b9ca1..94670e18ce7 100644 --- a/filebeat/input/filestream/prospector.go +++ b/filebeat/input/filestream/prospector.go @@ -18,19 +18,191 @@ package filestream import ( + "os" + "strings" + "time" + + "github.com/urso/sderr" + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/beats/v7/libbeat/statestore" + "github.com/elastic/go-concert/unison" +) + +const ( + prospectorDebugKey = "file_prospector" ) // fileProspector implements the Prospector interface. // It contains a file scanner which returns file system events. // The FS events then trigger either new Harvester runs or updates // the statestore. -type fileProspector struct{} +type fileProspector struct { + filewatcher loginp.FSWatcher + identifier fileIdentifier + ignoreOlder time.Duration + cleanRemoved bool +} + +func newFileProspector( + paths []string, + ignoreOlder time.Duration, + fileWatcherNs, identifierNs *common.ConfigNamespace, +) (loginp.Prospector, error) { + + filewatcher, err := newFileWatcher(paths, fileWatcherNs) + if err != nil { + return nil, err + } + + identifier, err := newFileIdentifier(identifierNs) + if err != nil { + return nil, err + } + + return &fileProspector{ + filewatcher: filewatcher, + identifier: identifier, + ignoreOlder: ignoreOlder, + cleanRemoved: true, + }, nil +} +// Run starts the fileProspector which accepts FS events from a file watcher. func (p *fileProspector) Run(ctx input.Context, s *statestore.Store, hg *loginp.HarvesterGroup) { - panic("TODO: implement me") + log := ctx.Logger.With("prospector", prospectorDebugKey) + log.Debug("Starting prospector") + defer log.Debug("Prospector has stopped") + + if p.cleanRemoved { + p.cleanRemovedBetweenRuns(log, s) + } + + p.updateIdentifiersBetweenRuns(log, s) + + var tg unison.MultiErrGroup + + tg.Go(func() error { + p.filewatcher.Run(ctx.Cancelation) + return nil + }) + + tg.Go(func() error { + for ctx.Cancelation.Err() == nil { + fe := p.filewatcher.Event() + + if fe.Op == loginp.OpDone { + return nil + } + + src := p.identifier.GetSource(fe) + switch fe.Op { + case loginp.OpCreate: + log.Debugf("A new file %s has been found", fe.NewPath) + + if p.ignoreOlder > 0 { + now := time.Now() + if now.Sub(fe.Info.ModTime()) > p.ignoreOlder { + log.Debugf("Ignore file because ignore_older reached. File %s", fe.NewPath) + break + } + } + + hg.Run(ctx, src) + + case loginp.OpWrite: + log.Debugf("File %s has been updated", fe.NewPath) + + hg.Run(ctx, src) + + case loginp.OpDelete: + log.Debugf("File %s has been removed", fe.OldPath) + + if p.cleanRemoved { + log.Debugf("Remove state for file as file removed: %s", fe.OldPath) + + err := s.Remove(src.Name()) + if err != nil { + log.Errorf("Error while removing state from statestore: %v", err) + } + } + + case loginp.OpRename: + log.Debugf("File %s has been renamed to %s", fe.OldPath, fe.NewPath) + // TODO update state information in the store + + default: + log.Error("Unkown return value %v", fe.Op) + } + } + return nil + }) + + errs := tg.Wait() + if len(errs) > 0 { + log.Error("%s", sderr.WrapAll(errs, "running prospector failed")) + } +} + +func (p *fileProspector) cleanRemovedBetweenRuns(log *logp.Logger, s *statestore.Store) { + keyPrefix := pluginName + "::" + s.Each(func(key string, dec statestore.ValueDecoder) (bool, error) { + if !strings.HasPrefix(string(key), keyPrefix) { + return true, nil + } + + var st state + if err := dec.Decode(&st); err != nil { + log.Errorf("Failed to read regisry state for '%v', cursor state will be ignored. Error was: %+v", + key, err) + return true, nil + } + + _, err := os.Stat(st.Source) + if err != nil { + s.Remove(key) + } + + return true, nil + }) +} + +func (p *fileProspector) updateIdentifiersBetweenRuns(log *logp.Logger, s *statestore.Store) { + keyPrefix := pluginName + "::" + s.Each(func(key string, dec statestore.ValueDecoder) (bool, error) { + if !strings.HasPrefix(string(key), keyPrefix) { + return true, nil + } + + var st state + if err := dec.Decode(&st); err != nil { + log.Errorf("Failed to read regisry state for '%v', cursor state will be ignored. Error was: %+v", key, err) + return true, nil + } + + if st.IdentifierName == p.identifier.Name() { + return true, nil + } + + fi, err := os.Stat(st.Source) + if err != nil { + return true, nil + } + newKey := p.identifier.GetSource(loginp.FSEvent{NewPath: st.Source, Info: fi}).Name() + st.IdentifierName = p.identifier.Name() + + err = s.Set(newKey, st) + if err != nil { + log.Errorf("Failed to add updated state for '%v', cursor state will be ignored. Error was: %+v", key, err) + return true, nil + } + s.Remove(key) + + return true, nil + }) } func (p *fileProspector) Test() error { From eb119c95c1c6300960b203fdae28c92603ff8145 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Mon, 5 Oct 2020 16:09:20 +0200 Subject: [PATCH 128/216] [Ingest Manager] Download asc from artifact store specified in spec (#21488) [Ingest Manager] Download asc from artifact store specified in spec (#21488) --- .../pkg/agent/application/upgrade/step_download.go | 2 +- .../elastic-agent/pkg/agent/operation/common_test.go | 2 +- .../elastic-agent/pkg/agent/operation/monitoring.go | 2 +- .../pkg/agent/operation/operation_verify.go | 2 +- .../pkg/artifact/download/composed/verifier.go | 4 ++-- .../pkg/artifact/download/fs/verifier.go | 2 +- .../pkg/artifact/download/fs/verifier_test.go | 6 +++--- .../pkg/artifact/download/http/elastic_test.go | 2 +- .../pkg/artifact/download/http/verifier.go | 12 ++++++------ .../elastic-agent/pkg/artifact/download/verifier.go | 2 +- 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go index 28e93949fbf..9db442d3655 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -31,7 +31,7 @@ func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI stri return "", errors.New(err, "failed upgrade of agent binary") } - matches, err := verifier.Verify(agentName, version) + matches, err := verifier.Verify(agentName, version, agentArtifactName) if err != nil { return "", errors.New(err, "failed verification of agent binary") } diff --git a/x-pack/elastic-agent/pkg/agent/operation/common_test.go b/x-pack/elastic-agent/pkg/agent/operation/common_test.go index cc17733c656..6e9b042fe92 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/common_test.go +++ b/x-pack/elastic-agent/pkg/agent/operation/common_test.go @@ -143,7 +143,7 @@ var _ download.Downloader = &DummyDownloader{} type DummyVerifier struct{} -func (*DummyVerifier) Verify(p, v string) (bool, error) { +func (*DummyVerifier) Verify(p, v, _ string) (bool, error) { return true, nil } diff --git a/x-pack/elastic-agent/pkg/agent/operation/monitoring.go b/x-pack/elastic-agent/pkg/agent/operation/monitoring.go index fe33de852d1..c4d895eb6ee 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/monitoring.go +++ b/x-pack/elastic-agent/pkg/agent/operation/monitoring.go @@ -161,7 +161,7 @@ func (o *Operator) generateMonitoringSteps(version string, output interface{}) [ ProgramSpec: program.Spec{ Name: metricsProcessName, Cmd: metricsProcessName, - Artifact: fmt.Sprintf("%s/%s", artifactPrefix, logsProcessName), + Artifact: fmt.Sprintf("%s/%s", artifactPrefix, metricsProcessName), }, Meta: map[string]interface{}{ configrequest.MetaConfigKey: mbConfig, diff --git a/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go b/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go index 289693ca373..97cf906cace 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go +++ b/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go @@ -66,7 +66,7 @@ func (o *operationVerify) Run(_ context.Context, application Application) (err e } }() - isVerified, err := o.verifier.Verify(o.program.BinaryName(), o.program.Version()) + isVerified, err := o.verifier.Verify(o.program.BinaryName(), o.program.Version(), o.program.ArtifactName()) if err != nil { return errors.New(err, fmt.Sprintf("operation '%s' failed to verify %s.%s", o.Name(), o.program.BinaryName(), o.program.Version()), diff --git a/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go index 33397a87e1e..9d6c4477733 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go @@ -29,11 +29,11 @@ func NewVerifier(verifiers ...download.Verifier) *Verifier { } // Verify checks the package from configured source. -func (e *Verifier) Verify(programName, version string) (bool, error) { +func (e *Verifier) Verify(programName, version, artifactName string) (bool, error) { var err error for _, v := range e.vv { - b, e := v.Verify(programName, version) + b, e := v.Verify(programName, version, artifactName) if e == nil { return b, nil } diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go index d934b20faef..09462ef3f23 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go @@ -51,7 +51,7 @@ func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Veri // Verify checks downloaded package on preconfigured // location agains a key stored on elastic.co website. -func (v *Verifier) Verify(programName, version string) (bool, error) { +func (v *Verifier) Verify(programName, version, artifactName string) (bool, error) { filename, err := artifact.GetArtifactName(programName, version, v.config.OS(), v.config.Arch()) if err != nil { return false, errors.New(err, "retrieving package name") diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go index 4fd845482c5..975d9ecb14d 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go @@ -65,7 +65,7 @@ func TestFetchVerify(t *testing.T) { // first download verify should fail: // download skipped, as invalid package is prepared upfront // verify fails and cleans download - matches, err := verifier.Verify(programName, version) + matches, err := verifier.Verify(programName, version, artifactName) assert.NoError(t, err) assert.Equal(t, false, matches) @@ -88,7 +88,7 @@ func TestFetchVerify(t *testing.T) { _, err = os.Stat(hashTargetFilePath) assert.NoError(t, err) - matches, err = verifier.Verify(programName, version) + matches, err = verifier.Verify(programName, version, artifactName) assert.NoError(t, err) assert.Equal(t, true, matches) } @@ -162,7 +162,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - isOk, err := testVerifier.Verify(beatName, version) + isOk, err := testVerifier.Verify(beatName, version, artifactName) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go index 0edb979a320..fec1d991c88 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go @@ -110,7 +110,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - isOk, err := testVerifier.Verify(beatName, version) + isOk, err := testVerifier.Verify(beatName, version, artifactName) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go index 9f2eacd9395..c0dfef9b30e 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go @@ -59,7 +59,7 @@ func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Veri // Verify checks downloaded package on preconfigured // location agains a key stored on elastic.co website. -func (v *Verifier) Verify(programName, version string) (bool, error) { +func (v *Verifier) Verify(programName, version, artifactName string) (bool, error) { // TODO: think about verifying asc for prepacked beats filename, err := artifact.GetArtifactName(programName, version, v.config.OS(), v.config.Arch()) @@ -81,7 +81,7 @@ func (v *Verifier) Verify(programName, version string) (bool, error) { return isMatch, err } - return v.verifyAsc(programName, version) + return v.verifyAsc(programName, version, artifactName) } func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { @@ -127,7 +127,7 @@ func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { return expectedHash == computedHash, nil } -func (v *Verifier) verifyAsc(programName, version string) (bool, error) { +func (v *Verifier) verifyAsc(programName, version, artifactName string) (bool, error) { if len(v.pgpBytes) == 0 { // no pgp available skip verification process return true, nil @@ -143,7 +143,7 @@ func (v *Verifier) verifyAsc(programName, version string) (bool, error) { return false, errors.New(err, "retrieving package path") } - ascURI, err := v.composeURI(programName, filename) + ascURI, err := v.composeURI(filename, artifactName) if err != nil { return false, errors.New(err, "composing URI for fetching asc file", errors.TypeNetwork) } @@ -177,7 +177,7 @@ func (v *Verifier) verifyAsc(programName, version string) (bool, error) { } -func (v *Verifier) composeURI(programName, filename string) (string, error) { +func (v *Verifier) composeURI(filename, artifactName string) (string, error) { upstream := v.config.SourceURI if !strings.HasPrefix(upstream, "http") && !strings.HasPrefix(upstream, "file") && !strings.HasPrefix(upstream, "/") { // always default to https @@ -190,7 +190,7 @@ func (v *Verifier) composeURI(programName, filename string) (string, error) { return "", errors.New(err, "invalid upstream URI", errors.TypeNetwork, errors.M(errors.MetaKeyURI, upstream)) } - uri.Path = path.Join(uri.Path, "beats", programName, filename+ascSuffix) + uri.Path = path.Join(uri.Path, artifactName, filename+ascSuffix) return uri.String(), nil } diff --git a/x-pack/elastic-agent/pkg/artifact/download/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/verifier.go index 6aa4dc4abe4..491979514ea 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/verifier.go @@ -6,5 +6,5 @@ package download // Verifier is an interface verifying GPG key of a downloaded artifact type Verifier interface { - Verify(programName, version string) (bool, error) + Verify(programName, version, artifactName string) (bool, error) } From 641d02f5feab7b959e8013821b2e1144c92a43dd Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Mon, 5 Oct 2020 16:52:50 +0200 Subject: [PATCH 129/216] [Filebeat][New Fileset] Cisco Umbrella support (#21504) * initial MVP push for cisco umbrella * Initial commit for Cisco Umbrella ready for review * updating some wording in the cisco docs for umbrella --- filebeat/docs/fields.asciidoc | 147 +++++++++++ filebeat/docs/modules/cisco.asciidoc | 59 ++++- .../filebeat/module/cisco/_meta/docs.asciidoc | 59 ++++- x-pack/filebeat/module/cisco/fields.go | 2 +- .../module/cisco/umbrella/_meta/fields.yml | 61 +++++ .../module/cisco/umbrella/config/input.yml | 23 ++ .../module/cisco/umbrella/ingest/pipeline.yml | 246 ++++++++++++++++++ .../module/cisco/umbrella/manifest.yml | 8 + .../test/umbrella-cloudfirewalllogs.log | 2 + ...brella-cloudfirewalllogs.log-expected.json | 74 ++++++ .../cisco/umbrella/test/umbrella-dnslogs.log | 2 + .../test/umbrella-dnslogs.log-expected.json | 92 +++++++ .../cisco/umbrella/test/umbrella-iplogs.log | 2 + .../test/umbrella-iplogs.log-expected.json | 60 +++++ .../umbrella/test/umbrella-proxylogs.log | 3 + .../test/umbrella-proxylogs.log-expected.json | 115 ++++++++ 16 files changed, 952 insertions(+), 3 deletions(-) create mode 100644 x-pack/filebeat/module/cisco/umbrella/_meta/fields.yml create mode 100644 x-pack/filebeat/module/cisco/umbrella/config/input.yml create mode 100644 x-pack/filebeat/module/cisco/umbrella/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/cisco/umbrella/manifest.yml create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log-expected.json create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log-expected.json create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log-expected.json create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log create mode 100644 x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log-expected.json diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 8a145ff8724..b66c1163367 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -26581,6 +26581,153 @@ type: keyword -- This key captures values or decorators used within a registry entry +type: keyword + +-- + +[float] +=== cisco.umbrella + +Fields for Cisco Umbrella. + + + +*`cisco.umbrella.identities`*:: ++ +-- +An array of the different identities related to the event. + + +type: keyword + +-- + +*`cisco.umbrella.categories`*:: ++ +-- +The security or content categories that the destination matches. + + +type: keyword + +-- + +*`cisco.umbrella.policy_identity_type`*:: ++ +-- +The first identity type matched with this request. Available in version 3 and above. + + +type: keyword + +-- + +*`cisco.umbrella.identity_types`*:: ++ +-- +The type of identity that made the request. For example, Roaming Computer or Network. + + +type: keyword + +-- + +*`cisco.umbrella.blocked_categories`*:: ++ +-- +The categories that resulted in the destination being blocked. Available in version 4 and above. + + +type: keyword + +-- + +*`cisco.umbrella.content_type`*:: ++ +-- +The type of web content, typically text/html. + + +type: keyword + +-- + +*`cisco.umbrella.sha_sha256`*:: ++ +-- +Hex digest of the response content. + + +type: keyword + +-- + +*`cisco.umbrella.av_detections`*:: ++ +-- +The detection name according to the antivirus engine used in file inspection. + + +type: keyword + +-- + +*`cisco.umbrella.puas`*:: ++ +-- +A list of all potentially unwanted application (PUA) results for the proxied file as returned by the antivirus scanner. + + +type: keyword + +-- + +*`cisco.umbrella.amp_disposition`*:: ++ +-- +The status of the files proxied and scanned by Cisco Advanced Malware Protection (AMP) as part of the Umbrella File Inspection feature; can be Clean, Malicious or Unknown. + + +type: keyword + +-- + +*`cisco.umbrella.amp_malware_name`*:: ++ +-- +If Malicious, the name of the malware according to AMP. + + +type: keyword + +-- + +*`cisco.umbrella.amp_score`*:: ++ +-- +The score of the malware from AMP. This field is not currently used and will be blank. + + +type: keyword + +-- + +*`cisco.umbrella.datacenter`*:: ++ +-- +The name of the Umbrella Data Center that processed the user-generated traffic. + + +type: keyword + +-- + +*`cisco.umbrella.origin_id`*:: ++ +-- +The unique identity of the network tunnel. + + type: keyword -- diff --git a/filebeat/docs/modules/cisco.asciidoc b/filebeat/docs/modules/cisco.asciidoc index c12f818caca..d087826245e 100644 --- a/filebeat/docs/modules/cisco.asciidoc +++ b/filebeat/docs/modules/cisco.asciidoc @@ -10,13 +10,15 @@ This file is generated! See scripts/docs_collector.py == Cisco module -This is a module for Cisco network device's logs. It includes the following +This is a module for Cisco network device's logs and Cisco Umbrella. It includes the following filesets for receiving logs over syslog or read from a file: - `asa` fileset: supports Cisco ASA firewall logs. - `ftd` fileset: supports Cisco Firepower Threat Defense logs. - `ios` fileset: supports Cisco IOS router and switch logs. - `nexus` fileset: supports Cisco Nexus switch logs. +- `meraki` fileset: supports Cisco Meraki logs. +- `umbrella` fileset: supports Cisco Umbrella logs. Cisco ASA devices also support exporting flow records using NetFlow, which is supported by the {filebeat-ref}/filebeat-module-netflow.html[netflow module] in @@ -32,6 +34,8 @@ The module is by default configured to run via syslog on port 9001 for ASA and port 9002 for IOS. However it can also be configured to read from a file path. See the following example. +Cisco Umbrella publishes its logs in a compressed CSV format to a S3 bucket. + ["source","yaml",subs="attributes"] ----- - module: cisco @@ -379,6 +383,59 @@ will be found under `rsa.raw`. The default is false. :fileset_ex!: +[float] +==== `umbrella` fileset settings + +The Cisco Umbrella fileset primarily focuses on reading CSV files from an S3 bucket using the filebeat S3 input. + +To configure Cisco Umbrella to log to either your own S3 bucket or one that is managed by Cisco please follow the https://docs.umbrella.com/deployment-umbrella/docs/log-management[Cisco Umbrella User Guide.] + +This fileset supports all 4 log types: +- Proxy +- Cloud Firewall +- IP Logs +- DNS logs + +The Cisco Umbrella fileset depends on the original file path structure being followed. This structure is documented https://docs.umbrella.com/deployment-umbrella/docs/log-formats-and-versioning[Umbrella Log Formats and Versioning]: + +/--

/--
---.csv.gz +dnslogs/--/----.csv.gz + +When configuring the fileset, please ensure that the Queue URL is set to the root folder that includes each of these subfolders above. + +Example config: + +[source,yaml] +---- +- module: cisco + umbrella: + enabled: true + var.input: s3 + var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue + var.access_key_id: 123456 + var.secret_access_key: PASSWORD +---- + +*`var.input`*:: + +The input from which messages are read. Can be S3 or file. + +*`var.queue_url`*:: + +The URL to the SQS queue if the input type is S3. + +*`var.access_key_id`*:: + +The ID for the access key used to read from the SQS queue. + +*`var.secret_access_key`*:: + +The secret token used for authenticating to the SQS queue. + +:has-dashboards!: + +:fileset_ex!: + [float] === Example dashboard diff --git a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc index 08dc160fab0..aaf285680e0 100644 --- a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc @@ -5,13 +5,15 @@ == Cisco module -This is a module for Cisco network device's logs. It includes the following +This is a module for Cisco network device's logs and Cisco Umbrella. It includes the following filesets for receiving logs over syslog or read from a file: - `asa` fileset: supports Cisco ASA firewall logs. - `ftd` fileset: supports Cisco Firepower Threat Defense logs. - `ios` fileset: supports Cisco IOS router and switch logs. - `nexus` fileset: supports Cisco Nexus switch logs. +- `meraki` fileset: supports Cisco Meraki logs. +- `umbrella` fileset: supports Cisco Umbrella logs. Cisco ASA devices also support exporting flow records using NetFlow, which is supported by the {filebeat-ref}/filebeat-module-netflow.html[netflow module] in @@ -27,6 +29,8 @@ The module is by default configured to run via syslog on port 9001 for ASA and port 9002 for IOS. However it can also be configured to read from a file path. See the following example. +Cisco Umbrella publishes its logs in a compressed CSV format to a S3 bucket. + ["source","yaml",subs="attributes"] ----- - module: cisco @@ -374,6 +378,59 @@ will be found under `rsa.raw`. The default is false. :fileset_ex!: +[float] +==== `umbrella` fileset settings + +The Cisco Umbrella fileset primarily focuses on reading CSV files from an S3 bucket using the filebeat S3 input. + +To configure Cisco Umbrella to log to either your own S3 bucket or one that is managed by Cisco please follow the https://docs.umbrella.com/deployment-umbrella/docs/log-management[Cisco Umbrella User Guide.] + +This fileset supports all 4 log types: +- Proxy +- Cloud Firewall +- IP Logs +- DNS logs + +The Cisco Umbrella fileset depends on the original file path structure being followed. This structure is documented https://docs.umbrella.com/deployment-umbrella/docs/log-formats-and-versioning[Umbrella Log Formats and Versioning]: + +/--
/--
---.csv.gz +dnslogs/--/----.csv.gz + +When configuring the fileset, please ensure that the Queue URL is set to the root folder that includes each of these subfolders above. + +Example config: + +[source,yaml] +---- +- module: cisco + umbrella: + enabled: true + var.input: s3 + var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue + var.access_key_id: 123456 + var.secret_access_key: PASSWORD +---- + +*`var.input`*:: + +The input from which messages are read. Can be S3 or file. + +*`var.queue_url`*:: + +The URL to the SQS queue if the input type is S3. + +*`var.access_key_id`*:: + +The ID for the access key used to read from the SQS queue. + +*`var.secret_access_key`*:: + +The secret token used for authenticating to the SQS queue. + +:has-dashboards!: + +:fileset_ex!: + [float] === Example dashboard diff --git a/x-pack/filebeat/module/cisco/fields.go b/x-pack/filebeat/module/cisco/fields.go index fac83c30f27..de57daee50f 100644 --- a/x-pack/filebeat/module/cisco/fields.go +++ b/x-pack/filebeat/module/cisco/fields.go @@ -19,5 +19,5 @@ func init() { // AssetCisco returns asset data. // This is the base64 encoded gzipped contents of module/cisco. func AssetCisco() string { - return "eJzsvW1zIzeSIPx9fwXOEc+52yGzx+2XvfHN7oVWkte66W5rW93tfS4mogJEgSRGKKAaQJGif/0FEqgXVqFIiQKK6r3xB4ctkolEIpHI9/wW3dHtz4gwTeQ/IWSY4fRndOH/N6eaKFYaJsXP6F//CSGE3sq84hQtpEIrLHLOxNJ9HQlqNlLdoZyuGaGIy6We/RNCC0Z5rn/+J/i1/edbJHBB/ZozrHHzCUJmW9Kf0VLJquz8NYBG/c8vAB3QcVic356jX5iiG8z5rPPVGo32LzUeBdUaL2nG8h3IDpU7ut1ItfvJHnQQ+rCiHUw8bMRyKgxbMKpanAKo6GqxYPcPRIPe46K0p6Wp1kyKh+P4G/wdc78ewgtDFfr/LMIPRVRWitCMCUPVAhMag3K3ABM1MOFQzYqiBZcbJBWiayrMXrRyqg0T2MKPi9tlC/hJCKqK08z+Zwyk3uGCIrkAFM4JoVqjCymMkhy9YdrAYsissEEFNmRFc2RWTD8AS3+6laYqBa4WrsOLafiDW8+T80EYdg96MjQ7iz4G1wKXJc2z+sqUATx7fzwoYIzCQnNsaF7T7voG4TxXVOtH4LKS2jyYagtccZOBGP0ZLTDX9Kk42+UfgW0pVQhbLsXyqZhY0A/BZEe+RD7ILnc97jS7WJ3qSLvYP/Rcu3inONwuTgdP2KwUxSbjdE15HD3AwkMAD6RFgfkGK4peobk0ghqL6WLByAz9JkDmrKnafsvl5gzZf/XAFTKnCht6hlZsubKPDXzd/s9DtkWwoUuptjF2duFhNc/f+M5+sY9iraasmar0mf9Of39Gyb9jcYaoIXv3Q6QQlLgLGEVf+yjY56qroMG2MLzpezFhpCgzu2gAC73qs/NeHK4v3t7ALw8vSGQea0EL6qG0HtlnGrHy6eZdZ220s3ZIF8BlpiiRKtePQ+QJGj7Wmi0FzdHl+Q3qLx4kZVFgkWecCZphtawKKsx06PrlkV0eNctbE21JczTfwjXmkmCOcJUzYz/Zt516+/1H8IF7eOwr2T6HLeGNRNhxCmdUGKQr0IAXFefbhnvE3l2Uiq0Zp0s6k/yRPHzkWfy+ogJh0Cx1u7zVL8kKi2WtoXt9U/IcrTGv9nJ/uwlBN89wE4JuDm9iXiltZnL+d0r6UizdpVDUqQluWRD7gAfaYCWYWO690A5jNg3bdLG1SgC6vjwKXVIpRYXJLIzpZI9b1CML6GtKxQOwlWLBlpWi+WkQbtfv4H4YbbxengZfvKYKL+mTCH0y5DvEDuwDcy43NH8IhxcVx4ataUZkJaYTJkYazBGsaXX5Du4rZjTSTBDqhLqTNhusEbGquRVAChFOsepscNdHujBdbJ7uI/2FKVrKDVW1lXJJF1Ro+kwcp798uPyyHKcW4X84Tv/hOP2H4/SLdpyij5qiq4tb/9FMYDNj5T/8qUf6U0PkfMaO1gbdzuePYIF/OGEP47TLFn06/8NF+w8X7T9ctDsLHnTRakoqxUyIaYLelHbB3nLv8cZr+kDcWw8XXdlXen8U6gt3E6dEca+beNfGY1JHtfGuf7ttUnDqf8ZNOQxacMbZIx6uB2qD9ol1OraFvpeTFpgwHubmvXbc7dXF486lXggZiTYrRlZOSHqbU9EFVRq9WLSi8Qzdvnt7c4Zu///bM4SFVXR6YBdSmdXLGTpvgRMs0JwijFZY5SB+XWrUGcKoVNJIIvkZAlFWuKwquejLXKvkb7WhBdJyYSyQGbo2KKdCGrpjBHhJT3ClG9q7n/bfKbfN2YARfQLXrLHTZj3rQK6p2ihm7KOlKjrg1+EhHbhCew6qy0J1ZllrQG5WVDl/in/I0AprNKdUIDnXVK1pPtyf2kk1O7SZ4eXbu5XxuwVYC7yrsoyvPrZ+aImONqeXvWPet8K+W9U7lQ/WVrujW2vLVdoFXgguTeXpr/CmuThg8xFZUG03Le3nPdAIvZFLdEntw6bCG3GwWB+pY7dTwwVz02q7JDJgj3Bi6nuSuxtPpDAQwJMLxIQ2WJgaDR3E0bDiGATzvic4hJ238e0SCBsvTnHtW3PuT4zeUfM7M8I+A/70ZwPWaDarV7LiORJ0TZWVoDXflVhpit5Sgy1qGC2ULDpLvXgjl/rVDSZ31OiXA/CXTFFi+PasiU9h9J46YeE4XHTQnAUJObQ9HkbJgQnVo+QlLRUlYDBZTHK6YFZtkIIDWgbPuVXiyzBWhV72Ve24HOjP+K2/59eX37mYnvfy1Iq5+xa9xwQiyO681OAgYHcMlDbHLfA9exwlVoaRimMFv/cHOxvljAHoozglxBkDyOOcMnok62nP5PU/zmT/mdhV0xzI066vnP89g430j+XZYLfGxwi95Kgp6nTf54ibJVuq+/80zLTBhha0Fxx9JshB+lFGOO7d4WeCHhWm56F7JoitBl6nZ4IYE8chllZjqiXH8+W0nOJjpEdasi2oixjEsqFG9JqQndn5Yu0WsNgM9JCBkvA0K6KnhwygH7Aixqk4CLxOQkXR8aoEyefINdhmJPKhAAUfTT4yhVpdDWIO9f79n7a7Ru2FFMQ+DtjI527ZjoibNUsrDrvUvbDLsAUjuHuf38ilizfUGS2VyKkCZyn1gmqw9QW7pznSFLKudn68u4YeN1jqQxjAfrLB0hzCAPSjDmXoCYzvXzqOMQf7egRNHkeDQUg9CV/+KrXpikje50hNRc7Esv5Qh9im40P6cujLjmGwwY9GCXt9s/6hyeEfu+594g52b+SXStz1T6nJ+9P/u+QdRJ2TyIa+XHCOtK63LEcYLdmaisZJ9uUqApZEx/kv0log+XNU/r6MiMaoQ0OW20zRzwnOuhs8hAOGfft6syu3NLqBi3TmvdkGow/bkiKChxJkThFlZkUV+ngtzHc/IanQL1xi8/1rNMcauKgOkEE1Aah+B/Z9jLr7Be8bwqDpjM8I/oVgItwk1nG98hfvYJBqg9WgOjOa1tGRaJ1tdyl5ffNpR9/DUL/WP1JU57a4R9SjDen21HGqdsSDwhnFlgxqL9xvdrWVA3RIpX/tSYy4vvn0U4AE4ZwcFIEEDUZDKsd4fVpGHSqOx74+K4pzqiaJXf8KS6Hry6dESR2+3WApgDkuVvqsnWycZMn9bLhWtK5bRQsuijVdLiTnlBipvkQBbKl3gpwby3NMI+JIR3OL6Y6i+kb21Ra0h9DP0OIryPy5qKqF1JDsVkiB5tvBoSGk6OeKaiiC0qwo+dafk/0yJOpSTFZIs5yiF39CZqUq9PrHH19CaaimVDSr7KHEs1BeH0AJXUqhaTpSkC+GK1yJcO1TqIq5E3r2KusgBPQCz+WadojBRDCzshZv2iiKi9H7Q74YtjkxqWjOqr6eFoNQX4U0x8axwBaImb9Vr//03Z+1E+mvShCgNdJ/G+zmb9YefIO3VKHX6EoQXGoogpcCTMpHyfUQ9CcGPwK5laFVvn+N/sVu9wx9/z36F0SkgpYXcExu0TP037n5n/aLTKNdonwVPEIh80DR8DOxdcWGZgRzPsfkLq0G7JCrCwawcXaFJSIVeSmZMHV3kSCiwBwZVUomyk9r9UFdUsIwB4wBU22kspq12Dqtw36wxpzljjFCSCG0kJXI7QvDKSDPxNIrRweTF3dvxAByjFigvw57wkYjp7DlEufP5Z3z6CDN/qCooEYxErA6vCnc/TLYwu65r4WwffaxaTVauaiPbYZ+lRt7NEObkwkklTXGjER3lJYHiPYsXrwvhGhKQjHYmuVZnirqelVLniUVUDWroayqcna0twvXTJkKc2u07/jeRcDFwQpmzW6IlQMx3C78Vb++RMpKaw0OFSAaVktqmq8dpIRWiZKeTk6JumZ/HyVUklDQUPBfX9a+1/e0kIaiW8/vda+c+XZMUCLoNuICMV9A4MWvlOmSs5SZDc/anNdsoPY/C93MytyE/A63zr4BdZmm57raavFPyH+NCKMTLwvGTxCjt6ta4+jm4vzG676+KJcVpVR9jRfBE/nFpUFUz8P94ds0gCE+bL6GnCt115Sv2p+0BrvTc8Ayn6HXP/6ENkD3gmKBMOdhXwE49UFNav1HaEOV64GHoM0H1gZJ0SsX2SXiydXEL5uIgbuaImzrafe7VDkQDrKaKFkJyeVy2w/ELZgaaLEI/YjICitMjCOivdRbwB+c5gJVwuf08B2f+WhFbeyCbheoTxlE2BO7BIuisEqmFHUYQeHNqEwDydpTKzEBjdXFKIT3OUhCoMcjQNQGixyrHAmpCszZH6H8XqmKIH1yn+VwNIlkNR88SY8iUot1g8wrzhYUdhww8DUlUuQjCnZ73Jk2Kf0sezbEBJFFyakJMsCoExWDAm8U64nBTr2ZMidi5Fu7dpCdx1h5lzNH2a+QwqwiHVNbnxor56XNcspPRPgrkacguwX5hxSpuy3sEYt29VrFdOm1H/oUHoioZDf6HBl6b/zlQ2uqdKecIt+XBxY436cy25biWNtsy/SIVDnN072DPsnGP1O6WbHWMepMm+aL3fj68LVSspgB1AqK8jWhAismnVpfVNywbw2jCuGy5HX1S9vLpsACL0OluQhxCO/stPWpG0ohZr7WSG6Ei4wZXJR9z6DHGPpvKjlMPmJGI7Ji1rqROdUz9LbSBsykLlB7K7EZycvFhh55SHsF2GJh8V7TKTQhOOR6QUc7aAVFBXEMga1qnbM1y61mA/wQFmS3tSD70CNeeJP3JVOT7bA9TxcLurecyAzf1n2vjAR9zSLlmjPu9Y1GPPRRF86ZlcaNPJsNlmzSyWQVWwIVA0XuqRAb+se+KqBBfq5oNRkrWe52XNTKxw3WCJDIR/gGkPsuNlEjKgU7BE0g05aFSfD6LosUuJZZAlTLLIX2XMYURbtAX0eHmkBX6rwipzEhe+Zj8I0ZPJePenOOFZuH5NoxwYL2geh1Q4jtCMJkoMTHUKx1xVOHnUasKFkZIgv6yuHQGC+QlT1ogIksXzgS7BiQIwxC13TQDneyjdWr+yLATmRnn8snbfHioHege6WbShcLDeJOJSVswVrDJ6zd+lbuIzzldeX02UyBA2hcjCxvCyZqF1XugyxBvL3ZPNUhfNq10ruWoFTot1ufGst0nRDQ96sh3xe2N0AB7VRJ6lJqFlFwPIi3wJwWueswBan89d0d7cJTcTNsmH0qUSSqgipGHiuLgnuboIptz8a6lWzNzXBiyd3vwdbWVORS+YTZvTuT87+foHtNHdoNtDXvIpa+FnxAbitB9yPmJH3KXnVfDS+kr/r3YsZ7uVa4yS0W0iAMYyIskuEEWi6XWZ2ochKhXjPio4X6FD1TdmTfv0O6FXSt3h132MWqlJyRberbs0cu3AACvrm24NsRuRwctpSYgO8rTgGxsDiVwtD71Bprg9C1cP66th8qznNt/wWPKox6A4RCDWAOPM5uSmbWH9eZQBaMBS7rkZxNrxBsjGLzytCOhBjm6PsBn1Zb7z5/YdGhy/4EsadbLW7U6/Q3BwzBfn6Rnzvb0d8Cxi1UgFmC1Q0HdZvzpdZUzdAtdYdSaapmeEmhlbfPdF9IVeMwgF2DcXo7cUO33O87fSukQnMlN/az+q9e13Rm12g/6ev8BisT203XAI7tUfF3qj/Hd7o71czqTXilZEl9QDHVW3wuEOZUmSa7SLWL+r+58JYXH50mAJCEFFCYcySk+FbRkoIlsy/7AcyGKZ+cevhoY6+YZkDnK+YibHX4Z7CzDTMrryw7WY8uYcE5VJsIJMW3S2n/e89LAEpKFlAcE+4bd4KBrwABi6RcICsdDKN6hm5bmdIfbNCtrEqD8YUr56u0NWJcyahLtsm9+PWEx4jwSpuaIf3/DI4JfsK0PUlfE+39G1bxhU/HVaDJtR93w8IWvWvLlE4p+/qQ4WWxvAQsENZaEgb+UnsaQXsSDuwNu6M/I4zK1VYzgjnKmb47Q6WCmSgwSuzrsKKMFT6m9vKRD72rs1G4oAaGmWMNXbw0NHJwvQjq0flyJ2g/LK3ZmYqGhk+Tew9OpfF1zjDBw+TEN5FFWQ3vYIJjw2jDRC43Pp+WSEFoac6aTIpRYgy2uag436LPFebO+ZnLAjPhpYboLMTlyNPV9XrGUpf2bN2qhG+YuKO5rwWqE9GxBu+UN1DsJ181qM1Yvu/g+KArRFJR153s5NwSfQRq9H67PRVev5Xe84puh+16mqAzVQXrD3ZK7WL1awK2jv/3a9rfR9a0F4ynv+PNln+B1ZprrGheEYrqyBENu9s0VQzzLPCaJntEbmHJWm3uv4+dB9C+MKN+AUru9FEtB2J4jP3q9qFbYb1qbqhVCwNVhhVZuczfusamKTO8qCH1WoTZjTTLzLQiMPi+/v9hpSmy8lwgBjl3lYAR+fZP0AivRc0XELZD8Fxh5+HogxN+1bDP07N+sYgs5vU8XbnYebB82ah6xOsFA1+n9vR1tRFAYNzjN02ANHAlLtzqrifjuKfUWXDJXeMN+ZyX+foSvXOS5oVv3IDctD1f9GtxexnWq50D+hS+/I77+foSSOpL3hoxMfQe7EbkXBqg28LMMZGVBRumw0bqWm9T9rLfjer6Am2nLuz1Y48MR0586S7aSbnXlwc12Vj+uQOarEXstchbjXaGLlx9pu93yt0H+7VZQFDtfuO7r7w7bl6ZpnJTmuYxqgSn2lFGugdlI9EaK4bnfFAF6JoyMIFKjkcEgaZCJ+2PsnOgXVXVrTyzkspqGHV9IbPnfPvq+qavQyPfMtZ5FMbqso8cKPjgWsg20uKQRNfCoFu2FBiExQiLllKlbF779UB+WSa9qXU3CV0d4T8tIt3h05bLchlgnHe/fUBMEF7l1IozP8jWDcJ/cVUPML5xDhEHFqT3LOwXgcjc5LFNcE61T0sYM6bvrMp9BF6PKMXruDHf+afhPdN3e0KuRrHlkqp0I+zCJPvUjQV4HNyIZkX1SvLcco+z1Ucmje6E3ifwLAxj714qv3jvdIyXTTOO68twGcmDo/NEFmU2cd4VnIrPvYIxrs6/p6v5txYdKaA+deFmc+cVGbPSvFp6oqyxLuaNtJQKOg9YuV7jNzIlzg8iP4kCOOyqv4DZ5+4hspsYaY38wgpRjN5iUvdTDiu3VgRNasdI8W2toKr9UsjZmtGHWiuKdfTcYG2wqWIpzo0/CjN+MrPDLj6X94jlr8bfL/uyVlNgaDH6OGh87O6CxSJ8det3LPH0vQGTXw7n7h3znDEhq1gxzk4diV5Gv1NWksZ0Ogw8sj9EBpy6M+MOS5xzbuUe0hUhVOtFxdGVXR8RmVNtWaJu9hu2LJjI6X1kAnCmzXGa5xNlCywMppiqkZhTBfHNAivGIYMn4MFz8XexRBiI+K39bXBnIgEfyrlrLnQijdivjl40+ZwlVbr0RbdOwgxI5lWENiG+7vD0cqTI0Lm5hu9x6oQSp3w1SV7eV+W+bT/ETGiUU4MZDzgZ5rIynd+NbE3yyXMza48tbvLYAI/xh9TQouTJsnnOUU4X2IeAfOfLOobvszWtVrymiuMtFHIZ6R9X9CJwI+0HYHX7X9NFXQXufPXaMFNBY0YU3FhrGwwbNj31ukaNYnX8OwTHxjSBrCKyKOx9SsNGFw46Yp1k31LJNcud/6zuIldQPZoIlUtyfKDx8d6yXxhvtUbSzcsLqwb3JSQ9nUbW16unlfV/l/Mj/U5Hb+9/y7kPwIRvV8nSNc69hIRid/K3N9foeqBQddFI1rXWV5fsxyBiYVdTDbuMakg/xh/mc6vDyr0TEdlc5qkrvgYVd32lw+OCLC4j6tEqfrcEFzKYoPK84wL2pcMugbaJh7Aly5tQzogTr4htNQ7KwCO8/PGUvGbfZZXymaqne998dN1z6kAUJGvcU1J1vQgu9WtOQ+WtdRemfYkbEzhCgl7xfNch0lRX4jVmHA8DGahxhSOor1xQpUYmLbg7dIyvP17czRsrhW8A5QKwgy35dAPNlrMRiciKbF7l+Ta6f4YVWdQ6oA7cStPjGp3v9VLFh6iYjNjloFdil+lqioIEprvZq67nKq5yZprKurYvmscoNNiurdhwoqQNL+zfpMsSi03B9WRW+cWnK/TC10p8qrjVleeMQwEH5IFd3ZdS22++RN8OHQ2iH4W5E3IjdgwhTUkFzSzWu9BHJm0SPIELrp8WelFXub/zpUlv6BKTLfo4aq5xNlf4FEX5fuEdEjOBCszEQuGC7k3HKLGCqb3p+yTsKJc3sCx6J3OXHN22BexknQWQQge0L0gVsIRIZSHt9o17Rzfo10qAKflW5pSjF0ysZ9+cISbJGZrbf1H7Lyww32qmZ9+E44uGlNmC48Hk/Ng61K6Gf3GDYFHwdYGc3NbDr+Rib6MGI5Ni6v4693jWbRA0VZaRgwiti7hyt4fZp7e/Y0XRB5cA/M03n97+fv7+6ptvXM7tGivMRnlyI9VdzJLlgxfs93rBboRt1AmGRWwlwtfsxO1S0jwHmNjnYpvAhFlIRYVmJKYA6biSEmBcxPeCBOIDsYBmG8yGw4mf7B2A3uexgdrrE7tEXVfzRJfCzHNtVOzKd6jXTuYQ676l0d7RuuYjnZP02GKXdjDYQKXxxSZt3Yuvd7EgFmzU0VRvNZkj9titBrsRBbbZL+8JC+Wj+wk+3nFhkff6//vhqq3K7Cb/nYTF8o6P3iOyF8mTMEcdx92Hn5QTJG3tnGzHLn1hmoz2OssO+mS+BLfbgHMPR6brltVsingYFH0tMOOW1nUzlxsvM64vu7Vt0InLmoOGLgMtDMazCuuc68yqiEfs55jEa0i39tVHF7IoKtH3RA2wE8c1bnoqdu/ovfl3GtapG9z0cZr1U3G7xSL/NxmOmrW4GWzYMZLhydgNF95BTle6ZITJaFmiU1nwgP0GKzEMOjx31LUoykymEsa3797eoN+cH7VNSg0j8nnSVILb/3iDPldUjfRurbjIFO136kyb3NBxiG7R+7roLJjW1WjpJOJD2gUqY48RsEDLoxxHh6CaQHDsyXDz+AMaMMeqSHBaFmwC9wIuIxYgN0CrPNpU2h2Ycbtd7YDOselrhU+FO6eCrAqsYpWVNHC3JR6ML35y9AmTQTpVFJjZKjovELqIW0DVAF4sodVSArBy/vcEUEscfRKG6zgVnb0g6J6x2A+O79xWUKt6RkdaZJjAYJT45ScWthYRjfcO4PmyXP8g7s0q+vtOREaMynIdte96B7qFfFzk6QGA1xxHlxgio2LJRMSiyCHoFLnRIltkesMMiS4/RLbgcqNxET93pQtbmHU66AmiLkRkTKQUJ0yUVBXzbbSE9wHsktylAb7GPAWvsDIrlTQyix+SAujrHzLwOMaHzZPdTS6XWZ6C2BZw/Pw3IrIC32fGxHIb7AK2HM1pgkehYCIR0kykQ7rkOuNznsUOi+7A/lNC4NE7g3dgx+6F2IUdu6q3C/vHhLB/Sgj7nxPC/h8JYf85DWwjS47nNIVIaaDHN89EVlQclO/5NsE7WQMv7xLoJUXF2bIo02jfVsvEfBk7CclDZimUEk0/k/i+EZFpl5CY4AS1ImmsSQs4jTWpt7oqE8wiJaIpq05iqhpprOlB7xOIECONNcxSwQazJgnwSrB7gYXUlCRgwvVPliqJHoX1T7I0K4rzBG41WZQZ4Ql82BZwgiAJwFXzrYnvFrWQdRLIZZUliGkQxQwjmCcoINIZXlJBthGzrrqwBebbP2g+T4H3OoM2oEkgu3YwabB2ibVJoM+X5fqnND5onc2Z+XOSRmNEZ3FnxfUAKxldVOsk1xygUqLiV7lp5+OPNmurA5ialfPzx3eOOOCg9iUB7rrJx+sg14G9YJymsGF0tkhxiGwRszh7F3AK3UBnrIQkxSyJqGPl+odcm3LQzD8SbK1IEticLWgKM0aDo7mgOYtWMLoLm4k0XFLIvOJUE5mC2h44WyaQTbLUG2yizvzvQA9lkEcBrOiSaaNwfE9ICzuBxqdomYrUKhmtNXQiV4nkq8vMdyyeALpRFBcJFElXCpQK7XTK9WYlmc7chNn40LdY4SQMno8UwsaAvHbz7WPDZdpgEX3Oca7NvFKxhgXWUKmbFZQCahUd1/h6dF2THBssTG5YxB92fWyngX0wlzjPY98BlscOq9atgxK8RazIiJKySNKVyAJOYKaxIkuTHOk7HqUgc3kXvT1TqeO3LGWlLhWLDJRjw0wVPfuMM0HjtdhpoeqoE3UauFB8G9+txaXrepotuIz+nDfAE6T8W5s3utSxQBNIHGtDJ0A1em4Cl8skrCuWSS5wKVVsAVbMq2WKa1YwTVKIhUInYdgUcyAENdBcKTrc6DLcNYCOnfHnoMZOxxObTWwLJElFmXQDoKNbojK+ZiQVW2aBeVxPhrsRVMV/s8rMDeWNDjbqZOoWrBvxmoTJEhRu+pk4sYWBBxtbGpSZcyRFRxdrbT/MyCpWnf8ANL0vWfRAQElVsVRYmEHP3RiQN0kAx396XSeyjx97U0AjAFZymWFdRhwY0AWtcGyoimKeQr9TlAAdXNfRRMDjE9lCjtvCtQNZqjwBxvEdmTqBb1g733CCfABNYycCuIHHCYwTTT/HZ4BQg9ZoUBOYUpotEwheXcb2smlFUtwDRfLoirRWJNQVNwJgE2/EVhdmpaN31VwTEbtQIjgt9qlAXZPO2Ns3SxOfrRzQ+BG9ZqZnbLjbMnq31iqfJ8lDrxRP8BZWmqosZ7Gr3pOMragjQynIYIg2uIjtDV5nTGiDFwk0gzVTJoUavi5FgtZNRqpKxHSzhtqiBTqKnldGoveVQIOlm+yRhMPyPmHOcnShaM4MusAq990MNbR/D6PjJmclpNLYhFAAA0P0EfQ3IJKjUKlOkw/BRDrKXRUll1s6GCx4kH4LWUVr6v1AHrM0dD4jmHem6JLeowL3Gy20sVixrPrDQJIjyZmG4Qz16v7ooYES0lVZSmXQsPEoQpsVNogZVCq6GGOFJ6TlPmYIRYjw3upoUEBM+M7uI32hOROpJ/J3ULWrdfHUyMglNSuqZu339UpWgxcNIUHXVDXjiIxEJVaaorfUYJgI7u4qbkjw4o1c6lc3ruz1Jbr0I77OkFkFphRBM+D31I8+BrQFekfN78wIqsPnPGTqJMRbwMju5hbB4m6zmmJFVjMmWBA/mLk7QX/tnviEWRiQDPGK40rArN9lBXNc6ybu4QbuvX7te/aUvh13s6emCbefXzxi7NuDyCLWND2s8yosiz7QewO3YsxdMMU06hGB1A6uewcTqgUfmXgJ3XMTjgOH/rmaGqTo54pqs6dp9/HZyo/vle9UBhjL41Z1ErvvkWryTnfdKftwchhBbGzn79ChXf8c3HnM2f+H5xvaxa4va6EAa4d5A6yGeEm8j2Rh+7jMsabIpWs32KDBrWpOyf/iNPiKZhR8g7lUrn19kIwIYY00pTDuDO+fV6Ww0JhMMN530GHaLS1A7W2ZhlQKJqDtQ7qkqmBO3ZgK6XZJN5iDrRmnS4o4XVOOsNZsKdzBtfP6w6wPLZlPKL9h/T2cPj/JpGeLWSXY54r2xyTi8OXr4Htcx8TjpqDUGg3L3YUkUggKuRVow8xqTFAgFKgMaTR2RY8qL3q0aWHJCfKkeaK4XDKCObIYjJg+gMVpsYOlRsY0no525Wqrw+h10tk2spfVGvuBx5xhna1kcpvAGXGNuQazVNqhRlYqdkfwhPsBIHdpLLbwpvlBLIRTrGbnXEtriO/ct0sIlqNf/S9m6Fxsm/8bQDdgy2thEM5nRBZlZagKi+Ekbny7sXTm2Vf9s4AZizsHwszfqtd/+u7P1va97BxHTbGvgmh7Ps3iRswe6rjBW6rQPzc+Of3KowHIhW997Pqf9DwvWpx3uH7veRyZvHxItn3dH5hi15mhd799uLJ7p4o65wn4S3OmiaIlFmRrtUqvnvF+LggCCp2hD29/RtfCfP/6DF2/u7z6z5/Rx2thfvoBvdistkhQZlZUIbKS2o9Kk0pRYuBb3/30v/7by6+DFKFmlVDG9ekBMnVW4PA4Hp2Y+x55zW8dL17XSIWveP68kO7KpgOYH9kw7sEPfAjfnmLaWiefmDIV5ujN+bsgsn9IQdP5so7jjP8jBZ2FaWvR/WJEKGzksPCEI3iOb/Cec1hiQzf4BCPSgbtv0HmeK/DTOi4PodM8vaQoj41zPjUWcn3x9sa9SqPhsQLrCaMfO04lp6n6txtd31hURrxfloZHToKIQkO79jgNa00sc9O1phUQHXRxnjP7ZczbgG1nln/4nZuQAaxJCBdc+ht+ucsCA1TaXOsket1DnzSM3nkMb6QyjUgeCN0cAmxwAMxsD0tePTHt3X6YWNaPSb2tt2OEFzRkN07lxfXYgeWLtZaEWZXT+Y0GOg6ycllhsaSzxnQiUizYslI0R/MtwKQih6yhsJwpj2w9MCgaHdGWg4suEvQ74BF1/24JV3QHgKKFNDTzmd3x84zikzYXOsOZS8VPALo0Kg3wRQKWWCSoFuYprkOq/idlAqLiPKs9cenU8r4Fb/cx66/WdSacQIO9MiuqBDXow7akZ+hj/Yy9AQfY9+imdoANXoLfxjS1elTPBMrEiGlcI+394mcIcx5UJsr2i5DghhUk5q2psm8gE0YibeAxZwJ9vB4VKAQSZJPJq+gi2wKVZYKxbxawojp2Rq8Fm6DExb2IsVPRwd+eAFs3WiHjVCyjT4oEnK3ykVALHdFAncqDeScAIxCBdIIFwugXqTZY5cM53QidLyHZSyFsb/w95NLNqdlQKsKqZ+SuiY+NcUuDeTdU55BB0DIeMiMGO2TC57lCWkLBjBVLfsRGeItrjsUUcfwHOCjrBJGOi3KwwV2XZRtJWVsLdgkG7O7LEztSSQl0IVjH6wf3sIg9VoaRimOFoF80qpF4cXX/8xu5lItFePo7JZlZ0eTHu4PsB7ugu40dvK8s3hbd88qsqDA+WXwUbV3F7JzwsIQet+Q46h81VaMIy8oQOS2l/ZLjCN9WhFCtR3CGzuPHNUc7LvEE8EJWxV1KtUWBwoQBblMIpx0caQ9HK5UgwKdLKey7YuVWSDlsfogGitLurtbx+tGNvJsYua6lUDPAGc2b/Xg/TE8fZgJpZqqA/ERQXEC9iPZQV1gjnMvSvi5mRZlCciPaI3OEM/heClmM5NXCTA7NXIv6aZUIq9wzkVv5I5VuCIDRL4xTdO4Rmw3I8BBnr2g25u7kaMJ4s/+TpCuMkuDWZy3EpUJojwFCxKx3fwIhXL7era/XiE2J8YTQuUxZPRDY/Jyu8JrJCrRLIotSyYKNZCjSqZG7EnjOoYhsgS7248bEuhE7CZHsY7ijdaIgAjsYRh0ucwSCgfUb/FKfbueVbe/bKNu1ZZaVMP1yttgafQ5l4Bk5xqx/kBYE7/GSCqoYqbcEBIFEv35qATMreGpDs92QR3ZGvptpo8aDn/Wejmm7dbI9vd6/J69euLUS7itomjZGuGEF1VauO21P0ZKOBpH8KURrCnHwIKDx4BOPQT2QtY7p3X0y1vr+YXv6LtPRhpw+eGveYXxoh4O9wY5bgfAAYfDl7u71wd2pSc/OXbQoe1OHTy5aL9VpBMgBOd4IkC+XHb8/fGSxRhtMc2QPk49qUgkS8449QH5Myo4x9zZgxkaphxK0np86euVOZVZZQc1KniBKgnc8ycih4b82euDQS0nJpF6nPVGd95J7f61FZA9fJvKE/Ofsxz/9Cb14c3l+8xJdMm2YWFZMr2gOpfBBXLhcyuR9gfZFwiBbduHw8McMXxzJGFMysVdxX/2nPdUQBs2NAY98tKHPj7kuBNL+m7rfjuMPcArFTLEItUlvM8Uwj9WdrreR9zhnlXYrIKmQZgXjWDnxZMWmvUME3vVweRXcc83yKTuNdDPlP1pGqL2Ivb6Y7SVPV2dxLvbddQhr+ErDjv/XO4ngkwEveMcN7ZRl5GFXplQpEwMGIRsgtVRLLNgfe7KqRTpWeCixj6B0l6dGyL1gKlhLmqjrzy92OXgtXIsv17toJ6v5V4q5WRGsKCoVzWXBBA4W3HXE0w02jAqjD6bHczzlbt/gk27WtX6kZSLGtVfnayu4SqwMNENqt7pfrE7Y7MgLm4dI1AXNqcKG5lm0pLI9/GGFzy/1ik3w7EbJNcub5mH+e7gsuddUB4zhm//YZ21Xpw0rOO0mWT7RLpslfa8/sx3ZZnB4KGROrpmLnq/6ivtIC7hG6Yw5FPyxmie9B52p86NOJfQysFGno4LGijXSRion8S20ghoMq30N35rZb30d3n3B8pzT6aTcW1jvoXIucLwduXeUnKvHY0yz3Ru/WqfDkNjW0dkzVHJsj8y+z1IhKojalmNefkiFnMCefEAGnWpsy1+lNugtJismRky6HCeSHF/1af1RQKZ/qagVH1Y/ck3O9Ay9yXGJPsH/OP0ol8LVnf5t+HiiFV5TqzlxihX6XFG1RdCDUJdSaFprVOHiVLvfDH4zjbz0PfCIhaxY3QVSuO27vnzjeNZbmgDVloHe++aoD8UUpjyldZj1ebxuLb3TxMjahv7hZRqpSoigHavPmpfHRZ5dG6mRGjsPMfMWZvqDwGjDRC43GumSErZgxH5yFqoT9Hmywwtit+fwbXNu0AvoCEsFaZ8hCF2+7FALVQLe8Td0ickWfdS7jW+bCGzRL6SNnl1rV5jAYB957bumFqACtWrAZPZFHFC86QMQqP7fqTSFcp4h+Xa3nV6hHuvO69TrwI5hh0FG8785YrPT5PWObdVn+HrXey3rrmDr411Ah7uZxmHXBAx2z6ZNyHTHMDihcEOKw8XPUDYQcyTgaIUbbDmnCya8rx6EE3T1K3A50nQQsDuqUCwRbq0Dpqf+xRaMjc829d59L6WR3pSND9sYTFbFxC3w21WB4GhgHXWPI8mQlzkT8SaIRb0bdstQVJj28QwIqW7ZDhyLa6PdlvcHpnYOsE779h3AusSq5in757N2K5sVG7RSR/Z2WFvWJb8/aHsm+swS19ZCqm26A/+LLrH414MdY2pEdruo1+p56GmyZPnLK4B+YG8nU4kGu6r7re/f1SgXZFQYJctjREcuq/nAufAgHvdrWmubHihHABxddce09/BCFiUW2+Y+wrWDcfrOXllTZZ+hjImFDCsFWN+lrhE6ID96VmSN2Yam7Yq++JwqR+CXivMt+o8Kc7ZgNEeXUPfsnINBVDZ0nhEp79iJgu6/0zly67f2M+Zj2nz0brNtOLysDKjcR44wPXzX3zdL+Ck73h3tfPIz9GFbuq23ngNLHHeC44en6CKL2ky2h7bFwTki1Nc61La2j8wUrrpGudzFznkWS6lqbz+EmN+/GTnyTq+cyOxU06JMO4doDynsygc99zWaSspEmsguUnYdex6oxCbsmiQiwzpmtL8DWPly+siQK8UjHnMHasRTaYzRrFKxvCEdmJqqDC/j2ZQt6OjP0y7oqOmPu6A91ycQLPTeUAGqVXzjxMKPxs2NordStJcqE1ujcktMUUu4I3M/wLKgXr3y/33hUXjl/8PnNYXc/phTFc7O89s5YfTcbaYbPAePa2fU2mA7uR+IZk0qJhZUqZG463Dfk+yrq/gfJH3QPTsBknVf4kXnGAJXCsLaMumVCiwxGftdubi9ZbsPkEGsun/6Kx0maI0P/GTliqpp/BFWZ/cZTy8uYPTjS3QB64dRo8pM1CxlhM4XVPnhn3QnC3NPc16aNHTcIWTnwO2iX+tOp+i9J83+ONYr+fjWKOHTRrfsj7C3ht0lkinXf71Cgi6lYe4AyxXWIxOgNJm6rVDnKN3i48MF7VEnmwA1SHDp8VjdOL2uvwknpGi2nKKiYre/UTP18MPooGUrTZjWVXSlEyBDslQ6b93TYiiAIVUqqQ90cChd6XllF0e3EJzeJ50myZBoOoP7KPKLW0jt3P8YdaTncUg+XnruwXFchGrNs3XKF70fUvWO7CAyeWZZD1fR2zTqVIDZHfUWdaLmBl+140q6DxLI1h+QhnidVOj69vyvb2/QjX2n0G9iZPpKi22iSupjsP2wkWFsQQyRFSV3+ign8sOEcNoeZKGhc02/zqZFGKSB+hGErRTco+VSxQZNIU+g5Do8mq4go0YD4GywqSab8NnFco05yx0jBpDoC8LJulrvE4RAsTu61X2xHYnz6wTSyLBXxpQ6YzCDNgloOMoUBCH4GdwmthR15YtUzGwP3CgiiyJpn7gH4u3w8A6hcAn+hinK+5ZmbBfLhmORaX2qgbd2ZSfDf/e7rWu0gti6UuOslGyKtOoQwg4DBBgAUmFrAMhKVliIQeOM1O2m/KqAyEjMdqK2zc3D4mce/v7m/J1/9171lm8eFCNV3/cfvWcb03fZWvIqFQHO6znOws+5aSZj1+N8K8GMRi8cEvoldOuAwt56om4PPAKkg7vhVSJp9sbj+lEw49MFZrtFB2uqIFNgUXFEpCC0NNZQvnVnONJeYbNJKX0d4a3BXo/QtoiWUhkkLX1//bfzUApukOyx+U6q5fQJlv0Cgx0X6xy7ZifBRjH/fvXbzfUNeovvCybyZqx3+Fjt3iZPw9wZojiyLb+Nwe72batRn8Ili9HTs12VY7aYrmDz1EX49ZaTqx07zjIvla8vfZdej8VeDPl0h3LiXgH1jov/8nXDTWGOyIeaZOzbDf4Sa0KfKLvRj6sGK74J6hauuPcM6SqQoo41+os2Sorlv845JnecaUPzv7zyfztrPmViQUn4owVTdIN5UJHBc975DcIiR1qiEbZUdMm0UVtr2U8pLEpsVr5Zf4MD6uMwQBKcUlOh6QqhXb0WkarThbzRJxvMqTCdnJQabz+QcdZMU5v1Lv847mN453SBK24yuBM/owXmO6XIO1vazeB/10mOqCdFtiPj27I1o/BiwQgMEphTKpCcQ9+ITkOv5lw0fsRm+hf7wFaGt75xGVusRWJ1stCp2ySNSBSFN6igWuOl70tEpJXfMMAspEi+kUt0SYnMR8I+HlZ0H5Xr+RwxgamH8JTSCIow7YsmF4gJbbAwNRphG9+wox7xfPhOBVVxuIfMWrfG1Tm14wnQytq2MGH3d2YE1bo+/cNTEARdU9VtUFFipSl6Sw0GTd3X3DZLvXgjl/rVjUuqfTkAf+nTwVq1AqP31AkLx+Gig+ZIJxm6TuLCeVq0udDLtMqzP+O3/p5fX37nAy6u7VtrXUNPgHtMDOJy6c5r2NcGdgeTrD23wPf07twh+3t/sLNRzhiAPopTQpwxgDzOKaNHsp72TF7/40z2n4ldNc2BPO36yvnfs2Cvq2eD3TpVqPRpqCmaMiv26WRLdf+fhhnYfukK7p+GHK5yZjLoR/0c0ds1nJ4RYquIE3WjIsbEcYil1ZhqyfF8OS2nRw2LTUu2BaV56iKQ8bBFt22iayRJ84EeMlASnmZF9PSQAfQDVsQ4FaevM+8Pxg2Sz5FrsM1I5EMBCj6afGQKtdpHBxo1WjX793/a7hq1F1IQ+zhgI5+7ZTsibqBJXUJx2KXuhV3GJb907vMbufRjXX0VA/SSsyaIol5QDba+YPc0R5rCpN2dH++uoccNlvoQBrCfbLA0hzAA/ahDGXoC4/uXjmPMwb4eQZPH0SBii4U9fPlrnVfqOZL3OVJT0XQe5nKpQ2zT8SF9OfRlxzDY4EejhL2+Wf/Q9gMcue594g52b+SXStz1T6nJ+9P/u+RNXPvkadyXC86R1vWW5QijJVtT0TjJvlxFwJLoOP9FWgskf47K35cR0Rh1aMhymyn6OcFZd4OHcMCwb9/M78r3FLuBi3TmvdkGuwprgocSZE7r5NGP18J89xOSCv3CJTbfv95N8yJSLNiyUuP5Le2+j1F3v+B9Qxj0uZZNgmU8Qc+MseyYuproS3cwSLXBKk+m1O2fVO8Ukk87+h5GinI8TE1zrVX9I+rR9s0wgVN12+VDKrZkAvP6N7vaygE6pNK/9iRGXN98+ilAAhTsJosikKDBaEjlGK9Py6hDxfHY12dFcZ6wvH7HtIOl0PXlU6KkDt9usBTAHBcrfdZONk6y5H423OTgtooWXBRrulxIzqFv6pcogC31TpBzY3mOaUQc6erxcB1F9Y0cjrMYJ/QztPgKMn8uqmohtakL9+bbwaE1k7gsQM2Kkm/9OdkvQzIzxWSFNMspevEnZFaqQq9//PEl2mA/SqheZQ8lnoXy+gBK+Lk6yUhBvhiucENVap9C03fVXmUdhIBe4Llc0w4xWLhEpxZv2iiKi9H7Q74YtjkxqWjOjmqacIhQX4U0x8axwBaImbrvD4j0V65NaI30cJzV3xDUi2ypQq/RlSC41BXHTbOyR8n1EPQnBj8CuZWhVb5/jf7FbvcMff89+hdEpLL6sus5UA9T++/c/E/7RabRLlHC7S+EzOmztXXFhmYEcz7H5C596VNOhTT1aDSwKywR65oXME3GptIBcyRvZgQsAw23MQeM3Rx7I5XVrMXWaR32g04zihBSCC1kJXL7wnAYyKChI8DDkhd3b8QAcoxYoL8Oe8JGI6ew5RLnz+Wd8+ggzf6AYZSKkYDV4U3h7pfBFnbPfS2E7bOPTavRykV9bDP0q9zYoxnanEwgqawxZiS6o7Q8QLRn8eJ9IURzgymydcqB51e15IGxVG4+tYBJ/B27cM0UjEy9vtz1vYuAi6M70x2I4Xbhr/r1JVJWWmtwqAxni4xO/28okaye+eSU2J1HMpIvlyQUNBT8bfOr99ANv5nRTBTFfhDQiKC0/9SBmC8g8OJXynTJWeruJc/WnNcsVSHsE1Okj2sa9VB+h1tn34B6IpDnutpq8U/If40IoxMvg3FBk8ToYQSQVOjm4vzG674EC0seVpRS9TVeBE/kF5cGUT0P98dH91SBIR4adYuGpnzV/qQ12J2eA5b5DL3+8Se0AboXFAuEOQ/7Curq5wVq/UdoQxV1YLFBnGJtkBS9cpFdIp5cTfyyiRi4qynCtp52v0uVA+Egq4mSlZBcLrf9QNyCqYEWi9CPiKywwsQ4IlJoX2SxcBPcUSV8Tg/f8ZmPVtTGLuh2gfqUQYR90xasRVFYJVOKOoyg8GZUpoFk7amVmIDG6mIUwvscJCGVqiFqg0WOVY6EVAXm7I9Qfq9URZA+uc9yOJpED5uFt4dILdYNMq84W1DYccDA15RIkY8o2O1xZ9pM0NA+tCEmiCxKTk2QAUadqBgU+PFG09pgZU7EyLd27SA7j7HyLmeOsl8hRfROyPkgQeLJTQ9EfiLCX4k8BdktyD+kOFH3nHr1WsV06bUf+hQeiKhkN/ocwTBuP4Lct8Otscv35YEFzvepzLbtjwJ/OkhFiVQ5zdO9gz7Jxj9Tulmx1jHqTJvmi934+vC1UrKYAdQKivI1oQIrJp1aX1TcsG8NowrhsuR19Uvby6bAAi9DpbkIcQjv1PaiQ8rhqhEzX2skN8JFxgwuyr5n0GNcT00a3j6jEVkxa93InOoZeltpA2ZSF6jrnjWSl4sNPfKQ9gqwxcLivaZTaEJwyPWCjnZuaJogjiGwVa1ztma51WyAH8KC7LYWZB96xAtv8r5karIdtufpYkH3lhOZ4Vu3WW2FntXXLFLAoPt9oxEP/UC371qezQZLtt3VqtgSqIg+irOhf+yrAhrk54pWk7GS5W7HRa183GAYe1p1G3B10SwBuVijHhqiRlQKdgiaQKYtC5Pg9V0WKXAtswSollkK7bmMKYp2gcYa9dFCTaArdV6R05iQPfMx+MYMnstHvTnHis1Dcu2YYEH7QPS6IcR2BGEyUOJjKNa64idqmi8rQ2RBXzkcGuPFD3AZcAgWngQ7BuQIg9A1Vcykbg061n3ar+6LAMdGk/ZcPhMPbnOvdFPpYqFB3MmNum8Nn7B264I5Yz1VvK6cPpspcACNi5Hlg8mwzSTYIN6hKTIJD+HTrpXetQSlQr/d+tRYpuuEgL5fDdavT2isSlKXUrOIguNBvAXmtMjb7sLN3R3twlNxk6VrXfRIUSSqgipGHiuLgnubaPLzAyrZmpvhxJK734OtranIYU7yQbkl538/QfeaOrQrh9Npu4ilrwUfkBvmAe9FzEn6lL3qvhqdBOvFjPdyrXCTWyykQbiZpBZOoOVymdWJKicR6jUjPlqoT9EzZUf2/TukW0HX6mHb70bxl5yR7RTTdkbkwg0g4JtrC74dkcsVT5k3HSbg+8o3/w+LUykMvU+tsTYIXbejAurqqjzX9l/wqGJeIxRqAHPgcSYrLJY0E3STWhaMBS7pphPqByXEGMXmlaEdCTHM0dcOdautd5+/kaHEJY4m7BrK8cGEjkluDhiC/fwih0xXfwsYt1ABZglWNxzUbc6XWlM1Q7fUHUqlqZrhJYVW3j7TfSFVjcMAdg3G6e0Efo/c7zt9K6RCcyU39rP6r6Se42jNrtF+0tf5DVYmtpuuARzbo+LvlBxUh051pyTP2xmkia6ULKkPKKZ6i88Fwpwq02QXqXZR/zcX3vLio9MEAJKQAgpzjoQU3ypaUrBk9mU/TDEXZbePfmgaitPjXjEXYavDP4Od+aEaraxHl7DgHKpNBJLi26W0/73nJQAlJQsojgn3jTvBwFeAgEVSLhBMmGdUz9BtK1P6gw26lVVpML5w5XyVtkaMKxl1yTa5F7/NNBPCK21qhvT/Mzgm+AnT9iR9TbT3b1jFFz4dV4Em137cDQtb9K4tUzql7OtDhpfF8hKwQFhrSRj4S+1pBO1JOLA37I7+3BlkCIMLz1CpYCbKGaKGfB1WlLHCsQZWHwhiwVLUUKVRiTV08dLQyMFPk5ZFYaWY3AnaD0trqCF71T33HpxK4+ucYYKHyYlvIouyGt7BBMeG0YaJXG58Pq2fNnnWZFKMEmOwzUXF+RZ9rjB3zs9cFpj5Qbyw73ohLkeerq7XM9EA+8FoOCbuaO5rgepEdKzBO+UNFPvJVw1qM5bvOzg+6AqRVNR1Jzs5t0QfgRq9325Phddvpfe8otthu54m6ExVwfqDnVK7WP2anTF5+zXt7yNr2gvG09/xZsu/wGrNNVY0rwhFdeSIht1tbqZ+FnhNkz0itztj/PvvY+cBtC/MqF+Akjt9VMuBGB5jv7p96FZYr5obatXCQJVhRVYu87eusWnKDC9qSL0WYXYjzTIzrYj9VfP/w0pTZOW5QAxy7ipBOMXK/gka4bWo+QLCevJrXdh5OPrghF817PP0rF8sIot5M753sfNg+bJR9YjXa81Upaf29HW1EUBg3OM3TYA0cCUu3OquJ+O4p9RZcNMNrnVe5utLP4IbvfCNG+rZlK7o1+L2MqxXOwf0qQb8e/fz9WV3vmsjJobeg92InEsDdFuYOSaysmDDdNhIXettyl72u1FdX6Dt1IW9fmzhjO+Jxx1fNAuj68uDmmws/9wBTdYi9lrkrUY7QxeuPtP3O+Xug/3aLCCodr/x3VfeHTevTFO5KU3zGFWCU+0oI92DspFojRXDcz6oAnRNGZhAJccjgkBToZP2R9k50K6q6laeWUllNYy6vpDZc759dX3T16GRbxnrPApjddlHDhR8cC1kG2lxSKJrYdAtWwoMwmKERUupUjav/XogvyyT3tS6m4SujvCfFpHOXQYuy2WAcd799gExQXiVUyvO/CBb+/MZenF1j4uS05/RjXOIOLAgvWdhvwhE5iaPbYJzqn1awpgxfWdV7iPwekQpXseN+c4/De+ZvtsTcjWKLZdUpRthFybZp24swOMA2ulKUb2SPLfc42z1kUmjO6H3CTwLw9i7l8ov3jsd42XTjOP6MlxG8uDoPJFFmU2cdwWn4nOvYIyr8+/pav6tRUcKqE9dwLgZmVdkzErzaumJssa6mDfSUiroPGDleo3fyJQ4rPINVqfJ0Bt21bfSFfuHyG5ipDXyCytEMXqLSd1POazcWhE0qR0jxbe1gqr2SyFna0Yfaq0o1tFzg7XBpoqlODf+KMz4ycwOu/hc3iOWvxp/v+zLWk2BocXo46DxsbsLFovw1a3fscTT9wZMfjmcu3fMc8aErGLFODt1JHoZ/U5ZSRrT6TDwyP4QGXDqzow7LHHOuZV7SFeEUK0XFUdXdn1EZE61ZYm62W/YsmAip/eRCcCZNsdpnk+ULbAwmGKqRmJOFcQ3C6wYhwyegAfPxd/FEmEg4rf2t8GdiQR8KOeuudCJNGK/OnrR5HOWVOnSF906CTMgmVcR2oT4usPTy5EiQ+fmGr7HqRNKnPLVJHl5X5X7tv0QM6FRTg1mPOBkmMvKdH43sjXJJ8/NrD22uMljAzzGH1JDi5Iny+Y5RzldYB8C8p0v6xi+z9a0WvGaKo63UMhlpH9c0YvAjbQfgNXtf00XdRW489Vrw0wFjRlRcGOtbTBs2PTU6xo1itXx7xAcG9MEsorIorD3KQ0bXTjoiHWSfUsl1yx3/rO6i1xB9WgiVC7J8YHGx3vLfmG81RpJNy8vrBrcl5D0dBpZX6+eVtb/Xc6P9Dsdvb3/Lec+ABO+XSVL1zj3EhKK3cnf3lyj64FC1UUjWddaX12yH4OIhV1NNewyqiH9GH+Yz60OK/dORGRzmaeu+BpU3PWVDo8LsriMqEer+N0SXMhggsrzjgvYlw67BNomHsKWLG9COSNOvCK21TgoA4/w8sdT8pp9l1XKZ6qe7n3z0XXPqQNRkKxxT0nV9SK41K85DZW31l2Y9iVuTOAICXrF812HSFNdideYcTwMZKDGFY6gvnJBlRqZtODu0DG+/nhxN2+sFL4BlAvADrbk0w00W85GJCIrsnmV59vo/hlWZFHrgDpwK02Pa3S+10sVH6JiMmKXg16JXaarKQoSmO5mr7qeq7jKmWkq69q+aB6j0GC7tmLDiZI2vLB/ky5LLDYF15NZ5RefrtALXyvxqeJWV54zDgUckAd2dV9Kbb/5En07dDSIfhTmTsiN2DGENCUVNLNY70IfmbRJ8AQuuH5a6EVd5f7Olya9oUtMtujjqLnG2VzhUxTl+4V3SMwEKjATC4ULujcdo8QKpvam75Owo1zewLLoncxdcnTbFrCTdRZACh3QviBVwBIilYW02zfuHd2gXysBpuRbmVOOXjCxnn1zhpgkZ2hu/0Xtv7DAfKuZnn0Tji8aUmYLjgeT82PrULsa/sUNgkXB1wVyclsPv5KLvY0ajEyKqfvr3ONZt0HQVFlGDiK0LuLK3R5mn97+jhVFH1wC8DfffHr7+/n7q2++cTm3a6wwG+XJjVR3MUuWD16w3+sFuxG2UScYFrGVCF+zE7dLSfMcYGKfi20CE2YhFRWakZgCpONKSoBxEd8LEogPxAKabTAbDid+sncAep/HBmqvT+wSdV3NE10KM8+1UbEr36FeO5lDrPuWRntH65qPdE7SY4td2sFgA5XGF5u0dS++3sWCWLBRR1O91WSO2GO3GuxGFNhmv7wnLJSP7if4eMeFRd7r/++Hq7Yqs5v8dxIWyzs+eo/IXiRPwhx1HHcfflJOkLS1c7Idu/SFaTLa6yw76JP5EtxuA849HJmuW1azKeJhUPS1wIxbWtfNXG68zLi+7Na2QScuaw4augy0MBjPKqxzrjOrIh6xn2MSryHd2lcfXciiqETfEzXAThzXuOmp2L2j9+bfaVinbnDTx2nWT8XtFov832Q4atbiZrBhx0iGJ2M3XHgHOV3pkhEmo2WJTmXBA/YbrMQw6PDcUdeiKDOZShjfvnt7g35zftQ2KTWMyOdJUwlu/+MN+lxRNdK7teIiU7TfqTNtckPHIbpF7+uis2BaV6Olk4gPaReojD1GwAItj3IcHYJqAsGxJ8PN4w9owByrIsFpWbAJ3Au4jFiA3ACt8mhTaXdgxu12tQM6x6avFT4V7pwKsiqwilVW0sDdlngwvvjJ0SdMBulUUWBmq+i8QOgibgFVA3ixhFZLCcDK+d8TQC1x9EkYruNUdPaCoHvGYj84vnNbQa3qGR1pkWECg1Hil59Y2FpENN47gOfLcv2DuDer6O87ERkxKst11L7rHegW8nGRpwcAXnMcXWKIjIolExGLIoegU+RGi2yR6Q0zJLr8ENmCy43GRfzclS5sYdbpoCeIuhCRMZFSnDBRUlXMt9ES3gewS3KXBvga8xS8wsqsVNLILH5ICqCvf8jA4xgfNk92N7lcZnkKYlvA8fPfiMgKfJ8ZE8ttsAvYcjSnCR6FgolESDORDumS64zPeRY7LLoD+08JgUfvDN6BHbsXYhd27KreLuwfE8L+KSHsf04I+38khP3nNLCNLDme0xQipYEe3zwTWVFxUL7n2wTvZA28vEuglxQVZ8uiTKN9Wy0T82XsJCQPmaVQSjT9TOL7RkSmXUJighPUiqSxJi3gNNak3uqqTDCLlIimrDqJqWqksaYHvU8gQow01jBLBRvMmiTAK8HuBRZSU5KACdc/WaokehTWP8nSrCjOE7jVZFFmhCfwYVvACYIkAFfNtya+W9RC1kkgl1WWIKZBFDOMYJ6ggEhneEkF2UbMuurCFphv/6D5PAXe6wzagCaB7NrBpMHaJdYmgT5fluuf0vigdTZn5s9JGo0RncWdFdcDrGR0Ua2TXHOASomKX+WmnY8/2qytDmBqVs7PH9854oCD2pcEuOsmH6+DXAf2gnGawobR2SLFIbJFzOLsXcApdAOdsRKSFLMkoo6V6x9ybcpBM/9IsLUiSWBztqApzBgNjuaC5ixawegubCbScEkh84pTTWQKanvgbJlANslSb7CJOvO/Az2UQR4FsKJLpo3C8T0hLewEGp+iZSpSq2S01tCJXCWSry4z37F4AuhGUVwkUCRdKVAqtNMp15uVZDpzE2bjQ99ihZMweD5SCBsD8trNt48Nl2mDRfQ5x7k280rFGhZYQ6VuVlAKqFV0XOPr0XVNcmywMLlhEX/Y9bGdBvbBXOI8j30HWB47rFq3DkrwFrEiI0rKIklXIgs4gZnGiixNcqTveJSCzOVd9PZMpY7fspSVulQsMlCODTNV9OwzzgSN12KnhaqjTtRp4ELxbXy3Fpeu62m24DL6c94AT5Dyb23e6FLHAk0gcawNnQDV6LkJXC6TsK5YJrnApVSxBVgxr5YprlnBNEkhFgqdhGFTzIEQ1EBzpehwo8tw1wA6dsafgxo7HU9sNrEtkCQVZdINgI5uicr4mpFUbJkF5nE9Ge5GUBX/zSozN5Q3Otiok6lbsG7EaxImS1C46WfixBYGHmxsaVBmzpEUHV2stf0wI6tYdf4D0PS+ZNEDASVVxVJhYQY9d2NA3iQBHP/pdZ3IPn7sTQGNAFjJZYZ1GXFgQBe0wrGhKop5Cv1OUQJ0cF1HEwGPT2QLOW4L1w5kqfIEGMd3ZOoEvmHtfMMJ8gE0jZ0I4AYeJzBONP0cnwFCDVqjQU1gSmm2TCB4dRnby6YVSXEPFMmjK9JakVBX3AiATbwRW12YlY7eVXNNROxCieC02KcCdU06Y2/fLE18tnJA40f0mpmeseFuy+jdWqt8niQPvVI8wVtYaaqynMWuek8ytqKODKUggyHa4CK2N3idMaENXiTQDNZMmRRq+LoUCVo3GakqEdPNGmqLFugoel4Zid5XAg2WbrJHEg7L+4Q5y9GFojkz6AKr3Hcz1ND+PYyOm5yVkEpjE0IBDAzRR9DfgEiOQqU6TT4EE+kod1WUXG7pYLDgQfotZBWtqfcDeczS0PmMYN6Zokt6jwrcb7TQxmLFsuoPA0mOJGcahjPUq/ujhwZKSFdlKZVBw8ajCG1W2CBmUKnoYowVnpCW+5ghFCHCe6ujQQEx4Tu7j/SF5kyknsjfQdWu1sVTIyOX1KyomrXf1ytZDV40hARdU9WMIzISlVhpit5Sg2EiuLuruCHBizdyqV/duLLXl+jSj/g6Q2YVmFIEzYDfUz/6GNAW6B01vzMjqA6f85CpkxBvASO7m1sEi7vNaooVWc2YYEH8YObuBP21e+ITZmFAMsQrjisBs36XFcxxrZu4hxu49/q179lT+nbczZ6aJtx+fvGIsW8PIotY0/SwzquwLPpA7w3cijF3wRTTqEcEUju47h1MqBZ8ZOIldM9NOA4c+udqapCinyuqzZ6m3cdnKz++V75TGWAsj1vVSey+R6rJO911p+zDyWEEsbGdv0OHdv1zcOcxZ/8fnm9oF7u+rIUCrB3mDbAa4iXxPpKF7eMyx5oil67dYIMGt6o5Jf+L0+ArmlHwDeZSufb1QTIihDXSlMK4M7x/XpXCQmMywXjfQYdpt7QAtbdlGlIpmIC2D+mSqoI5dWMqpNsl3WAOtmacLinidE05wlqzpXAH187rD7M+tGQ+ofyG9fdw+vwkk54tZpVgnyvaH5OIw5evg+9xHROPm4JSazQsdxeSSCEo5FagDTOrMUGBUKAypNHYFT2qvOjRpoUlJ8iT5onicskI5shiMGL6ABanxQ6WGhnTeDralautDqPXSWfbyF5Wa+wHHnOGdbaSyW0CZ8Q15hrMUmmHGlmp2B3BE+4HgNylsdjCm+YHsRBOsZqdcy2tIb5z3y4hWI5+9b+YoXOxbf5vAN2ALa+FQTifEVmUlaEqLIaTuPHtxtKZZ1/1zwJmLO4cCDN/q17/6bs/W9v3snMcNcW+CqLt+TSLGzF7qOMGb6lC/9z45PQrjwYgF771set/0vO8aHHe4fq953Fk8vIh2fZ1f2CKXWeG3v324crunSrqnCfgL82ZJoqWWJCt1Sq9esb7uSAIKHSGPrz9GV0L8/3rM3T97vLqP39GH6+F+ekH9GKz2iJBmVlRhchKaj8qTSpFiYFvfffT//pvL78OUoSaVUIZ16cHyNRZgcPjeHRi7nvkNb91vHhdIxW+4vnzQrormw5gfmTDuAc/8CF8e4ppa518YspUmKM35++CyP4hBU3nyzqOM/6PFHQWpq1F94sRobCRw8ITjuA5vsF7zmGJDd3gE4xIB+6+Qed5rsBP67g8hE7z9JKiPDbO+dRYyPXF2xv3Ko2GxwqsJ4x+7DiVnKbq3250fWNRGfF+WRoeOQkiCg3t2uM0rDWxzE3XmlZAdNDFec7slzFvA7adWf7hd25CBrAmIVxw6W/45S4LDFBpc62T6HUPfdIweucxvJHKNCJ5IHRzCLDBATCzPSx59cS0d/thYlk/JvW23o4RXtCQ3TiVF9djB5Yv1loSZlVO5zca6DjIymWFxZLOGtOJSLFgy0rRHM23AJOKHLKGwnKmPLL1wKBodERbDi66SNDvgEfU/bslXNEdAIoW0tDMZ3bHzzOKT9pc6AxnLhU/AejSqDTAFwlYYpGgWpinuA6p+p+UCYiK86z2xKVTy/sWvN3HrL9a15lwAg32yqyoEtSgD9uSnqGP9TP2Bhxg36Ob2gE2eAl+G9PU6lE9EygTI6ZxjbT3i58hzHlQmSjbL0KCG1aQmLemyr6BTBiJtIHHnAn08XpUoBBIkE0mr6KLbAtUlgnGvlnAiurYGb0WbIISF/cixk5FB397AmzdaIWMU7GMPikScLbKR0ItdEQDdSoP5p0AjEAE0gkWCKNfpNpglQ/ndCN0voRkL4WwvfH3kEs3p2ZDqQirnpG7Jj42xi0N5t1QnUMGQct4yIwY7JAJn+cKaQkFM1Ys+REb4S2uORZTxPEf4KCsE0Q6LsrBBnddlm0kZW0t2CUYsLsvT+xIJSXQhWAdrx/cwyL2WBlGKo4Vgn7RqEbixdX9z2/kUi4W4envlGRmRZMf7w6yH+yC7jZ28L6yeFt0zyuzosL4ZPFRtHUVs3PCwxJ63JLjqH/UVI0iLCtD5LSU9kuOI3xbEUK1HsEZOo8f1xztuMQTwAtZFXcp1RYFChMGuE0hnHZwpD0crVSCAJ8upbDvipVbIeWw+SEaKEq7u1rH60c38m5i5LqWQs0AZzRv9uP9MD19mAmkmakC8hNBcQH1ItpDXWGNcC5L+7qYFWUKyY1oj8wRzuB7KWQxklcLMzk0cy3qp1UirHLPRG7lj1S6IQBGvzBO0blHbDYgw0OcvaLZmLuTownjzf5Pkq4wSoJbn7UQlwqhPQYIEbPe/QmEcPl6t75eIzYlxhNC5zJl9UBg83O6wmsmK9AuiSxKJQs2kqFIp0buSuA5hyKyBbrYjxsT60bsJESyj+GO1omCCOxgGHW4zBEIBtZv8Et9up1Xtr1vo2zXlllWwvTL2WJr9DmUgWfkGLP+QVoQvMdLKqhipN4SEAQS/fqpBcys4KkNzXZDHtkZ+W6mjRoPftZ7Oqbt1sn29Hr/nrx64dZKuK+gadoY4YYVVFu57rQ9RUs6GkTypxCtKcTBg4DGg088BvVA1jqmd/fJWOv7h+3pu0xHG3L64K15h/GhHQ72BjtuBcIDhMGXu7vXB3enJj07d9Gi7E0dPrlovVSnESAH5HgjQL5cdvz+8JHFGm0wzZE9TD6qSSVIzDv2APkxKTvG3NuAGRulHkrQen7q6JU7lVllBTUreYIoCd7xJCOHhv/a6IFDLyUlk3qd9kR13kvu/bUWkT18mcgT8p+zH//0J/TizeX5zUt0ybRhYlkxvaI5lMIHceFyKZP3BdoXCYNs2YXDwx8zfHEkY0zJxF7FffWf9lRDGDQ3Bjzy0YY+P+a6EEj7b+p+O44/wCkUM8Ui1Ca9zRTDPFZ3ut5G3uOcVdqtgKRCmhWMY+XEkxWb9g4ReNfD5VVwzzXLp+w00s2U/2gZofYi9vpitpc8XZ3Fudh31yGs4SsNO/5f7ySCTwa84B03tFOWkYddmVKlTAwYhGyA1FItsWB/7MmqFulY4aHEPoLSXZ4aIfeCqWAtaaKuP7/Y5eC1cC2+XO+inazmXynmZkWwoqhUNJcFEzhYcNcRTzfYMCqMPpgez/GUu32DT7pZ1/qRlokY116dr63gKrEy0Ayp3ep+sTphsyMvbB4iURc0pwobmmfRksr28IcVPr/UKzbBsxsl1yxvmof57+Gy5F5THTCGb/5jn7VdnTas4LSbZPlEu2yW9L3+zHZkm8HhoZA5uWYuer7qK+4jLeAapTPmUPDHap70HnSmzo86ldDLwEadjgoaK9ZIG6mcxLfQCmowrPY1fGtmv/V1ePcFy3NOp5Nyb2G9h8q5wPF25N5Rcq4ejzHNdm/8ap0OQ2JbR2fPUMmxPTL7PkuFqCBqW455+SEVcgJ78gEZdKqxLX+V2qC3mKyYGDHpcpxIcnzVp/VHAZn+paJWfFj9yDU50zP0Jscl+gT/4/SjXApXd/q34eOJVnhNrebEKVboc0XVFkEPQl1KoWmtUYWLU+1+M/jNNPLS98AjFrJidRdI4bbv+vKN41lvaQJUWwZ675ujPhRTmPKU1mHW5/G6tfROEyNrG/qHl2mkKiGCdqw+a14eF3l2baRGauw8xMxbmOkPAqMNE7ncaKRLStiCEfvJWahO0OfJDi+I3Z7Dt825QS+gIywVpH2GIHT5skMtVAl4x9/QJSZb9FHvNr5tIrBFv5A2enatXWECg33kte+aWoAK1KoBk9kXcUDxpg9AoPp/p9IUynmG5NvddnqFeqw7r1OvAzuGHQYZzf/miM1Ok9c7tlWf4etd77Wsu4Ktj3cBHe5mGoddEzDYPZs2IdMdw+CEwg0pDhc/Q9lAzJGAoxVusOWcLpjwvnoQTtDVr8DlSNNBwO6oQrFEuLUOmJ76F1swNj7b1Hv3vZRGelM2PmxjMFkVE7fAb1cFgqOBddQ9jiRDXuZMxJsgFvVu2C1DUWHaxzMgpLplO3Asro12W94fmNo5wDrt23cA6xKrmqfsn8/arWxWbNBKHdnbYW1Zl/z+oO2Z6DNLXFsLqbbpDvwvusTiXw92jKkR2e2iXqvnoafJkuUvrwD6gb2dTCUa7Krut75/V6NckFFhlCyPER25rOYD58KDeNyvaa1teqAcAXB01R3T3sMLWZRYbJv7CNcOxuk7e2VNlX2GMiYWMqwUYH2XukbogPzoWZE1Zhuativ64nOqHIFfKs636D8qzNmC0RxdQt2zcw4GUdnQeUakvGMnCrr/TufIrd/az5iPafPRu8224fCyMqByHznC9PBdf98s4afseHe088nP0Idt6bbeeg4scdwJjh+eoossajPZHtoWB+eIUF/rUNvaPjJTuOoa5XIXO+dZLKWqvf0QYn7/ZuTIO71yIrNTTYsy7RyiPaSwKx/03NdoKikTaSK7SNl17HmgEpuwa5KIDOuY0f4OYOXL6SNDrhSPeMwdqBFPpTFGs0rF8oZ0YGqqMryMZ1O2oKM/T7ugo6Y/7oL2XJ9AsNB7QwWoVvGNEws/Gjc3it5K0V6qTGyNyi0xRS3hjsz9AMuCevXK//eFR+GV/w+f1xRy+2NOVTg7z2/nhNFzt5lu8Bw8rp1Ra4Pt5H4gmjWpmFhQpUbirsN9T7KvruJ/kPRB9+wESNZ9iRedYwhcKQhry6RXKrDEZOx35eL2lu0+QAax6v7pr3SYoDU+8JOVK6qm8UdYnd1nPL24gNGPL9EFrB9GjSozUbOUETpfUOWHf9KdLMw9zXlp0tBxh5CdA7eLfq07naL3njT741iv5ONbo4RPG92yP8LeGnaXSKZc//UKCbqUhrkDLFdYj0yA0mTqtkKdo3SLjw8XtEedbALUIMGlx2N14/S6/iackKLZcoqKit3+Rs3Uww+jg5atNGFaV9GVToAMyVLpvHVPi6EAhlSppD7QwaF0peeVXRzdQnB6n3SaJEOi6Qzuo8gvbiG1c/9j1JGexyH5eOm5B8dxEao1z9YpX/R+SNU7soPI5JllPVxFb9OoUwFmd9Rb1ImaG3zVjivpPkggW39AGuJ1UqHr2/O/vr1BN/adQr+JkekrLbaJKqmPwfbDRoaxBTFEVpTc6aOcyA8Twml7kIWGzjX9OpsWYZAG6kcQtlJwj5ZLFRs0hTyBkuvwaLqCjBoNgLPBpppswmcXyzXmLHeMGECiLwgn62q9TxACxe7oVvfFdiTOrxNII8NeGVPqjMEM2iSg4ShTEITgZ3Cb2FLUlS9SMbM9cKOILIqkfeIeiLfDwzuEwiX4G6Yo71uasV0sG45FpvWpBt7alZ0M/93vtq7RCmLrSo2zUrIp0qpDCDsMEGAASIWtASArWWEhBo0zUreb8qsCIiMx24naNjcPi595+Pub83f+3XvVW755UIxUfd9/9J5tTN9la8mrVAQ4r+c4Cz/nppmMXY/zrQQzGr1wSOiX0K0DCnvribo98AiQDu6GV4mk2RuP60fBjE8XmO0WHaypgkyBRcURkYLQ0lhD+dad4Uh7hc0mpfR1hLcGez1C2yJaSmWQtPT99d/OQym4QbLH5jupltMnWPYLDHZcrHPsmp0EG8X8+9VvN9c36C2+L5jIm7He4WO1e5s8DXNniOLItvw2Brvbt61GfQqXLEZPz3ZVjtliuoLNUxfh11tOrnbsOMu8VL6+9F16PRZ7MeTTHcqJewXUOy7+y9cNN4U5Ih9qkrFvN/hLrAl9ouxGP64arPgmqFu44t4zpKtAijrW6C/aKCmW/zrnmNxxpg3N//LK/+2s+ZSJBSXhjxZM0Q3mQUUGz3nnNwiLHGmJRthS0SXTRm2tZT+lsCixWflm/Q0OqI/DAElwSk2FpiuEdvVaRKpOF/JGn2wwp8Ko7T/93wAAAP//Gm+GWA==" + return "eJzs/W1zHDeSII6/30+Bc8T/LDno1li2tTfe2b3gktKaN5LMFSV5/xcTUYFGobsxRAElANXN9qf/BRKoZ1STbAJFam/8wmGzuxOJRCKRz/k9uqb7XxBhmsh/Qsgww+kv6Mz/b041Uaw0TIpf0L/9E0IIvZN5xSlaSYU2WOScibX7OhLU7KS6RjndMkIRl2u9+CeEVozyXP/yT/Br+8/3SOCC+jUXWOPmE4TMvqS/oLWSVdn5awCN+p83AB3QcVicXp2iN0zRHeZ80flqjUb7lxqPgmqN1zRjeQ+yQ+Wa7ndS9T85gA5CHze0g4mHjVhOhWErRlWLUwAVXa1W7OaOaNAbXJT2tDTVmklxdxx/g79j7tdDeGWoQv8/i/BdEZWVIjRjwlC1woTGoNwVwEQNTDhUs6FoxeUOSYXolgpzEK2casMEtvDj4nbeAn4QgqriNLP/GQOp97igSK4AhVNCqNboTAqjJEdvmTawGDIbbFCBDdnQHJkN03fA0p9upalKgauF6/BiGv7g1vPkvBOG3YOeDc3OovfBtcBlSfOsvjJlAM/BH28VMEZhoTk2NK9pd3GJcJ4rqvU9cNlIbe5MtRWuuMlAjP6CVphr+lCc7fL3wLaUKoQtl2L9UEws6Ltg0pMvkQ+yy133O80uVo91pF3s73quXbxTHG4Xp1tP2GwUxSbjdEt5HD3AwkMAD6RFgfkOK4peoKU0ghqL6WrFyAL9JkDmbKnaf8/l7gTZfw3AFTKnCht6gjZsvbGPDXzd/s9dtkWwoWup9jF2duZhNc/f9M7e2EexVlO2TFX6xH9nuD+j5N+xOEHUkIP7IVIIStwFjKKvfRLsS9VV0GBbGN70g5gwUpSZXTSAhd4M2fkgDhdn7y7hl7cvSGQea0EL6q60nthnGrHy+fJ9Z23UWzukC+AyU5RIlev7IfIADR9rzdaC5uj89BINFw+SsiiwyDPOBM2wWlcFFWY+dP3yyC6PmuWtibamOVru4RpzSTBHuMqZsZ8c2k69/eEjeMc93PeVbJ/DlvBGIuw4hTMqDNIVaMCrivN9wz3i4C5KxbaM0zVdSH5PHj7yLH7fUIEwaJa6Xd7ql2SDxbrW0L2+KXmOtphXB7m/3YSguye4CUF3t29iWSltFnL5d0qGUizdpVDUqQluWRD7gAfaYSWYWB+80A5jNg/bdLG1SgC6OD8KXVIpRYXJLIz5ZI9b1CML6GtKxR2wlWLF1pWi+eMg3K7fwf12tPF2/Tj44i1VeE0fROhHQ75D7MA+MOdyR/O7cHhRcWzYlmZEVmI+YWKkwRzBmlaX7+C+YUYjzQShTqg7abPDGhGrmlsBpBDhFKvOBvs+0pXpYvNwH+kbpmgpd1TVVso5XVGh6RNxnL75eP51OU4twv9wnP7DcfoPx+lX7ThFnzRFr8+u/EcLgc2Clf/wpx7pTw2R8wk7Wht0O5/fgwX+4YS9Hac+Wwzp/A8X7T9ctP9w0fYWvNVFqympFDMhpgl6U9oFB8t9wDuv6QNxrzxc9Nq+0oejUF+5mzgligfdxH0bj0kd1ca7+O2qScGp/5k25TBowRln93i47qgN2ifW6dgW+kFOWmHCeJibD9pxV6/P7ncu9ULISLTbMLJxQtLbnIquqNLo2aoVjSfo6v27yxN09f+/OkFYWEVnAHYlldk8X6DTFjjBAi0pwmiDVQ7i16VGnSCMSiWNJJKfIBBlhcuqkquhzLVK/l4bWiAtV8YCWaALg3IqpKE9I8BLeoIr3dDe/XT4TrltLkaM6BO4Fo2dthhYB3JL1U4xYx8tVdERv44P6ZYrdOCguixUZ5a1BuRuQ5Xzp/iHDG2wRktKBZJLTdWW5uP9qV6q2W2bGV++g1uZvluAtcB9lWV69an1Q0t0tDm9HhzzoRUO3arBqXy0tto13VtbrtIu8EJwaSpPf4V3zcUBm4/Igmq7aWk/H4BG6K1co3NqHzYV3oiDxYZIHbudGi6Ym1bbJZEBe4QTU9+T3N14IoWBAJ5cISa0wcLUaOggjoYVxyCYDz3BIey8jW+XQNh4cYpr35pzf2L0nprfmRH2GfCnvxixRrNZvZEVz5GgW6qsBK35rsRKU/SOGmxRw2ilZNFZ6tlbudYvLjG5pkY/H4E/Z4oSw/cnTXwKow/UCQvH4aKD5iJIyLHtcTdKjkyoASXPaakoAYPJYpLTFbNqgxQc0DJ4ya0SX4axKvR6qGrH5UB/xu/8Pb84/8HF9LyXp1bM3bfoDSYQQXbnpUYHAbtjoLQ5boHv2eMosTKMVBwr+L0/2MUkZ4xAH8UpIc4YQZ7mlMkj2c57Ji//cSaHz8SumuZAHnZ95fLvGWxkeCxPBrstPkboJUdNUaf7PkXcLNlS3f+HYaYNNrSgg+DoE0EO0o8ywvHgDj8R9KgwAw/dE0FsM/I6PRHEmDgOsbQaUy05ni6n5RQfIz3Skm1FXcQglg01odeE7MzOF2u3gMVmpIeMlISHWREDPWQE/RYrYpqKo8DrLFQUHa9KkHyOXKNtRiIfClDw3uQjc6jV1SjmUO/f/2nfN2rPpCD2ccBGPnXLdkLcbFlacdil7pldhq0Ywd37/FauXbyhzmipRE4VOEupF1Sjra/YDc2RppB11ftxfw09bbDUhzCC/WCDpTmEEeh7HcrYExjfv3QcY472dQ+a3I8Go5B6Er78VWrTFZF8yJGaipyJdf2hDrFNx4f09dCXHcNgox9NEvbicvtTk8M/dd2HxB3t3sivlbjbV6nJ++r/XfKOos5JZMNQLjhHWtdbliOM1mxLReMk+3oVAUui4/wXaS2Q/Ckqf19HRGPSoSHLfabolwRn3Q0ewgHDvn292Wu3NLqEi3TivdkGo4/7kiKCxxJkSRFlZkMV+nQhzA+vkFToDZfY/PgSLbEGLqoDZFBNAKrfLfs+Rt39ivcNYdB0xmcE/0IwEW4W67he+at3MEi1w2pUnRlN6+hItM62u5S8uPzc0/cw1K8NjxTVuS3uEfVoQ7o9dZyqHfGgcEaxNYPaC/ebvrZyCx1S6V8HEiMuLj+/CpAgnJODIpCgwWhM5RivT8uoY8Xx2NdnQ3FO1Syx619hKXRx/pAoqcO3GywFMMfFSp+0k42TLLmfDdeK1kWraMFFsabLmeScEiPV1yiALfUeIefG8hzTiDjS0dxi2lNU38qh2oIOEPoJWnwFWT4VVbWQGpLdCinQcj86NIQU/VJRDUVQmhUl3/tzsl+GRF2KyQZpllP07E/IbFSFXv7883MoDdWUimaVA5R4EsrrHSihSyk0TUcK8tVwhSsRrn0KVbF0Qs9eZR2EgJ7hpdzSDjGYCGZW1uJNG0VxMXl/yFfDNo9MKpqzaqinxSDUNyHNsXEssBVi5m/Vyz/98GftRPqLEgRojfTfRrv5m7UH3+I9Veglei0ILjUUwUsBJuW95HoI+gODH4HcytAqP75E/2q3e4J+/BH9KyJSQcsLOCa36An6n9z8i/0i06hPlG+CRyhkHigafiK2rtjRjGDOl5hcp9WAHXJ1wQA2zq6wRKQiLyUTpu4uEkQUmCOjSslE+WmtPqhLShjmgDFgqo1UVrMWe6d12A+2mLPcMUYIKYRWshK5fWE4BeSZWHvl6Nbkxf6NGEGOEQv01+FA2GjiFPZc4vypvHMeHaTZHxQV1ChGAlaHN4W7XwZb2D33tRC2zz42rUYrV/WxLdCvcmePZmxzMoGkssaYkeia0vIWoj2JF+8rIZqSUAy2ZXmWp4q6vq4lz5oKqJrVUFZVOTva24VbpkyFuTXae753EXBxsIJZsxti5UAMtwt/1S/OkbLSWoNDBYiG1Zqa5mu3UkKrRElPj06Jumb/ECVUklDQWPBfnNe+1w+0kIaiK8/vda+c5X5KUCLoNuICMV9B4MWvlOmSs5SZDU/anNdspPY/Cd3MytyE/A63zr4BdZmm57raavFPyH+PCKMTLyvGHyFGb1e1xtHl2eml1319US4rSqmGGi+CJ/KrS4Oonob7w7dpAEN83HwNOVdq35Sv2p+0BrvTc8AyX6CXP79CO6B7QbFAmPOwrwCc+qAmtf4jtKPK9cBD0OYDa4OkGJSL9In46Gri103EwF1NEbb1tPtdqhwIB1lNlGyE5HK9HwbiVkyNtFiEfkZkgxUmxhHRXuo94A9Oc4Eq4XN6eM9nPllRG7ug2wXqUwYRDsQuwaIorJIpRR1GUHg3KdNAsg7USkxAY3UxCuF9DpIQ6PEIELXBIscqR0KqAnP2Ryi/V6oiSJ/cZzkcTSJZLUdP0r2I1GLdIPOCsxWFHQcMfE2JFPmEgt0ed6ZNSj/LgQ0xQWRRcmqCDDDpRMWgwBvFBmKwU2+mzCMx8pVdO8jOU6zc58xJ9iukMJtIx9TWp8bKeWmznPJHIvxrkacguwX5hxSpuy0cEIt29VrFdOm1H4cUHomoZDf6FBl6Y/zlQ1uqdKecIj+UBxY434cy257iWNtsy/SIVDnN072DPsnGP1O6WbHWMepMm+aL3fj6+LVSslgA1AqK8jWhAismnVpfVNyw7w2jCuGy5HX1S9vLpsACr0OluQhxCO/02vrUDaUQM99qJHfCRcYMLsqhZ9BjDP03lRwnHzGjEdkwa93InOoFeldpA2ZSF6i9ldhM5OViQ488pIMCbLWyeG/pHJoQHHK9oKMdtIKigjiGwFa1ztmW5VazAX4IC7KrWpB9HBAvvMmbkqnZdtiep4sF3VhOZIbv675XRoK+ZpFyzRkP+kYjHvqkC+fESuNGni1GSzbpZLKKLYGKkSL3UIgN/WNfFdAgv1S0mo2VLHc7Lmrl4w5rBEjkE3wDyP0Qm6gRlYIeQRPItHVhEry+6yIFrmWWANUyS6E9lzFFUR/oy+hQE+hKnVfkcUzIgfkYfGNGz+W93pxjxeZtcu2YYEH7QAy6IcR2BGEyUuJjKNa64qnDThNWlKwMkQV94XBojBfIyh41wESWLxwJegbkBIPQLR21w51tY/XqvgiwE9k55PJJW7w46h3oXumm0sVCg7hTSQlbsdbwCWu3vpX7BE95XTl9NlPgABoXI8vbgonaRZX7IEsQb282z3UIn/tWetcSlAr9duVTY5muEwKGfjXk+8IOBiigXpWkLqVmEQXHnXgLzGmRuw5TkMpf393JLjwVN+OG2Y8likRVUMXIfWVRcG8zVLEd2Fi3kq25GU4sufs92tqWilwqnzB7cGdy+fdH6F5Th3YDbc27iKWvBR+R20rQw4g5SZ+yV9034wvpq/69mPFerg1ucouFNAjDmAiLZDiBlst1VieqPIpQrxnx3kJ9jp4pPdn3H5BuBV2r++MOu1iVkjOyT317DsiFS0DAN9cWfD8hl4PDlhIT8EPFKSAWFqdSGHqTWmNtELoQzl/X9kPFea7tv+BRhVFvgFCoAcwtj7ObkpkNx3UmkAVTgct6JGfTKwQbo9iyMrQjIcY5+n7Ap9XWu89fWHTocjhB7OFWixv1Ov/NAUNwmF/k58529LeAcQsVYJZgdcNB3eZ8qS1VC3RF3aFUmqoFXlNo5e0z3VdS1TiMYNdgnN5O3NAt9/tO3wqp0FLJnf2s/qvXNZ3ZNdlP+iK/xMrEdtM1gGN7VPydGs7xne9ONbN6E14pWVIfUEz1Fp8KhDlVpskuUu2i/m8uvOXFR6cJACQhBRTmHAkpvle0pGDJHMp+ALNhzienHj7a2CumGdD5grkIWx3+Ge1sx8zGK8tO1qNzWHAJ1SYCSfH9Wtr/PvASgJKSBRTHhPvGnWDgC0DAIilXyEoHw6heoKtWpgwHG3Qrq9JgfObK+SptjRhXMuqSbXIvfj3hMSK80qZmSP8/o2OCnzBtT9LXRHv/hlV84dNpFWh27cfdsLBF79oypVPKvr3N8LJYngMWCGstCQN/qT2NoD0JB/aWXdNfEEblZq8ZwRzlTF+foFLBTBQYJfZtWFHGCh9Te3nPh97V2ShcUAPDzLGGLl4aGjm4XgT16HzZC9qPS2t6U9HQ+Gly78FjaXydM0zwMDnxTWRRVuM7mODYMNoxkcudz6clUhBampMmk2KSGKNtrirO9+hLhblzfuaywEx4qSE6C3E58XR1vZ6x1KUDW7cq4Vsmrmnua4HqRHSswTvlDRT7yTcNaguWHzo4PuoKkVTUdSc7ObfEEIEavd+uHguv30rveUVX43Y9TdCZqoINBzuldrH6NQFbx/+HNe0fI2vaK8bT3/Fmy29gteYaK5pXhKI6ckTD7jZNFcM8C7ymyR6RK1iyVpuH72PnAbQvzKRfgJJrfVTLgRgeY7+6feg2WG+aG2rVwkCVYUU2LvO3rrFpygzPakiDFmF2I80yC60IDL6v/39caYqsPBeIQc5dJWBEvv0TNMJrUfMFhO0QPFfYeXv0wQm/atzn6Um/WEQWy3qerlz1HixfNqru8XrBwNe5PX1dbQQQmPb4zRMgDVyJM7e668k47Sl1Flxy13hDPudlvjhH752keeYbNyA3bc8X/Vrcnof1aueAfgxffsf9fHEOJPUlb42YGHsP+hE5lwbotrBwTGRlwY7psJG61fuUvez7UV1foO3UhYN+7InhyIkv3Vk7Kffi/FZNNpZ/7hZN1iL2UuStRrtAZ64+0/c75e6Dw9osIKj63/jhG++OW1amqdyUpnmMKsGpdpSR7kHZSbTFiuElH1UBuqYMTKCS4wlBoKnQSfuj9A60q6q6lRdWUlkNo64vZPacr15cXA51aORbxjqPwlRd9pEDBe9cC9lGWhyS6EIYdMXWAoOwmGDRUqqUzWu/Hckvy6SXte4moasj/KdFpDt82nJZLgOM8/63j4gJwqucWnHmB9m6QfjPXtcDjC+dQ8SBBem9CPtFIDI3e2wTnFPt0xLGjOlrq3Ifgdc9SvE6bsz3/mn4wPT1gZCrUWy9pirdCLswyT53YwEeBzeiWVG9kTy33ONs9YlJo73Q+wyehXHs3UvlZx+cjvG8acZxcR4uI7lzdJ7IosxmzruCU/G5VzDG1fn3dLX83qIjBdSnrtxs7rwiU1aaV0sfKWusi3kjLaWCzgNWrtf4TUyJ84PIH0UBHHfVX8Hsc/cQ2U1MtEZ+ZoUoRu8wqfsph5VbK4JmtWOk+L5WUNVhKeRszehDrRXFOnpusDbYVLEU58YfhRl/NLPDLr6UN4jlL6bfL/uyVnNgaDH6NGp87O6CxSJ8det3LPH0vRGTn4/n7h3znDEhq1gxzk4diV5Hv1NWksZ0Oow8sj9FBpy6M2OPJU45t3IP6YoQqvWq4ui1XR8RmVNtWaJu9hu2LJjI6U1kAnCmzXGa5wNlCywMppiqkVhSBfHNAivGIYMn4MFz8XexRhiI+L39bXBnIgEfyqVrLvRIGrFfHT1r8jlLqnTpi26dhBmRzKsIbUJ83eHp+USRoXNzjd/j1AklTvlqkry8r8p9236ImdAopwYzHnAyLGVlOr+b2Jrks+dm1h5b3OSxAR7TD6mhRcmTZfOcopyusA8B+c6XdQzfZ2tarXhLFcd7KOQy0j+u6FngRtoPwOr2v6arugrc+eq1YaaCxowouLHWNhg3bHrodY0axer4dwiOjWkCWUVkUdj7lIaNzhx0xDrJvqWSW5Y7/1ndRa6gejIRKpfk+EDj/b1lbxhvtUbSzcsLqwY3JSQ9PY6sr1dPK+v/LpdH+p2O3t7/kUsfgAnfrpKla5x7DgnF7uSvLi/QxUih6qKRrGutry45jEHEwq6mGnYd1ZC+jz/M51aHlXsnIrKlzFNXfI0q7oZKh8cFWVwm1KNN/G4JLmQwQ+V5xwXsS4ddAm0TD2FrljehnAknXhHbahyVgUd4+eMpec2+yyrlM1VP97785Lrn1IEoSNa4oaTqehFc6teShspb6y5MhxI3ZnCEBL3ied8h0lRX4i1mHI8DGahxhSOor1xRpSYmLbg7dIyvP17czRsrhW8A5QKwoy35dAPN1osJiciKbFnl+T66f4YVWdQ6oA7cStPjGp0f9FLFh6iYjNjlYFBil+lqjoIEprvZq67nKq5yZprKurYvmscoNNiurdhwoqQNLxzepMsSi03B7WxW+dnn1+iZr5X4XHGrKy8ZhwIOyAN7fVNKbb/5HH0/djSIYRTmWsid6BlCmpIKmlls+9AnJm0SPIMLbpgWelZXub/3pUlv6RqTPfo0aa5xtlT4MYry/cI9EjOBCszESuGCHkzHKLGCqb3p+yT0lMtLWBa9l7lLjm7bAnayzgJIoVu0L0gVsIRIZSH1+8a9pzv0ayXAlHwnc8rRMya2i+9OEJPkBC3tv6j9FxaY7zXTi+/C8UVDymzF8Whyfmwdqq/hn10iWBR8XSAn9/XwK7k62KjByKSYur8uPZ51GwRNlWXkIELbIq7cHWD2+d3vWFH00SUAf/fd53e/n354/d13Lud2ixVmkzy5k+o6ZsnyrRfs93rBboRt0gmGRWwlwtfsxO1S0jwHmNjnYp/AhFlJRYVmJKYA6biSEmBcxPeCBOIDsYBmO8zGw4kf7B2A3uexgdrrE7tEXVfLRJfCLHNtVOzKd6jXTuYQ676l0d7RuuYjnZP02GKXdjDYSKXxxSZt3Yuvd7EgVmzS0VRvNZkj9titBrsRBbY5LO8JC+Wj+wne33Fhkff6/4fxqq3K7Cb/PQqL5R0fvUfkIJKPwhx1HPcQflLOkLTVO9mOXfrMNBntdZYd9Ml8Dm63EefeHpmuW1azOeJhUPS1woxbWtfNXC69zLg479a2QScuaw4aug60MJjOKqxzrjOrIh6xn2MSryHd2lcfncmiqMTQEzXCThzXuOmh2L2nN+Y/aFinbnDTx2nWD8XtCov832U4atbiZrBhx0iGB2M3XriHnK50yQiT0bJE57LgAfsdVmIcdHjqqGtRlJlMJYyv3r+7RL85P2qblBpG5MusqQRX//kWfamomujdWnGRKTrs1Jk2uaHjEN2jD3XRWTCtq9HSScSHtAtUxh4jYIGWRzmOboNqAsGxB8PN4w9owByrIsFpWbAJ3Au4jFiA3ACt8mhTaXsw43a76oHOsRlqhQ+Fu6SCbAqsYpWVNHD3JR6NL35w9AmTUTpVFJjZJjovELqKW0DVAF6todVSArBy+fcEUEscfRKG6zgVnb0g6J6x2A+O79xWUKt6RkdaZJjAYJT45ScWthYRjfcO4OW63P4kbswm+vtOREaMynIdte96B7qFfFzk6Q6AtxxHlxgio2LNRMSiyDHoFLnRIltlescMiS4/RLbicqdxET93pQtbmG066AmiLkRkTKQUJ0yUVBXLfbSE9xHsklynAb7FPAWvsDIrlTQyix+SAujbnzLwOMaHzZPdTS7XWZ6C2BZw/Pw3IrIC32TGxHIb9AFbjuY0waNQMJEIaSbSIV1ynfElz2KHRXuw/5QQePTO4B3YsXshdmHHrurtwv45IexXCWH/c0LY/ysh7D+ngW1kyfGSphApDfT45pnIioqD8r3cJ3gna+DldQK9pKg4WxdlGu3bapmYr2MnIXnILIVSoukXEt83IjLtEhITnKBWJI01aQGnsSb1XldlglmkRDRl1UlMVSONNT3oTQIRYqSxhlkq2GDWJAFeCXYjsJCakgRMuH1lqZLoUdi+kqXZUJwncKvJoswIT+DDtoATBEkArlruTXy3qIWsk0AuqyxBTIMoZhjBPEEBkc7wmgqyj5h11YUtMN//QfNlCry3GbQBTQLZtYNJg7VLrE0Cfbkut6/S+KB1tmTmz0kajRGdxZ0VNwCsZHRRrZNcc4BKiYpf5aadjz/arK0OYGo2zs8f3znigIPalwS46yYfr4NcB/aKcZrChtHZKsUhslXM4uw+4BS6gc5YCUmKWRJRx8rtT7k25aiZfyTYWpEksDlb0RRmjAZHc0FzFq1gtA+biTRcUsi84lQTmYLaHjhbJ5BNstQ7bKLO/O9AD2WQRwGs6Jppo3B8T0gLO4HGp2iZitQqGa01dCJXieSry8x3LJ4AulEUFwkUSVcKlArtdMr1biOZztyE2fjQ91jhJAyeTxTCxoC8dfPtY8Nl2mARfc5xrs2yUrGGBdZQqZsVlAJqFR3X+Hp0XZMcGyxMbljFH3Z9bKeBQzDXOM9j3wGWxw6r1q2DErxFrMiIkrJI0pXIAk5gprEiS5Mc6TsepSBzeR29PVOp47csZaUuFYsMlGPDTBU9+4wzQeO12Gmh6qgTdRq4UHwb363Fpet6mq24jP6cN8ATpPxbmze61LFAE0gca0MnQDV6bgKX6ySsK9ZJLnApVWwBViyrdYprVjBNUoiFQidh2BRzIAQ10FwpOtzoMtw1gI6d8eegxk7HE7tdbAskSUWZdAOgo1uiMr5mJBVbZ4F5XA+GuxNUxX+zyswN5Y0ONupk6hasG/GahMkSFG76mTixhYEHG1salJlzJEVHF2ttP8zIJlad/wg0vSlZ9EBASVWxVliYUc/dGJB3SQDHf3pdJ7JPnwZTQCMAVnKdYV1GHBjQBa1wbKiKYp5Cv1OUAB1c19FEwOMT2UKO28K1A1mqPAHG8R2ZOoFvWDvfcIJ8AE1jJwK4gccJjBNNv8RngFCD1mhQE5hSmq0TCF5dxvayaUVS3ANF8uiKtFYk1BU3AmATb8RWF2alo3fV3BIRu1AiOC32oUBdk87Y2zdrE5+tHND4Eb1mpmdsuPsyerfWKl8myUOvFE/wFlaaqixnsavek4ytqCNDKchgiDa4iO0N3mZMaINXCTSDLVMmhRq+LUWC1k1GqkrEdLOG2qIFOoqeVkaiD5VAo6Wb7JGEw/I+Y85ydKZozgw6wyr33Qw1tH8Po+MmZyWk0tSEUAADQ/QR9DcgkqNQqU6TD8FEOsq9Lkou93Q0WPBW+q1kFa2p9x15zNLQ+Yxg3pmia3qDCjxstNDGYsW6Gg4DSY4kZxqGM9Sr+6OHBkpIV2UplUHjxqMI7TbYIGZQqehqihUekJZ7nyEUIcJ7q6NBATHhO7tP9IXmTKSeyN9B1a7WxVMjI9fUbKhatN/XG1mNXjSEBN1S1YwjMhKVWGmK3lGDYSK4u6u4IcGzt3KtX1y6stfn6NyP+DpBZhOYUgTNgD9QP/oY0BboPTW/MyOoDp/zmKmTEG8FI7ubWwSLu81qihXZLJhgQfxg5u4M/bUH4hNmYUAyxAuOKwGzftcVzHGtm7iHG7gP+rUf2FP6dtzNnpom3H5+8YSxbw8ii1jTdLfOq7As+khvDNyKKXfBHNOoJwRSO7juPUyoFnxi4iV0z004Dhz652pqkKJfKqrNgabdx2cr379XvlMZYCyPW9VJ7KFHqsk77btTDuHkMILYWO/v0KFd/xLceczZ/7fPN7SLXZzXQgHWDvMGWA3xknjvycL2cVliTZFL126wQaNb1ZyS/8Xj4CuaUfAN5lK59vVBMiKENdKUwrgzfHhelcJCYzLDeN9Rh2m3tAC1t2UaUimYgHYI6ZKqgjl1Yy6k2yXdYA62ZZyuKeJ0SznCWrO1cAfXzusPsz60ZH5E+Q3rH+D05aNMeraYVYJ9qehwTCIOX74Ovsd1TDxuCkqt0bDcXUgihaCQW4F2zGymBAVCgcqQRmNX9KjyonubFpacIE+aJ4rLNSOYI4vBhOkDWDwudrDUxJjGx6NdudnrMHqddLadHGS1xn7gMWdYZxuZ3CZwRlxjrsEslXaokZWK3RE84X4AyF0aiy28aX4QC+EUq8Up19Ia4r37dg7BcvSr/8UCnYp9838j6AZseS0MwvmCyKKsDFVhMZzEjW83ls48+2Z4FjBjsXcgzPytevmnH/5sbd/zznHUFPsmiLbn0yxuxOyujhu8pwr9c+OT0y88GoBc+NbHrv9Jz/OixbnH9QfP48jk5dtk27fDgSl2nQV6/9vH13bvVFHnPAF/ac40UbTEguytVunVMz7MBUFAoRP08d0v6EKYH1+eoIv356//6xf06UKYVz+hZ7vNHgnKzIYqRDZS+1FpUilKDHzrh1f/+388/zZIEWo2CWXckB4gUxcFDo/j0Ym5757X/Mrx4kWNVPiK508L6a5sugXzIxvG3fmBD+E7UExb6+QzU6bCHL09fR9E9g8paDpf1nGc8X+loIswbS26X40IhY3cLjzhCJ7iG3zgHNbY0B1+hBHpwN2X6DTPFfhpHZeH0GmeXlKUx8Y5HxoLuTh7d+lepcnwWIH1jNGPnlPJaar+7UYXlxaVCe+XpeGRkyCi0NCuPU3DWhPL3HSteQVEB12c58x+GfM2YNuZ5R9+52ZkAGsSwgWX/oaf91lghEqba51Er7vrk4bRe4/hpVSmEckjoZtDgA0OgJn97ZJXz0x7tx8m1vVjUm/r3RThBQ3ZjXN5cT12YPlirSVhVuV0fqORjoOsXFZYrOmiMZ2IFCu2rhTN0XIPMKnIIWsoLGfKI1sPjIpGJ7Tl4KKrBP0OeETdv1vCFd0BoGghDc18Znf8PKP4pM2FznDmUvETgC6NSgN8lYAlVgmqhXmK65Cq/0mZgKg4z2pPXDq1fGjB230shqt1nQmPoMG+NhuqBDXo476kJ+hT/Yy9BQfYj+iydoCNXoLfpjS1elTPDMrEhGlcI+394icIcx5UJsr2i5DghhUk5m2psm8gE0YibeAxZwJ9upgUKAQSZJPJq+gi2wKVZYKxbxawojp2Rq8Fm6DExb2IsVPRwd+eAFs3WiHjVKyjT4oEnK3ykVALndBAncqDeScAIxCBdIIVwuiNVDus8vGcboRO15DspRC2N/4GcumW1OwoFWHVM3LXxPvGuKXBvBuqc8ggaBkPmRGjHTLh81whLaFgxoolP2IjvMUtx2KOOP4dHJR1gkjHRTnaYN9l2UZSttaCXYMB2395YkcqKYEuBNt4/eDuFrHHyjBScawQ9ItGNRLPXt/88lau5WoVnv5OSWY2NPnx9pD9aBd0t7GD92uLt0X3tDIbKoxPFp9EW1cxOyfcLaHHLTmN+idN1STCsjJEzktpv+Q0wlcVIVTrCZyh8/hxzdGOSzwBvJBVcddS7VGgMGGE2xzCqYcjHeBopRIE+HQphX1XrNwKKYfND9FIUervahuvH93Eu4mR61oKNQOc0bzZj/fDDPRhJpBmpgrITwTFBdSLaA91gzXCuSzt62I2lCkkd6I9Mkc4g2+kkMVEXi3M5NDMtaifV4mwyj0TuZU/UumGABi9YZyiU4/YYkSGuzh7RbMxdycnE8ab/T9KusIkCa581kJcKoT2GCBEzHr3BxDC5etd+XqN2JSYTghdypTVA4HNL+kGb5msQLsksiiVLNhEhiKdG7nXAi85FJGt0Nlh3JjYNmInIZJDDHtaJwoi0MMw6nCZIxAMrN/gl/p0O69se98m2a4ts6yEGZazxdbocygDz8gxZv2dtCB4j9dUUMVIvSUgCCT6DVMLmNnAUxua7YY8sgvyw0IbNR38rPd0TNutR9vTy8N78uqFWyvhvoKmaWOEG1ZQbeW60/YULelkEMmfQrSmELceBDQefOAxqDuy1jG9ux+NtX68255+yHS0Iad33pp3GN+2w9HeYMetQLiDMPh6d/fy1t2pWc/OXbQoe1O3n1y0XqrzCJBb5HgjQL5edvzx9iOLNdpgniO7m3xUs0qQmHfsDvJjVnaMubcRMzZKPZSgDfzU0St3KrPJCmo28hGiJLjnSUYODf+1yQOHXkpKJvU6HYjqfJDc+2stIgf4MpEn5L8WP//pT+jZ2/PTy+fonGnDxLpiekNzKIUP4sLlWibvC3QoEgbZsiuHhz9m+OJExpiSib2Kh+o/7amGMGhuDHjkow19vs91IZD239T9dhx/gFMoZopFqE16mymGeazudIONfMA5q7RbAUmFNCsYx8qJJys27R0i8K6Hy6vgnmuWz9lppJsp/8kyQu1FHPTFbC95ujqLU3HorkNYw1cadvy/3kkEn4x4wTtuaKcsIw+7MqVKmRgwCtkAqaVaY8H+OJBVLdKxwl2JfQSluzw1Qe4VU8Fa0kRdf97Y5eC1cC2+XO+iXlbzrxRzsyFYUVQqmsuCCRwsuOuIp0tsGBVG35oez/Gcu32LH3WzrvUjLRMxrr0631rBVWJloBlSu9XDYnXGZkde2NxFoq5oThU2NM+iJZUd4A8rfN7UKzbBs0sltyxvmof57+Gy5F5THTGGb/5jn7W+ThtWcNpNsnymXTZL+l5/Zj+xzeDwUMic3DIXPd8MFfeJFnCN0hlzKPh9NU96AzpT50edSuh1YKNORwWNFWukjVRO4ltoBTUYVvsWvrWw3/o2vPuC5Tmn80m5d7DeXeVc4Hg7cu8oOVePx5hnu5d+tU6HIbGvo7MnqOTYHpl9n6VCVBC1L6e8/JAKOYM9eYcMOtXYlr9KbdA7TDZMTJh0OU4kOb4Z0vqTgEz/UlErPqx+5Jqc6QV6m+MSfYb/cfpRLoWrO/3b+PFEG7ylVnPiFCv0paJqj6AHoS6l0LTWqMLFqXa/GfxmHnnpe+ARC1mxugukcNt3ffmm8ay3NAOqLQN98M1R74opTHlK6zAb8njdWrrXxMjahv7hZRqpSoigHatPmpfHRZ5dG6mJGjsPMfMWZvqDwGjHRC53GumSErZixH5yEqoT9Hmy4wtit+fwbXNu0DPoCEsFaZ8hCF0+71ALVQLe8bd0jckefdL9xrdNBLYYFtJGz661K8xgsE+89l1TC1CBWjVgMvsijije9AEIVP/3Kk2hnGdMvv620yvUU915nXod2DHsMMho/jdHbHaevN6prfoMX+96r2Xda9j6dBfQ8W7mcdg1AYP+2bQJme4YRicUbkhxe/EzlA3EHAk4WeEGW87pignvqwfhBF39ClxONB0E7I4qFEuEW+uAGah/sQVj47NNvXffS2miN2XjwzYGk00xcwv8dlUgOBpZR93jSDLkZclEvAliUe+G3TIUFaZ9PANCqlu2A8fi2mi35f2BqZ0jrNO+fbdgXWJV85T980m7ld2GjVqpI3s7rC3rkt/vtD0TfWaJa2sh1T7dgf9Fl1j8260dY2pE+l3Ua/U89DRZsvzlBUC/ZW+PphKNdlX3Wz+8q0kuyKgwSpbHiI5cVsuRc+FOPO7XtNY2vaUcAXB01R3z3sMzWZRY7Jv7CNcOxuk7e2VLlX2GMiZWMqwUYH2dukboFvkxsCJrzHY0bVf01ZdUOQJvKs736D8rzNmK0RydQ92zcw4GUdnRZUakvGaPFHT/nS6RW7+1nzGf0uajd5ttw+FlZUDlPnKE6e13/UOzhJ+y493Rzie/QB/3pdt66zmwxHEnOH14iq6yqM1kB2hbHJwjQn2rQ21rh8jM4aprlMs+ds6zWEpVe/shxPzh7cSRd3rlRGanmhZl2jlEB0hhV77Vc1+jqaRMpIn0kbLr2PNAJTZh1yQRGdYxo/0dwMqX00eGXCke8Zg7UCOeSmOMZpWK5Q3pwNRUZXgdz6ZsQUd/nvqgo6Y/9kF7rk8gWOiNoQJUq/jGiYUfjZsbRW+j6CBVJrZG5ZaYo5awJ3M/wrKgXr3w/33mUXjh/8PnNYXc/phTFc7O89t5xOi520w3eA4e186otdF2cj8QzZpUTKyoUhNx1/G+Z9lXV/G/lfRB9+wMSNZ9iVedYwhcKQhry6RXKrDEbOz32sXtLdt9hAxi1f3TX+k4QWt64CcrN1TN44+wOrvPeHp2BqMfn6MzWD+MGlVmpmYpE3Q+o8oP/6S9LMwDzXlp0tBxh5CdA7eLfqs7naIPnjT741iv5P1bo4RPG12xP8LeGnadSKZc/PU1EnQtDXMHWG6wnpgApcncbYU6R+kWnx4uaI862QSoUYLLgMfqxul1/U04IUWz9RwVFf3+Rs3Uw4+Tg5atNGFaV9GVToAMyVLpvHUPi6EAhlSppD7Q0aF0pedruzi6guD0Iek0S4ZE0xncR5GfXUFq5+HHqCM9j0Py/tLzAI7TIlRrnm1TvujDkKp3ZAeRyTPLeriK3qZRpwLMrqm3qBM1N/imHVfSfZBAtv6ENMTrpEIXV6d/fXeJLu07hX4TE9NXWmwTVVIfg+3HnQxjC2KIbCi51kc5ke8mhNP2IAsNnWv6dTYtwiAN1I8gbKXgAS2XKjZqCvkISq7Do+kKMmk0AM4Gm2q2CZ9dLLeYs9wxYgCJoSCcrav1IUEIFLumez0U25E4v04gjQx7Y0ypMwYzaJOAhqNMQRCCn8BtYmtRV75Ixcz+lhtFZFEk7RN3R7wdHt4hFC7B3zFF+dDSjO1i2XEsMq0fa+CtXdnJ8N/9busarSC2rtQ4KyWbI606hLDDAAEGgFTYGgCykg0WYtQ4I3W7Kb8qIDIRs52pbXPzsPiZh7+/PX3v370Xg+WbB8VINfT9R+/ZxvR1tpW8SkWA03qOs/BzbprJ2PU430owo9Ezh4R+Dt06oLC3nqg7AI8A6eBueJVImr31uH4SzPh0gUW/6GBLFWQKrCqOiBSElsYaylfuDCfaK+x2KaWvI7w12OsR2hbRUiqDpKXvr/9+GkrBDZI9Nt9JtZ4/wXJYYNBzsS6xa3YSbBTzH69/u7y4RO/wTcFE3oz1Dh+r3dvsaZi9IYoT2/LbGO3u0LYa9Slcshg9PdtVOWar+Qo2H7sIv95ycrWj5yzzUvni3Hfp9VgcxJDPdyiP3Cug3nHx375uuCnMEflYk4x9u8FfYk3oR8pu9OOqwYpvgrqFK+49QboKpKhjjf6ijZJi/W9Ljsk1Z9rQ/C8v/N9Omk+ZWFES/mjFFN1hHlRk8JJ3foOwyJGWaIItFV0zbdTeWvZzCosSm41v1t/ggIY4jJAEp9RcaLpCaFevRaTqdCFv9MkGcypMJyelxtsPZFw009QWg8s/jfsU3jld4YqbDO7EL2iFea8Uubelfgb/+05yRD0psh0Z35atGYVXK0ZgkMCSUoHkEvpGdBp6Neei8T02M7zYt2xlfOsbl7HFWiRWJwuduk3ShERReIcKqjVe+75ERFr5DQPMQorkW7lG55TIfCLs42FF91G5ns8RE5gGCM8pjaAI075ocoWY0AYLU6MRtvENO+oRz8fvVFAVh3vIrHVrXJ1TO54AbaxtCxN2f2dGUK3r0799CoKgW6q6DSpKrDRF76jBoKn7mttmqWdv5Vq/uHRJtc9H4M99OlirVmD0gTph4ThcdNCc6CRDt0lcOA+LNhd6nVZ59mf8zt/zi/MffMDFtX1rrWvoCXCDiUFcrt15jfvawO5gkrXnFvie7s8dsr/3B7uY5IwR6KM4JcQZI8jTnDJ5JNt5z+TlP87k8JnYVdMcyMOur1z+PQv2unoy2G1ThUofhpqiKbNiH062VPf/YZiB7Zeu4P5hyOEqZyaDftRPEb2+4fSEENtEnKgbFTEmjkMsrcZUS46ny2k5PWpYbFqyrSjNUxeBTIctum0TXSNJmo/0kJGS8DArYqCHjKDfYkVMU3H+OvPhYNwg+Ry5RtuMRD4UoOC9yUfmUKt9dKBRo1Wzf/+nfd+oPZOC2McBG/nULdsJcQNN6hKKwy51z+wyLvmlc5/fyrUf6+qrGKCXnDVBFPWCarT1FbuhOdIUJu32ftxfQ08bLPUhjGA/2GBpDmEE+l6HMvYExvcvHceYo33dgyb3o0HEFgsH+PLXOq/UcyQfcqSmouk8zOVah9im40P6eujLjmGw0Y8mCXtxuf2p7Qc4cd2HxB3t3sivlbjbV6nJ++r/XfImrn3yNB7KBedI63rLcoTRmm2paJxkX68iYEl0nP8irQWSP0Xl7+uIaEw6NGS5zxT9kuCsu8FDOGDYt2/m99r3FLuEi3TivdkGuwprgscSZEnr5NFPF8L88ApJhd5wic2PL/tpXkSKFVtXajq/pd33MeruV7xvCIM+1bJJsIxn6JkxlR1TVxN97Q4GqXZY5cmUusOT6p1C8rmn72GkKMfj1DTXWtU/oh5t3wwTOFW3XT6kYmsmMK9/09dWbqFDKv3rQGLExeXnVwESoGA3WRSBBA1GYyrHeH1aRh0rjse+PhuK84Tl9T3TDpZCF+cPiZI6fLvBUgBzXKz0STvZOMmS+9lwk4PbKlpwUazpciY5h76pX6MAttR7hJwby3NMI+JIV4+H6yiqb+V4nMU0oZ+gxVeQ5VNRVQupTV24t9yPDq2ZxGUBalaUfO/PyX4ZkpkpJhukWU7Rsz8hs1EVevnzz8/RDvtRQvUqByjxJJTXO1DCz9VJRgry1XCFG6pS+xSavqv2KusgBPQML+WWdojBwiU6tXjTRlFcTN4f8tWwzSOTiubsqKYJtxHqm5Dm2DgW2AoxU/f9AZH+wrUJrZEej7P6G4J6kT1V6CV6LQgudcVx06zsXnI9BP2BwY9AbmVolR9fon+12z1BP/6I/hURqay+7HoO1MPU/ic3/2K/yDTqEyXc/kLInD5ZW1fsaEYw50tMrtOXPuVUSFOPRgO7whKxrnkB02RqKh0wR/JmRsAy0HAbc8DYzbE3UlnNWuyd1mE/6DSjCCGF0EpWIrcvDIeBDBo6AtwtebF/I0aQY8QC/XU4EDaaOIU9lzh/Ku+cRwdp9gcMo1SMBKwObwp3vwy2sHvuayFsn31sWo1WrupjW6Bf5c4ezdjmZAJJZY0xI9E1peUtRHsSL95XQjQ3mCLbphx4/rqWPDCWys2nFjCJv2MXbpmCkakX533fuwi4OLoz3YEYbhf+ql+cI2WltQaHyni2yOT0/4YSyeqZH50S/XkkE/lySUJBY8HfNr/6AN3wmxnNRFHsBwFNCEr7Tx2I+QoCL36lTJecpe5e8mTNec1SFcI+MEX6uKZRd+V3uHX2DagnAnmuq60W/4T894gwOvEyGhc0S4weRgBJhS7PTi+97kuwsORhRSnVUONF8ER+dWkQ1dNwf3xyTxUY4qFRt2hsylftT1qD3ek5YJkv0MufX6Ed0L2gWCDMedhXUFc/r1DrP0I7qqgDiw3iFGuDpBiUi/SJ+Ohq4tdNxMBdTRG29bT7XaocCAdZTZRshORyvR8G4lZMjbRYhH5GZIMVJsYRkUL7IouFm+COKuFzenjPZz5ZURu7oNsF6lMGEQ5NW7AWRWGVTCnqMILCu0mZBpJ1oFZiAhqri1EI73OQhFSqhqgNFjlWORJSFZizP0L5vVIVQfrkPsvhaBLdbRbeASK1WDfIvOBsRWHHAQNfUyJFPqFgt8edaTNDQ/vQhpggsig5NUEGmHSiYlDgpxtNa4OVeSRGvrJrB9l5ipX7nDnJfoUU0Tsh56MEiQc3PRD5IxH+tchTkN2C/EOKR+qeU69eq5guvfbjkMIjEZXsRp8iGMbtR5D7drg1dvmhPLDA+T6U2fbDUeAPB6kokSqnebp30CfZ+GdKNyvWOkadadN8sRtfH79WShYLgFpBUb4mVGDFpFPri4ob9r1hVCFclryufml72RRY4HWoNBchDuGd2l50SDlcNWLmW43kTrjImMFFOfQMeozrqUnj22c0IhtmrRuZU71A7yptwEzqAnXdsybycrGhRx7SQQG2Wlm8t3QOTQgOuV7Q0c4NTRPEMQS2qnXOtiy3mg3wQ1iQXdWC7OOAeOFN3pRMzbbD9jxdLOjGciIzfO82q63Qs/qaRQoY9LBvNOKh39Ltu5Zni9GSbXe1KrYEKqKP4mzoH/uqgAb5paLVbKxkudtxUSsfdxjGnlbdBlxdNEtALtaoh4aoEZWCHkETyLR1YRK8vusiBa5llgDVMkuhPZcxRVEfaKxRHy3UBLpS5xV5HBNyYD4G35jRc3mvN+dYsXmbXDsmWNA+EINuCLEdQZiMlPgYirWu+CM1zZeVIbKgLxwOjfHiB7iMOAQLT4KeATnBIHRLFTOpW4NOdZ/2q/siwKnRpAOXz8yD29wr3VS6WGgQd3Kj7lvDJ6zdumDOVE8Vryunz2YKHEDjYmT5aDJsMwk2iHdoikzCQ/jct9K7lqBU6LcrnxrLdJ0QMPSrwfr1CU1VSepSahZRcNyJt8CcFnnbXbi5u5NdeCpusnSti+4pikRVUMXIfWVRcG8zTX6+QyVbczOcWHL3e7S1LRU5zEm+VW7J5d8foXtNHdqV4+m0XcTS14KPyA3zgA8i5iR9yl5130xOgvVixnu5NrjJLRbSINxMUgsn0HK5zupElUcR6jUj3luoz9EzpSf7/gPSraBr9bjtd6P4S87Ifo5pOxNy4RIQ8M21Bd9PyOWKp8ybDhPwQ+Wb/4fFqRSG3qTWWBuELtpRAXV1VZ5r+y94VDGvEQo1gLnlcSYbLNY0E3SXWhZMBS7prhPqByXEGMWWlaEdCTHO0dcOdautd5+/iaHEJY4m7BrK8dGEjlluDhiCw/wih0xXfwsYt1ABZglWNxzUbc6X2lK1QFfUHUqlqVrgNYVW3j7TfSVVjcMIdg3G6e0Efo/c7zt9K6RCSyV39rP6r6Se42jNrsl+0hf5JVYmtpuuARzbo+LvlBxVh851pyTP2xmkia6ULKkPKKZ6i08Fwpwq02QXqXZR/zcX3vLio9MEAJKQAgpzjoQU3ytaUrBkDmU/zDEXpd9HPzQNxelxL5iLsNXhn9HO/FCNVtajc1hwCdUmAknx/Vra/z7wEoCSkgUUx4T7xp1g4AtAwCIpVwgmzDOqF+iqlSnDwQbdyqo0GJ+5cr5KWyPGlYy6ZJvci99mmgnhlTY1Q/r/GR0T/IRpe5K+Jtr7N6ziC59Oq0Czaz/uhoUteteWKZ1S9u1thpfF8hywQFhrSRj4S+1pBO1JOLC37Jr+0hlkCIMLT1CpYCbKCaKGfBtWlLHCsQZW3xLEgqWooUqjEmvo4qWhkYOfJi2Lwkox2Qvaj0trqCEH1T33HjyWxtc5wwQPkxPfRBZlNb6DCY4Nox0Tudz5fFo/bfKkyaSYJMZom6uK8z36UmHunJ+5LDDzg3hh3/VCXE48XV2vZ6IB9qPRcExc09zXAtWJ6FiDd8obKPaTbxrUFiw/dHB81BUiqajrTnZybokhAjV6v109Fl6/ld7ziq7G7XqaoDNVBRsOdkrtYvVrdsbkHda0f4ysaa8YT3/Hmy2/gdWaa6xoXhGK6sgRDbvb3Ez9LPCaJntErnpj/IfvY+cBtC/MpF+Akmt9VMuBGB5jv7p96DZYb5obatXCQJVhRTYu87eusWnKDM9qSIMWYXYjzTILrYj9VfP/40pTZOW5QAxy7ipBOMXK/gka4bWo+QLCevJrXdh5e/TBCb9q3OfpSb9YRBbLZnzvqvdg+bJRdY/Xa8tUpef29HW1EUBg2uM3T4A0cCXO3OquJ+O0p9RZcPMNrnVe5otzP4IbPfONG+rZlK7o1+L2PKxXOwf0Yw349+7ni/PufNdGTIy9B/2InEsDdFtYOCaysmDHdNhI3ep9yl72/aiuL9B26sJBP7ZwxvfM447PmoXRxfmtmmws/9wtmqxF7KXIW412gc5cfabvd8rdB4e1WUBQ9b/xwzfeHbesTFO5KU3zGFWCU+0oI92DspNoixXDSz6qAnRNGZhAJccTgkBToZP2R+kdaFdVdSsvrKSyGkZdX8jsOV+9uLgc6tDIt4x1HoWpuuwjBwreuRayjbQ4JNGFMOiKrQUGYTHBoqVUKZvXfjuSX5ZJL2vdTUJXR/hPi0jnLgOX5TLAOO9/+4iYILzKqRVnfpCt/fkCPXt9g4uS01/QpXOIOLAgvRdhvwhE5maPbYJzqn1awpgxfW1V7iPwukcpXseN+d4/DR+Yvj4QcjWKrddUpRthFybZ524swOMA2ulGUb2RPLfc42z1iUmjvdD7DJ6FcezdS+VnH5yO8bxpxnFxHi4juXN0nsiizGbOu4JT8blXMMbV+fd0tfzeoiMF1KeuYNyMzCsyZaV5tfSRssa6mDfSUiroPGDleo3fxJQ4rPIdVo+ToTfuqm+lK/YPkd3ERGvkZ1aIYvQOk7qfcli5tSJoVjtGiu9rBVUdlkLO1ow+1FpRrKPnBmuDTRVLcW78UZjxRzM77OJLeYNY/mL6/bIvazUHhhajT6PGx+4uWCzCV7d+xxJP3xsx+fl47t4xzxkTsooV4+zUkeh19DtlJWlMp8PII/tTZMCpOzP2WOKUcyv3kK4IoVqvKo5e2/URkTnVliXqZr9hy4KJnN5EJgBn2hyneT5QtsDCYIqpGoklVRDfLLBiHDJ4Ah48F38Xa4SBiN/b3wZ3JhLwoVy65kKPpBH71dGzJp+zpEqXvujWSZgRybyK0CbE1x2enk8UGTo31/g9Tp1Q4pSvJsnL+6rct+2HmAmNcmow4wEnw1JWpvO7ia1JPntuZu2xxU0eG+Ax/ZAaWpQ8WTbPKcrpCvsQkO98Wcfwfbam1Yq3VHG8h0IuI/3jip4FbqT9AKxu/2u6qqvAna9eG2YqaMyIghtrbYNxw6aHXteoUayOf4fg2JgmkFVEFoW9T2nY6MxBR6yT7FsquWW585/VXeQKqicToXJJjg803t9b9obxVmsk3by8sGpwU0LS0+PI+nr1tLL+73J5pN/p6O39H7n0AZjw7SpZusa555BQ7E7+6vICXYwUqi4aybrW+uqSwxhELOxqqmHXUQ3p+/jDfG51WLl3IiJbyjx1xdeo4m6odHhckMVlQj3axO+W4EIGM1Sed1zAvnTYJdA28RC2ZnkTyplw4hWxrcZRGXiElz+ektfsu6xSPlP1dO/LT657Th2IgmSNG0qqrhfBpX4taai8te7CdChxYwZHSNArnvcdIk11Jd5ixvE4kIEaVziC+soVVWpi0oK7Q8f4+uPF3byxUvgGUC4AO9qSTzfQbL2YkIisyJZVnu+j+2dYkUWtA+rArTQ9rtH5QS9VfIiKyYhdDgYldpmu5ihIYLqbvep6ruIqZ6aprGv7onmMQoPt2ooNJ0ra8MLhTbossdgU3M5mlZ99fo2e+VqJzxW3uvKScSjggDyw1zel1Pabz9H3Y0eDGEZhroXciZ4hpCmpoJnFtg99YtImwTO44IZpoWd1lft7X5r0lq4x2aNPk+YaZ0uFH6Mo3y/cIzETqMBMrBQu6MF0jBIrmNqbvk9CT7m8hGXRe5m75Oi2LWAn6yyAFLpF+4JUAUuIVBZSv2/ce7pDv1YCTMl3MqccPWNiu/juBDFJTtDS/ovaf2GB+V4zvfguHF80pMxWHI8m58fWofoa/tklgkXB1wVycl8Pv5Krg40ajEyKqfvr0uNZt0HQVFlGDiK0LeLK3QFmn9/9jhVFH10C8HfffX73++mH199953Jut1hhNsmTO6muY5Ys33rBfq8X7EbYJp1gWMRWInzNTtwuJc1zgIl9LvYJTJiVVFRoRmIKkI4rKQHGRXwvSCA+EAtotsNsPJz4wd4B6H0eG6i9PrFL1HW1THQpzDLXRsWufId67WQOse5bGu0drWs+0jlJjy12aQeDjVQaX2zS1r34ehcLYsUmHU31VpM5Yo/darAbUWCbw/KesFA+up/g/R0XFnmv/38Yr9qqzG7y36OwWN7x0XtEDiL5KMxRx3EP4SflDElbvZPt2KXPTJPRXmfZQZ/M5+B2G3Hu7ZHpumU1myMeBkVfK8y4pXXdzOXSy4yL825tG3TisuagoetAC4PprMI65zqzKuIR+zkm8RrSrX310ZksikoMPVEj7MRxjZseit17emP+g4Z16gY3fZxm/VDcrrDI/12Go2YtbgYbdoxkeDB244V7yOlKl4wwGS1LdC4LHrDfYSXGQYenjroWRZnJVML46v27S/Sb86O2SalhRL7Mmkpw9Z9v0ZeKqonerRUXmaLDTp1pkxs6DtE9+lAXnQXTuhotnUR8SLtAZewxAhZoeZTj6DaoJhAcezDcPP6ABsyxKhKclgWbwL2Ay4gFyA3QKo82lbYHM263qx7oHJuhVvhQuEsqyKbAKlZZSQN3X+LR+OIHR58wGaVTRYGZbaLzAqGruAVUDeDVGlotJQArl39PALXE0SdhuI5T0dkLgu4Zi/3g+M5tBbWqZ3SkRYYJDEaJX35iYWsR0XjvAF6uy+1P4sZsor/vRGTEqCzXUfuud6BbyMdFnu4AeMtxdIkhMirWTEQsihyDTpEbLbJVpnfMkOjyQ2QrLncaF/FzV7qwhdmmg54g6kJExkRKccJESVWx3EdLeB/BLsl1GuBbzFPwCiuzUkkjs/ghKYC+/SkDj2N82DzZ3eRyneUpiG0Bx89/IyIr8E1mTCy3QR+w5WhOEzwKBROJkGYiHdIl1xlf8ix2WLQH+08JgUfvDN6BHbsXYhd27KreLuyfE8J+lRD2PyeE/b8Swv5zGthGlhwvaQqR0kCPb56JrKg4KN/LfYJ3sgZeXifQS4qKs3VRptG+rZaJ+Tp2EpKHzFIoJZp+IfF9IyLTLiExwQlqRdJYkxZwGmtS73VVJphFSkRTVp3EVDXSWNOD3iQQIUYaa5ilgg1mTRLglWA3AgupKUnAhNtXliqJHoXtK1maDcV5AreaLMqM8AQ+bAs4QZAE4Krl3sR3i1rIOgnkssoSxDSIYoYRzBMUEOkMr6kg+4hZV13YAvP9HzRfpsB7m0Eb0CSQXTuYNFi7xNok0JfrcvsqjQ9aZ0tm/pyk0RjRWdxZcQPASkYX1TrJNQeolKj4VW7a+fijzdrqAKZm4/z88Z0jDjiofUmAu27y8TrIdWCvGKcpbBidrVIcIlvFLM7uA06hG+iMlZCkmCURdazc/pRrU46a+UeCrRVJApuzFU1hxmhwNBc0Z9EKRvuwmUjDJYXMK041kSmo7YGzdQLZJEu9wybqzP8O9FAGeRTAiq6ZNgrH94S0sBNofIqWqUitktFaQydylUi+usx8x+IJoBtFcZFAkXSlQKnQTqdc7zaS6cxNmI0PfY8VTsLg+UQhbAzIWzffPjZcpg0W0ecc59osKxVrWGANlbpZQSmgVtFxja9H1zXJscHC5IZV/GHXx3YaOARzjfM89h1geeywat06KMFbxIqMKCmLJF2JLOAEZhorsjTJkb7jUQoyl9fR2zOVOn7LUlbqUrHIQDk2zFTRs884EzRei50Wqo46UaeBC8W38d1aXLqup9mKy+jPeQM8Qcq/tXmjSx0LNIHEsTZ0AlSj5yZwuU7CumKd5AKXUsUWYMWyWqe4ZgXTJIVYKHQShk0xB0JQA82VosONLsNdA+jYGX8Oaux0PLHbxbZAklSUSTcAOrolKuNrRlKxdRaYx/VguDtBVfw3q8zcUN7oYKNOpm7BuhGvSZgsQeGmn4kTWxh4sLGlQZk5R1J0dLHW9sOMbGLV+Y9A05uSRQ8ElFQVa4WFGfXcjQF5lwRw/KfXdSL79GkwBTQCYCXXGdZlxIEBXdAKx4aqKOYp9DtFCdDBdR1NBDw+kS3kuC1cO5ClyhNgHN+RqRP4hrXzDSfIB9A0diKAG3icwDjR9Et8Bgg1aI0GNYEppdk6geDVZWwvm1YkxT1QJI+uSGtFQl1xIwA28UZsdWFWOnpXzS0RsQslgtNiHwrUNemMvX2zNvHZygGNH9FrZnrGhrsvo3drrfJlkjz0SvEEb2GlqcpyFrvqPcnYijoylIIMhmiDi9je4G3GhDZ4lUAz2DJlUqjh21IkaN1kpKpETDdrqC1aoKPoaWUk+lAJNFq6yR5JOCzvM+YsR2eK5sygM6xy381QQ/v3MDpuclZCKk1NCAUwMEQfQX8DIjkKleo0+RBMpKPc66Lkck9HgwVvpd9KVtGaet+RxywNnc8I5p0puqY3qMDDRgttLFasq+EwkORIcqZhOEO9uj96aKCEdFWWUhk0bjyK0G6DDWIGlYqupljhAWm59xlCESK8tzoaFBATvrP7RF9ozkTqifwdVO1qXTw1MnJNzYaqRft9vZHV6EVDSNAtVc04IiNRiZWm6B01GCaCu7uKGxI8eyvX+sWlK3t9js79iK8TZDaBKUXQDPgD9aOPAW2B3lPzOzOC6vA5j5k6CfFWMLK7uUWwuNuspliRzYIJFsQPZu7O0F97ID5hFgYkQ7zguBIw63ddwRzXuol7uIH7oF/7gT2lb8fd7Klpwu3nF08Y+/Ygsog1TXfrvArLoo/0xsCtmHIXzDGNekIgtYPr3sOEasEnJl5C99yE48Chf66mBin6paLaHGjafXy28v175TuVAcbyuFWdxB56pJq807475RBODiOIjfX+Dh3a9S/Bncec/X/7fEO72MV5LRRg7TBvgNUQL4n3nixsH5cl1hS5dO0GGzS6Vc0p+V88Dr6iGQXfYC6Va18fJCNCWCNNKYw7w4fnVSksNCYzjPcddZh2SwtQe1umIZWCCWiHkC6pKphTN+ZCul3SDeZgW8bpmiJOt5QjrDVbC3dw7bz+MOtDS+ZHlN+w/gFOXz7KpGeLWSXYl4oOxyTi8OXr4Htcx8TjpqDUGg3L3YUkUggKuRVox8xmSlAgFKgMaTR2RY8qL7q3aWHJCfKkeaK4XDOCObIYTJg+gMXjYgdLTYxpfDzalZu9DqPXSWfbyUFWa+wHHnOGdbaRyW0CZ8Q15hrMUmmHGlmp2B3BE+4HgNylsdjCm+YHsRBOsVqcci2tId67b+cQLEe/+l8s0KnYN/83gm7AltfCIJwviCzKylAVFsNJ3Ph2Y+nMs2+GZwEzFnsHwszfqpd/+uHP1vY97xxHTbFvgmh7Ps3iRszu6rjBe6rQPzc+Of3CowHIhW997Pqf9DwvWpx7XH/wPI5MXr5Ntn07HJhi11mg9799fG33ThV1zhPwl+ZME0VLLMjeapVePePDXBAEFDpBH9/9gi6E+fHlCbp4f/76v35Bny6EefUTerbb7JGgzGyoQmQjtR+VJpWixMC3fnj1v//H82+DFKFmk1DGDekBMnVR4PA4Hp2Y++55za8cL17USIWveP60kO7KplswP7Jh3J0f+BC+A8W0tU4+M2UqzNHb0/dBZP+QgqbzZR3HGf9XCroI09ai+9WIUNjI7cITjuApvsEHzmGNDd3hRxiRDtx9iU7zXIGf1nF5CJ3m6SVFeWyc86GxkIuzd5fuVZoMjxVYzxj96DmVnKbq3250cWlRmfB+WRoeOQkiCg3t2tM0rDWxzE3XmldAdNDFec7slzFvA7adWf7hd25GBrAmIVxw6W/4eZ8FRqi0udZJ9Lq7PmkYvfcYXkplGpE8Ero5BNjgAJjZ3y559cy0d/thYl0/JvW23k0RXtCQ3TiXF9djB5Yv1loSZlVO5zca6TjIymWFxZouGtOJSLFi60rRHC33AJOKHLKGwnKmPLL1wKhodEJbDi66StDvgEfU/bslXNEdAIoW0tDMZ3bHzzOKT9pc6AxnLhU/AejSqDTAVwlYYpWgWpinuA6p+p+UCYiK86z2xKVTy4cWvN3HYrha15nwCBrsa7OhSlCDPu5LeoI+1c/YW3CA/YguawfY6CX4bUpTq0f1zKBMTJjGNdLeL36CMOdBZaJsvwgJblhBYt6WKvsGMmEk0gYecybQp4tJgUIgQTaZvIousi1QWSYY+2YBK6pjZ/RasAlKXNyLGDsVHfztCbB1oxUyTsU6+qRIwNkqHwm10AkN1Kk8mHcCMAIRSCdYIYzeSLXDKh/P6UbodA3JXgphe+NvIJduSc2OUhFWPSN3TbxvjFsazLuhOocMgpbxkBkx2iETPs8V0hIKZqxY8iM2wlvccizmiOPfwUFZJ4h0XJSjDfZdlm0kZWst2DUYsP2XJ3akkhLoQrCN1w/ubhF7rAwjFccKQb9oVCPx7PXNL2/lWq5W4envlGRmQ5Mfbw/Zj3ZBdxs7eL+2eFt0TyuzocL4ZPFJtHUVs3PC3RJ63JLTqH/SVE0iLCtD5LyU9ktOI3xVEUK1nsAZOo8f1xztuMQTwAtZFXct1R4FChNGuM0hnHo40gGOVipBgE+XUth3xcqtkHLY/BCNFKX+rrbx+tFNvJsYua6lUDPAGc2b/Xg/zEAfZgJpZqqA/ERQXEC9iPZQN1gjnMvSvi5mQ5lCcifaI3OEM/hGCllM5NXCTA7NXIv6eZUIq9wzkVv5I5VuCIDRG8YpOvWILUZkuIuzVzQbc3dyMmG82f+jpCtMkuDKZy3EpUJojwFCxKx3fwAhXL7ela/XiE2J6YTQpUxZPRDY/JJu8JbJCrRLIotSyYJNZCjSuZF7LfCSQxHZCp0dxo2JbSN2EiI5xLCndaIgAj0Mow6XOQLBwPoNfqlPt/PKtvdtku3aMstKmGE5W2yNPocy8IwcY9bfSQuC93hNBVWM1FsCgkCi3zC1gJkNPLWh2W7II7sgPyy0UdPBz3pPx7TderQ9vTy8J69euLUS7itomjZGuGEF1VauO21P0ZJOBpH8KURrCnHrQUDjwQceg7ojax3Tu/vRWOvHu+3ph0xHG3J65615h/FtOxztDXbcCoQ7CIOvd3cvb92dmvXs3EWLsjd1+8lF66U6jwC5RY43AuTrZccfbz+yWKMN5jmyu8lHNasEiXnH7iA/ZmXHmHsbMWOj1EMJ2sBPHb1ypzKbrKBmIx8hSoJ7nmTk0PBfmzxw6KWkZFKv04GozgfJvb/WInKALxN5Qv5r8fOf/oSevT0/vXyOzpk2TKwrpjc0h1L4IC5crmXyvkCHImGQLbtyePhjhi9OZIwpmdireKj+055qCIPmxoBHPtrQ5/tcFwJp/03db8fxBziFYqZYhNqkt5limMfqTjfYyAecs0q7FZBUSLOCcayceLJi094hAu96uLwK7rlm+ZydRrqZ8p8sI9RexEFfzPaSp6uzOBWH7jqENXylYcf/651E8MmIF7zjhnbKMvKwK1OqlIkBo5ANkFqqNRbsjwNZ1SIdK9yV2EdQustTE+ReMRWsJU3U9eeNXQ5eC9fiy/Uu6mU1/0oxNxuCFUWlorksmMDBgruOeLrEhlFh9K3p8RzPudu3+FE361o/0jIR49qr860VXCVWBpohtVs9LFZnbHbkhc1dJOqK5lRhQ/MsWlLZAf6wwudNvWITPLtUcsvypnmY/x4uS+411RFj+OY/9lnr67RhBafdJMtn2mWzpO/1Z/YT2wwOD4XMyS1z0fPNUHGfaAHXKJ0xh4LfV/OkN6AzdX7UqYReBzbqdFTQWLFG2kjlJL6FVlCDYbVv4VsL+61vw7svWJ5zOp+Uewfr3VXOBY63I/eOknP1eIx5tnvpV+t0GBL7Ojp7gkqO7ZHZ91kqRAVR+3LKyw+pkDPYk3fIoFONbfmr1Aa9w2TDxIRJl+NEkuObIa0/Ccj0LxW14sPqR67JmV6gtzku0Wf4H6cf5VK4utO/jR9PtMFbajUnTrFCXyqq9gh6EOpSCk1rjSpcnGr3m8Fv5pGXvgcesZAVq7tACrd915dvGs96SzOg2jLQB98c9a6YwpSntA6zIY/XraV7TYysbegfXqaRqoQI2rH6pHl5XOTZtZGaqLHzEDNvYaY/CIx2TORyp5EuKWErRuwnJ6E6QZ8nO74gdnsO3zbnBj2DjrBUkPYZgtDl8w61UCXgHX9L15js0Sfdb3zbRGCLYSFt9Oxau8IMBvvEa981tQAVqFUDJrMv4ojiTR+AQPV/r9IUynnG5OtvO71CPdWd16nXgR3DDoOM5n9zxGbnyeud2qrP8PWu91rWvYatT3cBHe9mHoddEzDon02bkOmOYXRC4YYUtxc/Q9lAzJGAkxVusOWcrpjwvnoQTtDVr8DlRNNBwO6oQrFEuLUOmIH6F1swNj7b1Hv3vZQmelM2PmxjMNkUM7fAb1cFgqORddQ9jiRDXpZMxJsgFvVu2C1DUWHaxzMgpLplO3Asro12W94fmNo5wjrt23cL1iVWNU/ZP5+0W9lt2KiVOrK3w9qyLvn9Ttsz0WeWuLYWUu3THfhfdInFv93aMaZGpN9FvVbPQ0+TJctfXgD0W/b2aCrRaFd1v/XDu5rkgowKo2R5jOjIZbUcORfuxON+TWtt01vKEQBHV90x7z08k0WJxb65j3DtYJy+s1e2VNlnKGNiJcNKAdbXqWuEbpEfAyuyxmxH03ZFX31JlSPwpuJ8j/6zwpytGM3ROdQ9O+dgEJUdXWZEymv2SEH33+kSufVb+xnzKW0+erfZNhxeVgZU7iNHmN5+1z80S/gpO94d7XzyC/RxX7qtt54DSxx3gtOHp+gqi9pMdoC2xcE5ItS3OtS2dojMHK66RrnsY+c8i6VUtbcfQswf3k4ceadXTmR2qmlRpp1DdIAUduVbPfc1mkrKRJpIHym7jj0PVGITdk0SkWEdM9rfAax8OX1kyJXiEY+5AzXiqTTGaFapWN6QDkxNVYbX8WzKFnT056kPOmr6Yx+05/oEgoXeGCpAtYpvnFj40bi5UfQ2ig5SZWJrVG6JOWoJezL3IywL6tUL/99nHoUX/j98XlPI7Y85VeHsPL+dR4yeu810g+fgce2MWhttJ/cD0axJxcSKKjURdx3ve5Z9dRX/W0kfdM/OgGTdl3jVOYbAlYKwtkx6pQJLzMZ+r13c3rLdR8ggVt0//ZWOE7SmB36yckPVPP4Iq7P7jKdnZzD68Tk6g/XDqFFlZmqWMkHnM6r88E/ay8I80JyXJg0ddwjZOXC76Le60yn64EmzP471St6/NUr4tNEV+yPsrWHXiWTKxV9fI0HX0jB3gOUG64kJUJrM3Vaoc5Ru8enhgvaok02AGiW4DHisbpxe19+EE1I0W89RUdHvb9RMPfw4OWjZShOmdRVd6QTIkCyVzlv3sBgKYEiVSuoDHR1KV3q+toujKwhOH5JOs2RINJ3BfRT52RWkdh5+jDrS8zgk7y89D+A4LUK15tk25Ys+DKl6R3YQmTyzrIer6G0adSrA7Jp6izpRc4Nv2nEl3QcJZOtPSEO8Tip0cXX613eX6NK+U+g3MTF9pcU2USX1Mdh+3MkwtiCGyIaSa32UE/luQjhtD7LQ0LmmX2fTIgzSQP0IwlYKHtByqWKjppCPoOQ6PJquIJNGA+BssKlmm/DZxXKLOcsdIwaQGArC2bpaHxKEQLFrutdDsR2J8+sE0siwN8aUOmMwgzYJaDjKFAQh+AncJrYWdeWLVMzsb7lRRBZF0j5xd8Tb4eEdQuES/B1TlA8tzdgulh3HItP6sQbe2pWdDP/d77au0Qpi60qNs1KyOdKqQwg7DBBgAEiFrQEgK9lgIUaNM1K3m/KrAiITMduZ2jY3D4ufefj729P3/t17MVi+eVCMVEPff/SebUxfZ1vJq1QEOK3nOAs/56aZjF2P860EMxo9c0jo59CtAwp764m6A/AIkA7uhleJpNlbj+snwYxPF1j0iw62VEGmwKriiEhBaGmsoXzlznCivcJul1L6OsJbg70eoW0RLaUySFr6/vrvp6EU3CDZY/OdVOv5EyyHBQY9F+sSu2YnwUYx//H6t8uLS/QO3xRM5M1Y7/Cx2r3NnobZG6I4sS2/jdHuDm2rUZ/CJYvR07NdlWO2mq9g87GL8OstJ1c7es4yL5Uvzn2XXo/FQQz5fIfyyL0C6h0X/+3rhpvCHJGPNcnYtxv8JdaEfqTsRj+uGqz4JqhbuOLeE6SrQIo61ugv2igp1v+25Jhcc6YNzf/ywv/tpPmUiRUl4Y9WTNEd5kFFBi955zcIixxpiSbYUtE100btrWU/p7Aosdn4Zv0NDmiIwwhJcErNhaYrhHb1WkSqThfyRp9sMKfCdHJSWo+7JnJRFUtFOe9a82FO7+HTT79/A1cAbuyZBYo+eaDdh3V8Twbt5tjAYpkmzgFUEDoVCCuFm/z7nK2gjNV01kGKcoj1+DOGutaQFuAdjpFQ+wjZK6RyrgrlquvakRGsrmUf6m0FNmRDdVB5lZyRfVZHDMeBwQegCs2BmmCk60zhUGlaDDJddyBZoNMtZhziZG32PfoRbjheym1Qy+rhHY3Gxnd9a1G3VC1w7psd1Bi/kQrRG1yUnJ6gDxIXTKyhrqAy0BaqnqgawnzJJbmmeRafQ4bcoKC8vi3C7nLGklqUPS4TR/DT4SPwTBiVc+oD2EF2PcA/sX/0CeaG3pgXG1PwED56gzO9wS9/fhUDm1/pDcrZmmpTy4N+14fwtcfbLKfGTf+Ndq4NRO8aIESqzlQYhIVhW6YqjahYM9EOWIHKFiZ06X4eFAMVjiM8kX3vwSnHOSqlJRBzRQFih4Xlwk43IvTs8tPpc8+gugnXlEreMKvBWbyxlRCmUqJT1tdsVBMsRH98b3MERZnlTJdSs5HW+hDxC/GMbtWhbvAFXQQwAlTdU3aabzG0QHiH+c4q35dK1uf47PTd5XO7wxKrhr/qt88Nhblojg2tKGRQ/Asi2F5cdMYpFicWLiNMVvCWfxLXQu6CR2wJUjgcxv67IylysWqXPxmNUvOr9Tn19N3lFHaaSBVNhACwISaQA2oxcAoRqBRNbbrTdev6FXuYO8a5pfSSYxEU4jk2mNDRWIAHoN2lX8MJ59hgdAbrOJHuiwF9HWilqfoe6vWdTqLwasVICF83wXBoOT8AXW8VNw9lE4p2s7pNJQTli3/6/wIAAP//a6iF4Q==" } diff --git a/x-pack/filebeat/module/cisco/umbrella/_meta/fields.yml b/x-pack/filebeat/module/cisco/umbrella/_meta/fields.yml new file mode 100644 index 00000000000..e45d12ef732 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/_meta/fields.yml @@ -0,0 +1,61 @@ +- name: cisco.umbrella + type: group + description: > + Fields for Cisco Umbrella. + fields: + - name: identities + type: keyword + description: > + An array of the different identities related to the event. + - name: categories + type: keyword + description: > + The security or content categories that the destination matches. + - name: policy_identity_type + type: keyword + description: > + The first identity type matched with this request. Available in version 3 and above. + - name: identity_types + type: keyword + description: > + The type of identity that made the request. For example, Roaming Computer or Network. + - name: blocked_categories + type: keyword + description: > + The categories that resulted in the destination being blocked. Available in version 4 and above. + - name: content_type + type: keyword + description: > + The type of web content, typically text/html. + - name: sha_sha256 + type: keyword + description: > + Hex digest of the response content. + - name: av_detections + type: keyword + description: > + The detection name according to the antivirus engine used in file inspection. + - name: puas + type: keyword + description: > + A list of all potentially unwanted application (PUA) results for the proxied file as returned by the antivirus scanner. + - name: amp_disposition + type: keyword + description: > + The status of the files proxied and scanned by Cisco Advanced Malware Protection (AMP) as part of the Umbrella File Inspection feature; can be Clean, Malicious or Unknown. + - name: amp_malware_name + type: keyword + description: > + If Malicious, the name of the malware according to AMP. + - name: amp_score + type: keyword + description: > + The score of the malware from AMP. This field is not currently used and will be blank. + - name: datacenter + type: keyword + description: > + The name of the Umbrella Data Center that processed the user-generated traffic. + - name: origin_id + type: keyword + description: > + The unique identity of the network tunnel. diff --git a/x-pack/filebeat/module/cisco/umbrella/config/input.yml b/x-pack/filebeat/module/cisco/umbrella/config/input.yml new file mode 100644 index 00000000000..8b0ccde6e2e --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/config/input.yml @@ -0,0 +1,23 @@ +{{ if eq .input "s3" }} + +type: s3 +queue_url: {{ .queue_url }} +access_key_id: {{ .access_key_id }} +secret_access_key: {{ .secret_access_key }} + +{{ else if eq .input "file" }} + +type: log +paths: +{{ range $i, $path := .paths }} + - {{$path}} +{{ end }} +exclude_files: [".gz$"] + +{{ end }} + +processors: +- add_fields: + target: '' + fields: + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cisco/umbrella/ingest/pipeline.yml b/x-pack/filebeat/module/cisco/umbrella/ingest/pipeline.yml new file mode 100644 index 00000000000..2a602ff2331 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/ingest/pipeline.yml @@ -0,0 +1,246 @@ +description: Pipeline for parsing cisco umbrella logs +processors: +- set: + field: observer.vendor + value: Cisco +- set: + field: observer.product + value: Umbrella +- set: + field: event.ingested + value: "{{_ingest.timestamp}}" +- set: + field: event.original + value: "{{message}}" +############ +# DNS Logs # +############ +- csv: + field: message + target_fields: + - cisco.umbrella._tmp_time + - source.user.name + - cisco.umbrella.identities + - source.address + - destination.address + - cisco.umbrella.action + - dns.question.type + - dns.response_code + - destination.domain + - cisco.umbrella.categories + - cisco.umbrella.policy_identity_type + - cisco.umbrella.identity_types + - cisco.umbrella.blocked_categories + if: ctx?.log?.file?.path.contains('dnslogs') + +- set: + field: observer.type + value: dns + if: ctx?.log?.file?.path.contains('dnslogs') +########### +# IP Logs # +########### +- csv: + field: message + target_fields: + - cisco.umbrella._tmp_time + - source.user.name + - source.address + - source.port + - destination.address + - destination.port + - cisco.umbrella.categories + if: ctx?.log?.file?.path.contains('iplogs') + +- set: + field: observer.type + value: firewall + if: ctx?.log?.file?.path.contains('iplogs') + +############## +# Proxy Logs # +############## +- csv: + field: message + target_fields: + - cisco.umbrella._tmp_time + - cisco.umbrella.identities + - source.address + - source.nat.ip + - destination.address + - cisco.umbrella.content_type + - cisco.umbrella.verdict + - url.full + - http.request.referrer + - user_agent.original + - http.response.status_code + - http.request.bytes + - http.response.bytes + - http.response.body.bytes + - cisco.umbrella.sha_sha256 + - cisco.umbrella.categories + - cisco.umbrella.av_detections + - cisco.umbrella.puas + - cisco.umbrella.amp_disposition + - cisco.umbrella.amp_malware_name + - cisco.umbrella.amp_score + - cisco.umbrella.identity_types + - cisco.umbrella.blocked_categories + if: ctx?.log?.file?.path.contains('proxylogs') + +- set: + field: observer.type + value: proxy + if: ctx?.log?.file?.path.contains('proxylogs') + +####################### +# Cloud Firewall Logs # +####################### +- csv: + field: message + target_fields: + - cisco.umbrella._tmp_time + - cisco.umbrella.origin_id + - source.user.name + - cisco.umbrella.identity_types + - cisco.umbrella.direction + - network.transport + - source.bytes + - source.address + - source.port + - destination.address + - destination.port + - cisco.umbrella.datacenter + - cisco.umbrella.ruleid + - cisco.umbrella.verdict + if: ctx?.log?.file?.path.contains('cloudfirewalllogs') + +- set: + field: observer.type + value: firewall + if: ctx?.log?.file?.path.contains('cloudfirewalllogs') + +# Identifies is a field that includes any sort of username, device or other asset that is included in the request. +# Converting this to an array to make it easier to use in searches and visualizations +- split: + field: cisco.umbrella.identities + separator: "," + preserve_trailing: false + if: "ctx?.log?.file?.path.contains('dnslogs') && ctx?.cisco?.umbrella?.identities != null" + +###################### +# General ECS Fields # +###################### +# This field is always in UTC, so no timezone should need to be set +- date: + field: cisco.umbrella._tmp_time + target_field: "@timestamp" + formats: + - "yyyy-MM-dd HH:mm:ss" + +################## +# DNS ECS Fields # +################## +- set: + field: dns.type + value: query + if: ctx?.cisco?.umbrella?.action != null + +###################### +# Network ECS Fields # +###################### +- lowercase: + field: cisco.umbrella.direction + target_field: network.direction + if: ctx?.cisco?.umbrella?.direction != null + +################### +# Rule ECS Fields # +################### +- rename: + field: cisco.umbrella.ruleid + target_field: rule.id + if: ctx?.cisco?.umbrella?.ruleid != null + +#################### +# Event ECS Fields # +#################### +- set: + field: event.action + value: "dns-request-{{cisco.umbrella.action}}" + if: ctx?.cisco?.umbrella?.action != null +- set: + field: event.category + value: network + if: ctx?.cisco?.umbrella?.action != null +- append: + field: event.type + value: allowed + if: "ctx?.cisco?.umbrella?.action == 'Allowed' || ctx?.cisco?.umbrella?.verdict == 'ALLOWED' || ctx?.cisco?.umbrella?.verdict == 'ALLOW'" +- append: + field: event.type + value: denied + if: "ctx?.cisco?.umbrella?.action == 'Blocked' || ctx?.cisco?.umbrella?.verdict == 'BLOCKED' || ctx?.cisco?.umbrella?.verdict == 'BLOCK'" +- append: + field: event.type + value: connection + if: ctx?.cisco?.umbrella?.action != null + +# Converting address fields to either ip or domain +- grok: + field: source.address + patterns: + - "(?:%{IP:source.ip}|%{GREEDYDATA:source.domain})" + ignore_failure: true +- grok: + field: destination.address + patterns: + - "(?:%{IP:destination.ip}|%{GREEDYDATA:destination.domain})" + ignore_failure: true + +###################### +# Related ECS Fields # +###################### +- append: + field: related.user + value: "{{source.user.name}}" + if: ctx?.source?.user?.name != null +- append: + field: related.ip + value: "{{source.ip}}" + if: ctx?.source?.ip != null +- append: + field: related.ip + value: "{{source.nat.ip}}" + if: ctx?.source?.nat?.ip != null +- append: + field: related.ip + value: "{{destination.ip}}" + if: ctx?.destination?.ip != null +- append: + field: related.hosts + value: "{{source.domain}}" + if: ctx?.source?.domain != null +- append: + field: related.hosts + value: "{{destination.domain}}" + if: ctx?.destination?.domain != null +- append: + field: related.hash + value: "{{cisco.umbrella.sha_sha256}}" + if: ctx?.cisco?.umbrella?.sha_sha256 != null + +########### +# Cleanup # +########### +- remove: + field: + - cisco.umbrella._tmp_time + - cisco.umbrella.direction + - cisco.umbrella.action + - cisco.umbrella.verdict + ignore_missing: true +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/cisco/umbrella/manifest.yml b/x-pack/filebeat/module/cisco/umbrella/manifest.yml new file mode 100644 index 00000000000..3a7150e714d --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/manifest.yml @@ -0,0 +1,8 @@ +module_version: "1.0" + +var: + - name: tags + default: [cisco-umbrella, forwarded] + +ingest_pipeline: ingest/pipeline.yml +input: config/input.yml diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log new file mode 100644 index 00000000000..3e5f23fced2 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log @@ -0,0 +1,2 @@ +2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,OUTBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,ALLOW +2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,INBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,BLOCK diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log-expected.json b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log-expected.json new file mode 100644 index 00000000000..65aabab5a88 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-cloudfirewalllogs.log-expected.json @@ -0,0 +1,74 @@ +[ + { + "@timestamp": "2020-07-23T18:03:46.000Z", + "cisco.umbrella.datacenter": "ams1.edc", + "cisco.umbrella.identity_types": "CDFW Tunnel Device", + "cisco.umbrella.origin_id": "[211039844]", + "destination.address": "146.112.255.129", + "destination.ip": "146.112.255.129", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,OUTBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,ALLOW", + "event.type": [ + "allowed" + ], + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 0, + "message": "2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,OUTBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,ALLOW", + "network.direction": "outbound", + "network.transport": "1", + "observer.product": "Umbrella", + "observer.type": "firewall", + "observer.vendor": "Cisco", + "related.ip": [ + "172.17.3.4", + "146.112.255.129" + ], + "related.user": [ + "Passive Monitor" + ], + "rule.id": "12", + "service.type": "cisco", + "source.address": "172.17.3.4", + "source.bytes": "84", + "source.ip": "172.17.3.4", + "source.user.name": "Passive Monitor" + }, + { + "@timestamp": "2020-07-23T18:03:46.000Z", + "cisco.umbrella.datacenter": "ams1.edc", + "cisco.umbrella.identity_types": "CDFW Tunnel Device", + "cisco.umbrella.origin_id": "[211039844]", + "destination.address": "146.112.255.129", + "destination.ip": "146.112.255.129", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,INBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,BLOCK", + "event.type": [ + "denied" + ], + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 128, + "message": "2020-07-23 18:03:46,[211039844],Passive Monitor,CDFW Tunnel Device,INBOUND,1,84,172.17.3.4,,146.112.255.129,,ams1.edc,12,BLOCK", + "network.direction": "inbound", + "network.transport": "1", + "observer.product": "Umbrella", + "observer.type": "firewall", + "observer.vendor": "Cisco", + "related.ip": [ + "172.17.3.4", + "146.112.255.129" + ], + "related.user": [ + "Passive Monitor" + ], + "rule.id": "12", + "service.type": "cisco", + "source.address": "172.17.3.4", + "source.bytes": "84", + "source.ip": "172.17.3.4", + "source.user.name": "Passive Monitor" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log new file mode 100644 index 00000000000..403c1c9df33 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log @@ -0,0 +1,2 @@ +"2020-07-23 23:49:54","elasticuser","elasticuser2","some other identity","192.168.1.1","8.8.8.8","Allowed","1 (A)","NOERROR","elastic.co.","Software/Technology,Business Services,Application","Test Policy Name","SomeIdentityType","" +"2020-07-23 23:50:25","elasticuser","elasticuser2","some other identity","192.168.1.1","4.4.4.4","Blocked","1 (A)","NOERROR","elastic.co/something.","Chat,Instant Messaging,Block List,Application","Test Policy Name","SomeIdentityType","BlockedCategories" diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log-expected.json b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log-expected.json new file mode 100644 index 00000000000..81b1478da27 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-dnslogs.log-expected.json @@ -0,0 +1,92 @@ +[ + { + "@timestamp": "2020-07-23T23:49:54.000Z", + "cisco.umbrella.blocked_categories": "SomeIdentityType", + "cisco.umbrella.categories": "elastic.co.", + "cisco.umbrella.identities": [ + "elasticuser2" + ], + "cisco.umbrella.identity_types": "Test Policy Name", + "cisco.umbrella.policy_identity_type": "Software/Technology,Business Services,Application", + "destination.address": "192.168.1.1", + "destination.domain": "NOERROR", + "destination.ip": "192.168.1.1", + "dns.question.type": "Allowed", + "dns.response_code": "1 (A)", + "dns.type": "query", + "event.action": "dns-request-8.8.8.8", + "event.category": "network", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-07-23 23:49:54\\\",\\\"elasticuser\\\",\\\"elasticuser2\\\",\\\"some other identity\\\",\\\"192.168.1.1\\\",\\\"8.8.8.8\\\",\\\"Allowed\\\",\\\"1 (A)\\\",\\\"NOERROR\\\",\\\"elastic.co.\\\",\\\"Software/Technology,Business Services,Application\\\",\\\"Test Policy Name\\\",\\\"SomeIdentityType\\\",\\\"\\\"", + "event.type": [ + "connection" + ], + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 0, + "message": "\"2020-07-23 23:49:54\",\"elasticuser\",\"elasticuser2\",\"some other identity\",\"192.168.1.1\",\"8.8.8.8\",\"Allowed\",\"1 (A)\",\"NOERROR\",\"elastic.co.\",\"Software/Technology,Business Services,Application\",\"Test Policy Name\",\"SomeIdentityType\",\"\"", + "observer.product": "Umbrella", + "observer.type": "dns", + "observer.vendor": "Cisco", + "related.hosts": [ + "some other identity", + "NOERROR" + ], + "related.ip": [ + "192.168.1.1" + ], + "related.user": [ + "elasticuser" + ], + "service.type": "cisco", + "source.address": "some other identity", + "source.domain": "some other identity", + "source.user.name": "elasticuser" + }, + { + "@timestamp": "2020-07-23T23:50:25.000Z", + "cisco.umbrella.blocked_categories": "SomeIdentityType", + "cisco.umbrella.categories": "elastic.co/something.", + "cisco.umbrella.identities": [ + "elasticuser2" + ], + "cisco.umbrella.identity_types": "Test Policy Name", + "cisco.umbrella.policy_identity_type": "Chat,Instant Messaging,Block List,Application", + "destination.address": "192.168.1.1", + "destination.domain": "NOERROR", + "destination.ip": "192.168.1.1", + "dns.question.type": "Blocked", + "dns.response_code": "1 (A)", + "dns.type": "query", + "event.action": "dns-request-4.4.4.4", + "event.category": "network", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-07-23 23:50:25\\\",\\\"elasticuser\\\",\\\"elasticuser2\\\",\\\"some other identity\\\",\\\"192.168.1.1\\\",\\\"4.4.4.4\\\",\\\"Blocked\\\",\\\"1 (A)\\\",\\\"NOERROR\\\",\\\"elastic.co/something.\\\",\\\"Chat,Instant Messaging,Block List,Application\\\",\\\"Test Policy Name\\\",\\\"SomeIdentityType\\\",\\\"BlockedCategories\\\"", + "event.type": [ + "connection" + ], + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 232, + "message": "\"2020-07-23 23:50:25\",\"elasticuser\",\"elasticuser2\",\"some other identity\",\"192.168.1.1\",\"4.4.4.4\",\"Blocked\",\"1 (A)\",\"NOERROR\",\"elastic.co/something.\",\"Chat,Instant Messaging,Block List,Application\",\"Test Policy Name\",\"SomeIdentityType\",\"BlockedCategories\"", + "observer.product": "Umbrella", + "observer.type": "dns", + "observer.vendor": "Cisco", + "related.hosts": [ + "some other identity", + "NOERROR" + ], + "related.ip": [ + "192.168.1.1" + ], + "related.user": [ + "elasticuser" + ], + "service.type": "cisco", + "source.address": "some other identity", + "source.domain": "some other identity", + "source.user.name": "elasticuser" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log new file mode 100644 index 00000000000..6200aeab3ae --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log @@ -0,0 +1,2 @@ +"2020-08-26 20:32:46","elasticuser","192.168.1.1","0","8.8.8.8","0","Test Category" +"2020-08-26 20:32:45","elasticuser","192.168.1.1","61095","8.8.8.8","445","Test Category" diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log-expected.json b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log-expected.json new file mode 100644 index 00000000000..4d25464cb61 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-iplogs.log-expected.json @@ -0,0 +1,60 @@ +[ + { + "@timestamp": "2020-08-26T20:32:46.000Z", + "cisco.umbrella.categories": "Test Category", + "destination.address": "8.8.8.8", + "destination.ip": "8.8.8.8", + "destination.port": "0", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-08-26 20:32:46\\\",\\\"elasticuser\\\",\\\"192.168.1.1\\\",\\\"0\\\",\\\"8.8.8.8\\\",\\\"0\\\",\\\"Test Category\\\"", + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 0, + "message": "\"2020-08-26 20:32:46\",\"elasticuser\",\"192.168.1.1\",\"0\",\"8.8.8.8\",\"0\",\"Test Category\"", + "observer.product": "Umbrella", + "observer.type": "firewall", + "observer.vendor": "Cisco", + "related.ip": [ + "192.168.1.1", + "8.8.8.8" + ], + "related.user": [ + "elasticuser" + ], + "service.type": "cisco", + "source.address": "192.168.1.1", + "source.ip": "192.168.1.1", + "source.port": "0", + "source.user.name": "elasticuser" + }, + { + "@timestamp": "2020-08-26T20:32:45.000Z", + "cisco.umbrella.categories": "Test Category", + "destination.address": "8.8.8.8", + "destination.ip": "8.8.8.8", + "destination.port": "445", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-08-26 20:32:45\\\",\\\"elasticuser\\\",\\\"192.168.1.1\\\",\\\"61095\\\",\\\"8.8.8.8\\\",\\\"445\\\",\\\"Test Category\\\"", + "fileset.name": "umbrella", + "input.type": "log", + "log.offset": 84, + "message": "\"2020-08-26 20:32:45\",\"elasticuser\",\"192.168.1.1\",\"61095\",\"8.8.8.8\",\"445\",\"Test Category\"", + "observer.product": "Umbrella", + "observer.type": "firewall", + "observer.vendor": "Cisco", + "related.ip": [ + "192.168.1.1", + "8.8.8.8" + ], + "related.user": [ + "elasticuser" + ], + "service.type": "cisco", + "source.address": "192.168.1.1", + "source.ip": "192.168.1.1", + "source.port": "61095", + "source.user.name": "elasticuser" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log new file mode 100644 index 00000000000..bfe70c6839a --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log @@ -0,0 +1,3 @@ +"2020-07-23 23:48:56","elasticuser, someotheruser","192.168.1.1","1.1.1.1","8.8.8.8","","ALLOWED","https://elastic.co/blog/ext_id=Anyclip","https://google.com/elastic","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36","200","850","","","","Business Services","AVDetectionName","Malicious","MalwareName","","","Roaming Computers","" +"2020-07-23 23:48:56","elasticuser, someotheruser","192.168.1.1","1.1.1.1","8.8.8.8","","BLOCKED","https://elastic.co/blog/ext_id=Anyclip","https://google.com/elastic","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36","200","850","","","","Business Services","AVDetectionName","Malicious","MalwareName","","","Roaming Computers","" +"2017-10-02 23:52:53","elasticuser","ActiveDirectoryUserName,ADSite,Network","192.192.192.135","1.1.1.91","","ALLOWED","http://google.com/the.js","www.google.com","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36","200","562","1489","","","","","","","","Networks" diff --git a/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log-expected.json b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log-expected.json new file mode 100644 index 00000000000..fd474d2d029 --- /dev/null +++ b/x-pack/filebeat/module/cisco/umbrella/test/umbrella-proxylogs.log-expected.json @@ -0,0 +1,115 @@ +[ + { + "@timestamp": "2020-07-23T23:48:56.000Z", + "cisco.umbrella.amp_disposition": "MalwareName", + "cisco.umbrella.av_detections": "AVDetectionName", + "cisco.umbrella.categories": "Business Services", + "cisco.umbrella.identities": "elasticuser, someotheruser", + "cisco.umbrella.identity_types": "Roaming Computers", + "cisco.umbrella.puas": "Malicious", + "destination.address": "8.8.8.8", + "destination.ip": "8.8.8.8", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-07-23 23:48:56\\\",\\\"elasticuser, someotheruser\\\",\\\"192.168.1.1\\\",\\\"1.1.1.1\\\",\\\"8.8.8.8\\\",\\\"\\\",\\\"ALLOWED\\\",\\\"https://elastic.co/blog/ext_id=Anyclip\\\",\\\"https://google.com/elastic\\\",\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\\",\\\"200\\\",\\\"850\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"Business Services\\\",\\\"AVDetectionName\\\",\\\"Malicious\\\",\\\"MalwareName\\\",\\\"\\\",\\\"\\\",\\\"Roaming Computers\\\",\\\"\\\"", + "event.type": [ + "allowed" + ], + "fileset.name": "umbrella", + "http.request.bytes": "850", + "http.request.referrer": "https://google.com/elastic", + "http.response.status_code": "200", + "input.type": "log", + "log.offset": 0, + "message": "\"2020-07-23 23:48:56\",\"elasticuser, someotheruser\",\"192.168.1.1\",\"1.1.1.1\",\"8.8.8.8\",\"\",\"ALLOWED\",\"https://elastic.co/blog/ext_id=Anyclip\",\"https://google.com/elastic\",\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\",\"200\",\"850\",\"\",\"\",\"\",\"Business Services\",\"AVDetectionName\",\"Malicious\",\"MalwareName\",\"\",\"\",\"Roaming Computers\",\"\"", + "observer.product": "Umbrella", + "observer.type": "proxy", + "observer.vendor": "Cisco", + "related.ip": [ + "192.168.1.1", + "1.1.1.1", + "8.8.8.8" + ], + "service.type": "cisco", + "source.address": "192.168.1.1", + "source.ip": "192.168.1.1", + "source.nat.ip": "1.1.1.1", + "url.full": "https://elastic.co/blog/ext_id=Anyclip", + "user_agent.original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" + }, + { + "@timestamp": "2020-07-23T23:48:56.000Z", + "cisco.umbrella.amp_disposition": "MalwareName", + "cisco.umbrella.av_detections": "AVDetectionName", + "cisco.umbrella.categories": "Business Services", + "cisco.umbrella.identities": "elasticuser, someotheruser", + "cisco.umbrella.identity_types": "Roaming Computers", + "cisco.umbrella.puas": "Malicious", + "destination.address": "8.8.8.8", + "destination.ip": "8.8.8.8", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2020-07-23 23:48:56\\\",\\\"elasticuser, someotheruser\\\",\\\"192.168.1.1\\\",\\\"1.1.1.1\\\",\\\"8.8.8.8\\\",\\\"\\\",\\\"BLOCKED\\\",\\\"https://elastic.co/blog/ext_id=Anyclip\\\",\\\"https://google.com/elastic\\\",\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\\\",\\\"200\\\",\\\"850\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"Business Services\\\",\\\"AVDetectionName\\\",\\\"Malicious\\\",\\\"MalwareName\\\",\\\"\\\",\\\"\\\",\\\"Roaming Computers\\\",\\\"\\\"", + "event.type": [ + "denied" + ], + "fileset.name": "umbrella", + "http.request.bytes": "850", + "http.request.referrer": "https://google.com/elastic", + "http.response.status_code": "200", + "input.type": "log", + "log.offset": 399, + "message": "\"2020-07-23 23:48:56\",\"elasticuser, someotheruser\",\"192.168.1.1\",\"1.1.1.1\",\"8.8.8.8\",\"\",\"BLOCKED\",\"https://elastic.co/blog/ext_id=Anyclip\",\"https://google.com/elastic\",\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36\",\"200\",\"850\",\"\",\"\",\"\",\"Business Services\",\"AVDetectionName\",\"Malicious\",\"MalwareName\",\"\",\"\",\"Roaming Computers\",\"\"", + "observer.product": "Umbrella", + "observer.type": "proxy", + "observer.vendor": "Cisco", + "related.ip": [ + "192.168.1.1", + "1.1.1.1", + "8.8.8.8" + ], + "service.type": "cisco", + "source.address": "192.168.1.1", + "source.ip": "192.168.1.1", + "source.nat.ip": "1.1.1.1", + "url.full": "https://elastic.co/blog/ext_id=Anyclip", + "user_agent.original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36" + }, + { + "@timestamp": "2017-10-02T23:52:53.000Z", + "cisco.umbrella.amp_score": "Networks", + "cisco.umbrella.identities": "elasticuser", + "destination.address": "1.1.1.91", + "destination.ip": "1.1.1.91", + "event.dataset": "cisco.umbrella", + "event.module": "cisco", + "event.original": "\\\"2017-10-02 23:52:53\\\",\\\"elasticuser\\\",\\\"ActiveDirectoryUserName,ADSite,Network\\\",\\\"192.192.192.135\\\",\\\"1.1.1.91\\\",\\\"\\\",\\\"ALLOWED\\\",\\\"http://google.com/the.js\\\",\\\"www.google.com\\\",\\\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36\\\",\\\"200\\\",\\\"562\\\",\\\"1489\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"\\\",\\\"Networks\\\"", + "event.type": [ + "allowed" + ], + "fileset.name": "umbrella", + "http.request.bytes": "562", + "http.request.referrer": "www.google.com", + "http.response.bytes": "1489", + "http.response.status_code": "200", + "input.type": "log", + "log.offset": 798, + "message": "\"2017-10-02 23:52:53\",\"elasticuser\",\"ActiveDirectoryUserName,ADSite,Network\",\"192.192.192.135\",\"1.1.1.91\",\"\",\"ALLOWED\",\"http://google.com/the.js\",\"www.google.com\",\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36\",\"200\",\"562\",\"1489\",\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"Networks\"", + "observer.product": "Umbrella", + "observer.type": "proxy", + "observer.vendor": "Cisco", + "related.hosts": [ + "ActiveDirectoryUserName,ADSite,Network" + ], + "related.ip": [ + "192.192.192.135", + "1.1.1.91" + ], + "service.type": "cisco", + "source.address": "ActiveDirectoryUserName,ADSite,Network", + "source.domain": "ActiveDirectoryUserName,ADSite,Network", + "source.nat.ip": "192.192.192.135", + "url.full": "http://google.com/the.js", + "user_agent.original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36" + } +] \ No newline at end of file From 84f6311f6d01af786b61667b729ee428d776a015 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Mon, 5 Oct 2020 17:33:58 +0200 Subject: [PATCH 130/216] [Ingest Manager] Send updating state (#21461) [Ingest Manager] Send updating state (#21461) --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/managed_mode.go | 4 +- .../pkg/agent/application/upgrade/upgrade.go | 77 +++++++++++++++++-- x-pack/elastic-agent/pkg/core/state/state.go | 2 + x-pack/elastic-agent/pkg/reporter/reporter.go | 6 ++ 5 files changed, 81 insertions(+), 9 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 2ba08864ae8..278a9ea9cf4 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -28,3 +28,4 @@ - Add support for EQL based condition on inputs {pull}20994[20994] - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] - Add `install` and `uninstall` subcommands {pull}21206[21206] +- Send updating state {pull}21461[21461] diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index 12a9c242780..d1eaf197a88 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -200,11 +200,13 @@ func newManaged( } managedApplication.upgrader = upgrade.NewUpgrader( + agentInfo, cfg.Settings.DownloadConfig, log, []context.CancelFunc{managedApplication.cancelCtxFn}, reexec, - acker) + acker, + combinedReporter) actionDispatcher.MustRegister( &fleetapi.ActionPolicyChange{}, diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index cac36ef7922..7aacf77ba63 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -20,6 +20,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/state" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) @@ -33,11 +34,13 @@ const ( // Upgrader performs an upgrade type Upgrader struct { + agentInfo *info.AgentInfo settings *artifact.Config log *logger.Logger closers []context.CancelFunc reexec reexecManager acker acker + reporter stateReporter upgradeable bool } @@ -50,14 +53,19 @@ type acker interface { Commit(ctx context.Context) error } +type stateReporter interface { + OnStateChange(id string, name string, s state.State) +} + // NewUpgrader creates an upgrader which is capable of performing upgrade operation -func NewUpgrader(settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker) *Upgrader { +func NewUpgrader(agentInfo *info.AgentInfo, settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker, r stateReporter) *Upgrader { return &Upgrader{ settings: settings, log: log, closers: closers, reexec: reexec, acker: a, + reporter: r, upgradeable: getUpgradable(), } } @@ -68,13 +76,22 @@ func (u *Upgrader) Upgradeable() bool { } // Upgrade upgrades running agent -func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error { +func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) (err error) { + // report failed + defer func() { + if err != nil { + u.reportFailure(ctx, a, err) + } + }() + if !u.upgradeable { return fmt.Errorf( "cannot be upgraded; must be installed with install sub-command and " + "running under control of the systems supervisor") } + u.reportUpdating(a.Version) + sourceURI, err := u.sourceURI(a.Version, a.SourceURI) archivePath, err := u.downloadArtifact(ctx, a.Version, sourceURI) if err != nil { @@ -91,7 +108,10 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error } if strings.HasPrefix(release.Commit(), newHash) { - return errors.New("upgrading to same version") + // not an error + u.ackAction(ctx, a) + u.log.Warn("upgrading to same version") + return nil } if err := copyActionStore(newHash); err != nil { @@ -132,11 +152,7 @@ func (u *Upgrader) Ack(ctx context.Context) error { return nil } - if err := u.acker.Ack(ctx, marker.Action); err != nil { - return err - } - - if err := u.acker.Commit(ctx); err != nil { + if err := u.ackAction(ctx, marker.Action); err != nil { return err } @@ -148,6 +164,7 @@ func (u *Upgrader) Ack(ctx context.Context) error { return ioutil.WriteFile(markerFile, markerBytes, 0600) } + func (u *Upgrader) sourceURI(version, retrievedURI string) (string, error) { if strings.HasSuffix(version, "-SNAPSHOT") && retrievedURI == "" { return "", errors.New("snapshot upgrade requires source uri", errors.TypeConfig) @@ -159,6 +176,50 @@ func (u *Upgrader) sourceURI(version, retrievedURI string) (string, error) { return u.settings.SourceURI, nil } +// ackAction is used for successful updates, it was either updated successfully or to the same version +// so we need to remove updating state and get prevent from receiving same update action again. +func (u *Upgrader) ackAction(ctx context.Context, action fleetapi.Action) error { + if err := u.acker.Ack(ctx, action); err != nil { + return err + } + + if err := u.acker.Commit(ctx); err != nil { + return err + } + + u.reporter.OnStateChange( + "", + agentName, + state.State{Status: state.Running}, + ) + + return nil +} + +// report failure is used when update process fails. action is acked so it won't be received again +// and state is changed to FAILED +func (u *Upgrader) reportFailure(ctx context.Context, action fleetapi.Action, err error) { + // ack action + u.acker.Ack(ctx, action) + + // report failure + u.reporter.OnStateChange( + "", + agentName, + state.State{Status: state.Failed, Message: err.Error()}, + ) +} + +// reportUpdating sets state of agent to updating. +func (u *Upgrader) reportUpdating(version string) { + // report failure + u.reporter.OnStateChange( + "", + agentName, + state.State{Status: state.Updating, Message: fmt.Sprintf("Update to version '%s' started", version)}, + ) +} + func rollbackInstall(hash string) { os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) } diff --git a/x-pack/elastic-agent/pkg/core/state/state.go b/x-pack/elastic-agent/pkg/core/state/state.go index 6b7c8bd53de..670cdc2a2f2 100644 --- a/x-pack/elastic-agent/pkg/core/state/state.go +++ b/x-pack/elastic-agent/pkg/core/state/state.go @@ -30,6 +30,8 @@ const ( Crashed // Restarting is status describing application is restarting. Restarting + // Updating is status describing application is updating. + Updating ) // State wraps the process state and application status. diff --git a/x-pack/elastic-agent/pkg/reporter/reporter.go b/x-pack/elastic-agent/pkg/reporter/reporter.go index c36708a837f..3b128841b2a 100644 --- a/x-pack/elastic-agent/pkg/reporter/reporter.go +++ b/x-pack/elastic-agent/pkg/reporter/reporter.go @@ -38,6 +38,8 @@ const ( EventSubTypeFailed = "FAILED" // EventSubTypeStopping is an event type indicating application is stopping. EventSubTypeStopping = "STOPPING" + // EventSubTypeUpdating is an event type indicating update process in progress. + EventSubTypeUpdating = "UPDATING" ) type agentInfo interface { @@ -127,6 +129,10 @@ func generateRecord(agentID string, id string, name string, s state.State) event case state.Restarting: subType = EventSubTypeStarting subTypeText = "RESTARTING" + case state.Updating: + subType = EventSubTypeUpdating + subTypeText = EventSubTypeUpdating + } err := errors.New( From 931e3cafe1beb6b99d0706d51d25f422f59ea260 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Mon, 5 Oct 2020 10:00:07 -0600 Subject: [PATCH 131/216] Fix billing.go aws.GetStartTimeEndTime (#21531) This PR is to fix this error introduced in https://github.com/elastic/beats/pull/20875: ``` # github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/billing ../x-pack/metricbeat/module/aws/billing/billing.go:119:47: not enough arguments in call to "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws".GetStartTimeEndTime have (time.Duration) want (time.Duration, time.Duration) Error: error getting default metricsets: Error running subcommand to get metricsets: running "go run /home/travis/gopath/src/github.com/elastic/beats/x-pack/metricbeat/scripts/msetlists/main.go" failed with exit code 2 ``` --- x-pack/metricbeat/module/aws/billing/billing.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/metricbeat/module/aws/billing/billing.go b/x-pack/metricbeat/module/aws/billing/billing.go index 2eb2bd2854a..b9b971e3d34 100644 --- a/x-pack/metricbeat/module/aws/billing/billing.go +++ b/x-pack/metricbeat/module/aws/billing/billing.go @@ -116,7 +116,7 @@ func (m *MetricSet) Fetch(report mb.ReporterV2) error { startDate, endDate := getStartDateEndDate(m.Period) // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period) + startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) // get cost metrics from cost explorer awsConfig := m.MetricSet.AwsConfig.Copy() From 527ce19ca8fce4ff4dff6b04303768f460f72598 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Mon, 5 Oct 2020 17:03:02 +0100 Subject: [PATCH 132/216] [CI] fix 'no matches found within 10000' (#21466) --- Jenkinsfile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 317a5c781e3..08853ab1453 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -74,7 +74,7 @@ pipeline { } steps { withGithubNotify(context: 'Lint') { - withBeatsEnv(archive: true) { + withBeatsEnv(archive: true, id: 'lint') { dumpVariables() cmd(label: 'make check', script: 'make check') } @@ -345,8 +345,13 @@ def archiveTestOutput(Map args = [:]) { } cmd(label: 'Prepare test output', script: 'python .ci/scripts/pre_archive_test.py') dir('build') { + if (isUnix()) { + cmd(label: 'Delete folders that are causing exceptions (See JENKINS-58421)', + returnStatus: true, + script: 'rm -rf ve || true; find . -type d -name vendor -exec rm -r {} \\;') + } else { log(level: 'INFO', text: 'Delete folders that are causing exceptions (See JENKINS-58421) is disabled for Windows.') } junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: args.testResults, stashedTestReports: stashedTestReports, id: args.id) - archiveArtifacts(allowEmptyArchive: true, artifacts: args.artifacts) + tar(file: "test-build-artifacts-${args.id}.tgz", dir: '.', archive: true, allowMissing: true) } catchError(buildResult: 'SUCCESS', message: 'Failed to archive the build test results', stageResult: 'SUCCESS') { def folder = cmd(label: 'Find system-tests', returnStdout: true, script: 'python .ci/scripts/search_system_tests.py').trim() From 40b24dd2d00bb2a83b46449e452f4b7f86d59087 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 5 Oct 2020 18:24:42 +0200 Subject: [PATCH 133/216] Add filestream input reader (#21481) ## What does this PR do? This PR adds the event reader and publisher functionality. This is mostly the refactoring of `Harvester` from `filebeat/input/log`. Two things are missing: metrics and special readers e.g. `multiline`. --- filebeat/input/filestream/config.go | 4 +- filebeat/input/filestream/filestream.go | 75 +++++- filebeat/input/filestream/input.go | 307 +++++++++++++++++++++++- 3 files changed, 365 insertions(+), 21 deletions(-) diff --git a/filebeat/input/filestream/config.go b/filebeat/input/filestream/config.go index 93b23232594..3ec076196f0 100644 --- a/filebeat/input/filestream/config.go +++ b/filebeat/input/filestream/config.go @@ -48,12 +48,12 @@ type closerConfig struct { type readerCloserConfig struct { AfterInterval time.Duration - Inactive time.Duration OnEOF bool } type stateChangeCloserConfig struct { CheckInterval time.Duration + Inactive time.Duration Removed bool Renamed bool } @@ -94,11 +94,11 @@ func defaultCloserConfig() closerConfig { OnStateChange: stateChangeCloserConfig{ CheckInterval: 5 * time.Second, Removed: true, // TODO check clean_removed option + Inactive: 0 * time.Second, Renamed: false, }, Reader: readerCloserConfig{ OnEOF: false, - Inactive: 0 * time.Second, AfterInterval: 0 * time.Second, }, } diff --git a/filebeat/input/filestream/filestream.go b/filebeat/input/filestream/filestream.go index 59f26ccca1b..4d42bbf6242 100644 --- a/filebeat/input/filestream/filestream.go +++ b/filebeat/input/filestream/filestream.go @@ -26,6 +26,7 @@ import ( input "github.com/elastic/beats/v7/filebeat/input/v2" "github.com/elastic/beats/v7/libbeat/common/backoff" + "github.com/elastic/beats/v7/libbeat/common/file" "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/go-concert/ctxtool" "github.com/elastic/go-concert/unison" @@ -43,10 +44,14 @@ type logFile struct { ctx context.Context cancelReading context.CancelFunc - closeInactive time.Duration closeAfterInterval time.Duration closeOnEOF bool + checkInterval time.Duration + closeInactive time.Duration + closeRemoved bool + closeRenamed bool + offset int64 lastTimeRead time.Time backoff backoff.Backoff @@ -59,7 +64,7 @@ func newFileReader( canceler input.Canceler, f *os.File, config readerConfig, - closerConfig readerCloserConfig, + closerConfig closerConfig, ) (*logFile, error) { offset, err := f.Seek(0, os.SEEK_CUR) if err != nil { @@ -69,9 +74,12 @@ func newFileReader( l := &logFile{ file: f, log: log, - closeInactive: closerConfig.Inactive, - closeAfterInterval: closerConfig.AfterInterval, - closeOnEOF: closerConfig.OnEOF, + closeAfterInterval: closerConfig.Reader.AfterInterval, + closeOnEOF: closerConfig.Reader.OnEOF, + checkInterval: closerConfig.OnStateChange.CheckInterval, + closeInactive: closerConfig.OnStateChange.Inactive, + closeRemoved: closerConfig.OnStateChange.Removed, + closeRenamed: closerConfig.OnStateChange.Renamed, offset: offset, lastTimeRead: time.Now(), backoff: backoff.NewExpBackoff(canceler.Done(), config.Backoff.Init, config.Backoff.Max), @@ -143,7 +151,7 @@ func (f *logFile) startFileMonitoringIfNeeded() { if f.closeAfterInterval > 0 { f.tg.Go(func(ctx unison.Canceler) error { - f.closeIfInactive(ctx) + f.periodicStateCheck(ctx) return nil }) } @@ -164,10 +172,8 @@ func (f *logFile) closeIfTimeout(ctx unison.Canceler) { } } -func (f *logFile) closeIfInactive(ctx unison.Canceler) { - // This can be made configureble if users need a more flexible - // cheking for inactive files. - ticker := time.NewTicker(5 * time.Minute) +func (f *logFile) periodicStateCheck(ctx unison.Canceler) { + ticker := time.NewTicker(f.checkInterval) defer ticker.Stop() for { @@ -175,8 +181,7 @@ func (f *logFile) closeIfInactive(ctx unison.Canceler) { case <-ctx.Done(): return case <-ticker.C: - age := time.Since(f.lastTimeRead) - if age > f.closeInactive { + if f.shouldBeClosed() { f.cancelReading() return } @@ -184,6 +189,52 @@ func (f *logFile) closeIfInactive(ctx unison.Canceler) { } } +func (f *logFile) shouldBeClosed() bool { + if f.closeInactive > 0 { + if time.Since(f.lastTimeRead) > f.closeInactive { + return true + } + } + + if !f.closeRemoved && !f.closeRenamed { + return false + + } + + info, statErr := f.file.Stat() + if statErr != nil { + f.log.Errorf("Unexpected error reading from %s; error: %s", f.file.Name(), statErr) + return true + } + + if f.closeRenamed { + // Check if the file can still be found under the same path + if !isSameFile(f.file.Name(), info) { + f.log.Debugf("close_renamed is enabled and file %s has been renamed", f.file.Name()) + return true + } + } + + if f.closeRemoved { + // Check if the file name exists. See https://github.com/elastic/filebeat/issues/93 + if file.IsRemoved(f.file) { + f.log.Debugf("close_removed is enabled and file %s has been removed", f.file.Name()) + return true + } + } + + return false +} + +func isSameFile(path string, info os.FileInfo) bool { + fileInfo, err := os.Stat(path) + if err != nil { + return false + } + + return os.SameFile(fileInfo, info) +} + // errorChecks determines the cause for EOF errors, and how the EOF event should be handled // based on the config options. func (f *logFile) errorChecks(err error) error { diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go index bcd143c1c5a..b6c6598c50b 100644 --- a/filebeat/input/filestream/input.go +++ b/filebeat/input/filestream/input.go @@ -18,16 +18,27 @@ package filestream import ( + "fmt" + "os" + + "golang.org/x/text/transform" + + "github.com/elastic/go-concert/ctxtool" + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/match" "github.com/elastic/beats/v7/libbeat/feature" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/reader" + "github.com/elastic/beats/v7/libbeat/reader/debug" + "github.com/elastic/beats/v7/libbeat/reader/readfile" + "github.com/elastic/beats/v7/libbeat/reader/readfile/encoding" ) -// filestream is the input for reading from files which -// are actively written by other applications. -type filestream struct{} +const pluginName = "filestream" type state struct { Source string `json:"source" struct:"source"` @@ -35,7 +46,20 @@ type state struct { IdentifierName string `json:"identifier_name" struct:"identifier_name"` } -const pluginName = "filestream" +// filestream is the input for reading from files which +// are actively written by other applications. +type filestream struct { + readerConfig readerConfig + bufferSize int + tailFile bool // TODO + encodingFactory encoding.EncodingFactory + encoding encoding.Encoding + lineTerminator readfile.LineTerminator + excludeLines []match.Matcher + includeLines []match.Matcher + maxBytes int + closerConfig closerConfig +} // Plugin creates a new filestream input plugin for creating a stateful input. func Plugin(log *logp.Logger, store loginp.StateStore) input.Plugin { @@ -55,13 +79,46 @@ func Plugin(log *logp.Logger, store loginp.StateStore) input.Plugin { } func configure(cfg *common.Config) (loginp.Prospector, loginp.Harvester, error) { - panic("TODO: implement me") + config := defaultConfig() + if err := cfg.Unpack(&config); err != nil { + return nil, nil, err + } + + prospector, err := newFileProspector( + config.Paths, + config.IgnoreOlder, + config.FileWatcher, + config.FileIdentity, + ) + if err != nil { + return nil, nil, err + } + + encodingFactory, ok := encoding.FindEncoding(config.Reader.Encoding) + if !ok || encodingFactory == nil { + return nil, nil, fmt.Errorf("unknown encoding('%v')", config.Reader.Encoding) + } + + return prospector, &filestream{ + readerConfig: config.Reader, + bufferSize: config.Reader.BufferSize, + encodingFactory: encodingFactory, + lineTerminator: config.Reader.LineTerminator, + excludeLines: config.Reader.ExcludeLines, + includeLines: config.Reader.IncludeLines, + maxBytes: config.Reader.MaxBytes, + closerConfig: config.Close, + }, nil } func (inp *filestream) Name() string { return pluginName } func (inp *filestream) Test(src loginp.Source, ctx input.TestContext) error { - panic("TODO: implement me") + reader, err := inp.open(ctx.Logger, ctx.Cancelation, state{}) + if err != nil { + return err + } + return reader.Close() } func (inp *filestream) Run( @@ -70,5 +127,241 @@ func (inp *filestream) Run( cursor loginp.Cursor, publisher loginp.Publisher, ) error { - panic("TODO: implement me") + fs, ok := src.(fileSource) + if !ok { + return fmt.Errorf("not file source") + } + + log := ctx.Logger.With("path", fs.newPath).With("state-id", src.Name()) + state := initState(log, cursor, fs) + + r, err := inp.open(log, ctx.Cancelation, state) + if err != nil { + log.Errorf("File could not be opened for reading: %v", err) + return err + } + + _, streamCancel := ctxtool.WithFunc(ctxtool.FromCanceller(ctx.Cancelation), func() { + log.Debug("Closing reader of filestream") + err := r.Close() + if err != nil { + log.Errorf("Error stopping filestream reader %v", err) + } + }) + defer streamCancel() + + return inp.readFromSource(ctx, log, r, fs.newPath, state, publisher) +} + +func initState(log *logp.Logger, c loginp.Cursor, s fileSource) state { + state := state{Source: s.newPath, IdentifierName: s.identifierGenerator} + if c.IsNew() { + return state + } + + err := c.Unpack(&state) + if err != nil { + log.Error("Cannot serialize cursor data into file state: %+v", err) + } + + return state +} + +func (inp *filestream) open(log *logp.Logger, canceler input.Canceler, s state) (reader.Reader, error) { + f, err := inp.openFile(s.Source, s.Offset) + if err != nil { + return nil, err + } + + log.Debug("newLogFileReader with config.MaxBytes:", inp.maxBytes) + + // TODO: NewLineReader uses additional buffering to deal with encoding and testing + // for new lines in input stream. Simple 8-bit based encodings, or plain + // don't require 'complicated' logic. + logReader, err := newFileReader(log, canceler, f, inp.readerConfig, inp.closerConfig) + if err != nil { + return nil, err + } + + dbgReader, err := debug.AppendReaders(logReader) + if err != nil { + f.Close() + return nil, err + } + + // Configure MaxBytes limit for EncodeReader as multiplied by 4 + // for the worst case scenario where incoming UTF32 charchers are decoded to the single byte UTF-8 characters. + // This limit serves primarily to avoid memory bload or potential OOM with expectedly long lines in the file. + // The further size limiting is performed by LimitReader at the end of the readers pipeline as needed. + encReaderMaxBytes := inp.maxBytes * 4 + + var r reader.Reader + r, err = readfile.NewEncodeReader(dbgReader, readfile.Config{ + Codec: inp.encoding, + BufferSize: inp.bufferSize, + Terminator: inp.lineTerminator, + MaxBytes: encReaderMaxBytes, + }) + if err != nil { + f.Close() + return nil, err + } + + r = readfile.NewStripNewline(r, inp.lineTerminator) + r = readfile.NewLimitReader(r, inp.maxBytes) + + return r, nil +} + +// openFile opens a file and checks for the encoding. In case the encoding cannot be detected +// or the file cannot be opened because for example of failing read permissions, an error +// is returned and the harvester is closed. The file will be picked up again the next time +// the file system is scanned +func (inp *filestream) openFile(path string, offset int64) (*os.File, error) { + err := inp.checkFileBeforeOpening(path) + if err != nil { + return nil, err + } + + f, err := os.OpenFile(path, os.O_RDONLY, os.FileMode(0)) + if err != nil { + return nil, fmt.Errorf("failed opening %s: %s", path, err) + } + + err = inp.initFileOffset(f, offset) + if err != nil { + f.Close() + return nil, err + } + + inp.encoding, err = inp.encodingFactory(f) + if err != nil { + f.Close() + if err == transform.ErrShortSrc { + return nil, fmt.Errorf("initialising encoding for '%v' failed due to file being too short", f) + } + return nil, fmt.Errorf("initialising encoding for '%v' failed: %v", f, err) + } + + return f, nil +} + +func (inp *filestream) checkFileBeforeOpening(path string) error { + fi, err := os.Stat(path) + if err != nil { + return fmt.Errorf("failed to stat source file %s: %v", path, err) + } + + if !fi.Mode().IsRegular() { + return fmt.Errorf("tried to open non regular file: %q %s", fi.Mode(), fi.Name()) + } + + if fi.Mode()&os.ModeNamedPipe != 0 { + return fmt.Errorf("failed to open file %s, named pipes are not supported", path) + } + + return nil +} + +func (inp *filestream) initFileOffset(file *os.File, offset int64) error { + if offset > 0 { + _, err := file.Seek(offset, os.SEEK_SET) + return err + } + + // get offset from file in case of encoding factory was required to read some data. + _, err := file.Seek(0, os.SEEK_CUR) + return err +} + +func (inp *filestream) readFromSource( + ctx input.Context, + log *logp.Logger, + r reader.Reader, + path string, + s state, + p loginp.Publisher, +) error { + for ctx.Cancelation.Err() == nil { + message, err := r.Next() + if err != nil { + switch err { + case ErrFileTruncate: + log.Info("File was truncated. Begin reading file from offset 0.") + s.Offset = 0 + case ErrClosed: + log.Info("Reader was closed. Closing.") + case reader.ErrLineUnparsable: + log.Info("Skipping unparsable line in file.") + continue + default: + log.Errorf("Read line error: %v", err) + } + return nil + } + + if message.IsEmpty() || inp.isDroppedLine(log, string(message.Content)) { + continue + } + + event := inp.eventFromMessage(message, path) + s.Offset += int64(message.Bytes) + + if err := p.Publish(event, s); err != nil { + return err + } + } + return nil +} + +// isDroppedLine decides if the line is exported or not based on +// the include_lines and exclude_lines options. +func (inp *filestream) isDroppedLine(log *logp.Logger, line string) bool { + if len(inp.includeLines) > 0 { + if !matchAny(inp.includeLines, line) { + log.Debug("Drop line as it does not match any of the include patterns %s", line) + return true + } + } + if len(inp.excludeLines) > 0 { + if matchAny(inp.excludeLines, line) { + log.Debug("Drop line as it does match one of the exclude patterns%s", line) + return true + } + } + + return false +} + +func matchAny(matchers []match.Matcher, text string) bool { + for _, m := range matchers { + if m.MatchString(text) { + return true + } + } + return false +} + +func (inp *filestream) eventFromMessage(m reader.Message, path string) beat.Event { + fields := common.MapStr{ + "log": common.MapStr{ + "offset": m.Bytes, // Offset here is the offset before the starting char. + "file": common.MapStr{ + "path": path, + }, + }, + } + fields.DeepUpdate(m.Fields) + + if len(m.Content) > 0 { + if fields == nil { + fields = common.MapStr{} + } + fields["message"] = string(m.Content) + } + + return beat.Event{ + Timestamp: m.Ts, + Fields: fields, + } } From f4ebcf0dfc1a64bdd3ab5e2b70fa49bb4c1517b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 5 Oct 2020 19:18:35 +0200 Subject: [PATCH 134/216] Enable filestream input (#21533) The feature is enabled, but it is not yet documented. --- filebeat/input/default-inputs/inputs.go | 6 ++++-- filebeat/input/filestream/fswatch.go | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/filebeat/input/default-inputs/inputs.go b/filebeat/input/default-inputs/inputs.go index 52338a0af98..881f3664efd 100644 --- a/filebeat/input/default-inputs/inputs.go +++ b/filebeat/input/default-inputs/inputs.go @@ -19,6 +19,7 @@ package inputs import ( "github.com/elastic/beats/v7/filebeat/beater" + "github.com/elastic/beats/v7/filebeat/input/filestream" "github.com/elastic/beats/v7/filebeat/input/unix" v2 "github.com/elastic/beats/v7/filebeat/input/v2" "github.com/elastic/beats/v7/libbeat/beat" @@ -27,13 +28,14 @@ import ( func Init(info beat.Info, log *logp.Logger, components beater.StateStore) []v2.Plugin { return append( - genericInputs(), + genericInputs(log, components), osInputs(info, log, components)..., ) } -func genericInputs() []v2.Plugin { +func genericInputs(log *logp.Logger, components beater.StateStore) []v2.Plugin { return []v2.Plugin{ + filestream.Plugin(log, components), unix.Plugin(), } } diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index d4bc1b5ea08..1b80971d835 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -74,7 +74,7 @@ type fileWatcher struct { func newFileWatcher(paths []string, ns *common.ConfigNamespace) (loginp.FSWatcher, error) { if ns == nil { - return newScannerWatcher(paths, nil) + return newScannerWatcher(paths, common.NewConfig()) } watcherType := ns.Name() From c858dd0f3188793ffd52d8975c8120ce0f442ff8 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Mon, 5 Oct 2020 14:38:56 -0400 Subject: [PATCH 135/216] [Elastic Agent] Add upgrade CLI to initiate upgrade of Agent locally (#21425) * Add new upgrade command to initiate a local upgrade of Elastic Agent. * Update drop path with file:// prefix is defined. * Add comment. * Add missing new line. * Add changelog. * Prevent upgrading of Agent locally when connected to Fleet. * Fixes from rebase. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/application.go | 12 +++- .../application/handler_action_upgrade.go | 18 ++++- .../pkg/agent/application/local_mode.go | 14 ++++ .../application/upgrade/step_download.go | 9 ++- .../agent/application/upgrade/step_mark.go | 4 +- .../pkg/agent/application/upgrade/upgrade.go | 37 ++++++++--- x-pack/elastic-agent/pkg/agent/cmd/common.go | 1 + x-pack/elastic-agent/pkg/agent/cmd/run.go | 4 +- x-pack/elastic-agent/pkg/agent/cmd/upgrade.go | 56 ++++++++++++++++ .../pkg/agent/control/control_test.go | 2 +- .../pkg/agent/control/server/server.go | 65 +++++++++++++++++-- .../pkg/basecmd/version/cmd_test.go | 4 +- 13 files changed, 198 insertions(+), 29 deletions(-) create mode 100644 x-pack/elastic-agent/pkg/agent/cmd/upgrade.go diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 278a9ea9cf4..7d6870328c7 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -29,3 +29,4 @@ - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] - Add `install` and `uninstall` subcommands {pull}21206[21206] - Send updating state {pull}21461[21461] +- Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] diff --git a/x-pack/elastic-agent/pkg/agent/application/application.go b/x-pack/elastic-agent/pkg/agent/application/application.go index e003eed61a6..d721a8aa148 100644 --- a/x-pack/elastic-agent/pkg/agent/application/application.go +++ b/x-pack/elastic-agent/pkg/agent/application/application.go @@ -8,6 +8,7 @@ import ( "context" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/upgrade" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/warn" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" @@ -25,8 +26,12 @@ type reexecManager interface { ReExec(argOverrides ...string) } +type upgraderControl interface { + SetUpgrader(upgrader *upgrade.Upgrader) +} + // New creates a new Agent and bootstrap the required subsystem. -func New(log *logger.Logger, pathConfigFile string, reexec reexecManager) (Application, error) { +func New(log *logger.Logger, pathConfigFile string, reexec reexecManager, uc upgraderControl) (Application, error) { // Load configuration from disk to understand in which mode of operation // we must start the elastic-agent, the mode of operation cannot be changed without restarting the // elastic-agent. @@ -39,7 +44,7 @@ func New(log *logger.Logger, pathConfigFile string, reexec reexecManager) (Appli return nil, err } - return createApplication(log, pathConfigFile, rawConfig, reexec) + return createApplication(log, pathConfigFile, rawConfig, reexec, uc) } func createApplication( @@ -47,6 +52,7 @@ func createApplication( pathConfigFile string, rawConfig *config.Config, reexec reexecManager, + uc upgraderControl, ) (Application, error) { warn.LogNotGA(log) log.Info("Detecting execution mode") @@ -59,7 +65,7 @@ func createApplication( if isStandalone(cfg.Fleet) { log.Info("Agent is managed locally") - return newLocal(ctx, log, pathConfigFile, rawConfig) + return newLocal(ctx, log, pathConfigFile, rawConfig, reexec, uc) } log.Info("Agent is managed by Fleet") diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go index 4d0026d4d79..a4940cfe55b 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go @@ -27,5 +27,21 @@ func (h *handlerUpgrade) Handle(ctx context.Context, a action, acker fleetAcker) return fmt.Errorf("invalid type, expected ActionUpgrade and received %T", a) } - return h.upgrader.Upgrade(ctx, action) + return h.upgrader.Upgrade(ctx, &upgradeAction{action}, true) +} + +type upgradeAction struct { + *fleetapi.ActionUpgrade +} + +func (a *upgradeAction) Version() string { + return a.ActionUpgrade.Version +} + +func (a *upgradeAction) SourceURI() string { + return a.ActionUpgrade.SourceURI +} + +func (a *upgradeAction) FleetAction() *fleetapi.ActionUpgrade { + return a.ActionUpgrade } diff --git a/x-pack/elastic-agent/pkg/agent/application/local_mode.go b/x-pack/elastic-agent/pkg/agent/application/local_mode.go index 5559089404e..f8eed0f5792 100644 --- a/x-pack/elastic-agent/pkg/agent/application/local_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/local_mode.go @@ -9,6 +9,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/filters" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/upgrade" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" @@ -60,6 +61,8 @@ func newLocal( log *logger.Logger, pathConfigFile string, rawConfig *config.Config, + reexec reexecManager, + uc upgraderControl, ) (*Local, error) { cfg, err := configuration.NewFromConfig(rawConfig) if err != nil { @@ -135,6 +138,17 @@ func newLocal( localApplication.source = cfgSource + // create a upgrader to use in local mode + upgrader := upgrade.NewUpgrader( + agentInfo, + cfg.Settings.DownloadConfig, + log, + []context.CancelFunc{localApplication.cancelCtxFn}, + reexec, + newNoopAcker(), + reporter) + uc.SetUpgrader(upgrader) + return localApplication, nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go index 9db442d3655..cf3a3656724 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -6,6 +6,7 @@ package upgrade import ( "context" + "strings" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" downloader "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/download/localremote" @@ -16,7 +17,13 @@ func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI stri // do not update source config settings := *u.settings if sourceURI != "" { - settings.SourceURI = sourceURI + if strings.HasPrefix(sourceURI, "file://") { + // update the DropPath so the fs.Downloader can download from this + // path instead of looking into the installed downloads directory + settings.DropPath = strings.TrimPrefix(sourceURI, "file://") + } else { + settings.SourceURI = sourceURI + } } allowEmptyPgp, pgp := release.PGP() diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go index 53920e6ecff..8d03fec3ff6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go @@ -37,7 +37,7 @@ type updateMarker struct { } // markUpgrade marks update happened so we can handle grace period -func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action *fleetapi.ActionUpgrade) error { +func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action Action) error { prevVersion := release.Version() prevHash := release.Commit() if len(prevHash) > hashLen { @@ -49,7 +49,7 @@ func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action *fleetap UpdatedOn: time.Now(), PrevVersion: prevVersion, PrevHash: prevHash, - Action: action, + Action: action.FleetAction(), } markerBytes, err := yaml.Marshal(marker) diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index 7aacf77ba63..1a21bc154a1 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -44,6 +44,16 @@ type Upgrader struct { upgradeable bool } +// Action is the upgrade action state. +type Action interface { + // Version to upgrade to. + Version() string + // SourceURI for download. + SourceURI() string + // FleetAction is the action from fleet that started the action (optional). + FleetAction() *fleetapi.ActionUpgrade +} + type reexecManager interface { ReExec(argOverrides ...string) } @@ -60,13 +70,14 @@ type stateReporter interface { // NewUpgrader creates an upgrader which is capable of performing upgrade operation func NewUpgrader(agentInfo *info.AgentInfo, settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker, r stateReporter) *Upgrader { return &Upgrader{ + agentInfo: agentInfo, settings: settings, log: log, closers: closers, reexec: reexec, acker: a, reporter: r, - upgradeable: getUpgradable(), + upgradeable: getUpgradeable(), } } @@ -76,11 +87,13 @@ func (u *Upgrader) Upgradeable() bool { } // Upgrade upgrades running agent -func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) (err error) { +func (u *Upgrader) Upgrade(ctx context.Context, a Action, reexecNow bool) (err error) { // report failed defer func() { if err != nil { - u.reportFailure(ctx, a, err) + if action := a.FleetAction(); action != nil { + u.reportFailure(ctx, action, err) + } } }() @@ -90,15 +103,15 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) (err "running under control of the systems supervisor") } - u.reportUpdating(a.Version) + u.reportUpdating(a.Version()) - sourceURI, err := u.sourceURI(a.Version, a.SourceURI) - archivePath, err := u.downloadArtifact(ctx, a.Version, sourceURI) + sourceURI, err := u.sourceURI(a.Version(), a.SourceURI()) + archivePath, err := u.downloadArtifact(ctx, a.Version(), sourceURI) if err != nil { return err } - newHash, err := u.unpack(ctx, a.Version, archivePath) + newHash, err := u.unpack(ctx, a.Version(), archivePath) if err != nil { return err } @@ -109,7 +122,9 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) (err if strings.HasPrefix(release.Commit(), newHash) { // not an error - u.ackAction(ctx, a) + if action := a.FleetAction(); action != nil { + u.ackAction(ctx, action) + } u.log.Warn("upgrading to same version") return nil } @@ -128,7 +143,9 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) (err return err } - u.reexec.ReExec() + if reexecNow { + u.reexec.ReExec() + } return nil } @@ -224,7 +241,7 @@ func rollbackInstall(hash string) { os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) } -func getUpgradable() bool { +func getUpgradeable() bool { // only upgradeable if running from Agent installer and running under the // control of the system supervisor (or built specifically with upgrading enabled) return release.Upgradeable() || (install.RunningInstalled() && install.RunningUnderSupervisor()) diff --git a/x-pack/elastic-agent/pkg/agent/cmd/common.go b/x-pack/elastic-agent/pkg/agent/cmd/common.go index 8ca5700f3c6..39093be71b6 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/common.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/common.go @@ -68,6 +68,7 @@ func NewCommandWithArgs(args []string, streams *cli.IOStreams) *cobra.Command { cmd.AddCommand(run) cmd.AddCommand(newInstallCommandWithArgs(flags, args, streams)) cmd.AddCommand(newUninstallCommandWithArgs(flags, args, streams)) + cmd.AddCommand(newUpgradeCommandWithArgs(flags, args, streams)) cmd.AddCommand(newEnrollCommandWithArgs(flags, args, streams)) cmd.AddCommand(newInspectCommandWithArgs(flags, args, streams)) diff --git a/x-pack/elastic-agent/pkg/agent/cmd/run.go b/x-pack/elastic-agent/pkg/agent/cmd/run.go index 77beeb6fe1a..84dd8bd8a9a 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/run.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/run.go @@ -95,13 +95,13 @@ func run(flags *globalFlags, streams *cli.IOStreams) error { // Windows: Mark se rex := reexec.NewManager(rexLogger, execPath) // start the control listener - control := server.New(logger.Named("control"), rex) + control := server.New(logger.Named("control"), rex, nil) if err := control.Start(); err != nil { return err } defer control.Stop() - app, err := application.New(logger, pathConfigFile, rex) + app, err := application.New(logger, pathConfigFile, rex, control) if err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/upgrade.go b/x-pack/elastic-agent/pkg/agent/cmd/upgrade.go new file mode 100644 index 00000000000..81a5c82b4ab --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/cmd/upgrade.go @@ -0,0 +1,56 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package cmd + +import ( + "context" + "fmt" + "os" + + "github.com/spf13/cobra" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/control" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/control/client" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/cli" +) + +func newUpgradeCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStreams) *cobra.Command { + cmd := &cobra.Command{ + Use: "upgrade ", + Short: "Upgrade the currently running Elastic Agent to the specified version", + Args: cobra.ExactArgs(1), + Run: func(c *cobra.Command, args []string) { + if err := upgradeCmd(streams, c, flags, args); err != nil { + fmt.Fprintf(streams.Err, "%v\n", err) + os.Exit(1) + } + }, + } + + cmd.Flags().StringP("source-uri", "s", "", "Source URI to download the new version from") + + return cmd +} + +func upgradeCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args []string) error { + fmt.Fprintln(streams.Out, "The upgrade process of Elastic Agent is currently EXPERIMENTAL and should not be used in production") + + version := args[0] + sourceURI, _ := cmd.Flags().GetString("source-uri") + + c := client.New() + err := c.Connect(context.Background()) + if err != nil { + return errors.New(err, "Failed communicating to running daemon", errors.TypeNetwork, errors.M("socket", control.Address())) + } + defer c.Disconnect() + version, err = c.Upgrade(context.Background(), version, sourceURI) + if err != nil { + return errors.New(err, "Failed trigger upgrade of daemon") + } + fmt.Fprintf(streams.Out, "Upgrade triggered to version %s, Elastic Agent is currently restarting\n", version) + return nil +} diff --git a/x-pack/elastic-agent/pkg/agent/control/control_test.go b/x-pack/elastic-agent/pkg/agent/control/control_test.go index 9454179ae60..5c56aed4691 100644 --- a/x-pack/elastic-agent/pkg/agent/control/control_test.go +++ b/x-pack/elastic-agent/pkg/agent/control/control_test.go @@ -20,7 +20,7 @@ import ( ) func TestServerClient_Version(t *testing.T) { - srv := server.New(newErrorLogger(t), nil) + srv := server.New(newErrorLogger(t), nil, nil) err := srv.Start() require.NoError(t, err) defer srv.Stop() diff --git a/x-pack/elastic-agent/pkg/agent/control/server/server.go b/x-pack/elastic-agent/pkg/agent/control/server/server.go index faa7982c814..0ce970c9256 100644 --- a/x-pack/elastic-agent/pkg/agent/control/server/server.go +++ b/x-pack/elastic-agent/pkg/agent/control/server/server.go @@ -7,14 +7,17 @@ package server import ( "context" "net" - - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/reexec" + "sync" + "time" "google.golang.org/grpc" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/reexec" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/upgrade" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/control" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/control/proto" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) @@ -22,18 +25,28 @@ import ( type Server struct { logger *logger.Logger rex reexec.ExecManager + up *upgrade.Upgrader listener net.Listener server *grpc.Server + lock sync.RWMutex } // New creates a new control protocol server. -func New(log *logger.Logger, rex reexec.ExecManager) *Server { +func New(log *logger.Logger, rex reexec.ExecManager, up *upgrade.Upgrader) *Server { return &Server{ logger: log, rex: rex, + up: up, } } +// SetUpgrader changes the upgrader. +func (s *Server) SetUpgrader(up *upgrade.Upgrader) { + s.lock.Lock() + defer s.lock.Unlock() + s.up = up +} + // Start starts the GRPC endpoint and accepts new connections. func (s *Server) Start() error { if s.server != nil { @@ -100,10 +113,48 @@ func (s *Server) Restart(_ context.Context, _ *proto.Empty) (*proto.RestartRespo // Upgrade performs the upgrade operation. func (s *Server) Upgrade(ctx context.Context, request *proto.UpgradeRequest) (*proto.UpgradeResponse, error) { - // not implemented + s.lock.RLock() + u := s.up + s.lock.RUnlock() + if u == nil { + // not running with upgrader (must be controlled by Fleet) + return &proto.UpgradeResponse{ + Status: proto.ActionStatus_FAILURE, + Error: "cannot be upgraded; perform upgrading using Fleet", + }, nil + } + err := u.Upgrade(ctx, &upgradeRequest{request}, false) + if err != nil { + return &proto.UpgradeResponse{ + Status: proto.ActionStatus_FAILURE, + Error: err.Error(), + }, nil + } + // perform the re-exec after a 1 second delay + // this ensures that the upgrade response over GRPC is returned + go func() { + <-time.After(time.Second) + s.rex.ReExec() + }() return &proto.UpgradeResponse{ - Status: proto.ActionStatus_FAILURE, - Version: "", - Error: "not implemented", + Status: proto.ActionStatus_SUCCESS, + Version: request.Version, }, nil } + +type upgradeRequest struct { + *proto.UpgradeRequest +} + +func (r *upgradeRequest) Version() string { + return r.GetVersion() +} + +func (r *upgradeRequest) SourceURI() string { + return r.GetSourceURI() +} + +func (r *upgradeRequest) FleetAction() *fleetapi.ActionUpgrade { + // upgrade request not from Fleet + return nil +} diff --git a/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go b/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go index 119809338d6..6c656839820 100644 --- a/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go +++ b/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go @@ -52,7 +52,7 @@ func TestCmdBinaryOnlyYAML(t *testing.T) { } func TestCmdDaemon(t *testing.T) { - srv := server.New(newErrorLogger(t), nil) + srv := server.New(newErrorLogger(t), nil, nil) require.NoError(t, srv.Start()) defer srv.Stop() @@ -67,7 +67,7 @@ func TestCmdDaemon(t *testing.T) { } func TestCmdDaemonYAML(t *testing.T) { - srv := server.New(newErrorLogger(t), nil) + srv := server.New(newErrorLogger(t), nil, nil) require.NoError(t, srv.Start()) defer srv.Stop() From 889854e5f0ca01519487948a466177b897d46a82 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 6 Oct 2020 09:38:30 +0200 Subject: [PATCH 136/216] Add missing changelog entry for cisco umbrella (#21550) --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 279eda229a7..779272dc219 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -605,6 +605,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add related.hosts ecs field to all modules {pull}21160[21160] - Keep cursor state between httpjson input restarts {pull}20751[20751] - Convert aws s3 to v2 input {pull}20005[20005] +- New Cisco Umbrella dataset {pull}21504[21504] *Heartbeat* From 76905a2e2f3bbd966fa5cffa1fe7ce7da1dd7b44 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 6 Oct 2020 10:41:47 +0200 Subject: [PATCH 137/216] Add a persistent cache for cloudfoundry metadata based on badger (#20775) Cache on disk is used by add_cloudfoundry_metadata. Cache is written into the beats data directory. Objects in cache are serialized using CBOR encoding. Badger DB is added as dependency. --- CHANGELOG.next.asciidoc | 1 + NOTICE.txt | 6521 +++++++++++------ go.mod | 6 +- go.sum | 66 +- libbeat/tests/system/test_cmd_completion.py | 2 +- x-pack/libbeat/common/cloudfoundry/cache.go | 109 +- .../cloudfoundry/cache_integration_test.go | 11 +- .../libbeat/common/cloudfoundry/cache_test.go | 27 +- x-pack/libbeat/common/cloudfoundry/hub.go | 75 +- .../libbeat/common/cloudfoundry/main_test.go | 29 + x-pack/libbeat/persistentcache/encoding.go | 55 + .../persistentcache/persistentcache.go | 112 + .../persistentcache/persistentcache_test.go | 436 ++ x-pack/libbeat/persistentcache/store.go | 141 + x-pack/libbeat/persistentcache/store_test.go | 43 + .../add_cloudfoundry_metadata.go | 30 +- .../add_cloudfoundry_metadata_test.go | 46 +- 17 files changed, 5487 insertions(+), 2223 deletions(-) create mode 100644 x-pack/libbeat/common/cloudfoundry/main_test.go create mode 100644 x-pack/libbeat/persistentcache/encoding.go create mode 100644 x-pack/libbeat/persistentcache/persistentcache.go create mode 100644 x-pack/libbeat/persistentcache/persistentcache_test.go create mode 100644 x-pack/libbeat/persistentcache/store.go create mode 100644 x-pack/libbeat/persistentcache/store_test.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 779272dc219..5676634d637 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -448,6 +448,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Added experimental dataset `juniper/netscreen`. {pull}20820[20820] - Added experimental dataset `sophos/utm`. {pull}20820[20820] - Add Cloud Foundry tags in related events. {pull}21177[21177] +- Cloud Foundry metadata is cached to disk. {pull}20775[20775] - Add option to select the type of index template to load: legacy, component, index. {pull}21212[21212] *Auditbeat* diff --git a/NOTICE.txt b/NOTICE.txt index 527c1304379..0017abeba1a 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -4472,6 +4472,192 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------------------- +Dependency : github.com/dgraph-io/badger/v2 +Version: v2.2007.2 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/dgraph-io/badger/v2@v2.2007.2/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + -------------------------------------------------------------------------------- Dependency : github.com/digitalocean/go-libvirt Version: v0.0.0-20180301200012-6075ea3c39a1 @@ -5542,11 +5728,11 @@ OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR -------------------------------------------------------------------------------- Dependency : github.com/dustin/go-humanize -Version: v0.0.0-20171111073723-bb3d318650d4 +Version: v1.0.0 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/dustin/go-humanize@v0.0.0-20171111073723-bb3d318650d4/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/dustin/go-humanize@v1.0.0/LICENSE: Copyright (c) 2005-2008 Dustin Sallings @@ -13066,11 +13252,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- Dependency : github.com/spf13/cobra -Version: v0.0.3 +Version: v0.0.5 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/spf13/cobra@v0.0.3/LICENSE.txt: +Contents of probable licence file $GOMODCACHE/github.com/spf13/cobra@v0.0.5/LICENSE.txt: Apache License Version 2.0, January 2004 @@ -13393,224 +13579,256 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/urso/sderr -Version: v0.0.0-20200210124243-c2a16f3d43ec -Licence type (autodetected): Apache-2.0 +Dependency : github.com/ugorji/go/codec +Version: v1.1.8 +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/urso/sderr@v0.0.0-20200210124243-c2a16f3d43ec/LICENSE: - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. +Contents of probable licence file $GOMODCACHE/github.com/ugorji/go/codec@v1.1.8/LICENSE: - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. +The MIT License (MIT) - Copyright [yyyy] [name of copyright owner] +Copyright (c) 2012-2015 Ugorji Nwoke. +All rights reserved. - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: - http://www.apache.org/licenses/LICENSE-2.0 +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/vmware/govmomi -Version: v0.0.0-20170802214208-2cad15190b41 +Dependency : github.com/urso/sderr +Version: v0.0.0-20200210124243-c2a16f3d43ec Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/vmware/govmomi@v0.0.0-20170802214208-2cad15190b41/LICENSE.txt: - +Contents of probable licence file $GOMODCACHE/github.com/urso/sderr@v0.0.0-20200210124243-c2a16f3d43ec/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/vmware/govmomi +Version: v0.0.0-20170802214208-2cad15190b41 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/vmware/govmomi@v0.0.0-20170802214208-2cad15190b41/LICENSE.txt: + Apache License Version 2.0, January 2004 @@ -19482,6 +19700,43 @@ Contents of probable licence file $GOMODCACHE/github.com/!burnt!sushi/xgb@v0.0.0 // such litigation is filed. +-------------------------------------------------------------------------------- +Dependency : github.com/DataDog/zstd +Version: v1.4.1 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/!data!dog/zstd@v1.4.1/LICENSE: + +Simplified BSD License + +Copyright (c) 2016, Datadog +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + * Neither the name of the copyright holder nor the names of its contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------------------------------------------------------------------- Dependency : github.com/Masterminds/semver Version: v1.4.2 @@ -19565,6 +19820,203 @@ See the License for the specific language governing permissions and limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/OneOfOne/xxhash +Version: v1.2.2 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/!one!of!one/xxhash@v1.2.2/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + -------------------------------------------------------------------------------- Dependency : github.com/PuerkitoBio/purell Version: v1.0.0 @@ -19802,6 +20254,377 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Dependency : github.com/armon/consul-api +Version: v0.0.0-20180202201655-eb2c6b5be1b6 +Licence type (autodetected): MPL-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/armon/consul-api@v0.0.0-20180202201655-eb2c6b5be1b6/LICENSE: + +Mozilla Public License, version 2.0 + +1. Definitions + +1.1. "Contributor" + + means each individual or legal entity that creates, contributes to the + creation of, or owns Covered Software. + +1.2. "Contributor Version" + + means the combination of the Contributions of others (if any) used by a + Contributor and that particular Contributor's Contribution. + +1.3. "Contribution" + + means Covered Software of a particular Contributor. + +1.4. "Covered Software" + + means Source Code Form to which the initial Contributor has attached the + notice in Exhibit A, the Executable Form of such Source Code Form, and + Modifications of such Source Code Form, in each case including portions + thereof. + +1.5. "Incompatible With Secondary Licenses" + means + + a. that the initial Contributor has attached the notice described in + Exhibit B to the Covered Software; or + + b. that the Covered Software was made available under the terms of + version 1.1 or earlier of the License, but not also under the terms of + a Secondary License. + +1.6. "Executable Form" + + means any form of the work other than Source Code Form. + +1.7. "Larger Work" + + means a work that combines Covered Software with other material, in a + separate file or files, that is not Covered Software. + +1.8. "License" + + means this document. + +1.9. "Licensable" + + means having the right to grant, to the maximum extent possible, whether + at the time of the initial grant or subsequently, any and all of the + rights conveyed by this License. + +1.10. "Modifications" + + means any of the following: + + a. any file in Source Code Form that results from an addition to, + deletion from, or modification of the contents of Covered Software; or + + b. any new file in Source Code Form that contains any Covered Software. + +1.11. "Patent Claims" of a Contributor + + means any patent claim(s), including without limitation, method, + process, and apparatus claims, in any patent Licensable by such + Contributor that would be infringed, but for the grant of the License, + by the making, using, selling, offering for sale, having made, import, + or transfer of either its Contributions or its Contributor Version. + +1.12. "Secondary License" + + means either the GNU General Public License, Version 2.0, the GNU Lesser + General Public License, Version 2.1, the GNU Affero General Public + License, Version 3.0, or any later versions of those licenses. + +1.13. "Source Code Form" + + means the form of the work preferred for making modifications. + +1.14. "You" (or "Your") + + means an individual or a legal entity exercising rights under this + License. For legal entities, "You" includes any entity that controls, is + controlled by, or is under common control with You. For purposes of this + definition, "control" means (a) the power, direct or indirect, to cause + the direction or management of such entity, whether by contract or + otherwise, or (b) ownership of more than fifty percent (50%) of the + outstanding shares or beneficial ownership of such entity. + + +2. License Grants and Conditions + +2.1. Grants + + Each Contributor hereby grants You a world-wide, royalty-free, + non-exclusive license: + + a. under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or + as part of a Larger Work; and + + b. under Patent Claims of such Contributor to make, use, sell, offer for + sale, have made, import, and otherwise transfer either its + Contributions or its Contributor Version. + +2.2. Effective Date + + The licenses granted in Section 2.1 with respect to any Contribution + become effective for each Contribution on the date the Contributor first + distributes such Contribution. + +2.3. Limitations on Grant Scope + + The licenses granted in this Section 2 are the only rights granted under + this License. No additional rights or licenses will be implied from the + distribution or licensing of Covered Software under this License. + Notwithstanding Section 2.1(b) above, no patent license is granted by a + Contributor: + + a. for any code that a Contributor has removed from Covered Software; or + + b. for infringements caused by: (i) Your and any other third party's + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + + c. under Patent Claims infringed by Covered Software in the absence of + its Contributions. + + This License does not grant any rights in the trademarks, service marks, + or logos of any Contributor (except as may be necessary to comply with + the notice requirements in Section 3.4). + +2.4. Subsequent Licenses + + No Contributor makes additional grants as a result of Your choice to + distribute the Covered Software under a subsequent version of this + License (see Section 10.2) or under the terms of a Secondary License (if + permitted under the terms of Section 3.3). + +2.5. Representation + + Each Contributor represents that the Contributor believes its + Contributions are its original creation(s) or it has sufficient rights to + grant the rights to its Contributions conveyed by this License. + +2.6. Fair Use + + This License is not intended to limit any rights You have under + applicable copyright doctrines of fair use, fair dealing, or other + equivalents. + +2.7. Conditions + + Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in + Section 2.1. + + +3. Responsibilities + +3.1. Distribution of Source Form + + All distribution of Covered Software in Source Code Form, including any + Modifications that You create or to which You contribute, must be under + the terms of this License. You must inform recipients that the Source + Code Form of the Covered Software is governed by the terms of this + License, and how they can obtain a copy of this License. You may not + attempt to alter or restrict the recipients' rights in the Source Code + Form. + +3.2. Distribution of Executable Form + + If You distribute Covered Software in Executable Form then: + + a. such Covered Software must also be made available in Source Code Form, + as described in Section 3.1, and You must inform recipients of the + Executable Form how they can obtain a copy of such Source Code Form by + reasonable means in a timely manner, at a charge no more than the cost + of distribution to the recipient; and + + b. You may distribute such Executable Form under the terms of this + License, or sublicense it under different terms, provided that the + license for the Executable Form does not attempt to limit or alter the + recipients' rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + + You may create and distribute a Larger Work under terms of Your choice, + provided that You also comply with the requirements of this License for + the Covered Software. If the Larger Work is a combination of Covered + Software with a work governed by one or more Secondary Licenses, and the + Covered Software is not Incompatible With Secondary Licenses, this + License permits You to additionally distribute such Covered Software + under the terms of such Secondary License(s), so that the recipient of + the Larger Work may, at their option, further distribute the Covered + Software under the terms of either this License or such Secondary + License(s). + +3.4. Notices + + You may not remove or alter the substance of any license notices + (including copyright notices, patent notices, disclaimers of warranty, or + limitations of liability) contained within the Source Code Form of the + Covered Software, except that You may alter any license notices to the + extent required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + + You may choose to offer, and to charge a fee for, warranty, support, + indemnity or liability obligations to one or more recipients of Covered + Software. However, You may do so only on Your own behalf, and not on + behalf of any Contributor. You must make it absolutely clear that any + such warranty, support, indemnity, or liability obligation is offered by + You alone, and You hereby agree to indemnify every Contributor for any + liability incurred by such Contributor as a result of warranty, support, + indemnity or liability terms You offer. You may include additional + disclaimers of warranty and limitations of liability specific to any + jurisdiction. + +4. Inability to Comply Due to Statute or Regulation + + If it is impossible for You to comply with any of the terms of this License + with respect to some or all of the Covered Software due to statute, + judicial order, or regulation then You must: (a) comply with the terms of + this License to the maximum extent possible; and (b) describe the + limitations and the code they affect. Such description must be placed in a + text file included with all distributions of the Covered Software under + this License. Except to the extent prohibited by statute or regulation, + such description must be sufficiently detailed for a recipient of ordinary + skill to be able to understand it. + +5. Termination + +5.1. The rights granted under this License will terminate automatically if You + fail to comply with any of its terms. However, if You become compliant, + then the rights granted under this License from a particular Contributor + are reinstated (a) provisionally, unless and until such Contributor + explicitly and finally terminates Your grants, and (b) on an ongoing + basis, if such Contributor fails to notify You of the non-compliance by + some reasonable means prior to 60 days after You have come back into + compliance. Moreover, Your grants from a particular Contributor are + reinstated on an ongoing basis if such Contributor notifies You of the + non-compliance by some reasonable means, this is the first time You have + received notice of non-compliance with this License from such + Contributor, and You become compliant prior to 30 days after Your receipt + of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent + infringement claim (excluding declaratory judgment actions, + counter-claims, and cross-claims) alleging that a Contributor Version + directly or indirectly infringes any patent, then the rights granted to + You by any and all Contributors for the Covered Software under Section + 2.1 of this License shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user + license agreements (excluding distributors and resellers) which have been + validly granted by You or Your distributors under this License prior to + termination shall survive termination. + +6. Disclaimer of Warranty + + Covered Software is provided under this License on an "as is" basis, + without warranty of any kind, either expressed, implied, or statutory, + including, without limitation, warranties that the Covered Software is free + of defects, merchantable, fit for a particular purpose or non-infringing. + The entire risk as to the quality and performance of the Covered Software + is with You. Should any Covered Software prove defective in any respect, + You (not any Contributor) assume the cost of any necessary servicing, + repair, or correction. This disclaimer of warranty constitutes an essential + part of this License. No use of any Covered Software is authorized under + this License except under this disclaimer. + +7. Limitation of Liability + + Under no circumstances and under no legal theory, whether tort (including + negligence), contract, or otherwise, shall any Contributor, or anyone who + distributes Covered Software as permitted above, be liable to You for any + direct, indirect, special, incidental, or consequential damages of any + character including, without limitation, damages for lost profits, loss of + goodwill, work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses, even if such party shall have been + informed of the possibility of such damages. This limitation of liability + shall not apply to liability for death or personal injury resulting from + such party's negligence to the extent applicable law prohibits such + limitation. Some jurisdictions do not allow the exclusion or limitation of + incidental or consequential damages, so this exclusion and limitation may + not apply to You. + +8. Litigation + + Any litigation relating to this License may be brought only in the courts + of a jurisdiction where the defendant maintains its principal place of + business and such litigation shall be governed by laws of that + jurisdiction, without reference to its conflict-of-law provisions. Nothing + in this Section shall prevent a party's ability to bring cross-claims or + counter-claims. + +9. Miscellaneous + + This License represents the complete agreement concerning the subject + matter hereof. If any provision of this License is held to be + unenforceable, such provision shall be reformed only to the extent + necessary to make it enforceable. Any law or regulation which provides that + the language of a contract shall be construed against the drafter shall not + be used to construe this License against a Contributor. + + +10. Versions of the License + +10.1. New Versions + + Mozilla Foundation is the license steward. Except as provided in Section + 10.3, no one other than the license steward has the right to modify or + publish new versions of this License. Each version will be given a + distinguishing version number. + +10.2. Effect of New Versions + + You may distribute the Covered Software under the terms of the version + of the License under which You originally received the Covered Software, + or under the terms of any subsequent version published by the license + steward. + +10.3. Modified Versions + + If you create software not governed by this License, and you want to + create a new license for such software, you may create and use a + modified version of this License if you rename the license and remove + any references to the name of the license steward (except to note that + such modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary + Licenses If You choose to distribute Source Code Form that is + Incompatible With Secondary Licenses under the terms of this version of + the License, the notice described in Exhibit B of this License must be + attached. + +Exhibit A - Source Code Form License Notice + + This Source Code Form is subject to the + terms of the Mozilla Public License, v. + 2.0. If a copy of the MPL was not + distributed with this file, You can + obtain one at + http://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular file, +then You may include the notice in a location (such as a LICENSE file in a +relevant directory) where a recipient would be likely to look for such a +notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - "Incompatible With Secondary Licenses" Notice + + This Source Code Form is "Incompatible + With Secondary Licenses", as defined by + the Mozilla Public License, v. 2.0. + -------------------------------------------------------------------------------- Dependency : github.com/armon/go-radix Version: v1.0.0 @@ -20546,6 +21369,38 @@ Contents of probable licence file $GOMODCACHE/github.com/census-instrumentation/ limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/cespare/xxhash +Version: v1.1.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/cespare/xxhash@v1.1.0/LICENSE.txt: + +Copyright (c) 2016 Caleb Spare + +MIT License + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : github.com/chzyer/logex Version: v1.1.10 @@ -22348,378 +23203,13 @@ Contents of probable licence file $GOMODCACHE/github.com/containerd/typeurl@v0.0 -------------------------------------------------------------------------------- -Dependency : github.com/coreos/go-systemd -Version: v0.0.0-20190321100706-95778dfbb74e +Dependency : github.com/coreos/etcd +Version: v3.3.10+incompatible Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/coreos/go-systemd@v0.0.0-20190321100706-95778dfbb74e/LICENSE: - -Apache License -Version 2.0, January 2004 -http://www.apache.org/licenses/ - -TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - -1. Definitions. - -"License" shall mean the terms and conditions for use, reproduction, and -distribution as defined by Sections 1 through 9 of this document. - -"Licensor" shall mean the copyright owner or entity authorized by the copyright -owner that is granting the License. - -"Legal Entity" shall mean the union of the acting entity and all other entities -that control, are controlled by, or are under common control with that entity. -For the purposes of this definition, "control" means (i) the power, direct or -indirect, to cause the direction or management of such entity, whether by -contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the -outstanding shares, or (iii) beneficial ownership of such entity. - -"You" (or "Your") shall mean an individual or Legal Entity exercising -permissions granted by this License. - -"Source" form shall mean the preferred form for making modifications, including -but not limited to software source code, documentation source, and configuration -files. - -"Object" form shall mean any form resulting from mechanical transformation or -translation of a Source form, including but not limited to compiled object code, -generated documentation, and conversions to other media types. - -"Work" shall mean the work of authorship, whether in Source or Object form, made -available under the License, as indicated by a copyright notice that is included -in or attached to the work (an example is provided in the Appendix below). - -"Derivative Works" shall mean any work, whether in Source or Object form, that -is based on (or derived from) the Work and for which the editorial revisions, -annotations, elaborations, or other modifications represent, as a whole, an -original work of authorship. For the purposes of this License, Derivative Works -shall not include works that remain separable from, or merely link (or bind by -name) to the interfaces of, the Work and Derivative Works thereof. - -"Contribution" shall mean any work of authorship, including the original version -of the Work and any modifications or additions to that Work or Derivative Works -thereof, that is intentionally submitted to Licensor for inclusion in the Work -by the copyright owner or by an individual or Legal Entity authorized to submit -on behalf of the copyright owner. For the purposes of this definition, -"submitted" means any form of electronic, verbal, or written communication sent -to the Licensor or its representatives, including but not limited to -communication on electronic mailing lists, source code control systems, and -issue tracking systems that are managed by, or on behalf of, the Licensor for -the purpose of discussing and improving the Work, but excluding communication -that is conspicuously marked or otherwise designated in writing by the copyright -owner as "Not a Contribution." - -"Contributor" shall mean Licensor and any individual or Legal Entity on behalf -of whom a Contribution has been received by Licensor and subsequently -incorporated within the Work. - -2. Grant of Copyright License. - -Subject to the terms and conditions of this License, each Contributor hereby -grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, -irrevocable copyright license to reproduce, prepare Derivative Works of, -publicly display, publicly perform, sublicense, and distribute the Work and such -Derivative Works in Source or Object form. - -3. Grant of Patent License. - -Subject to the terms and conditions of this License, each Contributor hereby -grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, -irrevocable (except as stated in this section) patent license to make, have -made, use, offer to sell, sell, import, and otherwise transfer the Work, where -such license applies only to those patent claims licensable by such Contributor -that are necessarily infringed by their Contribution(s) alone or by combination -of their Contribution(s) with the Work to which such Contribution(s) was -submitted. If You institute patent litigation against any entity (including a -cross-claim or counterclaim in a lawsuit) alleging that the Work or a -Contribution incorporated within the Work constitutes direct or contributory -patent infringement, then any patent licenses granted to You under this License -for that Work shall terminate as of the date such litigation is filed. - -4. Redistribution. - -You may reproduce and distribute copies of the Work or Derivative Works thereof -in any medium, with or without modifications, and in Source or Object form, -provided that You meet the following conditions: - -You must give any other recipients of the Work or Derivative Works a copy of -this License; and -You must cause any modified files to carry prominent notices stating that You -changed the files; and -You must retain, in the Source form of any Derivative Works that You distribute, -all copyright, patent, trademark, and attribution notices from the Source form -of the Work, excluding those notices that do not pertain to any part of the -Derivative Works; and -If the Work includes a "NOTICE" text file as part of its distribution, then any -Derivative Works that You distribute must include a readable copy of the -attribution notices contained within such NOTICE file, excluding those notices -that do not pertain to any part of the Derivative Works, in at least one of the -following places: within a NOTICE text file distributed as part of the -Derivative Works; within the Source form or documentation, if provided along -with the Derivative Works; or, within a display generated by the Derivative -Works, if and wherever such third-party notices normally appear. The contents of -the NOTICE file are for informational purposes only and do not modify the -License. You may add Your own attribution notices within Derivative Works that -You distribute, alongside or as an addendum to the NOTICE text from the Work, -provided that such additional attribution notices cannot be construed as -modifying the License. -You may add Your own copyright statement to Your modifications and may provide -additional or different license terms and conditions for use, reproduction, or -distribution of Your modifications, or for any such Derivative Works as a whole, -provided Your use, reproduction, and distribution of the Work otherwise complies -with the conditions stated in this License. - -5. Submission of Contributions. - -Unless You explicitly state otherwise, any Contribution intentionally submitted -for inclusion in the Work by You to the Licensor shall be under the terms and -conditions of this License, without any additional terms or conditions. -Notwithstanding the above, nothing herein shall supersede or modify the terms of -any separate license agreement you may have executed with Licensor regarding -such Contributions. - -6. Trademarks. - -This License does not grant permission to use the trade names, trademarks, -service marks, or product names of the Licensor, except as required for -reasonable and customary use in describing the origin of the Work and -reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. - -Unless required by applicable law or agreed to in writing, Licensor provides the -Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, -including, without limitation, any warranties or conditions of TITLE, -NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are -solely responsible for determining the appropriateness of using or -redistributing the Work and assume any risks associated with Your exercise of -permissions under this License. - -8. Limitation of Liability. - -In no event and under no legal theory, whether in tort (including negligence), -contract, or otherwise, unless required by applicable law (such as deliberate -and grossly negligent acts) or agreed to in writing, shall any Contributor be -liable to You for damages, including any direct, indirect, special, incidental, -or consequential damages of any character arising as a result of this License or -out of the use or inability to use the Work (including but not limited to -damages for loss of goodwill, work stoppage, computer failure or malfunction, or -any and all other commercial damages or losses), even if such Contributor has -been advised of the possibility of such damages. - -9. Accepting Warranty or Additional Liability. - -While redistributing the Work or Derivative Works thereof, You may choose to -offer, and charge a fee for, acceptance of support, warranty, indemnity, or -other liability obligations and/or rights consistent with this License. However, -in accepting such obligations, You may act only on Your own behalf and on Your -sole responsibility, not on behalf of any other Contributor, and only if You -agree to indemnify, defend, and hold each Contributor harmless for any liability -incurred by, or claims asserted against, such Contributor by reason of your -accepting any such warranty or additional liability. - -END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work - -To apply the Apache License to your work, attach the following boilerplate -notice, with the fields enclosed by brackets "[]" replaced with your own -identifying information. (Don't include the brackets!) The text should be -enclosed in the appropriate comment syntax for the file format. We also -recommend that a file or class name and description of purpose be included on -the same "printed page" as the copyright notice for easier identification within -third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - --------------------------------------------------------------------------------- -Dependency : github.com/cucumber/godog -Version: v0.8.1 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/cucumber/godog@v0.8.1/LICENSE: - -The MIT License (MIT) - -Copyright (c) SmartBear - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/cyphar/filepath-securejoin -Version: v0.2.2 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/cyphar/filepath-securejoin@v0.2.2/LICENSE: - -Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved. -Copyright (C) 2017 SUSE LLC. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - +Contents of probable licence file $GOMODCACHE/github.com/coreos/etcd@v3.3.10+incompatible/LICENSE: --------------------------------------------------------------------------------- -Dependency : github.com/davecgh/go-spew -Version: v1.1.1 -Licence type (autodetected): ISC --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/davecgh/go-spew@v1.1.1/LICENSE: - -ISC License - -Copyright (c) 2012-2016 Dave Collins - -Permission to use, copy, modify, and/or distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/davecgh/go-xdr -Version: v0.0.0-20161123171359-e6a2ba005892 -Licence type (autodetected): ISC --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/davecgh/go-xdr@v0.0.0-20161123171359-e6a2ba005892/LICENSE: - -Copyright (c) 2012-2014 Dave Collins - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - --------------------------------------------------------------------------------- -Dependency : github.com/devigned/tab -Version: v0.1.2-0.20190607222403-0c15cf42f9a2 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/devigned/tab@v0.1.2-0.20190607222403-0c15cf42f9a2/LICENSE: - -MIT License - -Copyright (c) 2019 David Justice - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/dgrijalva/jwt-go -Version: v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/dgrijalva/jwt-go@v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible/LICENSE: - -Copyright (c) 2012 Dave Grijalva - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - - --------------------------------------------------------------------------------- -Dependency : github.com/dimchansky/utfbom -Version: v1.1.0 -Licence type (autodetected): Apache-2.0 --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/dimchansky/utfbom@v1.1.0/LICENSE: Apache License Version 2.0, January 2004 @@ -22901,7 +23391,7 @@ Contents of probable licence file $GOMODCACHE/github.com/dimchansky/utfbom@v1.1. APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" + boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -22909,7 +23399,7 @@ Contents of probable licence file $GOMODCACHE/github.com/dimchansky/utfbom@v1.1. same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright {yyyy} {name of copyright owner} + Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -22925,45 +23415,15 @@ Contents of probable licence file $GOMODCACHE/github.com/dimchansky/utfbom@v1.1. -------------------------------------------------------------------------------- -Dependency : github.com/dlclark/regexp2 -Version: v1.1.7-0.20171009020623-7632a260cbaf -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/dlclark/regexp2@v1.1.7-0.20171009020623-7632a260cbaf/LICENSE: - -The MIT License (MIT) - -Copyright (c) Doug Clark - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/docker/distribution -Version: v2.7.1+incompatible +Dependency : github.com/coreos/go-etcd +Version: v2.0.0+incompatible Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/docker/distribution@v2.7.1+incompatible/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/coreos/go-etcd@v2.0.0+incompatible/LICENSE: -Apache License + + Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ @@ -23143,7 +23603,7 @@ Apache License APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" + boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -23151,7 +23611,7 @@ Apache License same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright {yyyy} {name of copyright owner} + Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -23166,19 +23626,18 @@ Apache License limitations under the License. - -------------------------------------------------------------------------------- -Dependency : github.com/docker/go-metrics -Version: v0.0.1 +Dependency : github.com/coreos/go-semver +Version: v0.2.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/docker/go-metrics@v0.0.1/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/coreos/go-semver@v0.2.0/LICENSE: Apache License Version 2.0, January 2004 - https://www.apache.org/licenses/ + http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION @@ -23353,13 +23812,24 @@ Contents of probable licence file $GOMODCACHE/github.com/docker/go-metrics@v0.0. END OF TERMS AND CONDITIONS - Copyright 2013-2016 Docker, Inc. + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at - https://www.apache.org/licenses/LICENSE-2.0 + http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, @@ -23369,198 +23839,198 @@ Contents of probable licence file $GOMODCACHE/github.com/docker/go-metrics@v0.0. -------------------------------------------------------------------------------- -Dependency : github.com/docker/spdystream -Version: v0.0.0-20160310174837-449fdfce4d96 +Dependency : github.com/coreos/go-systemd +Version: v0.0.0-20190321100706-95778dfbb74e Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/docker/spdystream@v0.0.0-20160310174837-449fdfce4d96/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/coreos/go-systemd@v0.0.0-20190321100706-95778dfbb74e/LICENSE: +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION +1. Definitions. - 1. Definitions. +"License" shall mean the terms and conditions for use, reproduction, and +distribution as defined by Sections 1 through 9 of this document. - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. +"Licensor" shall mean the copyright owner or entity authorized by the copyright +owner that is granting the License. - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. +"Legal Entity" shall mean the union of the acting entity and all other entities +that control, are controlled by, or are under common control with that entity. +For the purposes of this definition, "control" means (i) the power, direct or +indirect, to cause the direction or management of such entity, whether by +contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the +outstanding shares, or (iii) beneficial ownership of such entity. - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. +"You" (or "Your") shall mean an individual or Legal Entity exercising +permissions granted by this License. - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. +"Source" form shall mean the preferred form for making modifications, including +but not limited to software source code, documentation source, and configuration +files. - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. +"Object" form shall mean any form resulting from mechanical transformation or +translation of a Source form, including but not limited to compiled object code, +generated documentation, and conversions to other media types. - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. +"Work" shall mean the work of authorship, whether in Source or Object form, made +available under the License, as indicated by a copyright notice that is included +in or attached to the work (an example is provided in the Appendix below). - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). +"Derivative Works" shall mean any work, whether in Source or Object form, that +is based on (or derived from) the Work and for which the editorial revisions, +annotations, elaborations, or other modifications represent, as a whole, an +original work of authorship. For the purposes of this License, Derivative Works +shall not include works that remain separable from, or merely link (or bind by +name) to the interfaces of, the Work and Derivative Works thereof. - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. +"Contribution" shall mean any work of authorship, including the original version +of the Work and any modifications or additions to that Work or Derivative Works +thereof, that is intentionally submitted to Licensor for inclusion in the Work +by the copyright owner or by an individual or Legal Entity authorized to submit +on behalf of the copyright owner. For the purposes of this definition, +"submitted" means any form of electronic, verbal, or written communication sent +to the Licensor or its representatives, including but not limited to +communication on electronic mailing lists, source code control systems, and +issue tracking systems that are managed by, or on behalf of, the Licensor for +the purpose of discussing and improving the Work, but excluding communication +that is conspicuously marked or otherwise designated in writing by the copyright +owner as "Not a Contribution." - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." +"Contributor" shall mean Licensor and any individual or Legal Entity on behalf +of whom a Contribution has been received by Licensor and subsequently +incorporated within the Work. - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. +2. Grant of Copyright License. - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. +Subject to the terms and conditions of this License, each Contributor hereby +grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, +irrevocable copyright license to reproduce, prepare Derivative Works of, +publicly display, publicly perform, sublicense, and distribute the Work and such +Derivative Works in Source or Object form. - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. +3. Grant of Patent License. - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: +Subject to the terms and conditions of this License, each Contributor hereby +grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, +irrevocable (except as stated in this section) patent license to make, have +made, use, offer to sell, sell, import, and otherwise transfer the Work, where +such license applies only to those patent claims licensable by such Contributor +that are necessarily infringed by their Contribution(s) alone or by combination +of their Contribution(s) with the Work to which such Contribution(s) was +submitted. If You institute patent litigation against any entity (including a +cross-claim or counterclaim in a lawsuit) alleging that the Work or a +Contribution incorporated within the Work constitutes direct or contributory +patent infringement, then any patent licenses granted to You under this License +for that Work shall terminate as of the date such litigation is filed. - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and +4. Redistribution. - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and +You may reproduce and distribute copies of the Work or Derivative Works thereof +in any medium, with or without modifications, and in Source or Object form, +provided that You meet the following conditions: - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and +You must give any other recipients of the Work or Derivative Works a copy of +this License; and +You must cause any modified files to carry prominent notices stating that You +changed the files; and +You must retain, in the Source form of any Derivative Works that You distribute, +all copyright, patent, trademark, and attribution notices from the Source form +of the Work, excluding those notices that do not pertain to any part of the +Derivative Works; and +If the Work includes a "NOTICE" text file as part of its distribution, then any +Derivative Works that You distribute must include a readable copy of the +attribution notices contained within such NOTICE file, excluding those notices +that do not pertain to any part of the Derivative Works, in at least one of the +following places: within a NOTICE text file distributed as part of the +Derivative Works; within the Source form or documentation, if provided along +with the Derivative Works; or, within a display generated by the Derivative +Works, if and wherever such third-party notices normally appear. The contents of +the NOTICE file are for informational purposes only and do not modify the +License. You may add Your own attribution notices within Derivative Works that +You distribute, alongside or as an addendum to the NOTICE text from the Work, +provided that such additional attribution notices cannot be construed as +modifying the License. +You may add Your own copyright statement to Your modifications and may provide +additional or different license terms and conditions for use, reproduction, or +distribution of Your modifications, or for any such Derivative Works as a whole, +provided Your use, reproduction, and distribution of the Work otherwise complies +with the conditions stated in this License. - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. +5. Submission of Contributions. - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. +Unless You explicitly state otherwise, any Contribution intentionally submitted +for inclusion in the Work by You to the Licensor shall be under the terms and +conditions of this License, without any additional terms or conditions. +Notwithstanding the above, nothing herein shall supersede or modify the terms of +any separate license agreement you may have executed with Licensor regarding +such Contributions. - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. +6. Trademarks. - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. +This License does not grant permission to use the trade names, trademarks, +service marks, or product names of the Licensor, except as required for +reasonable and customary use in describing the origin of the Work and +reproducing the content of the NOTICE file. - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. +7. Disclaimer of Warranty. - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. +Unless required by applicable law or agreed to in writing, Licensor provides the +Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, +including, without limitation, any warranties or conditions of TITLE, +NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are +solely responsible for determining the appropriateness of using or +redistributing the Work and assume any risks associated with Your exercise of +permissions under this License. - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. +8. Limitation of Liability. - END OF TERMS AND CONDITIONS +In no event and under no legal theory, whether in tort (including negligence), +contract, or otherwise, unless required by applicable law (such as deliberate +and grossly negligent acts) or agreed to in writing, shall any Contributor be +liable to You for damages, including any direct, indirect, special, incidental, +or consequential damages of any character arising as a result of this License or +out of the use or inability to use the Work (including but not limited to +damages for loss of goodwill, work stoppage, computer failure or malfunction, or +any and all other commercial damages or losses), even if such Contributor has +been advised of the possibility of such damages. - Copyright 2014-2015 Docker, Inc. +9. Accepting Warranty or Additional Liability. + +While redistributing the Work or Derivative Works thereof, You may choose to +offer, and charge a fee for, acceptance of support, warranty, indemnity, or +other liability obligations and/or rights consistent with this License. However, +in accepting such obligations, You may act only on Your own behalf and on Your +sole responsibility, not on behalf of any other Contributor, and only if You +agree to indemnify, defend, and hold each Contributor harmless for any liability +incurred by, or claims asserted against, such Contributor by reason of your +accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work + +To apply the Apache License to your work, attach the following boilerplate +notice, with the fields enclosed by brackets "[]" replaced with your own +identifying information. (Don't include the brackets!) The text should be +enclosed in the appropriate comment syntax for the file format. We also +recommend that a file or class name and description of purpose be included on +the same "printed page" as the copyright notice for easier identification within +third-party archives. + + Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at - http://www.apache.org/licenses/LICENSE-2.0 + http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, @@ -23570,16 +24040,16 @@ Contents of probable licence file $GOMODCACHE/github.com/docker/spdystream@v0.0. -------------------------------------------------------------------------------- -Dependency : github.com/eapache/go-resiliency -Version: v1.2.0 +Dependency : github.com/cpuguy83/go-md2man +Version: v1.0.10 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/eapache/go-resiliency@v1.2.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/cpuguy83/go-md2man@v1.0.10/LICENSE.md: The MIT License (MIT) -Copyright (c) 2014 Evan Huus +Copyright (c) 2014 Brian Goff Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -23600,18 +24070,17 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -------------------------------------------------------------------------------- -Dependency : github.com/eapache/go-xerial-snappy -Version: v0.0.0-20180814174437-776d5712da21 +Dependency : github.com/cucumber/godog +Version: v0.8.1 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/eapache/go-xerial-snappy@v0.0.0-20180814174437-776d5712da21/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/cucumber/godog@v0.8.1/LICENSE: The MIT License (MIT) -Copyright (c) 2016 Evan Huus +Copyright (c) SmartBear Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -23633,16 +24102,101 @@ SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/eapache/queue -Version: v1.1.0 +Dependency : github.com/cyphar/filepath-securejoin +Version: v0.2.2 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/cyphar/filepath-securejoin@v0.2.2/LICENSE: + +Copyright (C) 2014-2015 Docker Inc & Go Authors. All rights reserved. +Copyright (C) 2017 SUSE LLC. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/davecgh/go-spew +Version: v1.1.1 +Licence type (autodetected): ISC +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/davecgh/go-spew@v1.1.1/LICENSE: + +ISC License + +Copyright (c) 2012-2016 Dave Collins + +Permission to use, copy, modify, and/or distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/davecgh/go-xdr +Version: v0.0.0-20161123171359-e6a2ba005892 +Licence type (autodetected): ISC +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/davecgh/go-xdr@v0.0.0-20161123171359-e6a2ba005892/LICENSE: + +Copyright (c) 2012-2014 Dave Collins + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +-------------------------------------------------------------------------------- +Dependency : github.com/devigned/tab +Version: v0.1.2-0.20190607222403-0c15cf42f9a2 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/eapache/queue@v1.1.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/devigned/tab@v0.1.2-0.20190607222403-0c15cf42f9a2/LICENSE: -The MIT License (MIT) +MIT License -Copyright (c) 2014 Evan Huus +Copyright (c) 2019 David Justice Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -23662,14 +24216,14 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------------------- -Dependency : github.com/elastic/go-windows -Version: v1.0.1 +Dependency : github.com/dgraph-io/ristretto +Version: v0.0.3-0.20200630154024-f66de99634de Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/elastic/go-windows@v1.0.1/LICENSE.txt: - +Contents of probable licence file $GOMODCACHE/github.com/dgraph-io/ristretto@v0.0.3-0.20200630154024-f66de99634de/LICENSE: Apache License Version 2.0, January 2004 @@ -23848,107 +24402,65 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/go-windows@v1.0 END OF TERMS AND CONDITIONS - APPENDIX: How to apply the Apache License to your work. - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. +-------------------------------------------------------------------------------- +Dependency : github.com/dgrijalva/jwt-go +Version: v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- - Copyright [yyyy] [name of copyright owner] +Contents of probable licence file $GOMODCACHE/github.com/dgrijalva/jwt-go@v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible/LICENSE: - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at +Copyright (c) 2012 Dave Grijalva - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - --------------------------------------------------------------------------------- -Dependency : github.com/elazarl/goproxy -Version: v0.0.0-20180725130230-947c36da3153 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/elazarl/goproxy@v0.0.0-20180725130230-947c36da3153/LICENSE: - -Copyright (c) 2012 Elazar Leibovich. All rights reserved. +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Elazar Leibovich. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/emicklei/go-restful -Version: v0.0.0-20170410110728-ff4f55a20633 +Dependency : github.com/dgryski/go-farm +Version: v0.0.0-20190423205320-6a90982ecee2 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/emicklei/go-restful@v0.0.0-20170410110728-ff4f55a20633/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/dgryski/go-farm@v0.0.0-20190423205320-6a90982ecee2/LICENSE: -Copyright (c) 2012,2013 Ernest Micklei +As this is a highly derivative work, I have placed it under the same license as the original implementation: -MIT License +Copyright (c) 2014-2017 Damian Gryski +Copyright (c) 2016-2017 Nicola Asuni - Tecnick.com -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/envoyproxy/go-control-plane -Version: v0.9.4 +Dependency : github.com/dimchansky/utfbom +Version: v1.1.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/go-control-plane@v0.9.4/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/dimchansky/utfbom@v1.1.0/LICENSE: Apache License Version 2.0, January 2004 @@ -24154,15 +24666,45 @@ Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/go-control-p -------------------------------------------------------------------------------- -Dependency : github.com/envoyproxy/protoc-gen-validate -Version: v0.1.0 -Licence type (autodetected): Apache-2.0 +Dependency : github.com/dlclark/regexp2 +Version: v1.1.7-0.20171009020623-7632a260cbaf +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/protoc-gen-validate@v0.1.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/dlclark/regexp2@v1.1.7-0.20171009020623-7632a260cbaf/LICENSE: + +The MIT License (MIT) +Copyright (c) Doug Clark - Apache License +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/docker/distribution +Version: v2.7.1+incompatible +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/docker/distribution@v2.7.1+incompatible/LICENSE: + +Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ @@ -24342,7 +24884,7 @@ Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/protoc-gen-v APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" + boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -24350,7 +24892,7 @@ Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/protoc-gen-v same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright {yyyy} {name of copyright owner} Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -24365,281 +24907,19 @@ Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/protoc-gen-v limitations under the License. --------------------------------------------------------------------------------- -Dependency : github.com/evanphx/json-patch -Version: v4.2.0+incompatible -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/evanphx/json-patch@v4.2.0+incompatible/LICENSE: - -Copyright (c) 2014, Evan Phoenix -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - -* Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. -* Redistributions in binary form must reproduce the above copyright notice - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. -* Neither the name of the Evan Phoenix nor the names of its contributors - may be used to endorse or promote products derived from this software - without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/fortytw2/leaktest -Version: v1.3.0 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/fortytw2/leaktest@v1.3.0/LICENSE: - -Copyright (c) 2012 The Go Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/frankban/quicktest -Version: v1.7.2 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/frankban/quicktest@v1.7.2/LICENSE: - -MIT License - -Copyright (c) 2017 Canonical Ltd. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/ghodss/yaml -Version: v1.0.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/ghodss/yaml@v1.0.0/LICENSE: - -The MIT License (MIT) - -Copyright (c) 2014 Sam Ghods - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - -Copyright (c) 2012 The Go Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/go-gl/glfw/v3.3/glfw -Version: v0.0.0-20191125211704-12ad95a8df72 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/go-gl/glfw/v3.3/glfw@v0.0.0-20191125211704-12ad95a8df72/LICENSE: - -Copyright (c) 2012 The glfw3-go Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/go-kit/kit -Version: v0.9.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/go-kit/kit@v0.9.0/LICENSE: - -The MIT License (MIT) - -Copyright (c) 2015 Peter Bourgon - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - - --------------------------------------------------------------------------------- -Dependency : github.com/go-logfmt/logfmt -Version: v0.4.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/go-logfmt/logfmt@v0.4.0/LICENSE: - -The MIT License (MIT) - -Copyright (c) 2015 go-logfmt - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - -------------------------------------------------------------------------------- -Dependency : github.com/go-logr/logr -Version: v0.1.0 +Dependency : github.com/docker/go-metrics +Version: v0.0.1 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-logr/logr@v0.1.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/docker/go-metrics@v0.0.1/LICENSE: + Apache License Version 2.0, January 2004 - http://www.apache.org/licenses/ + https://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION @@ -24814,24 +25094,13 @@ Contents of probable licence file $GOMODCACHE/github.com/go-logr/logr@v0.1.0/LIC END OF TERMS AND CONDITIONS - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright {yyyy} {name of copyright owner} + Copyright 2013-2016 Docker, Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at - http://www.apache.org/licenses/LICENSE-2.0 + https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, @@ -24841,73 +25110,12 @@ Contents of probable licence file $GOMODCACHE/github.com/go-logr/logr@v0.1.0/LIC -------------------------------------------------------------------------------- -Dependency : github.com/go-martini/martini -Version: v0.0.0-20170121215854-22fa46961aab -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab/LICENSE: - -The MIT License (MIT) - -Copyright (c) 2015 Jeremy Saenz - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/go-ole/go-ole -Version: v1.2.5-0.20190920104607-14974a1cf647 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/go-ole/go-ole@v1.2.5-0.20190920104607-14974a1cf647/LICENSE: - -The MIT License (MIT) - -Copyright © 2013-2017 Yasuhiro Matsumoto, - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the “Software”), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies -of the Software, and to permit persons to whom the Software is furnished to do -so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/go-openapi/jsonpointer -Version: v0.0.0-20160704185906-46af16f9f7b1 +Dependency : github.com/docker/spdystream +Version: v0.0.0-20160310174837-449fdfce4d96 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonpointer@v0.0.0-20160704185906-46af16f9f7b1/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/docker/spdystream@v0.0.0-20160310174837-449fdfce4d96/LICENSE: Apache License @@ -25087,18 +25295,7 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonpointer@ END OF TERMS AND CONDITIONS - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] + Copyright 2014-2015 Docker, Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -25114,19 +25311,112 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonpointer@ -------------------------------------------------------------------------------- -Dependency : github.com/go-openapi/jsonreference -Version: v0.0.0-20160704190145-13c6e3589ad9 -Licence type (autodetected): Apache-2.0 +Dependency : github.com/eapache/go-resiliency +Version: v1.2.0 +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonreference@v0.0.0-20160704190145-13c6e3589ad9/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/eapache/go-resiliency@v1.2.0/LICENSE: +The MIT License (MIT) - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ +Copyright (c) 2014 Evan Huus - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + + +-------------------------------------------------------------------------------- +Dependency : github.com/eapache/go-xerial-snappy +Version: v0.0.0-20180814174437-776d5712da21 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/eapache/go-xerial-snappy@v0.0.0-20180814174437-776d5712da21/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2016 Evan Huus + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/eapache/queue +Version: v1.1.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/eapache/queue@v1.1.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2014 Evan Huus + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +-------------------------------------------------------------------------------- +Dependency : github.com/elastic/go-windows +Version: v1.0.1 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/elastic/go-windows@v1.0.1/LICENSE.txt: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. @@ -25326,13 +25616,80 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonreferenc -------------------------------------------------------------------------------- -Dependency : github.com/go-openapi/spec -Version: v0.0.0-20160808142527-6aced65f8501 -Licence type (autodetected): Apache-2.0 +Dependency : github.com/elazarl/goproxy +Version: v0.0.0-20180725130230-947c36da3153 +Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-openapi/spec@v0.0.0-20160808142527-6aced65f8501/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/elazarl/goproxy@v0.0.0-20180725130230-947c36da3153/LICENSE: +Copyright (c) 2012 Elazar Leibovich. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Elazar Leibovich. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/emicklei/go-restful +Version: v0.0.0-20170410110728-ff4f55a20633 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/emicklei/go-restful@v0.0.0-20170410110728-ff4f55a20633/LICENSE: + +Copyright (c) 2012,2013 Ernest Micklei + +MIT License + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +-------------------------------------------------------------------------------- +Dependency : github.com/envoyproxy/go-control-plane +Version: v0.9.4 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/go-control-plane@v0.9.4/LICENSE: Apache License Version 2.0, January 2004 @@ -25514,7 +25871,7 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/spec@v0.0.0- APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" + boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -25522,7 +25879,7 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/spec@v0.0.0- same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright {yyyy} {name of copyright owner} Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -25538,12 +25895,12 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/spec@v0.0.0- -------------------------------------------------------------------------------- -Dependency : github.com/go-openapi/swag -Version: v0.0.0-20160704191624-1d0bd113de87 +Dependency : github.com/envoyproxy/protoc-gen-validate +Version: v0.1.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-openapi/swag@v0.0.0-20160704191624-1d0bd113de87/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/envoyproxy/protoc-gen-validate@v0.1.0/LICENSE: Apache License @@ -25750,16 +26107,50 @@ Contents of probable licence file $GOMODCACHE/github.com/go-openapi/swag@v0.0.0- -------------------------------------------------------------------------------- -Dependency : github.com/go-sourcemap/sourcemap -Version: v2.1.2+incompatible -Licence type (autodetected): BSD-2-Clause +Dependency : github.com/evanphx/json-patch +Version: v4.2.0+incompatible +Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-sourcemap/sourcemap@v2.1.2+incompatible/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/evanphx/json-patch@v4.2.0+incompatible/LICENSE: -Copyright (c) 2016 The github.com/go-sourcemap/sourcemap Contributors. +Copyright (c) 2014, Evan Phoenix All rights reserved. +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. +* Redistributions in binary form must reproduce the above copyright notice + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. +* Neither the name of the Evan Phoenix nor the names of its contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/fortytw2/leaktest +Version: v1.3.0 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/fortytw2/leaktest@v1.3.0/LICENSE: + +Copyright (c) 2012 The Go Authors. All rights reserved. + Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -25770,6 +26161,9 @@ notice, this list of conditions and the following disclaimer. copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT @@ -25785,16 +26179,16 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/go-stack/stack -Version: v1.8.0 +Dependency : github.com/frankban/quicktest +Version: v1.7.2 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-stack/stack@v1.8.0/LICENSE.md: +Contents of probable licence file $GOMODCACHE/github.com/frankban/quicktest@v1.7.2/LICENSE: -The MIT License (MIT) +MIT License -Copyright (c) 2014 Chris Hines +Copyright (c) 2017 Canonical Ltd. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -25816,16 +26210,16 @@ SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/gobuffalo/here -Version: v0.6.0 +Dependency : github.com/ghodss/yaml +Version: v1.0.0 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/gobuffalo/here@v0.6.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/ghodss/yaml@v1.0.0/LICENSE: The MIT License (MIT) -Copyright (c) 2019 Mark Bates +Copyright (c) 2014 Sam Ghods Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -25846,48 +26240,1395 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +Copyright (c) 2012 The Go Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------------------------------------------------------------------- -Dependency : github.com/godbus/dbus/v5 -Version: v5.0.3 -Licence type (autodetected): BSD-2-Clause +Dependency : github.com/go-gl/glfw/v3.3/glfw +Version: v0.0.0-20191125211704-12ad95a8df72 +Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/godbus/dbus/v5@v5.0.3/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/go-gl/glfw/v3.3/glfw@v0.0.0-20191125211704-12ad95a8df72/LICENSE: -Copyright (c) 2013, Georg Reinke (), Google -All rights reserved. +Copyright (c) 2012 The glfw3-go Authors. All rights reserved. Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions -are met: - -1. Redistributions of source code must retain the above copyright notice, -this list of conditions and the following disclaimer. +modification, are permitted provided that the following conditions are +met: -2. Redistributions in binary form must reproduce the above copyright -notice, this list of conditions and the following disclaimer in the -documentation and/or other materials provided with the distribution. + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/golang-sql/civil -Version: v0.0.0-20190719163853-cb61b32ac6fe -Licence type (autodetected): Apache-2.0 +Dependency : github.com/go-kit/kit +Version: v0.9.0 +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/golang-sql/civil@v0.0.0-20190719163853-cb61b32ac6fe/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/go-kit/kit@v0.9.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2015 Peter Bourgon + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-logfmt/logfmt +Version: v0.4.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-logfmt/logfmt@v0.4.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2015 go-logfmt + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-logr/logr +Version: v0.1.0 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-logr/logr@v0.1.0/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} {name of copyright owner} + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-martini/martini +Version: v0.0.0-20170121215854-22fa46961aab +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2015 Jeremy Saenz + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-ole/go-ole +Version: v1.2.5-0.20190920104607-14974a1cf647 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-ole/go-ole@v1.2.5-0.20190920104607-14974a1cf647/LICENSE: + +The MIT License (MIT) + +Copyright © 2013-2017 Yasuhiro Matsumoto, + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the “Software”), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies +of the Software, and to permit persons to whom the Software is furnished to do +so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-openapi/jsonpointer +Version: v0.0.0-20160704185906-46af16f9f7b1 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonpointer@v0.0.0-20160704185906-46af16f9f7b1/LICENSE: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-openapi/jsonreference +Version: v0.0.0-20160704190145-13c6e3589ad9 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-openapi/jsonreference@v0.0.0-20160704190145-13c6e3589ad9/LICENSE: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-openapi/spec +Version: v0.0.0-20160808142527-6aced65f8501 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-openapi/spec@v0.0.0-20160808142527-6aced65f8501/LICENSE: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-openapi/swag +Version: v0.0.0-20160704191624-1d0bd113de87 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-openapi/swag@v0.0.0-20160704191624-1d0bd113de87/LICENSE: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-sourcemap/sourcemap +Version: v2.1.2+incompatible +Licence type (autodetected): BSD-2-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-sourcemap/sourcemap@v2.1.2+incompatible/LICENSE: + +Copyright (c) 2016 The github.com/go-sourcemap/sourcemap Contributors. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/go-stack/stack +Version: v1.8.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/go-stack/stack@v1.8.0/LICENSE.md: + +The MIT License (MIT) + +Copyright (c) 2014 Chris Hines + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/gobuffalo/here +Version: v0.6.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/gobuffalo/here@v0.6.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2019 Mark Bates + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/godbus/dbus/v5 +Version: v5.0.3 +Licence type (autodetected): BSD-2-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/godbus/dbus/v5@v5.0.3/LICENSE: + +Copyright (c) 2013, Georg Reinke (), Google +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +1. Redistributions of source code must retain the above copyright notice, +this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright +notice, this list of conditions and the following disclaimer in the +documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/golang-sql/civil +Version: v0.0.0-20190719163853-cb61b32ac6fe +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/golang-sql/civil@v0.0.0-20190719163853-cb61b32ac6fe/LICENSE: Apache License @@ -30822,6 +32563,370 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice the Mozilla Public License, v. 2.0. +-------------------------------------------------------------------------------- +Dependency : github.com/hashicorp/hcl +Version: v1.0.0 +Licence type (autodetected): MPL-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/hashicorp/hcl@v1.0.0/LICENSE: + +Mozilla Public License, version 2.0 + +1. Definitions + +1.1. “Contributor” + + means each individual or legal entity that creates, contributes to the + creation of, or owns Covered Software. + +1.2. “Contributor Version” + + means the combination of the Contributions of others (if any) used by a + Contributor and that particular Contributor’s Contribution. + +1.3. “Contribution” + + means Covered Software of a particular Contributor. + +1.4. “Covered Software” + + means Source Code Form to which the initial Contributor has attached the + notice in Exhibit A, the Executable Form of such Source Code Form, and + Modifications of such Source Code Form, in each case including portions + thereof. + +1.5. “Incompatible With Secondary Licenses” + means + + a. that the initial Contributor has attached the notice described in + Exhibit B to the Covered Software; or + + b. that the Covered Software was made available under the terms of version + 1.1 or earlier of the License, but not also under the terms of a + Secondary License. + +1.6. “Executable Form” + + means any form of the work other than Source Code Form. + +1.7. “Larger Work” + + means a work that combines Covered Software with other material, in a separate + file or files, that is not Covered Software. + +1.8. “License” + + means this document. + +1.9. “Licensable” + + means having the right to grant, to the maximum extent possible, whether at the + time of the initial grant or subsequently, any and all of the rights conveyed by + this License. + +1.10. “Modifications” + + means any of the following: + + a. any file in Source Code Form that results from an addition to, deletion + from, or modification of the contents of Covered Software; or + + b. any new file in Source Code Form that contains any Covered Software. + +1.11. “Patent Claims” of a Contributor + + means any patent claim(s), including without limitation, method, process, + and apparatus claims, in any patent Licensable by such Contributor that + would be infringed, but for the grant of the License, by the making, + using, selling, offering for sale, having made, import, or transfer of + either its Contributions or its Contributor Version. + +1.12. “Secondary License” + + means either the GNU General Public License, Version 2.0, the GNU Lesser + General Public License, Version 2.1, the GNU Affero General Public + License, Version 3.0, or any later versions of those licenses. + +1.13. “Source Code Form” + + means the form of the work preferred for making modifications. + +1.14. “You” (or “Your”) + + means an individual or a legal entity exercising rights under this + License. For legal entities, “You” includes any entity that controls, is + controlled by, or is under common control with You. For purposes of this + definition, “control” means (a) the power, direct or indirect, to cause + the direction or management of such entity, whether by contract or + otherwise, or (b) ownership of more than fifty percent (50%) of the + outstanding shares or beneficial ownership of such entity. + + +2. License Grants and Conditions + +2.1. Grants + + Each Contributor hereby grants You a world-wide, royalty-free, + non-exclusive license: + + a. under intellectual property rights (other than patent or trademark) + Licensable by such Contributor to use, reproduce, make available, + modify, display, perform, distribute, and otherwise exploit its + Contributions, either on an unmodified basis, with Modifications, or as + part of a Larger Work; and + + b. under Patent Claims of such Contributor to make, use, sell, offer for + sale, have made, import, and otherwise transfer either its Contributions + or its Contributor Version. + +2.2. Effective Date + + The licenses granted in Section 2.1 with respect to any Contribution become + effective for each Contribution on the date the Contributor first distributes + such Contribution. + +2.3. Limitations on Grant Scope + + The licenses granted in this Section 2 are the only rights granted under this + License. No additional rights or licenses will be implied from the distribution + or licensing of Covered Software under this License. Notwithstanding Section + 2.1(b) above, no patent license is granted by a Contributor: + + a. for any code that a Contributor has removed from Covered Software; or + + b. for infringements caused by: (i) Your and any other third party’s + modifications of Covered Software, or (ii) the combination of its + Contributions with other software (except as part of its Contributor + Version); or + + c. under Patent Claims infringed by Covered Software in the absence of its + Contributions. + + This License does not grant any rights in the trademarks, service marks, or + logos of any Contributor (except as may be necessary to comply with the + notice requirements in Section 3.4). + +2.4. Subsequent Licenses + + No Contributor makes additional grants as a result of Your choice to + distribute the Covered Software under a subsequent version of this License + (see Section 10.2) or under the terms of a Secondary License (if permitted + under the terms of Section 3.3). + +2.5. Representation + + Each Contributor represents that the Contributor believes its Contributions + are its original creation(s) or it has sufficient rights to grant the + rights to its Contributions conveyed by this License. + +2.6. Fair Use + + This License is not intended to limit any rights You have under applicable + copyright doctrines of fair use, fair dealing, or other equivalents. + +2.7. Conditions + + Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in + Section 2.1. + + +3. Responsibilities + +3.1. Distribution of Source Form + + All distribution of Covered Software in Source Code Form, including any + Modifications that You create or to which You contribute, must be under the + terms of this License. You must inform recipients that the Source Code Form + of the Covered Software is governed by the terms of this License, and how + they can obtain a copy of this License. You may not attempt to alter or + restrict the recipients’ rights in the Source Code Form. + +3.2. Distribution of Executable Form + + If You distribute Covered Software in Executable Form then: + + a. such Covered Software must also be made available in Source Code Form, + as described in Section 3.1, and You must inform recipients of the + Executable Form how they can obtain a copy of such Source Code Form by + reasonable means in a timely manner, at a charge no more than the cost + of distribution to the recipient; and + + b. You may distribute such Executable Form under the terms of this License, + or sublicense it under different terms, provided that the license for + the Executable Form does not attempt to limit or alter the recipients’ + rights in the Source Code Form under this License. + +3.3. Distribution of a Larger Work + + You may create and distribute a Larger Work under terms of Your choice, + provided that You also comply with the requirements of this License for the + Covered Software. If the Larger Work is a combination of Covered Software + with a work governed by one or more Secondary Licenses, and the Covered + Software is not Incompatible With Secondary Licenses, this License permits + You to additionally distribute such Covered Software under the terms of + such Secondary License(s), so that the recipient of the Larger Work may, at + their option, further distribute the Covered Software under the terms of + either this License or such Secondary License(s). + +3.4. Notices + + You may not remove or alter the substance of any license notices (including + copyright notices, patent notices, disclaimers of warranty, or limitations + of liability) contained within the Source Code Form of the Covered + Software, except that You may alter any license notices to the extent + required to remedy known factual inaccuracies. + +3.5. Application of Additional Terms + + You may choose to offer, and to charge a fee for, warranty, support, + indemnity or liability obligations to one or more recipients of Covered + Software. However, You may do so only on Your own behalf, and not on behalf + of any Contributor. You must make it absolutely clear that any such + warranty, support, indemnity, or liability obligation is offered by You + alone, and You hereby agree to indemnify every Contributor for any + liability incurred by such Contributor as a result of warranty, support, + indemnity or liability terms You offer. You may include additional + disclaimers of warranty and limitations of liability specific to any + jurisdiction. + +4. Inability to Comply Due to Statute or Regulation + + If it is impossible for You to comply with any of the terms of this License + with respect to some or all of the Covered Software due to statute, judicial + order, or regulation then You must: (a) comply with the terms of this License + to the maximum extent possible; and (b) describe the limitations and the code + they affect. Such description must be placed in a text file included with all + distributions of the Covered Software under this License. Except to the + extent prohibited by statute or regulation, such description must be + sufficiently detailed for a recipient of ordinary skill to be able to + understand it. + +5. Termination + +5.1. The rights granted under this License will terminate automatically if You + fail to comply with any of its terms. However, if You become compliant, + then the rights granted under this License from a particular Contributor + are reinstated (a) provisionally, unless and until such Contributor + explicitly and finally terminates Your grants, and (b) on an ongoing basis, + if such Contributor fails to notify You of the non-compliance by some + reasonable means prior to 60 days after You have come back into compliance. + Moreover, Your grants from a particular Contributor are reinstated on an + ongoing basis if such Contributor notifies You of the non-compliance by + some reasonable means, this is the first time You have received notice of + non-compliance with this License from such Contributor, and You become + compliant prior to 30 days after Your receipt of the notice. + +5.2. If You initiate litigation against any entity by asserting a patent + infringement claim (excluding declaratory judgment actions, counter-claims, + and cross-claims) alleging that a Contributor Version directly or + indirectly infringes any patent, then the rights granted to You by any and + all Contributors for the Covered Software under Section 2.1 of this License + shall terminate. + +5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user + license agreements (excluding distributors and resellers) which have been + validly granted by You or Your distributors under this License prior to + termination shall survive termination. + +6. Disclaimer of Warranty + + Covered Software is provided under this License on an “as is” basis, without + warranty of any kind, either expressed, implied, or statutory, including, + without limitation, warranties that the Covered Software is free of defects, + merchantable, fit for a particular purpose or non-infringing. The entire + risk as to the quality and performance of the Covered Software is with You. + Should any Covered Software prove defective in any respect, You (not any + Contributor) assume the cost of any necessary servicing, repair, or + correction. This disclaimer of warranty constitutes an essential part of this + License. No use of any Covered Software is authorized under this License + except under this disclaimer. + +7. Limitation of Liability + + Under no circumstances and under no legal theory, whether tort (including + negligence), contract, or otherwise, shall any Contributor, or anyone who + distributes Covered Software as permitted above, be liable to You for any + direct, indirect, special, incidental, or consequential damages of any + character including, without limitation, damages for lost profits, loss of + goodwill, work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses, even if such party shall have been + informed of the possibility of such damages. This limitation of liability + shall not apply to liability for death or personal injury resulting from such + party’s negligence to the extent applicable law prohibits such limitation. + Some jurisdictions do not allow the exclusion or limitation of incidental or + consequential damages, so this exclusion and limitation may not apply to You. + +8. Litigation + + Any litigation relating to this License may be brought only in the courts of + a jurisdiction where the defendant maintains its principal place of business + and such litigation shall be governed by laws of that jurisdiction, without + reference to its conflict-of-law provisions. Nothing in this Section shall + prevent a party’s ability to bring cross-claims or counter-claims. + +9. Miscellaneous + + This License represents the complete agreement concerning the subject matter + hereof. If any provision of this License is held to be unenforceable, such + provision shall be reformed only to the extent necessary to make it + enforceable. Any law or regulation which provides that the language of a + contract shall be construed against the drafter shall not be used to construe + this License against a Contributor. + + +10. Versions of the License + +10.1. New Versions + + Mozilla Foundation is the license steward. Except as provided in Section + 10.3, no one other than the license steward has the right to modify or + publish new versions of this License. Each version will be given a + distinguishing version number. + +10.2. Effect of New Versions + + You may distribute the Covered Software under the terms of the version of + the License under which You originally received the Covered Software, or + under the terms of any subsequent version published by the license + steward. + +10.3. Modified Versions + + If you create software not governed by this License, and you want to + create a new license for such software, you may create and use a modified + version of this License if you rename the license and remove any + references to the name of the license steward (except to note that such + modified license differs from this License). + +10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses + If You choose to distribute Source Code Form that is Incompatible With + Secondary Licenses under the terms of this version of the License, the + notice described in Exhibit B of this License must be attached. + +Exhibit A - Source Code Form License Notice + + This Source Code Form is subject to the + terms of the Mozilla Public License, v. + 2.0. If a copy of the MPL was not + distributed with this file, You can + obtain one at + http://mozilla.org/MPL/2.0/. + +If it is not possible or desirable to put the notice in a particular file, then +You may include the notice in a location (such as a LICENSE file in a relevant +directory) where a recipient would be likely to look for such a notice. + +You may add additional accurate notices of copyright ownership. + +Exhibit B - “Incompatible With Secondary Licenses” Notice + + This Source Code Form is “Incompatible + With Secondary Licenses”, as defined by + the Mozilla Public License, v. 2.0. + + + -------------------------------------------------------------------------------- Dependency : github.com/haya14busa/go-actions-toolkit Version: v0.0.0-20200105081403-ca0307860f01 @@ -31829,6 +33934,41 @@ Contents of probable licence file $GOMODCACHE/github.com/kylelemons/godebug@v1.1 limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/magiconair/properties +Version: v1.8.0 +Licence type (autodetected): BSD-2-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/magiconair/properties@v1.8.0/LICENSE: + +goproperties - properties file decoder for Go + +Copyright (c) 2013-2018 - Frank Schroeder + +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR +ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------------------------------------------------------------------- Dependency : github.com/mailru/easyjson Version: v0.7.1 @@ -32693,7 +34833,257 @@ Contents of probable licence file $GOMODCACHE/github.com/modern-go/reflect2@v1.0 APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/morikuni/aec +Version: v1.0.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/morikuni/aec@v1.0.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2016 Taihei Morikuni + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/munnerz/goautoneg +Version: v0.0.0-20120707110453-a547fc61f48d +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +No licence file provided. + +-------------------------------------------------------------------------------- +Dependency : github.com/mwitkow/go-conntrack +Version: v0.0.0-20161129095857-cc309e4a2223 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/mwitkow/go-conntrack@v0.0.0-20161129095857-cc309e4a2223/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -32701,7 +35091,7 @@ Contents of probable licence file $GOMODCACHE/github.com/modern-go/reflect2@v1.0 same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright {yyyy} {name of copyright owner} Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -32717,55 +35107,116 @@ Contents of probable licence file $GOMODCACHE/github.com/modern-go/reflect2@v1.0 -------------------------------------------------------------------------------- -Dependency : github.com/morikuni/aec -Version: v1.0.0 -Licence type (autodetected): MIT +Dependency : github.com/mxk/go-flowrate +Version: v0.0.0-20140419014527-cca7078d478f +Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/morikuni/aec@v1.0.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/mxk/go-flowrate@v0.0.0-20140419014527-cca7078d478f/LICENSE: -The MIT License (MIT) +Copyright (c) 2014 The Go-FlowRate Authors. All rights reserved. -Copyright (c) 2016 Taihei Morikuni +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the + distribution. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + * Neither the name of the go-flowrate project nor the names of its + contributors may be used to endorse or promote products derived + from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/munnerz/goautoneg -Version: v0.0.0-20120707110453-a547fc61f48d -Licence type (autodetected): BSD-3-Clause +Dependency : github.com/onsi/ginkgo +Version: v1.11.0 +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -No licence file provided. +Contents of probable licence file $GOMODCACHE/github.com/onsi/ginkgo@v1.11.0/LICENSE: + +Copyright (c) 2013-2014 Onsi Fakhouri + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------------------- -Dependency : github.com/mwitkow/go-conntrack -Version: v0.0.0-20161129095857-cc309e4a2223 +Dependency : github.com/onsi/gomega +Version: v1.7.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/onsi/gomega@v1.7.0/LICENSE: + +Copyright (c) 2013-2014 Onsi Fakhouri + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/opencontainers/go-digest +Version: v1.0.0-rc1.0.20190228220655-ac19fd6e7483 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/mwitkow/go-conntrack@v0.0.0-20161129095857-cc309e4a2223/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/opencontainers/go-digest@v1.0.0-rc1.0.20190228220655-ac19fd6e7483/LICENSE: + Apache License Version 2.0, January 2004 - http://www.apache.org/licenses/ + https://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION @@ -32940,24 +35391,13 @@ Contents of probable licence file $GOMODCACHE/github.com/mwitkow/go-conntrack@v0 END OF TERMS AND CONDITIONS - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright {yyyy} {name of copyright owner} + Copyright 2016 Docker, Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at - http://www.apache.org/licenses/LICENSE-2.0 + https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, @@ -32967,116 +35407,17 @@ Contents of probable licence file $GOMODCACHE/github.com/mwitkow/go-conntrack@v0 -------------------------------------------------------------------------------- -Dependency : github.com/mxk/go-flowrate -Version: v0.0.0-20140419014527-cca7078d478f -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/mxk/go-flowrate@v0.0.0-20140419014527-cca7078d478f/LICENSE: - -Copyright (c) 2014 The Go-FlowRate Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the - distribution. - - * Neither the name of the go-flowrate project nor the names of its - contributors may be used to endorse or promote products derived - from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/onsi/ginkgo -Version: v1.11.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/onsi/ginkgo@v1.11.0/LICENSE: - -Copyright (c) 2013-2014 Onsi Fakhouri - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/onsi/gomega -Version: v1.7.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/onsi/gomega@v1.7.0/LICENSE: - -Copyright (c) 2013-2014 Onsi Fakhouri - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/opencontainers/go-digest -Version: v1.0.0-rc1.0.20190228220655-ac19fd6e7483 +Dependency : github.com/opencontainers/image-spec +Version: v1.0.2-0.20190823105129-775207bd45b6 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/opencontainers/go-digest@v1.0.0-rc1.0.20190228220655-ac19fd6e7483/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/opencontainers/image-spec@v1.0.2-0.20190823105129-775207bd45b6/LICENSE: Apache License Version 2.0, January 2004 - https://www.apache.org/licenses/ + http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION @@ -33251,13 +35592,13 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/go-diges END OF TERMS AND CONDITIONS - Copyright 2016 Docker, Inc. + Copyright 2016 The Linux Foundation. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at - https://www.apache.org/licenses/LICENSE-2.0 + http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, @@ -33267,12 +35608,12 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/go-diges -------------------------------------------------------------------------------- -Dependency : github.com/opencontainers/image-spec -Version: v1.0.2-0.20190823105129-775207bd45b6 +Dependency : github.com/opencontainers/runc +Version: v1.0.0-rc9 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/opencontainers/image-spec@v1.0.2-0.20190823105129-775207bd45b6/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runc@v1.0.0-rc9/LICENSE: Apache License @@ -33452,7 +35793,7 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/image-sp END OF TERMS AND CONDITIONS - Copyright 2016 The Linux Foundation. + Copyright 2014 Docker, Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -33468,12 +35809,12 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/image-sp -------------------------------------------------------------------------------- -Dependency : github.com/opencontainers/runc -Version: v1.0.0-rc9 +Dependency : github.com/opencontainers/runtime-spec +Version: v1.0.1 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runc@v1.0.0-rc9/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime-spec@v1.0.1/LICENSE: Apache License @@ -33653,7 +35994,7 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runc@v1. END OF TERMS AND CONDITIONS - Copyright 2014 Docker, Inc. + Copyright 2015 The Linux Foundation. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -33669,12 +36010,12 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runc@v1. -------------------------------------------------------------------------------- -Dependency : github.com/opencontainers/runtime-spec -Version: v1.0.1 +Dependency : github.com/opencontainers/runtime-tools +Version: v0.0.0-20181011054405-1d69bd0f9c39 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime-spec@v1.0.1/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime-tools@v0.0.0-20181011054405-1d69bd0f9c39/LICENSE: Apache License @@ -33870,12 +36211,60 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime- -------------------------------------------------------------------------------- -Dependency : github.com/opencontainers/runtime-tools -Version: v0.0.0-20181011054405-1d69bd0f9c39 +Dependency : github.com/otiai10/curr +Version: v1.0.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/otiai10/curr@v1.0.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2020 Hiromu Ochiai + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/otiai10/mint +Version: v1.3.1 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/otiai10/mint@v1.3.1/LICENSE: + +Copyright 2017 otiai10 (Hiromu OCHIAI) + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/oxtoacart/bpool +Version: v0.0.0-20150712133111-4e1c5567d7c2 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime-tools@v0.0.0-20181011054405-1d69bd0f9c39/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/oxtoacart/bpool@v0.0.0-20150712133111-4e1c5567d7c2/LICENSE: Apache License @@ -34055,7 +36444,18 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime- END OF TERMS AND CONDITIONS - Copyright 2015 The Linux Foundation. + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2014 Percy Wegmann Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -34071,16 +36471,45 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime- -------------------------------------------------------------------------------- -Dependency : github.com/otiai10/curr -Version: v1.0.0 +Dependency : github.com/pelletier/go-toml +Version: v1.2.0 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/otiai10/curr@v1.0.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/pelletier/go-toml@v1.2.0/LICENSE: The MIT License (MIT) -Copyright (c) 2020 Hiromu Ochiai +Copyright (c) 2013 - 2017 Thomas Pelletier, Eric Anderton + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/peterbourgon/diskv +Version: v2.0.1+incompatible +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/peterbourgon/diskv@v2.0.1+incompatible/LICENSE: + +Copyright (c) 2011-2012 Peter Bourgon Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -34102,30 +36531,81 @@ THE SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/otiai10/mint -Version: v1.3.1 +Dependency : github.com/pierrec/lz4 +Version: v2.4.1+incompatible +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/pierrec/lz4@v2.4.1+incompatible/LICENSE: + +Copyright (c) 2015, Pierre Curto +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +* Neither the name of xxHash nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + +-------------------------------------------------------------------------------- +Dependency : github.com/poy/eachers +Version: v0.0.0-20181020210610-23942921fe77 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/otiai10/mint@v1.3.1/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/poy/eachers@v0.0.0-20181020210610-23942921fe77/LICENSE.md: -Copyright 2017 otiai10 (Hiromu OCHIAI) +The MIT License (MIT) -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: +Copyright (c) 2016 Andrew Poydence -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. -------------------------------------------------------------------------------- -Dependency : github.com/oxtoacart/bpool -Version: v0.0.0-20150712133111-4e1c5567d7c2 +Dependency : github.com/prometheus/client_golang +Version: v1.1.1-0.20190913103102-20428fa0bffc Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/oxtoacart/bpool@v0.0.0-20150712133111-4e1c5567d7c2/LICENSE: - +Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golang@v1.1.1-0.20190913103102-20428fa0bffc/LICENSE: Apache License Version 2.0, January 2004 @@ -34262,179 +36742,82 @@ Contents of probable licence file $GOMODCACHE/github.com/oxtoacart/bpool@v0.0.0- this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright 2014 Percy Wegmann - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - - --------------------------------------------------------------------------------- -Dependency : github.com/peterbourgon/diskv -Version: v2.0.1+incompatible -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/peterbourgon/diskv@v2.0.1+incompatible/LICENSE: - -Copyright (c) 2011-2012 Peter Bourgon - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/pierrec/lz4 -Version: v2.4.1+incompatible -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/pierrec/lz4@v2.4.1+incompatible/LICENSE: - -Copyright (c) 2015, Pierre Curto -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - -* Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. - -* Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. + with Licensor regarding such Contributions. -* Neither the name of xxHash nor the names of its - contributors may be used to endorse or promote products derived from - this software without specific prior written permission. + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. --------------------------------------------------------------------------------- -Dependency : github.com/poy/eachers -Version: v0.0.0-20181020210610-23942921fe77 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- + END OF TERMS AND CONDITIONS -Contents of probable licence file $GOMODCACHE/github.com/poy/eachers@v0.0.0-20181020210610-23942921fe77/LICENSE.md: + APPENDIX: How to apply the Apache License to your work. -The MIT License (MIT) + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. -Copyright (c) 2016 Andrew Poydence + Copyright [yyyy] [name of copyright owner] -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. + http://www.apache.org/licenses/LICENSE-2.0 -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. -------------------------------------------------------------------------------- -Dependency : github.com/prometheus/client_golang -Version: v1.1.1-0.20190913103102-20428fa0bffc +Dependency : github.com/rakyll/statik +Version: v0.1.6 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golang@v1.1.1-0.20190913103102-20428fa0bffc/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/rakyll/statik@v0.1.6/LICENSE: + Apache License Version 2.0, January 2004 @@ -34624,7 +37007,7 @@ Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golan same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright 2014 Google Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -34640,13 +37023,163 @@ Contents of probable licence file $GOMODCACHE/github.com/prometheus/client_golan -------------------------------------------------------------------------------- -Dependency : github.com/rakyll/statik -Version: v0.1.6 -Licence type (autodetected): Apache-2.0 +Dependency : github.com/reviewdog/errorformat +Version: v0.0.0-20200109134752-8983be9bc7dd +Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/rakyll/statik@v0.1.6/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/reviewdog/errorformat@v0.0.0-20200109134752-8983be9bc7dd/LICENSE: + +MIT License + +Copyright (c) 2016 haya14busa + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/rogpeppe/fastuuid +Version: v1.2.0 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/fastuuid@v1.2.0/LICENSE: + +Copyright © 2014, Roger Peppe +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + * Neither the name of this project nor the names of its contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/rogpeppe/go-internal +Version: v1.3.0 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/go-internal@v1.3.0/LICENSE: + +Copyright (c) 2018 The Go Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/russross/blackfriday +Version: v1.5.2 +Licence type (autodetected): BSD-2-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/russross/blackfriday@v1.5.2/LICENSE.txt: + +Blackfriday is distributed under the Simplified BSD License: + +> Copyright © 2011 Russ Ross +> All rights reserved. +> +> Redistribution and use in source and binary forms, with or without +> modification, are permitted provided that the following conditions +> are met: +> +> 1. Redistributions of source code must retain the above copyright +> notice, this list of conditions and the following disclaimer. +> +> 2. Redistributions in binary form must reproduce the above +> copyright notice, this list of conditions and the following +> disclaimer in the documentation and/or other materials provided with +> the distribution. +> +> THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +> "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +> LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +> FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +> COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, +> INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, +> BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +> LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +> CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +> LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN +> ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +> POSSIBILITY OF SUCH DAMAGE. + +-------------------------------------------------------------------------------- +Dependency : github.com/samuel/go-parser +Version: v0.0.0-20130731160455-ca8abbf65d0e +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +No licence file provided. + +-------------------------------------------------------------------------------- +Dependency : github.com/sanathkr/go-yaml +Version: v0.0.0-20170819195128-ed9d249f429b +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/sanathkr/go-yaml@v0.0.0-20170819195128-ed9d249f429b/LICENSE: Apache License Version 2.0, January 2004 @@ -34828,7 +37361,7 @@ Contents of probable licence file $GOMODCACHE/github.com/rakyll/statik@v0.1.6/LI APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" + boilerplate notice, with the fields enclosed by brackets "{}" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a @@ -34836,7 +37369,7 @@ Contents of probable licence file $GOMODCACHE/github.com/rakyll/statik@v0.1.6/LI same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright 2014 Google Inc. + Copyright {yyyy} {name of copyright owner} Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -34852,16 +37385,16 @@ Contents of probable licence file $GOMODCACHE/github.com/rakyll/statik@v0.1.6/LI -------------------------------------------------------------------------------- -Dependency : github.com/reviewdog/errorformat -Version: v0.0.0-20200109134752-8983be9bc7dd +Dependency : github.com/sanathkr/yaml +Version: v1.0.1-0.20170819201035-0056894fa522 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/reviewdog/errorformat@v0.0.0-20200109134752-8983be9bc7dd/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/sanathkr/yaml@v1.0.1-0.20170819201035-0056894fa522/LICENSE: -MIT License +The MIT License (MIT) -Copyright (c) 2016 haya14busa +Copyright (c) 2014 Sam Ghods Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -34882,51 +37415,44 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --------------------------------------------------------------------------------- -Dependency : github.com/rogpeppe/fastuuid -Version: v1.2.0 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/fastuuid@v1.2.0/LICENSE: - -Copyright © 2014, Roger Peppe -All rights reserved. +Copyright (c) 2012 The Go Authors. All rights reserved. -Redistribution and use in source and binary forms, with or without modification, -are permitted provided that the following conditions are met: +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: - * Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - * Neither the name of this project nor the names of its contributors - may be used to endorse or promote products derived from this software - without specific prior written permission. + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR -PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF -LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING -NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/rogpeppe/go-internal -Version: v1.3.0 +Dependency : github.com/santhosh-tekuri/jsonschema +Version: v1.2.4 Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/rogpeppe/go-internal@v1.3.0/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/santhosh-tekuri/jsonschema@v1.2.4/LICENSE: -Copyright (c) 2018 The Go Authors. All rights reserved. +Copyright (c) 2017 Santhosh Kumar Tekuri. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are @@ -34954,24 +37480,206 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------------------- +Dependency : github.com/satori/go.uuid +Version: v1.2.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/satori/go.uuid@v1.2.0/LICENSE: + +Copyright (C) 2013-2018 by Maxim Bublis + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------------------- -Dependency : github.com/samuel/go-parser -Version: v0.0.0-20130731160455-ca8abbf65d0e +Dependency : github.com/sergi/go-diff +Version: v1.1.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/sergi/go-diff@v1.1.0/LICENSE: + +Copyright (c) 2012-2016 The go-diff Authors. All rights reserved. + +Permission is hereby granted, free of charge, to any person obtaining a +copy of this software and associated documentation files (the "Software"), +to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included +in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. + + + +-------------------------------------------------------------------------------- +Dependency : github.com/sirupsen/logrus +Version: v1.4.2 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/sirupsen/logrus@v1.4.2/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2014 Simon Eskildsen + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/smartystreets/assertions +Version: v0.0.0-20180927180507-b2de0cb4f26d +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d/LICENSE.md: + +Copyright (c) 2016 SmartyStreets, LLC + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +NOTE: Various optional and subordinate components carry their own licensing +requirements and restrictions. Use of those components is subject to the terms +and conditions outlined the respective license of each component. + + +-------------------------------------------------------------------------------- +Dependency : github.com/smartystreets/goconvey +Version: v0.0.0-20190330032615-68dc04aab96a +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/smartystreets/goconvey@v0.0.0-20190330032615-68dc04aab96a/LICENSE.md: + +Copyright (c) 2016 SmartyStreets, LLC + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +NOTE: Various optional and subordinate components carry their own licensing +requirements and restrictions. Use of those components is subject to the terms +and conditions outlined the respective license of each component. + + +-------------------------------------------------------------------------------- +Dependency : github.com/spaolacci/murmur3 +Version: v1.1.0 Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -No licence file provided. +Contents of probable licence file $GOMODCACHE/github.com/spaolacci/murmur3@v1.1.0/LICENSE: + +Copyright 2013, Sébastien Paolacci. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * Neither the name of the library nor the + names of its contributors may be used to endorse or promote products + derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY +DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + -------------------------------------------------------------------------------- -Dependency : github.com/sanathkr/go-yaml -Version: v0.0.0-20170819195128-ed9d249f429b +Dependency : github.com/spf13/afero +Version: v1.2.2 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/sanathkr/go-yaml@v0.0.0-20170819195128-ed9d249f429b/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/spf13/afero@v1.2.2/LICENSE.txt: - Apache License + Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ @@ -35146,45 +37854,18 @@ Contents of probable licence file $GOMODCACHE/github.com/sanathkr/go-yaml@v0.0.0 incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "{}" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright {yyyy} {name of copyright owner} - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -------------------------------------------------------------------------------- -Dependency : github.com/sanathkr/yaml -Version: v1.0.1-0.20170819201035-0056894fa522 +Dependency : github.com/spf13/cast +Version: v1.3.0 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/sanathkr/yaml@v1.0.1-0.20170819201035-0056894fa522/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/spf13/cast@v1.3.0/LICENSE: The MIT License (MIT) -Copyright (c) 2014 Sam Ghods +Copyright (c) 2014 Steve Francia Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -35204,143 +37885,17 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -Copyright (c) 2012 The Go Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - --------------------------------------------------------------------------------- -Dependency : github.com/santhosh-tekuri/jsonschema -Version: v1.2.4 -Licence type (autodetected): BSD-3-Clause --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/santhosh-tekuri/jsonschema@v1.2.4/LICENSE: - -Copyright (c) 2017 Santhosh Kumar Tekuri. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -------------------------------------------------------------------------------- -Dependency : github.com/satori/go.uuid -Version: v1.2.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/satori/go.uuid@v1.2.0/LICENSE: - -Copyright (C) 2013-2018 by Maxim Bublis - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/sergi/go-diff -Version: v1.1.0 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/sergi/go-diff@v1.1.0/LICENSE: - -Copyright (c) 2012-2016 The go-diff Authors. All rights reserved. - -Permission is hereby granted, free of charge, to any person obtaining a -copy of this software and associated documentation files (the "Software"), -to deal in the Software without restriction, including without limitation -the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included -in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS -OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - - - --------------------------------------------------------------------------------- -Dependency : github.com/sirupsen/logrus -Version: v1.4.2 +Dependency : github.com/spf13/jwalterweatherman +Version: v1.0.0 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/sirupsen/logrus@v1.4.2/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/spf13/jwalterweatherman@v1.0.0/LICENSE: The MIT License (MIT) -Copyright (c) 2014 Simon Eskildsen +Copyright (c) 2014 Steve Francia Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -35349,60 +37904,28 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - - --------------------------------------------------------------------------------- -Dependency : github.com/smartystreets/assertions -Version: v0.0.0-20180927180507-b2de0cb4f26d -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d/LICENSE.md: - -Copyright (c) 2016 SmartyStreets, LLC - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -NOTE: Various optional and subordinate components carry their own licensing -requirements and restrictions. Use of those components is subject to the terms -and conditions outlined the respective license of each component. - - -------------------------------------------------------------------------------- -Dependency : github.com/smartystreets/goconvey -Version: v0.0.0-20190330032615-68dc04aab96a +Dependency : github.com/spf13/viper +Version: v1.3.2 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/smartystreets/goconvey@v0.0.0-20190330032615-68dc04aab96a/LICENSE.md: +Contents of probable licence file $GOMODCACHE/github.com/spf13/viper@v1.3.2/LICENSE: -Copyright (c) 2016 SmartyStreets, LLC +The MIT License (MIT) + +Copyright (c) 2014 Steve Francia Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -35422,195 +37945,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -NOTE: Various optional and subordinate components carry their own licensing -requirements and restrictions. Use of those components is subject to the terms -and conditions outlined the respective license of each component. - - --------------------------------------------------------------------------------- -Dependency : github.com/spf13/afero -Version: v1.2.2 -Licence type (autodetected): Apache-2.0 --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/spf13/afero@v1.2.2/LICENSE.txt: - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - -------------------------------------------------------------------------------- Dependency : github.com/stretchr/objx Version: v0.2.0 @@ -35677,6 +38011,38 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------------------- +Dependency : github.com/ugorji/go +Version: v1.1.8 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/ugorji/go@v1.1.8/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2012-2015 Ugorji Nwoke. +All rights reserved. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : github.com/urfave/cli Version: v0.0.0-20171014202726-7bc6a0acffa5 @@ -37420,6 +39786,25 @@ Contents of probable licence file $GOMODCACHE/github.com/xeipuuv/gojsonschema@v0 limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/xordataexchange/crypt +Version: v0.0.3-0.20170626215501-b2862e3d0a77 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/xordataexchange/crypt@v0.0.3-0.20170626215501-b2862e3d0a77/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2014 XOR Data Exchange, Inc. + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : github.com/yuin/gopher-lua Version: v0.0.0-20170403160031-b402f3114ec7 diff --git a/go.mod b/go.mod index 09cd086cbee..bb31374384a 100644 --- a/go.mod +++ b/go.mod @@ -45,6 +45,7 @@ require ( github.com/davecgh/go-xdr v0.0.0-20161123171359-e6a2ba005892 // indirect github.com/denisenkom/go-mssqldb v0.0.0-20200206145737-bbfc9a55622e github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2 // indirect + github.com/dgraph-io/badger/v2 v2.2007.2 github.com/dgrijalva/jwt-go v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible // indirect github.com/digitalocean/go-libvirt v0.0.0-20180301200012-6075ea3c39a1 github.com/dlclark/regexp2 v1.1.7-0.20171009020623-7632a260cbaf // indirect @@ -55,7 +56,7 @@ require ( github.com/docker/go-units v0.4.0 github.com/dop251/goja v0.0.0-20200831102558-9af81ddcf0e1 github.com/dop251/goja_nodejs v0.0.0-20171011081505-adff31b136e6 - github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4 + github.com/dustin/go-humanize v1.0.0 github.com/eclipse/paho.mqtt.golang v1.2.1-0.20200121105743-0d940dd29fd2 github.com/elastic/ecs v1.6.0 github.com/elastic/elastic-agent-client/v7 v7.0.0-20200709172729-d43b7ad5833a @@ -142,12 +143,13 @@ require ( github.com/satori/go.uuid v1.2.0 // indirect github.com/shirou/gopsutil v2.19.11+incompatible github.com/shopspring/decimal v1.2.0 - github.com/spf13/cobra v0.0.3 + github.com/spf13/cobra v0.0.5 github.com/spf13/pflag v1.0.5 github.com/stretchr/objx v0.2.0 // indirect github.com/stretchr/testify v1.6.1 github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b github.com/tsg/gopacket v0.0.0-20200626092518-2ab8e397a786 + github.com/ugorji/go/codec v1.1.8 github.com/urso/sderr v0.0.0-20200210124243-c2a16f3d43ec github.com/vmware/govmomi v0.0.0-20170802214208-2cad15190b41 github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c diff --git a/go.sum b/go.sum index 031f1faa095..8113d42f321 100644 --- a/go.sum +++ b/go.sum @@ -76,6 +76,8 @@ github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbt github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= +github.com/DataDog/zstd v1.4.1 h1:3oxKN3wbHibqx897utPC2LTQU4J+IHWWJO+glkAkpFM= +github.com/DataDog/zstd v1.4.1/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo= github.com/Masterminds/semver v1.4.2 h1:WBLTQ37jOCzSLtXNdoo8bNM8876KhNqOKvrlGITgsTc= github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y= github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA= @@ -83,6 +85,8 @@ github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tT github.com/Microsoft/hcsshim v0.8.7 h1:ptnOoufxGSzauVTsdE+wMYnCWA301PdoN4xg5oRdZpg= github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ= github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ= +github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE= +github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= github.com/Shopify/toxiproxy v2.1.4+incompatible h1:TKdv8HiTLgE5wdJuEML90aBgNWsokNbMijUGhmcoBJc= @@ -112,6 +116,7 @@ github.com/antlr/antlr4 v0.0.0-20200820155224-be881fa6b91d h1:OE3kzLBpy7pOJEzE55 github.com/antlr/antlr4 v0.0.0-20200820155224-be881fa6b91d/go.mod h1:T7PbCXFs94rrTttyxjbyT5+/1V8T2TYDejxUfHJjw1Y= github.com/apoydence/eachers v0.0.0-20181020210610-23942921fe77 h1:afT88tB6u9JCKQZVAAaa9ICz/uGn5Uw9ekn6P22mYKM= github.com/apoydence/eachers v0.0.0-20181020210610-23942921fe77/go.mod h1:bXvGk6IkT1Agy7qzJ+DjIw/SJ1AaB3AvAuMDVV+Vkoo= +github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8= github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI= github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= @@ -141,6 +146,8 @@ github.com/cavaliercoder/badio v0.0.0-20160213150051-ce5280129e9e/go.mod h1:V284 github.com/cavaliercoder/go-rpm v0.0.0-20190131055624-7a9c54e3d83e h1:Gbx+iVCXG/1m5WSnidDGuHgN+vbIwl+6fR092ANU+Y8= github.com/cavaliercoder/go-rpm v0.0.0-20190131055624-7a9c54e3d83e/go.mod h1:AZIh1CCnMrcVm6afFf96PBvE2MRpWFco91z8ObJtgDY= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= +github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= +github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= @@ -170,12 +177,16 @@ github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c/go.mod h1:ODA38xgv github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0= github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o= github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc= +github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE= +github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk= +github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8= github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= github.com/coreos/go-systemd/v22 v22.0.0 h1:XJIw/+VlJ+87J+doOxznsAWIdmWuViOVhkQamW5YV28= github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk= github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea h1:n2Ltr3SrfQlf/9nOna1DoGKxLx3qTSI8Ttl6Xrqp6mw= github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA= +github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE= github.com/cucumber/godog v0.8.1 h1:lVb+X41I4YDreE+ibZ50bdXmySxgRviYFgKY6Aw4XE8= github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA= github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg= @@ -190,9 +201,15 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200206145737-bbfc9a55622e/go.mod h1:xb github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2 h1:6+hM8KeYKV0Z9EIINNqIEDyyIRAcNc2FW+/TUYNmWyw= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= +github.com/dgraph-io/badger/v2 v2.2007.2 h1:EjjK0KqwaFMlPin1ajhP943VPENHJdEz1KLIegjaI3k= +github.com/dgraph-io/badger/v2 v2.2007.2/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDmM2p1e+NhhnBCAE= +github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de h1:t0UHb5vdojIDUqktM6+xJAfScFBsVpXZmqC9dsgJmeA= +github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= github.com/dgrijalva/jwt-go v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible h1:4jGdduO4ceTJFKf0IhgaB8NJapGqKHwC2b4xQ/cXujM= github.com/dgrijalva/jwt-go v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= +github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA= +github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw= github.com/digitalocean/go-libvirt v0.0.0-20180301200012-6075ea3c39a1 h1:eG5K5GNAAHvQlFmfIuy0Ocjg5dvyX22g/KknwTpmBko= github.com/digitalocean/go-libvirt v0.0.0-20180301200012-6075ea3c39a1/go.mod h1:PRcPVAAma6zcLpFd4GZrjR/MRpood3TamjKI2m/z/Uw= github.com/dimchansky/utfbom v1.1.0 h1:FcM3g+nofKgUteL8dm/UpdRXNC9KmADgTpLKsu0TRo4= @@ -213,8 +230,9 @@ github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96 h1:cenwrSVm+Z7QL github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM= github.com/dop251/goja_nodejs v0.0.0-20171011081505-adff31b136e6 h1:RrkoB0pT3gnjXhL/t10BSP1mcr/0Ldea2uMyuBr2SWk= github.com/dop251/goja_nodejs v0.0.0-20171011081505-adff31b136e6/go.mod h1:hn7BA7c8pLvoGndExHudxTDKZ84Pyvv+90pbBjbTz0Y= -github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4 h1:qk/FSDDxo05wdJH28W+p5yivv7LuLYLRXPPD8KQCtZs= github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= +github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo= +github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/eapache/go-resiliency v1.2.0 h1:v7g92e/KSN71Rq7vSThKaWIq68fL4YHvWyiUKorFR1Q= github.com/eapache/go-resiliency v1.2.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs= github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21 h1:YEetp8/yCZMuEPMUDHG0CW/brkkEp8mzqk2+ODEitlw= @@ -327,7 +345,6 @@ github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls= github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY= github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= -github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= @@ -339,7 +356,6 @@ github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFU github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= @@ -366,7 +382,6 @@ github.com/google/go-github/v29 v29.0.2 h1:opYN6Wc7DOz7Ku3Oh4l7prmkOMwEcQxpFtxdU github.com/google/go-github/v29 v29.0.2/go.mod h1:CHKiKKPHJ0REzfwc14QMklvtHwCveD0PxlMjLlzAM5E= github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk= github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= -github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g= github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -403,7 +418,6 @@ github.com/grpc-ecosystem/grpc-gateway v1.13.0 h1:sBDQoHXrOlfPobnKw69FIKa1wg9qsL github.com/grpc-ecosystem/grpc-gateway v1.13.0/go.mod h1:8XEsbTttt/W+VvjtQhLACqCisSPWTxCZ7sBRjU6iH9c= github.com/h2non/filetype v1.0.12 h1:yHCsIe0y2cvbDARtJhGBTD2ecvqMSTvlIcph9En/Zao= github.com/h2non/filetype v1.0.12/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY= -github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce h1:prjrVgOk2Yg6w+PflHoszQNLTUh4kaByUcEWM/9uin4= github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -424,6 +438,7 @@ github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.2-0.20190520140433-59383c442f7d h1:Ft6PtvobE9vwkCsuoNO5DZDbhKkKuktAlSsiOi1X5NA= github.com/hashicorp/golang-lru v0.5.2-0.20190520140433-59383c442f7d/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= github.com/haya14busa/go-actions-toolkit v0.0.0-20200105081403-ca0307860f01 h1:HiJF8Mek+I7PY0Bm+SuhkwaAZSZP83sw6rrTMrgZ0io= github.com/haya14busa/go-actions-toolkit v0.0.0-20200105081403-ca0307860f01/go.mod h1:1DWDZmeYf0LX30zscWb7K9rUMeirNeBMd5Dum+seUhc= github.com/haya14busa/go-checkstyle v0.0.0-20170303121022-5e9d09f51fa1/go.mod h1:RsN5RGgVYeXpcXNtWyztD5VIe7VNSEqpJvF2iEH7QvI= @@ -455,7 +470,6 @@ github.com/jpillora/backoff v0.0.0-20180909062703-3050d21c67d7/go.mod h1:2iMrUgb github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA= github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= -github.com/json-iterator/go v1.1.7 h1:KfgG9LzI+pYjr4xvmz/5H4FXjokeP+rlHLhv3iH62Fo= github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok= github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= @@ -478,7 +492,6 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY= github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= -github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs= github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= @@ -490,10 +503,10 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+ github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= github.com/lib/pq v1.1.2-0.20190507191818-2ff3cb3adc01 h1:EPw7R3OAyxHBCyl0oqh3lUZqS5lu3KSxzzGasE0opXQ= github.com/lib/pq v1.1.2-0.20190507191818-2ff3cb3adc01/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= -github.com/magefile/mage v1.9.0 h1:t3AU2wNwehMCW97vuqQLtw6puppWXHO+O2MHo5a50XE= github.com/magefile/mage v1.9.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/magefile/mage v1.10.0 h1:3HiXzCUY12kh9bIuyXShaVe529fJfyqoVM42o/uom2g= github.com/magefile/mage v1.10.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= +github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ= github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.1 h1:mdxE1MF9o53iCb2Ghj1VfWvh7ZOwHpnVG/xwXrV90U8= github.com/mailru/easyjson v0.7.1/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs= @@ -543,7 +556,6 @@ github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.5.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo= github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.11.0 h1:JAKSXpt1YjtLA7YpPiqO9ss6sNXEsPfSGdwN0UHqzrw= github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= @@ -575,6 +587,7 @@ github.com/otiai10/mint v1.3.1 h1:BCmzIS3n71sGfHB5NMNDB3lHYPz8fWSkCAErHed//qc= github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc= github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2 h1:CXwSGu/LYmbjEab5aMCs5usQRVBGThelUKBNnoSOuso= github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2/go.mod h1:L3UMQOThbttwfYRNFOWLLVXMhk5Lkio4GGOtw5UrxS0= +github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/pierrec/lz4 v2.4.1+incompatible h1:mFe7ttWaflA46Mhqh+jUfjp2qTbPYxLB2/OyBppH9dg= github.com/pierrec/lz4 v2.4.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY= @@ -621,6 +634,7 @@ github.com/reviewdog/reviewdog v0.9.17 h1:MKb3rlQZgkEXr3d85iqtYNITXn7gDJr2kT0Ihg github.com/reviewdog/reviewdog v0.9.17/go.mod h1:Y0yPFDTi9L5ohkoecJdgbvAhq+dUXp+zI7atqVibwKg= github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= +github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g= github.com/samuel/go-parser v0.0.0-20130731160455-ca8abbf65d0e h1:hUGyBE/4CXRPThr4b6kt+f1CN90no4Fs5CNrYOKYSIg= github.com/samuel/go-parser v0.0.0-20130731160455-ca8abbf65d0e/go.mod h1:Sb6li54lXV0yYEjI4wX8cucdQ9gqUJV3+Ngg3l9g30I= github.com/samuel/go-thrift v0.0.0-20140522043831-2187045faa54 h1:jbchLJWyhKcmOjkbC4zDvT/n5EEd7g6hnnF760rEyRA= @@ -650,14 +664,22 @@ github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykE github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a h1:pa8hGb/2YqsZKovtsgrwcDH1RZhVbTKCjLp47XpqCDs= github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= +github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= +github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI= +github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= +github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= +github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ= -github.com/spf13/cobra v0.0.3 h1:ZlrZ4XsMRm04Fr5pSFxBgfND2EBVa1nLpiy1stUsX/8= -github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ= +github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s= +github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU= +github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= +github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48= @@ -666,9 +688,7 @@ github.com/stretchr/testify v1.1.5-0.20170601210322-f6abca593680/go.mod h1:a8OnR github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= -github.com/stretchr/testify v1.5.0 h1:DMOzIV76tmoDNE9pX6RSN0aDtCYeCg5VueieJaAo1uw= github.com/stretchr/testify v1.5.0/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= @@ -677,6 +697,11 @@ github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b h1:X/8hkb4rQq3+QuOxp github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b/go.mod h1:jAqhj/JBVC1PwcLTWd6rjQyGyItxxrhpiBl8LSuAGmw= github.com/tsg/gopacket v0.0.0-20200626092518-2ab8e397a786 h1:B/IVHYiI0d04dudYw+CvCAGqSMq8d0yWy56eD6p85BQ= github.com/tsg/gopacket v0.0.0-20200626092518-2ab8e397a786/go.mod h1:RIkfovP3Y7my19aXEjjbNd9E5TlHozzAyt7B8AaEcwg= +github.com/ugorji/go v1.1.8 h1:/D9x7IRpfMHDlizVOgxrag5Fh+/NY+LtI8bsr+AswRA= +github.com/ugorji/go v1.1.8/go.mod h1:0lNM99SwWUIRhCXnigEMClngXBk/EmpTXa7mgiewYWA= +github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= +github.com/ugorji/go/codec v1.1.8 h1:4dryPvxMP9OtkjIbuNeK2nb27M38XMHLGlfNSNph/5s= +github.com/ugorji/go/codec v1.1.8/go.mod h1:X00B19HDtwvKbQY2DcYjvZxKQp8mzrJoQ6EgoIY/D2E= github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/urso/diag v0.0.0-20200210123136-21b3cc8eb797 h1:OHNw/6pXODJAB32NujjdQO/KIYQ3KAbHQfCzH81XdCs= github.com/urso/diag v0.0.0-20200210123136-21b3cc8eb797/go.mod h1:pNWFTeQ+V1OYT/TzWpnWb6eQBdoXpdx+H+lrH97/Oyo= @@ -705,9 +730,9 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1: github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs= github.com/xeipuuv/gojsonschema v0.0.0-20181112162635-ac52e6811b56 h1:yhqBHs09SmmUoNOHc9jgK4a60T3XFRtPAkYxVnqgY50= github.com/xeipuuv/gojsonschema v0.0.0-20181112162635-ac52e6811b56/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs= +github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q= github.com/yuin/gopher-lua v0.0.0-20170403160031-b402f3114ec7 h1:0gYLpmzecnaDCoeWxSfEJ7J1b6B/67+NV++4HKQXx+Y= github.com/yuin/gopher-lua v0.0.0-20170403160031-b402f3114ec7/go.mod h1:aEV29XrmTYFr3CiRxZeGHpkvbwq+prZduBqMaascyCU= -go.elastic.co/apm v1.7.2 h1:0nwzVIPp4PDBXSYYtN19+1W5V+sj+C25UjqxDVoKcA8= go.elastic.co/apm v1.7.2/go.mod h1:tCw6CkOJgkWnzEthFN9HUP1uL3Gjc/Ur6m7gRPLaoH0= go.elastic.co/apm v1.8.1-0.20200909061013-2aef45b9cf4b h1:Sf+V3eV91ZuXjF3824SABFgXU+z4ZEuIX5ikDvt2lCE= go.elastic.co/apm v1.8.1-0.20200909061013-2aef45b9cf4b/go.mod h1:qoOSi09pnzJDh5fKnfY7bPmQgl8yl2tULdOu03xhui0= @@ -717,7 +742,6 @@ go.elastic.co/apm/module/apmhttp v1.7.2 h1:2mRh7SwBuEVLmJlX+hsMdcSg9xaielCLElaPn go.elastic.co/apm/module/apmhttp v1.7.2/go.mod h1:sTFWiWejnhSdZv6+dMgxGec2Nxe/ZKfHfz/xtRM+cRY= go.elastic.co/ecszap v0.1.1-0.20200424093508-cdd95a104193 h1:NjYJ/beChqugXSavTkH5tF6shvr/is8jdgJ331wfwT8= go.elastic.co/ecszap v0.1.1-0.20200424093508-cdd95a104193/go.mod h1:HTUi+QRmr3EuZMqxPX+5fyOdMNfUu5iPebgfhgsTJYQ= -go.elastic.co/fastjson v1.0.0 h1:ooXV/ABvf+tBul26jcVViPT3sBir0PvXgibYB1IQQzg= go.elastic.co/fastjson v1.0.0/go.mod h1:PmeUOMMtLHQr9ZS9J9owrAVg0FkaZDRZJEFTTGHtchs= go.elastic.co/fastjson v1.1.0 h1:3MrGBWWVIxe/xvsbpghtkFoPciPhOCmjsR/HfwEeQR4= go.elastic.co/fastjson v1.1.0/go.mod h1:boNGISWMjQsUPy/t6yqt2/1Wx4YNPSe+mZjlyw9vKKI= @@ -741,6 +765,7 @@ go.uber.org/zap v1.14.0 h1:/pduUoebOeeJzTDFuoMgC6nRkiasr1sBCIEorly7m4o= go.uber.org/zap v1.14.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM= golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= @@ -767,7 +792,6 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f h1:J5lckAjkw6qYlOZNj90mLYNTEKDvWeuc1yieZ8qUzUE= golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs= golang.org/x/lint v0.0.0-20200130185559-910be7a94367 h1:0IiAsCRByjO2QjX7ZPkw5oU9x+n1YqRL802rjC0c3Aw= golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= @@ -801,7 +825,6 @@ golang.org/x/net v0.0.0-20191021144547-ec77196f6094/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200202094626-16171245cfb2 h1:CCH4IOTTfewWjGOlSp+zGcjutRKlBEZQ6wTn8ozI/nI= golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -818,7 +841,6 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a h1:WXEvlFVvvGxCJLG6REjsT03iWnKLEWinaScsxF2Vm2o= golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -827,6 +849,7 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -840,6 +863,7 @@ golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190529164535-6a60838ec259/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -848,12 +872,9 @@ golang.org/x/sys v0.0.0-20191025021431-6c3a3bfe00ae/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200102141924-c96a22e43c9c h1:OYFUffxXPezb7BVTx9AaD4Vl0qtxmklBIkwCKH1YwDY= golang.org/x/sys v0.0.0-20200102141924-c96a22e43c9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e h1:LwyF2AFISC9nVbS6MgzsaQNSUsRXI49GS+YQ5KX/QH0= golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 h1:ogLJMz+qpzav7lGMh10LMvAkM/fAoGlaiiHYiFYdm80= golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo= golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -904,7 +925,6 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= -google.golang.org/grpc v1.27.1 h1:zvIju4sqAGvwKspUQOhwnpcqSbzi7/H6QomNNjTL4sk= google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.29.1 h1:EC2SB8S04d2r73uptxphDSUG+kTKVgjRPF+N3xpxRB4= google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= @@ -916,7 +936,6 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM= google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U= -gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -948,7 +967,6 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU= gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= diff --git a/libbeat/tests/system/test_cmd_completion.py b/libbeat/tests/system/test_cmd_completion.py index 2e523c0831d..a06259a5046 100644 --- a/libbeat/tests/system/test_cmd_completion.py +++ b/libbeat/tests/system/test_cmd_completion.py @@ -17,7 +17,7 @@ def test_bash_completion(self): def test_zsh_completion(self): exit_code = self.run_beat(extra_args=["completion", "zsh"]) assert exit_code == 0 - assert self.log_contains("#compdef mockbeat") + assert self.log_contains("#compdef _mockbeat mockbeat") def test_unknown_completion(self): exit_code = self.run_beat(extra_args=["completion", "awesomeshell"]) diff --git a/x-pack/libbeat/common/cloudfoundry/cache.go b/x-pack/libbeat/common/cloudfoundry/cache.go index 22f41f3b23c..0f19818666e 100644 --- a/x-pack/libbeat/common/cloudfoundry/cache.go +++ b/x-pack/libbeat/common/cloudfoundry/cache.go @@ -5,13 +5,16 @@ package cloudfoundry import ( + "crypto/sha1" + "encoding/base64" "fmt" "time" "github.com/cloudfoundry-community/go-cfclient" + "github.com/pkg/errors" - "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/x-pack/libbeat/persistentcache" ) // cfClient interface is provided so unit tests can mock the actual client. @@ -22,65 +25,113 @@ type cfClient interface { // clientCacheWrap wraps the cloudfoundry client to add a cache in front of GetAppByGuid. type clientCacheWrap struct { - cache *common.Cache + cache *persistentcache.PersistentCache client cfClient log *logp.Logger errorTTL time.Duration } // newClientCacheWrap creates a new cache for application data. -func newClientCacheWrap(client cfClient, ttl time.Duration, errorTTL time.Duration, log *logp.Logger) *clientCacheWrap { +func newClientCacheWrap(client cfClient, cacheName string, ttl time.Duration, errorTTL time.Duration, log *logp.Logger) (*clientCacheWrap, error) { + options := persistentcache.Options{ + Timeout: ttl, + } + + name := "cloudfoundry" + if cacheName != "" { + name = name + "-" + sanitizeCacheName(cacheName) + } + + cache, err := persistentcache.New(name, options) + if err != nil { + return nil, fmt.Errorf("creating metadata cache: %w", err) + } + return &clientCacheWrap{ - cache: common.NewCacheWithExpireOnAdd(ttl, 100), + cache: cache, client: client, errorTTL: errorTTL, log: log, - } + }, nil } type appResponse struct { - app *cfclient.App - err error + App AppMeta `json:"a"` + Error cfclient.CloudFoundryError `json:"e,omitempty"` + ErrorMessage string `json:"em,omitempty"` +} + +func (r *appResponse) fromStructs(app cfclient.App, err error) { + if err != nil { + cause := errors.Cause(err) + if cferr, ok := cause.(cfclient.CloudFoundryError); ok { + r.Error = cferr + } + r.ErrorMessage = err.Error() + return + } + r.App = AppMeta{ + Name: app.Name, + Guid: app.Guid, + SpaceName: app.SpaceData.Entity.Name, + SpaceGuid: app.SpaceData.Meta.Guid, + OrgName: app.SpaceData.Entity.OrgData.Entity.Name, + OrgGuid: app.SpaceData.Entity.OrgData.Meta.Guid, + } +} + +func (r *appResponse) toStructs() (*AppMeta, error) { + var empty cfclient.CloudFoundryError + if r.Error != empty { + // Wrapping the error so cfclient.IsAppNotFoundError can identify it + return nil, errors.Wrap(r.Error, r.ErrorMessage) + } + if len(r.ErrorMessage) > 0 { + return nil, errors.New(r.ErrorMessage) + } + return &r.App, nil } // fetchApp uses the cfClient to retrieve an App entity and // stores it in the internal cache -func (c *clientCacheWrap) fetchAppByGuid(guid string) (*cfclient.App, error) { +func (c *clientCacheWrap) fetchAppByGuid(guid string) (*AppMeta, error) { app, err := c.client.GetAppByGuid(guid) - resp := appResponse{ - app: &app, - err: err, - } + var resp appResponse + resp.fromStructs(app, err) timeout := time.Duration(0) if err != nil { // Cache nil, because is what we want to return when there was an error - resp.app = nil timeout = c.errorTTL } - c.cache.PutWithTimeout(guid, &resp, timeout) - return resp.app, resp.err + err = c.cache.PutWithTimeout(guid, resp, timeout) + if err != nil { + return nil, fmt.Errorf("storing app response in cache: %w", err) + } + return resp.toStructs() } // GetApp returns CF Application info, either from the cache or // using the CF client. -func (c *clientCacheWrap) GetAppByGuid(guid string) (*cfclient.App, error) { - cachedResp := c.cache.Get(guid) - if cachedResp == nil { +func (c *clientCacheWrap) GetAppByGuid(guid string) (*AppMeta, error) { + var resp appResponse + err := c.cache.Get(guid, &resp) + if err != nil { return c.fetchAppByGuid(guid) } - resp, ok := cachedResp.(*appResponse) - if !ok { - return nil, fmt.Errorf("error converting cached app response (of type %T), this is likely a bug", cachedResp) - } - return resp.app, resp.err + return resp.toStructs() } -// StartJanitor starts a goroutine that will periodically clean the applications cache. -func (c *clientCacheWrap) StartJanitor(interval time.Duration) { - c.cache.StartJanitor(interval) +// Close release resources associated with this client +func (c *clientCacheWrap) Close() error { + err := c.cache.Close() + if err != nil { + return fmt.Errorf("closing cache: %w", err) + } + return nil } -// StopJanitor stops the goroutine that periodically clean the applications cache. -func (c *clientCacheWrap) StopJanitor() { - c.cache.StopJanitor() +// sanitizeCacheName returns a unique string that can be used safely as part of a file name +func sanitizeCacheName(name string) string { + hash := sha1.Sum([]byte(name)) + return base64.RawURLEncoding.EncodeToString(hash[:]) } diff --git a/x-pack/libbeat/common/cloudfoundry/cache_integration_test.go b/x-pack/libbeat/common/cloudfoundry/cache_integration_test.go index f6af11787c9..f799cc0615f 100644 --- a/x-pack/libbeat/common/cloudfoundry/cache_integration_test.go +++ b/x-pack/libbeat/common/cloudfoundry/cache_integration_test.go @@ -31,7 +31,7 @@ func TestGetApps(t *testing.T) { client, err := hub.Client() require.NoError(t, err) - apps, err := client.(*clientCacheWrap).client.(*cfclient.Client).ListApps() + apps, err := client.ListApps() require.NoError(t, err) t.Logf("%d applications available", len(apps)) @@ -40,8 +40,9 @@ func TestGetApps(t *testing.T) { if len(apps) == 0 { t.Skip("no apps in account?") } - client, err := hub.Client() + client, err := hub.ClientWithCache() require.NoError(t, err) + defer client.Close() guid := apps[0].Guid app, err := client.GetAppByGuid(guid) @@ -50,13 +51,15 @@ func TestGetApps(t *testing.T) { }) t.Run("handle error when application is not available", func(t *testing.T) { - client, err := hub.Client() + client, err := hub.ClientWithCache() require.NoError(t, err) + defer client.Close() testNotExists := func(t *testing.T) { app, err := client.GetAppByGuid("notexists") assert.Nil(t, app) - assert.True(t, cfclient.IsAppNotFoundError(err)) + assert.Error(t, err) + assert.True(t, cfclient.IsAppNotFoundError(err), "Error found: %v", err) } var firstTimeDuration time.Duration diff --git a/x-pack/libbeat/common/cloudfoundry/cache_test.go b/x-pack/libbeat/common/cloudfoundry/cache_test.go index 9e18a5ac86e..b345beff226 100644 --- a/x-pack/libbeat/common/cloudfoundry/cache_test.go +++ b/x-pack/libbeat/common/cloudfoundry/cache_test.go @@ -13,19 +13,25 @@ import ( "github.com/cloudfoundry-community/go-cfclient" "github.com/gofrs/uuid" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/elastic/beats/v7/libbeat/logp" ) func TestClientCacheWrap(t *testing.T) { - ttl := 500 * time.Millisecond + if testing.Short() { + t.Skip("skipping in short mode") + } + + ttl := 2 * time.Second guid := mustCreateFakeGuid() app := cfclient.App{ - Guid: guid, - Memory: 1, // use this field to track if from cache or from client + Guid: guid, + Name: "Foo", // use this field to track if from cache or from client } fakeClient := &fakeCFClient{app, 0} - cache := newClientCacheWrap(fakeClient, ttl, ttl, logp.NewLogger("cloudfoundry")) + cache, err := newClientCacheWrap(fakeClient, "test", ttl, ttl, logp.NewLogger("cloudfoundry")) + require.NoError(t, err) missingAppGuid := mustCreateFakeGuid() @@ -44,25 +50,28 @@ func TestClientCacheWrap(t *testing.T) { // fetched from client for the first time one, err = cache.GetAppByGuid(guid) assert.NoError(t, err) - assert.Equal(t, app, *one) + assert.Equal(t, app.Guid, one.Guid) + assert.Equal(t, app.Name, one.Name) assert.Equal(t, 2, fakeClient.callCount) // updated app in fake client, new fetch should not have updated app updatedApp := cfclient.App{ - Guid: guid, - Memory: 2, + Guid: guid, + Name: "Bar", } fakeClient.app = updatedApp two, err := cache.GetAppByGuid(guid) assert.NoError(t, err) - assert.Equal(t, app, *two) + assert.Equal(t, app.Guid, two.Guid) + assert.Equal(t, app.Name, two.Name) assert.Equal(t, 2, fakeClient.callCount) // wait the ttl, then it should have updated app time.Sleep(ttl) three, err := cache.GetAppByGuid(guid) assert.NoError(t, err) - assert.Equal(t, updatedApp, *three) + assert.Equal(t, updatedApp.Guid, three.Guid) + assert.Equal(t, updatedApp.Name, three.Name) assert.Equal(t, 3, fakeClient.callCount) } diff --git a/x-pack/libbeat/common/cloudfoundry/hub.go b/x-pack/libbeat/common/cloudfoundry/hub.go index 4bb7fce1eec..4cf9757c278 100644 --- a/x-pack/libbeat/common/cloudfoundry/hub.go +++ b/x-pack/libbeat/common/cloudfoundry/hub.go @@ -5,10 +5,8 @@ package cloudfoundry import ( - "fmt" "net/http" "strings" - "time" "github.com/cloudfoundry-community/go-cfclient" "github.com/pkg/errors" @@ -19,11 +17,20 @@ import ( // Client interface exposed by Hub.Client. type Client interface { // GetAppByGuid returns the application from cloudfoundry. - GetAppByGuid(guid string) (*cfclient.App, error) - // StartJanitor keeps the cache of applications clean. - StartJanitor(interval time.Duration) - // StopJanitor stops the running janitor. - StopJanitor() + GetAppByGuid(guid string) (*AppMeta, error) + + // Close releases resources associated with this client. + Close() error +} + +// AppMeta is the metadata associated with a cloudfoundry application +type AppMeta struct { + Guid string `json:"guid"` + Name string `json:"name"` + SpaceGuid string `json:"space_guid"` + SpaceName string `json:"space_name"` + OrgGuid string `json:"org_guid"` + OrgName string `json:"org_name"` } // Hub is central place to get all the required clients to communicate with cloudfoundry. @@ -39,7 +46,7 @@ func NewHub(cfg *Config, userAgent string, log *logp.Logger) *Hub { } // Client returns the cloudfoundry client. -func (h *Hub) Client() (Client, error) { +func (h *Hub) Client() (*cfclient.Client, error) { httpClient, insecure, err := h.httpClient() if err != nil { return nil, err @@ -67,7 +74,15 @@ func (h *Hub) Client() (Client, error) { if h.cfg.UaaAddress != "" { cf.Endpoint.AuthEndpoint = h.cfg.UaaAddress } - return newClientCacheWrap(cf, h.cfg.CacheDuration, h.cfg.CacheRetryDelay, h.log), nil + return cf, nil +} + +func (h *Hub) ClientWithCache() (Client, error) { + c, err := h.Client() + if err != nil { + return nil, err + } + return newClientCacheWrap(c, h.cfg.APIAddress, h.cfg.CacheDuration, h.cfg.CacheRetryDelay, h.log) } // RlpListener returns a listener client that calls the passed callback when the provided events are streamed through @@ -85,7 +100,7 @@ func (h *Hub) RlpListener(callbacks RlpListenerCallbacks) (*RlpListener, error) // // In the case that the cloudfoundry client was already needed by the code path, call this method // as not to create a intermediate client that will not be used. -func (h *Hub) RlpListenerFromClient(client Client, callbacks RlpListenerCallbacks) (*RlpListener, error) { +func (h *Hub) RlpListenerFromClient(client *cfclient.Client, callbacks RlpListenerCallbacks) (*RlpListener, error) { var rlpAddress string if h.cfg.RlpAddress != "" { rlpAddress = h.cfg.RlpAddress @@ -107,47 +122,29 @@ func (h *Hub) DopplerConsumer(callbacks DopplerCallbacks) (*DopplerConsumer, err return h.DopplerConsumerFromClient(client, callbacks) } -func (h *Hub) DopplerConsumerFromClient(client Client, callbacks DopplerCallbacks) (*DopplerConsumer, error) { +func (h *Hub) DopplerConsumerFromClient(client *cfclient.Client, callbacks DopplerCallbacks) (*DopplerConsumer, error) { dopplerAddress := h.cfg.DopplerAddress if dopplerAddress == "" { - endpoint, err := cfEndpoint(client) - if err != nil { - return nil, errors.Wrap(err, "getting endpoints from client") - } - dopplerAddress = endpoint.DopplerEndpoint + dopplerAddress = client.Endpoint.DopplerEndpoint } httpClient, _, err := h.httpClient() if err != nil { return nil, errors.Wrap(err, "getting http client") } - // TODO: Refactor Client so it is easier to access the cfclient - ccw, ok := client.(*clientCacheWrap) - if !ok { - return nil, fmt.Errorf("client without cache wrap") - } - cfc, ok := ccw.client.(*cfclient.Client) - if !ok { - return nil, fmt.Errorf("client is not a cloud foundry client") - } - - tr := TokenRefresherFromCfClient(cfc) + tr := TokenRefresherFromCfClient(client) return newDopplerConsumer(dopplerAddress, h.cfg.ShardID, h.log, httpClient, tr, callbacks) } // doerFromClient returns an auth token doer using uaa. -func (h *Hub) doerFromClient(client Client) (*authTokenDoer, error) { +func (h *Hub) doerFromClient(client *cfclient.Client) (*authTokenDoer, error) { httpClient, _, err := h.httpClient() if err != nil { return nil, err } url := h.cfg.UaaAddress if url == "" { - endpoint, err := cfEndpoint(client) - if err != nil { - return nil, errors.Wrap(err, "getting endpoints from client") - } - url = endpoint.AuthEndpoint + url = client.Endpoint.AuthEndpoint } return newAuthTokenDoer(url, h.cfg.ClientID, h.cfg.ClientSecret, httpClient, h.log), nil } @@ -165,18 +162,6 @@ func (h *Hub) httpClient() (*http.Client, bool, error) { return httpClient, tls.InsecureSkipVerify, nil } -func cfEndpoint(client Client) (cfclient.Endpoint, error) { - ccw, ok := client.(*clientCacheWrap) - if !ok { - return cfclient.Endpoint{}, fmt.Errorf("client without cache wrap") - } - cfc, ok := ccw.client.(*cfclient.Client) - if !ok { - return cfclient.Endpoint{}, fmt.Errorf("client is not a cloud foundry client") - } - return cfc.Endpoint, nil -} - // defaultTransport returns a new http.Transport for http.Client func defaultTransport() *http.Transport { defaultTransport := http.DefaultTransport.(*http.Transport) diff --git a/x-pack/libbeat/common/cloudfoundry/main_test.go b/x-pack/libbeat/common/cloudfoundry/main_test.go new file mode 100644 index 00000000000..ec352def825 --- /dev/null +++ b/x-pack/libbeat/common/cloudfoundry/main_test.go @@ -0,0 +1,29 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package cloudfoundry + +import ( + "fmt" + "io/ioutil" + "os" + "testing" + + "github.com/elastic/beats/v7/libbeat/paths" +) + +func TestMain(m *testing.M) { + // Override global beats data dir to avoid creating directories in the working copy. + tmpdir, err := ioutil.TempDir("", "beats-data-dir") + if err != nil { + fmt.Printf("Failed to create temporal data directory: %v\n", err) + os.Exit(1) + } + paths.Paths.Data = tmpdir + + result := m.Run() + os.RemoveAll(tmpdir) + + os.Exit(result) +} diff --git a/x-pack/libbeat/persistentcache/encoding.go b/x-pack/libbeat/persistentcache/encoding.go new file mode 100644 index 00000000000..60b2058ebf4 --- /dev/null +++ b/x-pack/libbeat/persistentcache/encoding.go @@ -0,0 +1,55 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package persistentcache + +import ( + "bytes" + "encoding/json" + + ugorjicodec "github.com/ugorji/go/codec" +) + +type codec interface { + Decode([]byte, interface{}) error + Encode(interface{}) ([]byte, error) +} + +type jsonCodec struct{} + +func newJSONCodec() *jsonCodec { + return &jsonCodec{} +} + +// Encode encodes an object in json format. +func (*jsonCodec) Encode(v interface{}) ([]byte, error) { + return json.Marshal(v) +} + +// Decode decodes an object from its json representation. +func (*jsonCodec) Decode(d []byte, v interface{}) error { + return json.Unmarshal(d, v) +} + +type cborCodec struct { + handle ugorjicodec.CborHandle +} + +func newCBORCodec() *cborCodec { + return &cborCodec{} +} + +// Encode encodes an object in cbor format. +func (c *cborCodec) Encode(v interface{}) ([]byte, error) { + var buf bytes.Buffer + enc := ugorjicodec.NewEncoder(&buf, &c.handle) + err := enc.Encode(v) + return buf.Bytes(), err +} + +// Decode decodes an object from its cbor representation. +func (c *cborCodec) Decode(d []byte, v interface{}) error { + dec := ugorjicodec.NewDecoder(bytes.NewReader(d), &c.handle) + return dec.Decode(v) +} diff --git a/x-pack/libbeat/persistentcache/persistentcache.go b/x-pack/libbeat/persistentcache/persistentcache.go new file mode 100644 index 00000000000..39721095b86 --- /dev/null +++ b/x-pack/libbeat/persistentcache/persistentcache.go @@ -0,0 +1,112 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package persistentcache + +import ( + "fmt" + "time" + + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/paths" +) + +const ( + cacheFile = "cache" + gcPeriod = 5 * time.Minute +) + +// PersistentCache is a persistent map of keys to values. Elements added to the +// cache are stored until they are explicitly deleted or are expired due to time-based +// eviction based on last access or add time. +type PersistentCache struct { + log *logp.Logger + + store *Store + codec codec + + refreshOnAccess bool + timeout time.Duration +} + +// Options are the options that can be used to customize persistent caches +type Options struct { + // Length of time before cache elements expire + Timeout time.Duration + + // If set to true, expiration time of an entry is updated + // when the object is accessed. + RefreshOnAccess bool + + // If empty, beats data path is used. + RootPath string +} + +// New creates and returns a new persistent cache. +// Cache returned by this method must be closed with Close() when +// not needed anymore. +func New(name string, opts Options) (*PersistentCache, error) { + logger := logp.NewLogger("persistentcache") + + rootPath := opts.RootPath + if rootPath == "" { + rootPath = paths.Resolve(paths.Data, cacheFile) + } + store, err := newStore(logger, rootPath, name) + if err != nil { + return nil, err + } + + return &PersistentCache{ + log: logger, + store: store, + codec: newCBORCodec(), + + refreshOnAccess: opts.RefreshOnAccess, + timeout: opts.Timeout, + }, nil +} + +// Put writes the given key and value to the map replacing any +// existing value if it exists. +func (c *PersistentCache) Put(k string, v interface{}) error { + return c.PutWithTimeout(k, v, 0) +} + +// PutWithTimeout writes the given key and value to the map replacing any +// existing value if it exists. +// The cache expiration time will be overwritten by timeout of the key being +// inserted. +func (c *PersistentCache) PutWithTimeout(k string, v interface{}, timeout time.Duration) error { + d, err := c.codec.Encode(v) + if err != nil { + return fmt.Errorf("encoding item to store in cache: %w", err) + } + if timeout == 0 { + timeout = c.timeout + } + return c.store.Set([]byte(k), d, timeout) +} + +// Get the current value associated with a key or nil if the key is not +// present. The last access time of the element is updated. +func (c *PersistentCache) Get(k string, v interface{}) error { + d, err := c.store.Get([]byte(k)) + if err != nil { + return err + } + if c.refreshOnAccess && c.timeout > 0 { + c.store.Set([]byte(k), d, c.timeout) + } + err = c.codec.Decode(d, v) + if err != nil { + return fmt.Errorf("decoding item stored in cache: %w", err) + } + return nil +} + +// Close releases all resources associated with this cache. +func (c *PersistentCache) Close() error { + return c.store.Close() +} diff --git a/x-pack/libbeat/persistentcache/persistentcache_test.go b/x-pack/libbeat/persistentcache/persistentcache_test.go new file mode 100644 index 00000000000..f6f28d73b75 --- /dev/null +++ b/x-pack/libbeat/persistentcache/persistentcache_test.go @@ -0,0 +1,436 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package persistentcache + +import ( + "fmt" + "io/ioutil" + "math/rand" + "os" + "path/filepath" + "strconv" + "testing" + "time" + + "github.com/gofrs/uuid" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +func TestPutGet(t *testing.T) { + logp.TestingSetup() + t.Parallel() + + cache, err := New("test", testOptions(t)) + require.NoError(t, err) + defer cache.Close() + + type valueType struct { + Something string + } + + var key = "somekey" + var value = valueType{Something: "foo"} + + err = cache.Put(key, value) + assert.NoError(t, err) + + var result valueType + err = cache.Get(key, &result) + assert.NoError(t, err) + assert.Equal(t, value, result) + + err = cache.Get("notexist", &result) + assert.Error(t, err) +} + +func TestPersist(t *testing.T) { + logp.TestingSetup() + t.Parallel() + + options := testOptions(t) + + cache, err := New("test", options) + require.NoError(t, err) + + type valueType struct { + Something string + } + + var key = "somekey" + var value = valueType{Something: "foo"} + + err = cache.Put(key, value) + assert.NoError(t, err) + + err = cache.Close() + assert.NoError(t, err) + + cache, err = New("test", options) + require.NoError(t, err) + defer cache.Close() + + var result valueType + err = cache.Get(key, &result) + assert.NoError(t, err) + assert.Equal(t, value, result) +} + +func TestExpired(t *testing.T) { + if testing.Short() { + t.Skip("skipping in short mode") + } + logp.TestingSetup() + t.Parallel() + + options := testOptions(t) + cache, err := New("test", options) + require.NoError(t, err) + defer cache.Close() + + type valueType struct { + Something string + } + + var key = "somekey" + var value = valueType{Something: "foo"} + + // Badger TTL is not reliable on sub-second durations. + err = cache.PutWithTimeout(key, value, 2*time.Second) + assert.NoError(t, err) + + var result valueType + err = cache.Get(key, &result) + assert.NoError(t, err) + assert.Equal(t, value, result) + + time.Sleep(2 * time.Second) + err = cache.Get(key, &result) + assert.Error(t, err) +} + +func TestRefreshOnAccess(t *testing.T) { + t.Skip("flaky test") + + if testing.Short() { + t.Skip("skipping in short mode") + } + + logp.TestingSetup() + t.Parallel() + + // Badger TTL is not reliable on sub-second durations. + options := testOptions(t) + options.Timeout = 2 * time.Second + options.RefreshOnAccess = true + + cache, err := New("test", options) + require.NoError(t, err) + defer cache.Close() + + type valueType struct { + Something string + } + + var key1 = "somekey" + var value1 = valueType{Something: "foo"} + var key2 = "otherkey" + var value2 = valueType{Something: "bar"} + + err = cache.Put(key1, value1) + assert.NoError(t, err) + err = cache.Put(key2, value2) + assert.NoError(t, err) + + time.Sleep(1 * time.Second) + + var result valueType + err = cache.Get(key1, &result) + assert.NoError(t, err) + assert.Equal(t, value1, result) + + time.Sleep(1 * time.Second) + + err = cache.Get(key1, &result) + assert.NoError(t, err) + assert.Equal(t, value1, result) + err = cache.Get(key2, &result) + assert.Error(t, err) +} + +var benchmarkCacheSizes = []int{10, 100, 1000, 10000, 100000} + +func BenchmarkPut(b *testing.B) { + type cache interface { + Put(key string, value interface{}) error + Close() error + } + + options := testOptions(b) + newPersistentCache := func(tb testing.TB, name string) cache { + cache, err := New(name, options) + require.NoError(tb, err) + return cache + } + + caches := []struct { + name string + factory func(t testing.TB, name string) cache + }{ + {name: "badger", factory: newPersistentCache}, + } + + b.Run("random strings", func(b *testing.B) { + for _, c := range caches { + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + cache := c.factory(b, b.Name()) + defer cache.Close() + + value := uuid.Must(uuid.NewV4()).String() + + b.ResetTimer() + for i := 0; i < b.N; i++ { + err := cache.Put(strconv.Itoa(i), value) + if err != nil { + b.Fatal(err) + } + } + b.StopTimer() + }) + } + }) + + b.Run("objects", func(b *testing.B) { + for _, c := range caches { + type entry struct { + ID string + Data [128]byte + } + + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + cache := c.factory(b, b.Name()) + defer cache.Close() + + value := entry{ID: uuid.Must(uuid.NewV4()).String()} + + b.ResetTimer() + for i := 0; i < b.N; i++ { + err := cache.Put(strconv.Itoa(i), value) + if err != nil { + b.Fatal(err) + } + } + b.StopTimer() + }) + } + }) + + b.Run("maps", func(b *testing.B) { + for _, c := range caches { + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + cache := c.factory(b, b.Name()) + defer cache.Close() + + value := map[string]string{ + "id": uuid.Must(uuid.NewV4()).String(), + } + + b.ResetTimer() + for i := 0; i < b.N; i++ { + err := cache.Put(strconv.Itoa(i), value) + if err != nil { + b.Fatal(err) + } + } + b.StopTimer() + }) + } + }) + + for _, size := range benchmarkCacheSizes { + b.Run(fmt.Sprintf("%d objects", size), func(b *testing.B) { + type entry struct { + ID string + Data [128]byte + } + objects := make([]entry, size) + for i := 0; i < size; i++ { + objects[i] = entry{ + ID: uuid.Must(uuid.NewV4()).String(), + } + } + + for _, c := range caches { + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + for i := 0; i < b.N; i++ { + cache := c.factory(b, b.Name()) + for _, object := range objects { + cache.Put(object.ID, object) + } + cache.Close() + } + }) + } + }) + } +} + +func BenchmarkOpen(b *testing.B) { + type cache interface { + Put(key string, value interface{}) error + Close() error + } + + options := testOptions(b) + newPersistentCache := func(tb testing.TB, name string) cache { + cache, err := New(name, options) + require.NoError(tb, err) + return cache + } + + caches := []struct { + name string + factory func(t testing.TB, name string) cache + }{ + {name: "badger", factory: newPersistentCache}, + } + + for _, size := range benchmarkCacheSizes { + b.Run(fmt.Sprintf("%d objects", size), func(b *testing.B) { + type entry struct { + ID string + Data [128]byte + } + + for _, c := range caches { + cacheName := b.Name() + cache := c.factory(b, cacheName) + for i := 0; i < size; i++ { + e := entry{ + ID: uuid.Must(uuid.NewV4()).String(), + } + err := cache.Put(e.ID, e) + require.NoError(b, err) + } + cache.Close() + + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + for i := 0; i < b.N; i++ { + cache := c.factory(b, cacheName) + cache.Close() + } + }) + } + }) + } +} + +func BenchmarkGet(b *testing.B) { + type cache interface { + Put(key string, value interface{}) error + Get(key string, value interface{}) error + Close() error + } + + options := testOptions(b) + newPersistentCache := func(tb testing.TB, name string) cache { + cache, err := New(name, options) + require.NoError(tb, err) + return cache + } + + caches := []struct { + name string + factory func(t testing.TB, name string) cache + }{ + {name: "badger", factory: newPersistentCache}, + } + + for _, size := range benchmarkCacheSizes { + b.Run(fmt.Sprintf("%d objects", size), func(b *testing.B) { + for _, c := range caches { + type entry struct { + ID string + Data [128]byte + } + + cacheName := b.Name() + + objects := make([]entry, size) + cache := c.factory(b, cacheName) + for i := 0; i < size; i++ { + e := entry{ + ID: uuid.Must(uuid.NewV4()).String(), + } + objects[i] = e + err := cache.Put(e.ID, e) + require.NoError(b, err) + } + cache.Close() + + b.Run(c.name, func(b *testing.B) { + b.ReportAllocs() + + cache := c.factory(b, cacheName) + + var result entry + + b.ResetTimer() + for i := 0; i < b.N; i++ { + expected := objects[rand.Intn(size)] + cache.Get(expected.ID, &result) + if expected.ID != result.ID { + b.Fatalf("%s != %s", expected.ID, result.ID) + } + } + b.StopTimer() + cache.Close() + }) + } + }) + } +} + +func testOptions(t testing.TB) Options { + t.Helper() + + tempDir, err := ioutil.TempDir("", "beat-data-dir-") + require.NoError(t, err) + + t.Cleanup(func() { os.RemoveAll(tempDir) }) + + return Options{ + RootPath: filepath.Join(tempDir, cacheFile), + } +} + +func dirSize(tb testing.TB, path string) int64 { + var size int64 + + err := filepath.Walk(path, func(_ string, info os.FileInfo, err error) error { + if err != nil { + return err + } + if !info.IsDir() { + size += info.Size() + } + return nil + }) + require.NoError(tb, err) + + return size +} diff --git a/x-pack/libbeat/persistentcache/store.go b/x-pack/libbeat/persistentcache/store.go new file mode 100644 index 00000000000..589fc724e01 --- /dev/null +++ b/x-pack/libbeat/persistentcache/store.go @@ -0,0 +1,141 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package persistentcache + +import ( + "fmt" + "os" + "path/filepath" + "time" + + badger "github.com/dgraph-io/badger/v2" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +// Store is a store for a persistent cache. It can be shared between consumers. +type Store struct { + logger *logp.Logger + name string + + gcQuit chan struct{} + db *badger.DB +} + +// newStore opens a store persisted on the specified directory, with the specified name. +// If succeeds, returned store must be closed. +func newStore(logger *logp.Logger, dir, name string) (*Store, error) { + dbPath := filepath.Join(dir, name) + err := os.MkdirAll(dbPath, 0750) + if err != nil { + return nil, fmt.Errorf("creating directory for cache store: %w", err) + } + + // Opinionated options for the use of badger as a store for metadata caches in Beats. + options := badger.DefaultOptions(dbPath) + options.Logger = badgerLogger{logger.Named("badger")} + // TODO: Disabling sync writes gives better performance, and data loss wouldn't + // be a problem for caches. But we are not properly closing processors yet, so let + // sync on writes by now. + // options.SyncWrites = false + + db, err := badger.Open(options) + if err != nil { + return nil, fmt.Errorf("opening database for cache store: %w", err) + } + + store := Store{ + db: db, + logger: logger, + name: name, + gcQuit: make(chan struct{}), + } + go store.runGC(gcPeriod) + return &store, nil +} + +// Close closes the store. +func (s *Store) Close() error { + s.stopGC() + err := s.db.Close() + if err != nil { + return fmt.Errorf("closing database of cache store: %w", err) + } + return nil +} + +// Set sets a value with a ttl in the store. If ttl is zero, it is ignored. +func (s *Store) Set(k, v []byte, ttl time.Duration) error { + entry := badger.Entry{ + Key: []byte(k), + Value: v, + } + if ttl > 0 { + entry.WithTTL(ttl) + } + err := s.db.Update(func(txn *badger.Txn) error { + return txn.SetEntry(&entry) + }) + if err != nil { + return fmt.Errorf("setting value in cache store: %w", err) + } + return err +} + +// Get gets a value from the store. +func (s *Store) Get(k []byte) ([]byte, error) { + var result []byte + err := s.db.View(func(txn *badger.Txn) error { + item, err := txn.Get(k) + if err != nil { + return err + } + result, err = item.ValueCopy(nil) + if err != nil { + return err + } + return nil + }) + if err != nil { + return nil, fmt.Errorf("getting value from cache store: %w", err) + } + return result, nil +} + +// runGC starts garbage collection in the store. +func (s *Store) runGC(period time.Duration) { + ticker := time.NewTicker(period) + defer ticker.Stop() + for { + select { + case <-ticker.C: + var err error + count := 0 + for err == nil { + err = s.db.RunValueLogGC(0.5) + count++ + } + s.logger.Debugf("Result of garbage collector after running %d times: %s", count, err) + case <-s.gcQuit: + return + } + } + +} + +// stopGC stops garbage collection in the store. +func (s *Store) stopGC() { + close(s.gcQuit) +} + +// badgerLogger is an adapter between a logp logger and the loggers expected by badger. +type badgerLogger struct { + *logp.Logger +} + +// Warningf logs a message at the warning level. +func (l badgerLogger) Warningf(format string, args ...interface{}) { + l.Warnf(format, args...) +} diff --git a/x-pack/libbeat/persistentcache/store_test.go b/x-pack/libbeat/persistentcache/store_test.go new file mode 100644 index 00000000000..efa51f24b7f --- /dev/null +++ b/x-pack/libbeat/persistentcache/store_test.go @@ -0,0 +1,43 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package persistentcache + +import ( + "io/ioutil" + "os" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +func TestStandaloneStore(t *testing.T) { + type valueType struct { + Something string + } + + var key = []byte("somekey") + var value = []byte("somevalue") + + tempDir, err := ioutil.TempDir("", "beat-data-dir-") + require.NoError(t, err) + t.Cleanup(func() { os.RemoveAll(tempDir) }) + + store, err := newStore(logp.NewLogger("test"), tempDir, "store-cache") + require.NoError(t, err) + + err = store.Set(key, value, 0) + assert.NoError(t, err) + + result, err := store.Get(key) + if assert.NoError(t, err) { + assert.Equal(t, value, result) + } + + err = store.Close() + assert.NoError(t, err) +} diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go index d18a04ca979..c178ea04325 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go @@ -5,8 +5,6 @@ package add_cloudfoundry_metadata import ( - "time" - "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/beat" @@ -40,14 +38,11 @@ func New(cfg *common.Config) (processors.Processor, error) { log := logp.NewLogger(selector) hub := cloudfoundry.NewHub(&config, "add_cloudfoundry_metadata", log) - client, err := hub.Client() + client, err := hub.ClientWithCache() if err != nil { - log.Debugf("%s: failed to created cloudfoundry client: %+v", processorName, err) + return nil, errors.Wrapf(err, "%s: creating cloudfoundry client", processorName) } - // Janitor run every 5 minutes to clean up the client cache. - client.StartJanitor(5 * time.Minute) - return &addCloudFoundryMetadata{ log: log, client: client, @@ -79,18 +74,31 @@ func (d *addCloudFoundryMetadata) Run(event *beat.Event) (*beat.Event, error) { "name": app.Name, }, "space": common.MapStr{ - "id": app.SpaceData.Meta.Guid, - "name": app.SpaceData.Entity.Name, + "id": app.SpaceGuid, + "name": app.SpaceName, }, "org": common.MapStr{ - "id": app.SpaceData.Entity.OrgData.Meta.Guid, - "name": app.SpaceData.Entity.OrgData.Entity.Name, + "id": app.OrgGuid, + "name": app.OrgName, }, }, }) return event, nil } +// String returns this processor name. func (d *addCloudFoundryMetadata) String() string { return processorName } + +// Close closes the underlying client and releases its resources. +func (d *addCloudFoundryMetadata) Close() error { + if d.client == nil { + return nil + } + err := d.client.Close() + if err != nil { + return errors.Wrap(err, "closing client") + } + return nil +} diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata_test.go b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata_test.go index 1aff4cb2df8..95a7073321e 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata_test.go +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata_test.go @@ -6,7 +6,6 @@ package add_cloudfoundry_metadata import ( "testing" - "time" "github.com/cloudfoundry-community/go-cfclient" "github.com/gofrs/uuid" @@ -15,6 +14,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/x-pack/libbeat/common/cloudfoundry" ) func TestNoClient(t *testing.T) { @@ -84,25 +84,13 @@ func TestCFAppNotFound(t *testing.T) { func TestCFAppUpdated(t *testing.T) { guid := mustCreateFakeGuid() - app := cfclient.App{ - Guid: guid, - Name: "My Fake App", - SpaceData: cfclient.SpaceResource{ - Meta: cfclient.Meta{ - Guid: mustCreateFakeGuid(), - }, - Entity: cfclient.Space{ - Name: "My Fake Space", - OrgData: cfclient.OrgResource{ - Meta: cfclient.Meta{ - Guid: mustCreateFakeGuid(), - }, - Entity: cfclient.Org{ - Name: "My Fake Org", - }, - }, - }, - }, + app := cloudfoundry.AppMeta{ + Guid: guid, + Name: "My Fake App", + SpaceGuid: mustCreateFakeGuid(), + SpaceName: "My Fake Space", + OrgGuid: mustCreateFakeGuid(), + OrgName: "My Fake Org", } p := addCloudFoundryMetadata{ log: logp.NewLogger("add_cloudfoundry_metadata"), @@ -126,12 +114,12 @@ func TestCFAppUpdated(t *testing.T) { "name": app.Name, }, "space": common.MapStr{ - "id": app.SpaceData.Meta.Guid, - "name": app.SpaceData.Entity.Name, + "id": app.SpaceGuid, + "name": app.SpaceName, }, "org": common.MapStr{ - "id": app.SpaceData.Entity.OrgData.Meta.Guid, - "name": app.SpaceData.Entity.OrgData.Entity.Name, + "id": app.OrgGuid, + "name": app.OrgName, }, }, }, @@ -142,20 +130,18 @@ func TestCFAppUpdated(t *testing.T) { } type fakeClient struct { - app cfclient.App + app cloudfoundry.AppMeta } -func (c *fakeClient) GetAppByGuid(guid string) (*cfclient.App, error) { +func (c *fakeClient) GetAppByGuid(guid string) (*cloudfoundry.AppMeta, error) { if c.app.Guid != guid { return nil, cfclient.CloudFoundryError{Code: 100004} } return &c.app, nil } -func (c *fakeClient) StartJanitor(_ time.Duration) { -} - -func (c *fakeClient) StopJanitor() { +func (c *fakeClient) Close() error { + return nil } func mustCreateFakeGuid() string { From 6c0a78617bbc9bfb1b0b5f0353adb797fb27701b Mon Sep 17 00:00:00 2001 From: StefanSa <6105075+StefanSa@users.noreply.github.com> Date: Tue, 6 Oct 2020 10:45:48 +0200 Subject: [PATCH 138/216] junipersrx-module initial release (#20017) * junipersrx-module initial release * stashing changes for later * Initial MVP release ready for review * updating a comment in pipeline.yml * updating filebeat.reference.yml * Small fix for docs * Fix parsing of juniper.srx.timestamp * Fix bad samples * Remove some fields to make the index-pattern smaller * Missing update * Fix var.tags and disable_host when forwarded * Add related fields * Add changelog entry * Remove unused file Co-authored-by: StefanSa Co-authored-by: P1llus Co-authored-by: Adrian Serrano Co-authored-by: Marc Guasch --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 967 ++++++++ filebeat/docs/modules/juniper.asciidoc | 121 +- x-pack/filebeat/filebeat.reference.yml | 13 + .../filebeat/module/juniper/_meta/config.yml | 13 + .../module/juniper/_meta/docs.asciidoc | 121 +- x-pack/filebeat/module/juniper/fields.go | 2 +- .../test/generated.log-expected.json | 4 +- .../module/juniper/srx/_meta/fields.yml | 488 ++++ .../module/juniper/srx/config/srx.yml | 31 + .../module/juniper/srx/ingest/atp.yml | 363 +++ .../module/juniper/srx/ingest/flow.yml | 360 +++ .../module/juniper/srx/ingest/idp.yml | 287 +++ .../module/juniper/srx/ingest/ids.yml | 363 +++ .../module/juniper/srx/ingest/pipeline.yml | 275 +++ .../module/juniper/srx/ingest/secintel.yml | 349 +++ .../module/juniper/srx/ingest/utm.yml | 388 ++++ .../filebeat/module/juniper/srx/manifest.yml | 26 + .../filebeat/module/juniper/srx/test/atp.log | 4 + .../juniper/srx/test/atp.log-expected.json | 240 ++ .../filebeat/module/juniper/srx/test/flow.log | 25 + .../juniper/srx/test/flow.log-expected.json | 2013 +++++++++++++++++ .../filebeat/module/juniper/srx/test/idp.log | 7 + .../juniper/srx/test/idp.log-expected.json | 537 +++++ .../filebeat/module/juniper/srx/test/ids.log | 12 + .../juniper/srx/test/ids.log-expected.json | 699 ++++++ .../module/juniper/srx/test/secintel.log | 2 + .../srx/test/secintel.log-expected.json | 140 ++ .../filebeat/module/juniper/srx/test/utm.log | 12 + .../juniper/srx/test/utm.log-expected.json | 698 ++++++ .../filebeat/modules.d/juniper.yml.disabled | 13 + 31 files changed, 8563 insertions(+), 11 deletions(-) create mode 100644 x-pack/filebeat/module/juniper/srx/_meta/fields.yml create mode 100644 x-pack/filebeat/module/juniper/srx/config/srx.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/atp.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/flow.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/idp.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/ids.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/secintel.yml create mode 100644 x-pack/filebeat/module/juniper/srx/ingest/utm.yml create mode 100644 x-pack/filebeat/module/juniper/srx/manifest.yml create mode 100644 x-pack/filebeat/module/juniper/srx/test/atp.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/srx/test/flow.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/srx/test/idp.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/srx/test/ids.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/ids.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/srx/test/secintel.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/secintel.log-expected.json create mode 100644 x-pack/filebeat/module/juniper/srx/test/utm.log create mode 100644 x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 5676634d637..07e7bc4be0d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -607,6 +607,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Keep cursor state between httpjson input restarts {pull}20751[20751] - Convert aws s3 to v2 input {pull}20005[20005] - New Cisco Umbrella dataset {pull}21504[21504] +- New juniper.srx dataset for Juniper SRX logs. {pull}20017[20017] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index b66c1163367..a2f19000095 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -88076,6 +88076,973 @@ type: keyword -- This key captures values or decorators used within a registry entry +type: keyword + +-- + +[float] +=== juniper.srx + +Module for parsing junipersrx syslog. + + + +*`juniper.srx.reason`*:: ++ +-- +reason + + +type: keyword + +-- + +*`juniper.srx.connection_tag`*:: ++ +-- +connection tag + + +type: keyword + +-- + +*`juniper.srx.service_name`*:: ++ +-- +service name + + +type: keyword + +-- + +*`juniper.srx.nat_connection_tag`*:: ++ +-- +nat connection tag + + +type: keyword + +-- + +*`juniper.srx.src_nat_rule_type`*:: ++ +-- +src nat rule type + + +type: keyword + +-- + +*`juniper.srx.src_nat_rule_name`*:: ++ +-- +src nat rule name + + +type: keyword + +-- + +*`juniper.srx.dst_nat_rule_type`*:: ++ +-- +dst nat rule type + + +type: keyword + +-- + +*`juniper.srx.dst_nat_rule_name`*:: ++ +-- +dst nat rule name + + +type: keyword + +-- + +*`juniper.srx.protocol_id`*:: ++ +-- +protocol id + + +type: keyword + +-- + +*`juniper.srx.policy_name`*:: ++ +-- +policy name + + +type: keyword + +-- + +*`juniper.srx.session_id_32`*:: ++ +-- +session id 32 + + +type: keyword + +-- + +*`juniper.srx.session_id`*:: ++ +-- +session id + + +type: keyword + +-- + +*`juniper.srx.outbound_packets`*:: ++ +-- +packets from client + + +type: integer + +-- + +*`juniper.srx.outbound_bytes`*:: ++ +-- +bytes from client + + +type: integer + +-- + +*`juniper.srx.inbound_packets`*:: ++ +-- +packets from server + + +type: integer + +-- + +*`juniper.srx.inbound_bytes`*:: ++ +-- +bytes from server + + +type: integer + +-- + +*`juniper.srx.elapsed_time`*:: ++ +-- +elapsed time + + +type: date + +-- + +*`juniper.srx.application`*:: ++ +-- +application + + +type: keyword + +-- + +*`juniper.srx.nested_application`*:: ++ +-- +nested application + + +type: keyword + +-- + +*`juniper.srx.username`*:: ++ +-- +username + + +type: keyword + +-- + +*`juniper.srx.roles`*:: ++ +-- +roles + + +type: keyword + +-- + +*`juniper.srx.encrypted`*:: ++ +-- +encrypted + + +type: keyword + +-- + +*`juniper.srx.application_category`*:: ++ +-- +application category + + +type: keyword + +-- + +*`juniper.srx.application_sub_category`*:: ++ +-- +application sub category + + +type: keyword + +-- + +*`juniper.srx.application_characteristics`*:: ++ +-- +application characteristics + + +type: keyword + +-- + +*`juniper.srx.secure_web_proxy_session_type`*:: ++ +-- +secure web proxy session type + + +type: keyword + +-- + +*`juniper.srx.peer_session_id`*:: ++ +-- +peer session id + + +type: keyword + +-- + +*`juniper.srx.peer_source_address`*:: ++ +-- +peer source address + + +type: ip + +-- + +*`juniper.srx.peer_source_port`*:: ++ +-- +peer source port + + +type: integer + +-- + +*`juniper.srx.peer_destination_address`*:: ++ +-- +peer destination address + + +type: ip + +-- + +*`juniper.srx.peer_destination_port`*:: ++ +-- +peer destination port + + +type: integer + +-- + +*`juniper.srx.hostname`*:: ++ +-- +hostname + + +type: keyword + +-- + +*`juniper.srx.src_vrf_grp`*:: ++ +-- +src_vrf_grp + + +type: keyword + +-- + +*`juniper.srx.dst_vrf_grp`*:: ++ +-- +dst_vrf_grp + + +type: keyword + +-- + +*`juniper.srx.icmp_type`*:: ++ +-- +icmp type + + +type: integer + +-- + +*`juniper.srx.process`*:: ++ +-- +process that generated the message + + +type: keyword + +-- + +*`juniper.srx.apbr_rule_type`*:: ++ +-- +apbr rule type + + +type: keyword + +-- + +*`juniper.srx.dscp_value`*:: ++ +-- +apbr rule type + + +type: integer + +-- + +*`juniper.srx.logical_system_name`*:: ++ +-- +logical system name + + +type: keyword + +-- + +*`juniper.srx.profile_name`*:: ++ +-- +profile name + + +type: keyword + +-- + +*`juniper.srx.routing_instance`*:: ++ +-- +routing instance + + +type: keyword + +-- + +*`juniper.srx.rule_name`*:: ++ +-- +rule name + + +type: keyword + +-- + +*`juniper.srx.uplink_tx_bytes`*:: ++ +-- +uplink tx bytes + + +type: integer + +-- + +*`juniper.srx.uplink_rx_bytes`*:: ++ +-- +uplink rx bytes + + +type: integer + +-- + +*`juniper.srx.obj`*:: ++ +-- +url path + + +type: keyword + +-- + +*`juniper.srx.url`*:: ++ +-- +url domain + + +type: keyword + +-- + +*`juniper.srx.profile`*:: ++ +-- +filter profile + + +type: keyword + +-- + +*`juniper.srx.category`*:: ++ +-- +filter category + + +type: keyword + +-- + +*`juniper.srx.filename`*:: ++ +-- +filename + + +type: keyword + +-- + +*`juniper.srx.temporary_filename`*:: ++ +-- +temporary_filename + + +type: keyword + +-- + +*`juniper.srx.name`*:: ++ +-- +name + + +type: keyword + +-- + +*`juniper.srx.error_message`*:: ++ +-- +error_message + + +type: keyword + +-- + +*`juniper.srx.error_code`*:: ++ +-- +error_code + + +type: keyword + +-- + +*`juniper.srx.action`*:: ++ +-- +action + + +type: keyword + +-- + +*`juniper.srx.protocol`*:: ++ +-- +protocol + + +type: keyword + +-- + +*`juniper.srx.protocol_name`*:: ++ +-- +protocol name + + +type: keyword + +-- + +*`juniper.srx.type`*:: ++ +-- +type + + +type: keyword + +-- + +*`juniper.srx.repeat_count`*:: ++ +-- +repeat count + + +type: integer + +-- + +*`juniper.srx.alert`*:: ++ +-- +repeat alert + + +type: keyword + +-- + +*`juniper.srx.message_type`*:: ++ +-- +message type + + +type: keyword + +-- + +*`juniper.srx.threat_severity`*:: ++ +-- +threat severity + + +type: keyword + +-- + +*`juniper.srx.application_name`*:: ++ +-- +application name + + +type: keyword + +-- + +*`juniper.srx.attack_name`*:: ++ +-- +attack name + + +type: keyword + +-- + +*`juniper.srx.index`*:: ++ +-- +index + + +type: keyword + +-- + +*`juniper.srx.message`*:: ++ +-- +mesagge + + +type: keyword + +-- + +*`juniper.srx.epoch_time`*:: ++ +-- +epoch time + + +type: date + +-- + +*`juniper.srx.packet_log_id`*:: ++ +-- +packet log id + + +type: integer + +-- + +*`juniper.srx.export_id`*:: ++ +-- +packet log id + + +type: integer + +-- + +*`juniper.srx.ddos_application_name`*:: ++ +-- +ddos application name + + +type: keyword + +-- + +*`juniper.srx.connection_hit_rate`*:: ++ +-- +connection hit rate + + +type: integer + +-- + +*`juniper.srx.time_scope`*:: ++ +-- +time scope + + +type: keyword + +-- + +*`juniper.srx.context_hit_rate`*:: ++ +-- +context hit rate + + +type: integer + +-- + +*`juniper.srx.context_value_hit_rate`*:: ++ +-- +context value hit rate + + +type: integer + +-- + +*`juniper.srx.time_count`*:: ++ +-- +time count + + +type: integer + +-- + +*`juniper.srx.time_period`*:: ++ +-- +time period + + +type: integer + +-- + +*`juniper.srx.context_value`*:: ++ +-- +context value + + +type: keyword + +-- + +*`juniper.srx.context_name`*:: ++ +-- +context name + + +type: keyword + +-- + +*`juniper.srx.ruleebase_name`*:: ++ +-- +ruleebase name + + +type: keyword + +-- + +*`juniper.srx.verdict_source`*:: ++ +-- +verdict source + + +type: keyword + +-- + +*`juniper.srx.verdict_number`*:: ++ +-- +verdict number + + +type: integer + +-- + +*`juniper.srx.file_category`*:: ++ +-- +file category + + +type: keyword + +-- + +*`juniper.srx.sample_sha256`*:: ++ +-- +sample sha256 + + +type: keyword + +-- + +*`juniper.srx.malware_info`*:: ++ +-- +malware info + + +type: keyword + +-- + +*`juniper.srx.client_ip`*:: ++ +-- +client ip + + +type: ip + +-- + +*`juniper.srx.tenant_id`*:: ++ +-- +tenant id + + +type: keyword + +-- + +*`juniper.srx.timestamp`*:: ++ +-- +timestamp + + +type: date + +-- + +*`juniper.srx.th`*:: ++ +-- +th + + +type: keyword + +-- + +*`juniper.srx.status`*:: ++ +-- +status + + +type: keyword + +-- + +*`juniper.srx.state`*:: ++ +-- +state + + +type: keyword + +-- + +*`juniper.srx.file_hash_lookup`*:: ++ +-- +file hash lookup + + +type: keyword + +-- + +*`juniper.srx.file_name`*:: ++ +-- +file name + + +type: keyword + +-- + +*`juniper.srx.action_detail`*:: ++ +-- +action detail + + +type: keyword + +-- + +*`juniper.srx.sub_category`*:: ++ +-- +sub category + + +type: keyword + +-- + +*`juniper.srx.feed_name`*:: ++ +-- +feed name + + +type: keyword + +-- + +*`juniper.srx.occur_count`*:: ++ +-- +occur count + + +type: integer + +-- + +*`juniper.srx.tag`*:: ++ +-- +system log message tag, which uniquely identifies the message. + + type: keyword -- diff --git a/filebeat/docs/modules/juniper.asciidoc b/filebeat/docs/modules/juniper.asciidoc index 047e847bc5a..a2d2a0100d3 100644 --- a/filebeat/docs/modules/juniper.asciidoc +++ b/filebeat/docs/modules/juniper.asciidoc @@ -10,18 +10,131 @@ This file is generated! See scripts/docs_collector.py == Juniper module -experimental[] +This is a module for ingesting data from the different Juniper Products. Currently supports these filesets: -This is a module for receiving Juniper JUNOS logs over Syslog or a file. +- `srx` fileset: Supports Juniper SRX logs +- `junos` fileset: Supports Juniper JUNOS logs +- `netscreen` fileset: Supports Juniper Netscreen logs include::../include/gs-link.asciidoc[] include::../include/configuring-intro.asciidoc[] -:fileset_ex: junos - include::../include/config-option-intro.asciidoc[] +:fileset_ex: srx +beta[] + +[float] +==== `srx` fileset settings + +The Juniper-SRX module only supports syslog messages in the format "structured-data + brief" https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html[JunOS Documentation structured-data] + +To configure a remote syslog destination, please reference the https://kb.juniper.net/InfoCenter/index?page=content&id=kb16502[SRX Getting Started - Configure System Logging]. + +The following processes and tags are supported: + +[options="header"] +|============================================================== +| JunOS processes | JunOS tags | +| RT_FLOW | RT_FLOW_SESSION_CREATE | +| | RT_FLOW_SESSION_CLOSE | +| | RT_FLOW_SESSION_DENY | +| | APPTRACK_SESSION_CREATE | +| | APPTRACK_SESSION_CLOSE | +| | APPTRACK_SESSION_VOL_UPDATE | +| RT_IDS | RT_SCREEN_TCP | +| | RT_SCREEN_UDP | +| | RT_SCREEN_ICMP | +| | RT_SCREEN_IP | +| | RT_SCREEN_TCP_DST_IP | +| | RT_SCREEN_TCP_SRC_IP | +| RT_UTM | WEBFILTER_URL_PERMITTED | +| | WEBFILTER_URL_BLOCKED | +| | AV_VIRUS_DETECTED_MT | +| | CONTENT_FILTERING_BLOCKED_MT | +| | ANTISPAM_SPAM_DETECTED_MT | +| RT_IDP | IDP_ATTACK_LOG_EVENT | +| | IDP_APPDDOS_APP_STATE_EVENT | +| RT_AAMW | SRX_AAMW_ACTION_LOG | +| | AAMW_MALWARE_EVENT_LOG | +| | AAMW_HOST_INFECTED_EVENT_LOG | +| | AAMW_ACTION_LOG | +| RT_SECINTEL | SECINTEL_ACTION_LOG | +|============================================================== + +The syslog format choosen should be `Default`. + +[float] +=== Compatibility + +This module has been tested against JunOS version 19.x and 20.x. +Versions above this are expected to work but have not been tested. + +[source,yaml] +---- +- module: sophosxg + firewall: + enabled: true + var.input: udp + var.syslog_host: 0.0.0.0 + var.syslog_port: 9006 +---- + +include::../include/var-paths.asciidoc[] + +*`var.input`*:: + +The input to use, can be either the value `tcp`, `udp` or `file`. + +*`var.syslog_host`*:: + +The interface to listen to all syslog traffic. Defaults to localhost. +Set to 0.0.0.0 to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to 9006. + + +[float] +==== Juniper SRX ECS fields + +This is a list of JunOS fields that are mapped to ECS. + +[options="header"] +|============================================================== +| Juniper SRX Fields | ECS Fields | +| application-risk | event.risk_score | +| bytes-from-client | source.bytes | +| bytes-from-server | destination.bytes | +| destination-interface-name | observer.egress.interface.name | +| destination-zone-name | observer.egress.zone | +| destination-address | destination.ip | +| destination-port | destination.port | +| dst_domainname | url.domain | +| elapsed-time | event.duration | +| filename | file.name | +| nat-destination-address | destination.nat.ip | +| nat-destination-port | destination.nat.port | +| nat-source-address | source.nat.ip | +| nat-source-port | source.nat.port | +| message | message | +| obj | url.path | +| packets-from-client | source.packets | +| packets-from-server | destination.packets | +| policy-name | rule.name | +| protocol | network.transport | +| source-address | source.ip | +| source-interface-name | observer.ingress.interface.name| +| source-port | source.port | +| source-zone-name | observer.ingress.zone | +| url | url.domain | +|============================================================== + + +:fileset_ex: junos + [float] ==== `junos` fileset settings diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 9797291bdf4..cc994b45cac 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -1050,6 +1050,19 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + srx: + enabled: true + + # Set which input to use between tcp, udp (default) or file. + #var.input: udp + + # The interface to listen to syslog traffic. Defaults to + # localhost. Set to 0.0.0.0 to bind to all available interfaces. + #var.syslog_host: localhost + + # The port to listen for syslog traffic. Defaults to 9006. + #var.syslog_port: 9006 + #-------------------------------- Kafka Module -------------------------------- - module: kafka # All logs diff --git a/x-pack/filebeat/module/juniper/_meta/config.yml b/x-pack/filebeat/module/juniper/_meta/config.yml index be40af66202..7f992656788 100644 --- a/x-pack/filebeat/module/juniper/_meta/config.yml +++ b/x-pack/filebeat/module/juniper/_meta/config.yml @@ -36,3 +36,16 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + srx: + enabled: true + + # Set which input to use between tcp, udp (default) or file. + #var.input: udp + + # The interface to listen to syslog traffic. Defaults to + # localhost. Set to 0.0.0.0 to bind to all available interfaces. + #var.syslog_host: localhost + + # The port to listen for syslog traffic. Defaults to 9006. + #var.syslog_port: 9006 diff --git a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc index c59b7ac4a95..3e145ea81c9 100644 --- a/x-pack/filebeat/module/juniper/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/juniper/_meta/docs.asciidoc @@ -5,18 +5,131 @@ == Juniper module -experimental[] +This is a module for ingesting data from the different Juniper Products. Currently supports these filesets: -This is a module for receiving Juniper JUNOS logs over Syslog or a file. +- `srx` fileset: Supports Juniper SRX logs +- `junos` fileset: Supports Juniper JUNOS logs +- `netscreen` fileset: Supports Juniper Netscreen logs include::../include/gs-link.asciidoc[] include::../include/configuring-intro.asciidoc[] -:fileset_ex: junos - include::../include/config-option-intro.asciidoc[] +:fileset_ex: srx +beta[] + +[float] +==== `srx` fileset settings + +The Juniper-SRX module only supports syslog messages in the format "structured-data + brief" https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html[JunOS Documentation structured-data] + +To configure a remote syslog destination, please reference the https://kb.juniper.net/InfoCenter/index?page=content&id=kb16502[SRX Getting Started - Configure System Logging]. + +The following processes and tags are supported: + +[options="header"] +|============================================================== +| JunOS processes | JunOS tags | +| RT_FLOW | RT_FLOW_SESSION_CREATE | +| | RT_FLOW_SESSION_CLOSE | +| | RT_FLOW_SESSION_DENY | +| | APPTRACK_SESSION_CREATE | +| | APPTRACK_SESSION_CLOSE | +| | APPTRACK_SESSION_VOL_UPDATE | +| RT_IDS | RT_SCREEN_TCP | +| | RT_SCREEN_UDP | +| | RT_SCREEN_ICMP | +| | RT_SCREEN_IP | +| | RT_SCREEN_TCP_DST_IP | +| | RT_SCREEN_TCP_SRC_IP | +| RT_UTM | WEBFILTER_URL_PERMITTED | +| | WEBFILTER_URL_BLOCKED | +| | AV_VIRUS_DETECTED_MT | +| | CONTENT_FILTERING_BLOCKED_MT | +| | ANTISPAM_SPAM_DETECTED_MT | +| RT_IDP | IDP_ATTACK_LOG_EVENT | +| | IDP_APPDDOS_APP_STATE_EVENT | +| RT_AAMW | SRX_AAMW_ACTION_LOG | +| | AAMW_MALWARE_EVENT_LOG | +| | AAMW_HOST_INFECTED_EVENT_LOG | +| | AAMW_ACTION_LOG | +| RT_SECINTEL | SECINTEL_ACTION_LOG | +|============================================================== + +The syslog format choosen should be `Default`. + +[float] +=== Compatibility + +This module has been tested against JunOS version 19.x and 20.x. +Versions above this are expected to work but have not been tested. + +[source,yaml] +---- +- module: sophosxg + firewall: + enabled: true + var.input: udp + var.syslog_host: 0.0.0.0 + var.syslog_port: 9006 +---- + +include::../include/var-paths.asciidoc[] + +*`var.input`*:: + +The input to use, can be either the value `tcp`, `udp` or `file`. + +*`var.syslog_host`*:: + +The interface to listen to all syslog traffic. Defaults to localhost. +Set to 0.0.0.0 to bind to all available interfaces. + +*`var.syslog_port`*:: + +The port to listen for syslog traffic. Defaults to 9006. + + +[float] +==== Juniper SRX ECS fields + +This is a list of JunOS fields that are mapped to ECS. + +[options="header"] +|============================================================== +| Juniper SRX Fields | ECS Fields | +| application-risk | event.risk_score | +| bytes-from-client | source.bytes | +| bytes-from-server | destination.bytes | +| destination-interface-name | observer.egress.interface.name | +| destination-zone-name | observer.egress.zone | +| destination-address | destination.ip | +| destination-port | destination.port | +| dst_domainname | url.domain | +| elapsed-time | event.duration | +| filename | file.name | +| nat-destination-address | destination.nat.ip | +| nat-destination-port | destination.nat.port | +| nat-source-address | source.nat.ip | +| nat-source-port | source.nat.port | +| message | message | +| obj | url.path | +| packets-from-client | source.packets | +| packets-from-server | destination.packets | +| policy-name | rule.name | +| protocol | network.transport | +| source-address | source.ip | +| source-interface-name | observer.ingress.interface.name| +| source-port | source.port | +| source-zone-name | observer.ingress.zone | +| url | url.domain | +|============================================================== + + +:fileset_ex: junos + [float] ==== `junos` fileset settings diff --git a/x-pack/filebeat/module/juniper/fields.go b/x-pack/filebeat/module/juniper/fields.go index 6122a564654..e22907d0244 100644 --- a/x-pack/filebeat/module/juniper/fields.go +++ b/x-pack/filebeat/module/juniper/fields.go @@ -19,5 +19,5 @@ func init() { // AssetJuniper returns asset data. // This is the base64 encoded gzipped contents of module/juniper. func AssetJuniper() string { - return "eJzsvW2TGzeSIPx9fwUefzhJDpmyZVt7o5udC213e9w7ktyrluSNi4moAFEgCTcKKAEosulf/wQSqBdWochuNlBs7d18mLCaZCKRSCTyPb9DN3T7Gv1RCVZS9S8IGWY4fY3+w/0B/cen979d/wtCOdVEsdIwKV6jv/0LQqj+DVowynM9+xfk/+s1fGr/9x0SuKCvkaBmI9XNjAlD1QITOrN/b76GkFxTtVHM0NfIqKr7idmW9LXFcSNV3vl7The44iaDJV+jBeaa7nw8QLf+33tcUCQXyKxojRhqEEObFVUUPjMKLxaMoBXWaE6pQHKuqVrTfDbYn9L4HptZKlmVd99Kn6jtsoC1wHxne+Orj60fWqJdpNDLnb/vX2H8wAan8nHFtP0eYhpVmubISERwaSpPf4U3qKBa46X9NzaIyIJqu2lpP++BRuitXKJzSmQObBzYiIPF+kgdu50aLl1TYTK7tciAPcKJqe9JroHmRApDhdH2fjChDRamRkMHcTSsOAbBHJv+B0PsmMPJLoGwQZsVIyuEkaZaMynQihmNMHpPze/MCKp1ffqzAWs0m9UrWfEcCbqmCs1pw3clVpqid9RgixpGCyWLzlJP38qlfnGFyQ01+tkA/DlTlBi+fY6MxxujD9QJC8fhooPmLEhITteUH0FJLkX/fu5Q8pyWihJsPCY5XTBBcyQFB7QMnnOKClyGsSr0Mot2Yfac8Tt/zy/Pf0BrzCt/41lOhWEL5rmT3mJiEJdLd15qcBCwO2bBe26B79njKLEyjFQcK/i9P9jZKGcMQB/FKSHOGEAe55TRI1lPeyYv/9+Z7D8Tu2qaA3nY9ZXzPzLYSP9YHg12a3yM0EuOmqJaVookensfTrZU9/9hmGmDDS2oMI8ROVzlzGSE494dfiToUWHU9jEitrI61WNEjInjEEurMdWS4/FyWk7xMdIjLdkWlOYxbagRvSZkZ3a+WLsFLDYDPWSgJDzMiujpIQPoB6yIcSr2XCsTUVF0vCpB8jlyDbYZiXwoQMF7k49MoVZXgn2paKtGq2b//k/bXaP2TApiHwds5GO3bEfEzZqlFYdd6p7ZZdiCEdy9z2/lEl2sqTDoGoQzqkROlTVBFPWCarD1BbulOdLUWCA7P95dQ48bLPUhDGA/2GBpDmEA+l6HMvQExvcvHceYg33dgyb3o8FK6kT6apcvf5XadEUk73OkpiJnYll/qENs0/EhfT30Zccw2OBHo4S9vFr/hHCeKysrx657n7iD3Rv5tRJ3/So1eV/930teS630sqEvF5wjrestyxFGS7amonGSfb2KgCXRcf6LtBZI/hiVv68jojHq0JDlNlP0S4Kz7gYP4YBh3/MtUPnCLY2u4CI9995sg9HHbUkRwUMJMqeIMrOiCn26FOaHV0gq9AuX2Pz4Es2xBi6qA2QLtqwUqH4H9n2MuvsV7xvCoOmMzwj+BfvrpUzlZttnHdcrf/UOBqk2WOXJlLqOROtsu0vJy6vPO/oeRopy3D9ShPRWG1r4R9SjbaGtqONU7Yhn/y0VWzKBef2bXW3lAB1S6V97EiMurz6/CpDAoz+gxMNJ0GA0pHKM16dl1KHieOzrs6I4p2qS2PWvsBS6PH9IlNTh2w2WApjjYqWP2snGSZbcz4ZrReuyVbTgoljT5UxyTomR6msUwJZ6J8i5sTzHNCKOdDS3mO4oqm9lX21Bewj9CC2+gswfi6paSA3JboUUaL4dHBpCin6pqDYWoGZFybf+nOyXraBHFJMV0iyn6On3yKxUhV7+/PMztMEaaUpFs8oeSjwK5fUOlNClFJqmIwX5ariCyEqYxqdQFXMn9OxV1kEI6CmeyzXtEIOJYGZlLd60URQXo/eHfDVsc2JS0ZxVfT0tBqG+CWmOjWOBLRAz/6xefv/DX7QT6S9KEKA10v8c7Oaf1h58i7dUoZfoQhBc6oq7yIo1Ke8l10PQHxj8CORWhlb58SX6N7vd5+jHH9G/ISKV1ZdhF37R5+h/cPO/7BeZRrtE+SZ4hELm9NHaumJDM4I5n2Nyk1YDdsgJaeDaYOPsCktEKvJSMmHANDE0nOAMzJFRpWSi/LRWH9QlJQxzwBgw1UYqq1mLrdM67AdrzFnuGCOEFEILWYncvjCcAvJMLL1ydDB5cfdGDCDHiAX667AnbDRyClsucf5Y3jmPDtLsT4oKahQjAavDm8LdL4Mt7J77WgjbZx+bVqOVi/rYZuhXubFHM7Q5mUBSWWPMSHRDaXmAaI/ixftKiKYkoVpna5Zneaqo60UteZZUUIUNXPLcUrBjF66ZMhXm1mjf8b2LgIuDFcya3RArB2K4XfirfnmOlJXWGhwqQDSsltQ0XztICa0SJT2dnBIuE24/JVSSUNBQ8F+e177XD7SQhqJrz+9EUXho59sxQWn/VwdivoLAi18p0yVnKTMbHrU5r9lA7X8UupmVuQn5HW6dfQM8r9dcV1st/gn57xFhdOJlwfgJYvR2VWscXZ29ufK6L8HCkocVpVR9jRfBE/nVpUFUj8P98ck9VWCIg+kecqXumvJV+5PWYHd6DljmM/Ty51doA3QvKBYIcx72FYBTH9Sk1n+ENlRRBxYbxCnWBknRKxfZJeLJ1cSvm4iBu5oibOtp97tUORAOspooWQnJ5XLbD8QtmBposQj9jMgKK0yMI6K91FvAH5zmAlXC5/TwHZ/5aEVt7IJuF6hPGUTYE7sEi6KwSqYUdRhB4c2oTAPJ2lMrMQGN1cUohPc5SEIqVUPUBoscqxwJqQrM2Z+h/F6piiB9cp/lcDSJZDUfPEn3IlKLdYPMC84WFHYcMPA1JVLkIwp2e9yZNin9LHs2xASRRcmpCTLAqBMVgwJvFOuJwU69mTInYuRru3aQncdYeZczR9mvkMKsIh1TW58aK+elzXLKT0T4C5GnILsF+acUqbst7BGLdvVaxXTptR/7FB6IqGQ3+g0y9Nb4y4fWVOlOOUW+Lw8scL4PZbYtxbG22ZbpEalymqd7B32SjX+mdLNirWPUmTbNF7vx9eFrpWQxA6gVFOVrQgVWTDq1vqi4Yd8ZRhXCZcnr6pe2l02BBV6GSnMR4hDeqe1Fh5TDVSNmnmgkN8JFxgwuyr5n0GNsV7MoDm+f0YismLVuZE71DL2rtAEzqQvU3kpsRvJysaFHHtJeAbZYWLzXdApNCA65XtDRTtEFVVQQxxDYqtY5W7PcajbAD2FBdl0Lso894oU3eVsyNdkO2/N0saBby4nM8K3brLZCz+prFilg0P2+0YiHPurCeW6lcSPPZoMlm3QyWcWWQMVAkXsoxIb+sa8KaJBfKlpNxkqWux0XtfJxgzUCJPIRvgHkfohN1IhKwQ5BE8i0ZWESvL7LIgWuZZYA1TJLoT2XMUXRLtCX0aEm0JU6r8hpTMie+Rh8YwbP5b3enGPF5iG5dkywoH0get0QYjuCMBko8TEUa13x1GGnEStKVobIgr5wODTGC2Rly8WAQ7DwJNgxIEcYhK6pYiZl6ciejdWr+yLATmRnn8snbfHioHege6WbShcLDeJOJSVswVrDJ6zdumDOWE8Vryunz2YKHEDjYmR5WzBRu6hyH2QJ4u3N5qkO4fOuld61BKVCv1371Fim64SAvl8N1q9PaKxKUpdSs4iC4068Bea0yF2HKUjlr+/uaBeeipssXeuie4oiURVUMXJfWRTc2wRVbHs21q1ka26GE0vufg+2tqYil8onzO7dmZz/cYLuNXVoV87/oCRsR1vE0teCD8htJeh+xJykT9mr7pvhhfRV/17MeC/XCje5xUIahNHKd7wIJ9ByuczqRJWTCPWaEe8t1KfombIj+/4O6VbQtRrER1jxl5yRberbs0cuXAECvrm24NsRuVzxlHnTYQJ+qDgFxMLiVApDb1NrrA1Cl8L569p+qDjPtf0/eFQxrxEKNYA58DiTFRZLmgm6SS0LxgKXdNMJ9YMSYoxi88rQjoQY5uhrh7rV1rvPX1h06BJHE3YN5ThL1rZyH9HAEOznFzlkuvpbwLiFCjBLsLrhoG5zvtSaqhm6pu5QKk3VDC8ptPL2me4LqWocBrBrME5vJ/B75H7f6VshFZorubGf1X/1uqYzu0b7SV/mV1iZ2G66BnBsj4q/U3JQHTrVnZI8b9TGVFdKltQHFFO9xW8Ewpwq02QXqXZR/zcX3vLio9MEAJKQAgpzjoQU3ylaUrBk9mU/gNkw5ZNDKqXshWnsFThJ0ONeMBdhq8M/g51tmFl5ZdnJenQOC86h2kQgKb5bSvvfe14CUFKygOKYcN+4Ewx8AQhYJOUCWelgGNUzdN3KlP5gg25lVRqMz1w5X6WtEeNKRl2yTe7Fryc8RoRX2tQM6f8xOCb4CdP2JH1NtPdvWMUXPh1XgSbXftwNC1v0ri1TOqXsySHDy2J5DlggrLUkDPyl9jSC9iQc2Ft2Q18jjMrVVjOCOcqZvnmOSgUzUZ4jasiTsKKMFT6m9vKeD72rs1G4oIYqjUqsoYuXhkYOrhcBkUVhpZjcCdoPS2uoIXvVPfcenErj65xhgofJiW8ii7Ia3sEEx4bRholcbnw+LZGC0NI8bzIpRokx2Oai4nyLvlSYO+dnLgvMhJcaorMQlyNPV9frGUtd2rN1qxK+ZeKG5r4WqE5Exxq8U95AsZ9806A2Y/m+g+ODrhBJRV13spNzS/QRqNGDkVYnweu30nte0fWwXU8TdKaqYP3BTqldrH5NwNbx/35N+8fImvaC8fR3vNnyL7Bac40VzStCUR05omF3m6aKYZ4FXtNkj8g1LFmrzf33sfMA2hdm1C9AyY0+quVADI+xX90+dCusV80NtWphoMqwIiuX+VvX2DRlhmc1pF6LMLuRZpmZVsT+qvn3sNIUWXkuEIOcu0oQTrGyf4JGeC1qvoDQeztVXdh5OPrghF817PP0qF8sIos5E03f7O6D5ctG1T1erzVTlZ7a09fVRgCBcY/fNAHSwJU4c6u7nozjnlJnwSV3jTfkc17my3P03kmap75xA3LT9nzRr8XtWVivdg7oU/jyO+7ny3MgqS95a8TE0HuwG5FzaYBuCzPHRFYWbJgOG6lrvU3Zy343qusLtJ26sNePLZzxPSHXWNKfNQujy/ODmmws/9wBTdYi9lLkrUY7Q2euPtP3O+Xug/3aLCCodr/xwzfeHTevTFO5KU3zGFWCU+0oI92DspFojRXDcz6oAnRNGZhAJccjgkBToZP2R9k50K6q6laeWUllNYy6vpDZc75+cXnV16GRbxnrPApjddlHDhS8cy1kG2lxSKJLYdA1WwoMwmKERUupUjavfTKQX5ZJr2rdTUJXR/hPi0jnLgOX5TLAOO9/+4iYILzKqRVnfpCt/fkMPb24xUXJ6Wt05RwiDixI71nYLwKRucljm+Ccap+WMGZM31iV+wi87lGK13FjvvdPwwemb/aEXI1iyyVV6UbYhUn2uRsL8DiAdrpSVK8kzy33OFt9ZNLoTuh9As/CMPbupfLTD07HeNY047g8D5eR3Dk6T2RRZhPnXcGp+NwrGOPq/Hu6mn9n0ZEC6lMXMG5G5hUZs9K8WnqirLEu5o20lAo6D1i5XuM3MiUOq3yD1Wky9IZd9a10xf4hspsYaY381ApRjN5hUvdTDiu3VgRNasdI8V2toKr9UsjZmtGHWiuKdfTcYG2wqWIpzo0/CjN+MrPDLj6Xt4jlL8bfL/uyVlNgaDH6NGh87O6CxSJ8det3LPH0vQGTnw/n7h3znDEhq1gxzk4diV5Gv1NWksZ0Ogw8sj9FBpy6M+MOS7zh3Mo9pCtCqNaLiqMLuz4iMqfaskTd7DdsWTCR09vIBOBMm+M0zwfKFlgYTDFVIzGnCuKbBVaMQwZPwIPn4u9iiTAQ8Tv72+DORAI+lHPXXOhEGrFfHT1t8jlLqnTpi26dhBmQzKsIbUJ83eHp2UiRoXNzDd/j1AklTvlqkry8r8p9236ImdAopwYzHnAyzGVlOr8b2Zrkk+dm1h5b3OSxAR7jD6mhRcmTZfO8QTldYB8C8p0v6xi+z9a0WvGaKo63UMhlpH9c0dPAjbQfgNXtf00XdRW489Vrw0wFjRlRcGOtbTBs2PTQ6xo1itXx7xAcG9MEsorIorD3KQ0bnTnoiHWSfUsl1yx3/rO6i1xB9WgiVC7J8YHG+3vLfmG81RpJNy8vrBrclpD0dBpZX6+eVtb/IedH+p2O3t5/yLkPwIRvV8nSNc49h4Rid/LXV5focqBQddFI1rXWV5fsxyBiYVdTDbuMakjfxx/mc6vDyr0TEdlc5qkrvgYVd32lw+OCLC4j6tEqfrcEFzKYoPK84wL2pcMugbaJh7Aly5tQzogTr4htNQ7KwCO8/PGUvGbfZZXymaqne199ct1z6kAUJGvcUlJ1vQgu9WtOQ+WtdRemfYkbEzhCgl7xfNch0lRX4jVmHA8DGahxhSOor1xQpUYmLbg7dIyvP17czRsrhW8A5QKwgy35dAPNlrMRiciKbF7l+Ta6f4YVWdQ6oA7cStPjGp3v9VLFh6iYjNjloFdil+lqioIEprvZq67nKq5yZprKurYvmscoNNiurdhwoqQNL+zfpMsSi03B9WRW+dnnC/TU10p8rrjVleeMQwEH5IFd3JZS228+Q98NHQ2iH4W5EXIjdgwhTUkFzSzWu9BHJm0SPIELrp8WelZXub/3pUlv6RKTLfo0aq5xNlf4FEX5fuEdEjOBCszEQuGC7k3HKLGCqb3p+yTsKJdXsCx6L3OXHN22BexknQWQQge0L0gVsIRIZSHt9o17Tzfo10qAKflO5pSjp0ysZ98+R0yS52hu/4/a/8MC861mevZtOL5oSJktOB5Mzo+tQ+1q+GdXCBYFXxfIyW09/Eou9jZqMDIppu6vc49n3QZBU2UZOYjQuogrd3uYfX73O1YUfXQJwN9++/nd728+XHz7rcu5XWOF2ShPbqS6iVmyfPCC/V4v2I2wjTrBsIitRPianbhdSprnABP7XGwTmDALqajQjMQUIB1XUgKMi/hekEB8IBbQbIPZcDjxg70D0Ps8NlB7fWKXqOtqnuhSmHmujYpd+Q712skcYt23NNo7Wtd8pHOSHlvs0g4GG6g0vtikrXvx9S4WxIKNOprqrSZzxB671WA3osA2++U9YaF8dD/B+zsuLPJe//8wXLVVmd3kv5OwWN7x0XtE9iJ5Euao47j78JNygqStnZPt2KVPTZPRXmfZQZ/MZ+B2G3Du4ch03bKaTREPg6KvBWbc0rpu5nLlZcblebe2DTpxWXPQ0GWghcF4VmGdc51ZFfGI/RyTeA3p1r766EwWRSX6nqgBduK4xk0Pxe49vTV/p2GdusFNH6dZPxS3ayzyf5fhqFmLm8GGHSMZHozdcOEd5HSlS0aYjJYlOpUFD9hvsBLDoMNjR12LosxkKmF8/f7dFfrN+VHbpNQwIl8mTSW4/s+36EtF1Ujv1oqLTNF+p860yQ0dh+gWfaiLzoJpXY2WTiI+pF2gMvYYAQu0PMpxdAiqCQTHHgw3jz+gAXOsigSnZcEmcC/gMmIBcgO0yqNNpd2BGbfb1Q7oHJu+VvhQuHMqyKrAKlZZSQN3W+LB+OIHR58wGaRTRYGZraLzAqGLuAVUDeDFElotJQAr538kgFri6JMwXMep6OwFQfeMxX5wfOe2glrVMzrSIsMEBqPELz+xsLWIaLx3AM+X5foncWtW0d93IjJiVJbrqH3XO9At5OMiT3cAvOY4usQQGRVLJiIWRQ5Bp8iNFtki0xtmSHT5IbIFlxuNi/i5K13YwqzTQU8QdSEiYyKlOGGipKqYb6MlvA9gl+QmDfA15il4hZVZqaSRWfyQFEBf/5SBxzE+bJ7sbnK5zPIUxLaA4+e/EZEV+DYzJpbbYBew5WhOEzwKBROJkGYiHdIl1xmf8yx2WHQH9vcJgUfvDN6BHbsXYhd27KreLuyfE8J+lRD2vyaE/T8Twv5LGthGlhzPaQqR0kCPb56JrKg4KN/zbYJ3sgZe3iTQS4qKs2VRptG+rZaJ+TJ2EpKHzFIoJZp+IfF9IyLTLiExwQlqRdJYkxZwGmtSb3VVJphFSkRTVp3EVDXSWNOD3iYQIUYaa5ilgg1mTRLglWC3AgupKUnAhOtXliqJHoX1K1maFcV5AreaLMqM8AQ+bAs4QZAE4Kr51sR3i1rIOgnkssoSxDSIYoYRzBMUEOkML6kg24hZV13YAvPtnzSfp8B7nUEb0CSQXTuYNFi7xNok0OfLcv0qjQ9aZ3Nm/pKk0RjRWdxZcT3ASkYX1TrJNQeolKj4VW7a+fijzdrqAKZm5fz88Z0jDjiofUmAu27y8TrIdWAvGKcpbBidLVIcIlvELM7eBZxCN9AZKyFJMUsi6li5/inXphw0848EWyuSBDZnC5rCjNHgaC5ozqIVjO7CZiINlxQyrzjVRKagtgfOlglkkyz1BpuoM/870EMZ5FEAK7pk2igc3xPSwk6g8SlapiK1SkZrDZ3IVSL56jLzHYsngG4UxUUCRdKVAqVCO51yvVlJpjM3YTY+9C1WOAmD5yOFsDEgr918+9hwmTZYRJ9znGszr1SsYYE1VOpmBaWAWkXHNb4eXdckxwYLkxsW8YddH9tpYB/MJc7z2HeA5bHDqnXroARvESsyoqQsknQlsoATmGmsyNIkR/qORynIXN5Eb89U6vgtS1mpS8UiA+XYMFNFzz7jTNB4LXZaqDrqRJ0GLhTfxndrcem6nmYLLqM/5w3wBCn/1uaNLnUs0AQSx9rQCVCNnpvA5TIJ64plkgtcShVbgBXzapnimhVMkxRiodBJGDbFHAhBDTRXig43ugx3DaBjZ/w5qLHT8cRmE9sCSVJRJt0A6OiWqIyvGUnFlllgHteD4W4EVfHfrDJzQ3mjg406mboF60a8JmGyBIWbfiZObGHgwcaWBmXmHEnR0cVa2w8zsopV5z8ATW9LFj0QUFJVLBUWZtBzNwbkTRLA8Z9e14ns06feFNAIgJVcZliXEQcGdEErHBuqopin0O8UJUAH13U0EfD4RLaQ47Zw7UCWKk+AcXxHpk7gG9bON5wgH0DT2IkAbuBxAuNE0y/xGSDUoDUa1ASmlGbLBIJXl7G9bFqRFPdAkTy6Iq0VCXXFjQDYxBux1YVZ6ehdNddExC6UCE6LfShQ16Qz9vbN0sRnKwc0fkSvmekZG+62jN6ttcrnSfLQK8UTvIWVpirLWeyq9yRjK+rIUAoyGKINLmJ7g9cZE9rgRQLNYM2USaGGr0uRoHWTkaoSMd2sobZogY6ibyoj0YdKoMHSTfZIwmF5nzFnOTpTNGcGnWGV+26GGtq/h9Fxk7MSUmlsQiiAgSH6CPobEMlRqFSnyYdgIh3lLoqSyy0dDBY8SL+FrKI19b4jj1kaOp8RzDtTdElvUYH7jRbaWKxYVv1hIMmR5EzDcIZ6dX/00EAJ6aospTJo2HgUoc0KG8QMKhVdjLHCA9Jy7zOEIkR4b3U0KCAmfGf3kb7QnInUE/k7qNrVunhqZOSSmhVVs/b7eiWrwYuGkKBrqppxREaiEitN0TtqMEwEd3cVNyR4+lYu9YsrV/b6DJ37EV/PkVkFphRBM+AP1I8+BrQFek/N78wIqsPnPGTqJMRbwMju5hbB4m6zmmJFVjMmWBA/mLk7QX/tnviEWRiQDPGC40rArN9lBXNc6ybu4QbuvX7te/aUvh13s6emCbefXzxi7NuDyCLWNN2t8yosiz7SWwO3YsxdMMU06hGB1A6uew8TqgUfmXgJ3XMTjgOH/rmaGqTol4pqs6dp9/HZyvfvle9UBhjL41Z1ErvvkWryTnfdKftwchhBbGzn79ChXb8O7jzm7P/D8w3tYpfntVCAtcO8AVZDvCTee7KwfVzmWFPk0rUbbNDgVjWn5H9xGnxFMwq+wVwq174+SEaEsEaaUhh3hvfPq1JYaEwmGO876DDtlhag9rZMQyoFE9D2IV1SVTCnbkyFdLukG8zB1ozTJUWcrilHWGu2FO7g2nn9YdaHlswnlN+w/h5On59k0rPFrBLsS0X7YxJx+PJ18D2uY+JxU1BqjYbl7kISKQSF3Aq0YWY1JigQClSGNBq7okeVF93btLDkBHnSPFFcLhnBHFkMRkwfwOK02MFSI2MaT0e7crXVYfQ66Wwb2ctqjf3AY86wzlYyuU3gjLjGXINZKu1QIysVuyN4wv0AkLs0Flt40/wgFsIpVrM3XEtriO/ct3MIlqNf/S9m6I3YNv8aQDdgy2thEM5nRBZlZagKi+Ekbny7sXTm2Tf9s4AZizsHwsw/q5ff//AXa/ued46jptg3QbQ9n2ZxI2Z3ddzgLVXoXxufnH7h0QDkwrc+dv1Pep4XLc47XL/3PI5MXj4k2570B6bYdWbo/W8fL+zeqaLOeQL+0pxpomiJBdlardKrZ7yfC4KAQs/Rx3ev0aUwP758ji7fn1/812v06VKYVz+hp5vVFgnKzIoqRFZS+1FpUilKDHzrh1f/+/979iRIEWpWCWVcnx4gU2cFDo/j0Ym5757X/Nrx4mWNVPiK548L6a5sOoD5kQ3j7vzAh/DtKaatdfKZKVNhjt6+eR9E9k8paDpf1nGc8X+koLMwbS26X40IhY0cFp5wBI/xDd5zDkts6AafYEQ6cPcVepPnCvy0jstD6DRPLynKY+OcD42FXJ69u3Kv0mh4rMB6wujHjlPJaar+7UaXVxaVEe+XpeGRkyCi0NCuPU7DWhPL3HStaQVEB12c58x+GfM2YNuZ5R9+5yZkAGsSwgWX/oaf77LAAJU21zqJXnfXJw2j9x7DK6lMI5IHQjeHABscADPbw5JXT0x7tx8mlvVjUm/r3RjhBQ3ZjVN5cT12YPlirSVhVuV0fqOBjoOsXFZYLOmsMZ2IFAu2rBTN0XwLMKnIIWsoLGfKI1sPDIpGR7Tl4KKLBP0OeETdv1vCFd0BoGghDc18Znf8PKP4pM2FznDmUvETgC6NSgN8kYAlFgmqhXmK65Cq/0mZgKg4z2pPXDq1vG/B233M+qt1nQkn0GAvzIoqQQ36uC3pc/SpfsbeggPsR3RVO8AGL8FvY5paPapnAmVixDSukfZ+8ecIcx5UJsr2i5DghhUk5q2psm8gE0YibeAxZwJ9uhwVKAQSZJPJq+gi2wKVZYKxbxawojp2Rq8Fm6DExb2IsVPRwd+eAFs3WiHjVCyjT4oEnK3ykVALHdFAncqDeScAIxCBdIIFwugXqTZY5cM53Qi9WUKyl0LY3vhbyKWbU7OhVIRVz8hdE+8b45YG826oziGDoGU8ZEYMdsiEz3OFtISCGSuW/IiN8BbXHIsp4vh3cFDWCSIdF+Vgg7suyzaSsrYW7BIM2N2XJ3akkhLoQrCO1w/ubhF7rAwjFccKQb9oVCPx9OL29Vu5lItFePo7JZlZ0eTHu4PsR7ugu40dvC8s3hbdN5VZUWF8svgo2rqK2Tnhbgk9bslx1D9pqkYRlpUhclpK+yXHEb6uCKFaj+AMncePa452XOIJ4IWsiruUaosChQkD3KYQTjs40h6OVipBgE+XUth3xcqtkHLY/BANFKXdXa3j9aMbeTcxcl1LoWaAM5o3+/F+mJ4+zATSzFQB+YmguIB6Ee2hrrBGOJelfV3MijKF5Ea0R+YIZ/CtFLIYyauFmRyauRb10yoRVrlnIrfyRyrdEACjXxin6I1HbDYgw12cvaLZmLuTownjzf5Pkq4wSoJrn7UQlwqhPQYIEbPe/QGEcPl6175eIzYlxhNC5zJl9UBg83O6wmsmK9AuiSxKJQs2kqFIp0buQuA5hyKyBTrbjxsT60bsJESyj+GO1omCCOxgGHW4zBEIBtZv8Et9up1Xtr1vo2zXlllWwvTL2WJr9DmUgWfkGLP+TloQvMdLKqhipN4SEAQS/fqpBcys4KkNzXZDHtkZ+WGmjRoPftZ7Oqbt1sn29HL/nrx64dZKuK+gadoY4YYVVFu57rQ9RUs6GkTypxCtKcTBg4DGgw88BnVH1jqmd/fJWOvHu+3ph0xHG3J65615h/GhHQ72BjtuBcIdhMHXu7uXB3enJj07d9Gi7E0dPrlovVSnESAH5HgjQL5edvzx8JHFGm0wzZHdTT6qSSVIzDt2B/kxKTvG3NuAGRulHkrQen7q6JU7lVllBTUreYIoCd7xJCOHhv/a6IFDLyUlk3qd9kR1Pkju/bUWkT18mcgT8l+zn7//Hj19e/7m6hk6Z9owsayYXtEcSuGDuHC5lMn7Au2LhEG27MLh4Y8ZvjiSMaZkYq/ivvpPe6ohDJobAx75aEOf73NdCKT9N3W/Hccf4BSKmWIRapPeZophHqs7XW8jH3DOKu1WQFIhzQrGsXLiyYpNe4cIvOvh8iq455rlU3Ya6WbKf7KMUHsRe30x20uers7ijdh31yGs4SsNO/5f7ySCTwa84B03tFOWkYddmVKlTAwYhGyA1FItsWB/7smqFulY4a7EPoLSXZ4aIfeCqWAtaaKuP7/Y5eC1cC2+XO+inazmXynmZkWwoqhUNJcFEzhYcNcRT1fYMCqMPpgez/GUu32LT7pZ1/qRlokY116dJ1ZwlVgZaIbUbnW/WJ2w2ZEXNneRqAuaU4UNzbNoSWV7+MMKn1/qFZvg2ZWSa5Y3zcP893BZcq+pDhjDN/+xz9quThtWcNpNsnyiXTZL+l5/ZjuyzeDwUMicXDMXPV/1FfeRFnCN0hlzKPh9NU96CzpT50edSuhlYKNORwWNFWukjVRO4ltoBTUYVnsC35rZbz0J775gec7pdFLuHax3VzkXON6O3DtKztXjMabZ7pVfrdNhSGzr6OxzVHJsj8y+z1IhKojalmNefkiFnMCevEMGnWpsy1+lNugdJismRky6HCeSHN/0af1JQKZ/qagVH1Y/ck3O9Ay9zXGJPsM/nH6US+HqTv85fDzRCq+p1Zw4xQp9qajaIuhBqEspNK01qnBxqt1vBr+ZRl76HnjEQlas7gIp3PZdX75xPOstTYBqy0AffHPUu2IKU57SOsz6PF63lt5pYmRtQ//wMo1UJUTQjtXPm5fHRZ5dG6mRGjsPMfMWZvqDwGjDRC43GumSErZgxH7yPFQn6PNkhxfEbs/h2+bcoKfQEZYK0j5DELp81qEWqgS842/pEpMt+qR3G982EdiiX0gbPbvWrjCBwT7y2ndNLUAFatWAyeyLOKB40wcgUP2/U2kK5TxD8u1uO71CPdad16nXgR3DDoOM5n9zxGanyesd26rP8PWu91rWXcDWx7uADnczjcOuCRjsnk2bkOmOYXBC4YYUh4ufoWwg5kjA0Qo32HJOF0x4Xz0IJ+jqV+BypOkgYHdUoVgi3FoHTE/9iy0YG59t6r37XkojvSkbH7YxmKyKiVvgt6sCwdHAOuoeR5IhL3Mm4k0Qi3o37JahqDDt4xkQUt2yHTgW10a7Le8PTO0cYJ327TuAdYlVzVP2z8/brWxWbNBKHdnbYW1Zl/x+p+2Z6DNLXFsLqbbpDvyvusTibwc7xtSI7HZRr9Xz0NNkyfLXFwD9wN5OphINdlX3W9+/q1EuyKgwSpbHiI5cVvOBc+FOPO7XtNY2PVCOADi66o5p7+GZLEosts19hGsH4/SdvbKmyj5DGRMLGVYKsL5JXSN0QH70rMgasw1N2xV98SVVjsAvFedb9J8V5mzBaI7Ooe7ZOQeDqGzoPCNS3rATBd1/p3Pk1m/tZ8zHtPno3WbbcHhZGVC5jxxheviuf2iW8FN2vDva+eRn6OO2dFtvPQeWOO4Exw9P0UUWtZlsD22Lg3NEqCc61La2j8wUrrpGudzFznkWS6lqbz+EmD+8HTnyTq+cyOxU06JMO4doDynsygc99zWaSspEmsguUnYdex6oxCbsmiQiwzpmtL8DWPly+siQK8UjHnMHasRTaYzRrFKxvCEdmJqqDC/j2ZQt6OjP0y7oqOmPu6A91ycQLPTWUAGqVXzjxMKPxs2NordStJcqE1ujcktMUUu4I3M/wrKgXr3w/33mUXjh/8PnNYXc/phTFc7O89s5YfTcbaYbPAePa2fU2mA7uR+IZk0qJhZUqZG463Dfk+yrq/gfJH3QPTsBknVf4kXnGAJXCsLaMumVCiwxGftduLi9ZbuPkEGsun/6Bx0maI0P/GTliqpp/BFWZ/cZT0/PYPTjM3QG64dRo8pM1CxlhM5nVPnhn3QnC3NPc16aNHTcIWTnwO2iT3SnU/Tek2Z/HuuVvH9rlPBpo2v2Z9hbw24SyZTLf1wgQZfSMHeA5QrrkQlQmkzdVqhzlG7x8eGC9qiTTYAaJLj0eKxunF7X34QTUjRbTlFRsdvfqJl6+HF00LKVJkzrKrrSCZAhWSqdt+5hMRTAkCqV1Ac6OJSu9Lywi6NrCE7vk06TZEg0ncF9FPnpNaR27n+MOtLzOCTvLz334DguQrXm2Trli94PqXpHdhCZPLOsh6vobRp1KsDshnqLOlFzg2/acSXdBwlk609IQ7xOKnR5/eYf767QlX2n0G9iZPpKi22iSupjsP24kWFsQQyRFSU3+ign8t2EcNoeZKGhc02/zqZFGKSB+hGErRTco+VSxQZNIU+g5Do8mq4go0YD4GywqSab8NnFco05yx0jBpDoC8LJulrvE4RAsRu61X2xHYnz6wTSyLBXxpQ6YzCDNgloOMoUBCH4EdwmthR15YtUzGwP3CgiiyJpn7g74u3w8A6hcAn+hinK+5ZmbBfLhmORaX2qgbd2ZSfDf/e7rWu0gti6UuOslGyKtOoQwg4DBBgAUmFrAMhKVliIQeOM1O2m/KqAyEjMdqK2zc3D4mce/v72zXv/7r3oLd88KEaqvu8/es82pm+yteRVKgK8qec4Cz/nppmMXY/zrQQzGj11SOhn0K0DCnvribo98AiQDu6GV4mk2VuP6yfBjE8XmO0WHaypgkyBRcURkYLQ0lhD+dqd4Uh7hc0mpfR1hLcGez1C2yJaSmWQtPT99d/fhFJwg2SPzXdSLadPsOwXGOy4WOfYNTsJNor5+8VvV5dX6B2+LZjIm7He4WO1e5s8DXNniOLItvw2Brvbt61GfQqXLEZPz3ZVjtliuoLNUxfh11tOrnbsOMu8VL489116PRZ7MeTTHcqJewXUOy7+29cNN4U5Ih9qkrFvN/hLrAl9ouxGP64arPgmqFu44t7nSFeBFHWs0V+1UVIs/zbnmNxwpg3N//rC/+158ykTC0rCHy2YohvMg4oMnvPObxAWOdISjbClokumjdpay35KYVFis/LN+hscUB+HAZLglJoKTVcI7eq1iFSdLuSNPtlgToXp5KTUePuBjLNmmtqsd/nHcR/DO6cLXHGTwZ14jRaY75Qi72xpN4P/fSc5op4U2Y6Mb8vWjMKLBSMwSGBOqUByDn0jOg29mnPR+B6b6V/sA1sZ3vrGZWyxFonVyUKnbpM0IlEU3qCCao2Xvi8RkVZ+wwCzkCL5Vi7ROSUyHwn7eFjRfVSu53PEBKYewlNKIyjCtC+aXCAmtMHC1GiEbXzDjnrE8+E7FVTF4R4ya90aV+fUjidAK2vbwoTd35kRVOv69A9PQRB0TVW3QUWJlaboHTUYNHVfc9ss9fStXOoXVy6p9tkA/LlPB2vVCow+UCcsHIeLDpojnWToOokL52HR5kIv0yrP/ozf+Xt+ef6DD7i4tm+tdQ09AW4xMYjLpTuvYV8b2B1MsvbcAt/Tu3OH7O/9wc5GOWMA+ihOCXHGAPI4p4weyXraM3n5/85k/5nYVdMcyMOur5z/kQV7XT0a7NapQqUPQ03RlFmxDydbqvv/MMzA9ktXcP8w5HCVM5NBP+rHiN6u4fSIEFtFnKgbFTEmjkMsrcZUS47Hy2k5PWpYbFqyLSjNUxeBjIctum0TXSNJmg/0kIGS8DAroqeHDKAfsCLGqTh9nXl/MG6QfI5cg21GIh8KUPDe5CNTqNU+OtCo0arZv//TdteoPZOC2McBG/nYLdsRcQNN6hKKwy51z+wyLvmlc5/fyqUf6+qrGKCXnDVBFPWCarD1BbulOdIUJu3u/Hh3DT1usNSHMID9YIOlOYQB6HsdytATGN+/dBxjDvZ1D5rcjwYRWyzs4ctf67xSz5G8z5GaiqbzMJdLHWKbjg/p66EvO4bBBj8aJezl1fqnth/gyHXvE3eweyO/VuKuX6Um76v/e8mbuPbJ07gvF5wjrestyxFGS7amonGSfb2KgCXRcf6LtBZI/hiVv68jojHq0JDlNlP0S4Kz7gYP4YBh376Z34XvKXYFF+m592Yb7CqsCR5KkDmtk0c/XQrzwyskFfqFS2x+fLmb5kWkWLBlpcbzW9p9H6PufsX7hjDoYy2bBMt4gp4ZY9kxdTXR1+5gkGqDVZ5Mqds/qd4pJJ939D2MFOV4mJrmWqv6R9Sj7ZthAqfqtsuHVGzJBOb1b3a1lQN0SKV/7UmMuLz6/CpAAhTsJosikKDBaEjlGK9Py6hDxfHY12dFcZ6wvH7HtIOl0OX5Q6KkDt9usBTAHBcrfdRONk6y5H423OTgtooWXBRrupxJzqFv6tcogC31TpBzY3mOaUQc6erxcB1F9a0cjrMYJ/QjtPgKMn8sqmohtakL9+bbwaE1k7gsQM2Kkm/9OdkvQzIzxWSFNMspevo9MitVoZc///wMbbAfJVSvsocSj0J5vQMl/FydZKQgXw1XuKEqtU+h6btqr7IOQkBP8VyuaYcYLFyiU4s3bRTFxej9IV8N25yYVDRnRzVNOESob0KaY+NYYAvETN33B0T6C9cmtEZ6OM7qnwjqRbZUoZfoQhBc6orjplnZveR6CPoDgx+B3MrQKj++RP9mt/sc/fgj+jdEpLL6sus5UA9T+x/c/C/7RabRLlHC7S+EzOmjtXXFhmYEcz7H5CZ96VNOhTT1aDSwKywR65oXME3GptIBcyRvZgQsAw23MQeM3Rx7I5XVrMXWaR32g04zihBSCC1kJXL7wnAYyKChI8Ddkhd3b8QAcoxYoL8Oe8JGI6ew5RLnj+Wd8+ggzf6EYZSKkYDV4U3h7pfBFnbPfS2E7bOPTavRykV9bDP0q9zYoxnanEwgqawxZiS6obQ8QLRH8eJ9JURzgymydcqB5xe15IGxVG4+tYBJ/B27cM0UjEy9PN/1vYuAi6M70x2I4Xbhr/rlOVJWWmtwqAxni4xO/28okaye+eSU2J1HMpIvlyQUNBT8bfOrD9ANv5nRTBTFfhDQiKC0/6sDMV9B4MWvlOmSs9TdSx6tOa9ZqkLYB6ZIH9c06q78DrfOvgH1RCDPdbXV4p+Q/x4RRideBuOCJonRwwggqdDV2Zsrr/sSLCx5WFFK1dd4ETyRX10aRPU43B+f3FMFhnho1C0amvJV+5PWYHd6DljmM/Ty51doA3QvKBYIcx72FdTVzwvU+o/QhirqwGKDOMXaICl65SK7RDy5mvh1EzFwV1OEbT3tfpcqB8JBVhMlKyG5XG77gbgFUwMtFqGfEVlhhYlxRKTQvshi4Sa4o0r4nB6+4zMfraiNXdDtAvUpgwj7pi1Yi6KwSqYUdRhB4c2oTAPJ2lMrMQGN1cUohPc5SEIqVUPUBoscqxwJqQrM2Z+h/F6piiB9cp/lcDSJ7jYLbw+RWqwbZF5wtqCw44CBrymRIh9RsNvjzrSZoKF9aENMEFmUnJogA4w6UTEo8OONprXBypyIka/t2kF2HmPlXc4cZb9CiuidkPNBgsSDmx6I/ESEvxB5CrJbkH9KcaLuOfXqtYrp0ms/9ik8EFHJbvQbBMO4/Qhy3w63xi7flwcWON+HMtu2Pwr84SAVJVLlNE/3DvokG/9M6WbFWseoM22aL3bj68PXSsliBlArKMrXhAqsmHRqfVFxw74zjCqEy5LX1S9tL5sCC7wMleYixCG8U9uLDimHq0bMPNFIboSLjBlclH3PoMe4npo0vH1GI7Ji1rqROdUz9K7SBsykLlDXPWskLxcbeuQh7RVgi4XFe02n0ITgkOsFHe3c0DRBHENgq1rnbM1yq9kAP4QF2XUtyD72iBfe5G3J1GQ7bM/TxYJuLScyw7dus9oKPauvWaSAQff7RiMe+oFu37U8mw2WbLurVbElUBF9FGdD/9hXBTTILxWtJmMly92Oi1r5uMEw9rTqNuDqolkCcrFGPTREjagU7BA0gUxbFibB67ssUuBaZglQLbMU2nMZUxTtAo016qOFmkBX6rwipzEhe+Zj8I0ZPJf3enOOFZuH5NoxwYL2geh1Q4jtCMJkoMTHUKx1xU/UNF9WhsiCvnA4NMaLH+Ay4BAsPAl2DMgRBqFrqphJ3Rp0rPu0X90XAY6NJu25fCYe3OZe6abSxUKDuJMbdd8aPmHt1gVzxnqqeF05fTZT4AAaFyPLB5Nhm0mwQbxDU2QSHsLnXSu9awlKhX679qmxTNcJAX2/Gqxfn9BYlaQupWYRBcedeAvMaZG33YWbuzvahafiJkvXuuieokhUBVWM3FcWBfc20eTnO1SyNTfDiSV3vwdbW1ORw5zkg3JLzv84QfeaOrQrh9Npu4ilrwUfkBvmAe9FzEn6lL3qvhmdBOvFjPdyrXCTWyykQbiZpBZOoOVymdWJKicR6jUj3luoT9EzZUf2/R3SraBr9bDtd6P4S87IdoppOyNy4QoQ8M21Bd+OyOWKp8ybDhPwQ+Wb/4fFqRSG3qbWWBuELttRAXV1VZ5r+3/wqGJeIxRqAHPgcSYrLJY0E3STWhaMBS7pphPqByXEGMXmlaEdCTHM0dcOdautd5+/kaHEJY4m7BrK8cGEjkluDhiC/fwih0xXfwsYt1ABZglWNxzUbc6XWlM1Q9fUHUqlqZrhJYVW3j7TfSFVjcMAdg3G6e0Efo/c7zt9K6RCcyU39rP6r6Se42jNrtF+0pf5FVYmtpuuARzbo+LvlBxUh051pyTP2xmkia6ULKkPKKZ6i98IhDlVpskuUu2i/m8uvOXFR6cJACQhBRTmHAkpvlO0pGDJ7Mt+mGIuym4f/dA0FKfHvWAuwlaHfwY780M1WlmPzmHBOVSbCCTFd0tp/3vPSwBKShZQHBPuG3eCgS8AAYukXCCYMM+onqHrVqb0Bxt0K6vSYHzmyvkqbY0YVzLqkm1yL36baSaEV9rUDOn/MTgm+AnT9iR9TbT3b1jFFz4dV4Em137cDQtb9K4tUzql7Mkhw8tieQ5YIKy1JAz8pfY0gvYkHNhbdkNfdwYZwuDC56hUMBPlOaKGPAkryljhWAOrDwSxYClqqNKoxBq6eGlo5OCnScuisFJM7gTth6U11JC96p57D06l8XXOMMHD5MQ3kUVZDe9ggmPDaMNELjc+n9ZPm3zeZFKMEmOwzUXF+RZ9qTB3zs9cFpj5Qbyw73ohLkeerq7XM9EA+8FoOCZuaO5rgepEdKzBO+UNFPvJNw1qM5bvOzg+6AqRVNR1Jzs5t0QfgRq9365Phddvpfe8outhu54m6ExVwfqDnVK7WP2anTF5+zXtHyNr2gvG09/xZsu/wGrNNVY0rwhFdeSIht1tbqZ+FnhNkz0i1ztj/PvvY+cBtC/MqF+Akht9VMuBGB5jv7p96FZYr5obatXCQJVhRVYu87eusWnKDM9qSL0WYXYjzTIzrYj9VfPvYaUpsvJcIAY5d5UgnGJl/wSN8FrUfAFhPfm1Luw8HH1wwq8a9nl61C8WkcW8Gd+72HmwfNmousfrtWaq0lN7+rraCCAw7vGbJkAauBJnbnXXk3HcU+osuOkG1zov8+W5H8GNnvrGDfVsSlf0a3F7FtarnQP6VAP+vfv58rw737URE0PvwW5EzqUBui3MHBNZWbBhOmykrvU2ZS/73aiuL9B26sJeP7ZwxvfE447PmoXR5flBTTaWf+6AJmsReynyVqOdoTNXn+n7nXL3wX5tFhBUu9/44RvvjptXpqnclKZ5jCrBqXaUke5B2Ui0xorhOR9UAbqmDEygkuMRQaCp0En7o+wcaFdVdSvPrKSyGkZdX8jsOV+/uLzq69DIt4x1HoWxuuwjBwreuRayjbQ4JNGlMOiaLQUGYTHCoqVUKZvXPhnIL8ukV7XuJqGrI/ynRaRzl4HLchlgnPe/fURMEF7l1IozP8jW/nyGnl7c4qLk9DW6cg4RBxak9yzsF4HI3OSxTXBOtU9LGDOmb6zKfQRe9yjF67gx3/un4QPTN3tCrkax5ZKqdCPswiT73I0FeBxAO10pqleS55Z7nK0+Mml0J/Q+gWdhGHv3UvnpB6djPGuacVyeh8tI7hydJ7Ios4nzruBUfO4VjHF1/j1dzb+z6EgB9akLGDcj84qMWWleLT1R1lgX80ZaSgWdB6xcr/EbmRKHVb7B6jQZesOu+la6Yv8Q2U2MtEZ+aoUoRu8wqfsph5VbK4ImtWOk+K5WUNV+KeRszehDrRXFOnpusDbYVLEU58YfhRk/mdlhF5/LW8TyF+Pvl31ZqykwtBh9GjQ+dnfBYhG+uvU7lnj63oDJz4dz9455zpiQVawYZ6eORC+j3ykrSWM6HQYe2Z8iA07dmXGHJd5wbuUe0hUhVOtFxdGFXR8RmVNtWaJu9hu2LJjI6W1kAnCmzXGa5wNlCywMppiqkZhTBfHNAivGIYMn4MFz8XexRBiI+J39bXBnIgEfyrlrLnQijdivjp42+ZwlVbr0RbdOwgxI5lWENiG+7vD0bKTI0Lm5hu9x6oQSp3w1SV7eV+W+bT/ETGiUU4MZDzgZ5rIynd+NbE3yyXMza48tbvLYAI/xh9TQouTJsnneoJwusA8B+c6XdQzfZ2tarXhNFcdbKOQy0j+u6GngRtoPwOr2v6aLugrc+eq1YaaCxowouLHWNhg2bHrodY0axer4dwiOjWkCWUVkUdj7lIaNzhx0xDrJvqWSa5Y7/1ndRa6gejQRKpfk+EDj/b1lvzDeao2km5cXVg1uS0h6Oo2sr1dPK+v/kPMj/U5Hb+8/5NwHYMK3q2TpGueeQ0KxO/nrq0t0OVCoumgk61rrq0v2YxCxsKuphl1GNaTv4w/zudVh5d6JiGwu89QVX4OKu77S4XFBFpcR9WgVv1uCCxlMUHnecQH70mGXQNvEQ9iS5U0oZ8SJV8S2Ggdl4BFe/nhKXrPvskr5TNXTva8+ue45dSAKkjVuKam6XgSX+jWnofLWugvTvsSNCRwhQa94vusQaaor8RozjoeBDNS4whHUVy6oUiOTFtwdOsbXHy/u5o2VwjeAcgHYwZZ8uoFmy9mIRGRFNq/yfBvdP8OKLGodUAdupelxjc73eqniQ1RMRuxy0Cuxy3Q1RUEC093sVddzFVc5M01lXdsXzWMUGmzXVmw4UdKGF/Zv0mWJxabgejKr/OzzBXrqayU+V9zqynPGoYAD8sAubkup7Tefoe+GjgbRj8LcCLkRO4aQpqSCZhbrXegjkzYJnsAF108LPaur3N/70qS3dInJFn0aNdc4myt8iqJ8v/AOiZlABWZioXBB96ZjlFjB1N70fRJ2lMsrWBa9l7lLjm7bAnayzgJIoQPaF6QKWEKkspB2+8a9pxv0ayXAlHwnc8rRUybWs2+fIybJczS3/0ft/2GB+VYzPfs2HF80pMwWHA8m58fWoXY1/LMrBIuCrwvk5LYefiUXexs1GJkUU/fXucezboOgqbKMHERoXcSVuz3MPr/7HSuKProE4G+//fzu9zcfLr791uXcrrHCbJQnN1LdxCxZPnjBfq8X7EbYRp1gWMRWInzNTtwuJc1zgIl9LrYJTJiFVFRoRmIKkI4rKQHGRXwvSCA+EAtotsFsOJz4wd4B6H0eG6i9PrFL1HU1T3QpzDzXRsWufId67WQOse5bGu0drWs+0jlJjy12aQeDDVQaX2zS1r34ehcLYsFGHU31VpM5Yo/darAbUWCb/fKesFA+up/g/R0XFnmv/38YrtqqzG7y30lYLO/46D0ie5E8CXPUcdx9+Ek5QdLWzsl27NKnpslor7PsoE/mM3C7DTj3cGS6blnNpoiHQdHXAjNuaV03c7nyMuPyvFvbBp24rDlo6DLQwmA8q7DOuc6sinjEfo5JvIZ0a199dCaLohJ9T9QAO3Fc46aHYvee3pq/07BO3eCmj9OsH4rbNRb5v8tw1KzFzWDDjpEMD8ZuuPAOcrrSJSNMRssSncqCB+w3WIlh0OGxo65FUWYylTC+fv/uCv3m/KhtUmoYkS+TphJc/+db9KWiaqR3a8VFpmi/U2fa5IaOQ3SLPtRFZ8G0rkZLJxEf0i5QGXuMgAVaHuU4OgTVBIJjD4abxx/QgDlWRYLTsmATuBdwGbEAuQFa5dGm0u7AjNvtagd0jk1fK3wo3DkVZFVgFauspIG7LfFgfPGDo0+YDNKposDMVtF5gdBF3AKqBvBiCa2WEoCV8z8SQC1x9EkYruNUdPaCoHvGYj84vnNbQa3qGR1pkWECg1Hil59Y2FpENN47gOfLcv2TuDWr6O87ERkxKst11L7rHegW8nGRpzsAXnMcXWKIjIolExGLIoegU+RGi2yR6Q0zJLr8ENmCy43GRfzclS5sYdbpoCeIuhCRMZFSnDBRUlXMt9ES3gewS3KTBvga8xS8wsqsVNLILH5ICqCvf8rA4xgfNk92N7lcZnkKYlvA8fPfiMgKfJsZE8ttsAvYcjSnCR6FgolESDORDumS64zPeRY7LLoD+/uEwKN3Bu/Ajt0LsQs7dlVvF/bPCWG/Sgj7XxPC/p8JYf8lDWwjS47nNIVIaaDHN89EVlQclO/5NsE7WQMvbxLoJUXF2bIo02jfVsvEfBk7CclDZimUEk2/kPi+EZFpl5CY4AS1ImmsSQs4jTWpt7oqE8wiJaIpq05iqhpprOlBbxOIECONNcxSwQazJgnwSrBbgYXUlCRgwvUrS5VEj8L6lSzNiuI8gVtNFmVGeAIftgWcIEgCcNV8a+K7RS1knQRyWWUJYhpEMcMI5gkKiHSGl1SQbcSsqy5sgfn2T5rPU+C9zqANaBLIrh1MGqxdYm0S6PNluX6Vxgetszkzf0nSaIzoLO6suB5gJaOLap3kmgNUSlT8KjftfPzRZm11AFOzcn7++M4RBxzUviTAXTf5eB3kOrAXjNMUNozOFikOkS1iFmfvAk6hG+iMlZCkmCURdaxc/5RrUw6a+UeCrRVJApuzBU1hxmhwNBc0Z9EKRndhM5GGSwqZV5xqIlNQ2wNnywSySZZ6g03Umf8d6KEM8iiAFV0ybRSO7wlpYSfQ+BQtU5FaJaO1hk7kKpF8dZn5jsUTQDeK4iKBIulKgVKhnU653qwk05mbMBsf+hYrnITB85FC2BiQ126+fWy4TBssos85zrWZVyrWsMAaKnWzglJAraLjGl+PrmuSY4OFyQ2L+MOuj+00sA/mEud57DvA8thh1bp1UIK3iBUZUVIWSboSWcAJzDRWZGmSI33HoxRkLm+it2cqdfyWpazUpWKRgXJsmKmiZ59xJmi8FjstVB11ok4DF4pv47u1uHRdT7MFl9Gf8wZ4gpR/a/NGlzoWaAKJY23oBKhGz03gcpmEdcUyyQUupYotwIp5tUxxzQqmSQqxUOgkDJtiDoSgBporRYcbXYa7BtCxM/4c1NjpeGKziW2BJKkok24AdHRLVMbXjKRiyywwj+vBcDeCqvhvVpm5obzRwUadTN2CdSNekzBZgsJNPxMntjDwYGNLgzJzjqTo6GKt7YcZWcWq8x+Aprclix4IKKkqlgoLM+i5GwPyJgng+E+v60T26VNvCmgEwEouM6zLiAMDuqAVjg1VUcxT6HeKEqCD6zqaCHh8IlvIcVu4diBLlSfAOL4jUyfwDWvnG06QD6Bp7EQAN/A4gXGi6Zf4DBBq0BoNagJTSrNlAsGry9heNq1IinugSB5dkdaKhLriRgBs4o3Y6sKsdPSummsiYhdKBKfFPhSoa9IZe/tmaeKzlQMaP6LXzPSMDXdbRu/WWuXzJHnoleIJ3sJKU5XlLHbVe5KxFXVkKAUZDNEGF7G9weuMCW3wIoFmsGbKpFDD16VI0LrJSFWJmG7WUFu0QEfRN5WR6EMl0GDpJnsk4bC8z5izHJ0pmjODzrDKfTdDDe3fw+i4yVkJqTQ2IRTAwBB9BP0NiOQoVKrT5EMwkY5yF0XJ5ZYOBgsepN9CVtGaet+RxywNnc8I5p0puqS3qMD9RgttLFYsq/4wkORIcqZhOEO9uj96aKCEdFWWUhk0bDyK0GaFDWIGlYouxljhAWm59xlCESK8tzoaFBATvrP7SF9ozkTqifwdVO1qXTw1MnJJzYqqWft9vZLV4EVDSNA1Vc04IiNRiZWm6B01GCaCu7uKGxI8fSuX+sWVK3t9hs79iK/nyKwCU4qgGfAH6kcfA9oCvafmd2YE1eFzHjJ1EuItYGR3c4tgcbdZTbEiqxkTLIgfzNydoL92T3zCLAxIhnjBcSVg1u+ygjmudRP3cAP3Xr/2PXtK34672VPThNvPLx4x9u1BZBFrmu7WeRWWRR/prYFbMeYumGIa9YhAagfXvYcJ1YKPTLyE7rkJx4FD/1xNDVL0S0W12dO0+/hs5fv3yncqA4zlcas6id33SDV5p7vulH04OYwgNrbzd+jQrl8Hdx5z9v/h+YZ2scvzWijA2mHeAKshXhLvPVnYPi5zrCly6doNNmhwq5pT8r84Db6iGQXfYC6Va18fJCNCWCNNKYw7w/vnVSksNCYTjPcddJh2SwtQe1umIZWCCWj7kC6pKphTN6ZCul3SDeZga8bpkiJO15QjrDVbCndw7bz+MOtDS+YTym9Yfw+nz08y6dliVgn2paL9MYk4fPk6+B7XMfG4KSi1RsNydyGJFIJCbgXaMLMaExQIBSpDGo1d0aPKi+5tWlhygjxpnigul4xgjiwGI6YPYHFa7GCpkTGNp6NdudrqMHqddLaN7GW1xn7gMWdYZyuZ3CZwRlxjrsEslXaokZWK3RE84X4AyF0aiy28aX4QC+EUq9kbrqU1xHfu2zkEy9Gv/hcz9EZsm38NoBuw5bUwCOczIouyMlSFxXASN77dWDrz7Jv+WcCMxZ0DYeaf1cvvf/iLtX3PO8dRU+ybINqeT7O4EbO7Om7wlir0r41PTr/waABy4Vsfu/4nPc+LFucdrt97HkcmLx+SbU/6A1PsOjP0/rePF3bvVFHnPAF/ac40UbTEgmytVunVM97PBUFAoefo47vX6FKYH18+R5fvzy/+6zX6dCnMq5/Q081qiwRlZkUVIiup/ag0qRQlBr71w6v//f89exKkCDWrhDKuTw+QqbMCh8fx6MTcd89rfu148bJGKnzF88eFdFc2HcD8yIZxd37gQ/j2FNPWOvnMlKkwR2/fvA8i+6cUNJ0v6zjO+D9S0FmYthbdr0aEwkYOC084gsf4Bu85hyU2dINPMCIduPsKvclzBX5ax+UhdJqnlxTlsXHOh8ZCLs/eXblXaTQ8VmA9YfRjx6nkNFX/dqPLK4vKiPfL0vDISRBRaGjXHqdhrYllbrrWtAKigy7Oc2a/jHkbsO3M8g+/cxMygDUJ4YJLf8PPd1lggEqba51Er7vrk4bRe4/hlVSmEckDoZtDgA0OgJntYcmrJ6a92w8Ty/oxqbf1bozwgobsxqm8uB47sHyx1pIwq3I6v9FAx0FWLisslnTWmE5EigVbVormaL4FmFTkkDUUljPlka0HBkWjI9pycNFFgn4HPKLu3y3hiu4AULSQhmY+szt+nlF80uZCZzhzqfgJQJdGpQG+SMASiwTVwjzFdUjV/6RMQFScZ7UnLp1a3rfg7T5m/dW6zoQTaLAXZkWVoAZ93Jb0OfpUP2NvwQH2I7qqHWCDl+C3MU2tHtUzgTIxYhrXSHu/+HOEOQ8qE2X7RUhwwwoS89ZU2TeQCSORNvCYM4E+XY4KFAIJssnkVXSRbYHKMsHYNwtYUR07o9eCTVDi4l7E2Kno4G9PgK0brZBxKpbRJ0UCzlb5SKiFjmigTuXBvBOAEYhAOsECYfSLVBus8uGcboTeLCHZSyFsb/wt5NLNqdlQKsKqZ+SuifeNcUuDeTdU55BB0DIeMiMGO2TC57lCWkLBjBVLfsRGeItrjsUUcfw7OCjrBJGOi3KwwV2XZRtJWVsLdgkG7O7LEztSSQl0IVjH6wd3t4g9VoaRimOFoF80qpF4enH7+q1cysUiPP2dksysaPLj3UH2o13Q3cYO3hcWb4vum8qsqDA+WXwUbV3F7Jxwt4Qet+Q46p80VaMIy8oQOS2l/ZLjCF9XhFCtR3CGzuPHNUc7LvEE8EJWxV1KtUWBwoQBblMIpx0caQ9HK5UgwKdLKey7YuVWSDlsfogGitLurtbx+tGNvJsYua6lUDPAGc2b/Xg/TE8fZgJpZqqA/ERQXEC9iPZQV1gjnMvSvi5mRZlCciPaI3OEM/hWClmM5NXCTA7NXIv6aZUIq9wzkVv5I5VuCIDRL4xT9MYjNhuQ4S7OXtFszN3J0YTxZv8nSVcYJcG1z1qIS4XQHgOEiFnv/gBCuHy9a1+vEZsS4wmhc5myeiCw+Tld4TWTFWiXRBalkgUbyVCkUyN3IfCcQxHZAp3tx42JdSN2EiLZx3BH60RBBHYwjDpc5ggEA+s3+KU+3c4r2963UbZryywrYfrlbLE1+hzKwDNyjFl/Jy0I3uMlFVQxUm8JCAKJfv3UAmZW8NSGZrshj+yM/DDTRo0HP+s9HdN262R7erl/T169cGsl3FfQNG2McMMKqq1cd9qeoiUdDSL5U4jWFOLgQUDjwQceg7ojax3Tu/tkrPXj3fb0Q6ajDTm989a8w/jQDgd7gx23AuEOwuDr3d3Lg7tTk56du2hR9qYOn1y0XqrTCJADcrwRIF8vO/54+MhijTaY5sjuJh/VpBIk5h27g/yYlB1j7m3AjI1SDyVoPT919MqdyqyygpqVPEGUBO94kpFDw39t9MChl5KSSb1Oe6I6HyT3/lqLyB6+TOQJ+a/Zz99/j56+PX9z9QydM22YWFZMr2gOpfBBXLhcyuR9gfZFwiBbduHw8McMXxzJGFMysVdxX/2nPdUQBs2NAY98tKHP97kuBNL+m7rfjuMPcArFTLEItUlvM8Uwj9WdrreRDzhnlXYrIKmQZgXjWDnxZMWmvUME3vVweRXcc83yKTuNdDPlP1lGqL2Ivb6Y7SVPV2fxRuy76xDW8JWGHf+vdxLBJwNe8I4b2inLyMOuTKlSJgYMQjZAaqmWWLA/92RVi3SscFdiH0HpLk+NkHvBVLCWNFHXn1/scvBauBZfrnfRTlbzrxRzsyJYUVQqmsuCCRwsuOuIpytsGBVGH0yP53jK3b7FJ92sa/1Iy0SMa6/OEyu4SqwMNENqt7pfrE7Y7MgLm7tI1AXNqcKG5lm0pLI9/GGFzy/1ik3w7ErJNcub5mH+e7gsuddUB4zhm//YZ21Xpw0rOO0mWT7RLpslfa8/sx3ZZnB4KGROrpmLnq/6ivtIC7hG6Yw5FPy+mie9BZ2p86NOJfQysFGno4LGijXSRion8S20ghoMqz2Bb83st56Ed1+wPOd0Oin3Dta7q5wLHG9H7h0l5+rxGNNs98qv1ukwJLZ1dPY5Kjm2R2bfZ6kQFURtyzEvP6RCTmBP3iGDTjW25a9SG/QOkxUTIyZdjhNJjm/6tP4kINO/VNSKD6sfuSZneobe5rhEn+EfTj/KpXB1p/8cPp5ohdfUak6cYoW+VFRtEfQg1KUUmtYaVbg41e43g99MIy99DzxiIStWd4EUbvuuL984nvWWJkC1ZaAPvjnqXTGFKU9pHWZ9Hq9bS+80MbK2oX94mUaqEiJox+rnzcvjIs+ujdRIjZ2HmHkLM/1BYLRhIpcbjXRJCVswYj95HqoT9Hmywwtit+fwbXNu0FPoCEsFaZ8hCF0+61ALVQLe8bd0ickWfdK7jW+bCGzRL6SNnl1rV5jAYB957bumFqACtWrAZPZFHFC86QMQqP7fqTSFcp4h+Xa3nV6hHuvO69TrwI5hh0FG8785YrPT5PWObdVn+HrXey3rLmDr411Ah7uZxmHXBAx2z6ZNyHTHMDihcEOKw8XPUDYQcyTgaIUbbDmnCya8rx6EE3T1K3A50nQQsDuqUCwRbq0Dpqf+xRaMjc829d59L6WR3pSND9sYTFbFxC3w21WB4GhgHXWPI8mQlzkT8SaIRb0bdstQVJj28QwIqW7ZDhyLa6PdlvcHpnYOsE779h3AusSq5in75+ftVjYrNmiljuztsLasS36/0/ZM9Jklrq2FVNt0B/5XXWLxt4MdY2pEdruo1+p56GmyZPnrC4B+YG8nU4kGu6r7re/f1SgXZFQYJctjREcuq/nAuXAnHvdrWmubHihHABxddce09/BMFiUW2+Y+wrWDcfrOXllTZZ+hjImFDCsFWN+krhE6ID96VmSN2Yam7Yq++JIqR+CXivMt+s8Kc7ZgNEfnUPfsnINBVDZ0nhEpb9iJgu6/0zly67f2M+Zj2nz0brNtOLysDKjcR44wPXzXPzRL+Ck73h3tfPIz9HFbuq23ngNLHHeC44en6CKL2ky2h7bFwTki1BMdalvbR2YKV12jXO5i5zyLpVS1tx9CzB/ejhx5p1dOZHaqaVGmnUO0hxR25YOe+xpNJWUiTWQXKbuOPQ9UYhN2TRKRYR0z2t8BrHw5fWTIleIRj7kDNeKpNMZoVqlY3pAOTE1VhpfxbMoWdPTnaRd01PTHXdCe6xMIFnprqADVKr5xYuFH4+ZG0Vsp2kuVia1RuSWmqCXckbkfYVlQr174/z7zKLzw/+HzmkJuf8ypCmfn+e2cMHruNtMNnoPHtTNqbbCd3A9EsyYVEwuq1EjcdbjvSfbVVfwPkj7onp0Aybov8aJzDIErBWFtmfRKBZaYjP0uXNzest1HyCBW3T/9gw4TtMYHfrJyRdU0/girs/uMp6dnMPrxGTqD9cOoUWUmapYyQuczqvzwT7qThbmnOS9NGjruELJz4HbRJ7rTKXrvSbM/j/VK3r81Svi00TX7M+ytYTeJZMrlPy6QoEtpmDvAcoX1yAQoTaZuK9Q5Srf4+HBBe9TJJkANElx6PFY3Tq/rb8IJKZotp6io2O1v1Ew9/Dg6aNlKE6Z1FV3pBMiQLJXOW/ewGApgSJVK6gMdHEpXel7YxdE1BKf3SadJMiSazuA+ivz0GlI79z9GHel5HJL3l557cBwXoVrzbJ3yRe+HVL0jO4hMnlnWw1X0No06FWB2Q71Fnai5wTftuJLugwSy9SekIV4nFbq8fvOPd1foyr5T6DcxMn2lxTZRJfUx2H7cyDC2IIbIipIbfZQT+W5COG0PstDQuaZfZ9MiDNJA/QjCVgru0XKpYoOmkCdQch0eTVeQUaMBcDbYVJNN+Oxiucac5Y4RA0j0BeFkXa33CUKg2A3d6r7YjsT5dQJpZNgrY0qdMZhBmwQ0HGUKghD8CG4TW4q68kUqZrYHbhSRRZG0T9wd8XZ4eIdQuAR/wxTlfUsztotlw7HItD7VwFu7spPhv/vd1jVaQWxdqXFWSjZFWnUIYYcBAgwAqbA1AGQlKyzEoHFG6nZTflVAZCRmO1Hb5uZh8TMPf3/75r1/9170lm8eFCNV3/cfvWcb0zfZWvIqFQHe1HOchZ9z00zGrsf5VoIZjZ46JPQz6NYBhb31RN0eeARIB3fDq0TS7K3H9ZNgxqcLzHaLDtZUQabAouKISEFoaayhfO3OcKS9wmaTUvo6wluDvR6hbREtpTJIWvr++u9vQim4QbLH5jupltMnWPYLDHZcrHPsmp0EG8X8/eK3q8sr9A7fFkzkzVjv8LHavU2ehrkzRHFkW34bg93t21ajPoVLFqOnZ7sqx2wxXcHmqYvw6y0nVzt2nGVeKl+e+y69Hou9GPLpDuXEvQLqHRf/7euGm8IckQ81ydi3G/wl1oQ+UXajH1cNVnwT1C1cce9zpKtAijrW6K/aKCmWf5tzTG4404bmf33h//a8+ZSJBSXhjxZM0Q3mQUUGz3nnNwiLHGmJRthS0SXTRm2tZT+lsCixWflm/Q0OqI/DAElwSk2FpiuEdvVaRKpOF/JGn2wwp8Ko7b/8/wEAAP//sMlYiA==" + return "eJzsvW2TGzeSIPx9fwUefzhJDrlly7b2Rjc7F9ru9rh3JLlXLckbFxNRAaJAEm4UUAJQZNO//gkkUMV6QZFsEqhu7d18mLCaZCKRSCTyPb9Dt3TzGv1RCVZS9S8IGWY4fY3+w/0B/cen97/d/AtCOdVEsdIwKV6jv/0LQqj+DZozynN99i/I/9dr+NT+7zskcEFfI0HNWqrbMyYMVXNM6Jn9e/M1hOSKqrVihr5GRlXtT8ympK8tjmup8tbfczrHFTcZLPkazTHXtPPxAN36f+9xQZGcI7OkNWKoQQytl1RR+MwoPJ8zgpZYoxmlAsmZpmpF87PB/pTG99jMQsmqPHwrfaJulwWsBead7Y2vPrZ+aIntIoVedP6+e4XxAxucyscl0/Z7iGlUaZojIxHBpak8/RVeo4JqjRf239ggIguq7aal/bwHGqG3coEuKJE5sHFgIw4W6yN17HZquHRFhcns1iID9ggnpr4nuQaaEykMFUbb+8GENliYGg0dxNGw4hgEc2z6HwyxYw4nuwTCBq2XjCwRRppqzaRAS2Y0wug9Nb8zI6jW9emfDVij2axeyornSNAVVWhGG74rsdIUvaMGW9QwmitZtJZ6+lYu9ItrTG6p0c8G4C+YosTwzXNkPN4YfaBOWDgOFy00z4KE5HRF+RGU5FL072eHkhe0VJRg4zHJ6ZwJmiMpOKBl8IxTVOAyjFWhF1m0C7PjjN/5e3518QNaYV75G89yKgybM8+d9A4Tg7hcuPNSg4OA3TEL3nMLfM8eR4mVYaTiWMHv/cGejXLGAPRRnBLijAHkcU4ZPZLVtGfy8v+dye4zsaumOZDTrq+c/ZHBRvrH8miwW+FjhF5y1BTVslIk0dt7OtlS3f/TMNMGG1pQYR4jcrjKmckIx707/EjQo8KozWNEbGl1qseIGBPHIZZWY6olx+PltJziY6RHWrLNKc1j2lAjek3Izmx9sXYLWGwGeshASTjNiujpIQPoe6yIcSr2XCsTUVG0vCpB8jlyDbYZiXwoQMF7k49MoVZXgn2p6FaNVs3+/Z82XaP2XApiHwds5GO3bEfEzYqlFYdt6p7bZdicEdy+z2/lAl2uqDDoBoQzqkROlTVBFPWCarD1ObujOdLUWCCdH3fX0OMGS30IA9gnGyzNIQxA3+tQhp7A+P6l4xhzsK970OR+NFhKnUhfbfPlr1KbtojkfY7UVORMLOoPdYhtWj6kr4e+7BgGG/xolLBX16ufEM5zZWXl2HXvE3eweyO/VuKuXqUm76v/e8lrqZVeNvTlgnOktb1lOcJowVZUNE6yr1cRsCQ6zn+R1gLJH6Py93VENEYdGrLcZIp+SXDW7eAhHDDse7YBKl+6pdE1XKTn3pttMPq4KSkieChBZhRRZpZUoU9XwvzwCkmFfuESmx9fohnWwEV1gGzOFpUC1W/Pvo9Rd7/ifUMYNJ3xGcG/YH+9kKncbLus43rlr97BINUaqzyZUteSaK1ttyl5df25o+9hpCjH/SNFSG+0oYV/RD3aFtqSOk7Vjnj231KxBROY17/pait76JBK/9qRGHF1/flVgAQe/QElTidBg9GQyjFeny2jDhXHY1+fJcU5VZPErn+FpdDVxSlRUodvO1gKYI6LlT5qJxsnWXI/G64VrautogUXxZou55JzSoxUX6MAttR7gJwby3NMI+JIR3OLaUdRfSv7agvaQehHaPEVZPZYVNVCakh2K6RAs83g0BBS9EtFtbEANStKvvHnZL9sBT2imCyRZjlFT79HZqkq9PLnn5+hNdZIUyqaVXZQ4lEorwdQQpdSaJqOFOSr4QoiK2Ean0JVzJzQs1dZByGgp3gmV7RFDCaCmZW1eNNGUVyM3h/y1bDNA5OK5qzq62kxCPVNSHNsHAtsjpj5Z/Xy+x/+op1If1GCAK2R/udgN/+09uBbvKEKvUSXguBSV9xFVqxJeS+5HoJ+YvAjkFsZWuXHl+jf7Hafox9/RP+GiFRWX4Zd+EWfo//Bzf+yX2QadYnyTfAIhczpo7V1xZpmBHM+w+Q2rQbskBPSwLXBxtkVlohU5KVkwoBpYmg4wRmYI6NKyUT5aVt9UJeUMMwBY8BUG6msZi02TuuwH6wwZ7ljjBBSCM1lJXL7wnAKyDOx8MrR3uTF7o0YQI4RC/TXYUfYaOQUNlzi/LG8cx4dpNmfFBXUKEYCVoc3hdtfBlvYPfe1ELbPPjZbjVbO62M7Q7/KtT2aoc3JBJLKGmNGoltKyz1EexQv3ldCNCUJ1TpbsTzLU0VdL2vJs6CCKmzgkueWgi27cMWUqTC3RnvH9y4CLg5WMGt2Q6wciOF24a/61QVSVlprcKgA0bBaUNN8bS8ltEqU9PTglHCZcLspoZKEgoaC/+qi9r1+oIU0FN14fieKwkM724wJSvu/OhDzFQRe/EqZLjlLmdnwqM15zQZq/6PQzazMTcjvcOvsG+B5vea62mrxT8h/jwijEy9zxh8gRm9XtcbR9fmba6/7EiwseVhRStXXeBE8kV9dGkT1ONwfn9xTBYY4mO4hV2rXlK+2P9ka7E7PAcv8DL38+RVaA90LigXCnId9BeDUBzVp6z9Ca6qoA4sN4hRrg6TolYt0ifjgauLXTcTAXU0RtvW0+12qHAgHWU2ULIXkcrHpB+LmTA20WIR+RmSJFSbGEdFe6g3gD05zgSrhc3p4x2c+WlEbu6DbBepTBhF2xC7BoiiskilFHUZQeD0q00Cy9tRKTEBjdTEK4X0OkpBK1RC1wSLHKkdCqgJz9mcov1eqIkif3Gc5HE0iWc0GT9K9iLTFukHmBWdzCjsOGPiaEinyEQV7e9yZNin9LDs2xASRRcmpCTLAqBMVgwJvFOuJwVa9mTIPxMg3du0gO4+xcpczR9mvkMIsIx3Ttj41Vs7LNsspfyDCX4o8BdktyD+lSN1tYYdYtKvXKqZLr/3Yp/BARCW70W+QoXfGXz60okq3yinyXXlggfM9ldk2FMfa5rZMj0iV0zzdO+iTbPwzpZsVax2jzrRpvtiOrw9fKyWLM4BaQVG+JlRgxaRT64uKG/adYVQhXJa8rn7Z9rIpsMCLUGkuQhzCO7W96JByuGrEzBON5Fq4yJjBRdn3DHqM7WoWxeHtMxqRJbPWjcypPkPvKm3ATGoDtbcSm5G8XGzokYe0U4DN5xbvFZ1CE4JDrhd0tFN0ThUVxDEEtqp1zlYst5oN8ENYkN3Uguxjj3jhTd6VTE22w+15uljQneVEZvjGbVZboWf1NYsUMOhu32jEQx914Ty30riRZ2eDJZt0MlnFlkDFQJE7FWJD/9hXBTTILxWtJmMly92Oi7bycY01AiTyEb4B5H6ITdSISkGHoAlk2qIwCV7fRZEC1zJLgGqZpdCey5iiqAv0ZXSoCXSl1ivyMCZkz3wMvjGD5/Jeb86xYnOfXDsmWLB9IHrdEGI7gjAZKPExFGtd8dRhpxErSlaGyIK+cDg0xgtkZcv5gEOw8CToGJAjDEJXVDGTsnRkx8bq1X0RYCuys8vlk7Z4cdA70L3STaWLhQZxp5ISNmdbwyes3bpgzlhPFa8rp89mChxA42Jk+bZgonZR5T7IEsTbm81THcLnrpXetgSlQr/d+NRYpuuEgL5fDdavT2isSlKXUrOIguMg3gJzWuSuwxSk8td3d7QLT8VNlq510T1FkagKqhi5rywK7m2CKrYdG2tXsjU3w4kld78HW1tRkUvlE2Z37kzO/niA7jV1aFfO/qAkbEdbxNLXgg/IbSXobsScpE/Zq+6b4YX0Vf9ezHgv1xI3ucVCGoTR0ne8CCfQcrnI6kSVBxHqNSPeW6hP0TOlI/v+DulW0LUaxEdY8ZeckU3q27NDLlwDAr65tuCbEblc8ZR502ECfqg4BcTC4lQKQ+9Sa6wNQlfC+eu2/VBxnmv7f/CoYl4jFGoAs+dxJkssFjQTdJ1aFowFLum6FeoHJcQYxWaVoS0JMczR1w51q623n7+w6NAljibsGspxlqxt5S6igSHYzy9yyLT1t4BxCxVglmB1w0G9zflSK6rO0A11h1Jpqs7wgkIrb5/pPpeqxmEAuwbj9HYCv0fu962+FVKhmZJr+1n9V69rOrNrtJ/0VX6NlYntpmsAx/ao+DslB9WhU90pyfNGbUx1pWRJfUAx1Vv8RiDMqTJNdpHaLur/5sJbXny0mgBAElJAYc6RkOI7RUsKlsyu7AcwG6Z8ckillL0wjb0CJwl63AvmImx1+GewszUzS68sO1mPLmDBGVSbCCTFdwtp/3vHSwBKShZQHBPuG7eCgS8AAYuknCMrHQyj+gzdbGVKf7BBu7IqDcbnrpyv0taIcSWjLtkm9+LXEx4jwittaob0/xgcE/yEaXuSviba+zes4gufjqtAk2s/7oaFLXrXlimdUvZkn+FlsbwALBDWWhIG/lJ7GkF7Eg7sLbulrxFG5XKjGcEc5UzfPkelgpkozxE15ElYUcYKH1N7ec+H3tXZKFxQQ5VGJdbQxUtDIwfXi4DIorBSTHaC9sPSGmrITnXPvQcPpfG1zjDBw+TEN5FFWQ3vYIJjw2jNRC7XPp+WSEFoaZ43mRSjxBhsc15xvkFfKsyd8zOXBWbCSw3RWojLkaer7fWMpS7t2LpVCd8ycUtzXwtUJ6JjDd4pb6DYT75pUDtj+a6D44OuEElFXXuyk3NL9BGo0YORVg+C12+l97yim2G7niboTFXB+oOdUrtY/ZqAreP/3Zr2j5E17Tnj6e94s+VfYLXmGiuaV4SiOnJEw+42TRXDPAu8pskekRtYslab++9j6wG0L8yoX4CSW31Uy4EYHmO/un3ollgvmxtq1cJAlWFFli7zt66xacoMz2tIvRZhdiPNMmdaEfur5t/DSlNk5blADHLuKkE4xcr+CRrhbVHzBYTe26nqws790Qcn/Kphn6dH/WIRWcyYaPpmtx8sXzaq7vF6rZiq9NSevrY2AgiMe/ymCZAGrsS5W931ZBz3lDoLLrlrvCGf8zJfXaD3TtI89Y0bkJu254t+LW7Pwnq1c0A/hC+/5X6+ugCS+pK3RkwMvQfdiJxLA3RbOHNMZGXBmumwkbrSm5S97LtRXV+g7dSFnX5s4YzvCbnGkv68WRhdXezVZGP55/ZoshaxlyLfarRn6NzVZ/p+p9x9sFubBQRV9xs/fOPdcbPKNJWb0jSPUSU41Y4y0j0oa4lWWDE844MqQNeUgQlUcjwiCDQVOml/lM6BtlVVt/KZlVRWw6jrC5k955sXV9d9HRr5lrHOozBWl33kQMGDayG3kRaHJLoSBt2whcAgLEZYtJQqZfPaJwP5ZZn0utbdJHR1hP+0iLTuMnBZLgOM8/63j4gJwqucWnHmB9nan5+hp5d3uCg5fY2unUPEgQXpfRb2i0BkbvLYJjintk9LGDOmb63KfQRe9yjFa7kx3/un4QPTtztCrkaxxYKqdCPswiT73I4FeBxAO10qqpeS55Z7nK0+Mmm0E3qfwLMwjL17qfz0g9MxnjXNOK4uwmUkB0fniSzKbOK8KzgVn3sFY1ydf09Xs+8sOlJAfeocxs3IvCJjVppXSx8oa6yNeSMtpYLOA1au1/iNTInDKl9j9TAZesOu+la6Yv8Q2U2MtEZ+aoUoRu8wqfsph5VbK4ImtWOk+K5WUNVuKeRszehDrRXFOnpusDbYVLEU58YfhRl/MLPDLj6Td4jlL8bfL/uyVlNgaDH6NGh87O6CxSJ8det3LPH0vQGTXwzn7h3znDEhq1gxzlYdiV5Ev1NWksZ0Ogw8sj9FBpy6M2OHJd5wbuUe0hUhVOt5xdGlXR8RmVNtWaJu9hu2LJjI6V1kAnCmzXGa54myBRYGU0zVSMyogvhmgRXjkMET8OC5+LtYIAxE/M7+NrgzkYAP5cw1F3ogjdivjp42+ZwlVbr0RbdOwgxI5lWEbUJ83eHp2UiRoXNzDd/j1AklTvlqkry8r8p9236ImdAopwYzHnAyzGRlWr8b2Zrkk+dm1h5b3OSxAR7jD6mhRcmTZfO8QTmdYx8C8p0v6xi+z9a0WvGKKo43UMhlpH9c0dPAjbQfgNXtf03ndRW489Vrw0wFjRlRcGNb22DYsOnU6xo1itXy7xAcG9MEsorIorD3KQ0bnTvoiLWSfUslVyx3/rO6i1xB9WgiVC7J8YHG+3vLfmF8qzWSdl5eWDW4KyHp6WFkfb16Wln/h5wd6Xc6env/IWc+ABO+XSVL1zj3AhKK3cnfXF+hq4FC1UYjWddaX12yG4OIhV1NNewiqiF9H3+Yz60OK/dORGQzmaeu+BpU3PWVDo8LsriMqEfL+N0SXMhggsrzlgvYlw67BNomHsIWLG9COSNOvCK21TgoA4/w8sdT8pp9l1XKZ6qe7n39yXXPqQNRkKxxR0nV9iK41K8ZDZW31l2YdiVuTOAICXrF865DpKmuxCvMOB4GMlDjCkdQXzmnSo1MWnB36Bhff7y4mzdWCt8AygVgB1vy6QaaLc5GJCIrslmV55vo/hlWZFHrgFpwK02Pa3S+00sVH6JiMmKXg16JXaarKQoSmG5nr7qeq7jKmWkq67Z90TxGocF224oNJ0q24YXdm3RZYrEpuJrMKj//fIme+lqJzxW3uvKMcSjggDywy7tSavvNZ+i7oaNB9KMwt0KuRccQ0pRU0Mxi1YU+MmmT4AlccP200PO6yv29L016SxeYbNCnUXONs5nCD1GU7xfukJgJVGAm5goXdGc6RokVTO1N3yeho1xew7LovcxdcvS2LWAr6yyAFNqjfUGqgCVEKgup2zfuPV2jXysBpuQ7mVOOnjKxOvv2OWKSPEcz+3/U/h8WmG8002ffhuOLhpTZnOPB5PzYOlRXwz+/RrAo+LpATm7q4VdyvrNRg5FJMXV/nXk86zYImirLyEGEVkVcudvD7PO737Gi6KNLAP7228/vfn/z4fLbb13O7QorzEZ5ci3VbcyS5b0X7Pd6wXaEbdQJhkVsJcLX7MTtUtI8B5jY52KTwISZS0WFZiSmAGm5khJgXMT3ggTiA7GAZmvMhsOJT/YOQO/z2EDt9Yldoq6rWaJLYWa5Nip25TvUaydziLXf0mjvaF3zkc5Jemyxy3Yw2ECl8cUm27oXX+9iQczZqKOp3moyR+yxWw12Iwpss1/eExbKR/cTvL/jwiLv9f8Pw1W3KrOb/PcgLJa3fPQekZ1IPghz1HHcXfhJOUHSVudkW3bpU9NktNdZdtAn8xm43Qacuz8yXbesZlPEw6Doa44Zt7Sum7lce5lxddGubYNOXNYcNHQRaGEwnlVY51xnVkU8Yj/HJF5DurWvPjqXRVGJvidqgJ04rnHTqdi9p3fm7zSsUze46eM061Nxu8Ei/3cZjpptcTPYsGMkw8nYDRfuIKcrXTLCZLQs0akseMB+jZUYBh0eO+paFGUmUwnjm/fvrtFvzo+6TUoNI/Jl0lSCm/98i75UVI30bq24yBTtd+pMm9zQcohu0Ie66CyY1tVo6STiQ9oGKmOPEbBAy6McR/ugmkBw7GS4efwBDZhjVSQ4LQs2gXsBlxELkBugVR5tKm0HZtxuVx3QOTZ9rfBUuDMqyLLAKlZZSQN3U+LB+OKTo0+YDNKposDMltF5gdB53AKqBvB8Aa2WEoCVsz8SQC1x9EkYruNUdPaCoHvGYj84vnNbQa3qGR1pkWECg1Hil59Y2FpENN5bgGeLcvWTuDPL6O87ERkxKst11L7rLegW8nGRpwMArziOLjFERsWCiYhFkUPQKXKjRTbP9JoZEl1+iGzO5VrjIn7uShu2MKt00BNEXYjImEgpTpgoqSpmm2gJ7wPYJblNA3yFeQpeYWVWKmlkFj8kBdBXP2XgcYwPmye7m1wusjwFsS3g+PlvRGQFvsuMieU26AK2HM1pgkehYCIR0kykQ7rkOuMznsUOi3Zgf58QePTO4C3YsXshtmHHruptw/45IexXCWH/a0LY/zMh7L+kgW1kyfGMphApDfT45pnIioqD8j3bJHgna+DlbQK9pKg4WxRlGu3bapmYL2InIXnILIVSoukXEt83IjLtEhITnKBWJI01aQGnsSb1RldlglmkRDRl1UlMVSONNT3oXQIRYqSxhlkq2GDWJAFeCXYnsJCakgRMuHplqZLoUVi9kqVZUpwncKvJoswIT+DDtoATBEkArpptTHy3qIWsk0AuqyxBTIMoZhjBPEEBkc7wggqyiZh11YYtMN/8SfNZCrxXGbQBTQLZtYNJg7VLrE0CfbYoV6/S+KB1NmPmL0kajRGdxZ0V1wOsZHRRrZNcc4BKiYpf5aadjz/arK0WYGqWzs8f3znigIPalwS46yYfr4NcC/accZrChtHZPMUhsnnM4uwu4BS6gc5YCUmKWRJRx8rVT7k25aCZfyTYWpEksDmb0xRmjAZHc0FzFq1gtAubiTRcUsi84lQTmYLaHjhbJJBNstRrbKLO/G9BD2WQRwGs6IJpo3B8T8gWdgKNT9EyFalVMlpr6ESuEslXl5nvWDwBdKMoLhIokq4UKBXa6ZTr9VIynbkJs/Ghb7DCSRg8HymEjQF55ebbx4bLtMEi+pzjXJtZpWINC6yhUjcrKAXUKjqu8fXouiY5NliY3DCPP+z62E4Du2AucJ7HvgMsjx1WrVsHJXiLWJERJWWRpCuRBZzATGNFliY50nc8SkHm8jZ6e6ZSx29ZykpdKhYZKMeGmSp69hlngsZrsbOFqqNO1GngQvFtfLcWl67raTbnMvpz3gBPkPJvbd7oUscCTSBxrA2dANXouQlcLpKwrlgkucClVLEFWDGrFimuWcE0SSEWCp2EYVPMgRDUQHOl6HCjy3DXADp2xp+DGjsdT6zXsS2QJBVl0g2Ajm6JyviakVRskQXmcZ0Mdy2oiv9mlZkbyhsdbNTJ1FuwbsRrEiZLULjpZ+LEFgYebGxpUGbOkRQdXay1/TAjy1h1/gPQ9K5k0QMBJVXFQmFhBj13Y0BeJwEc/+l1ncg+fepNAY0AWMlFhnUZcWBAG7TCsaEqinkK/U5RAnRwXUcTAY9PZAs5bgvXFmSp8gQYx3dk6gS+Ye18wwnyATSNnQjgBh4nME40/RKfAUINWqNBTWBKabZIIHh1GdvLphVJcQ8UyaMr0lqRUFfcCIBNvBFbbZiVjt5Vc0VE7EKJ4LTYU4G6Jp2xt28WJj5bOaDxI3rNTM/YcDdl9G6tVT5LkodeKZ7gLaw0VVnOYle9JxlbUUeGUpDBEG1wEdsbvMqY0AbPE2gGK6ZMCjV8VYoErZuMVJWI6WYNtUULdBR9UxmJPlQCDZZuskcSDsv7jDnL0bmiOTPoHKvcdzPU0P49jI6bnJWQSmMTQgEMDNFH0N+ASI5CpTpNPgQT6Sh3WZRcbuhgsOBe+s1lFa2p94E8ZmnofEYw70zRBb1DBe43WtjGYsWi6g8DSY4kZxqGM9Sr+6OHBkpIV2UplUHDxqMIrZfYIGZQqeh8jBVOSMu9zxCKEOG91dGggJjwnd1H+kJzJlJP5G+haldr46mRkQtqllSdbb+vl7IavGgICbqiqhlHZCQqsdIUvaMGw0Rwd1dxQ4Knb+VCv7h2Za/P0IUf8fUcmWVgShE0A/5A/ehjQFug99T8zoygOnzOQ6ZOQrw5jOxubhEs7jarKVZkecYEC+IHM3cn6K/dE58wCwOSIV5wXAmY9buoYI5r3cQ93MC91699x57St+Nu9tQ04fbzi0eMfXsQWcSapsM6r8Ky6CO9M3ArxtwFU0yjHhFI28F172FCteAjEy+he27CceDQP1dTgxT9UlFtdjTtPj5b+f698p3KAGN53KpOYvc9Uk3eadedsgsnhxHExjp/hw7t+nVw5zFn/++fb2gXu7qohQKsHeYNsBriJfHek4Xt4zLDmiKXrt1ggwa3qjkl/4uHwVc0o+AbzKVy7euDZEQIa6QphXFnePe8KoWFxmSC8b6DDtNuaQFq75ZpSKVgAtoupEuqCubUjamQ3i7pBnOwFeN0QRGnK8oR1pothDu47bz+MOtDS+YHlN+w/g5Onz3IpGeLWSXYl4r2xyTi8OVr4Xtcx8TjpqDUGg3L3YUkUggKuRVozcxyTFAgFKgMaTR2RY8qL7q3aWHJCfKkeaK4XDCCObIYjJg+gMXDYgdLjYxpfDjalcuNDqPXSmdby15Wa+wHHnOGdbaUyW0CZ8Q15hrMUtkONbJSsT2CJ9wPALlLY7GFN80PYiGcYnX2hmtpDfHOfbuAYDn61f/iDL0Rm+ZfA+gGbHktDML5GZFFWRmqwmI4iRvfbiydefZN/yxgxmLnQJj5Z/Xy+x/+Ym3fi9Zx1BT7Joi259MsbsTsUMcN3lCF/rXxyekXHg1ALnzrY9f/pOd5scW5w/U7z+PI5OV9su1Jf2CKXecMvf/t46XdO1XUOU/AX5ozTRQtsSAbq1V69Yz3c0EQUOg5+vjuNboS5seXz9HV+4vL/3qNPl0J8+on9HS93CBBmVlShchSaj8qTSpFiYFv/fDqf/9/z54EKULNMqGM69MDZOpZgcPjeHRi7rvnNb9xvHhVIxW+4vnjQrotm/ZgfmTDuIMf+BC+PcV0a518ZspUmKO3b94Hkf1TCprOl3UcZ/wfKehZmLYW3a9GhMJG9gtPOILH+AbvOIcFNnSNH2BEOnD3NXqT5wr8tI7LQ+g0Ty8pymPjnKfGQq7O3127V2k0PFZgPWH0o+NUcpqqf7vR1bVFZcT7ZWl45CSIKDS0a4/TsNbEMjdda1oB0UIX5zmzX8Z8G7BtzfIPv3MTMoA1CeGCS3/DL7osMEBlm2udRK879EnD6L3H8Foq04jkgdDNIcAGB8DMZr/k1RPT3u2HiUX9mNTbejdGeEFDduNUXlyPHVi+WGtJmFU5nd9ooOMgK5cVFgt61phORIo5W1SK5mi2AZhU5JA1FJYz5ZGtBwZFoyPacnDReYJ+Bzyi7t8u4YruAFC0kIZmPrM7fp5RfNLmQmc4c6n4CUCXRqUBPk/AEvME1cI8xXVI1f+kTEBUnGe1Jy6dWt634O0+zvqrtZ0JD6DBXpolVYIa9HFT0ufoU/2MvQUH2I/ounaADV6C38Y0tXpUzwTKxIhpXCPt/eLPEeY8qEyU2y9CghtWkJi3osq+gUwYibSBx5wJ9OlqVKAQSJBNJq+ii2wLVJYJxr5ZwIrq2Bm9FmyCEhf3IsZORQd/ewJs3WiFjFOxiD4pEnC2ykdCLXREA3UqD+atAIxABNIJ5gijX6RaY5UP53Qj9GYByV4KYXvj7yCXbkbNmlIRVj0jd028b4xbGszboTqHDIKW8ZAZMdghEz7PFdISCmasWPIjNsJbXHEspojjH+CgrBNEWi7KwQa7LsttJGVlLdgFGLDdlyd2pJIS6EKwitcP7rCIPVaGkYpjhaBfNKqReHp59/qtXMj5PDz9nZLMLGny4+0g+9Eu6G5jC+9Li7dF901lllQYnyw+irauYnZOOCyhxy05jvonTdUowrIyRE5Lab/kOMI3FSFU6xGcofP4cc3Rjks8AbyQVXEXUm1QoDBhgNsUwqmDI+3haKUSBPh0KYV9V6zcCimHzQ/RQFHq7moVrx/dyLuJketaCjUDnNG82Y/3w/T0YSaQZqYKyE8ExQXUi2gPdYk1wrks7etilpQpJNdie2SOcAbfSSGLkbxamMmhmWtRP60SYZV7JnIrf6TSDQEw+oVxit54xM4GZDjE2Suajbk7OZow3uz/QdIVRklw47MW4lIhtMcAIWLWu59ACJevd+PrNWJTYjwhdCZTVg8ENj+jS7xisgLtksiiVLJgIxmKdGrkLgWecSgim6Pz3bgxsWrETkIk+xh2tE4URKCDYdThMkcgGFi/wS/16bZe2e19G2W7bZllJUy/nC22Rp9DGXhGjjHrD9KC4D1eUEEVI/WWgCCQ6NdPLWBmCU9taLYb8siekR/OtFHjwc96T8e03XqwPb3cvSevXri1Eu4raJo2RrhhBdVWrjttT9GSjgaR/ClEawqx9yCg8eCJx6AOZK1jenc/GGv9eNiefsh0tCGnB2/NO4z37XCwN9jxViAcIAy+3t293Ls7NenZuYsWZW9q/8lF66U6jQDZI8cbAfL1suOP+48s1miDaY7sMPmoJpUgMe/YAfJjUnaMubcBMzZKPZSg9fzU0St3KrPMCmqW8gGiJLjjSUYODf+10QOHXkpKJvU67YjqfJDc+2stIjv4MpEn5L/Ofv7+e/T07cWb62fogmnDxKJieklzKIUP4sLlQibvC7QrEgbZsnOHhz9m+OJIxpiSib2Ku+o/7amGMGhuDHjkow19vs91IZD239T9thx/gFMoZopFqE36NlMM81jd6Xob+YBzVmm3ApIKaVYwjpUTT1Zs2jtE4F0Pl1fBPdcsn7LTSDtT/pNlhNqL2OuLub3k6eos3ohddx3CGr7SsOX/9U4i+GTAC95xQ1tlGXnYlSlVysSAQcgGSC3VAgv2546sapGOFQ4l9hGUbvPUCLnnTAVrSRN1/fnFLgevhWvx5XoXdbKaf6WYmyXBiqJS0VwWTOBgwV1LPF1jw6gwem96PMdT7vYtftDNutaPtEzEuPbqPLGCq8TKQDOk7VZ3i9UJmx15YXOIRJ3TnCpsaJ5FSyrbwR9W+PxSr9gEz66VXLG8aR7mv4fLkntNdcAYvvmPfda6Om1YwdlukuUT7bJZ0vf6M5uRbQaHh0Lm5Iq56Pmyr7iPtIBrlM6YQ8Hvq3nSO9CZWj9qVUIvAht1OiporFgjbaRyEt9CK6jBsNoT+NaZ/daT8O4LluecTifl3sF6h8q5wPG25N5Rcq4ejzHNdq/9aq0OQ2JTR2efo5Jje2T2fZYKUUHUphzz8kMq5AT25AEZdKqxLX+V2qB3mCyZGDHpcpxIcnzTp/UnAZn+paJWfFj9yDU502fobY5L9Bn+4fSjXApXd/rP4eOJlnhFrebEKVboS0XVBkEPQl1KoWmtUYWLU+1+M/jNNPLS98AjFrJidRdI4bbv+vKN41lvaQJUtwz0wTdHPRRTmPKU1mHW5/G6tXSniZG1Df3DyzRSlRBBO1Y/b14eF3l2baRGauw8xMxbmOkPAqM1E7lca6RLSticEfvJ81CdoM+THV4Quz2H7zbnBj2FjrBUkO0zBKHLZy1qoUrAO/6WLjDZoE+62/i2icAW/ULa6Nm1doUJDPaR175tagEqUKsGTGZfxAHFmz4Ager/TqUplPMMydfddnqFeqw7r1OvAzuGHQYZzf/miM1Ok9c7tlWf4etd77Wsu4Stj3cBHe5mGoddEzDons02IdMdw+CEwg0p9hc/Q9lAzJGAoxVusOWczpnwvnoQTtDVr8DlSNNBwO6oQrFEuG0dMD31L7ZgbHy2qffueymN9KZsfNjGYLIsJm6Bv10VCI4G1lH7OJIMeZkxEW+CWNS7YbcMRYVpH8+AkGqX7cCxuDba2/L+wNTOAdZp3749WJdY1Txl//x8u5X1kg1aqSN7O6wt65LfD9qeiT6zxLW1kGqT7sD/qkss/ra3Y0yNSLeLeq2eh54mS5a/vgDoe/b2YCrRYFd1v/XduxrlgowKo2R5jOjIZTUbOBcO4nG/prW26Z5yBMDRVXdMew/PZVFisWnuI1w7GKfv7JUVVfYZypiYy7BSgPVt6hqhPfKjZ0XWmK1p2q7o8y+pcgR+qTjfoP+sMGdzRnN0AXXPzjkYRGVNZxmR8pY9UND9dzpDbv2t/Yz5mDYfvdvsNhxeVgZU7iNHmO6/6x+aJfyUHe+Odj75M/RxU7qtbz0HljjuBMcPT9F5FrWZbA9ti4NzRKgnOtS2to/MFK66RrnsYuc8i6VUtbcfQswf3o4ceatXTmR2qmlRpp1DtIMUduW9nvsaTSVlIk2ki5Rdx54HKrEJuyaJyLCOGe1vAVa+nD4y5ErxiMfcghrxVBpjNKtULG9IC6amKsOLeDblFnT056kLOmr6Yxe05/oEgoXeGSpAtYpvnFj40bi5UfSWivZSZWJrVG6JKWoJOzL3IywL6tUL/9/nHoUX/j98XlPI7Y85VeHsPL+dB4yeu820g+fgcW2NWhtsJ/cD0axJxcScKjUSdx3ue5J9tRX/vaQPumcnQLLuSzxvHUPgSkFYWya9UoElJmO/Sxe3t2z3ETKIVftP/6DDBK3xgZ+sXFI1jT/C6uw+4+npOYx+fIbOYf0walSZiZqljND5nCo//JN2sjB3NOelSUPHLUK2Dtwu+kS3OkXvPGn257Feyfu3RgmfNrphf4a9New2kUy5+sclEnQhDXMHWC6xHpkApcnUbYVaR+kWHx8uaI862QSoQYJLj8fqxul1/U04IUWzxRQVFd3+Rs3Uw4+jg5atNGFaV9GVToAMyVLpvHWnxVAAQ6pUUh/o4FDa0vPSLo5uIDi9SzpNkiHRdAb3UeSnN5DaufsxaknP45C8v/TcgeO4CNWaZ6uUL3o/pOod2UFk8syyHq6it2nUqQCzW+ot6kTNDb7ZjitpP0ggW39CGuJ1UqGrmzf/eHeNru07hX4TI9NXttgmqqQ+BtuPaxnGFsQQWVJyq49yIh8mhNP2IAsNnWv6dTYtwiAN1I8g3ErBHVouVWzQFPIBlFyHR9MVZNRoAJwNNtVkEz7bWK4wZ7ljxAASfUE4WVfrXYIQKHZLN7ovtiNxfp1AGhn20phSZwxm0CYBDUeZgiAEP4LbxBairnyRipnNnhtFZFEk7RN3IN4OD+8QCpfgr5mivG9pxnaxrDkWmdYPNfDWruxk+O9+t3WNVhBbV2qclZJNkVYdQthhgAADQCpsDQBZyRILMWickbrdlF8VEBmJ2U7Utrl5WPzMw9/fvnnv370XveWbB8VI1ff9R+/ZxvRttpK8SkWAN/UcZ+Hn3DSTsetxvpVgRqOnDgn9DLp1QGFvPVG3Bx4B0sHd8CqRNHvrcf0kmPHpAmfdooMVVZApMK84IlIQWhprKN+4Mxxpr7Bep5S+jvDWYK9HaFtES6kMkpa+v/77m1AKbpDssflOqsX0CZb9AoOOi3WGXbOTYKOYv1/+dn11jd7hu4KJvBnrHT5Wu7fJ0zA7QxRHtuW3Mdjdrm016lO4ZDF6erarcszm0xVsPnQRfr3l5GpHx1nmpfLVhe/S67HYiSGf7lAeuFdAvePiv33dcFOYI/KhJhn7doO/xJrQD5Td6MdVgxXfBHULV9z7HOkqkKKONfqrNkqKxd9mHJNbzrSh+V9f+L89bz5lYk5J+KM5U3SNeVCRwTPe+g3CIkdaohG2VHTBtFEba9lPKSxKbJa+WX+DA+rjMEASnFJToekKoV29FpGq1YW80ScbzKkwrZyUGm8/kPGsmaZ21rv847iP4Z3TOa64yeBOvEZzzDulyJ0tdTP437eSI+pJkduR8duyNaPwfM4IDBKYUSqQnEHfiFZDr+ZcNL7HZvoXe89Whre+cRlbrEVidbLQqdskjUgUhdeooFrjhe9LRKSV3zDALKRIvpULdEGJzEfCPh5WdB+V6/kcMYGph/CU0giKMO2LJueICW2wMDUaYRvfsKMe8Xz4TgVVcbiHzFq3xtU5bccToKW1bWHC7u/MCKp1ffr7pyAIuqKq3aCixEpT9I4aDJq6r7ltlnr6Vi70i2uXVPtsAP7Cp4Nt1QqMPlAnLByHixaaI51k6CqJC+e0aHOhF2mVZ3/G7/w9v7r4wQdcXNu3rXUNPQHuMDGIy4U7r2FfG9gdTLL23ALf0925Q/b3/mDPRjljAPooTglxxgDyOKeMHslq2jN5+f/OZPeZ2FXTHMhp11fO/siCva4eDXarVKHS01BTNGVW7OlkS3X/T8MMbL90BfenIYernJkM+lE/RvS6htMjQmwZcaJuVMSYOA6xtBpTLTkeL6fl9KhhsWnJNqc0T10EMh62aLdNdI0kaT7QQwZKwmlWRE8PGUDfY0WMU3H6OvP+YNwg+Ry5BtuMRD4UoOC9yUemUKt9dKBRo1Wzf/+nTdeoPZeC2McBG/nYLdsRcQNN6hKKwzZ1z+0yLvmldZ/fyoUf6+qrGKCXnDVBFPWCarD1ObujOdIUJu12ftxdQ48bLPUhDGCfbLA0hzAAfa9DGXoC4/uXjmPMwb7uQZP70SBii4UdfPlrnVfqOZL3OVJT0XQe5nKhQ2zT8iF9PfRlxzDY4EejhL26Xv207Qc4ct37xB3s3sivlbirV6nJ++r/XvImrn3yNO7LBedIa3vLcoTRgq2oaJxkX68iYEl0nP8irQWSP0bl7+uIaIw6NGS5yRT9kuCs28FDOGDYt2/md+l7il3DRXruvdkGuwprgocSZEbr5NFPV8L88ApJhX7hEpsfX3bTvIgUc7ao1Hh+y3bfx6i7X/G+IQz6WMsmwTKeoGfGWHZMXU30tTsYpFpjlSdT6nZPqncKyeeOvoeRohwPU9Nca1X/iHq0fTNM4FS97fIhFVswgXn9m662socOqfSvHYkRV9efXwVIgILdZFEEEjQYDakc4/XZMupQcTz29VlSnCcsr++YdrAUuro4JUrq8G0HSwHMcbHSR+1k4yRL7mfDTQ7uVtGCi2JNl3PJOfRN/RoFsKXeA+TcWJ5jGhFHuno8XEtRfSuH4yzGCf0ILb6CzB6LqlpIberCvdlmcGjNJC4LULOi5Bt/TvbLkMxMMVkizXKKnn6PzFJV6OXPPz9Da+xHCdWr7KDEo1BeD6CEn6uTjBTkq+EKN1Sl9ik0fVftVdZBCOgpnskVbRGDhUt0avGmjaK4GL0/5KthmwcmFc3ZUU0T9hHqm5Dm2DgW2BwxU/f9AZH+wrUJrZEejrP6J4J6kQ1V6CW6FASXuuK4aVZ2L7kegn5i8COQWxla5ceX6N/sdp+jH39E/4aIVFZfdj0H6mFq/4Ob/2W/yDTqEiXc/kLInD5aW1esaUYw5zNMbtOXPuVUSFOPRgO7whKxrnkB02RsKh0wR/JmRsAy0HAbc8DYzbE3UlnNWmyc1mE/aDWjCCGF0FxWIrcvDIeBDBo6AhyWvNi9EQPIMWKB/jrsCBuNnMKGS5w/lnfOo4M0+xOGUSpGAlaHN4XbXwZb2D33tRC2zz42W41WzutjO0O/yrU9mqHNyQSSyhpjRqJbSss9RHsUL95XQjQ3mCJbpRx4fllLHhhL5eZTC5jE37ILV0zByNSri67vXQRcHO2Z7kAMtwt/1a8ukLLSWoNDZThbZHT6f0OJZPXMD06J7jySkXy5JKGgoeDfNr/6AN3wmxnNRFHsBwGNCEr7vzoQ8xUEXvxKmS45S9295NGa85qlKoQ9MUX6uKZRh/I73Dr7BtQTgTzX1VaLf0L+e0QYnXgZjAuaJEYPI4CkQtfnb6697kuwsORhRSlVX+NF8ER+dWkQ1eNwf3xyTxUY4qFRt2hoylfbn2wNdqfngGV+hl7+/Aqtge4FxQJhzsO+grr6eY62/iO0poo6sNggTrE2SIpeuUiXiA+uJn7dRAzc1RRhW0+736XKgXCQ1UTJUkguF5t+IG7O1ECLRehnRJZYYWIcESm0L7JYuAnuqBI+p4d3fOajFbWxC7pdoD5lEGHXtAVrURRWyZSiDiMovB6VaSBZe2olJqCxuhiF8D4HSUilaojaYJFjlSMhVYE5+zOU3ytVEaRP7rMcjibRYbPwdhBpi3WDzAvO5hR2HDDwNSVS5CMK9va4M20maGgf2hATRBYlpybIAKNOVAwK/HijaW2wMg/EyDd27SA7j7FylzNH2a+QInon5HyQIHFy0wORPxDhL0WeguwW5J9SPFD3nHr1WsV06bUf+xQeiKhkN/oNgmHcfgS5b4dbY5fvygMLnO+pzLbpjwI/HaSiRKqc5uneQZ9k458p3axY6xh1pk3zxXZ8ffhaKVmcAdQKivI1oQIrJp1aX1TcsO8MowrhsuR19cu2l02BBV6ESnMR4hDeqe1Fh5TDVSNmnmgk18JFxgwuyr5n0GNcT00a3j6jEVkya93InOoz9K7SBsykNlDXPWskLxcbeuQh7RRg87nFe0Wn0ITgkOsFHe3c0DRBHENgq1rnbMVyq9kAP4QF2U0tyD72iBfe5F3J1GQ73J6niwXdWU5khm/cZrUVelZfs0gBg+72jUY89D3dvmt5djZYcttdrYotgYroozgb+se+KqBBfqloNRkrWe52XLSVj2sMY0+rdgOuNpolIBdr1END1IhKQYegCWTaojAJXt9FkQLXMkuAapml0J7LmKKoCzTWqI8t1AS6UusVeRgTsmc+Bt+YwXN5rzfnWLG5T64dEyzYPhC9bgixHUGYDJT4GIq1rvgDNc2XlSGyoC8cDo3x4ge4DDgEC0+CjgE5wiB0RRUzqVuDjnWf9qv7IsCx0aQ9l8/Eg9vcK91UulhoEHdyo+63hk9Yu3XBnLGeKl5XTp/NFDiAxsXI8sFk2GYSbBDv0BSZhIfwuWulty1BqdBvNz41luk6IaDvV4P16xMaq5LUpdQsouA4iLfAnBb5trtwc3dHu/BU3GTpWhfdUxSJqqCKkfvKouDeJpr8fEAlW3MznFhy93uwtRUVOcxJ3iu35OyPB+heU4d25XA6bRux9LXgA3LDPOCdiDlJn7JX3Tejk2C9mPFeriVucouFNAg3k9TCCbRcLrI6UeVBhHrNiPcW6lP0TOnIvr9DuhV0rR62/W4Uf8kZ2UwxbWdELlwDAr65tuCbEblc8ZR502ECfqh88/+wOJXC0LvUGmuD0NV2VEBdXZXn2v4fPKqY1wiFGsDseZzJEosFzQRdp5YFY4FLum6F+kEJMUaxWWVoS0IMc/S1Q91q6+3nb2QocYmjCbuGcnwwoWOSmwOGYD+/yCHT1t8Cxi1UgFmC1Q0H9TbnS62oOkM31B1Kpak6wwsKrbx9pvtcqhqHAewajNPbCfweud+3+lZIhWZKru1n9V9JPcfRml2j/aSv8musTGw3XQM4tkfF3yk5qA6d6k5Jnm9nkCa6UrKkPqCY6i1+IxDmVJkmu0htF/V/c+EtLz5aTQAgCSmgMOdISPGdoiUFS2ZX9sMUc1G6ffRD01CcHveCuQhbHf4Z7MwP1djKenQBC86g2kQgKb5bSPvfO14CUFKygOKYcN+4FQx8AQhYJOUcwYR5RvUZutnKlP5gg3ZlVRqMz105X6WtEeNKRl2yTe7FbzPNhPBKm5oh/T8GxwQ/YdqepK+J9v4Nq/jCp+Mq0OTaj7thYYvetWVKp5Q92Wd4WSwvAAuEtZaEgb/UnkbQnoQDe8tu6evWIEMYXPgclQpmojxH1JAnYUUZKxxrYPWeIBYsRQ1VGpVYQxcvDY0c/DRpWRRWislO0H5YWkMN2anuuffgoTS+1hkmeJic+CayKKvhHUxwbBitmcjl2ufT+mmTz5tMilFiDLY5rzjfoC8V5s75mcsCMz+IF/ZdL8TlyNPV9nomGmA/GA3HxC3NfS1QnYiONXinvIFiP/mmQe2M5bsOjg+6QiQVde3JTs4t0UegRu+3m4fC67fSe17RzbBdTxN0pqpg/cFOqV2sfs3WmLzdmvaPkTXtOePp73iz5V9gteYaK5pXhKI6ckTD7jY3Uz8LvKbJHpGbzhj//vvYegDtCzPqF6DkVh/VciCGx9ivbh+6JdbL5oZatTBQZViRpcv8rWtsmjLD8xpSr0WY3UizzJlWxP6q+few0hRZeS4Qg5y7ShBOsbJ/gkZ4W9R8AWE9+bUu7NwffXDCrxr2eXrULxaRxawZ3zvvPFi+bFTd4/VaMVXpqT19bW0EEBj3+E0TIA1ciXO3uuvJOO4pdRbcdINrnZf56sKP4EZPfeOGejalK/q1uD0L69XOAf1QA/69+/nqoj3ftRETQ+9BNyLn0gDdFs4cE1lZsGY6bKSu9CZlL/tuVNcXaDt1YacfWzjje+Jxx+fNwujqYq8mG8s/t0eTtYi9FPlWoz1D564+0/c75e6D3dosIKi63/jhG++Om1WmqdyUpnmMKsGpdpSR7kFZS7TCiuEZH1QBuqYMTKCS4xFBoKnQSfujdA60raq6lc+spLIaRl1fyOw537y4uu7r0Mi3jHUehbG67CMHCh5cC7mNtDgk0ZUw6IYtBAZhMcKipVQpm9c+Gcgvy6TXte4moasj/KdFpHWXgctyGWCc9799REwQXuXUijM/yNb+/Aw9vbzDRcnpa3TtHCIOLEjvs7BfBCJzk8c2wTm1fVrCmDF9a1XuI/C6Ryley4353j8NH5i+3RFyNYotFlSlG2EXJtnndizA4wDa6VJRvZQ8t9zjbPWRSaOd0PsEnoVh7N1L5acfnI7xrGnGcXURLiM5ODpPZFFmE+ddwan43CsY4+r8e7qafWfRkQLqU+cwbkbmFRmz0rxa+kBZY23MG2kpFXQesHK9xm9kShxW+Rqrh8nQG3bVt9IV+4fIbmKkNfJTK0QxeodJ3U85rNxaETSpHSPFd7WCqnZLIWdrRh9qrSjW0XODtcGmiqU4N/4ozPiDmR128Zm8Qyx/Mf5+2Ze1mgJDi9GnQeNjdxcsFuGrW79jiafvDZj8Yjh375jnjAlZxYpxtupI9CL6nbKSNKbTYeCR/Sky4NSdGTss8YZzK/eQrgihWs8rji7t+ojInGrLEnWz37BlwURO7yITgDNtjtM8T5QtsDCYYqpGYkYVxDcLrBiHDJ6AB8/F38UCYSDid/a3wZ2JBHwoZ6650ANpxH519LTJ5yyp0qUvunUSZkAyryJsE+LrDk/PRooMnZtr+B6nTihxyleT5OV9Ve7b9kPMhEY5NZjxgJNhJivT+t3I1iSfPDez9tjiJo8N8Bh/SA0tSp4sm+cNyukc+xCQ73xZx/B9tqbVildUcbyBQi4j/eOKngZupP0ArG7/azqvq8Cdr14bZipozIiCG9vaBsOGTade16hRrJZ/h+DYmCaQVUQWhb1Padjo3EFHrJXsWyq5Yrnzn9Vd5AqqRxOhckmODzTe31v2C+NbrZG08/LCqsFdCUlPDyPr69XTyvo/5OxIv9PR2/sPOfMBmPDtKlm6xrkXkFDsTv7m+gpdDRSqNhrJutb66pLdGEQs7GqqYRdRDen7+MN8bnVYuXciIpvJPHXF16Dirq90eFyQxWVEPVrG75bgQgYTVJ63XMC+dNgl0DbxELZgeRPKGXHiFbGtxkEZeISXP56S1+y7rFI+U/V07+tPrntOHYiCZI07Sqq2F8Glfs1oqLy17sK0K3FjAkdI0Cuedx0iTXUlXmHG8TCQgRpXOIL6yjlVamTSgrtDx/j648XdvLFS+AZQLgA72JJPN9BscTYiEVmRzao830T3z7Aii1oH1IJbaXpco/OdXqr4EBWTEbsc9ErsMl1NUZDAdDt71fVcxVXOTFNZt+2L5jEKDbbbVmw4UbINL+zepMsSi03B1WRW+fnnS/TU10p8rrjVlWeMQwEH5IFd3pVS228+Q98NHQ2iH4W5FXItOoaQpqSCZharLvSRSZsET+CC66eFntdV7u99adJbusBkgz6NmmuczRR+iKJ8v3CHxEygAjMxV7igO9MxSqxgam/6Pgkd5fIalkXvZe6So7dtAVtZZwGk0B7tC1IFLCFSWUjdvnHv6Rr9WgkwJd/JnHL0lInV2bfPEZPkOZrZ/6P2/7DAfKOZPvs2HF80pMzmHA8m58fWoboa/vk1gkXB1wVyclMPv5LznY0ajEyKqfvrzONZt0HQVFlGDiK0KuLK3R5mn9/9jhVFH10C8Lfffn73+5sPl99+63JuV1hhNsqTa6luY5Ys771gv9cLtiNso04wLGIrEb5mJ26XkuY5wMQ+F5sEJsxcKio0IzEFSMuVlADjIr4XJBAfiAU0W2M2HE58sncAep/HBmqvT+wSdV3NEl0KM8u1UbEr36FeO5lDrP2WRntH65qPdE7SY4tdtoPBBiqNLzbZ1r34ehcLYs5GHU31VpM5Yo/darAbUWCb/fKesFA+up/g/R0XFnmv/38YrrpVmd3kvwdhsbzlo/eI7ETyQZijjuPuwk/KCZK2Oifbskufmiajvc6ygz6Zz8DtNuDc/ZHpumU1myIeBkVfc8y4pXXdzOXay4yri3ZtG3TisuagoYtAC4PxrMI65zqzKuIR+zkm8RrSrX310bksikr0PVED7MRxjZtOxe49vTN/p2GdusFNH6dZn4rbDRb5v8tw1GyLm8GGHSMZTsZuuHAHOV3pkhEmo2WJTmXBA/ZrrMQw6PDYUdeiKDOZShjfvH93jX5zftRtUmoYkS+TphLc/Odb9KWiaqR3a8VFpmi/U2fa5IaWQ3SDPtRFZ8G0rkZLJxEf0jZQGXuMgAVaHuU42gfVBIJjJ8PN4w9owByrIsFpWbAJ3Au4jFiA3ACt8mhTaTsw43a76oDOselrhafCnVFBlgVWscpKGribEg/GF58cfcJkkE4VBWa2jM4LhM7jFlA1gOcLaLWUAKyc/ZEAaomjT8JwHaeisxcE3TMW+8HxndsKalXP6EiLDBMYjBK//MTC1iKi8d4CPFuUq5/EnVlGf9+JyIhRWa6j9l1vQbeQj4s8HQB4xXF0iSEyKhZMRCyKHIJOkRstsnmm18yQ6PJDZHMu1xoX8XNX2rCFWaWDniDqQkTGREpxwkRJVTHbREt4H8AuyW0a4CvMU/AKK7NSSSOz+CEpgL76KQOPY3zYPNnd5HKR5SmIbQHHz38jIivwXWZMLLdBF7DlaE4TPAoFE4mQZiId0iXXGZ/xLHZYtAP7+4TAo3cGb8GO3QuxDTt2VW8b9s8JYb9KCPtfE8L+nwlh/yUNbCNLjmc0hUhpoMc3z0RWVByU79kmwTtZAy9vE+glRcXZoijTaN9Wy8R8ETsJyUNmKZQSTb+Q+L4RkWmXkJjgBLUiaaxJCziNNak3uioTzCIloimrTmKqGmms6UHvEogQI401zFLBBrMmCfBKsDuBhdSUJGDC1StLlUSPwuqVLM2S4jyBW00WZUZ4Ah+2BZwgSAJw1Wxj4rtFLWSdBHJZZQliGkQxwwjmCQqIdIYXVJBNxKyrNmyB+eZPms9S4L3KoA1oEsiuHUwarF1ibRLos0W5epXGB62zGTN/SdJojOgs7qy4HmAlo4tqneSaA1RKVPwqN+18/NFmbbUAU7N0fv74zhEHHNS+JMBdN/l4HeRasOeM0xQ2jM7mKQ6RzWMWZ3cBp9ANdMZKSFLMkog6Vq5+yrUpB838I8HWiiSBzdmcpjBjNDiaC5qzaAWjXdhMpOGSQuYVp5rIFNT2wNkigWySpV5jE3Xmfwt6KIM8CmBFF0wbheN7QrawE2h8ipapSK2S0VpDJ3KVSL66zHzH4gmgG0VxkUCRdKVAqdBOp1yvl5LpzE2YjQ99gxVOwuD5SCFsDMgrN98+NlymDRbR5xzn2swqFWtYYA2VullBKaBW0XGNr0fXNcmxwcLkhnn8YdfHdhrYBXOB8zz2HWB57LBq3ToowVvEiowoKYskXYks4ARmGiuyNMmRvuNRCjKXt9HbM5U6fstSVupSschAOTbMVNGzzzgTNF6LnS1UHXWiTgMXim/ju7W4dF1PszmX0Z/zBniClH9r80aXOhZoAoljbegEqEbPTeBykYR1xSLJBS6lii3Ailm1SHHNCqZJCrFQ6CQMm2IOhKAGmitFhxtdhrsG0LEz/hzU2Ol4Yr2ObYEkqSiTbgB0dEtUxteMpGKLLDCP62S4a0FV/DerzNxQ3uhgo06m3oJ1I16TMFmCwk0/Eye2MPBgY0uDMnOOpOjoYq3thxlZxqrzH4CmdyWLHggoqSoWCgsz6LkbA/I6CeD4T6/rRPbpU28KaATASi4yrMuIAwPaoBWODVVRzFPod4oSoIPrOpoIeHwiW8hxW7i2IEuVJ8A4viNTJ/ANa+cbTpAPoGnsRAA38DiBcaLpl/gMEGrQGg1qAlNKs0UCwavL2F42rUiKe6BIHl2R1oqEuuJGAGzijdhqw6x09K6aKyJiF0oEp8WeCtQ16Yy9fbMw8dnKAY0f0WtmesaGuymjd2ut8lmSPPRK8QRvYaWpynIWu+o9ydiKOjKUggyGaIOL2N7gVcaENnieQDNYMWVSqOGrUiRo3WSkqkRMN2uoLVqgo+ibykj0oRJosHSTPZJwWN5nzFmOzhXNmUHnWOW+m6GG9u9hdNzkrIRUGpsQCmBgiD6C/gZEchQq1WnyIZhIR7nLouRyQweDBffSby6raE29D+QxS0PnM4J5Z4ou6B0qcL/RwjYWKxZVfxhIciQ50zCcoV7dHz00UEK6KkupDBo2HkVovcQGMYNKRedjrHBCWu59hlCECO+tjgYFxITv7D7SF5ozkXoifwtVu1obT42MXFCzpOps+329lNXgRUNI0BVVzTgiI1GJlaboHTUYJoK7u4obEjx9Kxf6xbUre32GLvyIr+fILANTiqAZ8AfqRx8D2gK9p+Z3ZgTV4XMeMnUS4s1hZHdzi2Bxt1lNsSLLMyZYED+YuTtBf+2e+IRZGJAM8YLjSsCs30UFc1zrJu7hBu69fu079pS+HXezp6YJt59fPGLs24PIItY0HdZ5FZZFH+mdgVsx5i6YYhr1iEDaDq57DxOqBR+ZeAndcxOOA4f+uZoapOiXimqzo2n38dnK9++V71QGGMvjVnUSu++RavJOu+6UXTg5jCA21vk7dGjXr4M7jzn7f/98Q7vY1UUtFGDtMG+A1RAvifeeLGwflxnWFLl07QYbNLhVzSn5XzwMvqIZBd9gLpVrXx8kI0JYI00pjDvDu+dVKSw0JhOM9x10mHZLC1B7t0xDKgUT0HYhXVJVMKduTIX0dkk3mIOtGKcLijhdUY6w1mwh3MFt5/WHWR9aMj+g/Ib1d3D67EEmPVvMKsG+VLQ/JhGHL18L3+M6Jh43BaXWaFjuLiSRQlDIrUBrZpZjggKhQGVIo7ErelR50b1NC0tOkCfNE8XlghHMkcVgxPQBLB4WO1hqZEzjw9GuXG50GL1WOtta9rJaYz/wmDOss6VMbhM4I64x12CWynaokZWK7RE84X4AyF0aiy28aX4QC+EUq7M3XEtriHfu2wUEy9Gv/hdn6I3YNP8aQDdgy2thEM7PiCzKylAVFsNJ3Ph2Y+nMs2/6ZwEzFjsHwsw/q5ff//AXa/tetI6jptg3QbQ9n2ZxI2aHOm7whir0r41PTr/waABy4Vsfu/4nPc+LLc4drt95HkcmL++TbU/6A1PsOmfo/W8fL+3eqaLOeQL+0pxpomiJBdlYrdKrZ7yfC4KAQs/Rx3ev0ZUwP758jq7eX1z+12v06UqYVz+hp+vlBgnKzJIqRJZS+1FpUilKDHzrh1f/+/979iRIEWqWCWVcnx4gU88KHB7HoxNz3z2v+Y3jxasaqfAVzx8X0m3ZtAfzIxvGHfzAh/DtKaZb6+QzU6bCHL198z6I7J9S0HS+rOM44/9IQc/CtLXofjUiFDayX3jCETzGN3jHOSywoWv8ACPSgbuv0Zs8V+CndVweQqd5eklRHhvnPDUWcnX+7tq9SqPhsQLrCaMfHaeS01T9242uri0qI94vS8MjJ0FEoaFde5yGtSaWuela0wqIFro4z5n9MubbgG1rln/4nZuQAaxJCBdc+ht+0WWBASrbXOsket2hTxpG7z2G11KZRiQPhG4OATY4AGY2+yWvnpj2bj9MLOrHpN7WuzHCCxqyG6fy4nrswPLFWkvCrMrp/EYDHQdZuaywWNCzxnQiUszZolI0R7MNwKQih6yhsJwpj2w9MCgaHdGWg4vOE/Q74BF1/3YJV3QHgKKFNDTzmd3x84zikzYXOsOZS8VPALo0Kg3weQKWmCeoFuYprkOq/idlAqLiPKs9cenU8r4Fb/dx1l+t7Ux4AA320iypEtSgj5uSPkef6mfsLTjAfkTXtQNs8BL8Nqap1aN6JlAmRkzjGmnvF3+OMOdBZaLcfhES3LCCxLwVVfYNZMJIpA085kygT1ejAoVAgmwyeRVdZFugskww9s0CVlTHzui1YBOUuLgXMXYqOvjbE2DrRitknIpF9EmRgLNVPhJqoSMaqFN5MG8FYAQikE4wRxj9ItUaq3w4pxuhNwtI9lII2xt/B7l0M2rWlIqw6hm5a+J9Y9zSYN4O1TlkELSMh8yIwQ6Z8HmukJZQMGPFkh+xEd7iimMxRRz/AAdlnSDSclEONth1WW4jKStrwS7AgO2+PLEjlZRAF4JVvH5wh0XssTKMVBwrBP2iUY3E08u712/lQs7n4envlGRmSZMfbwfZj3ZBdxtbeF9avC26byqzpML4ZPFRtHUVs3PCYQk9bslx1D9pqkYRlpUhclpK+yXHEb6pCKFaj+AMncePa452XOIJ4IWsiruQaoMChQkD3KYQTh0caQ9HK5UgwKdLKey7YuVWSDlsfogGilJ3V6t4/ehG3k2MXNdSqBngjObNfrwfpqcPM4E0M1VAfiIoLqBeRHuoS6wRzmVpXxezpEwhuRbbI3OEM/hOClmM5NXCTA7NXIv6aZUIq9wzkVv5I5VuCIDRL4xT9MYjdjYgwyHOXtFszN3J0YTxZv8Pkq4wSoIbn7UQlwqhPQYIEbPe/QRCuHy9G1+vEZsS4wmhM5myeiCw+Rld4hWTFWiXRBalkgUbyVCkUyN3KfCMQxHZHJ3vxo2JVSN2EiLZx7CjdaIgAh0Mow6XOQLBwPoNfqlPt/XKbu/bKNttyywrYfrlbLE1+hzKwDNyjFl/kBYE7/GCCqoYqbcEBIFEv35qATNLeGpDs92QR/aM/HCmjRoPftZ7Oqbt1oPt6eXuPXn1wq2VcF9B07Qxwg0rqLZy3Wl7ipZ0NIjkTyFaU4i9BwGNB088BnUgax3Tu/vBWOvHw/b0Q6ajDTk9eGveYbxvh4O9wY63AuEAYfD17u7l3t2pSc/OXbQoe1P7Ty5aL9VpBMgeOd4IkK+XHX/cf2SxRhtMc2SHyUc1qQSJeccOkB+TsmPMvQ2YsVHqoQSt56eOXrlTmWVWULOUDxAlwR1PMnJo+K+NHjj0UlIyqddpR1Tng+TeX2sR2cGXiTwh/3X28/ffo6dvL95cP0MXTBsmFhXTS5pDKXwQFy4XMnlfoF2RMMiWnTs8/DHDF0cyxpRM7FXcVf9pTzWEQXNjwCMfbejzfa4LgbT/pu635fgDnEIxUyxCbdK3mWKYx+pO19vIB5yzSrsVkFRIs4JxrJx4smLT3iEC73q4vAruuWb5lJ1G2pnynywj1F7EXl/M7SVPV2fxRuy66xDW8JWGLf+vdxLBJwNe8I4b2irLyMOuTKlSJgYMQjZAaqkWWLA/d2RVi3SscCixj6B0m6dGyD1nKlhLmqjrzy92OXgtXIsv17uok9X8K8XcLAlWFJWK5rJgAgcL7lri6RobRoXRe9PjOZ5yt2/xg27WtX6kZSLGtVfniRVcJVYGmiFtt7pbrE7Y7MgLm0Mk6pzmVGFD8yxaUtkO/rDC55d6xSZ4dq3kiuVN8zD/PVyW3GuqA8bwzX/ss9bVacMKznaTLJ9ol82Svtef2YxsMzg8FDInV8xFz5d9xX2kBVyjdMYcCn5fzZPegc7U+lGrEnoR2KjTUUFjxRppI5WT+BZaQQ2G1Z7At87st56Ed1+wPOd0Oin3DtY7VM4Fjrcl946Sc/V4jGm2e+1Xa3UYEps6OvsclRzbI7Pvs1SICqI25ZiXH1IhJ7AnD8igU41t+avUBr3DZMnEiEmX40SS45s+rT8JyPQvFbXiw+pHrsmZPkNvc1yiz/APpx/lUri6038OH0+0xCtqNSdOsUJfKqo2CHoQ6lIKTWuNKlycavebwW+mkZe+Bx6xkBWru0AKt33Xl28cz3pLE6C6ZaAPvjnqoZjClKe0DrM+j9etpTtNjKxt6B9eppGqhAjasfp58/K4yLNrIzVSY+chZt7CTH8QGK2ZyOVaI11SwuaM2E+eh+oEfZ7s8ILY7Tl8tzk36Cl0hKWCbJ8hCF0+a1ELVQLe8bd0gckGfdLdxrdNBLboF9JGz661K0xgsI+89m1TC1CBWjVgMvsiDije9AEIVP93Kk2hnGdIvu620yvUY915nXod2DHsMMho/jdHbHaavN6xrfoMX+96r2XdJWx9vAvocDfTOOyagEH3bLYJme4YBicUbkixv/gZygZijgQcrXCDLed0zoT31YNwgq5+BS5Hmg4CdkcViiXCbeuA6al/sQVj47NNvXffS2mkN2XjwzYGk2UxcQv87apAcDSwjtrHkWTIy4yJeBPEot4Nu2UoKkz7eAaEVLtsB47FtdHelvcHpnYOsE779u3BusSq5in75+fbrayXbNBKHdnbYW1Zl/x+0PZM9Jklrq2FVJt0B/5XXWLxt70dY2pEul3Ua/U89DRZsvz1BUDfs7cHU4kGu6r7re/e1SgXZFQYJctjREcuq9nAuXAQj/s1rbVN95QjAI6uumPae3guixKLTXMf4drBOH1nr6yoss9QxsRchpUCrG9T1wjtkR89K7LGbE3TdkWff0mVI/BLxfkG/WeFOZszmqMLqHt2zsEgKms6y4iUt+yBgu6/0xly62/tZ8zHtPno3Wa34fCyMqByHznCdP9d/9As4afseHe088mfoY+b0m196zmwxHEnOH54is6zqM1ke2hbHJwjQj3Roba1fWSmcNU1ymUXO+dZLKWqvf0QYv7wduTIW71yIrNTTYsy7RyiHaSwK+/13NdoKikTaSJdpOw69jxQiU3YNUlEhnXMaH8LsPLl9JEhV4pHPOYW1Iin0hijWaVieUNaMDVVGV7Esym3oKM/T13QUdMfu6A91ycQLPTOUAGqVXzjxMKPxs2NordUtJcqE1ujcktMUUvYkbkfYVlQr174/z73KLzw/+HzmkJuf8ypCmfn+e08YPTcbaYdPAePa2vU2mA7uR+IZk0qJuZUqZG463Dfk+yrrfjvJX3QPTsBknVf4nnrGAJXCsLaMumVCiwxGftduri9ZbuPkEGs2n/6Bx0maI0P/GTlkqpp/BFWZ/cZT0/PYfTjM3QO64dRo8pM1CxlhM7nVPnhn7SThbmjOS9NGjpuEbJ14HbRJ7rVKXrnSbM/j/VK3r81Svi00Q37M+ytYbeJZMrVPy6RoAtpmDvAcon1yAQoTaZuK9Q6Srf4+HBBe9TJJkANElx6PFY3Tq/rb8IJKZotpqio6PY3aqYefhwdtGylCdO6iq50AmRIlkrnrTsthgIYUqWS+kAHh9KWnpd2cXQDweld0mmSDImmM7iPIj+9gdTO3Y9RS3oeh+T9pecOHMdFqNY8W6V80fshVe/IDiKTZ5b1cBW9TaNOBZjdUm9RJ2pu8M12XEn7QQLZ+hPSEK+TCl3dvPnHu2t0bd8p9JsYmb6yxTZRJfUx2H5cyzC2IIbIkpJbfZQT+TAhnLYHWWjoXNOvs2kRBmmgfgThVgru0HKpYoOmkA+g5Do8mq4go0YD4GywqSab8NnGcoU5yx0jBpDoC8LJulrvEoRAsVu60X2xHYnz6wTSyLCXxpQ6YzCDNgloOMoUBCH4EdwmthB15YtUzGz23CgiiyJpn7gD8XZ4eIdQuAR/zRTlfUsztotlzbHItH6ogbd2ZSfDf/e7rWu0gti6UuOslGyKtOoQwg4DBBgAUmFrAMhKlliIQeOM1O2m/KqAyEjMdqK2zc3D4mce/v72zXv/7r3oLd88KEaqvu8/es82pm+zleRVKgK8qec4Cz/nppmMXY/zrQQzGj11SOhn0K0DCnvribo98AiQDu6GV4mk2VuP6yfBjE8XOOsWHayogkyBecURkYLQ0lhD+cad4Uh7hfU6pfR1hLcGez1C2yJaSmWQtPT99d/fhFJwg2SPzXdSLaZPsOwXGHRcrDPsmp0EG8X8/fK366tr9A7fFUzkzVjv8LHavU2ehtkZojiyLb+Nwe52batRn8Ili9HTs12VYzafrmDzoYvw6y0nVzs6zjIvla8ufJdej8VODPl0h/LAvQLqHRf/7euGm8IckQ81ydi3G/wl1oR+oOxGP64arPgmqFu44t7nSFeBFHWs0V+1UVIs/jbjmNxypg3N//rC/+158ykTc0rCH82ZomvMg4oMnvHWbxAWOdISjbClogumjdpYy35KYVFis/TN+hscUB+HAZLglJoKTVcI7eq1iFStLuSNPtlgToVp5aTUeP9RCVZSdabV3b/0UeqzuTXPsKav0YyatuGf0zmuuMngErxGc8w7tcfju+/srpvM/07mFadw/0ustDXwPapa3SG90Vwu2i/2rguoKNYDi/9gqv9twMA9eGFXgxTCDQ7NDO5bciesvYWL2nCDONRVyAFxfgIGdWVwB2pwfYFNlooOAuZk3IMWimQWH1VxGgqcnkIQRQAdCxp1QO/HJPLRtDHZfz45BFOT0CTX5j406WASlyYdTPbTpJn7PFBMT8BhO7k537O65IxsIlPAAT1g7z6nLmN59mM/0nWSwHAtl1iOWmD3YJBi+d1ry8rMZCXyLJyh7TAIt+3ZdwAOoEteJLxjcexGBWa1xUPEjX47GA0mpiBIr+PTTkzS0eMQLCjHpaZ5ZtjI9cyHOv4eDDxI1AEZXHy8/9cJdyMENPyUU2sAZEmQcLAPx2UkCncCBgOIYTVS8hHmO06L7IALM1ywc9RJqw5B7uO2sXz2OGw3HHyzFx9dzRLjpKvZEXiRJVaYGKqYNoxE5JQOuUYWGXlOSaUoVIKUSt5t6iFZsRVgWAat6QzBMs2Tu1/xg0zLFK++BXzw0++wAD9yhgPJvc0j0690OQgJ55/uw92LSGAO+ylPbguVDuRxPFpBg/hUaUckDidNG6UE9GkjtZ9IdUJSPKYdQAzfakWylZpnC9Un/Gmm4wBocHVrqkVfPQQ0rAiSohyXXkedvAV5iKQKtm44zSiERAJoXAiNmrAfiIkKqjs91EaenplKYbpbuIfb7aQMejxPOI/7rO+j6Znr1hPZbq5D9Q74Yb4DaIQR2Xx3UA9YX8nKMLHImNAGi0Hh2Em6KkBGA8hhPOJ7cQ703lQlZ+I2M3exLUUHGJk71AW8CwuVCgt1EBZy9kdEC0nxbr18eOODuu4Tl+z1Rdh16+ItPGfcBIZwBBePb4f41Q8zP+oOUVGXp/vvmaFFKRVWmyw+BjtgB3GJu/r+9aDCJ+s/0ScvHAa7A4PBlPAIy3dghrWOYbuy07QNst/hU7vPo76pXYg7143/oLtowAH3LKpmt1+fcvNIs1DT4hOeLQcVdaGGuStQlH9SoBYW7kINLuzvXWRV2kM9gPB1wT9dUdWfuXbambseCgPAIybF1psVl+fbLqz9bA+dOoNt2U5BAYAesDoTOb2Lt24X3C7ui8p4eLH3GSklWUYNZliAB4QyXPgn43Ix5vI7Iapkzba9Dj96V0oVSD6cZvU8lzpLd9cs+HteuFaWxpKZTA2P/gTKtNI0lsygDvCwMGQFzTSRUd8+VlDUhTlGCUPvTBoyQBftw2hQ4wHOlYTYuBrKe5xLZN0AzuUAzQDWLqlig05Zpy7eA7r/NOIxZecQDsMgrqioETjAt1RxSmdYp3DsANwDcFhRlTMy0hbpBBw83H43/J04uCKmeKxY49CDG8QBnIxJPA/0QL+DxkXJaaaX+OXPr+Jh4MCiHtiwyoT5Gis6bOx7mt7koKIO1PB95K58IRwEuW9IzEFr/ywsBKnAoZqJk7wtFuRelcVKSm3woNXfsariEF542X5q+kmW0B6eDlXan8LMXXija8YMxJu9bzjIjiXWy4xLeVvFi+GB9LCAUQ/wOBpRX5IDYyTO35Tl1AxHshy/uIOKelDDR54ie+XwhJU5pXlkwlM/onb3wpKQSkXWHgHmQdpjzNRzHw+0ll7j4MGL527aQ7D+tBXT3dYs/Mv/HwAA///ei04u" } diff --git a/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json index fb4fca25df2..da17c3a5f76 100644 --- a/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json +++ b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json @@ -2399,8 +2399,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.119.181.171", - "10.166.144.66" + "10.166.144.66", + "10.119.181.171" ], "rsa.internal.messageid": "00625", "rsa.misc.hardware_id": "dol", diff --git a/x-pack/filebeat/module/juniper/srx/_meta/fields.yml b/x-pack/filebeat/module/juniper/srx/_meta/fields.yml new file mode 100644 index 00000000000..55ded3a11e6 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/_meta/fields.yml @@ -0,0 +1,488 @@ +- name: juniper.srx + type: group + release: beta + default_field: false + overwrite: true + description: > + Module for parsing junipersrx syslog. + fields: + - name: reason + type: keyword + description: > + reason + + - name: connection_tag + type: keyword + description: > + connection tag + + - name: service_name + type: keyword + description: > + service name + + - name: nat_connection_tag + type: keyword + description: > + nat connection tag + + - name: src_nat_rule_type + type: keyword + description: > + src nat rule type + + - name: src_nat_rule_name + type: keyword + description: > + src nat rule name + + - name: dst_nat_rule_type + type: keyword + description: > + dst nat rule type + + - name: dst_nat_rule_name + type: keyword + description: > + dst nat rule name + + - name: protocol_id + type: keyword + description: > + protocol id + + - name: policy_name + type: keyword + description: > + policy name + + - name: session_id_32 + type: keyword + description: > + session id 32 + + - name: session_id + type: keyword + description: > + session id + + - name: outbound_packets + type: integer + description: > + packets from client + + - name: outbound_bytes + type: integer + description: > + bytes from client + + - name: inbound_packets + type: integer + description: > + packets from server + + - name: inbound_bytes + type: integer + description: > + bytes from server + + - name: elapsed_time + type: date + description: > + elapsed time + + - name: application + type: keyword + description: > + application + + - name: nested_application + type: keyword + description: > + nested application + + - name: username + type: keyword + description: > + username + + - name: roles + type: keyword + description: > + roles + + - name: encrypted + type: keyword + description: > + encrypted + + - name: application_category + type: keyword + description: > + application category + + - name: application_sub_category + type: keyword + description: > + application sub category + + - name: application_characteristics + type: keyword + description: > + application characteristics + + - name: secure_web_proxy_session_type + type: keyword + description: > + secure web proxy session type + + - name: peer_session_id + type: keyword + description: > + peer session id + + - name: peer_source_address + type: ip + description: > + peer source address + + - name: peer_source_port + type: integer + description: > + peer source port + + - name: peer_destination_address + type: ip + description: > + peer destination address + + - name: peer_destination_port + type: integer + description: > + peer destination port + + - name: hostname + type: keyword + description: > + hostname + + - name: src_vrf_grp + type: keyword + description: > + src_vrf_grp + + - name: dst_vrf_grp + type: keyword + description: > + dst_vrf_grp + + - name: icmp_type + type: integer + description: > + icmp type + + - name: process + type: keyword + description: > + process that generated the message + + - name: apbr_rule_type + type: keyword + description: > + apbr rule type + + - name: dscp_value + type: integer + description: > + apbr rule type + + - name: logical_system_name + type: keyword + description: > + logical system name + + - name: profile_name + type: keyword + description: > + profile name + + - name: routing_instance + type: keyword + description: > + routing instance + + - name: rule_name + type: keyword + description: > + rule name + + - name: uplink_tx_bytes + type: integer + description: > + uplink tx bytes + + - name: uplink_rx_bytes + type: integer + description: > + uplink rx bytes + + - name: obj + type: keyword + description: > + url path + + - name: url + type: keyword + description: > + url domain + + - name: profile + type: keyword + description: > + filter profile + + - name: category + type: keyword + description: > + filter category + + - name: filename + type: keyword + description: > + filename + + - name: temporary_filename + type: keyword + description: > + temporary_filename + + - name: name + type: keyword + description: > + name + + - name: error_message + type: keyword + description: > + error_message + + - name: error_code + type: keyword + description: > + error_code + + - name: action + type: keyword + description: > + action + + - name: protocol + type: keyword + description: > + protocol + + - name: protocol_name + type: keyword + description: > + protocol name + + - name: type + type: keyword + description: > + type + + - name: repeat_count + type: integer + description: > + repeat count + + - name: alert + type: keyword + description: > + repeat alert + + - name: message_type + type: keyword + description: > + message type + + - name: threat_severity + type: keyword + description: > + threat severity + + - name: application_name + type: keyword + description: > + application name + + - name: attack_name + type: keyword + description: > + attack name + + - name: index + type: keyword + description: > + index + + - name: message + type: keyword + description: > + mesagge + + - name: epoch_time + type: date + description: > + epoch time + + - name: packet_log_id + type: integer + description: > + packet log id + + - name: export_id + type: integer + description: > + packet log id + + - name: ddos_application_name + type: keyword + description: > + ddos application name + + - name: connection_hit_rate + type: integer + description: > + connection hit rate + + - name: time_scope + type: keyword + description: > + time scope + + - name: context_hit_rate + type: integer + description: > + context hit rate + + - name: context_value_hit_rate + type: integer + description: > + context value hit rate + + - name: time_count + type: integer + description: > + time count + + - name: time_period + type: integer + description: > + time period + + - name: context_value + type: keyword + description: > + context value + + - name: context_name + type: keyword + description: > + context name + + - name: ruleebase_name + type: keyword + description: > + ruleebase name + + - name: verdict_source + type: keyword + description: > + verdict source + + - name: verdict_number + type: integer + description: > + verdict number + + - name: file_category + type: keyword + description: > + file category + + - name: sample_sha256 + type: keyword + description: > + sample sha256 + + - name: malware_info + type: keyword + description: > + malware info + + - name: client_ip + type: ip + description: > + client ip + + - name: tenant_id + type: keyword + description: > + tenant id + + - name: timestamp + type: date + description: > + timestamp + + - name: th + type: keyword + description: > + th + + - name: status + type: keyword + description: > + status + + - name: state + type: keyword + description: > + state + + - name: file_hash_lookup + type: keyword + description: > + file hash lookup + + - name: file_name + type: keyword + description: > + file name + + - name: action_detail + type: keyword + description: > + action detail + + - name: sub_category + type: keyword + description: > + sub category + + - name: feed_name + type: keyword + description: > + feed name + + - name: occur_count + type: integer + description: > + occur count + + - name: tag + type: keyword + description: > + system log message tag, which uniquely identifies the message. + diff --git a/x-pack/filebeat/module/juniper/srx/config/srx.yml b/x-pack/filebeat/module/juniper/srx/config/srx.yml new file mode 100644 index 00000000000..6af16945317 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/config/srx.yml @@ -0,0 +1,31 @@ +{{ if eq .input "tcp" }} + +type: tcp +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ else if eq .input "udp" }} + +type: udp +host: "{{.syslog_host}}:{{.syslog_port}}" + +{{ else if eq .input "file" }} + +type: log +paths: +{{ range $i, $path := .paths }} + - {{$path}} +{{ end }} + +exclude_files: [".gz$"] + +{{ end }} + +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +processors: + - add_locale: ~ + - add_fields: + target: '' + fields: + ecs.version: 1.5.0 diff --git a/x-pack/filebeat/module/juniper/srx/ingest/atp.yml b/x-pack/filebeat/module/juniper/srx/ingest/atp.yml new file mode 100644 index 00000000000..b93e8da9f98 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/atp.yml @@ -0,0 +1,363 @@ +description: Pipeline for parsing junipersrx firewall logs (atp pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- set: + field: event.kind + value: alert + if: '["SRX_AAMW_ACTION_LOG", "AAMW_MALWARE_EVENT_LOG", "AAMW_HOST_INFECTED_EVENT_LOG", "AAMW_ACTION_LOG"].contains(ctx.juniper?.srx?.tag) && ctx.juniper?.srx?.action != "PERMIT"' +- append: + field: event.category + value: malware + if: '["SRX_AAMW_ACTION_LOG", "AAMW_MALWARE_EVENT_LOG", "AAMW_HOST_INFECTED_EVENT_LOG", "AAMW_ACTION_LOG"].contains(ctx.juniper?.srx?.tag) && ctx.juniper?.srx?.action != "PERMIT"' +- append: + field: event.type + value: + - info + - denied + - connection + if: "ctx.juniper?.srx?.action == 'BLOCK' || ctx.juniper?.srx?.tag == 'AAMW_MALWARE_EVENT_LOG'" +- append: + field: event.type + value: + - allowed + - connection + if: "ctx.juniper?.srx?.action != 'BLOCK' && ctx.juniper?.srx?.tag != 'AAMW_MALWARE_EVENT_LOG'" +- set: + field: event.action + value: malware_detected + if: "ctx.juniper?.srx?.action == 'BLOCK' || ctx.juniper?.srx?.tag == 'AAMW_MALWARE_EVENT_LOG'" + + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_port != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_server + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_server != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.packets_from_server + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_server != null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_client + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_client != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.packets_from_client + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_client != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" +- rename: + field: juniper.srx.hostname + target_field: source.domain + ignore_missing: true + if: "ctx.juniper?.srx?.hostname != null" +- rename: + field: juniper.srx.client_ip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.client_ip != null" + +###################### +## ECS URL Mapping ## +###################### +- rename: + field: juniper.srx.http_host + target_field: url.domain + ignore_missing: true + if: "ctx.juniper?.srx?.http_host != null" + +############################# +## ECS Network/Geo Mapping ## +############################# +- rename: + field: juniper.srx.protocol_id + target_field: network.iana_number + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_id != null" +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + field: source.nat.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.nat.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.nat.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.source?.as == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.nat.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.destination?.as == null" +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +############### +## Timestamp ## +############### +- date: + if: 'ctx.juniper.srx?.timestamp != null' + field: juniper.srx.timestamp + target_field: juniper.srx.timestamp + formats: + - 'EEE MMM dd HH:mm:ss yyyy' + - 'EEE MMM d HH:mm:ss yyyy' + on_failure: + - remove: + field: + - juniper.srx.timestamp + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.bytes_from_client + - juniper.srx.packets_from_client + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.bytes_from_server + - juniper.srx.packets_from_server + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/flow.yml b/x-pack/filebeat/module/juniper/srx/ingest/flow.yml new file mode 100644 index 00000000000..1a488a57bd8 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/flow.yml @@ -0,0 +1,360 @@ +description: Pipeline for parsing junipersrx firewall logs (flow pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- rename: + field: juniper.srx.application_risk + target_field: event.risk_score + ignore_missing: true + if: "ctx.juniper?.srx?.application_risk != null" +- append: + field: event.type + value: + - start + - allowed + - connection + if: "ctx.juniper?.srx?.tag.endsWith('CREATE') || ctx.juniper?.srx?.tag.endsWith('UPDATE') || ctx.juniper?.srx?.tag.endsWith('CREATE_LS') || ctx.juniper?.srx?.tag.endsWith('UPDATE_LS')" +- append: + field: event.type + value: + - end + - allowed + - connection + if: "ctx.juniper?.srx?.tag.endsWith('CLOSE') || ctx.juniper?.srx?.tag.endsWith('CLOSE_LS')" +- append: + field: event.type + value: + - denied + - connection + if: "ctx.juniper?.srx?.tag.endsWith('DENY') || ctx.juniper?.srx?.tag.endsWith('DENY_LS')" +- set: + field: event.action + value: flow_started + if: "ctx.juniper?.srx?.tag.endsWith('CREATE') || ctx.juniper?.srx?.tag.endsWith('UPDATE') || ctx.juniper?.srx?.tag.endsWith('CREATE_LS') || ctx.juniper?.srx?.tag.endsWith('UPDATE_LS')" +- set: + field: event.action + value: flow_close + if: "ctx.juniper?.srx?.tag.endsWith('CLOSE') || ctx.juniper?.srx?.tag.endsWith('CLOSE_LS')" +- set: + field: event.action + value: flow_deny + if: "ctx.juniper?.srx?.tag.endsWith('DENY') || ctx.juniper?.srx?.tag.endsWith('DENY_LS')" + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx?.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_port != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_server + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_server != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.packets_from_server + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_server != null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_client + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_client != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.packets_from_client + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_client != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" + +###################### +## ECS Rule Mapping ## +###################### +- rename: + field: juniper.srx.policy_name + target_field: rule.name + ignore_missing: true + if: "ctx.juniper?.srx?.policy_name != null" + +############################# +## ECS Network/Geo Mapping ## +############################# +- rename: + field: juniper.srx.protocol_id + target_field: network.iana_number + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_id != null" +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + field: source.nat.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.nat.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.nat.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.source?.as == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.nat.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.destination?.as == null" +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true +- script: + lang: painless + source: "ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes" + if: "ctx?.source?.bytes != null && ctx?.destination?.bytes != null" + ignore_failure: true +- script: + lang: painless + source: "ctx.network.packets = ctx.client.packets + ctx.server.packets" + if: "ctx?.client?.packets != null && ctx?.server?.packets != null" + ignore_failure: true + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.bytes_from_client + - juniper.srx.packets_from_client + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.bytes_from_server + - juniper.srx.packets_from_server + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/idp.yml b/x-pack/filebeat/module/juniper/srx/ingest/idp.yml new file mode 100644 index 00000000000..808185410d7 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/idp.yml @@ -0,0 +1,287 @@ +description: Pipeline for parsing junipersrx firewall logs (idp pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- set: + field: event.kind + value: alert + if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.category + value: intrusion_detection + if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - info + - denied + - connection + if: '["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - allowed + - connection + if: '!["IDP_ATTACK_LOG_EVENT", "IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_ATTACK_LOG_EVENT_LS", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: application_ddos + if: '["IDP_APPDDOS_APP_STATE_EVENT", "IDP_APPDDOS_APP_ATTACK_EVENT", "IDP_APPDDOS_APP_STATE_EVENT_LS", "IDP_APPDDOS_APP_ATTACK_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: security_threat + if: '["IDP_ATTACK_LOG_EVENT", "IDP_ATTACK_LOG_EVENT_LS"].contains(ctx.juniper?.srx?.tag)' + + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx['nat_destination_port'] != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.inbound_bytes + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.inbound_bytes != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.inbound_packets + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.inbound_packets !=null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.outbound_bytes + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.outbound_bytes != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.outbound_packets + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.outbound_packets != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" + +###################### +## ECS Rule Mapping ## +###################### +- rename: + field: juniper.srx.rulebase_name + target_field: rule.name + ignore_missing: true + if: "ctx.juniper?.srx?.rulebase_name != null" +- rename: + field: juniper.srx.rule_name + target_field: rule.id + ignore_missing: true + if: "ctx.juniper?.srx?.rule_name != null" + +######################### +## ECS Network Mapping ## +######################### +- rename: + field: juniper.srx.protocol_name + target_field: network.protocol + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_name != null" + +######################### +## ECS message Mapping ## +######################### +- rename: + field: juniper.srx.message + target_field: message + ignore_missing: true + if: "ctx.juniper?.srx?.message != null" + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.outbound_bytes + - juniper.srx.outbound_packets + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.inbound_bytes + - juniper.srx.inbound_packets + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/ids.yml b/x-pack/filebeat/module/juniper/srx/ingest/ids.yml new file mode 100644 index 00000000000..039fdd64ccb --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/ids.yml @@ -0,0 +1,363 @@ +description: Pipeline for parsing junipersrx firewall logs (ids pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- set: + field: event.kind + value: alert + if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.category + value: intrusion_detection + if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - info + - denied + - connection + if: '["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - allowed + - connection + if: '!["RT_SCREEN_TCP", "RT_SCREEN_UDP", "RT_SCREEN_ICMP", "RT_SCREEN_IP", "RT_SCREEN_TCP_DST_IP", "RT_SCREEN_TCP_SRC_IP", "RT_SCREEN_TCP_LS", "RT_SCREEN_UDP_LS", "RT_SCREEN_ICMP_LS", "RT_SCREEN_IP_LS", "RT_SCREEN_TCP_DST_IP_LS", "RT_SCREEN_TCP_SRC_IP_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: flood_detected + if: '["ICMP flood!", "UDP flood!", "SYN flood!", "SYN flood Src-IP based!", "SYN flood Dst-IP based!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: scan_detected + if: "ctx.juniper?.srx?.attack_name == 'TCP port scan!'" +- set: + field: event.action + value: sweep_detected + if: '["TCP sweep!", "IP sweep!", "UDP sweep!", "Address sweep!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: fragment_detected + if: '["ICMP fragment!", "SYN fragment!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: spoofing_detected + if: "ctx.juniper?.srx?.attack_name == 'IP spoofing!'" +- set: + field: event.action + value: session_limit_detected + if: '["Src IP session limit!", "Dst IP session limit!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: attack_detected + if: '["Land attack!", "WinNuke attack!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: illegal_tcp_flag_detected + if: '["No TCP flag!", "SYN and FIN bits!", "FIN but no ACK bit!"].contains(ctx.juniper?.srx?.attack_name)' +- set: + field: event.action + value: tunneling_screen + if: "ctx.juniper?.srx?.attack_name.startsWith('Tunnel')" + + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_port != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_server + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_server != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.packets_from_server + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_server !=null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_client + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_client != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.packets_from_client + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_client != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" + +############################# +## ECS Network/Geo Mapping ## +############################# +- rename: + field: juniper.srx.protocol_id + target_field: network.iana_number + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_id != null" +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + field: source.nat.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.nat.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.nat.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.source?.as == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.nat.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.destination?.as == null" +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.bytes_from_client + - juniper.srx.packets_from_client + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.bytes_from_server + - juniper.srx.packets_from_server + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml b/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml new file mode 100644 index 00000000000..5bc4d45e82e --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/pipeline.yml @@ -0,0 +1,275 @@ +# This module only supports syslog messages in the format "structured-data + brief" +# https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/structured-data-edit-system.html +description: Pipeline for parsing junipersrx firewall logs +processors: +- grok: + field: message + patterns: + - '^<%{POSINT:syslog_pri}>(\d{1,3}\s)?(?:%{TIMESTAMP_ISO8601:_temp_.raw_date})\s%{SYSLOGHOST:syslog_hostname}\s%{PROG:syslog_program}\s(?:%{POSINT:syslog_pid}|-)?\s%{WORD:log_type}\s\[.+?\s%{GREEDYDATA:log.original}\]$' + +# split Juniper-SRX fields +- kv: + field: log.original + field_split: " (?=[a-z0-9\\_\\-]+=)" + value_split: "=" + prefix: "juniper.srx." + ignore_missing: true + ignore_failure: false + trim_value: "\"" + +# Converts all kebab-case key names to snake_case +- script: + lang: painless + source: >- + ctx.juniper.srx = ctx?.juniper?.srx.entrySet().stream().collect(Collectors.toMap(e -> e.getKey().replace('-', '_'), e -> e.getValue())); + +# +# Parse the date +# +- date: + if: "ctx.event.timezone == null" + field: _temp_.raw_date + target_field: "@timestamp" + formats: + - yyyy-MM-dd HH:mm:ss + - yyyy-MM-dd HH:mm:ss z + - yyyy-MM-dd HH:mm:ss Z + - ISO8601 +- date: + if: "ctx.event.timezone != null" + timezone: "{{ event.timezone }}" + field: _temp_.raw_date + target_field: "@timestamp" + formats: + - yyyy-MM-dd HH:mm:ss + - yyyy-MM-dd HH:mm:ss z + - yyyy-MM-dd HH:mm:ss Z + - ISO8601 + +- set: + field: event.ingested + value: '{{_ingest.timestamp}}' + +# Can possibly be omitted if there is a solution for the equal signs and the calculation of the start time. +# -> juniper.srx.elapsed_time +- rename: + field: juniper.srx.elapsed_time + target_field: juniper.srx.duration + if: "ctx.juniper?.srx?.elapsed_time != null" + +# Sets starts, end and duration when start and duration is known +- script: + lang: painless + if: ctx?.juniper?.srx?.duration != null + source: >- + ctx.event.duration = Integer.parseInt(ctx.juniper.srx.duration) * 1000000000L; + ctx.event.start = ctx['@timestamp']; + ZonedDateTime start = ZonedDateTime.parse(ctx.event.start); + ctx.event.end = start.plus(ctx.event.duration, ChronoUnit.NANOS); + +# Removes all empty fields +- script: + lang: painless + params: + values: + - "None" + - "UNKNOWN" + - "N/A" + - "-" + source: >- + ctx?.juniper?.srx.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); + +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.module + value: juniper +- set: + field: event.dataset + value: juniper.srx +- set: + field: event.severity + value: '{{syslog_pri}}' +- rename: + field: log.original + target_field: event.original + ignore_missing: true + +##################### +## ECS Log Mapping ## +##################### +# https://www.juniper.net/documentation/en_US/junos/topics/reference/general/syslog-interpreting-msg-generated-structured-data-format.html#fac_sev_codes +- set: + field: "log.level" + if: '["0", "8", "16", "24", "32", "40", "48", "56", "64", "72", "80", "88", "96", "104", "112", "128", "136", "144", "152", "160", "168", "176", "184"].contains(ctx.syslog_pri)' + value: emergency +- set: + field: "log.level" + if: '["1", "9", "17", "25", "33", "41", "49", "57", "65", "73", "81", "89", "97", "105", "113", "129", "137", "145", "153", "161", "169", "177", "185"].contains(ctx.syslog_pri)' + value: alert +- set: + field: "log.level" + if: '["2", "10", "18", "26", "34", "42", "50", "58", "66", "74", "82", "90", "98", "106", "114", "130", "138", "146", "154", "162", "170", "178", "186"].contains(ctx.syslog_pri)' + value: critical +- set: + field: "log.level" + if: '["3", "11", "19", "27", "35", "43", "51", "59", "67", "75", "83", "91", "99", "107", "115", "131", "139", "147", "155", "163", "171", "179", "187"].contains(ctx.syslog_pri)' + value: error +- set: + field: "log.level" + if: '["4", "12", "20", "28", "36", "44", "52", "60", "68", "76", "84", "92", "100", "108", "116", "132", "140", "148", "156", "164", "172", "180", "188"].contains(ctx.syslog_pri)' + value: warning +- set: + field: "log.level" + if: '["5", "13", "21", "29", "37", "45", "53", "61", "69", "77", "85", "93", "101", "109", "117", "133", "141", "149", "157", "165", "173", "181", "189"].contains(ctx.syslog_pri)' + value: notification +- set: + field: "log.level" + if: '["6", "14", "22", "30", "38", "46", "54", "62", "70", "78", "86", "94", "102", "110", "118", "134", "142", "150", "158", "166", "174", "182", "190"].contains(ctx.syslog_pri)' + value: informational +- set: + field: "log.level" + if: '["7", "15", "23", "31", "39", "47", "55", "63", "71", "79", "87", "95", "103", "111", "119", "135", "143", "151", "159", "167", "175", "183", "191"].contains(ctx.syslog_pri)' + value: debug + +########################## +## ECS Observer Mapping ## +########################## +- set: + field: observer.vendor + value: Juniper +- set: + field: observer.product + value: SRX +- set: + field: observer.type + value: firewall +- rename: + field: syslog_hostname + target_field: observer.name + ignore_missing: true +- rename: + field: juniper.srx.packet_incoming_interface + target_field: observer.ingress.interface.name + ignore_missing: true +- rename: + field: juniper.srx.destination_interface_name + target_field: observer.egress.interface.name + ignore_missing: true +- rename: + field: juniper.srx.source_interface_name + target_field: observer.ingress.interface.name + ignore_missing: true +- rename: + field: juniper.srx.interface_name + target_field: observer.ingress.interface.name + ignore_missing: true +- rename: + field: juniper.srx.source_zone_name + target_field: observer.ingress.zone + ignore_missing: true +- rename: + field: juniper.srx.source_zone + target_field: observer.ingress.zone + ignore_missing: true +- rename: + field: juniper.srx.destination_zone_name + target_field: observer.egress.zone + ignore_missing: true +- rename: + field: juniper.srx.destination_zone + target_field: observer.egress.zone + ignore_missing: true +- rename: + field: syslog_program + target_field: juniper.srx.process + ignore_missing: true +- rename: + field: log_type + target_field: juniper.srx.tag + ignore_missing: true + + +############# +## Cleanup ## +############# +- remove: + field: + - message + - _temp_ + - _temp + - juniper.srx.duration + - juniper.srx.dir_disp + - juniper.srx.srczone + - juniper.srx.dstzone + - juniper.srx.duration + - syslog_pri + ignore_missing: true + +################################ +## Product Specific Pipelines ## +################################ +- pipeline: + name: '{< IngestPipeline "flow" >}' + if: "ctx.juniper?.srx?.process == 'RT_FLOW'" +- pipeline: + name: '{< IngestPipeline "utm" >}' + if: "ctx.juniper?.srx?.process == 'RT_UTM'" +- pipeline: + name: '{< IngestPipeline "idp" >}' + if: "ctx.juniper?.srx?.process == 'RT_IDP'" +- pipeline: + name: '{< IngestPipeline "ids" >}' + if: "ctx.juniper?.srx?.process == 'RT_IDS'" +- pipeline: + name: '{< IngestPipeline "atp" >}' + if: "ctx.juniper?.srx?.process == 'RT_AAMW'" +- pipeline: + name: '{< IngestPipeline "secintel" >}' + if: "ctx.juniper?.srx?.process == 'RT_SECINTEL'" + +######################### +## ECS Related Mapping ## +######################### +- append: + if: 'ctx.source?.ip != null' + field: related.ip + value: '{{source.ip}}' + ignore_failure: true +- append: + if: 'ctx.destination?.ip != null' + field: related.ip + value: '{{destination.ip}}' + ignore_failure: true +- append: + if: 'ctx.source?.nat?.ip != null' + field: related.ip + value: '{{source.nat.ip}}' + ignore_failure: true +- append: + if: 'ctx?.destination?.nat?.ip != null' + field: related.ip + value: '{{destination.nat.ip}}' + ignore_failure: true + +- append: + if: 'ctx.url?.domain != null' + field: related.hosts + value: '{{url.domain}}' + ignore_failure: true +- append: + if: 'ctx.source?.domain != null' + field: related.hosts + value: '{{source.domain}}' + ignore_failure: true +- append: + if: 'ctx.destination?.domain != null' + field: related.hosts + value: '{{destination.domain}}' + ignore_failure: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/secintel.yml b/x-pack/filebeat/module/juniper/srx/ingest/secintel.yml new file mode 100644 index 00000000000..f2abb2bcf9c --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/secintel.yml @@ -0,0 +1,349 @@ +description: Pipeline for parsing junipersrx firewall logs (secintel pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- set: + field: event.kind + value: alert + if: 'ctx.juniper?.srx?.tag == "SECINTEL_ACTION_LOG" && ctx.juniper?.srx?.action != "PERMIT"' +- append: + field: event.category + value: malware + if: 'ctx.juniper?.srx?.tag == "SECINTEL_ACTION_LOG" && ctx.juniper?.srx?.action != "PERMIT"' +- append: + field: event.type + value: + - info + - denied + - connection + if: "ctx.juniper?.srx?.action == 'BLOCK'" +- append: + field: event.type + value: + - allowed + - connection + if: "ctx.juniper?.srx?.action != 'BLOCK'" +- set: + field: event.action + value: malware_detected + if: "ctx.juniper?.srx?.action == 'BLOCK'" + + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_port != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_server + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_server != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.packets_from_server + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_server !=null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_client + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_client != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.packets_from_client + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_client != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" +- rename: + field: juniper.srx.hostname + target_field: source.address + ignore_missing: true + if: "ctx.juniper?.srx?.hostname != null" +- rename: + field: juniper.srx.client_ip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.client_ip != null" + +###################### +## ECS URL Mapping ## +###################### +- rename: + field: juniper.srx.http_host + target_field: url.domain + ignore_missing: true + if: "ctx.juniper?.srx?.http_host != null" + +############################# +## ECS Network/Geo Mapping ## +############################# +- rename: + field: juniper.srx.protocol_id + target_field: network.iana_number + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_id != null" +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + field: source.nat.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.nat.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.nat.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.source?.as == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.nat.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.destination?.as == null" +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.bytes_from_client + - juniper.srx.packets_from_client + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.bytes_from_server + - juniper.srx.packets_from_server + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/ingest/utm.yml b/x-pack/filebeat/module/juniper/srx/ingest/utm.yml new file mode 100644 index 00000000000..a80e5a94d97 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/ingest/utm.yml @@ -0,0 +1,388 @@ +description: Pipeline for parsing junipersrx firewall logs (utm pipeline) +processors: +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: event +- set: + field: event.outcome + value: success + if: "ctx.juniper?.srx?.tag != null" +- append: + field: event.category + value: network +- rename: + field: juniper.srx.urlcategory_risk + target_field: event.risk_score + ignore_missing: true + if: "ctx.juniper?.srx?.urlcategory_risk != null" +- set: + field: event.kind + value: alert + if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.category + value: malware + if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - info + - denied + - connection + if: '["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- append: + field: event.type + value: + - allowed + - connection + if: '!["AV_VIRUS_DETECTED_MT", "WEBFILTER_URL_BLOCKED", "ANTISPAM_SPAM_DETECTED_MT", "CONTENT_FILTERING_BLOCKED_MT", "AV_VIRUS_DETECTED_MT_LS", "WEBFILTER_URL_BLOCKED_LS", "ANTISPAM_SPAM_DETECTED_MT_LS", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: web_filter + if: '["WEBFILTER_URL_BLOCKED", "WEBFILTER_URL_BLOCKED_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: content_filter + if: '["CONTENT_FILTERING_BLOCKED_MT", "CONTENT_FILTERING_BLOCKED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: antispam_filter + if: '["ANTISPAM_SPAM_DETECTED_MT", "ANTISPAM_SPAM_DETECTED_MT_LS"].contains(ctx.juniper?.srx?.tag)' +- set: + field: event.action + value: virus_detected + if: '["AV_VIRUS_DETECTED_MT", "AV_VIRUS_DETECTED_MT_LS"].contains(ctx.juniper?.srx?.tag)' + + +#################################### +## ECS Server/Destination Mapping ## +#################################### +- rename: + field: juniper.srx.destination_address + target_field: destination.ip + ignore_missing: true + if: "ctx.juniper?.srx?.destination_address != null" +- set: + field: server.ip + value: '{{destination.ip}}' + if: "ctx.destination?.ip != null" +- rename: + field: juniper.srx.nat_destination_address + target_field: destination.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_address != null" +- convert: + field: juniper.srx.destination_port + target_field: destination.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.destination_port != null" +- set: + field: server.port + value: '{{destination.port}}' + if: "ctx.destination?.port != null" +- convert: + field: server.port + target_field: server.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.port != null" +- convert: + field: juniper.srx.nat_destination_port + target_field: destination.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_destination_port != null" +- set: + field: server.nat.port + value: '{{destination.nat.port}}' + if: "ctx.destination?.nat?.port != null" +- convert: + field: server.nat.port + target_field: server.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_server + target_field: destination.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_server != null" +- set: + field: server.bytes + value: '{{destination.bytes}}' + if: "ctx.destination?.bytes != null" +- convert: + field: server.bytes + target_field: server.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.bytes != null" +- convert: + field: juniper.srx.packets_from_server + target_field: destination.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_server !=null" +- set: + field: server.packets + value: '{{destination.packets}}' + if: "ctx.destination?.packets != null" +- convert: + field: server.packets + target_field: server.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.server?.packets != null" + +############################### +## ECS Client/Source Mapping ## +############################### +- rename: + field: juniper.srx.source_address + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.source_address != null" +- set: + field: client.ip + value: '{{source.ip}}' + if: "ctx.source?.ip != null" +- rename: + field: juniper.srx.nat_source_address + target_field: source.nat.ip + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_address != null" +- rename: + field: juniper.srx.sourceip + target_field: source.ip + ignore_missing: true + if: "ctx.juniper?.srx?.sourceip != null" +- convert: + field: juniper.srx.source_port + target_field: source.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.source_port != null" +- set: + field: client.port + value: '{{source.port}}' + if: "ctx.source?.port != null" +- convert: + field: client.port + target_field: client.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.port != null" +- convert: + field: juniper.srx.nat_source_port + target_field: source.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.nat_source_port != null" +- set: + field: client.nat.port + value: '{{source.nat.port}}' + if: "ctx.source?.nat?.port != null" +- convert: + field: client.nat.port + target_field: client.nat.port + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.nat?.port != null" +- convert: + field: juniper.srx.bytes_from_client + target_field: source.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.bytes_from_client != null" +- set: + field: client.bytes + value: '{{source.bytes}}' + if: "ctx.source?.bytes != null" +- convert: + field: client.bytes + target_field: client.bytes + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.bytes != null" +- convert: + field: juniper.srx.packets_from_client + target_field: source.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.juniper?.srx?.packets_from_client != null" +- set: + field: client.packets + value: '{{source.packets}}' + if: "ctx.source?.packets != null" +- convert: + field: client.packets + target_field: client.packets + type: long + ignore_failure: true + ignore_missing: true + if: "ctx.client?.packets != null" +- rename: + field: juniper.srx.username + target_field: source.user.name + ignore_missing: true + if: "ctx.juniper?.srx?.username != null" + +###################### +## ECS Rule Mapping ## +###################### +- rename: + field: juniper.srx.policy_name + target_field: rule.name + ignore_missing: true + if: "ctx.juniper?.srx?.policy_name != null" + +##################### +## ECS URL Mapping ## +##################### +- rename: + field: juniper.srx.url + target_field: url.domain + ignore_missing: true + if: "ctx.juniper?.srx?.url != null" +- rename: + field: juniper.srx.obj + target_field: url.path + ignore_missing: true + if: "ctx.juniper?.srx?.obj != null" + +###################### +## ECS File Mapping ## +###################### +- rename: + field: juniper.srx.filename + target_field: file.name + ignore_missing: true + if: "ctx.juniper?.srx?.filename != null" + +######################### +## ECS Network Mapping ## +######################### +- rename: + field: juniper.srx.protocol + target_field: network.protocol + ignore_missing: true + if: "ctx.juniper?.srx?.protocol != null" + +############################# +## ECS Network/Geo Mapping ## +############################# +- rename: + field: juniper.srx.protocol_id + target_field: network.iana_number + ignore_missing: true + if: "ctx.juniper?.srx?.protocol_id != null" +- geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true +- geoip: + field: source.nat.ip + target_field: source.geo + ignore_missing: true + if: "ctx.source?.geo == null" +- geoip: + field: destination.nat.ip + target_field: destination.geo + ignore_missing: true + if: "ctx.destination?.geo == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: source.nat.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.source?.as == null" +- geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.nat.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + if: "ctx.destination?.as == null" +- rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true +- rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true +- rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true +- rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + +############# +## Cleanup ## +############# +- remove: + field: + - juniper.srx.destination_port + - juniper.srx.nat_destination_port + - juniper.srx.bytes_from_client + - juniper.srx.packets_from_client + - juniper.srx.source_port + - juniper.srx.nat_source_port + - juniper.srx.bytes_from_server + - juniper.srx.packets_from_server + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/x-pack/filebeat/module/juniper/srx/manifest.yml b/x-pack/filebeat/module/juniper/srx/manifest.yml new file mode 100644 index 00000000000..879be66b99d --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/manifest.yml @@ -0,0 +1,26 @@ +module_version: 1.0 + +var: + - name: syslog_host + default: localhost + - name: tags + default: ["juniper.srx", "forwarded"] + - name: syslog_port + default: 9006 + - name: input + default: udp + +ingest_pipeline: + - ingest/pipeline.yml + - ingest/flow.yml + - ingest/utm.yml + - ingest/idp.yml + - ingest/ids.yml + - ingest/atp.yml + - ingest/secintel.yml + +input: config/srx.yml + +requires.processors: +- name: geoip + plugin: ingest-geoip diff --git a/x-pack/filebeat/module/juniper/srx/test/atp.log b/x-pack/filebeat/module/juniper/srx/test/atp.log new file mode 100644 index 00000000000..95c8210f038 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/atp.log @@ -0,0 +1,4 @@ +<14>1 2013-12-14T16:06:59.134Z pinarello RT_AAMW - SRX_AAMW_ACTION_LOG [junos@xxx.x.x.x.x.28 http-host="www.mytest.com" file-category="executable" action="BLOCK" verdict-number="8" verdict-source=”cloud/blacklist/whitelist” source-address="10.10.10.1" source-port="57116" destination-address="187.19.188.200" destination-port="80" protocol-id="6" application="UNKNOWN" nested-application="UNKNOWN" policy-name="argon_policy" username="user1" session-id-32="50000002" source-zone-name="untrust" destination-zone-name="trust"] +<14>1 2016-09-20T10:43:30.330-07:00 host-example RT_AAMW - AAMW_MALWARE_EVENT_LOG [junos@xxxx.1.1.x.x.xxx timestamp="Thu Jun 23 09:55:38 2016" tenant-id="ABC123456" sample-sha256="ABC123" client-ip="192.0.2.0" verdict-number="9" malware-info="Eicar:TestVirus" username="admin" hostname="host.example.com"] +<11>1 2016-09-20T10:40:30.050-07:00 host-example RT_AAMW - AAMW_HOST_INFECTED_EVENT_LOG [junos@xxxx.1.1.x.x.xxx timestamp="Thu Jun 23 09:55:38 2016" tenant-id="ABC123456" client-ip="192.0.2.0" hostname="host.example.com" status="in_progress" policy-name="default" th="7" state="added" reason="malware" message="malware analysis detected host downloaded a malicious_file with score 9, sha256 ABC123"] +<165>1 2007-02-15T09:17:15.719Z aamw1 RT_AAMW - AAMW_ACTION_LOG [junos@2636.1.1.1.2.129 hostname="dummy_host" file-category="executable" verdict-number="10" malware-info="Testfile" action="PERMIT" list-hit="N/A" file-hash-lookup="FALSE" source-address="1.1.1.1" source-port="60148" destination-address="10.0.0.1" destination-port="80" protocol-id="6" application="HTTP" nested-application="N/A" policy-name="test-policy" username="N/A" roles="N/A" session-id-32="502156" source-zone-name="Inside" destination-zone-name="Outside" sample-sha256="e038b5168d9209267058112d845341cae83d92b1d1af0a10b66830acb7529494" file-name="dummy_file" url="dummy_url"] diff --git a/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json new file mode 100644 index 00000000000..4187866594e --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/atp.log-expected.json @@ -0,0 +1,240 @@ +[ + { + "@timestamp": "2013-12-14T14:06:59.134-02:00", + "client.ip": "10.10.10.1", + "client.port": 57116, + "destination.as.number": 28126, + "destination.as.organization.name": "BRISANET SERVICOS DE TELECOMUNICACOES LTDA", + "destination.geo.city_name": "Juazeiro do Norte", + "destination.geo.continent_name": "South America", + "destination.geo.country_iso_code": "BR", + "destination.geo.country_name": "Brazil", + "destination.geo.location.lat": -7.1467, + "destination.geo.location.lon": -39.247, + "destination.geo.region_iso_code": "BR-CE", + "destination.geo.region_name": "Ceara", + "destination.ip": "187.19.188.200", + "destination.port": 80, + "event.action": "malware_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "http-host=\"www.mytest.com\" file-category=\"executable\" action=\"BLOCK\" verdict-number=\"8\" verdict-source=\u201dcloud/blacklist/whitelist\u201d source-address=\"10.10.10.1\" source-port=\"57116\" destination-address=\"187.19.188.200\" destination-port=\"80\" protocol-id=\"6\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" policy-name=\"argon_policy\" username=\"user1\" session-id-32=\"50000002\" source-zone-name=\"untrust\" destination-zone-name=\"trust\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "BLOCK", + "juniper.srx.file_category": "executable", + "juniper.srx.policy_name": "argon_policy", + "juniper.srx.process": "RT_AAMW", + "juniper.srx.session_id_32": "50000002", + "juniper.srx.tag": "SRX_AAMW_ACTION_LOG", + "juniper.srx.verdict_number": "8", + "juniper.srx.verdict_source": "\u201dcloud/blacklist/whitelist\u201d", + "log.level": "informational", + "log.offset": 0, + "network.iana_number": "6", + "observer.egress.zone": "trust", + "observer.ingress.zone": "untrust", + "observer.name": "pinarello", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "www.mytest.com" + ], + "related.ip": [ + "10.10.10.1", + "187.19.188.200" + ], + "server.ip": "187.19.188.200", + "server.port": 80, + "service.type": "juniper", + "source.ip": "10.10.10.1", + "source.port": 57116, + "source.user.name": "user1", + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "www.mytest.com" + }, + { + "@timestamp": "2016-09-20T15:43:30.330-02:00", + "event.action": "malware_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "timestamp=\"Thu Jun 23 09:55:38 2016\" tenant-id=\"ABC123456\" sample-sha256=\"ABC123\" client-ip=\"192.0.2.0\" verdict-number=\"9\" malware-info=\"Eicar:TestVirus\" username=\"admin\" hostname=\"host.example.com\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.malware_info": "Eicar:TestVirus", + "juniper.srx.process": "RT_AAMW", + "juniper.srx.sample_sha256": "ABC123", + "juniper.srx.tag": "AAMW_MALWARE_EVENT_LOG", + "juniper.srx.tenant_id": "ABC123456", + "juniper.srx.timestamp": "2016-06-23T09:55:38.000Z", + "juniper.srx.verdict_number": "9", + "log.level": "informational", + "log.offset": 529, + "observer.name": "host-example", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "host.example.com" + ], + "related.ip": [ + "192.0.2.0" + ], + "service.type": "juniper", + "source.domain": "host.example.com", + "source.ip": "192.0.2.0", + "source.user.name": "admin", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2016-09-20T15:40:30.050-02:00", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "timestamp=\"Thu Jun 23 09:55:38 2016\" tenant-id=\"ABC123456\" client-ip=\"192.0.2.0\" hostname=\"host.example.com\" status=\"in_progress\" policy-name=\"default\" th=\"7\" state=\"added\" reason=\"malware\" message=\"malware analysis detected host downloaded a malicious_file with score 9, sha256 ABC123\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.message": "malware analysis detected host downloaded a malicious_file with score 9, sha256 ABC123", + "juniper.srx.policy_name": "default", + "juniper.srx.process": "RT_AAMW", + "juniper.srx.reason": "malware", + "juniper.srx.state": "added", + "juniper.srx.status": "in_progress", + "juniper.srx.tag": "AAMW_HOST_INFECTED_EVENT_LOG", + "juniper.srx.tenant_id": "ABC123456", + "juniper.srx.th": "7", + "juniper.srx.timestamp": "2016-06-23T09:55:38.000Z", + "log.level": "error", + "log.offset": 835, + "observer.name": "host-example", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "host.example.com" + ], + "related.ip": [ + "192.0.2.0" + ], + "service.type": "juniper", + "source.domain": "host.example.com", + "source.ip": "192.0.2.0", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2007-02-15T07:17:15.719-02:00", + "client.ip": "1.1.1.1", + "client.port": 60148, + "destination.ip": "10.0.0.1", + "destination.port": 80, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "hostname=\"dummy_host\" file-category=\"executable\" verdict-number=\"10\" malware-info=\"Testfile\" action=\"PERMIT\" list-hit=\"N/A\" file-hash-lookup=\"FALSE\" source-address=\"1.1.1.1\" source-port=\"60148\" destination-address=\"10.0.0.1\" destination-port=\"80\" protocol-id=\"6\" application=\"HTTP\" nested-application=\"N/A\" policy-name=\"test-policy\" username=\"N/A\" roles=\"N/A\" session-id-32=\"502156\" source-zone-name=\"Inside\" destination-zone-name=\"Outside\" sample-sha256=\"e038b5168d9209267058112d845341cae83d92b1d1af0a10b66830acb7529494\" file-name=\"dummy_file\" url=\"dummy_url\"", + "event.outcome": "success", + "event.severity": "165", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "PERMIT", + "juniper.srx.application": "HTTP", + "juniper.srx.file_category": "executable", + "juniper.srx.file_hash_lookup": "FALSE", + "juniper.srx.file_name": "dummy_file", + "juniper.srx.malware_info": "Testfile", + "juniper.srx.policy_name": "test-policy", + "juniper.srx.process": "RT_AAMW", + "juniper.srx.sample_sha256": "e038b5168d9209267058112d845341cae83d92b1d1af0a10b66830acb7529494", + "juniper.srx.session_id_32": "502156", + "juniper.srx.tag": "AAMW_ACTION_LOG", + "juniper.srx.url": "dummy_url", + "juniper.srx.verdict_number": "10", + "log.level": "notification", + "log.offset": 1235, + "network.iana_number": "6", + "observer.egress.zone": "Outside", + "observer.ingress.zone": "Inside", + "observer.name": "aamw1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "dummy_host" + ], + "related.ip": [ + "1.1.1.1", + "10.0.0.1" + ], + "server.ip": "10.0.0.1", + "server.port": 80, + "service.type": "juniper", + "source.as.number": 13335, + "source.as.organization.name": "Cloudflare, Inc.", + "source.domain": "dummy_host", + "source.geo.continent_name": "Oceania", + "source.geo.country_iso_code": "AU", + "source.geo.country_name": "Australia", + "source.geo.location.lat": -33.494, + "source.geo.location.lon": 143.2104, + "source.ip": "1.1.1.1", + "source.port": 60148, + "tags": [ + "juniper.srx", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/juniper/srx/test/flow.log b/x-pack/filebeat/module/juniper/srx/test/flow.log new file mode 100644 index 00000000000..400bceceeee --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/flow.log @@ -0,0 +1,25 @@ +<14>1 2019-11-14T09:37:51.184+01:00 SRX-GW1 RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.134 source-address="10.0.0.1" source-port="594" destination-address="10.128.0.1" destination-port="10400" connection-tag="0" service-name="icmp" nat-source-address="10.0.0.1" nat-source-port="594" nat-destination-address="10.128.0.1" nat-destination-port="10400" nat-connection-tag="0" src-nat-rule-type="N/A" src-nat-rule-name="N/A" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="1" policy-name="vpn_trust_permit-all" source-zone-name="vpn" destination-zone-name="trust" session-id-32="6093" username="N/A" roles="N/A" packet-incoming-interface="st0.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="1" application-characteristics="N/A"] +<14>1 2019-11-14T11:12:46.573+01:00 SRX-GW1 RT_FLOW - RT_FLOW_SESSION_DENY [junos@2636.1.1.1.2.134 source-address="10.0.0.26" source-port="37233" destination-address="10.128.0.1" destination-port="161" connection-tag="0" service-name="None" protocol-id="17" icmp-type="0" policy-name="MgmtAccess-trust-cleanup" source-zone-name="trust" destination-zone-name="junos-host" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface=".local..0" encrypted="No" reason="Denied by policy" session-id-32="7087" application-category="N/A" application-sub-category="N/A" application-risk="1" application-characteristics="N/A"] +<14>1 2014-05-01T08:26:51.179Z fw01 RT_FLOW - RT_FLOW_SESSION_DENY [junos@2636.1.1.1.2.39 source-address="1.2.3.4" source-port="56639" destination-address="5.6.7.8" destination-port="2003" service-name="None" protocol-id="6" icmp-type="0" policy-name="log-all-else" source-zone-name="campus" destination-zone-name="mngmt" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth6.0" encrypted="No "] +<14>1 2014-05-01T08:28:10.933Z fw01 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.39 reason="unset" source-address="1.2.3.4" source-port="63456" destination-address="5.6.7.8" destination-port="902" service-name="None" nat-source-address="1.2.3.4" nat-source-port="63456" nat-destination-address="5.6.7.8" nat-destination-port="902" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="17" policy-name="mngmt-to-vcenter" source-zone-name="mngmt" destination-zone-name="intra" session-id-32="15353" packets-from-client="1" bytes-from-client="94" packets-from-server="0" bytes-from-server="0" elapsed-time="60" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth3.5" encrypted="No "] +<14>1 2013-11-04T16:23:09.264Z cixi RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.35 source-address="50.0.0.100" source-port="24065" destination-address="30.0.0.100" destination-port="768" service-name="icmp" nat-source-address="50.0.0.100" nat-source-port="24065" nat-destination-address="30.0.0.100" nat-destination-port="768" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="alg-policy" source-zone-name="untrust" destination-zone-name="trust" session-id-32="100000165" username="N/A" roles="N/A" packet-incoming-interface="reth2.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"] +<14>1 2010-09-30T14:55:04.323+08:00 mrpp-srx550-dut01 RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2626.192.0.2.1.40 source-address="192.0.2.1" source-port="1" destination-address="198.51.100.12" destination-port="46384" service-name="icmp" nat-source-address="192.0.2.1" nat-source-port="1" nat-destination-address="18.51.100.12" nat-destination-port="46384" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="policy1" source-zone-name="trustZone" destination-zone-name="untrustZone" session-id-32="41" packet-incoming-interface="ge-0/0/1.0"] +<14>1 2010-09-30T14:55:07.188+08:00 mrpp-srx550-dut01 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2626.192.0.2.1.40 reason="response received" source-address="192.0.2.1" source-port="1" destination-address="198.51.100.12" destination-port="46384" service-name="icmp" nat-source-address="192.0.2.1" nat-source-port="1" nat-destination-address="18.51.100.12" nat-destination-port="46384" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="policy1" source-zone-name="trustZone" destination-zone-name="untrustZone" session-id-32="41" packets-from-client="1" bytes-from-client="84" packets-from-server="1" bytes-from-server="84" elapsed-time="0" packet-incoming-interface="ge-0/0/1.0"] +<14>1 2019-04-12T14:29:06.576Z cixi RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.129 reason="TCP FIN" source-address="10.3.255.203" source-port="47776" destination-address="8.23.224.110" destination-port="80" connection-tag="0" service-name="junos-http" nat-source-address="10.3.136.49" nat-source-port="19162" nat-destination-address="8.23.224.110" nat-destination-port="80" nat-connection-tag="0" src-nat-rule-type="source rule" src-nat-rule-name="nat1" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="permit_all" source-zone-name="trust" destination-zone-name="untrust" session-id-32="5" packets-from-client="6" bytes-from-client="337" packets-from-server="4" bytes-from-server="535" elapsed-time="1" application="HTTP" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0" encrypted="No" application-category="Web" application-sub-category="N/A" application-risk="4" application-characteristics="Can Leak Information;Supports File Transfer;Prone to Misuse;Known Vulnerabilities;Carrier of Malware;Capable of Tunneling;"] +<14>1 2019-04-13T14:33:06.576Z cixi RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.58 reason="TCP RST" source-address="192.168.2.164" source-port="53232" destination-address="172.16.1.19" destination-port="445" service-name="junos-smb" nat-source-address="192.168.2.164" nat-source-port="53232" nat-destination-address="172.16.1.19" nat-destination-port="445" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="6" policy-name="35" source-zone-name="Trust" destination-zone-name="Trust" session-id-32="206" packets-from-client="13" bytes-from-client="4274" packets-from-server="9" bytes-from-server="1575" elapsed-time="16" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/2.0"] +<14>1 2018-10-07T01:32:20.898Z TestFW2 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.34 reason="idle Timeout" source-address="100.73.10.92" source-port="52890" destination-address="58.68.126.198" destination-port="53" service-name="junos-dns-udp" nat-source-address="58.78.140.131" nat-source-port="11152" nat-destination-address="58.68.126.198" nat-destination-port="53" src-nat-rule-type="source rule" src-nat-rule-name="NAT_S" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="17" policy-name="NAT" source-zone-name="Gi_nat" destination-zone-name="Internet" session-id-32="220368889" packets-from-client="1" bytes-from-client="72" packets-from-server="1" bytes-from-server="136" elapsed-time="8" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth0.108" encrypted="UNKNOWN"] +<14>1 2018-06-30T02:17:22.753Z fw0001 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.41 reason="idle Timeout" source-address="192.168.255.2" source-port="62047" destination-address="8.8.8.8" destination-port="53" service-name="junos-dns-udp" nat-source-address="192.168.0.47" nat-source-port="20215" nat-destination-address="8.8.8.8" nat-destination-port="53" src-nat-rule-type="source rule" src-nat-rule-name="rule001" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="17" policy-name="trust-to-untrust-001" source-zone-name="trust" destination-zone-name="untrust" session-id-32="9621" packets-from-client="1" bytes-from-client="67" packets-from-server="1" bytes-from-server="116" elapsed-time="3" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="fe-0/0/1.0" encrypted="UNKNOWN"] +<14>1 2015-09-25T14:19:53.846Z VPNBox-A RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.36 reason="application failure or action" source-address="10.164.110.223" source-port="9057" destination-address="10.104.12.161" destination-port="21" service-name="junos-ftp" nat-source-address="10.9.1.150" nat-source-port="58020" nat-destination-address="10.12.70.1" nat-destination-port="21" src-nat-rule-name="SNAT-Policy5" dst-nat-rule-name="NAT-Policy10" protocol-id="6" policy-name="FW-FTP" source-zone-name="trust" destination-zone-name="untrust" session-id-32="24311" packets-from-client="0" bytes-from-client="0" packets-from-server="0" bytes-from-server="0" elapsed-time="1" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="reth0.0" encrypted="No "] +<14>1 2013-01-19T15:18:17.040 SRX100HM RT_FLOW - APPTRACK_SESSION_CREATE [junos@2636.1.1.1.2.41 source-address="192.168.224.30" source-port="3129" destination-address="207.17.137.56" destination-port="21" service-name="junos-ftp" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="173.167.224.7" nat-source-port="14406" nat-destination-address="207.17.137.56" nat-destination-port="21" src-nat-rule-name="1" dst-nat-rule-name="None" protocol-id="6" policy-name="General-Outbound" source-zone-name="LAN" destination-zone-name="Danger" session-id-32="5058" username="N/A" roles="N/A" encrypted="N/A"] +<14>1 2013-01-19T15:18:17.040 SRX100HM RT_FLOW - APPTRACK_SESSION_VOL_UPDATE [junos@2636.1.1.1.2.41 source-address="192.168.224.30" source-port="3129" destination-address="207.17.137.56" destination-port="21" service-name="junos-ftp" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="173.167.224.7" nat-source-port="14406" nat-destination-address="207.17.137.56" nat-destination-port="21" src-nat-rule-name="1" dst-nat-rule-name="None" protocol-id="6" policy-name="General-Outbound" source-zone-name="LAN" destination-zone-name="Danger" session-id-32="5058" packets-from-client="1" bytes-from-client="48" packets-from-server="0" bytes-from-server="0" elapsed-time="0" username="N/A" roles="N/A" encrypted="N/A"] +<14>1 2013-01-19T15:18:17.040 SRX100HM RT_FLOW - APPTRACK_SESSION_CLOSE [junos@2636.1.1.1.2.41 reason="application failure or action" source-address="192.168.224.30" source-port="3129" destination-address="207.17.137.56" destination-port="21" service-name="junos-ftp" application="FTP" nested-application="UNKNOWN" nat-source-address="173.167.224.7" nat-source-port="14406" nat-destination-address="207.17.137.56" nat-destination-port="21" src-nat-rule-name="1" dst-nat-rule-name="None" protocol-id="6" policy-name="General-Outbound" source-zone-name="LAN" destination-zone-name="Danger" session-id-32="5058" packets-from-client="3" bytes-from-client="144" packets-from-server="2" bytes-from-server="104" elapsed-time="1" username="N/A" roles="N/A" encrypted="N/A"] +<14>1 2013-01-19T15:18:18.040 SRX100HM RT_FLOW - APPTRACK_SESSION_VOL_UPDATE [junos@2636.1.1.1.2.129 source-address="4.0.0.1" source-port="33040" destination-address="5.0.0.1" destination-port="80" service-name="junos-http" application="HTTP" nested-application="FACEBOOK-SOCIALRSS" nat-source-address="4.0.0.1" nat-source-port="33040" nat-destination-address="5.0.0.1" nat-destination-port="80" src-nat-rule-name="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="permit-all" source-zone-name="trust" destination-zone-name="untrust" session-id-32="28" packets-from-client="371" bytes-from-client="19592" packets-from-server="584" bytes-from-server="686432" elapsed-time="60" username="user1" roles="DEPT1" encrypted="No" destination-interface-name=”st0.0” apbr-rule-type=”default”] +<14>1 2013-01-19T15:18:19.040 SRX100HM RT_FLOW - APPTRACK_SESSION_ROUTE_UPDATE [junos@2636.1.1.1.2.129 source-address="4.0.0.1" source-port="33040" destination-address="5.0.0.1" destination-port="80" service-name="junos-http" application="HTTP" nested-application="FACEBOOK-SOCIALRSS" nat-source-address="4.0.0.1" nat-source-port="33040" nat-destination-address="5.0.0.1" nat-destination-port="80" src-nat-rule-name="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="permit-all" source-zone-name="trust" destination-zone-name="untrust" session-id-32="28" username="user1" roles="DEPT1" encrypted="No" profile-name=”pf1” rule-name=”facebook1” routing-instance=”instance1” destination-interface-name=”st0.0” apbr-rule-type=”default”] +<14>1 2013-01-19T15:18:20.040 SRX100HM RT_FLOW - APPTRACK_SESSION_CLOSE [junos@2636.1.1.1.2.129 reason="TCP CLIENT RST" source-address="4.0.0.1" source-port="48873" destination-address="5.0.0.1" destination-port="80" service-name="junos-http" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="4.0.0.1" nat-source-port="48873" nat-destination-address="5.0.0.1" nat-destination-port="80" src-nat-rule-name="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="permit-all" source-zone-name="trust" destination-zone-name="untrust" session-id-32="32" packets-from-client="5" bytes-from-client="392" packets-from-server="3" bytes-from-server="646" elapsed-time="3" username="user1" roles="DEPT1" encrypted="No" destination-interface-name=”st0.0” apbr-rule-type=”default”] +<14>1 2020-11-04T16:23:09.264Z cixi RT_FLOW - RT_FLOW_SESSION_CREATE_LS [junos@2636.1.1.1.2.35 source-address="50.0.0.100" source-port="24065" destination-address="30.0.0.100" destination-port="768" service-name="icmp" nat-source-address="50.0.0.100" nat-source-port="24065" nat-destination-address="30.0.0.100" nat-destination-port="768" src-nat-rule-name="None" dst-nat-rule-name="None" protocol-id="1" policy-name="alg-policy" source-zone-name="untrust" destination-zone-name="trust" session-id-32="100000165" username="N/A" roles="N/A" packet-incoming-interface="reth2.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN"] +<14>1 2020-11-14T11:12:46.573+01:00 SRX-GW1 RT_FLOW - RT_FLOW_SESSION_DENY_LS [junos@2636.1.1.1.2.134 source-address="10.0.0.26" source-port="37233" destination-address="10.128.0.1" destination-port="161" connection-tag="0" service-name="None" protocol-id="17" icmp-type="0" policy-name="MgmtAccess-trust-cleanup" source-zone-name="trust" destination-zone-name="junos-host" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface=".local..0" encrypted="No" reason="Denied by policy" session-id-32="7087" application-category="N/A" application-sub-category="N/A" application-risk="1" application-characteristics="N/A"] +<14>1 2020-01-19T15:18:20.040 SRX100HM RT_FLOW - APPTRACK_SESSION_CLOSE_LS [junos@2636.1.1.1.2.129 reason="TCP CLIENT RST" source-address="4.0.0.1" source-port="48873" destination-address="5.0.0.1" destination-port="80" service-name="junos-http" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="4.0.0.1" nat-source-port="48873" nat-destination-address="5.0.0.1" nat-destination-port="80" src-nat-rule-name="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="permit-all" source-zone-name="trust" destination-zone-name="untrust" session-id-32="32" packets-from-client="5" bytes-from-client="392" packets-from-server="3" bytes-from-server="646" elapsed-time="3" username="user1" roles="DEPT1" encrypted="No" destination-interface-name=”st0.0” apbr-rule-type=”default”] +<14>1 2020-07-14T14:17:11.928Z SRX100HM RT_FLOW - APPTRACK_SESSION_VOL_UPDATE [junos@2636.1.1.1.2.129 source-address="10.1.1.100" source-port="58943" destination-address="46.165.154.241" destination-port="80" service-name="junos-http" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="172.19.34.100" nat-source-port="6018" nat-destination-address="46.165.154.241" nat-destination-port="80" src-nat-rule-name="our-nat-rule" dst-nat-rule-name="N/A" protocol-id="6" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id-32="16118" packets-from-client="42" bytes-from-client="2322" packets-from-server="34" bytes-from-server="2132" elapsed-time="60" username="N/A" roles="N/A" encrypted="No" destination-interface-name="ge-0/0/0.0" category="N/A" sub-category="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A"] +<14>1 2020-07-13T16:43:05.041Z SRX100HM RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.129 reason="idle Timeout" source-address="10.1.1.100" source-port="64720" destination-address="91.228.167.172" destination-port="8883" connection-tag="0" service-name="None" nat-source-address="172.19.34.100" nat-source-port="24519" nat-destination-address="91.228.167.172" nat-destination-port="8883" nat-connection-tag="0" src-nat-rule-type="source rule" src-nat-rule-name="our-nat-rule" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id-32="3851" packets-from-client="161" bytes-from-client="9530" packets-from-server="96" bytes-from-server="9670" elapsed-time="23755" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="1" application-characteristics="N/A" secure-web-proxy-session-type="NA" peer-session-id="0" peer-source-address="0.0.0.0" peer-source-port="0" peer-destination-address="0.0.0.0" peer-destination-port="0" hostname="NA NA" src-vrf-grp="N/A" dst-vrf-grp="N/A"] +<14>1 2020-07-13T16:12:05.530Z SRX100HM RT_FLOW - RT_FLOW_SESSION_CREATE [junos@2636.1.1.1.2.129 source-address="10.1.1.100" source-port="49583" destination-address="8.8.8.8" destination-port="53" connection-tag="0" service-name="junos-dns-udp" nat-source-address="172.19.34.100" nat-source-port="30838" nat-destination-address="8.8.8.8" nat-destination-port="53" nat-connection-tag="0" src-nat-rule-type="source rule" src-nat-rule-name="our-nat-rule" dst-nat-rule-type="N/A" dst-nat-rule-name="N/A" protocol-id="17" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id-32="15399" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" application="UNKNOWN" nested-application="UNKNOWN" encrypted="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="1" application-characteristics="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A"] +<14>1 2020-07-13T16:12:05.530Z SRX100HM RT_FLOW - APPTRACK_SESSION_CLOSE [junos@2636.1.1.1.2.129 reason="Closed by junos-alg" source-address="10.1.1.100" source-port="63381" destination-address="8.8.8.8" destination-port="53" service-name="junos-dns-udp" application="UNKNOWN" nested-application="UNKNOWN" nat-source-address="172.19.34.100" nat-source-port="26764" nat-destination-address="8.8.8.8" nat-destination-port="53" src-nat-rule-name="our-nat-rule" dst-nat-rule-name="N/A" protocol-id="17" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id-32="15361" packets-from-client="1" bytes-from-client="66" packets-from-server="1" bytes-from-server="82" elapsed-time="3" username="N/A" roles="N/A" encrypted="No" profile-name="N/A" rule-name="N/A" routing-instance="default" destination-interface-name="ge-0/0/0.0" uplink-incoming-interface-name="N/A" uplink-tx-bytes="0" uplink-rx-bytes="0" category="N/A" sub-category="N/A" apbr-policy-name="N/A" multipath-rule-name="N/A" src-vrf-grp="N/A" dst-vrf-grp="N/A"] diff --git a/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json new file mode 100644 index 00000000000..b597ed2afc5 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/flow.log-expected.json @@ -0,0 +1,2013 @@ +[ + { + "@timestamp": "2019-11-14T06:37:51.184-02:00", + "client.ip": "10.0.0.1", + "client.nat.port": 594, + "client.port": 594, + "destination.ip": "10.128.0.1", + "destination.nat.ip": "10.128.0.1", + "destination.nat.port": 10400, + "destination.port": 10400, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.0.0.1\" source-port=\"594\" destination-address=\"10.128.0.1\" destination-port=\"10400\" connection-tag=\"0\" service-name=\"icmp\" nat-source-address=\"10.0.0.1\" nat-source-port=\"594\" nat-destination-address=\"10.128.0.1\" nat-destination-port=\"10400\" nat-connection-tag=\"0\" src-nat-rule-type=\"N/A\" src-nat-rule-name=\"N/A\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"1\" policy-name=\"vpn_trust_permit-all\" source-zone-name=\"vpn\" destination-zone-name=\"trust\" session-id-32=\"6093\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"st0.0\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" encrypted=\"UNKNOWN\" application-category=\"N/A\" application-sub-category=\"N/A\" application-risk=\"1\" application-characteristics=\"N/A\"", + "event.outcome": "success", + "event.risk_score": "1", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.connection_tag": "0", + "juniper.srx.nat_connection_tag": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "icmp", + "juniper.srx.session_id_32": "6093", + "juniper.srx.tag": "RT_FLOW_SESSION_CREATE", + "log.level": "informational", + "log.offset": 0, + "network.iana_number": "1", + "observer.egress.zone": "trust", + "observer.ingress.interface.name": "st0.0", + "observer.ingress.zone": "vpn", + "observer.name": "SRX-GW1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.0.0.1", + "10.128.0.1", + "10.0.0.1", + "10.128.0.1" + ], + "rule.name": "vpn_trust_permit-all", + "server.ip": "10.128.0.1", + "server.nat.port": 10400, + "server.port": 10400, + "service.type": "juniper", + "source.ip": "10.0.0.1", + "source.nat.ip": "10.0.0.1", + "source.nat.port": 594, + "source.port": 594, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2019-11-14T08:12:46.573-02:00", + "client.ip": "10.0.0.26", + "client.port": 37233, + "destination.ip": "10.128.0.1", + "destination.port": 161, + "event.action": "flow_deny", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.0.0.26\" source-port=\"37233\" destination-address=\"10.128.0.1\" destination-port=\"161\" connection-tag=\"0\" service-name=\"None\" protocol-id=\"17\" icmp-type=\"0\" policy-name=\"MgmtAccess-trust-cleanup\" source-zone-name=\"trust\" destination-zone-name=\"junos-host\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\".local..0\" encrypted=\"No\" reason=\"Denied by policy\" session-id-32=\"7087\" application-category=\"N/A\" application-sub-category=\"N/A\" application-risk=\"1\" application-characteristics=\"N/A\"", + "event.outcome": "success", + "event.risk_score": "1", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.connection_tag": "0", + "juniper.srx.encrypted": "No", + "juniper.srx.icmp_type": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "Denied by policy", + "juniper.srx.session_id_32": "7087", + "juniper.srx.tag": "RT_FLOW_SESSION_DENY", + "log.level": "informational", + "log.offset": 850, + "network.iana_number": "17", + "observer.egress.zone": "junos-host", + "observer.ingress.interface.name": ".local..0", + "observer.ingress.zone": "trust", + "observer.name": "SRX-GW1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.0.0.26", + "10.128.0.1" + ], + "rule.name": "MgmtAccess-trust-cleanup", + "server.ip": "10.128.0.1", + "server.port": 161, + "service.type": "juniper", + "source.ip": "10.0.0.26", + "source.port": 37233, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2014-05-01T06:26:51.179-02:00", + "client.ip": "1.2.3.4", + "client.port": 56639, + "destination.as.number": 6805, + "destination.as.organization.name": "Telefonica Germany", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", + "destination.geo.location.lat": 51.2993, + "destination.geo.location.lon": 9.491, + "destination.ip": "5.6.7.8", + "destination.port": 2003, + "event.action": "flow_deny", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"1.2.3.4\" source-port=\"56639\" destination-address=\"5.6.7.8\" destination-port=\"2003\" service-name=\"None\" protocol-id=\"6\" icmp-type=\"0\" policy-name=\"log-all-else\" source-zone-name=\"campus\" destination-zone-name=\"mngmt\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth6.0\" encrypted=\"No \"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.encrypted": "No ", + "juniper.srx.icmp_type": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.tag": "RT_FLOW_SESSION_DENY", + "log.level": "informational", + "log.offset": 1513, + "network.iana_number": "6", + "observer.egress.zone": "mngmt", + "observer.ingress.interface.name": "reth6.0", + "observer.ingress.zone": "campus", + "observer.name": "fw01", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "1.2.3.4", + "5.6.7.8" + ], + "rule.name": "log-all-else", + "server.ip": "5.6.7.8", + "server.port": 2003, + "service.type": "juniper", + "source.geo.city_name": "Moscow", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", + "source.geo.location.lat": 55.7527, + "source.geo.location.lon": 37.6172, + "source.geo.region_iso_code": "RU-MOW", + "source.geo.region_name": "Moscow", + "source.ip": "1.2.3.4", + "source.port": 56639, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2014-05-01T06:28:10.933-02:00", + "client.bytes": 94, + "client.ip": "1.2.3.4", + "client.nat.port": 63456, + "client.packets": 1, + "client.port": 63456, + "destination.as.number": 6805, + "destination.as.organization.name": "Telefonica Germany", + "destination.bytes": 0, + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", + "destination.geo.location.lat": 51.2993, + "destination.geo.location.lon": 9.491, + "destination.ip": "5.6.7.8", + "destination.nat.ip": "5.6.7.8", + "destination.nat.port": 902, + "destination.packets": 0, + "destination.port": 902, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 60000000000, + "event.end": "2014-05-01T06:29:10.933-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"unset\" source-address=\"1.2.3.4\" source-port=\"63456\" destination-address=\"5.6.7.8\" destination-port=\"902\" service-name=\"None\" nat-source-address=\"1.2.3.4\" nat-source-port=\"63456\" nat-destination-address=\"5.6.7.8\" nat-destination-port=\"902\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"17\" policy-name=\"mngmt-to-vcenter\" source-zone-name=\"mngmt\" destination-zone-name=\"intra\" session-id-32=\"15353\" packets-from-client=\"1\" bytes-from-client=\"94\" packets-from-server=\"0\" bytes-from-server=\"0\" elapsed-time=\"60\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth3.5\" encrypted=\"No \"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2014-05-01T06:28:10.933-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.encrypted": "No ", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "unset", + "juniper.srx.session_id_32": "15353", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 1966, + "network.bytes": 94, + "network.iana_number": "17", + "network.packets": 1, + "observer.egress.zone": "intra", + "observer.ingress.interface.name": "reth3.5", + "observer.ingress.zone": "mngmt", + "observer.name": "fw01", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "1.2.3.4", + "5.6.7.8", + "1.2.3.4", + "5.6.7.8" + ], + "rule.name": "mngmt-to-vcenter", + "server.bytes": 0, + "server.ip": "5.6.7.8", + "server.nat.port": 902, + "server.packets": 0, + "server.port": 902, + "service.type": "juniper", + "source.bytes": 94, + "source.geo.city_name": "Moscow", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", + "source.geo.location.lat": 55.7527, + "source.geo.location.lon": 37.6172, + "source.geo.region_iso_code": "RU-MOW", + "source.geo.region_name": "Moscow", + "source.ip": "1.2.3.4", + "source.nat.ip": "1.2.3.4", + "source.nat.port": 63456, + "source.packets": 1, + "source.port": 63456, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-11-04T14:23:09.264-02:00", + "client.ip": "50.0.0.100", + "client.nat.port": 24065, + "client.port": 24065, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "30.0.0.100", + "destination.nat.ip": "30.0.0.100", + "destination.nat.port": 768, + "destination.port": 768, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"50.0.0.100\" source-port=\"24065\" destination-address=\"30.0.0.100\" destination-port=\"768\" service-name=\"icmp\" nat-source-address=\"50.0.0.100\" nat-source-port=\"24065\" nat-destination-address=\"30.0.0.100\" nat-destination-port=\"768\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"1\" policy-name=\"alg-policy\" source-zone-name=\"untrust\" destination-zone-name=\"trust\" session-id-32=\"100000165\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth2.0\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" encrypted=\"UNKNOWN\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "icmp", + "juniper.srx.session_id_32": "100000165", + "juniper.srx.tag": "RT_FLOW_SESSION_CREATE", + "log.level": "informational", + "log.offset": 2721, + "network.iana_number": "1", + "observer.egress.zone": "trust", + "observer.ingress.interface.name": "reth2.0", + "observer.ingress.zone": "untrust", + "observer.name": "cixi", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "50.0.0.100", + "30.0.0.100", + "50.0.0.100", + "30.0.0.100" + ], + "rule.name": "alg-policy", + "server.ip": "30.0.0.100", + "server.nat.port": 768, + "server.port": 768, + "service.type": "juniper", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "50.0.0.100", + "source.nat.ip": "50.0.0.100", + "source.nat.port": 24065, + "source.port": 24065, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2010-09-30T04:55:04.323-02:00", + "client.ip": "192.0.2.1", + "client.nat.port": 1, + "client.port": 1, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "198.51.100.12", + "destination.nat.ip": "18.51.100.12", + "destination.nat.port": 46384, + "destination.port": 46384, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"192.0.2.1\" source-port=\"1\" destination-address=\"198.51.100.12\" destination-port=\"46384\" service-name=\"icmp\" nat-source-address=\"192.0.2.1\" nat-source-port=\"1\" nat-destination-address=\"18.51.100.12\" nat-destination-port=\"46384\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"1\" policy-name=\"policy1\" source-zone-name=\"trustZone\" destination-zone-name=\"untrustZone\" session-id-32=\"41\" packet-incoming-interface=\"ge-0/0/1.0\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "icmp", + "juniper.srx.session_id_32": "41", + "juniper.srx.tag": "RT_FLOW_SESSION_CREATE", + "log.level": "informational", + "log.offset": 3366, + "network.iana_number": "1", + "observer.egress.zone": "untrustZone", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "mrpp-srx550-dut01", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.0.2.1", + "198.51.100.12", + "192.0.2.1", + "18.51.100.12" + ], + "rule.name": "policy1", + "server.ip": "198.51.100.12", + "server.nat.port": 46384, + "server.port": 46384, + "service.type": "juniper", + "source.ip": "192.0.2.1", + "source.nat.ip": "192.0.2.1", + "source.nat.port": 1, + "source.port": 1, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2010-09-30T04:55:07.188-02:00", + "client.bytes": 84, + "client.ip": "192.0.2.1", + "client.nat.port": 1, + "client.packets": 1, + "client.port": 1, + "destination.bytes": 84, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "198.51.100.12", + "destination.nat.ip": "18.51.100.12", + "destination.nat.port": 46384, + "destination.packets": 1, + "destination.port": 46384, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2010-09-30T04:55:07.188-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"response received\" source-address=\"192.0.2.1\" source-port=\"1\" destination-address=\"198.51.100.12\" destination-port=\"46384\" service-name=\"icmp\" nat-source-address=\"192.0.2.1\" nat-source-port=\"1\" nat-destination-address=\"18.51.100.12\" nat-destination-port=\"46384\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"1\" policy-name=\"policy1\" source-zone-name=\"trustZone\" destination-zone-name=\"untrustZone\" session-id-32=\"41\" packets-from-client=\"1\" bytes-from-client=\"84\" packets-from-server=\"1\" bytes-from-server=\"84\" elapsed-time=\"0\" packet-incoming-interface=\"ge-0/0/1.0\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2010-09-30T04:55:07.188-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "response received", + "juniper.srx.service_name": "icmp", + "juniper.srx.session_id_32": "41", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 3933, + "network.bytes": 168, + "network.iana_number": "1", + "network.packets": 2, + "observer.egress.zone": "untrustZone", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "mrpp-srx550-dut01", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.0.2.1", + "198.51.100.12", + "192.0.2.1", + "18.51.100.12" + ], + "rule.name": "policy1", + "server.bytes": 84, + "server.ip": "198.51.100.12", + "server.nat.port": 46384, + "server.packets": 1, + "server.port": 46384, + "service.type": "juniper", + "source.bytes": 84, + "source.ip": "192.0.2.1", + "source.nat.ip": "192.0.2.1", + "source.nat.port": 1, + "source.packets": 1, + "source.port": 1, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-12T12:29:06.576-02:00", + "client.bytes": 337, + "client.ip": "10.3.255.203", + "client.nat.port": 19162, + "client.packets": 6, + "client.port": 47776, + "destination.as.number": 14627, + "destination.as.organization.name": "Vitalwerks Internet Solutions, LLC", + "destination.bytes": 535, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "8.23.224.110", + "destination.nat.ip": "8.23.224.110", + "destination.nat.port": 80, + "destination.packets": 4, + "destination.port": 80, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 1000000000, + "event.end": "2019-04-12T12:29:07.576-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"TCP FIN\" source-address=\"10.3.255.203\" source-port=\"47776\" destination-address=\"8.23.224.110\" destination-port=\"80\" connection-tag=\"0\" service-name=\"junos-http\" nat-source-address=\"10.3.136.49\" nat-source-port=\"19162\" nat-destination-address=\"8.23.224.110\" nat-destination-port=\"80\" nat-connection-tag=\"0\" src-nat-rule-type=\"source rule\" src-nat-rule-name=\"nat1\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"permit_all\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"5\" packets-from-client=\"6\" bytes-from-client=\"337\" packets-from-server=\"4\" bytes-from-server=\"535\" elapsed-time=\"1\" application=\"HTTP\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"ge-0/0/0.0\" encrypted=\"No\" application-category=\"Web\" application-sub-category=\"N/A\" application-risk=\"4\" application-characteristics=\"Can Leak Information;Supports File Transfer;Prone to Misuse;Known Vulnerabilities;Carrier of Malware;Capable of Tunneling;\"", + "event.outcome": "success", + "event.risk_score": "4", + "event.severity": "14", + "event.start": "2019-04-12T12:29:06.576-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.application": "HTTP", + "juniper.srx.application_category": "Web", + "juniper.srx.application_characteristics": "Can Leak Information;Supports File Transfer;Prone to Misuse;Known Vulnerabilities;Carrier of Malware;Capable of Tunneling;", + "juniper.srx.connection_tag": "0", + "juniper.srx.encrypted": "No", + "juniper.srx.nat_connection_tag": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "TCP FIN", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "5", + "juniper.srx.src_nat_rule_name": "nat1", + "juniper.srx.src_nat_rule_type": "source rule", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 4637, + "network.bytes": 872, + "network.iana_number": "6", + "network.packets": 10, + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "ge-0/0/0.0", + "observer.ingress.zone": "trust", + "observer.name": "cixi", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.3.255.203", + "8.23.224.110", + "10.3.136.49", + "8.23.224.110" + ], + "rule.name": "permit_all", + "server.bytes": 535, + "server.ip": "8.23.224.110", + "server.nat.port": 80, + "server.packets": 4, + "server.port": 80, + "service.type": "juniper", + "source.bytes": 337, + "source.ip": "10.3.255.203", + "source.nat.ip": "10.3.136.49", + "source.nat.port": 19162, + "source.packets": 6, + "source.port": 47776, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2019-04-13T12:33:06.576-02:00", + "client.bytes": 4274, + "client.ip": "192.168.2.164", + "client.nat.port": 53232, + "client.packets": 13, + "client.port": 53232, + "destination.bytes": 1575, + "destination.ip": "172.16.1.19", + "destination.nat.ip": "172.16.1.19", + "destination.nat.port": 445, + "destination.packets": 9, + "destination.port": 445, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 16000000000, + "event.end": "2019-04-13T12:33:22.576-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"TCP RST\" source-address=\"192.168.2.164\" source-port=\"53232\" destination-address=\"172.16.1.19\" destination-port=\"445\" service-name=\"junos-smb\" nat-source-address=\"192.168.2.164\" nat-source-port=\"53232\" nat-destination-address=\"172.16.1.19\" nat-destination-port=\"445\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"35\" source-zone-name=\"Trust\" destination-zone-name=\"Trust\" session-id-32=\"206\" packets-from-client=\"13\" bytes-from-client=\"4274\" packets-from-server=\"9\" bytes-from-server=\"1575\" elapsed-time=\"16\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"ge-0/0/2.0\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2019-04-13T12:33:06.576-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "TCP RST", + "juniper.srx.service_name": "junos-smb", + "juniper.srx.session_id_32": "206", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 5739, + "network.bytes": 5849, + "network.iana_number": "6", + "network.packets": 22, + "observer.egress.zone": "Trust", + "observer.ingress.interface.name": "ge-0/0/2.0", + "observer.ingress.zone": "Trust", + "observer.name": "cixi", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.2.164", + "172.16.1.19", + "192.168.2.164", + "172.16.1.19" + ], + "rule.name": "35", + "server.bytes": 1575, + "server.ip": "172.16.1.19", + "server.nat.port": 445, + "server.packets": 9, + "server.port": 445, + "service.type": "juniper", + "source.bytes": 4274, + "source.ip": "192.168.2.164", + "source.nat.ip": "192.168.2.164", + "source.nat.port": 53232, + "source.packets": 13, + "source.port": 53232, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-10-06T23:32:20.898-02:00", + "client.bytes": 72, + "client.ip": "100.73.10.92", + "client.nat.port": 11152, + "client.packets": 1, + "client.port": 52890, + "destination.as.number": 10201, + "destination.as.organization.name": "Dishnet Wireless Limited. Broadband Wireless", + "destination.bytes": 136, + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "IN", + "destination.geo.country_name": "India", + "destination.geo.location.lat": 20.0, + "destination.geo.location.lon": 77.0, + "destination.ip": "58.68.126.198", + "destination.nat.ip": "58.68.126.198", + "destination.nat.port": 53, + "destination.packets": 1, + "destination.port": 53, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 8000000000, + "event.end": "2018-10-06T23:32:28.898-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"idle Timeout\" source-address=\"100.73.10.92\" source-port=\"52890\" destination-address=\"58.68.126.198\" destination-port=\"53\" service-name=\"junos-dns-udp\" nat-source-address=\"58.78.140.131\" nat-source-port=\"11152\" nat-destination-address=\"58.68.126.198\" nat-destination-port=\"53\" src-nat-rule-type=\"source rule\" src-nat-rule-name=\"NAT_S\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"17\" policy-name=\"NAT\" source-zone-name=\"Gi_nat\" destination-zone-name=\"Internet\" session-id-32=\"220368889\" packets-from-client=\"1\" bytes-from-client=\"72\" packets-from-server=\"1\" bytes-from-server=\"136\" elapsed-time=\"8\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth0.108\" encrypted=\"UNKNOWN\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2018-10-06T23:32:20.898-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "idle Timeout", + "juniper.srx.service_name": "junos-dns-udp", + "juniper.srx.session_id_32": "220368889", + "juniper.srx.src_nat_rule_name": "NAT_S", + "juniper.srx.src_nat_rule_type": "source rule", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 6497, + "network.bytes": 208, + "network.iana_number": "17", + "network.packets": 2, + "observer.egress.zone": "Internet", + "observer.ingress.interface.name": "reth0.108", + "observer.ingress.zone": "Gi_nat", + "observer.name": "TestFW2", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "100.73.10.92", + "58.68.126.198", + "58.78.140.131", + "58.68.126.198" + ], + "rule.name": "NAT", + "server.bytes": 136, + "server.ip": "58.68.126.198", + "server.nat.port": 53, + "server.packets": 1, + "server.port": 53, + "service.type": "juniper", + "source.as.number": 3786, + "source.as.organization.name": "LG DACOM Corporation", + "source.bytes": 72, + "source.geo.city_name": "Seogwipo", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "KR", + "source.geo.country_name": "South Korea", + "source.geo.location.lat": 33.2486, + "source.geo.location.lon": 126.5628, + "source.geo.region_iso_code": "KR-49", + "source.geo.region_name": "Jeju-do", + "source.ip": "100.73.10.92", + "source.nat.ip": "58.78.140.131", + "source.nat.port": 11152, + "source.packets": 1, + "source.port": 52890, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-06-30T00:17:22.753-02:00", + "client.bytes": 67, + "client.ip": "192.168.255.2", + "client.nat.port": 20215, + "client.packets": 1, + "client.port": 62047, + "destination.as.number": 15169, + "destination.as.organization.name": "Google LLC", + "destination.bytes": 116, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "8.8.8.8", + "destination.nat.ip": "8.8.8.8", + "destination.nat.port": 53, + "destination.packets": 1, + "destination.port": 53, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 3000000000, + "event.end": "2018-06-30T00:17:25.753-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"idle Timeout\" source-address=\"192.168.255.2\" source-port=\"62047\" destination-address=\"8.8.8.8\" destination-port=\"53\" service-name=\"junos-dns-udp\" nat-source-address=\"192.168.0.47\" nat-source-port=\"20215\" nat-destination-address=\"8.8.8.8\" nat-destination-port=\"53\" src-nat-rule-type=\"source rule\" src-nat-rule-name=\"rule001\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"17\" policy-name=\"trust-to-untrust-001\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"9621\" packets-from-client=\"1\" bytes-from-client=\"67\" packets-from-server=\"1\" bytes-from-server=\"116\" elapsed-time=\"3\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"fe-0/0/1.0\" encrypted=\"UNKNOWN\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2018-06-30T00:17:22.753-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "idle Timeout", + "juniper.srx.service_name": "junos-dns-udp", + "juniper.srx.session_id_32": "9621", + "juniper.srx.src_nat_rule_name": "rule001", + "juniper.srx.src_nat_rule_type": "source rule", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 7350, + "network.bytes": 183, + "network.iana_number": "17", + "network.packets": 2, + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "fe-0/0/1.0", + "observer.ingress.zone": "trust", + "observer.name": "fw0001", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.255.2", + "8.8.8.8", + "192.168.0.47", + "8.8.8.8" + ], + "rule.name": "trust-to-untrust-001", + "server.bytes": 116, + "server.ip": "8.8.8.8", + "server.nat.port": 53, + "server.packets": 1, + "server.port": 53, + "service.type": "juniper", + "source.bytes": 67, + "source.ip": "192.168.255.2", + "source.nat.ip": "192.168.0.47", + "source.nat.port": 20215, + "source.packets": 1, + "source.port": 62047, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2015-09-25T12:19:53.846-02:00", + "client.bytes": 0, + "client.ip": "10.164.110.223", + "client.nat.port": 58020, + "client.packets": 0, + "client.port": 9057, + "destination.bytes": 0, + "destination.ip": "10.104.12.161", + "destination.nat.ip": "10.12.70.1", + "destination.nat.port": 21, + "destination.packets": 0, + "destination.port": 21, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 1000000000, + "event.end": "2015-09-25T12:19:54.846-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"application failure or action\" source-address=\"10.164.110.223\" source-port=\"9057\" destination-address=\"10.104.12.161\" destination-port=\"21\" service-name=\"junos-ftp\" nat-source-address=\"10.9.1.150\" nat-source-port=\"58020\" nat-destination-address=\"10.12.70.1\" nat-destination-port=\"21\" src-nat-rule-name=\"SNAT-Policy5\" dst-nat-rule-name=\"NAT-Policy10\" protocol-id=\"6\" policy-name=\"FW-FTP\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"24311\" packets-from-client=\"0\" bytes-from-client=\"0\" packets-from-server=\"0\" bytes-from-server=\"0\" elapsed-time=\"1\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth0.0\" encrypted=\"No \"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2015-09-25T12:19:53.846-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.dst_nat_rule_name": "NAT-Policy10", + "juniper.srx.encrypted": "No ", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "application failure or action", + "juniper.srx.service_name": "junos-ftp", + "juniper.srx.session_id_32": "24311", + "juniper.srx.src_nat_rule_name": "SNAT-Policy5", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 8203, + "network.bytes": 0, + "network.iana_number": "6", + "network.packets": 0, + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "reth0.0", + "observer.ingress.zone": "trust", + "observer.name": "VPNBox-A", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.164.110.223", + "10.104.12.161", + "10.9.1.150", + "10.12.70.1" + ], + "rule.name": "FW-FTP", + "server.bytes": 0, + "server.ip": "10.104.12.161", + "server.nat.port": 21, + "server.packets": 0, + "server.port": 21, + "service.type": "juniper", + "source.bytes": 0, + "source.ip": "10.164.110.223", + "source.nat.ip": "10.9.1.150", + "source.nat.port": 58020, + "source.packets": 0, + "source.port": 9057, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:17.040-02:00", + "client.ip": "192.168.224.30", + "client.nat.port": 14406, + "client.port": 3129, + "destination.as.number": 701, + "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "207.17.137.56", + "destination.nat.ip": "207.17.137.56", + "destination.nat.port": 21, + "destination.port": 21, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"192.168.224.30\" source-port=\"3129\" destination-address=\"207.17.137.56\" destination-port=\"21\" service-name=\"junos-ftp\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"173.167.224.7\" nat-source-port=\"14406\" nat-destination-address=\"207.17.137.56\" nat-destination-port=\"21\" src-nat-rule-name=\"1\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"General-Outbound\" source-zone-name=\"LAN\" destination-zone-name=\"Danger\" session-id-32=\"5058\" username=\"N/A\" roles=\"N/A\" encrypted=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "junos-ftp", + "juniper.srx.session_id_32": "5058", + "juniper.srx.src_nat_rule_name": "1", + "juniper.srx.tag": "APPTRACK_SESSION_CREATE", + "log.level": "informational", + "log.offset": 9012, + "network.iana_number": "6", + "observer.egress.zone": "Danger", + "observer.ingress.zone": "LAN", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.224.30", + "207.17.137.56", + "173.167.224.7", + "207.17.137.56" + ], + "rule.name": "General-Outbound", + "server.ip": "207.17.137.56", + "server.nat.port": 21, + "server.port": 21, + "service.type": "juniper", + "source.as.number": 7922, + "source.as.organization.name": "Comcast Cable Communications, LLC", + "source.geo.city_name": "Plymouth", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 42.3695, + "source.geo.location.lon": -83.4769, + "source.geo.region_iso_code": "US-MI", + "source.geo.region_name": "Michigan", + "source.ip": "192.168.224.30", + "source.nat.ip": "173.167.224.7", + "source.nat.port": 14406, + "source.port": 3129, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:17.040-02:00", + "client.bytes": 48, + "client.ip": "192.168.224.30", + "client.nat.port": 14406, + "client.packets": 1, + "client.port": 3129, + "destination.as.number": 701, + "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", + "destination.bytes": 0, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "207.17.137.56", + "destination.nat.ip": "207.17.137.56", + "destination.nat.port": 21, + "destination.packets": 0, + "destination.port": 21, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2013-01-19T15:18:17.040-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"192.168.224.30\" source-port=\"3129\" destination-address=\"207.17.137.56\" destination-port=\"21\" service-name=\"junos-ftp\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"173.167.224.7\" nat-source-port=\"14406\" nat-destination-address=\"207.17.137.56\" nat-destination-port=\"21\" src-nat-rule-name=\"1\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"General-Outbound\" source-zone-name=\"LAN\" destination-zone-name=\"Danger\" session-id-32=\"5058\" packets-from-client=\"1\" bytes-from-client=\"48\" packets-from-server=\"0\" bytes-from-server=\"0\" elapsed-time=\"0\" username=\"N/A\" roles=\"N/A\" encrypted=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2013-01-19T15:18:17.040-02:00", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "junos-ftp", + "juniper.srx.session_id_32": "5058", + "juniper.srx.src_nat_rule_name": "1", + "juniper.srx.tag": "APPTRACK_SESSION_VOL_UPDATE", + "log.level": "informational", + "log.offset": 9631, + "network.bytes": 48, + "network.iana_number": "6", + "network.packets": 1, + "observer.egress.zone": "Danger", + "observer.ingress.zone": "LAN", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.224.30", + "207.17.137.56", + "173.167.224.7", + "207.17.137.56" + ], + "rule.name": "General-Outbound", + "server.bytes": 0, + "server.ip": "207.17.137.56", + "server.nat.port": 21, + "server.packets": 0, + "server.port": 21, + "service.type": "juniper", + "source.as.number": 7922, + "source.as.organization.name": "Comcast Cable Communications, LLC", + "source.bytes": 48, + "source.geo.city_name": "Plymouth", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 42.3695, + "source.geo.location.lon": -83.4769, + "source.geo.region_iso_code": "US-MI", + "source.geo.region_name": "Michigan", + "source.ip": "192.168.224.30", + "source.nat.ip": "173.167.224.7", + "source.nat.port": 14406, + "source.packets": 1, + "source.port": 3129, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:17.040-02:00", + "client.bytes": 144, + "client.ip": "192.168.224.30", + "client.nat.port": 14406, + "client.packets": 3, + "client.port": 3129, + "destination.as.number": 701, + "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", + "destination.bytes": 104, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "207.17.137.56", + "destination.nat.ip": "207.17.137.56", + "destination.nat.port": 21, + "destination.packets": 2, + "destination.port": 21, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 1000000000, + "event.end": "2013-01-19T15:18:18.040-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"application failure or action\" source-address=\"192.168.224.30\" source-port=\"3129\" destination-address=\"207.17.137.56\" destination-port=\"21\" service-name=\"junos-ftp\" application=\"FTP\" nested-application=\"UNKNOWN\" nat-source-address=\"173.167.224.7\" nat-source-port=\"14406\" nat-destination-address=\"207.17.137.56\" nat-destination-port=\"21\" src-nat-rule-name=\"1\" dst-nat-rule-name=\"None\" protocol-id=\"6\" policy-name=\"General-Outbound\" source-zone-name=\"LAN\" destination-zone-name=\"Danger\" session-id-32=\"5058\" packets-from-client=\"3\" bytes-from-client=\"144\" packets-from-server=\"2\" bytes-from-server=\"104\" elapsed-time=\"1\" username=\"N/A\" roles=\"N/A\" encrypted=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2013-01-19T15:18:17.040-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.application": "FTP", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "application failure or action", + "juniper.srx.service_name": "junos-ftp", + "juniper.srx.session_id_32": "5058", + "juniper.srx.src_nat_rule_name": "1", + "juniper.srx.tag": "APPTRACK_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 10364, + "network.bytes": 248, + "network.iana_number": "6", + "network.packets": 5, + "observer.egress.zone": "Danger", + "observer.ingress.zone": "LAN", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.224.30", + "207.17.137.56", + "173.167.224.7", + "207.17.137.56" + ], + "rule.name": "General-Outbound", + "server.bytes": 104, + "server.ip": "207.17.137.56", + "server.nat.port": 21, + "server.packets": 2, + "server.port": 21, + "service.type": "juniper", + "source.as.number": 7922, + "source.as.organization.name": "Comcast Cable Communications, LLC", + "source.bytes": 144, + "source.geo.city_name": "Plymouth", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 42.3695, + "source.geo.location.lon": -83.4769, + "source.geo.region_iso_code": "US-MI", + "source.geo.region_name": "Michigan", + "source.ip": "192.168.224.30", + "source.nat.ip": "173.167.224.7", + "source.nat.port": 14406, + "source.packets": 3, + "source.port": 3129, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:18.040-02:00", + "client.bytes": 19592, + "client.ip": "4.0.0.1", + "client.nat.port": 33040, + "client.packets": 371, + "client.port": 33040, + "destination.as.number": 29256, + "destination.as.organization.name": "Syrian Telecom", + "destination.bytes": 686432, + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "SY", + "destination.geo.country_name": "Syria", + "destination.geo.location.lat": 35.0, + "destination.geo.location.lon": 38.0, + "destination.ip": "5.0.0.1", + "destination.nat.ip": "5.0.0.1", + "destination.nat.port": 80, + "destination.packets": 584, + "destination.port": 80, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 60000000000, + "event.end": "2013-01-19T15:19:18.040-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"4.0.0.1\" source-port=\"33040\" destination-address=\"5.0.0.1\" destination-port=\"80\" service-name=\"junos-http\" application=\"HTTP\" nested-application=\"FACEBOOK-SOCIALRSS\" nat-source-address=\"4.0.0.1\" nat-source-port=\"33040\" nat-destination-address=\"5.0.0.1\" nat-destination-port=\"80\" src-nat-rule-name=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"permit-all\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"28\" packets-from-client=\"371\" bytes-from-client=\"19592\" packets-from-server=\"584\" bytes-from-server=\"686432\" elapsed-time=\"60\" username=\"user1\" roles=\"DEPT1\" encrypted=\"No\" destination-interface-name=\u201dst0.0\u201d apbr-rule-type=\u201ddefault\u201d", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2013-01-19T15:18:18.040-02:00", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.apbr_rule_type": "\u201ddefault\u201d", + "juniper.srx.application": "HTTP", + "juniper.srx.encrypted": "No", + "juniper.srx.nested_application": "FACEBOOK-SOCIALRSS", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.roles": "DEPT1", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "28", + "juniper.srx.tag": "APPTRACK_SESSION_VOL_UPDATE", + "log.level": "informational", + "log.offset": 11130, + "network.bytes": 706024, + "network.iana_number": "6", + "network.packets": 955, + "observer.egress.interface.name": "\u201dst0.0\u201d", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "4.0.0.1", + "5.0.0.1", + "4.0.0.1", + "5.0.0.1" + ], + "rule.name": "permit-all", + "server.bytes": 686432, + "server.ip": "5.0.0.1", + "server.nat.port": 80, + "server.packets": 584, + "server.port": 80, + "service.type": "juniper", + "source.as.number": 3356, + "source.as.organization.name": "Level 3 Parent, LLC", + "source.bytes": 19592, + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "4.0.0.1", + "source.nat.ip": "4.0.0.1", + "source.nat.port": 33040, + "source.packets": 371, + "source.port": 33040, + "source.user.name": "user1", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:19.040-02:00", + "client.ip": "4.0.0.1", + "client.nat.port": 33040, + "client.port": 33040, + "destination.as.number": 29256, + "destination.as.organization.name": "Syrian Telecom", + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "SY", + "destination.geo.country_name": "Syria", + "destination.geo.location.lat": 35.0, + "destination.geo.location.lon": 38.0, + "destination.ip": "5.0.0.1", + "destination.nat.ip": "5.0.0.1", + "destination.nat.port": 80, + "destination.port": 80, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"4.0.0.1\" source-port=\"33040\" destination-address=\"5.0.0.1\" destination-port=\"80\" service-name=\"junos-http\" application=\"HTTP\" nested-application=\"FACEBOOK-SOCIALRSS\" nat-source-address=\"4.0.0.1\" nat-source-port=\"33040\" nat-destination-address=\"5.0.0.1\" nat-destination-port=\"80\" src-nat-rule-name=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"permit-all\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"28\" username=\"user1\" roles=\"DEPT1\" encrypted=\"No\" profile-name=\u201dpf1\u201d rule-name=\u201dfacebook1\u201d routing-instance=\u201dinstance1\u201d destination-interface-name=\u201dst0.0\u201d apbr-rule-type=\u201ddefault\u201d", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.apbr_rule_type": "\u201ddefault\u201d", + "juniper.srx.application": "HTTP", + "juniper.srx.encrypted": "No", + "juniper.srx.nested_application": "FACEBOOK-SOCIALRSS", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.profile_name": "\u201dpf1\u201d", + "juniper.srx.roles": "DEPT1", + "juniper.srx.routing_instance": "\u201dinstance1\u201d", + "juniper.srx.rule_name": "\u201dfacebook1\u201d", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "28", + "juniper.srx.tag": "APPTRACK_SESSION_ROUTE_UPDATE", + "log.level": "informational", + "log.offset": 11929, + "network.iana_number": "6", + "observer.egress.interface.name": "\u201dst0.0\u201d", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "4.0.0.1", + "5.0.0.1", + "4.0.0.1", + "5.0.0.1" + ], + "rule.name": "permit-all", + "server.ip": "5.0.0.1", + "server.nat.port": 80, + "server.port": 80, + "service.type": "juniper", + "source.as.number": 3356, + "source.as.organization.name": "Level 3 Parent, LLC", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "4.0.0.1", + "source.nat.ip": "4.0.0.1", + "source.nat.port": 33040, + "source.port": 33040, + "source.user.name": "user1", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2013-01-19T15:18:20.040-02:00", + "client.bytes": 392, + "client.ip": "4.0.0.1", + "client.nat.port": 48873, + "client.packets": 5, + "client.port": 48873, + "destination.as.number": 29256, + "destination.as.organization.name": "Syrian Telecom", + "destination.bytes": 646, + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "SY", + "destination.geo.country_name": "Syria", + "destination.geo.location.lat": 35.0, + "destination.geo.location.lon": 38.0, + "destination.ip": "5.0.0.1", + "destination.nat.ip": "5.0.0.1", + "destination.nat.port": 80, + "destination.packets": 3, + "destination.port": 80, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 3000000000, + "event.end": "2013-01-19T15:18:23.040-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"TCP CLIENT RST\" source-address=\"4.0.0.1\" source-port=\"48873\" destination-address=\"5.0.0.1\" destination-port=\"80\" service-name=\"junos-http\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"4.0.0.1\" nat-source-port=\"48873\" nat-destination-address=\"5.0.0.1\" nat-destination-port=\"80\" src-nat-rule-name=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"permit-all\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"32\" packets-from-client=\"5\" bytes-from-client=\"392\" packets-from-server=\"3\" bytes-from-server=\"646\" elapsed-time=\"3\" username=\"user1\" roles=\"DEPT1\" encrypted=\"No\" destination-interface-name=\u201dst0.0\u201d apbr-rule-type=\u201ddefault\u201d", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2013-01-19T15:18:20.040-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.apbr_rule_type": "\u201ddefault\u201d", + "juniper.srx.encrypted": "No", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "TCP CLIENT RST", + "juniper.srx.roles": "DEPT1", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "32", + "juniper.srx.tag": "APPTRACK_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 12689, + "network.bytes": 1038, + "network.iana_number": "6", + "network.packets": 8, + "observer.egress.interface.name": "\u201dst0.0\u201d", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "4.0.0.1", + "5.0.0.1", + "4.0.0.1", + "5.0.0.1" + ], + "rule.name": "permit-all", + "server.bytes": 646, + "server.ip": "5.0.0.1", + "server.nat.port": 80, + "server.packets": 3, + "server.port": 80, + "service.type": "juniper", + "source.as.number": 3356, + "source.as.organization.name": "Level 3 Parent, LLC", + "source.bytes": 392, + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "4.0.0.1", + "source.nat.ip": "4.0.0.1", + "source.nat.port": 48873, + "source.packets": 5, + "source.port": 48873, + "source.user.name": "user1", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-11-04T14:23:09.264-02:00", + "client.ip": "50.0.0.100", + "client.nat.port": 24065, + "client.port": 24065, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "30.0.0.100", + "destination.nat.ip": "30.0.0.100", + "destination.nat.port": 768, + "destination.port": 768, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"50.0.0.100\" source-port=\"24065\" destination-address=\"30.0.0.100\" destination-port=\"768\" service-name=\"icmp\" nat-source-address=\"50.0.0.100\" nat-source-port=\"24065\" nat-destination-address=\"30.0.0.100\" nat-destination-port=\"768\" src-nat-rule-name=\"None\" dst-nat-rule-name=\"None\" protocol-id=\"1\" policy-name=\"alg-policy\" source-zone-name=\"untrust\" destination-zone-name=\"trust\" session-id-32=\"100000165\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"reth2.0\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" encrypted=\"UNKNOWN\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "icmp", + "juniper.srx.session_id_32": "100000165", + "juniper.srx.tag": "RT_FLOW_SESSION_CREATE_LS", + "log.level": "informational", + "log.offset": 13489, + "network.iana_number": "1", + "observer.egress.zone": "trust", + "observer.ingress.interface.name": "reth2.0", + "observer.ingress.zone": "untrust", + "observer.name": "cixi", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "50.0.0.100", + "30.0.0.100", + "50.0.0.100", + "30.0.0.100" + ], + "rule.name": "alg-policy", + "server.ip": "30.0.0.100", + "server.nat.port": 768, + "server.port": 768, + "service.type": "juniper", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "50.0.0.100", + "source.nat.ip": "50.0.0.100", + "source.nat.port": 24065, + "source.port": 24065, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-11-14T08:12:46.573-02:00", + "client.ip": "10.0.0.26", + "client.port": 37233, + "destination.ip": "10.128.0.1", + "destination.port": 161, + "event.action": "flow_deny", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.0.0.26\" source-port=\"37233\" destination-address=\"10.128.0.1\" destination-port=\"161\" connection-tag=\"0\" service-name=\"None\" protocol-id=\"17\" icmp-type=\"0\" policy-name=\"MgmtAccess-trust-cleanup\" source-zone-name=\"trust\" destination-zone-name=\"junos-host\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\".local..0\" encrypted=\"No\" reason=\"Denied by policy\" session-id-32=\"7087\" application-category=\"N/A\" application-sub-category=\"N/A\" application-risk=\"1\" application-characteristics=\"N/A\"", + "event.outcome": "success", + "event.risk_score": "1", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.connection_tag": "0", + "juniper.srx.encrypted": "No", + "juniper.srx.icmp_type": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "Denied by policy", + "juniper.srx.session_id_32": "7087", + "juniper.srx.tag": "RT_FLOW_SESSION_DENY_LS", + "log.level": "informational", + "log.offset": 14137, + "network.iana_number": "17", + "observer.egress.zone": "junos-host", + "observer.ingress.interface.name": ".local..0", + "observer.ingress.zone": "trust", + "observer.name": "SRX-GW1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.0.0.26", + "10.128.0.1" + ], + "rule.name": "MgmtAccess-trust-cleanup", + "server.ip": "10.128.0.1", + "server.port": 161, + "service.type": "juniper", + "source.ip": "10.0.0.26", + "source.port": 37233, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-01-19T15:18:20.040-02:00", + "client.bytes": 392, + "client.ip": "4.0.0.1", + "client.nat.port": 48873, + "client.packets": 5, + "client.port": 48873, + "destination.as.number": 29256, + "destination.as.organization.name": "Syrian Telecom", + "destination.bytes": 646, + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "SY", + "destination.geo.country_name": "Syria", + "destination.geo.location.lat": 35.0, + "destination.geo.location.lon": 38.0, + "destination.ip": "5.0.0.1", + "destination.nat.ip": "5.0.0.1", + "destination.nat.port": 80, + "destination.packets": 3, + "destination.port": 80, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 3000000000, + "event.end": "2020-01-19T15:18:23.040-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"TCP CLIENT RST\" source-address=\"4.0.0.1\" source-port=\"48873\" destination-address=\"5.0.0.1\" destination-port=\"80\" service-name=\"junos-http\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"4.0.0.1\" nat-source-port=\"48873\" nat-destination-address=\"5.0.0.1\" nat-destination-port=\"80\" src-nat-rule-name=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"permit-all\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"32\" packets-from-client=\"5\" bytes-from-client=\"392\" packets-from-server=\"3\" bytes-from-server=\"646\" elapsed-time=\"3\" username=\"user1\" roles=\"DEPT1\" encrypted=\"No\" destination-interface-name=\u201dst0.0\u201d apbr-rule-type=\u201ddefault\u201d", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2020-01-19T15:18:20.040-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.apbr_rule_type": "\u201ddefault\u201d", + "juniper.srx.encrypted": "No", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "TCP CLIENT RST", + "juniper.srx.roles": "DEPT1", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "32", + "juniper.srx.tag": "APPTRACK_SESSION_CLOSE_LS", + "log.level": "informational", + "log.offset": 14803, + "network.bytes": 1038, + "network.iana_number": "6", + "network.packets": 8, + "observer.egress.interface.name": "\u201dst0.0\u201d", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "4.0.0.1", + "5.0.0.1", + "4.0.0.1", + "5.0.0.1" + ], + "rule.name": "permit-all", + "server.bytes": 646, + "server.ip": "5.0.0.1", + "server.nat.port": 80, + "server.packets": 3, + "server.port": 80, + "service.type": "juniper", + "source.as.number": 3356, + "source.as.organization.name": "Level 3 Parent, LLC", + "source.bytes": 392, + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "4.0.0.1", + "source.nat.ip": "4.0.0.1", + "source.nat.port": 48873, + "source.packets": 5, + "source.port": 48873, + "source.user.name": "user1", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-14T12:17:11.928-02:00", + "client.bytes": 2322, + "client.ip": "10.1.1.100", + "client.nat.port": 6018, + "client.packets": 42, + "client.port": 58943, + "destination.as.number": 42652, + "destination.as.organization.name": "inexio Informationstechnologie und Telekommunikation Gmbh", + "destination.bytes": 2132, + "destination.geo.city_name": "Philippsburg", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", + "destination.geo.location.lat": 49.2317, + "destination.geo.location.lon": 8.4607, + "destination.geo.region_iso_code": "DE-BW", + "destination.geo.region_name": "Baden-W\u00fcrttemberg", + "destination.ip": "46.165.154.241", + "destination.nat.ip": "46.165.154.241", + "destination.nat.port": 80, + "destination.packets": 34, + "destination.port": 80, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 60000000000, + "event.end": "2020-07-14T12:18:11.928-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.1.1.100\" source-port=\"58943\" destination-address=\"46.165.154.241\" destination-port=\"80\" service-name=\"junos-http\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"172.19.34.100\" nat-source-port=\"6018\" nat-destination-address=\"46.165.154.241\" nat-destination-port=\"80\" src-nat-rule-name=\"our-nat-rule\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"default-permit\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"16118\" packets-from-client=\"42\" bytes-from-client=\"2322\" packets-from-server=\"34\" bytes-from-server=\"2132\" elapsed-time=\"60\" username=\"N/A\" roles=\"N/A\" encrypted=\"No\" destination-interface-name=\"ge-0/0/0.0\" category=\"N/A\" sub-category=\"N/A\" src-vrf-grp=\"N/A\" dst-vrf-grp=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2020-07-14T12:17:11.928-02:00", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.encrypted": "No", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "junos-http", + "juniper.srx.session_id_32": "16118", + "juniper.srx.src_nat_rule_name": "our-nat-rule", + "juniper.srx.tag": "APPTRACK_SESSION_VOL_UPDATE", + "log.level": "informational", + "log.offset": 15606, + "network.bytes": 4454, + "network.iana_number": "6", + "network.packets": 76, + "observer.egress.interface.name": "ge-0/0/0.0", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "46.165.154.241", + "172.19.34.100", + "46.165.154.241" + ], + "rule.name": "default-permit", + "server.bytes": 2132, + "server.ip": "46.165.154.241", + "server.nat.port": 80, + "server.packets": 34, + "server.port": 80, + "service.type": "juniper", + "source.bytes": 2322, + "source.ip": "10.1.1.100", + "source.nat.ip": "172.19.34.100", + "source.nat.port": 6018, + "source.packets": 42, + "source.port": 58943, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-13T14:43:05.041-02:00", + "client.bytes": 9530, + "client.ip": "10.1.1.100", + "client.nat.port": 24519, + "client.packets": 161, + "client.port": 64720, + "destination.as.number": 50881, + "destination.as.organization.name": "ESET, spol. s r.o.", + "destination.bytes": 9670, + "destination.geo.city_name": "Bratislava", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "SK", + "destination.geo.country_name": "Slovakia", + "destination.geo.location.lat": 48.15, + "destination.geo.location.lon": 17.1078, + "destination.geo.region_iso_code": "SK-BL", + "destination.geo.region_name": "Bratislava", + "destination.ip": "91.228.167.172", + "destination.nat.ip": "91.228.167.172", + "destination.nat.port": 8883, + "destination.packets": 96, + "destination.port": 8883, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 23755000000000, + "event.end": "2020-07-13T21:19:00.041-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"idle Timeout\" source-address=\"10.1.1.100\" source-port=\"64720\" destination-address=\"91.228.167.172\" destination-port=\"8883\" connection-tag=\"0\" service-name=\"None\" nat-source-address=\"172.19.34.100\" nat-source-port=\"24519\" nat-destination-address=\"91.228.167.172\" nat-destination-port=\"8883\" nat-connection-tag=\"0\" src-nat-rule-type=\"source rule\" src-nat-rule-name=\"our-nat-rule\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"6\" policy-name=\"default-permit\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"3851\" packets-from-client=\"161\" bytes-from-client=\"9530\" packets-from-server=\"96\" bytes-from-server=\"9670\" elapsed-time=\"23755\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"ge-0/0/1.0\" encrypted=\"UNKNOWN\" application-category=\"N/A\" application-sub-category=\"N/A\" application-risk=\"1\" application-characteristics=\"N/A\" secure-web-proxy-session-type=\"NA\" peer-session-id=\"0\" peer-source-address=\"0.0.0.0\" peer-source-port=\"0\" peer-destination-address=\"0.0.0.0\" peer-destination-port=\"0\" hostname=\"NA NA\" src-vrf-grp=\"N/A\" dst-vrf-grp=\"N/A\"", + "event.outcome": "success", + "event.risk_score": "1", + "event.severity": "14", + "event.start": "2020-07-13T14:43:05.041-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.connection_tag": "0", + "juniper.srx.hostname": "NA NA", + "juniper.srx.nat_connection_tag": "0", + "juniper.srx.peer_destination_address": "0.0.0.0", + "juniper.srx.peer_destination_port": "0", + "juniper.srx.peer_session_id": "0", + "juniper.srx.peer_source_address": "0.0.0.0", + "juniper.srx.peer_source_port": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "idle Timeout", + "juniper.srx.secure_web_proxy_session_type": "NA", + "juniper.srx.session_id_32": "3851", + "juniper.srx.src_nat_rule_name": "our-nat-rule", + "juniper.srx.src_nat_rule_type": "source rule", + "juniper.srx.tag": "RT_FLOW_SESSION_CLOSE", + "log.level": "informational", + "log.offset": 16469, + "network.bytes": 19200, + "network.iana_number": "6", + "network.packets": 257, + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "91.228.167.172", + "172.19.34.100", + "91.228.167.172" + ], + "rule.name": "default-permit", + "server.bytes": 9670, + "server.ip": "91.228.167.172", + "server.nat.port": 8883, + "server.packets": 96, + "server.port": 8883, + "service.type": "juniper", + "source.bytes": 9530, + "source.ip": "10.1.1.100", + "source.nat.ip": "172.19.34.100", + "source.nat.port": 24519, + "source.packets": 161, + "source.port": 64720, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-13T14:12:05.530-02:00", + "client.ip": "10.1.1.100", + "client.nat.port": 30838, + "client.port": 49583, + "destination.as.number": 15169, + "destination.as.organization.name": "Google LLC", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "8.8.8.8", + "destination.nat.ip": "8.8.8.8", + "destination.nat.port": 53, + "destination.port": 53, + "event.action": "flow_started", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.1.1.100\" source-port=\"49583\" destination-address=\"8.8.8.8\" destination-port=\"53\" connection-tag=\"0\" service-name=\"junos-dns-udp\" nat-source-address=\"172.19.34.100\" nat-source-port=\"30838\" nat-destination-address=\"8.8.8.8\" nat-destination-port=\"53\" nat-connection-tag=\"0\" src-nat-rule-type=\"source rule\" src-nat-rule-name=\"our-nat-rule\" dst-nat-rule-type=\"N/A\" dst-nat-rule-name=\"N/A\" protocol-id=\"17\" policy-name=\"default-permit\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"15399\" username=\"N/A\" roles=\"N/A\" packet-incoming-interface=\"ge-0/0/1.0\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" encrypted=\"UNKNOWN\" application-category=\"N/A\" application-sub-category=\"N/A\" application-risk=\"1\" application-characteristics=\"N/A\" src-vrf-grp=\"N/A\" dst-vrf-grp=\"N/A\"", + "event.outcome": "success", + "event.risk_score": "1", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "start", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.connection_tag": "0", + "juniper.srx.nat_connection_tag": "0", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.service_name": "junos-dns-udp", + "juniper.srx.session_id_32": "15399", + "juniper.srx.src_nat_rule_name": "our-nat-rule", + "juniper.srx.src_nat_rule_type": "source rule", + "juniper.srx.tag": "RT_FLOW_SESSION_CREATE", + "log.level": "informational", + "log.offset": 17715, + "network.iana_number": "17", + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "8.8.8.8", + "172.19.34.100", + "8.8.8.8" + ], + "rule.name": "default-permit", + "server.ip": "8.8.8.8", + "server.nat.port": 53, + "server.port": 53, + "service.type": "juniper", + "source.ip": "10.1.1.100", + "source.nat.ip": "172.19.34.100", + "source.nat.port": 30838, + "source.port": 49583, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-13T14:12:05.530-02:00", + "client.bytes": 66, + "client.ip": "10.1.1.100", + "client.nat.port": 26764, + "client.packets": 1, + "client.port": 63381, + "destination.as.number": 15169, + "destination.as.organization.name": "Google LLC", + "destination.bytes": 82, + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "8.8.8.8", + "destination.nat.ip": "8.8.8.8", + "destination.nat.port": 53, + "destination.packets": 1, + "destination.port": 53, + "event.action": "flow_close", + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.duration": 3000000000, + "event.end": "2020-07-13T14:12:08.530-02:00", + "event.kind": "event", + "event.module": "juniper", + "event.original": "reason=\"Closed by junos-alg\" source-address=\"10.1.1.100\" source-port=\"63381\" destination-address=\"8.8.8.8\" destination-port=\"53\" service-name=\"junos-dns-udp\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" nat-source-address=\"172.19.34.100\" nat-source-port=\"26764\" nat-destination-address=\"8.8.8.8\" nat-destination-port=\"53\" src-nat-rule-name=\"our-nat-rule\" dst-nat-rule-name=\"N/A\" protocol-id=\"17\" policy-name=\"default-permit\" source-zone-name=\"trust\" destination-zone-name=\"untrust\" session-id-32=\"15361\" packets-from-client=\"1\" bytes-from-client=\"66\" packets-from-server=\"1\" bytes-from-server=\"82\" elapsed-time=\"3\" username=\"N/A\" roles=\"N/A\" encrypted=\"No\" profile-name=\"N/A\" rule-name=\"N/A\" routing-instance=\"default\" destination-interface-name=\"ge-0/0/0.0\" uplink-incoming-interface-name=\"N/A\" uplink-tx-bytes=\"0\" uplink-rx-bytes=\"0\" category=\"N/A\" sub-category=\"N/A\" apbr-policy-name=\"N/A\" multipath-rule-name=\"N/A\" src-vrf-grp=\"N/A\" dst-vrf-grp=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.start": "2020-07-13T14:12:05.530-02:00", + "event.timezone": "-02:00", + "event.type": [ + "end", + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.encrypted": "No", + "juniper.srx.process": "RT_FLOW", + "juniper.srx.reason": "Closed by junos-alg", + "juniper.srx.routing_instance": "default", + "juniper.srx.service_name": "junos-dns-udp", + "juniper.srx.session_id_32": "15361", + "juniper.srx.src_nat_rule_name": "our-nat-rule", + "juniper.srx.tag": "APPTRACK_SESSION_CLOSE", + "juniper.srx.uplink_rx_bytes": "0", + "juniper.srx.uplink_tx_bytes": "0", + "log.level": "informational", + "log.offset": 18627, + "network.bytes": 148, + "network.iana_number": "17", + "network.packets": 2, + "observer.egress.interface.name": "ge-0/0/0.0", + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX100HM", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "8.8.8.8", + "172.19.34.100", + "8.8.8.8" + ], + "rule.name": "default-permit", + "server.bytes": 82, + "server.ip": "8.8.8.8", + "server.nat.port": 53, + "server.packets": 1, + "server.port": 53, + "service.type": "juniper", + "source.bytes": 66, + "source.ip": "10.1.1.100", + "source.nat.ip": "172.19.34.100", + "source.nat.port": 26764, + "source.packets": 1, + "source.port": 63381, + "tags": [ + "juniper.srx", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/juniper/srx/test/idp.log b/x-pack/filebeat/module/juniper/srx/test/idp.log new file mode 100644 index 00000000000..c05d9732fb5 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/idp.log @@ -0,0 +1,7 @@ +<165>1 2020-03-02T23:13:03.193Z idp1 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.28 epoch-time="1583190783" message-type="SIG" source-address="10.11.11.1" source-port="12345" destination-address="187.188.188.10" destination-port="123" protocol-name="TCP" service-name="SERVICE_IDP" application-name="HTTP" rule-name="3" rulebase-name="IPS" policy-name="Recommended" export-id="20175" repeat-count="0" action="DROP" threat-severity="HIGH" attack-name="HTTP:MISC:GENERIC-DIR-TRAVERSAL" nat-source-address="0.0.0.0" nat-source-port="13312" nat-destination-address="3.3.10.11" nat-destination-port="9757" elapsed-time="0" inbound-bytes="0" outbound-bytes="0" inbound-packets="0" outbound-packets="0" source-zone-name="UNTRUST" source-interface-name="reth1.24" destination-zone-name="DMZ" destination-interface-name="reth2.21" packet-log-id="0" alert="no" username="unknown-user" roles="N/A" index="cnm" type="idp" message="-"] +<165>1 2020-03-02T23:13:03.197Z idp1 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.28 epoch-time="1583190783" message-type="SIG" source-address="10.11.11.1" source-port="12345" destination-address="187.188.188.10" destination-port="123" protocol-name="TCP" service-name="SERVICE_IDP" application-name="HTTP" rule-name="3" rulebase-name="IPS" policy-name="Recommended" export-id="20175" repeat-count="0" action="DROP" threat-severity="CRITICAL" attack-name="TCP:C2S:AMBIG:C2S-SYN-DATA" nat-source-address="0.0.0.0" nat-source-port="13312" nat-destination-address="3.3.10.11" nat-destination-port="9757" elapsed-time="0" inbound-bytes="0" outbound-bytes="0" inbound-packets="0" outbound-packets="0" source-zone-name="UNTRUST" source-interface-name="reth1.24" destination-zone-name="DMZ" destination-interface-name="reth2.21" packet-log-id="0" alert="no" username="unknown-user" roles="N/A" index="cnm" type="idp" message="-"] +<165>1 2007-02-15T09:17:15.719Z idp1 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.135 epoch-time="1507845354" message-type="SIG" source-address="183.78.180.27" source-port="45610" destination-address="118.127.111.1" destination-port="80" protocol-name="TCP" service-name="SERVICE_IDP" application-name="HTTP" rule-name="9" rulebase-name="IPS" policy-name="Recommended" export-id="15229" repeat-count="0" action="DROP" threat-severity="HIGH" attack-name="TROJAN:ZMEU-BOT-SCAN" nat-source-address="0.0.0.0" nat-source-port="0" nat-destination-address="172.19.13.11" nat-destination-port="0" elapsed-time="0" inbound-bytes="0" outbound-bytes="0" inbound-packets="0" outbound-packets="0" source-zone-name="sec-zone-name-internet" source-interface-name="reth0.11" destination-zone-name="dst-sec-zone1-outside" destination-interface-name="reth1.1" packet-log-id="0" alert="no" username="N/A" roles="N/A" message="-"] +<165>1 2017-10-13T08:55:55.792+11:00 idp1 RT_IDP - IDP_ATTACK_LOG_EVENT [junos@2636.1.1.1.2.135 epoch-time="1507845354" message-type="SIG" source-address="183.78.180.27" source-port="45610" destination-address="118.127.30.11" destination-port="80" protocol-name="TCP" service-name="SERVICE_IDP" application-name="HTTP" rule-name="9" rulebase-name="IPS" policy-name="Recommended" export-id="15229" repeat-count="0" action="DROP" threat-severity="HIGH" attack-name="TROJAN:ZMEU-BOT-SCAN" nat-source-address="0.0.0.0" nat-source-port="0" nat-destination-address="172.16.1.10" nat-destination-port="0" elapsed-time="0" inbound-bytes="0" outbound-bytes="0" inbound-packets="0" outbound-packets="0" source-zone-name="sec-zone-name-internet" source-interface-name="reth0.11" destination-zone-name="dst-sec-zone1-outside" destination-interface-name="reth1.1" packet-log-id="0" alert="no" username="N/A" roles="N/A" message="-"] +<165>1 2011-10-23T02:06:26.544 SRX34001 RT_IDP - IDP_APPDDOS_APP_STATE_EVENT [junos@2636.1.1.1.2.35 epoch-time="1319367986" ddos-application-name="Webserver" destination-zone-name="untrust" destination-interface-name="reth0.0" destination-address="172.27.14.203" destination-port="80" protocol-name="TCP" service-name="HTTP" rule-name="1" rulebase-name="DDOS" policy-name="A DoS-Webserver" repeat-count="0" message="Connection rate exceeded limit 60" context-value="N/A"] +<165>1 2011-10-23T16:28:31.696 SRX34001 RT_IDP - IDP_APPDDOS_APP_ATTACK_EVENT [junos@2636.1.1.1.2.35 epoch-time="1319419711" ddos-application-name="Webserver" source-zone-name="trust" source-interface-name="reth1.O" source-address="192.168.14.214" source-port="50825" destination-zone-name="untrust" destination-interface-name="reth0.0" destination-address="172.27.14.203" destination-port="80" protocol-name="TCP" service-name="HTTP" rule-name="1" ruleebase-name="DDOS" policy-name="AppDoS-Webserver" repeat-count="0" action="NONE" threat-severity="INFO" connection-hit-rate="30" context-name="http-get-url" context-hit-rate="123" context-value-hit-rate="0" time-scope="PEER" time-count="3" time-period="60" context-value="N/A"] +<165>1 2012-10-23T17:28:31.696 SRX34001 RT_IDP - IDP_APPDDOS_APP_ATTACK_EVENT_LS [junos@2636.1.1.1.2.35 epoch-time="1419419711" ddos-application-name="Webserver" source-zone-name="trust" source-interface-name="reth3.0" source-address="193.168.14.214" source-port="50825" destination-zone-name="untrust" destination-interface-name="reth0.1" destination-address="172.30.20.201" destination-port="80" protocol-name="TCP" service-name="HTTP" rule-name="1" ruleebase-name="DDOS02" policy-name="AppDoS-Webserver" repeat-count="0" action="NONE" threat-severity="INFO" connection-hit-rate="30" context-name="http-get-url" context-hit-rate="123" context-value-hit-rate="0" time-scope="PEER" time-count="3" time-period="60" context-value="N/A"] diff --git a/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json new file mode 100644 index 00000000000..7704c88fac0 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/idp.log-expected.json @@ -0,0 +1,537 @@ +[ + { + "@timestamp": "2020-03-02T21:13:03.193-02:00", + "client.bytes": 0, + "client.ip": "10.11.11.1", + "client.nat.port": 13312, + "client.packets": 0, + "client.port": 12345, + "destination.bytes": 0, + "destination.ip": "187.188.188.10", + "destination.nat.ip": "3.3.10.11", + "destination.nat.port": 9757, + "destination.packets": 0, + "destination.port": 123, + "event.action": "security_threat", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2020-03-02T21:13:03.193-02:00", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1583190783\" message-type=\"SIG\" source-address=\"10.11.11.1\" source-port=\"12345\" destination-address=\"187.188.188.10\" destination-port=\"123\" protocol-name=\"TCP\" service-name=\"SERVICE_IDP\" application-name=\"HTTP\" rule-name=\"3\" rulebase-name=\"IPS\" policy-name=\"Recommended\" export-id=\"20175\" repeat-count=\"0\" action=\"DROP\" threat-severity=\"HIGH\" attack-name=\"HTTP:MISC:GENERIC-DIR-TRAVERSAL\" nat-source-address=\"0.0.0.0\" nat-source-port=\"13312\" nat-destination-address=\"3.3.10.11\" nat-destination-port=\"9757\" elapsed-time=\"0\" inbound-bytes=\"0\" outbound-bytes=\"0\" inbound-packets=\"0\" outbound-packets=\"0\" source-zone-name=\"UNTRUST\" source-interface-name=\"reth1.24\" destination-zone-name=\"DMZ\" destination-interface-name=\"reth2.21\" packet-log-id=\"0\" alert=\"no\" username=\"unknown-user\" roles=\"N/A\" index=\"cnm\" type=\"idp\" message=\"-\"", + "event.outcome": "success", + "event.severity": "165", + "event.start": "2020-03-02T21:13:03.193-02:00", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "DROP", + "juniper.srx.alert": "no", + "juniper.srx.application_name": "HTTP", + "juniper.srx.attack_name": "HTTP:MISC:GENERIC-DIR-TRAVERSAL", + "juniper.srx.epoch_time": "1583190783", + "juniper.srx.export_id": "20175", + "juniper.srx.index": "cnm", + "juniper.srx.message_type": "SIG", + "juniper.srx.packet_log_id": "0", + "juniper.srx.policy_name": "Recommended", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.service_name": "SERVICE_IDP", + "juniper.srx.tag": "IDP_ATTACK_LOG_EVENT", + "juniper.srx.threat_severity": "HIGH", + "juniper.srx.type": "idp", + "log.level": "notification", + "log.offset": 0, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth2.21", + "observer.egress.zone": "DMZ", + "observer.ingress.interface.name": "reth1.24", + "observer.ingress.zone": "UNTRUST", + "observer.name": "idp1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.11.11.1", + "187.188.188.10", + "0.0.0.0", + "3.3.10.11" + ], + "rule.id": "3", + "rule.name": "IPS", + "server.bytes": 0, + "server.ip": "187.188.188.10", + "server.nat.port": 9757, + "server.packets": 0, + "server.port": 123, + "service.type": "juniper", + "source.bytes": 0, + "source.ip": "10.11.11.1", + "source.nat.ip": "0.0.0.0", + "source.nat.port": 13312, + "source.packets": 0, + "source.port": 12345, + "source.user.name": "unknown-user", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-03-02T21:13:03.197-02:00", + "client.bytes": 0, + "client.ip": "10.11.11.1", + "client.nat.port": 13312, + "client.packets": 0, + "client.port": 12345, + "destination.bytes": 0, + "destination.ip": "187.188.188.10", + "destination.nat.ip": "3.3.10.11", + "destination.nat.port": 9757, + "destination.packets": 0, + "destination.port": 123, + "event.action": "security_threat", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2020-03-02T21:13:03.197-02:00", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1583190783\" message-type=\"SIG\" source-address=\"10.11.11.1\" source-port=\"12345\" destination-address=\"187.188.188.10\" destination-port=\"123\" protocol-name=\"TCP\" service-name=\"SERVICE_IDP\" application-name=\"HTTP\" rule-name=\"3\" rulebase-name=\"IPS\" policy-name=\"Recommended\" export-id=\"20175\" repeat-count=\"0\" action=\"DROP\" threat-severity=\"CRITICAL\" attack-name=\"TCP:C2S:AMBIG:C2S-SYN-DATA\" nat-source-address=\"0.0.0.0\" nat-source-port=\"13312\" nat-destination-address=\"3.3.10.11\" nat-destination-port=\"9757\" elapsed-time=\"0\" inbound-bytes=\"0\" outbound-bytes=\"0\" inbound-packets=\"0\" outbound-packets=\"0\" source-zone-name=\"UNTRUST\" source-interface-name=\"reth1.24\" destination-zone-name=\"DMZ\" destination-interface-name=\"reth2.21\" packet-log-id=\"0\" alert=\"no\" username=\"unknown-user\" roles=\"N/A\" index=\"cnm\" type=\"idp\" message=\"-\"", + "event.outcome": "success", + "event.severity": "165", + "event.start": "2020-03-02T21:13:03.197-02:00", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "DROP", + "juniper.srx.alert": "no", + "juniper.srx.application_name": "HTTP", + "juniper.srx.attack_name": "TCP:C2S:AMBIG:C2S-SYN-DATA", + "juniper.srx.epoch_time": "1583190783", + "juniper.srx.export_id": "20175", + "juniper.srx.index": "cnm", + "juniper.srx.message_type": "SIG", + "juniper.srx.packet_log_id": "0", + "juniper.srx.policy_name": "Recommended", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.service_name": "SERVICE_IDP", + "juniper.srx.tag": "IDP_ATTACK_LOG_EVENT", + "juniper.srx.threat_severity": "CRITICAL", + "juniper.srx.type": "idp", + "log.level": "notification", + "log.offset": 929, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth2.21", + "observer.egress.zone": "DMZ", + "observer.ingress.interface.name": "reth1.24", + "observer.ingress.zone": "UNTRUST", + "observer.name": "idp1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.11.11.1", + "187.188.188.10", + "0.0.0.0", + "3.3.10.11" + ], + "rule.id": "3", + "rule.name": "IPS", + "server.bytes": 0, + "server.ip": "187.188.188.10", + "server.nat.port": 9757, + "server.packets": 0, + "server.port": 123, + "service.type": "juniper", + "source.bytes": 0, + "source.ip": "10.11.11.1", + "source.nat.ip": "0.0.0.0", + "source.nat.port": 13312, + "source.packets": 0, + "source.port": 12345, + "source.user.name": "unknown-user", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2007-02-15T07:17:15.719-02:00", + "client.bytes": 0, + "client.ip": "183.78.180.27", + "client.nat.port": 0, + "client.packets": 0, + "client.port": 45610, + "destination.bytes": 0, + "destination.ip": "118.127.111.1", + "destination.nat.ip": "172.19.13.11", + "destination.nat.port": 0, + "destination.packets": 0, + "destination.port": 80, + "event.action": "security_threat", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2007-02-15T07:17:15.719-02:00", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1507845354\" message-type=\"SIG\" source-address=\"183.78.180.27\" source-port=\"45610\" destination-address=\"118.127.111.1\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"SERVICE_IDP\" application-name=\"HTTP\" rule-name=\"9\" rulebase-name=\"IPS\" policy-name=\"Recommended\" export-id=\"15229\" repeat-count=\"0\" action=\"DROP\" threat-severity=\"HIGH\" attack-name=\"TROJAN:ZMEU-BOT-SCAN\" nat-source-address=\"0.0.0.0\" nat-source-port=\"0\" nat-destination-address=\"172.19.13.11\" nat-destination-port=\"0\" elapsed-time=\"0\" inbound-bytes=\"0\" outbound-bytes=\"0\" inbound-packets=\"0\" outbound-packets=\"0\" source-zone-name=\"sec-zone-name-internet\" source-interface-name=\"reth0.11\" destination-zone-name=\"dst-sec-zone1-outside\" destination-interface-name=\"reth1.1\" packet-log-id=\"0\" alert=\"no\" username=\"N/A\" roles=\"N/A\" message=\"-\"", + "event.outcome": "success", + "event.severity": "165", + "event.start": "2007-02-15T07:17:15.719-02:00", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "DROP", + "juniper.srx.alert": "no", + "juniper.srx.application_name": "HTTP", + "juniper.srx.attack_name": "TROJAN:ZMEU-BOT-SCAN", + "juniper.srx.epoch_time": "1507845354", + "juniper.srx.export_id": "15229", + "juniper.srx.message_type": "SIG", + "juniper.srx.packet_log_id": "0", + "juniper.srx.policy_name": "Recommended", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.service_name": "SERVICE_IDP", + "juniper.srx.tag": "IDP_ATTACK_LOG_EVENT", + "juniper.srx.threat_severity": "HIGH", + "log.level": "notification", + "log.offset": 1857, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth1.1", + "observer.egress.zone": "dst-sec-zone1-outside", + "observer.ingress.interface.name": "reth0.11", + "observer.ingress.zone": "sec-zone-name-internet", + "observer.name": "idp1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "183.78.180.27", + "118.127.111.1", + "0.0.0.0", + "172.19.13.11" + ], + "rule.id": "9", + "rule.name": "IPS", + "server.bytes": 0, + "server.ip": "118.127.111.1", + "server.nat.port": 0, + "server.packets": 0, + "server.port": 80, + "service.type": "juniper", + "source.bytes": 0, + "source.ip": "183.78.180.27", + "source.nat.ip": "0.0.0.0", + "source.nat.port": 0, + "source.packets": 0, + "source.port": 45610, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2017-10-12T19:55:55.792-02:00", + "client.bytes": 0, + "client.ip": "183.78.180.27", + "client.nat.port": 0, + "client.packets": 0, + "client.port": 45610, + "destination.bytes": 0, + "destination.ip": "118.127.30.11", + "destination.nat.ip": "172.16.1.10", + "destination.nat.port": 0, + "destination.packets": 0, + "destination.port": 80, + "event.action": "security_threat", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.duration": 0, + "event.end": "2017-10-12T19:55:55.792-02:00", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1507845354\" message-type=\"SIG\" source-address=\"183.78.180.27\" source-port=\"45610\" destination-address=\"118.127.30.11\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"SERVICE_IDP\" application-name=\"HTTP\" rule-name=\"9\" rulebase-name=\"IPS\" policy-name=\"Recommended\" export-id=\"15229\" repeat-count=\"0\" action=\"DROP\" threat-severity=\"HIGH\" attack-name=\"TROJAN:ZMEU-BOT-SCAN\" nat-source-address=\"0.0.0.0\" nat-source-port=\"0\" nat-destination-address=\"172.16.1.10\" nat-destination-port=\"0\" elapsed-time=\"0\" inbound-bytes=\"0\" outbound-bytes=\"0\" inbound-packets=\"0\" outbound-packets=\"0\" source-zone-name=\"sec-zone-name-internet\" source-interface-name=\"reth0.11\" destination-zone-name=\"dst-sec-zone1-outside\" destination-interface-name=\"reth1.1\" packet-log-id=\"0\" alert=\"no\" username=\"N/A\" roles=\"N/A\" message=\"-\"", + "event.outcome": "success", + "event.severity": "165", + "event.start": "2017-10-12T19:55:55.792-02:00", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "DROP", + "juniper.srx.alert": "no", + "juniper.srx.application_name": "HTTP", + "juniper.srx.attack_name": "TROJAN:ZMEU-BOT-SCAN", + "juniper.srx.epoch_time": "1507845354", + "juniper.srx.export_id": "15229", + "juniper.srx.message_type": "SIG", + "juniper.srx.packet_log_id": "0", + "juniper.srx.policy_name": "Recommended", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.service_name": "SERVICE_IDP", + "juniper.srx.tag": "IDP_ATTACK_LOG_EVENT", + "juniper.srx.threat_severity": "HIGH", + "log.level": "notification", + "log.offset": 2773, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth1.1", + "observer.egress.zone": "dst-sec-zone1-outside", + "observer.ingress.interface.name": "reth0.11", + "observer.ingress.zone": "sec-zone-name-internet", + "observer.name": "idp1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "183.78.180.27", + "118.127.30.11", + "0.0.0.0", + "172.16.1.10" + ], + "rule.id": "9", + "rule.name": "IPS", + "server.bytes": 0, + "server.ip": "118.127.30.11", + "server.nat.port": 0, + "server.packets": 0, + "server.port": 80, + "service.type": "juniper", + "source.bytes": 0, + "source.ip": "183.78.180.27", + "source.nat.ip": "0.0.0.0", + "source.nat.port": 0, + "source.packets": 0, + "source.port": 45610, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2011-10-23T02:06:26.544-02:00", + "destination.ip": "172.27.14.203", + "destination.port": 80, + "event.action": "application_ddos", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1319367986\" ddos-application-name=\"Webserver\" destination-zone-name=\"untrust\" destination-interface-name=\"reth0.0\" destination-address=\"172.27.14.203\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"HTTP\" rule-name=\"1\" rulebase-name=\"DDOS\" policy-name=\"A DoS-Webserver\" repeat-count=\"0\" message=\"Connection rate exceeded limit 60\" context-value=\"N/A\"", + "event.outcome": "success", + "event.severity": "165", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.ddos_application_name": "Webserver", + "juniper.srx.epoch_time": "1319367986", + "juniper.srx.policy_name": "A DoS-Webserver", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.service_name": "HTTP", + "juniper.srx.tag": "IDP_APPDDOS_APP_STATE_EVENT", + "log.level": "notification", + "log.offset": 3693, + "message": "Connection rate exceeded limit 60", + "network.protocol": "TCP", + "observer.egress.interface.name": "reth0.0", + "observer.egress.zone": "untrust", + "observer.name": "SRX34001", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "172.27.14.203" + ], + "rule.id": "1", + "rule.name": "DDOS", + "server.ip": "172.27.14.203", + "server.port": 80, + "service.type": "juniper", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2011-10-23T16:28:31.696-02:00", + "client.ip": "192.168.14.214", + "client.port": 50825, + "destination.ip": "172.27.14.203", + "destination.port": 80, + "event.action": "application_ddos", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1319419711\" ddos-application-name=\"Webserver\" source-zone-name=\"trust\" source-interface-name=\"reth1.O\" source-address=\"192.168.14.214\" source-port=\"50825\" destination-zone-name=\"untrust\" destination-interface-name=\"reth0.0\" destination-address=\"172.27.14.203\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"HTTP\" rule-name=\"1\" ruleebase-name=\"DDOS\" policy-name=\"AppDoS-Webserver\" repeat-count=\"0\" action=\"NONE\" threat-severity=\"INFO\" connection-hit-rate=\"30\" context-name=\"http-get-url\" context-hit-rate=\"123\" context-value-hit-rate=\"0\" time-scope=\"PEER\" time-count=\"3\" time-period=\"60\" context-value=\"N/A\"", + "event.outcome": "success", + "event.severity": "165", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "NONE", + "juniper.srx.connection_hit_rate": "30", + "juniper.srx.context_hit_rate": "123", + "juniper.srx.context_name": "http-get-url", + "juniper.srx.context_value_hit_rate": "0", + "juniper.srx.ddos_application_name": "Webserver", + "juniper.srx.epoch_time": "1319419711", + "juniper.srx.policy_name": "AppDoS-Webserver", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.ruleebase_name": "DDOS", + "juniper.srx.service_name": "HTTP", + "juniper.srx.tag": "IDP_APPDDOS_APP_ATTACK_EVENT", + "juniper.srx.threat_severity": "INFO", + "juniper.srx.time_count": "3", + "juniper.srx.time_period": "60", + "juniper.srx.time_scope": "PEER", + "log.level": "notification", + "log.offset": 4165, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth0.0", + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "reth1.O", + "observer.ingress.zone": "trust", + "observer.name": "SRX34001", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.168.14.214", + "172.27.14.203" + ], + "rule.id": "1", + "server.ip": "172.27.14.203", + "server.port": 80, + "service.type": "juniper", + "source.ip": "192.168.14.214", + "source.port": 50825, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2012-10-23T17:28:31.696-02:00", + "client.ip": "193.168.14.214", + "client.port": 50825, + "destination.ip": "172.30.20.201", + "destination.port": 80, + "event.action": "application_ddos", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "epoch-time=\"1419419711\" ddos-application-name=\"Webserver\" source-zone-name=\"trust\" source-interface-name=\"reth3.0\" source-address=\"193.168.14.214\" source-port=\"50825\" destination-zone-name=\"untrust\" destination-interface-name=\"reth0.1\" destination-address=\"172.30.20.201\" destination-port=\"80\" protocol-name=\"TCP\" service-name=\"HTTP\" rule-name=\"1\" ruleebase-name=\"DDOS02\" policy-name=\"AppDoS-Webserver\" repeat-count=\"0\" action=\"NONE\" threat-severity=\"INFO\" connection-hit-rate=\"30\" context-name=\"http-get-url\" context-hit-rate=\"123\" context-value-hit-rate=\"0\" time-scope=\"PEER\" time-count=\"3\" time-period=\"60\" context-value=\"N/A\"", + "event.outcome": "success", + "event.severity": "165", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "NONE", + "juniper.srx.connection_hit_rate": "30", + "juniper.srx.context_hit_rate": "123", + "juniper.srx.context_name": "http-get-url", + "juniper.srx.context_value_hit_rate": "0", + "juniper.srx.ddos_application_name": "Webserver", + "juniper.srx.epoch_time": "1419419711", + "juniper.srx.policy_name": "AppDoS-Webserver", + "juniper.srx.process": "RT_IDP", + "juniper.srx.repeat_count": "0", + "juniper.srx.ruleebase_name": "DDOS02", + "juniper.srx.service_name": "HTTP", + "juniper.srx.tag": "IDP_APPDDOS_APP_ATTACK_EVENT_LS", + "juniper.srx.threat_severity": "INFO", + "juniper.srx.time_count": "3", + "juniper.srx.time_period": "60", + "juniper.srx.time_scope": "PEER", + "log.level": "notification", + "log.offset": 4895, + "network.protocol": "TCP", + "observer.egress.interface.name": "reth0.1", + "observer.egress.zone": "untrust", + "observer.ingress.interface.name": "reth3.0", + "observer.ingress.zone": "trust", + "observer.name": "SRX34001", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "193.168.14.214", + "172.30.20.201" + ], + "rule.id": "1", + "server.ip": "172.30.20.201", + "server.port": 80, + "service.type": "juniper", + "source.ip": "193.168.14.214", + "source.port": 50825, + "tags": [ + "juniper.srx", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/juniper/srx/test/ids.log b/x-pack/filebeat/module/juniper/srx/test/ids.log new file mode 100644 index 00000000000..5b87817da86 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/ids.log @@ -0,0 +1,12 @@ +<11>1 2018-07-19T18:17:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.137 attack-name="TCP sweep!" source-address="113.113.17.17" source-port="6000" destination-address="40.177.177.1" destination-port="1433" source-zone-name="untrust" interface-name="fe-0/0/2.0" action="drop"] +<11>1 2018-07-19T18:18:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.36 attack-name="WinNuke attack!" source-address="2000:0000:0000:0000:0000:0000:0000:0002" source-port="3240" destination-address="2001:0000:0000:0000:0000:0000:0000:0002" destination-port="139" source-zone-name="untrust" interface-name="fe-0/0/2.0" action="drop"] +<11>1 2018-07-19T18:19:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.40 attack-name="SYN flood!" source-address="1.1.1.2" source-port="40001" destination-address="2.2.2.2" destination-port="50010" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T18:22:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_UDP [junos@2636.1.1.1.2.40 attack-name="UDP flood!" source-address="111.1.1.3" source-port="40001" destination-address="3.4.2.2" destination-port="53" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T18:25:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_ICMP [junos@2636.1.1.1.2.40 attack-name="ICMP fragment!" source-address="111.1.1.3" destination-address="3.4.2.2" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T18:26:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_IP [junos@2636.1.1.1.2.40 attack-name="Record Route IP option!" source-address="111.1.1.3" destination-address="3.4.2.2" protocol-id="1" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T18:27:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_IP [junos@2636.1.1.1.2.40 attack-name="Tunnel GRE 6in6!" source-address="1212::12" destination-address="1111::11" protocol-id="1" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T18:28:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_IP [junos@2636.1.1.1.2.40 attack-name="Tunnel GRE 4in4!" source-address="12.12.12.1" destination-address="11.11.11.1" protocol-id="1" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2018-07-19T19:19:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_TCP_DST_IP [junos@2636.1.1.1.2.40 attack-name="SYN flood!" destination-address="2.2.2.2" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="alarm-without-drop"] +<11>1 2018-07-19T19:19:02.309-05:00 rtr199 RT_IDS - RT_SCREEN_TCP_SRC_IP [junos@2636.1.1.1.2.40 attack-name="SYN flood!" source-address="111.1.1.3" source-zone-name="trustZone" interface-name="ge-0/0/1.0" action="alarm-without-drop"] +<11>1 2020-07-17T09:54:43.912+02:00 rtr199 RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.129 attack-name="TCP port scan!" source-address="10.1.1.100" source-port="50630" destination-address="10.1.1.1" destination-port="10778" source-zone-name="trust" interface-name="ge-0/0/1.0" action="drop"] +<11>1 2020-07-17T10:01:43.006+02:00 rtr199 RT_IDS - RT_SCREEN_TCP [junos@2636.1.1.1.2.129 attack-name="FIN but no ACK bit!" source-address="10.1.1.100" source-port="42799" destination-address="10.1.1.1" destination-port="7" source-zone-name="trust" interface-name="ge-0/0/1.0" action="drop"] diff --git a/x-pack/filebeat/module/juniper/srx/test/ids.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/ids.log-expected.json new file mode 100644 index 00000000000..10abae2fa6d --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/ids.log-expected.json @@ -0,0 +1,699 @@ +[ + { + "@timestamp": "2018-07-19T21:17:02.309-02:00", + "client.ip": "113.113.17.17", + "client.port": 6000, + "destination.as.number": 4249, + "destination.as.organization.name": "Eli Lilly and Company", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "40.177.177.1", + "destination.port": 1433, + "event.action": "sweep_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"TCP sweep!\" source-address=\"113.113.17.17\" source-port=\"6000\" destination-address=\"40.177.177.1\" destination-port=\"1433\" source-zone-name=\"untrust\" interface-name=\"fe-0/0/2.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "TCP sweep!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP", + "log.level": "error", + "log.offset": 0, + "observer.ingress.interface.name": "fe-0/0/2.0", + "observer.ingress.zone": "untrust", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "113.113.17.17", + "40.177.177.1" + ], + "server.ip": "40.177.177.1", + "server.port": 1433, + "service.type": "juniper", + "source.as.number": 4134, + "source.as.organization.name": "No.31,Jin-rong Street", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", + "source.geo.location.lat": 23.1167, + "source.geo.location.lon": 113.25, + "source.geo.region_iso_code": "CN-GD", + "source.geo.region_name": "Guangdong", + "source.ip": "113.113.17.17", + "source.port": 6000, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:18:02.309-02:00", + "client.ip": "2000:0000:0000:0000:0000:0000:0000:0002", + "client.port": 3240, + "destination.ip": "2001:0000:0000:0000:0000:0000:0000:0002", + "destination.port": 139, + "event.action": "attack_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"WinNuke attack!\" source-address=\"2000:0000:0000:0000:0000:0000:0000:0002\" source-port=\"3240\" destination-address=\"2001:0000:0000:0000:0000:0000:0000:0002\" destination-port=\"139\" source-zone-name=\"untrust\" interface-name=\"fe-0/0/2.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "WinNuke attack!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP", + "log.level": "error", + "log.offset": 294, + "observer.ingress.interface.name": "fe-0/0/2.0", + "observer.ingress.zone": "untrust", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "2000:0000:0000:0000:0000:0000:0000:0002", + "2001:0000:0000:0000:0000:0000:0000:0002" + ], + "server.ip": "2001:0000:0000:0000:0000:0000:0000:0002", + "server.port": 139, + "service.type": "juniper", + "source.ip": "2000:0000:0000:0000:0000:0000:0000:0002", + "source.port": 3240, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:19:02.309-02:00", + "client.ip": "1.1.1.2", + "client.port": 40001, + "destination.as.number": 3215, + "destination.as.organization.name": "Orange", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", + "destination.geo.location.lat": 48.8582, + "destination.geo.location.lon": 2.3387, + "destination.ip": "2.2.2.2", + "destination.port": 50010, + "event.action": "flood_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"SYN flood!\" source-address=\"1.1.1.2\" source-port=\"40001\" destination-address=\"2.2.2.2\" destination-port=\"50010\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "SYN flood!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP", + "log.level": "error", + "log.offset": 644, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "1.1.1.2", + "2.2.2.2" + ], + "server.ip": "2.2.2.2", + "server.port": 50010, + "service.type": "juniper", + "source.as.number": 13335, + "source.as.organization.name": "Cloudflare, Inc.", + "source.geo.continent_name": "Oceania", + "source.geo.country_iso_code": "AU", + "source.geo.country_name": "Australia", + "source.geo.location.lat": -33.494, + "source.geo.location.lon": 143.2104, + "source.ip": "1.1.1.2", + "source.port": 40001, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:22:02.309-02:00", + "client.ip": "111.1.1.3", + "client.port": 40001, + "destination.geo.city_name": "Seattle", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 47.6348, + "destination.geo.location.lon": -122.3451, + "destination.geo.region_iso_code": "US-WA", + "destination.geo.region_name": "Washington", + "destination.ip": "3.4.2.2", + "destination.port": 53, + "event.action": "flood_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"UDP flood!\" source-address=\"111.1.1.3\" source-port=\"40001\" destination-address=\"3.4.2.2\" destination-port=\"53\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "UDP flood!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_UDP", + "log.level": "error", + "log.offset": 930, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "111.1.1.3", + "3.4.2.2" + ], + "server.ip": "3.4.2.2", + "server.port": 53, + "service.type": "juniper", + "source.as.number": 56041, + "source.as.organization.name": "China Mobile communications corporation", + "source.geo.city_name": "Wenzhou", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", + "source.geo.location.lat": 27.9983, + "source.geo.location.lon": 120.6666, + "source.geo.region_iso_code": "CN-ZJ", + "source.geo.region_name": "Zhejiang", + "source.ip": "111.1.1.3", + "source.port": 40001, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:25:02.309-02:00", + "client.ip": "111.1.1.3", + "destination.geo.city_name": "Seattle", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 47.6348, + "destination.geo.location.lon": -122.3451, + "destination.geo.region_iso_code": "US-WA", + "destination.geo.region_name": "Washington", + "destination.ip": "3.4.2.2", + "event.action": "fragment_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"ICMP fragment!\" source-address=\"111.1.1.3\" destination-address=\"3.4.2.2\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "ICMP fragment!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_ICMP", + "log.level": "error", + "log.offset": 1215, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "111.1.1.3", + "3.4.2.2" + ], + "server.ip": "3.4.2.2", + "service.type": "juniper", + "source.as.number": 56041, + "source.as.organization.name": "China Mobile communications corporation", + "source.geo.city_name": "Wenzhou", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", + "source.geo.location.lat": 27.9983, + "source.geo.location.lon": 120.6666, + "source.geo.region_iso_code": "CN-ZJ", + "source.geo.region_name": "Zhejiang", + "source.ip": "111.1.1.3", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:26:02.309-02:00", + "client.ip": "111.1.1.3", + "destination.geo.city_name": "Seattle", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 47.6348, + "destination.geo.location.lon": -122.3451, + "destination.geo.region_iso_code": "US-WA", + "destination.geo.region_name": "Washington", + "destination.ip": "3.4.2.2", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"Record Route IP option!\" source-address=\"111.1.1.3\" destination-address=\"3.4.2.2\" protocol-id=\"1\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "Record Route IP option!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_IP", + "log.level": "error", + "log.offset": 1463, + "network.iana_number": "1", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "111.1.1.3", + "3.4.2.2" + ], + "server.ip": "3.4.2.2", + "service.type": "juniper", + "source.as.number": 56041, + "source.as.organization.name": "China Mobile communications corporation", + "source.geo.city_name": "Wenzhou", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", + "source.geo.location.lat": 27.9983, + "source.geo.location.lon": 120.6666, + "source.geo.region_iso_code": "CN-ZJ", + "source.geo.region_name": "Zhejiang", + "source.ip": "111.1.1.3", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:27:02.309-02:00", + "client.ip": "1212::12", + "destination.ip": "1111::11", + "event.action": "tunneling_screen", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"Tunnel GRE 6in6!\" source-address=\"1212::12\" destination-address=\"1111::11\" protocol-id=\"1\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "Tunnel GRE 6in6!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_IP", + "log.level": "error", + "log.offset": 1734, + "network.iana_number": "1", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "1212::12", + "1111::11" + ], + "server.ip": "1111::11", + "service.type": "juniper", + "source.ip": "1212::12", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T21:28:02.309-02:00", + "client.ip": "12.12.12.1", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "11.11.11.1", + "event.action": "tunneling_screen", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"Tunnel GRE 4in4!\" source-address=\"12.12.12.1\" destination-address=\"11.11.11.1\" protocol-id=\"1\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "Tunnel GRE 4in4!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_IP", + "log.level": "error", + "log.offset": 1998, + "network.iana_number": "1", + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "12.12.12.1", + "11.11.11.1" + ], + "server.ip": "11.11.11.1", + "service.type": "juniper", + "source.as.number": 32328, + "source.as.organization.name": "Alascom, Inc.", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "12.12.12.1", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T22:19:02.309-02:00", + "destination.as.number": 3215, + "destination.as.organization.name": "Orange", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", + "destination.geo.location.lat": 48.8582, + "destination.geo.location.lon": 2.3387, + "destination.ip": "2.2.2.2", + "event.action": "flood_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"SYN flood!\" destination-address=\"2.2.2.2\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"alarm-without-drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "alarm-without-drop", + "juniper.srx.attack_name": "SYN flood!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP_DST_IP", + "log.level": "error", + "log.offset": 2266, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "2.2.2.2" + ], + "server.ip": "2.2.2.2", + "service.type": "juniper", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2018-07-19T22:19:02.309-02:00", + "client.ip": "111.1.1.3", + "event.action": "flood_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"SYN flood!\" source-address=\"111.1.1.3\" source-zone-name=\"trustZone\" interface-name=\"ge-0/0/1.0\" action=\"alarm-without-drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "alarm-without-drop", + "juniper.srx.attack_name": "SYN flood!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP_SRC_IP", + "log.level": "error", + "log.offset": 2503, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trustZone", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "111.1.1.3" + ], + "service.type": "juniper", + "source.as.number": 56041, + "source.as.organization.name": "China Mobile communications corporation", + "source.geo.city_name": "Wenzhou", + "source.geo.continent_name": "Asia", + "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", + "source.geo.location.lat": 27.9983, + "source.geo.location.lon": 120.6666, + "source.geo.region_iso_code": "CN-ZJ", + "source.geo.region_name": "Zhejiang", + "source.ip": "111.1.1.3", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-17T05:54:43.912-02:00", + "client.ip": "10.1.1.100", + "client.port": 50630, + "destination.ip": "10.1.1.1", + "destination.port": 10778, + "event.action": "scan_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"TCP port scan!\" source-address=\"10.1.1.100\" source-port=\"50630\" destination-address=\"10.1.1.1\" destination-port=\"10778\" source-zone-name=\"trust\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "TCP port scan!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP", + "log.level": "error", + "log.offset": 2737, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trust", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "10.1.1.1" + ], + "server.ip": "10.1.1.1", + "server.port": 10778, + "service.type": "juniper", + "source.ip": "10.1.1.100", + "source.port": 50630, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2020-07-17T06:01:43.006-02:00", + "client.ip": "10.1.1.100", + "client.port": 42799, + "destination.ip": "10.1.1.1", + "destination.port": 7, + "event.action": "illegal_tcp_flag_detected", + "event.category": [ + "network", + "intrusion_detection" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "attack-name=\"FIN but no ACK bit!\" source-address=\"10.1.1.100\" source-port=\"42799\" destination-address=\"10.1.1.1\" destination-port=\"7\" source-zone-name=\"trust\" interface-name=\"ge-0/0/1.0\" action=\"drop\"", + "event.outcome": "success", + "event.severity": "11", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.attack_name": "FIN but no ACK bit!", + "juniper.srx.process": "RT_IDS", + "juniper.srx.tag": "RT_SCREEN_TCP", + "log.level": "error", + "log.offset": 3028, + "observer.ingress.interface.name": "ge-0/0/1.0", + "observer.ingress.zone": "trust", + "observer.name": "rtr199", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.1.1.100", + "10.1.1.1" + ], + "server.ip": "10.1.1.1", + "server.port": 7, + "service.type": "juniper", + "source.ip": "10.1.1.100", + "source.port": 42799, + "tags": [ + "juniper.srx", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/juniper/srx/test/secintel.log b/x-pack/filebeat/module/juniper/srx/test/secintel.log new file mode 100644 index 00000000000..12f8f137c7f --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/secintel.log @@ -0,0 +1,2 @@ +<14>1 2016-10-17T15:18:11.618Z SRX-1500 RT_SECINTEL - SECINTEL_ACTION_LOG [junos@2636.1.1.1.2.129 category="secintel" sub-category="Blacklist" action="BLOCK" action-detail="DROP" http-host="N/A" threat-severity="0" source-address="5.196.121.161" source-port="1" destination-address="10.10.0.10" destination-port="24039" protocol-id="1" application="N/A" nested-application="N/A" feed-name="Tor_Exit_Nodes" policy-name="cc_policy" profile-name="Blacklist" username="N/A" roles="N/A" session-id-32="572564" source-zone-name="Outside" destination-zone-name="DMZ"] +<14>1 2016-10-17T15:18:11.618Z SRX-1500 RT_SECINTEL - SECINTEL_ACTION_LOG [junos@2636.1.1.1.2.129 category="secintel" sub-category="CC" action="BLOCK" action-detail="CLOSE REDIRECT MSG" http-host="dummy_host" threat-severity="10" source-address="1.1.1.1" source-port="36612" destination-address="10.0.0.1" destination-port="80" protocol-id="6" application="HTTP" nested-application="N/A" feed-name="cc_url_data" policy-name="test" profile-name="test-profile" username="N/A" roles="N/A" session-id-32="502362" source-zone-name="Inside" destination-zone-name="Outside" occur-count="0"] diff --git a/x-pack/filebeat/module/juniper/srx/test/secintel.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/secintel.log-expected.json new file mode 100644 index 00000000000..49667e85897 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/secintel.log-expected.json @@ -0,0 +1,140 @@ +[ + { + "@timestamp": "2016-10-17T13:18:11.618-02:00", + "client.ip": "5.196.121.161", + "client.port": 1, + "destination.ip": "10.10.0.10", + "destination.port": 24039, + "event.action": "malware_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "category=\"secintel\" sub-category=\"Blacklist\" action=\"BLOCK\" action-detail=\"DROP\" http-host=\"N/A\" threat-severity=\"0\" source-address=\"5.196.121.161\" source-port=\"1\" destination-address=\"10.10.0.10\" destination-port=\"24039\" protocol-id=\"1\" application=\"N/A\" nested-application=\"N/A\" feed-name=\"Tor_Exit_Nodes\" policy-name=\"cc_policy\" profile-name=\"Blacklist\" username=\"N/A\" roles=\"N/A\" session-id-32=\"572564\" source-zone-name=\"Outside\" destination-zone-name=\"DMZ\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "BLOCK", + "juniper.srx.action_detail": "DROP", + "juniper.srx.category": "secintel", + "juniper.srx.feed_name": "Tor_Exit_Nodes", + "juniper.srx.policy_name": "cc_policy", + "juniper.srx.process": "RT_SECINTEL", + "juniper.srx.profile_name": "Blacklist", + "juniper.srx.session_id_32": "572564", + "juniper.srx.sub_category": "Blacklist", + "juniper.srx.tag": "SECINTEL_ACTION_LOG", + "juniper.srx.threat_severity": "0", + "log.level": "informational", + "log.offset": 0, + "network.iana_number": "1", + "observer.egress.zone": "DMZ", + "observer.ingress.zone": "Outside", + "observer.name": "SRX-1500", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "5.196.121.161", + "10.10.0.10" + ], + "server.ip": "10.10.0.10", + "server.port": 24039, + "service.type": "juniper", + "source.as.number": 16276, + "source.as.organization.name": "OVH SAS", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", + "source.geo.location.lat": 48.8582, + "source.geo.location.lon": 2.3387, + "source.ip": "5.196.121.161", + "source.port": 1, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2016-10-17T13:18:11.618-02:00", + "client.ip": "1.1.1.1", + "client.port": 36612, + "destination.ip": "10.0.0.1", + "destination.port": 80, + "event.action": "malware_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "category=\"secintel\" sub-category=\"CC\" action=\"BLOCK\" action-detail=\"CLOSE REDIRECT MSG\" http-host=\"dummy_host\" threat-severity=\"10\" source-address=\"1.1.1.1\" source-port=\"36612\" destination-address=\"10.0.0.1\" destination-port=\"80\" protocol-id=\"6\" application=\"HTTP\" nested-application=\"N/A\" feed-name=\"cc_url_data\" policy-name=\"test\" profile-name=\"test-profile\" username=\"N/A\" roles=\"N/A\" session-id-32=\"502362\" source-zone-name=\"Inside\" destination-zone-name=\"Outside\" occur-count=\"0\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "BLOCK", + "juniper.srx.action_detail": "CLOSE REDIRECT MSG", + "juniper.srx.application": "HTTP", + "juniper.srx.category": "secintel", + "juniper.srx.feed_name": "cc_url_data", + "juniper.srx.occur_count": "0", + "juniper.srx.policy_name": "test", + "juniper.srx.process": "RT_SECINTEL", + "juniper.srx.profile_name": "test-profile", + "juniper.srx.session_id_32": "502362", + "juniper.srx.sub_category": "CC", + "juniper.srx.tag": "SECINTEL_ACTION_LOG", + "juniper.srx.threat_severity": "10", + "log.level": "informational", + "log.offset": 561, + "network.iana_number": "6", + "observer.egress.zone": "Outside", + "observer.ingress.zone": "Inside", + "observer.name": "SRX-1500", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "dummy_host" + ], + "related.ip": [ + "1.1.1.1", + "10.0.0.1" + ], + "server.ip": "10.0.0.1", + "server.port": 80, + "service.type": "juniper", + "source.as.number": 13335, + "source.as.organization.name": "Cloudflare, Inc.", + "source.geo.continent_name": "Oceania", + "source.geo.country_iso_code": "AU", + "source.geo.country_name": "Australia", + "source.geo.location.lat": -33.494, + "source.geo.location.lon": 143.2104, + "source.ip": "1.1.1.1", + "source.port": 36612, + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "dummy_host" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/juniper/srx/test/utm.log b/x-pack/filebeat/module/juniper/srx/test/utm.log new file mode 100644 index 00000000000..61c320ae885 --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/utm.log @@ -0,0 +1,12 @@ +<12>1 2016-02-18T01:32:50.391Z utm-srx550-b RT_UTM - WEBFILTER_URL_BLOCKED [junos@2636.1.1.1.2.86 source-address="192.168.1.100" source-port="58071" destination-address="103.235.46.39" destination-port="80" category="cat1" reason="BY_BLACK_LIST" profile="uf1" url="www.baidu.com" obj="/" username="user01" roles="N/A"] +<12>1 2016-02-18T01:32:50.391Z utm-srx550-b RT_UTM - WEBFILTER_URL_PERMITTED [junos@2636.1.1.1.2.86 source-address="10.10.10.50" source-port="1402" destination-address="216.200.241.66" destination-port="80" category="N/A" reason="BY_OTHER" profile="wf-profile" url="www.checkpoint.com" obj="/css/homepage2012.css" username="user02" roles="N/A"] +<12>1 2010-02-08T08:29:28.565Z SRX650-1 RT_UTM - AV_VIRUS_DETECTED_MT [junos@2636.1.1.1.2.40 source-address="188.40.238.250" source-port="80" destination-address="10.1.1.103" destination-port="47095" source-zone-name="untrust" filename="www.eicar.org/download/eicar.com" temporary-filename="www.eicar.org/download/eicar.com" name="EICAR-Test-File" url="EICAR-Test-File"] +<12>1 2010-02-08T08:29:28.565Z SRX650-1 RT_UTM - AV_SCANNER_DROP_FILE_MT [junos@2636.1.1.1.2.40 source-address="74.125.155.147" source-port="80" destination-address="10.1.1.103" destination-port="33578" filename="www.google.com/" error-code="14" error-message="scan engine is not ready"] +<12>1 2010-01-29T10:59:59.660Z SRX650-1 RT_UTM - AV_HUGE_FILE_DROPPED_MT [junos@2636.1.1.1.2.40 source-address="10.2.1.101" source-port="80" destination-address="10.1.1.103" destination-port="51727" filename="10.2.1.101/images/junos- srxsme-10.2-20100106.0-domestic.tgz"] +<14>1 2016-02-18T01:33:50.391Z utm-srx550-b RT_UTM - ANTISPAM_SPAM_DETECTED_MT [junos@2636.1.1.1.2.86 source-zone="trust" destination-zone="untrust" source-name="N/A" source-address="10.10.10.1" profile-name="antispam01" action="drop" reason="Match local blacklist" username="user01" roles="N/A"] +<14>1 2016-02-18T01:34:50.391Z utm-srx550-b RT_UTM - CONTENT_FILTERING_BLOCKED_MT [junos@2636.1.1.1.2.86 source-zone="untrust" destination-zone="trust" protocol="http" source-address="192.0.2.3" source-port="58071" destination-address="198.51.100.2" destination-port="80" profile-name="content02" action="drop" reason="blocked due to file extension block list" username="user01@testuser.com" roles="N/A" filename="test.cmd"] +<12>1 2016-02-19T01:32:50.391Z utm-srx550-b RT_UTM - WEBFILTER_URL_BLOCKED_LS [junos@2636.1.1.1.2.86 source-address="192.168.1.100" source-port="58071" destination-address="103.235.46.39" destination-port="80" category="cat1" reason="BY_BLACK_LIST" profile="uf1" url="www.baidu.com" obj="/" username="user01" roles="N/A"] +<12>1 2011-02-08T08:29:28.565Z SRX650-1 RT_UTM - AV_VIRUS_DETECTED_MT_LS [junos@2636.1.1.1.2.40 source-address="188.40.238.250" source-port="80" destination-address="10.1.1.103" destination-port="47095" source-zone-name="untrust" filename="www.eicar.org/download/eicar.com" temporary-filename="www.eicar.org/download/eicar.com" name="EICAR-Test-File" url="EICAR-Test-File"] +<14>1 2020-07-14T14:16:18.345Z SRX650-1 RT_UTM - WEBFILTER_URL_PERMITTED [junos@2636.1.1.1.2.129 source-zone="trust" destination-zone="untrust" source-address="10.1.1.100" source-port="58974" destination-address="104.26.15.142" destination-port="443" session-id="16297" application="UNKNOWN" nested-application="UNKNOWN" category="Enhanced_Information_Technology" reason="BY_SITE_REPUTATION_MODERATELY_SAFE" profile="WCF1" url="datawrapper.dwcdn.net" obj="/" username="N/A" roles="N/A" application-sub-category="N/A" urlcategory-risk="0"] +<12>1 2020-07-14T14:16:29.541Z SRX650-1 RT_UTM - WEBFILTER_URL_BLOCKED [junos@2636.1.1.1.2.129 source-zone="trust" destination-zone="untrust" source-address="10.1.1.100" source-port="59075" destination-address="85.114.159.93" destination-port="443" session-id="16490" application="UNKNOWN" nested-application="UNKNOWN" category="Enhanced_Advertisements" reason="BY_SITE_REPUTATION_SUSPICIOUS" profile="WCF1" url="dsp.adfarm1.adition.com" obj="/" username="N/A" roles="N/A" application-sub-category="N/A" urlcategory-risk="3"] +<12>1 2020-07-14T14:17:04.733Z SRX650-1 RT_UTM - AV_FILE_NOT_SCANNED_DROPPED_MT [junos@2636.1.1.1.2.129 source-zone="trust" destination-zone="untrust" source-address="23.209.86.45" source-port="80" destination-address="10.1.1.100" destination-port="58954" profile-name="Custom-Sophos-Profile" filename="download.cdn.mozilla.net/pub/firefox/releases/78.0.2/update/win64/de/firefox-78.0.2.complete.mar" action="BLOCKED" reason="exceeding maximum content size" error-code="7" username="N/A" roles="N/A"] diff --git a/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json b/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json new file mode 100644 index 00000000000..f9890a6ca0f --- /dev/null +++ b/x-pack/filebeat/module/juniper/srx/test/utm.log-expected.json @@ -0,0 +1,698 @@ +[ + { + "@timestamp": "2016-02-17T23:32:50.391-02:00", + "client.ip": "192.168.1.100", + "client.port": 58071, + "destination.as.number": 55967, + "destination.as.organization.name": "Beijing Baidu Netcom Science and Technology Co., Ltd.", + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "HK", + "destination.geo.country_name": "Hong Kong", + "destination.geo.location.lat": 22.25, + "destination.geo.location.lon": 114.1667, + "destination.ip": "103.235.46.39", + "destination.port": 80, + "event.action": "web_filter", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-address=\"192.168.1.100\" source-port=\"58071\" destination-address=\"103.235.46.39\" destination-port=\"80\" category=\"cat1\" reason=\"BY_BLACK_LIST\" profile=\"uf1\" url=\"www.baidu.com\" obj=\"/\" username=\"user01\" roles=\"N/A\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.category": "cat1", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile": "uf1", + "juniper.srx.reason": "BY_BLACK_LIST", + "juniper.srx.tag": "WEBFILTER_URL_BLOCKED", + "log.level": "warning", + "log.offset": 0, + "observer.name": "utm-srx550-b", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "www.baidu.com" + ], + "related.ip": [ + "192.168.1.100", + "103.235.46.39" + ], + "server.ip": "103.235.46.39", + "server.port": 80, + "service.type": "juniper", + "source.ip": "192.168.1.100", + "source.port": 58071, + "source.user.name": "user01", + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "www.baidu.com", + "url.path": "/" + }, + { + "@timestamp": "2016-02-17T23:32:50.391-02:00", + "client.ip": "10.10.10.50", + "client.port": 1402, + "destination.as.number": 6461, + "destination.as.organization.name": "Zayo Bandwidth", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "216.200.241.66", + "destination.port": 80, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.10.10.50\" source-port=\"1402\" destination-address=\"216.200.241.66\" destination-port=\"80\" category=\"N/A\" reason=\"BY_OTHER\" profile=\"wf-profile\" url=\"www.checkpoint.com\" obj=\"/css/homepage2012.css\" username=\"user02\" roles=\"N/A\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile": "wf-profile", + "juniper.srx.reason": "BY_OTHER", + "juniper.srx.tag": "WEBFILTER_URL_PERMITTED", + "log.level": "warning", + "log.offset": 319, + "observer.name": "utm-srx550-b", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "www.checkpoint.com" + ], + "related.ip": [ + "10.10.10.50", + "216.200.241.66" + ], + "server.ip": "216.200.241.66", + "server.port": 80, + "service.type": "juniper", + "source.ip": "10.10.10.50", + "source.port": 1402, + "source.user.name": "user02", + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "www.checkpoint.com", + "url.path": "/css/homepage2012.css" + }, + { + "@timestamp": "2010-02-08T06:29:28.565-02:00", + "client.ip": "188.40.238.250", + "client.port": 80, + "destination.ip": "10.1.1.103", + "destination.port": 47095, + "event.action": "virus_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-address=\"188.40.238.250\" source-port=\"80\" destination-address=\"10.1.1.103\" destination-port=\"47095\" source-zone-name=\"untrust\" filename=\"www.eicar.org/download/eicar.com\" temporary-filename=\"www.eicar.org/download/eicar.com\" name=\"EICAR-Test-File\" url=\"EICAR-Test-File\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "file.name": "www.eicar.org/download/eicar.com", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.name": "EICAR-Test-File", + "juniper.srx.process": "RT_UTM", + "juniper.srx.tag": "AV_VIRUS_DETECTED_MT", + "juniper.srx.temporary_filename": "www.eicar.org/download/eicar.com", + "log.level": "warning", + "log.offset": 664, + "observer.ingress.zone": "untrust", + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "EICAR-Test-File" + ], + "related.ip": [ + "188.40.238.250", + "10.1.1.103" + ], + "server.ip": "10.1.1.103", + "server.port": 47095, + "service.type": "juniper", + "source.as.number": 24940, + "source.as.organization.name": "Hetzner Online GmbH", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", + "source.geo.location.lat": 51.2993, + "source.geo.location.lon": 9.491, + "source.ip": "188.40.238.250", + "source.port": 80, + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "EICAR-Test-File" + }, + { + "@timestamp": "2010-02-08T06:29:28.565-02:00", + "client.ip": "74.125.155.147", + "client.port": 80, + "destination.ip": "10.1.1.103", + "destination.port": 33578, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"74.125.155.147\" source-port=\"80\" destination-address=\"10.1.1.103\" destination-port=\"33578\" filename=\"www.google.com/\" error-code=\"14\" error-message=\"scan engine is not ready\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "file.name": "www.google.com/", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.error_code": "14", + "juniper.srx.error_message": "scan engine is not ready", + "juniper.srx.process": "RT_UTM", + "juniper.srx.tag": "AV_SCANNER_DROP_FILE_MT", + "log.level": "warning", + "log.offset": 1035, + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "74.125.155.147", + "10.1.1.103" + ], + "server.ip": "10.1.1.103", + "server.port": 33578, + "service.type": "juniper", + "source.as.number": 15169, + "source.as.organization.name": "Google LLC", + "source.geo.continent_name": "North America", + "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", + "source.geo.location.lat": 37.751, + "source.geo.location.lon": -97.822, + "source.ip": "74.125.155.147", + "source.port": 80, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2010-01-29T08:59:59.660-02:00", + "client.ip": "10.2.1.101", + "client.port": 80, + "destination.ip": "10.1.1.103", + "destination.port": 51727, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-address=\"10.2.1.101\" source-port=\"80\" destination-address=\"10.1.1.103\" destination-port=\"51727\" filename=\"10.2.1.101/images/junos- srxsme-10.2-20100106.0-domestic.tgz\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "file.name": "10.2.1.101/images/junos- srxsme-10.2-20100106.0-domestic.tgz", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.process": "RT_UTM", + "juniper.srx.tag": "AV_HUGE_FILE_DROPPED_MT", + "log.level": "warning", + "log.offset": 1323, + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.2.1.101", + "10.1.1.103" + ], + "server.ip": "10.1.1.103", + "server.port": 51727, + "service.type": "juniper", + "source.ip": "10.2.1.101", + "source.port": 80, + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-17T23:33:50.391-02:00", + "client.ip": "10.10.10.1", + "event.action": "antispam_filter", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-zone=\"trust\" destination-zone=\"untrust\" source-name=\"N/A\" source-address=\"10.10.10.1\" profile-name=\"antispam01\" action=\"drop\" reason=\"Match local blacklist\" username=\"user01\" roles=\"N/A\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile_name": "antispam01", + "juniper.srx.reason": "Match local blacklist", + "juniper.srx.tag": "ANTISPAM_SPAM_DETECTED_MT", + "log.level": "informational", + "log.offset": 1595, + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "utm-srx550-b", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "10.10.10.1" + ], + "service.type": "juniper", + "source.ip": "10.10.10.1", + "source.user.name": "user01", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-17T23:34:50.391-02:00", + "client.ip": "192.0.2.3", + "client.port": 58071, + "destination.ip": "198.51.100.2", + "destination.port": 80, + "event.action": "content_filter", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-zone=\"untrust\" destination-zone=\"trust\" protocol=\"http\" source-address=\"192.0.2.3\" source-port=\"58071\" destination-address=\"198.51.100.2\" destination-port=\"80\" profile-name=\"content02\" action=\"drop\" reason=\"blocked due to file extension block list\" username=\"user01@testuser.com\" roles=\"N/A\" filename=\"test.cmd\"", + "event.outcome": "success", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "file.name": "test.cmd", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "drop", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile_name": "content02", + "juniper.srx.reason": "blocked due to file extension block list", + "juniper.srx.tag": "CONTENT_FILTERING_BLOCKED_MT", + "log.level": "informational", + "log.offset": 1892, + "network.protocol": "http", + "observer.egress.zone": "trust", + "observer.ingress.zone": "untrust", + "observer.name": "utm-srx550-b", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "192.0.2.3", + "198.51.100.2" + ], + "server.ip": "198.51.100.2", + "server.port": 80, + "service.type": "juniper", + "source.ip": "192.0.2.3", + "source.port": 58071, + "source.user.name": "user01@testuser.com", + "tags": [ + "juniper.srx", + "forwarded" + ] + }, + { + "@timestamp": "2016-02-18T23:32:50.391-02:00", + "client.ip": "192.168.1.100", + "client.port": 58071, + "destination.as.number": 55967, + "destination.as.organization.name": "Beijing Baidu Netcom Science and Technology Co., Ltd.", + "destination.geo.continent_name": "Asia", + "destination.geo.country_iso_code": "HK", + "destination.geo.country_name": "Hong Kong", + "destination.geo.location.lat": 22.25, + "destination.geo.location.lon": 114.1667, + "destination.ip": "103.235.46.39", + "destination.port": 80, + "event.action": "web_filter", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-address=\"192.168.1.100\" source-port=\"58071\" destination-address=\"103.235.46.39\" destination-port=\"80\" category=\"cat1\" reason=\"BY_BLACK_LIST\" profile=\"uf1\" url=\"www.baidu.com\" obj=\"/\" username=\"user01\" roles=\"N/A\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.category": "cat1", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile": "uf1", + "juniper.srx.reason": "BY_BLACK_LIST", + "juniper.srx.tag": "WEBFILTER_URL_BLOCKED_LS", + "log.level": "warning", + "log.offset": 2317, + "observer.name": "utm-srx550-b", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "www.baidu.com" + ], + "related.ip": [ + "192.168.1.100", + "103.235.46.39" + ], + "server.ip": "103.235.46.39", + "server.port": 80, + "service.type": "juniper", + "source.ip": "192.168.1.100", + "source.port": 58071, + "source.user.name": "user01", + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "www.baidu.com", + "url.path": "/" + }, + { + "@timestamp": "2011-02-08T06:29:28.565-02:00", + "client.ip": "188.40.238.250", + "client.port": 80, + "destination.ip": "10.1.1.103", + "destination.port": 47095, + "event.action": "virus_detected", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-address=\"188.40.238.250\" source-port=\"80\" destination-address=\"10.1.1.103\" destination-port=\"47095\" source-zone-name=\"untrust\" filename=\"www.eicar.org/download/eicar.com\" temporary-filename=\"www.eicar.org/download/eicar.com\" name=\"EICAR-Test-File\" url=\"EICAR-Test-File\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "file.name": "www.eicar.org/download/eicar.com", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.name": "EICAR-Test-File", + "juniper.srx.process": "RT_UTM", + "juniper.srx.tag": "AV_VIRUS_DETECTED_MT_LS", + "juniper.srx.temporary_filename": "www.eicar.org/download/eicar.com", + "log.level": "warning", + "log.offset": 2639, + "observer.ingress.zone": "untrust", + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "EICAR-Test-File" + ], + "related.ip": [ + "188.40.238.250", + "10.1.1.103" + ], + "server.ip": "10.1.1.103", + "server.port": 47095, + "service.type": "juniper", + "source.as.number": 24940, + "source.as.organization.name": "Hetzner Online GmbH", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", + "source.geo.location.lat": 51.2993, + "source.geo.location.lon": 9.491, + "source.ip": "188.40.238.250", + "source.port": 80, + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "EICAR-Test-File" + }, + { + "@timestamp": "2020-07-14T12:16:18.345-02:00", + "client.ip": "10.1.1.100", + "client.port": 58974, + "destination.as.number": 13335, + "destination.as.organization.name": "Cloudflare, Inc.", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "104.26.15.142", + "destination.port": 443, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-zone=\"trust\" destination-zone=\"untrust\" source-address=\"10.1.1.100\" source-port=\"58974\" destination-address=\"104.26.15.142\" destination-port=\"443\" session-id=\"16297\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" category=\"Enhanced_Information_Technology\" reason=\"BY_SITE_REPUTATION_MODERATELY_SAFE\" profile=\"WCF1\" url=\"datawrapper.dwcdn.net\" obj=\"/\" username=\"N/A\" roles=\"N/A\" application-sub-category=\"N/A\" urlcategory-risk=\"0\"", + "event.outcome": "success", + "event.risk_score": "0", + "event.severity": "14", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.category": "Enhanced_Information_Technology", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile": "WCF1", + "juniper.srx.reason": "BY_SITE_REPUTATION_MODERATELY_SAFE", + "juniper.srx.session_id": "16297", + "juniper.srx.tag": "WEBFILTER_URL_PERMITTED", + "log.level": "informational", + "log.offset": 3013, + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "datawrapper.dwcdn.net" + ], + "related.ip": [ + "10.1.1.100", + "104.26.15.142" + ], + "server.ip": "104.26.15.142", + "server.port": 443, + "service.type": "juniper", + "source.ip": "10.1.1.100", + "source.port": 58974, + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "datawrapper.dwcdn.net", + "url.path": "/" + }, + { + "@timestamp": "2020-07-14T12:16:29.541-02:00", + "client.ip": "10.1.1.100", + "client.port": 59075, + "destination.as.number": 24961, + "destination.as.organization.name": "myLoc managed IT AG", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", + "destination.geo.location.lat": 51.2993, + "destination.geo.location.lon": 9.491, + "destination.ip": "85.114.159.93", + "destination.port": 443, + "event.action": "web_filter", + "event.category": [ + "network", + "malware" + ], + "event.dataset": "juniper.srx", + "event.kind": "alert", + "event.module": "juniper", + "event.original": "source-zone=\"trust\" destination-zone=\"untrust\" source-address=\"10.1.1.100\" source-port=\"59075\" destination-address=\"85.114.159.93\" destination-port=\"443\" session-id=\"16490\" application=\"UNKNOWN\" nested-application=\"UNKNOWN\" category=\"Enhanced_Advertisements\" reason=\"BY_SITE_REPUTATION_SUSPICIOUS\" profile=\"WCF1\" url=\"dsp.adfarm1.adition.com\" obj=\"/\" username=\"N/A\" roles=\"N/A\" application-sub-category=\"N/A\" urlcategory-risk=\"3\"", + "event.outcome": "success", + "event.risk_score": "3", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "info", + "denied", + "connection" + ], + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.category": "Enhanced_Advertisements", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile": "WCF1", + "juniper.srx.reason": "BY_SITE_REPUTATION_SUSPICIOUS", + "juniper.srx.session_id": "16490", + "juniper.srx.tag": "WEBFILTER_URL_BLOCKED", + "log.level": "warning", + "log.offset": 3552, + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.hosts": [ + "dsp.adfarm1.adition.com" + ], + "related.ip": [ + "10.1.1.100", + "85.114.159.93" + ], + "server.ip": "85.114.159.93", + "server.port": 443, + "service.type": "juniper", + "source.ip": "10.1.1.100", + "source.port": 59075, + "tags": [ + "juniper.srx", + "forwarded" + ], + "url.domain": "dsp.adfarm1.adition.com", + "url.path": "/" + }, + { + "@timestamp": "2020-07-14T12:17:04.733-02:00", + "client.ip": "23.209.86.45", + "client.port": 80, + "destination.ip": "10.1.1.100", + "destination.port": 58954, + "event.category": [ + "network" + ], + "event.dataset": "juniper.srx", + "event.kind": "event", + "event.module": "juniper", + "event.original": "source-zone=\"trust\" destination-zone=\"untrust\" source-address=\"23.209.86.45\" source-port=\"80\" destination-address=\"10.1.1.100\" destination-port=\"58954\" profile-name=\"Custom-Sophos-Profile\" filename=\"download.cdn.mozilla.net/pub/firefox/releases/78.0.2/update/win64/de/firefox-78.0.2.complete.mar\" action=\"BLOCKED\" reason=\"exceeding maximum content size\" error-code=\"7\" username=\"N/A\" roles=\"N/A\"", + "event.outcome": "success", + "event.severity": "12", + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "file.name": "download.cdn.mozilla.net/pub/firefox/releases/78.0.2/update/win64/de/firefox-78.0.2.complete.mar", + "fileset.name": "srx", + "input.type": "log", + "juniper.srx.action": "BLOCKED", + "juniper.srx.error_code": "7", + "juniper.srx.process": "RT_UTM", + "juniper.srx.profile_name": "Custom-Sophos-Profile", + "juniper.srx.reason": "exceeding maximum content size", + "juniper.srx.tag": "AV_FILE_NOT_SCANNED_DROPPED_MT", + "log.level": "warning", + "log.offset": 4078, + "observer.egress.zone": "untrust", + "observer.ingress.zone": "trust", + "observer.name": "SRX650-1", + "observer.product": "SRX", + "observer.type": "firewall", + "observer.vendor": "Juniper", + "related.ip": [ + "23.209.86.45", + "10.1.1.100" + ], + "server.ip": "10.1.1.100", + "server.port": 58954, + "service.type": "juniper", + "source.as.number": 16625, + "source.as.organization.name": "Akamai Technologies, Inc.", + "source.geo.continent_name": "Europe", + "source.geo.country_iso_code": "NL", + "source.geo.country_name": "Netherlands", + "source.geo.location.lat": 52.3824, + "source.geo.location.lon": 4.8995, + "source.ip": "23.209.86.45", + "source.port": 80, + "tags": [ + "juniper.srx", + "forwarded" + ] + } +] \ No newline at end of file diff --git a/x-pack/filebeat/modules.d/juniper.yml.disabled b/x-pack/filebeat/modules.d/juniper.yml.disabled index e3359756d90..6ffe87834a4 100644 --- a/x-pack/filebeat/modules.d/juniper.yml.disabled +++ b/x-pack/filebeat/modules.d/juniper.yml.disabled @@ -39,3 +39,16 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + srx: + enabled: true + + # Set which input to use between tcp, udp (default) or file. + #var.input: udp + + # The interface to listen to syslog traffic. Defaults to + # localhost. Set to 0.0.0.0 to bind to all available interfaces. + #var.syslog_host: localhost + + # The port to listen for syslog traffic. Defaults to 9006. + #var.syslog_port: 9006 From 4dd8061938e8aee474ef6e378fe9aae2bd4837da Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 6 Oct 2020 11:06:39 +0200 Subject: [PATCH 139/216] [Beats][pytest] Asserting if filebeat logs include errors (#20999) First iteration on tackling this issue, allowing to assert on errors in filebeat, since any test will fail afterwards anyway, and the logs should not include errors. This could be anything from Elasticsearch not being available to pipeline failing to install. --- filebeat/tests/system/test_modules.py | 48 ++++++++++++++++++--------- 1 file changed, 32 insertions(+), 16 deletions(-) diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py index d449258c40f..fa3caa93475 100644 --- a/filebeat/tests/system/test_modules.py +++ b/filebeat/tests/system/test_modules.py @@ -131,22 +131,29 @@ def run_on_file(self, module, fileset, test_file, cfgfile): cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) - output = open(os.path.join(output_path, "output.log"), "ab") - output.write(bytes(" ".join(cmd) + "\n", "utf-8")) - - # Use a fixed timezone so results don't vary depending on the environment - # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, - # this can happen because UTC uses to be the default timezone in date parsers when no other - # timezone is specified. - local_env = os.environ.copy() - local_env["TZ"] = 'Etc/GMT+2' - - subprocess.Popen(cmd, - env=local_env, - stdin=None, - stdout=output, - stderr=subprocess.STDOUT, - bufsize=0).wait() + # Runs inside a with block to ensure file is closed afterwards + with open(os.path.join(output_path, "output.log"), "ab") as output: + output.write(bytes(" ".join(cmd) + "\n", "utf-8")) + + # Use a fixed timezone so results don't vary depending on the environment + # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, + # this can happen because UTC uses to be the default timezone in date parsers when no other + # timezone is specified. + local_env = os.environ.copy() + local_env["TZ"] = 'Etc/GMT+2' + + subprocess.Popen(cmd, + env=local_env, + stdin=None, + stdout=output, + stderr=subprocess.STDOUT, + bufsize=0).wait() + + # List of errors to check in filebeat output logs + errors = ["Error loading pipeline for fileset"] + # Checks if the output of filebeat includes errors + contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) + assert contains_error is False, "Error found in log:{}".format(error_line) # Make sure index exists self.wait_until(lambda: self.es.indices.exists(self.index_name)) @@ -305,5 +312,14 @@ def delete_key(obj, key): del obj[key] +def file_contains(filepath, strings): + with open(filepath, 'r') as file: + for line in file: + for string in strings: + if string in line: + return True, line + return False, None + + def pretty_json(obj): return json.dumps(obj, indent=2, separators=(',', ': ')) From 804db767212ff046c93ca77d48eca1716f08b7f2 Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 6 Oct 2020 11:52:06 +0200 Subject: [PATCH 140/216] [Filebeat][New Module] Add support for Microsoft MTP / 365 Defender (#21446) * Initial commit for mtp mvp * first finished MVP version of MTP module * updating m365_defender with new fields and new name * reverting some files that shouldnt be added * removing dhcp generated logs from PR * converting two fields to strings and updating some default template configurations * adding changelog entry * Initial commit for mtp mvp * first finished MVP version of MTP module * updating m365_defender with new fields and new name * reverting some files that shouldnt be added * removing dhcp generated logs from PR * converting two fields to strings and updating some default template configurations * adding changelog entry * updating typo Co-authored-by: Marc Guasch --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 427 ++++++++++++ filebeat/docs/modules/microsoft.asciidoc | 83 ++- x-pack/filebeat/filebeat.reference.yml | 15 +- .../module/microsoft/_meta/config.yml | 15 +- .../module/microsoft/_meta/docs.asciidoc | 83 ++- x-pack/filebeat/module/microsoft/fields.go | 2 +- .../microsoft/m365_defender/_meta/fields.yml | 176 +++++ .../m365_defender/config/defender.yml | 43 ++ .../m365_defender/ingest/pipeline.yml | 301 +++++++++ .../microsoft/m365_defender/manifest.yml | 17 + .../test/m365_defender-test.ndjson.log | 9 + ...365_defender-test.ndjson.log-expected.json | 611 ++++++++++++++++++ .../filebeat/modules.d/microsoft.yml.disabled | 15 +- 14 files changed, 1790 insertions(+), 8 deletions(-) create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/_meta/fields.yml create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/ingest/pipeline.yml create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/manifest.yml create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log create mode 100644 x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log-expected.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 07e7bc4be0d..c86fc85e347 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -608,6 +608,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Convert aws s3 to v2 input {pull}20005[20005] - New Cisco Umbrella dataset {pull}21504[21504] - New juniper.srx dataset for Juniper SRX logs. {pull}20017[20017] +- Adding support for Microsoft 365 Defender (Microsoft Threat Protection) {pull}21446[21446] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index a2f19000095..e7c2d35ff37 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -95523,6 +95523,433 @@ type: keyword -- +[float] +=== microsoft.m365_defender + +Module for ingesting Microsoft Defender ATP. + + + +*`microsoft.m365_defender.incidentId`*:: ++ +-- +Unique identifier to represent the incident. + + +type: keyword + +-- + +*`microsoft.m365_defender.redirectIncidentId`*:: ++ +-- +Only populated in case an incident is being grouped together with another incident, as part of the incident processing logic. + + +type: keyword + +-- + +*`microsoft.m365_defender.incidentName`*:: ++ +-- +Name of the Incident. + + +type: keyword + +-- + +*`microsoft.m365_defender.determination`*:: ++ +-- +Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other. + + +type: keyword + +-- + +*`microsoft.m365_defender.investigationState`*:: ++ +-- +The current state of the Investigation. + + +type: keyword + +-- + +*`microsoft.m365_defender.assignedTo`*:: ++ +-- +Owner of the alert. + + +type: keyword + +-- + +*`microsoft.m365_defender.tags`*:: ++ +-- +Array of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic. + + +type: keyword + +-- + +*`microsoft.m365_defender.status`*:: ++ +-- +Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. + + +type: keyword + +-- + +*`microsoft.m365_defender.classification`*:: ++ +-- +Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.incidentId`*:: ++ +-- +Unique identifier to represent the incident this alert is associated with. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.resolvedTime`*:: ++ +-- +Time when alert was resolved. + + +type: date + +-- + +*`microsoft.m365_defender.alerts.status`*:: ++ +-- +Categorize alerts (as New, Active, or Resolved). + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.severity`*:: ++ +-- +The severity of the related alert. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.creationTime`*:: ++ +-- +Time when alert was first created. + + +type: date + +-- + +*`microsoft.m365_defender.alerts.lastUpdatedTime`*:: ++ +-- +Time when alert was last updated. + + +type: date + +-- + +*`microsoft.m365_defender.alerts.investigationId`*:: ++ +-- +The automated investigation id triggered by this alert. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.userSid`*:: ++ +-- +The SID of the related user + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.detectionSource`*:: ++ +-- +The service that initially detected the threat. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.classification`*:: ++ +-- +The specification for the incident. The property values are: Unknown, FalsePositive, TruePositive or null. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.investigationState`*:: ++ +-- +Information on the investigation's current status. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.determination`*:: ++ +-- +Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other or null + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.assignedTo`*:: ++ +-- +Owner of the incident, or null if no owner is assigned. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.actorName`*:: ++ +-- +The activity group, if any, the associated with this alert. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.threatFamilyName`*:: ++ +-- +Threat family associated with this alert. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.mitreTechniques`*:: ++ +-- +The attack techniques, as aligned with the MITRE ATT&CK™ framework. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.entityType`*:: ++ +-- +Entities that have been identified to be part of, or related to, a given alert. The properties values are: User, Ip, Url, File, Process, MailBox, MailMessage, MailCluster, Registry. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.accountName`*:: ++ +-- +Account name of the related user. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.mailboxDisplayName`*:: ++ +-- +The display name of the related mailbox. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.mailboxAddress`*:: ++ +-- +The mail address of the related mailbox. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.clusterBy`*:: ++ +-- +A list of metadata if the entityType is MailCluster. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.sender`*:: ++ +-- +The sender for the related email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.recipient`*:: ++ +-- +The recipient for the related email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.subject`*:: ++ +-- +The subject for the related email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.deliveryAction`*:: ++ +-- +The delivery status for the related email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.securityGroupId`*:: ++ +-- +The Security Group ID for the user related to the email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.securityGroupName`*:: ++ +-- +The Security Group Name for the user related to the email message. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.registryHive`*:: ++ +-- +Reference to which Hive in registry the event is related to, if eventType is registry. Example: HKEY_LOCAL_MACHINE. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.registryKey`*:: ++ +-- +Reference to the related registry key to the event. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.registryValueType`*:: ++ +-- +Value type of the registry key/value pair related to the event. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.deviceId`*:: ++ +-- +The unique ID of the device related to the event. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.entities.ipAddress`*:: ++ +-- +The related IP address to the event. + + +type: keyword + +-- + +*`microsoft.m365_defender.alerts.devices`*:: ++ +-- +The devices related to the investigation. + + +type: flattened + +-- + [[exported-fields-misp]] == MISP fields diff --git a/filebeat/docs/modules/microsoft.asciidoc b/filebeat/docs/modules/microsoft.asciidoc index 513ca155be6..5edbbf027d0 100644 --- a/filebeat/docs/modules/microsoft.asciidoc +++ b/filebeat/docs/modules/microsoft.asciidoc @@ -12,7 +12,8 @@ This file is generated! See scripts/docs_collector.py This is a module for ingesting data from the different Microsoft Products. Currently supports these filesets: -- `defender_atp` fileset: Supports Microsoft Defender ATP +- `defender_atp` fileset: Supports Microsoft Defender for Endpoint (Microsoft Defender ATP) +- `m365_defender` fileset: Supports Microsoft 365 Defender (Microsoft Threat Protection) - `dhcp` fileset: Supports Microsoft DHCP logs include::../include/what-happens.asciidoc[] @@ -25,6 +26,84 @@ include::../include/configuring-intro.asciidoc[] include::../include/config-option-intro.asciidoc[] +[float] +==== `m365_defender` fileset settings + +beta[] + +To configure access for Filebeat to Microsoft 365 Defender you will have to create a new Azure Application registration, this will again return Oauth tokens with access to the Microsoft 365 Defender API + +The procedure to create an application is found on the below link: + +https://docs.microsoft.com/en-us/microsoft-365/security/mtp/api-create-app-web?view=o365-worldwide#create-an-app[Create a new Azure Application] + +When giving the application the API permissions described in the documentation (Incident.Read.All) it will only grant access to read Incidents from 365 Defender and nothing else in the Azure Domain. + +After the application has been created, it should contain 3 values that you need to apply to the module configuration. + +These values are: + +- Client ID +- Client Secret +- Tenant ID + +Example config: + +[source,yaml] +---- +- module: microsoft + m365_defender: + enabled: true + var.oauth2.client.id: "123abc-879546asd-349587-ad64508" + var.oauth2.client.secret: "980453~-Sg99gedf" + var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token" +---- + +*`var.oauth2.client.id`*:: + +This is the client ID related to creating a new application on Azure. + +*`var.oauth2.client.secret`*:: + +The secret related to the client ID. + +*`var.oauth2.token_url`*:: + +A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL. + +[float] +==== 365 Defender ECS fields + +This is a list of 365 Defender fields that are mapped to ECS. + +[options="header"] +|====================================================================== +| 365 Defender Fields | ECS Fields | +| lastUpdateTime | @timestamp | +| severity | event.severity | +| createdTime | event.created | +| alerts.category | threat.technique.name | +| alerts.description | rule.description | +| alerts.serviceSource | event.provider | +| alerts.alertId | event.id | +| alerts.firstActivity | event.start | +| alerts.lastActivity | event.end | +| alerts.title | message | +| entities.processId | process.pid | +| entities.processCommandLine | process.command_line | +| entities.processCreationTime | process.start | +| entities.parentProcessId | process.parent.pid | +| entities.parentProcessCreationTime | process.parent.start | +| entities.sha1 | file.hash.sha1 | +| entities.sha256 | file.hash.sha256 | +| entities.url | url.full | +| entities.filePath | file.path | +| entities.fileName | file.name | +| entities.userPrincipalName | host.user.name | +| entities.domainName | host.user.domain | +| entities.aadUserId | host.user.id | +|====================================================================== + [float] ==== `defender_atp` fileset settings @@ -114,7 +193,7 @@ This module comes with a sample dashboard for Defender ATP. [role="screenshot"] image::./images/filebeat-defender-atp-overview.png[] -The best way to view Defender ATP events and alert data is in the SIEM. +The best way to view Defender ATP events and alert data is in the SIEM. [role="screenshot"] image::./images/siem-alerts-cs.jpg[] diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index cc994b45cac..2ffff82135e 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -1118,7 +1118,20 @@ filebeat.modules: # Oauth Client Secret #var.oauth2.client.secret: "" - + + # Oauth Token URL, should include the tenant ID + #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" + m365_defender: + enabled: true + # How often the API should be polled + #var.interval: 5m + + # Oauth Client ID + #var.oauth2.client.id: "" + + # Oauth Client Secret + #var.oauth2.client.secret: "" + # Oauth Token URL, should include the tenant ID #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" dhcp: diff --git a/x-pack/filebeat/module/microsoft/_meta/config.yml b/x-pack/filebeat/module/microsoft/_meta/config.yml index 8e793bd2f9c..ee06eea9228 100644 --- a/x-pack/filebeat/module/microsoft/_meta/config.yml +++ b/x-pack/filebeat/module/microsoft/_meta/config.yml @@ -10,7 +10,20 @@ # Oauth Client Secret #var.oauth2.client.secret: "" - + + # Oauth Token URL, should include the tenant ID + #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" + m365_defender: + enabled: true + # How often the API should be polled + #var.interval: 5m + + # Oauth Client ID + #var.oauth2.client.id: "" + + # Oauth Client Secret + #var.oauth2.client.secret: "" + # Oauth Token URL, should include the tenant ID #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" dhcp: diff --git a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc index 8a3facdc259..7e646e1b4fe 100644 --- a/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/microsoft/_meta/docs.asciidoc @@ -7,7 +7,8 @@ This is a module for ingesting data from the different Microsoft Products. Currently supports these filesets: -- `defender_atp` fileset: Supports Microsoft Defender ATP +- `defender_atp` fileset: Supports Microsoft Defender for Endpoint (Microsoft Defender ATP) +- `m365_defender` fileset: Supports Microsoft 365 Defender (Microsoft Threat Protection) - `dhcp` fileset: Supports Microsoft DHCP logs include::../include/what-happens.asciidoc[] @@ -20,6 +21,84 @@ include::../include/configuring-intro.asciidoc[] include::../include/config-option-intro.asciidoc[] +[float] +==== `m365_defender` fileset settings + +beta[] + +To configure access for Filebeat to Microsoft 365 Defender you will have to create a new Azure Application registration, this will again return Oauth tokens with access to the Microsoft 365 Defender API + +The procedure to create an application is found on the below link: + +https://docs.microsoft.com/en-us/microsoft-365/security/mtp/api-create-app-web?view=o365-worldwide#create-an-app[Create a new Azure Application] + +When giving the application the API permissions described in the documentation (Incident.Read.All) it will only grant access to read Incidents from 365 Defender and nothing else in the Azure Domain. + +After the application has been created, it should contain 3 values that you need to apply to the module configuration. + +These values are: + +- Client ID +- Client Secret +- Tenant ID + +Example config: + +[source,yaml] +---- +- module: microsoft + m365_defender: + enabled: true + var.oauth2.client.id: "123abc-879546asd-349587-ad64508" + var.oauth2.client.secret: "980453~-Sg99gedf" + var.oauth2.token_url: "https://login.microsoftonline.com/INSERT-TENANT-ID/oauth2/token" +---- + +*`var.oauth2.client.id`*:: + +This is the client ID related to creating a new application on Azure. + +*`var.oauth2.client.secret`*:: + +The secret related to the client ID. + +*`var.oauth2.token_url`*:: + +A predefined URL towards the Oauth2 service for Microsoft. The URL should always be the same with the exception of the Tenant ID that needs to be added to the full URL. + +[float] +==== 365 Defender ECS fields + +This is a list of 365 Defender fields that are mapped to ECS. + +[options="header"] +|====================================================================== +| 365 Defender Fields | ECS Fields | +| lastUpdateTime | @timestamp | +| severity | event.severity | +| createdTime | event.created | +| alerts.category | threat.technique.name | +| alerts.description | rule.description | +| alerts.serviceSource | event.provider | +| alerts.alertId | event.id | +| alerts.firstActivity | event.start | +| alerts.lastActivity | event.end | +| alerts.title | message | +| entities.processId | process.pid | +| entities.processCommandLine | process.command_line | +| entities.processCreationTime | process.start | +| entities.parentProcessId | process.parent.pid | +| entities.parentProcessCreationTime | process.parent.start | +| entities.sha1 | file.hash.sha1 | +| entities.sha256 | file.hash.sha256 | +| entities.url | url.full | +| entities.filePath | file.path | +| entities.fileName | file.name | +| entities.userPrincipalName | host.user.name | +| entities.domainName | host.user.domain | +| entities.aadUserId | host.user.id | +|====================================================================== + [float] ==== `defender_atp` fileset settings @@ -109,7 +188,7 @@ This module comes with a sample dashboard for Defender ATP. [role="screenshot"] image::./images/filebeat-defender-atp-overview.png[] -The best way to view Defender ATP events and alert data is in the SIEM. +The best way to view Defender ATP events and alert data is in the SIEM. [role="screenshot"] image::./images/siem-alerts-cs.jpg[] diff --git a/x-pack/filebeat/module/microsoft/fields.go b/x-pack/filebeat/module/microsoft/fields.go index 2576fcb8ac7..d76c98c273d 100644 --- a/x-pack/filebeat/module/microsoft/fields.go +++ b/x-pack/filebeat/module/microsoft/fields.go @@ -19,5 +19,5 @@ func init() { // AssetMicrosoft returns asset data. // This is the base64 encoded gzipped contents of module/microsoft. func AssetMicrosoft() string { - return "eJzsfV1zGzmS4Pv8Clw/nO0JNz3t/tgb3+xeaCX3tm5tt9ayuzcuJqICRCVJjFBAGUCRYv/6CyRQxSILRUoUQMl754duWyITmQkgkd/5LbmB9RtScaaVUTP7J0IstwLekPe9H5VgmOa15Uq+If/yJ0LI5tfkvSobAX8iZMZBlOYN/tr9+ZZIWkEP+KSEGcgSdEFt3X2MELuu4Q2Za9X0f6pBADXwhkzB0t7PS5jRRtgCl3tDZlQY2Pr1ANf2j8eUzJQmXM7BWC7nPUIuAnbk7NPVpPfFXbr6tAlq7Oe6pBY+8Qq2PtLS5X6584s9OLo/nxaA3yJUlsTyCshzLsnnT+cviF0AoQK0JStqcHXS4PLlBuMoohqMEksos6LJJVktOFsgmsZS2xiiZjtIswWVcyiJVeTZx4DVswPYc8l4CdJellHcb2C9Unr3d3dA/zLAJZcXLaJnDtGD6Czd6ZlTBzs9Tj3gDjENwm2wY9hRCF7b4dY+EEfWaO3Y5vYYWs5tIX4AQWoMn0soP6l0iP26kqC3ztsBJPwJTYfAdQ2MzzgYxKDPo517MCFXyhg+FUCWVDRgCNXwhjz7LG+kWslnL8mzD7By/7uUV1rNNRjzDK/ZnW8ME47FM85wN5LT6MHel6ifnay+UoZbvgT3g0+62fz7AEUlWNAVl3kICpu2tcidyPug7NmSckGnAkk6q63733sqVlTjT66BNZrb9RVoo6QE0f/hJ/8MuR99lisqLZTXambb7/5qF6APccYuNFD7M624WH+gI/L9yLvuIJMZgj70wkwp+zf3hqdF4bMB7XWDXUGI27IfJ1g68c5gUqqKcpkWswuEiSs9BDVen5Wlu+FRzHh9P6Qurwj14NwjgKLCPcv3RYrS0jE+5du2eWIbt6UPwo4x1Uib/qDhXqbCEqR1F3xdJ3583dcdku1Cd0TH0XOlnSZVU5GWdR1Yck8GtkhKsCulbyZcWtAzymAitxFUS9Arza2TdrqBgfEwRPt4M+FDj4aAGOkQI6sFaMDfWU1nM87IghoyBZBETQ3oZV8V72SjofcgZtcSOkDK0D7ZqIHWnWmxRd746mPr7zeBKjPfORD7VrjHOfu04MZ9jnDjzhIKV0Zr2wT+a7oiFRhD5+7f1BKmKnBizwvhwSl9p+bkApgqQccJ8bD4LlLHkrO5gSBt4UhLDDggnJn7geVBqVXSgrSoznJpLJW2RcPEdZOhvXkXBA9Zo4gd9zih6UltMD0pMWCM094W3BpCyQewv3Mr3YsYdn8SEauBWLNQjSiJhCVoMoXu3NVUGyDvwVKHGiUzrareUs/fqbl5dUXZDVjzYqgpcA3MivVLYgPelHwELyz8CZc9NCdxTwMsQRzBSaHk7v3c4uQF1BoYKi8OkxJmXEJJlBSIlnV6LaloHceqMvMi2YXZs8fvwz2/vPjOq9/+xqPxvtHe4ZYyS4Sa+/3Sg41A6jjq9v604OfcdtRUW84aQTV+P2zsZPRkDEAfdVJiJ2MAefykjG7J8rR78vr/78n+PXGr5tmQh11fNf1HgYTsbsuTwW5JjxF62VHTYFSjWaa39+Fsy3X/H4YZugsrkPYpIkebktsC/WZPET2QVq+fImILp1M9RcS4PA6xvBpTKzme7kkrgR4jPfKybQZQprShRvSamJ3Z+2DrFnDYDPSQgZLwMCtiRw8ZQD9gRYxzUQ59PyfgYt8zFGWfZ9eAzETsIxEO3pt97BRqdSP5lwY2arTu6A8/Wm8btedKMvc4UKueumU7Im6WPK847HP3fCsu1h7Id2pO3i5BWnKNwpk0mAhASa0hCKoB6TN+CyUxYB2QrS9vr2HGDZZ2EwawH2ywdJswAH2vTRl6AtP7l447mAO67sGT+/FgoUwmfbV/Ln9RxvZFpNg9kQZkyeW8/aWJHZueD+nr4e8gwnUX7u4Pi/UZe3m1/KELiY1d913mDqi36mtl7vKn3Oz96f9d9tphcC+DbNiVC96R1veWlYSSOV+C7JxkX68i4Fh0nP8irwVSPkXl7+uIaIw6NFS9LjR8ybDX/eAhbjDSPV0jl9/6pckVXqSXwZttKfm0roEwOpQgUyDA7QI0+Xwp7Xc/EaXJz0JR+/1rMqUGT1EbIJvxeaOHWUpDuo9Rd79iujEMms/4TOBfcN+eq1xutn3WcbvyV+9gUHpFdZlNqetJtB7ZfU5eXv22pe9RzM3a3VJCzNpYqMIjGtB20BbgT6rxzHP/VprPuaSi/c62tnKAD7n0rz2JEZdXv/0UYUFAf8CJh7Ogw2jI5RSvz+agDhXHY1+fBdAS9Eli17/gUuTy4iFRUo9vP1iKYI6LlT5pJ5tgRXY/G20VrcuNooUXxZku50oIYFbpr1EAO+49Qs6NO3PcEOZZ59P9thTVd2pXbSF7GP0ELb6KTZ+Kqlopg8lulZJkuh5sGiEavjRgrANoeFWLddgn92EsfwLKFsTwEsjzvxC70A15/eOPL7A8xwDIbpU9nHgSyusdOGFqJQ3kYwX7ak4F5kx3PoWmmoZqGV6FR2gXAnlOp2oJPWb4JN7hKx/Em7EaaDV6f9hXc2wemVVQ8mZXT0vBqG9immPnWOAzwu3fm9d/+e6vxov0VzUK0Bbpvw+o+buzB9/RNWjymryVjNamET6y4kzKe8n1GPQHBj8iuZWxVb5/Tf7ZkfuSfP89+WfClMZyDtwmv+hL8t+F/Z/ug9yQbaZ8E91CqUp4srauXEHBqBBTym7yasAeOaksXhtqvV3hmAiyrBWXtq2ciSKKh6MArVWm/LSNPmhqYJwKxBgxNVZpp1nLtdc63C+WVPDSH4wYUoTMVCNL98IIQOS5nAfl6GDy4vaNGEBOEQsM12FP2GhkF9ZC0fKpvHMBHWL4H0AqsJqziNURTOH+h9EW9s99K4Tds0/tRqNVs3bbJuQXtXJbM7Q5uSRKO2PMKnIDUB9g2pN48b4SpmnFwJhiycuizBV1fdtKnjlI0NTiJS8dB3t24ZJr21DhjPYt37uMuDh4xZ3Z7WsUHTM8FeGqYwF3rcGgQwWZRvUcbPexg5wwOlPS06NzwmfC7eeEzhIKGgr+TXniR6iUBXIdzjvTgA/tdD0mKN2fNhDzFQRewkqFqQXPmdnwpM15wwdq/5PQzZzMzXje8da5NyCc9fbUtVZLeEL+a0QYvXiZcfEIMXq3qjOOrs7ProLuy6h07OFVrfSuxkvwifzq0iCap+H++OyfKjTE0XSPuVK3Tflm85WNwe71HLTMJ+T1jz+RFfK9AioJFSLuKwjdINSMbPxHZAUaPFhqiQBqLFFyp1xkm4mPriZ+3UyM3NUcYdvAu9+VLpFxmNUEbCGVUPP1biBuxvVAiyXkR8IWVFNmPRPdpV4j/ug0l6SRIadHbPnMRytqUxd0+0B9ziDCntglWhSVUzKVbMMImq5GZRpK1h21kjLUWH2MQgafg2Ks0S1EY6ksqS6JVLqigv8Ry+9VuorypwxZDkezSDXTwZN0LyZtsO6QeSX4DEITrojTkSlZjijYm+0ujM3pZ9lDEJdMVbUAGz0Ao05Uigq81XxHDPbqzbR9pIN87daOHuexo7x9MkePX6WkXSTapk19aqqcl02WU/lIjH/bdqNLy3YH8g8lc3db2CMW3eqtiunTawfN/AYiKtuNPiMWbm24fGQJ2vTKKcp9eWCR/X3oYVsDTUXmpkyPKV1Cme8dDEk24Zky3YqtjtFm2nQf7MfXh6+VVtUEoTZYlG8YSKq58mp91QjLv7UcNKF1Ldrql00vm4pKOo+V5hIiMLzT2oseKY+rIdw+M0StpI+MWVrVu57BgLFbzaE4vH3WELbgzrpRJZgJed8Yi2ZSH6i7ldSO5OVSC0du0l4BNps5vJdwCk0IN7ld0PNOwww0SOYPBHWqdcmXvHSaDZ6HuCC7bgXZpx3mxYm8rbk+GYWb/fSxoFt3ErkVa0+scULP6WsOqZ0mkiTiG0246aMunJdOGnfybDJYsksnU01qCVQNFLmHQuz4n/qqoAb5pYHmZEfJnW5/ijbycUUNQSTKkXODyH2XmqkJlYIthmaQafPKZnh951UOXOsiA6p1kUN7rlOKom2gr5NDzaAr9V6RxzEhd8zH6BszeC7v9eYcKzYPybVjggWbB2KnG0JqRxBlkVa7D1esTSNyh51GrCjVWKYqeOVx6IwXzMpWs8EJoTKwYMuAHDkgsATNbc7SkT2EtauHIsBeZGefyydv8eKgd6B/pbtKF2xjSo0PwM74xvCJa7c+mDPWUyXoyvmzmSIb0LkYebkpmGhdVGUIskTxDmbzqTbht20rvW8JKk1+vQ6psdy0CQG7fjVcv92hsSpJU2ND79ORhfqgw0qWm4b03d0d7cLTCFvka110T1Ekmwo0Z/eVRVHaTlDFtoewfiVbdzO8WPL3e0DaEmSJIzkOyi01/ccjdK9pQ7tq+g9gcTvaIZa/FnzA7tAIeg9iXtLn7FX3zfBChqr/IGaCl2tBu9xiqSyhZBE6XsQTaIWaF22iyqMI9fYg3luon6Jnypbsw6b7vms1io+44q8EZ+vct2ePXLhCBEJzbdmfJtBHUzciZ950nIEfGwFk0BG9E6dKWrjNrbF2CF1K76/b9EOlZWncf/BRpaJFKNYA5sDj7EfvFBJWuWXBWOASVr1QPyoh1mo+bSz0JMQwRz9MDXLaev/5i4sOU9Nkwm4zToVna1u5j2loCO7mF3lk+vpbxLjFCjDHsLbhoNnkfOkl6Am5Buj69E/oHLCVd8h0nynd4jCA3YIJk2B8n3///V7fCqXJVKsVzgAIPw26pje7RvtJX5ZXVNvUbroOcGqPSrhTalAdeqo7pUTZqY25rpSqIQQUc73FZzKMCGuzi/Rm0fAzH94K4qPXBACTkCIKc0mkkt9qqAEtmX3ZDyYyIitvH/3YAC2vx73iPsLWhn8GlK24XQRl2ct6coELTrHaRBIlv50r9/c9LwEqKUVEccxIN+0FA18hAg5JNSM4KIWDmXTTpXwQM4r5kU1d74DxuS/na4wzYnzJqE+2KYP4DYynhInG2PZAhn8Mtgm/wo3byVATHfwbTvHF346rQCfXfvwNi1v0vi1TPqXs2SHDy2F5gVgQaoxiHP2lbjei9iRu2Dt+A28IJfVibTijgpTc3LwktcaZKC8JWPYsrihTTY+pvbznQ+/rbDStwII2pKYGu3gZbOTgexEwVVVOiqmtoP2wtAYs26vu+ffgsTS+3h5meJi8+GaqqpvhHcywbZSsuCzVKuTTMiUZ1PZll0kxyowBmbNGiDX50lDhnZ9lb5oY0t0uJNTI09X3eqZSl/aQ7lTCd1zeQBlqgdpEdGrQOxUMFPebbzrUJrzct3Fi0BUiq6jrT3byboldBFr0fr1+LLx+rYPnlVwP2/V0QWc/pDDTaIQRF2tYE7H153+/pv19Yk17xkX+O96R/DOu1l1jDWXDgLSRI4i72wxoTkUReU2zPSLXuGSrNu++j70H0L0wo34BYDfmqJYDKTzGYXX30C2oWXQ3FOfnDd+Hhi185m9bY9OVGZ63kHZahDlCumUmRjP3re7fw0pT4uS5JBxz7hrJBFDtfoSN8DaohQLC4O3UbWHn4eiDF37NsM/Tk36xmKqmvcmo/QcrlI3qe7xeS64bc2pPX18bQQTGPX6nCZBGrsS5X933ZBz3lHoLLrtrvGOf9zJfXpAPXtI83xl56ot+HW4v4nq1d0A/hi+/536+vECWhpK3TkwMvQfbETmfBuhJmPhD5GTBipu4kbo065y97LejuqFA26sLe/3Y0hvfJzw1jvXn3cLk8uKgJpvKP3dAk3WIvZblRqOdkHNfnxn6nQr/i/3aLCKotz/x3TfBHTdtbFe5qWz3GDVSgPGcUf5BWSmypJrTqRhUAfqmDFySWtARQWBAmqz9UbY2tK+q+pUnTlI5DaOtL+Run69fXV7t6tAktIz1HoWxuuwjBwreuRZyE2nxSJJLack1n0uKwmLkiNZK52xe+2wgv9whvWp1N4VdHfGvDpHeXcZTVqrIwfnw6yfCJRNNCU6chUG27usT8vztLa1qAW9wdK/TcxEsSu9J3C+CkbmTxzbRObV5WuKYcXPjVO4j8LpHKV7PjfkhPA0fubnZE3K1ms/noPONsIuz7Ld+LCDggNrpQoNZKFG60+Nt9ZFJo1uh9xN4Foax9yCVn3/0OsaLrhnH5UW8jOTO0Xmmqro4cd4V7krIvcIxrt6/Z5rptw4dJbE+dYbjZlTZsDErLailj5Q11se8k5ZKY+cBJ9db/EamxFFdrqh+nAy9YVd9J11peIgcESOtkZ87IUrJe8rafspx5daJoJPaMUp+2yqoer8U8rZm8qHWGqhJnhtsLLVNKsW580dRLh7N7HCLT9Ut4eWr8ffLvazNKTB0GH0eND72d8FhEb+67TuWefre4JBfDOfuHfOccamaVDHOXh2JmSe/U06SpnQ6DDyyPyQGnLsz49aROBPCyT1iGsbAmFkjyFu3PmGqBOOORNvsN25ZcFnCbWIGCG7scZrnA2ULLoymmG6RmILG+GZFNReYwRPx4Pn4u5wTikz81n03SpnMcA7V1DcXeiSNOKxOnnf5nDVoU4eiWy9hBiwLKsImIb7t8PRipMjQu7mG73HuhBKvfHVJXsFX5T/tfkm5NKQES7mIOBmmqrG9742QpsTJczNbjy3t8tgQj/GH1EJVi2zZPGekhBkNIaDQ+bKN4YdsTacVL0ELusZCLqvC40qeR26k+wVa3eHbMGurwL2v3lhuG2zMSKKEbWyDYcOmh17XpFGsnn+H0dSYZpBVTFWVu095jtG5h054L9m31mrJS+8/a7vIVWBGE6FKxY4PNN7fW/YzFxutkfXz8uKqwW2NSU+PI+vb1fPK+n+o6ZF+p6PJ+99qGgIw8dtV83yNcy8wodjv/PXVJbkcKFR9NLJ1rQ3VJfsxSFjY1VXDzpMa0vfxh4Xc6rhy70VEMVVl7oqvQcXdrtIRcCEOlxH1aJG+W4IPGZyg8rznAg6lwz6BtouH8Dkvu1DOiBOvSm01DsrAE7z86ZS8ju66yflMtdO9rz777jltIAqTNW6BNX0vgk/9mkKsvLXtwrQvceMEjpCoV7zcdoh01ZV0Sbmgw0AG6VzhBOsrZ6D1yKQFf4eO8fWni7sFY6UKDaB8AHZAUkg3MHw+GZGIvCqmTVmuk/tneFUkrQPqwW0MHNfofK+XKj1EzVXCLgc7JXaFaU5RkMBNP3vV91ylTcltV1m36YsWMIoNtttUbHhRsgkv7CfSZ4ml5uDyZFb5+W9vyfNQK/FbI5yuPOUCCzgwD+ztba2M++QL8u3Q0SB3ozA3Uq3kliFkgDXYzGK5DX1k0iajJ3DB7aaFnrdV7h9CadI7mFO2Jp9HzTXBp5o+RlF+WHiLxVySinI507SCvekYNdU4tTd/n4Qt5fIKlyUfVOmTozdtAXtZZxGkyAHtC1MFHCNyWUjbfeM+wIr80kg0Jd+rEgR5zuVy8ueXhCv2kkzdf8D9h0oq1oabyZ/j8UXL6mIm6GByfmodalvDP78iuCj6ulBOrtvhV2q2t1GDVVkx9T+dBjzbNggGtDvIUYSWVVq5u4PZb+9/pxrIJ58A/Oc///b+97OPb//8Z59zu6Sa8tEzuVL6JmXJ8sEL9nu7YD/CNuoEozK1EhFqdtJ2KemeA8rcc7HOYMLMlAZpOEspQHqupAwYV+m9IJH4QCqgxYry4XDiB3sHsPd5aqDu+qQuUTfNNNOlsNPSWJ268h3rtbM5xPpvabJ3tK35yOckPbbYZTMYbKDShGKTTd1LqHdxIGZ81NHUkprNEXssqdFuRBEyd8t74kL56H6C93dcOOSD/v9xuOpGZfaT/x7liJU9H31AZC+Sj3I42jjuPvyUOkHS1tbO9uzS57bLaG+z7LBP5gt0uw1O7uHIdNuymp8iHoZFXzPKheN128zlKsiMy4t+bRt24nLmoIV5pIXBeFZhm3NdOBXxCHqOSbzGdOtQfXSuqqqRu56oAXbyuMZND8XuA9zaf4O4Tt3hZo7TrB+K2zWV5b+qeNRsg5ullh8jGR6M3XDhLeRMY2rOuEqWJXoqCx6xX1Eth0GHp466kVVdqFzC+PrD+yvyq/ejbpJS44h8OWkqwfV/vCNfGtAjvVsbIQsNu5068yY39Byia/KxLTqLpnV1WjpL+JD2garUYwQc0Poox9EhqDYSHHsw3DL9gAYqqK4y7JYDm8G9QOuEBcgd0KZMNpV2C2babldboEtqd7XCh8KdgmSLiupUZSUd3HVNB+OLHxx9omyQTpUEZrFIfhYYzNIWUHWAZ3NstZQBrJr+IwPUmiafhOE7TiU/Xhh0L3jqByd0bqvAqZ7JkZYFZTgYJX35iYNtZELjvQd4Oq+XP8hbu0j+vjNZMKuL0iTtu96D7iAfF3m6A+CloMklhixAzrlMWBQ5BJ0jN1oWs8KsuGXJ5YcsZkKtDK3S5670YUu7zAc9Q9SFyYLLnOKEyxp0NV0nS3gfwK7ZTR7gSypynBVeF7VWVhXpQ1IIfflDgR7H9LBFtrsp1LwoczDbAU6f/8ZkUdHbwtpUboNtwO5EC8jwKFRcZkKay3xI18IUYiqK1GHRLdh/yQg8eWfwHuzUvRD7sFNX9fZh/5gR9k8ZYf9TRtj/IyPsv+aBbVUt6BRyiJQOenrzTBZVI1D5nq4zvJMt8Pomg15SNYLPqzqP9u20TCrmqZOQAmSeQykx8IWl943IwviExAw7aDTLY006wHmsSbM2TZ1hFimTXVl1FlPVKutMD7jNIEKsss4wywUbzZoswBvJbyWVygDLcAiXPzmuZHoUlj+p2i6AlhncaqqqCyYy+LAd4AxBEoSrp2ub3i3qIJsskOumyBDTYJpbzqjIUEBkCjoHydYJs676sCUV6z+gnObAe1lgG9AskH07mDxY+8TaLNCn83r5Ux4ftCmm3P41S6MxZoq0s+J2AGuVXFSbLNccoQLT6avcjPfxJ5u11QMMduH9/OmdIx44qn1ZgPtu8uk6yPVgz7iAHDaMKWY5NpHPUhZnbwPOoRuYgteYpFhkEXW8Xv5QGlsPmvkngm00ywJb8BnkMGMMOporKHmygtFt2FzmOSWVKhsBhqkc3A7A+TyDbFK1WVGbdOZ/D3osgzwJYA1zbqym6T0hG9gZND4NdS5W62y8NtiJXGeSrz4z3x/xDNCtBlplUCR9KVAutPMp16uF4qbwE2bTQ19TTbMc8HKkEDYF5KWfb58aLjeWyuRzjktjp41ONSywhQp+VlAOqE1yXNPr0W1NcmqwOLlhln7Y9bGdBvbBnNOyTH0HeJk6rNq2DsrwFvGqYFqpKktXIgc4g5nGqyJPcmToeJSDzfVN8vZMtUnfspTXptY8MVBBLbdN8uwzwSWka7GzgWqSTtTp4GLxbXq3llC+62kxEyr5c94Bz5Dy72ze5FLHAc0gcZwNnQHV5LkJQs2zHF05z3KBa6VTC7Bq2sxzXLOKG5ZDLFQmy4HNMQdCgsXmSsnhJpfhvgF06ow/DzV1Op5crVJbIFkqypQfAJ3cElXpNSOl+byIzON6MNyVBJ3+zaoLP5Q3Odikk6k3YP2I1yyHLEPhZpiJk1oYBLCppUFdeEdScnSpMe6XBVukqvMfgIbbmicPBNSgq7mm0g567qaAvMoCOP3T6zuRff68MwU0AWCt5gU1dcKBAX3QmqaGqoGKHPqdBoZ88F1HMwFPz2QHOW0L1x5kpcsMGKd3ZJoMvmHjfcMZ8gEMpE4E8AOPMxgnBr6kPwCxBq3JoGYwpQyfZxC8pk7tZTOa5bgHmpXJFWmjWawrbgLANt2IrT7MxiTvqrlkMnWhRHRa7EOB+iadqcm3c5v+WHmg6SN63UzP1HDXdfJurU05zZKH3miR4S1sDOii5Kmr3rOMrWgjQznYYJmxtErtDV4WXBpLZxk0gyXXNocavqxlhtZNVulGpnSzxtqiRTqKnjVWkY+NJIOlu+yRjMPyfqOCl+RcQ8ktOae6DN0MDbZ/j6PjJ2dl5NLYhFAEg0P0CfY3YEqQWKlOlw/BZT7Ova1qodYwGCx4kH8z1SRr6n3HM+Z46H1GOO9MwxxuSUV3Gy1sYrFy3uwOA8mOpOAGhzO0q4etxwZKxDR1rbQlw8ajhKwW1BJuSa1hNnYUHpCWe58hFDHGB6ujQ4FwGTq7j/SFFlzmnsjfQ9Wt1sfTEKvmYBegJ5vPm4VqBi8aIRKWoLtxRFaRmmoD5D1YihPB/V2lHQuev1Nz8+rKl72+IBdhxNdLYheRKUXYDPgjhNHHiLYkH8D+zq0EE9/n4aHOwrwZjuzubhEu7ok1QDVbTLjkUfxw5u4J+mvviE+chYHJEK8EbSTO+p03OMe1beIeb+C+0699D03523F3NHVNuMP84hFj321EkbCm6W6dV3FZ8gluLd6KMXfBKaZRjwikzeC6DzihWoqRiZfYPTfjOHDsn2vAEg1fGjB2T9Pu47OV798r36sMOJbHr+ol9q5Hqss73Xan7MPJY4Sxsa2fY4d28yZKecrZ/4fnG7rFLi9aoYBrx88GWg3pknjveYTd4zKlBohP1+6wIYNb1e1S+Mbj4Cu7UfAd5kr79vVRNhJCDTEAOO6M7p9Xpak0lJ1gvO+gw7RfWqLauzk0rNE4AW0f0jXoint141RIb5b0gzn4kguYAxGwBEGoMXwu/cZt5vXHjz62ZH5E+Y3r7znp00eZ9OwwayT/0sDumEQav3w9fI/rmHjcFJRWo+Glv5BMSQmYW0FW3C7GBAUhkcqQTmPXcFR50b1NC8dOlCfdEyXUnDMqiMNgxPRBLB4XO1xqZEzj4/GuXqxNHL1eOttK7WS1pn7gqeDUFAuV3SbwRlxnruEslc1QIycV+yN44v0AiL80Dlt808IgFiaA6smZMMoZ4lv37QKD5eSX8I0JOZPr7l8D6BZteSMtoeWEqapuLOi4GM7ixneE5TPPvtndC5yxuLUh3P69ef2X7/7qbN+L3na0HPsminY4p0XaiNldHTd0DZr8U+eTM68CGohc/Nanrv/Jf+blBuetU793P45MXj4k257tDkxx60zIh18/vXW0gwbvPEF/ackN01BTydZOqwzqmdjNBSHIoZfk0/s35FLa71+/JJcfLt7+5xvy+VLan34gz1eLNZHA7QI0YQtlwqg0pTUwi5/67qf/9d9ePItyBOwio4zb5QfK1ElF4+N4TObTd89rfu3P4mWLVPyKl08L6b5sOoD5kQ3j7vzAx/DdUUw31slvXNuGCvLu7EMU2T+UhHy+rONOxv9REiZx3jp0vxoRioQcFp64BU/xDd6zD3NqYUUfYUQ6nu4rclaWGv20/pTH0OmeXlbVx8Y5HxoLuTx/f+VfpdHwWEXNCaMfW04lr6mGt5tcXjlURrxfjodHToJIwkO39jgPW02s8NO1TisgeujSsuTuw1RsAra9Wf7xd+6EB8CZhHjBVbjhF9tHYIDKJtc6i1531yeNkg8BwyulbSeSB0K3xAAbbgC368OS15yY954eLuftY9KS9X6M8RJiduOpvLgBO7R8qTGKcadyer/RQMchTi5rKucw6UwnpuSMzxsNJZmuESbIErOG4nKmPrL1wKBodERbji46y9DvQCTU/fslXMkdABoqZaEImd3p84zSs7aUpqCFT8XPALq2Og/wWYYjMctQLSxyXIdc/U/qDEylZdF64vKp5bsWvKNjsrta35nwCBrsW7sALcGST+saXpLP7TP2Dh1g35Or1gE2eAl+HdPU2lE9J1AmRkzjFungF39JqBBRZaLefBAT3KjGxLwlaPcGcmkVMRYfcy7J58tRgcIwQTabvEoush1QVWcY++YAazCpM3od2AwlLv5FTJ2Kjv72DNj60QqFADlPPikScXbKR0YtdEQD9SoPFb0AjCQM0wlmhJKflV5RXQ7ndBNyNsdkL02ou/G3mEs3BbsCkHHVM3HXxPvGuJWloh+q88gQbBmPmREDCrkMea6YllBx68RSGLERJ3EpqDxFHP8ODso2QaTnohwQuO2y3ERSls6CnaMBu/3ypI5UAsMuBMt0/eDuFrGn2nLWCKoJ9osmLRLP396+eafmajaLT38HVtgFZN/eLWQ/uQX9bezh/dbh7dA9a+wCpA3J4qNomyZl54S7JfT4JcdR/2xAjyKsGsvUaTkdlhxH+LphDIwZwRk7jx/XHO24xBPEizgVd670mkQKEwa4nUI4beEIOzg6qYQBPlMr6d4VJ7diymH3RTJQlLapWqbrRzfyblLiu5ZizYDgUHb0BD/Mjj7MJTHcNhH5SbC4AIKIDlAX1BBaqtq9LnYBXBO1kpst84yz9FZJVY3k1eJMDsN9i/rTKhFOueeydPJHadMxgJKfuQByFhCbDNhwF2ev7Ajzd3I0Ybyj/1HSFUZZcB2yFtJyIUZjhBEp690fwAifr3cd6jVSc2I8IXSqclYPRIifwoIuuWpQu2SqqrWq+EiGIpwaubeSTgUWkc3I+X7cuFx2YicjkrsYbmmdJIrAFoZJh8scgWBk/Q6/3Lvbe2U392302G3KLBtpd8vZUmv0JZaBF+wYs/5OWhC+x3OQoDlrSUKGYKLfbmoBtwt8amOz3UhAdsK+mxirx4OfLU3HtN16NJpe76cpqBd+rYx0RU3Tzgi3vALj5LrX9jTUMBpECruQrCnEwY3AxoMP3AZ9x6N1TO/uRzta39+Npu8Kk2zI6Z1JCw7jQxQOaEOKNwLhDsLg66Xu9UHq9En3zl+0JLTpwzuXrJfqaQTIATneCZCv9zh+f3jLUo02OM2W3U0+6pNKkJR37A7y46THMSVtg8PYKfVYgrbjp05eudPYRVGBXahHiJLQLU8y8WiEj41uOPZS0iqr12lPVOejEsFf6xDZcy4zeUL+c/LjX/5Cnr+7OLt6QS64sVzOG24WUGIpfBQXoeYqe1+gfZEwzJadeTzCNuMHRzLGtMrsVdxX/+l2NYZBd2PQI59s6PN9rgvDtP+u7rfn+EOcYjFTKmNt0jeZYlSk6k63Q8hHWvLG+BWI0sTwiguqvXhyYtPdIYbvery8Cu+54eUpO430M+U/u4PQehF3+mJuLnm+Ooszue+uY1gjVBr2/L/BSYS/GZyF4LiBXllGGXdlKp0zMWAQskFWKz2nkv+xJ6ta5jsKd2X2EZzun6kRds+4jtaSZur687NbDl8L3+LL9y7aymr+BaiwC0Y1kFpDqSouabTgrieerqjlIK05mB4v6CmpfUcflVjf+hHqTAfXXZ1nTnDVVFtshrQhdb9YPWGzoyBs7iJRZ1CCphbKIllS2Z7z4YTPz+2KXfDsSqslL7vmYeFztK5F0FQHByM0/3HP2rZOG1dwNkTy8kRUdkuGXn92PUJmdHgoZk4uuY+eL3YV95EWcJ3SmXIo+H01T7hFnan3pV4l9DxCqNdRUWOlhhirtJf4DloFluJqz/BTE/epZ3HqK16WAk4n5d7jeneVc5Ht7cm9o+RcOx7jNORehdV6HYbkuo3OviS1oG7L3PusNAHJ9Loe8/JjKuQJ7Mk7ZNDpzrb8RRlL3lO24HLEpCtpJsnxzS6vP0vM9K81OPHh9CPf5MxMyLuS1uQ3/IfXj0olfd3p34ePJ1nQJTjNSQDV5EsDek2wB6GplTTQalTx4lRHb4HfOY28DD3wmIOsedsFUnryfV++cTxbkk6A6uYAfQzNUe+KKU55yusw2z3jbWvprSZGzjYMDy83RDdSRu1Y87J7eXzk2beRGqmxCxCLYGHm3whKVlyWamWIqYHxGWfuNy9jdYIhT3Z4QRx5Ht9Nzg15jh1hQbLNM4Shyxc9bpFG4jv+DuaUrclns934tovAVruFtMmza90KJzDYR177vqmFqGCtGh4y9yIOON71AYhU/29VmmI5z5B922TnV6jHuvN69TpCMVIYPWjhO0cQe5q83jFSQ4ZvcL23su4tkj7eBXRIzWkcdl3AYHtvNgmZfhsGOxRvSHG4+BnLBlKOBBytcEOSS5hxGXz1KJywq19F65Gmg4jdUYVimXDbOGB21L/UgrHz2eamPfRSGulN2fmwraVsUZ24Bf5mVWQ4GVhH/e3IMuRlymW6CWJJ74YjGYsK8z6eESHVL9vBbfFttDfl/ZGpnQOs8759B7CuqW7PlPvxyw0pqwUftFIn7nY4W9Ynv9+JPJt8Zolva6H0Ot+G/83UVP7LwY4xLSLbXdRb9Tz2NDm2/O0VQj9A26OpRAOq2n7r+6kaPQUFSKtVfYzoKFUzHTgX7nTGw5rO2oYD5QiIo6/uOO09PFdVTeW6u4947XCcvrdXlqDdM1RwOVNxpYCam9w1Qgfkx44V2WK2grxd0WdfcuUI/NwIsSb/0VDBZxxKcoF1z945GEVlBdOCKXXDHyno/jtMiV9/Yz9TMabNJ+82uwmH141FlfvIEaaH7/rHbokwZSe4o71PfkI+rWtP+sZz4Jjjd3B88zTMiqTNZHfQdjh4R4R+ZmJta3eROYWrrlMut7HznsVa6dbbjyHmj+9GtrzXKyfxcWp5UeedQ7SHFW7lg577Fk2tVCZNZBspt47bD1JTG3dNMllQkzLa3wOsQzl9YsiNFgm3uQc14a50xmjR6FTekB5MA7qg83Q25QZ08udpG3TS9Mdt0OHUZxAscGtBomqV3jhx8JOd5k7RW2jYSZVJrVH5JU5RS7glcz/hsqhevQp/Pw8ovAp/CXlNMbc/FaDj2XmBnEeMnnti+sFz9Lj2Rq0NyCnDQDRnUnE5A61H4q5Duk9CV1/xP8j6qHv2BEi2fYlnvW2IXCkMa6usVyqyxMmO31sft3fH7hNmEOv+j/4dhgla4wM/eb0AfRp/hNPZQ8bT83Mc/fiCnOP6cdRA2xM1Sxnh8znoMPwTtrIw9zTnhayh4x4jexvuFn1mep2i9+40/+NYr+T9W6PEd5tc8z/i3hp+k0mmXP77WyJhriz3G1gvqBmZAGXYqdsK9bbSLz4+XNBtdbYJUIMEl50z1jZOb+tv4gkphs9PUVGx3d+om3r4aXTQspMm3JgmudKJkDFZKp+37mExFMQQtM7qAx1sSl96vnWLk2sMTu+TTifJkOg6g4co8vNrTO3c/xj1pOdxSN5feu7BcVyEGiOKZc4XfTekGhzZUWTKwh092iRv02hyAeY3ECzqTM0NvtmMK+k/SChbfyAG43VKk8vrs39/f0Wu3DtFfpUj01c22GaqpD4G208rFccWxRBbALsxRzmR7yaE8/Ygiw2d6/p1di3CMA00jCDcSME9Wi5oPmgK+QhKrsej6woyajQgzpba5mQTPvtYLqngpT+IESR2BeHJulrvE4TIsRtYm12xnejktwmkiWEvrK1NwXEGbRbQuJU5GMLoE7hNfC7byheluV0fuFFMVVXWPnF3xNvjERxC8RL8Fdcgdi3N1C6WlaCyMOaxBt66lb0M/z1Q29ZoRbH1pcZFrfgp0qpjCHsMCGKASMWtAWQrW1ApB40zcrebCqsiIiMx2xO1be4eljDz8Pd3Zx/Cu/dqZ/nuQbFK7/r+k/ds4+amWCrR5GLAWTvHWYY5N91k7HacbyO5NeS5R8K8wG4dWNjbTtTdAU8Q6Sg1oskkzd4FXD9LbkO6wGS76GAJGjMFZo0gTEkGtXWG8rXfw5H2CqtVTunrGe8M9naEtkO0VtoS5fj7y7+exVJwo2xPfe6Unp8+wXK3wGDLxTqlvtlJtFHMv7399eryiryntxWXZTfWO76tjraTp2FuDVEcISuQMaBuH1md+hQvWUyenu2rHIvZ6Qo2H7sIvyU5u9qx5SwLUvnyInTpDVjsxVCcblMeuVdAS3H1X75uuCvMkeVQk0x9u9Ff4kzoR8puDOOq0YrvgrqVL+59SUwTSVGnhvzNWK3k/F+mgrIbwY2F8m+vws9edr/lcgYs/qsZ17CiIqrI0KnofYdQWRKjyMix1DDnxuq1s+xPKSxqahehWX+HA9nFYYAkOqVOhaYvhPb1WkzpXhfyTp/sMAdp9fpP/zcAAP//faH2Mw==" + return "eJzsvd92I7mRJ3zvp8DXF1NVPmqVu9rd87k+j78jS2q31iWVpiR1z+7xOXnAzCAJCwlkAUhS7Ot9kn20fZI9CCD/kIkkJQqgqma2L+ySRAZ+CACBiED8+Zbcw+o9KVmupJZT8ztCDDMc3pPL3q8K0LlilWFSvCd/+R0hpPszuZRFzeF3hEwZ8EK/xz/b/74lgpbQI35cwBREASqjpmo/RohZVfCezJSs+79VwIFqeE8mYGjv9wVMac1NhsO9J1PKNaz9eYC1+c8hJVOpCBMz0IaJWW8iZx4dObm9Pu59cXNe/blxqs1dVVADt6yEtY8087J/3PjDFoz2v9s54LcIFQUxrATymglyd3v6hpg5EMpBGbKkGkcnNQ5fdIiDQBVoyRdQJIXJBFnOWT5HmNpQU2sipxug8zkVMyiIkeTVJ4/q1Q70TOSsAGEuiiD2e1gtpdr82yPgX3i65OKsAXpige6Es7C7Z0Yt7fiYesQtMAXcLrBl2F4Ab8xwaZ+JMa+VsmyzawwN59aA7wBItWYzAcWtjAfs41KAWttvO0C4HRoPwE0FOZsy0Iigz6ONc3BMrqXWbMKBLCivQROq4D15dSfuhVyKV0fk1RUs7f9diGslZwq0foXH7NEnJueWxVOW42pEn6Mj+9RJ/WRl9bXUzLAF2F/cqrr7eceMCjCgSibSTMgv2togj5relTQnC8o4nXCc0kll7P9dUr6kCn9zA3mtmFldg9JSCOD9X966a8j+6k4sqTBQ3Mipab770cxB7eKMmSug5idaMr66oiPyfc+zbimTKZLedcNMaP43e4fHhXCnQTndYFMQ4rJsxwQLK95zOC5kSZmIi+wMaeJIz4HGqpOisCc8iIxVTwN1cU2oI2cvARQV9lp+KihKC8v4mHdbd8XWdkmfhS7PZS1M/I2GaxkLJQhjD/iqinz52q9bkM1Aj4Rj53OtrCZVUR6XdS1Z8kQGNiAFmKVU98dMGFBTmsOxWAcoF6CWihkr7VQNA+NhCHt/M+GqNwcPjLTAyHIOCvBvRtHplOVkTjWZAAgiJxrUoq+Kt7JR0ydMZtMS2jGVoX3SqYHG7mm+Nr3x0cfG324ClXq2sSG2jfCEfXY7Z9p+jjBt9xIK15xWpvb8V3RJStCazuzP1JBclmDFnhPCg136Qc7IGeSyABWeiKPFNkHtO53uBIIwmZ1aZMIecGLue5Z7pVYKA8KgOsuENlSYBoYO6yZDe/MxAHdZo4iOOUxoelLjTU9KNGhttbc5M5pQcgXmV2aEvRH96h8HxKqfrJ7LmhdEwAIUmUC77yqqNJBLMNRCo2SqZNkb6vUHOdNvr2l+D0a/GWoKTEFu+OqIGI+bkk/ghIXb4aIH8zjsaYAF8D04yaXYPJ9rnDyDSkGOyotFUsCUCSiIFBxhGavXkpJWYVSlnmXRDsyWNb705/zi7DunfrsTj8Z7p73DA80N4XLm1ksNFgJnx1C3d7sFP2eXo6LKsLzmVOH3/cIej+6MAem9dkpoZwwoj++U0SVZHHZN3v3fNdm+JnbUNAvyvOMrJ//McCKby/LFoFvQfYRecmgKtKxVnujufT7bUp3/5yFDd2EJwnyJ4GhdMJOh3+xLhAfCqNWXCGxudaovERgT+wFLqzE1kuPL3WkF0H2kR1q2TQGKmDbUiF4TsjN7H2zcAhbNQA8ZKAnPsyI29JAB9R1WxDgXxdD3cwAu9j1DQfY5dg2mGYl9JMDBJ7MvP4RaXQv2uYZOjVbt/P2vVutG7akUub0cqJFfumU7Im4WLK047HP3dO1drNmQH+SMnC9AGHKDwpnUGAhASaXAC6rB1KfsAQqiwVgia19eH0OPGyzNIgxoP9tgaRdhQPpJizL0BMb3L+23MQfzegJPnsaDudSJ9NX+vvxZatMXkXxzR2oQBROz5o86tG16PqSvh7+DF67HcHf7s1ifsRfXiz+2T2Jjx32TuYPZG/m1MnfxY2r2/vhfl71m+LiXQDZsygXnSOt7ywpCyYwtQLROsq9XEbAs2s9/kdYCKb5E5e/reNEYdWjIapUp+JxgrfuPh7jAOO/JCrl87oYm13iQjrw321Byu6qA5HQoQSZAgJk5KHJ3Icx3PxKpyE9cUvP9OzKhGndR80A2ZbNaDaOUhvPeR939iueNz6DpjM8I/gX77ZlM5WbbZh03I3/1DgapllQVyZS6nkTrTbvPyYvrX9b0PYqxWZtLSoheaQOlv0Q9bEttDm6nasc8+7NUbMYE5c131rWVHXxIpX9tCYy4uP7lxwALPPwBJ57PghbRkMsxbp9uow4Vx31vnznQAtRB3q5/xqHIxdlzXkkd3v5jKZLZ7630i3ay8TxL7mejjaJ10SlaeFCs6XIqOYfcSPU1CmDLvReIubF7jmmSO9a5cL81RfWD3FRbyBZGf4EWX5lPvhRVtZQag91KKchkNVg0QhR8rkEbS1CzsuIrv072w5j+BDSfE80KIK//QMxc1eTdDz+8wfQcDSDaUbZw4otQXh/BCV1JoSEdK/KvZldgzHTrU6jLic+WYaW/hDYpkNd0IhfQY4YL4h3e8l68aaOAlqPnJ/9qts0LswoKVm/qaTEY9U1Ic2wdC2xKmPlH/e4P3/1JO5H+tkIB2oD+x2A2/7D24Ae6AkXekXOR00rX3L2sWJPySXI9RP2Zjx+B2MrQKN+/I/9mp3tEvv+e/BvJpcJ0DlwmN+gR+Rdu/j/7QabJOlO+CS6hkAV8sbauWEKWU84nNL9PqwE7cEIaPDbUOLvCMhFEUUkmTJM5EwSKmyMDpWSi+LROH9QV5IxyRIxItZHKatZi5bQO+4cF5axwGyMEipCprEVhbxgOCJ6JmVeOdgYvrp+IAeUYb4H+OGx5NhpZhRWXtPhS7jkPh2j2G5ASjGJ5wOrwpnD/w2gLu+u+EcL22qem02jltFm2Y/KzXNqlGdqcTBCprDFmJLkHqHYw7Yu48b4SpimZg9bZghVZkerV9byRPDMQoKjBQ15YDvbswgVTpqbcGu1rvncRcHGwklmz2+UoWma4WfijjgnclQKNDhVkGlUzMO3HdnJCq0RBTy/OCRcJt50TKslT0FDwd+mJn6CUBsiN3++5ArxoJ6sxQWn/ax5ivoKHFz9SpivOUkY2fNHmvGYDtf+L0M2szE243/HU2TvA7/Vm1zVWi79C/nO8MDrxMmX8Bd7o7ajWOLo+Pbn2um9OhWUPKyupNjVeglfkVxcGUX8Z7o87d1WhIY6me8iVum7K191XOoPd6TlomR+Tdz/8SJbI9xKoIJTzsK/AV4OQU9L5j8gSFDiy1BAOVBsixUa6yDoTX1xN/LqZGDirKZ5tPe9+lapAxmFUE+RzIbmcrTYf4qZMDbRYQn4g+ZwqmhvHRHuoV4gfneaC1MLH9PA1n/loRm3shG73UJ/yEWHL2yVaFKVVMqVonhEUXY7KNJSsG2olzVFjdW8UwvscZJ7XqqGoDRUFVQURUpWUs99C8b1SlUH+FD7KYW8WyXoyuJKexKQOdQvmLWdT8EW4Ak7HXIpiRMHuljvTJqWfZcuEmMhlWXEwwQ0w6kSlqMAbxTbEYC/fTJkX2sg3duzgdh7byus7c3T7lVKYeaRl6vJTY8W8dFFOxQsx/rypRheX7Zbkb1KkrrawRSza0RsV04XXDor5DURUshN9Qgw8GH/4yAKU7qVTFNviwALr+9zNtgIaa5pdml4uVQFFunvQB9n4a0q3IzY6RhNp036w/74+vK2ULI+Rao1J+ToHQRWTTq0va27Yt4aBIrSqeJP90tWyKamgs1BqLiEcn3cae9GBclg1YeaVJnIp3MuYoWW16Rn0iO1oFuLw9BlN8jmz1o0sQB+Ty1obNJP6RO2ppGYkLpca2HORtgqw6dTiXsAhNCFc5GZAxzsFU1AgcrchqFWtC7ZghdVscD+EBdlNI8huN5gXnuRDxdTBZtitp3sLerA7kRm+cpPVVuhZfc2C2igiSQK+0YiLPurCObLSuJVnx4Mh23AyWceWQOVAkXsuxZb/sY8KapCfa6gPtpXs7na7qJOPS6oJgihG9g2C+y42UyMqBWsMTSDTZqVJcPvOyhRYqywB1CpLoT1XMUXROtF30akm0JV6t8jLmJAb5mPwjhlcl0+6c/YVm7vk2j6PBd0FsVENIbYjiOaBUrvPV6x1zVM/O41YUbI2uSzhrcPQGi8YlS2ngx1ChWfBmgE5skFgAYqZlKkjWybWjO6TAHsvO9tcPmmTFwe1A90t3Wa6YBlTqt0D7JR1hk9Yu3WPOWM1VbyunD6aKbAArYuRFV3CROOiKvwjSxC3N5sPtQi/rFvpfUtQKvLxxofGMt0EBGz61XD8ZoXGsiR1hQW9Dzct1ActKlF0BenbsztahafmJktXuuiJokjUJSiWP1UWBed2gCy2LRPrZ7K1J8OJJXe+B1NbgCiwJcdOuSUn/3yB6jXN066c/BPysB1tgaXPBR+w2xeC3gLMSfqUteq+GR5In/XvxYz3cs1pG1sspCGUzH3Fi3AALZezrAlUeRGh3mzEJwv1Q9RMWZN9WHTfVa1G8RFW/CVn+Sr16dkiF64RgC+uLfrdBPowVc1Txk2HGfip5kAGFdFbcSqFgYfUGmsL6EI4f11XD5UWhbb/g5cq5Q2gUAGYHZeza72TCVimlgVjD5ew7D31oxJijGKT2kBPQgxj9H3XIKut96+/sOjQFY0m7Lp2KixZ2cptTENDcDO+yIHp628B4xYzwCzDmoKDuov5UgtQx+QGoK3Tf0xngKW8faT7VKoGw4B2Q8Z3gnF1/t33e3UrpCITJZfYA8D/1uuazuwarSd9UVxTZWK76VrCsT0q/kzJQXbooc6U5EWrNqY6UrIC/6CY6i4+Eb5FWBNdpLpB/e/c85YXH70iABiEFFCYCyKk+FZBBWjJbIt+0IEWWWnr6IcaaDk97i1zL2zN889gZktm5l5ZdrKenOGAE8w2EUSKb2fS/nvLTYBKShZQHBPOm/YeA98iAAtSTgk2SmGgj9vuUu4RM4h8z6Kuj0B86tL5am2NGJcy6oJtCi9+PeMpyXmtTbMh/Q+DZcKvMG1X0udEe/+GVXzxr+Mq0MG1H3fCwha9K8uUTil7tcvwsijPEAWhWsucob/UrkbQnsQF+8Du4T2hpJqvNMspJwXT90ekUtgT5YiAyV+FFWWq6D65l0+86F2ejaIlGFCaVFRjFS+NhRxcLYJclqWVYnLt0X6YWgMm36ruufvgpTS+3homuJic+M5lWdXDM5hg2ShZMlHIpY+nzaXIoTJHbSTFKDMG05zWnK/I55py5/wset3EcN7NQFyOXF19r2csdWnL1K1K+IGJeyh8LlATiE41eqe8gWL/8k0L7ZgV2xaOD6pCJBV1/c5Ozi2xCaCB9/HmpXB9rLznldwMy/W0j86uSWGi1ggjLlY/JqJ1+3+7pv19ZE17ynj6M95O+SccrT3GCoo6B9K8HEHY3aZBMcqzwG2a7BK5wSEbtXnzfuxdgPaGGfULQH6v9yo5EMNj7Ee3F92c6nl7QrF/3vB+qPO5i/xtcmzaNMPThtJGiTA7kXaYY61y+63252GmKbHyXBCGMXe1yDlQZX+FhfA6aD6B0Hs7VZPYufv1wQm/eljn6Yu+sXJZTnqdUfsXlk8bVU+4vRZM1frQnr6+NoIAxj1+h3kgDRyJUze6q8k47il1Flxy13jLPudlvjgjV07SvN5oeeqSfi22N2G92jmgX8KX33M/X5whS33KWysmht6D9Rc5FwbopnDsNpGVBUumw0bqQq9S1rJff9X1CdpOXdjqxxbO+D7grrGsP20HJhdnOzXZWP65HZqsBfZOFJ1Ge0xOXX6mr3fK3R+2a7MIUK1/4rtvvDtuUps2c1Oa9jKqBQftOCPdhbKUZEEVoxM+yAJ0RRmYIBWnI4JAg9BJ66OsLWhfVXUjH1tJZTWMJr+Q2XW+eXtxvalDE18y1nkUxvKy92wo+OhcyO6lxYEkF8KQGzYTFIXFyBatpEpZvPbVQH7ZTXrd6G4SqzriPy2Q3lnGXVbIwMa5+nhLmMh5XYAVZ76Rrf36MXl9/kDLisN7bN1r9Vwki9L7OOwXwZe5g79tonOqu1rCyJi+tyr3HriekIrXc2Ne+avhE9P3W55cjWKzGah0LezCLPul/xbgMaB2Oleg55IXdvc4W32k0+ja0/sBPAvDt3cvlV9/cjrGm7YYx8VZOI3k0a/zuSyr7MBxV7gqPvYK27g6/56uJ99aOFJgfuoU283Ios7HrDSvlr5Q1FgfeSstpcLKA1auN/hGusRRVSypepkIvWFVfStdqb+I7CRGSiO/tkKUkkuaN/WUw8qtFUEHtWOk+LZRUNV2KeRszehNrRVQHT02WBtq6liKc+uPooy/mNlhB5/IB8KKt+P3l71Z60MgtIjuBoWP3VmwKMJHt7nHEnffG2zys2HfvX2uMyZkHeuNs5dHomfRz5SVpDGdDgOP7B8jE05dmXFtS5xwbuUe0XWeg9bTmpNzOz7JZQHabomm2G/YsmCigIfIDOBMm/00z2fKFhwYTTHVgJiAwvfNkirGMYIn4MFz7+9iRigy8Vv73eDMRIJ9KCeuuNALacR+dPK6jeesQOnKJ906CTNgmVcRuoD4psLTm5EkQ+fmGt7HqQNKnPLVBnl5X5X7tP0jZUKTAgxlPOBkmMja9L43MjXJDx6b2XhsaRvHhjjGL1IDZcWTRfOckAKm1D8B+cqXzRu+j9a0WvECFKcrTOQy0l+u5HXgRNo/oNXtvw3TJgvc+eq1YabGwowkOLHONhgWbHrucY36itXz7+Q0NtIEsiqXZWnPU5ptdOqoE9YL9q2UXLDC+c+aKnIl6NFAqELm+z80Pt1b9hPjndaY9+PywqrBQ4VBTy8j65vR08r6f8rJnn6nvaf33+TEP8CET1fF0hXOPcOAYrfyN9cX5GKgUPVhJKta67NLtiOImNjVZsPOohrST/GH+djqsHLvREQ2kUXqjK9Bxt2m0uGxEItlRD2ax6+W4J4MDpB53nMB+9RhF0DbvoewGSvap5wRJ14Z22ocpIFHuPnjKXntvKs65TXVdPe+vnPVc5qHKAzWeIC87nsRXOjXBELprU0Vpm2BGwdwhAS94sW6Q6TNrqQLyjgdPmSQ1hVOML9yCkqNdFpwZ2gfX3+8dzdvrJS+AJR7gB1MyYcbaDY7HpGIrMwmdVGsovtnWJlFzQPq0a017FfofKuXKj5FxWTEKgcbKXaZrg+RkMB0P3rV1VyldcFMm1nX1UXziEKN7bqMDSdKuueF7ZN0UWKxObg4mFV++ss5ee1zJX6pudWVJ4xjAgfGgZ0/VFLbT74h3w4dDWLzFeZeyKVYM4Q05DUWs1isUx/ptJnTA7jgNsNCT5ss9yufmvQBZjRfkbtRc42ziaIvkZTvB15jMROkpExMFS1hazhGRRV27U1fJ2FNubzGYcmVLFxwdFcWsBd1FgBFdmhfGCpgGZHKQlqvG3cFS/JzLdCUvJQFcPKaicXx748Ik/kRmdj/Afs/VFC+0kwf/z78vmjyKptyOuicH1uHWtfwT68JDoq+LpSTq6b5lZxuLdRgZFKk7rcTj7Mpg6BB2Y0cBLQo48rdDWS/XP5KFZBbFwD8+9//cvnryafz3//exdwuqKJsdE8upbqPmbK884D92gzYf2EbdYJREVuJ8Dk7cauUtNcBze11sUpgwkylAqFZHlOA9FxJCRCX8b0ggfeBWESzJWXD5sTP9g5g7fPYRO3xiZ2irutJokNhJoU2KnbmO+ZrJ3OI9e/SaPdok/ORzkm6b7JL1xhsoNL4ZJMu78Xnu1gSUzbqaGqmmswRu+9Ug9WIAtPcTO8JC+W96wk+3XFhwXv9/9Nw1E5ldp3/XmSLFT0fvQeyFeSLbI7mHXcbPikPELS1trI9u/S1aSPamyg7rJP5Bt1ug527+2W6KVnNDvEehklfU8q45XVTzOXay4yLs35uG1bisuaggVmghMF4VGETc51ZFXGP+ewTeI3h1j776FSWZS02PVEDdGK/wk3PRXcFD+ZvENapW2x6P836udhuqCj+KsOvZh02Qw3bRzI8G91w4DVwutYVy5mMFiV6KAse0S+pEsNHhy8duhZllclUwvjm6vKafHR+1C4oNQzk80FDCW7+/QP5XIMaqd1ac5Ep2KzUmTa4oecQXZFPTdJZMKyr1dLziBdpn6iM3UbAEq32chztomoCj2PPplvEb9BAOVVlgtWyZBO4F2gVMQG5JVoX0brSrtGMW+1qjXRBzaZW+Fy6ExD5vKQqVlpJS3dV0UH74me/PtF8EE4VhWY2j74XcpjGTaBqCU9nWGopAVk5+WcCqhWN3gnDVZyKvr3w0T1jsS8cX7mtBKt6RgctMppjY5T46SeWthYRjfce4cmsWvxRPJh59Ps9F1luVFboqHXXe9Qt5f1enh5BeMFpdIkhMhAzJiImRQ5Jp4iNFtk000tm8ujyQ2RTLpealvFjV/q0hVmko57g1SUXGRMpxQkTFahysooW8D6gXeX3aYgvKE+xV1iVVUoamcV/kkLqiz9m6HGMT5snO5tczrIiBbMt4fjxb7nISvqQGRPLbbBO2O5oDgkuhZKJRKCZSAe64jrjE57FfhZdo/2HhMSjVwbv0Y5dC7FPO3ZWb5/2Dwlp/5iQ9r8mpP3/JqT9pzS0jaw4nUAKkdJSj2+eiaysOSrfk1WCe7IhXt0n0EvKmrNZWaXRvq2WSfksdhCSp8xSKCUaPufxfSMi0y4gMcEKapWnsSYt4TTWpF7pukrQizQXbVp1ElPVSGNND3hIIEKMNNYwS0UbzZokxGvBHgQVUkOeYBMufrRcSXQpLH6UlZkDLRK41WRZZTlP4MO2hBM8kiBdNVmZ+G5RS1knoVzVWYI3jVwxw3LKEyQQ6YzOQOSriFFXfdqC8tVvUExS4F5kWAY0CWVXDiYNahdYm4T6ZFYtfkzjg9bZhJk/JSk0lussbq+4DcJKRhfVOskxR6qQq/hZbtr5+KP12uoRBjN3fv74zhFHHNW+JMRdNfl4FeR6tKeMQwobRmfTFIvIpjGTs9cJp9ANdMYqDFLMkog6Vi3+WGhTDYr5R6KtVZ6ENmdTSGHGaHQ0l1CwaAmj67SZSLNLSlnUHHQuU3DbE2ezBLJJVnpJTdSe/z3qoQjyKIQVzJg2isb3hHS0E2h8CqpUrFbJeK2xErlKJF9dZL7b4gmoGwW0TKBIulSgVLDTKdfLuWQ6cx1m41NfUUWTbPBiJBE2BuWF628fmy7ThorofY4LbSa1itUssKEKrldQCqp1dKzx9egmJzk2WezcMI3f7HrfSgPbaM5oUcQ+A6yI/azalA5KcBexMsuVlGWSqkSWcAIzjZVZmuBIX/EoBZur++jlmSodv2Qpq3SlWGSinBpm6ujRZ5wJiFdip6Oqo3bUaeli8m18txaXruppNuUy+nXeEk8Q8m9t3uhSxxJNIHGsDZ0AavTYBC5nSbaumCU5wJVUsQVYOalnKY5ZyXSeQiyUOsmGTdEHQoDB4krR6UaX4a4AdOyIP0c1djieWC5jWyBJMsqkawAd3RKV8TUjqdgsC/TjejbdpQAV/86qMteUNzrZqJ2pO7KuxWuSTZYgcdP3xIktDDzZ2NKgypwjKTpcqrX9Y5bPY+X5D0jDQ8WiPwRUoMqZosIMau7GoLxMQjj+1esqkd3dbXQBjUBYyVlGdRWxYUCftKKxqSqgPIV+pyBHPriqo4mIx2eypRy3hGuPslRFAsTxHZk6gW9YO99wgngADbEDAVzD4wTGiYbP8TdAqEBrNKoJTCnNZgkEr65ie9m0ylOcA5UX0RVprfJQVdwIhE28Flt9mrWOXlVzkYvYiRLBbrHPJeqKdMaevpmZ+NvKEY3/otf29IxNd1VFr9ZaF5Mkcei14gnuwlqDygoWO+s9SduK5mUoBRtMrg0tY3uDFxkT2tBpAs1gwZRJoYYvKpGgdJORqhYx3ayhsmiBiqIntZHkUy3IYOg2eiRhs7xfKGcFOVVQMENOqSp8NUON5d/DcFznrIRcGusQimSwiT7B+ga55CSUqtPGQzCRjnPnZcXlCgaNBXfybyrraEW9H7nHLA+dzwj7nSmYwQMp6Wahhe4tVszqzWYgyUFyprE5QzO6X3osoER0XVVSGTIsPErIck4NYYZUCqZjW+EZYblPaUIRYry3OloIhAlf2X2kLjRnInVH/h5UO1ofpyZGzsDMQR13n9dzWQ9uNEIELEC17YiMJBVVGsglGIodwd1ZpS0LXn+QM/322qW9viFnvsXXETHzQJciLAb8CXzrY4QtyBWYX5kRoMPrPNzUSZg3xZbd7SnCwd1kNVCVz4+ZYEF82HP3APW1N8Qn9sLAYIi3nNYCe/3Oauzj2hRxDxdw36jXvmVO6ctxt3Nqi3D7/sUjxr5diCxiTtPjKq/isOQWHgyeijF3wSG6UY8IpK5x3RV2qBZ8pOMlVs9N2A4c6+dqMETB5xq02VK0e/9o5afXyncqA7blcaM6ib3pkWrjTtfdKdswOUT4Nrb2e6zQrt8HZx6z9//u/oZ2sIuzRijg2OG9gVZDvCDeJ25he7lMqAbiwrVbNGRwqtpV8t94GbyibQXfIpfKla8PspEQqokGwHZndHu/KkWFpvkB2vsOKky7oQWqvd2myWuFHdC2ga5AlcypG4cC3Q3pGnOwBeMwA8JhAZxQrdlMuIXr+vWHtz6WZH5B+Y3jb9npkxfp9GyR1YJ9rmGzTSINH74e3v0qJu7XBaXRaFjhDmQuhQCMrSBLZuZjgoKQQGZIq7Er2Cu96MmmhWUnypP2iuJyxnLKiUUwYvogipdFh0ONtGl8Od5V85UOw+uFsy3lRlRr7AueckZ1NpfJbQJnxLXmGvZS6ZoaWanYb8ETrgdA3KGxaPFO841Ycg5UHZ9wLa0hvnbezvCxnPzsv3FMTsSq/WlA3aAtr4UhtDjOZVnVBlRYDCdx49uJpTPPvtlcC+yxuLYgzPyjfveH7/5kbd+z3nI0HPsmCNvv0yzui9ljHTd0BYr8a+uT0289DAQXPvWx83/S73nRYV7b9VvXY8/g5V2y7dVmwxQ7zjG5+nh7bucOCpzzBP2lBdO5goqKfGW1Sq+e8c1YEIIcOiK3l+/JhTDfvzsiF1dn5//xntxdCPPjH8nr5XxFBDAzB0XyudS+VZpUCnKDn/rux////3nzKsgRMPOEMm6THyhTj0sabsejE+++Jx7zG7cXLxpQ4SNefFmg+7JpB/I9C8Y9+oIP4d1QTDvr5BemTE05+XByFQT7mxSQzpe13874H1LAcZi3Fu5XI0JxIruFJy7Bl3gHb1mHGTWwpC/QIh139zU5KQqFflq3y0Nw2qs3L6t93zmf+xZycXp57W6l0eexkuoDvn6sOZWcpurvbnJxbaGMeL8sD/fsBBGFh3bscR42mljmumsdVkD04NKiYPbDlHcPtr1e/uF77oAbwJqEeMClP+Fn61tgAKWLtU6i1z32SqPkyiO8lsq0InkgdAt8YMMFYGa1W/LqA/PezYeJWXOZNNO6HGO8gJDdeCgvrkeHli/VWubMqpzObzTQcYiVy4qKGRy3plMuxZTNagUFmayQJogCo4bCcqbas/TAIGl0RFsODjpNUO+AR9T9+ylc0R0ACkppIPOR3fHjjOKzthA6o5kLxU9AujIqDfFpgi0xTZAtzFMch1T1T6oETKVF1nji0qnlmxa8ncfx5mh9Z8ILaLDnZg5KgCG3qwqOyF1zjX1AB9j35LpxgA1ugo9jmlrTqucAysSIadyA9n7xI0I5DyoTVfdBDHCjCgPzFqDsHciEkUQbvMyZIHcXowIlxwDZZPIqusi2RGWVoO2bJaxAx47otWQTpLi4GzF2KDr62xOgda0VMg5iFr1TJGK2ykdCLXREA3UqD+W9BxhBcgwnmBJKfpJqSVUx7NNNyMkMg70UofbEP2As3QTMEkCEVc/IVROf+sYtDeX9pzoHhmDJeIyMGMyQCR/nimEJJTNWLPkWG+EpLjgVh3jHf4SDsgkQ6bkoBxNcd1l2LykLa8HO0IBdv3liv1RCjlUIFvHqwT3uxZ4qw/KaU0WwXjRpQLw+f3j/Qc7kdBru/g55ZuaQfHnXwN7aAd1p7OE+t7gt3JPazEEYHyw+ClvXMSsnPC6gxw05Dv1OgxoFLGuTy8Ny2g85DvimznPQegQzVh7frzjafoEniItYFXcm1YoEEhMG2A4hnNYwwgZGK5XwgU9XUth7xcqtkHLYfpEMFKX1WS3i1aMbuTcpcVVLMWeAMyja+Xg/zIY+zATRzNQB+UkwuQC8iPZU51QTWsjK3i5mDkwRuRTdkjnGGfoghSxH4mqxJ4dmrkT9YZUIq9wzUVj5I5VuGUDJT4wDOfHAjgdseIyzV7QTc2dyNGC8nf+LhCuMsuDGRy3E5UJojgFGxMx3fwYjXLzejc/XiM2J8YDQiUyZPRCY/ATmdMFkjdplLstKyZKNRCjCocGdCzrhmEQ2JafbsTGxaMVOQpCbCNe0ThIEsIYwanOZPQAGxm/xpV7d3i3bnbfRbdelWdbCbKazxdboC0wDz/J9zPpHaUF4H89AgGJ5MyVkCAb6bYYWMDPHqzbU2414sMf5d8faqPHHz2ZO+5TderE5vds+J69euLESzitomrZGuGElaCvXnbanoILRRyS/CtGKQuxcCCw8+MxlUI/cWvvU7n6xrfX94+b0XaajNTl99NS8w3jXDAdzwxl3AuERwuDrnd27nbNTB107d9CizE3tXrlotVQPI0B2yPFWgHy92/H73UsWq7XBYZbscfJRHVSCxDxjj5AfB92OMec22IytUo8paBt+6uiZO7WZZyWYuXyBVxK65kkmDob/2OiCYy0lJZN6nba86nyS3PtrLZAt+zKRJ+Q/jn/4wx/I6w9nJ9dvyBnTholZzfQcCkyFD2LhciaT1wXa9hKG0bJTh8MvM35wJGJMycRexW35n3ZVQwjaE4Me+WhNn59yXHIM+2/zfnuOP8QUejOlIlQmvYsUozxWdbqNiXyiBau1G4FIRTQrGafKiScrNu0ZyvFeD6dX4TnXrDhkpZF+pPyd3QiNF3GjLmZ3yNPlWZyIbWcdnzV8pmHP/+udRPiXwV7wjhvopWUUYVemVCkDAwZPNshqqWZUsN+2RFWLdFvhsczeg9P9PTXC7ilTwVzSRFV/frLD4W3hSny52kVrUc0/A+VmnlMFpFJQyJIJGky464mna2oYCKN3hsdzesjZfqAvOllX+hGqRBvXHp1XVnBVVBkshtRNdbtYPWCxIy9sHiNRp1CAogaKLFpQ2Zb9YYXPT82I7ePZtZILVrTFw/znaFVxr6kONoYv/mOvtXWdNqzgdJNkxYFm2Q7pa/2Z1cg0g81DMXJywdzr+XxTcR8pAdcqnTGbgj9V84QH1Jl6X+plQs8CE3U6KmqsVBNtpHIS31IrwVAc7RV+6th+6lV49iUrCg6Hk3KXON5j5VxgeXtyby8517THOMx0r/1ovQpDYtW8zh6RilO7ZPZ+loqAyNWqGvPyYyjkAezJR0TQqda2/FlqQy5pPmdixKQraCLJ8c0mr+8ERvpXCqz4sPqRK3Kmj8mHglbkF/zB6UeFFC7v9B/Dy5PM6QKs5sSBKvK5BrUiWINQV1JoaDSqcHKqnW+G3zmMvPQ18HJLWbGmCqRw03d1+cZxNlM6ANRuA33yxVEfixS7PKV1mG3u8aa09FoRI2sb+ouXaaJqIYJ2rD5qbx738uzKSI3k2HmKmbcw0y8EJUsmCrnURFeQsynL7V+OQnmCPk52eEDs9BzeLuaGvMaKsCDy7hrCp8s3PW6RWuA9/gFmNF+RO71e+LZ9gS03E2mjR9faEQ5gsI/c9n1TC6FgrhpuMnsjDjje1gEIZP+vZZpiOs+QfevTTq9Qj1Xndep1YMY4w+BG89/ZY7KHiesdm6qP8PWu90bWnePUx6uADmdzGIdd+2CwvjZdQKZbhsEKhQtS7E5+xrSBmC0BRzPccMoFTJnwvnoUTljVr6TVSNFBRLdXolgibJ0DZkP9iy0YW59t6rn7WkojtSlbH7YxNJ+XBy6B342KDCcD66i/HEmavEyYiNdBLOrZsFPGpMK0l2dASPXTdnBZXBntLr0/0LVzgDrt3bcDdUVVs6fsr4+6qSznbFBKndjTYW1ZF/z+qOmZ6D1LXFkLqVbpFvzPuqLiLzsrxjRA1quoN+p56GqybPnzW6S+Y24vphINZtXUW98+q9FdkIEwSlb7iI5C1pOBc+FRe9yPaa1t2JGOgBhddsdhz+GpLCsqVu15xGOH7fSdvbIAZa+hjImpDCsFVN+nzhHaIT82rMgG2RLSVkWffk4VI/BTzfmK/HtNOZsyKMgZ5j0752AQyhImWS7lPXuhR/dfYULc+J39TPmYNh+92mz3HF7VBlXuPVuY7j7rn9ohfJcd7452Pvljcruq3NQ7z4FljlvB8cVTMM2iFpPdgG0xOEeEeqVDZWs3wRzCVdcql+vonGexkqrx9uMT86cPI0veq5UTeTs1vKjS9iHawgo78k7PfQNTSZlIE1kHZcex60EqasKuyVxkVMd87e8RVj6dPjLlWvGIy9yjGnFVWmM0q1Usb0iPpgaV0Vk8m7IjHf16WicdNfxxnbTf9QkECzwYEKhaxTdOLP1ou7lV9OYKNkJlYmtUbohD5BKuydxbHBbVq7f+36cewlv/Dx/XFHL7Uw4qHJ3np/OCr+duMv3Hc/S49lqtDaZT+IZo1qRiYgpKjby7Dud9kHn1Ff+drA+6Zw8AsqlLPO0tQ+BI4bO2THqkAkMcbPudu3d7u+1uMYJY9X/1dxgGaI03/GTVHNRh/BFWZ/cRT69PsfXjG3KK44ehgTIHKpYywudTUL75J6xFYW4pzgtJn457jOwtuB30le5Vit660uy3fb2STy+NEl5tcsN+C3tr2H0imXLx93MiYCYNcwtYzake6QCl80OXFeotpRt8vLmgXepkHaAGAS4be6wpnN7k34QDUjSbHSKjYr2+Udv18Ha00bKVJkzrOrrSiZQxWCqdt+55byiIEJRK6gMdLEpfep7bwckNPk5vk04HiZBoK4P7V+TXNxjauf0y6knP/UA+XXpuwTguQrXm2SLljb75pOod2UEwRWa3Hq2jl2nUqQize/AWdaLiBt907Ur6FxLK1j8Sje91UpGLm5O/X16Ta3tPkY9ipPtKhzZRJvU+aG+XMowWxVA+h/xe7+VEfpwQTluDLNR0rq3X2ZYIwzBQ34Kwk4JbtFxQbFAU8gWUXIejrQoyajQgZkNNfbAOn32UC8pZ4TZiAMSmIDxYVettghA5dg8rvSm2I+38JoA0Mu25MZXOGPagTUIalzIFQ3L6BZwmNhNN5otUzKx2nKhclmXSOnGPxO1weIdQOAV/yRTwTUsztotlyanItH6phrd2ZCfDf/WzbXK0gmhdqnFWSXaIsOoQYIeAIAIEFbYGkK35nAoxKJyRutyUHxWBjLzZHqhsc3ux+J6Hv344ufL33tuN4dsLxUi16fuPXrON6ftsIXmdigEnTR9n4fvctJ2xm3a+tWBGk9cOhH6D1TowsbfpqLtBniDo4Gx4nUiaffBY7wQzPlzgeD3pYAEKIwWmNSe5FDlUxhrKN24NR8orLJcppa9jvDXYmxbaFmgllSHS8vfnv56EQnCDbI+976SaHT7AcjPBYM3FOqGu2EmwUMzfzj9eX1yTS/pQMlG0bb3Dy2rndvAwzLUmiiPT8tMYzG7btFr1KZyyGD0822U5ZtPDJWy+dBJ+M+Xkaseas8xL5YszX6XXo9iKkB9uUV64VkAz4/I/fd5wm5gjiqEmGft0o7/EmtAvFN3o21WjFd8+6pYuufeI6DoQok41+bM2SorZXyac5vecaQPFn9/63x21f2ViCnn4T1OmYEl5UJGhE977DqGiIFqSkW2pYMa0UStr2R9SWFTUzH2x/hYD2cQwAIlOqUPBdInQLl8rl6pXhbzVJ1vkIEwvJqUrFJArqeXUHJff//hDVsAURLHmnQ9veWuqUQ3vyQRM3wlQwJTW3GR4IN6TKeVrechr81kP37+URc0BTzwTM1/O4rKBR848MnJye92/qredPCZy1AIvNtn6aJb/ZbB779wV0mqXym4RBZUC9NPazdIMO9IVCFyMykUCcB8FX5FKVjVvAuCxsxHWm3CjWSExActaXFGUFjNA48z34JT4Q/P5IysLKqpMIzhaQj6XwZJCo2akza//+KA43LPmedWLornYyu0CDKjS677xANy4KHEvKdYG2WTUMbl16eYVKLNqjixV8J5cSXOyoIxbcXhETipzRC4pX1IFR+QG8loxs7oGpaU157tf3brDcUTuxJIKA8WNnBr3rY928cZWolfO/SZwHT2DHbdj18xFf9CRcHpvHd9uhvk85xwsBai1MKuRlFA62/StP2PUE6UoZvzktTayROqBJre9s2WFHTzQsuJgxciU0xmh7mRaOs0Htf9q4zPM51TR3IBi2owdvODDQbQd31/sWq9zmlxLrdmEw9pef3Un7oVcildH5NUVLO3/XYhrJWcKtH6FKsCrT6AlX0AxUtQGK5Y692mKw5yvHd/HzuUne8NdS80MW4D9xa2qu5/HMkhAGX38wteT07QRC3pz1jfqVuTKL9QtG5HqxVC87BIhrARXEcEhWlJNmmG2Yom90duQWb8HNHlNNbmC5RE5ye2iHll9q9mqb7ZjgwWoYa+3Z0rahmqzVRW4636LoPN4cgW4yROvGxYUJDjYjsXjVJu7yo6aei/ZkUjthtpxKntXVsyjeevqx8jS62b97iqsIEax2QzavubN0dyKtdagbgYulGdivOmiEZqdZcfZhsMqQJjHfBOKWH72dnelaFy5UcEMwwQ1N6bPonYxytv3fqLbAyGu3SBNxMIjNEB/kRyRtWvkiPQvEStuRM3543dtZO3uovOhND7VteFe6Q19YCvS/4oaebOE2/iSXA/u1E6PhrApEdJV4vIaACLYunw0N1LFteZufRmEhb3TUPk9stCoWPmiWxsq9COFo5MJP9GS8VVswJiYMkXS+8IrmVFwC/kcNbaICsxtU+vknpiWPNrxlLt3yLatw+XF7adzcnJ7+y+nf//f//N/kamiJSylut+KHOOSGfh/rAbBwM9Cf+6JO3GPNfsmWGOx0WjRvzmBxilx5Ir4uXvKyCNrP7FFc/WvHXXWecyc8NWgjshFdUTuFD/C/o1H5Nq5Ney5Z/yv8sH94xK0pjNwP5zyWhv71U/et/Y4bvnianG34omv2NbPK+rf2o+DVlLGJ/LhjOmK0+iHBUjhCAdR+rGfBDSUgfFskOv1y54BMnf7468R1f4TwplGH1wJhhbUUCshsRpfewatCO9tz8dh1Zvu3giMdDRbNajhoStCVrqT9Dh0CnJWDV7ong2wJRsDYzh36rks9IXmIuArgLMFqNXJsNDQ88+1p934gWKw06tUf7N6QGzzq9HXCFJv3oHbvhvdNeKO1jPRx5ejG/jRDR55Bs170c9sERH8p6aKqEWGZbGIHYAw0T1Qdd2zmV670dnU/b4Rcs03jsm5852+Jz///fy/Zx8+np58yC5PTn++uDp/2myH2ZyxJts/Dv1XxHaJFqNvF2NgseJxXK0LSSKB7ubrsL51kfYVZcMd9nj4BVgzPvaR7kI6PHA3zDNwsiqJetEAurhulYxHY3NzCgOacmoMCHgipEaAI+FNbrHws83v/k8AAAD//7KHlgw=" } diff --git a/x-pack/filebeat/module/microsoft/m365_defender/_meta/fields.yml b/x-pack/filebeat/module/microsoft/m365_defender/_meta/fields.yml new file mode 100644 index 00000000000..3656cd7c1de --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/_meta/fields.yml @@ -0,0 +1,176 @@ +- name: microsoft.m365_defender + type: group + release: beta + default_field: false + description: > + Module for ingesting Microsoft Defender ATP. + fields: + - name: incidentId + type: keyword + description: > + Unique identifier to represent the incident. + - name: redirectIncidentId + type: keyword + description: > + Only populated in case an incident is being grouped together with another incident, as part of the incident processing logic. + - name: incidentName + type: keyword + description: > + Name of the Incident. + - name: determination + type: keyword + description: > + Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other. + - name: investigationState + type: keyword + description: > + The current state of the Investigation. + - name: assignedTo + type: keyword + description: > + Owner of the alert. + - name: tags + type: keyword + description: > + Array of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic. + - name: status + type: keyword + description: > + Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. + - name: classification + type: keyword + description: > + Specification of the alert. Possible values are: 'Unknown', 'FalsePositive', 'TruePositive'. + - name: alerts.incidentId + type: keyword + description: > + Unique identifier to represent the incident this alert is associated with. + - name: alerts.resolvedTime + type: date + description: > + Time when alert was resolved. + - name: alerts.status + type: keyword + description: > + Categorize alerts (as New, Active, or Resolved). + - name: alerts.severity + type: keyword + description: > + The severity of the related alert. + - name: alerts.creationTime + type: date + description: > + Time when alert was first created. + - name: alerts.lastUpdatedTime + type: date + description: > + Time when alert was last updated. + - name: alerts.investigationId + type: keyword + description: > + The automated investigation id triggered by this alert. + - name: alerts.userSid + type: keyword + description: > + The SID of the related user + - name: alerts.detectionSource + type: keyword + description: > + The service that initially detected the threat. + - name: alerts.classification + type: keyword + description: > + The specification for the incident. The property values are: Unknown, FalsePositive, TruePositive or null. + - name: alerts.investigationState + type: keyword + description: > + Information on the investigation's current status. + - name: alerts.determination + type: keyword + description: > + Specifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other or null + - name: alerts.assignedTo + type: keyword + description: > + Owner of the incident, or null if no owner is assigned. + - name: alerts.actorName + type: keyword + description: > + The activity group, if any, the associated with this alert. + - name: alerts.threatFamilyName + type: keyword + description: > + Threat family associated with this alert. + - name: alerts.mitreTechniques + type: keyword + description: > + The attack techniques, as aligned with the MITRE ATT&CK™ framework. + - name: alerts.entities.entityType + type: keyword + description: > + Entities that have been identified to be part of, or related to, a given alert. The properties values are: User, Ip, Url, File, Process, MailBox, MailMessage, MailCluster, Registry. + - name: alerts.entities.accountName + type: keyword + description: > + Account name of the related user. + - name: alerts.entities.mailboxDisplayName + type: keyword + description: > + The display name of the related mailbox. + - name: alerts.entities.mailboxAddress + type: keyword + description: > + The mail address of the related mailbox. + - name: alerts.entities.clusterBy + type: keyword + description: > + A list of metadata if the entityType is MailCluster. + - name: alerts.entities.sender + type: keyword + description: > + The sender for the related email message. + - name: alerts.entities.recipient + type: keyword + description: > + The recipient for the related email message. + - name: alerts.entities.subject + type: keyword + description: > + The subject for the related email message. + - name: alerts.entities.deliveryAction + type: keyword + description: > + The delivery status for the related email message. + - name: alerts.entities.securityGroupId + type: keyword + description: > + The Security Group ID for the user related to the email message. + - name: alerts.entities.securityGroupName + type: keyword + description: > + The Security Group Name for the user related to the email message. + - name: alerts.entities.registryHive + type: keyword + description: > + Reference to which Hive in registry the event is related to, if eventType is registry. Example: HKEY_LOCAL_MACHINE. + - name: alerts.entities.registryKey + type: keyword + description: > + Reference to the related registry key to the event. + - name: alerts.entities.registryValueType + type: keyword + description: > + Value type of the registry key/value pair related to the event. + - name: alerts.entities.deviceId + type: keyword + description: > + The unique ID of the device related to the event. + - name: alerts.entities.ipAddress + type: keyword + description: > + The related IP address to the event. + - name: alerts.devices + type: flattened + description: > + The devices related to the investigation. + diff --git a/x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml b/x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml new file mode 100644 index 00000000000..2b2a6f936f7 --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/config/defender.yml @@ -0,0 +1,43 @@ +{{ if eq .input "httpjson" }} + +type: httpjson +http_method: GET +interval: {{ .interval }} +json_objects_array: value +split_events_by: alerts..entities +url: {{ .url }} + +oauth2: {{ .oauth2 | tojson }} +oauth2.provider: azure +oauth2.azure.resource: https://api.security.microsoft.com +http_headers: + User-Agent: MdatpPartner-Elastic-Filebeat/1.0.0 +date_cursor.field: lastUpdateTime +date_cursor.url_field: '$filter' +date_cursor.value_template: 'lastUpdateTime gt {{.}}' +date_cursor.initial_interval: 55m +date_cursor.date_format: '2006-01-02T15:04:05.9999999Z' + + +{{ else if eq .input "file" }} + +type: log +paths: +{{ range $i, $path := .paths }} + - {{$path}} +{{ end }} +exclude_files: [".gz$"] + +{{ end }} + +tags: {{ .tags | tojson }} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} + +processors: + - decode_json_fields: + fields: [message] + target: json + - add_fields: + target: '' + fields: + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/microsoft/m365_defender/ingest/pipeline.yml b/x-pack/filebeat/module/microsoft/m365_defender/ingest/pipeline.yml new file mode 100644 index 00000000000..f1ea7c03abd --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/ingest/pipeline.yml @@ -0,0 +1,301 @@ +--- +description: Pipeline for parsing microsoft atp logs +processors: +- set: + field: event.ingested + value: '{{_ingest.timestamp}}' +- remove: + field: + - message + - json.comments + - host + ignore_missing: true + +######################### +## ECS General Mapping ## +######################### +- script: + lang: painless + if: ctx?.json != null + source: | + void handleMap(Map map) { + for (def x : map.values()) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + map.values().removeIf(v -> v == null); + } + void handleList(List list) { + for (def x : list) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + } + handleMap(ctx); + +- set: + field: cloud.provider + value: azure +- set: + field: '@timestamp' + value: '{{json.lastUpdateTime}}' + if: ctx.json?.lastUpdateTime != null +- rename: + field: json.alerts.title + target_field: message + ignore_missing: true + +####################### +## ECS Event Mapping ## +####################### +- set: + field: event.kind + value: alert +# Events returned from the API is always in UTC, so should never use anything else +- set: + field: event.timezone + value: UTC +- set: + field: event.action + value: '{{json.alerts.category}}' + if: ctx.json?.alerts?.category != null +- set: + field: event.provider + value: '{{json.alerts.serviceSource}}' + if: ctx.json?.alerts?.serviceSource != null +- set: + field: event.created + value: '{{json.createdTime}}' + if: ctx.json?.createdTime != null +- append: + field: event.category + value: host +- append: + field: event.category + value: malware + if: ctx.json?.determination == 'Malware' +- append: + field: event.category + value: process + if: ctx.json?.entities?.entityType == 'Process' +- append: + field: event.type + value: user + if: ctx.json?.entities?.entityType == 'User' +- append: + field: event.type + value: + - creation + - start + if: ctx.json?.status == 'New' +- append: + field: event.type + value: end + if: ctx.json?.status == 'Resolved' +- rename: + field: json.alerts.alertId + target_field: event.id + ignore_missing: true +- rename: + field: json.alerts.firstActivity + target_field: event.start + ignore_missing: true +- rename: + field: json.alerts.lastActivity + target_field: event.end + ignore_missing: true +- set: + field: event.severity + value: 0 + if: ctx.json?.severity == 'Unspecified' +- set: + field: event.severity + value: 1 + if: ctx.json?.severity == 'Informational' +- set: + field: event.severity + value: 2 + if: ctx.json?.severity == 'Low' +- set: + field: event.severity + value: 3 + if: ctx.json?.severity == 'Medium' +- set: + field: event.severity + value: 4 + if: ctx.json?.severity == 'High' +- script: + lang: painless + if: "ctx?.event?.start != null && ctx?.event?.end != null" + source: > + Instant eventstart = ZonedDateTime.parse(ctx?.event?.start).toInstant(); + Instant eventend = ZonedDateTime.parse(ctx?.event?.end).toInstant(); + ctx.event['duration'] = ChronoUnit.NANOS.between(eventstart, eventend); + +######################## +## ECS Threat Mapping ## +######################## +- set: + field: threat.framework + value: MITRE ATT&CK + if: ctx.json?.alerts?.category != null +- rename: + field: json.alerts.category + target_field: threat.technique.name + ignore_missing: true +- rename: + field: json.alerts.description + target_field: rule.description + ignore_missing: true + if: ctx.json?.alerts?.description.length() < 1020 + +###################### +## ECS File Mapping ## +###################### +- rename: + field: json.alerts.entities.fileName + target_field: file.name + ignore_missing: true +- rename: + field: json.alerts.entities.sha256 + target_field: file.hash.sha256 + ignore_missing: true +- rename: + field: json.alerts.entities.sha1 + target_field: file.hash.sha1 + ignore_missing: true +- rename: + field: json.alerts.entities.filePath + target_field: file.path + ignore_missing: true + +######################### +## ECS Process Mapping ## +######################### +- rename: + field: json.alerts.entities.processId + target_field: process.pid + ignore_missing: true +- rename: + field: json.alerts.entities.processCommandLine + target_field: process.command_line + ignore_missing: true +- rename: + field: json.alerts.entities.processCreationTime + target_field: process.start + ignore_missing: true +- rename: + field: json.alerts.entities.parentProcessId + target_field: process.parent.pid + ignore_missing: true +- rename: + field: json.alerts.entities.parentProcessCreationTime + target_field: process.parent.start + ignore_missing: true + +########################## +## ECS Observer Mapping ## +########################## +- set: + field: observer.product + value: 365 Defender +- set: + field: observer.vendor + value: Microsoft +- rename: + field: json.alerts.serviceSource + target_field: observer.name + ignore_missing: true + +##################### +## ECS URL Mapping ## +##################### +- rename: + field: json.alerts.entities.url + target_field: url.full + ignore_missing: true + if: ctx?.json?.entities?.url != null + +###################### +## ECS User Mapping ## +###################### +- rename: + field: json.alerts.entities.userPrincipalName + target_field: host.user.name + ignore_missing: true +- rename: + field: json.alerts.entities.domainName + target_field: host.user.domain + ignore_missing: true +- rename: + field: json.alerts.entities.aadUserId + target_field: host.user.id + ignore_missing: true + +######################### +## ECS Related Mapping ## +######################### +- append: + field: related.ip + value: '{{json.alerts.entities.ipAddress}}' + if: ctx.json?.entities?.ipAddress != null +- append: + field: related.user + value: '{{host.user.name}}' + if: ctx.host?.user?.name != null +- append: + field: related.hash + value: '{{file.hash.sha1}}' + if: ctx.file?.hash?.sha1 != null +- append: + field: related.hash + value: '{{file.hash.sha256}}' + if: ctx.file?.hash?.sha256 != null +- append: + field: related.hosts + value: '{{host.hostname}}' + if: ctx.host?.hostname != null + +############# +## Cleanup ## +############# +- convert: + field: json.alerts.incidentId + type: string + ignore_missing: true +- convert: + field: json.incidentId + type: string + ignore_missing: true +- remove: + field: json.alerts.mitreTechniques + ignore_missing: true + if: ctx?.json?.alerts?.mitreTechniques.isEmpty() +- remove: + field: json.alerts.devices + ignore_missing: true + if: ctx?.json?.alerts?.devices.isEmpty() +- remove: + field: json.tags + ignore_missing: true + if: ctx?.json?.tags.isEmpty() +- remove: + ignore_missing: true + field: + - json.createdTime + - json.severity + - json.lastUpdateTime +- rename: + field: json + target_field: microsoft.m365_defender + ignore_missing: true +on_failure: +- set: + field: error.message + value: '{{_ingest.on_failure_message}}' diff --git a/x-pack/filebeat/module/microsoft/m365_defender/manifest.yml b/x-pack/filebeat/module/microsoft/m365_defender/manifest.yml new file mode 100644 index 00000000000..d7b73352f79 --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/manifest.yml @@ -0,0 +1,17 @@ +module_version: 1.0 + +var: + - name: input + default: httpjson + - name: interval + default: 5m + - name: tags + default: [m365-defender, forwarded] + - name: url + default: "https://api.security.microsoft.com/api/incidents" + - name: oauth2 + +ingest_pipeline: ingest/pipeline.yml +input: config/defender.yml + + diff --git a/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log b/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log new file mode 100644 index 00000000000..4fc4cf141b6 --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log @@ -0,0 +1,9 @@ +{"status":"Resolved","classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z","determination":"NotAvailable","incidentId":12,"incidentName":"12","redirectIncidentId":null,"severity":"Low","alerts":{"creationTime":"2020-06-30T09:32:31.4579225Z","detectionSource":"WindowsDefenderAv","firstActivity":"2020-06-30T09:31:22.5729558Z","incidentId":12,"serviceSource":"MicrosoftDefenderATP","actorName":null,"alertId":"da637291063515066999_-2102938302","determination":null,"lastActivity":"2020-06-30T09:46:15.0876676Z","assignedTo":"Automation","devices":[{"osBuild":17763,"osProcessor":"x64","rbacGroupId":0,"aadDeviceId":null,"firstSeen":"2020-06-30T08:55:08.8320449Z","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","rbacGroupName":null,"riskScore":"High","version":"Other","deviceDnsName":"TestServer4","healthStatus":"Inactive","osPlatform":"Other"}],"investigationId":9,"threatFamilyName":null,"title":"'Mountsi' malware was detected","category":"Malware","classification":null,"description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.","entities":{"deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"File","fileName":"amsistream-1D89ECED25A52AB98B76FF619B7BA07A","sha1":"ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281","sha256":"fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356"},"investigationState":"Benign","lastUpdatedTime":"2020-08-26T09:41:27.7233333Z","mitreTechniques":[],"resolvedTime":"2020-06-30T11:13:12.2680434Z","severity":"Informational","status":"Resolved"},"assignedTo":"elastic@elasticuser.com","lastUpdateTime":"2020-09-23T19:44:36.29Z","tags":[]} +{"incidentName":"12","redirectIncidentId":null,"severity":"Low","status":"Resolved","tags":[],"alerts":{"devices":[{"aadDeviceId":null,"firstSeen":"2020-06-30T08:55:08.8320449Z","healthStatus":"Inactive","osPlatform":"Other","rbacGroupId":0,"rbacGroupName":null,"deviceDnsName":"TestServer4","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","osBuild":17763,"osProcessor":"x64","riskScore":"High","version":"Other"}],"entities":{"deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"File","fileName":"amsistream-B103C1A335BDB049E617D1AC4A41FCDC","sha1":"ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281","sha256":"fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356"},"firstActivity":"2020-06-30T09:31:22.5729558Z","lastUpdatedTime":"2020-08-26T09:41:27.7233333Z","alertId":"da637291063515066999_-2102938302","category":"Malware","classification":null,"determination":null,"mitreTechniques":[],"serviceSource":"MicrosoftDefenderATP","status":"Resolved","assignedTo":"Automation","detectionSource":"WindowsDefenderAv","incidentId":12,"investigationId":9,"severity":"Informational","title":"'Mountsi' malware was detected","actorName":null,"description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.","lastActivity":"2020-06-30T09:46:15.0876676Z","resolvedTime":"2020-06-30T11:13:12.2680434Z","creationTime":"2020-06-30T09:32:31.4579225Z","investigationState":"Benign","threatFamilyName":null},"assignedTo":"elastic@elasticuser.com","determination":"NotAvailable","incidentId":12,"lastUpdateTime":"2020-09-23T19:44:36.29Z","classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z"} +{"alerts":{"mitreTechniques":[],"status":"Resolved","title":"'Exeselrun' malware was detected","threatFamilyName":null,"alertId":"da637291085389812387_-1296910232","category":"Malware","detectionSource":"WindowsDefenderAv","lastUpdatedTime":"2020-08-26T09:41:27.7233333Z","serviceSource":"MicrosoftDefenderATP","severity":"Informational","resolvedTime":"2020-06-30T11:13:12.2680434Z","description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.","devices":[{"deviceDnsName":"testserver4","healthStatus":"Inactive","osProcessor":"x64","rbacGroupId":0,"riskScore":"High","version":"Other","aadDeviceId":null,"firstSeen":"2020-06-30T08:55:08.8320449Z","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","osBuild":17763,"osPlatform":"Other","rbacGroupName":null}],"firstActivity":"2020-06-30T10:07:44.3144099Z","incidentId":12,"investigationId":9,"investigationState":"Benign","lastActivity":"2020-06-30T10:07:44.3144099Z","actorName":null,"assignedTo":"Automation","classification":null,"creationTime":"2020-06-30T10:08:58.9655663Z","determination":null,"entities":{"fileName":"SB.xsl","filePath":"C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5","sha1":"d1bb29ce3d01d01451e3623132545d5f577a1bd6","sha256":"ce8d3a3811a3bf923902d6924532308506fe5d024435ddee0cabf90ad9b29f6a","deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"File"}},"createdTime":"2020-06-30T09:32:31.85Z","determination":"NotAvailable","incidentId":12,"lastUpdateTime":"2020-09-23T19:44:36.29Z","redirectIncidentId":null,"assignedTo":"elastic@elasticuser.com","classification":"Unknown","incidentName":"12","severity":"Low","status":"Resolved","tags":[]} +{"classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z","determination":"NotAvailable","incidentName":"12","lastUpdateTime":"2020-09-23T19:44:36.29Z","redirectIncidentId":null,"severity":"Low","assignedTo":"elastic@elasticuser.com","status":"Resolved","incidentId":12,"tags":[],"alerts":{"assignedTo":"elastic@elasticuser.com","firstActivity":"2020-06-30T10:07:44.333733Z","investigationId":9,"mitreTechniques":[],"resolvedTime":"2020-06-30T11:13:12.2680434Z","title":"An active 'Exeselrun' malware was detected","alertId":"da637291085411733957_-1043898914","category":"Malware","classification":null,"detectionSource":"WindowsDefenderAv","determination":null,"threatFamilyName":null,"actorName":null,"serviceSource":"MicrosoftDefenderATP","status":"Resolved","creationTime":"2020-06-30T10:09:01.1569718Z","devices":[{"deviceDnsName":"TestServer4","healthStatus":"Inactive","osBuild":17763,"osProcessor":"x64","rbacGroupName":null,"riskScore":"High","version":"Other","aadDeviceId":null,"firstSeen":"2020-06-30T08:55:08.8320449Z","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","osPlatform":"Other","rbacGroupId":0}],"entities":{"filePath":"C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5","deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"File","fileName":"SB.xsl"},"incidentId":12,"investigationState":"Benign","lastActivity":"2020-06-30T10:07:44.333733Z","lastUpdatedTime":"2020-08-26T09:41:27.7233333Z","severity":"Low","description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection."}} +{"assignedTo":"elastic@elasticuser.com","classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z","redirectIncidentId":null,"severity":"Low","status":"Resolved","tags":[],"alerts":{"assignedTo":"elastic@elasticuser.com","determination":null,"serviceSource":"MicrosoftDefenderATP","severity":"Low","alertId":"da637291086161511365_-2075772905","classification":"FalsePositive","creationTime":"2020-06-30T10:10:16.1355657Z","description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.","entities":{"deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"Process","processCreationTime":"2020-06-30T10:31:04.1092404Z","processId":6720},"mitreTechniques":[],"title":"Suspicious 'AccessibilityEscalation' behavior was detected","category":"SuspiciousActivity","devices":[{"aadDeviceId":null,"mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","osProcessor":"x64","riskScore":"High","osPlatform":"Other","rbacGroupId":0,"rbacGroupName":null,"version":"Other","deviceDnsName":"testserver4","firstSeen":"2020-06-30T08:55:08.8320449Z","healthStatus":"Inactive","osBuild":17763}],"firstActivity":"2020-06-30T10:09:10.8889583Z","investigationState":"UnsupportedAlertType","status":"Resolved","detectionSource":"WindowsDefenderAv","incidentId":12,"investigationId":null,"lastActivity":"2020-06-30T10:31:09.4165785Z","lastUpdatedTime":"2020-09-23T19:44:37.9666667Z","resolvedTime":"2020-09-23T19:44:36.1092821Z","threatFamilyName":null,"actorName":null},"determination":"NotAvailable","incidentId":12,"incidentName":"12","lastUpdateTime":"2020-09-23T19:44:36.29Z"} +{"determination":"NotAvailable","severity":"Low","classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z","incidentId":12,"incidentName":"12","lastUpdateTime":"2020-09-23T19:44:36.29Z","redirectIncidentId":null,"alerts":{"lastActivity":"2020-06-30T10:31:09.4165785Z","lastUpdatedTime":"2020-09-23T19:44:37.9666667Z","actorName":null,"description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.","determination":null,"entities":{"accountName":"","entityType":"User"},"firstActivity":"2020-06-30T10:09:10.8889583Z","investigationState":"UnsupportedAlertType","serviceSource":"MicrosoftDefenderATP","status":"Resolved","title":"Suspicious 'AccessibilityEscalation' behavior was detected","classification":"FalsePositive","devices":[{"aadDeviceId":null,"healthStatus":"Inactive","osPlatform":"Other","osProcessor":"x64","riskScore":"High","deviceDnsName":"testserver4","firstSeen":"2020-06-30T08:55:08.8320449Z","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","osBuild":17763,"rbacGroupId":0,"rbacGroupName":null,"version":"Other"}],"mitreTechniques":[],"severity":"Low","threatFamilyName":null,"creationTime":"2020-06-30T10:10:16.1355657Z","detectionSource":"WindowsDefenderAv","incidentId":12,"alertId":"da637291086161511365_-2075772905","assignedTo":"elastic@elasticuser.com","category":"SuspiciousActivity","investigationId":null,"resolvedTime":"2020-09-23T19:44:36.1092821Z"},"assignedTo":"elastic@elasticuser.com","status":"Resolved","tags":[]} +{"determination":"NotAvailable","lastUpdateTime":"2020-09-23T19:44:36.29Z","tags":[],"alerts":{"investigationState":"UnsupportedAlertType","status":"Resolved","alertId":"da637291086161511365_-2075772905","assignedTo":"elastic@elasticuser.com","determination":null,"firstActivity":"2020-06-30T10:09:10.8889583Z","mitreTechniques":[],"resolvedTime":"2020-09-23T19:44:36.1092821Z","severity":"Low","actorName":null,"category":"SuspiciousActivity","description":"Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.","lastUpdatedTime":"2020-09-23T19:44:37.9666667Z","title":"Suspicious 'AccessibilityEscalation' behavior was detected","classification":"FalsePositive","creationTime":"2020-06-30T10:10:16.1355657Z","entities":{"deviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","entityType":"Process","processCreationTime":"2020-06-30T10:09:10.5747992Z","processId":1324},"incidentId":12,"serviceSource":"MicrosoftDefenderATP","threatFamilyName":null,"detectionSource":"WindowsDefenderAv","devices":[{"osPlatform":"Other","osProcessor":"x64","rbacGroupId":0,"riskScore":"High","version":"Other","aadDeviceId":null,"deviceDnsName":"testserver4","mdatpDeviceId":"75a63a39f9bc5a964f417c11f6277d5bf9489f0d","rbacGroupName":null,"firstSeen":"2020-06-30T08:55:08.8320449Z","healthStatus":"Inactive","osBuild":17763}],"investigationId":null,"lastActivity":"2020-06-30T10:31:09.4165785Z"},"assignedTo":"elastic@elasticuser.com","classification":"Unknown","createdTime":"2020-06-30T09:32:31.85Z","status":"Resolved","incidentId":12,"incidentName":"12","redirectIncidentId":null,"severity":"Low"} +{"incidentId":14,"incidentName":"Activity from infrequent country","redirectIncidentId":null,"tags":[],"alerts":{"category":"SuspiciousActivity","entities":{"aadUserId":"8e24c50a-a77c-4782-813f-965009b5ddf3","accountName":"brent","entityType":"User","userPrincipalName":"brent@elasticbv.onmicrosoft.com"},"incidentId":14,"investigationState":"UnsupportedAlertType","status":"New","actorName":null,"classification":"FalsePositive","description":"Brent Murphy (brent@elasticbv.onmicrosoft.com) performed an activity. No activity was performed in United States in the past 41 days.","investigationId":null,"lastActivity":"2020-07-27T15:47:22.088Z","lastUpdatedTime":"2020-09-23T19:32:17.5433333Z","mitreTechniques":[],"serviceSource":"MicrosoftCloudAppSecurity","severity":"Medium","threatFamilyName":null,"title":"Activity from infrequent country","assignedTo":"elastic@elasticuser.com","detectionSource":"MCAS","devices":[],"alertId":"caA214771F-6AB0-311D-B2B0-BECD3B4A967B","creationTime":"2020-07-27T15:54:20.52207Z","determination":null,"firstActivity":"2020-07-27T15:47:22.088Z","resolvedTime":null},"classification":"Unknown","determination":"NotAvailable","lastUpdateTime":"2020-09-23T19:32:05.8366667Z","severity":"Medium","status":"Active","assignedTo":"elastic@elasticuser.com","createdTime":"2020-07-27T15:54:21.58Z"} +{"incidentId":14,"incidentName":"Activity from infrequent country","severity":"Medium","status":"Active","tags":[],"alerts":{"description":"Brent Murphy (brent@elasticbv.onmicrosoft.com) performed an activity. No activity was performed in United States in the past 41 days.","detectionSource":"MCAS","firstActivity":"2020-07-27T15:47:22.088Z","investigationId":null,"investigationState":"UnsupportedAlertType","severity":"Medium","alertId":"caA214771F-6AB0-311D-B2B0-BECD3B4A967B","category":"SuspiciousActivity","classification":"FalsePositive","determination":null,"entities":{"entityType":"Ip","ipAddress":"73.172.171.53"},"incidentId":14,"serviceSource":"MicrosoftCloudAppSecurity","status":"New","actorName":null,"title":"Activity from infrequent country","devices":[],"lastActivity":"2020-07-27T15:47:22.088Z","lastUpdatedTime":"2020-09-23T19:32:17.5433333Z","creationTime":"2020-07-27T15:54:20.52207Z","mitreTechniques":[],"resolvedTime":null,"threatFamilyName":null,"assignedTo":"elastic@elasticuser.com"},"createdTime":"2020-07-27T15:54:21.58Z","determination":"NotAvailable","lastUpdateTime":"2020-09-23T19:32:05.8366667Z","redirectIncidentId":null,"assignedTo":"elastic@elasticuser.com","classification":"Unknown"} diff --git a/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log-expected.json b/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log-expected.json new file mode 100644 index 00000000000..1f81a57a98f --- /dev/null +++ b/x-pack/filebeat/module/microsoft/m365_defender/test/m365_defender-test.ndjson.log-expected.json @@ -0,0 +1,611 @@ +[ + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "Malware", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 892514711800, + "event.end": "2020-06-30T09:46:15.0876676Z", + "event.id": "da637291063515066999_-2102938302", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T09:31:22.5729558Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "file.hash.sha1": "ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281", + "file.hash.sha256": "fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356", + "file.name": "amsistream-1D89ECED25A52AB98B76FF619B7BA07A", + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 0, + "message": "'Mountsi' malware was detected", + "microsoft.m365_defender.alerts.assignedTo": "Automation", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T09:32:31.4579225Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "TestServer4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "File", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationId": 9, + "microsoft.m365_defender.alerts.investigationState": "Benign", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-08-26T09:41:27.7233333Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-06-30T11:13:12.2680434Z", + "microsoft.m365_defender.alerts.severity": "Informational", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "related.hash": [ + "ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281", + "fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356" + ], + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "Malware" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "Malware", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 892514711800, + "event.end": "2020-06-30T09:46:15.0876676Z", + "event.id": "da637291063515066999_-2102938302", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T09:31:22.5729558Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "file.hash.sha1": "ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281", + "file.hash.sha256": "fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356", + "file.name": "amsistream-B103C1A335BDB049E617D1AC4A41FCDC", + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 2071, + "message": "'Mountsi' malware was detected", + "microsoft.m365_defender.alerts.assignedTo": "Automation", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T09:32:31.4579225Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "TestServer4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "File", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationId": 9, + "microsoft.m365_defender.alerts.investigationState": "Benign", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-08-26T09:41:27.7233333Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-06-30T11:13:12.2680434Z", + "microsoft.m365_defender.alerts.severity": "Informational", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "related.hash": [ + "ffb1670c6c6a9c5b4c5cea8b6b8e68d62e7ff281", + "fd46705c4f67a8ef16e76259ca6d6253241e51a1f8952223145f92aa1907d356" + ], + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "Malware" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "Malware", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 0, + "event.end": "2020-06-30T10:07:44.3144099Z", + "event.id": "da637291085389812387_-1296910232", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T10:07:44.3144099Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "file.hash.sha1": "d1bb29ce3d01d01451e3623132545d5f577a1bd6", + "file.hash.sha256": "ce8d3a3811a3bf923902d6924532308506fe5d024435ddee0cabf90ad9b29f6a", + "file.name": "SB.xsl", + "file.path": "C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5", + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 4142, + "message": "'Exeselrun' malware was detected", + "microsoft.m365_defender.alerts.assignedTo": "Automation", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T10:08:58.9655663Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "testserver4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "File", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationId": 9, + "microsoft.m365_defender.alerts.investigationState": "Benign", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-08-26T09:41:27.7233333Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-06-30T11:13:12.2680434Z", + "microsoft.m365_defender.alerts.severity": "Informational", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "related.hash": [ + "d1bb29ce3d01d01451e3623132545d5f577a1bd6", + "ce8d3a3811a3bf923902d6924532308506fe5d024435ddee0cabf90ad9b29f6a" + ], + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nThis detection might indicate that the malware was stopped from delivering its payload. However, it is prudent to check the machine for signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "Malware" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "Malware", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 0, + "event.end": "2020-06-30T10:07:44.333733Z", + "event.id": "da637291085411733957_-1043898914", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T10:07:44.333733Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "file.name": "SB.xsl", + "file.path": "C:\\Windows\\Temp\\sb-sim-temp-ikyxqi\\sb_10554_bs_h4qpk5", + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 6249, + "message": "An active 'Exeselrun' malware was detected", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T10:09:01.1569718Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "TestServer4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "File", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationId": 9, + "microsoft.m365_defender.alerts.investigationState": "Benign", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-08-26T09:41:27.7233333Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-06-30T11:13:12.2680434Z", + "microsoft.m365_defender.alerts.severity": "Low", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "Malware" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "SuspiciousActivity", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 1318527620200, + "event.end": "2020-06-30T10:31:09.4165785Z", + "event.id": "da637291086161511365_-2075772905", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T10:09:10.8889583Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 8376, + "message": "Suspicious 'AccessibilityEscalation' behavior was detected", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.classification": "FalsePositive", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T10:10:16.1355657Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "testserver4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "Process", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationState": "UnsupportedAlertType", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-09-23T19:44:37.9666667Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-09-23T19:44:36.1092821Z", + "microsoft.m365_defender.alerts.severity": "Low", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "process.pid": 6720, + "process.start": "2020-06-30T10:31:04.1092404Z", + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "SuspiciousActivity" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "SuspiciousActivity", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 1318527620200, + "event.end": "2020-06-30T10:31:09.4165785Z", + "event.id": "da637291086161511365_-2075772905", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T10:09:10.8889583Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 10542, + "message": "Suspicious 'AccessibilityEscalation' behavior was detected", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.classification": "FalsePositive", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T10:10:16.1355657Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "testserver4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.accountName": "", + "microsoft.m365_defender.alerts.entities.entityType": "User", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationState": "UnsupportedAlertType", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-09-23T19:44:37.9666667Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-09-23T19:44:36.1092821Z", + "microsoft.m365_defender.alerts.severity": "Low", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "SuspiciousActivity" + }, + { + "@timestamp": "2020-09-23T19:44:36.29Z", + "cloud.provider": "azure", + "event.action": "SuspiciousActivity", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 1318527620200, + "event.end": "2020-06-30T10:31:09.4165785Z", + "event.id": "da637291086161511365_-2075772905", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftDefenderATP", + "event.severity": 2, + "event.start": "2020-06-30T10:09:10.8889583Z", + "event.timezone": "UTC", + "event.type": [ + "end" + ], + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 12598, + "message": "Suspicious 'AccessibilityEscalation' behavior was detected", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.classification": "FalsePositive", + "microsoft.m365_defender.alerts.creationTime": "2020-06-30T10:10:16.1355657Z", + "microsoft.m365_defender.alerts.detectionSource": "WindowsDefenderAv", + "microsoft.m365_defender.alerts.devices": [ + { + "deviceDnsName": "testserver4", + "firstSeen": "2020-06-30T08:55:08.8320449Z", + "healthStatus": "Inactive", + "mdatpDeviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "osBuild": 17763, + "osPlatform": "Other", + "osProcessor": "x64", + "rbacGroupId": 0, + "riskScore": "High", + "version": "Other" + } + ], + "microsoft.m365_defender.alerts.entities.deviceId": "75a63a39f9bc5a964f417c11f6277d5bf9489f0d", + "microsoft.m365_defender.alerts.entities.entityType": "Process", + "microsoft.m365_defender.alerts.incidentId": "12", + "microsoft.m365_defender.alerts.investigationState": "UnsupportedAlertType", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-09-23T19:44:37.9666667Z", + "microsoft.m365_defender.alerts.resolvedTime": "2020-09-23T19:44:36.1092821Z", + "microsoft.m365_defender.alerts.severity": "Low", + "microsoft.m365_defender.alerts.status": "Resolved", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "12", + "microsoft.m365_defender.incidentName": "12", + "microsoft.m365_defender.status": "Resolved", + "observer.name": "MicrosoftDefenderATP", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "process.pid": 1324, + "process.start": "2020-06-30T10:09:10.5747992Z", + "rule.description": "Malware and unwanted software are undesirable applications that perform annoying, disruptive, or harmful actions on affected machines. Some of these undesirable applications can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyber attacks.\n\nA malware is considered active if it is found running on the machine or it already has persistence mechanisms in place. Active malware detections are assigned higher severity ratings.\n\nBecause this malware was active, take precautionary measures and check for residual signs of infection.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "SuspiciousActivity" + }, + { + "@timestamp": "2020-09-23T19:32:05.8366667Z", + "cloud.provider": "azure", + "event.action": "SuspiciousActivity", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 0, + "event.end": "2020-07-27T15:47:22.088Z", + "event.id": "caA214771F-6AB0-311D-B2B0-BECD3B4A967B", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftCloudAppSecurity", + "event.severity": 3, + "event.start": "2020-07-27T15:47:22.088Z", + "event.timezone": "UTC", + "fileset.name": "m365_defender", + "host.user.id": "8e24c50a-a77c-4782-813f-965009b5ddf3", + "host.user.name": "brent@elasticbv.onmicrosoft.com", + "input.type": "log", + "log.offset": 14764, + "message": "Activity from infrequent country", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.classification": "FalsePositive", + "microsoft.m365_defender.alerts.creationTime": "2020-07-27T15:54:20.52207Z", + "microsoft.m365_defender.alerts.detectionSource": "MCAS", + "microsoft.m365_defender.alerts.entities.accountName": "brent", + "microsoft.m365_defender.alerts.entities.entityType": "User", + "microsoft.m365_defender.alerts.incidentId": "14", + "microsoft.m365_defender.alerts.investigationState": "UnsupportedAlertType", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-09-23T19:32:17.5433333Z", + "microsoft.m365_defender.alerts.severity": "Medium", + "microsoft.m365_defender.alerts.status": "New", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "14", + "microsoft.m365_defender.incidentName": "Activity from infrequent country", + "microsoft.m365_defender.status": "Active", + "observer.name": "MicrosoftCloudAppSecurity", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "related.user": [ + "brent@elasticbv.onmicrosoft.com" + ], + "rule.description": "Brent Murphy (brent@elasticbv.onmicrosoft.com) performed an activity. No activity was performed in United States in the past 41 days.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "SuspiciousActivity" + }, + { + "@timestamp": "2020-09-23T19:32:05.8366667Z", + "cloud.provider": "azure", + "event.action": "SuspiciousActivity", + "event.category": [ + "host" + ], + "event.dataset": "microsoft.m365_defender", + "event.duration": 0, + "event.end": "2020-07-27T15:47:22.088Z", + "event.id": "caA214771F-6AB0-311D-B2B0-BECD3B4A967B", + "event.kind": "alert", + "event.module": "microsoft", + "event.provider": "MicrosoftCloudAppSecurity", + "event.severity": 3, + "event.start": "2020-07-27T15:47:22.088Z", + "event.timezone": "UTC", + "fileset.name": "m365_defender", + "input.type": "log", + "log.offset": 16091, + "message": "Activity from infrequent country", + "microsoft.m365_defender.alerts.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.alerts.classification": "FalsePositive", + "microsoft.m365_defender.alerts.creationTime": "2020-07-27T15:54:20.52207Z", + "microsoft.m365_defender.alerts.detectionSource": "MCAS", + "microsoft.m365_defender.alerts.entities.entityType": "Ip", + "microsoft.m365_defender.alerts.entities.ipAddress": "73.172.171.53", + "microsoft.m365_defender.alerts.incidentId": "14", + "microsoft.m365_defender.alerts.investigationState": "UnsupportedAlertType", + "microsoft.m365_defender.alerts.lastUpdatedTime": "2020-09-23T19:32:17.5433333Z", + "microsoft.m365_defender.alerts.severity": "Medium", + "microsoft.m365_defender.alerts.status": "New", + "microsoft.m365_defender.assignedTo": "elastic@elasticuser.com", + "microsoft.m365_defender.classification": "Unknown", + "microsoft.m365_defender.determination": "NotAvailable", + "microsoft.m365_defender.incidentId": "14", + "microsoft.m365_defender.incidentName": "Activity from infrequent country", + "microsoft.m365_defender.status": "Active", + "observer.name": "MicrosoftCloudAppSecurity", + "observer.product": "365 Defender", + "observer.vendor": "Microsoft", + "rule.description": "Brent Murphy (brent@elasticbv.onmicrosoft.com) performed an activity. No activity was performed in United States in the past 41 days.", + "service.type": "microsoft", + "tags": [ + "m365-defender", + "forwarded" + ], + "threat.framework": "MITRE ATT&CK", + "threat.technique.name": "SuspiciousActivity" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/modules.d/microsoft.yml.disabled b/x-pack/filebeat/modules.d/microsoft.yml.disabled index 09c7211e179..63bcc20897a 100644 --- a/x-pack/filebeat/modules.d/microsoft.yml.disabled +++ b/x-pack/filebeat/modules.d/microsoft.yml.disabled @@ -13,7 +13,20 @@ # Oauth Client Secret #var.oauth2.client.secret: "" - + + # Oauth Token URL, should include the tenant ID + #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" + m365_defender: + enabled: true + # How often the API should be polled + #var.interval: 5m + + # Oauth Client ID + #var.oauth2.client.id: "" + + # Oauth Client Secret + #var.oauth2.client.secret: "" + # Oauth Token URL, should include the tenant ID #var.oauth2.token_url: "https://login.microsoftonline.com/TENANT-ID/oauth2/token" dhcp: From 0dd24289fa493ec742a54ad791cd7c3ed4bedf0f Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 6 Oct 2020 12:24:51 +0200 Subject: [PATCH 141/216] [Packetbeat] New SIP protocol (#21221) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * new protocol:sip:Make a directory and Readme file. new protocol:sip:update include list new protocol:sip:initial blank file DNSをベースとしてまずはDNSでやっている内容を解析開始・・・コメント付け中。 読み進めた分更新 パーサの実装を開始 パーサをのデコーダをsipPlugin内に移設もろもろ リクエスト、レスポンス判定を追加 SIPのパース, SDPのパース追加、パーサをいろいろばらばらに。醜い・・・ ヘッダパース系メソッドをsipMessageのメンバに変更 バッファリングの仕組みのプロトタイプ作成 ファイル分割、オブジェクト毎にファイルを分割。その他実装を進めているところ。とちゅう publish methodの実装 一部エラーハンドリングを追加 TODO更新とデータ構造を追加 ヘッダ処理諸々追加,途中 README TODO更新 ' 実働確認用に追加 フィールド名にsip.を付与、unixtimenanoをフィールドに追加(デフォルトのtimestampだとSIP信号を並び替えるのに精度不足なため。) フィールド命名規則を更新 Added english description change field name align the indents fields.yml update about timestamp テストケース追加 added testcase add testcases add testcases and fixed some bug cases add test cases add testcase parseSIPHeaders fixed bug cases. comment and refactoring update testcases add monitoring element named 'sip.message_ignored' move publish function call from expireBuffer to callback function when buffer expired. add testcase, bufferExpire remove unnecessary pkg add testcase at publish method add, edit and migrate test cases modify time duration change timer code remove fragmneted process translate comments add linux amd64 binary Comments translated update informations add windows bin update TODO list add no mandantory header parse check Add compact-form test case Add compact-form test case Add compact-form test case Add compact-form test case support compact form TODO list update add sip uri parser add detail mode add binary remove unnecessary file bug fix:broken when response parse in detail mode bug fix:detail mode modify detail mode modify detail mode Update Readme about compact form and parse detail sip header and request-uri Update Readme about compact form and parse detail sip header and request-uri Update Readme about compact form and parse detail sip header and request-uri Update Readme about compact form and parse detail sip header and request-uri expand config parsing options edit variable names arrangement and add text README file refine Readme message update Readme text update Readme on Configuration Go coding style was checked with golint Erase duplicate field in field.yml, move src and dst fields into sip filed Update docs, fields.asciidoc Update docs, fields.asciidoc * Fixes and style changes * Refactor to be more similar to http parser and add system tests * Add event action * Add related fields * Update fields and docs * Add sip to docs * Add beta warning * Parse SDP, Contact, Via and auth * Add suggestions Co-authored-by: tj8000rpm --- CHANGELOG.next.asciidoc | 1 + packetbeat/_meta/config/beat.docker.yml.tmpl | 3 + .../_meta/config/beat.reference.yml.tmpl | 13 + packetbeat/_meta/config/beat.yml.tmpl | 4 + packetbeat/_meta/sample_outputs/sip.json | 77 ++ packetbeat/docs/fields.asciidoc | 662 +++++++++++++++++ packetbeat/docs/shared-protocol-list.asciidoc | 1 + packetbeat/include/list.go | 1 + packetbeat/packetbeat.docker.yml | 3 + packetbeat/packetbeat.reference.yml | 13 + packetbeat/packetbeat.yml | 4 + packetbeat/pb/ecs.go | 6 +- packetbeat/pb/event.go | 47 +- packetbeat/protos/sip/README.md | 123 ++++ packetbeat/protos/sip/_meta/fields.yml | 238 +++++++ packetbeat/protos/sip/config.go | 41 ++ packetbeat/protos/sip/event.go | 102 +++ packetbeat/protos/sip/fields.go | 36 + packetbeat/protos/sip/parser.go | 469 ++++++++++++ packetbeat/protos/sip/plugin.go | 617 ++++++++++++++++ packetbeat/protos/sip/plugin_test.go | 168 +++++ .../tests/system/config/golden-tests.yml | 8 + .../tests/system/config/packetbeat.yml.j2 | 3 + .../tests/system/golden/sip-expected.json | 668 ++++++++++++++++++ .../sip_authenticated_register-expected.json | 142 ++++ packetbeat/tests/system/pcaps/sip.pcap | Bin 0 -> 6632 bytes .../pcaps/sip_authenticated_register.pcap | Bin 0 -> 1654 bytes .../tests/system/test_0099_golden_files.py | 3 + 28 files changed, 3451 insertions(+), 2 deletions(-) create mode 100644 packetbeat/_meta/sample_outputs/sip.json create mode 100644 packetbeat/protos/sip/README.md create mode 100644 packetbeat/protos/sip/_meta/fields.yml create mode 100644 packetbeat/protos/sip/config.go create mode 100644 packetbeat/protos/sip/event.go create mode 100644 packetbeat/protos/sip/fields.go create mode 100644 packetbeat/protos/sip/parser.go create mode 100644 packetbeat/protos/sip/plugin.go create mode 100644 packetbeat/protos/sip/plugin_test.go create mode 100644 packetbeat/tests/system/golden/sip-expected.json create mode 100644 packetbeat/tests/system/golden/sip_authenticated_register-expected.json create mode 100644 packetbeat/tests/system/pcaps/sip.pcap create mode 100644 packetbeat/tests/system/pcaps/sip_authenticated_register.pcap diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c86fc85e347..15c2f9fe8a8 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -746,6 +746,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d port. {pull}19209[19209] - Add ECS fields for x509 certs, event categorization, and related IP info. {pull}19167[19167] - Add 100-continue support {issue}15830[15830] {pull}19349[19349] +- Add initial SIP protocol support {pull}21221[21221] *Functionbeat* diff --git a/packetbeat/_meta/config/beat.docker.yml.tmpl b/packetbeat/_meta/config/beat.docker.yml.tmpl index f4f0db1f7e6..f9b573edfeb 100644 --- a/packetbeat/_meta/config/beat.docker.yml.tmpl +++ b/packetbeat/_meta/config/beat.docker.yml.tmpl @@ -36,3 +36,6 @@ packetbeat.protocols.cassandra: packetbeat.protocols.tls: ports: [443, 993, 995, 5223, 8443, 8883, 9243] + +packetbeat.protocols.sip: + ports: [5060] diff --git a/packetbeat/_meta/config/beat.reference.yml.tmpl b/packetbeat/_meta/config/beat.reference.yml.tmpl index 1a3aab315d7..722c47102dc 100644 --- a/packetbeat/_meta/config/beat.reference.yml.tmpl +++ b/packetbeat/_meta/config/beat.reference.yml.tmpl @@ -531,6 +531,19 @@ packetbeat.protocols: # Set to true to publish fields with null values in events. #keep_null: false +- type: sip + # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports. + ports: [5060] + + # Parse the authorization headers + parse_authorization: true + + # Parse body contents (only when body is SDP) + parse_body: true + + # Preserve original contents in event.original + keep_original: true + {{header "Monitored processes"}} # Packetbeat can enrich events with information about the process associated diff --git a/packetbeat/_meta/config/beat.yml.tmpl b/packetbeat/_meta/config/beat.yml.tmpl index fb221cba3c9..c5f9cfc0c23 100644 --- a/packetbeat/_meta/config/beat.yml.tmpl +++ b/packetbeat/_meta/config/beat.yml.tmpl @@ -101,6 +101,10 @@ packetbeat.protocols: - 8883 # Secure MQTT - 9243 # Elasticsearch +- type: sip + # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports. + ports: [5060] + {{header "Elasticsearch template setting"}} setup.template.settings: diff --git a/packetbeat/_meta/sample_outputs/sip.json b/packetbeat/_meta/sample_outputs/sip.json new file mode 100644 index 00000000000..4a57d85908f --- /dev/null +++ b/packetbeat/_meta/sample_outputs/sip.json @@ -0,0 +1,77 @@ +{ + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "192.168.1.2", + "client.port": 5060, + "destination.ip": "212.242.33.35", + "destination.port": 5060, + "event.action": "sip_register", + "event.category": [ + "network", + "protocol", + "authentication" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "REGISTER sip:sip.cybercity.dk SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport\r\nFrom: ;tag=6bac55c\r\nTo: \r\nCall-ID: 578222729-4665d775@578222732-4665d772\r\nContact: ;expires=1200;q=0.500\r\nExpires: 1200\r\nCSeq: 75 REGISTER\r\nContent-Length: 0\r\nAuthorization: Digest username=\"voi18062\",realm=\"sip.cybercity.dk\",uri=\"sip:192.168.1.2\",nonce=\"1701b22972b90f440c3e4eb250842bb\",opaque=\"1701a1351f70795\",nc=\"00000001\",response=\"79a0543188495d288c9ebbe0c881abdc\"\r\nMax-Forwards: 70\r\nUser-Agent: Nero SIPPS IP Phone Version 2.0.51.16\r\n\r\n", + "event.sequence": 75, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:dOa61R2NaaJsJlcFAiMIiyXX+Kk=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "sip.cybercity.dk" + ], + "related.ip": [ + "192.168.1.2", + "212.242.33.35" + ], + "related.user": [ + "voi18062" + ], + "server.ip": "212.242.33.35", + "server.port": 5060, + "sip.auth.realm": "sip.cybercity.dk", + "sip.auth.scheme": "Digest", + "sip.auth.uri.host": "192.168.1.2", + "sip.auth.uri.original": "sip:192.168.1.2", + "sip.auth.uri.scheme": "sip", + "sip.call_id": "578222729-4665d775@578222732-4665d772", + "sip.contact.uri.host": "sip.cybercity.dk", + "sip.contact.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "voi18062", + "sip.cseq.code": 75, + "sip.cseq.method": "REGISTER", + "sip.from.tag": "6bac55c", + "sip.from.uri.host": "sip.cybercity.dk", + "sip.from.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "voi18062", + "sip.max_forwards": 70, + "sip.method": "REGISTER", + "sip.to.uri.host": "sip.cybercity.dk", + "sip.to.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "voi18062", + "sip.type": "request", + "sip.uri.host": "sip.cybercity.dk", + "sip.uri.original": "sip:sip.cybercity.dk", + "sip.uri.scheme": "sip", + "sip.user_agent.original": "Nero SIPPS IP Phone Version 2.0.51.16", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport" + ], + "source.ip": "192.168.1.2", + "source.port": 5060, + "status": "OK", + "type": "sip", + "user.name": "voi18062" +} diff --git a/packetbeat/docs/fields.asciidoc b/packetbeat/docs/fields.asciidoc index 2c73f3dd277..14ed56f1578 100644 --- a/packetbeat/docs/fields.asciidoc +++ b/packetbeat/docs/fields.asciidoc @@ -35,6 +35,7 @@ grouped in the following categories: * <> * <> * <> +* <> * <> * <> * <> @@ -11680,6 +11681,667 @@ The return value of the Redis command in a human readable format. If the Redis command has resulted in an error, this field contains the error message returned by the Redis server. +-- + +[[exported-fields-sip]] +== SIP fields + +SIP-specific event fields. + + +[float] +=== sip + +Information about SIP traffic. + + +*`sip.timestamp`*:: ++ +-- +Timestamp with nano second precision. + +type: date_nanos + +-- + +*`sip.code`*:: ++ +-- +Response status code. + +type: keyword + +-- + +*`sip.method`*:: ++ +-- +Request method. + +type: keyword + +-- + +*`sip.status`*:: ++ +-- +Response status phrase. + +type: keyword + +-- + +*`sip.type`*:: ++ +-- +Either request or response. + +type: keyword + +-- + +*`sip.version`*:: ++ +-- +SIP protocol version. + +type: keyword + +-- + +*`sip.uri.original`*:: ++ +-- +The original URI. + +type: keyword + +-- + +*`sip.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.uri.scheme`*:: ++ +-- +The URI scheme. + +type: keyword + +-- + +*`sip.uri.username`*:: ++ +-- +The URI user name. + +type: keyword + +-- + +*`sip.uri.host`*:: ++ +-- +The URI host. + +type: keyword + +-- + +*`sip.uri.port`*:: ++ +-- +The URI port. + +type: keyword + +-- + +*`sip.accept`*:: ++ +-- +Accept header value. + +type: keyword + +-- + +*`sip.allow`*:: ++ +-- +Allowed methods. + +type: keyword + +-- + +*`sip.call_id`*:: ++ +-- +Call ID. + +type: keyword + +-- + +*`sip.content_length`*:: ++ +-- +type: long + +-- + +*`sip.content_type`*:: ++ +-- +type: keyword + +-- + +*`sip.max_forwards`*:: ++ +-- +type: long + +-- + +*`sip.supported`*:: ++ +-- +Supported methods. + +type: keyword + +-- + +*`sip.user_agent.original`*:: ++ +-- +type: keyword + +-- + +*`sip.user_agent.original.text`*:: ++ +-- +type: text + +-- + +*`sip.private.uri.original`*:: ++ +-- +Private original URI. + +type: keyword + +-- + +*`sip.private.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.private.uri.scheme`*:: ++ +-- +Private URI scheme. + +type: keyword + +-- + +*`sip.private.uri.username`*:: ++ +-- +Private URI user name. + +type: keyword + +-- + +*`sip.private.uri.host`*:: ++ +-- +Private URI host. + +type: keyword + +-- + +*`sip.private.uri.port`*:: ++ +-- +Private URI port. + +type: keyword + +-- + +*`sip.cseq.code`*:: ++ +-- +Sequence code. + +type: keyword + +-- + +*`sip.cseq.method`*:: ++ +-- +Sequence method. + +type: keyword + +-- + +*`sip.via.original`*:: ++ +-- +The original Via value. + +type: keyword + +-- + +*`sip.via.original.text`*:: ++ +-- +type: text + +-- + +*`sip.to.display_info`*:: ++ +-- +To display info + +type: keyword + +-- + +*`sip.to.uri.original`*:: ++ +-- +To original URI + +type: keyword + +-- + +*`sip.to.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.to.uri.scheme`*:: ++ +-- +To URI scheme + +type: keyword + +-- + +*`sip.to.uri.username`*:: ++ +-- +To URI user name + +type: keyword + +-- + +*`sip.to.uri.host`*:: ++ +-- +To URI host + +type: keyword + +-- + +*`sip.to.uri.port`*:: ++ +-- +To URI port + +type: keyword + +-- + +*`sip.to.tag`*:: ++ +-- +To tag + +type: keyword + +-- + +*`sip.from.display_info`*:: ++ +-- +From display info + +type: keyword + +-- + +*`sip.from.uri.original`*:: ++ +-- +From original URI + +type: keyword + +-- + +*`sip.from.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.from.uri.scheme`*:: ++ +-- +From URI scheme + +type: keyword + +-- + +*`sip.from.uri.username`*:: ++ +-- +From URI user name + +type: keyword + +-- + +*`sip.from.uri.host`*:: ++ +-- +From URI host + +type: keyword + +-- + +*`sip.from.uri.port`*:: ++ +-- +From URI port + +type: keyword + +-- + +*`sip.from.tag`*:: ++ +-- +From tag + +type: keyword + +-- + +*`sip.contact.display_info`*:: ++ +-- +Contact display info + +type: keyword + +-- + +*`sip.contact.uri.original`*:: ++ +-- +Contact original URI + +type: keyword + +-- + +*`sip.contact.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.contact.uri.scheme`*:: ++ +-- +Contat URI scheme + +type: keyword + +-- + +*`sip.contact.uri.username`*:: ++ +-- +Contact URI user name + +type: keyword + +-- + +*`sip.contact.uri.host`*:: ++ +-- +Contact URI host + +type: keyword + +-- + +*`sip.contact.uri.port`*:: ++ +-- +Contact URI port + +type: keyword + +-- + +*`sip.contact.transport`*:: ++ +-- +Contact transport + +type: keyword + +-- + +*`sip.contact.line`*:: ++ +-- +Contact line + +type: keyword + +-- + +*`sip.contact.expires`*:: ++ +-- +Contact expires + +type: keyword + +-- + +*`sip.contact.q`*:: ++ +-- +Contact Q + +type: keyword + +-- + +*`sip.auth.scheme`*:: ++ +-- +Auth scheme + +type: keyword + +-- + +*`sip.auth.realm`*:: ++ +-- +Auth realm + +type: keyword + +-- + +*`sip.auth.uri.original`*:: ++ +-- +Auth original URI + +type: keyword + +-- + +*`sip.auth.uri.original.text`*:: ++ +-- +type: text + +-- + +*`sip.auth.uri.scheme`*:: ++ +-- +Auth URI scheme + +type: keyword + +-- + +*`sip.auth.uri.host`*:: ++ +-- +Auth URI host + +type: keyword + +-- + +*`sip.auth.uri.port`*:: ++ +-- +Auth URI port + +type: keyword + +-- + +*`sip.sdp.version`*:: ++ +-- +SDP version + +type: keyword + +-- + +*`sip.sdp.owner.username`*:: ++ +-- +SDP owner user name + +type: keyword + +-- + +*`sip.sdp.owner.session_id`*:: ++ +-- +SDP owner session ID + +type: keyword + +-- + +*`sip.sdp.owner.version`*:: ++ +-- +SDP owner version + +type: keyword + +-- + +*`sip.sdp.owner.ip`*:: ++ +-- +SDP owner IP + +type: ip + +-- + +*`sip.sdp.session.name`*:: ++ +-- +SDP session name + +type: keyword + +-- + +*`sip.sdp.connection.info`*:: ++ +-- +SDP connection info + +type: keyword + +-- + +*`sip.sdp.connection.address`*:: ++ +-- +SDP connection address + +type: keyword + +-- + +*`sip.sdp.body.original`*:: ++ +-- +SDP original body + +type: keyword + +-- + +*`sip.sdp.body.original.text`*:: ++ +-- +type: text + -- [[exported-fields-thrift]] diff --git a/packetbeat/docs/shared-protocol-list.asciidoc b/packetbeat/docs/shared-protocol-list.asciidoc index 3e18fc35eb8..fdac127050a 100644 --- a/packetbeat/docs/shared-protocol-list.asciidoc +++ b/packetbeat/docs/shared-protocol-list.asciidoc @@ -18,3 +18,4 @@ - Memcache - NFS - TLS + - SIP/SDP (beta) diff --git a/packetbeat/include/list.go b/packetbeat/include/list.go index 0dc1f0bd053..748d525eb2f 100644 --- a/packetbeat/include/list.go +++ b/packetbeat/include/list.go @@ -33,6 +33,7 @@ import ( _ "github.com/elastic/beats/v7/packetbeat/protos/nfs" _ "github.com/elastic/beats/v7/packetbeat/protos/pgsql" _ "github.com/elastic/beats/v7/packetbeat/protos/redis" + _ "github.com/elastic/beats/v7/packetbeat/protos/sip" _ "github.com/elastic/beats/v7/packetbeat/protos/thrift" _ "github.com/elastic/beats/v7/packetbeat/protos/tls" ) diff --git a/packetbeat/packetbeat.docker.yml b/packetbeat/packetbeat.docker.yml index edffce72694..4cf9016a926 100644 --- a/packetbeat/packetbeat.docker.yml +++ b/packetbeat/packetbeat.docker.yml @@ -37,6 +37,9 @@ packetbeat.protocols.cassandra: packetbeat.protocols.tls: ports: [443, 993, 995, 5223, 8443, 8883, 9243] +packetbeat.protocols.sip: + ports: [5060] + processors: - add_cloud_metadata: ~ - add_docker_metadata: ~ diff --git a/packetbeat/packetbeat.reference.yml b/packetbeat/packetbeat.reference.yml index 0dc551698e9..6b936240bbb 100644 --- a/packetbeat/packetbeat.reference.yml +++ b/packetbeat/packetbeat.reference.yml @@ -531,6 +531,19 @@ packetbeat.protocols: # Set to true to publish fields with null values in events. #keep_null: false +- type: sip + # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports. + ports: [5060] + + # Parse the authorization headers + parse_authorization: true + + # Parse body contents (only when body is SDP) + parse_body: true + + # Preserve original contents in event.original + keep_original: true + # ============================ Monitored processes ============================= # Packetbeat can enrich events with information about the process associated diff --git a/packetbeat/packetbeat.yml b/packetbeat/packetbeat.yml index 53f87d73003..31c229b1ef7 100644 --- a/packetbeat/packetbeat.yml +++ b/packetbeat/packetbeat.yml @@ -101,6 +101,10 @@ packetbeat.protocols: - 8883 # Secure MQTT - 9243 # Elasticsearch +- type: sip + # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports. + ports: [5060] + # ======================= Elasticsearch template setting ======================= setup.template.settings: diff --git a/packetbeat/pb/ecs.go b/packetbeat/pb/ecs.go index b7722c2c22a..4594f7cd8c4 100644 --- a/packetbeat/pb/ecs.go +++ b/packetbeat/pb/ecs.go @@ -54,7 +54,11 @@ type ecsRelated struct { User []string `ecs:"user"` // overridden because this needs to be an array Hash []string `ecs:"hash"` + // overridden because this needs to be an array + Hosts []string `ecs:"hosts"` // for de-dup - ipSet map[string]struct{} + ipSet map[string]struct{} + userSet map[string]struct{} + hostSet map[string]struct{} } diff --git a/packetbeat/pb/event.go b/packetbeat/pb/event.go index f0287665c0d..cd652756f3e 100644 --- a/packetbeat/pb/event.go +++ b/packetbeat/pb/event.go @@ -147,10 +147,15 @@ func (f *Fields) SetDestination(endpoint *common.Endpoint) { func (f *Fields) AddIP(ip ...string) { if f.Related == nil { f.Related = &ecsRelated{ - ipSet: make(map[string]struct{}), + ipSet: make(map[string]struct{}), + userSet: make(map[string]struct{}), + hostSet: make(map[string]struct{}), } } for _, ipAddress := range ip { + if ipAddress == "" { + continue + } if _, ok := f.Related.ipSet[ipAddress]; !ok { f.Related.ipSet[ipAddress] = struct{}{} f.Related.IP = append(f.Related.IP, ipAddress) @@ -158,6 +163,46 @@ func (f *Fields) AddIP(ip ...string) { } } +// AddUser adds the given user names to the related ECS User field +func (f *Fields) AddUser(u ...string) { + if f.Related == nil { + f.Related = &ecsRelated{ + ipSet: make(map[string]struct{}), + userSet: make(map[string]struct{}), + hostSet: make(map[string]struct{}), + } + } + for _, user := range u { + if user == "" { + continue + } + if _, ok := f.Related.userSet[user]; !ok { + f.Related.userSet[user] = struct{}{} + f.Related.User = append(f.Related.User, user) + } + } +} + +// AddHost adds the given hosts to the related ECS Hosts field +func (f *Fields) AddHost(h ...string) { + if f.Related == nil { + f.Related = &ecsRelated{ + ipSet: make(map[string]struct{}), + userSet: make(map[string]struct{}), + hostSet: make(map[string]struct{}), + } + } + for _, host := range h { + if host == "" { + continue + } + if _, ok := f.Related.hostSet[host]; !ok { + f.Related.hostSet[host] = struct{}{} + f.Related.Hosts = append(f.Related.Hosts, host) + } + } +} + func makeProcess(p *common.Process) *ecs.Process { return &ecs.Process{ Name: p.Name, diff --git a/packetbeat/protos/sip/README.md b/packetbeat/protos/sip/README.md new file mode 100644 index 00000000000..5e5962675a1 --- /dev/null +++ b/packetbeat/protos/sip/README.md @@ -0,0 +1,123 @@ +# SIP (Session Initiation Protocol) for packetbeat + +The SIP (Session Initiation Protocol) is a communications protocol for signaling and controlling multimedia communication sessions. SIP is used by many VoIP applications, not only for enterprise uses but also telecom carriers. + +SIP is a text-based protocol like HTTP. But SIP has various unique features like : +- SIP is server-client model, but its role may change in a per call basis. +- SIP is request-response model, but server may (usually) reply with many responses to a single request. +- There are many requests and responses in one call. +- It is not known when the call will end. + +## Implementation + +### Published for each SIP message (request or response) + +- SIP is not a one to one message with request and response. Also order to each message is not determined (a response may be sent after previous response). +- Therefore the SIP responses and requests are published when packetbeat receives them immediately. +- If you need all SIP messages in throughout of SIP dialog, you need to retrieve from Elasticsearch using the SIP Call ID field etc. + +### Notes +* ``transport=tcp`` is not supported yet. +* ``content-encoding`` is not supported yet. +* Default timestamp field(@timestamp) precision is not sufficient(the sip response is often send immediately when request received eg. 100 Trying). You can sort to keep the message correct order using the ``sip.timestamp``(`date_nanos`) field. +* Body parsing is partially supported for ``application/sdp`` content type only. + +## Configuration + +```yaml +- type: sip + # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports. + ports: [5060] + + # Parse the authorization headers + parse_authorization: true + + # Parse body contents (only when body is SDP) + parse_body: true + + # Preserve original contents in event.original + keep_original: true +``` + +### Sample Full JSON Output + +```json +{ + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "192.168.1.2", + "client.port": 5060, + "destination.ip": "212.242.33.35", + "destination.port": 5060, + "event.action": "sip_register", + "event.category": [ + "network", + "protocol", + "authentication" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "REGISTER sip:sip.cybercity.dk SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport\r\nFrom: ;tag=6bac55c\r\nTo: \r\nCall-ID: 578222729-4665d775@578222732-4665d772\r\nContact: ;expires=1200;q=0.500\r\nExpires: 1200\r\nCSeq: 75 REGISTER\r\nContent-Length: 0\r\nAuthorization: Digest username=\"voi18062\",realm=\"sip.cybercity.dk\",uri=\"sip:192.168.1.2\",nonce=\"1701b22972b90f440c3e4eb250842bb\",opaque=\"1701a1351f70795\",nc=\"00000001\",response=\"79a0543188495d288c9ebbe0c881abdc\"\r\nMax-Forwards: 70\r\nUser-Agent: Nero SIPPS IP Phone Version 2.0.51.16\r\n\r\n", + "event.sequence": 75, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:dOa61R2NaaJsJlcFAiMIiyXX+Kk=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "sip.cybercity.dk" + ], + "related.ip": [ + "192.168.1.2", + "212.242.33.35" + ], + "related.user": [ + "voi18062" + ], + "server.ip": "212.242.33.35", + "server.port": 5060, + "sip.auth.realm": "sip.cybercity.dk", + "sip.auth.scheme": "Digest", + "sip.auth.uri.host": "192.168.1.2", + "sip.auth.uri.original": "sip:192.168.1.2", + "sip.auth.uri.scheme": "sip", + "sip.call_id": "578222729-4665d775@578222732-4665d772", + "sip.contact.uri.host": "sip.cybercity.dk", + "sip.contact.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "voi18062", + "sip.cseq.code": 75, + "sip.cseq.method": "REGISTER", + "sip.from.tag": "6bac55c", + "sip.from.uri.host": "sip.cybercity.dk", + "sip.from.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "voi18062", + "sip.max_forwards": 70, + "sip.method": "REGISTER", + "sip.to.uri.host": "sip.cybercity.dk", + "sip.to.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "voi18062", + "sip.type": "request", + "sip.uri.host": "sip.cybercity.dk", + "sip.uri.original": "sip:sip.cybercity.dk", + "sip.uri.scheme": "sip", + "sip.user_agent.original": "Nero SIPPS IP Phone Version 2.0.51.16", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport" + ], + "source.ip": "192.168.1.2", + "source.port": 5060, + "status": "OK", + "type": "sip", + "user.name": "voi18062" +} +``` + diff --git a/packetbeat/protos/sip/_meta/fields.yml b/packetbeat/protos/sip/_meta/fields.yml new file mode 100644 index 00000000000..fcbb1349dd1 --- /dev/null +++ b/packetbeat/protos/sip/_meta/fields.yml @@ -0,0 +1,238 @@ +- key: sip + title: "SIP" + description: SIP-specific event fields. + fields: + - name: sip + type: group + description: Information about SIP traffic. + fields: + - name: timestamp + type: date_nanos + description: Timestamp with nano second precision. + - name: code + type: keyword + description: Response status code. + - name: method + type: keyword + description: Request method. + - name: status + type: keyword + description: Response status phrase. + - name: type + type: keyword + description: Either request or response. + - name: version + type: keyword + description: SIP protocol version. + - name: uri.original + type: keyword + description: The original URI. + multi_fields: + - name: text + type: text + analyzer: simple + - name: uri.scheme + type: keyword + description: The URI scheme. + - name: uri.username + type: keyword + description: The URI user name. + - name: uri.host + type: keyword + description: The URI host. + - name: uri.port + type: keyword + description: The URI port. + - name: accept + type: keyword + description: Accept header value. + - name: allow + type: keyword + description: Allowed methods. + - name: call_id + type: keyword + description: Call ID. + - name: content_length + type: long + - name: content_type + type: keyword + - name: max_forwards + type: long + - name: supported + type: keyword + description: Supported methods. + - name: user_agent.original + type: keyword + multi_fields: + - name: text + type: text + analyzer: simple + - name: private.uri.original + type: keyword + description: Private original URI. + multi_fields: + - name: text + type: text + analyzer: simple + - name: private.uri.scheme + type: keyword + description: Private URI scheme. + - name: private.uri.username + type: keyword + description: Private URI user name. + - name: private.uri.host + type: keyword + description: Private URI host. + - name: private.uri.port + type: keyword + description: Private URI port. + - name: cseq.code + type: keyword + description: Sequence code. + - name: cseq.method + type: keyword + description: Sequence method. + - name: via.original + type: keyword + description: The original Via value. + multi_fields: + - name: text + type: text + analyzer: simple + - name: to.display_info + type: keyword + description: "To display info" + - name: to.uri.original + type: keyword + description: "To original URI" + multi_fields: + - name: text + type: text + analyzer: simple + - name: to.uri.scheme + type: keyword + description: "To URI scheme" + - name: to.uri.username + type: keyword + description: "To URI user name" + - name: to.uri.host + type: keyword + description: "To URI host" + - name: to.uri.port + type: keyword + description: "To URI port" + - name: to.tag + type: keyword + description: "To tag" + - name: from.display_info + type: keyword + description: "From display info" + - name: from.uri.original + type: keyword + description: "From original URI" + multi_fields: + - name: text + type: text + analyzer: simple + - name: from.uri.scheme + type: keyword + description: "From URI scheme" + - name: from.uri.username + type: keyword + description: "From URI user name" + - name: from.uri.host + type: keyword + description: "From URI host" + - name: from.uri.port + type: keyword + description: "From URI port" + - name: from.tag + type: keyword + description: "From tag" + - name: contact.display_info + type: keyword + description: "Contact display info" + - name: contact.uri.original + type: keyword + description: "Contact original URI" + multi_fields: + - name: text + type: text + analyzer: simple + - name: contact.uri.scheme + type: keyword + description: "Contat URI scheme" + - name: contact.uri.username + type: keyword + description: "Contact URI user name" + - name: contact.uri.host + type: keyword + description: "Contact URI host" + - name: contact.uri.port + type: keyword + description: "Contact URI port" + - name: contact.transport + type: keyword + description: "Contact transport" + - name: contact.line + type: keyword + description: "Contact line" + - name: contact.expires + type: keyword + description: "Contact expires" + - name: contact.q + type: keyword + description: "Contact Q" + - name: auth.scheme + type: keyword + description: "Auth scheme" + - name: auth.realm + type: keyword + description: "Auth realm" + - name: auth.uri.original + type: keyword + description: "Auth original URI" + multi_fields: + - name: text + type: text + analyzer: simple + - name: auth.uri.scheme + type: keyword + description: "Auth URI scheme" + - name: auth.uri.host + type: keyword + description: "Auth URI host" + - name: auth.uri.port + type: keyword + description: "Auth URI port" + - name: sdp.version + type: keyword + description: "SDP version" + - name: sdp.owner.username + type: keyword + description: "SDP owner user name" + - name: sdp.owner.session_id + type: keyword + description: "SDP owner session ID" + - name: sdp.owner.version + type: keyword + description: "SDP owner version" + - name: sdp.owner.ip + type: ip + description: "SDP owner IP" + - name: sdp.session.name + type: keyword + description: "SDP session name" + - name: sdp.connection.info + type: keyword + description: "SDP connection info" + - name: sdp.connection.address + type: keyword + description: "SDP connection address" + - name: sdp.body.original + type: keyword + description: "SDP original body" + multi_fields: + - name: text + type: text + analyzer: simple diff --git a/packetbeat/protos/sip/config.go b/packetbeat/protos/sip/config.go new file mode 100644 index 00000000000..58a92606e80 --- /dev/null +++ b/packetbeat/protos/sip/config.go @@ -0,0 +1,41 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package sip + +import ( + cfg "github.com/elastic/beats/v7/packetbeat/config" + "github.com/elastic/beats/v7/packetbeat/protos" +) + +type config struct { + cfg.ProtocolCommon `config:",inline"` + ParseAuthorization bool `config:"parse_authorization"` + ParseBody bool `config:"parse_body"` + KeepOriginal bool `config:"keep_original"` +} + +var ( + defaultConfig = config{ + ProtocolCommon: cfg.ProtocolCommon{ + TransactionTimeout: protos.DefaultTransactionExpiration, + }, + ParseAuthorization: true, + ParseBody: true, + KeepOriginal: true, + } +) diff --git a/packetbeat/protos/sip/event.go b/packetbeat/protos/sip/event.go new file mode 100644 index 00000000000..fcb9112fe93 --- /dev/null +++ b/packetbeat/protos/sip/event.go @@ -0,0 +1,102 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package sip + +import ( + "github.com/elastic/beats/v7/libbeat/common" +) + +// ProtocolFields contains SIP fields. +type ProtocolFields struct { + Timestamp int64 `ecs:"timestamp"` + Code int `ecs:"code"` + Method common.NetString `ecs:"method"` + Status common.NetString `ecs:"status"` + Type string `ecs:"type"` + Version string `ecs:"version"` + + URIOriginal common.NetString `ecs:"uri.original"` + URIScheme common.NetString `ecs:"uri.scheme"` + URIUsername common.NetString `ecs:"uri.username"` + URIHost common.NetString `ecs:"uri.host"` + URIPort int `ecs:"uri.port"` + + Accept common.NetString `ecs:"accept"` + Allow []string `ecs:"allow"` + CallID common.NetString `ecs:"call_id"` + ContentLength int `ecs:"content_length"` + ContentType common.NetString `ecs:"content_type"` + MaxForwards int `ecs:"max_forwards"` + Supported []string `ecs:"supported"` + UserAgentOriginal common.NetString `ecs:"user_agent.original"` + + PrivateURIOriginal common.NetString `ecs:"private.uri.original"` + PrivateURIScheme common.NetString `ecs:"private.uri.scheme"` + PrivateURIUsername common.NetString `ecs:"private.uri.username"` + PrivateURIHost common.NetString `ecs:"private.uri.host"` + PrivateURIPort int `ecs:"private.uri.port"` + + CseqCode int `ecs:"cseq.code"` + CseqMethod common.NetString `ecs:"cseq.method"` + + ViaOriginal []common.NetString `ecs:"via.original"` + + ToDisplayInfo common.NetString `ecs:"to.display_info"` + ToURIOriginal common.NetString `ecs:"to.uri.original"` + ToURIScheme common.NetString `ecs:"to.uri.scheme"` + ToURIUsername common.NetString `ecs:"to.uri.username"` + ToURIHost common.NetString `ecs:"to.uri.host"` + ToURIPort int `ecs:"to.uri.port"` + ToTag common.NetString `ecs:"to.tag"` + + FromDisplayInfo common.NetString `ecs:"from.display_info"` + FromURIOriginal common.NetString `ecs:"from.uri.original"` + FromURIScheme common.NetString `ecs:"from.uri.scheme"` + FromURIUsername common.NetString `ecs:"from.uri.username"` + FromURIHost common.NetString `ecs:"from.uri.host"` + FromURIPort int `ecs:"from.uri.port"` + FromTag common.NetString `ecs:"from.tag"` + + ContactDisplayInfo common.NetString `ecs:"contact.display_info"` + ContactURIOriginal common.NetString `ecs:"contact.uri.original"` + ContactURIScheme common.NetString `ecs:"contact.uri.scheme"` + ContactURIUsername common.NetString `ecs:"contact.uri.username"` + ContactURIHost common.NetString `ecs:"contact.uri.host"` + ContactURIPort int `ecs:"contact.uri.port"` + ContactTransport common.NetString `ecs:"contact.transport"` + ContactLine common.NetString `ecs:"contact.line"` + ContactExpires int `ecs:"contact.expires"` + ContactQ float64 `ecs:"contact.q"` + + AuthScheme common.NetString `ecs:"auth.scheme"` + AuthRealm common.NetString `ecs:"auth.realm"` + AuthURIOriginal common.NetString `ecs:"auth.uri.original"` + AuthURIScheme common.NetString `ecs:"auth.uri.scheme"` + AuthURIHost common.NetString `ecs:"auth.uri.host"` + AuthURIPort int `ecs:"auth.uri.port"` + + SDPVersion string `ecs:"sdp.version"` + SDPOwnerUsername common.NetString `ecs:"sdp.owner.username"` + SDPOwnerSessID common.NetString `ecs:"sdp.owner.session_id"` + SDPOwnerVersion common.NetString `ecs:"sdp.owner.version"` + SDPOwnerIP common.NetString `ecs:"sdp.owner.ip"` + SDPSessName common.NetString `ecs:"sdp.session.name"` + SDPConnInfo common.NetString `ecs:"sdp.connection.info"` + SDPConnAddr common.NetString `ecs:"sdp.connection.address"` + SDPBodyOriginal common.NetString `ecs:"sdp.body.original"` +} diff --git a/packetbeat/protos/sip/fields.go b/packetbeat/protos/sip/fields.go new file mode 100644 index 00000000000..87c93ab0cad --- /dev/null +++ b/packetbeat/protos/sip/fields.go @@ -0,0 +1,36 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Code generated by beats/dev-tools/cmd/asset/asset.go - DO NOT EDIT. + +package sip + +import ( + "github.com/elastic/beats/v7/libbeat/asset" +) + +func init() { + if err := asset.SetFields("packetbeat", "sip", asset.ModuleFieldsPri, AssetSip); err != nil { + panic(err) + } +} + +// AssetSip returns asset data. +// This is the base64 encoded gzipped contents of protos/sip. +func AssetSip() string { + return "eJzEmcFy4jgQhu95ii7u8QNwm5rsVnHLhsxeKY3dxqqRJUdqQ9in35KxFGEkZqRUhZzAcX+/1Pz9ozKP8AtPazB8eAAgTgLXsNpunlcPAA2aWvOBuJJr2G6eH82ANW95DXhASdByFI2pHmB+tX4AAHgEyXp0SPtHpwHXsNdqdFcuyBvZKt0z+wbYTzWS1QLSrG15Xc0VocKHBvEeDbHecZ1Wwwh3kkll/D8uJF9dHRw5dWDvBIO1kg0MGmtuuJLVQqtWDS5kfuHpqHQT13hBMyhpEAwxGs1Uv2T2SJ1q8qhvIxqaK5e8s9RnVjl0mpmrdVpQDvUvTh1q0PNilX151lmSD6hts3Pg1h2DVqRqJVz9EjtqXinN91wykcN+7RBcHfx42VT+tn4UxHeXNrxoEb5TcNmpXV1mkonTf6jtgPSDwMjCTd1hn9Vvu+wfLxs4V8aaMRrU9l0J1dZOqBi4U4ZKoLYuxhuULuLZuiWP1TUOWbRvUwV0yBrUcGBivNo0E0Ids5i2AJt5ZM1VrjAhdjwrBL4zIWDzdJ1QklDSTqDcU7cACiX3ift/O90+rtj7rlX6yHSzDJkI3oyD/VAwa2tbV5RqlzXjju1R0p8O+BdN7qD5gRFWpdHzfK6/b/yEm8iPIbeFdBSF/JJIChWSsRSK5MZTKBCLqJCdG1UhOxZXtcG3KveYsbXfsbLG6PliIuYfMjwzfso4cPb5L9d/ObvM1y/zOKmq4WYQ7LTjslU5O1i9KphrwdaurtGl42/R4eiv7tCWsqm3K/+Y+ERLSobdgf2gJ9i5M+64ti6BzB1th7R1ESSxfS6N2H4JarXqy637t1b9TfNO+GL7Tvi7Gtivv8DC0+rTJvboIht7eNLInp9tZc+Omdljs+3ssTFDT9hcS0/EiKntIZTVVO7r72fATWs7kWJ3O5G7GjzcRYHHpz3QDZeH/CKjuy7d9Hqokm33UCHm+BCebfoQHvO9g5Nm0hTTfXUKL7gsa7stTEHxfeAasx4Nee5cm0K/FUH/WeLYSF2Jrb+N1CUMPSE1MtHnE6eyKLA4RCbuXRPEr7+0z+nw8Ojsmfbg2EB7bPa8eWxs1kwzVAWPHlfbp2f3yDGGVEeJuiw7LXkqTyfnh4JBY5eQ+dgo0JgBsHlKi5T256zw2y7x5UP74EIKev5dYsmbN1MV9dx1ItXwWkmJtS2oso8mlv9RHz2ZLCRY02g0eTG9UJkRMaGfqjmVRdf0EbjkspgviK7/AwAA///sesAq" +} diff --git a/packetbeat/protos/sip/parser.go b/packetbeat/protos/sip/parser.go new file mode 100644 index 00000000000..55e66045e95 --- /dev/null +++ b/packetbeat/protos/sip/parser.go @@ -0,0 +1,469 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package sip + +import ( + "bytes" + "errors" + "fmt" + "time" + "unicode" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/streambuf" + "github.com/elastic/beats/v7/packetbeat/procs" + "github.com/elastic/beats/v7/packetbeat/protos" +) + +// Http Message +type message struct { + ts time.Time + hasContentLength bool + headerOffset int + + isRequest bool + ipPortTuple common.IPPortTuple + cmdlineTuple *common.ProcessTuple + + // Info + requestURI common.NetString + method common.NetString + statusCode uint16 + statusPhrase common.NetString + version version + + // Headers + contentLength int + contentType common.NetString + userAgent common.NetString + to common.NetString + from common.NetString + cseq common.NetString + callID common.NetString + maxForwards int + via []common.NetString + allow []string + supported []string + + headers map[string][]common.NetString + size uint64 + + firstLine []byte + rawHeaders []byte + body []byte + rawData []byte +} + +type version struct { + major uint8 + minor uint8 +} + +func (v version) String() string { + return fmt.Sprintf("%d.%d", v.major, v.minor) +} + +type parserState uint8 + +const ( + stateStart parserState = iota + stateHeaders + stateBody +) + +type parser struct { +} + +type parsingInfo struct { + tuple *common.IPPortTuple + + data []byte + + parseOffset int + state parserState + bodyReceived int + + pkt *protos.Packet +} + +var ( + constCRLF = []byte("\r\n") + constSIPVersion = []byte("SIP/") + nameContentLength = []byte("content-length") + nameContentType = []byte("content-type") + nameUserAgent = []byte("user-agent") + nameTo = []byte("to") + nameFrom = []byte("from") + nameCseq = []byte("cseq") + nameCallID = []byte("call-id") + nameMaxForwards = []byte("max-forwards") + nameAllow = []byte("allow") + nameSupported = []byte("supported") + nameVia = []byte("via") +) + +func newParser() *parser { + return &parser{} +} + +func (parser *parser) parse(pi *parsingInfo) (*message, error) { + m := &message{ + ts: pi.pkt.Ts, + ipPortTuple: pi.pkt.Tuple, + cmdlineTuple: procs.ProcWatcher.FindProcessesTupleTCP(&pi.pkt.Tuple), + rawData: pi.data, + } + for pi.parseOffset < len(pi.data) { + switch pi.state { + case stateStart: + if err := parser.parseSIPLine(pi, m); err != nil { + return m, err + } + case stateHeaders: + if err := parser.parseHeaders(pi, m); err != nil { + return m, err + } + case stateBody: + parser.parseBody(pi, m) + } + } + return m, nil +} + +func (*parser) parseSIPLine(pi *parsingInfo, m *message) error { + // ignore any CRLF appearing before the start-line (RFC3261 7.5) + pi.data = bytes.TrimLeft(pi.data[pi.parseOffset:], string(constCRLF)) + + i := bytes.Index(pi.data[pi.parseOffset:], constCRLF) + if i == -1 { + return errors.New("not found expected CRLF") + } + + // Very basic tests on the first line. Just to check that + // we have what looks as a SIP message + var ( + version []byte + err error + ) + + fline := pi.data[pi.parseOffset:i] + if len(fline) < 16 { // minimum line will be "SIP/2.0 XXX OK\r\n" + if isDebug { + debugf("First line too small") + } + return errors.New("first line too small") + } + + m.firstLine = fline + + if bytes.Equal(fline[0:4], constSIPVersion) { + // RESPONSE + m.isRequest = false + version = fline[4:7] + m.statusCode, m.statusPhrase, err = parseResponseStatus(fline[8:]) + if err != nil { + if isDebug { + debugf("Failed to understand SIP response status: %s", fline[8:]) + } + return errors.New("failed to parse response status") + } + + if isDebug { + debugf("SIP status_code=%d, status_phrase=%s", m.statusCode, m.statusPhrase) + } + } else { + // REQUEST + afterMethodIdx := bytes.IndexFunc(fline, unicode.IsSpace) + afterRequestURIIdx := bytes.LastIndexFunc(fline, unicode.IsSpace) + + // Make sure we have the VERB + URI + SIP_VERSION + if afterMethodIdx == -1 || afterRequestURIIdx == -1 || afterMethodIdx == afterRequestURIIdx { + if isDebug { + debugf("Couldn't understand SIP request: %s", fline) + } + return errors.New("failed to parse SIP request") + } + + m.method = common.NetString(fline[:afterMethodIdx]) + m.requestURI = common.NetString(fline[afterMethodIdx+1 : afterRequestURIIdx]) + + versionIdx := afterRequestURIIdx + len(constSIPVersion) + 1 + if len(fline) > versionIdx && bytes.Equal(fline[afterRequestURIIdx+1:versionIdx], constSIPVersion) { + m.isRequest = true + version = fline[versionIdx:] + } else { + if isDebug { + debugf("Couldn't understand SIP version: %s", fline) + } + return errors.New("failed to parse SIP version") + } + } + + m.version.major, m.version.minor, err = parseVersion(version) + if err != nil { + if isDebug { + debugf(err.Error(), version) + } + return err + } + if isDebug { + debugf("SIP version %d.%d", m.version.major, m.version.minor) + } + + // ok so far + pi.parseOffset = i + 2 + m.headerOffset = pi.parseOffset + pi.state = stateHeaders + + return nil +} + +func parseResponseStatus(s []byte) (uint16, []byte, error) { + if isDebug { + debugf("parseResponseStatus: %s", s) + } + + var phrase []byte + p := bytes.IndexByte(s, ' ') + if p == -1 { + p = len(s) + } else { + phrase = s[p+1:] + } + statusCode, err := parseInt(s[0:p]) + if err != nil { + return 0, nil, fmt.Errorf("Unable to parse status code from [%s]", s) + } + return uint16(statusCode), phrase, nil +} + +func parseVersion(s []byte) (uint8, uint8, error) { + if len(s) < 3 { + return 0, 0, errors.New("Invalid version") + } + + major := s[0] - '0' + minor := s[2] - '0' + + return uint8(major), uint8(minor), nil +} + +func (parser *parser) parseHeaders(pi *parsingInfo, m *message) error { + // check if it isn't headers end yet with /r/n/r/n + if !(len(pi.data)-pi.parseOffset >= 2 && + bytes.Equal(pi.data[pi.parseOffset:pi.parseOffset+2], constCRLF)) { + offset, err := parser.parseHeader(m, pi.data[pi.parseOffset:]) + if err != nil { + return err + } + + pi.parseOffset += offset + + return nil + } + + m.size = uint64(pi.parseOffset + 2) + m.rawHeaders = pi.data[:m.size] + pi.data = pi.data[m.size:] + pi.parseOffset = 0 + + if m.contentLength == 0 && (m.isRequest || m.hasContentLength) { + if isDebug { + debugf("Empty content length, ignore body") + } + return nil + } + + if isDebug { + debugf("Read body") + } + + pi.state = stateBody + + return nil +} + +func (parser *parser) parseHeader(m *message, data []byte) (int, error) { + if m.headers == nil { + m.headers = make(map[string][]common.NetString) + } + + i := bytes.Index(data, []byte(":")) + if i == -1 { + // Expected \":\" in headers. Assuming incomplete + if isDebug { + debugf("ignoring incomplete header %s", data) + } + return len(data), nil + } + + // enabled if required. Allocs for parameters slow down parser big times + if isDetailed { + detailedf("Data: %s", data) + detailedf("Header: %s", data[:i]) + } + + // skip folding line + for p := i + 1; p < len(data); { + q := bytes.Index(data[p:], constCRLF) + if q == -1 { + if isDebug { + debugf("ignoring incomplete header %s", data) + } + return len(data), nil + } + + p += q + if len(data) > p && (data[p+1] == ' ' || data[p+1] == '\t') { + p = p + 2 + continue + } + + headerName := getExpandedHeaderName(bytes.ToLower(data[:i])) + headerVal := bytes.TrimSpace(data[i+1 : p]) + if isDebug { + debugf("Header: '%s' Value: '%s'\n", data[:i], headerVal) + } + + // Headers we need for parsing. Make sure we always + // capture their value + switch { + case bytes.Equal(headerName, nameMaxForwards): + m.maxForwards, _ = parseInt(headerVal) + case bytes.Equal(headerName, nameContentLength): + m.contentLength, _ = parseInt(headerVal) + m.hasContentLength = true + case bytes.Equal(headerName, nameContentType): + m.contentType = headerVal + case bytes.Equal(headerName, nameUserAgent): + m.userAgent = headerVal + case bytes.Equal(headerName, nameTo): + m.to = headerVal + case bytes.Equal(headerName, nameFrom): + m.from = headerVal + case bytes.Equal(headerName, nameCseq): + m.cseq = headerVal + case bytes.Equal(headerName, nameCallID): + m.callID = headerVal + case bytes.Equal(headerName, nameAllow): + m.allow = parseCommaSeparatedList(headerVal) + case bytes.Equal(headerName, nameSupported): + m.supported = parseCommaSeparatedList(headerVal) + case bytes.Equal(headerName, nameVia): + m.via = append(m.via, headerVal) + } + + m.headers[string(headerName)] = append( + m.headers[string(headerName)], + headerVal, + ) + + return p + 2, nil + } + + return len(data), nil +} + +func parseCommaSeparatedList(s common.NetString) (list []string) { + values := bytes.Split(s, []byte(",")) + list = make([]string, len(values)) + for idx := range values { + list[idx] = string(bytes.ToLower(bytes.Trim(values[idx], " "))) + } + return list +} + +func (*parser) parseBody(pi *parsingInfo, m *message) { + nbytes := len(pi.data) + if nbytes >= m.contentLength-pi.bodyReceived { + wanted := m.contentLength - pi.bodyReceived + m.body = append(m.body, pi.data[:wanted]...) + pi.bodyReceived = m.contentLength + m.size += uint64(wanted) + pi.data = pi.data[wanted:] + } else { + m.body = append(m.body, pi.data...) + pi.data = nil + pi.bodyReceived += nbytes + m.size += uint64(nbytes) + if isDebug { + debugf("bodyReceived: %d", pi.bodyReceived) + } + } +} + +func (m *message) getEndpoints() (src *common.Endpoint, dst *common.Endpoint) { + source, destination := common.MakeEndpointPair(m.ipPortTuple.BaseTuple, m.cmdlineTuple) + src, dst = &source, &destination + return src, dst +} + +func parseInt(line []byte) (int, error) { + buf := streambuf.NewFixed(line) + i, err := buf.IntASCII(false) + return int(i), err + // TODO: is it an error if 'buf.Len() != 0 {}' ? +} + +func getExpandedHeaderName(n []byte) []byte { + if len(n) > 1 { + return n + } + switch string(n) { + // referfenced by https://www.iana.org/assignments/sip-parameters/sip-parameters.xhtml + case "a": + return []byte("accept-contact") //[RFC3841] + case "b": + return []byte("referred-by") //[RFC3892] + case "c": + return []byte("content-type") //[RFC3261] + case "d": + return []byte("request-disposition") //[RFC3841] + case "e": + return []byte("content-encoding") //[RFC3261] + case "f": + return []byte("from") //[RFC3261] + case "i": + return []byte("call-id") //[RFC3261] + case "j": + return []byte("reject-contact") //[RFC3841] + case "k": + return []byte("supported") //[RFC3261] + case "l": + return []byte("content-length") //[RFC3261] + case "m": + return []byte("contact") //[RFC3261] + case "o": + return []byte("event") //[RFC666)5] [RFC6446] + case "r": + return []byte("refer-to") //[RFC3515] + case "s": + return []byte("subject") //[RFC3261] + case "t": + return []byte("to") //[RFC3261] + case "u": + return []byte("allow-events") //[RFC6665] + case "v": + return []byte("via") //[RFC326)1] [RFC7118] + case "x": + return []byte("session-expires") //[RFC4028] + case "y": + return []byte("identity") //[RFC8224] + } + return n +} diff --git a/packetbeat/protos/sip/plugin.go b/packetbeat/protos/sip/plugin.go new file mode 100644 index 00000000000..e4cc0364d9a --- /dev/null +++ b/packetbeat/protos/sip/plugin.go @@ -0,0 +1,617 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package sip + +import ( + "bytes" + "fmt" + "strconv" + "strings" + "time" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/cfgwarn" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/packetbeat/pb" + "github.com/elastic/beats/v7/packetbeat/protos" +) + +var ( + debugf = logp.MakeDebug("sip") + detailedf = logp.MakeDebug("sipdetailed") +) + +// SIP application level protocol analyser plugin. +type plugin struct { + // config + ports []int + parseAuthorization bool + parseBody bool + keepOriginal bool + + results protos.Reporter +} + +var ( + isDebug = false + isDetailed = false +) + +func init() { + protos.Register("sip", New) +} + +func New( + testMode bool, + results protos.Reporter, + cfg *common.Config, +) (protos.Plugin, error) { + cfgwarn.Beta("packetbeat SIP protocol is used") + + p := &plugin{} + config := defaultConfig + if !testMode { + if err := cfg.Unpack(&config); err != nil { + return nil, err + } + } + + if err := p.init(results, &config); err != nil { + return nil, err + } + return p, nil +} + +// Init initializes the HTTP protocol analyser. +func (p *plugin) init(results protos.Reporter, config *config) error { + p.setFromConfig(config) + + isDebug = logp.IsDebug("sip") + isDetailed = logp.IsDebug("sipdetailed") + p.results = results + return nil +} + +func (p *plugin) setFromConfig(config *config) { + p.ports = config.Ports + p.keepOriginal = config.KeepOriginal + p.parseAuthorization = config.ParseAuthorization + p.parseBody = config.ParseBody +} + +func (p *plugin) GetPorts() []int { + return p.ports +} + +func (p *plugin) ParseUDP(pkt *protos.Packet) { + defer logp.Recover("SIP ParseUDP exception") + + if err := p.doParse(pkt); err != nil { + debugf("error: %s", err) + } +} + +func (p *plugin) doParse(pkt *protos.Packet) error { + if isDetailed { + detailedf("Payload received: [%s]", pkt.Payload) + } + + parser := newParser() + + pi := newParsingInfo(pkt) + m, err := parser.parse(pi) + if err != nil { + return err + } + + evt, err := p.buildEvent(m, pkt) + if err != nil { + return err + } + + p.publish(*evt) + + return nil +} + +func (p *plugin) publish(evt beat.Event) { + if p.results != nil { + p.results(evt) + } +} + +func newParsingInfo(pkt *protos.Packet) *parsingInfo { + return &parsingInfo{ + tuple: &pkt.Tuple, + data: pkt.Payload, + pkt: pkt, + } +} + +func (p *plugin) buildEvent(m *message, pkt *protos.Packet) (*beat.Event, error) { + status := common.OK_STATUS + if m.statusCode >= 400 { + status = common.ERROR_STATUS + } + + evt, pbf := pb.NewBeatEvent(m.ts) + fields := evt.Fields + fields["type"] = "sip" + fields["status"] = status + + var sipFields ProtocolFields + sipFields.Timestamp = time.Now().UnixNano() + if m.isRequest { + populateRequestFields(m, pbf, &sipFields) + } else { + populateResponseFields(m, &sipFields) + } + + p.populateHeadersFields(m, evt, pbf, &sipFields) + + if p.parseBody { + populateBodyFields(m, pbf, &sipFields) + } + + pbf.Network.IANANumber = "17" + pbf.Network.Application = "sip" + pbf.Network.Protocol = "sip" + pbf.Network.Transport = "udp" + + src, dst := m.getEndpoints() + pbf.SetSource(src) + pbf.SetDestination(dst) + + p.populateEventFields(m, pbf, sipFields) + + if err := pb.MarshalStruct(evt.Fields, "sip", sipFields); err != nil { + return nil, err + } + + return &evt, nil +} + +func populateRequestFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { + fields.Type = "request" + fields.Method = bytes.ToUpper(m.method) + fields.URIOriginal = m.requestURI + scheme, username, host, port, _ := parseURI(fields.URIOriginal) + fields.URIScheme = scheme + fields.URIHost = host + if !bytes.Equal(username, []byte(" ")) && !bytes.Equal(username, []byte("-")) { + fields.URIUsername = username + pbf.AddUser(string(username)) + } + fields.URIPort = port + fields.Version = m.version.String() + pbf.AddHost(string(host)) +} + +func populateResponseFields(m *message, fields *ProtocolFields) { + fields.Type = "response" + fields.Code = int(m.statusCode) + fields.Status = m.statusPhrase + fields.Version = m.version.String() +} + +func (p *plugin) populateHeadersFields(m *message, evt beat.Event, pbf *pb.Fields, fields *ProtocolFields) { + fields.Allow = m.allow + fields.CallID = m.callID + fields.ContentLength = m.contentLength + fields.ContentType = bytes.ToLower(m.contentType) + fields.MaxForwards = m.maxForwards + fields.Supported = m.supported + fields.UserAgentOriginal = m.userAgent + fields.ViaOriginal = m.via + + privateURI, found := m.headers["p-associated-uri"] + if found && len(privateURI) > 0 { + scheme, username, host, port, _ := parseURI(privateURI[0]) + fields.PrivateURIOriginal = privateURI[0] + fields.PrivateURIScheme = scheme + fields.PrivateURIHost = host + if !bytes.Equal(username, []byte(" ")) && !bytes.Equal(username, []byte("-")) { + fields.PrivateURIUsername = username + pbf.AddUser(string(username)) + } + fields.PrivateURIPort = port + pbf.AddHost(string(host)) + } + + if accept, found := m.headers["accept"]; found && len(accept) > 0 { + fields.Accept = bytes.ToLower(accept[0]) + } + + cseqParts := bytes.Split(m.cseq, []byte(" ")) + if len(cseqParts) == 2 { + fields.CseqCode, _ = strconv.Atoi(string(cseqParts[0])) + fields.CseqMethod = bytes.ToUpper(cseqParts[1]) + } + + populateFromFields(m, pbf, fields) + + populateToFields(m, pbf, fields) + + populateContactFields(m, pbf, fields) + + if p.parseAuthorization { + populateAuthFields(m, evt, pbf, fields) + } +} + +func populateFromFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { + if len(m.from) > 0 { + displayInfo, uri, params := parseFromToContact(m.from) + fields.FromDisplayInfo = displayInfo + fields.FromTag = params["tag"] + scheme, username, host, port, _ := parseURI(uri) + fields.FromURIOriginal = uri + fields.FromURIScheme = scheme + fields.FromURIHost = host + if !bytes.Equal(username, []byte(" ")) && !bytes.Equal(username, []byte("-")) { + fields.FromURIUsername = username + pbf.AddUser(string(username)) + } + fields.FromURIPort = port + pbf.AddHost(string(host)) + } +} + +func populateToFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { + if len(m.to) > 0 { + displayInfo, uri, params := parseFromToContact(m.to) + fields.ToDisplayInfo = displayInfo + fields.ToTag = params["tag"] + scheme, username, host, port, _ := parseURI(uri) + fields.ToURIOriginal = uri + fields.ToURIScheme = scheme + fields.ToURIHost = host + if !bytes.Equal(username, []byte(" ")) && !bytes.Equal(username, []byte("-")) { + fields.ToURIUsername = username + pbf.AddUser(string(username)) + } + fields.ToURIPort = port + pbf.AddHost(string(host)) + } +} + +func populateContactFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { + if contact, found := m.headers["contact"]; found && len(contact) > 0 { + displayInfo, uri, params := parseFromToContact(m.to) + fields.ContactDisplayInfo = displayInfo + fields.ContactExpires, _ = strconv.Atoi(string(params["expires"])) + fields.ContactQ, _ = strconv.ParseFloat(string(params["q"]), 64) + scheme, username, host, port, urlparams := parseURI(uri) + fields.ContactURIOriginal = uri + fields.ContactURIScheme = scheme + fields.ContactURIHost = host + if !bytes.Equal(username, []byte(" ")) && !bytes.Equal(username, []byte("-")) { + fields.ContactURIUsername = username + pbf.AddUser(string(username)) + } + fields.ContactURIPort = port + fields.ContactLine = urlparams["line"] + fields.ContactTransport = bytes.ToLower(urlparams["transport"]) + pbf.AddHost(string(host)) + } +} + +func (p *plugin) populateEventFields(m *message, pbf *pb.Fields, fields ProtocolFields) { + pbf.Event.Kind = "event" + pbf.Event.Type = []string{"info"} + pbf.Event.Dataset = "sip" + pbf.Event.Sequence = int64(fields.CseqCode) + + // TODO: Get these values from body + pbf.Event.Start = m.ts + pbf.Event.End = m.ts + // + + if p.keepOriginal { + pbf.Event.Original = string(m.rawData) + } + + pbf.Event.Category = []string{"network", "protocol"} + if _, found := m.headers["authorization"]; found { + pbf.Event.Category = append(pbf.Event.Category, "authentication") + } + + pbf.Event.Action = func() string { + if m.isRequest { + return fmt.Sprintf("sip-%s", strings.ToLower(string(m.method))) + } + return fmt.Sprintf("sip-%s", strings.ToLower(string(fields.CseqMethod))) + }() + + pbf.Event.Outcome = func() string { + switch { + case m.statusCode < 200: + return "" + case m.statusCode > 299: + return "failure" + } + return "success" + }() + + pbf.Event.Reason = string(fields.Status) +} + +func populateAuthFields(m *message, evt beat.Event, pbf *pb.Fields, fields *ProtocolFields) { + auths, found := m.headers["authorization"] + if !found || len(auths) == 0 { + if isDetailed { + detailedf("sip packet without authorization header") + } + return + } + + if isDetailed { + detailedf("sip packet with authorization header") + } + + auth := bytes.TrimSpace(auths[0]) + pos := bytes.IndexByte(auth, ' ') + if pos == -1 { + if isDebug { + debugf("malformed authorization header: missing scheme") + } + return + } + + fields.AuthScheme = auth[:pos] + + pos += 1 + for _, param := range bytes.Split(auth[pos:], []byte(",")) { + kv := bytes.SplitN(param, []byte("="), 2) + if len(kv) != 2 { + continue + } + kv[1] = bytes.Trim(kv[1], "'\" \t") + switch string(bytes.ToLower(bytes.TrimSpace(kv[0]))) { + case "realm": + fields.AuthRealm = kv[1] + case "username": + username := string(kv[1]) + if username != "" && username != "-" { + _, _ = evt.Fields.Put("user.name", username) + pbf.AddUser(username) + } + case "uri": + scheme, _, host, port, _ := parseURI(kv[1]) + fields.AuthURIOriginal = kv[1] + fields.AuthURIScheme = scheme + fields.AuthURIHost = host + fields.AuthURIPort = port + } + } +} + +var constSDPContentType = []byte("application/sdp") + +func populateBodyFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { + if !m.hasContentLength { + return + } + + if !bytes.Equal(m.contentType, constSDPContentType) { + if isDebug { + debugf("body content-type: %s is not supported", m.contentType) + } + return + } + + if _, found := m.headers["content-encoding"]; found { + if isDebug { + debugf("body decoding is not supported yet if content-endcoding is present") + } + return + } + + fields.SDPBodyOriginal = m.body + + var isInMedia bool + for _, line := range bytes.Split(m.body, []byte("\r\n")) { + kv := bytes.SplitN(line, []byte("="), 2) + if len(kv) != 2 { + continue + } + + kv[1] = bytes.TrimSpace(kv[1]) + ch := string(bytes.ToLower(bytes.TrimSpace(kv[0]))) + switch ch { + case "v": + fields.SDPVersion = string(kv[1]) + case "o": + var pos int + if kv[1][pos] == '"' { + endUserPos := bytes.IndexByte(kv[1][pos+1:], '"') + if !bytes.Equal(kv[1][pos+1:endUserPos], []byte("-")) { + fields.SDPOwnerUsername = kv[1][pos+1 : endUserPos] + } + pos = endUserPos + 1 + } + nParts := func() int { + if pos == 0 { + return 4 + } + return 3 // already have user + }() + parts := bytes.SplitN(kv[1][pos:], []byte(" "), nParts) + if len(parts) != nParts { + if isDebug { + debugf("malformed owner SDP line") + } + continue + } + if nParts == 4 { + if !bytes.Equal(parts[0], []byte("-")) { + fields.SDPOwnerUsername = parts[0] + } + parts = parts[1:] + } + fields.SDPOwnerSessID = parts[0] + fields.SDPOwnerVersion = parts[1] + fields.SDPOwnerIP = func() common.NetString { + p := bytes.Split(parts[2], []byte(" ")) + return p[len(p)-1] + }() + pbf.AddUser(string(fields.SDPOwnerUsername)) + pbf.AddIP(string(fields.SDPOwnerIP)) + case "s": + if !bytes.Equal(kv[1], []byte("-")) { + fields.SDPSessName = kv[1] + } + case "c": + if isInMedia { + continue + } + fields.SDPConnInfo = kv[1] + fields.SDPConnAddr = func() common.NetString { + p := bytes.Split(kv[1], []byte(" ")) + return p[len(p)-1] + }() + pbf.AddHost(string(fields.SDPConnAddr)) + case "m": + isInMedia = true + // TODO + case "i", "u", "e", "p", "b", "t", "r", "z", "k", "a": + // TODO + } + } +} + +func parseFromToContact(fromTo common.NetString) (displayInfo, uri common.NetString, params map[string]common.NetString) { + params = make(map[string]common.NetString) + + pos := bytes.IndexByte(fromTo, '<') + if pos == -1 { + pos = bytes.IndexByte(fromTo, ' ') + } + + displayInfo = bytes.Trim(fromTo[:pos], "'\"\t ") + + endURIPos := func() int { + if fromTo[pos] == '<' { + return bytes.IndexByte(fromTo, '>') + } + return bytes.IndexByte(fromTo, ';') + }() + + if endURIPos == -1 { + uri = bytes.TrimRight(fromTo[pos:], ">") + return + } + pos += 1 + uri = fromTo[pos:endURIPos] + + pos = endURIPos + 1 + for _, param := range bytes.Split(fromTo[pos:], []byte(";")) { + kv := bytes.SplitN(param, []byte("="), 2) + if len(kv) != 2 { + continue + } + params[string(bytes.ToLower(bytes.TrimSpace(kv[0])))] = kv[1] + } + + return displayInfo, uri, params +} + +func parseURI(uri common.NetString) (scheme, username, host common.NetString, port int, params map[string]common.NetString) { + var ( + prevChar rune + inIPv6 bool + idx int + hasParams bool + ) + uri = bytes.TrimSpace(uri) + prevChar = ' ' + pos := -1 + ppos := -1 + epos := len(uri) + + params = make(map[string]common.NetString) +loop: + for idx = 0; idx < len(uri); idx++ { + curChar := rune(uri[idx]) + + switch { + case idx == 0: + colonIdx := bytes.Index(uri, []byte(":")) + if colonIdx == -1 { + break loop + } + scheme = uri[:colonIdx] + idx += colonIdx + pos = idx + 1 + + case curChar == '[' && prevChar != '\\': + inIPv6 = true + + case curChar == ']' && prevChar != '\\': + inIPv6 = false + + case curChar == ';' && prevChar != '\\': + // we found end of URI + hasParams = true + epos = idx + break loop + + default: + // select wich part + switch curChar { + case '@': + if len(host) > 0 { + pos = ppos + host = nil + } + username = uri[pos:idx] + ppos = pos + pos = idx + 1 + case ':': + if !inIPv6 { + host = uri[pos:idx] + ppos = pos + pos = idx + 1 + } + } + } + + prevChar = curChar + } + + if pos > 0 && epos <= len(uri) && pos <= epos { + if len(host) == 0 { + host = bytes.TrimSpace(uri[pos:epos]) + } else { + port, _ = strconv.Atoi(string(bytes.TrimSpace(uri[pos:epos]))) + } + } + + if hasParams { + for _, param := range bytes.Split(uri[epos+1:], []byte(";")) { + kv := bytes.Split(param, []byte("=")) + if len(kv) != 2 { + continue + } + params[string(bytes.ToLower(bytes.TrimSpace(kv[0])))] = kv[1] + } + } + + return scheme, username, host, port, params +} diff --git a/packetbeat/protos/sip/plugin_test.go b/packetbeat/protos/sip/plugin_test.go new file mode 100644 index 00000000000..fc9ee53aff2 --- /dev/null +++ b/packetbeat/protos/sip/plugin_test.go @@ -0,0 +1,168 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build !integration + +package sip + +import ( + "testing" + "time" + + "github.com/stretchr/testify/assert" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/packetbeat/protos" +) + +func TestParseURI(t *testing.T) { + scheme, username, host, port, params := parseURI(common.NetString("sip:test@10.0.2.15:5060")) + assert.Equal(t, common.NetString("sip"), scheme) + assert.Equal(t, common.NetString("test"), username) + assert.Equal(t, common.NetString("10.0.2.15"), host) + assert.Equal(t, map[string]common.NetString{}, params) + assert.Equal(t, 5060, port) + + scheme, username, host, port, params = parseURI(common.NetString("sips:test@10.0.2.15:5061 ; transport=udp")) + assert.Equal(t, common.NetString("sips"), scheme) + assert.Equal(t, common.NetString("test"), username) + assert.Equal(t, common.NetString("10.0.2.15"), host) + assert.Equal(t, common.NetString("udp"), params["transport"]) + assert.Equal(t, 5061, port) + + scheme, username, host, port, params = parseURI(common.NetString("mailto:192.168.0.2")) + assert.Equal(t, common.NetString("mailto"), scheme) + assert.Equal(t, common.NetString(nil), username) + assert.Equal(t, common.NetString("192.168.0.2"), host) + assert.Equal(t, map[string]common.NetString{}, params) + assert.Equal(t, 0, port) +} + +func TestParseFromTo(t *testing.T) { + // To + displayInfo, uri, params := parseFromToContact(common.NetString("test ;tag=QvN921")) + assert.Equal(t, common.NetString("test"), displayInfo) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), uri) + assert.Equal(t, common.NetString("QvN921"), params["tag"]) + displayInfo, uri, params = parseFromToContact(common.NetString("test ")) + assert.Equal(t, common.NetString("test"), displayInfo) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), uri) + assert.Equal(t, common.NetString(nil), params["tag"]) + + // From + displayInfo, uri, params = parseFromToContact(common.NetString("\"PCMU/8000\" ;tag=1")) + assert.Equal(t, common.NetString("PCMU/8000"), displayInfo) + assert.Equal(t, common.NetString("sip:sipp@10.0.2.15:5060"), uri) + assert.Equal(t, common.NetString("1"), params["tag"]) + displayInfo, uri, params = parseFromToContact(common.NetString("\"Matthew Hodgson\" ;tag=5c7cdb68")) + assert.Equal(t, common.NetString("Matthew Hodgson"), displayInfo) + assert.Equal(t, common.NetString("sip:matthew@mxtelecom.com"), uri) + assert.Equal(t, common.NetString("5c7cdb68"), params["tag"]) + displayInfo, uri, params = parseFromToContact(common.NetString(";tag=5c7cdb68")) + assert.Equal(t, common.NetString(nil), displayInfo) + assert.Equal(t, common.NetString("sip:matthew@mxtelecom.com"), uri) + assert.Equal(t, common.NetString("5c7cdb68"), params["tag"]) + displayInfo, uri, params = parseFromToContact(common.NetString("")) + assert.Equal(t, common.NetString(nil), displayInfo) + assert.Equal(t, common.NetString("sip:matthew@mxtelecom.com"), uri) + assert.Equal(t, common.NetString(nil), params["tag"]) + + // Contact + displayInfo, uri, _ = parseFromToContact(common.NetString("")) + assert.Equal(t, common.NetString(nil), displayInfo) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060;transport=udp"), uri) + displayInfo, uri, params = parseFromToContact(common.NetString(";expires=1200;q=0.500")) + assert.Equal(t, common.NetString(nil), displayInfo) + assert.Equal(t, common.NetString("sip:voi18062@192.168.1.2:5060;line=aca6b97ca3f5e51a"), uri) + assert.Equal(t, common.NetString("1200"), params["expires"]) + assert.Equal(t, common.NetString("0.500"), params["q"]) + displayInfo, uri, params = parseFromToContact(common.NetString(" \"Mr. Watson\" ;q=0.7; expires=3600")) + assert.Equal(t, common.NetString("Mr. Watson"), displayInfo) + assert.Equal(t, common.NetString("sip:watson@worcester.bell-telephone.com"), uri) + assert.Equal(t, common.NetString("3600"), params["expires"]) + assert.Equal(t, common.NetString("0.7"), params["q"]) + displayInfo, uri, params = parseFromToContact(common.NetString(" \"Mr. Watson\" ;q=0.1")) + assert.Equal(t, common.NetString("Mr. Watson"), displayInfo) + assert.Equal(t, common.NetString("mailto:watson@bell-telephone.com"), uri) + assert.Equal(t, common.NetString("0.1"), params["q"]) +} + +func TestParseUDP(t *testing.T) { + gotEvent := new(beat.Event) + reporter := func(evt beat.Event) { + gotEvent = &evt + } + const data = "INVITE sip:test@10.0.2.15:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0\r\nFrom: \"DVI4/8000\" ;tag=1\r\nTo: test \r\nCall-ID: 1-2187@10.0.2.20\r\nCSeq: 1 INVITE\r\nContact: sip:sipp@10.0.2.20:5060\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 123\r\n\r\nv=0\r\no=- 42 42 IN IP4 10.0.2.20\r\ns=-\r\nc=IN IP4 10.0.2.20\r\nt=0 0\r\nm=audio 6000 RTP/AVP 5\r\na=rtpmap:5 DVI4/8000\r\na=recvonly\r\n" + p, _ := New(true, reporter, nil) + plugin := p.(*plugin) + plugin.ParseUDP(&protos.Packet{ + Ts: time.Now(), + Tuple: common.IPPortTuple{}, + Payload: []byte(data), + }) + fields := *gotEvent + + assert.Equal(t, common.NetString("1-2187@10.0.2.20"), getVal(fields, "sip.call_id")) + assert.Equal(t, common.NetString("test"), getVal(fields, "sip.contact.display_info")) + assert.Equal(t, common.NetString("10.0.2.15"), getVal(fields, "sip.contact.uri.host")) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), getVal(fields, "sip.contact.uri.original")) + assert.Equal(t, 5060, getVal(fields, "sip.contact.uri.port")) + assert.Equal(t, common.NetString("sip"), getVal(fields, "sip.contact.uri.scheme")) + assert.Equal(t, common.NetString("test"), getVal(fields, "sip.contact.uri.username")) + assert.Equal(t, 123, getVal(fields, "sip.content_length")) + assert.Equal(t, common.NetString("application/sdp"), getVal(fields, "sip.content_type")) + assert.Equal(t, 1, getVal(fields, "sip.cseq.code")) + assert.Equal(t, common.NetString("INVITE"), getVal(fields, "sip.cseq.method")) + assert.Equal(t, common.NetString("DVI4/8000"), getVal(fields, "sip.from.display_info")) + assert.Equal(t, common.NetString("1"), getVal(fields, "sip.from.tag")) + assert.Equal(t, common.NetString("10.0.2.20"), getVal(fields, "sip.from.uri.host")) + assert.Equal(t, common.NetString("sip:sipp@10.0.2.20:5060"), getVal(fields, "sip.from.uri.original")) + assert.Equal(t, 5060, getVal(fields, "sip.from.uri.port")) + assert.Equal(t, common.NetString("sip"), getVal(fields, "sip.from.uri.scheme")) + assert.Equal(t, common.NetString("sipp"), getVal(fields, "sip.from.uri.username")) + assert.Equal(t, 70, getVal(fields, "sip.max_forwards")) + assert.Equal(t, common.NetString("INVITE"), getVal(fields, "sip.method")) + assert.Equal(t, common.NetString("10.0.2.20"), getVal(fields, "sip.sdp.connection.address")) + assert.Equal(t, common.NetString("IN IP4 10.0.2.20"), getVal(fields, "sip.sdp.connection.info")) + assert.Equal(t, common.NetString("10.0.2.20"), getVal(fields, "sip.sdp.owner.ip")) + assert.Equal(t, common.NetString("42"), getVal(fields, "sip.sdp.owner.session_id")) + assert.Equal(t, common.NetString("42"), getVal(fields, "sip.sdp.owner.version")) + assert.Equal(t, nil, getVal(fields, "sip.sdp.owner.username")) + assert.Equal(t, nil, getVal(fields, "sip.sdp.session.name")) + assert.Equal(t, "0", getVal(fields, "sip.sdp.version")) + assert.Equal(t, common.NetString("test"), getVal(fields, "sip.to.display_info")) + assert.Equal(t, nil, getVal(fields, "sip.to.tag")) + assert.Equal(t, common.NetString("10.0.2.15"), getVal(fields, "sip.to.uri.host")) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), getVal(fields, "sip.to.uri.original")) + assert.Equal(t, 5060, getVal(fields, "sip.to.uri.port")) + assert.Equal(t, common.NetString("sip"), getVal(fields, "sip.to.uri.scheme")) + assert.Equal(t, common.NetString("test"), getVal(fields, "sip.to.uri.username")) + assert.Equal(t, "request", getVal(fields, "sip.type")) + assert.Equal(t, common.NetString("10.0.2.15"), getVal(fields, "sip.uri.host")) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), getVal(fields, "sip.uri.original")) + assert.Equal(t, 5060, getVal(fields, "sip.uri.port")) + assert.Equal(t, common.NetString("sip"), getVal(fields, "sip.uri.scheme")) + assert.Equal(t, common.NetString("test"), getVal(fields, "sip.uri.username")) + assert.Equal(t, "2.0", getVal(fields, "sip.version")) + assert.EqualValues(t, []common.NetString{common.NetString("SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0")}, getVal(fields, "sip.via.original")) +} + +func getVal(f beat.Event, k string) interface{} { + v, _ := f.GetValue(k) + return v +} diff --git a/packetbeat/tests/system/config/golden-tests.yml b/packetbeat/tests/system/config/golden-tests.yml index 6d49ce9c221..42ad0c746d2 100644 --- a/packetbeat/tests/system/config/golden-tests.yml +++ b/packetbeat/tests/system/config/golden-tests.yml @@ -27,3 +27,11 @@ test_cases: - name: TLS 1.3 pcap: pcaps/tls-version-13.pcap config: {} + + - name: SIP + pcap: pcaps/sip.pcap + config: {} + + - name: SIP Authenticated Register + pcap: pcaps/sip_authenticated_register.pcap + config: {} diff --git a/packetbeat/tests/system/config/packetbeat.yml.j2 b/packetbeat/tests/system/config/packetbeat.yml.j2 index b687f6f0402..7b253d8ec2c 100644 --- a/packetbeat/tests/system/config/packetbeat.yml.j2 +++ b/packetbeat/tests/system/config/packetbeat.yml.j2 @@ -148,6 +148,9 @@ packetbeat.protocols: {% if mongodb_max_docs is not none %} max_docs: {{mongodb_max_docs}}{% endif %} {% if mongodb_max_doc_length is not none %} max_doc_length: {{mongodb_max_doc_length}}{% endif %} +- type: sip + ports: [{{ sip_ports|default([5060])|join(", ") }}] + {% if procs_enabled %} #=========================== Monitored processes ============================== diff --git a/packetbeat/tests/system/golden/sip-expected.json b/packetbeat/tests/system/golden/sip-expected.json new file mode 100644 index 00000000000..37d95d715a7 --- /dev/null +++ b/packetbeat/tests/system/golden/sip-expected.json @@ -0,0 +1,668 @@ +[ + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.20", + "client.port": 5060, + "destination.ip": "10.0.2.15", + "destination.port": 5060, + "event.action": "sip-invite", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "INVITE sip:test@10.0.2.15:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0\r\nFrom: \"DVI4/8000\" ;tag=1\r\nTo: test \r\nCall-ID: 1-2187@10.0.2.20\r\nCSeq: 1 INVITE\r\nContact: sip:sipp@10.0.2.20:5060\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 123\r\n\r\nv=0\r\no=- 42 42 IN IP4 10.0.2.20\r\ns=-\r\nc=IN IP4 10.0.2.20\r\nt=0 0\r\nm=audio 6000 RTP/AVP 5\r\na=rtpmap:5 DVI4/8000\r\na=recvonly\r\n", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.ip": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.user": [ + "test", + "sipp" + ], + "server.ip": "10.0.2.15", + "server.port": 5060, + "sip.call_id": "1-2187@10.0.2.20", + "sip.contact.display_info": "test", + "sip.contact.uri.host": "10.0.2.15", + "sip.contact.uri.original": "sip:test@10.0.2.15:5060", + "sip.contact.uri.port": 5060, + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "test", + "sip.content_length": 123, + "sip.content_type": "application/sdp", + "sip.cseq.code": 1, + "sip.cseq.method": "INVITE", + "sip.from.display_info": "DVI4/8000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.max_forwards": 70, + "sip.method": "INVITE", + "sip.sdp.body.original": "v=0\r\no=- 42 42 IN IP4 10.0.2.20\r\ns=-\r\nc=IN IP4 10.0.2.20\r\nt=0 0\r\nm=audio 6000 RTP/AVP 5\r\na=rtpmap:5 DVI4/8000\r\na=recvonly\r\n", + "sip.sdp.connection.address": "10.0.2.20", + "sip.sdp.connection.info": "IN IP4 10.0.2.20", + "sip.sdp.owner.ip": "10.0.2.20", + "sip.sdp.owner.session_id": "42", + "sip.sdp.owner.version": "42", + "sip.sdp.version": "0", + "sip.to.display_info": "test", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "request", + "sip.uri.host": "10.0.2.15", + "sip.uri.original": "sip:test@10.0.2.15:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "test", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0" + ], + "source.ip": "10.0.2.20", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.15", + "client.port": 5060, + "destination.ip": "10.0.2.20", + "destination.port": 5060, + "event.action": "sip-invite", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0\r\nFrom: \"DVI4/8000\" ;tag=1\r\nTo: test \r\nCall-ID: 1-2187@10.0.2.20\r\nCSeq: 1 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit\r\nContent-Length: 0\r\n\r\n", + "event.reason": "Trying", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.ip": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.user": [ + "sipp", + "test" + ], + "server.ip": "10.0.2.20", + "server.port": 5060, + "sip.call_id": "1-2187@10.0.2.20", + "sip.code": 100, + "sip.cseq.code": 1, + "sip.cseq.method": "INVITE", + "sip.from.display_info": "DVI4/8000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.status": "Trying", + "sip.to.display_info": "test", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "response", + "sip.user_agent.original": "FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-0" + ], + "source.ip": "10.0.2.15", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.20", + "client.port": 5060, + "destination.ip": "10.0.2.15", + "destination.port": 5060, + "event.action": "sip-ack", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "ACK sip:test@10.0.2.15:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-5\r\nFrom: \"DVI4/8000\" ;tag=1\r\nTo: test ;tag=e2jv529vDZ3eQ\r\nCall-ID: 1-2187@10.0.2.20\r\nCSeq: 1 ACK\r\nContact: sip:sipp@10.0.2.20:5060\r\nMax-Forwards: 70\r\nContent-Length: 0\r\n\r\n", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.ip": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.user": [ + "test", + "sipp" + ], + "server.ip": "10.0.2.15", + "server.port": 5060, + "sip.call_id": "1-2187@10.0.2.20", + "sip.contact.display_info": "test", + "sip.contact.uri.host": "10.0.2.15", + "sip.contact.uri.original": "sip:test@10.0.2.15:5060", + "sip.contact.uri.port": 5060, + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "test", + "sip.cseq.code": 1, + "sip.cseq.method": "ACK", + "sip.from.display_info": "DVI4/8000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.max_forwards": 70, + "sip.method": "ACK", + "sip.to.display_info": "test", + "sip.to.tag": "e2jv529vDZ3eQ", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "request", + "sip.uri.host": "10.0.2.15", + "sip.uri.original": "sip:test@10.0.2.15:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "test", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2187-1-5" + ], + "source.ip": "10.0.2.20", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.15", + "client.port": 5060, + "destination.ip": "10.0.2.20", + "destination.port": 5060, + "event.action": "sip-bye", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "BYE sip:sipp@10.0.2.20:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.15;rport;branch=z9hG4bKDQ7XK6BBH57ya\r\nMax-Forwards: 70\r\nFrom: test ;tag=e2jv529vDZ3eQ\r\nTo: \"DVI4/8000\" ;tag=1\r\nCall-ID: 1-2187@10.0.2.20\r\nCSeq: 99750433 BYE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE\r\nSupported: timer, path, replaces\r\nReason: Q.850;cause=16;text=\"NORMAL_CLEARING\"\r\nContent-Length: 0\r\n\r\n", + "event.sequence": 99750433, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.ip": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.user": [ + "sipp", + "test" + ], + "server.ip": "10.0.2.20", + "server.port": 5060, + "sip.allow": [ + "invite", + "ack", + "bye", + "cancel", + "options", + "message", + "info", + "update", + "register", + "refer", + "notify", + "publish", + "subscribe" + ], + "sip.call_id": "1-2187@10.0.2.20", + "sip.cseq.code": 99750433, + "sip.cseq.method": "BYE", + "sip.from.display_info": "test", + "sip.from.tag": "e2jv529vDZ3eQ", + "sip.from.uri.host": "10.0.2.15", + "sip.from.uri.original": "sip:test@10.0.2.15:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "test", + "sip.max_forwards": 70, + "sip.method": "BYE", + "sip.supported": [ + "timer", + "path", + "replaces" + ], + "sip.to.display_info": "DVI4/8000", + "sip.to.tag": "1", + "sip.to.uri.host": "10.0.2.20", + "sip.to.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "sipp", + "sip.type": "request", + "sip.uri.host": "10.0.2.20", + "sip.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "sipp", + "sip.user_agent.original": "FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.15;rport;branch=z9hG4bKDQ7XK6BBH57ya" + ], + "source.ip": "10.0.2.15", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.20", + "client.port": 5060, + "destination.ip": "10.0.2.15", + "destination.port": 5060, + "event.action": "sip-invite", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "INVITE sip:test@10.0.2.15:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-0\r\nFrom: \"DVI4/16000\" ;tag=1\r\nTo: test \r\nCall-ID: 1-2189@10.0.2.20\r\nCSeq: 1 INVITE\r\nContact: sip:sipp@10.0.2.20:5060\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 124\r\n\r\nv=0\r\no=- 42 42 IN IP4 10.0.2.20\r\ns=-\r\nc=IN IP4 10.0.2.20\r\nt=0 0\r\nm=audio 6000 RTP/AVP 6\r\na=rtpmap:6 DVI4/16000\r\na=recvonly\r\n", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.ip": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.user": [ + "test", + "sipp" + ], + "server.ip": "10.0.2.15", + "server.port": 5060, + "sip.call_id": "1-2189@10.0.2.20", + "sip.contact.display_info": "test", + "sip.contact.uri.host": "10.0.2.15", + "sip.contact.uri.original": "sip:test@10.0.2.15:5060", + "sip.contact.uri.port": 5060, + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "test", + "sip.content_length": 124, + "sip.content_type": "application/sdp", + "sip.cseq.code": 1, + "sip.cseq.method": "INVITE", + "sip.from.display_info": "DVI4/16000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.max_forwards": 70, + "sip.method": "INVITE", + "sip.sdp.body.original": "v=0\r\no=- 42 42 IN IP4 10.0.2.20\r\ns=-\r\nc=IN IP4 10.0.2.20\r\nt=0 0\r\nm=audio 6000 RTP/AVP 6\r\na=rtpmap:6 DVI4/16000\r\na=recvonly\r\n", + "sip.sdp.connection.address": "10.0.2.20", + "sip.sdp.connection.info": "IN IP4 10.0.2.20", + "sip.sdp.owner.ip": "10.0.2.20", + "sip.sdp.owner.session_id": "42", + "sip.sdp.owner.version": "42", + "sip.sdp.version": "0", + "sip.to.display_info": "test", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "request", + "sip.uri.host": "10.0.2.15", + "sip.uri.original": "sip:test@10.0.2.15:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "test", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-0" + ], + "source.ip": "10.0.2.20", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.15", + "client.port": 5060, + "destination.ip": "10.0.2.20", + "destination.port": 5060, + "event.action": "sip-invite", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-0\r\nFrom: \"DVI4/16000\" ;tag=1\r\nTo: test \r\nCall-ID: 1-2189@10.0.2.20\r\nCSeq: 1 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit\r\nContent-Length: 0\r\n\r\n", + "event.reason": "Trying", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.ip": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.user": [ + "sipp", + "test" + ], + "server.ip": "10.0.2.20", + "server.port": 5060, + "sip.call_id": "1-2189@10.0.2.20", + "sip.code": 100, + "sip.cseq.code": 1, + "sip.cseq.method": "INVITE", + "sip.from.display_info": "DVI4/16000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.status": "Trying", + "sip.to.display_info": "test", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "response", + "sip.user_agent.original": "FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-0" + ], + "source.ip": "10.0.2.15", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.20", + "client.port": 5060, + "destination.ip": "10.0.2.15", + "destination.port": 5060, + "event.action": "sip-ack", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "ACK sip:test@10.0.2.15:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-5\r\nFrom: \"DVI4/16000\" ;tag=1\r\nTo: test ;tag=FBcN7Xt0a8S1j\r\nCall-ID: 1-2189@10.0.2.20\r\nCSeq: 1 ACK\r\nContact: sip:sipp@10.0.2.20:5060\r\nMax-Forwards: 70\r\nContent-Length: 0\r\n\r\n", + "event.sequence": 1, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.ip": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.user": [ + "test", + "sipp" + ], + "server.ip": "10.0.2.15", + "server.port": 5060, + "sip.call_id": "1-2189@10.0.2.20", + "sip.contact.display_info": "test", + "sip.contact.uri.host": "10.0.2.15", + "sip.contact.uri.original": "sip:test@10.0.2.15:5060", + "sip.contact.uri.port": 5060, + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "test", + "sip.cseq.code": 1, + "sip.cseq.method": "ACK", + "sip.from.display_info": "DVI4/16000", + "sip.from.tag": "1", + "sip.from.uri.host": "10.0.2.20", + "sip.from.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "sipp", + "sip.max_forwards": 70, + "sip.method": "ACK", + "sip.to.display_info": "test", + "sip.to.tag": "FBcN7Xt0a8S1j", + "sip.to.uri.host": "10.0.2.15", + "sip.to.uri.original": "sip:test@10.0.2.15:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "test", + "sip.type": "request", + "sip.uri.host": "10.0.2.15", + "sip.uri.original": "sip:test@10.0.2.15:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "test", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.20:5060;branch=z9hG4bK-2189-1-5" + ], + "source.ip": "10.0.2.20", + "source.port": 5060, + "status": "OK", + "type": "sip" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "10.0.2.15", + "client.port": 5060, + "destination.ip": "10.0.2.20", + "destination.port": 5060, + "event.action": "sip-bye", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "BYE sip:sipp@10.0.2.20:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 10.0.2.15;rport;branch=z9hG4bKe00pN1veeeyHp\r\nMax-Forwards: 70\r\nFrom: test ;tag=FBcN7Xt0a8S1j\r\nTo: \"DVI4/16000\" ;tag=1\r\nCall-ID: 1-2189@10.0.2.20\r\nCSeq: 99750437 BYE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE\r\nSupported: timer, path, replaces\r\nReason: Q.850;cause=16;text=\"NORMAL_CLEARING\"\r\nContent-Length: 0\r\n\r\n", + "event.sequence": 99750437, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:xDRQZvk3ErEhBDslXv1c6EKI804=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "10.0.2.20", + "10.0.2.15" + ], + "related.ip": [ + "10.0.2.15", + "10.0.2.20" + ], + "related.user": [ + "sipp", + "test" + ], + "server.ip": "10.0.2.20", + "server.port": 5060, + "sip.allow": [ + "invite", + "ack", + "bye", + "cancel", + "options", + "message", + "info", + "update", + "register", + "refer", + "notify", + "publish", + "subscribe" + ], + "sip.call_id": "1-2189@10.0.2.20", + "sip.cseq.code": 99750437, + "sip.cseq.method": "BYE", + "sip.from.display_info": "test", + "sip.from.tag": "FBcN7Xt0a8S1j", + "sip.from.uri.host": "10.0.2.15", + "sip.from.uri.original": "sip:test@10.0.2.15:5060", + "sip.from.uri.port": 5060, + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "test", + "sip.max_forwards": 70, + "sip.method": "BYE", + "sip.supported": [ + "timer", + "path", + "replaces" + ], + "sip.to.display_info": "DVI4/16000", + "sip.to.tag": "1", + "sip.to.uri.host": "10.0.2.20", + "sip.to.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.to.uri.port": 5060, + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "sipp", + "sip.type": "request", + "sip.uri.host": "10.0.2.20", + "sip.uri.original": "sip:sipp@10.0.2.20:5060", + "sip.uri.port": 5060, + "sip.uri.scheme": "sip", + "sip.uri.username": "sipp", + "sip.user_agent.original": "FreeSWITCH-mod_sofia/1.6.12-20-b91a0a6~64bit", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 10.0.2.15;rport;branch=z9hG4bKe00pN1veeeyHp" + ], + "source.ip": "10.0.2.15", + "source.port": 5060, + "status": "OK", + "type": "sip" + } +] \ No newline at end of file diff --git a/packetbeat/tests/system/golden/sip_authenticated_register-expected.json b/packetbeat/tests/system/golden/sip_authenticated_register-expected.json new file mode 100644 index 00000000000..133792cc157 --- /dev/null +++ b/packetbeat/tests/system/golden/sip_authenticated_register-expected.json @@ -0,0 +1,142 @@ +[ + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "192.168.1.2", + "client.port": 5060, + "destination.ip": "212.242.33.35", + "destination.port": 5060, + "event.action": "sip-register", + "event.category": [ + "network", + "protocol", + "authentication" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "REGISTER sip:sip.cybercity.dk SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport\r\nFrom: ;tag=6bac55c\r\nTo: \r\nCall-ID: 578222729-4665d775@578222732-4665d772\r\nContact: ;expires=1200;q=0.500\r\nExpires: 1200\r\nCSeq: 75 REGISTER\r\nContent-Length: 0\r\nAuthorization: Digest username=\"voi18062\",realm=\"sip.cybercity.dk\",uri=\"sip:192.168.1.2\",nonce=\"1701b22972b90f440c3e4eb250842bb\",opaque=\"1701a1351f70795\",nc=\"00000001\",response=\"79a0543188495d288c9ebbe0c881abdc\"\r\nMax-Forwards: 70\r\nUser-Agent: Nero SIPPS IP Phone Version 2.0.51.16\r\n\r\n", + "event.sequence": 75, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:dOa61R2NaaJsJlcFAiMIiyXX+Kk=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "sip.cybercity.dk" + ], + "related.ip": [ + "192.168.1.2", + "212.242.33.35" + ], + "related.user": [ + "voi18062" + ], + "server.ip": "212.242.33.35", + "server.port": 5060, + "sip.auth.realm": "sip.cybercity.dk", + "sip.auth.scheme": "Digest", + "sip.auth.uri.host": "192.168.1.2", + "sip.auth.uri.original": "sip:192.168.1.2", + "sip.auth.uri.scheme": "sip", + "sip.call_id": "578222729-4665d775@578222732-4665d772", + "sip.contact.uri.host": "sip.cybercity.dk", + "sip.contact.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.contact.uri.scheme": "sip", + "sip.contact.uri.username": "voi18062", + "sip.cseq.code": 75, + "sip.cseq.method": "REGISTER", + "sip.from.tag": "6bac55c", + "sip.from.uri.host": "sip.cybercity.dk", + "sip.from.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "voi18062", + "sip.max_forwards": 70, + "sip.method": "REGISTER", + "sip.to.uri.host": "sip.cybercity.dk", + "sip.to.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "voi18062", + "sip.type": "request", + "sip.uri.host": "sip.cybercity.dk", + "sip.uri.original": "sip:sip.cybercity.dk", + "sip.uri.scheme": "sip", + "sip.user_agent.original": "Nero SIPPS IP Phone Version 2.0.51.16", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 192.168.1.2;branch=z9hG4bKnp112903503-43a64480192.168.1.2;rport" + ], + "source.ip": "192.168.1.2", + "source.port": 5060, + "status": "OK", + "type": "sip", + "user.name": "voi18062" + }, + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "212.242.33.35", + "client.port": 5060, + "destination.ip": "192.168.1.2", + "destination.port": 5060, + "event.action": "sip-register", + "event.category": [ + "network", + "protocol" + ], + "event.dataset": "sip", + "event.duration": 0, + "event.kind": "event", + "event.original": "SIP/2.0 100 Trying\r\nCall-ID: 578222729-4665d775@578222732-4665d772\r\nCSeq: 75 REGISTER\r\nFrom: ;tag=6bac55c\r\nTo: \r\nVia: SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060;branch=z9hG4bKnp112903503-43a64480192.168.1.2\r\nContent-Length: 0\r\n\r\n", + "event.reason": "Trying", + "event.sequence": 75, + "event.type": [ + "info" + ], + "network.application": "sip", + "network.community_id": "1:dOa61R2NaaJsJlcFAiMIiyXX+Kk=", + "network.iana_number": "17", + "network.protocol": "sip", + "network.transport": "udp", + "network.type": "ipv4", + "related.hosts": [ + "sip.cybercity.dk" + ], + "related.ip": [ + "212.242.33.35", + "192.168.1.2" + ], + "related.user": [ + "voi18062" + ], + "server.ip": "192.168.1.2", + "server.port": 5060, + "sip.call_id": "578222729-4665d775@578222732-4665d772", + "sip.code": 100, + "sip.cseq.code": 75, + "sip.cseq.method": "REGISTER", + "sip.from.tag": "6bac55c", + "sip.from.uri.host": "sip.cybercity.dk", + "sip.from.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.from.uri.scheme": "sip", + "sip.from.uri.username": "voi18062", + "sip.status": "Trying", + "sip.to.uri.host": "sip.cybercity.dk", + "sip.to.uri.original": "sip:voi18062@sip.cybercity.dk", + "sip.to.uri.scheme": "sip", + "sip.to.uri.username": "voi18062", + "sip.type": "response", + "sip.version": "2.0", + "sip.via.original": [ + "SIP/2.0/UDP 192.168.1.2;received=80.230.219.70;rport=5060;branch=z9hG4bKnp112903503-43a64480192.168.1.2" + ], + "source.ip": "212.242.33.35", + "source.port": 5060, + "status": "OK", + "type": "sip" + } +] \ No newline at end of file diff --git a/packetbeat/tests/system/pcaps/sip.pcap b/packetbeat/tests/system/pcaps/sip.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7ec19fb525be299140dbfde2d0eddb177a31cf42 GIT binary patch literal 6632 zcmeHL&2QUe71*j2&9-@KRu0?9_Ji>ENmPY^`=l8mC=14%1ubP3z&rp6ztY z4jkaXof}6!_6INt5C|?~H#QDv8aE_%KwRK7@g*d9UMFeXq}58>OhwwGKB^tRul@S> zJkRfaetz)v?e_!BIMcUrW(-a~zm;5DyLOU!3@6n6Ho@eXv7hdx=a{)u)enPA;05sK zPTxI!ckH{V6H0MaspgTRTars0cTV8Ld{_(%Q7OvDc%&-j88OUiZv~fBat(e*omYc%v*}{ZmAseS<+-8Y z1$=`mnD%vS*BlAOVbydFX}VmsZ4n7!%QAEgySmw&acWlo@)BuoxSJ9}NDya3!BB8Z zhRLSPp@>NTlp<2fkv>+Tpd)jkpe7GraAh9B+=h%>HQhupfC^Qr<(c$q8AU@uEZeTt zz?Kw6+faJH5^c+D8tqV!=D;720}Bv;>VETbK*A3h$bo;ppz)`9;N`%%$;;g!!!mhP zwcC1g<9{9R6^GbddIQ2Ip@L0_dQqun7r2I5yW*I29nT2iSXdA_k>}Qv0_Jh-%~)hz zcZb6Y@#x?>`_@UO1Z79vZxq+@H2$9A`uA-=uH)QU+{0A_TuY0`4O6e$h|?6z#e5ju%QH60t~28#^6NjQh-H(|U+qoOzK zCW{;cvq*1hMyp0II}T71S0j#Q>lUS_{>{VJJ2M(E2yejPR-=LKHeD?&q@U|gV7QzP zA#`+lZy?al1N)PE{3nXBP_RN8rc1aow%xWz&C@h1x_rMgLC&WvI!dN*26U6MY<&xB zZP~2XQ}8Z?H07r0y7qic_EszDSZsIO1b6u+F~q| zS%}8lc(+!h69`&Ad-p@T;Yz!x|I~Ipk^Ga%c$AOK&Qgj!6rCS4)~*ojPg>xQ{_zb~u%Dd?J4Ec6!h9`sC9IW*H<7b-z(y$FuccDX_o4 z=LdFt=B(BO_TVySq@a3xVSN4&iyL zC~Ofz+6&g9l+FN~_m$3mAm?Zn{6!wrh0|~Tmsq?hc^+Rf+j93q$PQoqc}ARSQk4s8FINEep%pxhAHmo!U-mJ25fv z1(?|w5epL%5?R;~>cRqi0hWG&a?XpCwx|UJSbBzg^qil&|NZ{Y;rrJwir^9$f5*oF z6vU!G_2KrL=TqQQ5ex#L2GBRax9^4M?Nv|##r~sZ0G>==li$586c3NC-d_tCMb=WF=`SiMJhiD{s3ShuA^}nLpis&dpfM zGkg|M8kD3)eBp+Ybcc01N_EkJ)U*g8Cb1RWFlf^>>HH|Ak#UNM`Z&s1kU8+wStgF` zP-Gyt6Gq%)0W*Bt44Ae_ImK+w<$K*Q;i-oSLhg=-REmUNm0{L_d0I57^Bo786prN{ z_T^Eg+~rX#YdcU>E%dT>oP-A~3**Rvi(!kW8SJGziP$#xqf``{HbYd`ux05sZ4%20Z0`FU1(t=G-wfoEbdT*ROL6j;CCyYwAg;MC zE~G59#N{2h%9A+fs#b^98mzVBh{Fw@q(T5Fz*8v}l$E5CloM`#ybK-+-18W+J>)zm zys!$uJTRx9ea-34DbEQnIIc8e7-EEABiRq5)*nD}_Wk}9zvntF;Q Date: Tue, 6 Oct 2020 13:18:49 +0200 Subject: [PATCH 142/216] Release cloudfoundry input and processor as GA (#21525) --- CHANGELOG.next.asciidoc | 2 ++ x-pack/filebeat/input/cloudfoundry/input.go | 2 +- .../docs/add_cloudfoundry_metadata.asciidoc | 2 -- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 15c2f9fe8a8..cd1e6c50a4c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -450,6 +450,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add Cloud Foundry tags in related events. {pull}21177[21177] - Cloud Foundry metadata is cached to disk. {pull}20775[20775] - Add option to select the type of index template to load: legacy, component, index. {pull}21212[21212] +- Release `add_cloudfoundry_metadata` as GA. {pull}21525[21525] *Auditbeat* @@ -606,6 +607,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add related.hosts ecs field to all modules {pull}21160[21160] - Keep cursor state between httpjson input restarts {pull}20751[20751] - Convert aws s3 to v2 input {pull}20005[20005] +- Release Cloud Foundry input as GA. {pull}21525[21525] - New Cisco Umbrella dataset {pull}21504[21504] - New juniper.srx dataset for Juniper SRX logs. {pull}20017[20017] - Adding support for Microsoft 365 Defender (Microsoft Threat Protection) {pull}21446[21446] diff --git a/x-pack/filebeat/input/cloudfoundry/input.go b/x-pack/filebeat/input/cloudfoundry/input.go index 036a61b9d1e..3d2b9b34e59 100644 --- a/x-pack/filebeat/input/cloudfoundry/input.go +++ b/x-pack/filebeat/input/cloudfoundry/input.go @@ -25,7 +25,7 @@ type cloudfoundryEvent interface { func Plugin() v2.Plugin { return v2.Plugin{ Name: "cloudfoundry", - Stability: feature.Beta, + Stability: feature.Stable, Deprecated: false, Info: "collect logs from cloudfoundry loggregator", Manager: stateless.NewInputManager(configure), diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/docs/add_cloudfoundry_metadata.asciidoc b/x-pack/libbeat/processors/add_cloudfoundry_metadata/docs/add_cloudfoundry_metadata.asciidoc index 558b5a1031b..67e89c8173b 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/docs/add_cloudfoundry_metadata.asciidoc +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/docs/add_cloudfoundry_metadata.asciidoc @@ -6,8 +6,6 @@ add_cloudfoundry_metadata ++++ -beta[] - The `add_cloudfoundry_metadata` processor annotates each event with relevant metadata from Cloud Foundry applications. The events are annotated with Cloud Foundry metadata, only if the event contains a reference to a Cloud Foundry application (using field From f5d13aa2037bb26b8b1f0dcc801b48abb299e8e8 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Tue, 6 Oct 2020 09:02:26 -0400 Subject: [PATCH 143/216] [Elastic Agent] Add elastic agent ID and version to events from filebeat and metricbeat. (#21543) * Add elastic agent ID and version to events from filebeat and metricbeat. * Add changelog and fix inputs. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/emitter.go | 11 +- .../pkg/agent/application/info/agent_info.go | 12 ++ .../agent/application/inspect_output_cmd.go | 45 ++++--- .../pkg/agent/application/local_mode.go | 1 + .../pkg/agent/application/managed_mode.go | 1 + .../agent/application/managed_mode_test.go | 4 +- .../agent/application/monitoring_decorator.go | 6 +- .../application/monitoring_decorator_test.go | 25 +++- .../pkg/agent/program/program.go | 8 +- .../pkg/agent/program/program_test.go | 16 ++- .../pkg/agent/program/supported.go | 2 +- .../testdata/enabled_output_true-filebeat.yml | 6 + .../testdata/enabled_true-filebeat.yml | 6 + .../testdata/single_config-filebeat.yml | 12 ++ .../testdata/single_config-metricbeat.yml | 19 ++- .../pkg/agent/transpiler/rules.go | 126 ++++++++++++++---- .../pkg/agent/transpiler/rules_test.go | 65 ++++++++- x-pack/elastic-agent/spec/filebeat.yml | 2 + x-pack/elastic-agent/spec/metricbeat.yml | 2 + 20 files changed, 301 insertions(+), 69 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 7d6870328c7..639b1dbad17 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -29,4 +29,5 @@ - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] - Add `install` and `uninstall` subcommands {pull}21206[21206] - Send updating state {pull}21461[21461] +- Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] diff --git a/x-pack/elastic-agent/pkg/agent/application/emitter.go b/x-pack/elastic-agent/pkg/agent/application/emitter.go index d8a19492e2b..fc103366826 100644 --- a/x-pack/elastic-agent/pkg/agent/application/emitter.go +++ b/x-pack/elastic-agent/pkg/agent/application/emitter.go @@ -10,6 +10,7 @@ import ( "strings" "sync" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" @@ -18,7 +19,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" ) -type decoratorFunc = func(string, *transpiler.AST, []program.Program) ([]program.Program, error) +type decoratorFunc = func(*info.AgentInfo, string, *transpiler.AST, []program.Program) ([]program.Program, error) type filterFunc = func(*logger.Logger, *transpiler.AST) error type reloadable interface { @@ -36,6 +37,7 @@ type programsDispatcher interface { type emitterController struct { logger *logger.Logger + agentInfo *info.AgentInfo controller composable.Controller router programsDispatcher modifiers *configModifiers @@ -112,14 +114,14 @@ func (e *emitterController) update() error { e.logger.Debug("Converting single configuration into specific programs configuration") - programsToRun, err := program.Programs(ast) + programsToRun, err := program.Programs(e.agentInfo, ast) if err != nil { return err } for _, decorator := range e.modifiers.Decorators { for outputType, ptr := range programsToRun { - programsToRun[outputType], err = decorator(outputType, ast, ptr) + programsToRun[outputType], err = decorator(e.agentInfo, outputType, ast, ptr) if err != nil { return err } @@ -135,12 +137,13 @@ func (e *emitterController) update() error { return e.router.Dispatch(ast.HashStr(), programsToRun) } -func emitter(ctx context.Context, log *logger.Logger, controller composable.Controller, router programsDispatcher, modifiers *configModifiers, reloadables ...reloadable) (emitterFunc, error) { +func emitter(ctx context.Context, log *logger.Logger, agentInfo *info.AgentInfo, controller composable.Controller, router programsDispatcher, modifiers *configModifiers, reloadables ...reloadable) (emitterFunc, error) { log.Debugf("Supported programs: %s", strings.Join(program.KnownProgramNames(), ", ")) init, _ := transpiler.NewVars(map[string]interface{}{}) ctrl := &emitterController{ logger: log, + agentInfo: agentInfo, controller: controller, router: router, modifiers: modifiers, diff --git a/x-pack/elastic-agent/pkg/agent/application/info/agent_info.go b/x-pack/elastic-agent/pkg/agent/application/info/agent_info.go index e990b83bd49..b0abbe19e64 100644 --- a/x-pack/elastic-agent/pkg/agent/application/info/agent_info.go +++ b/x-pack/elastic-agent/pkg/agent/application/info/agent_info.go @@ -4,6 +4,8 @@ package info +import "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" + // AgentInfo is a collection of information about agent. type AgentInfo struct { agentID string @@ -44,3 +46,13 @@ func ForceNewAgentInfo() (*AgentInfo, error) { func (i *AgentInfo) AgentID() string { return i.agentID } + +// Version returns the version for this Agent. +func (*AgentInfo) Version() string { + return release.Version() +} + +// Snapshot returns if this version is a snapshot. +func (*AgentInfo) Snapshot() bool { + return release.Snapshot() +} diff --git a/x-pack/elastic-agent/pkg/agent/application/inspect_output_cmd.go b/x-pack/elastic-agent/pkg/agent/application/inspect_output_cmd.go index 8f648887d10..bb319ce1569 100644 --- a/x-pack/elastic-agent/pkg/agent/application/inspect_output_cmd.go +++ b/x-pack/elastic-agent/pkg/agent/application/inspect_output_cmd.go @@ -8,11 +8,12 @@ import ( "context" "fmt" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" - "github.com/elastic/beats/v7/libbeat/logp" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" @@ -37,14 +38,19 @@ func NewInspectOutputCmd(configPath, output, program string) (*InspectOutputCmd, // Execute tries to enroll the agent into Fleet. func (c *InspectOutputCmd) Execute() error { + agentInfo, err := info.NewAgentInfo() + if err != nil { + return err + } + if c.output == "" { - return c.inspectOutputs() + return c.inspectOutputs(agentInfo) } - return c.inspectOutput() + return c.inspectOutput(agentInfo) } -func (c *InspectOutputCmd) inspectOutputs() error { +func (c *InspectOutputCmd) inspectOutputs(agentInfo *info.AgentInfo) error { rawConfig, err := loadConfig(c.cfgPath) if err != nil { return err @@ -61,7 +67,7 @@ func (c *InspectOutputCmd) inspectOutputs() error { } if isStandalone(cfg.Fleet) { - return listOutputsFromConfig(l, rawConfig) + return listOutputsFromConfig(l, agentInfo, rawConfig) } fleetConfig, err := loadFleetConfig(rawConfig) @@ -71,11 +77,11 @@ func (c *InspectOutputCmd) inspectOutputs() error { return fmt.Errorf("no fleet config retrieved yet") } - return listOutputsFromMap(l, fleetConfig) + return listOutputsFromMap(l, agentInfo, fleetConfig) } -func listOutputsFromConfig(log *logger.Logger, cfg *config.Config) error { - programsGroup, err := getProgramsFromConfig(log, cfg) +func listOutputsFromConfig(log *logger.Logger, agentInfo *info.AgentInfo, cfg *config.Config) error { + programsGroup, err := getProgramsFromConfig(log, agentInfo, cfg) if err != nil { return err @@ -88,16 +94,16 @@ func listOutputsFromConfig(log *logger.Logger, cfg *config.Config) error { return nil } -func listOutputsFromMap(log *logger.Logger, cfg map[string]interface{}) error { +func listOutputsFromMap(log *logger.Logger, agentInfo *info.AgentInfo, cfg map[string]interface{}) error { c, err := config.NewConfigFrom(cfg) if err != nil { return err } - return listOutputsFromConfig(log, c) + return listOutputsFromConfig(log, agentInfo, c) } -func (c *InspectOutputCmd) inspectOutput() error { +func (c *InspectOutputCmd) inspectOutput(agentInfo *info.AgentInfo) error { rawConfig, err := loadConfig(c.cfgPath) if err != nil { return err @@ -114,7 +120,7 @@ func (c *InspectOutputCmd) inspectOutput() error { } if isStandalone(cfg.Fleet) { - return printOutputFromConfig(l, c.output, c.program, rawConfig) + return printOutputFromConfig(l, agentInfo, c.output, c.program, rawConfig) } fleetConfig, err := loadFleetConfig(rawConfig) @@ -124,11 +130,11 @@ func (c *InspectOutputCmd) inspectOutput() error { return fmt.Errorf("no fleet config retrieved yet") } - return printOutputFromMap(l, c.output, c.program, fleetConfig) + return printOutputFromMap(l, agentInfo, c.output, c.program, fleetConfig) } -func printOutputFromConfig(log *logger.Logger, output, programName string, cfg *config.Config) error { - programsGroup, err := getProgramsFromConfig(log, cfg) +func printOutputFromConfig(log *logger.Logger, agentInfo *info.AgentInfo, output, programName string, cfg *config.Config) error { + programsGroup, err := getProgramsFromConfig(log, agentInfo, cfg) if err != nil { return err @@ -164,16 +170,16 @@ func printOutputFromConfig(log *logger.Logger, output, programName string, cfg * } -func printOutputFromMap(log *logger.Logger, output, programName string, cfg map[string]interface{}) error { +func printOutputFromMap(log *logger.Logger, agentInfo *info.AgentInfo, output, programName string, cfg map[string]interface{}) error { c, err := config.NewConfigFrom(cfg) if err != nil { return err } - return printOutputFromConfig(log, output, programName, c) + return printOutputFromConfig(log, agentInfo, output, programName, c) } -func getProgramsFromConfig(log *logger.Logger, cfg *config.Config) (map[string][]program.Program, error) { +func getProgramsFromConfig(log *logger.Logger, agentInfo *info.AgentInfo, cfg *config.Config) (map[string][]program.Program, error) { monitor := noop.NewMonitor() router := &inmemRouter{} ctx, cancel := context.WithCancel(context.Background()) @@ -186,6 +192,7 @@ func getProgramsFromConfig(log *logger.Logger, cfg *config.Config) (map[string][ emit, err := emitter( ctx, log, + agentInfo, composableWaiter, router, &configModifiers{ diff --git a/x-pack/elastic-agent/pkg/agent/application/local_mode.go b/x-pack/elastic-agent/pkg/agent/application/local_mode.go index f8eed0f5792..b58e260cab6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/local_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/local_mode.go @@ -115,6 +115,7 @@ func newLocal( emit, err := emitter( localApplication.bgContext, log, + agentInfo, composableCtrl, router, &configModifiers{ diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index d1eaf197a88..647eae6d4e6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -168,6 +168,7 @@ func newManaged( emit, err := emitter( managedApplication.bgContext, log, + agentInfo, composableCtrl, router, &configModifiers{ diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go index 81f2419f936..65cb27547ff 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go @@ -12,6 +12,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" @@ -32,8 +33,9 @@ func TestManagedModeRouting(t *testing.T) { log, _ := logger.New("") router, _ := newRouter(log, streamFn) + agentInfo, _ := info.NewAgentInfo() composableCtrl, _ := composable.New(log, nil) - emit, err := emitter(ctx, log, composableCtrl, router, &configModifiers{Decorators: []decoratorFunc{injectMonitoring}}) + emit, err := emitter(ctx, log, agentInfo, composableCtrl, router, &configModifiers{Decorators: []decoratorFunc{injectMonitoring}}) require.NoError(t, err) actionDispatcher, err := newActionDispatcher(ctx, log, &handlerDefault{log: log}) diff --git a/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator.go b/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator.go index 2b04126381b..3fc49ef17d3 100644 --- a/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator.go +++ b/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator.go @@ -7,6 +7,7 @@ package application import ( "fmt" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" ) @@ -28,7 +29,7 @@ const ( defaultOutputName = "default" ) -func injectMonitoring(outputGroup string, rootAst *transpiler.AST, programsToRun []program.Program) ([]program.Program, error) { +func injectMonitoring(agentInfo *info.AgentInfo, outputGroup string, rootAst *transpiler.AST, programsToRun []program.Program) ([]program.Program, error) { var err error monitoringProgram := program.Program{ Spec: program.Spec{ @@ -63,7 +64,7 @@ func injectMonitoring(outputGroup string, rootAst *transpiler.AST, programsToRun } ast := rootAst.Clone() - if err := getMonitoringRule(monitoringOutputName).Apply(ast); err != nil { + if err := getMonitoringRule(monitoringOutputName).Apply(agentInfo, ast); err != nil { return programsToRun, err } @@ -93,6 +94,7 @@ func getMonitoringRule(outputName string) *transpiler.RuleList { return transpiler.NewRuleList( transpiler.Copy(monitoringOutputSelector, outputKey), transpiler.Rename(fmt.Sprintf("%s.%s", outputsKey, outputName), elasticsearchKey), + transpiler.InjectAgentInfo(), transpiler.Filter(monitoringKey, programsKey, outputKey), ) } diff --git a/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator_test.go b/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator_test.go index f50bb74d5e8..6a3be4100be 100644 --- a/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/monitoring_decorator_test.go @@ -7,17 +7,22 @@ package application import ( "testing" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" ) func TestMonitoringInjection(t *testing.T) { + agentInfo, err := info.NewAgentInfo() + if err != nil { + t.Fatal(err) + } ast, err := transpiler.NewAST(inputConfigMap) if err != nil { t.Fatal(err) } - programsToRun, err := program.Programs(ast) + programsToRun, err := program.Programs(agentInfo, ast) if err != nil { t.Fatal(err) } @@ -25,7 +30,7 @@ func TestMonitoringInjection(t *testing.T) { GROUPLOOP: for group, ptr := range programsToRun { programsCount := len(ptr) - newPtr, err := injectMonitoring(group, ast, ptr) + newPtr, err := injectMonitoring(agentInfo, group, ast, ptr) if err != nil { t.Error(err) continue GROUPLOOP @@ -83,12 +88,16 @@ GROUPLOOP: } func TestMonitoringInjectionDefaults(t *testing.T) { + agentInfo, err := info.NewAgentInfo() + if err != nil { + t.Fatal(err) + } ast, err := transpiler.NewAST(inputConfigMapDefaults) if err != nil { t.Fatal(err) } - programsToRun, err := program.Programs(ast) + programsToRun, err := program.Programs(agentInfo, ast) if err != nil { t.Fatal(err) } @@ -96,7 +105,7 @@ func TestMonitoringInjectionDefaults(t *testing.T) { GROUPLOOP: for group, ptr := range programsToRun { programsCount := len(ptr) - newPtr, err := injectMonitoring(group, ast, ptr) + newPtr, err := injectMonitoring(agentInfo, group, ast, ptr) if err != nil { t.Error(err) continue GROUPLOOP @@ -154,12 +163,16 @@ GROUPLOOP: } func TestMonitoringInjectionDisabled(t *testing.T) { + agentInfo, err := info.NewAgentInfo() + if err != nil { + t.Fatal(err) + } ast, err := transpiler.NewAST(inputConfigMapDisabled) if err != nil { t.Fatal(err) } - programsToRun, err := program.Programs(ast) + programsToRun, err := program.Programs(agentInfo, ast) if err != nil { t.Fatal(err) } @@ -167,7 +180,7 @@ func TestMonitoringInjectionDisabled(t *testing.T) { GROUPLOOP: for group, ptr := range programsToRun { programsCount := len(ptr) - newPtr, err := injectMonitoring(group, ast, ptr) + newPtr, err := injectMonitoring(agentInfo, group, ast, ptr) if err != nil { t.Error(err) continue GROUPLOOP diff --git a/x-pack/elastic-agent/pkg/agent/program/program.go b/x-pack/elastic-agent/pkg/agent/program/program.go index 25b56081e68..f3f17d06b9d 100644 --- a/x-pack/elastic-agent/pkg/agent/program/program.go +++ b/x-pack/elastic-agent/pkg/agent/program/program.go @@ -47,7 +47,7 @@ func (p *Program) Configuration() map[string]interface{} { // Programs take a Tree representation of the main configuration and apply all the different // programs rules and generate individual configuration from the rules. -func Programs(singleConfig *transpiler.AST) (map[string][]Program, error) { +func Programs(agentInfo transpiler.AgentInfo, singleConfig *transpiler.AST) (map[string][]Program, error) { grouped, err := groupByOutputs(singleConfig) if err != nil { return nil, errors.New(err, errors.TypeConfig, "fail to extract program configuration") @@ -55,7 +55,7 @@ func Programs(singleConfig *transpiler.AST) (map[string][]Program, error) { groupedPrograms := make(map[string][]Program) for k, config := range grouped { - programs, err := detectPrograms(config) + programs, err := detectPrograms(agentInfo, config) if err != nil { return nil, errors.New(err, errors.TypeConfig, "fail to generate program configuration") } @@ -65,11 +65,11 @@ func Programs(singleConfig *transpiler.AST) (map[string][]Program, error) { return groupedPrograms, nil } -func detectPrograms(singleConfig *transpiler.AST) ([]Program, error) { +func detectPrograms(agentInfo transpiler.AgentInfo, singleConfig *transpiler.AST) ([]Program, error) { programs := make([]Program, 0) for _, spec := range Supported { specificAST := singleConfig.Clone() - err := spec.Rules.Apply(specificAST) + err := spec.Rules.Apply(agentInfo, specificAST) if err != nil { return nil, err } diff --git a/x-pack/elastic-agent/pkg/agent/program/program_test.go b/x-pack/elastic-agent/pkg/agent/program/program_test.go index c15510b6655..8c2cf8c499f 100644 --- a/x-pack/elastic-agent/pkg/agent/program/program_test.go +++ b/x-pack/elastic-agent/pkg/agent/program/program_test.go @@ -437,7 +437,7 @@ func TestConfiguration(t *testing.T) { ast, err := transpiler.NewAST(m) require.NoError(t, err) - programs, err := Programs(ast) + programs, err := Programs(&fakeAgentInfo{}, ast) if test.err { require.Error(t, err) return @@ -478,3 +478,17 @@ func TestConfiguration(t *testing.T) { }) } } + +type fakeAgentInfo struct{} + +func (*fakeAgentInfo) AgentID() string { + return "agent-id" +} + +func (*fakeAgentInfo) Version() string { + return "8.0.0" +} + +func (*fakeAgentInfo) Snapshot() bool { + return false +} diff --git a/x-pack/elastic-agent/pkg/agent/program/supported.go b/x-pack/elastic-agent/pkg/agent/program/supported.go index 3b314bfa3f4..adc13938ae2 100644 --- a/x-pack/elastic-agent/pkg/agent/program/supported.go +++ b/x-pack/elastic-agent/pkg/agent/program/supported.go @@ -21,7 +21,7 @@ func init() { // spec/filebeat.yml // spec/heartbeat.yml // spec/metricbeat.yml - unpacked := packer.MustUnpack("eJzEWEtz47rR3X8/Y7b3q4QER06YqixEufiSRI9oGwCxIwCJpARSuuZDolL57ymQFB+yPXMnt2qymNIIhoDuRvfpc/pfX/LTlv11m/HTMcmKv9Sp+PKPLzQ1C/JyjHw0OzBLP9FsE70CuOfYPXH7sAyAenhKDEFT/0yBKPlCvRLkqSwVynZzilnmn0hq7vnjMSLDGQWxIFhknmAZOQXg9cF5DLSnx2gZgFgEoNiFaHbllpnTx+Ny9WyIrQX3GJATtV4fFsk8chbGOcD+8SmZJ+Nz2WBb0u2LWcqvT9ExchbzaPU8T3gK6xCRmdOtcUsUBOmqtHF9nS+ZpV+5Kc/zlABd8qfoWDgW/EqQtyOpyMnLcSl/59hGzK3owVm4H/v/7LT7LLMm2rqze144C7c/2xnZtXpWVWbxOkC+uFuvCfYqjt09wetkdM4n9072l9tUnD/y1dvPz4vMqAnUVZqKkml+TK3zwyJRIoJjEah6GqKLuMWOWaYSPh4jJ4UlsY0qRDNlhT0RaLAOsd/HM8Buxq5djG4xR7N3Pr+3xVWpBa9tvMlpa+pXbrsiQMqDYxf6olunti+Y0EGALirBt7gaV4IuItD8iu2PUYhmZ479a/e3N4IPD47tz5j12r0diakNxWCnMs7PZRODVOTcgjXW7vbanqAW3HNLr58S40QzQ+X2unvrQmxfmlyPg/QiyLzzNTVzjuAoDw2FZVA0Pt3Oa3LOr/p4A5gT5ClUc69PiUGJPA9vygB5e4K9KwbmOYS69C13LJITBJVVWpyC1CwDqExztP+7eQ43TU0VAZ7f1ZKRUgsK3tnMMpgP8Z0Xju0KinRA2jtv682/EMDZU2LEAfAE07xdgI0TBoXYbnp/a4LUiqdw1+ztfBzHLAQiCdAsnrzz/n3MJ2/WxqT/Pn33eeFYusptQ7351NiByYkBUdHouOQgFnR/jKgFS6L5x+XC/1t7pq8vn+e/OY/zKECzg2NdBE25Ei6iwxaIktlQYZpych6/RuuFEdN0E4WWeX0GcCbPoBpU5J7d8zlyAcwD7Ckh8q4EmXUAomy5Of7zy/+3kLtLxJZuw3eQK6EGuSLAmxvMNuUYpDDm81MLa4lBnUQ1neQcOZknuA3Pq1Tk9HkmaGom1IKHb0imryeaPfd7M19QbOQB9sUqhWWA3JygjU5SM2fgNVkt5snqtf2kyCwDxAVFsOSLWUGBL77hqGCWuQ9rtU2dhZM7C6fwn+WnW8jnJAAWRELF6Hxuuyp5nuzNKeBZiGbZKr0InsL8G/JFkMHMEcoywK4SIhIH2ubBsWRM/OuqaQcwIchUfggdSZMav8tywkCUxIJfbynIbXGW8aaWnrFzUxonmp4klOyY5tcEmQXWjJq2qV31KWnpJQZeRVOSh8hTWiiQLc3fBYgoBHfw38LOg2NdKqKtG2ihyDzfw+odZNUcXSbwFAD9vIV6TK3Ljlv6jlriyh8HmHUWhkKvx+hmMzuPS+ydrSUF+nlcwgTHe4INpcmpzFNYCmOK183bh2jTfPaw1ryze2ap3kCRhCj5Tne2KlTV8xB7yrTchUKadxnFNFv/t34MMU9hSjW3g1TZGps66t6K1BQoD47Vle751oL+Pqxpvc/LrgUqTFIXs/UBA2m3ev3s3e7tDbEv6Mt7PyZ3nj+F4mlbsfv8HtpHapYMXGLeU6L5xK4mrzfj2Kkxs40BUvv1S0U6atX8fxzvJi+IoNmm6qhPUyfj+5yFIeu15Av9yi3/JOGUaf4hRF/v7oGgwQHN3zNpn+WdPzlHJfb8wbHhgc2ntsi7V8CvAlBIPyJi6fsQwPrunJwCVrEUHkLs7Ri4VBxcKiJzqllbv/e/1q9b7MnfPTi2N5O/ucXhj7Qujj2BwQet5ge/I5apBLDHqr5+WAoLqhHRtNCXSY23VMbyY26ZPT6t0llMEbxKLCY/0XLv7i+b79iTFEDmpew3CsHu7p6+DNTEeVdTHRVQttgQXU7fUTXZlk2NAS+nGjxwYCoBiAbswCeVpa9Fm3f+kSNnhCuXiiM/pZqkoO5sOM+raObHIZoJNtTIgQLvrcdhSReAXhFwEStsqEHmqcGw98ht/4zBQG2Hs2OF28bvDOjlsFbEJC3i4fskXwqG/dHvZ4JbJKca6+2g1zXwkKkSSyhjekUsMVAXez36v6cQS5Sj7/c5qgTavD+fI/887IVliIf4ciDKpob/LJ22+n7+KaVu+nxLN/dUM/ocJJlbSWy8O7fBfTLiPWMa/iEtHt5vxI36tYpj/8zH9BDAGZM+pa+fUL/+7vJm2+75EH1L5mfHMkuyMI4B9lYEH46uXXTn+/pqMc8IusRM80+B5okAu/twwXJnwWuC/BOrWS59dEGbN24taaHkA56st6NbH5Y3Ohhvw7fiAz74bEEpp1u+k3oFkb1nstbKTMfMe87GAFQ4npchuhQ/4ne3vdyCBbOavlL2/f5RTQN0ud5xtjt+p1bEetW3C/UcIO9thVrJMeGdqRrT1MwIUmVPGZ/fyKHpXtmX+ImmrKRN7zjrxIIJRyzBd6OF5t3tdTWJRzbumU0efcW3Hv9yjLZag7cf1IC340AooanXBHGxtedDf73h/aS3GrV8H5x5M4lXBMscWFerJO9x+3O8/I7M/AHOflqHH8jNu3qc3DvsGdV8tp5wioYTj/nI4mN59Ufr7H9VW+m2eEvYB8X1gqDCUrHvxNWeIik0VMFt9xSAToS1c40I1X0BXAn2VbaYnail/KhYbnsliTxTy1TIj0TaXbFQpB/Ii/p1haXOzotO+35PpA3nY7/m6E7QWXpGpBiqZ3nTbB/VA0GuSmqXSzDhlkiDlmQ3BcVqvSDYr0PkdQVmVEzzJ7O6Nila0jGZlU3mR2pF7Ga2UJJFQ7ykICi3SO1nQ7IZyHgTvHmQQEOB3xTzKt1UTBNXCVKrTBR0MZMk7yZKlsPM4uOCH4u7EM0OBEe3htcQlqfEuPl4bRukKMO0mc10JEndMdutAgCvDOh98VAw2wVAL0l6ObUiVZQMwJqbekwyvyclvdjs8q0TALXMHYr62WbKUr14LwL8aljzbvZ0dqoxe7ybS34gbD4RE01zxsDMqfmJaGvvHu4cgcN732cV7clIS+y3lieYvWmaUy+I6qYuTp2Y7HO1HVBMxGGCN3e2an6FweXEtM10DnUTXaM3mgjIn/Kjf8OEINKA2S8Whu8IONb4iVvxjqUwIzjuhwgfkO62KSVf31agwzFtffguufu1hPBPil74eZP+ngi2XVnj2+WjvvnWDmZ+WyX56X2MukYq73g8Ru54dtwKtDJAqpiKqm7IMNk7EFuJ3xxdxCAM1DgEcBdgtw7u56ldjvQ4AaAysavJlZvNnhga8x8Rj6Pf/YxYvZtp/1qB23y/jme9v0ok34n7nxIzdMIrvov1k966Sj8aVPV982eE0bRnfz4XfyNY9lW9lvX5EWmb+NIOgJv6/DMkriFuWit8W+L2HRL37//7TwAAAP//S6KvFQ==") + unpacked := packer.MustUnpack("eJy8WF1zozoSfd+fMa93axdEnF226j4YUnzFJmOSSEJvSLIBW2DfALbx1v73LQHmw0lm7uxszcOUByKk7lb36XP631+Kw5r9fZ3zwz7Ny7/Vmfjyry80s0ryso8DNNsxWz/QfBW/Arjl2DtwZ/cYAnX3lBqCZsGJAlFxU70Q5KssE8p6dUhYHhxIZm35wz4mwx4lsSEwc1+wnBxC8HrvPoTa00P8GIJEhKDcRGh24bZV0If94+LZEGsbbjEgB2q/3pvpPHZN4xTiYP+UztPxvmywLe3WJSzjl6d4H7vmPF48z1OewTpCZOZ277gtSoJ0Vdq4vMwfma1fuCX385UQnYuneF+6NrwjyN+QTBTkZf8ov3MdI+F2fO+a3sf+P7vtOtuqibbs7J6Xrun1e7sjuxbPqspsXocoEDfva4L9I8feluBlOtrnk3Mn66t1Jk4f+epv5yczN2oCdZVmomJakFD7dG+mSkxwIkJVzyJ0FtfYMdtSood97GawIo5xjNBMWWBfhBqsIxz08Qyxl7NLF6NrzNHsnc/vbfFUasNLG29yWFv6hTueCJFy7zqlbnbvqRMIJnQQorNK8DWuxoWgswi14Mi2+zhCsxPHwaX72xvBu3vXCWbMfu3ujiTUgWKwUxnn52MTg0wU3IY11m7WOr6gNtxyW6+fUuNAc0PlzrK761KsX5pcT8LsLMi88zWzCo7gKA8NheVQND5d92tyLjj28QawIMhXqOZdnlKDErkfXlUh8rcE+xcMrFMEdelb4dqkIAgqi6w8hJlVhVCZ5mj/d+sUrZqaKkM8v6klI6M2FLyzmeWwGOI7L13HExTpgLRnXt83/yIAZ0+pkYTAF0zzNyE2DhiUYr3q/a0JUo88g5tmbefjOGYREGmIZsnknrfvYz65szYm/fP03uela+sqdwz16lNjByYHBsSRxvtHDhJBt/uY2rAiWrB/NIN/tHsG+uPz/Df3YR6HaLZz7bOgGVciM96tgaiYAxWmKQf34S5emkZCs1Uc2dblGcCZ3INqUJFrNs+n2AOwCLGvRMi/EGTVIYjzx9X+9y9/bSF3k4o1XUfvIFdCDfJEiFdXmG3KMcxgwueHFtZSg7qparnpKXZzX3AHnhaZKOjzTNDMSqkNd1+RTF9fNGtu1+aBoNgoQhyIRQarEHkFQSudZFbBwGu6MOfp4rX9pciqQsQFRbDi5qykIBBfcVwy29pGtdqmjukWrumWwbP89Up5nQTAkkioGO3PHU8lz5O1BQU8j9AsX2RnwTNYfEWBCHOYu0J5DLGnRIgkoba6d20Zk+CyaNoBTAmylO9CR9qkxh+ynDAQFbHh3TUFuSNOMt7U1nN2akrjQLODhJIN04KaIKvEmlHTNrWPfUraeoWBf6QZKSLkKy0UyJYWbEJEFII7+G9h5961z0eiLRtoocg63cLqDWTVHJ0n8BQC/bSGekLt84bb+oba4sIfBph1TUOhl318tZmdxiX2ztaKAv00LmGCky3BhtLkVO4rLIMJxcvm7iO0an57WGvu2TuxTG+gSEKUvKcbWxWq6kWEfWVa7kIhzb2MYpov/1c/hphnMKOa10GqbI1NHXV3RWoKlHvX7kr3dG1B/xzeab3Pj10LVJikLlbrAwbSbvXy2b3d2hvhQNCX935Mzjx9CsXTtuL0+T20j8yqGDgnvKdE84ldTV6vxrFTE+YYA6T2789H0lGr5v/jeDd5QQTNV8eO+jR1Mj7PNQ1ZrxU39Qu3g4OEU6YFuwjd3ZwDQYMDWrBl0j7bP32yj0qc+b3rwB2bT22RZy9AcAxBKf2Iia1vIwDrm30KCtiRZXAXYX/DwPnIwflIZE4175bv/a/1yxr78rt71/Fn8ptrHP5M6+LYFxh80Gq+8x2xLSWEPVb19cMyWFKNiKaFvkxqvKUydpBw2+rxaZHNEorgRWIx+YGWe3N+1TxjX1IAmZey3ygEe5tb+jJQE/ddTXVUQFljQ3Q5fUPVZFu2NAb8gmpwx4GlhCAesAMfVJa9lm3eBXuO3BGunI8cBRnVJAX1ZsN+/pHmQRKhmWBDjewo8N96HJZ0AehHAs5igQ01zH01HNbuuROcMBio7bB3onDH+IMBvRrelQnJymR4nuRLyXAw+n4muE0KqrHeDnpZAh9ZKrGFMqZXxBYDdXGWo//7CrFFNXq+zVEl1Ob9/hwFp2EtrCI8xJcDUTU1/LN02u77+aeUuunzq2lPbThEHkiJl0mcX2tKg7dNz/hTeD3q+z9EFQc+1d9DR9NG9yrWuKHcwsz5nqC7+yn1G85eZD9PAxfmPO8wKV80uMHfQkTewmdWuCaXnEjK4EtksoMZ/95TxmQdvZUfcMZnG0rJ3cYm80si+9PkXStFXavoeR0DUOF4XkXoXH6PA17XchuWzG56T9Vzggc1C9H5csPrbjigeiT2q7421VOI/LcFamXJhJtmakIzKydIlX1nvH8jmaZrZe/iB5qxijb95aQTG6YcsRTfjB8a3uwsj5N45OO+2uTIHb7ygJc2N9u8uK0Tf8OBUCJLrwniYu3Mhx587QmT/mvU8n5w7s8kphEcHEJteVykRY/tn2PqN6Tod7D401r9QJLe1Ozk3GHNCBfy5YR3NDU+5izmxxKsl2oAzpjcJ3v9UIZdMWfzvIu/pvOTa1sVMY19iP0Fwbu955RHjgO5Rpd1RNA5YZqMqy9C7G0js6mhmqDgwGpWSFs90OK2V8t6lHzcl/1u79W7x2ttZevyLWUfFNcLggrLxLYTYFuKpBhRBXe8Qwg6odbOPmJU9wVwIThQmTk7UFv5XrFc10qieaK2pZDvCbmbYqFI35EX9W6BpRYvyk4ff0vIDfvjoOboRvTZek6kYKpnRdOQH9QdQZ5Kao9LMOG2yMKWiDcFxWq9JDioI+R3BWYcmRZM5nltUrTEZDJPm8yY1CNxmvlDRcyGnEnRUK2R2s+PpFCQ8SZ4dS+BhoKgKeZFtjoyTVwkSC1yUVJzJongVbg8DnONjwt+3KwiNNsRHF+bYkNqnlLj6uOlbUCiirJmftMRKXXDHO8YAnhhQO+Lh4LZJgR6RbLzoRWyomIA1tzSE5IHPXHpBWmXb51IqGXuUNTPPzOW6eV7oRAch3f+1Z7OTjVhDzezyw/EzyeCY0s1Y4aBVVDrE2HXnj2cOQKH977PjrQnLC35X9u+YM6qaU69aKqbujh0grPP1XaIMRGQKV7d2KoFRwzOB6atprOqqzAb3dFEZP6QH/0dpgSRBsx+sXh8R9Kxxg/cTjYsgznBST9o+ICYt00pvXtbgA7HtOXumwTw15LGnxTG8PMm/S2h7HiyxtePD/rqazu8+W2RFof3MeoaqTzjYR974/lyK+KqEKliKrw6YjtZOww9JH5zdBYDIVWTCMBNiL06vJ25djnS4wToiewoV642+2JozH9GYI6++xFBezP3/rUiuHm+jOfBv0pI3wwA/s+CZ8ox5Le3uUVy7zjOhYajSM7xvjf0ffJHxNNk3+FuOwI2mr+PSN3HAmriS3XN958SUa1w6oned0XUf/7y3wAAAP//NCXBlQ==") SupportedMap = make(map[string]Spec) for f, v := range unpacked { diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_output_true-filebeat.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_output_true-filebeat.yml index 8edc27061b0..38b251d95dc 100644 --- a/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_output_true-filebeat.yml +++ b/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_output_true-filebeat.yml @@ -16,6 +16,12 @@ filebeat: target: "event" fields: dataset: generic + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false output: elasticsearch: enabled: true diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_true-filebeat.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_true-filebeat.yml index 8bd5d93a3b9..6e768db6aa4 100644 --- a/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_true-filebeat.yml +++ b/x-pack/elastic-agent/pkg/agent/program/testdata/enabled_true-filebeat.yml @@ -17,6 +17,12 @@ filebeat: target: "event" fields: dataset: generic + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false output: elasticsearch: hosts: diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-filebeat.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-filebeat.yml index b996e13b531..01ee955e4ec 100644 --- a/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-filebeat.yml +++ b/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-filebeat.yml @@ -18,6 +18,12 @@ filebeat: target: "event" fields: dataset: generic + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false - type: log paths: - /var/log/hello3.log @@ -36,6 +42,12 @@ filebeat: target: "event" fields: dataset: generic + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false output: elasticsearch: hosts: diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-metricbeat.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-metricbeat.yml index c62882ff6da..d09e80accf1 100644 --- a/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-metricbeat.yml +++ b/x-pack/elastic-agent/pkg/agent/program/testdata/single_config-metricbeat.yml @@ -15,6 +15,12 @@ metricbeat: target: "event" fields: dataset: docker.status + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false - module: docker metricsets: [info] index: metrics-generic-default @@ -30,6 +36,12 @@ metricbeat: target: "event" fields: dataset: generic + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false - module: apache metricsets: [info] index: metrics-generic-testing @@ -48,7 +60,12 @@ metricbeat: target: "event" fields: dataset: generic - + - add_fields: + target: "elastic" + fields: + agent.id: agent-id + agent.version: 8.0.0 + agent.snapshot: false output: elasticsearch: hosts: [127.0.0.1:9200, 127.0.0.1:9300] diff --git a/x-pack/elastic-agent/pkg/agent/transpiler/rules.go b/x-pack/elastic-agent/pkg/agent/transpiler/rules.go index 5ad790eb31e..29ff1786d1e 100644 --- a/x-pack/elastic-agent/pkg/agent/transpiler/rules.go +++ b/x-pack/elastic-agent/pkg/agent/transpiler/rules.go @@ -14,6 +14,13 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" ) +// AgentInfo is an interface to get the agent info. +type AgentInfo interface { + AgentID() string + Version() string + Snapshot() bool +} + // RuleList is a container that allow the same tree to be executed on multiple defined Rule. type RuleList struct { Rules []Rule @@ -21,15 +28,15 @@ type RuleList struct { // Rule defines a rule that can be Applied on the Tree. type Rule interface { - Apply(*AST) error + Apply(AgentInfo, *AST) error } // Apply applies a list of rules over the same tree and use the result of the previous execution // as the input of the next rule, will return early if any error is raise during the execution. -func (r *RuleList) Apply(ast *AST) error { +func (r *RuleList) Apply(agentInfo AgentInfo, ast *AST) error { var err error for _, rule := range r.Rules { - err = rule.Apply(ast) + err = rule.Apply(agentInfo, ast) if err != nil { return err } @@ -73,6 +80,8 @@ func (r *RuleList) MarshalYAML() (interface{}, error) { name = "inject_index" case *InjectStreamProcessorRule: name = "inject_stream_processor" + case *InjectAgentInfoRule: + name = "inject_agent_info" case *MakeArrayRule: name = "make_array" case *RemoveKeyRule: @@ -154,6 +163,8 @@ func (r *RuleList) UnmarshalYAML(unmarshal func(interface{}) error) error { r = &InjectIndexRule{} case "inject_stream_processor": r = &InjectStreamProcessorRule{} + case "inject_agent_info": + r = &InjectAgentInfoRule{} case "make_array": r = &MakeArrayRule{} case "remove_key": @@ -181,7 +192,7 @@ type SelectIntoRule struct { } // Apply applies select into rule. -func (r *SelectIntoRule) Apply(ast *AST) error { +func (r *SelectIntoRule) Apply(_ AgentInfo, ast *AST) error { target := &Dict{} for _, selector := range r.Selectors { @@ -214,7 +225,7 @@ type RemoveKeyRule struct { } // Apply applies remove key rule. -func (r *RemoveKeyRule) Apply(ast *AST) error { +func (r *RemoveKeyRule) Apply(_ AgentInfo, ast *AST) error { sourceMap, ok := ast.root.(*Dict) if !ok { return nil @@ -250,7 +261,7 @@ type MakeArrayRule struct { } // Apply applies make array rule. -func (r *MakeArrayRule) Apply(ast *AST) error { +func (r *MakeArrayRule) Apply(_ AgentInfo, ast *AST) error { sourceNode, found := Lookup(ast, r.Item) if !found { return nil @@ -286,7 +297,7 @@ type CopyToListRule struct { } // Apply copies specified node into every item of the list. -func (r *CopyToListRule) Apply(ast *AST) error { +func (r *CopyToListRule) Apply(_ AgentInfo, ast *AST) error { sourceNode, found := Lookup(ast, r.Item) if !found { // nothing to copy @@ -347,7 +358,7 @@ type CopyAllToListRule struct { } // Apply copies all nodes into every item of the list. -func (r *CopyAllToListRule) Apply(ast *AST) error { +func (r *CopyAllToListRule) Apply(agentInfo AgentInfo, ast *AST) error { // get list of nodes astMap, err := ast.Map() if err != nil { @@ -370,7 +381,7 @@ func (r *CopyAllToListRule) Apply(ast *AST) error { continue } - if err := CopyToList(item, r.To, r.OnConflict).Apply(ast); err != nil { + if err := CopyToList(item, r.To, r.OnConflict).Apply(agentInfo, ast); err != nil { return err } } @@ -393,7 +404,7 @@ type FixStreamRule struct { } // Apply stream fixes. -func (r *FixStreamRule) Apply(ast *AST) error { +func (r *FixStreamRule) Apply(_ AgentInfo, ast *AST) error { const defaultDataset = "generic" const defaultNamespace = "default" @@ -526,7 +537,7 @@ type InjectIndexRule struct { } // Apply injects index into input. -func (r *InjectIndexRule) Apply(ast *AST) error { +func (r *InjectIndexRule) Apply(_ AgentInfo, ast *AST) error { inputsNode, found := Lookup(ast, "inputs") if !found { return nil @@ -583,7 +594,7 @@ type InjectStreamProcessorRule struct { } // Apply injects processor into input. -func (r *InjectStreamProcessorRule) Apply(ast *AST) error { +func (r *InjectStreamProcessorRule) Apply(_ AgentInfo, ast *AST) error { inputsNode, found := Lookup(ast, "inputs") if !found { return nil @@ -665,6 +676,63 @@ func InjectStreamProcessor(onMerge, streamType string) *InjectStreamProcessorRul } } +// InjectAgentInfoRule injects agent information into each rule. +type InjectAgentInfoRule struct{} + +// Apply injects index into input. +func (r *InjectAgentInfoRule) Apply(agentInfo AgentInfo, ast *AST) error { + inputsNode, found := Lookup(ast, "inputs") + if !found { + return nil + } + + inputsList, ok := inputsNode.Value().(*List) + if !ok { + return nil + } + + for _, inputNode := range inputsList.value { + inputMap, ok := inputNode.(*Dict) + if !ok { + continue + } + + // get processors node + processorsNode, found := inputMap.Find("processors") + if !found { + processorsNode = &Key{ + name: "processors", + value: &List{value: make([]Node, 0)}, + } + + inputMap.value = append(inputMap.value, processorsNode) + } + + processorsList, ok := processorsNode.Value().(*List) + if !ok { + return errors.New("InjectAgentInfoRule: processors is not a list") + } + + // elastic.agent + processorMap := &Dict{value: make([]Node, 0)} + processorMap.value = append(processorMap.value, &Key{name: "target", value: &StrVal{value: "elastic"}}) + processorMap.value = append(processorMap.value, &Key{name: "fields", value: &Dict{value: []Node{ + &Key{name: "agent.id", value: &StrVal{value: agentInfo.AgentID()}}, + &Key{name: "agent.version", value: &StrVal{value: agentInfo.Version()}}, + &Key{name: "agent.snapshot", value: &BoolVal{value: agentInfo.Snapshot()}}, + }}}) + addFieldsMap := &Dict{value: []Node{&Key{"add_fields", processorMap}}} + processorsList.value = mergeStrategy("").InjectItem(processorsList.value, addFieldsMap) + } + + return nil +} + +// InjectAgentInfo creates a InjectAgentInfoRule +func InjectAgentInfo() *InjectAgentInfoRule { + return &InjectAgentInfoRule{} +} + // ExtractListItemRule extract items with specified name from a list of maps. // The result is store in a new array. // Example: @@ -679,7 +747,7 @@ type ExtractListItemRule struct { } // Apply extracts items from array. -func (r *ExtractListItemRule) Apply(ast *AST) error { +func (r *ExtractListItemRule) Apply(_ AgentInfo, ast *AST) error { node, found := Lookup(ast, r.Path) if !found { return nil @@ -740,7 +808,7 @@ type RenameRule struct { // Apply renames the last items of a Selector to a new name and keep all the other values and will // return an error on failure. -func (r *RenameRule) Apply(ast *AST) error { +func (r *RenameRule) Apply(_ AgentInfo, ast *AST) error { // Skip rename when node is not found. node, ok := Lookup(ast, r.From) if !ok { @@ -773,7 +841,7 @@ func Copy(from, to Selector) *CopyRule { } // Apply copy a part of a tree into a new destination. -func (r CopyRule) Apply(ast *AST) error { +func (r CopyRule) Apply(_ AgentInfo, ast *AST) error { node, ok := Lookup(ast, r.From) // skip when the `from` node is not found. if !ok { @@ -800,7 +868,7 @@ func Translate(path Selector, mapper map[string]interface{}) *TranslateRule { } // Apply translates matching elements of a translation table for a specific selector. -func (r *TranslateRule) Apply(ast *AST) error { +func (r *TranslateRule) Apply(_ AgentInfo, ast *AST) error { // Skip translate when node is not found. node, ok := Lookup(ast, r.Path) if !ok { @@ -873,7 +941,7 @@ func TranslateWithRegexp(path Selector, re *regexp.Regexp, with string) *Transla } // Apply translates matching elements of a translation table for a specific selector. -func (r *TranslateWithRegexpRule) Apply(ast *AST) error { +func (r *TranslateWithRegexpRule) Apply(_ AgentInfo, ast *AST) error { // Skip translate when node is not found. node, ok := Lookup(ast, r.Path) if !ok { @@ -914,7 +982,7 @@ func Map(path Selector, rules ...Rule) *MapRule { } // Apply maps multiples rules over a subset of the tree. -func (r *MapRule) Apply(ast *AST) error { +func (r *MapRule) Apply(agentInfo AgentInfo, ast *AST) error { node, ok := Lookup(ast, r.Path) // Skip map when node is not found. if !ok { @@ -931,15 +999,15 @@ func (r *MapRule) Apply(ast *AST) error { switch t := n.Value().(type) { case *List: - return mapList(r, t) + return mapList(agentInfo, r, t) case *Dict: - return mapDict(r, t) + return mapDict(agentInfo, r, t) case *Key: switch t := n.Value().(type) { case *List: - return mapList(r, t) + return mapList(agentInfo, r, t) case *Dict: - return mapDict(r, t) + return mapDict(agentInfo, r, t) default: return fmt.Errorf( "cannot iterate over node, invalid type expected 'List' or 'Dict' received '%T'", @@ -954,13 +1022,13 @@ func (r *MapRule) Apply(ast *AST) error { ) } -func mapList(r *MapRule, l *List) error { +func mapList(agentInfo AgentInfo, r *MapRule, l *List) error { values := l.Value().([]Node) for idx, item := range values { newAST := &AST{root: item} for _, rule := range r.Rules { - err := rule.Apply(newAST) + err := rule.Apply(agentInfo, newAST) if err != nil { return err } @@ -970,10 +1038,10 @@ func mapList(r *MapRule, l *List) error { return nil } -func mapDict(r *MapRule, l *Dict) error { +func mapDict(agentInfo AgentInfo, r *MapRule, l *Dict) error { newAST := &AST{root: l} for _, rule := range r.Rules { - err := rule.Apply(newAST) + err := rule.Apply(agentInfo, newAST) if err != nil { return err } @@ -1024,7 +1092,7 @@ func Filter(selectors ...Selector) *FilterRule { } // Apply filters a Tree based on list of selectors. -func (r *FilterRule) Apply(ast *AST) error { +func (r *FilterRule) Apply(_ AgentInfo, ast *AST) error { mergedAST := &AST{root: &Dict{}} var err error for _, selector := range r.Selectors { @@ -1054,7 +1122,7 @@ func FilterValues(selector Selector, key Selector, values ...interface{}) *Filte } // Apply filters a Tree based on list of selectors. -func (r *FilterValuesRule) Apply(ast *AST) error { +func (r *FilterValuesRule) Apply(_ AgentInfo, ast *AST) error { node, ok := Lookup(ast, r.Selector) // Skip map when node is not found. if !ok { @@ -1167,7 +1235,7 @@ func (r *FilterValuesWithRegexpRule) UnmarshalYAML(unmarshal func(interface{}) e } // Apply filters a Tree based on list of selectors. -func (r *FilterValuesWithRegexpRule) Apply(ast *AST) error { +func (r *FilterValuesWithRegexpRule) Apply(_ AgentInfo, ast *AST) error { node, ok := Lookup(ast, r.Selector) // Skip map when node is not found. if !ok { diff --git a/x-pack/elastic-agent/pkg/agent/transpiler/rules_test.go b/x-pack/elastic-agent/pkg/agent/transpiler/rules_test.go index c3207f48cea..d92ba0de985 100644 --- a/x-pack/elastic-agent/pkg/agent/transpiler/rules_test.go +++ b/x-pack/elastic-agent/pkg/agent/transpiler/rules_test.go @@ -165,6 +165,51 @@ inputs: }, }, + "inject agent info": { + givenYAML: ` +inputs: + - name: No processors + type: file + - name: With processors + type: file + processors: + - add_fields: + target: other + fields: + data: more +`, + expectedYAML: ` +inputs: + - name: No processors + type: file + processors: + - add_fields: + target: elastic + fields: + agent.id: agent-id + agent.snapshot: false + agent.version: 8.0.0 + - name: With processors + type: file + processors: + - add_fields: + target: other + fields: + data: more + - add_fields: + target: elastic + fields: + agent.id: agent-id + agent.snapshot: false + agent.version: 8.0.0 +`, + rule: &RuleList{ + Rules: []Rule{ + InjectAgentInfo(), + }, + }, + }, + "extract items from array": { givenYAML: ` streams: @@ -615,7 +660,7 @@ logs: a, err := makeASTFromYAML(test.givenYAML) require.NoError(t, err) - err = test.rule.Apply(a) + err = test.rule.Apply(FakeAgentInfo(), a) require.NoError(t, err) v := &MapVisitor{} @@ -751,3 +796,21 @@ func TestSerialization(t *testing.T) { assert.Equal(t, value, v) }) } + +type fakeAgentInfo struct{} + +func (*fakeAgentInfo) AgentID() string { + return "agent-id" +} + +func (*fakeAgentInfo) Version() string { + return "8.0.0" +} + +func (*fakeAgentInfo) Snapshot() bool { + return false +} + +func FakeAgentInfo() AgentInfo { + return &fakeAgentInfo{} +} diff --git a/x-pack/elastic-agent/spec/filebeat.yml b/x-pack/elastic-agent/spec/filebeat.yml index 1b184b10098..aa09b4f9121 100644 --- a/x-pack/elastic-agent/spec/filebeat.yml +++ b/x-pack/elastic-agent/spec/filebeat.yml @@ -87,6 +87,8 @@ rules: values: - true +- inject_agent_info: {} + - copy: from: inputs to: filebeat diff --git a/x-pack/elastic-agent/spec/metricbeat.yml b/x-pack/elastic-agent/spec/metricbeat.yml index 94b69e9a2f3..a5015a974a5 100644 --- a/x-pack/elastic-agent/spec/metricbeat.yml +++ b/x-pack/elastic-agent/spec/metricbeat.yml @@ -73,6 +73,8 @@ rules: - remove_key: key: use_output +- inject_agent_info: {} + - copy: from: inputs to: metricbeat From 5ef953bf6447ee4200f22308ac9719c97a2a8758 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Tue, 6 Oct 2020 15:40:03 +0200 Subject: [PATCH 144/216] feat: add a new step to run the e2e tests for certain parts of Beats (#21100) * feat: add a new step to run the e2e tests for certain parts of Beats We are going to trigger the tests for those parts affected by the elastic-agent, filebeat, or metricbeat, because those are the ones we verify in the e2e-testing suite * chore: do not include heartbeat * feat: trigger the e2e tests * fix: use relative path * chore: use proper target branch name for PRs * chore: use different tag * fix: use proper env variable * chore: pass github checks context to downstream job * chore: revert shared lib version Co-authored-by: Victor Martinez * chore: add BASE_DIR env variable Co-authored-by: Victor Martinez * chore: remove duplicated env * ffix: add param comma separator * fix: wrong copy&paste * chore: move e2e GH check out of the release context * chore: simplify conditional logic * chore: refine execution of test suites * fix: use proper parameter name * chore: set metricbeat version * chore: remove slack notifications on PRs * chore: update parameter * chore: run multiple test suites per beat type Co-authored-by: Victor Martinez --- .ci/packaging.groovy | 50 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index 2be78aac68f..301ead43bab 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -5,12 +5,14 @@ pipeline { agent none environment { - BASE_DIR = 'src/github.com/elastic/beats' + REPO = 'beats' + BASE_DIR = "src/github.com/elastic/${env.REPO}" JOB_GCS_BUCKET = 'beats-ci-artifacts' JOB_GCS_BUCKET_STASH = 'beats-ci-temp' JOB_GCS_CREDENTIALS = 'beats-ci-gcs-plugin' DOCKERELASTIC_SECRET = 'secret/observability-team/ci/docker-registry/prod' DOCKER_REGISTRY = 'docker.elastic.co' + GITHUB_CHECK_E2E_TESTS_NAME = 'E2E Tests' SNAPSHOT = "true" PIPELINE_LOG_LEVEL = "INFO" } @@ -119,6 +121,7 @@ pipeline { release() pushCIDockerImages() } + runE2ETestForPackages() } } stage('Package Mac OS'){ @@ -209,6 +212,25 @@ def tagAndPush(name){ } } +def runE2ETestForPackages(){ + def suite = '' + + catchError(buildResult: 'UNSTABLE', message: 'Unable to run e2e tests', stageResult: 'FAILURE') { + if ("${env.BEATS_FOLDER}" == "filebeat" || "${env.BEATS_FOLDER}" == "x-pack/filebeat") { + suite = 'helm,ingest-manager' + } else if ("${env.BEATS_FOLDER}" == "metricbeat" || "${env.BEATS_FOLDER}" == "x-pack/metricbeat") { + suite = '' + } else if ("${env.BEATS_FOLDER}" == "x-pack/elastic-agent") { + suite = 'ingest-manager' + } else { + echo("Skipping E2E tests for ${env.BEATS_FOLDER}.") + return + } + + triggerE2ETests(suite) + } +} + def release(){ withBeatsEnv(){ dir("${env.BEATS_FOLDER}") { @@ -218,6 +240,32 @@ def release(){ } } +def triggerE2ETests(String suite) { + echo("Triggering E2E tests for ${env.BEATS_FOLDER}. Test suite: ${suite}.") + + def branchName = isPR() ? "${env.CHANGE_TARGET}" : "${env.JOB_BASE_NAME}" + def e2eTestsPipeline = "e2e-tests/e2e-testing-mbp/${branchName}" + build(job: "${e2eTestsPipeline}", + parameters: [ + booleanParam(name: 'forceSkipGitChecks', value: true), + booleanParam(name: 'forceSkipPresubmit', value: true), + booleanParam(name: 'notifyOnGreenBuilds', value: !isPR()), + booleanParam(name: 'USE_CI_SNAPSHOTS', value: true), + string(name: 'ELASTIC_AGENT_VERSION', value: "pr-${env.CHANGE_ID}"), + string(name: 'METRICBEAT_VERSION', value: "pr-${env.CHANGE_ID}"), + string(name: 'runTestsSuites', value: suite), + string(name: 'GITHUB_CHECK_NAME', value: env.GITHUB_CHECK_E2E_TESTS_NAME), + string(name: 'GITHUB_CHECK_REPO', value: env.REPO), + string(name: 'GITHUB_CHECK_SHA1', value: env.GIT_BASE_COMMIT), + ], + propagate: false, + wait: false + ) + + def notifyContext = "${env.GITHUB_CHECK_E2E_TESTS_NAME} for ${env.BEATS_FOLDER}" + githubNotify(context: "${notifyContext}", description: "${notifyContext} ...", status: 'PENDING', targetUrl: "${env.JENKINS_URL}search/?q=${e2eTestsPipeline.replaceAll('/','+')}") +} + def withMacOSEnv(Closure body){ withEnvMask( vars: [ [var: "KEYCHAIN_PASS", password: getVaultSecret(secret: "secret/jenkins-ci/macos-codesign-keychain").data.password], From 9d2f3b9cfdda63c5ddba93c38ef7e24c6d516a56 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Tue, 6 Oct 2020 17:28:09 +0300 Subject: [PATCH 145/216] Move Prometheus query & remote_write to GA (#21507) --- CHANGELOG.next.asciidoc | 1 + metricbeat/docs/modules/prometheus/query.asciidoc | 2 -- metricbeat/docs/modules/prometheus/remote_write.asciidoc | 2 -- metricbeat/docs/modules_list.asciidoc | 4 ++-- metricbeat/module/prometheus/fields.go | 2 +- metricbeat/module/prometheus/query/_meta/fields.yml | 2 +- metricbeat/module/prometheus/remote_write/_meta/fields.yml | 2 +- 7 files changed, 6 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index cd1e6c50a4c..0fb2aa0f73d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -738,6 +738,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add overview and platform health dashboards to Cloud Foundry module. {pull}21124[21124] - Release lambda metricset in aws module as GA. {issue}21251[21251] {pull}21255[21255] - Add dashboard for pubsub metricset in googlecloud module. {pull}21326[21326] {issue}17137[17137] +- Move Prometheus query & remote_write to GA. {pull}21507[21507] - Expand unsupported option from namespace to metrics in the azure module. {pull}21486[21486] - Map cloud data filed `cloud.account.id` to azure subscription. {pull}21483[21483] {issue}21381[21381] diff --git a/metricbeat/docs/modules/prometheus/query.asciidoc b/metricbeat/docs/modules/prometheus/query.asciidoc index 72c0fde9278..ff746df44a7 100644 --- a/metricbeat/docs/modules/prometheus/query.asciidoc +++ b/metricbeat/docs/modules/prometheus/query.asciidoc @@ -5,8 +5,6 @@ This file is generated! See scripts/mage/docs_collector.go [[metricbeat-metricset-prometheus-query]] === Prometheus query metricset -beta[] - include::../../../module/prometheus/query/_meta/docs.asciidoc[] diff --git a/metricbeat/docs/modules/prometheus/remote_write.asciidoc b/metricbeat/docs/modules/prometheus/remote_write.asciidoc index 9d871805344..535fdec82e6 100644 --- a/metricbeat/docs/modules/prometheus/remote_write.asciidoc +++ b/metricbeat/docs/modules/prometheus/remote_write.asciidoc @@ -5,8 +5,6 @@ This file is generated! See scripts/mage/docs_collector.go [[metricbeat-metricset-prometheus-remote_write]] === Prometheus remote_write metricset -beta[] - include::../../../module/prometheus/remote_write/_meta/docs.asciidoc[] diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index 949657459db..5ff2305665f 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -222,8 +222,8 @@ This file is generated! See scripts/mage/docs_collector.go |<> |<> |image:./images/icon-yes.png[Prebuilt dashboards are available] | .3+| .3+| |<> -|<> beta[] -|<> beta[] +|<> +|<> |<> |image:./images/icon-yes.png[Prebuilt dashboards are available] | .4+| .4+| |<> |<> diff --git a/metricbeat/module/prometheus/fields.go b/metricbeat/module/prometheus/fields.go index e93b578c7b7..ff89ddf8ac7 100644 --- a/metricbeat/module/prometheus/fields.go +++ b/metricbeat/module/prometheus/fields.go @@ -32,5 +32,5 @@ func init() { // AssetPrometheus returns asset data. // This is the base64 encoded gzipped contents of module/prometheus. func AssetPrometheus() string { - return "eJzMkkGO2zAMRfc+xYe7G2TmAF70BAXaosuiCBT7O1ZHllSSniC3LxzHGU0yQJF2Uy75RfLxi4945rFBljTSBk5aAeYtsEH95ZKsK6CjtuKz+RQbfKwA4Js5U2grLrNDL2mEw2sVGLucfLSnCtAhiW3bFHu/b9C7oKwAYaBTNti7+Q3NfNxrg++1aqg3qAezXP+ogN4zdNqc5j4iupFX1HPYMc+9JE35nCnL5viAz9JR4BV+zEnMRcNA4QbB7RgUBx8CRmftgN6L2gY2EEI1OCG6NO0CL/1WlKX46eEirDBp95OtFeklsV3UZx4PSbpCfsfmNQpnR5r49jz1BmZR76e52u2Nuh1dzj7uz0/rh/ovoW9of02U4//G+uLCdPr1Kdh627P89VPB//Z639nqZqfyNP8Ac2qwfiVLHy5jdzRX5K9vfUURjsm4PYg3/gvR0genPivYqzNn45TyQrmD9ncAAAD//1baTA8=" + return "eJzMkk1u20AMhfc6xYO6C5wcQIueoEBbdFkUxlh6sqaZv5JUDN++kGU5im2gf5tyyTckP77hI555bFAkR9rAUSvAvAU2qD9dknUFdNRWfDGfU4P3FQB8MWcKbcUVduglRzi8VoGpK9kne6oAHbLYts2p9/sGvQvKChAGOmWDvZve0MynvTb4WquGeoN6MCv1twroPUOnzWnuI5KLvKKewo5l6iV5LOfMumyKd/goHQVe4WPJYi4ZBgo3CG7HoDj4EBCdtQN6L2ob2EAI1eCE6PK4C7z0W1Dm4qeHi7DA5N13trZKz4ntrD7zeMjSreQ7Ni+xcjbSxLfnqTcws/rnNFe7vVG30ZXi0/78tH6o/xL6hvbHSDn+b6wvLoynXx+DLbc9yZ8/rPjfXu+drW52Wp/mL2BODZav5NqHe2NvL30BEcZs3B7EG/+FZ+6DU58F69WXs21KeaH8NuvPAAAA///rUkpn" } diff --git a/metricbeat/module/prometheus/query/_meta/fields.yml b/metricbeat/module/prometheus/query/_meta/fields.yml index acbc35db449..31f29117385 100644 --- a/metricbeat/module/prometheus/query/_meta/fields.yml +++ b/metricbeat/module/prometheus/query/_meta/fields.yml @@ -2,5 +2,5 @@ type: group description: > query metricset - release: beta + release: ga fields: diff --git a/metricbeat/module/prometheus/remote_write/_meta/fields.yml b/metricbeat/module/prometheus/remote_write/_meta/fields.yml index e3b2f050a40..17f5f5fe801 100644 --- a/metricbeat/module/prometheus/remote_write/_meta/fields.yml +++ b/metricbeat/module/prometheus/remote_write/_meta/fields.yml @@ -2,5 +2,5 @@ type: group description: > remote write metrics from Prometheus server - release: beta + release: ga fields: From a2decea3c5011668156711f06fa8a1e6195bc5df Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Tue, 6 Oct 2020 09:01:17 -0600 Subject: [PATCH 146/216] Add support for additional fields from V2 ALB logs (#21540) * Add support for additional fields from V2 ALB logs * Add new fields as optional fields and regenerate -expected.json files * add changelog --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 40 ++++ .../filebeat/module/aws/elb/_meta/fields.yml | 16 ++ .../module/aws/elb/ingest/pipeline.yml | 14 +- .../aws/elb/test/application-lb-http.log | 2 +- .../application-lb-http.log-expected.json | 50 ++++ .../module/aws/elb/test/example-alb-http.log | 5 +- .../test/example-alb-http.log-expected.json | 215 ++++++++++++++++++ x-pack/filebeat/module/aws/fields.go | 2 +- 9 files changed, 341 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0fb2aa0f73d..99daa875a00 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -607,6 +607,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add related.hosts ecs field to all modules {pull}21160[21160] - Keep cursor state between httpjson input restarts {pull}20751[20751] - Convert aws s3 to v2 input {pull}20005[20005] +- Add support for additional fields from V2 ALB logs. {pull}21540[21540] - Release Cloud Foundry input as GA. {pull}21525[21525] - New Cisco Umbrella dataset {pull}21504[21504] - New juniper.srx dataset for Juniper SRX logs. {pull}20017[20017] diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index e7c2d35ff37..c294aef0f79 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -1884,6 +1884,46 @@ type: keyword The error reason if the executed action failed. +type: keyword + +-- + +*`aws.elb.target_port`*:: ++ +-- +List of IP addresses and ports for the targets that processed this request. + + +type: keyword + +-- + +*`aws.elb.target_status_code`*:: ++ +-- +List of status codes from the responses of the targets. + + +type: keyword + +-- + +*`aws.elb.classification`*:: ++ +-- +The classification for desync mitigation. + + +type: keyword + +-- + +*`aws.elb.classification_reason`*:: ++ +-- +The classification reason code. + + type: keyword -- diff --git a/x-pack/filebeat/module/aws/elb/_meta/fields.yml b/x-pack/filebeat/module/aws/elb/_meta/fields.yml index 9499f8bbb0e..aac074e9347 100644 --- a/x-pack/filebeat/module/aws/elb/_meta/fields.yml +++ b/x-pack/filebeat/module/aws/elb/_meta/fields.yml @@ -101,3 +101,19 @@ type: keyword description: > The error reason if the executed action failed. + - name: target_port + type: keyword + description: > + List of IP addresses and ports for the targets that processed this request. + - name: target_status_code + type: keyword + description: > + List of status codes from the responses of the targets. + - name: classification + type: keyword + description: > + The classification for desync mitigation. + - name: classification_reason + type: keyword + description: > + The classification reason code. diff --git a/x-pack/filebeat/module/aws/elb/ingest/pipeline.yml b/x-pack/filebeat/module/aws/elb/ingest/pipeline.yml index de772ccdf01..8cb2a914921 100644 --- a/x-pack/filebeat/module/aws/elb/ingest/pipeline.yml +++ b/x-pack/filebeat/module/aws/elb/ingest/pipeline.yml @@ -31,7 +31,7 @@ processors: %{TIMESTAMP_ISO8601:event.start} \"(?:-|%{DATA:_tmp.actions_executed})\" \"(?:-|%{DATA:aws.elb.redirect_url})\" - \"(?:-|%{DATA:aws.elb.error.reason})\" + \"(?:-|%{DATA:aws.elb.error.reason})\"( \"(?:-|%{DATA:_tmp.target_port})\")?( \"(?:-|%{DATA:_tmp.target_status_code})\")?( \"(?:-|%{DATA:aws.elb.classification})\")?( \"(?:-|%{DATA:aws.elb.classification_reason})\")? # TCP from Network Load Balancers (v2 Load Balancers) - >- @@ -141,6 +141,18 @@ processors: separator: ',' ignore_missing: true + - split: + field: '_tmp.target_port' + target_field: 'aws.elb.target_port' + separator: ' ' + ignore_missing: true + + - split: + field: '_tmp.target_status_code' + target_field: 'aws.elb.target_status_code' + separator: ' ' + ignore_missing: true + - date: field: '_tmp.timestamp' formats: diff --git a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log index 88ea2d75c26..5d754c4bbaa 100644 --- a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log +++ b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log @@ -8,4 +8,4 @@ http 2019-10-11T15:03:49.331902Z app/filebeat-aws-elb-test/c86a326e7dc14222 77.2 http 2019-10-11T15:55:09.308183Z app/filebeat-aws-elb-test/c86a326e7dc14222 77.227.156.41:37838 10.0.0.192:80 0.001 0.000 0.000 200 200 125 859 "GET http://filebeat-aws-elb-test-12030537.eu-central-1.elb.amazonaws.com:80/ HTTP/1.1" "curl/7.58.0" - - arn:aws:elasticloadbalancing:eu-central-1:627959692251:targetgroup/test-lb-instances/8f04c4fe71f5f794 "Root=1-5da0a5dd-4d9a423a0e9a782fe2f390af" "-" "-" 0 2019-10-11T15:55:09.307000Z "forward" "-" "-" http 2019-10-11T15:55:11.354283Z app/filebeat-aws-elb-test/c86a326e7dc14222 77.227.156.41:37850 10.0.1.107:80 0.001 0.001 0.000 200 200 125 859 "GET http://filebeat-aws-elb-test-12030537.eu-central-1.elb.amazonaws.com:80/ HTTP/1.1" "curl/7.58.0" - - arn:aws:elasticloadbalancing:eu-central-1:627959692251:targetgroup/test-lb-instances/8f04c4fe71f5f794 "Root=1-5da0a5df-7d64cabe9955b4df9acc800a" "-" "-" 0 2019-10-11T15:55:11.352000Z "forward" "-" "-" http 2019-10-11T15:55:11.987940Z app/filebeat-aws-elb-test/c86a326e7dc14222 77.227.156.41:37856 10.0.0.192:80 0.000 0.001 0.000 200 200 125 859 "GET http://filebeat-aws-elb-test-12030537.eu-central-1.elb.amazonaws.com:80/ HTTP/1.1" "curl/7.58.0" - - arn:aws:elasticloadbalancing:eu-central-1:627959692251:targetgroup/test-lb-instances/8f04c4fe71f5f794 "Root=1-5da0a5df-7c958e828ff43b63d0e0fac4" "-" "-" 0 2019-10-11T15:55:11.987000Z "forward" "-" "-" - +http 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366 "GET http://www.example.com:80/ HTTP/1.1" "curl/7.46.0" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337262-36d228ad5d99923122bbe354" "-" "-" 0 2018-07-02T22:22:48.364000Z "forward,redirect" "-" "-" "10.0.0.1:80" "200" "-" "-" diff --git a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json index 28e1564e928..3682fb6520e 100644 --- a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json @@ -500,5 +500,55 @@ ], "tracing.trace.id": "Root=1-5da0a5df-7c958e828ff43b63d0e0fac4", "user_agent.original": "curl/7.58.0" + }, + { + "@timestamp": "2018-07-02T22:23:00.186Z", + "aws.elb.action_executed": [ + "forward", + "redirect" + ], + "aws.elb.backend.http.response.status_code": 200, + "aws.elb.backend.ip": "10.0.0.1", + "aws.elb.backend.port": "80", + "aws.elb.backend_processing_time.sec": 0.001, + "aws.elb.matched_rule_priority": "0", + "aws.elb.name": "app/my-loadbalancer/50dc6c495c0c9188", + "aws.elb.protocol": "http", + "aws.elb.request_processing_time.sec": 0.0, + "aws.elb.response_processing_time.sec": 0.0, + "aws.elb.target_group.arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067", + "aws.elb.target_port": [ + "10.0.0.1:80" + ], + "aws.elb.target_status_code": [ + "200" + ], + "aws.elb.trace_id": "Root=1-58337262-36d228ad5d99923122bbe354", + "aws.elb.type": "http", + "cloud.provider": "aws", + "event.category": "web", + "event.dataset": "aws.elb", + "event.end": "2018-07-02T22:23:00.186Z", + "event.kind": "event", + "event.module": "aws", + "event.outcome": "success", + "event.start": "2018-07-02T22:22:48.364000Z", + "fileset.name": "elb", + "http.request.body.bytes": 34, + "http.request.method": "GET", + "http.request.referrer": "http://www.example.com:80/", + "http.response.body.bytes": 366, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 4431, + "service.type": "aws", + "source.ip": "192.168.131.39", + "source.port": "2817", + "tags": [ + "forwarded" + ], + "tracing.trace.id": "Root=1-58337262-36d228ad5d99923122bbe354", + "user_agent.original": "curl/7.46.0" } ] \ No newline at end of file diff --git a/x-pack/filebeat/module/aws/elb/test/example-alb-http.log b/x-pack/filebeat/module/aws/elb/test/example-alb-http.log index 9e4526d2d61..94c0ec1360b 100644 --- a/x-pack/filebeat/module/aws/elb/test/example-alb-http.log +++ b/x-pack/filebeat/module/aws/elb/test/example-alb-http.log @@ -7,4 +7,7 @@ http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.13 http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - 0.000 0.001 0.000 502 - 34 366 "GET http://www.example.com:80/ HTTP/1.1" "curl/7.46.0" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337364-23a8c76965a2ef7629b185e3" "-" "-" 0 2018-11-30T22:22:48.364000Z "forward" "-" "LambdaInvalidResponse" http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - -1 -1 -1 400 - 0 0 "- http://www.example.com:80- -" "-" - - - "-" "-" "-" 0 2018-11-30T22:22:48.364000Z "-" "-" "-" http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - -1 -1 -1 400 - 0 0 "- - -" "-" - - - "-" "-" "-" 0 2018-11-30T22:22:48.364000Z "-" "-" "-" - +h2 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 10.0.1.252:48160 10.0.0.66:9000 0.000 0.002 0.000 200 200 5 257 "GET https://10.0.2.105:773/ HTTP/2.0" "curl/7.46.0" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337327-72bd00b0343d75b906739c42" "-" "-" 1 2018-07-02T22:22:48.364000Z "redirect" "https://example.com:80/" "-" "10.0.0.66:9000" "200" "-" "-" +https 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.086 0.048 0.037 200 200 0 57 "GET https://www.example.com:443/ HTTP/1.1" "curl/7.46.0" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337281-1d84f3d73c47ec4e58577259" "www.example.com" "arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012" 1 2018-07-02T22:22:48.364000Z "authenticate,forward" "-" "-" "10.0.0.1:80" "200" "-" "-" +ws 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:40914 10.0.1.192:8010 0.001 0.003 0.000 101 101 218 587 "GET http://10.0.0.30:80/ HTTP/1.1" "-" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337364-23a8c76965a2ef7629b185e3" "-" "-" 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.1.192:8010" "101" "-" "-" +wss 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:44244 10.0.0.171:8010 0.000 0.001 0.000 101 101 218 786 "GET https://10.0.0.30:443/ HTTP/1.1" "-" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337364-23a8c76965a2ef7629b185e3" "-" "-" 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.171:8010" "101" "-" "-" diff --git a/x-pack/filebeat/module/aws/elb/test/example-alb-http.log-expected.json b/x-pack/filebeat/module/aws/elb/test/example-alb-http.log-expected.json index eb1fad5f705..2c1490142fa 100644 --- a/x-pack/filebeat/module/aws/elb/test/example-alb-http.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/example-alb-http.log-expected.json @@ -368,5 +368,220 @@ ], "tracing.trace.id": "-", "user_agent.original": "-" + }, + { + "@timestamp": "2018-07-02T22:23:00.186Z", + "aws.elb.action_executed": [ + "redirect" + ], + "aws.elb.backend.http.response.status_code": 200, + "aws.elb.backend.ip": "10.0.0.66", + "aws.elb.backend.port": "9000", + "aws.elb.backend_processing_time.sec": 0.002, + "aws.elb.matched_rule_priority": "1", + "aws.elb.name": "app/my-loadbalancer/50dc6c495c0c9188", + "aws.elb.protocol": "http", + "aws.elb.redirect_url": "https://example.com:80/", + "aws.elb.request_processing_time.sec": 0.0, + "aws.elb.response_processing_time.sec": 0.0, + "aws.elb.ssl_cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "aws.elb.ssl_protocol": "TLSv1.2", + "aws.elb.target_group.arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067", + "aws.elb.target_port": [ + "10.0.0.66:9000" + ], + "aws.elb.target_status_code": [ + "200" + ], + "aws.elb.trace_id": "Root=1-58337327-72bd00b0343d75b906739c42", + "aws.elb.type": "h2", + "cloud.provider": "aws", + "event.category": "web", + "event.dataset": "aws.elb", + "event.end": "2018-07-02T22:23:00.186Z", + "event.kind": "event", + "event.module": "aws", + "event.outcome": "success", + "event.start": "2018-07-02T22:22:48.364000Z", + "fileset.name": "elb", + "http.request.body.bytes": 5, + "http.request.method": "GET", + "http.request.referrer": "https://10.0.2.105:773/", + "http.response.body.bytes": 257, + "http.response.status_code": 200, + "http.version": "2.0", + "input.type": "log", + "log.offset": 3284, + "service.type": "aws", + "source.ip": "10.0.1.252", + "source.port": "48160", + "tags": [ + "forwarded" + ], + "tls.cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "tls.version": "1.2", + "tls.version_protocol": "tls", + "tracing.trace.id": "Root=1-58337327-72bd00b0343d75b906739c42", + "user_agent.original": "curl/7.46.0" + }, + { + "@timestamp": "2018-07-02T22:23:00.186Z", + "aws.elb.action_executed": [ + "authenticate", + "forward" + ], + "aws.elb.backend.http.response.status_code": 200, + "aws.elb.backend.ip": "10.0.0.1", + "aws.elb.backend.port": "80", + "aws.elb.backend_processing_time.sec": 0.048, + "aws.elb.chosen_cert.arn": "arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012", + "aws.elb.matched_rule_priority": "1", + "aws.elb.name": "app/my-loadbalancer/50dc6c495c0c9188", + "aws.elb.protocol": "http", + "aws.elb.request_processing_time.sec": 0.086, + "aws.elb.response_processing_time.sec": 0.037, + "aws.elb.ssl_cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "aws.elb.ssl_protocol": "TLSv1.2", + "aws.elb.target_group.arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067", + "aws.elb.target_port": [ + "10.0.0.1:80" + ], + "aws.elb.target_status_code": [ + "200" + ], + "aws.elb.trace_id": "Root=1-58337281-1d84f3d73c47ec4e58577259", + "aws.elb.type": "https", + "cloud.provider": "aws", + "destination.domain": "www.example.com", + "event.category": "web", + "event.dataset": "aws.elb", + "event.end": "2018-07-02T22:23:00.186Z", + "event.kind": "event", + "event.module": "aws", + "event.outcome": "success", + "event.start": "2018-07-02T22:22:48.364000Z", + "fileset.name": "elb", + "http.request.body.bytes": 0, + "http.request.method": "GET", + "http.request.referrer": "https://www.example.com:443/", + "http.response.body.bytes": 57, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 3750, + "service.type": "aws", + "source.ip": "192.168.131.39", + "source.port": "2817", + "tags": [ + "forwarded" + ], + "tls.cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "tls.version": "1.2", + "tls.version_protocol": "tls", + "tracing.trace.id": "Root=1-58337281-1d84f3d73c47ec4e58577259", + "user_agent.original": "curl/7.46.0" + }, + { + "@timestamp": "2018-07-02T22:23:00.186Z", + "aws.elb.action_executed": [ + "forward" + ], + "aws.elb.backend.http.response.status_code": 101, + "aws.elb.backend.ip": "10.0.1.192", + "aws.elb.backend.port": "8010", + "aws.elb.backend_processing_time.sec": 0.003, + "aws.elb.matched_rule_priority": "1", + "aws.elb.name": "app/my-loadbalancer/50dc6c495c0c9188", + "aws.elb.protocol": "http", + "aws.elb.request_processing_time.sec": 0.001, + "aws.elb.response_processing_time.sec": 0.0, + "aws.elb.target_group.arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067", + "aws.elb.target_port": [ + "10.0.1.192:8010" + ], + "aws.elb.target_status_code": [ + "101" + ], + "aws.elb.trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3", + "aws.elb.type": "ws", + "cloud.provider": "aws", + "event.category": "web", + "event.dataset": "aws.elb", + "event.end": "2018-07-02T22:23:00.186Z", + "event.kind": "event", + "event.module": "aws", + "event.outcome": "success", + "event.start": "2018-07-02T22:22:48.364000Z", + "fileset.name": "elb", + "http.request.body.bytes": 218, + "http.request.method": "GET", + "http.request.referrer": "http://10.0.0.30:80/", + "http.response.body.bytes": 587, + "http.response.status_code": 101, + "http.version": "1.1", + "input.type": "log", + "log.offset": 4306, + "service.type": "aws", + "source.ip": "10.0.0.140", + "source.port": "40914", + "tags": [ + "forwarded" + ], + "tracing.trace.id": "Root=1-58337364-23a8c76965a2ef7629b185e3", + "user_agent.original": "-" + }, + { + "@timestamp": "2018-07-02T22:23:00.186Z", + "aws.elb.action_executed": [ + "forward" + ], + "aws.elb.backend.http.response.status_code": 101, + "aws.elb.backend.ip": "10.0.0.171", + "aws.elb.backend.port": "8010", + "aws.elb.backend_processing_time.sec": 0.001, + "aws.elb.matched_rule_priority": "1", + "aws.elb.name": "app/my-loadbalancer/50dc6c495c0c9188", + "aws.elb.protocol": "http", + "aws.elb.request_processing_time.sec": 0.0, + "aws.elb.response_processing_time.sec": 0.0, + "aws.elb.ssl_cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "aws.elb.ssl_protocol": "TLSv1.2", + "aws.elb.target_group.arn": "arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067", + "aws.elb.target_port": [ + "10.0.0.171:8010" + ], + "aws.elb.target_status_code": [ + "101" + ], + "aws.elb.trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3", + "aws.elb.type": "wss", + "cloud.provider": "aws", + "event.category": "web", + "event.dataset": "aws.elb", + "event.end": "2018-07-02T22:23:00.186Z", + "event.kind": "event", + "event.module": "aws", + "event.outcome": "success", + "event.start": "2018-07-02T22:22:48.364000Z", + "fileset.name": "elb", + "http.request.body.bytes": 218, + "http.request.method": "GET", + "http.request.referrer": "https://10.0.0.30:443/", + "http.response.body.bytes": 786, + "http.response.status_code": 101, + "http.version": "1.1", + "input.type": "log", + "log.offset": 4708, + "service.type": "aws", + "source.ip": "10.0.0.140", + "source.port": "44244", + "tags": [ + "forwarded" + ], + "tls.cipher": "ECDHE-RSA-AES128-GCM-SHA256", + "tls.version": "1.2", + "tls.version_protocol": "tls", + "tracing.trace.id": "Root=1-58337364-23a8c76965a2ef7629b185e3", + "user_agent.original": "-" } ] \ No newline at end of file diff --git a/x-pack/filebeat/module/aws/fields.go b/x-pack/filebeat/module/aws/fields.go index 352932f1b1c..e8968b65e8e 100644 --- a/x-pack/filebeat/module/aws/fields.go +++ b/x-pack/filebeat/module/aws/fields.go @@ -19,5 +19,5 @@ func init() { // AssetAws returns asset data. // This is the base64 encoded gzipped contents of module/aws. func AssetAws() string { - return "eJzcXN+T4raTf9+/oisvma0Crr6b1NXVXOWq2NnJhctkMzewyd2TI+wGdCMkR5JhyV9/1ZL8AywDM5jd1JeHXQbb0qdb/VstD+EZd7fAtuYNgOVW4C2Mf5++AdAokBm8hTla9gYgQ5Nqnluu5C38xxsAgF9UVgiEhdKwYjITXC5BqKWBhVZrGmb0BmDBUWTm1j0wBMnWWE5HH7vL8RaWWhV5+CUyD31+dMNUI7t5RuFqc4rmNKlQRWY146K6FJuRPofUlp8MF6wQNnFT3MKCCYN7l6Ngm4CVdnjvCMuMsOxBj8FvkoAblDbZoDZcyb07SkqecbdVOju4dgQYfWYrbCIK44NagF0hAfQTE/o1s6MotMKgTniG0nK7i0I7ZHIb2DCKjEaehIEBBa4JSqqkZVwayNAyLgywuSqsw0uzgVq0xpqMf4ESINgVs7BmGbpHNP5ZoLEDYDKD7YqnK0g1unuZMLBFja3hCoPZCCYLsLjOlWZ613rG3TNwM5S4zUptDazUln5tjdkaQM2JSsxGB7fGhKS5GsSD1sXjMtJejsgNfkUChx1hHUve0G59KKkvR9IWjBLKeM3+UhKe0KhCpwgf2RrhZvz08W0JMNdcpjxn4mDNUybEIVsbqNMUjUmecZfwGL6+8Pt5aCCYfPAIt8w4wQGrwPClbEpoN2CDhpQ2IcXAz7YTckwLzwU8WTSxOKCOnVtuVw01MJgWOiYSsC/ipG6VYjjSc602PEMDXHpbQ2ao1uxAY3TcinWpRmYxc6bWrpTB5pSRR7tUqcnc9YIlrLArGiWl0aN3n5aKcxkNQTo2TBQI3IDV9H9gv1LWGUVQ2hk1931LpHYOFrVMgUX1gjJhlOPhHq1+eVmc7fT55ccxZLjhKf47KLtCveUGB947tgW2yVe3ViS1GbNd4D1Pj9zwEobSMM7IW75G2K7Qa1dbdtsc48YUbUO8T0+phO5efZSgLj18CUV96CO8Xic7xwvu7Xx3Vn6O6SKcdm/l5xw1hBfwGYL0BB8THMtxoRmAKdLV0SGZgSel7ICU+JNBPSCFflKiQ2maDKicWtw7XZsRXFrUkgnyWYEbzbiq6cGW2C0nsC97p8mOxxLXpnb89LGkMkjADUtTVUi/dM7+urXTSuDbo8PF2HNCkM7gigfzdUQhTO4pU1tpricNJb1cbtQzZsk8ZtH6CsxoqnLVKWMzqMnDdSUOpOzAYvEFlDHq/d07GBdWwTRlLjkOueC9YMbyFN4jk8Yy8RxPsFBrpZNUZYeW7/zEL55fNalzk1SBRvArGm2hpXGega4fw7dGY9iyT4iT42B8etUYpDJI3VDDWEnONFujRX24bpeytB54QMxkcjcIukBe0JBv9T66O7JfF8Ly5GSedyzU77h4oojRZJPJlTSYhHigby6V41fxBsWjLKVnTKlnzwjpisklGrjxkf2gnYnnFNY5C5yhQIrw/CBv/4ZMZVnGCRwTiSuqZGyvwnQpX8fV8BTrskby5Es4lUWWypKY2qAurYFKfSO3Ftbpb8jNUpNbru9S2fSZl+OWr3AsOJo9ffURYbCbc+Ry2S7nMCEwgyVK1My657nxQ3fYUFffi0S3FxnQffxl8aYhDyXArCEoGlOlszhMlvOLi5AncY4fJ1UlkhmjUl4no+761oxzfseEaI3kKJgRnUd4vWaSLZ3d8YrYpxLCe6UEMtkhRtsVUprc4DY3cGgFoIHQ39XlzFiWKCniRdeLl6LGyg2onOSEVoQAu6mHNHV9oQujD5zjHuQ1heExCG6c8arGDrU0zIDLmrUvrZxer1xZ1SjHTx/bgeJZwXwfMMYhYK9Tt5KDFL5Hqha91pRPsMYZp0pTdLmSvvDg9qJub9nWDIPdHTpkt+TphvSo+7tDAlOec1L2TgZfojBPmGukuM7bLlbz2Om+xhT5xtlXbo4pc6DLW6Qk7G1cz8ZWYT9NNwAuU1FklJpsCbXVfLlE7d1C3Mj6WpqXoUL8HYNYs2Ias8DQXtf8Pz9NPjRc53zX3EOzCgrJ/yxQ7Ep5bl6PczNsaLqVofSTMjMfygYXYnzuYBVkfLFATX/4/dn9T5A/ExeyTZ4mKLNc8b5ZciBevz3eQTkRqbLfWQsBVCgJulTakd12gPS8VcCkqyo3E9Uq4S6T6+l3cVpTJY0SmAi15PFg5TXeJ+zmmhxTvuApgbzzEz3QPGE1X+p5TmcGx1G3kccdQJ0i3Dsd/kCJAuVep2k4RkeTlrWac4EdQeI+JXMfKnXcc3YpvB2x7FFDKY+TMo8MjiEriXAyk1h1FH4/mz2fnh5aK3CcwQuWFObERtTVWOvsOixYailjrzeLyFJtO6pgEPbMISs0uZhOUksSF4JZi7JF4+vV9n5aD+rSYxduEN/V/P8wtY5A7St7pph7QQemUX5r4VmqrSQrxrINk2krG+5Vvbtob1N5SsUvqwLAeZWAF5TWXkNjd5W2h0Lb+fWufqH3Vf2CF1XAXhZq9kdxj4EnnBV8lmRmfIkmntxf4PmdK7mrGsrgg5sFHtTypV5fqGWy4KKVGtcwJZp4x8FZ2V6VJz+opZunbJ2q82TPoiOSYpm2ieXr7vSvY3v+XF1wM9Dyf5rd+a15TVLv1aCGCEQApIqcd1wRLHumYZivTrgIOfX23I1axaBCLcFzY8U2cRGbI0rSJr5xkrgX3nfzCmV2VU6hzP4p+GS+S+ZF+hzdDrzKFl6ZJoCflkJ2T6JrVCi0bpcAw2wNlq6YOaD3KIU+qrgihTVVfirXR3YTcsVBlPDoWEL54K1qmgsMaRLfTanELbn8ULy+ovBXUh9QrpXxtZWyQgpsrUishTgW0IRcO1i/WsTPNIdKZF+HXD9xB6Xd+Rq8mtJc44arwiRfQluPa2gJZU8du1KNM7SzIm3FzCphYqk0t6v1F7JGNClUk7bbJNz1LvGNseIIocVc8NQ1si64XKLONY9aur7oXOFnlmHK10wAylRlmEFj5qot1+FyBovIjw63ZjZdhYgx13zDLLoHDrpj+ZmsoNuZLTR+kfWul7fVzNuJtu5wMXy5Ol4A7orIT+Gbug70eINtITPUYkehQYjBDa0XkzDxiNr6FiL4shznjZOv5g98Zypb+jsss9xYnpqB29sjStvBiW/Aj2yP2TJMpCQHZVbK0XFgNXv3ToFsSbDeHHL065wC+Z2wvOgUyLEem0i5/ES9YB9EOXibcZi++/ocu797588UcdkAfi7jeJ6wLNNoXr+l0mJf3Q6JFsLo9caaqzigjnBTzM/n5vI6vHx4/yKxa+2tXcy3pksUimUwZ4LJFDvati7qi4gCaB5k2QPgmLR5Bw/04/vwY8d2imV6iTZxqzdqbx9fCLHRfOon8mJSH7HrLG1VFQZuyE8cbuxeiMtJTxi5tclJyaeUmHZ3BORaWZWqw42wC0GVo8bX9GZlbU7uw6b52xOdgVqlaAyXSxfhjwymHU5YtWKXc+ROWSaqVNtgqmRmwPAyCa+556uuvgDLTc3jQlougO/tCVIqv6QlcXk4S59RdjTwhIt/IzIbZNCVABAsF2LvBxcCmFA8zbhcdjac+FLuV6awKvI2167a5N2jcn8tHXsE72wUqFnn6VrHXZpQrba0l1FV1gMaKyVhzYXggdhBoNbDV7nbW2kQlAplDhOxynIKyr9kZlbsGa9LR3nUafYwhWpKYnSq1rmrmB/QBSoipVX9B41lc8HNqou0Uv34YYH5Qgs3eTwMMkohqiXdp0SnLHCJMFf69b1vcSustC1LDJeiI5M9qradKIcozGVN8FHIfmCggdvqedO82lZQ/wD5Q9Jfq7SvrP/RCf2PKMXGiCTl+apvRz2dPoAf1yeiXJIS/Iv7uVqEjtCGMF3HU9P0lbd+Ma50pQzKJEVtrxpx+XmA5uELdxoSQp+Xz+gbQvBa+AY1Zz0z148JsljPUV+ZFi5TtXbuVZiECezbmFButUQdOmnVwllwN0/Do853sRC+1GNPldsgDhR3uyP6liWxncEL6SDYbnAfv3cg0CzFS1qyolO7I+HSVh7jj/8Zjtd/yeGMZhtOsj9ghSzryrp8ES5LdCEonOIqcpT04rDdj1ovsoudClEdt3IQ9k9c8QUFvHRPuNzRq+6DJPyMadHeRr0QeGjOKwf3B4r3XF19cOlmofSW6WwAC/4Zs2HpGQZ7p61Ho9HbEUwspEyWO7VgcIOaCc+eDj3UmHGNqU0K3bM1+fT0ECy043iYxxUO07Ljp2LBkbNhI43M9P3aEn9gzY9cnlurliPgWzAumsjqHTrfMf61CzHT71w/BOrybRAvqcr4zZIk1rp9qdlgUkmeMuHLuHW/uJvr4ESsh9ERy8W2jnosHZX7ReUmePM8fFBGEoYl47KrRqJxrSwmHdF66+dzTEOeM+2d6dnFQWhXIr7YolbzuS4iBkMnnoXcfxVE2bt7vHrSpwMbg7GuX3Cv07reLIw2WiOr+4zjUKsDK/2ytz4g42pjGaz8qyMgw1QwygyYgemv48dRdecAnu6ns9FPs9ljska7UtmoPJDhToIN4Pf799PJ7P7YLUrD+/Hs7qfRh/uH+9n96Nf3/3V/N4uT/ow9u+9vnnH3TbONsHbS5DvCJqAD+c3wm9JK16zKFPpOREs5OXNbfFVj33FJKzTvl5YnP/Dw09NkjyLifWVYWnskTWiU9iU+2+uxlCGLNWqeehzNfLQ+wxPpzOzx7Hg8VarU8N754TuVYXOdpQoOWqWuo6SrWLKzaBLTdQjv1RwL2U9VhHPzuAx+APi5bDl0LK0rxxvUFA43yfgLteowI67tJjH8rzhnL6lb0aCVy/XtPVyCk8DOsol7MtaU0g8n9wpkh66WS1gIvlzZxikWF9Z8ayBHbXKKGjcdEmoLLROmVRHvn7sKfGYbAmxyctaN2H2nCn3ch7jGOd23h97LgZxsPoV5Qpp2OpF17+Jz2+7XhvbJoB6OaaajOWQ4bdF7ZlueD558KOuNlec519mEISbZKZezUj1HNkTA5yFb/zXk2fCdextIJY342aLM6oALJh86KnRVT8tV3gpZDV/yaQBTvvzNoaUv3w/azUvNiHHPSLw6rvTly8QUvNVPd2kZElMibqoogzDwwHao4WY6fXhb1kzroxK4VJZXr5Yj8Z/GSKMLHaWIvYMylx3zj/uNsJ1dvc9t/2SOfxvluLCrn5yu+hMH+/d4LTYD+O8C9W7qQ2+670/6u4zFb3KNQ5INzCjEe/v6pXVa5SftuTBQnjssxTJUMunriTODVpjraNNMM2nc7ogXtGn5uqeb2cP0bWXNGpIWCpuHO4GNk5wLobbnFzCu1Zfz2+MdEJIXlS6uwmNC8iMheVBLU07h3tO6UwUJQ3hfkCM8HCz3ndIl+7mBd9UD/ojnDhikhbFq3fVEhyj1cNg8Hni7k8HVIfNyd7Ncgq5SvUW9uEaFuS4jSLRbpZ/ruRy2uo/XarZY8DTshyudHa/b9gvz4Cx17K0iAd8Axnd3948z90a+++5cWqjlsVzv1UiFWi7J0IZMLzC3XN4B/PrzAD7++mE8GztP/PPkkb53NpNaJq+66uUUjrXftjn7CqkYlKFbNTY3rvLojOJOFR19Rc82MTplWRb3J68p5eWMooOhwA0KuFGaL7lk4m1Z+mxvyQdyuhFmxn4RhBnlitJ79gbM0lwcxbnJ0ytKjDvaT3pYvci7V+thirnE/s1ujd9PcE0SbJonC8FaBwovJGHO7ZqZ55DLVY5DCaG2ZHFmd4/gpr2Fdz9M//fj4B//Rv8Nx3c/D/7xw4+Tj4Pvf3iazuKQr9eg6bl2C5PHzfcD+vdfXYp3/+N49Ob/AwAA//+8xDjD" + return "eJzcXN9z47Zzf7+/Yicv8c1I7nwvmU7HnXRG53MaNc7FtXxJ+8RA5IpCDQEMAEqn/PWdBcAfEkFJtqi7zFcPd7JIAp9d7G8sOIZn3N4A25g3AJZbgTcw+X32BkCjQGbwBuZo2RuADE2qeWG5kjfwH28AAH5RWSkQFkrDkslMcJmDULmBhVYrGub6DcCCo8jMjXtgDJKtsJqOPnZb4A3kWpVF+CUyD31+dMPUI7t5rsPV9hTtaVKhysxqxkV9KTYjffaprT4ZLlgpbOKmuIEFEwZ3LkfBtgEr7fDeEpYnwrIDPQa/TQKuUdpkjdpwJXfuqCh5xu1G6Wzv2gFg9HlaYhtRGB/UAuwSCaCfmNCvmL2OQisN6oRnKC232yi0fSZ3gY2jyGjkaRgYUOCKoKRKWsalgQwt48IAm6vSOrw0G6hFZ6zp5BeoAIJdMgsrlqF7ROOfJRo7AiYz2Cx5uoRUo7uXCQMb1NgZrjSYXcN0ARZXhdJMbzvPuHtGboYKt1mqjYGl2tCvnTE7A6g5UYnZ9d6tMSFprwbxoHPxsIx0lyNyg1+RwGFHWM+St7Rb70vqy5F0BaOCMlmxv5SERzSq1CnCR7ZCuJo8fnxbASw0lykvmNhb85QJsc/WFuo0RWOSZ9wmPIZvKPx+HhoIph88wg0zTnDAKjA8l20J7Qds0JDSJqQY+Nn2Qo5p4amAp4s2FgfUsXPD7bKlBgbTUsdEAnZFnNStVgxHeqHVmmdogEtva8gMNZodaIyOW7Mu1cgsZs7U2qUy2J4y8mifKrWZu1qwhJV2SaOkNHr07uNScSqjIUjHmokSgRuwmv4P7FfKOqMISjuj5r5viNTewaKWKbCoWVAmjHI83KHVLy+Ls50+v/w4gQzXPMV/B2WXqDfc4Mh7x67Atvnq1oqkNmO2D7zn6YEbXsJQGsYZectXCJsleu3qym6XY9yYsmuId+mplNDdqw8S1KeHL6FoCH2E1+tk73jBvZ3uzqrPIV2E4+6t+pyihvACPkOQnuBjgmM5LDQjMGW6PDgkM/ColB2REn8yqEek0I9K9ChNmwG1U4t7p0szgkuLWjJBPitwox1XtT1Yjv1yAruyd5zseCxxaWonjx8rKoMEXLE0VaX0S+fsr1s7rQS+PThcjD1HBOkErngwX0cUwuSeMrWR5nLSUNHL5Vo9Y5bMYxZtqMCMpqpWnTI2g5o8XF/iQMoOLBZfQBWj3t2+g0lpFcxS5pLjkAveCWYsT+E9MmksE8/xBAu1VjpJVbZv+U5P/OL5VZs6N0kdaAS/otGWWhrnGej6IXwrNIblQ0KcHgbj06vWILVB6ocaxkoKptkKLer9dTuXpc3AI2Imk9tR0AXygoZ8q/fR/ZH9qhSWJ0fzvEOhfs/FI0WMNptMoaTBJMQDQ3OpGr+ONygeZSk9Yyo9e0ZIl0zmaODKR/ajbiZeUFjnLHCGAinC84O8/RsylWUZJ3BMJK6okrGdCtO5fJ3Uw1Osy1rJky/h1BZZKktiaoO6dAaq9I3cWlinvyE3K03uuL5zZdNnXo5bvsKx4Gh29NVHhMFuzpHLvFvOYUJgBjlK1My657nxQ/fYUFffi0S3ZxnQXfxV8aYlDxXArCUoGlOlszhMVvCzi5BHcU4epnUlkhmjUt4ko+76xkwKfsuE6IzkKHgiOg/wesUky53d8Yo4pBLCe6UEMtkjRpslUprc4jY3sG8FoIXQ39XnzFiWKCniRdezl6LByg2oguSEVoQAu6nHNHVzoQ+jD5zjHuQ1heEJCG6c8arHDrU0zIDLhrUvrZxerlxZ1ygnjx+7geJJwfwQMCYhYG9St4qDFL5HqhaD1pSPsMYZp1pTdLWSvvDg9qJubtjGjIPdHTtkN+TpxvSo+7tHAlNecFL2XgafozCPWGikuM7bLtbw2Om+xhT52tlXbg4pc6DLW6Qk7G1czsbWYT9NNwIuU1FmlJpsCLXVPM9Re7cQN7K+luZlqBR/xyDWLJnGLDB00DX/z0/TDy3XOd+299CsglLyP0sU20qe29fj3Awbmm5lKP2kzMyHssGFGJ87WAUZXyxQ0x9+f3b3E+TPxIVsXaQJyqxQfGiW7InXbw+3UE1Equx31kIAFUqCLpV2ZHcdID1vFTDpqsrtRLVOuKvkevZdnNZUSaMEJkLlPB6svMb7hN1cU2DKFzwlkLd+onuaJ6zmSz3P8czgMOou8rgDaFKEO6fDHyhRoNzrOA2H6GjTslJzLrAnSNylZO5DpZ57Ti6FdyOWHWoo5XFS5pHBIWQVEU5mEqsOwh9ms+fT431nBQ4zeMGS0hzZiLoYa51dhwVLLWXszWYRWapNTxUMwp45ZKUmF9NLakXiQjBrUXZofL3a3s2aQV167MIN4rua/x+m1hGofWXPlHMv6MA0ym8tPEu1kWTFWLZmMu1kw4Oqdx/tXSqPqfh5VQA4rRLwgtLaa2jsr9IOUGg7vd41LPShql/wogrYy0LN4SgeMPCEk4LPisyM52jiyf0Znt+5ktu6oQw+uFngXuUv9fpC5cmCi05q3MCUaOIdBydle3WefK9yN0/VOtXkyZ5FByTFMm0Ty1f96V/P9vypuuBmoOX/9HTrt+Y1Sb1XgwYiEAGQKnLecUWw7JmGYb464SLk1NtzN2odgwqVg+fGkq3jIjZHlKRNfO0kcSe87+cVyuyinEKZ/VPwyXyXzMv0ObodeJEtvCpNAD8theyeRNeoUGrdLQGG2VosXTKzR+9BCn1UcUEKG6r8VK6P7CrkiqMo4dGxhPLBW900FxjSJr6fUokbcvmheH1B4a+lPqBcKeNrK1WFFNhKkVgLcSigCbl2sH6NiJ9oDpXIvg65fuIeSvvzNXg1pYXGNVelSb6Eth7W0ArKjjr2pRonaGdN2pKZZcJErjS3y9UXskY0KdSTdtsk3PU+8Y2x4gCh5Vzw1DWyLrjMUReaRy3dUHQu8TPLMOUrJgBlqjLMoDVz3ZbrcDmDReRHh1sxmy5DxFhovmYW3QN73bH8RFbQ7cyWGr/IejfL22nm7UXbdLgYni8PF4D7IvJj+GauAz3eYFvKDLXYUmgQYnBD68UkTD2irr6FCL4qx3nj5Kv5I9+ZynJ/h2WWG8tTM3J7e0RpNzjxDfiR7TFbhYmU5KDMKjk6DKxh784pkA0J1pt9jn6dUyC/E5YXnQI51GMTKZcfqRfsgqgG7zIO03dfn2N3t+/8mSIuW8BPZRwvEpZlGs3rt1Q67GvaIdFCGL3ZWHMVB9QRbor56dzML8PL+/cvErvO3trZfGu7RKFYBnMmmEyxp23rrL6IKID2QZYdAI5J63dwTz++Dz/2bKdYpnO0iVu96+728ZkQW82nfiIvJs0Ru97SVl1h4Ib8xP7G7pm4nPSEkTubnJR8Solpf0dAoZVVqdrfCDsTVDVqfE2vltYW5D5sWrw90hmoVYrGcJm7CP/aYNrjhFUndjlF7pRlok61DaZKZgYMr5Lwhnu+6uoLsNw0PC6l5QL4zp4gpfI5LYnLw1n6jLKngSdc/BuR2SKDrgSAYLkQOz+4EMCE4mnGZd7bcOJLuV+ZwrrI2167epN3h8rdtXTsEby3UaBhnadrFXdpQnXa0l5GVVUPaK2UhBUXggdiR4FaD18Vbm+lRVAqlNlPxGrLKSj/kplZsme8LB3VUaen+xnUUxKjU7UqXMV8jy5QESmt6z9oLJsLbpZ9pFXqx/cLzGdauOnDfpBRCVEj6T4lOmaBK4SF0q/vfYtbYaVtVWI4Fx2Z7Ot624lyiNKc1wQfhewHBhq4q55X7atdBfUPkD8k/bVK+8r6H73Q/4hSbIxIUl4sh3bUs9k9+HF9IsolKcG/uJ/rRegJbQjTZTw1TV976xfjSpfKoExS1PaiEZefB2gevnCnISH0efmMviUEr4VvUHM2MHP9mCDL1Rz1hWnhMlUr516FSZjAoY0J5VY56tBJqxbOgrt5Wh51vo2F8JUee6rcBnGguN8d0bcsie0MnkkHwXaD+/i9B4FmKZ7TkhWd2h0Jl7b2GH/8z3iy+kuOn2i28TT7A5bIsr6syxfhskSXgsIpriJHSc8O2/2ozSK72KkU9XErB2H3xBVfUMBL94TLPb3qPkjCz5iW3W3UM4GH5rxqcH+geMfVNQeXrhZKb5jORrDgnzEbV55htHPa+vr6+u01TC2kTFY7tWBwjZoJz54ePdSYcY2pTUo9sDX59HgfLLTjeJjHFQ7TquOnZsGBs2HXGpkZ+rUl/sCaH7k6t1YvR8C3YFz0hqA+eR82CLoPW+5NsIbGVTZpGlPHon5uUx+zDt3rLj46mNEH0BeJhirsrZin1ZZaCa3ZrUn0+TnBjPHOZvD31eyO7XiaodnKFFbc8vzAYYTdJ5NLSOUeuCCexMtuJdB8588tfO1y4Ow715WDunonyUtqg37LLokdIDiXlUwqyVMm/GZCc2rBzbV3LtvD6MkoYhuYAxYwq13LqhWj/VaGRrlZzrjs02uNK2Ux6ckZOz+f4qCKgmkf0p1cooZuPeyLLWo9n+tlYzB24lnK3ReSVB3kh2t4Q4ZREzDWda3u9Ps3W9bRdn9kTbd7HGp9bGpY9jbHtFyFNoOlf4EJZJgKRvkpMzD7dfJwXd85gse72dP1T09PD8kK7VJl19WxIHcecQS/372fTZ/uDt2iNLyfPN3+dP3h7v7u6e761/f/dXf7FCf9GQcOIr95xu037WbWJlSkCCZsRTuQ34y/qWKFhlWZQt8Pa9kzAnMbzXV76WFJKzUflpZHP/D40+N0hyLifW1YOjt1bWhLa4sQIAxYUJPlCjVPPY52VaQ5SRbpDx7wDQbxhL1WwzsXDd6qDNvrLFUIE1Xq+pr6SnZbiyYxfUdBX82xkIPXpWA3j6sjjQA/V42vjqXN/sUaNSVlbTL+Qq16zIhr/koM/yvO2XOqpzRo7XJ9kxmX4CSwN8JyT8Zao4bh5E6Zdt/VcgkLwfOlbZ2lcmHNtwYK1Kag3GXdI6G21DJhWpXxLs6LwGe2JcCmIGfdyiC3qtSHfYhr39RDe+idTNzJ5mOYJxQLjpdT3BshXfPHpaF9MqjHE5rpYCUjnPkZvL5SnVKffqiq3rXnOdXZhCGm2TGXs1QDRzZEwOcxW/015tn4nXsnTS2N+NmizJqAC6YfeurEdWfVRd5NWg9f8WkEM57/5tDSl+9H3Ra6dsS4YyReHVf6InpiSt7p6jy3GI4pETdTlEEYuGdb1HA1m92/rSr3zYEdzJXl9QsOSfxnMdLoQk9BbOe41nkvm4j7jdBUUb9VcPd8mH8n6qS0y5+crvpzL7v3eC02I/jvEvV25kNvuu9P+ruKxa8KjWOSDcwoxHv7+qV1WuUnHbg8VZ1+rcQy1NPp65GTq1aYy2jTk2bSuD06L2iz6qVjV0/3s7e1NWtJWiiv7+9Ht84TL4TanF7AuFR32G8Pt0BIXlS6uAiPCcmPhORe5aaawr0teKtKEobw1ipHeHi9ge/Xr9jPDbyrH/AHjbfAIC2NVau+J3pEaYBXHsQDb3c+vX7VQVXXrJagb8PIol5cYp+jKSNItBuln5u5HLamm9xqtljwNHRlKJ0d3j0YFubeif7Yu20CvhFMbm/vHp7ceyHv+nNpofJDud6rkQqV52RoQ6YXmFst7wh+/XkEH3/9MHmaOE/88/SBvve2NFsmL7rq1RSOtd92OfsKqRhVoVs9Njeu8uiM4laVPd1tzzYxOmVZFvcnrynlFYyig7HANQq4UprnXDLxtip9dhtDAjn9CDNjvwjCjHJF6T17C2a9DXII57pILygx7gUTpIf16+QHtR6mnEsc3uw2+P0ElyTBpkWyEKxzrPVMEubcrph5Drlc7TiUEGpDFufp9gHctDfw7ofZ/34c/ePf6L/x5Pbn0T9++HH6cfT9D4+zpzjky7UJe67dwPRh/f2I/v1Xl+Ld/Ti5fvP/AQAA//9d8O3V" } From bf971f3919f73b1885abffc2683cbcd99af1822b Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Tue, 6 Oct 2020 08:09:24 -0700 Subject: [PATCH 147/216] docs: update generate_fields_docs.py (#21359) --- auditbeat/docs/fields.asciidoc | 9 +++++++- filebeat/docs/fields.asciidoc | 9 +++++++- heartbeat/docs/fields.asciidoc | 9 +++++++- journalbeat/docs/fields.asciidoc | 9 +++++++- libbeat/scripts/generate_fields_docs.py | 26 ++++++++++++++++++++++-- metricbeat/docs/fields.asciidoc | 9 +++++++- packetbeat/docs/fields.asciidoc | 9 +++++++- winlogbeat/docs/fields.asciidoc | 9 +++++++- x-pack/functionbeat/docs/fields.asciidoc | 9 +++++++- 9 files changed, 88 insertions(+), 10 deletions(-) diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc index 7ba194357ee..cb95eb4da12 100644 --- a/auditbeat/docs/fields.asciidoc +++ b/auditbeat/docs/fields.asciidoc @@ -2914,8 +2914,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index c294aef0f79..b4f6a158ad7 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -44228,8 +44228,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/heartbeat/docs/fields.asciidoc b/heartbeat/docs/fields.asciidoc index 20e797faf1a..e80238bca4c 100644 --- a/heartbeat/docs/fields.asciidoc +++ b/heartbeat/docs/fields.asciidoc @@ -361,8 +361,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/journalbeat/docs/fields.asciidoc b/journalbeat/docs/fields.asciidoc index bb7627508a4..57f97a4162e 100644 --- a/journalbeat/docs/fields.asciidoc +++ b/journalbeat/docs/fields.asciidoc @@ -914,8 +914,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/libbeat/scripts/generate_fields_docs.py b/libbeat/scripts/generate_fields_docs.py index 89a80d83d27..8e0a7c77c32 100644 --- a/libbeat/scripts/generate_fields_docs.py +++ b/libbeat/scripts/generate_fields_docs.py @@ -1,6 +1,7 @@ import argparse from collections import OrderedDict import os +import re import yaml @@ -20,11 +21,24 @@ def document_fields(output, section, sections, path): output.write("[float]\n") if "description" in section: - if "anchor" in section: + if "anchor" in section and section["name"] == "ECS": output.write("== {} fields\n\n".format(section["name"])) + output.write(""" +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. +""") + elif "anchor" in section: + output.write("== {} fields\n\n".format(section["name"])) + output.write("{}\n\n".format(section["description"])) else: output.write("=== {}\n\n".format(section["name"])) - output.write("{}\n\n".format(section["description"])) + output.write("{}\n\n".format(section["description"])) if "fields" not in section or not section["fields"]: return @@ -70,6 +84,14 @@ def document_field(output, field, field_path): if "path" in field: output.write("alias to: {}\n\n".format(field["path"])) + # For Apm-Server docs only + # Assign an ECS badge for fields containing "overwrite" + if beat_title == "Apm-Server": + if "overwrite" in field: + # And it's not a Kubernetes field + if re.match("^kubernetes.*", field["field_path"]) is None: + output.write("{yes-icon} {ecs-ref}[ECS] field.\n\n") + if "index" in field: if not field["index"]: output.write("{}\n\n".format("Field is not indexed.")) diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index 26e83c19050..dc7c0c45d3e 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -9371,8 +9371,15 @@ Stats collected from Dropwizard. [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/packetbeat/docs/fields.asciidoc b/packetbeat/docs/fields.asciidoc index 14ed56f1578..22d2b406bf9 100644 --- a/packetbeat/docs/fields.asciidoc +++ b/packetbeat/docs/fields.asciidoc @@ -2128,8 +2128,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/winlogbeat/docs/fields.asciidoc b/winlogbeat/docs/fields.asciidoc index d0b1a0a1473..cc84c0fad8a 100644 --- a/winlogbeat/docs/fields.asciidoc +++ b/winlogbeat/docs/fields.asciidoc @@ -220,8 +220,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + diff --git a/x-pack/functionbeat/docs/fields.asciidoc b/x-pack/functionbeat/docs/fields.asciidoc index 73c93e39a61..7f4aa3d5aaf 100644 --- a/x-pack/functionbeat/docs/fields.asciidoc +++ b/x-pack/functionbeat/docs/fields.asciidoc @@ -216,8 +216,15 @@ type: object [[exported-fields-ecs]] == ECS fields -ECS Fields. +This section defines Elastic Common Schema (ECS) fields—a common set of fields +to be used when storing event data in {es}. + +This is an exhaustive list, and fields listed here are not necessarily used by {beatname_uc}. +The goal of ECS is to enable and encourage users of {es} to normalize their event data, +so that they can better analyze, visualize, and correlate the data represented in their events. + +See the {ecs-ref}[ECS reference] for more information. *`@timestamp`*:: + From 1ce876d1dcf1ada555bbbba11382b63ec8cda95d Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Tue, 6 Oct 2020 16:27:07 +0100 Subject: [PATCH 148/216] [CI] Setup git config globally (#21562) --- Jenkinsfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 08853ab1453..df75ad2ccd1 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -265,8 +265,8 @@ def withBeatsEnv(Map args = [:], Closure body) { // See https://github.com/elastic/beats/issues/17787. sh(label: 'check git config', script: ''' if [ -z "$(git config --get user.email)" ]; then - git config user.email "beatsmachine@users.noreply.github.com" - git config user.name "beatsmachine" + git config --global user.email "beatsmachine@users.noreply.github.com" + git config --global user.name "beatsmachine" fi''') } try { From d6ee968b44dbb9413c8472ca1712914d192cbc00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20P=C3=A9rez-Aradros=20Herce?= Date: Tue, 6 Oct 2020 18:36:24 +0200 Subject: [PATCH 149/216] Add kubernetes composable inputs provider (#21480) * Add kubernetes composable inputs provider --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + x-pack/elastic-agent/pkg/agent/cmd/include.go | 1 + .../composable/providers/kubernetes/config.go | 31 +++ .../providers/kubernetes/kubernetes.go | 215 ++++++++++++++++++ 4 files changed, 248 insertions(+) create mode 100644 x-pack/elastic-agent/pkg/composable/providers/kubernetes/config.go create mode 100644 x-pack/elastic-agent/pkg/composable/providers/kubernetes/kubernetes.go diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 639b1dbad17..897b64c517e 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -28,6 +28,7 @@ - Add support for EQL based condition on inputs {pull}20994[20994] - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] - Add `install` and `uninstall` subcommands {pull}21206[21206] +- Add `kubernetes` composable dynamic provider. {pull}21480[21480] - Send updating state {pull}21461[21461] - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] diff --git a/x-pack/elastic-agent/pkg/agent/cmd/include.go b/x-pack/elastic-agent/pkg/agent/cmd/include.go index 87506b88415..b955c85418f 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/include.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/include.go @@ -10,6 +10,7 @@ import ( _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/docker" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/env" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/host" + _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/kubernetes" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/local" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/localdynamic" _ "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable/providers/path" diff --git a/x-pack/elastic-agent/pkg/composable/providers/kubernetes/config.go b/x-pack/elastic-agent/pkg/composable/providers/kubernetes/config.go new file mode 100644 index 00000000000..200bedbe878 --- /dev/null +++ b/x-pack/elastic-agent/pkg/composable/providers/kubernetes/config.go @@ -0,0 +1,31 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// TODO review the need for this +// +build linux darwin windows + +package kubernetes + +import ( + "time" +) + +// Config for kubernetes provider +type Config struct { + KubeConfig string `config:"kube_config"` + SyncPeriod time.Duration `config:"sync_period"` + CleanupTimeout time.Duration `config:"cleanup_timeout" validate:"positive"` + + // Needed when resource is a pod + Node string `config:"node"` + + // Scope of the provider (cluster or node) + Scope string `config:"scope"` +} + +// InitDefaults initializes the default values for the config. +func (c *Config) InitDefaults() { + c.SyncPeriod = 10 * time.Minute + c.CleanupTimeout = 60 * time.Second +} diff --git a/x-pack/elastic-agent/pkg/composable/providers/kubernetes/kubernetes.go b/x-pack/elastic-agent/pkg/composable/providers/kubernetes/kubernetes.go new file mode 100644 index 00000000000..c777c8a05ce --- /dev/null +++ b/x-pack/elastic-agent/pkg/composable/providers/kubernetes/kubernetes.go @@ -0,0 +1,215 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package kubernetes + +import ( + "fmt" + "time" + + "github.com/elastic/beats/v7/libbeat/common/kubernetes" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" +) + +func init() { + composable.Providers.AddDynamicProvider("kubernetes", DynamicProviderBuilder) +} + +type dynamicProvider struct { + logger *logger.Logger + config *Config +} + +type eventWatcher struct { + logger *logger.Logger + cleanupTimeout time.Duration + comm composable.DynamicProviderComm +} + +// DynamicProviderBuilder builds the dynamic provider. +func DynamicProviderBuilder(logger *logger.Logger, c *config.Config) (composable.DynamicProvider, error) { + var cfg Config + if c == nil { + c = config.New() + } + err := c.Unpack(&cfg) + if err != nil { + return nil, errors.New(err, "failed to unpack configuration") + } + return &dynamicProvider{logger, &cfg}, nil +} + +// Run runs the environment context provider. +func (p *dynamicProvider) Run(comm composable.DynamicProviderComm) error { + client, err := kubernetes.GetKubernetesClient(p.config.KubeConfig) + if err != nil { + // info only; return nil (do nothing) + p.logger.Debugf("Kubernetes provider skipped, unable to connect: %s", err) + return nil + } + + // Ensure that node is set correctly whenever the scope is set to "node". Make sure that node is empty + // when cluster scope is enforced. + if p.config.Scope == "node" { + p.config.Node = kubernetes.DiscoverKubernetesNode(p.logger, p.config.Node, kubernetes.IsInCluster(p.config.KubeConfig), client) + } else { + p.config.Node = "" + } + p.logger.Infof("Kubernetes provider started with %s scope", p.config.Scope) + p.logger.Debugf("Initializing Kubernetes watcher using node: %v", p.config.Node) + + watcher, err := kubernetes.NewWatcher(client, &kubernetes.Pod{}, kubernetes.WatchOptions{ + SyncTimeout: p.config.SyncPeriod, + Node: p.config.Node, + //Namespace: p.config.Namespace, + }, nil) + if err != nil { + return errors.New(err, "couldn't create kubernetes watcher") + } + + watcher.AddEventHandler(&eventWatcher{p.logger, p.config.CleanupTimeout, comm}) + + err = watcher.Start() + if err != nil { + return errors.New(err, "couldn't start kubernetes watcher") + } + + return nil +} + +func (p *eventWatcher) emitRunning(pod *kubernetes.Pod) { + mapping := map[string]interface{}{ + "namespace": pod.GetNamespace(), + "pod": map[string]interface{}{ + "uid": string(pod.GetUID()), + "name": pod.GetName(), + "labels": pod.GetLabels(), + "ip": pod.Status.PodIP, + }, + } + + processors := []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": mapping, + "target": "kubernetes", + }, + }, + } + + // Emit the pod + // We emit Pod + containers to ensure that configs matching Pod only + // get Pod metadata (not specific to any container) + p.comm.AddOrUpdate(string(pod.GetUID()), mapping, processors) + + // Emit all containers in the pod + p.emitContainers(pod, pod.Spec.Containers, pod.Status.ContainerStatuses) + + // TODO deal with init containers stopping after initialization + p.emitContainers(pod, pod.Spec.InitContainers, pod.Status.InitContainerStatuses) +} + +func (p *eventWatcher) emitContainers(pod *kubernetes.Pod, containers []kubernetes.Container, containerstatuses []kubernetes.PodContainerStatus) { + // Collect all runtimes from status information. + containerIDs := map[string]string{} + runtimes := map[string]string{} + for _, c := range containerstatuses { + cid, runtime := kubernetes.ContainerIDWithRuntime(c) + containerIDs[c.Name] = cid + runtimes[c.Name] = runtime + } + + for _, c := range containers { + // If it doesn't have an ID, container doesn't exist in + // the runtime, emit only an event if we are stopping, so + // we are sure of cleaning up configurations. + cid := containerIDs[c.Name] + if cid == "" { + continue + } + + // ID is the combination of pod UID + container name + eventID := fmt.Sprintf("%s.%s", pod.GetObjectMeta().GetUID(), c.Name) + + mapping := map[string]interface{}{ + "namespace": pod.GetNamespace(), + "pod": map[string]interface{}{ + "uid": string(pod.GetUID()), + "name": pod.GetName(), + "labels": pod.GetLabels(), + "ip": pod.Status.PodIP, + }, + "container": map[string]interface{}{ + "id": cid, + "name": c.Name, + "image": c.Image, + "runtime": runtimes[c.Name], + }, + } + + processors := []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": mapping, + "target": "kubernetes", + }, + }, + } + + // Emit the container + p.comm.AddOrUpdate(eventID, mapping, processors) + } +} + +func (p *eventWatcher) emitStopped(pod *kubernetes.Pod) { + p.comm.Remove(string(pod.GetUID())) + + for _, c := range pod.Spec.Containers { + // ID is the combination of pod UID + container name + eventID := fmt.Sprintf("%s.%s", pod.GetObjectMeta().GetUID(), c.Name) + p.comm.Remove(eventID) + } + + for _, c := range pod.Spec.InitContainers { + // ID is the combination of pod UID + container name + eventID := fmt.Sprintf("%s.%s", pod.GetObjectMeta().GetUID(), c.Name) + p.comm.Remove(eventID) + } +} + +// OnAdd ensures processing of pod objects that are newly added +func (p *eventWatcher) OnAdd(obj interface{}) { + p.logger.Debugf("pod add: %+v", obj) + p.emitRunning(obj.(*kubernetes.Pod)) +} + +// OnUpdate emits events for a given pod depending on the state of the pod, +// if it is terminating, a stop event is scheduled, if not, a stop and a start +// events are sent sequentially to recreate the resources assotiated to the pod. +func (p *eventWatcher) OnUpdate(obj interface{}) { + pod := obj.(*kubernetes.Pod) + + p.logger.Debugf("pod update for pod: %+v, status: %+v", pod.Name, pod.Status.Phase) + switch pod.Status.Phase { + case kubernetes.PodSucceeded, kubernetes.PodFailed: + time.AfterFunc(p.cleanupTimeout, func() { p.emitStopped(pod) }) + return + case kubernetes.PodPending: + p.logger.Debugf("pod update (pending): don't know what to do with this pod yet, skipping for now: %+v", obj) + return + } + + p.logger.Debugf("pod update: %+v", obj) + p.emitRunning(pod) +} + +// OnDelete stops pod objects that are deleted +func (p *eventWatcher) OnDelete(obj interface{}) { + p.logger.Debugf("pod delete: %+v", obj) + pod := obj.(*kubernetes.Pod) + time.AfterFunc(p.cleanupTimeout, func() { p.emitStopped(pod) }) +} From 306332f8d6bb924c9b9fee834079c788cd6ec2eb Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 6 Oct 2020 19:20:25 +0200 Subject: [PATCH 150/216] [Ingest Manager] Improved verify experience (#21573) [Ingest Manager] Improved verify experience (#21573) --- .../pkg/agent/application/emitter.go | 13 ++++++++---- .../application/upgrade/step_download.go | 2 +- .../pkg/agent/operation/common_test.go | 2 +- .../pkg/agent/operation/operation_verify.go | 2 +- .../artifact/download/composed/verifier.go | 7 ++++--- .../pkg/artifact/download/fs/verifier.go | 17 +++++++++------- .../pkg/artifact/download/fs/verifier_test.go | 6 +++--- .../artifact/download/http/elastic_test.go | 2 +- .../pkg/artifact/download/http/verifier.go | 20 ++++++++++--------- .../pkg/artifact/download/verifier.go | 2 +- .../pkg/core/plugin/process/app.go | 2 +- .../pkg/core/plugin/process/start.go | 2 +- 12 files changed, 44 insertions(+), 33 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/emitter.go b/x-pack/elastic-agent/pkg/agent/application/emitter.go index fc103366826..3bd06043c30 100644 --- a/x-pack/elastic-agent/pkg/agent/application/emitter.go +++ b/x-pack/elastic-agent/pkg/agent/application/emitter.go @@ -44,10 +44,11 @@ type emitterController struct { reloadables []reloadable // state - lock sync.RWMutex - config *config.Config - ast *transpiler.AST - vars []*transpiler.Vars + lock sync.RWMutex + updateLock sync.Mutex + config *config.Config + ast *transpiler.AST + vars []*transpiler.Vars } func (e *emitterController) Update(c *config.Config) error { @@ -93,6 +94,10 @@ func (e *emitterController) Set(vars []*transpiler.Vars) { } func (e *emitterController) update() error { + // locking whole update because it can be called concurrently via Set and Update method + e.updateLock.Lock() + defer e.updateLock.Unlock() + e.lock.RLock() cfg := e.config rawAst := e.ast diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go index cf3a3656724..3aea96da0ab 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -38,7 +38,7 @@ func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI stri return "", errors.New(err, "failed upgrade of agent binary") } - matches, err := verifier.Verify(agentName, version, agentArtifactName) + matches, err := verifier.Verify(agentName, version, agentArtifactName, true) if err != nil { return "", errors.New(err, "failed verification of agent binary") } diff --git a/x-pack/elastic-agent/pkg/agent/operation/common_test.go b/x-pack/elastic-agent/pkg/agent/operation/common_test.go index 6e9b042fe92..e9d40bece87 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/common_test.go +++ b/x-pack/elastic-agent/pkg/agent/operation/common_test.go @@ -143,7 +143,7 @@ var _ download.Downloader = &DummyDownloader{} type DummyVerifier struct{} -func (*DummyVerifier) Verify(p, v, _ string) (bool, error) { +func (*DummyVerifier) Verify(p, v, _ string, _ bool) (bool, error) { return true, nil } diff --git a/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go b/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go index 97cf906cace..7626d339e57 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go +++ b/x-pack/elastic-agent/pkg/agent/operation/operation_verify.go @@ -66,7 +66,7 @@ func (o *operationVerify) Run(_ context.Context, application Application) (err e } }() - isVerified, err := o.verifier.Verify(o.program.BinaryName(), o.program.Version(), o.program.ArtifactName()) + isVerified, err := o.verifier.Verify(o.program.BinaryName(), o.program.Version(), o.program.ArtifactName(), true) if err != nil { return errors.New(err, fmt.Sprintf("operation '%s' failed to verify %s.%s", o.Name(), o.program.BinaryName(), o.program.Version()), diff --git a/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go index 9d6c4477733..663484130f4 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/composed/verifier.go @@ -29,11 +29,12 @@ func NewVerifier(verifiers ...download.Verifier) *Verifier { } // Verify checks the package from configured source. -func (e *Verifier) Verify(programName, version, artifactName string) (bool, error) { +func (e *Verifier) Verify(programName, version, artifactName string, removeOnFailure bool) (bool, error) { var err error - for _, v := range e.vv { - b, e := v.Verify(programName, version, artifactName) + for i, v := range e.vv { + isLast := (i + 1) == len(e.vv) + b, e := v.Verify(programName, version, artifactName, isLast && removeOnFailure) if e == nil { return b, nil } diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go index 09462ef3f23..56652d4f69c 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go @@ -51,20 +51,23 @@ func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Veri // Verify checks downloaded package on preconfigured // location agains a key stored on elastic.co website. -func (v *Verifier) Verify(programName, version, artifactName string) (bool, error) { +func (v *Verifier) Verify(programName, version, artifactName string, removeOnFailure bool) (isMatch bool, err error) { filename, err := artifact.GetArtifactName(programName, version, v.config.OS(), v.config.Arch()) if err != nil { return false, errors.New(err, "retrieving package name") } fullPath := filepath.Join(v.config.TargetDirectory, filename) + defer func() { + if removeOnFailure && (!isMatch || err != nil) { + // remove bits so they can be redownloaded + os.Remove(fullPath) + os.Remove(fullPath + ".sha512") + os.Remove(fullPath + ".asc") + } + }() - isMatch, err := v.verifyHash(filename, fullPath) - if !isMatch || err != nil { - // remove bits so they can be redownloaded - os.Remove(fullPath) - os.Remove(fullPath + ".sha512") - os.Remove(fullPath + ".asc") + if isMatch, err := v.verifyHash(filename, fullPath); !isMatch || err != nil { return isMatch, err } diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go index 975d9ecb14d..a79f35bdd6f 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go @@ -65,7 +65,7 @@ func TestFetchVerify(t *testing.T) { // first download verify should fail: // download skipped, as invalid package is prepared upfront // verify fails and cleans download - matches, err := verifier.Verify(programName, version, artifactName) + matches, err := verifier.Verify(programName, version, artifactName, true) assert.NoError(t, err) assert.Equal(t, false, matches) @@ -88,7 +88,7 @@ func TestFetchVerify(t *testing.T) { _, err = os.Stat(hashTargetFilePath) assert.NoError(t, err) - matches, err = verifier.Verify(programName, version, artifactName) + matches, err = verifier.Verify(programName, version, artifactName, true) assert.NoError(t, err) assert.Equal(t, true, matches) } @@ -162,7 +162,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - isOk, err := testVerifier.Verify(beatName, version, artifactName) + isOk, err := testVerifier.Verify(beatName, version, artifactName, true) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go index fec1d991c88..0ff4dfd2b93 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go @@ -110,7 +110,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - isOk, err := testVerifier.Verify(beatName, version, artifactName) + isOk, err := testVerifier.Verify(beatName, version, artifactName, false) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go index c0dfef9b30e..b5b5e628b4a 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go @@ -59,9 +59,7 @@ func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Veri // Verify checks downloaded package on preconfigured // location agains a key stored on elastic.co website. -func (v *Verifier) Verify(programName, version, artifactName string) (bool, error) { - // TODO: think about verifying asc for prepacked beats - +func (v *Verifier) Verify(programName, version, artifactName string, removeOnFailure bool) (isMatch bool, err error) { filename, err := artifact.GetArtifactName(programName, version, v.config.OS(), v.config.Arch()) if err != nil { return false, errors.New(err, "retrieving package name") @@ -72,12 +70,16 @@ func (v *Verifier) Verify(programName, version, artifactName string) (bool, erro return false, errors.New(err, "retrieving package path") } - isMatch, err := v.verifyHash(filename, fullPath) - if !isMatch || err != nil { - // remove bits so they can be redownloaded - os.Remove(fullPath) - os.Remove(fullPath + ".sha512") - os.Remove(fullPath + ".asc") + defer func() { + if removeOnFailure && (!isMatch || err != nil) { + // remove bits so they can be redownloaded + os.Remove(fullPath) + os.Remove(fullPath + ".sha512") + os.Remove(fullPath + ".asc") + } + }() + + if isMatch, err := v.verifyHash(filename, fullPath); !isMatch || err != nil { return isMatch, err } diff --git a/x-pack/elastic-agent/pkg/artifact/download/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/verifier.go index 491979514ea..d7b2bc7a415 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/verifier.go @@ -6,5 +6,5 @@ package download // Verifier is an interface verifying GPG key of a downloaded artifact type Verifier interface { - Verify(programName, version, artifactName string) (bool, error) + Verify(programName, version, artifactName string, removeOnFailure bool) (bool, error) } diff --git a/x-pack/elastic-agent/pkg/core/plugin/process/app.go b/x-pack/elastic-agent/pkg/core/plugin/process/app.go index 5f9cf6efb25..8732af24f68 100644 --- a/x-pack/elastic-agent/pkg/core/plugin/process/app.go +++ b/x-pack/elastic-agent/pkg/core/plugin/process/app.go @@ -117,7 +117,7 @@ func (a *Application) Name() string { // Started returns true if the application is started. func (a *Application) Started() bool { - return a.state.Status != state.Stopped + return a.state.Status != state.Stopped && a.state.Status != state.Crashed && a.state.Status != state.Failed } // Stop stops the current application. diff --git a/x-pack/elastic-agent/pkg/core/plugin/process/start.go b/x-pack/elastic-agent/pkg/core/plugin/process/start.go index c5f1ffb3842..bc19910e53c 100644 --- a/x-pack/elastic-agent/pkg/core/plugin/process/start.go +++ b/x-pack/elastic-agent/pkg/core/plugin/process/start.go @@ -39,7 +39,7 @@ func (a *Application) start(ctx context.Context, t app.Taggable, cfg map[string] }() // already started if not stopped or crashed - if a.state.Status != state.Stopped && a.state.Status != state.Crashed && a.state.Status != state.Failed { + if a.Started() { return nil } From 0b9213c5d27d2b1e6141b00285bda419c82dcd41 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 6 Oct 2020 19:25:54 +0200 Subject: [PATCH 151/216] [Ingest Manager] Use new form of fleet API paths (#21478) [Ingest Manager] Use new form of fleet API paths (#21478) --- .../docker/docker-entrypoint.elastic-agent.tmpl | 8 ++++---- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/enroll_cmd_test.go | 10 +++++----- x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go | 2 +- x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go | 2 +- x-pack/elastic-agent/pkg/fleetapi/checkin_cmd.go | 2 +- .../elastic-agent/pkg/fleetapi/checkin_cmd_test.go | 12 ++++++------ x-pack/elastic-agent/pkg/fleetapi/enroll_cmd.go | 4 ++-- x-pack/elastic-agent/pkg/fleetapi/enroll_cmd_test.go | 4 ++-- 9 files changed, 23 insertions(+), 22 deletions(-) diff --git a/dev-tools/packaging/templates/docker/docker-entrypoint.elastic-agent.tmpl b/dev-tools/packaging/templates/docker/docker-entrypoint.elastic-agent.tmpl index 91f043d2799..d4c8d6e4645 100644 --- a/dev-tools/packaging/templates/docker/docker-entrypoint.elastic-agent.tmpl +++ b/dev-tools/packaging/templates/docker/docker-entrypoint.elastic-agent.tmpl @@ -13,8 +13,8 @@ set -eo pipefail # KIBANA_USERNAME - username for accessing kibana API [elastic] function setup(){ - curl -X POST ${KIBANA_HOST:-http://localhost:5601}/api/ingest_manager/setup -H 'kbn-xsrf: true' -u ${KIBANA_USERNAME:-elastic}:${KIBANA_PASSWORD:-changeme} - curl -X POST ${KIBANA_HOST:-http://localhost:5601}/api/ingest_manager/fleet/setup \ + curl -X POST ${KIBANA_HOST:-http://localhost:5601}/api/fleet/setup -H 'kbn-xsrf: true' -u ${KIBANA_USERNAME:-elastic}:${KIBANA_PASSWORD:-changeme} + curl -X POST ${KIBANA_HOST:-http://localhost:5601}/api/fleet/agents/setup \ -H 'Content-Type: application/json' \ -H 'kbn-xsrf: true' \ -u ${KIBANA_USERNAME:-elastic}:${KIBANA_PASSWORD:-changeme} @@ -27,7 +27,7 @@ function enroll(){ if [[ -n "${FLEET_ENROLLMENT_TOKEN}" ]]; then apikey="${FLEET_ENROLLMENT_TOKEN}" else - enrollResp=$(curl ${KIBANA_HOST:-http://localhost:5601}/api/ingest_manager/fleet/enrollment-api-keys \ + enrollResp=$(curl ${KIBANA_HOST:-http://localhost:5601}/api/fleet/enrollment-api-keys \ -H 'Content-Type: application/json' \ -H 'kbn-xsrf: true' \ -u ${KIBANA_USERNAME:-elastic}:${KIBANA_PASSWORD:-changeme} ) @@ -40,7 +40,7 @@ function enroll(){ local apikeyId=$(echo $enrollResp | jq -r '.list[0].id') echo $apikeyId - enrollResp=$(curl ${KIBANA_HOST:-http://localhost:5601}/api/ingest_manager/fleet/enrollment-api-keys/$apikeyId \ + enrollResp=$(curl ${KIBANA_HOST:-http://localhost:5601}/api/fleet/enrollment-api-keys/$apikeyId \ -H 'Content-Type: application/json' \ -H 'kbn-xsrf: true' \ -u ${KIBANA_USERNAME:-elastic}:${KIBANA_PASSWORD:-changeme} ) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 897b64c517e..a0cd6f6291e 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -28,6 +28,7 @@ - Add support for EQL based condition on inputs {pull}20994[20994] - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] - Add `install` and `uninstall` subcommands {pull}21206[21206] +- Use new form of fleet API paths {pull}21478[21478] - Add `kubernetes` composable dynamic provider. {pull}21480[21480] - Send updating state {pull}21461[21461] - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] diff --git a/x-pack/elastic-agent/pkg/agent/application/enroll_cmd_test.go b/x-pack/elastic-agent/pkg/agent/application/enroll_cmd_test.go index beab1b253d6..080b5efcb69 100644 --- a/x-pack/elastic-agent/pkg/agent/application/enroll_cmd_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/enroll_cmd_test.go @@ -49,7 +49,7 @@ func TestEnroll(t *testing.T) { t.Run("fail to save is propagated", withTLSServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) w.Write([]byte(` { @@ -102,7 +102,7 @@ func TestEnroll(t *testing.T) { t.Run("successfully enroll with TLS and save access api key in the store", withTLSServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) w.Write([]byte(` { @@ -163,7 +163,7 @@ func TestEnroll(t *testing.T) { t.Run("successfully enroll when a slash is defined at the end of host", withServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) w.Write([]byte(` { @@ -223,7 +223,7 @@ func TestEnroll(t *testing.T) { t.Run("successfully enroll without TLS and save access api key in the store", withServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) w.Write([]byte(` { @@ -283,7 +283,7 @@ func TestEnroll(t *testing.T) { t.Run("fail to enroll without TLS", withServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusInternalServerError) w.Write([]byte(` { diff --git a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go index ac568c884d1..5c197289ed9 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go +++ b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go @@ -14,7 +14,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" ) -const ackPath = "/api/ingest_manager/fleet/agents/%s/acks" +const ackPath = "/api/fleet/agents/%s/acks" // AckEvent is an event sent in an ACK request. type AckEvent struct { diff --git a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go index 75940e928b7..1f1bfdb21eb 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go +++ b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go @@ -22,7 +22,7 @@ func TestAck(t *testing.T) { func(t *testing.T) *http.ServeMux { raw := `{"action": "ack"}` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/acks", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/acks", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) diff --git a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd.go b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd.go index 58c80b0adf1..9758fd4236c 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd.go +++ b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd.go @@ -17,7 +17,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" ) -const checkingPath = "/api/ingest_manager/fleet/agents/%s/checkin" +const checkingPath = "/api/fleet/agents/%s/checkin" // CheckinRequest consists of multiple events reported to fleet ui. type CheckinRequest struct { diff --git a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go index af8b4da81ea..3e88ed29cd1 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go +++ b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go @@ -34,7 +34,7 @@ func TestCheckin(t *testing.T) { } ` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusInternalServerError) fmt.Fprintf(w, raw) @@ -83,7 +83,7 @@ func TestCheckin(t *testing.T) { } ` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) fmt.Fprintf(w, raw) @@ -144,7 +144,7 @@ func TestCheckin(t *testing.T) { } ` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) fmt.Fprintf(w, raw) @@ -176,7 +176,7 @@ func TestCheckin(t *testing.T) { func(t *testing.T) *http.ServeMux { raw := `{ "actions": [] }` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) fmt.Fprintf(w, raw) @@ -199,7 +199,7 @@ func TestCheckin(t *testing.T) { func(t *testing.T) *http.ServeMux { raw := `{"actions": []}` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { type Request struct { Metadata *info.ECSMeta `json:"local_metadata"` @@ -233,7 +233,7 @@ func TestCheckin(t *testing.T) { func(t *testing.T) *http.ServeMux { raw := `{"actions": []}` mux := http.NewServeMux() - path := fmt.Sprintf("/api/ingest_manager/fleet/agents/%s/checkin", agentInfo.AgentID()) + path := fmt.Sprintf("/api/fleet/agents/%s/checkin", agentInfo.AgentID()) mux.HandleFunc(path, authHandler(func(w http.ResponseWriter, r *http.Request) { type Request struct { Metadata *info.ECSMeta `json:"local_metadata"` diff --git a/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd.go b/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd.go index 3e6336fbc81..29168be0ae4 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd.go +++ b/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd.go @@ -71,7 +71,7 @@ func (p EnrollType) MarshalJSON() ([]byte, error) { // EnrollRequest is the data required to enroll the elastic-agent into Fleet. // // Example: -// POST /api/ingest_manager/fleet/agents/enroll +// POST /api/fleet/agents/enroll // { // "type": "PERMANENT", // "metadata": { @@ -168,7 +168,7 @@ type EnrollCmd struct { // Execute enroll the Agent in the Fleet. func (e *EnrollCmd) Execute(ctx context.Context, r *EnrollRequest) (*EnrollResponse, error) { - const p = "/api/ingest_manager/fleet/agents/enroll" + const p = "/api/fleet/agents/enroll" const key = "Authorization" const prefix = "ApiKey " diff --git a/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd_test.go b/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd_test.go index 6533ad6643e..29bbf7e607e 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd_test.go +++ b/x-pack/elastic-agent/pkg/fleetapi/enroll_cmd_test.go @@ -23,7 +23,7 @@ func TestEnroll(t *testing.T) { t.Run("Successful enroll", withServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) w.Header().Set("Content-Type", "application/json") @@ -92,7 +92,7 @@ func TestEnroll(t *testing.T) { t.Run("Raise back any server errors", withServer( func(t *testing.T) *http.ServeMux { mux := http.NewServeMux() - mux.HandleFunc("/api/ingest_manager/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { + mux.HandleFunc("/api/fleet/agents/enroll", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusInternalServerError) w.Header().Set("Content-Type", "application/json") w.Write([]byte(`{"statusCode": 500, "error":"Something is really bad here"}`)) From 31cf0acee9666e492d4e98f5aafef6b9989e2a6e Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 6 Oct 2020 20:30:22 +0200 Subject: [PATCH 152/216] [Filebeat][S3 Input] Add support for FIPS endpoints (#21585) * adding fips support for s3 input --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc | 5 +++++ x-pack/filebeat/input/s3/config.go | 2 ++ x-pack/filebeat/input/s3/input.go | 9 ++++++++- 4 files changed, 16 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 99daa875a00..6d22c4c1bf9 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -612,6 +612,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - New Cisco Umbrella dataset {pull}21504[21504] - New juniper.srx dataset for Juniper SRX logs. {pull}20017[20017] - Adding support for Microsoft 365 Defender (Microsoft Threat Protection) {pull}21446[21446] +- Adding support for FIPS in s3 input {pull}21446[21446] *Heartbeat* diff --git a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc index 8891e38fcc4..5cbe4685cb8 100644 --- a/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-aws-s3.asciidoc @@ -42,6 +42,11 @@ The `s3` input supports the following configuration options plus the URL of the AWS SQS queue that messages will be received from. Required. +[float] +==== `fips_enabled` + +Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. For example: `s3-fips.us-gov-east-1.amazonaws.com`. + [float] ==== `visibility_timeout` diff --git a/x-pack/filebeat/input/s3/config.go b/x-pack/filebeat/input/s3/config.go index 5f37a436d12..cc3c5318289 100644 --- a/x-pack/filebeat/input/s3/config.go +++ b/x-pack/filebeat/input/s3/config.go @@ -15,6 +15,7 @@ import ( type config struct { QueueURL string `config:"queue_url" validate:"nonzero,required"` VisibilityTimeout time.Duration `config:"visibility_timeout"` + FipsEnabled bool `config:"fips_enabled"` AwsConfig awscommon.ConfigAWS `config:",inline"` ExpandEventListFromField string `config:"expand_event_list_from_field"` APITimeout time.Duration `config:"api_timeout"` @@ -32,6 +33,7 @@ func defaultConfig() config { return config{ VisibilityTimeout: 300 * time.Second, APITimeout: 120 * time.Second, + FipsEnabled: false, } } diff --git a/x-pack/filebeat/input/s3/input.go b/x-pack/filebeat/input/s3/input.go index a6b56d03970..d76e5b8b728 100644 --- a/x-pack/filebeat/input/s3/input.go +++ b/x-pack/filebeat/input/s3/input.go @@ -100,6 +100,13 @@ func (in *s3Input) createCollector(ctx v2.Context, pipeline beat.Pipeline) (*s3C log.Infof("visibility timeout is set to %v seconds", visibilityTimeout) log.Infof("aws api timeout is set to %v", in.config.APITimeout) + s3Servicename := "s3" + if in.config.FipsEnabled { + s3Servicename = "s3-fips" + } + + log.Debug("s3 service name = ", s3Servicename) + return &s3Collector{ cancellation: ctxtool.FromCanceller(ctx.Cancelation), logger: log, @@ -107,7 +114,7 @@ func (in *s3Input) createCollector(ctx v2.Context, pipeline beat.Pipeline) (*s3C publisher: client, visibilityTimeout: visibilityTimeout, sqs: sqs.New(awscommon.EnrichAWSConfigWithEndpoint(in.config.AwsConfig.Endpoint, "sqs", regionName, awsConfig)), - s3: s3.New(awscommon.EnrichAWSConfigWithEndpoint(in.config.AwsConfig.Endpoint, "s3", regionName, awsConfig)), + s3: s3.New(awscommon.EnrichAWSConfigWithEndpoint(in.config.AwsConfig.Endpoint, s3Servicename, regionName, awsConfig)), }, nil } From b4c273c0259c166efc5fbd45903d27a2c1bbe0f2 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Tue, 6 Oct 2020 12:40:21 -0600 Subject: [PATCH 153/216] [Metricbeat] Use timestamp from CloudWatch for events (#21498) --- CHANGELOG.next.asciidoc | 1 + x-pack/metricbeat/module/aws/aws.go | 13 +- .../metricbeat/module/aws/billing/billing.go | 38 ++-- .../module/aws/cloudwatch/cloudwatch.go | 105 ++++++----- .../module/aws/cloudwatch/cloudwatch_test.go | 39 ++++- x-pack/metricbeat/module/aws/ec2/ec2.go | 164 +++++++++--------- x-pack/metricbeat/module/aws/rds/rds.go | 106 +++++------ .../aws/s3_daily_storage/s3_daily_storage.go | 3 +- .../module/aws/s3_request/s3_request.go | 3 +- x-pack/metricbeat/module/aws/sqs/sqs.go | 7 +- 10 files changed, 255 insertions(+), 224 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6d22c4c1bf9..3099a033153 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -362,6 +362,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix remote_write flaky test. {pull}21173[21173] - Visualization title fixes in aws, azure and googlecloud compute dashboards. {pull}21098[21098] - Add a switch to the driver definition on SQL module to use pretty names {pull}17378[17378] +- Use timestamp from CloudWatch API when creating events. {pull}21498[21498] *Packetbeat* diff --git a/x-pack/metricbeat/module/aws/aws.go b/x-pack/metricbeat/module/aws/aws.go index 9786c4f7b38..167e6a088a0 100644 --- a/x-pack/metricbeat/module/aws/aws.go +++ b/x-pack/metricbeat/module/aws/aws.go @@ -196,11 +196,14 @@ func StringInSlice(str string, list []string) (bool, int) { } // InitEvent initialize mb.Event with basic information like service.name, cloud.provider -func InitEvent(regionName string, accountName string, accountID string) mb.Event { - event := mb.Event{} - event.MetricSetFields = common.MapStr{} - event.ModuleFields = common.MapStr{} - event.RootFields = common.MapStr{} +func InitEvent(regionName string, accountName string, accountID string, timestamp time.Time) mb.Event { + event := mb.Event{ + Timestamp: timestamp, + MetricSetFields: common.MapStr{}, + ModuleFields: common.MapStr{}, + RootFields: common.MapStr{}, + } + event.RootFields.Put("cloud.provider", "aws") if regionName != "" { event.RootFields.Put("cloud.region", regionName) diff --git a/x-pack/metricbeat/module/aws/billing/billing.go b/x-pack/metricbeat/module/aws/billing/billing.go index b9b971e3d34..39d600983d0 100644 --- a/x-pack/metricbeat/module/aws/billing/billing.go +++ b/x-pack/metricbeat/module/aws/billing/billing.go @@ -178,26 +178,28 @@ func (m *MetricSet) getCloudWatchBillingMetrics( // Find a timestamp for all metrics in output timestamp := aws.FindTimestamp(metricDataOutput) - if !timestamp.IsZero() { - for _, output := range metricDataOutput { - if len(output.Values) == 0 { - continue - } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, labelSeparator) + if timestamp.IsZero() { + return nil + } + + for _, output := range metricDataOutput { + if len(output.Values) == 0 { + continue + } + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + labels := strings.Split(*output.Label, labelSeparator) - event := aws.InitEvent("", m.AccountName, m.AccountID) - event.MetricSetFields.Put(labels[0], output.Values[timestampIdx]) + event := aws.InitEvent("", m.AccountName, m.AccountID, timestamp) + event.MetricSetFields.Put(labels[0], output.Values[timestampIdx]) - i := 1 - for i < len(labels)-1 { - event.MetricSetFields.Put(labels[i], labels[i+1]) - i += 2 - } - event.Timestamp = endTime - events = append(events, event) + i := 1 + for i < len(labels)-1 { + event.MetricSetFields.Put(labels[i], labels[i+1]) + i += 2 } + event.Timestamp = endTime + events = append(events, event) } } return events @@ -278,7 +280,7 @@ func (m *MetricSet) getCostGroupBy(svcCostExplorer costexploreriface.ClientAPI, } func (m *MetricSet) addCostMetrics(metrics map[string]costexplorer.MetricValue, groupDefinition costexplorer.GroupDefinition, startDate string, endDate string) mb.Event { - event := aws.InitEvent("", m.AccountName, m.AccountID) + event := aws.InitEvent("", m.AccountName, m.AccountID, time.Now()) // add group definition event.MetricSetFields.Put("group_definition", common.MapStr{ diff --git a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go index 07e1f09acef..af04508a111 100644 --- a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go +++ b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go @@ -499,34 +499,35 @@ func (m *MetricSet) createEvents(svcCloudwatch cloudwatchiface.ClientAPI, svcRes // Find a timestamp for all metrics in output timestamp := aws.FindTimestamp(metricDataResults) + if timestamp.IsZero() { + return nil, nil + } // Create events when there is no tags_filter or resource_type specified. if len(resourceTypeTagFilters) == 0 { - if !timestamp.IsZero() { - for _, output := range metricDataResults { - if len(output.Values) == 0 { - continue - } + for _, output := range metricDataResults { + if len(output.Values) == 0 { + continue + } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, labelSeparator) - if len(labels) != 5 { - // when there is no identifier value in label, use region+accountID+namespace instead - identifier := regionName + m.AccountID + labels[namespaceIdx] - if _, ok := events[identifier]; !ok { - events[identifier] = aws.InitEvent(regionName, m.AccountName, m.AccountID) - } - events[identifier] = insertRootFields(events[identifier], output.Values[timestampIdx], labels) - continue + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + labels := strings.Split(*output.Label, labelSeparator) + if len(labels) != 5 { + // when there is no identifier value in label, use region+accountID+namespace instead + identifier := regionName + m.AccountID + labels[namespaceIdx] + if _, ok := events[identifier]; !ok { + events[identifier] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) } + events[identifier] = insertRootFields(events[identifier], output.Values[timestampIdx], labels) + continue + } - identifierValue := labels[identifierValueIdx] - if _, ok := events[identifierValue]; !ok { - events[identifierValue] = aws.InitEvent(regionName, m.AccountName, m.AccountID) - } - events[identifierValue] = insertRootFields(events[identifierValue], output.Values[timestampIdx], labels) + identifierValue := labels[identifierValueIdx] + if _, ok := events[identifierValue]; !ok { + events[identifierValue] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) } + events[identifierValue] = insertRootFields(events[identifierValue], output.Values[timestampIdx], labels) } } return events, nil @@ -556,45 +557,43 @@ func (m *MetricSet) createEvents(svcCloudwatch cloudwatchiface.ClientAPI, svcRes m.logger.Debugf("In region %s, service %s tags match tags_filter", regionName, identifier) } - if !timestamp.IsZero() { - for _, output := range metricDataResults { - if len(output.Values) == 0 { - continue - } + for _, output := range metricDataResults { + if len(output.Values) == 0 { + continue + } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, labelSeparator) - if len(labels) != 5 { - // if there is no tag in labels but there is a tagsFilter, then no event should be reported. - if len(tagsFilter) != 0 { - continue - } - - // when there is no identifier value in label, use region+accountID+namespace instead - identifier := regionName + m.AccountID + labels[namespaceIdx] - if _, ok := events[identifier]; !ok { - events[identifier] = aws.InitEvent(regionName, m.AccountName, m.AccountID) - } - events[identifier] = insertRootFields(events[identifier], output.Values[timestampIdx], labels) + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + labels := strings.Split(*output.Label, labelSeparator) + if len(labels) != 5 { + // if there is no tag in labels but there is a tagsFilter, then no event should be reported. + if len(tagsFilter) != 0 { continue } - identifierValue := labels[identifierValueIdx] - if _, ok := events[identifierValue]; !ok { - // when tagsFilter is not empty but no entry in - // resourceTagMap for this identifier, do not initialize - // an event for this identifier. - if len(tagsFilter) != 0 && resourceTagMap[identifierValue] == nil { - continue - } - events[identifierValue] = aws.InitEvent(regionName, m.AccountName, m.AccountID) + // when there is no identifier value in label, use region+accountID+namespace instead + identifier := regionName + m.AccountID + labels[namespaceIdx] + if _, ok := events[identifier]; !ok { + events[identifier] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) } - events[identifierValue] = insertRootFields(events[identifierValue], output.Values[timestampIdx], labels) + events[identifier] = insertRootFields(events[identifier], output.Values[timestampIdx], labels) + continue + } - // add tags to event based on identifierValue - insertTags(events, identifierValue, resourceTagMap) + identifierValue := labels[identifierValueIdx] + if _, ok := events[identifierValue]; !ok { + // when tagsFilter is not empty but no entry in + // resourceTagMap for this identifier, do not initialize + // an event for this identifier. + if len(tagsFilter) != 0 && resourceTagMap[identifierValue] == nil { + continue + } + events[identifierValue] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) } + events[identifierValue] = insertRootFields(events[identifierValue], output.Values[timestampIdx], labels) + + // add tags to event based on identifierValue + insertTags(events, identifierValue, resourceTagMap) } } } diff --git a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go index 393ddecb07e..ecd4bb2f9d1 100644 --- a/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go +++ b/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch_test.go @@ -11,9 +11,6 @@ import ( "testing" "time" - "github.com/elastic/beats/v7/libbeat/logp" - "github.com/elastic/beats/v7/metricbeat/mb" - awssdk "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/service/cloudwatch" "github.com/aws/aws-sdk-go-v2/service/cloudwatch/cloudwatchiface" @@ -22,12 +19,14 @@ import ( "github.com/pkg/errors" "github.com/stretchr/testify/assert" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/metricbeat/mb" "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" ) var ( regionName = "us-west-1" - timestamp = time.Now() + timestamp = time.Date(2020, 10, 06, 00, 00, 00, 0, time.UTC) accountID = "123456789012" accountName = "test" @@ -1466,9 +1465,9 @@ func TestInsertTags(t *testing.T) { tagValue3 := "dev" events := map[string]mb.Event{} - events[identifier1] = aws.InitEvent(regionName, accountName, accountID) - events[identifier2] = aws.InitEvent(regionName, accountName, accountID) - events[identifierContainsArn] = aws.InitEvent(regionName, accountName, accountID) + events[identifier1] = aws.InitEvent(regionName, accountName, accountID, timestamp) + events[identifier2] = aws.InitEvent(regionName, accountName, accountID, timestamp) + events[identifierContainsArn] = aws.InitEvent(regionName, accountName, accountID, timestamp) resourceTagMap := map[string][]resourcegroupstaggingapi.Tag{} resourceTagMap["test-s3-1"] = []resourcegroupstaggingapi.Tag{ @@ -1569,3 +1568,29 @@ func TestConfigDimensionValueContainsWildcard(t *testing.T) { }) } } + +func TestCreateEventsTimestamp(t *testing.T) { + m := MetricSet{ + logger: logp.NewLogger("test"), + CloudwatchConfigs: []Config{{Statistic: []string{"Average"}}}, + MetricSet: &aws.MetricSet{Period: 5, AccountID: accountID}, + } + + listMetricWithStatsTotal := []metricsWithStatistics{ + { + cloudwatch.Metric{ + MetricName: awssdk.String("CPUUtilization"), + Namespace: awssdk.String("AWS/EC2"), + }, + []string{"Average"}, + nil, + }, + } + + resourceTypeTagFilters := map[string][]aws.Tag{} + startTime, endTime := aws.GetStartTimeEndTime(m.MetricSet.Period, m.MetricSet.Latency) + + events, err := m.createEvents(&MockCloudWatchClientWithoutDim{}, &MockResourceGroupsTaggingClient{}, listMetricWithStatsTotal, resourceTypeTagFilters, regionName, startTime, endTime) + assert.NoError(t, err) + assert.Equal(t, timestamp, events[regionName+accountID+namespace].Timestamp) +} diff --git a/x-pack/metricbeat/module/aws/ec2/ec2.go b/x-pack/metricbeat/module/aws/ec2/ec2.go index 4e0776072e6..7cb69623a00 100644 --- a/x-pack/metricbeat/module/aws/ec2/ec2.go +++ b/x-pack/metricbeat/module/aws/ec2/ec2.go @@ -175,115 +175,117 @@ func constructMetricQueries(listMetricsOutput []cloudwatch.Metric, instanceID st } func (m *MetricSet) createCloudWatchEvents(getMetricDataResults []cloudwatch.MetricDataResult, instanceOutput map[string]ec2.Instance, regionName string) (map[string]mb.Event, error) { + // monitoring state for each instance + monitoringStates := map[string]string{} + + // Find a timestamp for all metrics in output + timestamp := aws.FindTimestamp(getMetricDataResults) + if timestamp.IsZero() { + return nil, nil + } + // Initialize events and metricSetFieldResults per instanceID events := map[string]mb.Event{} metricSetFieldResults := map[idStat]map[string]interface{}{} for instanceID := range instanceOutput { for _, statistic := range statistics { - events[instanceID] = aws.InitEvent(regionName, m.AccountName, m.AccountID) + events[instanceID] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) metricSetFieldResults[idStat{instanceID: instanceID, statistic: statistic}] = map[string]interface{}{} } } - // monitoring state for each instance - monitoringStates := map[string]string{} + for _, output := range getMetricDataResults { + if len(output.Values) == 0 { + continue + } - // Find a timestamp for all metrics in output - timestamp := aws.FindTimestamp(getMetricDataResults) - if !timestamp.IsZero() { - for _, output := range getMetricDataResults { - if len(output.Values) == 0 { + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + label, err := newLabelFromJSON(*output.Label) + if err != nil { + m.logger.Errorf("convert cloudwatch MetricDataResult label failed for label = %s: %w", *output.Label, err) continue } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - label, err := newLabelFromJSON(*output.Label) - if err != nil { - m.logger.Errorf("convert cloudwatch MetricDataResult label failed for label = %s: %w", *output.Label, err) + instanceID := label.InstanceID + statistic := label.Statistic + + // Add tags + tags := instanceOutput[instanceID].Tags + if m.TagsFilter != nil { + // Check with each tag filter + // If tag filter doesn't exist in tagKeys/tagValues, + // then do not report this event/instance. + if exists := aws.CheckTagFiltersExist(m.TagsFilter, tags); !exists { + // if tag filter doesn't exist, remove this event initial + // entry to avoid report an empty event. + delete(events, instanceID) continue } + } - instanceID := label.InstanceID - statistic := label.Statistic - - // Add tags - tags := instanceOutput[instanceID].Tags - if m.TagsFilter != nil { - // Check with each tag filter - // If tag filter doesn't exist in tagKeys/tagValues, - // then do not report this event/instance. - if exists := aws.CheckTagFiltersExist(m.TagsFilter, tags); !exists { - // if tag filter doesn't exist, remove this event initial - // entry to avoid report an empty event. - delete(events, instanceID) - continue - } - } - - // By default, replace dot "." using underscore "_" for tag keys. - // Note: tag values are not dedotted. - for _, tag := range tags { - events[instanceID].ModuleFields.Put("tags."+common.DeDot(*tag.Key), *tag.Value) - // add cloud.instance.name and host.name into ec2 events - if *tag.Key == "Name" { - events[instanceID].RootFields.Put("cloud.instance.name", *tag.Value) - events[instanceID].RootFields.Put("host.name", *tag.Value) - } - } - - machineType, err := instanceOutput[instanceID].InstanceType.MarshalValue() - if err != nil { - return events, errors.Wrap(err, "instance.InstanceType.MarshalValue failed") + // By default, replace dot "." using underscore "_" for tag keys. + // Note: tag values are not dedotted. + for _, tag := range tags { + events[instanceID].ModuleFields.Put("tags."+common.DeDot(*tag.Key), *tag.Value) + // add cloud.instance.name and host.name into ec2 events + if *tag.Key == "Name" { + events[instanceID].RootFields.Put("cloud.instance.name", *tag.Value) + events[instanceID].RootFields.Put("host.name", *tag.Value) } + } - events[instanceID].RootFields.Put("cloud.instance.id", instanceID) - events[instanceID].RootFields.Put("cloud.machine.type", machineType) + machineType, err := instanceOutput[instanceID].InstanceType.MarshalValue() + if err != nil { + return events, errors.Wrap(err, "instance.InstanceType.MarshalValue failed") + } - placement := instanceOutput[instanceID].Placement - if placement != nil { - events[instanceID].RootFields.Put("cloud.availability_zone", *placement.AvailabilityZone) - } + events[instanceID].RootFields.Put("cloud.instance.id", instanceID) + events[instanceID].RootFields.Put("cloud.machine.type", machineType) - if len(output.Values) > timestampIdx { - metricSetFieldResults[idStat{instanceID: instanceID, statistic: statistic}][label.MetricName] = fmt.Sprint(output.Values[timestampIdx]) - } + placement := instanceOutput[instanceID].Placement + if placement != nil { + events[instanceID].RootFields.Put("cloud.availability_zone", *placement.AvailabilityZone) + } - instanceStateName, err := instanceOutput[instanceID].State.Name.MarshalValue() - if err != nil { - return events, errors.Wrap(err, "instance.State.Name.MarshalValue failed") - } + if len(output.Values) > timestampIdx { + metricSetFieldResults[idStat{instanceID: instanceID, statistic: statistic}][label.MetricName] = fmt.Sprint(output.Values[timestampIdx]) + } - monitoringState, err := instanceOutput[instanceID].Monitoring.State.MarshalValue() - if err != nil { - return events, errors.Wrap(err, "instance.Monitoring.State.MarshalValue failed") - } + instanceStateName, err := instanceOutput[instanceID].State.Name.MarshalValue() + if err != nil { + return events, errors.Wrap(err, "instance.State.Name.MarshalValue failed") + } - monitoringStates[instanceID] = monitoringState + monitoringState, err := instanceOutput[instanceID].Monitoring.State.MarshalValue() + if err != nil { + return events, errors.Wrap(err, "instance.Monitoring.State.MarshalValue failed") + } - cpuOptions := instanceOutput[instanceID].CpuOptions - if cpuOptions != nil { - events[instanceID].MetricSetFields.Put("instance.core.count", *cpuOptions.CoreCount) - events[instanceID].MetricSetFields.Put("instance.threads_per_core", *cpuOptions.ThreadsPerCore) - } + monitoringStates[instanceID] = monitoringState - publicIP := instanceOutput[instanceID].PublicIpAddress - if publicIP != nil { - events[instanceID].MetricSetFields.Put("instance.public.ip", *publicIP) - } + cpuOptions := instanceOutput[instanceID].CpuOptions + if cpuOptions != nil { + events[instanceID].MetricSetFields.Put("instance.core.count", *cpuOptions.CoreCount) + events[instanceID].MetricSetFields.Put("instance.threads_per_core", *cpuOptions.ThreadsPerCore) + } - privateIP := instanceOutput[instanceID].PrivateIpAddress - if privateIP != nil { - events[instanceID].MetricSetFields.Put("instance.private.ip", *privateIP) - } + publicIP := instanceOutput[instanceID].PublicIpAddress + if publicIP != nil { + events[instanceID].MetricSetFields.Put("instance.public.ip", *publicIP) + } - events[instanceID].MetricSetFields.Put("instance.image.id", *instanceOutput[instanceID].ImageId) - events[instanceID].MetricSetFields.Put("instance.state.name", instanceStateName) - events[instanceID].MetricSetFields.Put("instance.state.code", *instanceOutput[instanceID].State.Code) - events[instanceID].MetricSetFields.Put("instance.monitoring.state", monitoringState) - events[instanceID].MetricSetFields.Put("instance.public.dns_name", *instanceOutput[instanceID].PublicDnsName) - events[instanceID].MetricSetFields.Put("instance.private.dns_name", *instanceOutput[instanceID].PrivateDnsName) + privateIP := instanceOutput[instanceID].PrivateIpAddress + if privateIP != nil { + events[instanceID].MetricSetFields.Put("instance.private.ip", *privateIP) } + + events[instanceID].MetricSetFields.Put("instance.image.id", *instanceOutput[instanceID].ImageId) + events[instanceID].MetricSetFields.Put("instance.state.name", instanceStateName) + events[instanceID].MetricSetFields.Put("instance.state.code", *instanceOutput[instanceID].State.Code) + events[instanceID].MetricSetFields.Put("instance.monitoring.state", monitoringState) + events[instanceID].MetricSetFields.Put("instance.public.dns_name", *instanceOutput[instanceID].PublicDnsName) + events[instanceID].MetricSetFields.Put("instance.private.dns_name", *instanceOutput[instanceID].PrivateDnsName) } } diff --git a/x-pack/metricbeat/module/aws/rds/rds.go b/x-pack/metricbeat/module/aws/rds/rds.go index b381dcac943..3bb14f28de8 100644 --- a/x-pack/metricbeat/module/aws/rds/rds.go +++ b/x-pack/metricbeat/module/aws/rds/rds.go @@ -274,70 +274,72 @@ func (m *MetricSet) createCloudWatchEvents(getMetricDataResults []cloudwatch.Met // Find a timestamp for all metrics in output timestamp := aws.FindTimestamp(getMetricDataResults) - if !timestamp.IsZero() { - for _, output := range getMetricDataResults { - if len(output.Values) == 0 { - continue + if timestamp.IsZero() { + return nil, nil + } + + for _, output := range getMetricDataResults { + if len(output.Values) == 0 { + continue + } + exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) + if exists { + labels := strings.Split(*output.Label, " ") + // Collect dimension values from the labels and initialize events and metricSetFieldResults with dimValues + var dimValues string + for i := 1; i < len(labels); i += 2 { + dimValues = dimValues + labels[i+1] } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, " ") - // Collect dimension values from the labels and initialize events and metricSetFieldResults with dimValues - var dimValues string - for i := 1; i < len(labels); i += 2 { - dimValues = dimValues + labels[i+1] - } - if _, ok := events[dimValues]; !ok { - events[dimValues] = aws.InitEvent(regionName, m.AccountName, m.AccountID) - } + if _, ok := events[dimValues]; !ok { + events[dimValues] = aws.InitEvent(regionName, m.AccountName, m.AccountID, timestamp) + } - if _, ok := metricSetFieldResults[dimValues]; !ok { - metricSetFieldResults[dimValues] = map[string]interface{}{} - } + if _, ok := metricSetFieldResults[dimValues]; !ok { + metricSetFieldResults[dimValues] = map[string]interface{}{} + } - if len(output.Values) > timestampIdx && len(labels) > 0 { - if labels[metricNameIdx] == "CPUUtilization" { - metricSetFieldResults[dimValues][labels[metricNameIdx]] = fmt.Sprint(output.Values[timestampIdx] / 100) - } else { - metricSetFieldResults[dimValues][labels[metricNameIdx]] = fmt.Sprint(output.Values[timestampIdx]) - } + if len(output.Values) > timestampIdx && len(labels) > 0 { + if labels[metricNameIdx] == "CPUUtilization" { + metricSetFieldResults[dimValues][labels[metricNameIdx]] = fmt.Sprint(output.Values[timestampIdx] / 100) + } else { + metricSetFieldResults[dimValues][labels[metricNameIdx]] = fmt.Sprint(output.Values[timestampIdx]) + } - for i := 1; i < len(labels); i += 2 { - if labels[i] == "DBInstanceIdentifier" { - dbIdentifier := labels[i+1] - if _, found := events[dbIdentifier]; found { - if _, found := dbInstanceMap[dbIdentifier]; !found { - delete(metricSetFieldResults, dimValues) - continue - } - events[dbIdentifier].RootFields.Put("cloud.availability_zone", dbInstanceMap[dbIdentifier].dbAvailabilityZone) - events[dbIdentifier].MetricSetFields.Put("db_instance.arn", dbInstanceMap[dbIdentifier].dbArn) - events[dbIdentifier].MetricSetFields.Put("db_instance.class", dbInstanceMap[dbIdentifier].dbClass) - events[dbIdentifier].MetricSetFields.Put("db_instance.identifier", dbInstanceMap[dbIdentifier].dbIdentifier) - events[dbIdentifier].MetricSetFields.Put("db_instance.status", dbInstanceMap[dbIdentifier].dbStatus) - - for _, tag := range dbInstanceMap[dbIdentifier].tags { - events[dbIdentifier].ModuleFields.Put("tags."+tag.Key, tag.Value) - } + for i := 1; i < len(labels); i += 2 { + if labels[i] == "DBInstanceIdentifier" { + dbIdentifier := labels[i+1] + if _, found := events[dbIdentifier]; found { + if _, found := dbInstanceMap[dbIdentifier]; !found { + delete(metricSetFieldResults, dimValues) + continue + } + events[dbIdentifier].RootFields.Put("cloud.availability_zone", dbInstanceMap[dbIdentifier].dbAvailabilityZone) + events[dbIdentifier].MetricSetFields.Put("db_instance.arn", dbInstanceMap[dbIdentifier].dbArn) + events[dbIdentifier].MetricSetFields.Put("db_instance.class", dbInstanceMap[dbIdentifier].dbClass) + events[dbIdentifier].MetricSetFields.Put("db_instance.identifier", dbInstanceMap[dbIdentifier].dbIdentifier) + events[dbIdentifier].MetricSetFields.Put("db_instance.status", dbInstanceMap[dbIdentifier].dbStatus) + + for _, tag := range dbInstanceMap[dbIdentifier].tags { + events[dbIdentifier].ModuleFields.Put("tags."+tag.Key, tag.Value) } } - metricSetFieldResults[dimValues][labels[i]] = fmt.Sprint(labels[(i + 1)]) + } + metricSetFieldResults[dimValues][labels[i]] = fmt.Sprint(labels[(i + 1)]) + } + + // if tags_filter is given, then only return metrics with DBInstanceIdentifier as dimension + if m.TagsFilter != nil { + if len(labels) == 1 { + delete(events, dimValues) + delete(metricSetFieldResults, dimValues) } - // if tags_filter is given, then only return metrics with DBInstanceIdentifier as dimension - if m.TagsFilter != nil { - if len(labels) == 1 { + for i := 1; i < len(labels); i += 2 { + if labels[i] != "DBInstanceIdentifier" && i == len(labels)-2 { delete(events, dimValues) delete(metricSetFieldResults, dimValues) } - - for i := 1; i < len(labels); i += 2 { - if labels[i] != "DBInstanceIdentifier" && i == len(labels)-2 { - delete(events, dimValues) - delete(metricSetFieldResults, dimValues) - } - } } } } diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go index 53248284d41..d5efa36fb03 100644 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go @@ -186,8 +186,6 @@ func createMetricDataQuery(metric cloudwatch.Metric, period time.Duration, index } func createCloudWatchEvents(outputs []cloudwatch.MetricDataResult, regionName string, bucketName string, accountName string, accountID string) (event mb.Event, err error) { - event = aws.InitEvent(regionName, accountName, accountID) - // AWS s3_daily_storage metrics mapOfMetricSetFieldResults := make(map[string]interface{}) @@ -214,6 +212,7 @@ func createCloudWatchEvents(outputs []cloudwatch.MetricDataResult, regionName st return } + event = aws.InitEvent(regionName, accountName, accountID, timestamp) event.MetricSetFields = resultMetricSetFields event.RootFields.Put("aws.s3.bucket.name", bucketName) return diff --git a/x-pack/metricbeat/module/aws/s3_request/s3_request.go b/x-pack/metricbeat/module/aws/s3_request/s3_request.go index 63b93f6cdf4..00b82827bbf 100644 --- a/x-pack/metricbeat/module/aws/s3_request/s3_request.go +++ b/x-pack/metricbeat/module/aws/s3_request/s3_request.go @@ -188,8 +188,6 @@ func constructMetricQueries(listMetricsOutputs []cloudwatch.Metric, period time. // CreateS3Events creates s3_request and s3_daily_storage events from Cloudwatch metric data. func createS3RequestEvents(outputs []cloudwatch.MetricDataResult, regionName string, bucketName string, accountName string, accountID string) (event mb.Event, err error) { - event = aws.InitEvent(regionName, accountName, accountID) - // AWS s3_request metrics mapOfMetricSetFieldResults := make(map[string]interface{}) @@ -216,6 +214,7 @@ func createS3RequestEvents(outputs []cloudwatch.MetricDataResult, regionName str return } + event = aws.InitEvent(regionName, accountName, accountID, timestamp) event.MetricSetFields = resultMetricSetFields event.RootFields.Put("aws.s3.bucket.name", bucketName) return diff --git a/x-pack/metricbeat/module/aws/sqs/sqs.go b/x-pack/metricbeat/module/aws/sqs/sqs.go index 6dc0774f66d..5f17eccb4b1 100644 --- a/x-pack/metricbeat/module/aws/sqs/sqs.go +++ b/x-pack/metricbeat/module/aws/sqs/sqs.go @@ -175,9 +175,7 @@ func createMetricDataQuery(metric cloudwatch.Metric, index int, period time.Dura return } -func createEventPerQueue(getMetricDataResults []cloudwatch.MetricDataResult, queueName string, metricsetName string, regionName string, schemaMetricFields s.Schema, accountName string, accountID string) (event mb.Event, err error) { - event = aws.InitEvent(regionName, accountName, accountID) - +func createEventPerQueue(getMetricDataResults []cloudwatch.MetricDataResult, queueName string, regionName string, schemaMetricFields s.Schema, accountName string, accountID string) (event mb.Event, err error) { // AWS sqs metrics mapOfMetricSetFieldResults := make(map[string]interface{}) @@ -204,6 +202,7 @@ func createEventPerQueue(getMetricDataResults []cloudwatch.MetricDataResult, que return } + event = aws.InitEvent(regionName, accountName, accountID, timestamp) event.MetricSetFields = resultMetricSetFields event.MetricSetFields.Put("queue.name", queueName) return @@ -213,7 +212,7 @@ func createSQSEvents(queueURLs []string, metricDataResults []cloudwatch.MetricDa for _, queueURL := range queueURLs { queueURLParsed := strings.Split(queueURL, "/") queueName := queueURLParsed[len(queueURLParsed)-1] - event, err := createEventPerQueue(metricDataResults, queueName, metricsetName, regionName, schemaRequestFields, accountName, accountID) + event, err := createEventPerQueue(metricDataResults, queueName, regionName, schemaRequestFields, accountName, accountID) if err != nil { event.Error = err report.Event(event) From aed4831afd215c8b230cda3836e71712fdf48389 Mon Sep 17 00:00:00 2001 From: Alex K <8418476+fearful-symmetry@users.noreply.github.com> Date: Tue, 6 Oct 2020 12:02:29 -0700 Subject: [PATCH 154/216] Remove nil-zero metrics and linux-exclusive metrics from Metricbeat (#21457) * refactor metricbeat to remove nil-zero metrics and linux-exclusive metrics * update xpack docs * fix non-linux diskstat builds * fix linux test builds * fix python tests * move windows files for disk performance * properly fix test_drop_fields * try to fix different system test * mage fmt * fix windows filesystem tests * fix platform test * add changelog --- CHANGELOG.next.asciidoc | 1 + .../system/diskio/disk_performance_386.go | 0 .../system/diskio/disk_performance_amd64.go | 0 .../metric}/system/diskio/diskstat.go | 11 +- .../metric}/system/diskio/diskstat_linux.go | 81 ++-- .../system/diskio/diskstat_linux_test.go | 60 +-- .../metric}/system/diskio/diskstat_other.go | 14 +- .../metric}/system/diskio/diskstat_windows.go | 14 +- .../system/diskio/diskstat_windows_helper.go | 0 .../system/diskio/diskstat_windows_test.go | 0 metricbeat/docs/fields.asciidoc | 354 +++++++++++++++++- metricbeat/docs/modules/linux.asciidoc | 10 + metricbeat/docs/modules/linux/iostat.asciidoc | 23 ++ metricbeat/docs/modules/linux/memory.asciidoc | 24 ++ metricbeat/docs/modules_list.asciidoc | 4 +- metricbeat/include/list_common.go | 2 + metricbeat/metricbeat.reference.yml | 2 + metricbeat/module/linux/_meta/config.yml | 2 + metricbeat/module/linux/_meta/fields.yml | 1 + metricbeat/module/linux/fields.go | 2 +- .../module/linux/iostat/_meta/data.json | 49 +++ .../module/linux/iostat/_meta/docs.asciidoc | 3 + .../module/linux/iostat/_meta/fields.yml | 61 +++ metricbeat/module/linux/iostat/data.go | 58 +++ metricbeat/module/linux/iostat/iostat.go | 104 +++++ metricbeat/module/linux/iostat/iostat_test.go | 55 +++ .../module/linux/memory/_meta/data.json | 59 +++ .../module/linux/memory/_meta/docs.asciidoc | 3 + .../module/linux/memory/_meta/fields.yml | 78 ++++ metricbeat/module/linux/memory/data.go | 99 +++++ metricbeat/module/linux/memory/memory.go | 62 +++ metricbeat/module/linux/memory/memory_test.go | 55 +++ metricbeat/module/system/cpu/_meta/data.json | 44 +-- metricbeat/module/system/cpu/cpu.go | 48 +-- metricbeat/module/system/cpu/data.go | 112 ++++++ .../module/system/diskio/_meta/data.json | 16 +- metricbeat/module/system/diskio/diskio.go | 57 ++- .../module/system/diskio/diskio_test.go | 40 ++ metricbeat/module/system/fields.go | 2 +- .../module/system/filesystem/_meta/data.json | 27 +- metricbeat/module/system/filesystem/helper.go | 9 +- .../module/system/fsstat/_meta/fields.yml | 2 +- metricbeat/module/system/fsstat/fsstat.go | 26 +- .../module/system/memory/_meta/data.json | 42 +-- metricbeat/module/system/memory/memory.go | 81 +--- .../module/system/process/_meta/data.json | 132 +++---- .../module/system/process/_meta/fields.yml | 16 +- metricbeat/module/system/process/process.go | 36 +- .../system/process_summary/_meta/data.json | 19 +- .../system/process_summary/process_summary.go | 32 +- .../process_summary/process_summary_test.go | 31 +- metricbeat/module/system/system.go | 38 +- metricbeat/module/system/test_system.py | 59 ++- metricbeat/modules.d/linux.yml.disabled | 2 + metricbeat/tests/system/test_processors.py | 15 +- x-pack/metricbeat/metricbeat.reference.yml | 2 + 56 files changed, 1700 insertions(+), 479 deletions(-) rename {metricbeat/module => libbeat/metric}/system/diskio/disk_performance_386.go (100%) rename {metricbeat/module => libbeat/metric}/system/diskio/disk_performance_amd64.go (100%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat.go (88%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_linux.go (55%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_linux_test.go (55%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_other.go (79%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_windows.go (78%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_windows_helper.go (100%) rename {metricbeat/module => libbeat/metric}/system/diskio/diskstat_windows_test.go (100%) create mode 100644 metricbeat/docs/modules/linux/iostat.asciidoc create mode 100644 metricbeat/docs/modules/linux/memory.asciidoc create mode 100644 metricbeat/module/linux/iostat/_meta/data.json create mode 100644 metricbeat/module/linux/iostat/_meta/docs.asciidoc create mode 100644 metricbeat/module/linux/iostat/_meta/fields.yml create mode 100644 metricbeat/module/linux/iostat/data.go create mode 100644 metricbeat/module/linux/iostat/iostat.go create mode 100644 metricbeat/module/linux/iostat/iostat_test.go create mode 100644 metricbeat/module/linux/memory/_meta/data.json create mode 100644 metricbeat/module/linux/memory/_meta/docs.asciidoc create mode 100644 metricbeat/module/linux/memory/_meta/fields.yml create mode 100644 metricbeat/module/linux/memory/data.go create mode 100644 metricbeat/module/linux/memory/memory.go create mode 100644 metricbeat/module/linux/memory/memory_test.go create mode 100644 metricbeat/module/system/cpu/data.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 3099a033153..6b4a999e0ec 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -93,6 +93,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Move service config under metrics and simplify metric types. {pull}18691[18691] - Fix ECS compliance of user.id field in system/users metricset {pull}19019[19019] - Rename googlecloud stackdriver metricset to metrics. {pull}19718[19718] +- Remove "invalid zero" metrics on Windows and Darwin, don't report linux-only memory and diskio metrics when running under agent. {pull}21457[21457] *Packetbeat* diff --git a/metricbeat/module/system/diskio/disk_performance_386.go b/libbeat/metric/system/diskio/disk_performance_386.go similarity index 100% rename from metricbeat/module/system/diskio/disk_performance_386.go rename to libbeat/metric/system/diskio/disk_performance_386.go diff --git a/metricbeat/module/system/diskio/disk_performance_amd64.go b/libbeat/metric/system/diskio/disk_performance_amd64.go similarity index 100% rename from metricbeat/module/system/diskio/disk_performance_amd64.go rename to libbeat/metric/system/diskio/disk_performance_amd64.go diff --git a/metricbeat/module/system/diskio/diskstat.go b/libbeat/metric/system/diskio/diskstat.go similarity index 88% rename from metricbeat/module/system/diskio/diskstat.go rename to libbeat/metric/system/diskio/diskstat.go index 949d69778fa..3cea37c552a 100644 --- a/metricbeat/module/system/diskio/diskstat.go +++ b/libbeat/metric/system/diskio/diskstat.go @@ -25,11 +25,11 @@ import ( sigar "github.com/elastic/gosigar" ) -// mapping fields which output by `iostat -x` on linux +// IOMetric contains mapping fields which are outputed by `iostat -x` on linux // // Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await r_await w_await svctm %util // sda 0.06 0.78 0.09 0.27 9.42 8.06 48.64 0.00 1.34 0.99 1.45 0.77 0.03 -type DiskIOMetric struct { +type IOMetric struct { ReadRequestMergeCountPerSec float64 `json:"rrqmCps"` WriteRequestMergeCountPerSec float64 `json:"wrqmCps"` ReadRequestCountPerSec float64 `json:"rrqCps"` @@ -46,8 +46,9 @@ type DiskIOMetric struct { BusyPct float64 `json:"busy"` } -type DiskIOStat struct { +// IOStat carries disk statistics for all devices +type IOStat struct { lastDiskIOCounters map[string]disk.IOCountersStat - lastCpu sigar.Cpu - curCpu sigar.Cpu + lastCPU sigar.Cpu + curCPU sigar.Cpu } diff --git a/metricbeat/module/system/diskio/diskstat_linux.go b/libbeat/metric/system/diskio/diskstat_linux.go similarity index 55% rename from metricbeat/module/system/diskio/diskstat_linux.go rename to libbeat/metric/system/diskio/diskstat_linux.go index 4ecfdf700ac..826aed78c27 100644 --- a/metricbeat/module/system/diskio/diskstat_linux.go +++ b/libbeat/metric/system/diskio/diskstat_linux.go @@ -26,7 +26,8 @@ import ( "github.com/elastic/beats/v7/libbeat/metric/system/cpu" ) -func Get_CLK_TCK() uint32 { +// GetCLKTCK emulates the _SC_CLK_TCK syscall +func GetCLKTCK() uint32 { // return uint32(C.sysconf(C._SC_CLK_TCK)) // NOTE: _SC_CLK_TCK should be fetched from sysconf using cgo return uint32(100) @@ -38,77 +39,78 @@ func IOCounters(names ...string) (map[string]disk.IOCountersStat, error) { } // NewDiskIOStat :init DiskIOStat object. -func NewDiskIOStat() *DiskIOStat { - return &DiskIOStat{ +func NewDiskIOStat() *IOStat { + return &IOStat{ lastDiskIOCounters: map[string]disk.IOCountersStat{}, } } // OpenSampling creates current cpu sampling // need call as soon as get IOCounters. -func (stat *DiskIOStat) OpenSampling() error { - return stat.curCpu.Get() +func (stat *IOStat) OpenSampling() error { + return stat.curCPU.Get() } -// CalIOStatistics calculates IO statistics. -func (stat *DiskIOStat) CalIOStatistics(result *DiskIOMetric, counter disk.IOCountersStat) error { +// CalcIOStatistics calculates IO statistics. +func (stat *IOStat) CalcIOStatistics(counter disk.IOCountersStat) (IOMetric, error) { var last disk.IOCountersStat var ok bool // if last counter not found, create one and return all 0 if last, ok = stat.lastDiskIOCounters[counter.Name]; !ok { stat.lastDiskIOCounters[counter.Name] = counter - return nil + return IOMetric{}, nil } // calculate the delta ms between the CloseSampling and OpenSampling - deltams := 1000.0 * float64(stat.curCpu.Total()-stat.lastCpu.Total()) / float64(cpu.NumCores) / float64(Get_CLK_TCK()) + deltams := 1000.0 * float64(stat.curCPU.Total()-stat.lastCPU.Total()) / float64(cpu.NumCores) / float64(GetCLKTCK()) if deltams <= 0 { - return errors.New("The delta cpu time between close sampling and open sampling is less or equal to 0") + return IOMetric{}, errors.New("The delta cpu time between close sampling and open sampling is less or equal to 0") } - rd_ios := counter.ReadCount - last.ReadCount - rd_merges := counter.MergedReadCount - last.MergedReadCount - rd_bytes := counter.ReadBytes - last.ReadBytes - rd_ticks := counter.ReadTime - last.ReadTime - wr_ios := counter.WriteCount - last.WriteCount - wr_merges := counter.MergedWriteCount - last.MergedWriteCount - wr_bytes := counter.WriteBytes - last.WriteBytes - wr_ticks := counter.WriteTime - last.WriteTime + rdIOs := counter.ReadCount - last.ReadCount + rdMerges := counter.MergedReadCount - last.MergedReadCount + rdBytes := counter.ReadBytes - last.ReadBytes + rdTicks := counter.ReadTime - last.ReadTime + wrIOs := counter.WriteCount - last.WriteCount + wrMerges := counter.MergedWriteCount - last.MergedWriteCount + wrBytes := counter.WriteBytes - last.WriteBytes + wrTicks := counter.WriteTime - last.WriteTime ticks := counter.IoTime - last.IoTime aveq := counter.WeightedIO - last.WeightedIO - n_ios := rd_ios + wr_ios - n_ticks := rd_ticks + wr_ticks - n_bytes := rd_bytes + wr_bytes + nIOs := rdIOs + wrIOs + nTicks := rdTicks + wrTicks + nBytes := rdBytes + wrBytes size := float64(0) wait := float64(0) svct := float64(0) - if n_ios > 0 { - size = float64(n_bytes) / float64(n_ios) - wait = float64(n_ticks) / float64(n_ios) - svct = float64(ticks) / float64(n_ios) + if nIOs > 0 { + size = float64(nBytes) / float64(nIOs) + wait = float64(nTicks) / float64(nIOs) + svct = float64(ticks) / float64(nIOs) } queue := float64(aveq) / deltams - per_sec := func(x uint64) float64 { + perSec := func(x uint64) float64 { return 1000.0 * float64(x) / deltams } - result.ReadRequestMergeCountPerSec = per_sec(rd_merges) - result.WriteRequestMergeCountPerSec = per_sec(wr_merges) - result.ReadRequestCountPerSec = per_sec(rd_ios) - result.WriteRequestCountPerSec = per_sec(wr_ios) - result.ReadBytesPerSec = per_sec(rd_bytes) - result.WriteBytesPerSec = per_sec(wr_bytes) + result := IOMetric{} + result.ReadRequestMergeCountPerSec = perSec(rdMerges) + result.WriteRequestMergeCountPerSec = perSec(wrMerges) + result.ReadRequestCountPerSec = perSec(rdIOs) + result.WriteRequestCountPerSec = perSec(wrIOs) + result.ReadBytesPerSec = perSec(rdBytes) + result.WriteBytesPerSec = perSec(wrBytes) result.AvgRequestSize = size result.AvgQueueSize = queue result.AvgAwaitTime = wait - if rd_ios > 0 { - result.AvgReadAwaitTime = float64(rd_ticks) / float64(rd_ios) + if rdIOs > 0 { + result.AvgReadAwaitTime = float64(rdTicks) / float64(rdIOs) } - if wr_ios > 0 { - result.AvgWriteAwaitTime = float64(wr_ticks) / float64(wr_ios) + if wrIOs > 0 { + result.AvgWriteAwaitTime = float64(wrTicks) / float64(wrIOs) } result.AvgServiceTime = svct result.BusyPct = 100.0 * float64(ticks) / deltams @@ -117,10 +119,11 @@ func (stat *DiskIOStat) CalIOStatistics(result *DiskIOMetric, counter disk.IOCou } stat.lastDiskIOCounters[counter.Name] = counter - return nil + return result, nil } -func (stat *DiskIOStat) CloseSampling() { - stat.lastCpu = stat.curCpu +// CloseSampling closes the disk sampler +func (stat *IOStat) CloseSampling() { + stat.lastCPU = stat.curCPU } diff --git a/metricbeat/module/system/diskio/diskstat_linux_test.go b/libbeat/metric/system/diskio/diskstat_linux_test.go similarity index 55% rename from metricbeat/module/system/diskio/diskstat_linux_test.go rename to libbeat/metric/system/diskio/diskstat_linux_test.go index 56a8d9dc7cc..74c0bef231e 100644 --- a/metricbeat/module/system/diskio/diskstat_linux_test.go +++ b/libbeat/metric/system/diskio/diskstat_linux_test.go @@ -27,53 +27,11 @@ import ( "github.com/stretchr/testify/assert" sigar "github.com/elastic/gosigar" - - mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" - "github.com/elastic/beats/v7/metricbeat/module/system" ) -func Test_Get_CLK_TCK(t *testing.T) { +func Test_GetCLKTCK(t *testing.T) { //usually the tick is 100 - assert.Equal(t, uint32(100), Get_CLK_TCK()) -} - -func TestDataNameFilter(t *testing.T) { - oldFS := system.HostFS - newFS := "_meta/testdata" - system.HostFS = &newFS - defer func() { - system.HostFS = oldFS - }() - - conf := map[string]interface{}{ - "module": "system", - "metricsets": []string{"diskio"}, - "diskio.include_devices": []string{"sda", "sda1", "sda2"}, - } - - f := mbtest.NewReportingMetricSetV2Error(t, conf) - data, errs := mbtest.ReportingFetchV2Error(f) - assert.Empty(t, errs) - assert.Equal(t, 3, len(data)) -} - -func TestDataEmptyFilter(t *testing.T) { - oldFS := system.HostFS - newFS := "_meta/testdata" - system.HostFS = &newFS - defer func() { - system.HostFS = oldFS - }() - - conf := map[string]interface{}{ - "module": "system", - "metricsets": []string{"diskio"}, - } - - f := mbtest.NewReportingMetricSetV2Error(t, conf) - data, errs := mbtest.ReportingFetchV2Error(f) - assert.Empty(t, errs) - assert.Equal(t, 10, len(data)) + assert.Equal(t, uint32(100), GetCLKTCK()) } func TestDiskIOStat_CalIOStatistics(t *testing.T) { @@ -85,9 +43,9 @@ func TestDiskIOStat_CalIOStatistics(t *testing.T) { Name: "iostat", } - stat := &DiskIOStat{ + stat := &IOStat{ lastDiskIOCounters: map[string]disk.IOCountersStat{ - "iostat": disk.IOCountersStat{ + "iostat": { ReadCount: 3, WriteCount: 5, ReadTime: 7, @@ -95,17 +53,17 @@ func TestDiskIOStat_CalIOStatistics(t *testing.T) { Name: "iostat", }, }, - lastCpu: sigar.Cpu{Idle: 100}, - curCpu: sigar.Cpu{Idle: 1}, + lastCPU: sigar.Cpu{Idle: 100}, + curCPU: sigar.Cpu{Idle: 1}, } - expected := DiskIOMetric{ + expected := IOMetric{ AvgAwaitTime: 24.0 / 22.0, AvgReadAwaitTime: 1.2, AvgWriteAwaitTime: 1, } - var got DiskIOMetric - err := stat.CalIOStatistics(&got, counter) + + got, err := stat.CalcIOStatistics(counter) if err != nil { t.Fatal(err) } diff --git a/metricbeat/module/system/diskio/diskstat_other.go b/libbeat/metric/system/diskio/diskstat_other.go similarity index 79% rename from metricbeat/module/system/diskio/diskstat_other.go rename to libbeat/metric/system/diskio/diskstat_other.go index d2669117d9e..ad5208b1b4f 100644 --- a/metricbeat/module/system/diskio/diskstat_other.go +++ b/libbeat/metric/system/diskio/diskstat_other.go @@ -25,24 +25,24 @@ import ( ) // NewDiskIOStat :init DiskIOStat object. -func NewDiskIOStat() *DiskIOStat { - return &DiskIOStat{ +func NewDiskIOStat() *IOStat { + return &IOStat{ lastDiskIOCounters: map[string]disk.IOCountersStat{}, } } // OpenSampling stub for linux implementation. -func (stat *DiskIOStat) OpenSampling() error { +func (stat *IOStat) OpenSampling() error { return nil } -// CalIOStatistics stub for linux implementation. -func (stat *DiskIOStat) CalIOStatistics(result *DiskIOMetric, counter disk.IOCountersStat) error { - return errors.New("not implemented out of linux") +// CalcIOStatistics stub for linux implementation. +func (stat *IOStat) CalcIOStatistics(rcounter disk.IOCountersStat) (IOMetric, error) { + return IOMetric{}, errors.New("not implemented out of linux") } // CloseSampling stub for linux implementation. -func (stat *DiskIOStat) CloseSampling() {} +func (stat *IOStat) CloseSampling() {} // IOCounters should map functionality to disk package for linux os. func IOCounters(names ...string) (map[string]disk.IOCountersStat, error) { diff --git a/metricbeat/module/system/diskio/diskstat_windows.go b/libbeat/metric/system/diskio/diskstat_windows.go similarity index 78% rename from metricbeat/module/system/diskio/diskstat_windows.go rename to libbeat/metric/system/diskio/diskstat_windows.go index 1e2b363074b..665caab9130 100644 --- a/metricbeat/module/system/diskio/diskstat_windows.go +++ b/libbeat/metric/system/diskio/diskstat_windows.go @@ -25,24 +25,24 @@ import ( ) // NewDiskIOStat :init DiskIOStat object. -func NewDiskIOStat() *DiskIOStat { - return &DiskIOStat{ +func NewDiskIOStat() *IOStat { + return &IOStat{ lastDiskIOCounters: map[string]disk.IOCountersStat{}, } } // OpenSampling stub for linux implementation. -func (stat *DiskIOStat) OpenSampling() error { +func (stat *IOStat) OpenSampling() error { return nil } -// CalIOStatistics stub for linux implementation. -func (stat *DiskIOStat) CalIOStatistics(result *DiskIOMetric, counter disk.IOCountersStat) error { - return errors.New("iostat is not implement for Windows") +// CalcIOStatistics stub for linux implementation. +func (stat *IOStat) CalcIOStatistics(counter disk.IOCountersStat) (IOMetric, error) { + return IOMetric{}, errors.New("iostat is not implement for Windows") } // CloseSampling stub for linux implementation. -func (stat *DiskIOStat) CloseSampling() {} +func (stat *IOStat) CloseSampling() {} // IOCounters should map functionality to disk package for linux os. func IOCounters(names ...string) (map[string]disk.IOCountersStat, error) { diff --git a/metricbeat/module/system/diskio/diskstat_windows_helper.go b/libbeat/metric/system/diskio/diskstat_windows_helper.go similarity index 100% rename from metricbeat/module/system/diskio/diskstat_windows_helper.go rename to libbeat/metric/system/diskio/diskstat_windows_helper.go diff --git a/metricbeat/module/system/diskio/diskstat_windows_test.go b/libbeat/metric/system/diskio/diskstat_windows_test.go similarity index 100% rename from metricbeat/module/system/diskio/diskstat_windows_test.go rename to libbeat/metric/system/diskio/diskstat_windows_test.go diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index dc7c0c45d3e..7f1d0f69ab9 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -29167,6 +29167,7 @@ linux module [float] === linux +linux system metrics @@ -29264,6 +29265,147 @@ type: long -- +[float] +=== iostat + +iostat + + + +*`linux.iostat.read.request.merges_per_sec`*:: ++ +-- +The number of read requests merged per second that were queued to the device. + + +type: float + +-- + +*`linux.iostat.write.request.merges_per_sec`*:: ++ +-- +The number of write requests merged per second that were queued to the device. + + +type: float + +-- + +*`linux.iostat.read.request.per_sec`*:: ++ +-- +The number of read requests that were issued to the device per second + + +type: float + +-- + +*`linux.iostat.write.request.per_sec`*:: ++ +-- +The number of write requests that were issued to the device per second + + +type: float + +-- + +*`linux.iostat.read.per_sec.bytes`*:: ++ +-- +The number of Bytes read from the device per second. + + +type: float + +format: bytes + +-- + +*`linux.iostat.read.await`*:: ++ +-- +The average time spent for read requests issued to the device to be served. + + +type: float + +-- + +*`linux.iostat.write.per_sec.bytes`*:: ++ +-- +The number of Bytes write from the device per second. + + +type: float + +format: bytes + +-- + +*`linux.iostat.write.await`*:: ++ +-- +The average time spent for write requests issued to the device to be served. + + +type: float + +-- + +*`linux.iostat.request.avg_size`*:: ++ +-- +The average size (in bytes) of the requests that were issued to the device. + + +type: float + +-- + +*`linux.iostat.queue.avg_size`*:: ++ +-- +The average queue length of the requests that were issued to the device. + + +type: float + +-- + +*`linux.iostat.await`*:: ++ +-- +The average time spent for requests issued to the device to be served. + + +type: float + +-- + +*`linux.iostat.service_time`*:: ++ +-- +The average service time (in milliseconds) for I/O requests that were issued to the device. + + +type: float + +-- + +*`linux.iostat.busy`*:: ++ +-- +Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%. + + +type: float + +-- + [float] === ksm @@ -29338,6 +29480,186 @@ type: long -- +[float] +=== memory + +Linux memory data + + + +[float] +=== page_stats + +memory page statistics + + +*`linux.memory.page_stats.pgscan_kswapd.pages`*:: ++ +-- +pages scanned by kswapd + +type: long + +format: number + +-- + +*`linux.memory.page_stats.pgscan_direct.pages`*:: ++ +-- +pages scanned directly + +type: long + +format: number + +-- + +*`linux.memory.page_stats.pgfree.pages`*:: ++ +-- +pages freed by the system + +type: long + +format: number + +-- + +*`linux.memory.page_stats.pgsteal_kswapd.pages`*:: ++ +-- +number of pages reclaimed by kswapd + +type: long + +format: number + +-- + +*`linux.memory.page_stats.pgsteal_direct.pages`*:: ++ +-- +number of pages reclaimed directly + +type: long + +format: number + +-- + +*`linux.memory.page_stats.direct_efficiency.pct`*:: ++ +-- +direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory. + +type: scaled_float + +format: percent + +-- + +*`linux.memory.page_stats.kswapd_efficiency.pct`*:: ++ +-- +kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory. + +type: scaled_float + +format: percent + +-- + +[float] +=== hugepages + +This group contains statistics related to huge pages usage on the system. + + +*`linux.memory.hugepages.total`*:: ++ +-- +Number of huge pages in the pool. + + +type: long + +format: number + +-- + +*`linux.memory.hugepages.used.bytes`*:: ++ +-- +Memory used in allocated huge pages. + + +type: long + +format: bytes + +-- + +*`linux.memory.hugepages.used.pct`*:: ++ +-- +Percentage of huge pages used. + + +type: long + +format: percent + +-- + +*`linux.memory.hugepages.free`*:: ++ +-- +Number of available huge pages in the pool. + + +type: long + +format: number + +-- + +*`linux.memory.hugepages.reserved`*:: ++ +-- +Number of reserved but not allocated huge pages in the pool. + + +type: long + +format: number + +-- + +*`linux.memory.hugepages.surplus`*:: ++ +-- +Number of overcommited huge pages. + + +type: long + +format: number + +-- + +*`linux.memory.hugepages.default_size`*:: ++ +-- +Default size for huge pages. + + +type: long + +format: bytes + +-- + [float] === pageinfo @@ -40709,7 +41031,7 @@ type: long *`system.fsstat.total_files`*:: + -- -Total number of files. +Total number of files. Not on Windows. type: long @@ -41571,7 +41893,7 @@ format: bytes *`system.process.memory.rss.bytes`*:: + -- -The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes. +The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes. Not available on Windows. type: long @@ -41583,7 +41905,31 @@ format: bytes *`system.process.memory.rss.pct`*:: + -- -The percentage of memory the process occupied in main memory (RAM). +The percentage of memory the process occupied in main memory (RAM). Not available on Windows. + + +type: scaled_float + +format: percent + +-- + +*`system.process.memory.wss.bytes`*:: ++ +-- +The Working Set Size. The amount of memory the process occupied in main memory (RAM). Windows only. + + +type: long + +format: bytes + +-- + +*`system.process.memory.wss.pct`*:: ++ +-- +The percentage of memory the process occupied in main memory (RAM). Windows only. type: scaled_float @@ -41595,7 +41941,7 @@ format: percent *`system.process.memory.share`*:: + -- -The shared memory the process uses. +The shared memory the process uses. Not available on Windows. type: long diff --git a/metricbeat/docs/modules/linux.asciidoc b/metricbeat/docs/modules/linux.asciidoc index d63528730cb..ab911885afd 100644 --- a/metricbeat/docs/modules/linux.asciidoc +++ b/metricbeat/docs/modules/linux.asciidoc @@ -22,8 +22,10 @@ metricbeat.modules: period: 10s metricsets: - "pageinfo" + - "memory" # - ksm # - conntrack + # - iostat enabled: true #hostfs: /hostfs @@ -36,13 +38,21 @@ The following metricsets are available: * <> +* <> + * <> +* <> + * <> include::linux/conntrack.asciidoc[] +include::linux/iostat.asciidoc[] + include::linux/ksm.asciidoc[] +include::linux/memory.asciidoc[] + include::linux/pageinfo.asciidoc[] diff --git a/metricbeat/docs/modules/linux/iostat.asciidoc b/metricbeat/docs/modules/linux/iostat.asciidoc new file mode 100644 index 00000000000..7a41297b819 --- /dev/null +++ b/metricbeat/docs/modules/linux/iostat.asciidoc @@ -0,0 +1,23 @@ +//// +This file is generated! See scripts/mage/docs_collector.go +//// + +[[metricbeat-metricset-linux-iostat]] +=== linux iostat metricset + +beta[] + +include::../../../module/linux/iostat/_meta/docs.asciidoc[] + + +==== Fields + +For a description of each field in the metricset, see the +<> section. + +Here is an example document generated by this metricset: + +[source,json] +---- +include::../../../module/linux/iostat/_meta/data.json[] +---- diff --git a/metricbeat/docs/modules/linux/memory.asciidoc b/metricbeat/docs/modules/linux/memory.asciidoc new file mode 100644 index 00000000000..9ea3d482e57 --- /dev/null +++ b/metricbeat/docs/modules/linux/memory.asciidoc @@ -0,0 +1,24 @@ +//// +This file is generated! See scripts/mage/docs_collector.go +//// + +[[metricbeat-metricset-linux-memory]] +=== linux memory metricset + +beta[] + +include::../../../module/linux/memory/_meta/docs.asciidoc[] + +This is a default metricset. If the host module is unconfigured, this metricset is enabled by default. + +==== Fields + +For a description of each field in the metricset, see the +<> section. + +Here is an example document generated by this metricset: + +[source,json] +---- +include::../../../module/linux/memory/_meta/data.json[] +---- diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index 5ff2305665f..b37f7f831a3 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -176,8 +176,10 @@ This file is generated! See scripts/mage/docs_collector.go .2+| .2+| |<> beta[] |<> beta[] |<> beta[] |image:./images/icon-no.png[No prebuilt dashboards] | -.3+| .3+| |<> beta[] +.5+| .5+| |<> beta[] +|<> beta[] |<> beta[] +|<> beta[] |<> beta[] |<> |image:./images/icon-no.png[No prebuilt dashboards] | .2+| .2+| |<> diff --git a/metricbeat/include/list_common.go b/metricbeat/include/list_common.go index 39fadeea0e0..b77bb57f9a6 100644 --- a/metricbeat/include/list_common.go +++ b/metricbeat/include/list_common.go @@ -95,7 +95,9 @@ import ( _ "github.com/elastic/beats/v7/metricbeat/module/kvm/status" _ "github.com/elastic/beats/v7/metricbeat/module/linux" _ "github.com/elastic/beats/v7/metricbeat/module/linux/conntrack" + _ "github.com/elastic/beats/v7/metricbeat/module/linux/iostat" _ "github.com/elastic/beats/v7/metricbeat/module/linux/ksm" + _ "github.com/elastic/beats/v7/metricbeat/module/linux/memory" _ "github.com/elastic/beats/v7/metricbeat/module/linux/pageinfo" _ "github.com/elastic/beats/v7/metricbeat/module/logstash" _ "github.com/elastic/beats/v7/metricbeat/module/logstash/node" diff --git a/metricbeat/metricbeat.reference.yml b/metricbeat/metricbeat.reference.yml index 9b6f37eb447..9df18e4d7f9 100644 --- a/metricbeat/metricbeat.reference.yml +++ b/metricbeat/metricbeat.reference.yml @@ -572,8 +572,10 @@ metricbeat.modules: period: 10s metricsets: - "pageinfo" + - "memory" # - ksm # - conntrack + # - iostat enabled: true #hostfs: /hostfs diff --git a/metricbeat/module/linux/_meta/config.yml b/metricbeat/module/linux/_meta/config.yml index e00fe571846..490d3245c19 100644 --- a/metricbeat/module/linux/_meta/config.yml +++ b/metricbeat/module/linux/_meta/config.yml @@ -2,8 +2,10 @@ period: 10s metricsets: - "pageinfo" + - "memory" # - ksm # - conntrack + # - iostat enabled: true #hostfs: /hostfs diff --git a/metricbeat/module/linux/_meta/fields.yml b/metricbeat/module/linux/_meta/fields.yml index c3fe9657e89..44236f625e9 100644 --- a/metricbeat/module/linux/_meta/fields.yml +++ b/metricbeat/module/linux/_meta/fields.yml @@ -7,4 +7,5 @@ - name: linux type: group description: > + linux system metrics fields: diff --git a/metricbeat/module/linux/fields.go b/metricbeat/module/linux/fields.go index e4935eb2d7f..90e7e3ed940 100644 --- a/metricbeat/module/linux/fields.go +++ b/metricbeat/module/linux/fields.go @@ -32,5 +32,5 @@ func init() { // AssetLinux returns asset data. // This is the base64 encoded gzipped contents of module/linux. func AssetLinux() string { - return "eJy8l0tv4zYQx+/+FIMcF91Hsm8fCgTdRVEUKYIGe+mhwogcWawpUuWQybqfviBl2YoiOUpTiZcgIfWfn/6ch/IStrRbg1YmfF8BeOU1reEs/X62AnCkCZnWkJPHFYAkFk7VXlmzhh9XANA8C5WVQdMKoFCkJa/T1kswWNFRPi6/q2kNG2dDvf/LgOZ9ma6UsMZ4h2J72BmSjKuP3q7BcM0aEu+DdGE4VBW63b29MZxHQse1lwNbgCmyAwywR6/YK8E/pDMkAYWzzPDT9TcQ1hH3tIagu+DS2T7bkVxbsxnYfAQ+rhrFljwn+ZokyEDg7dFWKFBpFRyNghE6vctmwjtykPFO0RHUW6hwS+CsraCwDgzdgTUPfO2ANgozULZsyoAvqQPtMdfjzhU2GDkDDgchiLkIWu+ACZ0oSY6+fkujNsYOXPP/l2JMZAC1I5S75BEJ31wk9u65X54dSMPkfBaTkuaw7rdQ5eRiObd3eleSI9CK/T54+6NhgBOot6jVMyEfyj9w1JfoQaAx1kNOkFwc8ObQAFM+ZI7Yo/MzWJhyHrS121BH+5QoocR0zznBPu6x0zTHHbH6p5OcLe2Wqzmmxn3Zk/PCo+/XzH+eFr/eXHUmwxMHQI0b4oxLdLNk/k0SbqLERhaYXk1gUYPxng2jPDHs9Ztoj8EEM5s134z6O9AJjAoPGLdWo1cDTf/5GNfpakSJZhNd8dZCgez3hdW8/bhLcRpkLNDMMQCPbdOrihgqcptU1006lXhLkMdmFQHMKUxO/SAzVlImSlSz4DZOpsaZ0BxhGpEVfs8icZvZ0zBlqOf1VIZaK4GxacYO0svDbhkoU9g5+uWA9qmmmQcpd1nvgXGgCYZ8QY9QOFvB69pZ8TpFiAEasVgPgQ/tK9+BdZLcEzvsl6vL0XscYp7AndivLhNXeomBE2NYXbSzN2eD+4+k2UTCROGIQJTBbDnm3MWfb15cX/78Nbv55Y+vp9HOF0c7n4p2sTjaxVS0t4ujvZ2K9m5xtHdT0d4vjvZ+KtqHxdE+TEX7uDjax6lonxZH+zQV7fPiaJ8nt9zlx8H52DxooeK3EL96MTjxbf4Xif4/mxNIfsc7QK2twHgK0sDvfAXEqRoD3PvSWP0bAAD//4Pi/m8=" + return "eJzEmd9v2zgSx9/zVwwCHNAWVzfp7/rhgNylOBR3uQu27csudoUxObK5pkiVP+y6f/2CpBXLtmQrcaT6pWgkz3z4neHMkH4Oc1qNQQrlv58BOOEkjeE8/v/8DMCQJLQ0hgk5PAPgZJkRpRNajeEfZwCQvguF5l7SGUAuSHI7jo+eg8KCNubDx61KGsPUaF+u/9Jgc2PXrqyjAgpyRjC7flj3UffDtFLOIJvfPWnyFz6766o+LSzh02R8F6QOY31RoFltPWvDOeI6fNbmQOeg8uwOBqxDJ6wTzP49vkMckBltLfzr9iswbcju2GqCroNzo3fZNuRSq2nDwyPw4VMim5Oz0XxJHLgncHojK+QopPCGWsEIjVxlPeFtOEg5I2gD6jQUOCcwWheQawOKlqDVnq410GShB8qKTShwM6pBO5zIduVy7RXvAcd6xsja3Eu5Akto2Ix46/IrGjFVuiHMj5dilkgBSkPIV1EjYi4FEnfivLs9a5DKknFZSErqQ7r/+WJCJmznKqbLGRkCKaxbO6/+SQxwAHWBUpwIuW9+T1E3QwcMldIOJgRRxQZt7gpgzIfMkHVoXA8SxpwHqfXcl0E+wWYwwxjnCcHa76bSpNcNWfGjlpx3IupQSftoHHuWD3WNkLMjQ988WTcqyEzJZiWZzBJr7CS51Lir7VHpvswI1F3+BZewdmkh+uRQkgFLTCuewr4MufnNk0/7KBQfTgvBaNS4jKURjgZeR/T52AvZiseggdjQCmv3aGvr6hCAYZU/jTwqvgYeTVZur5E8GvY/g/Gkem500cw42p2etCnQjWGfbGsBuESxi3ciOC7I4JTAiYLAlqRcnEa2s6ZR8VQQLZkF8UP7dUDVU8o8puxpCcPpvpP0DxS+2qG4mGahMfWDHizDE6GSfE9DGAJlxx3bTB5raM/c0QdIUlM3exToIbflaYkRnglGWTDbU1IkDwk8JEchpBRp+9mncRGfXvz/NL0n3jafgB9Ef0uGkXIBXufxfBvZuTdCTdcD4BZyexN6MkHFl4K7GXgnpPiBwW1c9OatpyO4Tq9bdN6kVzRj3sRpPUzEwsICpQ9egEltY2gvLy7+ttFjb9Sc26KPOXPb7MGrCYeuub4/4GLiP59vapcQ97xrKDEMhnaGppdD1udoOHkJZ2ZvabexNLGIRn8nw4jQ+Nb2k7djMF71Js1XJb55OoBR4B3GQkt0ouF+4XSM2xgaNkM1Dao4rSFH66oCGVffrlLupcwsQ9XHXcvmhB6qTDpQxCNkSqcZLggm4VwcANQhTBuPnpnSnDI2Q9ELblIyFumIZgjjbUyB37NAXGV2N0zuy3415b6UgmE4n4cKspOHFVJBhd66pHm0avnfdG0d7QPHra8dqp1JyocX0LXHMnbgB5fNaci5bG6XWPJR1O6+waoG6jSYH4tmSvl1osNkBcn1MUAuDDE3PGDyK9tv98ppboiGAwveom5huEi/aRzSzhHKAaO7OZwlWkNMoii6RjrSDhfqdtqjYU8vZJTngglSbDUqWfvNpGUoiWdNo2qdukxT6THs5LuihQ1DZQCnNIIrkHpJpvY3EIrHQmlryRPGTeuMn05lapt3dlN9aS/yKZw/R4Lk+6dIUC1/5qfUlKPt1bs0lIvvYzj/Larw+/mh6v4lHAiiFWBaudDqa1U+9Clc/xIRQNYJ7G080aja4vauP440BKcdyn633bGGXlvQ+tepUmvZnojeEm+8aerM3fblDtg3qQsHhkCLUuo0i2xWcYT80K45wt1xt7SMeVtn4K0sOjgpG7r3+P64+YELFDLOz/fNFEPpouTn8lcUMPEOlHaNSdNtQdabUvqe2+Sx9egFGaaLQnRNe045eumarvs6o5+wZa+T+3SXmWvTyFyf0oXKdR8nhwbbhw4ME8/5Ktv5QjtQBzWu0WG6On9RGs1eRA/BQTIWumEsbCkjJyvQhu/ly7GOcn1z1RrkJuYO3JH95iqdfa63j1zHsOpo5xe7PXgbryUHOxJGCkMEbObV3Iat8vKPi2e3V//+mH3+9OvHw2iXg6NddkV7OTjay65orwZHe9UV7fXgaK+7or0ZHO1NV7S3g6O97Yr2bnC0d13R3g+O9r4r2ofB0T50LrnDt4PLtn5QQSnNyY6eNXZ8PfmT9g4PHUh+wWU1cwqtIDb82hQQumpwsDVpnP0VAAD//2DzKvg=" } diff --git a/metricbeat/module/linux/iostat/_meta/data.json b/metricbeat/module/linux/iostat/_meta/data.json new file mode 100644 index 00000000000..99f23d8cc95 --- /dev/null +++ b/metricbeat/module/linux/iostat/_meta/data.json @@ -0,0 +1,49 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "event": { + "dataset": "linux.iostat", + "duration": 115000, + "module": "linux" + }, + "linux": { + "iostat": { + "await": 0, + "busy": 0, + "name": "sr0", + "queue": { + "avg_size": 0 + }, + "read": { + "await": 0, + "per_sec": { + "bytes": 0 + }, + "request": { + "merges_per_sec": 0, + "per_sec": 0 + } + }, + "request": { + "avg_size": 0 + }, + "service_time": 0, + "write": { + "await": 0, + "per_sec": { + "bytes": 0 + }, + "request": { + "merges_per_sec": 0, + "per_sec": 0 + } + } + } + }, + "metricset": { + "name": "iostat", + "period": 10000 + }, + "service": { + "type": "linux" + } +} \ No newline at end of file diff --git a/metricbeat/module/linux/iostat/_meta/docs.asciidoc b/metricbeat/module/linux/iostat/_meta/docs.asciidoc new file mode 100644 index 00000000000..ec4c4de1618 --- /dev/null +++ b/metricbeat/module/linux/iostat/_meta/docs.asciidoc @@ -0,0 +1,3 @@ +The iostat module reports per-disk IO statistics that emulate `iostat -x` on linux. + +NOTE: as of now, this data is part of system/diskio on Metricbeat, but can only be found in the Linux integration in Fleet. In the future, this data will be removed from system/memory. \ No newline at end of file diff --git a/metricbeat/module/linux/iostat/_meta/fields.yml b/metricbeat/module/linux/iostat/_meta/fields.yml new file mode 100644 index 00000000000..a7ded63f8fc --- /dev/null +++ b/metricbeat/module/linux/iostat/_meta/fields.yml @@ -0,0 +1,61 @@ +- name: iostat + type: group + release: beta + description: > + iostat + fields: + - name: read.request.merges_per_sec + type: float + description: > + The number of read requests merged per second that were queued to the device. + - name: write.request.merges_per_sec + type: float + description: > + The number of write requests merged per second that were queued to the device. + - name: read.request.per_sec + type: float + description: > + The number of read requests that were issued to the device per second + - name: write.request.per_sec + type: float + description: > + The number of write requests that were issued to the device per second + - name: read.per_sec.bytes + type: float + description: > + The number of Bytes read from the device per second. + format: bytes + - name: read.await + type: float + description: > + The average time spent for read requests issued to the device to be served. + - name: write.per_sec.bytes + type: float + description: > + The number of Bytes write from the device per second. + format: bytes + - name: write.await + type: float + description: > + The average time spent for write requests issued to the device to be served. + - name: request.avg_size + type: float + description: > + The average size (in bytes) of the requests that were issued to the device. + - name: queue.avg_size + type: float + description: > + The average queue length of the requests that were issued to the device. + - name: await + type: float + description: > + The average time spent for requests issued to the device to be served. + - name: service_time + type: float + description: > + The average service time (in milliseconds) for I/O requests that were issued to the device. + - name: busy + type: float + description: > + Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%. + diff --git a/metricbeat/module/linux/iostat/data.go b/metricbeat/module/linux/iostat/data.go new file mode 100644 index 00000000000..4e546deaa34 --- /dev/null +++ b/metricbeat/module/linux/iostat/data.go @@ -0,0 +1,58 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package iostat + +import ( + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/metric/system/diskio" +) + +// AddLinuxIOStat adds the linux iostat data to the provided map +func AddLinuxIOStat(extraMetrics diskio.IOMetric) common.MapStr { + return common.MapStr{ + "read": common.MapStr{ + "request": common.MapStr{ + "merges_per_sec": extraMetrics.ReadRequestMergeCountPerSec, + "per_sec": extraMetrics.ReadRequestCountPerSec, + }, + "per_sec": common.MapStr{ + "bytes": extraMetrics.ReadBytesPerSec, + }, + "await": extraMetrics.AvgReadAwaitTime, + }, + "write": common.MapStr{ + "request": common.MapStr{ + "merges_per_sec": extraMetrics.WriteRequestMergeCountPerSec, + "per_sec": extraMetrics.WriteRequestCountPerSec, + }, + "per_sec": common.MapStr{ + "bytes": extraMetrics.WriteBytesPerSec, + }, + "await": extraMetrics.AvgWriteAwaitTime, + }, + "queue": common.MapStr{ + "avg_size": extraMetrics.AvgQueueSize, + }, + "request": common.MapStr{ + "avg_size": extraMetrics.AvgRequestSize, + }, + "await": extraMetrics.AvgAwaitTime, + "service_time": extraMetrics.AvgServiceTime, + "busy": extraMetrics.BusyPct, + } +} diff --git a/metricbeat/module/linux/iostat/iostat.go b/metricbeat/module/linux/iostat/iostat.go new file mode 100644 index 00000000000..049b4daadf7 --- /dev/null +++ b/metricbeat/module/linux/iostat/iostat.go @@ -0,0 +1,104 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package iostat + +import ( + "github.com/pkg/errors" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/cfgwarn" + "github.com/elastic/beats/v7/libbeat/metric/system/diskio" + "github.com/elastic/beats/v7/metricbeat/mb" +) + +// init registers the MetricSet with the central registry as soon as the program +// starts. The New function will be called later to instantiate an instance of +// the MetricSet for each host defined in the module's configuration. After the +// MetricSet has been created then Fetch will begin to be called periodically. +func init() { + mb.Registry.MustAddMetricSet("linux", "iostat", New) +} + +// MetricSet holds any configuration or state information. It must implement +// the mb.MetricSet interface. And this is best achieved by embedding +// mb.BaseMetricSet because it implements all of the required mb.MetricSet +// interface methods except for Fetch. +type MetricSet struct { + mb.BaseMetricSet + stats *diskio.IOStat + includeDevices []string +} + +// New creates a new instance of the MetricSet. New is responsible for unpacking +// any MetricSet specific configuration options if there are any. +func New(base mb.BaseMetricSet) (mb.MetricSet, error) { + cfgwarn.Beta("The linux iostat metricset is beta.") + + config := struct { + IncludeDevices []string `config:"iostat.include_devices"` + }{IncludeDevices: []string{}} + if err := base.Module().UnpackConfig(&config); err != nil { + return nil, err + } + + return &MetricSet{ + BaseMetricSet: base, + includeDevices: config.IncludeDevices, + stats: diskio.NewDiskIOStat(), + }, nil +} + +// Fetch methods implements the data gathering and data conversion to the right +// format. It publishes the event which is then forwarded to the output. In case +// of an error set the Error field of mb.Event or simply call report.Error(). +func (m *MetricSet) Fetch(report mb.ReporterV2) error { + + IOstats, err := diskio.IOCounters(m.includeDevices...) + if err != nil { + return errors.Wrap(err, "disk io counters") + } + + // Sample the current cpu counter + m.stats.OpenSampling() + + // Store the last cpu counter when finished + defer m.stats.CloseSampling() + + for _, counters := range IOstats { + event := common.MapStr{ + "name": counters.Name, + } + if counters.SerialNumber != "" { + event["serial_number"] = counters.SerialNumber + } + result, err := m.stats.CalcIOStatistics(counters) + if err != nil { + return errors.Wrap(err, "error calculating iostat") + } + IOstats := AddLinuxIOStat(result) + event.DeepUpdate(IOstats) + + isOpen := report.Event(mb.Event{ + MetricSetFields: event, + }) + if !isOpen { + return nil + } + } + return nil +} diff --git a/metricbeat/module/linux/iostat/iostat_test.go b/metricbeat/module/linux/iostat/iostat_test.go new file mode 100644 index 00000000000..6a607fc66d4 --- /dev/null +++ b/metricbeat/module/linux/iostat/iostat_test.go @@ -0,0 +1,55 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build linux + +package iostat + +import ( + "testing" + + "github.com/stretchr/testify/assert" + + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" +) + +func TestFetch(t *testing.T) { + f := mbtest.NewReportingMetricSetV2Error(t, getConfig()) + events, errs := mbtest.ReportingFetchV2Error(f) + + assert.Empty(t, errs) + if !assert.NotEmpty(t, events) { + t.FailNow() + } + t.Logf("%s/%s event: %+v", f.Module().Name(), f.Name(), + events[0].BeatEvent("linux", "iostat").Fields.StringToPrint()) +} + +func TestData(t *testing.T) { + f := mbtest.NewReportingMetricSetV2Error(t, getConfig()) + err := mbtest.WriteEventsReporterV2Error(f, t, ".") + if err != nil { + t.Fatal("write", err) + } +} + +func getConfig() map[string]interface{} { + return map[string]interface{}{ + "module": "linux", + "metricsets": []string{"iostat"}, + } +} diff --git a/metricbeat/module/linux/memory/_meta/data.json b/metricbeat/module/linux/memory/_meta/data.json new file mode 100644 index 00000000000..79a3d431869 --- /dev/null +++ b/metricbeat/module/linux/memory/_meta/data.json @@ -0,0 +1,59 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "event": { + "dataset": "linux.memory", + "duration": 115000, + "module": "linux" + }, + "linux": { + "memory": { + "hugepages": { + "default_size": 2097152, + "free": 0, + "reserved": 0, + "surplus": 0, + "swap": { + "out": { + "fallback": 0, + "pages": 0 + } + }, + "total": 0, + "used": { + "bytes": 0, + "pct": 0 + } + }, + "page_stats": { + "direct_efficiency": { + "pct": 0.9228 + }, + "kswapd_efficiency": { + "pct": 0.7523 + }, + "pgfree": { + "pages": 16061818710 + }, + "pgscan_direct": { + "pages": 1198580 + }, + "pgscan_kswapd": { + "pages": 50222460 + }, + "pgsteal_direct": { + "pages": 1106083 + }, + "pgsteal_kswapd": { + "pages": 37782783 + } + } + } + }, + "metricset": { + "name": "memory", + "period": 10000 + }, + "service": { + "type": "linux" + } +} \ No newline at end of file diff --git a/metricbeat/module/linux/memory/_meta/docs.asciidoc b/metricbeat/module/linux/memory/_meta/docs.asciidoc new file mode 100644 index 00000000000..8b0bbaed750 --- /dev/null +++ b/metricbeat/module/linux/memory/_meta/docs.asciidoc @@ -0,0 +1,3 @@ +The memory metricset extends system/memory and adds linux-specific memory metrics, including Huge Pages and overall paging statistics. + +NOTE: as of now, this data is part of system/memory on Metricbeat, but can only be found in the Linux integration in Fleet. In the future, this data will be removed from system/memory. \ No newline at end of file diff --git a/metricbeat/module/linux/memory/_meta/fields.yml b/metricbeat/module/linux/memory/_meta/fields.yml new file mode 100644 index 00000000000..2490e69aa21 --- /dev/null +++ b/metricbeat/module/linux/memory/_meta/fields.yml @@ -0,0 +1,78 @@ +- name: memory + type: group + release: beta + description: > + Linux memory data + fields: + - name: page_stats + type: group + description: memory page statistics + fields: + - name: pgscan_kswapd.pages + type: long + format: number + description: pages scanned by kswapd + - name: pgscan_direct.pages + type: long + format: number + description: pages scanned directly + - name: pgfree.pages + type: long + format: number + description: pages freed by the system + - name: pgsteal_kswapd.pages + type: long + format: number + description: number of pages reclaimed by kswapd + - name: pgsteal_direct.pages + type: long + format: number + description: number of pages reclaimed directly + - name: direct_efficiency.pct + type: scaled_float + format: percent + description: direct reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory. + - name: kswapd_efficiency.pct + type: scaled_float + format: percent + description: kswapd reclaim efficiency percentage. A lower percentage indicates the system is struggling to reclaim memory. + - name: hugepages + type: group + prefix: "[float]" + description: This group contains statistics related to huge pages usage on the system. + fields: + - name: total + type: long + format: number + description: > + Number of huge pages in the pool. + - name: used.bytes + type: long + format: bytes + description: > + Memory used in allocated huge pages. + - name: used.pct + type: long + format: percent + description: > + Percentage of huge pages used. + - name: free + type: long + format: number + description: > + Number of available huge pages in the pool. + - name: reserved + type: long + format: number + description: > + Number of reserved but not allocated huge pages in the pool. + - name: surplus + type: long + format: number + description: > + Number of overcommited huge pages. + - name: default_size + type: long + format: bytes + description: > + Default size for huge pages. diff --git a/metricbeat/module/linux/memory/data.go b/metricbeat/module/linux/memory/data.go new file mode 100644 index 00000000000..d3f1a5ef2f8 --- /dev/null +++ b/metricbeat/module/linux/memory/data.go @@ -0,0 +1,99 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build darwin freebsd linux openbsd windows + +package memory + +import ( + "github.com/pkg/errors" + + "github.com/elastic/beats/v7/libbeat/common" + mem "github.com/elastic/beats/v7/libbeat/metric/system/memory" +) + +// FetchLinuxMemStats gets page_stat and huge pages data for linux +func FetchLinuxMemStats(baseMap common.MapStr) error { + + vmstat, err := mem.GetVMStat() + if err != nil { + return errors.Wrap(err, "VMStat") + } + + if vmstat != nil { + pageStats := common.MapStr{ + "pgscan_kswapd": common.MapStr{ + "pages": vmstat.PgscanKswapd, + }, + "pgscan_direct": common.MapStr{ + "pages": vmstat.PgscanDirect, + }, + "pgfree": common.MapStr{ + "pages": vmstat.Pgfree, + }, + "pgsteal_kswapd": common.MapStr{ + "pages": vmstat.PgstealKswapd, + }, + "pgsteal_direct": common.MapStr{ + "pages": vmstat.PgstealDirect, + }, + } + // This is similar to the vmeff stat gathered by sar + // these ratios calculate thhe efficiency of page reclaim + if vmstat.PgscanDirect != 0 { + pageStats["direct_efficiency"] = common.MapStr{ + "pct": common.Round(float64(vmstat.PgstealDirect)/float64(vmstat.PgscanDirect), common.DefaultDecimalPlacesCount), + } + } + + if vmstat.PgscanKswapd != 0 { + pageStats["kswapd_efficiency"] = common.MapStr{ + "pct": common.Round(float64(vmstat.PgstealKswapd)/float64(vmstat.PgscanKswapd), common.DefaultDecimalPlacesCount), + } + } + baseMap["page_stats"] = pageStats + } + + hugePagesStat, err := mem.GetHugeTLBPages() + if err != nil { + return errors.Wrap(err, "hugepages") + } + if hugePagesStat != nil { + mem.AddHugeTLBPagesPercentage(hugePagesStat) + thp := common.MapStr{ + "total": hugePagesStat.Total, + "used": common.MapStr{ + "bytes": hugePagesStat.TotalAllocatedSize, + "pct": hugePagesStat.UsedPercent, + }, + "free": hugePagesStat.Free, + "reserved": hugePagesStat.Reserved, + "surplus": hugePagesStat.Surplus, + "default_size": hugePagesStat.DefaultSize, + } + if vmstat != nil { + thp["swap"] = common.MapStr{ + "out": common.MapStr{ + "pages": vmstat.ThpSwpout, + "fallback": vmstat.ThpSwpoutFallback, + }, + } + } + baseMap["hugepages"] = thp + } + return nil +} diff --git a/metricbeat/module/linux/memory/memory.go b/metricbeat/module/linux/memory/memory.go new file mode 100644 index 00000000000..163e3bea771 --- /dev/null +++ b/metricbeat/module/linux/memory/memory.go @@ -0,0 +1,62 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package memory + +import ( + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/cfgwarn" + "github.com/elastic/beats/v7/metricbeat/mb" +) + +// init registers the MetricSet with the central registry as soon as the program +// starts. The New function will be called later to instantiate an instance of +// the MetricSet for each host defined in the module's configuration. After the +// MetricSet has been created then Fetch will begin to be called periodically. +func init() { + mb.Registry.MustAddMetricSet("linux", "memory", New, mb.DefaultMetricSet()) +} + +// MetricSet holds any configuration or state information. It must implement +// the mb.MetricSet interface. And this is best achieved by embedding +// mb.BaseMetricSet because it implements all of the required mb.MetricSet +// interface methods except for Fetch. +type MetricSet struct { + mb.BaseMetricSet +} + +// New creates a new instance of the MetricSet. New is responsible for unpacking +// any MetricSet specific configuration options if there are any. +func New(base mb.BaseMetricSet) (mb.MetricSet, error) { + cfgwarn.Beta("The linux memory metricset is beta.") + + return &MetricSet{ + BaseMetricSet: base, + }, nil +} + +// Fetch methods implements the data gathering and data conversion to the right +// format. It publishes the event which is then forwarded to the output. In case +// of an error set the Error field of mb.Event or simply call report.Error(). +func (m *MetricSet) Fetch(report mb.ReporterV2) error { + rootEvent := common.MapStr{} + FetchLinuxMemStats(rootEvent) + report.Event(mb.Event{ + MetricSetFields: rootEvent, + }) + return nil +} diff --git a/metricbeat/module/linux/memory/memory_test.go b/metricbeat/module/linux/memory/memory_test.go new file mode 100644 index 00000000000..2980c94841e --- /dev/null +++ b/metricbeat/module/linux/memory/memory_test.go @@ -0,0 +1,55 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build darwin freebsd linux openbsd windows + +package memory + +import ( + "testing" + + "github.com/stretchr/testify/assert" + + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" +) + +func TestFetch(t *testing.T) { + f := mbtest.NewReportingMetricSetV2Error(t, getConfig()) + events, errs := mbtest.ReportingFetchV2Error(f) + + assert.Empty(t, errs) + if !assert.NotEmpty(t, events) { + t.FailNow() + } + t.Logf("%s/%s event: %+v", f.Module().Name(), f.Name(), + events[0].BeatEvent("linux", "memory").Fields.StringToPrint()) +} + +func TestData(t *testing.T) { + f := mbtest.NewReportingMetricSetV2Error(t, getConfig()) + err := mbtest.WriteEventsReporterV2Error(f, t, ".") + if err != nil { + t.Fatal("write", err) + } +} + +func getConfig() map[string]interface{} { + return map[string]interface{}{ + "module": "linux", + "metricsets": []string{"memory"}, + } +} diff --git a/metricbeat/module/system/cpu/_meta/data.json b/metricbeat/module/system/cpu/_meta/data.json index 4a5fd7c8ff7..cb9548ec6e4 100644 --- a/metricbeat/module/system/cpu/_meta/data.json +++ b/metricbeat/module/system/cpu/_meta/data.json @@ -7,7 +7,7 @@ }, "host": { "cpu": { - "pct": 0.0816 + "pct": 0.1629 } }, "metricset": { @@ -19,68 +19,68 @@ }, "system": { "cpu": { - "cores": 12, + "cores": 4, "idle": { "norm": { - "pct": 0.9184 + "pct": 0.8371 }, - "pct": 11.0208, - "ticks": 1964402 + "pct": 3.3484, + "ticks": 806327077 }, "iowait": { "norm": { "pct": 0 }, "pct": 0, - "ticks": 5083 + "ticks": 312229 }, "irq": { "norm": { - "pct": 0 + "pct": 0.0125 }, - "pct": 0, - "ticks": 0 + "pct": 0.0501, + "ticks": 6548016 }, "nice": { "norm": { "pct": 0 }, "pct": 0, - "ticks": 9752 + "ticks": 517231 }, "softirq": { "norm": { - "pct": 0.0058 + "pct": 0.0025 }, - "pct": 0.0699, - "ticks": 10386 + "pct": 0.01, + "ticks": 1561223 }, "steal": { "norm": { "pct": 0 }, "pct": 0, - "ticks": 0 + "ticks": 156646 }, "system": { "norm": { - "pct": 0.005 + "pct": 0.0551 }, - "pct": 0.06, - "ticks": 22274 + "pct": 0.2206, + "ticks": 31037256 }, "total": { "norm": { - "pct": 0.0816 + "pct": 0.1629 }, - "pct": 0.9792 + "pct": 0.6516 }, "user": { "norm": { - "pct": 0.0708 + "pct": 0.0927 }, - "pct": 0.8493, - "ticks": 123767 + "pct": 0.3709, + "ticks": 139619320 } } } diff --git a/metricbeat/module/system/cpu/cpu.go b/metricbeat/module/system/cpu/cpu.go index 7333df6dec7..7650b65cd80 100644 --- a/metricbeat/module/system/cpu/cpu.go +++ b/metricbeat/module/system/cpu/cpu.go @@ -20,11 +20,8 @@ package cpu import ( - "strings" - "github.com/pkg/errors" - "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/metric/system/cpu" "github.com/elastic/beats/v7/metricbeat/mb" "github.com/elastic/beats/v7/metricbeat/mb/parse" @@ -69,50 +66,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { return errors.Wrap(err, "failed to fetch CPU times") } - event := common.MapStr{"cores": cpu.NumCores} - hostFields := common.MapStr{} - for _, metric := range m.config.Metrics { - switch strings.ToLower(metric) { - case percentages: - pct := sample.Percentages() - event.Put("user.pct", pct.User) - event.Put("system.pct", pct.System) - event.Put("idle.pct", pct.Idle) - event.Put("iowait.pct", pct.IOWait) - event.Put("irq.pct", pct.IRQ) - event.Put("nice.pct", pct.Nice) - event.Put("softirq.pct", pct.SoftIRQ) - event.Put("steal.pct", pct.Steal) - event.Put("total.pct", pct.Total) - case normalizedPercentages: - normalizedPct := sample.NormalizedPercentages() - event.Put("user.norm.pct", normalizedPct.User) - event.Put("system.norm.pct", normalizedPct.System) - event.Put("idle.norm.pct", normalizedPct.Idle) - event.Put("iowait.norm.pct", normalizedPct.IOWait) - event.Put("irq.norm.pct", normalizedPct.IRQ) - event.Put("nice.norm.pct", normalizedPct.Nice) - event.Put("softirq.norm.pct", normalizedPct.SoftIRQ) - event.Put("steal.norm.pct", normalizedPct.Steal) - event.Put("total.norm.pct", normalizedPct.Total) - hostFields.Put("host.cpu.pct", normalizedPct.Total) - case ticks: - ticks := sample.Ticks() - event.Put("user.ticks", ticks.User) - event.Put("system.ticks", ticks.System) - event.Put("idle.ticks", ticks.Idle) - event.Put("iowait.ticks", ticks.IOWait) - event.Put("irq.ticks", ticks.IRQ) - event.Put("nice.ticks", ticks.Nice) - event.Put("softirq.ticks", ticks.SoftIRQ) - event.Put("steal.ticks", ticks.Steal) - } - } - - r.Event(mb.Event{ - RootFields: hostFields, - MetricSetFields: event, - }) + r.Event(collectCPUMetrics(m.config.Metrics, sample)) return nil } diff --git a/metricbeat/module/system/cpu/data.go b/metricbeat/module/system/cpu/data.go new file mode 100644 index 00000000000..497a91a6173 --- /dev/null +++ b/metricbeat/module/system/cpu/data.go @@ -0,0 +1,112 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build darwin freebsd linux openbsd windows + +package cpu + +import ( + "runtime" + "strings" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/metric/system/cpu" + "github.com/elastic/beats/v7/metricbeat/mb" +) + +// CPU metrics are highly OS-specific, so we need to build the event per-OS +func getPlatformCPUMetrics(sample *cpu.Metrics, selectors []string, event common.MapStr) { + for _, metric := range selectors { + switch strings.ToLower(metric) { + case percentages: + pct := sample.Percentages() + event.Put("user.pct", pct.User) + event.Put("system.pct", pct.System) + event.Put("idle.pct", pct.Idle) + event.Put("total.pct", pct.Total) + + if runtime.GOOS != "windows" { + event.Put("nice.pct", pct.Nice) + } + if runtime.GOOS == "linux" || runtime.GOOS == "openbsd" { + event.Put("irq.pct", pct.IRQ) + } + if runtime.GOOS == "linux" || runtime.GOOS == "aix" { + event.Put("iowait.pct", pct.IOWait) + } + if runtime.GOOS == "linux" { + event.Put("softirq.pct", pct.SoftIRQ) + event.Put("steal.pct", pct.Steal) + } + case normalizedPercentages: + normalizedPct := sample.NormalizedPercentages() + event.Put("user.norm.pct", normalizedPct.User) + event.Put("system.norm.pct", normalizedPct.System) + event.Put("idle.norm.pct", normalizedPct.Idle) + event.Put("total.norm.pct", normalizedPct.Total) + + if runtime.GOOS != "windows" { + event.Put("nice.norm.pct", normalizedPct.Nice) + } + if runtime.GOOS == "linux" || runtime.GOOS == "openbsd" { + event.Put("irq.norm.pct", normalizedPct.IRQ) + } + if runtime.GOOS == "linux" || runtime.GOOS == "aix" { + event.Put("iowait.norm.pct", normalizedPct.IOWait) + } + if runtime.GOOS == "linux" { + event.Put("softirq.norm.pct", normalizedPct.SoftIRQ) + event.Put("steal.norm.pct", normalizedPct.Steal) + } + case ticks: + ticks := sample.Ticks() + event.Put("user.ticks", ticks.User) + event.Put("system.ticks", ticks.System) + event.Put("idle.ticks", ticks.Idle) + + if runtime.GOOS != "windows" { + event.Put("nice.ticks", ticks.Nice) + } + if runtime.GOOS == "linux" || runtime.GOOS == "openbsd" { + event.Put("irq.ticks", ticks.IRQ) + } + if runtime.GOOS == "linux" || runtime.GOOS == "aix" { + event.Put("iowait.ticks", ticks.IOWait) + } + if runtime.GOOS == "linux" { + event.Put("softirq.ticks", ticks.SoftIRQ) + event.Put("steal.ticks", ticks.Steal) + } + } + } +} + +// gather CPU metrics +func collectCPUMetrics(selectors []string, sample *cpu.Metrics) mb.Event { + event := common.MapStr{"cores": cpu.NumCores} + getPlatformCPUMetrics(sample, selectors, event) + + //generate the host fields here, since we don't want users disabling it. + normalizedPct := sample.NormalizedPercentages() + hostFields := common.MapStr{} + hostFields.Put("host.cpu.pct", normalizedPct.Total) + + return mb.Event{ + RootFields: hostFields, + MetricSetFields: event, + } +} diff --git a/metricbeat/module/system/diskio/_meta/data.json b/metricbeat/module/system/diskio/_meta/data.json index b9c8533b0c8..a2301ef8888 100644 --- a/metricbeat/module/system/diskio/_meta/data.json +++ b/metricbeat/module/system/diskio/_meta/data.json @@ -15,7 +15,7 @@ "system": { "diskio": { "io": { - "time": 364 + "time": 601740 }, "iostat": { "await": 0, @@ -48,16 +48,16 @@ } } }, - "name": "loop1", + "name": "sdb1", "read": { - "bytes": 5267456, - "count": 4124, - "time": 557 + "bytes": 25128030208, + "count": 3146154, + "time": 833872 }, "write": { - "bytes": 0, - "count": 0, - "time": 0 + "bytes": 34401640448, + "count": 861040, + "time": 11224168 } } } diff --git a/metricbeat/module/system/diskio/diskio.go b/metricbeat/module/system/diskio/diskio.go index 9da3a3c2344..1359180cff6 100644 --- a/metricbeat/module/system/diskio/diskio.go +++ b/metricbeat/module/system/diskio/diskio.go @@ -20,9 +20,14 @@ package diskio import ( + "fmt" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/metric/system/diskio" "github.com/elastic/beats/v7/metricbeat/mb" "github.com/elastic/beats/v7/metricbeat/mb/parse" + "github.com/elastic/beats/v7/metricbeat/module/linux/iostat" + "github.com/elastic/beats/v7/metricbeat/module/system" "github.com/pkg/errors" ) @@ -36,9 +41,10 @@ func init() { // MetricSet for fetching system disk IO metrics. type MetricSet struct { mb.BaseMetricSet - statistics *DiskIOStat + statistics *diskio.IOStat includeDevices []string prevCounters diskCounter + IsAgent bool } // diskCounter stores previous disk counter values for calculating gauges in next collection @@ -57,17 +63,23 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { return nil, err } + systemModule, ok := base.Module().(*system.Module) + if !ok { + return nil, fmt.Errorf("unexpected module type") + } + return &MetricSet{ BaseMetricSet: base, - statistics: NewDiskIOStat(), + statistics: diskio.NewDiskIOStat(), includeDevices: config.IncludeDevices, prevCounters: diskCounter{}, + IsAgent: systemModule.IsAgent, }, nil } // Fetch fetches disk IO metrics from the OS. func (m *MetricSet) Fetch(r mb.ReporterV2) error { - stats, err := IOCounters(m.includeDevices...) + stats, err := diskio.IOCounters(m.includeDevices...) if err != nil { return errors.Wrap(err, "disk io counters") } @@ -101,40 +113,13 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { diskReadBytes += counters.ReadBytes diskWriteBytes += counters.WriteBytes - var extraMetrics DiskIOMetric - err := m.statistics.CalIOStatistics(&extraMetrics, counters) - if err == nil { - event["iostat"] = common.MapStr{ - "read": common.MapStr{ - "request": common.MapStr{ - "merges_per_sec": extraMetrics.ReadRequestMergeCountPerSec, - "per_sec": extraMetrics.ReadRequestCountPerSec, - }, - "per_sec": common.MapStr{ - "bytes": extraMetrics.ReadBytesPerSec, - }, - "await": extraMetrics.AvgReadAwaitTime, - }, - "write": common.MapStr{ - "request": common.MapStr{ - "merges_per_sec": extraMetrics.WriteRequestMergeCountPerSec, - "per_sec": extraMetrics.WriteRequestCountPerSec, - }, - "per_sec": common.MapStr{ - "bytes": extraMetrics.WriteBytesPerSec, - }, - "await": extraMetrics.AvgWriteAwaitTime, - }, - "queue": common.MapStr{ - "avg_size": extraMetrics.AvgQueueSize, - }, - "request": common.MapStr{ - "avg_size": extraMetrics.AvgRequestSize, - }, - "await": extraMetrics.AvgAwaitTime, - "service_time": extraMetrics.AvgServiceTime, - "busy": extraMetrics.BusyPct, + //Add linux-only data if agent is off as not to make breaking changes. + if !m.IsAgent { + result, err := m.statistics.CalcIOStatistics(counters) + if err != nil { + return errors.Wrap(err, "error calculating iostat") } + event["iostat"] = iostat.AddLinuxIOStat(result) } if counters.SerialNumber != "" { diff --git a/metricbeat/module/system/diskio/diskio_test.go b/metricbeat/module/system/diskio/diskio_test.go index aabc44c374b..b5494ac4bfe 100644 --- a/metricbeat/module/system/diskio/diskio_test.go +++ b/metricbeat/module/system/diskio/diskio_test.go @@ -27,8 +27,48 @@ import ( "github.com/stretchr/testify/assert" mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + "github.com/elastic/beats/v7/metricbeat/module/system" ) +func TestDataNameFilter(t *testing.T) { + oldFS := system.HostFS + newFS := "_meta/testdata" + system.HostFS = &newFS + defer func() { + system.HostFS = oldFS + }() + + conf := map[string]interface{}{ + "module": "system", + "metricsets": []string{"diskio"}, + "diskio.include_devices": []string{"sda", "sda1", "sda2"}, + } + + f := mbtest.NewReportingMetricSetV2Error(t, conf) + data, errs := mbtest.ReportingFetchV2Error(f) + assert.Empty(t, errs) + assert.Equal(t, 3, len(data)) +} + +func TestDataEmptyFilter(t *testing.T) { + oldFS := system.HostFS + newFS := "_meta/testdata" + system.HostFS = &newFS + defer func() { + system.HostFS = oldFS + }() + + conf := map[string]interface{}{ + "module": "system", + "metricsets": []string{"diskio"}, + } + + f := mbtest.NewReportingMetricSetV2Error(t, conf) + data, errs := mbtest.ReportingFetchV2Error(f) + assert.Empty(t, errs) + assert.Equal(t, 10, len(data)) +} + func TestFetch(t *testing.T) { f := mbtest.NewReportingMetricSetV2Error(t, getConfig()) events, errs := mbtest.ReportingFetchV2Error(f) diff --git a/metricbeat/module/system/fields.go b/metricbeat/module/system/fields.go index 28135f5fa95..d78002d2847 100644 --- a/metricbeat/module/system/fields.go +++ b/metricbeat/module/system/fields.go @@ -32,5 +32,5 @@ func init() { // AssetSystem returns asset data. // This is the base64 encoded gzipped contents of module/system. func AssetSystem() string { - return "eJzsff+PGzey5+/5KwgfFhm/m5E93mxe3vxwgON5uRvAWQ9sB+8Bh4NMdZck7rDJDsmWrPz1BxbZ39nqbqmlkYMMFtlkRiI/VSwW6xuLN+QJdndE77SB5DtCDDMc7siLT/iLF98REoOOFEsNk+KO/K/vCCHE/ZFoQ02mSQJGsUhfE86egLx7/I1QEZMEEql2JNN0BdfErKkhVAGJJOcQGYjJUsmEmDUQmYKihomVRzH7jhC9lsrMIymWbHVHjMrgO0IUcKAa7siKfkfIkgGP9R0CuiGCJlAhw/6YXWo/q2SW+t8ESLE/X9zXvpBICkOZ0ITLiHI/Wk7fzH++Om917kgqKH4Zmn0PggqKGztOBYrlp0dAllIRSjQTKw44H5FLQkmSccPwexUO5j91puU/TSKqhLC49uucFC7FqvGHPdTYHwv9nUUlsmQBqkRV++T/II+gIhCGrkAHAWUa1CyNTBCWjiiHeL7kkjY/sJQqoeaOpG78ceA/ryH/Il0hoy05hiVAdArCECYQGNEpjaCDthoFhkVPehrWWnA0kZkwRwLz8nKJzH0CJYCPoWJCBvdyeAQ6wSK4PA5LQbjc3qSKScXMjqRKRqA16CHUnI3Th6JkMb9AniOqAcDPJ8gDAMktZeYCeSmIBUaupCAx008vh9FxTh0xDp/6/fKYrEFtWGRNM2vSramIuf2PNVXx1lpzTBhQKktN735Uv5+P9ZOh1nJpvqV1sXgPo/C51+YA5AYov7yVYYIwsZE8E4aqnVMBix36ORumTEY5fmO7Zhzwt+tdalmipWpNtqW6xi9p1qDyI1CqWesLbzeUcbrgQKTgO3t4/ibY10GMPKdevFwGFb5cmh3lykVp1vImLVXWY9bHeWfWzZtyoZxvli8Ujk5SBdpbX7gCUpuZ+7AUN8LuH87+gKabSCo7Q5Mt45ys6Qasg0q/siRLyIbyDDfNl9vXr/9G/s1N9wXHbg1WzlMbl3IFNN4RQ5+sfDDtR2XCSEKjCMXO6ZZNe9AAFgvlT+2akg+iHSLQ161hdzIjERVu0aosL4I3KwXUgLK/EI5v5BepCHylScrhmrAl+XtrWCdS9uvUkB9f/81Cu7Zy5YTLhz1mUZrNcm5+cdKzAHL7U+fi/Llc2D+Xk/jtul9/Fm/nG7Ja/7LLAxT+Zd1OY90aaS6UkdYWBE0c2XiiPsQcUHAePvyX1UJdRsk/S8tokH1iLamLZMHYMPXFEjL2oL9MQo467S+TpOFH/oXiP+Dcv0xKJj/8vykyD7UALpPIb9UMuDRuDrECrvNAiIY4Z3IZs0HnOkB7w2L43IrufSuZ6UvO6X4bWdALTCZedBLuuVMhh5+Iz4380EPur9xDlSdWTpn8rsmKMekHO0Ql/2D/kzx8KMrIBtbg5T/jcxT2n8H1fILdVqpm4sDHj++Ijunt+OVG8uyUfcIGilE+d4fnCHgDIXyv/Qx5uRv5vGaaJHRHhDRkAVY4Nix2xzjlvGR6a0wfo+8hSAGNZ5jwmHDzoKVUsTDsJFZk7ApZkdFZZCV8mXG+68G3VczAyQHiLAciRA4udmZ4Ri03BUNfOgA8DoMw6rDJB0HeM5F9dSku1pyKNOxADZGRyo+EyZ6UMy9pglCts8RyBj9FNPsD7dB/3L4ZtILPzyCLw4CYhkf5YAPZ1Bq1n20oVvbcOaHYJ4xbnyCSItb+ePNqBXfsoIV9Nohuz/Yai6cGGMYYS3sOPrz60A/Qem8zXG0Fv2egzSwBtQI9T0HNNURB7CEPswd8M1WP29xPqQnOiVly4ihxGdstKCC/Z5BBTIzEzRDDhvX6Np4sJyLnpQvnPDVhtfU660KV6JnWLfQVOg9YoPOuzLSU4Ip4AvacNhOQ8XN53ha2bwtz03YPH2m9BFHrX0xLCN2Aoiuo+jRLqRpSFlwRI60Fah0WiMfs/zOuihOxUy6LI+l869LYNBMtTL7j6WY1tzbKaUhB6+eKCcfel3aZLOqBGmAYJajDT0wHzkE4iJVZn4SIc27zaQXJhS9g3mllHS9EbgZHiBWmqrn1Eol6ePVh2vVYZHo3HTWP4ch9nClrJG7XLFrXSeg+FK8WVMRbFps1yQzj7A9qp0UmlJ96OSP37uOamky5j8goyqzj4mrmypJHTSIuNS59vYoxZwkIo2S6OyaYVIat/HXI9pjjA0Q0H3S+YGbS0F+B1g5sl6wNt4Tx/KmgEq/HeW25SQ3bQC49qZS8cNl/eP0fP7ZWeck41G6+koOihuUwrdrl8k9TlDAXRJ8ppoABQszqVPhtpHX5M5EqtmEcrJ+Buan8xJsFobtNOh8Z4BwVxKyW1N6RL69i2Lyyf739EkRk5z0BFDtGEwp8NT+EQWDAfZ5K1hHpOxgLDmw1LY7d4k0YDUrrCcMGdnwiZAzaSovdo/ibduS8AknBs0r7fqm26OZTc63CLwVwCNOQ72fimlvjCu/2cyzTcN7AsZ1wJLznP90aoPfVKRSiqO0Bc9Q55kXKjVQ5yiqHWJ4Jo6uVghUtUmGUc6dyGpdbyq8efXvn0GTIP+vqx6MhS5k1PePa9jliW38OqL0OeXNTBZy4fVIfXtk24aBxfUqqSSwj3YoGBLhO9mvgvazoQ9/CGfIeiGciasDGHmgCtJvl2QDiTu0BGFLH50Po1N4VAk15ppGnL9suD5c0PkZ9WBfPjpH7sEdu+Be3L8YqYfsnJlbzJY2MVHfWtRuniN9X4BfuJafakISJzEB4D7/4xyUh/YfH2qFwXtxeFNrbANwwbixBfC6ZCMgCiVlRkzCstLBNznMtRVhgpqDo2aSrQ6qOpAk/FKbotJeGW9rZdQU7yrxzQ7RCFL7f2AThibO5HXiuOdz9/aPO5278Zo/YQbDO6NU6/6ys7EOLyq954Qu5iisXHI0laCy8YiLiWVx8OJLCVXksdrk5GdFoDZpQ0ba/FtlyCUqTKw2Fr+pZQyOTUT5rmCEX744NWlhH22H2ehvJWxyt7AgIMdaNWs71WfF7reXgjiBnsEg9QRV+VmTwwRAFXhlqF9lnVohAREAWYLbgb757kcaqhmqsxq9QsCmC/Wl+ksSQgoh1rnk/fHJxskQqIDEYyri+JimqQRKtIXoqfOSKDH/pEAny/D6UZ3d4yz8YzINQHmUcHfkFtctS4UW9TMxph7y/wK+QlAkODAG8SpWMXiWQMLGU121e2B+pqhPi16rg0D0plUqhRNiyProFbjVUsaBt38v+fBDkw6f/JgwJpURnSVMB5jLEBI0wdZCL0AdB/ouJWG71tf8+/N7e2H4VZSEW/utDxaJDvZEhKo70qjky0Ets51Zau7SvQHhLm5qtW+elCpbs6x158X+RrP/XNK/qoRQreThKabZYS4VpwyLtUj5lvtDiqPVPzaU5FCztj3w8s99eEjNUlJ5LraPhMw7vc2nEMik7Cq7MzCxtXRYfgLmGKcqNMBwKIaRW5WamHwETpwPARP/8CmhM11hvdjQM5H0xIKkPOAABHhGjY377IOCIZF3NqX9rWjsbtgmLFD5dwRydvsOs1fzIxmqVQiOP1LDpSkdUzJ8s7AMFK+dm8HZKC7WX+4gK4TwZN3UfwJgpiA7UAMcAdPPyZllOFR86A2cDZmcrgimt0okW7wxQfsbVLaMrDq2CiFOWDF1pRHu+pe5G27vs7gNzWC5ZxEBEuzPqIzd3jpaUGCr6aEbeEi63oKo6iomYRXhpuxQea1lro7LVCi9CGlmM21RiTRa45XweFri5z86CoB5fZysICevZDXALxEvyc9vew/Zf+GAt08UVgnzhRSolv3Rb/NdKsIgJQjmXES5RSc4UnmkPAUfZNvXS0ZpcdVbokol8i2lEp4w0HSxEClxF8vMSkqMgi8y4kEtAnkZSpjOV8uzEh2sfYXIDKpJJwkZvjRiWNOMmVLQxmIYj9ve9m94Vti6lGgfeHlyzqr/ZBB46MFrIKksf8mEr9HZoedJwREK8IH3MbMEagqiiJSjnCxo9TTL1u9yxrrAGa/KTTOMVdp1yZv9liZ1ktzStwiuu/4PZSlVFND7L58eopPn8b6qNDGrv4eR/x+YTy0Yly/l6GIBZj0z8YkK1CX5IQwOZmbPWIDZvZWsQXU0KK+Ge50SoIALWfx/GhcWiJ5j0LkLVMcKxBzLsdEhUgWQgY5iYgVJSnYYtbmjfbsUhYmI1YK3OhUmDiPsRMTGLlbTK+iSImIhkgiXwfu3KS1J+2gEcOyVAmZmV3A+wmphnmlC+pbv2Yfna+lr3VG2twS9i8vOne7KAiGYafPbKmm4KUqlMGb7pbl3TOI/mOksSOqD6pDgsFmDosPPqV38iucs7zv9dcbmgvFDtmJpjZjfw/GHp7N+CyyUX/4KWR9OzYA+PLmYOKtwFzkRTzvb5Xc90WTzldL/d908358zAxHO+Zwb2T8yiZNJVfPdrgNLCAHWtp46yuvwYFavL/8aaXDSmhl5XHyS8rr702HgmkUxrdVHOaFNjpNSsC7pnga8mbOVuUBZPSLZnxAaMIwy9IVU3nmc4dOPO0guVCcHE6kW4rjXteHyxn/z2N4dQnx4x4YEzrg6fsf3VITNGScyZmHiNlxnnxHreVMQ3dngXqjLSrroyLpDgcF/7EjQ8FgI1PVStsgSLhTSkVFF/tgWr8dlKSAVzupAbuCNvXv/wU1jjaVAHbCXXLfywfRRtD11WezoysfIpi3p56NDZQWyGq1n3y/mREgBiw5QUduXIhipGF9zH9oJS4B7QsSo01KmKVpoDkl8UwM+f7q9d2ZJTsh8+kf8Oq4z6W0Vkupj5u8ffbnQKEVuyqBosT8s+h2PD4Z3dZsmorHd3LjnQ+tFUNfK+NrRNsK5nMBqtJ0JbvEFkwbpsg2YiAic9Xl908boJ9PJS+Y3um95eL9YCKS2K3bM0xtPywVQcBc0SxqnyhVHBaf9mZykYWZ0gZjrldFd6CkamucrO22+2Oy2GmdvROfqb4jBsauGH+shV96zy8lbrvkFZ72+5yAxRVHQFPrEw8nW7O0WTxXtaPZMz64VwC+gmYCcTp8TraoP3Lu8eflrtEerqUqKL20bvGHQW0zZ/wStnInbEtVNDx4XU1uUPMrxOx+UDx55Hfedd33n1TMmRUgLytsTex6qye011tcDXVTc3Ks/fYWqIvFtTtQJyZQIXKYqRqTNXcm+OCroCZWchLsGEpc4YcPcuTI7kZfECn4+6uktMTPdLqtL62TLMlskfQbPYbq1PYMgn9gfMGtoiwHcZRVnKXFo6ofYf7jNXH9/++rJ3RaJMKTuhN3qJBpcDu+640d/k1uWdQaNZ1L3b1lQ913bDueMQMZnubJsR9ngOuCHzC+NQfEYqbwvmERV3PFtJQXa7SCPTFadhGWhQ7u482FPa+xNTK0eZgjjq+Gt0CanzQOP4g888zhJmZlouR9d6DBUQuTRulrwiqAd6YT0Fh6x5hZWxIyrIAki0tmZV3LToqCFU7PD87WPFmrac2qlYYYc+FSsqY1tWYKv8BRBF8/dPlJSmwxEObbyDt2Qe0bcbCPHosjWlmwnbomIDODxXqX5yF3QSwPbvrRH9t4reIwrKXEbLmLLnrhtIr1mKJVCtAYUUN5YdfmRkoIbaBMi/WnAB1cJYv70VdyM9EbQBDCZemh7u0cCwkiSxAYujRhOqtYwYhsO2zKzdcWrZHPZhHtD7w+Z74ntDaD7qw70LyvjW0/noOBrSnV8GC45KF3uStqRW/2HWp2OSHT2/HuTlqNknzv9aZwvnT32vXSsb1zlrFMtwtnMwrR27IuNKeLo5FqVZyQuiozXEGQeNPhXFLvLOTqX6qaj88vsoOOZb951cP0thlOTca7atLGK3xVRKX5N3v3xCBfLxc3hQ+3dtqIgdmPwNA74jS8pUOZTXM6mSVl8wKSgPlFUjd7BRgLf+c/cxv3WaL2NxRXILbLU2M/LxcwVGcFwFlHtftAFKg9GVd7WDnnbQHiXlO0b1BUAm+3vaeadNSlZsA8Lankzuq54cVq0VVGhkwH4lTQl8uM/jTk3p2QugQ10cBCG8CezP4yFqo3O0kDrZS2S01DO/YMFCSTK6QG0PqTgProV/Wi1hkZJ5a38sMZRbomCVcarsqdg5lGPJ9zrXE0aiLCvQMlMRaKLXMuMx2iVQVJKO4MnvmTT09Cz53HD1OxnjNjLl4YvBCClXk7S6R1Um8v0pBfi9Sa6oJjEsmTP7urlcFY6uDgoh7qGrdmrevRVYi7cC5aMbGCDx4SewCq/YSIinqvA6B611H82NxhpbZ5W8QD5Z7LVjNyfTzDPFmd95seYbYoWerdZVa3Qve5W54P1a7Mtu/nbsVwzDjN2oysxUJtDVugRmYBhfihVog9YHE5nMtN9znQMz0XBR6pt4TTfQxbWBbHINdxyMU7OprHv3qgbLZTeUa1Q6tQ1jN0VdxXQrN7u1kRXAabr/ckabdLNW0hgO8dmZYGVFd63qwrUZ8djIFRLJ9HXnuPm1iK1LYFvdnhffmTXsPIO+rmmG/RjxAbPlXr1UUXdWqmsr5OIBTBE8C4eq/ybHxcmP0CJinrd9dx3Zr5ggggpZa2Xvd1qxHj0GRmidhvlMNNoTBR7kN3kvKO+uHKjdyn/+sqaLn2e2pn0m+jxWY/WN4oqg19pnWRVQ9Z975H3UHnelSNPQWtBSBV8Ax1KQRMZdty3C+HzO+nwIr1xq+uUYqCmocISF7C+Qyn9qhVLHS1ZBZUt7FmRLQYBGa/xoQ8L2HN9M94vY3iQ0Gac9/eVUHxZ2NbB/KdATKdDxijKBZIYZtM7cMhmyQ/syiyMIr7Z69Mm9xa4z/FW+ujSa4IR+vRyi11BEBau9/6am3OW7LpHqMvTiDpl67zpLbV4XbP327uOTRmt46Us02vFqTPRULPdMDz0fLPeWlPHs9PGUeq7Xey6NmhOX9rtqrOlLsm0VEJc/CrCJ0nCC9fbSdMMa8p5+eXFITVFgN0FsiORaoPs91DnelHurYNal6pVWpY49jNvMqjFljyFxLLMuXhXlkSQvcE2m4WLvj5NMrYD09pJUUHOz4YJ2jnjVWnVUViOV0tOl2iu+GPZkZsvT5dstTRb0mi+do47nzMUrE7ls8GefguiOEh6iOJ4u03RprtuUtosde26i9CJVRU1H2EPm87vHsu9xq7J1DKGXqhqqOqFJcUBH9ATHDtOeyKZvQU94ZjX51FIYfVw62NIouHWZSqO5kN3JqvH2hQtYus7gcypkuCXLYAZMKCtvhRS7RGa6tEBdB1spiO9kzoFqc6MgAmH47gZ329X7j791M4gzbWpXbpN0qcmVXieQvAyV2Q9nnvXSz8y8XxiHmwWNnsri9JI57z/+VpB7AFXI6zPT82gPCJx46jVaM1BURWsWUT53rJpflmqsho0LTyyH7a2novFCRU843deduZ2EXXp7mdwqPbLBfOscss7Pw/iWv7Hw7WjS4lWIqrqo7bxuB7e5Iw/i1DOozW5OhRVqkEcHSEeCTfsui+JP/u1wR+2Ng0j8/+Gjnt2qeFqdg83ase/j2YtkrI6gxe2KundqFFutQEFsP7EvAIbQR8rDv6SafwN0I9AewsmLX+2nXrj/1GRtRUiUd1d8MMC9u8J3eIfFyH3ur3u2Bpti4OWamFVvdwyUKD3vDLucoPAMe2Laf2L1may81sTcpby8Q9MBdHT1+jw1ITKrOGnHkrLvTu8gUs5xLPrUm90higqdUsy7FE3IX14TIbvjvtMarkrruZ35Yrj2z0YXTbkktGBkkF/jSme2NL0YWj8VaY8DVy8TsGGRwee7LoWoXyvh2IgKIY27q+AfZhhEaU7lgj+xkA4fUS7zM5dRtW/vX1UyU1fJHFAk46oJL0Vim2/NO8WDumYJSrlon3s00j/Tv0Chiu3m65yc7EnWjGITk+epuiwZ8PDqQ97ZVAos87fcdhVylvzDCcc6bCiv1vvaY2zoITmLdu0GqvkN7UADVWY43JFHb19+GthhdQ9T/BC1Ht+Vi9Ggi/YjwYeGT/7gb19nuMY6lrARLtMtvJUbJ46wiZBUXj+o92sZhIXFrYKk44HYQUeh0BwgPQVL8oHHoTFTNlGugHHjjsLyh0wWbPoVcsOOQhIDnZ4lMT6oF0ZBHsz3mmxA7UgmOHsC7k0dZtytdOuWUoVvfTBBtEz8XTrKiWYm8yqVGZLQnXdiw6Rl4knIbdO5PJ66krDKtZG1e4AOWwrzWHzvbTajGGys3lfWJfOI2ipa0Zp1NFrtNr5/8vcS+nhFk6KfnzvqurYkNa3beUfMmzfpvnFLMQABhw2ED4+DO4vatXDj1gGEObAT0dzClmE5PQjFO1+IaAcnbvBrwhyWj28f7glViu7cvco4EzEVJtx7Pmb6KU+fTbSNqu8TuZitm2TP/Kc84HGGyiLhXQamjXWb92FCH3p6luCwcT9LlpTxyY6yyvxu3P75cX/pMc3Rj+/aSxKKTXsU3SIKp2/DrdvRvZhWciphFRy8KjRryWMMw5Pb129+uLHuTw5hHzy7P09gkHh83sD2EF0oWeGNMDtvD9pCP4Fq6K7JHl2ough5nxc3mz7DoYUVHpVjqk1o5ZCQNJ4f1Wn+M17/pjGpHUz75jx6uvwsHDFltjieSp0tbsYROcdGt8E5A31OWxNipsTQJM0nxG653hbDPmwz3ykph4LBcXf2UBHn/tW1s1Ht/4wmWdru0lZ0K/8K0TyS8VF8+vTwv9/9n/f3xI5TtibzCL/XrvFi+1GIismY3/QPouhtmeZ3XNFtrNWtK7xy/c3GojTzpX/B25XDO9iVXbXr9w07Z/YJkP0FlsPnrxVFtjLozcmxDG6GGZejZq1UnWFh3fCFab2Y04ljUNg3f/gml7PO2wWDYr/nrrVwEciOzGIFVfi1rtPhyh9Z6kHW/aTZYGjBafueI+x6k+6wWX3+qTJn276QFtgxru/nd49+FF0aOU69HxdXdA9adDlm3Q9j+I0z6/p+14MYQRBLmrBWr7ihCOznjpmcy4jyGQs35Wz9ungk5/Y/3sxez97MbolU5M3r17d3r+9//unu7c//eX/30z/+/uPd3e040/a9xUEeHgmNY+V7jbKimR8V5OFx84Od7OFx82PxoSG0pVI1N0SniBf0vXlzCHw7VQ8mBYk0cAEM/4hAJua4p+4sLPcEDOf5Wuowqp73Qv/9x5s3t7c3t7f/fvP3H2diO/N/mUWy9dp4D+bHzx+JgkiqOHjoq3xNZuQBX9OTC0OxS9uGUaJgA0q3j+eHR8KlfOpMmDXYAIbH85Rnei5HPblUvp96KPn4Js9yCZFPlKY3LoQWS7SEr+Dz+/uXuYnveWEXzVWYSgEkke1rSpwugNfe8LrGAexo//MWXc8XSylnC6pmK8mpWM2kWs1eWP6+qP6ilfQungOyY8RgQCVM5G++2OFJJBPwXYepIJAsII4hJpFMd0VgkJpWmyH8wtqY9O7VqzRbcBbpbLlkXxHHYFme40uYhzoobeH8Tzuc/9AiJ9O1lyrWBCXQixvxFzV6EHc/f9Z3xo1/OG0vAP+wzIEgAoGIw1BM/dbZL5V3zkht6L044Ouhz/hZ3zjDcppj+IHtg0aLRPhb4yfuDCv1TL3MOJ+PEIW6Ddydnv+EfydD3z8dkZ2XS9emP7efWZmT9wGCoyzodkvSg/u5v0U5FsJZ1M1F6I1J7HXLfafQPoc4XP1hgSEPu9FVe/trA4EigQmxFFOg8dP5XuyU6+IejD10bXo6OnUzZIKnQ36tXwyvupJ5wOe6bLddhmaKZqS+DhfLU11ALXXPwP0BM/JOKgU6xcZrRub9pjRgXvuV1Ziv9E6/EmBesXTzwysTpfMEkhn50NH2v7vML9z89+hO7P2rSwYGgKRK13R/nXf3Sg9Ei4jdXveL5KeF2Ip8vrTd/N1LQZcOmZqAXJ/0832YXjkBPgttn55pwgNtLQKm161k1wkAlnmwyrSjuBlxqWG+pZ2tQ06CtoHQ6oh5iWQeTAjVcRuWXAbsAsgQ1Hon5jr8oNVZQec4hmJWEDUfrX0WzBbHEMxLJnBNmqGgs4MugIxB3Yz/PBvqN0NQc6rNnEahDMxZQec4hmC2uuYsJ0i/ymNiFUJcOGnxpObrb/d/EvPVEvKM5msWX6L5un91yUDz9dzGXxfqPf9S7I608YjF6CjBFzfEl3o3A3+dQaxyUXGf8rGEI1NtvjH7LAlXMwRSA/n2yb/a+DMTaWbm+YcSxjkLlw8MKOj88CmnFV92KIdql0tlGpTu5f0BxVLv5WoF8U3x9jlozaRoBpD38bgjnHZwmWt5CcuDCc6qofV41BHzvhXV1AiXK2Y1V3OKPfe9jqT5/udM+0pG98raAA4EkrBHorBfz2euSkPHAoRqRY5Zg0L4hpam1NMTQSQLKTm04gO9SOzXCBMxi5xmonlmaC9HjilxC69I3vm1Ufi2B0Mkp5aKymo4BR0HZinL3mncOqwOrqleA77rSR6H6QS3RvORKdfeI/RtLS3oc9Jly9QGoPJf/n8AAAD//y766bE=" + return "eJzsff+PGzey5+/5KwgfFhm/m5E93mzevvnhAMfzcjeAEw9sB/uAw0GmuksS37DJDsmWrPz1BxbZ39nqbqmlkYMMFtlkRiI/9YXFqmKxeEOeYHdH9E4bSL4jxDDD4Y68+IS/ePEdITHoSLHUMCnuyP/6jhBC3B+JNtRkmiRgFIv0NeHsCci7x98IFTFJIJFqRzJNV3BNzJoaQhWQSHIOkYGYLJVMiFkDkSkoaphYeRSz7wjRa6nMPJJiyVZ3xKgMviNEAQeq4Y6s6HeELBnwWN8hoBsiaAIVMuyP2aX2s0pmqf9NgBT788V97QuJpDCUCU24jCj3o+X0zfznq/NW546kguKXodn3IKiguLHjVKBYfnoEZCkVoUQzseKA8xG5JJQkGTcMv1fhYP5TZ1r+0ySiSgiLa7/OSeFSrBp/2EON/bHQ31lUIksWoEpUtU/+D/IIKgJh6Ap0EFCmQc3SyARh6YhyiOdLLmnzA0upEmruSOrGHwf+8xryL9IVMtqSY1gCRKcgDGECgRGd0gg6aKtRYFj0pKdhrQVHE5kJcyQwry+XyNwnUAL4GComZHAvh0egEyyCy+OwFITL7U2qmFTM7EiqZARagx5Czdk4fShKFvML5DmiGgD8fIo8AJDcUmYukJeCWGDkSgoSM/30chgd57QR4/Cp3y+PyRrUhkXWNbMu3ZqKmNv/WFMVb603x4QBpbLU9K5H9fv5WD8Zai2X5luSi8V7GIXPLZsDkBug/PIkwwRhYiN5JgxVO2cCFjuMczZMmYxy/MZ2zTjgb9e71LJES9WabEt1jV/SrEHlW6BUs9YX3m4o43TBgUjBd3bz/E2wr4MYeU67eLkMKmK5NDsqlIvSrBVNWqpsxKyPi85smDeloFxslgsKRyepAu29L5SA1GbmPizFjbDrh7M/oBkmksrK0GTLOCdrugEboNKvLMkSsqE8w0Xz5fb167+Rf3PTfcGxW4OV89TGpVwBjXfE0CerH0z7UZkwktAoQrVztmXTHjSAxUL5U4em5INopwj0dWvYncxIRIUTWpXlRfJmpYAaUPYXwvGN/CwVga80STlcE7Ykf28N61TKfp0a8uPrv1lo11avnHL5tMcsSrNZzs0vTnsWQG7/2SmcP1cI++cKEr/d8OvPEu18Q17rX355gMK/vNtpvFsjzYUy0vqCoIkjG3fUh5gDKs7Dh39ZK9TllPxaekaD/BPrSV0kC8amqS+WkLEb/WUSctRuf5kkDd/yLxT/Afv+ZVIy+eb/TZF5qAdwmUR+q27ApXFziBdwnSdCNMQ5k8ucDQbXAdobHsPnVnbvWzmZvuQz3W/jFPQCDxMv+hDuuY9CDt8Rnxv5oZvcX2cPVZ5YPWXyuyYrxhw/2CEq5w/2P8nDh6KMbGANXv4z/ozC/jMozyfYbaVqHhz4/PEd0TG9HS9uJM9O2adsoBjlc7d5joA3EML32s+Ql7uRz2umSUJ3REhDFmCVY8Nit41Tzkumt8b0OfoeghTQeIYHHhMuHvSUKh6GncSqjJWQVRmdRVbDlxnnux58W8UMnBwgznIgQuTgYmeGn6jlrmDoSweAx2EQRh02+SDIeyayr+6IizWnIg0/UENkpPIj4WFPypnXNEGo1lliOYOfIpr9gX7oP27fDJLg8zPI4jAgpuFRPthANrVG7WcbqpXdd06o9gnjNiaIpIi13968WcEVO0iwzwbRrdleZ/HUAMMYY2n3wYdXH/oB2uhthtJW8HsG2swSUCvQ8xTUXEMUxB6KMHvAN4/qcZn7KTXBOfGUnDhK3IntFhSQ3zPIICZG4mKIYcN6YxtPllOR89KFc56asJq8ziqoEj3TuoW+QucBAjqvZKalBCXiCdiz20xAxk/lflv4vi3MTd89vKX1EkRtfDEtIXQDiq6gGtMspWpoWVAiRloP1AYsEI9Z/2eUilOxU4rFkXQ+uTQWzUSCyVc83azm1kc5DSno/Vwx4dj70orJoh5oAYZRgjb8xHTgHISDWJn1SYg45zKfVpFc+gLmnV7W8UrkZnCEWGWqulsvkaiHVx+mlcci07vpqHkMZ+7jTFkncbtm0bpOQvemeLWgIt6y2KxJZhhnf1A7LTKh/NTLGbl3H9fUZMp9REZRZgMXVzNXljxqEnGpUfT1KsacJSCMkunumGRSmbby1yHbY45PENF80PmCmUlTfwVaO7AVWRtuCeP5j4JKvB7nteUmNWwDufakUvIiZP/h9X/82JLyknGo3XwlB2UNy2Fatcvln6YoYS6IPlNOAROEeKpT4beRNuTPRKrYhnGwcQaeTeU73iwI3S3S+cgE56gkZrWk9o58eRXD5pX96+2XICI77wmg2DGaUOCr+SEMAhPu81SyjkzfwVhwYGtpcewWb8JoUFtPmDaw4xMhY9BWW+waxd+0M+cVSAqeVdv3a7VFN5+aaxV+KYBDmIZ8PxPXnIwrvNvPsUzDeRPHdsKR8J5/d2uA3lenUKiithvMUfuYVyk3UmUrq2xi+UkYXa0UrGhxFEY5dyancbml/OrRt3cOPQz5tW5+PBqylFkzMq4tnyOW9eeA2dMz8qvEgoR/MRHLbYf+uakDQd2+VRCWdJsRoFFeJRdILCPdyg4EpED2W+S9rOlD38IZiiaIZypaxMaaaAK0i+fZAOLK7QEYMs/nQ+jM4BUCTXmmkacv2yEQlzQ+xpzYkM+Okce0RxqAF7cvxhpl+ycmVvMljYxUdzbUG2eY31fgF+Emp9qQhInMQHgNv/jHJSH9h8faYXBe3F4U2tsA3DBuLEl8Lp0I6AKJWVGjMKzUsE3Oc4kirDBTUPRs2tWhVUfShB8KU3TaS8Qt6+y6hB3l7rkhWikL339sgnTF2cIQ3Ncc7v5+UucLP36zW+wgWGeMcl28Vlb6oUflZV7ERq4CyyVLYwkaC7GYiHgWFx+OpHBVH4td7k5GNFqDJlS0/a9FtlyC0uRKQxG7etbQyGSUzxpuyMWHZ4ME62g7zF9vI3mLo5UdAiHGOlLLuT4vfq+3HFwR5AweqSeows+KDj4YosAbQ+0y/cwqEYgIyALMFvxNeK/SWOVQzd14CQWbJNif5idJDCmIWOeW98MnlzdLpAISg6GM62uSohkk0RqipyJmrujwlw6VIM8fQ3l2h5f8g8FzEcqjjGNgv6BWLBVe1MvGnHXI+w38Akl54IEpgVepktGrBBImlvK6zQv7I1V1QvxaFRyGJ6VRKYwIW9ZHt8CthSoE2o697M8HQT58+i/CkFBKdJY0DWCuQ0zQCI8SchX6UMTt1/778Ht7YXspykIt/NeHqkWHeSNDTBzpNXNkYJTYPmtprdK+guEtbVq2bpuXKliyr3fkxf9Fsv5f072qp1as5uEopdtiPRWmDYu0OwIqzw8tjlo/1VybQ8nT/szHM8ftJTFDVem5zDo6PuPwPpdFLA9pR8GVmZmlrcvjAzDXMEW5E4ZDIYTUmtzM9CNg4nQAmOifXwGN6Rrrz46GgbwvBiT1AQcgwC1idM5vHwQckayrZ+zfmtXOhi3C4kifrmCOQd9h3mq+ZWP1SmGRR1rYdKUjKuZPFvaBipVzM3hbpYXa631EhXCRjJu6D2DMFEQHWoBjALp5ebNMp4oPg4GzAbOzFcmUVilFi3cGKD+jdMvsikOrIOKUJUMljWjPJ+putL1idx+Yw3LJIgYi2p3RHrm5c7SkxFCxRzPylnC5BVW1UUzELMJL3KXyWM9aG5WtVngx0shi3KYRa7LAifN5WODmPjsLgnZ8na0gpKxnd8AtEK/Jz+17D1t/4Y21PD6uEOQLMVIp+aX74r9UkkVMEMq5jFBEJTlTRKY9BBzl29RLSWt61VmxSyaKLaZRnTLTdLASKXAVys9LSI6CLDLjUi4BfRpJmc5UyrMTb659hMkNqEgmCRu9NGJY0oybUNHGYBqOWN/3bnpX6LqUahx4u3HNqvFmE3how2ghq4g+FMNW6O2w8qQRiIR4QfqY2YI1BFHFSlDOFzR6mmTqd3lgXWEN1ugnmcYr7TrlzP7LEjvLbmlahVe0AwCzlaqKaPwpnx+jcsznf1NtbFB7Hyf/OzajWDYqWc7X0wDMeuTBLx6oNsEPaXAgM3PWmsTmLW0NoqtpYSXd85wIFUTA+u/HuLRY9AST3k2oBkY49kCGnQ6JKpAMZAwTM1BKqtOwxQ3t2684REysBsjqXJg0iLgfEROzWElrrE+CiIlIJlgS72VXXpry0w7g2CkBysys5H6A1YN5pgnlW7prb5avbax1T9XWOvwiJj99uicLiGimwZ9eWddNQSqVKdM33a1sGvvRXGdJQgdUnxSbxQIMHbZf/eJ3JHeZx8W/Ky4XlBemHY/mmNkN3H9YOvu3oLjk4r+hFdH0COzh0eXMQYW7wploytk+v+uZLounnO63+/7p5pwZmHjO98zA/olZlEwqxXe/BCgtHFDXiuoor8uPUfG6/G+sy0Vjauh19YHC6+rLj41nE8m0XhfljDYtRkrNuqB7FvhqwlbuRmXxpGR7RmzIOMLRG1J143mGQzfuML1QmRBMrF6E61rTjscY+8lvf3MI9ekREx444+rwGdtfHTJjlMSciYllvMw4JzbypiK+scO7VJWRVurKuESCw33tS9BwWwjU9FC1yhIsFtKQUkX93hasxmcrIRXM6UJu4I68ef3DP8MWT4M6YCm57uGHraNoe6hY7e7IxMofWdTLQ4fODmIz3My6X86P1AAQG6aksJIjG6oYXXCf2wtqgXtQx5rQUOcqWmkWSH5WAD99ur92ZUvOyH74RP4rbDLqbxeR6XLm7x5/u9EpRGzJomqyPC37Ho5Nh3d2nyWjTr27z5IDrSBN1SLva0vbBOt6CKPTeiK0xZtEFqw7bdBMROC0x9uLLl43gV7eUX6jG6f31wtZIKVFsXuWxrhbPphKoKBZwjhVvjAqOO3f7CwFI6sTxEynnO7KSMHINDfZeTvOdufFMHM7Okl/UxyGTS39UB+5Gp5VXuJq3Tco6/0tF5khioquxCcWRr5ud6tosnhP62dyZrsQbgndBOx04pR4XW3wXvHu4ae1HqEuLyW6uO30jkFnMW3zF71yJmKHXDs1dFxQbV3+IMPrdNx54Nj9qG+/69uvnulwpNSAvE2xj7Gq7F5TXS3wddXNjcrzd3g0RN6tqVoBuTKBixTFyNS5K3k0RwVdgbKzEHfAhKXOmHD3IUyO5GXxIp/PurpLTEz3a6rS+tlOmC2TP4JmsV1an8CQT+wPmDWsRYDvMoqylLlj6YTaf7jPXH18+8vLXolEmVJ2Qu/0Eg3uDOy6UtL+a7UmvPPudZOPl7c7jWfeeMq3z6hBjuZ/eUlOp0K5/kjB91QObS9A5tNIfRi9ek3VcxljnDsOkZbp4Su2OLINR8oH3Kz6mXEoPiOVjyHyTJxz66yFQbG4DDXTFaTLQKN7d1fGenc+Dp16U5UpiKPcpka3mToPNI4/2FfiLGFmpuVydI3QUNWRS+NmySvJeqAXXndwyFo2oTJ2RAVZAInW1h2Pm5EANYSKHfptfaxY01YyZCpW2KFPxYrK2JYV+OTCAoii+Ts6SkrTkUAJLbyDl2R+EmQXEOLRZYtTNxO218VGguiPUf3kLnYlgM8ItEb03yp62Cgoz8BaTrj119xAes1SLJ1rDSikuLHs8CMjAzXUJkD+1SwamoWx+Z5Wvpb0ZF4HMJh4bXq4R8fUapLERj6OGk2o1jJimEbdMrN2bphlczj2fcCsATZxFN8bQvNRH+5dMs+3MM9Hx9GQ7vwSYXBUuthz2E9qdUNmfTom2dHza2Vej5r9Bv2vdbZwcfj32rVEch3YRrEMZzsH09o5TzKu9KubY1GalbwgOlpDnHHQGItTfI3AxTdUPxUVg34dBcd8676T22cpjJKce8u2lUXOv5hK6Wvy7udPaEA+fg4Pav+uDRWxA5O/hcF3ZEmZKofydiZV0toLJgXlgXJ85A42mPBRY552yG8r52IsrtZuga3WZkY+fq7ACI6rgHKfw2iA0mB05X32YIYm6LmS8j2sugCQyf5+f96xlZIV24CwPiqT+6puh1X5BQ0aGbBeSVMDH+7zfGVTe/YC6DAXB0Ho8ukJeTzEbHSOFjIne4mMlnrmBRYssCWjCxv3kIrzoCz8E30Ji5TMn4jA0lS5JQpWGafK7oqdQzmWfK9zO2Ek6rICLTMVgSZ6LTMeo18CRQXyCJ78nklDT8+Sz40UUSdj3EKmPHyhHCHlZpJW16jKRL4+pQC/NskV1SSGJXNuXzeXq8rR1XkjxD0M4k7Nu7cCazhXoHxWDBNrPm0J1uAVCwnxVA1e56C1Lra501hj66xynpRPFnvr2M3JNPNMce53XuT7hlilZ6t11Rvdy15lLni9Fuuym78d6xXTd2MXqjIzlQkMtS6BGXj8I8UKtEHvg4lMZtqvuc6BmWiEKPVFvKYb6OLaQDa5Rk0OxqnZVN6X8KYGy6w3lGs0OrUFYxdF3cR0Gze7tJEVwGm6/1JPm3SzVtIYDvHZmWB1RXdJdeHa03hs5AqJZPq6c9z8Os3WFT5Y254XbZo17DyDvq5phn088SG85V67VDF3VqtrEnL5AKYI7oVDzX+T4+LkW2hx0pI/H+A6+18xQQQVsvYkgl9phTx6HIyQnIbFTDTaky8eFDf5KCjv0h2o+ct//vKmi59n9qZ9BcN5vMbqW9cVRa+1XbMmoBo/9+j7qDXuStimobWgpQq+AI4lRImMu27phPH5WofzIbxyJQ0vx0BNQYUzLGR/YV3+UyuwO16zCipb1rMgWwoCNFrjRxsatmf7ZrpfxfYWL5Bx1tNfavZpYVc7/ZcBPZEBHW8oE0hmeILWeaJMhqzQvjPHEYRXW4T6w73FrjP9Vb7eNZrghH69HKLXUGQFqz0jp6bcnXddItVl6sVtMvWeh5bavJ7cxu3d2yeN1vDSl/a089V40FPx3DM9dH+w3FtSxrPT51PqZ70+cmnUKrljv6uGTF+SbavwvPxRgM23hhOst5dmG9aQ94LMi4pqhgK7UGIjLdc636+hzvGmXFsFsy7VrrTKc+xm3GZWjSl7HIljmXXxpijPJHmFazINhb0/TzK1AdLbSzJBzcWGAu0c8aoldTRWI43S06X6K76I+mRuy9Pl+y1NFvS6L52jjufMxRsTuWzwZ5+B6M4SHmI4ni7TdWnKbUrfxY49N1F6kaaiZiPsJvP53WPZL7v15tkYQi/VNFRtQpPigI3oSY4dZj2RTd+CnfDMavKpZTD6uHSwp1Fw6zKNRlOQ3YdV4/0Ll7B0HeXnVMhwK5/BDJhQV94KKXaJzHTpgbrOx1IQ3wGfA9XmRkEEwvDdDa62q/cff+tmEGfa1K5qJ+lSkyu9TiB5eT3WGNWYZ6P0MzPvZ8bhZkGjp7JsvWTO+4+/FeQeQBXy+sz0PNoNAieeWkZrBoqqaM0iyueOVfPLMo3VtHERieWwvfdUNOyo2Aln+7pPbidhl95eJrfKiGww3zqHrPPzML7lb3N8O5a0eE2kai5qK687wG2uyIM49Qxms5tTYYMa5NEB2pFgs8fLoviTf4PeUXvjIBL/f/g4bLcpntbmYJN/7Bd69iIZayNocbuiHp0axVYrUBDbT+xLgCH0kfrw31LNvwG6EWgP4eTFL/ZTL9x/arK2KiTKuys+GeDe6+E7vMNi5L7w1z13hM1U8HJNzKq3OwZqlJ53pl1OUHiGvVTtP7H6TFZe+WLuUl7e2esAOrp6xJ6aEJlVgrRjSdl3F3wQKefYFv3Rm10higqdUjx3KZrXv7wmQnbnfad1XJXWczvzxXDt10b3VbkktGBkkF/jSme2NL0YWj8Vxx4HSi8TsGGRwWffLoWoXyrp2IgKIY27q+Af9BhEaU7lgj+xkA0fUS7zE5dRtd/zX1UyU1fJHFAk46oJL0VjXRa52fYZbc0SlHLZPvfYqEywLGyBShXbxdc5OdlzWDOKTUyep+qyZMDDqw95R1wpsMzfcttVyFnyDycc67ChvFrva4+xEYzkLNq1G+/mN7QDjXeZ4XBHHr1/+WlgZ949TPFD1HrDVy5Ggy7a1gQfqD75Q9F9HQUbcixhI1ymW3grN04cYRMhqbyaUe/zMwgLi1sFSccDsYOOQqE5QHoKluQDj0Njpmy+XQHjxh2F5Q+ZLNj0EnLDjkISA52eJTE+xBhGQR7M95psQO1IJjh7Au5dHWbcrXQbllKFb8QwQbRM/F06yolmJvMmlRmS0J0PYsOkZeJJyG0zuDyeupKwyrWRtXu4EFtR81h87302oxhsrN1XNiTziNomWtGadzTa7Da+f/J3Nvp4RZOiD6Tb6rqWJDWt23lHzJs3d79xohiAgMMGwpvHwR1prSzcuHUAYQ7sRDS3sGVYTw9C8c4XItrBiRv8mjCH5ePbh3tClaI7d68yzkRMhQm/WRAz/ZQfn020jKrvWrmcrZtkz/yn3OBxhoqQ8C4D08aGzfswYQw9PUtw2LifJUvK+GRbWWV+N27//Li+9Jim+sd3eyYJxaY9im4RhbO34Zb/GF5MqzmVtAoOXlWateQxpuHJ7es3P9zY8CeHsA+eXZ8ncEg8Pu9ge4gulazwRpidtwdtYZ9ANWzXZI91VEOEvM+Lm02fYdPCCo/KNtUmtLJJSBrPj3qh4DNe/6YxqW1M++Y8erp8LxwxZbY4nkqdLW7GETnHBsnBOQP9cVsT4kmJoUmaT4hdlr0vhn3YZr5TUg4Fk+Nu76EizuOra+ej2v8ZTbK03aWt6HL/FaJ5JOOj+PTp4X+/+z/v74kdp2xN5hF+r12DxvZjIhWXMb/pH0TR2zLNr7ii21irW1dYcv3NxqI086V/wduVwzvYld3Y6/cNO2f2ByD7CyyHz18rimydoDcnxzK4GZ64HDVrpeoMC+uGC6b10lInjkFp3/zBpFzPOm8XDMr9nrvWwmUgO04WK6jCr7ydDlf+OFcPsu6n8AZDC07b94xl11uGh83qz58qc7b9C2mBHRP6fn736EfRpZPjzPtxeUX3EEpXYNb9oIpfOLOu73c9pBIEsaQJa/WKG4rAfu6YybmMKJ+xcFPO1q+Lx5Vu/+PN7PXszeyWSEXevH59e/f6/qd/3r396T/v7/75j7//eHd3O861fW9xkIdHQuNY+V6jrGjmRwV5eNz8YCd7eNz8WHxoCG2pVM0F0aniBX1v3hwC307Vg0lBIg1cAMM/IpCJOe6pOwvLPQHDeb6WOoyq553Zf//x5s3t7c3t7b/f/P3HmdjO/F9mkWy9Ut+D+fHzR6IgkioObvoql8mMPOArjHJhKHZp2zBKFGxA6fb2/PBIuJRPnQdmDTaA4fE85Zmey1FPdZXv7h5KPr7ltFxC5A9K0xuXQoslesJX8Pn9/cvcxfe8sEJzFaZSAElk+5oSpwvgtbffrnEAO9r/vMXQ88VSytmCqtlKcipWM6lWsxeWvy+qv2gdehfPSNkxYjCgEibyt4Ls8CSSCfiuw1QQSBYQxxCTSKa7IjFITavNEH5hbUx69+pVmi04i3S2XLKviGOwLs/xBdVDA5S2cv6nHc5/aJGT6dpLFTJBDfTqRvxFjR7E3c/m9e1x4x/c2wvAP0h0IIhAIuIwFFO/kfdz5X08Uht6Lw74eujzjzY2zrCc5hh+YPug0SoR/tb4iTvTSj1TLzPO5yNUoe4Ddx/Pf8K/k6Hv5o44nZdL16Y/959ZeSbvEwRHedDtlqQH93N/i3oshPOom0LozUnsDct9p9C+gDhc/WGBIQ+70VV7+2sDgSKBCbEUU6Dz0/nO8JRycQ8NHyqbno5O3QyZ4FGRX+oXw6uhZJ7wuS7bbZepmaIZqa/DxfJUl1BL3fOBf8CMvJNKgU6x8ZqReb8pDXiu/cpazFd6p18JMK9YuvnhlYnSeQLJjHzoaPvfXeYXbv57dCf2fumSgQkgqdI13V/n3S3pgWgRsVvrXkh+Woityuei7ebvXgq6bMjUBOT2pJ/vw+zKCfBZaPvsTBMeaOsRML1uHXadAGB5DlaZdhQ3Iy41zLe0s3XISdA2EFobMS+RzIMHQnXchiWXAbsAMgS13om5Dj99dVbQOY6hmBVEzceOnwWzxTEE85IJlEkzFXR20AWQMaib+Z9nQ/1mCGpOtZnTKHQCc1bQOY4hmK2tOcsO0m/ymFiFEBdBWjyp+/rb/Z/EfbWEPKP7msWX6L7uly4Z6L6e2/nrQr3nX4rVkTYesRidJfjihvhS72bgrzOIVa4q7lM+l3DkUZtvzD5LwtUMgaOBfPnkX238mYk0M/P8QwnjnIXLBwYUdH74lNOKLzuUQ7XLpTINSvfy/oBiqfdytYL4pngzH7RmUjQTyPt43JFOO7jMtbyE5cEEZ9XQejzqiHnfiurRCJcrZi1Xc4o9972OpPn+p0z7Skb3ytoADgQOYY9EYb+ez1zVhg4BhGpFjpFBoXxDS1PqxxNBJAspObTyA71I7NcIEzGLnGWi+cnQXo4cU+IWlkje+bVR+LYHQySn1oqKNJyBjgOzlGXvNG5tVgfXVK8B3/Ukj8NsgpPRfOSRa+8W+rZ2LOjPpMuWqQ1A5b/8/wAAAP//AKSNsw==" } diff --git a/metricbeat/module/system/filesystem/_meta/data.json b/metricbeat/module/system/filesystem/_meta/data.json index 2cb9f0897ac..4f13fff0465 100644 --- a/metricbeat/module/system/filesystem/_meta/data.json +++ b/metricbeat/module/system/filesystem/_meta/data.json @@ -1,33 +1,30 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.filesystem", "duration": 115000, "module": "system" }, "metricset": { - "name": "filesystem" + "name": "filesystem", + "period": 10000 }, "service": { "type": "system" }, "system": { "filesystem": { - "available": 53067177984, - "device_name": "/dev/dm-5", - "files": 0, - "free": 54342492160, - "free_files": 0, - "mount_point": "/var/lib/lxd/storage-pools/default", - "total": 86301999104, - "type": "btrfs", + "available": 148708327424, + "device_name": "/dev/mapper/fedora-root", + "files": 105089024, + "free": 148708327424, + "free_files": 103974920, + "mount_point": "/", + "total": 215211835392, + "type": "xfs", "used": { - "bytes": 31959506944, - "pct": 0.3759 + "bytes": 66503507968, + "pct": 0.309 } } } diff --git a/metricbeat/module/system/filesystem/helper.go b/metricbeat/module/system/filesystem/helper.go index d64ef95f562..4d53ddf2a79 100644 --- a/metricbeat/module/system/filesystem/helper.go +++ b/metricbeat/module/system/filesystem/helper.go @@ -145,20 +145,23 @@ func AddFileSystemUsedPercentage(f *FSStat) { // GetFilesystemEvent turns a stat struct into a MapStr func GetFilesystemEvent(fsStat *FSStat) common.MapStr { - return common.MapStr{ + evt := common.MapStr{ "type": fsStat.SysTypeName, "device_name": fsStat.DevName, "mount_point": fsStat.Mount, "total": fsStat.Total, - "free": fsStat.Free, "available": fsStat.Avail, "files": fsStat.Files, - "free_files": fsStat.FreeFiles, "used": common.MapStr{ "pct": fsStat.UsedPercent, "bytes": fsStat.Used, }, } + if runtime.GOOS != "windows" { + evt.Put("free", fsStat.Free) + evt.Put("free_files", fsStat.FreeFiles) + } + return evt } // Predicate is a function predicate for use with filesystems. It returns true diff --git a/metricbeat/module/system/fsstat/_meta/fields.yml b/metricbeat/module/system/fsstat/_meta/fields.yml index d9d2b0e7ce1..d9bd3acd7f3 100644 --- a/metricbeat/module/system/fsstat/_meta/fields.yml +++ b/metricbeat/module/system/fsstat/_meta/fields.yml @@ -10,7 +10,7 @@ description: Number of file systems found. - name: total_files type: long - description: Total number of files. + description: Total number of files. Not on Windows. - name: total_size format: bytes type: group diff --git a/metricbeat/module/system/fsstat/fsstat.go b/metricbeat/module/system/fsstat/fsstat.go index a8a1eaa0c94..0f43cf4af55 100644 --- a/metricbeat/module/system/fsstat/fsstat.go +++ b/metricbeat/module/system/fsstat/fsstat.go @@ -20,6 +20,7 @@ package fsstat import ( + "runtime" "strings" "github.com/elastic/beats/v7/libbeat/common" @@ -91,16 +92,23 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { totalSizeUsed += stat.Used } - r.Event(mb.Event{ - MetricSetFields: common.MapStr{ - "total_size": common.MapStr{ - "free": totalSizeFree, - "used": totalSizeUsed, - "total": totalSize, - }, - "count": len(fss), - "total_files": totalFiles, + event := common.MapStr{ + "total_size": common.MapStr{ + "free": totalSizeFree, + "used": totalSizeUsed, + "total": totalSize, }, + "count": len(fss), + "total_files": totalFiles, + } + + //We don't get the `Files` field on Windows + if runtime.GOOS == "windows" { + event["total_files"] = totalFiles + } + + r.Event(mb.Event{ + MetricSetFields: event, }) return nil diff --git a/metricbeat/module/system/memory/_meta/data.json b/metricbeat/module/system/memory/_meta/data.json index 01231bede4c..06abee40a35 100644 --- a/metricbeat/module/system/memory/_meta/data.json +++ b/metricbeat/module/system/memory/_meta/data.json @@ -15,13 +15,13 @@ "system": { "memory": { "actual": { - "free": 14247317504, + "free": 8461623296, "used": { - "bytes": 1407057920, - "pct": 0.0899 + "bytes": 7159164928, + "pct": 0.4583 } }, - "free": 4859097088, + "free": 1299234816, "hugepages": { "default_size": 2097152, "free": 0, @@ -41,49 +41,49 @@ }, "page_stats": { "direct_efficiency": { - "pct": 0.9976 + "pct": 0.9242 }, "kswapd_efficiency": { - "pct": 0.6213 + "pct": 0.7518 }, "pgfree": { - "pages": 4382105954 + "pages": 15924304810 }, "pgscan_direct": { - "pages": 485820 + "pages": 1185751 }, "pgscan_kswapd": { - "pages": 77390925 + "pages": 50008148 }, "pgsteal_direct": { - "pages": 484631 + "pages": 1095884 }, "pgsteal_kswapd": { - "pages": 48081976 + "pages": 37594071 } }, "swap": { - "free": 7846490112, + "free": 7823421440, "in": { - "pages": 1111 + "pages": 2702 }, "out": { - "pages": 20255 + "pages": 23582 }, "readahead": { - "cached": 28, - "pages": 65 + "cached": 554, + "pages": 986 }, "total": 7897870336, "used": { - "bytes": 51380224, - "pct": 0.0065 + "bytes": 74448896, + "pct": 0.0094 } }, - "total": 15654375424, + "total": 15620788224, "used": { - "bytes": 10795278336, - "pct": 0.6896 + "bytes": 14321553408, + "pct": 0.9168 } } } diff --git a/metricbeat/module/system/memory/memory.go b/metricbeat/module/system/memory/memory.go index 90283f801be..27e76b85489 100644 --- a/metricbeat/module/system/memory/memory.go +++ b/metricbeat/module/system/memory/memory.go @@ -20,12 +20,16 @@ package memory import ( + "fmt" + + "github.com/pkg/errors" + "github.com/elastic/beats/v7/libbeat/common" mem "github.com/elastic/beats/v7/libbeat/metric/system/memory" "github.com/elastic/beats/v7/metricbeat/mb" "github.com/elastic/beats/v7/metricbeat/mb/parse" - - "github.com/pkg/errors" + linux "github.com/elastic/beats/v7/metricbeat/module/linux/memory" + "github.com/elastic/beats/v7/metricbeat/module/system" ) func init() { @@ -38,11 +42,18 @@ func init() { // MetricSet for fetching system memory metrics. type MetricSet struct { mb.BaseMetricSet + IsFleet bool } // New is a mb.MetricSetFactory that returns a memory.MetricSet. func New(base mb.BaseMetricSet) (mb.MetricSet, error) { - return &MetricSet{base}, nil + + systemModule, ok := base.Module().(*system.Module) + if !ok { + return nil, fmt.Errorf("unexpected module type") + } + + return &MetricSet{BaseMetricSet: base, IsFleet: systemModule.IsAgent}, nil } // Fetch fetches memory metrics from the OS. @@ -103,70 +114,18 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { "pages": vmstat.SwapRa, "cached": vmstat.SwapRaHit, } - pageStats := common.MapStr{ - "pgscan_kswapd": common.MapStr{ - "pages": vmstat.PgscanKswapd, - }, - "pgscan_direct": common.MapStr{ - "pages": vmstat.PgscanDirect, - }, - "pgfree": common.MapStr{ - "pages": vmstat.Pgfree, - }, - "pgsteal_kswapd": common.MapStr{ - "pages": vmstat.PgstealKswapd, - }, - "pgsteal_direct": common.MapStr{ - "pages": vmstat.PgstealDirect, - }, - } - // This is similar to the vmeff stat gathered by sar - // these ratios calculate thhe efficiency of page reclaim - if vmstat.PgscanDirect != 0 { - pageStats["direct_efficiency"] = common.MapStr{ - "pct": common.Round(float64(vmstat.PgstealDirect)/float64(vmstat.PgscanDirect), common.DefaultDecimalPlacesCount), - } - } + } - if vmstat.PgscanKswapd != 0 { - pageStats["kswapd_efficiency"] = common.MapStr{ - "pct": common.Round(float64(vmstat.PgstealKswapd)/float64(vmstat.PgscanKswapd), common.DefaultDecimalPlacesCount), - } + // for backwards compatibility, only report if we're not in fleet mode + if !m.IsFleet { + err := linux.FetchLinuxMemStats(memory) + if err != nil { + return errors.Wrap(err, "error getting page stats") } - - memory["page_stats"] = pageStats } memory["swap"] = swap - hugePagesStat, err := mem.GetHugeTLBPages() - if err != nil { - return errors.Wrap(err, "hugepages") - } - if hugePagesStat != nil { - mem.AddHugeTLBPagesPercentage(hugePagesStat) - thp := common.MapStr{ - "total": hugePagesStat.Total, - "used": common.MapStr{ - "bytes": hugePagesStat.TotalAllocatedSize, - "pct": hugePagesStat.UsedPercent, - }, - "free": hugePagesStat.Free, - "reserved": hugePagesStat.Reserved, - "surplus": hugePagesStat.Surplus, - "default_size": hugePagesStat.DefaultSize, - } - if vmstat != nil { - thp["swap"] = common.MapStr{ - "out": common.MapStr{ - "pages": vmstat.ThpSwpout, - "fallback": vmstat.ThpSwpoutFallback, - }, - } - } - memory["hugepages"] = thp - } - r.Event(mb.Event{ MetricSetFields: memory, }) diff --git a/metricbeat/module/system/process/_meta/data.json b/metricbeat/module/system/process/_meta/data.json index 78ece4aa114..84b74110683 100644 --- a/metricbeat/module/system/process/_meta/data.json +++ b/metricbeat/module/system/process/_meta/data.json @@ -1,29 +1,26 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.process", "duration": 115000, "module": "system" }, "metricset": { - "name": "process" + "name": "process", + "period": 10000 }, "process": { "args": [ - "/usr/bin/dockerd", - "-H", - "unix://" + "/usr/lib/systemd/systemd", + "--switched-root", + "--system", + "--deserialize", + "28" ], - "executable": "/usr/bin/dockerd-ce", - "name": "dockerd", - "pgid": 2080, - "pid": 2080, - "ppid": 1, - "working_directory": "/" + "name": "systemd", + "pgid": 1, + "pid": 1, + "ppid": 0 }, "service": { "type": "system" @@ -32,11 +29,11 @@ "process": { "cgroup": { "blkio": { - "id": "docker.service", - "path": "/system.slice/docker.service", + "id": "init.scope", + "path": "/init.scope", "total": { - "bytes": 844576104448, - "ios": 54869430 + "bytes": 7453696, + "ios": 548 } }, "cpu": { @@ -49,8 +46,8 @@ }, "shares": 1024 }, - "id": "docker.service", - "path": "/system.slice/docker.service", + "id": "init.scope", + "path": "/init.scope", "rt": { "period": { "us": 0 @@ -68,38 +65,38 @@ } }, "cpuacct": { - "id": "docker.service", - "path": "/system.slice/docker.service", + "id": "init.scope", + "path": "/init.scope", "percpu": { - "1": 7058282754012, - "2": 7053634662537, - "3": 7069386293853, - "4": 7050055153087 + "1": 3930656993407, + "2": 4025787490535, + "3": 4064460082910, + "4": 3387847262532 }, "stats": { "system": { - "ns": 7202920000000 + "ns": 4996000000000 }, "user": { - "ns": 19573240000000 + "ns": 10329380000000 } }, "total": { - "ns": 28231358863489 + "ns": 15408751829384 } }, - "id": "docker.service", + "id": "init.scope", "memory": { - "id": "docker.service", + "id": "init.scope", "kmem": { "failures": 0, "limit": { "bytes": 9223372036854771712 }, "usage": { - "bytes": 21139456, + "bytes": 9404416, "max": { - "bytes": 480030720 + "bytes": 14987264 } } }, @@ -121,95 +118,88 @@ "bytes": 9223372036854771712 }, "usage": { - "bytes": 3337703424, + "bytes": 29437952, "max": { - "bytes": 5245300736 + "bytes": 70705152 } } }, "memsw": { "failures": 0, "limit": { - "bytes": 0 + "bytes": 9223372036854771712 }, "usage": { - "bytes": 0, + "bytes": 30392320, "max": { - "bytes": 0 + "bytes": 70705152 } } }, - "path": "/system.slice/docker.service", + "path": "/init.scope", "stats": { "active_anon": { - "bytes": 779677696 + "bytes": 3444736 }, "active_file": { - "bytes": 1753378816 + "bytes": 10563584 }, "cache": { - "bytes": 2127810560 + "bytes": 10752000 }, "hierarchical_memory_limit": { "bytes": 9223372036854771712 }, "hierarchical_memsw_limit": { - "bytes": 0 + "bytes": 9223372036854771712 }, "inactive_anon": { - "bytes": 409075712 + "bytes": 6197248 }, "inactive_file": { - "bytes": 374431744 + "bytes": 327680 }, - "major_page_faults": 53164, + "major_page_faults": 198, "mapped_file": { - "bytes": 7491584 + "bytes": 9867264 }, - "page_faults": 21923702, - "pages_in": 57261049, - "pages_out": 56521859, + "page_faults": 3626304, + "pages_in": 1095732, + "pages_out": 1090806, "rss": { - "bytes": 1188753408 + "bytes": 9592832 }, "rss_huge": { - "bytes": 56623104 + "bytes": 0 }, "swap": { - "bytes": 0 + "bytes": 675840 }, "unevictable": { "bytes": 0 } } }, - "path": "/system.slice/docker.service" + "path": "/init.scope" }, - "cmdline": "/usr/bin/dockerd -H unix://", + "cmdline": "/usr/lib/systemd/systemd --switched-root --system --deserialize 28", "cpu": { - "start_time": "2019-01-08T17:06:39.000Z", + "start_time": "2020-08-27T01:05:16.000Z", "total": { "norm": { - "pct": 0.0049 + "pct": 0.0056 }, - "pct": 0.0195, - "value": 27827810 + "pct": 0.0222, + "value": 15389060 } }, - "fd": { - "limit": { - "hard": 1048576, - "soft": 1048576 - }, - "open": 68 - }, "memory": { "rss": { - "bytes": 1187336192, - "pct": 0.0716 + "bytes": 12853248, + "pct": 0.0008 }, - "share": 8253440, - "size": 4438523904 + "share": 7118848, + "size": 176881664 }, "state": "sleeping" } @@ -217,4 +207,4 @@ "user": { "name": "root" } -} +} \ No newline at end of file diff --git a/metricbeat/module/system/process/_meta/fields.yml b/metricbeat/module/system/process/_meta/fields.yml index 51ab8b81e09..fe941031551 100644 --- a/metricbeat/module/system/process/_meta/fields.yml +++ b/metricbeat/module/system/process/_meta/fields.yml @@ -96,17 +96,27 @@ type: long format: bytes description: > - The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes. + The Resident Set Size. The amount of memory the process occupied in main memory (RAM). On Windows this represents the current working set size, in bytes. Not available on Windows. - name: rss.pct type: scaled_float format: percent description: > - The percentage of memory the process occupied in main memory (RAM). + The percentage of memory the process occupied in main memory (RAM). Not available on Windows. + - name: wss.bytes + type: long + format: bytes + description: > + The Working Set Size. The amount of memory the process occupied in main memory (RAM). Windows only. + - name: wss.pct + type: scaled_float + format: percent + description: > + The percentage of memory the process occupied in main memory (RAM). Windows only. - name: share type: long format: bytes description: > - The shared memory the process uses. + The shared memory the process uses. Not available on Windows. - name: fd type: group description: > diff --git a/metricbeat/module/system/process/process.go b/metricbeat/module/system/process/process.go index 9c754177372..804c62d06d6 100644 --- a/metricbeat/module/system/process/process.go +++ b/metricbeat/module/system/process/process.go @@ -46,9 +46,10 @@ func init() { // MetricSet that fetches process metrics. type MetricSet struct { mb.BaseMetricSet - stats *process.Stats - cgroup *cgroup.Reader - perCPU bool + stats *process.Stats + cgroup *cgroup.Reader + perCPU bool + IsAgent bool } // New creates and returns a new MetricSet. @@ -58,6 +59,11 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { return nil, err } + systemModule, ok := base.Module().(*system.Module) + if !ok { + return nil, fmt.Errorf("unexpected module type") + } + m := &MetricSet{ BaseMetricSet: base, stats: &process.Stats{ @@ -67,7 +73,8 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { CacheCmdLine: config.CacheCmdLine, IncludeTop: config.IncludeTop, }, - perCPU: config.IncludePerCPU, + perCPU: config.IncludePerCPU, + IsAgent: systemModule.IsAgent, } err := m.stats.Init() if err != nil { @@ -75,11 +82,6 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { } if runtime.GOOS == "linux" { - systemModule, ok := base.Module().(*system.Module) - if !ok { - return nil, fmt.Errorf("unexpected module type") - } - if config.Cgroups == nil || *config.Cgroups { debugf("process cgroup data collection is enabled, using hostfs='%v'", systemModule.HostFS) m.cgroup, err = cgroup.NewReader(systemModule.HostFS, true) @@ -148,6 +150,22 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { rootFields.Put("process.args", args) } + // This is a temporary fix until we make these changes global across libbeat + // This logic should happen in libbeat getProcessEvent() + + // There's some more Windows memory quirks we need to deal with. + // "rss" is a linux concept, but "wss" is a direct match on Windows. + // "share" is also unavailable on Windows. + + if m.IsAgent { + if runtime.GOOS == "windows" { + proc.Delete("memory.share") + if setSize := getAndRemove(proc, "memory.rss"); setSize != nil { + proc.Put("memory.wss", setSize) + } + } + } + e := mb.Event{ RootFields: rootFields, MetricSetFields: proc, diff --git a/metricbeat/module/system/process_summary/_meta/data.json b/metricbeat/module/system/process_summary/_meta/data.json index 363e5f77a0d..159defcb769 100644 --- a/metricbeat/module/system/process_summary/_meta/data.json +++ b/metricbeat/module/system/process_summary/_meta/data.json @@ -1,16 +1,13 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.process.summary", "duration": 115000, "module": "system" }, "metricset": { - "name": "process_summary" + "name": "process_summary", + "period": 10000 }, "service": { "type": "system" @@ -19,13 +16,13 @@ "process": { "summary": { "dead": 0, - "idle": 112, - "running": 0, - "sleeping": 288, + "idle": 63, + "running": 3, + "sleeping": 117, "stopped": 0, - "total": 401, - "unknown": 0, - "zombie": 1 + "total": 185, + "unknown": 2, + "zombie": 0 } } } diff --git a/metricbeat/module/system/process_summary/process_summary.go b/metricbeat/module/system/process_summary/process_summary.go index 071a7b2a660..5edb31f9182 100644 --- a/metricbeat/module/system/process_summary/process_summary.go +++ b/metricbeat/module/system/process_summary/process_summary.go @@ -20,6 +20,8 @@ package process_summary import ( + "runtime" + "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/common" @@ -79,7 +81,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { state := sigar.ProcState{} err = state.Get(pid) if err != nil { - summary.unknown += 1 + summary.unknown++ continue } @@ -104,15 +106,25 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { } } - event := common.MapStr{ - "total": len(pids), - "sleeping": summary.sleeping, - "running": summary.running, - "idle": summary.idle, - "stopped": summary.stopped, - "zombie": summary.zombie, - "unknown": summary.unknown, - "dead": summary.dead, + event := common.MapStr{} + if runtime.GOOS == "windows" { + event = common.MapStr{ + "total": len(pids), + "sleeping": summary.sleeping, + "running": summary.running, + "unknown": summary.unknown, + } + } else { + event = common.MapStr{ + "total": len(pids), + "sleeping": summary.sleeping, + "running": summary.running, + "idle": summary.idle, + "stopped": summary.stopped, + "zombie": summary.zombie, + "unknown": summary.unknown, + "dead": summary.dead, + } } r.Event(mb.Event{ diff --git a/metricbeat/module/system/process_summary/process_summary_test.go b/metricbeat/module/system/process_summary/process_summary_test.go index 55afce8f190..c95e361224c 100644 --- a/metricbeat/module/system/process_summary/process_summary_test.go +++ b/metricbeat/module/system/process_summary/process_summary_test.go @@ -20,6 +20,7 @@ package process_summary import ( + "runtime" "testing" "github.com/stretchr/testify/assert" @@ -53,18 +54,26 @@ func TestFetch(t *testing.T) { event, ok := summary.(common.MapStr) require.True(t, ok) - assert.Contains(t, event, "total") - assert.Contains(t, event, "sleeping") - assert.Contains(t, event, "running") - assert.Contains(t, event, "idle") - assert.Contains(t, event, "stopped") - assert.Contains(t, event, "zombie") - assert.Contains(t, event, "unknown") + if runtime.GOOS == "windows" { + assert.Contains(t, event, "total") + assert.Contains(t, event, "sleeping") + assert.Contains(t, event, "running") + assert.Contains(t, event, "unknown") + total := event["sleeping"].(int) + event["running"].(int) + event["unknown"].(int) + assert.Equal(t, event["total"].(int), total) + } else { + assert.Contains(t, event, "total") + assert.Contains(t, event, "sleeping") + assert.Contains(t, event, "running") + assert.Contains(t, event, "idle") + assert.Contains(t, event, "stopped") + assert.Contains(t, event, "zombie") + assert.Contains(t, event, "unknown") + total := event["sleeping"].(int) + event["running"].(int) + event["idle"].(int) + + event["stopped"].(int) + event["zombie"].(int) + event["unknown"].(int) - total := event["sleeping"].(int) + event["running"].(int) + event["idle"].(int) + - event["stopped"].(int) + event["zombie"].(int) + event["unknown"].(int) - - assert.Equal(t, event["total"].(int), total) + assert.Equal(t, event["total"].(int), total) + } } func getConfig() map[string]interface{} { diff --git a/metricbeat/module/system/system.go b/metricbeat/module/system/system.go index edb9f55bf6b..f1f060a90bc 100644 --- a/metricbeat/module/system/system.go +++ b/metricbeat/module/system/system.go @@ -21,10 +21,12 @@ import ( "flag" "sync" + "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/metricbeat/mb" ) var ( + // HostFS is an alternate mountpoint for the filesytem root, for when metricbeat is running inside a container. HostFS = flag.String("system.hostfs", "", "mountpoint of the host's filesystem for use in monitoring a host from within a container") ) @@ -37,16 +39,48 @@ func init() { } } +// Module represents the system module type Module struct { mb.BaseModule - HostFS string // Mountpoint of the host's filesystem for use in monitoring inside a container. + HostFS string // Mountpoint of the host's filesystem for use in monitoring inside a container. + IsAgent bool // Looks to see if metricbeat is running under agent. Useful if we have breaking changes in one but not the other. } +// NewModule instatiates the system module func NewModule(base mb.BaseModule) (mb.Module, error) { // This only needs to be configured once for all system modules. once.Do(func() { initModule() }) - return &Module{BaseModule: base, HostFS: *HostFS}, nil + return &Module{BaseModule: base, HostFS: *HostFS, IsAgent: checkMgmtFlags()}, nil +} + +// checkMgmtFlags checks to see if metricbeat is running under Agent +// The management setting is stored in the main Beat runtime object, but we can't see that from a module +// So instead we check the CLI flags, since Agent starts metricbeat with "-E", "management.mode=x-pack-fleet", "-E", "management.enabled=true" +func checkMgmtFlags() bool { + type management struct { + Mode string `config:"management.mode"` + Enabled bool `config:"management.enabled"` + } + var managementSettings management + + cfgFlag := flag.Lookup("E") + if cfgFlag == nil { + return false + } + + CfgObject, _ := cfgFlag.Value.(*common.SettingsFlag) + cliCfg := CfgObject.Config() + + err := cliCfg.Unpack(&managementSettings) + if err != nil { + return false + } + + if managementSettings.Enabled == true && managementSettings.Mode == "x-pack-fleet" { + return true + } + return false } diff --git a/metricbeat/module/system/test_system.py b/metricbeat/module/system/test_system.py index f689b99fb4c..0cfb820c18a 100644 --- a/metricbeat/module/system/test_system.py +++ b/metricbeat/module/system/test_system.py @@ -7,13 +7,23 @@ import unittest -SYSTEM_CPU_FIELDS = ["cores", "idle.pct", "iowait.pct", "irq.pct", "nice.pct", - "softirq.pct", "steal.pct", "system.pct", "user.pct", "total.pct"] +SYSTEM_CPU_FIELDS_LINUX = ["cores", "idle.pct", "iowait.pct", "irq.pct", "nice.pct", + "softirq.pct", "steal.pct", "system.pct", "user.pct", "total.pct"] -SYSTEM_CPU_FIELDS_ALL = ["cores", "idle.pct", "idle.ticks", "iowait.pct", "iowait.ticks", "irq.pct", "irq.ticks", "nice.pct", "nice.ticks", - "softirq.pct", "softirq.ticks", "steal.pct", "steal.ticks", "system.pct", "system.ticks", "user.pct", "user.ticks", - "idle.norm.pct", "iowait.norm.pct", "irq.norm.pct", "nice.norm.pct", "softirq.norm.pct", - "steal.norm.pct", "system.norm.pct", "user.norm.pct", "total.norm.pct", "total.value"] +SYSTEM_CPU_FIELDS_WINDOWS = ["cores", "idle.pct", "system.pct", "user.pct", "total.pct"] + +SYSTEM_CPU_FIELDS_DARWIN = ["cores", "idle.pct", "system.pct", "user.pct", "total.pct", "nice.pct"] + +SYSTEM_CPU_FIELDS_LINUX_ALL = ["cores", "idle.pct", "idle.ticks", "iowait.pct", "iowait.ticks", "irq.pct", "irq.ticks", "nice.pct", "nice.ticks", + "softirq.pct", "softirq.ticks", "steal.pct", "steal.ticks", "system.pct", "system.ticks", "user.pct", "user.ticks", + "idle.norm.pct", "iowait.norm.pct", "irq.norm.pct", "nice.norm.pct", "softirq.norm.pct", + "steal.norm.pct", "system.norm.pct", "user.norm.pct", "total.norm.pct", "total.value"] + +SYSTEM_CPU_FIELDS_WINDOWS_ALL = ["cores", "idle.pct", "idle.ticks", "system.pct", "system.ticks", "user.pct", "user.ticks", + "idle.norm.pct", "system.norm.pct", "user.norm.pct", "total.norm.pct", "total.value"] + +SYSTEM_CPU_FIELDS_DARWIN_ALL = ["cores", "idle.pct", "idle.ticks", "nice.pct", "nice.ticks", "system.pct", "system.ticks", "user.pct", "user.ticks", + "idle.norm.pct", "nice.norm.pct", "system.norm.pct", "user.norm.pct", "total.norm.pct", "total.value"] SYSTEM_LOAD_FIELDS = ["cores", "1", "5", "15", "norm.1", "norm.5", "norm.15"] @@ -37,6 +47,10 @@ "free_files", "mount_point", "total", "used.bytes", "used.pct"] +SYSTEM_FILESYSTEM_FIELDS_WINDOWS = ["available", "device_name", "type", "files", + "mount_point", "total", "used.bytes", + "used.pct"] + SYSTEM_FSSTAT_FIELDS = ["count", "total_files", "total_size"] SYSTEM_MEMORY_FIELDS = ["swap", "actual.free", "free", "total", "used.bytes", "used.pct", "actual.used.bytes", @@ -82,7 +96,12 @@ def test_cpu(self): if "system" in evt: cpu = evt["system"]["cpu"] - self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS), cpu.keys()) + if sys.platform.startswith("linux"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_LINUX), cpu.keys()) + elif sys.platform.startswith("darwin"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_DARWIN), cpu.keys()) + elif sys.platform.startswith("win"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_WINDOWS), cpu.keys()) else: host_cpu = evt["host"]["cpu"] self.assertCountEqual(self.de_dot(SYSTEM_CPU_HOST_FIELDS), host_cpu.keys()) @@ -111,7 +130,12 @@ def test_cpu_ticks_option(self): for evt in output: self.assert_fields_are_documented(evt) cpuStats = evt["system"]["cpu"] - self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_ALL), cpuStats.keys()) + if sys.platform.startswith("linux"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_LINUX_ALL), cpuStats.keys()) + elif sys.platform.startswith("win"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_WINDOWS_ALL), cpuStats.keys()) + elif sys.platform.startswith("darwin"): + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS_DARWIN_ALL), cpuStats.keys()) @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd|openbsd", sys.platform), "os") def test_core(self): @@ -261,7 +285,10 @@ def test_filesystem(self): for evt in output: self.assert_fields_are_documented(evt) filesystem = evt["system"]["filesystem"] - self.assertCountEqual(self.de_dot(SYSTEM_FILESYSTEM_FIELDS), filesystem.keys()) + if sys.platform.startswith("win"): + self.assertCountEqual(self.de_dot(SYSTEM_FILESYSTEM_FIELDS_WINDOWS), filesystem.keys()) + else: + self.assertCountEqual(self.de_dot(SYSTEM_FILESYSTEM_FIELDS), filesystem.keys()) @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd|openbsd", sys.platform), "os") def test_fsstat(self): @@ -378,13 +405,17 @@ def test_process_summary(self): assert isinstance(summary["total"], int) assert isinstance(summary["sleeping"], int) assert isinstance(summary["running"], int) - assert isinstance(summary["idle"], int) - assert isinstance(summary["stopped"], int) - assert isinstance(summary["zombie"], int) assert isinstance(summary["unknown"], int) - assert summary["total"] == summary["sleeping"] + summary["running"] + \ - summary["idle"] + summary["stopped"] + summary["zombie"] + summary["unknown"] + if not sys.platform.startswith("win"): + assert isinstance(summary["idle"], int) + assert isinstance(summary["stopped"], int) + assert isinstance(summary["zombie"], int) + assert summary["total"] == summary["sleeping"] + summary["running"] + \ + summary["idle"] + summary["stopped"] + summary["zombie"] + summary["unknown"] + + if sys.platform.startswith("windows"): + assert summary["total"] == summary["sleeping"] + summary["running"] + summary["unknown"] @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd", sys.platform), "os") def test_process(self): diff --git a/metricbeat/modules.d/linux.yml.disabled b/metricbeat/modules.d/linux.yml.disabled index a01989aa0c9..22e675cafff 100644 --- a/metricbeat/modules.d/linux.yml.disabled +++ b/metricbeat/modules.d/linux.yml.disabled @@ -5,8 +5,10 @@ period: 10s metricsets: - "pageinfo" + - "memory" # - ksm # - conntrack + # - iostat enabled: true #hostfs: /hostfs diff --git a/metricbeat/tests/system/test_processors.py b/metricbeat/tests/system/test_processors.py index 2f7d131d119..a680c049d67 100644 --- a/metricbeat/tests/system/test_processors.py +++ b/metricbeat/tests/system/test_processors.py @@ -12,13 +12,13 @@ def test_drop_fields(self): self.render_config_template( modules=[{ "name": "system", - "metricsets": ["cpu"], + "metricsets": ["network"], "period": "1s" }], processors=[{ "drop_fields": { "when": "range.system.cpu.system.pct.lt: 0.1", - "fields": ["system.cpu.load"], + "fields": ["system.network.in"], }, }] ) @@ -27,7 +27,7 @@ def test_drop_fields(self): proc.check_kill_and_wait() output = self.read_output_json() - self.assertEqual(len(output), 1) + self.assertGreater(len(output), 1) evt = output[0] self.assert_fields_are_documented(evt) @@ -37,12 +37,9 @@ def test_drop_fields(self): 'agent', '@timestamp', 'system', 'metricset.module', 'metricset.rtt', 'metricset.name', 'host', 'service', 'ecs', 'event' ]), evt.keys()) - cpu = evt["system"]["cpu"] - print(list(cpu.keys())) - self.assertCountEqual(self.de_dot([ - "system", "cores", "user", "softirq", "iowait", - "idle", "irq", "steal", "nice", "total" - ]), cpu.keys()) + network = evt["system"]["network"] + print(list(network.keys())) + self.assertCountEqual(self.de_dot(["name", "out", "in"]), network.keys()) def test_dropfields_with_condition(self): """ diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index 17c9234ea9f..bd99c2cf508 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -902,8 +902,10 @@ metricbeat.modules: period: 10s metricsets: - "pageinfo" + - "memory" # - ksm # - conntrack + # - iostat enabled: true #hostfs: /hostfs From fac0347d36205abd3e9e1ac377fdd9d263b8c9f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bernhard=20Fl=C3=BChmann?= Date: Wed, 7 Oct 2020 01:56:39 +0200 Subject: [PATCH 155/216] docs: Update timestamp.asciidoc (#20395) --- libbeat/processors/timestamp/docs/timestamp.asciidoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libbeat/processors/timestamp/docs/timestamp.asciidoc b/libbeat/processors/timestamp/docs/timestamp.asciidoc index 83421c584a7..eb5ba628995 100644 --- a/libbeat/processors/timestamp/docs/timestamp.asciidoc +++ b/libbeat/processors/timestamp/docs/timestamp.asciidoc @@ -50,7 +50,7 @@ If a layout does not contain a year then the current year in the specified Here is an example that parses the `start_time` field and writes the result to the `@timestamp` field then deletes the `start_time` field. When the -processor is loaded it will immediately validate that the two `test` timestamps +processor is loaded, it will immediately validate that the two `test` timestamps parse with this configuration. [source,yaml] @@ -61,9 +61,11 @@ processors: layouts: - '2006-01-02T15:04:05Z' - '2006-01-02T15:04:05.999Z' + - '2006-01-02T15:04:05.999-07:00' test: - '2019-06-22T16:33:51Z' - '2019-11-18T04:59:51.123Z' + - '2020-08-03T07:10:20.123456+02:00' - drop_fields: fields: [start_time] ---- From b58aeb6e4b928659572df8d70118d7e31f26e1ef Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 7 Oct 2020 12:33:19 +0200 Subject: [PATCH 156/216] Fix badger build in 386 (#21613) Use a fork with the latest released version including the fix for the issue with 32-bit architectures. Fix uses uint32 instead of 32-bit int to avoid overflow in constant with max uint32. --- NOTICE.txt | 6 +++--- go.mod | 1 + go.sum | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index 0017abeba1a..b62c4b5d202 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -4473,12 +4473,12 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/dgraph-io/badger/v2 -Version: v2.2007.2 +Dependency : github.com/elastic/badger/v2 +Version: v2.2007.2-beats Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/dgraph-io/badger/v2@v2.2007.2/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/elastic/badger/v2@v2.2007.2-beats/LICENSE: Apache License Version 2.0, January 2004 diff --git a/go.mod b/go.mod index bb31374384a..0f0bdb3a422 100644 --- a/go.mod +++ b/go.mod @@ -191,6 +191,7 @@ replace ( github.com/Azure/go-autorest => github.com/Azure/go-autorest v12.2.0+incompatible github.com/Shopify/sarama => github.com/elastic/sarama v1.19.1-0.20200629123429-0e7b69039eec github.com/cucumber/godog => github.com/cucumber/godog v0.8.1 + github.com/dgraph-io/badger/v2 => github.com/elastic/badger/v2 v2.2007.2-beats github.com/docker/docker => github.com/docker/engine v0.0.0-20191113042239-ea84732a7725 github.com/docker/go-plugins-helpers => github.com/elastic/go-plugins-helpers v0.0.0-20200207104224-bdf17607b79f github.com/dop251/goja => github.com/andrewkroh/goja v0.0.0-20190128172624-dd2ac4456e20 diff --git a/go.sum b/go.sum index 8113d42f321..6f737d7cee2 100644 --- a/go.sum +++ b/go.sum @@ -201,8 +201,6 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200206145737-bbfc9a55622e/go.mod h1:xb github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2 h1:6+hM8KeYKV0Z9EIINNqIEDyyIRAcNc2FW+/TUYNmWyw= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= -github.com/dgraph-io/badger/v2 v2.2007.2 h1:EjjK0KqwaFMlPin1ajhP943VPENHJdEz1KLIegjaI3k= -github.com/dgraph-io/badger/v2 v2.2007.2/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDmM2p1e+NhhnBCAE= github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de h1:t0UHb5vdojIDUqktM6+xJAfScFBsVpXZmqC9dsgJmeA= github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= @@ -241,6 +239,8 @@ github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc= github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I= github.com/eclipse/paho.mqtt.golang v1.2.1-0.20200121105743-0d940dd29fd2 h1:DW6WrARxK5J+o8uAKCiACi5wy9EK1UzrsCpGBPsKHAA= github.com/eclipse/paho.mqtt.golang v1.2.1-0.20200121105743-0d940dd29fd2/go.mod h1:H9keYFcgq3Qr5OUJm/JZI/i6U7joQ8SYLhZwfeOo6Ts= +github.com/elastic/badger/v2 v2.2007.2-beats h1:/rV4bM6fdYvPQhFf2bHHivIb0H4nX8Or7nkWbQ/Q6Ko= +github.com/elastic/badger/v2 v2.2007.2-beats/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDmM2p1e+NhhnBCAE= github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3 h1:lnDkqiRFKm0rxdljqrj3lotWinO9+jFmeDXIC4gvIQs= github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3/go.mod h1:aPqzac6AYkipvp4hufTyMj5PDIphF3+At8zr7r51xjY= github.com/elastic/ecs v1.6.0 h1:8NmgfnsjmKXh9hVsK3H2tZtfUptepNc3msJOAynhtmc= From 3e86c2af0594d792f62af39a0b0e6b530e9aa90d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Wed, 7 Oct 2020 13:02:34 +0200 Subject: [PATCH 157/216] [E2E Tests] fix: set versions ony for PRs (#21608) * fix: set versions ony for PRs We want to use default versions per branch when running after a merge * fix: add trailing comma Co-authored-by: Victor Martinez Co-authored-by: Victor Martinez --- .ci/packaging.groovy | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index 301ead43bab..26916372b70 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -245,19 +245,25 @@ def triggerE2ETests(String suite) { def branchName = isPR() ? "${env.CHANGE_TARGET}" : "${env.JOB_BASE_NAME}" def e2eTestsPipeline = "e2e-tests/e2e-testing-mbp/${branchName}" + + def parameters = [ + booleanParam(name: 'forceSkipGitChecks', value: true), + booleanParam(name: 'forceSkipPresubmit', value: true), + booleanParam(name: 'notifyOnGreenBuilds', value: !isPR()), + string(name: 'runTestsSuites', value: suite), + string(name: 'GITHUB_CHECK_NAME', value: env.GITHUB_CHECK_E2E_TESTS_NAME), + string(name: 'GITHUB_CHECK_REPO', value: env.REPO), + string(name: 'GITHUB_CHECK_SHA1', value: env.GIT_BASE_COMMIT), + ] + if (isPR()) { + def version = "pr-${env.CHANGE_ID}" + parameters.push(booleanParam(name: 'USE_CI_SNAPSHOTS', value: true)) + parameters.push(string(name: 'ELASTIC_AGENT_VERSION', value: "${version}")) + parameters.push(string(name: 'METRICBEAT_VERSION', value: "${version}")) + } + build(job: "${e2eTestsPipeline}", - parameters: [ - booleanParam(name: 'forceSkipGitChecks', value: true), - booleanParam(name: 'forceSkipPresubmit', value: true), - booleanParam(name: 'notifyOnGreenBuilds', value: !isPR()), - booleanParam(name: 'USE_CI_SNAPSHOTS', value: true), - string(name: 'ELASTIC_AGENT_VERSION', value: "pr-${env.CHANGE_ID}"), - string(name: 'METRICBEAT_VERSION', value: "pr-${env.CHANGE_ID}"), - string(name: 'runTestsSuites', value: suite), - string(name: 'GITHUB_CHECK_NAME', value: env.GITHUB_CHECK_E2E_TESTS_NAME), - string(name: 'GITHUB_CHECK_REPO', value: env.REPO), - string(name: 'GITHUB_CHECK_SHA1', value: env.GIT_BASE_COMMIT), - ], + parameters: parameters, propagate: false, wait: false ) From 36953dfe6a587c0083cacb350f4d274e09d634a4 Mon Sep 17 00:00:00 2001 From: Dan Roscigno Date: Wed, 7 Oct 2020 09:59:05 -0400 Subject: [PATCH 158/216] Add `add_observer_metadata` `geo.name` to Quickstart (#21501) * Add `add_observer_metadata` `geo.name` to Quickstart The observer location is very important in the Uptime app and the out-of-the-box machine learning job. * Update getting-started.asciidoc The instructions about editing heartbeat.yml were too wordy * tighten it up! Co-authored-by: DeDe Morton Co-authored-by: DeDe Morton --- heartbeat/docs/getting-started.asciidoc | 40 +++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/heartbeat/docs/getting-started.asciidoc b/heartbeat/docs/getting-started.asciidoc index 21da1fb0547..1cd73dbb04f 100644 --- a/heartbeat/docs/getting-started.asciidoc +++ b/heartbeat/docs/getting-started.asciidoc @@ -96,9 +96,43 @@ was started. Heartbeat adds the `@every` keyword to the syntax provided by the include::{libbeat-dir}/shared/config-check.asciidoc[] +[float] +[[configurelocation]] +=== Step 4: Configure the Heartbeat location + +Heartbeat can be deployed in multiple locations so that you can detect +differences in availability and response times across those locations. +Configure the Heartbeat location to allow {kib} to display location-specific +information on Uptime maps and perform Uptime anomaly detection based +on location. + +To configure the location of a Heartbeat instance, modify the +`add_observer_metadata` processor in +{beatname_lc}.yml+. The following +example specifies the `geo.name` of the `add_observer_metadata` processor as +`us-east-1a`: + +[source,yaml] +---------------------------------------------------------------------- +# ============================ Processors ============================ + +processors: + - add_observer_metadata: + # Optional, but recommended geo settings for the location Heartbeat is running in + geo: <1> + # Token describing this location + name: us-east-1a <2> + # Lat, Lon " + #location: "37.926868, -78.024902" <3> +---------------------------------------------------------------------- +<1> Uncomment the `geo` setting. +<2> Uncomment `name` and assign the name of the location of the Heartbeat server. +<3> Optionally uncomment `location` and assign the latitude and longitude. + +include::{libbeat-dir}/shared/config-check.asciidoc[] + [float] [[setup-assets]] -=== Step 4: Set up assets +=== Step 5: Set up assets {beatname_uc} comes with predefined assets for parsing, indexing, and visualizing your data. To load these assets: @@ -128,7 +162,7 @@ environment. If you're using a different output, such as {ls}, see [float] [[start]] -=== Step 5: Start Heartbeat +=== Step 6: Start Heartbeat Before starting {beatname_uc}, modify the user credentials in +{beatname_lc}.yml+ and specify a user who is @@ -145,7 +179,7 @@ events to your defined output. [float] [[view-data]] -=== Step 6: View your data in {kib} +=== Step 7: View your data in {kib} {beatname_uc} comes with pre-built {kib} dashboards and UIs for visualizing the status of your services. The dashboards are available in the From 00d0419b9d1cadc4b2feb3c0676d7661d4786cfa Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 7 Oct 2020 15:03:22 +0100 Subject: [PATCH 159/216] [CI] Change notification channel (#21559) --- Jenkinsfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index df75ad2ccd1..17041987b27 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -24,7 +24,7 @@ pipeline { PIPELINE_LOG_LEVEL = 'INFO' PYTEST_ADDOPTS = "${params.PYTEST_ADDOPTS}" RUNBLD_DISABLE_NOTIFICATIONS = 'true' - SLACK_CHANNEL = "#beats-ci-builds" + SLACK_CHANNEL = "#beats-build" TERRAFORM_VERSION = "0.12.24" XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' } @@ -122,7 +122,7 @@ pipeline { runbld(stashedTestReports: stashedTestReports, project: env.REPO) } cleanup { - notifyBuildResult(prComment: true, slackComment: true) + notifyBuildResult(prComment: true, slackComment: true, slackNotify: (isBranch() || isTag())) } } } From 030077ce9098bbb419fe92843a2ce3ad25860b20 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Wed, 7 Oct 2020 08:22:34 -0600 Subject: [PATCH 160/216] [Filebeat S3] Change log.file.path to be nested object (#21624) --- x-pack/filebeat/input/s3/collector.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/x-pack/filebeat/input/s3/collector.go b/x-pack/filebeat/input/s3/collector.go index 2976dd52a5b..bf294f94245 100644 --- a/x-pack/filebeat/input/s3/collector.go +++ b/x-pack/filebeat/input/s3/collector.go @@ -556,8 +556,10 @@ func createEvent(log string, offset int, info s3Info, objectHash string, s3Ctx * Fields: common.MapStr{ "message": log, "log": common.MapStr{ - "offset": int64(offset), - "file.path": constructObjectURL(info), + "offset": int64(offset), + "file": common.MapStr{ + "path": constructObjectURL(info), + }, }, "aws": common.MapStr{ "s3": common.MapStr{ From 048a404985dae344e340b82ddd14698f7fa86bed Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Wed, 7 Oct 2020 08:25:54 -0600 Subject: [PATCH 161/216] Add fips_enabled into all aws filesets (#21626) --- x-pack/filebeat/module/aws/cloudtrail/config/s3.yml | 4 ++++ x-pack/filebeat/module/aws/cloudwatch/config/s3.yml | 4 ++++ x-pack/filebeat/module/aws/ec2/config/s3.yml | 4 ++++ x-pack/filebeat/module/aws/elb/config/s3.yml | 4 ++++ x-pack/filebeat/module/aws/s3access/config/s3.yml | 4 ++++ x-pack/filebeat/module/aws/vpcflow/config/input.yml | 4 ++++ 6 files changed, 24 insertions(+) diff --git a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml index 7c455f64f26..ac1caacf21c 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml @@ -51,6 +51,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml b/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml index 5d2d75dc5d8..bdb0ff350f0 100644 --- a/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml +++ b/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml @@ -37,6 +37,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/aws/ec2/config/s3.yml b/x-pack/filebeat/module/aws/ec2/config/s3.yml index 5d2d75dc5d8..bdb0ff350f0 100644 --- a/x-pack/filebeat/module/aws/ec2/config/s3.yml +++ b/x-pack/filebeat/module/aws/ec2/config/s3.yml @@ -37,6 +37,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/aws/elb/config/s3.yml b/x-pack/filebeat/module/aws/elb/config/s3.yml index 5d2d75dc5d8..bdb0ff350f0 100644 --- a/x-pack/filebeat/module/aws/elb/config/s3.yml +++ b/x-pack/filebeat/module/aws/elb/config/s3.yml @@ -37,6 +37,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/aws/s3access/config/s3.yml b/x-pack/filebeat/module/aws/s3access/config/s3.yml index 5d2d75dc5d8..bdb0ff350f0 100644 --- a/x-pack/filebeat/module/aws/s3access/config/s3.yml +++ b/x-pack/filebeat/module/aws/s3access/config/s3.yml @@ -37,6 +37,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/aws/vpcflow/config/input.yml b/x-pack/filebeat/module/aws/vpcflow/config/input.yml index d0c18047ca4..628196b7d3e 100644 --- a/x-pack/filebeat/module/aws/vpcflow/config/input.yml +++ b/x-pack/filebeat/module/aws/vpcflow/config/input.yml @@ -39,6 +39,10 @@ session_token: {{ .session_token }} role_arn: {{ .role_arn }} {{ end }} +{{ if .fips_enabled }} +fips_enabled: {{ .fips_enabled }} +{{ end }} + {{ else if eq .input "file" }} type: log From cf5fafb157c127c0159e55697ac8a2baf9f1e710 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 7 Oct 2020 17:56:16 +0200 Subject: [PATCH 162/216] Add openstack ssl provider in add_cloud_metadata (#21590) Add a new provider to query metadata from OpenStack deployments using HTTPS. Add the usual SSL settings available in other features that support TLS. --- CHANGELOG.next.asciidoc | 1 + .../add_cloud_metadata/add_cloud_metadata.go | 16 ++++++++-- .../processors/add_cloud_metadata/config.go | 9 ++++-- .../docs/add_cloud_metadata.asciidoc | 4 +++ .../add_cloud_metadata/http_fetcher.go | 11 +++++-- .../provider_openstack_nova.go | 18 +++++++---- .../provider_openstack_nova_test.go | 30 ++++++++++++++++--- .../add_cloud_metadata/providers.go | 25 +++++++++------- 8 files changed, 87 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6b4a999e0ec..cc8fb52396a 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -453,6 +453,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Cloud Foundry metadata is cached to disk. {pull}20775[20775] - Add option to select the type of index template to load: legacy, component, index. {pull}21212[21212] - Release `add_cloudfoundry_metadata` as GA. {pull}21525[21525] +- Add support for OpenStack SSL metadata APIs in `add_cloud_metadata`. {pull}21590[21590] *Auditbeat* diff --git a/libbeat/processors/add_cloud_metadata/add_cloud_metadata.go b/libbeat/processors/add_cloud_metadata/add_cloud_metadata.go index de1a8063667..5376d563fca 100644 --- a/libbeat/processors/add_cloud_metadata/add_cloud_metadata.go +++ b/libbeat/processors/add_cloud_metadata/add_cloud_metadata.go @@ -26,6 +26,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/beats/v7/libbeat/processors" jsprocessor "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/processor" @@ -53,6 +54,7 @@ type addCloudMetadata struct { type initData struct { fetchers []metadataFetcher timeout time.Duration + tlsConfig *tlscommon.TLSConfig overwrite bool } @@ -63,14 +65,24 @@ func New(c *common.Config) (processors.Processor, error) { return nil, errors.Wrap(err, "failed to unpack add_cloud_metadata config") } + tlsConfig, err := tlscommon.LoadTLSConfig(config.TLS) + if err != nil { + return nil, errors.Wrap(err, "TLS configuration load") + } + initProviders := selectProviders(config.Providers, cloudMetaProviders) fetchers, err := setupFetchers(initProviders, c) if err != nil { return nil, err } p := &addCloudMetadata{ - initData: &initData{fetchers, config.Timeout, config.Overwrite}, - logger: logp.NewLogger("add_cloud_metadata"), + initData: &initData{ + fetchers: fetchers, + timeout: config.Timeout, + tlsConfig: tlsConfig, + overwrite: config.Overwrite, + }, + logger: logp.NewLogger("add_cloud_metadata"), } go p.init() diff --git a/libbeat/processors/add_cloud_metadata/config.go b/libbeat/processors/add_cloud_metadata/config.go index 08f4a241483..93a31137592 100644 --- a/libbeat/processors/add_cloud_metadata/config.go +++ b/libbeat/processors/add_cloud_metadata/config.go @@ -20,12 +20,15 @@ package add_cloud_metadata import ( "fmt" "time" + + "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" ) type config struct { - Timeout time.Duration `config:"timeout"` // Amount of time to wait for responses from the metadata services. - Overwrite bool `config:"overwrite"` // Overwrite if cloud.* fields already exist. - Providers providerList `config:"providers"` // List of providers to probe + Timeout time.Duration `config:"timeout"` // Amount of time to wait for responses from the metadata services. + TLS *tlscommon.Config `config:"ssl"` // TLS configuration + Overwrite bool `config:"overwrite"` // Overwrite if cloud.* fields already exist. + Providers providerList `config:"providers"` // List of providers to probe } type providerList []string diff --git a/libbeat/processors/add_cloud_metadata/docs/add_cloud_metadata.asciidoc b/libbeat/processors/add_cloud_metadata/docs/add_cloud_metadata.asciidoc index 41c0dd6d9f3..44497f31539 100644 --- a/libbeat/processors/add_cloud_metadata/docs/add_cloud_metadata.asciidoc +++ b/libbeat/processors/add_cloud_metadata/docs/add_cloud_metadata.asciidoc @@ -52,12 +52,16 @@ List of names the `providers` setting supports: - "aws", or "ec2" for Amazon Web Services (enabled by default). - "gcp" for Google Copmute Enging (enabled by default). - "openstack", or "nova" for Openstack Nova (enabled by default). +- "openstack-ssl", or "nova-ssl" for Openstack Nova when SSL metadata APIs are enabled (enabled by default). - "tencent", or "qcloud" for Tencent Cloud (disabled by default). The third optional configuration setting is `overwrite`. When `overwrite` is `true`, `add_cloud_metadata` overwrites existing `cloud.*` fields (`false` by default). +The `add_cloud_metadata` processor supports SSL options to configure the http +client used to query cloud metadata. See <> for more information. + The metadata that is added to events varies by hosting provider. Below are examples for each of the supported providers. diff --git a/libbeat/processors/add_cloud_metadata/http_fetcher.go b/libbeat/processors/add_cloud_metadata/http_fetcher.go index e9b18478661..e337edd5be9 100644 --- a/libbeat/processors/add_cloud_metadata/http_fetcher.go +++ b/libbeat/processors/add_cloud_metadata/http_fetcher.go @@ -27,6 +27,7 @@ import ( "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" ) type httpMetadataFetcher struct { @@ -127,9 +128,15 @@ func (f *httpMetadataFetcher) fetchRaw( // getMetadataURLs loads config and generates the metadata URLs. func getMetadataURLs(c *common.Config, defaultHost string, metadataURIs []string) ([]string, error) { + return getMetadataURLsWithScheme(c, "http", defaultHost, metadataURIs) +} + +// getMetadataURLsWithScheme loads config and generates the metadata URLs. +func getMetadataURLsWithScheme(c *common.Config, scheme string, defaultHost string, metadataURIs []string) ([]string, error) { var urls []string config := struct { - MetadataHostAndPort string `config:"host"` // Specifies the host and port of the metadata service (for testing purposes only). + MetadataHostAndPort string `config:"host"` // Specifies the host and port of the metadata service (for testing purposes only). + TLSConfig *tlscommon.Config `config:"ssl"` }{ MetadataHostAndPort: defaultHost, } @@ -138,7 +145,7 @@ func getMetadataURLs(c *common.Config, defaultHost string, metadataURIs []string return urls, errors.Wrap(err, "failed to unpack add_cloud_metadata config") } for _, uri := range metadataURIs { - urls = append(urls, "http://"+config.MetadataHostAndPort+uri) + urls = append(urls, scheme+"://"+config.MetadataHostAndPort+uri) } return urls, nil } diff --git a/libbeat/processors/add_cloud_metadata/provider_openstack_nova.go b/libbeat/processors/add_cloud_metadata/provider_openstack_nova.go index 17bc5abf689..7c9a997e0e2 100644 --- a/libbeat/processors/add_cloud_metadata/provider_openstack_nova.go +++ b/libbeat/processors/add_cloud_metadata/provider_openstack_nova.go @@ -32,16 +32,24 @@ const ( // OpenStack Nova Metadata Service // Document https://docs.openstack.org/nova/latest/user/metadata-service.html var openstackNovaMetadataFetcher = provider{ - Name: "openstack-nova", + Name: "openstack-nova", + Local: true, + Create: buildOpenstackNovaCreate("http"), +} - Local: true, +var openstackNovaSSLMetadataFetcher = provider{ + Name: "openstack-nova-ssl", + Local: true, + Create: buildOpenstackNovaCreate("https"), +} - Create: func(provider string, c *common.Config) (metadataFetcher, error) { +func buildOpenstackNovaCreate(scheme string) func(provider string, c *common.Config) (metadataFetcher, error) { + return func(provider string, c *common.Config) (metadataFetcher, error) { osSchema := func(m map[string]interface{}) common.MapStr { return common.MapStr(m) } - urls, err := getMetadataURLs(c, metadataHost, []string{ + urls, err := getMetadataURLsWithScheme(c, scheme, metadataHost, []string{ osMetadataInstanceIDURI, osMetadataInstanceTypeURI, osMetadataHostnameURI, @@ -71,5 +79,5 @@ var openstackNovaMetadataFetcher = provider{ } fetcher := &httpMetadataFetcher{"openstack", nil, responseHandlers, osSchema} return fetcher, nil - }, + } } diff --git a/libbeat/processors/add_cloud_metadata/provider_openstack_nova_test.go b/libbeat/processors/add_cloud_metadata/provider_openstack_nova_test.go index d5c38a8437b..0a63c026cde 100644 --- a/libbeat/processors/add_cloud_metadata/provider_openstack_nova_test.go +++ b/libbeat/processors/add_cloud_metadata/provider_openstack_nova_test.go @@ -29,8 +29,8 @@ import ( "github.com/elastic/beats/v7/libbeat/logp" ) -func initOpenstackNovaTestServer() *httptest.Server { - return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { +func openstackNovaMetadataHandler() http.HandlerFunc { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.RequestURI == osMetadataInstanceIDURI { w.Write([]byte("i-0000ffac")) return @@ -49,13 +49,13 @@ func initOpenstackNovaTestServer() *httptest.Server { } http.Error(w, "not found", http.StatusNotFound) - })) + }) } func TestRetrieveOpenstackNovaMetadata(t *testing.T) { logp.TestingSetup() - server := initOpenstackNovaTestServer() + server := httptest.NewServer(openstackNovaMetadataHandler()) defer server.Close() config, err := common.NewConfigFrom(map[string]interface{}{ @@ -66,6 +66,28 @@ func TestRetrieveOpenstackNovaMetadata(t *testing.T) { t.Fatal(err) } + assertOpenstackNova(t, config) +} + +func TestRetrieveOpenstackNovaMetadataWithHTTPS(t *testing.T) { + logp.TestingSetup() + + server := httptest.NewTLSServer(openstackNovaMetadataHandler()) + defer server.Close() + + config, err := common.NewConfigFrom(map[string]interface{}{ + "host": server.Listener.Addr().String(), + "ssl.verification_mode": "none", + }) + + if err != nil { + t.Fatal(err) + } + + assertOpenstackNova(t, config) +} + +func assertOpenstackNova(t *testing.T, config *common.Config) { p, err := New(config) if err != nil { t.Fatal(err) diff --git a/libbeat/processors/add_cloud_metadata/providers.go b/libbeat/processors/add_cloud_metadata/providers.go index f93e8cf78f4..ea03b64258a 100644 --- a/libbeat/processors/add_cloud_metadata/providers.go +++ b/libbeat/processors/add_cloud_metadata/providers.go @@ -51,17 +51,19 @@ type result struct { } var cloudMetaProviders = map[string]provider{ - "alibaba": alibabaCloudMetadataFetcher, - "ecs": alibabaCloudMetadataFetcher, - "azure": azureVMMetadataFetcher, - "digitalocean": doMetadataFetcher, - "aws": ec2MetadataFetcher, - "ec2": ec2MetadataFetcher, - "gcp": gceMetadataFetcher, - "openstack": openstackNovaMetadataFetcher, - "nova": openstackNovaMetadataFetcher, - "qcloud": qcloudMetadataFetcher, - "tencent": qcloudMetadataFetcher, + "alibaba": alibabaCloudMetadataFetcher, + "ecs": alibabaCloudMetadataFetcher, + "azure": azureVMMetadataFetcher, + "digitalocean": doMetadataFetcher, + "aws": ec2MetadataFetcher, + "ec2": ec2MetadataFetcher, + "gcp": gceMetadataFetcher, + "openstack": openstackNovaMetadataFetcher, + "nova": openstackNovaMetadataFetcher, + "openstack-ssl": openstackNovaSSLMetadataFetcher, + "nova-ssl": openstackNovaSSLMetadataFetcher, + "qcloud": qcloudMetadataFetcher, + "tencent": qcloudMetadataFetcher, } func selectProviders(configList providerList, providers map[string]provider) map[string]provider { @@ -138,6 +140,7 @@ func (p *addCloudMetadata) fetchMetadata() *result { Timeout: p.initData.timeout, KeepAlive: 0, }).DialContext, + TLSClientConfig: p.initData.tlsConfig.ToConfig(), }, } From 7028e2c9779bff69f7d526af69eb804c024e5776 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 7 Oct 2020 18:47:33 +0200 Subject: [PATCH 163/216] Fix cyberark/corepas pipeline (#21643) --- .../cyberark/corepas/ingest/pipeline.yml | 2 +- .../corepas/test/generated.log-expected.json | 394 +++++++++--------- 2 files changed, 198 insertions(+), 198 deletions(-) diff --git a/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml index ffe90e79f85..4e401931415 100644 --- a/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml +++ b/x-pack/filebeat/module/cyberark/corepas/ingest/pipeline.yml @@ -55,7 +55,7 @@ processors: ignore_missing: true - append: field: related.hosts - value: '{{host.hostname server.domain}}' + value: '{{host.hostname}}' allow_duplicates: false if: ctx?.host?.hostname != null && ctx.host?.hostname != '' - append: diff --git a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json index 4056ed473ca..90805d72bcd 100644 --- a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json @@ -20,9 +20,9 @@ "10.208.15.216" ], "related.user": [ + "quasiarc", "itv", - "utl", - "quasiarc" + "utl" ], "rsa.db.index": "nes", "rsa.internal.event_desc": "pexe", @@ -67,13 +67,13 @@ "iatnu3810.mail.localdomain" ], "related.ip": [ - "10.92.136.230", - "10.175.75.18" + "10.175.75.18", + "10.92.136.230" ], "related.user": [ - "dolore", + "orev", "nnumqu", - "orev" + "dolore" ], "rsa.db.database": "umdo", "rsa.db.index": "vol", @@ -130,13 +130,13 @@ "anti4454.api.example" ], "related.ip": [ - "10.46.185.46", - "10.51.132.10" + "10.51.132.10", + "10.46.185.46" ], "related.user": [ - "incid", + "serror", "nse", - "serror" + "incid" ], "rsa.db.database": "byC", "rsa.db.index": "tur", @@ -197,9 +197,9 @@ "10.53.192.140" ], "related.user": [ + "psumquia", "atcup", - "ptass", - "psumquia" + "ptass" ], "rsa.db.database": "aperi", "rsa.db.index": "llumd", @@ -253,9 +253,9 @@ "10.81.199.122" ], "related.user": [ + "oremips", "eos", - "giatq", - "oremips" + "giatq" ], "rsa.db.index": "tempo", "rsa.internal.event_desc": "uian", @@ -304,9 +304,9 @@ "10.139.186.201" ], "related.user": [ - "uam", "tcupida", - "aboris" + "aboris", + "uam" ], "rsa.db.database": "isiu", "rsa.db.index": "iatisu", @@ -367,9 +367,9 @@ "10.104.111.129" ], "related.user": [ + "ele", "etconsec", - "ipis", - "ele" + "ipis" ], "rsa.db.database": "riat", "rsa.db.index": "umdolor", @@ -423,9 +423,9 @@ "10.116.120.216" ], "related.user": [ - "quiratio", + "animi", "umdo", - "animi" + "quiratio" ], "rsa.db.index": "oll", "rsa.internal.event_desc": "rumet", @@ -470,13 +470,13 @@ "isqu7224.localdomain" ], "related.ip": [ - "10.57.40.29", - "10.62.54.220" + "10.62.54.220", + "10.57.40.29" ], "related.user": [ "psum", - "rnatura", - "taevi" + "taevi", + "rnatura" ], "rsa.db.database": "emeumfug", "rsa.db.index": "omn", @@ -530,9 +530,9 @@ "10.74.237.180" ], "related.user": [ - "ema", + "tnon", "cup", - "tnon" + "ema" ], "rsa.db.index": "remeumf", "rsa.internal.event_desc": "lup", @@ -618,8 +618,8 @@ "10.74.253.127" ], "related.user": [ - "onproide", "icab", + "onproide", "tema" ], "rsa.db.index": "mqui", @@ -664,8 +664,8 @@ "tlabo6088.www.localdomain" ], "related.ip": [ - "10.189.109.245", - "10.92.8.15" + "10.92.8.15", + "10.189.109.245" ], "related.user": [ "inima", @@ -766,8 +766,8 @@ "10.18.109.121" ], "related.user": [ - "hil", "tatn", + "hil", "pida" ], "rsa.db.index": "quip", @@ -817,9 +817,9 @@ "10.63.37.192" ], "related.user": [ + "reetd", "iunt", - "equep", - "reetd" + "equep" ], "rsa.db.database": "aliqu", "rsa.db.index": "mipsumd", @@ -880,9 +880,9 @@ "10.47.202.102" ], "related.user": [ - "run", + "ice", "ntor", - "ice" + "run" ], "rsa.db.database": "ite", "rsa.db.index": "iquipex", @@ -942,8 +942,8 @@ "10.106.239.55" ], "related.user": [ - "itquiin", - "serunt" + "serunt", + "itquiin" ], "rsa.db.database": "itame", "rsa.db.index": "oluptas", @@ -999,13 +999,13 @@ "etMalor4236.www5.host" ], "related.ip": [ - "10.125.160.129", - "10.53.168.235" + "10.53.168.235", + "10.125.160.129" ], "related.user": [ + "one", "abi", - "ione", - "one" + "ione" ], "rsa.db.database": "sperna", "rsa.db.index": "estia", @@ -1066,8 +1066,8 @@ "10.227.177.121" ], "related.user": [ - "liqui", "tasuntex", + "liqui", "iduntu" ], "rsa.db.database": "rvel", @@ -1125,16 +1125,16 @@ "process.name": "laboree.exe", "process.pid": 6501, "related.hosts": [ - "", + "xeacomm6855.api.corp", "nsecte3304.mail.corp" ], "related.ip": [ - "10.167.85.181", - "10.98.182.220" + "10.98.182.220", + "10.167.85.181" ], "related.user": [ - "fde", - "econs" + "econs", + "fde" ], "rsa.db.database": "equat", "rsa.internal.event_desc": "orpor", @@ -1189,9 +1189,9 @@ "10.89.208.95" ], "related.user": [ - "iciadese", "icabo", - "sintoc" + "sintoc", + "iciadese" ], "rsa.db.index": "eni", "rsa.internal.event_desc": "rcitati", @@ -1240,9 +1240,9 @@ "10.72.148.32" ], "related.user": [ - "uteirure", "tDuisaut", - "luptatev" + "luptatev", + "uteirure" ], "rsa.db.database": "uamest", "rsa.db.index": "uae", @@ -1362,12 +1362,12 @@ "tnonpro7635.localdomain" ], "related.ip": [ - "10.192.34.76", - "10.213.144.249" + "10.213.144.249", + "10.192.34.76" ], "related.user": [ - "lore", "temqu", + "lore", "iquipe" ], "rsa.db.database": "gnamal", @@ -1482,9 +1482,9 @@ "10.143.193.199" ], "related.user": [ - "tqu", + "niamqui", "quid", - "niamqui" + "tqu" ], "rsa.db.index": "inci", "rsa.internal.event_desc": "eroinBCS", @@ -1533,9 +1533,9 @@ "10.65.175.9" ], "related.user": [ + "umqu", "ritatise", - "essequam", - "umqu" + "essequam" ], "rsa.db.database": "ender", "rsa.db.index": "entorev", @@ -1589,9 +1589,9 @@ "10.205.72.243" ], "related.user": [ - "isiuta", "tatn", - "umdolo" + "umdolo", + "isiuta" ], "rsa.db.index": "proide", "rsa.internal.event_desc": "ameiusm", @@ -1633,9 +1633,9 @@ "10.107.9.163" ], "related.user": [ - "sit", + "mac", "mquisno", - "mac" + "sit" ], "rsa.db.index": "sit", "rsa.internal.event_desc": "tdol", @@ -1677,9 +1677,9 @@ "10.80.101.72" ], "related.user": [ + "asiarc", "umSe", - "quidexea", - "asiarc" + "quidexea" ], "rsa.db.index": "veli", "rsa.internal.event_desc": "quatu", @@ -1728,9 +1728,9 @@ "10.39.10.155" ], "related.user": [ - "urExcept", + "ptass", "aboreetd", - "ptass" + "urExcept" ], "rsa.db.database": "teirured", "rsa.db.index": "dolorem", @@ -1828,9 +1828,9 @@ "10.71.238.250" ], "related.user": [ + "reseo", "moenimi", - "aec", - "reseo" + "aec" ], "rsa.db.index": "mac", "rsa.internal.event_desc": "quamest", @@ -1875,13 +1875,13 @@ "rum5798.home" ], "related.ip": [ - "10.226.20.199", - "10.226.101.180" + "10.226.101.180", + "10.226.20.199" ], "related.user": [ - "ritt", "rationev", - "veniamqu" + "veniamqu", + "ritt" ], "rsa.db.database": "conse", "rsa.db.index": "imveniam", @@ -1943,9 +1943,9 @@ "10.134.65.15" ], "related.user": [ - "quaUten", + "cab", "utaliqu", - "cab" + "quaUten" ], "rsa.db.database": "isciv", "rsa.db.index": "nofd", @@ -2002,8 +2002,8 @@ "10.70.147.120" ], "related.user": [ - "cidunt", "tten", + "cidunt", "emqu" ], "rsa.db.index": "eaqu", @@ -2053,9 +2053,9 @@ "10.178.242.100" ], "related.user": [ + "idid", "dqu", - "loi", - "idid" + "loi" ], "rsa.db.database": "tenatuse", "rsa.db.index": "ullamcor", @@ -2109,9 +2109,9 @@ "10.211.179.168" ], "related.user": [ - "ritati", "untincul", - "mmodoc" + "mmodoc", + "ritati" ], "rsa.db.index": "emvele", "rsa.internal.event_desc": "oluptas", @@ -2153,9 +2153,9 @@ "10.30.243.163" ], "related.user": [ - "illu", "mven", - "dolore" + "dolore", + "illu" ], "rsa.db.index": "idol", "rsa.internal.event_desc": "lore", @@ -2200,12 +2200,12 @@ "dictasun3878.internal.localhost" ], "related.ip": [ - "10.212.214.4", - "10.6.79.159" + "10.6.79.159", + "10.212.214.4" ], "related.user": [ - "amvo", "quid", + "amvo", "midestl" ], "rsa.db.database": "urExce", @@ -2267,8 +2267,8 @@ "10.237.170.202" ], "related.user": [ - "liquide", "rcit", + "liquide", "atDu" ], "rsa.db.database": "taedict", @@ -2330,8 +2330,8 @@ "10.228.118.81" ], "related.user": [ - "emoe", "tatemU", + "emoe", "itasper" ], "rsa.db.database": "toditaut", @@ -2389,13 +2389,13 @@ "esseq7889.www.invalid" ], "related.ip": [ - "10.49.71.118", - "10.234.165.130" + "10.234.165.130", + "10.49.71.118" ], "related.user": [ "henderit", - "emip", - "iuntNequ" + "iuntNequ", + "emip" ], "rsa.db.database": "veniamqu", "rsa.db.index": "atquo", @@ -2449,9 +2449,9 @@ "10.199.5.49" ], "related.user": [ - "emip", "turadipi", - "olorema" + "olorema", + "emip" ], "rsa.db.index": "ataevi", "rsa.internal.event_desc": "minim", @@ -2493,9 +2493,9 @@ "10.193.219.34" ], "related.user": [ - "uamei", + "olorem", "utlabo", - "olorem" + "uamei" ], "rsa.db.index": "nse", "rsa.internal.event_desc": "orisni", @@ -2540,12 +2540,12 @@ "tem6815.home" ], "related.ip": [ - "10.174.185.109", - "10.120.167.217" + "10.120.167.217", + "10.174.185.109" ], "related.user": [ - "dolorem", "rsp", + "dolorem", "animid" ], "rsa.db.database": "tsuntinc", @@ -2603,12 +2603,12 @@ "mporainc2064.home" ], "related.ip": [ - "10.141.213.219", - "10.117.137.159" + "10.117.137.159", + "10.141.213.219" ], "related.user": [ - "accusa", "atev", + "accusa", "ate" ], "rsa.db.database": "nibus", @@ -2666,13 +2666,13 @@ "caboNem1043.internal.home" ], "related.ip": [ - "10.166.90.130", - "10.94.224.229" + "10.94.224.229", + "10.166.90.130" ], "related.user": [ "eavol", - "etconsec", - "rem" + "rem", + "etconsec" ], "rsa.db.database": "oditempo", "rsa.db.index": "deF", @@ -2731,13 +2731,13 @@ "tatio6513.www.invalid" ], "related.ip": [ - "10.201.81.46", - "10.38.28.151" + "10.38.28.151", + "10.201.81.46" ], "related.user": [ + "mipsumqu", "incidid", - "tiumto", - "mipsumqu" + "tiumto" ], "rsa.db.database": "abor", "rsa.db.index": "adol", @@ -2796,12 +2796,12 @@ "dolori6232.api.invalid" ], "related.ip": [ - "10.214.245.95", - "10.255.28.56" + "10.255.28.56", + "10.214.245.95" ], "related.user": [ - "umdolors", "rerepre", + "umdolors", "uptatem" ], "rsa.db.database": "odt", @@ -2900,8 +2900,8 @@ "10.141.200.133" ], "related.user": [ - "iame", "ess", + "iame", "enim" ], "rsa.db.index": "nofdeFi", @@ -2945,8 +2945,8 @@ ], "related.user": [ "runtmo", - "illoi", - "ugi" + "ugi", + "illoi" ], "rsa.db.index": "eetdo", "rsa.internal.event_desc": "quaer", @@ -2991,13 +2991,13 @@ "mestq2106.api.host" ], "related.ip": [ - "10.41.89.217", - "10.39.143.155" + "10.39.143.155", + "10.41.89.217" ], "related.user": [ - "sedquiac", "tem", - "tperspic" + "tperspic", + "sedquiac" ], "rsa.db.database": "radipis", "rsa.db.index": "nse", @@ -3058,8 +3058,8 @@ "10.5.5.1" ], "related.user": [ - "minim", "CSe", + "minim", "unt" ], "rsa.db.database": "atu", @@ -3121,9 +3121,9 @@ "10.168.132.175" ], "related.user": [ - "eursinto", + "iamea", "giatquov", - "iamea" + "eursinto" ], "rsa.db.database": "ici", "rsa.db.index": "iquaUt", @@ -3177,9 +3177,9 @@ "10.123.154.17" ], "related.user": [ + "quiac", "dolorsi", - "lmo", - "quiac" + "lmo" ], "rsa.db.index": "idunt", "rsa.internal.event_desc": "usantiu", @@ -3270,9 +3270,9 @@ "10.126.205.76" ], "related.user": [ - "rsitvol", "Nemoenim", - "iati" + "iati", + "rsitvol" ], "rsa.db.index": "eFini", "rsa.internal.event_desc": "acom", @@ -3317,13 +3317,13 @@ "fic5107.home" ], "related.ip": [ - "10.169.101.161", - "10.164.66.154" + "10.164.66.154", + "10.169.101.161" ], "related.user": [ - "orissu", + "eufug", "ine", - "eufug" + "orissu" ], "rsa.db.database": "stquidol", "rsa.db.index": "imadmini", @@ -3377,8 +3377,8 @@ "10.70.83.200" ], "related.user": [ - "metco", "riat", + "metco", "ihilmole" ], "rsa.db.index": "urQuis", @@ -3424,13 +3424,13 @@ "onpr47.api.home" ], "related.ip": [ - "10.207.97.192", - "10.134.55.11" + "10.134.55.11", + "10.207.97.192" ], "related.user": [ + "madminim", "tanimid", - "mmod", - "madminim" + "mmod" ], "rsa.db.database": "tetura", "rsa.db.index": "uptasnul", @@ -3492,8 +3492,8 @@ ], "related.user": [ "eritq", - "oinBCSed", - "texplica" + "texplica", + "oinBCSed" ], "rsa.db.database": "lit", "rsa.db.index": "ritati", @@ -3550,8 +3550,8 @@ "eufugia4481.corp" ], "related.ip": [ - "10.41.232.147", - "10.61.175.217" + "10.61.175.217", + "10.41.232.147" ], "related.user": [ "runtm", @@ -3610,9 +3610,9 @@ "10.150.30.95" ], "related.user": [ - "mini", + "atnonpr", "uisnos", - "atnonpr" + "mini" ], "rsa.db.index": "smod", "rsa.internal.event_desc": "isn", @@ -3654,9 +3654,9 @@ "10.98.71.45" ], "related.user": [ - "fugitse", "CSe", - "onse" + "onse", + "fugitse" ], "rsa.db.index": "Dui", "rsa.internal.event_desc": "isci", @@ -3742,8 +3742,8 @@ "10.197.203.167" ], "related.user": [ - "iumdo", "uta", + "iumdo", "eserun" ], "rsa.db.index": "smo", @@ -3786,9 +3786,9 @@ "10.187.170.23" ], "related.user": [ - "ibusBo", + "enima", "sectetu", - "enima" + "ibusBo" ], "rsa.db.index": "uido", "rsa.internal.event_desc": "lab", @@ -3837,9 +3837,9 @@ "10.250.248.215" ], "related.user": [ - "aevitaed", "tinculpa", - "quaeratv" + "quaeratv", + "aevitaed" ], "rsa.db.database": "lica", "rsa.db.index": "uisnos", @@ -3895,8 +3895,8 @@ "osa3211.www5.example" ], "related.ip": [ - "10.147.154.118", - "10.146.57.23" + "10.146.57.23", + "10.147.154.118" ], "related.user": [ "tateveli", @@ -3997,9 +3997,9 @@ "10.154.172.82" ], "related.user": [ - "onnumqua", + "tetura", "nesci", - "tetura" + "onnumqua" ], "rsa.db.index": "oinBCSed", "rsa.internal.event_desc": "ntor", @@ -4042,8 +4042,8 @@ ], "related.user": [ "tpers", - "midestl", - "expl" + "expl", + "midestl" ], "rsa.db.index": "olu", "rsa.internal.event_desc": "odocons", @@ -4085,8 +4085,8 @@ "10.178.160.245" ], "related.user": [ - "fdeFinib", "turQuis", + "fdeFinib", "olupta" ], "rsa.db.index": "rsint", @@ -4195,13 +4195,13 @@ "nimve2787.mail.test" ], "related.ip": [ - "10.65.207.234", - "10.222.32.183" + "10.222.32.183", + "10.65.207.234" ], "related.user": [ "eve", - "itame", - "eruntmo" + "eruntmo", + "itame" ], "rsa.db.database": "udexerc", "rsa.db.index": "volup", @@ -4255,9 +4255,9 @@ "10.16.181.60" ], "related.user": [ + "olore", "gnama", - "oinven", - "olore" + "oinven" ], "rsa.db.index": "uatu", "rsa.internal.event_desc": "nderiti", @@ -4343,9 +4343,9 @@ "10.204.214.98" ], "related.user": [ + "eprehe", "porissus", - "tdolo", - "eprehe" + "tdolo" ], "rsa.db.index": "abo", "rsa.internal.event_desc": "ecte", @@ -4387,8 +4387,8 @@ "10.223.178.192" ], "related.user": [ - "etc", "evel", + "etc", "moenimip" ], "rsa.db.index": "iarchit", @@ -4434,13 +4434,13 @@ "ama6820.mail.example" ], "related.ip": [ - "10.26.137.126", - "10.26.33.181" + "10.26.33.181", + "10.26.137.126" ], "related.user": [ - "taevit", "ati", - "audant" + "audant", + "taevit" ], "rsa.db.database": "com", "rsa.db.index": "mveni", @@ -4560,13 +4560,13 @@ "lit4112.www.localhost" ], "related.ip": [ - "10.107.24.54", - "10.10.174.253" + "10.10.174.253", + "10.107.24.54" ], "related.user": [ "itinvo", - "uptasn", - "hend" + "hend", + "uptasn" ], "rsa.db.database": "lup", "rsa.db.index": "isau", @@ -4621,9 +4621,9 @@ "10.87.92.17" ], "related.user": [ + "eeufug", "luptate", - "tamr", - "eeufug" + "tamr" ], "rsa.db.index": "oreeufug", "rsa.internal.event_desc": "ura", @@ -4676,9 +4676,9 @@ "10.161.51.135" ], "related.user": [ - "Finibus", "accus", - "asper" + "asper", + "Finibus" ], "rsa.db.database": "litani", "rsa.db.index": "arch", @@ -4732,9 +4732,9 @@ "10.51.17.32" ], "related.user": [ - "itten", "mquido", - "llum" + "llum", + "itten" ], "rsa.db.index": "uscipit", "rsa.internal.event_desc": "llitani", @@ -4777,8 +4777,8 @@ ], "related.user": [ "ollita", - "mmodicon", - "cusa" + "cusa", + "mmodicon" ], "rsa.db.index": "ercitati", "rsa.internal.event_desc": "pteurs", @@ -4824,13 +4824,13 @@ "uidol6868.mail.localdomain" ], "related.ip": [ - "10.114.0.148", - "10.198.187.144" + "10.198.187.144", + "10.114.0.148" ], "related.user": [ "equatD", - "rsitamet", - "ons" + "ons", + "rsitamet" ], "rsa.db.database": "periam", "rsa.db.index": "umiurer", @@ -4888,9 +4888,9 @@ "10.61.140.120" ], "related.user": [ - "loru", + "naaliq", "equa", - "naaliq" + "loru" ], "rsa.db.index": "umfugiat", "rsa.internal.event_desc": "ora", @@ -4935,13 +4935,13 @@ "ptat4878.lan" ], "related.ip": [ - "10.149.238.108", - "10.93.24.151" + "10.93.24.151", + "10.149.238.108" ], "related.user": [ "ite", - "nven", - "sequamn" + "sequamn", + "nven" ], "rsa.db.database": "fugi", "rsa.db.index": "nesciu", @@ -4995,9 +4995,9 @@ "10.101.45.225" ], "related.user": [ - "emi", "uinesc", - "cipitla" + "cipitla", + "emi" ], "rsa.db.index": "caecat", "rsa.internal.event_desc": "tsunt", @@ -5040,9 +5040,9 @@ "10.2.204.161" ], "related.user": [ - "quela", + "eumfugia", "ore", - "eumfugia" + "quela" ], "rsa.db.index": "olup", "rsa.internal.event_desc": "quuntur", @@ -5139,8 +5139,8 @@ "10.151.110.250" ], "related.user": [ - "neavol", "tla", + "neavol", "pidatatn" ], "rsa.db.database": "itaedict", @@ -5258,9 +5258,9 @@ "10.128.102.130" ], "related.user": [ - "que", + "sequatu", "ore", - "sequatu" + "que" ], "rsa.db.index": "exerci", "rsa.internal.event_desc": "olu", @@ -5309,8 +5309,8 @@ "10.200.162.248" ], "related.user": [ - "onnu", "reseo", + "onnu", "doloremi" ], "rsa.db.database": "billo", @@ -5365,8 +5365,8 @@ "10.103.215.159" ], "related.user": [ - "volup", "apa", + "volup", "atatn" ], "rsa.db.index": "atcupi", From 189171723ce69e3a235ef16a80c870db74fba682 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 7 Oct 2020 18:52:51 -0500 Subject: [PATCH 164/216] [Elastic Agent] Reload fleet.kibana.hosts from policy change (#21599) * Update the connected client for kibana from policy change. * Fix vet. * Add changelog. * Add protocol compare. * Rollback protocol and hosts on failure. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/fleet_acker.go | 4 + .../pkg/agent/application/fleet_gateway.go | 4 + .../handler_action_policy_change.go | 107 +++++++++++++++++- .../handler_action_policy_change_test.go | 45 +++++++- .../pkg/agent/application/managed_mode.go | 16 ++- .../agent/application/managed_mode_test.go | 12 +- .../pkg/agent/storage/storage.go | 8 +- 8 files changed, 182 insertions(+), 15 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index a0cd6f6291e..73dfe8ff9a4 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -33,3 +33,4 @@ - Send updating state {pull}21461[21461] - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] +- Update `fleet.yml` and Kibana hosts when a policy change updates the Kibana hosts {pull}21599[21599] diff --git a/x-pack/elastic-agent/pkg/agent/application/fleet_acker.go b/x-pack/elastic-agent/pkg/agent/application/fleet_acker.go index ba324f2d7de..4544fa8a772 100644 --- a/x-pack/elastic-agent/pkg/agent/application/fleet_acker.go +++ b/x-pack/elastic-agent/pkg/agent/application/fleet_acker.go @@ -39,6 +39,10 @@ func newActionAcker( }, nil } +func (f *actionAcker) SetClient(client clienter) { + f.client = client +} + func (f *actionAcker) Ack(ctx context.Context, action fleetapi.Action) error { // checkin agentID := f.agentInfo.AgentID() diff --git a/x-pack/elastic-agent/pkg/agent/application/fleet_gateway.go b/x-pack/elastic-agent/pkg/agent/application/fleet_gateway.go index 4bb9d2e6280..21e7bfd4589 100644 --- a/x-pack/elastic-agent/pkg/agent/application/fleet_gateway.go +++ b/x-pack/elastic-agent/pkg/agent/application/fleet_gateway.go @@ -253,3 +253,7 @@ func (f *fleetGateway) stop() { close(f.done) f.wg.Wait() } + +func (f *fleetGateway) SetClient(client clienter) { + f.client = client +} diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go index 81dc1444816..8821700ee74 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go @@ -5,17 +5,36 @@ package application import ( + "bytes" "context" "fmt" + "io" + "sort" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" + + "gopkg.in/yaml.v2" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/storage" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/kibana" ) +type clientSetter interface { + SetClient(clienter) +} + type handlerPolicyChange struct { - log *logger.Logger - emitter emitterFunc + log *logger.Logger + emitter emitterFunc + agentInfo *info.AgentInfo + config *configuration.Configuration + store storage.Store + setters []clientSetter } func (h *handlerPolicyChange) Handle(ctx context.Context, a action, acker fleetAcker) error { @@ -31,9 +50,93 @@ func (h *handlerPolicyChange) Handle(ctx context.Context, a action, acker fleetA } h.log.Debugf("handlerPolicyChange: emit configuration for action %+v", a) + err = h.handleKibanaHosts(c) + if err != nil { + return err + } if err := h.emitter(c); err != nil { return err } return acker.Ack(ctx, action) } + +func (h *handlerPolicyChange) handleKibanaHosts(c *config.Config) (err error) { + cfg, err := configuration.NewFromConfig(c) + if err != nil { + return errors.New(err, "could not parse the configuration from the policy", errors.TypeConfig) + } + if kibanaEqual(h.config.Fleet.Kibana, cfg.Fleet.Kibana) { + // already the same hosts + return nil + } + + // only set protocol/hosts as that is all Fleet currently sends + prevProtocol := h.config.Fleet.Kibana.Protocol + prevHosts := h.config.Fleet.Kibana.Hosts + h.config.Fleet.Kibana.Protocol = cfg.Fleet.Kibana.Protocol + h.config.Fleet.Kibana.Hosts = cfg.Fleet.Kibana.Hosts + + // rollback on failure + defer func() { + if err != nil { + h.config.Fleet.Kibana.Protocol = prevProtocol + h.config.Fleet.Kibana.Hosts = prevHosts + } + }() + + client, err := fleetapi.NewAuthWithConfig(h.log, h.config.Fleet.AccessAPIKey, h.config.Fleet.Kibana) + if err != nil { + return errors.New( + err, "fail to create API client with updated hosts", + errors.TypeNetwork, errors.M("hosts", h.config.Fleet.Kibana.Hosts)) + } + reader, err := fleetToReader(h.agentInfo, h.config) + if err != nil { + return errors.New( + err, "fail to persist updated API client hosts", + errors.TypeUnexpected, errors.M("hosts", h.config.Fleet.Kibana.Hosts)) + } + err = h.store.Save(reader) + if err != nil { + return errors.New( + err, "fail to persist updated API client hosts", + errors.TypeFilesystem, errors.M("hosts", h.config.Fleet.Kibana.Hosts)) + } + for _, setter := range h.setters { + setter.SetClient(client) + } + return nil +} + +func kibanaEqual(k1 *kibana.Config, k2 *kibana.Config) bool { + if k1.Protocol != k2.Protocol { + return false + } + + sort.Strings(k1.Hosts) + sort.Strings(k2.Hosts) + if len(k1.Hosts) != len(k2.Hosts) { + return false + } + for i, v := range k1.Hosts { + if v != k2.Hosts[i] { + return false + } + } + return true +} + +func fleetToReader(agentInfo *info.AgentInfo, cfg *configuration.Configuration) (io.Reader, error) { + configToStore := map[string]interface{}{ + "fleet": cfg.Fleet, + "agent": map[string]interface{}{ + "id": agentInfo.AgentID(), + }, + } + data, err := yaml.Marshal(configToStore) + if err != nil { + return nil, err + } + return bytes.NewReader(data), nil +} diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go index ce4802b68e6..c30f886b0d1 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go @@ -9,6 +9,10 @@ import ( "sync" "testing" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/storage" + "github.com/pkg/errors" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -31,6 +35,8 @@ func (m *mockEmitter) Emitter(policy *config.Config) error { func TestPolicyChange(t *testing.T) { log, _ := logger.New("") ack := newNoopAcker() + agentInfo, _ := info.NewAgentInfo() + nullStore := &storage.NullStore{} t.Run("Receive a config change and successfully emits a raw configuration", func(t *testing.T) { emitter := &mockEmitter{} @@ -42,7 +48,14 @@ func TestPolicyChange(t *testing.T) { Policy: conf, } - handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} + cfg := configuration.DefaultConfiguration() + handler := &handlerPolicyChange{ + log: log, + emitter: emitter.Emitter, + agentInfo: agentInfo, + config: cfg, + store: nullStore, + } err := handler.Handle(context.Background(), action, ack) require.NoError(t, err) @@ -60,7 +73,14 @@ func TestPolicyChange(t *testing.T) { Policy: conf, } - handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} + cfg := configuration.DefaultConfiguration() + handler := &handlerPolicyChange{ + log: log, + emitter: emitter.Emitter, + agentInfo: agentInfo, + config: cfg, + store: nullStore, + } err := handler.Handle(context.Background(), action, ack) require.Error(t, err) @@ -69,6 +89,9 @@ func TestPolicyChange(t *testing.T) { func TestPolicyAcked(t *testing.T) { log, _ := logger.New("") + agentInfo, _ := info.NewAgentInfo() + nullStore := &storage.NullStore{} + t.Run("Config change should not ACK on error", func(t *testing.T) { tacker := &testAcker{} @@ -83,7 +106,14 @@ func TestPolicyAcked(t *testing.T) { Policy: config, } - handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} + cfg := configuration.DefaultConfiguration() + handler := &handlerPolicyChange{ + log: log, + emitter: emitter.Emitter, + agentInfo: agentInfo, + config: cfg, + store: nullStore, + } err := handler.Handle(context.Background(), action, tacker) require.Error(t, err) @@ -105,7 +135,14 @@ func TestPolicyAcked(t *testing.T) { Policy: config, } - handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} + cfg := configuration.DefaultConfiguration() + handler := &handlerPolicyChange{ + log: log, + emitter: emitter.Emitter, + agentInfo: agentInfo, + config: cfg, + store: nullStore, + } err := handler.Handle(context.Background(), action, tacker) require.NoError(t, err) diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index 647eae6d4e6..e38685741c3 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -209,12 +209,17 @@ func newManaged( acker, combinedReporter) + policyChanger := &handlerPolicyChange{ + log: log, + emitter: emit, + agentInfo: agentInfo, + config: cfg, + store: store, + setters: []clientSetter{acker}, + } actionDispatcher.MustRegister( &fleetapi.ActionPolicyChange{}, - &handlerPolicyChange{ - log: log, - emitter: emit, - }, + policyChanger, ) actionDispatcher.MustRegister( @@ -264,6 +269,9 @@ func newManaged( if err != nil { return nil, err } + // add the gateway to setters, so the gateway can be updated + // when the hosts for Kibana are updated by the policy. + policyChanger.setters = append(policyChanger.setters, gateway) managedApplication.gateway = gateway return managedApplication, nil diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go index 65cb27547ff..4325c5ce7a6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go @@ -9,11 +9,14 @@ import ( "encoding/json" "testing" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/storage" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/composable" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" @@ -34,6 +37,7 @@ func TestManagedModeRouting(t *testing.T) { log, _ := logger.New("") router, _ := newRouter(log, streamFn) agentInfo, _ := info.NewAgentInfo() + nullStore := &storage.NullStore{} composableCtrl, _ := composable.New(log, nil) emit, err := emitter(ctx, log, agentInfo, composableCtrl, router, &configModifiers{Decorators: []decoratorFunc{injectMonitoring}}) require.NoError(t, err) @@ -41,11 +45,15 @@ func TestManagedModeRouting(t *testing.T) { actionDispatcher, err := newActionDispatcher(ctx, log, &handlerDefault{log: log}) require.NoError(t, err) + cfg := configuration.DefaultConfiguration() actionDispatcher.MustRegister( &fleetapi.ActionPolicyChange{}, &handlerPolicyChange{ - log: log, - emitter: emit, + log: log, + emitter: emit, + agentInfo: agentInfo, + config: cfg, + store: nullStore, }, ) diff --git a/x-pack/elastic-agent/pkg/agent/storage/storage.go b/x-pack/elastic-agent/pkg/agent/storage/storage.go index b37c6e06ab3..2435311486a 100644 --- a/x-pack/elastic-agent/pkg/agent/storage/storage.go +++ b/x-pack/elastic-agent/pkg/agent/storage/storage.go @@ -20,7 +20,9 @@ import ( const perms os.FileMode = 0600 -type store interface { +// Store saves the io.Reader. +type Store interface { + // Save the io.Reader. Save(io.Reader) error } @@ -62,12 +64,12 @@ type ReplaceOnSuccessStore struct { target string replaceWith []byte - wrapped store + wrapped Store } // NewReplaceOnSuccessStore takes a target file and a replacement content and will replace the target // file content if the wrapped store execution is done without any error. -func NewReplaceOnSuccessStore(target string, replaceWith []byte, wrapped store) *ReplaceOnSuccessStore { +func NewReplaceOnSuccessStore(target string, replaceWith []byte, wrapped Store) *ReplaceOnSuccessStore { return &ReplaceOnSuccessStore{ target: target, replaceWith: replaceWith, From 53892413e05b63d588e728d3252d145bb4247a59 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Thu, 8 Oct 2020 09:54:42 +0200 Subject: [PATCH 165/216] chore: add versions 7.1x (#21670) --- .ci/jobs/apm-beats-update.yml | 5 ++++- .ci/jobs/beats.yml | 5 ++++- .ci/jobs/packaging.yml | 5 ++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.ci/jobs/apm-beats-update.yml b/.ci/jobs/apm-beats-update.yml index 2ae688ffab7..678a9fbcd67 100644 --- a/.ci/jobs/apm-beats-update.yml +++ b/.ci/jobs/apm-beats-update.yml @@ -18,7 +18,7 @@ discover-pr-forks-trust: 'permission' discover-pr-origin: 'merge-current' discover-tags: true - head-filter-regex: '(master|7\.[x789]|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' + head-filter-regex: '(master|7\.[x789]|7\.1\d|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' disable-pr-notifications: true notification-context: 'apm-beats-update' repo: 'beats' @@ -38,6 +38,9 @@ - regex-name: regex: '7\.[x789]' case-sensitive: true + - regex-name: + regex: '7\.1\d' + case-sensitive: true - regex-name: regex: '8\.\d+' case-sensitive: true diff --git a/.ci/jobs/beats.yml b/.ci/jobs/beats.yml index 6f59a9bcdf8..27095b2fecb 100644 --- a/.ci/jobs/beats.yml +++ b/.ci/jobs/beats.yml @@ -17,7 +17,7 @@ discover-pr-forks-strategy: 'merge-current' discover-pr-forks-trust: 'permission' discover-pr-origin: 'merge-current' - head-filter-regex: '(master|7\.[x789]|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' + head-filter-regex: '(master|7\.[x789]|7\.1\d|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' discover-tags: true notification-context: "beats-ci" repo: 'beats' @@ -38,6 +38,9 @@ - regex-name: regex: '7\.[x789]' case-sensitive: true + - regex-name: + regex: '7\.1\d' + case-sensitive: true - regex-name: regex: '8\.\d+' case-sensitive: true diff --git a/.ci/jobs/packaging.yml b/.ci/jobs/packaging.yml index fd6fb9f90c6..baa3ce45035 100644 --- a/.ci/jobs/packaging.yml +++ b/.ci/jobs/packaging.yml @@ -14,7 +14,7 @@ discover-pr-forks-trust: 'permission' discover-pr-origin: 'merge-current' discover-tags: true - head-filter-regex: '(master|7\.[x789]|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' + head-filter-regex: '(master|7\.[x789]|7\.1\d|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' disable-pr-notifications: true notification-context: 'beats-packaging' repo: 'beats' @@ -34,6 +34,9 @@ - regex-name: regex: '7\.[x789]' case-sensitive: true + - regex-name: + regex: '7\.1\d' + case-sensitive: true - regex-name: regex: '8\.\d+' case-sensitive: true From 47546025421fa6cfb3945799968313b18ad82783 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 8 Oct 2020 11:51:10 +0200 Subject: [PATCH 166/216] Fix flaky FSWatch/FSScanner tests (#21625) ## What does this PR do? Unit tests in for `fswatch.go` do not depend on the order of the returned events anymore. Closes #21489 --- filebeat/input/filestream/fswatch_test.go | 32 ++++--------------- .../filestream/fswatch_test_non_windows.go | 2 +- 2 files changed, 8 insertions(+), 26 deletions(-) diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go index d6286a273eb..2435fad1500 100644 --- a/filebeat/input/filestream/fswatch_test.go +++ b/filebeat/input/filestream/fswatch_test.go @@ -38,8 +38,6 @@ var ( ) func TestFileScanner(t *testing.T) { - t.Skip("Flaky test: https://github.com/elastic/beats/issues/21489") - testCases := map[string]struct { paths []string excludedFiles []match.Matcher @@ -89,7 +87,7 @@ func TestFileScanner(t *testing.T) { for p, _ := range files { paths = append(paths, p) } - assert.True(t, checkIfSameContents(test.expectedFiles, paths)) + assert.ElementsMatch(t, paths, test.expectedFiles) }) } } @@ -116,26 +114,7 @@ func removeFilesOfScannerTest(t *testing.T) { } } -// only handles sets -func checkIfSameContents(one, other []string) bool { - if len(one) != len(other) { - return false - } - - mustFind := len(one) - for _, oneElem := range one { - for _, otherElem := range other { - if oneElem == otherElem { - mustFind-- - } - } - } - return mustFind == 0 -} - func TestFileWatchNewDeleteModified(t *testing.T) { - t.Skip("Flaky test: https://github.com/elastic/beats/issues/21489") - oldTs := time.Now() newTs := oldTs.Add(5 * time.Second) testCases := map[string]struct { @@ -226,10 +205,13 @@ func TestFileWatchNewDeleteModified(t *testing.T) { go w.watch(context.Background()) - for _, expectedEvent := range test.expectedEvents { - evt := w.Event() - assert.Equal(t, expectedEvent, evt) + count := len(test.expectedEvents) + actual := make([]loginp.FSEvent, count) + for i := 0; i < count; i++ { + actual[i] = w.Event() } + + assert.ElementsMatch(t, actual, test.expectedEvents) }) } } diff --git a/filebeat/input/filestream/fswatch_test_non_windows.go b/filebeat/input/filestream/fswatch_test_non_windows.go index eecfeddf930..3c316efdfc9 100644 --- a/filebeat/input/filestream/fswatch_test_non_windows.go +++ b/filebeat/input/filestream/fswatch_test_non_windows.go @@ -88,7 +88,7 @@ func TestFileScannerSymlinks(t *testing.T) { for p, _ := range files { paths = append(paths, p) } - assert.Equal(t, test.expectedFiles, paths) + assert.ElementsMatch(t, test.expectedFiles, paths) }) } } From 1f29969264b64cbcfa09df86ffc228161d4d2e3f Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 8 Oct 2020 10:57:41 +0100 Subject: [PATCH 167/216] Docker build resiliance with a retry (#21587) --- dev-tools/mage/integtest_docker.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/dev-tools/mage/integtest_docker.go b/dev-tools/mage/integtest_docker.go index 2ed09db711e..8b366bad315 100644 --- a/dev-tools/mage/integtest_docker.go +++ b/dev-tools/mage/integtest_docker.go @@ -27,6 +27,7 @@ import ( "runtime" "strings" "sync" + "time" "github.com/pkg/errors" @@ -246,5 +247,17 @@ func dockerComposeBuildImages() error { os.Stderr, "docker-compose", args..., ) + + // This sleep is to avoid hitting the docker build issues when resources are not available. + if err != nil { + fmt.Println(">> Building docker images again") + time.Sleep(10) + _, err = sh.Exec( + composeEnv, + out, + os.Stderr, + "docker-compose", args..., + ) + } return err } From f344a6769eaa04c6f3fc960551b5b8a8fa8100c6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Thu, 8 Oct 2020 13:16:16 +0200 Subject: [PATCH 168/216] [CI: Packaging] fix: push ubi8 images too (#21621) * fix: push ubi8 images too * chore: enhance retries Co-authored-by: Victor Martinez * chore: use variables in log * chore: add "-oss" images Co-authored-by: Victor Martinez --- .ci/packaging.groovy | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index 26916372b70..81ff5b1994a 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -198,17 +198,30 @@ def tagAndPush(name){ tagName = "pr-${env.CHANGE_ID}" } - def oldName = "${DOCKER_REGISTRY}/beats/${name}:${libbetaVer}" - def newName = "${DOCKER_REGISTRY}/observability-ci/${name}:${tagName}" - def commitName = "${DOCKER_REGISTRY}/observability-ci/${name}:${env.GIT_BASE_COMMIT}" dockerLogin(secret: "${DOCKERELASTIC_SECRET}", registry: "${DOCKER_REGISTRY}") - retry(3){ - sh(label:'Change tag and push', script: """ - docker tag ${oldName} ${newName} - docker push ${newName} - docker tag ${oldName} ${commitName} - docker push ${commitName} - """) + + // supported image flavours + def variants = ["", "-oss", "-ubi8"] + variants.each { variant -> + def oldName = "${DOCKER_REGISTRY}/beats/${name}${variant}:${libbetaVer}" + def newName = "${DOCKER_REGISTRY}/observability-ci/${name}${variant}:${tagName}" + def commitName = "${DOCKER_REGISTRY}/observability-ci/${name}${variant}:${env.GIT_BASE_COMMIT}" + + def iterations = 0 + retryWithSleep(retries: 3, seconds: 5, backoff: true) + iterations++ + def status = sh(label:'Change tag and push', script: """ + docker tag ${oldName} ${newName} + docker push ${newName} + docker tag ${oldName} ${commitName} + docker push ${commitName} + """, returnStatus: true) + if ( status > 0 && iterations < 3) { + error('tag and push failed, retry') + } else if ( status > 0 ) { + log(level: 'WARN', text: "${name} doesn't have ${variant} docker images. See https://github.com/elastic/beats/pull/21621") + } + } } } From d5e89d961ade56b5edf1fe5059e15e64f6426071 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 8 Oct 2020 12:16:53 +0100 Subject: [PATCH 169/216] backport: add 7.10 branch (#21635) --- .backportrc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.backportrc.json b/.backportrc.json index 3dce189d671..8bfd891160c 100644 --- a/.backportrc.json +++ b/.backportrc.json @@ -1,6 +1,6 @@ { "upstream": "elastic/beats", - "branches": [{ "name": "7.9"}, { "name": "7.8"}, { "name": "7.7"}, { "name": "7.x"}], + "branches": [ { "name": "7.x", "checked": true }, "7.10", "7.9", "7.8", "7.7"], "labels": ["backport"], "autoAssign": true, "prTitle": "Cherry-pick to {targetBranch}: {commitMessages}" From df03addd29f2d051ea54c55ba10273eaf44d2bfa Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Thu, 8 Oct 2020 14:10:28 +0200 Subject: [PATCH 170/216] Skip publisher flaky tests (#21657) --- libbeat/publisher/pipeline/controller_test.go | 8 +++++--- libbeat/publisher/pipeline/output_test.go | 2 ++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/libbeat/publisher/pipeline/controller_test.go b/libbeat/publisher/pipeline/controller_test.go index fba98018894..1e400476a30 100644 --- a/libbeat/publisher/pipeline/controller_test.go +++ b/libbeat/publisher/pipeline/controller_test.go @@ -31,7 +31,8 @@ import ( "github.com/elastic/beats/v7/libbeat/publisher" "github.com/elastic/beats/v7/libbeat/publisher/queue" "github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue" - "github.com/elastic/beats/v7/libbeat/tests/resources" + + //"github.com/elastic/beats/v7/libbeat/tests/resources" "github.com/stretchr/testify/require" ) @@ -46,8 +47,9 @@ func TestOutputReload(t *testing.T) { t.Run(name, func(t *testing.T) { testutil.SeedPRNG(t) - goroutines := resources.NewGoroutinesChecker() - defer goroutines.Check(t) + // Flaky check: https://github.com/elastic/beats/issues/21656 + //goroutines := resources.NewGoroutinesChecker() + //defer goroutines.Check(t) err := quick.Check(func(q uint) bool { numEventsToPublish := 15000 + (q % 500) // 15000 to 19999 diff --git a/libbeat/publisher/pipeline/output_test.go b/libbeat/publisher/pipeline/output_test.go index 5be34fa9436..7bde6e137ab 100644 --- a/libbeat/publisher/pipeline/output_test.go +++ b/libbeat/publisher/pipeline/output_test.go @@ -95,6 +95,8 @@ func TestMakeClientWorker(t *testing.T) { } func TestReplaceClientWorker(t *testing.T) { + t.Skip("Flaky test: https://github.com/elastic/beats/issues/17965") + tests := map[string]func(mockPublishFn) outputs.Client{ "client": newMockClient, "network_client": newMockNetworkClient, From 38c6a7026c5eaf419fc2f000f6b3b5cab9105f16 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 8 Oct 2020 14:08:57 +0100 Subject: [PATCH 171/216] [CI] Support Windows-2016 in pipeline 2.0 (#21337) --- .ci/jobs/beats-windows-mbp.yml | 56 -- .ci/windows.groovy | 874 --------------------------- auditbeat/Jenkinsfile.yml | 11 + filebeat/Jenkinsfile.yml | 1 + heartbeat/Jenkinsfile.yml | 11 + metricbeat/Jenkinsfile.yml | 11 + packetbeat/Jenkinsfile.yml | 11 + winlogbeat/Jenkinsfile.yml | 11 + x-pack/auditbeat/Jenkinsfile.yml | 11 + x-pack/elastic-agent/Jenkinsfile.yml | 11 + x-pack/filebeat/Jenkinsfile.yml | 11 + x-pack/functionbeat/Jenkinsfile.yml | 11 + x-pack/metricbeat/Jenkinsfile.yml | 11 + x-pack/packetbeat/Jenkinsfile.yml | 11 + x-pack/winlogbeat/Jenkinsfile.yml | 11 + 15 files changed, 133 insertions(+), 930 deletions(-) delete mode 100644 .ci/jobs/beats-windows-mbp.yml delete mode 100644 .ci/windows.groovy diff --git a/.ci/jobs/beats-windows-mbp.yml b/.ci/jobs/beats-windows-mbp.yml deleted file mode 100644 index 7ea26c9ba18..00000000000 --- a/.ci/jobs/beats-windows-mbp.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- job: - name: Beats/beats-windows-mbp - display-name: Beats Pipeline for Windows - description: Jenkins pipeline for the Beats project running on windows agents. - view: Beats - project-type: multibranch - script-path: .ci/windows.groovy - scm: - - github: - branch-discovery: no-pr - discover-pr-forks-strategy: merge-current - discover-pr-forks-trust: permission - discover-pr-origin: merge-current - discover-tags: false - # Run MBP for the master branch and PRs - head-filter-regex: '(master|PR-.*)' - notification-context: 'beats-ci/windows' - repo: beats - repo-owner: elastic - credentials-id: github-app-beats-ci - ssh-checkout: - credentials: f6c7695a-671e-4f4f-a331-acdce44ff9ba - build-strategies: - - tags: - ignore-tags-older-than: -1 - ignore-tags-newer-than: -1 - - regular-branches: true - - change-request: - ignore-target-only-changes: true - property-strategies: - # Builds for PRs won't be triggered automatically. - # Only the master branch will be triggered automatically. - named-branches: - defaults: - - suppress-scm-triggering: true - exceptions: - - exception: - branch-name: master - properties: - - suppress-scm-triggering: false - clean: - after: true - before: true - prune: true - shallow-clone: true - depth: 10 - do-not-fetch-tags: true - submodule: - disable: false - recursive: true - parent-credentials: true - timeout: 100 - timeout: '15' - use-author: true - wipe-workspace: 'True' diff --git a/.ci/windows.groovy b/.ci/windows.groovy deleted file mode 100644 index 92826e80926..00000000000 --- a/.ci/windows.groovy +++ /dev/null @@ -1,874 +0,0 @@ -#!/usr/bin/env groovy - -@Library('apm@current') _ - -import groovy.transform.Field - -/** - This is required to store the stashed id with the test results to be digested with runbld -*/ -@Field def stashedTestReports = [:] - -/** - List of supported windows versions to be tested with - NOTE: - - 'windows-10' is too slow - - 'windows-2012-r2', 'windows-2008-r2', 'windows-7', 'windows-7-32-bit' are disabled - since we are working on releasing each windows version incrementally. -*/ -@Field def windowsVersions = ['windows-2019', 'windows-2016', 'windows-2012-r2'] - -pipeline { - agent { label 'ubuntu && immutable' } - environment { - BASE_DIR = 'src/github.com/elastic/beats' - GOX_FLAGS = "-arch amd64" - DOCKER_COMPOSE_VERSION = "1.21.0" - TERRAFORM_VERSION = "0.12.24" - PIPELINE_LOG_LEVEL = "INFO" - DOCKERELASTIC_SECRET = 'secret/observability-team/ci/docker-registry/prod' - DOCKER_REGISTRY = 'docker.elastic.co' - AWS_ACCOUNT_SECRET = 'secret/observability-team/ci/elastic-observability-aws-account-auth' - RUNBLD_DISABLE_NOTIFICATIONS = 'true' - JOB_GCS_BUCKET = 'beats-ci-temp' - JOB_GCS_CREDENTIALS = 'beats-ci-gcs-plugin' - } - options { - timeout(time: 2, unit: 'HOURS') - buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20', daysToKeepStr: '30')) - timestamps() - ansiColor('xterm') - disableResume() - durabilityHint('PERFORMANCE_OPTIMIZED') - quietPeriod(10) - rateLimitBuilds(throttle: [count: 60, durationName: 'hour', userBoost: true]) - } - triggers { - issueCommentTrigger('(?i).*(?:jenkins\\W+)?run\\W+(?:the\\W+)?tests(?:\\W+please)?.*') - } - parameters { - booleanParam(name: 'runAllStages', defaultValue: false, description: 'Allow to run all stages.') - booleanParam(name: 'windowsTest', defaultValue: true, description: 'Allow Windows stages.') - booleanParam(name: 'macosTest', defaultValue: true, description: 'Allow macOS stages.') - - booleanParam(name: 'allCloudTests', defaultValue: false, description: 'Run all cloud integration tests.') - booleanParam(name: 'awsCloudTests', defaultValue: false, description: 'Run AWS cloud integration tests.') - string(name: 'awsRegion', defaultValue: 'eu-central-1', description: 'Default AWS region to use for testing.') - - booleanParam(name: 'debug', defaultValue: false, description: 'Allow debug logging for Jenkins steps') - booleanParam(name: 'dry_run', defaultValue: false, description: 'Skip build steps, it is for testing pipeline flow') - } - stages { - /** - Checkout the code and stash it, to use it on other stages. - */ - stage('Checkout') { - options { skipDefaultCheckout() } - steps { - pipelineManager([ cancelPreviousRunningBuilds: [ when: 'PR' ] ]) - deleteDir() - gitCheckout(basedir: "${BASE_DIR}", githubNotifyFirstTimeContributor: true) - stashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - dir("${BASE_DIR}"){ - loadConfigEnvVars() - } - whenTrue(params.debug){ - dumpFilteredEnvironment() - } - } - } - stage('Lint'){ - options { skipDefaultCheckout() } - steps { - // NOTE: commented to run the windows pipeline a bit faster. - // when required then it can be enabled. - // makeTarget("Lint", "check") - echo 'SKIPPED' - } - } - stage('Build and Test Windows'){ - failFast false - parallel { - stage('Elastic Agent x-pack Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_ELASTIC_AGENT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Elastic Agent x-pack Windows Unit test", "x-pack/elastic-agent", "build unitTest") - } - } - stage('Filebeat Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_FILEBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Filebeat oss Windows Unit test", "filebeat", "build unitTest") - } - } - stage('Filebeat x-pack Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_FILEBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Filebeat x-pack Windows", "x-pack/filebeat", "build unitTest") - } - } - stage('Heartbeat'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_HEARTBEAT != "false" - } - } - stages { - stage('Heartbeat Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - } - } - steps { - mageTargetWin("Heartbeat oss Windows Unit test", "heartbeat", "build unitTest") - } - } - } - } - stage('Auditbeat oss Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_AUDITBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Auditbeat oss Windows Unit test", "auditbeat", "build unitTest") - } - } - stage('Auditbeat x-pack Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_AUDITBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Auditbeat x-pack Windows", "x-pack/auditbeat", "build unitTest") - } - } - stage('Metricbeat Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_METRICBEAT != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Metricbeat Windows Unit test", "metricbeat", "build unitTest") - } - } - stage('Metricbeat x-pack Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_METRICBEAT_XPACK != "false" && params.windowsTest - } - } - steps { - mageTargetWin("Metricbeat x-pack Windows", "x-pack/metricbeat", "build unitTest") - } - } - stage('Winlogbeat'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_WINLOGBEAT != "false" - } - } - stages { - stage('Winlogbeat Windows'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - } - } - steps { - mageTargetWin("Winlogbeat Windows Unit test", "winlogbeat", "build unitTest") - } - } - } - } - stage('Winlogbeat Windows x-pack'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return params.windowsTest && env.BUILD_WINLOGBEAT_XPACK != "false" - } - } - steps { - mageTargetWin("Winlogbeat x-pack Windows", "x-pack/winlogbeat", "build unitTest") - } - } - stage('Functionbeat'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - // NOTE: commented to run all the windows stages. - //return env.BUILD_FUNCTIONBEAT_XPACK != "false" - } - } - stages { - stage('Functionbeat Windows x-pack'){ - options { skipDefaultCheckout() } - when { - beforeAgent true - expression { - return params.windowsTest - } - } - steps { - mageTargetWin("Functionbeat x-pack Windows Unit test", "x-pack/functionbeat", "build unitTest") - } - } - } - } - } - } - } - post { - always { - runbld() - } - cleanup { - notifyBuildResult(prComment: true) - } - } -} - -def delete() { - dir("${env.BASE_DIR}") { - fixPermissions("${WORKSPACE}") - } - deleteDir() -} - -def fixPermissions(location) { - sh(label: 'Fix permissions', script: """#!/usr/bin/env bash - source ./dev-tools/common.bash - docker_setup - script/fix_permissions.sh ${location}""", returnStatus: true) -} - -def makeTarget(String context, String target, boolean clean = true) { - withGithubNotify(context: "${context}") { - withBeatsEnv(true) { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMage() - } - sh(label: "Make ${target}", script: "make ${target}") - whenTrue(clean) { - fixPermissions("${HOME}") - } - } - } -} - -def mageTarget(String context, String directory, String target) { - withGithubNotify(context: "${context}") { - withBeatsEnv(true) { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMage() - } - - def verboseFlag = params.debug ? "-v" : "" - dir(directory) { - sh(label: "Mage ${target}", script: "mage ${verboseFlag} ${target}") - } - } - } -} - -def mageTargetWin(String context, String directory, String target) { - withGithubNotify(context: "${context}") { - def tasks = [:] - windowsVersions.each { os -> - tasks["${context}-${os}"] = mageTargetWin(context, directory, target, os) - } - parallel(tasks) - } -} - -def mageTargetWin(String context, String directory, String target, String label) { - return { - log(level: 'INFO', text: "context=${context} directory=${directory} target=${target} os=${label}") - def immutable = label.equals('windows-7-32-bit') ? 'windows-immutable-32-bit' : 'windows-immutable' - - // NOTE: skip filebeat with windows-2016/2012-r2 since there are some test failures. - // See https://github.com/elastic/beats/issues/19787 https://github.com/elastic/beats/issues/19641 - if (directory.equals('filebeat') && (label.equals('windows-2016') || label.equals('windows-2012-r2'))) { - log(level: 'WARN', text: "Skipped stage for the 'filebeat' with '${label}' as long as there are test failures to be analysed.") - } else { - node("${immutable} && ${label}"){ - withBeatsEnvWin() { - whenTrue(params.debug) { - dumpFilteredEnvironment() - dumpMageWin() - } - - def verboseFlag = params.debug ? "-v" : "" - dir(directory) { - bat(label: "Mage ${target}", script: "mage ${verboseFlag} ${target}") - } - } - } - } - } -} - -def withBeatsEnv(boolean archive, Closure body) { - def os = goos() - def goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${os}.amd64" - - withEnv([ - "HOME=${env.WORKSPACE}", - "GOPATH=${env.WORKSPACE}", - "GOROOT=${goRoot}", - "PATH=${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}", - "MAGEFILE_CACHE=${WORKSPACE}/.magefile", - "TEST_COVERAGE=true", - "RACE_DETECTOR=true", - "PYTHON_ENV=${WORKSPACE}/python-env", - "TEST_TAGS=${env.TEST_TAGS},oracle", - "DOCKER_PULL=0", - ]) { - deleteDir() - unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - if(isDockerInstalled()){ - dockerLogin(secret: "${DOCKERELASTIC_SECRET}", registry: "${DOCKER_REGISTRY}") - } - dir("${env.BASE_DIR}") { - installTools() - // TODO (2020-04-07): This is a work-around to fix the Beat generator tests. - // See https://github.com/elastic/beats/issues/17787. - setGitConfig() - try { - if(!params.dry_run){ - body() - } - } finally { - if (archive) { - catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') { - junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: "**/build/TEST*.xml") - archiveArtifacts(allowEmptyArchive: true, artifacts: '**/build/TEST*.out') - } - } - reportCoverage() - } - } - } -} - -def withBeatsEnvWin(Closure body) { - final String chocoPath = 'C:\\ProgramData\\chocolatey\\bin' - final String chocoPython3Path = 'C:\\Python38;C:\\Python38\\Scripts' - // NOTE: to support Windows 7 32 bits the arch in the go context path is required. - def arch = is32bit() ? '386' : 'amd64' - def goRoot = "${env.USERPROFILE}\\.gvm\\versions\\go${GO_VERSION}.windows.${arch}" - - withEnv([ - "HOME=${env.WORKSPACE}", - "DEV_ARCH=${arch}", - "DEV_OS=windows", - "GOPATH=${env.WORKSPACE}", - "GOROOT=${goRoot}", - "PATH=${env.WORKSPACE}\\bin;${goRoot}\\bin;${chocoPath};${chocoPython3Path};C:\\tools\\mingw64\\bin;${env.PATH}", - "MAGEFILE_CACHE=${env.WORKSPACE}\\.magefile", - "TEST_COVERAGE=true", - "RACE_DETECTOR=true", - ]){ - deleteDir() - unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") - dir("${env.BASE_DIR}"){ - installTools() - try { - if(!params.dry_run){ - body() - } - } finally { - catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') { - junitAndStore(allowEmptyResults: true, keepLongStdio: true, testResults: "**\\build\\TEST*.xml") - archiveArtifacts(allowEmptyArchive: true, artifacts: '**\\build\\TEST*.out') - } - } - } - } -} - -def installTools() { - def i = 2 // Number of retries - if(isUnix()) { - retry(i) { sh(label: "Install Go ${GO_VERSION}", script: ".ci/scripts/install-go.sh") } - retry(i) { sh(label: "Install docker-compose ${DOCKER_COMPOSE_VERSION}", script: ".ci/scripts/install-docker-compose.sh") } - retry(i) { sh(label: "Install Terraform ${TERRAFORM_VERSION}", script: ".ci/scripts/install-terraform.sh") } - retry(i) { sh(label: "Install Mage", script: "make mage") } - } else { - retry(i) { bat(label: "Install Go/Mage/Python ${GO_VERSION}", script: ".ci/scripts/install-tools.bat") } - } -} - -def is32bit(){ - def labels = env.NODE_LABELS - return labels.contains('i386') -} - -def goos(){ - def labels = env.NODE_LABELS - - if (labels.contains('linux')) { - return 'linux' - } else if (labels.contains('windows')) { - return 'windows' - } else if (labels.contains('darwin')) { - return 'darwin' - } - - error("Unhandled OS name in NODE_LABELS: " + labels) -} - -def dumpMage(){ - echo "### MAGE DUMP ###" - sh(label: "Dump mage variables", script: "mage dumpVariables") - echo "### END MAGE DUMP ###" -} - -def dumpMageWin(){ - echo "### MAGE DUMP ###" - bat(label: "Dump mage variables", script: "mage dumpVariables") - echo "### END MAGE DUMP ###" -} - -def dumpFilteredEnvironment(){ - echo "### ENV DUMP ###" - echo "PATH: ${env.PATH}" - echo "HOME: ${env.HOME}" - echo "USERPROFILE: ${env.USERPROFILE}" - echo "BUILD_DIR: ${env.BUILD_DIR}" - echo "COVERAGE_DIR: ${env.COVERAGE_DIR}" - echo "BEATS: ${env.BEATS}" - echo "PROJECTS: ${env.PROJECTS}" - echo "PROJECTS_ENV: ${env.PROJECTS_ENV}" - echo "PYTHON_ENV: ${env.PYTHON_ENV}" - echo "PYTHON_EXE: ${env.PYTHON_EXE}" - echo "PYTHON_ENV_EXE: ${env.PYTHON_ENV_EXE}" - echo "VENV_PARAMS: ${env.VENV_PARAMS}" - echo "FIND: ${env.FIND}" - echo "GOLINT: ${env.GOLINT}" - echo "GOLINT_REPO: ${env.GOLINT_REPO}" - echo "REVIEWDOG: ${env.REVIEWDOG}" - echo "REVIEWDOG_OPTIONS: ${env.REVIEWDOG_OPTIONS}" - echo "REVIEWDOG_REPO: ${env.REVIEWDOG_REPO}" - echo "XPACK_SUFFIX: ${env.XPACK_SUFFIX}" - echo "PKG_BUILD_DIR: ${env.PKG_BUILD_DIR}" - echo "PKG_UPLOAD_DIR: ${env.PKG_UPLOAD_DIR}" - echo "COVERAGE_TOOL: ${env.COVERAGE_TOOL}" - echo "COVERAGE_TOOL_REPO: ${env.COVERAGE_TOOL_REPO}" - echo "TESTIFY_TOOL_REPO: ${env.TESTIFY_TOOL_REPO}" - echo "NOW: ${env.NOW}" - echo "GOBUILD_FLAGS: ${env.GOBUILD_FLAGS}" - echo "GOIMPORTS: ${env.GOIMPORTS}" - echo "GOIMPORTS_REPO: ${env.GOIMPORTS_REPO}" - echo "GOIMPORTS_LOCAL_PREFIX: ${env.GOIMPORTS_LOCAL_PREFIX}" - echo "PROCESSES: ${env.PROCESSES}" - echo "TIMEOUT: ${env.TIMEOUT}" - echo "PYTHON_TEST_FILES: ${env.PYTHON_TEST_FILES}" - echo "PYTEST_ADDOPTS: ${env.PYTEST_ADDOPTS}" - echo "PYTEST_OPTIONS: ${env.PYTEST_OPTIONS}" - echo "TEST_ENVIRONMENT: ${env.TEST_ENVIRONMENT}" - echo "SYSTEM_TESTS: ${env.SYSTEM_TESTS}" - echo "STRESS_TESTS: ${env.STRESS_TESTS}" - echo "STRESS_TEST_OPTIONS: ${env.STRESS_TEST_OPTIONS}" - echo "TEST_TAGS: ${env.TEST_TAGS}" - echo "GOX_OS: ${env.GOX_OS}" - echo "GOX_OSARCH: ${env.GOX_OSARCH}" - echo "GOX_FLAGS: ${env.GOX_FLAGS}" - echo "TESTING_ENVIRONMENT: ${env.TESTING_ENVIRONMENT}" - echo "BEAT_VERSION: ${env.BEAT_VERSION}" - echo "COMMIT_ID: ${env.COMMIT_ID}" - echo "DOCKER_COMPOSE_PROJECT_NAME: ${env.DOCKER_COMPOSE_PROJECT_NAME}" - echo "DOCKER_COMPOSE: ${env.DOCKER_COMPOSE}" - echo "DOCKER_CACHE: ${env.DOCKER_CACHE}" - echo "GOPACKAGES_COMMA_SEP: ${env.GOPACKAGES_COMMA_SEP}" - echo "PIP_INSTALL_PARAMS: ${env.PIP_INSTALL_PARAMS}" - echo "### END ENV DUMP ###" -} - -def k8sTest(versions){ - versions.each{ v -> - stage("k8s ${v}"){ - withEnv(["K8S_VERSION=${v}", "KIND_VERSION=v0.7.0", "KUBECONFIG=${env.WORKSPACE}/kubecfg"]){ - withGithubNotify(context: "K8s ${v}") { - withBeatsEnv(false) { - sh(label: "Install kind", script: ".ci/scripts/install-kind.sh") - sh(label: "Install kubectl", script: ".ci/scripts/install-kubectl.sh") - sh(label: "Setup kind", script: ".ci/scripts/kind-setup.sh") - sh(label: "Integration tests", script: "MODULE=kubernetes make -C metricbeat integration-tests") - sh(label: "Deploy to kubernetes",script: "make -C deploy/kubernetes test") - sh(label: 'Delete cluster', script: 'kind delete cluster') - } - } - } - } - } -} - -def reportCoverage(){ - catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') { - retry(2){ - sh(label: 'Report to Codecov', script: ''' - curl -sSLo codecov https://codecov.io/bash - for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat - do - FILE="${i}/build/coverage/full.cov" - if [ -f "${FILE}" ]; then - bash codecov -f "${FILE}" - fi - done - ''') - } - } -} - -// isChanged treats the patterns as regular expressions. In order to check if -// any file in a directoy is modified use `^/.*`. -def isChanged(patterns){ - return ( - params.runAllStages - || isGitRegionMatch(patterns: patterns, comparator: 'regexp') - ) -} - -def isChangedOSSCode(patterns) { - def allPatterns = [ - "^Jenkinsfile", - "^go.mod", - "^libbeat/.*", - "^testing/.*", - "^dev-tools/.*", - "^\\.ci/scripts/.*", - ] - allPatterns.addAll(patterns) - return isChanged(allPatterns) -} - -def isChangedXPackCode(patterns) { - def allPatterns = [ - "^Jenkinsfile", - "^go.mod", - "^libbeat/.*", - "^dev-tools/.*", - "^testing/.*", - "^x-pack/libbeat/.*", - "^\\.ci/scripts/.*", - ] - allPatterns.addAll(patterns) - return isChanged(allPatterns) -} - -// withCloudTestEnv executes a closure with credentials for cloud test -// environments. -def withCloudTestEnv(Closure body) { - def maskedVars = [] - def testTags = "${env.TEST_TAGS}" - - // AWS - if (params.allCloudTests || params.awsCloudTests) { - testTags = "${testTags},aws" - def aws = getVaultSecret(secret: "${AWS_ACCOUNT_SECRET}").data - if (!aws.containsKey('access_key')) { - error("${AWS_ACCOUNT_SECRET} doesn't contain 'access_key'") - } - if (!aws.containsKey('secret_key')) { - error("${AWS_ACCOUNT_SECRET} doesn't contain 'secret_key'") - } - maskedVars.addAll([ - [var: "AWS_REGION", password: params.awsRegion], - [var: "AWS_ACCESS_KEY_ID", password: aws.access_key], - [var: "AWS_SECRET_ACCESS_KEY", password: aws.secret_key], - ]) - } - - withEnv([ - "TEST_TAGS=${testTags}", - ]) { - withEnvMask(vars: maskedVars) { - body() - } - } -} - -def terraformInit(String directory) { - dir(directory) { - sh(label: "Terraform Init on ${directory}", script: "terraform init") - } -} - -def terraformApply(String directory) { - terraformInit(directory) - dir(directory) { - sh(label: "Terraform Apply on ${directory}", script: "terraform apply -auto-approve") - } -} - -// Start testing environment on cloud using terraform. Terraform files are -// stashed so they can be used by other stages. They are also archived in -// case manual cleanup is needed. -// -// Example: -// startCloudTestEnv('x-pack-metricbeat', [ -// [cond: params.awsCloudTests, dir: 'x-pack/metricbeat/module/aws'], -// ]) -// ... -// terraformCleanup('x-pack-metricbeat', 'x-pack/metricbeat') -def startCloudTestEnv(String name, environments = []) { - withCloudTestEnv() { - withBeatsEnv(false) { - def runAll = params.runAllCloudTests - try { - for (environment in environments) { - if (environment.cond || runAll) { - retry(2) { - terraformApply(environment.dir) - } - } - } - } finally { - // Archive terraform states in case manual cleanup is needed. - archiveArtifacts(allowEmptyArchive: true, artifacts: '**/terraform.tfstate') - } - stash(name: "terraform-${name}", allowEmpty: true, includes: '**/terraform.tfstate,**/.terraform/**') - } - } -} - - -// Looks for all terraform states in directory and runs terraform destroy for them, -// it uses terraform states previously stashed by startCloudTestEnv. -def terraformCleanup(String stashName, String directory) { - stage("Remove cloud scenarios in ${directory}"){ - withCloudTestEnv() { - withBeatsEnv(false) { - unstash("terraform-${stashName}") - retry(2) { - sh(label: "Terraform Cleanup", script: ".ci/scripts/terraform-cleanup.sh ${directory}") - } - } - } - } -} - -def loadConfigEnvVars(){ - def empty = [] - env.GO_VERSION = readFile(".go-version").trim() - - withEnv(["HOME=${env.WORKSPACE}"]) { - retry(2) { sh(label: "Install Go ${env.GO_VERSION}", script: ".ci/scripts/install-go.sh") } - } - - // Libbeat is the core framework of Beats. It has no additional dependencies - // on other projects in the Beats repository. - env.BUILD_LIBBEAT = isChangedOSSCode(empty) - env.BUILD_LIBBEAT_XPACK = isChangedXPackCode(empty) - - // Auditbeat depends on metricbeat as framework, but does not include any of - // the modules from Metricbeat. - // The Auditbeat x-pack build contains all functionality from OSS Auditbeat. - env.BUILD_AUDITBEAT = isChangedOSSCode(getVendorPatterns('auditbeat')) - env.BUILD_AUDITBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/auditbeat')) - - // Dockerlogbeat is a standalone Beat that only relies on libbeat. - env.BUILD_DOCKERLOGBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/dockerlogbeat')) - - // Filebeat depends on libbeat only. - // The Filebeat x-pack build contains all functionality from OSS Filebeat. - env.BUILD_FILEBEAT = isChangedOSSCode(getVendorPatterns('filebeat')) - env.BUILD_FILEBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/filebeat')) - - // Metricbeat depends on libbeat only. - // The Metricbeat x-pack build contains all functionality from OSS Metricbeat. - env.BUILD_METRICBEAT = isChangedOSSCode(getVendorPatterns('metricbeat')) - env.BUILD_METRICBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/metricbeat')) - - // Functionbeat is a standalone beat that depends on libbeat only. - // Functionbeat is available as x-pack build only. - env.BUILD_FUNCTIONBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/functionbeat')) - - // Heartbeat depends on libbeat only. - // The Heartbeat x-pack build contains all functionality from OSS Heartbeat. - env.BUILD_HEARTBEAT = isChangedOSSCode(getVendorPatterns('heartbeat')) - env.BUILD_HEARTBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/heartbeat')) - - // Journalbeat depends on libbeat only. - // The Journalbeat x-pack build contains all functionality from OSS Journalbeat. - env.BUILD_JOURNALBEAT = isChangedOSSCode(getVendorPatterns('journalbeat')) - env.BUILD_JOURNALBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/journalbeat')) - - // Packetbeat depends on libbeat only. - // The Packetbeat x-pack build contains all functionality from OSS Packetbeat. - env.BUILD_PACKETBEAT = isChangedOSSCode(getVendorPatterns('packetbeat')) - env.BUILD_PACKETBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/packetbeat')) - - // Winlogbeat depends on libbeat only. - // The Winlogbeat x-pack build contains all functionality from OSS Winlogbeat. - env.BUILD_WINLOGBEAT = isChangedOSSCode(getVendorPatterns('winlogbeat')) - env.BUILD_WINLOGBEAT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/winlogbeat')) - - // Elastic-agent is a self-contained product, that depends on libbeat only. - // The agent acts as a supervisor for other Beats like Filebeat or Metricbeat. - // The agent is available as x-pack build only. - env.BUILD_ELASTIC_AGENT_XPACK = isChangedXPackCode(getVendorPatterns('x-pack/elastic-agent')) - - // The Kubernetes test use Filebeat and Metricbeat, but only need to be run - // if the deployment scripts have been updated. No Beats specific testing is - // involved. - env.BUILD_KUBERNETES = isChanged(["^deploy/kubernetes/.*"]) - - def generatorPatterns = ['^generator/.*'] - generatorPatterns.addAll(getVendorPatterns('generator/common/beatgen')) - generatorPatterns.addAll(getVendorPatterns('metricbeat/beater')) - env.BUILD_GENERATOR = isChangedOSSCode(generatorPatterns) - - // Skip all the stages for changes only related to the documentation - env.ONLY_DOCS = isDocChangedOnly() - - // Run the ITs by running only if the changeset affects a specific module. - // For such, it's required to look for changes under the module folder and exclude anything else - // such as ascidoc and png files. - env.MODULE = getGitMatchingGroup(pattern: '[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*', exclude: '^(((?!\\/module\\/).)*$|.*\\.asciidoc|.*\\.png)') -} - -/** - This method verifies if the changeset for the current pull request affect only changes related - to documentation, such as asciidoc and png files. -*/ -def isDocChangedOnly(){ - if (params.runAllStages || !env.CHANGE_ID?.trim()) { - log(level: 'INFO', text: 'Speed build for docs only is disabled for branches/tags or when forcing with the runAllStages parameter.') - return 'false' - } else { - log(level: "INFO", text: 'Check if the speed build for docs is enabled.') - return isGitRegionMatch(patterns: ['.*\\.(asciidoc|png)'], shouldMatchAll: true) - } -} - -/** - This method grab the dependencies of a Go module and transform them on regexp -*/ -def getVendorPatterns(beatName){ - def os = goos() - def goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${os}.amd64" - def output = "" - - withEnv([ - "HOME=${env.WORKSPACE}/${env.BASE_DIR}", - "PATH=${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}", - ]) { - output = sh(label: 'Get vendor dependency patterns', returnStdout: true, script: """ - go list -deps ./${beatName} \ - | grep 'elastic/beats' \ - | sed -e "s#github.com/elastic/beats/v7/##g" \ - | awk '{print "^" \$1 "/.*"}' - """) - } - return output?.split('\n').collect{ item -> item as String } -} - -def setGitConfig(){ - sh(label: 'check git config', script: ''' - if [ -z "$(git config --get user.email)" ]; then - git config user.email "beatsmachine@users.noreply.github.com" - git config user.name "beatsmachine" - fi - ''') -} - -def isDockerInstalled(){ - return sh(label: 'check for Docker', script: 'command -v docker', returnStatus: true) -} - -def junitAndStore(Map params = [:]){ - junit(params) - // STAGE_NAME env variable could be null in some cases, so let's use the currentmilliseconds - def stageName = env.STAGE_NAME ? env.STAGE_NAME.replaceAll("[\\W]|_",'-') : "uncategorized-${new java.util.Date().getTime()}" - stash(includes: params.testResults, allowEmpty: true, name: stageName, useDefaultExcludes: true) - stashedTestReports[stageName] = stageName -} - -def runbld() { - catchError(buildResult: 'SUCCESS', message: 'runbld post build action failed.') { - if (stashedTestReports) { - dir("${env.BASE_DIR}") { - sh(label: 'Prepare workspace context', - script: 'find . -type f -name "TEST*.xml" -path "*/build/*" -delete') - // Unstash the test reports - stashedTestReports.each { k, v -> - dir(k) { - unstash(v) - } - } - sh(label: 'Process JUnit reports with runbld', - script: '''\ - cat >./runbld-script < Date: Thu, 8 Oct 2020 15:27:14 +0200 Subject: [PATCH 172/216] Fix function that parses from/to/contact headers (#21672) --- packetbeat/protos/sip/plugin.go | 35 +++++++++++++++++++++------- packetbeat/protos/sip/plugin_test.go | 12 +++++++--- 2 files changed, 36 insertions(+), 11 deletions(-) diff --git a/packetbeat/protos/sip/plugin.go b/packetbeat/protos/sip/plugin.go index e4cc0364d9a..14b56aeda45 100644 --- a/packetbeat/protos/sip/plugin.go +++ b/packetbeat/protos/sip/plugin.go @@ -499,27 +499,46 @@ func populateBodyFields(m *message, pbf *pb.Fields, fields *ProtocolFields) { func parseFromToContact(fromTo common.NetString) (displayInfo, uri common.NetString, params map[string]common.NetString) { params = make(map[string]common.NetString) - pos := bytes.IndexByte(fromTo, '<') - if pos == -1 { - pos = bytes.IndexByte(fromTo, ' ') - } + fromTo = bytes.TrimSpace(fromTo) + + var uriIsWrapped bool + pos := func() int { + // look for the beginning of a url wrapped in <...> + if pos := bytes.IndexByte(fromTo, '<'); pos > -1 { + uriIsWrapped = true + return pos + } + // if there is no < char, it means there is no display info, and + // that the url starts from the beginning + // https://tools.ietf.org/html/rfc3261#section-20.10 + return 0 + }() displayInfo = bytes.Trim(fromTo[:pos], "'\"\t ") endURIPos := func() int { - if fromTo[pos] == '<' { + if uriIsWrapped { return bytes.IndexByte(fromTo, '>') } return bytes.IndexByte(fromTo, ';') }() + // not wrapped and no header params if endURIPos == -1 { - uri = bytes.TrimRight(fromTo[pos:], ">") - return + uri = fromTo[pos:] + return displayInfo, uri, params } - pos += 1 + + // if wrapped, we want to get over the < char + if uriIsWrapped { + pos += 1 + } + + // if wrapped, we will get the string between <...> + // if not wrapped, we will get the value before the header params (until ;) uri = fromTo[pos:endURIPos] + // parse the header params pos = endURIPos + 1 for _, param := range bytes.Split(fromTo[pos:], []byte(";")) { kv := bytes.SplitN(param, []byte("="), 2) diff --git a/packetbeat/protos/sip/plugin_test.go b/packetbeat/protos/sip/plugin_test.go index fc9ee53aff2..d8c09f5b307 100644 --- a/packetbeat/protos/sip/plugin_test.go +++ b/packetbeat/protos/sip/plugin_test.go @@ -65,11 +65,11 @@ func TestParseFromTo(t *testing.T) { assert.Equal(t, common.NetString(nil), params["tag"]) // From - displayInfo, uri, params = parseFromToContact(common.NetString("\"PCMU/8000\" ;tag=1")) + displayInfo, uri, params = parseFromToContact(common.NetString("\"PCMU/8000\" ;tag=1")) assert.Equal(t, common.NetString("PCMU/8000"), displayInfo) assert.Equal(t, common.NetString("sip:sipp@10.0.2.15:5060"), uri) assert.Equal(t, common.NetString("1"), params["tag"]) - displayInfo, uri, params = parseFromToContact(common.NetString("\"Matthew Hodgson\" ;tag=5c7cdb68")) + displayInfo, uri, params = parseFromToContact(common.NetString(" \"Matthew Hodgson\" ;tag=5c7cdb68")) assert.Equal(t, common.NetString("Matthew Hodgson"), displayInfo) assert.Equal(t, common.NetString("sip:matthew@mxtelecom.com"), uri) assert.Equal(t, common.NetString("5c7cdb68"), params["tag"]) @@ -83,7 +83,7 @@ func TestParseFromTo(t *testing.T) { assert.Equal(t, common.NetString(nil), params["tag"]) // Contact - displayInfo, uri, _ = parseFromToContact(common.NetString("")) + displayInfo, uri, _ = parseFromToContact(common.NetString(" ")) assert.Equal(t, common.NetString(nil), displayInfo) assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060;transport=udp"), uri) displayInfo, uri, params = parseFromToContact(common.NetString(";expires=1200;q=0.500")) @@ -100,6 +100,12 @@ func TestParseFromTo(t *testing.T) { assert.Equal(t, common.NetString("Mr. Watson"), displayInfo) assert.Equal(t, common.NetString("mailto:watson@bell-telephone.com"), uri) assert.Equal(t, common.NetString("0.1"), params["q"]) + + // url is not bounded by <...> + displayInfo, uri, params = parseFromToContact(common.NetString(" sip:test@10.0.2.15:5060;transport=udp")) + assert.Equal(t, common.NetString(nil), displayInfo) + assert.Equal(t, common.NetString("sip:test@10.0.2.15:5060"), uri) + assert.Equal(t, common.NetString("udp"), params["transport"]) } func TestParseUDP(t *testing.T) { From 5b69349d02b3fc92605ccfe796b6dd558fa18846 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Thu, 8 Oct 2020 09:27:33 -0500 Subject: [PATCH 173/216] [Winlogbeat] Remove brittle configuration validation from wineventlog (#21593) * Remove brittle configuration validation from wineventlog - removed config keys checking - update unit tests Closes #21220 --- winlogbeat/eventlog/eventlogging.go | 5 +--- winlogbeat/eventlog/factory.go | 28 +++---------------- winlogbeat/eventlog/wineventlog.go | 6 +--- .../eventlog/wineventlog_expirimental.go | 2 +- winlogbeat/tests/system/test_eventlogging.py | 19 ------------- winlogbeat/tests/system/test_wineventlog.py | 17 ----------- 6 files changed, 7 insertions(+), 70 deletions(-) diff --git a/winlogbeat/eventlog/eventlogging.go b/winlogbeat/eventlog/eventlogging.go index 963797264b2..01465d933fc 100644 --- a/winlogbeat/eventlog/eventlogging.go +++ b/winlogbeat/eventlog/eventlogging.go @@ -40,9 +40,6 @@ const ( eventLoggingAPIName = "eventlogging" ) -var eventLoggingConfigKeys = common.MakeStringSet(append(commonConfigKeys, - "ignore_older", "read_buffer_size", "format_buffer_size")...) - type eventLoggingConfig struct { ConfigCommon `config:",inline"` IgnoreOlder time.Duration `config:"ignore_older"` @@ -284,7 +281,7 @@ func newEventLogging(options *common.Config) (EventLog, error) { ReadBufferSize: win.MaxEventBufferSize, FormatBufferSize: win.MaxFormatMessageBufferSize, } - if err := readConfig(options, &c, eventLoggingConfigKeys); err != nil { + if err := readConfig(options, &c); err != nil { return nil, err } diff --git a/winlogbeat/eventlog/factory.go b/winlogbeat/eventlog/factory.go index f66c158b2f2..9ee8e0d144f 100644 --- a/winlogbeat/eventlog/factory.go +++ b/winlogbeat/eventlog/factory.go @@ -22,14 +22,9 @@ import ( "sort" "strings" - "github.com/joeshaw/multierror" - "github.com/elastic/beats/v7/libbeat/common" ) -var commonConfigKeys = []string{"type", "api", "name", "fields", "fields_under_root", - "tags", "processors", "index", "id", "meta", "revision"} - // ConfigCommon is the common configuration data used to instantiate a new // EventLog. Each implementation is free to support additional configuration // options. @@ -42,33 +37,18 @@ type validator interface { Validate() error } -func readConfig( - c *common.Config, - config interface{}, - validKeys common.StringSet, -) error { +func readConfig(c *common.Config, config interface{}) error { if err := c.Unpack(config); err != nil { return fmt.Errorf("failed unpacking config. %v", err) } - var errs multierror.Errors - if len(validKeys) > 0 { - // Check for invalid keys. - for _, k := range c.GetFields() { - if !validKeys.Has(k) { - errs = append(errs, fmt.Errorf("invalid event log key '%s' "+ - "found. Valid keys are %s", k, strings.Join(validKeys.ToSlice(), ", "))) - } - } - } - if v, ok := config.(validator); ok { if err := v.Validate(); err != nil { - errs = append(errs, err) + return err } } - return errs.Err() + return nil } // Producer produces a new event log instance for reading event log records. @@ -114,7 +94,7 @@ func New(options *common.Config) (EventLog, error) { } var config ConfigCommon - if err := readConfig(options, &config, nil); err != nil { + if err := readConfig(options, &config); err != nil { return nil, err } diff --git a/winlogbeat/eventlog/wineventlog.go b/winlogbeat/eventlog/wineventlog.go index db00f239974..7ee6c62cf18 100644 --- a/winlogbeat/eventlog/wineventlog.go +++ b/winlogbeat/eventlog/wineventlog.go @@ -47,10 +47,6 @@ const ( winEventLogAPIName = "wineventlog" ) -var winEventLogConfigKeys = common.MakeStringSet(append(commonConfigKeys, - "batch_read_size", "ignore_older", "include_xml", "event_id", "forwarded", - "level", "provider", "no_more_events")...) - type winEventLogConfig struct { ConfigCommon `config:",inline"` BatchReadSize int `config:"batch_read_size"` // Maximum number of events that Read will return. @@ -366,7 +362,7 @@ func (l *winEventLog) buildRecordFromXML(x []byte, recoveredErr error) (Record, // using the Windows Event Log. func newWinEventLog(options *common.Config) (EventLog, error) { c := defaultWinEventLogConfig - if err := readConfig(options, &c, winEventLogConfigKeys); err != nil { + if err := readConfig(options, &c); err != nil { return nil, err } diff --git a/winlogbeat/eventlog/wineventlog_expirimental.go b/winlogbeat/eventlog/wineventlog_expirimental.go index 5952aad0f5a..301b2cf4f0b 100644 --- a/winlogbeat/eventlog/wineventlog_expirimental.go +++ b/winlogbeat/eventlog/wineventlog_expirimental.go @@ -243,7 +243,7 @@ func newWinEventLogExp(options *common.Config) (EventLog, error) { cfgwarn.Experimental("The %s event log reader is experimental.", winEventLogExpAPIName) c := winEventLogConfig{BatchReadSize: 512} - if err := readConfig(options, &c, winEventLogConfigKeys); err != nil { + if err := readConfig(options, &c); err != nil { return nil, err } diff --git a/winlogbeat/tests/system/test_eventlogging.py b/winlogbeat/tests/system/test_eventlogging.py index dd763104fa5..0d486656054 100644 --- a/winlogbeat/tests/system/test_eventlogging.py +++ b/winlogbeat/tests/system/test_eventlogging.py @@ -156,25 +156,6 @@ def test_ignore_older(self): self.assertEqual(evts[0]["winlog.event_id"], 10) self.assertEqual(evts[0]["event.code"], 10) - def test_unknown_eventlog_config(self): - """ - eventlogging - Unknown config parameter - """ - self.render_config_template( - event_logs=[ - { - "name": self.providerName, - "api": self.api, - "event_id": "10, 12", - "level": "info", - "provider": ["me"], - "include_xml": True, - } - ] - ) - self.start_beat().check_wait(exit_code=1) - assert self.log_contains("4 errors: invalid event log key") - def test_utf16_characters(self): """ eventlogging - UTF-16 characters diff --git a/winlogbeat/tests/system/test_wineventlog.py b/winlogbeat/tests/system/test_wineventlog.py index ea390475279..363e90edbd2 100644 --- a/winlogbeat/tests/system/test_wineventlog.py +++ b/winlogbeat/tests/system/test_wineventlog.py @@ -311,23 +311,6 @@ def test_query_multi_param(self): self.assertTrue(len(evts), 1) self.assertEqual(evts[0]["message"], "selected") - def test_unknown_eventlog_config(self): - """ - wineventlog - Unknown config parameter - """ - self.render_config_template( - event_logs=[ - { - "name": self.providerName, - "api": self.api, - "forwarded": False, - "invalid": "garbage"} - ] - ) - self.start_beat().check_wait(exit_code=1) - assert self.log_contains( - "1 error: invalid event log key 'invalid' found.") - def test_utf16_characters(self): """ wineventlog - UTF-16 characters From e4df4501bdbf9edb89421746f559a89688fff71e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Thu, 8 Oct 2020 19:46:45 +0200 Subject: [PATCH 174/216] fix: remove extra curly brace in script (#21692) * fix: remove extra curly brace * chore: proper indent --- .ci/packaging.groovy | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index 81ff5b1994a..c65fd7f8b56 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -215,12 +215,12 @@ def tagAndPush(name){ docker push ${newName} docker tag ${oldName} ${commitName} docker push ${commitName} - """, returnStatus: true) - if ( status > 0 && iterations < 3) { - error('tag and push failed, retry') - } else if ( status > 0 ) { - log(level: 'WARN', text: "${name} doesn't have ${variant} docker images. See https://github.com/elastic/beats/pull/21621") - } + """, returnStatus: true) + + if ( status > 0 && iterations < 3) { + error('tag and push failed, retry') + } else if ( status > 0 ) { + log(level: 'WARN', text: "${name} doesn't have ${variant} docker images. See https://github.com/elastic/beats/pull/21621") } } } From 1abe97b20d708d9dd61018163a7d45616b415c59 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Fri, 9 Oct 2020 09:33:35 +0200 Subject: [PATCH 175/216] Make o365audit input cancellable (#21647) PR #21258 introduced a restart mechanism for o365input so that it didn't stop working once a fatal error was found. This updates the restart delay to use a cancellation-context-aware method so that the input doesn't block Filebeat termination. --- x-pack/filebeat/input/o365audit/input.go | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/x-pack/filebeat/input/o365audit/input.go b/x-pack/filebeat/input/o365audit/input.go index 67013dc6a71..2cf76de9ee3 100644 --- a/x-pack/filebeat/input/o365audit/input.go +++ b/x-pack/filebeat/input/o365audit/input.go @@ -21,14 +21,12 @@ import ( "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/beats/v7/x-pack/filebeat/input/o365audit/poll" "github.com/elastic/go-concert/ctxtool" + "github.com/elastic/go-concert/timed" ) const ( pluginName = "o365audit" fieldsPrefix = pluginName - - // How long to retry when a fatal error is encountered in the input. - failureRetryInterval = time.Minute * 5 ) type o365input struct { @@ -126,8 +124,8 @@ func (inp *o365input) Run( } publisher.Publish(event, nil) ctx.Logger.Errorf("Input failed: %v", err) - ctx.Logger.Infof("Restarting in %v", failureRetryInterval) - time.Sleep(failureRetryInterval) + ctx.Logger.Infof("Restarting in %v", inp.config.API.ErrorRetryInterval) + timed.Wait(ctx.Cancelation, inp.config.API.ErrorRetryInterval) } } return nil From 3aceb31568b531063369c191636a36b68f48ae59 Mon Sep 17 00:00:00 2001 From: Andrew Wilkins Date: Mon, 12 Oct 2020 12:34:58 +0800 Subject: [PATCH 176/216] libbeat/logp: introduce Logger.WithOptions (#21671) * libbeat/logp: introduce Logger.WithOptions Add a Logger.WithOptions method, which clones the logger and applies given options. For example, this can be used to obtain a clone of the logger with sampling/rate limiting applied. --- libbeat/logp/logger.go | 6 +++++ libbeat/logp/logger_test.go | 52 +++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 libbeat/logp/logger_test.go diff --git a/libbeat/logp/logger.go b/libbeat/logp/logger.go index 6f1c42fe022..2bbe6b3ce53 100644 --- a/libbeat/logp/logger.go +++ b/libbeat/logp/logger.go @@ -50,6 +50,12 @@ func NewLogger(selector string, options ...LogOption) *Logger { return newLogger(loadLogger().rootLogger, selector, options...) } +// WithOptions returns a clone of l with options applied. +func (l *Logger) WithOptions(options ...LogOption) *Logger { + cloned := l.logger.WithOptions(options...) + return &Logger{cloned, cloned.Sugar()} +} + // With creates a child logger and adds structured context to it. Fields added // to the child don't affect the parent, and vice versa. func (l *Logger) With(args ...interface{}) *Logger { diff --git a/libbeat/logp/logger_test.go b/libbeat/logp/logger_test.go new file mode 100644 index 00000000000..eaf8a1070ce --- /dev/null +++ b/libbeat/logp/logger_test.go @@ -0,0 +1,52 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package logp + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "go.uber.org/zap" + "go.uber.org/zap/zapcore" + "go.uber.org/zap/zaptest/observer" +) + +func TestLoggerWithOptions(t *testing.T) { + core1, observed1 := observer.New(zapcore.DebugLevel) + core2, observed2 := observer.New(zapcore.DebugLevel) + + logger1 := NewLogger("bo", zap.WrapCore(func(in zapcore.Core) zapcore.Core { + return zapcore.NewTee(in, core1) + })) + logger2 := logger1.WithOptions(zap.WrapCore(func(in zapcore.Core) zapcore.Core { + return zapcore.NewTee(in, core2) + })) + + logger1.Info("hello logger1") // should just go to the first observer + logger2.Info("hello logger1 and logger2") // should go to both observers + + observedEntries1 := observed1.All() + require.Len(t, observedEntries1, 2) + assert.Equal(t, "hello logger1", observedEntries1[0].Message) + assert.Equal(t, "hello logger1 and logger2", observedEntries1[1].Message) + + observedEntries2 := observed2.All() + require.Len(t, observedEntries2, 1) + assert.Equal(t, "hello logger1 and logger2", observedEntries2[0].Message) +} From d35dfb53111a86ed0e484f8450ffcf1474be60e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 12 Oct 2020 10:53:59 +0200 Subject: [PATCH 177/216] Add configuration of filestream input (#21565) --- .../config/filebeat.inputs.reference.yml.tmpl | 140 ++++++++++++++++++ .../_meta/config/filebeat.inputs.yml.tmpl | 29 ++++ filebeat/filebeat.reference.yml | 140 ++++++++++++++++++ filebeat/filebeat.yml | 29 ++++ filebeat/input/filestream/config.go | 18 +-- filebeat/input/filestream/input.go | 16 +- x-pack/filebeat/filebeat.reference.yml | 140 ++++++++++++++++++ x-pack/filebeat/filebeat.yml | 29 ++++ 8 files changed, 524 insertions(+), 17 deletions(-) diff --git a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl index c920b7dbec8..7eceb559f16 100644 --- a/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl @@ -11,6 +11,7 @@ filebeat.inputs: # # Possible options are: # * log: Reads every line of the log file (default) +# * filestream: Improved version of log input. Experimental. # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- @@ -231,6 +232,145 @@ filebeat.inputs: # Defines if inputs is enabled #enabled: true +#--------------------------- Filestream input ---------------------------- +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + # To fetch all ".log" files from a specific level of subdirectories + # /var/log/*/*.log can be used. + # For each file found under this path, a harvester is started. + # Make sure not file is defined twice as this can lead to unexpected behaviour. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Configure the file encoding for reading files with international characters + # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding). + # Some sample encodings: + # plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk, + # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ... + #encoding: plain + + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, no lines are dropped. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, all the lines are exported. + #include_lines: ['^ERR', '^WARN'] + + ### Prospector options + + # How often the input checks for new files in the paths that are specified + # for harvesting. Specify 1s to scan the directory as frequently as possible + # without causing Filebeat to scan too frequently. Default: 10s. + #prospector.scanner.check_interval: 10s + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Expand "**" patterns into regular glob patterns. + #prospector.scanner.recursive_glob: true + + # If symlinks is enabled, symlinks are opened and harvested. The harvester is opening the + # original for harvesting but will report the symlink name as source. + #prospector.scanner.symlinks: false + + ### State options + + # Files for the modification data is older then clean_inactive the state from the registry is removed + # By default this is disabled. + #clean_inactive: 0 + + # Removes the state for file which cannot be found on disk anymore immediately + #clean_removed: true + + # Method to determine if two files are the same or not. By default + # the Beat considers two files the same if their inode and device id are the same. + #file_identity.native: ~ + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + + # Set to true to publish fields with null values in events. + #keep_null: false + + # By default, all events contain `host.name`. This option can be set to true + # to disable the addition of this field to all events. The default value is + # false. + #publisher_pipeline.disable_host: false + + # Ignore files which were modified more then the defined timespan in the past. + # ignore_older is disabled by default, so no files are ignored by setting it to 0. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #ignore_older: 0 + + # Defines the buffer size every harvester uses when fetching the file + #harvester_buffer_size: 16384 + + # Maximum number of bytes a single log event can have + # All bytes after max_bytes are discarded and not sent. The default is 10MB. + # This is especially useful for multiline log messages which can get large. + #message_max_bytes: 10485760 + + # Characters which separate the lines. Valid values: auto, line_feed, vertical_tab, form_feed, + # carriage_return, carriage_return_line_feed, next_line, line_separator, paragraph_separator. + #line_terminator: auto + + # The Ingest Node pipeline ID associated with this input. If this is set, it + # overwrites the pipeline option from the Elasticsearch output. + #pipeline: + + # Backoff values define how aggressively filebeat crawls new files for updates + # The default values can be used in most cases. Backoff defines how long it is waited + # to check a file again after EOF is reached. Default is 1s which means the file + # is checked every second if new lines were added. This leads to a near real time crawling. + # Every time a new line appears, backoff is reset to the initial value. + #backoff.init: 1s + + # Max backoff defines what the maximum backoff time is. After having backed off multiple times + # from checking the files, the waiting time will never exceed max_backoff independent of the + # backoff factor. Having it set to 10s means in the worst case a new line can be added to a log + # file after having backed off multiple times, it takes a maximum of 10s to read the new line + #backoff.max: 10s + + ### Harvester closing options + + # Close inactive closes the file handler after the predefined period. + # The period starts when the last line of the file was, not the file ModTime. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #close.on_state_change.inactive: 5m + + # Close renamed closes a file handler when the file is renamed or rotated. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.on_state_change.renamed: false + + # When enabling this option, a file handler is closed immediately in case a file can't be found + # any more. In case the file shows up again later, harvesting will continue at the last known position + # after scan_frequency. + #close.on_state_change.removed: true + + # Closes the file handler as soon as the harvesters reaches the end of the file. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.eof: false + + # Close timeout closes the harvester after the predefined time. + # This is independent if the harvester did finish reading the file or not. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.after_interval: 0 + #----------------------------- Stdin input ------------------------------- # Configuration to use stdin input #- type: stdin diff --git a/filebeat/_meta/config/filebeat.inputs.yml.tmpl b/filebeat/_meta/config/filebeat.inputs.yml.tmpl index a7bd1b5eaa6..70d52cbb9c6 100644 --- a/filebeat/_meta/config/filebeat.inputs.yml.tmpl +++ b/filebeat/_meta/config/filebeat.inputs.yml.tmpl @@ -49,3 +49,32 @@ filebeat.inputs: # that was (not) matched before or after or as long as a pattern is not matched based on negate. # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash #multiline.match: after + +# filestream is an experimental input. It is going to replace log input in the future. +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. + #include_lines: ['^ERR', '^WARN'] + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml index bf29e0715ed..3a0d1d5d19c 100644 --- a/filebeat/filebeat.reference.yml +++ b/filebeat/filebeat.reference.yml @@ -398,6 +398,7 @@ filebeat.inputs: # # Possible options are: # * log: Reads every line of the log file (default) +# * filestream: Improved version of log input. Experimental. # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- @@ -618,6 +619,145 @@ filebeat.inputs: # Defines if inputs is enabled #enabled: true +#--------------------------- Filestream input ---------------------------- +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + # To fetch all ".log" files from a specific level of subdirectories + # /var/log/*/*.log can be used. + # For each file found under this path, a harvester is started. + # Make sure not file is defined twice as this can lead to unexpected behaviour. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Configure the file encoding for reading files with international characters + # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding). + # Some sample encodings: + # plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk, + # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ... + #encoding: plain + + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, no lines are dropped. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, all the lines are exported. + #include_lines: ['^ERR', '^WARN'] + + ### Prospector options + + # How often the input checks for new files in the paths that are specified + # for harvesting. Specify 1s to scan the directory as frequently as possible + # without causing Filebeat to scan too frequently. Default: 10s. + #prospector.scanner.check_interval: 10s + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Expand "**" patterns into regular glob patterns. + #prospector.scanner.recursive_glob: true + + # If symlinks is enabled, symlinks are opened and harvested. The harvester is opening the + # original for harvesting but will report the symlink name as source. + #prospector.scanner.symlinks: false + + ### State options + + # Files for the modification data is older then clean_inactive the state from the registry is removed + # By default this is disabled. + #clean_inactive: 0 + + # Removes the state for file which cannot be found on disk anymore immediately + #clean_removed: true + + # Method to determine if two files are the same or not. By default + # the Beat considers two files the same if their inode and device id are the same. + #file_identity.native: ~ + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + + # Set to true to publish fields with null values in events. + #keep_null: false + + # By default, all events contain `host.name`. This option can be set to true + # to disable the addition of this field to all events. The default value is + # false. + #publisher_pipeline.disable_host: false + + # Ignore files which were modified more then the defined timespan in the past. + # ignore_older is disabled by default, so no files are ignored by setting it to 0. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #ignore_older: 0 + + # Defines the buffer size every harvester uses when fetching the file + #harvester_buffer_size: 16384 + + # Maximum number of bytes a single log event can have + # All bytes after max_bytes are discarded and not sent. The default is 10MB. + # This is especially useful for multiline log messages which can get large. + #message_max_bytes: 10485760 + + # Characters which separate the lines. Valid values: auto, line_feed, vertical_tab, form_feed, + # carriage_return, carriage_return_line_feed, next_line, line_separator, paragraph_separator. + #line_terminator: auto + + # The Ingest Node pipeline ID associated with this input. If this is set, it + # overwrites the pipeline option from the Elasticsearch output. + #pipeline: + + # Backoff values define how aggressively filebeat crawls new files for updates + # The default values can be used in most cases. Backoff defines how long it is waited + # to check a file again after EOF is reached. Default is 1s which means the file + # is checked every second if new lines were added. This leads to a near real time crawling. + # Every time a new line appears, backoff is reset to the initial value. + #backoff.init: 1s + + # Max backoff defines what the maximum backoff time is. After having backed off multiple times + # from checking the files, the waiting time will never exceed max_backoff independent of the + # backoff factor. Having it set to 10s means in the worst case a new line can be added to a log + # file after having backed off multiple times, it takes a maximum of 10s to read the new line + #backoff.max: 10s + + ### Harvester closing options + + # Close inactive closes the file handler after the predefined period. + # The period starts when the last line of the file was, not the file ModTime. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #close.on_state_change.inactive: 5m + + # Close renamed closes a file handler when the file is renamed or rotated. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.on_state_change.renamed: false + + # When enabling this option, a file handler is closed immediately in case a file can't be found + # any more. In case the file shows up again later, harvesting will continue at the last known position + # after scan_frequency. + #close.on_state_change.removed: true + + # Closes the file handler as soon as the harvesters reaches the end of the file. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.eof: false + + # Close timeout closes the harvester after the predefined time. + # This is independent if the harvester did finish reading the file or not. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.after_interval: 0 + #----------------------------- Stdin input ------------------------------- # Configuration to use stdin input #- type: stdin diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml index 2a3e678c542..9a29bc76962 100644 --- a/filebeat/filebeat.yml +++ b/filebeat/filebeat.yml @@ -62,6 +62,35 @@ filebeat.inputs: # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash #multiline.match: after +# filestream is an experimental input. It is going to replace log input in the future. +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. + #include_lines: ['^ERR', '^WARN'] + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + # ============================== Filebeat modules ============================== filebeat.config.modules: diff --git a/filebeat/input/filestream/config.go b/filebeat/input/filestream/config.go index 3ec076196f0..c2b1e838ee5 100644 --- a/filebeat/input/filestream/config.go +++ b/filebeat/input/filestream/config.go @@ -30,10 +30,11 @@ import ( // Config stores the options of a file stream. type config struct { + readerConfig + Paths []string `config:"paths"` Close closerConfig `config:"close"` FileWatcher *common.ConfigNamespace `config:"file_watcher"` - Reader readerConfig `config:"readers"` FileIdentity *common.ConfigNamespace `config:"file_identity"` CleanInactive time.Duration `config:"clean_inactive" validate:"min=0"` CleanRemoved bool `config:"clean_removed"` @@ -47,18 +48,17 @@ type closerConfig struct { } type readerCloserConfig struct { - AfterInterval time.Duration - OnEOF bool + AfterInterval time.Duration `config:"after_interval"` + OnEOF bool `config:"on_eof"` } type stateChangeCloserConfig struct { - CheckInterval time.Duration - Inactive time.Duration - Removed bool - Renamed bool + CheckInterval time.Duration `config:"check_interval" validate:"nonzero"` + Inactive time.Duration `config:"inactive"` + Removed bool `config:"removed"` + Renamed bool `config:"renamed"` } -// TODO should this be inline? type readerConfig struct { Backoff backoffConfig `config:"backoff"` BufferSize int `config:"buffer_size"` @@ -79,9 +79,9 @@ type backoffConfig struct { func defaultConfig() config { return config{ + readerConfig: defaultReaderConfig(), Paths: []string{}, Close: defaultCloserConfig(), - Reader: defaultReaderConfig(), CleanInactive: 0, CleanRemoved: true, HarvesterLimit: 0, diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go index b6c6598c50b..9f715d1183e 100644 --- a/filebeat/input/filestream/input.go +++ b/filebeat/input/filestream/input.go @@ -94,19 +94,19 @@ func configure(cfg *common.Config) (loginp.Prospector, loginp.Harvester, error) return nil, nil, err } - encodingFactory, ok := encoding.FindEncoding(config.Reader.Encoding) + encodingFactory, ok := encoding.FindEncoding(config.Encoding) if !ok || encodingFactory == nil { - return nil, nil, fmt.Errorf("unknown encoding('%v')", config.Reader.Encoding) + return nil, nil, fmt.Errorf("unknown encoding('%v')", config.Encoding) } return prospector, &filestream{ - readerConfig: config.Reader, - bufferSize: config.Reader.BufferSize, + readerConfig: config.readerConfig, + bufferSize: config.BufferSize, encodingFactory: encodingFactory, - lineTerminator: config.Reader.LineTerminator, - excludeLines: config.Reader.ExcludeLines, - includeLines: config.Reader.IncludeLines, - maxBytes: config.Reader.MaxBytes, + lineTerminator: config.LineTerminator, + excludeLines: config.ExcludeLines, + includeLines: config.IncludeLines, + maxBytes: config.MaxBytes, closerConfig: config.Close, }, nil } diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 2ffff82135e..49ede1c7d24 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -1783,6 +1783,7 @@ filebeat.inputs: # # Possible options are: # * log: Reads every line of the log file (default) +# * filestream: Improved version of log input. Experimental. # * stdin: Reads the standard in #------------------------------ Log input -------------------------------- @@ -2003,6 +2004,145 @@ filebeat.inputs: # Defines if inputs is enabled #enabled: true +#--------------------------- Filestream input ---------------------------- +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + # To fetch all ".log" files from a specific level of subdirectories + # /var/log/*/*.log can be used. + # For each file found under this path, a harvester is started. + # Make sure not file is defined twice as this can lead to unexpected behaviour. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Configure the file encoding for reading files with international characters + # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding). + # Some sample encodings: + # plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk, + # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ... + #encoding: plain + + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, no lines are dropped. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. The include_lines is called before + # exclude_lines. By default, all the lines are exported. + #include_lines: ['^ERR', '^WARN'] + + ### Prospector options + + # How often the input checks for new files in the paths that are specified + # for harvesting. Specify 1s to scan the directory as frequently as possible + # without causing Filebeat to scan too frequently. Default: 10s. + #prospector.scanner.check_interval: 10s + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Expand "**" patterns into regular glob patterns. + #prospector.scanner.recursive_glob: true + + # If symlinks is enabled, symlinks are opened and harvested. The harvester is opening the + # original for harvesting but will report the symlink name as source. + #prospector.scanner.symlinks: false + + ### State options + + # Files for the modification data is older then clean_inactive the state from the registry is removed + # By default this is disabled. + #clean_inactive: 0 + + # Removes the state for file which cannot be found on disk anymore immediately + #clean_removed: true + + # Method to determine if two files are the same or not. By default + # the Beat considers two files the same if their inode and device id are the same. + #file_identity.native: ~ + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + + # Set to true to publish fields with null values in events. + #keep_null: false + + # By default, all events contain `host.name`. This option can be set to true + # to disable the addition of this field to all events. The default value is + # false. + #publisher_pipeline.disable_host: false + + # Ignore files which were modified more then the defined timespan in the past. + # ignore_older is disabled by default, so no files are ignored by setting it to 0. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #ignore_older: 0 + + # Defines the buffer size every harvester uses when fetching the file + #harvester_buffer_size: 16384 + + # Maximum number of bytes a single log event can have + # All bytes after max_bytes are discarded and not sent. The default is 10MB. + # This is especially useful for multiline log messages which can get large. + #message_max_bytes: 10485760 + + # Characters which separate the lines. Valid values: auto, line_feed, vertical_tab, form_feed, + # carriage_return, carriage_return_line_feed, next_line, line_separator, paragraph_separator. + #line_terminator: auto + + # The Ingest Node pipeline ID associated with this input. If this is set, it + # overwrites the pipeline option from the Elasticsearch output. + #pipeline: + + # Backoff values define how aggressively filebeat crawls new files for updates + # The default values can be used in most cases. Backoff defines how long it is waited + # to check a file again after EOF is reached. Default is 1s which means the file + # is checked every second if new lines were added. This leads to a near real time crawling. + # Every time a new line appears, backoff is reset to the initial value. + #backoff.init: 1s + + # Max backoff defines what the maximum backoff time is. After having backed off multiple times + # from checking the files, the waiting time will never exceed max_backoff independent of the + # backoff factor. Having it set to 10s means in the worst case a new line can be added to a log + # file after having backed off multiple times, it takes a maximum of 10s to read the new line + #backoff.max: 10s + + ### Harvester closing options + + # Close inactive closes the file handler after the predefined period. + # The period starts when the last line of the file was, not the file ModTime. + # Time strings like 2h (2 hours), 5m (5 minutes) can be used. + #close.on_state_change.inactive: 5m + + # Close renamed closes a file handler when the file is renamed or rotated. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.on_state_change.renamed: false + + # When enabling this option, a file handler is closed immediately in case a file can't be found + # any more. In case the file shows up again later, harvesting will continue at the last known position + # after scan_frequency. + #close.on_state_change.removed: true + + # Closes the file handler as soon as the harvesters reaches the end of the file. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.eof: false + + # Close timeout closes the harvester after the predefined time. + # This is independent if the harvester did finish reading the file or not. + # By default this option is disabled. + # Note: Potential data loss. Make sure to read and understand the docs for this option. + #close.reader.after_interval: 0 + #----------------------------- Stdin input ------------------------------- # Configuration to use stdin input #- type: stdin diff --git a/x-pack/filebeat/filebeat.yml b/x-pack/filebeat/filebeat.yml index 2a3e678c542..9a29bc76962 100644 --- a/x-pack/filebeat/filebeat.yml +++ b/x-pack/filebeat/filebeat.yml @@ -62,6 +62,35 @@ filebeat.inputs: # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash #multiline.match: after +# filestream is an experimental input. It is going to replace log input in the future. +- type: filestream + + # Change to true to enable this input configuration. + enabled: false + + # Paths that should be crawled and fetched. Glob based paths. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. + #exclude_lines: ['^DBG'] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. + #include_lines: ['^ERR', '^WARN'] + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #prospector.scanner.exclude_files: ['.gz$'] + + # Optional additional fields. These fields can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + # ============================== Filebeat modules ============================== filebeat.config.modules: From f3d18f91c1aeb4d49d2214f519430e02a173b357 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Mon, 12 Oct 2020 10:05:51 -0400 Subject: [PATCH 178/216] [Elastic Agent] Fix issue where inputs without processors defined would panic (#21628) * Fix #21581. * Add changelog entry. * Add test for processors as a map. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/emitter.go | 11 +- .../pkg/agent/application/emitter_test.go | 175 ++++++++++++++++++ 3 files changed, 183 insertions(+), 4 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 73dfe8ff9a4..eb98ef39ded 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -14,6 +14,7 @@ - Thread safe sorted set {pull}21290[21290] - Copy Action store on upgrade {pull}21298[21298] - Include inputs in action store actions {pull}21298[21298] +- Fix issue where inputs without processors defined would panic {pull}21628[21628] ==== New features diff --git a/x-pack/elastic-agent/pkg/agent/application/emitter.go b/x-pack/elastic-agent/pkg/agent/application/emitter.go index 3bd06043c30..07f8e1f460b 100644 --- a/x-pack/elastic-agent/pkg/agent/application/emitter.go +++ b/x-pack/elastic-agent/pkg/agent/application/emitter.go @@ -219,17 +219,20 @@ func promoteProcessors(dict *transpiler.Dict) *transpiler.Dict { if p == nil { return dict } + var currentList *transpiler.List current, ok := dict.Find("processors") - currentList, isList := current.Value().(*transpiler.List) - if !isList { - return dict + if ok { + currentList, ok = current.Value().(*transpiler.List) + if !ok { + return dict + } } ast, _ := transpiler.NewAST(map[string]interface{}{ "processors": p, }) procs, _ := transpiler.Lookup(ast, "processors") nodes := nodesFromList(procs.Value().(*transpiler.List)) - if ok { + if ok && currentList != nil { nodes = append(nodes, nodesFromList(currentList)...) } dictNodes := dict.Value().([]transpiler.Node) diff --git a/x-pack/elastic-agent/pkg/agent/application/emitter_test.go b/x-pack/elastic-agent/pkg/agent/application/emitter_test.go index 32770eaa5df..b2286552f9f 100644 --- a/x-pack/elastic-agent/pkg/agent/application/emitter_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/emitter_test.go @@ -479,6 +479,181 @@ func TestRenderInputs(t *testing.T) { }), }, }, + "inputs without processors and vars with processors": { + input: transpiler.NewKey("inputs", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/${var1.name}.log"), + })), + }), + })), + }), + })), + expected: transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/value1.log"), + })), + }), + })), + transpiler.NewKey("processors", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("add_fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("custom", transpiler.NewStrVal("value1")), + })), + transpiler.NewKey("to", transpiler.NewStrVal("dynamic")), + })), + }), + })), + }), + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/value2.log"), + })), + }), + })), + transpiler.NewKey("processors", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("add_fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("custom", transpiler.NewStrVal("value2")), + })), + transpiler.NewKey("to", transpiler.NewStrVal("dynamic")), + })), + }), + })), + }), + }), + varsArray: []*transpiler.Vars{ + mustMakeVarsP(map[string]interface{}{ + "var1": map[string]interface{}{ + "name": "value1", + }, + }, + "var1", + []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "custom": "value1", + }, + "to": "dynamic", + }, + }, + }), + mustMakeVarsP(map[string]interface{}{ + "var1": map[string]interface{}{ + "name": "value2", + }, + }, + "var1", + []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "custom": "value2", + }, + "to": "dynamic", + }, + }, + }), + }, + }, + "processors incorrectly a map": { + input: transpiler.NewKey("inputs", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/${var1.name}.log"), + })), + }), + })), + transpiler.NewKey("processors", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("add_fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("invalid", transpiler.NewStrVal("value")), + })), + })), + }), + })), + expected: transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/value1.log"), + })), + }), + })), + transpiler.NewKey("processors", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("add_fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("invalid", transpiler.NewStrVal("value")), + })), + })), + }), + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("type", transpiler.NewStrVal("logfile")), + transpiler.NewKey("streams", transpiler.NewList([]transpiler.Node{ + transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("paths", transpiler.NewList([]transpiler.Node{ + transpiler.NewStrVal("/var/log/value2.log"), + })), + }), + })), + transpiler.NewKey("processors", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("add_fields", transpiler.NewDict([]transpiler.Node{ + transpiler.NewKey("invalid", transpiler.NewStrVal("value")), + })), + })), + }), + }), + varsArray: []*transpiler.Vars{ + mustMakeVarsP(map[string]interface{}{ + "var1": map[string]interface{}{ + "name": "value1", + }, + }, + "var1", + []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "custom": "value1", + }, + "to": "dynamic", + }, + }, + }), + mustMakeVarsP(map[string]interface{}{ + "var1": map[string]interface{}{ + "name": "value2", + }, + }, + "var1", + []map[string]interface{}{ + { + "add_fields": map[string]interface{}{ + "fields": map[string]interface{}{ + "custom": "value2", + }, + "to": "dynamic", + }, + }, + }), + }, + }, } for name, test := range testcases { From cf11c8b5fcae3e3eed12769308f40878b893ef0f Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Mon, 12 Oct 2020 11:55:28 -0700 Subject: [PATCH 179/216] Fix conditional coding to remove seccomp info from Winlogbeat (#21652) --- libbeat/docs/shared-securing-beat.asciidoc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libbeat/docs/shared-securing-beat.asciidoc b/libbeat/docs/shared-securing-beat.asciidoc index b8dcc3b1957..e1c47d91f2c 100644 --- a/libbeat/docs/shared-securing-beat.asciidoc +++ b/libbeat/docs/shared-securing-beat.asciidoc @@ -29,11 +29,13 @@ For secure communication between APM Server and APM Agents, see <> endif::[] +endif::[] // APM HTTPS information ifdef::beat-specific-security[] @@ -70,5 +72,7 @@ endif::[] // Linux Seccomp ifndef::serverless[] +ifndef::win_only[] include::./security/linux-seccomp.asciidoc[] endif::[] +endif::[] From 9ab0a918237369343cab4e7d17ac09d08e887625 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Tue, 13 Oct 2020 00:43:40 +0200 Subject: [PATCH 180/216] Fix concurrent map read and write in socket dataset (#21690) This fixes a panic caused by a concurrent map read and write in Auditbeat's system/socket dataset. Fixes #21192 --- CHANGELOG.next.asciidoc | 1 + .../auditbeat/module/system/socket/events.go | 4 +-- .../module/system/socket/socket_linux.go | 2 +- .../auditbeat/module/system/socket/state.go | 11 ++++++-- .../module/system/socket/state_test.go | 26 +++++++++++++++++++ 5 files changed, 39 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index cc8fb52396a..f01136c441e 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -195,6 +195,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - auditd: Fix typo in `event.action` of `removed-user-role-from`. {pull}19300[19300] - auditd: Fix typo in `event.action` of `used-suspicious-link`. {pull}19300[19300] - system/socket: Fix kprobe grouping to allow running more than one instance. {pull}20325[20325] +- system/socket: Fixed a crash due to concurrent map read and write. {issue}21192[21192] {pull}21690[21690] *Filebeat* diff --git a/x-pack/auditbeat/module/system/socket/events.go b/x-pack/auditbeat/module/system/socket/events.go index 76d91a8db24..c1937cb0302 100644 --- a/x-pack/auditbeat/module/system/socket/events.go +++ b/x-pack/auditbeat/module/system/socket/events.go @@ -872,8 +872,8 @@ type execveCall struct { creds *commitCreds } -func (e *execveCall) getProcess() process { - p := process{ +func (e *execveCall) getProcess() *process { + p := &process{ pid: e.Meta.PID, path: readCString(e.Path[:]), created: kernelTime(e.Meta.Timestamp), diff --git a/x-pack/auditbeat/module/system/socket/socket_linux.go b/x-pack/auditbeat/module/system/socket/socket_linux.go index 78fdd8ae4ca..11f8a22289e 100644 --- a/x-pack/auditbeat/module/system/socket/socket_linux.go +++ b/x-pack/auditbeat/module/system/socket/socket_linux.go @@ -158,7 +158,7 @@ func (m *MetricSet) Run(r mb.PushReporterV2) { } else { for _, p := range procs { if i, err := p.Info(); err == nil { - process := process{ + process := &process{ name: i.Name, pid: uint32(i.PID), args: i.Args, diff --git a/x-pack/auditbeat/module/system/socket/state.go b/x-pack/auditbeat/module/system/socket/state.go index c7b3ac761a7..fa612b56e1a 100644 --- a/x-pack/auditbeat/module/system/socket/state.go +++ b/x-pack/auditbeat/module/system/socket/state.go @@ -214,6 +214,9 @@ func (f *flow) Timestamp() time.Time { } type process struct { + // RWMutex is used to arbitrate reads and writes to resolvedDomains. + sync.RWMutex + pid uint32 name, path string args []string @@ -229,6 +232,8 @@ type process struct { } func (p *process) addTransaction(tr dns.Transaction) { + p.Lock() + defer p.Unlock() if p.resolvedDomains == nil { p.resolvedDomains = make(map[string]string) } @@ -239,6 +244,8 @@ func (p *process) addTransaction(tr dns.Transaction) { // ResolveIP returns the domain associated with the given IP. func (p *process) ResolveIP(ip net.IP) (domain string, found bool) { + p.RLock() + defer p.RUnlock() domain, found = p.resolvedDomains[ip.String()] return } @@ -542,13 +549,13 @@ func (s *state) ExpireOlder() { s.dns.CleanUp() } -func (s *state) CreateProcess(p process) error { +func (s *state) CreateProcess(p *process) error { if p.pid == 0 { return errors.New("can't create process with PID 0") } s.Lock() defer s.Unlock() - s.processes[p.pid] = &p + s.processes[p.pid] = p if p.createdTime == (time.Time{}) { p.createdTime = s.kernTimestampToTime(p.created) } diff --git a/x-pack/auditbeat/module/system/socket/state_test.go b/x-pack/auditbeat/module/system/socket/state_test.go index 75b73a374d1..89ba0cde9db 100644 --- a/x-pack/auditbeat/module/system/socket/state_test.go +++ b/x-pack/auditbeat/module/system/socket/state_test.go @@ -11,6 +11,7 @@ import ( "fmt" "net" "os" + "sync" "testing" "time" @@ -835,3 +836,28 @@ func TestSocketReuse(t *testing.T) { } assert.Len(t, flows, 1) } + +func TestProcessDNSRace(t *testing.T) { + p := new(process) + var wg sync.WaitGroup + wg.Add(2) + address := func(i byte) net.IP { return net.IPv4(172, 16, 0, i) } + go func() { + for i := byte(255); i > 0; i-- { + p.addTransaction(dns.Transaction{ + Client: net.UDPAddr{IP: net.IPv4(10, 20, 30, 40)}, + Server: net.UDPAddr{IP: net.IPv4(10, 20, 30, 41)}, + Domain: "example.net", + Addresses: []net.IP{address(i)}, + }) + } + wg.Done() + }() + go func() { + for i := byte(255); i > 0; i-- { + p.ResolveIP(address(i)) + } + wg.Done() + }() + wg.Wait() +} From 5e786b383598d252cf200ed22f213d8d5f33ee0d Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 13 Oct 2020 09:17:00 +0200 Subject: [PATCH 181/216] [Ingest Manager] Syncing unpacked files (#21706) [Ingest Manager] Syncing unpacked files (#21706) --- .../pkg/artifact/install/tar/tar_installer.go | 6 ++++++ .../pkg/artifact/install/zip/zip_installer.go | 11 +++++++++-- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go b/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go index 5c7f0f593a3..b9e621c71ac 100644 --- a/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go +++ b/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go @@ -102,6 +102,12 @@ func unpack(r io.Reader, dir string) error { if closeErr := wf.Close(); closeErr != nil && err == nil { err = closeErr } + + // sometimes we try executing binary too fast and run into text file busy after unpacking + // syncing prevents this + if syncErr := wf.Sync(); syncErr != nil && err == nil { + err = syncErr + } if err != nil { return fmt.Errorf("TarInstaller: error writing to %s: %v", abs, err) } diff --git a/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go b/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go index ffc90f2dce8..29cdb66f852 100644 --- a/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go +++ b/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go @@ -102,9 +102,16 @@ func (i *Installer) unzip(artifactPath string) error { return err } defer func() { - if cerr := f.Close(); cerr != nil { - err = multierror.Append(err, cerr) + if closeErr := f.Close(); closeErr != nil { + err = multierror.Append(err, closeErr) } + + // sometimes we try executing binary too fast and run into text file busy after unpacking + // syncing prevents this + if syncErr := f.Sync(); syncErr != nil { + err = multierror.Append(err, syncErr) + } + }() if _, err = io.Copy(f, rc); err != nil { From ed772cd8fe1c478318eb5b9622e022412b577df2 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 13 Oct 2020 12:17:29 +0200 Subject: [PATCH 182/216] [Ingest Manager] Change Sync/Close call order (#21735) [Ingest Manager] Change Sync/Close call order (#21735) --- .../pkg/artifact/install/tar/tar_installer.go | 14 +++++++++----- .../pkg/artifact/install/zip/zip_installer.go | 11 ++++------- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go b/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go index b9e621c71ac..74a74e4c6bc 100644 --- a/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go +++ b/x-pack/elastic-agent/pkg/artifact/install/tar/tar_installer.go @@ -99,15 +99,19 @@ func unpack(r io.Reader, dir string) error { } _, err = io.Copy(wf, tr) + + if err == nil { + // sometimes we try executing binary too fast and run into text file busy after unpacking + // syncing prevents this + if syncErr := wf.Sync(); syncErr != nil { + err = syncErr + } + } + if closeErr := wf.Close(); closeErr != nil && err == nil { err = closeErr } - // sometimes we try executing binary too fast and run into text file busy after unpacking - // syncing prevents this - if syncErr := wf.Sync(); syncErr != nil && err == nil { - err = syncErr - } if err != nil { return fmt.Errorf("TarInstaller: error writing to %s: %v", abs, err) } diff --git a/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go b/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go index 29cdb66f852..b565f630a73 100644 --- a/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go +++ b/x-pack/elastic-agent/pkg/artifact/install/zip/zip_installer.go @@ -105,18 +105,15 @@ func (i *Installer) unzip(artifactPath string) error { if closeErr := f.Close(); closeErr != nil { err = multierror.Append(err, closeErr) } - - // sometimes we try executing binary too fast and run into text file busy after unpacking - // syncing prevents this - if syncErr := f.Sync(); syncErr != nil { - err = multierror.Append(err, syncErr) - } - }() if _, err = io.Copy(f, rc); err != nil { return err } + + // sometimes we try executing binary too fast and run into text file busy after unpacking + // syncing prevents this + f.Sync() } return nil } From 5536fb6cf02480c3db685aa4f27889266cd20a32 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Tue, 13 Oct 2020 13:28:11 +0300 Subject: [PATCH 183/216] Add istiod metricset (#21519) --- CHANGELOG.next.asciidoc | 1 + .../docs/images/metricbeat-istio-overview.png | Bin 0 -> 187983 bytes metricbeat/docs/modules/istio.asciidoc | 24 +- metricbeat/docs/modules_list.asciidoc | 2 +- x-pack/metricbeat/metricbeat.reference.yml | 7 + .../module/istio/_meta/config.reference.yml | 7 + .../metricbeat/module/istio/_meta/config.yml | 7 + .../module/istio/_meta/docs.asciidoc | 17 +- .../dashboard/Metricbeat-istio-overview.json | 1762 +++++++++++++++++ x-pack/metricbeat/module/istio/fields.go | 2 +- .../module/istio/istiod/_meta/docs.ascoodoc | 4 + .../module/istio/istiod/_meta/fields.yml | 1 + .../istio/istiod/_meta/testdata/config.yml | 5 + .../istiod/_meta/testdata/istiod.v1.7.1.plain | 499 +++++ .../istiod.v1.7.1.plain-expected.json | 843 ++++++++ .../module/istio/istiod/istiod_test.go | 32 + .../module/istio/istiod/manifest.yml | 11 + x-pack/metricbeat/module/istio/module.yaml | 1 - x-pack/metricbeat/module/istio/module.yml | 3 + .../metricbeat/modules.d/istio.yml.disabled | 7 + 20 files changed, 3228 insertions(+), 7 deletions(-) create mode 100644 metricbeat/docs/images/metricbeat-istio-overview.png create mode 100644 x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json create mode 100644 x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc create mode 100644 x-pack/metricbeat/module/istio/istiod/_meta/fields.yml create mode 100644 x-pack/metricbeat/module/istio/istiod/_meta/testdata/config.yml create mode 100644 x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain create mode 100644 x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain-expected.json create mode 100644 x-pack/metricbeat/module/istio/istiod/istiod_test.go create mode 100644 x-pack/metricbeat/module/istio/istiod/manifest.yml delete mode 100644 x-pack/metricbeat/module/istio/module.yaml create mode 100644 x-pack/metricbeat/module/istio/module.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index f01136c441e..4ca46560ab5 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -453,6 +453,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add Cloud Foundry tags in related events. {pull}21177[21177] - Cloud Foundry metadata is cached to disk. {pull}20775[20775] - Add option to select the type of index template to load: legacy, component, index. {pull}21212[21212] +- Add istiod metricset. {pull}21519[21519] - Release `add_cloudfoundry_metadata` as GA. {pull}21525[21525] - Add support for OpenStack SSL metadata APIs in `add_cloud_metadata`. {pull}21590[21590] diff --git a/metricbeat/docs/images/metricbeat-istio-overview.png b/metricbeat/docs/images/metricbeat-istio-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..139fe9260d49bd0d0034ad292987f67be37468ce GIT binary patch literal 187983 zcmeFZWl&zt(l!c&;4Z=4A-KCc1b4R(+=E-t;1D#py9W0_aCdiicRPzDd%yea^SxEi z|MR6*rS2tTJv}|$S6{AYivp5Wo|bGd^e#5Kw+I zVPSbmVPQgfdz+7DmL?z|l+i}|`Y00bDSHhJ^!0m(XsBT9ofU(F!xZ(sJKDS25q{aj z;ePGwdK&=>$|pbu$AFFQ(bU}zl|_H>Wl-_EDSB!v<#7XJgHvmr*F8(Mo@jAja4 z&I^d0qP?I3^qV(EU{R&ox{4r%bs%%Zq5|TebIbyVj!^FK!KvT|1R%xG(Do2jw$7m{mWu;!gQin24FiWA~`Vz$! zttKUuw{OLpe-X!rQ7&)Mk|E9A&PJG^Zl8FMd^Y{6#o?AYcN6#0nzFV#i-&* z_`>$4Gqd{3uPl-JH<)deX!%$;g0qVYSeWYhPcJW=DZais-+b3ju3lceZC+kpPM9Dd zwzc5kAX`B}ObK=TO*gFM0a2!zDXTlG%gS&W*;vsT7~2?{(79OI0-^>1;c?*tep;D0 z8W6fzSz0@Ax$qMI{(=km{rZ@mnDF-}juyPc>ay~L!Z!9MgsgNdbPU9NFocAJJod&P zxfDgj{uT%Bc!@tbI@)s4(>psm(>XKK+1Q)XGjeir(lap8GcnNuU(hGSik`3U*FI( z(lOBgyKbN;&+Ahzc{3LiOLY-5D-&x6pbb7o4i0vn-v$0Zul}dW|0t^QKSkNu82+>5 zf4uoyl863v1phIjKjQlR6p$Am3=jRkWzPrW#7Nfz0wMq+DI%!s0(zMGHU+f@qle&w zo%7R1S7;NubKSc9;!=%-owGANLV%ypnd0IV$Kn#~;|_aI;9~TqeUD_!1AMwRThosp z%q#G&+$Tfs^uL;J2>4-Pp`$?l+12ih40WetdSQ%02>K5%S)Xn-FJuWH@PBl*6F`mL z?js`2f&a4(fk6A$2CV)Vh8T#gsKq?P{9Q`mlnjYj1WFGvt!iqf*9Gj)Lk41jIqWcN zwje1mQUNeJ5ufvc0BiCfq1QX$;zOzsKh|Pt{Z13edsMCmU!hm$QO||=?T=)9LXl4m z%>&k^l=O=f0+G@WD`HFOu1!{L|BUJ}0K}xYP2ZU0PhGw;KIb%1z8Cg?Zb^~+!5@il z+8A50``2y=`1*$)BDb!RZv;6=b-(|W3+^|8#L-O09z}}qe7N%TIK1gb(DRR^ck!aMM)VE%t#JuzATDUKf+Lxwc74xs$ z2?d~k`1g?84WQ+{I1ft=dj9o#1$vg`rUgr{=1zt0@kW7I9PZ=< z&(QC0`>P?~gzRx&r}jr}!>XpJ@$vs^psx*-e65$CKlh(%QhY$R5>OXOKS%!+?BiD- z+6Eh@R^my9$?kN1&v6(-??$#{qQCl^K#}pbG$vg$!mS%?+9=P`=}v0|H0HNV!I41w zr$N95K1%*pUa(k@Ej6EYlZ}6MNFKbT&(m?-*kg)U6=p+j8qXQmT>cR5ui|o`fYS00 z!IkH=D%5_LxAptm9S>ojswwtr^@Kk{P=Er2(4VT$|F2nEg;xLepc`IZL~uH8@UKpy zoZ^9Moli_NuIL2R{OOGZ;Vn`H8NU@CET2Dz;-9rBPO2|0HpjIcY-EuBw>}?mOVkST z1wi%Yt-GJI<3iIUP!0m9KmMFbiO@7B0$_bxeETNWd$|E@`{&P%hcoc zgnzEpGl<9QaaNTTpX9g1Yz@Ew&G&HNWO@Di^-k~KcZ8q`gh=xqX!AQ$A9`l|AQ2@K z%6Mh+#lNCx*l!OKm1@<*&Q==r`9ps*nZLwha_DCHS((;yFBL}}m!s5ko#*i0s=ldd zpff0vRHY~uh1Fb{UL{X9ohtMlE#r}NEM?~ANP?PX^{t9f&@~g9QmW6g%lYP4nKUNZ z=lL3~WBz*j02uUGt{Mx;G@gbx_v3uE-Z#fOg{m#JQ*HzCbTJ=?H2dcqb~a}#y-BT8 zI8+b3PJG9Vy8C~=398Oyw_6v9;ZPv%OQlF~Jf1vrPu{-!y$~?LV;}vY;MYpoBj~hR zoMyIrJ|A)Sk7f6mjCC}`yw_k#cCtIYI+#(+GS*OP8O;=ytWEcdal6`=ihrLZ`{3Ec z=+!~0(O_Q_hR3XEzu9Yjb-6|&*54hTOp8yiQslp>I6@1L%@*Aqj?*9Y^9}9vMPzEM z@3UaE6=0RYr2%oTEM8~Cm##SWCU8@tdP0Xy0V0(F1w*ff|m&)%aOD;lidpB@fPuNn|+Axh#h)ei6uSkUNjSr0MLu0 z1?MWaE6qa9(!9f^I(~*m{R?a&;lS}5h?|~zy^(Z&<|9~i>KwxvmHW#*GCRYb+PQc= z#N~QBr6RTR+_+7=xV5KgS!ay~!z6v2ZgpIvKkMm~RR2*GGSBh~{$Zi+>si!d(%@^y61s-3LL z2)ud8B`#2sP|7z}OL)H*h;KWQz??aOsk=$BXQ`)FDASo1`J(WviL8YJ4|rrU{yBg_ zZ{;K#=DJ*Cam;q`wp(!Uf=;h>eM?d7h0Z0}fzRVqeneKU)nhBSm6zZ!6?Uc3N&2A1 z{qoRA?#Jh;Ot>0YRGL?t@6(BVYwbK1Ll!#l3wop4msM^VOfxu@%Sp40a?N?@sZqOz zFc^8+X6`)he1u<|wBbC3N~**qN1^$mSK&rhUcVY~0j1Nc59ap{b|Bz~B$ zHp>lfQOX~Rg4^?sbv{`c07~Y1HnGL9Sz)(?Ka)zvsJmV7e%v2P;k>9G3{eb z+h}c>#O&M(hyR#dZ9XOTA&sL*joV;LeNE_XtYBkcJIGT03CPlj^-?30s#&RerPT9s zlN_16=mUyJ~KEeHu`u(c! z4LfWc>dI0{UC%eaOtrJyEXN!#anWF53x6C=p^Zus4Mjf_+MdXl(}Xyj`=ORb$thnU z;6Oh|AnHauU2Jf?&oz-)y4$o^y3Hvy;i@S%@k( zjh0%qgb*K}-FRTS)c$nUK=K=TjgR#7dkvW*ewSN$2>5&1v5Hz`2H7=ry>>4ySO^#L=k5zE5I4kiajW1b@QVstnyh zN9(=Va*5|WFOS*l%W(@YilMX8^c=hu#`+Ys%Kf@6g7X49>dCj#+U-)lK8r=q{$Cj{ z{O$O_8x9KJ_E^1be+IRV$Aan*O#i#}F{7T`uyKue`jaV=&z;?}RUd~4Vu-t5a?HMo zq0sB{EDhdWU~D4h?(ljaHyihT7cEjLB@Whyg2WS149j;6dwOukrgXpA%UAr#GZq~# z7LJ{L6+85uH9i3LowV{+3yh~xkusH2)9B1_a+?76nn89<*+J8Rc-qnh-?YhjZA|ns?FMQbcB^_%ktN9~oRGqu7rP=|bFjgO<+%r|>rplD$XzVk?mh#}dpyZm}rtGaO18yi`gtqzI z?*~6Eue%GOH%?Q^rSnY9F!ODA4(>*)mIp8dBuv6kVtRN#HzZyXFi2!vT8-Cddi8i= z>Yjc1f|=grxM#fFjLT^+;%%J~mKG?8f{4w~O6+)^%I$m!yVC&$w{cLcR_>$)RR^_U zF{0~fe72s8LZd2k#0e{Wp7V9XDR>*tn!Cny)Cbh_EokDJPFSrzF0VIVj-rfOTmrpb z|I70Y|B&4`n9_Q$Cv1~n;j6jnwS0+so%N>H`;DJ4w#wT+A5>ym>9fu)ax!1}sU+7P zT^-+^Z4BJQ<7{2-F`qvK8;Gg=^cxIMX76HXUT;@7`NbAie#;{k5axeFvp-#;fY+q{ z$H{3$f`Xfa*;vn!R3bI*MN$-(HK&kEqYi+@7&izwm@F;d0%`OU<=i&;+0ivF-N(@D z1Aew4xkIO zt`6|;4`t02J+?3H(APFveBi^z1L3-fbKwtW%t;ujl^`@hhIM{B86be~U3|b~( zsOH$LAB7j=m=UtD4a*>w=(l5FrylJt@|?J=aJO|5#j(0)O0`}l?TsgU*ZPyXl`zb` zmRK#OsY!PD&qemUidBmZ#+9t+tGk*9TIbmuGj>B2G8R&p-2-E(RTMR=EsdP$;1Jh< zU4G9?pe^idNM)F#M@5SLy|LKO*>c^MqPo&P`JA1D`P`;4#6{ z8k4DIs!BhLQHl%X^?wy>&Dgh&w>(_$O{qD>A!ED+gK;$puTtE?sXzA8K)`$M*{{g} z!RP38U_}vv>^#*h)kN=0<4wN)C91{UO8Ff=z~OBTSbsAv-=UcY>rDqVDtTC+!&H7$ z$c=LEc31yt2xP>PcLNnkxv6ergTqdeUiUg%vp!L8PXt~rf$n!!i!5P+mxmLD&@0a$ zKO$h-puBc5!g`g+W1SYpjWNHGKuT&fqYZ% z>RX9^)6=Y6tgC`RRZjlykEbmM=1ZkjS;VGRmckVy#Jv?4!elGJ&wJMehAR^viN{+) zOn-QGxR}sJG5Liswn&Ahc*kds$*EtYFFy-gojOYG0^_}MG{OBq{TZrLT(j%@8P?$- zH5&2@^_0nMceOjCBWh3hi>Mxxf!O$inQ{r#np0?#h1#R;Juff0G@hh-y(VKf2rA`@ z43`3nRgE_r97SnPVWwCjYd&BG_m@=nv-ejxGBdewESakizvmAeh~SXh`c<_qRNd!u zWE_KEzz%^(-RBz$l+2w8G;$WKZllX|PTNww*|!Aq#Qaolcf|vw=$NCyIS0et_sG1b zj}1!a1N2Upi`J=g9(~dz@A%-bXZ6ao`REIk^2ZzdHu_PW)5jr&<-UG$;|P=pThWSI zc*i9_=&PVwrn#}9eS3Al&NWYb-Z!k~U@(ZT@FAU#=3;wze1W0gdZAGgzi>CQ*0Bu| z!Htg2dZIDzvrI>#VX;J@SSB2+#A)j5-kTEH?u?_ib~RS)tao%599K%C`hLm)rZm&X znN%v8IDjmS$>$xlvb^`Q_i8ak=(52EVzU+mJa$%i3)Bm{#WstQmCJy@9V|(K+>8(} zWlH9v=w8lwR2Hf9cjX{-f5yA{8VfF-^GIq*xBghFOS=t3p{FduM@Cf&qD^pnruJ`; zZw=h6;(k!)5W%Pl<&H#&^76P;wL2kC_o;H`b$Dht9?pu6=M5AH8>})P_uRb0%=kG1 zwHK`$U>JD5pxzKxiCtU=gK?)Z{*>6~xO9O*_ni*0eCF3z)MUQSPF8~~W9m(1wFy4U z_6>BJhQBtF2O2!j5+0e@-|=W(Ll5&D2{!ul!De%)FNwJ+-ZUy){gV+ICcZ&pz>HA3vU4w5JO90oTq&qsQjJ(o#NIYKFq&rjS-fp-L2OlXZO2uBNh`?ATb35T5Lz2hbWWF3flB-o09 z-zPTNey!ihi&L$ zd2cEN(<8f*eidrd)umoH-sVY%|UFz9Jk3=^d*5=Rx`}v0eOCU^3QXp$zJ{t{y zeD4BcwN#}*Qy2{kil}U+m|yFr9lceqI&%8{{G6K&8}Vu{Am9 zhSyW0C)u3%VLB2kbE9qLe!TeBlZJt@`SXyD&4yec+@4e7QZY6Ez5%+K;eA-r7ibby zQQ;4X7`t;qx8nHF^{kw-rVyFe!0Cz30Els+r$!jUg$A5KskS>K@;mc-D}JL+y6xH%@U>3 zdZN~{8q&(_ttBt#cG}lJ+g2pk{MC{Ax)JL~3yfv?(zG=@6B|>?wc$xS(Cxl8Knq7E z31m`t8{S%_N*3WX6flKOrQZ(6XXkNhho1U^XN2IQC;H~`bj`2X>uG)y&B*HrNvdbJ zzf&m9Z z3J$w#9-_btZ1nVrpNqe5-*!nphTy6<=h6EbWi z*xZ{;2Jlr&PHda&*6W@0Co=lQQYvWMI3Fx4G1%bp&NK7aGHzAE?BMxt2CUVF^keB( zDyn2t5v({AP>NClP*^koKS}uo%Dzu~ll^guI_|2H$%N*Uj>Y!-IVWW@5g8WZr_2uU z+!+z&pVL-6yz;P=h`Q<99f1a{ioYc6_b<)p17|Q9jrI>ZG9fR_wU{omnMUKOlmz<| z%1Hrykd>At0{x)a0oA0SyO00(xMIN{EjMUze$7a);!^4*&}kGnfC|h# z?2Z|kO;t5iE7QknvKAkpOS)e_(rVRNUySG2(QYga2*MIr>KvT3-So%PYB{C(grL*( z0&#;AEJJ%%`$V<=PcS!}%&(}V5*c+vFTa$;R%}`H;6Am}MF*Li~<0$$Y}y5y^yPAusPq#Nei!%%_S9`LmatPnIRE zuI4DGidE1zKeRJ$j=Ep%*F3TrN5Q;V$8sAhFg)%q{*Y!*SgCgzUaIU`EBrA2D^yjix%GRNX28KQ>ChmI4W_3Y`huMBt^B3j@)9 ze=vnpYiqQDxOXe0kII+{M(8P9fbMdCPG_JkZr{1p{YJNO`A}oR2~%H3a^_+YhG3aF z#;k^=oh;rZz#J$m$)>c4Wice^ ze41D_t+qL7x^vxL;8=wn^PoQcRY6Nop~O5R@{7t#!+@v0eihh<*;=-3SzFV(^jbYsV)j241e zpwumU5M?)OrB5wlKfhViya_3gFlpr&-u>3{gvH|GQ~l|=c)F*90nW&#FNVzcsj)`4 z%&(d|nayS_a1Lf`Kyrbt^fG07TDv|_Dm}2_?C~wE$!71^xkF`EUa>IZVv`!;QjbD* z_oorv*C_jlFpKDN*yXbT3zg-~(ZawazDWV}TXtYL6773X{w_Dq8>W}oYhU;ZXS{*T zi)f^K%#pYp;-nAmSSSX)%BKz}azSe^TK`l5OK%4v3$Mkxh1xQcLR$Zd-2(e>#P1oK z)h(t=3<|%S5eRX#s1m*JpovUh_PjS+<1*ib;)PJ|FegXzN3B&xdIsx>G97lm%a|AQ z(zbX@G{bWo%+s#5A4E=aD?W(H9`SS;rfI>EjNH1M^L@)bXI*9{UR%#FB-{!P+Xzw8y~A2 zO?6v6a<7`Yd1jjtjD;r)6o#CWYCXS0ey4U@@QFZgl-LbFqS_TUHbG-e{{fH5p^g-1 z*Bw@vkA!iQB52d!Hz-*2Y_FAvUfEqNdlz(K(|UXwK9xCIy) zGH}X^%|HfF00|}I5k}~?wZ6LHY)Y|+Q;!9GRfS6U4K5@7?^K@`xxVaiwjj11t$vHw zlJN9%<%jWHS(4x@o1x-~j>1Kgfc9NRqneR4d(DJp7+o`!SjzbUq3P9&P$OP`L;sQu)h{o4|s4~}f z?aLRW`(b%X;nX#{%1B_Eeun$7HXtIfv_jO`yy=ntlj%DFFM-y?)_cNZ#d*cvK~bQ{ z0eHZ#FMONfHTl!t1tg6cX5qK~CLbk$#F~XYLB4;r9X{eKH2lx5SxF!>%Pm-m{f`R} z3v3kAa`A}$E93WDn6J9_zg(YDGR~$x$d~-%0<}Q$*E|#<@}CaECl&mYM-3`k@jos= z3&zqqpVevfzjgV)pX*bAV(T4&cbWh9i~nWFr23&C;pMfvr++fh|6nHm?=<|c`tv_B z|G(4l4;JbFPgeud{IuZT#|&=S8nkl94d-_xp*T94;|zlQ7V084$o{+NAAs+_|A#^X%nt;V z>R-mif7bVZ{QcTU_1RTdD8~7U_e;`oAK-<(Vkmhdi~sKCDV{Ijwf9}@jI^X&-d|bJ zr?+_f90tI#(Z}{}v((G}_v#v!^>N_YY4twj{jE|yM##3aDdmXxJW)VuRiaq6lvMUR zOO?e8-CU(nkjPgQ(F_hC2UoNF`F+YE{9i5PVDkm~GytT6b4^Fm?6>;SlbB5-L_*)m zrtx`FhhwwG#8N4JhX5ft+U)yA2B0zLhjYwS3R(VWblQnbb0Wbw|Fg9J41ARbe7aPN zB7sh4951kPs+>PyOu1hE@|3GJiThuQ3OG3K_$`dh%-zL~bdE$cOGhLDe?NfE z8Ur2(3ZtP&61Q_%eM5ufR)1V72xF7P-@!)+uBLlGM=#XbBy;^R?1CxOZD};_ixEY@ z=b@xgE1MM4$nF?U{FJK_I+d+P;;fc4o0aBvlKB#^)2a#rE5bp|1ldEB1PpN8PsZFI-E z-yD0s?9TlmCjov8Dp*us4!k zLiRpDn{)0rmi^-W>gE3D)y@gsK5+%4Q51p9R_5{)C%_*1qX4V3;JCvV=xOY|SKn#1 z*Z^8bQ(lm^L#9vwQ?&n0u}wda?rByQpEZ;wlSyQV|Li~j4Q>IZe%lVvqgEHe`8;k3 zmGVEt<;f<8G{}hLKnq_B))F^YxcWZAR=M{`R*7=5~ERIv-gYcz$BoYQiF+%S6-VQ0hZwy^l1s1LeuL!XuXQfNbxWb zi$3vvL1JpB;}~AAz7`MIi%2guZ&NsQGwit((96%LK5&6NY*`|6o`!@fA}<-F%z8X{ z5(x-V13cc(+CKvEJLX_p*~|6X*m9liW6xZ)J*a!G7vpE>mj}`ZcrN6*q*lNh36}EF z;;ZKjAumm4`Jg?7K^*u8kq@Sd^CPG?tLfC$#XW zUpa&3NI9!mPz?(6ok|><^o59LO%6-<2*D^AUlG>w< z0#UMt(KGL8hCB|YEZF_^RikXCX*LUr0WW^zgN~UWnlkbp*m680m-?p8m*o^ndze zx@^tB#GO~-=ll?9Iu9TxIHV_K$ZEJv7(HuiL0gdDp>rKv_}19j@k4_{fMV)q>ajXT zxqN^R<6NG#rb_+z0Su4!-LgL{1|5U7WR!NN0>;)Ydl-;;G}l<;9Z&Gqqo7=XMOc~1 z*c`C<=A-v2Ki1EO<;BkxhVRmecJ(bqdqrXaBPF#xnDoT;F-`o{QhX3zO;x1yS2dV< zGw!}RyySkaKt+#2c0TyDhr#iJ&r6rYY{C#wa3zhyL$L}a5Mjv53`3583s*j~-W56! zj7(xYlE&+%ce32#lnPh{Nq}2bQxcF_Yt$1lKL9KpwtEhfs_ynbph`e{mvjPIS${en zt2r9|!_kw^%FY2kJLyy8-XU+m)$agy4QdeEQT^Jg@wnK_gf><_CMSYgQc*M^9fs_5 zs-Z*%Sex!(81%Za%7u!qoY4+E^c=Up`2{I~AjA_uuqDgQ0<^0s%H^8<4)<}D<;i&~ zf-B{03iorJ^^y#M!)7m05|asv3nC#8@$cZXp4b->5uX~dW(Ht3q3|}dS#e7$))3do zos_o)J@X#p^FBx}Ob^wZT`jjfoG*+<+i$L9n={2L&evE`&3T<`yLz2Zn(a+ES0oJ7 zDeS~i>ME<2YSI8my$XIzZZq!90OST&=(|D1VjB`IOT(Mv7ADVaTs!ABy1VnO=;fA1 zspz*V9$sU%|+o)lfc6bN)fE8xEaV`$o6y-eN<3iFW0v z8j1V$VFQcJ*oWy-owAXKonD0`7S~2?MTj}vxgTbn=oAq<#1pv#s{P|8#WF{o#fIa* z#!$p*xsGzmc-^;+n=nL5)f>dN>D9A@zp9ohDrnYNUdujPPXtVMR~k_mw`UlPHyCMA zsWYVWIj*gfVR3(s5qQq~kSayE@WXV#+zY$TQxXIQX;Z>9f?Ds3kyAc}?ehv`D_gUw z<#o2Q`S<0$o?+12wDy9r4Kl0mlZs{9W-IBIJyO?(k)<;onHfy4V+Q-bRj1P=H^r_XPb!(M;R{b2j@lE}%pMu9V2zcFO z#tU|W@RztHv01&HHrGeH)lODd3;i$vRRB1&6&I7Tb58s5Dc3Hfc3Ey^>tu>=H7I1AZKav;xiTDEfuQ&x=_0r=$Gi z^^($e?l1``Eb7iV7Az&zG9AX3MYMsI8DWIiDHc8GAQJf?xFfd8@L@?(n>p^RuU6}-f!-DcYB6vc5Q*Pw_KWixi=*% z>z^Q%P}XAd^AU?n@4CSOBS+wwM^SK!T`Fa^a*~Iln z7QaDA7#6QKKnEe!X}TF(d&9U^tGwLeP7m-e(Gj*h4_hd$!(fL0lDXo;>BvaM^E`keBO8rdc8aMCNaMh z9Bk4!``GAQk2RMV7QxY>)Kz~bhkKFN z)FI&);;^{x4n5OG>E*5KHYrnH`$?D53DJqV14$wH_7aQy) zTuf%e2>8=B)t0|?iibr5D05Qt2h+in;rD~TwA&REhQ=Mi7{gJ92)69@Q;xK$JQ=M_S-HmoU8I!xeIwGR@ zkQSp}X=sj!c}Z`Rrd`!(mEaGBB}5}NlFCc(ZM{MTMWc}IhOSf~OsP8aT&WO{T2Bpl zj4_Q)=IYwbRk~PQl}s>iqu;JNP1MT5e$5pc&y$K1+8)%&IJeS^1$@B1S9%SfbaBWl z+Js2Jr>x6t3f}yvXr6zoJ16G*5J z(Z*57GmAnqltal)uXRG~={PHs21~{DOCD)XUG0#|VoP*Mv0jOASSB*qA6(-VDmHu( z)$lh(Ezu5Kn^x@y#e6vBQTidK(w9p+JJEfyLze}8J&EvSwkU@gRh?`!TS5Bt7BxaC*n-b)1ya@+j2EE^CqiIvw>bemnQ&@uJ-F zVM2D#bj3U$Sp-|e*9bZbjcDZQ`AraM{`gotjg}@3nfn!f1_>oGcFcnlB9&@&MafEq z24~*p_>Q5$*?bMo=5*=87YRv71pH~PDSv1@`XRrD#Xv7SuBGiZwrQ@V?2w-(xf^NB z?nPdFpNh6;0V_4lW&i%m=SiWB;_PLt>rilsRUEK^8_gRLU-lBY<#K@T9d(V@Sg4)A znB!QuUZq(I*O7x1s2FS2zmP4HgpzlF&*dS4W%vz7b*4R;RD0I;{&u?5+$sDVMx(*Q zmrdPz`8*$EgNDypaqZDE)wC~^-)x+8ULNMBdZD2PdJ$bp3YVu?423j#mgCP|g8RwG z8L=;XlSNAcRUi9G?v)j{hqQ8dKP0o1l?(mii-idPZt>Qx(lEdz8iv>RwAl~hnlXH6 zwtcf!2(`j-D9cr6UtgbUWz?ii}nTGI6GC%2wXXnbm~mvzyw2Rp#*B$TU@Y{cdx z!F9vOp7Tn^{K|8v7yKO}uDXD)o|#*_u(}0%a;UognhA#NX1s6~#wTH62#b5TAyBlh z3b0hK6S_X;CFFIxnlQLd=kp|g1M&Qk3*8LFoLVDPzSZ?&TQP9R3~ZzD2I(P6OP(_S zWlZUv0V|!Z*w0_sRV>=G74sKY`%@NGvZa$c&BhHmGH3i&IkE|K;bm#WqV`V+Z_4Bv zX6d!-N#kf#80fOYb9Z|#cIaE77Z6<$Hx6RD9HtC^jO951Tvqa_A{7)K5~8d2ebzLZ zph}R?E?58F~@ng0)~|-j=TQ?(kw>!y^mH>iiNpr_5lVGrW@s^-=m} zqz?<|QUVb>Q=vEOwdYb91|2usoewXhmh}wJ_CrSlbORQw5GT2xgJe+ngbF}jB8U}z z?Yx_BekSo5;crozER{H@HdWbNI1z-G2R7HR*mQHy4t06=?V z#-TeJAa|$i=jAu)WWDQ4wnuhdN}fh(M5m;;POTt^sgTF26U^5 zw{joi0Er3=uv3p3Rip^awIC~WN-CS>MzS9tKaA^UkV!qh=d?$!b_(J9e70_qTJJHC z$2t$2t3KADSRg^gX}2CrDuJ}Je^)y!ObK;D*4i%#lY1~>IwC_8+dSi|WeAn zMX}Oe7B7BOy%c-|7gO(L@i>pi*g^W?bLr*YsdB(MrmI2=j%T@cOHqqm{XMFCNTvle^Axs4{MhQfAkPbwZUFP_zh0@5>n{K)OqeYV~^3RHZyo*kl*qghlJ^v)iCJINC863jMN+$&k0*pCl~jfA!%9f8t~o zroy{H1nBd^XFmIqFnrd*>W3XeQBvzgj(PPa_YqyQdzyESw38!f4C)4oU*F2rhLtmL zw2zu^28(Y8L)uW;P~=_IIP)G@Rm0s z76&^suoT^&#CrVZ08Cx_%5unit<=bZE`rB8aYu+Vh1(gyyR97Xz8j4ee}{{tfRTk_ zwJe?G`j}#5q1))VCuKI*TzD-d>Y0;^_57f2<R5`5|>lf)(MWi>sU z!#{kj^e$KFIsG%2pl9q6_h-qp#fBW=hv|Ff^O6~hQ5hTVbAmy#yrD!|+VAX)Lly-5 zt|b@0aGtt0MN{f$xGp7QyC+deMA))2B+_G zE3dU_RnARYdi$CT&f}PdG41Cjqvq>N(@-^Q_cPS!agcEsB!3xFW^WFsDq(%1A837o zR0$Rx8LdWECJj;J+idq^gqrbRV|OZwZERTR*Lp`5QpXUE!)A@_?;z6aWszF|Q|F<- z@_{p>L*40kUK%IpXIK{-XbA_u!*c zYdeL*;IucEmIc4#^I$)-+9)MziU@U`?@2zOu2d6mj zc=@W4c>8>-*gU|>fEPt(aVRboY9;i`1riuEehiUHnMyXH%t>cZ+HyUEp%668R-OXj zQcOYzJ44}bzTI6Z&rjHHao5uagDVFDfL6C*fux!I6T-WUSgeg$1yrZ7FN<&bzEQAl z_4=)0q~(jb-kw&X?57!^hI@iuMc9VPdRt{vY(c3Uwg4x?gm<=BZyp6P#Wp2;)-d~R z!e~`X5~(BgR@SSE{94|H5gxy@%_PM>Pr9Qo{ zF{cr%eX}Mt$F`C$Piqcb#qAR_dC9E~Y;gw&$;m?}q#lWdO96C>tDp$cL(EA?VHMqxrocl-O|Qihs&8nH_NYqoGQt~2-y&7h=*BL@oXX>>d0Z4=BGG9p z?uuiO%kqv2omNxgd}oBFS6FVNSa9r~8?Ib3hE!pZw-auI`|UFZo%ZNMBra#x`HO1R zGDsvimG7KiWbbnL%$E{GGp`WZBeCsoP|?k9;SkC}rzwbXy89YnAr%&N7LjLD(~lTc zBh%Wr5Hm*$(+9!G5``1BIvBvQs?0Wlt;JD2hAQOOtp(~Dd^|tweeaoh;cB8>*K{+B zLWe(BRrDCd_P4|Ztk6NBz}up9QM^GKPwKCz6tPPA!-++lZo#^aXd}QGnIT2kAdBQ? z-AaOCIkh+?^bTraf=GMC@S$liBOR*X7XZS$iid&bvYKa!`^K23+m%SK$M@3$IMJ~` zU@ztBEIQRotyWf|nn3|?=+VprKp6Tc0_tn6(g+&O#zT*3x&-eKz2?56^WA1X8!d_X z-oPvq4TdQadgE&}TE-27hSZ-UNu^IkK1cQ!qX=0|Y?pFb9yvwgjOULK;@M;HKlg6b z>aU@^MmmFuoNDZlCi!wZSTn5NLFdCd0hcwg`p{P#n_ZmT zYTXLk!aiw83Oxtsgc!Z^p8f8}GsLhw^~!+FQwCdhn>pQ`u$_SLDe2K~LbxcvZ3S;NGk+w7uwHk~JnbM>-T z^j^I}paPK$z`~^V(pLO8fXoV$>$$O2fmdFKdOW~Tgu$SD-}Lz?29Nvmr?<@bVVZT; zrFF6tK->jvJ&(}>%VLGUo=*L2&RYW!Fr>~4jQHX%_q-=nwukiIJDID^1a=|dH4UV- z)$T=gFn=6EFCq2H^SX#HSGO`h23X-tF1=7>{5^eg{TyGB+Tw-G42ck7hz$u#=;11@ z=AEYT`QZ0wSo^4C(vZK`uK27}KZ-2d$zVoLw0O15H^RRc==$+BT2bJn`V=zM07=Tb z<5yw7kERfo5^=v!+y>sAM@4}suUr3)Zb;`NIB@Wf5-LxcT*ivoSxmdsbZ$jU%L357<(gyt&P^Iol~tN4*AXK)!x6i zp3Nw;TxnGj|4yyYtR8hUrwR$=W!w&D8L2d?a#Wu?W*aT%n5;ZnJRfRV%qJzNh*7+Z zcq&*0R&a~??`#SUf(3ECVJ$6lqCU~WqrHGmAOq@O3m_4WcpTT&x;KH+hMMV zjKiCdmV{hYuQ(dz7TjC_RaAnQ=_4CZS&4c<&kS5U(kJ(r+v!&|8+!e3|US~ITYhW91kZxn4?vuiBH=7xE zdB`i^MW>)kP^{DxI9aMBY(vt9+wpjB3KfcU?iA(y(xOL|zf^tZv~({!&w#K|Kc?ph z#_4J&msbD@3uV}eS8DQT2r)Ap14Wtjs{(XOLDI`84rq(hgpi_1?~)6on; zH?su8OsC4fg*P{O?#2A!&uU${H`@rk{~>KRfjui4e1FPcQW z=FBN*fo=(6ey-Lks0@ZP{Be^%PnzZxu+?pW+?Qm?lF(N`weQcu<#iK!zG>TB>1FU7 zT}VIQk{Z|=P;*3Z!R-K}I4c6AR<#`Co>D{_><1}?FEq_MXZ>nyg?!tnBo-HXM$2JcGTRPzgPw6NlhGK2 z-V4sVc{}Ba^oV%lEBOO+PALw;2Z;>gzl1b9i(y#LQrdULrjyQ~UNLj>C>BBRy=9g- z%ULJ2sEw;19iWkFm?n0E`Gyv{^Yse6=tS#jXf(%#4z%)w>2O$+Glt)mTl5wB)G0qT z8xd?Lej^WyAsbMoh78f+@&*ol?%4Gb!5WXVm{4|i7@u(I zc$i_~VGaj_K(|{fp~~9+l}8?u^zVE>4@WKwQ5|Kx51BeJlku*v$h~IlbY#AiqT`mU zH{>A{9_mzRa6^7$d3?ss#8I%B+UIxN6~^>@QaN@quarcsT6*Vcj zF15>$Nt!cGh`E9&{;d=rAHT}|#yWSApBh+t@%+!X!q0a*1W!-0z(Jk(QXr4cN+d`c z0*A%4`&I!{8rY|DOa|h?{0@4fNt{{$egf>g)mT=*Uh~P4?JtkdP|z?VjutOHZO((B zu6$nU?PzJ-!|FhCJEP@#5M6kf1;M}T=LuOybQL(Suj$BY*So#smw_m&+oM{vc)S(C zO>`Ea0Zr_;s=Gozxt(kCd$M!6mTz3;etcP(12SXM(Zp|+{Ug?wi?yD@o(09+M%IqC z8qA(c46h9L+vnjInsLjtpBGMFbg6I8{C@PR@*|9lYsC<|DBPLNSl7!!73dOdOBi8PBSeK~U1gl-`TGv%;O!&8jeu}*BoR;9n7ikjb7QM^N@K=zU~SM3=S^#1 zOmOUOXs%&&T_M12Enn_AJWMYgl12_VoyfP@`Rs*7zwH;i4ZcH+#<2t(-WLwK>mk-Q zrM>Py%1EpGQf@RntK4(S075pkH<4d+hE9~cn&gMeWz-#}Kr;|2k;dbCcppKioF%t) zwcxDCrzHeUK>i8MD4oxHy#Hi06Zbm))_*iJ!jHmBzr+8U|4oZ9JVO+hAA!3XZ9KVq zw|Xg-uHE9iD8D<$0}C?MU9fOJTAcXvojcXtYs(kTtn-Cf^CpXZ$S zobSvyI5-ac?|au;*ZQq%qZxEi=bPSnv|qlMQ+Z+T&R~X19%?_Zv>(;y2qT~!W}2K% ztT3nJ^|;A*uZ>dpFw;nXPa^wNCgwK<}A@ST)qV0TW%tQUY zniAVQ3>zWbRqZT^T#W5Qwcs03SqwE_qS`#i;if>VPU45#jLw}on^xH#wZ{REqOiu= z#ldt%v&q$p45|@#4f+608OU|62mb4eTkJE18AuRkKLVGJTovxm!*`SXw?@@i^Bewv zC7Em+e=qFAISnwA8swMTi#Q9tS4w{y-XP*VYn+UKm6sb_MewffC^{Htj@6Q~Sl(S7 z>lX$0$5J^+5#Celh+&tPaL3Hsb4U>T@*$Q0ghsxoHRL@g6RnMAiOH2|@y4LPBt_AU zt(m?uiO73S#6fEyL7*R_LjCpFTB$7D^PXY-b}BR5uX4Oj^!bu@kRb=Rmo=?^`rERL zW0VKG-HE${&v$gMCmbAnkyKtCT^;K+Sg!|@V15G4AGYrw!MXO{2L?%U(a}$lUb)zl zjUfn~VvHH*R;Rs_PP5T=HU!-o10LPc_gh*^msV1!DQEOCmYWyZ3~pQ><4xvc_>b|$ zLxi1`re_C3vmQK4oHmbcHf7!}3*VJGgl2w1lLq#L;(fNXoBC^H@~3R7jZyD#n3lF` zxA#jn2R|@-yho=s(C@83GSX-y>OvqmE1q~;rx)3vkfT(hlKpb#j;`)-K1w^8RSv-| zgyYaNrF;|F(6z;OJ6fa3{-eo6ekL(YhEb=<0pN)wKw~TvCmPUC@=n`lf8skmxYGK| z&EzTW^VO_QuO0<@l5yvk9!|S+?>H?7xrnEQI|mTtX@h1R`;?(_s#mB2P&!8%mHI&> z)mCR)qw8R7fv18RE}K~*CWDs7I_*Hw2}W8Ji}BbNk-$sxJB6|A4~klWgmV878+_O? z)*_h#$f^@yj|46&GYd9`k$v$nKAUJ(wxYwzI1f6{Y(FP$4czy5GtNUAZdh(VLS6nR zOUps*1&SkE*E#^qvSrBzwHS%HTJx6I%&ej17vV$fqhUuHdx+4;geqoxlB1@sKe6=Q zemlFm&@e2Fh`g;&aBML7GI>aM#!yR!*|2keHvEP3&^bqZ{jTam?K%Pkcyn(Q@*@Y* zc-6sb%*INQ*%InguQrm!Wi^Q7 zo6jxj{~tRAOc@fMAr`4teU1Yu)XsFFVo~)2mhLJfd1DlBR3w2H(MB8N6sLs8eFtKQ z2$PgD5qZ6itBU0QYk!Zn`Jc;2Zs!QtX~GbKAKO<#%iuJBwRw0r-JBKlE85Y z3VwpJT7Cy+I{Dm~cJ4lbd;q>RYxlR8T+Ns_=}dZ}xSZD6&92vS47SYO zEbe!Xdh(!@N)8ykk#1GJO7EjCpkPM>yNLH7I+nC+_*=vH1CvKdEVzclue0)?*30qN zyWw+aJ!R%rt`LD1)!-oYT0t^il*tG|D&7(uiWY~u_dT9ez1dB$Bx;5~=CxX9@FQs+#RG@JMWqfey49G^k&Ii(;% z?hEz+(iobAw(lK;e?`6TzRx-`$(0+?`jIoQKr00eIHbo&Z%Nfx{6-q>Oo`Xc7zMj^ z|Bf%mv*#irjgH6PY!4ST@w3a{W7`OcvRiv5chdib+Uqf&2e7s_Vj3X(|4;JmX_*?p z?JYDZyVR1s;^)x><<;U-(=yd6QGXO-dbnMV|1KIf4b*d@{?WppZ&E%(Y4|+&b$d%J za8}0=lDRR;W=Z)X?eDrje)1x7y!7QI`~UDxD;|8cQK=eoL2D2J?pmMOw^3LutjS|FV^Oni|XiN#&YB z(sOufE%={*yyO4Zg0S7{2H2Q!CwZtHgI04SphIUCM!`J1Qo;6ri^I0m=5eUEkdg1{ z{{0yeWCa~&C@h0AW9#pKv?8MUsHaG>H>`CNZuTBA5$Q2uN?QZdR-GDcCCHV|q-I13hCDzHQBv!Nc zQm>>P19mf!j)*3vWc0WDpAq(279aup!BY^qk97^GKwf+wad(aNF;V#HjM<14v8FlAFr@;$N3I zh=gYyq(Zm^!2ZOmq6QFU5J}vi`#I?4o3A`>Hwt*HCa-AZb6M>6{*iI^`%eFF^7eb& zvyJ>Gatw%_5{Znu*=jW=YFdBgjxcCuR-281?^tL(gpx08Q~8voe4P!Zw-)psNG@Yn z&OM~HCH4}CUwxm8WR~X5nw8hV3BWER$Bo(FX5anqsSKD_l&5`z*M2WC_O+@UP$wDk zq*9|nfd1iNzQF(pcg(I=R;lcU;Je=&8w|7ZR?bOG{TU^n(5$&BpBUmn+MS)9an zYhYS&SsP zg78{_R`YXeLw`r#W z{eNsJ92n07-nQZ$J@LD`o&IqkGuVyme4>7ljSrQ_VY%6e_}%yP-uM;^y5pVhUO7hd zD=`Xf)Co~EdtDL&Y*J1#o|;b(kgf~ZxN z^&R(dvfgPrUSup^V$NNevnBv2hy{l?OLiJ&B+ z_QvOsCJiCAX894Zl^rLb3bWtCut9#0>gfTX2)&XWh{Sj8B-YFHKNBtXAK~5ZyEs?E zESRsveOPXS17Vt>@{U(40=e|Ro9dr)Hvolr>Uv}OxjMkEw@0%Av{>(UCh5!x{C=N; z;3XPB#7&l&yurFW8Umazd@N-!g_H0Vrcr{KVAohPml6AKaU=Eg=DvrtbI0{iSF5?A zM~cR9I~?|joqJHql1ZbyZ$oW$+^+l)L>RJieh0yTI^^~J6o4q+GJ$YWfsqfe$OI$T zlK`#DKE&6jJNf<Q`!9dj?w^s<-R_2tJ#Ic4wi||sJdd2F zj};_{OZbNSZEszB2y-GL{k|w-dI8w`szKsk^7M`Cv5oLkeW#rU&Q|_fR@=>$*vRev z?!%k>)6mHKg=rqFA zZ48zUxm$uu@?n89pQVU;86ZEeu=d(R3b9MIV?&*Ih%VrJJlWeAF72MAi@b(AIewAj| zCT`72gN0A>U5ne!1a6%0St#Px($Aj_59ccn_poDU(`;H_i&Qd;S&a9b+*aG0uR{z5 zXV1IE#&1K7F=BO@N+nZRKGq)oGMJ4Bdx!9u1{Y)IC!g}|v#jB03W-g&$^)l zdYbWu3$xd1%^FIDHim z5}Tx4o)iVIi)}p1PAbS|NS5K+O{;%?HK?S39^>LjQR_bNGITx?YNUGj(2q4_e#u$< z9)e_9*=bkZ`QU&^ygMw?W^+g))B8F{@V?Q6C{~T#hjSx?l)U;*B91l(^fyze^tOTY zbNgBwBnBTtnlmFbsy>Gy0_9Om?|;7h*i2wkje>j`tDP@Hn#Ai;Yr8Y?fsR90 z-|rj7A?Qt*ypzk7qyebEJxlx^a2paJLH*^lle@=dCn4p+1DqW_MwHF|0<3RQONovW ztmdv0+IJ1s0!eQ^Ei~H361&6Ij|_{&GQUiFoT+-uE^`2;6*Q6j5ehQ?AG6xCunZO& zKUP|eGUIZ8_I;SIkaq||252q)y;nH)Bsb;N6@ ziP1by?)Vbrxr*-S^pIIU%t?3lycL_;os^ z7cZf4L!6Ka`N#;lt7W?fVjBx0wKWFI6PN2Uv(~EqJ>I40>J)+X^?#XRDf;D|A8GcVrigWhwI~F&h_e zTDr^)Mf0`vL$>OtnJv@`&a5WBggt1g|xg{n6y<@$QOzI2E4hEoCF zOsFjs7BF%uH>f+)^7k-)GLLsfXN77$TBQ%rj4zqE$!0Ppv~w>fadUA%zdL0ao7Mu`OIys{TwoUbX8m~=d z!Oy@wm>#^XG7rgwsp=(Jc2HyqMhyTNU_zdBdSRrd>_<*+G+HM4TuClNRTczz2QlaY zcaWH05&sL!9{n$17W9yerjh;!FzZ{v=+VjpKqaL?6Uwr2+_#(JLn$*95*wkj?`urX zxoT)H>d~JCodv5p#tWc+q8KaBgtXHpfpWgYrRHsPn9_ySov-{$%EF@DlNU|05*0F* zEx4S;xVyRZ2F2vP0+sYxIxH<_r_;5uG-gsEe;KWGq_vcj!taG7#fv4fEx|Msq)Kol z_j+0ItS*X``hBl}2sA=EKS-a)K3%qyt^5rC)^eehT#;6}y#BYtarF9FxuE7Cn)fu7G{HQEO+-3?>y+&6!`+J@I~`!|`6#9{iBs3a;+ z$vqNgp!}W$2i0@sTqOkQWP3pwva6H#;6#Ncph}X?@`>*3>4`{>6$!!+@4T^#bvSk8Eq3|$53lEx^mou0p1!2J#u_S`7PT$VL zKms@wQi6DWX<8*p3o+5JL;8q{RbVvw%_LLVSnw~*FTBR9J9 zAbhxAdU8m-BE>mGQ$)G9pM;3m1aOy{Ypq=l6S+A${6SvP%Pl7vjs4qTIJxjxA3XnQ z-L`}1%fq9)E!FV-1`0#ug}Ai0!M_YVS=X{1?wQq2ORFBF?}=IAH=<5A8010>OX+wm zMGLe_g45b?do)*g&FagU-S-aV%60g7Q-Gh^&X%0>@p8gro0ZCJqj?j+d(^dxdZWU% zzKn#(B?Ve-)S%)IYYu`SELGB*wfR9rz0Ykc??kWnep{}~paxzV zK^In-roWco;e8S_h2+R`O|&GyEjZf8 z4e~v;Y{OM&>hUbb=;qXZJs)#|4JIK)IXLZZLSIS8ONwlJkMf@tT$hDGx#cT1dFc;E ztDYBR4Bwyx={gjC|j$(wpQDi_H!C9Y2iG*(4J!g&;atF)`N9 z_?=6eTYv?z61~({9^ul4CW+egN~11IAd{|j4<gN~>z2Wl_o&yoyO(y3GF$H^(= zE^G}29mI2bt_#gh$!Y?pB0JMXdZSmtK|67D)34;a5p%y#h$jlToNFkP27aNpZtXlW zi5(D6Bj;fXS$g5g9a|fo{rcqANaJ)sEr!bN#WkJW<%wz1w+;_=THr=J-HorT^h*to z{SsOl;w_tYHJ6oR=grzZ-pI+6$!0M@I|Oa-28a{jUux$_rz?Fed?#A*sXMmCgZN7H zL3i{77y>J)*`zLPkLAd}9^2*Q`G!I^&$toDD1!@cA(HBC6WY?1_KuM8M9^VbvJ$QB zKHir7!urdZ^A&%{Z^_Fa43e3`9d5QSJKMCo18p?!Z+DdGADoE(9fAP8eK99Iq_F$N zB_vMc4{f1`c@(MV(yCQkpBrs=OH#hFn%g`y@;|UtzXSv=HH#r_xDrs2EREw6uyaDVxCas*fR0>Cq@{pQo`;^mB z{<+rgqLgeJxmO9m4z*yUp`n?0Djk&aN#BKFDlk2czwhd2wcES(6%PuA_}?V0I~+ZA zgv;g5&ESuf{>dWelLERze&7{M1`36vF%t_e7qsLybXf7mQO4_Zh(AP`YPFjk3wSMb zGkmZu1Y&>mOVA{IQW97%=oDW^Ym10-uw2@XlbR}JH<*d{ zUq3?V8lxOJe>$k%sLxCPA<0o~p?HLm)LUCi^ty5X#cT0#f96NFMm|4!rk;6{4OGHj zY-*W-Q2ayOsjUV%o^K>vFdZjPbS;_4k)%@witDw_?v#0p0W}fR7g2>k;IsSTLruGJ z-x$_d;YTsm;toW9r#l5Ym%%uV-qTi_O$+&$USps4NPJj0t^r{c3R}^biNqxPaRSF=irF=Zdw`DKYQYzCbA$Mjm zpH-mOY|KWoe1ZOIq;d!JvzmOd{?pGY_4t_q;Sj;~O=>{b5hL>Vm_c0ln{CPaa|HQN zlwrRiYw0^?(G;KK6~Br`lNZQK%3}2nqWQWKZWVR|`IZvW1f)Vx$y}xb!x<>_G9+c< zM`#+M@!u~`E0Yq8 zNCjdPoB{-3+I;aY+;zzxi!Sds(#xpJqR-#ZVrzqu=j>@K}S5yHG+0fQN9DriYv2+BZ-rx`cw)$`Z)X zCD?%1!7&PhfINcEDPOF6%s_q@dY>5D!C`8)y3m`4r$tko&VQ+(unYfi1)Emth)azfBrKgO4m2ZLRc?&CL>M z&uQbzt|-+HJAT2+;xIlBvd>82_lO$Hk^Z@Rh0?HS=g2ZHRfOf3+a8l=kvh9a8e;AO zU7%6zt&(m7?CaThgt(aa|1Eud^A5bE-z-J6WESL+``NN>Z}$;Xxv zo!4hq2noRbB9Ejnhj$5(ysgT2%>acvCUd>@A3^f{*7?kbK5?VGRU#WtJnk;)>~o^% z7l6mr1W9S>N##2=SmB_cAZ6d~$*xhm8v=*dQKy)?xG*R?rm`(|i!b3=eDUr!(>+vZ zLXI5U3d*|y702c@qA$Bx49Dpk^f|>v#LuDwiVc3MLRwmAN#-1?p2qhO1Sm9Na*Vf| zp@?p=q;AebVWy*kRY+?srZd0Y(p09JGI2yzdf;gd(`%1@tTFRA1l(5H@x ziCmpj`p#qseR5SV*Dl1AYw%JC_qzn7(^8qH+rc(QDQ3h5G#bS+)9GgVE$74ophOB> z>V`J*MjjOi9Z^QkJI7(pNjB-=LsO2zt(5&v$3@lQphLg2#^%DtL2xJwcoqzqPFu)i z3PDTG)hZpeJ{P8IPAB=n2fqVvG42)l`5DGQBNWtH_LBW$Df>(j*8aOS#OnQtg7Fm5 z=ZCD+z3g*$KD|LId5OnjOIOVOKf)aP3khfo( zmARzDohE6Z@Je?z5wKG2e9k!HVR}#>FhK+5D=?4In|9pQi!xPWRo7h8nqFldsyKMM z{(b9(|1UWCK)qJl$HOP0RGsqE&v5Aee1G zVm-6UJHqHT?9|-8dqX>Vo-gd!5%9Z%vnnO)qxO|^m-X3TG?v-ND!FwZUKh5M2gSwA zr*dbr=2F>`0N{W>M@%nI5&pt|sg-f$uX;84X)%q{lwLXDg^bwrwu>4=CJArWNqP4V zA55YmxJQ?(Bkg_{O3wSUapaxZ7L$nD#cE*TQ|FCb^S^ zbbzd%JIot1ece{pudy9=_ZI-Tsx~nZHe;4=?($!I%v{rL^0n(<0MWweVjkM}XqZ|i zAK-ln3nt#z`IVo$^&6Z3N6loXAcVI<9F>j|8hH!baFzXEbMy+fP5ebni_zP!jH+ZE zOoqVYt2eR`Yep2gOV4xQSE?}$0W-IORmkxK!5>DKk1D0DdH5$h57Cjr?mzt#g3Km3x z6U1+uqot%OLq!gX9;YeP<4;Nby!>zVnZxc~p~7%kLyP4VUYSlA=JjZ8rfu6Z^=0hQE<}}*dGGOf595wfDBJS2fVc8f^0U}WkVNNz zZhHART1Ak`y}N53j0>Ogx2!dFZpB`DVVE8m2zQ!qr zEiTS^BQO!bxv~7NXff>Z{I|!TtjY??QvYGK*Fk)p6uyp~kexv!VnglfX6oH-=;gD! zk6Eda9+7<;Cn!-gt{)y|+M8XK!lTaTr?5q$Q4|9)vE|`mBBYv%sU)MAIRO61_0ze3>Om zG7(%^i&~1iBGFs8w!o#iz8Jo|)_eaE?5fQw_Q4U-d(L4(i;M5KVXCB>MfTYpSl99u z(g}pz?wQEMHIvB|jd#oUx&2LRuP0r&yg5-S?D-eZwMGbZq%Gp zvb`BlExh?mSPDaw4yPU=r-G}!B3~eGzS!;QxVK5}v~b7YI}DW3{5vBTP9ezH>c~z= z7-R#}c^)UN+!^hB*HdxT0Pn~jye=rqGC$xJBCG-(Hw6S29p;HItraqsg{2%ckCH>Z zT}T<;=#z(r;;|N&39Z761nNRww>%>%tGBqjl6B<^?a!4Yk^o{?7Agfln#GsdiQ_xu zcB)86Kyv5L@owCE9|9*S!baF*Qh|nfUfxtVAfHR&fvVH>$g2v9a$3d)u zfeUETTp-V#=v=gWL7GIrVkSmE*?>y)+YIjKHA@WQyi8Tn=@Y8Z|2rl;76W{oMWpnDWy#%^tc|ehIzzlrp6J<()iM-p#d}lF3 zyD_~#-w@Jx>6+%Ekj_u14-fiW64{wJScZx7hJ*Ui+ji?2e4ARlSI_ZTHX{3%GZ7GV zKsi5${Y`vCY#nrPnn?FefjsS=Rvq8jLcis_35(wDVtpI(d7zy#yb#jvyhmxu;aO3gG%K&gLE@4Uu9syxh5tgmRuruUl_eW` z5QNOLi%az-rlFN6!*G(TyM$D^1fU8#aLuF}yBP!xgCY|vNJCEX@M6BvF4^O;hB3;9&461N@w>Y>~2C`%X6=LdsviL!hMT$ zRQ;ec;J@@)+KvB+Wl`3=tZB_$Vb1IHc%iLm3?V7PVQ}}0;zN@5s?oyM$xqq21*ZY< zcjICBB2vll`GmP;48ld44+Dqeb;sr8;_3Os{l@8!DYteeb>^ROPFlN-JYTqL-IIU2 z%)?*!pSmsp=c>vx`uAb@>>EL~AUFMjlLuUYWUQ>p`#+xXv}I7aJ7o`o)q>;W`Gz!C z9fkqbrEAe{10%1tl(h|6*UMw3VrI%X*NsWB`5T!eI;ULoZ-VL~^W=En5344Vw0hXs zE*MoDMy0l4Jjq)i+Rc$}ay4V}Dvs#d7@KO5ZF36bS3bZ_4ps(Vmo{~*X<1lesr;Bo z8?D#HXY0R^OCyr&f2uK=G-C#rfFOX$5R#GqPAUWNYH~o>xxN8vbQRgBhr8=)r_;~g zvax?R%F!3UVnV{3uh8O&iNz=w%U@lWXbuB&S9j}PU9po1wJANu`vCZWh%LMd*`R+a+txf41TtG^>Q> zFl4x1{?p@nJ3_L@;-KEzzZ*+^vL|_i{$V2BY4d@FgT}<6**qS$d0>gluW7~~Q-t4C zq!$|PJ}TwhUhL}?sn)*)qDd5`R7&qlQwoXrwIChC7!uj$niP5{Ur!YDeDyjus^g3A zrOAzV?p2$aJ|DTW>c^U$#;LVP^Li+r<6weKH`sty2>NiTEgf9cRVu`pt`vN^0NnP~ zunL(`ek%DMjI4vHsgV6%pIVa8={GR+(ulZt)_J|MvT}p23jZg{jc>QYnq{Yi_Suf= zgzd_PZ(u`yp%Z#DW0+p?B^ue!Zw?j)rZAtji=*H7`hmmj>%2JJKSA5yhyL@;?6WkYZVvQN*cXTTO)~P>0E|!=_^`=v#$Ct&QdOfPK&E>Lem+UpoJjj! zz?-;ARhFQ36?9 zCB;8kkI7Qg=f(Y4hAMd->q^1oX=G31`02Nd<5$5b#iummE7<#CjX>w=*+J8x9AKA{ z-ho(A(uq3ir`=Ss>dVl(ySpv$h|MU>=)~DD07pQ-hu5U@5I)OZ9b=XMZocKbNB zkBfir685|t&fgQ}W2e^URm>GWhR7RGfXnWjjQ{@I} zlr`!^V>j4>-z5ejsBDnW$bbyvOgB%$28Gat%2fKLq*S-q=;h?kDO{b4Y!_RmEA^F;P=?U8KY7BEUf>`;8P?cO=^jG6DGO@9BJ z{6A=)o|b7PWc~}VkYTgK6o0}~$H0YTj>MGVzz0s3i=GbbdH)Qy8w4;y`&>2&RLVpt zZ&*`cZVm)4=<3gdc-~^PLa14i$!uZH7khmxfx^PV1>l}ESKin<>ZhH<_lRo@0>H&7 z)Bg$-e?pIcXAvXc^K2hnrcY3AcgHZekFD7+^9>mhAgH6{+i=^c#)SSIv+h?q z9P6e5$b@Fmh1zX=z_B9a)XmA{7iThIOzOX%c3zT1z1EBcblD|40E?{Gr0Fy;GmVmI zJgQ}5p3foSAZ@4(Yo<+fbV$Gg4JG1nY~Ow^N%b@M|CkdvU!Tc2yI!v+hsp+@uGIEr9pQ`*WmU;}&lxg*w+8L~XSuKc9g%-u2>9RakZ`ZHniB!6EChm{jVY}r`!Hdo zJjtZ!I*|2?2d2IHGto$%et00?^G>H$(Kb5kod4qi;JoT7NH|Y_$Jfn&{5zK4q?f0) zJt%rh0IV_w0+9M|0B};nnKPj%E^>IH=f~yI`f)f7cyl~IctgFQCL`;R|4OiK-?55& zf0n(8zAjaW01}{{%<5yFmKqY}Dt346m{%XjIP+W1C3ea0(btP2c#O7l|BnyzgZ_D6 z5_S_$4%^@Hv|{i=!e=XIHUUj&XF%OT6+)~tnGC)Zd;trM99!k??oQAC3KXoRhCyA1 zkFFg=Ve4laEXQc(F9a7LAo4ihfM72 z={-=R90>~pX>C)a9o2VX)aU;9Hy%Ml9P}nRfSWw?ww{8;h8a}KkwEA}Oh+-RE`T$MVEVWEw>;(}g#4fL(aqJ(XGFE1~J zVihJLhFoyfXSMc!eB3QG#*`B*PMcim^dXE+N3?faAt2Nr1MaLeuV06D>gbGkGU5WH zHb|>%o%Y|?!6&K%LWF9)9_0R{w^S(k$!zB0GKE9Q>=BIh-M*GqR*c{KRTF^!YL%ov z52%B_oXnT?0o~fKnN=a9|5*xGub(@BL4NlFl7ghW6R<6;uUx2qL{gy;TT(BFMu4*c zSnl-qi)Xnzd^>gf&RxiUPQ`_|hDVB;49eDYoaA~j`4bd>mvF0OyA}C2;NmI|_Pqj7 z{qgkzzG(|vVeE?;05cui8qHFr3DG|Su9vysYNxA{s+iV)XMk1Evt|e(VPRts44Y}9 zBsG3n6$OhQz2)|xN#UEw3vbw`1hl|%sWq3Y&TK{qEJHGClgt!C4l9y4dQCO`%Am;N zfA)tmbStqT9_83FnGC^e6NPok**IX$ZRA4C@P%~ zZyXWywgdii2?(6QfnyuAU2BfFe+K1Qo)4iP^bket5`Pq{R>_%d4mq7&(UjcZ6STy> zc7GlCcz>BxDdg4hlGEi*G zF&-DUB|>r1XEMoM8wf$;Yf$<3%=)h+P%yWI$i$krhT&yB^0wfxprLc#ET;9+Eb^B5}%$Y}8 z2u1DOEHIGRnXlm8U#v<1j*VwR=c_&LqTsmCY`upW&+PO_3eQu_TxwI}NIqC<64T_{ ze`ngNzN17@vE41DobjiC%7F#^>`POp) z7bD|!cbzh^MHm3Yfp-9Q{suB-InaMO<6}2dX+W7p+^gg$l8Eg~;s5(3bT^JlzzG|@ zK6A5kV2CDcZ7i8Z9`~p5O5!q#}DJ61c*&9ne z7Q8oO0I7Rp5k(^}`jy?#zl-lKzV^NxV}(#SVZH&v=p=jC>GWisj>UCt^ELh{UDB^Q zX@~Tvu&-j03DIvEa-r6rQi*1-b_#>o+stS`9PC-zK|Z68hZ(&KQx zA&aM4wkbJRJ@09EfVN);<^Fi|Vx3wRyc9;CysYstq`SlMeDt^t;=xz`% zzIhbPmCjo)Th2N!^AIAoNvV!eZr<9K%7+GD8QRYAu2%jYRCmu_x;)6L&=Wl}cRAk@ z?~7?$tEJq#zDH5YjiWvP+Fy|x0*~d~Wm|?pB_-STAUttsmEE&i)?_cwPVozn?mstQ zNun0y|BTr*=+A-~(bZKi_&mt|ak{4m9%dR$uMgz@DBmEUPewy=tBiXihmC-;{u+2* z@8m++3aV8)J~xL$%37Wx9?c!8p{*1OzA~~%Sv&<1cghl$u0JSg4POo=GLdVxxlg88 z-TvzZkZSNozo@3!x47#ICiT&gpvg0bpZXIKE;&-EUk}ZFACDe%B?QfVYdK9JRfKdc zUZoAqnz<7k`d?+gUrF-F7{KES8iJq4NZP#W(&EH=JVyKBojhQt1IyeQojXlN1p zL=pRtjCe>Er)aE?8849bmel*k>?V}MES0Gt>2SKQPku4hsy3-P6Lb84 zP{Y@aJeKP*+``nfUpUmt{QFbM{z!!FQUY%chjMf~MaO-Qvwq=z``8pwFr>~}AXZ0T z{bl^6fzEuC`}~PdpYe}CH@1|M^SpHTPg1?-g$R_eW7H@`Sz-~T;Esc#o4DVb;>h6D4R&%4DpTguT_w*62P?Owo77c7ZMHGT_Fw%}b3N7iT# z@n@%7jfS}B4)ZX&4pyYy+YzKyr;OB+3myc$OA+GTDAgMot@5xX zQ;{tym_8ll!nL9SiS(=luw|sR%KOY*DYa@fx+cL+pYKd<a_n3YESC}7#JIi8jQaZ-x?y@0cg0To#*mwFqNA&Z)gx%rHbpulS8XWn{?n6 z*Y?0A`ZK;vfAuMhkdwLJq>&qtzWdw40cwMTZ+M}<6d)^ANJ96hoAGVivH@9LB zpY^B^jda>szuXyx*pz?SSIb8GXsjsBTog+X8P+46!qV4mZ>~NXokQm;#Mb&u-2P7h z;+padv(y7AUH{wB(QgB-rOPkcv`l)j67VYHT_(_aWr{^pW8f0ytp$hIn@6Crp7PC= zHCig4n^Kr^NZ~4yQ|M=RH_7Qvw#Qx@*AgFfE5%fW>b%E$2JU;CQ_B1MOXze${O;Hy z4a;;-cDnC-mulf~&zDG_b?qMVI*g2qNqZ~ujn|T+>QAiSSz$ooO)EH@+hTNIxc=0;=H6bNZ`v6Cp6fblRN zZ-frOGQ*uuqY5liERqDAQ!0Y(>>0yWb^rDC zY*Cl$buynD7oV1hpGzVd^R1urZ)aG{ovW=%hr{%K`L|=qm!Ug!vA<-RcObfeY;Sm$ zJ5A3(m&1YxnJby}X@{Ig1)t3fTmT=M30jyctXn-EA6#9*Rqhj2hSKphnVFdrpo6xR zs9zluM<7V@Gv-M;h|sw6KX0VOY^|y&Zoozq@tO6D^-NY^Krz&ZuWRqfFF1?^2O$e%+3VjlE}bulHAD}=^?B^A#TwU0 zH}>l$po_dUS{*u0cVF`>o7>C0j+vHQ2Px9=!W{VIvThepXH+^J9R3A4vGI||G4DL( zpw$gl(xwr_;<_j*3oW3ye6;iUknr)4d2P(9e;S#P>lc*Yoo!bzmfkzDM%$>Edp7CV zCk4jw4dAwB|8iU5@UMd&_&m}!2GY8NbMaUgv)h?1IU0Q>UupqW3q)k1bc8*?`X)+@HNj>STxm91ph;JP)zRV@3PG=#1?lp zKH3V7t8I@b>x07B=DtQO{5|+nXi|`O`AXP;Jg3bbzZN9Gh2`Pipg&$QX{g0e=_42>Rqx7YSsnD9gv|^wuX14EB z^U$_+FRtUM029#5Nbp}IA$O0#TQ^$3Eo67s9Ln8ZlsJ8AS_nwx+$-n3-bBz74#Soe zEMC&g2o=3psZ}`4&v5QAI>H0`le}{XQ6LWAFKRzXmat7m^_bAj5U323_44L0Y z<}#($n~qD?#$kT8vhhrR^U3Y4M82iPD|F*;s8NMGRBRwB4>m ztQ?(82yy<6mdspMy6nLu9s`&+HzwhW25MR@&S5uagpw^TcC43J`j1#0OKZb*=XhfU>V_EpSHn@0X8MIr4%9NcC zunll(uVm?yk5~FE$lm#l8@a5xauvfIx!X^L66tTx|y_>cW zTC-T>f>1ZdQBnS4SS7&nXM+Ng{FaAS83*<~0T;&@9r~P?SDEb0iQ zL*m^VD|ZcSU-g4u4ft+s)^Kh0%MWmIF8%#K&*vN3-Uz+vvEvT2;-{Vhk>6f9O>KCH zqsnK9tB39m&h^IF!Q+BMLrNyaF{(0mLjUcnng%p=}__3)HO;qt8@u65wd?7#hyO~Bi zy1bO{^|&_BU^md0TI?0LdG#lcLxBkIPI#X_RWvL>GM2H-|OI;WbcLYcS^?0HT8B3B+utOXqF70@hIs14c@3AfL`?(>%^D?k*j zSmor43@Kw$tBfu+(YhkQQ(DQ|;(S^R%zM-+nZM|i;_(#A7u6h@mKT2>Av5Y|PYv#$ z{p|{IL!gQm(7uSbyT`U6aM5HR(XcPz{rGSZ$6DWmC2hg2BXPTM5=ZAe+M2M@%Hyyd z^KQ6Betyi8T0sruQbOU%>d*jU>D5DAMs-)AlR_&XE$H_MZa$nY<%=kOu4<@-DhomM z*5jceol-KTTd8}YiB~$p+vYKEr`^TV>3+km-i9zUwoRixky83@{=j_b-Yw0d@G|Dx zJA_kCP-R?SCp;hW*}^5m-~Sc^`B!Q`BKAtCGz>xy0Y+g(71nExc-UHCdO-Q@=8mx1 z0!UN{K6Oab*~+ntdf`W3AI>AMY^63fj`nv?OwpgMJZyKX5&ZeUDnS9bvU6E2KYOEE zDdI$&kn@k6HWOm>PfZgD#9rN05`Pl?VT@iCW(3lnq7rYtQcRcCpV5zlb!6Jt;pq-z zBbiaijP9J)sB#@!n5H;3LbVj~da9PM18L7kd(!2AGqN^Z$(=yhipvFFyPk@cXvp4HzEiK(%ncYjg)jscY{bt zN_RI%mvl;ZcgJ3+&-*^#*fI7P{*fE*YhAV0Tyq}tJn8+QkLnNDNnj2@Mts=8Y+@Mj zK+@5Jb!DK=SE_KP9NUfw{dpmjw!fnjG2cn^;d%H3r^U_NgDHhJK^ArgMK*cWQNQhCR;>L#7SOamw-1+_H_arMKs$+3d1 z`qQ1FUp|M@v+f8K07cUubd6o9qyAOr_BD?2W1~7UAN2* zdZU#l%P`4l+G8VW1U$0qNLr zy**U|fPsE)c6KG-s=3Y}Rq9@H!~$|#5AawkuPq@uT&cGxPN=u?Bv7?>p$A#!=r{|1 z&6p9p<8P=9f46LQ7qWfPvboW9!JomCswI6gdbUuEV$+Zq?<0YZ3OF1v6@H9p<=;oa z#7rN-$CRd7MoA$)hBsNfy}i%j7k0@%OZTa;n^ysj9p4n@>??V4Zh+PY9=jtH9|R&X z=g$~%qOeypEi(c9udhsh?MFu__J-G@{f;0u7F5u2#_n zkI$0Tt#T9JlyJ^FzrD|^ac5D~j4mFb?fxB_7#r*8o86PaKYJ8&LNY9W-6(YT^Xv}r zyUjr9)MYRzd^m-jtAB_%$Ep>9Eo|N#E@tgi)o*#98Grx%Q}^gB@%TO7wkt<-X7(5U z?VD)N6mchJ$i65O-E6QUA1Og!h#EYC3sCfm=yPT( zEktu-DXho2c0O_pyfhXD3C1ORAG@|3h1i(}#LpR}so}0mpKz!_HPsI!ar=5F!E!Vb z62YTXtV1aIg$!CcnKRlbBK4RRSS@kLp3n5{-3za&@b#x6Ht3KJk%SMx-_KWDJ@{fa zhT=_Ze8Y{f^^XcH` z_6m9t3(N$<1W$W%8XX&g?ovZ>b_=elf3s#gd*d!osv%aEzmP^tU(LF?nFCW0gD^;& z!^KxwPnh1b=)NQ5=)-ljW%}T*k~JCLM*TFQ|06F1SB%=>F6wc2vwsS zKSDd2)ol}*z89*(*RAGAkP(y5wZ_~UTh7R|ZD?D;3{nL{ObTT(qcixX4kG*N1@}HB zOnxIKYVrl3E`BW7k6&#}#POM0(dd~jOX}#|`yLxhhRzv)cE17w=4%*EQ&;apowE(d zW5}vxk~JDEemtP@2RZgqiqk{IlDPhdQMZ?-Ya7)}HQzmZ>k{`HIkWhh*fHeKfk;VifvM%6WIgfpnZ*|Dw|Dsoy4AKDjN9|& z3-CDua9{M{V86HHG=EgU__XLic;SmSrPF%!xS@Gtq{?q0Pvy>}nB`1V#7efzGVXRm zsKLx+V>3P97*g>tm|UMd=TSOb^e?PT1!w!fzqoH=vnSm!f@_CC1R#xz}+cjT&C zOC4UDv}(Q+100!h?;!%e*yd;s^4Y;cs#q9-1Sk}A}wfNo` zRWPrzP&;4=(O|^}=85Y!b7{{XVs{FUm9!@5miZQVrCk~@56s&S>MZvcf3EIh;^WNV zt*7Ahp`i>U03X@@3j&+92p9C^Eu=EPpSqxe&P8cHq(6)C4s_6EaHR1!5AA)CUTDUw z4!I*qu1u!&bQTMMu_3C_2Mdd(KGh;Xm8ggQ!mIKODe^?W2wx ztY36g)>LO)!0X0^${PirocY+9`&op@@PRreSou67VTG`!*>r4-8u0MlKHstthigu5 znH?Vh2F33B)WrFq@#2xG;eUvvc#G9RjYufqtdym9tUAnpE+;1!!9hEX1^F27d8v^s z_Fj%$bAmdm{Ig$SU6~V;-JfpJA8Wgks;ih&AflH=sW8XgQV9KV08~rlf_y5Z5GUFp zARvxpNC*N1u7zWTD7cwnVKY@%S_ipC?qeoFLka6qXsZErgt~2Vx0*Wx$92PS%mh%k~K*K?) z*6nS6k}n;DFfI5AkBSKG_Ib}=l)=YS9(J=N^w6_VAq$SwoSf_}NdZ}mrrZRnVPk4) zYM*v@Oi%5rw4#L+sxN(9wkv`27@u&01WL}a*32@WyGn8i-qqye*^0~QNKP%)7%(~< zBSA*I1${8}7s z;)jUhS=HkdG**w)`3 zugnK@YRxM8rE;LLr6^9KS=tCdzTRjmu^~RV6YW7ZeT4-4*0ytSF$Al4RFvrY^J<&sp%t6X3>s{kD zo1hPNA$>7^wlnEOZ1_SD8XhY|{*5TOH&`hBoFt0;%2z?3x+eL;aNCRvg-rs(bNn!U zh9P5$udNs~P*%yn_aTT2wQ=I@N51*|ALIoB{P_2O{755yGBa5JM4=V~2DUPfRNBz< z)j~S0nv&0Ss}W#s{_{L8hO_{wqs@3-_oY#gt$Ym)hp}kyqu}FjCM5J^4`8Af|5Rg0 z{ZW0F0ll#+T??Ftsn^PFCn$Ly!PCd@YKev+G0(6!gzz!1z#JTozNWCi{CkAI1NuER zZlW_+Y~&OD0Pbu-c`AjHE1jV$DeHal;gT`bsCPPjvH!dzt_hxT#bAq<2`hHMz1Lpnb zgntj`&>qrHxe2@^qs!A{#k#3r1`&m!+R4@1pyz#o|IZ+ny;{a{6{Q^*G%Bb=3Hjpo z=NtQY#?QQfn$wOl9`m~=+KtY!vE{svDa?NuIg%6sN`*4A|M%fZSPPEFC)!_KQquf$ zEFYm=R3Sz=AJk7u=4&RtQdqUS0f_{EU!8w$D)?ob=qCstm*%{W(ik7^Zg|_*82S!KFPTug47lU!i>lXWXdSIZ_-67CvO^jBLg8 zmm&|&+#ZyBT*W}aqW^5CLrzNGXX&!_kn_}Wf4~ekDP~uKQF~;~I8gttl@R|rv;Q$R zM_jLeAw;JjQr?~@#BV(6#IN`Z7t$F4M{e1_6p^F)fk8FjeCBG9HmkzdKd0yENv*r) z@~@}wzXv11dwkE?(|RcWTz(WQDDd@W$4};}t%yl~90IopM_4Phm`BRT(b2J>y7b5C zaSW?{o?7uFA*P`7X#fv}bmAD{IDYz|N38fJnDS{vdolcs!|U;^ALiX8Q*J3F-(l&` zYF`8uJ2#%)T<;!@UJBD*U_zD(x0Lj%`apR?$2ke|^a!BP4QbK-T^xuh4-c0_;tJPE z9rhQRhpyar^-AqSyA53`44ePnGDxpWgxO7a*R1eABVQzfl%o`$t^>~6-q_|q-;;aD zEd6z$6xW!f+9(ng9V#lS%pi&L^(hTSZ-h@&w#51)7Hs#5oD-Cs56b-R6KkY*2f`C()0)~!)4JG9S#w#rP`F;jeHpxcymeZH5EJPKU7!2+l?R$-#3GKfUL z9U&Rd$N)^*-~53BhhPc#+`Y@*_oRntj_@zgnCZN2A=JYkFscyv$o)Ke60FF@NDlkr z^@m4surgNL$k+O-U@>lvms{Q3Kp!^?wG)itQ}7YeLc83`Nxl5^2s||Cfn1shaPFn> z@bH-V2Y8T)$7MDA=!_IofB989wwJ99No4D(`g@|tVG}BWT_}F!eh#Nzwm{f<3>pQ; z%8h)LbeEG04$7eg>|%hNdIf!q=bxwxTY%r(L&?(#+WCDkpPCP+L;L#qfp&uU8Y*DO z92`COw8$Wu?KjA~Px|p}o5RT3S(gUXGM**#I%GWIxWxV09PeWJ-E?o%0mXiQDkZiU z2xX?rXLOCq&VHhPisJ$JBsS$drD3~+y;+ZJP|6&+g2&z*Fjf9;mAX&sAZAln{7m5= zh73!TCFJ8{OZP;9_E20IhnZ4_rFOj>XfD|7jm;keN#<-${jB?0`|r{_SXehDEcP=} zGZynE=Y83fz@~22YI;90K7{G(}T9Dc@s(2fSgiBeVF1~ zF!AmCTr6^c73ITk*lIaJ=(4ss*X5$A!gX3zzV4(@vpN@K(u~jYvgGR+X{ng5ooN_! zOM}*3SwaER`XioEvni?xq?U~gGW^cAR*?40W$5qjZ;095mzB=&-Q#Fg=w+W?pRx8d z^~D$eJd8{o1^k;FNdBr-VavUx3409J$XCnCy#tY{e}?4E`G}*>Y%;)6oIZDBp|$$3 zfPJ#!$ar{v6bHFR7xMDxVlkHjbl3`V1=f<l_^-otp>(mx)_UrMO*j#BHigA z->d$XiqSq5@Df*cU{Bz$>*zYSO-|HSos(`=l&81r{)l&Js+tKYzTsP0G3jbWr}zEP zpPF>Fpwn*_?1ZR^bStfioRsr1vbl3 zKj*&trWzCVi69h*Cr&I3Cll(nFJ@zH4kH`mD~DMV?#>JFjEmt5w{M=Xv~Nw1eqcB5 zev{a|NN4(>XI7Vn(FqgG&SqG))wHF&`9c$#i5w_-l>vuKsV{94xq_w0&9Momue{7F zQ>cA!eLI-oC<#l$4uY=^yt#S}_e;h-93}juj()%jR%ll*Zf&t@dsy{9Sn@+O z49~dS9JBCN+LCI&1eXRFyI`y_&L)i*h9(JxGGt#iwSMNvGukS{T5p36 z_NW!gKmuo^2R^U;zKkzCb|ytIc1eN7AM{LYe69X?7&0vx(ZR>Uhcu=)e|%e9Wd{^;(-OI{FGlr*K{i#sP&CZ*TAHP&Blqs5)6 z2dOo}bcP}rR4gGyR{A6vJ49P+C~5}8$8JAUvX^*RahNoOU7r&R)5UmUy5|Gz?>*^* z_xS5GK>O)1J@DFXzC-r_8OK~;N6fzj8dCn2{1!zaCy|J=8_S#0PWT+q`kQUyn8b_S zFG-DPl{Pz~Ep~Z8gFR&keii}gy*PGkdwVtA11b13 z!lpqd_q3M5xB(jlXealN1fq0@a9H%4XROl`2L5DttTX6q>?z5$WWQ7%LK=_{-pJWF zlDT{wKOj%Ztl>($^0&9 z;>h`ofb9}eyYlN~7fGDgJvSu}@WU*GX}G*}{~K z@B1>Ke?|SGTDqdh&OQfDts4UeTFh#8vVD20dWsJh+|?#*4{hu7P$K68s6`0BBG zM2`>#`kVBkOs*ZJ;`H(?abzoy!a@SZBt%`V7aqz+UvgRHSsy@iR*f7V{N)7&nI2He zl-lAtS2d|7K`DQ604mK><6c0-DiKN~1Z(&CpA(T<0@drSi_N{Lg%wR(3kxj?bN@@;eYJH4`!UBiw}) ze`U7D8!u8$?#-<=c#ZS}O{WBum<;02 zz(z)r3<3E0t=kRaH{^M%{%2M$%GxvNpDy+nXzW(r8og)gc4fyM4l&HXRFGj3clq~g3-m$#JZDnzP-CxaJ~J}6Rp&sCa=@=7(y(a*=}>k z6pO-PE9mf)OLrOAuANQNeY8ip^;hoxK5jNa2kpo<@37QH(FQN!AC`(Xqj@)w2PIlz z-+JO{(+rb8 z30Jl4$S+#^qR_dl7MOf!Y({Q)rODRsqL$*1mh5Mwj&Z7bxLeH-0(%>D(D7uP$l6( zHCohBv{9!M0zF0+Uktw}tWM>QAThs)t{(T^UOb(`599R^+h-?zdU&oYj@CwYeizR` z-1lZmtjl%vJJ=+qh`&1x-0&NmD12DIrO5$X%}T!|#s(ui>JB;tkBIZN9E+Fb5cHI$ zpuP~2rxMC;CybE|+7oOHvtZ7OCMz|q!rD+YSJ-gmUU7z}GRKM#Vl&>tRVw>Qeu;tD z4%_3?jqtz;PE{FB`A3Kar9|{Enuv71q!!u}eaaXgpAcM_MFt}b5eTV%B{8Yf3%hQ> zxk|+8T9JtCBn-ge?Anv2OzE#x3ePzN1wJmK*em63s}yUrb-vAS((IG`NhS)X*{_`X z(!(n)#(K*f2kPk`5`W>JMBvMO2Fvdzx~c*=5s%k zK$9`>vkfO-KZQ%$)IjX?m9BvX!rql>5sXl}1K6XFb}>xCLkv+qcJo66b8q)4`PLU} z3mZeDNz^`GwQ=AXn0Ud%6hcPubGSc>y!drUSA1TjgP2;%H^UWUQ7YqtTl7Ah<3 ze6khI5MK9_*Inw_4dUM%MSKT-jGP^yh?uEX1^as(Hg3kTh-TetrJPBu_)3m`>@u;$FrT?VIH@FZBSdRE%OM zy523jE-oySqF5hJwEpsCp1P&kYHg=unba2rg3$CJyp1+;$||_FeexKCQOe&0pt5n- zIBkR82P7+F*?Vmz8jF9w9^d@-FvYuewKFc7^FlnDv@SWU+zUsF&bFsx2~A7LC89EE z(N-MjMT)g*vpcPs@_80U__=_F0hOa9yQ#xoUg2(?wiO_aV{ayVP`oFWdT8ywjKMw7O;! zAxTP;bC6G;Qe1fYk-jBe%z%nmQTE5H5=%R2);Qo=5OmsR_qY40laug+9>@t^(QrO^XhnjMyj2gk{C9(IU6doDqn;AN;m2aBZEU>R7j&@wUuR!eoEWmx)^U$eYFR z<4ZR@|Bpqg4+1kcU4m8jtb~Whv7mi8(K&#*9c*Veezw6h=f;*rQ@tEY<$KriWKG&F zmesJkg~_x=&9Dsi+i#j30*a(-X#lc=4sIl5Gor5B>Rzv2rGfZ?blj7XImlZd>&g}- z84|09*``dU=i_g{aALBv6D_XgaKbB=b;j31o21-YmfHPfqpz<%@+l$3fXCe`;+d`n zM`R)959b9S&!z7E()~8Uwr=N6jf@`yAuscF>XZ4vQy2MDvq-w%SrqHHPk40fzw7Pr z?c5em+*nwM90hqFvBHHo+d1uxqY?DL%vv?*L;|r6nen_y1D?|5qPbQHX6CbLlm@mB%WJPi zvEerSZ?yXLyGl;5DC;xJt%as{@scFzo^S z&oPw-1*vg|J){`PfA}(Cf9y`;DHnnI7sZMa48^)eD+=T<^A{7!A)Q>cXx=S(Wjs%g zAclbsZ8!+nO@lv9OT?zuT>7KHr-g1aV|OqyeG81N@}3?*teQP&htkK-8m_Yv~AR_P=KFAZ@e9WQxwmS5s@h2aWFiOya5 ze9Hal_t`%rvqI8uItb0Ejv9{cFwZUBu$hs$sSW3uSRXg#v21kY-{#{QVUiD5Ha-N! zRd8XV)g<0}xeCQcYdEQ7$UNzyn^DYqWI6+d3M+1R<64|?cY5uVVe1zwam3u1NrICT zta{!)SoOrY%sn`&WFbeWv0v?%FXc^jxIHtJlLT(GWHhx5tCr%)pNs2_)T2bg25BbK zO7eZ$TzMF=9cK>-aeY1|I*VZGY2a9J|lX{tVqlikLYe~uVm8z3J7Ohgm%C1MV`%`~g zPiU);J4m~TAkBky{$G7PE(qcNVf*tLSm-U>Sbxl*woNP_pQ-Q5JH&#w*s_`T|H$jP zloYW6>#R(wM3$`}t?w|1&yRXkco;8sjjV{94pT zz=H4z^%bmGXWhF3b@_qRA%&BLH^fh#=5I+3syb(og^Qdy4aR{LWSv?Or+vGW)$lw; zz~yQL6hKbYu<@BCJLeb;YjZGx0K*J=^f?>^G37s+dnK=5eb*}xp~=7CX^RGKNr@m? zg?!Jvb-h=e@5HLCJNjJ@d`d7 z9EJ5yo`oisJxAPbH_U0=Awh|J+j)(SdXzxrWi22~Ao6pDF3&mG`-Vc2zywwqv>CFe zc`$ANazJTR$s+?z-@3jM<|fDIEX{`;nC%af4-F=Zh)`DQj*~I@a>|WQLb93OOH&X! z!}4FBZ^p&4wzU56_aJn-qA^;!j)AR|YQ9XkwSs7~- zoibz{PY?*H_NwOCz%<@5D!Y{KcKh{s9MEvgMiw?gMitDGwh+;`Sr>6O6k8EP{>0ei&|lQfuVHgZFx zJ|Z8RL|zL@y+fGxf>=q?I#TxjI=HX15q;f}IWLPF(55GW?B4r6eKiqs4+fhS)qI`! z+ZZZ3o1I0$+3E*j_~vWB9nfg$DTaXGeE_{itCZ2`@{l>y6|!i6b1L(NKW?Jv#tU-< zol-i(M6v5De~dY&)Th6yII3ul0wSCms&%}|{SmP@{&MYV;zf@{p*ikSn2MiBKnm2= zEO6*nu{1?aO5|Y9Zg}HmG@sV1Y&M!t5kyBmBROcfa%}Agoif#>&&;$NBK|1_h#h|1V0=1Z=e(Mb{OL#eED_RD3-K=Y1{P*@hf#kX1}Bt9?wz; z2IQN1Mb&{yOSsv#i^+#d(95bn!;Si&6x3r6>?g2K zru2*hdnw?>NickbCswATY57@>$8?%p$0ryN8kt%%0&;dQf?r+#Ti5Rjziz4Y7q?nz zJF5VoMoP6S-=4L4KZ%2z(0ip_rzYd<<$34|5x84I_JodHsuPftYHQJqdBSi_2E0!t zI$3Z{@)vnmL&}NNmM@+{qnA_#UD=mhcC?Jv^}~G;4u}qi+#w?zUAX2~tv;#`yV19q z)@iktnkmw$9E+*P+*sxso+lMVT7WI2~?xf?J4_QAX(By^BATyeYn;11S`q&@!^*$}s z+WJ3G?%svY)^$?f9CE>DADxAvD+{I3ohe$ci{E*&KUL|m6{(3{FY9t8^a!sBk3%ng1+~{MP+*jC z`;}JNa9?xBrK`%kqUdGbESaVSI$L@OyA{oh|3Ug$ef$+qN`?Ckr#qWM z*Y<+B>)FDzm5^&CUEM`T0%G$(%C$SnFL#%1`v?}Cml}P#r_T>0r>x#S>k{)g`sL4p z(fLp%Y2NozHd1%d+X2RQAE&vEZ|XX^4XgV5K3m;w*?xG2gUF7pfc@<3YS|dR?mt=p z-i;fc7@857Rqh_U+AAhEZc8`YCPOc>_c~mV+`}zGU$Ml4k@sRZjV63m7LiujtaJ9b z-Pcvkon0(3G-D)KVCXlRy1r?>1CzEj!S;4z;ZVC()RkL*bzxW4#N^D3P9^7$frkXZd{;?FGDG6l8UBPt#p(v9jLo`Hs=7ImwXK()9fuuE7zDR^?TtT8v6vW(d!%IPgU_Et+)N4(M3#`kf_B)Ny>j$+~6sHxY0z4{WnLYCaK z*2Lvx^xRNmBr~k5pbF>RKKH1HPIXlnA0CzXJk$0?g+1|ZIT77gE6s3=y>Y#YJJ8TF zgC6;q20+Py+Rlq``@$yf_bFf$AAj@x0hbxU%0vu}cF2lLL9$$6d&z0E^DhLV&gp~_@h=3SGCY4} zAEEO{v_uF4Tx5HUcRjhkZ#L;WW5@tIL!uFRIz4R*_TzJ2x^7(nKNK&}1$u9R^3i~5G`*(YS^+%$w_psKwy(U$KLCyR zgI41|Qc5roY>+I;4V`C$aFi&h$2f1vu>@KJPod`JD$-l{&%ATa-(GZlUr7FL<9kuN zuc%baF>=M4Yo3|2RBzFfBEScZ6n;1xx={a@Yv~g@yx1(*v^^b}zB+Ov=;bXr^jq+7 zp+CY8a(C`!E1g9Ca5MaJ6XmC_6~p|so9LiyWc2)X;aRA=Q^+xg)qKP5m(M>AfR_r5yaWlC;auc8?nCfus^zVQ& z9~M@|eo2s@ROb)YI5C=p??2K8&sb{tHC#^){K%)niYXFyH{tG-vMEWUG@{i=8M+(r3#u6}pPHnC-1Z~&iKE47H9yA= z5fb4KF4P-L;{V8`9i>CD0|>zWI#{GT7ZO>?A_$i#qdV-u5Q zkr?q|sncNuY&e)LAC>BGj5A2$cK}*OkB4Bk0j}MNAcEQpEvx@@dI-@um^gc%@kvH%gAu7>QxYTL|+=9iNzHA-SSFgAjptpM^A2z<~YoV zWXS4>$dJ7#r=t7OPYmf^&qA}u(5renph-D>WX?Rf!f?m(FyB*$5N{S)?I;eq8f!%61YM$IT@4m*cAZRRlz2%H|3aCV4NA?ew zo8^25uqlp#7%BUi^!AS|{uY#2D4ytezG@E8*ckn*JqH*)(G z0lFX@-|dEF2HEI6nbFz?>Dv6S8>RHNe4-HzlWdd#4@g!g!iOQD-w-``R^`d%%HK-| z!-MSQV?p1C8UeIumUC172l4a~8hbonj#xNC%}P^cJT6Ou3ufSb4AjN~zh9^n{e#Jp zKuJO20o4Y0Ec!IyF(K!NfXfZVf+X`-&2eJzuWZ8~9#t0~TV>c^5Rt1=@sZ>T(1b)a zY8So2tL|R2B$5)MEEc$2k{JEFhI&5{-gUN3&<-B#^?O_nACXlq^h206I-I{~YKPv& zi-M4^&6o;}e}3T-$}3$ocmxz1wt%?Z?m!-&0O+f4lmvbCX+SKx%tpl@1tZ@WohUfg zLvg-*Dh`qK2_)=(76uCV_DdXyFAe9V&l!LH?}V-z>LJb=-3-Hos*0>E=YQt^2%$C~ zSO$#Zs=U4=o)h@`Ujn6CRt83r$-HOq7oo+3z^?II42`0*`IKJfM`pC4@BHGcPdd94 zLl02u5dGkJn{AY?88`k0`v08cpXv4Y2|E&b`J_x5nw0(@KKo~p{O_IkyO(!_;_p2f zcf8CL{j(~N{J)vo-+zzeB?O|Tl}6m*Obn^Ipo*3#)(5q8} zA`a1rzDagHOhAYowtBAWpKRZpgwSd{-3Fxo}JE%@!|_TU^$f)Q+Rexv6Tamxy?*QM3M^(zR-BV*NsKL|iWJU;Sm&fGk{- z*}IR&s}hNzrbRaZRz!)`*47xHO*3jx?{>o}ohq1&Mk)2?pTG%3YcxehWx22ZuxlUL zybf(W6fgGOOs>j`)9rGAn4#iLc-_x!<+mAj+DbCNZF)W^9|4;l_>o_~elZX#patD- zq0tMA@tW={7S54Tevw- z`NCs6cy*LB&3X|J&1$jzLLvi;pLF00pKjBQd-gljfxZE}K257n!w2S*HsF<`Fc3_o z21<8vpyj1E4Z>|qjW)1p7l_CmFLh;9nD^%!>OZ(Qx@vINmBH@`8W|b~9y$MZW`~d^ z5xQD~mG!a*F7yFCP-&y4BLzkgl=?d3{hH5sOl;qsCLBe*)YUPWDoGi@Y$d+`bd3z` zR~6Lj9E)ayfy|*UkNa&V2BX%`J$ruK7*ACo5J?^U6F8su0Tb2LtBurnup;#VZa>px zH2ak%MkjfADu3)crtKRtqiKWKl50BFQAOqZjIQt(5DXmTP$$tj?#HV=27$6~mtmH+ zBzy~gImk@x@iE;DX~kFcpl#>bTgfTGeUM(07)P+x20SMd-@^<;YUu5o_~DH^2MWEm z?$Yxv#CxUa(nD&wIy;HRlC{dBUt^zO1)N+LTV8D)$yhZa8Xd0Dsji-Gv9aE49K295 z_ki#Iv7H?9m^r{@`{dm)Um0!K9ic-UJou1C?YE41)@ZvCRs=V{V&&i>3x`QdQvQB0 z0$8@b?UJ$T&cl2gV_sT)9Wwao^?4(}wa7sMH6FAd^Z~(6BhUdg((K{U1tb);^RXZe z<3XSc7gG*0aB*cuePVS|V$fJcx{LDp2ZvvSatwo_kBUD>=UAn|pMaSnka&Tw(JU?e z^pvIHv!iG=NB7WDU>@K67quUY3|kBS$eG%otB90;wdYv&RQQS;-FTVR>8!!!L=J|Y zyt&`)A*)C^OoD`;_?bOz>mJ$3#PN}uUF7S_njP6x9=hlpDP_qCkFy1~BHj9Z2i%u> zWg&!Y!ci||=o@d4MhvpT2qBqb+S)P(wdW@!$IFZ)`+Ou6GZ#EbS)E2UG|nA%=IJ8L zcgL=z)oWc#hk82~Q+(@B!c89hoX?kMJX{meCvI8 zwl{VsAX}-V5MxO@l+}YuMv#z0z;~_KlSI*S^X}SiOE_loDjnpeyOZlLl8}9!>m{Q7 z6q>ZYygSjOzwXo&FdFq!Zq@07heSUNQZE2_(H5*4wNB(nF7YY|#38F+B)M3x{D>2y zV0|0);-0RhU0v&Yc}B+5>agt4Z;YO}kfLfrcONEk)v9=~>shhjA!w)a}us(btk zdwt(PxU6(aTW|m+CwGQ-DT+bT)bMnwc_idwVX+UDjvadTyk|RGlEX?GLBQG0;b1;i zcb!2&g|wc+Y@&apN!!fA9#YSLTrAa{RcaDCKj9e?9_8Kj`H1E7y<;A{rHWGfS)?yH zzlpf5S*rj9+&S6v-CtCo_&B1H`(3vKZq4v4(cYP?**53gW^++bz1FmFbtqL;$6~&J zY5On)Ed(BmQJF4UhPp#T-sIP|@*d~J)+cA%qh;MJQ%sLOl>&WWCf7ipa8a%@BD4f2 zdPrt3Jw#*$M{fXDh5Umx4Wt;}Sd8|CxZ)@o!VHf#_fChGl456CM=U1c&g%(s59eQL zwzX5$>OO5zzZ^=;chYa0!$w~<%a*z)Y^vy0UI%J34l?nK+6r{Da62MBQCD=_K$aVG zixrnEiQqsyl4`IraNWZ3-W_ki9%g7y-a~d7ccx0nYOC<9O9QiD=_LL7LvxDgjKu6u z!K^p+L_w29#8z?7k)M)SUhYJh&w40lBNgC~K^H`J9R_)NS^9q}1eUMWM89f|kSj?( zgetrijNBg2e`eaX)Gl6WPlI&~v~+b6*)4Ipq3dfeH`JTE17!Wb{(`v^TUgEr7nkfp zvRDi5QM8{{lY^q0!YXc}UsKYB&h0ZJ1jd#$+jT9ylUdD-@jwr9%gp*0pTI&~r?du4 zf$MNM&w2H+_n{PLdWd?t$C1f2jF_G@c*+sYekFuM0gFxWZx=?+eL8Z<`tg~EApzoR zwb1Qj%ZL79pB-fHX)Xr$W9g+|MnI7&wXAo4(FXq7`_xbIapLv#EbgxDjUJ8fSPY(- zOzcwh9Miu}+HpNM$a>4V74HOJ=|3gnAJz>dLo=0f(VTZbU@d;-Sys%EeQRRBAFG-u z>3w;$w)@5Qc(O=fCVf1{`tlH!C%-eW(o`iL>{B;u-;M2nR_GC+9B49H=c`jw|9-$( zfEe-fH|Mi$?#|3?ncH)!Ma*7RYKr6)LO+#PP6s-N`A-%X@FsLG!@_)&&r2jUKhQU)7!mt*AMtk?7rP&FB{asY0nBsIIIc`NDVO;DqDc(yLuu?;4Q0 zmAJT$9i%`F^OfB)4MPjoaN+)G6uHYMR1WNr>u)l}4tvz!+aENl;?X*SO5{sc>fyI>kx@xv$ud3=a)?ZO}gzhXTw;Vj3jfh?U^3}D@6XhOT;R`|Aa{7Lm z_^XHa8T;!E(XuE37cI7lu(l@1k|mDzDh-KwOE`m}?p=4L+T`I&csRYifEfc6nIFA6 zyEv!COnRY^i=Bs}`sG5@w{}6!jvY`Jh$--;TL{AJqv=?WpUIc}{EUgWsP$QaJPQt^ z60=9z3TkD!`7|5{PBRTaKW(UW<YA;SpeVJDu7}Kake!2;A`lXRrr+^eFYT zkR~muH;#g0+LRv^ZNdzZ{5+jX*kvEs1G0_XRiCSM#gM*Q&h(T zle(Kt-^X1)^`Lc}F)%wc$l)$Fs8v^u0lz%=OOv>i9UuAdFXWxIyp?9#zEwBpgi7%K z{yjiW(J)@2NxwgU^`k5fKBlVe0C8SNbFM;86y(*3L@YKfjg=GMYL?hpg@WTvSn{!Z zs@L)GVe4_~Hs~X4ZtlN5(ljcFpW5OzDgt&dB$;NE&G5%a>@Lp7f4kG5TmFB zKaXeTM(D9`jYUs6DSe^hSjNT#`@<2k#I^G6M{$IU_I)%;nxW*EOruRHnS4J%f57w9jCVjj;v2^~o8Tw`_ za#%$wxh~aQnPO+Oy~Q4aCUX_OVd{wz(&=QR`}i@%bgG5&SY>OmmD`%v-1>?7$Bv7h z^RJ#E0ZGb;u_26Ip7CBfsg|}n&@%a80)fz~`^{BdTgDVqx5&AYRzX7jzD4?aYKW>Q z^edOWl(JR?r8HjSwuCN$^uv-s7?N=OB(LNIz1P|g@VOm7)JEP~Px4!ojR{qB-qOj~ zEPD{HRhom~xkUj-ip0#C2-f_FMlMY#rh7HZ$bI7CEau@SvIJ=IMS-r&85`0TIGp<# ziM+SW;b0`T#zT+R^24(l=>-c)XWO&#pQNi%$XV?+qSlTesrj#B2Xj0BQE70VRzfV>PP1J zRAqFR1PLuz1E8}I)Yst;5)xjNe-;#dAaD99*893Xhq$yWG+!@Y;a9S4V^i+ixyf<5 zcy7k6$qfO3pv0d~sO8I$*XDMb<5)f8N)0{wU*x@oS5;lx_ALks0)moCH_{;j(x7xp zY`Q_ZyBq25l92B1t_^}9A>AR(2BhJgT-SAf&;8u@_l@@t_{Ly3*x+EVwf03mjbUm1dVmS?y|G=QSZc>QSe712?OVvh3T4YWb8kzY3YwLUgXU4yzM zE`Rn^XDW1KfxDP|c9K?$*=ErS1KdeJ*uzXM=9e$ zO2y5QG-$5MmnWnAdEhmvr{~y)1ZNMnBCej^b4-CZ3b{zq@3hQ>AK?r`X5v^4B~s~} zf8isO^cCB%@2PoV-cO!2oZKB_Qr8Y?u=zxa4_6sVa%t-|qM6Aw%zJz_^;X(zbvr*Z zrD*V}kUW6RY#<*1AHchI6U-beqZ}%E&N`(wBYsG%ogklpEnmWMrNw?$)n%mP)}PX{RlNCB zCAt=v=_bc9hOVqlr3ysNR0GkNjLKzTYyC6fN7?ih)H8yB3*=n4`X2J%T?khh9BbzR zpG+18t7^j`Do`&;06z2sK>1e_)^$kvZOEW_E3zGT0Lv=PKVTKs7mmMEp8+j0A@V{E z(I0SFyP932+f(SAgMNC1b4e)?H?V=~loRr3o#jbZ-w7PnO5Xy{YO2%zc&9wJvkfzH zXm(bT#pJix4({Gi2eaQFWy%hH+=|ex)~g2bUo1g2kqx(;yD;gNL7qYj+q+(GVv07c| zt){7_*ODIhLpt&8Ny;3~dv9MYc@}OOS97IAa4n!fSFw>pRC3=!A3Z@{Oci3y)U1>0 zxOo?5&#dg9s_Q@YrZ6s_Do-q01Eh74dKEJ}loblVdCAJ)nRVekJ{eLjgrdZ6oG;x+ zrPSh!561N7DGhDTO4~?nGpW~d@btF`U4}dnnt5*s#afsG5VvHd9vpwl(IXwLmn1$( zf+QAI%ha_$X*(T$kH-t3-CZAILSt%D_yWHiyUBDyS5n}RFBQH?k%r<7D@*h}LUDj} zYBq0LVIxseA>b=hB(F1OHd3*+k!J1EwBHb;{w6MPRw?H2(oGScoLRDcl3tr5Q4v9O zRw>*$(Ks|mOJz=}`JAd;zu&i3N~RT^>N5uxHw}t%Mc)q9kMJDpt>!~x+K-opCVwQ% zJX8>>f&yTac|85J6_~)M?#pW)?p&~m3XacK&OG(GH=QnH0A>}6#WU|do0Ws^&W^Hd z%3E>Q^Mg{u{Sa)r^#!M;NxCIaLislOiR!u|(odQK4xLP{%=)!pm`bs~T_@$hn!ZG! zpw_G2HyVSw*)ME>Ll4?fi4SMN2r?0++Ff~L45eFbe-H?flyz;LUbuWos69U*{K+#5 zrK`b@4-w~+;G*SBlV+l?czi_q5|;l`%8@7H~V^Uu^+vLL476npmC5 zkSjg82t@X{@Ia{^_fH}ssGgbA zI2&PDlvdeR-okg|91?#WHe`Lxu=DX;8HV4JzIyZ#Z;{u;hg06h-^hMD3_ie)7HqgNlV3q;M8 zXbx`TYSkYycpR?EhZ2f^nTD^QCRek5{$c%!-!jgT8`Ui7&@1W9_mnn@Pwg3Hp?=IL zV8oQ4aA4&IOYabrf4_7Wt6O=ZH_NdkZig+<3KrzFe0#L24bFw`TrMs8<1=xw_p@+? zVP(gLaUPGWk}A{?t@}HD5wDjtjJWR~O%}CfF*vihq=QfkAKyCR>nY#mBVeyQ&4P}K zu6-Sty27I0_c<}HP$_@dzNRmd_)vi5^A8ei@>NrkVp*ucQzFZ#N5~)Gd_X~9pzc=1 zug60ggTHQB!y4H#Ap~`~`T22)z5c}TuhyvPbe z1rc;)f0Y`7wcz8l$A&VUs6nN{9sZ33N4%Ty`7^zi_xTW;HI$Knx4I+KGj=+@TQ3{F zzn*u0$6Bu5E~uJgIbP0SR z6erO`#u`bH;4@c}ISNNm>HZa{FhyYJB-+By?DO6QI;~J9V`%HjH$8Jz zsB>rMD#qCZYWsHs`$t5jkjgZz3jbK^-`p-scx3<~O!`I8&Y*rBp&?tAX83q)dE;i0lvQFs;mld7|-e^R=V>nYzw5~PyT6XeIcY_)n;S>KJ;p-OqmUbNY5 zm689^{xD&@)yWpaVfOwDK2t;lioPdtTXT8JAXFBw-e;XIb;~O=B~ZBws@}Ou2v#dC-H&-zx3cmihf+_*RLB~(|t8b}mD3CSjE%I8T~4(a_#tHuZ<)jp26JP2#u5{74|`qTy?BQK@dD##lx$h%SI4s+#+eN^UuufWWmD^uZ|shVJ8LT-SQA5P zujy0E>g$@V+L8UUT$}GHlh$I?PME{XYtZdT{yHc(@8UDoWDDp?jg?djTl6Dj@T9mP zg5z%7E^4r+!er9o2@3VtS{s=I8S^p2k_jd%chICUoxi7IPz3we*C>S!2UGa0-i>jdb1zpI;=)ERdne^I3)}n)wnl25a$W1p zNMmtOLn9Hv_*|gzr<1ajDSxU|&A<5)c;cfvy`ulCz6MHcEy*20&{`(Uhok(DuMgO8 zJ$7j2dhA6zJ7(v=l6pFWb50VT0wY*}68JrS`KL(tcd72b|84mq03^sQg-v`)D!a@6 zd;#9!f8VVCI*I@1Z2s#TpCiny4YP|^B4Wr$QhU3dU&s;GtA$qkBbh+%U)TVdD$ZZW z>Wz*m7E2XAT}NcY-_m#&OuqWP@o>8;R#8Sd<*XcSr^1=2t;nYtHSv* zgmzt}&TjV|`d&08c*s%SR8bV-F?h0M-v$wzpKgBF*KK~+NF$(`4OC2 zn`?)#4)%Ya;s5JTS~4HSmoMI<&cOfIY5mXV_wT<#ClS~ve#(QO?DK!Qp#QvG$2GFt z<<2dT;Q!w*fu)feVIA-0))w_c zr!DG)GtiEOG$6?M^V}f{kMNNHH2Bz~1fheGI#!?VFO(p&cS!6Itu? zdbj7wJbrXT2Q5nXk6JXglr&D%S&$;C7hH;~G!FYcz&JXj(3uSCzou+(LS2*ws@CU9 zIi-s%j)!A%*aW_zrHlHy(J0Cm)@`ktZe$9KoJ*rFb2~(&zf(CAUyNJOWpq{|o6H=P zRbRDcGe)y))|f>q%`HqOZ-K$)OO3&CA?X~z4UYi@c8JjqyHnyII4;lQ`p*>%n9e{! z<%>cxfgX0)elGz`cqoDYrC`Wxqg_4_FbY#iC6QF>^~T8ZU4D2;Ax2`e+A}uoxH~1i z+K1*W)i4UW43r>i&$a7fzkX?I+T$4H7v6y;aSTW+6$2r|zVk!)&;8@KKp4peXz(Wj zJCj|b1h8HQ*?M~?JgqCq)e#5CJkA$#t3~HNF4PU}@6C;ww3_H;Cq9U74ht^HlQO(8 z%&Jaem)wjpT5+JjphO_Sl}&$7x#W3Wib~9<0UGvHAXyE2;5$gl(Ha^d;Ib71v6j9Q zPyJpFY=GZBq{$ip_m?WGB|gn3jFz)Cg$6?j-=iNaE3fz-YD`{tm!j_-_h`86HscQ4 zu4T@#nRPz4XMtQ?wM}l;rkMu&-!TGxf`4)t#jei}6N$ZU}fuPD@>}7_Qd40hVKsydoO#wUpIvrv~3aOzNp#{Z@vX3^3gx2mUwD6=fitdcOTdOvXwHCu}J8`UfAleS)L%AKJOS zAvn(`?j!#MR>JcMl8|lWE&Lkx4hwP0P;w)a^b`ra;V2n)f?Pdz93^eqBG|in%71$r z3$DtCb9H98uttmlwb-sMF4n83-}r8*z;-|iUfIK$rUIm{kWH6sCju|G-L{+E@^(hx zLy0nu)DjA8Yp6kf^K__jX`d2R>;kvZ?bVs!rX_h3I%tZ%>@t84&tj^S&Ol`C>Y!p8~WXzZdHwcARlRhL}02zigW^?Hzab-@E4S0TjG9yG-U+&wT*fm3E4K(iFUCnO+2tG)FbF)~fb z{%;#57BB58-3h~yT zRTAY+&61Nv@q`@LE>jwpE>ldl`?KtYO4Us*OU3zWs4*W7=;-c=4o{gsR_Zo66@jt~gV!b?gCgQ`K`D^o+?uSdIu z_(G&^6yUr7`CtU6od^aV6cm zL(inN%Yb8R!YHbQ*S7&mX4hfo!Az#|x8@KgMGo79{KSduTvzLMx;3=kLFsC+nI5hlkScAJpk^9!Hkgtmy1>!*Fbcyew* zIV8-QP@jTQXUctG_3J|)gsVXq zn-L6fwAvP9{(A_@a3FtLhEDys>w|CJ4)Aa;!Y+rD`hKYeE!SN;kRd%LAy4x;Upkcv zV#02}E$8u^5tDh_TSxd+MU^);9lfsI1~f08uz{G~A&U9(X((!LR{+Yc737peclG&J zD?>m$wLi^!aq!3*D`9p)mT4RLIhWxjw$tpm#HCt)*s{lOr#Vg~Sx{~NHw=Rvvq$9h zJ*9RRQJE<-{4_Ie|KzS22qrs14udT_GP#{hB+EeG-*jWbOtV=WP~LG-=?qWfm=FGe zVXTH!27AP{p)^YMr#rW-n+Qu!#qZa{>OeYnB$D8^sR1IvVfP-zXKuDaYy7){&xoie6;y(ms*yVONHtgRT?IPQ-!4zgP9y%;u`Iq z!UywceD=X7;prQ1BHB;1vGd8?5o}NOgzS<8v4aTP5}}g#+wgG7Vh_deGSji*a`=< zG4yFSpZr=-_4ApF%-6;CJ2&6#4<@uG^CQ)mo7A*+VRbi^HtdEuY&^ujB0jtPe*dof z*95qC8K;lUKD3{d0Eq((lmE*=+9hG(#$(-p9! zs~`&t;dB4I?i;P5Y?rTW@d)LFsMi@<##>g!lf9K)YT#n6@6z1pP+XT|rS}UGj=%rQ z-=4nQ>qF;_@tIqA2}{1FTgfbuR4p*V*~jl+zi1;~pUrE38#M7sLcFZYg2DtE^~zBv z!**|5meMZa(V<_GemL}0E*zzjWMj_i8$y%CYR@QLxfNQTJD1m}>GTA9(xE_?`x&F* zIxFnceSobGt8IURce_d6zDWiWollP`JOVuKV}3@t{2Y~N=kekOp6rZo{`g- zt}vbhKf0;nqAal%o3%ikoq?wxv#ayM<-1lJY^1{m4a`%;H!7xv@F)i}-f@6gf2(`VCP+7Bi}RO0M5rrNLAoHyU~S1v<=qVStL`^GBY&dwioJ zt4Ca%RN=Lo;1!0^?A|cNZn01&y!l-{S6Szd5;zl$;Z#&aTwY%wd%W4H*X<@|UH6Ne zSpVH`ySc|zd!%1`>gwg~&TA34meGKRS-eIqHFkCj5WhMbX`JFoDW&2I^*WGrt)TiV zJ<;d(8Y!+6?R5)HMRsQhb#AT1kG82sKgBXdK{Q2MXq4cs0qDF%{F-8Fk(0+^)G8_u zKez`4<{X3JC@tE!bFcGkKDR#yi8=ju30lyX?||*`c&(&pYl9&moyIgZ7x_bwdm@Ro zhr}Vv0z}>9i0f2Ow4%P_#R)uVhe7FlOatMrnh)EGOIdU%LkIOK$mhN`u$L8wN$MNF z3O6Io>7vWg4M#DPqCu=wz&;oC#irW{{?j=QrUjPSY+Q>ENC?Gz2vpCrn<8JRvM!tk zbaYwQxl(ZwFZw(2X0UtGB^e;miJqj|-K8hB5nKf*kJ7g|ocG9=;&qQiHAMv6UoPt#Sj{uh-5O-S%X zJdp%t&H;4(J99>4*eyuWGMV}Ow%!Uq&ew%v`Di2c4GbkQ=E z_8DcFtSj2Lo{%YcX7kE3+}p@*VQILPWccNeawR4CMperVkOu@*S8GH-?|jOb??D0f zh!cMMldw;N%ZZWCBps^3QN-KBXZ~`&>Z_m+`eesTJ-qlRqiUx+XAIA;V@=NfY-NAl z*CkSI5Yafl1xw> zWzuiMwd+p8>`OaPWfu*7tGkNjF(2mzn=onB!9B!piDkA54QNQ>SUfi;aDjx!26=G` zWpZ2sQp9op(1=5hP!9d3G*byBpx)v2c9BU}(i>(JysAC^shl?13R-V}R7wmR&|3y2 za_F^o8Q(>b3frSCU%}HMgXG4X00&1ylW3*J*8!o3vCASy8Mgah_-QGmTDn%@iA$6P zx_##phJ}f@!$;4g-ql%Pl<4|NZp)o3me~L+ zNwPDo5(YD%(-&IZQ@wAYi>vM5=f0Ep6o;s5_pz}sfY}ej4}T6UWoZyM5Pz4H2>mGR zM%b-dQhsk4-p;?*ou1I_9)T)@Z+)T;(%DM!%*Pviu6U`VJg(6>vAPPDw$|F^FjY3z zr}*nPycp)pHjKkxE5+wQU;9`KH@Tjr)Er(k&B8vFH53n874Z>!!IJs5u9g6k23oyB zR~1U4uhN-=hCWTgImtw3s3K*wTgwwOY7}G%G>AI+!V^NL;U2q6mi&Tq;LDp0X{ZBE zqmGI%T7ZOV~3 z3AfTJvY-R{1D{K90>kPg4C%SLO3*^a5{Y%wqiw?MT zqD&`)n9qWtd?E$|e=h-QxagPqBM5&U6zX2igP6_Mtb-1pN0h1%F153bBZ39q>WYaa z^^=a(voA4?WylhcG!(|h*nVY?#{-J7i-&A-j5Hh_kgyu3L%0V}me0_0kiEf<-zUPSECqzJ3u|k`aOSN`sP#6n_;utBngtBgUY}b>jdPcSe zQngj#*7!g%#D;(kzkoQd{5HPX!+0hMgvZqW$o*1x)elckFXzXBL=%)OMp6PBH#Ogs zVryD-i6-SAW295nr%p`c@^|8H_ygg6DoaSNKgLy(_W&~hkE5~B6%FCH;C5fItDvQ8 z8TGq-Scs=S(kN!sY*IX5(dGS}_9L^O(-K58`eIliah!k%p(|3(1aeejI()h{h$?b+s*g143{{)-MO3|X= zl*`6-O|k>NEr43r^Ob}mjTqRzlJv)uj>v7)A|ao2vl)-rV6~giNCZU_p$4^G{&BOQ zi3Jd$$NtxeOHIL%YuAT zX=DQ2B^tntyPUz21c_O|$4oyL6sS#b{gfrJJbZBPa0z6Od{T`|bcBWSk<$s?WAkzO ztT~hdH;OfVxmTC}LBYsHQKxO@+fwv+eRkAFv&9_{tu-A^jX1^L==VHI4C`G@Xxr?^}MJSWJFxFV|0aSD>xZOKeV#|L*Rq zRjcjf>q5xamealCgtwlBK8`4;a1rg;)Akyw+o^*qX{H-WMtNyB+iTIYLiT^sT-1*6 z=`vF!2D$fBUrD^E6)(?y&9g47IqzY}?icsoftL4oC?eHZJjpu0;@KfgO?0s6{p*q6 zec$ol2WFmB@-*80o-`ckZy-ED7Dx_3IQNswO+i2r8CV39kR&K&)`SI$hJd~JXG8`) zxK2b&97+Kra-(N24c^|hVW1v1!`956^8sme=vQrW&g}hvVRcom2pMV6At%^NKXia zD`hE7N&ETe_nqW`{JX`J>4w*JMeWUYo32hU&W1KPy?PubX$?rmR(!Ts2P^VM1vgYo)nZjSeCD{C&qwS?ZK-hj`vkxiFK5@xSuzfFY`YB zSp4Nh^jh1WQzK>^((Xn~}GPOE@2|Wr8(=$}d z9pU-c=tKyH8T&h7E)kiJ)7(s8Gd+tr2_rtYm+7qS-{ErJ!Fy##2yP6;!&-dT=x09WkayGr z^0zcEJ-VrG4?5GJWE&1g0H-{g|GEA~dnlh6ee$IJ$bX_xU%k}6*H>*Axm<0d{fCnu zG?PQt^0u=T1So7Z@bADp4}HEp6KvDmDrWh13u;FXwA(D^Ct#DYzF)7E2>R^YFfti) zK&}_r*i-hiXwL`lhK5I!yu%NmrZQq7Wz`k()_dwp0R08{HE~b`ucZvL<7IvmGFqfm zY;XK1mLdrvoy?k7H!Rq8yw-2#gk&AygD~w2Vt6r2u2d`a0vrQ^uR*c*d*kQwh39Cp z_8~^YNu)rTJT<)Ri)VA*fu2qWJDtrG%nBjzqtifBrv%j7P8yfvO^>)CX^cv9N^d17 zvcB1^RoJZA=g^o0jt?KT3e@^-(6BNqI2x3_|K$asF_<)_^<|YYGbc;VGFK*DVT+kX zqOu4XnUVIO_&upEnal6;_Q9sJyJu7$a<@*$s~ZBbHO|^ugh|VyzO~d;S>4vfpYfi&?@Y%N@3=`|>F}L21DkQe{T>~BoMgzd|Jp?>$qIhE6Qr^$ z{tzU5oY^#_JOpxhwP2!{h`;L7rJ%f`fL!V+n1i3N|W(Zp%z*$i}+bGFUh3p*ey37yi z--I{p;-Bu{mN}mB@24K-O2kXRHh0Sl&jptudu6bRBM}}YRK040?qq;z>tb7A(4D^;aUTW4Ikq1Jvwjov)#B6NBB4|0Du{f%$WNOgLwx zVveiQ46I*mCR;-S7?=n=s3%l7t}{38+eA8As=LXUNY6_a*K|IwD*_3A_G!BDU;FI+ zFQ%7~ZtwG#XZ6nrcr3!qGte{~l#3L_-6#axpV(Yr?4rM+PfOphHTZ*`mie^);mI87 z?b1(TfC^Gh_;^f1oG4aXQ}|j`NkRkc@P-5jO*zU~J)Fbv!T$Q+ZtT6j;*mr7;y)kG zG-_NDI?tq;sV&)Y%_kjio}=Oy+vE`9uZM;i%;Kr)%QP<)gSB^#2R)m2N0?Q+;z{)k z!BggZx0PfS!8IQmkYaJgv#DFTTxT%2YMSAcvpy34iRmCnrN_>cK3FkJz?&l%M4Osf ziEu_(+umNGM-we9O=!JNWp_gka*#;7a8Yf#z^yLE`4c1~9n9>q8z(A0OiHfnIWzM! z%kG+h#I7{QUrN%xk1Cq$I=#!3{o1xOC6PWi& zwtxxZ>O1WyRF*yO6oT_+ATNwkjyA@i&~nS#U9a_&=DVGQv2EvkbN$n@Y2$CZeFx8@5eP%ulF#1)8e!) z1abM?^AIk=HRXNrpsvT_C4bFjdAsATaD(OTRk+V0dAgR{kZj|di7lo1NBnsmQ*#%G zqv_2zw2DPv*ZUuPNFjz#Thup2l7FJGTE5Jdadx~|p3%{kPPw)Kb)!SNQMd@TtXmzT zMTAD=OJuHRE)p}ZwX!o(iCH0y(N(1+1~1ktcbDMSW1HRU5Chlzm9#s{&~+{Ko%o8b z@pR*VE2r&ed@-?uw2jrv9c)-s2gc`M8#h;(TM<2$-P`3Iu+nVYNg)1vaoc%@CRdlD z0h5$5Iw;$AHvUmQ#FO3co*P6ge#coqR>rGbHP5AOZ=pWO)m)eQ zes(Zm`B&1-i(5i4{)+*o&6_>9zQ1vMc8$@#!9Q7b^MJvnvB>`BsW*kutYLVJ?5*KX z7ag%&{qPNtywTdds#`MF@4NPR=bFa%4J+g7wV{9Z`7v={0+g^~u|EmRZZK(1L{+6+ z^Jl+P(WOS%)6(%6%AuR4!ef%19UkiN#-Dt*Pj=}!r>h)9*)#d5f6TM(tfh?Z5V7nh zrO)@zGcP=M%jzSfGn;R`>Uu_R%<<(La`5FQpbi-IF{qCc>cnS{_P3Dz#>La?B4H9zD5Av_E-avjV z-JS#1(F}zR(&D&x`mHW7zz|8V!Q;MLs`Y+DWodggj>IN)bpGcVK8{VWv?+G^_cOI- zj|O_J!g&b-9%snqv~0lwLi=2CW?hrr_XoU@%kEDaUznNhFr!R4s+0XKU%)f$sOS50 zpHUWBL0MWdjMGe-|3JA9xuT4Q1Uy&lPQ! ziA@^s1bY2M?{!wPwUur%WF5l({4^dZ;_DfuRs7N(fD6lb@1a&j6Kd*&e2CXztKetG zkXWwS%*cPkDG8K%Qf^hhnyuO$IRbXm4A%;xiA`sI0cjuueq~J4iJ8^!hU#Fp8vTBm znOqGFT>7Y`g?*O@1Yb&>b0Vja?ZU&BiUC<}Rej3Dv{xVg)GgQ@O|Y=et9Lz{Vho6{ zp0uj~&Gtne8Gzw7Bb2QBvY{0_h2{TwsLm+ir_FtyCZbb4NMmXOE2%WiIcdWEbs=kW zsk`922vA>Da@(6F8nb}?f!ShP=GZggtSLCq8?Q`}S`ux#r}N`cKS?y5DxjLHKa9Ji zjWBCGY$IuH1^v;;Jkxk+M1@`F!q863 zi95R|(`1qI6j8$R8`cPzS~kvM2JYDY3%Xtzlze9@sY~{ zE79^wxHii^ZZmsvxukUvdp16sRJw`yIBVfIcw$>k1w_78T4S-1A49PcAQD*}x83VZ zeI~v1Fo(Urth+1(q~=a%K6YCgGCpVf;X5x*U5lJ;tbo^rI}#*_U#^BbIj#?x-! zSlgh&8T~sNXJJis5mZ#z}Da&VYB{y{3JQf>~q7ez%`W&UMcre=ZKtsnJ6Zza3w~Qn*}OSAqNP>U!;%#0)|+&(37|e z)0SKX8mvE2oRV6xLK~_pE?yRFiSF zmWb1uCTf>v2*1cL7*SChtp$WHkg}U`#0@92nx6N`9a+vdsM0w^Pp6yv!(4#02-f){ zGS9vDwQsMQwPXNZ{R5BvA76I}G2e#C4b8k5P1uy8eo3r^$j%O9PgYjO&>J4DDRftQ z1eLjl1vhHDke+xc%Ea>t_@d zI+1~=K3lX{q~1{#SN*hHTWrS@8s*ofPz0cfiQ+@;{Jh%Kq=h@~(K2nLE%knmGOa&% zKO3={9o;V7HqsP7QK2#FN9DKlwI(5(`J+4)1RIq3-cI%n(ev|kZl}k+WJp#Xjzm1< zF4f;+8;)1S%qMkO+tHy@M=^$;55!e41bzhetJWY*c&URuKs2K%VWXvdzTO1I)OeJ= zeOSFfzh0R1^|*hMderw3+gC0&!;O2(P`iGrhL&iXj4F24f-0%M$St1%DuGMv8Glv2 zzd1BIxM6bsa}8gTwe|(KKZEL4?c}>t^goYFG*1E?mmJz&+ilaD`|lIjejYmS+udL1 zn|;|N*0lJ`bt?IR`JzXHNSCDytE$Sv_>2{$^E%DYon>gHnV0pYbH;x`Xe3ui zkniN97YEexHmV!nIhsBMuVRAkyc+N=oPr5{VjD5 zW>A)LE>_Xz!StAn)=dI4VXf89*~>rMadw~HUVp(<9c zY9(}kUBdsuBLCy9qP+WGX2B-)iP7kQc;nyx&j084%hCv7w*Hpi+Z6ME{o{ZA2WNWF zA?N)w=B(Wdq%8~!O%5oE$G{8$DCsnFJ#Vjo)`FzbN~?EM zz>8f(2MHJq21pKjjW!bTzL*1vCS3nVwhTp0{TzE=S8gZL*O>ycF`;A8di! z(?hTPuCIrQ-b^x%=Icq9knzpMvF*;pn?jAos<#%iiW2d(c|#AKk-8C(8yNv4M9Lu2 zjxLE_tLAgGr9R-}41mYml_zM|7q#4gplPXz%i{937(kgxeotX1bm-|@Y;`jP37oTJ z1=cHFzV0CR2H76X>7Uz>qzXykz~k<6OHD+WN>BtiYN#xNx-CQbzQJaj$2Ee)1Q4C9=X*12axL$l7opKGes%s1{IrKNc-8;HO$tnbB2qA}+>v!$^B!Kg z77~RxlS;43S}30r2$BqxGu#fi80^3YTpHgB`2`M~?sDn=jv9h72_i-ZGx^&SRw~8= z_WJdh9<%P=cEiCLr-B#By; zI=4C>X9Ipx*eh$8*Yl4yMxrYm-c{VT|6+D zOwO!ZAeFh0?yF+YSuYNBQr~=i2c&EYlJ$KclR(;mCX?_U@Ion5`K* zf2d5Aacd9@FOr4%M6dk{%Emz{COKL1IM=+q+ATlh8xbr-mDGyeyTbp*uUodp@z0Zn zvV-NAjKMCPej|x<^KNQ}_2E&OHJmfNrVR%k3#Tu2hNrhTh#8#jHxjjLy0E9RD~@_P zP;k=4wB3&bGH!ZuDN8hUzL>t$tM6*9sGcn5GCo7Y?G~%Z_}GQ;<|S2RI%bJ=6tm5< zT?hoKhk-<=I)OgL$Z51XC^UnzL9I}()mp=D2`trWdg-yCaxG*G>UC1}a8rdzS&MZR zseBRlI+Qg!o$#gZeRrTLa@L4(ujw7pLOg*T!w zfQ6!g*Us)-mz_U%vdKb$<5ncQ@h*Z zuayPd5=jROOMg$>v7|BG1Hdof&l<@Z>GkwsfD1ni@D-v`r;j&EG#_-OL+nA8c%%De z)go9+R@Mphu2aWU_ab5CRFol`uui88s((u0vV;Q4_DjZx00-20lCFKGmsEDq%v_;g zj4m?!RzXH@{gVTa@jqX2Fp3jHsk7Lak0Jn2+ruWr+RDX4M@M4s4h z*Dw}fjAfem!e1VO8-6dgHaqg8a(wyMQWYZ}0d(YZte&a{Ar#A#$!Lx6cbQl8ELGzK7j zIL;-`rR|QR<4>%B{fn%*m2EQO@N-_9RsZ$j@&dlBfc$|`7m0%+@A>@ol! zfrykQT4_RR^LJr-m{3iM6AP?dDts!L6;q7ZZx!>ZZSIZkutDnaN_|leaezD5a)0az z_v03tFaascSMvb5I^)o5BV8oWYa}D&bBEmA+|gx12p+_VL8GeTK z9ZAL8-!a9Y#WcyoJvHjdw^mLgnBH7jI~IvFaKyiQkR7v69swEWBq)y2cXF+MyQW%c^3t!S}N=Bp>MtJ+%3kCCC33yDv`!% zb9!8HV_YJQA^iN@cSujFjx3|tuFIw2q8DLLlBqRU7DQqKJ)X|fvd8E9bJW28Fd85c zJ9ssHrnr_dUzr2hY4xUz24g;|p9;Cm1Lejme$N(1rZC&EJdC>12WQi>l^5h9+f^9a zBNPpCA~#$O{QmJHC`>I`vVxsMAO2Z`$%{WKI|k-mJHelxyO{C3hYSu^OraeFj`4f5 zVph#Me-roxzqKwSGJD1(=NSH)-F^mmc>V|l?bNUI>?noS1S}fYAVb#b>5!%qvSl=w zqCS?=i?lx??s4Q8ENd6+Ehg=;dbnl(x^C+HW)WXX8;@un=0aySI4I9b}2+X=W$i|ShRW-=7)H-08C!83Hya*oi zzb)=W|8>oEvYK?W1v{0{z%v5KtSqWjwWfu8{89s;h24t0TO_#v-y zQ*7r42W&T>Gk=%>qM48D4m6C?xB(v(AUB9korkUG8Ew=&`XrMjs-J?WtjkjQR$#(SAdcME=qOaEJMw;`>6 zrim<2=?tLqQlx-lAt}qQ-U>Tkfj~rBjiW%(;~kAn;Hgl9vNW8`)?Aw#fTG)DZs%Ye zT(u0tI6#m#=lH}20}@#!^_H%XJ}yCvAtWzzxn_uyIc-m>XSj%ng(dRWb_Hc1bhUR4hND((GB2%d#tgU^p12!~-dlRjnf z!WqZjY~Nbj$N#aDW3~_7n{{&6d|=AsfQ-&FgI&eL)5hCRBk8S8n1OtV>OkOcHqR*4 z>MawOvDHbV@j`uWkNuX*&D$aLCxbUTly(v>*xP`yJht#c% z05d2Ivz!c$4#+f>6`kqdBgt(BguOS^8sI!G3MQ`rSW%VpAnQ!qnkT~(WYHcE*ZdbtFC}W)hr36on(y38%NAh)imQA6T z#?PTT?jGKAy(qqBFVST7! ziZ$OM;)oi4H*H-;xAb3$C#xCMOr{yqTq3PGUp5qtZ=MD{yDu`G!Da+QWiZS zw~@bc&x0RMu2i%_%3Bi}H2jI!N(u2X1*`GN={cDCI2Q$=lzDTn1XrQt0OHTK_1gT7y4|Vqr(wX$1 zSZnP~<5gf=$UwfbaD@i5EcYDGKj$8A{KP#23a{>eXsFk{4D&S z%H?N@x8FSMGrY|c^gEq`LQ*Lmu*Hkrtv?X&dpkI+>)DS1UvWnRKxA@84OA1HRKbTi zXG~^!by7WsR#oo{A$47y9&18*0iK~*4Sxon5*)+_=zZP?$A1nprN9@4X9QW5rS%qm z1Z{5WMBSevuLzo*RE)HF=xWDvV^5Lc-E3_J%YbQID;=9x1|2Bh2|g#_$yLF_-&h6v z%8hGcPvx(So>BM`$FA}&vOcTT!D{mEC!74R4V9mY1)+_$^1T#br;tb?hVg6endQ+# zAs>6dFyoE3R~nakKt%yPHZ(DQ0?NS2w;kHO<1p})c(C|;Diqj`hzFkDP3?lvtc1-S z2mz(&b7C&4`x`q+5J_${87I)6#RC$zqm*Y4epP-_t2ZSTkGW8~rVE_`Diz@9(z}tLY~#+S zk|fsg2^i$KKx1`yX-+QiNqmASflnI#p;b(5{vi}|LkcI8ZR=nV#=e#3{=3F>c*|2G zq*7bDVu^QiEHo+bt><@XWAw>nE4p)=-UATP$|*)WFG?mqoqj$%d=BOlR)jkPH26 z)_zsS=0Z`h$%oZVd-&3~>At7Wqq_-=ZkwSW5{STC%l`uVQ|3*hcYm*!frZI7#iPXY z;KLBkaw&>sNd%qat4v$@{S<4|Eni9Nj|=K=XuzN-#)@!=UOEI**H52p00i9FNUvZi$?7 zZt1N3I8+(ZMJA}~x_7vyK;p$G$|Yw@Hbpn0dn|LT_i=rAraI!};2n?^eH99vk8`w8 zSJeuH?d^r)4AtK! z2c}CGFkOZrbjduzDF+n=GzITxyM?8?ereWR)^|6EjZTMc6J?s@Kaw9%C*I~dF|xdi z`MO)#-&1QIZ%TMDC(Bht8D3@-{vXEP0xGL$TN@Sx1OX`}B$aLukq$w+LApV@LApUe z32Bf9De3NRcF)X$#`(`Z_uTWHF&K>f*4}IH6?3jRpZPrMPl=!EmSxlbbdh+@ zBK?Ax$shC%QbR@ZC6g07(RjlS51C>GN4>9Z&PABYj4X#&`T(_Sx zhYB)#LkQjC(~optSfMb#;ReY2$Hx*fEh(W1*c=o7f1fWmPf---}mbvsq>dGms*ieG# z54YF1Tx*d$f_#}e|Jr1Qb0F9&sG83%$!>I-_mr7O9l?bCo9M3F zVAhE;;-O-}=eKG%IrA%@%vCz_cU0K+#S10y*TnpZoBS=C1~0D>umPbK=S%|AcoO?g z!~U~nNs`Lv8pX#fHY)ds9%+yKbF-8*MS`%x&kh|)?p^h+k3Om?IS4ktoO=8Wvcbti zX(9HEIwCreYi{W3;&2TZi0SS|sJciWW73Uj_s>W_@9ItGiq(S*sPExYBEh>B5W=_$ z(FB9X3t#c4gaZJt0$_!P*MT&f45hRP9alO)qUR}s#qSLJMa81%!f#!j*)}0TA!x~m z%pc+%p8eXW|0Cqc`x><~o*|Ue;rYnnGkFnI4#`4hFY9NIJJt%yZPfxM8dyeo565<< zWs7v!@*LVkC>Xa!b9O%4vwx80xp28A;i8~ZEH5oJy5T8%%v#7nnF}Kbu)?P3aJ6KS ziur!p3DwU18d*6JHI_FpJ`^+JFSKzx(8=92_Q>VUy?Z^>2n)|qF!SbJuDtD-ki?X? zQ;{g5)iEM!>?5YN*FP#!IxS}0ha!w^PbAmnHm7PJqwh0#J1Y7AHON{oPNY8d3352< zr1qT0ZNTaqHFaQjvb5{87kOw9;(>W z%G(Eusv!j9-;pYr1Uut_-?%lvg3UtwR8nEpsZ#JHdkUS!B#I_XNx4fQdqopvMfWid z2;lO!e^LAsjs4pP?;d&zZZLI@;f~Ypsd4L3buaflLPL3!E_}ym}(8@az(j`ip zgOa(?EP6-*_6Si&slu7Ln0bC|&TAtTmO+h?25{P-TpK3G4(Kx=^F=sUzBAGflZ1F>h zT$<#G+Bv~xd2hOb{&lPBms$T4)%_KEt(QzzNk=MP_c*C6RZ3atNQb|JUj5nR?Kg5> z@cGaoLWSMVFy~oXT!rcIT<99T5(#zzG9kOPCZc@<*bof;Ts&k^ce;bEWewqSRxq0R zQU6hTET<14zz3}_!+bWj*lJimkF_^}I1=a9!-V0NT?akHXNNG#g9*;kRQ>9Uq=5->iyf5iDYYVmN-0w8+#T7@*@H(_euev%2g&W-V zM1lz{gh7gStCB}ubBn0TdhI=A$)*@&z`1_rzc2F2p5|h+Uip#VzecN?4zjXg0?5^9 z&Y1oiKpxnTltztFSHKn!HQ=2s!Trw#0?<~ldq!*Yyi|Tg7Ikcd0ektO>%8_J+@agV zqOnJF&z1XlqQ&W8cZ11bHQF(tv|F2I#wVTnX{z)Ph(1eo=u0Hh#L!(j>OG4Cg2Ppg zM;VP*Ak5UZnp^x8L_@<)_(ANM?DkNh=abQ`D-E&o+?K)IkDK;P;xpAG4@$ zpu3jaqR~ad#p0EeSe}c?{gkw$>f3cnkE&-`o@l+}>V&@(+@e zq}H%{!YB!9*Hd&BO~d^}7h{_l=DUKl_k-nLbU&@|*su*S)&;Zca)^RF%y!{L*2 z$>e_r{LuN2@+;LWDK+TC`@vRX zQzx?7NHP$-b9f%uJCq?o?JOUt7}(2D4`dCzPgNqA44#;U`dh76pWq%Z=_r+C$cJxLs>^$t33PF=QgeMsw+2(CHdt^&~rpx7U4s+D3LVWu^uhi}TC)_bsBnZA|b@=ti ziZ+L}X`(zt-S( z$GX_fW3#+OLY{e6Lsm%(D53LKdc&tro}MM46^382;xjxar~B&x{~g(%n_#v<2H0Au zKc+TaGzx4;cVWI8Wd3XwkgjG2gLE5+S;&f3!PpT9FFPoOZSmskRp$hgQ);vfY1}i3 z|DGRz|69CRFgJx0__5{CS4u4z&-%7KV7I-PENPZycRAakF0*+IPd+hXftJ$X>$aV; zBPTX=Vo536H~+)e|GJDgP(ih>B3M8`M#3RL>sKoN??wJx6Q0QvP#G8pD1KULdLuUh zAEGu<$%yr@=lR#n>#yEy#fCsS()R!RC6(p{?*IMi|9sq@@PG!!1cvtm+J9>D|41*dQoBF=Z@-KR1#-?o z4?fd){jdD~KUuqfc5;8XtXljZAN}*!ejmT|0Qpt42cZK0wu}DVn~??A$p7yBf7crT zy#t@-666DY;*KW$>L1Tv^JVf%W+Z&N=}9^v)U@a?zYsMAhC-G2DLLYAqWsS##qUTtWd43p!ujh% zPi)bJzPdY-x7U>_ZkKoKL(&ihETWmeq)BJs&SsAmm4Bb8p9Dxu#Ps`={moW&5~0S= z*i&fgYFlG7f5sOZN)x8J`l^ol;cq?*3cZm0-tu*YuxCXjg`|dLlF5`mNB?UWJwq^( zO_ABCHAH?r$OSgQNXfabTuAn3h@nox%yhZVaO9i7>QF!1wmDc9$xcI9ZJo?HJkLtn zBAo#QfxiZO68S=b;WLp?l2Ge$LLnla9dx}Md>n#5AA3H4j>vtRAwO0|@aJ}(t&u-)wD%E0aAzpIq`vrFlRmo7id{5@?Kg6?njAgieF@6En} z)(*J>dGpGWq9M=b6Ury7RRnh5x|Ue~(s7-mdh%AwQ)tRh-{{uDl{wh9@l9@ue!BW| zf(J=xl3$8P5#U&U4?fPA2dmNKJosZle;&=tC|;$N`t-xm_ub-8<6PbTVFO`M_Z4g5 zw*5W?6f=`VI3WL;b{+-j$)+cxwa0s$X|Gn=Dx+ zS)hh#K1@Ue;)mfaD1=<0Hj3t*H|~U&k9o?&|2!)`aUzWw*2}5d$sy{toTQ9WEVRI!Cmt>O^=E{81f#-lIMan3j*36I z$_kRh$`=Xc#Bqheiu*lxd7)Ft_xA^N*=%oP(?k=M(8-2_wOJFk?J<=E?>k-?8JTM2 z_b?myoL|2-Hw{knG|(uYMkQ3u>h6`_G#glmzKU7lXb~f$-}8ZK_Ij|Yro<_z04!aj z?}OENWIRDI06x9;yiZjCEYj+ARf)B#CtkU3vpGbu%q8K{{$NP2E1pqZm|tu0?>MT0 zPo8~uW%O*KTqShT@$d2=?qQZ=K*xDcg2xR*vEIC{TztPiCL&1pIj%LAfWyVN3qb!y zCEA#oZ2NtE^C*LFP=SU_tSa;8o_`qc1$?NRw<%LnvtQY-k+u*g%bhxcv;GYH#)Jpc z3idBK!FC0n1vboI?gnOb%xgXzt8P56Irzz3XN(~yxC05T}hlj9NFGTUE)>2%KLVcmzN zB7T2kqA;LDt4Xx4O|d@vQ{j;IKRlTIAP@B`Bdqml^>49%*B8HEZ(*^0Qj!CaSZQ)C z^6u>=zPdRY9&m*f)WUE*JF8Is&&v zsYim^45N^zLJJ(%LucgE?MdQ>+j7X>#bxXw5ZhkyBXo-ZHDs4gl*7N5fOiy7ZX7~C zy$#Alh;ZOxvMrv|xE_7r&9!*TmZ+BINQhn;%A3406GSR96C+LUzGU2+BTRIS&?;AN z9H&T#tl4nq7Rq_?o`up%2*+sVoWOB)bbJ*M8O6>V>UF2vM0e=*OxPbEfW7Q$KhL?Q147}k-$C{6ghcb25>cuza64VROy|} zOtSY$M^6{6v##<@rl*b**A5%*>L>x3s=bt5%YhWnP3|;)X-)nW3yF9uLaCnNF!#j= zo!T6pbIV%p;8!ZJdIQVMaC_@^wE1je z@&Y1#zGCda<%9FBhuzvI9H|2 z|9EFujNR5nxTE3bw8q-Kd#u>)22Rt0^cz&M^O-rDEmhy?lo(_RbK`V3sQ$%l6adDJ zJ~UfB>Td`El2ecdfMx?wi^xml-Kd)@j7$%}7ub+L-1wH?qLT0vBgFc6Vi0$UZ?U!B zmGM&9?P3*gW4fYZJ9v^>voAL5O!1~%rNf7hOG)s4p2CwtgF-F)@;soW_zbDO{-&?y zQ0wYz*uaBrkR7(IIRfZS|E+qSP0cK8frPW3n35$u7TtDn*Lt0F|AW37g32gTz_#-TQ5oZ#gu6}pzU^$XuO?Xys$dKAAWyLL1AA@7!*hJ>kgFH(5m zfvf#_p*z_{<=W2e&dkQ5(20EpOL&3W(Lt%j8Gb!Incz6W{9t{dj_S&n*ZrZqTJR*t z?kq*FAfYHzZi++8fvJIu@~#&oIA{ROtd3i=%9`{b!@}GiMbog_&7xA{(Hmr3=Fkho z`cObe_ml8+&up%FPs4a-wbF#`x=spb+v0l<{R9FGUtdc9=dM|5#aj~lh)Q+I#K2M4 zPHxx4BMv%6ww<${*;i@TmJgfx(S`Y-voPXVxH+AVxAW);IZh>vhA*MM1O$W&LN0B4 zHBEl;=>yKe?p-eDvSM4Hfl~Z&@>K!>CR-7?6vVZ6Z(bu2L-b$C8nFsiX*`bt&%94t0HVxlCgv+)OSQ%5b zh-?#!>I`Y}j!54#xx`d0H;vrwKaQ~P2#OrZ;?fQJI!8Y5dRG@Kb6qoIC4^u!b!-mG z*uClrdZOr*sp90he-?U50QNe)kspeB4bMNj-IU3MfdC9tIN<3Z<#OgE2EfNK^%}cw z7Q_aifN}{9izqzaQ7v4gBd{8vtO)@scx6k@U156G+w;1IS~caenUZF%JQn9CTjQF_ z)e7PCSG^L}fDaoF z4N@Ap*fU)KULXKgaT~Rs5j~xroe6{&+U44Fd7r+V}t4?BXhgFVaZoKB1n2l!Do>qYp?(wtum zXe>KcKI-v08Szs-JDV>y*yE{2S#b-J=Xtn+uA_aZb7d-Q3G62?^c)65G2RX;CsE2x zGfZa9F5s-vAUb1Ljy%jc^pXQkH{^;8^H%)8Nde7(szYI>mA z;O2UKmMUL!dN#kcntDJecH?B5=6dzWwua@s>($cqv-yO?`j!Nr<3imI2#JB}hx?{B z@i%VX?b4C%XC5S=w%Yf)>n+v%S#R5Gq8(wmLJE{)DSNT#B2H z*ta3=LzfZ2k!O}kKD_f|ylwcnVO_U^8rW_;mYveR$no=TPoJ{^RLQ<_okDu1C}NlPysJN6EtX=VW+qKtFlUS_%=XID8~>m>$7 zQp5P=cx=U6!GNqAj}8NH){qpD>y$lcLPAHHnzK`lxK5r4m!_(UF(R9C&Amsb;wkcpAY|GLl zrpKmYVfjjRGlfos90tD&*!o#c9pe;h-6~#k@6rX&J38kM%OkMcoO@I}{>iIj$4p}m zP}AfXtBs<0H#Nz?cjtsK))53*bJaY6YVuf0*;Kx0z-oVjrTbUqgf6D_0rAd@;juQg1jkT zP*5u|_zefYR{^+qd$GjOm;4(~FPt6hDP^TbyRA8XBo!^h`8Zj+F0}?@m=ddZd)%Z71tY+@i8m(q0IK_A8YL-L>|r?F zWU{j7hKx=5NuEts9GC#;+V2Zfaqqo{utFP(1w5t8ZAg)9ZQp#;pIxU^vPQo#aDcWR zMC7gB;&Ds=^E92$hr{-Y^Q6S+l}H&Az}*dYF;G+}N(i>|D(%g29m8lINla!+NpWR8 z?pPfm`QSpXLpa}OAem$}r@zN@XNag?+N-eou?`b5KD_C);$ywq8?ES0Pt1RWzuUv< ziEpn!#y0(u-%Ax8UJ`ou&OYxlW1r>`j^7uGpTm5VmxJdBuMAGHRH_!Zeb-e~mCAKE zpI``Ba$R=JQ{^baP>7(ZU9Dvx3Bo;b(e~(Y-kzwE>!v?W6`Q7z;!-o6Od@4Zx;?;lPA0cw8_k<=F7;P;|4WUq8q7(`N6n4sGMn%gwBqqm23 zq1mE75+o$q8*tRRk*dBfPe+ErKh0I5gX;kB!~pV+7XiIz(eLA2t4Y@h!$&+4DEK^h`WSYpqX$liL}P?|2v) zVU}U;aBpJeZgDOS&XlXS*c13 z98~kbM z;Cjln+VKsaSk8E=u{17W+fSvGaJIdi$-~7*dyi+RblUNupB5CpA_yex4ebYqWuwQ{Q=0W)6!URg0e{ zJ%kjhGWO#G+Qmnz=FTn{|r%r=@3v zPfhMF)g{7IvW}SCa}Q@Ktx8BnZewkg8B-7;D#ua`55S|=53h4DCQb;Yz zYG1=0*qwf0w{wYuP{e>!g7T9$ss~^>8K2X_kkAAB{>rm&k4hmL>(&>C{Ex zyLx@rvB=4Kg?!Gjd9Xp!Amp)wNT;ib%lH{`L^?(@kncT-&A#Nl@ytvgg{VH|qt!!R ze7+wPxF-nX!oruOttdHeGJD45>Q|F##Z#`MH&jIX3S8H7;bq9co%-2OY&|87Jd4@o z^u~r>ZE>2Eu$>msU6Y9~HmFES)u8GT|4~~bqI;&w792M-s}y`-t0;(uFx%odScWgY z)ao#snIt~&c>F6q;Sl4#wAM4AE|sPHi>{YROdK`6EquWH1T<;;Pnc)Sv~`# zYN37LugrvWZ$x;ZS)`IX%gSwcG`BwLg96|%Q2k?Q^1SnW84?-9QaoQr0%R|CeWrOP z6f}#CPmI@jo4L+dbM4fQyiBx_h!*%4rI-y(^}EJ@$Z*N5@~Qesmu;$7CmK>8H0ki^ zZ2FrV6zSH=Xz5_&+ATgt*FIwI$DcSG5nQTu_E<%Q8|g(c56-(}z>;rhrkXfmx_6L2 z{KG-6NAo};;9L>lvV!;CFN_dPRYRCA!-{)jHpF5yv|`THRemrVv@}~PwWo23P4{y* zTb7?Y>B8rOaMBBn=cNhoh8&Bc7!Qr$b4D7c=^@WZr{rlGbg}k>%oHVSOfWFkzdTd> z9NSpl8L|)s;}yWmcV|B{lhs!+1Mkq8qvbhc-b*C@G)ZdS3*g+BaDBPTezxn8}UDT%%I#gldt~XgN zPy^Lg#@fzG^t2Q{WB#k__$ys;RE3Jq9rm#8FSKc_uXfr(M{s&r9+8bVhNHEUxL=)+ z@8CD>PUmWQLPzQPk=a1B_`RluNkZbSpG56?KdK{AeN&)#xW?b~4(YgKifiJn6f2`^ z$tCi0v8B-ns12o6Asb9E3`0LBrAP^ttL=#$p@{-DLO1 zFw79be(vd6M--`QM2lm@2*UidDk*3Ysm4VEVze_#)iFj^e;nDIHLIzzM=HNLzwjZa3~Qqkq=C!^Xu%Cy`DVd=3^{b*8C1fD{7DL97ur<%5%>frZ^jTNw!4E5u%9od?_vA?cd zk$*T(mL|H2Ga1<(ErA}aTIhHbG`?Cy7o5#ZblN#WIb7O}hV)t&vp1JMW9vkt;z!?f z&7LcfMeRXUV=N{O>JxlU62}ph63bDY=3^YD6LI#BB!qjH-vX2Nzu3uWEfq;@EbR`& zOCj+n)z&lX=WYkHX%!DnyIv)y(PHo6q5KZEq6;-5)qgi@OQsp4yiu|}+_RWekrHk8 zs|WMrW*4E$wGz4AiJ0kqjaM*^%lpbF#j)4sRjZgcO&*i+t|Jd%o4rM?0)oR@Bd9B^ zXT1x7Hcy>^YL!91MqMz^+{#AQjZg9DG4a9_;uya(5M;Q}sf#cJ#LTWzW@%q7ue{4f z2FI%5D&1PsD9-@($MZAS8Qdm0o`<$Vg*qw3T-VxH+fa|C?jd6ykD!rp#}v10k%znc z0lG;nv(o7#+ss*p7uic!%T@E3n`^?nmU2-?4UwMLKHEZ^;^D#^frhUJHmeeSYN|!@ zEfInCuHq5i!&_IUd(za1L;G@WUuQ`Ggmg{0^zIV2+j$-}@pgi+MAPEz$6jw70y6Gg zCxnitT)^%lwh(leP_j1v{O#UzVptk{U({5xMdGK5bhdQ}g%H12=#Sxb6D&AamDGco z<#xOnKeAdjGM>V)w30P4KzD~n%7rt}J6_Rpalnr zG`xsrknoC(@_k`40lCY10wV<0MVZZcH#c5UEN&KTb6m~`VG_!mW2Pxk-WuZiBDsom zR5`aSS5tuXK3L{WC-yQ!*ku-bWv=KtQMl+Tds zhkimWmtA~bGggT_YO-aXdS<qQ1ky5~-7f!ivcZ^`>wI4_gEx z2FyrDC9b8|ca*^|K9S~o-2FyA#&a%DeCYHWX_X44`y&#Q)oNDc9+t4#u+1vG#&c!(-EMYRq@p`G{Ft={ zmGypS4JsX>zmakqE*!C^j+qgBEYCCC8z^t~XJRboc~KR7;@{)+qLNMDUe)JHbtW^l zhepaK{+snPxrZFmfz8ygQ>>LxEv?iT+lQql?t{UGlS7LytA<;GH)FQ3wVFDR;n=Rx z0yB}pQdAzGVOmj!io#ub5r? zh7Br<8R`U+)oXme48SXK+{l!Pdn)6OefW8cZ{DYB##Ll3(Oupd2?r!W9qwbC<8^5n z7VK{&RtP!I1vYNQQ4(OpY=}rmIEeTG%VpkhtcABP^46BF#a-om3&qPh7n@wpu@ez4 zI)lUNY|c}n#>%D6(A2(Fh#4;4r1euvGST|^t{gxI&&k@HYT zFM+IwKtadmX6VofrS^~$sFf?deMrEgjbIX(uQoiIzpCW>c&qlw^Vjcj0&SyN=AToO z>q<>+(rq6jlDR`r?rk2KmKtJQp0@Va-Zv>nWOL?mhO5-Cc4l+@KxOp%f>dA6MH^!~ zZ2eugk_Bq6<(3)j5^huiS!g)#L?sU7fT1(l@l+=0GpU9w$tPpFOp9gXf+A(c@?|03 z=mSW*-)$agGu!vknBm;-Rh@kCb3Y0OyN#;tS|Q$T4rfXXZjJDDHc4@g<+jC^RI=!w zX$MWxC>L)|eiVzueUSSWs>ChF!_!)+PKy@{pR&iAv1tTX@2kK65R+bVsV@gcC03)# zvqEg++3Lvh+SzKeIGrIycQtQnnq&gm+XWdGByru0_yd$+XDwG`rMD6>moeoLKuPB; zt&cEl*zbA2B~aU})qyEd#x^U@5dT0S+pE?7&rBQQu_Rd8~1Zm!N-2pyJs zwICooZT(%s@WVIDJ>M>pBcH zV<78H+{57vfQ+I9a=X$qG=&A zd0`LGnN+Tk6%Rf|Y)(JGkeQ~icmT0z{c?Hlfgi;ZD}l}H)l(INFw3Czv813$^d$iB)DzZn+H z)-~t|sCmtj`g64k#I<_t66cM!7v=N%hQwNW>qgrHD^fThNQ^52({s1;>5?M5Ao)^gJ|ENfekXrYt}?8#__`i$Fkaa zMiI3=YJ7iZUZ)70OGNRIj&D4isc+x#E1R%nXk}_LoTXed-0u`uUW6=N`*bT>QCF5% zes_ze(}>y`^h>wiXy%SwSjmzL6HzXFu5D<40N|z{{d(ZVDQHRnQQ-l4?ljz)Ct05J zcaYUGW|3gnJ0o3S|L7YihH+-%nuU_z)?;wZ@Q^+Q6&E+>(SVivndSAlRUN^nE62*P zVik;sdTo#Fb-eI-a*zCNH9GE{cNm?ah|{^q5@c(tGF7Cf(^+rO7>!UERFX;8D{(6tH3=#RfVX zn0_ae(CPN6)(L5nE9_=UImJ5oh6fiNB!aem$zXTJpOAYgVMh}}K5f8J90;I0@L13y zqva|GMJDw3(nOXVMkidpd#WyvoR4S?ZQXN@&Ix>@VKKHLju%t1tP19Vvkfg0iC-p* zX+@EkK|2o+NGjq3+|SO1?B?-rBk&LQoNhXA2<&vVgaa6PrF4zQZECIdz^2g2bkG`a zK;QJReWsSj`wdK!9PZ-AbkB+@i=8lzDTNj8HcYcXUt8N-p3u4F38YK?5c&bla}KQ; zqEyJZ+P0R^<)sJAgc(xY(56Y@!OVN0cp8-zI%TFD?yJh-Y>b)AVbNMbb2I={oO4g7<>TmC z%3|o>-oE5zTc;1Z?FOEXJ57w7Au6aZd7UWN8g-b*s9WX(6rl2k{1tK!RO$qo9rHEk zKkGI7-zV%ns6C}`lN-giK{9{qq#gGM^H1|S<_eS1O2Sr{3GPP+E!u;?GdGXrrKreb zQNKWic$mq+bJ1Wj|Ad$BgPkQtsDhS(^P3?KsDzg5gWV&}yoR4MXbHQB<|T?OV7aV2 z0jMxlY}Dj1W+Z}_zZripVHR#TV+`<2T9io^H;70ZPuYYCkpg}p4$$6#^TTkNDnx?7 zF}MWWqgi5YPhp}D0Hph=CspSy|2N)i`DOmfmo)7E4wndS>3{vfgaIU^XIj7WZ-m1C z{=&b!a~{bHYCx}Jljvh)E;bQqGycN;{vbB~fxh^c19)R-9438ur3*lggzYrXoWWy~=lOnE&p# zz-mYVPNh9%M$-TG2TJ#xO6bVMe^4?1`L4jHjn4NPhyDJPfABm1?;qUvQ-%<}@5=g1tn-v9B4K8r&WuYHYvHa!kGq%|R-Qgr(QNs!u%{6W#8!h;{ft7HN& zN`=I{Y*==|5zhc{))E}A!+r7-5d_RCB>dfh|9157B{a_IK1$mnCoUTr9f4in_kM}_ zcryJV&nuazX<#2ACItzxoFkYzp?UyKe?xdHX0RtQNd?XcsMl1}}e=5Yz+Egf1_a!n(5xQUX;)x{0 zw(ue}>p`P`<^||8wDSRFJ@n5E_lKvA-pSR#zQ7Ye2mAxp_Rj~XE-++wr9_EsIr0c8 z9s(*kz&}8^SOc8Wioxb8lT)=9T(UI^$QPT`TPC@O%@?4!OgNFVLKJY&q`mtxeNw>d zd3_nC>875(tgVb_qG%dQu#R&-r~p20HJ$^F04%ScaG@Yomd@W(WC%fZ-7;HI#J`=B zUE*4s^oVu!%aA-1+Tq=RFN0PU^BO%d8ERFpifzWt*Nf;mfRJ1mK$eLn)zf$C2HQt} z3Fi(6v}jv2c6)Qw&!{4z-)G5g=$cvu9{q~0E=YooN`Mar!=*V0SjS4P!GRwrH@%6VLpeY)E#kVvuTBL&o;%r!b7nhx@*4q3Y&zfKqUx)^7fak<_|D1ks6)n)xM;0^zK>ROysDCVe ze-1n!p#RV;E*8JN@K7ZE3`yvJrG9(;wGs&H{j^mHwFD{v=<;d%$m1h?Jr%G>%)6qOK79y}8ku@9{ zc3hf!VUj?jUd;!j6ZIW~)LYjiR9Cw)ojdyyYF1ael>pt((?&TNHn#H{TDqoPy?yARcJUqH{Q0%41;_i)%|F;&+E9wE<`qENg zXVuYqS@Y;TEOS(GHreD+bar@=bw6j_xj72Hv2sogB8o6Q4c&ZKOYHX{!{bfIY1IJ^6=xF zw5RNt{0l@q(~LkI{Kv}afk6=qIbqDQm4%5UmL=di=26La`I&#ZHXpp9W&~rGWKCCi zO}w%DHp@l5+%)DIh}le;J$YIPNGQX_V}6p6hiQn9{cZt~BSLF?JLH~saH;jnE5H-g z1yY=cm>%~3FkY7E3=cn&>qxQp!wx@*D5^Fsf+UPF3z%kzBo4 zf>(wHSbO zsztE0)6FC?YzaZnp}~u;ngGqC6>k*o5C9AA22?ERKvHyW)b}r3+XDt&AQ?pAyygK# zWay7AN3_3_mUjsOq}nx-Yd@+RFdtOGu8As+w-);LMllB*YDF?K_$=Pn0D64|%i;hR zI_76E>ifYnzeb9f4CVcd0WQ6DudfV%oMH5u++V(ajRHVZQ9zAU$LFfzTG(t%4i>la zF%H1)c0k2L_7Z@vL+I42r3;|DLGcOd3e3bQ+{Htk17RX~_(C3Z7!*$dcu{EVG>+3f zcjz`fR@jmCiH43clO;7a8^eGJ%WT3eKEQg-1qCL>FGro%@E#!EyWTDv&MS)n&%U|^ z2)m9k245tvZw!lKVU1XY0 zQLVN-xq>gSN$2q2-i(`aMWUKnEYAx%`7g176_A0PA-{Q9mR7xsp@1|;2pS{@IoNY! zHc`aJzhMX+_Zr-ly|+-@o2AG(H7%tXh|DT*4y^gu#rXDOrV7dW)&(vdRg!q3A?5+; zHsC;rgf)dTLx^Ly9YB6NBYxrlVpbl=;FfS%1A)H>j|iL>?E`FO1a#q7&~MLH9|kBY z<+ZoB8&|a4-JB)86A*AjZp1~L1Om=oBL-UzW)fQ`y%@p{C!6voR`}7|XA;RuFEEh1 zsgxvuI0n@RNRQXOGtEnax?jGduC|<>Z1HeV64)W`?WtHGe~WneVo~1}-iPP%(Oj)} z%BefriD=xLJZTv;W2vvJq@JG;0AZRewFZWyQ3CX1MGDn<61dPWQ6RAdz7gK)%t?i( zGs!{>?*OGHW9LYk2nG(baYVV3&#TiEKY~Lwr^Me|%>CHL3q&lEve?>21SAdOfQe6l zh57SDb;;5nH!9>kjCngLeneiOeh`~mtBH@v`+S$a?02h>f-`dN(etUQ?eTJh0<(Vg z>A6a-z!1ZeRu091Fe$v6R}YI&&yRVV@1 zl}Ko_kKWIab+cg~o0Y`6yUw43x*u+QgYI*!>Gu7*vRSe|mifi~w$5j>_OA85Siko- z4nhxhq}Rl8NEP$d=G0MNX3=TZ(+~^RlL`1gjq0f3e*Q9Da!!YAjJ+8bQ8D$yj%=n+ z{`2Ca%f;tTqFY?4 zp9CJOG^yC=AR&Bu4*b(CsX*&pcEsIKURGdVYHnXsuIHC55FjYsFD}%N5wT3(*Q#*6 zNhJ3iAT9jJA4oG@sQE_lj=Dl$qJVm+#L*kdat z2z$QgtJCBupO>fAuQ2^5Oeen@J%?EkiG>i}hW8xT=;3e$-C5`xHzrGMa5K;=|ExM147FQy&GC z?8Tb+VAHx&@e?q~2M4cKavbM76Sl(JL~{ zKaC(8*3@-ZXP3y?b8P8=vy@#^a}$uH%^yZz;+SA6?e@s%ZQQ9@=xtbvjOr%ls+{*|TVjse?J;ARlLhR>CG zJRZ%`YmIrjpzQZ*BZh}33}tr{^u=kz-Pi8ul7_I8Ef&!-WBZMh2(Si{mzj(Xm~EGC zFu}S;0Z^r|!RQ`^Lhg^$;6l5EZ5~VBJEt?J_Tq*j%f&Nm$-L2-3|levKC3-93IU6N zu&Z5@j9{TVi`>@@69CJCeks zbObEIK~@cHCA(Ms2%|SelmQcPsBw0G#6$=`Eyi$;0gLiYM{KJ;TKRYr?JTewuGxfY zh$!DUB$HiiQ3MyKs`^}YX5ecwMPiqaMR8P*RmOfc5Gq0@W{tNj<+qKI5fLXQCe)^0 zj>Q!>8bb&E^qs&}5$A_)5(2)%q5&UUGy`!4k*5|JFI)8fa7w(`H#E6-WS$YB%4TDr za*7BQrvBV9bJa{6IZoQc3y}8rg^~B?L6{wNV_rMPx?JtNbe;T8h}qpGN1mYE_;?wl z099VFFZiSwdsuyWZ78kym4J;bfpCiqEM=joLPd9_t*x!X%YrAX9c^N(W#jWhj)2MQ zX}VSd-3g$D%2h5A?(nO5{PZjQO%mbDM^6Zb9)8~%w+O3f4;)_SNnjPgq&b(|ZD^=^ z{!^T?pNgeHTHNWe^oUC277DY&B-rJxVpe>Ug^!L5rEkcGlW!QGc@kdBmzz$KIkba-=zyM>X<~{U{+v*bJ-V$Y z-}MYz2e0vu(V*2|M$ZDlrT9vyJ8hoediYh}J2l|1IGs6aRFIxgwXOO`HvF_Rp63?Q z%#dop`Y@b9JCr@@YTZp+(TO2-GH_UCo$l||#k1NSIqHhOVlX=2nLL#VA_c=0tsnBF z$R#6d+FIkwllSpA7uV5Y959~(CW3);~WhM0vV8k&r8TQQ-=p9AnUB-gM#!B5; z$Cikpd%iL?(0vN4Hnx6BmUtq++Lo5t3U{o?utAlVP2FM(Z7H@Mu=ETv_5{OkGpS~2 zv=YO&*>>Wg6luxQiBkfeb77#5JWV;g{*F=y+S4L78-fv@ZD)+YX?6x(u&aj02g~cD z$WiW9wV$;`G?WPEz`^}$-FH^us~FN~3tj3`*XQMY?`VrZh$>Kk+WoxfHbEEvek>mz zaO2tA=wH0x^*+wU|6u@q(e zTgtX>$NZI%r0LF`q6kRL=B^3!QmmyhDaA(2rFimbBvHip(>r|x41h~@>_PR4_50Hr zP?Q-N%bdM=4w5n|)zT%@Y`a46il=jYNn_nsLsT6AE zsL`}{mdy5r@O$bAwhjwR-3x3A+tUT8NWq z*8j)WS3pI*wfzc$l!TqvyQu zz4!apa*by=>m2^E_p_h)#nm+i(MrHcmjt_UONdIEo`wkfybGSL z81d>}K;gBzI`3|yI-)%kG~NywE_=sowULkCdWz3LAr;5<2Dk7X{G>uIO>6`xm}hYl z=U#)tD6b;GMI2BMR=@;kq(GAw;lto?Ur~P?#LY)hw}8vtC!6CNW?Kz)EzP;e0&XxxH?Uc;Y}%%K8}Q#10!H2~uf-eOD-hSOjpNP-T6c*9NCsbQ0T-x=oZ)X|i!cU%R||6z_UyB7NQF3F}#h@kZ~as>k83u>le+|%&OGD zTVOPEtTJT2#a1(1Eg#@YWbY_;El!N0i?M0#@$~wp2Pb1ha?_ku5B* z4faGLW>@3hH_fG=(3yK}^d%p@J}G0^y1trYW?Wtx{Ltalg37RKQH6PW2YYoOmpHVs zF#Uy`m;mu_)hIDY+UH8n^|fbB#8OI*xVuffZ?Q?(QW?9Y<1gd-FAYLNy|cY2HqIx~ z3&k7eXoQ!P8;m}~(N9gz%?Iyt_w4*E_uA8kGPUqZgP#3T(lQE2)>9J$Ledk<+(nqy z^1JsunZOUgR}Wq0wXO9hgHd2|Q}`Sy`atjmwaTQSP^+93?MDF>wK=2DO@mHnh?gwz z)MXq(z;oE7xVks0M+YSr749!WW@?Or6q;Mf+nLN3RYSjGB6s(FD0^$w%A)^puTtNDkKQSjyD-r4z>GU3SSpI^FTQXaS%We8xDO zV>qv5G=Iek_CpG_iaWhFd%D`yYM0`FFc*;YGsx;zHbNdc#gExvqM4it_{*0rVOk8R z07+lr6k+jaUb&h>7CC}8g}G_0ZTGDM^*;sp`lW*Iw}dsKKYnIbF0kP_lg=IFigVe5 zqd;J74IvR^)-?Kl7j^cBlsmmpfMm$ww#MQ6-ZHYWx7a2FV`bA){3W$fzSJ4t+ZD=p zjnBuqgoo^syuRhVqhZqEy<-P z?f$V&X*#4>tzh>H_tv|R`#-}Lxs8tCkByss=SnpSpu(1?tP$Ljq&edN*~Qveb;kmc@yq1^5Sd;R^9 zCagVJ%Ux*VRCUG`pdO!I;7dGV*0WKnuZ^LAFBFQ)p?uBc+{_mDHQ{2iZ*f6sh3ayS zNxFqlJ=35u9MKEi;w#5-@M;Ybkrn>^Mkb~4+UmJaOO^RjXAyr;+q=;99&%kz;WvmI zg>?ts>7nDa4^reyXrA)#k%f|FFJCVoyeif!|zi(=ytJPHQP5}2-+?Lbb4zl)m~OXsDp(X#Y!KYxb5!xU#1&}aDU9JTopoDy;7y$2@PZM*1*QyGXaZs)8p;~ zeuV+0lmhLu@%mNN3G*u{Aho4RnyNdboBhM^9o;ttLZ8#$jOI@e&m^B0cYlK6Y=-(R zd_;w4Au90Hvhd(g{b4eAt8_BgfEz_|-FD?8js5c~1zRA@MsAuoj>qQSd>`H@CXYvN zc@=n)ZE-X9WtiqiLOUSqn_C#p5M4g4_Iid=NTY98{~A{;pk=DU$AWAOunO}&kxEtJJYwP8!Cy7%)hBeT~{h zOPPYg(Erh}VebYFA$HXYy9uc}pyL~vtReCKxju_UiXutVyot!vFZ$4@ly4R4d>>^9 zH%%!=pd9**({yOGYZZU0DXF(ZV5QUyM+m_iPHla*h;uP@*mvh!l~VoB_XtVl=yQ5jRNkt;|?9km`4ApKFt~-Q87b#j|dBk1UtM$$zAZGd=Pv7e(Xo=-RBIr zBVf89hU__G$q&|y*v@7pI%Kw7$sq@{=k3T=boGuR_!kR}RDSTsCC)h!PdNZ1Xr#%< z$Lk%FL7J=AQZQpg30gf6ITcm7$E5iptA3^=-gEy@rscfImiz8k=p7g~<`N;cTG`zu zcii}mjQbPM;T4r;vl4F`FKcH!bSYYD3yaOA(%8-xe(qkmbTRR^6!liSh>YD%Dn9Ox z=l<&KCh%dw0Wi`m+?z{N?N7L!`{De%H_R4MYZ#48-^k~)!WL`6LJ;#qbhqJ)18^>m zlyb*F`|!zytzsa5`VMCpWiG@g&+=#DbRzVQmK`c7XX6-(@f+98oj z)Jq*}gy*wP%BGSy@1!i^kz0RP%&_hM3B}U7Zmu0c6U0y(;ISSNOL0H?9;zUX%l3F+ z_~B3=POtK#I}zX47G7Q@Mfa_`>sH;@BNw(T4sl2L@ax`nciBDuXkVc=56u_j@B)gW z##iTvLHo8+ZlCMZ086!Hz>D8L0QFri!oy*PV7GpvEmWSz^|O6)YrAirY7svP(cov= z>6d)c>H+y5c$F!obee};Z&l~?`>z`u%D5fk-H|V8V8Pz}xJH8K^eREG{++Ax8J&z0 z-@B)03x(DPJv%h$@Ft+5!lsk3mdEy4k}1_H<#Z#6OTYE?%jqC2RoqSJc+ATdEZ($j zYR}g+35U7*V_m>OeuQJ!=lqOUy;`qQ4Q!(Oz4wlsSX8PNb-y0pw=zf%#H(t3aVB?B zi5f-}wUb+L@j~t{g(OdVy3bxumf{M?q&m{@q!XS)BExc(9DY2I)=`8+70b zdc(^0=)g^eV3+OA_AuwCzBye-sm(F6@j9yQagE})D4-*@;~Lq$H2X*$Pp<>6{XPvE z@NK@!zQG>4BUHK`)S;21A%%z&aCViu5qU@PP24|r#tij%aRbAy(CY)y?zZ!_|EKeW z_9M5&d+0=-;zC^<$eS4RngZ&2#EEe9mzTV-reu)77z-q7LTttktXbJk#mYZ z%Yk2o5}R+Vq!N3g*{5-LaeB}C%e;&xBWw^CEAD)~pM}4d)H-~_3B1y?(Zqdh!%k;X zq|I`BHS}2wR=zf)5Z_D|0-(PIXsZwo`LlJV{hm=l6%j*jk41L1qB{7yh({*664QJ? zxe%)j@cUO;e+F|95;?MVypE?3X9UMY2@uHPJ!<~~s>$9jQ6d%=h{>{F8`s{m=hCpC z-6qI>H4&Rq!px|G3WqN7Zo=)W36b&hA%>OixL2CJ@rF?Lm0_U)jhL5 zEql4peh;-CzF|!MKGnm|#iZJfj^)76qz%cn%Y&#(Fp1g)y!^64-QOxSt1ZHyq|&L& zc+2^IzQoR&a|2phRS-&xEyaf}Mc;@)ZF$q=(AkSc@tQC2Cwm`A*7%>8@A$D#XlUQI z&?HLsS`}{@;!uMH)J}|d3CRjtR5M*7*64TSslyry0^l7g*vyGt{6CR7JA!ztca6D$ zb4@GdJ16v$xdzj(T$KWrSAlnb+n0k*mV3AjVAh*UuTa$%6sVW|I_5z!wglYX%UoAn zWox!SHd?NaZe`Nfo2=AuSAm>c{aWiVCb?gsLW17Z{)i_3oM7Fhx~qmp;Msuz#&%{F z&wWXb{!`EBgM+<{cj)kenbEHXZ(bAHkQD8}saw7FN?RH=3&ke+H+u9(GDF)e-qX?w zXkqE9rn>9i2^#+h*C@7q6+%E^F(331eXGRhCQ?hH=l*5OT&XK)fDE#X$*CMpSML5m zqHwf7K1QW>&_h@smvm&vKy4M+-MDP7c?T6UC8Nrf8V6M+g7 zj+^=(!AF;Wu~|xc&jgZz8Juo1BaHHc{NUNa;1jDSNF)J_S#Hpe6qd-jD`k|0s{w;Y z&`XZ#y(LLum$jCMKV~3KZN~X{KyvcQzm?2bLd+>R!`1e2(|h+Nq&K6l2$tjKm^c7l zq)n&ZeL#u5>!moX`L7lLn4MyKV**37?IuIKW*v zEy|)p1@pE4t<$ouF?V`#znC?bP4AvFylIX_4^*e`&0*gdG%G2D#@9n4_GGauDz}wk z{F8Nh+xn=a;IwRf%UPyhzd4f|t?lnZ;JIdi^#l02;Y3ruY!)7TILN&)Q(ZN0D+IHn zIk{M93qu@G6(;*E%)J0m7X{F<^rDKE_hTei+pqg|7|SgCmKcng+6ApaB~a5|&s)zR z2hu3QSINkZ%F|tGBORjhUe$c*nAi%PhPW17)nrVSXa{iwi|8VbYEF;Wd`7OU{TdF8 zb>?S{k0*l*pQ{M+F<~mBs+UgStC43~W<$bYNcCjDl}ERr2sM1+*xQg~7Kl;}#k$f4|#}|wmHrA&}`GB6U6Ub0-uocOp{y;m*a?=~5zCH_~QGFl7)$EkX zZ2DJ}sMC%>grSYDZzViD0F>u4%58;aZgwJ{rU*z zXOY6q^bB;cD+; zu*PzQbe)VsmJSggiHpYD(EIVR(|hqxkT{hv3`xFs;IEURlQ2WW)z* zqY=?X;^J{`06|9==sUi&*#fDIZ;@akM8}vXKjV6g}-zb zIL*JHHiGi!5IZ~9p=S`>l`YC^w(hj zWvzosltWqXz1!cCQMLB;XH9ptxYC>SEBbE}XJMK(s40juO0Ccw;q2p7HNJdghql7i zTjQ%I8c4p!oV(@Z(jwW|s-Rs&Yz##cY>H8sWgpJC=v zLH%kyzjRUMI-8ZFsu-mdn$54A&e-I7foODJCW_in%8;J34 z+GkDuk{8+a*QQ~u&{!sE%D`KPf7EQE&51h`0Qe{$BHX}BrnP>>)Wm0Wk31y#$U=uw z><0yvd-+~HDy?$1=U|$}dw0BSunoX0$oU|EZaHsFJOr?n@A_?lJ)i@G-Zfom_0=U3 zNOnlpId88_nx>4a5K!<~ekL2b{SRd4vk~fCKF*yEi=bfWY!!J&-eMp^Cn#?o;BH|h zVL^EXRq)U8lwxi;ee#C;*eCVIS}eEoevb?;OT`&P8I0@nP-WHMUWlV}dH=9ONj>eo zO}=+U;WnA%j=`QcT{s;Gh}NX6u$ckE6$Ai7A-_gH`TO6ObL94pjyvyvaa%d^vaCUfw(JI$P=N%t7`(f{#gW5u0DLk}cW{iLwWxmq@tX zWY*8bvb8ofLQFPfDBA;gGmJN@_xM29|63wZOZ$sWf6e6QkB-v|sFz6R)&1M zQpuuAxhI2U^wd36+&t>|VKh3)3T8I7)&L%p{;)N92Lal$W+ih3rVgk_%r!8G3w1T#2 zNmFbsyvG3L!q|5wtV$+-bR|Yy7WXSbCac{2OjgMI3LLzXHe1>H>J|%o;ni@MU!69=~jE@5aGE3b^KLCrSM2#LI3JO+W z2^@_y2l)B(XFUfxn+XxN-034AG50Vn1La!~y)p29qz8V#DC|K^HlgRKHc=c@Cb@yK z&4;a=6Z3iP1YL&!g~U#R9qiX-@xD0>jZmRpY~y^eG;UBp#@)W!VcwdND_>h1i!Q^J z+ibLNqoJy25jKqoo=}FPHRX@9#-i<4f``yWZ<9Q;KX{1T_8wsQ&XtwQiu0Kc1(hIa zMBqLRWRXOnenu`#G+2BQ98wS&qvJ0AODgV>P2<@w$``h@T*-GV{$*5%i_!uSLIuF# ze86S&x&EM+btGT?8Gx&%=j$|RfIyl@A_#yP-{sTa_V}XQE+?@>Y>r2!()IsKHxLVI z22TcEq;4VCwL)WUe8;_W_C2kl5(=|OeOBlbND=R^TJO$;HAf-t6A-Jkuv`ysKqVX% z>vPP!cG>p5Cft`7#D@B`m7C|_>P>qoUxkUvX*7y$053N=tKi%4L|ca|GWQ}ZNua|D zHb2288b2Ti0^zG+6~|7AV&Ed}Pa}4?I)D()Hv}*y(#>(>vws5P!Y{1m%mQs&7hcPX z!8~p1kVC1|4{JQ776)3!=ykevG@;%erNld<9S#Og#~_;YB!ohWqJ6>EAqCgO)=bxC z)>~ub+pih!3;0)L)lh&nu-$T7Tc9Oyj4lGgpk$}|Dc~47+L_gCyt($+Mt%CiwuJZ} zEEhp7TB%Ww0X&%-07R7P19z58MLwBTAM)};8z)UNA27O>EgU~piP z%^kJW@f9cEkwH414rpW60lYSpRYNU{BkfkpSEup_4o3WfI>zv`XMmJq&~WE8NHqC;JmW(Q zq*PPAx%Fxj_%|^Z_NtB;KdsxHmh00 z4*79An${N0U*@Z^*26ikli4Z$EKo9(+AY5=iYiiT<4CjJnc*w&Y=A{;5=v}BU72(_ zwW?`*ymXsX9{I+-G)o3%wpTcMPhA1K1mw-?sNw0DiS2}?Vd3b1HP7GQLB&!RZ%=&j z2y}}aqm4!)+Y&Ek_Bm11n#9h&5Y(9`T^kqZv@A>a$6G5kySKMR(h-CKSg0T+iV#3x zGI`Glh9D8KLv5LfILW3h5ptS9wh=xpg+069aU~dl)QnB&Ln1! zFZ}B4iwDDrS3@A#3YLD(-3}*vO*RZZQqn(q&4hHez&yCcee?J4-|h$UX=0x;ETDxE zV6N)54GuV``kr+F^^D-P(E*yHVSF8bk4G@Hx$E~apKeZ_f3ycxrRc7>WV2e+5(k)R zXL@ELEJlPeR;hKsdi969DGZ`R5B1Di1Hi4=3cc&CS#YOjlRh9ojwGHE%w$TEogMUX zX8PP*Pf6P#P1b|%>;eSppSP|5UJrzN;5AJBfX6Zx>BMdu(j(0Pq%Sn9YCgDtkz_t& zjo^Me5ktJ@zbOP0s!#E3RHh6yLPEuU$AQrdlNdfT6<1Q??UZag?T28!4cf!4 z;Q9znek3vjXmupdE(!CW>lFu#Lge*E1R;Tw^4q}Hw1>5*{wKy~U_{Se9Qco-0eHpl zDgD5Z3p7-uyQ5fRD1|*IC_ASIfw=`auQgj7Fo$3@Bv>>T zt{-P0MW2u(^=+q+qon3VSRO2Idb2MKm)cn;1gzLAa}vF)_#fC4P47Y?X()srjVeTk zyS<@U_ewMb^2*4KFDU!fp2Ia6U6Sz6b6!I}=bK?{lSKHZ zTJ#GK82nJoeQe_Z)(0%qdDOA zRq2@NBIPgB6px#nsOavCK7S|^g)fpQP`ZR)~Mv>P=%|0Tl&> zMQQO2Icy%B+ias~uiC-f#_4IRwERcJPMf@Vu%D3>#~vaHH_(MWjcY->{n??3{VOpy zbbjhc5ir9iTQ}IdrduFE5g>Eg`2rP}#Z&wO0f2AW`4>^eZBeMC*y=3$4Xsq1_lOJc zXFI6YM$Q&Ya&$D%*ZcRl^I!r0j z3CxCFA&|B6V~>~iMnew^G-et9cjj24E756UoE>8ZGHUJY%Y#}ReP{b?z5v)_J8sC* z9DK!T6i_@P_Z<32|Br(ON)sWIR&_BF%BH22c&#s@+vsV()Q;uHH3kMesnY!#MYe{C za=xu(4~b_U{J~iNa9fL_CnJtp{B2h2vBC z{mM>+ZLOo(a+2&;OJR@0l6t)c>^3^v2q}D|(=Y-+88N*Xnz1Xd0<7pjGH$=v`sQr6 zY1v*C_9Ztg8cHWV#-rF7a zw){(Vq>aUDPpUi_Byd>zTy|P)>4YoS>YNjh(neC^QExG|GB@wDSA5x^UuHR1s|fJG z1va`%$3GQnjqGa5w9J4Bl&n2j&+^s5SP=s^!#4oO6Qb|F?=*|f0r9RV^G0OB7iSgM z+*m@p9Nwv1>*shnHRwSLXAibrM7mGr`3{8b+xM*-PFm2w{wPw)bh+eHdn#C>Xkn*?-04h#!fvYEyo97}U9Pkc{a#=8{NXAIN zgs9Md5V6=iyWSOPYQFpM!84=qtU71MZ+Pp%utZFlmZ)ya=W4g=?wa=A(srG-qL={C zC>zw>Rd}%y`9g$eQO*GZWJUix&qtp{frI!8&?1foM`EAQ$xOP%T)COz+IgXRnMst( zyjP5h^SvXP;@rRCejhMCOdIClpoHKjV$4vJW}1tW=i0igb^mskoJYfCP=^-IYklu- z_ab=nuP8^*UUfTKS*hlg(l%ymT#TbJ=@y{Qte>+cs=yoEDHhC!5}tUszTViA)9i_X zrk!@$V*oPBaCFgZvb&ZuOHBK0%62+Q`py}E z*Rrq|YO@Bj>QG<9L{m&o)I~5#O$pc8b-g4$GaQ&NwZ1Yr)3yo#eORz5M=$Od8e?Jb z#i*%APrxtFIFLU*JM_Xv)PFc5-;@o9{p<0e!s+uh~g@}CkwH1AjODbJJ%0p zt2IG*U7G%;|$>Da@*K$;<3+D0K;zD@sQesv(v*KH? z^M#gINZ{4`*Y|^$w-=!fJ-5gTI6-hXk3cgbpZu%BLIPAFZrK? z{qOPqH&>Cl1^+mOt{T$@M(LH3&#kvXxrL_ zmj|tf=Ih+ETj`b$o+C?V*R>1bo&wZeT03)b%#*#Q-{~{5^saY#Tak=X&`P#&X|29> z@gk^N%v`{3M9InwhgGYZS*J-qT`)D@?m=siXmt;t-~+XTn+oT2%lV3T-r5zNd`}<# zNFo2TN0^#g{MbFRK|dL}N603!=xRB;t|>1Z{Jilam#<%LIG+M=w;%5F({Lp{c+_~~i*B3P{^kZfXsW*MI0S&2A+1LnmjAhZ%Uv{B;)(1> z`#}$tmT)ens3PF#_@l(IO9H5x8*Pr|*aNk9J-rUDf3t)4M9t@>&K9ZqUg6a*y5jX7 zYRi*?7SErU;z_4hB|NbyM3Gc8&idfeS}lz7O0{x(Vw>&IcTQHkFmV#e0$w99MJ;Tp zXrTsib(76tiv^CL+&&i^yjwrP49WafIsBf9ne9b5gv0Z)$7o|XEol@{Bu+u1tfu2` zmwMOB?xQoWpvxTU*~;<>{Wg15ES<28A`^}&bk8>HSRrRA$zHZhe%uM^nXeZGBlx9RDvnjKVFN=?CrH?= zSf?5Q#r-`P4O-t|ld#YM2|}l6qA&x%T;wtxr0hxHEvl>rMNYbg4_niG@(7?zIO>3O z?N~Ee{QJEhL-#*?#A&p}UW-ED&%LXDdN<40g~BUO&!>p6jS?Y|$2KytD}Gl&)v69&@4h} zgMku1>6iSK#z;+i1L|*{GNaES({;M5vnsmt%vLS+3b3^y_T6~ElWD4^4*i=VXUtN0 z)INZ?Th$*u>mgPiRxF3EMHu!kTmltRL6tAFioGOGCa_=e4>v&KH7mG0nl;p2CBhat zQ)4fI0^@IREnyN0Ub)$t#YiN6Gu5>pl=u=Y7{}la`b$27me2OtpC4hcJYr$G(@rTW zhqaoohsX3*kVNQNY@0cX4-gv}AMI!bw*| zTRBF{yI{H|IatsUirXO~$Gq$3Ug)|o=Fo8{34@F|^q7%WaIkJV_rP+Epg)sYlQ|Ju z`wX+(sA#-*kQ{9<@O9!4SHoX^?;8qZdMED0&imS-eKwd5-thd2~z+8Fpi?az^c{$IAD2 zTJQ-_08IolCa)JI?`am`6VczGXBa`G%Znnk3NJU(;nF(`&SPli-0qa^Vr zRd^a+zZ0X)M&0kcGtj=T6LV9OS%u~1@?oCmVI5>YplETLVdjZ6E7N)ohxg&!)fh~4 z`Q!M;7>Bv_*p=RR?oEgVg;StRx*cuNx^wn{;kG$|`DllT>7+!zR_{!}5uru8o%X%h#ye z4B>T_^3C?dA_BR*Jk~S!HF9=%oWw>;7+RsfE92x&J|q@r_!rILn9!jSeC7-{Lug%& z7!4_G)@<>`{Ghu+9dp5_qJ9Cv|!$ddHc&xt6j$hmK-C#8e3%V+8;%SI^ zXjFRkO%z=3Sh#E3Gf1FAe+vT!VZw*9a*p{?_^QkK`aTCf-2QMRo(wNklmXL7Q78s$ zE~oo3LW_lX@|`+iYI0wFnY2)h+gb=EnG9|5m5-UF?2W$d;+OU*@M@6nhk#?a-pzqG z6rQV`C#6kbAqDOHMllUq3RVC~#$lVekl5*`>|40tTD*8+Kn^yd=q*1>B01>AWJENF zCN;|!jU>j=<&TixwcgnCK_Z;p^ZT7xeZL$iRvbj<{5hL_a9Tv(?c2W>B9jd=#L7zfVd-?q_z>EO$ zxIVxqmw*CfdN}RX_76pwlB{I+UTU99JH_Hk(CO*fig)_^pLe_Zxw6v>$6Z*xjpD5D zTa+MSrAu-tfZM=*7#r;3RkdR3o(%9U>|vtm(k5)yELda-2aP%8@EV6rG7g_y_lbS# zoivf$)#7uai2e0!+nYlvoa^~ZA=N+`=Lak-El@7UQf8JvD|?b;SglaV0C(C zad&R^NZx$(*S8Am*{Lyp9*R0!_Bzw#h{wnWoguOC9bc!E6p>IpTQN~+_kmyeLbk)Z z5{qKlX<*7pe3#2}cF&8hA%IZFZoGb8?46nrC$!Zki1c;bXENI_rTk?COoym(azn;& zaqJ>!_F5@|O|fuBHoy;yF znaa?l2UWvtuaWVTX%scMcImFq2i`rur}70FV>XsqTl1rDsT|zLV3~YnIk&494PF&Gj8P5yGAfGeh*+v3J$JyK~%@Ayj93isD~H|F$pmZ(#ou-H{*uY;v*D z-?57aFAV$IgoIWSs!m;0pL^NtqU!~O1CWjZNpDP*r%fzMrif~O`JL(UuL;}*%Zyfe zUTEy&AAUdokr~f!KjS!8mlC+zkuc21a7r%w*?5uz8O17-IX7!8h01>9Jx9x4lXz8g z+LfBj+W63;o6S!YLzkN)sa8a4Oo6eiyN4b5YHy)#+}oRXUqdl+zvTP-vRARQo#1T& z@7}QcqLz5Ow9Bh9!Q!~hm8wWsRcq1*&&_077vT9RtAX~}Rsj*@)a7AG)o#xHTY^n( zFDv=;1(sr2OTk@65O!y{bL5~JH%p8;Jg|-EHc-Km8;ZK#$Vg`OatOUoiM*Z^*CnjJ zfq{xXjtkS~t%c$5M1Nxr*DF!ZXVQr;eyrI^+U+GI<_d)Koi^yI78euehZxeCRZ9j zyRks*6L#8})ZZB7D{6w}D6(?vVsUo?Zds%Zmnb5!EYRRiCpCcOj`KJiCk}I2C0OMc zyxFlR-A+`X2H~4HHTmn&g6bquw{~Ur7D;VLRIGbpNYWk~v-KHm^kYuWp*hb(X*dWN z1ZD4%|A`Dt$V0alQt15)7^B$KLISgZx81CD-8N6%UMtS_?{_p6-zazkIZgfvbos>H zofv!`6|-%Cdv=dscX>DA!zOyV-blSbgR%Dr&s6lsTd0%t;olHi&PfkJSMTrInPeiU zjxKVa@E8(0nJ~*rG65)Cj`AAnCybFtKF`My24)OYvc@di%h4teBoEX8CAtJSGEo?k zFcg7lwsD?Dh4}$RF#{^5QD!qRM|!k52qZe*I`ZX1Dl{SqHvU)qRR73v@wM=dbCw~^E{^0O6NmJ(YzkM zOd_%Q!@RgD2G94XRR+E{`t?v`UJ(5qHBM>Bn9lYdm$Z;7+H;K(o{+c-H6UYR4~<+Fy9D`8JR1-a>{bIk$x1+i%A?3rHc4h$+)t zm66+GLjCO9%fDD|Hs->pg;~O5aq%CHTJ`MT6HT?mT3K0{0KQ+ZJ^>_HCa}+-JJN(^ zq1?Xn5w-lkS*b;MQA3&-178~4vBG@3bVnn7A#c#3vLQVEqQDDA z`^_jG7V<^rMcm7NeUqLJ zClF2D!Zy+nQgt38rhj+K&mWb&QgTQ5n|om@WfQncI&@TMemWR|^BA;a3c&Nrw${_b zDuE1%I-qwcnx|qofiwge_DjJ(-=5G9R1kavsx-)P5{K{dkeJ^i( z4PWF^&tvQRlr=`padcD@Pj4_-Z$>eqgFLueeq#y-b4%zC6svRR`Y6&l1cscajk`Vz z-c;%>s`#lEq&rpMVu4?kEcy%LV7x0OZvgfX{Q}gmB>LhI9CCw0yz`i};c=*b7H7G< zmk3ccar|I}Cdz~oLq+()LtBr8K<%ay zXpd+>3$?calf}7X!Z=1dAJlWq?1X?lY+w59PwqgBMMpkDmt}psPrI?3%4&|LN%QOZ z%@O7IpKL!StjAy{dtU=5o<-`Ga5g6EyL}~nN13M|a1LqIrhre^1u1tI?;L~V^|?|s zf6~%?86AID8r4%j(P(VCa~s-7c+Kmqe1#6|U=^$_dt|Ok&P6JUGVXxge12lNUm9z6 z;=m#)4=?>`O*X_C)t9}dkkixX4|eN<#fu2)YaQoF8+OaA{Iv(Hj9_EuQqN~)U3{S2IIC%@BP-E(Zexx;XkxCxy;~&*$y;fscF#7rgP|h^ zY$^PRF^wFARKwqKMhm*%6rh`$&e&|$ga{ZLy%<0h;5Cod+8ak05nf)@{Dc_4ndP9$ z0(A=2CS}=ku;#XH&4_ghY~KG(@P2UrIs9?+bE|?QFzb8cENs*-EYjQhfbhm$y_4MebHH=S`dZkmCOxwc z0ju=~iJz-sQm%lENW(=N*)`p~8R`4V%-8W{J&X4+LqO2blX)}pAT3!k{tL-HTU3k+ zi9&AH6Ni?wfV5Cl zn!ySeR&$d-M;qGfW+&+j)1!XJsl^oQpsJ8FaxbCP=t5CsmIBC8igm-!iNHN*`?_<~ zN`|i~456QGg;&vHQ%-QzL>J8rp|5SpgAc9n$cTHXFbi<>s{RccsE?m`99t%U4(K;> z?%uay)K=$00GLs5z-u-2T(elOMdeWOX+U&Qj+_zApOrxWP_D$_Q*|BUcJX2TQ{9bR z4i4oUw#&2cJ!#9&*B#V8@K2!`HojHV*HH&&YhQku%-`(%&a2c8=Wmg{m?sY6Poqvj z)i2wB;YZv@U&>`sRwk zSuUbLwazuU3a9>!U%v2md>x)E6&!4liqkz~fox^_*}1dnJu2qZh1||t3BvC6 z7h@lOk2&*aR&fj3(pb0-3zN>h(QXr-eawq@pB%HG|-#w7UM}y+5xsj;y<UJ%`DAgHAG68=_3auw_ zKMd;PmH><(NHA|&bb0Uy2!b;#+@PIUZmto-8VhD#+FLea}+zHwSakr$I$H{!U)ye0z_R}oufMHK`4VUU-Q={ezZ$km& z8+M_0Oiv_PlADv$2c7&>gvt|^EBq0+OH7uf{nW0G73=qP^4y)6!1B1h_gQ5K#-VFe z(?>e#pxZ#D0qT&~@&-g;A%h~Muew=(n|~U&NLnfz)T80q6RdJWBnjbEMt-88x#P~1 z-3*2-huaM&b7io;7)_*_)-M%{D5Hp*VvaZ`#fngByz>;L?XvuBjHcF#xy{wP@fi0K!-1mu$eo^YLggol z&^gfKId7&f{&}$GBcXRMQDxZ)=ix-ZiEBi6k(=GF()8b^;s0_Czc4 zSdC9!Tql|_xI)Di`!3B+7sbsM;%g=OTTQ>n^a?gA9F;9pg{l=Lp?jkFG``05(9#34 zmwbxg=y$-b7QTQ@A8*v#yh3QS7=qg-7T*Tv%$R#AFPf*HQJ2^F`ItkaMvtfBP*e!3 z#{e5Ljq?%~qE%v56UrVBSb!AVJTUFjWt=(z(AYH$9mxy*=-!ONeayf&iJ=)j zOroiz>LJsS&*Od%=pLx#2aEFHjO8l#@jGvQc>FHZ5jsvS|uV(973H+mPH2?rDG^`>B|!u1N})vFkB zyrWKuu@|4sTV#c*NECwyKvnou!&&PN`lX#NjP+>{2*K#V1dX?*nyTUSW}Tq7nd%61X1p7>r|Q#`^Oah9JqiY{Vl4gbtq>$C z`D%;QuR+prZkU=0pMu8-P1i8$G;fpMfRC6_$$Gr^EPD;r=S#O9v7Z_u zQ3Y444+;c4r-4PM83>M%;{ZQK%Bf=sO1%(;{GUS#3sImvLM9sOMA;w_ochvV!E1Fy zdH+x37e_(g!mMTpCMg~#rkgiOU_aq=w|yse%WoYOKSj8gopynIma*F*XU*T!xmzz#&253f|yQk zZ2EWow394MQN#p&`WxX1Qll(x$%tW>HoHloJgV!~K=Ch}v@_3HD_s^;_yP{vWY!1J zkvUd`mf2T_`UnDKoAc8aKv+>ZjmcYk%Ay;J|NY<6%6XzR(ZA16P-7n&8gkK2BE9*r zh4N3q{kP`)PkV!a$ph8zZsX?j>VV*H+3u$e##t4MPSB6YOBDAK*$w;eTSESm zgamDIi>lD6R-JRfc(#0cM(?2a-)GK5gv!Uq$K!Q=B&QB^o&Fw$I<<~DSD+Gyq`ktR z5OggD=VOoX_33g(KoMAsSlg_SkA)kxl^~)CL0J4^ch{aygQ>v+vs|1N%9A9{n?&>_ ze5Oxv!)Lj`=mS*S%%41rRsXjq1%iI}0vyapENQ$?)8LQf@hvV8a8r=}O2>Vo9{K+F zHkepZ2NHOzW@fZBE6k%V{+v989{Lr9dD?ZALT4+Hm7_8O>R`Yo&8`kKc;cSRafw97(hnE~#E{P#vsx5X`T2%jp*%o+)a45P zJ3R=lE(V?cr@31o8N)%ea`o@e&>Hqr&F%`9=WBZJC+Vv$UN`M;5K`rORFPND(CvHHCt=$N7~c`cCG#AB5uE2s z-i-TciT|?i_V%JRit<+UnlkGnk6gCP&Aj^3+INBCj#^m@NW_^j!GZZXh*6uQzZfS2 zvU<8Pr?Fev#)ykG-#n9OB46#JW)nz`ef6%pE~q$l-z>nHRVE~FH)HI^eklBNV}XGL z$%ALRD`F98Kbo68LOOs~^yFbjww?gT73;e*-tK&M0XnAgC5n{qem_TLM&ebEw*wR- zZxJdn$DSV`qhbwu=P1u16Z<`^NYE8yVTOT_Va2a zI)U|w03harTN~fc{p(#oIL92aB;R;oyuqvI7lfP$aW ze2+zO8Dvwf7^PRD#9Rh@fs6ItlRs9(BGJtZk*9~L1r+4FWiFBinz7BwNQ3X`02$nm zne;4ykSjpzB8-|>J2~&gQfX>+o$9(P?}x(KYCc3Z-%q3b7rSjEpRBsyqKHsqWwfr4 z_Hu8mZ&QK<_gteLX%G;10==v;vga_MzvLf0&TBYa6_5)c;iJvRcJA_KrtHh7wgIZY z>cyyHVS}hb&{HRb@fhm~r8Q-Fl895er$)wdwDaT}(7ucVt8)AzH*n+sW}-oa;6c-5 zy$~G(|FBG_tiCrMFGMK0EDCTAP`C0|>1d>$kUl2IXgriQJ`PXv*Inle>$s$%uPz)bt9rt;=0${fT5Q6vlj$#m zP{(p$?RfiGjBx#0v3~?rEy(Ipyng0PP=0f;Ba4V zh~QwoNRj1rq7;J+*CmYfoBUq$e?5pO7gS|B;JKh@#;l*EZ3A;v)qChv=lbF})>~<(7EzjN-6!(z%Zf%R*+1&a`1E9(EV&qz zdenm`?g2nh7Hl)-;(EmSKmQ7d+0JRAyquT+fTtxm=T)W&wJ!c+F7|dh4<~hq)5c~k zqiin_Gc;v=c0S}LKJJaCP14W3`0WJn!3Lh5|F@k9&=qOQxBIhn_@ri2-zuwq=n?-j zM?@_MiZ*z=_{_Cq$sp?y`8SB?A3lZL(}OgHlaB6(02UeNwoIAoY_IY9h&?;zw~%8M zv-UF^uR`?*oE9c&%F&%4B3?>eGiUQ|`hJO;pS69}7N}!i3)=N(HFWOD`2h43F5Fjz zKsIDuhi=4Ox)&M&LS{fJdfVyWz9g0wKX>R~Rwx)1>Wfj38Vt~QJD0llDCxN|`P`t^ zX#-7_Gqiyq9(eNOfu%ug9M@2+fPrwn?;+!Q>)Q)rcD7Hpc{DevDS#?4`N-t#NE!ci zw>Sxpbc9pim3JTB5SNl-;HMpU|6?A)X$ytdKdP!EpkW567&sbOSF{eE&Vmww7=J%@ z<2~0Ph{e$tbu%?X74Kmv>uBwuplMlqcRyMKj7MojMa44!?rdXhL4s%3fqy4`(otEW zkL^F!kuJ|d4d#vA}dP-JQjgnk489fYL%f!L9ylSul_Jwdb6O~ z<=1YXujcRwV4)Wb+EUlgj;A z*&A(*s`wjOdai)IVPmj>0KkC}o1yyDVBwK}j&l@97+zUdZpNtYc$^17J$TRCM=6E| zGS}MyBKU{C?EV&Pdsydg%RLCFsPwbf#)sWqtEfc^P zG!u}lPIDj;v1&;Ry4sZM95(os82iU!FVx#R5LT_Vg@0P=v4h=tW>Q1p&&Vi9iwU-T)f+04&K))goFbPW#%h ziOoO&Bk644iUpU=KO!jb&>`XXDK5y$hz{ccAnsz#l#ZUw* z3VqY{X{h%sJ4tWj42xQFe6&FSQ>Q1CxnnZm8Gu*1GjQ8{BFYvD&F(6Y^!wfyF8a^j z*dTocI}`+BKWF`ac4$-!bqGThKq&hhFnP|D(0QsQZUEpiF5tzKH%~E_q&am;sn@)q zU(a?_9NHFPpDMIz&H))YeQ*M#5Q1~}3~CC!^)f=-A!PiA?iZMPf@EIClj|^>!4x!1 zf50M+TnMtWHl{=4HrM0kbD1wqSMd$?+5U@ZWKyL}Z(XV-9#GQ9zj+P$+B$+7>r1QO zS$;mc(U~s@aTWD*b^kc?_qJC^F+I(d^?ndj4tTUlt67;j7qwioryU#l`QGnnsq!jq zMg?{5{QIW4U>_p4-$Kt0BBVkpJRh*xC;RiRp_lrty~SM}TJG`^g$PatTu?jMzRe^ zU^g<*luSA<-L_Qw`|Vx`N5yT$nfcFtf5v&$x$|2;!r3Z}v!|tGAg{{g+UTevA<~`H zn=tNDutS=6+T5vQwHN@IDfR;A?7%}Z?!iw1cU zaQ&2FTKxPm>6225$%hUAjpIY{)-Rs@)y6TISOPP&R?8>~f@=ri?`5`eJtgj4cTgKW z?p{sFqJ&qnCr}Y4h`|;~ukBc|7W=V45#yDx0CMfC0`F5+jrNb))I*CtrkG2;@Rz#=L@T4@+Hsd{oPhJw6Z9o3uN4r7 zBT0qd-Sr!xv+5%8v$s(oTG!lFd6;r()mmxlQNYl5EB#=FL@Xg&K zz&RUWRakUV_N(zp6)H@q^r2gGIR|84=#-o}6{!XSCZ!M_v{lnm7@1Vi@<9}nSM8F+ zNn9-(%RmtWzYv2gLjzV*NI!(h;_*&4UyZA$V?nCDZ3;xrJv+4 z*&>Yec}zf8g>$0u*HMHuDYNkX&dK}IOE9}Kn={A7bBXg~X@9KE-v^#^{^;2|eE?S& z&&9>;kUlh~#~>tk8~~i9N_|l}^7@YlExU~n0d{A-=-UmuUmOp5 z{|Hid^S!>Dvpg3eK0M^G>Z88fB)faP`RU>6&NZpzxFT(ak?P&R-WmAkdD|pt%_dOY z(w$Ozn|Rpb$5oK6PL_K@&ys@~7RmJ|?=TYYW<$F@wkTx3=B=k~qjP1>p?$v%4zCq@oK=M|*t8CvzTi_@B07yRvm zvR_%O4>xVoXsu97hiR zlXOn=ZrDd$8_>7f3Ri%<@l%)BeXL`OU3=$kk-Di*(xrX-^kaL2MhC9kHZefP(=}^{ zxuR58s5aKkwbHsh4>R~tf=*HTsHgW2{b8-s^=C<@9 zF8lUmd48_Ts3U3aPp>8(_~j$N0o}r?17}86l{n9GZslqfJ;fYL)|WhDmeTNJ3MxQ^ zDz9jSC7g{a4i1e0{_`O-4hq=_fPfy$DTE0}xXo8K+eF7|Aw$dQB<~XOBV*Nbub*r5 z*2TW`9LO{Q^-+OaQ^e1+e^d}9#?zcjvaB%X(oI)|3C^X%EUtRcl>$D(M@QE}oVf~I zMObDSFlcSXhdfajhq2MJf%7Q0N4B4IKiynWJP5MF?jbf1dB0$BUSb_C$KP3@88w#gvmY$!Q1ZO-QG9n|F_l0#{RnNN+T$w~uv z9{zsiyHBaH>V71del?O*6&xn+*poRL$hw_TiD6gG?KSs>IDAVf9SX$k$c!xr)fnv@ zXv0iZUqfyBch5LFg%}LSOHX)8t@RF-EUQcPmk*sRR1V{Mm@l=aE=3#(40D}-;6q-= z&?45fwG*z6EnU_JLJkIWM^3i4rK<)s3oKtKjSm8*;yv|jP6HCiYJQsGYURe=6kR!0 zQAs*8;x&NwZq}nqkeKkNh+gFkF9ytICMuSV@~dBWPZlD3s3hPqO7u-QvQDBm(a2nU zVaqtSb*mSzGxW^oC{TlJtGN7tMCk4ySdf`>rn!Q~>`|K^In1P?eGB1~Tn=$ad%Wvn z77^t%VJCj;Y2@XJoEjpR`o{KBvyg(GT>=#!V~I%hX1}`BDzg;+WtZye&iUBL;?<#c z?sGJSdciJXMXNu42O+=XT>r^mOrr$Y;HC1qh4N!47R@Q)J<^&GB!T+rf&@=tuWv{+l3;BP|N_!51x z@pged1~QU9&PdNRyKgxRS0x<2Zl52wM&6it+cubr#CZrA_;K1p ziGBU-;`S5puK*u>mmF+-Lt5Oo`8^CZKXhgEH4sDigH`aPs9$Op%sXwoavuzLkoLl` zFJ8}}EoXHN=59?QQ5UdVUDNMu_6gYac!~e$0V<)=WBH@am(06019Bt<%pK4U;&Cez zXOF^GR)E%kRUTyEsrPN}0_~UFfDgG8%D^`;o55Ik(Oeq-u9|;1(H~bW{C%V?yg;Jp zs2tB>>e;*oufb1GIEHRkrl|&uJL|Lwu#2NiO7nUI=Y|M1VO)!$pPT2(ZIg=YBiJRg zKEIOeM7RZP&Q8xAf)6deCDwY%PGy{}*!t4Il{A4H9%^v1$I7Bna2?6*g`h3iZGZgG z62-APTQM0}N@(CFag#zDQRZ#b8H`-k*VxrIP zwyC#lz~YnXkLGu^aC5W{)te4T7`L;E9-F&UAWzg`Y8s28Q9q@}`rC>??-+!ccV8dFxy1Kw!yuk1vcBEWXO4JnENU7wp1VdU9Y&2f ze&wt)lovWUL<+4jF!ha=CJ(+f$xRdXi&mGJef-RZ&zG^hn`MzvwpCDfVO0ly{_(Ih zR(oDP$@q@l+&2LcZmt5do$S{~we(jn?1Ska$9Wlrys?h2+VFb{A(Kvj`T~pW@_U6f zr#>%%-6hQVA0lk39zh$aOrSJFd{{>dOIbm4zAUD^ryfe4jq}j~0eL)Ux zGSZJY?v0gk9g0~*K79Dm2~v^ZJ=FN1wSQ?L0QN+wRTJZZF%#{N#CsPywn&Z@s+=hS zKAZ&6yNfsC?3DP%7Aan0`OFmG<|krIK=|fr38ML_nY9_x^TmOu_5BTzQYFs}C#LW1 zZd)iUk4t1hB_o7T)fkAokM@Wc+{>9@0B3k0%Nb}WPTHq!b!&IN&S209QkRh&j@&s1 z_;xtjZKS+>*YQnGM^4G&R|Aq_H|UBgkomX63Aw;G8!b}EMO|I{H0&pK|H*aPZUP(!|>FhWw@*ai98J7&A zX<1yW$AulSexzsE$*b7Tv<2=U!A0Zf9nouJV|6NneiCY>N9YyjlD{wlAw`Ed7TPIZ zk`A`n{*b<`km>trUNnoF#C(wQVm!089{y0o7JFj1-`Ey+;LDQ@rd0X}`i}Sc!@fc| zW=~&-&Y}{KYvz!4xV1i|dNx>&o`(5u#dO}li;4_@E0h<+GZ5v*t1fOp>}w{U2f`Sv zB4RURZ>*fTQ_*Ake2vAm9LaZB14n)JMnsu^@vO}$$dkMRcECHIj!=}U6Ry7RwC+H; zEIXjtzsec{9Z9rrHT$5SSlzK85*=m8+X7w9!AS9J6K@XGcnL>IC(Q7&`+LR8fRTdM#)fF?tCTr6F#(ixUWsN4T6o^tX|z& z5`gyshan&2AIp2Z&nlXZAz$n+!Cb!@SOH!>^_lj5$4^MVRram*aSa6tZRy2oRtpIB z=vIwEwT)AarLEm(>f_iW1l-i%RAoGo=-tb^>&<@g8_M zzg`o@eLLsj@XqnM&U>+OI60#WS;Xb#R9AF_XnN3eOqOCW9hd*N7!eB>KdR~X=F)@| zhBo)+tAhIvhB&d@-B!L;5)=RM?`Ue&%@78Wleqeurvm$;haQoF22ySZ^#(Aix|zYU z5Fts-2Lk36mDYN#G|CI8&}I(`vq0U2*Q%aD|7+>3TTUs#bp-)X=s1^*69p`+BstiM zR_(N|1kZgx%joUm1jTQ^yIQ&F`(i+r%b*X&u9!*pU$ z*5T^~NmHu(;tO#zDQ%(S-cDlhe5_B2x38GY*EkAJLh(J`J|y%lFSM6o zr2(_qM@dK<;=0kT(^e+@dUa_SlsFP`His9J6P1t1*r_B0ZbVzeT1<@ME{;$d~5tRTz7!`L8HpB$XLfzo_P3c0^~h85`7m18Ke<$d1>{X}SR+ zaSIOPm>;)9=kN8t*E;Lm{ob*H&VoE~uT0!42AQCPH<4b^c6?ejR9k*8)|83f?pzUh zEa&ryJcU+vCj+y9M*|UoNzhiKo(2xv9~zC<`Q-wp%S`6z?x;nqf;R0dYV#&usViR`iw5p+8zM$G0_vGyY5%W3M^pXWFrrdub&8vWwM}IGZ zz#10*QSl|r7+tm5uZw9?StWrm&er8nZ8e;(pBTyzHW2+e&kLp7x8Fzl#EcDxY`*D2 zzt%$U_MLqpmIs-0M6}IbtzJ(-LEY7BmDeF*G@fmuxTfa8@Kc+WfHc#O^~Sn*`-ptr zkWS7t?`Cju=*VUcw3vCoygr@$M`^|T6v>i+tx9@9>}CdTl-_({WtJ>sOB&otHjyWJ zvYO_nO=c6t^fF)r-e`|ayJ5aH+16IBhe#8P)se%PSBNk!zwTBpzk7B=JEVwGLIoG? z-2>Jzx$;$xC2^P=j(uEYzR2FHs^w#nEy0^?>mTDJbYpUlQzOU2LT%wMJM85=)P7Mv z+j6p!+(jTKIppPLwcGsUf7@vBaOCB(cNLe2w?-Q~)hi2B=7kAB$F1s2_a!)XVkTq_;GndLo>bf~yQ9=c#G^Tyq{#Hn07(vXF<_<0Fq zi;h7Xd$sDgK)oX;t0Q#ktY$xTAE1(AoNAv&>E4NN*pE~bPQ@2 ziMD{|;0W~3Ahi3+|_}KH3y;hWO?9 zU*--;q5qaWT`X%{bwV#1P>cVX)OmI~>POu6Xzo3$x%9h5ENl zynFc;d0g$?O0c#S@y#CTfP%<*|KjOcB2_CBF~iz~gA6&PUbasCP@BKe>d%IM#&i-eEX+beJF6} zWI=Pgypq!jPkTYl-2>3cvIOv(3=^tRsuEN0t(-vP8%Adm$k3IIgY4k|EpMC5mQ(3m z9*X$z4g zgKI@*#a6$#_WAqw0Cf_yfE9$UbSPF<5lbuTcHluf&7eNAy4?#f9^AIjGPMaQADUwK zSW;1()Y;3^EpfKTc~$c%MU0M4S1|0+=2RkP9&1BTS69JubD|&jyz%mKn=ER4M#u-E za1C_)8gOsmbOy8mqF+X`0f@Dn037CyGE%)`PNi?A0O9OH5GLMgc*Ru$Fk@{rj2k(g z3Ht;HLFHRVgOWOkVz{1Mj#c(q*UwhB1!{qwM#;tbR;dPV*XCi{iusg5lUY+U&yL%~ zD*3IRoiB?G+}xQ^m|akK_0C!x7CK*P9;>+uHr?SKpiD+u40z$t7Vt{sJLSy1oeU1^ zzN15BHWcC}&jo5^5TG`ieJdM~Z{+xsr8LI^s)i@Zcfd0Wii?ZiCjfxChEn_l=)(u4 zGxZi$fhaKIgpl!j>PN`Nu17yWGVy7NS-xcmR1=n*%Wc^GHO>Xuxc|_}5iTC{pq*9W zOB+BAVE|-BC%J|klKjfD=_(CO-JcLp^Hsvv+4|k(_*UHX0!MQV0r~6?a70COdJnn} zojl1w0B3bE=;z%VxH-$W1)BDm@pu8*0I%@~ab!%D-$>5N)_k=IrP3@);mGs+oW8pfh`18_XR0&Ppy5EPq-^UcC~QDF4t8hhREA*{ z%VNJW$G`M~f7*%(#oWcJs3yr^2|*yek#A??v%4`}dT|~U!s)*oyXBoM}y59|5!UrElJFI_8LYB-ERqnEiKU39)yqOs<&6$)+T z-(_|uM8!|6mJIZ$vC=jCPAXsFm0J*NJf0VGsd{@U91AqEJ_#{j>Q>N516-g%uYP+z zacrv6+xGWN8ZsNH3>R_oxk=1&6@-!jQ&`U$VE`5E05Yadv1VSEA&MCR*|#&_xTvGY zZf61FAaTI;GK?oDhE94`9xhWlb}1QIJ4r1 z$8t{;IS>S-q%-|z(_-UGLp!c4v_QD%C9}@!3U+Be1vob_ao_DifS30{26<xDLhMh^d&Y8u(32YnJ>6W*`W(z1fx-MNL}b(gY88Fj*mvjQiD}dYl77=?>TgI{ zO_d?QX6}jRH}>sMN;~Ow?!$cS@lH<%%oo%)Z1O46MPK~I#aGnr4o^OZH9AQ6w}@fh8<$?_MS9L^ zgFG5x?(uPTHzA|$kLzdy3kXe>?^Qm6z(@P^{?{M?0y%~Wnqy{;%-_3KDGE|YrBpq0 zJ5+8W%>_2F(_t1tS1mA^Zz|Ls$+#niW`Y9kFmo>E@5}SIQ?QPYr!Q}tf3047D#9qD zP`u>etCV_+q%WC)qZ*Gfad8(Zo#ncjdod;2V1uE*GTLuTlkKYK6KyR*`MkUT_U}?^ zDwglfCKJ@~fZeWUUg?cz2>@00YHq>w2aqC{6A6Mv2Ic|M4z0D&g6GIkaUJ}*qQvSQ zem+v^fGg^>Lz{c!9G@P3ePi@@6@1gveL@!D?ulYC@yI&#$#iW>veJcu<<_ zfC75PYGyOp45K<4(rAd#9G&)RzAobkvzxBAw_pDq#$&6Nx;5DN_){2qPf-2j!b!fP z!x$ziHaj{Fz&~PW3jIxd2!MASV*q`>LkRQ76u=7Nkc&E)Z+>=Jo>Agc&OR#EEpPSY z`5>;RT6FPm_Z*T!1D+1V6xfImX`z|h+|`c$W*%VJuexO9i6Oo0r6Q!V@vn@NH&%?0zb{bEF@M_ zSRv^$@Ln;tX1g+ygsvJc=n56==(UNk80qD?Wpl>UAZy!Jy+VY=^#>o{G8&etyeZO| zbYtO=W3{)GNzsFd%Jt5e*o82&hap%Qq6-T6`Xvp-+--$kN*2;=6oIVV%ofO1nO48% zvMs&Vn9()Y*uV$WL|hSH1D12WD~7t+4Ka@x7pT7}i)4T@F0Y{nlB{@R%rbf}B{h3aQ}e9Zh7GERt& zhF}0@+!E332h0enK($R0FNnFX!#KFIPsgetOW-EroR*vxe!Bb6b{H}#a5D?<06%Ba&HU(mmKwrI#3rVcSf{=EjN`OuxzJ}E4=*CUYpJ4{N6Tu$#NI$tdm(ldpm1ZGI!|2 zTEC+R>84(aW6Ke#xskj^KQ`DWb6XGvY-hZH0QO138Ed9Xn@sChqf9U*r3JC85>igF&2vE z9mGHG``V#&`6l%gG%twI4+>n$+e%95_ZWVQ6aBXP%Vp+?rY1X7$CBO{nTag;!byXU z55DD*oVxls?l?5GS2QH~^ygJg)eE&X3*Tq}#TE7#v!EhrfH8f70P2Vfqnb}QCC3y= z7#MhJ=J$zEYGI3cv9^jCK9rmB+`u9ZHzi;QOSN?btygT;kL>IMxYw)x!!#(clHRhZ z6)E}S$jp5WHNT!#3DSKbFD0vPhlIMJfPp&JL`P?mla+?dss+lkcaj*WE>OADg!e+D z#SOzxv^f9BeBCq1F~5oAaB-KP5Q2_c{9YB!d#j?)z&i+dYY)f0?Zy3~(hE$Je5csN zcY8mDak2NKxQ=8)o*Q4!L{$LRSf7xNw+Er$x%@QHVUQxcQ4w}Go4|r0btyMiDs~>| z>Go3`f1HK7FFgm!DDCWqKU^K9d%4P_ZPk}um!Cx8ia9iX7LM1GF^T{M^vuC}Q6?0| zuJfxKOV29T$HIxFNFM#A7RKu%!I|nful(e!AX88z22Q|26`nrFh&*}vCjMCyOdQw? z=PP>b{LvgPWi=64qcmj}@7zu=T+2<2kXZ(FW#%Y*wX_~GuzZC&HuAE|U|D;e9Z59-8yH z+aBp#??G_-z4Bd#KfdbL@NER3J=F#I%pLhf> zXPz13Ra%RkV(Uh2)a=xNbNd&nyveMoq^lz|QsmHk*LGW>gvWsm#;Z7T@tpwT2fhkh zdB{#nrS0vlzGisE1J?MU5>%-%sKa4+u||Ntger*?-|zkQz5r9+llMxstPOAE+^l&< zYQFfbn$Nlx2q0)(1pBo{{|QVHd@j*f$=TD=|be~Osw3n{#)>9X^5yX9iV&^L1PmQ(+G*P^Luqb+P) ztlnE~{!-(NnbYw4YvD1)rs5H!xi=As$Z;K}EB=SN>;`O`Z$Jhvd|p_>g%lZ|*kJte zIa=(ajv)9%loG97c=?5OxUJMIPQ3U<^hHBo`1w!VZlnFiC+jS8<7SLMPde0OF6!?r z=N`*3Ecjaak_EqM{xR((1b&pj&Xx$bvw5aBv_MeyFc!MQFm$%=B0LFhNTPavW1FC} znCp)L4C*mgUjORbh*$bg4JQxFa&;Y`F$#8cjA}dLtFSLb_rSX+e(Hx0b{|^>F&vd$TsjBbt40fQ)E_Vs2>p(CP{|qdo4Z@w$e270S+NcZ{2qye#AA%T=um_h z{Eprr3Apx-tmgh7q*q3;={+Sn!#)GT<({e1S4Pd@25}`W33xO++VS#Ms|g%wt7Nt| zKLv60uQ2oP@IAV<6g1=ewz~CGnAfT;1+^>-u(&pN27_2w7OAlQ++gac$c?Ur`YziI zRO&TrUJ@@pdi=mU_mDy$mb0j%x_A_*Ar;^xY5@IOEr`p3|G0>~Z!zR+!-MeBfD%C+ zm6T8=q1$7$=7_+n8HVY!q_#b8hKl0M6yNAa@OG?bUA6g)Rh(JxSmOMjQAJvg=ru&@ znaf%f5dS#lyFQRHCS_bzOES^j`Z@CBmqC8*7Y8pj`00$cn|2bYVee1PNJ5~9Rl{31 zELnZc4z&S>4QJrD?;To2uS@M-GgLX;Yhf2FF;=u{>H#zzJa$rz)jxo+nw6(Vp#_#0 z8;DM|?$otl)^iFvD|}7rVHD&xU881YAaod;Q_F~-I?P}4omfti-x>~wm-+6166ZGA z`MLMGE)2x*pPXPoqpzf7G)aTnSAH3}zrr2LdLw`bHlPfrosE<#KEPQDNT6PuBOz-w zbliP>LEe1>sY+I*+j&y1h#qJ$eJ)<(7WDM6MY?OHlb3GW*}1w{bA)K?NoyecmzW@J zosSQ_?k^qGKYwg}Yd)x0fl;D2iE|N~>8?Q9D%R2P60$yf!cX>U&igl2Z8yesF=|U7 z)R;HMI?VNgNMT?`>+GQ9pRS&bL9&0JkR*^&`DIl80@Z}*(r=SKOcUM@?KpvO=d2eB zQ0umQTTeN5+;7&j1sFS8hzt?}*r;Q;^S6?WiUJD(?MPOqwC;K5QAN*EGz`;=HW;4K zm)>3=UKY=?fG2W@uBpLM_YWT(&nO-C9j2TsAl5Wp#&q0}mEG*QY#wOy!m$QMxY{!Z z(h+V}oeqb3U!N5&pk#rows9OmrT)K|PjYN0fH(u2%my>(e?0ps_ixpNT{_<054H)m zwh8VZ3HeqGfDhHi6)?xo`t3%xEu(i?e0+LO>HOuj_2U`?ooUTEP?AFB>WMxGX4nbG zUKYk`sP?YEc&N5G$$KbZcx?!kAhw)7o^~(R98mu(>}y3hY$_v(_o{!iA>7C3OF&;1 z)Q;VNib(kvlfbmYH&z9=H0D3&+Hn>}?nh!oA%D)0snK(vg=<(dQQy?y(xzy?D-T5+h*HN_%(yr1vWh zlWWCRL0?U{5|7}AC@rri>pk?E_0o=z`v>yM{odJID6_Xg2>l3`gx9gJAj`$AEN4X! zcOptWRs37qMV%YpqzSvh^b3?J6gdhJQ*D{?_jYv-d59OEKm}gw#@7FD1$R{%LsVgl z!tCBb%XC+8p^midjF~!|dq0g{e`rf~ZkKF7-T$#SQtaoFe8&3)A@-4e8N}srG)>CV z8FJHO=T&mFYWIV3S43IHf;SxE^oW3i3aJTvGZWEc5WD6KR60yCH3e%~`(R6Em3}J~ z)6>%fAZ1w*Q?#lqG+eOM8N7tP`jQ)JYEbh78@xGOu(V&r6YWR}jfp{qwtDX`8~xmOr(v{_S#q{w&!J zSds9ldi{TJtoN|L|M^Sq@xB_&fg^!`=L`SOul%x>w~vD*bhY$K5ePE_Y=EFnF_2cg zpgRQ&0a)Q?(^E;Fol0w)cz9Th&DU=%2B!C*#PW=mBw5+xg(|-)_3p-fIUj3!AISYh zT(2S?+|S76q06c*{#r6%47f_5uPQG3A7Du&nv^u!%Og`r&nkH*CGG@S%= z;_%*Jg%mTWf+7G=?Q0bW$^@MO7WZj;8vu)508~N_qlict#jPvx-*|`u9-{)D#`iv8 zRtiG_JZ2D8q%`yw8~1DcuNVf8IPOonVPhtw;|jFNq(Et=Gw2p{&0|UxKU9f2%y#A5 zMZN5az+pdpF43e$8)4q(2(NSkHSp;?IDmS&B>68rM*w#eluI&qu203e-VDLCtAf8( zXw5wyKAZ!Ida#+vgVK*dYfGGdjlraCXR1;j+6i?3A%MX^{Bh*^7a&1u%_y^;47G#> z2+V_AS5-6I7>%O>08h0uC~PjsGeh-*7C$+_*U$48ANDU|Si{LL9OR3)Y~T*6n5Dvj z+qeKRfMQUDfEq`*4i8PL$d7_zhrYw&gCkAlTSQb`cWuCF9R6T24~{f=?&X>i0kQCC z;PmbVWspu_3X7~FCF(uZFuV1yxaa)_41vZNrOt*@ABSuu0}R@O#7xKO8CAJh&q4Id zgGQ3Kr)7m@o0b7N*_NU$qi{sx+&e|JZ{X^N&wr+0{=N{IZ-PlaogZ3;OA6X$a|p-| zwsvvJlU`|8&U4qpcS-fFGn+v1P~Ay(`0={xg|M1q=`%?i>GRM;omu{e+5N2R*43l`kqsu_u4 zHz3&j>J~^CIRAKm*=y!gm~r{T$w3D5{)`ez@gA?)3vYM|bpP+lp}!ih+ea;bU{W$^ z-8iHzDUjqG*il~PIx6ajTUr8)2qrxSmY^Tk$RXMK-H-0l%I*l$9A{CJH#uJoQ3ZN( zgRZg{@PR&LLBsqnv=XZe+PSVPOuFM=?V*ULdZ0iZW$LDf&lJmD%BF*D=F-*ECuiS| zoPs$igB)>*^ybXxJVbWj)>db6iB36-ss575^o&V!Hzb8?>?t1*IOwc3MGU=u%QXm+ zQG2-Pxe)Nh9$HhhF>tSF&+a%{*Wh#go-e$uchMt#-GyM2xbY@thXk^`51+4GNKK8c z`KptHcdUROugpvX=>*pDo-$DI>`kJgzkuJBo27t&q(e9*1(A3_(93YC+SP({16xtS zAcH4?TTRLAUU7zfDNY*0!q$J!@o$Itx4Uo;(0fkk3nt^eXWDBfo#rb^Uc(NwDPb>^ z{VcP9h8|a(tVQ$g&U_F`I7}=-RhvntG3Yxk2mtz0_m@G2p^QkqYU%my*-@`niRm(8 zFxXS}zP`RL*w3$I`VrUB3is0}m65K9>|Fiak9aRbEEjGRHeA>vl7wVDGJL0t9jcBM z0*J4J8q8|;Q!dh2U%b94gBlqKI3=+RKeEO0kY@U&kALY{Tv3z5$kE3iD(=q2-Q29v<5spVyJsJ5T-uBPVwa z>n@`|>SGzQP2?iZXPn5Q_s7*_QRg|l{(M68V~=5>gL}3O=se|)(rP}1m;gE;ubYb= z0K^lXE?0yU*VUHTnJE3b7=#~~r`Dn}l-(G>l~N{`~%S-2&nB=-G1iB zf`QcVj}M}N^6B2tzG@~d`3*UQllh|Yq>^y~PNFAX+!ziF?jCl{!Q(*#0_?>Oq8cT^ zQ|biB4a6-lg%7O?9Rv;1xP!JkuDK4)QM4QMl}P6U=Q&seTmno$4060Qks5_-G8`Y= z0U<0Hw_i~hEhG63%`aUOV&8K6j#lwS{= zKMGc-A+FF+M8m#fWq}#LnVopyT?#gCJ=Y7ZR%qVdDP}^VYWXPUA>_AO*pn7(?f|l7 zVR&=Htwrc=yJxZINC+LW59C-X2V(2PNjeo!mLSfb;L+c`j0-tmdems>QFJ|wkAsmj z%P5wflQ8yLwOq}WD6L#Yc-a_ztOnw$R&dw+QxPq^dQdqzH^EM@1e_KJz69iL%TB;|{}=;DW)Szb6*Mot6`!n&e7%|RxD4QiJw9_JJ2VtVp z+|7O`#QwaroD5Jv9lZK0E&)O@xW2F4Br}n#v;BUJ=VQNB44pujA{!Rq^FUR>8>1J2 zH@{SetRe!q4s==e6hJs-7;s5(syMw79Xm7A$8z)IP_O@r%AIHR=D@kQySsRJ_26~K-Rs!}B?ba4 zwBllU#x=x!tI38!>ge;yTv3}!K$rWFI7DgA+jT}n$Kcz=aHOi>kM~ZyGLW3mjrJ;Z z-KY9zLOwUhWqSeX;@=ddD*fO<-y-JwB4irL6uF3_h)ckuoxQ}{QV1OEGh9~8a351t(| ztuct0SN;`Zg%t87pQihFGta|x3f#3uf^}j~SoEKl1n(Ad*8j(sL6s+{>(u#K<;k-T1c86J9s5rGD}Mf;yZjm6rK*p>tCw_2Mb{|QiC<2w zA(E9*k8dd5RP+F zvvj#@MpA@v|MP;kj?eV$ToB)i;1@x>8JrAcSSWX&cTCXA`_DbRZ<09W! zE}T>qT9+c$?cdhfvt6@p{neePWRwEz8dMyE%-MdwO=R)ZQY z##fu?O#YxCF3LI}Sg?2S5d2qA@8_sI6VSZ$-gv=#Fv5sZ8k%YZyoxS=>gzZD`({7K z$T|$9M2mp(8U24>z3}Fj`3JqOi#T$m-u0kL!{!f^jrA@a1pl4gQ-=RN*r1X-+42%% zWWJ1}hzShP-J*TiBN-bsZa#m%nMcM4%x^7#zt8jcBYXE{Ums}C4YDf zP3DBT?fMnOh;oDbT~Gs?E-kC2;P03GpQXc-Cs$+XP&4c<{@^qitf&W6NKW;5|*{PQ};7&y>%fzjek&DXq?2DLmJ@k^My>Lc1d+$EcyTm(GgZN;aKF zl3LA%pwq2CD!q5Zq~^U^ecLuF=cT6ym*b~>Dea1QIuGQ#MilckZGzTDWydU~rj;Kz zfDTx%?*tP}Q>C?f!a(QW=-@D~R;6{^$ETE!{y+cp95{Ep>JEQp!px6Gb(7|Zf}h=y z?(#f3CP$v-&v#wD^>q4oOL0-EwcNzM1^R+`1m@N1|h!aotW}%9gl_&{Qid*8yd%6?{%YkOds+#jA?2ZJqgmsW6t1J6?AYPk)LO~l&36?$S9YH2=P%%C zdP|LM>)wN_jVggr^pO#d`3Oc)k}9abJVNRSzjMCe&BKOxf3~+^{C5ueI8JLK?J#E^ zXrJkwGb*}Ub3?*X1#j+hR(*l(%_nyfoi5dTlIC9zliTUrtVee$aT!ghJ_ zqv<%Bg<(tI;LPtCpz3|;c3{qg)6y*#Oq=$B{Dkm#e2sqK>po|`c(op9O9TV;jF~#5 z*u&)seE+i#7p^r7{#t$e4w{~~JYHcgT~gRkg{D7W|MT6xXM&~jpqsDF@2y<@X|O2A zZ#ee6qq%YsJT=>DW6{vLDE9+~_R}eqqxl=T9&cv-!do3F)3^6W2JGBbs%Npk_mBp7 z{~en88Sv>nMX>IArLUZL57wOqSPt7ie|}nH--+XFzc%9DJpJGQ*1r1%HYK2THa$xC zEoGR&80)JZE&F<(WA3M!ILGvXrdRRSl!s03uPgDKI=C(+JUZXw=HDbJy4OpU(j`v$ zfFYYmIZKt~k$BSn}ZfDBeR1W;e}fxM$Lg3R_v_0^QjTiBChybTFBr-V6c)1zRR6qzz0wzq&q15U2~!?B z>*r1e)S-oS4A(8jj_$pL+!va{2hU@aZLB6oUcWUEWI~CKwO+e!`9<|E<*N5og9C1z zl)Z5x;dgV(m%;Py2ZKuQ^q#ea{5jFv=SHCakF&Rqs`BgFMk%GF1(6Vt?(PO@6s5Zx zHr=pkL?o4v5D@9^hE1p-jdX{Uba#CV_4mBr`Of=%?{m%=4*n4CJ?=f%Tx-pF%{i~D zDNgaMUsL2KW;k4K0V?iq*eO1x2kR{;=n6b0LB^_s=(xC9guMBW6v) zoeC+v2*yRyJt&GX8*)(iZOj-1goadC?53$oV`5vGHqzfN1$LH<>F=HO`)-I4`-S81 z+bsvZUo!nM=bc+NfdAE3&UPe#72s)p>-e*^V!V)=sw?M8vh~9f|9G%i9`@cCmPaE2 z!-@s}zbyGQ)IYa8H23hGit||TU)z9R7UAr1vB=Z-R41hFY64Z(SdjR>=ua2j6?8)R zR_C$*`Re*q8#JUAs^s?@)RE6aYo7r@gr6>H$X%$xo0UrXcxe;?d(_xb^Isg8oX=ns zO#I+YrDar2<3Tg`{!zuxSPf9#&xW|Ow6k6!hL zMt!xo$>mxJ!Rhx_@zSmgNmQbNUq5ygI$tQ!!EfQ7?{}uVGy$T7^JldtotRq9UXdiC zzB3SA6d6&H)AA~-OMlgd69Frzy$+DRE|{*nNsEY{r{?2Wp<%n4StTCZtS_ zAZ-fMe!aMcbnc+F+VAFEqn7zYoc-)eEL(SpYt(Wdsu)Zp4l%MH+viWbe8L?4v_r#U zMTSq)cy|jQ&Q7Jz-=`-%tSFWJk!fsv=Pcv_ao7%=EMZym#q0bujy_C48uT3~U~~lp zA(JX0SMAyqeQ}f$(@c8vcaeqg960qQOlcPj*G9TZ@5BoM7(;_R+WN_`4Iwb>1k|RU zp-Tc5EJgr=$L|b?(t?7-JHY+8UYF>xhYu*XC{M3;^|cyL(oJ7wz%CDZO1pv5>GB5y zb$K9hw+ze_JI4y6lAQOV)$;LEQcU5|!^Oo^XuO>6*0FD)mx+Edx+0Q|l)*c%tK;Re zOM@l+ONVfy7_-rBcg$1&WpdSAJGB`dkx#At{35e{&d{KY9SZ>WS}Q)R&crJ@$k`2L43=G&AOJzTnf?* z4%>WNm2J>${Fh;VB}i!Q8J~Ui_Fe)qC_FeI&(?fmMH_8(qg73R&?ANLPMmz?@=de% z>H7Xky|a})1u_v2p-H+>QsU>(?E(8BvCgI~M&+Y7iQtC1J0Ouz92AYWDULkzYXK>t z(%XkDw#)$^G}Af+NHjbGIu!mMkuhjUpH-6AKo=5=iFEV`!dSyG(XXxtmZXr71&7WT zldIAmD8tReIezq@5lp*;UPoPf2Kr&7VgG&`+L2k$hs~$rUyjbg@SNPk8@Hr_Ke--Q zq$?;YMkt>9ydNon#u8jeY`RqqDMNQAEvNwH55n`&U6>97_Q_bjbGXo6>-Bp|8BE9v zLhZ`FU0WJLm#h6X11F6`!ECc0f`dNZaMO#3qznD&xccbl#JrQc;i;q=8weQ=0NO`t zS3%kIy*Rh%`p91iNQ*RYPFuWv#@g72!EAUOKBMm-!fdv}2Zi=Ur1};JvDM&$dZ#6a zUzb(M!qGkX3J(}fYs*aOeKL{eA7$qg`(};l3QqDetcP`K znsko!>J`=0>L+$4j2uAxOFjzTkZivr#eRMNIK0`rn|oZBvb2R=)o?azAe>b;0O8&; zm}VJGKuzX?Y^fSBLTGT21f;+I>>ChC|LjZV!+Ixq-M~xm<}+FAS-t#9w^wiE{vKYm zD2>$H2^vw-OZd+Hnk9Qgly}0{9sZ1X?k4)~OG^N&5r~h5hTvg7`Exr2vj;@5(Ij!( zL>acJZK|KjR+`s_^TST()V1^8mP-WbZ1&tBBAXUFxvS^ekqUP{A|+*RVb}~z%oWU7 z74MAjG}xt_jT>lrnQ*%kE4XX9>Q?fgG`O}rYKifSV+bY2&fmaWYy(fWd~ft2j>G^* zw!)^|t_h%4y-#f!#Dp318SdEqeAQ%_jgGzr75r6G~NS{$jj+EQ=~7X9(~G zuAH%341d8+cseuP5Kqu#++yBG#9?vr!AS!3kc~d5t5`OC(1uO3fJ5#QVld^rHeeM%-Y*{8tEMoX#r%@Ig~0M;dwjlYX1_P7QZ1PhHC=k0UN44Nncro_UKwn1!Z;nsZ}>b$e9O8SH2cFz;9 zRfLimN=7wH^yoOHoTo;x@+q$d`eB zls@0~_ZD|87a4y_FeV2eNxT!&u4+s4znQ@2B(*a$O z#5XeD1dqmLl_X5sdXq;Bk>)kcPCyXos?Vt(2PFkPiCJlch3E&HdP9k!rzI} z`E!`8a8E@AOQIg+;gWdUXuLEScXQhqu{!7(5M>Bxw~J;n&kNzdRwWB)z-Lug)&F(; z*>prH3lt%n^l;_X8JSYo4pz0STkV2yX$asKh_d{x|0x9Tji>P|-x!I^h4>H-t zCxQ{5(!y}|LX*Uzj?%d)MLga?_NUzeB5+3g#<3}oa49}>AIp-3T2ul&=0s5qFk+uj zMCQOd*AJ9_`#Z}AI9k{l^mN!K6CatVf-O<{$T$0u>u07d#$LR|gg+O}dz5DfiAddK ziP2Y}cj;KdEJ6=^j_9JHW-gRHbg2%}h}`lrDjc(gCZM3l<|i5I1_L)Phw&ThPg<**(;{BF z5Q<%~tH8?8H}1C#YSmS!dM(Mji6fgg3*v~Tn+cK0IK9lb+3IuRnHccL(e8Ay;}K1| z!RCYrNTv2L_GdXtDNhF&Fjhbdi8^W^WGdJ2^%}-J!2%k5*C}HHLtlBR>lEN{-eA7@ z)Q|n5^lC*0iYc)R*qkS!`z4yNXI7Ie37e&*H0g!-f!G&`gIg!lriVGlLsA&J&lB^5 zslJ3Zn_wOjw2!g2xQsb{lmB86-|++yHJB&>L?Rjd!Mh7@aCSFBo}>zjmT*n+eoyB1 z^MD9qQd9jpK@DdpJA(&OxL6%|yCwF{u{%>T_U9S4byx^Hh}$!u4Ps;W{HGK;lBhWj z0b`#ko=`Po4s0-PzR4=pWqV3WN8`+UTics>E9%>P_XE*(=xMe3^-^v_$#FbQGpeoo z15`VZ!6>JQX`kTqrOZHeu93CmcXg6|EZ8pWd$t@G zfs^aQt~S4WI6$-RXsBk^)}eQ{x_KVxC`{1b`gQ=661E}Dqx&_D^Mt%}4w4n@rMdh2 z>%$gXQYHpQe{&o1001-MbWl;tKl}hhWjD%|!W(tg=lc`gdtzy$uThOZmh1P07|#U2 zokGeGezGjo9@Z469QkC{)^jkLkVY}i;H>ihj(g#8W%Ur~31G%fpXYl@EuTw1cnU;( z3Z931GVrK-QF7Ul&}zk5MFMuxjU@y1k|7;?Kk_(9HqXR5Hj@VdbTy#$bU2q{t0##w zSNQf=-p~r6*T=A0PtVMnz~~l+xcWZ3xU10j+G}ct=DsHO{TDB%ssn<-44V}}j!<4G zYGPhszCKEVQ3LLxDD~dW;adVWKJ)H4Iik*Q>oy)w)FpLwB_UDu{meX=b-N9&HEW1? z^lVV4>Fwvm=4(9qnXfUb+3;iS*c4`uC+!dpZP@6yh{g}F zEPjr{q~PskH3`RR2f9sL1HvWy5an!ZS7EEyHpHV}lTeFwZk3*2tqc|Q@mn@0D4V}| zZaIAdPyec-hy!(M`s0v}Ws`9>`9EIwym2^FhBaSz#S0>VEA;ZdJw#@b!>kI`k?EkW z@_e>HuU-X++p?U;bvYZf>0SP^_XRYqgEX6r>IK%dRB(}+cr(?EgE8F4-+n#`{&3lx zHSL9>+{f+CG*xS#8}eWft`T+-dC=cT85a_QzUrnuowglCitG-;WMy!`pWwWD^~$Xl zv&>~Mr>}WR52*u+0@|lyYqkP;NWzyD_eRa1>VGo%nkf@qa4%~ALLGy6uAno((RyZ^ zsLT?1hsjWSKBD%O-SC(WslCp1q>-6VFMGkJ%1`z`7y}>PcS4i*=m#UQO20aT%dtBi zK}IEfJ6{^qfA9Xln*PK+QR>U($s|)7f5#V*Au!^i*GrPsSYH9=akYsy9dsAvKl}p{ z$6O#O+q%`s#qvGo8mxI=2&R2S6ds6ExA%KYKSNREeOh;6I7F*=Ll~)@7zaJ*>OAf~ z0vSX1^J)l@lwaQH5w^NSI4X@ld(0#Z(%7Hvv2Q#zLxss<)}J+C^qwx}rE1c-ky>Q5=^>cDE-QHAt8lA4rM93^Jmrep($i7- zEDX2%$dMp*_Q{F`x>4hS(I(3?`ix>5F)tKBclz6iy)VRmX6@bFX`?168s>`WpRb$k zULx$V%MjGp9|*dG}vfhw~e@8Mv*q8hCG(HJfF)h z!cVl>(Om9N)j7{j%OnV~9jD3dfF6|#{WzzGIKpqo+ZZ-3{XzNKo(^WoO&x=-`M`7Z z@*hS&KHIO^bzZjXUwr%ll0E}epfH< zvPEnkgsyCR-#J9auNh&MQhRTUHpeTU)3sJfxA>OQ;gt<+2)0*INvtzYMPQo~adun; zUZ^Np5x42GtH+Essk^lC_)T<+SlQp!XS z*gH9){OG&nls|uW1-jc-7G(siZ;b&cbF6*i<+|C;%BbNL85F(;k8Xti&*>IPb48mT zF)m`G@3n3weu+epSzCh`{_IoVO_Mbv8;*XJW>LqR3S?ZL6?ZTU`pfq6l^D(ojXTzjV)6x!7v;P2y4@Lnety#xCEjL09_dneo+)*k$N3 z0wEI%SDQvkmH@+h~PHOx6$TMSl$gFnUxk09@Fx@g;tBW>Wwn!cTUr! z#usmbZke-*p*UVE}VdQY^^t)Nj?)VSs~iZ$V5#%9HLZAdb%68Sx~aTmF!) zxR5u_PwlJ0@uvOT?O_4^RmOqdndw<5neQ+0ZEu2DV}MkR7vYGi&{!}VeZj`F0w{si z?N>&MY}D^$E5QceLAqjfYv3`5c>icz8`E`j<|(sw>pY~%ht2IHkF${X*aN*#kmhAw zpSCM)f-xVXilaK{VIRd*%TvB)0mB%;R;AU!$T>Jj$kR45PGaJ%keYH2#;S`LT-?#i zR;4eK*ClxdH6ssrNnr>JirRkNSOM}@Srw6c5Qk}=Q!CNovpEx^4#3L0a!e5vk9sQb zvv`|Mr>1DkJX9Ko;2V=pjfA23!Oi7#9b*Mw{JH$)rlyj?`SI3%(++XYilnL2SRNI70S?sMCDDe4yQP zoV~PmpZzCgS!tQ$g25k@a*t*q-`=G-e%QYC;f>w%QuZ!Q?$UdZ@wsM$7@Frlvz9VR zdZ1oP$48b%1ixb3%C1bx4 z@ZR}cbB@NT`C(+O9TZUbZ~R9JtPgXOlC%9i?}VkNXcCy?j{I6=bb?hlJimYZ;^^4rU?e6&>c2TG`|*g#H*(E+n*q}{Y8bnQL0-l zZ?kIbx)8zI5~s%KH)^g`wA$rCwGh^te7vum?^48pm8OOIICE=$-N7bE=_4P7=fSd^ z`f~#a@)TpDw9^%gw&!a!-rRwpE82EWF&0V|#DVE`t{Z`)PKf?SOPDH=AmB74J9!j-2wU16O9lQ|*Z2r&Hvmb4q9k7EHI|>o zdFoa+ZJifgB!6PyfQn`9w5LXq-Lm-u#2#J`MmiBFRsOc5?@c+w7=mNww^uwH6x? zlI7nn$y?DR{kJ~WMjKO-T-sKO=}Z;Siu!<9M8c--=JVB90)v|JrAM*KDS>B(MRY5t znLMro#ex;LqE`{Q8$A)$Z~)wNs*8WW&U-NwJWzA1!9t#*9FC`N^*KMFpSL;9+U~oq zBfdlvHDqV_6Yvg#%FNa)zSI@xTbnNa^{>?v>k8mNS0hK25|MoBbk0;CUKJAT01q%K}&i|CQ{x3hV z`QXtE5G^|6{?i8xX~h-`N$=eyCjZetatDNmu>1W{^#3Xu{tu6}zVL6?5JcPgr`Yv- zz5bN*{@b5o3rKW67#~Sh{#AAVAD;A21vYhiIP*`Z!T)4h;E6BKi1-9^sQ%3&{U1v} z4lf97x=mLHVw?Yq<^Q)|1%O54c5qXa`%fQm12&y{bq72DXRCk!7R_d1EAjn*`oI>j zX?5lT=Ko~;e^vwuEZTVMBs=wg`oILRsr5h5#(!Yf{~sISP0g+&uuv;=fOutR*J;Xa z96s@w?4-oEY}-ZSp}Zjsj)l40nT|EN-wqHEAqfiJ9iC%F^#ArdXi@;*$CrS4ShuKD7E`|W9IMi;uWR}C@yG{k*4Xxj4C^)db6;UowmCHR7`r}rz{Ge1$ zZ}FYv-!3&d?wx;zDaE^@p}}jk724!rxAHu`s8WL8is7Am7le$}wU!QLARe=ivuJE4 zcQ#jwcN&j#?HgL#2c=H4wSJEz5!d$sn$2EX>yB5jXVtAEk9OZ-=-X}5L)WwDPcDpZ z(PvZmoO!NxiuwWP?mb$u5Vk0<{J-V>TL+H`Kp9-Kx$iYmRN#t$=l5|pYkz~D8ma8f zCOwI;mm&evnRJ8jWfeh9jiqDmjCM;&Z_*NfWNwqgO>009F0sxtz?nt`3TPwgxYTbq zsYGupZ)|XGrkV>ovq(6AFT+-1i-h z7}>tf0!}yWo{vR-3iCT1<(-^+Eq{OI`0(JV$p6PzTC}-q@}uoTjbk?DyxiRB@N`;B zm~A|@gp4w2Rs5p!KG}-(IX|Qh2MPX*q{~r+%X4q-xp>7h?X`rdz-ZJEG=ez0S#O1b zodJ0uN*%Z77G9rK+vvXi4$yi1SSP{yvm!%LaF=hYO!@@>wCepg=du_bHaPkorXloT zJ0bmK7=Irox?QbWQV|mF8KKcsw>>phJYAix{_M(q){9;z$EAV`gLv$bPg6*rd|fg< zL+sdFsV0Pb2R$Gus9s-GmjB{*72M^tK1AIWM;|*^a=m6?HCvEf%k(#Y16@(TZ~t^f z{r9f>|L|K3#(6`2r_c*#p^nH%=BLMTVGDAxxpWlk^je3V1{JoGr$ZHH&e2v)dYUbE znJ&H?TA;xrwW&kAEYwrhS4%0cu{gAMA@($ZDtuudCh?HLMUUda2)DUqxtv9ilm zV#H%#(1@}ebSnKloVEF>B#A&nJ9e~`~Mp%zduHm z0CBhwdE~caH)UV7jv{9P(fKID7H)YI5G@+DU9aU3-6i_VF6yn?{-2O%vQVBnUae zN*LlcpW=k7H@^>5ZH~lX#MyNZmq*L;ORi%3B7Hh`0(VimYak|kcsMp0dOWD zY7!5Mci#acVCk&zq8Fg@p<-cq!RD(~VH&pF6)VG{*FXiPT1PMEc3TVo>!A1@EMFUf zj3G>wU2t6nN10^w6}AnR>)}eDq`2+dE)GP{R^&hdXH>{eZ9CQGK;M|_Bv7-hYq}JM zI{;h>DX0}pvQrCt9mNb~EA$LzNUnfU-gjVX?>?o?s`x+l6hlZrwVfyv2a|3^A^9{v zz@ToH?PSFe4C>7f1X`N_GRynyHYJV zE{a$W{x)&VV`e@y;|v@H1?0!u7=}#Mi`JFc5v(d<8z3q<-FB8c{M$!AMP7lgh3iPS=ksM@h1nk0*)=f z=(TdbGPMFeZ*08zCd-ez2;L-4&+K6#Su;Enf-Kk$&%d zjWoRb@`-W%Z<1f7>8o{yT}a$Rw~W+Oa`a5Qi(4cD{Bas2hU43W;j6YghTwbqI=?Pg zm14T52U^@2u2mY2sB}P&Tj8AQAA6f@oh0?~-SFY=-Nvgc~{4!r5p7_rxnU^#2gu6sp4tZP`G{s=nJuo+;VzTtFNk4cfA zH5Bz*lpv`0*e^h>`T8tn7tK3Zb*Amv^$lWZNn+tL6_nw#`50IPu$TiiLak48y*bc~ zhOcqT;Ha?OkifR10mGBAfPB`nSOdj`%wr*-tPmOf&$$Phw8h}kDP^J}R2Cm-t5{Y& z9m#toNx-Vl1h)5}b}1NWEE2&o+MFmiIraq+oQn{&RrJq-TY;k;rhvpCM2@gG;8m zoBtfE>j4VSDDe?e|D?bc2z$p`x%zmXHopw>wK5xo&RuxVt#@43WbL9r1V+BnV~|>k{u4H&_v~io_v5Z;QVL4n$^B zGH-1HKTeIe1d-Lry^tpN(8%}Qd$GsM{mxS zSUug(EGIKMqycvXkiOc651&m+oa-rh3PnYUlqx!{MucD!AWRyf znUK=1TfLoFGFiL_j!7?zommngwf!TVWHq}YaQhtKq)8QXap9t6+2;C-6~rhb^xRA`1F1a9+YYjXr=E~x zvVrP6mQndfim%4XCid1lcNG8-xja$6RN-vVlzm0clq&4}7PmE_^5MJ&l_Ff4phZgU zK0a^ErV@RIlWyky1LNJD3LsaJJ-np1{2@I-mSx45D)Tj9NT4kgm_zm<{1dAC;2F+u zrMzM@R&6eM>vPs7ORr4j*|K7P6B^&NY5J4iFE&K)Du39#TZSz91918cDYYDgP)zDy z?AXBtwKKXp(vjz47e`R34w$I&C3N?~R;m8Qe%i^mXIfPrVJ^xNySoGf8cW$DuS}oS zbHwf8;~nQOj*p_~TF`U0@6gQjp)b@i>*OVVRVxQdzV;H2p-H{(RN=p}IMdrB0Gxm~LzYjV<8Ju+1RRbsB_1>+t63Zq)% z;gCv92uiBcMLcGBcK5pT|Q3M&RXyk;J0a zAOWVbvsRfnrgsBU&(8EXEOrnkK}Qvs;=OM*oKtP8q8*Ef+?=t5LAIa9)pF=oJ4Lxy zdbT=fG{jdDFjDLt?u6s|YR=v`(2mdPXRcleB#J&mk?+EpMT>19j0uRi_c zC_*0cRJGjx*>bW?_xCr8_FdDv5rd~}eygl!(gmvZ>Ql3R=^~?s4p z>5;cCMF+&BluB+pR4Td9{Eo1mdrKW7Xgme^@!lva=#cSQ?~_8gtx9ove43v!EGabO zO+)fT54@G7nbTL*_Xk&=N+9q53DCed|)CS_3#_X=XXh2_d^EX z>Bid3N;#91qxV6^vfxNtYU-|P_^?)wp&aRs{ zI62jJEEJ=lZ`{;oMqo}R;5#iG-WSWBA17JnY!IKz{p-{z&#GhT;nDOAz0u zEDI@Oq#7Yp4z`D@&tIAkDt`#Dns58~2c!7Msg;9TkJ4*AdI_e=UmL+!6FiBdyt8H9<$01K4^u9MTg2LIW?C(dij8)E08qE$i3ME~xR{Ita zv`Vs9EN(9}yy@=e*iK9{7UkDv*HYf-1rUcC)IJdLLmL{Ap}oO6_-`(2yTe z*?f8Qq2)%qkidgG79b(rOR0?v_ZlmmZmv8%VVB_zyPd}6W{kcu_VI%w8fRuxDdQ;B3aYcD6yUz`&r-7iJpvvq4dC^xDmK zo}OAEVK7hwF9Tpu71!M!KR%+L@JL$1?hliZ(=5x-XKX5FuWYaoMylIVynKEQ7c0b5 zDfCMFrOi&A1`9fu2?S=;r^Wd$y35D%OPWBu2K0wYjy47}eWGL3D;mht9~uj0lLdRE zDr9>|HfPYTT%@^`(FEW=MYImNn^JB=I4SV&+<@Mlw4CCO<%UmX^C5l z(V*cSJJj?MA1bqkrDg=lF>LJD*|Q|x*IK@oFK0dPGaycMomK^q)+PhB{M z2FbrFk{GV=3?Jk0>eXas)7u;U@B-^sCYB82y>P;M1?HoMTs6V-&0Rkv1c^@nd)lC_ z@}ypx@jBNNQ$Cg>r=qv$9T+;*H4l$dZ5^+pXB;*~MnzRAn%aJ>Xzj zelzq^#OdhGNvKUro*RQY9V-|=au>osx_(0d+z^!Sb%m4gJCKC9)QRaaG&oVoj%Zih zUk@gH`%wGwf=UnPtMSv@4O0=MvNOWUubt7;s$c!;eOAqoi89#H#$?|eBuV}dm5Rad9^2z|qPBw8 z(W*l_N$Z;9GKU2cMem>s+DG37Sn}kaixYUInw8u&tq}{?pz26Z{k< zc2m@o^Qajw8$GRB-yqOxhnnDPncwX{SyvDN2%q-(m0rsvFdAjEd!iQ-bXd@F z=^42ZmY~cLa)_PsuNt+HuppJ9{5mbnmon6;u~ne)2@xAignON&%S2~0_}x4n(aKR2 zg$)N;WIK}e5U_*f-SpRfMDPSm9QTMx=h^rxqn$^K0my=PUBXxVP96ky)0FqiVtMWL_4GTlZs}i_;UYXYGQt0* z8#-xbNt0{-Msv}otSXD#Mle-wMl zreIrTr1CVlI>~)5_g!olx&e$qZKH)zZEBpv6X-O2}oR#@Oiv++llzFu0osN!7rcwB^vWS zE{ZEczS-E!bRZF%0Bn8wC<6cmeP8Wh&AsF6a{vrsi3LKj-$8?m^Z=f>TB zeBP}>HL@IX)6lLwAIT!Ss->o)nuy(T{gLNiR(*{Ki686M4nUPSQ}q@{bwtG2J5-mm za&2WLM(EwTc5%LVdiw{h zIg=vKJnaM9fAmHoW8GRJN3ljqb?_({yg+HY!2Kdq!j_#qZY;8W^R`i6?j6f1u71-+ zH}rFOA6S11=d4J2^c!sbo0Dnl$(GwsDgr3ZDO^#`0&6?1ab3ENMOjiP)CzHfuvdMa zXL2EikF{%1=7zRkhPN5YA;BL9-%bV=C`tRf0;EiS19~OLyh&o#9XFH{+ZTDVEBYy< znL5smJrOcpqnF~z(>`B)TU2Rtp3K!Y_qx`l7ctT>@$qY=mbpq9+QTJlnq_yYt=KTp z{tvsnH#k4rH7sO5nC-^nVR!rtGO<(%<1u^ufWnr_Qg)J0>qk`(oZBuwvq>cTB-xpd z)$GNSeARs83L6zzA`2-Q^t)Xy$tB;TH+%RPVW^;>H|}e*FhUGpXgauOBJ}_?)FB2K zGJkR`Dr9BW7>0>XE!aU`Ot3?KZP7mJ&>ve}`Jqoby3N;(CeC#AwVjse+P9}6mXU8 zr9S(G(^T7b#S14*jj>DdQu!jyjXhy_v}Oku2HzLNuV$u3Ch^Fe zo`bOg=d7k7U#Zq-YkoR4)_9(2G$QrU=I%jXk62b(3-m^^=QL!+H<1wwO(*!-MB4XYP7u z$4?< zSBOfJ_k3g>!lPb1}S}1B}6*&70!t=3^ z-t1x6G_K~MdM}7sK@ukB--fijj;k!ywLgv?x-l$86VY3;Q^Q#NY5&18gTc2~c;d$Q z`dcSCw&?o;)tcgdDS<7MW5$wm>j~Z6C6BAotB?!iZx9Xj!L9ig1FRPfg&n(Kf>Iu^ ztO-pmiszD%N3GW@A*{=hPnf?hM$xOqN>5Kyd(qZxGzqu50%NgN!e+88%#Oqvx#4MudRLmq)vNkqE0f%;s41eowTp@aoays?i)v{k zniY{Jr)g;qpFKUJ*gPC69IAP4vyInhshs?PT^zGkRLRX(v0G0?U4Ls-&(3B{d7OEkfU?nY&9q&t<5Gte=T~ee$uEz0;kk@)2CN;RH#yEos4Y{5)i$}T$MnPWY!E0gl%0fM|K53RI5^`tVuya>_7dnc`#sqE~ z^%a(dSNtAq;yaMTn41QGDC^BBOQcAVw(~j$z#)5L8SU!z%xah+a)xm!|31b>PfT0s zM5*8oUrvx37F~L^&23&(pp%QovUv0D$>8`hVEulVQ#)DYV_X!x*@pJYT73kG$vUXs z!XdPbc&TymOXxZ3#Xp7W|*g4BT;O0kF74KIEP4HmPGci0P2GxC(YTY+}gH$U;9KD9Qoj3bEfBG@=j z7d;5UQsLe^T__xJ{V76tV|bYV`ss|Ksy@M4Xn?1Z4TZejA>sZp@7xbY#s%jUAm=(% zsBhkXri(5^+%Zcr&yt*5N{MKh$J2P|ckt!yH+d80Xkn$IIlbl!tV>6Dv*;%C$jxn_ z)@w148Y`Gm`yR%6tX#;O{7V6hzUaZO-SS)6PtMWTs{Lz$METMA1`12$$@qWOCA+e` zo^hgLqe2|muye9V-J4r--AMO)1Cs-sMTRc(nSGi;g0R2HNV2~a~3UXeAxb{>cP)u z#OId-@!Ff*GErLzv}HeNOcrT<0_yK;#dKYo&p!|$`=Tte%;h>*$13H8oO>SVrn;jw zon)kNWFEyo&Q3dvT5KeEF<&`&?UrTN^)$oYx5-(f^jeevUW{>6-T)?+M1Eub!(DsA zU6USjLrRO#^bDuzc)xCyFF~vRK*KY`y~VUXnpjYKp>tHDmGIY4cKDQOOKDxy_&ZD! zk|o6PeWH%#Bu*K|$SJ0%TotqVar>QE+I?aM8p~5RUVV-vnTS;zd77<^l_}q*N;x7< zc6%;847N^YMHPuN0omtsoobKQJm^C%zr{OnB}!=MINDAXcQ3ys*l1uij#F*^e9wkc zhU7spePZ4-6khluZ;74$_6K=u{`l22t!v#meLBl)2I^hS-4EH@MOF~+Tko2aO(zms z_!SX89Jsa)hzb%_D^xw9^SPE!5@|&v?u;+dgxYMCP(mrHhq84}=Y}dTE9r;Ir1T$9 zVLw11tfC?jDWIY2zfUQ+zg#-)D&F@N!^TB03ZfgYEne?_VP>q}V-$dKU!_B|$h+r$ z+fZ=!V`BrQkI-ONiKZvMNDGg!a<0;#Ct59NexRzFzQ1pRfhYUp2hJhqxBUJy3d_qy zt3&i+-@Z;a(E(wG#by{hBej1O>Y$ zid0a2S0nGGxb;Y0#_9Q=u!!6h^=z6qM1Fp&@V1jsD8|u4Jo_cS>|V!@W1?lOma8hR znCV|!HS96B63SVeOSI!D#G-{IYbr~GyD_!j`r95hT`>4P>$Tnzb)Z{7^>)WQLevqZ zp9?OzUyzg+3deIqy90^ctEuqD+akhC_*Q~qRJ%?kjS?Ot=7VeunsdIP%l~?$iD<&; zK6M?bJk|Dr*#_oyv-mbFbKX~nQuDD5QTo$vQ?e?7J(D8SF5C)$=vM!%Xec2$aqRy= zhRU)q^XuL28Iu1c^pkDn>E?8gTprqCN782wxezp-!z@iB#AENGj^|;XCh7N#k#Nhz z$P>Y#c+()rW0^m7+~4I>pELKAXzi_uk%D#TGP*7Kkz`5~&uxVD@L<|>?@BU{FwJV6 z-7v+Q=W=Z3Z#dtQX@c%DPn|>_Toe$zsREJ7RNJPXg?4Pi%Zy^59(J{BL^LB@XY7RQ zQR#&);4dwT(QrKt3#x4ZWj*P&4eln%v*s`E>kP57(>>{;={yu9R>#Ir1WLF^sBD4{ zw#R{X@MN_=yIsIHOeX(!W7j`)S^*=Jt+2@?h?V~`B;yBgcX+a{O8AtyRM!HqQig_6O}AkqjQIu+#y+h z6s5?~nissQ@Th0xaBYlJjwrjzxI#&UfHoj^_9>BlxW2NobL`kS0&&&);A`gG;4+PA z7Zf9Of*IP$iqtU)%|vQUE>kLarpq^C^SC+T4-tSqDaQBl!uZh=X+dV?PC9J5&r$ER zTMV0*43Uf;^Lx^uiC`3$y7QnFwlUE z5isw>+)cehA&~yoP5Sw}VdBAg9X1hEqk@5uDp9pFlsvBEAYu}ww&#;6kLx;`+mN&XeN&Ty5X5N13)aK z3k5d+@C5yDZMJ_h?F5u(slx929LDWU4Ry32iysSru@@-k`$PC zTPlP2m~hEPD8)B)vu0cNE2CcZa>UsCCwT={z4RT0Fd)RG%dIi`y8wTUF@cOIX*XMj zxYxw@q}weK8D^~ky7#Rb+}oo{7`%<{{dn2xu~}raRQoKA^ywR4cGQ>O-#DC3hc}Rs z3A}&*eq&gAd_JF*Z&{}JHm;YaU_}SBN~)T8^#0iCy#*DyHTJs-V!Kq$FF8{i%wtaK zpQM36H1!_{)OC}*Q+EK1@%5~$q?t9!JhYNFSkjy5E*4rIAxF*Pads}9Nurx6%dLaA zsEoctrAQOfd;1l4$uB)`TTAok=?^qcofM1`ma>+I3r1=6LhdTI?+W~)A8>&BB&`_M zEylFroM81w7%v+h59Fx2KKC^p+Ficv_mg;H$%)LJNf7djY+yd)vtr_`xStfidmKb#q^;6C}?Nx1QU)p z9334?!Tbdz9Eglx+II*{a|u{zIci%RmehVZFw*8BHZIe|*=8wC-oYjiqB; z27W)=Qo{m8qk#nfJ_HeCWq2d;q3f&uSK(nDq=V(>q@}?xOmzg2;1Q6(`h53p>L9-u z!8=>wtQXZ{-5Im_ujY^WUKMoDB0bWLL`Zj;&2jL`JA8zqO_GFc<(fK_N%uQwN*2U32e4{8jP0ckz2MZYBI)#U`kFGx@5T515(i~<?Zv*n6>I7-U0{(tm_1O7w~jG}VHGTx1v5?) z+WW(y^t;AND+c>ksH+a<95MrhKn#_Li$&3BU?9}i3W!JG*qBaObhK*p!fyKCow^Y! zIR-PDry;n>dkKAciNgGXn#EDm>NFPjyZbF;B`#rW1u8)`y;IVj1)lit=y!Q&P8(3E ztb4qOzPdsomd%e@g}Ac6RK!`;eqQc-N+4NlINU*QqX3dEX)7sz_}_ki+iNl?t%EF! zL3Qy_M7>Ef2AGWU`B`tOZbmx|LtsV5PDyNB+#*BpN1ux{qB{TuZpw zsXIa8=0qxeL5BxQK%p_5)_+J5?CVR{zE5j_6&SU{H^1|6Sl6(;dmJ?Egf-4q2RCVV zk$B11dA1%DhhgF7jg7hPYNOO%A?R3j-zRkh1DKm1jA726VoS%Xd<8dHY|T|6;h3tu zaw_cpZGeRf;vPF!fZ?oTyst1aF`UV$e9T<8hj}3|=_XH)Y}omQl>YS!YP9GzQjTIOKO8b?!wbxXAEju+Q zuZAB)=FPX+i!-9FcxLzET5O8OY^%;hS~CD*#H}Gre&sw{D~SiHgEA=V(O6HiZfJfq zMqL0sGoiNurQ$pW>V%_3U9$0nliuyy_Z~Un7?s|Z@f@xbop4E_RZ-|%JB}LfJ&TIO zx=;HI%a|S~Hi?IahfZIPEb>n^pY}VUui7E-8ubX0laf9L-9X1Cc?~c}7Bs~`8puw9 zf*eMyzGg@?_I-8LsI=k9 z4|s;Qs=xNm)>!6;HWgGGh1rHID|+wx-WHglt7CW^8w<|}-I~x)VTL@Y_)(+zKi~zYq$wy`@@hU$p1dmfV(%|>P{U`&>LvFK z3S{v$6AH21Z2`*r4y1MT(NtJxV}_WJyZ0?^%$8#}YQ8iIOdM~Ft4{XmPV;Pv&JY53 z*Kdd3;b=pbkH3)?U{2$}P#i-ruHse@4mloNp}737h9gu($?=bx8`j`YDJ_@#QtiVio z%anY^vbc7{aa#AtiWp6oR9v@sYMwu2@5JV4qw^zReC;q+PI^h&uelSBeiu#eWrDT) zj7;qA<-2Qo8(pO;OQz=@qmOVLc5JG~l?gBx(8wS=_#Pqfihhd1_Er*NhHQRm#0vTO43iI>r8}dRe)GuF-M869)o|{Qu;2d zu&`d~vyL}grdY!e#P$tA*&i<%b*8?+wvo`tfOylfm4G8=(1KuMgs=4nzVPc5NWYc* zifwekBT#oXCgpg51MATO2Xy~7tuJTR`InpOEz6=+Gg$Yqm^yc5dSd5>vqR)Kpym9H z#r@v(4s;QF7fD0+c0RZ6uVmM0->bV1p;JVW=JWA#PU#e^T(ZcRFQD)fuf=@_i1Zqd zHNUKDUd^z`ccK?ttmBY!ydH^PxB#~S8rJXT+ETs*Sqhw^_2B|$FzXv`I&aNYQQfP3 zA5iW!je>&M&+wZGqja}rrs*rZzqqpiE|Bbq|mGnJ1|u9wB7##IGI!~o3*lU%(SI!78|ar0X3 zgi98ufWNjzZ~5rKcv?cVI~?71cVC=hgUZLy!_33$VW|GJ-#8zwlNXwsU5|-1e=jGK8Yz0W ziPQok<+#H`$q=c`p%5^^Di$o1sy6!OGf&UDgVg~Um#ryQFk)oD+jxNd<>rLuw!Czj zF6JML<=20U;Cb22q;d(+(qXFC|Hl8V0#s>)dt0FQxt^So7o1Au^M1ODYgGC{I7XTqr3N=nFBTBnAnQd_gRfd6nS z|EuGL22#k*cDrdlSAJ9o{unUBcb>GsZV12l zh``32VnT-5dR2C|(Ov&=mi{%(uZbIeGPnly55o*m+oqp+75ni>_+X8lH%jk>J2))U zhuJ!XEEcH`najzY@zwX>Ux`_iQ=VVGWE8#BeA1cl+Q3v%Ax5s^Lz}Oi_&Nf1>varF zGBkL*sPT&(r$faHgm_a%ZclZLgPJQ8vvs-($Pt! z+~nWF2bk{)Ih&91Z|!(R#&{kk6LfDW*APu!$e%VIsvQ5y8>35g;!$!_|Ou9uQLrBcbz&mU3#ZZ@0cvC zbbP|~Si#NHDXBZy6p$P#nzd+57f_`>wb^Swdg|k1{Ai{AxV-~(1}%ON=U&Yg6fjvZ zzhnE8!|M-lU}Jo1qCy`7-%Sye$hk)!Yik;A&dMvqvspIwQV|s^pv?Ve7K*JIwgRi%i$) z3Wbg;#C$I6;4BcMrQ7C_s@2eL@*s6Lw0Wx^U)?dJxeo^Cgp$o~x_?k~3!BSAHlxv& z!U7X^4&x5PJYa_N3M3K@`cN7eXW!NgHvvMAPvV;G>icn=T%l{o zUO`l~#O-9!1x=L6VkxhhPd_w`EUs+FnJx^eSx)zshR2J39===~|1MNh`3T*Ml9W_O zzV@_{bMGg`_Q&`%>kp0wG9C|Cdh}T`yu_8|uK6fttPhk$lYBLj)T{WcZ^>f#x?SXD z{PN40PeGrMn7?)-?xYVsnPYe7@vwAg=c0!pu~Z!7k$U1ilx#F`w9T^y7Z%q;S(fXg zbemy-hsl0|_s6i-Xj$JS7`fTI; z(Q#nnOp-X2(-+4NKp|{#s%HN==;Eu%8^L{4sPmARG1E43Pk(S8Ad~>y@e}|rH{Fy@ zpL~Adc|ez^``z6O?@SPLe!Z`;@X@jqzCzW?=T*STMa--`utLFCH=GVAqY&hNPuo>a zOe+wJm`=@1*EA*yNj~1ZIbR)Q`6P*YCI=_uV1=8WH04Z_5N5o~1v+Tj;V;$*-+DpM zLJwTGT~+_+U}X3(3#D}pGIGzF2L&#zj;z8++llfA8G!J!BAM87NhFJ%2b*-yb{LcF zEA930u&|O;dw2P3RiK!Q)1)2f;LcT;YYuTWFY%=x%mDA|q(Qrh9TcKorWmC6GmCHO zBWo+xnTG52yg1MtI*ci9-bXb7*9wr>4jC4$Z=K|K`&8AXGKzP(Q#(|W8&ITQ)iFBj z$(|-Wu4P0mYB4nBy&Vv}_$7oU76}mt>{o6ITZf*z3$59fLxQ=eFbu~2(4t4DdLDWk z-zh%*7D;cb^H>!|q$OH`m z&1=HHn<0^ElXeU$4Ps|riXx5PVF_C1jUqLiG{Gh6desyfe#TNZ-@_Fu9=F_Q9tx)( z6*ntYQf*m(fU2?L8Ro?OlJ_OT;@!{6t%e_2H;7*>elL}Mduwa3qE#MP_X5m~?Pfb8fqj+bmQxtb*(b@6m-bkwqMccoKC zSq_26+7e$4eh3UZJ&7T{U@IB%*34O!5i5>{9WuA<0W12qc?VE>1LmUpIpbiywk@(y zW7?l7wKwI|XSrDu*%@;9du{;$8c{&#OkBojidf}~fZ|-q#bumfw186f;6HtGdBQe% zt3IA$4zMN8!W%k+g-@{op{pjDPpt--kCSE=*+hN-#z7f#(c?3@Jau^3h-i`8yVMI& zmj*DT<5pUQWq|1;ZxgDE&%&}V1Vh6*K13gFPI8x&$ZnjCeW?Hw8Nd1{;EeEW%v8uD z%ku5&AXbWoLUc)Dh$P_DI88WovY9`9?Mh44X&&dG-6dC?5#~E=x1#Iuh)>8_E=u5h z?YhALdDq7K*EvVNAuxb|_DUw|S<>p8- zTrl|QA>duX?za0JTs3=h!M$^ZryG_C`h@xIrV4wo7*LNK@kSN$Hczl(D{?r?9ZbSq zHzlqVtUp9`NkX(>CuI(8i!0T>IZp!;4)(1O_xdY6+dY;L$Bk^bIw_hc<+~L=$v?Dl zWt>Z*@}Ni!IvIK27@)@Xz`(wbvIcI>hx%1^oB(Ol5z3-t{$EY-?|TPD+UXv=T4LTB z&OBiut8v~l#$<}hELd0C542A|y$`j|_&C`NvQ2Ees#r(g#gA5}2wXAGdRHk4JC~oj z^TmKsSqy+aE0RP1G62b=Eq*n1Wu_$!jeot8z&^rJ^aD=UB`ZXU2NDLw%DU#jz zn0wwI82OF}Egz&DWAi~gj<+-~*F`L2y{2nl=FahbqbBJ3|FSf^-hvJqog}*gfUnZT zwz!L0duz6r0jX7k9)$dTOeS9-K7?r*zuVwhUN$+GK`{yUhnUWnFOHPgStY)qf)?Cp ziMK49lT{Tdmwb+037nkphP^ijKBlkv1w=izJWm(DA2aHY6f%X+PJaBzlFN&P?c3G8 z3!WOUi@!9cSs?%>fsUq5K$=PE+`ukxQb+u!tG_r>VeQD$5)_RBSkq)#TEAPSSB6N8 zJR&JcfG^;5{?_ow88O7I{k%hh(Q#ZpJCJ%PSi}!>%5{ViGGv?grQZQ#>V$kQJ*&0D zmj333K&C~<*!ySszUOyf2@ad~VFhdje;0+|J@kEVdadgX(`MSmH$M#oeID|+)4bNx zRLpgc0qKkfP4ig^TSLZUu`cuMAWez0shw2x48{$y#*9iR>ZDxCqw?55@6#&%Xj&E* zguOf}uDBVdZprM}Zl`;yV`NJ`KFvvMP;EPIPW1H4Mse-IGG&8DZd~4cQqpxNw$;h9 zmEJW`F)SC=bR|F}r@nnD1y{RnUTx-8r@=1p_kp0mY~!vGE#0~V`BP7jQ8SBNwkCKqbYnc zKZjKYBw`YTI`PP!G|&?90rZJJs_5DWt`!=#r{eAP01nsTTWi$YEn&n`rmwe1 zpR1$P!NbCmwy`r-7IJQitD45SFNg$h>t#!*X5gnH$r+@>eQS5$uo{2<>8UKbREOO| z(&@aOe;B?lLUi;XHyX1eQ|QWkTM1!ZJtJ{RWKBdE2qS!0{s^j>U%{@)naskeFklpq zT~V1(S?Qx6m;WKTQtzDw>!WE!*(Z4)KGs+2S>e;s;Yj_E*nVK%t-N*TczJobcWT=$ zeLelH&`P(P#NC>^%Ocxn-b_%PK)T)sJr@a1;h)6cxON1|>WrW9sksZ<7wouwUr)Kh zU)0gCWezLwU@SQq45pHnH2xCrRHtPz9{S^gTx)2=)7Ez7ieT|rhFI}^fv5lseh16b znr<#s{yn8#QhT%;`h0MO1HW{N{L`F)A67+ytclq$OuxsI>T67gd@0MlHAaq6{hrqc z`X!+!UsSed>VsI?%=ql4l0d6WrmiPIk{2r9JeLeQj-5T0<7a-OihJ@dhJEW|&+;c1 z#Yk5d&O!n1#Q95qrw)u;mUlB0&sh^fR;4SC{mHFo02x!zuxg~ZZo`E7li`)7`NfhYsi?$I)^6{i|MqMvlc$7UP{~9OFJ**HHtoeA^ zv9LENwGKo01SS=T7mg{s4|K#zEJ!y~1hvQSMtmARbD`_SN=hnD8@n6cwWb@9jk#ah zs;wPFoxr@o5u-_sKTDfw4tce>@C>e9qZCI^7KowohJ4r70rLE0zUV>@NAdJ!!`7Y6 zg#yopnu23?iXiL2FRD+H%%y#U29P|WfSy$z^p$0SO2NaSoN=K=<(qms#;7e?COi)= z$E*t4H%o2Lqn^A)5!5xynxS`k1eckPL%GWaa^ys|Z7= zxu2IHK$DUt-Pg{C%n&rRwS%>xWaSm|T$}j9LXLrZiu(FbYpg^XTe5Obg_~q630;Jx z`!0U&IL1kA3Dnm0g>GxBAwN_$6ValLCsYWIo?%UW>UxF!zJj!k>45V<4h`%44i{b1 zk>v~_{!xXmvk8T+tLZ>Ix;B~N68(y|DPcmr5!`n2=@9#m-ZTz{2Q?~}m)?7~PcTpk z90>h**S^$>1&J9B8^S{$8RLsREnk{-yS!Lo!91scFTDgA&J3q5j)we|aADZ>G!&1l zO3R^OK$J_TRHR$R1o#v#g0Qpp{k*_Y_;sNx(h3Q^1�)!0&tU;~T5q=NGJC@b*1d zMAzL|Ssl0W5rOF355*`2xrqgWFX{(csmYAQT2=7M><_+oG!;CIW_|>*IE|O3An2#@ z^Cvdq3#Odm601&(s5$>s_evu7O)m~18MWpe&f^m^c~Pdq{^Dn8XW zjD2*B#K+GUi)^h2^3^8j!I+vY&XVrCa!1}` z!dA)4l(Uf!@MqxEF9c24VEtf>xs0m#>8)KfIeUA10#sB2l;2ks9iqu900Z|UV3k-X zd%mPVcfZ3DSBFwrS^2}v?>C4vpv`Ll-{ymn*7=wah3{9K0WduK1>t4FoFP8GB(eiwnd+H^h9{a9lDnd$+*;Nf+J`zyFN|FFYffh z8aorn?LEACli}(bN0C&&sj{fdsw17s%L0n%pk@vjqeW`Ve#?7r~wfbRp9T zY)obXsLrb<-YiBh-)^3pz{G3>%wC|NhF}%%bW(@vDfSw`bKh`<)=j16)@qJ5^U{?{ z>^WHnwUTJ)1E&ICw7(PYBZt zl#WJH-C;>gTbCb}iT8JxGoS`s4OXOv zuVR;PYG{p!-}IVI+MnlCdvKQN%r29CMT&V26$o z`yW~PzqXoS=Q@N7U!-tYfA?@qs8h;145!FQ5HZ7H~dnz8autFji(d%PYyeOfDN+S4CJ+6Aq;6^#uCQ3(S6dpg0 zk<}r4@(@sTwGOvG$4;R6l>_;umX=gguTp zqNqeF=a>U-{Ci$}@A*=RgE>4803`#lD4SN{ePkGLa^ec|u~fT?PtPH`8X9pQ(Qf{G z#umv@MGAB-xdSdXe(E_jr!b`C!)P&YGinQB?%b)32l+IKpw z^y}@OMYGme;L7F=$Ldj&&w_V0gOG3FCIlE79`#FvRSg1|bqx6WQ z$SCA`PGA9{4**l6;Pq&Ff7Oq#FAnS$6BG8l^VipOi%Uz4M@jMVvLz)Yyv{!~_I7vQ z0be;hA|mVS*Zbt%u-d<>Vn+kQ)pwfD_~OIFI^VZBL%6!RTnY>xU1g;ZJ42}wA%5Y@ z)X3-Ws>{XE|J);sOo)Em>3h2o@CXZJyemuLWHB(WBnECDcfX|^7@QWbl z9_)x^22FJ)yx!-o!VYsNjEsz7YRw#V&#|suyVZ~(^{)i^fstj8`n0`6;lT9g=mm)t zeu&_jOg&$@mL}rUx4r`KKp)Mkdc!&2(S0GAxU187s2Asb!6{X^ax?|k8)j1wVbC0- zP~hTdNU(ckWLSO@RR<>D#IQ=&P~;xndBlV#gRi>w^q zSx-LPZ&Kh{>}DI32L=WX_PV&$Ka*fg%{1ZPt02L{{OUFysWbK|GV&VXUVrG3P*)Cx zfE_IQ1E3}mvcBIO)$GIU$#vtvNTcqya<2#M7uV9@o;*EJU;zNZp^lqgYC#> z-!&#Yh!$40hUf5)57ifosHTGnd+2PqFAPq169r9=h6^CKo47=Q{hwK^ON4*W-=`BXQFQhN^! zTIn80^kEAAJR6M@s5q>n27);=v!}wenbr_YeClj=?N9yY8D4T#cGE=oWy^gTs(?Oi z^cnfe<1)H>()3y^7boR75^0Z8F`3?v4v%Y=f zo!DIwH=R%woiWHuDfn3BB(Y`RvYWvP%E3F- z6X0u~5%=F@GhD8)I(Dy7@Je>p`0>%#R|w+AN%K&P8EDIIwwkYxhso${F#XOM)aqOv zv9Ym+Ll(;dEM!5PR`DTJhtoQSy@?IoNIWkzJ)e5H-|Ze7mRjI z?*8@ufd9xe=K@d2P;ST`v(SKR^WT2Jn4Z9{FIO_ICp*1Ws!&%kf;ox&Sj0of(c*|f z-k!VcR}=X#4?~Fx6l>L06OUfyzAWqrDal#r+-d&y_mJ`5Zi%l5!ENT^=Ph_n>(eF; zNoaqM!7fbaWz~z)dcCIRe6d{VE{eO0x1ZKOKTKaK@UgVT+8W;cc9G_pgzYIvqY2!m zN2~LL{ASrpb)`H|e(>2zbcmTCy{@BJ%($F)sBKYtnb-63IrI8spj+ zBwCZi@D0U8I##~BFvR|_YdZ;<-{0f=_l<8Zp~Ksg{6nd{yp;k+nz@2zyu>5+4{LSm zRqDs1-*n}pD7((wL&8ZM$JYuOl9SkAf+~n~a*E2lmeGWYo5Bt1X@}>|(-=S9lS1cn;l1rxIvaMjUtV z#wx_I%qQ%(X8%2*k+KL=tN4+Sla)tXK~&=LFZ_t`Hi=qfy3BD(D=VF{Pes@#JI9n7+#es& z(_e4LUwyya#J9FMjJEEXzg_#PHE^{rvHvK|quWj!Zg4Qn_Jpo#NZoe009X4M3)f|g z>3mBh5|2s>QG_Mw>b%|@(D8fyeYs!;4W4gj+*YV=@>&px?I6%dXlPUcfR6!0E4y#B zk-o}$({&}HKk_P>2sL17m?@#?Z&H>Z@Oe&#XW2n-b6&0LWH;FJ{Oz5~7t2%VJhQ-g z;p@?#es#89W3wiZtilmlVcAq+>tS0dg$DG{3UM)WZqCH|@G4!%%WaYS^3iG8X|=}> z7e3soMR4mjOx$y|9n0i8T%CB!7RSvjY80JuBJbMTIT}n_;FE(*3R#T_S)Z(+5##H< zv4%+RZ>A)xy%)CNeuvx%9hIP85+xmellC3fU)hj_P|}$Xyq8^EUuU0qW@`G-#)d;V zO*r1u)02gXDR^OFf#uGf!G-H%e*$gbD7i7J3Bu6?Ya7Fk<48W24*O)-eBqlsix+!x zXb9R5Z?a z!~#9CeetEphKUUE*-jSsYA)aUCYhlwOXO^^tjUm8=eqF0u(!19QoP}#q@FWtjjWe# z(eL~7kL#p1cMCN!Ms&$nI^y6L4Su= zeRMm++C~q-K7zi|4H6?j4N3p)HV)hXWJy>7irC2)@#v2^0RH&gojz^(!m`D2ceb^< z9Z%cw9hk50 zcWA<07hwGW?SiA5d{}sM0NDtrz%Xiqv*|G6Wgx^v7McMlZ%+ znemXYX@nZCO~$q7|BYxYpNEmjhJ4v{g05lV14ULkVR6?q7Qi&b zfmS|gQg*GlrY!URxi0}}$s)Mv@GWl)WAERA!dwFs49t`RDI7qJb}(t*7#0S&Lu2de z>f#=B(HE9B$t?|j@K_t*;9I&XTiZl0JvewFb0rZQO-e&vIkXzIxp?+Gi~N$}Zhl&- z6~XDpC~u5ran)OMBMSu|(4GX=!L4==#%7s0-&&O#POD7MX2+L4K8&@y(LC5A|@XFqnza)NIW2cg|IawDw*cTda7o(~kw$RF=hK)&iB&iIv z0IVqDDs9Vjm*4(yDZ8LEcy5js1P)21sb!C99%Xjq$64oTw9WQCON$|EVy=@rW9lVk zqWe}C^NPcUhaT12wWDbrFbW2_#WE?s2M&@t2%%HWKFv@Y2=_Q#gZ>Rx%^^reG=j;t zXd2ayjt=@3huH?NR^ihRT4d${0o$?^r4>WKM(Zob?QW8~*y5!|09#DcOf9f73a&a@wtL&Nc$uBU90JI3(TXyHhwnlF?7f$CWQUdvK@B-E1f7dLHm%Mt)`=sv~20n z%f}f+Q@9gwhk@*rF7x50(+Ce5^W?2BU-=pAzNAK;r@W7n-qMnLmH%c^uW-aU)9riVf{q=1?gB&pk;54&7a^$&Sc z%{Psr{F6s~a@d~#hYO%j?98=k_l4?S5-AV{1}JTVuyhZWSAMVtS-N^y;+qx=tduHU zQX_%$bgDNo6lLwC$MVP^1i2>frYp!)i3}_5@Qi-SzNHg5I>4m1A>pcXbdLVC@8O9Qm6{eFqRBjoeq81c##S1=`!PsKvbIy0>_K$lNhA z|K?zs@G6gC-F~W?&U;n}N)he`Ij?G3A-c!A@3~m9SMy?hgwrj)-G`z4U3&&37(=bW z)2&t9+cGi{#7|r;z#X(GDFV~EK)avV2P(GT(gl>`YZ~ZI%N>c2R+Rf|N46GU7VPh> z2P#jl4z%GvFyXLX{NZ)7>KHy-t*P60fy}K+f`l|8>vrSU3F>1rGbXRY9;*)~7oR7f z`X2&%*^d@IP1R2gf==@H175AIhoeN~wnx*Dn*^U7Z>xfuRu(A6Tag(JO()HK@&Lim2U{xg{K=1HlKcqQ5Cu! ze);(%a3*5e!FH1R;)d^y0N)UTInQAuufzBqW7BzNR@MiBdrmp094hbsRcyS-A3`7T@V3VM3@;Wikdm3{| zHu{8%+F*cTBQS<`P6bMdE0XHqN>1v&Yl4jnBU%P!h0aT^j0-Wk(#CSm+AWo%&&>u$ z8&{y2imE{AgL_5(w@=DWrsJ@9PEd5X`z(fU^P6s&|9Vdud0x3(0F{_FA6~Q>SVc1! zn6(!#{BlbvRf6!HQx8fL+n*=!gMgHELc+RuP?pOx1xrIgat`c2z5)ttQ2@1y*oeKL zWfXTXz%wfX?&+(m=H+o%Ytr{CBCMc4T6y(Yoi@P|>KUwFT<(!$pqp{RN8IWLCV z^wk9fhYs41@tMF^eOnrX=mWZ!OlwuCI1zA`8Z2aLp(njca(oWB%yPJ1Am(JtE*$b; zRNk`^i@|T)d|A4+N`@t< zySsppRd{cIpO}yzwAb95PFsFe^Y>(3kMQkk8Ksx4+hEESt*)xgy%a7k7Ir_8rH+f|rTo;De!k4af+-6+WAkA#@cWQ; z_FF5FV$Ql`CVe=mJMKMRT92z;A7Bey5ju{!ah*5yobbqWwAVh{Y7;j6&c5`*i`Oi< z*mvE)Gh40sxz}vAP`UkrL5aBfo~JC(fI9{dn9xQ|J9WbE;6~CAYh$K911c?IH@?LQBHR$#)_aEierq zr8ig2T(=pUz53x*t8Y;q;D7xrLGugH_#jJl^>-_LCA|szb3%nJw>Q!(*d_EG-g*cbnQpT(Z&Ej}21-8h zpV+Tx=+SLnA7-NGMM15Fr7G6gXnXKhW=OiX;nLMTe`Q}&CvJnHS)eCt*dp-nasB-b zzG%=BbZwOw2SDV4jgQaF4fhy0c}A$UUd%Bw!A4mV;MDnp)mh2iU3gc~9;7vt##F?p z$mL&!L1vD`g`3{{ zVo|so=%_DmA@IfRfKie@uK9j`oB5ACqW0a|X{Yf~13dzvV#WX*q6}Jg-Yv97;Gn9I z$*ZfYvkD68+|2}F*h!nNV_8q1#m!CIvZ7kvubrKP!@w%HwHw&Cqr2!aA==+Wq+j-O z=m&6uO-h$Ud|0r?S_@uT?olc*2)JM;@Sy~w7@Zw#etF8p4-o1y4U^FCff(l*K{uS1 zhu%7kpE|gG)&6;y8GN`dZ1Un7DpCYbRp-DBX7{8Br~|-lAj)KxJbu1`kVsu7&MBt#jEQp6=vC0+DEpV%?w+YJ434EOYjhNBW zowdn63+YAnJ^BV*mAR89odA8>m(+ zYp}&Jz44E=c6bTd5W8dANkUg=W@ZLhs?RAg%;!A0y*~(Dww(xh(*l8 z$QUGOP@KA6_ApD1{+K-k^XT~an1$)~pCDc`(-;P_o1Bjp4gEc=m&GSDaf_zv4S633 zmMan&6;-tHGZ5aNDt^q9`-0fko}PZC!2cR40gD>s>yYgYpQaq!1O0QeSd7M^+56`u zn!=(3;W{7rp2s*fltz6$vsz@pos5)3jE*L%fSFNs3jY579|37ca?g`5BU&cA@iMuN z)WB7(jJCa-@6{`8){SYhR5%p3KQ?br+WTPn>A~yR5!S_-A4?xL$Cb9ybh>?YYG{f5&?&$Q?p<;FKL~+KkyO7yfN9y5U;NR(73mAOZfC-xc=H%Og5L||0G&Zsuxw`HZq?pwSa-)=EQ_+_8@t~oAN89e%%N)$k*GI!8m$U=Qi|Hf147_@2n6m-&{m}qRMvUy>vT?rHv^Q zPpG@eI&3bSANT0+uyPy&7wFv$hD>kNw)FH|uJ5Kd6rV_yJdxd$vK-{+_EN?e?2yiE z^PCmt!5o63$`BgQ?*P<%E`Up@1N*UASp<;r{Aby@xi~Q`?d|Pm`eOXA(P^_LRtlds z8HS(x$SaO&ns3VYeczd7AWu~siKg#mT=y&{g+?mSa&ku1)z`~5XphUCqJJb}RQOr| z60?6F>QoNs7IyuI(%8Euik?d@(Sc?WaD!ReCF*Y0hEn;B_sSB3_gI;2&c{@pY*)Nl zwq!wJ2^1aGj0@yHx@T}L=!?lXe>EvGVUBREIVaIlz2OWbhZI#cN@Hhyij@s}xuDN^ z?f$tGk18$Cyx~{3ea>z`sn?6}v@ZlgR-7ma!14rgE8TCiUf_a!wp0KHYnNNm*M(<> z?NUDfYE}k^(>>E<0sC}Uo*<)!k6J}Ho!16~7QTPCoc`<#G!pZc=|6tMKJ3erzyGC8 z=uq>VanH%H%$C}tq4!mv9rKEpCeEiHgxz6fKQ=$sVxp3152>ax;Bj`-Wb}73Nf-W{ z7ul=-+|JX?AsQ9wxd0**@OxPTDs`<%Nnwb-J@wZy#ih`OL0oSY7_-4Yb`-1aep_wU! zftNP)C;#?6PHVov(E_X+$B$h(%x(s$x<;vR=*e!Nr>KW6nSzR$2y2UH4RM1M3N%$( za((+nZ<=G0D+z%^pzqJ)+4Re5j4>G;Tku{LnAQ25b`S3GNnzjekk6)SJ%o4T8`!t`_OZndQ-T^YPb z{_%lhErAl*eJ=CpU9+UT%V#nT+Ei4oN}AeG!R^W{bfM2wj3M5yK)#Wvd_(X{2vFv*EKxtT)^zx_l_$}X>lw0Uhe}`)MF+!T2)Tl zB`;GryAch|gs|m1>F9bRx@tDTYY$_Bbdn{d!D@1yYtgTut0?vrC(|VLF(B>F3bCko!f}v2_><#XDD%T&(Ku%4zlF&iM8U!4J;{tM zl@DT>Vj3GIz{!jl92yEkXFCf21N>OFAiQTcQ^(q7zN^h0w33g6^u$LC(fEw5!NiW& zo3B*o%-jB(nvnDhg>RH3J>UG?k!t#7corm3>g!PEHJMDh?E#2qUFT%?a49-kla6ej zDawrt!FEiGXsme^3jg|Lle%41we0@YN}H<+24hJB@S5ASZC$#hSK_n?{P zphm!L7&ds(y#mS`S$J9N%OBtW%soZ77L=@BamDs)FV zBzKrNIh%Jt`^k$WlYBpz!`M7l48|Q;&Y}n^o)mZDpz@CnO(b~1l?Bzc!F|;)Wc;_X znu9{xUr`aC8iZWC@jeoOdcifocXN2Wx5~kT;ZV;{2Sw+N@q&8Xjk4U&p#rd zIej98F-(P8K|rDQsc>sK8Y{pz9roK|kBgb&5k^BGM*w0n`yA_A(tgS$!$F-AE-0bg zh6>ghI<7G);LWadL;AGM2U~Rh+>I{O(CbjM3nygjWbpFP$AnYeF+K=F9`^R0OB8G9&EbeRw9o)u-S5>b<9&{m_d~&@s_VyCxAbj~s;Rj;v{s``dq$;Vx zgI?~3qn%tOSbw#TG4#Zn{_fqOmV8jnAj(yi{I`A$JOGyBRQRXccxS(zu1FLdeM)!N z$qqCZd_+2&n0|9B7?1kCWZHJci&*z$tdpPa)^-uW;0Cv3km`V+ITqCU&k+Xz-OfMx zqXc!bz4FGexH%Q^G8)~Cu(Eg}P}>1c9l}gsU@MR8?#o7y_0$ttOCnI9C)*bQZ-*=w zP%38uxOEeop&`IHoSvSBtt%qy1{8>ANq_U{b2%U__Ib_kOF2?YW@i55_6>RKK0D@B zVN9zU3klLaicBLo4R7TiGp2-`G4;@8_hi4vd3ifjo?)57ch@ zv#HZyDND!uH-tD6BxaM5RvBfl-f|@P#hShsOynqgXg}{1YQ)w8O5zIdq=R4!>tfU& zZ$zNXTH8!j$MmKO$$<8B(ze|$w*L>t;eH*DO<@+k^>3AqsE0{W#FjU#v4caq@a z!;)|rCm~SP(RpUNn-IZKt#W>J*HrWXFs7fa9m)FxfGLRx7Oy7G_@16!a zb=+Za!|7#w3vG}>oIpXHiEfYqw0;HyIsleyDhdkphJ8)!i3o(`JQX|H4*tJU;UY0G zLZ?u&W~9;doxuvkfQHq-dRvW_??0soF}H2QbK9W2}& zB<7E29)GPY4HRuiX>>z1J?bZjpC>)omC*ni9)MpEGwQuurR`Z|?f=PEr9bf9uXA^E zV{QALXa9M)&aX#M(#|>Cyt;P9+TFU!Ewme})FFs0KjH7-=*%AzSb3U+b|> zg0*sXu;7Hsv8F`NeW;kKgJUQ7^B{z;*}>{YZo{i)scv)n(_3_-Wj?T^8l1} zoBZqezoknwQBqBf!0{O_*+-qZ`@bQElI1Wl&+YdDyYc9joRyXsOToBHPZzLU+?#e6 z2^Ks#qP#_?cT};|kqPkEC@tEUU*1t57v2@(H=ug>4$3NDkT9r#&DecvI9^tfzc~Lh z`WAw|s(|cyn|-r%Aw2Fl-l?%unggx~0u0wSjBlT#2M6!)`Z*i~p(qDr5yE^W{fK>c z^yWfPh<}MS3UF;%vZA06KWNDI zp!zo^xiK~t}8OR;gB?E#aNOF*$ zN?crAC|8<*6y_iIYcBw$W%N8VoCoQ{Ata$z8rR-cI#a((c%(BAP#U<;ZYViwLxh6H zL|&G%D0dD8{wKxuYe`-auo%_}?qdE2qhKI~vQWUz@{|Vo7nx5XJQr6HI0a8BZaZHP z8Pg?5zyu0spN78uoyGdc8vNHX`1&#vvTQtPYts6=ApgAat0S!TIQ|rub!s+)QPQ8{ z)bRe_fAcNFT3oq^C|mi9KR|&VAf1q(62ZlPp7z&c8%WcNi>HGQQ+ZIvXgSr*LM8%r zMdW+6&0|^we?1j=z2kS@;1hEkfb_zCU$3#|hMyy~%m02L2NB4uya!1)!1YIow5>=W z8vvV=O+Nh#I6#4s@S;vNk{l2sE`R?!;x3k?=VAAEyn_GvJOmd6B*q?HE)gw$|IY9e z9RuSLh+Q5(&E)x4Usbet=9#-iOQM&dF4+K_+VkYPEbYjbmRo7QqP zv9a4|05xh`PWu_8F@XC!2nq%^NOgMDP~-SLxcFi8{>$OiQ-km4jUWVZ8s>7YqQM(T zi-|EAYa}(NB1lzSevrVf-FuD!4kj9rL+b_3Y}M-8We}Xs)5rx>>CvcnJ(%1&D~McX zM3&t@%}*4rWQEiO___iAp~vZq-oGpP&rOs1WoFXuW^Qdw*J^xJqf_{$Q8aNTHN6E} z-rw{|VV4ajDXH!;@Tf0(YIiPGqT<^}=up}lTICwmHwJ6*@UnGKEF$^s z%$CuKaDn$b72AlIAL%b7=2=IDRZE8M`-BvuLq*>L<)bS8vlyV_{^z_nC?H@IfT5lO6f;Uc)p!ueh%@O=9z&aE-Y7LA~k-))Rkzisum8WpEkdYpvs0$2zdhV3hkan~b--8n^Vtq@?cH zOkGcpT3EmxgP$voK^{H}9fhKF#l|NJn~on5ry+o1OeDK&;l{Y<`=qS{TG4wX zFP~|ViaTX^Z)51z<93)U$(|>g%$8B7NmrP|5yzF zxRt-%Vm`LD|B36)j8;Tk9B5`Vh?gv1&tJaMk$K=2!hf)w3~7c_-+GrJ9?zOJR?*bV z9B2$$E2VaJzB1eIsn}e+c+)&rSR1)G-7N3wdW-JDmf!t&)0SE@pRlADKAhU5o6EI1 z%j>yVPAhIyy^?y%f1i^7>H5>tnbL$JOtu_xJ+Y9tGbPGH zv#Szu%!eqdyIs0S@GDuQN3n7|*V=gwDFJAjWpdtdc_HnCp*EaaQ9hffVjAtt6#9q{ zj^#64pyw!CxlzShIQrc--+pLBHD=i$i7U$@G!vT0a-2;AUe zAGS(Kf@#XP&K3VumrdqR?+jdSwM(Gv;xS?}y8Qf@Lxj*U>2Xi!F++%12#l+3s@SG1 zrmb6})+d@Vq-&p3e5k%juhaOyw(QU zG06Ing-&_2k`DBITLbFKrgFPvNdnZKMqW_(C+wm>reaRRaaeyO2~z$9>kn`k-T+Hv zGSW+#tI8(gRy~y_%3>$%?;ssTpY1f|p4=WqC#=^Nlt%rIdfYivr?N6ESd01pT#kH#iRs|Ym`#Dc4boqOwZAnYm_yp7;{!<8%v=)P! zB&dMLZQDB8#R((i3Fk=vw^wi#fjrpR+e-u86>B%)69&3Sk*UjRo9NT(d0uOJ6CP?e z`rS*1KN0m7_Kd^_FE6iSMZ)sdH}`4Y=4iiO---pG!ravI6qEQp5Kob!s^dFyQryRX z<#|pgyWmXsCe8Z?dVJYu*VBCle95#W@&JvRh+L%xIrFt&B`6LX6QB7n7VP3!b%^)| zPEF2ceUrcDM94+1N8N#ZkWFR^ObQd}rP`Kx&;=E^%*W!vVK>iGI%^P_So#=i_cgsd z#Oczi&Uj$mXW57F+~&aTr&$%>O*AD%M<$cG_+NzO=IWay#W;!&iSEZ8lqD_wdSWpm%ZoYe@emoBHSVl$6`muiPdt+GHQ`y-;he zi%WRrDbc|nCcb)7)oNVoew+mRb+kJau+yHH`xYJl#=_PlgzYmK2e;cvPEMuSadn-P zTf=cTs)35-z;a7cJ9lB-NG+NT<(#l@NQ_@mS3F-iOHec^`;Tdt6`BpREla1CXwuD(0ty^t7bR}gGApa<_77qceZQ> z*N>7tWfhhR)M_eKRKM$()_D64SN`%|V2`A^8C(AKV0zCVCp+Sh2pV%!uqJ{wR%6+P zM>UuPq2?{ORI;CkiWCCm=KcVQcaMtZlS=1#}|bpHI~^%?ma^!siGJfJ>5%IhekULcmc9>J#xZ6QXU zO6cfWT@6-vvoX?&tRfO{mUnao9?C`tK+ePv7YCJ%{tqXan z(uM05RsrqzHGM7D&HxRi*OHb0Bqb@C zT3wBro7}|1LdPa!qE{%t?seW`+HI9fpX^cjeu@x*j{uEpaq*Adj~op2G~~vAsq36| z+AsU{HF5K24I+fN-EyQhdOyd5T|i8w4NvVTj7v)`vE2alUWYZhPX-dKv6i2%TP2Js)=!eQ(g3pfx=80AEph!)p8pqF!2BO3Cl> z5hk3<_wUHyAGYtG3ym}KeFq>ua<3C)PUM++2Bwn=B=y^>briO z4s73{4WQR74Z>%*h$C^$;UBz^YkvDk0z9govlQ}VIFv`K1fOYz2P>;Lz!Z}{C{JD9}kNCK#IN8OF*IjuH z=b=L_EdvL~)9)O!TQoCEK1QZCO{XZK)xR1p%I^OV(<1bC^UOShu)twGN+^fq^o;YX zjHkZ^xhl<~rh%8^oVSe>=bSi+i3pG5g(L%v*N?m03JfOVB~TS8gNRvVAa-qZv0Vi( zqo0SYP?y8wmC1gL@ey+WFJtuYx84I!^z(^oPO(XMZzEUKb{@VIspkQiJ12w$c6g-k z_1>AhiRg0Katl?-X8a}RAHQ@Z#UC2R)CYBkZmWHx z(Zfqy6iG>~9`P9B^7R#dW)8xK*aaurX|`+2XIhgf7_HR1Yo_ckGxVAXYY}vfJag{O zU&Vd&=xG!TCfzS?Cy)YKeI$beSS?@ACVo^@%>F?KTy9%)(jR8*d0|ix!Ep42lRaJR zekSOo{-yDCi}31+mS_@-uXYl}X2`ir?2*^VBh9M&Fn&`)nPes!BM#dCF>wF;dVAk- z8@IhK(jofT5frJNDVY>zcDH*&K?NIjWIS=TUqYR3am7;;yGZ2}l^fj&Av)j|G(70k)U5jo#EL_2R zb0}t?mkS(c2MZ9YR{SA1;z~p8+r~m9?ZAZFjQ@$i&HZ58_9U)~mW~XzI9LQYW5%nV4NIvtEJszYcgd=?eVg1^I0b03T4H65p7ziC zE>EP#yFQa2f4`#RaK^u<=hI5ON5(L3!>LK9nd&l%cJ>!$`FkJY(q2`lX?Y?<0XaMU zcnTu-Y6(b(mII;oT=kk#EGe}LQ>!X=m#Lk_`hq+jYXA8afS)#98oQ*^g0EQ!{N7 zP@iSwQvjeHh&Tb+c6%B?XHA;~nlvKRUqE?pAC4UF%Q^ukYPjG!$k3OYk20H1*Yol1 z{dgwyJTN#o3m}HC1qI(@1*6?16a*RlcUdHlA4>zyWpsag1pYc;R{6Y!X@9@5cYI9n zRR$z-#etXg`b@pSBe8Rru`QSjs$jFAt~=|o@FVnXfhwDh6iBXo1tv;A7&yC zd|n!%N}Nd11*5&|F_f<|M@0Q54K`_!30N94*r-G`pMGfD zPKAs>KM@IdB-m;O0#9`&%*^kZqbgJ}u9iJ#`(CGokzrxABKH88iGj(DiF$V)_v1+? zd69N0q4%48>1aOQ6Ve}7Rt{^PY(`uT{RZn_fm8zV@^y@YBC&hvFHz1F0`X-`UUo*a zLS$LpS(i~vr{GLHVnPc45&Q9Bk5pPbPUM3O>9^-872(gx0Zh_|@q95_>&~tNkTC%E zND5N`UW|oJK&L9Q7V!`;st+#Cw=uB&6%wo^U%kQ=+A7v*@=js@M*$_ys=V_n55~x_ zFd?f31Uui^O1iAfx{huF3I_aIDA!j$dEi1k^&UpYdEtkx;th@-ib8+@53s zIoiTfKRS$lg{)Vp00Mb~I6G{Kp;63FDbZ^S>x>E!l_dcYA$vz~i@FnaaDp_b`xbI0 zX4dy>^s``Y>&{t5mPS%BGJZKb+N7x~77HPf0gB%E4j$-@Qw@ov9w#pogkAZgCsylP z)qx377ycG%=9hVnZ8wZnse5*?`YT(G^lT~K%2p$=sj<;k!*hS$qZym0OM`|>{zhOJ z*LL2?)cehi$=a&X&4euaUpJ36x=X`D;w$D?gB`&QN1ogi!Pf$fp=FWCXL#`- z@qee5uVxOw5?I*SFB7>Pm}7qcDViL|%`shKi~!K^o4~=tubCuXz5Z;C#&iK^TyU9bZ0W1BeR(=&Y`Q_I%Hme%@gBjWf7U+iI)B5D!GM{h^&h zL?J+}Bi4X|8`>uTro@~fFvM*th*ThHWIZmB%aK_vJy9BTo_Nr>4w8ne^C1FRGc($| zPK!A(G0y0TmGaiN$e9oUGjUsvZW(dAh{fsN>>-=k5bm&v-LS6R@HD)d)TUY1Zdgis zSZGwXo`L4aIla;7&m(1?q%C8L>49Q2=D>O2k%cCea2T?96LuW;Ep@X=AG-!mVfYcx zUDXBtpg;nm*N*zcNmEagyED&oeU=_Ag2K_R3fYc3!IC|sYN8z{s^i8cMrQmYe-*%A z+4Ur`Z{y=?&Mp8|3m<6;Crz=Lt=d-6*0;KKbOSU;O#SdlIJ*?By>`1^dZXpXloRO7 zgr`e)ylkCUdQ9OICaSEdl_B9c^Yo~7hTF3iqN4`tdj;O=6%B(q^tUd7zm{2Q$p@Z> zEV8}jmdpFnPRn0M`JS1ygz@H|UOF0cbqjk>?GWFDW*e8lvQ=}Ah0 zUy9jn=vRvIL@&($xb$4K`$*cphvF%|$+lMW+^!KA?)S@B#SZtFoCF%}J2ixz`LvQx zMH#L}R!eCzWTbRpqGAsqrTE+TMr7-gVrrdw;}fH{&=-(vdT*kd(Tv|QVd`Vxvtc9g z?VHW_cdtOWEBMXjTCL8!Au=!2?|Jqh@{MAls?224x(qVm!;iQnaT=@`U;&b11Qy_6 zQgGcVmie{Z`C0KSk;^XXVmr~~SJvjhuW}c)N9=B_U}dY0(r=qB7fv?XMYS!vGia8+ zGI^$?m=BK{X^I->o%~8er&ceupc+=SU*|jxnhpzgsg~oAdejpAE!hgzlAs{ZbuOnz z%h_?9HfdORgD@cPthAbR5wY`@*J&%^Hd$wl9OQ6~yb-G`oAQ{?e&tL5XPDT)z(6Dc zvr3%-roe@@7CkNhuCJZuTB;k+XFC9kw!b%3_^V!9@C$_{Umv17AzV8jS&m$_i@Je~ z2h|ZXO1Die{gSgarHI|eFT_NJ<+{4=_{e@7scfbBsQk#!Dc+@#pX`q|)dA5a25b4$ z;1++hG9jn)PKtTqPBps|yepArt%2BX{Lqb_O7Jz3I!t(@vXE?POZT^on7Efo**uyw#3c$=$Ea?k9er9SH*1slAOWl-@U$do49~E+ zM)KsYbFPIDva-Ak;JjT;yWO32g3N}Is@bJimR)NvW6QVSj4Q;BosaNcN*_!rr zd3g>^a--rWrqC%FnXk5<+!!b_pS{_RnT%8{0q`2m{wO$FBdHX`2$G5tM01;1YL0>od1!R`j+MLwWIkpGoYAY^uFLN#30;~xERC5jC&dHGC zV$-chjVuf6cP}gBz}(heK->2RqY{@2BZ+jU`eE0{e=>N*ju&$9&`sj}K>7mvJBrD$Zc&F&NfzH??=ckkmKd$_Vf#J6?O8h<8qxU^K;=CUWayl?9!)C z)1LYG4yUF_;br<#imt|X%Sr3Bcx0vZqu>>GEP@P}ysa&B0nq)w`R*=mUh?WhDD-%P zhMY)C6h+fT(vsSH6of_ri`m?~FXbHE6#XjcR9PdZ?lwpb7+&o+$q8MOu1U z`hv9tQY6WrfZs)cC@K2pPe6{O(W})H^}y=T@m6_D%wibC+y&YW`@t(qVMMY{tw9fU zd6r}Iv>NKMOtWR;UwEr^&$rCc5yV=6wpysi3A~)%+Om#m>G79(>*`3)5(ZS4KcEN{ z1L}V5P7-@tu#b6c0T&6;p+v~?gJmT{GA;gSP+t0kw~-hz&a_suu$0Z61;P>_lJk4A zcVNCX;CKruB1?!)Qnp^9++MikOysJB_{R^mJ^3&d*TnDDJ_4P6T4OHZe_wsoO#a5Mye0bx5vZS?Yx9o^d z%$F!}kMwRI%%+=tW^eJi>A46+9PcU}SyCawf)94l8hO9DitAAZ)RTR)E$jP5?Ps!0a`0?yB@B^~K>WX|Y z_)|d#JF3m6$(vN0wai_yY>Dib^^s|}LQ;;W5+y*71o<(*L{V{u(qFn_4}zSWL$I@^ z>&P3KpgdL~V6eZDqdFoS;9;<9efMu$M^b zW39a#83;|5d`A24oX1uCzQE%ppDCp>i3W+g>N|cDWIpl?M zAx^Y*JoCN5yJ~H?L$SXrK9<#{k+Tdk7f;xYqLvjT&~;(0TF6cWeFaKCsU%nvkNaNb zD)7)Maj0ENb`4&qK`wzOr0CYS8-XlHz{Ic9>c>@tW8vlw7&9@b|6A@17t5>hX1SK| z)=^usN2=B^{KZ}_yXmhlQ$)wylUilB5H&nJF4gAts-|)3c+*5;&OJ%)_TqQSTC9wA z+s4Pm!OwhaOA5~0!NCj}}H6Hr5al0N^jTP@Yg;KPudYYpk4<{omWdfkkrf4^1 zdSPwsaQ|m_>ZsKuv|vMb=S%3Xd{G`G9F+f<-}bKi+2{>}+S<1d*v%g}sy8I9?L^p) zt?dY|-2Ml0`=1GgnIY8j+IP^3hoJ8O3fjffBYPPjzc#pykx9&RnUUUhkwwA>rNUV# zZU~H~4G;78l)>bCn`|mglFM+kCfk6(7k59qpRx=Ul{YqicXl*RO3APDtb`zM=mC*> zEL0K^O{+oQ90c+U{Vjpf#_hizzHRW}a{+{&vG1j? zXN6uAU@R+>Fgrg1H7AivorswJ0Tz*QKR;Pk`yY8y4O1}J-YFQGacd_R5`j4Q9(0`J zdU(Dv?^0%bln`RFkR^915OrkZ)5Xb8^D|)W ziVM%eM~Jc}A1;DON0+dhPPf2#G&_pD4%4i1&npxta zzq>o&x)%lT+Z>59-`g%4Z*LVyVdAq5cJTA_vmy{qRMK}y6C&(=Zro@O1$^lKBpNR- zJmcNyeX4hN_|)^AnG7C7%v;>BWgb4{$RP6L$N`C$cJ{)BiRik}HhF@n>6}pEmgUA4 zk=)n(Plk!=wP5O#H?II#i+Z#QB>N*9ezuf zVW{;pNtTXqIwdQsh)EL24kWvs`TR0`M*c!G4fF$u=}LvE-JuXzPM2Hh5jgg%n=DXc zBj9QPy$!wwWftaG$Utp7Eop0rd zrB4&e%8-~m$CNogB25VqNRm^lLXZvFuzq^;OcMwD;ewbOpKc#7zYb0!FvucroE>I5 zUd$WMnldoBT>kHPF$~)}_;Kh|e)sZe>9zK!X0o&IVB_+cZeN{CAai+jUE{U-^t11# z47Z(Lw+QCh6+7`F8MD{C>aak?S=5RqD4yB{Y@U}uAh(=zAv&-j&1pJbb}9_*5MN(=#)!7;DJcY87#}n`S*e@ z7>DT*X2T)`-QqlM3(DC1^)m5Mtd5U!sY92g7X1%lS|sHQe(*0gv*+Mb}?=ZnMSz|!=R0oOd2v~C{Sfj4}JFO^(Wjx zueQ+=y=dcfpS)*v%`+!x|C>FrmjDzqZeHUUAnb7M_R8mLz8MA#vh)t*FMAbrwtF!R zyYZ5;w=brh`|5@jxZQL4j&sgo|OC|FD)}}nnq~4MzTxPKpwN1N~l(I z2Lc{W@!j7C)ZiRz^0jM^5+y}mzWwh<))tb{#6yDDc}45KEBKyI3}CgZfSP3w;JgD+ zvLtFe0mwF$CX=&G;-c~V3`eXc=epY@&8dEv#QZ|vzembcs;G^?j7a$i6{Wo&ELk_& z&eo0ihUjmv7d6}uHlOLX)Q}+Lp*e9q=hl|Fy##>Zg?H=?TyFHse2e|r+cY&}$$WOQ`SS@`sj2VmEIfCd%>s}O4Xt~#y=WtI z)?>#~ZA;$OR65c@=Ft(cn>|V@+c8)q5xOC*6GDn9 z#5^zEAGgq|)9!sMJT+hg{tL?;jC>R{xZHv{pYsj_5@-z#IRf>sahy8pNsdgH`#vBi zd^YyPbO4&UAgb<9FF{g7%;WH`wcx>nSMi?HQeVHCG`qCh;TNcb0)FSk1k!&I-M&5Y z8rJem1O>b=N!<@Z`^|ww11=8Ev&EMJ;+T8~Sg_sJ$DpDt+uUinUEmTf402X!etx&( zcwI_)6mCpZ#N*SeQu8`<;aXotpG(y!JoAoT!=q9vC~FT9KnOJyo`UK?=>T}{h6=>9 z>(RlorGgiy%meXFx;D9llyBee9LP6Jg;iPIF1ZGC+U5_}S(D&$s4>5sCkg3Pt1{lG zMn4#Z6PCzeC@Jkez-bitvwXBa3Ib`Ok{zgF*CQ(OMgb`^e08+@L=xjwR?&s9sRP9E z^gy+Z3uILC;lxcmF6d41tbf;oSSNhzOBY`Sl_V*k`FSA3$DS%TT0KiHSr*_;6(<4* z;E9_9RgpjsM=gRwVE)gqTHgbFZs;eLqu*3$ZM5t68Q=gI7h0H4C;|LC2HP(lz(-#j zDM6WZ(qdy$t+;GN^(>i@Ci8G~JCoeo+iS1LCV)6(PkRK0H{Qqm()t;9)~5k+gccw- zBC*dOM>ST4Mj6sHH~0R6L2|0}o$)D0iO`pKn9hf$%E$DZaCIvUhQ&Qp8A>tN&HySiU?;=hTsf|sZxEYCpsCsNw&<^afGqW6Ka=&`5CaL`$e9#y`w z98elSyE{gtg4fR3D=DcoK%wgoBbPP?`7Uq*G2N7~w`ZLMJm*2D zTFz+l@#Y`ryO-s9ePt;D^)%X!Lr75rC?&`Sm8SlX8`8rD_|hsOo4u(hpy$bFz`GG= zfE|Q=&;=Uk{g)*K0|0u7bWqoswFTgy{6dblYP}oRCeYWftF8bw=DBKBg_3I0!#W=I zI;$j~w5XT;h}_&6G@z_VMIP7VEjsx-yUr|zonJJmr=Rgba;SMNLH&~~ynm3Us7?rp zm>i>TgmxSgz=a-8OYgvbm75HBCt~uSJo&1nUgapKr+XLwcc?^!tUb7@;X`h+FGe@m z8~1}B@(I<+w11ceoDBIB9jmn$=-Ei-g7?v)TgHUtT6ye28!3-JpW!GEtI=0Y1Za*h zMH|PrtQU8xC?tX=P9h*DjJYU!h<+z>Voy)3ilF8aW;32Gr%Qd`?t9$X8$H=n$xuy|X z3#Cfw^R7g`k4P${OiTn_O)C@?~Hz!d5Hov^)UTNe0 zg6HLVG8S3G>C)q~llhRACb=W|MYIe!W9Ut_EvKECmr@cEjDf+TujpylaxozFw&)lb zIDK>{@ub$8bt)q;3p25q#jnT43y+{QD zzDxK%eo+U!6z6yrlc0VnPZ}tRW*A{k8iTe-bD7jGYPPneIi|&Gs;?{U<(^HK#Sr@Z*-o{9Az$(MA@}clR({rdIC^_7 zq=0$pGj=m+javh^+K-6n(T@%XkDJJM?Q(WZ7a403j986y$U9bc`AbnBNATY#wF=j2`42o z6SXjVzfe==bUdWqm454x;^K$TWz!FmEVv`xGW6bU%IJ=~=vdkd+xj0Js`<{9N+GUV zd&;~5hx{ta?w(^jtU7RIvYpawCSQ_^jUe~1li8u`ZI{VZ7i}P{l^c@j1B)rF4e{U22an~mb4?+ z$g0?LLrf+54ZaT1`pW%}8V)*`59#5r%YfX&T$5(a26+cbPQv+Tn2};R2sUb(rG0OXr6u!*$8htGNBqYs}E*WEc%Pk5?&h@Is; z|8h?<0j82lgn`^FsK2~jr0OwpclTXZz#q>w9cv~!jB~FUG|R}*YVdfOm zSm2hZj~&jZRe@U{Y#X{w7XTEqq72?B(n?$^*WOoy`p!a7>nUc|SsV0QZ*0Xd>3QE1 zfbV=H5325tWXFZ4_KQ1?)nw*>{t%b~$@(s=FXFUa2zL zI;ZbJQ2AL@(aZ@qkqy%>;*QTR%a|sQpF8s zzZ!NRub8HM+{w}tGm?I^G*kRtwa{konyuRD_gvnnI!#Lg0I~z(3eM@&2*ihU!q!sR zqqp6MG@<HX%(2IpWoZd>jNRHPlbgvy7-&A`yJ^g*WXmBvwLp)b@SYesVMIc>We#+JC ztH2kWQpt*#Fr0iU$(opN=12%yO}4N#uUieW(woYxTS+_f>Du)hsJA=6d_yC3dtLdW zZ6G4(5wVkcVcUEN|C#Zi*KmH7=C`*Dow>(qm9!e=i3ajx!A)F>Rfjqr@ZGk((V*O} z7Uk29x9C(qH$vsB7*;k>M}8uO=Sfo z6MTQoYZ)KQ&D~On<_Y)#c@tR33$JK0Yp_Yat8aT!Qec){1aWr#>%vE1Ony&W*7$`)T#c$+60eHb*aD)5|2#i~yEDO3 z5-*0^Ai}I2P(9k+m-IR&ECAC($HfD%M+|LjN`fSQCKOWvE}F%fM4Wy$Aw3|bIJ!_# zM2EL??oSMbeX|j3e}QK!PiQnXo*~eUJ`5T+WY8}q{T?`P!T!~y6Sa`Z@k$Gtwm$QT zoO#yVM;t$bn*v{nifu z9PU2V|7Y0#jNeS=?F4>zXlF?rt{au)y=tfJsl5{*8zgfh_Mzw*Anz1P^l0I$F3Q{p zr;44Xn~vmCvwO;Ff)O2Emt13HXL|rz@+=krbrTMtQ19WAQ0^g#<_x^9r5~Zs4DOEw zjmb#HEuaRmJYw62!S=g(WTvEdIH|(J6;A*g-(ZwGAe;B0O_|kn{oWc7uxN*dv6n<; zyzZW`222X~aBNo4ahA%8{9E4dsaC;}Si1m%d+ZMM2SfvALw;}C7EP)IRzD4(Niwn^ zyf6spBi_-;EyfeH68nyyF{&H`m6i@@Pa+Snk5XD>-}_xl6g7K@3bovJMNg-KCWw{7 zKAZq{7`bvnz4!&QryHGxJBZn+7m$H*{5@zpW|HS_B0+w#`RGEDZ9adcLw~!LF_WtY~pbY zAls2H^LwXpB#h}6wolnieD^s`0$8Nj7dvBF44P%4x_GU)xDvv)WdzyM&DMVQ%%0~n zOrNi2C$q=m9E0|hR1_as9&vOSW>`-~&9{X_A1*Dd1HmPAl3L_exqhSU`4`qkV6hqE zBj#O}+~t-6)MHrJs@0dd3)+U+1J68QJ+@qiT7b#Z$rQgVxvs_F*S;TN(>4ndomEFV zpqaBOJ@xs~xK)R%Etw)cqqOQgI3w!Zj7qICh&ZiNI++^kEEhkg#viCLE4eXiXM}{N z9Dp3s>nPLpfx88b3dsE#Bd@)6@v&`jZ&>|iE#nE~V8_O8KHHPS^J1WzN@-OOxfXk0 z>_j&pe!*>)j|>r?9J=5$3(A|6<7id>E{Whd%*4Mj>28)+(79I%-U#HdoS^jT%>be* zZ5f1`nh#>SZvV=dDcH}Y_wZR-8jsja*TPv`5+Zz8#qVc}cS9b&i5Ik4N_rd#%v4t(VJdHaw)_1HkD`A3S#tCEsr-FuY%#U~a)PJEoXzll;)3)R}EO zlFNErN~~I6q)_O}G8$?;Az-T@mL3o87>HZ=P^3^Ed^QU`4Vv{&Zsk zVp!ezX6l#v{oAFyNQ(e}`sCy+&`12AH*wu7W3(1>Y>8%?cIWpyf&@3iMrVQ8co#VB zp~`#?Pmz|GjsD3AwDl5Y#O+_k8Tp;|GEY`f@cz6a7%%vtD0ceY??tMC8?&vO`OE*x zGXCwc|9bwb3wInWw@tOcuMB_L{Qq{5hzmZYUzUUW-`@P|dH&yb{cCyszw!FlNc{i1 zCY-5HxTD9S*qrlxdWbE}jbgU;krKm*DG^6ql!Mn)a8h$5e zCHiENn<{M)yo=mNvG|02TJ1;tcy5U%*B*=i&Dr@s*S1$QW%1J!ZVtkb3XjQvXf0j5 z{5Yi9lzwtPTB%Dq@nRlnVe;=?Z}Y3@>#hvD+G+m~q1_HJAEU4O~yr^?j;6{dm-|IDxnV6|b zUELs*p0N`7ox|~Rh~FdYrSyccvVryFg5vvdjeU}Q>S>MP_|P<~C*oWn-c9++r6YK@ zQ>1oj;&E9^XCM%dusEu%7(r9IvVzL-H-fRv$|fz?uAX`&O;D|&d3%VyGKw4f_sA6q zrxY~2T`#TY&pF=zh_z9~ZfWdMYoK7aPg)fxjuCiBcV$f(eZI-3RG3s+UK~CtIEQ|J z$IyVP;j3gs%1b-P1-{!*4ID9*o`3Zq$*S)({tONQRq@zG{{#XpBw0j> zpd-Cysc*im>mwRw{N4FC0!?>scjnB!tuPea zu3w5D@NZ`vMpY-+vsPJ~-BZ+5Ku&7PyP2;erXPwvlH=GDv&}g;lOKI=dYT0MBkfAC zstxn_EbjfDt+H?BhzAX7=M!sdvcDJbtEY@Io+kP`6&@y=5`)WI$iJw~?Ung$T|c=3 zGpVx!>6)(Oz1I`bQj>*U-OslT^jBlx{B=0Gz#Mt{`v}pl`(}D3z1~)kcDMggr*sZ- z%Y4ftD8}?ST&fQRPvwqn9ke1X{gvYCMq(_kyN8WhYN`F%Mz1Koyo$LRu&cdx^_kzR j>8~>a^)_$zx6A8K^TX^|tP~Hffq#;svfymh{_y_+GhnEH literal 0 HcmV?d00001 diff --git a/metricbeat/docs/modules/istio.asciidoc b/metricbeat/docs/modules/istio.asciidoc index 52be7886e04..bfda2a9588d 100644 --- a/metricbeat/docs/modules/istio.asciidoc +++ b/metricbeat/docs/modules/istio.asciidoc @@ -8,15 +8,28 @@ This file is generated! See scripts/mage/docs_collector.go beta[] -This is the Istio module. The Istio module collects metrics from the +This is the Istio module. +This module is compatible with versions before `1.5` of Istio where microservices architecture is used. If using +versions priot to `1.5` then `mesh`, `mixer`, `pilot`, `galley`, `citadel` metricsets should be used. +wehre the Istio module collects metrics from the Istio https://istio.io/v1.4/docs/tasks/observability/metrics/querying-metrics/#about-the-prometheus-add-on[prometheus exporters endpoints]. +For versions after `1.5`, `istiod` metricset can be used which collects metrics directly from Istio Daemon. The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. [float] === Compatibility -The Istio module is tested with Istio `1.4`. +The Istio module is tested with Istio `1.4` for `mesh`, `mixer`, `pilot`, `galley`, `citadel`. +The Istio module is tested with Istio `1.7` for `istiod`. + +[float] +=== Dashboard + +The Istio module includes a predefined dashboard with overview information about Istio Daemon. +This dashboard is only compatible with versions of Istio after `1.5` which should be monitored with `istiod` metricset. + +image::./images/metricbeat-istio-overview.png[] [float] @@ -62,6 +75,13 @@ metricbeat.modules: period: 10s # use istio-pilot.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ["localhost:15014"] + +# Istio istiod to monitor the Istio Daemon for versions after 1.5 of Istio. +- module: istio + metricsets: ['istiod'] + period: 10s + # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset + hosts: ['localhost:15014'] ---- [float] diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index b37f7f831a3..1bc81071e76 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -132,7 +132,7 @@ This file is generated! See scripts/mage/docs_collector.go .3+| .3+| |<> beta[] |<> beta[] |<> beta[] -|<> beta[] |image:./images/icon-no.png[No prebuilt dashboards] | +|<> beta[] |image:./images/icon-yes.png[Prebuilt dashboards are available] | .5+| .5+| |<> beta[] |<> beta[] |<> beta[] diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index bd99c2cf508..b7b62643353 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -693,6 +693,13 @@ metricbeat.modules: # use istio-pilot.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ["localhost:15014"] +# Istio istiod to monitor the Istio Daemon for versions after 1.5 of Istio. +- module: istio + metricsets: ['istiod'] + period: 10s + # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset + hosts: ['localhost:15014'] + #------------------------------- Jolokia Module ------------------------------- - module: jolokia #metricsets: ["jmx"] diff --git a/x-pack/metricbeat/module/istio/_meta/config.reference.yml b/x-pack/metricbeat/module/istio/_meta/config.reference.yml index c3e940f80e5..146728fdfcd 100644 --- a/x-pack/metricbeat/module/istio/_meta/config.reference.yml +++ b/x-pack/metricbeat/module/istio/_meta/config.reference.yml @@ -32,3 +32,10 @@ period: 10s # use istio-pilot.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ["localhost:15014"] + +# Istio istiod to monitor the Istio Daemon for versions after 1.5 of Istio. +- module: istio + metricsets: ['istiod'] + period: 10s + # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset + hosts: ['localhost:15014'] diff --git a/x-pack/metricbeat/module/istio/_meta/config.yml b/x-pack/metricbeat/module/istio/_meta/config.yml index c3e940f80e5..146728fdfcd 100644 --- a/x-pack/metricbeat/module/istio/_meta/config.yml +++ b/x-pack/metricbeat/module/istio/_meta/config.yml @@ -32,3 +32,10 @@ period: 10s # use istio-pilot.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ["localhost:15014"] + +# Istio istiod to monitor the Istio Daemon for versions after 1.5 of Istio. +- module: istio + metricsets: ['istiod'] + period: 10s + # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset + hosts: ['localhost:15014'] diff --git a/x-pack/metricbeat/module/istio/_meta/docs.asciidoc b/x-pack/metricbeat/module/istio/_meta/docs.asciidoc index 0a52294d1fc..cfba8ec7ce8 100644 --- a/x-pack/metricbeat/module/istio/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/istio/_meta/docs.asciidoc @@ -1,9 +1,22 @@ -This is the Istio module. The Istio module collects metrics from the +This is the Istio module. +This module is compatible with versions before `1.5` of Istio where microservices architecture is used. If using +versions priot to `1.5` then `mesh`, `mixer`, `pilot`, `galley`, `citadel` metricsets should be used. +wehre the Istio module collects metrics from the Istio https://istio.io/v1.4/docs/tasks/observability/metrics/querying-metrics/#about-the-prometheus-add-on[prometheus exporters endpoints]. +For versions after `1.5`, `istiod` metricset can be used which collects metrics directly from Istio Daemon. The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. [float] === Compatibility -The Istio module is tested with Istio `1.4`. +The Istio module is tested with Istio `1.4` for `mesh`, `mixer`, `pilot`, `galley`, `citadel`. +The Istio module is tested with Istio `1.7` for `istiod`. + +[float] +=== Dashboard + +The Istio module includes a predefined dashboard with overview information about Istio Daemon. +This dashboard is only compatible with versions of Istio after `1.5` which should be monitored with `istiod` metricset. + +image::./images/metricbeat-istio-overview.png[] diff --git a/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json new file mode 100644 index 00000000000..72b995c2382 --- /dev/null +++ b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json @@ -0,0 +1,1762 @@ +{ + "objects": [ + { + "attributes": { + "description": "Overview of the Istiod Service status", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "Pilot Proxy Queue Time" + }, + "gridData": { + "h": 9, + "i": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", + "w": 12, + "x": 0, + "y": 0 + }, + "panelIndex": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", + "panelRefName": "panel_0", + "title": "Pilot Proxy Queue Time", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds Push Time" + }, + "gridData": { + "h": 9, + "i": "06af11e6-e026-48db-a06b-b34b402b535b", + "w": 12, + "x": 12, + "y": 0 + }, + "panelIndex": "06af11e6-e026-48db-a06b-b34b402b535b", + "panelRefName": "panel_1", + "title": "Pilot xds Push Time", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds Pushes" + }, + "gridData": { + "h": 9, + "i": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", + "w": 11, + "x": 24, + "y": 0 + }, + "panelIndex": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", + "panelRefName": "panel_2", + "title": "Pilot xds Pushes", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot Inbound Updates" + }, + "gridData": { + "h": 9, + "i": "a8e47ef0-03db-419f-890f-0880d674682c", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "a8e47ef0-03db-419f-890f-0880d674682c", + "panelRefName": "panel_3", + "title": "Pilot Inbound Updates", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Citadel Cert Issuane" + }, + "gridData": { + "h": 9, + "i": "e708abfa-5a95-483c-9bb2-4470ee913f3c", + "w": 12, + "x": 0, + "y": 9 + }, + "panelIndex": "e708abfa-5a95-483c-9bb2-4470ee913f3c", + "panelRefName": "panel_4", + "title": "Citadel Cert Issuane", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Galley Validation Failed" + }, + "gridData": { + "h": 9, + "i": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", + "panelRefName": "panel_5", + "title": "Galley Validation Failed", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pods witout IP", + "vis": null + }, + "gridData": { + "h": 9, + "i": "32eaa989-a4f9-4d31-97cb-684f31488aa8", + "w": 8, + "x": 24, + "y": 9 + }, + "panelIndex": "32eaa989-a4f9-4d31-97cb-684f31488aa8", + "panelRefName": "panel_6", + "title": "Pods witout IP", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot Virtual Services", + "vis": null + }, + "gridData": { + "h": 9, + "i": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", + "w": 8, + "x": 32, + "y": 9 + }, + "panelIndex": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", + "panelRefName": "panel_7", + "title": "Pilot Virtual Services", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot Services", + "vis": null + }, + "gridData": { + "h": 9, + "i": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", + "w": 8, + "x": 40, + "y": 9 + }, + "panelIndex": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", + "panelRefName": "panel_8", + "title": "Pilot Services", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot Conflict Inbound Listener", + "vis": null + }, + "gridData": { + "h": 9, + "i": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", + "w": 9, + "x": 0, + "y": 18 + }, + "panelIndex": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", + "panelRefName": "panel_9", + "title": "Pilot Conflict Inbound Listener", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot eds instances", + "vis": null + }, + "gridData": { + "h": 9, + "i": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", + "w": 10, + "x": 9, + "y": 18 + }, + "panelIndex": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", + "panelRefName": "panel_10", + "title": "Pilot eds instances", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds endpoints" + }, + "gridData": { + "h": 9, + "i": "d6b2845f-9582-4863-853e-ab753f3d763e", + "w": 14, + "x": 19, + "y": 18 + }, + "panelIndex": "d6b2845f-9582-4863-853e-ab753f3d763e", + "panelRefName": "panel_11", + "title": "Pilot xds endpoints", + "version": "7.8.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds expired" + }, + "gridData": { + "h": 9, + "i": "3d0dec37-26c3-490b-a45f-48b6d1baa160", + "w": 15, + "x": 33, + "y": 18 + }, + "panelIndex": "3d0dec37-26c3-490b-a45f-48b6d1baa160", + "panelRefName": "panel_12", + "title": "Pilot xds expired", + "version": "7.8.0" + } + ], + "timeRestore": false, + "title": "[Metricbeat Istio] Overview", + "version": 1 + }, + "id": "d899d3f0-0883-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "references": [ + { + "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", + "name": "panel_12", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2020-10-07T10:23:52.518Z", + "version": "WzQ0OTIsMV0=" + }, + { + "attributes": { + "description": "Time in seconds, a proxy is in the push queue before being dequeued.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Proxy Queue Time [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "queue_time", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_proxy_queue_time.histogram.values", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "03ef6580-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "071fe4f0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "0b7164c0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "90" + }, + { + "id": "0f611580-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "136f98e0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot Proxy Queue Time [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T10:23:11.367Z", + "version": "WzQ0ODMsMV0=" + }, + { + "attributes": { + "description": "Total time in seconds Pilot takes to push lds, rds, cds and eds.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot xds Push Time [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "prometheus.labels.type: \"rds\" OR prometheus.labels.type: \"lds\" OR prometheus.labels.type: \"cds\" OR prometheus.labels.type: \"eds\"" + }, + "formatter": "s,s,", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_push_time", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_push_time.histogram.values", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_size": "20", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot xds Push Time [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T10:23:48.176Z", + "version": "WzQ0ODgsMV0=" + }, + { + "attributes": { + "description": "Pilot build and send errors for lds, rds, cds and eds.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot xds Pushes [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_pushes", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_pushes.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "4", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot xds Pushes [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T09:24:59.040Z", + "version": "WzQzOTAsMV0=" + }, + { + "attributes": { + "description": "Total number of updates received by pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Inbound Updates [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_inbound_updates", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_inbound_updates.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "10", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot Inbound Updates [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T09:21:43.250Z", + "version": "WzQzODcsMV0=" + }, + { + "attributes": { + "description": "The number of certificates issuances that have succeeded.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Citadel Cert Issuance [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "success_cert_issuance", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.citadel_server_success_cert_issuance_count.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "4", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Citadel Cert Issuance [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T10:15:51.172Z", + "version": "WzQ0NzYsMV0=" + }, + { + "attributes": { + "description": "Resource validation failed.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Galley Validation Failed [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "galley_validation_failed", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.galley_validation_failed.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.resource", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "10", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Galley Validation Failed [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T09:30:05.212Z", + "version": "WzQzOTksMV0=" + }, + { + "attributes": { + "description": "Pods not found in the endpoint table, possibly invalid.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Pods without IP [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot No IP pods", + "field": "prometheus.pilot_no_ip.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 + } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Pods without IP [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-07T09:48:31.873Z", + "version": "WzQ0MjcsMV0=" + }, + { + "attributes": { + "description": "Total virtual services known to pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Virtual Services [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot Virtual Services", + "field": "prometheus.pilot_virt_services.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 + } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Virtual Services [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-07T09:50:53.286Z", + "version": "WzQ0MzMsMV0=" + }, + { + "attributes": { + "description": "Total services known to pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Services [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot Services", + "field": "prometheus.pilot_services.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 + } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Services [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-07T10:04:27.677Z", + "version": "WzQ0NTksMV0=" + }, + { + "attributes": { + "description": "Number of conflicting inbound listeners.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot conflict inbound listener", + "field": "prometheus.pilot_conflict_inbound_listener.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 + } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-07T09:45:30.182Z", + "version": "WzQ0MjAsMV0=" + }, + { + "attributes": { + "description": "Number of clusters without instances.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot eds Instances [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot eds instnaces", + "field": "prometheus.pilot_eds_no_instances.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 + } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot eds Instances [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-07T09:47:11.918Z", + "version": "WzQ0MjQsMV0=" + }, + { + "attributes": { + "description": "Number of endpoints connected to this pilot using XDS.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot XDS endpoints [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds.value", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot XDS endpoints [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T09:53:38.583Z", + "version": "WzQ0NDEsMV0=" + }, + { + "attributes": { + "description": "Total number of XDS requests with an expired nonce.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot XDS expired [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_expired_nonce", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_expired_nonce.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot XDS expired [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "references": [], + "type": "visualization", + "updated_at": "2020-10-07T09:54:14.728Z", + "version": "WzQ0NDMsMV0=" + } + ], + "version": "7.8.0" +} diff --git a/x-pack/metricbeat/module/istio/fields.go b/x-pack/metricbeat/module/istio/fields.go index 40a9baed3f5..ccd41e55fe8 100644 --- a/x-pack/metricbeat/module/istio/fields.go +++ b/x-pack/metricbeat/module/istio/fields.go @@ -19,5 +19,5 @@ func init() { // AssetIstio returns asset data. // This is the base64 encoded gzipped contents of module/istio. func AssetIstio() string { - return "eJzUXE2T47bRvu+v6PLltd+a5V5Te0hVap2PrcSuza5TSeUiQ2BLhAUCNNCURv71KXyRFEVp9AFq1nPYnZFIPM8DNBqNRpNvYYP79yAsCf0GgARJfA/ffHR/f/MGoETLjWhIaPUe/vgGAMK18IMuW4lvAAxKZBbfwxKJvQFYCZSlfe8vfQuK1dg3735o3+B7WBvdNvGTCQz387O/62fgWhETyoIlRu4zboEqRrBDg2CQlbAyuoaPA5AhiSERLoiVKLvPp+icoeR+PkzQMSgZYQmkgSoMTOBDwAKLZis4DhoZd1n6GbMeMl+bhhc1UqXLg++Tgg3ud9qMvzujw/38VKFvGCYaPgA+1pALearlA2gHkhfX3Q565YfKoG2Qk9ieoDPJyyI3SAtnmEZLiWZht3zBOF9wg84QFhwNFVy3iiapS63W1/NWbb1E45i75sVKcEZoIWJC2aIzwKgAGPf44WuhVXFCitmiWRityZNe4HMjzH5hkWtV2kn2K6nZWNcF9FslnoFEjZZY3TyBUBBRnmBXoeomjCPjJcJOSAmeERbwbwSLBIKcSoVr5kdNKODM+vEUitAoJgGN0WZab2fNaIqKqVLi9HS6YYQ0MTkYo8+fPljgum4kutHRyttbgH4Cg2tmSonWumtty7n/1cCKCdkafJl9bdeFQY5iO6cEsGSQ1VCjtWyNztUFyENBl9G1mG8+jKiup7g6PFjur+JpiRma1ygixKkevMxuhVoXbtFRfF/Utli2fINU/P8kb738Bfm458OHi3scknOeWlmESAS+rYWUIs7q77px8at1xUpYIipgTSOd6xJavZW4RQlxIl47VFP9YNv60qFbaVMzeg9lazyZDPqj4Cewbe3+CJ8LtM5NDfvmJm2515PT9HuDrZGM4PbYODvSTErcPySgClCZ4in3b96wwrU4CCt0azj6P0IfghjKOsnJNix3nPX3dolGoYsVOoQx0Uk+WzT2eGLcySY2mghM+KYuWHexFZ+Ymncy6NtNJISyxNRLYZ/fjxSspQoVRQ9W1GirRkvhZvkssd6WSVEG7HeH2O+G2LBReqfchInThBEwaLRQ5JyPi7suF/VagvKIcd1S/IC2+qDVSoy55hfh8N71ePeRV0g7bTbO9ZdoSSjfM6aVDxiNHvvdGDubKFRbvV8JSWgeKmiIm03MmhHu2P6hQhJmNhFWlMjZY0cjYWYTsRWGWiZjbPBQLSPo+yR5D7gvGJERy5awZkqs0NL8igLyu2PkLIJCiP8AI4syEl4W8ik8eBj7DjAL/ccsHpH61avF+ZjLtMpdXTRGc7RWmwK3qGhhG6aKtHN7tQ1wIuA2Hju3t0XGKxCK61qoNXiqwCxUwpJeG1ZDoHnZfvBi7Q/d9F6iudsAp4szC869E75M0wW74vNqrGKNrTQtfIOvZLO9isAiZWe2GNIzkS6Wk4Z7o9IrLDSnhM4Ow3U3kv+9W5sUK/TffT3+0g2JE5045nSS53W/jq8c683mIM+Lnc1yj/XcaK6WGKG3qcW8UZY/9OvjqgZN+Ohfn//xAkHDCNf7QqsFr5haTyfn7qYnarQh+x0B/8+CVh88IlTMBs/GXTg1fU57RNj9ZRa/tgItx4Vx45XvXGOCPIOI1dOdAu1OHn3ecbFpl7iIy3w4BVuQJiZnJbrpM6IxTxuxV62U++48gqngjKeToy72DTPNH5xucF+0TckomwH/NcTOPRDscFlpvRme/8IU5hRHn5sqpGa5bGDzB9sT8q0n7/Ctwe8c0KWk8nbbaV5jnMSoRlu9GQPPcYLhgDKdXxylrIfcCZ9vOKBvjK6RKmztdOsJ+he9nES9OSE/AB633Xk3/LXNmQbx57Kp0eEBJFNxrBqjn/fnuLxuOPU5kOiX5BvDpwktDwuRPqf+T7ffGhZNiMgZ+kzw7NeUScscM7PiNyyWe8JXtJQv4je8dEN3TDvfDu4EnzHAGS4zjO2YzSHECWLh+Pz3N7jHvF9xdI/JfC3D22hDaPItdZ9jiyBKVC5+ixF/QurP5IPFw0cCYX3RG2kYnMiBWMWb3Pe++JXFqpnh4gVMlSm+nbqDS4GKhnecqBH0TRQ7bTYuqityl04IO+6RVEoRySdk2FWCVxDrLuN2KZC7mHj2+opp9gdFFiMZZ8k2RigumhMboGwcG0QDHVYiSoatVoInLgMD9AWa/qbDI3v3fWvxvCbWNPOqiR3MmgaWzIbSOveHZEuUt4zCDJUvx6xHlTAn+U0SHbiD15iZQ290vkdPEn2NmXgb7a9iTg4J3T0xh43NPjuHnX5+ik4Oz8sKXmO2nrekFynHJEBRaTsd6mThPSSZngtwiCnsEkuJbg/ndr3d+UMKPy7WML/XmdLhUK/j+GiHM8H6BQtJXd8YTZrruf1NRDkfd/7p08f+SrFyv29FieUTaKrQ7ITt7gRtXHCmYnFlumt6lLrIn+syX079WGVX5exwjqT6O4IPEhYag/6ZAa3k3jmov/3006d0njGtopdbWOStEbSPZRczRzzpKZ9Dpx+gzw9o3VLL5IKkDYtHiP/jcuEvYBvXW3XdqtSu14Z+QzHaRpxYlkhDq0IViAcZ3ZWy7kK5f2PHJfacKaUJlt5CGzTSfdO0Pp/aj0KXvBXPB5u0GbO3DilX+jZUqvKmSIPE+Gaek680OR1A//hOetbizPYpZudZyRpCUwi10oV/tMrGxP0sdAMCoPJ7dDT+yTbjFqZ46ul+jQYeqYGjdpjrv1xR+Gyerg8TIML5XKZjzVtjnJeJbM4yTdV4s/LrQG5gGAvtHtCNXUnf7SSj9fYnUI+y4CVy1lpMGoZnegapNQrLc08tRhnpVOYrm4WJ1hUzsFMyv9n0Z/7X241p5dfW2Y7SFR09VFAz4tU8S0wkVYpwaBMez2cW3DreMGORLeX5VcYTnd8aQnnq9ZZAWDcuJPjKrCHRusIiOiXzd3aCuqXDW2VdNLYSWBbMB9iL6DxnIRwgouWumJD9A/XdurNE1/OtYlsm5GmDLoVt3ExDsxgEx3bRoFlsmRFI+xlLXH7wQWoKjIYEfMiX7CUS8aDTMtKameQXXGo7UwFR18X9ez0CWrL8YBRAhikrTpt44lwyrLXKadrJcg8tZosQoMDoloQKls5gLbbYxX2AaiuMVjWqE0mVRDs++2+LZSvkI3o6Gnp6RcSNvd3R9mP2KJ+4q4QMZuIod7puk9AZucLdoyxc4U7uB2/vuIu3wfaBk9Pg2/b22Tnvo9dxQsLUatGXoHnvNx+JMUACboTU9JBkhUfKlKx4LvMeyn/wL6bRK2c4ybE+f/8lHUj3OTXrk9OfnJRpk3LMmtZW2fbHHTXH5+BFIk/ALOxQSvd/9EfeT/twzLhr/K/DG4+ad3JkaZ/AuH94aX1KDcsT2cUkz9fyvk7Vvi+Uc/BhGIDYBq0zNcdrWsvTy7VoF8rN+NjInTpiXVooIL5NTNZi/Dvl8GTmXtBpAc4yc9flf+w25G42+McIuGwtofFTzL82xZIXUsB/0ejhFt76ouzTmZKu17lWhM8U92uZqP84Dki+df2nW7LfgVCCBCO/T3NjkAicpJleV5WX4viNQ91Lsf7z/ZfEWqiwPJzegEnBqZDCEiqfJ13qVuWKLvpOTEiuzyIGJNDT5y0jcrolf2dRETWF3qIp4ppSEJ8+2c7FeSdkyZkpwUH3zGEnqOp2DN1FxPtr7hDnfstvz0NZ/tRrpMYvfGFX777+Ao02dP0YER8NkVPzmDEadv+pIToYx/vFzW1/ZyS9bGyh4I9rtX2dwMKtXQqxDGdRcRWL69ef1VbvD3Nat0cVh0IzhhT3KLg+njiUkTWYuEfIJZHE2bdyuAVqfZTVu2iVO37lxpllbSsMFbnfD+JpxBeAXEdH6ULk8g6fdBlS7Su/hMZkK6oyvHGB2FLiEzTaWrGUexDKHz+d8G8hFJtkdttjRd3x0F/++f2P06B06h2vtyEGmw010IdPgIV05/8CAAD//82LgnI=" + return "eJzUXE2T47bRvu+v6PLltd+a5V5Te0hVap2PrcSuza5TSeUiQ2BLhAUCNNCURv71KXyRFEVp9AFq1nPYnZFIPM8DNIBGd5NvYYP79yAsCf0GgARJfA/ffHR/f/MGoETLjWhIaPUe/vgGAMK18IMuW4lvAAxKZBbfwxKJvQFYCZSlfe8vfQuK1dg3735o3+B7WBvdNvGTCQz387O/62fgWhETyoIlRu4zboEqRrBDg2CQlbAyuoaPA5AhiSERLoiVKLvPp+icoeR+PkzQMSgZYQmkgSoMTOBDwAKLZis4DhoZd1n6GbMeMl+bhhc1UqXLg++Tgg3ud9qMvzujw/38VKFvGCYaPgA+1pALearlA2gHkhfX3Q565YfKoG2Qk9ieoDPJyyI3SAtnmEZLiWZht3zBOF9wg84QFhwNFVy3iiapS63W1/NWbb1E45i75sVKcEZoIWJC2aIzwKgAGPf44WuhVXFCitmiWRityZNe4HMjzH5hkWtV2kn2K6nZWNcF9FslnoFEjZZY3TyBUBBRnmBXoeomjCPjJcJOSAmeERbwbwSLBIKcSoVr5kdNKODM+vEUitAoJgGN0WZab2fNaIqKqVLi9HS6YYQ0MTkYo8+fPljgum4kutHRyttbgH4Cg2tmSonWumtty7n/1cCKCdkafJl9bdeFQY5iO6cEsGSQ1VCjtWyNbqkLkIeCLqNrMd98GFFdT3F1eLDcX8XTEjM0r1FEiFM9eJndCrUu3Kaj+L6obbFs+Qap+P9J3nr5C/Jxz4cPF/csSG7x1MoiRCLwbS2kFHFWf9eNi9+tK1bCElEBaxrpli6h1VuJW5QQJ+K1QzXVD7atLx26lTY1o/dQtsaTyaA/Cn4C29buj/C5QOuWqWHf3KQt935ymn5vsDWSEdweG2dHmkmJ+4c4VAEqkz/l/s3rVrgWB26Fbg1H/0foQxBDWSc52Ybl9rP+3i7RKHS+QocwJjrJZ4vGHk+MO9nERhOBibWpc9adb8UnpuadDPp2EwmhLDH1ktvnzyMFa6lCRXEFK2q0VaOlcLN8Fl9vy6QoA/a7Q+x3Q2zYKL1TbsLEacIIGDRaKHKLj/O7Lhf1WoLyiHHdUvyAtvqg1UqMueYX4fDe9Xj3kVdIO202bukv0ZJQvmdMKx8wGj32uzF2NlGotnq/EpLQPFTQEDebmDUj3LH9Q4UkzGwirCiRs8eORsLMJmIrDLVMRt/goVpG0PdJ8ivgvmBERixbwpopsUJL8ysKyO+OkbMICi7+A4wsykh4Wcgn9+Bh7DvALPQfs3lE6lfvFud9LtMqd3XRGM3RWm0K3KKihW2YKtLJ7dUOwImAO3js3NkWGa9AKK5rodbgqQKzUAlLem1YDYHmZefBi7U/9NB7iebuAJwuziw490n4Mk0XnIrPq7GKNbbStPANvpLN9ioCixSd2WIIz0S6WE4a7o1Kr7DQnBI6OwzX3Uj+925tUqzQf/f1rJduSJzoxDHnInle9+uslWO92RbI82Jns9xjPTeaqyVG6G1qMa+X5ZN+vV/VoAkf/evzP14gaBjhel9oteAVU+vp4Nzd9ESNNkS/I+D/WdDqg0eEitmwsnHnTk3naY8Iu7/M4tdWoOW4MG688uU1JsgziFg93SnQLvPo446LTbvERdzmQxZsQZqYnJXopo+IxjhtxF61Uu67fARTYTGeDo463zfMNJ843eC+aJuSUTYD/mvwnXsg2OGy0nozzP/CFOYURx+bKqRmuWxg8wfbE/Ktp9XhW4PfOaBLSeXtttO8xjhvT2QOEtMabfVmTGiOzIYDypTXOAplD7kTPt+QuG+MrpEqbO106wn6F72cRL05UD8AHrfdrXr4a5szPOLztanRYWKSqThWjdHP+3NcXtfN+hxI9Fv1jW7VhJaHuU6fU/+n2291lyZE5HSJJnj2e82kZY6ZWfEbFss94StayhfxG1560Dumne9kd4LPGOAMlxnGdszmEOIEsZBW//0N7jHvVxzdYzJfy/A22hCafFvd59giiBKV8+viSSAh9bn6YPHwkUBYXwxHGgaZOhCreJP73hfFslhNM9y8gKky+b1Td3ApUNHwjhO1g76JYqfNxnl7Re6SCmHHPZJKLCL5hAy7SvAKYj1mPEYFchcTz153Mc3+oPhiJOMs2cYIxUVz4mCUjWODaKDDSkTJsNVK8MRlYIC+cNPfdJjKd9+3Fs9rYk0zr5rYwaxpYMlsKLlzf0i2RHnLKMxQEXPMelQhc5LfJNHBcvAaM3O4Gp3v0ZNEX2Mm3kb7q5iTQ0J3T8xhY7PPzmGnn5+ik8PzsoLXmK3nLelFyjEIUFTaTrs6WXgPSabnBRxicrvEUqI7w7lTb5eXSO7HxRrmX3WmdDjU6zg+esGZYP2ChaSub4wmzfXc601EOe93/unTx/5KsXK/b0WJ5RNoqtDshO3uBG2cc6Zi0WW6a3qUOs+f6zJfrP1YZVf97HCOpPo7whokLDQG/bMEWsm9W6D+9tNPn1KeY1pFL7ewyFsjaB/LMWb2eNLTP4eLfoA+P6B1Sy2TC5I2bB7B/4/bhb+AbVxv1XWrUrteG/oDxegYcWJbIg2tCtUhHmR0V4rGC+X+jR2X2HOmlCZYegtt0Ej3TdP6eGo/Cl3wVjwfHNJmjN46pFzh21DBypsiDRLjm3kyYmlyOoD+sZ70DMaZ41OM2rOSNYSmEGqlC//IlY0B/VnoBgRA5c/oaPwTb8ZtTDEb6n6NBh6pgaN2mAO4XFH4bJ6uDxMgwvlYpmPNW2PcKhPZnGWaqvRm5deB3MAwFuA9oBu7Ur/bSUbr7TNTj7LgJXLWWkwahrk+g9QaheW5pxmjjJSV+cpmYaJ1xQzslMxvNn0twPV2Y1r5tXW2o3RFRw8V1Ix4Nc8WE0mVIiRtwmP7zILbxxtmLLKlPL/LeKLzW0MoW73eEgjrxrkEX5k1JFpXWESnZP7OTlC3dHirrPPGVgLLgnkHexEXz1kIB4houSsmZP+gfbfvLNH1fKvYlgl52qBLYRs309AsBs6xXTRoFltmBNJ+xtKXH7yTmhyjIQHv8iV7iUQ86LSMtGcm+QWX2s5UWNR1cf++j4CWLD8YBZBhyorTJp44lwxrrXKadrLcQ4vZIgQoMLoloYKlM1iLLXZ+H6DaCqNVjepEUCXRju8EsMWyFfIRPR0NPb064sbe7mj7MXvUmrirhAxm4ih3um6T0Bm5wt2jLFzhTu4Hb/W4i7fB9oGT0+Db9vbZOe8j2XFCwtRu0Zem+dVvPhJjgATcCKnpIcEKj5QpWPFc5k3Kf/AvrNErZzhpYX3+/ktKSPcxNeuD05+clGmTcsya1lbZzscdNcfn4AUjT8As7FBK939cj/w67d0x467xvw5vPGreyZGlfQLj/uGl9SE1LE9EF5M8X+P7OtX8vlDOwYdhAGIbtM7UHK9pLU8v16JdKDfj4yR36oh1aaGw+DYxWYv075TDk5l7QacFOMvMXa//sTuQu9ngHy/gsrWExk8x/zoVS15IAf9Fo4dHeOuLtU9HSrpe51oRPlM8r2Wi/uPYIfnW9Z9uyX4HQgkSjPw5zY1BInCSZnqNVV6K4zcRdS/L+s/3XxJrocL2cPoAJgWnQgpLqHycdKlblcu76DsxIbk+ixiQQE/nW0bkdEv+zqIiagq9RVPEPaUgPp3ZzsV5J2TJmSnBQffMYSeo6k4M3UXE+2vuEOd+y2/PQ1k+6zVS4ze+cKp3X3+BRhu6foyIj4bIqXnMGA27/9QQHYzj/eLmtr8zkl42tlDwx7Xavo5j4fYuhViGXFTcxeL+9We11fvDmNbtXsWh0IwuxT0KrvcnDmVkdSbuEXKJJ3H2bR1ug1ofRfUu2uWOX8VxZlvbCkNF7veGeBrxxSDX0VG6ELlWh0+6DKH2ld9CY7AVVRnexEBsKfEJGm2tWMo9COXTTyfWt+CKTTK77bGiLj30l39+/+M0KJ169+ttiMFmQw304ZNhIdz5vwAAAP//h0iIoA==" } diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc b/x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc new file mode 100644 index 00000000000..61170c60413 --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc @@ -0,0 +1,4 @@ +This is the istiod metricset of the module istio. +This metricset collects metrics from the Istio Daemon of Istio versions higher than 1.5 + +Tested with Istio 1.7 diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml b/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml new file mode 100644 index 00000000000..8033a27f5ac --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml @@ -0,0 +1 @@ +- release: beta diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/testdata/config.yml b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/config.yml new file mode 100644 index 00000000000..376691991b5 --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/config.yml @@ -0,0 +1,5 @@ +type: http +url: "/metrics" +suffix: plain +remove_fields_from_comparison: ["prometheus.labels.instance"] +omit_documented_fields_check: ["prometheus.labels.*"] diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain new file mode 100644 index 00000000000..4ec26bf4a2c --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain @@ -0,0 +1,499 @@ +# HELP citadel_server_csr_count The number of CSRs received by Citadel server. +# TYPE citadel_server_csr_count counter +citadel_server_csr_count 8 +# HELP citadel_server_root_cert_expiry_timestamp The unix timestamp, in seconds, when Citadel root cert will expire. A negative time indicates the cert is expired. +# TYPE citadel_server_root_cert_expiry_timestamp gauge +citadel_server_root_cert_expiry_timestamp 1.916309303e+09 +# HELP citadel_server_success_cert_issuance_count The number of certificates issuances that have succeeded. +# TYPE citadel_server_success_cert_issuance_count counter +citadel_server_success_cert_issuance_count 8 +# HELP endpoint_no_pod Endpoints without an associated pod. +# TYPE endpoint_no_pod gauge +endpoint_no_pod 0 +# HELP galley_validation_config_updates k8s webhook configuration updates +# TYPE galley_validation_config_updates counter +galley_validation_config_updates 2 +# HELP galley_validation_failed Resource validation failed +# TYPE galley_validation_failed counter +galley_validation_failed{group="networking.istio.io",reason="invalid_resource",resource="gateways",version="v1alpha3"} 1 +# HELP go_gc_duration_seconds A summary of the GC invocation durations. +# TYPE go_gc_duration_seconds summary +go_gc_duration_seconds{quantile="0"} 8.969e-06 +go_gc_duration_seconds{quantile="0.25"} 8.7539e-05 +go_gc_duration_seconds{quantile="0.5"} 0.000238037 +go_gc_duration_seconds{quantile="0.75"} 0.000783504 +go_gc_duration_seconds{quantile="1"} 0.005515511 +go_gc_duration_seconds_sum 0.013316174 +go_gc_duration_seconds_count 13 +# HELP go_goroutines Number of goroutines that currently exist. +# TYPE go_goroutines gauge +go_goroutines 345 +# HELP go_info Information about the Go environment. +# TYPE go_info gauge +go_info{version="go1.14.7"} 1 +# HELP go_memstats_alloc_bytes Number of bytes allocated and still in use. +# TYPE go_memstats_alloc_bytes gauge +go_memstats_alloc_bytes 3.1723136e+07 +# HELP go_memstats_alloc_bytes_total Total number of bytes allocated, even if freed. +# TYPE go_memstats_alloc_bytes_total counter +go_memstats_alloc_bytes_total 1.106604e+08 +# HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table. +# TYPE go_memstats_buck_hash_sys_bytes gauge +go_memstats_buck_hash_sys_bytes 1.496287e+06 +# HELP go_memstats_frees_total Total number of frees. +# TYPE go_memstats_frees_total counter +go_memstats_frees_total 982627 +# HELP go_memstats_gc_cpu_fraction The fraction of this program's available CPU time used by the GC since the program started. +# TYPE go_memstats_gc_cpu_fraction gauge +go_memstats_gc_cpu_fraction 6.904294960464036e-05 +# HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata. +# TYPE go_memstats_gc_sys_bytes gauge +go_memstats_gc_sys_bytes 3.832072e+06 +# HELP go_memstats_heap_alloc_bytes Number of heap bytes allocated and still in use. +# TYPE go_memstats_heap_alloc_bytes gauge +go_memstats_heap_alloc_bytes 3.1723136e+07 +# HELP go_memstats_heap_idle_bytes Number of heap bytes waiting to be used. +# TYPE go_memstats_heap_idle_bytes gauge +go_memstats_heap_idle_bytes 2.1651456e+07 +# HELP go_memstats_heap_inuse_bytes Number of heap bytes that are in use. +# TYPE go_memstats_heap_inuse_bytes gauge +go_memstats_heap_inuse_bytes 4.2508288e+07 +# HELP go_memstats_heap_objects Number of allocated objects. +# TYPE go_memstats_heap_objects gauge +go_memstats_heap_objects 157553 +# HELP go_memstats_heap_released_bytes Number of heap bytes released to OS. +# TYPE go_memstats_heap_released_bytes gauge +go_memstats_heap_released_bytes 1.7825792e+07 +# HELP go_memstats_heap_sys_bytes Number of heap bytes obtained from system. +# TYPE go_memstats_heap_sys_bytes gauge +go_memstats_heap_sys_bytes 6.4159744e+07 +# HELP go_memstats_last_gc_time_seconds Number of seconds since 1970 of last garbage collection. +# TYPE go_memstats_last_gc_time_seconds gauge +go_memstats_last_gc_time_seconds 1.6019028053800597e+09 +# HELP go_memstats_lookups_total Total number of pointer lookups. +# TYPE go_memstats_lookups_total counter +go_memstats_lookups_total 0 +# HELP go_memstats_mallocs_total Total number of mallocs. +# TYPE go_memstats_mallocs_total counter +go_memstats_mallocs_total 1.14018e+06 +# HELP go_memstats_mcache_inuse_bytes Number of bytes in use by mcache structures. +# TYPE go_memstats_mcache_inuse_bytes gauge +go_memstats_mcache_inuse_bytes 6944 +# HELP go_memstats_mcache_sys_bytes Number of bytes used for mcache structures obtained from system. +# TYPE go_memstats_mcache_sys_bytes gauge +go_memstats_mcache_sys_bytes 16384 +# HELP go_memstats_mspan_inuse_bytes Number of bytes in use by mspan structures. +# TYPE go_memstats_mspan_inuse_bytes gauge +go_memstats_mspan_inuse_bytes 485384 +# HELP go_memstats_mspan_sys_bytes Number of bytes used for mspan structures obtained from system. +# TYPE go_memstats_mspan_sys_bytes gauge +go_memstats_mspan_sys_bytes 573440 +# HELP go_memstats_next_gc_bytes Number of heap bytes when next garbage collection will take place. +# TYPE go_memstats_next_gc_bytes gauge +go_memstats_next_gc_bytes 5.3766592e+07 +# HELP go_memstats_other_sys_bytes Number of bytes used for other system allocations. +# TYPE go_memstats_other_sys_bytes gauge +go_memstats_other_sys_bytes 914201 +# HELP go_memstats_stack_inuse_bytes Number of bytes in use by the stack allocator. +# TYPE go_memstats_stack_inuse_bytes gauge +go_memstats_stack_inuse_bytes 2.94912e+06 +# HELP go_memstats_stack_sys_bytes Number of bytes obtained from system for stack allocator. +# TYPE go_memstats_stack_sys_bytes gauge +go_memstats_stack_sys_bytes 2.94912e+06 +# HELP go_memstats_sys_bytes Number of bytes obtained from system. +# TYPE go_memstats_sys_bytes gauge +go_memstats_sys_bytes 7.3941248e+07 +# HELP go_threads Number of OS threads created. +# TYPE go_threads gauge +go_threads 14 +# HELP grpc_server_handled_total Total number of RPCs completed on the server, regardless of success or failure. +# TYPE grpc_server_handled_total counter +grpc_server_handled_total{grpc_code="Aborted",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Aborted",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Aborted",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Aborted",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Aborted",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Aborted",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="AlreadyExists",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Canceled",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DataLoss",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="DeadlineExceeded",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="FailedPrecondition",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Internal",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="InvalidArgument",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="NotFound",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OK",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 8 +grpc_server_handled_total{grpc_code="OK",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OK",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OK",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OK",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OK",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="OutOfRange",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="PermissionDenied",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unauthenticated",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unavailable",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unimplemented",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handled_total{grpc_code="Unknown",grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +# HELP grpc_server_handling_seconds Histogram of response latency (seconds) of gRPC that had been application-level handled by the server. +# TYPE grpc_server_handling_seconds histogram +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.005"} 7 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.01"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.025"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.05"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.1"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.25"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="0.5"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="1"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="2.5"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="5"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="10"} 8 +grpc_server_handling_seconds_bucket{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary",le="+Inf"} 8 +grpc_server_handling_seconds_sum{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 0.031283576 +grpc_server_handling_seconds_count{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 8 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.005"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.01"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.025"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.05"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.25"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="2.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="10"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="+Inf"} 0 +grpc_server_handling_seconds_sum{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_count{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.005"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.01"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.025"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.05"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.25"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="2.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="10"} 0 +grpc_server_handling_seconds_bucket{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="+Inf"} 0 +grpc_server_handling_seconds_sum{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_count{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.005"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.01"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.025"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.05"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.25"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="0.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="2.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="10"} 0 +grpc_server_handling_seconds_bucket{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream",le="+Inf"} 0 +grpc_server_handling_seconds_sum{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_count{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.005"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.01"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.025"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.05"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.25"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="2.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="10"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream",le="+Inf"} 0 +grpc_server_handling_seconds_sum{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_count{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.005"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.01"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.025"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.05"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.25"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="0.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="1"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="2.5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="5"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="10"} 0 +grpc_server_handling_seconds_bucket{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream",le="+Inf"} 0 +grpc_server_handling_seconds_sum{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_handling_seconds_count{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +# HELP grpc_server_msg_received_total Total number of RPC stream messages received on the server. +# TYPE grpc_server_msg_received_total counter +grpc_server_msg_received_total{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 8 +grpc_server_msg_received_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_received_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_received_total{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_msg_received_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_received_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +# HELP grpc_server_msg_sent_total Total number of gRPC stream messages sent by the server. +# TYPE grpc_server_msg_sent_total counter +grpc_server_msg_sent_total{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 8 +grpc_server_msg_sent_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_sent_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_sent_total{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_msg_sent_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_msg_sent_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +# HELP grpc_server_started_total Total number of RPCs started on the server. +# TYPE grpc_server_started_total counter +grpc_server_started_total{grpc_method="CreateCertificate",grpc_service="istio.v1.auth.IstioCertificateService",grpc_type="unary"} 8 +grpc_server_started_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_started_total{grpc_method="DeltaAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_started_total{grpc_method="ServerReflectionInfo",grpc_service="grpc.reflection.v1alpha.ServerReflection",grpc_type="bidi_stream"} 0 +grpc_server_started_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v2.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +grpc_server_started_total{grpc_method="StreamAggregatedResources",grpc_service="envoy.service.discovery.v3.AggregatedDiscoveryService",grpc_type="bidi_stream"} 0 +# HELP istio_build Istio component build info +# TYPE istio_build gauge +istio_build{component="pilot",tag="1.7.1"} 1 +# HELP pilot_conflict_inbound_listener Number of conflicting inbound listeners. +# TYPE pilot_conflict_inbound_listener gauge +pilot_conflict_inbound_listener 0 +# HELP pilot_conflict_outbound_listener_http_over_current_tcp Number of conflicting wildcard http listeners with current wildcard tcp listener. +# TYPE pilot_conflict_outbound_listener_http_over_current_tcp gauge +pilot_conflict_outbound_listener_http_over_current_tcp 0 +# HELP pilot_conflict_outbound_listener_tcp_over_current_http Number of conflicting wildcard tcp listeners with current wildcard http listener. +# TYPE pilot_conflict_outbound_listener_tcp_over_current_http gauge +pilot_conflict_outbound_listener_tcp_over_current_http 0 +# HELP pilot_conflict_outbound_listener_tcp_over_current_tcp Number of conflicting tcp listeners with current tcp listener. +# TYPE pilot_conflict_outbound_listener_tcp_over_current_tcp gauge +pilot_conflict_outbound_listener_tcp_over_current_tcp 0 +# HELP pilot_destrule_subsets Duplicate subsets across destination rules for same host +# TYPE pilot_destrule_subsets gauge +pilot_destrule_subsets 0 +# HELP pilot_duplicate_envoy_clusters Duplicate envoy clusters caused by service entries with same hostname +# TYPE pilot_duplicate_envoy_clusters gauge +pilot_duplicate_envoy_clusters 0 +# HELP pilot_eds_no_instances Number of clusters without instances. +# TYPE pilot_eds_no_instances gauge +pilot_eds_no_instances 0 +# HELP pilot_endpoint_not_ready Endpoint found in unready state. +# TYPE pilot_endpoint_not_ready gauge +pilot_endpoint_not_ready 0 +# HELP pilot_inbound_updates Total number of updates received by pilot. +# TYPE pilot_inbound_updates counter +pilot_inbound_updates{type="config"} 90 +pilot_inbound_updates{type="eds"} 54 +pilot_inbound_updates{type="svc"} 22 +# HELP pilot_info Pilot version and build information. +# TYPE pilot_info gauge +pilot_info{version="1.7.1-4e26c697ce460dc8d3b25b25818fb0163ca16394-Clean"} 1 +# HELP pilot_k8s_cfg_events Events from k8s config. +# TYPE pilot_k8s_cfg_events counter +pilot_k8s_cfg_events{event="add",type="DestinationRule"} 4 +pilot_k8s_cfg_events{event="add",type="EnvoyFilter"} 8 +pilot_k8s_cfg_events{event="add",type="Gateway"} 1 +pilot_k8s_cfg_events{event="add",type="VirtualService"} 1 +# HELP pilot_k8s_reg_events Events from k8s registry. +# TYPE pilot_k8s_reg_events counter +pilot_k8s_reg_events{event="add",type="Endpoints"} 12 +pilot_k8s_reg_events{event="add",type="Nodes"} 1 +pilot_k8s_reg_events{event="add",type="Pods"} 22 +pilot_k8s_reg_events{event="add",type="Services"} 11 +pilot_k8s_reg_events{event="update",type="Endpoints"} 30 +pilot_k8s_reg_events{event="update",type="Nodes"} 1 +pilot_k8s_reg_events{event="update",type="Pods"} 61 +pilot_k8s_reg_events{event="updatesame",type="Endpoints"} 185 +# HELP pilot_no_ip Pods not found in the endpoint table, possibly invalid. +# TYPE pilot_no_ip gauge +pilot_no_ip 0 +# HELP pilot_proxy_convergence_time Delay in seconds between config change and a proxy receiving all required configuration. +# TYPE pilot_proxy_convergence_time histogram +pilot_proxy_convergence_time_bucket{le="0.1"} 1 +pilot_proxy_convergence_time_bucket{le="0.5"} 1 +pilot_proxy_convergence_time_bucket{le="1"} 1 +pilot_proxy_convergence_time_bucket{le="3"} 1 +pilot_proxy_convergence_time_bucket{le="5"} 1 +pilot_proxy_convergence_time_bucket{le="10"} 1 +pilot_proxy_convergence_time_bucket{le="20"} 1 +pilot_proxy_convergence_time_bucket{le="30"} 1 +pilot_proxy_convergence_time_bucket{le="+Inf"} 1 +pilot_proxy_convergence_time_sum 0.002034992 +pilot_proxy_convergence_time_count 1 +# HELP pilot_proxy_queue_time Time in seconds, a proxy is in the push queue before being dequeued. +# TYPE pilot_proxy_queue_time histogram +pilot_proxy_queue_time_bucket{le="0.1"} 41 +pilot_proxy_queue_time_bucket{le="1"} 41 +pilot_proxy_queue_time_bucket{le="3"} 41 +pilot_proxy_queue_time_bucket{le="5"} 41 +pilot_proxy_queue_time_bucket{le="10"} 41 +pilot_proxy_queue_time_bucket{le="20"} 41 +pilot_proxy_queue_time_bucket{le="30"} 41 +pilot_proxy_queue_time_bucket{le="+Inf"} 41 +pilot_proxy_queue_time_sum 0.002216352 +pilot_proxy_queue_time_count 41 +# HELP pilot_push_triggers Total number of times a push was triggered, labeled by reason for the push. +# TYPE pilot_push_triggers counter +pilot_push_triggers{type="endpoint"} 40 +pilot_push_triggers{type="proxy"} 1 +# HELP pilot_services Total services known to pilot. +# TYPE pilot_services gauge +pilot_services 11 +# HELP pilot_virt_services Total virtual services known to pilot. +# TYPE pilot_virt_services gauge +pilot_virt_services 1 +# HELP pilot_vservice_dup_domain Virtual services with dup domains. +# TYPE pilot_vservice_dup_domain gauge +pilot_vservice_dup_domain 0 +# HELP pilot_xds Number of endpoints connected to this pilot using XDS. +# TYPE pilot_xds gauge +pilot_xds{version="1.7.1"} 8 +# HELP pilot_xds_push_time Total time in seconds Pilot takes to push lds, rds, cds and eds. +# TYPE pilot_xds_push_time histogram +pilot_xds_push_time_bucket{type="cds",le="0.01"} 9 +pilot_xds_push_time_bucket{type="cds",le="0.1"} 9 +pilot_xds_push_time_bucket{type="cds",le="1"} 9 +pilot_xds_push_time_bucket{type="cds",le="3"} 9 +pilot_xds_push_time_bucket{type="cds",le="5"} 9 +pilot_xds_push_time_bucket{type="cds",le="10"} 9 +pilot_xds_push_time_bucket{type="cds",le="20"} 9 +pilot_xds_push_time_bucket{type="cds",le="30"} 9 +pilot_xds_push_time_bucket{type="cds",le="+Inf"} 9 +pilot_xds_push_time_sum{type="cds"} 0.009549363999999998 +pilot_xds_push_time_count{type="cds"} 9 +pilot_xds_push_time_bucket{type="eds",le="0.01"} 49 +pilot_xds_push_time_bucket{type="eds",le="0.1"} 49 +pilot_xds_push_time_bucket{type="eds",le="1"} 49 +pilot_xds_push_time_bucket{type="eds",le="3"} 49 +pilot_xds_push_time_bucket{type="eds",le="5"} 49 +pilot_xds_push_time_bucket{type="eds",le="10"} 49 +pilot_xds_push_time_bucket{type="eds",le="20"} 49 +pilot_xds_push_time_bucket{type="eds",le="30"} 49 +pilot_xds_push_time_bucket{type="eds",le="+Inf"} 49 +pilot_xds_push_time_sum{type="eds"} 0.008623654 +pilot_xds_push_time_count{type="eds"} 49 +pilot_xds_push_time_bucket{type="lds",le="0.01"} 9 +pilot_xds_push_time_bucket{type="lds",le="0.1"} 9 +pilot_xds_push_time_bucket{type="lds",le="1"} 9 +pilot_xds_push_time_bucket{type="lds",le="3"} 9 +pilot_xds_push_time_bucket{type="lds",le="5"} 9 +pilot_xds_push_time_bucket{type="lds",le="10"} 9 +pilot_xds_push_time_bucket{type="lds",le="20"} 9 +pilot_xds_push_time_bucket{type="lds",le="30"} 9 +pilot_xds_push_time_bucket{type="lds",le="+Inf"} 9 +pilot_xds_push_time_sum{type="lds"} 0.011886486000000002 +pilot_xds_push_time_count{type="lds"} 9 +pilot_xds_push_time_bucket{type="rds",le="0.01"} 9 +pilot_xds_push_time_bucket{type="rds",le="0.1"} 9 +pilot_xds_push_time_bucket{type="rds",le="1"} 9 +pilot_xds_push_time_bucket{type="rds",le="3"} 9 +pilot_xds_push_time_bucket{type="rds",le="5"} 9 +pilot_xds_push_time_bucket{type="rds",le="10"} 9 +pilot_xds_push_time_bucket{type="rds",le="20"} 9 +pilot_xds_push_time_bucket{type="rds",le="30"} 9 +pilot_xds_push_time_bucket{type="rds",le="+Inf"} 9 +pilot_xds_push_time_sum{type="rds"} 0.002646734 +pilot_xds_push_time_count{type="rds"} 9 +# HELP pilot_xds_pushes Pilot build and send errors for lds, rds, cds and eds. +# TYPE pilot_xds_pushes counter +pilot_xds_pushes{type="cds"} 9 +pilot_xds_pushes{type="eds"} 49 +pilot_xds_pushes{type="lds"} 9 +pilot_xds_pushes{type="rds"} 9 +# HELP process_cpu_seconds_total Total user and system CPU time spent in seconds. +# TYPE process_cpu_seconds_total counter +process_cpu_seconds_total 2.35 +# HELP process_max_fds Maximum number of open file descriptors. +# TYPE process_max_fds gauge +process_max_fds 1.048576e+06 +# HELP process_open_fds Number of open file descriptors. +# TYPE process_open_fds gauge +process_open_fds 52 +# HELP process_resident_memory_bytes Resident memory size in bytes. +# TYPE process_resident_memory_bytes gauge +process_resident_memory_bytes 1.08478464e+08 +# HELP process_start_time_seconds Start time of the process since unix epoch in seconds. +# TYPE process_start_time_seconds gauge +process_start_time_seconds 1.60190238401e+09 +# HELP process_virtual_memory_bytes Virtual memory size in bytes. +# TYPE process_virtual_memory_bytes gauge +process_virtual_memory_bytes 8.08730624e+08 +# HELP process_virtual_memory_max_bytes Maximum amount of virtual memory available in bytes. +# TYPE process_virtual_memory_max_bytes gauge +process_virtual_memory_max_bytes -1 +# HELP statsd_metric_mapper_cache_gets_total The count of total metric cache gets. +# TYPE statsd_metric_mapper_cache_gets_total counter +statsd_metric_mapper_cache_gets_total 0 +# HELP statsd_metric_mapper_cache_hits_total The count of total metric cache hits. +# TYPE statsd_metric_mapper_cache_hits_total counter +statsd_metric_mapper_cache_hits_total 0 +# HELP statsd_metric_mapper_cache_length The count of unique metrics currently cached. +# TYPE statsd_metric_mapper_cache_length gauge +statsd_metric_mapper_cache_length 0 diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain-expected.json b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain-expected.json new file mode 100644 index 00000000000..2d96ee6b90e --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/_meta/testdata/istiod.v1.7.1.plain-expected.json @@ -0,0 +1,843 @@ +[ + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Gateway" + }, + "pilot_k8s_cfg_events": { + "counter": 1, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Nodes" + }, + "pilot_k8s_reg_events": { + "counter": 1, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "update", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Nodes" + }, + "pilot_k8s_reg_events": { + "counter": 1, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "DestinationRule" + }, + "pilot_k8s_cfg_events": { + "counter": 4, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "proxy" + }, + "pilot_push_triggers": { + "counter": 1, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "lds" + }, + "pilot_xds_push_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.005, + 0.05500000000000001, + 0.55, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_xds_pushes": { + "counter": 9, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "svc" + }, + "pilot_inbound_updates": { + "counter": 22, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "eds" + }, + "pilot_inbound_updates": { + "counter": 54, + "rate": 0 + }, + "pilot_xds_push_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.005, + 0.05500000000000001, + 0.55, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_xds_pushes": { + "counter": 49, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "EnvoyFilter" + }, + "pilot_k8s_cfg_events": { + "counter": 8, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "endpoint" + }, + "pilot_push_triggers": { + "counter": 40, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "version": "1.7.1" + }, + "pilot_xds": { + "value": 8 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Services" + }, + "pilot_k8s_reg_events": { + "counter": 11, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "update", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Pods" + }, + "pilot_k8s_reg_events": { + "counter": 61, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "update", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Endpoints" + }, + "pilot_k8s_reg_events": { + "counter": 30, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "version": "1.7.1-4e26c697ce460dc8d3b25b25818fb0163ca16394-Clean" + }, + "pilot_info": { + "value": 1 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Endpoints" + }, + "pilot_k8s_reg_events": { + "counter": 12, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "VirtualService" + }, + "pilot_k8s_cfg_events": { + "counter": 1, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "cds" + }, + "pilot_xds_push_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.005, + 0.05500000000000001, + 0.55, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_xds_pushes": { + "counter": 9, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "add", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Pods" + }, + "pilot_k8s_reg_events": { + "counter": 22, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "event": "updatesame", + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "Endpoints" + }, + "pilot_k8s_reg_events": { + "counter": 185, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "config" + }, + "pilot_inbound_updates": { + "counter": 90, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "citadel_server_csr_count": { + "counter": 8, + "rate": 0 + }, + "citadel_server_root_cert_expiry_timestamp": { + "value": 1916309303 + }, + "citadel_server_success_cert_issuance_count": { + "counter": 8, + "rate": 0 + }, + "galley_validation_config_updates": { + "counter": 2, + "rate": 0 + }, + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio" + }, + "pilot_conflict_inbound_listener": { + "value": 0 + }, + "pilot_conflict_outbound_listener_http_over_current_tcp": { + "value": 0 + }, + "pilot_conflict_outbound_listener_tcp_over_current_http": { + "value": 0 + }, + "pilot_conflict_outbound_listener_tcp_over_current_tcp": { + "value": 0 + }, + "pilot_destrule_subsets": { + "value": 0 + }, + "pilot_duplicate_envoy_clusters": { + "value": 0 + }, + "pilot_eds_no_instances": { + "value": 0 + }, + "pilot_endpoint_not_ready": { + "value": 0 + }, + "pilot_no_ip": { + "value": 0 + }, + "pilot_proxy_convergence_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.05, + 0.30000000000000004, + 0.75, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_proxy_queue_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.05, + 0.55, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_services": { + "value": 11 + }, + "pilot_virt_services": { + "value": 1 + }, + "pilot_vservice_dup_domain": { + "value": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "labels": { + "instance": "127.0.0.1:51143", + "job": "istio", + "type": "rds" + }, + "pilot_xds_push_time": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.005, + 0.05500000000000001, + 0.55, + 2, + 4, + 7.5, + 15, + 25, + 40 + ] + } + }, + "pilot_xds_pushes": { + "counter": 9, + "rate": 0 + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.istiod", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "istiod", + "period": 10000 + }, + "prometheus": { + "galley_validation_failed": { + "counter": 1, + "rate": 0 + }, + "labels": { + "group": "networking.istio.io", + "instance": "127.0.0.1:51143", + "job": "istio", + "reason": "invalid_resource", + "resource": "gateways", + "version": "v1alpha3" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + } +] \ No newline at end of file diff --git a/x-pack/metricbeat/module/istio/istiod/istiod_test.go b/x-pack/metricbeat/module/istio/istiod/istiod_test.go new file mode 100644 index 00000000000..23ce86ca7f0 --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/istiod_test.go @@ -0,0 +1,32 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !integration + +package istiod + +import ( + "os" + "testing" + + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/metricbeat/mb" + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/prometheus" + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/prometheus/collector" +) + +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +} + +func TestEventMapping(t *testing.T) { + logp.TestingSetup() + + mbtest.TestDataFiles(t, "istio", "istiod") +} diff --git a/x-pack/metricbeat/module/istio/istiod/manifest.yml b/x-pack/metricbeat/module/istio/istiod/manifest.yml new file mode 100644 index 00000000000..0a8294d9192 --- /dev/null +++ b/x-pack/metricbeat/module/istio/istiod/manifest.yml @@ -0,0 +1,11 @@ +default: false +input: + module: prometheus + metricset: collector + defaults: + metrics_path: /metrics + metrics_filters: + include: ["citadel_*", "galley_*", "pilot_*"] + exclude: ["^up$"] + use_types: true + rate_counters: true diff --git a/x-pack/metricbeat/module/istio/module.yaml b/x-pack/metricbeat/module/istio/module.yaml deleted file mode 100644 index 8b137891791..00000000000 --- a/x-pack/metricbeat/module/istio/module.yaml +++ /dev/null @@ -1 +0,0 @@ - diff --git a/x-pack/metricbeat/module/istio/module.yml b/x-pack/metricbeat/module/istio/module.yml new file mode 100644 index 00000000000..de29503fca5 --- /dev/null +++ b/x-pack/metricbeat/module/istio/module.yml @@ -0,0 +1,3 @@ +name: istio +metricsets: +- istiod diff --git a/x-pack/metricbeat/modules.d/istio.yml.disabled b/x-pack/metricbeat/modules.d/istio.yml.disabled index 1140d047a09..b65bcdef949 100644 --- a/x-pack/metricbeat/modules.d/istio.yml.disabled +++ b/x-pack/metricbeat/modules.d/istio.yml.disabled @@ -35,3 +35,10 @@ period: 10s # use istio-pilot.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ["localhost:15014"] + +# Istio istiod to monitor the Istio Daemon for versions after 1.5 of Istio. +- module: istio + metricsets: ['istiod'] + period: 10s + # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset + hosts: ['localhost:15014'] From a3fe79648592169bf81d482f5d3895a5045d140a Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 13 Oct 2020 13:08:46 +0200 Subject: [PATCH 184/216] Fix leaks with metadata processors (#16349) Add a closer interface for processors so their resources can be released when the processor is not needed anymore. Explicitly close publisher pipelines so their processors are closed. Add closers for add_docker_metadata, add_kubernetes_metadata and add_process_metadata. Script processor will fail if a processor that needs to be closed is used. --- CHANGELOG.next.asciidoc | 1 + libbeat/beat/pipeline.go | 1 + libbeat/cmd/instance/beat.go | 5 + libbeat/common/docker/watcher.go | 7 +- .../add_docker_metadata.go | 12 ++ .../add_docker_metadata_integration_test.go | 120 ++++++++++++++++++ .../add_docker_metadata_test.go | 1 + .../add_kubernetes_metadata/cache.go | 32 +++-- .../add_kubernetes_metadata/kubernetes.go | 10 ++ .../add_process_metadata.go | 46 +++++-- .../add_process_metadata_test.go | 2 +- libbeat/processors/processor.go | 30 +++++ .../javascript/module/processor/chain.go | 11 ++ .../module/processor/processor_test.go | 54 ++++++-- libbeat/publisher/pipeline/client.go | 10 ++ libbeat/publisher/processing/default.go | 12 +- libbeat/publisher/processing/default_test.go | 72 +++++++++++ libbeat/publisher/processing/processing.go | 2 + libbeat/publisher/processing/processors.go | 16 +++ libbeat/tests/docker/docker.go | 20 +++ 20 files changed, 426 insertions(+), 38 deletions(-) create mode 100644 libbeat/processors/add_docker_metadata/add_docker_metadata_integration_test.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 4ca46560ab5..576c0062310 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -180,6 +180,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Explicitly detect missing variables in autodiscover configuration, log them at the debug level. {issue}20568[20568] {pull}20898[20898] - Fix `libbeat.output.write.bytes` and `libbeat.output.read.bytes` metrics of the Elasticsearch output. {issue}20752[20752] {pull}21197[21197] - The `o365input` and `o365` module now recover from an authentication problem or other fatal errors, instead of terminating. {pull}21259[21258] +- Orderly close processors when processing pipelines are not needed anymore to release their resources. {pull}16349[16349] *Auditbeat* diff --git a/libbeat/beat/pipeline.go b/libbeat/beat/pipeline.go index 699c96d8b62..f13b3c39ff2 100644 --- a/libbeat/beat/pipeline.go +++ b/libbeat/beat/pipeline.go @@ -138,6 +138,7 @@ type ClientEventer interface { type ProcessorList interface { Processor + Close() error All() []Processor } diff --git a/libbeat/cmd/instance/beat.go b/libbeat/cmd/instance/beat.go index ca58b9b321f..714b266ea84 100644 --- a/libbeat/cmd/instance/beat.go +++ b/libbeat/cmd/instance/beat.go @@ -371,6 +371,11 @@ func (b *Beat) launch(settings Settings, bt beat.Creator) error { if err != nil { return err } + defer func() { + if err := b.processing.Close(); err != nil { + logp.Warn("Failed to close global processing: %v", err) + } + }() // Windows: Mark service as stopped. // After this is run, a Beat service is considered by the OS to be stopped diff --git a/libbeat/common/docker/watcher.go b/libbeat/common/docker/watcher.go index 0543d37e9c3..2421c232eee 100644 --- a/libbeat/common/docker/watcher.go +++ b/libbeat/common/docker/watcher.go @@ -138,6 +138,7 @@ func NewWatcher(log *logp.Logger, host string, tls *TLSConfig, storeShortID bool // Extra check to confirm that Docker is available _, err = client.Info(context.Background()) if err != nil { + client.Close() return nil, err } @@ -395,14 +396,12 @@ func (w *watcher) cleanupWorker() { log := w.log for { - // Wait a full period - time.Sleep(w.cleanupTimeout) - select { case <-w.ctx.Done(): w.stopped.Done() return - default: + // Wait a full period + case <-time.After(w.cleanupTimeout): // Check entries for timeout var toDelete []string timeout := time.Now().Add(-w.cleanupTimeout) diff --git a/libbeat/processors/add_docker_metadata/add_docker_metadata.go b/libbeat/processors/add_docker_metadata/add_docker_metadata.go index cf0fda79d8d..beaca3bb46b 100644 --- a/libbeat/processors/add_docker_metadata/add_docker_metadata.go +++ b/libbeat/processors/add_docker_metadata/add_docker_metadata.go @@ -209,6 +209,18 @@ func (d *addDockerMetadata) Run(event *beat.Event) (*beat.Event, error) { return event, nil } +func (d *addDockerMetadata) Close() error { + if d.cgroups != nil { + d.cgroups.StopJanitor() + } + d.watcher.Stop() + err := processors.Close(d.sourceProcessor) + if err != nil { + return errors.Wrap(err, "closing source processor of add_docker_metadata") + } + return nil +} + func (d *addDockerMetadata) String() string { return fmt.Sprintf("%v=[match_fields=[%v] match_pids=[%v]]", processorName, strings.Join(d.fields, ", "), strings.Join(d.pidFields, ", ")) diff --git a/libbeat/processors/add_docker_metadata/add_docker_metadata_integration_test.go b/libbeat/processors/add_docker_metadata/add_docker_metadata_integration_test.go new file mode 100644 index 00000000000..91d3315a401 --- /dev/null +++ b/libbeat/processors/add_docker_metadata/add_docker_metadata_integration_test.go @@ -0,0 +1,120 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// +build linux darwin windows +// +build integration + +package add_docker_metadata + +import ( + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/docker" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/processors" + dockertest "github.com/elastic/beats/v7/libbeat/tests/docker" + "github.com/elastic/beats/v7/libbeat/tests/resources" +) + +func TestAddDockerMetadata(t *testing.T) { + goroutines := resources.NewGoroutinesChecker() + defer goroutines.Check(t) + + client, err := docker.NewClient(defaultConfig().Host, nil, nil) + require.NoError(t, err) + + // Docker clients can affect the goroutines checker because they keep + // idle keep-alive connections, so we explicitly close them. + // These idle connections in principle wouldn't represent leaks even if + // the client is not explicitly closed because they are eventually closed. + defer client.Close() + + // Start a container to have some data to enrich events + testClient, err := dockertest.NewClient() + require.NoError(t, err) + // Explicitly close client to don't affect goroutines checker + defer testClient.Close() + + image := "busybox" + cmd := []string{"sleep", "60"} + labels := map[string]string{"label": "foo"} + id, err := testClient.ContainerStart(image, cmd, labels) + require.NoError(t, err) + defer testClient.ContainerRemove(id) + + info, err := testClient.ContainerInspect(id) + require.NoError(t, err) + pid := info.State.Pid + + config, err := common.NewConfigFrom(map[string]interface{}{ + "match_fields": []string{"cid"}, + }) + watcherConstructor := newWatcherWith(client) + processor, err := buildDockerMetadataProcessor(logp.L(), config, watcherConstructor) + require.NoError(t, err) + + t.Run("match container by container id", func(t *testing.T) { + input := &beat.Event{Fields: common.MapStr{ + "cid": id, + }} + result, err := processor.Run(input) + require.NoError(t, err) + + resultLabels, _ := result.Fields.GetValue("container.labels") + expectedLabels := common.MapStr{"label": "foo"} + assert.Equal(t, expectedLabels, resultLabels) + assert.Equal(t, id, result.Fields["cid"]) + }) + + t.Run("match container by process id", func(t *testing.T) { + input := &beat.Event{Fields: common.MapStr{ + "cid": id, + "process.pid": pid, + }} + result, err := processor.Run(input) + require.NoError(t, err) + + resultLabels, _ := result.Fields.GetValue("container.labels") + expectedLabels := common.MapStr{"label": "foo"} + assert.Equal(t, expectedLabels, resultLabels) + assert.Equal(t, id, result.Fields["cid"]) + }) + + t.Run("don't enrich non existing container", func(t *testing.T) { + input := &beat.Event{Fields: common.MapStr{ + "cid": "notexists", + }} + result, err := processor.Run(input) + require.NoError(t, err) + assert.Equal(t, input.Fields, result.Fields) + }) + + err = processors.Close(processor) + require.NoError(t, err) +} + +func newWatcherWith(client docker.Client) docker.WatcherConstructor { + return func(log *logp.Logger, host string, tls *docker.TLSConfig, storeShortID bool) (docker.Watcher, error) { + return docker.NewWatcherWithClient(log, client, 60*time.Second, storeShortID) + } +} diff --git a/libbeat/processors/add_docker_metadata/add_docker_metadata_test.go b/libbeat/processors/add_docker_metadata/add_docker_metadata_test.go index 2d8a5a9e970..f246d597e13 100644 --- a/libbeat/processors/add_docker_metadata/add_docker_metadata_test.go +++ b/libbeat/processors/add_docker_metadata/add_docker_metadata_test.go @@ -16,6 +16,7 @@ // under the License. // +build linux darwin windows +// +build !integration package add_docker_metadata diff --git a/libbeat/processors/add_kubernetes_metadata/cache.go b/libbeat/processors/add_kubernetes_metadata/cache.go index da7492b43a9..5de52efdc1b 100644 --- a/libbeat/processors/add_kubernetes_metadata/cache.go +++ b/libbeat/processors/add_kubernetes_metadata/cache.go @@ -31,6 +31,7 @@ type cache struct { timeout time.Duration deleted map[string]time.Time // key -> when should this obj be deleted metadata map[string]common.MapStr + done chan struct{} } func newCache(cleanupTimeout time.Duration) *cache { @@ -38,6 +39,7 @@ func newCache(cleanupTimeout time.Duration) *cache { timeout: cleanupTimeout, deleted: make(map[string]time.Time), metadata: make(map[string]common.MapStr), + done: make(chan struct{}), } go c.cleanup() return c @@ -67,15 +69,29 @@ func (c *cache) set(key string, data common.MapStr) { } func (c *cache) cleanup() { - ticker := time.Tick(timeout) - for now := range ticker { - c.Lock() - for k, t := range c.deleted { - if now.After(t) { - delete(c.deleted, k) - delete(c.metadata, k) + if timeout <= 0 { + return + } + + ticker := time.NewTicker(timeout) + defer ticker.Stop() + for { + select { + case <-c.done: + return + case now := <-ticker.C: + c.Lock() + for k, t := range c.deleted { + if now.After(t) { + delete(c.deleted, k) + delete(c.metadata, k) + } } + c.Unlock() } - c.Unlock() } } + +func (c *cache) stop() { + close(c.done) +} diff --git a/libbeat/processors/add_kubernetes_metadata/kubernetes.go b/libbeat/processors/add_kubernetes_metadata/kubernetes.go index 2a5f4d2faed..535eb1187ea 100644 --- a/libbeat/processors/add_kubernetes_metadata/kubernetes.go +++ b/libbeat/processors/add_kubernetes_metadata/kubernetes.go @@ -242,6 +242,16 @@ func (k *kubernetesAnnotator) Run(event *beat.Event) (*beat.Event, error) { return event, nil } +func (k *kubernetesAnnotator) Close() error { + if k.watcher != nil { + k.watcher.Stop() + } + if k.cache != nil { + k.cache.stop() + } + return nil +} + func (k *kubernetesAnnotator) addPod(pod *kubernetes.Pod) { metadata := k.indexers.GetMetadata(pod) for _, m := range metadata { diff --git a/libbeat/processors/add_process_metadata/add_process_metadata.go b/libbeat/processors/add_process_metadata/add_process_metadata.go index c41ca9a73d6..01e2cf1e9fe 100644 --- a/libbeat/processors/add_process_metadata/add_process_metadata.go +++ b/libbeat/processors/add_process_metadata/add_process_metadata.go @@ -55,11 +55,12 @@ var ( ) type addProcessMetadata struct { - config config - provider processMetadataProvider - cidProvider cidProvider - log *logp.Logger - mappings common.MapStr + config config + provider processMetadataProvider + cgroupsCache *common.Cache + cidProvider cidProvider + log *logp.Logger + mappings common.MapStr } type processMetadata struct { @@ -81,16 +82,22 @@ type cidProvider interface { } func init() { - processors.RegisterPlugin(processorName, New) + processors.RegisterPlugin(processorName, NewWithCache) jsprocessor.RegisterPlugin("AddProcessMetadata", New) } // New constructs a new add_process_metadata processor. func New(cfg *common.Config) (processors.Processor, error) { - return newProcessMetadataProcessorWithProvider(cfg, &procCache) + return newProcessMetadataProcessorWithProvider(cfg, &procCache, false) } -func newProcessMetadataProcessorWithProvider(cfg *common.Config, provider processMetadataProvider) (proc processors.Processor, err error) { +// NewWithCache construct a new add_process_metadata processor with cache for container IDs. +// Resulting processor implements `Close()` to release the cache resources. +func NewWithCache(cfg *common.Config) (processors.Processor, error) { + return newProcessMetadataProcessorWithProvider(cfg, &procCache, true) +} + +func newProcessMetadataProcessorWithProvider(cfg *common.Config, provider processMetadataProvider, withCache bool) (proc processors.Processor, err error) { // Logging (each processor instance has a unique ID). var ( id = int(instanceID.Inc()) @@ -118,21 +125,25 @@ func newProcessMetadataProcessorWithProvider(cfg *common.Config, provider proces } // don't use cgroup.ProcessCgroupPaths to save it from doing the work when container id disabled if ok := containsValue(mappings, "container.id"); ok { - if config.CgroupCacheExpireTime != 0 { + if withCache && config.CgroupCacheExpireTime != 0 { p.log.Debug("Initializing cgroup cache") evictionListener := func(k common.Key, v common.Value) { p.log.Debugf("Evicted cached cgroups for PID=%v", k) } - cgroupsCache := common.NewCacheWithRemovalListener(config.CgroupCacheExpireTime, 100, evictionListener) - cgroupsCache.StartJanitor(config.CgroupCacheExpireTime) - p.cidProvider = newCidProvider(config.HostPath, config.CgroupPrefixes, config.CgroupRegex, processCgroupPaths, cgroupsCache) + p.cgroupsCache = common.NewCacheWithRemovalListener(config.CgroupCacheExpireTime, 100, evictionListener) + p.cgroupsCache.StartJanitor(config.CgroupCacheExpireTime) + p.cidProvider = newCidProvider(config.HostPath, config.CgroupPrefixes, config.CgroupRegex, processCgroupPaths, p.cgroupsCache) } else { p.cidProvider = newCidProvider(config.HostPath, config.CgroupPrefixes, config.CgroupRegex, processCgroupPaths, nil) } } + if withCache { + return &addProcessMetadataCloser{p}, nil + } + return &p, nil } @@ -253,6 +264,17 @@ func (p *addProcessMetadata) getContainerID(pid int) (string, error) { return cid, nil } +type addProcessMetadataCloser struct { + addProcessMetadata +} + +func (p *addProcessMetadataCloser) Close() error { + if p.addProcessMetadata.cgroupsCache != nil { + p.addProcessMetadata.cgroupsCache.StopJanitor() + } + return nil +} + // String returns the processor representation formatted as a string func (p *addProcessMetadata) String() string { return fmt.Sprintf("%v=[match_pids=%v, mappings=%v, ignore_missing=%v, overwrite_fields=%v, restricted_fields=%v, host_path=%v, cgroup_prefixes=%v]", diff --git a/libbeat/processors/add_process_metadata/add_process_metadata_test.go b/libbeat/processors/add_process_metadata/add_process_metadata_test.go index f9b4aaa681c..493034098cf 100644 --- a/libbeat/processors/add_process_metadata/add_process_metadata_test.go +++ b/libbeat/processors/add_process_metadata/add_process_metadata_test.go @@ -651,7 +651,7 @@ func TestAddProcessMetadata(t *testing.T) { t.Fatal(err) } - proc, err := newProcessMetadataProcessorWithProvider(config, testProcs) + proc, err := newProcessMetadataProcessorWithProvider(config, testProcs, true) if test.initErr == nil { if err != nil { t.Fatal(err) diff --git a/libbeat/processors/processor.go b/libbeat/processors/processor.go index c5002b7cebd..0e772a524da 100644 --- a/libbeat/processors/processor.go +++ b/libbeat/processors/processor.go @@ -20,6 +20,7 @@ package processors import ( "strings" + "github.com/joeshaw/multierror" "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/beat" @@ -35,11 +36,29 @@ type Processors struct { log *logp.Logger } +// Processor is the interface that all processors must implement type Processor interface { Run(event *beat.Event) (*beat.Event, error) String() string } +// Closer defines the interface for processors that should be closed after using +// them. +// Close() is not part of the Processor interface because implementing this method +// is also a way to indicate that the processor keeps some resource that needs to +// be released or orderly closed. +type Closer interface { + Close() error +} + +// Close closes a processor if it implements the Closer interface +func Close(p Processor) error { + if closer, ok := p.(Closer); ok { + return closer.Close() + } + return nil +} + // NewList creates a new empty processor list. // Additional processors can be added to the List field. func NewList(log *logp.Logger) *Processors { @@ -153,6 +172,17 @@ func (procs *Processors) All() []beat.Processor { return ret } +func (procs *Processors) Close() error { + var errs multierror.Errors + for _, p := range procs.List { + err := Close(p) + if err != nil { + errs = append(errs, err) + } + } + return errs.Err() +} + // Run executes the all processors serially and returns the event and possibly // an error. If the event has been dropped (canceled) by a processor in the // list then a nil event is returned. diff --git a/libbeat/processors/script/javascript/module/processor/chain.go b/libbeat/processors/script/javascript/module/processor/chain.go index e58aac29372..9ef3da7859e 100644 --- a/libbeat/processors/script/javascript/module/processor/chain.go +++ b/libbeat/processors/script/javascript/module/processor/chain.go @@ -151,6 +151,17 @@ func newNativeProcessor(constructor processors.Constructor, call gojaCall) (proc if err != nil { return nil, err } + + if closer, ok := p.(processors.Closer); ok { + closer.Close() + // Script processor doesn't support releasing resources of stateful processors, + // what can lead to leaks, so prevent use of these processors. They shouldn't + // be registered. If this error happens, a processor that needs to be closed is + // being registered, this should be avoided. + // See https://github.com/elastic/beats/pull/16349 + return nil, errors.Errorf("stateful processor cannot be used in script processor, this is probably a bug: %s", p) + } + return &nativeProcessor{p}, nil } diff --git a/libbeat/processors/script/javascript/module/processor/processor_test.go b/libbeat/processors/script/javascript/module/processor/processor_test.go index 6ea66f409ff..9e958ee7035 100644 --- a/libbeat/processors/script/javascript/module/processor/processor_test.go +++ b/libbeat/processors/script/javascript/module/processor/processor_test.go @@ -23,6 +23,7 @@ import ( "testing" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" @@ -35,6 +36,7 @@ import ( func init() { RegisterPlugin("Mock", newMock) + RegisterPlugin("MockWithCloser", newMockWithCloser) } func testEvent() *beat.Event { @@ -67,14 +69,10 @@ function process(evt) { logp.TestingSetup() p, err := javascript.NewFromConfig(javascript.Config{Source: script}, nil) - if err != nil { - t.Fatal(err) - } + require.NoError(t, err) evt, err := p.Run(testEvent()) - if err != nil { - t.Fatal(err) - } + require.NoError(t, err) checkEvent(t, evt, "added", "new_value") } @@ -107,14 +105,10 @@ function process(evt) { logp.TestingSetup() p, err := javascript.NewFromConfig(javascript.Config{Source: script}, nil) - if err != nil { - t.Fatal(err) - } + require.NoError(t, err) evt, err := p.Run(testEvent()) - if err != nil { - t.Fatal(err) - } + require.NoError(t, err) // checking if hello world is added to the event in different languages checkEvent(t, evt, "helló", "világ") @@ -123,6 +117,22 @@ function process(evt) { checkEvent(t, evt, "hallo", "Welt") } +func TestProcessorWithCloser(t *testing.T) { + const script = ` +var processor = require('processor'); + +var processorWithCloser = new processor.MockWithCloser().Build() + +function process(evt) { + processorWithCloser.Run(evt); +} +` + + logp.TestingSetup() + _, err := javascript.NewFromConfig(javascript.Config{Source: script}, nil) + require.Error(t, err, "processor that implements Closer() shouldn't be allowed") +} + func checkEvent(t *testing.T, evt *beat.Event, key, value string) { s, err := evt.GetValue(key) assert.NoError(t, err) @@ -162,3 +172,23 @@ func (m *mockProcessor) String() string { s, _ := json.Marshal(m.fields) return fmt.Sprintf("mock=%s", s) } + +type mockProcessorWithCloser struct{} + +func newMockWithCloser(c *common.Config) (processors.Processor, error) { + return &mockProcessorWithCloser{}, nil +} + +func (m *mockProcessorWithCloser) Run(event *beat.Event) (*beat.Event, error) { + // Nothing to do, we only want this struct to implement processors.Closer + return event, nil +} + +func (m *mockProcessorWithCloser) Close() error { + // Nothing to do, we only want this struct to implement processors.Closer + return nil +} + +func (m *mockProcessorWithCloser) String() string { + return "mockWithCloser" +} diff --git a/libbeat/publisher/pipeline/client.go b/libbeat/publisher/pipeline/client.go index 2ce792ed887..edb5a3f1eb3 100644 --- a/libbeat/publisher/pipeline/client.go +++ b/libbeat/publisher/pipeline/client.go @@ -24,6 +24,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common/atomic" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/processors" "github.com/elastic/beats/v7/libbeat/publisher" "github.com/elastic/beats/v7/libbeat/publisher/queue" ) @@ -164,6 +165,15 @@ func (c *client) Close() error { log.Debug("client: unlink from queue") c.unlink() log.Debug("client: done unlink") + + if c.processors != nil { + log.Debug("client: closing processors") + err := processors.Close(c.processors) + if err != nil { + log.Errorf("client: error closing processors: %v", err) + } + log.Debug("client: done closing processors") + } }) return nil } diff --git a/libbeat/publisher/processing/default.go b/libbeat/publisher/processing/default.go index b2a65642e17..f9eab88fe48 100644 --- a/libbeat/publisher/processing/default.go +++ b/libbeat/publisher/processing/default.go @@ -338,7 +338,10 @@ func (b *builder) Create(cfg beat.ProcessingConfig, drop bool) (beat.Processor, } // setup 8: pipeline processors list - processors.add(b.processors) + if b.processors != nil { + // Add the global pipeline as a function processor, so clients cannot close it + processors.add(newProcessor(b.processors.title, b.processors.Run)) + } // setup 9: time series metadata if b.timeSeries { @@ -358,6 +361,13 @@ func (b *builder) Create(cfg beat.ProcessingConfig, drop bool) (beat.Processor, return processors, nil } +func (b *builder) Close() error { + if b.processors != nil { + return b.processors.Close() + } + return nil +} + func makeClientProcessors( log *logp.Logger, cfg beat.ProcessingConfig, diff --git a/libbeat/publisher/processing/default_test.go b/libbeat/publisher/processing/default_test.go index 56dfa75bdd2..637b38cf44d 100644 --- a/libbeat/publisher/processing/default_test.go +++ b/libbeat/publisher/processing/default_test.go @@ -29,6 +29,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/processors" "github.com/elastic/beats/v7/libbeat/processors/actions" "github.com/elastic/ecs/code/go/ecs" ) @@ -317,6 +318,9 @@ func TestNormalization(t *testing.T) { fields.DeepUpdate(test.mod) assert.Equal(t, test.want, actual.Fields) + + err = s.Close() + require.NoError(t, err) }) } } @@ -331,6 +335,9 @@ func TestAlwaysDrop(t *testing.T) { actual, err := prog.Run(&beat.Event{}) require.NoError(t, err) assert.Nil(t, actual) + + err = s.Close() + require.NoError(t, err) } func TestDynamicFields(t *testing.T) { @@ -351,6 +358,52 @@ func TestDynamicFields(t *testing.T) { actual, err = prog.Run(&beat.Event{Fields: common.MapStr{"hello": "world"}}) require.NoError(t, err) assert.Equal(t, common.MapStr{"hello": "world", "dyn": "field"}, actual.Fields) + + err = factory.Close() + require.NoError(t, err) +} + +func TestProcessingClose(t *testing.T) { + factory, err := MakeDefaultSupport(true)(beat.Info{}, logp.L(), common.NewConfig()) + require.NoError(t, err) + + // Inject a processor in the builder that we can check if has been closed. + factoryProcessor := &processorWithClose{} + b := factory.(*builder) + if b.processors == nil { + b.processors = newGroup("global", logp.L()) + } + b.processors.add(factoryProcessor) + + clientProcessor := &processorWithClose{} + g := newGroup("test", logp.L()) + g.add(clientProcessor) + + prog, err := factory.Create(beat.ProcessingConfig{ + Processor: g, + }, false) + require.NoError(t, err) + + // Check that both processors are called + assert.False(t, factoryProcessor.called) + assert.False(t, clientProcessor.called) + _, err = prog.Run(&beat.Event{Fields: common.MapStr{"hello": "world"}}) + require.NoError(t, err) + assert.True(t, factoryProcessor.called) + assert.True(t, clientProcessor.called) + + // Check that closing the client processing pipeline doesn't close the global pipeline + assert.False(t, factoryProcessor.closed) + assert.False(t, clientProcessor.closed) + err = processors.Close(prog) + require.NoError(t, err) + assert.False(t, factoryProcessor.closed) + assert.True(t, clientProcessor.closed) + + // Check that closing the factory closes the processor in the global pipeline + err = factory.Close() + require.NoError(t, err) + assert.True(t, factoryProcessor.closed) } func fromJSON(in string) common.MapStr { @@ -361,3 +414,22 @@ func fromJSON(in string) common.MapStr { } return tmp } + +type processorWithClose struct { + closed bool + called bool +} + +func (p *processorWithClose) Run(e *beat.Event) (*beat.Event, error) { + p.called = true + return e, nil +} + +func (p *processorWithClose) Close() error { + p.closed = true + return nil +} + +func (p *processorWithClose) String() string { + return "processorWithClose" +} diff --git a/libbeat/publisher/processing/processing.go b/libbeat/publisher/processing/processing.go index 4f615fb1422..88feb62c7b2 100644 --- a/libbeat/publisher/processing/processing.go +++ b/libbeat/publisher/processing/processing.go @@ -33,6 +33,8 @@ type SupportFactory func(info beat.Info, log *logp.Logger, cfg *common.Config) ( // will merge the global and local configurations into a common event // processor. // If `drop` is set, then the processor generated must always drop all events. +// A Supporter needs to be closed with `Close()` to release its global resources. type Supporter interface { Create(cfg beat.ProcessingConfig, drop bool) (beat.Processor, error) + Close() error } diff --git a/libbeat/publisher/processing/processors.go b/libbeat/publisher/processing/processors.go index e994eef48cc..3a400d36dad 100644 --- a/libbeat/publisher/processing/processors.go +++ b/libbeat/publisher/processing/processors.go @@ -22,6 +22,8 @@ import ( "strings" "sync" + "github.com/joeshaw/multierror" + "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" @@ -77,6 +79,20 @@ func (p *group) add(processor processors.Processor) { } } +func (p *group) Close() error { + if p == nil { + return nil + } + var errs multierror.Errors + for _, processor := range p.list { + err := processors.Close(processor) + if err != nil { + errs = append(errs, err) + } + } + return errs.Err() +} + func (p *group) String() string { var s []string for _, p := range p.list { diff --git a/libbeat/tests/docker/docker.go b/libbeat/tests/docker/docker.go index b81ffa285ea..888347c5cc7 100644 --- a/libbeat/tests/docker/docker.go +++ b/libbeat/tests/docker/docker.go @@ -77,8 +77,28 @@ func (c Client) ContainerWait(ID string) error { return nil } +// ContainerInspect recovers information of the container +func (c Client) ContainerInspect(ID string) (types.ContainerJSON, error) { + ctx := context.Background() + return c.cli.ContainerInspect(ctx, ID) +} + // ContainerKill kills the given container func (c Client) ContainerKill(ID string) error { ctx := context.Background() return c.cli.ContainerKill(ctx, ID, "KILL") } + +// ContainerRemove kills and removed the given container +func (c Client) ContainerRemove(ID string) error { + ctx := context.Background() + return c.cli.ContainerRemove(ctx, ID, types.ContainerRemoveOptions{ + RemoveVolumes: true, + Force: true, + }) +} + +// Close closes the underlying client +func (c *Client) Close() error { + return c.cli.Close() +} From 500e8b5f81af3a9d0cd369182ac879360b39c64b Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Tue, 13 Oct 2020 07:14:59 -0400 Subject: [PATCH 185/216] Remove dot from file.extension value in Auditbeat FIM (#21644) The ECS file.extension field should not include the dot. For example the value should be "png" and not ".png". Relates elastic/ecs#1016 --- CHANGELOG.next.asciidoc | 1 + auditbeat/module/file_integrity/event.go | 2 +- auditbeat/module/file_integrity/event_test.go | 11 +++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 576c0062310..660fa25a10d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -32,6 +32,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Change event.kind=error to event.kind=event to comply with ECS. {issue}18870[18870] {pull}20685[20685] - Change network.direction values to ECS recommended values (inbound, outbound). {issue}12445[12445] {pull}20695[20695] - Docker container needs to be explicitly run as user root for auditing. {pull}21202[21202] +- File integrity dataset no longer includes the leading dot in `file.extension` values (e.g. it will report "png" instead of ".png") to comply with ECS. {pull}21644[21644] *Filebeat* diff --git a/auditbeat/module/file_integrity/event.go b/auditbeat/module/file_integrity/event.go index 41e4d5a3795..1ee28b7ce35 100644 --- a/auditbeat/module/file_integrity/event.go +++ b/auditbeat/module/file_integrity/event.go @@ -257,7 +257,7 @@ func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event { if e.Info.Type == FileType { if extension := filepath.Ext(e.Path); extension != "" { - file["extension"] = extension + file["extension"] = strings.TrimLeft(extension, ".") } if mimeType := getMimeType(e.Path); mimeType != "" { file["mime_type"] = mimeType diff --git a/auditbeat/module/file_integrity/event_test.go b/auditbeat/module/file_integrity/event_test.go index 79d1309903d..efaafd02041 100644 --- a/auditbeat/module/file_integrity/event_test.go +++ b/auditbeat/module/file_integrity/event_test.go @@ -28,6 +28,7 @@ import ( "time" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" "github.com/elastic/beats/v7/libbeat/common" ) @@ -295,7 +296,11 @@ func TestBuildEvent(t *testing.T) { assertHasKey(t, fields, "event.type") assertHasKey(t, fields, "file.path") - assertHasKey(t, fields, "file.extension") + if assertHasKey(t, fields, "file.extension") { + ext, err := fields.GetValue("file.extension") + require.NoError(t, err) + assert.Equal(t, ext, "txt") + } assertHasKey(t, fields, "file.target_path") assertHasKey(t, fields, "file.inode") assertHasKey(t, fields, "file.uid") @@ -427,10 +432,12 @@ func mustDecodeHex(v string) []byte { return data } -func assertHasKey(t testing.TB, m common.MapStr, key string) { +func assertHasKey(t testing.TB, m common.MapStr, key string) bool { t.Helper() found, err := m.HasKey(key) if err != nil || !found { t.Errorf("key %v not found: %v", key, err) + return false } + return true } From 09234d4e94d4813892160f7d313bc6dec66ca037 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Tue, 13 Oct 2020 13:17:06 +0200 Subject: [PATCH 186/216] fix: update fleet test suite name (#21738) --- .ci/packaging.groovy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index c65fd7f8b56..9087cf48de4 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -230,11 +230,11 @@ def runE2ETestForPackages(){ catchError(buildResult: 'UNSTABLE', message: 'Unable to run e2e tests', stageResult: 'FAILURE') { if ("${env.BEATS_FOLDER}" == "filebeat" || "${env.BEATS_FOLDER}" == "x-pack/filebeat") { - suite = 'helm,ingest-manager' + suite = 'helm,fleet' } else if ("${env.BEATS_FOLDER}" == "metricbeat" || "${env.BEATS_FOLDER}" == "x-pack/metricbeat") { suite = '' } else if ("${env.BEATS_FOLDER}" == "x-pack/elastic-agent") { - suite = 'ingest-manager' + suite = 'fleet' } else { echo("Skipping E2E tests for ${env.BEATS_FOLDER}.") return From 1824e849978f248f4e2da75ae51732963379714a Mon Sep 17 00:00:00 2001 From: EamonnTP Date: Tue, 13 Oct 2020 13:49:48 +0100 Subject: [PATCH 187/216] Update obs app links (#21682) --- libbeat/docs/shared/obs-apps.asciidoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libbeat/docs/shared/obs-apps.asciidoc b/libbeat/docs/shared/obs-apps.asciidoc index 9b5f7354ea0..26698700c21 100644 --- a/libbeat/docs/shared/obs-apps.asciidoc +++ b/libbeat/docs/shared/obs-apps.asciidoc @@ -38,13 +38,13 @@ endif::[] |=== |Elastic apps | Use to -|{kibana-ref}/xpack-infra.html[{metrics-app}] +|{observability-guide}/analyze-metrics.html[{metrics-app}] |Explore metrics about systems and services across your ecosystem -|{kibana-ref}/xpack-logs.html[{logs-app}] +|{observability-guide}/monitor-logs.html[{logs-app}] |Tail related log data in real time -|{kibana-ref}/xpack-uptime.html[{uptime-app}] +|{observability-guide}/monitor-uptime.html[{uptime-app}] |Monitor availability issues across your apps and services |{kibana-ref}/xpack-apm.html[APM app] From 056f0e07b233d3a438b1d21b5182cb2ea49638d2 Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Tue, 13 Oct 2020 16:01:19 +0200 Subject: [PATCH 188/216] Fix for azure retrieve resource by ids (#21711) * mofidy doc * start work * work * changelog * fix test --- CHANGELOG.next.asciidoc | 1 + x-pack/metricbeat/module/azure/client.go | 6 ++--- x-pack/metricbeat/module/azure/client_test.go | 2 +- .../metricbeat/module/azure/mock_service.go | 4 +-- .../module/azure/monitor_service.go | 26 ++++++++++++++----- .../module/azure/service_interface.go | 2 +- 6 files changed, 27 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 660fa25a10d..41de16190a8 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -366,6 +366,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix remote_write flaky test. {pull}21173[21173] - Visualization title fixes in aws, azure and googlecloud compute dashboards. {pull}21098[21098] - Add a switch to the driver definition on SQL module to use pretty names {pull}17378[17378] +- Fix retrieving resources by ID for the azure module. {pull}21711[21711] {issue}21707[21707] - Use timestamp from CloudWatch API when creating events. {pull}21498[21498] *Packetbeat* diff --git a/x-pack/metricbeat/module/azure/client.go b/x-pack/metricbeat/module/azure/client.go index e488fab98b6..dd48f962b59 100644 --- a/x-pack/metricbeat/module/azure/client.go +++ b/x-pack/metricbeat/module/azure/client.go @@ -65,14 +65,14 @@ func (client *Client) InitResources(fn mapResourceMetrics) error { err = errors.Wrap(err, "failed to retrieve resources") return err } - if len(resourceList.Values()) == 0 { + if len(resourceList) == 0 { err = errors.Errorf("failed to retrieve resources: No resources returned using the configuration options resource ID %s, resource group %s, resource type %s, resource query %s", resource.Id, resource.Group, resource.Type, resource.Query) client.Log.Error(err) continue } //map resources to the client - for _, resource := range resourceList.Values() { + for _, resource := range resourceList { if !containsResource(*resource.ID, client.Resources) { client.Resources = append(client.Resources, Resource{ Id: *resource.ID, @@ -84,7 +84,7 @@ func (client *Client) InitResources(fn mapResourceMetrics) error { Subscription: client.Config.SubscriptionId}) } } - resourceMetrics, err := fn(client, resourceList.Values(), resource) + resourceMetrics, err := fn(client, resourceList, resource) if err != nil { return err } diff --git a/x-pack/metricbeat/module/azure/client_test.go b/x-pack/metricbeat/module/azure/client_test.go index 47b88f99cce..6b0df97a370 100644 --- a/x-pack/metricbeat/module/azure/client_test.go +++ b/x-pack/metricbeat/module/azure/client_test.go @@ -50,7 +50,7 @@ func TestInitResources(t *testing.T) { client := NewMockClient() client.Config = resourceQueryConfig m := &MockService{} - m.On("GetResourceDefinitions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(resources.ListResultPage{}, errors.New("invalid resource query")) + m.On("GetResourceDefinitions", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]resources.GenericResource{}, errors.New("invalid resource query")) client.AzureMonitorService = m mr := MockReporterV2{} mr.On("Error", mock.Anything).Return(true) diff --git a/x-pack/metricbeat/module/azure/mock_service.go b/x-pack/metricbeat/module/azure/mock_service.go index f6f54c300e0..601f1de5b45 100644 --- a/x-pack/metricbeat/module/azure/mock_service.go +++ b/x-pack/metricbeat/module/azure/mock_service.go @@ -24,9 +24,9 @@ func (client *MockService) GetResourceDefinitionById(id string) (resources.Gener } // GetResourceDefinitions is a mock function for the azure service -func (client *MockService) GetResourceDefinitions(id []string, group []string, rType string, query string) (resources.ListResultPage, error) { +func (client *MockService) GetResourceDefinitions(id []string, group []string, rType string, query string) ([]resources.GenericResource, error) { args := client.Called(id, group, rType, query) - return args.Get(0).(resources.ListResultPage), args.Error(1) + return args.Get(0).([]resources.GenericResource), args.Error(1) } // GetMetricDefinitions is a mock function for the azure service diff --git a/x-pack/metricbeat/module/azure/monitor_service.go b/x-pack/metricbeat/module/azure/monitor_service.go index 053da3db05b..c3ed4e2fa43 100644 --- a/x-pack/metricbeat/module/azure/monitor_service.go +++ b/x-pack/metricbeat/module/azure/monitor_service.go @@ -55,16 +55,24 @@ func NewService(clientId string, clientSecret string, tenantId string, subscript } // GetResourceDefinitions will retrieve the azure resources based on the options entered -func (service MonitorService) GetResourceDefinitions(id []string, group []string, rType string, query string) (resources.ListResultPage, error) { +func (service MonitorService) GetResourceDefinitions(id []string, group []string, rType string, query string) ([]resources.GenericResource, error) { var resourceQuery string + var resourceList []resources.GenericResource if len(id) > 0 { - var filterList []string - // listing resourceID conditions does not seem to work with the API but querying by name or resource types will work + // listing multiple resourceId conditions does not seem to work with the API, extracting the name and resource type does not work as the position of the `resourceType` can move if a parent resource is involved, filtering by resource name and resource group (if extracted) is also not possible as + // different types of resources can contain the same name. for _, id := range id { - filterList = append(filterList, fmt.Sprintf("name eq '%s'", getResourceNameFromId(id))) + resource, err := service.resourceClient.List(service.context, fmt.Sprintf("resourceId eq '%s'", id), "", nil) + if err != nil { + return nil, err + } + if len(resource.Values()) > 0 { + resourceList = append(resourceList, resource.Values()...) + } } - resourceQuery = fmt.Sprintf("(%s) AND resourceType eq '%s'", strings.Join(filterList, " OR "), getResourceTypeFromId(id[0])) - } else if len(group) > 0 { + return resourceList, nil + } + if len(group) > 0 { var filterList []string for _, gr := range group { filterList = append(filterList, fmt.Sprintf("resourceGroup eq '%s'", gr)) @@ -76,7 +84,11 @@ func (service MonitorService) GetResourceDefinitions(id []string, group []string } else if query != "" { resourceQuery = query } - return service.resourceClient.List(service.context, resourceQuery, "", nil) + result, err := service.resourceClient.List(service.context, resourceQuery, "", nil) + if err == nil { + resourceList = result.Values() + } + return resourceList, err } // GetResourceDefinitionById will retrieve the azure resource based on the resource Id diff --git a/x-pack/metricbeat/module/azure/service_interface.go b/x-pack/metricbeat/module/azure/service_interface.go index e8985a7eedd..30430d03100 100644 --- a/x-pack/metricbeat/module/azure/service_interface.go +++ b/x-pack/metricbeat/module/azure/service_interface.go @@ -12,7 +12,7 @@ import ( // Service interface for the azure monitor service and mock for testing type Service interface { GetResourceDefinitionById(id string) (resources.GenericResource, error) - GetResourceDefinitions(id []string, group []string, rType string, query string) (resources.ListResultPage, error) + GetResourceDefinitions(id []string, group []string, rType string, query string) ([]resources.GenericResource, error) GetMetricDefinitions(resourceId string, namespace string) (insights.MetricDefinitionCollection, error) GetMetricNamespaces(resourceId string) (insights.MetricNamespaceCollection, error) GetMetricValues(resourceId string, namespace string, timegrain string, timespan string, metricNames []string, aggregations string, filter string) ([]insights.Metric, string, error) From 32d45264d27acb5c62a272431dff96c47d1dea83 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 13 Oct 2020 16:36:02 +0200 Subject: [PATCH 189/216] Skip flaky test with oauth2 config in httpjson input (#21749) --- x-pack/filebeat/input/httpjson/config_test.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/x-pack/filebeat/input/httpjson/config_test.go b/x-pack/filebeat/input/httpjson/config_test.go index 85c7c64848d..1986ee7abe9 100644 --- a/x-pack/filebeat/input/httpjson/config_test.go +++ b/x-pack/filebeat/input/httpjson/config_test.go @@ -362,6 +362,7 @@ func TestConfigOauth2Validation(t *testing.T) { "url": "localhost", }, }, + /* Flaky test: https://github.com/elastic/beats/issues/21748 { name: "date_cursor.date_format will fail if invalid", expectedErr: "invalid configuration: date_format is not a valid date layout accessing 'date_cursor'", @@ -370,6 +371,7 @@ func TestConfigOauth2Validation(t *testing.T) { "url": "localhost", }, }, + */ { name: "date_cursor must work with a valid date_format", input: map[string]interface{}{ From f754515e287672405bb1f1b6613deb17471d1f70 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 13 Oct 2020 18:55:46 +0200 Subject: [PATCH 190/216] Remove kafka partition ISR from Metricbeat docs (#21709) Metricbeat doesn't collect this field directly, it collects for each replica if it is in sync or not. --- metricbeat/docs/fields.asciidoc | 10 ---------- metricbeat/module/kafka/fields.go | 2 +- metricbeat/module/kafka/partition/_meta/fields.yml | 4 ---- 3 files changed, 1 insertion(+), 15 deletions(-) diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index 7f1d0f69ab9..a193d630564 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -24870,16 +24870,6 @@ type: long -- -*`kafka.partition.partition.isr`*:: -+ --- -List of isr ids. - - -type: keyword - --- - *`kafka.partition.partition.replica`*:: + -- diff --git a/metricbeat/module/kafka/fields.go b/metricbeat/module/kafka/fields.go index 72ee2cdc60c..96c306b5915 100644 --- a/metricbeat/module/kafka/fields.go +++ b/metricbeat/module/kafka/fields.go @@ -32,5 +32,5 @@ func init() { // AssetKafka returns asset data. // This is the base64 encoded gzipped contents of module/kafka. func AssetKafka() string { - return "eJzUWs2O3DYSvs9TFHwaHyyfdg9zWGDXXgQT27HhOECQi8AmS93MSKRMUj3TfvqApKTWL0W1epx4TtOSqr6PxWKxWMVX8ICnO3gg2QO5ATDc5HgHL97Z3y9uABhqqnhpuBR38J8bAAD3DgrJqhxvAPRBKpNSKTK+v4OM5No+VZgj0XgHe6s245gzfefEX4EgBZ4h7Z85lfZTJauyfjKB21fTVbVT8gFV+3hK36xO//c/pwHeSKGrAhX8ZEXhXmRSFcQKwIEcEXaIAhQSBpmSBdzWYgciWM7FvqfSHBBoo89ReZl0PhiOpTseznqPm/HkcgARHFJnWJzdTOIQxhRqPQn2gKdHqYZE4vAIO6IyXCNrIUZzZmTJaWL/H83bGDoA+8XqcTrnMFApqRIq2RhpYNFFGKcKrKpkjFYSZbiVTXrztxbpU6MGOAuiuNGlE1hh+/XAfhP8a4XAGcjMeWx5RhfugbfhMg+/Br8PHSCCuV8eNLlKQKh9t0CjONV+gftQV7/5+cPvHdk2wO3QkMh1XeyQiNCK+mA/AHMgBsyBa8AjCgNcWzRikIGR0Yu1AVX4tUJtEnogQmCefK2wwkTzbxhi8uWAYL9pJqLWAk46LjoNCZRKsopikhGeI0tLVKlGKkUwxlgeihjHwwtCrafRq6FEBZOaPLEsl8QEmWVo6OFyXjTndpqcltZQVlul8Ars+nZbIiWqYocqYK4r2CieQ9A0q5mUOaduN05yJAxVijlS+3uoasTIfw/N927qNsBXguZIRLqWRi13DToatbZUvkn5gFiiShjXVAqB1CzR+EPKd04GaC7tLl0r2+CsYzr4VHK1GGPOVPz3z8PFpmxS5Kd4No3Es9DRJ0HXzJFbQ/XcbuOSy32S5ZU+pBMuN141cg/u60sctE7w0CRcJLuTQd2E1iVYLqgsuNiDlfJR1g7YKbyYhKzMOhayMnt5bRYK/0RqkK2j0khdjUqBWpM96pQH05HeZNQy2+Cv4w4XgF5h+i9AvdZ0r4TeOr0RcA1Uc8Jdl2u35+yJbLt994Pm2y7XiQqvBRe8qAq/ooiBxwOnh37dQKNgup8+aTASyPiIE+MY3g1r7YtpHDmisi5xTuecfMOOQSYVENAlUp5xWp/NNuS7VCq2hV6t4UzwzGWS60qCawNXcz5orObWmT3Hyt4kr13c5CnNSbAQ5JyLPDnnal1pLLOE1CYsKZVFwUdHh9kByyzTaDMWJ2XH22YzKym4IuF2+HedWmO0neODaHsQPIc1H0z9A/flBTF1GEJXVzXnFPWLs81fKJIGos1QuedUKqQ2gt7Bv5N/hew3W0S8Zi0WluuxcxaAUF0WQrXZiKFCr0bbPJnFn67XwkLNdh2PIcZ0JJyO7RE14+Gsvg0DzYfpOaxox+sUjoMU2hJkXNVrFYdzrXfJED6mxVPogLROX8dFLozsFFZ3aLclu5DCDIp+3gVrZp1W2siiGx8NAUYMAW1Ud7FOIjdiE9veSgvkZO8SgXb0r33OQklOK5/xEe0iBeNZhgoFtYHGPNpY069H18Ykgg0NHB7MZDcifijjteu2yJbD6zPDbrMibF9XYFgR3IN8/qs13wtkTd3Cepb1MJdb15n+3JraEIAjY98bT+r+Ldx6w2k0xtLzbBPOXi7H4YPUQ3NdSqSnahawQJviptuHz4VBJUg+2AlrgG4UCoW/1YnIlJL1SUggBl7ip0fCc7LLsdarm1bHnh9RdPpbK31U4CMG3OPyROEXp7gJPMMG2ZBmx2w5ex5CH53iZUIXbKsXzOd5L7Uby/dI7ULbfARhGDV7m6ezLH3f4Bmm8r1vSHAGtz7VH+XGHVPpeQabMtD33HmTBQDO9DyDuhXzDHb47DVPG2LeIkKfBE2XaO2kzMcFqUhm94Jx620aeNYYALgGLmheMWRNg5yLV5ZM265Cu8PB7f2vn6NGotMFH3uWQZi2RbdMcTaBgivM///bnMknKq7yZtOD2LAWuHIS5LfpxGxGl1PmqQ1u3MD1DlRjXrFHrPoax5prT9vrC3y6fFtzueRq1HZOs4fvcVrmu/or6+6faqmpunv77getu5Mmn0t3lT27pa7sGmLxxd0nMiQHUshKuL3Hy9p8WKphu3ixuk4MPaSaf8OUHBcLtHPVdT13FosCLsjTEnBTGY4GDtzsoVKxVKNgUQ2P+Yq9xd7aOUgVGnW6mIhRHFmtqu67bCXkIvI/iJDvXNR9pL95stYuk8YO43trawBXLI8lwKX7blHzfjZuE9Cvcq1Nl1JovJyBl99Agcv0kfBFH2sh719/BCsAhs+kJ/NYq1v7/b6c7/LLyrjKoOmwWsmjbvpEWb08b8RRbfe/AgAA//9LpueC" + return "eJzUWk9v3LYSv/tTDHJyDlFO7x18eMBrUhRumiZIU6DoReCSo13WEqmQ1NqbT1+QlLT6S1Grddr45JU08/txhhwOZ/gKHvB0Bw8keyA3AIabHO/gxTv7+8UNAENNFS8Nl+IO/ncDAODeQSFZleMNgD5IZVIqRcb3d5CRXNunCnMkGu9gb9VmHHOm75z4KxCkwDOk/TOn0n6qZFXWTyZw+2q6qnZKPqBqH0/pm9Xp/35wGuCNFLoqUMFPVhTuRSZVQawAHMgRYYcoQCFhkClZwG0tdiCC5VzseyrNAYE2+hyVl0nng+FYuuPhrPe4GU8uBxDBIXWGxdnNJA5hTKHWk2APeHqUakgkDo+wIyrDNbIWYuQzI0tOE/v/yG9j6ADsZ6vH6ZzDQKWkSqhkY6SBRRdhnCqwqpIxWkmU4VY26flvLdLHRg1wFkRxo0snsML264H9LviXCoEzkJmbseUZXbgH3obLPPwa/DZ0gAjmfnnQ5CoBoZ67BRrFqfYL3Ie6+s3P7//oyLYBboeGRK7rYodEhFbUe/sBmAMxYA5cAx5RGODaohGDDIyMXqwNqMIvFWqT0AMRAvPkS4UVJpp/xRCTzwcE+03jiFoLOOm46DQkUCrJKopJRniOLC1RpRqpFMEYY3koYhwPLwi1nkavhhIVTGryxLJcEhNklqGhh8t50ZxbNzktraGstkrhFdj17bZESlTFDlXAXFewUTyHoGlWMylzTt1unORIGKoUc6T291DViJH/Hprvnes2wFeC5khEupZGLXcNOhq1tlS+SvmAWKJKGNdUCoHULNH4U8p3TgZoLu0uXSvbMFnHdPCp5Goxxpyp+O+fh4tN2aTIT/FsGolnoaNPgq7xkVtDtW+3ccnlPsnySh/SiSk3XjVyD+7rSyZoneChSbhIdieDugmtS7BcUFlwsQcr5aOsHbBTeDEJWZl1LGRl9vLaLBT+hdQgW0elkboalQK1JnvUKQ+mIz1n1DLb4K8zHS4AvYL7L0C9lrtXQm91bwRcA9WccNfl2u05eyLbbt99p/m2y3WiwmvBBS+qwq8oYuDxwOmhXzfQKJjup08ajAQyPuLETAw/DWvti2kcOaKyU+Kczjn5hh2DTCogoEukPOO0PpttyHepVGwLvVrDmeCZyyTXlQTXBq7mfNBYza0ze46VPSevXdzkKc1JsBDkJhd5cpOrnUpjmSWkNmFJqSwKPjo6zA5YZplGm7E4KTveNptZScEVCbfDv+vUGqPtHB9E24PgOaz5YOofuC8viKnDELq6qjmnqF+cbf5CkTQQbYbKPadSIbUR9A7+m/wnZL/ZIuI1a7GwXI+dswCE6rIQqs1GDBV6NdrmySz+dL0WFmq263gMMaYj4XRsj6gZD736Ngw0H6bnsKInXqdwHKTQliDjql6rOJxrvUuG8DEtnkIHpJ30dVzkwshOYXWHdluyCynMoOjnXbDG67TSRhbd+GgIMGIIaKO6i3USuRGb2PZWWiAne5cItKN/7XMWSnJa+YyPaBcpGM8yVCioDTTm0caafj26NiYRbGjg8GAmuxHxQxmvXbdFthxenxl2mxVh+7oCw4rgHuTzf635XiBr6hZ2ZtkZ5nLrOtOfW1MbAnBk7HvjSd2/hVtvOI3GWHqebcLZy+U4fJB6aK5LifRUzQIWaFPcdPvwuTCoBMkHO2EN0I1CofC3OhGZUrI+CQnEwEvm6ZHwnOxyrPXqptWx50cUnf7Wyjkq8BED0+PyROFXp7gJPMMG2ZBmx2w5ex5CH5ziZUIXbKsX+PO8l9qN5VukdqFtPoIwjJq9zdNZlr5v8Ayu/MU3JDiDW5/qj3LjUSPkGVh88pqnacy7TuiToOkSrZ2U+bgcFMnsXjBufa2BZ40BgGvgguYVQ9a0p7l4Zcm0zSK0+wvc3v/2KWokOl3w8LMMwrQNsmWKs+kLXMH/P7YZi08TXN3Lbs6xQSVw4SPIb9N51YyuhsxTG9x3gesdZ8a8Yg849SWKNZeOtp/u+XTxtOZyycWk7Zxmj77jpMj31FdWvT/WUlNV7/bdd1r1Jk02le4qe3JKXdEzeP52t3kMyYEUshIugfCyNhuVatisXaxtE0MPqeZfMSXHxfLoXG1bz52EooAL8rQE3NRlo4ED92qoVCzVKFhUu2G+Xm6xt9btU4VGnS4mYhRHVququx5bCbmI/C8i5PsGdRfnH3bW2mXS2GF8a2wN4IrlsQS4dNssyu9n4zYB/SqXynQphcbLGXj5DRS4TB8JX5xjLeT96w9gBcDwmfRkHmt1Y73fFfM9dlkZV5czHVYredQtlyirl+eNOKrp/XcAAAD//1uFyto=" } diff --git a/metricbeat/module/kafka/partition/_meta/fields.yml b/metricbeat/module/kafka/partition/_meta/fields.yml index 8f241278589..cf40ad266b9 100644 --- a/metricbeat/module/kafka/partition/_meta/fields.yml +++ b/metricbeat/module/kafka/partition/_meta/fields.yml @@ -33,10 +33,6 @@ type: long description: > Leader id (broker). - - name: isr - type: keyword - description: > - List of isr ids. - name: replica type: long description: > From 7addb4d45502d6f1bc0d5ea9823dc5a926cda9ea Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Tue, 13 Oct 2020 11:36:12 -0600 Subject: [PATCH 191/216] [Filebeat] Add check for context.DeadlineExceeded error (#21732) --- x-pack/filebeat/input/s3/collector.go | 34 ++++++++++++--------------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/x-pack/filebeat/input/s3/collector.go b/x-pack/filebeat/input/s3/collector.go index bf294f94245..1b890513284 100644 --- a/x-pack/filebeat/input/s3/collector.go +++ b/x-pack/filebeat/input/s3/collector.go @@ -148,8 +148,7 @@ func (c *s3Collector) processMessage(svcS3 s3iface.ClientAPI, message sqs.Messag // read from s3 object and create event for each log line err = c.handleS3Objects(svcS3, s3Infos, errC) if err != nil { - err = fmt.Errorf("handleS3Objects failed: %w", err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("handleS3Objects failed: %w", err)) return err } c.logger.Debugf("handleS3Objects succeed") @@ -163,7 +162,12 @@ func (c *s3Collector) processorKeepAlive(svcSQS sqsiface.ClientAPI, message sqs. return nil case err := <-errC: if err != nil { - c.logger.Warn("Processing message failed, updating visibility timeout") + if err == context.DeadlineExceeded { + c.logger.Info("Context deadline exceeded, updating visibility timeout") + } else { + c.logger.Warnf("Processing message failed '%w', updating visibility timeout", err) + } + err := c.changeVisibilityTimeout(queueURL, visibilityTimeout, svcSQS, message.ReceiptHandle) if err != nil { c.logger.Error(fmt.Errorf("SQS ChangeMessageVisibilityRequest failed: %w", err)) @@ -298,8 +302,7 @@ func (c *s3Collector) handleS3Objects(svc s3iface.ClientAPI, s3Infos []s3Info, e c.logger.Debugf("Processing file from s3 bucket \"%s\" with name \"%s\"", info.name, info.key) err := c.createEventsFromS3Info(svc, info, s3Ctx) if err != nil { - err = fmt.Errorf("createEventsFromS3Info failed processing file from s3 bucket \"%s\" with name \"%s\": %w", info.name, info.key, err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("createEventsFromS3Info failed processing file from s3 bucket \"%s\" with name \"%s\": %w", info.name, info.key, err)) s3Ctx.setError(err) } } @@ -326,8 +329,7 @@ func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, // If the SDK can determine the request or retry delay was canceled // by a context the ErrCodeRequestCanceled error will be returned. if awsErr.Code() == awssdk.ErrCodeRequestCanceled { - err = fmt.Errorf("s3 GetObjectRequest canceled for '%s' from S3 bucket '%s': %w", info.key, info.name, err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("s3 GetObjectRequest canceled for '%s' from S3 bucket '%s': %w", info.key, info.name, err)) return err } @@ -345,16 +347,14 @@ func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, isS3ObjGzipped, err := isStreamGzipped(reader) if err != nil { - err = fmt.Errorf("could not determine if S3 object is gzipped: %w", err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("could not determine if S3 object is gzipped: %w", err)) return err } if isS3ObjGzipped { gzipReader, err := gzip.NewReader(reader) if err != nil { - err = fmt.Errorf("gzip.NewReader failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("gzip.NewReader failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err)) return err } reader = bufio.NewReader(gzipReader) @@ -366,8 +366,7 @@ func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, decoder := json.NewDecoder(reader) err := c.decodeJSON(decoder, objectHash, info, s3Ctx) if err != nil { - err = fmt.Errorf("decodeJSONWithKey failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("decodeJSONWithKey failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err)) return err } return nil @@ -383,14 +382,12 @@ func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, event := createEvent(log, offset, info, objectHash, s3Ctx) err = c.forwardEvent(event) if err != nil { - err = fmt.Errorf("forwardEvent failed: %w", err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("forwardEvent failed: %w", err)) return err } return nil } else if err != nil { - err = fmt.Errorf("readStringAndTrimDelimiter failed: %w", err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("readStringAndTrimDelimiter failed: %w", err)) return err } @@ -403,8 +400,7 @@ func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, event := createEvent(log, offset, info, objectHash, s3Ctx) err = c.forwardEvent(event) if err != nil { - err = fmt.Errorf("forwardEvent failed: %w", err) - c.logger.Error(err) + c.logger.Error(fmt.Errorf("forwardEvent failed: %w", err)) return err } } From b0fbfaed277c6c04c23a4be8d30c2a512d915084 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 13 Oct 2020 20:44:32 +0200 Subject: [PATCH 192/216] Add missing configuration annotations (#21736) --- filebeat/input/filestream/config.go | 2 +- filebeat/input/filestream/fswatch.go | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/filebeat/input/filestream/config.go b/filebeat/input/filestream/config.go index c2b1e838ee5..5b582ccf6e8 100644 --- a/filebeat/input/filestream/config.go +++ b/filebeat/input/filestream/config.go @@ -34,7 +34,7 @@ type config struct { Paths []string `config:"paths"` Close closerConfig `config:"close"` - FileWatcher *common.ConfigNamespace `config:"file_watcher"` + FileWatcher *common.ConfigNamespace `config:"prospector"` FileIdentity *common.ConfigNamespace `config:"file_identity"` CleanInactive time.Duration `config:"clean_inactive" validate:"min=0"` CleanRemoved bool `config:"clean_removed"` diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index 1b80971d835..e988fb3cee9 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -57,9 +57,9 @@ type fileScanner struct { type fileWatcherConfig struct { // Interval is the time between two scans. - Interval time.Duration + Interval time.Duration `config:"check_interval"` // Scanner is the configuration of the scanner. - Scanner fileScannerConfig + Scanner fileScannerConfig `config:",inline"` } // fileWatcher gets the list of files from a FSWatcher and creates events by @@ -212,10 +212,9 @@ func (w *fileWatcher) Event() loginp.FSEvent { } type fileScannerConfig struct { - Paths []string - ExcludedFiles []match.Matcher - Symlinks bool - RecursiveGlob bool + ExcludedFiles []match.Matcher `config:"exclude_files"` + Symlinks bool `config:"symlinks"` + RecursiveGlob bool `config:"recursive_glob"` } func defaultFileScannerConfig() fileScannerConfig { From fff5f6a2241e4c9c9513c98c7e821f0a5007d362 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 13 Oct 2020 22:35:02 +0200 Subject: [PATCH 193/216] [Ingest Manager] Agent atomic installer (#21745) [Ingest Manager] Agent atomic installer (#21745) --- .../install/atomic/atomic_installer.go | 62 ++++++++++ .../install/atomic/atomic_installer_test.go | 115 ++++++++++++++++++ .../pkg/artifact/install/installer.go | 8 +- 3 files changed, 184 insertions(+), 1 deletion(-) create mode 100644 x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer.go create mode 100644 x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer_test.go diff --git a/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer.go b/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer.go new file mode 100644 index 00000000000..5e26436bfc4 --- /dev/null +++ b/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer.go @@ -0,0 +1,62 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package atomic + +import ( + "context" + "io/ioutil" + "os" + "path/filepath" +) + +type embeddedInstaller interface { + Install(ctx context.Context, programName, version, installDir string) error +} + +// Installer installs into temporary destination and moves to correct one after +// successful finish. +type Installer struct { + installer embeddedInstaller +} + +// NewInstaller creates a new AtomicInstaller +func NewInstaller(i embeddedInstaller) (*Installer, error) { + return &Installer{ + installer: i, + }, nil +} + +// Install performs installation of program in a specific version. +func (i *Installer) Install(ctx context.Context, programName, version, installDir string) error { + // tar installer uses Dir of installDir to determine location of unpack + tempDir, err := ioutil.TempDir(os.TempDir(), "elastic-agent-install") + if err != nil { + return err + } + tempInstallDir := filepath.Join(tempDir, filepath.Base(installDir)) + + // cleanup install directory before Install + if _, err := os.Stat(installDir); err == nil || os.IsExist(err) { + os.RemoveAll(installDir) + } + + if _, err := os.Stat(tempInstallDir); err == nil || os.IsExist(err) { + os.RemoveAll(tempInstallDir) + } + + if err := i.installer.Install(ctx, programName, version, tempInstallDir); err != nil { + // cleanup unfinished install + os.RemoveAll(tempInstallDir) + return err + } + + if err := os.Rename(tempInstallDir, installDir); err != nil { + os.RemoveAll(installDir) + os.RemoveAll(tempInstallDir) + return err + } + + return nil +} diff --git a/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer_test.go b/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer_test.go new file mode 100644 index 00000000000..d6266659b7d --- /dev/null +++ b/x-pack/elastic-agent/pkg/artifact/install/atomic/atomic_installer_test.go @@ -0,0 +1,115 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package atomic + +import ( + "context" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "sync" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestOKInstall(t *testing.T) { + sig := make(chan int) + ti := &testInstaller{sig} + var wg sync.WaitGroup + i, err := NewInstaller(ti) + + assert.NoError(t, err) + + ctx := context.Background() + installDir := filepath.Join(os.TempDir(), "install_dir") + + wg.Add(1) + go func() { + err := i.Install(ctx, "a", "b", installDir) + assert.NoError(t, err) + wg.Done() + }() + + // signal to process next files + close(sig) + + wg.Wait() + + assert.DirExists(t, installDir) + files := getFiles() + + for name := range files { + path := filepath.Join(installDir, name) + assert.FileExists(t, path) + } + + os.RemoveAll(installDir) +} + +func TestContextCancelledInstall(t *testing.T) { + sig := make(chan int) + ti := &testInstaller{sig} + var wg sync.WaitGroup + i, err := NewInstaller(ti) + + assert.NoError(t, err) + + ctx, cancel := context.WithCancel(context.Background()) + installDir := filepath.Join(os.TempDir(), "install_dir") + + wg.Add(1) + go func() { + err := i.Install(ctx, "a", "b", installDir) + assert.Error(t, err) + wg.Done() + }() + + // cancel before signaling + cancel() + close(sig) + + wg.Wait() + + assert.NoDirExists(t, installDir) +} + +type testInstaller struct { + signal chan int +} + +func (ti *testInstaller) Install(ctx context.Context, programName, version, installDir string) error { + files := getFiles() + if err := os.MkdirAll(installDir, 0777); err != nil { + return err + } + + for name, content := range files { + if err := ctx.Err(); err != nil { + return err + } + + filename := filepath.Join(installDir, name) + if err := ioutil.WriteFile(filename, content, 0666); err != nil { + return err + } + + // wait for all but last + <-ti.signal + } + + return nil +} + +func getFiles() map[string][]byte { + files := make(map[string][]byte) + fileCount := 3 + for i := 1; i <= fileCount; i++ { + files[fmt.Sprintf("file_%d", i)] = []byte(fmt.Sprintf("content of file %d", i)) + } + + return files +} diff --git a/x-pack/elastic-agent/pkg/artifact/install/installer.go b/x-pack/elastic-agent/pkg/artifact/install/installer.go index f04e7a4238e..c606ada5d65 100644 --- a/x-pack/elastic-agent/pkg/artifact/install/installer.go +++ b/x-pack/elastic-agent/pkg/artifact/install/installer.go @@ -12,6 +12,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/install/dir" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/install/atomic" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/install/hooks" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/install/tar" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/install/zip" @@ -60,5 +61,10 @@ func NewInstaller(config *artifact.Config) (InstallerChecker, error) { return nil, err } - return hooks.NewInstallerChecker(installer, dir.NewChecker()) + atomicInstaller, err := atomic.NewInstaller(installer) + if err != nil { + return nil, err + } + + return hooks.NewInstallerChecker(atomicInstaller, dir.NewChecker()) } From a74c74f3e5fdee905c1521edb5ad2d64b2d3a672 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Wed, 14 Oct 2020 10:17:56 +0200 Subject: [PATCH 194/216] [Ingest Manager] Atomic installed forgotten changelog #21780 --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index eb98ef39ded..96f036dd15d 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -15,6 +15,7 @@ - Copy Action store on upgrade {pull}21298[21298] - Include inputs in action store actions {pull}21298[21298] - Fix issue where inputs without processors defined would panic {pull}21628[21628] +- Partial extracted beat result in failure to spawn beat {issue}21718[21718] ==== New features From e3cf9939f97d77f6efd848b1786cbf2e2a963f74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20de=20la=20Pe=C3=B1a?= Date: Wed, 14 Oct 2020 11:23:48 +0200 Subject: [PATCH 195/216] chore: create CI artifacts for DEV usage (#21645) It will create the artifacts with some requirements related to integrity --- .ci/packaging.groovy | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.ci/packaging.groovy b/.ci/packaging.groovy index 9087cf48de4..37eeaa7d223 100644 --- a/.ci/packaging.groovy +++ b/.ci/packaging.groovy @@ -246,8 +246,12 @@ def runE2ETestForPackages(){ def release(){ withBeatsEnv(){ - dir("${env.BEATS_FOLDER}") { - sh(label: "Release ${env.BEATS_FOLDER} ${env.PLATFORMS}", script: 'mage package') + withEnv([ + "DEV=true" + ]) { + dir("${env.BEATS_FOLDER}") { + sh(label: "Release ${env.BEATS_FOLDER} ${env.PLATFORMS}", script: 'mage package') + } } publishPackages("${env.BEATS_FOLDER}") } From 303133990cbe6c001d3242445ab03a2d290c4883 Mon Sep 17 00:00:00 2001 From: Pavel Derendyaev Date: Wed, 14 Oct 2020 12:35:30 +0300 Subject: [PATCH 196/216] typofix for dns timeout configuration option (#21069) --- libbeat/processors/dns/config.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/processors/dns/config.go b/libbeat/processors/dns/config.go index 8b0d6c9bd97..a2c2a98955e 100644 --- a/libbeat/processors/dns/config.go +++ b/libbeat/processors/dns/config.go @@ -31,7 +31,7 @@ import ( type Config struct { CacheConfig `config:",inline"` Nameservers []string `config:"nameservers"` // Required on Windows. /etc/resolv.conf is used if none are given. - Timeout time.Duration `conifg:"timeout"` // Per request timeout (with 2 nameservers the total timeout would be 2x). + Timeout time.Duration `config:"timeout"` // Per request timeout (with 2 nameservers the total timeout would be 2x). Type string `config:"type" validate:"required"` // Reverse is the only supported type currently. Action FieldAction `config:"action"` // Append or replace (defaults to append) when target exists. TagOnFailure []string `config:"tag_on_failure"` // Tags to append when a failure occurs. From 6c80fb3b37df033adcaffa190208e5c1d6e88d7d Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 14 Oct 2020 12:00:07 +0200 Subject: [PATCH 197/216] Increase recommended memory when deploying in Cloud foundry (#21755) --- deploy/cloudfoundry/filebeat/manifest.yml | 2 +- deploy/cloudfoundry/metricbeat/manifest.yml | 2 +- filebeat/docs/running-on-cloudfoundry.asciidoc | 2 +- metricbeat/docs/running-on-cloudfoundry.asciidoc | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deploy/cloudfoundry/filebeat/manifest.yml b/deploy/cloudfoundry/filebeat/manifest.yml index 26ec5a0b958..5c424823cb3 100644 --- a/deploy/cloudfoundry/filebeat/manifest.yml +++ b/deploy/cloudfoundry/filebeat/manifest.yml @@ -1,6 +1,6 @@ applications: - name: filebeat - memory: 256M + memory: 512M instances: 1 buildpacks: - binary_buildpack diff --git a/deploy/cloudfoundry/metricbeat/manifest.yml b/deploy/cloudfoundry/metricbeat/manifest.yml index 40f0459b8da..1a2bb025683 100644 --- a/deploy/cloudfoundry/metricbeat/manifest.yml +++ b/deploy/cloudfoundry/metricbeat/manifest.yml @@ -1,6 +1,6 @@ applications: - name: metricbeat - memory: 256M + memory: 512M instances: 1 buildpacks: - binary_buildpack diff --git a/filebeat/docs/running-on-cloudfoundry.asciidoc b/filebeat/docs/running-on-cloudfoundry.asciidoc index ae9603dc012..c08efa30c5f 100644 --- a/filebeat/docs/running-on-cloudfoundry.asciidoc +++ b/filebeat/docs/running-on-cloudfoundry.asciidoc @@ -66,7 +66,7 @@ To check the status, run: $ cf apps name requested state instances memory disk urls -filebeat started 1/1 256M 1G +filebeat started 1/1 512M 1G ------------------------------------------------ Log events should start flowing to Elasticsearch. The events are annotated with diff --git a/metricbeat/docs/running-on-cloudfoundry.asciidoc b/metricbeat/docs/running-on-cloudfoundry.asciidoc index 2988e4d3a8b..5fdf20c9f72 100644 --- a/metricbeat/docs/running-on-cloudfoundry.asciidoc +++ b/metricbeat/docs/running-on-cloudfoundry.asciidoc @@ -66,7 +66,7 @@ To check the status, run: $ cf apps name requested state instances memory disk urls -metricbeat started 1/1 256M 1G +metricbeat started 1/1 512M 1G ------------------------------------------------ Metrics should start flowing to Elasticsearch. The events are annotated with From 1685f972d39607203a65eb9208941a3bc9d87a86 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 14 Oct 2020 11:03:28 +0100 Subject: [PATCH 198/216] [CI] Support skip-ci label (#21377) --- Jenkinsfile | 14 +++++++++----- Jenkinsfile.yml | 9 ++++----- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 17041987b27..30564270125 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -103,13 +103,17 @@ pipeline { script { def mapParallelTasks = [:] def content = readYaml(file: 'Jenkinsfile.yml') - content['projects'].each { projectName -> - generateStages(project: projectName, changeset: content['changeset']).each { k,v -> - mapParallelTasks["${k}"] = v + if (content?.disabled?.when?.labels && beatsWhen(project: 'top-level', content: content?.disabled?.when)) { + error 'Pull Request has been configured to be disabled when there is a skip-ci label match' + } else { + content['projects'].each { projectName -> + generateStages(project: projectName, changeset: content['changeset']).each { k,v -> + mapParallelTasks["${k}"] = v + } } + notifyBuildReason() + parallel(mapParallelTasks) } - notifyBuildReason() - parallel(mapParallelTasks) } } } diff --git a/Jenkinsfile.yml b/Jenkinsfile.yml index 2278ea93735..f7b21e1cbdf 100644 --- a/Jenkinsfile.yml +++ b/Jenkinsfile.yml @@ -40,10 +40,9 @@ changeset: - "^testing/.*" - "^x-pack/libbeat/.*" -## Proposal -## TBC: This will allow to configure what to do based on the PR configuration disabled: when: - labels: ## Skip the GitHub Pull Request builds if there is a GitHub label match - - "skip-ci" - draft: true ## Skip the GitHub Pull Request builds with Draft PRs. + labels: ## Skip the GitHub Pull Request builds if any of the given GitHub labels match with the assigned labels in the PR. + - skip-ci + ## TODO: This will allow to configure what to do based on the PR configuration + draft: true ## Skip the GitHub Pull Request builds with Draft PRs. \ No newline at end of file From 3e5a167809210e9999732d5e50c7e895e10fc389 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 14 Oct 2020 12:58:48 +0200 Subject: [PATCH 199/216] Make API address and Shard ID required in Cloud Foundry settings (#21759) Having an auto-generated Shard ID leads to duplicated data when trying to scale, increasing the problems of loaded systems. Forcing to set a shard ID makes the user more conscious of the implications of this setting. API address should be always set in a real deployment. --- CHANGELOG.next.asciidoc | 3 +++ deploy/cloudfoundry/filebeat/filebeat.yml | 2 +- deploy/cloudfoundry/metricbeat/metricbeat.yml | 3 ++- .../docs/running-on-cloudfoundry.asciidoc | 8 ------ metricbeat/docs/modules/cloudfoundry.asciidoc | 3 ++- .../docs/running-on-cloudfoundry.asciidoc | 8 ------ .../docs/inputs/input-cloudfoundry.asciidoc | 2 ++ x-pack/libbeat/common/cloudfoundry/config.go | 13 ++-------- .../common/cloudfoundry/config_test.go | 26 +++++++++++++++++-- .../common/cloudfoundry/test/config.go | 9 ++++++- .../add_cloudfoundry_metadata.go | 6 +++++ x-pack/metricbeat/metricbeat.reference.yml | 1 + .../cloudfoundry/_meta/config.reference.yml | 1 + .../module/cloudfoundry/_meta/config.yml | 1 + .../module/cloudfoundry/_meta/docs.asciidoc | 2 +- .../modules.d/cloudfoundry.yml.disabled | 1 + 16 files changed, 55 insertions(+), 34 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 41de16190a8..8ff5fbee069 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -25,6 +25,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Allow embedding of CAs, Certificate of private keys for anything that support TLS in ouputs and inputs https://github.com/elastic/beats/pull/21179 - Update to Golang 1.12.1. {pull}11330[11330] - Disable Alibaba Cloud and Tencent Cloud metadata providers by default. {pull}13812[12812] +- API address is a required setting in `add_cloudfoundry_metadata`. {pull}21759[21759] *Auditbeat* @@ -78,6 +79,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Removed experimental modules `citrix`, `kaspersky`, `rapid7` and `tenable`. {pull}20706[20706] - Add support for GMT timezone offsets in `decode_cef`. {pull}20993[20993] - Fix parsing of Elasticsearch node name by `elasticsearch/slowlog` fileset. {pull}14547[14547] +- API address and shard ID are required settings in the Cloud Foundry input. {pull}21759[21759] *Heartbeat* @@ -95,6 +97,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix ECS compliance of user.id field in system/users metricset {pull}19019[19019] - Rename googlecloud stackdriver metricset to metrics. {pull}19718[19718] - Remove "invalid zero" metrics on Windows and Darwin, don't report linux-only memory and diskio metrics when running under agent. {pull}21457[21457] +- API address and shard ID are required settings in the Cloud Foundry module. {pull}21759[21759] *Packetbeat* diff --git a/deploy/cloudfoundry/filebeat/filebeat.yml b/deploy/cloudfoundry/filebeat/filebeat.yml index f4c4943d4bb..f3d58f079a1 100644 --- a/deploy/cloudfoundry/filebeat/filebeat.yml +++ b/deploy/cloudfoundry/filebeat/filebeat.yml @@ -11,7 +11,7 @@ filebeat.inputs: #doppler_address: ${DOPPLER_ADDRESS} #uaa_address: ${UAA_ADDRESS} #rlp_address: ${RLP_ADDRESS} - #shard_id: ${SHARD_ID} + shard_id: ${SHARD_ID} #version: v1 diff --git a/deploy/cloudfoundry/metricbeat/metricbeat.yml b/deploy/cloudfoundry/metricbeat/metricbeat.yml index c89c00ce983..12cfee75f00 100644 --- a/deploy/cloudfoundry/metricbeat/metricbeat.yml +++ b/deploy/cloudfoundry/metricbeat/metricbeat.yml @@ -11,7 +11,8 @@ metricbeat.modules: #doppler_address: ${DOPPLER_ADDRESS} #uaa_address: ${UAA_ADDRESS} #rlp_address: ${RLP_ADDRESS} - #shard_id: ${SHARD_ID} + shard_id: ${SHARD_ID} + #version: v1 #================================ Outputs ===================================== diff --git a/filebeat/docs/running-on-cloudfoundry.asciidoc b/filebeat/docs/running-on-cloudfoundry.asciidoc index c08efa30c5f..5aa3ef95837 100644 --- a/filebeat/docs/running-on-cloudfoundry.asciidoc +++ b/filebeat/docs/running-on-cloudfoundry.asciidoc @@ -71,11 +71,3 @@ filebeat started 1/1 512M 1G Log events should start flowing to Elasticsearch. The events are annotated with metadata added by the <> processor. - - -[WARNING] -======================================= -*Set shard_id to scale:* By default {beatname_uc} will generate a random `shard_id` when it starts. In the case that -{beatname_uc} needs to be scaled passed 1 instance, be sure to set a static `shard_id`. Not setting a static `shard_id` -will result in duplicate events being pushed to Elasticsearch. -======================================= diff --git a/metricbeat/docs/modules/cloudfoundry.asciidoc b/metricbeat/docs/modules/cloudfoundry.asciidoc index 4d153933c23..614c703d155 100644 --- a/metricbeat/docs/modules/cloudfoundry.asciidoc +++ b/metricbeat/docs/modules/cloudfoundry.asciidoc @@ -117,7 +117,7 @@ Client Secret to authenticate with Cloud Foundry. Default: "". === `shard_id` Shard ID for connection to the RLP Gateway. Use the same ID across multiple {beatname_lc} to shard the load of events -from the RLP Gateway. Default: "(generated UUID)". +from the RLP Gateway. [float] ==== `version` @@ -152,6 +152,7 @@ metricbeat.modules: rlp_address: '${CLOUDFOUNDRY_RLP_ADDRESS:""}' client_id: '${CLOUDFOUNDRY_CLIENT_ID:""}' client_secret: '${CLOUDFOUNDRY_CLIENT_SECRET:""}' + shard_id: metricbeat version: v1 ---- diff --git a/metricbeat/docs/running-on-cloudfoundry.asciidoc b/metricbeat/docs/running-on-cloudfoundry.asciidoc index 5fdf20c9f72..59802ba505d 100644 --- a/metricbeat/docs/running-on-cloudfoundry.asciidoc +++ b/metricbeat/docs/running-on-cloudfoundry.asciidoc @@ -71,11 +71,3 @@ metricbeat started 1/1 512M 1G Metrics should start flowing to Elasticsearch. The events are annotated with metadata added by the <> processor. - - -[WARNING] -======================================= -*Set shard_id to scale:* By default {beatname_uc} will generate a random `shard_id` when it starts. In the case that -{beatname_uc} needs to be scaled passed 1 instance, be sure to set a static `shard_id`. Not setting a static `shard_id` -will result in duplicate events being pushed to Elasticsearch. -======================================= diff --git a/x-pack/filebeat/docs/inputs/input-cloudfoundry.asciidoc b/x-pack/filebeat/docs/inputs/input-cloudfoundry.asciidoc index f8d5dd51015..551d0095b3a 100644 --- a/x-pack/filebeat/docs/inputs/input-cloudfoundry.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-cloudfoundry.asciidoc @@ -23,6 +23,7 @@ Example configurations: api_address: https://api.dev.cfdev.sh client_id: uaa-filebeat client_secret: verysecret + shard_id: filebeat ssl: verification_mode: none ---- @@ -34,6 +35,7 @@ Example configurations: api_address: https://api.dev.cfdev.sh client_id: uaa-filebeat client_secret: verysecret + shard_id: filebeat ssl.certificate_authorities: ["/etc/pki/cf/ca.pem"] ssl.certificate: "/etc/pki/cf/cert.pem" ssl.key: "/etc/pki/cf/cert.key" diff --git a/x-pack/libbeat/common/cloudfoundry/config.go b/x-pack/libbeat/common/cloudfoundry/config.go index 0724bdc66e1..2f15d0c7cf9 100644 --- a/x-pack/libbeat/common/cloudfoundry/config.go +++ b/x-pack/libbeat/common/cloudfoundry/config.go @@ -10,8 +10,6 @@ import ( "strings" "time" - "github.com/gofrs/uuid" - "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" ) @@ -32,14 +30,14 @@ type Config struct { TLS *tlscommon.Config `config:"ssl"` // Override URLs returned from the CF client - APIAddress string `config:"api_address"` + APIAddress string `config:"api_address" validate:"required"` DopplerAddress string `config:"doppler_address"` UaaAddress string `config:"uaa_address"` RlpAddress string `config:"rlp_address"` // ShardID when retrieving events from loggregator, sharing this ID across // multiple filebeats will shard the load of receiving and sending events. - ShardID string `config:"shard_id"` + ShardID string `config:"shard_id" validate:"required"` // Maximum amount of time to cache application objects from CF client. CacheDuration time.Duration `config:"cache_duration"` @@ -50,13 +48,6 @@ type Config struct { // InitDefaults initialize the defaults for the configuration. func (c *Config) InitDefaults() { - // If not provided by the user; subscription ID should be a unique string to avoid clustering by default. - // Default to using a UUID4 string. - uuid, err := uuid.NewV4() - if err != nil { - panic(err) - } - c.ShardID = uuid.String() c.CacheDuration = 120 * time.Second c.CacheRetryDelay = 20 * time.Second c.Version = ConsumerVersionV1 diff --git a/x-pack/libbeat/common/cloudfoundry/config_test.go b/x-pack/libbeat/common/cloudfoundry/config_test.go index bce98a0b642..79ba7d47cc1 100644 --- a/x-pack/libbeat/common/cloudfoundry/config_test.go +++ b/x-pack/libbeat/common/cloudfoundry/config_test.go @@ -22,26 +22,48 @@ func TestValidation(t *testing.T) { var noId Config assert.Error(t, ucfg.MustNewFrom(common.MapStr{ + "api_address": "https://api.dev.cfdev.sh", "client_secret": "client_secret", + "shard_id": "beats-test-1", }).Unpack(&noId)) var noSecret Config assert.Error(t, ucfg.MustNewFrom(common.MapStr{ - "client_id": "client_id", + "api_address": "https://api.dev.cfdev.sh", + "client_id": "client_id", + "shard_id": "beats-test-1", }).Unpack(&noSecret)) + var noAPI Config + assert.Error(t, ucfg.MustNewFrom(common.MapStr{ + "client_id": "client_id", + "client_secret": "client_secret", + "shard_id": "beats-test-1", + }).Unpack(&noAPI)) + + var noShardID Config + assert.Error(t, ucfg.MustNewFrom(common.MapStr{ + "api_address": "https://api.dev.cfdev.sh", + "client_id": "client_id", + "client_secret": "client_secret", + }).Unpack(&noShardID)) + var valid Config assert.NoError(t, ucfg.MustNewFrom(common.MapStr{ + "api_address": "https://api.dev.cfdev.sh", "client_id": "client_id", "client_secret": "client_secret", + "shard_id": "beats-test-1", }).Unpack(&valid)) } func TestInitDefaults(t *testing.T) { var cfCfg Config assert.NoError(t, ucfg.MustNewFrom(common.MapStr{ + "api_address": "https://api.dev.cfdev.sh", "client_id": "client_id", "client_secret": "client_secret", + "shard_id": "beats-test-1", }).Unpack(&cfCfg)) - assert.Len(t, cfCfg.ShardID, 36) + assert.Equal(t, ConsumerVersionV1, cfCfg.Version) } diff --git a/x-pack/libbeat/common/cloudfoundry/test/config.go b/x-pack/libbeat/common/cloudfoundry/test/config.go index f7b9cd18ffb..45059fc559c 100644 --- a/x-pack/libbeat/common/cloudfoundry/test/config.go +++ b/x-pack/libbeat/common/cloudfoundry/test/config.go @@ -7,15 +7,23 @@ package test import ( "os" "testing" + + "github.com/gofrs/uuid" ) func GetConfigFromEnv(t *testing.T) map[string]interface{} { t.Helper() + shardID, err := uuid.NewV4() + if err != nil { + t.Fatalf("Unable to create a random shard ID: %v", err) + } + config := map[string]interface{}{ "api_address": lookupEnv(t, "CLOUDFOUNDRY_API_ADDRESS"), "client_id": lookupEnv(t, "CLOUDFOUNDRY_CLIENT_ID"), "client_secret": lookupEnv(t, "CLOUDFOUNDRY_CLIENT_SECRET"), + "shard_id": shardID.String(), "ssl.verification_mode": "none", } @@ -23,7 +31,6 @@ func GetConfigFromEnv(t *testing.T) map[string]interface{} { optionalConfig(config, "uaa_address", "CLOUDFOUNDRY_UAA_ADDRESS") optionalConfig(config, "rlp_address", "CLOUDFOUNDRY_RLP_ADDRESS") optionalConfig(config, "doppler_address", "CLOUDFOUNDRY_DOPPLER_ADDRESS") - optionalConfig(config, "shard_id", "CLOUDFOUNDRY_SHARD_ID") if t.Failed() { t.FailNow() diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go index c178ea04325..a6b8bd16566 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/add_cloudfoundry_metadata.go @@ -5,6 +5,7 @@ package add_cloudfoundry_metadata import ( + "github.com/gofrs/uuid" "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/beat" @@ -32,6 +33,11 @@ const selector = "add_cloudfoundry_metadata" // New constructs a new add_cloudfoundry_metadata processor. func New(cfg *common.Config) (processors.Processor, error) { var config cloudfoundry.Config + + // ShardID is required in cloudfoundry config to consume from the firehose, + // but not for metadata requests, randomly generate one and use it. + config.ShardID = uuid.Must(uuid.NewV4()).String() + if err := cfg.Unpack(&config); err != nil { return nil, errors.Wrapf(err, "fail to unpack the %v configuration", processorName) } diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index b7b62643353..41552410a38 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -398,6 +398,7 @@ metricbeat.modules: rlp_address: '${CLOUDFOUNDRY_RLP_ADDRESS:""}' client_id: '${CLOUDFOUNDRY_CLIENT_ID:""}' client_secret: '${CLOUDFOUNDRY_CLIENT_SECRET:""}' + shard_id: metricbeat version: v1 #----------------------------- CockroachDB Module ----------------------------- diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/config.reference.yml b/x-pack/metricbeat/module/cloudfoundry/_meta/config.reference.yml index be15db23b65..6299cfc8116 100644 --- a/x-pack/metricbeat/module/cloudfoundry/_meta/config.reference.yml +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/config.reference.yml @@ -10,4 +10,5 @@ rlp_address: '${CLOUDFOUNDRY_RLP_ADDRESS:""}' client_id: '${CLOUDFOUNDRY_CLIENT_ID:""}' client_secret: '${CLOUDFOUNDRY_CLIENT_SECRET:""}' + shard_id: metricbeat version: v1 diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/config.yml b/x-pack/metricbeat/module/cloudfoundry/_meta/config.yml index a2803b06d40..5ea86f3e8de 100644 --- a/x-pack/metricbeat/module/cloudfoundry/_meta/config.yml +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/config.yml @@ -7,3 +7,4 @@ api_address: '${CLOUDFOUNDRY_API_ADDRESS:""}' client_id: '${CLOUDFOUNDRY_CLIENT_ID:""}' client_secret: '${CLOUDFOUNDRY_CLIENT_SECRET:""}' + shard_id: metricbeat diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc b/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc index 4d908802358..752b2aaea0c 100644 --- a/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc @@ -107,7 +107,7 @@ Client Secret to authenticate with Cloud Foundry. Default: "". === `shard_id` Shard ID for connection to the RLP Gateway. Use the same ID across multiple {beatname_lc} to shard the load of events -from the RLP Gateway. Default: "(generated UUID)". +from the RLP Gateway. [float] ==== `version` diff --git a/x-pack/metricbeat/modules.d/cloudfoundry.yml.disabled b/x-pack/metricbeat/modules.d/cloudfoundry.yml.disabled index ae540f20cfc..22a600e51d8 100644 --- a/x-pack/metricbeat/modules.d/cloudfoundry.yml.disabled +++ b/x-pack/metricbeat/modules.d/cloudfoundry.yml.disabled @@ -10,3 +10,4 @@ api_address: '${CLOUDFOUNDRY_API_ADDRESS:""}' client_id: '${CLOUDFOUNDRY_CLIENT_ID:""}' client_secret: '${CLOUDFOUNDRY_CLIENT_SECRET:""}' + shard_id: metricbeat From 85b95ee14300324f4950cdca13df1e04e84cc330 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 14 Oct 2020 13:15:39 +0200 Subject: [PATCH 200/216] Disable writes sync in persistent cache (#21754) With default configuration, every write is synced to disk. For the persistent cache, Beats not need to guarantee that everything is on disk, as the data can be recovered from the source endpoints, but the database was not being properly closed, so there could happen that most of the recent data was lost if the beat is stopped. Now, the processors can close their resources, so the database is properly closed in an normal shutdown, so we can go on without syncs on writes, what gives a much better performance. --- x-pack/libbeat/persistentcache/store.go | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/x-pack/libbeat/persistentcache/store.go b/x-pack/libbeat/persistentcache/store.go index 589fc724e01..e14b90fedda 100644 --- a/x-pack/libbeat/persistentcache/store.go +++ b/x-pack/libbeat/persistentcache/store.go @@ -36,10 +36,7 @@ func newStore(logger *logp.Logger, dir, name string) (*Store, error) { // Opinionated options for the use of badger as a store for metadata caches in Beats. options := badger.DefaultOptions(dbPath) options.Logger = badgerLogger{logger.Named("badger")} - // TODO: Disabling sync writes gives better performance, and data loss wouldn't - // be a problem for caches. But we are not properly closing processors yet, so let - // sync on writes by now. - // options.SyncWrites = false + options.SyncWrites = false db, err := badger.Open(options) if err != nil { From 355eef4f4bf1081568a0cd15bda16d17cd628fb2 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 14 Oct 2020 13:59:52 +0200 Subject: [PATCH 201/216] Use badger code from upstream repository (#21705) Issue in badger with 32-bits architectures has been solved in the release branch used by Beats. Update to the version with this fix and stop using the Elastic fork. --- NOTICE.txt | 6 +++--- go.mod | 3 +-- go.sum | 4 ++-- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index b62c4b5d202..349fe58b3d1 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -4473,12 +4473,12 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/elastic/badger/v2 -Version: v2.2007.2-beats +Dependency : github.com/dgraph-io/badger/v2 +Version: v2.2007.3-0.20201012072640-f5a7e0a1c83b Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/elastic/badger/v2@v2.2007.2-beats/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/dgraph-io/badger/v2@v2.2007.3-0.20201012072640-f5a7e0a1c83b/LICENSE: Apache License Version 2.0, January 2004 diff --git a/go.mod b/go.mod index 0f0bdb3a422..720690f1f2f 100644 --- a/go.mod +++ b/go.mod @@ -45,7 +45,7 @@ require ( github.com/davecgh/go-xdr v0.0.0-20161123171359-e6a2ba005892 // indirect github.com/denisenkom/go-mssqldb v0.0.0-20200206145737-bbfc9a55622e github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2 // indirect - github.com/dgraph-io/badger/v2 v2.2007.2 + github.com/dgraph-io/badger/v2 v2.2007.3-0.20201012072640-f5a7e0a1c83b github.com/dgrijalva/jwt-go v3.2.1-0.20190620180102-5e25c22bd5d6+incompatible // indirect github.com/digitalocean/go-libvirt v0.0.0-20180301200012-6075ea3c39a1 github.com/dlclark/regexp2 v1.1.7-0.20171009020623-7632a260cbaf // indirect @@ -191,7 +191,6 @@ replace ( github.com/Azure/go-autorest => github.com/Azure/go-autorest v12.2.0+incompatible github.com/Shopify/sarama => github.com/elastic/sarama v1.19.1-0.20200629123429-0e7b69039eec github.com/cucumber/godog => github.com/cucumber/godog v0.8.1 - github.com/dgraph-io/badger/v2 => github.com/elastic/badger/v2 v2.2007.2-beats github.com/docker/docker => github.com/docker/engine v0.0.0-20191113042239-ea84732a7725 github.com/docker/go-plugins-helpers => github.com/elastic/go-plugins-helpers v0.0.0-20200207104224-bdf17607b79f github.com/dop251/goja => github.com/andrewkroh/goja v0.0.0-20190128172624-dd2ac4456e20 diff --git a/go.sum b/go.sum index 6f737d7cee2..5c01c612fe3 100644 --- a/go.sum +++ b/go.sum @@ -201,6 +201,8 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200206145737-bbfc9a55622e/go.mod h1:xb github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2 h1:6+hM8KeYKV0Z9EIINNqIEDyyIRAcNc2FW+/TUYNmWyw= github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY= +github.com/dgraph-io/badger/v2 v2.2007.3-0.20201012072640-f5a7e0a1c83b h1:mUDs72Rlzv6A4YN8w3Ra3hU9x/plOQPcQjZYL/1f5SM= +github.com/dgraph-io/badger/v2 v2.2007.3-0.20201012072640-f5a7e0a1c83b/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDmM2p1e+NhhnBCAE= github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de h1:t0UHb5vdojIDUqktM6+xJAfScFBsVpXZmqC9dsgJmeA= github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E= github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ= @@ -239,8 +241,6 @@ github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc= github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I= github.com/eclipse/paho.mqtt.golang v1.2.1-0.20200121105743-0d940dd29fd2 h1:DW6WrARxK5J+o8uAKCiACi5wy9EK1UzrsCpGBPsKHAA= github.com/eclipse/paho.mqtt.golang v1.2.1-0.20200121105743-0d940dd29fd2/go.mod h1:H9keYFcgq3Qr5OUJm/JZI/i6U7joQ8SYLhZwfeOo6Ts= -github.com/elastic/badger/v2 v2.2007.2-beats h1:/rV4bM6fdYvPQhFf2bHHivIb0H4nX8Or7nkWbQ/Q6Ko= -github.com/elastic/badger/v2 v2.2007.2-beats/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDmM2p1e+NhhnBCAE= github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3 h1:lnDkqiRFKm0rxdljqrj3lotWinO9+jFmeDXIC4gvIQs= github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3/go.mod h1:aPqzac6AYkipvp4hufTyMj5PDIphF3+At8zr7r51xjY= github.com/elastic/ecs v1.6.0 h1:8NmgfnsjmKXh9hVsK3H2tZtfUptepNc3msJOAynhtmc= From 3f57f0ead23180dd721858bb40f2c63accb9007a Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 14 Oct 2020 14:52:02 +0100 Subject: [PATCH 202/216] disable TestReceiveEventsAndMetadata/TestSocketCleanup/TestReceiveNewEventsConcurrently in Windows (#21750) --- filebeat/Jenkinsfile.yml | 12 +++++++++++- filebeat/inputsource/unix/server_test.go | 12 ++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml index 6b5a23b7fb2..ffe2cec98b4 100644 --- a/filebeat/Jenkinsfile.yml +++ b/filebeat/Jenkinsfile.yml @@ -33,4 +33,14 @@ stages: mage: "mage build unitTest" platforms: ## override default labels in this specific stage. - "windows-2019" - #- "windows-2016" https://github.com/elastic/beats/issues/19641 + windows-2016: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2016" + when: ## Override the top-level when. + comments: + - "/test filebeat for windows-2016" + labels: + - "windows-2016" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/filebeat/inputsource/unix/server_test.go b/filebeat/inputsource/unix/server_test.go index a9043d14a8e..fc9545100d5 100644 --- a/filebeat/inputsource/unix/server_test.go +++ b/filebeat/inputsource/unix/server_test.go @@ -60,6 +60,10 @@ func TestErrorOnEmptyLineDelimiter(t *testing.T) { } func TestReceiveEventsAndMetadata(t *testing.T) { + if runtime.GOOS == "windows" { + t.Skip("test is only supported on non-windows. See https://github.com/elastic/beats/issues/19641") + return + } expectedMessages := generateMessages(5, 100) largeMessages := generateMessages(10, 4096) extraLargeMessages := generateMessages(2, 65*1024) @@ -255,6 +259,10 @@ func TestSocketOwnershipAndMode(t *testing.T) { } func TestSocketCleanup(t *testing.T) { + if runtime.GOOS == "windows" { + t.Skip("test is only supported on non-windows. See https://github.com/elastic/beats/issues/21757") + return + } path := filepath.Join(os.TempDir(), "test.sock") mockStaleSocket, err := net.Listen("unix", path) require.NoError(t, err) @@ -298,6 +306,10 @@ func TestSocketCleanupRefusal(t *testing.T) { } func TestReceiveNewEventsConcurrently(t *testing.T) { + if runtime.GOOS == "windows" { + t.Skip("test is only supported on non-windows. See https://github.com/elastic/beats/issues/21757") + return + } workers := 4 eventsCount := 100 path := filepath.Join(os.TempDir(), "test.sock") From 4a9b08ae2c67dd9d9631f76e88cf55af54aa3587 Mon Sep 17 00:00:00 2001 From: Alex K <8418476+fearful-symmetry@users.noreply.github.com> Date: Wed, 14 Oct 2020 07:49:01 -0700 Subject: [PATCH 203/216] Fix non-windows fields on system/filesystem (#21758) * fix windows fields on system/filesystem * add changelog * fix tests --- CHANGELOG.next.asciidoc | 1 + metricbeat/module/system/filesystem/helper.go | 4 ++-- metricbeat/module/system/test_system.py | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 8ff5fbee069..0344f6a90d0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -371,6 +371,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add a switch to the driver definition on SQL module to use pretty names {pull}17378[17378] - Fix retrieving resources by ID for the azure module. {pull}21711[21711] {issue}21707[21707] - Use timestamp from CloudWatch API when creating events. {pull}21498[21498] +- Report the correct windows events for system/filesystem {pull}21758[21758] *Packetbeat* diff --git a/metricbeat/module/system/filesystem/helper.go b/metricbeat/module/system/filesystem/helper.go index 4d53ddf2a79..9238df79f59 100644 --- a/metricbeat/module/system/filesystem/helper.go +++ b/metricbeat/module/system/filesystem/helper.go @@ -151,14 +151,14 @@ func GetFilesystemEvent(fsStat *FSStat) common.MapStr { "mount_point": fsStat.Mount, "total": fsStat.Total, "available": fsStat.Avail, - "files": fsStat.Files, + "free": fsStat.Free, "used": common.MapStr{ "pct": fsStat.UsedPercent, "bytes": fsStat.Used, }, } if runtime.GOOS != "windows" { - evt.Put("free", fsStat.Free) + evt.Put("files", fsStat.Files) evt.Put("free_files", fsStat.FreeFiles) } return evt diff --git a/metricbeat/module/system/test_system.py b/metricbeat/module/system/test_system.py index 0cfb820c18a..2e1b9e579d9 100644 --- a/metricbeat/module/system/test_system.py +++ b/metricbeat/module/system/test_system.py @@ -47,7 +47,7 @@ "free_files", "mount_point", "total", "used.bytes", "used.pct"] -SYSTEM_FILESYSTEM_FIELDS_WINDOWS = ["available", "device_name", "type", "files", +SYSTEM_FILESYSTEM_FIELDS_WINDOWS = ["available", "device_name", "type", "free", "mount_point", "total", "used.bytes", "used.pct"] From db3b99dd0eade882af21dd8090847bcb458cac3f Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 14 Oct 2020 16:08:40 +0100 Subject: [PATCH 204/216] [CI] Support Windows-2012 in pipeline 2.0 (#21338) --- Jenkinsfile | 3 ++- auditbeat/Jenkinsfile.yml | 11 +++++++++++ heartbeat/Jenkinsfile.yml | 12 ++++++++++++ metricbeat/Jenkinsfile.yml | 11 +++++++++++ packetbeat/Jenkinsfile.yml | 11 +++++++++++ winlogbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/auditbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/elastic-agent/Jenkinsfile.yml | 11 +++++++++++ x-pack/filebeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/functionbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/metricbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/packetbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/winlogbeat/Jenkinsfile.yml | 11 +++++++++++ 13 files changed, 135 insertions(+), 1 deletion(-) diff --git a/Jenkinsfile b/Jenkinsfile index 30564270125..8f05b4522cd 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -234,9 +234,10 @@ def withBeatsEnv(Map args = [:], Closure body) { artifacts = '**/build/TEST*.out' } else { def chocoPath = 'C:\\ProgramData\\chocolatey\\bin' + def mingw64Path = 'C:\\tools\\mingw64\\bin' def chocoPython3Path = 'C:\\Python38;C:\\Python38\\Scripts' goRoot = "${env.USERPROFILE}\\.gvm\\versions\\go${GO_VERSION}.windows.amd64" - path = "${env.WORKSPACE}\\bin;${goRoot}\\bin;${chocoPath};${chocoPython3Path};${env.PATH}" + path = "${env.WORKSPACE}\\bin;${goRoot}\\bin;${chocoPath};${chocoPython3Path};${env.PATH};${mingw64Path}" magefile = "${env.WORKSPACE}\\.magefile" testResults = "**\\build\\TEST*.xml" artifacts = "**\\build\\TEST*.out" diff --git a/auditbeat/Jenkinsfile.yml b/auditbeat/Jenkinsfile.yml index 6f5374224d4..33d708e2635 100644 --- a/auditbeat/Jenkinsfile.yml +++ b/auditbeat/Jenkinsfile.yml @@ -45,3 +45,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test auditbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/heartbeat/Jenkinsfile.yml b/heartbeat/Jenkinsfile.yml index c465138791b..8d8b00a865d 100644 --- a/heartbeat/Jenkinsfile.yml +++ b/heartbeat/Jenkinsfile.yml @@ -43,3 +43,15 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test heartbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags + diff --git a/metricbeat/Jenkinsfile.yml b/metricbeat/Jenkinsfile.yml index 9860919d006..bdd45090837 100644 --- a/metricbeat/Jenkinsfile.yml +++ b/metricbeat/Jenkinsfile.yml @@ -51,3 +51,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test metricbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/packetbeat/Jenkinsfile.yml b/packetbeat/Jenkinsfile.yml index f755f322477..9fbe272b382 100644 --- a/packetbeat/Jenkinsfile.yml +++ b/packetbeat/Jenkinsfile.yml @@ -43,3 +43,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test packetbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/winlogbeat/Jenkinsfile.yml b/winlogbeat/Jenkinsfile.yml index 82ce7912d3b..94b36b0e647 100644 --- a/winlogbeat/Jenkinsfile.yml +++ b/winlogbeat/Jenkinsfile.yml @@ -30,3 +30,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test winlogbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/auditbeat/Jenkinsfile.yml b/x-pack/auditbeat/Jenkinsfile.yml index 969aa0a8e08..5e0e2223dfa 100644 --- a/x-pack/auditbeat/Jenkinsfile.yml +++ b/x-pack/auditbeat/Jenkinsfile.yml @@ -44,3 +44,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test auditbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/elastic-agent/Jenkinsfile.yml b/x-pack/elastic-agent/Jenkinsfile.yml index 04a6b227721..a36472d123b 100644 --- a/x-pack/elastic-agent/Jenkinsfile.yml +++ b/x-pack/elastic-agent/Jenkinsfile.yml @@ -43,3 +43,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/elastic-agent for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/filebeat/Jenkinsfile.yml b/x-pack/filebeat/Jenkinsfile.yml index b2db448f532..4b17c13b6ac 100644 --- a/x-pack/filebeat/Jenkinsfile.yml +++ b/x-pack/filebeat/Jenkinsfile.yml @@ -44,3 +44,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/filebeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/functionbeat/Jenkinsfile.yml b/x-pack/functionbeat/Jenkinsfile.yml index a8d42ce5fb9..29f2ecf8b5a 100644 --- a/x-pack/functionbeat/Jenkinsfile.yml +++ b/x-pack/functionbeat/Jenkinsfile.yml @@ -43,3 +43,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/functionbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/metricbeat/Jenkinsfile.yml b/x-pack/metricbeat/Jenkinsfile.yml index d02dc5e16aa..60a593c488d 100644 --- a/x-pack/metricbeat/Jenkinsfile.yml +++ b/x-pack/metricbeat/Jenkinsfile.yml @@ -46,3 +46,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/metricbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/packetbeat/Jenkinsfile.yml b/x-pack/packetbeat/Jenkinsfile.yml index fd30546f70a..e3fa9ad0324 100644 --- a/x-pack/packetbeat/Jenkinsfile.yml +++ b/x-pack/packetbeat/Jenkinsfile.yml @@ -29,3 +29,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/winlogbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags diff --git a/x-pack/winlogbeat/Jenkinsfile.yml b/x-pack/winlogbeat/Jenkinsfile.yml index 788d4a35369..371f0aa6f48 100644 --- a/x-pack/winlogbeat/Jenkinsfile.yml +++ b/x-pack/winlogbeat/Jenkinsfile.yml @@ -29,3 +29,14 @@ stages: - "windows-2016" branches: true ## for all the branches tags: true ## for all the tags + windows-2012: + mage: "mage build unitTest" + platforms: ## override default labels in this specific stage. + - "windows-2012-r2" + when: ## Override the top-level when. + comments: + - "/test x-pack/winlogbeat for windows-2012" + labels: + - "windows-2012" + branches: true ## for all the branches + tags: true ## for all the tags From e38d417446bd595fb199a52dd81f1fad1134925d Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 14 Oct 2020 11:09:21 -0400 Subject: [PATCH 205/216] [Elastic Agent] Remove the service installer scripts from packaging (#21694) * Remove the service installer scripts from packaging. * Add changelog. --- dev-tools/packaging/packages.yml | 6 ------ .../install-service-elastic-agent.ps1.tmpl | 19 ------------------- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + 3 files changed, 1 insertion(+), 25 deletions(-) delete mode 100644 dev-tools/packaging/templates/windows/install-service-elastic-agent.ps1.tmpl diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml index dbfbc9f4b7a..aedcd81eb7f 100644 --- a/dev-tools/packaging/packages.yml +++ b/dev-tools/packaging/packages.yml @@ -284,12 +284,6 @@ shared: <<: *common files: <<: *agent_binary_files - install-service-{{.BeatName}}.ps1: - template: '{{ elastic_beats_dir }}/dev-tools/packaging/templates/windows/install-service-elastic-agent.ps1.tmpl' - mode: 0755 - uninstall-service-{{.BeatName}}.ps1: - template: '{{ elastic_beats_dir }}/dev-tools/packaging/templates/windows/uninstall-service.ps1.tmpl' - mode: 0755 'data/{{.BeatName}}-{{ commit_short }}/downloads/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip': source: '{{.AgentDropPath}}/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip' mode: 0644 diff --git a/dev-tools/packaging/templates/windows/install-service-elastic-agent.ps1.tmpl b/dev-tools/packaging/templates/windows/install-service-elastic-agent.ps1.tmpl deleted file mode 100644 index fe037e3b425..00000000000 --- a/dev-tools/packaging/templates/windows/install-service-elastic-agent.ps1.tmpl +++ /dev/null @@ -1,19 +0,0 @@ -$ErrorActionPreference = "Stop" - -# Delete and stop the service if it already exists. -if (Get-Service {{.BeatName}} -ErrorAction SilentlyContinue) { - $service = Get-WmiObject -Class Win32_Service -Filter "name='{{.BeatName}}'" - $service.StopService() - Start-Sleep -s 1 - $service.delete() -} - -$workdir = Split-Path $MyInvocation.MyCommand.Path - -# Create the new service. -New-Service -name {{.BeatName}} ` - -displayName {{.BeatName | title}} ` - -binaryPathName "`"$workdir\{{.BeatName}}.exe`" --path.home `"$workdir`" --path.data `"$workdir\data`" run" - -# Start the new service. -Start-Service -name {{.BeatName}} diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 96f036dd15d..c2a723d552a 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -36,3 +36,4 @@ - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] - Update `fleet.yml` and Kibana hosts when a policy change updates the Kibana hosts {pull}21599[21599] +- Removed `install-service.ps1` and `uninstall-service.ps1` from Windows .zip packaging {pull}21694[21694] From f28d14da067fc59d877e27e8afcc6d76dfdd5f0a Mon Sep 17 00:00:00 2001 From: Steffen Siering Date: Wed, 14 Oct 2020 17:37:59 +0200 Subject: [PATCH 206/216] Fix stress test package list (#21719) --- libbeat/scripts/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libbeat/scripts/Makefile b/libbeat/scripts/Makefile index b0c48d7c9fd..3bdf4774158 100755 --- a/libbeat/scripts/Makefile +++ b/libbeat/scripts/Makefile @@ -41,7 +41,7 @@ export PATH := ./bin:$(PATH) GOFILES = $(shell find . -type f -name '*.go' 2>/dev/null) GOFILES_NOVENDOR = $(shell find . -type f -name '*.go' -not -path "*/vendor/*" 2>/dev/null) GOFILES_ALL = $(GOFILES) $(shell find $(ES_BEATS) -type f -name '*.go' 2>/dev/null) -GOPACKAGES_STRESSTESTS=$(shell find . -name '*.go' 2>/dev/null | xargs awk 'FNR>1 {nextfile} /\+build.*stresstest/ {print FILENAME; nextfile}' | xargs dirname | uniq) +GOPACKAGES_STRESSTESTS=$(shell find . -name '*.go' 2>/dev/null | xargs grep -l '\+build.*stresstest' | xargs -n1 dirname | uniq) SHELL=bash ES_HOST?=elasticsearch ES_PORT?=9200 From de88c5515fa2d1ea2dd348bf3578a51154040128 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Wed, 14 Oct 2020 10:20:35 -0600 Subject: [PATCH 207/216] Change cloud.provider from googlecloud to gcp (#21775) --- CHANGELOG.next.asciidoc | 1 + .../googlecloud/metrics/_meta/data.json | 21 +++++++++++++------ .../timeseries_metadata_collector.go | 2 +- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0344f6a90d0..8da665c7d2b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -97,6 +97,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix ECS compliance of user.id field in system/users metricset {pull}19019[19019] - Rename googlecloud stackdriver metricset to metrics. {pull}19718[19718] - Remove "invalid zero" metrics on Windows and Darwin, don't report linux-only memory and diskio metrics when running under agent. {pull}21457[21457] +- Change cloud.provider from googlecloud to gcp. {pull}21775[21775] - API address and shard ID are required settings in the Cloud Foundry module. {pull}21759[21759] *Packetbeat* diff --git a/x-pack/metricbeat/module/googlecloud/metrics/_meta/data.json b/x-pack/metricbeat/module/googlecloud/metrics/_meta/data.json index c14017dd7df..43fb0505dc3 100644 --- a/x-pack/metricbeat/module/googlecloud/metrics/_meta/data.json +++ b/x-pack/metricbeat/module/googlecloud/metrics/_meta/data.json @@ -2,15 +2,20 @@ "@timestamp": "2017-10-12T08:05:34.853Z", "cloud": { "account": { - "id": "elastic-apm" + "id": "elastic-observability", + "name": "elastic-observability" }, "instance": { - "id": "8867356942891823986", - "name": "apm-ui-dev" + "id": "2029454349697438698", + "name": "nchaulet-loadtest-elasticsearch" }, - "provider": "googlecloud" + "machine": { + "type": "n1-standard-8" + }, + "provider": "gcp" }, - "cloud.availability_zone": "europe-west4-a", + "cloud.availability_zone": "us-central1-a", + "cloud.region": "us-central1", "event": { "dataset": "googlecloud.metrics", "duration": 115000, @@ -21,11 +26,15 @@ "metrics": { "instance": { "uptime": { - "value": 60 + "value": 60.00000000093132 } } } }, + "host": { + "id": "2029454349697438698", + "name": "nchaulet-loadtest-elasticsearch" + }, "metricset": { "name": "metrics", "period": 10000 diff --git a/x-pack/metricbeat/module/googlecloud/timeseries_metadata_collector.go b/x-pack/metricbeat/module/googlecloud/timeseries_metadata_collector.go index d309d78714b..75441e53853 100644 --- a/x-pack/metricbeat/module/googlecloud/timeseries_metadata_collector.go +++ b/x-pack/metricbeat/module/googlecloud/timeseries_metadata_collector.go @@ -58,7 +58,7 @@ func (s *StackdriverTimeSeriesMetadataCollector) Metadata(ctx context.Context, i ECSCloudAccountID: accountID, ECSCloudAccountName: accountID, }, - ECSCloudProvider: "googlecloud", + ECSCloudProvider: "gcp", }, } From 116d7670b9bfe73477a5c0c8883ae7dabd31a1d2 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 14 Oct 2020 13:03:44 -0400 Subject: [PATCH 208/216] [Elastic Agent] Update path from policy change for Kibana connection. (#21804) * Update path from policy change for kibana connection. * Add changelog. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../pkg/agent/application/handler_action_policy_change.go | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index c2a723d552a..51081c2c7a7 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -36,4 +36,5 @@ - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] - Update `fleet.yml` and Kibana hosts when a policy change updates the Kibana hosts {pull}21599[21599] +- Update `fleet.kibana.path` from a POLICY_CHANGE {pull}21804[21804] - Removed `install-service.ps1` and `uninstall-service.ps1` from Windows .zip packaging {pull}21694[21694] diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go index 8821700ee74..30a163a7b5e 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go @@ -73,14 +73,17 @@ func (h *handlerPolicyChange) handleKibanaHosts(c *config.Config) (err error) { // only set protocol/hosts as that is all Fleet currently sends prevProtocol := h.config.Fleet.Kibana.Protocol + prevPath := h.config.Fleet.Kibana.Path prevHosts := h.config.Fleet.Kibana.Hosts h.config.Fleet.Kibana.Protocol = cfg.Fleet.Kibana.Protocol + h.config.Fleet.Kibana.Path = cfg.Fleet.Kibana.Path h.config.Fleet.Kibana.Hosts = cfg.Fleet.Kibana.Hosts // rollback on failure defer func() { if err != nil { h.config.Fleet.Kibana.Protocol = prevProtocol + h.config.Fleet.Kibana.Path = prevPath h.config.Fleet.Kibana.Hosts = prevHosts } }() @@ -113,6 +116,9 @@ func kibanaEqual(k1 *kibana.Config, k2 *kibana.Config) bool { if k1.Protocol != k2.Protocol { return false } + if k1.Path != k2.Path { + return false + } sort.Strings(k1.Hosts) sort.Strings(k2.Hosts) From 34da9c906352d4d8717b42245b5a66cebe5aa693 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Wed, 14 Oct 2020 13:45:16 -0400 Subject: [PATCH 209/216] [Elastic Agent] Don't perform install until after enroll (#21772) * Flip install and enroll. * Update order. * Always perform uninstall of service. * Fix issue with no enrolling. * Fix enrollment no. * Add changelog. --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + x-pack/elastic-agent/pkg/agent/cmd/enroll.go | 4 +- x-pack/elastic-agent/pkg/agent/cmd/install.go | 116 +++++++++++------- .../elastic-agent/pkg/agent/cmd/uninstall.go | 2 +- .../pkg/agent/install/uninstall.go | 10 +- 5 files changed, 74 insertions(+), 59 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 51081c2c7a7..4803b1ba4d2 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -36,5 +36,6 @@ - Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543] - Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425] - Update `fleet.yml` and Kibana hosts when a policy change updates the Kibana hosts {pull}21599[21599] +- Update `install` command to perform enroll before starting Elastic Agent {pull}21772[21772] - Update `fleet.kibana.path` from a POLICY_CHANGE {pull}21804[21804] - Removed `install-service.ps1` and `uninstall-service.ps1` from Windows .zip packaging {pull}21694[21694] diff --git a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go index a92766b9c07..2ae011db291 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go @@ -36,7 +36,7 @@ func newEnrollCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStr Args: cobra.ExactArgs(2), Run: func(c *cobra.Command, args []string) { if err := enroll(streams, c, flags, args); err != nil { - fmt.Fprintf(streams.Err, "%v\n", err) + fmt.Fprintf(streams.Err, "Error: %v\n", err) os.Exit(1) } }, @@ -193,7 +193,7 @@ func enroll(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args // skip restarting noRestart, _ := cmd.Flags().GetBool("no-restart") - if noRestart { + if noRestart || fromInstall { return nil } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/install.go b/x-pack/elastic-agent/pkg/agent/cmd/install.go index 177f79912c9..583bd2fc5b4 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/install.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/install.go @@ -9,6 +9,9 @@ import ( "os" "os/exec" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/spf13/cobra" c "github.com/elastic/beats/v7/libbeat/common/cli" @@ -28,7 +31,7 @@ would like the Agent to operate. `, Run: func(c *cobra.Command, args []string) { if err := installCmd(streams, c, flags, args); err != nil { - fmt.Fprintf(streams.Err, "%v\n", err) + fmt.Fprintf(streams.Err, "Error: %v\n", err) os.Exit(1) } }, @@ -43,6 +46,7 @@ would like the Agent to operate. } func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args []string) error { + var err error if !install.HasRoot() { return fmt.Errorf("unable to perform install command, not executed with %s permissions", install.PermissionUser) } @@ -51,6 +55,16 @@ func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, return fmt.Errorf("already installed at: %s", install.InstallPath) } + // check the lock to ensure that elastic-agent is not already running in this directory + locker := application.NewAppLocker(paths.Data()) + if err := locker.TryLock(); err != nil { + if err == application.ErrAppAlreadyRunning { + return fmt.Errorf("cannot perform installation as Elastic Agent is already running from this directory") + } + return err + } + locker.Unlock() + warn.PrintNotGA(streams.Out) force, _ := cmd.Flags().GetBool("force") if status == install.Broken { @@ -58,7 +72,7 @@ func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, fmt.Fprintf(streams.Out, "Elastic Agent is installed but currently broken: %s\n", reason) confirm, err := c.Confirm(fmt.Sprintf("Continuing will re-install Elastic Agent over the current installation at %s. Do you want to continue?", install.InstallPath), true) if err != nil { - return fmt.Errorf("Error: problem reading prompt response") + return fmt.Errorf("problem reading prompt response") } if !confirm { return fmt.Errorf("installation was cancelled by the user") @@ -68,7 +82,7 @@ func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, if !force { confirm, err := c.Confirm(fmt.Sprintf("Elastic Agent will be installed at %s and will run as a service. Do you want to continue?", install.InstallPath), true) if err != nil { - return fmt.Errorf("Error: problem reading prompt response") + return fmt.Errorf("problem reading prompt response") } if !confirm { return fmt.Errorf("installation was cancelled by the user") @@ -76,17 +90,7 @@ func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, } } - err := install.Install() - if err != nil { - return fmt.Errorf("Error: %s", err) - } - err = install.StartService() - if err != nil { - fmt.Fprintf(streams.Out, "Installation of required system files was successful, but starting of the service failed.\n") - return err - } - fmt.Fprintf(streams.Out, "Installation was successful and Elastic Agent is running.\n") - + enroll := true askEnroll := true kibana, _ := cmd.Flags().GetString("kibana-url") token, _ := cmd.Flags().GetString("enrollment-token") @@ -102,53 +106,71 @@ func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, return fmt.Errorf("problem reading prompt response") } if !confirm { - // not enrolling, all done (standalone mode) - return nil + // not enrolling + enroll = false } } if !askEnroll && (kibana == "" || token == "") { // force was performed without required enrollment arguments, all done (standalone mode) - return nil + enroll = false } - if kibana == "" { - kibana, err = c.ReadInput("Kibana URL you want to enroll this Agent into:") - if err != nil { - return fmt.Errorf("problem reading prompt response") - } + if enroll { if kibana == "" { - fmt.Fprintf(streams.Out, "Enrollment cancelled because no URL was provided.\n") - return nil - } - } - if token == "" { - token, err = c.ReadInput("Fleet enrollment token:") - if err != nil { - return fmt.Errorf("problem reading prompt response") + kibana, err = c.ReadInput("Kibana URL you want to enroll this Agent into:") + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if kibana == "" { + fmt.Fprintf(streams.Out, "Enrollment cancelled because no URL was provided.\n") + return nil + } } if token == "" { - fmt.Fprintf(streams.Out, "Enrollment cancelled because no enrollment token was provided.\n") - return nil + token, err = c.ReadInput("Fleet enrollment token:") + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if token == "" { + fmt.Fprintf(streams.Out, "Enrollment cancelled because no enrollment token was provided.\n") + return nil + } } } - enrollArgs := []string{"enroll", kibana, token, "--from-install"} - enrollArgs = append(enrollArgs, buildEnrollmentFlags(cmd)...) - enrollCmd := exec.Command(install.ExecutablePath(), enrollArgs...) - enrollCmd.Stdin = os.Stdin - enrollCmd.Stdout = os.Stdout - enrollCmd.Stderr = os.Stderr - err = enrollCmd.Start() + err = install.Install() if err != nil { - return fmt.Errorf("failed to execute enroll command: %s", err) + return err } - err = enrollCmd.Wait() - if err == nil { - return nil + + if enroll { + enrollArgs := []string{"enroll", kibana, token, "--from-install"} + enrollArgs = append(enrollArgs, buildEnrollmentFlags(cmd)...) + enrollCmd := exec.Command(install.ExecutablePath(), enrollArgs...) + enrollCmd.Stdin = os.Stdin + enrollCmd.Stdout = os.Stdout + enrollCmd.Stderr = os.Stderr + err = enrollCmd.Start() + if err != nil { + install.Uninstall() + return fmt.Errorf("failed to execute enroll command: %s", err) + } + err = enrollCmd.Wait() + if err != nil { + install.Uninstall() + exitErr, ok := err.(*exec.ExitError) + if ok { + return fmt.Errorf("enroll command failed with exit code: %d", exitErr.ExitCode()) + } + return fmt.Errorf("enroll command failed for unknown reason: %s", err) + } } - exitErr, ok := err.(*exec.ExitError) - if ok { - return fmt.Errorf("enroll command failed with exit code: %d", exitErr.ExitCode()) + + err = install.StartService() + if err != nil { + fmt.Fprintf(streams.Out, "Installation of required system files was successful, but starting of the service failed.\n") + return err } - return fmt.Errorf("enroll command failed for unknown reason: %s", err) + fmt.Fprintf(streams.Out, "Installation was successful and Elastic Agent is running.\n") + return nil } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go b/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go index d215a15e337..ecb42d72b77 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go @@ -28,7 +28,7 @@ Unless -f is used this command will ask confirmation before performing removal. `, Run: func(c *cobra.Command, args []string) { if err := uninstallCmd(streams, c, flags, args); err != nil { - fmt.Fprintf(streams.Err, "%v\n", err) + fmt.Fprintf(streams.Err, "Error: %v\n", err) os.Exit(1) } }, diff --git a/x-pack/elastic-agent/pkg/agent/install/uninstall.go b/x-pack/elastic-agent/pkg/agent/install/uninstall.go index 381427eb8c7..a83681cfb80 100644 --- a/x-pack/elastic-agent/pkg/agent/install/uninstall.go +++ b/x-pack/elastic-agent/pkg/agent/install/uninstall.go @@ -32,15 +32,7 @@ func Uninstall() error { } status = service.StatusStopped } - if status == service.StatusStopped { - err := svc.Uninstall() - if err != nil { - return errors.New( - err, - fmt.Sprintf("failed to uninstall service (%s)", ServiceName), - errors.M("service", ServiceName)) - } - } + _ = svc.Uninstall() // remove, if present on platform if ShellWrapperPath != "" { From 39b1db81034166991f28904278c8282a502d58e6 Mon Sep 17 00:00:00 2001 From: Andrew Cholakian Date: Wed, 14 Oct 2020 13:48:35 -0500 Subject: [PATCH 210/216] [Agent] Remove heartbeat from bundled beats in agent. (#21602) This keeps most of the changes in https://github.com/elastic/beats/pull/20488 but unbundles heartbeat since it's not ready for prime time yet. We may as well keep the work that has been done already IMHO. --- dev-tools/packaging/packages.yml | 41 -------------------- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 - x-pack/elastic-agent/magefile.go | 2 +- 3 files changed, 1 insertion(+), 43 deletions(-) diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml index aedcd81eb7f..e1eff0fdfbb 100644 --- a/dev-tools/packaging/packages.yml +++ b/dev-tools/packaging/packages.yml @@ -74,16 +74,6 @@ shared: source: '{{.AgentDropPath}}/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' mode: 0644 skip_on_missing: true - /var/lib/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' - mode: 0644 - /var/lib/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512' - mode: 0644 - /var/lib/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' - mode: 0644 - skip_on_missing: true /var/lib/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz: source: '{{.AgentDropPath}}/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' mode: 0644 @@ -165,17 +155,6 @@ shared: source: '{{.AgentDropPath}}/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' mode: 0644 skip_on_missing: true - /etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' - mode: 0644 - /etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512' - mode: 0644 - skip_on_missing: true - /etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc: - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' - mode: 0644 - skip_on_missing: true /etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/downloads/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz: source: '{{.AgentDropPath}}/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' mode: 0644 @@ -246,16 +225,6 @@ shared: source: '{{.AgentDropPath}}/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' mode: 0644 skip_on_missing: true - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' - mode: 0644 - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.sha512' - mode: 0644 - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz.asc' - mode: 0644 - skip_on_missing: true 'data/{{.BeatName}}-{{ commit_short }}/downloads/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz': source: '{{.AgentDropPath}}/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.tar.gz' mode: 0644 @@ -294,16 +263,6 @@ shared: source: '{{.AgentDropPath}}/filebeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip.asc' mode: 0644 skip_on_missing: true - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip' - mode: 0644 - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip.sha512': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip.sha512' - mode: 0644 - 'data/{{.BeatName}}-{{ commit_short }}/downloads/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip.asc': - source: '{{.AgentDropPath}}/heartbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip.asc' - mode: 0644 - skip_on_missing: true 'data/{{.BeatName}}-{{ commit_short }}/downloads/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip': source: '{{.AgentDropPath}}/metricbeat-{{ beat_version }}{{if .Snapshot}}-SNAPSHOT{{end}}-{{.GOOS}}-{{.AgentArchName}}.zip' mode: 0644 diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 4803b1ba4d2..deae2522773 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -23,7 +23,6 @@ - Improved version CLI {pull}20359[20359] - Enroll CLI now restarts running daemon {pull}20359[20359] - Add restart CLI cmd {pull}20359[20359] -- Add new `synthetics/*` inputs to run Heartbeat {pull}20387[20387] - Users of the Docker image can now pass `FLEET_ENROLL_INSECURE=1` to include the `--insecure` flag with the `elastic-agent enroll` command {issue}20312[20312] {pull}20713[20713] - Add `docker` composable dynamic provider. {pull}20842[20842] - Add support for dynamic inputs with providers and `{{variable|"default"}}` substitution. {pull}20839[20839] diff --git a/x-pack/elastic-agent/magefile.go b/x-pack/elastic-agent/magefile.go index 4fa067f8f8b..a1aaba840fb 100644 --- a/x-pack/elastic-agent/magefile.go +++ b/x-pack/elastic-agent/magefile.go @@ -572,7 +572,7 @@ func packageAgent(requiredPackages []string, packagingFn func()) { defer os.RemoveAll(dropPath) defer os.Unsetenv(agentDropPath) - packedBeats := []string{"filebeat", "heartbeat", "metricbeat"} + packedBeats := []string{"filebeat", "metricbeat"} for _, b := range packedBeats { pwd, err := filepath.Abs(filepath.Join("..", b)) From 99b4172b3b6b506de32152412647b7ed3e38389f Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Wed, 14 Oct 2020 13:30:15 -0600 Subject: [PATCH 211/216] Move s3_daily_storage and s3_request metricsets to use cloudwatch input (#21703) --- CHANGELOG.next.asciidoc | 1 + .../modules/aws/s3_daily_storage.asciidoc | 1 + .../docs/modules/aws/s3_request.asciidoc | 1 + x-pack/metricbeat/include/list.go | 2 - x-pack/metricbeat/module/aws/module.yml | 2 + .../module/aws/mtest/integration.go | 1 + .../aws/s3_daily_storage/_meta/data.json | 27 +-- .../module/aws/s3_daily_storage/data.go | 21 -- .../module/aws/s3_daily_storage/manifest.yml | 22 ++ .../aws/s3_daily_storage/s3_daily_storage.go | 219 ----------------- .../s3_daily_storage_integration_test.go | 18 +- .../s3_daily_storage/s3_daily_storage_test.go | 21 ++ .../module/aws/s3_request/_meta/data.json | 58 ++--- .../metricbeat/module/aws/s3_request/data.go | 41 ---- .../module/aws/s3_request/manifest.yml | 64 +++++ .../module/aws/s3_request/s3_request.go | 221 ------------------ .../s3_request/s3_request_integration_test.go | 49 ++-- .../module/aws/s3_request/s3_request_test.go | 21 ++ 18 files changed, 209 insertions(+), 581 deletions(-) delete mode 100644 x-pack/metricbeat/module/aws/s3_daily_storage/data.go create mode 100644 x-pack/metricbeat/module/aws/s3_daily_storage/manifest.yml delete mode 100644 x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go create mode 100644 x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_test.go delete mode 100644 x-pack/metricbeat/module/aws/s3_request/data.go create mode 100644 x-pack/metricbeat/module/aws/s3_request/manifest.yml delete mode 100644 x-pack/metricbeat/module/aws/s3_request/s3_request.go create mode 100644 x-pack/metricbeat/module/aws/s3_request/s3_request_test.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 8da665c7d2b..28e66a63034 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -756,6 +756,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Move Prometheus query & remote_write to GA. {pull}21507[21507] - Expand unsupported option from namespace to metrics in the azure module. {pull}21486[21486] - Map cloud data filed `cloud.account.id` to azure subscription. {pull}21483[21483] {issue}21381[21381] +- Move s3_daily_storage and s3_request metricsets to use cloudwatch input. {pull}21703[21703] *Packetbeat* diff --git a/metricbeat/docs/modules/aws/s3_daily_storage.asciidoc b/metricbeat/docs/modules/aws/s3_daily_storage.asciidoc index 251fe923231..7fd8a635a3b 100644 --- a/metricbeat/docs/modules/aws/s3_daily_storage.asciidoc +++ b/metricbeat/docs/modules/aws/s3_daily_storage.asciidoc @@ -8,6 +8,7 @@ This file is generated! See scripts/mage/docs_collector.go include::../../../../x-pack/metricbeat/module/aws/s3_daily_storage/_meta/docs.asciidoc[] +This is a default metricset. If the host module is unconfigured, this metricset is enabled by default. ==== Fields diff --git a/metricbeat/docs/modules/aws/s3_request.asciidoc b/metricbeat/docs/modules/aws/s3_request.asciidoc index 53bef698894..e8d26703b17 100644 --- a/metricbeat/docs/modules/aws/s3_request.asciidoc +++ b/metricbeat/docs/modules/aws/s3_request.asciidoc @@ -8,6 +8,7 @@ This file is generated! See scripts/mage/docs_collector.go include::../../../../x-pack/metricbeat/module/aws/s3_request/_meta/docs.asciidoc[] +This is a default metricset. If the host module is unconfigured, this metricset is enabled by default. ==== Fields diff --git a/x-pack/metricbeat/include/list.go b/x-pack/metricbeat/include/list.go index 053385e2e79..e27c7f9a624 100644 --- a/x-pack/metricbeat/include/list.go +++ b/x-pack/metricbeat/include/list.go @@ -16,8 +16,6 @@ import ( _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/cloudwatch" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/ec2" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/rds" - _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/s3_daily_storage" - _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/s3_request" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/sqs" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights" diff --git a/x-pack/metricbeat/module/aws/module.yml b/x-pack/metricbeat/module/aws/module.yml index 0be20d1d484..c6129426e8b 100644 --- a/x-pack/metricbeat/module/aws/module.yml +++ b/x-pack/metricbeat/module/aws/module.yml @@ -4,6 +4,8 @@ metricsets: - ebs - usage - sns + - s3_daily_storage + - s3_request - lambda - dynamodb - vpn diff --git a/x-pack/metricbeat/module/aws/mtest/integration.go b/x-pack/metricbeat/module/aws/mtest/integration.go index f99d34bb05f..fba6b9fe3b2 100644 --- a/x-pack/metricbeat/module/aws/mtest/integration.go +++ b/x-pack/metricbeat/module/aws/mtest/integration.go @@ -39,6 +39,7 @@ func GetConfigForTest(t *testing.T, metricSetName string, period string) map[str "access_key_id": accessKeyID, "secret_access_key": secretAccessKey, "default_region": defaultRegion, + "latency": "5m", // You can specify which region to run test on by using regions variable // "regions": []string{"us-east-1"}, } diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/_meta/data.json b/x-pack/metricbeat/module/aws/s3_daily_storage/_meta/data.json index 722318a2981..4285889e5d4 100644 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/_meta/data.json +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/_meta/data.json @@ -1,27 +1,28 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", "aws": { - "s3": { - "bucket": { - "name": "test-s3-ks-2" - } + "cloudwatch": { + "namespace": "AWS/S3" + }, + "dimensions": { + "BucketName": "filebeat-aws-elb-test", + "StorageType": "AllStorageTypes" }, - "s3_daily_storage": { - "bucket": { - "size": { - "bytes": 207372 + "s3": { + "metrics": { + "NumberOfObjects": { + "avg": 57828 } - }, - "number_of_objects": 128 + } } }, "cloud": { "account": { - "id": "627959692251", - "name": "elastic-test" + "id": "428152502467", + "name": "elastic-beats" }, "provider": "aws", - "region": "ap-southeast-1" + "region": "eu-central-1" }, "event": { "dataset": "aws.s3_daily_storage", diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/data.go b/x-pack/metricbeat/module/aws/s3_daily_storage/data.go deleted file mode 100644 index 95b5b3cf53d..00000000000 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/data.go +++ /dev/null @@ -1,21 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package s3_daily_storage - -import ( - s "github.com/elastic/beats/v7/libbeat/common/schema" - c "github.com/elastic/beats/v7/libbeat/common/schema/mapstrstr" -) - -var ( - schemaMetricSetFields = s.Schema{ - "bucket": s.Object{ - "size": s.Object{ - "bytes": c.Float("BucketSizeBytes"), - }, - }, - "number_of_objects": c.Float("NumberOfObjects"), - } -) diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/manifest.yml b/x-pack/metricbeat/module/aws/s3_daily_storage/manifest.yml new file mode 100644 index 00000000000..83ed42545c0 --- /dev/null +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/manifest.yml @@ -0,0 +1,22 @@ +default: true +input: + module: aws + metricset: cloudwatch + defaults: + metrics: + - namespace: AWS/S3 + statistic: ["Average"] + name: + - BucketSizeBytes + - NumberOfObjects + +processors: + - rename: + ignore_missing: true + fields: + - from: "aws.s3.metrics.NumberOfObjects.avg" + to: "aws.s3_daily_storage.number_of_objects" + - from: "aws.s3.metrics.BucketSizeBytes.avg" + to: "aws.s3_daily_storage.bucket.size.bytes" + - from: "aws.dimensions.BucketName" + to: "aws.s3.bucket.name" diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go deleted file mode 100644 index d5efa36fb03..00000000000 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage.go +++ /dev/null @@ -1,219 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package s3_daily_storage - -import ( - "fmt" - "strconv" - "strings" - "time" - - "github.com/aws/aws-sdk-go-v2/service/cloudwatch" - "github.com/pkg/errors" - - "github.com/elastic/beats/v7/metricbeat/mb" - awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" - "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" -) - -var metricsetName = "s3_daily_storage" - -// init registers the MetricSet with the central registry as soon as the program -// starts. The New function will be called later to instantiate an instance of -// the MetricSet for each host defined in the module's configuration. After the -// MetricSet has been created then Fetch will begin to be called periodically. -func init() { - mb.Registry.MustAddMetricSet(aws.ModuleName, metricsetName, New) -} - -// MetricSet holds any configuration or state information. It must implement -// the mb.MetricSet interface. And this is best achieved by embedding -// mb.BaseMetricSet because it implements all of the required mb.MetricSet -// interface methods except for Fetch. -type MetricSet struct { - *aws.MetricSet -} - -// New creates a new instance of the MetricSet. New is responsible for unpacking -// any MetricSet specific configuration options if there are any. -func New(base mb.BaseMetricSet) (mb.MetricSet, error) { - moduleConfig := aws.Config{} - if err := base.Module().UnpackConfig(&moduleConfig); err != nil { - return nil, err - } - - metricSet, err := aws.NewMetricSet(base) - if err != nil { - return nil, errors.Wrap(err, "error creating aws metricset") - } - - // Check if period is set to be multiple of 86400s - remainder := int(metricSet.Period.Seconds()) % 86400 - if remainder != 0 { - err := errors.New("period needs to be set to 86400s (or a multiple of 86400s). " + - "To avoid data missing or extra costs, please make sure period is set correctly " + - "in config.yml") - base.Logger().Info(err) - } - - return &MetricSet{ - MetricSet: metricSet, - }, nil -} - -// Fetch methods implements the data gathering and data conversion to the right -// format. It publishes the event which is then forwarded to the output. In case -// of an error set the Error field of mb.Event or simply call report.Error(). -func (m *MetricSet) Fetch(report mb.ReporterV2) error { - namespace := "AWS/S3" - // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) - m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) - - // GetMetricData for AWS S3 from Cloudwatch - for _, regionName := range m.MetricSet.RegionsList { - awsConfig := m.MetricSet.AwsConfig.Copy() - awsConfig.Region = regionName - - svcCloudwatch := cloudwatch.New(awscommon.EnrichAWSConfigWithEndpoint( - m.Endpoint, "monitoring", regionName, awsConfig)) - - listMetricsOutputs, err := aws.GetListMetricsOutput(namespace, regionName, svcCloudwatch) - if err != nil { - err = errors.Wrap(err, "GetListMetricsOutput failed, skipping region "+regionName) - m.Logger().Error(err.Error()) - report.Error(err) - continue - } - - if listMetricsOutputs == nil || len(listMetricsOutputs) == 0 { - continue - } - - metricDataQueries := constructMetricQueries(listMetricsOutputs, m.Period) - // Use metricDataQueries to make GetMetricData API calls - metricDataOutputs, err := aws.GetMetricDataResults(metricDataQueries, svcCloudwatch, startTime, endTime) - if err != nil { - err = errors.Wrap(err, "GetMetricDataResults failed, skipping region "+regionName) - m.Logger().Error(err) - report.Error(err) - continue - } - - // Create Cloudwatch Events for s3_daily_storage - bucketNames := getBucketNames(listMetricsOutputs) - for _, bucketName := range bucketNames { - event, err := createCloudWatchEvents(metricDataOutputs, regionName, bucketName, m.AccountName, m.AccountID) - if err != nil { - err = errors.Wrap(err, "createCloudWatchEvents failed") - m.Logger().Error(err) - event.Error = err - report.Event(event) - continue - } - - if reported := report.Event(event); !reported { - m.Logger().Debug("Fetch interrupted, failed to emit event") - return nil - } - } - } - - return nil -} - -func getBucketNames(listMetricsOutputs []cloudwatch.Metric) (bucketNames []string) { - for _, output := range listMetricsOutputs { - for _, dim := range output.Dimensions { - if *dim.Name == "BucketName" { - if exists, _ := aws.StringInSlice(*dim.Value, bucketNames); exists { - continue - } - bucketNames = append(bucketNames, *dim.Value) - } - } - } - return -} - -func constructMetricQueries(listMetricsOutputs []cloudwatch.Metric, period time.Duration) []cloudwatch.MetricDataQuery { - var metricDataQueries []cloudwatch.MetricDataQuery - metricDataQueryEmpty := cloudwatch.MetricDataQuery{} - metricNames := []string{"NumberOfObjects", "BucketSizeBytes"} - for i, listMetric := range listMetricsOutputs { - if exists, _ := aws.StringInSlice(*listMetric.MetricName, metricNames); !exists { - continue - } - - metricDataQuery := createMetricDataQuery(listMetric, period, i) - if metricDataQuery == metricDataQueryEmpty { - continue - } - metricDataQueries = append(metricDataQueries, metricDataQuery) - } - return metricDataQueries -} - -func createMetricDataQuery(metric cloudwatch.Metric, period time.Duration, index int) (metricDataQuery cloudwatch.MetricDataQuery) { - statistic := "Average" - periodInSec := int64(period.Seconds()) - id := "s3d" + strconv.Itoa(index) - metricDims := metric.Dimensions - bucketName := "" - storageType := "" - for _, dim := range metricDims { - if *dim.Name == "BucketName" { - bucketName = *dim.Value - } else if *dim.Name == "StorageType" { - storageType = *dim.Value - } - } - metricName := *metric.MetricName - label := bucketName + " " + storageType + " " + metricName - - metricDataQuery = cloudwatch.MetricDataQuery{ - Id: &id, - MetricStat: &cloudwatch.MetricStat{ - Period: &periodInSec, - Stat: &statistic, - Metric: &metric, - }, - Label: &label, - } - return -} - -func createCloudWatchEvents(outputs []cloudwatch.MetricDataResult, regionName string, bucketName string, accountName string, accountID string) (event mb.Event, err error) { - // AWS s3_daily_storage metrics - mapOfMetricSetFieldResults := make(map[string]interface{}) - - // Find a timestamp for all metrics in output - timestamp := aws.FindTimestamp(outputs) - if !timestamp.IsZero() { - for _, output := range outputs { - if len(output.Values) == 0 { - continue - } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, " ") - if labels[0] == bucketName && len(output.Values) > timestampIdx { - mapOfMetricSetFieldResults[labels[2]] = fmt.Sprint(output.Values[timestampIdx]) - } - } - } - } - - resultMetricSetFields, err := aws.EventMapping(mapOfMetricSetFieldResults, schemaMetricSetFields) - if err != nil { - err = errors.Wrap(err, "Error trying to apply schema schemaMetricSetFields in AWS s3_daily_storage metricbeat module.") - return - } - - event = aws.InitEvent(regionName, accountName, accountID, timestamp) - event.MetricSetFields = resultMetricSetFields - event.RootFields.Put("aws.s3.bucket.name", bucketName) - return -} diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_integration_test.go b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_integration_test.go index 592416a56a8..4042f332b8e 100644 --- a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_integration_test.go +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_integration_test.go @@ -28,22 +28,18 @@ func TestFetch(t *testing.T) { assert.NotEmpty(t, events) for _, event := range events { - // RootField - mtest.CheckEventField("service.name", "string", event, t) mtest.CheckEventField("cloud.region", "string", event, t) - - // MetricSetField - mtest.CheckEventField("bucket.name", "string", event, t) - mtest.CheckEventField("bucket.size.bytes", "float", event, t) - mtest.CheckEventField("number_of_objects", "float", event, t) + mtest.CheckEventField("aws.dimensions.BucketName", "string", event, t) + mtest.CheckEventField("aws.dimensions.StorageType", "string", event, t) + mtest.CheckEventField("aws.s3.metrics.BucketSizeBytes.avg", "float", event, t) + mtest.CheckEventField("aws.s3.metrics.NumberOfObjects.avg", "float", event, t) + break } } func TestData(t *testing.T) { config := mtest.GetConfigForTest(t, "s3_daily_storage", "86400s") - metricSet := mbtest.NewReportingMetricSetV2Error(t, config) - if err := mbtest.WriteEventsReporterV2Error(metricSet, t, "/"); err != nil { - t.Fatal("write", err) - } + metricSet := mbtest.NewFetcher(t, config) + metricSet.WriteEvents(t, "/") } diff --git a/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_test.go b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_test.go new file mode 100644 index 00000000000..16008223a92 --- /dev/null +++ b/x-pack/metricbeat/module/aws/s3_daily_storage/s3_daily_storage_test.go @@ -0,0 +1,21 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package s3_daily_storage + +import ( + "os" + + "github.com/elastic/beats/v7/metricbeat/mb" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/cloudwatch" +) + +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +} diff --git a/x-pack/metricbeat/module/aws/s3_request/_meta/data.json b/x-pack/metricbeat/module/aws/s3_request/_meta/data.json index d8dfc488a83..8bdda96ef8d 100644 --- a/x-pack/metricbeat/module/aws/s3_request/_meta/data.json +++ b/x-pack/metricbeat/module/aws/s3_request/_meta/data.json @@ -1,40 +1,46 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", "aws": { - "s3": { - "bucket": { - "name": "test-s3-ks-2" - } + "cloudwatch": { + "namespace": "AWS/S3" }, - "s3_request": { - "downloaded": { - "bytes": 534 - }, - "errors": { - "4xx": 0, - "5xx": 0 - }, - "latency": { - "first_byte.ms": 214, - "total_request.ms": 533 - }, - "requests": { - "list": 2, - "put": 10, - "total": 12 - }, - "uploaded": { - "bytes": 13572 + "dimensions": { + "BucketName": "test-ks-1", + "FilterId": "EntireBucket" + }, + "s3": { + "metrics": { + "4xxErrors": { + "avg": 0 + }, + "5xxErrors": { + "avg": 0 + }, + "AllRequests": { + "avg": 1 + }, + "BytesUploaded": { + "avg": 684 + }, + "FirstByteLatency": { + "avg": 21.791666666666668 + }, + "PutRequests": { + "avg": 1 + }, + "TotalRequestLatency": { + "avg": 35.916666666666664 + } } } }, "cloud": { "account": { - "id": "627959692251", - "name": "elastic-test" + "id": "428152502467", + "name": "elastic-beats" }, "provider": "aws", - "region": "ap-southeast-1" + "region": "us-east-1" }, "event": { "dataset": "aws.s3_request", diff --git a/x-pack/metricbeat/module/aws/s3_request/data.go b/x-pack/metricbeat/module/aws/s3_request/data.go deleted file mode 100644 index 5c4c2bfa1a4..00000000000 --- a/x-pack/metricbeat/module/aws/s3_request/data.go +++ /dev/null @@ -1,41 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package s3_request - -import ( - s "github.com/elastic/beats/v7/libbeat/common/schema" - c "github.com/elastic/beats/v7/libbeat/common/schema/mapstrstr" -) - -var ( - schemaMetricSetFields = s.Schema{ - "requests": s.Object{ - "total": c.Int("AllRequests"), - "get": c.Int("GetRequests"), - "put": c.Int("PutRequests"), - "delete": c.Int("DeleteRequests"), - "head": c.Int("HeadRequests"), - "post": c.Int("PostRequests"), - "select": c.Int("SelectRequests"), - "select_scanned.bytes": c.Float("SelectScannedBytes"), - "select_returned.bytes": c.Float("SelectReturnedBytes"), - "list": c.Int("ListRequests"), - }, - "downloaded": s.Object{ - "bytes": c.Float("BytesDownloaded"), - }, - "uploaded": s.Object{ - "bytes": c.Float("BytesUploaded"), - }, - "errors": s.Object{ - "4xx": c.Int("4xxErrors"), - "5xx": c.Int("5xxErrors"), - }, - "latency": s.Object{ - "first_byte.ms": c.Float("FirstByteLatency"), - "total_request.ms": c.Float("TotalRequestLatency"), - }, - } -) diff --git a/x-pack/metricbeat/module/aws/s3_request/manifest.yml b/x-pack/metricbeat/module/aws/s3_request/manifest.yml new file mode 100644 index 00000000000..6a401fed08f --- /dev/null +++ b/x-pack/metricbeat/module/aws/s3_request/manifest.yml @@ -0,0 +1,64 @@ +default: true +input: + module: aws + metricset: cloudwatch + defaults: + metrics: + - namespace: AWS/S3 + statistic: ["Average"] + name: + - AllRequests + - GetRequests + - PutRequests + - DeleteRequests + - HeadRequests + - PostRequests + - SelectRequests + - SelectScannedBytes + - SelectReturnedBytes + - ListRequests + - BytesDownloaded + - BytesUploaded + - 4xxErrors + - 5xxErrors + - FirstByteLatency + - TotalRequestLatency + +processors: + - rename: + ignore_missing: true + fields: + - from: "aws.s3.metrics.AllRequests.avg" + to: "aws.s3_request.requests.total" + - from: "aws.s3.metrics.GetRequests.avg" + to: "aws.s3_request.requests.get" + - from: "aws.s3.metrics.PutRequests.avg" + to: "aws.s3_request.requests.put" + - from: "aws.s3.metrics.DeleteRequests.avg" + to: "aws.s3_request.requests.delete" + - from: "aws.s3.metrics.HeadRequests.avg" + to: "aws.s3_request.requests.head" + - from: "aws.s3.metrics.PostRequests.avg" + to: "aws.s3_request.requests.post" + - from: "aws.s3.metrics.SelectRequests.avg" + to: "aws.s3_request.requests.select" + - from: "aws.s3.metrics.SelectScannedBytes.avg" + to: "aws.s3_request.requests.select_scanned.bytes" + - from: "aws.s3.metrics.SelectReturnedBytes.avg" + to: "aws.s3_request.requests.select_returned.bytes" + - from: "aws.s3.metrics.ListRequests.avg" + to: "aws.s3_request.requests.list" + - from: "aws.s3.metrics.BytesDownloaded.avg" + to: "aws.s3_request.downloaded.bytes" + - from: "aws.s3.metrics.BytesUploaded.avg" + to: "aws.s3_request.uploaded.bytes" + - from: "aws.s3.metrics.4xxErrors.avg" + to: "aws.s3_request.errors.4xx" + - from: "aws.s3.metrics.5xxErrors.avg" + to: "aws.s3_request.errors.5xx" + - from: "aws.s3.metrics.FirstByteLatency.avg" + to: "aws.s3_request.latency.first_byte.ms" + - from: "aws.s3.metrics.TotalRequestLatency.avg" + to: "aws.s3_request.latency.total_request.ms" + - from: "aws.dimensions.BucketName" + to: "aws.s3.bucket.name" diff --git a/x-pack/metricbeat/module/aws/s3_request/s3_request.go b/x-pack/metricbeat/module/aws/s3_request/s3_request.go deleted file mode 100644 index 00b82827bbf..00000000000 --- a/x-pack/metricbeat/module/aws/s3_request/s3_request.go +++ /dev/null @@ -1,221 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package s3_request - -import ( - "fmt" - "strconv" - "strings" - "time" - - "github.com/aws/aws-sdk-go-v2/service/cloudwatch" - "github.com/pkg/errors" - - "github.com/elastic/beats/v7/metricbeat/mb" - awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" - "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" -) - -var metricsetName = "s3_request" - -// init registers the MetricSet with the central registry as soon as the program -// starts. The New function will be called later to instantiate an instance of -// the MetricSet for each host defined in the module's configuration. After the -// MetricSet has been created then Fetch will begin to be called periodically. -func init() { - mb.Registry.MustAddMetricSet(aws.ModuleName, metricsetName, New) -} - -// MetricSet holds any configuration or state information. It must implement -// the mb.MetricSet interface. And this is best achieved by embedding -// mb.BaseMetricSet because it implements all of the required mb.MetricSet -// interface methods except for Fetch. -type MetricSet struct { - *aws.MetricSet -} - -// New creates a new instance of the MetricSet. New is responsible for unpacking -// any MetricSet specific configuration options if there are any. -func New(base mb.BaseMetricSet) (mb.MetricSet, error) { - moduleConfig := aws.Config{} - if err := base.Module().UnpackConfig(&moduleConfig); err != nil { - return nil, err - } - - metricSet, err := aws.NewMetricSet(base) - if err != nil { - return nil, errors.Wrap(err, "error creating aws metricset") - } - - // Check if period is set to be multiple of 60s - remainder := int(metricSet.Period.Seconds()) % 60 - if remainder != 0 { - err := errors.New("period needs to be set to 60s (or a multiple of 60s). " + - "To avoid data missing or extra costs, please make sure period is set correctly " + - "in config.yml") - base.Logger().Info(err) - } - - return &MetricSet{ - MetricSet: metricSet, - }, nil -} - -// Fetch methods implements the data gathering and data conversion to the right -// format. It publishes the event which is then forwarded to the output. In case -// of an error set the Error field of mb.Event or simply call report.Error(). -func (m *MetricSet) Fetch(report mb.ReporterV2) error { - namespace := "AWS/S3" - // Get startTime and endTime - startTime, endTime := aws.GetStartTimeEndTime(m.Period, m.Latency) - m.Logger().Debugf("startTime = %s, endTime = %s", startTime, endTime) - - // GetMetricData for AWS S3 from Cloudwatch - for _, regionName := range m.MetricSet.RegionsList { - awsConfig := m.MetricSet.AwsConfig.Copy() - awsConfig.Region = regionName - - svcCloudwatch := cloudwatch.New(awscommon.EnrichAWSConfigWithEndpoint( - m.Endpoint, "monitoring", regionName, awsConfig)) - - listMetricsOutputs, err := aws.GetListMetricsOutput(namespace, regionName, svcCloudwatch) - if err != nil { - m.Logger().Error(err.Error()) - report.Error(err) - continue - } - - if listMetricsOutputs == nil || len(listMetricsOutputs) == 0 { - continue - } - - metricDataQueries := constructMetricQueries(listMetricsOutputs, m.Period) - // This happens when S3 cloudwatch request metrics are not enabled. - if len(metricDataQueries) == 0 { - continue - } - // Use metricDataQueries to make GetMetricData API calls - metricDataOutputs, err := aws.GetMetricDataResults(metricDataQueries, svcCloudwatch, startTime, endTime) - if err != nil { - err = errors.Wrap(err, "GetMetricDataResults failed, skipping region "+regionName) - m.Logger().Error(err.Error()) - report.Error(err) - continue - } - - // Create Cloudwatch Events for s3_request - bucketNames := getBucketNames(listMetricsOutputs) - for _, bucketName := range bucketNames { - event, err := createS3RequestEvents(metricDataOutputs, regionName, bucketName, m.AccountName, m.AccountID) - if err != nil { - m.Logger().Error(err.Error()) - event.Error = err - report.Event(event) - continue - } - - if reported := report.Event(event); !reported { - m.Logger().Debug("Fetch interrupted, failed to emit event") - return nil - } - } - } - - return nil -} - -func getBucketNames(listMetricsOutputs []cloudwatch.Metric) (bucketNames []string) { - for _, output := range listMetricsOutputs { - for _, dim := range output.Dimensions { - if *dim.Name == "BucketName" { - if exists, _ := aws.StringInSlice(*dim.Value, bucketNames); exists { - continue - } - bucketNames = append(bucketNames, *dim.Value) - } - } - } - return -} - -func createMetricDataQuery(metric cloudwatch.Metric, period time.Duration, index int) (metricDataQuery cloudwatch.MetricDataQuery) { - statistic := "Sum" - periodInSec := int64(period.Seconds()) - id := "s3r" + strconv.Itoa(index) - metricDims := metric.Dimensions - bucketName := "" - filterID := "" - for _, dim := range metricDims { - if *dim.Name == "BucketName" { - bucketName = *dim.Value - } else if *dim.Name == "FilterId" { - filterID = *dim.Value - } - } - metricName := *metric.MetricName - label := bucketName + " " + filterID + " " + metricName - metricDataQuery = cloudwatch.MetricDataQuery{ - Id: &id, - MetricStat: &cloudwatch.MetricStat{ - Period: &periodInSec, - Stat: &statistic, - Metric: &metric, - }, - Label: &label, - } - return -} - -func constructMetricQueries(listMetricsOutputs []cloudwatch.Metric, period time.Duration) []cloudwatch.MetricDataQuery { - var metricDataQueries []cloudwatch.MetricDataQuery - metricDataQueryEmpty := cloudwatch.MetricDataQuery{} - dailyMetricNames := []string{"NumberOfObjects", "BucketSizeBytes"} - for i, listMetric := range listMetricsOutputs { - if exists, _ := aws.StringInSlice(*listMetric.MetricName, dailyMetricNames); exists { - continue - } - - metricDataQuery := createMetricDataQuery(listMetric, period, i) - if metricDataQuery == metricDataQueryEmpty { - continue - } - metricDataQueries = append(metricDataQueries, metricDataQuery) - } - return metricDataQueries -} - -// CreateS3Events creates s3_request and s3_daily_storage events from Cloudwatch metric data. -func createS3RequestEvents(outputs []cloudwatch.MetricDataResult, regionName string, bucketName string, accountName string, accountID string) (event mb.Event, err error) { - // AWS s3_request metrics - mapOfMetricSetFieldResults := make(map[string]interface{}) - - // Find a timestamp for all metrics in output - timestamp := aws.FindTimestamp(outputs) - if !timestamp.IsZero() { - for _, output := range outputs { - if len(output.Values) == 0 { - continue - } - exists, timestampIdx := aws.CheckTimestampInArray(timestamp, output.Timestamps) - if exists { - labels := strings.Split(*output.Label, " ") - if labels[0] == bucketName && len(output.Values) > timestampIdx { - mapOfMetricSetFieldResults[labels[2]] = fmt.Sprint(output.Values[timestampIdx]) - } - } - } - } - - resultMetricSetFields, err := aws.EventMapping(mapOfMetricSetFieldResults, schemaMetricSetFields) - if err != nil { - err = errors.Wrap(err, "Error trying to apply schema schemaMetricSetFields in AWS s3_request metricbeat module.") - return - } - - event = aws.InitEvent(regionName, accountName, accountID, timestamp) - event.MetricSetFields = resultMetricSetFields - event.RootFields.Put("aws.s3.bucket.name", bucketName) - return -} diff --git a/x-pack/metricbeat/module/aws/s3_request/s3_request_integration_test.go b/x-pack/metricbeat/module/aws/s3_request/s3_request_integration_test.go index eeae8439f1f..8103acd13a4 100644 --- a/x-pack/metricbeat/module/aws/s3_request/s3_request_integration_test.go +++ b/x-pack/metricbeat/module/aws/s3_request/s3_request_integration_test.go @@ -17,7 +17,7 @@ import ( ) func TestFetch(t *testing.T) { - config := mtest.GetConfigForTest(t, "s3_request", "86400s") + config := mtest.GetConfigForTest(t, "s3_request", "60s") metricSet := mbtest.NewReportingMetricSetV2Error(t, config) events, errs := mbtest.ReportingFetchV2Error(metricSet) @@ -28,36 +28,31 @@ func TestFetch(t *testing.T) { assert.NotEmpty(t, events) for _, event := range events { - // RootField - mtest.CheckEventField("service.name", "string", event, t) mtest.CheckEventField("cloud.region", "string", event, t) - - // MetricSetField - mtest.CheckEventField("bucket.name", "string", event, t) - mtest.CheckEventField("requests.total", "int", event, t) - mtest.CheckEventField("requests.get", "int", event, t) - mtest.CheckEventField("requests.put", "int", event, t) - mtest.CheckEventField("requests.delete", "int", event, t) - mtest.CheckEventField("requests.head", "int", event, t) - mtest.CheckEventField("requests.post", "int", event, t) - mtest.CheckEventField("select.requests", "int", event, t) - mtest.CheckEventField("select_scanned.bytes", "float", event, t) - mtest.CheckEventField("select_returned.bytes", "float", event, t) - mtest.CheckEventField("requests.list", "int", event, t) - mtest.CheckEventField("downloaded.bytes", "float", event, t) - mtest.CheckEventField("uploaded.bytes", "float", event, t) - mtest.CheckEventField("errors.4xx", "int", event, t) - mtest.CheckEventField("errors.5xx", "int", event, t) - mtest.CheckEventField("latency.first_byte.ms", "float", event, t) - mtest.CheckEventField("latency.total_request.ms", "float", event, t) + mtest.CheckEventField("aws.dimensions.BucketName", "string", event, t) + mtest.CheckEventField("aws.dimensions.StorageType", "string", event, t) + mtest.CheckEventField("s3.metrics.AllRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.GetRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.PutRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.DeleteRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.HeadRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.PostRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.SelectRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.SelectScannedBytes.avg", "float", event, t) + mtest.CheckEventField("s3.metrics.SelectReturnedBytes.avg", "float", event, t) + mtest.CheckEventField("s3.metrics.ListRequests.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.BytesDownloaded.avg", "float", event, t) + mtest.CheckEventField("s3.metrics.BytesUploaded.avg", "float", event, t) + mtest.CheckEventField("s3.metrics.4xxErrors.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.5xxErrors.avg", "int", event, t) + mtest.CheckEventField("s3.metrics.FirstByteLatency.avg", "float", event, t) + mtest.CheckEventField("s3.metrics.TotalRequestLatency.avg", "float", event, t) } } func TestData(t *testing.T) { - config := mtest.GetConfigForTest(t, "s3_request", "86400s") + config := mtest.GetConfigForTest(t, "s3_request", "60s") - metricSet := mbtest.NewReportingMetricSetV2Error(t, config) - if err := mbtest.WriteEventsReporterV2Error(metricSet, t, "/"); err != nil { - t.Fatal("write", err) - } + metricSet := mbtest.NewFetcher(t, config) + metricSet.WriteEvents(t, "/") } diff --git a/x-pack/metricbeat/module/aws/s3_request/s3_request_test.go b/x-pack/metricbeat/module/aws/s3_request/s3_request_test.go new file mode 100644 index 00000000000..41098399024 --- /dev/null +++ b/x-pack/metricbeat/module/aws/s3_request/s3_request_test.go @@ -0,0 +1,21 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package s3_request + +import ( + "os" + + "github.com/elastic/beats/v7/metricbeat/mb" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws" + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/aws/cloudwatch" +) + +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +} From ace440f4736e6d969595ad1010b197d051e8fe77 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Wed, 14 Oct 2020 16:33:58 -0700 Subject: [PATCH 212/216] Update endpoint-related terminology in Elastic Agent docs (#21458) --- x-pack/elastic-agent/docs/install-elastic-agent.asciidoc | 2 +- x-pack/elastic-agent/docs/tab-widgets/run.asciidoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/x-pack/elastic-agent/docs/install-elastic-agent.asciidoc b/x-pack/elastic-agent/docs/install-elastic-agent.asciidoc index d8dfd49d5c4..69a04b01f9e 100644 --- a/x-pack/elastic-agent/docs/install-elastic-agent.asciidoc +++ b/x-pack/elastic-agent/docs/install-elastic-agent.asciidoc @@ -94,7 +94,7 @@ rm /Library/Launchdaemons/co.elastic.agent.plist . <>. + Unenrolling the agent should stop {agent} and any other programs started by -the agent, such as Elastic {endpoint-sec} and data shippers. +the agent, such as {elastic-sec} and data shippers. . If necessary, manually kill the `elastic-agent` process and any other processes started by the agent. diff --git a/x-pack/elastic-agent/docs/tab-widgets/run.asciidoc b/x-pack/elastic-agent/docs/tab-widgets/run.asciidoc index 569ea013236..727b2371cf4 100644 --- a/x-pack/elastic-agent/docs/tab-widgets/run.asciidoc +++ b/x-pack/elastic-agent/docs/tab-widgets/run.asciidoc @@ -92,7 +92,7 @@ cd 'C:\Program Files\Elastic-Agent' .\install-service-elastic-agent.ps1 <1> <2> ---- <1> You must run {agent} under the SYSTEM account if you plan -to use the {elastic-endpoint} integration. +to use the {elastic-endpoint-integration} integration. <2> If script execution is disabled on your system, set the execution policy for the current session to allow the script to run. For example: `PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-elastic-agent.ps1`. From 471df0bf0f0d241743953dc8efe1ea74ece04a09 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Thu, 15 Oct 2020 09:53:23 +0200 Subject: [PATCH 213/216] [Filebeat][httpjson] Fix date_cursor validation (#21756) * Fix date_cursor validation * Only check for parse errors --- x-pack/filebeat/input/httpjson/config.go | 9 +++++++-- x-pack/filebeat/input/httpjson/config_test.go | 2 -- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/x-pack/filebeat/input/httpjson/config.go b/x-pack/filebeat/input/httpjson/config.go index ee1445b8a3d..6384811aaa4 100644 --- a/x-pack/filebeat/input/httpjson/config.go +++ b/x-pack/filebeat/input/httpjson/config.go @@ -125,10 +125,15 @@ func (dc *dateCursorConfig) Validate() error { if dc.DateFormat == "" { return nil } - now := time.Now().Format(dc.DateFormat) - if _, err := time.Parse(dc.DateFormat, now); err != nil { + + const knownTimestamp = 1602601228 // 2020-10-13T15:00:28+00:00 RFC3339 + knownDate := time.Unix(knownTimestamp, 0).UTC() + + dateStr := knownDate.Format(dc.DateFormat) + if _, err := time.Parse(dc.DateFormat, dateStr); err != nil { return errors.New("invalid configuration: date_format is not a valid date layout") } + return nil } diff --git a/x-pack/filebeat/input/httpjson/config_test.go b/x-pack/filebeat/input/httpjson/config_test.go index 1986ee7abe9..85c7c64848d 100644 --- a/x-pack/filebeat/input/httpjson/config_test.go +++ b/x-pack/filebeat/input/httpjson/config_test.go @@ -362,7 +362,6 @@ func TestConfigOauth2Validation(t *testing.T) { "url": "localhost", }, }, - /* Flaky test: https://github.com/elastic/beats/issues/21748 { name: "date_cursor.date_format will fail if invalid", expectedErr: "invalid configuration: date_format is not a valid date layout accessing 'date_cursor'", @@ -371,7 +370,6 @@ func TestConfigOauth2Validation(t *testing.T) { "url": "localhost", }, }, - */ { name: "date_cursor must work with a valid date_format", input: map[string]interface{}{ From fc10f069a30f5b54fd0b9aaaed6c56f93ee56e0e Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Thu, 15 Oct 2020 10:54:12 +0300 Subject: [PATCH 214/216] Add proxy metricset (#21751) --- CHANGELOG.next.asciidoc | 1 + .../docs/images/metricbeat-istio-overview.png | Bin 187983 -> 198266 bytes .../docs/images/metricbeat-istio-traffic.png | Bin 0 -> 267742 bytes metricbeat/docs/modules/istio.asciidoc | 36 +- metricbeat/docs/modules/istio/istiod.asciidoc | 18 + metricbeat/docs/modules/istio/proxy.asciidoc | 18 + metricbeat/docs/modules_list.asciidoc | 4 +- x-pack/metricbeat/metricbeat.reference.yml | 7 + .../module/istio/_meta/config.reference.yml | 7 + .../metricbeat/module/istio/_meta/config.yml | 7 + .../module/istio/_meta/docs.asciidoc | 21 +- .../dashboard/Metricbeat-istio-overview.json | 3486 +++++++++-------- .../7/dashboard/Metricbeat-istio-traffic.json | 1274 ++++++ x-pack/metricbeat/module/istio/fields.go | 2 +- .../_meta/{docs.ascoodoc => docs.asciidoc} | 0 .../module/istio/istiod/_meta/fields.yml | 5 +- x-pack/metricbeat/module/istio/module.yml | 1 + .../module/istio/proxy/_meta/docs.asciidoc | 33 + .../module/istio/proxy/_meta/fields.yml | 4 + .../istio/proxy/_meta/testdata/config.yml | 5 + .../proxy/_meta/testdata/proxy.v1.7.1.plain | 1146 ++++++ .../testdata/proxy.v1.7.1.plain-expected.json | 1365 +++++++ .../module/istio/proxy/manifest.yml | 11 + .../module/istio/proxy/proxy_test.go | 32 + .../metricbeat/modules.d/istio.yml.disabled | 7 + 25 files changed, 5767 insertions(+), 1723 deletions(-) create mode 100644 metricbeat/docs/images/metricbeat-istio-traffic.png create mode 100644 metricbeat/docs/modules/istio/istiod.asciidoc create mode 100644 metricbeat/docs/modules/istio/proxy.asciidoc create mode 100644 x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-traffic.json rename x-pack/metricbeat/module/istio/istiod/_meta/{docs.ascoodoc => docs.asciidoc} (100%) create mode 100644 x-pack/metricbeat/module/istio/proxy/_meta/docs.asciidoc create mode 100644 x-pack/metricbeat/module/istio/proxy/_meta/fields.yml create mode 100644 x-pack/metricbeat/module/istio/proxy/_meta/testdata/config.yml create mode 100644 x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain create mode 100644 x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain-expected.json create mode 100644 x-pack/metricbeat/module/istio/proxy/manifest.yml create mode 100644 x-pack/metricbeat/module/istio/proxy/proxy_test.go diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 28e66a63034..37a3366318f 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -464,6 +464,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add istiod metricset. {pull}21519[21519] - Release `add_cloudfoundry_metadata` as GA. {pull}21525[21525] - Add support for OpenStack SSL metadata APIs in `add_cloud_metadata`. {pull}21590[21590] +- Add proxy metricset for istio module. {pull}21751[21751] *Auditbeat* diff --git a/metricbeat/docs/images/metricbeat-istio-overview.png b/metricbeat/docs/images/metricbeat-istio-overview.png index 139fe9260d49bd0d0034ad292987f67be37468ce..87151a70e73bf31750e55719311edee41c81afc0 100644 GIT binary patch literal 198266 zcma&O1y~$Qw*?9WhXe}{+}%lV4FnJF9$W@@w;;hCfGXMjljMV$|300JqvR6mv)2H4c8Y*}jN4YOwLgYSqcC>Z1 zz4%Ux=o8r21r-Jk&dX1R$cT;Z*4W(!`;B4GXKaEghp?ueS@H50b2nCY(?nwjvo%AUS*?`Vvu#MSrL+E5~W?{?e#6$e+3Qpkl^T!OtgugDa1Mv{6NXifjTG|*8ve3VyXC&r@CnO}~ zw$V4_l=~q3=XT&753#YGofRhogQKG(z2jSYOB*8wCJqh`21aHEW@b9z3OZY73p*Vr zItyEp-(T|A_k1w0)w40NvNN%?AbkE_9bHR%J04=<=Lh}$?{_;5oJ{`bNfx$$x&?HQ z;rR>$6Fnot-`@?~%KiK)r;Le{ftkt&6LSL#Ti_YIOza%2+`n%4|D5`tNB-kh)&IGb zjg{k{cmCtdpF6o3o_p|*9{o1guTKGc@xpU6{B3()_-+rZ7%(t?FtHEs6`a8LQ=r^l z_h9xAsA>2JmaPsGV9!$>zJ{;LhJvTlnx~TMOwsLHkf5S}A1t4|df1*q_;e#Vy%CiR zMeNvTd97jLXy~vx9KdP~V;J<4SKXCc!+ke@5eu#_@UhuOr5JMLKw)tN0Y97%4_F}>q zSef@Y;^{Ll;Ud8P)$yU)Z+QqOW}C03fHCbaoART4c}*o3!C{s9l9^fSci)iT!&#+< zrn9AXk^_eHw))^@tIFPxfD8ZUF_4j7#Y^DcudCvaLLTg@j$*2g!hEK=3Zs9wgP)yv zSsD*vqiAV8U-*p}73csd=B&t_mzM0$uz1Q-ZK-+?{_g2~1lSfcTa(G_gg;I43G}LL zeQ{4^92(Hg;HKTTk>t4E_Ykk?=SE^79&&}r*!$0@RMA*e}+w58Kf>Y;LPgg z0nJYRYvjEnNZOoP*QYBCe!m?hYOANUW3R;gGcT-!ATB*%zQU`mWt`yHTRj$pulL7{ zq4x+R{4syq25i%@JJnX{wdglUYf`DAH%hTp$wr!oHL`@izk`ja&3RJN;&m74uSS)L zdD$jNzN7s!^}Ma5+a`~^dXI!(6%s_+?tg;{+#1~ zgEnfL?`JdlI^e7*&9~K+Bi};Odcrixk5Y4d zTIu}Tvd52*`$O56{fn(4T4I0tg%aS^TtBX*`km-|pae}*^#Wpi56JTzT{4oxy z)yFoQlB?Wwdp9c3-;2tZ#oP7juy3|{@B7pgTageP=EGf!8`a)qaXgpfp>Obs74q)} z5eR#o?FXE!P5geVBMmH@>7^Iqe>sdWSYX1Lb4k2V6KPVB`qQ#YxV-xDSv%|)XNRp} zO}Qc`lQYG7ar>RQBZ_+a0g)>n({UA(@w$Auv6A>=_1YbmPXF*KhInco&&Q_yg+}Sa zrPiael4f{wPvg?N53a*m6w;|*_1f#iV;>bb9rlS~Ug6qp+9cTvhhb;VEmRtn4slYx zVYDi1eWaUtydSWv=yQ#B`?;-d?Vqs_hWq*z9;?RgWHCcN_fN5mj;?d2)33i*gb%;h znHiyq4$lZQD&-ffWP;DIArrt{oKN#g8a7y?_&By#u;E!+=86>JoFArk=WF1S&$_C6 z5O7gtz`S0lRGec_bAP%Ars;Wg$n$ub!eQ+Y8X`HV5>3G8F`r=gSs~!eB*Lnk`Ps$z z;(-S*f#>+J?q}(Y{26S1h&aepUUzDvk<{2EHcRnuAMn*8IjmO+|ijj3FKE^xd$)LbCPn7))to-St*DSNlx#-wGv)*TB0)s*Gl zSaZ68NpuFbGL}7{hSg}bqHD7B2vcu!(?qMmC{1uQUoH_p6P;%8yXox`US~zN+$kwW zDIhv4y5Vr|1jc~pMV(BBjA5I=#K7%x-COdt`}SzQ{>)*|Pnc-ZGgmt8WGa?uDG&@K zOHfUOeL=wEvR~TrmSVUhvQ(q~+tm6(!<9{rYVNKTuRS~(&GVY`l0f~k8zm=8`Nzi* zg6GR*B!}R$2+-&tU{aM}1_vM!M7}ls;dFQp#Q`#CM__9{+hlmH5}P9(FIAvWOnY^!9w`;&5dkzEpII9wgV>(%d<%19KzpU7+p40s3TT9Y}g z0Z8ScCwz9oBv$jt9LXeORmX!_x}P~CF+ryHET#(a!I%tv1rvn^Tf+-cWD0gmc3i{d!l_&WP{AORTc|!tyam*ifT=L6?~X`j`ti+#}S5bT`V!f z(^z3GBgs4zBH{SaYSpHqi`>o%j~|?iF!r=r?&SsoK^bq-kQPlb-#JY^+`sLMW1$He z9M2G>Fkn)b!EpGRd)9U{mMtOPuBFn-X}5i^bjDw8sz_T1S7aVfdn3=Rf31?}F{ctmAzd=?ba&)?pFf%Rg!d$U`p8f^ep6KA z6g$=L%aSJGBQqS);w!Lv=V)+U*3PWo%UJ)7^_~?p`N44bE8Pj&cV!%N z9MPPQSoV#%QYlKHJ}j5YGi7a$73sM2*Tu`t;RV_DWDVkxuoE*FQHrF#%@g!St(x-^@$~Wt+brHOS%wBQFvd6! z&Q7E;*C%UxYcFwF6U|H1s?`Q;Ryu^-FW{^Bd0p1MDhxd`X85fiPI?GHi=3CU3347*o<_| zW|!hrd4EKF!o3O3ms($G?=&m)^W}UGBO4u$`i$&(r}hl(8g#p;E05Cg-+(N7b+cOI zp6KMsrDKB7X++O3ip@(Rbxbr09q{M^;-@HF+~jkm;$J)+{s3uK1(bKHVfIbBsWm!C z?#$;GD%oreC5eO{l?;C6kjRlr$l9Dey;U2|#eVVh9F@K1P}76;YMbp}C;!4mgiUB| z9k#PoSYu7jG&8vli^Lo9jlt&Gl1Xf!4ca2*Fnpf8VoO;^pV^sv`_9tyFvDad?CT`A z8-o|PiExcpz~Uv8v8qv=EEavZeayq`kQvrpxj%YbI33|r9|T!h9h>9MjPMp_>!;AJ zc@WSE#Tw*Q`wDHJW4*m7SwSHY*`pSMS1$!=AnmEp?w=gjs!t7{ZjA{wAW2;HD^e>* zAz%*o)|!g2jwQ0}g$yj+@wngG**wluMa%c0lC6K+eSx4CqSx9$0DT1ga(5>H4vqZ2 zWZ>}@R6lb>yfNuCJ=(s>@hUw+vu?Dt+AO6Zt&iS-Xz(}QL3RN!Qc%+ox2vF^&e!6Y zN++)t=bz9Ul6u)K)_{p^3nYibGp;y{q=8_xlEiO3Y%nPb_-qBK6mG*3o+qspK3=*> z%bsw&v9m5FbjOSB@-=4LNwa2)-NoYIigX@YZTAa5tuwkx6%p0F0p?QAR$iOUbI&La zTk>L9o^)E5TFa%9@RfX6gJa=~jQm77R&91qwbIZZlN~}5xFwNk+|C88v`>@+@lRAg zC$OgQiQ*Y#>vc&9gt~+nW zKeYeywpJ1V`D)lO&m8?7RZ+abXy3Y?@6%1^BLqi7A#9pDcGh%ztoO=lDm2(p1?D*5 z)RV7@K3NZi^Ib+U8;C;{tsdb%v>Ol?1<)uJP^ZNe zQsS_>NI-1#_lssr#E-AhY2-x=+mPdzS{D~zN%QtG{KynxqqAl*+}|9IqbqD#pQ$ub z!wN%FK{ObO8<@v?JW|hQ>Hox&#A$Dey9+5Xqma52quw(t9On_RLF>Tx_79%M2jKO$ zt&6J!qwsuWFwwHdzR0(wHZw< zvA57corN%V0b(08RXIbaT+VKOP4xQJ7*#dgjrPVXEV#YN-bfOO9l7jtj_y@6YQ+NI z?;%+7@aX4zm>C}FMZ(nbIaTz4KPajk+HtX5Y=Tp0{fJdv6NVw#AN!;bk0%4-5drD@ z-g)a*zyDlH>KexF1B%dUaw=J(dzwy?MiEb6Kr*+#$Qf#hmu`X|n0G!SQyNq;L`#;I ze9irfFx8UsWA<1$&r!bnMKSq55X$6yq^g#$4gVgDDIG;Bwr|y&FPA-TPp{FGx5PlR zK`7T9f_2`Q$>+)7Sv!Yikp_%+DZIr?Com7~v5ITL+J)@p zTl(GSsuiLKYW}N}qLE7t&aAU!^F;UA?mI@&jps=IgEIBb`# z*lbiRsf4=3)4z}0Gf6&8`R$}$!^Ti`I$yeP&8$-wfuk1rAWEaas(PtZIklOC4i85& zQd;Pj35LVL1CM{XwPX^&1lz*~;MqaAT_cx0vucQ`0qN`)$Hy|_lC3QGv=%?}UKYuy z={5<anLx>`f_{ehx2ZZOZ3nxxT&akEW2W>N0KfAff8AXp5nBW=^qxymx*GbK0In z-J~v(BqCUE)3`j}k)PQ}(R}yJ7l8{@hyJE0AM;sRGh?QJ*W_^_o;I5#ozdi6Wq<_YhG=fn_pf6%YFE>D|N)$!Y@tYc0i_D2^Gn@I?mKAtNjBuBo5cb`j zQ($&X?lT@uTSIc7kxt?jRPSNU)0S30d?jBl=X$Z5v4GH7P}4FC9^yxXQ6aqhpr>vA zezxv}Es6z%krLWvVVCV&9aj_z)0mHP=J2JWWuaUzUds-9O819Wma&-m`}u4M5wTR_ zgfODKR! zBbK?I?{RzMJ(@hQC^9yi=3X*cg{41t>3P0UZ?h2t(9E0Sqy~rhgQxunp!3{tv5Ik} z)5(Zet*)2*v9r{vH-f>{xtWj6F_@%Ts+F60)7v9418aCn4Bo3}m9y1$*D3vq1rp`o zgdpjo%7-NjCkGRl4c?XFu$YF-*Les!ThHd51r=6cs%M<(O2#WyA?=DmH*SaP96%}}H?$0=d&vg616QKDjeWGFFrd09QY}T|?HanS}CkJh<^SR7c%cW973&{lL?z>;5pHc8I z3T$xw;8(U#M^RJBFj31XPZdD{jz-f7)8f%&UiY9&M8#)RG*Q`zzrEfkPbN!@gr|-k zq)KY$G?Yr0#2*;Q$jUB!I(0NxU1p%gs%Uwf4nE6?p%qW9T#{E>d71kp?Vf#ewPaGC z&h2kgBj9&>I#rSVc>8`k4V^}LCxUCDP%)OZSbewp@EyAP?t06dinv$K2NHef1s<#puSkI3Qj1$8WJtb-FV$y0*a>Z^i z&dW0W4yx1SfQHAirRp^GA2eapkm`!^97BR~_0A-s=y<5e32!tr?~LGqwI z=|QxUwVqms1a>t7wPsO+7P-UE+D%RwQ%yCyDw~4-b>h~h^>KTEbmMJQ5Qx?zCX`+0 z*Jx0b@q*kHq+f)R5m6mi=Fv?f9P-Any!qxe$h_A`b*V1mEdRaF(KD=BzJ-K%eC1^1 zvUXb`0t=@j^wwtlh%-#n_YEV=Zz&6z7&2Y7TH}+N11gPD5h0C{bu--tZGZZ^2jmUf z*|OYZAr6eglDuR;GZm+~RUWfxWbZCojA5B!3@SMl-coht#&h!dtAx&aWzG&seBwIIt;RxFupB;o1A4G|f z&#DLFXT?<-<G{I}VP14sLh?68wkGjD!{2ms&ne?buiNTzzvvl!LLTyp39!a#N} zAHB*C9y7)d&zJ*8_jrc!*VSGFsLS`;6}A38&jZTuOCgi53x#*aVidMdKjL$iKd?j$ zFZ#U9Sm9*egV0_g{E>HoIZAj9YqvkjdyTCp@f%T+B1^$qc_31-MRh)75#`=ts4BLHU7dqe@iw0e6a^9Fz<8O*4|m+e8xIcZW}*e zXD#2QNkax|OJh zpCFS=9A~y1e&;G#5%SBo{g$Ku`~Sq;-pGohB}>b6cw869FgHi7%5YkX{Sdaj%i4D7 z_MYe+*QDx`v}!&8$o4HKt!W(jx}q0|IVF8_ySzf8TCQ8YJ`k^5p+9V_e&GY~bsOii&CrlEM%4;~0piw&S!vYo;S5ZA-4Rh_L4mnO1xPz#Q-6eH zU=I8r2fr`jv5p!y*O$xv86#>Vi8xvSzB|dKe&c5%3!WvkJH{)jW+I%|<%W-7kk|RxIAYtMzJbRVEsG zw0(|e&{o5XEmr5)+ORBwozqRI4xBqZ6_1=(&63b{Pl|eG8I_hbIf!dzW zl2XqzjkHv&dF)wU&Yip7+4A0G`I&RqC);eu(|!TOT!PUHMkz`zLFSwJmg2ix+nJ@Y z0(+RgBgJ`zuiC91g140ZLP4<;Yu+I;r`T{?ZwOFT6!Mis;@9558Pri2hm-~1(^|5?6&$?X5@ElMQ+7b@ec!#m}(`vZ8r4p4MHxr=Lz&loaS+Z$t=?Nd>+JUd6y`67?Wu-(1KKES*@|Us5emX>r<-T z7mi0wg>PL3ov^s|efMV?wFlf!$4#=QQ-~K_&wq%|CUaEmuqqX6fvAaAh~FF#`|s_% zHL{;`ow(?|V|VBLNj(ukQn$3!D1LC((a0J zjE|c@#$DgqY_?mc8HT{ePV0f0>`e#NNoVqgwJ9i83FE z0lkGBS-B3^e++%6H&PFkLJBuuB_o-4smi3#BVb}Du^Q*xdZGaR;%+n})2?x2AU4um zeX=hnw6I!;9v(&tv|!8fC>z@Z+c}2%RZN;2!TpH=aI~WQhet3x(kJjm{A?RYbn#NkFvFU>9+F!5f`Hjlno( zu@Q$2cSY>#(5lkJ5`$VR9vdXyw@Woqpft9@5hH+oQ}*T6*H85b1`ZqI8wR6oY4&%S z!ibaRKoFq&WS{yc8TxOa`qe zJT8a6pjeO{ULEh_D5M{Y9KYXHDc@BjM`ezi@mW*qzX~7oiC*>xJ20={;K!%S^-Qih zluNXt*ZZQOOi!9@9)e>?Tv;Eq@?^lz5(NXodil5<_U-`}YznnElvHcy+WU@H&EBup z^Ha0SUR-!WER`N~;A^TV=djQ4=)CCP{WV+L)oDIX6`xIROcY$J`rj7bU#z>C zYl!Gc*X(>IoFkP)_ zacd|MCT`9!^Vgaly$%+emFWweDnw^0j3$l%=_tBDT$aTrz`!lK{FNE5K1f~D17K}B|e_Jm@4lP z5Hv|CzlwxmQ>fRP#{;}*x5)=cX4&mT0qSp|{%r^cC(?=f3+gcY_mmGaCA8s06m_ik z6)joPX-c}^zYt{)+^S-F=Dm5AVI+ZxBaVtGcAhbG;__cR`A>ucs|+ddy^9G}v1l7p z9>ZEK1KI6(IU~#yKE6S-@hOj}gU$*bVQ*I4vNQqktYI$^Xy!Zo;CCCWWcM$`c-?`E zbqxFxrI-!+2>~=76&RgE$<|y56{I85XJvc;bL55nL=;&t6F1b%)yWEq8_a=XoF~>ZlUc-|+NWqmxvCLGX|+wl^S5fRx5czWqDx|% z5I3SUVxTgpM|pcK*a!oYRXq22GBxfSD4!)UrS&*3b641g_OCkq1q|r455_#Q{3Vb* zW(ESmMwFAkhwAAEx5*zQ0V;-KsoeEdjhc06!Ub~m-`XlBMd{SvMRzaNL}Yu?Pbt-u zee;W@A44)%-({~9)>J>TNKRqhRDM4_oh zS%+VjMI(XQu0%Snzx{qitJ3z_YFE(q6@=E!1B(e|!h?bTs#uAJM@fK4*sZ4NQ~~`J z0k;e{Ib;%~mF0u;!Ys4np@0}NUyG7Lr>@Is4Axk>2VQQ>b~`yD&hHe&KL_?dy~ZS2 zo?btH0cml2z&5tkb0}A2tW$~pUE6%R%sT{!O+fu?BGfLJ_%QZFVWO(PP;q3WbiH^g zqeqO=ZTl)(zbd7RIwfdSc*)H~q4F-3vpRQuIQD0eyg*l2b^ND#E~{l}wH;W${jikA zuAUx|{&<>9^g%e(rplJ;sxUf*Q3lv6UR{hv-RQp zm>D|#gND$tCIhaW*#nUc|9W4g5RtIe`JVR3Y@6B=ysY=18)h{xu7>7JH_TE-OvUdm z%@LWd|0Udr;?LS*&}xG!(|r%V7S z{XnN2{4=87umV8khgZZ;FlaD%<*px@t(B}VWpLN!ze{z|RH4O$>Lj>a-Kajg>4*3#Oih`1sCdFat58<>NFpl{;MYwdY2LMBg~eiTjY-H&s6kJGj;BdfBHpk|1Y}m zJ92w9qNYO?H!gDYOa7_Y_|J{}8+|T2K<1^}H>wMJ|4}*q3wHV&T+PP<8tI|S7A4#N z$zJ{j5?*sC={}PO7FbZv)mi`Iuu^_bo$RG#&j0^3{jWY)hyaynwT%X^zy7NTF50FE zuhQp+jTa8%WIz3@4iJJnk|9rMLgoI44(LdK8uF)m^v#p0@olwD z{SO1`Rfq~($U=u+RdO4cuJON3unY~E%I&-hEhqQkKePq*BVo~G6~OtgwSL!Z{5@*_ z#|r^pU_gm{VnhEGD}6?RpMU{^HtfLt(*oElNUc^6IwXAVW42)c7+-TCIi2p$ynQCZ zt!Bw2X}?vQe@-mId(`DwhWkbJu-~Me&Vk#isoM^fnkavFEI&^VCr z)=0lUhAN8iJw(0ZQR+L3c@<{ELF0ZHp+f+Lk=d;G+5pNmm3B*047H+oQ**Py!|esY zi@3cz06kRccDgCzuQDy5TJY1^*mEic$g(lRsSI>>9&U}KNrb#%8g%)c-T~B*WE(HxIp5*bks);th5?fY*jr^PX#Tw4{jK1N>-WjzIT*X zZO=vn)NPn;WTOfx<1f$yk=n*`{PABFt2&cKmq0{2n*Av2aJHk;)xEM{o?SD)alf zkADqRBpfcEhsG;>?mQleH@G38QksnpvGke^y@2b3(t#@bkq;EJ_}l{!c`sC|o8|8g zm63u4&%A(nB?_<{s68RTuBR4dmcQ+KEbfI-wQ@0R^Vj@G_VOw%Ed_$HR3fW6HBc|b zDxnP&wf*=e^m9w5t|PYGz(=AxPxirsxlNHIY$c3IJciPcMNk%G$j)B2PoTI$Jfp_E zUZK>@4VZG2j32WoV<4%yp2Aze4<1hISV@P}%&tG-Z7y$h?GHE$(!a|p(P4|!s>Oj6 zW7d?13X;vi7QCY$Gq7mciQ8BTNd#yeS)P5>EM5lpU*-^i1oHRPK$bZ!5RIZAs0*r! zau~}Ji=vbzP6>Zgg+#zRuEZTj?BwFIYqS17G6+*c^L<}X-3OW3RnBo+))~28H7%qr z>&Js?x=JUY@B~>HQv6X_fxLPTN4U9C9o5Pbf~fol97bIj>gMg|SXTCeZX3X8n8Xpb z3MgXhu^oP--zZTc!6qG4xLD1mWsvxUf?j7-T%Juo>V5b=#00oJNHlMI=hkSszDg*0 zkeNTEKmgzXGCC8Q|9B(*uV`L!=q0Zsm%lj;C9=phI+&~0+hpT%+KGdsVF6s#TznPu%Em@J#AWF_lkNyQ0x3q_#PM3{h+%3y71a8%Swz79l_# zw|tZMuCxHm2(coSatPIXPBZop8vettOnSF-e)!$Q923o40|zB(Xz@{v-{c9GaxCZzue{x2!9wUQ9cKS^joCC4r@egQH>2gf^|^b>~_jGIxC0R zcz{0(CvOE476RIUc96;Ee0+r5oE;%}^(*=S)hTU9TW^hqcb2RHjvWX1?}C@mhc~X{ z=9WHw%L=1vZOgxMhrs0c@EStJ%JFDX6N%0Fbe-95Tjrpf9VnEWHDH1l4#PEB-JU3n zpKq|2;O6H3I3Ufyz|fb%Rm<&utFVlp@GA&(ka!2j(@XS(Ef}o$B)rF7e7HkezuPo7 zm>IjdZD_uGjQye4JwTOR^+4*$3uKXkNhK3M#1Ey^%4`m+ua`cQ>-n2(Slqo@(C;T` zrC~eGzmJ{cR4ua#{FufhLRXarWWFbUY4k4G>{iPW_tRIH&k{`xrK|!QLf2`TPUgnw z3dt_Gxv5`tGhpA%o<|mz|5NX1WE6{pVZK_moL3YQSF`I? zYSrGTqFRkHIiSGkvetM$fnzb7#hlXHy$`~mqkUF?<8+U>A3mW8wLZ2|g$tOh&yi~< zP5E7YE^U3qtps?tJI$?YAPN)1duNy~CUJmLV`ybRVzb?fW3!mhgOncfJ5tDOX&`~3 z!Z)@wQU=L3W@txwv0$*Mdr4kl$Q@*I^V{+Hu{h9njVqZNy~ zrh+%Kw=Bk0s&o34HsUu%1IDQ3V}gUg<^IJFP0V9);?UMUQq>B`BYzZ?FYk4*#@~6i z6X(k|2YHOT0?O}Ajfuq0WcBCs-5)}9U$(@1qZmpf9~O=ras(7<{qMcy%x=^Cfw>xej=N*>tKS1NF&8K4T>v^kW5l3Q zm$wj~F>GrfJDGQKHFiEHJSI;SIaNHDZt!F@2fZQ3cwcW(*-gfNDjbe)&iZ01Vt!kH zbr~Eeqe?=lYguiYS8s8|!8} zGskOlKmOJ=0Ev;6nlCSwS=x&1gu*}DVBe_r-CPEtQCY6RPRvvC{%T3gJC=Ht37tw# z)O0e>)CIq+=nG883y;0h$`Z}Sl2tq9Sm=wr-Lo7?9I@(M`wO3IlI*5Nn~TI6hw7Tl zTB{5Qh+tw$$IK6bx-&xQdcBHAXCoi?(vK2ZCgIihLu%r3B-6;KC^E*ae|-*R&+QOz`N+2S{5xAHC9W_uKc3Lwf_)WM1*?Yrn_ko&ElEz+I!^%~Bz$dJV11;)nNl4#gMqh$C1ga;`xl z9lm2VlD0F|TMO3@EPtyaWrAS+GZl@(13#5p42w6|!g^h@ixy; zOrtGkn6uYQH)vwNRi?LK;6%sMYtk#1XvB_~PDS8xITpU`ydYC7h}nFju>saf7P5q9 zHOK9C{l?_+q1NT|X{%|d=k7UH0<&}S5@zULl$luH4B9_a z=INt-%hi-u|aZi^;skQPo0)L1RVwjjYW^ ze~Bjc<-t|(3@%3H1-2UrP^BCTsFAVxKMni(V?l#9Yhc!H$DUW-7N7ijFQ$yObrfuEP1?XiY<7hy-2SVaZA}AvdgR%skw`(Z4Q;SZn_r z;7t$g0{G@}ydbE$DIA2`M=Sl6(HlUQ@;#&tZZ|>CIkO|?;TWpVssVq%I?CrZzrG&x zSLfaR2&@Ak5PB_Lp8-vMU|?fFd1KD7cpUdp!_D1&BfvrPJXtwkmt!WciN8n@DKQk1 z0az$-lTI(@e^$S%u8?s^E#pljE9+l_Z;JQJNpPC<3)^LQjWi!@qIc^t|~ z=zlLmDP*sWqHLSVI!I?q+n5lJ@!3RlEqo8-C81KPvyB0g)|YRHgE1cRlYDLLzse~A zSqv5NSlSX+Oa{djJB;lLK+)cFq_jJGU?{z$Ew_nHqpf?D8pC@_*^u}Y)SFI3GH#DB z(Y-Db_TlB3O;M@i;Vg;vyK9XBoA<@`D8#)sddm10>R?1KHRyi$OimoaZu}*S{DB^2 z5^Yu>v*M^`=FG>w=-iDoPlvu5y1nyn#WvZeK7LfIHS{uZ+~#vtKz?9%d)I0UrnX%a zDQ1FJjtM>YmAG=r(?OTMj5eK?YvaaO=iZ_b`bmyH|gfa zJNM!$jJ+!?BohSG%XO{cXw;kL#7nhXC;O)XP4=teSkB2@tozZUyC>6y%vG*7w0LDs zXmxCavv*f}%>h@I=3NP=(WqA%uG*2BM!z5qO`(xz>aGJi)1EC3#M^ z*`u2?kai89=+38U;C(DoKce$PK#y_Ys~U6u0{1jAB{^iH%+q%C*&6LJ0%IsC5wytV zc(ncXG7d;te0_gB*D-+#ka`CZN~Hg{aKiru)hp_q<>LHi*sSr7ZwVz~0E5WEC=DHa zq${?NBbCmHtu3?jgEA8`5V|vuE`348KtLmuT9iiy7pp}w-C2An? zwm;n>>p)$rbin2C6JDQD51!MTMjX7{Zb#02C56i|OCeuQ?%M~rlgrDvi@m8r7`T(F z3kP76%(?Zb>oWSY143qoM7Eu@0^ydykl>rQxeeG3*0Nd5$E=bKB+VQPdrOLZtzF&$ z$H|C5c5LSNzBg%!P2qT#&go_8pcMD!f7vD(Ru;q$BGQy zhBvn8{?uQt_tZDq-kPwg>u!Gu)N)e|htZ=^`gW!aI?b&!jXnuMzJvb_=T1g)*bI417{e6zI~wsJEZ% z#rXcM@}o?zfc1=Km+!^pBC%e#R2A)H&zHR*n9;ZclDNeyI*(B%Q0r|)s`JYt3Y4?U zu3*RVz$kLDZ+i3Cv2HQ3Nb5E+pKe~T^#}vTh*6r=^)^jFw%rCex?JOMyd03FHkSl8 zL47s=WNsTpo_9;NPhKTq3zG)@G2`_3E6hPV53m5Q5}-Q&DGqG-$_4;^h1H4xk0U*x zFSwj<6FqZtfQb+IzdX`#ZPAu)3VN2z1j6}4UYFxJ_}@%+l4KNV-Q*T&Hh*lbvDBon zD*sZkH)VMXT07sV+~kO<*qgj3(-THQ|1M(rvnE;<0~ZEhCUKo2VF{A$1<mp^W}D4)(UHywR9P3I_2^MF`#u82_z*#WxuOn zbA2pZISYlJIXQurD)z{05#_dUjNpk=#2BB(<0{o?#oBEp8ajl&<@Ds(9})Mf0O{A% zScz%_1}oe1>5mzs! z`r@^{Husb7d^!CGbB^aFb2kVWNke!%4jQ|jKSZhI(h4igboH%oah~0S^`}6hV^(|zATJe8ea!Eu1Ox7=<#R*g+dq3uGSq?mHJm=Z zs!w#A6R5A7&6@%2Ax#ress6oYBJ?=?CnUhf>^^F193K}a?E{j8X>E78-W?S?uvIB1 zc2kP2Kj_yIhKJm*XOy}#XAMBrA4!$8MAR&|ss0d(t*AcCYB46DKGDGpgCzZ=aapSs zJ($$m>oy&ta#+oKClChg_o*-#BCfaHin?oWn#|M4_X!$t6dkdaPUD@ho*{}}@#|Pw zR`LF$&+a2{KUzBnVv(t(V>6M6pv7>A1G8iL`#UKrazKPSzcoLfhLfxKz|?$bJ6=+J z3gm-eC%e$drBHkuu^5fN78lS*hgVaxlCkA!Po;g-N?VW45{rgqCD$Xl3_>rg&dopF z=)W!8f~T;v-iLSeepYOr4}MDIw(uxGnJ|W;YuKAAO`FAYRH0ECh@m1e7>HxhOjil2 zv|ba=_7$agiT!TWLe}N#uy{Tk9a-fO@eL#Y!B{XIPW#l-l#lZu5{8 z`eKA@-LGS*eoB2ovBik1lo|d8K(D)w^2`9Lsle9$ydP`l7Hi%wZYA!oPZTsJg>8UM zZB%C_=nIJRV8CWM4T3Ehq{I_y)rKhEp3n2ZsKSlo&9eeka59&N3#EEZK)q7&96uLm zs--e2naikv|AfQlJK@e^X6eV|cZ%xR7khK^J#|8zK=D8fP-t^xDPooWYRQnl9Vq|6 z%9kA&5vX;mXCAx1v$O}+#Zxc##FbGssJCb5XLEDM(aSZd?9~Nw*~yPi7l#vyx0KmT zuLq_B9|Y&(IHA*9gPm62Ju78>%k7^xW~)IEU9@spqLKGQ_5R-`XM|BkCS_etR{bvB zyd6P(Q&Y067R2y~qJz5xPI+``=+*ZUUI zC?hktdd8bNLVUV;>`oh2)s1&P%p!1S14nuyz2WX2ao{fkb~rZfjuN-u?A1BkACa7E zgmAzF$(lvUX@_&RaBVIT%-a7DS62b6RA&6^w*XciZ*2)g7C30bNefPD;gX6*4W|zI zc5hxiAmLon^ESyMEk(vnVco1eEF9D7s_5x7T@UNdpC5Z{aqt2X;WBXqgNNx1zya=E zT#DZ?8R>8!0CkJFWUin|@=%;zrvifk#h*j38MG8U4wvRkqrr;+x8?A(bF2_@juve_J@0u9Tz{# z)BRKl=n&V1Kda}$0eWhUepHj(>gGxjffN+|hUva%7omU|YO=~&@m@`jw{l`@Yy)(U z4pgtSFF9MK)D3Wh%$vUcygZo8)x-jL!+Y19?dkH&5NsClvxmE*)(Znb=C5{ePUkji zQXzkXg%AGER1^A zcQ5vbs3?{VZF>TfmtpK!kBwn3hGCcZPt(rR`g!e?9f zF^hEdqE+wsZgBCaG@`*W;|KkwLyYBWZQ2bF!g|Gr2mSCEs6Kl@a7I$=o!GJFr*cLXalV?W7A6*oujtzygX> zs$sR5pT=d`)xE+(#Rz8a9yXDH(v!jLyE#Al;YgBz7ea<9bY&^W2%!xUY%PV zZj|2Sg%q$dd+m3GKy_u3z;AzGFdfB^_k>i$Lt8t=Fi?c1((F?GEDU0^no%B$p8z`v z5n{eMO+$@fI9)e89%<#PR_0tl7p-%ir6VFWo~V{xsS5uL>o2xDLRG!i>NtXQj3rn) znq-ypeLde8ZqZwlQn~(^G1NZgw_56f3$5*%u@HsOpVp`b)0dL3U>pq_`v?qYP5<%J z{3JJ?hQQjBZrcr8-K;~81M(sCQsI}Ru%qdPMn}*FS~Erc+CtVK;K^6~yo&1?UF^(U zU{gbpfSud%n{*z?b>LEw#P#rvm0Iwa)XS6os`H*^><%0H)W#RmrfiRz2mKLLIKRUS zByswtoN|g3urr#(XgC=K5I{{PixLKt*rXlyr-_!_&O$w8LK+nc6sVf@W>3SMU0e!O z{A=xjox5wXbn2{lG$_Fi-0bZo;y@;VL$COA&5w9GD7x1#y9Z`GG&AtK*M@E88VE|- zCKC~%EgfUI^59uOh+i=sAU!Hp4Et3BmwimGN81iDQkqjQG(Ph`-rpEpAFqtnT59uX z6Q^>azOGp7zEM>HWNBH;7s^Tj5mewJ8bA%_WV`b!hzo0G-?Np#=q zl+2p|pZk_8i@<RRo3MgqA!T0%!SmVg}iB8pdTkhbT8qWTYVpoUz5Qnyp#aK3(H z=Vxvdq4(N!-;tW#lSN5NYZOZ-ns=_{Sbupu`ubv0#7(jvg^~_WocKvTKhmBn z@{hY#*Q*jO3Wwcsv1M};ppqA8CyplwOi*@@wlLjEx}tW{YtF+-)n+P`Bg|>#3apy| zzXzsNxckBOd;3CvXawpZdF|U%-M3i0@rM;NSRfC_i=x%R2iQFOZ;|^P0x=qUg-ylKjPJV8I8oOA?nG3IS$0R;tbS@B)V`4FR2+)G3YCJn{Zw zN_%x>C1U|k4^gi>Bof$j2ntSR0Zqa>$O@XkJ1UE2=-gy-trGm@ZeSqO^Im=}^Cl(L z%d>EjW&RY;9o_~h=kz_w6e{`3Nf&7Xgr2)!UC|MSJ+!1p<{Dq8FoScEbU8t@k>Ay| zJ`zP8D`EYO5hWZfru6A<>4`Mwh#6I^l`(?;tz(y?HX`n@mrq-vBiWT#i5CEQ@ey8LU@+NGf=RXi2K>UzJD;Mz zDj$N{I(tUeGq+_gGY(Smp66#NWA7QNmux7TQ=P-Ja{-UHek4ma!YzZ^Gqjhr0<8PocM4 z^h$W(&ZbbgF2`7E{|{Sl8CK;Mu5Ala0#cF!0*Xj?cY`3^E!`m9ozh53hje$hgmiaz zmvnvumuv0)?&JF*9Kv)upBT@$QH>+y4H5{Y4`~>cH^BraQu6!XiC?VstjH<7*APSgiko;Cp?(h| z3*wlkJz|RR%fY1E$4J(c6me~Vz20DQQx3uvc$i=d7cxppkNsaA^nb7Jmk*FYggVko z*|!Aen0tA5{Ts!md$Q1s{VOg@vBIY>EP?CA#mlWP@8%WUNny2R){EgK3kb*!fNr3c z3&K$y?{SpaND~0 zj~3!B3WVWqc+;TdZCCCG9DN;Dsy}CzMQL_3}m7son8n*Ms?Y{n|ig zdt;s$E;Y9K7(neS_NwYbpQ&=0xfc~0z0}$rANKz(^*rD&a0bt-=0=IsC_SPx>BXK3 zscCvrXHxHfoEct7!Uz^iO_gf1?;&rvRDqO$CM){9Fg!fmegMR_vgLZe)F~3{E*cbatM>GM zvRB1QhYd{o--?;qsk03&Y_RBTtGXkpe|O-W3Bj)aCx?LO#!c7)a#Q4i!)dI)=ju;} zhmCriljeu${|yt9SLQQ4Zs(HjHZ5Az!r#l|xrcTvH&|cn3i00M`ZNo`Rm7Gvdg)iR zX;u+u#DH{TY)Ux{3)%j}lMa+7tEqLl|Gv4P5hREGKJajei-DFnw2k>xvBtUU?bV5H z5n*Rz&~#-=N{XaSyZRw%I+D(u&R|Wfw7*`#{47&(H0Gu`*8a66Ij z|F%biMWyW&3tkcgWwANZgR}KKik1lo`l~h}63-6FJt~bxpe8F0$y*TI&`JM=a6Mg} zRu{C=yfn9=3rC!PubF2snkO{n8z>NyYKc#S4T{b6s#LLjvPey-yJxP>CWlhJR=VEd z$RbQ5WbK~<)Kd*g z^eftXz3t)j(LA{ip_u^kG22A<6bFTlIZb27fLM9;znJ5nm>PTyB!n^}H<}QZkHNNM z_I5>L{q*N5c_9;iR!(!}eU)xaM)@f%smbvq!wlqH6lxXveI&m(2ckfs)EMU*i3B;w zq|QDJfnw=<5D2osFdr~Yj|Lt{`Y9(rFGDG06pg7>I5boduJ!7 z9p%cW!igqj;Ggo`|6YlrgsUiUKhmn?`)_uPmdK2k@P+Vr@yPz3PAKAK8g>pH$SaAI zeAOQ{W%JK9S5&vYz`~iT)^hn~U>xo&Z@zp1uT+az`6(BH#a>iecn#aiFch}GhXuWg z)t+Rb&Zb+NsRvqx>b9&A4!JTCve#6l8zUSfeJ+{5|_#5pPkbOwbo>H!FX|oSuftLe&+2!xS3<5(PL)d!Q!C zrZNQJ6p%E({|2NerhCc2e+j=jrb;3uC8ZI@NosfEy+NfjryYruMO7@oWf;W(uR-}R zq6E6tMa;pq+N3rt&{XUG-{z#9)$o%L4EQZbPZuOCw6wHpVsKL})o{_(kKge}7NW2^ z?N$=YrMy_}cEF<<@7-WGU3z%_?Sq44&25XJDd&HXGPExmkkiC-Wx66CQ@NWk(M&sT z&i8_AYHE-|eXzHcGr=7x=HmBdAyWFkoz@LJ)+eP0SNZm?3%I{g$catGrJ()$j6y(h zT)CAU)H;b2e6cE;q)ex-_z^*WD2dI67^L!$6mJL!2!16n6)ZxyZ4VPQ!7VkrHT;lF zR+R&;sc29L6Ml+?vDN~=*O*RGyHVLo=vsxvSLarMJd2O=>3mG`JFE1VsVJUOhc~QanGJEXzD`Q?}7jMx)wjM7GZTpdKua zk;cjIJ}MPkecpcJdcY0?PzkHNar;U^OGF*QWK!^0Ka57&M;i>4&YRvSO*J_Ejy-#H zO50z0ECKRA8E4xgVikHr_;DBp?xbf$k=#i{YT&McBY;|TXugjau>^j`E~)rJ{wnov zkeaF6*VI6TT>s0)#2t_IOFSOCtKg6yPo*)@_36fa#Nqtv>{H%irwyP^{pYcvbTsz;Z{JHO|QR;$QAD5 z_D#$AVw^4cdF5T$@*#6+*5zacM8s8NN~cqk9He@E82HpCPC-{r5K z{2y8GZr|=JK7)Vt55ERoC2=6EkwIPw7He_8uY8ZW+J#9jFZzbd`Ntb>#AqtDY9p3l zP{tn52*+U%23;&lpvZ{?kvlN49h_T$8lT#pHK|^AC~i(TgF%1pUfpc`Qw@pt>izL? z{|mO3&k6HvwIax)?@Ho+6wHaP8uXwQ`g9qfD!0Qh4QQ2$n#h;vkaImXCh=!$BKyBH z>}J0eao&=A*wTXO8&G4>pX~o-txjg8R&zis9@ifeK9&`axE-$l+&&%Hpei)VS9spjrU*H~0)F0DTV%h>vGp3QiwIC(Mt78KM9LN!00WovdI zpiM@`_x(l9?Z0w7TjFBl*@&NCaFbIyBaQzw$~Z`FRRM$KrqlAiI}3;bBY`QKqZnJ# z1dq-7Q+=+J%g*epWhmN<Vr~g>APjyd1rgYW9i%264`(wM^@yOkY0)+Vqe(hl2%XEPN6P7Lz zEKe#H^boLF6EE6=-~KDj>Q5g35|hN?V1d8Jz~>DmtkC?VgXRr<O_$46oz_(zNNqs68V z9wo}}D-7<^G0LTTi`AZT4tpF1UITgyLX{m2`rs$N z57L>!FMnqMp3NRD#IYou>(v+4ci;7%`isj!AUZX7b*v?uz0P4dv)Wl$_}S3 zh-)dK9r|P$ki|^QqolbD4leN*fWhR+oa`*H`|jNHwktI8bRzEjOkim|k4t|&*Q$5# zr%;m@S)fLpf}LXuNYg`Ru@yfqYk*pi3Sd6j*t`sE!wyn4g!Px^2tz|ZyLzcRZrb z!+b11x**HUzaVMr{+us&=A<}Gdp+Ex{`0J3YzPEfhZE4u!qdX1}SS_qM`U z9$1=>Lw;w5@Ua!Ky(*bJ>l*Ra>efi)I(jN@EStmO86Lzj6mf9?h0<3up!%!*n&He4 zNs|y*{UXFL`hKludE^~4!j7|#4PkiXP;(7Ph>Aa|7dO69k8O5yRzB#~U_kYTrRgV- z7L)?AO`xUHbr0Z{v$>NZH$&#sS8sA&r~;)8lHA8HB^^t`$PV|eG8X@&Ni6R@>ln)u zsk#2}cPb$(X2`dhh zAblqsHqnhd{`}()9dZK-^=BPipd>?Qm$H!xh*7(8YhJ`}X2%Ov6v&iq#Qje7^#|vn zM>7;SzB8Bx%{SRdQ3z5Ixc(526YjL1(_{Y1${t6pMK@%Q|2gNZg4awO`p0955FlbCAJ_UB@pqNSC> zwCGiX7oJ1;nZB_8j)W$CvpuC3t@jSy>xZWTbiS~uv8m4;>XEP1SK87W`YiVzMU)p2 zlw?1*dQU2P@992iX84_(tEOr)>3@2csO7{WzUFK%WVdQJ`dte|nm^nEichyvJ@y)z zixN!{cq{l>xs)3n%XlH?Dvjk1QV3e4WV1iz@iYH?l5UeC6f>5Cc=5a;J9`W&>H5y!MOQF~pIcoM+=H7XQKJfn8irh1OmEc&I+p!SH%`7GXgZ%%Y; zEj(+&BxwCt<>^ImNrLEXrSZ7Vk(~aETf4LXiSU@yetJz)U_JSvm6~FZsHu7VLpqWk z5G$PUGcU?zn^)V2*Lmx$Hxh_Nv6l)7noo&l(XcnY5(*mVFfnF$-gL4>~dlWBUaKOwY zT5p6|j9Noi%qd|@(@EX8!bv@^{aTTA%TURlt-9Ts#?rFU$`{aTf4#VeyJio*lwp&rsKB(_<5s^oyd?w z*nS9Dh$c!F3N4_~OK&txxHD6cQ$3uo)zTbG06zm@vO8-bI1FOIeKc>Pjvo6|6q^qP zAxP~Ujb?cx89OJth78?!SsT6SWPi2@huI*NG+~QMiRsqGXwDMNY4`fhEcBP)qeQXO z^%a^zGItic-C@OMnZ?XlQi|1CyXI*8ITq638B=-zr>=M&hx%VX6_7zq+ef?yl+%74 zF1W}yX3GL<&9Vsx@myQ`c28vH?0~#*mH519v&l)rFPEtGp;W2vMTXPsH}Regi?^-s zw2}TTGdvXn3eb*w_TGb&MFoT%VhO}$M008G z8dWye5s0|l!ksJb*}9#olOOYDTUT-R5cXMHKvoiV6og$VS}N=Xc^PSq1-C(kW-p=} z8EPv?_H`@|J4@KRZxv`TuyYibw7G(ns{?atY^L5+NM@1@YyetEOx4i`gEwykk7k>u zIJ=QddlJR!*uy||MHVl0?4;8w#P_P^Wy`4xuc_uwA3{`5YfMEE|13&wQv#h(UsL?| zwVA$Xy|v*Gd$>V_;(G_4cIwx7$k}PjzyWZw;CTe6cG(>>BfzYTsGaHA&>Q}et~A9? z=~`pu_ezL2^N+1L8)2h*9|hjX2_|E8^!=`+=4DTU=b+Qw{HtyR@I>U$n(?s;5Yso_Bl&xNGs= z_opk*QGq;>OmE3)r^7OC!Gy};zFrF(KQnnOXNbIDM)n5XN@c3(S{#5)-;ZSvd}B7} z_yr7Bra~qmM5IUE;i<#*BK>P0(J2bYxaKJ+;>JMOZJwxCZUidSkGtbVG~X-MBUG#QdiQ5+iY8y0Y<336 zt$SQI{*c`;dE$2Bu$hF!&Z&_Zq$k~HkJRi!^aq5l+#adzG6RXbkrHQZ0i;$41Lc_4 zbJ!}p+M3v3wU76=k2>Fr!l{nj()fcBYZW@0kZNs~GQ@J<{GnKrFa95hHE1}DtM9Jc zzFyCE`m3iR@UpeT{iuf#{NXeIn_j#uJhr>}TS+;K@F&#tVq&#uTYFZFc#FvFABECx zKt(BWGJxjH;87Yq$&6$m9Mnjt^$H(R)wcjf+s>WY zOt~l!wAgXZ0jSnq^~C`XA;^vqC%^PmFr4CwKN|8@G@FsXBJB1U3#s673raB(kPl( zu#49-=pY!&7l)n3R%nH7M73(yLziJ(hhY^c4NZ;RN6O!4W>}UiEG#x%WV6b9{hU7y zOk9+5+iX!0ZhLobxBE4JPLAk+{lR2CyUOB{6|@n0(<8Z!3Wta&ul=LqyGE|lyO%(@ z<3#!a%aWMEcAXam1xg(P!i6X#z`%T8x-;;NB|iD*9R6bUMb0j5vu@>P*G_WH#tG|L zpzq&-q4g)=x3dT+f;Xo$G++jf$J(#wR=4VSPnfL zhDiGAQE_iLUAMRG>nR@9a6Z+TF8K{6y;wJr6OSue=O)y0W!R7juA|%Rypn&s@d#?9 z{_Uk*MPYlB$!Sy;Xa%eW7*lLs2|Zgsd|;9DUOezrI{j9hEq8j(WF#%6Qs$n4`8sIi z;U2b@8jekb-u;ePwcd=4N~KY{vzu8t&v>ep-hR22sF%qJBDFmOcD8HlG=^flMT?+l zSHv7}Gx&*!9CG>YoyX4-Nh<9R*e7vUel=4nd;`@Ov5EZqA?>+~n`c~JiJ4#IAM>F6 zb77M*WlIU4b6G6*>t_33+*t<9GjoJLA2WR9OaJwCK&@I9posGf!!5=eYTCZF{a_un zM=dTg99q0X3cc4y1f`AmFNdcaeTLP!W#iwXInVm*zOMad!T6?3W^V zP1RmeBKS3 zFrRU}zFw1RTn^2}0=1oV_zkyxCNh2So`g>~v?r>UFI$wX*N*=75?jv4J~o6Qm52&b z8{+sx$z=Kze?G<$-WORIA@o=HeRzj%d}Xy zJ;nCF#@lp1BmuNRHNKMhhLk(tKZ5ub538q>#02 zDCf5v%f?t}whLCRvJe4EiW~yrFlm}j4b?_HoTz#ba{tH=I-|Vm+^TdwfBl+M54%RD z(g@XLp+2iO^(+O&Z_40+{ro$+X6@%U7}V;4AGIBi_`M;e^5V`Iye&X|PzLkJK^}5F zW4u(`4N1iZMen$|=v3i7$#NLped2@C28I52&6tNfo9Cfd4~8qOWC9BhJ5n)~GgvK3J^S((v9am(LWo3vlx+CM=|mP!`gZYsiNCNjom znf9XXoVZDRw2hHwfKBOidhsWbvRE$7yR#R;;tAXe3e?4(o}ngQlw9XKW5FeD9)zER z^X`b6oG+GbUbCrX2wHI;=G`EdD~hW63p~664+K~^JZ_9nGfkXi_DRa}#-$IIiDchqB>_S#LUA^MZ3wu}ZVUOT+k( zinsk1zzNiJz!b4jHN1VJU^5$jnpU-s4%3B5o{GdNt-a!=8fitS&KK0ltm66;szqka zGCscJ?K8Lv5L=7}ZHP|~+yIu){26e?Z@1mU8q`3f!{=!fkVNH9(?}EY6rE`aBTryK zyQ`Ndm&taH9frNt)KhM-;EMWcvw7FMPGLKn(Zf$k%g@_?y4qV1cc<@TQ-hvvwsU~6 ziaFIj`wZ&9^9bgkLFoOsZD;tWZKOip;dUD)TG}2&SdYgT+p``% zB({*P%ojZa!$FfYoVTw&tdc`ElJEqBG-~v6>5&)MBn&d%9Ko-zbik5p-n?9#`r_xn z_~q{Y@;#%|C{)bvHSxpeH~Cx~oO29@L!&=mti`t;&S&A)K*+j;p1N~etrFieI!B*q zK*6BMNtvD@YYy}|H(y5hO;N(BgryYfne_RP--Fc!LByaa%px=nKv>r|H>XfDLqk%bRBE{Z zKH%&xYKsL0+z5m(n0}a> zjLqTMogSry5-jC%Gow=U7$4Yp%l8y>fp-bz6%4J>hQ`oMZvv3>3SvMB_x-Tc{g z()n5!mGue`ZKTw6EsYKjcJ1&7j5RbLOG)7}EDz_elPWM$zD3YPv*b|CH0#1fRU8Ka z91X!mv(N%gFGtl3i^NPOMmOOkP-psTWF~Q&!%@HtsmOWNn0LZ&O!URZcZH_*2o)$5 zrL}~=A$C;rjsX8W`s7*M{G-O;R9M{2i6n*)iT26c$m z*1xvwEPJ((3c%1@+}Mu8njR?JYhi2zxuw|gvWc3?sZ?3BC3D+_a7jp!Ax7Y?)j%VB z&&3;VDLGB!k_0vbW|Ruk$plRk2alh}>9!B^I9+ghWIFa>FiJuR-=mL&ZTVb8a{HL! z;1{x<85y3i_2G#p(+y}9kd{v`cf$7{H(HYG;9dK!$TaBQVhUm3wN2ez4=^o4tW(16 zw_F^q+7NbWpX6`AEH;~0oKC(>YjpZO47kqI9DEJ6vYqhgju+^5+tZpHLVYnIDgbOp(!KoRq|H#m*X7D43A+w&?VlUL%9436g8w z;Y#TTmI>#`{*1@9exDot)az}(&W#ktX{+lw;VVTyLP3Cw9oPlu%A-RYz>0(b1t*e) z+NfSf^wVpf0=xhHZ64Q))@k^yAQd-?Bei6_=e*!A zv$rrM!T>MEjV?lk7DpzR5Ptbk6<%}k@Z1WP4;QYe@C83f2Lh(zeoq`c1Q8qpL?trX zb@W@NC=!WweXUsXUn$(33d(9dp?jOb!>*%)9!3a2>hfa3K=#4NH$Az}3^PXI*HO@a054m?I5uFV7cShjvLeU>=G3a9`g@xz%pc2%3rw2S^soa8wV6BHq^ z*>aLP^||u6zj>(yjhga4c!jH#+u9GHS?8|i-Fg*i&1IdYVP1!uPUNRIKIdk5qYJxO z@p{Em*O#NK0ZvKPdyAX0CGAM!MP_$afbhn8YmRySh0L0G|$-p;di+%H2Q zqG8sVd1(P1jlwkJ^AuoRQgA|kS$0>VS=T$D(P-4#T7H17h*@F91vk>y7RN^OrSvUt z$J>wc?sH%mkoCjNSkQC|qfmXtlYBD_h&%jWIQth={}dm@V{Y zC47N}3M1f=wAt*J5hgpAXT3z5&jL7!)5{M?uCA_*s56x%JEK_){*SQ6LE$wuEF$Es zm#kg#>+kuv3_DZ!;wE7NKg}a7{jL@)VPij!_rV(}1vS!XfnKK^x5= zO!I(>xW$J-0*{%^>mg91nC?-Qh2DOg5kvle7v!J6T`5Cx>oxL^pmB;ag$o-}Q(RjR zId1l=oSk-x&sMu}X!+B&pwMh!yntB2(L%L^Zn;VdKOwO8e#=PDkBLPo9}<3fcpuz{ zio_NJU!gp~da zea*C7uz%hrS-~7^GL=_CJILQ~xxc{<+AS-09)$U~7r4AG=rBM9v{nv0KeAy-Y>os@ z#z6F!$B*@>TVdYkjrKm+=0UNtL7eI>A#5SnOoKxze1I{WLWuLr*YR6Mz!Ar_1x20J z7`j(b4ykqLr+-Q#f9k1++T{niutkGiAyKYxSKSrgvtIe6u-hg|1tQ_b_e?2jJ^ zMfQEaM&*H_6=zXzy@+lf=zaOC?X148cE)t?YmE~&)h))JM@BKbk&43h?QJOkSsF@w z&-8W+RVp04SOHI7xC-T>R;M%Q)AZW}Nd6H4Z*TAEz7Ig=0djbQ7`0~dgQb?#Op(v& zY%&>wwu&3i13nCc?ryGugh2f>-41(u#x-0Hg^-`o%m&JnolXb3Dx1CC34_%)8~OEn zDwYvR&KzM4uP~^{b)tlCPKu5{?DWPiyRbpP}&6LH9nPX zXNdN(BD8%ijNaiOhsN2jbZ>{KHfpSiD z<4N#dJnjyVhR)M?9_L#pc;6!7a7J7nob#EE*%nk;24$&Q8qoQk4YXhKIWB9-H_JPc z1HoQY1oD@gkniMzSp=`TdccOcbuV)eu8@)jz`xSL&lco07YImW+n3}E7ix^7x@>pX zjgd?dt*f0XER7cLme3707rS2j113^VR$nY`B9&%FycNNLz>sdQoN3lu?FM@$N?}BN z_P{3h6;y>P6Aaas2dM;hbN{zf1yPSdSs@fR(0q&2GMU1!=PIjw*h`igvoRFA%A^9M^})c(oEn1UkryOF3?=XI8wt&uA#uoE@L>@%Bh2GKXGPkUuB! z6~#pTpIz4m3ZzLQL_|d607Nyo(hSU^Ao>ZWlSMHx6)d`rsSZcs>xm?+r0+5}D|*r1 zqFc6rlSyVeC34Ot;h}aPY;upc@Ca0fAuTEABE2x7wN~R=N))gU!%G+^-8XT8geVhm zgzpEyyp}xO?l7~~2J<;)=2^c;>aJLjVU@L6$nTL|f*|vsDBvuFHw24jDVJ?V?MBK? zv&C7!tBob^GqukLQ$hRvk<4xrwAV|b@d=9vL@%||^~F>ZVs)R;JqAAujM+#`hEiLk zp-P8PDxSjngQIl zT~acS2X~Zm0t7mz@d+RXA>vACr_@+1u)C{H{AvXVF?n48G91{D&*RI%XVOr_;49$(89_N;WNIqG&?5@!+s2hTV$7UTo9i{h01vC z6=V9mUp_FGR3^6Nd3(4QgWS>yA2=6giq@M5RAul{rsBL8??q8gG%7ALXTEb!k1m}y za%Ie5B5A9fRZY=|FC=kQ3lFZUnqIbNoOi>eG?0z#eZtj^39uVVX;Pr>^4~WPk)9%*6*m08CN9^xx} z%u3H))iE3-X!@H@B=;0NBA^I=o#(e);OSAo2|_^vmt6+f#epm@vDQh@tJR@MI7CeO zA&^&N_U~gfFbqzRGZ+V7CWdRy>!Rl#+MkQ4#Cx(WBkp*(GX`3Gw3-x#(#blvtmpjm6{w%M+O}KqInT=&S zrP9xQ@AFQR3>lDw8Fz~`7Q8t$*Ygi)@h~P4*>gIQDe!MGcjTj{w4$&RFJsLW`u&DvFY{T z0$7Dv*D$G6kJ%!a2u*mG-=g_eJdMN)P(X#m`dLs^dS}$SAb@9jKZSs^d7Pdg&pVFr z!paOXP}2T{B|N;TMLgM7XdE3%9TS4cNaJE8Q0L!W?cZYOpTy_T+q0^Z>LbQ7wUp8g z(Vrry3*j)(3nOWTE#BSimB<6y0O$eB#kZgOB-s!XzOM=|s#mS!K#Sk5;JB2!G1x1z zzyCd3VdEwtB*4d;3J1qmFtkOY`d@zg|NGy9AEH>mIXXIG&++F<<8{P~wx8l^N8l#?zk8%ve4aBU)})r+PetEK&N z`u81Lks#^AW+6m^{=Pv5x>vK??du~N?dwqKp0Ga$|Iep@1&^57 zCKr}0snnE@v%;aTQ3I#gY&NBVWOMuB{&u`vU%VHHP|Fwq((VTkIic{&aXB7)0{@jD zH#c`Bc+k%_Ixz$^K<)&8Q3hgNdd&|U|GhmSFCKY0@Y>+LMRWWCNaatyz_r{)yuUA~ z=jUxd-P^VLTK@M3?7X~is`#A5GBW?B7jVc=&`Ajh2na@le(Vd!^UKQ|P(&I9e{w+t zA)m$zFAA^&E%ndg zdV-D?d(K;APISf$Hb`s{;9wF3?!_D;0smp3@^jo5vf#lH$-M3(TKI1>{r8^nG79!| z92TAvp~3(AJMgd}7LD+vR1_l@fAiAjQBD;4^8?F>)|R)b$&O!Exm03*D|;S??xBf#MtZ+3I3ILaCh%e)Gs z#R!Ru^*%yL>W(*;kVc{#pt3AVDM;~oxC%{Ex(5%WUpIRP4j~uZ&paHx_cT1zJP1^I zGIfG!%MafIqR9_?6H4`p-W%oVT4RdWY&x|1gGpp!^^E{%oWQNi3=ON5{niiR#4(OO z3wF=?WVD6R`AoUpF}SQ$Ee`3d6AL;+P^vEP-<3xQ=Ni}=hTmY^RbsRK?RABC40+p{ z<2Q$}_gFL!;ym}9VGq|^tQ)->5&$ummBd!zF)fOoit5cAMBq8E`R`f?{PdJH4qh9e zj@Al(MRVN)dCVBd?O0(CGDX5!SyJ*OLDsltoz%fk!@an;2(>D%hTUnGyH!Z|nDUPA zwiW~!Hm;V&HJhY&YBVLDYMu!i}gH(fx)==5hQS(c#~H!>Qk_tCjzvWx8D{9>i! zi25u_>37v?6RAYVNpjt!D|L|v1bj$r20*YMSW^H4!&ocnj*28kc2DNf+<3NE zST~-tM3}I};&TM|jv|#_OLmES;f0_@-z2`#(cwTk^QTb4^M&%6cQMTM`YoS0Fj(@; zpCdAnOCz2S;cxITDUzyL*6b6c;QF`6Z>I(K^|?%jUZ|^^=S=hslVIta9UR!+_vBt3 zyQ3s?RC)4S;LFswh`&kkBefYMiDu2iZt=(PKq*~tKFd0aNmshqS23QgRAF?zB7My= z8Mnn-G;5od|5(ufbH7VMEyl}QWVX!QX9VJX;U#j(o?qHa8se<~cAVBu)K-3=eyhj@ zC$|^=?moN?xQwi7bZnOMqczbT>U>VD|+DEko4& zy^uUdYU4YDYu}rrRNW8p5hgN z1$ekJ>-XK^nbje2pQ^?XlfUq|tme)yR>`PekCXNLx(sS%Xr@>lADbf7RkO%I+o3PwT%J3+73{s%a;^i&#x>t z-7-2XLSmpjXpu`3mXMbWtVQgcuhe-w+(C=QQj$G&j1$d&bWLnhwQLA20D(;I8C6ZL zaTJV6ag^pj_~?l5*RkjTNm^W5znnLtif8=5Iaa=X&X`r>?db-^J9xOXD0jc;A{DaK z2*iRGZ?ZG=yJX*f5LGp`8LBY!apY!ql;&CEL>CqY9;Iw+eent+>JT#mPFGPd{Up7F zT&c1oS5n+E|IBQO(OgtZsi2+9Xr`RZZhze8a>ZAc(1Uw-ybPa1v{GRt!=OK@qlFGc zy{ocZnBJ3FZvsf4BJe+ZrXU_9@JFpf2Y|inwIyUp3Sf#99BX76Zw)571#-RRJ-%c9r%cuWE)nnz6pOo|PgDOqNKr$caT-eeQaP|^4JhA< zK`_oKwBQSB6^GFd#2qgY0Qxbd;PM0GgWar3mrJej#|ENt1wZ;m0P%c@``}X+3Ye#| zKEeZex&hTeNmOD09hp;0F6cUuuZ6Ssc?$>)ZNWII-eiiLnd@VA&-b*4+ESP_Dtv6# zdP?d0JU>_K;n`k*`HAQnNX?+@um;%4bzwccmt3*de&ARHsUfjy2CJMpaC-|TacESFARG&;rJ;=O zovU{GXv8Cqq}Jq#y)IW~T`uvBh(9S6s}{5)X{Bomw2V=M*6pIJ6D!mmm}HAiloY;s zUmZvuP184m6v6&%CB*P{AjkiFuN;;tL$p;ugm@LDr)C<+Zo9Orp=5}j#-C!&Eih!j zhCD`m6D>)|I1VO!t5DSd9s_3xHyNE;``+Ej$@#JF9LAz!EeRkjm;Nnb zsSkG(Pa^fbjm!zaqd%F?+GPW3nzSSn7T!ry$><8t1#y-0EBsW-?2yotk@f8nUGmvf z?T3Svm9~^h)tO&%IZiARuLX!v4jL)U{L<|FatPV~-d}K#k)F@m;iVE7f9)o_UvFR` z=^`G{nezjX0F>?ms95Kz`_)Wje5BVkS_B;}xn|evZD0$)do!b~V*e*@3j7SkT38n9 zGEFf?{Q{A*`^Wxaa$t zc=o2UdOZQ&EkwF|5I%#Q5K_Cy!jb= ze(Qi61RdYKaBW;AfKAXJgNFjKi6 zYZBoxS;)s3G8_qWD8@4xIINreF=r8ucb&MkkAT(xkQN^JW};^4^Anv7BoJM!iKceOj6msk%^re9c7E--h1ckD^ z(q^hF&IgJJo)Rk_J94R%eP)YUF+Yz>*_90PV<_w>Jvpb0z{TADshiu?tbH!E+An-^ zRUxfw7)Zbj9qL`VDw?;({XX(npE9ZBbYBVrj(K*S=+B((E+H4mG_ne zKqIr#3!khCb!cEInH&Sx480W zQL=fO5`8ut%s(ArM{}`}@;yJ8^PnA)&^A(Uu(z`~Ox5jX!w8!Mxr#%aP4956c+KKj zM^E}E<-`lDF5%>ciwqj^7{Y;PbCvTL7yoxTdV4BBAzc(1oO4Pp21SM@T}hb!z9FRu zOh4Ses&S0YGyL6^Q6pjW_6H&SvE)ZS<_2pDNlg=0tMY-<9%|BDFE;Yj@#*L~?g+6I5_omMxha#BYIXU73;mSx7Pgp7I+mQ=!P?olQtrSYkisuO?@E zx*~pKd0e=U&{D`nZWZvTj>kX-5z}EwL_Q!nF}Ef&9A@kQV=S4Y7Tpq=`fhPm1~z6#%OrKh-AoVdZA8YkdEA=FEtd+X!-DV zP@_^v;--X@zecw6G<)FJgUDOYJ8Qyb-Ga+!Xd^3cd1NK(KK;qFgr56_p^wQ@8HYllbQqW~AxtapPZ-V_xYH)k zoFmffb8(C66Uugkx?+^8V6H^qZ3@9%!Tw`Ql2p-2~Rh9fi(Fr@> zjK&1bQe}0v+fuht!MPiy>D><9i^Y}awup{r^%3hQqMurnXoRDXVNth|6ttj@lc3px z=|#Lh&P9LJRUqvoFkby(j2Gruc?2hx#EM#FKITnLUa)43k#EiL6qkZ%Zqv;-us!F~ z47uz6L9$OF)uc|ldWN8kw*wNKs;@=@{khW3&0c;qFO|h=O6fW@(e6=8!m`3y*&8;x z@yo9y@zIjW7Zd|2ObQ(O^M|ulagfXw+TPX6SkSC^idYzjFM>zvY+S||h1dmXwUZf7 z40mTtpGhQgi*LM<5(DPLjiNHTnQKz0h(5RVp2%@v49D+p@v# zNL=|#=QV*sZhK%f(EAOyJi^EUh36GBt>kMK`%1CfZ{9o|{_Z00Jnp`pw|QFxT$tzb zJEaE7|H_(mKi|a=!31Nmec$%~{!V2CT09l-iO!O9^)SR(qN-yKUFC-Wi^#TL&hgE4 zn=aKZSHO9ryZSzG`lVn)y zd3<_&^5mXlq~1dyBG1C7KOQ#Ab+GfqW$7yG^e1`6EuEcQ;j|7%rp9 z;1(b!OAa&}n^8LCBu|)5{$>p;b3OUCG0)`c@la*~y`bnXggY^hC7V7v)m2W=Ou(;D z;NIC?e5&=QS=7SB1egE6#G)JIH(%fUSDLdxVRa>sFL!a0-DfQ$&HnXMtZOFR#Wx=A z^S3A<>nnIk7$*pjjCKqv!|V`ED_k2UiY^K6)z!|EY9&Ws-<(&UKh&OH1N5*pwQ8Rq zEG4nFw;|OKGp4p?v#aqLaoJ>x4>{thywH~$G8%Zq{ZD;ZSW9uuUs$92l1yL5=A>BxWba!_*h)4?x zNOvQRbR*p%EsX+7H`3kR4fjR&KIhy!?hk(;W9VAn_r{#he4^P6^xCXgDy(!42lI3E zdK7kJfoAnmk}EIgZG-6;-Uh5UyMF12U*e26IO}$T+*8#kEq~c+q#NtJAepyn-Y!Su z$F&kC!+~nLxV*2FI9_^>*CoN67((B!1u>>%U}|3T_=3{YVU_B5R=L~e^OR2llmKC$ zk^p==3Vz%QBKFJ#E!Zn$;1z3}$o5`WwohRF_i$nW$6hlpvAv>ZJ~D&dpY3 zW3Bm$8R$P*-Dl;QiI!I)R^VD<(C(f!!G0OPGmr5_GuTT>YOG5CR?c1Y7*jn3wI%9$xhqhQq)-hC;eOS6MNMxA<#W zJM3>hr8iQgy2UVi^bd=XI+z%_a!qBuJ=5W8Gb_n7QpDSz^F!`i-HiENzeabjL%a^kc%s^H}z^TDZqsO+qACp_)bUi=3XB@x~GFT z=RCQ!EzPY?#AST76Xo*3>MY@D@E3dj7#&}sA7qb%t%31RjgNz^cfhk&mCCqY3cz~E zIB-mqW}Oo~c2R9g+|C#><`#YkTt6rzv6@uB8(BK)*R9)J@ba_xb#S5v`GTuw zNZwj;IsDCn}1f~w$a^t?w5H=$P?=#~W zbn(iCa3$#92v^{Sc=-Dv$eMQnIwRgpT}^g$RjtSdzss>dPP%p6j3sB$AUQqdbslH) zSqSH87j*sB4c_>HH|s^v{N=tAR&(@)1a@Vbi=B!j>Ln^vSXJ`k0i;`N@i{5o5*hnj zFzfvf{_yX@6*?7poQ<9}Jwk9KnW%}4R;5WBB@9YJBUv_~Os%y#YXJ4DwwcSQetl0* z^;Wp&{%Au&r@@ZlY<^WSR{SuDGq+dP~ zkm+M|Xl;<(k6;#PKqf@bsSj`wqN$NuDU` zSQ$~weR)3u`|tVuf00jTAi=Pu*6(s25rbJwAKAKc-npuV#>tV?TG5h;AXsals^}LH zFzwqE2b`^kOo8L>=g-nO(+88;SzTOmIf;y^fp%AIBA+deUOCL5*;CxOTRyMxV&4{d z8mzTw8nm!$t}Yie;YDLKZ%K+A$GvGbr+q!0DpRD#8~Hoo%40rSAuxR+xaI=nZD7^j zK3@f35s6BF)3=zbg8$!7{l9-H66B2vGQ4ChA72BTD2Z_h8;4u!OCu4WO{R5gCgUVt z-5%eGrLg#nQr6&nWT;bPns(%VR{n4SC9DhbPCF!HFn`6UPVRdYm|YCS0)Kq*!}QS* zXScOuby~Ge1OR7{K)6EN0M;L-4xFxJ!6@}hcO)@J(;N0AW>6f<`aMU=0)9-aKE-Q4 zVu!*coZm|R+Xj3He$q7s1BaeC?sjv|AXywmFlbuw)91fk<$v~#O(gglHV?tMe&FrB z{^YGV;LGN8!QMNn5y|SBQ|n4ZJ(|N33m7rOiJa#@z)8yDHwil#%c%ePu#(y*#5?>2 zIaPZj_Gfx+mAI7?njmh4az2NR%YL(iP7pD6eE$0gL#;UP?6&@VpByNj*kKM0l0H{W zY-{!6hYp2Z2LI=S_S3fLQwc)t<|Jz;RLoqR9JqGqvHsw6Sl6>A2Bpd+gVe z*1J1oJB@$8DZ~)wwHhYaRULfF7%a3SQBkG;eoIsVzzV<@;F6(xJPF8QWHxT~(5kJ{ zM(VYH6>;pixaQ@c(-IstT_IQuwY7X)e}`&4_s!2U<)OIWY8NY&$0d+TE?K5^AW@D+ z)ph9fMOC3(k_ya$Uihs3*N@L)zS3#FIGr4rvC{1M7Z3YOs>(w40Yg9)FcB>T223As zFKu<2oLRttBkcC>4!CtE2;A(l9-o}3TD+=N0v?K43d#*te?K(X&rg(N@<453jPY~o zaS|kx`jeS<8bhhO^f2-wNwVPjWFe&vlQo_cNx6V=OxPsqMvP@sKc14%e77lNmff}Z zI5%(rnj$_}L+Ogy} zCa)vC01mI?ySN2azN)?_pZ%E0hn9QGEx_?oeRpcqXnp03LorrEO&*ApGw%Vb@<|12 z42DVoX>%dvc&*>~06pc=5L$!cK)Xn_9BvZoig&x)sEHU%HIsQ<2+sBd6Wt{vO%8Mj zR+@tUeM5h1yB#v{6xcP8uV$V0X92=1B^8{!;ogI=`117hG-q+~_2izvIo02z9+d(0 zca0T}i<_G&SpHmTs(_ji*Y0e=LVF#Ye_*pZDJevf@Xwm!dZaMGK9N4^CV%n@TZ|qu zwZSwdX)P$h_7z)fFP}Ed)E6ehLypxhoaA+2TPlZW!FUN8hqTUWx;UZa@=~<#`c?m; z(vPEM4@>O(?%|sFwZquGg>oEV*e-v!*R(FqJIeD6el^=gh{I2do?>A8*37WSfKTHlSu(`jy&c%Vc2cF}@&G)tU0$Io0QrA%hVut%j z*<^ceX9ukh>ke?%9wPX~WIY81A3$o5ps+{^%2Mk?Mc1WXfC2JcqD7T34xRJuW%M~?K()prBGn@r@Wiv4-}9DD&c9?0Kt;OMp@Vm@C~-m7?_@HYumVbI#AGAV z#GkkvVXB4tb5PQzn*G$^ohWNZaio9Ojv)0{b@S&a77zpBe@|nyAd-Ub zxuDDO4=H8=*VAA?vA9_3UMx#4!kb66WZU=cT zv-RB8LBDh>e=DMtNc`Y>2hDz1n;6m-1+jALO<fr z(x7q8?NjCPTCw8pz5chElh}JOI|=u;eope0J^E$~4=OzInG4=9bce=CU+3MTc8ZX8 zs_e_vV2OGD859Pzo%EMd=Od<;{_GEYC=~$< zXEoq0QUY-5vm+vNc3!*&nu+MhNEC4iA~Jc{smGq;&n|QoCwciYm=Vxhz`>9YNdJe> zAlrn7<`4Nfx9;%xI7>7LSs7SxrtQD!@Q>hsA@syA)8VbyTEVPEE?EOvSYO450?_<4 z!u$IhoWW{myNrt;XQL#{w3A@xL>nBT;GpK93Ae#RlL&*`Yfzae5QSJFk$m|*CB1|= z$Q7-%qdrl+6lizi2@AA_+vXBIpZ+#KKKQ*CbD=a(VyvvJs_MEDw)8l?ll3E~aK@q2 zN`!B#G#{^<0!7)_`%RjaZ*=@eadTDA~s%*AZ{Dv_-lkUQ1 z_+FN}p68sDH>f)2qqNHL{mx|I2b|w6&S-{6^R{XbjGYNv5=-_$9n@-RbZQmDAE0RV z`A1$;;rmZt6@~MzW*KxBD$TBE1;7or`u&1{PVKuFk9v2yy#ML2hRh{6 z?7wX#U=&HFhXl)(cmhthAq;rRqJRxVwR-fF29``?=8-V$;}c{JJjAn^q( zUUx?jmcVw=%P*ecVrORo&pZqHsaZ=2aX9qf3L7xl*kTSNA`CO{Kqn?O9(^OinX+wC)pxQhC_3XTxMo91z4Ul^3I1Pd_+shRFb4E#YW z-k-K^D_7R+=0D7`G?*s%lkfjZWJq42zSJneU9vx16kgdA5fOQ5JzedN7@4kHhuFoc z69DWDlz^|vB`Q%JuwLwVrJO<_sYXQBl63nATo=M5Lv_D`Kig*aj%T=IP}AX4k_cO< zJ&-BZWP}@c_)^&PdI??UTVICh15W@SpUPn_S30K`np@^rnL3!Uyfb5$T#Y988XYvI zE;=~zDt!BEna%mNV9llFVNa984o5gHcX9*)w+uKkau1%L<`GO)1xTj<7^12L>(cdew(=-a()LURlFvK1fh0n+L6t$`78+WX(4-PP5p(1cc{ z9yQVlR0;(J&n2A+s?`eI>J-$<-dXgH+Bk$2ptQHQkLAkZ7`L|E?DKLkqGywlQ+)k{ z&ItLFKlxl`x+l?f|^PEEeIpr&$> zT6)(_fGO-r(#Zx>QO$Qf_bGzb1@rN3hiaStuS0Cc8ctKkai=rBon7_~P4+5t-`HO~ zU6JPejpjRnMD*sZ)6)H2&@Q{xPRmLiV;+`d9XdqEEJtpjZ$M3T3Dbb)_zcPmof_Gw ze41Jj-D^=FAyOx*2I7`V@yVHv>sguF<22Mf{7IM%o2&+ES%nQdmKKeb1e2Cpm%#Br zASDV~nG?kj!bEaKY%LX6B+B-tG+Xmo4(rG9;`zj}Mg3PEhG*XVr;arjGvmyNuDD{M z0}Pquq>^Lg9nZBhv-`_X>00E^5$t5CN&Cc)1KUQ4=~!H#(n8g^4jLwI;gDLY|_*w%e3E8t;BpO(mJBtuiYMW zSOvP15vQw1U?O$HWI0-kQL0tzeTJ;M!uYWgwVLsiSx+B}ULjz%p?ftSc-q(P`dc5A z;?eKCm5WYxZ$dz;HL=51yLr~oqx&th_VR5W?)Hg6Sz&Ii+xB6@HJ@7@du;OOn!}Q2 zSN6~^i*pYUU`&;uKA)?WP9*WBz2q~&KXn>2G-x+BQk}K9JWn^Hzb49>1S0ZzMX{nl zk3jx((QBk%6Lh5-xw{BwWyvFJPNuObn0~&M715@18ZR|ClW@l4Uq*WRG`KiAG-6&6 zsOK&l&;v=#Zgvl(ndX}~&o6h@4R{Fb5%cg+^5Y*ya!qLG_taMavyI*w�$y|mL zm6M5b7v6W5k?tv#D^#j+<+Lhbm~PQOE$EE!ej1QfKm6Qp_S(}Nri53iDN=Vf2o7ad zG^i6066f^jJHzKJ%FjBSTj$;|7SB2-W{z#Kn2!36PpoWhK~w{V2zlP&x@rn58@Iff zDxG#EPd!mc{O>`w{nppyP>q*{8fRZpZPS=Og$U$?cV~E|XPgsrNx`b=lElx6gL)!? z`bGQQ;$b^ysV-ZG@dO@=mCR4%((!$AHo0ub3>(!XzpDS9gM+)g2V!XHOBn4G((f?9GFhcW6XXu8?+XTwmiHLvI zE7p5+pMvcVQ`sraYTTOC{26)zJz4a4O&mgh(Kfw(9f$DQ?qL4TQn{ADRKGdak*;_4 zegSC-?f|4goBuu}4zq6S%?EBFW0j)1;se;ZpJMV<_2OiUEyv5l94h<>1W0)7H+n1_ z1)7j2$`^!yKTY8jXLvtEC#t)~QiF5;d5rVs5g73sU%tU4yH#sx3LHA)Qpl(Oxqj$_cn2W%wpzK@b$o!ecq;a%hyK70V`>AbE*#NW zQ{VX+icN~5S+1@4P=wl1g9&U=)Nrx)em6+Ic;S&fQbv#`-pZ6~w}#lI1bjSl)0<(3 zBFTeBWaCCFB?mnT`k{;nzv~{a_kLe!)oSYE;ykDmZ(@GOUFUtVyUTrI-V~xh`j>?P z>R_(WfB0-XsiISx2chQqsqTKNJoicsX}LyRS=;PP5b`i%l_oHiXSX!t1snTH=mNkGox;9JP+bMELn& zT3r+&_jHYQ?$2S-u?DO6+jCWP_+0XdZ1OHgo)TDevBskGxCY||_rOtnj_!yve>1H>hx;knVKtP;Nf;f-za=6K&l8H3Z$M^4*_#CF1z!~5fIUo;U6eO5% z_br1qtfAu{L@id(%M%^~$pqHP72+;{Vc5`Q+Mi6}61-~thejpThC1>4I&Ck`LKEhB zy0MDm#elq=*uA35=4%!BgZo_CNu-i!e2#+N@g)Y|iuNerNus*JDxFV zkcdS~sD5OO|wEwe&`iow4lpy%Fnq>tPo=R#Z`_`rE?uJ)J5uh8{jlsGHG2jKs`Nmi38+ zTC2`N$Ec?sK|LsudW}(|Jx^ZDcaTH_+vVIQ{{!XWH%16)eMpT%ULr%^hQ5CgS6}pi zKhTz~TxZ|O?!dmOVMYC#uz+3{xUdzVsIytVr*3q<=V4Za^D>1VY2ONPCr^+ov< z3h7`SL^mPM_pV7UqhzZ`JDlY-;>T}^ova#U{$MPeBCkhsE<#Zt7Pq}jtsiiW{V&FX zXW%fXaNYQTp<)NLJ*b_-(lbCIAI~Qy;r|C9CByNlbF?ul@B8q=uBSuyIjK7-B-bF@ zRec@+2eHZCwTm9Nnj~HZE1uhG>2mXAW{QD`2Jf0@zp1mXTx4k+eIj!ur#0LeY?XT( zYO31&!4TD}p8Ds~Zpga;JvYfBD%VLxfx>&)66{6>>SbYgjMZL`T)uclE$3dcSv9*W zq|$br?LAO1a(OD45q}_=sf#ZK8{i$ z{VrBd$uOVv@5Wvtc$lq_Ui+$B&~^2bRxqHOAs6YN zwo{m-50c8|k{oU|JS5m1F$$uE<0^-_Y;e#rs$I-6*aMLX*iu8VnRJ z1$OV&Lb009II*gEPO;ru9Ib&c&!)MZ4)wY^f_Yr|JPr$-^cu?XqnqC=B$i9^2w4+q zK$2Q?ygAR#PkHkX^Z^e=zv~9HV867jGBfpVqVwXuS0Of7{q+R^j1hQO%&#uIZYI;> zH2f;45NWM@OW&r}!#83AO;Ixk{DDyk<7z@b?`zEHkTxe(8ORQDeyN%!W1o29jX$UA z&fD`++9FqIb90=#7PJ^$FI8(ceR`jngk3sq|C7eKJz2s0=~F-FWkeKt)pn6nTa&$# zUqDKwZ7A2a)bMesL%ddHq9?L2N{fr>*cJlTLO8#v?b(9YL;q4(v>BmMcn$MCh(PIS zJ6-Rd6Ds>N{Ud=#m5SN@4ndC?lPU}2CzT@2lm@M-bwajE*g2uFE=PIxbx)(iW(6^q zdv>J=*FK4vVXn;DRHGE@SjU?ai#S+CjMdjc7w?ujlKs3j$aMc*3~d6?;_xoNOJ0}v zt&1PP1I}hv7U|kLd7u7GvCCE$Qt?%l*(B9;({Nk&+nz)p?0b%s(MytRjN=kxfi0;w zUCjB2Xgn`o0WKIv0p3OLOCCG(IvMq$K4n$CbVh5Ph|?T(i81Q1I;lJ8O12KyV!b1_ zU*#icr~BjKsGpv0xoMQc8J0;mDyrFZ`f<<>J1x2ClAEE8;I5VwBC0l+l&&QZ>J&5d z&(*}&W(d61;U_ppnuuqS`>7?G9eCJHVzV$}Z+2!V!BmR3u zExoptB0SFIKckbspzRu}d29n5Au_kzPi`w(TjMUuSnkiW4Mrg0zykdldtm24zu*1ac^4HE~mTUAEag1nt=5GkDTloN>_Muf8%+2Efn2_~b`v zUVo&87KW7S)dVJUzL&9m)4hHep@kVJIV=%pPi^EoC;)*qnWBnVS_-L%N^ZJ4VA%LU z$XCI%rtBf&*$Rh|uL3IMN~goy1<(BJGs`Npfl2@((|DwBkCh2O6ssfw8GvY`*kuLW>kf(9J($atGVG=`=Ly&vdK|*DiGZV%rA?sx~+6t+#5RF zacTh0c|w$o$8Q0sO7i3cb>u#s++oPo;#j@chw*`0j3HVR_T$EzkrfuMJhxt+Dz*{Y>CQsRQCqJ|a=Heww%to?JN3e6K4L zxMTs3_@b0hQD((-o)~^t(Gz_1lRO)JUX`GTxx$uhl=Wc{?Y!thw_XLQL3~P=!}tWQ z`CUUReBo?xW-P2;ZEy3~4pnQI9WE z@{qQ2;K`r;D#f-xqEW4dCwBXTY23Blfz%roCp8FP!$KWufrv zn1w_2L>NW*>3A(eq7|bF$eRP0Jd&w^g(~V^|dr=ZnVulX9@AkDi(I5R^Nxtd#?r<7|Y!6ov zW6>!`bTi^UF{*r_(xCDTnH{*#S_s@1*@@E{mLVPlU3fX{j4h&uho@98=NYB4+3cEQ zssDVv7&%)7X$%IQfB&ATB-N1BpXvUfin__9}vOgC=h)L8%eS-Y#pI$ z64^$7sahrU#_#cI$8qaF?7)Rw%jGM2?ZHp;t%n1p_+jOqt%+MDHf@;_=Kz!Jn zEpCKmtfeqQI6iaTd!E!!IyYwrG$Lo|WE#Rv%f|YM>6HbrkwI(|bT08O@g~!l0 zvH*yLaFBAJAjZ%^DgB1%xW8KOucH+N2|7senW`g`VhABMcBh)gn`vMFu&OV@M;`k0 zdd5cFAj|SVF?pBN@EQG6QDX-)JD1o!k@s3hNv;awNw2=t|3_^pdL+{zr|$fd1gCV( z39cj*gzNUl!1?1tINS^(AF+hOkj2v!{_q=k5&4@&&bjUjg8l697fVoK>r;WK-}2tL z8m4wPFMUcP@gc=2x6t1;ZrAG_wbI7M>UJeG1NtjD5W<`*;L(Re_8gf&3WSp)f!2Rm zQSeR-Fu~N)O`dfi=}4{=mb@rrS+*sVK%dBp#8@B?53 z%^e{!PlSjeLE{=PDqC^ii=+VN1RS_X~ayAOE0=RqwQ zmk|=DB)x7>#ucL{Dv;M5e_~*ke$-O~Wjb!@p+B|D)r3s%1?wLC#(7S9 zdYBOUkhX@xY#6S$qDx?YU~PVAyFK)=Mc`<*7Vg3OsqGfUuNrVMul_-7APbN0oo%>q zR1Ak`AS>;lH2lejZp)*GQANR}NDa-}VFaJLj|L97M;Aw)OU>;frs!u1o>H5|(Er(e zLZ}~DVHVk~MP(`b2|h`gBY63+3m0|Ud?f)sp*Wa7!OR144$@_<6P8= z4`lIu#V)pGa*EH)B!Ndp&STX7hTC{G=d{2=%4?nM(+1cn#qh;x3tEhSh4=Nm(C1x= zKPm26u%|~m=Q8|E9xB?xS*(B~!!7R@V5y|{tecq&TG@{WOfAqyy3qN!vH$dzA*fHZ zEyI}uc!G&clYagg9srxacLuI2lCK!A-j&{(tcQp5TRX`y*j63`dOH#d=ugz%JH_xvRjiLpa3 z6c5Rg`3eOg6PEZ!@iTPxf7U33fGVU2BeOd=m zr1)3DK@TJxaoL`KBpd|$FXjKkIvK_RJ{8#qRh&C6KM7SohivxT>5g@KWmO{o)bOX7 z=)mTc9SKz2*Oo_e=3HKpiYlH!o&GIUL8&fAP}bPSZ4pD=ssQ>^+uz33Z%Hf;SOAwQ zdef&ZXtl(o70vagLiF?b=~mULN#U|u_BT>RLLKQVMzelE4BD!D7RnuoG(bM6@HOXG zY@HZ8L7+?&3JR$gn=sjV8f^l>>Uyaz2%ZO2yx6lS((~4uDD3GPFkYiaf-YLrMUQ*e*%P|;p55_r|Y8? z>YnV=fGO#yDiRCQJZ>}g4y*=~G)jwpyokf6QI>}xIZi*4N%O4{Wl9J9{5epEy|An# z0-PQO&JKyMQ3y~Y^?%%O*@#d>!bmR#wk$U^)%4IIdAb8 zRmd&V_89HpdC|qr{qh-Wf&GU7;drG(DbawH2Wz-iE-WDEqj~t%8!sFhEH~F&?DP0V z(@hBfVB2f{D1KM6MS=FJ^b6UB-V3nM^slzWKHJ34SAnq`l|N@7Ni_?Q(LSTtYbBjb z$_$VM2od13?~vOpEFJ})8!IuMwfdy8&!Uiiwy%_2JrBv=?2N<5a^QsaUA zf$?~_2d4oIopYYWzsWJrkA+Kc&&_V^IQayJQKhY`U#`jYSL!D`&LYM6d2TLh+1Eqd z#{)^AfmX{T&-N%BD|J@8%8@?^t4L`+sN7qf&J)!Ua0Q88Ds}^bS>}2_UW$BX z>N}kxaa91W20IDlCmpR%>$eS zJWyZbO74wUI;I&6d@;PNr~CBjqMJ~h+-&Zs`3LLhyevN-Z%Iwhw-%!G*iG{gusZY1 z#lCy28nR1)t$`PO=E9e{3Gi#ZUoR~8 z^|&p%2j<4USxf4)e1yU%s3!xCr7Ho`_m6ZSP)B#20IL?jpNPPXj45;?j~ZfCTaYHGK4c z*|j_0-{{;#hyEfvH*9h?GKE1!(-=#1w+fw-Fp+bt{?$;(UMF4IyKjkru$ht$<7#Y| z*NosgOz67eF`hl&HWN30z-7CV0qnI93Ws-T~Rbf3?aJTu$V`nMWm3 zCiWlSvI<|J*?QYQln}uAJU%{F*}(}?ds~sLVW}gS`{GK6i9PihRM-)4y1(QoZjV8+ zS9NoEXHen?-KRUm=|o`;CAf~h&y~^k4Mt%9(!e*fb0LlQ9JrLgWxZh&26SEX<4kLZ zlcSYJh%T2Qcftk6wnAX5}`?_wn_ckp^cI zE0+b6wsYh281$G8E50E$2iV-y5Pwc+=Gxy4_SE_>z@XxQV zu7&}NT5UT_XUW6O;vY*IA=Jy4Fmj(nP`{4m$*(v9ptq;1nRvWFkK(_ro&;dQu#2GG zInp(1bJB@B;ojzi|Vl|E@Wi0D17N)H_Mt0z^M2@U)3Y+uB7I2 zVh+d?2zIS|R720c->x>?YJ@syHd78%>R~bdkyE0L)CC7pA=Q6OsZx1&pv!1CmcN@L z_5s2LWuU7r1a2!Ik5{F8qQ9di^8)4)Lr!HPB1%S)dhrMl+0X#v2!eU8S0x1~89Z`F zE82r7_q$W7AveFMG3iX{_4#wmdU*J3niRzkq+BiAZZHCz&*jNmo^RkV7)Y47x2ziPuFQ7# z^r-JRlc}|&Mrvc^E2Mvci^&@)XQiSOg++OE(*fcH8NReWrO!{@AY)+su|AL{3pU3W zKso}ZBx4}s?G><#4=T;BESLph(C6uUvkk1AI4?BDT0gpF?gvCRelobBaFyIo+2nD4 z$Y`$ej$FQ6zWhGd3E$*hlC-rvW(TG0q;Y{Z&eR-nO@|KK$Fa7&feKW}oe zkIwju(&gkz&(TrRalJ7mEzRR(K2&p)0Kxp}#q!CN2p3eM`54pmNpZ0^ps#A7USIdu zO}T4jdB?$}_P!LV;^cxIZ(W>*J?uUkwkmj*-{LLE*6!zaqi-urhwbp;HFTNO6M?Za z&oTYV@L4LVHkiaG7_Xt*KRrP(_ZuCzd!rj(ZMNjak@+2A$;y5x818g+i!~+R_po*_ zlZCB7kvas6HL$cDaU3b50ho8MWRB`2t46&sKrSMCMUeNA? z1DD1e?Kxl1B>h3G=P>0GLY`^q_1A5Y4xGLB24#;StHEXG9!7PDfH^)+>8{$tSMqN8 zI@E#q+pYx!a)&D`e9b;CDz^NUp?;`zIVo_J3(LVvO-JqJA{b;o4BL-Z)CjR zL9PffKOoWfCr1|1zuF07=c=qijcii$H3!SaO06Ud@A~P=kXVj{d0|K{gMPiyCG}xm zvL=Lf#X8HfCc-2StYk)jUIQwKYn|%Xa}t^}l8xD7pWb}oUbD1jvsC&9V!hCErJ#gw>jw67ouxvuJcY;tNW9%^fPDh&Pem zOr(?Kr7TL>UbnBPIScIMdE@j0SzXZM1N>(V%C#LlK1e6i_Ld)3M#u;)8tUE$+Rf)B zl7X|;7bDVm)#oV5POr&b-u8(;Ev~z?5#B>8*ZsIrRyRnQ+UWiQrAV{5$TARffpm|3czRg%;6=tahFS7JIkt z5oUz{@7MUVDB55MDBGZQB&7o~-46t{EC-32kLo6P&HD$eS)%xe7joOJ%w(V#{HxuV z(jUJ`UTI_XNsdBNhX_|OWiZ6QR!0TI01ng}Hl{zxSlM=p9n-Zd^O!u%Kt$RJ3-kHq%>qj)9#JkLPx(M(w-8ES=exS&EX}u@{QYD=xYi1E%<6=|ywD zWdqhDK6hx3!5UW6HgVYn9;&t{$M6h1?!-UG&)->1~Z=>rlBM?!I!Jg5)Rs1Avth$OEx{+>fViz43LC5v{s^=W^e<_5;) z^%Yx`Ti~4E|*jf3$kXJ-q%TR>@>7_xoFJcI)X_pn=Lh1D$08o5QvmJRLoL zlk<^pPdtMx5fM?f*&q=xT&C^}dl7S(HBoD=`(hH_&i`?Pph81tn;cTUIqu2RY0{sn zz9&hvo+^4;YS=idxOV&5Wq5h5`pp_%GQT}7@MAT^?gTbevXD?4kPIzjJ#$N&u`qF# z&f^ex&uN41;_9jla;OTu7Sfkr5Q&<)T^^z#z2FD|CcpB)Wc`akbEES0M~l+p#k&KF zwv|mM=+))Fs|?i~#<>rkZOonQarJpqcptnQw;VeY&jxmRY9(4mhTYbLmkYl?iM(JW zR4>zO*WgI8uwQ4)soCKeSr0FMw+`H$2=y^0)T-Y8ddo^o?TYal%KBv^Mv446?MYYL zAwS;Nb7ldT?QCIuUJW_7DU)vk87)ns0e6XTBGa&Lk?8)_%=QGuLde?RcR1hsw{=vW zUmwM$rv14}UcqRTXbA&f$Se@XFceKLX%3qBN2}yg4yz8tD^_8QiE^W>5cN~zahc?y(ekyuwV*}k=~KZ?;D7-fWvP=q z2IueCjF#2#1Z^-o!_fS`oo&hj&P;xuJf4=?#Umedx~T@UX?-vufl47=g5T{Te@m5G zN*2y~#^DQyx*GXPd9pcZ&0ABXQIeX{n5IaGBATz+?z*LU87V&_MC;Irbi! z&-5tm&z3zT_R-XQpd8G#-`d(*`RZHWa2$OzDF0F-`4m}wbIl>9>+XQlPBvbxH-k%= zjA0)rQDX8>dwRYWWt*tCfZRD%0Je;mZDF5`#h3C98NxayuP?z6L(^xT8KKd>nYcGo z&j&RUiQoJW+mZ*3^%>rb$9LRpcP|}D_(#;uufS8d3 z1PMAHFF>jOW=$8{g&w?ZyPd5q8hS*r_zrCXDGCErpl_iWO}*MM;W7$&2$c?xdY_z| zglYTfyZMD?g88QfJhapqLV^PfJwhDIi?nWTaX&ptA%vyf>j|&n4HSVWK9t$~nQkKG z@vVS>sEHeGlN~CM{lH$T)0{q#%1uq(B#$?qeR~$Xc%x01fG~yXjG$$ogFfeoQ=M81(r8r)MJ$& zr(~uZtRgYFtf*IhI-#}w#>WL)l>IXT>pvG3D%hjTGk?n~Cur1x^!?$$7WdmsEKm2< zC;a>lVRqr^>lINPCbUj6aU=T0PthQH)C$RfKNg=|W5qdwB1rKCkG)9c73aZwx5QB} zZjK*FyU~SL7YyzELR+HKtf14{2vmvRY`@2Vgm9XT05oz}I-%Jn7g_Tj8!|=UIY>U@ zd0ogOjvj(hXEUFtnm;Jhuch9dEBi3Qz!F5SUjzes1r>KicZ!XS4^>me7ebc57tIm7d;v`ba1VkaJzsJG(YkVE>OQK;1z-Cu1-6> zI$e93~i+0`+#NrS(pT_ZiIeP%?x#{Xw1WC4mt*iGQHA*(>nde?dY}?Ye$K zT(!*&DOLO-=zd93ebZq9^0}Fo!Yh(CzOAmF7L>51&gM}A@R1#YC-OmK@B8@eBWH7YB4rRE^D_2c29(e}96 z69@AJ9W5kh;9`a{x$RwRnf5KbP<{tngexV3O8!2LEW~LB6zWzks4h3>X_y~P2V&co z>#H0&-ruXb(|gE-<4shd4v9GHHS4JFvAuYe6SL=hbsQH!#U!U-(!1S!_&jOu^F2w8 zakGDeF@4xa3=B7jnL03VPf2Ym_L%n+gbFM50VbPG9QcaSfv7YpIR^(ysAJyeD^oDS zP9G5K8JYEQQfE-^ne&MVp0=>OruTj!pows_+-YA!W$Pxw4W)@&^#P9gedhz?GzR)p z?1yKk7lWD0dHbYibEE~+Xs8Yet=;aS~a zm^Ykw|69&!e?A5w&3p=T0&<(p&!&+&9Qt4M#Es6p*}Q6H z8sZ`KW&k5mz*P3dW;CGMaD94xL8hf+Ia{48N2i;I$)MXJ194#*Du@={97t>Ynhu~w zwCy%-!0A=w7H<~)vApDbw4&UFxCH_q$Ua^kvQ*aBWnmH!3)+T!b373J9)z5UvV2!3 zJ84k;@kkE@wOITU287quxZ8 zZ06!C2~XUBA?&rN!C`Nn-DiAm#p}9nl94td0ZE+6=c@%2j&xg)oIB#ASE5sN-qgG2 zR8P=4i==Jp`#d~jP#DTk%>pVejGqqi-sDLH2h$`}zn_Sm9Ez5iL# zhlh_<6K9&%`Yn!lI&Fs2Qrq=xlWg6#FgN}kIA9_6;(g-p7aByXOckOR(m^RD4+vzV zJtWXh9H`&OUbEPA_OKTMwSq{mLxNPV7{A-ccnfBWUFEO774>5p`#TSq*b_NA_tSDM zC>>ezEgrBrUDiOrzqY*K`|PB5x1wWlJwEn$W00IdBaU7>_05A>nxdhhd3cpK2d2JD z3EOB8@1O_FV>6PO#|mrpYyT)l3I0fR$?a~mD{_bY^*Dlo`kjQXhk%Dmc2fj_U*yze zy3=O(q%}k1EKaw9+cm)`I(Nroy$+#-0kPgR8b8v=-#uLKFv-OCxna!!u;@of?P@Hr zQU}Fh{t#-h*yAu5;ILBGkzgo4()w^ucaq9w>kE*qb>>Rk4$kF^=kA#Pzt$FO;W_JT z@tMZkqn$ojUjTh{?gtbRTjT-iCm1b>!L$s@e3FYy*Z_#~^4DIVdKDqa{nc!I8R*zP zcg(mVC4VwAwyXSF&t~+j@~k6(^9`wl(3REQ!f$CcKwk)T{Ni)z>}&r$Fv(os+{RWxF<3}ArACjIl9eYm2 znXKS?|5e)ToT|Avh;Wg13RtIy_OF7#p*uHjyBsZ3>Nk4&y_S~N{?(o}?|x<1>%Ohn z(j;&r{ZN$$6Vp}kGgcO&rS3hV2b|uvwrh5_qiXwOX|ltNqoFZ5lqOzc(&_l0@AFIL z_Nbvv*G?6BHcyXGykd$y$?JsH$!?^=Bs%#&jJzadL8|mTJEbD#t4%w5AbjvcrkTq7c0u_*oTW#l!kX(=Ef>(G87X z-rkpL5B?(l0c+$`pr-H}DA2fFNw5Izn-t&+qHwxBX$B77;ys3H|0>F8J#0@OPFaHrJJJb_NIs912qz_0nHJHbkVa2r>yIwtB9 zOwH_IqqRP*kXxT}#OKzipesx84yFGqq_TJkzG&7{ej&K3aNhx?LVor}1~1r*(Y)v# z#H6=pC}C+oc=RAKeO`9_(llS0>M%YJVzGzc=>$CChOw(oY>Cj09OMp9qxy-Giole;`E^Ov0laS0BKv*)<|L2GG~+Pi`(xa2jby zyYU(%VnR7BH9-XXas7=9`=h@}!Wsm;cP6nHABW3ruO=w9+>P2qP{rPt5olMU=*(TW zD;8NW(r#~$)V$i6uak~rzSSGkC|Q3=-{5!=7FDEDpyaTazx>VgVIrzc3U9nQ8c5;$_uw4UGfwXR;h!_!qY2U~b!mW-XwN!_=Y^%JL~m(_{{s9Zw?%jcd|IVK>%D0zw<~ z73PaR-+XLP_PI7S5;chbZcvb(BaoIM1~HEJfZ`HRjC=vW!$@k&#2$0}w>Q2CKE#__I!W*`)C3Sf*BK;!!ydqCGq>e9CH z5s)Ry3UkX=%ScrraSL?M*A%PFF^dfw$wa5qm-T`0RaN8LU&xI=9t5Y&2Zqr9Ya$~^aewo@R)_Cz zJ_Y3G`|w22wumN5uKoMDSB;Ej{(SV$Z*Z~80K_@f=fit|S&ioRdYpvIs9FQ2o^BO>A*#0#wVOc1!-_J4EzXs z@kTM{mkj9KT43--^-7EJ>jmA{*0hVhQ9hhrEM)xdSaHAR*YnQZZja$i^R9w5tg&c) z&ouU__AgI}ov(iyR=hi74>ua!m@O5a$3KtZLdzz#-{bTKzTpgcXEbV_aqRi#&bc-I z%0r1azWUCoumj_sV*X60gver=fV0j*l}BG>$MlygOqM(SDV6Qt4WDvjzkxLG?JpWM zWN43Niw#sWmARzIh1r|!)CS5w6y@31`n(;3HH0j<$NzAnRUo?jbBv`*wRUFZUNj_e zSRu17MC~mQSB(_0HruU-mz&j88T9wtnaG!A29}#FGFyBbIP_xXGeW(Gqo3p34G(cI zxgx&0s}bJ_dzHG6)hefQu$smu=M- zjYi~(qsTGNtu`}8Sg5YATO4%Q$j#W%fckm5F|?W6p|XnBv7tuK?HVW-9`c&>u;leK zcMkH$Q-1l=h2MU>CW6@aRLjDE|Gn1tN8!I@ibO<&%G;LnZCc7O)YcAW+B@jr#maSu41q`U`pb>ZIctbjHZtyr?iF!s3Qh zTm6_M%(>4EuMaHeFFH@f*Q!khyR>I1- z2-r*Mw2GkyW*94_8X%~O^7G- zcdOXkK9=5kPpnOx3^%T7lRGP;MtML-@X;9h-b}`;_CTCyP}@oEC(P7~sMqMCcuy+j zjd$NL{!pI&bn-ciJ01kazXq%?-eGx;<;xZ0TWlV^`-bVYUxs(M+AD2AT!ra6(b`k; z1|#^*Wp!NfR4$NbG1wVSBCuPUF=$myuM4xn-&y>>4Q+$4im9~QX9nJL`NzGMDOVZ` zEmQB$(z%TBu|&KL$3HLh4Muv1IF`FEZbu!2Ty#U(>>``4P3n)Kn$~&uA-dptuyt=c z+j>szu@NReQ;LS5uj$d4QIhly--t-Y~js3jmi4RLCqFH&L%oPTe7 z4QoOt!OEK9gc0naA5fcflgdJ}Hn{~S&Cpfvxq zYIH?d+Z?*?iPwGS$!-*w4I9u~Z1XK!k5zw8Mpm8}yr-J}=qEbT&nC7);bB9@uu%`J z+`~3enapfC3I*&%mdm*t7k>rHrV8yz3ZHQMImg*C6Tj`K_x_aFlR?Yo{yp_L z3=j>i;=ViL$7D&5z6BEth{Vy?yU&J$Ym{lcuC0W7YF!T+-&~@(H~+cD zVDZuxU-;ojw)%g*XwPLN)Ia@Ojs|^%3rH$H9L-pDyC^fZMBrg}A4>@9j8#isX)*LY zO4+U;)@+28b@^U> z@e493A;3X_Ckst)j<4D(#Ryo;R)*sys*RU9%p*)SxFlTzn8p0tNh>n`MNIkh{R6_n zrT0GJ4yJ*hwwJk(|9jDaIfDYj+ME8@RR5nh``3CSQt*6X%F3c@9z}2f!Z-ys-d(Lx zMCD$T$?e~5KKH)6aj{QkC%%oK4ia#?Ot*VX9XOmJF3z4Cl~tZITd|Bl;zg^Dhkc`{ zDMH0;?n{{xCTM$>Zhz&r@{1ifXA+oS$++M@NG`%)a}g4Sh~K+&_(%v%Xog5r$Vk6Ri7q^SSLOJTJ4b<= zx!Pw)2M-94DWK#;UM95~j`iFE!}o$MEy}D)OsJZ)VBUB#9(B-}Ca*Xtq1$$_3xA{J z5r$dVS`t_r&OWOeG&c9zuP|IwE^YJ;P8`5V86^Na5Q&%*vD%u$gmQmsP2HqKl(9$8@mQiXgOpv~y}Wm= z(^lmO;0M;{i}>S5YBo8gl^RVCrhPTG7NcZQ-3I+PfXgyS6Qn&~;`&Gxy(D{6FvV-y!iokBE?%=c96=PX70O&sFo;T<+%76)>LCguFo` zsR0{Ce5wezj2cA$q(#j$Pv$C-3s#Ci6(dro-Kb*RrAYv-vGI9@g=8zClEjUvtb+Zaig2mw$Kp*Daf}$2s~4Um_!yU&&R4fD&2CRb!Oqb(jO$88-%1=$cGm)t7M_3ibYgEz+tGGYmpon~jlhdpl_vbFA7j#qotfkqHjZya|dg-Ael>A4fyFvaCS zvOCG)VXgQIy(5}_3W>iSgk_xF{FmeAV4gtWbM~Mm)TegaWrWOpLP7t`uK%w7{>RhZ z7r(BEI{dEJhtf!wbnZz4ZYjSx$z*q>x*s-CxpoMW?_V4l*1C00%TRrAyt)vkdpjn7 zPJ|6Bt<cXJ9tCPOUZvm6E`l{CB@b31yjAtaSY zduc+s=)l#DvWEx^S!R`iaLm>IK^lW4^)*mJWN-h5Wwmx!*x_5;`d`Hnx$H-%9jT%4 z1blV(U%4g(bHSS9eesd_-%HWv??{deHWX5Ye*YvR7E0|K(q^LamTg3LOPfU>e6@1S z5hxFvdp*~&c?*gvV-Im%=iQ=<%;Mn+xuZYR^*}2DBdh|#^_ZIF?)tV38R)PTU}lTh zT{K!fypeg}J^lvzz(qNx-o1LS8h2!g-?M-6U!BFZR!!kcBwGa9`1YJ0q_SK>hIply zj=%p^H2mic`R}CoVjZQ}lViO|D7oqZR25=UAZ&!$r*=k&$c@+h(%JSpRc>45^{CF= zS1ZIm?4Mt)q-Oa3J6ivrdFHR{*({FaD!CD_`1<2=Em8oitZ;fN*_e5p{%}k!w8u`(OM2{T%l{`A7~h1s`j$XVCwj{*J%iB9s>af8gu6WDm*be*i0S zNOMgdGGM@UG+GTj@dkllx*JKS7XWK^CCM#;iE04)Z#~QT#*@geHZcjE9}Q*^46D>X zRumb@RuQk=9j^Eb?+h7!X}4e2bU9iLY>aJO5*_DY*~4L-J5OS%MbCZMXI7OPUIiYl zn%@hEOcL@F?@O^bqo;{!HMz69;ZG5H^d`a$)~sQqQ{L9IZx_yi%2)x$Z#VTFPKNz? zp^wG_Q#vDtX=~Mu0)<2FWhKWzo$GS-(yz|>>UBrltj)TVVEH`3OORNg2nct)XI_t% z!{v(E=N6sdwp-eJPNoU-%vT0>({Wi#7br~bPeqrDCd+;m*%7at_4D{n&U9q&T-p#> zv(+VDez^_2T5Dt@#^}AwpE9ry+yL|NLJP>up{^V`h@V_xo=4AaD9*xcnm(PFdqIolqFL{(&<|U zwA_Y)2M7&-iOLsG13N=MOmgoY8vy46R7g@V;rb5x)3ivyUX0_F0T_sli=(v>P%nb8 zgm*9EYymcdTjEg+grJq}NsU+bVp{64?~i#ce5LIvj!rEG=>KU}i>=+PkL~IX4jjQR z3zGqI@U%kSNQzDFZf{IJ#<3Z*Nr-NEbx-Hd-p^mbw>pd=aQ)&Dj@{N+2H1j{?sSMv zg1%TDs2`(@*8pK_uo5p3tdr@P3cT|Li*-4GgkAB?0jS1%6C1?zS+$Jk)^uJjXJi8e z?h~M6N(jclL0}49bb?9NA{y{asOHN` zs>x`saVPK@H^w0W*lL#D2A8v-eFmwxk*hg2VvmEtA)}sp_nX?H10?}cmG}u0WV_TG zm(%Ug{#l?>to}y@XiLsEy8UoI+cmeI$-V(3{$%=(g|P1Cx& zy<(>N5U+wdFkN9PMke5X%zo?W=-72zt#%dIAzxp0eS5Ws3rLNV(ZHey$DOVk+av9C z`I9z)&fjajP9g_%lJMA%Bvv5|y0?F=l6t|0wZCU`2Pi(7AmewJpz4t&1_M${39Dh>0B~hlx%uYM1)u@lH5IwT z>r;>axaIWyo=$${=|a3$c5d;r#RJJPYEQsIWn*$L z!(ZtN^#QOeD0nsLfP*jqaNX%v&zxLNHmL++mY!F7vrY#FmqIXk@Ab!ugM;G>hjxKj z3>I}PxEG;hq2P^+1AWa5AiHtC^c`cpaL!_eO#2DK4uGK;gGe?~tRq}7i;1-0?p2KF zeGL}uzu^zO?2=**I&Rc5r3mR1vqNwPoSmGyuS5^*4eIpUuR9}}?>auDKiL?TTls}2 zb@Yttc$3d_s>+=9Q8~~TOkbqz82BEZ1*F^9MpE2NfgP7GgZ=LH{7BKAtUuk<_bqT*A_# zUi{_amr{w*=Qk;zj7+cW3ut6^;|-Md4+N<_F)W@92eA3QCH6MCB0gXw9|6C;OeIC>>4TSaF6&?bNxvrkuts1+EK0`tow7)Hw2GRB-a;19jJ zsFt`Qf5%BAx%~4xB>@U9&`Cc~88Aln&%z2`vE{%~Al$jHK{Jx6rB44m;Gws`~6ySZr5WpaGGS&#U+QMK)&*LyF=E`jW)y+coR}i>uuF1~u-D-PiatpY{g3LwtNEoYaES$`CZR=Pg>Y9xiWa# zn@p7(uaJK<=7fy`tOUQCnu%3yO$}C|Kb8#J%;;})F&V3`V9D7qFYW)mh2M^S zwjMLsR<6}pKes}}c79LL-!hf+Ke;GwGTd{&*YW~P5dTbRLKzQ>X z%L<0k57Ji@kyq2r=?~mKXxSsgW?(|py;RwubpymRMq`XQNY|(J@H<%+(;S&mZbvfBG!>*XC?blUyHcu-O#L^pVOwjzK1bAvCUJ3fF zQ77_Xs_CX6A>yy;@(P2BMaQ-EB01LYK?-39LD^bC&vAlB!0PwY)f`86XtAH?0h)P7 znb@O%UX^#L_{{Xwppa>_q$%n!Q5rupyE*F9;i!6T!ZT%H`N6=J4;W_T=6mc(rX39A z_iyrbY!k)4mNUOjWMs%$pU;tvraa34r~OPc!l(TW!}--wzrYITlMw>NGparkjn;V? z&4Hpi8QDyc>7RQtCN*m>7h}>8j>>~})J<*P^$>u%aMQ>->(ABsV%jx+dQu(*IPh#b zC0TC*pTAZ~Tq`MdJX?ZS{RsP1cQ#Z$Z}@iQn!EuU)Sk!mJvVy)sy#8EKxm|sXKHNJ z%ki172VQ#F(^AV~77DrGtHCkNblK^KbktvkDnaQ)hMs&b10Mk~2d)<=rXz(6rrBsV0ZLMBYUHPipc4 zC!tJwUyr{)U3ae^jq(mNmK$!36pCNKt=RQ|PK~L5W;u}h9KJqUWlkjvdztC|$W_X) z36DOZ&elXm`UhL`=Tcu1t@nR|?D?{cKb z%X(1ntN;8Dyo2Qw>xFEGH)*wooY3pnL>?z@!tU(Kd8K`GQ+1CwUB_&Q(<&*83TmFh zd_>0;651x!#dam_K7d1C`|m@)W_3C?2P&K_vhm0wHCHXK69$H;P6`yHkG0H7)1Qpd zgv@pXf(QE4F*X`vWE$@%8WCn)1uLpZ55oTfm6->9tI^F@c@2lxWU*;4u)O_p%yqKO z?n(V2?n9NueCTWvn^P@sp~?(cPBq?qecx+X?_Wr8G_nhv4ZGx)VUKY4xL1Kzu5s5u z=umGY9jDD0?}0_R%#K<)!cOzuYQc}Hjr9^7HPUzJWZcwJxFmB=Y6S_n)Rij*>DfWZ&j&_PQ>aD{@hOv>lB9XU)iXgE!Gn2zV&~rg6a!;k0 zb6IZf<_E^R7@65XOx|SBHAVq;$DKd*(@#(8%L30Meq&j51nQ92-Es)t>gNR_&3{Ot zOh!Js8M&xjK}vPED7VH{Z!xYD7Ja;i_LVwIo^IN=C6S#AYopJd7rO$$ZJT|KbKOD7 zGXvfhA~J0q>ZjiBZq0ltyEsz02R;~onrmfx9L2t4!~MV%oPbhW4v}AKLs$^pM5d4a zE`8h-@Y1mz@8U7Z^hq?9-*9o-o+|)>RF1i;mF!h7k0dHOe=%61fKdyedAYKUPj=?& zv}T0s%IWF=a?}Cdy%@*tj;r>Kz-YT#TrH0O%ktM~mhQEJ6E9P4FxLi6wumq~aWOqE(Vzcki6tyexol$Xk9H8_4fo=7hI)`>JD zCr^ov!ssDVx!a{}7K=`U0EB|?L;M7^>!UQkq@}<3?H;Rv|6NkHyk|ahzx6mpvBREb zYpM?zsY|l%vaFz+E4q1#&jKM&G@HrD^hpPX>JrYN*uYrP<%nAi_dvaX7MpY64)UV@ zVRO$xPi$1)Zs1h#k@j;jC(}TU^csmPU_DFMd)u0B@R7*!@AJq>UoZEQ|n>(F#2>A+v!Wd9hqsV1VdGg|^qP|XbYRotY*Wrxs3y8nX zBD3>Ave03|#GE7Y7B-6#Iyn+z2jrT0+3=>Z$YbtpIPlk2thWS4-kPYoI;Z@SQ4DH0 z+WIKeHYeWVkw$E{aeR4-goc(opB|Rg1j@|~>26IMBB#Rd8rxG9^n z)`_0RWFPiTy#1m@6u6~Q9pHIE)0icgT!{ZU$DZ({Ex$ik%4p)lTNn5o@ORD2!yE&0 z?TGjfga=T`O+qOi!SO=2*o^ies`{W?HR=w-Q#%38V)T6fzSM=Via{KoAp#!l6A|C) zk>o+ zX|+}thM!*CgP?l3bkWH4SXBK{_^&e;ggM;5ssH#sLRW!vAXBFl$)X<#Ja#JRs|trK zT)UcmRbsA$oB8?ah!5V?(pOE-&L)7GU5Lf{sn$;x!*6<*_Gy-wp9PJqkJsfcO8%a< z7`1^ILu1$%FVB_NQ%gICFl&L*Epo@pv#LM!M%_4f008XTU!Fb&zMZ1{tP+vO$xBqf zh9}F`GVc1Omw+JEDz33+k=f)>1ZPw5<2Im%nf>{@t|H*b==8A`og&DN7F3SIGE=d; za`h&bC>0#Y|CnExvRZ37qv{?RqF8%)h%@j_Z6}XLDq7y8L=QR9JZS z-Q>6L^kjJ|C8-(%UK~&~On=N5#jsVBa;xN%2hk7qJD&s9n;mFEdXoXj{MQSFx&oD3@d#o*L$wul<(^cnwbji&kII^%aGMN32%P|TSoqUF6=xd%lYx;@^D+XA+(jSY3b_e_Q} z`_rlXSHHCz6RsHVH$3&8ba!(Z2v(v;p|`A~waE-vx|$Y}h~@~q7J7i@Q95aZKN9yi znosX;jS+JU{gyyHj4RY}Ox5mpR7hfrSb?`S6bxKwdYc>B$T4E6B;B zQzpj#9%}dpi|#P_yr|xa^rWrxm<&dZY){-Ji@8#1oB`4A*s4r4gQ(Bm4Oke}>f*6d z4?_lyMZOVI*3RS#5OY|Bwra$vaiD=c-QZ%AJsM7RXSU6_W~(nTKKEzV-+i4v-#m$e z_YbfIkj%)F+ijk-PSPr5z7MypW_~4oIC$P6_CCf=sm18pe7><^v24JMSJsZZR%xg6 z?uQx!yj@|!S9Un`RIAZ-61pB>Bm59)4?}3yz5LNNsP8@iMM-KSaiMQ0N#FKWzhNYf zEeGdS&Kohb+r{y@RN}HM5F(L7Dhs>jvu_5Fyp7E?2+E1~c+N2cMNGV`?-tZ-v=LJR zJsZ~e9kbV{dk&WggV$anCMFHMtze%6B6V{7{@NU52xt*N0)y#MxoE$7Z1;DM0fFn0 zn9SVD#4KH=Z?DmpBT!YcVKu1uM>Tg<$%+}Y_stROD&r<^W##77q|4efKIihL)i6;T z;&Nm?|C5vQ(GPd&IgPOm!O0)&o(6Q_^hA~<&p6-a&*@od5%n?#7G`-&?Y$=i_l@CO zG3j`U-S>+lFzL+Twt)OdSqw~$d3HisyelboNowm<&wdfuZ%N-<`m>(9$=?u)y7NNn z`8?i{GLlg`#Y;e6vRHhGk7jSP@=M6&lr)(wN1@y4a|-lgqcY|dMKfLyD$v*tEp#i^ z5{F2-oRA8V!1|{d)vNs5!<3Xbxcg`7tt%?Y$i3%(`Wf~o5bR9Kq;&>F+i4d*A*-ZI zm)a;yO|c+eZR=!)e!B^5^qXIk(ONGp_DSFgugWQq74zZw2TifS1Bt(0qt1{_{MIT4 z5z}dNlCmWc#j6)SzvZn(pQ=e`MN61b4)Xs{Uqps_LNx_Trcy`nS z|BRHLG*{|yQ73dVe!5;7K=RUXjlf9L_oCH}(IUEO`d)5-g1zGiY;@oP;|7XnhCroH zD(BAS0u``_zG>4ruK2;#H1Tp2S6&fuq&J-}Bz+=ny%Uvry$Fxm8tK+!gjIFIJraTB zOV=9in>LL8z66)`vke@5)$=F7TB2bULz$HAe7M?JvUPJ~tiU}qXMg9R78LnxFQgS& zDc!l(d8mmn(I29z$+?nV=Tz1KA}C)9RlK^?rjpTk3b8&`Uj7MGKN3Gioz(DQc;!k> z0N7acyZjC-ELo%5@r@O{ULcbt3rJkPwEbw@G^yfufJa1hd6vI0;;w-+(?8~KqDZCz zZ!*EK^x;Gx{f)SGDP)61EtoP|1Zd+`m-U52oWvf1iAq9~V5}RfI(@RkRx4^SuAs%l zvTU%NBA0Zs^QKlbh-Gjb>zOr(|85-=Zy}n2-l_rtmu8CmFG)>n*3yr;O-HKUEKM&4 zVDtNX1|E7E_szhKcj7W4=rZa=@T*f>T#vRl+NP|Hs&(Db5O!)$ei$7^3Bb29ZO>`M zXKU?o$2R8VT3V@$_jU`G>b{+oVIB1W_({rvp4hKPi36=Wvw1(t&&y5MsEx5uiOS8V z9e{Sf+stitxW!bt(s}r-c=)TE;Kxr1g=pKC!l(nchD%rS)+1<;C8eqzHaX2cDA9ck z5m4eVo3LulxBl$^g^uy1Wx@Qz31sv4jZ-t6|K4K>qEaP?n%)dzA~Ju(>su-n3a13; zt2H1=pmOGK)9WdI4sP9kOs<|qdC0SU=*A3+LST= z5p&vsSpT5XlqE+L^nvb8B3}Gd@RlxhyodleV~Mn#U>#K~{U9!6tW`Cl_^iI-Q=Vyh zTws%Ee{Ql_$>2;!{?4U6(I?8XtsG{880)fwf$aWEd%{nYVlnGmkbvsJ>LC6!4}+F` zGEp~VbYl z?0)4>*qwguebGewEx9kQUjD60pVJjBN3J1vU!N!5kAPlxy|8nP`^30devMY+EP1xt zf!B|KT*cZOFK-`C-IqK+qf<7*xDT>@5{0r7*>>0~Zp%k8BmVBTyEAD7`-f56WbRGe0C}{8pB` z^`?SZRYvYxDr?4w%TNfc-te0vwg_MhDHmzVh`@>!d+6I!gJ_V-ngO9FBrkTY=aZlh z^5uE!SQ2OSKs?+@8wp|(U8KUuu0*exOD;{{R)6>_(p2Ah?SuLHa#rw=rEFww1;ij| zYdnu}ctPN_74DCpnf=+jg$$xXuf!lGpj;#jq)}7TQw1cpPMW=h**v_elv$Luvt*)` zue^{CTiNh?c+U356(9k=3SLm)w}2pX4`VjZqkaY4BnVmfY7T*HEX(t*ijp^4TXx>O};9B=8|YHedfBu(rot65)YTBmXA&m1=6)@KqiEC?6A z-*wtuL%{bG{ZiXJ6KagTkOBLIQvHW&S@bVj^`Bf#DeX~K^C{@k)r0!?eJk)#al6Fs!ClulQ@?`Q>}E$!N}>g_hxcad zWTIg?Z-Hcq+Cm^QhPPI1^=5!HUQ}U)k1}RAoi~C{?4r;87sL5K)*<%@8I9lvu*@-= zHo$gL2u{4ou8`ff`D%sVFotGWf^h~-QRPB=JVsuB;uTUkU$|2g!4MnVlo?yLIvA0| z3S4#5q+*BMVaQND zUa9}aWld1aHffSf6Fz@W^4cuwDBl7A<6X%3-f~UHa6oZ02u$6jK#NYCZ0}jD?l+HH4eWjp%Qr*e#~Q@R?Pa9(mJP z?H9EvX2w?~>;hAY?poO_RY$--myY92$Q{qm8bxNUzO(|4wnT4i)AP|9(;lN1%mbY# zBUMrXCyIO5HgUHrjFeUpNre=O45Nu}gF`K>Z_vqJe|>AaP5oQjpI@`i{!^Z?NWf+A z5e5l|#AN|=HsS5rNV(r)v+5|Cox_O#>9a@2WttDk6b7|9?WUv_U7gXDau36|J+>+n zP}a)O2PDiVvf({GZvhLzB0(g|28Po^z4dTPDbHSbCnRmh+qfpN;jwI}uKwpH!+zBl z(orUO+?XW>h@BIk>P|w(G4he0Jg1hTo{wOktgEt`Pc{QJjJ}I#AStu-PL2WB6m!hb z@O=1!+xfnnQeb^!b>G&QWoqS4t?X{S$cj_NlY4gT|37X9oHTDLg!Au=n)Tll@Nj*o zz6n~`X5$P1B!(Qt*GXm=fW8b3XZ1te;{sZ};gadathusRyK@CN?ZE`WqQS8*U;#Gz zr=WdfOcAksLjBi3GX~IVGf>pZqtEagba{mkfMmCaPM|9eyj5unil^B=Tmg zLZ8)xHP=1CWb`tp7B_0~8O#YX-{>B0z6&5^v(<~@O>CCX4fy;_B>nhMfPleo-j!cb zsYI>iuc5O^rrq`}wB>fiyLVvCkfZeDL%B;ozsXECzs{%tY_h_`;vGTp&I5+IW)x8#MF9%X6M?Piu`2_NNiXY;3XFC*Gw8q-;5*;<6 zfNixdqrVnc%UBJ6@+aq%Qpz2uK-|qx+=nD?`WiM96&a1r3t&^O>;?)jXXEqDqSkG@*6WrWUfFZYEoEZvlqUX+D{3w$?Uzd$M#WEQ3Cs5HaIo`+d{E*Eu)j zZkJN4lqq>hiQ^Fw1G6 zD-bp`P?0OKyF2UR33yXt50Q^EiAEbLEK1C$^4WKI_6b&cfBd*_;vbcmDl=w|K+pXj z=oqZzRv5(%XaY6zVBW6+wDK>r!04pw28bER)}W3Wtra$m)F|)(&qx9@oZ(iuBwWo| zXTz6(knG0rR0aRdIjiX@Zw_Of#m*avjYR0`K85I=CFAXStX#P6=u7DbGe13ofa-5fPrhLXB(NWUYNQ8H%^>WsGk6Iw6aE9}$K%NIn zeJ763!HWgsCMt?Kp(wToEb@Iv4l5K2j1NISwNmlbvqGn>_Kg-f`Aa^x%ja$v*Kq7t zA3i%<-j}ohaV^SfD3$UJi?Zu*V7p_<3ovQAUBnY6l$%EQxb1#%0e81#hM{*el2j7P z$=$8E=QESTO6(D@^_*czkbq$135sP3Qg<4LUP{!;k2^J4#1VP z>0D0UcwqMHN6d-Ns8Jt~DiSOTN5cyl|Kza~h}!6WqZU_h0fYc9 z*OsUlCB2d65O+Zp2Cxq%21h2ZRj4zd`=ol3%$fzU~@lM9^S1qh>Ywb)g^6DwU z(U33-Wi%O~`J%-P`RN59GU|UM!(NumoZ%wc8wFj$!$m}>c`BzKF+~??oUFXyF`Fok zU=_2kwYv%uFQ~-uMI#8J{_u>kq8u6HLfYV~RlP$$6H-gAsw}?=c>pJN*L;nO482L7 zR+p_3gPPzy2dbvx_ULehen%D{nku-&{&ybzA78KJ(^hBEYX_w4$DmhT4OhT&3*+G>d;KSC>O#~^jSiW@a- zE_ny7CZyGUccYWlL2mW)qCeqkI_Kmvs}y9?kUEzy1?z2M!JnVES~q>U++Xxj#-P~O z+KNuDUccE$<%Rtk&<@0+{Hm2(*7bwY6hBVD;qff+P)}~)b(o_t87$>9pR4|*$irhD z_O3KYD~^-eXi&|!E0lyFo!aiG(Km&hgf?unfoiuCpxvj~{mtFn=M4W!XkH;g$$*)D zygSPi_eS4u48S+g2f^xm16=M1`j1STgK5Y>W=BENVdYzNG=Wl%JRCr+M1{XTv0lmi zGX1Z@6o$P}!Vc3^*~S0+gvEf*{kTtG{S|0w7+6_eJxKZi`B8Ok94fwJ*cI}D)VCRP z5xBH{F+F|d&w>|Vbv$9s_}e#_EXN_q>$tP0=1_%62QUKWZt$Tc06IF%w5ZM@cABqN zxXeW76s^Ts?@bT6oD=m*XjvCgY3dr)H`~pfbYO(3Uvg7&b&7*Ga&ND`qw9rPP=QAVu-v z=}&d#(UaQz#6l%w^Xdo7?ctfB4ttX_z*=m~eLu9$_=sc3wBeV8*|pr+%fgz*!iFpK zp$nTi>Kb$0wU>XND2Nx*SiY)o%sb2JO6lsa`$Nu<6f@8RtpjKiF1v~1RI$!Op!Fvv z>2UI`bPVD5vwzbyfJ_3Z`onOJB>%trG7YZ>!ES|Cc-2oqVyb@Yg;^wY#Yga9D(;>{ z+Ny9~+#AV?+!DMUAh0S6kY?#c$|D#G6)e(q?rqfG+_^)l5DB)Q`CBKmU#jWVr}@g}*OY4D137T3vnvbX+2;)^iB>g+Qi9augK6YyxI^ z5ns9vexETA%lNagAui&Fn*zX=3cE8kC@0cDk>mFINJa<#C-T|!ksR>qrp+m~Ep@+f zo)p8tz&N-q6;3PyjA6wx18LP)Q@nZ|Pn>~YJpi;xu*+HWC-8^?8zdb5aSXXA235$4 zA0E9ysISAn?zJt}LP=!j*nnN9&EJ}3?|4rSCOYqs!68H<@sedueo8#1el@y{eT;o8 z2!NT)k8&{8?zt%dar=P}?kQ!=nQGS5$d|2t#?NN8Z?!p_M|`8vdDWKOI7cIwI`HTF zT^hhZcDcS6cI(orloF3+SCVjuIrP!FGdRs%qLiM7{eBSQ~;_WQh{uHJ&?RmBNgK!Kk{_v%gMt0ygSz*V|4wT06M2O z^z%3WKZe6LZ-n^a}Iko#?U4#F9e)v%k^bFN`1>^^T!TT8#|(X4}~PyVdg36#xM&FI%JA zjvB{d9`~$mHeDOI8Nrc$6U4Zt&4AztYY%Gp`qVcW2fqJy)_-t06 z%r<#wsp-f%fja)fa%XTB5bWzNF#&q85iiBDbLG+=0}PQ0sw5gd!+W446?OH4!#oU8 zH=TT;exR=%EX3U8oBiGnh=HUBRGe~g`{wE#g295H$piBoGgECmWjEw|fJervr1bJUt(bm~UB{nrXSCFntL!PfWAF>RFa7@<@GjvC_`dka@e=RjChQ3eCeB@Pl;i0-$;YH zSPmnqK=C<^G0B%Tuo1C04^?|v=^6&z=g_&PInde1;d8o-!1lj9_SPKvK`F+u5slku zqVpBQUGM~f+Tz4q+1MQ3LGMoY2iv@~&+yY&?H!GOV>2^dAI4K6$aeliq=W$`cdBxJ zz0N}pDzk*FkHJi^B-Al8>*qv2E;%-froG&z*;lL4$682V{gH|435;Thqht@z4wCy+ z2ejghN4bZXJ~OG6hg<_^N{w^Vz?b|BqJx_({whZm2J(#>gsm6`-<#a8OuB})=W^v5 z=oXQaYB6ust2zhW7ZaZe*uQkUIE0h(JLjV;DJA9a5!%Jy(;q;RT_8fb$3lbMTY3-) z&k%@t8O7LfDG&hjraGtg<=6z01{wV-qnr4QYO-Ypy$t1sN^yhu)E8LEaQ|f2#3siB z=x&~XSde2Kwx?hP07V}n?`RrLL&Gb8p7CM*)>uLKtvNZS^0Li%;irrNe8fqx)qbDC zxziqPdxSEoDrpI9pLq2REjU+5bx^d<7CGrZu*Y|v88O6i%cbAa20WyxEi1ui2# zLVdrZVYI&F=Jl_76lQ_QTNzfI-L7Z4e#^Wt2S`qsQ;_|MPC(nMTdQf3YQ}?{N3qpH z^E8T|o?FGd6xZE(n5v4Sv(*1S#wbBR_a{Ui(||F4bj=@&vX*%*o|xC$rEGOo+H})|I|zmu zROVwJ{uxLWioN($Yb$SrTA&C6x54kx2aM0xon#&naru}56oNE4P!QB%k$y%dSzH9fk4DuWV&91DE>}zV*fSx*s#z+Yv@k&n zHEKR5I9hs7>LFze`a1#udvOX31?Lwd+vmvSYS|R%;jM_7ilqMfc+eZgYQjXQHp{AxU_y0!0O8be~t8{8Bnuza|o&9F9Jya7c?DO*PqUS z0C5Apia`)?(v=xpM<@Wd(id3rQ7>DG>5#aeFCsfZTD4-Nzs`Tcd!b=5nj6Vh_r#`q zzYR^{_kOfG@L7lq{MSLplt9^^kQf>bKUrBT8I6PN{Y8j_q9c%AIc}qIJFuR?P=JVD zz7Vl%AzoF)-?h_UkK70eAYzxebcN5W!T>@?0WfGjyY|Mh%d_GV<@h{)T51{z#eZ}0 zaFMFD-suRk=8d6x?gsZzbrXE+x(M{DV7bZ#bm0rPPG$guR9ZOi zekJ|;p-t~oA~w(|;L8GD4-CyG_03bL_P?pvj%MtQ$lyP#tzv(r1M>Sau;XKBC%+z( z>;2=cVeS`LEW|t4;Qwb20|a3nFam{}wO_14kRLR16q|DmbtCagQ1$1;U`^%_d*xfC zY}B%(F<=3Y+6DN0w-Zcv^OOo;*9Xq!e((=!X(I0s+!cWIXC6+LzK0}DGX2!SC!DH; z0DeXkbxbHhqcQn}NV5~UE&Or87d)K?xG8G z+b(B7zLLSCQw*^NAwOPZ;hy=ua%8x;$CcBRSMRz)MKTJv)^T**gv= zh`7#3li>Gn5mWK+e2~4%$Ipxd=|yUFJwF$rL32$jS~|NJCa85iLRjgG;ALZ7Z2X5L zxliB~em9eD+l?c44q2qh$3&z}!3r+BZS96{V|wl%fHqxT1=XhQo0fc@28Vq>O>-rn9!QKlZeCXYMKBeXmLPS+;r1d>hHrRN*a0a6(C0fLcS(o1RT zG=cYJYe||~n5+Mby|;|Ys_WW@0~p$nI=a2B)*l@Q6NThh-GZk6gJ<8G6Eo4lZ`b z1%4IabBo{CN=leaRD=Zkr13AOk^ky%BYQ~RbNxXA+aZEqi98pnxzH!Yt@Pz$H z+L0em6}Ntcvx>db-}WsOF@!T3OJ+%zPsFo}yKCckYW*eoz^WSr;4#vly{aAph45D9 z3T8s0a=}rggOu++`DD?2DwQ(*bbl`vB*gR7^^xh&6FgULw10#eAikbQ$foMfk*{TZ z*OC)Xm-c5q@2d#iO!8|5rpVBlMikNyLC&N+r8LSPnX4I{*}x@3OE#WlXe&;R4s_lB zK#CLzjl0Uq6Rp*$$l-VT`Gu5(YKzf|O^+c^ z;sm(aQcYz%E+?^I6G07Ae0jVI3N>fT0FqJTt1)<4rMW6~Oh7D7Osz^EayM5M5zlNY zz)@xX;{IC3eY^uUmRFdxMK}L4YPEDc@mcm?`(JMcV4eDk@j~3!%vd`TTPkA|jV{Lp z?AE#|;wXd~)IN~gKNiL9E$t|FJ=@D3P>L)7JY|a8S83@$F43V6*ub3=8XpS;Iu;&9tO9i8x zdx?jg(x7IO(Kx5;S>js1=6eE6Pj^{j zKOy6$D%xQx~Ed(6-avwd-qKuq5An+H4MU9wu`-~2-MyMyxfYn z`il8jNs*c-NJ*tuskew2DrlrxE1S*%EM_2wiR7WcA3CKq&3!cTrRYe*|S{5=>-cA7zt}H1DyOvt>)b-iPSWT z68TkGwZ1zE5{)`a1&IfvfIvnMug|NL;N=o18&x5Y0m>@~?Ey}I{s9SX5%aYI=aD0{ zp7q{@1P}p{)X=E*tuGX=u-g=k!}ngLR;?1_qpc4Q7dE@oex{P(#2WSwALB1)T#+~x zFfms4D#Z7ATpr19h8S+IF^yzf=Z52bXn60;?t0b`yCIl4>$o>m5GS|tbO|Ks$~{n& z$$%3&s3)9n{L8l1bro3f-}%j~OzZu4ZO`aTr}t~yPg z62q9RT`ohoXjT3YXuRA*I)Q;D1n??UM_XWcIqZK4yH7W6`|y_0vLE6m2g+hC2f%UX zEt#I>zP>-1mfN&c)C60|F*_-^%>RA@`IqU6^>l|k5NS#RBF*OPNr_r34D2E}I#Wb3 z;Wr<0)x3_@x&>ydiqe5Y_Z)-pfi!d=rJ46Y4#8ZhCdW&G8bZa0{zl1@-NA?$kSdCa z*>5ptHM!S`?M{PI^1_&`pr|~W?R;B><04<&dGR};9JOiLGI3B-IRiZl#6X0hb^y|6 z^H-)vZXyb{R06k{$!web_@|(RT&ZGEB z+t?&(##(zD=K_jY)kN6%;v8hk82Og(iZJ5gpgxD7;XpE4#QexeHI;7`%1V9k?TPOaz907k$9PTEi@z^uun^F5k0%XKB3@`5kPo{8877@`%s|N3j7tc$F z6QYb@R+>gb#LAV$w&GMr1r17<8BU#6y-tq>4F{cc>#EF+!##RI5;h>faNtS{}H#mW#(_D?)C*29;AuZ5HSI=H$ z?gzN9bYQ|7rya~xZlA_t!sD{rDRC=$YnZ{<{d(W$?DbiWT@mCQeLP+RjLybC{%)fTyXLb^P)nUX58yR^Run>`vCHuH9XfFIXC0lz7$X zJEGiac(}{6xtaTqU!oP-zhZ`TC$md32~1itDrGw-U~_}mqT zi_RqfUkE*TU*8H9x7p#I2Mz} zt7K zv6x^vo6+};buYbpRy}S=r=!Ry``)S7Sjh-Ba|oX8&C*(Dif($*pZ&64&wK5)waJiu zN{txYoWdZ5k$Y=Kt5%cRPq{zSDAXn7$)Q?RQpm4x$*WO9g!QpAiOW^;&4<^fH1l|2 z&59a$MDEvTVE}wBR-9e8&3Cm7{#~Zu^V;hO?{d2so!!Fc>h#0Hz>h2d=p#6*UW^gx z$7T`r|J8AFSB+krPXM;DquwezqX9RQx$3>UwwogVK5ryH#eYudP-hrb{gS0K)y|e0 zHtT>sZ(xJts^?jdH|V?3fH!8@>S*SO`m|kPX$ars zJENR(cLr=3dk&YoU@($XN$XXOr**cmsl*p5HhC_O@^jCqUAHE3skg^$<8yZ14t5eu z#v@OA+^k0dQQav8NxYEpbhLb%DxBflCeG&`vip7ku1sT2sFMlI7SW%cfvTSau#mT4 z-;4Ft%H*)hMaJKT@hUI#+a@T$s&f|#Wudv276xZ6tT2=lDI^;oC zLv0|=^!hQ_wZBNn-lzoWej~BW!jYwPGGu#xylaG(xxc?G$UQzfG zYB37FPI53_UV(fBpRv=U`_(mql(qRNWNZw2D9~*bBMmwdD80r|cQU~evq5%$%nS6II%aw5L)WrR)`9R~S3%Bqs5 z&F`tdcd(vk%>2qyE+^B0u5*qQ$m~zJk9g9<__l5RLv&QtO|^W2Y$sO@zaK(g=>h7c z9Q6&C(?N-3v7SGwNwY?_#3~GV&VP-f_271RHT~*D-PtT&;4lWWaNVeaU zSsSI4WQWOrL`AitwR7mu<}h8r`Af8TAy`q5X3GMv)?zImY`?H3B)Kz8X(wRU7^lmH zta_>o9kk2f_d=OlK{orXNHiHr?bi@Ky6xAAev4omIDS_=p7dnw0Qq|@ z($rhw^T-rw)PX0m8l8my{x~awpT=`fv~#zW1|!+X$jGLZMn+jDzn8QBVk>H!W-z%< z?C((-WfB!u%d$(9|8P}Lh{E2RHm?_~@oy%dBvb}oi#9c~?wdeB1|$4mV)gGY`#^~D z>Qz3IVJQ>Jz@{5HuS!$7j_`k5AOE>l{`cPn9$gRodbiF470-H>f~EUUYyH3d&dUq^ zI`tXcE8?*KZsGr5@A13`H=O?8H~jCz_5aBz?LcN;e;?PpBX4{8FJV)J+yx9xF= zZbtbdIdBlDs&YQhA0)z_(BK+*&_274!Owpif;v>I4cIA|ip_XJ?!zS27CO843q;kyM0C>r6v z2j6oadTQWm;49(p@A5~0jt#ld_M!jrRWe|p9B&^{rv|lUytP5WC51U&3uU_BMT5@z zw>3~UgO_GL`kREntO?Gn@;h&#zeg_c(d=|f&0CD$E5ZhfmMRAOzBk(+E8$f^_Ol2d zWjog2h%~D|oGoHyFiO5^mzyf4h=hG%jqPuj$rAx8flh(Ma=^?a!Sf}bs>$lqfJ#^z z&!5k0$XgsHxG=AN_eu{3V%AGPP_HBTyH~;lQ_!5JkG}zPUXWShUu9WqcUh*^5KFL5 zqZSEm52CAINq%MR(oQ++y8IdM&?Pvd=LJ{Z24>=R6?(D(31u1)%Jlifz7<=N^pss@ zh75D22A_UEe#9Si(GD`$_51D6L0}A1)AacN>rodo$R!9yGJxV)UK6E>qMwL>D7@Td0S?!~SPVzGy)tj}+mI z&=F>n%e$Ej)!&vT*^{=J{`uI742)$QZ1HaqrpJS-(#P6QdfWA2d*Zvk-;TA5a1gnW#E=tX+as|B&sXvlA00fNv_~&nd;_V~`tzB+pSd0C;wE``9 z_$a2Qk17k3Z6s|p@>5S9yoJB610apcJYH{E|IG3QpXY7?e#y(ozwRX<0p0~d_hg&+ zAG-_4I$PclOJ0*0S*m@(3To^3 zwY1HR?Sr-NBY)cGsR)sL^{8bpvav7_H393*HVKg7@+I6qy?q2U{00}aw9)663Iw(0jwBEZ|$=XiypBlvrz2lH=cNPMwczCnVb4Skcl@A*kL0PfnW zq=p2=0Q~*%s_9-sYhi*mIH$b*9f*qDFlk-{?sc$m<&gj}B3gjhpSksVUK4920;r6M zE{|72ai+^^&_~LWo&{3t{_ZkRL=b+4H!;xF`9{jlF8EDXM}P7ou%v#y-+_4XhkMd4 zKh;ar4G48}?|T6s>X`!V_VD^k_^4LU8SuHhJ7!X(s?qHiGexvMYk^}>mJ>|FZ~NLp z?9~^ilgY29&1Sa~>0U;9XIs(&ld{d)tcM{P*G7=+AeKn>y)^w$|rK1z^4S_ za2L!)yxMG4a1n|FI-$Jp(GCg+blowBc~CKuq1$}HYu5=<$LBdjYV4G43Zy#r+m;kfeU2c4stI#qMs^@#!%FK*t+a&hhJ6F3dmwM|GdK!`i4C9mGXG>7W25l zXCd-7hY649z`tJ<3=NJ%&CrI*lI*{?*#gg+j#P`Oh}Rl)XEbI&CyW;wtt9W^MF%0? z0^miY;6#!BIj2z4$@!GgtE1j+TC- zBof$~rS~nRlD4QrPx3oFEWngkG?yRm$+Tx zgWAXn`%t%t&)@96x_SKJmJYJGQ=27aa5`VWq=Gg(HVJKow3ToyvG&pyfToW-j&EGjfhW z#61hg;dXmp?tDIvys{*OC(l1~2@W=8aV=JI92;zAOLafr+@3%64+)XNI7<)dnojv_ zxadB3dvtfLyAqCFkrl)7@unuw=~BLSHF|dS>Rvu3+vPM`pOEN))9R-u8g19P-!VW! zh*n#0WxV@5U~@2(_Ces{?1#)q>GHg6fm7mG?ksOgdr0tuz_*2anuyIaW#3hlf9jp9 zJ_xX~|AOvEDdOx*oQ zkFxDUm>F`|<=DLQu0Lo@{wSFJxyg(CbBET(1G=;ok7{Z+!L+%nA~#*I+0-MeK7#l9 zU6HY~ZmYvY)XQQp&u#I%C^O2FF7x)B+sMrxcbAIQiZ792XQ?$Rl<-_?@?%R+;+ahC z6C4G0+Y@BhjdyM@mZdi6L5NulqTS&@k!kt)P~_(usDLXZ$6G8_r)wUhiova1JmdMS z#v-91DMveXe0Q~L-9vv`cL%9KEAh$M+GW=7OjK)Kb&ejggWK8`$m<6PRknqrK1ogW zCrbGB>HN*1q*^lTelG5?$6WUeMgypghfL0Ds@=Rla&+zqp z=Wd8ObQOX3CKfPGbQ6+J^#a;QEopX#9rBSXbs;WmaG%iT?TMUhu?8-i?OGs`D`0~t z4tdFS#Z{Yc&!G$oT$h!^{^($!)odb}E;o$O^iU@%Zn&yzn5y|Htadp=~ZG~L*IJ!>w# z3X;4F#te4uPGBiU#G;peg0!*y^83do%f*jL3mpN;h1NUs^@``XS7)z`LSF5h^;e{4 zE&5cUrzEo3Or>n@kqq61nyM&JO%2qA|6+P*%Y|S|rG_K!;8pZj>M=m8Y42)(pml)R zxL_wo?VROETf4tdf7-rRf6q6+c3Gy>tBS=L)Cdrz>Ak)kLw6-Q^(#T_`w_fXCfuX*lR6|X0AWahKkD5M7IHm_{#a6Yqsf=$Tkw}_Zt zbf*P17DrLN!npqC0>DpP94?a|DumQcYzAM#ow02%YoY18VEOU7j5%%y@k2c=`?~!m z60@)Qo#aUUc{yL#+F#-l1H`4~(Gn?q2CCOoWX5d6W#Q36eR?HIl||#Hx(Gk`l|s=_ zz#=R;UF9xRwxXSE+%viOL(}7yI&=9~#%dDCtYnJgFr6?{t}zNj3PEo>B$w(*qTUzA zXr7egT1|FkHtn0q`)rJ8u|zyB}KPr9Inc%0Gx1-NA7! z370E(8cZAhM@EG_g7O=Jt}c2gA~1TqVljCQm|Rfda$%9M^Nugu5C)BR z7XhhTcX(#ANR^p#ra-{#YP5mGDT833lfYSC_vWMqE+GI^L=SS`^MAZ|ujR}~J{O)j(3-8?}rlu$W@~yVQ?!|y&XWJLRs7)9YXse`Y z+}4?l{KWJ3_b<&3ir{unmcuTuTutDXtKfNa2H;hct?uf#o1^QO`4F{P_v{}H4=$z` z9GPeL0(r8VC>k%vY@I!&I_;v3DZ>26yDSU{li3t+mBl>S;@~BpLZMn_!HX9WG$EW+ z`n}PI!blN?doy?$KJbyz)T$e2m`lkrr>wrMmQ9E8CfQ}1b_vYJ1tCg_zUaHwdDM#y zmpt>ZKhmJ1S*~Mg#lvro2Tj;Y?o;PJy4o^*VWU{?bkBnsmPlX{QF!90FOa}!HH3oe z(EcfCWZ6IaL$hAwO&XPZ>NA0Oqj#7T&oWXxG*V}m*zHYv=N%ox0o=A{Qm%Q}9G|QS zlS+w1C>SqH5|_iMs+&HQQ@pwB6i=adKyg!-5Q{7w&vi$pJBl*q=6Jt3`j+qnzDdwS z*cd&PXRK7tHTOg5H_4e-2*+;!3SpwWgpw;xm$1PZ1SswHvfY-5kC&^8aaa9}-H8K)bAjfIrVFyNje?^W0s?kx5>OTPPk!6sj(gO7D4k+ULd_ z_J(nNp0l4!8d=%8=$KbkPV1Bb80CpUl?J0GB=1XszFO@YFK52|OBRM`t3F$Cvx1^7 zSFTgv4|yNDHL_#g$jhqaybZ}6wMO2BdVw8%cb1SWWjayePxF{wo5`TPQN7-wH^g@R z4Faskmcyg{)6Q2GE!6e8?q))*5pblT(Wmome$38-)fVddQ$wwJl5E5w4z6mw%m>Xl z`CBmg&UOs(5`Ep0Rzx z7DY;3M~^gvvWW%(GvVtq^USNDDuLtVH5}=4YPAw+iX`(FRCr#9oqd-HDTv$8A9n4+ z>JSRlq4)y*!DMyOD5_l8K=Mdu9r1AfpI;?K3w(z5#&Sn(1{;w#x)sHLeH%R;?$TYI zHP+k~MNrAHq8ohWL9{@!f2LGWBO(1Ifjl^6XwVjs^=OxcIt74BBrc^S$cRI#=SIXo zA>z_(jM?uVm2kJ=C(*f;#LyI_xE6)z9`#g=EnZy_lD=d@pGsH9ABLzPCZ6vv7V~^T z;Cl;Q0pMlh#`9L~_t21;kGHTrn3`^+;4pX+y9R~1`F?@JThzHJkL2wVm)!a;g+x0RoyfFn+3L$Y#3}Db zNbVu~O)2T*1i+R!&Ldsm)eEwc=*V(no4+|?&2%-677y;F54}X9y|@m z5WgzAB}AOsYux9X$EV+A#dzn=;`%9B@9=vYXToj)VJk84;$NfHR9>n}PG37On7Qv3 zH_H*_S}n0B3#e+1I{?~h*$@T^W@&tmy7d%SnQEq&$7#3mH`D7bh~o{H=Ik%YHXUB4 zQId5gf2_;a$niNtDRSJ;h7KsPQkS5aqAf;m}w8Jg;|^S>a@t zaISaAkh8dVu74d{ti#{WmI+J-Y-k3|<#a*5_*jpsJCgQ9aHUM>K7H+NCTnYwlaM8O zE6OuCuSm+Y5BvF&rSI87(bkrB`)6S?dBt|~xtea9yMFa#nJ!|U)!wLah>DrAk7*x8 z-9)c}S{8mr6I~NKKuX!k*hZ`+Z@UrtN|tDRslaBjAd$ucn}&1!j>X>78=Mgxce5`? z!jSH3>b3g``@rPztG%mx^mntcwGr(YMY($wrv4$!P@5dd`iANw^Fy!9Ao8E6n+~a zSTCxDko4`L(nb}g%j|T_!G|p>!7q3-g?!>AY{s185G4Yi+e7vo0cvE9KU;2v)kH|x%6C8-7( za#iA%=s=&3$w~Fle6DI=F`hnJy{cG`klOJ3QQ|8jt;}L$ClML_V(u$?{s~_38eYL0 zEgS?zO=D?R_P|>@8DtjQPDbjTgGi~anxgfl;6~hKDH<$P&T!rhRN$-c#M_P< zKGQ=&=J%6S#QgQ{5Ncv_sLQYZv`SSCU%$C&cS2R~IP0{BUeYmT9bQ6@>XE?x)u>db zNgCB!^-rzSmY&tY6wN^i9UN#=?y0H*(WrZ4Lh@f1^!IDA>(PqTPy=%MpWaO`smxEy z;`d|rap_8;ET`C;-iI~csb%@~DQ#>T_chrGA^*2r1>ahJk)NgcF`=<)t_>gFH<)jealzUR&L`P7==adST*LS| zQ)OPb6|i$P=SHp4pw!D6%?|B zdUD4tgOT#@e=@&D3sJ&)HcDP%>+wF0%GXCkOUmMQ++W-1`a`aZ5B;U7uGf0ojTbqr z9IVwK=P~fSKS($dSqGhm$$sv^x&gKAvm^4p^>L>!e?CX}T!#HDvs1z%Of;&vn#XZj z-V4&k=UU}UFQSXXs2_kHB9~Q@%%X7x*RNdAllD7wDoi9T8n^RVwQ@vZv8%Il!vV&g zj!`uvA0EkW;4Qq{AlJE=K9m0=kD35X^NH6de!Vf-Rj^rs9FAM5x>Wbe$ZsQ_RxetN zURaAiH3)ng=h@n}XhM&*i(CZqEzqQ!2s}U4Z)U~UB^m|f%jcVT=n?1(=uzR&n`6wd z7~RJ=bzSAF^uSGKh!D@y=H~YuwQF-caYPDeqZ_v1E=dg|6~n0XKIPCKY4&QQ7Mg>u zOzrN8JHw_l8x95zA{zU~n^UC5QaaOo0(Fx$~Xu9Qw;Oe zkcrY!E*I;so5jxYLi;%{V(F?M*&dkB%w=lgR+)Gk>(wxut8Aw)$KI$WC zP^HxyrXkB433hHkz5c{H1oc;IEvS~2-GSNXtwoCf$J^iYeCosJ0DqA;!PSP^gHMbG zuvrWTLh2yx_8=3-j@;xztaxKKiG7x=Ktc(}QZ}Bw`Mybfp9^|v)x3XyXhzJy8^`t0 z-gLd9&~$y5gKx_uYiyKvyI%1yqn{OK6rlq4H(hu~t$Qeng0pcy_$SMvua5_u1~~Qu zKV%i>_0%4(uXxiVgT$Cb_;3@U*tS+*C0<2;XvSv9mGHuHSZA90Copt9q9qbo zwo`}m=1)7)%wa8sV9{bs@GY(a21BwU?)?3ioxt5T#+ zJ@O*;MH5_JRQgr=HGoTviw%zO=h<#~KXvO$skPG1MNfY5wqNpo;78TL^j5P{a@c%N z{19An|4 zmxxZZba)3i`!SWG5Flp6Zt=`^8~Z@R`DaB9+Fj_`%zL2Rp|+qFB=%Jzx}x5o?f8Pj7#)=_a!E5|XPhhRW~a{WZU6^3?WC0EqgmPI)ad|SGD zg$>;;GE|}RGm|O^owuyVk-UO(uIIrE1?oKo?AG;xq){KNV>2n^H93RspLFn$QNB*1 zCpSX|l@{}&2xa>qzS-!48$tb&K)X$MSf0TY?p02`T{qdw&KCIV)}Oe}wpk&Nh)$Fq zomI-d_ss`wwl1ZyF<(Sa-6^sllNzpCIGnrw{UKVYOg4zz=SPv`>)u_Yk4r zR1AS^rveOTm3=N#yr=orN{={nzEk$>+=w<>p)SMJ0Mx#yS(Z}oB}>Go?dK|HfDXBW z(r<3MEYlQ)i-w_XyC{UaC?%k*1!way@|+=?CaaqHq(bpWV)uJL%;YH3fEN?0$xHLt zT~||~Ki`JKXXv{trnxy^p3Pz%4YjMoVEhP_r!pGsqS!V{ULTHVCZ%%QpQ}xGyV``F z2UBzBy8BfvI1RAY6w{XO??m+~R_J3;9ewVgmGc10R0}7dnn3AvkR9v>hXTnS-4Prj zXep;(h>epYc(+hXf@W^qo>Y)74NV`dd`k}x7s7$FZN55U;JW0n9?|n+Mo`E(mBz2B zm(TQsm)kjHcHHC4&gd`i8{W)HK#&?#DbvfvL!6W|2rgxJ-WcLzhk-L*N-cFc?tga5 z)<^KpXnU(j-uoBUX!G!6)4BExdNQ}AGEFWW?^|^JUR<=o-l!@IP;Bn>_GJeoYWKu4 zduyBm-FQFw$nGKo9!Vu$Y#d_}_< z(~IRf)ma}aqktg59yD#1e%SR~r7>&%9fxANpuPL-q8lM9Ssr8s71p(X!nceh@z%t%Pn1!8) zO5bNRl4of{MD^aSC6kCnj$~LtsJSW6HCW;x9D&g@|7ahKUGg+&YB!#PXp;I1G>e^;|O{+;Pe zjH*asOKU`Xi)Hb3;Ve(ZC8gux=3htNSV1jcPwO-IyW31MK?H|{ZdXZkR#|Fys#`9b zb8lI%V@Q40_TVQUR(1hHAYhW9^E%q&NH6&2dWy`b`I?dpXO2zE_?tuSZZlzk{nxBWc7p_aRS6r|bfe0;_)?SZpaP4|((AX0t#$;_goMAs?yE_`DBS=)SU z|M!rPkV$i|dYdwC=18Z$*U$x94S@=aN!;#&mYN$DZXpjI%1LAcWgn%U;_>mG9x|AF zz=2S7-s*5}HbK0XGZX?XD@ma29-{%7iNqwemz}D!Phf1Q^_Rq%X(%_8IIowBVQ1@g z$^~o_Lc3ntvk3=Sl{2sM+m>LdRg4C7+7B(WB$x0iu=dC4AD~GX(BVvFCZ5PKcs@@9 zs8n1uWyo4BYD%-1(;l0TX<`gcs<1~tcOssLFG-R(S8PE9=aDria4b-TVuwzfevf8J zX+511pl=8skQAs`+Ga~aGFXi0a3$Q5FgfD%^6*OI0P!G;Uf=ayImGFEdjbgxotNGz zE=X6Rr8Q>N>y(508u?C>d2CR2s@!D18VOML)7N~GskQacujYA{^ zr&L`OdCSe9<~f+R)WjD`zO%EEjUaq3$yFuJRs&{$bHcH86-U^lKnRl7$x5On0ftuy zs*s6l;crN;2ONp19z&?-M2ZbP)gRnM4Kc_f;dpcM*N*)jUMYw&6cq;J?pO~I2-y&s zmiz;}Y4^Ny4nTS?q*^MQ0?v5gJAVVT{!f0w`96ZF@RHWW`2%zM$35hbIC_1Xx;2>qIDKcDcQet-W4>ZuX&X@B|LA8g$}y73?XV=M{!_J3dSKPK)U zI!ooS&djyp)>u~j*Jgy zN?4&jbxv&Cd*rk?$L4%mS*?HPEg)N9B(r(?0oiz}Bw61{iiJi)JQOKu&+)0vasTOR zEq7zZBA|fOyZADxKVNq$n<=V~#d#nA$fIiHoHQO(&yxdEa6BiIh7TIX3L1tPY{_)e z^B&54qY-WG%O9v8=)r$o1dmay&$w0sX{-XdX$n*D}r|Qs+J9boW&Qm3XF5DRZ)2Q)wlF(Uq zJ4(ivD`a|xVrUo69Rj+5>wS+%4X%1qFSFk0YB8THd;LztZB_;2*888W?__JN2tjzx z`$LYjh6muD%1ggFyS8!1$F3WS?|8nnB=wi~kqlQdaQy!BIT(XB|3};PRxSx?>KIRr z-d*3)IsQjWLMW_tWNGU*FkbvhQTfw+qhUysVw0P)Yb@ZU`Vn0?yEA#0h{I~d3m|tH z=M1zx#Okg;F5pwT0cnXn>TK0+=qrmF4ILew6Qo)*av^3W&vWZV83nC z{F8&SQ8QV^BC_qjaDo3&RT30$Xa}5yecK{3np??E$5%VdoQy`G+9{cGnO^B)2uR8U z97|Q231~a`*NYyi{h5GpPY__3w3|CcydW?cBFhPx9~;@jttj{egIzR(ae;r4%H^;P8JYf6&qyFPkP(3vQk{Nr7q`35lG}qTE*(a>iphUc4NWaE{H% zSA~f@9vW7@40p*Rt6X6Ge~`7X)0Qprh)F@h9%hWBarcCplF4W^h9^bxKUg_q{+~cu zuh?Q})SF!Fnu3FZhVM#Ct8yWe+l<|MPh5VqKU3{qSzP<^>lr2ITAg(!ws%SL+(Fvo zm0HXv!i`U=g&%l8H5b=cu1w^)1WFqw%k*uhYm6f*_MK9Y9xv_Z7bA|ZKNL}YyB`vc zd4&`{sezwcX=?q6<7VlS-+8zmn9?b>{287788&Q^+GtF5Eg zzo#4hv^LU8nR%c6HPah%mh@$AcK1KXSWjp~FZ69k5x;OhQf9e8dP+=EnXShFgpTs- zZ+JcAA;ZDZAvVJY8#5sPQM9a|M{oMk^l>#iaM@B~4-jB$aMTi;Zlz>KK#8D9x-SK$p?t5Ya7=fnNpAyz)Q+-io;27|LuhL~rUO zWHqKgzakamJ0a z&k_<(uI?h4h(bYxDS86Sf4Q9*2v7{#jw-v#CeS&?NzXYajkZJ^j0$IPrptvgN+vY< z%v72wxkI4o*`X$!(@vi#ulr40Ygx1f0INIX0yxL`x7~eJE%;@5T`vx_vEJ(Vavpw1 z1IfaZ-2j85cXx9c4oE{mn)6rA%aw>L&N+=Iz3={r^ri#>H@Akv&J-bFor`&>Y6on{ zD2LdeY)Y^ew#Y*a+V#8_(kP6e+FA#bXJ8r40p4y72fR`9&5@Y#NQOT^Vh_eo18)8bWnDPK zCBP0z1*jZH)^Glmj0i{L#csa^$Nf-1$_mZEJMzet7-SVc*h4tg0_sXGI;! zl_+Ct-4VS+B#l6$h~j`RBmD82iUa;V2GoRO*lClp3Tg=viY#OXtX~Lc$%QiMpVWB+ zxDLPywsXnity2FvCW66)ZhJ$EXgaAEWbkuXUV;6N8fnXI%B38TnghW{<}@?Y8yiL; z*fnOhjbSV9s9z8vJF4$HT@5H66MKr(OEc->DEXU}1}aed4!ju4@+Dag=XH9nm4vCW zACU>RU?pTNR|E0S_Ct9|P~j+`0Or{iCZgU47C9Qsx2bI>C<0${CMGT(nUnLHx&_dr z*9`9Wh!SkaJ`#uLyl6!gqD=-VK&&WEIo2@7a@mPK$Wnj77TBOh*Wz`LP>A5+;mdwa zu*}VWdvKPZpXbnDL3PV!^Fv3)3XnoA!fBbgtZZ1b0kpB@^9J7;+h3tOY#)WAEj9Ds zeXKW0<8E6VSC6}ikC@C96A6eNOc^A@q|rmWhzpU^;-STXsRYZLoI-igAp^_M}$yHBBg5?&}Dop9sBv5I>AFd5W9tvoo5_YC2GF)p({NH zIBL(L$2~QmM?JihSnZ1&HC2N1Bj=fxp7ZNyG%czX)X{zSG-{IG8NmwRoWPlx?Nrn@ z7_K_;rK}_v2^%Wu7R#`|qWJt#p7jo6OvN*@orAPB=C%@3fS^dM%51uVtmv@!htSxP z)zUX=r^_RKQdU;lI~6AQRY#|z6_NQx#8u9#2$qxMA#6fT1x z^!A_~`4nVP_jKRio%6V|{*{8kOM+5kb@=W38{7S0vPB>Dy<1qM9(^V@B~UfZGeV>E z2>){NRGzICgRXVx>lZ&lyML)ht{6dP)?T1A#!TrRqb}DfcMk}$fUT~&wt>Fu`C!GruZ~|Wvt&!lfy@u0Gvhq{Z z1F!<)ZgWUABZGV>6d<>S%aqPbewaHkl_uli+r`Zqskm{VhGIRB)Po}dGNK-mBH|o* zD6OqY?Vr1Hj|+)XP(mKVl8gtn(zq^u^jXa%$Df4E0KxC>EpDIy>F*RkEh99fPD8QB zEr&wX8Vw2&aZbWVmtFIms^@1u0I~r>*fadlXlhHxI{Y7g&I9WaJTmd-dxeBIN4>I_ zPIFGvrMlT;#hQvwPCPUU-w#luk-HO)8um$^O_ky|Qch~9DlNF)6JI*t5oKQ|CojLC zyYo zvN~G>aQchNj2*;?#GdXoX%dfSb99~=tK|xovHH_%UJHo$=$*eGplDtW&*5fXq7EKF zYMbG74mOe^E(i)a-)Gr1I=h%@gQ@*Fi1oHun4ld^D{1}asq#A8Lx!9$8n9LamJz2( z49FT`p2S|E=tJxVsOv)+na+xeZyNp|roI9ys;+HY5f#KoKoFD;=@O8V6r@v{p}V^q z1VriX?#`i0x?v=S?(XjTH}Cs=-~X*O>nvxDYYnr{K6~%`y00Mj?jb9)8YEDG8k82z z*~`CL8!Gt9HGb@p4`K3D=2I!ND(AyJ8=Mf{JZ?OkWsYE>`HUmmeb=NDJ>pbL#A2#A zf$DS}kG)#I)7PJctgC-T=qVao!mZcKz-#;!7+N=w)i81MT4_a;fvO|%xi7HVRRtEa z)O3*97?KmHkAF~@O6A68qnc>ray5+8VK?IOu#3*{58N4_*&yjP{&heQ!C5`DF|%&0 z*fo-SzChstG*g?32R4B03j}0@aYm!neb3Ai?b)4r#yn`~iS(a21JJO~-p_0m`@A_G zdVWXGkcp$uWWWM^rbSb>v*oJPfa7oZSg~!S-R9yAD}8=KI?>1b?o`iyRm&#Q#D^IY zR4yxNG}+fJAJaIVk2c?bvHYQeq=&0iK*j#X_$IEUSJhWole6%f==a#0o03=N7o1nP z+H?{m0*U7X@w3;Pm_6-&bGv}yCAOK^FCa1xwxAwL@D!`GP{EzyW%ycZb;rryeN@W{DZ zlS}bfzPfk?<&t4I$%NRmY`?4N9n!V^A^hFxLfvl3utbXjDz@9w1SUZ{NRB(FxFYqE zac@NDTKdZax%Ekup1+yhtHm`7;Yykxa!$Zv@$SPXtGHA5BbDCb^U;cc+-D7LUx}`Z zUAn?Eh1WWpee@60nvV~*S;Q*ITi_Og_uJ#ebin!{B5#v2JNh^bkT$-1Tsx=B7b$=J zVsDn4`dbe$Tj`h$JQzSp5&2lz?Kjj!&UDgOMt_3-9c0xeD|&}1OTM1EJ*EC?b-47i zQGXw(CB`)t6SEbIaVk6?JoX&b{f_B5u=C}QzHr#A{wmU_lsXZ^`Xd}Vy`4Pk?)b89 zV_uk67mwXZhCl{kNzt(yrd@C6%vXQm1W8>W2p4$5KNZX{ScZLhdyjE_n@Z8u|Br6{<;N`hUDdG?b-4phb*K^gTn)R& zt*_gCC+1YGb>-@Cs`MG*el(DU^&ji%%_wQY-~z}Vu(r%?UiIR@K(9t z-7es1Z@RFH0`U$#W0pDnY2FM0jM}{Wk-ufDC5*wo7f!2OrhGwGM)Vq`*rc#oI*nd) zzOnCG$nk2W^qn_3I{XNM#qr|y)KNcyNq2XfD9G<;QM5ym>E)t2b`v#}E;EA5Q$ZPJ z58@V8N1v@=dS2p}cD~peF})DWkZJ5)hBbxE^ra%8e*~bCzR$c%V=c;QUqDTo>U@0>o$D`9DgYV8*!rfp!s@7$X?cxJ z@4`ZL)|q!OHZoUgI?@}f2Uy-e&$&+Vv`%{zF4V1r%mDb+{Sh01oM7?~5_;VB61+r! zsAWsTKp(=XgFxh z_p3boW6QV|uzH4N9m-PAjdwhI4w($ZgPSj9Mxm# zB_4)b`PSjP72)|l+Zc9T@EoG%x%e*o-iK&S+T&Ma z+SW?#KhM^16cp<}A{e=*v$&G*NXGRq}rjAk03+NO~G9hVYnkW|TgHM(BrWzJ>TRJD8@4V-Q?Kn z7IvOs#F5Y^JDhOGt&5$NNain3O<)G6Y(2M;e28zoUKB_BZ0W{*IbUTpzm}Ff-Hn#+ zYAUS~wQShK%2$|SrP`(<_$&?7H}t$i@$`(0j3Y(Hy2fLx4p$coEC~O6pxFSQ+p4Rh zR|%T{YQXradLz@Q>daYn^G^p;IhJtMqxzjJ`K#NIX zUEV&`Muubqojk=Q}9(AvkxTOy;2->uu~D=H4>r>RtXUmtN7|qSHp}J;9P3aGEnh*Q%}_1X zA1x0WRInjG8LYsDj?tP)12F-g8O3Glu2)m7Sk%%`Wc{RKcKLTAX7S*^*Jk z1xc`G{}+tDa5UMC@BBLz+akgU;euZFDSPgfLxDvL+~T`lo{fdSOC;$M0OI*DrA9Te)JJj*b|dU9;dez8{QyoGx%ZQ>sm0udpLE-I0aPG-LU5s@L=3 zj^a`346uNmh_k&Jr8_Cs{0IMlYmk7_&g6OT_JPADORq0Vl;?8snM$oyI@DtB%YaB3 z`(s70DDlK~2&b}Z$T8~I+O`L@e-bR|}~|(Wdr!oIJClC^aM)iV{B^F~=XD)m+cdCC?P@eIbDQpKR!DmMO`%TxjM} zD!YAInPG@NOGVs*ZF%InvMs1-rtFON_l9DBTmVZ^ zNKh*^52@vBTR+@Co0iZE?Is+**{|c-^p2mXSTDiXad-qgW@(N0)8b&q0{&myzNT$gCsSBz?o9j7sPZM=;=c4| zz$-GmEf}C^mpGaXogc+w^tjT`zs)%>^s7RumF7v#I|y~TQ5Y|YjX=iWRSL9q*mh+x zoy`k98TY81TydBzdwPu%7^~rFUd#1xJ9^xG+@jY5izRa`Q8Rg}Y9mhg1);@_eDR8dr2C(}ycc5GBycu(0(;docOCsa%( zt2@^?20bThgSmq_rl`El_1xEG8d}B~TEjb?cjDd{&AcF8te#UBjg03 z9~VQw^um4jIKgJ`JYfut;25Xt?%(OWyW%(TVDAz|o`nc?jqd#$%5yCudA>1m!wN6e z)I0<_wR)!hDk0;aYw#eTO(=X}lRe^toeD}@Gz3K8unvp$tQ{2Hc(L|qlc-o=muw~n zfifGqGt{uP2ojce7g)!=Z{4=veTow44dW4&$0&}D=J*4|wUp+6>!!c$OI5MW{PAwD za@I70>4Ylop1@1?)R`P+5tH!{)#sPvH@*-sqE`q==J3aDQmWa#UfIK24=)c@?|x&R z{WBpfne)Ohp5w;#%4mSo<#>|OV{62^!t{cm?x^d*_}~#tXR+eNVTP1ub(>t9MpYx6 zMQN;Ns z8U1r3IpH0FfzwxzL_BKXY&eE1JSNe)Df=Z>}gW z7nS7268I`&jt9-7Q7HJx&~zGs^(RyPJhzG46`s>%K4R1$$P zcJ`=uN!-yKq|q1$FZGdQkG(bAn)un8&X$x*oU~=gk$D3Cx$_3x6xcqQxM} zUz~dSM+y{B^nK>o=pFa`L=cN~Hw# zLtTo`F6L%bR15wrXK1%;Mgu7m)sm^`*}wpTdF`@Ex`HuTke?5gCsGh`lHkLOwpbGd z^P7Q84MAT0&9d0+@aYw-_2?xno2yh$_@6J8|z>{~~<3uDD)sZL7Yw8&lYuT3xE7CMJ_06p%^GvQD5F zMn6joR0`}8D|o=3(eYiiHs?tv&yvJ6YN7}xEjl(&{4!VeP>(el87vHfu zmJ>3YbKx5(3-S9z$hGeCm&vII$@>XLWZq=rcpRHY!Nv-36+Ors-_x9u4Eai_`wn%w z7WTy6UO8(d%|kuDXaJ)v=~&v^z2J0+Bm7+Q65 z+vY@aOG>(#$6lX7%_JhjC-ESUr+A1IM!J@bt<`A-zutCaxLbngf#%TC22RJY?s{Ib zaZ^^9`#Yr2U~;_uOiQ2VYL0XEFX^jHJ!a^pSFMYutGO2DZxwStOR{^0mh~-8hTP!t zlKNj5F2CWQa_vI3qqbPqTR<#nu69rsH}DA0O@rSbf8f z2=QLB<1{%jcp!5n9Pg+>2-x4N*%r^1$9xe~9+R;=;)_{Z=>myOJ~TnV3kYLG;zLtC z(>Q2TE*#-&!2BVdnLb_mfaVGV`4fGHk=@2iKAF|T2wLOUyYZSkPOu-=Nw+`A4J&hk z(IpapyF+&buJJVYm+4f`{kd-3JYC=09v}H1JVFMmiTSCqH{QoJBC;ApAh~n|- zYgNojOJU4ZX}XF}s5LBQ57rz!#DLhT_(mI2vscvKnw6oOP-3lxax zQtHVDh$8!o^B3kpC!ZJAc)1+-qsbWE0eC5lK#k>6k5*;ZKQ(b6`7IGq*4UuYE_sNN z;}wrcp?b&P z6P)_)@-ote*Y0+BnJ?#(@P-opehw=x_7_iTb`vuE#FL6f0vzN z`gHEzMG{0EP1DEFLLXf+ml9?y$2)-_|E*2u^~wOpbw!A~Tafv^;*BhBtn@gA&<^}E zo^+ek?Bz)5f$cdD_VtzWw;xB}+OiSp5P5Q{zXF=*Pn^(w(AcmQ?o1}!;S#1UI>9qO z9QFan_+&4r5&XP(0Noja&%oX?Ik@qsuFejK!lqit5J(luoS)lvhXQog8Sa9K3 z-O}0bOe=;bvMY8wWe=_mCUbj!g^W{@t1#(HVPX2bMIy|IRy1JeFly2|CQ~DC8EmL? zQ;83gi_~HKYg}q;d|y_C_H`O1KeJRj7jU|E_Ih4Y{b4#D6_lUuUs6L@a|@j6BP@ZjDnwxGn#!G#(&;M zCCL`yTdC#8ZD3iyMgHNFmY2rq7%#lGPW{}j#^tyEHYKVOn~9}tT^ETob+PaKX>I3uM+m75ArDSRZpdqSK!A5eoAkh{ zLy-}yw$_N8pvcC>EZ^of26K$H0~;h?diUxgnT8V3E%Wp#Xl9DKnlJt6#UgPEinCxV z#?B=ce|F7lIsBmuIg!;ee8EGrWH4go1?>T!m+6r8KsaebGpi;=G@PdTGh>NOc0dfm z^i&_tKUmi9_f$Ia8~>C1BAbPsPg_fxEQo^ehB{$ zSOsrU1xUY{Q#Y=6*jw2B)kZ4hJ&NQsxnzRTKLl~gZj0V8cc0Nq&tlvo^(D%IdNVAR$?k-0d(^Y0uW++d}nx61j z?akE0f^;&Yr}XDUS^t&S9!fp=G1!aIO-;imKJHO5ldTfjb$l!?06lDX-G!o93)0o& z!Va9Po=}LovhJl2e31TPGZuR%0vu)>Fo*d6eEH^%VExG!&uEq}WrODpVzK`0!tu6g zU}9eTlrMBL5^D&Xm<|!Ru{&d}Z+FNp(TK&{O3CLWxZA4G`T+OwulKjMeq)LVvY9NJ zd0Jof_tv5`K83jFuvyH~vdvmGNj=**v{kP~;x(IF8eDSL<-yCX;k8!NdL`GVoTO2b zw5P5k9`i^~Dtr>M)R;Yd6D|Pw9YhBS_JH5P=fM^fIS&w?=f^J|VIGuKM+_Bfelb3j zy<{*J;()aR6{VLT5cqYuTRAKSVk4vLN^b#}{i2DXxU{r4R$*~+^f{rU!D0{^^DH8i z65H2(Ns+$DfT;yn)06ZAaS|iN);?PT`f)1y@um?LJLzhyGoZzz9U25oB3Z~CzwRP? zB=w4rJ}G=X$-o+gf8LfY&W(VE*>;-Dwo$;*khjnctfkKZjoT385bHaF^h`4pZN#A0 zM)7=~ZU;T+Zx&tJz*SC_cof%m_>G%eQ5D*UmBv;9;mu;vGQaMGsvZ6P#?(hIqrb+w zoDmGUZlu9DY-1Db{+ekPT>}Sa2yZL714Rw*>VuDmTy;+!$o--Oy+V2J<#AX{79C1D zI+hr10N^SPtcyAdxD!uSd-bKM=%g~THWfyPhOVUUcN@jpC#OFXLFE=c-2FV= z;g#+<8QrJJZC+lwvsoS`sB+68qCn_Se@Zp`O+&S&$PG?mVDgrj- zp#DmZj6NYKf{=(_eeNQm}elrRj#i4}r@d-wOGX!oS0;st`t6a~$n@6L} zLwqS(YRoS%Hrj9DTU`cE>|6T&b@i9oLTeFQkUo&Aop<-vwy^lycut}c{#a|eU>pvF z`;+eLe;~Vq8{2JD9oFn7u(p4%jQ50E7KxA8wjFYja*H^16fJFee3_$jR1-c*l>-+1 z#bQwrB~eSBv|Q$(Up^1Jqj^bldb3n2PjTwr7h|J+Ln!IC6}#gNt0A<4sAV%WU1F+| z^T0J0yP9)!(=hQ^Cg*n}Bs$)=&XIfluO7ziH{_cq z3WeFFxyZRO*6+#)t2XX>C7e!uimKzitlsV85LVkTZ9TX7riq?vwbg*wM%1*TJnq<| zF-`7M7hEpwOX&~x3JNB4NK0{MF2vF9Z7*Y zfXKo5DksVLFyLPv?k$;Dr^qAW2v{C%{Z4)hT$lhmZ}*2@R*lhL5|uie?36H{uxgO3 z924n#&y%|Jh$B7H2k?*)Ns^Lb=6Uc0KP!jLpmKUKdIE8YiZ2DyyQRrc@U7FJ~jI%dZL*682QXQ4XaIgmm^Vl z?!+uZ<++Uw$RbA+GjA>GMZ!8#p<89vb_!B^r0^Z>t89D-C^~tKOdtR@g9fd}cW}p_ zBs-kISwzk^v`W?jp@aI7Ou9ogtUBTGe=;mY5#8czaht3HXcwB{1igU&#F(|GJ59(xt-Xz*lxBpO zz$ukb>mvgvPkN3;dMPm-iIo67I(q(@*->*c6pMfQbTSlB(TW;wM?(?$lL6aFtC1M) z+?v+&S%jzxxvUxGg*MQFfVXXle0EOQq1pf4FF+^Z6XL&!UJ0K!f(;NP+2)6y?M%di zh_{{@%N9Cd*BS$|8NbYJ{I4j(EBMKP+ww~9*H1S?8C2&)f!FRy5>HTw_hindto2&B zm@M*W=d}iIr!)PIexE$vA!{lcUnnfEst%81Ir`_WitX0Bl{nTh2)c)pI;IReVpHQ-_4^N z0r^-2o23SoY}PMUzedn|4!!C8lELCy{N=hXMfX8=msIz>)xIgz)K^qQBrGoOy<-h? z5@Fw~p~ph46RKnCuSJDca7?uIkaFxj)`t8Q zpO@kV4wR9|VY|N^s>Rr5ffG*4txLR1nO_6xNsj05MUB(caWRJTnRpND7R7^^Q7@h#+*b z5}xR@h=ec=SksUfolTpYn`Lid8D;78w3Tke^lW9ZMr2_Z(^ z=xNK%M0{;Mwjc2naJZleTX9yk2&VaG2mLXCUfOI+g2k2l8VA4d~}YNzyUFRP*o9IRfKu{`Nwc=O(vYk(I7@EvE?)bV+K$Q=Ros5<4MD(YPuon_Enog>P9h9!;(I^a%Sv^1-ZZ3uSd}Dk@Mh4~Q&rtwR7RMl$2!mJB);0sa)zASF1o0`_lgAf6 zMy>Tp%;0>bsqScPCCZDSDiwnGkheY3!Pst6s;W&SG#`s5B{cpq?GMeynhc29D6ngO z8&hHZ2K<<>k3R-+?NmqkBq;>*pC4ZM2+9Y$Pi$0J;heGQg6#+2NrT4u{Q0Ku--4i=~$YJ+cWdWji!Pz9)|_s0a}y6{Ne8}Z`z@$t z^L3tYU_M1)aIw4l4i6SUl}SUuVdHB8FM2F=Wh>;<6}hzy{Z}@o#PJ-1bY~MZg!93S z!ryu^BAX&B6sk&q9hykkhD&u+%f61YARr`$=NZ3pXFbd7_%S5aC~ETe{-VF>kN^Cp ze}7pjpAa3*;`Ahot%l66%3y2>hsp7BCd*%fI|)~OgG@~0a4yv>rc{3x zhLc?x3`9IKud|`=vL$r>XG2wPf9qM1jl_~~0OgR9h{$U)q8c~~eg-@6@!?@wR@O(V zvnL9FyC!dMt|gV`w? zq1~MqEq}YRH#mB?n{$8F&enDIQPZ;(=Pq9(?9U1 zzwOH{{-0hWhAll}ezjNsnRGYbjVB>T-4GiR0R0s5X|M}F*`dt zVB!o--#~C(G-`-=3@z2lLNdGckK5Z@BT(;*RhcUJZ$|m+L*xP zS(Z`t>m|ikBK)Uoj^ye;dy$Kr$v;(SVVi1T@pX|^kbx&+I?>_rf^phokNBAkR&Dh6 z$2#DQ3HZN>Rt%%%1(UJR*H6Go)-0Z;0WKOsHr(;u8uLOL|EBQ&n` zQ~m9VM91#}b}}B$ztp*Rm!4jD3w*XeMpQX%2T{L3mOWJ%vvqstN%--cT&8B9xgvO_ zTUrJ{n0b|GywM#ofQ4adPw{H^l*^s<4h84Z1?lQi z*@KUqM*q0mFYst2vTc?lwU7?83XP^}|64i3g#LKr(M8 zO$Yg`(C_4eC36v6pV^4S;&JQ5@$FpRn!oXh0)R=K)iS;zy8v`(jVG|`ks~po;X0Vd z{)zs-i#(cD9AC!awjND9Wcb_?3u#A1wJa&B+v0Gtk7Q}0X(WKvVV%T9XZllNaeDxq z8b{BI?+aMlM~JO&z=&I1N<7P$~4wuKKzD|Zcd!=!eTK@#1&X^UORVE z2mE5^{|9$0(~bXD?`yenq|j&MV>_2RL)3AXvqWcr*0?M|{UtWcb5qne@EP^y zznec%*c{SFa`G9xihQ!E((a4VwgpdOER%3GVK2X_4rc4^=esI@sfh{3UP;Y!aP6bi zLrqgLgRWXLa$6Xp&Ax}4Ad72$M1$czEpnbtWPH4U2kHHP?lr;xz1M}WMO9Jq% zm5QL=bVy!a*2uIA?tR;flLhdUcXZt`9yiIT`A$bVW9fIcP}$lx{nqGCd8x!2v&@ZD z%R&v^1I-&hWz`e{9ybxf*SLZN&fI$UIg&G*<4=9IHr4`vYZ6VBS&QR%$AtPfb9NYT zi|;_Ljy+^0)|`OHqTNS_PAunDN`=D<3X||@-u=-(6F$Fh4sA+3PVM#}8Pa=3OKoH$ zCr=t~_1Svwe!L7|{qjALmCpEgnG3h=I&Cl^n;3p#1qOy~3^)vB;>p_Cy#@y)$ycS( z)QV~IO&S@Gs!6B0*-{gQ!aRLv&w4bz==U&MJ=+gTSt!`cTOcO(v(X`E2kKOcYjqW7 zmbrRhvEjq)3AW_bFi!jiqZAUf-}6;&Jg~Cu9x1i7q`I9p=|*w}4)2mH2r17^9a1e) zl%e`;J?ZJjbE1i{%)ILhbgsV-FdQNWRZV*}nyXwO+@(PZQzliZA?JbJ>27$%nP)aa zjT=tIw)(R+h67ZteP0ota-)ezK+U;1ZM!Qzx3k->kvt#96<$$v7uel?&u@;y73z*g z>88*&g$ z8#tp-=!s7JEhek~#%!BH9?(f}7;RqTzhls&?k%*^zVqsBcB^@Ur97>Rxo8l576pBNxaeXofv;VHli&(a9Y+6#bj;=j83g~jz1$tA@%M1?A6KXUL(U= zAffpTkN6qR=NbjU^<=GA~&&+RU)K1Nfm=vFlsyO_nBrnr3z z8WW4Ah6N|G`6bT3Sf4s}64}HZt5>isfMmb2--1U9g*c`5#n6$ScwBR+b?MDj*f*3x z%|$F*&T_bh;Thb1ak#9{leJRj=C%QY)3vvY-tlu$W6s_|^FJ%H_xfIKkk#(hP;M zHzxaBF1D~IEX`(Oecan{mM{ba>hEk1d{jl1VNC|(HdR66U3Mw0Dbyq+1S+Wjo=}}_ z$iD~%iU!LCsof@$%;h0T>)~l}+TA08KdX8>F(OIbYfLWgt`iPQ_f4)BtJ%&HLLyvm zux{vn-?-otF4zjyEjYco%ueTWKJLL*fqtO?ts^Xw-#cm-ruMU&u{_AL@3e``vWFdc z-Wp-QelK9?$JdVq&EcmDg#HpY4a~UXI`MZ%X%nlGeb|>TUqFG@^NUYCQT;nDR$^sq zMn9CGnJPG4TzoT$X`IMrO7gI;xGj_%kQ1)0>-Un8!8w3?_b@P3Aq6R{o5MzL|2ekD zZ<}Qbxh+^alF9h--v{1m{nH($jJL!}=V8dq%6#;~hCa->FAM zWgkIeWqNBt-SJO|e5p$bxYg=grdCdALm7Zmtw4PC`OW{f#^qOW0X={`9c$Vjt z`KiH4wI z1y(bTdOF{}(Qn6!S#`p65I{FDO{jgt8Z6jPQmoWIjYY*VGkCP+M>DEC1Zm7;?Ne>AZH}O#cTC<<@lh`g6C|@qowLDW={&C5BjqmUVHl_s6n+e{<<+25Ye@ z5-Ptx_;zsjAD-Ou!c+xb^v1?JHCX*cJ@$MyibiFkJNcIz>`wcs{6)^nC$pZ|2B8F6 zO|}nQx?mC6xNm?parexc#_sPim%MpAUn(L;ol_uT)>!^o^;Bg3*w{<2&1iYi8);*){UZ0uLbSGUw1Vm$zL7gL~i--Ft z#U!_g?%^Z%DWLq$mr3Ve*7v=}#KIB+V0RX%nnemX!DB7!Fc`+v}?j#oI%R6tyYsl=Sk%rWvPY4ug&%%NIL z_JLQ?5}hg~D&?AvRZksk&FH8sLW&9aB zh8(WcaMR2p9we>7(Jn6SLDDwxAiMtUY5L=m8$8wN;tw8V$BY}7rznt%^6u!bPY{_z zz0}`(LhVXBr@0ez>hCJzt`m$Iz`i+-fl~^~zrf8zl zPT^`9B{)f!+bZIWsOb}8%4>#WN*9JSzcHL|3fXtyUI3|M_PFW9-`P?grB3{lpWF%?t4dPp(f*(Ydh&I=M8%v{uzk?@G74#$y% zMiT-?NKR|Iz*alzJo?F`NXyH6V1w)6O`o(C_AT}3+U=&w@u!Kqs~r9A zd$-kF@KnCAD^ebw8`XJKyP~H{JTNV0_O&ppfds3#cvXU}Ta@I!DD(HqI_tGX#N4u` z=L!CqOWjNBNero5CT%73luU;c0eHjFu*LRTYH{&*(Cr~~po98(37|~Ttz%-iL%LrG) z-9GB#Oa02%k63W?E;rPbEp4qq8ofJHzoyHKW2QhzWtq!0UnHD_KPyR8x67Sh*B9;T z+u9SC^>|?m7`PMBU7lROQw~lMxEIpt#*4lu+x&V-y32D}IK^yy8i)K?plCZ&-iNz# zf3vsb`e;WanS9RS-m)tE3VENVp_LJ*cwE<1&EcI{Nf$D-*ik z>!Tl=HA-gdRyiDeSgCgfa9DMqZeDGu5O&4lVB-YgMaWzE&vA|b-Gc%fg0w)a-mA~DG>!6tTu9|G^KJwg*+wXa)zQx5?bOo6q1E= z9h5VJ-_ffnXL1YF{5y~MR1x{&sW0>^4c4m1dm` zr(K0#$7;Rx|8l4cvZYc|7Maeitxx_INSSLq3fHGsZ3OCm#K88mYM4O`qX@HWQC@723J(8n6t)6vt*f^KX3f(8YKrCrPf zf#fL?A|FvdQW=_RQ;j<#9O6G&ALS?A$#37$!)Wr|gY@>M^W>MV{Mt~mL;Nb+#6*b( z{mwgT`7mWPg}2>83Pl{w|G4grdx*ujt;{vfr+V&ZU+_3#q9{<^o+UBl2?ghFZlpHH zmTRjZ5wMX<^yVbbu;tz0otzxD@{X^N2jjl=jOu__n$7jCtoqZy-^Ol@6zBH&2yUIV z6or+G4X!X9^OoVY+xw!qayYLJ7P8{f(MHPc&yjZ4D-K$Xyy*_TJB_sdtccW=BvHzJ zIXJNu>|I)*1o`9{Qg7MZj=*lKSNJ4F_~XAY0YHR5QG}sSIMNkt3l~jS+_6C_Zo{7# z@mQ?IJy$b;RZH5gMdj4&uE*&%+32u!v&3+_JROCu1SGDwU2#cB8=9mFE`8Jfup@GO zdQqjio9LVmugrd^Oj&ycYS)+)i_0}}DZJ5?2VN0OVyc1Bs9uZ#=_&5@ST+u|US1Mk z{rtZ7b`5HfmP-8qQOJ_nqRPaHkTOLng=;6TAbu+nUUSh*S zveyv~AE~M{7l*f2mmpiivG7;D{|8x}B+;_?YFb#NcpQSq87`DWN2?)^vON`T!lMw~ zk?23-a{iKde*P^(xwQ^)O^}tn+FdU-jzsHXk~RIYVi{ zTsZ7$ZDNkapEHA8X3tJx%0OIJnD|jUT3bBL@rDTYZzBWEit%ZuLQ!^q98ayOiUOg9 zmouIz+)}|ma=6{6E5t3fF%Vl}n5E$1wL*!!w@^rOM!CWN9gLfbP8dxhxU&alSehBm`UO;Ioapn>*)Lk*!cid91 z-*G=LTj${MdF%#7tBY;_{{f@`yBQCP@&TSK4ISMe$q@ia+j8YKlY%1^b`@5UZw(AmG88)-E)?nSGO*#jJo2uh{&|CuwoDOa8 zYUOer2j@zpe$-+*l~?7I>%{Z4tO<+V7RoAUY}2*MA{(fogCf5-MC-7FKhp<22fK$U z@;5=j?-CNPg9&*xG@LFEm+U|`MoF#F$llr6`M2F4HJaA!zeCAK zq>8?%oDCnDk0UjS(O4d~n7uBX-XPKN%eUcsem3dme^NUToLHlWHL(X&VbAlNarfEj z$1}WZ%?irgY=^ZA)fem5V%w9C9<08itDe{4FN`i(Yr?YCZ?a_i!O^#4Uhr!mn}e-kQ#gvF1vP)u4Pw` zfr@~}EP9Qp`gl)W!1St5IjR_b9sBqGkUdITXvd_g5&eL}qpmHy#b=I#qHkewfA?9* zKM3$gNL8gjV&ftX2})NuUaq1@6OS$&QmAhHH_A_9=663OeYoV#bjjMh8kS(R9k9fk zs;XV{uN*=%itb7#>!9A#MnO;!{qxH-rEPe$@=4QVai)z?9vCnINs1Sdf{3Th|2>;D z(I#Lu#J0K^Vxzy>jPlAsgjDZp*8~dueEr?J;uFZTGfiMMPvBAlQq(1l?utZ`s<#gR z9?PB}j-boT{-OC`=BItl-w!At`dI#0NUvUHJV(KTfuuq~u&gT;OwMZ5*>oE47*g}c zZP^df9QCWXpv4Z{nD52;SxO0&3mI6)9FUQco#*I$ESEvnZ=E-WCR7MqA{JK&x8RX# z^;i5*{ncPCYTmP;N=P4KIonu#UZ;@^*>0}Fr_V%!=GYfUPqaB#t0~9^;Csi+;jZ^@ zq+@ntAy%+FB`tBD(&jH;*Y{WHdY>!_+N+hn4J2Ka4=R2#mqeUBwrk$teC{FfrdO|* z0jUmaK7$C)Un$f2M1mXr-&ZyA<@L4fw{O0X&GWq(n!&f_LPx(iN<){8ae) zG~jC&n5)h#nc7eTj&>D^?C13zT)|Je!~v1tb(||<16aZ-DJhB@GL|21m%WNzWi3~< z`&F6`qFkjd?}R~z9|e(s%Z^sa_`$#%vRN|6b2x2&JtFj%M8jbxE@r9T#o4()zW;>@ zmvW-D5q^?xLz>JJ#MgX(j7(FW=5#C(YYp1IfA{K#*GI22sTMW_IOp9EzKcaNpVW@Z zbl(ztS)Y%t`Pu8Hr~mF#?r4W6Cz00r7#JA8=kRTVR0s(P>#bK_JhCxg$>X&ru8dS@ z=@XwQhIF2yl2@AMDV6!7m_?@A+_lx)RDe0!I7S^EsEZZH|%8egAC^ zdwHcJmEEYCQtj90yXq2}c7C?MpZ@2m*qnK7f>TgCN}~jevl3NjK7+ z3ew#T(%oH3D&5`q&>`LMEsTB6K4-t@Kl9Bv&!97V1M6P*TG#cf>j>A_eWGqoA?I%9 z)0o9Fe<)q`qIyG4c;RGWI{gm{!FH7H5D@e~EVw-TULfn^)kc%biKOFUCItQ!Vmhcne(MEh0PNR&|Neb( ztV(|af4l7|ba(bqa1`Vz7E77xnUKa5@4OBA&1hpse0GdDEr&K95e-li)AWlb&(z{2 zW7Fr4$XB5#+Q|v@?>B8k?RJpmTugw6_7(3gPmyCBZZ5A0z_3>v(#Cg4e(Xp;A5v38 zH&QNPd2D#J&!!Ro1^W{0?=KYW2`HeZU`=vB#{ESrUtmzG)s*ypDQ`z^Q%>*=Mf|z5 z-&()~*EP=`_1_h1nXeBNZ)^5KjU&j%F`uE*#;|5R>r?k})>av-c<6&`q4lNh`ReFc zL|+>KmSRdwik*1L=rv~9<}Gc4dp8%cVFN`!56;6k7B~tglH7jC2Z|xVE?qnCNlj9_ zwm4;nem$oft1mDJrl||L1N#SP`Rg3{^#!x==j6?49!8N70*1>gtfi35k!IzmblA^2 zWEG-QXf!HB<4v+MW=K#&8jSkl2rY1ib>}`BX(;U8pmPU)!umMfSWt*vp$3eE_U7D> zQX~vGWXanDaF84seCR(~w#2&YyqRRwe7Mh+Y?KmI0`6Uea$iPWFAwq?Os#7FEjvaq z8E`}C`szeeTudy@=!$v$79&bQnj2 zwbm0Auu%%J+lL;csx94Y`Vime$xf&?m-~j%Ze|zMP3gC3g{vZ-e62US^XO38)}&{Z zomaVSLYb*Q8m>?UhYP$4D3}A?@vA>PY~G-mBnOitsk6Y|sxA_Q!G}%=jRDWye>IO0 z+1c5T3~1iu@B_bpHgHf6f%r9Fb*Af-Qy(DA`(nknX}ReC`~6DQgt^481IkJNpdd20 zylo-IBV5k?bOp!Ly@5k zR|9;ik4#TP=@1VMm55Y>r;|Q_G>ZphWMmP|%_&>LYoTdx=K4c~yrJJm{f>mIe( z*?|*PQnUXe802e6NX9dNDhVTe9d_}wb70cg{ZHt9PH%f(}=cKz3cK; zlldGSGOE$)7>XF^41@H;sFV(Btgw5SVheAqzV~RccfaMJx4c>Ps+X}nnnuSF;UeiD z4x7k-GepzO&6lAgnYW{;Mwh;tw9Vy~*^G+!DK~=RtCq{@b$ujX^Cp4r?#)H23sIK& ztU=BTICrQ0Z+X;Ba>T-uUrS20C8dJI>I`;ypPcWYIW76!Q5N2N_8N@#$a_=z-WR7S zVyeQ`i>A8Wnx6p<+{EO^!0t60Nov7((B6Uyi}jgmL`;MEBvbw8VlQ1yOvso zZwBC*Y_UmG#B&2F>es3Kb?_Z4&_k;pZE}iqUm4n-vL7*nF)J0kn%?c*PG*p6;3PJwieb#~i%x?Fmj zVH8-l#hQIft=ev(TZ@Znyaje$a4Z7|suYZ>auU=JZ8l5mQ{e-`dXU2jcMe{nH(`Z| z`j?fD@nOW#&o+>hx>VROxX#pjz9inRG#OuCeVp&5Wb5^WHAm#k>vVltERDA7~>@sCC>$O29Ve+gEy%DCDCut5`IX zK<}AR1Mfc!`abU?OU&%Dh53hnkjH`NcjrHmQSEe)ad>Hl+(?41Yp~a1s>(>%`2;`1 zdX=Gzcb5xI;BpbWoTL2)x64tFAKG<}HVz~aXkVLP4;xlMs9)<>P%jh2c+6dQIM3{T z;sq)dX9Pp)5@Rq~I*@@&_bZw#FCJ0|+$4wf%78CA$@hE9V5n-X52WY;%+pjvm~Q)& zvMJQ6yvmpfl^e4~{}V9Q;isHsd3@fmrH#sFN6mP)SG8)eaJqU#|M& zTDGeKVIsi~6dOy+9-X}FSS`;5ZGerO!ySiOMLv}a&~nVy!I@2#sUv*N*W<8@m|<{8 zow!k~DKHbm6>=wcV;cP~9%84X-6tFLWL2f^;wMLN)5q&9Lq&J z`jfVk#!-dZ%3eUONNfux8L0^D%+|-Ww6^-G6M!lu9z;5lH(NJ)Nvwg1FkF@HruYGW z^nEJiZ!2PyB$Zb&8C-&K_E_a})dmlllbX>|q!OV_YSEi(R7o1xMRw!)Y1_>@f!yQN zuv;ELJbcPia!+)5Qt5!1S70qU3*pq6Z~tjlZgARj6!gzdt7znphH&mmD*tL4d8>AE zmCMOX@3feQ{Ja3zWTPWF|6~E&wKFlLE8Wzwvo)njVn-LUTk8DB-+FX~~mQ(YQW>qFjC)$bTIX$!wO>rV}K-elW7bSiZg z>GH(x`zc;o#@4%hYQ)CoZXn;lf z0DRX8QgBX>DM%~7dWQALG)jcvr-;m=N4dSQ^o%mfp<-oKGDKRWQ&jPDS3K~C5NOF8 z&a>dxw@ZrF2==N}$R|jMi$fsrSY}8StQ)xx^(;E4xklkiF`mm?iuLS7MhK;_m!dVA zUkOj0ndDtKKruiLea=q886J{8H;T0Y3-v}t#n;&e%Su`KVC$LKXGb*}jRrYd%VUr5 zT|WW=PTr=C)qaxAc5YOeg%6zvJSvWO$}2nxX&z-sjkwuU;RNOGWG<|jjzVjQ-5^~| z8J3CM*{p@os?v8K(ai^ChM@2Ub;aj6*ojX)@%)=Tn>G1#5Dm>8bV|OhJu=pvPnT}T zCp0u5Rp6)_XIyfkQqimQy z*f72(Nw8V@wnqM5X~s@z}S(5e{AXA zUT%?7lvTEr5K_QM^nPgJ{RoVRNLuZ`1Q5M>&=wVDpZF9$cegq#veCR4Zz+hREqflX8l87=0ayDrz{TrFM;aU8qEO9wYcbQc(XYX=>f|TZRBcCB zn=!w}3YJc(2IP2{yXt5qM;C7^SfsHqm)=WF#p__Hp-8^>&__ItL7Q9kf`8=v4Z(eR z5;tAupmYw$RzHY?9`^n7l?LrMPv08CRHoC!s*N!ef?M=OZov)Ph{jHm1eC78`SRT@-IXmGUUy2Wy$<> zI_a<7a=DW)j$9^ZKwD)}o@^y~Ko^jMM{_h*IK85bLRjwnolez$pj78Zl*nqlX!dZ& zxs^_ZK_O>>!CNtN50fHYcXr`A7eJ*4rZ^WHChvxVlbXdmt-poqF$Kg~Y408Tb={35 z=_I+Us;|3;3i%3;;*@YJNwk=p7PESzG?ssXymvd&_)Xu<`B8!(_u|2e9`lIyMw@vk z0k^}`g7*XyTX&FhtIc`*+fBWlT20W08CfnS85FSc7!(KKP`cOXKrn~NVo|zWp3Iy4) z@P{q6uulg#V<=Safjb%o28gSNI~#G)-f@(w>dYA|DsUL&5yNRH>w?{GA{lFO&?R zT}(4)I3y-a87f1feWQ}!IaXr|HM*_^$|DxDA<;1d`>rj8NfoAXfitJt>+;jLG~+T_ zghM6h>FaTIlIxp}NP?zQZcJ`Pj?Vqu>H)`FXA(SD+to-yTa#Fsp}EPAKtb%re4f6@ zype7>RB2g*y<2^tAK_Edu+Y|kXNg6JRR81F4xCxibeSDBM8;zMy&sM!Z?!8bK;M-y z$W6IgrthX=U2|ZIAzNb85X(*sQ?h)m?(G+tcyPT+#y<1B)vRA)cxE29qVf%Z!Dw`P zJYyV61H2I4H}`*b-Cv1eEZh@>Qq?WuG5{Q;aB!A&Em@TOY|_)#8xeU+-x&zD51o;K z&SrNeZFPs}^_+m`7*AuXycxJV4FXX155@1$2On`-udyNMTEoz`DeNXu59r_buArZ- z5LQuu(5v|h2jZo($^nY!R_CTbe_5qIxG423t1w&u zuWc+ZaRe;n42>sWL@NW!4*pJRPkNUa&5Q#|n^Nf8^mGCW;iVjp`A`kfo`~43!iGm< zjryYdMQLT5UY*Tm?tUz%-lxh>hc8a(M;cWP2CGS_l}b`og1w5 znrM5SDtY^YdMY>F59(aG!W;<7CH(#UKLMZM6F#>FynT?YCseS6Nlb1%%8UR|V~RG@ zaV1!y`({r@*nf4{14MV{iOKx0dVA}zED}9AmT&9s1YO0fNbyZ8Z84)*!%rt z;+-+>?YTQj2NhgwYjJjnr_M-NohYQ2L92H%XldUc(IaUs%PNcWM?fk})mzO4f3}yO zM`4u`E2Debm4~g=`onQGAt|P{7A%FG#CwGG)!7#%>_9VUK*&a=&`>qC=vJEA11Sk6 zH6MPH2<3!F#m_2gNwSDz3a$;X{LWcKACc6itd9dI4}hh}m6m-@0hS|z0~Eq{(^Ww* z_wEfR+K=7+`^E0Tv)P4}Y+k707IV+CXQXA~8xstfb47od$>NKrsrI+qg!e;BIrbR$ zl{B$%C>iXf1p9T*1NUXUZ;`sE#7etNfyj@UUp*}}icR3^LN(LT(J=xRG}(o7bgq$n_@;4oCkZW!y~&U~{p80D1)oC=aEqBKyvS&cf~S^Vmu`}J?CD2B>x zSv$Y#*^dZ|c1alYj3fB1hU}6#ALL}0?(-O&*QaJTscvin%#9LQ^^Dx+>7uMxId(Jw z{4p~Lr-ln_im`xoG|{rZqu$Mc!uIPXnSxav2wsnF;s{o+T060AD>^)9v+fO$UN1J@ zdXDEzt2M4cJ^JZxl=0-#*|+IfJY}gz#!58mP3wrN3_9`At-J`j@L=^SIJ$2?7}lbi z5KG|9y7O$;6yY^WTIU^<*~S645zJDQL3eB9+nuc!X}&tf1wSQy(4B5`$cGOfazSq3 zM@Oan!s$D=jKDKnB;+Sg-@buqYHE6fj-H0H3-)Wv(pi{u3W)a@8qHT+2g81euBG$` zjprI1nE?n?8C-~8^|dkv0~1pZU0PZ?LFiz$|K0GDS$(}AJ?au)ad(Y|_ z(NkCz?}24Al8#E(|ORxFYuv)*^4; z5=lJp(TnJ$iwuJo--7N50sCpzMW?ZwbF3!33c*l36$&5YdU2cySSbm%zz2E2?>ZES z^E@L{IEm9X2N*eqsQJHDS3-S!k1_Znmr+%ZVkvmDU3v}*Gm z%yMW7m(dO#G<2vuOL>(WN$amzK9t{|%x_;j!Ch0{Dk*{4f4N{eMvq$2e3o@b*|87KW&ZttmJPQ z$aU`Byzz`iFKwr#kduind>)!8;W7Kj;rz&2rG@4I*zl5mI3WrLN z%DWWqE?Ow;t8s3j$XVwVUl;UtJoGVcYvLk~j`-ClMTU=InJ|1Ho9bgT48O?2PdqU3 zSca40>C!2@d7)oXqeFl(y@X#CxSr}qCcQ}lDlQkMxJwPYQFDUGb<5=8>KmU=)i`ip zY6%RA`gOL#(9H+jb|_DOu*1H8|DN*Mv)4sYa1S!-PC!Bs{$3}ue34q5a3Hpp(}TZ^ zHH8R2ZXS;<4U~m4R!widsSwq|(TV=@HC7)@ulzd!6=i|pSu5%RJDIqrf&(JDYOu`3 z_rPa$3E|p|AD{K-4ql`7VXW2oE+YQeZLeFtNhgxX&ce;#-$yjCP&1QKIw1W>d*;c) zAn|OOc+%ISki9}_cgC3nD4QAF)p#}$4K-5r_9E$AC!oZtdw5`KZ#=V6_)&(1&~M!9 z8N%IT(Z!-R20^0Vz`2J8LTrbwu1r;`Z(84;#ADBQfoMiyGt&I7u@rSJmPS!+b0s@- zl4)%jy7C1ql^Acj07?BcRD5CA`X-0+QP?M-0GADve_pa|2Tr*eUbr=nyWszr*6x%& zi+KA{E6|_#lD`~)rASubYJLi)VgEz{LMA`mcAQp(e7_J?@OdcY!6V0?F*=@@R(-qd zp-G4(m3rvZuY|lZX~VA(Nr+?%W+me;dHm)^CSD zUto%3qMyaR#XQF_IJrry1mRYH|DwRoZCd+>)Cu0x zC{p8ifQT5zSQMq;cDe}9X}JV@E0zh5h@fI-e#0Hxm#wSw7cuaM;=WyMRwZE7e@P)1cOr51=ViEXgYh2`{qSzwFS|GavebNu4^AP z(d@KQpV_pJw}18Jz%a7yBr!~bpvHO?1^O+5qIb7`Y{h?^xJG(>svwo`Ukmxyir#@y z7UGY9q2oKPcfa9{>qvt7cmR6AAv8kX{(jLfdhsp$p9?s66I{S=vR>gFodQ_P=KRnI zP{;%iv7dQF)2Rx(U!P^S!W72D#7sq3;zNQ@otr=i$C$t9B7^(&T4mY~+!Pcvpfj04Li+yUVaBZz1*~T-7)l|Wj1~Cs_9q`g6Gh+DF()#v9fEGQpTatwF5Epk zkCwFF4#cy--MagwIPsluUYaQco$^f%+Gw$6N=r-2cO+?iF1yJ2Lg1&&0`J3vhYvGB zqSru;<#NW6dai6{j#leOscn2Dk;@m5|GiBWZ%ebuBTZnc@*{lI+1c66p|y$6+rLCh z;ilB1Q1$bgc&iHo6vAo19khRP648o$>$OJO>;yeyo#{lYNMIJx2Y7MMV}QM#+YA|0 zY*x=MdE@Xo?amU7d=ip7ngY!~-?{df8mIdr3=i;)1z}$kluAtLqId2U+Vf^q=Eu|v zzFLW~Yf5VN9lI{`oLDMXpJrt~oUQi4?dP^xAJTK$K6+gl(l88E;7%+V@8Ydpo^5v5 zR)9o&=G7S5YXzlHh`4p1FT8+&z$0vIN;swVOcRi@;LDfjbhst}N=|Y&BY&L{PA-8& zTUMEh|Kl0n?#5KM+ZCbvBBw?~?dbnHA8&fvYDUF*-LnK+$KLgFVV--Bqt9U6URYch zAB*pF^^D0MR}7lGe758~FvOD=X?Zjj6`c^be(@iUYRs3MV;LK6?azl3S2j%N_h_zM z7tkb=xCM^4fus5{j3IB#k@d|yyk6oi5O;@-1<~4!6<#nGDpw{36Y!7=j-!6(Md}!2 zG@v{zJXw!G)XABOkoOMd3L<}%D2_=H2r06pk5 zX1GpxVm0(`6-H;Fjr^9l(!dmP2=^bF>Cbum7e#x=bBmw<0EVu!LjnV$Oben5+EM3S zUGeRczCjd@F_4^Sx0L;pvJo0~9(8OT@jXA|rY9&L?63tn3>+cC8vk0l8A1#u9*|DuwYV{BwZ7DY;h2dxuR}ge#!=w4*x1OEh z?3BO=*G1=NrX%c6c(-`=_o+=QlQ|J0l6ag?2E{FdXcUWwN*2?N4nVF$EaqLbuZhHT>pnl`upOdmR04*EMUvz0#EAJj$))A=&K0DPPC7Jy|xZs7oByw@Gn+=@CoZRn(0w9&D(Qt3w-kSDu#pt^(-+eV@ykS7FWAML>&8Q5lx(M1D>DPyPQzv_m;>P^3bRR zhn-hhw5m2ZFcSUX5us5mjCxNKkekT*Zc_M`CTi@MYd%IQt!i*dTl}Dv{*|QIr)R#x z2)B{*?X#-}7skErySS|8Vk86md#@Lt#Aud{g=d3jpx#r#1d+1iQKLm;MS8b|EQ8- z1r@itN&ITyS#>TaJ)~&8l6%%SV>DLaXS#E|Ey!tiNl5hM9U8IYJI9?CZ-+X!tNRb1 zTn1NUxbIAk$ri9S^Y+6d4gB^+3ytO}gqfApB&cKbQ&5=9-@Q!wdQwrj+upedi!{}l z=2Q32SL4qcNBC)~^5`IdYz6Fq1R>m>pZ^X(Y`YP*81JLq@qC5x7D>g#Po1zlUq^Ml z&5zQb%RRX%=_K<}<8+m4^ahKedA@%Sm*ak9iC|D#&}M6+U}G3PP*?t21yc&4&7X+EFsntatNbFAp9hu))`3H#it z(Z`Rp%_qL14*6YWr>B3bcgS;I^M8DmnYrWT7qK3tsF4N29V9j2a?A8m}L$FrD-ngm zgVXGJP{qNx`o7Yc<(~G7C!SGo&k1~pv&y`e0R}r9nfu&u0r#Dl$z-2re?GBB*e4B} z>r0_b4($NlDpC11NpBOYef&zv%902>x9fFhf5-v5!A|wz+y#l=jB-^hG$fpxdw=Ni zEMOS10`9^0>{1h_HKwa@engPtFJa`Xc9HylZJ{!PS<@(zf&hhBmmEe~Z>9Ww_> zOIcD$)T{IW8v}z2UjRReaGNLNe+!!aRWEy}A{ff1Rtml+Jf%UsqJu8u-PYF6Ji|5M zw%!BhY6ozxip%Yco1m zJOfe^ZG2h2`d{YNWnf-q3ButamONN7H&G6af|QIGODwW7GKNV#u(Y3w^fTVlvV+ci za?Eqqy4i=WgWNRZ1XKAQu~OnDq5?&Z(s~_(Y`&Wri7nYlfZkFo6!2eNG`?umL<}3N z6OeFPSxnb-b(+-_Cpdez^ArT6yshL{v^D6C(J zilQ;lW<03a+CLqZ=8IaQ?Q9D6^-Wz(c9xNk)ITO#cYR=>QG-IyzU?)vhtmt;ZcBWD0`7l?zkjw2$p+oHu^EcUj!^9ff3M!3u_`O#f*76SWQ@O9d zq-giI4-QL@6GIX?SWQN9heztiB`Sbm2mR*aj%3_nDJ=o^gy;DoKEFF5JEG4({2tx0SE-572450?&b{9o-A|Or75VIcarzmuplpgI8y6>a`MEu*? zk4MB84QEJxv#+hS!(2xi%vTjkCMil?G0y_q<8$3ehb4sQLy^?5jZX+WLxL zzYtQ)IKU1mfB;!bJ$Ykl3Z34c{arq->U!BIYv)*1^h71o&CUe1PGJ$Gf4<&c+OC^& zC&>|yTO@0dvf?WbiR;o{?6tXWMiB%|j6byx;=way+3RNXU%g*=jDGdssrAr?R(_5O!J(@#CK|H_y=2t(S+mu#%HGZeF2 z{h*D=m)xTICtoyslf}|IU!?*Sj)cUdXR%LCbo$E|@Ixa;DZ?icZW*BqO=UcgX9d8U zITL`jJi1BE)hAuyUOZn(&!PI=JY-oa zNWCC2ATTgvx9K8S!(~s1sDVvEimSp_&{Qidwtc+8@j%5aLWr!d+NM~gFk=xJ!h8l| z17cZbu58qG7DF22vGusQ`3V9*vuYg)W`UlGv3aupk=g#|#k^n#!y&uF^Qd3!Ci4a} z1^$F^=-UKr-a$snG*@&KzNol(_!u|Pg^AlM_bvN`3YXR%EDvf=!*AT)FJ+bWPQ899BDIeYFyfFl3FXFn;GLyHe=;lug^o(Q zfy~|5NZ`c8e5SekRv_R4Bnv)O#eDXdq*p)*)1Wr7(&-qMY}je*{b|VTbT31~O6>9^ zueo;EKs0;zwso_Hb0uNvkqOAh8I_pAceDa_RMyB=v(Fzt$m-Gi#(SpNq;y? z)^k8&@fzBuXbNh_v}UF3M& zX7Hh8A3M$9kN!t3!Ovd|$l(p!m4SDlO3%hv8_B&FMY*^=!g@5O1c;-MS?K+vO$_(Y z3JH(|C|cu$5;?YLn%R{L(rEWvFTk+1rJ!yMqzg17^^aH&L890Hb$zUPc+kU6fwV#Y zM~r(74GpA2fV7f1+lShEV5x%;!~rBvV6)xG%wMBG;AXvRUuWgbelaoZbN{ch=fA(O zk>baK*#@zklEH7hfop%L3cA2DE^k+q_>+RhN*zS0ClHCC{Fq!Z9f4*w}hPOCT{9u2e869*5 zKzL@I4&-%=(%%-!t_TY0Xm!netfBOQZ29OltlQPlrGP;t$Y`R}rs>-U`~O>O>j(Ca zrOz<|Sty2S_CIQqwXoY2^YFN1Je>8gRH9>jIC~fv<8o!vg;DmJfR%98>Q*K`d9^76 z2#BF5N%2=1K(a0eJnci!^)o>$Sqy0JraeN>WnNAOz=w6-m&pAiJK- z+B1XDGnNLA@;YQB6@xHAuK%@GWT}p}!Gupw)`xu_(WC%Z%P^Q!jt9Bre|h>U^Ej8lDDYu`OlFQhILg4Ze=D#l7;E?|V(_1e zYJUD0SZ0O+azu&#UlK{u#|#>Yr(Y~V^fKPZZ75W)npX1zA@(YW1yxt(?WZSr?8&Zv zH!1n;VnQJ!=th%K2qFg6-j)Z*T>ohF{VBnVyYgVif@W-oiFVRWOUvfqpQEC+Yh9j`WGoB)~N zAA{Wvj?X+(?E4n5;Hj@>W^NdEa-f91YAi%=0qNNoI98s{_57v2wKuFjA2Ozj~PoOWBH zz}*I{0{Xwmx&h|Y#Pw?>BPH~cNS!}c(tq4|PwPP?mN2W2w+vc0u#jKJ{!n9e*7CF( z)0HM7myD9&q-ElEb z5crBm6rX$;v4mnQGeryEEO^Ei<7qcp;g~cL@H+5ElE6c|TEIjfYn8@cXV$`33<0R& z7YG?M^&++Hm-YJuHP|WqF2w+s?mgtcMO?zk8g3Iq;>_T%pey;qCLsV{M2`lS@#D&6|k9LOQ%Sk2ijd#C3MA{q@T>;zW|w#QRBA~rz3~; zDCTj~xdy~WzC$|yKyGS2ozB2l5xadKUiuIl9!~g`xz9*Tfww1X50iY@^B#Pz74*&% zjwRQ;eOQebZ&{13`-G5HvI74Ic>nfje?4;WfB_}xdisON+s9`(LoDL!@Nfh;A^3qi zA{$((9AbQAQYA9$Wtr7DV)b5w3HZpWX zy$qzO9_%1&MG`+D-JZSSB3?E$`0mJw;T$FI1dUPp_$!gK9zHChxbEK)IVbmh zcAF*64(dBT+|hgs5ai65_qPZ#LrcT46Xoc?Fl6C(jR&4H24C10hsbW#d(k&FqL)pX zbGUHr=RH&4#ch5c^AHf_d&_bPRdoaMn)zj8(MVVE{h zi_0u@w$WM9fxVAtS7_FD4h~=cSF$Gb{|y?KrA}0ck;F4QayHJC`xyVtp8(FUq2C6D z{ey!{H`fn2UKZ=lM;k2h$CImv>lDknniJyxKSAS6{_|Upg4-71RGBTjeBn84oH!TN@K88N^lln+GJnv#?a1*05(1w(kn-&E1eRYR#S6OVGIq?PWnp1QKHl! z9O-ybC=eNHAy&{%2CaNmM`vH_g89W_Ijisy#!M$SS9b^&y~+!{wuXHXF`xFta+;Oh zm45V1HvuPC{%2P;TL$0CC02vQOHFHg{dZ?f5g{LbDeL}RBL8s&W5UEM;w#581=Z#t zRFdnI)ON$SPk=j1xX2ttav&AVJO1y9sz+v z%1Ii)N?;)5tl9SWa7?RF6{?!D*e;`kXtTr11G7<+tt*peG^%b)RV+8)C2;(H6nX}t zr_vSSk+V`_7|1nfSWRcbg;Sx+X)P=zg-(|+zK+^4Ewou>z7xPmuovzRFGRp0{`m6B zPbK3xV**vF4Vaw!gwH(kjEstW zg|^acS~z)ip6K9^zb)(5$dSG5eW9a&+E?GYwo<4%0%kZ9y*W`BH-?ne?(Rq#^tE9i zRdjo0?q)}1<<4@DbaYwTDJRNf8~_(VI-dS?;r?vu9gB8*`gw`5ChMrpeS0?d!2Q|o zWvK4@i8@Ysa#a_gb+segAjjO&cqEeuVrS}O=kty#=hH0+2f>Vgdzbzc`D;END{v|R zwKxlnR+lX^{ERx_0*Dv#Eztrlw>zf!iDacMiztSb3(cgC#+A+?!we*SSRvnhm%FyO z%i#(u+loSNleTS^1Ru30@k!73UC2Hl|7Tl(Y@q3I9a*K}Xfg_6a0Zi}OTk#RdLHtFt^HX90QW(LU?odI}j*Fg|&AX#<0g1-v4tGX`= z+=EA=6#7cE1?dqWA2_rq{QzpM{z}4rp@yvB>~xW@KQ0WTIrcNEDiXv+ch4YWPtS%H z&sxFK#8gAkPsGG+?(o#cCeWroU#YxQbq>_;v5?Z5eucEHxoYJAk+Di}VcJ}`2u;Hj z201|(zJC^bx2s(iiSazD(37K-3#vOvAw?@#tlAuAcU>nzK*L9`@#<+X84z9$IpB3U zeQxRgH|SWVFrFm`1OVo}?VwLPODBccaR_e@*uTg$jF47>o3D#{vMWy&F*;q@Z2Htr zXI2EEXT`5s?o)4pUVl3qtl+F&b3pJA`&z%J0$9jdBA-a=LhUU&vo68Wyg+r1YQs6fs@4~_eRv#HPg6f}>yvYv+d+HGN?FVto2`tB;zr>E zAPkSSonUNt(McIxk4+0IY=W_1E^fIDL!zN_RpVqXDfBQAI{#Xx=LuJz?af&eERX>r z_@{RI&o7>KBd!q-C;+;`5X=T;HlJaC!ldh~Re)ROQe`QC2E?+vbE*PHP5;LV8Hq|2iD&JK75r`Gl2T1Cx$LgV8?f+FgZryv&N_pyU*5a_ z5hGw~rkO*#fG(abYOk*L^JMudEYit?iWJEUFNh0UOqNvKQ$E_RIot>TVo$yGh^=Nt{nNVSIettM3w8&6d zwAcKcmn-fB_LH;K^$ZRTpvAgbn^pxQ1ul2=R^~XY`@SV|rXd$4sFrwrE@T`_tEoJ8 z%)2`k-k%*DlRK<0zSAJ23+);We{NtmO$B&B1*C~GX#O{8KK#%EWhMzy9h?UzU*xg_ z6`^!}CPNibkqnwsD|0oj_0juBc`UM-D)?f_+;J=L<0CtLAD~oA$(%O;c~aV6?ap6q zO=5b~w9}@$`?N+QGDpT{{-V}Obe=awG(_WyboJs)@4Tm$oYjmZLB8P1kHcCw!u7&! zMBTR?A%D72pX*)Ir`x%$ag46vy>J#_s8Pn7Z`!hj!aTMo$N|#=AI_)BrW>6@>V&Gc z5k5rO7!4z6@2I%fz*D_Se5>?0-7SJVIGV+TZS9JX$L`asIBtc)^w!iI4M#B$lH#bU zM2P_=_WU1z2#L_v7t^ylK5z0l>R%^wyHRH|s70y8X|$0ahB@7@e-bEwYigrqMXWRM z5%Ji1c;RS+Zc1voe2r<3p^MuhEvcg~rxI>80`^Niq#=k(;{Tm80{? z^;7lwlj9iE^9sLkvToxc8y$dI@@_=kXd-x7jHh zrT3`U1rwF*4#!&@>m!-j1?R?os`pXiy!JYhxNbIFk#n{2*ewN^vZSbG(uEk!Q%NS1 zQIE?7NP4g<1ePC9<+?K7r&IexAr{_t{EoFE?&IMR_6ODsKPJ9+L<`$jv@g`!Li)wp z=k^;)@JP{;5o=6#UsGtFRei43uP_`Wb2>ECu+49%RMUX-^Ct2{BVQ=$MPk@i7c^rd zHg0@*x@TaA9_V51ysC15_9eBXj+7q;J;tMvX(;YJ7nF9Wma9KWd#r2vn!D!dT)A_; z?N=zqo~fn+EscisS*jW#n@I+w7364Dk=bS^3c>ua)IYpBxyX?7VO@N|5x~j+O^WDW z56d1F?S9%cg)1IPw!`wnZ^?84k@V^>8m$)=5^IrkTiT469G9@EUN4Z$@>(o}I;~r< zb9k}FSDP{vcLq|Wi#$9!;r)nch#)eUs$oW@*vB9!WI^xT?sc#>R2WlXG^+Lh(vz*c zPzRjsrFvL=ZZ3MB7FfFt5rb8Hv8(Uq5m}Od|UCI`loB3FAWIyaRJESQtBSh@2`=LULrh(|7>a1@mSkGcTrgpa2 zd3C-MLDZ_cA7(TUst+{d2#v&P%Y0KcFy#m~$ioD)I2HP31Uv##v>in7!U|hKofcQv zXA~*1ALl4mM^DfgdL==i@xdoMW0;>|HyZ1$CW1T-~1w)VQYB_+1}BBUlHX;0~o&W z^%$Q^?>G_edWhHcT(H|^Sn04SklW!0|H0Ws3f9>|-RnCq1%jFLRV)@?AQxbyhu}y{jRiDky&z)i@=8F^K;x7BfFg`y3UZ4$m;n%!zrgu zt6J{GGpR_N@#N?BY1z78cp)=xq!U=*{lJ1d-K6zRIFlL5CTH4%vg!&jV&8RCFO}G_eEh+( zB(|hQ$KloGGZnf!xl+8zWPHw<=((%ArnR2hkN)+qw0aB z_w9E_Bo#%QPfPM>NmchT=d8{AWF&#^W^h{K>DkoReTf^4^ZX-_DhPlIh2%=jt46t5 zs~m9?Q*K(eqBpq$u_GemO})EfRlK4wM%Pzj7&}F<$_j!1Z-vyQcffCt7%9qGo>>>^!N=00mwSfvtA?$3qeQYuxktj8}0l+@@~Iqc`i5>N7=4%l21O6lbHY=TZ5@ z#?2eaM2cKwOReZ|*xbrg1QuW^IV^eir^^jeidqYkDX5g5rjSa;3pyR|FaY@bB=SuN zo#tND=NDMx??y5*X;m6t=_ucK(7uD1YDlG6Rgrjo#Ad6yLCvx8-ei|a!A3rBbd;&W zcvhxqwyamvN;rAnU^KNcc+w3(>|6kKcvRx%)e3s7#IyrQr`Mqh=nw5Y)nRb(15M1 zA@;Ojy4-rzO_AR5z-8g{>azYry}m6Ym}0nSwFU>V`=~fnLIE)mE^z)xQ-h%VQt~k~ z!)z!UDVkQAt|41dN8F~LD^G+=qyJ&xmw#;D9-}!u#}*cHa6!&pvCueRJiR&gj@o&9 zW{G4sU$NLo^+M)aTV==X%7;C2x{f!7bO8xAC-vb1J#iMwlHO^2TL6~y?aV&S{AfR< zCnDPMO0Sy8OLaPugMn zwQ0L(uJme>&eoj_S}(l7xtMo(UU{w6m}+^mE(X{dn%0kpSZ&|%+1&iIGs@mBYU6O4 zMz%34XwTN$h6^HMb{V91;7SD467(Z&eG&NxM=Jhk{3SAoWsrkDS4)I2Gdk7VZs&BV zjS%{yNWd(4*;we!94?P_y!c+iY^)>=QYcK+c=}^1P1uws*D$(Jk;SvbB2?}l?~>%o zWkxQNbbif}RK**z1gFPS8-&k1+^}5_5hBy8uWK_m`}j&~wnv>kIu826c=B!5XQYa* zj$-P>I!I9v$aCKms)&tmjufSt85WFdj+?EfsCC36D_DT1V#f}|s3^1asvXjv0S_;% zu1>c2%%(3;v8febO%GQ|A^~@PUPBablFc(lGoto@$Ac!>(lH9v+x_GCE1er8Z|Uv} zT#VH3^5e(6boPBM08&U;YXD<7OC^ei zq|+IXW<_jGHHvJE6wyDXi5&fbZM(@9=5Bsg*{CoL+fHZm6u)RYR_RX`09OTT(dvPC zQ;1b}hvYoxt0$h?C!K^R5_8;y#@DBo=DSV*AA4^ZR^`^U4NFKjC>Gtr^bfvz&=8EO8IP;Jz4fSCgBJHub;deF0kXw-PdvW(=Bi ze~RgSOedWV-G>&H+WK?fMLcmyKfD;h>T%#Yi&G`;u^B5!v^1xE-6&|LOzeJr`EIyI zRaoQrE?bf^NP0IoAG5V|zD}hB%CB!SgDwm1t&ittV?3{s<*;DuHN>XSMF@3ho?+Q( zJhAtW^fkrggN2HtC81nb0)r-Z~_a^l5A^9;sD%PznQwVy|51l!m zDBqFM3&9ktbj#J%FEj6F>zv_`dRY6)z|mA7dvMi0Opp~vq;~o zfnc;%KJ0QMK`D&fRwt~G$Q$uu+@CR_f6kuJ9V#xgLqH!c&r*LuTKcfNMPxAbQH^$TsB3D$zTmEq~t{{5?ZxN13ya;(Yi z1Uo4oq@xncR%=#Rn%oMl1xU?8_nr;C_fQv~YO-QGKUh)__nIQFD^^2t@RMITN5E2hb~M zk&L&Ck|eea_9>P}i<|6p4{JwE~4zF=*>_7yjjGi0`KB4DGD_U6?Do%l?Q z$y+?mvA4!h1tZ!{zxf8OY{b91%nlSZl>P7mN*Vd+;oawsUf%nO>f&lcSB3?QY}GKn z{ub&2X1wN7gSj-Ev--&rEgDG#1bTKh_W4CpjJOs@0q-B5;#jo%a^8K0ayKW+^&0v; zWoj|f5Of@JtSsw2+!j>(;CTm5ce69OOCiszwpcT6i`H-g0T?ZX5pg6qN{`_8(j~^j zxr)X`LObcp^UB*r99!`P0fiFD-1N`H>&-S`h}o_2tbS+(#|x!2G`YID5@K?Jt`uOv z{!EjP4CreYnw^c-goREwIH_l}WZ&eBs0a?WgBdD?whU>7y0tp<=(mc-_Qvzfc&ujD zO>T!mD%?+6p9oxN2g0fh6zfemlL{<2`Eg^l#){|Y5(3={OE0d6-2F@A8jpXL+BZ5R zFsb$};59TtoJSfCB<9UFhZa7J*>@+f=f61h4<&=l0P&7CDTS3INHMw1tWeCXJ9`Ut z2(tH^TX!m&+_khB|8)&%0`TrT?#%ks`m9B+o*WC3J}ZTMsiBD^WHcl`UK@me#!yJ! z$M#$C*eE=7Uay$TXlM=!m_|r+YY)YV)`61cYS`}R&rl8sxvUo0e{{cJ+kVBD=8!Jz zHEZN2M((&}TPhp(AmDKQs|IL$EoD4_Cd$;gT2bI=o7Ffjytiv+RC4qRg;d{uonq=0 z;LIm;Z0r2B#;Ynz@h5=*O&EWCezW$+`h`W@9ufnr6O+*t1%lnXh?;^3pRH#E9<2o7 zI(t+&S8|?MedEZHJIHCqBT9gh7(dX_EID5D&66oYM7NJXeub0aB?AvHsPS78yjG_PSPM6`5B?ZRl*)qUj>f=d*9!t?Y^t zjXIgB2@(C2$kF6(&?XK?57t~H8)dP1=g0(G=pl*yp~LH7OnF>gG0RtO?lU;YWz*%* zoceWCnxiKeDXD@04CqRJaK&?U6)5Kx?b;dQT}-9-OuRtwR1#6-i9d!8bzO1+#=oV2 zVqXYbZY4F+YpE0>+-;3f5jT5!*sq$~iS#NriFeEjnEUGsir3VF=w+%h`1?xEMF! zdo4Bj>h$$^@!XIrv-+tPg`nwt1p@2$)*un+Bzeu#nnFoMh{DyyL0(bYmLuH(bq66M zld;j)0RD<v1pg8mpl(*t?gZU@~zkcP$`}>d%{x z=zE?}(j+w?5pTXEO=eP+Af$%H9$vae`*0V<0#`vmaIhI1@&!Ql{?=hCyTuj+pCdhs z>#LwZxnOsLaB9&sMH0SY>d&84ku=d;zxDnoB{Z8l-g!Na*bM6gq|)==-pMzMXYl1* z^=A3^Q3N{mlnKmf%9_9%E5njEmh<`5=rjfvgF*48_oDV&Wub_n@wb80laPlF6Z&`r zOJ;4({6sIv>E`K?X}#ngL$LnMR}ctxA0whi#9Iw#$(aJ^;{IW7Sn84Pyv{*P>1nW+ zzSr4!%@dr+7Bi>gO>MKynr@tr_uXhs0TdVqUTDVzlT`4X^lNcrhP1coQK5(s(kn6r zti<(qyt%Yrvxhoao4Kv_J%*-R+nLn5&7e%w{Cpk;4kkL=M?YuuX4I~|cT4_yRQCe< zI){(8XS~W_JGfQDnf;K z5(Ugv6!}~?ec)+7l9>B4ywIhqjs~wzkh@+RcY5nFe$=gVr57u)OnJbJ z8>@|1Oip-bfodYP;h<^`zFaipMG>Qz&Lt!A^Q+d--N4((b{QHBY+t3Rgq?MxTH9Ot zv=5fk{jTs8$8yzb16{X<^`q{wp@PU2A=dJZ-n+1~0QcYA16&=L!kao}CDfVLc%F=K z7UR4%X~6BXN&%ff!Mv@I!KQcmSxpH>UwaUs#YnLY(TE|DcJbU zki&_X>5_DZE4>^Dl}l?&lRPDXL}(rth7p1Tv&=U#zAw=eE_XjE9PF>iV@^uI5N*od zOJQ~cp+Bn_VB9qdWb?kdsP=qXe&w3;5+cfJKqkE`D@O1Hb#nIMWlcmJvxda+CR`PV zTEw^)*K9ClO;WqkI>IWd{O99(H=km8yyvtbExVcoIOW7Jb01mpkjeq_HS|7f#JpgJ@g`oJ>*}@X9S8ICe~4D2p7`H+?F8 zN0rq+y-!7N@!MztGLhS($F()M&J$|W1E^=L2dkXJ3Ko2&*35MCHX!Rbsub)w|LZXP z`$+ujzrid4U*236)YuaH*pHgoCGrLxmY}3G8eq8Ryu&LWHx01!rG$d>^)=8~(R5OB8M3e#D z*Ji^lYE@4+Rza0jwjX7RaU+H1~($zcd}!&onLZP8YIzjYYbj{F;hK9P?GHUxisoP8sqR z+HnNQW6e7VD(mKby9ve!OX`-xZ8kwv@@>2=wm48bMDFw?Qu^wWGL01)ff^nHl|=R zxp%x1Uf2HfqvO41IW|ihmzACc*O6<6$t5P~*18*6R&aEG>VMKOkb22xxOWv+MOn1^ zb#?*QW4u^P0Sv**{P~qCl7dUtd{CdpZVFnul>+M3bi7m;OgHOGE9`wZ;y!+=oR-|o z7?s}h6H|*`D~FiN$h)xZkFPhdAfhViM!(LDl^?NGr7Jtjs1hlf7;Iu$>`O!j+qNtX zE&gu2?_Dmddw>O5OiE0w-J&)ej>As+swCn~0Lrr5#eW#kB zjY8h1DocH|n#o5+%Xt(53x_9j*GVMi*Xm}G`9dYQ_SyJ?*j!Y?+GDkX>2Nt3Hnf|P zZ^FxCyS*P@O`uS8Sjsl?^}r4ZYrebFQk}xS{7L&A3sB6aoFu7$s+4(JcY*#C2RMPF zAMu{Ww;8U|;b9?ePYM~>>`0UeBc+h@IrKEcwlSv3yga)A7N%*s+0UR|4tePq`HU!T zD@ye08S(b^;>`P*CiB^_Sn@%n?d9VwL1~L4w!TR>*vg_WfjcSUz!oLDrNIk^LHd8o z%xMB>@X-1;{k-xgX-p{%)tJlx*z&GnomTQK3=N13G955vST+JW3L8FBk_6b%MbMu_ zQ9VUH6OO049%z?;{L1;>i}&Rjg_yDg^zR=*#9q6kow|E)G1+53gqkEhAl_f2uBgoY+U1`?YA1hWpwaW=}X z&-q)jJqHdLm^{aEe7@xjW$z9`B6V!H(*{?3LcbF(rp$ z;zg#~I)h!+DAL7kx`wgdZ^F`gtw?^y`*~@Sa2v&U`}Yaw2b<)rn0(iZ>K;Lp+GCC^aRv`Rcs4qm+ae48nL*J?A?mjTfW^po%LDVM#T1P-rkpsM$t6X^T z)B6&;sj52rdcy~r4_>-0wB6RObIpxo(U5mu8?fuW9Te350z3BIW0$uiLY#}IHTlG+ z1^SJXeHmf7L8|}(9a}x?iJ#v-wGk4|sZ${f&M{^e8;t6oT>&+>f}@7|C4C_2qSd#Y z_&kmLN&b*=Pb2fMV1P$uT2fe?0Mt5HBR`=~p9BIXvNefNlR%!vv&28Nn|$WB`5k|8 zFmvm@F8U)xTx#K%PphOYF1vZlQKH2?>fa)fJKwkJkw&8uVS<8>Yhp0mCrJ!)(g^6+ zt`j((&gnmXx*>lYl=20=>3Dzzwh_eQlYp*|yt#y*^cFW?I8neqIcRp1{mn z5w@t;aY0kBp{9uL$46Gf9ht>ru|c~BYw3PHfGt^J&>|Srn4#S0`ZMNmeYDrN`eL^o z_q=JhlicA`%-tioWNtJ60=-7mdnQ^tia5krZPJcuwY`a)z2F1vrv>TbWOD5K6FJkb zYCS)?Z&i-lW`lKo-Ru#R8EWg_E8yLp3$K|j52KeIozy1RuqUOfvTnItj8Lq#=!B;oI#X$*eirl zz@F#<*jLk?*~TiDlKquL19>ow!}S570v5!0_Ykm|MiEMio6hCI1d+_}HlVE8GgkQg zhJlacfeb}L$_Ls8-vW5oTrw*{%0^>AA+v|r!26zAPn?r>F%YVj1Ip1FnGM#XEE7N` z8Rz^(qNn%*_6i%(ZZyE^^?dyxbEMw{->%PV2!8(waQi_g7k`DCY8%Al)?rknVigG! z$LlU?zmYX^Le$-hrjuDOXF$j&k4h8v!nmSr2wxil0`lHaWIUG*km=?`?7c#tE%G7u z_{OvXKR#QI*Q>B7_8o4rQ_vWq)$G{CH(3T1@|Au*b%pVPt!$Odiz*vV?K+7Bw#(s; zgE|gS%zI<6Cz!YK#;cRIS@NUua*9T;elGWfX0%uVg#f_4W0SDV)VW3n-ahzAI$m^1 zAN1mNT)LkK6DfBCeWMpNwwlKr?TNkOV%UwDCh4wBBKoA+6rjCG zi6{@T5Pu9tNGz6+LoI4S)QA(yXDg=7?+d(%amoA~B0nYD^^Ip&x}PUn#t6X#33&z${E5D8m! zozVI%!1p+JLM_y+rfW)-7T3Ri2z^!nQQa*7`LTq^`H%ZP4i_Lg$Ll~E)@tiu(=uR# zC`HTSjy>6x`DLbFh$K^xrbSkh`4aU=3gMichd}BhQIq{`-a@d?q*g6hCasD39hr#O zR2uOMEf3~ZkOKc5CwUP?HWvB80IcB>BgyAdh4H{K^2<2fHiT$wy2lEnU z&ABk?9}X{wgq(OToCQGn*or{K?_sH4h^XVbN>lE#JK z^!wBfWjtj~zedHIazR|t%*w?Xrso7Ud2_s6tZ1Tg9W3Vdfq9RCw45O5feI&x_z1|Q za}<^iOi>L>VQKnCQ3-3VZ0qa(1wl(#aoLKO+_KuBmD)u@!P&erej5^tBUBp8N1=wnE~VPuiqo z9AzvGaM4VwSUS1)gq^m@w@q$S@d9y@c}IpKq$uhEIFIR^m?K3fhXEm%m+OGIJ-NF--J$% zb?b7Wkoe$6!+Gp6a!1N=1OY6OHqX17sE&lFtj{PyS%tg;q!5W}90Oh=XrsktLAo*u z8d=p8RBilxWeZIl9f3@xTB9d4l#T1hs{jb>NWfz;izRx2iXX&J>&JmuZ3>MAJrWav zUbjx7RbIDqqnsezrLBRLc(%H^gZzcs#IXiU6cH%F#bg_q@$}tFmn;d0=bwHaI_6?I z6Ey^pz!$Wd!7n8$8@Hb!z7RLE*~0up!RK(r{>`FKRcfX!M8Om^ntHc)E(?|c^~^?H znl_!3XYHn?`$z%8J($ugE8x1x0my_82p<=1T#@tH%NNi3j-7lDSi_&Hwm?O#;IGwM984@ZGRxSe#p-DvqO_MV+h8%_LnpOr-6LeOAu)k!H4W7uxjb# zX%y1sKPCIZ`$6ccM%$!2owL{q>6=`0lkiH)qm9uc=15|u-8Tj2=Iom7x~u)y60@>t ziu-SI?GSiUknNGiQJCu&G>A;XQZ(gID3Mi>!wIhF2N2df=iZ(>^=GR7PkkP;$|JMv3^cf7rzK>si*CDJ{wx`;NlM| z<7EkQk$$7OM38Ot`Y6jr$3!HhPH)oJcGL4U!rOBjpeg0rjj|(zfIf`OkQ$H6AQ?r? zH=M1N*s@HhW>v872-*g}Lnj^=+7qVRTYz(`5rDcO*+CsNwJ_%k?_W@AkEb#2YMs1w z_b!Qh5T*2H0xeDy z?Bp8NL5{*`3M5`mMZ}R?6ZJCji7K08#RhZfm=+GjDO zN}AN#RxdR_huheTdQSL$TM27-zJc54MAa8ej_Cs;0ub{E9W&A_=KGxv^kLMbmv;)iM*eQ17?U${*MA9m8^@4+L zfioDo7#4$R8u6j=tnoaAGFOZ;QIyrp5vom2ggHs#$J5Rm=~HU;O7}IQ@3QNBsZpC@ zF(}f_t`+x~{v@YRew9wdstMsu+Q*{g?b(*+)ErEO>y?>$D8p*h5;FSBYo#8^-|_Oe zXb^7jUcsG7J!@3l@8$fs6&u_wz~-Bou{Bd)|0Mk4ec#$sJ@p*L1v~?^hQU-pYKE1= zqgOA?=U(v+)=~yn8p_HWp6k|3rGqJH$N64?|AeBl;Q)A3SVCvyTL#GgkG;liW3y($qkIMK8iG9L%@qu}MW!rY<_C*4nw7 zghd=fFvNqJuXb4JKG>ecI6}H-wy-*JmfF^&TeK}DMzJ}FyX`49NMTIAss zTVR`&VGc-v$}*B058u-@pL&(=h5vS^_}FYg;P3jISjTPI!xwU)T8dQ$-S{knzh&5Kf)KlSQ+T7vPNpeRs7))?<7;RYh!X)FzH+YiIZ zOoVN;8`|>nfB<0C<_m0c2KMJw&+_q@Jl^00d8oWJra2C!_EjNvF6jsn6vKLv&Fgd@ zzZW=Eu>{~s<|8?N@dAXH^T4-)FnbNM)=N&5AMZ9oDoB+1&LIN8H^)kngJqijTpL0H*mwrmT1#tPP zTiy@uvZ(3ckZ(-#%{saY+NURfJP^6q^?_&ArGf6@f$m2QK4ox*JcdyS-V~^$UJ=E? z`kLqDHLR_$Mv0g&h*V!Ld@Hb$oVeK1JY#a8`uROGVl{vyzw$MAb(AXPy8dauM7O1=;mDH`D4mP-B@(6&u z1(rw&b%*Z02ocMD_&u)qtm`RVrFuhoir?JBY5kgaQfJ%^@%nhMM1p-}iSixjD2_lV zvik%X%E($wXp2~o!$sqWxz_h0{rPJgQ&Je7lFjT)uVpms(gebAM`kpxgV4DLb`*;k zLK+lPZ-P5#M?|4^dCu|2lEsi1l6%ze=9o7h*VGZu?)Hg0;nE98(1?{pz|`Zm5)FL6 zcI&xQOU=;C?u%rFEc~fOiv`o~`W8_H?f|HlNTR8^?Gnh=t4hDT{p|GqlK54E6(n^y zTb@K&b_>dVxQqV*y1BGu9&y+J>YXy?gW4G$V+E?C4Kg29iK!i~S2R(aMT&+J& zM9UC>mYGqBa<$3+FymnhZyb?|r_nqMu)e&D^@;M2TUISJW^ZVvY^NXrQkeU?rN$vT z7Jy5og8Go_0ZR5Q6tjCOU)tI^m*xe2!hImcu8<2m2s4jKT%MGM&2_g zZB9re7;Y-V{sO<3sL21uYX}(>@gOm6@^^#sRWxZMDHgxJ-v;7M;U`ASS&MkwsfaCL-gP^;-e7qet@9+;qnq4Nd>WCeQgNkF_BhGM?@w^gq|Kj7b3vz z4w9PrN~gqd1Bm7ey&``l_39eO_GcL?a?dA$)DJqFj4+F3grFX5ZGszPQ67xtJj7y^ zR+1o8zH`&CtF`Ds4xshis>3ex37yNjJ!9p2b-I+NT9Q@8d*mT5%x1=t#_H|r%WM74 z*U`N9trUwUlZ}gHc$9ICJ(Z|aUKJnMd$jV6y>%toRyc{OG}EeHg$!fpax4Ya2dF*} z#GLFdR~joL=G5m-2=~QG{pKR*j$9zZ@(`|n=uTslGV-E*-wCKv3Vg-5t{UnL&7x6O2#e?z{$3>^Fi-g&l+moMFsjdg z7?^av&fQa*DXp3n9+IhF_shtT+SFQum(?5UNjJte?%eoh?IB_L$t4T`aTW3@QFh)el_?-x#oMW24AmQYWs*b=UqzdGAsm`;_Ha4P`_EY+IkVOw_oe6t#D>!cAvnkP@Kul=i{l zx52dkt#(W^ewn^gL7nqI609b)C!VK2a`)Qc=|Vhy%2cB9--wIkixfFgw%fI!ZB-Q| z(odsl0wnt$L1N}taJeQLR2_GWJgh~Ne(K&7DRsXr;yTR*(k@i$lZbWQdW;gU*A47g z!zkimf;-&BGM=ZTH{n}Vy~dEaQmP8dIMfbmz0wR?c>5DS(D#peK96xg9Yz3LBUin? zu1;ayra+N><3@)^uD*($-mPFf8#WhEcD`Zu!jEpMwnPn#TYOO`JPA<4s;|37zE^x! z(2QnJ8Bfx#vY1Y@p#JbRAyZqsZc`yOK+t*_Zzcj#ZuKn-zoRo?BMW^=^jnl>4Ob`B z_j|pbD91vcRa_g0tqWg=|_Fwa^7B-gEb zSg3U$6SE{K@80v?{Ei-GwVniyWx|v^Aycp)EK}8X(brN@_6)MRaTxK|J(=kz-{b1W zpb|FP**bb3h??{EM4kHQBH(P(i9oI3C!1xT>uj|}iYG~n(+G9X^kgN4iN_K|Ww|8` zGlmPQ7DmP%{)Cs%gKc2bB1nSE(n_y#1-M7X3YlB3UOZ)N^Za9kJ=;PHmI{TJ79?X$ zyAUJJq8=N+X}#;E^`?n*VzP}-xYGzzJlH={+h!WkUP@YypeB?j5t-DER27AliFa=( z-5C2xzaG`JGGeBb|D~w!<~S2|!S&Id_tB(P7JtrhLu@o7aoGaa#z zw4JK~osBm}lBh}1%A9S9o71(=+07H#lZy#U_GWODpDlI1cC7JvUcDX7G2_|2sjYrn zvp%JHhG9nZr%7CK`o;+-K|A|C10jbceC+64_+7CW`lZO`Smg&v{V|kIvx0}9I8y0m zV@bC>lP{x{Yu9}|(*gL4&|uJmXco88j{?eu5> zIVZlyW+}N*Rj=mUMsVA2mW3qFRl^>>Unj8r^eEh(Na7STFL>PZcGgR`M`#;QPgp;l zbZdClJh*b*!!5#*E4*;1opxv@EQ%dS6K2d;6nZ<{S%{ZVQdN=V9~OXgB9*KDarm@c zW&6^Ch%WiH0v(nP;4Z1=Ju9MVCYLguYYKX%je)7tcdA$7So*9`P1U^bUH-&^8F$7( z!Nw$~(dBDM?n?s@)okIC0s5hV9%GwlHy9nlln0?s8;6D9Y*^?m0u5|`LSUN2Ye!aV zSRk935zMg&&1dRjDEhF7&;(k(+uGg`Oc|VXFIKQr#!}m zG!m`Gx>v6Rna#g|Ig-KxgOA(NRU5oNJrM zMh;O#s--MOuL{m5E~HcQNQr&S2BOXtxr@9>)KK7S3jH(L@OeuwVB6Q+79`Pf1+-P8p^w*g}G*z>Svq;T%Z zJXx)7?Qo}$4d(O5zUM#1GIXV}V6g#ARX!^x2!SiS^dcVN9014?vyaA4L@`OvXl5Txt7=oHe?I}OO=g4Ay1G|o zB3Y$#&sPRg{fC2S|WrfT2@L1;BpQVXhiDpfn*nQg|snRC^0O6bdBPOnqZSdl;PtQRLv zHl0=5%`pSL=m_uO#@He+ zTN>P_NktBt?B!ca80b%2f3;+-c4*Hp%`O2eK_B$UcPz!>f!O2VCTVF9yv(v(j`r@Y zC{3rXDRJ4XnD|lY;@vkdWc1KpVcV}Na2M7?U1{4ifHdFbxm%V{qdu_6&t_LhQmJ_! z6pEt&m<@L2?+Pzx>w;ra|G47cWpFyYI%IIN%*B}0EEJUANT61jbhTPm{@@6rWtgXR z9whVKU8Zc+ET9c8bp!PkmW<~%3J1Wgw^-C%Ix~2Qtj}3m0xh~P(rBoeEEa@&^&fAn zFH@zvCQu2(>umlVC@}MO!R2Dj3nPe&!dIvG^Iizl zc^>7JHn0~=Pzkz8v@>2F4BE*#te?c9Q@Wmy&t(Awi|0GhKgE0e6o0QR$&S^wNwCE{ zd4LG8yrs3x5r!Jo8rAwUI#oyWMax&aKCJ+A_>bWC_c47MUp8g+X|kxp3vZA!gY)9o z1U9|83Wkay{>qF>w_^Yj)aNM*A1|Dv1N=r!PIX7o>2ew3YW?B@m(q?bGbU9=#dkSI zKATZL&s_#(#(W_SZBqn`z4p_Gh1*y2m+!b;Wr5fX`(p1b=%)jX0l_Z`tLlX2OxoO{ z#9y|iDq}!RG|!oMwv;BGRVzAj>-mO&-=E8*O=1d)+Y%Z%DX|-5UlSZQjv2(fZB4 z6G}TIK*eVzPRlm#bT!~$GE%jNS>aLrI6orqMC3F26c4A*>r@7{eOUYZA7Kr4&3}-GIBSY_FzcU3P#RQ`hx+?|_iOEIm zC;yYl9V63DIsERD|GD4)+Yj@j_!)u6qorm8e^&l~`C(oRpcqjprvLRa{~em}`!@kv zGX5BoT3x(tE8e^F;<+lBfj~c~OY;Q8#4kV#2kHk77iK^%y~A$M`?qBrdnC;PjNok z)|=9hjv%84gDImyJG&Q12p@7vg%bg>@Vn2+9P~ZT4|Dm5qs;FAeZ@-tmlv!ueVG5~ zPy7=s3H%cH!?Pjj404>_M5m=rIdE16hqL?6>m$s}8hLRQR^O!GOTEgO0y-6=^h9}E zla;X)kDb4OM(OSFF);k+OOp?r4z%=#E3DMXYuiI{r{c=1Qq6DoJY})~MMUP_1ol|a z`&Iyx(M`c5vn!$srorKCh0$|fz_3;;H-E|ul!t^o_Me#dzonn^K8P@nD1)t!$n|1w zOoM%+7ffZRv!AX}tFTlB2c&?8<4GHxX7KI#5~pAue_S1OLmphy3TRFa1LT>Q2|~tCq7u= zuk}IWLEK!M7z~|g@4~!EN&nLeISfFP#oO*Q5zf^?d(A&%WUqjhl<-9X1+zp1&Z_dO^_@A&13P%L<@=Mh|6&l7V^Dt*KTkx z&EW96*b7wz64F5Fr?_VZbOLRBZ`!qG?fu*XoX@KYEFG@5*q0Ayq=J!Y0{@oy}VmWCPmux{tN3YUutlpc2{^-?U3_h_F`!$A5kp(PBer z4^Zre+|Qn@0}4(rm{n`KJzc9q4G9MSQ;#n%c}OYbUZOL&I1j)hHu*ekMwv7rcWe!j z!}ZYO%A>C@cl_!qh^p(1e8DmIeYgsf)STCjFe$%d#^KhK)}8i}yb!Q@Qg=#Zk@9t! zVlrty9|K&rMlQxH%}tpZ0Mn|92l$ImqpVeh4JDBWDh^B;_f$}xD^N^<=61ie7H$$X z1XnVn&kl5soddJE{tojEVYlEO#|N{ALS=0KEmB;e4+V~i5~j}`w4zd5QUasRRe+>R z$YBHw6Z$0>Hk)xhFEf>cI@nTTTB1uaBHtB0?&Wt{{84oTrizhugTD6WY~yp!lkLKK z0Lv&YN-EZG%$tg5(I|`A*q^R-sSAeMzb4^2beOELs>2x<=Qq_}>4p7;@Z$e+p|56C< z!Rd~rjr@;};{S|sxHnM6TU}bXtxyLb3bYL7!svVks2zoi(>*99d|{iU)L@~L4^ZLq zDmuh#ByhqZ9&Pd59nQq>=;R1OZA+*%Yk`t^JZR-S)hyD@O(;}}l<3CHhd`R!D7nV) zr|u@?^Sdo|V)tY2nHu50W7Fnl=WzoH-l`8|0o>Hjnr!47LB}*S!F_M>CkK-id+ESu zw*oMuZYB^?YV3HRWkgku6CNQ54~-@k4Cl1EC#6pFjo5?#_w=fLK{#dvO5%iXb0Hn0BoEa$oYm*JT7}^`&}iz z3P2l%O-d3%5Q#bB>Ro@nAAbiLK~!KrN&@()hhk|i6TZzkMan<-zw|1Xvr0Oqy*;_j>L{ZH<`S}0&qXRF*V zG3mkyKqN}YbY#2$o{``7t@f6q92TFy<4Eg4A0S@mHEyzbib})c#qhpwtmrM54+>QE zfbE~My2Ot&mC$NiSJ8eIcXGu@iel4pT|hl5`V8iH;5%||B1c| zx0l*O)FV$t<-dZ$y{G<{4PNj6muG#ig`^_0eS)7{ExfpDFcGe z(D|y5S>Zp-{ND}#pMKL24Ypx@cXbHef3co_P2}e2#BLWl%xaB=|CikBpFaHN8d@;X zRm3+!_(G&;|MjE(^Ed831=-a9yM_P!aQ@zc{@*J6-=ELTU;lq;NZ*Mn-l*_j?zO3v z$^Mlv;Q=YMrV$NTk1ub-v{*vyFTZNZM=wb~TAylf1FjxSgTS{%S=8e23U9fu0C-hH zkbepYda1B!s)Rsr+(AbFUJ2v9ZHHz)c=PA~k1t(3N0lLIZkOHn(oWx37Kyh1c&MYy zEuUOLBhigWtdqYI1hIJ#d$1`ObHJO>u91Z*VV@|Q+1sv#&9TAP>ErE=td=%?o*nUW1P{YYN^wvZZ=_XK#maex1*X8Bxk)Lv;;c<+_#{{khFwk zXq{9fUD#4r%!g)ue7c-Jkr6qvh1zc>W;txp(jZ*qj!!=QrUg5}4ZZ2+En>SjcSOaP zCIxVgV9bT}jtaT&^WbK$9s+RBHH`DQ{U%;(Y2;BiUnUB^tp3yS=u6v?iejlK2K1$l z=yKxg7{HH(_ctZMCUlTkod%_c&Vtm0__k>S@$;xSHz+cnFLNuS` zPl}5`U?@sXL(6dEDENr2Ry!(C-{+@akXo#x#gOmgy}Q{{k-cOgdN+R#u-mc4&>4At zRI-XHugzqgzAy;+nir@^c#1};35fc?OiurW|8bcw#^e_UAu-braUsTcdvu_!2NyL5 z^k9t%7kK|#;~JV4-?7`jtZi2gvDJ2`C2;Pp$k~$;HM;pJJoT4r z&CB{<7Tm|R2R?Ml5s+xLBNj4uw+U`rVoo>z3RyqrW`SQRBX2xGY*L^p*-90?T^Q0~ zeOO?}@n>3zF5#~FK%K~{JttfnW?GZ}*UeG@_k=FDvfnHuJ>I)xoQJ1&3-yD@HqwYq ziZuK;W@_L|3*jT!)dS_m`cK<=o5X^H;)5F;%zt|nm`w8qSUU}(iSu9PgNBH3%&lb| z^!F@)a&iC9SvUTac5AA^(GOD_?4SW+1cqM3vMP$wz-l?rT3GM@Ne}*4$EP7etEtS$ zuJ>2T7*x1%0e@nA$2IF#b^Hk}_xJ54e?7I`KyX>aY&GB;K-Cg(L`pa@(@!F@8UEhD z(Vio2&t_gQTW+CFT}vikx>^2&3fgY8=Kqcr!FUL$jK=_&ZL@PfEWMZHgxJ_%Ar1S+ zkAA&?+pW0#)u5QY`S2ZB^vWNaIT|KnfKRBi%8(Ayb`)sEDvaCrG{U3W-f!Lv7rOCV zCc>9@ABF34Ev0n7c0LyUkPj`+GBd#M;R{XtU9&+u0cr6I`13Cqzuq6r*wVz-CJN@x z|K%t*w4AirOkmPBEtjI@&R0Fq?wExLL*4L?zppV^3lV(vn}ft+g*Nw6I?cXuT^6ee zt>E$cUcg_!xr*RNpb&24gX-?{YwZFO>06pM&CvI~|5{2=r;}}&5q!2x{J@Zl-gy9P z;G@U=)>kvSzpwBm9`bvcS1hF8=;Ceoc7#scHhW5i;o)d|4@zQwufjc0b+UbV-|WTj ze`YHB`)D&Et*!it?cN|0hA|1=E<_i#yz;tO&h7BMe3bs_A*=ZBWphRRfjUH8LwI~= z`-`LKU%rQ|2tKvtbrRS#ZgR7F@bnM1;qAkJ@=13_gf$qG#!y=!*Neq#uVckK6|>r| z3BQv)nulnXGDhb}Tf`UMWE*DSfuQ*4|91bD@tghXNU-nx=A-;~2n`KZ;U`It{;Gk1 zJ;MWWU`K_M&9a~7g69N9{hk5As_d^Tov%c$5G_$3n8fI5YI_lQ!;iRm;pu`{8Ke-o z_WRo0F%gco}nJ`@x7IW=giG`>p(h{D_Ox`lmYU4xQn3+Hyt)cJAWU!JufF$3gWz5Uq^v*^gf% zr0Tus$=v;QVY}hzLcaS?nl9a5O#`yU9fPomzxT)v+LoP^#O66~We<-ReE~NQS^vc? zIJc-L&`FF1!exzE@@WdcJ_X$2d0&tO z6u%8xIy#{i489+#dy`6+vZNy>V`$CDx?}m8i%fo3=<)o=G!pURn%dq2Q9=f*+4u3L z-f&@N{e}vFe3YOPa?c2b+0NaIAmbyW$*uusppuzrg;Y)$8$VQ?D&#S2;G8c?`OxxHv&n)LDm-@A zwHl%c7OR*B5Am{KG!!ytHhcW^#TB8MuJ|NJe&(VNXEeKIbdzcb`PR_y_To)MP!mAc7gTk1cew{CMQ1Xg-#@8{dEY`!T37Q;KL5c7VXU00r5q);8`!HTCF@(yUaBCVy}zZd8za1 z*?wdfuQ1otNH4e85g^zq$pZ7CgWty;a)0^v){h_Xi8Iy#NCKG-ckJZ_hs5KfG#H6{ zcCrnoUh55{3GQ%u)s*Vi*@l2Js;^uMLqr^_fu{3H-@Ov|$ts`voKX7F!l~+P@7gk) zHIw;^jbg1EsuzQHx%nF)=qC$GYLEJ1b6asMtW9x0zP?vT6QUM)2U}>9nkaGlusL<| zq2ba^TD;c9bZ|R*b!efziu>Ap+766-QNM!%(D#WOd_@ZVWTV+)0T-T;^%tNp$T(gM zXMQgTU1!m&bBzJ@D$>s#o)fh$)fb>n7{hrj!!RdcEj(7}rQ998z}}t26;yC$UTE5z zpbEPxyfsz#qiJ!%M|O6 zDUV(|ElDd>=4n(=vY8iH;$C>G_+IQWhT-3TaeOB!$>sd8m;;Vb<2<>)rMYFoZQ-k| zQ*jDe>*l%AeAz#dz8Vy3*DE!*ir9~h9FF@U z%^c6^O@Ltl>!W!X!(bx8(^n@%OmD#`5cQroj$ABX5qH_1x3E_jcY3-3{PGRp09vJL z73$xA^Wn)G4s+Uq`ljcEBG*O+*2+N}H=YwO_T)#eX3@o@_kH_VmUveA?il)x$s(P~ zG8X->T|{5fm9H8+H6kfQj61jXzjXD#{ZYMy+ZlVW>C8T*bXYDn=ZC<+^TW@^x%wa8 z#&Kv2Z&eq66dAtqF!3|}{S7xe9G(EOZWJEs-Xw6Ax`t$dN*2azuA=)~XxJe(fSN^@ zcgA0dtoanW&N~!!3@J74&Uu>BFSCuMeYV1_@kPXa-U51l!;>uZqnM#s`cSKuZ7txK z256PSu$jrD{eC_JE8j2U1Xu#k196=p$87|8jtdg!3qnqdrjJYf(&?1brsY>v%=0gv z_rD^H%foBn-2@2yym`5yEwL(n^@U=MDC9_7VbhrK$!Q)U&* zLE-C}T;=%nJ$($|$MG<)X6k%aN_!}daff9-dSFuQT`jQPb@M6S!e{8OBU*vRZsoeh zs7Xij^=y3I5t((f$&r)+n~p8Rgm>Y%xZb8&+o@Ad|FH}7B&{rH!l>E_61}=G;B)M8)TW>W4 z-gKYU+hj8DoI~@E$O+aKg>T1Zl-SQX*nclkr4seEZR0mBc{sG8kk$ ze!f~hR#;)zSDjyfML1`lb}lQreo&wS3 z{5m;0R;AN>GcbWq*qAv>UAXy2?8nM{E*cMbIvt?NQ#qPZwX3;q8@ql>&_XSW}j(ttZBhPE6n;*2sU)2q%(Fqg~->ZiWa?IS; zdJEWl!=&^4V>1xPR1v7|WR)GeyQ;AF^2@Cx*1MtoEkap3l`N~XePea2JPD-<-d034 zOi_(u_v(#9K2)-q&;K9F-U6)3wc8pN1X+ZDptO{9cS;D-DM&X+gMf5{gd*Kt0)ljR zr*wCBclUpzd%y3#zH`od&hNFZ^7n362gU5fF?pRt3;F{b z+3yaFFMG=7_p=Eu=I`$^ckiMs*yHMTv&p^;ot-6e7aJX-&EDxQx(rJvg-Gt#n|31? zIi@7|pq>7&MUJGXWW=;S^_cR(YTPG9Yfef1@eAV)qk>P(0N zeQFDIdo72&oEn+$zyBdV>u7Db$w(o}ZmzyQ<}@aM4_yF{N@4f~1(z5|PlVaE3!Kf> zU02V~q6DFA%*%|$Ky6(9kolFw6HhkVaBnzGnSWK?c%bL5EBNchgUb$)hfckeQUrDG z&ctiM+q=(S;D0qj-JUojcBx2aaa|k-8>Bd9J`VS&e;2~R;2K$Q~J@yCC4Qij? zzJOU=S@3C&)DAe_iIwLfni{UK(7qBq6Um2I|IOi9>jX`okhJ}(DuF2c}7ib%;d(a_D!72z6PX2mh!!BZ6o<~MQ+2csuO9`fC8gFXir1sybbXSkxB zxn3+@3#$l67EW6bk#blE;M-$XRIT0EatflbW1Y# z4XByVL@?n0PD>Hmz}H6jF9WznJod0#Ngdd>&$T=Ank*{Iy&DziTNQTrd9=^Nsr1EP zDkm}MhDk<_2Rj-2wvJ?ny_ei`%|fe7VBc| zJ4|S51tc6o;au`JJA{Vt;%-PSB$94VToE|C_4guOldl;>Lp7^Q3mRC z$Zxb#6KTj~=_slLH-D{4tCSF~YKFM&EW7g<6610$zW%@h(H7ma@b`en>EqJ&h#cnU z!rZnG&y|PN>zt$p8VJX-Njn4l?IAS6v;|P(Qaj2NEVLD$6@kcduv+>Te{BkFwK9`b z<1fg#so|d&s)zvgEUwmgxLvM6QzNn0Wf%#G+!>z$4{o+>yFaN~5lL>_{qhlj7B7Mhe_`!NM2rx=-Y?E_dZUloZ=*o3!FyW2MTJzAVKS!Kp2l)@9Tj76 zA~!8|+_e&Sk^W8;(RqFs65NkRVpXd#c!@y;plDGbA_0+WIJGoH9Ao0 z4N;LBhuJ}EAik2T8UH?vA`ycQW_YV^M^MJR&qOkbF`Ae;S;6=Hjta^y$HnjS6(+!_ z&E8C(|yEEzdr?tOKMf2 z-L#^cYM&Sov|KSWbg8Hl&x^Pbe777NtU1pds+QueW168BkmIW$Ok_H>j_>}!qwPkM zGoezlW@P4@#B(h=YQlQ@>i!jT3(}Doh}Esj_A_s7arrI=d{5tZNNd=la;qGrJ0a<# z1i?gTO_jQNodfwar3_Eor${~hF`Uy=NR}$u@5Q8sJCrF<@HpPaRT$Bxbp$YX`NZI> zxJ+4iJf~C@uyen!OPAPJ!l(@pa_9B9e>YcKY*?TbASC0%FR4oL`R|hy>(Q>x4BZWFeRe@dzOXm(yZ8DNAZ zZ&9=O=}duCNvCy}VRcxeXfl@jYPmz|B2F&pGG(CDuCnu`%eh@2T!z^$I^#iey-0!_=nOeMIMDK(@O^Z0a zMn~yCDjg_QLHub>qyNrOf+oWPpv~c_f={r=AGM*$K(kFn3^#g1vgt;}*Kkk1x>UF7j8RWf$S;Ota94Qn$mpUtp8EF+?xPlMz}}A%SM3J4+mgOEMx3i5+@sj z<|=Bp->mrtni5d#eJwK^?E5u)JGhL2h#3wX3SB(IVY;r*krTw6ZD!WJ>{FF$j2o}3 zZvZaeJ8>Munb22X0AZ&38v92?OjpMF%C~(v`6;M~@Y`QK{ka;KAM^fLZuJAy&cV-n zJcRGPI2QLvf)33FI+P#j759LA;cB^6znPzcMFeNympcSkXc`B1PFr!*W0YI+%I2X= zyIoaP_LE@CRILs(HM!x+oG*rcfTljXjaIjj+kbR_^4!+*!RW=3RQwLnZQv))iIVco z%8o_7tcMy}0ma-iJN|na*do2IJ&h?xQNK3TQB(owv>7T7 z#>$uE(sW}dk>_q{jxu?(e{JvZBE#&73;u~2E)~l}C^kG`n zEsjlS673|kkFxa%x-Zg2naOS)yPx$v=Kc2lc3H+FgdZ9P;*CZK{z*L(LWPtoY0-FG zP$|+(@IM!NM-wrwbf`c{Oq}w3n&3qd=5q+7;Ja>`Xa|&^X4ff%FGu>zxR1L#d{xFTPX@$l^&J zv;{AVF}#ia0%mavK4Odm7im1KHr%l$Nk@2M*imbrqHohRkf(2R=A4HIeMgZFd8(90 zf*wt?nnW-@&^y>prfJ+cI`brH=|KA1I^4Rww1pn~ku}Zf+fXYIR)tD?=*6yIvaP!z zexUIRL!cp^b=sy?#fBvdstZ);8@HT4x0RC7OSg6l66s^9{2L9FA=r3}O~n${MYx3! zsA$oYOgJ1q@J#WtpEq@H3cg#YSdsqwHirIq%<=THvk7n|#>Et^n^t)F|B z(0$B$#*t|~e||3MaZ*oK>l)awH-2Qdvza(DJrT&n5#{u%)8S!VGl(>fS1#Xa8t1oN>cJowNN(>`xIDEVN2K!AO5QLbJb1XMe8z56|BIk6=p| ziF>#I!!`f>(OVuU1f#S&48li$*_6La7yrYTo|ey2JlNFJ9bf(r7yMnG{p;^|W|8wl znUBo>qwe{qvi3hcqtZb?AMo{ODfk-(`;c__4-eE+7>bm@D>aWte~sGzR)B66@_?SQ z{L^CjfBBW~Nnk|Zxg(Uo8BnDGfDSFKHf4u&k3>eX@ z23W}dHuQh5YjrSXPce-(|FzQp^Dh!^!GjS!t#}0WpT_YY)ARp-6L=zk5AjH}@d=D@ zZz8e(_&t^X*bR+w=P5~^qQ>UjjU@KqIvs9lkktQSj;>KtJjQrkJEPtLrsM?kPt&Gp zW!hs#yh{h3g%|?UKEd@S2}jjD4hJc(xz~hZ8wdqKXBxTJevL@A-R=%+T><(R6il&s z_t}lGbhQdPrjw>7uD$(+ieDR<$>F0p_aV%EMx-)4jFLDkqPAlFkN?x$|GC{lYOrE< zr%KF}-lJM#_Eodv2uvZi&+ICRUY{`cclRaMtmLt4MYFo+M!xYP2t!%F1EeqsYntiv z%R7nOs|5|kE3^0Uq^n(R8z=Da@J`Mvzn)dOHu6{P4EdL7+x5W_Y%bIDUh`AEU+53j zs+9c4TKeyokhUZA$s5y4x(|=PM>h75CRZEvIW0dTq8)NVbUt6}GE8=*^n#nsgDvK9 z)}&gu=ak{S8F0q8&?n;McFs&sABn=CjgtUvC?}b2w@zH$_w{N&`UM3sRZAv_d6uyM z_gzhh^RP#s*7dMWg*D>dU(eXo)N5SljF-AwOn&cYHMNU-B^A$R_^Vwi{$+>f4#0H_ z0(15Z<%x2LS0r0irmq)9ojO84{uOI()D*cCr`t~u@)bl`J zO#@tWF+%HcyW!oqsuTHG-UZ6w&D1yXajIHN%gZmCr1SE zLPbGi5?;rIn6z{h{^o4D#JaScO}c1%kh99!&TNkBz}{quQUYv~Xs})@^MAO9zkbBe z0+uQpj#I38fD^QFXB(L>k7t%@#y7LcVg=K>_V)HIl83rw`j%KG$^CJE!%CVAuXU@I zV;i5$vjIDzN9j)$9Mmj;TQd zJ0_o}+io(6-^m}D$$FDbepfO_VcZln2!87~pE}7r!}a&hQM@NI4#Y_c%LLovb8tbS zCcJicTg32GnW$2lux)2Q{eVFbE``)An4b`Uj~A=@w0dIK)}=61GybCf+Y0CZVW&KW zx=JaNQYt1I6i!j|XO?2WT%+Tu`ynOvlQuDub4kUbHV@|K<r{iVD4gmz1XO?pI0qp zuGot(uYkd6Wtr(Dv?JsA5>re-K;Lm^FmC}mgrN}ckSp18zg~+Q}KL;E97ktGE5;N zfvdt_RzDlI?5kJ*-DP? zwzX_+h?#BTx!+L4dxOx(lrhwaIBK7t4;K@1Kx1QL1Fo1sIW->U|`S%U>N!!6C#(V%6hxUVLU`4Cc9VN6-iAFHaB3!yn@h(^d$3XWh>@o z!&WFm0$iW`+pbVZfrS@EHVbe>YHaj;^NSs$eaO zA$Y)pteUM7MYt%GgmVIViM@y}tii(Q*zRZw=kAw;o zoL}sIcm=W>F6av!+wmy?O$*(RJ(@{fcD9#8wV#n!v?fuiwRM#ZwebD(0|kDRvY;AvJ)Yk9~&LCAAMO_S^4EpUr+IZT5%*43RkgIFf8cKH1iZ483BpwaHo z44h*F49j8%mz$Z%c&Kzh>&?&4Z?L1`_AI{m0;3>rRtGUp)jJ~Mc^yQVzB1fMf% zNyVntLqPRQLQC7r8XEkHIj;PH@|yjL9gh$-rhrDRdOT%|$P41N5g^uVu2+rd8Wj_> z5o76x_3O=h7~Uc(h3p3g+RM@ePUH(3f;OC1)bST(wL4^PyE;+zD$-zdd3e*oUq6ayTzK z=E0!|7ZvYkoGxQWKtL8>?Q-$8%Fyk7gP$FXTTLjJk9s%s$U1eVQgO?`F+og zM3VEz++5`^`99$AfTnCd(DF!_q8#B^; ziLeL558x|3G%p)xCAmh?YtaFgEhg#f*|=u|0tb(us%U+tHEO|zW@x}H(}so^?b6H$ zMyI%<9!x5fJlpj`oyte#7^I^%9#B0nB;249>5ehS7y$4ax?77HwKdnv(2<|vx@_?s zHuSX|Z&VZJ)WL3I3SQqutFpJqe|@mPP<5UJ^=XgOkUOr-;ZQD?$-MeQw*5VwMqhZx z7d{%X(d^CR*jSaLnPWXbd8b5me@eTu_+>8|gSMw?+*-Y{6&bdajL=acEWSqT`u(XL zZ^Gd+X5U!!bX<*mc@|1@R9%~zYs#HDK6lTAtywUhpTe4k?&)DF$chxET|BWNfh-4= zZ0cQPNr`9UwC5blfgP;)$|L$Qf??j6X)ZlHjIj1%7j0P4r<~lbDcZ7}7X`?51%_(I zvmy0%(61bsPUqFiv&A;9S86g4rG=d)oIh-!W+*)0Uz9v~JDWkaJzQfSDT43Dk3p+R zTruYsyu`+5(i8eAAu!1~k(Sg`luTB&AG#3Z;Hp&2={qgEee%tzQWPZ;YF1z3aXH!$ z8)M|07O^A*pI3c_US(iC&6S3^5gR8Em(6V8PJh2(&YDe`0M;2qi6SdccKFW&Ez#`5d1!BwB0f6LFQteLRoI4=SP^ zV1{53#{wTg?JU6IM`hmMMkKg7F@uxKnCa6BGn3nl^;C9yUd22u&;2C|_SJ&+K-$Bm=ES{J8&h8V|mCBrxfhTwuv!w_d*lw@E&K z`R2~`w(5s>DImj-KA%g@ks7t#n-O!;u&rX#U>7zP(zG|%T5YIKrE}jZ#r_neDl}QI zftwf0x9%0ZS~0IEYT|V@bicMu%E_sc+1+)e#(T5D43q&SS*^x}Kh`d))^*|FKqb3e z`Ow_XpQ9C!xx72W-pYW7qGmPhbCOuS1PUh>uf|Vy(_Ab_5m+ea+}1TNSEJ``dB83B zr15g4P4iup9w`>AcDsibto4qMS6?jQ9|cR$4ecfzH;Kqm@@gvPtI~4Y?TmbGw_4Ux zG`KFD}fWcDm;q+i1oR0R~Zll!~mX^R>aOvK$pl=m9G*)KAu z_T#6t%6G{9C^28TI%yDr7Tm$j0ebLXR6u}5#)fFoA9TLYM>sjjZA$=ng84xN9|=z{rATdBQp<#x?(*Z0n#O@l zN_szZj7`G95cMa=eu>pvP67n=G<92jnU4L78(9AnEUi=l$LKDsW$`sF_s+?eeG&Dp z&Jqbj#dw@s*ohx^Dx+76CFswx%s(G)O)}Dp2cP7B0v!EYhj+1tS|RS)@b$=D2rXAn zaaUVV_#%Nx{AmcSL@Q;{PfHhxxB&8yjJW_+&6PE4-Om%`x}NyJ&j2V$Pg`j*p}4~r zc^|^um{*OAH4gbrxU@3+JD~Cwh1nq;aSb=0!>V&=c5swVc~ytqPh7b2UZw7uPUR>O zjgW1;|0!zM+RIAHnGCTs>>%p z-N8Znv4Hq%^gLNduEgngL0OLQ?oh`Fg)BvOyIhyo`?Q}1eRx)u{OK)~5ifw_pg%W` zID(~0FQ-NosTHDY`9>u!lpT!-_`aj_lt6Q^FbCmIJn1a{kwi3YvW)|8p) zaAzl58gf*cM|uMAswHaWdla@>C8+fRSctt7?J{R!`Sf#?w?FuZ(3uRjFZg{*Dr|Na zG8E?0h-w3a=}`qOr?UoCe`>jhV=NKpmwM@(afsBt_vHCk4uSs!)xmyKxFFC+F|Xkf z(Ms9v$Iys~sVwwWBu7W1DhEt^Vj+xHIl=7mFRM#n$U|w{ph^h2$e!zhH;b zMA#?Gm_pI?@SVHBYlqbLg-@CYdzZ?J7h4C)qbW-L6i4eYuJ0V`T5DxhOf776iR^xd5Lrx>M z0M6oK>e0X=Xmz_MIcly`b~XU95F_jMf_?`< zAQX{#%|Vn}oUbOSjR7}q7DN&cf_c-F{foVlMxggY(4yra#sG&r~%8*gsSJlEstN1W-Q zhjgBu0V1E(BX`a0G80C757_nln{`r?JKgvhUhNdQdhYbzjrse=S68E6&!%M$Q9Ia#OyREIw*D!<10sHux`#{hva%^Y zUBAC3NUTdkqr1DB-dA<-SIAFxyGc?_oZ@$)qD{;*fwoH;GOD}IpN?EJDOXSNt{Xtw z9r>BY7U>0TN401H>c{EFj_Vu86*Hgel;k<VZN2nD76;cMC zSGymGnTIm>n`LT!E}R-Og9zaUn9fe!3s;?KDQzp%#Z>xMrLvlk=BM_$_zx-HjkCJi z9QlZc1Nvz9us!hup3TUgM_uVwLqf&^uS(6Vs`0p;B+n(*kGVD#I==GNIWp76eA&mU z-H9TZvC-qh{(dv!l3x1b*&eP<#aIlTSZvRqKu|l0Uo06mfSM<@9Y$})%hsE|;YQf_ zEfRxt4barw4q#U8EEMtGaFCqK&;nd0j@l_LhS)4RfmYq5$9|8Ey4|iOqn&h~(U{c& zNM(!J%?&K}r+lh?&uh4?2!>4i;oi1W$XZp~aM|oKM^qL1BIBQem@(=?%&u#G(>V8a z2;7rSeIDm-33PJP)Gfp0+WjFOc`aA5P8~E@YjmZvYDG8sJ6ZYdaceOzq0N3?W;xSR zU8}<%Qtn;R$^D~u-|1@!HLA}m-(SD;VcUz!QyaDJ?7q^tMALW7S+1H@?>e&cI6tV_ ztCdQ=lYsZfq+F!S4Y--VucJSovHddkwykqYTpkl~;3}yQZHbm3rg3R(;riP;m1;Sc zhUr4HR!za>3yV`~q4FyPKKMePGuG3Eb52oljEbtnA-H?Na`d37iP6lR$*X z@Sw+G8Fean{{#HWHnxRp?Fv1Ykho4IUQj+jyjP`}v*oQ<$ID zo#C4J)K4Q+1Y=&rFdj?A-tNI&o!E|R(pJo>niUUl*2TKUcz^B`T$inPalAb6vM-%a ztiP`wyo|8f9ut~&wD((q`ZE>pQ9b%qT5^k=y`H+4?j81Z*hWT?;-97Vej81QrlM7? zeWX2eh@owVN@lC`8H zd^KVsp9|eq=^Gu*WxKTcL?8dsDr44Z&ylC}(NVdY#iy8K+vhgA9ZGfD-#7&8@UYjM zEX{KTSOvn#0t07LDpHNStgMVs08rOcyAQG!iCP#p4xv?LVYefdI-TYdkRKdTxwQRT{HunWf~B z^RIS_--m-IDjLORiO0JahUViylc=*|{;r?HwhP0+w_nabHsDd7T0jPFB(|%vB?Eej z(Dj1Xc_-_AwU`sN{9T^3k)GK^p%~Dg+ofp!D)N@0pEl@o?T#hQF|_aC9}k;|ypeJG zTHUL_-p;6}xs{PdjOX|Sl=QT_qcTkwX}A!NvGPWti$Sg_nK;FK?1be@l}^t~ZAR7c zy*5R@5KLYPp2=D}Ods z$|-2P`*Acs4RxJ*-WF8Ri+`T)EFInU7H}|mTf*gsX%Fti-Urx>v{3N!@o6P*JGmL| zc6EJ4S&f2LC1BApKvpgB@gXM$XVq*h2YpZDQr}CD z$V2n4YeVi9a>i6Blyfye(x}ulRVqGNOUfeAI@*TMe%`H9UMm3P9coQtBTjG>yWF!a z$Lh{dhwgTiMEyruHAYu}#R~9vK@TBtzo}vqf~f66Vsdle)%l)m*;er)ugrUJU*%jc zr7v6MlHDmz4vPGmtCGLFqL!GuZBQ|3q^RFULqmh6Ofr4||9HTB_vYUVKjkBi#1nbpqmjA+tqXA+LgY4yN>IG4G;r zZFzZ=V^PXEFND}IvWEH6Ct>1Hf!^qJj&nir%lz{XluCUys8e-j%pIQPsRCxOlkte% z_-#$7txJ%43vTU<-Dzf)Veb9<{kK&8@ylCc?b-p+Wox~0Ti&1~_>-3^({;14qxWkj zzBMI?5Ks>~y-cw`YfEMchM$Y*f9o7*{!~SX@>iNvym6=G5tWahfaE9Qm6e?{N+Tas zyZ$5|F4{YtrcdQZ?+h+JS|=Qo97p0zAMQK~oPmotGY|X3{HVc-le4WK?-w#Aq_1h( z+TS{k|BN#VR>1$Sffe`XFAbiopPOVXc$A~zVBm53RC%#cfF9-|)ix>KqkjaEUUGcB z_O@jP%4NXqX0ayd(l)&f`iQ_?J)g#9*QOJ}b03yxNMq^sODtQazD1swL}hNS9nGeA z%d-TC?TqW67pS#mCl6j5l7QDrlhYnZ~%~dYK+d4Ej5IuK(&DnPaK)qVI!0le`FG}u$ z*zTBRPe|CdU}=bHAPP()Z&`<4mCAM4YUEqQypa~`9O5<2QQ*FWUJ7IQ^|*zd_6ADC znj^n7e%5Ct$&p`FE!T1Bvet?5eU4G#_lzngL?f4gQ5K7aKxvT$6!0`Ci>~MR4LEo!ZUZX3Qu=o>#4H%_I`7aVx0|)PXHfVC5xs+QFki*6 zy!GHyxv=##pkh%+!TTk@=GQ;?10EBkJ{)9|FOG5^k_B7Q!6p5?5(YU(2$5tInpD28 zPqJJZc0_jh%Fai}y9rFkOu_*wu{_lE+CNzf-(9z~Sej8pF0$;Kv)|b1-&_EFyVQnIyuO@|OhzuC*K*XRKx`l*`I9Rc{3`L~xi1v3|u?;zYJ$>c5K_ok5 z2<0_mqyG%y^I&iMeFXcQOGjooq}};Kyo1BHjlYo0$9{QOS~xw>r>ZEepCUAjFL<6RFt~I}|BBfy`elgNONr3_;XSqFSQ2!pt zldOh{Bu609Q8Ly(SzuNsguymLB2ig6vWFQNHzcq?5;` z7WCEW6TKb1>>35P7eu}2!F2p|2?{^4UVRaR+k7 zr1KJI4yXY>q~rsK>D1O;3UQ!)icGI(zYnM2J9LN~ur+*_i8{~<2>XByg*dCzE3bCq zvj6y%>h*r_WSv_5os(w}^BSS0$0gqDVIQVeJT8~_DrTH?9V6?agYQ(5BWYi%vLdar z(#R_s$FTUe=aM(kl|2TYj?Q=o>eLr)*sT9VAg4)flT%D?6pR>iL-_pm;`;dZ$E9K;l z$dpv;&J3kakOJO>H(lOR7J_#FB%JlG#CNQkH7K!SAgSu4SkvUYb5K9`E&s@N6JiLW4&f#w2p6}v0N17`Z7d7r*l-; zcdisgQKE;sWCjI|q{ova=UNG3#FsltaV~&3vP?FxPU*$(>R6>#U1q=yvoa5awj&H7 zhPWYP@u$waccE-TJDn@ENwH6Y*`!=T6Ys{N)1{+sH&4?DQL)R(WStT=8&V7SaJwyz z4qgQ(e{$+tiEee(&!1%Dz+5v6>f~_)WzEmgJbD3Ey!)mEIbWMF(HHuflx`D-VM~H} zo9j@GH0m_`mvgiBL)NXvw0(;(a7^dwlZC5Aryojp0}H{y>~qV+f%)fG%BR?b1M}wl zFb?gwP%&(KjzU_Ox8wV#9O^&iZYY<(RMcMZwiM%FSX99ojp;HS?>Q65P8FJJNGIob z7cOh!Eu*cwc^p2Q=akVaFIdMo{{+n$v{poeDxDFDv5d1vskI-1i1otD0yEjsVs-7Qe&y;!y+SmtcX-~V}WxA?Ni30Azf=%mbNrsx98-{}NKGNTE$BENc)lrjt+Z`il9q*8K%}CkmU!|M=eg`1 z=+U{93jXrAmcLpCX*mNsoO18b4KZK<#>iholXn24mg31(BaWYjS2>~gbsOeRE(ha& z0g7wghwCdkXS5$nsxg*_cF3P?WuVOJR;}D9aUAv^HFYQ*C?ZcST25BGPS<<4X;+23q?dg(ISFIiPT#Bm;4U}MLvgt464gxcVR zW&OA+Gq6^_s_e)b+QsD6!exgE)H$MCd>$JSGSN$nvA1${yH_+G&RhfYpHBQMUbhS6 zjz`{KYD2fbk!eLtZ2JXjO1W*2sTv6(Pvh$zQh5$}(;CtbQ53R;o%qW@}hV>f7pgK9G%%lwoQ2P$XKc zqKEIn;f6En>BC|eYD=bJG18gCQY~eUc2Vsj3(~l4YhX~74JL0!1Fh-)pw z6_qm)`A51tSV>Cd73?;(d?1E4YkAe@I`qPdKG0n=^Y9d9+*xSy$Ct}D>z$AoIXX;v z={Po@DziaquM|=*Kg4yL`mVLA4dO!WCg@Gj;Z1q|oezP5eu-ZD^JusS#<^Z0%KN)~ z6^!-6+2W~{3U=uWspbyk2Fwlg(l$ER<-C3@0Gdaggz3^vVEw9mYCq7`51&<&35057 zh#gI5==b)?L)8sOdKY>R>rb4rolZ&2^D9sC8^iuYlOU)Pc;lg0PTi*1RcrOVc&Sy} z9r_)8ice=;!fcyBOPEasJ6}l>OiACk=e`QW$dL9j_dRTBSDN3kzJz|m#C`6NHmXeX zf;bhvYT1_1dpE^<83Yq~xnjIKV;yMD2~=}|spYVAS!@9-_mS79VpjOM1Fj}3!$ap= znnU+dxF1%t`Briq=P7FTZ*8Dk8WC^L|vJINq?&SjXxd*jpF_vK<4pxJgBD%WDB_|ZLDhxF* z<^r#$m{|_bTA=S{TLyf=_+S2#;wo=KW1!UVwT`(#7`**mDl*scUG!zwSLa}nf zJxdQmn$ilxVNgTtP2lW;wIf5A4O^Ou*4KAwn>rR}TdzSF!zzi*-BGij2~xzW0-`kl z=SGK9zGwXE8Vg!Ua6qHqP{ALzjKQ^5C4-u6IVPr3h6e`o*H~WWWzY6LiFavLmm%Kg zSyp4c^dwzK_|OykSu>RTh(M>vF*T3!N$BU@eEsh<1qga8d8u#V|6nzGwWZSY(8j$t$zF-cO+D+ zMJ5%Op0~GfLmI74yt%m<78*))yxu>4_fAL3c%jkLsUae}UH4yWP?R72t16T^g?Gt7 zoDZj7467aTtH@v#h+!{G45u%jY79qG*$Hzuf>AIx3um3FN%av0o2xoax=)H?1Z4-Y z@rY3#n>|uV2kGFCKzt%|YSMHbW3H)4#-Nm{nXM6{ikNb9RiHWE_b#r-F)U`ogcpjs zS|kXIE|@aB6=Fr!(^CCnpX2RZ0IU{AP@=tMqR1B>553Hp`ApO3AJ^x zB_jsYL+Axw|F?L+1%Lib>BN<_cndqRV!&(sz<3|jqDul}G^vXWy~g@XPEL-5n_F%F z`0uWLVA3PVJhO&VfVU}P4381rYESkvx3F}!Yii*)-6iI`GP}fF^@-GDW znl&F!@*D)BS1v1T@1|1jhX)6KNQqNn4D3xuyD%AhI1i?YsWA-?K5o(H?`hHBcL35~$}s{TL2ev?}J)r=1JNjxin?;KH482AVn|GUT}^ zSNR-8wySAUx3+W?Bu;2>XK&yqKJW0J3GF8 z@Qru1~%A}mkMYaA^jWbDfRiQ0d~fBybX6WW7} z`U6VP>1>CR@8-bkJ*a!evjgUxY#@p#jl*U}0chl-HS3&W>%Hlf-U$<-KDxGE{{RWt z-8zC7pf{qJDs$a1Ek(fzT{LguM0fCp|)rC1Vt%1v5stamfM5s$n}5A@ZP^4{F2nCpE0A&O{hzn>54nvq`Bs!2|S zLBYYp$teihWPggH|Mgkona2}qP}kl4FjwpNz#g8L$7M7?_!7l)2e7T5x`DcuEthMf z`#*N&HyAVe6doY*4YF=8SOjF6Cj%Dc#m$B|HV}jqgdrx}l@Mdov6+09)EqGeH{)PD z&TN=d=X7at+AsZ~S zov=|U4tk|m{m7F-Kr&4%5Qh~n&I3pbM}TT<7ie%KrKIc(P5L*sg+w;);r_rTV>fcM zcGI9h>38i6<*O5d^R$d2N`N6u=h1>U*4c9?8B3RvoWYFnz$o(#!GOLVxw37UglPH$ z5N#`r+x0H{<$@Oq(5Kgf zGa2O~eIZ$~)bfu-vq-FM3PlTJ#bAMFW{J^vw(sP_Wcr$T;(JViH;ndC<%E!PQAqi_ zw6d`Hc)W;|v4L~|*-7&*)3pO!4#mU_reid9M^!*`qgcNi!;}8`zo4j|0}t?4oS=X6 zcK;c--_Nzr3iCYJ*zMg1npNz3RV)s$2tER8*#R*z&T8nU81BAq>JWrgYKmc2g_c=} zW-vIdycoy*Bxe4fa3)bf+bx-+x-waMTUpR(52pzi)`Btd?}_^gT z&5`Z`@`q9}{d0%tw-{U=!5IiIb`B{#$|IW$U4SlBdBr|ubj|&JICeXmT2YrWcUwZ-o z@-~;I%VFE++XvAP0C12*G(ty1yD2X!ER;q3MWvX#5rz>Sg*sOaQ1itDZ_Lbccc;+A z!V{Y25MoF~<|l+4@M+-IK=%O!?(Yvt+pg?C&wqoVN~sKDUeq4dLu@!(-+58s%{_nd zV$%nr_~B#5J}FR@`}h6^ovPxEcF?MV)J(Dq0|~YmeRrH^=wcH2nf^@}9jHSB@fe;0 zs)4B^_bYIkz|G_>=i5 zbXa?VKCcb{ntPo7#^4S#?&%zpSp4)_e^!dl8Yrmy2w4zVAd2fTwpOL*Vdp=Ej&a$ZZ)m8!zq@9#*^o8=R0*0< z#HRr#2588;(<%20c*trR_zQIF{S3l;r$$N1!D>fDsxG~m( zo_$PY6E_`dJ}IgpWG|#ktND_X8(7 zfA45C$V;f8l2pCUuz&64f4^u%hnj{Md13TXC6^4O2zgkt>0LaRNx-uLRlUd(jq04z z=Y3p-5zW%1`t6neRG0$iTfE)Dq1ECs{x;5KPt0$x;{QL&-U6!XZEGI}1Obr{5Rj0P z4iThlg90Kc-HmjYbSr{%OKrNl8$m#6=|-hny5UgSt1t!?3=< zng?uiQ4`x9(9q)gL(|&L(FBtA%Znqt2N(NxWiAJ#wjB=&7jkLdiu>Nq4cVK1uZ1x1 zE7h9AVT}x!D49z@jJf0qs?OBpI?TOabXD^8`KUSb#G7~&mp7Af=y6+oy zn1E)vOP8@ZS{ao1Z7t)f4;^$A{pu8ZDJRFSISmqd5y+qyAe+-FFH~R8r~E^cN1Nyg zNEUWmH5Z0~mM~()i{ttJYZMiLwyoBXV`4-Sj+nhD)`~@YI&VeFBFkLAug4UZ1aOh3 z#~_3$DX1z>{{cfc|MfPKICIS(Vz9GzJpJd7*JA|ha5jfE1*SxP>+fEPAP9*_PG$xTGpwGMZn=4k zZ-HMSc^iW`=g2*}-R^IdC@Y8XDYrFxKaaepnbK8RHuFF}D>yi8XB=1DYT^^u!e|*H zRD9~?n1Jgy7ggKCO}QFFF-RdDheHDml+Q5w%^neHeA9lPl_zVo<4{)bZaaXn6;{t? z3~f)VnqQtRDra>aaL!W0klcq`z3hrHu4yg@YhC{MSq$)R(&lls+@PvcW$mjWTpN@a z%fCAkO@A1Xnn*a;CUBATvzWPyvN~SW|3XXlmDyR zvxU(cG-d(<;|nS<&}aB#1t3@rPfR4X808XDy%2sOF8(T}p{y70tNq_QiS-m-B7v)K zf}|!(zr@4Hm%8VJE=^d<0~%D5gJ>_ud}2Am3e|a|mu<+W$O@R#>bVEE_H>B`kXjSD zUhVwC=P)0CwAZ9Xw%5d$8;@2v_KNZ?Z<*u9n;3i0F)*rQFbN zs~4X-oDw(ry1d?93w3+Y;Q!`+&DhwDpzeyW~RE( z_{x_1AR#Pft=dCA`@UKKD0eD<&|O}qt%!o=YGZUY;?B;_{Mh@8Q=EdN@0foy_w#Ss znlHg&V&~=_7;a7;Oxi!$)giUv8iQD511P89_n+{nm=X+1MG>MzBB;#`yM{QGqNC#qH|iXt2@M$&juf78e)SII;sa zf6I-%6FyZXFANy$;8TUWp?vY>}D&^=*@-t@@|CV9G1ed~weRQS=?z;GOg`B6-FX&&Z_W-mg*Rke!BdI#L{ zte}MH>29N`vEn&0ZO?Mqrpq<`SbHQSIH3@1vt+RZ9) zq|sR8#=k89$W#Gahsqdq14gHnN5E=mb$jCHKLGV-sQ~Rga+Rivs@0ZBusKrSv+)o# z%2R)SM#e_sAJV{39x>$N5AtHEej^j7-Vx2+K)go(u-6^=OrzD(%sW6rAU?F`M z)WL@X2NA#stkMP!i-^yP1;&q1->f%9`~oRIMFE|%g~9GXZ7(QE5SJgA%=DGvacHF2 zLwC6jK2D`ZF2%9V03%@Kr>d=BqZL>28$c+Ob5>1CnwEYRqqBbFPYS;PJ{^i~*>4b8 z0Qo?nI;ZnaJHFw{Kx&;dh);%FsZsvXFA@~TQ%>=h`Z=V+vRnD}sxm;lP){y}Qbf$q zU8&06c!VWQy#d&j7KF(TFw*ZL1{fC8eo=eOcSW`XEEkufx^*oz!#sckitD|ydO19G z$a=;wYXaZK>Mm>bm!oR_CB+wLcK!HFZt~btaa@Or&gY^!?M8ZfX~hOqJWem->x6z$ zpYsFdnx{b5xE`Cc%h7$lN2)s5pc|+Vz*KyW+PR|GV668j_&%&>5a3m0i|xU<)&hWs zHiY#Q#IL;vvG8HU)qD8)aZJ&<|J+;1v$q6obj>|5fN^N=xd3o zLhI`@-CgOFb}msZ4C`-KU~Xsp@CZf2mznN#9EG;;(Xbo0IdJaqJi=;3oK8t) z%oalHoq$vtktUx-q<0Rf+e58Kh1xE8vk$f@6O4LC5PF`eJH8k_RvkR|*YhrnA0;|c z&p1u<|9+rH<#pjcEKz2+BU6`z)dliMzy0giA6Gfi5g%qUh3!(uvD1tFC=l{dZy2Ak zACkhD<6BO&3jvh7T@_w<)CK2A4R5~lY#s4yeQeut|E1h4n5^t^>K@9d!($)RFUFAT9q%$D-YzN6G!R7p9=KlQx#I8)gkS z$F%$i$vxQm)1^Ntq6gDI|6SC0nc%gESOI)8d-l#&FPhGz)= z1GDH#oAua6SSj~gKbP#-Fb@T^jbeN<4o#ZWd)M^jv>n5uw5_q7BMee;j}{;lbSy^Z zgz`s;rh}h!juX1;`WGtJs#ne`)zGMj{lhUWL4cP)HAc7SfVA+K^@Dtg2$^d9C^aJV z)gRFSFIRnG8*Hgh6*c!g4R?|aGMhY+DV&YzI*zX0il?maad1)VyaS4kZ1 zLZW%!*(UovV#vd~YL9 zgvd~{Ye|&b8(?oEfa3Pio1VlqW|?l78@bv-oR~o z;&OKe0H(ZJQh&~OXha(m%T4g7Yr?<@26`;Sh-BE42~DrGzpjtvj>t$3^|wC!5}po!&__%I&(uR?v}7I|FClRMnJlah1Rve`d6ZHI<+Y$` zA~S=i^f3Ah@yDZS?Lt3LrPRuq+V}}pgyG8#*+~AIoBwZ)Kg1rZ#LtUEwzvJ=a?`>J zKZ=pjT>^5?kc;P{hfRAK(8CG6V6{7@Bsu2gw?1t+Rb${7ePTTCKRmSy*GSxndAd3$ zR((G!qIXRsBFGu|xsMK}*dpQ5;HHJZC5h=7F39+%HVb1z-9J3Mi@@+39id^sDItej7 zHGi-n0{8ku5>okAp)Yil#o;c~B*d@csojQjWGAd$c-G_0A|8wxm{9Uj{u2-1Q=g(?icI*w!$4B#!IYjXABa1^ zyDL;!z4xJ-86HI^^~pNJ)7s2X$Pga68KB}}t8Xk`U|!Z);t~+(qq-)6_(AgvbS!@b zx!zV!U9Irnv{`9hfGvS`#en1b4{0ADpnw4zJBwzducw!x+xFHL3>bJRD*6_do(E0* z^d%3USbv8!k{Z4l*Z8AryjgGp-k?uHq`HKCM^Rw;^!n)tFEsdPzIfsOFM~M3uvYjV zyqJ&#?Gid65J$%<5AUX*chrPf#6Db8Er2y>;RA`2CDkW4)TLeyC}7;U0#i+Btk^^6 z=Wj7c=uJ#a5K=e6>{!F&Uq4vQ$5{Y*a0sJHNefS~p44ASDn<#iGtGM->Bmu0TJAgrbZ}80AgUqdqP9}2jsbj3cldakNxwz%x~jD}I!``Sc9ndgb_szH|5)NEU5|8TR-)v*RY^=;(6$#>uLQ`%HhWVO+bvhU+Rk6-jMBIk2eTRdUo;D|vh z=yhZs3Wp%#1gvn*LZrSj+wBTU>~-988xwgkf;}il!j3xLW8>8nPJ;gvG$=#fqr&QC z2`R!tZ*r44t&#!ZMfT@K9(=D@qd)b708tPFq?e9OyoQ~K01O1Irex=(c)4Z|_X{xh zHUy7Axa2lG1)^CAYt%;<+omt1@nH1unM4{=syzhr`;uQjqW3i!naqweR<1}J#c|(8 zisPQG-ryX9luX8h??TN{An92knmLV3Oe|nG2MMDGgI(hX{`47PDg-xm7A92d#7e{J zvR5}+I1rL98f*Y2xlbmc^pH?O2+;C{!N8&+!UB-~z)`Dqo79 zp-+ZU8hYQ{6%RNQqdrL;^fx1!-cZ4~NK~6W8t)QuNSb{;0MoF|cn{Y`B&b36_#V5( zqykvH<;uIse|ZdK-m>=sRDgvb4D4G9P8I5gAiPFN9BmGD^IT_1daA?Lx&O@U_LHG7 zFDg`sZ;Y^-gd+*VZ~8%aSmkLzynq6>BI99jZW0&-ED*rRk^#~^81fbWRv&xIWEAo9hjV3)Y)Sq=xaj zr}0J0WB6ld2Pd;zI9IrRry`w*f7wFvM_8qV72a`Njz@w-!UFfSasB*;UiZbMrBR5> z=3i~qZMw)i%+~R%duX4$J1=!iFPJM)T{f95cwb?fDp^}$LUpj76-VER@m_AQ-yx10 zBZJ@D)EQZhV+agVjADW}J&a=V)JnRx0WGtjR5)4hIl=Sy*8W-9D?|z<2pVb1>t_|G zDf}MiH4S`*F$F4>O6h^Y!R%Dfi>-Gliz8!m0!Z6|ie?I`W(J3eGK*VNR$+b1j$Bm1 zB$VL(-w-B2$OV6v>K}$jZA$=FZ$rfEBmd!=Ox5pHLm4192`;$QvG{9c|N77>Lq;J* zyu7%G{G5XDqJIgWILhX6^A>1}L^?e1vEsjDG_&{2E2!cd)?^4lK>{jHr}t?px&gV+ z(-H$B@fK#p>0Zr=OilAYUf**BU}wSy&91heY-&Y!!NeudQwja#0n&xu#ZXyf(?h?HwB0wvRwabsd6d?ljQ;1u z>z0>@6mk$E#ugCWe|lZ{ys5dY>P!BR47-$h6=)B+45l<`z&8FsEbu(SOv&kUl2f1R z;6_CUtJ{JnNvrn4``hq^Ki=V~Re1YB{1?2VdSRTNv#1Rhhf^>r4Vd`^Nu4iHA>U!W z_iwfzAn-k#djtR1WJ7h34KmB$GSL5PEB^XG5e9kwkqcwg+}x$RoD$1sRWa8#^G$7* zlZ-t6c&%A=!Boja_~DPUZTowDgfwI&?c9`Pn7gbn&kB-(1#(2gtrOqU#kw1hW*JUS zPRhVR3sVXutRQdy+In*n#^+x11^zriiZ@A>KjH`z&=N-PfMKXVH&eMTs33%7IF3Q3 z3YC?MYBq#(qc!B$7>3%UWF&@KhmHi#r$4n!^~KIH+9tltQ&RlMZn44TIQNM= zVWf&B>i%!Tg|)mSOqK?AIGw1d(NbnTJkZ2()l$=7%Dl6aWuC*vO|oEJ>V2h9 z8RMum#6*fB$HvB%35r%(^z~qld-LjDP<1;Zjn zMgd+fPb<+BU@M8g0{A!gVeR}&GN(CsvFDu_o5W|cj$s{G13b$IF|%ts?@bPTO@&LA zYJBSm*g%!n7y+xqax-`PfanWtxIckxPE>*()sx?m<|0^~E3 zIEDhHO;F@}eSku3az9+E6HuY1m;ZX{<4PD6u2EjsY#zhET_EI23xO{*B^J_o4+UI%7?=-d zvd&8jcL&vOxi9*Oeur`JAq<@0gM^j=2;qgI`(ZQVfB)#jKmZAFXk6hL-72eH6{>$l zwoW*|s~t%=i>6_RAn71kVXAWw>jopV7gRq{yLxPzCT|l4RyNHe^mgoni%^jbR9k7+ z?shR$&M`|q`kUp^F9gIr1EmJyH+Kpbfg6o;*|* z#qs$zFIA%@&I-K>O=3Q;Y6Gafrc>K?6q-vR>mS7VHi?IdJdRb+ba zD6CJ(KllKw14<&CB+I|xU$9(&tMaTrit1+fqL{paCPH=VcU&3xL=I(QWQ^KflQE#cFCi_hWV+0IXdE)i4>q6i_R@B!lm;Uq zAt6xRS0OIfZ?S@RlOyuTrECnAElBI%c(F}28j5(16Tk&;5q_E~#v+MNq<$rJFOy$g z8EnXU#@5um*LO-xK0cyJDMvy^ld2x%F0^})g%;4_hc)PO=aXr_3w;m_<}*t3eS2}@ zl*s_?w;h3Q0ISc$d)UAVTifSs-o;I)F99rVF*iFo0{H%SdLA5Y&uMo)@L@->mY0{8 z(g)GNVFKRR^OGjOW&$Ge@xADdZGQ?b_{mTXfd7Jof_^ZKi7EuiihBq`%Sh+}!25tv20RYoi0)h5$5`Yk3b-Iscp04PMch^)&rnTc9NLDl2 z*fdr4g>`V(#Qt#Wqd!A6$+flVP_L^S7qdR(Ka&b2YEOVura9c*{_^d6udORx1gu%v zP|{1lxVz@o8|NF@R|k}HX6svq^RU+?(?f-^`I*6``2avpBpP!Kgpkvc5wwIv1AQzG zXi5!%HXY1YemrEsk}hTZ!S!>vaf;>{3*jX4k8;hk$E_aN zDu7ek8wb&x66&!1s;#25)IpF`s&i+@Mox==fkcs^7VB_RkgU>dWdA*!$p^0n+O{?L zRuv=ff|02_MG*~eU zkw9363{Zw_2!>^&X*JuFYr}7z27B_*dpF#jMOC2fcOB&=NhbFmq=efO`t?oU2uD0q zER^c^BY0T>sdnG{p?b4yW;kya!o`TuSH?@zD=emznzgB^YSmKh9>HRr@cW)BdZtu(d8Mg3+xBl9)}Y>pgiuF0FQq^9=@6`Yis8_Zk%{X?b!7#-Jz z8>A<&k30Qmi0_X>EA%lF2eKTV^K24->5g?E;^5Uw+~c8u8C@U{&%cAAJ*-xHtQR+9m{_dXJ<8xx{T+k(gJV!BYg7s|LjU#?L#0CmZ?RNl5wq!Mt#IDs zX!Jr)*k@i2C%Xq*hEOlSRW*qXVVCUjwJ!^r9PV`CUV^^Wd^i2h?$l@R3;^115RAJG zQ|ceu)_?K1<+peBf=n31A;AM7x|M&w-kjMu7BE8aRcXC8J`ihDmYnMub9i$2;VvwG@x-c$H(K(ZdJlG%fv&QKC)xlUS2S#306Fh%?J=nyy=h{FJ*EhDDNuMhUH39dE;Q7 zACNFZ_CCVRPupZqoeK{WEEks%=O;RDGTxtNOpnmEcFKtN8V{IKkQ%~u`TiCVASr$^ zUKWTI@!Z4E11B>LTV3UoAKBWA+kkF!FvUZa{J5ploSVvz{b#T(;czj-mm8R2xTwxz zS2U~pseSFzN3#rIq2LvZq0km97s)u?vd0`8qf|^k$-X;;I*A*k-m1tfDH#xEKh#pJ zKvL6IN=Q5yP6N|v(R$3^O$~EU8*tOD=ZXOi)Nf+Yf(}*Rryj`n3aA+?cI|vVO|RTy zu-IXg$D4mG{@}-D$DYKa;6^t*T9abdf0Eb7(Et%BJfRk|>N>9BdayHov3u^9%PjD^ z+H%U~PSj8Wd-%KUW_d8y0Z;-{d81Q;Iu;_Bhj~B80vDI-HH9}BDy00Na!e}{2)=mv z>s|!rOj!AGZ((`a4Bo;g(&UXn>t_ZZ*M^Xa?}CzdCo`E=h$`AK5Y(pUf%_DggQ|`; zJ6iyBG$ahM%Qn%W$Trc%=~F8a0}_KE4S}$5O<0KTG=xtx%>8;w^;Rm{ z|M2x_%@9Ui=9$dY?s;6O;P?omXpp+EXgPasE${AGF;KZ0g-GPfnbJtSJG5B%D8QfD zFgSaSsq%h78J3h(h?M!baX%v6lu5lR%5}SO%tm97MBk?}W0B?0VyOhfb*knc5Uk%Y zvi$2w(h-5_smc7eTzx1%Ro zhSCSCIvMW^txNlLKEjGeTpP}%1gMA)Jzb?rzYnO64J>Og>s|1lKm#u-6yP9mRJvG5 zc$G^~rM{Y~5T~qvO7mzlK%x*wmK!K&_)H_ce=N_x#y5X|1}X^4hQoZdpUuUpkG_<7j zzlLCdFJ!(X`}x!u_}k*9auyR2^=#kY_G|3s?t}7B%SoI!Vj?PHo{)N~@Mrhn#Dq3? zpbW`S29PbV2IBtAt(SzQud#6>fg27xYEdm<(zU^0hIm9+7?}#=aE*;VNRovb7#Msx zKiSI!TdSdpVW#DhMaXR`IHnD*eASqO&w2}OzCutdnv zPA*-DyC?5ctBp{s{z%Z0D_h?A@uEZR#&oCvqF+_BeViMhpd)38!B=dPiLy+-^IvVO zZ+_`8#r1yu8eVI+-1X~6o8fqgE`s(3=!h>-ADVdhXZgKR9_cWQG>e#d#N2D73}em5 z-9ZE=h-Zx;;5L(#EpLgwxViHn&Wr2q7{~{D8bNmxVG#sQ8WMt8#WG3y879a zRWl6lMa*sc+$vQu=vR*>?jJ6IFyJGrs;auAT>Y(bp-)ktXLxY{_fWOsaM^1rDZZTP zJ0Czrl7%&{AR`BW5+d*6#ijx+X}C7I=g5*Xb_qKCF-l-ikX?hpyFA^2jUNj(ImTtg zH*b><+mw-H{l*(_o9|wZN@*J2m%ey5F{l);P755j{Yn_Xcg==RV-53AoNp{FEuD&! z%PA;4`en23Msg(i=8BP)b|5QurhnoG!KNVKNFAS$BA9$vi>QCki{!Mo7QIIBTc~5D zpU-8R54xLnA=UtuyQbv>hCL%@y-a+3UuC$;l8Pb$hG0GGJ4mI(8@ zjeG;H6H>+TC8WhtnVh%DSLM0x*fzA-HFg>7MOO&q`5oi>>J=>9aLGkqP$o$AhUE`Y z%|CLFg+ImGR5d7DfA;y4`}|Rt zyxGxnZ$~C|8?Z4%(T5dIKq55~pv1bs^uSEzVy%$9OUE7*WAbBfuhB7L>{%gn__$^> zwH-dh3P-%HR2cvPIo`Fg^ z|8`|_E*49n2`}=QnO@{%>OMR};2l0avC=e(KqNXPH}moP_t63ZPgP0VeiNL`lVgNqV+o~=r^I_KqKd+5^IZXi7^dQrEKVl7SL`g~~qDYbZ= zZ60s&Fl&}NjrMXrF}(~qUtz&^T$kKEhY!gF)Z|`p2>FyHJO>4H#U98b{7|*2&vfl4 zd_qgRA^Q0Qi~J6EzjC=**>9yaEKk)EEF;()ABJ_BBS{OKEDR{BR~YNUSWERY@}~5$ z5m3m$)lkS}A0jwEfGU3CMV=v+xvSO|!y%P&U}vJNd-9T*g{hl41n|4be_f;%K-j^R z{m!7d%h_c=#K@g%SeTV5Eu%#(z3uM&Gio`fVJ)i$vp|dqCwBGJL-Dz_(kCp-u8u`@ zko*0j?LCrfR1a~N1LFEQWTx!yfN1Em{O_AH#rz}{CH$p&6%%IuD8?Tqf=>_c z%sA~Hm#gUn$MimnMN6m=wceE$hVwo~eF~abEV7pSQ?@%$@&I@x+|Yqi$}@K;h!Hm( z^Uibpm#X%5N`~*Jde2LWgDhF|8Ewqlag`osk$XWFu~m{>MkR8KMuK+(->9@NlP8RE zrO+IovPG8SmY33XJJ@5$g66OBq+7IewvVIiO3U~<%!y!Pa4idP-om(Frr|GDk&KhxJk zW^Ws-BhL?1Sx&a%sxVpXdaDGBB}_`~=2_$sErevwFm`v!LbcW%G<6(1K8t4+eK^S0 zv1lA+vS>?pjn6t8-hehf>aRzRs7K9WyYPkeYiXV0!jet=K-nwUyLuC# z%Jz4x=!7f&_2$=);H`qXVBw_{cxUi64s?VEpWo5-C&;8tIgMScPI8gUInU;dY$Si0 zYgiSm)!C@1@2np?@${6AF)n%bZXuMa$>@9n+d1w%WCIDMuj3L+4(|G9e0b30-g)0= zqyP50T_R+~wRmAsj&7$z@mg-n;;-zEDMDFc70fGP7F1IGYNF2 z=EQ{xZ?gIWI+6TgYcf?)SIsf&Ps zLu`m2Tw4v!ofL(}5_h^{>L2nl(!vMR zjfto1(fdCN_XA9KFE615PqWaTcVEFzbQ#T8P^*} zx(FC3Z`Ky_>CS??SC!5p9RX~;A)^R@g|Mvg_-Bw3C_@f$IRe0g({}l+PFLWE;8=uK zv1?IyNd@6o&&A;MhiPs4Mu_T|YxF~cYcT=ufO0>FkSF^6&Gs$iwgA&*aell5pt~$Y zd~ZtFt!AgGCF8=fYpK+4zVlha%Y{R$GiaIu_D}`Ma0jz%C#4*}1;F4j#EZj~cl6pO z!{z=?l63d3U#9}@K&t}X?)Qd3 z&5>4q)|k6b@Ld062oj(`F#yyx66PbwrZ_l*4e^4W9v`WC!1&Ikj%v*^1MzUfk%JwO zV`Ox23HR6A*WH?~t+HPoBv|C)$p<9-Z0?*-J*=lAo6-r@xldfRv6JRvZlLDT+C~jA-R^rx1*DsEPiNh*1CMZ0$o0zF4U8Hj1-cD>$H6?AV<<5jyjJ=g?eGb+F+i3t#{8S%U9 ze|Zy>X7{iX)*IQ!G}vh3#}0Y`Ki(^rF{4~s7qZN-B0>4??0%lNbxq8}kcy@h9+`nFHvhP# zp7{ALCD6Jl%=pj{oI}3*WB~q!{MH=iGoU<2qb1`7neOVA4k9b_&8g~8tvK!*fhUut z2Wn2vrj+Gc5POhvj`Td>z6#t({1b2)qM=)2Rp7{acQKZ1R!yman@H*pvjgHoR(V;+ z8`WjY4B=0(lj8`0smicUgke`_H|sBiHy1%-gm_hXVKR$614s0ZDio}0>H29&SSYd~ z>@T362A-gmCpqd`D?$z6*BT?-e46aRl+luQzQGw#mNe^;wFCjR;!-mF+;5cS(R=Gg!Jmj7}A6r7xg z9N{K^)?Wh(!pkZ!xdT7t-Vj}H0%xd6UyxCKScnA3vXh%$HWY_ z|7I}%^V(1FfmrR`dU5#M!TXnW{O9VC2_PUE&)XGzp}P^Ke>~Ygp7yf_*r*;%vI(*O z^I|vu0Nxx68r)w>k^O&P?8e$-*#UWaBIsp6`p<{@&l~)t1a{&7|6+O%q5}LEnZ3W@ z)j6Ae9d%yt zM2YIG4rZn{Yf@cgJ=SU%-^Y)6nU~(S7MjDuWj>WV)as#JDJkw8z$5cw#&LH!hwp7P zjdNqp(W|9NEroc6ckkk}yPqjskXEMT@SUx`I%8NpOLNa04Slt^bN0nNqH59@A~o9V*KWZ7mW{50Tjwn3oe+WUFjaJZW7kTiEqief=|{A$YK})}D3&`D?rg&b~!n_E8Uyr>%F@Cn)Y~?iL z5Igf`K3FO9W%TC;0C1Y@<(xAIg^WsYgeGqjnd^Z094~udfUS*AQqKyIil)w5?FA-b z<4_(rBlzQ+py4y2*usR@ZmFlV@o=)6$7yRLEA}u&BSyse0yK-82eXfsfPSV)ahfE9 z1AzT8SWU2MD&^g77y@hn#^px+Rr(>^9URlv&+5;%>Nmk-IdR?{Q@7&hJsj5$8mHn2 zTMA~(l1bS*v;kcO>b|$pvCY0*MMyB0%1d*%b4;0+f8GZS?O!b$50uOXGu|_)mVI`d zbv8OW0#Wi5NYh((g?8DF>%N<)TQ5pbc?@KNsD4b_v(aw&i3(618v&FdEYTM+>XxN| z7{5NKjsI}GtqL&V+cHS#i8TlTDSt^0O;F4udidr${1h;Q7H6B)G6f_D2}KDW0A^J- z=Xo^)Mq#XZV4fYU8v)0{dR=tn+nv|`Bl)@xC2RBcbjl9vMfF>2YcHCcfvcnn+!PDI zapEB--H-EMbWJhE))|8g*}eZjbI5t-n;7Y))4W!CA0~~|M*|tY z9lyfzKAx?Psy=z3BMm|Cc#Zr1H?ge-(M8^i{h>ma15e8lKlkj)^oS6}@Vh(kz%FQz zCGac&kZC0>Nvm1BQmrxe7A#3&x0!hJ-2I(|FsYN)qD;12O1l%+q*d?!EP=o}YII(K zugl~%blM8;M2fM_>l!I3Cz~<*AA4(M6;1{<-zh&oc}dT^2OR!Ogsa4Z&Su7_->T?^ zclDgd6q39={_$q@+y-a^q-Q+|7kgL=h=}VGtUwD{=`#%O&-+i8;*F9`KucRGXvdkT z-)=Gk8pBSn5tN;4(9CDNNCZ6^G;P}NGnasw7b*#$T8^e=no##38?t<|oMOehRg(^U zONP>5$+?9xMj3&Vj3k?m2V1vOch3O3(E5Gd}wtU zk4ylo@@)md(Oh|&SB@#j{9IYz3yM46VUljG$a^p_e1j<{7BH!?~-=K%{u#Tj>nHpmW+pZIVsznCWyXl%jU=SmyrvTW`T?VEBT zH3$`$0>{usP`l4UE}4BZk6sTx&eWzoq*lm(G-IyxJ&Ui8AqdwC6ZlNg5Dtegp!Bu= zu*ZC=s?as;IN5be9ML%4qnTlilRRN}RVb#!Y_)_(ZsoGNte{x14a1t_;MF+$DhBTc zmh(gG>Rtbl>N;uk{BFQFq<_i7KDKP6+sWXd#<4664z9M+*pK_Knud3G9{?vz!izZs zZT*cLA14hMq|2w8oLnQ= zoX)OyDl99$iDt#H-oeTnDU9&3Qq#gmH=W2`P=8M^n;_L?s5*SAz{Fl$yF@rQ(_N)Qvd^0q0Ji$1xaG#03DZg9@*? zoA>&7i|z-jp{=LFQC-b2uFwB;>=3+`9VFc8A*(u%{78B6=G8TFAk&oS9XY6FWsBbW0(G+komM>YtF7f&SK@*7F$5>s)m*e>Hj4ohiT{>t>Zvbbcg zZGn%rBuz=dCEzt(%c#k zdjYfj$+?5+ZmlqLU;iKpZ!gST=DDpFwK1f*#S@g=ML_wi3_K>cP!jHIk4Z%ezEV=Q z8_OX&A#vFB73aGHg#t^kJ(YN7Q11c~{zn=i!7A^Ko{7+aI%FXz+)>FrC~(1)b=qECt6Zr2GM4WGp((&% zHjKdu0zS*QvrjSR{Q`No3i)hlOV>r`WN6*k3KmH3p3!ca)olmOX_+?WuI4U&tJvj19^e)qKhd>)xUVH1a=MjMSL;^S%eRF zp_O@d(U(2vXTQiGMUtzpsMS0c@9~(mFf`(NKNDg5na4+;U);Svp`HD9M5b0iaOiR{ z)Bfu5$$@-#>=qB7cGvP=KLglMZLp!|q2yH8vCkJ_2+b(rn6&<94eL)xmS}5QuQ(sL z54MjwjA<@gmgJoYRx&F>R`iu$8(FghXgZasO;zI|Y&5I)H&IW_^ zNbnu1X_tZf#Z&6cuXqXcX-!PU8ihnBBxQtu55NkfX71;r36ZKCGA!w-e6JTPbA zAX|v6xzC36{T@mVstn_6+K2OQ%N(60J#I#gk9wTIBM0j0p2ckZU8`&9C1!F59#~49 zG}~;5osp&V1-rlz3+jyha~@@^L6+cfe8MG*?HS zk*8nv5jmOD@kQ5g`s6Y~V6v8_I>de$XnDCNv+Yn$rYx>Me*&rXnFE=2hciXANWdsi z(_nJ9!533t94T~!P}N%s>D&FdktZ*tPc-n5svW}f$!a46*5B5C$d-)PQ@3iYJYzm# z?mu@brwEZKquYihA0&|mFR~b{Gk5qLBGnv<<){xndN9bZD^`9+&-Z2PHQTj~Um)M$ z`(*V@bJJ`?HKl8hPj}A!$N}@jc+NDu*6qZ0jHI~Vcg@^^DYs5!8Np@crRGI0vlOuQ zK!c~RU6t^BjjgXJUTu2(>L5$4I4ef%jJep(D+i{w8$fiP^@D=Pe&xH`*R@26Wkpkw zGvG_tZZ~!$juCiXswjSTHZ%!+&`s$DvGJB%!$KcPLuNhDiI7?KXx>}oB#+#U&I(aD z>0UpYRL^#mQYNKq&K=7*4G!hOe6J278}$+O>KRA%(mKhQOPVeg&r8gh@`GrRG{KC?uyJ3Xau0qa8V8%aY@Nz!Db5)K z&S`63v@dI-sS$NAE$5mV(FW+_@*#nOo#$Uqq$!)T)@(CSoOy6CcN<|B#?xpzL}ByEO~KhtQsA2uRiOP{WW zk>W6_+BX$CwBDRxs;I8jNd?~pE2u$n5#leisx78Q`J?7Nkt@;okB2iQVkulD3e!g% ztW_HGc*rX;n9EY{0#!YeXUQ<)ljUGdIYi^&tTDQbI;#N;S$2jpk}Ngh(;{=oRZM|;`5@z*0hr_{jZPwW2dZQf$h~kcyQ<|dC(a`4>d=Z*#zczWKekp zCHs7RSdM0#QizU}=k5gy6(@^>Ow3YQ~)`QpFAhD%> zEegG?patpZs?0WhPXAywYU_xX)B}f=PJ6i0UWFugH}+t=@-SR{w|V_W3wT-(I{vFW zx3E?$-+g+{IP+w`^YKjWK(w+}{D{LFk=VzYC-Fch?%?EvDN+Dy#6L>H*NrLb$pUqSq*dfm3cnBgxidabiZ;fL)eS*uLO*_D-Q>P5j72zpUVY3tUMI&ldp4I zFjL(}EcW@9JHy&NK9?cRq}~)m#h&6O3g?{$(%&NdN=Nc4jf9HG#am6bwH^u&+qxpV zFQ~1|z{J`t!Cuawxqn`W%k=Q+qdg@>v0gnV5dTkY06n3(^%D$mN zktDHux_BS}@&r!eV?REU#_rM;1NZ97V{g4>Sw!Q#b-3_rDN92NRK)eHHhlz9|0eeK z;<_S%>jNsl6&RCHz`hm-{&#|L;VU0Zo_-h9Y}?FK&mL>652UTMezWk{{(1 zvdXejb^g=~{-tX4k0jWAYS}RTfhMjWhD7{JTZnlbaO3tk!SLgwhf_|Z`Ksk_6P(t( z%0WChR~k!m&beY)7M^4?iZ$g{E>$@9zLR>i_Z=sWwsWs#qs50AkM%Fmgf{l_E;&=x z@<|ki>x}RJb!XrUx0s^h8lX*1lrN9tYrC1OSDPA=_(07QdO6FjvOSIP(VKg2WAe`p ze^fAeM^aVJoW!d-QtMpIdS^X-7o%<^#x&zCX09#}MIl+g>; zevwd(rPNeqvyrL}&S7OC`QKSPZw-_M>Ys5ziBWAF7<@W{)v=)hS|gJO9pUL4zbGZP z`i@iIbtb62x16yt;ysP?aGblq{D_GdQs+>SkrQ+`s%lIZ}k(H4`q958=L@K|I~fTB9JEH9@yNQ-g{gHEF!L|D5=2tFG}8} zn#dVeNVE7rHki&3uW}7UF&xJjmDEryJbVn^;1-_nh!SeS2!Lz@7t`q zTcC~J(Z!RE^2g`qM|rF!u4;3nzQdaaKh@NVDdNB1`hO%@xv_H;;3ughVz{aZ z*_DEY@>`aHhfgT(++TCHIoMrP#v_FP#kcRFu~fp-QikHXS<7bq0`=^nB3|`kE#$hR zcO;Wjx07e*)KX;F5-n(wSO>IRFQj-k27EWXE{-Z=X_^QTSwc%E?3QXAVi;8k zKlt(vU*aGN)jQ7gzQy34YC3tXhE>v7^@Zbp*oNzdcouVLKkpIolwByZGUY}AYQjg;&^_z!J-j9GDM^$`T&|w&j z-uz3$?0$u46CcV$h7$F9M+@cIgE1?^Q+Y7EbF#fK-<{6dbruOy>7A;>7K@w>S^+LK5q-5(2hbJAzo!cyWl8#iC zXB7+ph~MP-s1ubd_Aba^-DBQzAt4 zA*xE&#-+*d(MDI!`u#cln)Xn>pIG=MjfTS{RdY?QQ!(mQrT#&96E!whrJBAvg&p<5 zFVj1x4LvVUviVQHT#TkUvsI6KBimO$!`wCl$%>o<-W`>MUxUxVoU5-KKLdj-QW}r! zyZ5=Q1;>6mdSJ!vuU;I{)K@QKkSy#%F-az?%SD3lPefQ<6mtupP$^64vZYR+W z(^%Q+m=r}!TI;DG{$b&rXoK`UoYA1q$NBT#5kX^>jdmOl6$4+Zx5tGR=nrm zmFuQAN1=0SD>ZA~8QG|rWJSa@YoQhMRAYSzkGB3PPRTtrBcN;|GiwM@eDFkXyu81;+iv#Sxu`kle5pd^v$$=kUz<1Sz}1LXA9Nen;E(mru_AfCOZ%h)-G#9 zg%&!fJ*d>M`LYgU^@@hOEl3(~+1qa!`+H*6OE0J zRQ~}F#4O`c50mm zxwqY4kkUv%DuuMRFp*X+j9Qz3K!?Fz-`=vxQ1e~{ipF{ehf-!^8qiyF(OLbV{JMtJ zMd(&k4vUrV6&7g2HVqpnR-QbX&W5Xp45@lP;Pq)ep)B+17>R!U>Nz|K-f`LjOdz%x z^(BWa`PJQtBdxzlYOQ#{%(P~FC+BTz?%H2r_M4+?w>_y^vKH|Z!xe8=Yv*CWI*Tc= zsP$(^V~m%Z?l7OpDb_mJ{|nLd9-f^I6b-h)H3hj&$^~N-9P(Yu^VOg>EIZ4`@$LqL zyKIcYx>Ie<`!g-W`_=UW(~nr!g>4E0*|6waRCX8XkaU=(dku0cFK=cYRqDAu<>>GY z!DR6Mh=+Jk_hl7@Y2U4&{?22{VtU&2q_qmwOLit(wdWd#e++(5&JyMK7*9I-=PF7=xcU-DhYZD-^u~QlpIN z+O19PYbF4X@B?iSG~F!$ zLxlSQ%9CZNVm;iH0j$XqsMg}4YC$~+pyTnEuL;|aT14ZS*KF@G)vjb=@csK-t+l+I z%6^;2<+QwJCk1lr*X5qml}lMFgTWRm3_cyy1sikV|Cf|iKabzz!=+! z<$MKZoPqU-RQOq`YpO44z{uV8LD5%0$0V-cRc5JMFBquh5TaBO<%GuYN==;=5o+t! zJs4H&>zk4pIv%z(<*R6wp+;idFLZrTHF-|Fk55wc!0A>&?)+S%LBn*=PnY2FPNGBF zS*gEKIA`Uq_1Xe>ftpHg&aX<4Lin{W;>;*x1E4+o+Er+&T&-aNVL!oMnyM|cab;+LYJ1Z3C%R`Tim&5oKA91ULCp>{1Bz)c zdG)~NOyYgufGW6LmN%A)0g@-u$2R*>!d0>Q`?@DHeTsBXlkSwcpW>m8iYCD{&zeaj zxf+@1s=iNaNqv}}O`8r}8qyiDYg2v@74~%wV;8Vtr0hFx*s+4|h$==&p4h5z%k3+3 z`Q#a!)Gar?Zlbx-PkNdGU03XLuJ2j`V^Zjyg*D~%2U!{PWNz9qvVVWY77yW-8XXu<2C2X zs33f4S847y=ww)udd2@GbJU7+;p4ZmK zY*-aK9}FHL0VOESsWo$2!hF6-UO=L{l0y>$f~FYAX{t7!0}ewWe;vTpy`X5pEs){- zDsBo)6ea<7r?MIFM$8W7hiwh4OlpJjy#DV zzWDeBTnTh(ndw)}Pjc{HS6>;5ns(S)OYO^>5AO3I_W(hVJIG0wt^EptOr#k4<@H`7 z>=WF^!x32sa86zH@NQ67dBhZo>B3`^V0;A%{ea$@PPQ=iVf$L1CL+uHtG=hl2CV-f{7LpuJ)a($i|JRb*b|c4@&r5e<^+|E*?8ZJnBQBF0=&Y zp+Tzi?3r?}vrg66IBWWmxL2`Tp$%>067T%(nDQ_e$JD-j8(`uV_|NMvm_j;w3>gs2a|aR*wi1t z@0ym6Iq4HGvEDbi*Vy=c*Tnn!NOWOVFRgpPIcRF2fmpeAQPBIyg2kZaM$jN9EY34b zb0rTbpDTXvQs?h=TonRh9alO)&^*K+)YJSY9T7bb>k+(wN8<#+ce0aX+~D>xwsRcG zjLiNB4jh$~10(DOZ6t&tV#Z~I2*=jr!Kw=6w=4xz;X zgCX4;vP0|OR?|Txg9m7#;mxK*w(BEj0sY}O%Z~S)hdASN#0R$42e3y+0PBc7kp*L(j^|3;=D@FZ-kUH<)-4EaJ#c99{h4^b zzL~ZcQBBJno{8BVvdmC1^TO584qpkR>!YfXT!TLEPRx{!%YJ!&-0z86?U#u|y89aV zwqe&uv7x{f0mRllsO=XA)IK1Bx*#O;o@-iri+O9!AobC6-@M6IjI^YK$kbvM?TG&u z)w?`<+B@u6R;Uj+9}|nD$T(LIb(Q;(x_=s|{ z2zeftJ~9&d+V>vPjgaRb^1bJ5qLjh(@{sK8c->|&xjnSf(AI!8Ms5ap0yBVwJGSPtG5$vWzbe^K^4dSF-V0VoO+biN5PY z+$c+y;caZ}%6OHNP6(Q*#H?Ge>`CP?19)5*2Cd0q?A;!`3J0R>RyEf7fGFgi9>5+p z^JcK^Cu_Gh3JZweeSb5&4^2TX=@H^P*RIQZ)0#(s#3Cu*#(csh11LXw7>lqWxcrj< z`Ypb0HH1o?KwBVeCmL+Ls&(kw0+kp*&kR0M9Y5MV^0UO9U$JLGwBRT-cZREWx}JGP z-Y9Dos0S)rHN06GJX^_@($_Og@@wE5cr}Yd4`tu0gDDA!N0`jOMh{BZ)+PsXw-6jU z^W^gHY~%|rLSmPNiFjku+a}sx^L=e=e7ToCMiRfJy?SI~HX#ThiBd-`+nJlt$C|q)%Lg{QTb=mp8U~{H|qKmBTGN9oDI8+hTP{ba#STe zcat!f8U$Cz;G%IxDy|ih&Ru-VPGvnLpY25$(qpxsfai;Dlyk5da|WM^ua%yPAIcZWI1O>3WKDQomHP!pM2pa2 zy-w*K{mQ6PxZNqpswg$EP*hDHAkF1Lw7A=0XAml(DV@1FCIlO@ze)%#P;cZjAK%3)lsPeD%y5WYaIL_CeDrKHhNF3g45jQI?ye&<)t3{p-`$ zX)%=0IJK;mr9LkP(=`JZjj;^F4!{$-$ZhN~3q*r{=m~0fWi0dlw2mG%*x7*-2#c?2 z^;u{r9gq5tyF!eXn^4Iz2dI9{J`QLW+;EN)c5wi~vezJ^iS+4I@l#Ps5hK~sjI4Pb zY4f^=Ha=4WO>RhZUr{Q0Mm(;uQovP|7{=DNtgZ1Z$ENEroMAZYxD!D@jZ_K0iX1Ph zKj>?x>T0WwdYFHufP`-cJ&ecfMb6V!P#Nk0{#hJKL=HjpJH&Q=jLZf4k2Ejd90_sr z4mB2j~D5F86t9)*jtCV*I1FT6W7=g+=yf z@Kld6FHOtfpIEk;7nHHfnR-&t$2p^t_<43^`pWWRzS;$5@YVW#&I7ZxTQkb9E=+)K zb8bMFX!6_*6s8@@yIJ<=s;RkZ$UN0&r8UrlUi4!9a}(}Rs2w$4t=80_zf&Tu?8^4t z%f83&4RwDJcc(&vcziHSKZc8Ym7}r$s(x;ieFY6i@JwuL^9fz|S8WF zKRO|dLp7?ff0ZM8_nDIuGzzMm;^G5Zq03K^TT>wC@kB?y{xkG8*Roq01bpfEJ3Yh( zGboZDcc!#CmZIFX8qS@GO%I6|{lNIftxt*;145x*f6&K*QSMbecYXOJn(4u7xls>$ zM!ew2cSvID*KE<(Qc|dZ>Q;^Qitv(_y^EOQv5;TYYENEfJ-ojyX2)=K*AKtTU=4eV z<#EzGM|sm~0X^&4-=_am%s&*!7r`P4GP3-AKu{xo$vMGIl@(R~%>RQ_YBHS^M&WkG z!{bsgAq6NLvITVcuBN*(yQ~Osk#Ly#VZ_LYXZ74$Z}kitz=J#dxH5wAWLs5MKI zFG2P}>>iAz5J?GWnpFVBg^;rW`HV$tZ|1o(apjl|3BNY&ybCcL^;tj?k`PG3Bag3_ zaDrdYDvE4BXokC-8MY&Om66+nnwYIxMKG`zhH2stCC=`{oe4?Zs3FESre@7Lke)MJ zLAuZx_W;+*s0vUCtA}T$=wpR|C0c*K5cBGZS|gN48O+ckpMYM@<@>!;X%0l&lS>5> zO3D6%Apt5=+V=+fA18?8`O@S({0#Qhs|UkwN3T_D;fj^U9LXQg=&FbNV?-eo^~6t!q?r^c+x>=h{; zFK{GAemEAUh)=&Gufs_j+d-90p3vupzpmW|^XB@5 zZ!|l$AHARUI0_S9y!pGiWu`t-dg`1%z1#xhVmOeW)1~U#W3Zd>Ug2FlY;H*vh5hK1 zt_jV~jZSaRO=P~wUl4$P59Dbp^+U`OE2?#}a!Q$z2QJ6=Vf#$%*!I2Krvp;n&m-^I z-a8c(5hWb4wJ6qIXvc_L5i(VY1hwwXrMAEQSxmz(Wa@PQwACpB{URSVJMC)G`IE1L zrOa;@%W%LBtxAEz+43r`{y*HBSv;?^8NFnfPy`z)4|BadfUgmIibN3mYnw=--??vp{Lp=O#qW!0G zwRYUm-(z?Qg+M~Rz)n;D+qs9U$oMS02RyrFSs&;;7*E{{O?v zK4YLssXJl5Z)bhs8gE2w zA31%w!<~G$VB9EOms8d|)oKxkLE*@TOt$2UK@!Mk2n7+|Y<#lRjo6_4IgueBt$QTQC6hace zChZvADI$9^c)Myy>!dHZkdFkb?b?r%n!uFKFH|JR?LKhty&{TyWyG=xFU4mXgJ_U) z_^ZIB4+zb4(VZ)|REThJYAF^qVpXkau_Kv$S^09+JiCG09cfTmlOgW5Z8}Edxlq=d z#|7_2?(WCjxBTkS*v#h}Sna3&anF?SdK8qd+6m6ly36=jvc$jFP5EoAmA2c+o%Qe;*@g=r-)>(@qs42QFpj$n7NszQ z`$pTE*GUAAVtls+)l@R*6e&2p%K)9c1}gk`9_nqMo#G?e3bC}|)1|v7DM6b1yG$Js zfi?)M29+FHB6sOjLHbYK@8KPs3L7r&VlkN`VX$z(QeZFKjU_)fl0T2q#qwwE?4=9@ z)FO69nQZ^*oDf)g@WPpQyGxtSai@W$1>4r}>*=$bKkVG!hw?>`%QlpY=7{8$*xc=9 zAca78Fa}*pJ`T1AYivp5Wo|bGd^e#5Kw+I zVPSbmVPQgfdz+7DmL?z|l+i}|`Y00bDSHhJ^!0m(XsBT9ofU(F!xZ(sJKDS25q{aj z;ePGwdK&=>$|pbu$AFFQ(bU}zl|_H>Wl-_EDSB!v<#7XJgHvmr*F8(Mo@jAja4 z&I^d0qP?I3^qV(EU{R&ox{4r%bs%%Zq5|TebIbyVj!^FK!KvT|1R%xG(Do2jw$7m{mWu;!gQin24FiWA~`Vz$! zttKUuw{OLpe-X!rQ7&)Mk|E9A&PJG^Zl8FMd^Y{6#o?AYcN6#0nzFV#i-&* z_`>$4Gqd{3uPl-JH<)deX!%$;g0qVYSeWYhPcJW=DZais-+b3ju3lceZC+kpPM9Dd zwzc5kAX`B}ObK=TO*gFM0a2!zDXTlG%gS&W*;vsT7~2?{(79OI0-^>1;c?*tep;D0 z8W6fzSz0@Ax$qMI{(=km{rZ@mnDF-}juyPc>ay~L!Z!9MgsgNdbPU9NFocAJJod&P zxfDgj{uT%Bc!@tbI@)s4(>psm(>XKK+1Q)XGjeir(lap8GcnNuU(hGSik`3U*FI( z(lOBgyKbN;&+Ahzc{3LiOLY-5D-&x6pbb7o4i0vn-v$0Zul}dW|0t^QKSkNu82+>5 zf4uoyl863v1phIjKjQlR6p$Am3=jRkWzPrW#7Nfz0wMq+DI%!s0(zMGHU+f@qle&w zo%7R1S7;NubKSc9;!=%-owGANLV%ypnd0IV$Kn#~;|_aI;9~TqeUD_!1AMwRThosp z%q#G&+$Tfs^uL;J2>4-Pp`$?l+12ih40WetdSQ%02>K5%S)Xn-FJuWH@PBl*6F`mL z?js`2f&a4(fk6A$2CV)Vh8T#gsKq?P{9Q`mlnjYj1WFGvt!iqf*9Gj)Lk41jIqWcN zwje1mQUNeJ5ufvc0BiCfq1QX$;zOzsKh|Pt{Z13edsMCmU!hm$QO||=?T=)9LXl4m z%>&k^l=O=f0+G@WD`HFOu1!{L|BUJ}0K}xYP2ZU0PhGw;KIb%1z8Cg?Zb^~+!5@il z+8A50``2y=`1*$)BDb!RZv;6=b-(|W3+^|8#L-O09z}}qe7N%TIK1gb(DRR^ck!aMM)VE%t#JuzATDUKf+Lxwc74xs$ z2?d~k`1g?84WQ+{I1ft=dj9o#1$vg`rUgr{=1zt0@kW7I9PZ=< z&(QC0`>P?~gzRx&r}jr}!>XpJ@$vs^psx*-e65$CKlh(%QhY$R5>OXOKS%!+?BiD- z+6Eh@R^my9$?kN1&v6(-??$#{qQCl^K#}pbG$vg$!mS%?+9=P`=}v0|H0HNV!I41w zr$N95K1%*pUa(k@Ej6EYlZ}6MNFKbT&(m?-*kg)U6=p+j8qXQmT>cR5ui|o`fYS00 z!IkH=D%5_LxAptm9S>ojswwtr^@Kk{P=Er2(4VT$|F2nEg;xLepc`IZL~uH8@UKpy zoZ^9Moli_NuIL2R{OOGZ;Vn`H8NU@CET2Dz;-9rBPO2|0HpjIcY-EuBw>}?mOVkST z1wi%Yt-GJI<3iIUP!0m9KmMFbiO@7B0$_bxeETNWd$|E@`{&P%hcoc zgnzEpGl<9QaaNTTpX9g1Yz@Ew&G&HNWO@Di^-k~KcZ8q`gh=xqX!AQ$A9`l|AQ2@K z%6Mh+#lNCx*l!OKm1@<*&Q==r`9ps*nZLwha_DCHS((;yFBL}}m!s5ko#*i0s=ldd zpff0vRHY~uh1Fb{UL{X9ohtMlE#r}NEM?~ANP?PX^{t9f&@~g9QmW6g%lYP4nKUNZ z=lL3~WBz*j02uUGt{Mx;G@gbx_v3uE-Z#fOg{m#JQ*HzCbTJ=?H2dcqb~a}#y-BT8 zI8+b3PJG9Vy8C~=398Oyw_6v9;ZPv%OQlF~Jf1vrPu{-!y$~?LV;}vY;MYpoBj~hR zoMyIrJ|A)Sk7f6mjCC}`yw_k#cCtIYI+#(+GS*OP8O;=ytWEcdal6`=ihrLZ`{3Ec z=+!~0(O_Q_hR3XEzu9Yjb-6|&*54hTOp8yiQslp>I6@1L%@*Aqj?*9Y^9}9vMPzEM z@3UaE6=0RYr2%oTEM8~Cm##SWCU8@tdP0Xy0V0(F1w*ff|m&)%aOD;lidpB@fPuNn|+Axh#h)ei6uSkUNjSr0MLu0 z1?MWaE6qa9(!9f^I(~*m{R?a&;lS}5h?|~zy^(Z&<|9~i>KwxvmHW#*GCRYb+PQc= z#N~QBr6RTR+_+7=xV5KgS!ay~!z6v2ZgpIvKkMm~RR2*GGSBh~{$Zi+>si!d(%@^y61s-3LL z2)ud8B`#2sP|7z}OL)H*h;KWQz??aOsk=$BXQ`)FDASo1`J(WviL8YJ4|rrU{yBg_ zZ{;K#=DJ*Cam;q`wp(!Uf=;h>eM?d7h0Z0}fzRVqeneKU)nhBSm6zZ!6?Uc3N&2A1 z{qoRA?#Jh;Ot>0YRGL?t@6(BVYwbK1Ll!#l3wop4msM^VOfxu@%Sp40a?N?@sZqOz zFc^8+X6`)he1u<|wBbC3N~**qN1^$mSK&rhUcVY~0j1Nc59ap{b|Bz~B$ zHp>lfQOX~Rg4^?sbv{`c07~Y1HnGL9Sz)(?Ka)zvsJmV7e%v2P;k>9G3{eb z+h}c>#O&M(hyR#dZ9XOTA&sL*joV;LeNE_XtYBkcJIGT03CPlj^-?30s#&RerPT9s zlN_16=mUyJ~KEeHu`u(c! z4LfWc>dI0{UC%eaOtrJyEXN!#anWF53x6C=p^Zus4Mjf_+MdXl(}Xyj`=ORb$thnU z;6Oh|AnHauU2Jf?&oz-)y4$o^y3Hvy;i@S%@k( zjh0%qgb*K}-FRTS)c$nUK=K=TjgR#7dkvW*ewSN$2>5&1v5Hz`2H7=ry>>4ySO^#L=k5zE5I4kiajW1b@QVstnyh zN9(=Va*5|WFOS*l%W(@YilMX8^c=hu#`+Ys%Kf@6g7X49>dCj#+U-)lK8r=q{$Cj{ z{O$O_8x9KJ_E^1be+IRV$Aan*O#i#}F{7T`uyKue`jaV=&z;?}RUd~4Vu-t5a?HMo zq0sB{EDhdWU~D4h?(ljaHyihT7cEjLB@Whyg2WS149j;6dwOukrgXpA%UAr#GZq~# z7LJ{L6+85uH9i3LowV{+3yh~xkusH2)9B1_a+?76nn89<*+J8Rc-qnh-?YhjZA|ns?FMQbcB^_%ktN9~oRGqu7rP=|bFjgO<+%r|>rplD$XzVk?mh#}dpyZm}rtGaO18yi`gtqzI z?*~6Eue%GOH%?Q^rSnY9F!ODA4(>*)mIp8dBuv6kVtRN#HzZyXFi2!vT8-Cddi8i= z>Yjc1f|=grxM#fFjLT^+;%%J~mKG?8f{4w~O6+)^%I$m!yVC&$w{cLcR_>$)RR^_U zF{0~fe72s8LZd2k#0e{Wp7V9XDR>*tn!Cny)Cbh_EokDJPFSrzF0VIVj-rfOTmrpb z|I70Y|B&4`n9_Q$Cv1~n;j6jnwS0+so%N>H`;DJ4w#wT+A5>ym>9fu)ax!1}sU+7P zT^-+^Z4BJQ<7{2-F`qvK8;Gg=^cxIMX76HXUT;@7`NbAie#;{k5axeFvp-#;fY+q{ z$H{3$f`Xfa*;vn!R3bI*MN$-(HK&kEqYi+@7&izwm@F;d0%`OU<=i&;+0ivF-N(@D z1Aew4xkIO zt`6|;4`t02J+?3H(APFveBi^z1L3-fbKwtW%t;ujl^`@hhIM{B86be~U3|b~( zsOH$LAB7j=m=UtD4a*>w=(l5FrylJt@|?J=aJO|5#j(0)O0`}l?TsgU*ZPyXl`zb` zmRK#OsY!PD&qemUidBmZ#+9t+tGk*9TIbmuGj>B2G8R&p-2-E(RTMR=EsdP$;1Jh< zU4G9?pe^idNM)F#M@5SLy|LKO*>c^MqPo&P`JA1D`P`;4#6{ z8k4DIs!BhLQHl%X^?wy>&Dgh&w>(_$O{qD>A!ED+gK;$puTtE?sXzA8K)`$M*{{g} z!RP38U_}vv>^#*h)kN=0<4wN)C91{UO8Ff=z~OBTSbsAv-=UcY>rDqVDtTC+!&H7$ z$c=LEc31yt2xP>PcLNnkxv6ergTqdeUiUg%vp!L8PXt~rf$n!!i!5P+mxmLD&@0a$ zKO$h-puBc5!g`g+W1SYpjWNHGKuT&fqYZ% z>RX9^)6=Y6tgC`RRZjlykEbmM=1ZkjS;VGRmckVy#Jv?4!elGJ&wJMehAR^viN{+) zOn-QGxR}sJG5Liswn&Ahc*kds$*EtYFFy-gojOYG0^_}MG{OBq{TZrLT(j%@8P?$- zH5&2@^_0nMceOjCBWh3hi>Mxxf!O$inQ{r#np0?#h1#R;Juff0G@hh-y(VKf2rA`@ z43`3nRgE_r97SnPVWwCjYd&BG_m@=nv-ejxGBdewESakizvmAeh~SXh`c<_qRNd!u zWE_KEzz%^(-RBz$l+2w8G;$WKZllX|PTNww*|!Aq#Qaolcf|vw=$NCyIS0et_sG1b zj}1!a1N2Upi`J=g9(~dz@A%-bXZ6ao`REIk^2ZzdHu_PW)5jr&<-UG$;|P=pThWSI zc*i9_=&PVwrn#}9eS3Al&NWYb-Z!k~U@(ZT@FAU#=3;wze1W0gdZAGgzi>CQ*0Bu| z!Htg2dZIDzvrI>#VX;J@SSB2+#A)j5-kTEH?u?_ib~RS)tao%599K%C`hLm)rZm&X znN%v8IDjmS$>$xlvb^`Q_i8ak=(52EVzU+mJa$%i3)Bm{#WstQmCJy@9V|(K+>8(} zWlH9v=w8lwR2Hf9cjX{-f5yA{8VfF-^GIq*xBghFOS=t3p{FduM@Cf&qD^pnruJ`; zZw=h6;(k!)5W%Pl<&H#&^76P;wL2kC_o;H`b$Dht9?pu6=M5AH8>})P_uRb0%=kG1 zwHK`$U>JD5pxzKxiCtU=gK?)Z{*>6~xO9O*_ni*0eCF3z)MUQSPF8~~W9m(1wFy4U z_6>BJhQBtF2O2!j5+0e@-|=W(Ll5&D2{!ul!De%)FNwJ+-ZUy){gV+ICcZ&pz>HA3vU4w5JO90oTq&qsQjJ(o#NIYKFq&rjS-fp-L2OlXZO2uBNh`?ATb35T5Lz2hbWWF3flB-o09 z-zPTNey!ihi&L$ zd2cEN(<8f*eidrd)umoH-sVY%|UFz9Jk3=^d*5=Rx`}v0eOCU^3QXp$zJ{t{y zeD4BcwN#}*Qy2{kil}U+m|yFr9lceqI&%8{{G6K&8}Vu{Am9 zhSyW0C)u3%VLB2kbE9qLe!TeBlZJt@`SXyD&4yec+@4e7QZY6Ez5%+K;eA-r7ibby zQQ;4X7`t;qx8nHF^{kw-rVyFe!0Cz30Els+r$!jUg$A5KskS>K@;mc-D}JL+y6xH%@U>3 zdZN~{8q&(_ttBt#cG}lJ+g2pk{MC{Ax)JL~3yfv?(zG=@6B|>?wc$xS(Cxl8Knq7E z31m`t8{S%_N*3WX6flKOrQZ(6XXkNhho1U^XN2IQC;H~`bj`2X>uG)y&B*HrNvdbJ zzf&m9Z z3J$w#9-_btZ1nVrpNqe5-*!nphTy6<=h6EbWi z*xZ{;2Jlr&PHda&*6W@0Co=lQQYvWMI3Fx4G1%bp&NK7aGHzAE?BMxt2CUVF^keB( zDyn2t5v({AP>NClP*^koKS}uo%Dzu~ll^guI_|2H$%N*Uj>Y!-IVWW@5g8WZr_2uU z+!+z&pVL-6yz;P=h`Q<99f1a{ioYc6_b<)p17|Q9jrI>ZG9fR_wU{omnMUKOlmz<| z%1Hrykd>At0{x)a0oA0SyO00(xMIN{EjMUze$7a);!^4*&}kGnfC|h# z?2Z|kO;t5iE7QknvKAkpOS)e_(rVRNUySG2(QYga2*MIr>KvT3-So%PYB{C(grL*( z0&#;AEJJ%%`$V<=PcS!}%&(}V5*c+vFTa$;R%}`H;6Am}MF*Li~<0$$Y}y5y^yPAusPq#Nei!%%_S9`LmatPnIRE zuI4DGidE1zKeRJ$j=Ep%*F3TrN5Q;V$8sAhFg)%q{*Y!*SgCgzUaIU`EBrA2D^yjix%GRNX28KQ>ChmI4W_3Y`huMBt^B3j@)9 ze=vnpYiqQDxOXe0kII+{M(8P9fbMdCPG_JkZr{1p{YJNO`A}oR2~%H3a^_+YhG3aF z#;k^=oh;rZz#J$m$)>c4Wice^ ze41D_t+qL7x^vxL;8=wn^PoQcRY6Nop~O5R@{7t#!+@v0eihh<*;=-3SzFV(^jbYsV)j241e zpwumU5M?)OrB5wlKfhViya_3gFlpr&-u>3{gvH|GQ~l|=c)F*90nW&#FNVzcsj)`4 z%&(d|nayS_a1Lf`Kyrbt^fG07TDv|_Dm}2_?C~wE$!71^xkF`EUa>IZVv`!;QjbD* z_oorv*C_jlFpKDN*yXbT3zg-~(ZawazDWV}TXtYL6773X{w_Dq8>W}oYhU;ZXS{*T zi)f^K%#pYp;-nAmSSSX)%BKz}azSe^TK`l5OK%4v3$Mkxh1xQcLR$Zd-2(e>#P1oK z)h(t=3<|%S5eRX#s1m*JpovUh_PjS+<1*ib;)PJ|FegXzN3B&xdIsx>G97lm%a|AQ z(zbX@G{bWo%+s#5A4E=aD?W(H9`SS;rfI>EjNH1M^L@)bXI*9{UR%#FB-{!P+Xzw8y~A2 zO?6v6a<7`Yd1jjtjD;r)6o#CWYCXS0ey4U@@QFZgl-LbFqS_TUHbG-e{{fH5p^g-1 z*Bw@vkA!iQB52d!Hz-*2Y_FAvUfEqNdlz(K(|UXwK9xCIy) zGH}X^%|HfF00|}I5k}~?wZ6LHY)Y|+Q;!9GRfS6U4K5@7?^K@`xxVaiwjj11t$vHw zlJN9%<%jWHS(4x@o1x-~j>1Kgfc9NRqneR4d(DJp7+o`!SjzbUq3P9&P$OP`L;sQu)h{o4|s4~}f z?aLRW`(b%X;nX#{%1B_Eeun$7HXtIfv_jO`yy=ntlj%DFFM-y?)_cNZ#d*cvK~bQ{ z0eHZ#FMONfHTl!t1tg6cX5qK~CLbk$#F~XYLB4;r9X{eKH2lx5SxF!>%Pm-m{f`R} z3v3kAa`A}$E93WDn6J9_zg(YDGR~$x$d~-%0<}Q$*E|#<@}CaECl&mYM-3`k@jos= z3&zqqpVevfzjgV)pX*bAV(T4&cbWh9i~nWFr23&C;pMfvr++fh|6nHm?=<|c`tv_B z|G(4l4;JbFPgeud{IuZT#|&=S8nkl94d-_xp*T94;|zlQ7V084$o{+NAAs+_|A#^X%nt;V z>R-mif7bVZ{QcTU_1RTdD8~7U_e;`oAK-<(Vkmhdi~sKCDV{Ijwf9}@jI^X&-d|bJ zr?+_f90tI#(Z}{}v((G}_v#v!^>N_YY4twj{jE|yM##3aDdmXxJW)VuRiaq6lvMUR zOO?e8-CU(nkjPgQ(F_hC2UoNF`F+YE{9i5PVDkm~GytT6b4^Fm?6>;SlbB5-L_*)m zrtx`FhhwwG#8N4JhX5ft+U)yA2B0zLhjYwS3R(VWblQnbb0Wbw|Fg9J41ARbe7aPN zB7sh4951kPs+>PyOu1hE@|3GJiThuQ3OG3K_$`dh%-zL~bdE$cOGhLDe?NfE z8Ur2(3ZtP&61Q_%eM5ufR)1V72xF7P-@!)+uBLlGM=#XbBy;^R?1CxOZD};_ixEY@ z=b@xgE1MM4$nF?U{FJK_I+d+P;;fc4o0aBvlKB#^)2a#rE5bp|1ldEB1PpN8PsZFI-E z-yD0s?9TlmCjov8Dp*us4!k zLiRpDn{)0rmi^-W>gE3D)y@gsK5+%4Q51p9R_5{)C%_*1qX4V3;JCvV=xOY|SKn#1 z*Z^8bQ(lm^L#9vwQ?&n0u}wda?rByQpEZ;wlSyQV|Li~j4Q>IZe%lVvqgEHe`8;k3 zmGVEt<;f<8G{}hLKnq_B))F^YxcWZAR=M{`R*7=5~ERIv-gYcz$BoYQiF+%S6-VQ0hZwy^l1s1LeuL!XuXQfNbxWb zi$3vvL1JpB;}~AAz7`MIi%2guZ&NsQGwit((96%LK5&6NY*`|6o`!@fA}<-F%z8X{ z5(x-V13cc(+CKvEJLX_p*~|6X*m9liW6xZ)J*a!G7vpE>mj}`ZcrN6*q*lNh36}EF z;;ZKjAumm4`Jg?7K^*u8kq@Sd^CPG?tLfC$#XW zUpa&3NI9!mPz?(6ok|><^o59LO%6-<2*D^AUlG>w< z0#UMt(KGL8hCB|YEZF_^RikXCX*LUr0WW^zgN~UWnlkbp*m680m-?p8m*o^ndze zx@^tB#GO~-=ll?9Iu9TxIHV_K$ZEJv7(HuiL0gdDp>rKv_}19j@k4_{fMV)q>ajXT zxqN^R<6NG#rb_+z0Su4!-LgL{1|5U7WR!NN0>;)Ydl-;;G}l<;9Z&Gqqo7=XMOc~1 z*c`C<=A-v2Ki1EO<;BkxhVRmecJ(bqdqrXaBPF#xnDoT;F-`o{QhX3zO;x1yS2dV< zGw!}RyySkaKt+#2c0TyDhr#iJ&r6rYY{C#wa3zhyL$L}a5Mjv53`3583s*j~-W56! zj7(xYlE&+%ce32#lnPh{Nq}2bQxcF_Yt$1lKL9KpwtEhfs_ynbph`e{mvjPIS${en zt2r9|!_kw^%FY2kJLyy8-XU+m)$agy4QdeEQT^Jg@wnK_gf><_CMSYgQc*M^9fs_5 zs-Z*%Sex!(81%Za%7u!qoY4+E^c=Up`2{I~AjA_uuqDgQ0<^0s%H^8<4)<}D<;i&~ zf-B{03iorJ^^y#M!)7m05|asv3nC#8@$cZXp4b->5uX~dW(Ht3q3|}dS#e7$))3do zos_o)J@X#p^FBx}Ob^wZT`jjfoG*+<+i$L9n={2L&evE`&3T<`yLz2Zn(a+ES0oJ7 zDeS~i>ME<2YSI8my$XIzZZq!90OST&=(|D1VjB`IOT(Mv7ADVaTs!ABy1VnO=;fA1 zspz*V9$sU%|+o)lfc6bN)fE8xEaV`$o6y-eN<3iFW0v z8j1V$VFQcJ*oWy-owAXKonD0`7S~2?MTj}vxgTbn=oAq<#1pv#s{P|8#WF{o#fIa* z#!$p*xsGzmc-^;+n=nL5)f>dN>D9A@zp9ohDrnYNUdujPPXtVMR~k_mw`UlPHyCMA zsWYVWIj*gfVR3(s5qQq~kSayE@WXV#+zY$TQxXIQX;Z>9f?Ds3kyAc}?ehv`D_gUw z<#o2Q`S<0$o?+12wDy9r4Kl0mlZs{9W-IBIJyO?(k)<;onHfy4V+Q-bRj1P=H^r_XPb!(M;R{b2j@lE}%pMu9V2zcFO z#tU|W@RztHv01&HHrGeH)lODd3;i$vRRB1&6&I7Tb58s5Dc3Hfc3Ey^>tu>=H7I1AZKav;xiTDEfuQ&x=_0r=$Gi z^^($e?l1``Eb7iV7Az&zG9AX3MYMsI8DWIiDHc8GAQJf?xFfd8@L@?(n>p^RuU6}-f!-DcYB6vc5Q*Pw_KWixi=*% z>z^Q%P}XAd^AU?n@4CSOBS+wwM^SK!T`Fa^a*~Iln z7QaDA7#6QKKnEe!X}TF(d&9U^tGwLeP7m-e(Gj*h4_hd$!(fL0lDXo;>BvaM^E`keBO8rdc8aMCNaMh z9Bk4!``GAQk2RMV7QxY>)Kz~bhkKFN z)FI&);;^{x4n5OG>E*5KHYrnH`$?D53DJqV14$wH_7aQy) zTuf%e2>8=B)t0|?iibr5D05Qt2h+in;rD~TwA&REhQ=Mi7{gJ92)69@Q;xK$JQ=M_S-HmoU8I!xeIwGR@ zkQSp}X=sj!c}Z`Rrd`!(mEaGBB}5}NlFCc(ZM{MTMWc}IhOSf~OsP8aT&WO{T2Bpl zj4_Q)=IYwbRk~PQl}s>iqu;JNP1MT5e$5pc&y$K1+8)%&IJeS^1$@B1S9%SfbaBWl z+Js2Jr>x6t3f}yvXr6zoJ16G*5J z(Z*57GmAnqltal)uXRG~={PHs21~{DOCD)XUG0#|VoP*Mv0jOASSB*qA6(-VDmHu( z)$lh(Ezu5Kn^x@y#e6vBQTidK(w9p+JJEfyLze}8J&EvSwkU@gRh?`!TS5Bt7BxaC*n-b)1ya@+j2EE^CqiIvw>bemnQ&@uJ-F zVM2D#bj3U$Sp-|e*9bZbjcDZQ`AraM{`gotjg}@3nfn!f1_>oGcFcnlB9&@&MafEq z24~*p_>Q5$*?bMo=5*=87YRv71pH~PDSv1@`XRrD#Xv7SuBGiZwrQ@V?2w-(xf^NB z?nPdFpNh6;0V_4lW&i%m=SiWB;_PLt>rilsRUEK^8_gRLU-lBY<#K@T9d(V@Sg4)A znB!QuUZq(I*O7x1s2FS2zmP4HgpzlF&*dS4W%vz7b*4R;RD0I;{&u?5+$sDVMx(*Q zmrdPz`8*$EgNDypaqZDE)wC~^-)x+8ULNMBdZD2PdJ$bp3YVu?423j#mgCP|g8RwG z8L=;XlSNAcRUi9G?v)j{hqQ8dKP0o1l?(mii-idPZt>Qx(lEdz8iv>RwAl~hnlXH6 zwtcf!2(`j-D9cr6UtgbUWz?ii}nTGI6GC%2wXXnbm~mvzyw2Rp#*B$TU@Y{cdx z!F9vOp7Tn^{K|8v7yKO}uDXD)o|#*_u(}0%a;UognhA#NX1s6~#wTH62#b5TAyBlh z3b0hK6S_X;CFFIxnlQLd=kp|g1M&Qk3*8LFoLVDPzSZ?&TQP9R3~ZzD2I(P6OP(_S zWlZUv0V|!Z*w0_sRV>=G74sKY`%@NGvZa$c&BhHmGH3i&IkE|K;bm#WqV`V+Z_4Bv zX6d!-N#kf#80fOYb9Z|#cIaE77Z6<$Hx6RD9HtC^jO951Tvqa_A{7)K5~8d2ebzLZ zph}R?E?58F~@ng0)~|-j=TQ?(kw>!y^mH>iiNpr_5lVGrW@s^-=m} zqz?<|QUVb>Q=vEOwdYb91|2usoewXhmh}wJ_CrSlbORQw5GT2xgJe+ngbF}jB8U}z z?Yx_BekSo5;crozER{H@HdWbNI1z-G2R7HR*mQHy4t06=?V z#-TeJAa|$i=jAu)WWDQ4wnuhdN}fh(M5m;;POTt^sgTF26U^5 zw{joi0Er3=uv3p3Rip^awIC~WN-CS>MzS9tKaA^UkV!qh=d?$!b_(J9e70_qTJJHC z$2t$2t3KADSRg^gX}2CrDuJ}Je^)y!ObK;D*4i%#lY1~>IwC_8+dSi|WeAn zMX}Oe7B7BOy%c-|7gO(L@i>pi*g^W?bLr*YsdB(MrmI2=j%T@cOHqqm{XMFCNTvle^Axs4{MhQfAkPbwZUFP_zh0@5>n{K)OqeYV~^3RHZyo*kl*qghlJ^v)iCJINC863jMN+$&k0*pCl~jfA!%9f8t~o zroy{H1nBd^XFmIqFnrd*>W3XeQBvzgj(PPa_YqyQdzyESw38!f4C)4oU*F2rhLtmL zw2zu^28(Y8L)uW;P~=_IIP)G@Rm0s z76&^suoT^&#CrVZ08Cx_%5unit<=bZE`rB8aYu+Vh1(gyyR97Xz8j4ee}{{tfRTk_ zwJe?G`j}#5q1))VCuKI*TzD-d>Y0;^_57f2<R5`5|>lf)(MWi>sU z!#{kj^e$KFIsG%2pl9q6_h-qp#fBW=hv|Ff^O6~hQ5hTVbAmy#yrD!|+VAX)Lly-5 zt|b@0aGtt0MN{f$xGp7QyC+deMA))2B+_G zE3dU_RnARYdi$CT&f}PdG41Cjqvq>N(@-^Q_cPS!agcEsB!3xFW^WFsDq(%1A837o zR0$Rx8LdWECJj;J+idq^gqrbRV|OZwZERTR*Lp`5QpXUE!)A@_?;z6aWszF|Q|F<- z@_{p>L*40kUK%IpXIK{-XbA_u!*c zYdeL*;IucEmIc4#^I$)-+9)MziU@U`?@2zOu2d6mj zc=@W4c>8>-*gU|>fEPt(aVRboY9;i`1riuEehiUHnMyXH%t>cZ+HyUEp%668R-OXj zQcOYzJ44}bzTI6Z&rjHHao5uagDVFDfL6C*fux!I6T-WUSgeg$1yrZ7FN<&bzEQAl z_4=)0q~(jb-kw&X?57!^hI@iuMc9VPdRt{vY(c3Uwg4x?gm<=BZyp6P#Wp2;)-d~R z!e~`X5~(BgR@SSE{94|H5gxy@%_PM>Pr9Qo{ zF{cr%eX}Mt$F`C$Piqcb#qAR_dC9E~Y;gw&$;m?}q#lWdO96C>tDp$cL(EA?VHMqxrocl-O|Qihs&8nH_NYqoGQt~2-y&7h=*BL@oXX>>d0Z4=BGG9p z?uuiO%kqv2omNxgd}oBFS6FVNSa9r~8?Ib3hE!pZw-auI`|UFZo%ZNMBra#x`HO1R zGDsvimG7KiWbbnL%$E{GGp`WZBeCsoP|?k9;SkC}rzwbXy89YnAr%&N7LjLD(~lTc zBh%Wr5Hm*$(+9!G5``1BIvBvQs?0Wlt;JD2hAQOOtp(~Dd^|tweeaoh;cB8>*K{+B zLWe(BRrDCd_P4|Ztk6NBz}up9QM^GKPwKCz6tPPA!-++lZo#^aXd}QGnIT2kAdBQ? z-AaOCIkh+?^bTraf=GMC@S$liBOR*X7XZS$iid&bvYKa!`^K23+m%SK$M@3$IMJ~` zU@ztBEIQRotyWf|nn3|?=+VprKp6Tc0_tn6(g+&O#zT*3x&-eKz2?56^WA1X8!d_X z-oPvq4TdQadgE&}TE-27hSZ-UNu^IkK1cQ!qX=0|Y?pFb9yvwgjOULK;@M;HKlg6b z>aU@^MmmFuoNDZlCi!wZSTn5NLFdCd0hcwg`p{P#n_ZmT zYTXLk!aiw83Oxtsgc!Z^p8f8}GsLhw^~!+FQwCdhn>pQ`u$_SLDe2K~LbxcvZ3S;NGk+w7uwHk~JnbM>-T z^j^I}paPK$z`~^V(pLO8fXoV$>$$O2fmdFKdOW~Tgu$SD-}Lz?29Nvmr?<@bVVZT; zrFF6tK->jvJ&(}>%VLGUo=*L2&RYW!Fr>~4jQHX%_q-=nwukiIJDID^1a=|dH4UV- z)$T=gFn=6EFCq2H^SX#HSGO`h23X-tF1=7>{5^eg{TyGB+Tw-G42ck7hz$u#=;11@ z=AEYT`QZ0wSo^4C(vZK`uK27}KZ-2d$zVoLw0O15H^RRc==$+BT2bJn`V=zM07=Tb z<5yw7kERfo5^=v!+y>sAM@4}suUr3)Zb;`NIB@Wf5-LxcT*ivoSxmdsbZ$jU%L357<(gyt&P^Iol~tN4*AXK)!x6i zp3Nw;TxnGj|4yyYtR8hUrwR$=W!w&D8L2d?a#Wu?W*aT%n5;ZnJRfRV%qJzNh*7+Z zcq&*0R&a~??`#SUf(3ECVJ$6lqCU~WqrHGmAOq@O3m_4WcpTT&x;KH+hMMV zjKiCdmV{hYuQ(dz7TjC_RaAnQ=_4CZS&4c<&kS5U(kJ(r+v!&|8+!e3|US~ITYhW91kZxn4?vuiBH=7xE zdB`i^MW>)kP^{DxI9aMBY(vt9+wpjB3KfcU?iA(y(xOL|zf^tZv~({!&w#K|Kc?ph z#_4J&msbD@3uV}eS8DQT2r)Ap14Wtjs{(XOLDI`84rq(hgpi_1?~)6on; zH?su8OsC4fg*P{O?#2A!&uU${H`@rk{~>KRfjui4e1FPcQW z=FBN*fo=(6ey-Lks0@ZP{Be^%PnzZxu+?pW+?Qm?lF(N`weQcu<#iK!zG>TB>1FU7 zT}VIQk{Z|=P;*3Z!R-K}I4c6AR<#`Co>D{_><1}?FEq_MXZ>nyg?!tnBo-HXM$2JcGTRPzgPw6NlhGK2 z-V4sVc{}Ba^oV%lEBOO+PALw;2Z;>gzl1b9i(y#LQrdULrjyQ~UNLj>C>BBRy=9g- z%ULJ2sEw;19iWkFm?n0E`Gyv{^Yse6=tS#jXf(%#4z%)w>2O$+Glt)mTl5wB)G0qT z8xd?Lej^WyAsbMoh78f+@&*ol?%4Gb!5WXVm{4|i7@u(I zc$i_~VGaj_K(|{fp~~9+l}8?u^zVE>4@WKwQ5|Kx51BeJlku*v$h~IlbY#AiqT`mU zH{>A{9_mzRa6^7$d3?ss#8I%B+UIxN6~^>@QaN@quarcsT6*Vcj zF15>$Nt!cGh`E9&{;d=rAHT}|#yWSApBh+t@%+!X!q0a*1W!-0z(Jk(QXr4cN+d`c z0*A%4`&I!{8rY|DOa|h?{0@4fNt{{$egf>g)mT=*Uh~P4?JtkdP|z?VjutOHZO((B zu6$nU?PzJ-!|FhCJEP@#5M6kf1;M}T=LuOybQL(Suj$BY*So#smw_m&+oM{vc)S(C zO>`Ea0Zr_;s=Gozxt(kCd$M!6mTz3;etcP(12SXM(Zp|+{Ug?wi?yD@o(09+M%IqC z8qA(c46h9L+vnjInsLjtpBGMFbg6I8{C@PR@*|9lYsC<|DBPLNSl7!!73dOdOBi8PBSeK~U1gl-`TGv%;O!&8jeu}*BoR;9n7ikjb7QM^N@K=zU~SM3=S^#1 zOmOUOXs%&&T_M12Enn_AJWMYgl12_VoyfP@`Rs*7zwH;i4ZcH+#<2t(-WLwK>mk-Q zrM>Py%1EpGQf@RntK4(S075pkH<4d+hE9~cn&gMeWz-#}Kr;|2k;dbCcppKioF%t) zwcxDCrzHeUK>i8MD4oxHy#Hi06Zbm))_*iJ!jHmBzr+8U|4oZ9JVO+hAA!3XZ9KVq zw|Xg-uHE9iD8D<$0}C?MU9fOJTAcXvojcXtYs(kTtn-Cf^CpXZ$S zobSvyI5-ac?|au;*ZQq%qZxEi=bPSnv|qlMQ+Z+T&R~X19%?_Zv>(;y2qT~!W}2K% ztT3nJ^|;A*uZ>dpFw;nXPa^wNCgwK<}A@ST)qV0TW%tQUY zniAVQ3>zWbRqZT^T#W5Qwcs03SqwE_qS`#i;if>VPU45#jLw}on^xH#wZ{REqOiu= z#ldt%v&q$p45|@#4f+608OU|62mb4eTkJE18AuRkKLVGJTovxm!*`SXw?@@i^Bewv zC7Em+e=qFAISnwA8swMTi#Q9tS4w{y-XP*VYn+UKm6sb_MewffC^{Htj@6Q~Sl(S7 z>lX$0$5J^+5#Celh+&tPaL3Hsb4U>T@*$Q0ghsxoHRL@g6RnMAiOH2|@y4LPBt_AU zt(m?uiO73S#6fEyL7*R_LjCpFTB$7D^PXY-b}BR5uX4Oj^!bu@kRb=Rmo=?^`rERL zW0VKG-HE${&v$gMCmbAnkyKtCT^;K+Sg!|@V15G4AGYrw!MXO{2L?%U(a}$lUb)zl zjUfn~VvHH*R;Rs_PP5T=HU!-o10LPc_gh*^msV1!DQEOCmYWyZ3~pQ><4xvc_>b|$ zLxi1`re_C3vmQK4oHmbcHf7!}3*VJGgl2w1lLq#L;(fNXoBC^H@~3R7jZyD#n3lF` zxA#jn2R|@-yho=s(C@83GSX-y>OvqmE1q~;rx)3vkfT(hlKpb#j;`)-K1w^8RSv-| zgyYaNrF;|F(6z;OJ6fa3{-eo6ekL(YhEb=<0pN)wKw~TvCmPUC@=n`lf8skmxYGK| z&EzTW^VO_QuO0<@l5yvk9!|S+?>H?7xrnEQI|mTtX@h1R`;?(_s#mB2P&!8%mHI&> z)mCR)qw8R7fv18RE}K~*CWDs7I_*Hw2}W8Ji}BbNk-$sxJB6|A4~klWgmV878+_O? z)*_h#$f^@yj|46&GYd9`k$v$nKAUJ(wxYwzI1f6{Y(FP$4czy5GtNUAZdh(VLS6nR zOUps*1&SkE*E#^qvSrBzwHS%HTJx6I%&ej17vV$fqhUuHdx+4;geqoxlB1@sKe6=Q zemlFm&@e2Fh`g;&aBML7GI>aM#!yR!*|2keHvEP3&^bqZ{jTam?K%Pkcyn(Q@*@Y* zc-6sb%*INQ*%InguQrm!Wi^Q7 zo6jxj{~tRAOc@fMAr`4teU1Yu)XsFFVo~)2mhLJfd1DlBR3w2H(MB8N6sLs8eFtKQ z2$PgD5qZ6itBU0QYk!Zn`Jc;2Zs!QtX~GbKAKO<#%iuJBwRw0r-JBKlE85Y z3VwpJT7Cy+I{Dm~cJ4lbd;q>RYxlR8T+Ns_=}dZ}xSZD6&92vS47SYO zEbe!Xdh(!@N)8ykk#1GJO7EjCpkPM>yNLH7I+nC+_*=vH1CvKdEVzclue0)?*30qN zyWw+aJ!R%rt`LD1)!-oYT0t^il*tG|D&7(uiWY~u_dT9ez1dB$Bx;5~=CxX9@FQs+#RG@JMWqfey49G^k&Ii(;% z?hEz+(iobAw(lK;e?`6TzRx-`$(0+?`jIoQKr00eIHbo&Z%Nfx{6-q>Oo`Xc7zMj^ z|Bf%mv*#irjgH6PY!4ST@w3a{W7`OcvRiv5chdib+Uqf&2e7s_Vj3X(|4;JmX_*?p z?JYDZyVR1s;^)x><<;U-(=yd6QGXO-dbnMV|1KIf4b*d@{?WppZ&E%(Y4|+&b$d%J za8}0=lDRR;W=Z)X?eDrje)1x7y!7QI`~UDxD;|8cQK=eoL2D2J?pmMOw^3LutjS|FV^Oni|XiN#&YB z(sOufE%={*yyO4Zg0S7{2H2Q!CwZtHgI04SphIUCM!`J1Qo;6ri^I0m=5eUEkdg1{ z{{0yeWCa~&C@h0AW9#pKv?8MUsHaG>H>`CNZuTBA5$Q2uN?QZdR-GDcCCHV|q-I13hCDzHQBv!Nc zQm>>P19mf!j)*3vWc0WDpAq(279aup!BY^qk97^GKwf+wad(aNF;V#HjM<14v8FlAFr@;$N3I zh=gYyq(Zm^!2ZOmq6QFU5J}vi`#I?4o3A`>Hwt*HCa-AZb6M>6{*iI^`%eFF^7eb& zvyJ>Gatw%_5{Znu*=jW=YFdBgjxcCuR-281?^tL(gpx08Q~8voe4P!Zw-)psNG@Yn z&OM~HCH4}CUwxm8WR~X5nw8hV3BWER$Bo(FX5anqsSKD_l&5`z*M2WC_O+@UP$wDk zq*9|nfd1iNzQF(pcg(I=R;lcU;Je=&8w|7ZR?bOG{TU^n(5$&BpBUmn+MS)9an zYhYS&SsP zg78{_R`YXeLw`r#W z{eNsJ92n07-nQZ$J@LD`o&IqkGuVyme4>7ljSrQ_VY%6e_}%yP-uM;^y5pVhUO7hd zD=`Xf)Co~EdtDL&Y*J1#o|;b(kgf~ZxN z^&R(dvfgPrUSup^V$NNevnBv2hy{l?OLiJ&B+ z_QvOsCJiCAX894Zl^rLb3bWtCut9#0>gfTX2)&XWh{Sj8B-YFHKNBtXAK~5ZyEs?E zESRsveOPXS17Vt>@{U(40=e|Ro9dr)Hvolr>Uv}OxjMkEw@0%Av{>(UCh5!x{C=N; z;3XPB#7&l&yurFW8Umazd@N-!g_H0Vrcr{KVAohPml6AKaU=Eg=DvrtbI0{iSF5?A zM~cR9I~?|joqJHql1ZbyZ$oW$+^+l)L>RJieh0yTI^^~J6o4q+GJ$YWfsqfe$OI$T zlK`#DKE&6jJNf<Q`!9dj?w^s<-R_2tJ#Ic4wi||sJdd2F zj};_{OZbNSZEszB2y-GL{k|w-dI8w`szKsk^7M`Cv5oLkeW#rU&Q|_fR@=>$*vRev z?!%k>)6mHKg=rqFA zZ48zUxm$uu@?n89pQVU;86ZEeu=d(R3b9MIV?&*Ih%VrJJlWeAF72MAi@b(AIewAj| zCT`72gN0A>U5ne!1a6%0St#Px($Aj_59ccn_poDU(`;H_i&Qd;S&a9b+*aG0uR{z5 zXV1IE#&1K7F=BO@N+nZRKGq)oGMJ4Bdx!9u1{Y)IC!g}|v#jB03W-g&$^)l zdYbWu3$xd1%^FIDHim z5}Tx4o)iVIi)}p1PAbS|NS5K+O{;%?HK?S39^>LjQR_bNGITx?YNUGj(2q4_e#u$< z9)e_9*=bkZ`QU&^ygMw?W^+g))B8F{@V?Q6C{~T#hjSx?l)U;*B91l(^fyze^tOTY zbNgBwBnBTtnlmFbsy>Gy0_9Om?|;7h*i2wkje>j`tDP@Hn#Ai;Yr8Y?fsR90 z-|rj7A?Qt*ypzk7qyebEJxlx^a2paJLH*^lle@=dCn4p+1DqW_MwHF|0<3RQONovW ztmdv0+IJ1s0!eQ^Ei~H361&6Ij|_{&GQUiFoT+-uE^`2;6*Q6j5ehQ?AG6xCunZO& zKUP|eGUIZ8_I;SIkaq||252q)y;nH)Bsb;N6@ ziP1by?)Vbrxr*-S^pIIU%t?3lycL_;os^ z7cZf4L!6Ka`N#;lt7W?fVjBx0wKWFI6PN2Uv(~EqJ>I40>J)+X^?#XRDf;D|A8GcVrigWhwI~F&h_e zTDr^)Mf0`vL$>OtnJv@`&a5WBggt1g|xg{n6y<@$QOzI2E4hEoCF zOsFjs7BF%uH>f+)^7k-)GLLsfXN77$TBQ%rj4zqE$!0Ppv~w>fadUA%zdL0ao7Mu`OIys{TwoUbX8m~=d z!Oy@wm>#^XG7rgwsp=(Jc2HyqMhyTNU_zdBdSRrd>_<*+G+HM4TuClNRTczz2QlaY zcaWH05&sL!9{n$17W9yerjh;!FzZ{v=+VjpKqaL?6Uwr2+_#(JLn$*95*wkj?`urX zxoT)H>d~JCodv5p#tWc+q8KaBgtXHpfpWgYrRHsPn9_ySov-{$%EF@DlNU|05*0F* zEx4S;xVyRZ2F2vP0+sYxIxH<_r_;5uG-gsEe;KWGq_vcj!taG7#fv4fEx|Msq)Kol z_j+0ItS*X``hBl}2sA=EKS-a)K3%qyt^5rC)^eehT#;6}y#BYtarF9FxuE7Cn)fu7G{HQEO+-3?>y+&6!`+J@I~`!|`6#9{iBs3a;+ z$vqNgp!}W$2i0@sTqOkQWP3pwva6H#;6#Ncph}X?@`>*3>4`{>6$!!+@4T^#bvSk8Eq3|$53lEx^mou0p1!2J#u_S`7PT$VL zKms@wQi6DWX<8*p3o+5JL;8q{RbVvw%_LLVSnw~*FTBR9J9 zAbhxAdU8m-BE>mGQ$)G9pM;3m1aOy{Ypq=l6S+A${6SvP%Pl7vjs4qTIJxjxA3XnQ z-L`}1%fq9)E!FV-1`0#ug}Ai0!M_YVS=X{1?wQq2ORFBF?}=IAH=<5A8010>OX+wm zMGLe_g45b?do)*g&FagU-S-aV%60g7Q-Gh^&X%0>@p8gro0ZCJqj?j+d(^dxdZWU% zzKn#(B?Ve-)S%)IYYu`SELGB*wfR9rz0Ykc??kWnep{}~paxzV zK^In-roWco;e8S_h2+R`O|&GyEjZf8 z4e~v;Y{OM&>hUbb=;qXZJs)#|4JIK)IXLZZLSIS8ONwlJkMf@tT$hDGx#cT1dFc;E ztDYBR4Bwyx={gjC|j$(wpQDi_H!C9Y2iG*(4J!g&;atF)`N9 z_?=6eTYv?z61~({9^ul4CW+egN~11IAd{|j4<gN~>z2Wl_o&yoyO(y3GF$H^(= zE^G}29mI2bt_#gh$!Y?pB0JMXdZSmtK|67D)34;a5p%y#h$jlToNFkP27aNpZtXlW zi5(D6Bj;fXS$g5g9a|fo{rcqANaJ)sEr!bN#WkJW<%wz1w+;_=THr=J-HorT^h*to z{SsOl;w_tYHJ6oR=grzZ-pI+6$!0M@I|Oa-28a{jUux$_rz?Fed?#A*sXMmCgZN7H zL3i{77y>J)*`zLPkLAd}9^2*Q`G!I^&$toDD1!@cA(HBC6WY?1_KuM8M9^VbvJ$QB zKHir7!urdZ^A&%{Z^_Fa43e3`9d5QSJKMCo18p?!Z+DdGADoE(9fAP8eK99Iq_F$N zB_vMc4{f1`c@(MV(yCQkpBrs=OH#hFn%g`y@;|UtzXSv=HH#r_xDrs2EREw6uyaDVxCas*fR0>Cq@{pQo`;^mB z{<+rgqLgeJxmO9m4z*yUp`n?0Djk&aN#BKFDlk2czwhd2wcES(6%PuA_}?V0I~+ZA zgv;g5&ESuf{>dWelLERze&7{M1`36vF%t_e7qsLybXf7mQO4_Zh(AP`YPFjk3wSMb zGkmZu1Y&>mOVA{IQW97%=oDW^Ym10-uw2@XlbR}JH<*d{ zUq3?V8lxOJe>$k%sLxCPA<0o~p?HLm)LUCi^ty5X#cT0#f96NFMm|4!rk;6{4OGHj zY-*W-Q2ayOsjUV%o^K>vFdZjPbS;_4k)%@witDw_?v#0p0W}fR7g2>k;IsSTLruGJ z-x$_d;YTsm;toW9r#l5Ym%%uV-qTi_O$+&$USps4NPJj0t^r{c3R}^biNqxPaRSF=irF=Zdw`DKYQYzCbA$Mjm zpH-mOY|KWoe1ZOIq;d!JvzmOd{?pGY_4t_q;Sj;~O=>{b5hL>Vm_c0ln{CPaa|HQN zlwrRiYw0^?(G;KK6~Br`lNZQK%3}2nqWQWKZWVR|`IZvW1f)Vx$y}xb!x<>_G9+c< zM`#+M@!u~`E0Yq8 zNCjdPoB{-3+I;aY+;zzxi!Sds(#xpJqR-#ZVrzqu=j>@K}S5yHG+0fQN9DriYv2+BZ-rx`cw)$`Z)X zCD?%1!7&PhfINcEDPOF6%s_q@dY>5D!C`8)y3m`4r$tko&VQ+(unYfi1)Emth)azfBrKgO4m2ZLRc?&CL>M z&uQbzt|-+HJAT2+;xIlBvd>82_lO$Hk^Z@Rh0?HS=g2ZHRfOf3+a8l=kvh9a8e;AO zU7%6zt&(m7?CaThgt(aa|1Eud^A5bE-z-J6WESL+``NN>Z}$;Xxv zo!4hq2noRbB9Ejnhj$5(ysgT2%>acvCUd>@A3^f{*7?kbK5?VGRU#WtJnk;)>~o^% z7l6mr1W9S>N##2=SmB_cAZ6d~$*xhm8v=*dQKy)?xG*R?rm`(|i!b3=eDUr!(>+vZ zLXI5U3d*|y702c@qA$Bx49Dpk^f|>v#LuDwiVc3MLRwmAN#-1?p2qhO1Sm9Na*Vf| zp@?p=q;AebVWy*kRY+?srZd0Y(p09JGI2yzdf;gd(`%1@tTFRA1l(5H@x ziCmpj`p#qseR5SV*Dl1AYw%JC_qzn7(^8qH+rc(QDQ3h5G#bS+)9GgVE$74ophOB> z>V`J*MjjOi9Z^QkJI7(pNjB-=LsO2zt(5&v$3@lQphLg2#^%DtL2xJwcoqzqPFu)i z3PDTG)hZpeJ{P8IPAB=n2fqVvG42)l`5DGQBNWtH_LBW$Df>(j*8aOS#OnQtg7Fm5 z=ZCD+z3g*$KD|LId5OnjOIOVOKf)aP3khfo( zmARzDohE6Z@Je?z5wKG2e9k!HVR}#>FhK+5D=?4In|9pQi!xPWRo7h8nqFldsyKMM z{(b9(|1UWCK)qJl$HOP0RGsqE&v5Aee1G zVm-6UJHqHT?9|-8dqX>Vo-gd!5%9Z%vnnO)qxO|^m-X3TG?v-ND!FwZUKh5M2gSwA zr*dbr=2F>`0N{W>M@%nI5&pt|sg-f$uX;84X)%q{lwLXDg^bwrwu>4=CJArWNqP4V zA55YmxJQ?(Bkg_{O3wSUapaxZ7L$nD#cE*TQ|FCb^S^ zbbzd%JIot1ece{pudy9=_ZI-Tsx~nZHe;4=?($!I%v{rL^0n(<0MWweVjkM}XqZ|i zAK-ln3nt#z`IVo$^&6Z3N6loXAcVI<9F>j|8hH!baFzXEbMy+fP5ebni_zP!jH+ZE zOoqVYt2eR`Yep2gOV4xQSE?}$0W-IORmkxK!5>DKk1D0DdH5$h57Cjr?mzt#g3Km3x z6U1+uqot%OLq!gX9;YeP<4;Nby!>zVnZxc~p~7%kLyP4VUYSlA=JjZ8rfu6Z^=0hQE<}}*dGGOf595wfDBJS2fVc8f^0U}WkVNNz zZhHART1Ak`y}N53j0>Ogx2!dFZpB`DVVE8m2zQ!qr zEiTS^BQO!bxv~7NXff>Z{I|!TtjY??QvYGK*Fk)p6uyp~kexv!VnglfX6oH-=;gD! zk6Eda9+7<;Cn!-gt{)y|+M8XK!lTaTr?5q$Q4|9)vE|`mBBYv%sU)MAIRO61_0ze3>Om zG7(%^i&~1iBGFs8w!o#iz8Jo|)_eaE?5fQw_Q4U-d(L4(i;M5KVXCB>MfTYpSl99u z(g}pz?wQEMHIvB|jd#oUx&2LRuP0r&yg5-S?D-eZwMGbZq%Gp zvb`BlExh?mSPDaw4yPU=r-G}!B3~eGzS!;QxVK5}v~b7YI}DW3{5vBTP9ezH>c~z= z7-R#}c^)UN+!^hB*HdxT0Pn~jye=rqGC$xJBCG-(Hw6S29p;HItraqsg{2%ckCH>Z zT}T<;=#z(r;;|N&39Z761nNRww>%>%tGBqjl6B<^?a!4Yk^o{?7Agfln#GsdiQ_xu zcB)86Kyv5L@owCE9|9*S!baF*Qh|nfUfxtVAfHR&fvVH>$g2v9a$3d)u zfeUETTp-V#=v=gWL7GIrVkSmE*?>y)+YIjKHA@WQyi8Tn=@Y8Z|2rl;76W{oMWpnDWy#%^tc|ehIzzlrp6J<()iM-p#d}lF3 zyD_~#-w@Jx>6+%Ekj_u14-fiW64{wJScZx7hJ*Ui+ji?2e4ARlSI_ZTHX{3%GZ7GV zKsi5${Y`vCY#nrPnn?FefjsS=Rvq8jLcis_35(wDVtpI(d7zy#yb#jvyhmxu;aO3gG%K&gLE@4Uu9syxh5tgmRuruUl_eW` z5QNOLi%az-rlFN6!*G(TyM$D^1fU8#aLuF}yBP!xgCY|vNJCEX@M6BvF4^O;hB3;9&461N@w>Y>~2C`%X6=LdsviL!hMT$ zRQ;ec;J@@)+KvB+Wl`3=tZB_$Vb1IHc%iLm3?V7PVQ}}0;zN@5s?oyM$xqq21*ZY< zcjICBB2vll`GmP;48ld44+Dqeb;sr8;_3Os{l@8!DYteeb>^ROPFlN-JYTqL-IIU2 z%)?*!pSmsp=c>vx`uAb@>>EL~AUFMjlLuUYWUQ>p`#+xXv}I7aJ7o`o)q>;W`Gz!C z9fkqbrEAe{10%1tl(h|6*UMw3VrI%X*NsWB`5T!eI;ULoZ-VL~^W=En5344Vw0hXs zE*MoDMy0l4Jjq)i+Rc$}ay4V}Dvs#d7@KO5ZF36bS3bZ_4ps(Vmo{~*X<1lesr;Bo z8?D#HXY0R^OCyr&f2uK=G-C#rfFOX$5R#GqPAUWNYH~o>xxN8vbQRgBhr8=)r_;~g zvax?R%F!3UVnV{3uh8O&iNz=w%U@lWXbuB&S9j}PU9po1wJANu`vCZWh%LMd*`R+a+txf41TtG^>Q> zFl4x1{?p@nJ3_L@;-KEzzZ*+^vL|_i{$V2BY4d@FgT}<6**qS$d0>gluW7~~Q-t4C zq!$|PJ}TwhUhL}?sn)*)qDd5`R7&qlQwoXrwIChC7!uj$niP5{Ur!YDeDyjus^g3A zrOAzV?p2$aJ|DTW>c^U$#;LVP^Li+r<6weKH`sty2>NiTEgf9cRVu`pt`vN^0NnP~ zunL(`ek%DMjI4vHsgV6%pIVa8={GR+(ulZt)_J|MvT}p23jZg{jc>QYnq{Yi_Suf= zgzd_PZ(u`yp%Z#DW0+p?B^ue!Zw?j)rZAtji=*H7`hmmj>%2JJKSA5yhyL@;?6WkYZVvQN*cXTTO)~P>0E|!=_^`=v#$Ct&QdOfPK&E>Lem+UpoJjj! zz?-;ARhFQ36?9 zCB;8kkI7Qg=f(Y4hAMd->q^1oX=G31`02Nd<5$5b#iummE7<#CjX>w=*+J8x9AKA{ z-ho(A(uq3ir`=Ss>dVl(ySpv$h|MU>=)~DD07pQ-hu5U@5I)OZ9b=XMZocKbNB zkBfir685|t&fgQ}W2e^URm>GWhR7RGfXnWjjQ{@I} zlr`!^V>j4>-z5ejsBDnW$bbyvOgB%$28Gat%2fKLq*S-q=;h?kDO{b4Y!_RmEA^F;P=?U8KY7BEUf>`;8P?cO=^jG6DGO@9BJ z{6A=)o|b7PWc~}VkYTgK6o0}~$H0YTj>MGVzz0s3i=GbbdH)Qy8w4;y`&>2&RLVpt zZ&*`cZVm)4=<3gdc-~^PLa14i$!uZH7khmxfx^PV1>l}ESKin<>ZhH<_lRo@0>H&7 z)Bg$-e?pIcXAvXc^K2hnrcY3AcgHZekFD7+^9>mhAgH6{+i=^c#)SSIv+h?q z9P6e5$b@Fmh1zX=z_B9a)XmA{7iThIOzOX%c3zT1z1EBcblD|40E?{Gr0Fy;GmVmI zJgQ}5p3foSAZ@4(Yo<+fbV$Gg4JG1nY~Ow^N%b@M|CkdvU!Tc2yI!v+hsp+@uGIEr9pQ`*WmU;}&lxg*w+8L~XSuKc9g%-u2>9RakZ`ZHniB!6EChm{jVY}r`!Hdo zJjtZ!I*|2?2d2IHGto$%et00?^G>H$(Kb5kod4qi;JoT7NH|Y_$Jfn&{5zK4q?f0) zJt%rh0IV_w0+9M|0B};nnKPj%E^>IH=f~yI`f)f7cyl~IctgFQCL`;R|4OiK-?55& zf0n(8zAjaW01}{{%<5yFmKqY}Dt346m{%XjIP+W1C3ea0(btP2c#O7l|BnyzgZ_D6 z5_S_$4%^@Hv|{i=!e=XIHUUj&XF%OT6+)~tnGC)Zd;trM99!k??oQAC3KXoRhCyA1 zkFFg=Ve4laEXQc(F9a7LAo4ihfM72 z={-=R90>~pX>C)a9o2VX)aU;9Hy%Ml9P}nRfSWw?ww{8;h8a}KkwEA}Oh+-RE`T$MVEVWEw>;(}g#4fL(aqJ(XGFE1~J zVihJLhFoyfXSMc!eB3QG#*`B*PMcim^dXE+N3?faAt2Nr1MaLeuV06D>gbGkGU5WH zHb|>%o%Y|?!6&K%LWF9)9_0R{w^S(k$!zB0GKE9Q>=BIh-M*GqR*c{KRTF^!YL%ov z52%B_oXnT?0o~fKnN=a9|5*xGub(@BL4NlFl7ghW6R<6;uUx2qL{gy;TT(BFMu4*c zSnl-qi)Xnzd^>gf&RxiUPQ`_|hDVB;49eDYoaA~j`4bd>mvF0OyA}C2;NmI|_Pqj7 z{qgkzzG(|vVeE?;05cui8qHFr3DG|Su9vysYNxA{s+iV)XMk1Evt|e(VPRts44Y}9 zBsG3n6$OhQz2)|xN#UEw3vbw`1hl|%sWq3Y&TK{qEJHGClgt!C4l9y4dQCO`%Am;N zfA)tmbStqT9_83FnGC^e6NPok**IX$ZRA4C@P%~ zZyXWywgdii2?(6QfnyuAU2BfFe+K1Qo)4iP^bket5`Pq{R>_%d4mq7&(UjcZ6STy> zc7GlCcz>BxDdg4hlGEi*G zF&-DUB|>r1XEMoM8wf$;Yf$<3%=)h+P%yWI$i$krhT&yB^0wfxprLc#ET;9+Eb^B5}%$Y}8 z2u1DOEHIGRnXlm8U#v<1j*VwR=c_&LqTsmCY`upW&+PO_3eQu_TxwI}NIqC<64T_{ ze`ngNzN17@vE41DobjiC%7F#^>`POp) z7bD|!cbzh^MHm3Yfp-9Q{suB-InaMO<6}2dX+W7p+^gg$l8Eg~;s5(3bT^JlzzG|@ zK6A5kV2CDcZ7i8Z9`~p5O5!q#}DJ61c*&9ne z7Q8oO0I7Rp5k(^}`jy?#zl-lKzV^NxV}(#SVZH&v=p=jC>GWisj>UCt^ELh{UDB^Q zX@~Tvu&-j03DIvEa-r6rQi*1-b_#>o+stS`9PC-zK|Z68hZ(&KQx zA&aM4wkbJRJ@09EfVN);<^Fi|Vx3wRyc9;CysYstq`SlMeDt^t;=xz`% zzIhbPmCjo)Th2N!^AIAoNvV!eZr<9K%7+GD8QRYAu2%jYRCmu_x;)6L&=Wl}cRAk@ z?~7?$tEJq#zDH5YjiWvP+Fy|x0*~d~Wm|?pB_-STAUttsmEE&i)?_cwPVozn?mstQ zNun0y|BTr*=+A-~(bZKi_&mt|ak{4m9%dR$uMgz@DBmEUPewy=tBiXihmC-;{u+2* z@8m++3aV8)J~xL$%37Wx9?c!8p{*1OzA~~%Sv&<1cghl$u0JSg4POo=GLdVxxlg88 z-TvzZkZSNozo@3!x47#ICiT&gpvg0bpZXIKE;&-EUk}ZFACDe%B?QfVYdK9JRfKdc zUZoAqnz<7k`d?+gUrF-F7{KES8iJq4NZP#W(&EH=JVyKBojhQt1IyeQojXlN1p zL=pRtjCe>Er)aE?8849bmel*k>?V}MES0Gt>2SKQPku4hsy3-P6Lb84 zP{Y@aJeKP*+``nfUpUmt{QFbM{z!!FQUY%chjMf~MaO-Qvwq=z``8pwFr>~}AXZ0T z{bl^6fzEuC`}~PdpYe}CH@1|M^SpHTPg1?-g$R_eW7H@`Sz-~T;Esc#o4DVb;>h6D4R&%4DpTguT_w*62P?Owo77c7ZMHGT_Fw%}b3N7iT# z@n@%7jfS}B4)ZX&4pyYy+YzKyr;OB+3myc$OA+GTDAgMot@5xX zQ;{tym_8ll!nL9SiS(=luw|sR%KOY*DYa@fx+cL+pYKd<a_n3YESC}7#JIi8jQaZ-x?y@0cg0To#*mwFqNA&Z)gx%rHbpulS8XWn{?n6 z*Y?0A`ZK;vfAuMhkdwLJq>&qtzWdw40cwMTZ+M}<6d)^ANJ96hoAGVivH@9LB zpY^B^jda>szuXyx*pz?SSIb8GXsjsBTog+X8P+46!qV4mZ>~NXokQm;#Mb&u-2P7h z;+padv(y7AUH{wB(QgB-rOPkcv`l)j67VYHT_(_aWr{^pW8f0ytp$hIn@6Crp7PC= zHCig4n^Kr^NZ~4yQ|M=RH_7Qvw#Qx@*AgFfE5%fW>b%E$2JU;CQ_B1MOXze${O;Hy z4a;;-cDnC-mulf~&zDG_b?qMVI*g2qNqZ~ujn|T+>QAiSSz$ooO)EH@+hTNIxc=0;=H6bNZ`v6Cp6fblRN zZ-frOGQ*uuqY5liERqDAQ!0Y(>>0yWb^rDC zY*Cl$buynD7oV1hpGzVd^R1urZ)aG{ovW=%hr{%K`L|=qm!Ug!vA<-RcObfeY;Sm$ zJ5A3(m&1YxnJby}X@{Ig1)t3fTmT=M30jyctXn-EA6#9*Rqhj2hSKphnVFdrpo6xR zs9zluM<7V@Gv-M;h|sw6KX0VOY^|y&Zoozq@tO6D^-NY^Krz&ZuWRqfFF1?^2O$e%+3VjlE}bulHAD}=^?B^A#TwU0 zH}>l$po_dUS{*u0cVF`>o7>C0j+vHQ2Px9=!W{VIvThepXH+^J9R3A4vGI||G4DL( zpw$gl(xwr_;<_j*3oW3ye6;iUknr)4d2P(9e;S#P>lc*Yoo!bzmfkzDM%$>Edp7CV zCk4jw4dAwB|8iU5@UMd&_&m}!2GY8NbMaUgv)h?1IU0Q>UupqW3q)k1bc8*?`X)+@HNj>STxm91ph;JP)zRV@3PG=#1?lp zKH3V7t8I@b>x07B=DtQO{5|+nXi|`O`AXP;Jg3bbzZN9Gh2`Pipg&$QX{g0e=_42>Rqx7YSsnD9gv|^wuX14EB z^U$_+FRtUM029#5Nbp}IA$O0#TQ^$3Eo67s9Ln8ZlsJ8AS_nwx+$-n3-bBz74#Soe zEMC&g2o=3psZ}`4&v5QAI>H0`le}{XQ6LWAFKRzXmat7m^_bAj5U323_44L0Y z<}#($n~qD?#$kT8vhhrR^U3Y4M82iPD|F*;s8NMGRBRwB4>m ztQ?(82yy<6mdspMy6nLu9s`&+HzwhW25MR@&S5uagpw^TcC43J`j1#0OKZb*=XhfU>V_EpSHn@0X8MIr4%9NcC zunll(uVm?yk5~FE$lm#l8@a5xauvfIx!X^L66tTx|y_>cW zTC-T>f>1ZdQBnS4SS7&nXM+Ng{FaAS83*<~0T;&@9r~P?SDEb0iQ zL*m^VD|ZcSU-g4u4ft+s)^Kh0%MWmIF8%#K&*vN3-Uz+vvEvT2;-{Vhk>6f9O>KCH zqsnK9tB39m&h^IF!Q+BMLrNyaF{(0mLjUcnng%p=}__3)HO;qt8@u65wd?7#hyO~Bi zy1bO{^|&_BU^md0TI?0LdG#lcLxBkIPI#X_RWvL>GM2H-|OI;WbcLYcS^?0HT8B3B+utOXqF70@hIs14c@3AfL`?(>%^D?k*j zSmor43@Kw$tBfu+(YhkQQ(DQ|;(S^R%zM-+nZM|i;_(#A7u6h@mKT2>Av5Y|PYv#$ z{p|{IL!gQm(7uSbyT`U6aM5HR(XcPz{rGSZ$6DWmC2hg2BXPTM5=ZAe+M2M@%Hyyd z^KQ6Betyi8T0sruQbOU%>d*jU>D5DAMs-)AlR_&XE$H_MZa$nY<%=kOu4<@-DhomM z*5jceol-KTTd8}YiB~$p+vYKEr`^TV>3+km-i9zUwoRixky83@{=j_b-Yw0d@G|Dx zJA_kCP-R?SCp;hW*}^5m-~Sc^`B!Q`BKAtCGz>xy0Y+g(71nExc-UHCdO-Q@=8mx1 z0!UN{K6Oab*~+ntdf`W3AI>AMY^63fj`nv?OwpgMJZyKX5&ZeUDnS9bvU6E2KYOEE zDdI$&kn@k6HWOm>PfZgD#9rN05`Pl?VT@iCW(3lnq7rYtQcRcCpV5zlb!6Jt;pq-z zBbiaijP9J)sB#@!n5H;3LbVj~da9PM18L7kd(!2AGqN^Z$(=yhipvFFyPk@cXvp4HzEiK(%ncYjg)jscY{bt zN_RI%mvl;ZcgJ3+&-*^#*fI7P{*fE*YhAV0Tyq}tJn8+QkLnNDNnj2@Mts=8Y+@Mj zK+@5Jb!DK=SE_KP9NUfw{dpmjw!fnjG2cn^;d%H3r^U_NgDHhJK^ArgMK*cWQNQhCR;>L#7SOamw-1+_H_arMKs$+3d1 z`qQ1FUp|M@v+f8K07cUubd6o9qyAOr_BD?2W1~7UAN2* zdZU#l%P`4l+G8VW1U$0qNLr zy**U|fPsE)c6KG-s=3Y}Rq9@H!~$|#5AawkuPq@uT&cGxPN=u?Bv7?>p$A#!=r{|1 z&6p9p<8P=9f46LQ7qWfPvboW9!JomCswI6gdbUuEV$+Zq?<0YZ3OF1v6@H9p<=;oa z#7rN-$CRd7MoA$)hBsNfy}i%j7k0@%OZTa;n^ysj9p4n@>??V4Zh+PY9=jtH9|R&X z=g$~%qOeypEi(c9udhsh?MFu__J-G@{f;0u7F5u2#_n zkI$0Tt#T9JlyJ^FzrD|^ac5D~j4mFb?fxB_7#r*8o86PaKYJ8&LNY9W-6(YT^Xv}r zyUjr9)MYRzd^m-jtAB_%$Ep>9Eo|N#E@tgi)o*#98Grx%Q}^gB@%TO7wkt<-X7(5U z?VD)N6mchJ$i65O-E6QUA1Og!h#EYC3sCfm=yPT( zEktu-DXho2c0O_pyfhXD3C1ORAG@|3h1i(}#LpR}so}0mpKz!_HPsI!ar=5F!E!Vb z62YTXtV1aIg$!CcnKRlbBK4RRSS@kLp3n5{-3za&@b#x6Ht3KJk%SMx-_KWDJ@{fa zhT=_Ze8Y{f^^XcH` z_6m9t3(N$<1W$W%8XX&g?ovZ>b_=elf3s#gd*d!osv%aEzmP^tU(LF?nFCW0gD^;& z!^KxwPnh1b=)NQ5=)-ljW%}T*k~JCLM*TFQ|06F1SB%=>F6wc2vwsS zKSDd2)ol}*z89*(*RAGAkP(y5wZ_~UTh7R|ZD?D;3{nL{ObTT(qcixX4kG*N1@}HB zOnxIKYVrl3E`BW7k6&#}#POM0(dd~jOX}#|`yLxhhRzv)cE17w=4%*EQ&;apowE(d zW5}vxk~JDEemtP@2RZgqiqk{IlDPhdQMZ?-Ya7)}HQzmZ>k{`HIkWhh*fHeKfk;VifvM%6WIgfpnZ*|Dw|Dsoy4AKDjN9|& z3-CDua9{M{V86HHG=EgU__XLic;SmSrPF%!xS@Gtq{?q0Pvy>}nB`1V#7efzGVXRm zsKLx+V>3P97*g>tm|UMd=TSOb^e?PT1!w!fzqoH=vnSm!f@_CC1R#xz}+cjT&C zOC4UDv}(Q+100!h?;!%e*yd;s^4Y;cs#q9-1Sk}A}wfNo` zRWPrzP&;4=(O|^}=85Y!b7{{XVs{FUm9!@5miZQVrCk~@56s&S>MZvcf3EIh;^WNV zt*7Ahp`i>U03X@@3j&+92p9C^Eu=EPpSqxe&P8cHq(6)C4s_6EaHR1!5AA)CUTDUw z4!I*qu1u!&bQTMMu_3C_2Mdd(KGh;Xm8ggQ!mIKODe^?W2wx ztY36g)>LO)!0X0^${PirocY+9`&op@@PRreSou67VTG`!*>r4-8u0MlKHstthigu5 znH?Vh2F33B)WrFq@#2xG;eUvvc#G9RjYufqtdym9tUAnpE+;1!!9hEX1^F27d8v^s z_Fj%$bAmdm{Ig$SU6~V;-JfpJA8Wgks;ih&AflH=sW8XgQV9KV08~rlf_y5Z5GUFp zARvxpNC*N1u7zWTD7cwnVKY@%S_ipC?qeoFLka6qXsZErgt~2Vx0*Wx$92PS%mh%k~K*K?) z*6nS6k}n;DFfI5AkBSKG_Ib}=l)=YS9(J=N^w6_VAq$SwoSf_}NdZ}mrrZRnVPk4) zYM*v@Oi%5rw4#L+sxN(9wkv`27@u&01WL}a*32@WyGn8i-qqye*^0~QNKP%)7%(~< zBSA*I1${8}7s z;)jUhS=HkdG**w)`3 zugnK@YRxM8rE;LLr6^9KS=tCdzTRjmu^~RV6YW7ZeT4-4*0ytSF$Al4RFvrY^J<&sp%t6X3>s{kD zo1hPNA$>7^wlnEOZ1_SD8XhY|{*5TOH&`hBoFt0;%2z?3x+eL;aNCRvg-rs(bNn!U zh9P5$udNs~P*%yn_aTT2wQ=I@N51*|ALIoB{P_2O{755yGBa5JM4=V~2DUPfRNBz< z)j~S0nv&0Ss}W#s{_{L8hO_{wqs@3-_oY#gt$Ym)hp}kyqu}FjCM5J^4`8Af|5Rg0 z{ZW0F0ll#+T??Ftsn^PFCn$Ly!PCd@YKev+G0(6!gzz!1z#JTozNWCi{CkAI1NuER zZlW_+Y~&OD0Pbu-c`AjHE1jV$DeHal;gT`bsCPPjvH!dzt_hxT#bAq<2`hHMz1Lpnb zgntj`&>qrHxe2@^qs!A{#k#3r1`&m!+R4@1pyz#o|IZ+ny;{a{6{Q^*G%Bb=3Hjpo z=NtQY#?QQfn$wOl9`m~=+KtY!vE{svDa?NuIg%6sN`*4A|M%fZSPPEFC)!_KQquf$ zEFYm=R3Sz=AJk7u=4&RtQdqUS0f_{EU!8w$D)?ob=qCstm*%{W(ik7^Zg|_*82S!KFPTug47lU!i>lXWXdSIZ_-67CvO^jBLg8 zmm&|&+#ZyBT*W}aqW^5CLrzNGXX&!_kn_}Wf4~ekDP~uKQF~;~I8gttl@R|rv;Q$R zM_jLeAw;JjQr?~@#BV(6#IN`Z7t$F4M{e1_6p^F)fk8FjeCBG9HmkzdKd0yENv*r) z@~@}wzXv11dwkE?(|RcWTz(WQDDd@W$4};}t%yl~90IopM_4Phm`BRT(b2J>y7b5C zaSW?{o?7uFA*P`7X#fv}bmAD{IDYz|N38fJnDS{vdolcs!|U;^ALiX8Q*J3F-(l&` zYF`8uJ2#%)T<;!@UJBD*U_zD(x0Lj%`apR?$2ke|^a!BP4QbK-T^xuh4-c0_;tJPE z9rhQRhpyar^-AqSyA53`44ePnGDxpWgxO7a*R1eABVQzfl%o`$t^>~6-q_|q-;;aD zEd6z$6xW!f+9(ng9V#lS%pi&L^(hTSZ-h@&w#51)7Hs#5oD-Cs56b-R6KkY*2f`C()0)~!)4JG9S#w#rP`F;jeHpxcymeZH5EJPKU7!2+l?R$-#3GKfUL z9U&Rd$N)^*-~53BhhPc#+`Y@*_oRntj_@zgnCZN2A=JYkFscyv$o)Ke60FF@NDlkr z^@m4surgNL$k+O-U@>lvms{Q3Kp!^?wG)itQ}7YeLc83`Nxl5^2s||Cfn1shaPFn> z@bH-V2Y8T)$7MDA=!_IofB989wwJ99No4D(`g@|tVG}BWT_}F!eh#Nzwm{f<3>pQ; z%8h)LbeEG04$7eg>|%hNdIf!q=bxwxTY%r(L&?(#+WCDkpPCP+L;L#qfp&uU8Y*DO z92`COw8$Wu?KjA~Px|p}o5RT3S(gUXGM**#I%GWIxWxV09PeWJ-E?o%0mXiQDkZiU z2xX?rXLOCq&VHhPisJ$JBsS$drD3~+y;+ZJP|6&+g2&z*Fjf9;mAX&sAZAln{7m5= zh73!TCFJ8{OZP;9_E20IhnZ4_rFOj>XfD|7jm;keN#<-${jB?0`|r{_SXehDEcP=} zGZynE=Y83fz@~22YI;90K7{G(}T9Dc@s(2fSgiBeVF1~ zF!AmCTr6^c73ITk*lIaJ=(4ss*X5$A!gX3zzV4(@vpN@K(u~jYvgGR+X{ng5ooN_! zOM}*3SwaER`XioEvni?xq?U~gGW^cAR*?40W$5qjZ;095mzB=&-Q#Fg=w+W?pRx8d z^~D$eJd8{o1^k;FNdBr-VavUx3409J$XCnCy#tY{e}?4E`G}*>Y%;)6oIZDBp|$$3 zfPJ#!$ar{v6bHFR7xMDxVlkHjbl3`V1=f<l_^-otp>(mx)_UrMO*j#BHigA z->d$XiqSq5@Df*cU{Bz$>*zYSO-|HSos(`=l&81r{)l&Js+tKYzTsP0G3jbWr}zEP zpPF>Fpwn*_?1ZR^bStfioRsr1vbl3 zKj*&trWzCVi69h*Cr&I3Cll(nFJ@zH4kH`mD~DMV?#>JFjEmt5w{M=Xv~Nw1eqcB5 zev{a|NN4(>XI7Vn(FqgG&SqG))wHF&`9c$#i5w_-l>vuKsV{94xq_w0&9Momue{7F zQ>cA!eLI-oC<#l$4uY=^yt#S}_e;h-93}juj()%jR%ll*Zf&t@dsy{9Sn@+O z49~dS9JBCN+LCI&1eXRFyI`y_&L)i*h9(JxGGt#iwSMNvGukS{T5p36 z_NW!gKmuo^2R^U;zKkzCb|ytIc1eN7AM{LYe69X?7&0vx(ZR>Uhcu=)e|%e9Wd{^;(-OI{FGlr*K{i#sP&CZ*TAHP&Blqs5)6 z2dOo}bcP}rR4gGyR{A6vJ49P+C~5}8$8JAUvX^*RahNoOU7r&R)5UmUy5|Gz?>*^* z_xS5GK>O)1J@DFXzC-r_8OK~;N6fzj8dCn2{1!zaCy|J=8_S#0PWT+q`kQUyn8b_S zFG-DPl{Pz~Ep~Z8gFR&keii}gy*PGkdwVtA11b13 z!lpqd_q3M5xB(jlXealN1fq0@a9H%4XROl`2L5DttTX6q>?z5$WWQ7%LK=_{-pJWF zlDT{wKOj%Ztl>($^0&9 z;>h`ofb9}eyYlN~7fGDgJvSu}@WU*GX}G*}{~K z@B1>Ke?|SGTDqdh&OQfDts4UeTFh#8vVD20dWsJh+|?#*4{hu7P$K68s6`0BBG zM2`>#`kVBkOs*ZJ;`H(?abzoy!a@SZBt%`V7aqz+UvgRHSsy@iR*f7V{N)7&nI2He zl-lAtS2d|7K`DQ604mK><6c0-DiKN~1Z(&CpA(T<0@drSi_N{Lg%wR(3kxj?bN@@;eYJH4`!UBiw}) ze`U7D8!u8$?#-<=c#ZS}O{WBum<;02 zz(z)r3<3E0t=kRaH{^M%{%2M$%GxvNpDy+nXzW(r8og)gc4fyM4l&HXRFGj3clq~g3-m$#JZDnzP-CxaJ~J}6Rp&sCa=@=7(y(a*=}>k z6pO-PE9mf)OLrOAuANQNeY8ip^;hoxK5jNa2kpo<@37QH(FQN!AC`(Xqj@)w2PIlz z-+JO{(+rb8 z30Jl4$S+#^qR_dl7MOf!Y({Q)rODRsqL$*1mh5Mwj&Z7bxLeH-0(%>D(D7uP$l6( zHCohBv{9!M0zF0+Uktw}tWM>QAThs)t{(T^UOb(`599R^+h-?zdU&oYj@CwYeizR` z-1lZmtjl%vJJ=+qh`&1x-0&NmD12DIrO5$X%}T!|#s(ui>JB;tkBIZN9E+Fb5cHI$ zpuP~2rxMC;CybE|+7oOHvtZ7OCMz|q!rD+YSJ-gmUU7z}GRKM#Vl&>tRVw>Qeu;tD z4%_3?jqtz;PE{FB`A3Kar9|{Enuv71q!!u}eaaXgpAcM_MFt}b5eTV%B{8Yf3%hQ> zxk|+8T9JtCBn-ge?Anv2OzE#x3ePzN1wJmK*em63s}yUrb-vAS((IG`NhS)X*{_`X z(!(n)#(K*f2kPk`5`W>JMBvMO2Fvdzx~c*=5s%k zK$9`>vkfO-KZQ%$)IjX?m9BvX!rql>5sXl}1K6XFb}>xCLkv+qcJo66b8q)4`PLU} z3mZeDNz^`GwQ=AXn0Ud%6hcPubGSc>y!drUSA1TjgP2;%H^UWUQ7YqtTl7Ah<3 ze6khI5MK9_*Inw_4dUM%MSKT-jGP^yh?uEX1^as(Hg3kTh-TetrJPBu_)3m`>@u;$FrT?VIH@FZBSdRE%OM zy523jE-oySqF5hJwEpsCp1P&kYHg=unba2rg3$CJyp1+;$||_FeexKCQOe&0pt5n- zIBkR82P7+F*?Vmz8jF9w9^d@-FvYuewKFc7^FlnDv@SWU+zUsF&bFsx2~A7LC89EE z(N-MjMT)g*vpcPs@_80U__=_F0hOa9yQ#xoUg2(?wiO_aV{ayVP`oFWdT8ywjKMw7O;! zAxTP;bC6G;Qe1fYk-jBe%z%nmQTE5H5=%R2);Qo=5OmsR_qY40laug+9>@t^(QrO^XhnjMyj2gk{C9(IU6doDqn;AN;m2aBZEU>R7j&@wUuR!eoEWmx)^U$eYFR z<4ZR@|Bpqg4+1kcU4m8jtb~Whv7mi8(K&#*9c*Veezw6h=f;*rQ@tEY<$KriWKG&F zmesJkg~_x=&9Dsi+i#j30*a(-X#lc=4sIl5Gor5B>Rzv2rGfZ?blj7XImlZd>&g}- z84|09*``dU=i_g{aALBv6D_XgaKbB=b;j31o21-YmfHPfqpz<%@+l$3fXCe`;+d`n zM`R)959b9S&!z7E()~8Uwr=N6jf@`yAuscF>XZ4vQy2MDvq-w%SrqHHPk40fzw7Pr z?c5em+*nwM90hqFvBHHo+d1uxqY?DL%vv?*L;|r6nen_y1D?|5qPbQHX6CbLlm@mB%WJPi zvEerSZ?yXLyGl;5DC;xJt%as{@scFzo^S z&oPw-1*vg|J){`PfA}(Cf9y`;DHnnI7sZMa48^)eD+=T<^A{7!A)Q>cXx=S(Wjs%g zAclbsZ8!+nO@lv9OT?zuT>7KHr-g1aV|OqyeG81N@}3?*teQP&htkK-8m_Yv~AR_P=KFAZ@e9WQxwmS5s@h2aWFiOya5 ze9Hal_t`%rvqI8uItb0Ejv9{cFwZUBu$hs$sSW3uSRXg#v21kY-{#{QVUiD5Ha-N! zRd8XV)g<0}xeCQcYdEQ7$UNzyn^DYqWI6+d3M+1R<64|?cY5uVVe1zwam3u1NrICT zta{!)SoOrY%sn`&WFbeWv0v?%FXc^jxIHtJlLT(GWHhx5tCr%)pNs2_)T2bg25BbK zO7eZ$TzMF=9cK>-aeY1|I*VZGY2a9J|lX{tVqlikLYe~uVm8z3J7Ohgm%C1MV`%`~g zPiU);J4m~TAkBky{$G7PE(qcNVf*tLSm-U>Sbxl*woNP_pQ-Q5JH&#w*s_`T|H$jP zloYW6>#R(wM3$`}t?w|1&yRXkco;8sjjV{94pT zz=H4z^%bmGXWhF3b@_qRA%&BLH^fh#=5I+3syb(og^Qdy4aR{LWSv?Or+vGW)$lw; zz~yQL6hKbYu<@BCJLeb;YjZGx0K*J=^f?>^G37s+dnK=5eb*}xp~=7CX^RGKNr@m? zg?!Jvb-h=e@5HLCJNjJ@d`d7 z9EJ5yo`oisJxAPbH_U0=Awh|J+j)(SdXzxrWi22~Ao6pDF3&mG`-Vc2zywwqv>CFe zc`$ANazJTR$s+?z-@3jM<|fDIEX{`;nC%af4-F=Zh)`DQj*~I@a>|WQLb93OOH&X! z!}4FBZ^p&4wzU56_aJn-qA^;!j)AR|YQ9XkwSs7~- zoibz{PY?*H_NwOCz%<@5D!Y{KcKh{s9MEvgMiw?gMitDGwh+;`Sr>6O6k8EP{>0ei&|lQfuVHgZFx zJ|Z8RL|zL@y+fGxf>=q?I#TxjI=HX15q;f}IWLPF(55GW?B4r6eKiqs4+fhS)qI`! z+ZZZ3o1I0$+3E*j_~vWB9nfg$DTaXGeE_{itCZ2`@{l>y6|!i6b1L(NKW?Jv#tU-< zol-i(M6v5De~dY&)Th6yII3ul0wSCms&%}|{SmP@{&MYV;zf@{p*ikSn2MiBKnm2= zEO6*nu{1?aO5|Y9Zg}HmG@sV1Y&M!t5kyBmBROcfa%}Agoif#>&&;$NBK|1_h#h|1V0=1Z=e(Mb{OL#eED_RD3-K=Y1{P*@hf#kX1}Bt9?wz; z2IQN1Mb&{yOSsv#i^+#d(95bn!;Si&6x3r6>?g2K zru2*hdnw?>NickbCswATY57@>$8?%p$0ryN8kt%%0&;dQf?r+#Ti5Rjziz4Y7q?nz zJF5VoMoP6S-=4L4KZ%2z(0ip_rzYd<<$34|5x84I_JodHsuPftYHQJqdBSi_2E0!t zI$3Z{@)vnmL&}NNmM@+{qnA_#UD=mhcC?Jv^}~G;4u}qi+#w?zUAX2~tv;#`yV19q z)@iktnkmw$9E+*P+*sxso+lMVT7WI2~?xf?J4_QAX(By^BATyeYn;11S`q&@!^*$}s z+WJ3G?%svY)^$?f9CE>DADxAvD+{I3ohe$ci{E*&KUL|m6{(3{FY9t8^a!sBk3%ng1+~{MP+*jC z`;}JNa9?xBrK`%kqUdGbESaVSI$L@OyA{oh|3Ug$ef$+qN`?Ckr#qWM z*Y<+B>)FDzm5^&CUEM`T0%G$(%C$SnFL#%1`v?}Cml}P#r_T>0r>x#S>k{)g`sL4p z(fLp%Y2NozHd1%d+X2RQAE&vEZ|XX^4XgV5K3m;w*?xG2gUF7pfc@<3YS|dR?mt=p z-i;fc7@857Rqh_U+AAhEZc8`YCPOc>_c~mV+`}zGU$Ml4k@sRZjV63m7LiujtaJ9b z-Pcvkon0(3G-D)KVCXlRy1r?>1CzEj!S;4z;ZVC()RkL*bzxW4#N^D3P9^7$frkXZd{;?FGDG6l8UBPt#p(v9jLo`Hs=7ImwXK()9fuuE7zDR^?TtT8v6vW(d!%IPgU_Et+)N4(M3#`kf_B)Ny>j$+~6sHxY0z4{WnLYCaK z*2Lvx^xRNmBr~k5pbF>RKKH1HPIXlnA0CzXJk$0?g+1|ZIT77gE6s3=y>Y#YJJ8TF zgC6;q20+Py+Rlq``@$yf_bFf$AAj@x0hbxU%0vu}cF2lLL9$$6d&z0E^DhLV&gp~_@h=3SGCY4} zAEEO{v_uF4Tx5HUcRjhkZ#L;WW5@tIL!uFRIz4R*_TzJ2x^7(nKNK&}1$u9R^3i~5G`*(YS^+%$w_psKwy(U$KLCyR zgI41|Qc5roY>+I;4V`C$aFi&h$2f1vu>@KJPod`JD$-l{&%ATa-(GZlUr7FL<9kuN zuc%baF>=M4Yo3|2RBzFfBEScZ6n;1xx={a@Yv~g@yx1(*v^^b}zB+Ov=;bXr^jq+7 zp+CY8a(C`!E1g9Ca5MaJ6XmC_6~p|so9LiyWc2)X;aRA=Q^+xg)qKP5m(M>AfR_r5yaWlC;auc8?nCfus^zVQ& z9~M@|eo2s@ROb)YI5C=p??2K8&sb{tHC#^){K%)niYXFyH{tG-vMEWUG@{i=8M+(r3#u6}pPHnC-1Z~&iKE47H9yA= z5fb4KF4P-L;{V8`9i>CD0|>zWI#{GT7ZO>?A_$i#qdV-u5Q zkr?q|sncNuY&e)LAC>BGj5A2$cK}*OkB4Bk0j}MNAcEQpEvx@@dI-@um^gc%@kvH%gAu7>QxYTL|+=9iNzHA-SSFgAjptpM^A2z<~YoV zWXS4>$dJ7#r=t7OPYmf^&qA}u(5renph-D>WX?Rf!f?m(FyB*$5N{S)?I;eq8f!%61YM$IT@4m*cAZRRlz2%H|3aCV4NA?ew zo8^25uqlp#7%BUi^!AS|{uY#2D4ytezG@E8*ckn*JqH*)(G z0lFX@-|dEF2HEI6nbFz?>Dv6S8>RHNe4-HzlWdd#4@g!g!iOQD-w-``R^`d%%HK-| z!-MSQV?p1C8UeIumUC172l4a~8hbonj#xNC%}P^cJT6Ou3ufSb4AjN~zh9^n{e#Jp zKuJO20o4Y0Ec!IyF(K!NfXfZVf+X`-&2eJzuWZ8~9#t0~TV>c^5Rt1=@sZ>T(1b)a zY8So2tL|R2B$5)MEEc$2k{JEFhI&5{-gUN3&<-B#^?O_nACXlq^h206I-I{~YKPv& zi-M4^&6o;}e}3T-$}3$ocmxz1wt%?Z?m!-&0O+f4lmvbCX+SKx%tpl@1tZ@WohUfg zLvg-*Dh`qK2_)=(76uCV_DdXyFAe9V&l!LH?}V-z>LJb=-3-Hos*0>E=YQt^2%$C~ zSO$#Zs=U4=o)h@`Ujn6CRt83r$-HOq7oo+3z^?II42`0*`IKJfM`pC4@BHGcPdd94 zLl02u5dGkJn{AY?88`k0`v08cpXv4Y2|E&b`J_x5nw0(@KKo~p{O_IkyO(!_;_p2f zcf8CL{j(~N{J)vo-+zzeB?O|Tl}6m*Obn^Ipo*3#)(5q8} zA`a1rzDagHOhAYowtBAWpKRZpgwSd{-3Fxo}JE%@!|_TU^$f)Q+Rexv6Tamxy?*QM3M^(zR-BV*NsKL|iWJU;Sm&fGk{- z*}IR&s}hNzrbRaZRz!)`*47xHO*3jx?{>o}ohq1&Mk)2?pTG%3YcxehWx22ZuxlUL zybf(W6fgGOOs>j`)9rGAn4#iLc-_x!<+mAj+DbCNZF)W^9|4;l_>o_~elZX#patD- zq0tMA@tW={7S54Tevw- z`NCs6cy*LB&3X|J&1$jzLLvi;pLF00pKjBQd-gljfxZE}K257n!w2S*HsF<`Fc3_o z21<8vpyj1E4Z>|qjW)1p7l_CmFLh;9nD^%!>OZ(Qx@vINmBH@`8W|b~9y$MZW`~d^ z5xQD~mG!a*F7yFCP-&y4BLzkgl=?d3{hH5sOl;qsCLBe*)YUPWDoGi@Y$d+`bd3z` zR~6Lj9E)ayfy|*UkNa&V2BX%`J$ruK7*ACo5J?^U6F8su0Tb2LtBurnup;#VZa>px zH2ak%MkjfADu3)crtKRtqiKWKl50BFQAOqZjIQt(5DXmTP$$tj?#HV=27$6~mtmH+ zBzy~gImk@x@iE;DX~kFcpl#>bTgfTGeUM(07)P+x20SMd-@^<;YUu5o_~DH^2MWEm z?$Yxv#CxUa(nD&wIy;HRlC{dBUt^zO1)N+LTV8D)$yhZa8Xd0Dsji-Gv9aE49K295 z_ki#Iv7H?9m^r{@`{dm)Um0!K9ic-UJou1C?YE41)@ZvCRs=V{V&&i>3x`QdQvQB0 z0$8@b?UJ$T&cl2gV_sT)9Wwao^?4(}wa7sMH6FAd^Z~(6BhUdg((K{U1tb);^RXZe z<3XSc7gG*0aB*cuePVS|V$fJcx{LDp2ZvvSatwo_kBUD>=UAn|pMaSnka&Tw(JU?e z^pvIHv!iG=NB7WDU>@K67quUY3|kBS$eG%otB90;wdYv&RQQS;-FTVR>8!!!L=J|Y zyt&`)A*)C^OoD`;_?bOz>mJ$3#PN}uUF7S_njP6x9=hlpDP_qCkFy1~BHj9Z2i%u> zWg&!Y!ci||=o@d4MhvpT2qBqb+S)P(wdW@!$IFZ)`+Ou6GZ#EbS)E2UG|nA%=IJ8L zcgL=z)oWc#hk82~Q+(@B!c89hoX?kMJX{meCvI8 zwl{VsAX}-V5MxO@l+}YuMv#z0z;~_KlSI*S^X}SiOE_loDjnpeyOZlLl8}9!>m{Q7 z6q>ZYygSjOzwXo&FdFq!Zq@07heSUNQZE2_(H5*4wNB(nF7YY|#38F+B)M3x{D>2y zV0|0);-0RhU0v&Yc}B+5>agt4Z;YO}kfLfrcONEk)v9=~>shhjA!w)a}us(btk zdwt(PxU6(aTW|m+CwGQ-DT+bT)bMnwc_idwVX+UDjvadTyk|RGlEX?GLBQG0;b1;i zcb!2&g|wc+Y@&apN!!fA9#YSLTrAa{RcaDCKj9e?9_8Kj`H1E7y<;A{rHWGfS)?yH zzlpf5S*rj9+&S6v-CtCo_&B1H`(3vKZq4v4(cYP?**53gW^++bz1FmFbtqL;$6~&J zY5On)Ed(BmQJF4UhPp#T-sIP|@*d~J)+cA%qh;MJQ%sLOl>&WWCf7ipa8a%@BD4f2 zdPrt3Jw#*$M{fXDh5Umx4Wt;}Sd8|CxZ)@o!VHf#_fChGl456CM=U1c&g%(s59eQL zwzX5$>OO5zzZ^=;chYa0!$w~<%a*z)Y^vy0UI%J34l?nK+6r{Da62MBQCD=_K$aVG zixrnEiQqsyl4`IraNWZ3-W_ki9%g7y-a~d7ccx0nYOC<9O9QiD=_LL7LvxDgjKu6u z!K^p+L_w29#8z?7k)M)SUhYJh&w40lBNgC~K^H`J9R_)NS^9q}1eUMWM89f|kSj?( zgetrijNBg2e`eaX)Gl6WPlI&~v~+b6*)4Ipq3dfeH`JTE17!Wb{(`v^TUgEr7nkfp zvRDi5QM8{{lY^q0!YXc}UsKYB&h0ZJ1jd#$+jT9ylUdD-@jwr9%gp*0pTI&~r?du4 zf$MNM&w2H+_n{PLdWd?t$C1f2jF_G@c*+sYekFuM0gFxWZx=?+eL8Z<`tg~EApzoR zwb1Qj%ZL79pB-fHX)Xr$W9g+|MnI7&wXAo4(FXq7`_xbIapLv#EbgxDjUJ8fSPY(- zOzcwh9Miu}+HpNM$a>4V74HOJ=|3gnAJz>dLo=0f(VTZbU@d;-Sys%EeQRRBAFG-u z>3w;$w)@5Qc(O=fCVf1{`tlH!C%-eW(o`iL>{B;u-;M2nR_GC+9B49H=c`jw|9-$( zfEe-fH|Mi$?#|3?ncH)!Ma*7RYKr6)LO+#PP6s-N`A-%X@FsLG!@_)&&r2jUKhQU)7!mt*AMtk?7rP&FB{asY0nBsIIIc`NDVO;DqDc(yLuu?;4Q0 zmAJT$9i%`F^OfB)4MPjoaN+)G6uHYMR1WNr>u)l}4tvz!+aENl;?X*SO5{sc>fyI>kx@xv$ud3=a)?ZO}gzhXTw;Vj3jfh?U^3}D@6XhOT;R`|Aa{7Lm z_^XHa8T;!E(XuE37cI7lu(l@1k|mDzDh-KwOE`m}?p=4L+T`I&csRYifEfc6nIFA6 zyEv!COnRY^i=Bs}`sG5@w{}6!jvY`Jh$--;TL{AJqv=?WpUIc}{EUgWsP$QaJPQt^ z60=9z3TkD!`7|5{PBRTaKW(UW<YA;SpeVJDu7}Kake!2;A`lXRrr+^eFYT zkR~muH;#g0+LRv^ZNdzZ{5+jX*kvEs1G0_XRiCSM#gM*Q&h(T zle(Kt-^X1)^`Lc}F)%wc$l)$Fs8v^u0lz%=OOv>i9UuAdFXWxIyp?9#zEwBpgi7%K z{yjiW(J)@2NxwgU^`k5fKBlVe0C8SNbFM;86y(*3L@YKfjg=GMYL?hpg@WTvSn{!Z zs@L)GVe4_~Hs~X4ZtlN5(ljcFpW5OzDgt&dB$;NE&G5%a>@Lp7f4kG5TmFB zKaXeTM(D9`jYUs6DSe^hSjNT#`@<2k#I^G6M{$IU_I)%;nxW*EOruRHnS4J%f57w9jCVjj;v2^~o8Tw`_ za#%$wxh~aQnPO+Oy~Q4aCUX_OVd{wz(&=QR`}i@%bgG5&SY>OmmD`%v-1>?7$Bv7h z^RJ#E0ZGb;u_26Ip7CBfsg|}n&@%a80)fz~`^{BdTgDVqx5&AYRzX7jzD4?aYKW>Q z^edOWl(JR?r8HjSwuCN$^uv-s7?N=OB(LNIz1P|g@VOm7)JEP~Px4!ojR{qB-qOj~ zEPD{HRhom~xkUj-ip0#C2-f_FMlMY#rh7HZ$bI7CEau@SvIJ=IMS-r&85`0TIGp<# ziM+SW;b0`T#zT+R^24(l=>-c)XWO&#pQNi%$XV?+qSlTesrj#B2Xj0BQE70VRzfV>PP1J zRAqFR1PLuz1E8}I)Yst;5)xjNe-;#dAaD99*893Xhq$yWG+!@Y;a9S4V^i+ixyf<5 zcy7k6$qfO3pv0d~sO8I$*XDMb<5)f8N)0{wU*x@oS5;lx_ALks0)moCH_{;j(x7xp zY`Q_ZyBq25l92B1t_^}9A>AR(2BhJgT-SAf&;8u@_l@@t_{Ly3*x+EVwf03mjbUm1dVmS?y|G=QSZc>QSe712?OVvh3T4YWb8kzY3YwLUgXU4yzM zE`Rn^XDW1KfxDP|c9K?$*=ErS1KdeJ*uzXM=9e$ zO2y5QG-$5MmnWnAdEhmvr{~y)1ZNMnBCej^b4-CZ3b{zq@3hQ>AK?r`X5v^4B~s~} zf8isO^cCB%@2PoV-cO!2oZKB_Qr8Y?u=zxa4_6sVa%t-|qM6Aw%zJz_^;X(zbvr*Z zrD*V}kUW6RY#<*1AHchI6U-beqZ}%E&N`(wBYsG%ogklpEnmWMrNw?$)n%mP)}PX{RlNCB zCAt=v=_bc9hOVqlr3ysNR0GkNjLKzTYyC6fN7?ih)H8yB3*=n4`X2J%T?khh9BbzR zpG+18t7^j`Do`&;06z2sK>1e_)^$kvZOEW_E3zGT0Lv=PKVTKs7mmMEp8+j0A@V{E z(I0SFyP932+f(SAgMNC1b4e)?H?V=~loRr3o#jbZ-w7PnO5Xy{YO2%zc&9wJvkfzH zXm(bT#pJix4({Gi2eaQFWy%hH+=|ex)~g2bUo1g2kqx(;yD;gNL7qYj+q+(GVv07c| zt){7_*ODIhLpt&8Ny;3~dv9MYc@}OOS97IAa4n!fSFw>pRC3=!A3Z@{Oci3y)U1>0 zxOo?5&#dg9s_Q@YrZ6s_Do-q01Eh74dKEJ}loblVdCAJ)nRVekJ{eLjgrdZ6oG;x+ zrPSh!561N7DGhDTO4~?nGpW~d@btF`U4}dnnt5*s#afsG5VvHd9vpwl(IXwLmn1$( zf+QAI%ha_$X*(T$kH-t3-CZAILSt%D_yWHiyUBDyS5n}RFBQH?k%r<7D@*h}LUDj} zYBq0LVIxseA>b=hB(F1OHd3*+k!J1EwBHb;{w6MPRw?H2(oGScoLRDcl3tr5Q4v9O zRw>*$(Ks|mOJz=}`JAd;zu&i3N~RT^>N5uxHw}t%Mc)q9kMJDpt>!~x+K-opCVwQ% zJX8>>f&yTac|85J6_~)M?#pW)?p&~m3XacK&OG(GH=QnH0A>}6#WU|do0Ws^&W^Hd z%3E>Q^Mg{u{Sa)r^#!M;NxCIaLislOiR!u|(odQK4xLP{%=)!pm`bs~T_@$hn!ZG! zpw_G2HyVSw*)ME>Ll4?fi4SMN2r?0++Ff~L45eFbe-H?flyz;LUbuWos69U*{K+#5 zrK`b@4-w~+;G*SBlV+l?czi_q5|;l`%8@7H~V^Uu^+vLL476npmC5 zkSjg82t@X{@Ia{^_fH}ssGgbA zI2&PDlvdeR-okg|91?#WHe`Lxu=DX;8HV4JzIyZ#Z;{u;hg06h-^hMD3_ie)7HqgNlV3q;M8 zXbx`TYSkYycpR?EhZ2f^nTD^QCRek5{$c%!-!jgT8`Ui7&@1W9_mnn@Pwg3Hp?=IL zV8oQ4aA4&IOYabrf4_7Wt6O=ZH_NdkZig+<3KrzFe0#L24bFw`TrMs8<1=xw_p@+? zVP(gLaUPGWk}A{?t@}HD5wDjtjJWR~O%}CfF*vihq=QfkAKyCR>nY#mBVeyQ&4P}K zu6-Sty27I0_c<}HP$_@dzNRmd_)vi5^A8ei@>NrkVp*ucQzFZ#N5~)Gd_X~9pzc=1 zug60ggTHQB!y4H#Ap~`~`T22)z5c}TuhyvPbe z1rc;)f0Y`7wcz8l$A&VUs6nN{9sZ33N4%Ty`7^zi_xTW;HI$Knx4I+KGj=+@TQ3{F zzn*u0$6Bu5E~uJgIbP0SR z6erO`#u`bH;4@c}ISNNm>HZa{FhyYJB-+By?DO6QI;~J9V`%HjH$8Jz zsB>rMD#qCZYWsHs`$t5jkjgZz3jbK^-`p-scx3<~O!`I8&Y*rBp&?tAX83q)dE;i0lvQFs;mld7|-e^R=V>nYzw5~PyT6XeIcY_)n;S>KJ;p-OqmUbNY5 zm689^{xD&@)yWpaVfOwDK2t;lioPdtTXT8JAXFBw-e;XIb;~O=B~ZBws@}Ou2v#dC-H&-zx3cmihf+_*RLB~(|t8b}mD3CSjE%I8T~4(a_#tHuZ<)jp26JP2#u5{74|`qTy?BQK@dD##lx$h%SI4s+#+eN^UuufWWmD^uZ|shVJ8LT-SQA5P zujy0E>g$@V+L8UUT$}GHlh$I?PME{XYtZdT{yHc(@8UDoWDDp?jg?djTl6Dj@T9mP zg5z%7E^4r+!er9o2@3VtS{s=I8S^p2k_jd%chICUoxi7IPz3we*C>S!2UGa0-i>jdb1zpI;=)ERdne^I3)}n)wnl25a$W1p zNMmtOLn9Hv_*|gzr<1ajDSxU|&A<5)c;cfvy`ulCz6MHcEy*20&{`(Uhok(DuMgO8 zJ$7j2dhA6zJ7(v=l6pFWb50VT0wY*}68JrS`KL(tcd72b|84mq03^sQg-v`)D!a@6 zd;#9!f8VVCI*I@1Z2s#TpCiny4YP|^B4Wr$QhU3dU&s;GtA$qkBbh+%U)TVdD$ZZW z>Wz*m7E2XAT}NcY-_m#&OuqWP@o>8;R#8Sd<*XcSr^1=2t;nYtHSv* zgmzt}&TjV|`d&08c*s%SR8bV-F?h0M-v$wzpKgBF*KK~+NF$(`4OC2 zn`?)#4)%Ya;s5JTS~4HSmoMI<&cOfIY5mXV_wT<#ClS~ve#(QO?DK!Qp#QvG$2GFt z<<2dT;Q!w*fu)feVIA-0))w_c zr!DG)GtiEOG$6?M^V}f{kMNNHH2Bz~1fheGI#!?VFO(p&cS!6Itu? zdbj7wJbrXT2Q5nXk6JXglr&D%S&$;C7hH;~G!FYcz&JXj(3uSCzou+(LS2*ws@CU9 zIi-s%j)!A%*aW_zrHlHy(J0Cm)@`ktZe$9KoJ*rFb2~(&zf(CAUyNJOWpq{|o6H=P zRbRDcGe)y))|f>q%`HqOZ-K$)OO3&CA?X~z4UYi@c8JjqyHnyII4;lQ`p*>%n9e{! z<%>cxfgX0)elGz`cqoDYrC`Wxqg_4_FbY#iC6QF>^~T8ZU4D2;Ax2`e+A}uoxH~1i z+K1*W)i4UW43r>i&$a7fzkX?I+T$4H7v6y;aSTW+6$2r|zVk!)&;8@KKp4peXz(Wj zJCj|b1h8HQ*?M~?JgqCq)e#5CJkA$#t3~HNF4PU}@6C;ww3_H;Cq9U74ht^HlQO(8 z%&Jaem)wjpT5+JjphO_Sl}&$7x#W3Wib~9<0UGvHAXyE2;5$gl(Ha^d;Ib71v6j9Q zPyJpFY=GZBq{$ip_m?WGB|gn3jFz)Cg$6?j-=iNaE3fz-YD`{tm!j_-_h`86HscQ4 zu4T@#nRPz4XMtQ?wM}l;rkMu&-!TGxf`4)t#jei}6N$ZU}fuPD@>}7_Qd40hVKsydoO#wUpIvrv~3aOzNp#{Z@vX3^3gx2mUwD6=fitdcOTdOvXwHCu}J8`UfAleS)L%AKJOS zAvn(`?j!#MR>JcMl8|lWE&Lkx4hwP0P;w)a^b`ra;V2n)f?Pdz93^eqBG|in%71$r z3$DtCb9H98uttmlwb-sMF4n83-}r8*z;-|iUfIK$rUIm{kWH6sCju|G-L{+E@^(hx zLy0nu)DjA8Yp6kf^K__jX`d2R>;kvZ?bVs!rX_h3I%tZ%>@t84&tj^S&Ol`C>Y!p8~WXzZdHwcARlRhL}02zigW^?Hzab-@E4S0TjG9yG-U+&wT*fm3E4K(iFUCnO+2tG)FbF)~fb z{%;#57BB58-3h~yT zRTAY+&61Nv@q`@LE>jwpE>ldl`?KtYO4Us*OU3zWs4*W7=;-c=4o{gsR_Zo66@jt~gV!b?gCgQ`K`D^o+?uSdIu z_(G&^6yUr7`CtU6od^aV6cm zL(inN%Yb8R!YHbQ*S7&mX4hfo!Az#|x8@KgMGo79{KSduTvzLMx;3=kLFsC+nI5hlkScAJpk^9!Hkgtmy1>!*Fbcyew* zIV8-QP@jTQXUctG_3J|)gsVXq zn-L6fwAvP9{(A_@a3FtLhEDys>w|CJ4)Aa;!Y+rD`hKYeE!SN;kRd%LAy4x;Upkcv zV#02}E$8u^5tDh_TSxd+MU^);9lfsI1~f08uz{G~A&U9(X((!LR{+Yc737peclG&J zD?>m$wLi^!aq!3*D`9p)mT4RLIhWxjw$tpm#HCt)*s{lOr#Vg~Sx{~NHw=Rvvq$9h zJ*9RRQJE<-{4_Ie|KzS22qrs14udT_GP#{hB+EeG-*jWbOtV=WP~LG-=?qWfm=FGe zVXTH!27AP{p)^YMr#rW-n+Qu!#qZa{>OeYnB$D8^sR1IvVfP-zXKuDaYy7){&xoie6;y(ms*yVONHtgRT?IPQ-!4zgP9y%;u`Iq z!UywceD=X7;prQ1BHB;1vGd8?5o}NOgzS<8v4aTP5}}g#+wgG7Vh_deGSji*a`=< zG4yFSpZr=-_4ApF%-6;CJ2&6#4<@uG^CQ)mo7A*+VRbi^HtdEuY&^ujB0jtPe*dof z*95qC8K;lUKD3{d0Eq((lmE*=+9hG(#$(-p9! zs~`&t;dB4I?i;P5Y?rTW@d)LFsMi@<##>g!lf9K)YT#n6@6z1pP+XT|rS}UGj=%rQ z-=4nQ>qF;_@tIqA2}{1FTgfbuR4p*V*~jl+zi1;~pUrE38#M7sLcFZYg2DtE^~zBv z!**|5meMZa(V<_GemL}0E*zzjWMj_i8$y%CYR@QLxfNQTJD1m}>GTA9(xE_?`x&F* zIxFnceSobGt8IURce_d6zDWiWollP`JOVuKV}3@t{2Y~N=kekOp6rZo{`g- zt}vbhKf0;nqAal%o3%ikoq?wxv#ayM<-1lJY^1{m4a`%;H!7xv@F)i}-f@6gf2(`VCP+7Bi}RO0M5rrNLAoHyU~S1v<=qVStL`^GBY&dwioJ zt4Ca%RN=Lo;1!0^?A|cNZn01&y!l-{S6Szd5;zl$;Z#&aTwY%wd%W4H*X<@|UH6Ne zSpVH`ySc|zd!%1`>gwg~&TA34meGKRS-eIqHFkCj5WhMbX`JFoDW&2I^*WGrt)TiV zJ<;d(8Y!+6?R5)HMRsQhb#AT1kG82sKgBXdK{Q2MXq4cs0qDF%{F-8Fk(0+^)G8_u zKez`4<{X3JC@tE!bFcGkKDR#yi8=ju30lyX?||*`c&(&pYl9&moyIgZ7x_bwdm@Ro zhr}Vv0z}>9i0f2Ow4%P_#R)uVhe7FlOatMrnh)EGOIdU%LkIOK$mhN`u$L8wN$MNF z3O6Io>7vWg4M#DPqCu=wz&;oC#irW{{?j=QrUjPSY+Q>ENC?Gz2vpCrn<8JRvM!tk zbaYwQxl(ZwFZw(2X0UtGB^e;miJqj|-K8hB5nKf*kJ7g|ocG9=;&qQiHAMv6UoPt#Sj{uh-5O-S%X zJdp%t&H;4(J99>4*eyuWGMV}Ow%!Uq&ew%v`Di2c4GbkQ=E z_8DcFtSj2Lo{%YcX7kE3+}p@*VQILPWccNeawR4CMperVkOu@*S8GH-?|jOb??D0f zh!cMMldw;N%ZZWCBps^3QN-KBXZ~`&>Z_m+`eesTJ-qlRqiUx+XAIA;V@=NfY-NAl z*CkSI5Yafl1xw> zWzuiMwd+p8>`OaPWfu*7tGkNjF(2mzn=onB!9B!piDkA54QNQ>SUfi;aDjx!26=G` zWpZ2sQp9op(1=5hP!9d3G*byBpx)v2c9BU}(i>(JysAC^shl?13R-V}R7wmR&|3y2 za_F^o8Q(>b3frSCU%}HMgXG4X00&1ylW3*J*8!o3vCASy8Mgah_-QGmTDn%@iA$6P zx_##phJ}f@!$;4g-ql%Pl<4|NZp)o3me~L+ zNwPDo5(YD%(-&IZQ@wAYi>vM5=f0Ep6o;s5_pz}sfY}ej4}T6UWoZyM5Pz4H2>mGR zM%b-dQhsk4-p;?*ou1I_9)T)@Z+)T;(%DM!%*Pviu6U`VJg(6>vAPPDw$|F^FjY3z zr}*nPycp)pHjKkxE5+wQU;9`KH@Tjr)Er(k&B8vFH53n874Z>!!IJs5u9g6k23oyB zR~1U4uhN-=hCWTgImtw3s3K*wTgwwOY7}G%G>AI+!V^NL;U2q6mi&Tq;LDp0X{ZBE zqmGI%T7ZOV~3 z3AfTJvY-R{1D{K90>kPg4C%SLO3*^a5{Y%wqiw?MT zqD&`)n9qWtd?E$|e=h-QxagPqBM5&U6zX2igP6_Mtb-1pN0h1%F153bBZ39q>WYaa z^^=a(voA4?WylhcG!(|h*nVY?#{-J7i-&A-j5Hh_kgyu3L%0V}me0_0kiEf<-zUPSECqzJ3u|k`aOSN`sP#6n_;utBngtBgUY}b>jdPcSe zQngj#*7!g%#D;(kzkoQd{5HPX!+0hMgvZqW$o*1x)elckFXzXBL=%)OMp6PBH#Ogs zVryD-i6-SAW295nr%p`c@^|8H_ygg6DoaSNKgLy(_W&~hkE5~B6%FCH;C5fItDvQ8 z8TGq-Scs=S(kN!sY*IX5(dGS}_9L^O(-K58`eIliah!k%p(|3(1aeejI()h{h$?b+s*g143{{)-MO3|X= zl*`6-O|k>NEr43r^Ob}mjTqRzlJv)uj>v7)A|ao2vl)-rV6~giNCZU_p$4^G{&BOQ zi3Jd$$NtxeOHIL%YuAT zX=DQ2B^tntyPUz21c_O|$4oyL6sS#b{gfrJJbZBPa0z6Od{T`|bcBWSk<$s?WAkzO ztT~hdH;OfVxmTC}LBYsHQKxO@+fwv+eRkAFv&9_{tu-A^jX1^L==VHI4C`G@Xxr?^}MJSWJFxFV|0aSD>xZOKeV#|L*Rq zRjcjf>q5xamealCgtwlBK8`4;a1rg;)Akyw+o^*qX{H-WMtNyB+iTIYLiT^sT-1*6 z=`vF!2D$fBUrD^E6)(?y&9g47IqzY}?icsoftL4oC?eHZJjpu0;@KfgO?0s6{p*q6 zec$ol2WFmB@-*80o-`ckZy-ED7Dx_3IQNswO+i2r8CV39kR&K&)`SI$hJd~JXG8`) zxK2b&97+Kra-(N24c^|hVW1v1!`956^8sme=vQrW&g}hvVRcom2pMV6At%^NKXia zD`hE7N&ETe_nqW`{JX`J>4w*JMeWUYo32hU&W1KPy?PubX$?rmR(!Ts2P^VM1vgYo)nZjSeCD{C&qwS?ZK-hj`vkxiFK5@xSuzfFY`YB zSp4Nh^jh1WQzK>^((Xn~}GPOE@2|Wr8(=$}d z9pU-c=tKyH8T&h7E)kiJ)7(s8Gd+tr2_rtYm+7qS-{ErJ!Fy##2yP6;!&-dT=x09WkayGr z^0zcEJ-VrG4?5GJWE&1g0H-{g|GEA~dnlh6ee$IJ$bX_xU%k}6*H>*Axm<0d{fCnu zG?PQt^0u=T1So7Z@bADp4}HEp6KvDmDrWh13u;FXwA(D^Ct#DYzF)7E2>R^YFfti) zK&}_r*i-hiXwL`lhK5I!yu%NmrZQq7Wz`k()_dwp0R08{HE~b`ucZvL<7IvmGFqfm zY;XK1mLdrvoy?k7H!Rq8yw-2#gk&AygD~w2Vt6r2u2d`a0vrQ^uR*c*d*kQwh39Cp z_8~^YNu)rTJT<)Ri)VA*fu2qWJDtrG%nBjzqtifBrv%j7P8yfvO^>)CX^cv9N^d17 zvcB1^RoJZA=g^o0jt?KT3e@^-(6BNqI2x3_|K$asF_<)_^<|YYGbc;VGFK*DVT+kX zqOu4XnUVIO_&upEnal6;_Q9sJyJu7$a<@*$s~ZBbHO|^ugh|VyzO~d;S>4vfpYfi&?@Y%N@3=`|>F}L21DkQe{T>~BoMgzd|Jp?>$qIhE6Qr^$ z{tzU5oY^#_JOpxhwP2!{h`;L7rJ%f`fL!V+n1i3N|W(Zp%z*$i}+bGFUh3p*ey37yi z--I{p;-Bu{mN}mB@24K-O2kXRHh0Sl&jptudu6bRBM}}YRK040?qq;z>tb7A(4D^;aUTW4Ikq1Jvwjov)#B6NBB4|0Du{f%$WNOgLwx zVveiQ46I*mCR;-S7?=n=s3%l7t}{38+eA8As=LXUNY6_a*K|IwD*_3A_G!BDU;FI+ zFQ%7~ZtwG#XZ6nrcr3!qGte{~l#3L_-6#axpV(Yr?4rM+PfOphHTZ*`mie^);mI87 z?b1(TfC^Gh_;^f1oG4aXQ}|j`NkRkc@P-5jO*zU~J)Fbv!T$Q+ZtT6j;*mr7;y)kG zG-_NDI?tq;sV&)Y%_kjio}=Oy+vE`9uZM;i%;Kr)%QP<)gSB^#2R)m2N0?Q+;z{)k z!BggZx0PfS!8IQmkYaJgv#DFTTxT%2YMSAcvpy34iRmCnrN_>cK3FkJz?&l%M4Osf ziEu_(+umNGM-we9O=!JNWp_gka*#;7a8Yf#z^yLE`4c1~9n9>q8z(A0OiHfnIWzM! z%kG+h#I7{QUrN%xk1Cq$I=#!3{o1xOC6PWi& zwtxxZ>O1WyRF*yO6oT_+ATNwkjyA@i&~nS#U9a_&=DVGQv2EvkbN$n@Y2$CZeFx8@5eP%ulF#1)8e!) z1abM?^AIk=HRXNrpsvT_C4bFjdAsATaD(OTRk+V0dAgR{kZj|di7lo1NBnsmQ*#%G zqv_2zw2DPv*ZUuPNFjz#Thup2l7FJGTE5Jdadx~|p3%{kPPw)Kb)!SNQMd@TtXmzT zMTAD=OJuHRE)p}ZwX!o(iCH0y(N(1+1~1ktcbDMSW1HRU5Chlzm9#s{&~+{Ko%o8b z@pR*VE2r&ed@-?uw2jrv9c)-s2gc`M8#h;(TM<2$-P`3Iu+nVYNg)1vaoc%@CRdlD z0h5$5Iw;$AHvUmQ#FO3co*P6ge#coqR>rGbHP5AOZ=pWO)m)eQ zes(Zm`B&1-i(5i4{)+*o&6_>9zQ1vMc8$@#!9Q7b^MJvnvB>`BsW*kutYLVJ?5*KX z7ag%&{qPNtywTdds#`MF@4NPR=bFa%4J+g7wV{9Z`7v={0+g^~u|EmRZZK(1L{+6+ z^Jl+P(WOS%)6(%6%AuR4!ef%19UkiN#-Dt*Pj=}!r>h)9*)#d5f6TM(tfh?Z5V7nh zrO)@zGcP=M%jzSfGn;R`>Uu_R%<<(La`5FQpbi-IF{qCc>cnS{_P3Dz#>La?B4H9zD5Av_E-avjV z-JS#1(F}zR(&D&x`mHW7zz|8V!Q;MLs`Y+DWodggj>IN)bpGcVK8{VWv?+G^_cOI- zj|O_J!g&b-9%snqv~0lwLi=2CW?hrr_XoU@%kEDaUznNhFr!R4s+0XKU%)f$sOS50 zpHUWBL0MWdjMGe-|3JA9xuT4Q1Uy&lPQ! ziA@^s1bY2M?{!wPwUur%WF5l({4^dZ;_DfuRs7N(fD6lb@1a&j6Kd*&e2CXztKetG zkXWwS%*cPkDG8K%Qf^hhnyuO$IRbXm4A%;xiA`sI0cjuueq~J4iJ8^!hU#Fp8vTBm znOqGFT>7Y`g?*O@1Yb&>b0Vja?ZU&BiUC<}Rej3Dv{xVg)GgQ@O|Y=et9Lz{Vho6{ zp0uj~&Gtne8Gzw7Bb2QBvY{0_h2{TwsLm+ir_FtyCZbb4NMmXOE2%WiIcdWEbs=kW zsk`922vA>Da@(6F8nb}?f!ShP=GZggtSLCq8?Q`}S`ux#r}N`cKS?y5DxjLHKa9Ji zjWBCGY$IuH1^v;;Jkxk+M1@`F!q863 zi95R|(`1qI6j8$R8`cPzS~kvM2JYDY3%Xtzlze9@sY~{ zE79^wxHii^ZZmsvxukUvdp16sRJw`yIBVfIcw$>k1w_78T4S-1A49PcAQD*}x83VZ zeI~v1Fo(Urth+1(q~=a%K6YCgGCpVf;X5x*U5lJ;tbo^rI}#*_U#^BbIj#?x-! zSlgh&8T~sNXJJis5mZ#z}Da&VYB{y{3JQf>~q7ez%`W&UMcre=ZKtsnJ6Zza3w~Qn*}OSAqNP>U!;%#0)|+&(37|e z)0SKX8mvE2oRV6xLK~_pE?yRFiSF zmWb1uCTf>v2*1cL7*SChtp$WHkg}U`#0@92nx6N`9a+vdsM0w^Pp6yv!(4#02-f){ zGS9vDwQsMQwPXNZ{R5BvA76I}G2e#C4b8k5P1uy8eo3r^$j%O9PgYjO&>J4DDRftQ z1eLjl1vhHDke+xc%Ea>t_@d zI+1~=K3lX{q~1{#SN*hHTWrS@8s*ofPz0cfiQ+@;{Jh%Kq=h@~(K2nLE%knmGOa&% zKO3={9o;V7HqsP7QK2#FN9DKlwI(5(`J+4)1RIq3-cI%n(ev|kZl}k+WJp#Xjzm1< zF4f;+8;)1S%qMkO+tHy@M=^$;55!e41bzhetJWY*c&URuKs2K%VWXvdzTO1I)OeJ= zeOSFfzh0R1^|*hMderw3+gC0&!;O2(P`iGrhL&iXj4F24f-0%M$St1%DuGMv8Glv2 zzd1BIxM6bsa}8gTwe|(KKZEL4?c}>t^goYFG*1E?mmJz&+ilaD`|lIjejYmS+udL1 zn|;|N*0lJ`bt?IR`JzXHNSCDytE$Sv_>2{$^E%DYon>gHnV0pYbH;x`Xe3ui zkniN97YEexHmV!nIhsBMuVRAkyc+N=oPr5{VjD5 zW>A)LE>_Xz!StAn)=dI4VXf89*~>rMadw~HUVp(<9c zY9(}kUBdsuBLCy9qP+WGX2B-)iP7kQc;nyx&j084%hCv7w*Hpi+Z6ME{o{ZA2WNWF zA?N)w=B(Wdq%8~!O%5oE$G{8$DCsnFJ#Vjo)`FzbN~?EM zz>8f(2MHJq21pKjjW!bTzL*1vCS3nVwhTp0{TzE=S8gZL*O>ycF`;A8di! z(?hTPuCIrQ-b^x%=Icq9knzpMvF*;pn?jAos<#%iiW2d(c|#AKk-8C(8yNv4M9Lu2 zjxLE_tLAgGr9R-}41mYml_zM|7q#4gplPXz%i{937(kgxeotX1bm-|@Y;`jP37oTJ z1=cHFzV0CR2H76X>7Uz>qzXykz~k<6OHD+WN>BtiYN#xNx-CQbzQJaj$2Ee)1Q4C9=X*12axL$l7opKGes%s1{IrKNc-8;HO$tnbB2qA}+>v!$^B!Kg z77~RxlS;43S}30r2$BqxGu#fi80^3YTpHgB`2`M~?sDn=jv9h72_i-ZGx^&SRw~8= z_WJdh9<%P=cEiCLr-B#By; zI=4C>X9Ipx*eh$8*Yl4yMxrYm-c{VT|6+D zOwO!ZAeFh0?yF+YSuYNBQr~=i2c&EYlJ$KclR(;mCX?_U@Ion5`K* zf2d5Aacd9@FOr4%M6dk{%Emz{COKL1IM=+q+ATlh8xbr-mDGyeyTbp*uUodp@z0Zn zvV-NAjKMCPej|x<^KNQ}_2E&OHJmfNrVR%k3#Tu2hNrhTh#8#jHxjjLy0E9RD~@_P zP;k=4wB3&bGH!ZuDN8hUzL>t$tM6*9sGcn5GCo7Y?G~%Z_}GQ;<|S2RI%bJ=6tm5< zT?hoKhk-<=I)OgL$Z51XC^UnzL9I}()mp=D2`trWdg-yCaxG*G>UC1}a8rdzS&MZR zseBRlI+Qg!o$#gZeRrTLa@L4(ujw7pLOg*T!w zfQ6!g*Us)-mz_U%vdKb$<5ncQ@h*Z zuayPd5=jROOMg$>v7|BG1Hdof&l<@Z>GkwsfD1ni@D-v`r;j&EG#_-OL+nA8c%%De z)go9+R@Mphu2aWU_ab5CRFol`uui88s((u0vV;Q4_DjZx00-20lCFKGmsEDq%v_;g zj4m?!RzXH@{gVTa@jqX2Fp3jHsk7Lak0Jn2+ruWr+RDX4M@M4s4h z*Dw}fjAfem!e1VO8-6dgHaqg8a(wyMQWYZ}0d(YZte&a{Ar#A#$!Lx6cbQl8ELGzK7j zIL;-`rR|QR<4>%B{fn%*m2EQO@N-_9RsZ$j@&dlBfc$|`7m0%+@A>@ol! zfrykQT4_RR^LJr-m{3iM6AP?dDts!L6;q7ZZx!>ZZSIZkutDnaN_|leaezD5a)0az z_v03tFaascSMvb5I^)o5BV8oWYa}D&bBEmA+|gx12p+_VL8GeTK z9ZAL8-!a9Y#WcyoJvHjdw^mLgnBH7jI~IvFaKyiQkR7v69swEWBq)y2cXF+MyQW%c^3t!S}N=Bp>MtJ+%3kCCC33yDv`!% zb9!8HV_YJQA^iN@cSujFjx3|tuFIw2q8DLLlBqRU7DQqKJ)X|fvd8E9bJW28Fd85c zJ9ssHrnr_dUzr2hY4xUz24g;|p9;Cm1Lejme$N(1rZC&EJdC>12WQi>l^5h9+f^9a zBNPpCA~#$O{QmJHC`>I`vVxsMAO2Z`$%{WKI|k-mJHelxyO{C3hYSu^OraeFj`4f5 zVph#Me-roxzqKwSGJD1(=NSH)-F^mmc>V|l?bNUI>?noS1S}fYAVb#b>5!%qvSl=w zqCS?=i?lx??s4Q8ENd6+Ehg=;dbnl(x^C+HW)WXX8;@un=0aySI4I9b}2+X=W$i|ShRW-=7)H-08C!83Hya*oi zzb)=W|8>oEvYK?W1v{0{z%v5KtSqWjwWfu8{89s;h24t0TO_#v-y zQ*7r42W&T>Gk=%>qM48D4m6C?xB(v(AUB9korkUG8Ew=&`XrMjs-J?WtjkjQR$#(SAdcME=qOaEJMw;`>6 zrim<2=?tLqQlx-lAt}qQ-U>Tkfj~rBjiW%(;~kAn;Hgl9vNW8`)?Aw#fTG)DZs%Ye zT(u0tI6#m#=lH}20}@#!^_H%XJ}yCvAtWzzxn_uyIc-m>XSj%ng(dRWb_Hc1bhUR4hND((GB2%d#tgU^p12!~-dlRjnf z!WqZjY~Nbj$N#aDW3~_7n{{&6d|=AsfQ-&FgI&eL)5hCRBk8S8n1OtV>OkOcHqR*4 z>MawOvDHbV@j`uWkNuX*&D$aLCxbUTly(v>*xP`yJht#c% z05d2Ivz!c$4#+f>6`kqdBgt(BguOS^8sI!G3MQ`rSW%VpAnQ!qnkT~(WYHcE*ZdbtFC}W)hr36on(y38%NAh)imQA6T z#?PTT?jGKAy(qqBFVST7! ziZ$OM;)oi4H*H-;xAb3$C#xCMOr{yqTq3PGUp5qtZ=MD{yDu`G!Da+QWiZS zw~@bc&x0RMu2i%_%3Bi}H2jI!N(u2X1*`GN={cDCI2Q$=lzDTn1XrQt0OHTK_1gT7y4|Vqr(wX$1 zSZnP~<5gf=$UwfbaD@i5EcYDGKj$8A{KP#23a{>eXsFk{4D&S z%H?N@x8FSMGrY|c^gEq`LQ*Lmu*Hkrtv?X&dpkI+>)DS1UvWnRKxA@84OA1HRKbTi zXG~^!by7WsR#oo{A$47y9&18*0iK~*4Sxon5*)+_=zZP?$A1nprN9@4X9QW5rS%qm z1Z{5WMBSevuLzo*RE)HF=xWDvV^5Lc-E3_J%YbQID;=9x1|2Bh2|g#_$yLF_-&h6v z%8hGcPvx(So>BM`$FA}&vOcTT!D{mEC!74R4V9mY1)+_$^1T#br;tb?hVg6endQ+# zAs>6dFyoE3R~nakKt%yPHZ(DQ0?NS2w;kHO<1p})c(C|;Diqj`hzFkDP3?lvtc1-S z2mz(&b7C&4`x`q+5J_${87I)6#RC$zqm*Y4epP-_t2ZSTkGW8~rVE_`Diz@9(z}tLY~#+S zk|fsg2^i$KKx1`yX-+QiNqmASflnI#p;b(5{vi}|LkcI8ZR=nV#=e#3{=3F>c*|2G zq*7bDVu^QiEHo+bt><@XWAw>nE4p)=-UATP$|*)WFG?mqoqj$%d=BOlR)jkPH26 z)_zsS=0Z`h$%oZVd-&3~>At7Wqq_-=ZkwSW5{STC%l`uVQ|3*hcYm*!frZI7#iPXY z;KLBkaw&>sNd%qat4v$@{S<4|Eni9Nj|=K=XuzN-#)@!=UOEI**H52p00i9FNUvZi$?7 zZt1N3I8+(ZMJA}~x_7vyK;p$G$|Yw@Hbpn0dn|LT_i=rAraI!};2n?^eH99vk8`w8 zSJeuH?d^r)4AtK! z2c}CGFkOZrbjduzDF+n=GzITxyM?8?ereWR)^|6EjZTMc6J?s@Kaw9%C*I~dF|xdi z`MO)#-&1QIZ%TMDC(Bht8D3@-{vXEP0xGL$TN@Sx1OX`}B$aLukq$w+LApV@LApUe z32Bf9De3NRcF)X$#`(`Z_uTWHF&K>f*4}IH6?3jRpZPrMPl=!EmSxlbbdh+@ zBK?Ax$shC%QbR@ZC6g07(RjlS51C>GN4>9Z&PABYj4X#&`T(_Sx zhYB)#LkQjC(~optSfMb#;ReY2$Hx*fEh(W1*c=o7f1fWmPf---}mbvsq>dGms*ieG# z54YF1Tx*d$f_#}e|Jr1Qb0F9&sG83%$!>I-_mr7O9l?bCo9M3F zVAhE;;-O-}=eKG%IrA%@%vCz_cU0K+#S10y*TnpZoBS=C1~0D>umPbK=S%|AcoO?g z!~U~nNs`Lv8pX#fHY)ds9%+yKbF-8*MS`%x&kh|)?p^h+k3Om?IS4ktoO=8Wvcbti zX(9HEIwCreYi{W3;&2TZi0SS|sJciWW73Uj_s>W_@9ItGiq(S*sPExYBEh>B5W=_$ z(FB9X3t#c4gaZJt0$_!P*MT&f45hRP9alO)qUR}s#qSLJMa81%!f#!j*)}0TA!x~m z%pc+%p8eXW|0Cqc`x><~o*|Ue;rYnnGkFnI4#`4hFY9NIJJt%yZPfxM8dyeo565<< zWs7v!@*LVkC>Xa!b9O%4vwx80xp28A;i8~ZEH5oJy5T8%%v#7nnF}Kbu)?P3aJ6KS ziur!p3DwU18d*6JHI_FpJ`^+JFSKzx(8=92_Q>VUy?Z^>2n)|qF!SbJuDtD-ki?X? zQ;{g5)iEM!>?5YN*FP#!IxS}0ha!w^PbAmnHm7PJqwh0#J1Y7AHON{oPNY8d3352< zr1qT0ZNTaqHFaQjvb5{87kOw9;(>W z%G(Eusv!j9-;pYr1Uut_-?%lvg3UtwR8nEpsZ#JHdkUS!B#I_XNx4fQdqopvMfWid z2;lO!e^LAsjs4pP?;d&zZZLI@;f~Ypsd4L3buaflLPL3!E_}ym}(8@az(j`ip zgOa(?EP6-*_6Si&slu7Ln0bC|&TAtTmO+h?25{P-TpK3G4(Kx=^F=sUzBAGflZ1F>h zT$<#G+Bv~xd2hOb{&lPBms$T4)%_KEt(QzzNk=MP_c*C6RZ3atNQb|JUj5nR?Kg5> z@cGaoLWSMVFy~oXT!rcIT<99T5(#zzG9kOPCZc@<*bof;Ts&k^ce;bEWewqSRxq0R zQU6hTET<14zz3}_!+bWj*lJimkF_^}I1=a9!-V0NT?akHXNNG#g9*;kRQ>9Uq=5->iyf5iDYYVmN-0w8+#T7@*@H(_euev%2g&W-V zM1lz{gh7gStCB}ubBn0TdhI=A$)*@&z`1_rzc2F2p5|h+Uip#VzecN?4zjXg0?5^9 z&Y1oiKpxnTltztFSHKn!HQ=2s!Trw#0?<~ldq!*Yyi|Tg7Ikcd0ektO>%8_J+@agV zqOnJF&z1XlqQ&W8cZ11bHQF(tv|F2I#wVTnX{z)Ph(1eo=u0Hh#L!(j>OG4Cg2Ppg zM;VP*Ak5UZnp^x8L_@<)_(ANM?DkNh=abQ`D-E&o+?K)IkDK;P;xpAG4@$ zpu3jaqR~ad#p0EeSe}c?{gkw$>f3cnkE&-`o@l+}>V&@(+@e zq}H%{!YB!9*Hd&BO~d^}7h{_l=DUKl_k-nLbU&@|*su*S)&;Zca)^RF%y!{L*2 z$>e_r{LuN2@+;LWDK+TC`@vRX zQzx?7NHP$-b9f%uJCq?o?JOUt7}(2D4`dCzPgNqA44#;U`dh76pWq%Z=_r+C$cJxLs>^$t33PF=QgeMsw+2(CHdt^&~rpx7U4s+D3LVWu^uhi}TC)_bsBnZA|b@=ti ziZ+L}X`(zt-S( z$GX_fW3#+OLY{e6Lsm%(D53LKdc&tro}MM46^382;xjxar~B&x{~g(%n_#v<2H0Au zKc+TaGzx4;cVWI8Wd3XwkgjG2gLE5+S;&f3!PpT9FFPoOZSmskRp$hgQ);vfY1}i3 z|DGRz|69CRFgJx0__5{CS4u4z&-%7KV7I-PENPZycRAakF0*+IPd+hXftJ$X>$aV; zBPTX=Vo536H~+)e|GJDgP(ih>B3M8`M#3RL>sKoN??wJx6Q0QvP#G8pD1KULdLuUh zAEGu<$%yr@=lR#n>#yEy#fCsS()R!RC6(p{?*IMi|9sq@@PG!!1cvtm+J9>D|41*dQoBF=Z@-KR1#-?o z4?fd){jdD~KUuqfc5;8XtXljZAN}*!ejmT|0Qpt42cZK0wu}DVn~??A$p7yBf7crT zy#t@-666DY;*KW$>L1Tv^JVf%W+Z&N=}9^v)U@a?zYsMAhC-G2DLLYAqWsS##qUTtWd43p!ujh% zPi)bJzPdY-x7U>_ZkKoKL(&ihETWmeq)BJs&SsAmm4Bb8p9Dxu#Ps`={moW&5~0S= z*i&fgYFlG7f5sOZN)x8J`l^ol;cq?*3cZm0-tu*YuxCXjg`|dLlF5`mNB?UWJwq^( zO_ABCHAH?r$OSgQNXfabTuAn3h@nox%yhZVaO9i7>QF!1wmDc9$xcI9ZJo?HJkLtn zBAo#QfxiZO68S=b;WLp?l2Ge$LLnla9dx}Md>n#5AA3H4j>vtRAwO0|@aJ}(t&u-)wD%E0aAzpIq`vrFlRmo7id{5@?Kg6?njAgieF@6En} z)(*J>dGpGWq9M=b6Ury7RRnh5x|Ue~(s7-mdh%AwQ)tRh-{{uDl{wh9@l9@ue!BW| zf(J=xl3$8P5#U&U4?fPA2dmNKJosZle;&=tC|;$N`t-xm_ub-8<6PbTVFO`M_Z4g5 zw*5W?6f=`VI3WL;b{+-j$)+cxwa0s$X|Gn=Dx+ zS)hh#K1@Ue;)mfaD1=<0Hj3t*H|~U&k9o?&|2!)`aUzWw*2}5d$sy{toTQ9WEVRI!Cmt>O^=E{81f#-lIMan3j*36I z$_kRh$`=Xc#Bqheiu*lxd7)Ft_xA^N*=%oP(?k=M(8-2_wOJFk?J<=E?>k-?8JTM2 z_b?myoL|2-Hw{knG|(uYMkQ3u>h6`_G#glmzKU7lXb~f$-}8ZK_Ij|Yro<_z04!aj z?}OENWIRDI06x9;yiZjCEYj+ARf)B#CtkU3vpGbu%q8K{{$NP2E1pqZm|tu0?>MT0 zPo8~uW%O*KTqShT@$d2=?qQZ=K*xDcg2xR*vEIC{TztPiCL&1pIj%LAfWyVN3qb!y zCEA#oZ2NtE^C*LFP=SU_tSa;8o_`qc1$?NRw<%LnvtQY-k+u*g%bhxcv;GYH#)Jpc z3idBK!FC0n1vboI?gnOb%xgXzt8P56Irzz3XN(~yxC05T}hlj9NFGTUE)>2%KLVcmzN zB7T2kqA;LDt4Xx4O|d@vQ{j;IKRlTIAP@B`Bdqml^>49%*B8HEZ(*^0Qj!CaSZQ)C z^6u>=zPdRY9&m*f)WUE*JF8Is&&v zsYim^45N^zLJJ(%LucgE?MdQ>+j7X>#bxXw5ZhkyBXo-ZHDs4gl*7N5fOiy7ZX7~C zy$#Alh;ZOxvMrv|xE_7r&9!*TmZ+BINQhn;%A3406GSR96C+LUzGU2+BTRIS&?;AN z9H&T#tl4nq7Rq_?o`up%2*+sVoWOB)bbJ*M8O6>V>UF2vM0e=*OxPbEfW7Q$KhL?Q147}k-$C{6ghcb25>cuza64VROy|} zOtSY$M^6{6v##<@rl*b**A5%*>L>x3s=bt5%YhWnP3|;)X-)nW3yF9uLaCnNF!#j= zo!T6pbIV%p;8!ZJdIQVMaC_@^wE1je z@&Y1#zGCda<%9FBhuzvI9H|2 z|9EFujNR5nxTE3bw8q-Kd#u>)22Rt0^cz&M^O-rDEmhy?lo(_RbK`V3sQ$%l6adDJ zJ~UfB>Td`El2ecdfMx?wi^xml-Kd)@j7$%}7ub+L-1wH?qLT0vBgFc6Vi0$UZ?U!B zmGM&9?P3*gW4fYZJ9v^>voAL5O!1~%rNf7hOG)s4p2CwtgF-F)@;soW_zbDO{-&?y zQ0wYz*uaBrkR7(IIRfZS|E+qSP0cK8frPW3n35$u7TtDn*Lt0F|AW37g32gTz_#-TQ5oZ#gu6}pzU^$XuO?Xys$dKAAWyLL1AA@7!*hJ>kgFH(5m zfvf#_p*z_{<=W2e&dkQ5(20EpOL&3W(Lt%j8Gb!Incz6W{9t{dj_S&n*ZrZqTJR*t z?kq*FAfYHzZi++8fvJIu@~#&oIA{ROtd3i=%9`{b!@}GiMbog_&7xA{(Hmr3=Fkho z`cObe_ml8+&up%FPs4a-wbF#`x=spb+v0l<{R9FGUtdc9=dM|5#aj~lh)Q+I#K2M4 zPHxx4BMv%6ww<${*;i@TmJgfx(S`Y-voPXVxH+AVxAW);IZh>vhA*MM1O$W&LN0B4 zHBEl;=>yKe?p-eDvSM4Hfl~Z&@>K!>CR-7?6vVZ6Z(bu2L-b$C8nFsiX*`bt&%94t0HVxlCgv+)OSQ%5b zh-?#!>I`Y}j!54#xx`d0H;vrwKaQ~P2#OrZ;?fQJI!8Y5dRG@Kb6qoIC4^u!b!-mG z*uClrdZOr*sp90he-?U50QNe)kspeB4bMNj-IU3MfdC9tIN<3Z<#OgE2EfNK^%}cw z7Q_aifN}{9izqzaQ7v4gBd{8vtO)@scx6k@U156G+w;1IS~caenUZF%JQn9CTjQF_ z)e7PCSG^L}fDaoF z4N@Ap*fU)KULXKgaT~Rs5j~xroe6{&+U44Fd7r+V}t4?BXhgFVaZoKB1n2l!Do>qYp?(wtum zXe>KcKI-v08Szs-JDV>y*yE{2S#b-J=Xtn+uA_aZb7d-Q3G62?^c)65G2RX;CsE2x zGfZa9F5s-vAUb1Ljy%jc^pXQkH{^;8^H%)8Nde7(szYI>mA z;O2UKmMUL!dN#kcntDJecH?B5=6dzWwua@s>($cqv-yO?`j!Nr<3imI2#JB}hx?{B z@i%VX?b4C%XC5S=w%Yf)>n+v%S#R5Gq8(wmLJE{)DSNT#B2H z*ta3=LzfZ2k!O}kKD_f|ylwcnVO_U^8rW_;mYveR$no=TPoJ{^RLQ<_okDu1C}NlPysJN6EtX=VW+qKtFlUS_%=XID8~>m>$7 zQp5P=cx=U6!GNqAj}8NH){qpD>y$lcLPAHHnzK`lxK5r4m!_(UF(R9C&Amsb;wkcpAY|GLl zrpKmYVfjjRGlfos90tD&*!o#c9pe;h-6~#k@6rX&J38kM%OkMcoO@I}{>iIj$4p}m zP}AfXtBs<0H#Nz?cjtsK))53*bJaY6YVuf0*;Kx0z-oVjrTbUqgf6D_0rAd@;juQg1jkT zP*5u|_zefYR{^+qd$GjOm;4(~FPt6hDP^TbyRA8XBo!^h`8Zj+F0}?@m=ddZd)%Z71tY+@i8m(q0IK_A8YL-L>|r?F zWU{j7hKx=5NuEts9GC#;+V2Zfaqqo{utFP(1w5t8ZAg)9ZQp#;pIxU^vPQo#aDcWR zMC7gB;&Ds=^E92$hr{-Y^Q6S+l}H&Az}*dYF;G+}N(i>|D(%g29m8lINla!+NpWR8 z?pPfm`QSpXLpa}OAem$}r@zN@XNag?+N-eou?`b5KD_C);$ywq8?ES0Pt1RWzuUv< ziEpn!#y0(u-%Ax8UJ`ou&OYxlW1r>`j^7uGpTm5VmxJdBuMAGHRH_!Zeb-e~mCAKE zpI``Ba$R=JQ{^baP>7(ZU9Dvx3Bo;b(e~(Y-kzwE>!v?W6`Q7z;!-o6Od@4Zx;?;lPA0cw8_k<=F7;P;|4WUq8q7(`N6n4sGMn%gwBqqm23 zq1mE75+o$q8*tRRk*dBfPe+ErKh0I5gX;kB!~pV+7XiIz(eLA2t4Y@h!$&+4DEK^h`WSYpqX$liL}P?|2v) zVU}U;aBpJeZgDOS&XlXS*c13 z98~kbM z;Cjln+VKsaSk8E=u{17W+fSvGaJIdi$-~7*dyi+RblUNupB5CpA_yex4ebYqWuwQ{Q=0W)6!URg0e{ zJ%kjhGWO#G+Qmnz=FTn{|r%r=@3v zPfhMF)g{7IvW}SCa}Q@Ktx8BnZewkg8B-7;D#ua`55S|=53h4DCQb;Yz zYG1=0*qwf0w{wYuP{e>!g7T9$ss~^>8K2X_kkAAB{>rm&k4hmL>(&>C{Ex zyLx@rvB=4Kg?!Gjd9Xp!Amp)wNT;ib%lH{`L^?(@kncT-&A#Nl@ytvgg{VH|qt!!R ze7+wPxF-nX!oruOttdHeGJD45>Q|F##Z#`MH&jIX3S8H7;bq9co%-2OY&|87Jd4@o z^u~r>ZE>2Eu$>msU6Y9~HmFES)u8GT|4~~bqI;&w792M-s}y`-t0;(uFx%odScWgY z)ao#snIt~&c>F6q;Sl4#wAM4AE|sPHi>{YROdK`6EquWH1T<;;Pnc)Sv~`# zYN37LugrvWZ$x;ZS)`IX%gSwcG`BwLg96|%Q2k?Q^1SnW84?-9QaoQr0%R|CeWrOP z6f}#CPmI@jo4L+dbM4fQyiBx_h!*%4rI-y(^}EJ@$Z*N5@~Qesmu;$7CmK>8H0ki^ zZ2FrV6zSH=Xz5_&+ATgt*FIwI$DcSG5nQTu_E<%Q8|g(c56-(}z>;rhrkXfmx_6L2 z{KG-6NAo};;9L>lvV!;CFN_dPRYRCA!-{)jHpF5yv|`THRemrVv@}~PwWo23P4{y* zTb7?Y>B8rOaMBBn=cNhoh8&Bc7!Qr$b4D7c=^@WZr{rlGbg}k>%oHVSOfWFkzdTd> z9NSpl8L|)s;}yWmcV|B{lhs!+1Mkq8qvbhc-b*C@G)ZdS3*g+BaDBPTezxn8}UDT%%I#gldt~XgN zPy^Lg#@fzG^t2Q{WB#k__$ys;RE3Jq9rm#8FSKc_uXfr(M{s&r9+8bVhNHEUxL=)+ z@8CD>PUmWQLPzQPk=a1B_`RluNkZbSpG56?KdK{AeN&)#xW?b~4(YgKifiJn6f2`^ z$tCi0v8B-ns12o6Asb9E3`0LBrAP^ttL=#$p@{-DLO1 zFw79be(vd6M--`QM2lm@2*UidDk*3Ysm4VEVze_#)iFj^e;nDIHLIzzM=HNLzwjZa3~Qqkq=C!^Xu%Cy`DVd=3^{b*8C1fD{7DL97ur<%5%>frZ^jTNw!4E5u%9od?_vA?cd zk$*T(mL|H2Ga1<(ErA}aTIhHbG`?Cy7o5#ZblN#WIb7O}hV)t&vp1JMW9vkt;z!?f z&7LcfMeRXUV=N{O>JxlU62}ph63bDY=3^YD6LI#BB!qjH-vX2Nzu3uWEfq;@EbR`& zOCj+n)z&lX=WYkHX%!DnyIv)y(PHo6q5KZEq6;-5)qgi@OQsp4yiu|}+_RWekrHk8 zs|WMrW*4E$wGz4AiJ0kqjaM*^%lpbF#j)4sRjZgcO&*i+t|Jd%o4rM?0)oR@Bd9B^ zXT1x7Hcy>^YL!91MqMz^+{#AQjZg9DG4a9_;uya(5M;Q}sf#cJ#LTWzW@%q7ue{4f z2FI%5D&1PsD9-@($MZAS8Qdm0o`<$Vg*qw3T-VxH+fa|C?jd6ykD!rp#}v10k%znc z0lG;nv(o7#+ss*p7uic!%T@E3n`^?nmU2-?4UwMLKHEZ^;^D#^frhUJHmeeSYN|!@ zEfInCuHq5i!&_IUd(za1L;G@WUuQ`Ggmg{0^zIV2+j$-}@pgi+MAPEz$6jw70y6Gg zCxnitT)^%lwh(leP_j1v{O#UzVptk{U({5xMdGK5bhdQ}g%H12=#Sxb6D&AamDGco z<#xOnKeAdjGM>V)w30P4KzD~n%7rt}J6_Rpalnr zG`xsrknoC(@_k`40lCY10wV<0MVZZcH#c5UEN&KTb6m~`VG_!mW2Pxk-WuZiBDsom zR5`aSS5tuXK3L{WC-yQ!*ku-bWv=KtQMl+Tds zhkimWmtA~bGggT_YO-aXdS<qQ1ky5~-7f!ivcZ^`>wI4_gEx z2FyrDC9b8|ca*^|K9S~o-2FyA#&a%DeCYHWX_X44`y&#Q)oNDc9+t4#u+1vG#&c!(-EMYRq@p`G{Ft={ zmGypS4JsX>zmakqE*!C^j+qgBEYCCC8z^t~XJRboc~KR7;@{)+qLNMDUe)JHbtW^l zhepaK{+snPxrZFmfz8ygQ>>LxEv?iT+lQql?t{UGlS7LytA<;GH)FQ3wVFDR;n=Rx z0yB}pQdAzGVOmj!io#ub5r? zh7Br<8R`U+)oXme48SXK+{l!Pdn)6OefW8cZ{DYB##Ll3(Oupd2?r!W9qwbC<8^5n z7VK{&RtP!I1vYNQQ4(OpY=}rmIEeTG%VpkhtcABP^46BF#a-om3&qPh7n@wpu@ez4 zI)lUNY|c}n#>%D6(A2(Fh#4;4r1euvGST|^t{gxI&&k@HYT zFM+IwKtadmX6VofrS^~$sFf?deMrEgjbIX(uQoiIzpCW>c&qlw^Vjcj0&SyN=AToO z>q<>+(rq6jlDR`r?rk2KmKtJQp0@Va-Zv>nWOL?mhO5-Cc4l+@KxOp%f>dA6MH^!~ zZ2eugk_Bq6<(3)j5^huiS!g)#L?sU7fT1(l@l+=0GpU9w$tPpFOp9gXf+A(c@?|03 z=mSW*-)$agGu!vknBm;-Rh@kCb3Y0OyN#;tS|Q$T4rfXXZjJDDHc4@g<+jC^RI=!w zX$MWxC>L)|eiVzueUSSWs>ChF!_!)+PKy@{pR&iAv1tTX@2kK65R+bVsV@gcC03)# zvqEg++3Lvh+SzKeIGrIycQtQnnq&gm+XWdGByru0_yd$+XDwG`rMD6>moeoLKuPB; zt&cEl*zbA2B~aU})qyEd#x^U@5dT0S+pE?7&rBQQu_Rd8~1Zm!N-2pyJs zwICooZT(%s@WVIDJ>M>pBcH zV<78H+{57vfQ+I9a=X$qG=&A zd0`LGnN+Tk6%Rf|Y)(JGkeQ~icmT0z{c?Hlfgi;ZD}l}H)l(INFw3Czv813$^d$iB)DzZn+H z)-~t|sCmtj`g64k#I<_t66cM!7v=N%hQwNW>qgrHD^fThNQ^52({s1;>5?M5Ao)^gJ|ENfekXrYt}?8#__`i$Fkaa zMiI3=YJ7iZUZ)70OGNRIj&D4isc+x#E1R%nXk}_LoTXed-0u`uUW6=N`*bT>QCF5% zes_ze(}>y`^h>wiXy%SwSjmzL6HzXFu5D<40N|z{{d(ZVDQHRnQQ-l4?ljz)Ct05J zcaYUGW|3gnJ0o3S|L7YihH+-%nuU_z)?;wZ@Q^+Q6&E+>(SVivndSAlRUN^nE62*P zVik;sdTo#Fb-eI-a*zCNH9GE{cNm?ah|{^q5@c(tGF7Cf(^+rO7>!UERFX;8D{(6tH3=#RfVX zn0_ae(CPN6)(L5nE9_=UImJ5oh6fiNB!aem$zXTJpOAYgVMh}}K5f8J90;I0@L13y zqva|GMJDw3(nOXVMkidpd#WyvoR4S?ZQXN@&Ix>@VKKHLju%t1tP19Vvkfg0iC-p* zX+@EkK|2o+NGjq3+|SO1?B?-rBk&LQoNhXA2<&vVgaa6PrF4zQZECIdz^2g2bkG`a zK;QJReWsSj`wdK!9PZ-AbkB+@i=8lzDTNj8HcYcXUt8N-p3u4F38YK?5c&bla}KQ; zqEyJZ+P0R^<)sJAgc(xY(56Y@!OVN0cp8-zI%TFD?yJh-Y>b)AVbNMbb2I={oO4g7<>TmC z%3|o>-oE5zTc;1Z?FOEXJ57w7Au6aZd7UWN8g-b*s9WX(6rl2k{1tK!RO$qo9rHEk zKkGI7-zV%ns6C}`lN-giK{9{qq#gGM^H1|S<_eS1O2Sr{3GPP+E!u;?GdGXrrKreb zQNKWic$mq+bJ1Wj|Ad$BgPkQtsDhS(^P3?KsDzg5gWV&}yoR4MXbHQB<|T?OV7aV2 z0jMxlY}Dj1W+Z}_zZripVHR#TV+`<2T9io^H;70ZPuYYCkpg}p4$$6#^TTkNDnx?7 zF}MWWqgi5YPhp}D0Hph=CspSy|2N)i`DOmfmo)7E4wndS>3{vfgaIU^XIj7WZ-m1C z{=&b!a~{bHYCx}Jljvh)E;bQqGycN;{vbB~fxh^c19)R-9438ur3*lggzYrXoWWy~=lOnE&p# zz-mYVPNh9%M$-TG2TJ#xO6bVMe^4?1`L4jHjn4NPhyDJPfABm1?;qUvQ-%<}@5=g1tn-v9B4K8r&WuYHYvHa!kGq%|R-Qgr(QNs!u%{6W#8!h;{ft7HN& zN`=I{Y*==|5zhc{))E}A!+r7-5d_RCB>dfh|9157B{a_IK1$mnCoUTr9f4in_kM}_ zcryJV&nuazX<#2ACItzxoFkYzp?UyKe?xdHX0RtQNd?XcsMl1}}e=5Yz+Egf1_a!n(5xQUX;)x{0 zw(ue}>p`P`<^||8wDSRFJ@n5E_lKvA-pSR#zQ7Ye2mAxp_Rj~XE-++wr9_EsIr0c8 z9s(*kz&}8^SOc8Wioxb8lT)=9T(UI^$QPT`TPC@O%@?4!OgNFVLKJY&q`mtxeNw>d zd3_nC>875(tgVb_qG%dQu#R&-r~p20HJ$^F04%ScaG@Yomd@W(WC%fZ-7;HI#J`=B zUE*4s^oVu!%aA-1+Tq=RFN0PU^BO%d8ERFpifzWt*Nf;mfRJ1mK$eLn)zf$C2HQt} z3Fi(6v}jv2c6)Qw&!{4z-)G5g=$cvu9{q~0E=YooN`Mar!=*V0SjS4P!GRwrH@%6VLpeY)E#kVvuTBL&o;%r!b7nhx@*4q3Y&zfKqUx)^7fak<_|D1ks6)n)xM;0^zK>ROysDCVe ze-1n!p#RV;E*8JN@K7ZE3`yvJrG9(;wGs&H{j^mHwFD{v=<;d%$m1h?Jr%G>%)6qOK79y}8ku@9{ zc3hf!VUj?jUd;!j6ZIW~)LYjiR9Cw)ojdyyYF1ael>pt((?&TNHn#H{TDqoPy?yARcJUqH{Q0%41;_i)%|F;&+E9wE<`qENg zXVuYqS@Y;TEOS(GHreD+bar@=bw6j_xj72Hv2sogB8o6Q4c&ZKOYHX{!{bfIY1IJ^6=xF zw5RNt{0l@q(~LkI{Kv}afk6=qIbqDQm4%5UmL=di=26La`I&#ZHXpp9W&~rGWKCCi zO}w%DHp@l5+%)DIh}le;J$YIPNGQX_V}6p6hiQn9{cZt~BSLF?JLH~saH;jnE5H-g z1yY=cm>%~3FkY7E3=cn&>qxQp!wx@*D5^Fsf+UPF3z%kzBo4 zf>(wHSbO zsztE0)6FC?YzaZnp}~u;ngGqC6>k*o5C9AA22?ERKvHyW)b}r3+XDt&AQ?pAyygK# zWay7AN3_3_mUjsOq}nx-Yd@+RFdtOGu8As+w-);LMllB*YDF?K_$=Pn0D64|%i;hR zI_76E>ifYnzeb9f4CVcd0WQ6DudfV%oMH5u++V(ajRHVZQ9zAU$LFfzTG(t%4i>la zF%H1)c0k2L_7Z@vL+I42r3;|DLGcOd3e3bQ+{Htk17RX~_(C3Z7!*$dcu{EVG>+3f zcjz`fR@jmCiH43clO;7a8^eGJ%WT3eKEQg-1qCL>FGro%@E#!EyWTDv&MS)n&%U|^ z2)m9k245tvZw!lKVU1XY0 zQLVN-xq>gSN$2q2-i(`aMWUKnEYAx%`7g176_A0PA-{Q9mR7xsp@1|;2pS{@IoNY! zHc`aJzhMX+_Zr-ly|+-@o2AG(H7%tXh|DT*4y^gu#rXDOrV7dW)&(vdRg!q3A?5+; zHsC;rgf)dTLx^Ly9YB6NBYxrlVpbl=;FfS%1A)H>j|iL>?E`FO1a#q7&~MLH9|kBY z<+ZoB8&|a4-JB)86A*AjZp1~L1Om=oBL-UzW)fQ`y%@p{C!6voR`}7|XA;RuFEEh1 zsgxvuI0n@RNRQXOGtEnax?jGduC|<>Z1HeV64)W`?WtHGe~WneVo~1}-iPP%(Oj)} z%BefriD=xLJZTv;W2vvJq@JG;0AZRewFZWyQ3CX1MGDn<61dPWQ6RAdz7gK)%t?i( zGs!{>?*OGHW9LYk2nG(baYVV3&#TiEKY~Lwr^Me|%>CHL3q&lEve?>21SAdOfQe6l zh57SDb;;5nH!9>kjCngLeneiOeh`~mtBH@v`+S$a?02h>f-`dN(etUQ?eTJh0<(Vg z>A6a-z!1ZeRu091Fe$v6R}YI&&yRVV@1 zl}Ko_kKWIab+cg~o0Y`6yUw43x*u+QgYI*!>Gu7*vRSe|mifi~w$5j>_OA85Siko- z4nhxhq}Rl8NEP$d=G0MNX3=TZ(+~^RlL`1gjq0f3e*Q9Da!!YAjJ+8bQ8D$yj%=n+ z{`2Ca%f;tTqFY?4 zp9CJOG^yC=AR&Bu4*b(CsX*&pcEsIKURGdVYHnXsuIHC55FjYsFD}%N5wT3(*Q#*6 zNhJ3iAT9jJA4oG@sQE_lj=Dl$qJVm+#L*kdat z2z$QgtJCBupO>fAuQ2^5Oeen@J%?EkiG>i}hW8xT=;3e$-C5`xHzrGMa5K;=|ExM147FQy&GC z?8Tb+VAHx&@e?q~2M4cKavbM76Sl(JL~{ zKaC(8*3@-ZXP3y?b8P8=vy@#^a}$uH%^yZz;+SA6?e@s%ZQQ9@=xtbvjOr%ls+{*|TVjse?J;ARlLhR>CG zJRZ%`YmIrjpzQZ*BZh}33}tr{^u=kz-Pi8ul7_I8Ef&!-WBZMh2(Si{mzj(Xm~EGC zFu}S;0Z^r|!RQ`^Lhg^$;6l5EZ5~VBJEt?J_Tq*j%f&Nm$-L2-3|levKC3-93IU6N zu&Z5@j9{TVi`>@@69CJCeks zbObEIK~@cHCA(Ms2%|SelmQcPsBw0G#6$=`Eyi$;0gLiYM{KJ;TKRYr?JTewuGxfY zh$!DUB$HiiQ3MyKs`^}YX5ecwMPiqaMR8P*RmOfc5Gq0@W{tNj<+qKI5fLXQCe)^0 zj>Q!>8bb&E^qs&}5$A_)5(2)%q5&UUGy`!4k*5|JFI)8fa7w(`H#E6-WS$YB%4TDr za*7BQrvBV9bJa{6IZoQc3y}8rg^~B?L6{wNV_rMPx?JtNbe;T8h}qpGN1mYE_;?wl z099VFFZiSwdsuyWZ78kym4J;bfpCiqEM=joLPd9_t*x!X%YrAX9c^N(W#jWhj)2MQ zX}VSd-3g$D%2h5A?(nO5{PZjQO%mbDM^6Zb9)8~%w+O3f4;)_SNnjPgq&b(|ZD^=^ z{!^T?pNgeHTHNWe^oUC277DY&B-rJxVpe>Ug^!L5rEkcGlW!QGc@kdBmzz$KIkba-=zyM>X<~{U{+v*bJ-V$Y z-}MYz2e0vu(V*2|M$ZDlrT9vyJ8hoediYh}J2l|1IGs6aRFIxgwXOO`HvF_Rp63?Q z%#dop`Y@b9JCr@@YTZp+(TO2-GH_UCo$l||#k1NSIqHhOVlX=2nLL#VA_c=0tsnBF z$R#6d+FIkwllSpA7uV5Y959~(CW3);~WhM0vV8k&r8TQQ-=p9AnUB-gM#!B5; z$Cikpd%iL?(0vN4Hnx6BmUtq++Lo5t3U{o?utAlVP2FM(Z7H@Mu=ETv_5{OkGpS~2 zv=YO&*>>Wg6luxQiBkfeb77#5JWV;g{*F=y+S4L78-fv@ZD)+YX?6x(u&aj02g~cD z$WiW9wV$;`G?WPEz`^}$-FH^us~FN~3tj3`*XQMY?`VrZh$>Kk+WoxfHbEEvek>mz zaO2tA=wH0x^*+wU|6u@q(e zTgtX>$NZI%r0LF`q6kRL=B^3!QmmyhDaA(2rFimbBvHip(>r|x41h~@>_PR4_50Hr zP?Q-N%bdM=4w5n|)zT%@Y`a46il=jYNn_nsLsT6AE zsL`}{mdy5r@O$bAwhjwR-3x3A+tUT8NWq z*8j)WS3pI*wfzc$l!TqvyQu zz4!apa*by=>m2^E_p_h)#nm+i(MrHcmjt_UONdIEo`wkfybGSL z81d>}K;gBzI`3|yI-)%kG~NywE_=sowULkCdWz3LAr;5<2Dk7X{G>uIO>6`xm}hYl z=U#)tD6b;GMI2BMR=@;kq(GAw;lto?Ur~P?#LY)hw}8vtC!6CNW?Kz)EzP;e0&XxxH?Uc;Y}%%K8}Q#10!H2~uf-eOD-hSOjpNP-T6c*9NCsbQ0T-x=oZ)X|i!cU%R||6z_UyB7NQF3F}#h@kZ~as>k83u>le+|%&OGD zTVOPEtTJT2#a1(1Eg#@YWbY_;El!N0i?M0#@$~wp2Pb1ha?_ku5B* z4faGLW>@3hH_fG=(3yK}^d%p@J}G0^y1trYW?Wtx{Ltalg37RKQH6PW2YYoOmpHVs zF#Uy`m;mu_)hIDY+UH8n^|fbB#8OI*xVuffZ?Q?(QW?9Y<1gd-FAYLNy|cY2HqIx~ z3&k7eXoQ!P8;m}~(N9gz%?Iyt_w4*E_uA8kGPUqZgP#3T(lQE2)>9J$Ledk<+(nqy z^1JsunZOUgR}Wq0wXO9hgHd2|Q}`Sy`atjmwaTQSP^+93?MDF>wK=2DO@mHnh?gwz z)MXq(z;oE7xVks0M+YSr749!WW@?Or6q;Mf+nLN3RYSjGB6s(FD0^$w%A)^puTtNDkKQSjyD-r4z>GU3SSpI^FTQXaS%We8xDO zV>qv5G=Iek_CpG_iaWhFd%D`yYM0`FFc*;YGsx;zHbNdc#gExvqM4it_{*0rVOk8R z07+lr6k+jaUb&h>7CC}8g}G_0ZTGDM^*;sp`lW*Iw}dsKKYnIbF0kP_lg=IFigVe5 zqd;J74IvR^)-?Kl7j^cBlsmmpfMm$ww#MQ6-ZHYWx7a2FV`bA){3W$fzSJ4t+ZD=p zjnBuqgoo^syuRhVqhZqEy<-P z?f$V&X*#4>tzh>H_tv|R`#-}Lxs8tCkByss=SnpSpu(1?tP$Ljq&edN*~Qveb;kmc@yq1^5Sd;R^9 zCagVJ%Ux*VRCUG`pdO!I;7dGV*0WKnuZ^LAFBFQ)p?uBc+{_mDHQ{2iZ*f6sh3ayS zNxFqlJ=35u9MKEi;w#5-@M;Ybkrn>^Mkb~4+UmJaOO^RjXAyr;+q=;99&%kz;WvmI zg>?ts>7nDa4^reyXrA)#k%f|FFJCVoyeif!|zi(=ytJPHQP5}2-+?Lbb4zl)m~OXsDp(X#Y!KYxb5!xU#1&}aDU9JTopoDy;7y$2@PZM*1*QyGXaZs)8p;~ zeuV+0lmhLu@%mNN3G*u{Aho4RnyNdboBhM^9o;ttLZ8#$jOI@e&m^B0cYlK6Y=-(R zd_;w4Au90Hvhd(g{b4eAt8_BgfEz_|-FD?8js5c~1zRA@MsAuoj>qQSd>`H@CXYvN zc@=n)ZE-X9WtiqiLOUSqn_C#p5M4g4_Iid=NTY98{~A{;pk=DU$AWAOunO}&kxEtJJYwP8!Cy7%)hBeT~{h zOPPYg(Erh}VebYFA$HXYy9uc}pyL~vtReCKxju_UiXutVyot!vFZ$4@ly4R4d>>^9 zH%%!=pd9**({yOGYZZU0DXF(ZV5QUyM+m_iPHla*h;uP@*mvh!l~VoB_XtVl=yQ5jRNkt;|?9km`4ApKFt~-Q87b#j|dBk1UtM$$zAZGd=Pv7e(Xo=-RBIr zBVf89hU__G$q&|y*v@7pI%Kw7$sq@{=k3T=boGuR_!kR}RDSTsCC)h!PdNZ1Xr#%< z$Lk%FL7J=AQZQpg30gf6ITcm7$E5iptA3^=-gEy@rscfImiz8k=p7g~<`N;cTG`zu zcii}mjQbPM;T4r;vl4F`FKcH!bSYYD3yaOA(%8-xe(qkmbTRR^6!liSh>YD%Dn9Ox z=l<&KCh%dw0Wi`m+?z{N?N7L!`{De%H_R4MYZ#48-^k~)!WL`6LJ;#qbhqJ)18^>m zlyb*F`|!zytzsa5`VMCpWiG@g&+=#DbRzVQmK`c7XX6-(@f+98oj z)Jq*}gy*wP%BGSy@1!i^kz0RP%&_hM3B}U7Zmu0c6U0y(;ISSNOL0H?9;zUX%l3F+ z_~B3=POtK#I}zX47G7Q@Mfa_`>sH;@BNw(T4sl2L@ax`nciBDuXkVc=56u_j@B)gW z##iTvLHo8+ZlCMZ086!Hz>D8L0QFri!oy*PV7GpvEmWSz^|O6)YrAirY7svP(cov= z>6d)c>H+y5c$F!obee};Z&l~?`>z`u%D5fk-H|V8V8Pz}xJH8K^eREG{++Ax8J&z0 z-@B)03x(DPJv%h$@Ft+5!lsk3mdEy4k}1_H<#Z#6OTYE?%jqC2RoqSJc+ATdEZ($j zYR}g+35U7*V_m>OeuQJ!=lqOUy;`qQ4Q!(Oz4wlsSX8PNb-y0pw=zf%#H(t3aVB?B zi5f-}wUb+L@j~t{g(OdVy3bxumf{M?q&m{@q!XS)BExc(9DY2I)=`8+70b zdc(^0=)g^eV3+OA_AuwCzBye-sm(F6@j9yQagE})D4-*@;~Lq$H2X*$Pp<>6{XPvE z@NK@!zQG>4BUHK`)S;21A%%z&aCViu5qU@PP24|r#tij%aRbAy(CY)y?zZ!_|EKeW z_9M5&d+0=-;zC^<$eS4RngZ&2#EEe9mzTV-reu)77z-q7LTttktXbJk#mYZ z%Yk2o5}R+Vq!N3g*{5-LaeB}C%e;&xBWw^CEAD)~pM}4d)H-~_3B1y?(Zqdh!%k;X zq|I`BHS}2wR=zf)5Z_D|0-(PIXsZwo`LlJV{hm=l6%j*jk41L1qB{7yh({*664QJ? zxe%)j@cUO;e+F|95;?MVypE?3X9UMY2@uHPJ!<~~s>$9jQ6d%=h{>{F8`s{m=hCpC z-6qI>H4&Rq!px|G3WqN7Zo=)W36b&hA%>OixL2CJ@rF?Lm0_U)jhL5 zEql4peh;-CzF|!MKGnm|#iZJfj^)76qz%cn%Y&#(Fp1g)y!^64-QOxSt1ZHyq|&L& zc+2^IzQoR&a|2phRS-&xEyaf}Mc;@)ZF$q=(AkSc@tQC2Cwm`A*7%>8@A$D#XlUQI z&?HLsS`}{@;!uMH)J}|d3CRjtR5M*7*64TSslyry0^l7g*vyGt{6CR7JA!ztca6D$ zb4@GdJ16v$xdzj(T$KWrSAlnb+n0k*mV3AjVAh*UuTa$%6sVW|I_5z!wglYX%UoAn zWox!SHd?NaZe`Nfo2=AuSAm>c{aWiVCb?gsLW17Z{)i_3oM7Fhx~qmp;Msuz#&%{F z&wWXb{!`EBgM+<{cj)kenbEHXZ(bAHkQD8}saw7FN?RH=3&ke+H+u9(GDF)e-qX?w zXkqE9rn>9i2^#+h*C@7q6+%E^F(331eXGRhCQ?hH=l*5OT&XK)fDE#X$*CMpSML5m zqHwf7K1QW>&_h@smvm&vKy4M+-MDP7c?T6UC8Nrf8V6M+g7 zj+^=(!AF;Wu~|xc&jgZz8Juo1BaHHc{NUNa;1jDSNF)J_S#Hpe6qd-jD`k|0s{w;Y z&`XZ#y(LLum$jCMKV~3KZN~X{KyvcQzm?2bLd+>R!`1e2(|h+Nq&K6l2$tjKm^c7l zq)n&ZeL#u5>!moX`L7lLn4MyKV**37?IuIKW*v zEy|)p1@pE4t<$ouF?V`#znC?bP4AvFylIX_4^*e`&0*gdG%G2D#@9n4_GGauDz}wk z{F8Nh+xn=a;IwRf%UPyhzd4f|t?lnZ;JIdi^#l02;Y3ruY!)7TILN&)Q(ZN0D+IHn zIk{M93qu@G6(;*E%)J0m7X{F<^rDKE_hTei+pqg|7|SgCmKcng+6ApaB~a5|&s)zR z2hu3QSINkZ%F|tGBORjhUe$c*nAi%PhPW17)nrVSXa{iwi|8VbYEF;Wd`7OU{TdF8 zb>?S{k0*l*pQ{M+F<~mBs+UgStC43~W<$bYNcCjDl}ERr2sM1+*xQg~7Kl;}#k$f4|#}|wmHrA&}`GB6U6Ub0-uocOp{y;m*a?=~5zCH_~QGFl7)$EkX zZ2DJ}sMC%>grSYDZzViD0F>u4%58;aZgwJ{rU*z zXOY6q^bB;cD+; zu*PzQbe)VsmJSggiHpYD(EIVR(|hqxkT{hv3`xFs;IEURlQ2WW)z* zqY=?X;^J{`06|9==sUi&*#fDIZ;@akM8}vXKjV6g}-zb zIL*JHHiGi!5IZ~9p=S`>l`YC^w(hj zWvzosltWqXz1!cCQMLB;XH9ptxYC>SEBbE}XJMK(s40juO0Ccw;q2p7HNJdghql7i zTjQ%I8c4p!oV(@Z(jwW|s-Rs&Yz##cY>H8sWgpJC=v zLH%kyzjRUMI-8ZFsu-mdn$54A&e-I7foODJCW_in%8;J34 z+GkDuk{8+a*QQ~u&{!sE%D`KPf7EQE&51h`0Qe{$BHX}BrnP>>)Wm0Wk31y#$U=uw z><0yvd-+~HDy?$1=U|$}dw0BSunoX0$oU|EZaHsFJOr?n@A_?lJ)i@G-Zfom_0=U3 zNOnlpId88_nx>4a5K!<~ekL2b{SRd4vk~fCKF*yEi=bfWY!!J&-eMp^Cn#?o;BH|h zVL^EXRq)U8lwxi;ee#C;*eCVIS}eEoevb?;OT`&P8I0@nP-WHMUWlV}dH=9ONj>eo zO}=+U;WnA%j=`QcT{s;Gh}NX6u$ckE6$Ai7A-_gH`TO6ObL94pjyvyvaa%d^vaCUfw(JI$P=N%t7`(f{#gW5u0DLk}cW{iLwWxmq@tX zWY*8bvb8ofLQFPfDBA;gGmJN@_xM29|63wZOZ$sWf6e6QkB-v|sFz6R)&1M zQpuuAxhI2U^wd36+&t>|VKh3)3T8I7)&L%p{;)N92Lal$W+ih3rVgk_%r!8G3w1T#2 zNmFbsyvG3L!q|5wtV$+-bR|Yy7WXSbCac{2OjgMI3LLzXHe1>H>J|%o;ni@MU!69=~jE@5aGE3b^KLCrSM2#LI3JO+W z2^@_y2l)B(XFUfxn+XxN-034AG50Vn1La!~y)p29qz8V#DC|K^HlgRKHc=c@Cb@yK z&4;a=6Z3iP1YL&!g~U#R9qiX-@xD0>jZmRpY~y^eG;UBp#@)W!VcwdND_>h1i!Q^J z+ibLNqoJy25jKqoo=}FPHRX@9#-i<4f``yWZ<9Q;KX{1T_8wsQ&XtwQiu0Kc1(hIa zMBqLRWRXOnenu`#G+2BQ98wS&qvJ0AODgV>P2<@w$``h@T*-GV{$*5%i_!uSLIuF# ze86S&x&EM+btGT?8Gx&%=j$|RfIyl@A_#yP-{sTa_V}XQE+?@>Y>r2!()IsKHxLVI z22TcEq;4VCwL)WUe8;_W_C2kl5(=|OeOBlbND=R^TJO$;HAf-t6A-Jkuv`ysKqVX% z>vPP!cG>p5Cft`7#D@B`m7C|_>P>qoUxkUvX*7y$053N=tKi%4L|ca|GWQ}ZNua|D zHb2288b2Ti0^zG+6~|7AV&Ed}Pa}4?I)D()Hv}*y(#>(>vws5P!Y{1m%mQs&7hcPX z!8~p1kVC1|4{JQ776)3!=ykevG@;%erNld<9S#Og#~_;YB!ohWqJ6>EAqCgO)=bxC z)>~ub+pih!3;0)L)lh&nu-$T7Tc9Oyj4lGgpk$}|Dc~47+L_gCyt($+Mt%CiwuJZ} zEEhp7TB%Ww0X&%-07R7P19z58MLwBTAM)};8z)UNA27O>EgU~piP z%^kJW@f9cEkwH414rpW60lYSpRYNU{BkfkpSEup_4o3WfI>zv`XMmJq&~WE8NHqC;JmW(Q zq*PPAx%Fxj_%|^Z_NtB;KdsxHmh00 z4*79An${N0U*@Z^*26ikli4Z$EKo9(+AY5=iYiiT<4CjJnc*w&Y=A{;5=v}BU72(_ zwW?`*ymXsX9{I+-G)o3%wpTcMPhA1K1mw-?sNw0DiS2}?Vd3b1HP7GQLB&!RZ%=&j z2y}}aqm4!)+Y&Ek_Bm11n#9h&5Y(9`T^kqZv@A>a$6G5kySKMR(h-CKSg0T+iV#3x zGI`Glh9D8KLv5LfILW3h5ptS9wh=xpg+069aU~dl)QnB&Ln1! zFZ}B4iwDDrS3@A#3YLD(-3}*vO*RZZQqn(q&4hHez&yCcee?J4-|h$UX=0x;ETDxE zV6N)54GuV``kr+F^^D-P(E*yHVSF8bk4G@Hx$E~apKeZ_f3ycxrRc7>WV2e+5(k)R zXL@ELEJlPeR;hKsdi969DGZ`R5B1Di1Hi4=3cc&CS#YOjlRh9ojwGHE%w$TEogMUX zX8PP*Pf6P#P1b|%>;eSppSP|5UJrzN;5AJBfX6Zx>BMdu(j(0Pq%Sn9YCgDtkz_t& zjo^Me5ktJ@zbOP0s!#E3RHh6yLPEuU$AQrdlNdfT6<1Q??UZag?T28!4cf!4 z;Q9znek3vjXmupdE(!CW>lFu#Lge*E1R;Tw^4q}Hw1>5*{wKy~U_{Se9Qco-0eHpl zDgD5Z3p7-uyQ5fRD1|*IC_ASIfw=`auQgj7Fo$3@Bv>>T zt{-P0MW2u(^=+q+qon3VSRO2Idb2MKm)cn;1gzLAa}vF)_#fC4P47Y?X()srjVeTk zyS<@U_ewMb^2*4KFDU!fp2Ia6U6Sz6b6!I}=bK?{lSKHZ zTJ#GK82nJoeQe_Z)(0%qdDOA zRq2@NBIPgB6px#nsOavCK7S|^g)fpQP`ZR)~Mv>P=%|0Tl&> zMQQO2Icy%B+ias~uiC-f#_4IRwERcJPMf@Vu%D3>#~vaHH_(MWjcY->{n??3{VOpy zbbjhc5ir9iTQ}IdrduFE5g>Eg`2rP}#Z&wO0f2AW`4>^eZBeMC*y=3$4Xsq1_lOJc zXFI6YM$Q&Ya&$D%*ZcRl^I!r0j z3CxCFA&|B6V~>~iMnew^G-et9cjj24E756UoE>8ZGHUJY%Y#}ReP{b?z5v)_J8sC* z9DK!T6i_@P_Z<32|Br(ON)sWIR&_BF%BH22c&#s@+vsV()Q;uHH3kMesnY!#MYe{C za=xu(4~b_U{J~iNa9fL_CnJtp{B2h2vBC z{mM>+ZLOo(a+2&;OJR@0l6t)c>^3^v2q}D|(=Y-+88N*Xnz1Xd0<7pjGH$=v`sQr6 zY1v*C_9Ztg8cHWV#-rF7a zw){(Vq>aUDPpUi_Byd>zTy|P)>4YoS>YNjh(neC^QExG|GB@wDSA5x^UuHR1s|fJG z1va`%$3GQnjqGa5w9J4Bl&n2j&+^s5SP=s^!#4oO6Qb|F?=*|f0r9RV^G0OB7iSgM z+*m@p9Nwv1>*shnHRwSLXAibrM7mGr`3{8b+xM*-PFm2w{wPw)bh+eHdn#C>Xkn*?-04h#!fvYEyo97}U9Pkc{a#=8{NXAIN zgs9Md5V6=iyWSOPYQFpM!84=qtU71MZ+Pp%utZFlmZ)ya=W4g=?wa=A(srG-qL={C zC>zw>Rd}%y`9g$eQO*GZWJUix&qtp{frI!8&?1foM`EAQ$xOP%T)COz+IgXRnMst( zyjP5h^SvXP;@rRCejhMCOdIClpoHKjV$4vJW}1tW=i0igb^mskoJYfCP=^-IYklu- z_ab=nuP8^*UUfTKS*hlg(l%ymT#TbJ=@y{Qte>+cs=yoEDHhC!5}tUszTViA)9i_X zrk!@$V*oPBaCFgZvb&ZuOHBK0%62+Q`py}E z*Rrq|YO@Bj>QG<9L{m&o)I~5#O$pc8b-g4$GaQ&NwZ1Yr)3yo#eORz5M=$Od8e?Jb z#i*%APrxtFIFLU*JM_Xv)PFc5-;@o9{p<0e!s+uh~g@}CkwH1AjODbJJ%0p zt2IG*U7G%;|$>Da@*K$;<3+D0K;zD@sQesv(v*KH? z^M#gINZ{4`*Y|^$w-=!fJ-5gTI6-hXk3cgbpZu%BLIPAFZrK? z{qOPqH&>Cl1^+mOt{T$@M(LH3&#kvXxrL_ zmj|tf=Ih+ETj`b$o+C?V*R>1bo&wZeT03)b%#*#Q-{~{5^saY#Tak=X&`P#&X|29> z@gk^N%v`{3M9InwhgGYZS*J-qT`)D@?m=siXmt;t-~+XTn+oT2%lV3T-r5zNd`}<# zNFo2TN0^#g{MbFRK|dL}N603!=xRB;t|>1Z{Jilam#<%LIG+M=w;%5F({Lp{c+_~~i*B3P{^kZfXsW*MI0S&2A+1LnmjAhZ%Uv{B;)(1> z`#}$tmT)ens3PF#_@l(IO9H5x8*Pr|*aNk9J-rUDf3t)4M9t@>&K9ZqUg6a*y5jX7 zYRi*?7SErU;z_4hB|NbyM3Gc8&idfeS}lz7O0{x(Vw>&IcTQHkFmV#e0$w99MJ;Tp zXrTsib(76tiv^CL+&&i^yjwrP49WafIsBf9ne9b5gv0Z)$7o|XEol@{Bu+u1tfu2` zmwMOB?xQoWpvxTU*~;<>{Wg15ES<28A`^}&bk8>HSRrRA$zHZhe%uM^nXeZGBlx9RDvnjKVFN=?CrH?= zSf?5Q#r-`P4O-t|ld#YM2|}l6qA&x%T;wtxr0hxHEvl>rMNYbg4_niG@(7?zIO>3O z?N~Ee{QJEhL-#*?#A&p}UW-ED&%LXDdN<40g~BUO&!>p6jS?Y|$2KytD}Gl&)v69&@4h} zgMku1>6iSK#z;+i1L|*{GNaES({;M5vnsmt%vLS+3b3^y_T6~ElWD4^4*i=VXUtN0 z)INZ?Th$*u>mgPiRxF3EMHu!kTmltRL6tAFioGOGCa_=e4>v&KH7mG0nl;p2CBhat zQ)4fI0^@IREnyN0Ub)$t#YiN6Gu5>pl=u=Y7{}la`b$27me2OtpC4hcJYr$G(@rTW zhqaoohsX3*kVNQNY@0cX4-gv}AMI!bw*| zTRBF{yI{H|IatsUirXO~$Gq$3Ug)|o=Fo8{34@F|^q7%WaIkJV_rP+Epg)sYlQ|Ju z`wX+(sA#-*kQ{9<@O9!4SHoX^?;8qZdMED0&imS-eKwd5-thd2~z+8Fpi?az^c{$IAD2 zTJQ-_08IolCa)JI?`am`6VczGXBa`G%Znnk3NJU(;nF(`&SPli-0qa^Vr zRd^a+zZ0X)M&0kcGtj=T6LV9OS%u~1@?oCmVI5>YplETLVdjZ6E7N)ohxg&!)fh~4 z`Q!M;7>Bv_*p=RR?oEgVg;StRx*cuNx^wn{;kG$|`DllT>7+!zR_{!}5uru8o%X%h#ye z4B>T_^3C?dA_BR*Jk~S!HF9=%oWw>;7+RsfE92x&J|q@r_!rILn9!jSeC7-{Lug%& z7!4_G)@<>`{Ghu+9dp5_qJ9Cv|!$ddHc&xt6j$hmK-C#8e3%V+8;%SI^ zXjFRkO%z=3Sh#E3Gf1FAe+vT!VZw*9a*p{?_^QkK`aTCf-2QMRo(wNklmXL7Q78s$ zE~oo3LW_lX@|`+iYI0wFnY2)h+gb=EnG9|5m5-UF?2W$d;+OU*@M@6nhk#?a-pzqG z6rQV`C#6kbAqDOHMllUq3RVC~#$lVekl5*`>|40tTD*8+Kn^yd=q*1>B01>AWJENF zCN;|!jU>j=<&TixwcgnCK_Z;p^ZT7xeZL$iRvbj<{5hL_a9Tv(?c2W>B9jd=#L7zfVd-?q_z>EO$ zxIVxqmw*CfdN}RX_76pwlB{I+UTU99JH_Hk(CO*fig)_^pLe_Zxw6v>$6Z*xjpD5D zTa+MSrAu-tfZM=*7#r;3RkdR3o(%9U>|vtm(k5)yELda-2aP%8@EV6rG7g_y_lbS# zoivf$)#7uai2e0!+nYlvoa^~ZA=N+`=Lak-El@7UQf8JvD|?b;SglaV0C(C zad&R^NZx$(*S8Am*{Lyp9*R0!_Bzw#h{wnWoguOC9bc!E6p>IpTQN~+_kmyeLbk)Z z5{qKlX<*7pe3#2}cF&8hA%IZFZoGb8?46nrC$!Zki1c;bXENI_rTk?COoym(azn;& zaqJ>!_F5@|O|fuBHoy;yF znaa?l2UWvtuaWVTX%scMcImFq2i`rur}70FV>XsqTl1rDsT|zLV3~YnIk&494PF&Gj8P5yGAfGeh*+v3J$JyK~%@Ayj93isD~H|F$pmZ(#ou-H{*uY;v*D z-?57aFAV$IgoIWSs!m;0pL^NtqU!~O1CWjZNpDP*r%fzMrif~O`JL(UuL;}*%Zyfe zUTEy&AAUdokr~f!KjS!8mlC+zkuc21a7r%w*?5uz8O17-IX7!8h01>9Jx9x4lXz8g z+LfBj+W63;o6S!YLzkN)sa8a4Oo6eiyN4b5YHy)#+}oRXUqdl+zvTP-vRARQo#1T& z@7}QcqLz5Ow9Bh9!Q!~hm8wWsRcq1*&&_077vT9RtAX~}Rsj*@)a7AG)o#xHTY^n( zFDv=;1(sr2OTk@65O!y{bL5~JH%p8;Jg|-EHc-Km8;ZK#$Vg`OatOUoiM*Z^*CnjJ zfq{xXjtkS~t%c$5M1Nxr*DF!ZXVQr;eyrI^+U+GI<_d)Koi^yI78euehZxeCRZ9j zyRks*6L#8})ZZB7D{6w}D6(?vVsUo?Zds%Zmnb5!EYRRiCpCcOj`KJiCk}I2C0OMc zyxFlR-A+`X2H~4HHTmn&g6bquw{~Ur7D;VLRIGbpNYWk~v-KHm^kYuWp*hb(X*dWN z1ZD4%|A`Dt$V0alQt15)7^B$KLISgZx81CD-8N6%UMtS_?{_p6-zazkIZgfvbos>H zofv!`6|-%Cdv=dscX>DA!zOyV-blSbgR%Dr&s6lsTd0%t;olHi&PfkJSMTrInPeiU zjxKVa@E8(0nJ~*rG65)Cj`AAnCybFtKF`My24)OYvc@di%h4teBoEX8CAtJSGEo?k zFcg7lwsD?Dh4}$RF#{^5QD!qRM|!k52qZe*I`ZX1Dl{SqHvU)qRR73v@wM=dbCw~^E{^0O6NmJ(YzkM zOd_%Q!@RgD2G94XRR+E{`t?v`UJ(5qHBM>Bn9lYdm$Z;7+H;K(o{+c-H6UYR4~<+Fy9D`8JR1-a>{bIk$x1+i%A?3rHc4h$+)t zm66+GLjCO9%fDD|Hs->pg;~O5aq%CHTJ`MT6HT?mT3K0{0KQ+ZJ^>_HCa}+-JJN(^ zq1?Xn5w-lkS*b;MQA3&-178~4vBG@3bVnn7A#c#3vLQVEqQDDA z`^_jG7V<^rMcm7NeUqLJ zClF2D!Zy+nQgt38rhj+K&mWb&QgTQ5n|om@WfQncI&@TMemWR|^BA;a3c&Nrw${_b zDuE1%I-qwcnx|qofiwge_DjJ(-=5G9R1kavsx-)P5{K{dkeJ^i( z4PWF^&tvQRlr=`padcD@Pj4_-Z$>eqgFLueeq#y-b4%zC6svRR`Y6&l1cscajk`Vz z-c;%>s`#lEq&rpMVu4?kEcy%LV7x0OZvgfX{Q}gmB>LhI9CCw0yz`i};c=*b7H7G< zmk3ccar|I}Cdz~oLq+()LtBr8K<%ay zXpd+>3$?calf}7X!Z=1dAJlWq?1X?lY+w59PwqgBMMpkDmt}psPrI?3%4&|LN%QOZ z%@O7IpKL!StjAy{dtU=5o<-`Ga5g6EyL}~nN13M|a1LqIrhre^1u1tI?;L~V^|?|s zf6~%?86AID8r4%j(P(VCa~s-7c+Kmqe1#6|U=^$_dt|Ok&P6JUGVXxge12lNUm9z6 z;=m#)4=?>`O*X_C)t9}dkkixX4|eN<#fu2)YaQoF8+OaA{Iv(Hj9_EuQqN~)U3{S2IIC%@BP-E(Zexx;XkxCxy;~&*$y;fscF#7rgP|h^ zY$^PRF^wFARKwqKMhm*%6rh`$&e&|$ga{ZLy%<0h;5Cod+8ak05nf)@{Dc_4ndP9$ z0(A=2CS}=ku;#XH&4_ghY~KG(@P2UrIs9?+bE|?QFzb8cENs*-EYjQhfbhm$y_4MebHH=S`dZkmCOxwc z0ju=~iJz-sQm%lENW(=N*)`p~8R`4V%-8W{J&X4+LqO2blX)}pAT3!k{tL-HTU3k+ zi9&AH6Ni?wfV5Cl zn!ySeR&$d-M;qGfW+&+j)1!XJsl^oQpsJ8FaxbCP=t5CsmIBC8igm-!iNHN*`?_<~ zN`|i~456QGg;&vHQ%-QzL>J8rp|5SpgAc9n$cTHXFbi<>s{RccsE?m`99t%U4(K;> z?%uay)K=$00GLs5z-u-2T(elOMdeWOX+U&Qj+_zApOrxWP_D$_Q*|BUcJX2TQ{9bR z4i4oUw#&2cJ!#9&*B#V8@K2!`HojHV*HH&&YhQku%-`(%&a2c8=Wmg{m?sY6Poqvj z)i2wB;YZv@U&>`sRwk zSuUbLwazuU3a9>!U%v2md>x)E6&!4liqkz~fox^_*}1dnJu2qZh1||t3BvC6 z7h@lOk2&*aR&fj3(pb0-3zN>h(QXr-eawq@pB%HG|-#w7UM}y+5xsj;y<UJ%`DAgHAG68=_3auw_ zKMd;PmH><(NHA|&bb0Uy2!b;#+@PIUZmto-8VhD#+FLea}+zHwSakr$I$H{!U)ye0z_R}oufMHK`4VUU-Q={ezZ$km& z8+M_0Oiv_PlADv$2c7&>gvt|^EBq0+OH7uf{nW0G73=qP^4y)6!1B1h_gQ5K#-VFe z(?>e#pxZ#D0qT&~@&-g;A%h~Muew=(n|~U&NLnfz)T80q6RdJWBnjbEMt-88x#P~1 z-3*2-huaM&b7io;7)_*_)-M%{D5Hp*VvaZ`#fngByz>;L?XvuBjHcF#xy{wP@fi0K!-1mu$eo^YLggol z&^gfKId7&f{&}$GBcXRMQDxZ)=ix-ZiEBi6k(=GF()8b^;s0_Czc4 zSdC9!Tql|_xI)Di`!3B+7sbsM;%g=OTTQ>n^a?gA9F;9pg{l=Lp?jkFG``05(9#34 zmwbxg=y$-b7QTQ@A8*v#yh3QS7=qg-7T*Tv%$R#AFPf*HQJ2^F`ItkaMvtfBP*e!3 z#{e5Ljq?%~qE%v56UrVBSb!AVJTUFjWt=(z(AYH$9mxy*=-!ONeayf&iJ=)j zOroiz>LJsS&*Od%=pLx#2aEFHjO8l#@jGvQc>FHZ5jsvS|uV(973H+mPH2?rDG^`>B|!u1N})vFkB zyrWKuu@|4sTV#c*NECwyKvnou!&&PN`lX#NjP+>{2*K#V1dX?*nyTUSW}Tq7nd%61X1p7>r|Q#`^Oah9JqiY{Vl4gbtq>$C z`D%;QuR+prZkU=0pMu8-P1i8$G;fpMfRC6_$$Gr^EPD;r=S#O9v7Z_u zQ3Y444+;c4r-4PM83>M%;{ZQK%Bf=sO1%(;{GUS#3sImvLM9sOMA;w_ochvV!E1Fy zdH+x37e_(g!mMTpCMg~#rkgiOU_aq=w|yse%WoYOKSj8gopynIma*F*XU*T!xmzz#&253f|yQk zZ2EWow394MQN#p&`WxX1Qll(x$%tW>HoHloJgV!~K=Ch}v@_3HD_s^;_yP{vWY!1J zkvUd`mf2T_`UnDKoAc8aKv+>ZjmcYk%Ay;J|NY<6%6XzR(ZA16P-7n&8gkK2BE9*r zh4N3q{kP`)PkV!a$ph8zZsX?j>VV*H+3u$e##t4MPSB6YOBDAK*$w;eTSESm zgamDIi>lD6R-JRfc(#0cM(?2a-)GK5gv!Uq$K!Q=B&QB^o&Fw$I<<~DSD+Gyq`ktR z5OggD=VOoX_33g(KoMAsSlg_SkA)kxl^~)CL0J4^ch{aygQ>v+vs|1N%9A9{n?&>_ ze5Oxv!)Lj`=mS*S%%41rRsXjq1%iI}0vyapENQ$?)8LQf@hvV8a8r=}O2>Vo9{K+F zHkepZ2NHOzW@fZBE6k%V{+v989{Lr9dD?ZALT4+Hm7_8O>R`Yo&8`kKc;cSRafw97(hnE~#E{P#vsx5X`T2%jp*%o+)a45P zJ3R=lE(V?cr@31o8N)%ea`o@e&>Hqr&F%`9=WBZJC+Vv$UN`M;5K`rORFPND(CvHHCt=$N7~c`cCG#AB5uE2s z-i-TciT|?i_V%JRit<+UnlkGnk6gCP&Aj^3+INBCj#^m@NW_^j!GZZXh*6uQzZfS2 zvU<8Pr?Fev#)ykG-#n9OB46#JW)nz`ef6%pE~q$l-z>nHRVE~FH)HI^eklBNV}XGL z$%ALRD`F98Kbo68LOOs~^yFbjww?gT73;e*-tK&M0XnAgC5n{qem_TLM&ebEw*wR- zZxJdn$DSV`qhbwu=P1u16Z<`^NYE8yVTOT_Va2a zI)U|w03harTN~fc{p(#oIL92aB;R;oyuqvI7lfP$aW ze2+zO8Dvwf7^PRD#9Rh@fs6ItlRs9(BGJtZk*9~L1r+4FWiFBinz7BwNQ3X`02$nm zne;4ykSjpzB8-|>J2~&gQfX>+o$9(P?}x(KYCc3Z-%q3b7rSjEpRBsyqKHsqWwfr4 z_Hu8mZ&QK<_gteLX%G;10==v;vga_MzvLf0&TBYa6_5)c;iJvRcJA_KrtHh7wgIZY z>cyyHVS}hb&{HRb@fhm~r8Q-Fl895er$)wdwDaT}(7ucVt8)AzH*n+sW}-oa;6c-5 zy$~G(|FBG_tiCrMFGMK0EDCTAP`C0|>1d>$kUl2IXgriQJ`PXv*Inle>$s$%uPz)bt9rt;=0${fT5Q6vlj$#m zP{(p$?RfiGjBx#0v3~?rEy(Ipyng0PP=0f;Ba4V zh~QwoNRj1rq7;J+*CmYfoBUq$e?5pO7gS|B;JKh@#;l*EZ3A;v)qChv=lbF})>~<(7EzjN-6!(z%Zf%R*+1&a`1E9(EV&qz zdenm`?g2nh7Hl)-;(EmSKmQ7d+0JRAyquT+fTtxm=T)W&wJ!c+F7|dh4<~hq)5c~k zqiin_Gc;v=c0S}LKJJaCP14W3`0WJn!3Lh5|F@k9&=qOQxBIhn_@ri2-zuwq=n?-j zM?@_MiZ*z=_{_Cq$sp?y`8SB?A3lZL(}OgHlaB6(02UeNwoIAoY_IY9h&?;zw~%8M zv-UF^uR`?*oE9c&%F&%4B3?>eGiUQ|`hJO;pS69}7N}!i3)=N(HFWOD`2h43F5Fjz zKsIDuhi=4Ox)&M&LS{fJdfVyWz9g0wKX>R~Rwx)1>Wfj38Vt~QJD0llDCxN|`P`t^ zX#-7_Gqiyq9(eNOfu%ug9M@2+fPrwn?;+!Q>)Q)rcD7Hpc{DevDS#?4`N-t#NE!ci zw>Sxpbc9pim3JTB5SNl-;HMpU|6?A)X$ytdKdP!EpkW567&sbOSF{eE&Vmww7=J%@ z<2~0Ph{e$tbu%?X74Kmv>uBwuplMlqcRyMKj7MojMa44!?rdXhL4s%3fqy4`(otEW zkL^F!kuJ|d4d#vA}dP-JQjgnk489fYL%f!L9ylSul_Jwdb6O~ z<=1YXujcRwV4)Wb+EUlgj;A z*&A(*s`wjOdai)IVPmj>0KkC}o1yyDVBwK}j&l@97+zUdZpNtYc$^17J$TRCM=6E| zGS}MyBKU{C?EV&Pdsydg%RLCFsPwbf#)sWqtEfc^P zG!u}lPIDj;v1&;Ry4sZM95(os82iU!FVx#R5LT_Vg@0P=v4h=tW>Q1p&&Vi9iwU-T)f+04&K))goFbPW#%h ziOoO&Bk644iUpU=KO!jb&>`XXDK5y$hz{ccAnsz#l#ZUw* z3VqY{X{h%sJ4tWj42xQFe6&FSQ>Q1CxnnZm8Gu*1GjQ8{BFYvD&F(6Y^!wfyF8a^j z*dTocI}`+BKWF`ac4$-!bqGThKq&hhFnP|D(0QsQZUEpiF5tzKH%~E_q&am;sn@)q zU(a?_9NHFPpDMIz&H))YeQ*M#5Q1~}3~CC!^)f=-A!PiA?iZMPf@EIClj|^>!4x!1 zf50M+TnMtWHl{=4HrM0kbD1wqSMd$?+5U@ZWKyL}Z(XV-9#GQ9zj+P$+B$+7>r1QO zS$;mc(U~s@aTWD*b^kc?_qJC^F+I(d^?ndj4tTUlt67;j7qwioryU#l`QGnnsq!jq zMg?{5{QIW4U>_p4-$Kt0BBVkpJRh*xC;RiRp_lrty~SM}TJG`^g$PatTu?jMzRe^ zU^g<*luSA<-L_Qw`|Vx`N5yT$nfcFtf5v&$x$|2;!r3Z}v!|tGAg{{g+UTevA<~`H zn=tNDutS=6+T5vQwHN@IDfR;A?7%}Z?!iw1cU zaQ&2FTKxPm>6225$%hUAjpIY{)-Rs@)y6TISOPP&R?8>~f@=ri?`5`eJtgj4cTgKW z?p{sFqJ&qnCr}Y4h`|;~ukBc|7W=V45#yDx0CMfC0`F5+jrNb))I*CtrkG2;@Rz#=L@T4@+Hsd{oPhJw6Z9o3uN4r7 zBT0qd-Sr!xv+5%8v$s(oTG!lFd6;r()mmxlQNYl5EB#=FL@Xg&K zz&RUWRakUV_N(zp6)H@q^r2gGIR|84=#-o}6{!XSCZ!M_v{lnm7@1Vi@<9}nSM8F+ zNn9-(%RmtWzYv2gLjzV*NI!(h;_*&4UyZA$V?nCDZ3;xrJv+4 z*&>Yec}zf8g>$0u*HMHuDYNkX&dK}IOE9}Kn={A7bBXg~X@9KE-v^#^{^;2|eE?S& z&&9>;kUlh~#~>tk8~~i9N_|l}^7@YlExU~n0d{A-=-UmuUmOp5 z{|Hid^S!>Dvpg3eK0M^G>Z88fB)faP`RU>6&NZpzxFT(ak?P&R-WmAkdD|pt%_dOY z(w$Ozn|Rpb$5oK6PL_K@&ys@~7RmJ|?=TYYW<$F@wkTx3=B=k~qjP1>p?$v%4zCq@oK=M|*t8CvzTi_@B07yRvm zvR_%O4>xVoXsu97hiR zlXOn=ZrDd$8_>7f3Ri%<@l%)BeXL`OU3=$kk-Di*(xrX-^kaL2MhC9kHZefP(=}^{ zxuR58s5aKkwbHsh4>R~tf=*HTsHgW2{b8-s^=C<@9 zF8lUmd48_Ts3U3aPp>8(_~j$N0o}r?17}86l{n9GZslqfJ;fYL)|WhDmeTNJ3MxQ^ zDz9jSC7g{a4i1e0{_`O-4hq=_fPfy$DTE0}xXo8K+eF7|Aw$dQB<~XOBV*Nbub*r5 z*2TW`9LO{Q^-+OaQ^e1+e^d}9#?zcjvaB%X(oI)|3C^X%EUtRcl>$D(M@QE}oVf~I zMObDSFlcSXhdfajhq2MJf%7Q0N4B4IKiynWJP5MF?jbf1dB0$BUSb_C$KP3@88w#gvmY$!Q1ZO-QG9n|F_l0#{RnNN+T$w~uv z9{zsiyHBaH>V71del?O*6&xn+*poRL$hw_TiD6gG?KSs>IDAVf9SX$k$c!xr)fnv@ zXv0iZUqfyBch5LFg%}LSOHX)8t@RF-EUQcPmk*sRR1V{Mm@l=aE=3#(40D}-;6q-= z&?45fwG*z6EnU_JLJkIWM^3i4rK<)s3oKtKjSm8*;yv|jP6HCiYJQsGYURe=6kR!0 zQAs*8;x&NwZq}nqkeKkNh+gFkF9ytICMuSV@~dBWPZlD3s3hPqO7u-QvQDBm(a2nU zVaqtSb*mSzGxW^oC{TlJtGN7tMCk4ySdf`>rn!Q~>`|K^In1P?eGB1~Tn=$ad%Wvn z77^t%VJCj;Y2@XJoEjpR`o{KBvyg(GT>=#!V~I%hX1}`BDzg;+WtZye&iUBL;?<#c z?sGJSdciJXMXNu42O+=XT>r^mOrr$Y;HC1qh4N!47R@Q)J<^&GB!T+rf&@=tuWv{+l3;BP|N_!51x z@pged1~QU9&PdNRyKgxRS0x<2Zl52wM&6it+cubr#CZrA_;K1p ziGBU-;`S5puK*u>mmF+-Lt5Oo`8^CZKXhgEH4sDigH`aPs9$Op%sXwoavuzLkoLl` zFJ8}}EoXHN=59?QQ5UdVUDNMu_6gYac!~e$0V<)=WBH@am(06019Bt<%pK4U;&Cez zXOF^GR)E%kRUTyEsrPN}0_~UFfDgG8%D^`;o55Ik(Oeq-u9|;1(H~bW{C%V?yg;Jp zs2tB>>e;*oufb1GIEHRkrl|&uJL|Lwu#2NiO7nUI=Y|M1VO)!$pPT2(ZIg=YBiJRg zKEIOeM7RZP&Q8xAf)6deCDwY%PGy{}*!t4Il{A4H9%^v1$I7Bna2?6*g`h3iZGZgG z62-APTQM0}N@(CFag#zDQRZ#b8H`-k*VxrIP zwyC#lz~YnXkLGu^aC5W{)te4T7`L;E9-F&UAWzg`Y8s28Q9q@}`rC>??-+!ccV8dFxy1Kw!yuk1vcBEWXO4JnENU7wp1VdU9Y&2f ze&wt)lovWUL<+4jF!ha=CJ(+f$xRdXi&mGJef-RZ&zG^hn`MzvwpCDfVO0ly{_(Ih zR(oDP$@q@l+&2LcZmt5do$S{~we(jn?1Ska$9Wlrys?h2+VFb{A(Kvj`T~pW@_U6f zr#>%%-6hQVA0lk39zh$aOrSJFd{{>dOIbm4zAUD^ryfe4jq}j~0eL)Ux zGSZJY?v0gk9g0~*K79Dm2~v^ZJ=FN1wSQ?L0QN+wRTJZZF%#{N#CsPywn&Z@s+=hS zKAZ&6yNfsC?3DP%7Aan0`OFmG<|krIK=|fr38ML_nY9_x^TmOu_5BTzQYFs}C#LW1 zZd)iUk4t1hB_o7T)fkAokM@Wc+{>9@0B3k0%Nb}WPTHq!b!&IN&S209QkRh&j@&s1 z_;xtjZKS+>*YQnGM^4G&R|Aq_H|UBgkomX63Aw;G8!b}EMO|I{H0&pK|H*aPZUP(!|>FhWw@*ai98J7&A zX<1yW$AulSexzsE$*b7Tv<2=U!A0Zf9nouJV|6NneiCY>N9YyjlD{wlAw`Ed7TPIZ zk`A`n{*b<`km>trUNnoF#C(wQVm!089{y0o7JFj1-`Ey+;LDQ@rd0X}`i}Sc!@fc| zW=~&-&Y}{KYvz!4xV1i|dNx>&o`(5u#dO}li;4_@E0h<+GZ5v*t1fOp>}w{U2f`Sv zB4RURZ>*fTQ_*Ake2vAm9LaZB14n)JMnsu^@vO}$$dkMRcECHIj!=}U6Ry7RwC+H; zEIXjtzsec{9Z9rrHT$5SSlzK85*=m8+X7w9!AS9J6K@XGcnL>IC(Q7&`+LR8fRTdM#)fF?tCTr6F#(ixUWsN4T6o^tX|z& z5`gyshan&2AIp2Z&nlXZAz$n+!Cb!@SOH!>^_lj5$4^MVRram*aSa6tZRy2oRtpIB z=vIwEwT)AarLEm(>f_iW1l-i%RAoGo=-tb^>&<@g8_M zzg`o@eLLsj@XqnM&U>+OI60#WS;Xb#R9AF_XnN3eOqOCW9hd*N7!eB>KdR~X=F)@| zhBo)+tAhIvhB&d@-B!L;5)=RM?`Ue&%@78Wleqeurvm$;haQoF22ySZ^#(Aix|zYU z5Fts-2Lk36mDYN#G|CI8&}I(`vq0U2*Q%aD|7+>3TTUs#bp-)X=s1^*69p`+BstiM zR_(N|1kZgx%joUm1jTQ^yIQ&F`(i+r%b*X&u9!*pU$ z*5T^~NmHu(;tO#zDQ%(S-cDlhe5_B2x38GY*EkAJLh(J`J|y%lFSM6o zr2(_qM@dK<;=0kT(^e+@dUa_SlsFP`His9J6P1t1*r_B0ZbVzeT1<@ME{;$d~5tRTz7!`L8HpB$XLfzo_P3c0^~h85`7m18Ke<$d1>{X}SR+ zaSIOPm>;)9=kN8t*E;Lm{ob*H&VoE~uT0!42AQCPH<4b^c6?ejR9k*8)|83f?pzUh zEa&ryJcU+vCj+y9M*|UoNzhiKo(2xv9~zC<`Q-wp%S`6z?x;nqf;R0dYV#&usViR`iw5p+8zM$G0_vGyY5%W3M^pXWFrrdub&8vWwM}IGZ zz#10*QSl|r7+tm5uZw9?StWrm&er8nZ8e;(pBTyzHW2+e&kLp7x8Fzl#EcDxY`*D2 zzt%$U_MLqpmIs-0M6}IbtzJ(-LEY7BmDeF*G@fmuxTfa8@Kc+WfHc#O^~Sn*`-ptr zkWS7t?`Cju=*VUcw3vCoygr@$M`^|T6v>i+tx9@9>}CdTl-_({WtJ>sOB&otHjyWJ zvYO_nO=c6t^fF)r-e`|ayJ5aH+16IBhe#8P)se%PSBNk!zwTBpzk7B=JEVwGLIoG? z-2>Jzx$;$xC2^P=j(uEYzR2FHs^w#nEy0^?>mTDJbYpUlQzOU2LT%wMJM85=)P7Mv z+j6p!+(jTKIppPLwcGsUf7@vBaOCB(cNLe2w?-Q~)hi2B=7kAB$F1s2_a!)XVkTq_;GndLo>bf~yQ9=c#G^Tyq{#Hn07(vXF<_<0Fq zi;h7Xd$sDgK)oX;t0Q#ktY$xTAE1(AoNAv&>E4NN*pE~bPQ@2 ziMD{|;0W~3Ahi3+|_}KH3y;hWO?9 zU*--;q5qaWT`X%{bwV#1P>cVX)OmI~>POu6Xzo3$x%9h5ENl zynFc;d0g$?O0c#S@y#CTfP%<*|KjOcB2_CBF~iz~gA6&PUbasCP@BKe>d%IM#&i-eEX+beJF6} zWI=Pgypq!jPkTYl-2>3cvIOv(3=^tRsuEN0t(-vP8%Adm$k3IIgY4k|EpMC5mQ(3m z9*X$z4g zgKI@*#a6$#_WAqw0Cf_yfE9$UbSPF<5lbuTcHluf&7eNAy4?#f9^AIjGPMaQADUwK zSW;1()Y;3^EpfKTc~$c%MU0M4S1|0+=2RkP9&1BTS69JubD|&jyz%mKn=ER4M#u-E za1C_)8gOsmbOy8mqF+X`0f@Dn037CyGE%)`PNi?A0O9OH5GLMgc*Ru$Fk@{rj2k(g z3Ht;HLFHRVgOWOkVz{1Mj#c(q*UwhB1!{qwM#;tbR;dPV*XCi{iusg5lUY+U&yL%~ zD*3IRoiB?G+}xQ^m|akK_0C!x7CK*P9;>+uHr?SKpiD+u40z$t7Vt{sJLSy1oeU1^ zzN15BHWcC}&jo5^5TG`ieJdM~Z{+xsr8LI^s)i@Zcfd0Wii?ZiCjfxChEn_l=)(u4 zGxZi$fhaKIgpl!j>PN`Nu17yWGVy7NS-xcmR1=n*%Wc^GHO>Xuxc|_}5iTC{pq*9W zOB+BAVE|-BC%J|klKjfD=_(CO-JcLp^Hsvv+4|k(_*UHX0!MQV0r~6?a70COdJnn} zojl1w0B3bE=;z%VxH-$W1)BDm@pu8*0I%@~ab!%D-$>5N)_k=IrP3@);mGs+oW8pfh`18_XR0&Ppy5EPq-^UcC~QDF4t8hhREA*{ z%VNJW$G`M~f7*%(#oWcJs3yr^2|*yek#A??v%4`}dT|~U!s)*oyXBoM}y59|5!UrElJFI_8LYB-ERqnEiKU39)yqOs<&6$)+T z-(_|uM8!|6mJIZ$vC=jCPAXsFm0J*NJf0VGsd{@U91AqEJ_#{j>Q>N516-g%uYP+z zacrv6+xGWN8ZsNH3>R_oxk=1&6@-!jQ&`U$VE`5E05Yadv1VSEA&MCR*|#&_xTvGY zZf61FAaTI;GK?oDhE94`9xhWlb}1QIJ4r1 z$8t{;IS>S-q%-|z(_-UGLp!c4v_QD%C9}@!3U+Be1vob_ao_DifS30{26<xDLhMh^d&Y8u(32YnJ>6W*`W(z1fx-MNL}b(gY88Fj*mvjQiD}dYl77=?>TgI{ zO_d?QX6}jRH}>sMN;~Ow?!$cS@lH<%%oo%)Z1O46MPK~I#aGnr4o^OZH9AQ6w}@fh8<$?_MS9L^ zgFG5x?(uPTHzA|$kLzdy3kXe>?^Qm6z(@P^{?{M?0y%~Wnqy{;%-_3KDGE|YrBpq0 zJ5+8W%>_2F(_t1tS1mA^Zz|Ls$+#niW`Y9kFmo>E@5}SIQ?QPYr!Q}tf3047D#9qD zP`u>etCV_+q%WC)qZ*Gfad8(Zo#ncjdod;2V1uE*GTLuTlkKYK6KyR*`MkUT_U}?^ zDwglfCKJ@~fZeWUUg?cz2>@00YHq>w2aqC{6A6Mv2Ic|M4z0D&g6GIkaUJ}*qQvSQ zem+v^fGg^>Lz{c!9G@P3ePi@@6@1gveL@!D?ulYC@yI&#$#iW>veJcu<<_ zfC75PYGyOp45K<4(rAd#9G&)RzAobkvzxBAw_pDq#$&6Nx;5DN_){2qPf-2j!b!fP z!x$ziHaj{Fz&~PW3jIxd2!MASV*q`>LkRQ76u=7Nkc&E)Z+>=Jo>Agc&OR#EEpPSY z`5>;RT6FPm_Z*T!1D+1V6xfImX`z|h+|`c$W*%VJuexO9i6Oo0r6Q!V@vn@NH&%?0zb{bEF@M_ zSRv^$@Ln;tX1g+ygsvJc=n56==(UNk80qD?Wpl>UAZy!Jy+VY=^#>o{G8&etyeZO| zbYtO=W3{)GNzsFd%Jt5e*o82&hap%Qq6-T6`Xvp-+--$kN*2;=6oIVV%ofO1nO48% zvMs&Vn9()Y*uV$WL|hSH1D12WD~7t+4Ka@x7pT7}i)4T@F0Y{nlB{@R%rbf}B{h3aQ}e9Zh7GERt& zhF}0@+!E332h0enK($R0FNnFX!#KFIPsgetOW-EroR*vxe!Bb6b{H}#a5D?<06%Ba&HU(mmKwrI#3rVcSf{=EjN`OuxzJ}E4=*CUYpJ4{N6Tu$#NI$tdm(ldpm1ZGI!|2 zTEC+R>84(aW6Ke#xskj^KQ`DWb6XGvY-hZH0QO138Ed9Xn@sChqf9U*r3JC85>igF&2vE z9mGHG``V#&`6l%gG%twI4+>n$+e%95_ZWVQ6aBXP%Vp+?rY1X7$CBO{nTag;!byXU z55DD*oVxls?l?5GS2QH~^ygJg)eE&X3*Tq}#TE7#v!EhrfH8f70P2Vfqnb}QCC3y= z7#MhJ=J$zEYGI3cv9^jCK9rmB+`u9ZHzi;QOSN?btygT;kL>IMxYw)x!!#(clHRhZ z6)E}S$jp5WHNT!#3DSKbFD0vPhlIMJfPp&JL`P?mla+?dss+lkcaj*WE>OADg!e+D z#SOzxv^f9BeBCq1F~5oAaB-KP5Q2_c{9YB!d#j?)z&i+dYY)f0?Zy3~(hE$Je5csN zcY8mDak2NKxQ=8)o*Q4!L{$LRSf7xNw+Er$x%@QHVUQxcQ4w}Go4|r0btyMiDs~>| z>Go3`f1HK7FFgm!DDCWqKU^K9d%4P_ZPk}um!Cx8ia9iX7LM1GF^T{M^vuC}Q6?0| zuJfxKOV29T$HIxFNFM#A7RKu%!I|nful(e!AX88z22Q|26`nrFh&*}vCjMCyOdQw? z=PP>b{LvgPWi=64qcmj}@7zu=T+2<2kXZ(FW#%Y*wX_~GuzZC&HuAE|U|D;e9Z59-8yH z+aBp#??G_-z4Bd#KfdbL@NER3J=F#I%pLhf> zXPz13Ra%RkV(Uh2)a=xNbNd&nyveMoq^lz|QsmHk*LGW>gvWsm#;Z7T@tpwT2fhkh zdB{#nrS0vlzGisE1J?MU5>%-%sKa4+u||Ntger*?-|zkQz5r9+llMxstPOAE+^l&< zYQFfbn$Nlx2q0)(1pBo{{|QVHd@j*f$=TD=|be~Osw3n{#)>9X^5yX9iV&^L1PmQ(+G*P^Luqb+P) ztlnE~{!-(NnbYw4YvD1)rs5H!xi=As$Z;K}EB=SN>;`O`Z$Jhvd|p_>g%lZ|*kJte zIa=(ajv)9%loG97c=?5OxUJMIPQ3U<^hHBo`1w!VZlnFiC+jS8<7SLMPde0OF6!?r z=N`*3Ecjaak_EqM{xR((1b&pj&Xx$bvw5aBv_MeyFc!MQFm$%=B0LFhNTPavW1FC} znCp)L4C*mgUjORbh*$bg4JQxFa&;Y`F$#8cjA}dLtFSLb_rSX+e(Hx0b{|^>F&vd$TsjBbt40fQ)E_Vs2>p(CP{|qdo4Z@w$e270S+NcZ{2qye#AA%T=um_h z{Eprr3Apx-tmgh7q*q3;={+Sn!#)GT<({e1S4Pd@25}`W33xO++VS#Ms|g%wt7Nt| zKLv60uQ2oP@IAV<6g1=ewz~CGnAfT;1+^>-u(&pN27_2w7OAlQ++gac$c?Ur`YziI zRO&TrUJ@@pdi=mU_mDy$mb0j%x_A_*Ar;^xY5@IOEr`p3|G0>~Z!zR+!-MeBfD%C+ zm6T8=q1$7$=7_+n8HVY!q_#b8hKl0M6yNAa@OG?bUA6g)Rh(JxSmOMjQAJvg=ru&@ znaf%f5dS#lyFQRHCS_bzOES^j`Z@CBmqC8*7Y8pj`00$cn|2bYVee1PNJ5~9Rl{31 zELnZc4z&S>4QJrD?;To2uS@M-GgLX;Yhf2FF;=u{>H#zzJa$rz)jxo+nw6(Vp#_#0 z8;DM|?$otl)^iFvD|}7rVHD&xU881YAaod;Q_F~-I?P}4omfti-x>~wm-+6166ZGA z`MLMGE)2x*pPXPoqpzf7G)aTnSAH3}zrr2LdLw`bHlPfrosE<#KEPQDNT6PuBOz-w zbliP>LEe1>sY+I*+j&y1h#qJ$eJ)<(7WDM6MY?OHlb3GW*}1w{bA)K?NoyecmzW@J zosSQ_?k^qGKYwg}Yd)x0fl;D2iE|N~>8?Q9D%R2P60$yf!cX>U&igl2Z8yesF=|U7 z)R;HMI?VNgNMT?`>+GQ9pRS&bL9&0JkR*^&`DIl80@Z}*(r=SKOcUM@?KpvO=d2eB zQ0umQTTeN5+;7&j1sFS8hzt?}*r;Q;^S6?WiUJD(?MPOqwC;K5QAN*EGz`;=HW;4K zm)>3=UKY=?fG2W@uBpLM_YWT(&nO-C9j2TsAl5Wp#&q0}mEG*QY#wOy!m$QMxY{!Z z(h+V}oeqb3U!N5&pk#rows9OmrT)K|PjYN0fH(u2%my>(e?0ps_ixpNT{_<054H)m zwh8VZ3HeqGfDhHi6)?xo`t3%xEu(i?e0+LO>HOuj_2U`?ooUTEP?AFB>WMxGX4nbG zUKYk`sP?YEc&N5G$$KbZcx?!kAhw)7o^~(R98mu(>}y3hY$_v(_o{!iA>7C3OF&;1 z)Q;VNib(kvlfbmYH&z9=H0D3&+Hn>}?nh!oA%D)0snK(vg=<(dQQy?y(xzy?D-T5+h*HN_%(yr1vWh zlWWCRL0?U{5|7}AC@rri>pk?E_0o=z`v>yM{odJID6_Xg2>l3`gx9gJAj`$AEN4X! zcOptWRs37qMV%YpqzSvh^b3?J6gdhJQ*D{?_jYv-d59OEKm}gw#@7FD1$R{%LsVgl z!tCBb%XC+8p^midjF~!|dq0g{e`rf~ZkKF7-T$#SQtaoFe8&3)A@-4e8N}srG)>CV z8FJHO=T&mFYWIV3S43IHf;SxE^oW3i3aJTvGZWEc5WD6KR60yCH3e%~`(R6Em3}J~ z)6>%fAZ1w*Q?#lqG+eOM8N7tP`jQ)JYEbh78@xGOu(V&r6YWR}jfp{qwtDX`8~xmOr(v{_S#q{w&!J zSds9ldi{TJtoN|L|M^Sq@xB_&fg^!`=L`SOul%x>w~vD*bhY$K5ePE_Y=EFnF_2cg zpgRQ&0a)Q?(^E;Fol0w)cz9Th&DU=%2B!C*#PW=mBw5+xg(|-)_3p-fIUj3!AISYh zT(2S?+|S76q06c*{#r6%47f_5uPQG3A7Du&nv^u!%Og`r&nkH*CGG@S%= z;_%*Jg%mTWf+7G=?Q0bW$^@MO7WZj;8vu)508~N_qlict#jPvx-*|`u9-{)D#`iv8 zRtiG_JZ2D8q%`yw8~1DcuNVf8IPOonVPhtw;|jFNq(Et=Gw2p{&0|UxKU9f2%y#A5 zMZN5az+pdpF43e$8)4q(2(NSkHSp;?IDmS&B>68rM*w#eluI&qu203e-VDLCtAf8( zXw5wyKAZ!Ida#+vgVK*dYfGGdjlraCXR1;j+6i?3A%MX^{Bh*^7a&1u%_y^;47G#> z2+V_AS5-6I7>%O>08h0uC~PjsGeh-*7C$+_*U$48ANDU|Si{LL9OR3)Y~T*6n5Dvj z+qeKRfMQUDfEq`*4i8PL$d7_zhrYw&gCkAlTSQb`cWuCF9R6T24~{f=?&X>i0kQCC z;PmbVWspu_3X7~FCF(uZFuV1yxaa)_41vZNrOt*@ABSuu0}R@O#7xKO8CAJh&q4Id zgGQ3Kr)7m@o0b7N*_NU$qi{sx+&e|JZ{X^N&wr+0{=N{IZ-PlaogZ3;OA6X$a|p-| zwsvvJlU`|8&U4qpcS-fFGn+v1P~Ay(`0={xg|M1q=`%?i>GRM;omu{e+5N2R*43l`kqsu_u4 zHz3&j>J~^CIRAKm*=y!gm~r{T$w3D5{)`ez@gA?)3vYM|bpP+lp}!ih+ea;bU{W$^ z-8iHzDUjqG*il~PIx6ajTUr8)2qrxSmY^Tk$RXMK-H-0l%I*l$9A{CJH#uJoQ3ZN( zgRZg{@PR&LLBsqnv=XZe+PSVPOuFM=?V*ULdZ0iZW$LDf&lJmD%BF*D=F-*ECuiS| zoPs$igB)>*^ybXxJVbWj)>db6iB36-ss575^o&V!Hzb8?>?t1*IOwc3MGU=u%QXm+ zQG2-Pxe)Nh9$HhhF>tSF&+a%{*Wh#go-e$uchMt#-GyM2xbY@thXk^`51+4GNKK8c z`KptHcdUROugpvX=>*pDo-$DI>`kJgzkuJBo27t&q(e9*1(A3_(93YC+SP({16xtS zAcH4?TTRLAUU7zfDNY*0!q$J!@o$Itx4Uo;(0fkk3nt^eXWDBfo#rb^Uc(NwDPb>^ z{VcP9h8|a(tVQ$g&U_F`I7}=-RhvntG3Yxk2mtz0_m@G2p^QkqYU%my*-@`niRm(8 zFxXS}zP`RL*w3$I`VrUB3is0}m65K9>|Fiak9aRbEEjGRHeA>vl7wVDGJL0t9jcBM z0*J4J8q8|;Q!dh2U%b94gBlqKI3=+RKeEO0kY@U&kALY{Tv3z5$kE3iD(=q2-Q29v<5spVyJsJ5T-uBPVwa z>n@`|>SGzQP2?iZXPn5Q_s7*_QRg|l{(M68V~=5>gL}3O=se|)(rP}1m;gE;ubYb= z0K^lXE?0yU*VUHTnJE3b7=#~~r`Dn}l-(G>l~N{`~%S-2&nB=-G1iB zf`QcVj}M}N^6B2tzG@~d`3*UQllh|Yq>^y~PNFAX+!ziF?jCl{!Q(*#0_?>Oq8cT^ zQ|biB4a6-lg%7O?9Rv;1xP!JkuDK4)QM4QMl}P6U=Q&seTmno$4060Qks5_-G8`Y= z0U<0Hw_i~hEhG63%`aUOV&8K6j#lwS{= zKMGc-A+FF+M8m#fWq}#LnVopyT?#gCJ=Y7ZR%qVdDP}^VYWXPUA>_AO*pn7(?f|l7 zVR&=Htwrc=yJxZINC+LW59C-X2V(2PNjeo!mLSfb;L+c`j0-tmdems>QFJ|wkAsmj z%P5wflQ8yLwOq}WD6L#Yc-a_ztOnw$R&dw+QxPq^dQdqzH^EM@1e_KJz69iL%TB;|{}=;DW)Szb6*Mot6`!n&e7%|RxD4QiJw9_JJ2VtVp z+|7O`#QwaroD5Jv9lZK0E&)O@xW2F4Br}n#v;BUJ=VQNB44pujA{!Rq^FUR>8>1J2 zH@{SetRe!q4s==e6hJs-7;s5(syMw79Xm7A$8z)IP_O@r%AIHR=D@kQySsRJ_26~K-Rs!}B?ba4 zwBllU#x=x!tI38!>ge;yTv3}!K$rWFI7DgA+jT}n$Kcz=aHOi>kM~ZyGLW3mjrJ;Z z-KY9zLOwUhWqSeX;@=ddD*fO<-y-JwB4irL6uF3_h)ckuoxQ}{QV1OEGh9~8a351t(| ztuct0SN;`Zg%t87pQihFGta|x3f#3uf^}j~SoEKl1n(Ad*8j(sL6s+{>(u#K<;k-T1c86J9s5rGD}Mf;yZjm6rK*p>tCw_2Mb{|QiC<2w zA(E9*k8dd5RP+F zvvj#@MpA@v|MP;kj?eV$ToB)i;1@x>8JrAcSSWX&cTCXA`_DbRZ<09W! zE}T>qT9+c$?cdhfvt6@p{neePWRwEz8dMyE%-MdwO=R)ZQY z##fu?O#YxCF3LI}Sg?2S5d2qA@8_sI6VSZ$-gv=#Fv5sZ8k%YZyoxS=>gzZD`({7K z$T|$9M2mp(8U24>z3}Fj`3JqOi#T$m-u0kL!{!f^jrA@a1pl4gQ-=RN*r1X-+42%% zWWJ1}hzShP-J*TiBN-bsZa#m%nMcM4%x^7#zt8jcBYXE{Ums}C4YDf zP3DBT?fMnOh;oDbT~Gs?E-kC2;P03GpQXc-Cs$+XP&4c<{@^qitf&W6NKW;5|*{PQ};7&y>%fzjek&DXq?2DLmJ@k^My>Lc1d+$EcyTm(GgZN;aKF zl3LA%pwq2CD!q5Zq~^U^ecLuF=cT6ym*b~>Dea1QIuGQ#MilckZGzTDWydU~rj;Kz zfDTx%?*tP}Q>C?f!a(QW=-@D~R;6{^$ETE!{y+cp95{Ep>JEQp!px6Gb(7|Zf}h=y z?(#f3CP$v-&v#wD^>q4oOL0-EwcNzM1^R+`1m@N1|h!aotW}%9gl_&{Qid*8yd%6?{%YkOds+#jA?2ZJqgmsW6t1J6?AYPk)LO~l&36?$S9YH2=P%%C zdP|LM>)wN_jVggr^pO#d`3Oc)k}9abJVNRSzjMCe&BKOxf3~+^{C5ueI8JLK?J#E^ zXrJkwGb*}Ub3?*X1#j+hR(*l(%_nyfoi5dTlIC9zliTUrtVee$aT!ghJ_ zqv<%Bg<(tI;LPtCpz3|;c3{qg)6y*#Oq=$B{Dkm#e2sqK>po|`c(op9O9TV;jF~#5 z*u&)seE+i#7p^r7{#t$e4w{~~JYHcgT~gRkg{D7W|MT6xXM&~jpqsDF@2y<@X|O2A zZ#ee6qq%YsJT=>DW6{vLDE9+~_R}eqqxl=T9&cv-!do3F)3^6W2JGBbs%Npk_mBp7 z{~en88Sv>nMX>IArLUZL57wOqSPt7ie|}nH--+XFzc%9DJpJGQ*1r1%HYK2THa$xC zEoGR&80)JZE&F<(WA3M!ILGvXrdRRSl!s03uPgDKI=C(+JUZXw=HDbJy4OpU(j`v$ zfFYYmIZKt~k$BSn}ZfDBeR1W;e}fxM$Lg3R_v_0^QjTiBChybTFBr-V6c)1zRR6qzz0wzq&q15U2~!?B z>*r1e)S-oS4A(8jj_$pL+!va{2hU@aZLB6oUcWUEWI~CKwO+e!`9<|E<*N5og9C1z zl)Z5x;dgV(m%;Py2ZKuQ^q#ea{5jFv=SHCakF&Rqs`BgFMk%GF1(6Vt?(PO@6s5Zx zHr=pkL?o4v5D@9^hE1p-jdX{Uba#CV_4mBr`Of=%?{m%=4*n4CJ?=f%Tx-pF%{i~D zDNgaMUsL2KW;k4K0V?iq*eO1x2kR{;=n6b0LB^_s=(xC9guMBW6v) zoeC+v2*yRyJt&GX8*)(iZOj-1goadC?53$oV`5vGHqzfN1$LH<>F=HO`)-I4`-S81 z+bsvZUo!nM=bc+NfdAE3&UPe#72s)p>-e*^V!V)=sw?M8vh~9f|9G%i9`@cCmPaE2 z!-@s}zbyGQ)IYa8H23hGit||TU)z9R7UAr1vB=Z-R41hFY64Z(SdjR>=ua2j6?8)R zR_C$*`Re*q8#JUAs^s?@)RE6aYo7r@gr6>H$X%$xo0UrXcxe;?d(_xb^Isg8oX=ns zO#I+YrDar2<3Tg`{!zuxSPf9#&xW|Ow6k6!hL zMt!xo$>mxJ!Rhx_@zSmgNmQbNUq5ygI$tQ!!EfQ7?{}uVGy$T7^JldtotRq9UXdiC zzB3SA6d6&H)AA~-OMlgd69Frzy$+DRE|{*nNsEY{r{?2Wp<%n4StTCZtS_ zAZ-fMe!aMcbnc+F+VAFEqn7zYoc-)eEL(SpYt(Wdsu)Zp4l%MH+viWbe8L?4v_r#U zMTSq)cy|jQ&Q7Jz-=`-%tSFWJk!fsv=Pcv_ao7%=EMZym#q0bujy_C48uT3~U~~lp zA(JX0SMAyqeQ}f$(@c8vcaeqg960qQOlcPj*G9TZ@5BoM7(;_R+WN_`4Iwb>1k|RU zp-Tc5EJgr=$L|b?(t?7-JHY+8UYF>xhYu*XC{M3;^|cyL(oJ7wz%CDZO1pv5>GB5y zb$K9hw+ze_JI4y6lAQOV)$;LEQcU5|!^Oo^XuO>6*0FD)mx+Edx+0Q|l)*c%tK;Re zOM@l+ONVfy7_-rBcg$1&WpdSAJGB`dkx#At{35e{&d{KY9SZ>WS}Q)R&crJ@$k`2L43=G&AOJzTnf?* z4%>WNm2J>${Fh;VB}i!Q8J~Ui_Fe)qC_FeI&(?fmMH_8(qg73R&?ANLPMmz?@=de% z>H7Xky|a})1u_v2p-H+>QsU>(?E(8BvCgI~M&+Y7iQtC1J0Ouz92AYWDULkzYXK>t z(%XkDw#)$^G}Af+NHjbGIu!mMkuhjUpH-6AKo=5=iFEV`!dSyG(XXxtmZXr71&7WT zldIAmD8tReIezq@5lp*;UPoPf2Kr&7VgG&`+L2k$hs~$rUyjbg@SNPk8@Hr_Ke--Q zq$?;YMkt>9ydNon#u8jeY`RqqDMNQAEvNwH55n`&U6>97_Q_bjbGXo6>-Bp|8BE9v zLhZ`FU0WJLm#h6X11F6`!ECc0f`dNZaMO#3qznD&xccbl#JrQc;i;q=8weQ=0NO`t zS3%kIy*Rh%`p91iNQ*RYPFuWv#@g72!EAUOKBMm-!fdv}2Zi=Ur1};JvDM&$dZ#6a zUzb(M!qGkX3J(}fYs*aOeKL{eA7$qg`(};l3QqDetcP`K znsko!>J`=0>L+$4j2uAxOFjzTkZivr#eRMNIK0`rn|oZBvb2R=)o?azAe>b;0O8&; zm}VJGKuzX?Y^fSBLTGT21f;+I>>ChC|LjZV!+Ixq-M~xm<}+FAS-t#9w^wiE{vKYm zD2>$H2^vw-OZd+Hnk9Qgly}0{9sZ1X?k4)~OG^N&5r~h5hTvg7`Exr2vj;@5(Ij!( zL>acJZK|KjR+`s_^TST()V1^8mP-WbZ1&tBBAXUFxvS^ekqUP{A|+*RVb}~z%oWU7 z74MAjG}xt_jT>lrnQ*%kE4XX9>Q?fgG`O}rYKifSV+bY2&fmaWYy(fWd~ft2j>G^* zw!)^|t_h%4y-#f!#Dp318SdEqeAQ%_jgGzr75r6G~NS{$jj+EQ=~7X9(~G zuAH%341d8+cseuP5Kqu#++yBG#9?vr!AS!3kc~d5t5`OC(1uO3fJ5#QVld^rHeeM%-Y*{8tEMoX#r%@Ig~0M;dwjlYX1_P7QZ1PhHC=k0UN44Nncro_UKwn1!Z;nsZ}>b$e9O8SH2cFz;9 zRfLimN=7wH^yoOHoTo;x@+q$d`eB zls@0~_ZD|87a4y_FeV2eNxT!&u4+s4znQ@2B(*a$O z#5XeD1dqmLl_X5sdXq;Bk>)kcPCyXos?Vt(2PFkPiCJlch3E&HdP9k!rzI} z`E!`8a8E@AOQIg+;gWdUXuLEScXQhqu{!7(5M>Bxw~J;n&kNzdRwWB)z-Lug)&F(; z*>prH3lt%n^l;_X8JSYo4pz0STkV2yX$asKh_d{x|0x9Tji>P|-x!I^h4>H-t zCxQ{5(!y}|LX*Uzj?%d)MLga?_NUzeB5+3g#<3}oa49}>AIp-3T2ul&=0s5qFk+uj zMCQOd*AJ9_`#Z}AI9k{l^mN!K6CatVf-O<{$T$0u>u07d#$LR|gg+O}dz5DfiAddK ziP2Y}cj;KdEJ6=^j_9JHW-gRHbg2%}h}`lrDjc(gCZM3l<|i5I1_L)Phw&ThPg<**(;{BF z5Q<%~tH8?8H}1C#YSmS!dM(Mji6fgg3*v~Tn+cK0IK9lb+3IuRnHccL(e8Ay;}K1| z!RCYrNTv2L_GdXtDNhF&Fjhbdi8^W^WGdJ2^%}-J!2%k5*C}HHLtlBR>lEN{-eA7@ z)Q|n5^lC*0iYc)R*qkS!`z4yNXI7Ie37e&*H0g!-f!G&`gIg!lriVGlLsA&J&lB^5 zslJ3Zn_wOjw2!g2xQsb{lmB86-|++yHJB&>L?Rjd!Mh7@aCSFBo}>zjmT*n+eoyB1 z^MD9qQd9jpK@DdpJA(&OxL6%|yCwF{u{%>T_U9S4byx^Hh}$!u4Ps;W{HGK;lBhWj z0b`#ko=`Po4s0-PzR4=pWqV3WN8`+UTics>E9%>P_XE*(=xMe3^-^v_$#FbQGpeoo z15`VZ!6>JQX`kTqrOZHeu93CmcXg6|EZ8pWd$t@G zfs^aQt~S4WI6$-RXsBk^)}eQ{x_KVxC`{1b`gQ=661E}Dqx&_D^Mt%}4w4n@rMdh2 z>%$gXQYHpQe{&o1001-MbWl;tKl}hhWjD%|!W(tg=lc`gdtzy$uThOZmh1P07|#U2 zokGeGezGjo9@Z469QkC{)^jkLkVY}i;H>ihj(g#8W%Ur~31G%fpXYl@EuTw1cnU;( z3Z931GVrK-QF7Ul&}zk5MFMuxjU@y1k|7;?Kk_(9HqXR5Hj@VdbTy#$bU2q{t0##w zSNQf=-p~r6*T=A0PtVMnz~~l+xcWZ3xU10j+G}ct=DsHO{TDB%ssn<-44V}}j!<4G zYGPhszCKEVQ3LLxDD~dW;adVWKJ)H4Iik*Q>oy)w)FpLwB_UDu{meX=b-N9&HEW1? z^lVV4>Fwvm=4(9qnXfUb+3;iS*c4`uC+!dpZP@6yh{g}F zEPjr{q~PskH3`RR2f9sL1HvWy5an!ZS7EEyHpHV}lTeFwZk3*2tqc|Q@mn@0D4V}| zZaIAdPyec-hy!(M`s0v}Ws`9>`9EIwym2^FhBaSz#S0>VEA;ZdJw#@b!>kI`k?EkW z@_e>HuU-X++p?U;bvYZf>0SP^_XRYqgEX6r>IK%dRB(}+cr(?EgE8F4-+n#`{&3lx zHSL9>+{f+CG*xS#8}eWft`T+-dC=cT85a_QzUrnuowglCitG-;WMy!`pWwWD^~$Xl zv&>~Mr>}WR52*u+0@|lyYqkP;NWzyD_eRa1>VGo%nkf@qa4%~ALLGy6uAno((RyZ^ zsLT?1hsjWSKBD%O-SC(WslCp1q>-6VFMGkJ%1`z`7y}>PcS4i*=m#UQO20aT%dtBi zK}IEfJ6{^qfA9Xln*PK+QR>U($s|)7f5#V*Au!^i*GrPsSYH9=akYsy9dsAvKl}p{ z$6O#O+q%`s#qvGo8mxI=2&R2S6ds6ExA%KYKSNREeOh;6I7F*=Ll~)@7zaJ*>OAf~ z0vSX1^J)l@lwaQH5w^NSI4X@ld(0#Z(%7Hvv2Q#zLxss<)}J+C^qwx}rE1c-ky>Q5=^>cDE-QHAt8lA4rM93^Jmrep($i7- zEDX2%$dMp*_Q{F`x>4hS(I(3?`ix>5F)tKBclz6iy)VRmX6@bFX`?168s>`WpRb$k zULx$V%MjGp9|*dG}vfhw~e@8Mv*q8hCG(HJfF)h z!cVl>(Om9N)j7{j%OnV~9jD3dfF6|#{WzzGIKpqo+ZZ-3{XzNKo(^WoO&x=-`M`7Z z@*hS&KHIO^bzZjXUwr%ll0E}epfH< zvPEnkgsyCR-#J9auNh&MQhRTUHpeTU)3sJfxA>OQ;gt<+2)0*INvtzYMPQo~adun; zUZ^Np5x42GtH+Essk^lC_)T<+SlQp!XS z*gH9){OG&nls|uW1-jc-7G(siZ;b&cbF6*i<+|C;%BbNL85F(;k8Xti&*>IPb48mT zF)m`G@3n3weu+epSzCh`{_IoVO_Mbv8;*XJW>LqR3S?ZL6?ZTU`pfq6l^D(ojXTzjV)6x!7v;P2y4@Lnety#xCEjL09_dneo+)*k$N3 z0wEI%SDQvkmH@+h~PHOx6$TMSl$gFnUxk09@Fx@g;tBW>Wwn!cTUr! z#usmbZke-*p*UVE}VdQY^^t)Nj?)VSs~iZ$V5#%9HLZAdb%68Sx~aTmF!) zxR5u_PwlJ0@uvOT?O_4^RmOqdndw<5neQ+0ZEu2DV}MkR7vYGi&{!}VeZj`F0w{si z?N>&MY}D^$E5QceLAqjfYv3`5c>icz8`E`j<|(sw>pY~%ht2IHkF${X*aN*#kmhAw zpSCM)f-xVXilaK{VIRd*%TvB)0mB%;R;AU!$T>Jj$kR45PGaJ%keYH2#;S`LT-?#i zR;4eK*ClxdH6ssrNnr>JirRkNSOM}@Srw6c5Qk}=Q!CNovpEx^4#3L0a!e5vk9sQb zvv`|Mr>1DkJX9Ko;2V=pjfA23!Oi7#9b*Mw{JH$)rlyj?`SI3%(++XYilnL2SRNI70S?sMCDDe4yQP zoV~PmpZzCgS!tQ$g25k@a*t*q-`=G-e%QYC;f>w%QuZ!Q?$UdZ@wsM$7@Frlvz9VR zdZ1oP$48b%1ixb3%C1bx4 z@ZR}cbB@NT`C(+O9TZUbZ~R9JtPgXOlC%9i?}VkNXcCy?j{I6=bb?hlJimYZ;^^4rU?e6&>c2TG`|*g#H*(E+n*q}{Y8bnQL0-l zZ?kIbx)8zI5~s%KH)^g`wA$rCwGh^te7vum?^48pm8OOIICE=$-N7bE=_4P7=fSd^ z`f~#a@)TpDw9^%gw&!a!-rRwpE82EWF&0V|#DVE`t{Z`)PKf?SOPDH=AmB74J9!j-2wU16O9lQ|*Z2r&Hvmb4q9k7EHI|>o zdFoa+ZJifgB!6PyfQn`9w5LXq-Lm-u#2#J`MmiBFRsOc5?@c+w7=mNww^uwH6x? zlI7nn$y?DR{kJ~WMjKO-T-sKO=}Z;Siu!<9M8c--=JVB90)v|JrAM*KDS>B(MRY5t znLMro#ex;LqE`{Q8$A)$Z~)wNs*8WW&U-NwJWzA1!9t#*9FC`N^*KMFpSL;9+U~oq zBfdlvHDqV_6Yvg#%FNa)zSI@xTbnNa^{>?v>k8mNS0hK25|MoBbk0;CUKJAT01q%K}&i|CQ{x3hV z`QXtE5G^|6{?i8xX~h-`N$=eyCjZetatDNmu>1W{^#3Xu{tu6}zVL6?5JcPgr`Yv- zz5bN*{@b5o3rKW67#~Sh{#AAVAD;A21vYhiIP*`Z!T)4h;E6BKi1-9^sQ%3&{U1v} z4lf97x=mLHVw?Yq<^Q)|1%O54c5qXa`%fQm12&y{bq72DXRCk!7R_d1EAjn*`oI>j zX?5lT=Ko~;e^vwuEZTVMBs=wg`oILRsr5h5#(!Yf{~sISP0g+&uuv;=fOutR*J;Xa z96s@w?4-oEY}-ZSp}Zjsj)l40nT|EN-wqHEAqfiJ9iC%F^#ArdXi@;*$CrS4ShuKD7E`|W9IMi;uWR}C@yG{k*4Xxj4C^)db6;UowmCHR7`r}rz{Ge1$ zZ}FYv-!3&d?wx;zDaE^@p}}jk724!rxAHu`s8WL8is7Am7le$}wU!QLARe=ivuJE4 zcQ#jwcN&j#?HgL#2c=H4wSJEz5!d$sn$2EX>yB5jXVtAEk9OZ-=-X}5L)WwDPcDpZ z(PvZmoO!NxiuwWP?mb$u5Vk0<{J-V>TL+H`Kp9-Kx$iYmRN#t$=l5|pYkz~D8ma8f zCOwI;mm&evnRJ8jWfeh9jiqDmjCM;&Z_*NfWNwqgO>009F0sxtz?nt`3TPwgxYTbq zsYGupZ)|XGrkV>ovq(6AFT+-1i-h z7}>tf0!}yWo{vR-3iCT1<(-^+Eq{OI`0(JV$p6PzTC}-q@}uoTjbk?DyxiRB@N`;B zm~A|@gp4w2Rs5p!KG}-(IX|Qh2MPX*q{~r+%X4q-xp>7h?X`rdz-ZJEG=ez0S#O1b zodJ0uN*%Z77G9rK+vvXi4$yi1SSP{yvm!%LaF=hYO!@@>wCepg=du_bHaPkorXloT zJ0bmK7=Irox?QbWQV|mF8KKcsw>>phJYAix{_M(q){9;z$EAV`gLv$bPg6*rd|fg< zL+sdFsV0Pb2R$Gus9s-GmjB{*72M^tK1AIWM;|*^a=m6?HCvEf%k(#Y16@(TZ~t^f z{r9f>|L|K3#(6`2r_c*#p^nH%=BLMTVGDAxxpWlk^je3V1{JoGr$ZHH&e2v)dYUbE znJ&H?TA;xrwW&kAEYwrhS4%0cu{gAMA@($ZDtuudCh?HLMUUda2)DUqxtv9ilm zV#H%#(1@}ebSnKloVEF>B#A&nJ9e~`~Mp%zduHm z0CBhwdE~caH)UV7jv{9P(fKID7H)YI5G@+DU9aU3-6i_VF6yn?{-2O%vQVBnUae zN*LlcpW=k7H@^>5ZH~lX#MyNZmq*L;ORi%3B7Hh`0(VimYak|kcsMp0dOWD zY7!5Mci#acVCk&zq8Fg@p<-cq!RD(~VH&pF6)VG{*FXiPT1PMEc3TVo>!A1@EMFUf zj3G>wU2t6nN10^w6}AnR>)}eDq`2+dE)GP{R^&hdXH>{eZ9CQGK;M|_Bv7-hYq}JM zI{;h>DX0}pvQrCt9mNb~EA$LzNUnfU-gjVX?>?o?s`x+l6hlZrwVfyv2a|3^A^9{v zz@ToH?PSFe4C>7f1X`N_GRynyHYJV zE{a$W{x)&VV`e@y;|v@H1?0!u7=}#Mi`JFc5v(d<8z3q<-FB8c{M$!AMP7lgh3iPS=ksM@h1nk0*)=f z=(TdbGPMFeZ*08zCd-ez2;L-4&+K6#Su;Enf-Kk$&%d zjWoRb@`-W%Z<1f7>8o{yT}a$Rw~W+Oa`a5Qi(4cD{Bas2hU43W;j6YghTwbqI=?Pg zm14T52U^@2u2mY2sB}P&Tj8AQAA6f@oh0?~-SFY=-Nvgc~{4!r5p7_rxnU^#2gu6sp4tZP`G{s=nJuo+;VzTtFNk4cfA zH5Bz*lpv`0*e^h>`T8tn7tK3Zb*Amv^$lWZNn+tL6_nw#`50IPu$TiiLak48y*bc~ zhOcqT;Ha?OkifR10mGBAfPB`nSOdj`%wr*-tPmOf&$$Phw8h}kDP^J}R2Cm-t5{Y& z9m#toNx-Vl1h)5}b}1NWEE2&o+MFmiIraq+oQn{&RrJq-TY;k;rhvpCM2@gG;8m zoBtfE>j4VSDDe?e|D?bc2z$p`x%zmXHopw>wK5xo&RuxVt#@43WbL9r1V+BnV~|>k{u4H&_v~io_v5Z;QVL4n$^B zGH-1HKTeIe1d-Lry^tpN(8%}Qd$GsM{mxS zSUug(EGIKMqycvXkiOc651&m+oa-rh3PnYUlqx!{MucD!AWRyf znUK=1TfLoFGFiL_j!7?zommngwf!TVWHq}YaQhtKq)8QXap9t6+2;C-6~rhb^xRA`1F1a9+YYjXr=E~x zvVrP6mQndfim%4XCid1lcNG8-xja$6RN-vVlzm0clq&4}7PmE_^5MJ&l_Ff4phZgU zK0a^ErV@RIlWyky1LNJD3LsaJJ-np1{2@I-mSx45D)Tj9NT4kgm_zm<{1dAC;2F+u zrMzM@R&6eM>vPs7ORr4j*|K7P6B^&NY5J4iFE&K)Du39#TZSz91918cDYYDgP)zDy z?AXBtwKKXp(vjz47e`R34w$I&C3N?~R;m8Qe%i^mXIfPrVJ^xNySoGf8cW$DuS}oS zbHwf8;~nQOj*p_~TF`U0@6gQjp)b@i>*OVVRVxQdzV;H2p-H{(RN=p}IMdrB0Gxm~LzYjV<8Ju+1RRbsB_1>+t63Zq)% z;gCv92uiBcMLcGBcK5pT|Q3M&RXyk;J0a zAOWVbvsRfnrgsBU&(8EXEOrnkK}Qvs;=OM*oKtP8q8*Ef+?=t5LAIa9)pF=oJ4Lxy zdbT=fG{jdDFjDLt?u6s|YR=v`(2mdPXRcleB#J&mk?+EpMT>19j0uRi_c zC_*0cRJGjx*>bW?_xCr8_FdDv5rd~}eygl!(gmvZ>Ql3R=^~?s4p z>5;cCMF+&BluB+pR4Td9{Eo1mdrKW7Xgme^@!lva=#cSQ?~_8gtx9ove43v!EGabO zO+)fT54@G7nbTL*_Xk&=N+9q53DCed|)CS_3#_X=XXh2_d^EX z>Bid3N;#91qxV6^vfxNtYU-|P_^?)wp&aRs{ zI62jJEEJ=lZ`{;oMqo}R;5#iG-WSWBA17JnY!IKz{p-{z&#GhT;nDOAz0u zEDI@Oq#7Yp4z`D@&tIAkDt`#Dns58~2c!7Msg;9TkJ4*AdI_e=UmL+!6FiBdyt8H9<$01K4^u9MTg2LIW?C(dij8)E08qE$i3ME~xR{Ita zv`Vs9EN(9}yy@=e*iK9{7UkDv*HYf-1rUcC)IJdLLmL{Ap}oO6_-`(2yTe z*?f8Qq2)%qkidgG79b(rOR0?v_ZlmmZmv8%VVB_zyPd}6W{kcu_VI%w8fRuxDdQ;B3aYcD6yUz`&r-7iJpvvq4dC^xDmK zo}OAEVK7hwF9Tpu71!M!KR%+L@JL$1?hliZ(=5x-XKX5FuWYaoMylIVynKEQ7c0b5 zDfCMFrOi&A1`9fu2?S=;r^Wd$y35D%OPWBu2K0wYjy47}eWGL3D;mht9~uj0lLdRE zDr9>|HfPYTT%@^`(FEW=MYImNn^JB=I4SV&+<@Mlw4CCO<%UmX^C5l z(V*cSJJj?MA1bqkrDg=lF>LJD*|Q|x*IK@oFK0dPGaycMomK^q)+PhB{M z2FbrFk{GV=3?Jk0>eXas)7u;U@B-^sCYB82y>P;M1?HoMTs6V-&0Rkv1c^@nd)lC_ z@}ypx@jBNNQ$Cg>r=qv$9T+;*H4l$dZ5^+pXB;*~MnzRAn%aJ>Xzj zelzq^#OdhGNvKUro*RQY9V-|=au>osx_(0d+z^!Sb%m4gJCKC9)QRaaG&oVoj%Zih zUk@gH`%wGwf=UnPtMSv@4O0=MvNOWUubt7;s$c!;eOAqoi89#H#$?|eBuV}dm5Rad9^2z|qPBw8 z(W*l_N$Z;9GKU2cMem>s+DG37Sn}kaixYUInw8u&tq}{?pz26Z{k< zc2m@o^Qajw8$GRB-yqOxhnnDPncwX{SyvDN2%q-(m0rsvFdAjEd!iQ-bXd@F z=^42ZmY~cLa)_PsuNt+HuppJ9{5mbnmon6;u~ne)2@xAignON&%S2~0_}x4n(aKR2 zg$)N;WIK}e5U_*f-SpRfMDPSm9QTMx=h^rxqn$^K0my=PUBXxVP96ky)0FqiVtMWL_4GTlZs}i_;UYXYGQt0* z8#-xbNt0{-Msv}otSXD#Mle-wMl zreIrTr1CVlI>~)5_g!olx&e$qZKH)zZEBpv6X-O2}oR#@Oiv++llzFu0osN!7rcwB^vWS zE{ZEczS-E!bRZF%0Bn8wC<6cmeP8Wh&AsF6a{vrsi3LKj-$8?m^Z=f>TB zeBP}>HL@IX)6lLwAIT!Ss->o)nuy(T{gLNiR(*{Ki686M4nUPSQ}q@{bwtG2J5-mm za&2WLM(EwTc5%LVdiw{h zIg=vKJnaM9fAmHoW8GRJN3ljqb?_({yg+HY!2Kdq!j_#qZY;8W^R`i6?j6f1u71-+ zH}rFOA6S11=d4J2^c!sbo0Dnl$(GwsDgr3ZDO^#`0&6?1ab3ENMOjiP)CzHfuvdMa zXL2EikF{%1=7zRkhPN5YA;BL9-%bV=C`tRf0;EiS19~OLyh&o#9XFH{+ZTDVEBYy< znL5smJrOcpqnF~z(>`B)TU2Rtp3K!Y_qx`l7ctT>@$qY=mbpq9+QTJlnq_yYt=KTp z{tvsnH#k4rH7sO5nC-^nVR!rtGO<(%<1u^ufWnr_Qg)J0>qk`(oZBuwvq>cTB-xpd z)$GNSeARs83L6zzA`2-Q^t)Xy$tB;TH+%RPVW^;>H|}e*FhUGpXgauOBJ}_?)FB2K zGJkR`Dr9BW7>0>XE!aU`Ot3?KZP7mJ&>ve}`Jqoby3N;(CeC#AwVjse+P9}6mXU8 zr9S(G(^T7b#S14*jj>DdQu!jyjXhy_v}Oku2HzLNuV$u3Ch^Fe zo`bOg=d7k7U#Zq-YkoR4)_9(2G$QrU=I%jXk62b(3-m^^=QL!+H<1wwO(*!-MB4XYP7u z$4?< zSBOfJ_k3g>!lPb1}S}1B}6*&70!t=3^ z-t1x6G_K~MdM}7sK@ukB--fijj;k!ywLgv?x-l$86VY3;Q^Q#NY5&18gTc2~c;d$Q z`dcSCw&?o;)tcgdDS<7MW5$wm>j~Z6C6BAotB?!iZx9Xj!L9ig1FRPfg&n(Kf>Iu^ ztO-pmiszD%N3GW@A*{=hPnf?hM$xOqN>5Kyd(qZxGzqu50%NgN!e+88%#Oqvx#4MudRLmq)vNkqE0f%;s41eowTp@aoays?i)v{k zniY{Jr)g;qpFKUJ*gPC69IAP4vyInhshs?PT^zGkRLRX(v0G0?U4Ls-&(3B{d7OEkfU?nY&9q&t<5Gte=T~ee$uEz0;kk@)2CN;RH#yEos4Y{5)i$}T$MnPWY!E0gl%0fM|K53RI5^`tVuya>_7dnc`#sqE~ z^%a(dSNtAq;yaMTn41QGDC^BBOQcAVw(~j$z#)5L8SU!z%xah+a)xm!|31b>PfT0s zM5*8oUrvx37F~L^&23&(pp%QovUv0D$>8`hVEulVQ#)DYV_X!x*@pJYT73kG$vUXs z!XdPbc&TymOXxZ3#Xp7W|*g4BT;O0kF74KIEP4HmPGci0P2GxC(YTY+}gH$U;9KD9Qoj3bEfBG@=j z7d;5UQsLe^T__xJ{V76tV|bYV`ss|Ksy@M4Xn?1Z4TZejA>sZp@7xbY#s%jUAm=(% zsBhkXri(5^+%Zcr&yt*5N{MKh$J2P|ckt!yH+d80Xkn$IIlbl!tV>6Dv*;%C$jxn_ z)@w148Y`Gm`yR%6tX#;O{7V6hzUaZO-SS)6PtMWTs{Lz$METMA1`12$$@qWOCA+e` zo^hgLqe2|muye9V-J4r--AMO)1Cs-sMTRc(nSGi;g0R2HNV2~a~3UXeAxb{>cP)u z#OId-@!Ff*GErLzv}HeNOcrT<0_yK;#dKYo&p!|$`=Tte%;h>*$13H8oO>SVrn;jw zon)kNWFEyo&Q3dvT5KeEF<&`&?UrTN^)$oYx5-(f^jeevUW{>6-T)?+M1Eub!(DsA zU6USjLrRO#^bDuzc)xCyFF~vRK*KY`y~VUXnpjYKp>tHDmGIY4cKDQOOKDxy_&ZD! zk|o6PeWH%#Bu*K|$SJ0%TotqVar>QE+I?aM8p~5RUVV-vnTS;zd77<^l_}q*N;x7< zc6%;847N^YMHPuN0omtsoobKQJm^C%zr{OnB}!=MINDAXcQ3ys*l1uij#F*^e9wkc zhU7spePZ4-6khluZ;74$_6K=u{`l22t!v#meLBl)2I^hS-4EH@MOF~+Tko2aO(zms z_!SX89Jsa)hzb%_D^xw9^SPE!5@|&v?u;+dgxYMCP(mrHhq84}=Y}dTE9r;Ir1T$9 zVLw11tfC?jDWIY2zfUQ+zg#-)D&F@N!^TB03ZfgYEne?_VP>q}V-$dKU!_B|$h+r$ z+fZ=!V`BrQkI-ONiKZvMNDGg!a<0;#Ct59NexRzFzQ1pRfhYUp2hJhqxBUJy3d_qy zt3&i+-@Z;a(E(wG#by{hBej1O>Y$ zid0a2S0nGGxb;Y0#_9Q=u!!6h^=z6qM1Fp&@V1jsD8|u4Jo_cS>|V!@W1?lOma8hR znCV|!HS96B63SVeOSI!D#G-{IYbr~GyD_!j`r95hT`>4P>$Tnzb)Z{7^>)WQLevqZ zp9?OzUyzg+3deIqy90^ctEuqD+akhC_*Q~qRJ%?kjS?Ot=7VeunsdIP%l~?$iD<&; zK6M?bJk|Dr*#_oyv-mbFbKX~nQuDD5QTo$vQ?e?7J(D8SF5C)$=vM!%Xec2$aqRy= zhRU)q^XuL28Iu1c^pkDn>E?8gTprqCN782wxezp-!z@iB#AENGj^|;XCh7N#k#Nhz z$P>Y#c+()rW0^m7+~4I>pELKAXzi_uk%D#TGP*7Kkz`5~&uxVD@L<|>?@BU{FwJV6 z-7v+Q=W=Z3Z#dtQX@c%DPn|>_Toe$zsREJ7RNJPXg?4Pi%Zy^59(J{BL^LB@XY7RQ zQR#&);4dwT(QrKt3#x4ZWj*P&4eln%v*s`E>kP57(>>{;={yu9R>#Ir1WLF^sBD4{ zw#R{X@MN_=yIsIHOeX(!W7j`)S^*=Jt+2@?h?V~`B;yBgcX+a{O8AtyRM!HqQig_6O}AkqjQIu+#y+h z6s5?~nissQ@Th0xaBYlJjwrjzxI#&UfHoj^_9>BlxW2NobL`kS0&&&);A`gG;4+PA z7Zf9Of*IP$iqtU)%|vQUE>kLarpq^C^SC+T4-tSqDaQBl!uZh=X+dV?PC9J5&r$ER zTMV0*43Uf;^Lx^uiC`3$y7QnFwlUE z5isw>+)cehA&~yoP5Sw}VdBAg9X1hEqk@5uDp9pFlsvBEAYu}ww&#;6kLx;`+mN&XeN&Ty5X5N13)aK z3k5d+@C5yDZMJ_h?F5u(slx929LDWU4Ry32iysSru@@-k`$PC zTPlP2m~hEPD8)B)vu0cNE2CcZa>UsCCwT={z4RT0Fd)RG%dIi`y8wTUF@cOIX*XMj zxYxw@q}weK8D^~ky7#Rb+}oo{7`%<{{dn2xu~}raRQoKA^ywR4cGQ>O-#DC3hc}Rs z3A}&*eq&gAd_JF*Z&{}JHm;YaU_}SBN~)T8^#0iCy#*DyHTJs-V!Kq$FF8{i%wtaK zpQM36H1!_{)OC}*Q+EK1@%5~$q?t9!JhYNFSkjy5E*4rIAxF*Pads}9Nurx6%dLaA zsEoctrAQOfd;1l4$uB)`TTAok=?^qcofM1`ma>+I3r1=6LhdTI?+W~)A8>&BB&`_M zEylFroM81w7%v+h59Fx2KKC^p+Ficv_mg;H$%)LJNf7djY+yd)vtr_`xStfidmKb#q^;6C}?Nx1QU)p z9334?!Tbdz9Eglx+II*{a|u{zIci%RmehVZFw*8BHZIe|*=8wC-oYjiqB; z27W)=Qo{m8qk#nfJ_HeCWq2d;q3f&uSK(nDq=V(>q@}?xOmzg2;1Q6(`h53p>L9-u z!8=>wtQXZ{-5Im_ujY^WUKMoDB0bWLL`Zj;&2jL`JA8zqO_GFc<(fK_N%uQwN*2U32e4{8jP0ckz2MZYBI)#U`kFGx@5T515(i~<?Zv*n6>I7-U0{(tm_1O7w~jG}VHGTx1v5?) z+WW(y^t;AND+c>ksH+a<95MrhKn#_Li$&3BU?9}i3W!JG*qBaObhK*p!fyKCow^Y! zIR-PDry;n>dkKAciNgGXn#EDm>NFPjyZbF;B`#rW1u8)`y;IVj1)lit=y!Q&P8(3E ztb4qOzPdsomd%e@g}Ac6RK!`;eqQc-N+4NlINU*QqX3dEX)7sz_}_ki+iNl?t%EF! zL3Qy_M7>Ef2AGWU`B`tOZbmx|LtsV5PDyNB+#*BpN1ux{qB{TuZpw zsXIa8=0qxeL5BxQK%p_5)_+J5?CVR{zE5j_6&SU{H^1|6Sl6(;dmJ?Egf-4q2RCVV zk$B11dA1%DhhgF7jg7hPYNOO%A?R3j-zRkh1DKm1jA726VoS%Xd<8dHY|T|6;h3tu zaw_cpZGeRf;vPF!fZ?oTyst1aF`UV$e9T<8hj}3|=_XH)Y}omQl>YS!YP9GzQjTIOKO8b?!wbxXAEju+Q zuZAB)=FPX+i!-9FcxLzET5O8OY^%;hS~CD*#H}Gre&sw{D~SiHgEA=V(O6HiZfJfq zMqL0sGoiNurQ$pW>V%_3U9$0nliuyy_Z~Un7?s|Z@f@xbop4E_RZ-|%JB}LfJ&TIO zx=;HI%a|S~Hi?IahfZIPEb>n^pY}VUui7E-8ubX0laf9L-9X1Cc?~c}7Bs~`8puw9 zf*eMyzGg@?_I-8LsI=k9 z4|s;Qs=xNm)>!6;HWgGGh1rHID|+wx-WHglt7CW^8w<|}-I~x)VTL@Y_)(+zKi~zYq$wy`@@hU$p1dmfV(%|>P{U`&>LvFK z3S{v$6AH21Z2`*r4y1MT(NtJxV}_WJyZ0?^%$8#}YQ8iIOdM~Ft4{XmPV;Pv&JY53 z*Kdd3;b=pbkH3)?U{2$}P#i-ruHse@4mloNp}737h9gu($?=bx8`j`YDJ_@#QtiVio z%anY^vbc7{aa#AtiWp6oR9v@sYMwu2@5JV4qw^zReC;q+PI^h&uelSBeiu#eWrDT) zj7;qA<-2Qo8(pO;OQz=@qmOVLc5JG~l?gBx(8wS=_#Pqfihhd1_Er*NhHQRm#0vTO43iI>r8}dRe)GuF-M869)o|{Qu;2d zu&`d~vyL}grdY!e#P$tA*&i<%b*8?+wvo`tfOylfm4G8=(1KuMgs=4nzVPc5NWYc* zifwekBT#oXCgpg51MATO2Xy~7tuJTR`InpOEz6=+Gg$Yqm^yc5dSd5>vqR)Kpym9H z#r@v(4s;QF7fD0+c0RZ6uVmM0->bV1p;JVW=JWA#PU#e^T(ZcRFQD)fuf=@_i1Zqd zHNUKDUd^z`ccK?ttmBY!ydH^PxB#~S8rJXT+ETs*Sqhw^_2B|$FzXv`I&aNYQQfP3 zA5iW!je>&M&+wZGqja}rrs*rZzqqpiE|Bbq|mGnJ1|u9wB7##IGI!~o3*lU%(SI!78|ar0X3 zgi98ufWNjzZ~5rKcv?cVI~?71cVC=hgUZLy!_33$VW|GJ-#8zwlNXwsU5|-1e=jGK8Yz0W ziPQok<+#H`$q=c`p%5^^Di$o1sy6!OGf&UDgVg~Um#ryQFk)oD+jxNd<>rLuw!Czj zF6JML<=20U;Cb22q;d(+(qXFC|Hl8V0#s>)dt0FQxt^So7o1Au^M1ODYgGC{I7XTqr3N=nFBTBnAnQd_gRfd6nS z|EuGL22#k*cDrdlSAJ9o{unUBcb>GsZV12l zh``32VnT-5dR2C|(Ov&=mi{%(uZbIeGPnly55o*m+oqp+75ni>_+X8lH%jk>J2))U zhuJ!XEEcH`najzY@zwX>Ux`_iQ=VVGWE8#BeA1cl+Q3v%Ax5s^Lz}Oi_&Nf1>varF zGBkL*sPT&(r$faHgm_a%ZclZLgPJQ8vvs-($Pt! z+~nWF2bk{)Ih&91Z|!(R#&{kk6LfDW*APu!$e%VIsvQ5y8>35g;!$!_|Ou9uQLrBcbz&mU3#ZZ@0cvC zbbP|~Si#NHDXBZy6p$P#nzd+57f_`>wb^Swdg|k1{Ai{AxV-~(1}%ON=U&Yg6fjvZ zzhnE8!|M-lU}Jo1qCy`7-%Sye$hk)!Yik;A&dMvqvspIwQV|s^pv?Ve7K*JIwgRi%i$) z3Wbg;#C$I6;4BcMrQ7C_s@2eL@*s6Lw0Wx^U)?dJxeo^Cgp$o~x_?k~3!BSAHlxv& z!U7X^4&x5PJYa_N3M3K@`cN7eXW!NgHvvMAPvV;G>icn=T%l{o zUO`l~#O-9!1x=L6VkxhhPd_w`EUs+FnJx^eSx)zshR2J39===~|1MNh`3T*Ml9W_O zzV@_{bMGg`_Q&`%>kp0wG9C|Cdh}T`yu_8|uK6fttPhk$lYBLj)T{WcZ^>f#x?SXD z{PN40PeGrMn7?)-?xYVsnPYe7@vwAg=c0!pu~Z!7k$U1ilx#F`w9T^y7Z%q;S(fXg zbemy-hsl0|_s6i-Xj$JS7`fTI; z(Q#nnOp-X2(-+4NKp|{#s%HN==;Eu%8^L{4sPmARG1E43Pk(S8Ad~>y@e}|rH{Fy@ zpL~Adc|ez^``z6O?@SPLe!Z`;@X@jqzCzW?=T*STMa--`utLFCH=GVAqY&hNPuo>a zOe+wJm`=@1*EA*yNj~1ZIbR)Q`6P*YCI=_uV1=8WH04Z_5N5o~1v+Tj;V;$*-+DpM zLJwTGT~+_+U}X3(3#D}pGIGzF2L&#zj;z8++llfA8G!J!BAM87NhFJ%2b*-yb{LcF zEA930u&|O;dw2P3RiK!Q)1)2f;LcT;YYuTWFY%=x%mDA|q(Qrh9TcKorWmC6GmCHO zBWo+xnTG52yg1MtI*ci9-bXb7*9wr>4jC4$Z=K|K`&8AXGKzP(Q#(|W8&ITQ)iFBj z$(|-Wu4P0mYB4nBy&Vv}_$7oU76}mt>{o6ITZf*z3$59fLxQ=eFbu~2(4t4DdLDWk z-zh%*7D;cb^H>!|q$OH`m z&1=HHn<0^ElXeU$4Ps|riXx5PVF_C1jUqLiG{Gh6desyfe#TNZ-@_Fu9=F_Q9tx)( z6*ntYQf*m(fU2?L8Ro?OlJ_OT;@!{6t%e_2H;7*>elL}Mduwa3qE#MP_X5m~?Pfb8fqj+bmQxtb*(b@6m-bkwqMccoKC zSq_26+7e$4eh3UZJ&7T{U@IB%*34O!5i5>{9WuA<0W12qc?VE>1LmUpIpbiywk@(y zW7?l7wKwI|XSrDu*%@;9du{;$8c{&#OkBojidf}~fZ|-q#bumfw186f;6HtGdBQe% zt3IA$4zMN8!W%k+g-@{op{pjDPpt--kCSE=*+hN-#z7f#(c?3@Jau^3h-i`8yVMI& zmj*DT<5pUQWq|1;ZxgDE&%&}V1Vh6*K13gFPI8x&$ZnjCeW?Hw8Nd1{;EeEW%v8uD z%ku5&AXbWoLUc)Dh$P_DI88WovY9`9?Mh44X&&dG-6dC?5#~E=x1#Iuh)>8_E=u5h z?YhALdDq7K*EvVNAuxb|_DUw|S<>p8- zTrl|QA>duX?za0JTs3=h!M$^ZryG_C`h@xIrV4wo7*LNK@kSN$Hczl(D{?r?9ZbSq zHzlqVtUp9`NkX(>CuI(8i!0T>IZp!;4)(1O_xdY6+dY;L$Bk^bIw_hc<+~L=$v?Dl zWt>Z*@}Ni!IvIK27@)@Xz`(wbvIcI>hx%1^oB(Ol5z3-t{$EY-?|TPD+UXv=T4LTB z&OBiut8v~l#$<}hELd0C542A|y$`j|_&C`NvQ2Ees#r(g#gA5}2wXAGdRHk4JC~oj z^TmKsSqy+aE0RP1G62b=Eq*n1Wu_$!jeot8z&^rJ^aD=UB`ZXU2NDLw%DU#jz zn0wwI82OF}Egz&DWAi~gj<+-~*F`L2y{2nl=FahbqbBJ3|FSf^-hvJqog}*gfUnZT zwz!L0duz6r0jX7k9)$dTOeS9-K7?r*zuVwhUN$+GK`{yUhnUWnFOHPgStY)qf)?Cp ziMK49lT{Tdmwb+037nkphP^ijKBlkv1w=izJWm(DA2aHY6f%X+PJaBzlFN&P?c3G8 z3!WOUi@!9cSs?%>fsUq5K$=PE+`ukxQb+u!tG_r>VeQD$5)_RBSkq)#TEAPSSB6N8 zJR&JcfG^;5{?_ow88O7I{k%hh(Q#ZpJCJ%PSi}!>%5{ViGGv?grQZQ#>V$kQJ*&0D zmj333K&C~<*!ySszUOyf2@ad~VFhdje;0+|J@kEVdadgX(`MSmH$M#oeID|+)4bNx zRLpgc0qKkfP4ig^TSLZUu`cuMAWez0shw2x48{$y#*9iR>ZDxCqw?55@6#&%Xj&E* zguOf}uDBVdZprM}Zl`;yV`NJ`KFvvMP;EPIPW1H4Mse-IGG&8DZd~4cQqpxNw$;h9 zmEJW`F)SC=bR|F}r@nnD1y{RnUTx-8r@=1p_kp0mY~!vGE#0~V`BP7jQ8SBNwkCKqbYnc zKZjKYBw`YTI`PP!G|&?90rZJJs_5DWt`!=#r{eAP01nsTTWi$YEn&n`rmwe1 zpR1$P!NbCmwy`r-7IJQitD45SFNg$h>t#!*X5gnH$r+@>eQS5$uo{2<>8UKbREOO| z(&@aOe;B?lLUi;XHyX1eQ|QWkTM1!ZJtJ{RWKBdE2qS!0{s^j>U%{@)naskeFklpq zT~V1(S?Qx6m;WKTQtzDw>!WE!*(Z4)KGs+2S>e;s;Yj_E*nVK%t-N*TczJobcWT=$ zeLelH&`P(P#NC>^%Ocxn-b_%PK)T)sJr@a1;h)6cxON1|>WrW9sksZ<7wouwUr)Kh zU)0gCWezLwU@SQq45pHnH2xCrRHtPz9{S^gTx)2=)7Ez7ieT|rhFI}^fv5lseh16b znr<#s{yn8#QhT%;`h0MO1HW{N{L`F)A67+ytclq$OuxsI>T67gd@0MlHAaq6{hrqc z`X!+!UsSed>VsI?%=ql4l0d6WrmiPIk{2r9JeLeQj-5T0<7a-OihJ@dhJEW|&+;c1 z#Yk5d&O!n1#Q95qrw)u;mUlB0&sh^fR;4SC{mHFo02x!zuxg~ZZo`E7li`)7`NfhYsi?$I)^6{i|MqMvlc$7UP{~9OFJ**HHtoeA^ zv9LENwGKo01SS=T7mg{s4|K#zEJ!y~1hvQSMtmARbD`_SN=hnD8@n6cwWb@9jk#ah zs;wPFoxr@o5u-_sKTDfw4tce>@C>e9qZCI^7KowohJ4r70rLE0zUV>@NAdJ!!`7Y6 zg#yopnu23?iXiL2FRD+H%%y#U29P|WfSy$z^p$0SO2NaSoN=K=<(qms#;7e?COi)= z$E*t4H%o2Lqn^A)5!5xynxS`k1eckPL%GWaa^ys|Z7= zxu2IHK$DUt-Pg{C%n&rRwS%>xWaSm|T$}j9LXLrZiu(FbYpg^XTe5Obg_~q630;Jx z`!0U&IL1kA3Dnm0g>GxBAwN_$6ValLCsYWIo?%UW>UxF!zJj!k>45V<4h`%44i{b1 zk>v~_{!xXmvk8T+tLZ>Ix;B~N68(y|DPcmr5!`n2=@9#m-ZTz{2Q?~}m)?7~PcTpk z90>h**S^$>1&J9B8^S{$8RLsREnk{-yS!Lo!91scFTDgA&J3q5j)we|aADZ>G!&1l zO3R^OK$J_TRHR$R1o#v#g0Qpp{k*_Y_;sNx(h3Q^1�)!0&tU;~T5q=NGJC@b*1d zMAzL|Ssl0W5rOF355*`2xrqgWFX{(csmYAQT2=7M><_+oG!;CIW_|>*IE|O3An2#@ z^Cvdq3#Odm601&(s5$>s_evu7O)m~18MWpe&f^m^c~Pdq{^Dn8XW zjD2*B#K+GUi)^h2^3^8j!I+vY&XVrCa!1}` z!dA)4l(Uf!@MqxEF9c24VEtf>xs0m#>8)KfIeUA10#sB2l;2ks9iqu900Z|UV3k-X zd%mPVcfZ3DSBFwrS^2}v?>C4vpv`Ll-{ymn*7=wah3{9K0WduK1>t4FoFP8GB(eiwnd+H^h9{a9lDnd$+*;Nf+J`zyFN|FFYffh z8aorn?LEACli}(bN0C&&sj{fdsw17s%L0n%pk@vjqeW`Ve#?7r~wfbRp9T zY)obXsLrb<-YiBh-)^3pz{G3>%wC|NhF}%%bW(@vDfSw`bKh`<)=j16)@qJ5^U{?{ z>^WHnwUTJ)1E&ICw7(PYBZt zl#WJH-C;>gTbCb}iT8JxGoS`s4OXOv zuVR;PYG{p!-}IVI+MnlCdvKQN%r29CMT&V26$o z`yW~PzqXoS=Q@N7U!-tYfA?@qs8h;145!FQ5HZ7H~dnz8autFji(d%PYyeOfDN+S4CJ+6Aq;6^#uCQ3(S6dpg0 zk<}r4@(@sTwGOvG$4;R6l>_;umX=gguTp zqNqeF=a>U-{Ci$}@A*=RgE>4803`#lD4SN{ePkGLa^ec|u~fT?PtPH`8X9pQ(Qf{G z#umv@MGAB-xdSdXe(E_jr!b`C!)P&YGinQB?%b)32l+IKpw z^y}@OMYGme;L7F=$Ldj&&w_V0gOG3FCIlE79`#FvRSg1|bqx6WQ z$SCA`PGA9{4**l6;Pq&Ff7Oq#FAnS$6BG8l^VipOi%Uz4M@jMVvLz)Yyv{!~_I7vQ z0be;hA|mVS*Zbt%u-d<>Vn+kQ)pwfD_~OIFI^VZBL%6!RTnY>xU1g;ZJ42}wA%5Y@ z)X3-Ws>{XE|J);sOo)Em>3h2o@CXZJyemuLWHB(WBnECDcfX|^7@QWbl z9_)x^22FJ)yx!-o!VYsNjEsz7YRw#V&#|suyVZ~(^{)i^fstj8`n0`6;lT9g=mm)t zeu&_jOg&$@mL}rUx4r`KKp)Mkdc!&2(S0GAxU187s2Asb!6{X^ax?|k8)j1wVbC0- zP~hTdNU(ckWLSO@RR<>D#IQ=&P~;xndBlV#gRi>w^q zSx-LPZ&Kh{>}DI32L=WX_PV&$Ka*fg%{1ZPt02L{{OUFysWbK|GV&VXUVrG3P*)Cx zfE_IQ1E3}mvcBIO)$GIU$#vtvNTcqya<2#M7uV9@o;*EJU;zNZp^lqgYC#> z-!&#Yh!$40hUf5)57ifosHTGnd+2PqFAPq169r9=h6^CKo47=Q{hwK^ON4*W-=`BXQFQhN^! zTIn80^kEAAJR6M@s5q>n27);=v!}wenbr_YeClj=?N9yY8D4T#cGE=oWy^gTs(?Oi z^cnfe<1)H>()3y^7boR75^0Z8F`3?v4v%Y=f zo!DIwH=R%woiWHuDfn3BB(Y`RvYWvP%E3F- z6X0u~5%=F@GhD8)I(Dy7@Je>p`0>%#R|w+AN%K&P8EDIIwwkYxhso${F#XOM)aqOv zv9Ym+Ll(;dEM!5PR`DTJhtoQSy@?IoNIWkzJ)e5H-|Ze7mRjI z?*8@ufd9xe=K@d2P;ST`v(SKR^WT2Jn4Z9{FIO_ICp*1Ws!&%kf;ox&Sj0of(c*|f z-k!VcR}=X#4?~Fx6l>L06OUfyzAWqrDal#r+-d&y_mJ`5Zi%l5!ENT^=Ph_n>(eF; zNoaqM!7fbaWz~z)dcCIRe6d{VE{eO0x1ZKOKTKaK@UgVT+8W;cc9G_pgzYIvqY2!m zN2~LL{ASrpb)`H|e(>2zbcmTCy{@BJ%($F)sBKYtnb-63IrI8spj+ zBwCZi@D0U8I##~BFvR|_YdZ;<-{0f=_l<8Zp~Ksg{6nd{yp;k+nz@2zyu>5+4{LSm zRqDs1-*n}pD7((wL&8ZM$JYuOl9SkAf+~n~a*E2lmeGWYo5Bt1X@}>|(-=S9lS1cn;l1rxIvaMjUtV z#wx_I%qQ%(X8%2*k+KL=tN4+Sla)tXK~&=LFZ_t`Hi=qfy3BD(D=VF{Pes@#JI9n7+#es& z(_e4LUwyya#J9FMjJEEXzg_#PHE^{rvHvK|quWj!Zg4Qn_Jpo#NZoe009X4M3)f|g z>3mBh5|2s>QG_Mw>b%|@(D8fyeYs!;4W4gj+*YV=@>&px?I6%dXlPUcfR6!0E4y#B zk-o}$({&}HKk_P>2sL17m?@#?Z&H>Z@Oe&#XW2n-b6&0LWH;FJ{Oz5~7t2%VJhQ-g z;p@?#es#89W3wiZtilmlVcAq+>tS0dg$DG{3UM)WZqCH|@G4!%%WaYS^3iG8X|=}> z7e3soMR4mjOx$y|9n0i8T%CB!7RSvjY80JuBJbMTIT}n_;FE(*3R#T_S)Z(+5##H< zv4%+RZ>A)xy%)CNeuvx%9hIP85+xmellC3fU)hj_P|}$Xyq8^EUuU0qW@`G-#)d;V zO*r1u)02gXDR^OFf#uGf!G-H%e*$gbD7i7J3Bu6?Ya7Fk<48W24*O)-eBqlsix+!x zXb9R5Z?a z!~#9CeetEphKUUE*-jSsYA)aUCYhlwOXO^^tjUm8=eqF0u(!19QoP}#q@FWtjjWe# z(eL~7kL#p1cMCN!Ms&$nI^y6L4Su= zeRMm++C~q-K7zi|4H6?j4N3p)HV)hXWJy>7irC2)@#v2^0RH&gojz^(!m`D2ceb^< z9Z%cw9hk50 zcWA<07hwGW?SiA5d{}sM0NDtrz%Xiqv*|G6Wgx^v7McMlZ%+ znemXYX@nZCO~$q7|BYxYpNEmjhJ4v{g05lV14ULkVR6?q7Qi&b zfmS|gQg*GlrY!URxi0}}$s)Mv@GWl)WAERA!dwFs49t`RDI7qJb}(t*7#0S&Lu2de z>f#=B(HE9B$t?|j@K_t*;9I&XTiZl0JvewFb0rZQO-e&vIkXzIxp?+Gi~N$}Zhl&- z6~XDpC~u5ran)OMBMSu|(4GX=!L4==#%7s0-&&O#POD7MX2+L4K8&@y(LC5A|@XFqnza)NIW2cg|IawDw*cTda7o(~kw$RF=hK)&iB&iIv z0IVqDDs9Vjm*4(yDZ8LEcy5js1P)21sb!C99%Xjq$64oTw9WQCON$|EVy=@rW9lVk zqWe}C^NPcUhaT12wWDbrFbW2_#WE?s2M&@t2%%HWKFv@Y2=_Q#gZ>Rx%^^reG=j;t zXd2ayjt=@3huH?NR^ihRT4d${0o$?^r4>WKM(Zob?QW8~*y5!|09#DcOf9f73a&a@wtL&Nc$uBU90JI3(TXyHhwnlF?7f$CWQUdvK@B-E1f7dLHm%Mt)`=sv~20n z%f}f+Q@9gwhk@*rF7x50(+Ce5^W?2BU-=pAzNAK;r@W7n-qMnLmH%c^uW-aU)9riVf{q=1?gB&pk;54&7a^$&Sc z%{Psr{F6s~a@d~#hYO%j?98=k_l4?S5-AV{1}JTVuyhZWSAMVtS-N^y;+qx=tduHU zQX_%$bgDNo6lLwC$MVP^1i2>frYp!)i3}_5@Qi-SzNHg5I>4m1A>pcXbdLVC@8O9Qm6{eFqRBjoeq81c##S1=`!PsKvbIy0>_K$lNhA z|K?zs@G6gC-F~W?&U;n}N)he`Ij?G3A-c!A@3~m9SMy?hgwrj)-G`z4U3&&37(=bW z)2&t9+cGi{#7|r;z#X(GDFV~EK)avV2P(GT(gl>`YZ~ZI%N>c2R+Rf|N46GU7VPh> z2P#jl4z%GvFyXLX{NZ)7>KHy-t*P60fy}K+f`l|8>vrSU3F>1rGbXRY9;*)~7oR7f z`X2&%*^d@IP1R2gf==@H175AIhoeN~wnx*Dn*^U7Z>xfuRu(A6Tag(JO()HK@&Lim2U{xg{K=1HlKcqQ5Cu! ze);(%a3*5e!FH1R;)d^y0N)UTInQAuufzBqW7BzNR@MiBdrmp094hbsRcyS-A3`7T@V3VM3@;Wikdm3{| zHu{8%+F*cTBQS<`P6bMdE0XHqN>1v&Yl4jnBU%P!h0aT^j0-Wk(#CSm+AWo%&&>u$ z8&{y2imE{AgL_5(w@=DWrsJ@9PEd5X`z(fU^P6s&|9Vdud0x3(0F{_FA6~Q>SVc1! zn6(!#{BlbvRf6!HQx8fL+n*=!gMgHELc+RuP?pOx1xrIgat`c2z5)ttQ2@1y*oeKL zWfXTXz%wfX?&+(m=H+o%Ytr{CBCMc4T6y(Yoi@P|>KUwFT<(!$pqp{RN8IWLCV z^wk9fhYs41@tMF^eOnrX=mWZ!OlwuCI1zA`8Z2aLp(njca(oWB%yPJ1Am(JtE*$b; zRNk`^i@|T)d|A4+N`@t< zySsppRd{cIpO}yzwAb95PFsFe^Y>(3kMQkk8Ksx4+hEESt*)xgy%a7k7Ir_8rH+f|rTo;De!k4af+-6+WAkA#@cWQ; z_FF5FV$Ql`CVe=mJMKMRT92z;A7Bey5ju{!ah*5yobbqWwAVh{Y7;j6&c5`*i`Oi< z*mvE)Gh40sxz}vAP`UkrL5aBfo~JC(fI9{dn9xQ|J9WbE;6~CAYh$K911c?IH@?LQBHR$#)_aEierq zr8ig2T(=pUz53x*t8Y;q;D7xrLGugH_#jJl^>-_LCA|szb3%nJw>Q!(*d_EG-g*cbnQpT(Z&Ej}21-8h zpV+Tx=+SLnA7-NGMM15Fr7G6gXnXKhW=OiX;nLMTe`Q}&CvJnHS)eCt*dp-nasB-b zzG%=BbZwOw2SDV4jgQaF4fhy0c}A$UUd%Bw!A4mV;MDnp)mh2iU3gc~9;7vt##F?p z$mL&!L1vD`g`3{{ zVo|so=%_DmA@IfRfKie@uK9j`oB5ACqW0a|X{Yf~13dzvV#WX*q6}Jg-Yv97;Gn9I z$*ZfYvkD68+|2}F*h!nNV_8q1#m!CIvZ7kvubrKP!@w%HwHw&Cqr2!aA==+Wq+j-O z=m&6uO-h$Ud|0r?S_@uT?olc*2)JM;@Sy~w7@Zw#etF8p4-o1y4U^FCff(l*K{uS1 zhu%7kpE|gG)&6;y8GN`dZ1Un7DpCYbRp-DBX7{8Br~|-lAj)KxJbu1`kVsu7&MBt#jEQp6=vC0+DEpV%?w+YJ434EOYjhNBW zowdn63+YAnJ^BV*mAR89odA8>m(+ zYp}&Jz44E=c6bTd5W8dANkUg=W@ZLhs?RAg%;!A0y*~(Dww(xh(*l8 z$QUGOP@KA6_ApD1{+K-k^XT~an1$)~pCDc`(-;P_o1Bjp4gEc=m&GSDaf_zv4S633 zmMan&6;-tHGZ5aNDt^q9`-0fko}PZC!2cR40gD>s>yYgYpQaq!1O0QeSd7M^+56`u zn!=(3;W{7rp2s*fltz6$vsz@pos5)3jE*L%fSFNs3jY579|37ca?g`5BU&cA@iMuN z)WB7(jJCa-@6{`8){SYhR5%p3KQ?br+WTPn>A~yR5!S_-A4?xL$Cb9ybh>?YYG{f5&?&$Q?p<;FKL~+KkyO7yfN9y5U;NR(73mAOZfC-xc=H%Og5L||0G&Zsuxw`HZq?pwSa-)=EQ_+_8@t~oAN89e%%N)$k*GI!8m$U=Qi|Hf147_@2n6m-&{m}qRMvUy>vT?rHv^Q zPpG@eI&3bSANT0+uyPy&7wFv$hD>kNw)FH|uJ5Kd6rV_yJdxd$vK-{+_EN?e?2yiE z^PCmt!5o63$`BgQ?*P<%E`Up@1N*UASp<;r{Aby@xi~Q`?d|Pm`eOXA(P^_LRtlds z8HS(x$SaO&ns3VYeczd7AWu~siKg#mT=y&{g+?mSa&ku1)z`~5XphUCqJJb}RQOr| z60?6F>QoNs7IyuI(%8Euik?d@(Sc?WaD!ReCF*Y0hEn;B_sSB3_gI;2&c{@pY*)Nl zwq!wJ2^1aGj0@yHx@T}L=!?lXe>EvGVUBREIVaIlz2OWbhZI#cN@Hhyij@s}xuDN^ z?f$tGk18$Cyx~{3ea>z`sn?6}v@ZlgR-7ma!14rgE8TCiUf_a!wp0KHYnNNm*M(<> z?NUDfYE}k^(>>E<0sC}Uo*<)!k6J}Ho!16~7QTPCoc`<#G!pZc=|6tMKJ3erzyGC8 z=uq>VanH%H%$C}tq4!mv9rKEpCeEiHgxz6fKQ=$sVxp3152>ax;Bj`-Wb}73Nf-W{ z7ul=-+|JX?AsQ9wxd0**@OxPTDs`<%Nnwb-J@wZy#ih`OL0oSY7_-4Yb`-1aep_wU! zftNP)C;#?6PHVov(E_X+$B$h(%x(s$x<;vR=*e!Nr>KW6nSzR$2y2UH4RM1M3N%$( za((+nZ<=G0D+z%^pzqJ)+4Re5j4>G;Tku{LnAQ25b`S3GNnzjekk6)SJ%o4T8`!t`_OZndQ-T^YPb z{_%lhErAl*eJ=CpU9+UT%V#nT+Ei4oN}AeG!R^W{bfM2wj3M5yK)#Wvd_(X{2vFv*EKxtT)^zx_l_$}X>lw0Uhe}`)MF+!T2)Tl zB`;GryAch|gs|m1>F9bRx@tDTYY$_Bbdn{d!D@1yYtgTut0?vrC(|VLF(B>F3bCko!f}v2_><#XDD%T&(Ku%4zlF&iM8U!4J;{tM zl@DT>Vj3GIz{!jl92yEkXFCf21N>OFAiQTcQ^(q7zN^h0w33g6^u$LC(fEw5!NiW& zo3B*o%-jB(nvnDhg>RH3J>UG?k!t#7corm3>g!PEHJMDh?E#2qUFT%?a49-kla6ej zDawrt!FEiGXsme^3jg|Lle%41we0@YN}H<+24hJB@S5ASZC$#hSK_n?{P zphm!L7&ds(y#mS`S$J9N%OBtW%soZ77L=@BamDs)FV zBzKrNIh%Jt`^k$WlYBpz!`M7l48|Q;&Y}n^o)mZDpz@CnO(b~1l?Bzc!F|;)Wc;_X znu9{xUr`aC8iZWC@jeoOdcifocXN2Wx5~kT;ZV;{2Sw+N@q&8Xjk4U&p#rd zIej98F-(P8K|rDQsc>sK8Y{pz9roK|kBgb&5k^BGM*w0n`yA_A(tgS$!$F-AE-0bg zh6>ghI<7G);LWadL;AGM2U~Rh+>I{O(CbjM3nygjWbpFP$AnYeF+K=F9`^R0OB8G9&EbeRw9o)u-S5>b<9&{m_d~&@s_VyCxAbj~s;Rj;v{s``dq$;Vx zgI?~3qn%tOSbw#TG4#Zn{_fqOmV8jnAj(yi{I`A$JOGyBRQRXccxS(zu1FLdeM)!N z$qqCZd_+2&n0|9B7?1kCWZHJci&*z$tdpPa)^-uW;0Cv3km`V+ITqCU&k+Xz-OfMx zqXc!bz4FGexH%Q^G8)~Cu(Eg}P}>1c9l}gsU@MR8?#o7y_0$ttOCnI9C)*bQZ-*=w zP%38uxOEeop&`IHoSvSBtt%qy1{8>ANq_U{b2%U__Ib_kOF2?YW@i55_6>RKK0D@B zVN9zU3klLaicBLo4R7TiGp2-`G4;@8_hi4vd3ifjo?)57ch@ zv#HZyDND!uH-tD6BxaM5RvBfl-f|@P#hShsOynqgXg}{1YQ)w8O5zIdq=R4!>tfU& zZ$zNXTH8!j$MmKO$$<8B(ze|$w*L>t;eH*DO<@+k^>3AqsE0{W#FjU#v4caq@a z!;)|rCm~SP(RpUNn-IZKt#W>J*HrWXFs7fa9m)FxfGLRx7Oy7G_@16!a zb=+Za!|7#w3vG}>oIpXHiEfYqw0;HyIsleyDhdkphJ8)!i3o(`JQX|H4*tJU;UY0G zLZ?u&W~9;doxuvkfQHq-dRvW_??0soF}H2QbK9W2}& zB<7E29)GPY4HRuiX>>z1J?bZjpC>)omC*ni9)MpEGwQuurR`Z|?f=PEr9bf9uXA^E zV{QALXa9M)&aX#M(#|>Cyt;P9+TFU!Ewme})FFs0KjH7-=*%AzSb3U+b|> zg0*sXu;7Hsv8F`NeW;kKgJUQ7^B{z;*}>{YZo{i)scv)n(_3_-Wj?T^8l1} zoBZqezoknwQBqBf!0{O_*+-qZ`@bQElI1Wl&+YdDyYc9joRyXsOToBHPZzLU+?#e6 z2^Ks#qP#_?cT};|kqPkEC@tEUU*1t57v2@(H=ug>4$3NDkT9r#&DecvI9^tfzc~Lh z`WAw|s(|cyn|-r%Aw2Fl-l?%unggx~0u0wSjBlT#2M6!)`Z*i~p(qDr5yE^W{fK>c z^yWfPh<}MS3UF;%vZA06KWNDI zp!zo^xiK~t}8OR;gB?E#aNOF*$ zN?crAC|8<*6y_iIYcBw$W%N8VoCoQ{Ata$z8rR-cI#a((c%(BAP#U<;ZYViwLxh6H zL|&G%D0dD8{wKxuYe`-auo%_}?qdE2qhKI~vQWUz@{|Vo7nx5XJQr6HI0a8BZaZHP z8Pg?5zyu0spN78uoyGdc8vNHX`1&#vvTQtPYts6=ApgAat0S!TIQ|rub!s+)QPQ8{ z)bRe_fAcNFT3oq^C|mi9KR|&VAf1q(62ZlPp7z&c8%WcNi>HGQQ+ZIvXgSr*LM8%r zMdW+6&0|^we?1j=z2kS@;1hEkfb_zCU$3#|hMyy~%m02L2NB4uya!1)!1YIow5>=W z8vvV=O+Nh#I6#4s@S;vNk{l2sE`R?!;x3k?=VAAEyn_GvJOmd6B*q?HE)gw$|IY9e z9RuSLh+Q5(&E)x4Usbet=9#-iOQM&dF4+K_+VkYPEbYjbmRo7QqP zv9a4|05xh`PWu_8F@XC!2nq%^NOgMDP~-SLxcFi8{>$OiQ-km4jUWVZ8s>7YqQM(T zi-|EAYa}(NB1lzSevrVf-FuD!4kj9rL+b_3Y}M-8We}Xs)5rx>>CvcnJ(%1&D~McX zM3&t@%}*4rWQEiO___iAp~vZq-oGpP&rOs1WoFXuW^Qdw*J^xJqf_{$Q8aNTHN6E} z-rw{|VV4ajDXH!;@Tf0(YIiPGqT<^}=up}lTICwmHwJ6*@UnGKEF$^s z%$CuKaDn$b72AlIAL%b7=2=IDRZE8M`-BvuLq*>L<)bS8vlyV_{^z_nC?H@IfT5lO6f;Uc)p!ueh%@O=9z&aE-Y7LA~k-))Rkzisum8WpEkdYpvs0$2zdhV3hkan~b--8n^Vtq@?cH zOkGcpT3EmxgP$voK^{H}9fhKF#l|NJn~on5ry+o1OeDK&;l{Y<`=qS{TG4wX zFP~|ViaTX^Z)51z<93)U$(|>g%$8B7NmrP|5yzF zxRt-%Vm`LD|B36)j8;Tk9B5`Vh?gv1&tJaMk$K=2!hf)w3~7c_-+GrJ9?zOJR?*bV z9B2$$E2VaJzB1eIsn}e+c+)&rSR1)G-7N3wdW-JDmf!t&)0SE@pRlADKAhU5o6EI1 z%j>yVPAhIyy^?y%f1i^7>H5>tnbL$JOtu_xJ+Y9tGbPGH zv#Szu%!eqdyIs0S@GDuQN3n7|*V=gwDFJAjWpdtdc_HnCp*EaaQ9hffVjAtt6#9q{ zj^#64pyw!CxlzShIQrc--+pLBHD=i$i7U$@G!vT0a-2;AUe zAGS(Kf@#XP&K3VumrdqR?+jdSwM(Gv;xS?}y8Qf@Lxj*U>2Xi!F++%12#l+3s@SG1 zrmb6})+d@Vq-&p3e5k%juhaOyw(QU zG06Ing-&_2k`DBITLbFKrgFPvNdnZKMqW_(C+wm>reaRRaaeyO2~z$9>kn`k-T+Hv zGSW+#tI8(gRy~y_%3>$%?;ssTpY1f|p4=WqC#=^Nlt%rIdfYivr?N6ESd01pT#kH#iRs|Ym`#Dc4boqOwZAnYm_yp7;{!<8%v=)P! zB&dMLZQDB8#R((i3Fk=vw^wi#fjrpR+e-u86>B%)69&3Sk*UjRo9NT(d0uOJ6CP?e z`rS*1KN0m7_Kd^_FE6iSMZ)sdH}`4Y=4iiO---pG!ravI6qEQp5Kob!s^dFyQryRX z<#|pgyWmXsCe8Z?dVJYu*VBCle95#W@&JvRh+L%xIrFt&B`6LX6QB7n7VP3!b%^)| zPEF2ceUrcDM94+1N8N#ZkWFR^ObQd}rP`Kx&;=E^%*W!vVK>iGI%^P_So#=i_cgsd z#Oczi&Uj$mXW57F+~&aTr&$%>O*AD%M<$cG_+NzO=IWay#W;!&iSEZ8lqD_wdSWpm%ZoYe@emoBHSVl$6`muiPdt+GHQ`y-;he zi%WRrDbc|nCcb)7)oNVoew+mRb+kJau+yHH`xYJl#=_PlgzYmK2e;cvPEMuSadn-P zTf=cTs)35-z;a7cJ9lB-NG+NT<(#l@NQ_@mS3F-iOHec^`;Tdt6`BpREla1CXwuD(0ty^t7bR}gGApa<_77qceZQ> z*N>7tWfhhR)M_eKRKM$()_D64SN`%|V2`A^8C(AKV0zCVCp+Sh2pV%!uqJ{wR%6+P zM>UuPq2?{ORI;CkiWCCm=KcVQcaMtZlS=1#}|bpHI~^%?ma^!siGJfJ>5%IhekULcmc9>J#xZ6QXU zO6cfWT@6-vvoX?&tRfO{mUnao9?C`tK+ePv7YCJ%{tqXan z(uM05RsrqzHGM7D&HxRi*OHb0Bqb@C zT3wBro7}|1LdPa!qE{%t?seW`+HI9fpX^cjeu@x*j{uEpaq*Adj~op2G~~vAsq36| z+AsU{HF5K24I+fN-EyQhdOyd5T|i8w4NvVTj7v)`vE2alUWYZhPX-dKv6i2%TP2Js)=!eQ(g3pfx=80AEph!)p8pqF!2BO3Cl> z5hk3<_wUHyAGYtG3ym}KeFq>ua<3C)PUM++2Bwn=B=y^>briO z4s73{4WQR74Z>%*h$C^$;UBz^YkvDk0z9govlQ}VIFv`K1fOYz2P>;Lz!Z}{C{JD9}kNCK#IN8OF*IjuH z=b=L_EdvL~)9)O!TQoCEK1QZCO{XZK)xR1p%I^OV(<1bC^UOShu)twGN+^fq^o;YX zjHkZ^xhl<~rh%8^oVSe>=bSi+i3pG5g(L%v*N?m03JfOVB~TS8gNRvVAa-qZv0Vi( zqo0SYP?y8wmC1gL@ey+WFJtuYx84I!^z(^oPO(XMZzEUKb{@VIspkQiJ12w$c6g-k z_1>AhiRg0Katl?-X8a}RAHQ@Z#UC2R)CYBkZmWHx z(Zfqy6iG>~9`P9B^7R#dW)8xK*aaurX|`+2XIhgf7_HR1Yo_ckGxVAXYY}vfJag{O zU&Vd&=xG!TCfzS?Cy)YKeI$beSS?@ACVo^@%>F?KTy9%)(jR8*d0|ix!Ep42lRaJR zekSOo{-yDCi}31+mS_@-uXYl}X2`ir?2*^VBh9M&Fn&`)nPes!BM#dCF>wF;dVAk- z8@IhK(jofT5frJNDVY>zcDH*&K?NIjWIS=TUqYR3am7;;yGZ2}l^fj&Av)j|G(70k)U5jo#EL_2R zb0}t?mkS(c2MZ9YR{SA1;z~p8+r~m9?ZAZFjQ@$i&HZ58_9U)~mW~XzI9LQYW5%nV4NIvtEJszYcgd=?eVg1^I0b03T4H65p7ziC zE>EP#yFQa2f4`#RaK^u<=hI5ON5(L3!>LK9nd&l%cJ>!$`FkJY(q2`lX?Y?<0XaMU zcnTu-Y6(b(mII;oT=kk#EGe}LQ>!X=m#Lk_`hq+jYXA8afS)#98oQ*^g0EQ!{N7 zP@iSwQvjeHh&Tb+c6%B?XHA;~nlvKRUqE?pAC4UF%Q^ukYPjG!$k3OYk20H1*Yol1 z{dgwyJTN#o3m}HC1qI(@1*6?16a*RlcUdHlA4>zyWpsag1pYc;R{6Y!X@9@5cYI9n zRR$z-#etXg`b@pSBe8Rru`QSjs$jFAt~=|o@FVnXfhwDh6iBXo1tv;A7&yC zd|n!%N}Nd11*5&|F_f<|M@0Q54K`_!30N94*r-G`pMGfD zPKAs>KM@IdB-m;O0#9`&%*^kZqbgJ}u9iJ#`(CGokzrxABKH88iGj(DiF$V)_v1+? zd69N0q4%48>1aOQ6Ve}7Rt{^PY(`uT{RZn_fm8zV@^y@YBC&hvFHz1F0`X-`UUo*a zLS$LpS(i~vr{GLHVnPc45&Q9Bk5pPbPUM3O>9^-872(gx0Zh_|@q95_>&~tNkTC%E zND5N`UW|oJK&L9Q7V!`;st+#Cw=uB&6%wo^U%kQ=+A7v*@=js@M*$_ys=V_n55~x_ zFd?f31Uui^O1iAfx{huF3I_aIDA!j$dEi1k^&UpYdEtkx;th@-ib8+@53s zIoiTfKRS$lg{)Vp00Mb~I6G{Kp;63FDbZ^S>x>E!l_dcYA$vz~i@FnaaDp_b`xbI0 zX4dy>^s``Y>&{t5mPS%BGJZKb+N7x~77HPf0gB%E4j$-@Qw@ov9w#pogkAZgCsylP z)qx377ycG%=9hVnZ8wZnse5*?`YT(G^lT~K%2p$=sj<;k!*hS$qZym0OM`|>{zhOJ z*LL2?)cehi$=a&X&4euaUpJ36x=X`D;w$D?gB`&QN1ogi!Pf$fp=FWCXL#`- z@qee5uVxOw5?I*SFB7>Pm}7qcDViL|%`shKi~!K^o4~=tubCuXz5Z;C#&iK^TyU9bZ0W1BeR(=&Y`Q_I%Hme%@gBjWf7U+iI)B5D!GM{h^&h zL?J+}Bi4X|8`>uTro@~fFvM*th*ThHWIZmB%aK_vJy9BTo_Nr>4w8ne^C1FRGc($| zPK!A(G0y0TmGaiN$e9oUGjUsvZW(dAh{fsN>>-=k5bm&v-LS6R@HD)d)TUY1Zdgis zSZGwXo`L4aIla;7&m(1?q%C8L>49Q2=D>O2k%cCea2T?96LuW;Ep@X=AG-!mVfYcx zUDXBtpg;nm*N*zcNmEagyED&oeU=_Ag2K_R3fYc3!IC|sYN8z{s^i8cMrQmYe-*%A z+4Ur`Z{y=?&Mp8|3m<6;Crz=Lt=d-6*0;KKbOSU;O#SdlIJ*?By>`1^dZXpXloRO7 zgr`e)ylkCUdQ9OICaSEdl_B9c^Yo~7hTF3iqN4`tdj;O=6%B(q^tUd7zm{2Q$p@Z> zEV8}jmdpFnPRn0M`JS1ygz@H|UOF0cbqjk>?GWFDW*e8lvQ=}Ah0 zUy9jn=vRvIL@&($xb$4K`$*cphvF%|$+lMW+^!KA?)S@B#SZtFoCF%}J2ixz`LvQx zMH#L}R!eCzWTbRpqGAsqrTE+TMr7-gVrrdw;}fH{&=-(vdT*kd(Tv|QVd`Vxvtc9g z?VHW_cdtOWEBMXjTCL8!Au=!2?|Jqh@{MAls?224x(qVm!;iQnaT=@`U;&b11Qy_6 zQgGcVmie{Z`C0KSk;^XXVmr~~SJvjhuW}c)N9=B_U}dY0(r=qB7fv?XMYS!vGia8+ zGI^$?m=BK{X^I->o%~8er&ceupc+=SU*|jxnhpzgsg~oAdejpAE!hgzlAs{ZbuOnz z%h_?9HfdORgD@cPthAbR5wY`@*J&%^Hd$wl9OQ6~yb-G`oAQ{?e&tL5XPDT)z(6Dc zvr3%-roe@@7CkNhuCJZuTB;k+XFC9kw!b%3_^V!9@C$_{Umv17AzV8jS&m$_i@Je~ z2h|ZXO1Die{gSgarHI|eFT_NJ<+{4=_{e@7scfbBsQk#!Dc+@#pX`q|)dA5a25b4$ z;1++hG9jn)PKtTqPBps|yepArt%2BX{Lqb_O7Jz3I!t(@vXE?POZT^on7Efo**uyw#3c$=$Ea?k9er9SH*1slAOWl-@U$do49~E+ zM)KsYbFPIDva-Ak;JjT;yWO32g3N}Is@bJimR)NvW6QVSj4Q;BosaNcN*_!rr zd3g>^a--rWrqC%FnXk5<+!!b_pS{_RnT%8{0q`2m{wO$FBdHX`2$G5tM01;1YL0>od1!R`j+MLwWIkpGoYAY^uFLN#30;~xERC5jC&dHGC zV$-chjVuf6cP}gBz}(heK->2RqY{@2BZ+jU`eE0{e=>N*ju&$9&`sj}K>7mvJBrD$Zc&F&NfzH??=ckkmKd$_Vf#J6?O8h<8qxU^K;=CUWayl?9!)C z)1LYG4yUF_;br<#imt|X%Sr3Bcx0vZqu>>GEP@P}ysa&B0nq)w`R*=mUh?WhDD-%P zhMY)C6h+fT(vsSH6of_ri`m?~FXbHE6#XjcR9PdZ?lwpb7+&o+$q8MOu1U z`hv9tQY6WrfZs)cC@K2pPe6{O(W})H^}y=T@m6_D%wibC+y&YW`@t(qVMMY{tw9fU zd6r}Iv>NKMOtWR;UwEr^&$rCc5yV=6wpysi3A~)%+Om#m>G79(>*`3)5(ZS4KcEN{ z1L}V5P7-@tu#b6c0T&6;p+v~?gJmT{GA;gSP+t0kw~-hz&a_suu$0Z61;P>_lJk4A zcVNCX;CKruB1?!)Qnp^9++MikOysJB_{R^mJ^3&d*TnDDJ_4P6T4OHZe_wsoO#a5Mye0bx5vZS?Yx9o^d z%$F!}kMwRI%%+=tW^eJi>A46+9PcU}SyCawf)94l8hO9DitAAZ)RTR)E$jP5?Ps!0a`0?yB@B^~K>WX|Y z_)|d#JF3m6$(vN0wai_yY>Dib^^s|}LQ;;W5+y*71o<(*L{V{u(qFn_4}zSWL$I@^ z>&P3KpgdL~V6eZDqdFoS;9;<9efMu$M^b zW39a#83;|5d`A24oX1uCzQE%ppDCp>i3W+g>N|cDWIpl?M zAx^Y*JoCN5yJ~H?L$SXrK9<#{k+Tdk7f;xYqLvjT&~;(0TF6cWeFaKCsU%nvkNaNb zD)7)Maj0ENb`4&qK`wzOr0CYS8-XlHz{Ic9>c>@tW8vlw7&9@b|6A@17t5>hX1SK| z)=^usN2=B^{KZ}_yXmhlQ$)wylUilB5H&nJF4gAts-|)3c+*5;&OJ%)_TqQSTC9wA z+s4Pm!OwhaOA5~0!NCj}}H6Hr5al0N^jTP@Yg;KPudYYpk4<{omWdfkkrf4^1 zdSPwsaQ|m_>ZsKuv|vMb=S%3Xd{G`G9F+f<-}bKi+2{>}+S<1d*v%g}sy8I9?L^p) zt?dY|-2Ml0`=1GgnIY8j+IP^3hoJ8O3fjffBYPPjzc#pykx9&RnUUUhkwwA>rNUV# zZU~H~4G;78l)>bCn`|mglFM+kCfk6(7k59qpRx=Ul{YqicXl*RO3APDtb`zM=mC*> zEL0K^O{+oQ90c+U{Vjpf#_hizzHRW}a{+{&vG1j? zXN6uAU@R+>Fgrg1H7AivorswJ0Tz*QKR;Pk`yY8y4O1}J-YFQGacd_R5`j4Q9(0`J zdU(Dv?^0%bln`RFkR^915OrkZ)5Xb8^D|)W ziVM%eM~Jc}A1;DON0+dhPPf2#G&_pD4%4i1&npxta zzq>o&x)%lT+Z>59-`g%4Z*LVyVdAq5cJTA_vmy{qRMK}y6C&(=Zro@O1$^lKBpNR- zJmcNyeX4hN_|)^AnG7C7%v;>BWgb4{$RP6L$N`C$cJ{)BiRik}HhF@n>6}pEmgUA4 zk=)n(Plk!=wP5O#H?II#i+Z#QB>N*9ezuf zVW{;pNtTXqIwdQsh)EL24kWvs`TR0`M*c!G4fF$u=}LvE-JuXzPM2Hh5jgg%n=DXc zBj9QPy$!wwWftaG$Utp7Eop0rd zrB4&e%8-~m$CNogB25VqNRm^lLXZvFuzq^;OcMwD;ewbOpKc#7zYb0!FvucroE>I5 zUd$WMnldoBT>kHPF$~)}_;Kh|e)sZe>9zK!X0o&IVB_+cZeN{CAai+jUE{U-^t11# z47Z(Lw+QCh6+7`F8MD{C>aak?S=5RqD4yB{Y@U}uAh(=zAv&-j&1pJbb}9_*5MN(=#)!7;DJcY87#}n`S*e@ z7>DT*X2T)`-QqlM3(DC1^)m5Mtd5U!sY92g7X1%lS|sHQe(*0gv*+Mb}?=ZnMSz|!=R0oOd2v~C{Sfj4}JFO^(Wjx zueQ+=y=dcfpS)*v%`+!x|C>FrmjDzqZeHUUAnb7M_R8mLz8MA#vh)t*FMAbrwtF!R zyYZ5;w=brh`|5@jxZQL4j&sgo|OC|FD)}}nnq~4MzTxPKpwN1N~l(I z2Lc{W@!j7C)ZiRz^0jM^5+y}mzWwh<))tb{#6yDDc}45KEBKyI3}CgZfSP3w;JgD+ zvLtFe0mwF$CX=&G;-c~V3`eXc=epY@&8dEv#QZ|vzembcs;G^?j7a$i6{Wo&ELk_& z&eo0ihUjmv7d6}uHlOLX)Q}+Lp*e9q=hl|Fy##>Zg?H=?TyFHse2e|r+cY&}$$WOQ`SS@`sj2VmEIfCd%>s}O4Xt~#y=WtI z)?>#~ZA;$OR65c@=Ft(cn>|V@+c8)q5xOC*6GDn9 z#5^zEAGgq|)9!sMJT+hg{tL?;jC>R{xZHv{pYsj_5@-z#IRf>sahy8pNsdgH`#vBi zd^YyPbO4&UAgb<9FF{g7%;WH`wcx>nSMi?HQeVHCG`qCh;TNcb0)FSk1k!&I-M&5Y z8rJem1O>b=N!<@Z`^|ww11=8Ev&EMJ;+T8~Sg_sJ$DpDt+uUinUEmTf402X!etx&( zcwI_)6mCpZ#N*SeQu8`<;aXotpG(y!JoAoT!=q9vC~FT9KnOJyo`UK?=>T}{h6=>9 z>(RlorGgiy%meXFx;D9llyBee9LP6Jg;iPIF1ZGC+U5_}S(D&$s4>5sCkg3Pt1{lG zMn4#Z6PCzeC@Jkez-bitvwXBa3Ib`Ok{zgF*CQ(OMgb`^e08+@L=xjwR?&s9sRP9E z^gy+Z3uILC;lxcmF6d41tbf;oSSNhzOBY`Sl_V*k`FSA3$DS%TT0KiHSr*_;6(<4* z;E9_9RgpjsM=gRwVE)gqTHgbFZs;eLqu*3$ZM5t68Q=gI7h0H4C;|LC2HP(lz(-#j zDM6WZ(qdy$t+;GN^(>i@Ci8G~JCoeo+iS1LCV)6(PkRK0H{Qqm()t;9)~5k+gccw- zBC*dOM>ST4Mj6sHH~0R6L2|0}o$)D0iO`pKn9hf$%E$DZaCIvUhQ&Qp8A>tN&HySiU?;=hTsf|sZxEYCpsCsNw&<^afGqW6Ka=&`5CaL`$e9#y`w z98elSyE{gtg4fR3D=DcoK%wgoBbPP?`7Uq*G2N7~w`ZLMJm*2D zTFz+l@#Y`ryO-s9ePt;D^)%X!Lr75rC?&`Sm8SlX8`8rD_|hsOo4u(hpy$bFz`GG= zfE|Q=&;=Uk{g)*K0|0u7bWqoswFTgy{6dblYP}oRCeYWftF8bw=DBKBg_3I0!#W=I zI;$j~w5XT;h}_&6G@z_VMIP7VEjsx-yUr|zonJJmr=Rgba;SMNLH&~~ynm3Us7?rp zm>i>TgmxSgz=a-8OYgvbm75HBCt~uSJo&1nUgapKr+XLwcc?^!tUb7@;X`h+FGe@m z8~1}B@(I<+w11ceoDBIB9jmn$=-Ei-g7?v)TgHUtT6ye28!3-JpW!GEtI=0Y1Za*h zMH|PrtQU8xC?tX=P9h*DjJYU!h<+z>Voy)3ilF8aW;32Gr%Qd`?t9$X8$H=n$xuy|X z3#Cfw^R7g`k4P${OiTn_O)C@?~Hz!d5Hov^)UTNe0 zg6HLVG8S3G>C)q~llhRACb=W|MYIe!W9Ut_EvKECmr@cEjDf+TujpylaxozFw&)lb zIDK>{@ub$8bt)q;3p25q#jnT43y+{QD zzDxK%eo+U!6z6yrlc0VnPZ}tRW*A{k8iTe-bD7jGYPPneIi|&Gs;?{U<(^HK#Sr@Z*-o{9Az$(MA@}clR({rdIC^_7 zq=0$pGj=m+javh^+K-6n(T@%XkDJJM?Q(WZ7a403j986y$U9bc`AbnBNATY#wF=j2`42o z6SXjVzfe==bUdWqm454x;^K$TWz!FmEVv`xGW6bU%IJ=~=vdkd+xj0Js`<{9N+GUV zd&;~5hx{ta?w(^jtU7RIvYpawCSQ_^jUe~1li8u`ZI{VZ7i}P{l^c@j1B)rF4e{U22an~mb4?+ z$g0?LLrf+54ZaT1`pW%}8V)*`59#5r%YfX&T$5(a26+cbPQv+Tn2};R2sUb(rG0OXr6u!*$8htGNBqYs}E*WEc%Pk5?&h@Is; z|8h?<0j82lgn`^FsK2~jr0OwpclTXZz#q>w9cv~!jB~FUG|R}*YVdfOm zSm2hZj~&jZRe@U{Y#X{w7XTEqq72?B(n?$^*WOoy`p!a7>nUc|SsV0QZ*0Xd>3QE1 zfbV=H5325tWXFZ4_KQ1?)nw*>{t%b~$@(s=FXFUa2zL zI;ZbJQ2AL@(aZ@qkqy%>;*QTR%a|sQpF8s zzZ!NRub8HM+{w}tGm?I^G*kRtwa{konyuRD_gvnnI!#Lg0I~z(3eM@&2*ihU!q!sR zqqp6MG@<HX%(2IpWoZd>jNRHPlbgvy7-&A`yJ^g*WXmBvwLp)b@SYesVMIc>We#+JC ztH2kWQpt*#Fr0iU$(opN=12%yO}4N#uUieW(woYxTS+_f>Du)hsJA=6d_yC3dtLdW zZ6G4(5wVkcVcUEN|C#Zi*KmH7=C`*Dow>(qm9!e=i3ajx!A)F>Rfjqr@ZGk((V*O} z7Uk29x9C(qH$vsB7*;k>M}8uO=Sfo z6MTQoYZ)KQ&D~On<_Y)#c@tR33$JK0Yp_Yat8aT!Qec){1aWr#>%vE1Ony&W*7$`)T#c$+60eHb*aD)5|2#i~yEDO3 z5-*0^Ai}I2P(9k+m-IR&ECAC($HfD%M+|LjN`fSQCKOWvE}F%fM4Wy$Aw3|bIJ!_# zM2EL??oSMbeX|j3e}QK!PiQnXo*~eUJ`5T+WY8}q{T?`P!T!~y6Sa`Z@k$Gtwm$QT zoO#yVM;t$bn*v{nifu z9PU2V|7Y0#jNeS=?F4>zXlF?rt{au)y=tfJsl5{*8zgfh_Mzw*Anz1P^l0I$F3Q{p zr;44Xn~vmCvwO;Ff)O2Emt13HXL|rz@+=krbrTMtQ19WAQ0^g#<_x^9r5~Zs4DOEw zjmb#HEuaRmJYw62!S=g(WTvEdIH|(J6;A*g-(ZwGAe;B0O_|kn{oWc7uxN*dv6n<; zyzZW`222X~aBNo4ahA%8{9E4dsaC;}Si1m%d+ZMM2SfvALw;}C7EP)IRzD4(Niwn^ zyf6spBi_-;EyfeH68nyyF{&H`m6i@@Pa+Snk5XD>-}_xl6g7K@3bovJMNg-KCWw{7 zKAZq{7`bvnz4!&QryHGxJBZn+7m$H*{5@zpW|HS_B0+w#`RGEDZ9adcLw~!LF_WtY~pbY zAls2H^LwXpB#h}6wolnieD^s`0$8Nj7dvBF44P%4x_GU)xDvv)WdzyM&DMVQ%%0~n zOrNi2C$q=m9E0|hR1_as9&vOSW>`-~&9{X_A1*Dd1HmPAl3L_exqhSU`4`qkV6hqE zBj#O}+~t-6)MHrJs@0dd3)+U+1J68QJ+@qiT7b#Z$rQgVxvs_F*S;TN(>4ndomEFV zpqaBOJ@xs~xK)R%Etw)cqqOQgI3w!Zj7qICh&ZiNI++^kEEhkg#viCLE4eXiXM}{N z9Dp3s>nPLpfx88b3dsE#Bd@)6@v&`jZ&>|iE#nE~V8_O8KHHPS^J1WzN@-OOxfXk0 z>_j&pe!*>)j|>r?9J=5$3(A|6<7id>E{Whd%*4Mj>28)+(79I%-U#HdoS^jT%>be* zZ5f1`nh#>SZvV=dDcH}Y_wZR-8jsja*TPv`5+Zz8#qVc}cS9b&i5Ik4N_rd#%v4t(VJdHaw)_1HkD`A3S#tCEsr-FuY%#U~a)PJEoXzll;)3)R}EO zlFNErN~~I6q)_O}G8$?;Az-T@mL3o87>HZ=P^3^Ed^QU`4Vv{&Zsk zVp!ezX6l#v{oAFyNQ(e}`sCy+&`12AH*wu7W3(1>Y>8%?cIWpyf&@3iMrVQ8co#VB zp~`#?Pmz|GjsD3AwDl5Y#O+_k8Tp;|GEY`f@cz6a7%%vtD0ceY??tMC8?&vO`OE*x zGXCwc|9bwb3wInWw@tOcuMB_L{Qq{5hzmZYUzUUW-`@P|dH&yb{cCyszw!FlNc{i1 zCY-5HxTD9S*qrlxdWbE}jbgU;krKm*DG^6ql!Mn)a8h$5e zCHiENn<{M)yo=mNvG|02TJ1;tcy5U%*B*=i&Dr@s*S1$QW%1J!ZVtkb3XjQvXf0j5 z{5Yi9lzwtPTB%Dq@nRlnVe;=?Z}Y3@>#hvD+G+m~q1_HJAEU4O~yr^?j;6{dm-|IDxnV6|b zUELs*p0N`7ox|~Rh~FdYrSyccvVryFg5vvdjeU}Q>S>MP_|P<~C*oWn-c9++r6YK@ zQ>1oj;&E9^XCM%dusEu%7(r9IvVzL-H-fRv$|fz?uAX`&O;D|&d3%VyGKw4f_sA6q zrxY~2T`#TY&pF=zh_z9~ZfWdMYoK7aPg)fxjuCiBcV$f(eZI-3RG3s+UK~CtIEQ|J z$IyVP;j3gs%1b-P1-{!*4ID9*o`3Zq$*S)({tONQRq@zG{{#XpBw0j> zpd-Cysc*im>mwRw{N4FC0!?>scjnB!tuPea zu3w5D@NZ`vMpY-+vsPJ~-BZ+5Ku&7PyP2;erXPwvlH=GDv&}g;lOKI=dYT0MBkfAC zstxn_EbjfDt+H?BhzAX7=M!sdvcDJbtEY@Io+kP`6&@y=5`)WI$iJw~?Ung$T|c=3 zGpVx!>6)(Oz1I`bQj>*U-OslT^jBlx{B=0Gz#Mt{`v}pl`(}D3z1~)kcDMggr*sZ- z%Y4ftD8}?ST&fQRPvwqn9ke1X{gvYCMq(_kyN8WhYN`F%Mz1Koyo$LRu&cdx^_kzR j>8~>a^)_$zx6A8K^TX^|tP~Hffq#;svfymh{_y_+GhnEH diff --git a/metricbeat/docs/images/metricbeat-istio-traffic.png b/metricbeat/docs/images/metricbeat-istio-traffic.png new file mode 100644 index 0000000000000000000000000000000000000000..ff706b4c66bcd887759bb4e7d84c02e03b515136 GIT binary patch literal 267742 zcma%jWk6g@5-tRSBuJ28!GgQHJHg#G!QI{6-Q6L0a2Y(f6WoFgI=DM;lDl{J?t6E4 zAHNQLPD@o+SC@P>Ve+!#h;MM-KtMnsN_-Mggn)pBhk$_cg@XaNbU#VsLqI_Cnh6Wb zO9%@S%G=u*n^_t`Kv2XP=pX}s|?G1>^+oK@#fC0Ty|y9htzBbeIMnFv>bgPtSX_n-Tr<|^ zNK}ngPlR)U*kVuKWHBIy%kbcaf&$gQyzqxGGkmjPVt8zSet9`LdU<)#>F?_DjPTp& zVuvuL(6`jtr27PBWVV^Ix}&;`G?#&m72Rh;n=eLmu2!~SMngdGxN?CXt&AK$6S`Vi zT03yL@)G_2f(!iotC^mN@b@Q<7Q962GV+ANHugq@taL1N3`Bfy2nh*!> zpJRi&^89M$k~ecTvQ!r_vof-F0MEh4$icwK^Si_U^Xgwy{-vwNzq)d8vi-H^U*7zq zClCEE3jRXTAMEf@xT>#!JWoDSSsbZ?+ zj-fE@n3u5Xj- zIuhjE9%b8cY2K$)LPd($Cljoyu-)VTgK|QY*FE3E{ClwitD=Xf3KK&&?OaUR#bMvT zA-xwABKnZ=^@=QmdKj{Y3f4u@S0MBoCVb*GWxl!kH(BVD^>T^gno z5?WmgtdW4ww4?`H%mUn*2vCoc{VK(OpI%`70!<*1VP8+_`#i&OfiXOx(|ve#pLp02 zR$wubso5%{S!d~%0p9;Qb^@Dk+TOzD<;pXL8lX}R8B6z&*z-<~x}t}^yQ^pS(v$yr zh&?#RX1)eEb2U{){I4fTfCsMa4oiC0XN}zACwo0tk)6cnYlY*s(-PIX7_60_vb`wL z(Pc8%WSj6;#kjeeubF?iT(#|a=~EbeX!AQaax9oOIKZixUc%_-_@v%u7^I#x(!wlm z(BNaga`)Ir4Sd-s;Bn&S<{nO6}baPO+cQiws^SF72y1!-gedD&v z-puzAGrQ9<=|`cgC}*7sE9lz^AN25%^lLa+1YEHV6v@O+l?Y?yd=UjMw*v%DZqE1^ zInICqPNxHw_L~<0(s0b8db4S)6|&;DH^;mJ56HOral{?OnawX4b^YnW7 z!^vYjXbJE8ZMTCWQU)hZ5LGG_DaBaT?Z>5FbOgy|pUGnq=xy*1mUlBK20SnK7HH@BQeB?aAiM!iiBIG#It(R0vwLMraTy~Ov`T*y}46Jh!! z6hkc~(B<}oW-2FwKTF`5M?~}u>TH!P30*F0;%guJ5*MO(!1Z;3jnALaG4N$&qoZf? ztQ^XKN@Q~~K)p<#=PTr^gP%W5V{HeHp)P@o4);SI@)a?d%Wsltw1oS5Sq~AN zmYYr{Yu}fbI*k}7^84@w9BI_w5^M^r-PH{sRL$#}e&v%I=WKvOH5tm3!10Pi$hDZC zn1)5h%UdIpp3)$S7vRF=}7_oJ7iA#Kg$bjVGx=C|WfVNK^vzO0v0d>xPT z==3oj>1q>}d3amwCFBu4cy0H~Ssl?4f zg9NY>2-6^;pT}{ljEZLU#c+~Jdt&?5AzZzs*IJqu_o-2t0Ch-dPR>lwp)oLo?oFZP zXJ>^fa=g3aBT46r`DA!9@LPP z*6rH2AMT%joRvWmH~GI206=k#8*MWqbEz+c-Em z3BzJInN}u^nNm>1;OaBy-zsQ<75IuHB@JgtEEm>%GKbf}RXpNVL=?A{OPEXo*Q$|I zsy4&k2Ms`eY){sv?84SngSaqFlONtxu|rYOp~Gtb!H0lB)42f zMi&*L-o)K}txSio>xTrDYHhEuREbVCTPjw7!tG)i=ENK4-k68#`wz;-7bS+S$J|AI zZM#j?gWj#EEJV}Mx;{LA-|lsjjX|qX3Xf`kYI}DO<#=^Z8&`?(vG%B~bXtveXi7n1 zx5Ightx~foD4Wki(9M3g5XPx20n4X7Ld0}b&t#)Z}%wOFK;Ok30Ab6DTkf1xg4@zi3+4FTS~yAK(^$@%G*bgB}^)3 zQL9$v*>oI};U-!3GQ^FwXdBLAQ@Nb1mduvVPYorMP&y<_&onD|$;g-4be`-T%!2Hj zknlVv=k;8Q;z`4ms%>E9pWL1H`lB*x-;O~(c}#=mz3bgBoYUD|TE97y9V=e08By== z)u0h&uw+sxQ;4s&I-`ygeZ$jm&CnZoqKnb_nv3amXCy_XTM^ot9v$YzZnG+=R;69w z|HUiB*=leEq;yjgf`nIO#qB&*B&9Y;901r8t7{ld+&b(UQZgBICzH;U#AV51bMi0N zH9(US)whe@i@)dzl1iktz$hc}|5mBRTH^J9gi~QNwuH#FJ6avaYQZ+?7Z4H#+Kg7l%IXpxh~iaeitALuz;Gv;#KM35i(6q6pY_jc*S2O~ws>p?ZQB#1Whv1Hbr zR0E7#XCtrtzndP6gX)hq4W=Trp&RHDgd3@Yo=TuG8pZ+i{PKu4$oF{?pNH3XDC#b# zUK%rk=WfWxgL&L`8wS-!h?Wx7oSn?Z?|Nt1LToy6r=s2tL42G~({wCtIRw3NJUF&+ z(`}5)A$CaCX%Z#hzdce@Zn7m?R7I+=gGYcb!1l2IQKr;!In19ryelEs$wp5Fpxc%f z;hVRy02aI__u9YYZ@X@+t9-%h(17nlL6rUT{)N*zeY zJx401gQ{3FeG<_kLS7fY3hZ+zOcLyA<~wYRkOM9RJ!%3$H$W>0)^ulv;m^8l$nn)0 z9Xn{6?+ebfM2ONUh;c9qAHP%xSy1Qv)TyX6nw!jyC(5UO#q4-g%v#@X`T=LI@*@-q zZsuD=#3DU1>5_<)YK5q>_rM7|#_{#F7piWWPIeo!N1%oweXG3HYz1UcVBqA5((XH0 znAuwUG2^N4WmzjXn?)8Z2FG8Vk~}+J)=?_g>H{QGD1=_0?-a9sXbj5*lC?xbnRLpe z$%I5_ljPJEeT`M)TdMVnIqXkl53TZQ8>`!;-#;lT7u6pK!kH_VSQOPao8m7woo-ys zhgGM?M$oA-Mr(JyOJ`>FY(hg{l$IHeVl?VipdmRK2K^dj zvpjxOYPkT-k=}VvdqCK+=WO@Z+#GQW=m2iw{Um;_pT-%?l&tBuI_%QTqVHZwLQ}#b z;nOi)(ZzWLU)Jih;Wbqo4t?P!zY4l{3N#ja52M&q$g}-Mt>)sMhrqq$d z&j$EygHoxS4k$)4`|dit9#peqIy*a8ystA~Uyf9x?L}h^#0J#kqFb#N7r=Q_8yNS` za^~Uxtx4y%!)WJ;X2c2 zkO~SMk7%h5?pKeb6{b@qnMj#_$SN12x@af^-WNX7fQSOoew36(AN-=un3bYyzHDH^ zKvr;QWLumC-JsLs=>uDlEWwnKNywY*`tunmbB-g3Gmc2@=oL?iqusDxBv|ePO-{@w zheJL)d6qn>reQbJ^Jq~0c8`I~va585s!=V-af(BK5u0<)V4}8*GE#@)f~6oPh0dZ)2cI){ zg@}gC&ZX>I_h>qS=G#*p>`&W~LQ=zr?d;o~63;HB&$eA^v|i7gGNOIWArHZGxqeP> z2CcvN*jTldtBa$o>>f+Gt&C|OSJ|fnmKz#Tx1@VENexmoQb<~<8!&l@-o_kLzr3qF z+AKX9N@NVkY$I<4&mb_4GnzV;#bk0BJHqL3@*@dke{T(JaYSD>9LtQOQlk;aq|+%% zBudRo7W#Qts#i^C&nA9d!QwSegc9o}b4>IgNy{IN`>8EjDxIa&a7Vw~7;)bpuF>{g z-2CovnoiZOWgq9;=R6FVgNV`kOR{Bhmv_iUQkW$+9*&811R|#w>v3o^9Wu;}B87vO z=tbITn?wtoTCy1zU0W!{lBI?a>2>YTY${Z0=zjHD_1e(!IBZ|3)v7h?WMS?P=1M6C z)|GBFS{++PAyzu9+QA2yc|g-=G4A=!gp<|khrBams~YrfGhnL2t0NB39)?QNn5AOFX=*ri%8Lx{;3iEM{jxLB zxIZqdJ=_!DKJqyRWXB6_Hhs)gyN5}cMmdTV>SA~R>~=z00C6y4F@1+A$xXFN9hcW^ z2Xz*glb9imb78T}hpBNL4^d-7s4~T(eD_ZU6BF5;v3@hjv>mal#pl7ZeXOI|v>)D6 z0r9N7yf+)TZJvqZ7S%)(8q_;=tvHc@nkd?!MPWOJC5X3b67Z10xnqivX8Z<<-MUy$5jJ2&n$n;w^p=HcwWPzdHX$?n7~ZsECGy1I z2PT4FcVG})mbj?6t8USjc^D;X@CG+EdhQp6*lf!hh|c@1WEo1KKybT0aTcL!I1q@6 zt)I^Bn&rb0da6xGS*uNRC%|Ru5F^o*85si@u6+gP~%5@tHBDWmMU6NX!WturQ#ktQWj$?j~#qf!D~jqd;T`J z!Yr#a1P<4p49~>MZX;J?iy!F+2)R3PPPC;e6Ol_8%l@;25+CbZvK4s&SQ{S9YSyi8 z;zj*-*yEmfX0ay33du~r{yxs2EQE7=TNPS^bd2I?B7xB$fSr!_IbTfxYgVVFHV<#= z2f`Kp3YelW&#csC^l|leqFVn3DLRyuot|oLd@TprfgeB;|5Ni)`q~)I)T~6Q$bdkJ zyTUPRz~ImP2(>VCka2igyU#1D!Brc3yZ32kjrme?)vw(4X7(@Yz2+gOiuN2@-9U7U z;rh^+&FsdKjwn;9O9n^A>Mdrhrtk(*Zt*g=@K33Bcw_0rzZd7vLghHhkFAXd^OyTRr0eH6+lL0VaGJ5fmJnompEPz$0(8DNzbc*0-|b z>Ze^>r*`u8SLs)q4R#?^suXg#wzJ1SXOx}ht0=pV#G($&*r=6?6EBT+n`v4cc7H&_ zwft;uT<4m-*jT5Ag=?`TEAwV6)Aob?`)dp9Eel0@+8bku%0>PdIAEVqDM>5x)jPlP zcz$clG=I0y0QrVD#zf=zn>2!SQQ=-VJ*E1|%9m;>wf3B_ADT^Jt7O-15+EBWiJ;_Y zkww{yw5@r4#&ve@SYy4t!p zCF)opq3PsUzh4X-5lzX(g}_x@lQPyTwKAn?6;_d2)Ry#rgiPPEdVKZ+$vp@9ls`{RC8h37C#AoQcCFDE4V0j8CjmXcm_~ar;v6_k z=`TwOybWwagoQGZz7K0WT9GT6&?z(^mqm-Qy1m%zW*Yoz{e42)QuIx|cg-$>RAsyn zG+vACxA=h12MZwwWVoYSIS^A>L@tYFWnKq-ajS|Wi(R>dcNM(H`12(&e6wDWys$7q zp=YRJnYacwR%v2iv;~n+&(%Gxt%v!&#}V4xK#k*hYaJfs6Vtlt<$VLO9iHR$EI7B8$O21>BuxCT!c2> zyf|Da8&D9rJxzB!=k$-`ld@?**E5&oVGGSQV)QfR7->`QbkMQw~`VYej`G2 zoA00t^C*WMir_TG2(IfKuAIpUb1_1b*UvQ|7`vN%VjT1tL)ZO!l@o`(=(o|+odYK$ z(jz?@)AD@C>^KeAO7rEObZnXgMCCheD~ZU}F(--|(6MfrBEmrdek+IeElCIxP8m&* z-CSTrb4&zF)$5|O@j z3mjeAf;zqRHiv)nra0vbP3Mlx!4QESZS`O%>Wo7>_iOc%^)X$VX zro>csgQjO8Qv54EaV1=_eQxYP)t05ec<4wntwkc?$C%fyFCFxDE{VtcN$d|F*liTv zgrFyCMrxHL=jxAi$S8i57i}VhTuG`Bh6>4f3Y*R zJd^88r^TgINuY` z<|>+v9AlzUUG>A;+sbmWHVcQXLj3MxyP=TF^6lT|1N8GCV5{n(IGVBt4uzi~rrJqe zqBwJ%A@3ZHhPco18YP(Fh7YkR3G2w3{{BfKQ)k z4JmiAaRdi?G_?2Hl_ErydKMKoFvD}hdI%t~)(W}L~vb*RSUOPk#Bwmkgg zIV*FC?YjldxBh|Y)M(gF1l$@Lit^Cp9i{>^Wt3scJY%Y1yl0Qw)U7m3xSZ56P(~|7 z6ebIZkBu3Y=^+5rL@p{OXlgYIsd-Uf&;kN)*JCjmooFtiQ>>l&030d z_}DAkbuGwmpLOZ_;VkI@%sMpwvEU6OGnwi$Qiy9GT#b`WW6W841JFl-djR=RQv`T$ zEsB;diGHoQ#^&NP;j&K#K8n8lU|(HQa%W`Q%=b~nUYc2F!jECFqB02p(daBlMpibt zU9hE5E|eKD2LRYH{CW{TG);E-eJ>qLp*3{gt~T&V*_s^7W>xY2P6~jdJ74gQc+r(y z>7#Jb!_g^SSCWOfBYWfvYPOgH=UIN-u92a*Byida5R4sT(&^@RJawQMyr{&jdY*^3 zHdqW_@rZqdeG-er6>hMYjfE7m7Jl(=FSSTPs-;%Mzp;&h!`QI}pZzW@ar#qD&L{wwCH!`*~gy(rEkuijuz+9Kt6Wp^4saI%$~AA!ZrY>_-# zFA{k-D2iA+l;-NXZml7s(F=@SB$^1(BhYRJDUYiIbL~TrtPB)Mum3*t{Y@aZ6pNsG zar8Tj_sDxHs#j9{6#&!jpE+!+p3jU8*$#nhm*vu=BB%a!@GZ9eC^0z$I^xlq4t_%4 zdrBksBppWYrHCf460=`E-!k`^>*Cwf^x#LxO}%4`{v50v&7vJC==!wp(RwT8WhBiv zb>Rxm|9YBILf-5-BZ;%YMx5faH2N_u?JnoX!c(9gE<1 z3T`vnZ^ak$=Bk-8*_f+C_5!g|yPdMVQogn+uI;Zwg2l}oU~GV8Ju>VHmd?TO-D~)=aj$TlF;bZ3RR4MKWL?{RE{=X9#+p%5<2wU zA9mU#pu^=TSFE9#tya=;1iLbVX~Z6?Wh#}ZRtvRC&$c&7uiMY3#+Gk@e3`VaSN&Gt zEJ51n@m3HbXpZpY)s6{+ow44hPZUv)cK#I!by%=h`*bBOcm*NXMc59Q(+gqDz}n1w znSlH2SeWoIbP)o>#_=k!>=l+Ty`G5%G{W5QQ~g#j)h~pCg4a6 zM!+N81vnj1Fr$c$06l;5w1~p!OQp%U?Tm7AdEAHYWCCF}yXSV4hPh#d2cEcsF=!qM zyrw;TR{{gPi9>u$>iHV*KPVu3NN2M|dq0|G9u_Cg*SvroMxc7gL1QwXgRfHO*Ligv z{H&nXtdX%>x=ow<;szfY3WV18BNV7@9%ixCTl zz>lHiXmmrtsei2Kd*48nkOlLTP5>O8(VZ39`H-@vg-JdRw{H|Zz{OpTms2mnYt-GJT@VL2owuXV+W7QuU{&csL#RZ3ymj^zlK)P83D^)+!IFxR*N1CGjiQ z>?pU}qf_Ha_7U?Xd;624Uubu2j2&oy9-a`pY?rj|dY6&k=->`u2WGYp^WO&z+&Ri_ zNb`y|wNyU_n5OS>xolJFwJhe~Nll}pK(MI5%+d-BSa%k7Q;!eZk*WEVd#c))=LBk- zpna5-MoLW;?3q^cEL9dHEm~S>T((k|+=xC)Kry9mJw>o6gVq=|lapSuk!@dEwr$F{ zS!>7i3#nJ|=V;Su-g~}iSksy^GQ}zIqddAtkm+>0h|bK!-Hyq-;z7cPt>UPY?-ZHm zdperEL(Z3dE`xWuF_S%e!4g5vzK?S`mfo?H?UTHfU*%#gts8V70cS4}^3xg$;-Y?b zc#$uc@kbZ5-aXtr+qZlBO6u4grdi$PR58Np-Y6Po+0PZ#wCc6H(@spt>!0^Uq!1}F zB4S&xyCmU!)D^xrc#UI0Pk)1^5tNy=XS#Q#FXok(m&X*q>~tU((9P#|FFgYi|1KUG zxA^Vt&IHqJAXa6>IFVRVc-F1w^}I@cjHiSSI?$h)pNy=k~2YW~oMlZwTC+PRZ@zmzf2LuoPBaZ#2RV z!}U+N=!CE=%YhZ?kmjaYrAEb;Zv04(Mxn)THIN8#sHcuVSOIjdoO`Af zsY(Q}G*`U4qiOWa=gqoOfKk>tjHm4>jXfKiW1bx3SAjd`pSl0eoqpH!YMe6PTOB`v z*me%fCC{vaV`(|QAgG&1O?;YQ*`aG}2`ccgTW~sazktAaC>3wH-_Xb6LV~(hgqE_V zy>ZU@IXM$hW5r3~x_%P_oYh-}V*ZZom%Kz`TvA59nq476e1w9r*0fW-bYL4PhmKoR8=+mm6kWKuGcYN_zQ zp|yyQza%olaS9AN{fE@uUlV$SrEnw}gdg?ZA?;XEXpxp`f2c?MTaWf%pfr*)-zdbm zf&jcb*r51wgW5OLq-7r3xQ|})aGWI!-ed7HE(LaeVO)QInf$X=;2iZ^p5{+%v!N-E zAy7SkK;5>5>d3NiW?1MY4n_a>5E!<8qQ4WzKY8$rw|+q4uCzemgY5!$C1fQLXa#WU z0Jsx)8qeDK>L+Y)c!QcpdsXR2Xb(3|oxV@2WS$gw+~hxMo0BmKkkmc*IhD?7u}0{AKffM}?#|)&-0l zN=i7fb@mMO-vtE+DFxofyolEjLB=r-3hH=pYuVe`7b;U`g;nD*!B_6#SxhS&CfTaRKdF2s}YSA>={Dg>1DFEM{uLn}7Qg_WuJrAS>iM_sMVznzf9LL4RS!e|n7Xfbb8Lc){63_@|Kkr%ws>qGQl)1~MsQ38J7p z5|0m&N#tPSApd`K4{gqg3Vm2Sg@T3XdvR`LGd$Tj$cKjM`$8&9K>!K!|1p9m-7BI` zSlDEVkis711L%^slb>MnMyZs0LUP_hjzfV(y~~6+*Yo0g?R57;tC8*k&OfBz?-r%Y zOZu@nU-hrN0&|E)|J0^xFj6Q@m4c6=v8k>uVx|@)uM19wzF>)f2xNjqH2;pC;a8_H z;;yyx$;3e$FN%xJ4}@IQtXgJdryW&!UC@7?hcLoihjRaiRFURa93+1>{+6Iq&bO%- z?3e>LiP}P>KTN89Lv{LI8sk0+JrgeWlli}TCA=TB=5hXl^=V_cWF)7KU>p&=a)Ef% zZ|@1JT3R_2g6pk;hd{z5YaaQ~n=2A0vnlmIDCshxf0yu(8nbyaopSqdS?6Q54*hSi zU%!R7SPvNyP+?3wSb5Tm(62)%H+lvQ%F@Un{kk1*rlf|GDQSzOvJ{c@u^x=`V15r9 zO6~XU6wdwW8j9ERK)j{4H9{b7k8epJ_uUD|jx^f+Pmv9!hLk!n;0y1RI}v^MO4oh# zGPfA_9VM*4P7rC?Dqv zG!oz*kxwr!3O?NcA<)L<4@USpy*>3{jrlNgvU<*|eWw{}$?|i)@?j~@=@0ed2c**< z@3-nCff0JkkKMqueYnP;M!q2#PXtV#=@Cw!Sy9-Rm z`%w+|m!E6q%b~&lGINDrHODX(erX^1+2$t9?Q)zS8ym}EW#~Ekp(IMg=r4*^mG&L! zCkiy=snxG4dMqqRV5a*DLZ1D!+B;f~zq#5PkdrSOo;5pl5q3hFsxiQ9d0f2M~Q}Ne$+{f%xy7?@u){n38_`P|=oJi(mt99G+U!J*TkO}xCE6CQH|H1uc z%+PDTezGNlvKx%%n6PB3DYkFd52+5j<0BqF34HEJRmCvrb>nX=HolD7(oL64NFo&>1Iap*v0VG@5siAEFE(u+6T0R<>N#ok zI*4jA{I~ughP7Gc_L2dJ%)S1*ge9;D6<841_%FD;H z+@FuAvgG>cmC5I|^%*a5_o}ro4Ro>mYeRpTCvv(a5p{puTwvTE(g(rq;iSCLG-l9Y z?U!w;rOp>Zr<0#al1VgRba7^3pAUVWyOTviNeTHAr%Oj>hu1EhPKReuI;(|bU&MQ~ zk=-fS7vz}^VeXb3O*3^cm9Bc%p&6_$(L3BA~(YSjiNop$G}%H?Y8Mk1ww7!I>>{fhI<9>Ly~ z1%Eo15fQlTC(J;bS)JYolnE&0ay@0Z3v;MeY>6Lqw-o8<=%}~d_@Xg?kC-v2s*ZrO zpy!+cPURz4YqygjE)scMTiSDb-=1y+SW1CW*h9-B5o}gJh3?L`i;h=Y<3q$@TC!>y zv6$_?sab!FY?z&8EvlHGbh34JCUejgzn|Z@u3WD7{w~%^HeTne26?blgl2@^p&i+v zSJeykdoM}2Ay)?0`GQYo^8qm%K3GdPU>Qo8y=y|n!I7j^t11=_iHQZLie{_zV$5eN zJ~o|Qc?m2x+F-UTW){ABeXgWqN3WglYM0LAM%C_lCuz+ru;PM*!{R%h#V_{@dB_ch zidX6Yw%Z*6)k~AvybpWZaoePG_}Y2s@c+D9z-lSJ z1Z?*VU9@gh{8Ggt)axfF^sRV!Wd623AWIJwXj8UO0h#Z?SAFNGwaZf36KTw_oLpSP zP97p%;WxXrR?E&{K$f+3qvfht3Vl|>^kWw!Tf-qbLHa2yUFQ>9@?4dUoY(zzN;!x8 z5J9qbt7DpX4ny{>)*id{O5(sKqWjIWSfvnOwMJd^{q+aJ5>A8IfG@ZeU>R>kxIBAf zO<*Du98OrIna$%y1Oi@cC>BW?ZFVV77t;c-!Fk+bJZ|S7$zxh(Tm22aIuZ>}WdW@K z1kX}tT-#zFW6Lc|@IUl!Ve8pu8L#oHlr{-Nrqt%!hjn7G< z8-N_uxYpMv%4@{)TgeEZVuUg*l(wFs^>`s18{F#Bwmx7z*JjjsaC$pMy}L1xN}(fm zxw+i*ruuZ<$mq~dz(lxE;YO|D13rw~Db2-lIT9r=+*Q-0kL?dPVRi5gCmu6qM-N6F zCR~oTIn6esqHEXt^!}l+z?AW-hzFhLFSEl*Bl(p#ORSh_?O(mB>qS;dtX6CN4*OC7 zw;kapd9J*e9sC{6Ph2uD24$H8f5`ps+sF3`Zl-Kny@V0qVjX{xOgCTJJBZNwf%R2D z-!DZUUk3r(e4Fv(5wb7dCs|WEjyi>W72uJu)L=nj_>=I&>wOkV_M0)ccUr-P~z zxzC>cSr7ISz@$X`x|8%Jv`dFVCha~XbFI^+Nxdl`9Gz17CA32DnXFzDoIn+FvDPbL zGLkHh0A9?PO>bWWUs>#}EGnIUn8sCaBd-0RRwX|k0$Q%|ig=t9H!)%SZncT*mi%ZF z$K&(NV017eaW0H8?$~C3RW|AgJQSkydhn*6s5S_>w*Q$4>&&Wp;>L)Nl!8H{PoLg0xFGsXhgg+L!t8;4*g+lM{N!P4)2xf`Y(5i2h%0&UXNIWDIk8!1?e%n2K$iKCVSi72%-qg|!`T>(Sn-l$jft`bIZ0D(y{tN!p$amEiP`+ry ze&0w6lfdBB`P1ILQ#tq+vb7CuGXZXEyK>$Leg4W~DX({_X_qncApZOc)2AlFqu|z} zn+F@~QPS{({RX}BS^L*gcd))d`5qFki%F;WaIHrv_#z&BLDId|^tMN2*+{ zx@dh}pEK&OxCjvHdRHzE?u>O>(MZD$D@zn%-pBVe0bma%cJ#HSm6chK%@(jJDg>E8 zG)8njI~g5Gz35Y%kh9g$gPlNhXZPXJ5o!4bvcSxyQb*h2&Y+Yd!O&u;c9nJuS>2;+ ztLBv^Q0LoM1k)3YTRwgA235{F{>`1i_!d%iU>)D&hMD}Zk=H_l&k-*go{RLu3DFn85r!$$?7ERdGzm1<$x3}wj zFgJ{kZ+1Oc8?XQ|j860}q~}sHD;FYpJ$-$y{=-i|vooV6OO3i=`WZW9aH$J>zGeex zD!cuGLMDCY;A4STm2Nwg-3bC8-|+21wO(g(yZs90YJBvwH^TN1h_tm`j}Qb84pf{&il&+%ua_Qg7*0tceH zlNkPD`M91SN~LeUcu3C(>c5VLb8i4k{Iffh6g z?b_@OOE7XaDhhuOWIKTJiS6s=2A2adl0|>njGOvys5OI}SuZnlf7@caAq2BLyy#tA z72xivR84$jP^JsMj1vZcHZvC-$%ws8r?XDMRdLQ*jDM8L4T*zo|KSF1>5tS!EffjYlM_46%if#hm8>AKYtI2k$*tS+Anv;6HWOfXx~x;J5FV} zq`cn*(0PdN#r9p9rGTxt6~>o}NXKi|?-t^6zr?aLHoCy5G=iuW5+%@Bo%~D;Z1#Js zv}q_r-R)Yl?%k4ZbDa=xhCzV>oTtWvFzfkeP5)N%ogUv_v<3S}gy3(F-< zX#mZQ)EKc@EeREk+)lQ&Tu|1*`GfB^*($k&rBn9B3|4S4&~mBL%h1uA_m>!J-fFcM z2w4RygS`PYja=afa!T{vKjsxyTb&H4#iH)Bz3=zc4yNibWzu<6jKlkjpU7kp%l~lC z!ocS-So%47zzZRcGQiXAVmO=hcI3-1+fC++=iyxC@{jt`>HVn!aVEgG7vFBC2YRKQ z$aB57H*;O2YINJrR^U>UeVSqtVt|o<5c$*0HXq-1snP%v)2)+CWC**h0DntNrD{r!Ij?268ar!hx;6*9}$|MY2}HA>QJivX6*P$ErysEw&$|XSwZr85VS zN`39b7*%O4q|%GVVFNN+dYWBlwh%$wy*}dzo3GL<@qU6CJ{)2+5F4?H1+j>Yo^k|c z$_yF&JiV;-N%@4PWTgO_WK&2vt1E3xZ$(P(h`!}%iBO=+)Yu0CDF&X0z%_ajQY}z_ zShnlT?-;I3D(&45PN00CH<}}AgW2RWTi}A(vgxI2 zwPUKBfx;bnhpYYNoHy^Oz8>RPwR={xxX-|~tm^sD#_Qo`FnVbw)&QKSdJ+EO3D#nM zgMWjhbWe?jzG5WSd<%~VU+|%0;;V8u?hrm4#BWo|ziXemBavTRtk&flnjiBA8A2Mq zwRvG7VWUZ^DsYyIKh&}_QK9VZ`vG_)q~t}G1n)n83jo_dK~=2I_XZJNCjh66JzWQ} zYKKmaQ&_(96f45{i*(xbOIET*uuKM993+hsV6P%_cI0T+S~3bRVZaSY&;WKZhR$GS z-LCGE_HZHw*nl-}kqMT_U$q5Sx_KCYH-hQfvaGVWO4yMtIQr)LNDF&~rJk<%h+P>o z`FAKnpa(A1h2TQ_(JP&I90xsNjlUSl`p|{?1*z97a>Ik%qBTb0WZN}TKsadNs19v) zPV&gk(i)5)6bUy79V@qS0V z=7V`$Q3USnT}AE=Q<2SYkvMcS0)}Paak-uS@%h|oYKhX*mJmR{!%wZgHOLBImKY5D zc%G1BX-ac$oSdQndQQRqPAmAwsKd%(~ zSyiR^k6a&w2Y`|C2BctuRSA-R+wi_la3VS4rW)J^=MMujD3MRr+iQN0XbE2qZcL;P zn6J5iO!5XfKTT<1m!~Y-SZ3uJknMOy=3Se9;Na%Am^hHmXr zDfP1Yxh}u+aTRdmxc}pQnevdhb;io7 z?ekxV{kzAmL;-bmti^=|c@dG#%j|f4!5)WQ`X7E!A*L^W-+Kcr)yg%~s8ng>RLYf^ zwi75o_m_Cm1JOB!ULK8#t&V1BMTq@K?kCywhy-^5HM8m4{Lc*WZEfckI|fWOo_FRr z{GV%$=bbE46pppC4NdR9eO?>U|I*pf{#8p2G?G7+2~GB!OaB)8{I`YrzK2^_Tm;8l zpkBkml1o~kl6-RAn^ZWMw)w`>jl)`o8WUCTHo~S^V~>cq_d@Hmzrv>=`*T4MY@AB* z*t!iT7Q?<}Z}jn`Lq>ux2AkdD9$*gonl>>uK$<9(LG~~eNh!t=1yQ7!$TBsyiG+P& z`jiT;K3AIk^1puv0Q_qcb!b5$AtSd^LIu4Zv9VB^xP+rQ^z^j4mnCp*MTxtEl!@QP z9|fkLQ$;oEjPt;?x4nBS*yD3^bHEPVh1w?e7iDf2bMan&m~hSk=5Jb=w42f$c*}DZ z2N|p$_*N_RNgTIamV*Lg=iqHMD|Yi&Qn?df8(z5M@w`>9d%3maR|rNpw*R?s4z9E> z$PWpQl zz({UQ*}O+^2`;6}v39-T5R)6pI9-Kq9i&c&y~^%jNDOYmNDMA7T?+HeCAPy?jfm>6 zBBkM%Di2kThYRpyeBfH}_~q)gZ)qJz%%PG=rP2YNA1LcE$4YZRJ6sJTztEa^o;+0s zJtsB zQ2J}lP2oJIZ&(f>mv_0u3aY)#WJ z8-xFik@4{muy2%#Bt^}pi{m7;GMnG4@fYK6@_rgLKuM<1jpX5B5;22y+1F^-G-|ay zLk$WHjFr2yzr1fCuv+WTGFkqGG1@NrKa6~LI9%`A?kFMAgD6o(B!XzsqYWWSbkTe7 zL}DV0E=_cT(Txxxdat8I@4fc~qqi9hGs>C#b~$J7{axQae{r$ade?f_x}SPKw<=u{ zchY^OOO+tL3!r|HcC;^g`>9r@bgqXlWtOnxQ12ys+x@ju+dyWun9c?dKlHb$;zh*L=ZMK>6-B;G+LN4fKI57wkOby|q98 ze9b|^QwfW=J5wxw#@+5b+8nGrGO4>Z0fA}*CN^PPIOFH(uc$R@zqtS*bw(yIdM+qZ zjNz(&abj)@@-m$go^0bfa0V6@7SX*`zysp@QG6TZmrL-tZWQ{O3+;D!c-!k>Hq@Zh zSRiJwd*wCjY+NHu@!z+zS?vl!dJNYA^DGy#GP!n6Qu-k(jZ ziP#sH_$+EWWmX@9S=loWo+>_1@;%*@U+;s86$W})?rjL-NHo7YBgQW3g?}i7)`+-o z6V6sYByPIG9z^c8RlY60TLqrB(14XIM>FR|GRoKiG+7i5>t-_5a>GG$lik=iIZ7wF zqo2HZxNrmaxbl{gVg&8?plf5U0E1#P_W4#k^`T(5nKD+s3)krH=6?p8f`-o9H$4YG znb6>J;`pZu%|tuXe0lMl6xz69_%%9Q{dQ`OI{sfQ-@klsf47pi_^3*sw&7B02*@R< z;FIRi&!>z$vBJ0NMcfy(iIRrWWdt@TSwIhAOjD&iFx;pIJIvhNJgk!TJoNo5-1K2$ z%7^q@c~F5=F#}G~;nB&`*~gx3%gdGy*LS$hVoS`LzDqcKB2#sEKrCLb_v3{Q$dY<* z6=aJJD{9MJZ0uRdo$EyWY*)5#)ni%K+K&ZL5@1fg4`fG->HS!+^9#Ik7U45_5;_xz zjW)0HoHWtkv4H#MrbKTMS`tuXdO9x_NUT%OMx=l2dAe91q?yOMDAn)v|3>kDHFW-? zovOl&$01Lz)%_L>&c#)@o-x{LV_%7TEPbiO)ySd4iI2{E@p z#cZ7NshLlXxYfM)r@tw%Kbfh~P?P*Kvo>9uw7`E4c>Mm$A4aZj-k`|LhdPF>_qZ@_ zU$LHcs*hbGL-J0dfMM6l>vF1p=8=EzE&aQTWBWz;TU4bdPsfZ9{Y0f}@sp&K)J{61 zH@ENZ8FwE{pwxjS=41EbiZqfM|^ZCfOx$*k;m}!3uSr!I=_SFhjKI3YQ&>WuJ*{|fv5U~lM$5;uWHL(>hHa4 zJx6WCS3Z6E)TXH0(azCPZMM=;SNx~&e{(Z(_@o`K-Z}pKUfUB1i=ojB=Q(7V&amZl zS^6G+c_z^@a&1v3Z9|9bOU%xJCkhj19)*ldO?i8c)K`sv7=>`eMImpF+U)nXqcqbB zEQ2`F$6MUy4OK!tc>&Tx3G;A!VrNHwgHj9Qw*d`r7nKThn!<|;+)~DnkiH2<&&W1h z9=Zu+f4U)HR`(#Ldt<`#jY8j3Gw|YoI~QeneizEp+sYR-06nG_fnsxB?va5|=x)kT3d>~Z7gTCm)Y5m4>g5|-X{bs620 z!tT*PR!KWHa^Mkx*Va^oiHHZg(63$Rr3=O5-C5x{86%BK=NmAjCkEH!K^}2)=1EkR z`y6Gz*qBc>va5gGKU+v(adsS8=Ea z9%Q-IkVyXDq?Z7M)LLvy!ne*R<^oPQE=3$@>m6Tl4zXU?Vwg$DZYHdvqF6=sj;RZn zo~%MdV<)PfE3jlFaGN_JB75~TBi(CpAq1von9ZccTDaN+%@Htf%9uCOWl#&sAnAzw zfmyHd-NTK%ibb7U6E;CmP^G9VVMHYq?lb$ITzPs_WsN z6`pIA4bp;{5wzUT+C#~|JZ&Uk$0BErXeJsBDO1+-7g?Dwc22gaEqfcc`qO47U%kE6RbwEAY|If>|qM>D``^qZG&i<~gQ_D$(Vev3PDVGGHZP+;r zwz6WoK^&@Gp!c%8M3|R1GBe_cSlIQ(wvD;7$Q`)viAgkU^LMsXvyDh&N|W!@?)jV3 zT?v!NLC{%j#~TIK#yEns1sNxQI@TB=oJYa6_-J6EPZz0FrttGhrL!(1q30U(JLkYx9P*Jj@@v3_*-$4 zq7PaVQ&wTLMlCNT){z4#`F9zgIXKGGIyyQs8fkpC{l!3~(u|*a;P=21KmC8!TKSu6 zO8(0kp&VmU7OC8B{)g56Ph0*VQVvdZiv~dpD$TL$hkle-Pym(2x6S_B9slQvMv1uW z$G}VCbE=rLlRck2_}?w+f8-A!alHBAy$`QI{}sl#Dy=h)c%*@~;`?vb3_u8y!W}Bx zs1{E1-zbCsdfAW%>{jv5=E5BQ7p1&l(VJ{4PUMDo?teA__f|g}O$U?wFHg#LjyoaQ zzeIG1_P==?0R9UAPJxf=f4SPjQe~p@{6>!>(9opT3e_c|JMB48(^6kNrMii6y zr*+ert-e1I(A1Ud8T0uZo z${y|4uUjDXei>bBu#=VpoO&I0tej~R+#}8Sb0{~=@5=^Ua^l8#c>h% zzFbn8>pncxXP-g|(Vol5w1Y_{JMg-Etz($OhJ&3n1m7(=%-uU1@v(au1xJGorvq^j>YafqRWGsZfm$?{G|}RpHr*UI z&t!%MzA{~@qRZ={YaAO)TPn-X^QZ-FHPZ~;BowhhK?N;5TT&-2WwAp|^=h`H)j73k zZqBIe9ZBrW21zz!gy}Z#&Y}akqO@Rudo8d*g-L07d^X1MIHuHMz9dtW>pBsB+;X&$ zz1W>TO=tMxWCfktfYf@Vdg_spZDzXEy1WcK6Kz>NVZchfB^cPCAQ?k?KF94setbgFn3&5&`YCCxbo+%WPc)F|=q=+-Ks{YV2IhR*F?`_E^2=yf)f zEVqkrbgDk>|esR6dU^uDXqod-m@drO6=mj*D zV^}9GI1UOYmg6OPItH-g=&iZ@Nzd};A6GRP6aucvcXE1k^cBad*#W9LHXlv9J9kdB zyn%MULG*_#I*l*bKlC29;FUF(r8^0XwamM)SCW!i#9}+s47CrY%+;rQd2F|FkN+A+ zyUEwQoJ0HkSte1FbgNxhHey+r;L@n{%DY_V@f`k40dG2lrX`*|3XE9`6 zK^DWg>t}Gi{P##afm_8FX`V z+gemx_c_N2`Ubr7gRxJ z^OL-FrQbj8(mdeMw4)=4RQ2X`=SIiJ;n5+B^O0QVn0I>Ko(}cW$5HMHHTih*B}qFQ zZ5xH=;(o7mN{cld*5@*te-~CR&eo#W-}*-_H|y2>T177!yx`v;-t&c+V5{~0o*C3H zqNIRcHI2xlI5P`&cUBuy3M$Xh7ELo?%gb})mcaz2`YDWip#S;%qW*9Lo z7XE@0mZZGoR$-wAKR+p%&5;*ka?}C$Grv0{p-(?e7E56cngO$i9xJqZq(LmrEzbgqY zYf@7k9r-^6a&{fd%rSdVNVoW3ckR}=Tx;U8n1Z3e?d8miT$__iivWwbYg0(z#jD@D zL6X=M&tG2K^u%Q5q*va9onz=toQ>|gJl&n8Szp%6y zvlv9tU49%Z?NZn!y{p61M~NYsgl9S`O6!y-x{ismUw9>2J#PY&LuWI9A1H1Wjj_pE$ZwKjO&LM#F&b?JUhqb zI^!KnGYsB+wcwEMkp%}=d`xkVF49CDuY|lPjcBCit@73}XoBR_If+H4k2H5-c8)jR z1G&8rr^i_nKhoE?M*zCZM;N{KdGEN56X!UG?d?13?|;9kPw<$K{ALK!6P{dRhp2QQ;2&hnj3(vF88 zHX73M-lruh^lhKZL{@bAsBgaZcX+z)u)b?z@AJt<3q_92+@{y@eO_xtxl35|!L(j` zi2NS%!Af=d;7)=6FIB(AORQ>EaFTg5M8hw!ck6y$LYDp~URI*o{#4;mvzKADbNkE^ z2?5nS2rNU|LLYtl1Y6-LCRr2w7^?Qw-$JLL2YQd@HQVR@AB7Fyb;PDj4mX=i)BCql zbX~XddaF`|dKlH<)s_cy*A#W^SJ?MzplM#DG4?6e%X-VN%kOr_#)~egZ9koI{Eusr zEso)^bivi9C#OU4vVBv6CsTpsu2M&MFPn6i=#h{LdM77c5n=~(CDmQWYv((v z+Cn*b)Vq_*4Q4-tJmYegT;|D}(97QX`=hYM>fHdN7WX;SMl^TGmpcC#&}&SB^t0En zvANJO^}>F>BZE?1Tx(zSB%emS|=0rwE=lDoZJNymz3x!}pl>?cO1$-p@#Opa;b1Tj?PXv(Q;q`i`lbwxLmgMUD<>V8JKctT%d*dumKR>QiVbdHTVYf?-QJKgZ%kmZ{a zUTXLmlCvjOBlZHczq<$MEE^71vp*D#a^{9Pe(#?ZDALSbg1-*sQzPiMxf26CNZ>az zloxI!bjy(|SpF?HfM7vhC+r6KDEIU4qM%IU_Yhg zHh8c57_!pZ_pwsT@LMIvVF}vI4KbJo)4)*@Zmb_~`B7~4I2CX`dTuqfD}j?X3hZO{ zZrefx&IOM8Zo#dxbjM|3cqw4E<7)l5s>2FkOUojh8ME6S;3TGCt!Pm@Ch zR1I1`lu@jVk%ApRD*l*mrk)@s(zEUqBmOX1yoD=l*3CczdD?1r zEkku*%u-`_e~LcPuSXA3J-`@@2GE1Fa`7l~>ntng++9eWZKiwD28r)!94Ig+8%Dqb zAdiFEk~D(ar3~@&ucQdd)S8MIf?azyf9VJTHcZwA{e0Hqlno9i=JLH{i4%Ipis&GQ zk5NJZpTfaWx0{Cr-yh;Bg_5(}&Arz`2SNGU0>&!#T;rpJHN~z_-;Qo`yz<$eyGZjE zRaP4^2EQq_reH(Je8sH+5eCW6ea%sxDKc5xYgztvSqaJVVB!R}$Xv_(u#YEQ?kEZH z!|e7sFYTBhHgTx|&HzjN(G-qfTn;I=P*;$A$Fk{PkXXeH2W@Ox$Yi|O>!>K#E5ikZ__|eWPX-_@a zLo>Egj0nEBf6vZKQvUecNbQi>lX*TPqNq(5yW*O{z5dwTu8N0xGv{9jQtx%NS?g^` zRyuuORWn{!EcUoG z3Q6&yjBPdmZW~H4&NL3|RD-6ffskQcdVJd=^7!-dV7(<6;C=i<4Ur)DkvL*4K3W`j zwxS#_{4wLB{Cy)j{nK}Z+L+E@YVOOqD9=8jgguQt{Jt}hT-cfJr*~y0X)kQR7W7u~ zM#Qh2w{>;fvnO0FZ-u{L`Hg$0^J`}>6Z@PK2H53v{(ON{#M+$SSVjs<9Mpu@$j@kz z6QWsm7LY=URV8O2?WAanVYi~)YCr9bmTf&!E@M0b1>a!e*575)Z#7!9q>nnnZ7!o- zmVOjFFVDO0LxYH@qsvY@oK;bECr93qs^jUS!Jn-O3m`3*6JGSI< zWqeA=5ugV^V5OfEupz4b<(J$fgJXa|$S$FuaRi)EykN71xWS@)@Di~<{oPYHSylkB zTcBADXcgtccPQi!2J<1mFAK&JmgUVm5v#8!dQSy7MRy4m&M^;u3g!(=z>BoeQ345` zSNEg|G81UqbN7kgW*me5)-0a83(r5yJX5o2rDT7j~|TppH05X9M}K#4FXvn<3?%&)cfWM)+>)fbsfhrLHlwBoQ_eon+8Ljq6RpOarJrT0ktk9 zc-k6PZb#_T zj63rE7DZQO;ko>5wodn+25ep=gH|)|`~ieQ%T==~DH(h%437~yg}Q1_FL^O`uA!t`+6k|`{n%9yX5)MKIH4dWnoG4)BZ5o+eVvH?CEe2$nK4YT9V{C{$AnowEsbST4Lt9Q_Bzyti~P<%O)de!9Lf zLLjv*Wk!-Vm%XnYM9)5t67b`Rbvm_4CxrDWza}G3^Dkq*C;LrNXD2BySBDCJyJOSk z4|0OF1T%xbK-TvNRDN&t-|F;%)$E%d)N<~Sccme94zVK6&Iv`qA@^8X75Jc9$5KQI zR@`&nL+5)!*=5~op{{1Vczs>l*>%JW;iG2|uCB_W*s=!&ic42M%9>Sar&22Gzh-)* z{(|c`6iC2^&xNrs7s(P&qp%TCP~9g&_08AHQ_BWP@1#cM-oFq1&@6hVwFGA{0A}6M z;FpTF$ADo7AIzt@90F7utx-rnF|dGiV-%N`QgiT>%DHl6Y>=*T;;S+bnWkv(Qv%)7 zZgw{c9cBM6Rov9#9THZi1nvwO47fUXJ+U(DnCmPkhI(YnehMfvyD;uQbvM5iE4=i~ zu%CIbi-=cVUzQBM>@ACwGoo!moOdm#_rK5!DTf&@jeb&1f$%E!gWp8$CsfWYGTGx3 zlwPg7p^hU@9J+_h9UPI@Tl7b-u9Uczdj`glr>w0A0D*A?e| zhAlc4;zP-T{r;CshO?gg>+~%b)%9o)I{iS?r^t9!TJl?QN4coJIhY#sN74WV=`GHN0;cxxA1pX# z^WS}hGXsAGn*=)e0=^shctoEr35x*moBiV@g~t5nCv$n}Nr-U~6=mKeKoFqp?ns`Q z8`2DBl9X(Y6SxO__pGLN(kCkKyK(g4fLfSTz0;-~3My1A8V4{YhN`LO-l=h0a9%aB zix6d*@`64^5@+36NxZ0H$i2JXP;&6wZU@bXvkZ4Ia6vk#Af~IKqoaVDN9{=IC!3+3 zt7;>u<-SQ;ZvIfE-c4*|BJWBgN8cGu!%iaB%B&u9@XBd6?Wd5*vrD6U0bMe#kqEgS z>?FK#@HA=BZw0L!{I##(Mm=g`zmq3kaq;YERlWA5d6d^}$)J#8OpMflnBjHHL0UT{ zFwH12!>VfaNEddMF7ZG@&E?|k{-AeBL)XHaaZA3v3j6-zJ0@vj#e-p-td1qBbe=|8 zKQiWDwp1>#gnVdNiZd#4{+jm@fwK{|nldL3Dt#wYI|kR4)v>30gWQ}_u5qMGJ|$bz zr9RPVytwZ7ekGyxeod*U*8+AuqQ=9#al+DuiMB- zjS6%^LMmc&aQZq3Vg#l5Rq1TqYu)_T7kq zD2HDseTV z$To_`!8sThtQE-UEY}N1D$(_H83J+`4(KJ4Na|lr(USyX;^;QYY4y$JYye>*fotOj z<+j~l^rOpZSptuLi3ya#`^ngE(GCSy+@^m2o7IX7w>F-IgK@ac^8~}C-$0OUW=3Bb zZDMHRV*v9p%ddr_jSOMHBLGUFxq(QIP&@L^4d6WcVZTZY^KUaBM54H-6`62QIM6`l z{(VPL_F;bWh6y)vvQ{s|>%5V@aE29$(sh~@I`l7LJB_iR6}hww!zED6<0f&06TpeL zw@s}6JF_ox+@|Z*McSs=6V}&fw`(MaCpS0*_(_UBUQ`%K4l~OfaXB9KDScr8%Er8I zt-~#DI|)Un^)&VE1b3BFChw&6)NPH|j4g5f;_q}UU+hyNBFD7^ zaf7u&Efhr|d^se0Z8lzH3`Uh} z`QyaFcz+dc#!MM%`GB-C_ zJlR)aDGv2(sAU67^HDM*0-qd=M!A_yE&Pl(6T$1O6uDzOf={SGw(S-3cM@uwN#JL9S6(c`HWxqPe5`sO~|Jhmjhi6h>SP+ ziG#;sfsXvw7cFVyT2h_q*Pp-xG+LVF`uh!7kns78ZC`+{%)2?5ly~#_lIXISW7Cy7 z>be=L;o5tq-iERwre-w+jDk7(aye$%UGap1z)XOW(U9XEG~m* z`24-5P_g1`%FWPs62;))4gj_Do3(M+{peRDLC8C(##g_c455F4HL8tKTa0&FG~6%v zD?=2F*eAuF`w_+j;M!H+)s&fte?S11U%q*B_dOAfmekNx|KCE3`M#e(z%xK+R^4yv zku(kBJA}`>utS&Pe=I;GBc4i~lag3uO2cU)RBt4oHJE?pX_4jHIW+sy@AzILJCP63 z=MuJ?LO!98=0HJccAh%ur^7~K?eKl|gD8o+fV*lHWf~>ip_vy(0}OOG>97xNxckz> zm;)>V<{Q8+5W~Nl4&OQ{g3PD~f}lXw)!^5^lH#Tqt1IM&TxYvyrjzmHIAT10>zFT! z$B5A?BvPZujXq%fpQ8d%&G9h0ao7xkidRuf)~2F3({Rbzojb^5VAObTZ?Iwm zv3r_NT@$ZQHx`IuvJ|Cqm>FOd&WKeQ}dUY;$Me$mM0yL1SD6HZ7H`&jX@;@f|u=I|Phk$baznc@Hg zfJHuQiE==HuJna`QZf%hVme9&TV30HT{~It3V=#Wf5p4NYi$$asak92_`cngZnUdM z8mu2|n0*jbhuS-6RCEtl8*m9Asv_tpoZ3h-Y(QQ6PDs?gnB!>58GdM5{1m3<_yS+j zU{y_m?xPXIBiQ2U$Xb|f7WH5Dg6{0A+CY&QZt39Zz(1MCo1x#zj0V|_b5ltnqdKb@ z`hAhy6byIxUdrJ0|FGoiDxmE*8m*+!+p6AKlo~6sb#Hw(yDji)J^Yea@)v-$Ue!V%ntG) zsil)Z@Wk0FHBXx>O|9fm--`eyVF&M^j`vxo>vP8)@s^I!Qor7Skv|-bNqcg`?ALzY z)s$I(fa+;Sryc|yJVMp?w|wD>%#<-weBHVz9=?;DoviUfQk+4XAU20v{LA0a{kOb8 zC5PA!|BY&nZnKBRJAZ9{Oj^1;>qtID76&c>m}=>oqk7yefEw@Cd@^T|ZFJgiHkLG&Iv>Pxl9nz|V6_7@Gla6dU&+JQjJ3lSty>|uYK$Ym7XhvwYP zI-PwfoSV0nx)LRE1Q4}EiiG=_6Hw{UMc@fk@+#_6Mr2C|SK|_MqC?QY!dkPv*B&#~ zZ}hE{%r|4t9olqO-E~+y11!{ZaIjWv*)vMjAmY@L1R0nO?dVOne@7Xm-Xq3i9U$$A zSU$Ngbs~Uz7}EK5?N%144?u&LNM%=MCWDe8N5=x^qXQ7E{>?_=fyiA__qP@htaRJ) zQgRMnR`~JaVlUM>=`YpYp3 z3)ygLo}6qB158!>(`ZSoCy>O(de{uSTL8LN4~)WN+_=Je6(Q9xAN^*D9=uHF#$a+Z zi=Hnz2k2hm)~lSGPqQBsN_I^AIQfP!r0vU?Ai0UF^We8@&!-JeF{Z=NiiX%B%qc>5#4;bRYbG_vQ@{^a|2BroRneNAKIAw%ZgV z1_k4_s=Kv#lUvHNGuZF*hu}Ym?9c7t`$rP+UJgH)W#N$(+jK|ponZRD?h~hCsM_wp zd-SOW#lW^Pex=3BjS@VgEYj8Fb?OyLfPoR`+dWeum(aC-ceOpg4SfOwJd4gVy?!+U z-EyO%++i2e9g$_eM~#d6OAf{0{*lU(CVuys$r4F6ms|Hs%zCVYG7>iTn=bGm`bm)+g?U*INqNW#$(tpLJP0;2ISKv zmzQxF)AlKHTX*&)*6f9{`gUCGZnTs&ngIRQK;Xrg(vJ^bhm0?)r=6Oe`~GTMoDz4j zH2CbjaB2wNU=g3crj+$bs(!|6_(X-;lTm8@N8a9IjmPp3|A283@B#ai6%U%u>V!aR zqvpZE#mjjw;o!T$%=g@vcHpYAM+$-}8AW2+HU#Y7M)8I4By&f(f%fHck7>7p&A?*( zmHOojN9S_)IfO|}Xlp>`$wY9xfm{9cAltF$VqrEZ7e-_~A9!s=*6=j(4ZZ*)bShN& zdx#Vtt4_^4Vvly^CC4s-V4LHhBMlMCmCJNub

fX{mgssF9JpPd1OG?hUfg$$c6u!}YrYP%6!<8$E_G*uL)fmD7PG3vhzahX` z?RU&=$r7n(8D4a0fSQhR#HXLjH~ah(Hqsc7M}HRELoFw53ARh-iY4ho4Spzl*Uqjb zwbYgTOx+4EHG5g8p1guk&5-3PeIR+4ooo`Pw8^2Y<)o2UNfsmH@I`_fkK7A-(SECi z=F2KC?I$u&$HL*fWlGE91?LW~Z_yh^eKjZKR#~^i7lLSvS1kBj^XE@h8-B{sI`o9Q zmu_&O`14c-0g;#iNieXkL%q_hAW_zed?jjIe9AMdlRaRjYKD7`IC|5jO2O0iy13?M z@GTrC7;eiiSlK$^^5LUi{U(?}MU;SNA-=5Qu2FCHrI z&?!auX3#&4^}Cy4o3DVV_S17*B% z(yrMJ2HKIEd*qjk0$6t31!Fe7ncg<}qgF4-&CdZ8?5=BxB|EbRJZ`R%B$ zzKy*K15Q3jCg^Z#e!r~5#qO!kXlK$~pgg#&!}mLV(8`PZ_1ng{0yQnlssb!ts=xV@ zJ?|0%YyK^{OPnTSC-~tDOYHq`gMJx?TbzMj?Zn146VF`I)bED2$wVy@)n;*BVvNrrq z%k$<+)^rvK<_Lc0Ext$Me&hWZ{DP?wI%eDG2%}N?9A6_4 z9_u&Uv3S(4h0~Qx`Cuku?Y{^?0wm2SsuU++)4jsGPuY! z^#y`(T2e+RU~WgChDMK*uCQ>U`<@+SD4lAL?BV-3&x}~Y?L?t{wB~AgEo%9di{*HO zJ_qkN>BPyqRf2l_avt!bhn0L1jZL80s`IU&7U^<~-$KQhueP$L|6ZTR?1}X->q~{u zWzA}@>7#BI*J-x`VV}b+LN4jKi_58b8u6UP$kwMH1p>}@dL<9Ouff}|!uoZ*S#!mb z>Ap4)K2laVk-VY!k64(N+GkP~kd!P~E9oqL!wApko}^g}2C5begqYjZ@Px1g3rS*a z{I(V(0d&UAj*v0?nK9 z;Ag*I>Q#9T;}i#)&XGwV$KI;XU}vE|z8Vwnmued$#b$cT2b#yHo1Yb(|Dp_X zInW|Czfp}E-wCw3iskiLuR&x-$l44^9q^8qT4wOcCSNh90*WlpksE_|EV0nUgFMh> z{aVVy)xs(;+UiSZh;J#^GaVny<+CmE=6UV3s0x;{_PoKg62&cIBc+TgF#stN*AV+- zD106P*Gm(^dWa#`_k`Gg8;lr!%g#z{GYCf(0es$PKaPOtw_J7q}LT~rO$GBzUl_TOJ&0~E_+a=F-CMO)`KZhzMi z$=RgrzjWn=6>#t4h3ViK4ILa?!3+{{mWA`6g0F<~|cX^rZ5TLBk zDL(Czz5m!fA~eik-$;ip(HZh;7Kg6VyEE_&|zpOB|)`4}Vt2 zG*$7AEAi1<&EivywSWPX#(+*WYffQ!+Y)Vz2*w(>G;wyGT_l*Xqa24M$2Skv7G z_k|CugMLfcr;S&3?#?_-eOEWl+@Tlq^k1LUzqVAVcgp!kIAC#y8bC%SwbL3tMRX{? z?kUr-wAn5@yIxBwi5rGk2O8*A;tyokQktLTro12(gEQ;FEb#W z$1B2zzknnSQDpr<(A}{BC97uI@Y1>N2~RnLdU{?u9l19yWGFsyvZJs3v1F|Lr&Oo7 zUWwdQT#G5%ejr@53oybHxUcWhhs5s6YXF~=|#UvQxfnAc*FRUa3x>V^#WWEjiMe!J3 zvq0@j12qYv5$iWtpg+xM#vPX{k}3!U=@@(l>mpJoss#dn$qsbOp8o3aEG_;in$NK0 zJ?u_?woN7%q5`{KaHRIm5=g6Y_cqN8Kl~lB1&=1)s~7F`k#<~$1xNTHS<^2giaRdc-O%Qf#x;2 zo-urbeZe4TaKP`;1}`4hk2fie@4elc>xA-XIXd37+8u4z=uu{Y)VW(i-$*hE)^L5A zc9jX-G39@ZvF!QX>Oa;zCa`O5yp=StO7fznG_|q=@D>-!mgr#c-q}sY*&Nb=-+$G- z%V+hJmBZCSO*o+$pc0IS-{8Ot^Jp9slqhV_E&K$AlE`yZ(pKXWeB)9!W@)6SeIG0# zco#{C3Cp7$FqXzkafuVR;&A^cXiJnrrFI+c)(F;#c(+ihCPTZ!by~>1UoPL5W2f&2 zS&#Be!{Ohah6$S8Gmk$-k4-oq4=&}xRJz!l>uJ2EREc~i9l?q0YU7F$BLpkvq2-Wc zeuCic7p8ZT!a+d0@H=$iE?Hnuomu)ydS0B z-Bj9iT|JF+%q-0jAmEe|=CVXPA~$8YTT57(;1FYPof-vjBfHsOkE_Tr;HXJTO9kDH zR5^qAaYpl2+y(Ut$6q*Y@iOs^t5crsoXs@ivw%hTop7NkvWcnMvuW}@^Usfntm@^M7JvP5enh)pyd2l}Z|n&; zyCfW0SJxR-uD#eLYQI<;M`#EuSC(@YvZCawB_t!do4IHh&W^k(-Su=Yv1s98^?+|r z&5JVv6YH1~yW{BiOy)$BwAfr*%A)%&MeT7>MO4dm_3&89=mi-hcCeB_pxa>mG}R4>*VpVTKKypdm|OaDS}>!dn&_UDGrf*NiKWV103Id z0Ap75gqGYn$WO^?16?Nkzo^F_wX5^x$b^a-?c3~ z3;0Bw#WQUz$S;`Y4KA@MuNo-ORbwa)8ytH;-i-bGoi@p~iqOdp3k&H^+ zFI+)QXU&|v>=g3BnHCEvvH=AC4WG8$1y^hyyiskS?bMA9A4AsR-J^}gPZcgWx5o|H zAOqY3uve$hmH8KZuPc4Nw9(QpW=LKZji<7()57XEfgFK&Sz8qymE<#9(NoNgG%9eU`R=U+D$&iIB(I`R7`oY#NGZP26705Z_uTj_KwGzhRhtwHZz_Qfmttd zFQZiq90&vPvGHUTS|ak|Tr(vw$LUZ9qvlC=kCU(?1Ug2f;#X$kuuq^JhF0xU(w%KC z2hh>REF3IyV9U4M;Q|&xKV80T{shg2h~GJvZWF=%ff*V)Z4~4%IBK0S-B&$jVnQj# zA>vj174r*I#(gQlux$|hVJdj^N`m2KOI`QhxLxp14`K%vJCDsTA)gw<^m8Rv37di8o6Jprp}%7DvY~?SFcJtsX7r~j`UAz%r|gOOv=Z5u6;Ihs>UzqC(`D= zigN|-l>W8(!I8~s0|tApz(i{p-VWfPV9_^!vwcyecFq6(jh11++u-O)AMCmjosDyk z&9jI{W;Un0(<3H*r7&n$0o9-Ld8b~5&1U zw4KgA#MN0LUX^|k4q!vi#aj1rzixFF_k&lhDggVG(&HSkCuwo3_cP~K@`QuFLeZ>a z0>a*c7@Js0=c?cvT$SUSJ<7L;&z>~{bB<5$g!ODKDFds%r5kQcNA%Jv@`ZcCGDS$9 zVw3_+BIOxxfbX(Y6e=zSCpt^(U@&adBrAUV@OcA;r~4?m?;{0dhOreQYNWvdki??k zPGe+rNPX4tf$Q=MT8JS*(XZPP<+Po-W|3XP1PpyI76_;bY%nLb&TCP*I+33?`hDoh z4}KQaSGwO3qc}VHu@Ms?4OS|KW&^?i5rIHl_1K{@#F9?!{sC`mDw@ek+dp=EpuUpV zv?%sM%w~nXm7ndMmeyUs?cj)uswXjUTWB^&cFMu1<=%lya5b(`Bdq*aFItSyZg8|3 z2MSK)_e^A4E6N^@T`wy3SJUZ|v|Y~I;3AhZY#GqHKP?RwNi!=L9F0m8UmZLEItSYq z;U&hT?>9^jVlUOE@+Nd5)gf95-OMsFuV-O&K9sXFu}aEUz46hty*N7KuK5RLC+=`~ zq5GrkKwgLFAsn_bZjbs>b8Po$As-1(lL#NlwOvleWiS4N#mM#GRhBBC4F6F6vIAFr zoeJHRo1pYCvtgC|YKTw0|90y`^&L4i)_MR2V5UP%T0HVa;IthkX-#Hy!zUM6;n$!3 zQU^~rV9DqaVz1It9O@uwW#8DEk>tHuw`4z?DP&z#2(28h!tuU*o`awtjqZK{>WaLe z>k3v4E_u{lP?pML$jeh+bqvA5I=6|CHiwK#YFBtYyu6^J?*$zfiIEdOe}>e|%bu67 znjDv@RqFgBa*IzxLAD(Khpo4ciaPAta0d_&5KvlDM7l$eMi5W|QMx;&#G!^96+}86 zVrV3UA%|}18dACihVEvF^W%NL?|f^Wb^gSKtXc5v{p@G&`@S~OdYTR?QDPj19;P(% zL>5&pR&j%4wcXwps6wF1d&DdovVoi}C;POTY~y!-u8`ff^v4$<2GOZMo7_twJKyXm{mC%UbLju;df9*xN*lS}Slm+EzdNo%wX_Q?H8w4^Q zzIsUmBq5IY+OtxliEg@m7A11@Dj*KRgZ#kXU?oa%1RhLRAAVuVdn_;RO$J*`tvy!3 zp|b6f%&qxO-CS}_Y}HLSL^*9>L4n~&D;&e6sl&wJYrJs)QfQpfAzy?`+V4%QZJEnx zWY%hf#Lq`wP5zBiU_7~pEf23o{x!gC0NE~{{Z+T}JcI{zCHTPZ@H|f4Kqo~P-?SrK zY$aa`I>*z;4oo!o#`*|BL;7HmK>}#s8nvV*1tg4*sPyzA&>l1=Ev}5z$2Aji6mA#* z;sF#w{0r!ySf+{(yO2jy4vq1%L`XR#Wlz11JyCl#uh%+kV$d%Zb3m1CIeQKg-{>Hs zn&N7c)Hax4p}S2rj~tj@Y4z#u{H~XNB{hG90J@<9B{})$EG}ryW|WluZcGH**k%HWrupkmSn1{ddQlF;5XV-TI6^v2Ib%}(<`(mVjAT`^0z9f?>S=8rbDm`VxuIahu=w8+G_^eX&r@&+Ec5mE))%7 zkIudiA};4i2R+29;iAER{NE!xu}9=MGC-j?uMe}?zrSq2tEinWF3~sg;0eVO2}iMp z0ZaQ%@V}%>sY$6t!_cP+0Vc;=i!kc_F@DWtVh}JYbA0v&o*h$tF3cD|K-f)JSWUwV zW;^4dMGso5z^1s$T%InY@Vk?;k)pK%du3(Jfbc%*Oxh_DeKF$F?BB1Uwb~7b^p?c2 zqoj9x#3j`0an+c=__2O@yYmkD3YFr8=P;4`6Jp;8eq321p;@8%zov^y6*+Jv+7UIk ztG*+3suZy^Qw=XHX_~%TSC$o$y*Y?N5sS^fAMQ`Ty|M+b{?tuox?03Pm6g@wzJF$h zCkX69=_-rch4SYR}+Z)PWFK4IfPIMCd?U4;XS!cd?>d z9vOFxd?)GA54k(w97LAD$V|4=)%v?i|3IU|nIhBa<5H4+zHMbMhF%XAjzVP)-C~eC zG{VHS_}N_!|3{`-AL$w*&Jk1OQUt?)*l|~)=s{oq8KX!@tmBk(ybNb$$p9DA@joi7 zHyAJ5k*r-aVziCoE!P4KRPIyqnicR^VPWg1RO_!GUIjCa%`M8juvvZR03Lec*-1ZM zwh#LnF8tPdY9>G0+;5V@Uoq$IzB(oUs$}aa4bzVRhcyZiffK(@VsoKrl7T*x;ed*%nSS*3^sV?pCS9>8_a~~A$y-*b zC)8q!KP;!rw>Q@FL4OeS!o?6!Y~VD>r?V?%MzxBoGeDW4S*0YQpIZ9vexO+@t4oVf zXZ^WA+614z`BXVUzst8WEMDs|^n(^}DB-4c2Po7&)Mo|7_Kn9RK7zqNUoE!>F3wEf z)@{EW+8aT+k7v}r`Thcm2WlL;6a+nmW|_iZct763vy-yds|SNw*yMrQKGoVDeRMDi zs*Om>E^9r!h{3y$`-4rE_dB1;ywvii2Vv}6=Ho&YZARVa?52WnN08~YP!3#38N6%O zO%4$zxigw9wDUl~0XH;C?*NI%!mEG=LFGbzd$`d#TY1d0@xA{!@Y25){I3&%R@McZ zkotvtK~8OTC-D71_B9j`;d)9@;Hjo98F22SBC-8dndOw>yxQWOjgl< zi;tCfD9`=p$_~ZjDMht2OMxD2gFV)JF{pIeh2xFUE+hYoRdg&+NJq(B<^vi;%WrrI zyoNS>b?Z-$Leza*jXb8T*{ViMUItx%I#@@7oeH5;Zdeo9dVDc}l7iKy3$~*=6RXny zlBMo3)#vHqAC;8j!DC(p^h5ZIp%Qv_9XuBX&%wJ-tG8zfAtHD{r|N6Ip!0{{g)}N1 z2AA6tXQP04Lx+3r;@dYR_vakSQQK0J74(}t+aFz53HNcm-qhb!>pxWbCyOmN&jpKl zunal54Jl!>S(i^(M8^Ils;G`(wdVp_F>DFlWuo&L7V&STU?P0GJ_#833Xp+KKyjhq zZ>oDwzb;H`v}oyfm(S>i9eonqEBhF&irn5YUhBjiFSCEbV#ej`i$0#J-qwb|PBKlK zUsD5$xc$xOmckuRRn?8)UsLU51`o86BH8{tN*5+!Bcuit-aiGA# zdVoa{w93(n#eWxxQ1@iuHK?6nOUMLWjL@W_bxL`FvuN=`^!+T(Y|sg43ybUS_(3g_ za~>bs#JvnxPW0?=&vw#DZh%y`VQ@tBo6W4h2^%e`H%=x~?t@wqB-%j+pitnJ0u9?A zqK)s(9ztB(6<_QDrHP7gdQ>`Iw^Kho@%hS;CM}2pB*CLz|6N9HUjGT%*1;!Kr_WcT z>nbcmeI&;Et(bKrx{(0#)TQ&K9%H?YZ%z-~$C3o9JW*_{wpQ%SVpFI+leO?_^ZOn# zpse&;eABOlCmI`_PI=Un=SPm5R~(N7+Pc&K;E8N|h?`F?K==VygjJ<}JSExW1lbS9 zs$r=Q!qqM_)5q(x^9Up4JXeM(BVUzz(YRaEwL@*Q?idO&kD!|uxaXh3D zaig9pF$UNKq-|QDSh<>cbGBZ;O8~~E*uw428LHU0zCVzFykBzR;@xP0_72Q8q7kUv zdkNn@$>2G)s$DVM#v%h5{GEmk@EV$#h-9wDHa~G$D2qAc>C18Fjc8$$V}ce+U2j(v zA|F{*{q~0^HTLK~UT?@U$&tYkNg~tJ#w#fh04BD*@;hw8UF|JeJd_R_$b|~TU!4KJ zj;|5!%C(Bb^_g%NPgz%57Q@T%pQ$){h6#h2$C!sI$kBKqk1~gt`KC1$8^5oTIMJba zrGW6djE9^0%02SW$VkZ=P%4Q6x(m*&x6;D;hJ3PC5!OW=2g%mE{eRL}OHnSu>IQ2D zeCJyupVP}?aotKfam>gh7W_(YN%HhhHA)P41l<1|Gjtx-W-veZJ6#L;PSK%#_X{n- zC1{}a?|Nbjv|l+cd=RQ+?-`d8n9)8$JmBUoQ@u1D)y+L+632^rH z1Tz9hE1BLu%ep%0Q=*rdmbw_q&OQ119X|OAr-nweNyVHS7eP_OVYM_vbM~o#=sY;< zv449vU1`V_f+ku>Z64~dRPz$60kUd9&ZR%bxJ)e3OsX+^*L>x=QJBiGQq0_*=zB{P z9o>NYG+0VI$`*0caCO*6tfywYC5j2s5yVEg2#Up1Vu-o4Ye8;`OGZJnRD}x(iA3a6 zFZ#y*_fFX{fL2p`^MpuZT_c+#%HYD@Y^~>y%>;=W9&e5fvp9O^?Q0&;G zq6n|y`};Y5T-a7v&tgq^Z6e3^GQ8qG#(DVyM#!T2qvwK4wXUXVOHhNV|Cj9K2}twBH`??z&AZu>{M7# z>>C)L@yCkwPq+U}f_sry82rN0&(K7*vSX$By7`!ICZ`cT=h_FH@;RD1CZ%OFU&V ztt_yrvtRnbC;SqAtB(f=ukkp%@7h}%@Sf8?+~GS37*O&YXvr9#L-naJyqNOQ!me^M zcG~c++_YLhLXVvgPaj{jYL-oV-Q)yS-RyfbqEhU4!{e~pB;oIzJaID2{pQlYS~T-) zBU>aQwpqF!*vU=gHc|s&USXe_g=I{Sgk(Bg&CX&M>_|XzgRGdDCSLxi6 zAk)|T?qrHR2VfA)OrJ(fmHP+lmyUly_)WW2iqy1AS*a=`&!?!JJiSG>%<7KqoyHR` z>F3$~ba=MpE1Ru4J|eB+d_<)U-2_G%JqKMTAI*`~*88BRG!{;W>jx`jWQ8r83S*%t znFyza!VHk-iSisQP;#in@vErmCm9SI`T6q$EJvx(4qB2n}l&6Xop62S5%!)HPH zvP|4ZwIeR+<~taj_{N*~Q53Ii{U6oq335tnbHo0;t6cdDe{?%};doGj9px{92bkYi z+A4FNkdY7MS*uwgLG$166FUa`g#zktNsexg=AEmYW^DdEJ#pVP!Y5^YblM>=Y(d&P(A!?BAu22l4vN_LSu3E`i zsb~7BMquQ9wzWXddo~G+3npf?9<@IlSCRqdIh|Vj^eIqvBC>t^Hu4_n)0t_x+`prE zEu|$KyLp4YOiai^EKa~Buslo?QZxjGi(l=xabHel+EN>iJEF!z%e$BYW?=*m zq8t2@-o5ykf~#u@?$i`cuRO8hoX)mPAZ)4^xLn*D)an9FMW2QPq|~yi>Ry|A3mIKYt)>(jo41G zCwXL+%I303URdl#>YbM?p)4zYZQs^#?{*42d*;wS`GN8bkcd(>f*e+M`rO75`c-eY z;WV2#zVqwMB3&0k1yN5kfj5tSy@~4w z9s}TSfxuF>V(-F_3Sll32E4Jv0)*IFJ)@QBndE$LcF%Utd$QNJ$Fj) z2cFfby~}($#O2t0yTs7n3Xw#Os`EW}|2Eg?_Hl0D#^e394a%cWW5WFUgd6uorNG!_ zxJti_H0|y^ZBt4L%plcS{z+=}jA*+4UQ6i`!7sk(|raiTKL1#1?LqZGitmZ&`-W+)c4C(>oDG$W;NSW~^GS4%9a z?NYUsvnVszY&q$jSO95f|K@dO(dFf>Z1t?2iZ}6=X=PehmXYnrY!14*dd`YZ;+BCp z6!(}j#jkba`2mBd%`aSny_!9~dQH<_-AlqBZkxaJboL#`3getyx{@O(t-Ia!7ynRN zucf+HU0?#{?a-)1%@3#Rf7y8kO|CIo@l)7)QT&?vG`{^tjymix!6on|rp zXa%m`tW6Y%Ofn9UWS3uJC=jTzqg4!Qu0{0LL*ZS?Uig)3At*9lfqi#I+W*mL4!))dfD> zbMdg(T>nAhPU-iE0qU+gFT<1*^LwQ(4{g^RVaqsn|J{7v0eQCHiT!oO`mM9GNI{9r zrI7W5uBMQ}&AGa_urHZc&+|C#oFDYD9n(AaRe0R*`mQ^&WjBR|j~C+dBvI4o$78JPz8oH&a>^an1u_)dMa^tJ>~sW`S<@+{t+kzh95H|QjieTj$7+u z6nF!2Q4AEQ$~wE67cfQfJ)@GXKX`07pQ)>Yl$p}1bKJNTYP2&oTH=YQW6i+zeXFWk zc&}tK$;ffKh8IG@H(}uA&8O+(=1G`;*`7Lh6HWkBuCNz;V*0noF z|F9gaQeIzkPbf4%5wio=-|A9>SJ4?+M5;jxql;%vOH8w3w#wYm*2vGw<>cOCgkkJIvo#(aVbO)_48vw|>hGHa|kjd#I4yqn9TXt7VLb=DD36jd%v2FxFd zIo)%lV$(_9(s2|UjF%e^A?U92uS^RSQlq_(hhbBId?x#6<|V za#+e$5Rq{{Nx;%?N*4WjtsF+YdDs0<^F6jx8BE9X8=x_i{?0a@b7Ufjv_S|Jdc!FC z=kSuONo!n%&WD^Soknb>14foG0v7qREwwTW7a5u#`_%IJg-@P4IiBn;B3@ND&wi3B zXu2ighc}5YjZD+~Z8K9gbeR5e(X_ur+!W5Y!q;dH4mMW&$HvuW%Puc^k1&oQp|bxG zVi&M}dU6x_hI}14C_%)?dEHuTKlU!~;m$;+vf`AhvT6m-1Ut;nys?zm@0*qOle#3L zl#vo2^QJL}|ay;mzyZlaK`L^-qsHG1+I& zKk2@(OhZ;|h#@4@qZ-vt-?hBu3}b?9x`KNQ`FNy0>=P|U7V}B=6oW&?oMg!TBkx%0& z4kiXS7v;FERX5+x2q5x2K1I;>N{-_n?)vx7)zA8NddX9VbuoBW_))3LNRN$c`#E|4 zeWCY!CW7wvafeqR#Kmh)9PJ`|`)&BKp?LsJTiII0?_fjnBEusMMd|sZKi}|YgnG0> zoel<*g`Mlq-pxpVIW;$J^$(u-{F1w`YHbb0Q_W0!+fXMZrT9&CRl>FNn5SEb zbdPC!|0*>Xrj>E?Fm!)m4XG75T)i{Wt-03ptz1ND2{L!Ev>}+3&V(yy0Stfr!q#={0?OR<@2hGV=^||hj=cuvZsRFSYoyj^Q7rCiuEXXcjDW79?RgXZX$f_R~V z@58_N$>JpjJEioa^!n`vWQJNN%PiGqs+>@(38v1seby1PWYVXTmgvEN8|21hS@v-2 zcCtgUpy_!l^)~5YqB;Q4G!<5<=Tder2Bbu6{t|Hl9~(5oKk+fzV#cQV)+RQjBxU0V zdAU=!))Hb&()28Ha0iMsY?781k#ntL%c35 zr`gT!LF}^An<6;I`Gq8P(Q2k37(7?woC<|ce;qKac$s1R@P*4@YBMzjjL+6dkBa~G zXK{9oHKp%gWCjfvcUgHzOT-!)P&V$)W8*x@tDWNm^Sl18XW1Pq>w?%lWYjqhTzg$q zuWruQc6pOm;~T#zxd}JcyI1|yGf*n9vH3YTqdIH#J=1t2MKzVKmRWr8EwdEqdkA(i zr5pMuQz?3TdMx5Y?~93%J@9tJAW2A0R_nML$$rjFGUdD66XU8R+X?>CDT8}le=kW& z47Lz~POB?}|E6|pPqx<(?A;~LNiaqZ*I%3N9;-MC*!chU5=DBB4KP2-CL^B zo-=8xdmbDa;ZehZkQDR$qn?k%f4|_L(D|68Zf=G122Cc}=+U=ZAu9&1Nk(b|%|T`% zV?={5kGBXBAM%0m^X8VSFm7tuD*iyBf``9;rHHM*YZc{jN)Z)i=lZV-SS>i4{=Lub z^_gZzXLsDuCM^XUwXLd5kBzzeQi2$|L1IjK{w)q0cahw!#oF#gvl@eYTXV{n)4{IP zRin0%^PdBmT0^z*mESAC>~|k(dQieLOpxBEle?~VA+wMA#ix;G>NHnG+WH7OyfcOK zZN0>(>KAZx_gX{U7nb1YpOWYY3Iig)o?4p1b=xu)kRaB+I50t*+??h+aaJC#Z!|Tj z#{{%s6NZzR>H(1>oFo5j8Fc)(Y?-iP$2ahpJOp#qb_`%X=)fkamz@_Lf6p*|G?AzU zU-Gu2&HTZdHT}4fn&L)71^$`&Pdfwj5k}V%VSx@2!$;r`2X3wBKxD3@gJl7y;A$(vduxP*L3YHN|F!Xo6U@@Fj8#31zF*= z#)o;^{(8)tGgv*3MzDZ(vf5vwVPvHhg-(r008wj3-_TBSnz^` zwKUOzk?oY3>GQAyUb?x&sj<`50;!SvmrT2t7b})w;iN*&oDspNtPlB%{0*8GY+I~b z&=nH;7c8+1m4rw!zURT=>mNtM?p6Jia|PKNzHei?o55TL4<60`^_(#m-8=06;;=Z! zRfer~-iAXuMH3yfHjXT2F0~K&e3j(Y|3qaK;SJV$(f#^L_$5iXA;0sPHrE%N15edt zjt@4S@%}e^VS0WoBrQ=iYKapRIZUDQUM+Oi&&{wdApek&vU9Om@*miVI;t_2l{?PF8s+=tpSp@tN-y_$;+5-oHI@I8J)8;XIy|9GBRDf_3DZ$hUp@b_q^u0x&im)KTV3F&P#xP_o<~>cC_Q}Dax6S9R@PL2_{DbB;68m3m$tRFX2EdI^DrWr^I5V?o z#&`h2{;ng(kMe|KX9Nuv>h$GcsA|AGRy{Q~NebN_r>+ONsk__F??PB<$8|uw{&0JH zENw!loD4(adM>f+d+Xlm3mX-`2Gu7&u`_-SR;$?BD&kF|0nZ|gRpt4Y-~KHcf`x<7 zU;fe~dcO%AkEz?jZ0bEcj^`{u-}N~j(5zDhLNNW;I0hpg^XI=~`{JSjF02Hq78~1< z*#5I|0uN6gRl=K`dPe_w9oz?f9qdn9>pt%sI$3jTIU6l|DRtAgi=zRYj`=2=r+B#BEz&Ag^dWuNxk?vbFfHH%g zTz)6)d9_^J+xm1(n;naHz1h1%3{`T25i6-{63cDFzucptNV0z`d)*X0R_$-vj@|3| zzky&14EYvYY7U%n-c8z!yC+lPl!tu5()*e*`D!EIBcB@iE}MzN`NIkq)7huD*)&=b zE^>duTa&z@ZzDdGW9wj>w8mi~IQ1(bMefafFfBJwZm--$S}q3_F=2qID``z|gQBjA z+&qX9ST$-fn5d?+TrYNf_|jNz;$dm76csS;FJsDn)7N&$sWpp3nEg<_FdY`v;MYQ1 z+nyH3qe$sZyzXGxSD)8Q z51?P>q}(%x=~356b2)1e3Y0mt77-)ns}*%X51+B(>`jJOnom-lOhOkEaO%o;e?1U? z`hREtP^Z2devsFI5JW&sGkr{}31|#f4;b71ZS#%3sPQe)qcB}pYxzglYVhpGm@?0@ zu@BTe=uWH52h=%n%6>M5OjI>s9{ z)?mONC;WEjWsU@*;@q@5g9fLAhNH9P%X7Q})RH1ZfuK}j01!2ukUufAL_qKTntbRQ z^4qs1xpq(-%35JHn`o|q?;=Mx5se93B{Pcybd)ZUHSLJK?Ut9RB^l7CK{9Krsc14y zsWL5xaBf{WL#WaLi&+j^sUV7#Z7@Z`A8>_giX10l@a;~v@^bEUE`Q96@SYILaWO)R z?60n_s1w-NEyzBFgalceROic-AVkK0ehv$LFiJJboPM&!u*iT07aj3ZdQE_4I0r+k zom<`_=Rf8Ckn_a7W#~+`FM>7dZEKLq91{%DN*t1|c$t?oFa7_~?ws&0{*QKNSW!v+ zZ2$kmyMyWYWF~#JCMJ_(rqzUH9=B~uc2ccME-C}WK!?x~()|aF`*`$r;j!9Mpmb1n zd~mE78y(L}5^2YZ*L{l#Bl<$xwb-FE8-p*R@OyE7y=2aBFpviVB}2n99?>mnW1rj9 z0s4OElCaD^waY?kobf^_#+l%&EFiz?kPcn$s0YZrrti1IU}Ky96X5J2Ye zbj|LhFgYiG^KuQnksNJfuXLAX@rELXtyay0RtJag4!Qn`rFA!*Ox99T2igxJ^TEv6 zhX1Q4Wt;3pi3FFI=3qHa49d5Vt_))c_f+y5ExV8sqg%S($tPFBT_J@DILn zD?(Dy+H*kmZEV>ba(5lDo$~1*Db!}P+Wp!s(003mN^w8C*r)>{2eK9ttY>rw#rm8v zX-P+>d)2oI3;sn@u$7&NPlJtT@GbvSQ|s|`Oq4qOthvNvYg6dkgqKACqE_Rje9NDE zPgQT8-y`&74eGd+$GbcJa)NlL*EDvZ5z$1r>9T3Jw40A0a4=<`=MwNFi1K{Sz=x_a z0Dm65|q{q&-nzMY*=p0 zj9>VC$ARhhx7L^O364=-O5Kv+JL8CoWx;JM>^+;PV8`~o*UnfZL$fqZ(BI|J)@AIv z4MZwyc+NZ39gdEH7_*a{L4md26I0T`GUFp&AN&Zn-7(rxTLfv@rW0T$H&!-V9BWQ- zN=qx7-=3`P+g81iy>9geYsV(wbNC)~Bp^B_rO#$vWd4^cS8x9wG;Aw-Ykl;y#J^4I zY?i2MM%bob$n>^TyD9~9-oYQ>wA;9ch3nq?OpM=y`EnQr^9uJ@`FN=j~a&rru3gN73#%@;d+0OjbW;o=WziAp?m zy=M+AB&^*eM()gcuAg1@;1PH!Xm6JLiYT{I?;h|b}%$W~M9K|K^A(oJ5AJa4++_yYxS&36G4Ufs@EAI?q zeRtE2egI`^@wPka6jTugyc{^uu?b9W-81+I)D1MCLwbz}sg)g^ zaeXsBSeE_T*l%8|-ulIA()HdtU27kQNHly_3nF~;S65W0odZ29Or=y#&++T{!u<@9rA?iZY?QP<0D;HeDllV04whjY8vU z_H&;|Zr`dMrHiQCu?fu`Q}s+uU7W9$)jT3j0aNs>)cIoDX%(a2Ho;NAttS$42;fE5 z_-_lQ8X#d1^pw5Lz$~Qds-UpsIqB`zha;4W--MCtYIW>dgAWc2v9b8Oa`F1scgT(* zKcjqNGx-w`(6i=mbt>v_??0h(+koGE{y-NCK)wF)y5q<9%rDn}Dr0CrvJ{2V+3un59 zKj5|X0nkHIeM17r?lwcdMqjgYkKFU$?Y(_G#hUq6f*jZq!N<1Mgg<0_9>(oL+?EBm_xR3Sd zunq7!l&HRc74&p`3;ic!ZvR=wv_~FU{_MA=w==XzhIl-vzRIfkZ+WQ}W=m|lY96kQ zO;t~7zl`L`+W_0K>ax8iYvR^j?bA+e{YUm%%ub6naU5A9+2^uc;OLnR`*4Uqgqb^((kw>vINjc!4& zuXb)IspucnKLto~OaT)^rTKp<2Od#8srfW)ag<9mZ>AK*Xbm{cwop#h3-&Tz2R^*mKU7ukl#HX1Zdnzl+TCxfr{j-IUOR@9-j9SXlBi0gHBl>|1qNVbnTL z%+u`vf|U=KCr1&&A*ndtl{j|^w= zM1Fa#_f?ff_D{LuMln%*wBV; z_os?|h4-Q66P~kVv<4XfTPcLQnG#XM_Ha5NuyQ@ZTSI@3ZwHiT9FcT|R@%+{g4D1t zgzi85JJR@JS&lYb3v$tN^Vo<&tiMnMbQY`7C;>avMn+@|OL^}+qX>uNfn8EqjB;Q@ znUuz(!560~lX7CN6?AzG?EZ~BPk2OaL06!Akh#9p_?#)gB}vP~RdZ*b$?cWb){F6D(O}!Xgp0v=tTHzShxPZEVOj1w%f(9e z)DWW5V$styucgO^MP;z8f_^-#fJnUiIQMg0fLC5b$M4MpUrS3Gm0<)5$GG03(iT!| z+C1N+yma++Uz^eEUS}^3DKr2O3^{!st_~D8Sa>D9C(Z2AnQqlaL$deA+A)_=Y*WA( zX8#lIsWdJoD5`ukUl#MS;Uh6n0nbv^2TQ@SJ~BZZ<_kpk!qUVgNQ>6nGSv7c;9KFc z%E2O-W$&H1fU*{|$tsY-&#~0&B;d5VJErCnX9cK>`uVT4F_k)qI|(&j@CS$l(+hE6 zEk+3-Z3YDa&Y96@l@pz?(>wSYxd{yVN%3*D&kN+{Js+o-fA_n<3^O+8*`u~65)UiTHy>A zF=00|_0cRyRcyhZ*PML+Z*nS8Sp=*Pi3#H_@6elLHm`5f2;L`x-r~Mbh+z#k6~+M#V+}_Gz5o{?-(6rhVosd}g{AYFr@)K$>8;G`f_>hoB zXOZE%izTm*dC8?Dxr(k^{Qt55T;xBm_6o;h#_qMMgUTE`h@?(EuVzysej9gl5pnz7 z(dcmSkHzXecFKXRUd}ghk45Y<#Ls4t{UcV)XHfyOPSoFAq;6;LHPlah4J4J?kA5s} zQFFa_1b^-jnFJ6FYp=&;;edHI@js|T-%b4xp@8Hhx8qkxs~!!EsR%iHWVPfwKqG3q z@>wyg&v~wn4Z1`t?0fzmJiGD+U7@KiwCA%>PY4~N{v0Ed|14U0L##j(SQdN#IQpx` z+l!BH1>*f9Dnmag{}M=vZP!fyO!s})zg?exIg$^FfMjxoVnW94lox1tQ89AZABh!vKl|AaXdBhBd|ry7qCEN!cnm$+DQ zt=i(4d+eamq!N=x_5K_O^n*m8a{B!3@^9ZS-PkeFV%MRZ#p1%@3-|4PW5l5D0P_H_ z%YA$vCR(H_H_VI1`}Xfowi1K$4BB{D7)48WBOL_BYax}3 zR)>r6LO(3u>ySQlMo`91E6#()!;@&BD~8O>nwrl0nk)3z-SbVC zx=4%;YNV1ocX9DSs`ZhhETd%2-$@*JIdJByahV>4r>kgF8*IC}jIAlA(n`j(G*}OJCZnyGf#0 zZA?n>5)#XrKHa35!X`cws1%_M=WG`|Lu#}4c9A_2@raJUO7k+yRFz}nRI5h}r-3S} zm;KkG9jt6pKQ@rXaKOlMQYPSd9gBQHY-|y#^ru><4=3Ehc+#SAnLFBbxc^?+TX{_* zivk%x9Rn<}q}_t5<~H)Pazc&H%Dul2U#KFj`e(3pa#LYd!ZrVZ9RlFyI_E^>LrVTH zyOsA47KSCS`{m*m4NvdvguDnYdrbs2H^G_OyK$;!0C?(&eV-D>V{EhR*|2qut|5O{ zeY^VAZTKIns40<{J|m%OeB}~+!M6!@c58>f(fhNoKZLz`V4PZxBS9FOPVyNnkew~; zW$iD>%5YbIl5NUI&rq3|nq0^eS6y(YeV(4qp8wfQk^Ax;hK^5#y5DqN>;qt$qSqqp z&ORQk=H$)@ROU=qtY?q+=XiiM_P$)SgOFgKKwxvqHuaF3@QKqWa8eVmUc`DDs|tu* ze=4YV={+CErw{8{pjXT^BWtxv!{MsYo|Z+?e{DDbPaHup&TyBYdq1$H4?}A0AMBB~PU0elCn+@$Oc>g!{O8E3DH+nuS@1?14oqq^X~#vtmTJ}~Uls-cxCKYt7Ei>Qi{ zDx~=l7@Y7Cjvvjv_s!bq66c(dChRI%2p|jux;%x|N_jS4H`q6Ygv%nZfUA1T)sK9& z7I!~sk7JqlbpHI>JhHPc*5zqNJ&*xVm_d5L{S_sX{&Qwxy6+?WdyLo-3~<4M`PIrO zPQ)nHl43~ugPfWTiuKtGn#-}T2F4bI^V0kyhb5erS`}@8#$v7W>X3pmYy*!S-ZNe@ zV+Mnbr?q`2;Y^5N3eXZaMiBI6O|pdCf4%;WdA7m2eq+9)He#BEms0iruE^K_u~T_| z-8QlRmtlQbl4m>PgO9k6`={34+`n=wl6NNQu_pawS&=h1DMc|@$jV9E;r<_{P0Qb7 z-qx&xIw%7<*kc@npjV&63Wm&+z{-zddB)BA4PaM;qCxu;OW;cEM_qf=FCKe_kF3!| zRWv-T2qYnD)7c{99)1?cCzz=c=GQWk_vdrb>LuBNRJTRQo!~Io3m_%DUKie3#f4)9 z`25|u@tdp-+FJOYI>Xh{*B~c+ec#f#wxfzFqWqy6P)~DJU5Ku|XHom|+Hc{fgCBur zl>TYKZKWRn_p^Gj;;si<@x7vjJVhE&yK_#%`~j}1wMUWgo!elhhCZW%pM6d@fdm7a zuhvL=d4b4C)A>{2S(4`Axxr9t_ggAAQCkWP%QHkW3foC0O z^AWy^M{pD&rw6%k0=++?kxApwC5SsmV9tF-tT!e)J{+HNhB~-%Id_--Qia-BeQm&! zEWeD?!Lti#_;B6{{NJV%I7N^^3+FO#t}p3KCu<%Q1pI5X!gRv~h$2?ZPs8|fcZHY+t{8^RgbSu}GI%Wa2xbGUoUHx@c*IW%R&n$Izth4b%_*;92lL+tH2zc83`|6*p)`b>b(5RsO@yai)-rC?lkwvuF%)Vv^{hU_6;Li(0Rjk+<8C_dH zrW-dI(B-n)_Db8qtrTABVETsvd#u=pV@LX)0=P~m5Ll^|`m7~691E||MHN*)2fwFE zKUY?VAIa;0F%^hwkgXb{gGeEdl6u+z-CyqmQn9Nj$mQ>Vq&IOXDxSR#Avp`%b2Cnh zsnRq0bp0vIY56q9(AxMi!Uj>d-Hwva9}H2oxXsw< z%D;&iktn=I2+8H!+BQdTF!D;3kSNwu>{UVo{~JtrrEG=i`qmuDAEa1ZS|Sm3_SQ|5 z-zciX>2_yIg8#u$+8p13_4Xz(PC~b4lSHKh{wE+-Zo-vl(Y@!OpcNE2D?lcyHV0XC zAisDAuq39T1E^L|1V`d^xxolXX=34${pc@?`g8&GXXXBZJr;uX?v7LWF#Z&ZrO_bF z*L`#mY#%T%Np2e&DhpzPsdvNGaLt(xO>p#xN-bwWpi8M2C6U5LG2d3OYiN9IeHnqt zJ`h*bA)sIYH0l7gM-5Bm0gp8OD+P${aIwLrsORo)aRWMhkQ7$RT`tMKX}~?|15*qR zl&l$sUS5=m3_jM!h(JrAWj@}K5%s1kRc>FyP|1nqGo(jRF*U+%8Rl*|g@a!?(DtSWq`x41msa7u%C)IqLX#S=U;6@ph1JIqI0TP^~g^AOUGj^t9F5b3!5zqHSKS631Xfj|9S zw+VpS7ph`=?DBzH|K@cLOu5d@Mp_`Ud?zBHU$(|~s&-YZX*fZp1YsZ`whsF+)rDGF znANv9bmY-S!Hhb3EoTQY>SQB zs-O|jE;d>X^&IB0j%XlYHK>T}(|-Q2v13|qK@dQo*N*l*D{#@9$jD1~O%uO}N2->XH1-p8 zsq>Ad0&9H`n4zOV*}RlB_Byu>M}O}*((T8TpB2Ev9ZZ6NC=zzJ&?46UgShuGhmTIC z(B|glbla}!nm%jO@{UW{NtfD-`G&PdCXw{Zl^ocBOWx}}V}kn+oncqptv5eGlAFkQ zf4vT?6N(|69ADa7)0c9CriE*dbQtZp~h?5Y0oJm=`4^VGlt# zoPja+j87im7E{#uv`VM!k_x;JU6ZyBde#I@h!uOHq1w|6>`9RfHLp!o5M2pzF_3fp zpE#?K0Dc~amHqdu7vl+YXN!mhJ$l{r2AWi{*ktEbSC0eL{7h~Y9N>4-6E-7pQQs=%yL>Tb%M`kN?1`f zaSdhn)>8i;uD&WPu4dad5Hz^E1R4zvjk^;pgy0t3ouI*`ao5HrxVuAecXti$?zi*r zz0Wy!Kk?9fy{cE$lp1r4Iqx1eY~tNAo5U`~^Q)TX_Odx38nD-6I$5PPZ%-^Yw1dp` z*TlyYlj*TC$u+E>=|PIy1rO9)?Msjz-c}2X%8u97Qy3^-L{Fbq^XJjoH{{ilQT=J2 zy>H9kw}%=Wk%`iOg#AkU5#3$N{Y?G~1~x{E!Mv&WV`bZ3!T95Gn{S&x1vy0<(r4x= zzM{P7HLP}?8XhjkyVEs~yFYNTuGAf=tLY9Ve>!Sv_^vV?;iB<-^t$Ife~|?>IY@5z zz@NUsLnfVkny9(^em|}}E=r_N9ltf{iqVkPSw@q_Lu?xDaoV9M0-4>i5z(-QW&Is* z#o-DC8^#;Ny4ghRXzrY7b#6gZs5B6X@f`*qN;1p&W2a}s-I-b!T|_*2br&uCj5fsy zMXnuthcbv`QDidVsd2K{TF!q-wclHTMb>8DR_c|O^^3A46LFAF9C$A4Q;p&0uWp}> z64uBnCK(PdD0|U=a$t-0wNR5t_oV=49xtHOjPvhLW1Yoci>Xxr6#3{cOjqED| zC^I~^zI2~6`!a$ZB9K2+V)^=G6PLOkei=ruW1fuv1n%KSJT?EEfNO?zXF|Bg83tN7j@?j`@k@4~C?BAQ)D#%Ox0i<_ zo3CB>yPfl4GE0B=YCn>}lXymuzg=oNb{3RgVF`GD)>I!Mwb!YXDh zT<&pKUVn{31n18i{cZcg?dIcoREuqe;3mVOHH_KRxY-u?(Ren#DdoGSiXzz4)p`e& zRDhw)95VYPvc-$`J&mYP+D(j{=#EdzLBtjYVgjw)Hpya>mLw~9A@Ai-nlfN(Vuz19 zPsSkk=Rg#-T@`5nVhj+wKaNsiB~y^twmV3gO3_G(aE7DXVeHMV{hAGI)cekY>)NZJ zK2Uscsm{_^GZ)d7AnUn1Dmo57=84Uu*o{>U zFOiF`l(e$zS`UZG4lx3&J5x<-a4W2ksdtb>B7R*W(v(id!<@_PZoxdO(FZ36DG|+C zhJGcU!Oz+2EVVBDkrU!^%$``L&g37Qr?#yjAZ5LAyyJ9l5_!8;&z@xauFRMkerIpaWWxi?_Lv??~=oX3;5om^-ga%kWk`c$;z7g+T;{LOjrOs$;qQx)psZoM*M8<4C10FualPsBM16S`XjpxRd|+|`MxY(($>h)GUMn*=ibw0CH^Cf{s`r+>=I}uo*btQZTP}{yxyjM)05)4v~ z%Rh%_*p|1SvmUP#40Q5JBZ!Cq+GQA zwOY6o2`c6C2lFM}pp1Bpp^|&4C5v{`=X7vS?dR~%7omyiG}NrKBB2(T%2bj9iymLg zgv`}(X=snyV}Y0zkZ+I~#*}Z$sqY;WTXLMN7E9KI8Q#kq1R<(iWu1Pwtgu!5Ty(Hc zAPFg3=mOho96u}OYvYxzFy-=1AOE1PC=Y~%h2=pHP(8vYBsAc1y#@$i1*j@*-~T{_ zGR2xlgw@QHkMk-&l;43*L0}J6#Hw6NzNRFoeZx=r034dv5u(UeAmK&jZVLNzA5M*B z-oZPC@No*MPO>x^rzgY%%q`UDS;0VUj@PVZlIzN`DaR&5)I(d|;w7$oy4EU2&Ds@M z8@;cELy3uTG0L?*;B<;EjUPjO8iR12m`^)I)hhJz%-#x<8*C|CbJ(rhnUEtcxLY)#e`Z@;SFrs+S25HpHZNyR#z5iH9 z=kop0=K~3VK%j>MAScFXs_jA?_t!`H8sl{{m?jKg@u%4$kH)Xd{a%T<=+R_@oV=Ke zK|9bX(txcA+V&Q&8L5hj1o1fCaArVqJhUrQs zRD_`{X{}yCXYoyKHtH0(>H#d(cz^P+=%TJ=B+Xq6VWKLN$-fA$+Lk!X+|Qh%+ZKaZ zIhVSOmbw!jQ310DZMN|WqhVu3QTe9H8A2cKcBEfATX}?rcD@O!;4-4x_q#*q=e~yC zdVe#XY~lh+6h%>&X%FQxksi%gpvCz0C?ks2Wk{oI+Glz{MAQOfPkr>4Pkr^t?v`Bin%D8BY<;*NDEdkhrOcsJ9*-xP~(T#^Rcm+ z_K?D##aVe2Cw!S460?qlQA0mnM-VI7b`7ehv zuwK|vj~bL;6*BR3ur6fBSujA@r-L!)kwRXdsS7TPs;|L0kT<|{!)S!LKsz=^vYgkz z^<;K<7h=XaG#^SfxY*{Hq&k-&KoWZdlpvwl=ilccpVC30MtRveS>lVa`?jqvP#_3i zLjI3&AlT+g;9M)rM5PwBZTk^9NuJ36muU#==5tDk87mu8;hFE|3Hxq;k1y z?ecgZ&2pa?#_@gM_#bHbFUOyDGHy?n>jKI4exi6jU9&}ww5y1A))4#(Wtbe9P|B{3 z>Zq>%s@~)PY(3w4`+gZ;WLF&O?3`4gj+ms-PTc;az|KC=;VtBP?)$W{WLaMPHLygs zTq(Q#?G>I#aNSd=pZ3EOD>NiboHs~ieKQNi!@*JELv{N_=!>xxo-mO>A*9AmByAMP zq^=9OcZo0H_bR^(0H|YGjK&bV2U}4xN|sc`=dwBqB01_c^DOcSq$3sW5(HuMG`_{} zX08Z>djL)4k-xyZbOn=zBdPQUV{rDvRRzIdp0qy|Ux- zMpxgP)&mIV4|&Y{ZwG8X#l@P~8r6I+$vNJNyUk9g(PM!Q7fy#9f6xAX5rA^8WSo~c z%>KH!JHa6^hODt5C56vZR15hyLPn?!nF4;~(s^EwDmVD~%QQ8vikZ5qnctUWUMP$B z$gP8@!=5Itk?!oDF9BBzBHcHOn(cFONs<7}lysL# z99`Qh{&IHRXc&T6DhNd5-Wri1(UxCWQW{(-DbLRCa$fPmRtPy?Q|Ro&%R1gFkr=)K zXW~m0V>(A{*9_<~rHO&{2y|l;xGb2F7Q`ickAlr=wrA1g7EkOJ-SsX8(J!Rs7TPyF zb}GzuQGJb%d*dqZxptmHS&0!_%N&Se;JBn|${RH^hnbPdu9(C9+|f%TZz-5B?Dh+l zAAL-?Dmq>*%;w7@3<0+nAD~06>Bo2F)7=SLU*?FSqoZkoh#mKrpOPQ;x6eoC^`x^Q zIyw+U%-#(FD6*xZPVJ^6=8?2&BeGgsi6Q+gsI8WfJn9U3*Ut6D^r!M<-<^-p5E~dp27qvPV@!V5wsVHoHw+3fW7SJ-tvUD3!-r~H;YZ@ci$*VmWDVFw}EX|T7NVO;Qu z9{`~KZQZbntmkzB3ndv)d8enRH!wEn+uOkuRChEdCf$v$Z(ztR zm*$$?j_`97lEQ@xM@VfPRRl&nzlYB&7IS6o=IY zwNxjk{KX?VQV_&X39pK6{PgOd==n8il%f*n=xQ4MoFyZaZNHm)w z5D4R|i5mX?V-ncQ#b?kFxQ>*1cftZ-H{XIFeCFHLCF=GHX~XgRq+y+E)Lrmt1?l{neSC;x z-+O-bu8YjuCWuk1;dgG7Ae3$UL%nQM@_ki*X8bPX1_b-_>EzB1qO0s~IcsO$&B3Ke z+$=6B_doMaeoyAfft0Un|7#+LA#U@qW8F)Og1JD~D}`JT7<<9hyF)wJ?C=Pz{JzN? zOWSI&q+%ep6Ib6X_&gxzx|=Zny=WoqfcPShNn^H4 zcJ`1Edl|z~EambsIfK}GuwJOA4vQkk+rbdVpc!`5kd?^83}aj}J?kNpe#ow@;?#g~ zn~dC4Ex>Q0kSXInCXov4@WZ7#TU|ZTu0Mu4v*nM7l8H#YWFePX;Ym}l*CWpQHL_tc z4Y(~ilK2;ma=9B0IBjj>_!s~E0K^;B;rTkgkmO1YEqVpy;pApsPY-{oFlWo4o|U#yS|*uBm1B%1Js;lW-sazN(g5IO9LE#K1zH&%xiH!Ev7vbFNXwDeXqj+#~+*4 z;uJAFg5Y-r%_ZELDGaK>%$X3w*rP$EUM)sE2o0dbyk#mwf9LF28o+>Acu}AWZho==k>@YF{aBS0T ztyjx>{2QJ-&0#+ZwvAJssjsvF5H&K)p*|y8Hz1Sn^uX;$E7t6-X_7j-|8g0s6> zNcdhGIpofHL)VIaTv_B7;La8#jC1B9Pc+YvT2-D&w<=uMY_~7dcd|XD3neJ@tkn-X z9z;kpg-K(6y34W~P2~bXAZM8zBp_19^P#1%b^E-YH!QV6Bf75V3CjKb_F|<Mt;wOo@iL=Zqh=DrVA;Gi5Zw+4A2QsK+p9vM-mL_LC`;W1v8P~58dFzCK95EY@;QpXCIE22Z`zKJ%<$FGL*Wj=MjUYmkwO-PIVMKkjQVyP zS@lb}@&@@LiF||d+gXX57nxY(Y##}4ZDq?i8q5ta9pBoql{FsU(bw<+*e%QrUi0)z zk|YS@!Y~^|3p-3~X6S#HCWXvP=jTw9fgNsmh{*>$N3p-ja+qsYL6zWK{k9-2B=LBb zW`(h}MP7ccdnw|8Kq#uaJh$)*&QQld`%i{urg@%)cYBtQTW_HULR!gLvPy~Spupud z!qkViEu{ABTX#Nk9z={!k#qnnn?Yr#MPbTPY2|yc>QhqK-fJuaW$}b%jum z8H?k+eH*3uv9%z`Hz9;Ec zrm(RralRos`|~SJrvSRKY|fU>(!lz=R719Mh@~ScodF+GNM;4asP;y;T8`FBb!3ZH zm33T`8a}XgN+QPwOj~{|$_rhRYAg=>x2c~wdp2{==vyD^RjVIn z8SmGPGCJFQ|5aR?{prq^&tY_noD^xplAshb)8u0HLhS<8a(x7VS3diqS?5be@OA8wih?0{-f9Frg<%|sB zSpHtHHw4H8=WB!jh}n#y%ZOuQFuu01(a{l*HoghEUal+tE^Ao*xQj~4kC5?lHhr1) zZ-ZV&=k~ZQok5qvnlT&8)oQS@Q4v|cBcu|QKZC#fsgGpQlub3V=se)8^Ytq|aCtDd zF{eYa%XDnSze{Ucoe)@=tHU1})i3C2xY_wgGEu1FV@@27x3SGUYEAmsjNWsJdF@v( zK>9eNF>!atRbl?=Gpj&-SviV<(W|w8 z4#|}A>u72qZ-CNk1QBO6WOm~7N#$%(%1F-XgXr=I307bOhb=ok>8!@evhch$(soW_ zzPoL%!OO{zwq~*U{Yz{kfhajbj#fSNn~9*a{g=qYLhB|E+x1qp)GRTAh5A0=3Fx8BR}n#|t!n%!&iL*IqS`%-On49n4y3B`Dolw`rNiA*g1*Mm zIX_oF^L(EMLDmkLpl4r5*o}v<3pUz3On~>cYc}`=_5xS0L$o4JCHUNRN9g=sSDuo; zrz+g6kfsGEIAUakkv<}kC{%-QN~mSz+m`FB7`vav{5N96)|2}zH!a_+Cp)~owN_9` zYR}+OL19>F!u^9iuL4i%#qeGQThD<}HU^|MmXqyu92jaOu1TQBE}c{%mQozAxWhA8 zrY=c5BBCR76WY8kN29aP)z(&-*@;uUak8$=*F5h^Q>01^4{nWTc*6_& zyCB!tt`?P1r38u6^D`6kz~Q#O0ef!E&VVWOYh>^tg1__hI&HmgNS~gbhTUkiD?`Fw zXIU7SPFgf8GHyxo=E5GsxvQw61=9(~hulEr={*Y;e6D_6iBSFVjq*{42xpaz)cMwA zWi2zz80&si3ESD!^5BIY^#i=-`or(CT(xT6@K&LL6i|Y1_pg;(2xqfYApInn<)}*} z`+;!{(tx}1Gf&uic85)+xeOXgf}Q#H1Wr&GI48n?v|j{!Jv}${jz*)SyCD@grIyJ# zCe($=**J?68vs!?O@vkJPYK%S&{=j%xIN-GV>e(=%gEfO`KZd-7$;r#$x9bv1D<~WqNavV(x9r=@ zLocmrnDUNO&D8n9xB?j5vQ6<`xQj++yrynYox{$bKZ_$3oHi>6<;k2lO#5!Way92k z5>qp@r%*g^dt`KUWCT!u!{`M9`5@@Uy2I(tFJ4t z9G56KnY*`|89;{jvJ5iu^HRg`a#xI1yZL8bEvYgAx4I~Xj3 zM6ArPT-%}}Pp3aCeFy0#gz3@xQ&(j>H%1VwW3(@bwK$qp5jLRKhKZRUxb~yu zzO%{tbhVxQX}PON>{inwd()SNuD;`0=`(S-A&LFf(OpM#XsdkG=^r8CV;z^`Y|mF$ z+b4-S?2aL*L~sn>gNxOg=ywlEdFt_-yP_w%Dg(~-cI&#sg&Df~(-kc%tyFiONI*9s z{Bi;vH8-?-P{Z7FS8ui@#)hu&qeF4X${^V`Q5|D*LoSg^!n#NCO0gi?Bb(IS1(vvH zHW>DLf33@Wb)~7n8T!Ew;!P~5p!W{>OdzcxQL)xw)PLI0U!P6IF_A=?oRNcqaY%ES z2;obRgMEhXP4)Y(kJ4^^6YO;|v-{@M&Y_$R=N2v5Y+H_b@8MS%(6IU1Xl4j1?_%$gJX;29aY3EsD&U^kRv(P3sOe$` z-vUF&m!;=@jy8+?Z7~GBvEB^dxTv(dSM+>Fd=Hnv9WhKz_0U$0dR3xgZ1tC-6Vl$g zWwVh2Gsam~<#z-GoA2)4O7Fa$j&vZzZT;2eA1vMc~VYkS7+u=-^wd^Zx7($>rZ_}-ot?5Zt(*T<-gC`(>V_G(-I?8A<#RVKk^1zhF<@#7Xbx1zk8P@M{LM zZY#`}KZ-&xR#KR2)VJSS?{h*NqQt_3cPtc~>*f4+4#QJz{gwTs^H{VofHuz(e(D1B zb@1B(k9^Go(*1~<1f6e?G7iM^WFu_!&vC8)q~z#Y7R{B6=rIW9xL~rAuUGo9@}T~S zj?P!DWfg$;YrrWXtVbri`(oR+qUJ&0U7ICGFTx`1`=-%WUHUukz2S()T9l3P0eupC zmJ@RUvM1qaH>Q8{2Ydis4cI{RRh@ch$&_Rwccfw z8%~&@`_InKfGz7w=d{Hu{(AZ|O&$Kb`w~>sL?MOJEzj%PQC<(y8TZ!fXPiT-O!mK} zhVNp3k@)A^W!r>x*7}u_J(#+}4L8F@X_L*@$;OF!to6@{(|f!w9O=JfG%`DQP-GNS-#QtI+tw zyC2B40rY>JW32ZC_{AWzG%MZ< zm~)bbT9Uw9ibpC-D#SmyZ|g;&g8v+TsS55a}SI9ptd~XAH0QJ$cXQ{&^Q|FM*Bmkxfp;M#lIIS76v# zq!3uy<`aTR$&Cv&(daE){Jqa?{h8b!NGTc_68;+MQWEa$&jUD9R$@)-~`lrfDmSN+Ai8dtSWzWt_zDWer%a+}0%gv((({3az`(?)d zUZq6?Qj!kE>*TNQxs8~-7#Y!>zdfjB2=_}$7_xX}p8QtFT&ok{EW6$-Q#{uj) z7M80&9I8(ka|S|T!rj^vS(iVW8MPv#pE^Y?ov z>2XScB_$lL+dbZ(!~zb!EO}!L4!(3f(+(Z4wGp*m-KKu!!>VJ;^t^Qop&1f3xLAMl zB34}d7vf-v-sxpK5dHD|dRlQ9O_9Tp)h_E{s6$hkm5KHrYQ;Yciy1eVd%pa`hUD7? z(K38n-Zb<&2vK)ez+p$aNs3da#iPd)-Gw8_CyVovgJ(Ay%~npp-Q4K zltZ1a0`jm53<7D$|KSjncjb%th6Fu1voD_AyDJZ}Ucds4htZrs-z{ja*tFAVfb+9o zI$G=WNQ?uF$m&T-Q0*^Zh*n&tmQjZ{W!C?kIDAtf1t;JBAuU%Y)!y+1Z|n_CW^_CX zXqSM6PNf!_${bHPOWa(Sf|TMWu;lE?dPs;G)EV=q@5Pa)Ce4jdjUd(HDD*;18E%6f zJ83!YO}1?h*oQzNqg#7e!X^a$4^FqGXuHLL+KZB)k4?81Qe*=v-=)_!6-Q+Sq}+(S z^`s0o=d^5tQf-={Ca!7AUEOYG-xj;H2P1HvC`O*lBS-MIi^23IYK#qozvJ+9T~%Md zDFS$JjJxd^KrwIrXsc*%ciwM_H`5i^=BvD@?GKMgB3XYBBYcJu>^$A?VvWT|D#IaF znPgZ#h&zO22PDuCVJED%`@yg3j=n)o=YJDl{)3FXm8btT?(9%eA`&b0m!x4B(IoAq1It^<&TDb7?x?p>Glm-{7P)|@ghsgh9qupr2f@^Ek*rb9j0vit4*u4SSaKI=v8&qHnWIb4`sPOY{%5;@ zdG|f3fY)>5F2zO{nKt>BJSa??zsR3!xU(AHw>eTcL0YtAqY#h<#vNp>VNpb6p}?K} zIpe72pc7b9UF?2J&zwO1?MiejhUA}9T1Nt<9iGiJPUjHa-nmxEYaI3Yg!2xqa<+?#FgHx{P7WjOk*j9S9$3Uk2aG?lSw z&hTUt6BAx6Yy2SbwN8D1l2XN!sjuNKc%bi_CAsT&wJ6(N=rv95ro!7@nQk47PPo0fm4k6K z9`TV_5bO2vK$v;E>&Sc*0v>AEE9rXSPSspyxy8GTiWWXRuZ|M|Kj7s{z`wVEeSCOW z{Ot=vb2=HAFJ+D<(Sq>v_urD652|n83_~!2C4%6MXC8_3Eb--flU~07to=B=%U#{< zZ+bP#tx$1Kp|U8o<%&s8!FqxfvTPk1m9ypImZQ_B-q&3Z z{rmHes&RAo_w)+D_DX74e%E~#{)?UI^XIUN&ZQq6?=|(!*IH9#tnS(#`1r zWp76CItnWJ*G^r+hCXK*eme3DtkK*c)odIMnY|OhgvyA9QcvtN@IJv011km;EgJAB z8u50+c7Gvy@2yI*<@fZg(aXV0LHPLNmI))sxZiUm0#}PN|6a#32%PhtG@1;-W*h7gT>zMkFg_ zX9cW>1B$r%aZDX*TGyC2*rV=9@4g7AG4*hvi$0e!hdOeqmPC4yU7Y8kP$rt?EMbKy zW(anVou+GaM48(?`>xZhSrv>8ZJFbr$OJoL9;Z>-jsD;gtH=<@in(vU?AgqjeGiW+ z;#BK`NALC(S8?jwdh#c&5t6Vo9{;9ocZptOZf^#X_UGY?+~PcB)C@UaL7mdnIC71j ze_bEMrEt3-Sgm?s^43~Gw|m|EF3=TN?w?$5(;FWij(g9t(zApGiqpUUxK|_@PUDsl z#Ss`7=)j^wME$MU4-I_K_ghSdM$FN{Vdr~!K3Z(C19O#ax6F6N%#-3Bo#iRgb#J&o z<4Z^$Z*nmbXOQ}+w!5rp@X?NYXP~C%a=i`SlinSBnjIwrq)fJLAawC+*NdZ^H=oG3 z+yi3+A4QFWO2SL=xFTHjg(;|KJ|&m5U`dtL3N5!M@3yRA1!lW1BFK1HwKLVW4XvX> z@8f`fu?F|%8UFU%m)SFX!=j9btpLu%0?zA}`}TfYFjx=~lx(0Okm7T5%;cU?T>o8D zRh7CSQbe>Szh&uCM>CbB_wR1bUfaGbarBAH*<&PQTxiB+R4oOVTN9Lgya+O6%7rBW z9;_K^*m!rDfs426oW|E-QL^AjbO`{DupadVkYp5kaN*C1{IJ$bUJ)dAb zA1uAwO`eK#ARly|4(Hq9?v1z}p1RN8GCBtKNZQ}Ks+=|F?f$e?;~SEGbRlXm)dWSMbar8Zm6_C6mkBgz6A zR^8*srJgqqOm(9#5RVd|#p3Ostl9IB6<>GvcDu#UR*)e5;u5(bt8He$nQ z23QF!o;Md@`q}pFi03P8ZF!unX6bQH+mARGTHQV|Xf#8A`0$~ZG)_#vRozJ%Ri@4D z3U`Qgxi&Pg06*xV_3|+Fyz5GFxUjMFLm8N#_bO9#8aQK9x=6tZXVbh%$g27YG{5dD z#b7fGN{M=v3P-Deo7q^c^N7;Eu2fJLgS26N|6MT8+>9gt1IlbX%1pI<+fO#Dm1`Pp z?^P9atm&1+w|Z;7p0!cNjXt9Cz{0{}bB@dkR<+go1_{Q9sQ)^8o$JWHur+s!7y;ir z0Vu2^31aMw9Zb6Pxz-qjfoKBH_{ey9tFU-ZAb2t`oeU30`g*l70|d`Nk&GZ@+Gf&d zCa!j@9zMe>`A;tZs+8MvO2q-F%>YEhkF2bSHXT=jRZCp`9F~CFNHQVwxT|NR3SkiH zNmdL?luNEUN~i}Q$76f+ZsUo}%a7Gi^7Bdl6WKkU6`nYNH~yj#pC1ku=u?!W_kn=G z)JW5(hV9irsQ^;E)93@1;GxnN=y_6dm}8>g>2l)=z8rtLSBd_ypSJsQQ98acT+tr) zaD6rpf7*1WuR%tcW-|IpEcoq7sa6K-{?9TQIS?rS=Wf--aWhV_ zqjocBkK3%*ebsK-+K;7_`H)8=HjMe@>_-#tL#=d+)dPJB>6@o!Oy8f)--tFzK1(^$ z0e$^6o$zF1iG%?s%O3OJ^57-50sr-~-%)N*L)SzxHBchZX(+iNeoy`c+U|Kk!u>t{ z=854Rc0nGAWyj!ny3pcJ>%6{%zo|Zc&F=nfs@R4 zXG(zAA6$5YhrYp#7u-(U$Igu_RuCz5K`0|ioJny2LgFGzdB`KDP#dr}J3QcE{nMh1 z=}Rev+`VrQv)Aij38T&OxO8+DERl=!OCo-oMxj&a)JgtQDV(s*ADVMGV~0Tbt2*1^iR8q zCb9`!=d$rb#EbNwwVV@aQa=bmtvi*Bn30xL>5DJ`?k7w$CFvHTK){VuSS22q_WMhs zo7bn)Slz-CZr2InRBGLR)DtSG`=0G6AC0!ySm0Hu7zjD` zlL7qo84X;Thy%+$!x;gW4*YaQ+J^`tu2}yuTiD+Xwr^0$-1=!G3f!HZd#h;ro6lr` zLH8>4z*KU$0ogA8m~8N5L#hH{7A-;6`9R}pVT=x#qF!BJ@Z+{*cH>tSzY7bdIx<+L>a zj@c!a5@yMC!5D6|4><)W>{&e^b>{!-5Gj!bXS&sxyzwvr1BV}eH^e)p|jLG(RFf6YG2 z8>Lj_?=1#41b=QrS2Zc<-LW9ATy=5$en5C;*&1T;2$ zY~rrEFM&+0P|F2eFyl_q%Be(X^wLBCdrL^qT^*3;m6JP zlKsA5jyJbMjiTO0lM~($M$Du&JJ(E38+AIl;#Wkp*DIwWYZ;U8Z67m@A#wj-f`lqIM63UO}&zNe#TNysZvhwnHpZMxLVfDNYG=KwTS2bNmv?nCK{+tvT zcVsMjC}B^c8yR?tFMF&l{C@uaRDO3s2ijRcO*GB$!!+`ioNN z)eEH2t>Rq{aTBgav6aR94(|Vz7;LPNPYC4*l**QAe=qtIs(;E0cns!-5G1))J=!JY z!mXjGhWdKr8~3Xq(2#=_XijH4&)6Edj)`HM+?0zn8lIbAV=`VW`)aV4vUDLd9unUw5;7vVo*=266YMw;~wW{KnP-@m64 z34Hocu2G|VdIShub(k<{Y$9lu4h&DH7Q8r1V6METHk zjv7@BY@;M0Jhh4`7}P&eHls^7KGa_(agwlypC&ZSwC1p!f3!cnN*yS^Q6t8lPmi}_ zo5*2Vo70ZOQJzw{T`{`IY+>BNLz>Zjf=ttaTG2TIVP)^^Pe0sm*Rs=hK-t!}eD4mUYz$^r=eloY5nqe0xRv zt1gr4$jC^*V&+eqINzu4Tot^PQ>eOIJ4Gj_##!h{;N&Lh88@d!ojW5kKF8-%ykKz> z%&^82XiWe8bMV%d=;sw#bRc1RL{Sh53BxX=4oKtkM@a8^-SR8$>(SJ&np%8+Rh^%n zp1X4x>^AMgCT@MWlUsuigpRB-W*3t7PXBc-vpC7o=Zi4-ZzpN@c}klANHN66Kz_+b zeMnN#gVlu89~Ib>2iWKO&K*uHpkz^>EhFpHm;@86pjuv^Fm_T;(B-rr;m}*8(bgO)LiQ>d4n}x^j|@;YNH`8Bm>*_H+l_cq`H#HQ{1j_612fV+ z%}z*&LyFzxn2N<<2PQZ)w3_nj%M%8C?Y zVH{1yPt8bRcbDkLdWrCr-18jS{2|y#+JchG)@t_~UP#VnSPkMtc zh6moMAEW}JXw%>uCNQZl$UWC9upg6_W`C7#H%NuG<8{I22YMTuPcG3_vR~AoXRof@ z-2!oKZ^-C>&JU|MNa%X_%VdQ3gD>nD3(a=`C$mMEpD&00QLY+O0XvYpzEm073^pPn z;>CVnLVUdRNm4Nw>74e;F&ROg4FVpfXaqT`$6Jij3km5dB*)Q(T8tj^e;6Mej9HSH zK}+k;`KC3u(6IRmn<2P7t6JIN`(682$P4U=r<6)xJFX0U%`2vw_?GaP*6IGFAvytp zd0fcTS$5Foc9eh>7`C2>0UmY#daP9Uo|G1M$=3`VpH|XpUw4?oZc0u;(RC}BUn|M2 zzjkx<wbJeKp>>g_VfDpa_pC1Y_8kE+*_|?Ylo)ye0}%j-){K&)Qe5q z7o4m3>$2B-?*zQ2H;PZe$LPuopTO|t2j%tOLtmJ^=8HX@<$LSvex%mp@AJ!9 zgxPcP6q}))ZPsb~)kH*m>#ecUelapJVK_P&2jO#jtZ#5(@z%5>^owzGPJ-edCiT2^ zpu@bi;Lh5w2=l@O)+Xf&+uQIXiYn#I^n-5Y_}%D9sdac!5}9>qaa|>siVsh!Fc5F+ zSIRsT{|y$5RG4@Ju_*on;`~o4i0^w9>5~zh1HI`p!hpQ(8b>bfmWdR{zT9wzsp)_R zb;|7fN!oPW9nD{k1QjL%K~(O$s`CoG|7{of@AAvOK^Xu`L>h*Ii5t-`u1ogf=}?@K z&D66$kkqEo{=j$Q?KhJxi3C9rpFSos63+nXF_=)ZH=81KTNi^7CJCEy?b_H~`=$oN; z-D9_P8P@!&NrCu{4e`i^H*zodop(RCL6_kFjfgDJ-g+>Ezz-lAQt!OEcM}rHDAu$b zC}qtM6;jsoAjTbe~18GnE3YkbcUqz z>QtoUn@@k*xQ)se5uWMwi0FK_#>m0fWmLx8a?Dos_O*o9@12_ezgC~sjNX}$4^dCV zbQ}(K%bh-qESJi;zd3ToLp)u&vTY-zw^#$ zgp88;9Z#3!8e6OSOFyD#(Zp^txR%)gMk|WHFl{*P_D2 z!qV>xCqT!-Qr^Ccti%B;{x8UpHAdOF&idmO*Aey~*2n)IDkw=|@=m}G`v18M{^w)gtI&6G0ed)JV}Dsy5cEIn9oVpY{jB2+b=~_-Ae@Lx!RnOA zSWO>*(jQJh$@zd1IIrt5Dl$F6RDB99BL%53NO3qG7JXu5gyrB0>Tf=_>!4aeSQ;O9 zeSgsW^$wzNr=_Ed`BC=i2V1d}jZL}L-Ob@F`-gHYuY2vi-QC%R=74~JnT2Zm-;gDB z3cwt8xrBQFe=w`cpSjFxZal56uXprm6$#5hQtFcHvf{ZG-f>H${QDCVn&P6;8)cvyyS&|ei5WXY?Lt@SssQ-bFj}Py+PyNLkSsz(gD*F@(c@tN_Xmt-@LFsDMPfrUA-W%i7rpvm7djAv$ zzlRH3zeTc^Cz!V1+Y~XrFtxu$14<9VG9fFk+tdk4-g2SvZ19*1Ef&JT5U+!sUON8= zOcgAKWWB&wEwcV(X%l@7%Vse-`?D&rLMz1IS`MqDATqYTEhx@9fnKn0pMajvTGQ*< zz!yQshhjV^YQz#ey~MGRz_a;6JEK>zrEjJ;)0TwT;9+_<|t1b26LcZbH^-Q5Yn0>KFq0t9z=cXxLP z4#9mo&uh;&-%Qn1|LWUaUH9DHd!Mz|mb1fOM0dATJm6*JaO`C_=B4P+SI^}y&RXiG8?VLNqAWBuG}aN)xRynLwxEQ_qp z+68V}+CN6D7upTNjR)`}(j)=%TDxP+U4+glTcBpI?Hs?05D;zb1D)yesc)^x2}RKF zzJA~UfZi<~2iL4vbzmBx+6y81jl^iTc>Y^8c`P(L_ zIVBPfgGwejr=e#(M%7?B;eR5^2{Gtb)gLZsm;N)N{!5u5L^DpBM#H%OPw(W3f}Ot$ zxSAyUmW}m4Y2a)#P?$O-gqZw~B|9%&&Z5V(N_+(KdPobthxBYmX%(RDvh1JvD zQ?S!SIY!FM3&r%EZNnn76@6zrzt8!|;Gu6j-)wsj&#ODNVy&#hRsmg$zdsx7e^&Q@ zyvP5(ctjH7u-4cEIs^+DRAljo+v7w-L|ECt*B5$!|FA`&)AYdB`{6ACI4GX{UMC!g z6N!umSy));yc=$3I#W2UhnoMZ8P^fL-}vJ_VCUtsGZ+m-D;S$Lk$ilf7W8~KldJW1 zEO!3uasKNm{r4UG`?KsI$V5a!URR1=hXObZIsj0l4_heH7Qfu=Fu-Ob-$NYF;79R1 zUxfh8SPh%4Wz)~Bvzq!RW$=tdK&Fxypsm;i-s*XdnDxGl2=XM7+1WXh!-9{HkJlGf zSY$`Q>7qlh5jJDU`Z^Go!x{i|yW_aJz79E{*Ah23r+9o`Y#JF%#_A0^u1x_IQ^SIW ztww=`s+7?)86}3G2s$$>eCNYEStx^9GGr&(^gj*Y@t`B-^Egp)STI-YwGB&!`X@>I zZwvarELnve)%&95=nPhj4l5}V_iz*hRlDC%UJ>rk`2iTzv0*7?OTDv&^!6kF5^`z6 zBO-b^mo^ZG;&X$wD)hvrK#4PpF`aa_CsSBN#9-m~b?}Gv2Nrh>ie1UjtC!s|CyJiv zUeKgV533;4hcQMe77l$qZnNUQ+feg0< zEI{bAw6s3{%RpF!qYu)NZcrf!0PeGFwfTr^^G&>d9*7AgW~5MZLbHl?b#|DH?B?d% z%u%UO)uVActw6VVeNf8u%hT|;nd#}_*IT1OKtSK7=tUMtAw^wPv$XMe?0`40ka#;6 zm5+WHzB12OIaMhhpYyTF{&tYiCH{YP3lBt)c$^?Rm-bh2dU(L_`+fKI=o;?xAMXWD z?h*3$zPH=Z&`|rO6S&BL_W|zeod-qNEm00(KHGg*&X|p-zx}NXr5-Gn>l7s^-Wv^b zCTHoYvmC_+{d$3{w)@V@%_fxgtGA$5pDF2l*<@?ot&>vhoGM@4!J|=vBf6j9TnM4S_KsqiwdN8i=qdZ|NBDIFm-UW1OiT%;ZNcl=` z&t|~O&YiYVaC5WP)v=XPPmLM%JdNiO5|U>}sfgHEb~Zd)@OvyOiLMt%CQNKB(GnK2m`rDa z2r0tW?QLToCYkQDGeRE&4GqMJEY1{2vQeGtEA3;adnb?nv4hU9pk9m!k5ev@w8`(K4NRc0N#D-!3M8*K3&L){Uom;g z>S8+vT1`FugBkw69__q|M#DV%;EN|GHzt^*3*6P^OJLiRh!sH+%j3)G!`JAzQTvvZ ztpS=HmsqT*;b(Bgi#>ck@e;g*t?(ph7kGI(dgEXyJ|*V+aDfCm3MW!FnM$@6bp-VI zJ2d{P8aTwn$RzC#(CrWJLoCMAG>_LqPb}`kq$YpVcvvb0Xv50u2uS*VOJ}o2 z(tk{JwphmQ-tEp!e}fV#W5=}*RUy+#9#*qMY=G>%LDFp-{qp#u>Os)7N_e%*@9=?S zs)iG9+lv*`4#TjZnNERftD01jHbWNQf`@suRi|W|i_a(K?gNzQJaX8tG3VS2&N{lP zLJ%VNa_o=ztWKZ4pWZhHjamNYG_Ai2eMeFw#e1An7WM(of#6*C?AD=tTsKG{;^##} zi!*6t;nq`8A$`_j4Pw4$pji5)$}|47Bj2J-W=r%#zxL5eMp+q#f+Qe-{M)USQ$lV& z?!u1y-!VVETr5E{%UZC4c0gw#kVP@$kihsH)xlVQH%s*H_a&&zndM3Itz6UJ2`QXJ=+D=b z5>ZAi1y>bUrG#Bz`2-6pcQG(Qo zOz8h!?mg`M{3UL7Jrxqp3%XxmN{%KXb#jaVI;wg-Mojp~4B$H!u6FNqxv^-kA#BX? zE*)JIJNQBjz_ybEFCgkbK+dhfs;0;~Q@2tCNkN6~GcU6phUNG0*heZ6z1SUx z3I}E5v^R?+D+Kyll=6sQ`P{+E!9_EBvhN4@}v@n^$V#)c2=Z6@)Q2tlY&cGw|LiHs#shGRS7Z_U=cKct+zyvaxs<<*}t zW^rTVJPx;N_hYqmP`Y=5Ss*R(e{kRXBJBJ=XsONj_x+Z;$Df8L85I`7oY=Nhl3~!$s>L4%2 zFO*@^Z(o~A85=1RP!f_9xf>< zS#7t(gv;#+Jg@u)Q>Z+~5V_T4#q+b>T|=F}3u4H1CwSRQ(}QRaUu31*9Td3wF%tDwSXXLQ$`~_EOahbrBSB9p2)8$yG z`Uq4h4(^UUPEQ;{U1K5D!rs0Te!!Z>!SPg_b7PVrb3!F3422oMu!Z}4l~W(s?2g?h zAd1ToYV+hMrK9m|{^UVgIb;YXotEKAo>xv{*{U-G22887(A)EJ;5 zl@NwLh5-3lG6uUk6I`D|n1+y0V>1QX_;=i#SA@s;DkDa!s&Z5O%oey;IrclrZ%YRU zRy+1Sc=Ou#?6cD2@TV|^ffrp>VQ%;0@?_?Ft>=kE#CbSYzUM~X@T)N@9A+ykyYG3E zIR%B5bax%nChW(?Q+RMP6;`ik2BYuEnrsfBZzHfPqXB?1^39$gWJ?V`P`z#9h#u zZ1mZw**gb%worda3a_lExP6+1Df3Ch2x6yvnXAD+zK#Z+xGHWj8nV>?8GWqa{m2yC6mwBEkLw;|h-d`XM7hIbekv(HawFs!3Qa_yI!V>%bx zem}jQYn~;-OkU@)iH4YX4P|>$#o9I^5ep3%7y{xd;Nl~h^xFSA>D0wUDZ!IOHDcu% zV9C}HOb(Fn|GgN-Uo<4kUceLb(3XxVje|1>kV1-1I(ocZYM^!g9nRGwbl!_=jg19s z$5q_psQO-TZ8}XoicWk2xtk(Q>eKf5AOn#{SWvz)twlUYjn(TxC6%Ge@psiM=35l_$Vgx03d zN$7q*CUl=EyX?ZZBEksDbTe~u}}d{70n zCOkoSYh8J0$a*jrm-3{&Jzqur)Vt13@b=wX+E`EnXYD8PdwRHnpkEiWdfuDg$ZN}g*{tm8BDC(mY8 zt~-i%X0s*uCQR&gp^P&X_6BLv)q^vyptnI9}4)n}>{FaaH zcwd`okMMH9F4j=n823sSgzV;aBIk7HPOiI+w}1*R48mmdM~>}I5MgDUjs?vaK~C<) ziH+=d+*f+CRb_%3eK{Sprv&jkW2cZ8jQ22cNLd=k_Ze~O?T2ihraF5ZZ^+dcscg^P zJd-u;E_uy-*^+_Xml6CDrDH2DeW~K2q5Xci>Ad`xbBF6z^P2RD<@qa3Gz4Iy(_CnD zFvL(TWD$9`WDUY8Q9H`6#GIl~3ZUzpYw%aypf%=UeX2K74@FMVX4JW3Oj$4}u`kk+3fg`)1y!W?`qgtx-P8^d(G;ID_2 z#oU>Pg!q`5QB>SOja5Y00q*Xlr}vgxzsGA)A8oTb6N&%UWIqrjXfH#15RdGarHEmEcjBwLf~G!Ae1han8&Nv zBfrBX@Lh-18RJ>LeQ(AIwnBf&o!qv`WtqXsbFrN`=6I3F^j}&At<%4IwhjfY zj0X=Y!lgvaIF~)&*IF^t+caKCDU>PjREbk}cF`1#Q%K=vP&RaG)No`~T!$o94Bz)r zF~4;1YD6u`mPGt%(lqv4tLLezjMu!`b(6}YBCYm&aC`)vHfOwAZ^Pn!Wh^ggyE^YZ zE02{#t`(e*00*bqG0;D1GvjqItQha-!TQcK1Sx~On+MA+p|w%+O+cr1Csy3|3}uF7 zqaM!X&+ikXFj5ECG8gh7T)JmMeDf1wVr2>&31TKwk*GIQB}2htl8nwf`nfzQvPE7N zmTo3RHA#|99cxjfbAy%3ldt2m>_jen zly$i5%@GD#Yxi~!MbbkuU!jZlfc&3enTa+u_KOcPa*iRM{k~vCHrL!`5LP(d{~Q+; zy%ROEYzSX_$VGb?tZ|^A^;m2|x)Z{}OdS~@Kd=foXAwsdu4|M`H`%D3a#L_ z8q~N}f{A*iMgH3no9Fn+xwF$OJD-*l{=^2O!_03ntR3~`k`lP>1B{hqb35N+pENhs zu`S}dm&N&Uw?#8Kn|fd|yq))Iwm4g8^X6qPBDDQt;L&`KfKxOkX&t6j3U%hZ8Sgi73~X2*o&YQorImPwS-UCXoZ zMgy*nz43)x62qVhSeb~Z55phZQrFSp?C9!~>;UChCXkt@^)99USW zovIo&ZnqaqS8wCqI%z|n|5&dI8mDE=K~*R2_@PEtoBMJshTb&nw?lnmeLFtwRbnV_ zwdLZ#fJTm+D`e1jyTH;R701FudnonVOU4cw`PdF!l0_zQi=-=iJzcLX9OcZO@C|XM zC_IazJUd!hfq&`MIUkn=ugR$`x)s6p%Z9031f0kNYn&YR))jb8W1J+xg+ne=S2bbk zm#3fKV$sFhJtV6Qhy~rCufE{az#-bw;5e>Gy}tcUcsc-SX3 zirp6TA_uh9_5aF17#d&W?!=jl8R!tYBf^OfKYWD}l^kKI&H7EycfJ-^Cy+%r4uh&# zNkQF*N>EpScT@jhAtr)yg;YaAqP}*CpMjJga6Xnqf2geOD2D})Zjt(jpJJ6|(puv2 zr=FaZR^TnQ`p(J$nF{L078%{$R@yC->*J(zbh)=mE^A`}?iVQ}4KWdh-N~qqs5&yn zwZP6Erle$q?3%@o2wFU^Qy7IUB-(m3mnI8K> zA5RnkYZ$mT#1qCRjr@GEtZ}^vN_r=2BgK1ddmci0AX)o%0s7>Cuj_7f4 zDr8mFmUFRTYi~3~Q%fPq7OPAkj6}oX<0x5SC8Kl#uijX_S*nTLvG6m_K#9LdK;>;F zrycgX+mzrmD6wN(LX2!Xd>hTpF7gSU=qst_S4B3y&z;Z>@lBTt3d%o(Z7ENQGT1rT zR7(^5*mM!?!`p045tchia6ITBp_o368CKf8BHWYDw17|cIcFsCyeC>fJX9qYdQA}hi?6hUju1`( zojC0WjY%egMMhzj0@;a{>ftT>ApIh(qv+TB36b=c8vzwPE9ucKUBYqo1iYm1@UXi2 zzkC_o112Q%nFyoHsSRmANAZUAM_0f{0yZ#_g5oB>ahOSISH1p0O>AIB(p|q=`74(r ze3_2534*hWYh$my-qi|2)B_roK^reot*iWYy*INYJpwl{niFZTqj>r$LJDrYXmwyM zhyw;0lQ;sbhdjGhs>{u6D8Vd2{wUp6<&_r{u^4N) zII~r;rZ0qRYpYYUWE4R#=9I)x&dC%CSX0_HEOi9vKoY71&vxmkd$>U*o&rBI2!(en zinEBvr?sD420;kvgCE&s9HIT|pGp1hwn}8sD^L+c+53BkKh-?)iHx(i?76DP%d!FX za-Qw@>(7s6s_{o;mE|Ba3u|U0EjAP7Q01UnaBXW6m_}!@r=A9p8tk=L-;X4^1+9iWc+8fS@fKJgbigS- z(?v>ihB>Met~IUf8h%T8KT1ffIgtKMtbTE-Bi75TjESAnE@eWz)VNWBXlw>Nyh z$A!f1zG^3qW`{k#+ z#+r^j8JIQ`-A%eqxI71RoWloC&krbo!!+mHJW{v~qr@FG7HMP1QoO%8UA*nCWbaR~ zZ~g&4SEjXk*R6nV4%4A}LBg*^9+T0sr`Sl_Jp^l_5Edk{!r?_*cZa2B7gnfX2eE;<_HI0Q2p#|r|xc!;YB_nl{z zDd8}baaPg7d1U=&s;Q>Cq{(GH9aoa!w&3f$!l6b~6UMl*8|Px$k21NY3(S7$WE3Ld zJAZmVuS!_m^(U`q&-KguLKixP7s3}JA}1F^akc4t%BUZ}=XHSy8iLVu-dajs2`eU8 zV!|m5tg$^Dmk|o^|5PW#ULu-!Z|fa^xDRpXOgaTWCG#lDfiurko)@*urngpL=KJJ$2I&nI~jD44o;zU7lH`eiNoxl5?8_j9Fq!=N5^i`%B`?uLsuZlT4j(+AL!h zwkRi+npZBozV;KV{&r4aq_3n=v?HLzz7QN`9xEF^>fdyjE^71JR}Zyz`fb{OPoo8t zZA{Hw3Ah`2{!;QSRN-Mwzt^UR7;cGS_L`p{SKeK8f`6)8ut0 zR=1E3%6S@ZIEzc7k^!B>`tAKQ&wD<_|gek}%S zX3skpxN%mlTGBGz`Ft+X>k@z09H#e|L%W+LGFAs*zdIrm z61LC&p!jBqAmA;X!d)Udz?SZBS;{=Wy8Ku~a+&hx%FJXvmDYi`SZCa8UqTb8rsmRk z&?K02)j5Ug;wB1tA|i<#yn;9|LWAd<`1`)qL3ID-`P{C(tQf(w+)a+oBIdQ4RFof9 z=>T|ioM+IG1#P>9aSk}p9M`oBjFm7~O|@ZyCzTABDYe;8>NhtWD4)*s zwj&XgvfKK9(uGFL&Q_}T{U$s$mM~RqE+e;D&Tqu$V^2~}**n{8R<{%!v0`r1=&1i* zwvUslO9|%ys<`B#XaDPf#}e5#s3S2Bdc4Mk!_5yEHU*{ocoC-wHW{lgWukeFNo#bh z#|ma@lxMK=R;y7u%=8wEOHfs^LI+luQEz{1H7>)tpI+l#B3%tF3#Gu4M165EDirzj zbW0K>2wU1i)l4qh=S|wBcTQN3qq&|G0%fIujoBP@MV3`0^u454?{ zK%4SMUMLS`_WFpr5f^#yszSV6@ON2s(A3b26^7P{+#E&wJuSkoEfUec=eX==6qiwf z$elhHcJtGw;2pa9-xPUDCB6$OTPa*Nmp{LEO&7~lMDrZ%Yc73Q^|I39s*#L5m~X0Su{AGPxfmX+x?jv7kW>%+IQDy zmj8Myy7Iu=zSa+pO96+`FGlPoEB2wL=!V8F^#|Yh8-uv!JC=5RNuJb9r0MS#?&nDs zg{zOV4!CrS5lv!T-Ha#Kt%t(e`_hX_!v?aNVdBq<*5NwPVTi+~vHPr2#EAm9<3}}6 z=-!Ajv7#hlI3|e}kX#Ol1D_HjL}h-=%rf4oZ8TUObY8yjxqP|^+VZ*nbP@OR$3oMC ze)qI8n!si9bMw()oEQ5$&(W}4C)KV9LNR4JXFsZZ z>N{Xb!@)BN8dAUvE+vaKXS61>%ZawA_J~)}2Ta61J><%q&UO%hMau*|#Dzft$Usc@ zwxMde*j8oerf|XEd20X82GGdsz$|0XSy@>6?Z#i-2;L38g3AsNn{RWCMZ)$3JgGSSSy-aVB>+!^L4|t- z;7vSwSSye5J`N07-X~MRoC}eX0NT`s5RK6T{7;Y`?i=cs5qZ6Wdsd>_5c z;e@!Qtb@-4+6bkOmW=q%gC@jd6-fV`J5P{m`6F z1#G%;48w8ea?3heIB*|;`r{^m3;-UO`h|iEn)K7yNOrLU_SFv8;~!&w$+hdIN2 zrVz#mJ-ZhZ4&J?f(kM!wQp=GnA{-LXc{4E|Q9^GgU5jo9y_z=Ul$V~4kuGDSIaqe% zaXJb$3kD|FxksT_J_9KJHOXzVakD@@G7tiJ%SvT1^Zavw)`wK2r~{al+}Kl9U{%_MlEHD%+uA*e+7IeeQHtlj*Nu;7ylW$2R>NvmS?r{(mq@Vd zR3`$=t+$Dl4Q`RZ;V|e>=p;_#Q2dekCoO;{fbI|DQxe>t1ATb;>RO0IaJw?K9(Wm; zL?{IQVP$-F@39mJ>rj4$VUK`YvvCQSYIuQ4LQ?Yb1)zK9o$k_;O!ng`7{*B4Iz=%ZIEcbfUnp{D(Q!3WjS-?h}z&Ojd)?Wt^;UK8vdg}*=z*r%E?F2Kkd$-ckePhA%Jg@v{7+_dUdfalJ&jrPZ@ z^bVS$<@23vG!k4>O*Ra{WTPK|sC?X>4+?1t%=6%x>H4JhTg?i}7&S@0G#I>$&~tyC z?CBgNyfIYjAj}g?itnUG)pH1Q!MNHtuJJmG+hgB%B7=%hu8xt~NUoj$^zvvw#tSLd zD8S?6@E(Wrx!p=_(t$qrx|-h1k0}sj*X7AO(Uk z#c$#zS>A47TAS)F)U;EmH&e?rlskk$%Wu^LPP32jcg1DBNr7`u2zT1s3gC4gAr+ z^~IQ19zve5g4tgNhPFQzpZ6k~n4926`^HpoMQ zQJwF>#s`y&F}@|8CS$K+>`<&wzJphYAHvda#%Wkcl-|$LlBWxCu5%i z9(W`oPVz$dOToBDU8JMX`21+C^SIIkzIQ&JB|TmT-PJ!%Y>}WT8|Z4ed^9#bT#i<# zzxI^dxN=>NLT63Ove6ZC<}u#M-T1^<$cPkVGAzBQX-H_1{vAU6H0L&i9V{_Q<|> zo=*t!I~8Q4VWQJSbWXsR(2~9$?_@kEnd!iL zvW4~b+yr*(0_hDCNG2_>t>RL9f|32*cwq6x7%G-JS|ZqcIWHHF1M7oxmALEosDtFG zK|!vdYG^L19_GD&(7_+$JkA`>X2^PfM)@}-7ULmN92HYIi;~? z>)XJFQHbf5lim)bccooCs<^2|XrZ8PU!Bj#-UnV~>s(fR`ehyp?8hZB$cjG;?=nmj zXZ_WtTV-wb@f&_V54{ReCrXIx|f2jBG4GC|Q-pu3c zZTsQp@qsX1bpBd~`L&6D)jH1c?6(_&vJF_?IlET5I6zcgLO<(oOus27eAc6^8l1z& zg#qV#z6C>FGcGMSN;n#{@#QaEXkFL){?##R#FUe0aMQgL*SY}3TwvOm0iD)Lu>igmra^@s^XdyGITqFls*SM0nNB99)S?%x4Z&iK1|>L6PpZuO*0#p-RrHp%NJ#k`w^i@2BX-5 zNYWyK;?)WuYC#<5Hqy;bOPgph?yRW(D&KmV5! zKq3)FL1P!+TF#3)L)IG+4xq)T3*2+Li$YQYSZ6ze=f%Z>!HyL#KSyHVTj&t< zI^@j|8Z~;I#z~NHM?v~B410IghbRz?SoTJ`Wu_Qlk5T{bIK*9#n|<7ids*PU@r*=el2_*kFCCJ=Zp(@u2&yPk7e8_ zwXvhzsGt}O#Wev^9YO^YZyxFo3N(ZSaNz;!e+x!P;thiNV$Cu5a!XNhtDcX$jV)>D zi$CB!fmK#mps7!eP!O1wu^p?SpF-z|qLUmdYpT~;Fm^mW5l z0%gYuVRu!1v>Vnu;MXz?OuwY0r&wAo2d5~*t%*eG?IRy1aOP7OrXd$poFPZor167> zVa-R+y%h<=SE|g*{5Uv{dduyVHDuUrFCrLs`&$1~J(OEMuan&Xx zP~n>$YK0us0>O>7_07B*>LajUqer|>%JeUQWL&pQhPt;| zymRmbeG=DG(JfXtzDbmp-$Q4@|4?8M_C~;Eb&k!#tYc*v5URimbjGYk;rtRm(@sC~}j&1X!fas(=xs;6QQVXf|7%^#!!2GrqK)?AD}bwPq884BvE)_|9_EPpYlkqeF&` zl`5FpQuvkc%K=7k#%QDx(+_(K`*kx2URh_}U~qdSw=!()TtXUBe1PdMuWMDo92mim z2|Wh~sHId{|7-s`ofxWX6J+sRrq#p1j$@+^p_5OaPhFz(y4t8J#lbGgZ$Cem^B&r* z-VEJ@S~w?SiOgXK=Nn>|F@;V{Kjrx@ zkqUR#7Xmp82d4a!TrNGVGCt2uAgrBU4=KC#@iz-UaxkLdqNAKaz3d&J9_*cZ#URvM{ zh3sCC1#C4T#c;n@5I;#FJ5;FWaVY*Is>Y@pJH%LP;B^C-g-CX!`Cnat%-7Q!S=2)RM%EEhP_Qx%F(4K#k zb8x%@9PAZfPNyjZ;17zUivd3F9Ovh#Hng)+>8MW8=HUvVUX=2gfX?fU-P0iK%MHx;PzJgr zt|S;=4(|}wR`a3-w=(8r><3wwAJsL-W`z)T;=v6?K;WDd8^gq4j$$K+cr29w!f+lT z!301V1g4>#;ktY6hd6`rS}Sc88vVhQ7X`)!13>nTPtq+k>=uW2i7cY|kAZ_pgb!GH z)HQDE8_~SJZ0%Fi{~RbZXb^R*!{j`E;yh%z9a-~kxy){i>80XvVjq*eLFz`{R8C%c zz`w!z1N8USsvcK#b%Rx5cQ7E;j)#0z!50XUf&+-)5G|N>g6Tl=IQYFkuFV{g zCYMc>s3N&DX`kHTT(g@{9`A;gX~xjX)IiBAR=gc?mRS+@tG&Sai$WaCivZxpN+w9h zN<&s?QnB%wbLVOpoa3^A?#Kx*y4xW~N{2;b2?+tC?_ZUv4c{N)ZjV&LMUO{R zDnlK8FyoO=33K4XyMIMOIiflc7$3I&Vlp%o=8Aq5#Ttg4hgAs@Q>y8Q(x1{5y5qzA zv*XitX3=YCN|3Z71PsXs70v;cC1-MZHfhDI25>jXH`9`78cvgxH*chd<5?8E^O3A! z@%josnB*rb!0WC;xDdJ+4axVz1^$C=D%s?9{}AzvQIrYB_9uk&RRxC~T=V9Q4_PV% z<9$`+VC|R~i5Wfp+E%-P?Le!&R;s+<#6&$rnVn!tb}p4wE=w@tBj4-Z6eo$BoqOQ!!j0K9pr+6k46c`Jt>(?y*dM9;*#MG{#L5Z5$&{> z-&#W}nD9bFl>tfRk8z9~u)7ItuQ+F%t@!!Q)ovr#ex6lq=@MJ24 z%(w@|5Cw%Hi1|)|^M%A$Q!NjQdVnk+3^;SaxanE*>v=`i!6E{J^m9L496&pO;br_N zmz1jp&JNH0@YCRGbi*H&)~h0p+*+w27%;sgQRAeDJ1`izU&wG>b>1+lPKO0kr{bK^ z#h-bi0X2%gxpt1Ut3g|RB@B;~GIO-6VCdl4(B8xRF+pqO%Fyi-P3>Iwv7a`|mHrER#yArIP#xgi^BUmUTOAt1%H z#XOW#HrODwhGHhO+q@-2SZ5jRN)G>v6Tu*2SuIHFPDI(p0r1CW3__%(R?ptxkq7Jk zfEtEf0Z`%W%eu=MR17fv&ZJCoW^E2nZWi; zD`~h52Lea1_`{`OxtF-Z9E|Y4h_ezKC+uG1xKejZF zPUD=Cj>u(;$$MZGQ|oH}KXjdHsT?R!?oMhHCY<0_ml-I*L#^kV~epG=jmq+W&06t^AP+XZ~YjijzQ&|qeUIO)>*#>mGty*)Ia zZ6aR1q-w`h%ki3>g69BbPq=`jq7C6A*0DC#^@Y_`riJ;%G8C|Gx!IpXcfOEJpNdFN z>JD!=s(q)+m#HuoSIb=?0;aoNY)KQe2(6e!@3kACX(Cm>zmgn3yt|9N?m7W+a(!Gy zUyrRU`(HlxJgzai9u-u9Us?tnu8)G)sf&(oiZ!Ob&$C9!EXIBHxTgO&E_%Egl2Y%H zybYLtCGo$^c+?;X;Q1Jpc8tk=YryHR`k1VKOzV1Xe-z%l`Ic_7*KqeR3Ufnsnj2s% z+J3oYgsSXsp*oGSt&Z;g3es-AK6`UP;~!)0j1dptESpER=7r>ewLvRo)4XSdHQ;x{ z^IP5P1rs}aWEg~ILHq;TtAXH;9y=PFt}BA@ctK)%yz1aAP>C~Geeu?c#z`kMqRP76 z8WXyY%nWDV!c@aUynxZC*p+(3{_Gu6k~E|aK(#nQH#5K!mwk1DP%C1(3XaXycOAtX zB7L8u(?SP|YG7kbn7d8i;TB2-lHdE9O>sP4li3v@f+J zX|*Ws1P~ebyuo**TpG&Z%-Xf{&HdeRl6a}D$kdf44!M3Z*EFS5tqOn*d$QvgN&|r( zvCvbabw33fg#EAN)I$o_oR8fcaEQO<|>4ap~mk8lU^-Rw-KpbbUpi6v%i44$P344|AY^ml-GY)8=iL1l4v@W;wj@pDpQup%1IgiX(cG@u29hpiaJOhQA6s z6e|h>AKi_lzFUL$nit~dQ4I8!FSF;Lk*=Stu%V!mh7u-P@&(f2`1Xab&Z!TgJl_}E zI2*~{H-hl6KOU-pXkB!oL&`xehW0hyQNmY6$$$23v6lbYXc9#sWT~$Ly5aS;0cV}p zoW2Es;D|V`3gq@^Q5fG~Ol#?YR6-GKb2Mg=PPK!~ZVC}8ZNxT)JxaY;yjCdd6isA+ zIL1CX?~VNPwk)mLV75z$Kj2JBGV3$oDQVCNBE?uU+B=TW9I`os$}d3PDQ14@Fvw}# z#dtG?k3@#pd(X<#&cFkLyA!}X(dn?X9rE5hKv4{1tgW5=!FYIXi8nP-?qy(ANX>iA zo~2Mz?&9&kh<-CW89Wy&bkxCrgo-GEcc*s2mSAi016Tz_N5fFj$|VupGnE4OBBP<<&+~(} zrN~YcV;TxjU^)97vK_Kxpm+8rCD8r6$vGJqg4k7Nvt2BpK!$}-F;0F!k#XNrAu=?w zrY=9~fvKOzXR*@>S5>H-?(G#Cpr4m*ZoW~Pvn_AJaqiOBSGrrp_avX<5{Vl9Kw;#& z-ndZ;7Jw<2p^bLF`wjo9Nyc*e@L#YQV((bvfZbSH3&Rijh(4!yFbNXQf^L>vXq>Wi zdVGI~a4k)Mss4>wZPX;NSFV<$1H7)$yulmQy|0hQQOU=-ykd?_QS%`DaC4xv?MOJs+&3Bps@0;2@~7kQ9%wfcu+k zIh`85;RngGDxtTlmy-`tDl+F(9=YE;nu^pP&z{}oA1k%oFAh}yHS^)zzygBX8b0K` z6p4y=QGq3u8w9<89YAi2IdcC8EFl=M0AL;Don5TM1|0q&5Kc@@1tMZQZ5gHKz*xt< z-~GEdIKDK2xSbk%SvIA3M{)LX;h8Dd)ol6=K&KO*`p~B05SMh{H^Mt%)p|D241hI| z3+W8m^F`|$Oe(6;RFBlqlBswzwsWuK{un1y-%O&afP}&EeXmxUh|U+CKi=ad$7I5b zvBZW05!@~f4eTG9iojDpBg?IE79Fwn{R726|Vou!qB6Faq#oxJHiYTc_Xg zXR;k$Pg^6~Kh-Flbyp@c^9pdf9lj5LFaJ_MvG|cGtD}VfPf2D&oXDHttdpou@xSE( zscLwMRdN>$L=x$vt(ih2gtY*^(M9vtJ$?}H_fX9@OQ#D|sTJ1YTMOf7 zHDLjOX7=>n&37+gHBa|(&7)}}!FqjcHmB6lInZuQE=;4HnQ8NSJAksIcWAFt9O2kp zTYs(szf|>#U+RTztEqf6; zdRME_A%O{AWT%Cqp<`;3USMqGJs^xpc#PLS-;s)M_5a&2;EX6Dp}xm=q*PiBG}Az+ zjTd!KU6l3Vdv~L#V7kl~U{N^gYKXH7ite9}=RBYN2yvbK{9l^?x)@Ghn^z~C!V9Ib z%lZY!s-Uvo^fk|vfcIQw)zab)nJa0;`KTauX6W*8$a1-tHCU|ao3q*^EV-1h+Pu<$ zNpI?Dt*sWz;%aPA-;ZLtN+1ta1{!C(E|dC)j|I#xP5P|;Ui1H4?D^HT@op>0LIUoh z=iFPYQJONv{~8c*`uJ48ad4LI%q=fg!=5w6elYh-MHXO>kUfmE*o{#|Ay2dR@*(Xq z`pxrSmp}jfdOp>C`>H!86`h?YGT^y>k#Gg?mC;NLT&3%8URzNu%gA%+{lSKK5OK1H zsV)+;3dfkF?Or0=!|IJ0ZrCdur?agjI!>-yCceUJ>J{`>qBn^QrXvH4&-p?`Z(d3u zvwy(0v$G4k_ZCk{-tG`x!tm8DfA!*QWNJUE1VKB(f_vDtp+It>GT(0`>og>g?ZwX*~E>!;wvBP4U38-6Z zT4-MI*~mV_ul^48`m|yT!PLP091GdY`o7E~VDp z@tV^OtmNM*Z89v<8WYsMQc{pMGLG+=VoWZmSrZVzP zGGGHHeZs%r3EMqTtEHw-e63B={(`d4}+Ej~S*pC$a^DSa7WSQ_T-0p+4 zPWzr)u(Q9D!jjd7IwS3UMMmvd(JX4M6?>Edo=p@0q0&8Afd=gtdQU9~-@^<78w*5g z!$o>{;rq4*Wh!xvYLx_sP*r%}R0D4f!c5g81r3i)qdAlc*Xk9eK8Q;I|04+0=PuZS zCX@dSjdna8RnL!foY!CQ7O-|9jGHT=OX71HlvB+`7vz@oJ?STbt`V(056I9Tm9Zrh zE~(4peA!;8R4nC8KR zv9hUymz4$>2deTcLFQ35rUOyZW5`|6SoKBH(eY)qc)I00__}UMq%|93i#KX2qrY!`=m=T9i`j|Ag%S`Al|iuwT(`rdcU zk!?DuX?W(L-rD83D1@)H-|w|fyW|Da?FjL}Dx+RHY7dwj8ER`L-+fw}fSyP@BQrM( z*s3pUWn4HKG}beIX-GP2BpeWq!;USVHC2pDEnmlC8d>GL0{_1M#E1Y0 z_{Tq>;|?jIg#mUc<~Le&{T){&_a7M2(#-3~?myJR1MetiHG0YNl9sdQC6qXmO7jC- zif;}50Y6K|jQ(Ba#2$8wB++5yeI+Cg6t1|0!yk%CKv3q#Uff+f_w|v%hDPx8X%51P zBG^Puma(w6#RD6I0U-Q41QibYWJ`dTHE*+aT~my05V5%~VYLe&GGf*B6QzR&g-~SR zt>w(ds-p2=0rLJv4Dj`4sFs$BhRr`*X6nf)`Ykkq{ z$Ih}o?mo}kgJU}++G?$)lFaMK9IoWl@HQtEej*JyXWwj{F5SiRl%F_1k=QLF*WL-j zIZo|+gL}YKEIFSDa4*CBGqqQL5Bd=#65CVR1$b;-mUm8x@5D+CJh{6xUMYPCM+HP! zwjY!Bh(pyA&~EH0WdYVNR$iaW87JZI!J-B1s%|)s|!;lo?iWyJcH~Oo4S(2<6kC8W^CHw-{eL3m$c8?BOBL@UnlT4N{Q*PUCg;1 z1htJHTc8)U@II@eDX3{9FLiNSbKF^Jw^(kmF7Dp4mN-8(8&pe4p6if!g)|qk5rYhFqk#2!bVY?au7)v&^&S zxVO>a%)#%QC&lML1r%JP_YGefxW10&2BwstJ>6G7>x$egyG*uc#AZl{UrCD7uHH?0 zL{L4{QV|p@zxEdpA`vCCOa5Z~bqNF|EkTGt77*-XC}El*0M z+{OH3j@$C^&^xOl{&2;`25?IsouK3Imv=TD-$nlkrV8@|eeQ%qz+N`~BerTFo`srz zdWzk{7`_=G+6CWx33g~Qq$Im8hX>{Oe6_11~XGS;76wv5kxk4@*tm<<#)i{CzL%woPha zF)&x7$tn&>dnmazWcyu3yj@kmLpyJc_(qsblK^k2y-j&j&RY83!Tda-u$!E&Z5jp} zT`^9if&2!^dYYpl4yCEm&T$nNNQ8JH)Q8`~lofiSc=v_|s@X8)w7_=+=D~r!FpEM9 zfQuYM0dQ-ms?PS(9;ZX?U>c7$ff5J5yHvY*j6xVP;5ryL{ax0)r@d!%CSG?t!Hnrz za`LOtmMU0YGkZj+Y;qlnt(6>&R*u$IQTZ7UiC4|kNg+n}3QTnCHz~S-s)`_-vLdR3 zwUYeV&^3#V8WOo-t$A#%)rT5|h=qP6?2jdZquLuVymjO8}r?|IjK=3l5efo z%Vm+*&MDU3u3i=K3!Zv9JFEMyBU9m>de67_JN$(^gs&I`)R+bY7}=xIJ*!XLs4xknm4T8}AwP}fPvATW$BrlqWCNw%dvIb=8U zR{HRgU#pT!(YsAL?*f7WRkejwy@w@4;kso~S&UBG?>Jh>8{;=lOT3h)P**vg=Fasg z;FDk9wU|p2L`;1UM<= z&X#SP$R>1s`XY+L)!a$h;;CDS=pc61rTF9J`i2c_N(C;bLuu4lLy{miblH91epXt+ zji;Mw+P4@?TaRTNwb;tCms~;YB|4g!oig3k^?m*YlCx8eHCg=0DPxqPJ)!m=_(&>I zB8Md`LvYn3Z6HU@u$-)kJ4m*0jsun|W#DQU}mm)STk`uuVpz-`!UtT?GPj~9#K zdZ?&5V)4%(oc{5RWTf@`Hrr3aaD$eP%v5-H!X9R;^AJNZsMxjftI#L{EBr)|FVpsO z>zZ*lxvKn6$O$*<@#|J05;KMNuS+`FY}UeW1Co6fd26^xqe2J6Yd=_}O-3;oY}IQ6aGkE-xt6ogmYlIH zi^9pM_#8!1MzPs2ot%%8OA+|Cs3XeBZ#~u;@!7^HZI`&$%YT+x%f~xEW5<7zzKQYQ zOUDOVlxzx)FUar_<*#l7V5jxFGuHbF^DMzi6of+lu z%e;mc*k1em=k;3gqIKq*a=EeU^7Onr`a8rg3uv<~e9)g$qpW^V_voOss36%9`st%f zwY66{Ts`fZDF9Gs4>TASvc&;7YPCu8TF_Na(^obt=X(hF9W(3q9ip?BTge*d{^B>- z1b~{q;aY=t-C#_j{PMmy!O{9qtps(S@*(Js~mAvFj|)`ujA9B*ZKW? zw;>Ndf8Se{EqZ>asI*xR`EtfZ+}7Mo zj2!o=y9K|MB-tJ(9NlTwawmBk!yTKJXYM3?garGIy~C-1MMB5561JzEJw#ThY@Q2DU3jgW-^>I#x7x`mSSTUDUk-EZGnLRoF=ut94Xok2^q_x2t)(w$(S-p#5H-zu zK9@w|-WP*9-}jOZ{MDK^NS74;fo*I`t5ILm z?QJPhAT~s>iIi-zV{a8Qjx^(Z}q&)csbq zJoiaSH^NX;UrW6XM>9haAEl|l1W^WaJ2b!a#I2UweVr4ky){}F`&c{LvssaXCzIFO zdQz8~heQp-HvSrUcgikd_?_teYxHZ81KXm!J9=i`_OR5u&hIKqqAsFYB*P=O{U1d9 z+$6AS>iJ+UMjpx&Ivq73Sd{A?4OL!DtDSdW4Vvd6vfU}5iFTzQ@h--!aTqtv1PlFdMq&_%=W%JT&3yG7D% zDju$=v0!HU93-5=S0A)wlmCu-}LLv|+OOlf}!~kDUp%v7}4FFK@&0>MT^r$Ms*AbDO>M$U8eNKZ$I{pSRZHW;k}G~avu2{<(|&&sPPR9jc!Kl&8Mq(JMiJdIp&N6!ibknm zJXW}=qOZ1feAHO+Q#+E+V$*+)AHKE)5EmS3@P9tf{Vp?d^^*y4_j?dL_OmiG>5whX zsE5gL2s6UuXVu4HZB#%B2HGk<*ds(ccl2pMZ_n#ghDxp~2;mzERW3m&HTN_2mJ zI3Tv0;AZY8y*^gCoAb(w%KPJlhR~Vp>D=&_Y?-Wy*YI=3@5uoip;8(~^j-S(C^=h% zYX;e@8|{L5lEtpg``sQb${t$}GU2O3EG`pVSH7R4(0<77@}*@EEVkKb&7=uc+KV%} z6H8m9*6x0Edx-tVyu8c$yF9UG+xr5!(~?{_ zw_`Ev4XA^ezkI_;WJJgYZv_06{FP$aH>++j|IdvS@TRgSYrni_xn?<=YWZqjVSEs` zTYY=(F6n-c9YI{V)r^5!#t|NPFnVquhYT#`R+#H)r^KMyKS5j-eiA5Fs6k3osc`@Z zGmBDgiz#S|*zte6C6E%DqYi#kJn&d$Etj*_B~-{8gu6=H`IMMII3pvcS)VSc7qRhTQwKlq)9os=fXzc zBu6&Yp1k5{mMZk%G-$k`k$@e%pvz+_N1Dx0#pRQrVkV01#t;}M5bzEW73v$+CWKkbGc zkOaFA7bDgjVCED2q?2LMNv~?(;l8P;?EG+IWEVL&XkGuVyyl+;W1RE_^>0pQfv^A@ zoAoPD=j{+eY3qAN!#`lSH5tQ`Bnt?!sn z(x+vd46>e}S*f!DJs!>TO#TrW(#d)X;Lq|!`q%}i>cQVWzmHjoK*gB*^uFy~uNvyI zr|2KhZ~9+fXL%+C_YbU$d?)%y<@!=vS;{1Hl$7pbChjamC+it9BJPV@Y<5x)4-V&s zY}vFbkXNaaymH!oNM9V-<@;a!%@Ap+swhion<0zOf=pZ#)IIgJ6wx#6TpMQQa^hmc za@P7@I{v5+#>$?b+k2q(C#I+_p7>EFzY=$v8ct;<_G^uPNTfQ%_>avbtMglV2C9ix zHI2R#ukam=thp+7(f~7L(MX7znvP!X~wwi*z1@Z%58cZX5IfB@W;r6BDj0k+Or z>)pSl@_$so_1Q7#?|cop8^4$$x~V3z$0nkiA~Gp@WlM`T6{i>5m_xQ~>G}UA4@E4p zW#wN(6cyzT&jtsJf)@10_^*rB+Bp)<@w@{?)iaah-Qs~LLo#hH9Z{&% z?AMeb-%kQRyXm_wexz$_Pj|Ck`KYY%+zzr(TN01e^Ur-g+?SEcI?v!~=BZv(#vR6X z$!F#Fj5~XMfvr2&R9_U(ogPB@-c|$Ymw15&68D}*#(m2ls|yl&g?i-D$YghH0ld50 zil^1QTgM%3<5pR?fF;@CsP3}$;b&@->nGh;r-b{uMNQuyUgPbQYk*}alRhI84;&D0 zJsrWFr?uVPum191Wis1xOA+izPj!Bmcy`Y?K5v}6(O1f`CbTzbpe}%JRc=Pf4bt2V*ZEZh^@fNQ&yA&^( z>)qc7n6p(|N45}^io4(h4<>uyX5)X@_?5JTDRt9QlXvZB3z|}>n!RK0lh+USrGm88 zUT2JOx;OzEw)0q-eibLsVpomY4HmQdXv#1n^-cZ!N# zmDV`(&A26emkx@{Dr&1&&b8F@s7NSEX{$?Rh%QGnF^E~~y42mvL z_3goA+C;&ve7MSJTb`le+tweWup?Tb`PxPu>*&;Yds+lXzH822<`Qsu4wf>jge2u= zbtJ9)+z|Zs1o1k)uPL)nzAt*914VYZ*@7{F@(KL&e(EJOmC0-U{k)Q0^;Zh*-C{>U0r;_$XGy!NB6^uskgT-&`GOG|5XaRky!c}p*?p9MIc!s9xnS=(ONIbww!{G z_IR&yAfNo_sCd)Nb}l@Zc??hWLVV<$^Sv^|p>l{|mtNf{*DtrO%e)rJPUO5H2I@v{ zxCgNNQz4)_1!=!5w1~aCww`>yjk;ze3@j2bU)TsgU-;nS1FcO6=C(Ob1`APOR{-S86`3OOZT%l z^8SD?zOc}Ldc^f|4P=i?M2B+HCghRgd={YK3l)S0x<{nU(i;S59Cg}|%*HUZG&cr%0)i_tH(xR8480DVt9ILyGqK`hKAvb;4{)tgs40p9lECcDS8(F2ggEZ(Z4LE(M7smd$d4c2$|G%3jQwvN|BOEtilRAU4rp-48KxGqL?wK-#&fN#q4J=?hj z`%AgxYO-dC!iWB8WKncW0nd;>o5SBV`l~klsKs(g#G_^t)uqWlif|A2xD2!hdvCpA z-c!XD3{wjA-r~g{|K8A85%^-Ry5hJj>MRq5`8S*bV&heM4h*IARSbvQ(_#Ab`h2;G zXnr?Hu`09bp2)SszC&sLR+=vR^+DXGPHcuG_qE5qWcH?7hfIS*Rds}=4UM2b+q zoxLBg45IJH(igR3LyR934cD?`=4tv)c%RK~8LZbSr+dy%Uar#clZ3qDQMJeZq^TL^ zaKC7Ou7MDgKV6HrR)G3&AGahotX93cJtG?^w~B4XRy<;fdCm~B7Q|aBZz%&Fo!o5i z-Ku@EZU>AWrOq|PuQl=t3#CNvt)F=2ot7D5Otc~%X?t*T(E&fyx0XEP2eAMzj1!{7 zOL5lcjklsX!-*i|2#u~RC#8ZMED2i?RU7r}eYr2rg_EIkj&$i9r;$)4Pz8_}OCkQe zx{;7f{)jY;CZ@Ieb`wcGU2l;MKq4rbExaRvrKr1Xy*F0--{7e-qk=$ec2g=4y7>V$P;5yL3p95?vX?tE}1sJFc0WqG5rUBmIt=q zA$Yp7I>y+jzgBG8asb`bjPZ}(qOLHIjcK&aNlqTS4}4t`Uo$Pvc!lK!2siK?#pB0e9V zQdayn4xL7kQizU+>U?Qg&F^pS5r1WEsF6ffRlG=5du%4S0FikSmKV;MNk(LAzpf%Oe2$kK&KZp_sNu(~Q z)fHqcrMsw_9$S0k`6EPRm3cM9D)=U@nWFHUl}V7FCm%q4Tns>tEW2~e*<)G(L8xdS z=x(Z;zATh#Yf03%b>O!r9#OLF6z-lNw4SgYk67TogYSfASg5fF*i+n=^;jnN_1HXoF!wxPJaU{XcWkc|5zGV(8jOf}=ie z*GdvVxdbt0B5FS!PdB$fl#XFc&v91K2d%u^@>4kV_gKv_k%?#<%>Jx0Q&`fh1#6D~ zo<&4qe$Ym+e+QNT>HzD1 z-dun-pg{l^p`IF4bOy-20wJV`^FP?+rgl<+n!t{Y8^^?p5LcZKOoypJ-L`u^pfJuw zt0#cIH!ps+x6RRCZjf?$t~N*Z2EY%5A>>NL$ycIHKG5dWfWmR~vvpAbRMt%Thi`8q z^Uz=8aexLtg6Y#F&MBwV42<2(bNLyJ>#XnEk*!B{asQuQ#nTDAZulIXrc%pDeQXx| zni?(O-NF|X4rtTJp6Ub?xn=nBHIfUjT19op$t>RI*ybxRasGdp{ycHfmD|`zkheZ9 zg!V@6tm4Co9n1p*;(AYOH;e?@7SV9g+fa?LNvYbyP^>L{9JKt7O5i$fK)-kkapRp> zlt(3-%uK)Or<#*^jmZLWtHJny~H!+KrvRCXP6#o=dUikO5okEa}jH~)2Sel zqmQQv6Y+Q;<f&aIFMZkywr{*3BC>h{+p(gs%IMPM$ zeR(2|LajcMwMN-jL&R9fafc9I5R}$jFiR2b{dU@Z#?F)adoL@eNcvr5PyQnM9XBvKyG8i*Hs5WA6ZKMr98qSjw{ zgg}vy*6o;@X2L6$K?zH<83zV&bjSyBIo`u3I~>hr{3m4SY{3oG9uQiBSFH@khjW`K z>*_srt$@@}Y+Yp}k`|fO5H3Ex)+8Lh&EJ%G4PAnKskOhcy5dG&d^}+DCtA=(D2XU@ z$ZsYkur?wC)98h7*J;`bN%s;RmZ{iPb6Mrbm5zCG0h=fkC$Fd0P}$sNo1uW5WV~;B zTz$4bca(|hAc9w4&KIoX51KL>3n%W!9Th_+Zdaoh-!*r`G?G**|jSSvIpQF50+V+G#)%wnI$}GapE+ZCH1I`$1V)aPwfC4~fflix$w$=Ze1+Xyf2~@nO z)eyu?wY`|(ZLZ;70$!M8&UMvvln>V-B;Dr0+Y|u#D=?CK2|C`3GfZl#K^!6OP`9^( zxUq4w5_~&A=*ZWkN2<6?vC_;OTx>b>GHe$#msxXACuIC1rt!?y<~%^d#3YPw51E?s zfN4ta`L$l$daILh{AC`cYX`Oq;KGZHJ%5FqyBK5pf4j;VZ0z<}guh?Mm@5q>TBz7D z3sX7ZPVohdyzs0aK&SQZfB6oI%+}D-UiakU?qOk`)=b(em>IF`6W5V$fX(KvXX>XW zOt&OmXa8GM@;(;}A=LqB*x5M?^_wdoLF~vfVli%@`b8?gENz+^>dHYli;VV=DmMJ! zC<|g$)qdkofR=R^WU}@eEKcp{Uf**(b)}z)9o%4|Tp!Bmg`!*%L_G zRuLO!$rNG3=dYnxs73)5)W%lJQVGfic;22lriZw9Iz>%5*^-5V^&&G200N%4trhvn z=PYL(Z*iy4KrauxPMlq2d9;g-qZHi2co#TssSR{z4Lh6oHflBaiHl!DX7u~(dvrlq zGJZ1CROk45 zL~0;Um5B}}bN&86rb(+!ASgPDY;}D~>LE3@iR_+KLPpN=`_OUO%3LDaBjJGg9rF~C z0=engz)3m7H9yjU!QEm9T8)0y4+GzlArCb4hZ;-Tzw{efKu>J1#J&WeDeWbnURsyb za3w=w?^w*DEQ-#b3918Rj<9;UF96~t?m@E#chgUlJUC_P*fcnK5=3mlXeVv|DtDer z;tdD^rT<$!PB!c7xo=nmw^Tz3e61sT#={?z(aNoKu?6aIdV@B78@D05tFkV z4xp5wnuWPmhxO=I+w&JWcZJCBnfTfJM4;jiY{v6(cJSE|qgjYP!4@|VA^UW6uqAVe zXI6k3!?;1x@yM~WbUw_^)8TIdo4V9O@3cmJ0l2Hk9mI|aV?*Db^ab^&O%XG|?-?S5 z2%FTlTy;AM;WnlnPML%=Wv2;Rl0ix^|1%(*O+%+V#!oK7@INo@G%+GXrFg+N*x*(< z=UNhqvLQ>_rn`rNJq>=FF|^gqdM(BlWwyJ?Egvk2RlHiuQ_R8Z#u3h%;2I zQ>+~mie7vRSa*+cpbbX3>FotH{BpJ%G&M_@1)){2AY2WISS#(oN}BBLcjn!erkycqSTz(U5lZY0s8a2}aDqUDS~SKUvYYBrRLkYLw?`$45!p zJHDDiGGk~3VAWct`V|^1^@xf1EVnD5xrUyDn&sBtjeOAO>$h1-hNqf)NsYJxKJq5t z#vmyEK|8&Cg(G^)KJr0b8EkFjgw-{8bn*hJr~QXuTZDFc4**)03qjh!-g#*?V3Ooy zsWk7G%Sz%@^JO+aGm@p(L@?4@3kU3vak?RikBubr)l@ZiIYL<;$ z|Jy0ax%ukS?s}pz4R*iNBJt1rj`gTwlaZM{nkR5ZB*Xn2)AHMA!T%EngS{ zX8zZ2wcV4@0zK4`BbSyo8Ut>P2Fk_%2%kScpK<53B}l&T`#1k~gz*9#k=KpjdV$+8 zcyct!&>av4#M**8AL2kb%0MfDy9UeJwfUu`oYr=obGFpIMZ zBUmRK3vF;~#ZQoyt$j2}Zeg_uKsv1S#aZMnqCMO9EXzv(cZ zRmna5N_&1N=ktcW_}_xj;`e9-y;3bJ!Kj~mwcm{~Xj`1~A(C;J`1k}TK5lut!AzA< zg_Z{C`5H|uUM#X8M3eLmh8lJRv-kWIZ98=}rRj)opsdF_!_JtE^&)4Zo9LPVL*F9m zw=d#I0E&cXMuzs7e9c~JRgLp0#0Z>UW~ zSRADu|5NKQ*D$}P3tv=U{!dOTCr}E^ z9~$?+L?9LF$sw6deu)`}W7%duUgib_-@gJto? zv$&Y|VRZCcS0Y4RoNY`)Z7P#rFUz)T;P?Z#g1>$ub}MvrS$j-(-lFOy4!*AZ#Pe%A2WM(orrSIQtNnd_Mj)9=|%e36@Z=^IXNg3sk zFv2Mjx2VZL;U0C?5Lrt*M3sn>rJU$9ndE;m`1pK_gqk_Tg6!MZ0nkP}8!r$)0c#^1 zxl|0QpqroxFYOM*A9xNfprE(B@M06?y#b$S(!ouXKVUJ`m2?laKY?)hDK55G-`Oo2QFB86Eza@JBYC5=3pj zL4YQ9*kr(!*-cVf{Zhr~ta;&*Ko01Vev!@&{86Tskhh!r45y%y1YyvlqFUzI#3MlX z^&NLxm-6Oy>M7=KFDo%micJBk+fiolYXsoFeq@TJhX{%Di;JCEQx2ceA?23{G| zIbRcQ{l5b&VuZE8HgDAA4h08&E3$Zn-mPeONxJ^JqI=w(pyDivBA5{(s8P@+Hkv92 z#rSA}5U!#l>gE90rAA`>x`(W6EFN&tiSL2W<`*L8gQnd`N zNSYT`lVz#~x~OHs;t0MGd;>%RJOBs*o|_FFA~1t|w%^&@%|)#54+u>CUP<~?yI*Rx z7p^oyrf`@ATZ^`oG+k(PIHjIlJ?6qj%U;&fZsMLEN&9OE0-4Qdh{)0_I$yxYJ90L-N6!LV<` z(%<<5o+^lwV_)>(xS^#vt0k|0L-gvnF9k;EjMnAVqubBR+!&lll)70w1%FebQ2MIa*oQw($O& zzDa#>nlVD0%@*8GjbJZ4c@WWmo73P}(*F)eL>qhu1N2}+18gMuBnD}7k*L>}XPQ2< z^e_|0s=wC;uD=8&|MHqiRa$g5$mk)ccvQUe9bcEg5=tN4$go_yc(nJq{hYA`T3f@7M+oy+AIt}z(36G3D^RFn=nI=j_gQHJFt zH(c6wGKvoUy&b$0*a12_gIn?9tuz+{J+Wtvzr2fJ1h%4`wX+}qVr(#iaEJ3Hj0mA; zEY`5`*!WeODby=LSdk8u_tMACQC|wg=!D<^hI_ei)`R2%mgfNs7+8VIF~p28HiV03 z1Cwz5ml*-M8LIL241%l#V~MdUDn%6R9>z;t1NbZ|Q9$7vOkbO85QnxG?w#Wl54Xs{9BZYRY(`h8Q+k4Zwbu|i_|$}}azdEaqEEIPb25Mjlm zEMd=Fh3Ty60&uI(W$OJJIrml^IUoV>-p}0SEHc=4IetbaS}u53<+`hOD@7NmO82wN(zE?tljAP^hXpAA0kTbUJ`=7A}F%a_e)(HNoI1ro2 zgND^GeN(a&vv0Y~OKqxIrSF+Qc`1OKq;fM~{=Tk@M&auY0rNrIjroPNkcW%FTYmP8 zo5rQ-RUpKqfLSU@GaZ z9WKlq8GnND(?YNaVAFG|pJ|aY1{RFj-kntdUdXs0a{)U%BN)j@dgMqkUA;5S0#9BX zAp*mCDrr{)_Q#3!Y44NXL$@UD$rQ;Ha7ugvan8o#52M83K>|GUd6BJ~q zd?d(3!An&-5n;j>Jxd)mc!o7k{P^ylB9r5%-oI|@Z~^5ZZua~h2l!9#>4 zVgDDFWG#B7!-w6lW7|LPdL5DC;Xd@-ZF1)NYYScCUoJB{1$KeXLg5Ni5B&*#f~SCS zZ*Mh^SD49e-lj2XbB)V%K4s5qD9hYs#~i058hTNk?t%oGGqluoVhF3|r8jz~10}Lr zH)jhUrVM$zA;OvzyHlGqlwE zA7^ExIDAzKz@xKq{T|u_i4@moImq%oM>t!<|5{+8B=W-9buD8Uf8?$Mv0GH5gRcFL zUcaUZ=gKfO%~(BU`6;ndgWO(ciO=+p$o!%C^VwRpU11FjsQR>|cC>xRlt16TtyQIrj#f2z5u2jjA)^n62<#@)z@(h91;F^7m%x3bXrn;e5ztYYX#w?Po_hX@ zA8C~UN8g$7H$NZVuT74l!{4aKMr7wBN~6uaB`Gs*J!Q#J-yyD%HzZOwTqucv1mOj?yB(qN9Yo76%oN{}6doGdP`&j`!MI z*>tzc+QD}_GGcBB8xpT*+jrT2xqWpf*um<}e5EhqC8yWtBvg-e^D|?N6oqHW$)Mg_ z={1?U{@38uBp1YaJ1quATQwrbTff*>Rm=D$r2_BKxF8!yqPMr!`f-W>sNnKinXAc` zm%4>RkTN*3__TY9?rHe?Ixfld_+Wx&>?KkVTC@U!I}%}=Kx_5*hz#N7-Kg&V>oY*S z`j~wC9Pn^m-A&^ciclo{r%3<|$Dv8Lf~1L!fw8!7m7=B^jNQ7YI>?JOF1vX^Rs5}i zS<{F@`6iLOO@p<^`57m21;RdjwpvM^Ymxkf$i&@Hs4H;QA-PAY7yH}3lLPLs>=aC? z11|d13bZ_4lemm0stc42m@z#rdvjWNei!^-645Xzw4FOA3Nh&a;`?n)Evkl9hsgdl zQ|)czfW$hEVR%@gGu3ucJ2Xo-Fy0@3D6 zw9%O7ho>k->!2&tgQvi;Fg_wXS~Ig>iE-Pc#=9XX?TmLw+&cGXg#&}4kVWKiQG_dL z5cRO7F~dl;uir(9jC)Tr`&nUP-bpA*s&QW09tqJRP$3FtjdeuVrqN-59aAhFPeE3` zfe|G1&|0*%#%-M9r8FwF6whZ*J;5;mCft7CD)3){vE=@lZ%le!Jf!P>eP1CITjR%A z*|j)Z*`*77AwS02AA9A*6mIol>cuG&R8p*}0#TjkzK0^mbVy*7Rfj!+D6eLzp{a^D z4`8W-cIn~~w?;F4R}cWq17aYaQah}LZ@X<;rM2sqBJPiIQzdVE4z3tCdpmjq3D_{Z zf$aLzfZ6DhS8mvgGYPY4+dIR&@AbVij$7=bEAHC=S7MtaGahLE1b*{a(0T0}FDhgM zZ>1n%$JG$T(+W+nrAm9L&!*Yn>EthDG)C&KC~TBg2Ya)*v>VivRz?!;Fi`2gyKZSZ zCL%=Zf9s|Lk$N)xJl@K31aJnRh>R*Zonb=f_YxoaGaQVTe@t!#ZsUVw>P3&!V+5oA zFdi?D;0%+8aPU81XqRtgvj|^eKxS~Rv5t(kmM&w(Y$%&c#rQ>_O`Q&7M9{N0ayD)b|ANaA)vt&AC_D%! zHhqh&uh<;%)?ZsphyS;CgVZ`^bHgMUV*`T*owW#( zyLUinY~jntZ>-7!Z*-oOCfissfbokJUG9a2KfZm_lMa8*z7RvqcYMG_fFt*Qoqpep zB8y1%g7MoC3u77*vat?UFbQDrzNRVS9Q9vQQ;3Or5Jn~JnW5_nP$ACtgnRz!nnGG9 z_ZrJy6D$nwVQ>%bOz>~AyYKG1 zdw$ zU#L&;7tZ96M4UIw2p{sPWa@A&1JJ0l_8X$>vAVW{J=vak6k=QWD}p(K(|!+!4Szcx zXl1wofo13$SNB7Yp|LzM)hknex*A*(FbQXb_KCY{!x%_Yyb1?x`$P-8zh2v#fITq? zo8?X%4)8J(;y3~_tpT&(#SnhZB*r81U={eEsoLGJz5EweWbuDFJ3`2mo7 z{;E5BHcx{K$AWb(*c^^3-gfya8K=pyW#u7}&`3>^FzlO}F2RNj;-8C}GY=fR7I{(6 zWjCeF2WKB6gWsu6^>tSSJ)RzP^M3zO^RJ*^P-@rfmX;sGzMm8C*sS`7zcZH;;s5yI z#r=EmC{9-~0ae-Dl+Q6axww~ViJ6BujehWZ?5M&aS>C*gh+tN9PTF*4Xb(|QFHgM`Al*Wk&JH5@&+vSpvA-?8p{}clW$^CLLy<%)E7?}s_x^Tx zl!|z%OJqTQWk-pu$bMLi#NL(78tVOh=471HcY5|k zx<@{r{9M-UG#6o{Vbg#VKq={Ru7-*o=$mAmoYUwe+Z{>7DHh|&-t6_gjXxVuH3@r! zMP|6iSRdfnW!U0oLSua3P>{wr+9KaBQ?>F51_M0>N)Y@e z#&s2INJ7bZL}(8h0mi(78+cVmhZ>-%>r&0`cASuU#BVS)H{;Q=(UF8&MdmZ(*PLD_ zi8gQLv8kuv|Mbm|BPj5y5iA!-=W|)|dZdIwF+%}hka@)6-#8lr+ZCE=t+>8kjlmit z;j9KF?30fOg{#kaV=4x^mg_S3?U*N@Xxt*X!(~1~3#xB8*yLSj7j^O+)?W7H>gi$< z`E=Ify)I7oax{2`UrM}c+%kn`JY&zSc$@iYG%e0WDs^vmisLqxMWpMP*ajFqPXA)M zu-vBnWM`@{=HL)HbZ9fJpN(yqp*wJNk2u(ho`aW6_x4!J-D6;WSAtpxpUnPDmLz!O zV@nTp3Fjhe#lsPiM1Y@|ersDd6S_F5epz)D&Kr$+=T0RPcUv`nL0|stK;v$TNOF#jdJCK8?A@+myEE4t?RpluF$FjM-HkUzrXfo)5xUS4((E z7WhgmvZ-j7cjO$Jy90jJr->h~s}B6FnFU(8S!!w+Bg$jkrn5#PCcwPTCG|Q2M_f7l zOdU%rpC6%2Uy|Ib(b3UQo}Svizr@I}gs#|yD0Ovb){}uZ_8?d!tA%Ya0vncbkQyXU zVf1Z3GqN}xZWW9Z!uwIq6xE@zT_@uT98^B$sMK**Y%7Tlz}H%JKc_p-A>YTYRgKr$ z2R4YpwxHejxlvpr2?=@xz$L-HDvUQn;#Zi$^oPDK*maaJ7b6V!9$({lWJvX&Es9VxQNUE1Uk`=IldnP;#CV`%yttT9JpT# zeiQAr#@UbAs%-vv5F^o~g3f@jZ1F)qeTfm$hGsZ4L_PnF(H@d`M=F#IjKE>!s) zObN3}hsT&1<-NBiuJh&nx$wT6TYnhkOjSxn^svcvcb7poPT}KYN4h!Qvg~F%xKVkpK;v z5r@etVs^RdT;`pOb-w@A2qp^dJM=vJ$sub&I zz_V)p23CzzZynAaMFwF-lH4a^V(a5y+v5@D(AT-};u2eHB4cZ`aHpA-)-X>RZtGH> z1-!R@<0@F-uvCg3u!Zsa!OX4Eod!VQhh1P zrQ%lvorCK}Qi+6Z!LLE3(3*rPN~s>=SRy8=0cZUPe%%*41Q*bv$?hV3lR|fyN>Lbs zkloMj9Y0ey5|2!5RPS)5Wfe6s9JzOq^QzMgtXTl6UH6MRt z2k6XQhpj(aT-al|f)aXeuzOi@lHcPgwHZ}VVqWY>y}WWv3AAWzyYuib%bRd>miTP; zvcaBXW`os2zk-Z?*s!m#8*}s(K#WGtxPr3L* zuygT76DH*ecl6)p=4Rvd`pCVQJ$Iu*qKrJ}xx$%|Nkeh|BsJ={110pky)}r5lU~Cm znexMoA;J3|KVJqV!89kph@Zwb%=rZE&a4y&Mi^COZSPSs@Xa82Ya_ zEkXen;t$KuM#Oz`4IuX2&5T!#p3hdVKBOa5(GT;Bzx41xBL;f|seqjPN-}LSRUf*J zT_BH8>ZrBoA1J<2srQd_=J%+BfOYy&MtFqXq<^&qIU@0%3Yv&34v~xM2Ujq`+9po; z_l}Q(Kq#yMQ*^wFR+SNJB0^5_L%}g-4cvW0^g~N5+vRVixmg>TNbAa82ZpsfD?XY| zzox3KhZk*xT#mg2vQDIMv8o|mU!}Y89$JGOJ`7S@tm192qxIzSdqW#QIxD1DBT-* zNE(2Pd9!q~`U;jSM-2aLyDDP0yk7*?<9oIr7|0pF86JaMeJMOt)w050P}WEK(TS0e z_8H8d;_!KDdk#h?xBBEXQtEkGstU$Lbv?l8q2$-gNkA?Nrs&YZbIxzBNkKqRJ4QsD zT&0-aea&o2?-12ySglcgJl~OIF>VnuCf3EeK&nu2qb)3+om-2d|2=9hE{1g9JOXA0 zKfLtw_T-b&#nkqT3}%~^T@9A$9jk*ufRZD4-mJrp(4(=#Zhgm5g{A<_uGzRNMDL@jY1}E%FvfBOugDOxkKDjg z!GMRC^1$ut>|VUn=oqacfhSg`zKP?<;meh(`zcvbRx-&NCbYW z{#2)f_91+f%Bh+HOcLlLxOPfED|z{a)33~>Lv+|0IGu5GsNP-mr_WOlG&&!MFn@b& zuU6CqnsHDysE>lFf&H)xM{UszAZe}GIcb67zw$Tt&C}-Pg>Njuo+Yj|a&Zw?v#;5T zp=V&fHTmx6__#IElk>s_)Te;Ond><&e-HiT6lHE(cPWVs zX|v%(V|>MD(G$0XKuY?DCBTRvD8CdOCA7RCrOUv|gJ z4cqaXeM(J0YV*~GYcTS>(i@;W$wr_sTr@(%!unQ9Ej0+qb;-558_>Q8W4wqrU;hEF zc%R)dLl%pU&ymgxPBcE`db-%2!9A3HTdjl;)Ngj+dE)b&(@=K3iTv>&MX>Cx5wcTm zii!ec?m zwQ5`Jx_F!j&b-<0|4N*Dl%v2i<&uyy#%jb}yc+WyHXK&G+(-xw0V*E$wn(12&oug7 z^7vggP)h7~VK1iHQiyrO(YH^?u=w(Gw4(r+4{{Q7PK4u5%NhY%?^8pt-btLQDfmMR z7?c!*hpiK_K;I!2@A7@j8e*gjr5y)Mh@Bw*wKhl3qOFt*B}NS`M{;9W;TFvjt`pZ)=QnD=xV-IX*cIE4dsJS>v_sy z*;mHOV+=03Nr(y#Z;>z3Uuu8LyF!8lv+isI8fb1&vSN@~`SZER9~YyvE{CzLQpQXd&lWkDWb3ZRSNDQ@9+GYdgQ992k@R|-PiAbS{4)f> z=UvdQp^zo%EVsH)fPneIEWqjf(aZTN;H%HF#`MQ~5uSAvjJXr$BR^=HX3%u5Epb_? zr7$9am7>J~hKuLjfl_!(yy%%CMwLw*1ANaS7pLc_{XqiE)Ej|@oLS56yO}+w@~e+D zZjF>o0J)i%CS{lI^(jA<8vSWQY*&~a#)pUY@EUpCQ^TbPT_f=qAA@|F3A#>$u3e#xH&Kkqd*U>R_B^iPBwpV3&>e# zxrm}%aj!RxF-rCE?1YZ5B5AOa_ca>|d51QUPnP&9Rvy5>VzvxSnrI|K#)egEemS9KTo zj@9tzd}k#4m_~R6G(oZ!JRZu$C*sE0b*JjZs9~a8L60 z$g?W<4uWs;6!Ki59mV0(ogb}LOZGxOe!j!RP{!u(tj1=YH2nbB3}b+FQE_;s?>>M) z=f^o~MmJrJcJUF1da);SW8223cxFd0>?|SZ)W!t0c-Y1Lw8$hpsL~5 zhx!Gl>m-pb{SNzYAMk%n`SUFFu%5WG49765?zU^eu54t-Ab!By*AEBS&k7tJ z@97&DRBxA5w!3CyRry|>?=#M(<2|en56xS8v;f^pTxv6W+`?Qk;iUuNv*5pz4C7R` zhg4lgt<@PodSDlsZ6A%`)KF!MEpCW+Cm7FzM{a*$r)u0FshbC&-S0Xa8hv(Nh)u0N zJt_;3f2qFaG?$erEBR$T&syLr<3-{snbrv!GcpH;qBJ(Pa~zXWq#N`Aa1hw>OrlL3 z%}g9r#cyO-PRr9zLC^+hBtvu?$tioaNg@)Jjh(a#n^+?iI>q-k$+f5c46-5w$d0{D zH8DkxtD2%COSgjJJjynw&w&%kZErbelYw;>{a8!MYQ!o;`Lx0YYV(Mn%17)LuVGhvh%eUCg zRnE)9wXcLrekEm9iFWszIvq6jS}xektZlc90R(b8Ep#YWVb-a7>FqT2e&f;X6x}qk zDXLxcheauZhO8$ZNIM#7726oQA^S@OP44#RdsFBc&@w> zb3ejF;hbgOH^i&ya|R^?u>-dd@f`XiBa0nPh(?t0J{+JA5?0N|zHBIXuyqS`8AQk{ zyKIQ4Siqn1nc)5&t`%HxnNN3Wd^{OG1A)~hl0Oc^>=)H^?>vr>AtzZYddapEzmbyR zR-&sscNs)9bzjU1qJA~T;W=9OHX*xXpS-%DMUw7O6AAn)ryqmakVVOf!x_EExaqI&;TBaBF zOU&Ne4DQ)v(Tjn&HFRZ6)12=|$yoJT&!?HK5t9Jqj|f2v)eztI6AeMbzU%;1sgV)z z6@XA5g||BV^)=`#!z8$IJw5fALWK^UZ7vL3a^)c2Eq<8p;$b`A_-FMmwu5ZBHnlMj zTcN>z&gzi>@AA=ZbOg6nPV;_;`K>t**zWt-jDaP8-p0OWTiWl_V!m#lUV9>IS%I!O zv_pHx{h)^;*%wk$Ck^ttl2Op5`}B^YQ8nq0OCY;Cp^w+8H)7>gvSoRy40FWJ&vTnb z_EF=k?$|d)Ba<>ISy@?uwQAX3e2c-&vjmgvq*cDPSKre8A2-c`8y^C8n@)Vsw^n57 zb}!5;J6VER`F6FkKj*}?Y>!lCPqefx_8;hZ5IQ8nAcu%;q_zrgiYo+iZ^oLYVDt#< z=$;XTac8C!JqF|LSn>sn*0c(pquI+?Mg6{Oa=ZM}(9?Tf31 z0ic>sv6FoLRr8&E2%U@s34$XN5bP0EHpU!$o2*A&lVI|My7Sd9saZGVv;SmxUQT{P zu9j1QZ<}4VzPHWBZ@l3H_Z!2ax>3XY2J5d+G8Gtkoa1x{q;J)T`}r_>_1Wfb*aj~g zP?9TF>(x$ueQVH2r^pNVov9d=Q}j5>zq~CLOSkrp<$Ab_!FY9^wN#M|aY4IulGAYJ zD%a&z07lBrcSUWImGa?^Mp_>dNsC^Nm$q#M4q<8jRai%G^QEH@$MCA9)Qc{< z{{!F-I4;}Et(>zeR7xHPTl!P;`d*4xp%knTP(d8M#fjKHiP*{a6%2Qw&p8r%|Bu|l|(lr z^tr4Z+x{rldLn9wF8P7#0{OxhkX!A4dYzm+az7ZvuCH#ZBZ< zY}vQ$Nvi!yMu z+6PZygx@wX9MO*2w8&WZihRDSCDc0y5?>wi?8Dn0vjy+QZM#~=ytr7^{k~bX-0Mei z_x}m{Fq|*r7-fnYEcaNQz6z-A>TWvxxqt^KG2uq^uxC(pLsoYc%O?i~i&YI=ixj!s zSr3*2zo86f`k)~2$J)lM+=MEj`7+fVJ?#Dg!$uB^cLswh|-rBe! z6QKU_eJRt}#j7{G{q^X8e7)x>n)6L8P=!(whY_upox_Ilp|6~O{-yJ2fX@L%<--)B z6!9kwOx{`diIK#EZN;~=LaUckj5h}nVjVksGBTPQ_}yeaZ8%?!7L7mc0h$KAe9A9X zwi29~wF=4T@oOEHIu(|`M(WZ6S$+}y3`_CUSmxwl zk?|8^jL&pfvQeg2&ZcFzgkRjmAOR6Jro*&gZM7)_AlS1_40+}qZLT{5O0amO6Mm9! zS}T((Dy$qAt0YZB?uMyL7s8V6SS@7fNNE zweIyGSe1QR{G`kziF`Hm6J-mH3IPts6n5P{-X!Igc9?E`hu3BsZ=H@@Z$^^kLUEd} zTz3y5>7BN{%6A#^xtJn5>Saxi@W!CIrE&VQ{9}j*c(qN~1}Ku(FGx2MiE1qi2)Z$f znhSY+Ny~xCK!@7rhE!Er-T)^PIdWL6_kX*r4B;b}&5)AR;!zB#Fo={ft=UL=701cd zr@&)2?=Jj>8{0a#If0La>kCyHBZJLGHInsiPp=4 zRAtW_W|XJfa^ZF1gEk0@@q+TaK3)!y_ZKTj{$i0`Q$A%~1^Va0niO*!NLIkAc8&?Z z?B~`RniTv3FiuY#E={ta5n%Y0cKQ_%KV! z>z;taU(9C~C{d0GI8KYG9dU0%N2aI?e>`nlzkg!Zbm3Bkx-);jGVo!mkB`XGN0r5l zwUZ7a@53PV6?8PDsh-fl*!R#BsLdzh9nHJjb&aT&>o87UdP?ANkA#~mHlB+AR<|Evug0!Y%6`c6 z{ob6P4*+j7)p~6BlsFxxkePQlUA7EP*U--+qShx_)vnv$lMs*EfY$s_lNk(NAbzaX z!f9W=5pwI6nBYwtPfvx_XqCN5;bNx<5~su@qf8Jl#0$G2QCr|KtNyU`*m|UiIIvu6 zuv3GLZbkMRFt5)M_C;^vNT83TXkYA+KYVnWX79Bwp`o_Y;2h*=Q93&#bBrl|!WpSJ zeS8KZQnZv{q>Jgw>3^ z_LpmygR0lp0Xty2#NDtrX(c&OT`ByxYbpWx`k0v8UX+`^K#}YHdEtx`D5{lvx-An8 zTBO~8$blK8Y;F=@+C-iO?A{sxSFnOF3w9T(8U2%ho-(H#7)@F)A1yqaa@%0py;8Y4irq&rN~(vR4FxuAPeQqRzDMq;!{&|ET+ zbHVSO0!ex({3nU`9GVFASwny+KA~&;T)7qvZCvx*vi3{kX}pM^NinGOA9gEyubHfv zRUhCuFjeg7=A8 z^rMS`TXJ(VWHQU)P25K(xtQMMEEx=slGK2w^rgAcef+WHm*{sV_@ObwjIy1x9T4m$``*bX9vXn&ipy3lH@xeqlWY;I<7fJ6nwvo)Ic zo-X6=cQ)e{f#)=P2pxpb1|}Q)fw0J8@Sb$iVpOO;9?8Wg!|sQKUr8ecDbw($1jxwu za6*XnvACU2J7c|&OBo<}4r{}DdmBctwvrq8;m5tIbq zw<_k+r!7Nm@87q5Jx!mp)p2^G__H5TT1TL}G|X9{S==#-V0 z_6B`)+lk#k_?22nNnwgXKI7fsxqt@C%qV3`o*RSO8dUYKDdzjK*6y)J3yqxiIBNK< z$>bE@S83oieVyJOCP7Fv!_KtzV?u!=k^X6%r#N>zzp$%hr7d+%-DuHjpKo1wZniyE zJKGfCoE6^lpfMb^IlwST{Wa{VPsmQhv!6P1-q8HbOuY|Edz;reotE!#|M_xewmSI( zGh;O$B~sIPm}SCCJ|qxkF>`VvmkEL{^g}#;cz@!$Ix`vd0gbKlMt856!(kaiQc2loH5x|7gX8S7g2gWcli}GW4<)xS32wZy8r}C<*mA&Kv{O6U=JTm|;BL~usUY2NvzpwuP zc^@HV94AR}aX3LJC7q`b>etgj6pEIbP<4#t62*A0UCbCvF?v9OUBg*grN<-|6=_}y zG`&0iyabz`GvDYato;$TuE0gEbByus3>NC15V`tv0bvg{u|64o?@v~Bp1CacHz!d! zthM6T9hXDG&s7uwv(FI+8P(_`Vx3!qx!SF4mxwK|G5?s%x7ZlL2W$ zmxI$%a=QfhAgGU}p&9J8U{_jgWckMO{r@Vd|2e#0g+F2D0Zcw!s|C+Bm}>!nEdf(yA>j^Y}6U{ouId2+DvzO@A;d=(t$_q!_B`i zh!*JNy1&5Q1c^@5DOaJZX{IPviqO9E*~RBAJh&-L2IMPDE$;hW1RX1V%{#=~acBEAY-d9+X?>@AsEe7H!D>8#S z0Pk1u>imY$+pmw5Ub$z_HyR12vBN|PwsPYZ|MW;2oiB@UM3oBQ+4Ypm&3IA zl{e_6?rW}e>GkmouH-*H)0+a5#4J;7$mG@3D4yG*Oank{PGM*7@b#*m;BxmVxc3Bx(SDNhMJ|K4se8^KyC)?Z73G7LJF*#H^z%H32W ze;sJ^5UG*L$;FZ37$TZ%-la)IkLOLhE7V6PT2}PGBnoYeHO%Tju|oZK%K(dI6$@WR zWf$8`Sfr4)e;V2yhNwLta@P#0oCM7xlF;?mYnPay_sj~W(>gLEXUWwXSfpev6*_)Z zg&fn5P9&2{oR}SUaQMI(*h0ZpQGf}Nmemv2Lpgt(I*5D!G4Kbj+rhFV8jd*{leHPKh<4 zGDaH9=F`Gs)~8)G3g||^zsh}KY_yzAS?h+3MYMk!MB%v_V=p!xj!pRF+-`dr=`JJp z-D-rDmDC8$5Y$PD*c`XXr`PxW|OC8xg6KOO5IzPABD&tYJ7(n+Cy z`1e7EJ;s5HiyN?p|Hb%_!9y%trGA32GF+u*^~^#rwW^9re3fB0SV^W0xGUR!RMUCg z6(kml7N4jjs57I_3{>!D{?B5(*MuIe2wdwFvHwzsR8vWRc9ZPAg7z%8Qgq0f*F z31a1U3{A%QUS*9gkKa%x3W+j)-SvPDs+#jlXD&QUbODm8B@w8V?J~0EJdZKR3zzxQ zE)28sx)9)2{P34*;xEPTah#L~ItDq<^4KThNw07z&>3;Wka50FlK3V?`(AwsESu*$ z+_?duUb7gN0$@@SdogC4s{lN~y6=Jx4{c-=R$VejMn*1NI8caJJ3UgT3#H@?4Rcn! z_Osc{K{y10zMk4e(7M5*L;d`sPHwt-dPHnBOmH(N%2)A{nQJMQ{Gs`NPUDBJ2t;u= zRgT$HicQmA`U_l>p7L?-3v+Y71Y?HpImEM#0nzST_;KIkNVe*=v}v%yqlI1G4T~>q zZPbr@(i+xwPJjzz+ty9d-c5>@yjkaa_b`0*yKm`}OV-ds+sElxHP6xrkCI%{{N_S}-=92_aTlDe7&S&;aasEbU*AOT0m zOevqAkspwapSz)4R5B$^54};9;ady(7ppqj&a$)jFMS_cHfk>4?ZRE*npf}P(T;r{ zfAcGrY@Cx3A%HNTB3e08w3T7p>9U_VNEs7d^9mu9VdRh;w?@(aR5$L|JKtxHwp+Wx zq|BBM(vm8e{`j|pBs(Sf52MX$)M41Ggot=?PD--mK~Bg?DJh`qgIT|6273A;u`u)= z`>r;glcrf;45^3X#<<7pStSz&WL8WxfM=Nm&%0;|N@+xM@uq`9x<JGTveTx1L@R-{4@(}672`ZL8%-03ji9bzvL z4lVw!3+3yDz_bH5Fuy&1o(3WKA?hZF;8&bWQ}wfj>1f*M{$TXp#RnB&PbM7ozUVqU zINSXA9S#F2(83_3*uN#jY(dCp-@eH1K%__mW3tNd^BZbp<3?-;|Kr% zG+574LqYc3Lhz!YPqn_wILAzh0#Q1TOG)%QRth`GySx1Tp^#5lGZh+@byseZ12E_q z#M31nd$^NF@8rcq(sFW0C+Dj?R?ojC<_jjsgy6H?SXc2_Y(J5g3)+htZIM^D=VsoR z3^YN}><#4<@eu0`y-=adioZ*x z#!_SFjE2EbvGY(TRRUtXA#zFSiJ!_5Rd857z zFhSE7wp(nEaphFMbx!mQ^sq-N?|5iV`U7nsYf%0Iz$QXhP*QC~Q&~w5O+jfr;7bb1 z1_I5C8YKDD24gho4ys6#G~P_dqU$WF?7spWR6j%~31JXc>~HvZP5Y*InkQD()+A`k zvcg1tW8;uA*7v`xVHEf?h*MK z-9Vs}%4oC#k(r)BwT)vWFswrkq+tXZWBHon^@UBjJ>ki|)lg(#9;!LgdhW1(jF01L zBZ|HaPkk>%=GSCqX*oI&fo*=e(hi)Kz#kzGBc^Cw_wNjyDwM(?;P-U8LinEYZyZL2 z1{-UNRZ^*~@;`2=H>Nb$u(5x?jLZn>SiQFcOu}Y4VnZ;)#jh25Lz^q}Pwh<@*f&QY zS7hl`UsO_zw6dJRlC-ti(PKV}_XP0J)J$nEhPEDC#1k=msE+uK_Aw>Ia~eM;t^Ezw zrtOXu7@FUbaoT`nqk*!^2E~)`$!y)DIJP8 zZr5thxQB9VUGsl$*eC8kaCUjncS{bTw`ygZJSkNTH9{x#{ zVrBGAWbLo`q!WSI5gVv7CiqP3MnjHFMu(28S|BO}y>HNeRlY2$tACTbdPx#*m{+}RZwo3nk2>;j+Ozn^*_rHGX zA5#f`13lWN{prPDg&V0pJajg*-4yP=0k@Qsv7|1o*Uoz>KG=Q9LqkD^x*kRwQgX2e z|K@))GN5u)SbfEq`(Ja&5Q6?caUfB2L+fxgTCKp!X|ga+=U?VlCQ zP@&&uWC)Mn^6Jz(MID0)I;aD>?8SdcM~lFjVD;hu_Wg!O%_vFvm&n2yps;d4!=sMv zzm{%_@sDsBJCkE5f`-WJOx%k3eHJkqJSQX%Ryvgv5)yn7PQdMQYXSZ>zL#LpaVw+Q--LfiW+{y=u;m*62xSfVhDOor3?5>Mn^6AfmvUGN-fMBVVAI|%?v(ARz z=QMQmBMHI79#^|D$pq^)@iN$ZC{_4!y!#^~0fbZnuW|1NH(w*SAuEggqW*6Gmym+Q z|H!-G8s|vnzp!4!A5Rdw_3V@3mA%_M5S;39uufJgNPKmvV?2x9b~b4QIxNNoKHj}5 zQg~pzvzSpeDqi!mi0!(Znq<2VIR&o0ENkIStk6OXIdm>{EkPzUw^JAXE*HWhAcfQy z!TDO8%WG;Jl0YuZxsu;N^8c2gKXg857zlsO@1Md65~miH`!0Uk z{ch1uZ`D0rt=`AKt!XFeT`H-eb7ckBVK|-4$P6c?P?vZ#E?!WKZKc^}^c&zRWnr;x z??S_wiTUN#Vx^z8kyd0+zv3Y|V$4}ZzoI(IH@%4$ZF&ZqqN@GVo?n7_F-0YS(fHEq zBxXN7xfa!TH99>SI@m1<5{;aoz^CPhOP89th2yz}Frr0uSrHWmp1T>5h8LCWqzBbv zD)}|j@n7=&H_)u(X(_UiBAG-g78a#Wgzoe2s5jnX^EpNvTsSg&|HkAS)P2s;nMkew zp8CJkK@5~gj#x0Qs-+1+(9;?nNpysqyxgBJ`yT0+3&FNMg!GM<#rO0_nm<*@o~WvK zV)~htbmjXimj7&9Z7*MZ3khu${2F6h(e$~_#@1e#*izWgBs8nC3LDz^A_K_7s{~Hn zw>cU(eYMP8=q&IJ>G)^8n4$ljdHZgP9u*&-9;x58%H2jVhS^G+Gx7qKX6nDsTRk$B zjIZCjA!m702=~>0k(jVp;Rt^;g-E*jKu90+5PPbgVMuW==4qiqlY@afTBuGO806^5;KQB{RTz!guK z)*~$^C%0n}Qso2XIEzY4A4ojNu>r;*k&!5VD_r|LJe#ub76YNie&}?8)86V}?Pqkl z5b{S3SeLVpH{rw1(dBw#Osx*9gsqDPmPDoqw-34pa>j2NX11R)zXtuYI9{n`P2#L7J%a#9zt$o%Qaldk%Oc1u$Vhc`zv0vr)rx zbnq$|>~>jHb^;{=!JDfZepwnGj_fF}{y zZq`n3?}wMAq=B*tNp37(TSyvr54YFj`3!}0B}tYg96Eoik<WJ7%sPFV%95tlWJiyW{u zPZ6q0#2ws<*qdHV@o8J#N)$-IU z-=*gn%2x3loyYR7u4}m^Wi@iXq=riFM&Q{%2%{96;na@q=EY=#d zS~mnNa`cO!H$nDxwcT~CT)&VZwu#zK%=8Q3GMU~LmAcHMh?0R2MGp@ zG;X}m!VehNQI5-=0rMa4fU9(y z<`(_VoqhTsqX0Jb+8sN3(h&MVW9y$pkePbmo2SksKN(L6J}bUAP1-3o=P8tG7PNCM z=Rcq3*69Uis;=zH+T7=u7StIqw4Vlq{Q%=G7qwWF0@*VvaYJZn1=uB??`GbWSCz#d zce(Ohf%Dm(F`ni}z2iR@tQvWf__!MdeY#NcINkK$Wa{_3;lG>t#-%bj;(8f4dETQH%~mZFt-Im8+2k$SsbZtm8WP}iQdm-fO^^|u8rK;9 zW1e(p(_+27j5SFozGHyyH;mgD81oQf=CW&)! z#eD>S_lvo%3a=d95*mvo9Ck{T1C}yYP5Bz5V@+B?p)i5=Ooi|>>o&j=tGsIYbeqF@ z*Wh$GI!w9dCIB)r^boFl+>asNz1}#M&^&TCeMS`kD=d7Sb7dgSi zu-kTF?_GDaaBOQB#yehmK(<0clAcN}51eyt=;tYEf1&^`Oi3N9+vODLZAHtd;kp5G znBt9B82ot*E8RXG1Rt%Gx72eu0DmEAtLZ<~{`BhP5L74r$GZ}4d@l?zp>(HAVpj}m zK*4jCbZ3C%Xy5_Mb2R;vWeIjQF*B|$?lM^%63vs3#!3uD+uPK1I==BvAmIekDD^0; z37$Lp*YM>>^LbsKG|VN3$ylZ+dvie3#c*7pGHiq$%o8v+DUzgKguH!SU58`f~6vM9&{s6i(E zp(A}kuWo!9BhCTl(Ef=6|M7!z{`f)bh*hwETMOvA2tOey%V-Pvn-qtt?s*uX#|wHD zgFZVIcGYj`?UG*k8G$pC8-8uLKRw}i^kmx%(q?UV1H*y4$oR!1dbkI)EX>)*rSFNA zr(_(6d`l*EF?Uzbui(w!a4QY3msR1s2tY{M+xDk>C~~xa=jVQ|Q}C|Q7dmfcE6a=O zyE%}nhz{HD-H%$=W>C&}cG(;4InMX&?1DIhXV_>s)LPD}=267kG`{o|AHwe*Vrxd# z;ru`L-ZCnVbZZ+<2*Cp+KyVENcMGl|1PB`3gN5L(4Ix+(+}+(8cXx;2(zv^OBX1FA z=A4=Hyx)2LervsJO=fl1DypmQ+IsD4?>oNIE+hVSb++Lo3=Nv4^^RW)W_6jOJ}{&; z+-1l=oNf2ZsrhQ?D3#{oEr!30ELblf*)?m7XeLx^8mf{c<1~8g)_zglp0r6W`?&?r z#@*og7yah(F*l$;#k-x^S_RrXETPIJEw7Z~(C4gJo5gNyDoMqy>+~6R_p6Iq)yo3e zy-xxv?3&D=_rxM^0>KHl;jS!KhPyRm>5HL2s`p4kfWzTD=tF<>>R)olh6=y|c)qkY ze+lP99{&BA$HHrs;vA7uhNs7n*;EZzVIhQO0?&1O9t}5$ad_dZY+LiLK9k4NdiP>f zPg1z>Hs|WA(HSS>Y55&3-@KkVVEueF7XS$o2zN-bjxp|ehofQFVnzx3vzn5?Aj$x% zJ1-6VypI;agstlJ4XCnpg(%{kUT+#Q|F1p%4_r}aczF>vvgpD(Kj0$`@pY355!ZMDNA>uQb2EAC_2?i}g*)sc|9-kcQD--Y$x_4whlVDIaDZ9Wsg zZvi_gI;;$A;^S{(jVXCNA4APA@j)Y^SMF~zBwRPh#2q&ESl#_>-ntQZwOa?-0 zJVB82Tqm*s%*^#Jr`aH;I5)|%;w(J|VM?RM?=$~`Wd5{V|2XoQ85X8oh(2>OVEz|) zYWD`yWADWx-e}c;hE{cRJ*4s(GILyCj>;l3gVM{-^#ngj<^#2rl7mg-LKrQR5QWsL zD&i}wLgqRIs2Z-;9gfUum8G|>gRkwbM)nrqAU-Zqubv=r$Blhm&FNVJ`&!o{bt~-& zr$rpTY|rcN-NeJxJ*HK9@1&$&57o%U$n9QTsN=5WeqSC1yM~mR6WhE-_ZLUzE@Ku$g5UrCaNFB zBwARit~vuT>!RPj|GJj;g6xYHm|up~#=~X3eVloZdr#SGH9J0aLTEF)R?16ZmZBeJ z!Myz0SEI>O=Au}dB>8uY;6GoXN8~+RCbqMm>OYfQjc@WsG3YWV7 zi=Gl+)Ijz1xJBWwL#2;qC+!wt4V^bRjK7NIUy9)dZj38ZWt+0dsBUo?=m=r28+sP% zHMHy4V5JJGXtmIwmz+g$5flerBHmT%gz`2Vv?ky9RB@?VhmRRP zpa-`t_IM{Eh_%l7T|q2_xgEF7?!VsrOVQsqzf+T7?;TBDl4>91@}W-~Cr3~f>xXIf zlwN_#OzuKddabLfSFXrgvvNlBGTOK=6{=y}>pLP|XFZ@VdOt_L4CN6RC8%YjLsM_` zIwX&3Vta?^EjN)&`V)Jww%p8|yY(b~TpX`a?0pW!6w+=D9RgBkpW4wRg=Fyon?8?? znRPASVP^IpNWz@h=3!q01nuoB=&Po@0oe9VJiVH&%5HnSKZ9BbG6dFKR=tI%f8)br z#YoS<5UBfu?k5m9ZX#X;xyLo|)91kfCB9Iq^QdcA3k$l#Q4?chWBHGmGjTF?qm{|Y zR!M{Sxe1$_o1s+8^`bdOVq!iEQ9$~%u3%`G349u^*xfUBSgHrBs;VApz16;Xv8ojt z7Pg#cQwPvwh^K3{c*{sbqC1{2j+0j02Zo|^rL>Vx`$4L!-1E16D|`}E+B)B{RM5cS zxpckeSpzCn^?Db6;kNA~zwKYB1!}z=+L#V`x#uca(?@FZ)#EP-2(PgD?!j))~yKF4K*&*gfo zUcL6tt32fcH_uFkxh=5Cg_U~=74CDiJz3pn#`%bY`&QxC6(dyYFH!!2Apc>0{`J-4 z(LEkbVqEp868VF}z`S|%I`S5VJ}SR9`GiE&&L=)%qHjj#s$0|Bjfkt`&g@2s&(pni z5}T7a_oaDkY%DX@IJeiMS04A08zdO&nAt@8ws^l-?X9K|d~nQRL+HfeLj z+n{luJJ|IRBPu~g(If=oq##vIFY{Z~vevJ{+gN$Sf4n|)WzSmL?rj{4qlodgmd|?9 z$MA3U>VL1||J!FZ5)Z!EgqM>S9p)^UHpm3WgIv9ytMlimPk&`sfD&q3)%L@bxBTEu zniwbg&j924n(nd%8@4hPigh{+xjE_uEk^KE^up(5K`Rnyi{@PBLVRtA$BzlY49ZGo zmiyz7&!x(Q%mO<287C}9J4=Iox$`f~If!F9hp@-z<=nM(qG=21pgpW>v!&YSyS?%+ zzZF$^P>DddbgEIvgY~n$R`_I?zgIR{N)>Z+L2UwOrT1O&1H#mtg1dX>tz{?wp}I6pVcN= z0tMl+?61|DhI8mVX=SqHUxX~aJf5+*HA~PQ)VH@9OzY3B2!@`|RDvLePcOOYvCvEe zx^_Y_CwN`7kkrB!Obl=@`<7(-Gc6DuQl$;n7Frk@K+?2=Wj0#v67#?YH>>+x^D{;q zPa1&PPxY`k?k&f(PX}xCHA}vhm2&P zPE<5f6E8}3V*S^piF^;h+W6J;v_PiTN6FdsJ#~&nklIH{$t-*#(w#oS&Lv#H@@A5O z^{9JHx7*$z$?C{mfIm;&qr~mzvVf(*wCZGVKb>ys%PQp5#$YLTKjP?fRAELGcerHq z$o|n>XZJG!zQS`6>QhL!Lzf(dNP3~Qhgt@vr)(_!Nzr$<7@~2vq8W~3tWxUx7?oe^ zIP9cvH(4{~Hh)Gp_VU;@M1xk=nLj%pHX!x*hc_{`L+-JDdPzy&dozk8+P8R^E@DU{ zr3O;IDTWF?r9WYnLNg1nrJQ7aX#Kk7%%Dy+ST_?pocc>W`v#&A{x8zawjPpW7MQHB zHoJ33zDNgpGdpT!R_-Uzyy0MuWePlt}?rsv~(m1>Mzs4DD*2 z0bDD;_9nu9?D~54b)H@sI?YLBklz;NQl08^l$5i=sQ)C>%+GTO0E#g*4zma_4 zrPCnFYLv=K7Vd$DS}T~`#u}PG4WB4RT~Tb9S62|Oul_M1CEf zHeJ#fMFk}9@>&OUxm8kFoP(9LPkWwl!S&RJf+*vvql(RY>DVWU^7B*DEtrgha*#Vc zz$Y0p(lpNN6l^!CAuc30Vz#!Mw>lbGYv-42URB&)^{C#zXlKUH9=Q=2WR24Z{l6^J zU+Y+=17piM{XGE7N6%MEQG( z#8w&pXOF4P!zBl2eNooXZF>RCud8|%wQ~H4L_J^y!d!gf zx24xA1Dww0aO?^Mxz;Ew?=D-u=UuO@uv#&0^C?XmdR6p@f^IAK+hN*cJ~VBE>jxu2 z(Ki9*W@d>KxHKZ?<+xI~?u#y)4hq&|K8yNr=eUjktSu7#H zKzMC9M5Ky8KW~=QCNe*g6x16h-~ng8sH#1`TG>bK8dv&Tg#i_@*%f1jQJuj;9lpHJ^?^k+h zUaPO2K@O3r-eI%B@d-m*YmY0?(71Pri3(^8@8GfRu~hKI$cmccD~wb6WXHXD#_GOX zrc6;bepEm9?pcSA00SXi1=~)Ta%Q-PvGZ+{LPMPbrT5ZKZ>zatCsf)=M)h&3|0z4x zFm+zRNiSp64dhJe%P+yV*`*qNvls2tF#vdpl)?KUv}C8kI$ORalBP0Ctb#VG&{7*I zuj5;pY5%bC&F3ZE>P+X-{Mm-L&Z~ClRUY2?xpU-t0`>0;MTB@Ri`=*DAOa_|AKMA~ zBJ=c6$A7No^1X8)psDWBq|I=`i00P&aYDx!Ia-EUkS!zMN$xdqx;DFS`X`}|4IZd` zvH`6O_2%nMYV&20z#_K6&EzjDYYxkqUlU5pXVKL8Nf)!uymM1i7*!9wGD!!CqVz8WP1P(M*Io%Ml)5)jnBQM3p=Q)8E> z9c}XjnwOWCAmmJF9Gnz2IyQ#rW}cH@Hn_SKsGPJrJ*_rXtmmu!a&oT3zz;aP6=>mp zQ(;#mq?RQb7sVQ6Ic{d~iVjDw&~2*1O#K&`nL&GQ!q5pNo?e~}6NlDr@hS$UQaF#9 zU0!xJ!kfs1Dae5F&bz9K!@1F2+wr8|Ty%h+ms-6yy@yz}23H$2eqMv$5BjC_y5-v# z21wT=iJr00&Ce%?J|M?$g1?Y^YRe+egiWfxL$=~NLAQe2X>2}bAioxu#H^^8XSjNV zgl@XHsNlA1kiNnZp>(W0-3%$SqFA9!N@Q$4FUc$)1!H~qC8Jtq^VMU6=^mspeuat8 zG1CLBvIfq(XuvmR^_Y}_XN>&KJ^2>%oa7@NZswJQJSl++>d;@6dk$Ec^L@h|GuzQj z#(l#|hHusz3P4>LgT_>l*IITZWAl-7N`_^F-v7Ec)a_?Z{NCJ#bzAy*jkSq0uRT5^ z{0e2l`ywR*b4vcz32V^@lg0QHjpeg3Hdl(Nd%b3*iLX6A^qe>;;^#CCp^rOdWY9^0 z4L}tkdGi?Mdla2288PT2gq)JHci-)tCqZYr%=lD9`_kLzx)wkZSzw9$Uu0nFG9Y-Yb3R- zGwydc!!>p$vy8q(&e=PqgZvF-^#jHji}b@yVc+ezQba>72C4>3F#FAOnXO10RHL#&whA#`0Pl~ zsBg~1B(+**5dT#+kwaR6V?*+{3HP8>j25&N)KM1kgTsrP(-fpzJ4ed+>U0z8qyKXq zFG)DV{eeaZT37?^0(!VfH3I>&fu;~LH zsIXas)B^!=$4L)IS6B=vw0}=*y7%ni&(1fv1ewt`%viNUcns@v*QBMe``R}mi!-3P z)kx>OuC?d)LuHzh1V4NTaJ|~hDzV*^Z}cFAQ+L1F)-FFnL3*kOa)6jsZo-SB&{nSh47%Tz5*;)i z_0S$|Yu~BCp%KvmQXf$V@EaZ@q1>sxYw(8WSb1g;6%s+K+=H#{N?JMRoabign~K2L z$y5Z|%E?-halZ}J-R-FSlIET5bVrUm%4SsWvtsxXl6wKP2fx< z7UIp4Ib1et8@}jaj9RiwLP%&IWe41j`#GKOfIW^q&ya~e!J`snN5ngd-vZKH7JAT* ztv$NiYBlt6*FRGrWwQLR*~+8hjlt>Gm{8E;x^T-%(8a-GXh_InU*_C)Ma|;%o1LOo z{kxmQ_^FZ zbcG*{unxR=m0N6CwfqE9MLTUp9Vmy8_};u~5f0QREHsHOmF7f*)PdR4Ub|N#8C1zw ze4E?N8vDP&3rkO)=cEBl3az&6_k3%Hyi>aPxhra|jr6MIug*!IzG z=kK8IYSrE@bbEzb>!kc2E9xCSXD?$SeLiR91j}4}e>$-gA5UQVg?S%g3(C;e!8W}v z%!{_vYU*00&tE2Jfd9={BvEE)jSE!b=!_SCr2`nPBvJk1TJ~vLBbqoY2rnfjXxqqdLzJDzEK=0c8I6 zjPnw(pSF<|_GAJG`A}1*&4gzc7L7M&BfGYSh#lJ#g%f6?ppoI>vWT>T263aS)vr%b zg8}7`+^gN^zgg00`~I9;y-rkA&B(o@=00kmu~>dW>!laSC05ygjl7P-)LCN8gW2+o z9+227?^NvdHBU5tDn}t0=9_QJeIRK)fxss!B{dMdo%o7VE4?y|)3p06Ly#B!`&x}j zt>zjO<4@bmbsg~)7an(mgq=kkPqN-}vH4w5P0_sl_P9k(5y@V@Mzig9F~ z;v)On#7}o<4h2d!qkTieIMn!dh@4IuJ>4M;aRL-nwH7^rNO+fO@P!Ahet@-g)TD7Y+Tr6+YdKLXqFWxLCj2r6QC7mq$o(jDmeUr#h>0r5069Fcv1&8lg|7O`PG?I z0HT8b>EKG95Etk7fj%X%x|L7b?A{=McfsV>Z+bUdG}=HSA~(iF2t1Yw}OCfR#^cU%lRiBy)sqgUiip$ z;T{Xk@Di`rv5mx35tP{-tvnf>4>R(u3Ot)%=jR_#00n8vh9VJHD)JD@wkqBs{D5n; zU9XlW;E#)_E3Ie(qev1cD?`$w6L|?2+}D9Td%w^gf2O57G2In~{xYolT(mmY^ zEdhs0+o~PQdL`r?l17E&7&f9*V_!V80>I_ZsrWJ`;okn^rbwr?cyVXY(b%ZyR&=&C zLbmg3!LANEvPT{+LO5h2j&sgY#3IgZ2p{b3c;K?&0bhnybo@rNOlRFzp<-kV*8DzP z7YuujU^jbOqqO9PWb&kLp$%C=WuATQhGN<(;IW^*4jud;61t6cad~0Ga;&VBnVv`; zN*mw47lt&G;&^YS;TL>}@DJ}pihLGJg1VbCNDVlkoo#fI@FzU}$mbwj2=nv3H&lQv zeAF^amM_I@&-}tdYOw;ttj#w_7KcH*L8F$)Y-gD*w)oZqo+w+h@st1ebrSz`(&p%v z*na!IxLbq@l=U~|84g4ilNO1J@ls}XC4|Qn*Jipv;H!>T$YjKquxxpZvTK^;l=*YT zRk&Jfa93<|1FWvVTj|SvK5J)dzC48$Z~3h09Syn${DY{O1mfoVhJFrG(0k0I--X^t zX1b4n-aMMa-)WrflB4~W0RN5FK?oZi>*A?#PdK%+g&s@58W-Ov^YYl>sqR)&o8pTD zazTm|%GeEi0@adAjVYt}+g-&;_8O_^Tsef5%!;GaXEUG<&-B+BUEK*{-K|g!s=}Ze zC4M|mTAj}i2*Zop+OB5ElAH)FvW9f9Xof{C-?q_E<_^8@ z1_kbRXr}=gbACRq;#k$v%C55D{q=d-NEtjD%LQpbK+OA*Xvs30!uqq}@z^3bQP4qZ z|99m^saxw3rIRItnVhUd8f~}BjQ6Qghm!+3H=D|rOq_LrkJTXo)Zlw6a?s+VJS_2~NGYY>>`zx9UwD9vMm=tiW);Vn7xeefgdjRHT zf#$1NwA5em9aVc`JYWy}kLlj>+u;h*L*ri3D-~yB4jLFgbIeRH4m*iWEM683wD5kp zXcnFmS73UI51D)!NgjQNr^FN;HBF`UK@&gLIJ=mqr<^(9EV_71V8%+eY+1hS@$vUp z^)}`*ULvM;xr0`C^a?7^T6=q@jFRZr6J5ZGBHZ!oRO&bQanv1Q(YGlU^9|0@EWA-% z?Mjq=#fCg<37d7}t-4<%{hVQGNAB%g<*EfTvYq+luosevzsbiksl&&*`AHCw1Sp4_ zV~0v6@4DelI`?YPB1-nnD_x9mn8;pyK!Hl zk%t@`=wYbp{0f881CK&h%x0dzLCl|s*75WIH zbL%M@V>h^Z4Ug;Y`q%&rBh&r4E7e7De& zlfRotWNPVARmFO5D}1_g)CIV>uq)LN~alI6}sO@(z1&M;ALPX?`ulNuWE0Y&|C6x)@0j_Y{CO$PGgdcmU)u1ou$2m-uv@Tf0mF<}^UFJ}tOiCbb zp&J-Y;ry`4>_yRY@$#oEz=W*drJ7je$H$gItGGt-q=Wp>e0%(#&DgKueRbSwXbbD) zYtO%$;33Q?qTsQK4+g=}w)inNsQ4}uV`5x{67`^XElZZ06xJ&Vur2pGyAr~gQ1wAP ze)KRGK04#fjJ99$xXDfn999YfDu?_gJY|n}+dNq{%&QS5MJ6WPKVg z*W$SOXF7$Mgt+rX4~0n+r*Wm-xt-#cn{W-s4}W3q;51ECR#e2D1XL4nn#bR=V4*oU zes90_1f=RddoFYw5sO!r?GiaCL4wGdihTPmQkq=1_vJi~Hzep=K;%Wd#Q%-CiSK-7 z+2k?*WK(^4%0AIu)EvjEUP?a@}8={C|cdilQk zEoW8hi=MOykI1!I|v#!UMrF^U#aF=!Uk(qs#;H&{&DQ=@^RSW-hBn6_# zlmQUFLcHVxw%@wF!h~g@LTg{Thop46XB1ggc)Kq+Iu7kqqOR%9j$L2$wV9-XVVP7y zWaC9J9K><$n{Y+SymxesPfgTxB62gPLe`8MbQkXlFU>O|UX?=5mm`3svJ8yz;XXI( zgl!dX^7{=B*WTpj;9Pvu&AJ*J+Y9EBRO$_GSk>Bm7{o#jbOmJ&sF3mX`cbgczYQHr zo<=Eh)I{4MXYvq!>}eXekRcDSrjy2!=@WTSv?o3VTWC1x2xz4@6Oyg%FoTw)CsZKO z>Q7enm@F^~?U(Wdv)a>n=<^TMD$RE}u~U?__R0c^0~%m$>WYef6lnKh#|`)rIZQj6 z7-iquP6))C6}pv{^Tl7|k)dAo*3p@LzYc!KTTz-a-Qg;pTzx;OVAGjp)Q&UOMOaV6 zL1Y%*%wWka$m-dQy~~dRP(@wcFr>wkIl$g@Ly=Pb1_(*Ky+3`y7fHFrad}#+4Eb%t z>t_H#0A936`Cy)O#Z~S0N;zSF)hI2aQB{Go)~Q40v06|hb-vw!)UxZGRpjFRl@d0; z6})T3?6D_k3`vAm=<%z}#zTdf?KdEh?}8|1|1D-PM$mySlTw3K{cT9?w}5Ag#6femuX8H-;mX#+M{a$O`zU z+{S>X!0QtGx6ZHck`yTcIIZ_qgQOYZU{&p#9ZsI)pG_+ZuYhIVpp)5D!OEfSFWx0=q5r=jH!iW%x%Kf|(3B-CwX2=YMti@7VW6 zE=idpqJLcGfBuU8>i%>DHot#NC;L}z|KEu#|6jMRLlI2=e%$hZ0K!FOfP(SH6f?zt z<81vdNRg8R*$hSrM8)`j_q>TfKgv+4p2Yv^Y;kemabN3K77zcm92_t*{FmtjHhs+Z zZLjlt_b_8dlopL%hkuA4Lyfp$f9xtG3V{}$&^DOBep2^`tm61z9UFkOBzvPTRMmRh zvc)}+n11abrgK1FmU#U23;l^r>q+hm+U_^yyucuanu7B3a_4HG#fa;C#^&kI7Pp(L z?yMv?8ih=$5CC^mVPR#(@bNR2Y55q9_3ymE&ylci_RJ$^d&C}^1cCZo8M$e5!eHhf zd_uu|L|)*M)&Q{9dpsym7NypAz1c zPiTcH$nYsi|gZ+u1XM zH?q?Fm->KTvp8W;VMzp?O&uMyqV-ZlX{6Es#IlQU|^ir_&)4)_e`}-`O>o<<}lQ;-=&lSa{#2S z2Q@#%MrbhSC;`Sk)FaUfi|^0XpALI%KRdP99L}&FQ&cwgo&(Z1D%k_Gsgk$%fXO|2 zwc5+rI0}`$!#A%IvbM2V1)g(4;w=?MKm-{b7NpEL4a?>3-2E=AbRNK*R{=06Z2s={ zTrEUZPL6cm4O(!E3wI9~qu{cL-p5(n%tiwQ#UiUp}zx;82qvrP(EZGCGNgi$7y{N&n?(P

F=kDt-jm4(EUc@xFY~8?V2t(d5R>w;~6@- zGxB^?fQpn9Xi(>tp?aqvFK>%;_qTT0`za-}1P--9i1$;A?-8c2VUOq$6WFSL&p^9Z zNOTMsPk6NPRlyuMllrkdWk0!@n^i{l!@Sm>2wD(?GT!o=?at&-CE=H+NK?CgqXvkuxAnv8OkRV4MNcYa3=iUk%g^ z`DBR09gf%fN9?@f2F2T`7W!s<45z@FJdLIm=Cd?_O-QR)iDNPNS#jXWveyhxJbHL_ zvYA$Z@31>f@jWgiBxN@36XhD67adUXsfB5mL{Pahn=BHFWYh*KQnn!!l93y4K4(22 z(JBp~7#0df{Z`^H_yd7r1qdZySwmF+7J;6Tw?;N&!Gpe;R-otyqpA}Ycw;|(JIedc-14dgb%I^}@ zv-|7gC$=C;spw?QBsTzyZ`hEf(Q-X(cZU9?1qUi58k^?37|$*$wYrm7ZQjxlv;emIrbX4AGa zfrA=y!SrtBJcA7Hp;z6-lHYIx$mIhmBO{QU(Je3dU^0A7UNJ$)DJU3Y;FU83sFy~O zmYYAS;eZXjT-QT>_+KJgNtc^J#$h)N0N*iy-_r-6`;DOJCsqJ#?o8CKvwB4#j~@{c zQDU_$w)rbXM37I%pjxLHrk;_92a*sDxwjF)mar}Oo%wQuSq6v`97@r@%Zxt()3O+{ zUd6*J?f+MkIuOX`&Jk83J39C)4TUllLnF)o6ksok1trv2pQc#UV|0%6^o$JSsN|F* zFZq(XncI-?nE77`@Zs*3l3y^&hVl|BE?%QB$RC!zmyq~*vN6$ynMXJA6KLG&)#+n;8n#b zSd`HJdA{R46_vN5FXm4jZF;K%6b3M^ss8r+f-nK^zAo=|==H|`(GHx<^<3OsIzU(b zU$O9S^#;DizVguQFP1a?$9#lGh-}or?Z#mWApfH^_x}=WP67sx>8wwc?0*$D{=bXg z`@8@6@Bb~!f368|O(sXCEPq&ay)9}X4KFV-2G#C@{sa(2{gpdR}{!^j1Z)JsH zKcdT_1izpV4UP;B79dN2E3l=Zdp1m0-FCaq8RRqrg3dvlEwpzmE_luR6E5azZT4bV zZG8Sz`>(LB5+so!Ot9@kcb8=veGhXzNK#-wLU!{n4Qmr+gZ=*;#X%mt1A9Rjw$l|u z`geg7L?T-dUjJ!8E+r(cqWHhd$3kG^@eoBuHNt-dqgOl8a=#VU&A2x)B*6&D1!8dl z?qC>*owB}T;-7cg6a~8kCB#T=urrqvI9*NqH1`in^;mpitw23@ABSio{+zIr<3(zk zYWs&Ij`Daecj`xZePs8cp6__rgiYG5gVzA5Ed)%w>C>AJ6L&!iw}{MYl8>xE{6N zBeA)(05SCd4tx<|Q+wgrP!k-}359W<=IK8OV}i-(;uj85++42e0;~Qlf=)ejlz(5= zuZ0Mo6Sn)_a=EtH%`^ABw5H!OL`g~=8XB4okQ_bTw%%(o_)+Jom})-rBHrl1m>v+r zFg?nAk3|#1k{*^H!zvy-nnQuBvtf5+cCg+r zV=w{i34zclG2SK9m`av(nA!(ynKXzg4#J`)H^9;-ibEXyOD)McJ<{Df)0MA`aZX28 z+${V4nw$CHP)JA+$i>!wvWKCwx2FsB@p|YUbo9qrBMYpK5AeqYE46%eBvlayAWaf- zO9&joD^mY&DZ09$5;rzJJi5mlqZh;Unn=$04?2zT3Fa_HYhMM_BlwPt_hBF;f+)<7 z5RYuiRUHz3v&e^FqA5i1(+Y_}@~gK*56KuTna4$!V3e3}9+SV=t{Ej8Jc!`CsEXn5 z8}`5yA@NBwy?9;PTa3OM1mT105j=NwjCfe5M#MIB8^myrY~0mkcLD9lhZ#Ffd>-jt zLcn>ZPJf+8E(XWV{sPYf*cir+%Z@{yL92nL(v84^TGAjVh!< zNj1NWU2aaxisNp;lF0nAm~)|6&Kk+bxPOQdi3)-s zSg1j0pc*OM1Kf4+Fg!|-1fwgF-BV4hr5;7}h6?`4C3We}!ySSV+TNkc!_}mA9zPuL zkRoBg1rXWncm3JZV)Hc_6C@~UenWz8XLLLdKmX)$7khp&G8a56=}ICX9zL*@4}aP$ zPD01_v0E?>yiWB*PP?aB$93zEd0k&gb;3MHpFTtTL#gFaJ*sS*am0iJ-r7YAJL&&n z`8;$el2_x~1wR*38YB}wb$EEHZ((00aldcLqr$C=7!^Dm+kw^S0fdm})!u_igQa|| z%)(R=B0DzET}t-Gsz~YKo~UEK@^G#1sYw`i)cm0k@E%nw8X6Oxo-ig4P;jt3VpW*U z9ysHpRzBzNXB0d@x1?AHeB_gyY3TWWlz?*K`*E`QIwu7Vi#al&WN1;c*4y{Tnm0*& zW%(uH2?ZnMtCo(_&eP3FOepf*`%aP~gm@kY>6i3sbQ6WzG8NzM&gb7xT};fsz;$At zI?@+=xJU8@ao`Fe2tkC1j*?O5?X~MFocG!bOXQ&Ko+f4U5_L444aE6pI%iEdY1T!-`SXEt*)T#g69yce=hjeiyWsJk?D zu`pbXC=yZ*1((M#H~SlDNe4&#uu_6F~F)E*ud!4JD=W8s)_l> zS7#_O@dDOyr8lD8nR=XGtY$Fww3PRBG>pZj!`A8ca(!ib%;cz(*!@eT(i;J@D;Wu0 zd}^oTwFuX(O8Z^zW~#wBPV=sElZo^}O3-SkJe^TrJjF7lR44$UO0?Y~#Jn*s@h3P; z$X8~CN5-Z}$87K)E>^&vDg+B5&J^23@oF_DO2u(&-d;K+jb_VzpibG;zdXV^x;fX= zzdFI~!LgT+h@>OUQOK%@dSwzx$6~(&8^dK1sV^@}Ozc!AJ8YPI+EN zJ?XvtMgw;zTvRQ%Ec(HB$tvxYE6W zVw(4+O&12gj@%%rw)-nc<$iD}&3vJ+8?7pf(Mu^bPE!D+;&1MXb*QzEBBaqO|Dw3+ zv$Re#iyRVibUbLI-`2IiQmNROH+09D?s({;ztGeSkZi3rXK$cqCIF2nf&z@Ufx4FxMXP&&k`x57m^n`g}Fq&C%AX^ogiWSVI_lf&?FuY-g zR04-)tP6FC&x( zggTOWL;k7}p8^@1Av8Oi>c)J*(1Ffw=^6<0NU{+Kc$~DX^%0|f70DtZA`S^C0IK&~ z*^JR3dEJ1d!KmTJzRDkuU5%vHVSnxwK$edLhLpY!B;e9t2Wwu%t@#!&pPtKfzc`l=Dg-=|HQ4oGwRk1Pmnghny`n4g zgL?Y+VP6KC^CUhO5FG%_1|8;oEKUU|xk6}ccA1hY)C+O5u7ix~6&mh?QB~(!^=9)a zY1aS@9{TzNUUi0TevRE1<5~1`e9aEI^_fzmpk5C9)gHy8v9BH_`iJskdzoQwH}G9n zW8;ysyG1;FBN8!th<5M~Pmiv|`7LpT=T@gAoK)?c_TZ=Igon3)@>bg5`Efw8BA-|D$K{5nK3G8$f|5AI=g z8*ewqlX77rulRsBma<5gR3tHqjir|_t1==-)k^eZT(fM4@pJDk5?y|7HkerI+(%3d zFy?m6CUTr<{rg+x_(M^JT0sryPVCODXHR;3R{5z`>9{Q#fNrt5z0X0}+}S5w@yg(w zR2TQ_AN+~XUS7g?xFIKp*xF}7i308(d<;th=huEixi%~{Qd97!PV6SX+-?AF^$@$s zSUK@T-n?v<#Q>r5#D{6|yo>q_yBWazcT)Ls1--e*L1l88Dz;e^)@K{8$n>}oxYHoy zb88WGsfoz@7(~Q<0>L?tEr~9R5Mry@cA2$P%MR;yS?im+;$Mwb)Mh>G2drneJqNMt zq+}u2n{X$4$t1?Sj?&%?02dyh0znme z2~$cA|0pUo{MP83BHB#RA>-`0N@JxJvF#g&8n5@r>c{=&W{snQ$g^TG z_AiW61Gt@z!f%w`X~J=5)p97&=cGV5(+zIwr@$il99S_pAUNmmwYFm<9}|d{IL&81 z?t2b(G~SkE=}wy~@A6K6!N|WZSQWh)`zl^(VAau~em4z)0*oUQ*wxlyRHOG6K7= zEE;!RKeQ0d&WC~S_Qp#wnQJOO52cn^x67-RZ775G0lR!+e-xx}Vn5t=SYmXJO0Ah2 z&L6lfkl(n$FgsQ`v9R&$mY%)UCKfCLo~hP9Sa=LGj$jGzH}w>}#7+Ce&~r~#YVD3& zS-YbT-k*h#?ZO1)|Gcd?l3}!zmNIAR8P4pNZ@S-%j9T8aj~q`H>(xkA1+oO-+y>x1 zbJd*TgST7xMxx7!Dsb0>I%zm79wts17au+=2ew$hP)fdk(Aco(p zgx@C$d*g@L`VghXozWQAVt>0LK99>80SMl<-t%SsP;6u#$YIl5$pnwI2{P~|V_kSZ zN2&ZL@5zGa(xkl}9N{-T9yHA<)vs=FeDH%XHFSoVwX}ZkTYK8#TgMeuXZhg!^1sUz ztr_=R0Q(TqfE;VfEas&LzqQeQw0UOTEr;4cN!;<9Y+~^O*p&6dgl6ro1o$Ei#rB+V z0W2`CNt{)BJ2?saHvUw#b#@b(k(W|WEJ$AKI8)s3<>0nDGlUsz+t2FM_>Oa`+$OK? zL>_q-%`e99^@`H`C%`!s0cCX-i^S?Sz)#-;l2)%sXFjDaBR>Y`FJa(ud``x~qjI#Q zMQR-bYHZ{g5urbxetMpo3a%UPZmyH^`t;`gyV+LTv;kxvoUlcQC&v|N4ct@RCxV(%TZl zei}4h*>SLAD^|>+R^C~fe6Fo(K{Q#CrUVyzGm}Rz3&w(2g^*{b-TKP%GrZokAU+1k zi0xz`<)ca~T2J)E<4P;_ic`u@2^VnZpDkuO^W86pDrwlZ4~Ivn-{&~r(SD2foB~`; zlt*w90v0Vlol`i}x=Ym7JnrCpKJJ8J9Ggxx*MIM8C!+1`xa-PuzDI~+9W;t2;!xE6 z&klCDEN$)ux>eg9(`^y7vzJ8QAZI`u)XyVfojXIJ#EA$$a|faRiz0Vq@>TpkO`stgx;Ok5o*0h4rQbHD z1dZAu)AO_hec*+ZI1gGH{t4>_R}d9HLNN1Q&!?j@7UuOLJ4Gc6KHpBFa^~9uPa-uL z&qFr;)yl{i=zV4tJOgA_dM_L%%xgnwnH7o%FV)~`ps1D;#Oi|diwn6yBdUA}2{z+K z0Uq)2WT;e?yY(59d=#hhSXIhS`!$J-8yB2xxDKyHv zH;O?oyo-QFHjZgZmT{pHxC=>p6ec9$&6e-7`QDEW5V!Y8n^daR3%ESc@$CN(dv6&O zXV>igVnKoj65Ktw2e;r3!98doxVu9V+$}f+cXxLgbO`S5?(kmZzMpN+e%`(7d^zXC zsiLNesiaub(`#M5x_|v|Dn`%FRRQcsG!*=5oD&ox{^E$$7_Qci4O_LPrVD!YChM{G zvWq7gH91%=68M z!yc5@;zmTaLPo~89c>siomu^1!h$e!B&3xq;U;1)^>B*cin%iDS&n87e zZ|_ALoWTc7`54*PvP_nou(FNj+eJmb5n!L$6{gzHBjh`u;2X|2-Z>jHrv|A~g4rqv zOR6eI?|V3gCZ_F~Jl2ZtQ&^57zKvO|d{%`q8Rq=7~pJ4{?yJ>Y4-VC0^(CF#<+v~}8@pwTTW7|$(bEuF>GKOR+sZDzHnWYEDY)ZaeS(QP4b?(| zhL+me$=zd#?3QyMiCS-zXglClsq=TLh1Us|6-o+acl~HbQ2BQ#4wv>atb1aQ1A^AB z7qU$yvSO@XF71JPjAsW`jQx=vA~onGa)+ASk`A3MKpM(&nAP=DvAWPPgJ$!`D$n~= z9;hCjM$S0M8iOt>pdZ`B?r4FFj};POb2v#kPc26Rz2$JWsxJRBV4-&!o&GtK&?RUj znJ*XAi598>A2c$vH~Uno?b13`SySy&q4KjzfFy^htI{yfxhABl>1=C!_cLa3)3(nm zr*ZVx{x;`ZAc@KO%?eERUIrI~YGxC}*1I{pEHDOobKd+EwShAo4Y8sA1|Z7lg9sJt zJK9lip~oCao;%e3+57|@maXHy^PI6cXYoR)G)dp2G?ehs-%hkq)9vC$Az9$E_((gA z$2si^lS!&U7*qr+yxAY6vm6w7RDs6VSv)JycM~*0wSIHli#$(EhiwZaO5Sz}CgLya z+hRr}0QsSZ(00%3IB=Tc-PNPEx1or<&r_g6l}Q+OZjXMynx4B(dY2M}e{4m$e0r;! zzKMqe0@Cm9YhEOOOFeJphB@yD0xnsl0WqwXmO z>Mziocdzbt3=4F&nQtE>1ai!nQ{-TE*u#=ZR(?A*S!~N{6wgzoduZ+hI?7=-db>)4 z($YFD$1>qNh*nSbD&S~yS0rZ;NoJ$>yjKS5`J+D6h-cXRbj96 z%aOi<4j8cFer=&GUSoN0-1Pt{lR*-wCQ0)4@CM6Yz=j0`0Fyp=SOFy z;YxxnFX!D(S}3U2FDFQ_DEL_s`{06-x|ghl4-AqoIS#`3K(J3Q@@o>zAfQuN$YkVa zsW|nDX59O@%}rJM8X?mJO|49OsubE`g^+p47?d@E`vX?D?yVaHjLUqNVq`O66ZX3| z+4Gq)9sT||7L)-&0aAK3ax0VaoHM2Mzhs{!BP!duoi#q?B_VtZUKxY{d{r^&Z2co& zr{ls6f}1L-SZ}Rz+YM|C99RYh5xZKSHX zldqEQ-8E>M!V`Q0@*T>zZ3V{&%EODfA>%37mI%;)x67a|O%3EHyS1DzeDpSy`0^1-xVxr3V3nrm(-i;a%c79TqGwR7!^@7=<|+vaC5WxJEV z%uuMwwDDJ4?(%1Xtu!=;2LF^jY{>PEu#EL(SirRjEMvXBOcl|7`}W0>f!28{MP8E$ zOop!@D-V+L(%%#lK$4Me+~!IrY*w|V?;ICyjil_dzji)cqCak))bK94I9gQpc2_CT zmc(W6yc>cuzWH|S;5PciYFs%u;=Ht*F?8;`SFBTl6w@0=bmaU18xq=VIM(eb@8M5E z06czt+esh@OsDeEHG`R#f7?{C3ze`&u)E0$x&ws#D!w*_h%&WAw< zdFdun*GEJ8_{8u!<`AHh%RF7!+tJH{V4?!m{nblX1sYDh49Cr;uuPxfEzioU%DcVZAlMfxXy=N-ahOlsEHLJ-q4(qZ4!7d6V{sR#aX%>%LgYfaXayfPi(Ex z4#B@ypcP1jB63Wl%STA&9l%+zX|z7cX!OQAh{~0)!s+&oZFfnd{wA5IoDuR~Y?RDUZ~-+$PoZYhy@o!@SzRSEXTqU=xFXl%^DS=!M~ zKw#mL`&0M~@iDP->VQgLeR$u|nRKZ&QyKxC!e|c&=A>bA!4p8FO7|`reU`%0 z(}6m~bHF!sQ~7-6IK4%Z&NLlvwNS1I+OV3tK(K6QaqR|z04c1?fTPV~9cQppllgW9 z3JaJ6;4t$ap62ZmxN!&f3+a9_l-AnDO;6i@3kj=w$UxPEyVhJMuYCZs)&IdXh*zY5 zT3WA%05!DeCGC7GwDzTO)1>X_o1v}Vs3otpqj+D0K|Zek>Sb&g}$+ucj9;?=1+2XpH$$At%3l%935JCkG@vw!L7 z>FutvTHN*jPT$7v`B&Ie_Y(F{?iVh~I4=D zQmqw?lV5h7Ae1D90uX_gAR6q;L#76fjRRM^J^7x`8h_UkzX?W>#`+3fe9-tKEN3H0 zJi8FqNC(OIHyRjNu|IvjI9rY*Elo*QY ztMOL>`zFAL$2mKbp9Y=vKQ<8jUEBP3Nc^vg*URe(4kRvuXHXi>U!}>vm+((G+28N` zSi_G=?BE>@|5bPY2U+lU8Su3S&lof#YT(^YVTEk3X#>f@GQ2 z^{i_DZr6XY=>Om3|Kue9ubN!Y?hU-;=x`#|KRJ<4ItJihAR@GofAAy!cQ;6*1biUx zJIlZGRsT0<01BXhuirv{KK&m&@h@|=Prmpgo8qtk-CDflfPE+6El5ZBPao^Q+a4~- zz}`rs9K86iYiVah_;_zzpiceIA7vR0uny-!67B!$FWiIze}P{F6#Bp0eVi|!7TJ00 zKaWlRSN7*811t|3V>SHeRsJ{coFKm(cwMOte{*>Mok9Nn6!ZbT9C)l3!+&7#|7xFq z@?{SZ!0^j9rltRCt^eu$71kFgK;mQlFVl7Z#o6)yDU(MInsVJs_9igsL~GSqN&b>a z`Wa8n!lKmK)kQ&0-o5L%KLDi8B~rN^5AuL~2W5@HK;$G-JgHj~}?47<8MdNw!h?$Dch-K%-cj<)%kQ+ZT;Vb|zgi z15YQ)(b;RtSJ;uKE^?)<$_MD4)%G{r@|%O>sY)4NC@q@fReOp1;m1IuxH*nLnkDJo3kAC8eKWen5Yi7AJ-+mGw(n+joTw0;e9Bwd@LL zkolL{6)Os&*&N)Xd=svUBu5j3`4Ge8Lm1zNc?p!9pOi4;|7yn~7KG1v4Jwd!BRh+g zm%?}4^BLu|3>W4f5Kw1rc?$@P7WKNlJlX~6pk_e$QL4yxgSjH}7a1}R>Z{JTXT}{q zxb_EST1bOz&{8^ar|AehMz)W$eusD0s=JSqDbMy=oZWq>r{z7Kr4tb#S3n@eddVRv zDDT`}l@b@;u;q#O4}g>m0lUv*!ASx~f|{yxUS~g3sxt}A+@e@|*%dV8Y&`h7R)XmM zriZhP%wlHu=GkIVY}udwsPFdX*Xn=^0u8DWr%^rCIp>#C5O7a!Z+h9j49giZo|C_1 zg)|sdf56})JY3FDKH9Fk@VE9Qwp4rejoyfv^1gvLhbmy*p15oxbe*8OY<3+n8GbFB z(m{3G7q?rZjBYD>IkXsAp#^>KS!h}IsJNOlg4Ft)ij^6q+a&mnaHhpJIJ|2WaC-p4#L*%cuh9m?mmo) zq4b&?%o_M+CA1myZly)RGBmVQyC$4Yz5X|1L6f}QLjaNSw6*t+#7yk{J*W*kV-vy% za?Umsh6B>>YLmm-Y@ERSdZr8fiw^ey~%Q(hoeP;G3)y$1u8+=FQZ zh~VX~h8M%xaTXH}B}AD*Lq|u?7d35w_GzyX<9wU?4=sS0`^}v)=*@J+ zlFQ@Y4?=b-spr9H=(d6l42@|!S@=p~)iZ!8#;@JidymBwc;{;)DsEbwkUIs{5o4T_;Yr0BdpePBUSEL@?*CUa0jfZ_Sk(Tl=nsI z^^jU|G>IN+OoZEI)l7PTiXfs7AuYG>*HdTI;TZg*QY=* z%eMFV#zBKU4U_@#P&?+SkGkZWZ~lTCOZJrwAWe;>3#`ZavjOggj8O_xi4=~K&|9y> zPi3kUTvgNlyp*zO??D3B)uVOZ&mEP<`y4pTU%w$e?Aa%Ac>WrGG;VEmIvF!?T_17Y zIK7J)T;Q7Ae7ct!nl~>;Zl!?IaZ-Y%+_&f(eh3hB86R#W$9iswET(95TiBu?_OyDw zc(WpjJ@txDlJ%%MAFyG$LXeEhrWhdrhVVlnaXqPm0knf;BUAUfJYFL zqe;buymLsGZ;f1Rx|X`ON(D~ZkKySbNG|uMr>~t3=M+iF7^Q;imL22Xf`E9QoXj_W z{_*Myi>Xwv_9HFro(GNEHlhhm;-KEsFu>A~0-3N_d@j2k$2UOMj`HS3pyZ`XP@~dl zT(pO@A@KF>wwo{<%5N}_l+`brXAOXL+ZYAs-Ii!KOyu2CId3t+5~eMRXIX!ot!l0J z_SZx;4#9M(tjifv>GoQh9o?NY-Pq6U%C*hzdzF1vX*~1`ne}>6O-lT^a+$c` z?3Cs5+Oe*Ay0oNNuTAkCgJvOEt>Hbpg=&IZ#B>E!i|Mfdi~E%}m)%A_@3{l(z3T?6 z{>sctne~Fp4Q|TSvC>@i}a3YsDho#bHD^FXs)wJ*kW)p>fut(8DhhF>< zAAhtez22B51ot~uqkdwb*C{WS+O}+z%GoNVsnh#umI}MZc4J4eAy1w8%e|(>fX6*_ zk7jLNGH2Yh1(-%;@jM!+s<}TUwy2itL%KFhheXpRSf;YMQ%s?R#^Z53P%L}!38w4T zehqBCGPiIK-WTU{?_Wnw|8%)WDjq>N!}`h;^fQZx1HhrE@l@`ZzB+p3rG6^VR%8`g z00vN5a0oR;;9!FI?qfd{-jtWF?+@C%&NfJy7gJNVb$FNXUPZXCr(raeTOx)k4c&nd ztGUU?NbPu+$GVNiV!8?YfCSq}zg&O}909XN3Sqd?TiP~MlAm&wPo+i_Gl};ca|T@~ zy|t!sxSe{4t)X)swa4N<$~e)ifl;7ykAAznptpG~peoI6{NN9XQt3WZ%I8;Gs|Gr1 zWJTW16sc0L$WjtttTNhtJ&?qj7Z4oW6zh4uMITvY4kj_8=p3^alNcur%(Y#Iy{k`W zIb%0h*Q=Y1@%~8(^uB8luP3uxX4P>=Z??r1c_pm%9FLz7o_Rm{iLz+pz)QzBtM%>O zjB5EgFfkd0MUSWysYU}ivR*ICr7}e0#XDq8Fl^;P4pMb9=7KCUj8b48*s;ayG`ut# zKd#NL(}Y|mfvP?%VCq!?B4yvQvd6hZ0)J}!W*8nn1At;WxoQDr|M{{^BK?7hO%@{s zfqSkh|6^1nlvFl@YNHXiZLQtXrZb7}?jieTW3%aBpZtzk`xBY#pO=uate_JFU0RzP zPofIbd9b^77n>Yw>|&|WL#IQkdDgBCifn2k2ZiT3LxgLR<*$b_j`H%ljj@Wd9f)KoHZonsw22}X(qCGlKhuKuh!QyI+h0y(zgc<2S4CsBAp!aI7Ahx zl??(~s<|rrwbAcY5|4hrkdql?7?9T*Ltwp;EB_RQP+qp%F2UJy13u&5JnzeDEg2KD zjgKp z)hYZW>CQeT6uNEVIQ}E#`Kd{7Fuq}#u*`>LLwJ`b!{iq!CZn!Qi{Ui6Wis2*ZMAj=QfKWk53W^I#e_tgx~@HnJ^!slL%=fTZ%qcw#@6TJ|l@ly+aEP=bH$|3y25^aaY#PZ#8C+x3`VL_9RB#A^YdLJ)}^}N=)k@^<9f4Eu4X~!Mhkwq!6=O2$V*@gd>;Ap^W-a;^K~0&|tgPP1BhEx%$jU9~LIX;)cN| z7_uHGmDe?Sp$L|AT+nRCW*-E@vOQE5;;eXS>Q4Gmr<&d|CffAK)h|15B4ae6(y>)P z-q(vYrrdVD_wLvcP*bf0gnA3K8!GwvoemO_0I3^1yuk!UM#kn7zZ^MByn>wq0UPUF z|5+;_nm=>jDD`v+ng9XB0q(!kG5ZC2jheISJ&G3 z+@GQVaE`XEOp`8&B~ZExkjI5Y=ct8K$s^^zk)4%!lP!iaT}6zBwU7OEu36=MQM0K` zdQRB)olgP2cE3*)@8Wx;szU_DB?Uv7=C*GbvX%bL1|t-!}F;9u1A)P+_nYkXms3MG2r6 zlGaQ++ac3a7Bd#_nvg=jeH%Lfo}>8Hpmri!C%0=to#I$-d(d*)cb=9}z-(>`+tN6X zxxVDkh88#B)|M@ND0 z*n+9nen1NU`D^Mc`;kHq?vP;nZx+Z~y8B%62O_sMuzem(N_e)~(*thS!dE4i=MHn! z!3E;N>RtMKVU^en9b1HFKtDaJN(|6cU&8(NxtyqLBp)HA?rR+Q-ArVn!8f^&!)(8s zu9vZ^+N88hLX+-OEmvVN3BsAsNZWs-CK#4NnVfaV;zFfCgK7Oz#(%sW9GWnuH3pu9 zMga9NS8v80tx!9WdpxW!f=fy4jV)#|RctD^J1XT+&m9zk#fV^{p6C-5tnN=j7M+x4w9-uO<5Z0MkFERn9uP{5`v41tR6!CW-ypi0!z zqAI#I4_dPE!TZvz1}<0Qqgv+%yYc59+@~P1Ey(hOY^RLb96lg;N*A8sUuns@U18`h z`Fea0uN^Q`4&TR;b5rpm&y`Z;r*4Xhkd&O9zZOe<2GPiS#ANV;xm_FSIw*?_h(CTP zo>L6i)~W_;Jp}tQ@5adpwYR5P@ww5|4IesCX`OG$@0^357Y6u|A`29=lZ!Q)bO&a< zH!H*~_OF~*tVLKyk;bb{3im9*UPTykZl=|Ls8`p;P`CmP7Ci%a{( zi{G6+k3|Mzc>iS=S9baEA{a#QN%~j4_|*X5ga$;`g|(W;#|EDu}1`wNMUqF!?BoNRb%@r$}R{l!~Q_xb=Zj%lO@Y^Uaps^ z3){k)&cO*B@ZV~M#3Fea@+plM+A~Q+=iha zyMR4I!F+e+m6(Q%4vWdKnUiPZh(boF_79s@2E5W9&URu$B-1>(R8;~7XOkg~N$N;} zHo|f1Q3DffBms3YG%LYj()D^PB*EXD-r_ea;vU0dOpsOR1`wUgfxBZpRb3enrjS-c z#kLhLu7JkP#`Ut=(6^}NA%z;G+N{k&Nw3uG+Nyzi{KI-R@PJT~*HpPSadLtq*W48}UJv{;Y86F?4Meg3Wdy(AW z%kStvFd4{WsKTQ}f>DYbVXVnJ%cqDp`P~M8G~|zg6A+8wSiAi)+{?d)eMZxUJow2 zvsHPzb%do0<6;b2wK9%xu)u^SO#0<&Wx9j3A4OZ@9|6sgf>th;K>)io2Kt8lE)Q@d zh{q5VurMJqyKYOl@N0QX5}+wb0Z zyX-FG>De-(nAs5U>xZQbqT;p4ZDK7}`R0t;TPbNS3xT~o#_V77L&j$uX&;-^a(E8!b`jeXA;@x)8J+@ipMhSl zLW+qNQn}0^-`^I#3M3=W6)w8~gfP2F?up~rj(k!P#EiM%29Z2gFeg){*kvL2;<4Cc z29HeJr_vD_>XLsEu zS~Qg-%UYyB#__92RQA&=GxR5nS!`bx#WMF1kX1Jvp=z=ALumD#k$>dpUfMr2Jiq?F zy?@xOoohX~vTr&5j)I)dQoZ#1ih{RTqrgT`5Nu z$nmyvXPrO&3r^}J3nFOaZNfp3YE5N)%C`tP&iacdV?rdK*=k#~ZJYpPTb&w78X6J&Q*qWtgUS z4M7SM4*}cc5gy}#$RzVcmAWClrlCh1>c*;z*dGX_C4uP^#vOjIUO+`IuZMcggvl*P zXk7#}Qc}_j8P#eGc-Po@mz_u?NirL&p)aX|wJcmQ@o2|#Zy@*lre4KdKvArZ05|Kg z#_|EX!Kw6EFEu4^P@=sFVk$nQey#_O?Y)g_LjJnPBcGgB(`x~QVE4p^*A8b|x?TmXo@ZobtR6f4uoz;>n zOQ%RcwVqaET`B>;c2mbGoT|AA`l?YSwb+-uvtzS;YPL8hXB|k(JiNzZYcZ8i=_#5d60ia0_~U8ti{l!%qTM2w?H`@d!f2BLx_yBCrH*&bjycrP{?@ z5VzlE8>#5){qTZEb5Dxl43}yvdOneg9%)O5)Cz_vE$f!jW5HmrsEpSZ|eR0 z<5oqoB}-Ppr#p)(Oce{9U*uTHHg$J^5Vh1KRr+KolQ8DKDG4w~BE8aPT*0uj(l{`~>ZiF;PS+%J+*sW<0I9^B|D=j^=M0!H(1hT?T2g zqLMiN3IOd$g|jUEX#9yk>%xZ0D;~rH!}1pNezUER;ofV3-t?)m#hPnyJHC@~fwumg znhnQ%<#R&1c|w*Wk!7)U@I!%a$q&8)SShE^`okFVY}M&iN8J?nO!aW7_Nejhg3Cb~ z$Jht{H7>F)PYrn+UApOJv)}D+U~M>fT4iSMU-?HdF~K`_IE%HF1xXw>BG(Liwj9#> z2}!`$KgaO%Z6Z=c7^nvf6BTaMA^6e(cY+aRnY*il*(z>yI)T%*5XQY(-$YmIRGlzq zWP%YU>g0}h^#j<5>smj6NWL3qdaq;?H@-#z`ln1gdn^Sr>ya$(K*cMn*l~wZo*@id zG^+w%1WJ9TgeLv9rRFawH4*FeN45!sY0PPPRZin>=>w?qIUA<3la0s2>)$Tj><*Q& zau^b|k2RIfJ0NuX9gyt&e68zoU3g6{PCmr+_$U>J09;_O6C*SDv`|!KXITv?QdpPVk0$o?47f!&3Y6aS zy7I{&6Mk$T7PG)9zNZx6b>DYR<~sgf($;UZ=P`Aw-2(Du_#+ljUAJ^&_@5A|0f8_g z))*$zsX{bCMPIZ|2{-v*Y4b-+_#l}i7A{$CC0XRYMlFPD_{=F^YG|h2*T}{x-5fvO0K)T3YGD?Rtw1>sC)0Fy#vC;HZ8@g3U*;ykLRW&kZaATP(j8dsJUwx}1+B(Y1KWQFO)GnMxc^*ylKCZ6f z7!FwN^Cc4e)@`5>-OfOu<}qrjS>&84M^>H1F=IgkbrNl?00iWvj8L&8eAi+ykry=p zs7|^OU!)(-*U`>gH#nwDDL>>giS4T$ zbyFq`iMwWs!#Y8|p6dWw&bzB`{7XW7Btwe>=jU4TL-A?*Gt`gHaNBAFKN`*r(t-;t0{-%Ab(V;22S0&V*&oXCKoD!R$)&?sk?na_x7+(Bw zP1yZbLyn~>9e+_u9+oOXVoU8~V*`PubZmu9fG^TLl zEoOupTHkfaxZN_{^_bAZUv1vuhe>`jG}++lb&l_C^+cbeH*4wJ z+tYZB_>Lj!eH?8saGg%QVRAW|-5Ly>$C~Rm=H{qizYpK+s31eFSNC_H>LV;!r*j)i zx1UDX>_L8BD867s>%)~JPdH<63x_VN|8*I@_r5pP=~$O*xw5+`0jrG!}7{t zj&Aq!iLFyalYKwxCR;PXdh)|C2OArmYR75TC;2BU1h(aO?3+b^w`|Ms&)q5w>v!bV7-Q5Gu^a%^k2te!r! z1Euk8ZVbej>l_?7F`_aN1JHviAjJFC#49ua!`0?|LDAFHuB<4ff9;Ip%^0w*Gf{vq zCSEyaVPc}Lj9nr}%U$p#%gLmow*G7~N4|mqupw?}JYeOI?a4p3LFw1}gEGM2>c5Z^ zVhXf+bl3O9MXt2(k1m^`DnHY)0jwklL0>g+TF~ruED(KGSuA&o=5i(!>T8*bkNhd{ z68jnvugJ47;S}OwY8VZs%g?N5omsv8x_VK%*eJy%6$@WmSiw&oxrPw%%LR%MrW_DP zPStF%+vH6w+|POa_I(bc*vF6c;g~sUNc+SkghhYUaD+tK9rA;6N6^?D&rC#1#nUcK z&UB^k=L+Db9<)yLKBPoh;>4E zYytDL#&S60m-nsV(K^+vAM}*urIi^F7y4o2!y6 zJhA!Th&?nc--`xIXy4K_i6xCqP6pi>QE7rS%2LuZ?mv`(;2Q*dZU>1xeM&lVX09bd zR48C6wQJYiWE_7DDOy7qlSp)NVmM}FMQCB49~s7{)2=TcV#&!t3=)?rWZnPIcoG5? zTJ(vQ3mihX5U~!SA$ju~aT$aTC_Gx`UQn{xiX)_!#}Ua!vL zTP(-%TG)&}R(-!0A6pRw7$P|0v=76{>_u`xRg1hrtVe8SfYJoI;R~4LBY-B6URKS} zyGh0q)AB(r{Aj}U7s#4cq!No5o)ziSOuoAEWY$|pKs?wMI+nxV%>i_cEo&v+NIg}UE=5mq9S!FN>*oL2c#aXNq z$a3~}q5~iUkb($vOrwfU@Tmi<%PeU!asK(xdI0tQbpKVI<>fbG$YTs(7<{~TlM}tF z*az=bKg&lhd-OY!i;or=OJ=zpo`3$8uOO))4z`4Ri17$^f4IjC1?4+yv5aM|T- z^hb$gWo6}P)|lVbdED9o_3`gUqdzr>nda-P%dQ`D7wF&+a@e5MO0}adb|ghyi%?dIkz>oJ_@jBIS5biHmjv2%eUPbEIThx!sQuFaAT zpW|y{xbxG4Yk^u>+Ek&6^s;mdGb~30egM|UL6k$Hgbi8-12#S=s^*08#W0t=>bP%C zOrfT3A8vPHoMsTceX{`|LJcxa=S_SY-%UV0H#M#`so~F)p|e15Am^34^+J87W5>0? zPKoKa>$@H0druJWyb}M>dBe{Sr|EoN<%bHeu=5zko)Yc$FHffMTq@<)+Bn#gh#_&` zm$4D>IIZXaQJsW9M65vofXlVp9JJe;qLEBsNCl)s6cf1Q(|Gr~Rsw1s7Ov4D8wq8- zPNLjF16%wS#;%ik7uG{m`x}1T2|r0J=c-w@?hTY$G~+ggRq?|ApHePTuHSz&G5}&q z@$rl;#5=!@P6&NBX;lXz%Yp~QTip6jtl?<0&)(z>pH@JNR_tPgZS+YRz8W;RzINaB z>(EiZN6{fS4L@MH?6XxWF*p8lKA2*+t7L;KPYvC2%@6x|a7IoPMjMFH7jbNiuf%-i z4}X({a63g;yrmsL-K$ea_UhuY4#*u+?Jq~qK9F?YpVQE6d&qkHox+1Xwu;c84Kz*B z02RD5+{%TN9$9cT4KzkD9=BeRYDo^TDVg8+90kw%0>z+;bO9hsv*3BXc=tg%p3V&q z9bKqpT(19`XZPIb#GHiXZ4IAunaP^z_m}(R4rAGd?dGctoqIVq{RsdK(|K3)A4#1Z zoR#|3hg-zPHq`q>(V6WSMx*PamWdWEQ$XYXUOLrc04z0K5#3 z%A-1yM6%cjQB(upxo6Q)h9TiJ7p)|Ftj%>|*H`Qx+tKd*;@caT?%TNNea?CC*^6#) zQN4FHwen2+recN+|<^;_;5t7Xd+5=EXWZ00) zz*YL*{rPdn)=#V@ywP-E;%zjmsT=|-DpvjRPiFgYeGYXXNw%@6$|zN;&1JmQ{K`&c zgxdp1k?8!)Tn>%Q5`8Vb-iv%;D`31~F;(8`M8JL9_hs*C#QdX+&=+v^_a$zy!Diud zE+BP8F8wZLe)Sgd-GGfTF`dSlE@i-%cD|gfd22md-ZP7 zorMB_HrF*A-^}abq^e2)OFHXHM31IXt|tzoQTA3kUbcJuX-JOw5$=f+8dH4 z+p*IW1AAT3p|;cRvHe}@#wFfN3)m`!MXOE~$MmzARG2 zyELAvH!SXFu5?pLC9B3`KiPEb&qs}c+RHa@aI-d@!*HizShq~y-?~eAMmQdyMiBxR z&mmQcbbAS3sN2mUFaI2|u)@K|wf7zNZb}0)!0EF0uv!33b`xc?)a*=?J=`@ovQF}4 zx-u|rJYm5OXY=9KyNx=6G@@}6gBlBvBfHKa#t;w1CIM!vCF7Di45Tp`DHVR=V1LJr zd&S%}Fem3GZOs;F^Yu7VV9>9P(Hn)DbI|OjC$D&%)6%YAX8{l8jF{X)J$l3Ar<=iC zVs3-erDpV5NYY#?nRgW93)!>eO6%E{z~ISU62WeDQy+>aFl+4l`du~hmLSXpo?rwX zOTJ$5%?_=4la;?rGLvSdNy}uJ?Tn6VPIpU>qsIj^@9e`XK7BSrvFDxa?<(l1=_lei zW_Q>+mmRCTt+%qgsAQ*Rc1vJImiO{52~!!rs^Cy}?3U}(%Dtq!(5^|aQx%AARs@vO z00MSz!9LEtyIyP7WTB?+De@|Ub4_{nn7NbkhY!D)wq%`g^KZ|SA z0g;3cpdK&WJmlX)lOVBX_k||tZ8JvC=zgK#aXthy5P7HZse}zP5VM+&MCGNK7tS1Y z<+oS|dr}F=rsq%U)|-82`>HPQ%+$_jq`BFN(TDhsE=p~_HX;3&Y$VcNm*-9Y_?!fM zAjFYi6jf+|4aqHl!_4ilZUvuKx}4g5nJF##y4a{QN2~V5{u2&955t)2?U+C6hY~!w zHE2fC&Z|@7Ck7d#2l^H0`+oG4l)}$FKX#8?zI;_{QU0277*`EO{E7j`#I%FvyhtW5{w)--whLNL;<|`v9*3E@H zzgPTRM-RRzEul1U?{+a90taGNKE8@}-V(y=Lf zGE6e+kJLq;!!Ct`Z<+X&`vN_3JMB?A?oCaJ3G4M658n{+ues;RK%J5UQfO&&0I_`8 z-mSQI3`Y<#hS>J}NdfxPHlO8ZJMxz8t zcxPiYRm+juRMiU3sYpZWm2p=P@&pi~x+Ku^1GI8Zz~^1FSf->EUawyyY}=`p72&YL zK(QzXDA3&zs_k+&31n_pnu1ELeNU&7BNXFHw%;VzR^6z=?$BL1+)1DcSn!Vy`r2#N z{x-?hC-PgIG!|-n!elZWQ?YR#IZbO#_ab+u?ZRF{|AXR?J>astX@}>_bq5a8lXH_Y zlUbjx8P7@7n@=C#`QsC9g3C=o0#Ib22iL0V(~N(xMy}_o1?sB?Ek{J)Cy}2(l2GFD z@hO-81hlK@$8-fKH>%(u$rp4$isqWf{cww48)B@pxuY|H07gyPal7*#2O;kjX}p2n z^uKO0?^14i^1sLzo+?txeLZnq^~7R3@rjRT4QMB}fR4lQ4ZlY06`BHsclR+ahxyYW zk^B;I%!M=Ovn4>O0z_RB-%wfsUBcnwjw<@nr7G4vJ}&#K(AZBua@aB3@)GOqzZiz$ zncY9Vhej5k+@i`Y>1p{=wFQ=3YIK;}U2YrzP0sHi)(SxZMT?2sH64)?tlQNO6B8$5 zIH#PioFok*9Gc%)X@^A>SFs2y2Ar)NXojZvuRyTE>b!EE!9QlM#NB3w#;Yo+G6hj4 z^06E5A@P;xb*x7e;5>=K9Gb_yXI^AYzR)N3xJuf(vq?%;tan;;bIlQBPhvV1=R1M3 zYx$1b?2i*lc_YkVcty4WyN8u-?X0Zoy`Ti^c2&@R5?r&3P8!RjNGCns>}p>FzTiLf zt5(bwt5gj$1I5#)csWOlSbx+ArR!)#Fxx%}+dZ}<*g!YlAH~&U1L0Su8S0l*_VAJhk zmycFDmTdY$^E-#Wnd*C@hL%m20_c&{LG+8VwRr&&mR>c~@pMiHLrz2AO*k&TZ0PSTSYBi?p#mwTD3||uHB9fxSzL3FeNc;aPb&~a*#y_RjcB?ajL*5nce)uI{&;U79CWd}Inl#oRW$5s6(a`$f&eWKFMRwVZe6AlHOoSa zwmlx+5&0F_ecC;6HfU#Oew)eSWGu65ZnK!(tNZ|HI!@${u?#r5?2j3^+sVrQ+FLwU z{j{65Ge@&+saGj1_0hz)-sv-GAl+hzk1FvlLHx=HCQxFn3NN**pU1bc1(TO_ zov+^x_VvH>gwwlxmO-KMJPEGgC=&(4W1}@2EWW=zzot05H6;QRHUuKSee(xX3pE^r zSO8$AB-s^UI{l+t1XSLSSfa`(nk&Kkd!yU@aUpd?vKZSm?sT%$6)qHVoE;$lzA9D? zh;2fxqjHCb=@%iF(ej04LsgDGDDrW`$7{k{$hs5h0g3_g>Q#Z_UmA}7irj- z!rcz>Th|m837@Z05cd|4!J8g_?7dXDJwx47R`*7;cz3mXp85Ur@|Nm8l)ee{LRw&< zW3-G!8IldWqqzWSk?JD}kJC}KB3auw0S~R(6N7jD#gfvI=s)llbZqY}M)l&w%o24D zJrK(jy4AB9vG)@;D*?DvhssjVq6CXWJXUczLS>(3&Ll@@z{kL*SaS#k(xUrQv9@$E zL6&+K!aftTOR(VS+VxHiy~T{%M^oT**0uZ)unNL`{kBmHM902e4#5=L^I%R+vy|-# zXr_8!ZKcj-X;0L8?7Cv`<=1wQL;LS_kSiNo>7Fm$^$dJ^Ws(iQQKlq{Qmnoj`>K?J zQolv0e}g8bPb!VKVe^u6Sx$!KF3s$FZPVFY)3x4xV{4ODgn}43@RUC%fJ24uK%<6^ zxxxg-uphJeuJwfcAFAFuEUNDd`&K|wIwcjPV<n}ddW z>id@nFwe(e?k234_CcFe<<_gC?{vH9?18oiqUR1x&&nonL<(6AX9x5@ovwSs2&eIj z6Pi5k!wE<&3@8a#sA*tfA6~kZ-vCwKXxIVO-d(=m3I3!~iQ<$$UpTgOUUtDJ4dbWH z(2RafUmkqVZljOL4litvmL&??B^bm?M4|6*7xHJt0|uxIU3pUR4`-N$U}42h|Bj6V z^i#|_;AXH0nI}+~1oP->jZ|YW58*`(TNgeJ-D&1Ub$q!oN%ed#cO*=@XE$tA4|cG* z#xQA15Ul_?nP4Md+v^TM3uvMW1v5`$s=v~`i;je(l$xHNGre`t?h$pTA*mjDGuJ*F#Kf|EDN~9U*J)TBF%GJwvqaNJI#aDaBJkOm<}XNXY|$*z&Dyj zVc_vYN!f%NC7Yi-lQ1zY-glI|c`g5X>7BPDC=VFjin#D6YD6+GL8@!|1FiuEeVVr@ z?Y=L}N+tko$X6B1*0mL-FUdLtMWmf%ISFyfmh=Uv2VRmE?WYLeix;-P zg@wXVh6us*$*g2>>clDSB~7uc5Cc)6rD)-XL#yzmHW0u-qa61+=A-)JS+ext`J*Fl z;0ODA?)(68>KMHhH0~ontlGSF5#R21CF75V43Fp20t&7kKy>t7w*g6+5hq5X7OeC) z_D!@4tGyF;ADvgNOajmEAWx{T1~Nhl>Og2bv(cWcL@Ry4J?S7m|nb-W?&?;_m9`PT+FVu3Ia^=nlXb6;++W2W z9eZV`O?8JQRS&$;`eQlzZPGre2uHX{7hnit^q0}bt5j`Me4e{B4`G7C<2gBfbrlNv zDvVYPuNAx7J8CR;?Vr&Msv;goOVD$rw4YB&nSXClbpV7t(rZ}<6-7vF^cEtda=$YB z*4~!z?o;5t4`Er$c)u2wZZFVMi2Ddy@L!e+VfD27d1DyR^Cg3ipw~Bt$!d{6l)eU8((ENW^gK(lz6V3f~*}NpIU< z^}{#3eqE2}I5E9nY95Goqq*n2ekVO=f8rkv(jHY$@!KQDTk2}C05Aqlg3okMBde>c z6~>(0etO(`k*SW$>X6P<%?yazRDq&cxhF29DiI3QSQnx~6|#oq;r9uxuR_FU3jmIl z(6L1!&%5dL{OcE>c6A(9=~Ailn2Kj?6A+N2P@1Gb-Ho+|w5K?){`eIPQ1!(xezP%) zx0-yJkkQ=Wep_j6k%9}00$qciDb3ccr$aQEBeEq*ULU=CcXb`hI{HEXq2x`RK&c^D zYo)Ubibuwcra*rT1<%Gwa?7v(=8?~dnryBH1-$xpMPLtZQ*}7cpAJ$Gl5s??ddQO4 z8W{$Dy{GVf{{x1Oi-t~!4;|Y;R1OX{Gu=y;Pac!`t?{5b@9R98H`vtV;+XPwYO~to zTfMEGA2h4@swSd-o8+2o;ik>oxX;khH! zp-%U}-{Lh{QE+A2Apsw{!(GqGx2b?!V$0K>c>0NUKI)Fhx6~cEDX94G><5%J35U5g ze3QNz=)gDqg91`xacp?x=DxpLD4BWWuZYWAV62t9{!u%L0eelh)HwLjx#V4OAGyo0 zNhQ%*z{hr8_{_%Kxu{W;E3M8ExM<(eks&*Keya2JoNNik48k(n{NgK)916q?}Zplg~my+)FO|+IN>TLvSIr&EV^? zUn4Eqs=BUAxo%!z1FhDO&%g#vV23Q+w!t#GMc;)lB>J|%QJcGki?cV|*tYrIiaGzL zOv+K{o8dj%Jl>I4DVXfCi5d*wNPnndQMJLv3)*0;aOv7Ws7(~$?+JP(giV~|CgNXU zGo$*DE{>49n`7@yNoKjq4wXvdYQ-WkzeGoj-ZUD3$cx`0qoEhFF<3YRi=>{>-M%jR zI7nZ}K>OMrrhN>GV7w$L5Y+6!`Rz7r{joC!M;c6H`9Qb-q=*C75M#>xb zJgSvYZ%jk9=PTP{f4-s@*oc%cyxS-_jk{?r<-bM+lIwB*{l6ZJzF7K0wum@E$}j!G z7BOng4S5MEMWmh%=9gsHZFE!iBZt%i{MNxmCjWi*-;ew6iv+M&xYE*m0tM|c-;E+1 z3BN!*SZd~ZQDPVM?>Yc)1#$z%`&{MNyP36OUI8%!MZiGBxVMt+<-e~#q4v3fKRR~Z zldZ2~{NEKBQ({E@vQ!y+{jVDzkQpR8^65~7TRDzI4f_uZ<{*^~Sk3Qe?8po!k{bK_cmG~gEuxZ& zih{WK4{4oFTpXO)&ehDix_F>ZXM`PL(P_^dE~rICj}(^G_krd4A}^3m2=Yg$W);R4 zQuOnCS;WP^Pxr+9{nG(bd80g-+ylVPzbNZ|AS@I6Z(nwOA=FOCpls*IAm024bUp310d}-s^BzCi3yy)P%moG44Fb*eF*41ry6%7 z13GL_lt9fWIE97ZMp%D;bs83P$}eUCfix^Etc~oEJU-64GhiyTkFe2U*T80|wCK;q z$7C2ymhTgbTP>_UC*&B#hI%fGlt+yJei?yudUbX5bg}v;z?ma!Ylv~W57_3a9d;Gm z0C5IdCZ=#aV197f{TwwXCr3U6k1@OBlIx3J~k(proQ2&lCwUy*=Ax zHy$L&64|_iyp4p+*Mfeo6IMEA5!L!s0l|y$9?sY7^#K6=M9QIBvl#xGvtzD1ek(Zw z=NsW|7VSSbH)kh8L*=N(H(zNaNyy_=oO}Qn1_w-<<4Rpjc8-PCDJm*L$?@jfgVp`R zh&cNV>mKwe_3I#JN7UGeWH1@5@ZU#B)>B#k#-R64xOBLttwf7#1!j7BNfi=YT#*RA zt9T`hj#s;Y`kmR%Xoi2i{xgG2`a!Jo;f13f(~ro61X@Py%~wzQ|2-6X1~9zvi8ott zU#jom8|hKyIP27b;PDN5zTjtxW1#3bu^Fc;1DGVUTg|f*ezbW@!s`-AB^56Sw9GPk zdwUOM5pVye1&}Tjf<({oP~I^0rE3*fKT24gW<{v-3q!Q$o9UxRg<)=}$GnUZoAUg$ zx4{j5dMkd=US+>6;|6%L0>eF`;|3>y=PDHq2Ik&m0mVqh=gDE*n99+`)Qt_bt5U~U zvZECYnXWu6hNqgBhlUySTNTD=fMJG$XqT+)bpIK$g@T#7S=gfnc9Bdla)@Q-!R_q( z2HT9Q^iHTFPN?;WJWj>EA;CL$sH~10WfMN1JtcM_|*=H50?cgQrnxecs-_jde z`vd}>ns@ckHw}>L+eue_`3&xup7AxTi2el}jy3Y`>9CI*_7{9@&>n(PPR|)p9MUL@ zPZ0yGFK6JSvfekHbfA<7ke7%4kszd*K_lV*3>ZE{-AgzeFKIW#00UA`Tf0T+r)_U6 zbY#8@5%q^#-QW{b76=3FpY>8ZP=cTfCSnZ>bJJ0(ZF88+a60+C=%(vjxAIs`_TT&=l+~ai8CPgbAvc zSs?=%uro4Kznq{!Vo`6W3kQ7A$+V zoCYx}>Ax4oQ|2VK`}j8u-KE=#4b%5HJ=0izo0hOEB~}@_+WJU+#}em}c{lzzug+H^ zT}2kP->If^q!NvDr;G;mR7-tF95z;SwUmtP^d#IR=AKEP_8IPE0Sf37jsk>Ofz`rqmA>-JPCyUA6hKR=trxlL z#op3f8evCX6=}c(n$$Q93gGlFx0JW=B;y@q=tBX_`WdHJ_9_x@k!5Hg51tf znt<+OFYm?Zr}1D60VY*lkD95J*Bsf)4UR<%62f)&4!Dyc^kM?mG$FWIH$GKQKDA}| zOvV^**&uZ*LEbJ}M7SrFs4vB=n&<7M^u}61x-^BJgj1l&bwIq}H|VRpW8g0?aE1+R zbfjM6p8BQYaS(Xz5IG&Icn}Nyhuc%_#r($2Jmze*7vTUfS6?^cU2Bn)fH2mXsh;qn)SCU++VTKu?i?qS@bjs(G z52qP|v<$e%xJY{Ke zAL@gIaaUNkfLYQ!z*#(Ed}6|E;kVUfnXW+0!I@fXi;+l6Rj4U!KYKI2luJPX`vC&y<|7&JKc_`Y4e!}=T1^!ybEqo|Sdm+}t^!M+ z{CDa5PiJ&F$7*I4g(X|>&_7tl7c7)$H(txxDUh!|q2WMGu1P*ej6C9p5%4S3hU#=| zEab}DSNsBRL9cg=kmg+&so5OY@*D*wLO{);Av!fpZ^6gVh@IwZ0jh&4wy!6G4g15i z1~DF$IJcu23~rWJiq&pI&XY~9Yz_8%R+FtyTph2J8KhI3K+RYE=N;0j*kz5^t70L$ zVVuh`!QmB#Ou6E-k2npGLo`x12KWCN0VPZuMj3gw=`Apetyk~QIxo59jAXzx3RE@W7pMSuu~yb za3EtQa9!DY@hzEfHV_PxzGRLis$y@~V<6!-!s3XOCAEMZ;9QxU#eHy5X_naIhY$b; z+f|-PF9vRr_GE=2LRtTPW@JJ)pVgDg>&fwx1NWPg)oB>O94#AA!JT$1;Y;AMr!q1z zQ3QOiibH7Jt`5Y30&pw}eJBK5XMrh=hbj`%P`VB$&`DJzar%kAeGzWtRamoE1~Wdp zZ|^;syOh8~d3dVpop|7sbo05+EhJr9O16x8yO7M|f%b5*G3_YXDM_lkYAy8sNtTKA z@jB~C44wA|(F&N1&+S4kGc-w^OQl+}gEcbd7*)Zy+vbJ;4q@CxV|m&7d@%mD>{v)d z7;KncqKh##@q*a-VD=p;*44OG?V>SM5A;LG4}J{rQ8(=ledFIuUOq#HK!p(w$6+}u zXxI}TQyRS@v-?Yu>0M_%Hg{0q9)4W(+I-5H^$mZwu7~T(6bc;9 zC4cZyqQp#i>v&RTE+}jBE0w;k=cZ%B(R@+%7hMl1Bi}s)#bIR8c{Hi4RccOH{$?Zj zmK9YZkjOew%Is3XtS^sjbcj4C<%g1J1etIO=@Dc^ zT~0Om`c)0rzmSr*wbEB^3^Bq`Nx?;pTUI`V|}$*~^Ye z+NhmAYSIeN2B+Px+U#y?o#OS8xJE3T9y_`bNX}zCrgwabn=nuYeQ|#GSv~cu(#G5% z594#QGb`u454f?Xz#ZST+LlT3e=&0V0HzpZ-$vPF8D)?4$EKEXxIrcQV2%?;z#`mG zDDmZsO?)6lf?z&&TeeM`_e(pY>b-p+kVTh0?@Q$NN;0h%Ew8;5Tqjv{d6m4bZoLAE zmX=t}Z_ku3hHB~kjl_skyns2~#Ug~}^CN`n)tNAdl@+1e1iSl^YN-uB<#!BfdWq0e zYDv@e?xFESi;H}e6b(wi_emsLI&RvuiY!fXJ9QyWrBv&a(WVi*@ubK&C6&Jq5qI(X zhuyq1;L!Meve6m6LQjuO+x`+av-wG`sl0o!5@>7na|_E3-ExwAw29=0j^G<8ugR$Q z#Hc>_P38`V-vw|y-mJ@Z6nZl7?krqe`W}>{IZbn@uw{DmzIr+~6w`fwH#+i;nx?w# zx)CV$eLS_>ON-N`Q{{PVIYhsEI4|4yieTq{yPR_YblI?H$=xemepCf#EBfB>DzT`pF)u3%+{KbJEaF-_=$ zO>v@H%-@ev_`}dh2Q#7MPkCug)C+)r&Kqc@J_Y0Lf#lfq=RJETP~!RI1Zx>56I%P- znU@xMt11S3rLft@3<)3FS2$k$Piyr0?`CDTL?DwqR1+fjx}xCg!#udt#e?zssA@s~ zSL4!*i4#ESMgp*M!@S3;QBn3E{MpkMSs$b0m<^PK)X^jcv-X<{JB|bTWsL_ovJ{g+ z{HKk2FD)_p+n{OupYsYK-NMli+WQ51%f{y1TSCDDHrDNNN#N*I&n?#mn+-%Rrd*)t zDT1TM7vWt|Z4zN^_h7yBz~11v7Itwy(mFc+EjDD^&%g|o-*V?|0>0NHkG%GG z4>@%!)Hi(iYk8VW2ET86vl#aDZAW%~_5|h6o{lxa8T^VGq)&eN>%-pMA8!rcD&*Aj zfa_#XbdTVK8W#7xnKz6#uKzINEeLfw8S&`gdPkr@xHU(N%wtkiDBtb%jP4hE+{oir zT@Q+?lBZ48M5me8+_E%>4M9`xih0s;67@%m!&snonXKUy?(sIC?Y<_-R&`P8a~TPv zd2Q!qkgjMr0n2Ba1T-WI--X?cKHkOLj9EV;LYTeVYeV~;i-`p}4RgA%G@B}$PwMX{ zwgjNO9w(~?guE`^E<2!fT4%_oR%DU)Fne{fO?9CWvgwlDI#K{U8)ejWl*am`nkgIc zxUjbLxlGq3!}YfAbo@i#$?7N5vHfooUICS8?dl6^1!vO>#{*7omj^OY-&!TFdNA`; zbv!=FM8YRKhr72UpL^D2n8hcEAGcg**aXH?c}$!$JP@ zWo$$qZgXv2b})*`FCwUNnMsp&V0|RBkaaq!FbXPM0Uw|#EZjsXN+VR0Aw|Q7i53Lj z?)6}e&U`jjb=9c--PG&!n^nnp@)kCS0peHq0zYFX3wr&^djG^jF{8kRD^z@$v>mN~ z_x7B$wt?p1&^ZJPkh=O#2c9K%ef>H~bBF}h4yI??%RK9?(xT5ehFK|0w>iVK%g*YY z!Rd&4bZo2yfvnTfJY$FfgU3UkE8z8+FsU2L>5{==w8uAY;<8&t}7shBIJq#-6psr-sG%(XWdXheZx?O$;rgW%eE$eOaRmbq#RC1^L#roqcPK zlt|M5gfO8z0}&K>xQR-BTddI>OBWFH5~lbF9<7|_jnU_+w9^i(RkFCS7}fIcn%Avq z0hyI#&9~Ey7h{3n`kX)wC+@xhejIu+TSJt{dP zC#P!D!BKjp_%)kV*Y)vE#rpI|$(AfQ%F9sjF;200?b%eWLCfEwA;Fgycz$l}>WLl+ z2?kP%u}>~6S5vCX$VGcZM!y%RmW2uEF^}T8Q>d2Q{i@skIKo!+llHes27Dk>*}pzo zj5>;EMG{}@($Z|WBa|dz72Zbg1|NVf78AeGsuz2=2)Yn?!(i^q409KS5SK+;76!-Z zxQMzD3oeC->BsLa_Ny zZJ2i7H16?3jNe>muPA%{zgQ+;v25997?Qu|#owq;&pHkOt*_8s)QEf=pE$SNE-#vK zr%q#GM(8q-zdxBh$jg>g#6>R?CWevq)^ ze-GY0;EwMWRKenIj7si?6OL?i-A<)|c$Vh0e_~`3C~G*gBV=_+|Fq9K!t(vu<6fpD+%SihhDmWu2E=$*q6+mwI(I|Be#s=${%Wf8cD(P(G)m!cT_r z3uPb$uywQ-Hq$9|qL^5D8?oZ#%$I+1pNZz-?)=l>Fm5%m1F^r8;4GbQav%QN7!ZLW z;Yl?+Q~@fSrbCIxB{Mc`g)k5|-6Grd*C?MJayxQn!b!Xq7;bjcD~?n)Nk~|hoPmM? z9pXi)n5#eJqgweNN-h|PqBC!mpF0*M4j3-#)t$xUgqtaXorWou6{)1 z?>4qz?ytQV6}5}oXh`HkQ7@dMpHuWjk82za>Z=9t$rEW#11;^>R$*OD>SFA2>U55; zCfmqGzQe40eLZAjRP~OY5_PYYnM6)H>8tolF76IKXO!JM>3ubY2YY%5$JnT&yt8Ge;Yd~4X`NaC0hacg!v!;z>p&ikM| zcGgA5q$gB&(xtkwTNlWWrH=}Qt&LxB@ugB0Q& zS5_|b;53JPCwjp1LHbdCb>c%q78D&AQN$5Ay8Hmn zJwmbn_v$^DdmA}9e|5`r|odne66HSJbBHr=x=^)?zYyS7N@Grj~AIiTev zIU;D={m3Hp}zTT;{FkOKM-D~QA1b$;$ijy3!eyU3 z#VQ>_2pWpq62IA5m)(6#c*>04z}W*5sRI9gJkUGLlgg8_)~DE`4>gXdv<$FlA^2Xi z&WPX{=zEBXXY+;T-dJ-IM^ewWt*z~N1KK@uDP9pQi;p+C6sWChj&r#*9T-LXbS9Wk z;Jif7cnXXiHXrD1s%mJEU%BkjQR9}&*iUibC^2es#7WdhC)JKWJ*q<2R0oi@ZQcb# z;X?v)^y^(JkP|#{rhO3^HQDj+C3410(wr{PEl>Eml6YQ7j~Bcq&Z% zIJDkJ`-kXwN!C5_nlffd_i#acA1`NQEZB7rmsxFtfxO888l$S4H^4;lsbWn8)WTWL z-1!)4BY=EeRvu4G%aJDLjfXQ5_jh`%_rNLRMecueB*atF*SWvgV58{4*Le(SXRp(&V{ZX@I%V775khn48c)@(E zpps=_r;_(3vT}|r8RB5tZ)5G|^e5?i-a;L@*Ep^A@*iT%96u9}Lr}|pEQ4uo0AT^j zMT6@-qsB9xDf?8l*$SK00alPFSsHF>S%vC5Pm78#8&(xw=y)l5uU#%{IF(qqO4}<* znQHZGu6@fB#k?CWLaz}CA}X9$`;{&7ozr~mS_MN%w4iwF8k=1PcxuIeGRNlX z;0J6b@7E;D#+;X*Xtc72W31L>1JMq1ruZ55Pwg=9{IN@uOlux%jd7@r3IFdND%Hjb zmx;v?LgKF2cx%21M0M)Pb5y_WK8e$HUEG`6E-Gt{IS0#i+y4P-UI&+6zJUCi#xT9| zt66&j@RVVTB^mQDg`PeRp8pby6}ORzD#(ToXN16|rM;>j=uV0NQmfKOe=K#;b=h84 zVVh1ao>n!@ZBF<1#D-0=yA1c(x9olMJ5(=^@F{*@-JF)&s(=?F!DZ^^qb~Rf(E|{v~*TvdE$mhq?@p+*#U6Ww^@S6)V7ye6b@C$wPEF|pGSm}=zME4(| z_Z3`|HJZA+N7&Y~xME-#*+EaWmR@4s4dFcjJvgJUUuS8~%Z0H(Ut^4xfOF8s*DvY{ z25DV@b-Kc`{r4|#4i^&*L?|H&5>3G98PG@ zg-Xb(paItN5(N~;ywW+B+*MOQ>E9iTkw#yiAGG-G#OZQK#Ib$xA5f z-mOP&S$~m~j$vx=(XtDu_6?M@5nJVEiFG`J$ZvHW8>*|<6I1-e2g4W$Ebo77QVxH) zX@om2jD8PK0pYkcu0Jsuq+BmH#P0t1a0GI3Duv|XwGLd5xPJ-1cHGbHjd`4PKJi5X z{hU6`M*u@hHELob@eQ{iToITMcOIe{xvhGWt)ONU&WQIQT*NFm*nu#Wmi6F{F=W~L5%C$KzJft}R1R)>P5S4rHkJ)B^IyzRQ z{MU>=lf%0$R)Uj&T3uyY!w3zX?xq^`i_ZPlS5@$FZKL1x$JI14~%zUsF(6<9C?2bIjT_N zv^~UM;F>h|h$M0DiUY1pPu}0>BNx}4{_)9+SI%A%Tr12`LBL=_;Kp`40@-`_gR;wh zS3&_mElS_ECQ$|OScHXt{r28sQk9M&eUw^F;tg(kIw89$h7i|}E6gSjo5`p?#c9A2 z4HFcXdi8_BjrF?%F9Te9u_Ac6prrr-$Z|OzcYtWyq z!5wCL-2cYRgUn`VlmmNtbZd z`zfip|1c|aZV9zdoE2&`T){=^U56Ft`PL20;BOEewLWbFzHi)avC))G4J@vqVOmaxTm^w^|I91!ch!@TSWx zG8XW*2ET1(={3v4d?NWG*Wb28fUl2m?~Ti%m+Md0dnA+V0R8g>7a6Ia%X5Huf8Pz@ z%GT?Cvc(E0WpaV+qGy(->KP6;$sX{?+}A}5XV$SKj*V=$OA9-mP~24y(~6WE)WdgR zzbfJJ0s>C%_vrJN!%hj1!ylf}(*<`=xjG4(+nT&0g5tB#Q~Qg`dfemTrqSLj2o_x@ z>+Vp(i5F(DTeEG_wr?!RmqMnU9e;ATXB7Xzv*1)EX=`_e)NxLL(?uh&>^#Yq3DLTp z8Qy?DbIFyvLH6dbt;!$zuq?kM*mLU^Znv|2dC`T6_lk=F3FJPsR{tl;vlWu#_S8e~ zd9$>7-b8&l#Zjh`O2ld9phj{eu%w${b+jip`$FU_8C1RHK3^u!9O1JQ*wv!DK*4VU zBP86mT&nE{7qVcmC;f0DR~GlZKTHWDvxRfXEzT3_Sf%9}(Hs`*enr`Q*MI(H95ue} zqXI^zck03HfZ*YuY&s|4)T1t^$Bi8Raku6$zbWgZn1=?Fia`rKq`Iw!o`ESPVBm=* z_VGBQXG2my$N!If3J;yd(;9)b=qi=NZ~4uPS9!0(d_hPR|N4ce-L zA}yN7;`!P7{a5V%l)SP9l)yWBm*vlCOUAO@8VpRBJgD5!2(7hOt><)EMR6|S-S49v zFV@7=Gm9Fg#^gzOoPm-^c_1nYLkU5vPDAKj^5TG~P|(>CGxI`S-dz|)gpUSc=}1Md zEnqGH7=rV!dSuiyc;in2A`ZELk>0@Z>3@*TnTQhr;+R6}Y{yfMfT^xdewAk8EfPSZ zZoivv5L3Ozt2nUhBM&w+?#pJ^kSwln6&q*Iq?%jpl*YseF1itWAu**d2O`IhT5>#O zRbHf{xm?!b0@E!_(B$OIXV55J#TvL3Qt3``yl)g;hfPwQQ{0^SW_y6FeQ!}c9Qack z2#z$~6$Cx`BWqCBu$*s|G=0%0b{tu2EyaiXG197$-a_3qK`EUsu6(#($d=!0X??h| zPRft6w<*uKaj@r2ymu{-P%v1(qL)B!F6mgei&3@`i9hKowR0|nq`5)rU*OX8Em3HO ze>-qL7545#={KGjSJ(yWN@#?0JczX!;vM576QjSaEbeap)Nbmu+IV?Rgkg7fMEj(w zP@JFFZR2t%;`yH4CR&tc0P4#MDk`zjm|%Ny9ohyqHnyCcS6Dnw)oPj3B^I_k_26sk z#U@ebkH1?)ewaBlYms3iioy6KN4%=Eaz3tU-S$1|@45~ByEGMi+w<{)H<&;laQixW z+dY--JQt20sW}7hyV0ahkXlUVCoBhf2)SYeB1@ zKB&6)12ADeCUX@G+oW1jvw)nxo@}ZfQi;azx9&|y0NRu}mIb=VrHMnLfU#LEs4fdK7eRgIYM8+3JwE3yS^gDYLe$yIf`mHfqBni`Wbun?Drh6|vGjQe02r$w9#Q%Ug;AHFa`T|w8 zH0B@XfuQT-kq_V)HhfhQfW(*VwcXK>%T>=H6yF|Zy$rlfmn zP)hi1n~Ee@f~I<~g*xMxJgs^SbRxBN){2CNQ~l1u0-izyWjD?{s4$Z$=%vwn@~c;;0G zqcuhe)Yx;AEGJ9mbqYA2@mNe?bFCA0&NT3uRN4^!g}E@`q} zYzeL_dV5tXr}0DL3IRb*1IH8}Ui&4o58n|Kgsqc+r5Zts7ZtB_I@G9#xi}jD#bLLa zP2`TbZl`S5qVDjC^-%tgk0kiy-6LrD(T?#ilSqZ}09OqBMx#iGsz{SrDM#>OXC3|p&hwZr`c^9dP%%lQxFP*{G|{UT)8OzBPl<< zCFpJ|)ovu5P%rJG^dVSvYE-i9>+*SyxfOJnTzM>mN`#!19x^Yf^8C8fZX%23m(BBH zBX7P~s-UFxx!tqs2?wK=)D*cAPvvnmc3~PFl##@oQpwype}A&9HuMVP{`oz9d_#os z$@D&JPnmVH(%i!Kn_5u^&3?!V{nJKEWX%3ofOm62ig$di^tl35J`d6Es<&t8tDp&^ zi(=c14`4Ogj14=my_ot|n`$|Kwf8=|&+=70!jHY0N&2<(n_uHtbD|<5IU7C{zM=Sr zM35ChYv7=j!1cnb`nrObPFzAxT|sRn z1|X4W`Fo9(eAU__?v$J?8GxIzuxttOG@D47+LTHBEkM`$TN+n2iDJ(_uqKtE#w-b7 z5P`se5r1ad3}9}{^|~i)b1JLlR4}pAG7B@murQIY?3j5>OEmG0{lZc7 zBp?0aB7zvu78{mfgI|v>C7AY%ivdm{u?hwNz?8mGGz5QfRLsybK<|DLtr*l3!l)YS z4{Quk2DN~6?sSgw*WIa-yWKwdKA$`JV|9}h5nzrrVc=|{dre-6{O2)IFRcsjUpsvfnS!*3t^1e6j`vna^q(Lg&}^;m)cIAl0J<5F z)rj_&7Zx||mMiHj-sKnxJ)=tqMtfwEHDqJBR_r?e`R|n?93rSeZ6BVNA(8<8^Z((v zpYOa_8@oiu4{U1g?9qJrEW)HIo)c+MZv)o7EVcI{!H;ge3cK|ya5!@ETG{%fhU6)+E%oL*9*cQkyOIEQ?<$?Z@xDMZ#@wIy+7hq`x`HG8 z*S-!!2l-xdzjbV<9O0atWz)?59QFRROmx53X0>|oPcpkt;~`dVx0PyhfcvF6br~X6 zkTL-sN8&$T3bcEddvq;uqc&`RX`be`-E8+5a{K#Es&2{P?e))i1c49N z>K5{rBfj-3q4%WkE#GnO`vjI4G2Qn}U3j5Glb-$MhK`G((&e!33eWTL!O;IZG69fR zF0WtrG!A=QQThOk*(jjBzL`2dt9t*J!EzdMn%ftx z0*V3p6)zXv*WntV;f*EzgGHrx)Xg_%nUP>T-FkD>AuqR=e9ZegZjbe@!tWYGmt4-Z z!J%+nOjN;HOr$^uzxm5j#4ek0pL;y9Od@aCUfxXB^|D9G-6dZVm6kIKFxxPlA4n1J zJ%{+2QZz~WeQe;rkpH`;-+_av?#=LR`KZ%cHqTDQoGd0@=Uza8BGp)wEUy97;c&dK zq4%ouM^rS$)(~Pmo4`d`4{!h>VTYy`DCNnJ^mDt%1ES9i151uGIQ;_yd408u1vAn5 zr@6MA=4ugjv9*-uYb?3(fM?%@1s9H@Z;2U6(lnIMF7OnOu>6_=V{Y$fcj;>8)_DnEC25AeoNu3GF~>|{mE z(;(uq({M&^(M89^j79StWdP9j#4W}5ab*3US3{fwC0#nMm#AErZ)}#hlxnSm9Te*= zu1U?8ni3#n7}!6@vP6+LzZ55%wkaElWqfWDqq=VZB$q3ryhiC-K(Jf^gL2EGgfs9o3Ew&u-9SPyawfKqIY`hvZ9@>p)t) zTAKh9oOB()VvbwcjfVIMVA|SuUR$URe_VGcxR_|r7g<~OI?e>xAC2=5R^#!^y9*RY zyGPpKd_dAuK`5V954~5r(Wz*loC`4Z`?WQkA_-*QnOyc;UvjSdqNsN(dPuYK0Gpqq z)+f&be*}z;=k`yi828yNc_-)YN{D&A%>SMcj^~MrdBk3P8Kmr5i*5E4Y`-V~FbwK& z9gd?5%@ci1CULo!QxARR`Q#@HIFn2i#4VCTo@o)LbPo}iJG0TZe{%Voh-erYqpU@j zUAJMmo2`hrRIB^Gp1jh;QhB)ukiv_$JtQAaIu5WwELs7;TtFWK!gQ0!y{x+!0>|O6 znIJND)5xMV(!68cvml13X2%-d7T_>i?N+l%%xWl7;-p;CgF1^ldR6we=WKkZl(tr0 zqTw)ZwlrQWPGuUGQpx6`yvEW1n)}(Y@Yv^9SE5j|R1(LK=z6I%eIJj+W>@SK&rg<9 z9Mu_*1l3}-jFRAyzvrQMl7eCM;oNHS>hCyM@YaKg)-ybAxyMec_3y5yce3%sM5I4c z)`NT1lcr&6cncV4BR@pr$1L>zoE~Fk+OX37Bog?0suK4&Bra_*HsIWuG>b3IUADq8 zLQaZK{^*H6?_sf3E~h-W0B8Cub>_o)uZqLUdu1GD&9W{|@yy zitM9cS<^#ubvQ7*g?M@3kt)^AHg0b~);1F7{zVQRFp3nWTPx37X5`eB1+us7b!wR} zAwoDib6G@;&^-Zv+#uYw`}3;u#|3hRE76Dsxeq4x{*Bl)Id0cS?@C@Hpz%g9zpO+r ze{UI|U=~Kon=b&}U!9w5P?qG9PXr3o2`Xx8?{V}@`nkzmFKm4+#&o?F-%|^D3?CUW zM)YCqy^is|hocu%ll}{>&>qQ3NK^*rYU$t36)4tJBAti*HaK&>n6*9Sk}wJSkuiMNLt-f|osS1RG% zR(#*Fj;NYZ#^@H6ntJUo9jID%8~%7d1*o;L;DyX1)UkDm1>|i#Xr|m9?4)tZ@MAC6 z1+%nkQECZIaRBIWZYHdV(l0A{yEn>Z%~~P|o^kS&${>9G-MnJx!8xI8*kcU7rcRwT z1}NzP+o{3Q7?`|}c={u2w=ATVk4ikM8};YvqRD;)Q$@|f>|`_~TX{`cRY&F%JbH1( z3WM%JM0~oft*>(QtfKxS+lZvm`{+mj{fb5YMAKYOclLvNdu*r{BBRaioCz>cZMiaa z90B(+a!5ODYGfGKC`ACxr*f$LlN|Eh99HY*4@nWn0S1$3#+OdO)!9kK56Ct094f^0 z>jHq@!PxnTfb5$$Zw$zKEca$BDD>Okh9jEO!wvea7~mia`%7gEE;Txr@j7p#R1@TUE9s?9H* z9k#WBX<%7_a`jMi#Wrsg6)Y8@PQmS7^WyUI^6p1`Hwa4jK`uPFC9*FiF=uT1xK;EA zs)kw>nHrR8byIz-UUi{UldaD6*ZqR|Py5C}57*^bht1IcL)ce`MZK6gcYp8TT5F&EoxQK~&s@aJ{N8->e(uM_ zO3I*}Tjhm>#F*CEyU2l7)RAWDqIF4Edz74Q!WD({xO3)2zJg>Ni^H8ZGK+%tqYvMY z)*74-mQV~Vj2}`5)=QZ?bTK%r@8(QO-25rEYVrNZW>J8(r-y|}C^@jOX!c`P=~>`r zW`+uFRP({}r12*rTRS;sXVB^c?yV2DsO?-*IBPR}Rvl*7X=w($b$BS%eEB5MOv0st zemVL>;RW5G;~Ast{m*fiafl5S+;UIRhQ?q+HGasDMCI2-lM2hj3ecV7 z(^@*Zxz48|em_BF;JpY^fHy*ph~4H+=2$t6f9iV+$N1e6dECR~ zBVZFaoV!nvvG3$|wuz?kFuGh>&F2k{o-2)bQ8elP1JF4c>OY*j;g@nyQZ%m-H5;tK zygD7?wHPSW^rV*gQ1Xxr;h4lHf`P5v3vzu$TR^e$x$Di_k$0U(TykmGD@Wzg{arj# zq`Vcte`!H3xI1t6e(p}U{SqAVBBO}-#>x~xuGjEX+Kr4zqXTED3@E`ezw{j>C^CmW zBXH%?VPtsG$_VZgWE=#rQKF3FKcgMs-4Z7Ytg`ErSCmR9=~-C4*Jkf{9{he)8+;hg~5+fyxTk)9;M}5 zu|KH~*`g|WH_vvEQlRj5{HL%_znN?T1|C8yYS<_#?QgEwjYYP7@A<>Nda|Fuc<+;H zA$snP;ia4dtoj@UHjf{XZN}w&R5W=%_hfYy97B!F+{_IgIc$yvRk*5b3O1?KEYM}S zFhxv22dMZusApVr>Pq=HD=i|mjUIN&x` zhz9#-s4B-ftqvsLKZ?kV=~-Y{OP~$27^OO15hS{OGB_lUdmnejI0&6bM)jETMu7P~k7ryA68Ee{3ty)hDF>XR&J5Ie23D_c6&CdfogU(Gz;U_`$)zQ?8g!ZB)`-j2KRbkL&0aqDFNSJQRJ zlwGrg8u>ydE>2;|gGR?oXocGuotXo-rKxGDokMeZSs7B1O^VApt-d-jg`nWoVWf@W z6r|2V%(=&T*KD?_(Tz3}M>MA8JPE0H_owS~+!+knZnDCFB zr~(%|$a59?m!wBy3bk$QL6r=6zBQU13jCk%Nvqo1jQ9t$v02O{CzFu$!`)RRoV#qH zUV8JJC#0yxERTt=mEmGj z*wpEVQd88sc5CkFHaGL?_xAnF=Xl8a&kmcWbUn^06I=Cvh3@{kAnR&eAE~TLbO~*L zc}EQmAaLp`aC$IM{V`E|GoSuGR%1U0RUSz9=Q-i7P!&pRKgFYB)?oSqjH026yG%W9 zn1JPC3S!}D75M}I3AX%6VcGDphl>^_{w=te^*l(J@NVW}nBY~|`600=y5Nfh9hW`z{BD`e z0spSYRN`N8<`i-B`Mv(M3dnkqi5?rYRQ zxu3V@;NF;)ob~(&~L@lxC&{?FDpEyZ(K|i&lhgkE4S!Bl^sduNsW% zl!`yezU>sf%>EfQ^$v>Xr9lN^e>PaaA*djyj2K9l7y`Y9mYqQw z3TaBxX7>*dNFzmO=Iw5FV9c@pBnZ_)#ooOS0jW>|b7|ocuSwAp=2X%fc_6SM{ty!u9^sLC(v%E^+;=UNV#wb9Cg3 zrg3|3#Q`1R9LC5*%Y44!EZ^3%A73cUKsBx%U`J|D{+OS=xoN4dt=@k=voTRl?SOZ2 zBJ`!GHy=h|E3@v_ggJsJM#@-x*aPD#3|c-BCv~6c>JW+V^5w8RTD2I|5(G2$dZt&! zY6CjEd%ePp+NvUTVCBH-r|L3jHhcGK@d^KD>sntTN2jeXZ3*Z6jOk!2-=Nxi_#=Mk zTfvb2DQ=*H-}9Ya>eWB=DvIXXAUMxlYrt^~WD1h&gJ;2nY~ppXU+^zGixHz8i8Sp*D>l{zlyBj@aan8diK1s`Fr3fSoS4=>u(|NKL3*-)t6$L5#Ui=6UKmL00yN`5QN zetPzm`!@y&Vyau5;Le@~DynJ%N$kg$h%IHL6vo{9cRz&Hgytx9Kcst zwBJ)mz%UQZH}||_%066uQFfY+KK%fmIr)Zrmo3B#UEoK*bDtu!+iv+Zz;3P)Jd>s zJ>IAR#4AV_(r=B7)Gywz{(KtG^)7k(T^hhZv0G1bdtW?pLSSIi@>R-~>tb+m{u0Vw zV`+yA+YkN0pwQJ~AX`^c5mm{oYO~8Fl}}25EsdkZXS6Bj``^wwa z@JyK@P*o=M@62O8ff)7fEsp=Tw7`^D8x>`iBX35@(Y#O5$)apx6~=mGXoTC|GKsZ+ zW-U`pn+pw@!<{16G5&bp*ovDcLU$@u1;uGffyuJc=q&Mn1mXW}No2m+!!uv&0im)h zpwS5fr<=^zTKkp3^P`R2Hz@)x6IKiMc3L}P**ZFFw0D8MzTI^=Sc!&5_L6~_LMcIt zQs4I4R&lxVjINuWw8P?n`z3St41MIHMzXB0XF=*^0jVfj-pqHsHxh^W4b$USAyVB^ zM)l!jU#qUdp{Ca~DwF45f*qCPsp>nk^L{O)8RQkz6^GK%;xfr$(gpRJ@Xx>22{i;+ z*!ReYE{`B@=YJsF?i6jr{H; zP*hMBT$eM~joGhGN)-{@$&Pw#Hd%02u()8-qkudAb*MW*KPoEfj79-ObN>5-yC<() zbrM(!fJ2FkyPv-FvTQz_PZsAym|ye5i_!cSIijvb>!9xKF9YZApy@xW`Oy`T&vR-; zr_pbz1$L8P+%$QvSOz-VR5)y?R6~8xfTKw(p`(-B6PcJ;kibPt+f^82Po4HGS7taO zb|PNt*eXMb8vRS2>Q<1yc$%mHZt+x3qz{8W|7VPtC~@wffY8cZbWq8th#5^Q?x#5L z7-305&|(T*J#L1qL?AbpY-{|azvy$fv{6jnlHBXh*&nD+G?$rQnk#hFS$<^uLzN=* zjlqz-E(^zJTVvnCR#Z&$2?wBNqAAp_gY-c+X)>06RkI-1?bNy5jY4=pNbsTEKsjZehrxAGBJ+?w8nI z^}XE5fHQUA%K+Albimdz6oy4GhI9NK^;kaHWKHC~o%ql9Vzegd5$g{_dKhTnyK@Ke zmDwYR6Fc1iztjA z3MzVgDsyHDQs39jc=~RQ@c+2ePVv-@RQ2lY4AzEaA zbTVsu2@o_8qYw`ccb%XaQ{^N)ZP`K0h>)+)h%lU}?>D_mmp`2=u0nehoF`c2fePwr zP@!*kzGg)82j@j^+I5|$IQ08Tj6eu9~=Rdu~jmp$=7D&`cU>1^$0WqQFD|c@! z&GmYblguSpOFzC9%|`R;^BZ-B^E5IoYOr5T)Fq(S^?WJvO^$x6ADoL!Rm;{Fg2$v* zB2;G}V7q__@}j{H9uWx9s}^N|?kQc3oAY_jgBgq^+2A^f0dnyG3n`jaJ`5N>`a89Y znhYvt%lEI9`)G~yAZg2`52b20$THPpa z&I%5G1cSlShU8w#8W(Dg?Gu*)Oyb&YthJ{{rnb1TVeYSV9AF;{20$`l$5u71+Ym@N zHWG?-i=N@5>S!blr$nh*YHag8iTX|*#=QBozxPf?`WqB$pu*dgRt`P)0Fu! zBlX&kfEtKecpM$G+|q&`9Sf@)*n+vmD%6&UVV^PK^a3e0S1;EU_mMgXP#4spsL3PMMr{FH`iZy!c#lun2Jnc~>NCs?YB z2#Ijo4BO7zBo*o-DJi-Ax!d_xH2K|5-r)(VXa6!PMUdmUCKXos<@ zkEwUt2)0+%yOQ?%_IG19gCA$JdQD>MQR;6I`pKffh+gncI7z)4c`%*Z!L>#{fk!(1 zn`04}zhw*sFDVSMmui!V)ryJd;hcqVOj`Iya3Rr!Ouo;$?$Ao}81bygR0(AWKc$A+ zx7;^z+36AbJU7G%J<_%7-nB1YS1JKigh;FiU0q!uK`sIsx@7~A3|j;YLc*Ux8!*BU z5}pW9KqFyhW;QrtDkT-zGxP`5$RF~Af70rijo~_-5HfORMtTfHzHWXwY2pM^Lmf`y4mPAu*?C(37UZ!Zg~fSiSQ@?o7) z7<#gzK&ws4Pk*NL*g6Qzs2>?nVA>mNy~6nXZaO)&fu47_UOCPLk-(^sVC$Ym`}lcp z=I4f;R7|J9ja$uALzNok2~#$5yVq@iR#^Xfta4aDVxFlx*(cAPGOR2y-yO9w|NAOG zfdzHQjx_y-paa>$i^bein=hw0idtFAFBe>CYwm+{+aq@eCC#F^G5VM54!_IARy8uL zIho&8N^E*CQ`!tL^(mThIq$!nz@@p5&!k1uKc7|s+*IS8XWgBDK_|XF1qy`JVE*+V z*}98)R|Sg*v8pTsR%le-8Rk&g&$`LK~x5kRw#G;pB-lA@`C z971B;mnaG77a_$u{Q1)KG#CJ@&M>2unU$4S;06$dx5ot|3J#=!O?AAwReIhLcXryW zep)GwngIu6I!}QXcLr9_l`(DGvYd^%&CQ{FkV`KA;hXDN)}!!0wz0W{ka{$&bot~+ zMK=utQ=q;_z`~y%E^+t}^TO8kIdbM@Z;8p)d z1!FRD!Q#*QAgKUe#s?cohPAh%{JYpksEMh|^lpX9%Z+unUDP2s0O*7$-R0ihmed&9&ezH?AItXo)71o*epCR8~ z%)e#mpI^RFAY>_F8L*v3L|`Sz=`9W|EEptkr!zf!cKJyNxc`*Z%^M2QVVKr+N=Mah zE?czAmTwt$Y%@APFM_eMpu@3ay?K{Pu-8UBCduzUibd4;MYE!AbBQpLOc^L3mE-E= z%&2eQ!u4(!{$J=CaA`4u5oOA$pXvmIMuTw9A4&P?5HdlX{k9{(kw-&GDP}DrXg2uV z`AKleCw1e@rT1e=dDZTW{oT=G^K!UPIU9MPOWR-Y;$V$=GByWc%G>9?wBESB){2Xk zV49~1Lfj!<@{fgi9vXd796gJ7`Za1;hFrdVrmB_s2(r!Z-rH(BQt`{V1=(!Al6qHye=Y>Ge<$fUpSj$y9O zI*^=0YUA1_C+2cNZ!U|(qx@=@ZJuGk49p^0`vKu!PAoRFB-U|YUnIamEXYb@=!t4q zcaU05#x=q1>Z3hL_FB!gvm%17-W(Y!1PqjQC)aU=$OR)K(pg9Tx7~ay0>=W@)Nt1U zhcyTEbWo|`;oUDWl4M63s6xfhZP}9maQ;d#+E!#dyTMt}vg9fa{w$svLe) zEfXeVAtfdz22oI;EtVF&de-7X`XyE_Dn&%Bvy4Wg&6Nli$l#tA9Q0)mJF0CQ7dzv^=75S4a@1kL#@4Re)C#9Tyuw~JvN%r zQXc=5o`)`tak|1bxypa%5uZqojomD=Gg0Id%^A57HZfn~ew-hlQbYH>Z~hHz`ftB{ z5c^hY+>@Ud%sdPliPO>0grhLitnKgb15{6zHCKi*%Q|k0G*?5zpzE2RW2pov(s{P7 z7W~3iR2x~ASAK1N3*z|UAtfh&WKM%xAO>#C>sMB<=~9xlT=tA4PGA}1!FXj!uS@%N z2o31+bjkB#YFyk0^QY9^)S+c6so`6bCu8dBPD9`7LP;em{4t(Ro@5Dv^;}mx!`3`Z zU3_&0yR`)|Xb_AE?kUffraovMaA{7WOSvk2K9xowW0qvjNF4c`-S1fH(hwvjZ7nMdM3q7D`^)=; zi2YCLdQ}a)xx9}BUIrdixbqpBZ7_6~@}akL$&?&R)}r|ijw%a|IEj(+L;VkcWXDKE zEOB}V^g{2iLp2#}Vq$tvLr8JSYb;cHy|4YZgTBqXfv_nH&i1pD+rQ{pBV?&yb+onp z2$=hem$L%I&x!b5DyBqdO8I=Suu#6Ons%xnhJW|iUweJ0;hV@eOos{GnBUu9)@%tG zb8Y$`SO^fVeJ9Hl4JwM5xF%B8w+r@1Y7}t(naE)gAph!_Xa^O~W(tQPqujUnXI4DC z>nYT-tI#pS^!@yc6-muRxT8U(_xvtfuvea7_ znw7?XAIH7OXmjLukYrWEIAb^CQ4Rma@rc9xwwrVOXy3v0;a}{}AK@Y#Bm^T5Bzk;7!|u1~kVpJ< z(-ePcxrac@`L$~Q7We~Mm;M$d^=fO~=8qLY3rNEK>fWzmsTt@`x=2=ubrEVd`@TVj zsBCQ^p-LiFsDfe#=+frb5Bf=KW$ljkc*#@m0*uJe z_fHQCXS7NU?pK-)cz1*lOMvifHlSryDAs8--CJm9cRjYOO}Y9X^w1VO0)NCNSRYHc zNm2E(WB+!3-jN^IqI^IwqWUSQcYCuwU0Xg~O~t`6Le={jwcy3_9FNy{@b5DDf$y{J zdszMSKWP;djcf@uXB9m~gT>U<6byR07fw62G6zdnzwH!o57#~<0UX{!b4WfL1hLIS z2C^~JWlW?~QP?%adM(l22fkPX3n3%fgV5zx!aAF?c(uX;8EY#A0y+zc6qGsRWibhc z{(H79+O!YBe!NQgHs9)>=`aT{K)iOUGQY*pDW6-HtUPXn9A2w~%ie{JMLdk#p z3~~|Ea{dGkVW{_SP{hl7Q4~tELnkEp*@|@ddS~+T^Ct!k!iqIxo=$<%IrHN?Jh($b zu)HP{uPCo6V55=qAtMeE2WMZ>OiPfd|RxpzVoespXP~i@p^& zhlZ|R)_Db~Faw1}9gZg95vMem6wA*Sb{AmfV?TWZmu2`DdK;&yBPRjMddve| zUD#uuy%#J$WzKvvn0H=)wga&r*$}?7KgjdYV}LA{1hQ>l26DNvka4elr7Cv^4B>5)PhvN$YcKWm}-SSt~%82O%bcfu=yCII9W>JaX zHQpFOHHUmUNWCjj8Mtl(*}(Kqc)iRysH3*Lps1cWk?rbIczhXTp_l*su;PjCvZ|B} zn+Dr?UjOk?2W`8p$`^MmK=D9@(SewHTEEkD@%(NLwszfnT2QJM4TvykwZj2&@!woG z6sy^$q<9VsanN#!dedshT8Omhm9VfEX*JvjuEJigu%%i~KiKzS;wq7Recop8m%f5-CBT-rc)f`I zs4U(KzZ>{aqPI3YF^rU&;ilw<6ydma5hPclGL3CscPrish*$m}?RfGS`d($5{NC;= zWsGhlAF3O#)A7A;yf^>M`-Kv%&AkciLR8HoZR8BTX-;_Ti{g%v3Mejod++S*OtBUU zVn)D!Rn+HpScl|RB!K?lJ@+!_{!S3W>(rXCLoLABzO~TiM8K^*$6!+Zs}%qTQb~k7 zIqmtzOWx9x7$O@C1sxq>5Md_GGNXVdNLi8eVWwPNX&w)}@VJSPFmH1u{!;CZhD$n0 z6{PwZ8iVxZL3}TL&<`J~szABJ{v3~w4()sHijJ8XO0L}I7u0Mud)Z|fLci@Y65II$ zKFhvO$AcGm0I&i&0&$jS@zg+|RJV>arh`_Pe;st3QfT56XE!Q?D}_F~fR+5(B=>UylcbF2>)(10s1ufFR(7>vGgVjpKrU_LPdO;fG z>fQ@z6kuB5>nm#4P~@ddmVWk(VV1Pf5klJ6m3?Am zWo5VjEd%T8%W^qdSD$%zv^f#U>$EKctkJ0Wc%nL%8k0YZh@k?P^7&J}Nk;HxMf3rI zoBPLs-X!^zDe3j{357HBO=THx--MWB7Bf7uc$P4u|k%p9j22IxJ;h&L@0QU(=(5S^R)8dENZx{o=?@YB*5M6 z6~c%DCR3MTYb);nVr>^ z_9X7$TXA1y$z>cn40qJK>L{oPFSlTgj7Ymm%pyBY{#4?uQ;I(LH$(b={6apB{NcKa z88HA#%1`ck|NhrTgB(8Qu!YD7zF+L5fwUKOIJ}J?pxa%T(T=c5IcN|ABlN=l)TLaH z;^OWEX{lp}!qHe{I)zSh)JntcuE|q^Ss_qrLLfL|5>s@S4My_?jGJsL3^NIw>Fqiy zwvJMqx)qBdmM%tmlAqsX+Kdot%afnX4R&vIpH6Ozr~!qhRUM<`=GLIZ8q%~PN4zNd z$8`FaTlFs&UXt9K=YLG+Klxz)dNUP<4x*YQ&9;-#yn^#sx}y2E1*VSf!@v7x{9oTA z#Eqdx`L(7S_Y63)jZ=L#rwBH1{(e1#oBm(!-y{_>+(|su?D`PskWgq$_;Bx0^_<~A zRe2~nlw@Mt-~axQ7K>Y+NZ4+J;(fQ=`>qTDhJpg3XcvS2?Dd%9;-=+E&!%PkZhpT> zTwJK~?33SX>+5;qckUu$2>qv*)Lq1~>o^}!G+qHJ7BqpuIWw>}R-95;IjZ67ltIIa zfJFXL=sPmTJ=E=RCB6UnE#@-h8^p*aJ+b=t9zL$%7*%Us2f;oo7PP6sT{Wv3O9J@A z$tk?z1HA~1LZN>Kl5^J!O0PNzuqK7T?=m{BdfSC%F<$Z&w6db+Y|O}Li)PX`2e8UO z*+n$?815j{(g{848KID9!W6pWHI4P-T)YLqs@nY?lbWLhCsw++4ea?3IW4Vcr*i6M&J*`jTGO`@I^u5Bm36!wVHbwsIoH z^V+O_t197WYidl#b&G=-v?l>3Z%cat$WhgvC`V#fdEdER#aO)z zLVQ4LnCc{_UlYo^)(v~&2`u{FR*graW~AkSA)0a7?%I2Pf0^F$`toc!S{HPOss9F* z#!m(G{MyMejG8J%d=q?6i3=URc=><_3`Yyewtag~bTh0e(s(x1D4AW=kak>eGyh7n z)WEksm84RpN^WdVy~0$X%9z=x={?i43xL$m*5Vwx|9K=1R{8{Cf-!YA1i)gZj>dF% zTppMsZL=D7sDUP!g`lCy_U{3~>(f@Iy47b>20@H62gS9&iN+QIq32FDNUy{_Q5Jr6 zd&0=a5I=j>I=1~_2D1*ILQtQ1o%5if6&#Ys0xsb;FBbvJfW!9vg94uX5qW-N${lbh#9-j zYKCN_<(RgULx29P-X}DzfJ^%g&?Dn_^npl3-V<*3^FtB_4)s45=9|_`5Wx?wyYTay znuS-Qe3$em(L|(v|&rBi$pHZ>ZKLn)dUG-4P@509b}GVEN-$F zV_H%!f|)QajigX3OXvi2P3$-OyDjAlsc>P@k#AQF$vL*7adF=~;ddFQO0ZO9>`b%X zm3f8r=Xy;%laFL&(S*qe{F%vT{8(TE%{a}vk2ZUHZVY9IB~*e?*d*YupLW#_9@GVX zoDA34>Ouz5#vuVRV~q7+dkdsX_j1_6V6Z~V^!c#ZOO6KG;)%qi+^=~KmKJQb!eyLC z6I=*LOHz*xC19OhrwNXi4VJFTZVDbpF<~4FOuwzsydv3h?LWfk1y)WjL9D`WHRM|v=Vgxb(>DwFV^dw!DVBBW z!`VQRb$5i4T7W&MZoC0JA%wmzJ>JQ0c#U8<8=%U-HS`Lc;T=`Uvvq$)*{W2crw$6N zmZxty>eh-uRSqz9LfA{U9I@ma2s0*s(?tZ5#2nEDX3d@BLYx0<2h0tN6@y z;Zh)QPYSZNNEZx2Gi9DB3gJe9!-9f90bP2{rneq7aqA7~YK?xc!L{=QgrSZVn%1?H z6?*tOAHD(_nr;Bx!gj^e-}%*Ol^()r*Bn=Zxv(jmjJvrtiTSdu+KM^r2MT}ovQ(4TRn{70B zq}badwgE9R5CBgJ-$L-bKFj7nCrXc?L~~LHDVpw)d2xKu6#z7tDouNK^fEu0-2{e1 zeCGL3^I$}^T14kO#kJV%;t`p3lFPf~V>!<=8}CL8zIXXU#t9PwCo>l4*7Zra4_BVu z^S0tdtxB>mn>xP^)_uQoU@tii2h@V4N6P)3m66J{;bTU^S*awrqVJOjxAw2F*tb*Nl94-)fA0 zrjHq$deU2YDvxZsASwvWhYtPEt-d|G|GWSb)AV`IFGD2?9*e5HlN1+hI*#?&x-TVr z=9%3LvF9dhyre|+s@KA|`Y1L0{_w>cvwaGRX^W|3{uv9gYcq_)b<5G*NKGSH&dRjK z#`Xr}Ej9!E*8KbQz^_6Y;0$H8M>V6KJrLA=CAgV$LvlQ6s{F2X8C5Ff%aWi!V>kPs z(}Nfm{xWwxl3pxlT`ui-J9uJlVxkAQjjM2*S zP$aqvG~r82&~yGXjz7ZSpXVr|EQwO+gZ6if>SfQ3^wm-q5cc}94n@MU%Ap;k@f~>i zvjxJN{O@i*mZ$QOK&>))q_)yApXlUL088*pr4LFbCcU8s9Wu)$iZv52ZySyf7Yf=gN@s7iw^j1Gpg}2>tE#qYo z5kge>b>#^HM8c@1M6G}MGdeLEhGjTcMl^ z`A86(FzZvr?^+jpF(xB5V0knm8}doY%B3iwi%RVwm@Ey=T?1obQfrjkqk};$^eDJ> zjuF0DLgH|{ha1E=ErxTxa9C;ZRv7s|Cbb0U6hho6Xxe=u2h&aC4lV+5W^LYVg-)tc zF}lGT0?h!fKg$agf~0eqqcJ!|cdjh52#*?(Ro|>8#jYKzp@RqiFaZx1Ak&8V-EM#k z7^;lF^X*61klr5Iq`QF3Z=HkT@@|N4DKhOZ2CW*Fb}Zxe_V#UOe-|`qR6GWoZlB)n zQ8Qriv&~3mJQ#hi*r;;UYs^$dc@zy-@`LK_(ba0((H0HHkriW-mGfr@EA@s7kSKnu zF#x)fgV<6@hgxCdl-#g$prH7~d7hg^&FTAo$rrQ_OL?(5Muo|n5zSv3|CUOGFhCf> zK*OCyuBV#ozHKpC2r%P6#o4qqG))x!o#%e zfOzXeRBl!3DRl}Z~iIY1a(h;+zuLtfSbghS+7k2w{ zt1FeV{9=qe2_$X{m05xxBou|zD#KK+eyAEjitdd-g06k8fY@cVutXQ zFH1})k+awxuXU^+egv!CSqbkUJZ4qvJkB02MGfm|@S>wakE_%bw@^y$no*2bwJs|e zMBEP4xtEggbL@Z&;WXxa_p3osT`7?vPwA~}0#tx1U6DAy1FGB)M-y{cj+YRfD4xmY zGfe@8u0+!hg@D-=0o($49yj6ufpBNdc%z^R?6sa?f!9Al8u3t5l$ft1U1`H$_cuxn1-xL{cfl zEiv4_!1#d)?4D2(nz8`!*0;Grqg+^kN@j|4(v*U0SS4Sjuq^6}CEV)*&p86JDv!%3 z==QFh(F*nS^e;-~-pW2jRE&E{#HEP0kE?)x3*83MW6CLi(Euvr$MC=2L5KtIVXHQj zy&Xgg7P&Fr=w4RE?Y}&M$hs+;Bfb52J7OSR6}R+%vJC#GiV-S8{rNg}Ln8e0|9Gdo z@LeKgdZdnp+eiKPm!-NpAwIPph+Tqz#`|C2iHno^rNmp0A@p{2|LY4F;Bfa50>tTB zRnw|+{g)W@T{CdFl$(0v$Mt|?=7V|xS2X6Dsm=$#E0cVswweJY0#u`!QV-3{*tlzRg7`Ay`01f0Jg0d5hJx9ix92m;E-WBv@DG13lE4?xc=P?Axm zRl)9BtK-y*{PsnF5C`(l$dY)y35Ne;S`&0YlU6+;+`rXKw_E-nU*KQ(T1~dZ5)Yi8 ze^llF{>jS{H}wmPX4s>%KhEtxD*ONcOlmx$>GJ|AHO~KNMf_`hg{n}%ju%S!x&1ki z|8aD;Csh_09xB)j31a{CnYaHS*Mu8GqZA@d|9kZRHn$uqaD?)aqkEtI*Js}TBfJp7 zdG>V;a1Q`e5ba{I86dTwV`ID)8RrEk&w?1R!zBap_f}XafcM6S#_dDo)WA zY{g1nHxDV$GT@0?(VG(o47FCp(KU&-R|BmRQ~r5YSM4%rQsvU6>zBV3o3cR5f+1aJ z&Y8YP*FLczGaXr1pJau{xRcyaBxyCx3X7ms5L{|NphDyCR23UhEQr<)UE+j3NO!AQaC~XS9o@1v#gt`98{;&p{h8|IK)_x7bsM&(h zt*)T(#q4UvajF+IB((sncHST)q&Zq^Z=%`op%fnD8dWn48Fv94gp;P;0O7U?+I^OI z-FrAWX;Ey2E^wL(z%w%(ism!vVFHsCvpE@LZy0aD|7!V2oR_{>54;gLYfJVxH`^F5 zO`p0Eyg7TL>3%d~m@u&am$gXCP9w1!@*;SkLqFi|opQj|F8XQ`lpL z8jibdv1~SU7(H(nR5*L>Acu97G_(!Lg|=oTSesw$G~SC^^@oI?ByyXwx+;vUF!*D2^M|c0ZE{CeVjhv4W;0- z6o~g2>@=Pv^Peq6ZnvzR0Ad>=n#!AlzL))3GI0hQh1JRZa z7{^$3$tC|m58E;<;?(fT)NUSEoZ1fPw7U$;3-aeMN>Y0u0M~eDG^yC`?UXZTD?@;y z-TTpP8G0>V@fnlJRqb`3hn60k_L_h|bu8yaE z5afy1Kv-cb^qU-!r&zeNI_^ixQx0R=g`k9{Z_%I3!=~PCJvUpX^aiS`LyLbij6{S- zAKAWtYWG9O_NBlY$y0R!&T+j@c6$o8f-u&J+K+T0bP3kh`zsup?;0zCb;BYc{dI?p zhkAhL%Qm0vW#1WTPH7!bg4gNFojj73iw$r;a}Xn^i<=NPWiZ!M*@zFKttMHz445&U z91J-y&OhYTKnY$BhOERbMY`w{=|b?}AIVc7S2g&G^rA4`N4uJTJtzIuMtfa!fkhiM zVCve&cjRHD_F_ohn_TSIYK;I~JSw@di<^t?x6Bb)m(N_k?!so=vr9H(;V`1zz3BrE zQur64Uyr%!MpQH>FeOM79vA^pGE{Ci0Ocl9K-aG0wljivoU|Up-H8pC0X3x5!mNx$e zNd_?&#(ej@y-lx&Pgsr)Kb$Sc6oLe~HQQwKe)iFDxkxS`Lohl{4@#|*HUizXZ4O#t zd4vK$C)m^YT-@gXTpJD>-xb562IO&JP1qpA4TeX~&>3-+V znz6bSuo6TIrO*cUZEVZpxP6IYLRtUx|7X9tY=6v z)Ld4QoZ{&qQtNTWFMQgYbF6A{hfXCLmyba_^M!O4%)bGv|9)C%0B7Q+7P-L9b!<*4 zOA=0W7-Z%7`D0)Al?uU${0O4iZ$!s417+8-zNFZ_)Np;ROo?%vpp0#+cvk%5owjm^ z$h&M}Y2{)FiNgLK3xi_@aX(v^iCV)~oz*ZbxT7p|gt{cf5GAVC^Ew*{iQ>hN9GsDq?O5Jdh(AWC1;d3*3PTN8>9%VBPQHB$wx+0A4z8Ikyqo8i}A^o;=f zP_>fm+5y8=QDIy;z*oWREjE=hBCTwktO$i+55c`^H>{sK_|^# zKO9w@=9UGiPY=+vNR-~(JK`SJ4h^)>w{7o~SN3kHQYP$&>`~HPnEu?$VBt;>PzVh!h&I zlDofll5#55$fDrW4}W_vGJH!u@8{t-%&@Q5SwRT%%R?jNbhP!ct^>kAknXP?>CO;{ z1-p^{7*3mIy;Of{aTn$!JE~nN2qNYg%<}RfKITFf7qd6pfT08=0gCK0P*nvAYk$WV zWq%dOU&s)g(dGfz?)v3uO-mqq9a~FJ9|$)mC$D8Z36vrll*K2jWaM~#p0T#qk9jzx z)OfC6%g!EGl@FT&O+xWBWgA7RV6H&VHNFKSswT*G#SF6bDa) zgU<{S9H?9UY)7d*Cg*gt#@293-=9=VOI2nBV{VU@;abd!-lH+F=?yfjWJ`<`yV-L1 zvczyff?{_=Wr<^iM{>AI$Med8YyUeCsb=pQ_WUk}k}?Ivc>KY8AK#vP;5M2hKFTLE zKG%#f)rh@Kr;KD;tjW#@SJYkJsK1fOjLgWyI>WJ`Al z6b;R1ZSV+TQ^|bhz*_fLKa-z3=!)Tho4kAQC4xGPS3#mDD;{@a55c9I8@7D#AZak@ zWN*(Z)2f*NRen##R*aRJp(w{zLbCtaFlms$Sq&E08WNfDDtp0#^S`+OF6-hNvI3bE z_GE{e&)4azrP~$J3iCi4P{I0xkN^4ZILgosMY4?W1T=~0OZF%5t|Z!Twqd`i=;fN7 zo+-)vI&$Si4ddC2^|4AZgWm^b6o_hK!TM~S%;MJqcFP)%u*JwQ|9|%BU~X24`4FoC z?ln|WgoC&X@7l0J%Q~)tQ9&QC6t6Sd%LRoMjNJ8Ieb&ZjN8e@Ei|R^Ee}q3R+O7s^ z%s3)bbndx3ss-@{^?p1r(C#9p-Cq~$ho$gbKa_8LcywpdzMp>#Z75g2I5049dN-*~ z??VeR_4w*Q`V3qA@LaZkT|TSAjz1bP-n{|zWIxk-U=43=miKcWy{P`DQn$DfICC)Xo?Q8)dV9t0U%o4J z$+RFaKY9RpbjZJ%{U&95VG=Curr%x3V0xF(l<0t)tI@9J?ZdFZulvD)3b>WWXK$#1 zEjtU?vua-w_VXRc;HO{N2OY6E9tA!M^2}@VwaQO(4$~D-7I2&}iWy&M>WRl#j@{G} zY81row=f_s{zjaF-k8NpJwTc&aCS5-Um!@?Sfp0kLi!0LXdxRs0sRkeZyhhfHCKM! z!dvB$W;X%05dX5DVs&lAdhUGF9v538h7u5xz_P;E0#}@uyu+xCNVlKqMLC_Fw+!=D z+;bkW$m5lQXfqe+XeBvBz27HNNeRr0$;xY0t-2M3{gQ`CZ-;HgQ%2--AlMG7)f6Da z?uCLntgg|J_C67&r#w?y{o+)!$!Yh8hrx?TbO!KU0{5plDnw`R~`XWz)-5m}x3Z|wHWUxgZEPV0| zF^yYyaD)8l9q-;?L1iQEt8z1G-fT9NAE{`f=vG#Yg6-IRQM%Hta8iPaCo|d$qY=;p z8qHv(a>&RDqRVFFECv8HFI2fz_;4me`yheh+WlUV7W$mnE)jy-ia}<64&3o_h<2Q*Q$~DloAgf`hW0<|N0YoGJue9 z+y@>!{FhjZml?Hj)Fb zmB8&ArUAEG=Y=ny9~H0l7rU}S=>u@MTRQP|(qLv>jP5Fl*6voa+8xZ={=n9toB~Ps z4G`tOi#h>vq9q^?39~xOA^mJnSNgdpG0BzCxaR` zz|0kr4RsZYRi0n%Nf3ldN6^_>s~jV1H*NdkpA>szXs)gxV$%aWiadbgxdPu=7pQJ; zbTCDHVE^1}4-}>J4;-^ic;bZrjL`bhoV7L6*9#1+1L6;4NV{kJ&V9VL8u1LI0X1dG zP_sb*^axiZ3Irvr^`H)EhWS~Habd$*4X^dc{aONwXhEaID!IDf*jBPU&bxHYuFf{# z#Nc6IH2;7y<3=pO)$gBehZXsGp?+XU`mGn~8`q7=>RLhjs$aP3B#42OfHgD>&=d4Z z%tLZJ?221&@cEs2gEG5WTj2H--|CNlGR%8sRo$}JaDLja=s6d1FAwwqsMx50*BE+) zguQJzJIV#^+M7nQ#sTpN4muc^5rvqweJI8-Hp=K1PwRI3N1;8l#%1rcVa{s(Dm{FCMAbKp-#bJ(B^x7>ZTc)?|)I`9cj%3r+)u58skq3?hQ!JTTWmg3=uZ~ zoh364nS)j)0`Yp;RjM9 zwE&Hq65?gcIX(pq!564$lpp`X)R!A<+o=avH z2+lLHa!}}+L`cQRG66@`k7-#Q(DI_ACWgBG#4}a(*#~7U1DB}dtT+wL*&Pg#7MYK5 zmCsRNL9Zeux0Fk2v^1bDfOA$#rYyughM#5l{>TPik#93zyAY``wWOJ(>9aL%7U4pa zP;>nNkgc5kW_|*9*KJ>QG*A;ygZ8=0OGT}nu(zuF+Po@}fA22sqq^G8ciOsCvu^Ss zVlG#=o;4vx6vr!A_&K3_k-1z}R4TlL2&5b|XE~ll0H*I0rpH?U=^0r;Em8oM%W3lY z6TKyfn5ef;uz*s4vppa;oZdm@bj3wd9|IX>LiO|#$aKvCaMx;9DGi)IWm_hD-agxE zCguaBh%njASWHa^2C>30a6DOkfdMHntpWj4%_{X(%|(soRF>BwtKp*{DDB(N&}dHC zVYz(QPTj5Hs4F)k`*!yCUuvVns%}|Gz>!&GX@M~Q&iUV`0tRX|g}LBHk5=NF+ZdBd z2q;^letRFp(zOgd?phi2kY%Bg5ML3WqLqdezse(0D9?{TR9e%2mXuW!O--DJ$VcF0 zwHsxbDD#KR00Ugn%LgA{pD3LsN|~(45Z?N6xu7q*zrH>jg@K8VF-B)Ctu|Z3&L17(KbccF?~6YhM(cHz zuIGA4Zs4)s>qw^8Vn~7&eto$xYw8D55uRH_ZYD0=Msoqz1UdjjO?1w^n2S)6_l4IF z4k)8&-sN~@H!45Kn?bC3)>FKC<`;a8VBoKercf96f+KQ# z-&cKp44AsLuWFL9ksSG*c`dqb{8g?yL)D($QHo7t@uv0bno>f0WQg~j%Eg{E5ohXDN zo9g&<_dUkr`bdw}GCDLbtKS>3$&-%R9OMIGpK@f-(mX_i*>OTqO$gI^y6kp!jXP-E z$HL2ooef8peaCiEqflhsu2LmH1V>@q`#lnONAWZ(N2K&d6*MVNL8<|yfFXQ7N6wWW zx>i4P7M|y6kY&xZe zX%E;-C+Nu|{VeLEM^8T>-;Nrjg+%oqdapo(u8)>p#Y9Oc!mGl|1NV3d&j85c+Wakt zkh)L0Igxp09}&Hb;f0AMgRPJ|*dAL&ZP$DY{0{Q-NGQtCt$7h>P#8t$&p^H6sNtyy z)7T{gmxrTCd)lGkjDcaYAC=iHzvR;phB>v?W#5WCa}#N^JXj=Q1qRbw**RJWRZ?np z8A^Lz@_5tFi86)X1uROwduHq$gFw2fU1_C_;bJ}?UPQ(C-T&}{(;*`9aAwygVo?A6RQG+};PImD%xrLBb^QLJ0+R}%7Jnr+GQ+tKq zFm4QgPo`f*N)WCvIDh7~oSG}*-DW%>4LM~G&_0FrM~DJ{Whgc$XsF7+iNTh``~)}3 zK6@=CQ(xWB#1+q<1)>TtWA~%g%yv4qLb^A=fGv0lv@EL+@9Tv5S%1`+PdeKpd`hIA zQw9v`WSo8d>XOaPiEQpcl&dqrHu1%&1-RZ?3c=IBc1~#}VS$I7?n+j05+Xnz7#yC_ z@-NP%7TN|qy@Y3SCmX2Y)7(PIqs2$qu?P##YtX`31Fi+E(9OY27tGY|N{#B36Hhzm z2&5!B6gp!LWmTJz$Jv7x&P>^U@hunt5fE;Sp2aB?D3wf&jbLLpRGq8LP2teO_3Mt#FDlIJFY7%UYwe#a zC<a1|)7I*WSlCidw(a`vqoSF7f9x^0^QKIke4tnn#*Y^a$Aiu?=;FcyE$`OHQ^) z5r&6;L$y$X$R~{hamI+!6+@4Z@KOh9P+Ixi)z~c)CL%~%)QsJW67E&_TGo4$=S5Xp zLy_Sd>gUq^wJTFV&=CHtLUak>wI)}eotW0_uMagMMhk7E8bMgMW1XcH{=XFD=xl?Byq~w?T-Uv-n=l&v|rf(Z4Vc z$vet-?*m$XxTjBfD6=VUYF}3vb~1f{y<@<@f}1n7cPH;xT4CEGQD*14f>Wp4q?uYv zP69;X)_LoI2)+XOVziI@>{(87_73IOGAM@u%gm2FJ7%x8WNKQT35Ygb>~8`R#+S8j{R{({2R)dv?107tooUvbnVdFJA_V}|v}HL4v2SLs zE)5pZ$nuKn2#*!^|Mr|r@SnC)nPyi%2J8Ld9PbOM|1(UITcZGLExY8q<+%$1-H6hk zguH(j*s!e2?UNT_Z8>LhJ8PNkM9I{vr1B&l$KR2z7z6}EPVq2SlUQQH^u~Ejrg{})6KwOy%&D0IkOmBZ%CV4r?0HhvfL)lVBK+-@|K)2JD#0|PeY_uBFm(Pa?(uKq zT?8R0n@kf3od4wv?&yJOJ`t(^f}uVBi+B1vf_eGMWP)Kt{WnXz5G|H)!g4JglMw_b z+Eq;ai}jSx|GyvL1e;1^Z!DAj?@Num2e(w-)TeZDrvJ}_$P&ivc@S;>Yp8}ng%u2S z?5d#Pf8?B4>%Io;=d#Dg|8XN*8!^;yXcv4MV5f$9Z$t;)`h9yUI{plOfq??1#ug?z zzxnO8IBzVurCP)m;~vLM%S23FY+wzgbu9<14d+50ltU7kpFs)!KJZIxQ?6< zvlI*=VmUR&XlV%pAtDw)V**~~xqgiKaL=DImr87M82K#uvi!MRhbTAKrMD3mi-Nwr zbxa=`*)B%$<#7yWaGc}CtlYu>{sCBFY;KVY_RT`5SPqqT#;2litWn z0oaRP1F?uEZ#19EHOyuZ!x;&{qzV+b6&(u75(cD%GbISw1~~CrFYZnMN9&JS%5i0$ zG_z#XUJ ziN!&CofMznAStV1{m`R?KSVo@t64*^WW!Iq_Cp=IR8Tj(D@pQ741h&Y-}`dF{=9mpV4kus)(3 z%hiJEKC&_2U!$BTnX?eLZ_*?R6xU7QH+~mR@i-lh?zj0YpcFs7Q*1F_3`S$il9Sqj0^6-K&&d`qiFvNe+ zlQgFX@hGcSc9g5iyY;GGc0;n8Ngh9A{@W)9qYSl}$+>hj&-$_kQwlXsC}OPKvoVR9 zke5A$%!KeA6;;~Li`p}>f~)30i$j0TxPZ=i=VGstkachYgw^cLMe?7dL(`wo)c7S+ zN>||zs*^QpTrGs%fb7b!(dG&HZ-<+tgTr5wyZDj1^&P^QYzGzSom6UkpDXYD4d46@ z5B15jo)KzzgalN(k8}d?nBnzn%B*MLmOQ0?U%^q8;WHK0gzU;C?^kfTLV`DJYRZVQaQ;H%;JE&a(9pWEy`=2wkM2q3`u5eV4 zQ~kPd#=^z(_xt{w{GIzEm}sudD@Q7P2_Cw_!H;xWLYrO?Fad?aAh}0uf|`~2Mms`# zb%1+NhXGd_&V?c8Tv+6e8~$DKo7sf%yB6J_?$BS1`{G5D@na|20W6rPs$rdZZ0|S0 z*&A%SrmSX^TDiA#ZT}R@d?UMmRTn3Y*UEfDkH4}l41q`aHkIaTh(E8J{y5p+_FP31 zi{i=bu*m6?+0>sk?Y0G88lxu0g8zJ(&h3v#v_nFAD{GfC;oiNj&}ecvO0>U%SFoaj zk3CLzI`yI5M;*0iCBKcnn6*CztHL@;lyXwJp|2cbQ$|32l?IzN%KrWx+>8qID}QcI zjDZGc3Oz&Lh@ReDkf5U6mG3}+7SHXzmK9+F}*HFmwl>G*HQk%orx z*e1bx1UfX&sRf-_K`FR=e76cY7`aAA!TaK$3IzYD>#{Ds`sB~Q{3Ok0*Do8{XCRF0 z|5GX9s46BrPXTOaDk(RYe9-FOQzdplP-ZoH$K70h2W*C>gk5$+YrBA5$-kYj3(Ldu z5ph!Wj47oyj^pEfo$4XsfRBvQyZbic)tEinM6RMg%;QS2Jn}57YMG3CKw;}5;>K*s zg#xkZ)YPBeg?ly9bLd2Q&4c*f?}e4ie3VaqU6^M&$0Om;<@TG6RWHDSsYNW~U6_~PwV;?cQx zyf{11Lklkseu*}svume4=Ul5s9#wR6c#TJC8JH=2W$Vm(o0-Trjs`8o*wglPejDJ+ z7hXWk`xdc{eUP=N@H@5nXjitKfmGh)RkRu}g0E-!x8o88noTbw&SZ*Ter~XbfTTnN z6h%jgp97EE_~WaHeI-Y(9Y8@=nQI3~Vj->r;&{ua`&C_4#T>t%SR76g2Vecdhg_h4dIb=K z2MT1pd0K`0>!&EuSAP80pq(?mHgzEFpZ74Xzsp4?+e z=>ua{a-Y2>Qq=$wAp=Ky6D;`~nlDm7+GWD7a{AZYwhPSAP7hLUVZqm4^Us#d#eTfZ z+Ee((^Buxd%R+kP5I{W}^vATuP%nE(TB6USZY9JnTHi4xe>7boT?O2GSc2Eg1n9Ci zJ88WE*RqD^{q0Z%-c!kzmgp}Bb3Mu43~_Yhv1@2n0+8|WMli;39no;2Y8IyV=E(Vu_qB~q%dn1#TTQOzQaIDHwetrS`l{o?ZzDd$2h zbRG*0W2qJdg6ji*-^R3#PEoTP#qCMX$17vyxf{@a!-|Ovze+$Np472SvK01ocB8Zf zJ$G>6K)iJ-5O74{lXd9bjr4P<`TVSR_cwkUh~Rn=bfbD135mnV!QD%A?*e@Q?QDj= zJ8=0B!!4E*ri9KTJPD3)n^Gk0i!KwdEOT7jytT(XvIPOO$rL*Z{g|+>q>40xYLNCQ zR7^b4dF9|C)37>j^CkMmfQTV2%6i~FI?AqC${udH3C(j_<~3W}!NokS$xGOKaqBer zMt=Eal|Mf+QdU<1JWG9JSnl)sv6blf$Y!R_u1=}lieht@1+qkevlxh6O@Mq5(lnJr zdT-*z8p9b;5um(()iHEHfQrwO=cM=Tpk3uY}PAPZw`Ulp>+p?;H#dv2my`rbHM>mKrYqe zSl3kyzLq-?NNF&)r|iGG&oi^MmMU)Z%2*vd|kqeC({Yt>o#X1!N?pWt*K`fmr}s*Evkib>Ba%~y9K zr4+tK^~5!NH*Z=N#a@=}90u$7e8_5_ zA+?)}8OL@uv0&~i%@5Wm7Bg&S9%LpWE4)s&@718akmdHB&-LurX7D6~YdkCydavK{Sy|s}KRRT^ukJ;o@-TBl z@w8MuWs3v&N6A;)k3?91`{c5W$%h$_Gu<<*qOAz`xMdpVDUBSnLnT|gzqTF}#AJB% zH*A@P%mvRWcz+nIOBT<4THMx-)%p}FdK|xN3g5Q(j(;EF15&h^}Zi#Ke}8iQ|rdo(j5?X6UyY=m^LZ8?nBmfl?LXN|mhJih>|Mlb1^x_Xki zAV02qKV3sR-J~^3=jjuI(+0zg{L=2&CT)A{wLhjR7|RFb{t34h_8!qcrjSIxKZee; zK6AIe1SXu3IWiXy&hig^$}C=r%yIo_NcCdH!{wf{sjXkZGGDNvSIl53CmxkT^+(q7 zawFy6KrumkA6_|oLfZM!+OtYxJIT%@&LbyL_Dm;3gXJp_X{SwI_LVTIZg|hnsiDH< zN*Y2@>bMN2{>((`n|d?$$6L)2EQ5|`brZ@kzC9FZa+-P4@Z)bk@MA4jXI}&>AK#0o z@KqZ750(Bh^p-UCC9yuI`}~lqQpJEopBe%MDBH*y(vLIzYMZQR8&U5QhdG&p)q6=b z`LyoF4L_d*p(bf7XHDUI6E!__XQ!K?>%msDHHoB?N(1+;3LCbA)&esPeSzvk_F7|B z6!NO4+~IeN*<0t|pvQf25Vcot7Cd$9Y7sXT?-2`hCi)^ADj~>~urF|7G&LgD+foi%r zJly`jbo@@k6orRLKYP|HAMG(6FU(&7nKYj%+t#XUx%n@^X*=Qb+`dJtJ*dh5)Hn zFS<78H1fnh(IH;R`ygY+?c29w}+Krk}AK}H&pB$Th=-z5r zmQygG>-XSBdcT{^>`&`c)(El-*zD92U)NHW#_YN~osi$=N(9Tu>GJeY*>e*UPc~)ot<8{Dvd44UjX4+uQ6Is1HegC#D*S4-A z2u$dz{HowVK{TUJJfWTzGFP_+2Uc#+`W#2mT(>z`e{vwl#S&Doe{vidx&hAia=ZYW z7a*rstann{UynZlnGkO}!DptP+xr|L>I|o)`5?cKUN$;3n6wrbUWhAfcxRyQ^{bWA zY}fs76CHS0?Q#tv4@BJ@7DDZUAHNWUjfZSQ+Z#CIi; zUb9A#=w^yZpEqLCg&lP;Z0!CH&@d4$m)siP1j_BA0Cl5!6x4V)tpRd}i-8Th8~3<9 zYb@*<+F<^H`^J2?hr zv6VMj^ytw`l97*JshRhx%px56AFHmbB5LP3#@6g524=5lbIIbO*9A!{ zd@}xkxMHLDullrjVdf?K@yf8!lPCM2rQllMm1AU;4(e> z>ITIAmV!96K;YOY*J%x;a(^uSc!VSi!!N=F+4rCMmsHYNyi6urGT|pK_d7{T@`5BL z%4A8`^w|`wDw#v-(bDi&0YtXjk*yWZooYZ4CKtnsP4q*?{#;n}La{Z}BJ0~n+%pAZ zy}yZ^wi{1C0JuXx^&J#jw{aYuazXb}S3nKW!cuF*O`}Q(+7yRYd?Wb`4;MTXa%xwEx#CXG8oPI2LE|`g3+3#A@Xl+j{Pk5ANbO5OUm@C4E!? zSj&D>my1T>uP^r3C~n*P)PmG1ObWgmYh!L!+hAq{9lFVHM|7?w@Oa z%?HsGlmh*hs;&k|j4JVAw2^0{Fy7Pt>kmMUql?$U2RjMjg)jBT1$!^ZT8a0kw1y0R z0LcfZ&CjRm{K&pV^X-g``O=-bM%=aFM6$ZArqTl0?733T%7&XV{2PZf(R=GN=56Ud z*Lo2Jo~|jgUk!n)wlXF2fNjRcvpI-ppH#?cNegDC(Vr^!%r~h9e_{8r%@~^-)2GDF z6TN}YJ5}@HVZ90mv~p8?Nq?~5WNQ#J^W4mQ@+`&UAGb&UYmj%kut~Ds}0!$FoDKuKU3=M+4iY-)B?*w zODq23P_wEq>V5s#)~1SFX>p^kPn>++U<38U1+@>dZ&{OQvgGL1D38kh28lp<(>T_m z-tfb{fsocf%4@}#pfb0hp7|x$RQvv48fM_AMol!H!)A#ZGX#qseHl|%j&OD}$zE>t zT+3fO$RUfx&E?3kYI0~#dg--UZfU#1H*HY(nd>eQk)!A|kkY*^R8b>=G2?Yc_^0`m-wKsFAH*TVOInfS? zHbFP&9}yx_)2Sc0FseyLfed>%vaw%Rgw1aao4Db5KQ3@OJ6<P12X+yPOcwyCCPBQF=--HdKDN5V#1adA5fb*SxC58$;;X z*XP~`7V5WPTg%pYnnNA|$gYEB(qC=98#{#pZsRtEes2>6ZHF`Wa1)B$3)!t6VJGa~ z^6A+gOOrv3PtPu*ObZ&_f#{A4<(q55d$MrHT=w;|V|r%`dZEKIax~{@_*=VZ40jw8 z4XAir>OHOl$I4T$64crIs7BFsrW|;&*JmXzqA!jnLKJ9{d%r(rQ=FnrhTr2wK(%Ng^W4I)- z=$z6EC1DGd_1M6OGn7f~&n5*>YkRy(3Uk~Fe|jWD>QP)YfwsZ zs>qNj$+t;K*sf^W12zq;Cz&%~W>%rL&*NPYonu+5l5X7UluRzE<+Hx$_=#lh)oYhh z>At9;NTHbyD?3ce4kc-GzzHiflMT;j~sMF4u zaMErc{X4Y)?#u-%epj=X_a^NpTj6E(8Rz=+Ws`>UGrSB&!Smuxkpf1QWz!lH<$jjB z!$^gIxVb_Xm{~Z!G}$0;p{L6lGxWJr+zXp@J%WX+q!@P zz)5*kKDlpbj^b{8i}gF*n6;1VtBEx*gdX%EMLxt2L`BI@b7Aw+f_bAzQHC`kp zR;SI7(&G_pLvH4!g{B=TJlhShyaZ^WEkxa4A9GGvZYbY-O09OA+iC@ehTWEX zNW;m_OPHB*8rjN=J4F0Bj6!7UHEkhlt4<{t-`H2@mHs~AqBA&L9=l7Mj6adE*hxa3 z>HN-i`g@Zcu7uL(%S4ZMC2VHf#_vW6H<>IOjru4u+a`%h^ zrM-{P4eQEnD6&!UtyL|YOrpkVR?FG2K8yVMNz`Py)dX%v{U?rEC=@H%o!=|e)f~E) z=dTi{F>f>?)T``DO5u7*aqYW&C&v$K?Gk78k&tgjqB>`hy~9VH&t5X@HC>Q#CKy#H zh+I|qTkd@2($RmW&zI1zx}Cu{=TzeJ{Emo>0lpmUaS!`MwPZ<*;U`>)4K0rklZF;M z^v{|9%_D2YfNg6OE`4gQ**i%k==egbS4{3DU)BXwKn&Rx-+UKt1cvTg`hwSWg7YTL z?r%3rj3E@KWXINIYc&%Wx_I`kPLCy2xbx3ld9Z%W-`45pt4DNooAp2LgI^YF{PVHD z{HaNP#uws#oWS|FNb)Y0&V+21ps&6_aa-tiP9x}S|;gi8L^ zHT`d4_zuCubUGKgzuyDD82w-VC0KW#tGQw&{kzZKH}*GQZhu62V~a8%^vW00T$>w2ptvHNLr1|!*s>r zqe&d~iB-+Js-fJp;4Afio}rE@tNv;&RPqO{8$b?*<;DY7AVtu74b*gc{Rdgxrc0M` z$Ej`dR4sH=^);EyL9r`qc`s;%G#vH>wBXAcaaGF~+McS!NFLgzg;o{;1xWdF_aQWp zmw7mS=L;+URnUlUDxomz`V($Np9R)q-xl&U*Oi)z1CzD8eH9K~;f}+uzE%y6yE#s8 z>dAlzB_<@-SccrL6n5LOJzj~g%paAuvn#c!4AbxHS26Pjq9XYqdEu*;U(XR+-7zDA zpok7GGOIKNOpp?DIi+ba5?7|D`L{F2tG%PDRPW=EmtGfRD8z2+Bi7e%2dx`NJkZ*CZ`g;3*+-ePz#vqe-v??` zyJkrPmg?mk>}MEfx6i|+Cx z7k3^VNwF{L_QFOK^9`vA^L$bTyJW8B*kw}frYaOBiaCY15`(p z_0y8)W=6G)HfA^tYDWHuP2`>QjZ4g2VKb`giL#n#nyX{g(hExyxCUQ5sPI$-&p4aiPPR~0br$pEHc>2meD+%>gOquSE z*Pq0Rp2u6>i+9hltK8t@Tls!+Ye}}5257fsCVF;_x`9<&6{BQ2BN?#r@ z;gjPGN*RFd+nMx1F@+9rzw=11pRX5cU(RdFym{ctjn!_gZx zjjCt_%<7k?fLQ}YiIxF~uOHcfx>kvnq4yf1^I3loC+t-rh$pbtGyKNz5fHvS-{~%N z-RC_o=5K4Tu*n~7?YrguexsOsDxK1VsJB*!8DSi=FsujdB_s!)BF>ZQto?Agq#bE2{>!#*OaJ3YF+YN zgIYMEum5vQSY6FZEYVC#Sf8}v2u;vRueMI7^x8@}ukmy$G+dh;`bpjDcgE9Wc=I?1 zjx-6TGrb%k!1jE07`;d9cC8YVgVeJvj!giFW_)aY*F%Y4)DRUkSjZf=b3^miJoASq8?6HR zi(OzFCd4y-l@E+3U#=AVtpz~u(-U&AL}NA;SfH9_SQbq0(GxV|o(~`UnY>+~xW-oj zi1V0?^h9T7qJ@@$L&*LS+_SN@h-UpgYhfj8Vb$aO(;)Wmp>}SwPDw!XSRd5`EwX^n zxz^SySV3KOD=8C#@T)NuIU!@|(S`_))K1f#g-%zXG^KNXc8U?yF%kMSj8Xo5(%-Mb z^p=`xh&B;k7=4%%l$ zjK_d|V10A-kZg>dO1?9Rf*ttML~P>eEv<#uu01?F0H89P>^HAhnU~r z7>)0A1yGr#;F(e8xS)MlxB0%c&T`@};_<;oscYcwd|M&a`%1OQN!C2G;A;m-$%AW0 zG?0?+fFRY=F^+(4D&6w%q(f*dL8Hv1i6-{C?vj=Ss!1qAYd_ zFKZ{P$6UmeZ3fdcZDSF>X}fQ{HmiHb^a@`Te(sIqpQXFG9RuB)<0*ItGvFTy`{vMY z$6wuUlEA+}3N+mFH&78!yQ2uvi7V#ty}K%t|~)^;Fywq3P?j?Z$VX1on3A3 zSOq9ueVnJREHZdaa86rrtw%lIWvxdksK!OFn^)G*?Q~$^G8Z@1(%Rx+;rOp$;v$?~ z%C{V!iOFW&=ZUlkg+mAK8Jye%G9U@wJDrUVh+p?IPrvoG+WDo-G-N=x-{M4R*`<}h z<;HE%5#r5>%2CtNW6`P>mGism(}i7`=L%D>_fomO#8^o!J9*mrlgDanY$v|;7>(vR z#OT4qGXGiXi}DRN^JbU#EC)WSzNM>zpIFX$56(GS_=e@q1V0@L_d0uxLJj#Ao#Y0@ z4u^T7bvt(&f+!5PPO2xV``6ciLNttoyl~WT|}~a1fyg^MxGt z_qy(DM%P&792&m*mEPFu&jTFK8wD^l0Nowk$Oz~*3l=t zX)1X89UAdO*lNeJKot!flPeGiV)dYO(mI{r87NDP7>@*GPIcf;!*tri1rM^c3+oT- zXx)GK9w5Ewu_+m^6@#V_!WDi*Oq1!|-&_~22kRamY?z`^_9HK!m^8__cK7mE$$*`B%E_kK6)ZV{ z;)x9|ufb^TJa_G=Z8{-NDlw4uIugs)};fkx>< zh{S~H2WsA~dh`+vziPw$aHeu4rmP;wml*>UJePj=;qy3*2%ZI`c7u-+4%By)fi~ZC z9w@U1q9cV-dVEPqL|V^3D*q0iMiPJ20j=vf9s7x{xrTzyUQZNd9M3jCd_Blcosay; zX@|CAb}aGc{u|n&^ZJVUa5&tlAN2e1JT|Z)e{@FcxFrs84g@nWndt8L-N5-*bumq# zGZ|c9EzeF6XYB(m%5#7L))(fTs_N|=p5PvS46483kw0`dfnMSZv$fcG0~hSL%b=PyS-(238-^sTwn?+kUDtsf-&5AZ)v zbVbNP1g-CQb3Vq~9JW-Tc_r&tiPP(~?U%L@Kzy&t3860}0~x9MlqRSmSHP_01-8Aj(9F5<8{wUSEp5w7y@g@B^LgIPCPFtbDnFO7 z&q&>oGo0OzNRFOZKN_ji$Oerg3IyvwY6L6_(sSGDB^!>rf%aPYOigj`3N*uNrgGND zk_J-cYnw<-73Hkuo?(^C?$ypgdKV(ud}Ag2TPUXh=SpvkA!lcc-9ne80o#yNs=CsX zy9X$cvwngCC7rDq(_o8MtKHer3BcNIIOfTRvKxKz;7lrW{UHIcW;-mWdqV0N{sWt` zVL{)bSyq`Dd36mu(YzI_8Gdg3sF&|l!bp=JdG=`6@>QA0I2cm0Yv_!2Tow=oir!(< zE0>go_w)2zrC(95t6o;d_vGU(+NfAFgJDxrj{L~{etNQ*&W(hg4Wa`?j(q_JT~Fi0JYm66^x~(x4-3?TRZO#OLlP79eDk4Wr0UO zf+bAkRf}pn4m5YIhJen<8y&TZ6&yJh+7EZ(pCTu`eq_!?zKg{_l7CS6D;#Xm%48G! zAX=v>2AETK{w-9$a$`b&jW+1qK0lQ0z@PoHsU+F0G7^b@t@gSEw82l;#kZ_aV0x;A zIe;-C%?kARk7XJoF`dp#bN^*5u4Q8jgy!bcERU__4nM?!6 zu-J;*cWKF9g{YG!Xvqj6YC@w~Sc3hv29!AL=Lr8}ymP;Ug3I;UIid6)b>yvdaQsVT zK0)~{HrXFO4SG|8!rhh>=ev#HF(aAr`fA`qoQVz+k^wB7l=Z>JmxG&U_En5TI(DCz z?g}rX6lSW{rp~=O1ve9M7HQ1)a&ODagx{L5n$KXz)}h4qIH;Z2eTskVw#dDJ$}~}C z@2a9}TCv_HHF%4AKlcW^p%QE0LlS2cQdk%IBH__@y)yTkAnHl@c6HG(@{U}#R+9h2 zyWx2+w)-N6<9W(v=PcH#ZQ61N)XhjlhbdliMMw-d++ z>AG*GYv~r7hIxzX-4~LGV*HLR?fpbjqj!uRKI(70TzlV6SJ`?zxj=(K;{3T98=n~WcX#!$Wj|4MU70k<@RFVRxI7h= zopz-f3t92_UpR~FPj)Rn8;E-aE*p9X+v977XW=n?h^PyO`_0@DKC&JqOh)h`hHqZK zI((Q;oA?%=H7DzNFJdoUrD%!b31#tpE|;TcI^;LeAKqVSWm!mZn7^lr_pA8uc++x$ zKr}B+T$@4s3HkeRW@b;ex>>QHnQzsOi(jsa2VQo3GMDypa-?vyK+pcy6ZfM%t8bt$ z58)G>YTdwy0}2$~hjuZk_vD}8&ZeqYoi`?VZ-$R(80h#nP+``{7#sZa!vz0_*}yFw z79I!>GMC#CN`UL4a$*NBQF>b4!N}w${(_K@Fcq2Pa~nG58X`--NpX+~S|`byvCMNt z->{e}u`q8TcnW=eOJDlwHSw|!V8Im9evsaMdW3cT=6V6wjO0kLJVm!0XRA`eWViFZ zHgCyG+Bq6mJg8N*sQI$)-Hv>g_K69XOyZN$Hz9+rr5MT?%C@j1wlw)KoJK)og|lo4 z2BWik#v(_LaL0+%rVHjM_yt+_ecAOznFgD-@(HE zna=-mOI9L_6Q7Pjx&M(Pfr6XSY|oL8=F-MzCGC@`uglw@9n#%EBF@6HBd3GOE7$5- zc2Ie#E;iBdTm@u15s5p+HnVdE&9mUlpT^jU(Di+aqXWz%K5Jxa*8?wG>B>j;6;@!vm4!p@a9kbO>_<@W!WQ{L<7+CG7 zRjbohm5^1GT(cs+-pMGj7dzguwqNdha#$?#mNc&&3We^g7^`Mmgk}uEooCMi)I_8p zGH+`fEhp=J1c6417{?Drwp^3@y6Jzlcq}mC{_<@SalG*@$AIG+js zbnf!qhT6y`PVSz;gu;}XaHNpTzLzuXNmFjf^2(7GC2U}8V)=;Yb~Zzc5TyPf#|BZ{B3T9TZLgzzxv+IjrZ!75{vJi8v>C`?`OtGPZ^lV-kdZ1^oFu0JN|Z!?@(uvHj4q7uE>kKCLa`j;9cyjmo)xOi{7hyg#s{dGbPm*1ivgS z_m+*iRCIXS&Xtpz2_-1mra0eMEo--2Hlbfu`Ks_%;%NQ^=ai&K0*jF?25L3Dl<)Yf zAQPV*S3=E5=;?J++oekNb>Um6<=gn<)X#^dGR!FX=o4z~qkXH$HW*20&zObS3QCm+ zD|a)jB5amARPo)-Ipwdzl)kOgSyYgc`^Y=Eo}XQg-E7i;uTPY8S{AT0?^1R>CMG7n z>GM~=g;XVB(@TkMye1x+eUtP&{F!%JZ&UkTrQpebB!8fm#ll^IZ)vX0zt=~bqsjXE z8lBKHrv@X21^;XbhZRnWz{_|MAMKp*=QDx2@Y->;ufcLyAQ=_Cyzu?xNa_VP%}}l* zY14agAMLKuKgki@Z>Og;M=tTvmqjjrbRyXeP^BQxjOH{*$)1xkVmD^|V6|@@wZE|` z>MjNl+ClnzUuoT2{5h_0_U#l(vKiF5%PlpjQi*K`9^=w4w1|tu?@G)#Ti!L%){cpp z_xR*=%ydO^EKjG^o>_vWH<|FM2cRQcxKHEF&0G@qZEv5Qoi#Vm=?vnWDjdTPMW{fs zXG_bEirIrx$+}#;r=qrIzfvu&WO+R$K;ih>2fg=X-!iwSs4;(b$t|p+F}Lp+#e;+K8FpZ zD|D%Mh`x&t1m3us=ANF-LyjHFCN2^a1#o64P{TGTgLHzQ`U!ijr1~%1_(bT-lO~PuE(};m4xstm^~-Wsg10> z*tb=GVfEJB$RKD()eS*FC z`FiHasqVA;b>r5URZzbBHN(MSv^0<0ZIpGHs-EYIom@X8G0jivnuMf$BpXgj&vV^6 zXB;A$A)}zny7i{KK2KcBIx|M!zOg}0;mie=7pcspf7iK9Na{#o`ibak(N>JjRF*%$ zPTx;4cklU#F^gq6?h&nNv5~({ex*Wy>#hTtEhsO0DXl$x`4}s`{1JKR*2C^dsZ8yr z;+#;a>kFjukAEp-i@ga>@k_yS6esi$A=k`Tle6uZru5@- zvD7ZJv%!5vnTWH<`UGw?d%!&^*+v`H>*OiwnLezP&+DMjm%mceM~+T!sJY5B-w*}1 zU&w0%?!&Mg$ffl8p6}f_$p@G3+VGL3ywx~I)&$W?}?k<5tclRMB51rCT zD%}l-M!Fl3?vie4r9+VJknXPS!8D2R!}$}cOHGMu z&o3eY`xVQo6Q>>ip0Hk(YgzpxMz6+hZrJ8~l00q49e%LKYx77=9EGb6<%t|staJ`f z$8YYVyK02S{HC@W?C15YvN67$GF1lOF1{+KuakmxY!Pd*!2W=pcK~4bPMLHii+o{x z&jZa|a*r0+hrVYLe(vzAy2;KSoS)!9PPf_$^{+JAE!r4*CC(+5>I0T)dUB;8K zD#5#Mf7J%PjNk76-oZ%%^n<-EzdaDuo3Fu@Fu}GSCyjv>MNjDxb@DNcaW8rWmP~Ym zr0wuDNhRH1dKf|zM`!E8MYQwth^#VDe(f`L;J_C$an~rkCyC$ zO==T<^6pqpXDs`|WzwQOJUIUJGa{a9b+Hw}WH)Njs9NnSm~wRvbgJsN8Cof0L*C3R z#<2B~V#5l}^j?vyyWOXXIP{6Zxm^5`XmK216`EmN8gk6-8ciS{MWAP4x>BRpObtqa zgo>N(Rdt{VoRa-Mx6S2|nf{O8sQT%aJmoxI$WgfO(s&$Z%@ti+aGCEnQauk6-8IR} z%)gF|MNk&;nsvSdGs%6=?x& zN@E$2F?g?riRrjAN|V#BCAEypls#REOCgN&%WaoxXR%ntXMg@&&6$z;OD6$m;Cr9z z_6PsD+w=D-At(YPCu&8b5VE+Dam=-OnpZ^6L=1_Oy)w}gp&o}c_Pvi^5N=5|qGgy8 zy+u4zwZGKn7B^&)!$Q?g2TK_7< z{e*=%KtUZuagY%as8X+u88|^XTf&ClrmT?85oA4W4KhDaZuL=Mca(i*tx~=4RiB)-yee zL%=g`&Tg@mGyf)963g$Rh(*`3^3A8_hfLbbMH#qYo0F5~mpni4XQPK7rwU)Qs3N8s zvFpkw6J7Zq?M)R?!OQ73I(CP;=$V;)5iyJuwx0x(hj(MiA@k|2zvM?2KVjjbU33Gy z7*b&T9nu&{a@sJ!a1Y+}I%jU65)A9a*zNBYtLriZyybCU}$L-Xh~KrT4gHvqUtA{~@j*IP}|rUL^V z`exd-W{8K&?HPau)+{txdLBqLp#V*hU8|LNob&;=KEIFaS;&9_i(>1cG% zXsa@Q8cKc6HHHtC;-OCVdK$Ts}SM>SsAjVbSXKHqC{iK?B2jNaBPa>-wx|VQdgPSjJ*B(p2$nSM0pLKCwYYZ=$moZHh>ud7?&Ld25@NuX(Ua80d{(3HET@q4Hh_53>JkYi22u z*I#fV{uj9TpSw1K#lnV3SHS{fBA_E~8us*v17?+*E;qpV;qGd8P$IPqS~JDZ%6Edp zz!<4Xi?oo|KOey>^P-;}2&RZdN~$p(7}n>~&Xits1+7*WM=#O>VJ?k?hINB53{TLMW2Z6+dow`pSIOIqZlYI4d|{<#Nzkb7`bO(|7R)w z*PRi(bQ2fjlmjz`kn!33e_U)5=Xcspyyv+K}n!hEpXf#PAj{cy`@twXU(MiMqFN< z|Jix1rTSA84l+9r22M)#x-|Kb zzv;?KJ9U`?fMDk{UM(jexZ{tA#f*tixa;5H{1_}I z004_4&)4r%Fj+sn?+*Q|;s*A{KcL+I{_zw4r6MC@9!R^%p7Qc&DdTKsjQk)Ccx@M~ zi9rabZ_kvlbnx{+?`$bSS&+HeyRR1|!2)t=uch(?<61P2zPy3L=e3|O?dh&HqSLgs zK7L)?BRbXpgJ#|$2>BhpOCFwUY1{Drm^C8)b43}X)>l4i9w_twedy9+rU*X^QRR&a zldyJxmq|5%*J)cp82;($X}Zor`LU+m^=Ks`_TBB)b&XcaBKm*d51Pd4{6TeDiMKEb z&ud_3|KB(I-@mPPAXqBB)dr$(g%@;c&GLYCwHHI$?DYJVWiB$b$Se4#^PBgJy#Jgh zKA8R%f@h0FA^5=-%#JaR1`78kS=ycwH!8IM*#XD#V8(JpQ(jMmoROM!;IkS)O4UnD z*dkkEQIpuYk$%j4nutaJ-!B`%OJa=i%=q!w+097*-p8sYf*3ym78cm+`iKUKc?5*+ zWRgcKX9>{YN9KZnyjDREPtTT_MGp=KnN^SC(Jp$AbR0AJCjm`@eo~u{L%>bjVRW4j zCfB3c>Hf4}rJ@20G1|p<`gQZU5s;B7%}IP5_X>X8ScK;_gIy1L5!DS0G|9xp#i{P? z0DBUUmlelh1c6|9czC?sG6q~^H`(ee#*%B-66lnR0Z(2W3=E@MmIZe9|5;1^UeqV+ zTk>+WlR-4<5o}(AD~%GzvZn5xB=bx6>rFSm<6HQizl;2RgJMjWUF*xKtoGO^Cl#4Ox0tI$uvdU_fkwh724FK`?02&jdL@8*5E@LixhLdy zq#xxdBD;tn2E*3O|2@nI_Eiim3HB0+F2;*b|jEWz2oY4vMO%%!0o&XArf+D z+Zs-iXUPP<#&GFqlDB}!japKDq1}u3aK26^d4pu%Zm~&)0bg;(<*3}<`9G`29v0^M zXsO6%4t(+M`iL`@Rw1)c)b%1-c=K4+cy}(}!msBpyLEhloCmVvEAd^)qAPdJlTd4@ z<(jgLggr$S8X&e%ArOd9e!y1e<3A-KQ$ZR~)1e3tPNkMq5p z-q1bKZj)#^+>*_r9M%4w;14G5i#PPn*URs8n@up^wVlvi9to!M*y&0D$9`>z4_HIM z^Ea$w)*bV^jx&6p3zb$V(JcK2MY;MwG$}oB0D>hXE``)9_0s?)t3(=y`DbALs>D%A zU6{A^0&6lE)BQ=nB7aL)e;A<&4aQgtn5Ws7zc`r|9&!$uOrzIoh1pD65$vW7hz*Uz z`(6kRMtbuzm0)*oicPoKn)$=CM;(dV*{0p@LvSRQ+Z9R)7a@y5DNrzo{YdBe981i* zS9j!NbyFR1G4pex{&wKQv`pJKyXB@3pg~X~cd?YwJ|W8c$)@z z9iM#gv_E4>%GT{G{e03L6nb&^onO6O7k8m;i_Ut!4RNMe<Mk4az7y}OEj0rqg24#$zOAn?_iAg}Er71%U~R&fA~TRI~ec4Yw_NF?XB zo0a_dsp`kmD|q@&cTD9JCHx47`{*n#84yBJZLQ%-HqxFK)ACJpG84t-LLs!VX|@w{Sw(uja5L&GZakejtO1^=GPha0X0ihwXvKI z!o##5Ms~r^P;U$OmC}~4>lZhtrezwGPOHsUe9<$~HO2mrG72pZyl*Dfccl!O<$`0F z6IRoYB{@yRhhntfT%4zm#gHK-{4M7`NIGaLUW;jLGTtYhhm}x^98U03Mh|C)jbowN z8StMXd)&!T_L3F7d7B{1-wsUCLk9_ngEM^$3Gh*gMMC<$MKVV-h3QZ?YAwcSskjx2 z0B$6lZ4(~EAP}L8z~3SnZW8~Y&8^!M)dvW13Uj4H|Y}))MWzby`ei2NVoisn+Uidqm1hiUH=+rhG$x}RGwuCd0T8Q`pF(B zqKOnQ|KR2)3=N1^U5VHH+uVme%+M%$?UeW~`+A}yvW7=l4nwbCOs@+A*47b7^? zC(5dFk48QflQE}?7RPD^C?2LuH8|5+S(%tJJ2HfokC$+pIKzl|${CNvq5W^^!S3ts z1JM+BU-VdYpL-q8Fp#qOS6CC}z-keW+(w+us)HV$@uf55(02GudTm8@cH#q|h4?8(}wL*Z6fTP#FE698- zTk+^T#S{YpbtV{%S$$WL>@DcCA5Mg|R1*)vTcj<*@^a&(!%8IZcS5=Lcp7=tueS4> z7Qn%LCW^`LXJ57cgo=!eef{1wFdoAol!9q{W8?UkHL=)kE-A_O27G~J153u1oWCjH z{)SFDTPQ@q^b?&HqgHKenb7fiAZuk_{!v`hiRm%V4eILiP}WY^HSz=5l1KE7Xzu{< zn-}>rH$cTQx7Q80DUK#8pqaMiKm*=gkBLwY{s_BjFh5663otX zdH-Wy_3bXoZ7aZITa7NlT|Jd4ojkQknT6h6?vJna%6uU6Iz%Tf0er>&oYDjz0EGti z%2+aUmU0@WMTE*W%57>Al%3@z`CoPN|HwH?cw)#zl95e9kYTGASD4#iQtN|X2q94Z z7WFuj3?Y^RmFi=>{_v*0QCi!q2ie}XV*Jy6@c73V->7?TA*E!d<~7Q86kll(Db9XA z{ESy^OePMm$h9b#{7okodpAB=NKKj@%g!4ANZwwmzqkm55Q&6)2y2k4fAjUOay=D6wbzr~`?#Nh6hl^W%n0U08 z@cx8=OD1_Z>Q~ggHOdx71p9+X-p#MC=2<5%zKee%nn|Iwhj|sW2?NJu28>2hCqd!S zND?E6H(~`+Sf8bUKpG9`i={WmeY)JQiakHwIZG2s?#HQWapAO`kDFoL95{Pl zhNcRx3AZ&mymg3peQPg_f@Uu6E;FR~24qxg0?|%#V7Dm1Pevn~e6VE5gs)-I#iam& zNmQI0hKCD^(}6<9T|?=9@-M(EYZ8cOEiloef02iAadw84SI82+lAm)^k(mn=^zv|0 z5J>Ee56|a(nV8{Stk^ZhnFd^@Ubh!cA5Ofx?S`~<>?(b2$2K}~&r-^SkWBiz9Y4K`D!soJIr;5AI4%Z2Ux`4mD?Gu*E$?w(Nl9Y2Pa!H3OG!k zk`$uP-wC+o0?^;*i#?w&0psZn#9v+-2Hm+xzKL0c^(ZyzJL`WpXbM6QwOmp?I>sam zmWd%PvesanI>Rk12q53QrtOhMCyR>6r1Ya^ezEC5AU01G2{L%+gKRp|C!ajkxS|lv zjw|_AT%A{vZz%h4iNKuCKE%8Hle?UqcsJcYO_c(rkyXi(YTEwD2xEnQeea0>XJBwi zaap8Ah;E<6E-TbuwYaOa4(MUHfEX7d4zsWehH^+=;5orY9QP+N2E(kglX=p22&{^n z2e8{@SyO!vZaw2dZ>V$WVRI>9m%I-(=Dzw^l&TjbKLB|ihTG>7{CL=_9$`|dZC${o zf>UIQQJ#Lh*etJ6HkWjmMtP$*2UQOlG>5AwqwY;Ay5+*ju$)LY;C z|32tN|0R3e4`?VLhH<Sn)Nh zSNG_IDDg+1qpyB1u{vRcDPOYo11TlNM}yQZ))5FXUQk(w-9m-2#B?bZ#g91!y z=|L|*8N3cf$8jArY;rx+y#o?hwonviX1byO@-d?z5FN!So-dqJm= zF3oMt{bumnTve#{r@;I>wY+PGOnG-Q5s!xp#S4@;ct{+_*WMb=O}lct04nMg$&om^ z#Rr?eEk(XwiYcc)b6AOALN}?-4}78$$?9RNquq`Qq45;kOp>Ds;D}Pt@w^y3S0t?(rUdl5)aO z8PfnKQO`Z8LboOiKo8&ka{C=`9Dj8<&(e;f;rH`BejXtzb1pD=B)!z)T4*c*KWKf9 z&xCo4gFNEXW-GzoWHzDi5yjTH#Q+O22nxp9bQSl-qaC1HJvd;5Z+g?FG}4Jy<9xbK zla{0U3FR1VYd%IOX)w--thOY~c`X`x>v}M&IP4mdJp&947MS!!VD`k)r=e#b0$W5O z(5;29=z4k>zQR^>S;Az@#{Rc+$>oM!Z>6=c78&G4nD_coO0#*8ktTAuJfO~s(h$0yuLr5H23kc7+e`PLWz^aLKgNRqCLkO&1B!Ipr5NyOE?LrC6LbOlOzK5 z+J6D6tNDbJOY;^#J&U*L>^A9*EF?L9fo5Wi2#I&U)#R=gU z7_)?2()B4#;v8cPo5-JBNFaF>98jCWvqvb={B>Q2H#k4gT1ulMJ-dR7qA^f^q)fs5j+fTmts+$#*2ElN> z{Sx{e7bbWFsI$zQrm3WyM? zFDYJVc53Ws=G;8SFvbWQFJf>^&L-qtxYgNAlJta=vYD;KpHM&=a$|8(`cN|p53a{{ zN4+BFQy>U#XMb@0i|==FaUc1E#Q7sr#MamwTh}@xZlNH=4)?fyGXYl;y*wisw#{RG z=1u>&goc~fZLOBm5oG!8M7+nkAdFctOBEhDiE61yt$$mb@TC?2dF^J{la;eMUzQC$ z(7lJ9+`cZHRD;%5g7HcSppI++yr}MJjSEiW=C}llc&ux2a9LI?d@Au2^GSRDD!0X} zf=I+w%-9)k34+l^Cv&(F#9A;4xAO6UDi~PhTb|sj`PxE07Ah#dZdJzlB8_YpQ`NCIhu z{~`W|OG>lje_$??zt%`bu(62f_qz;EEPDSvQv!$_El?IYDvlT=Ji9*KpbIY2{~nv+ z8M0_*0ThOaD%xU@{n4~me^2LQh8Sia%Az+>jPU5BG-|@Rm7JR!Z&(4d_jW79*C&&g ztXSF7?Vm>|-HM%!uTf5o-HoXveUUd8cJ;hMh1xeQZF)^2@2eFwj&krATeK}t*5tITJI+3=((FYD8Ikg zM|{p=Xw%WZmmPGyQTC>1LcvT&fs%L?g^*Dln-CUXd|~)iYEW53V_o>Lr2SNkEqD$>L3XAtc8U4j zdb;EyJcOaQ;RfpEaGU?bJco@h}OwvuDVo`G|*bI!Lp2 z#JYQQ(YxCG=M}%g4EyAt_c+h?H{Z}EP9Y$)|KsH`02cd8!TvT*#5JrE(p$LRzojP? z_M{4lA16BQM*>3$eF!h(_osa~epq6Xu+$U7%vL5XyeXa~MEZB}C*kM?%EuBb3K;}BEKUC)1^>gbbR*}+CV>7Y1 zd&U)*4d-%Lmn1AT2Ap{6y{Vr4StPtxcy7x_Zw2>XBdSxuPvW- zhxFf%>LSHp<4R=D9IG`SDfWAQnvCoKh8$ow(!MEWdpLWbC&e?>tYhLnsVWKUq&Mwg z$d~_Y?rDp2!h-5Y1`%(XORsXDm-{Jo6g%A}Lk;31iCX6$h=asY+jtYC< zj8E?o?8JV<<44D({E|@tTNQ0K6t8l&dDI{Vk5Y~CA*{V3)w0q=^`>7j&9yR!LN4j7lU*dgF!m+uenA6t4&qQ;P;h3`J2tuA0vP!~+ z9o`pfq2yTLkK}@`QKcGX@3G%}bzj~PmGrUQpH`r`z$7F4SU4?Gl*a~Fau}Jyy1S?L zZtzD_)C&o6p-$u98%WS+Nuh!12Xcc+kMu`662^ca4o7e^jXqP-JTd$tw!1X{MswMT zY%(PrW+F6ijA=cvS%Mb&JAo?La>GpZq3i(FHL8lV8g8s|(>Th*SgDfAv`3p70E(45 zh~3@)-;cV>0m0JK93_$qkX!<2I?dVnc|JCs5(IFD_#oYzEJfzdwA4{r$8tS#Ov-r7 z&txx_w)TGzzhY=Yk~oxs5mi~js?(Ea z7@E8?f;+Jq;AabK{O;#Z@yeAbSfQ5aS>4ztDsz+qLUQ1ACPj{j=y7@-jWn9_L!H+_ z%oaj!sHc!~0KYJTzoj!DPAm_M~%Ciy!xb?gbk zo3}TV8~jw8^aOMS#Bx0puw%5nJ0;C6r)B{eoc}|+{n=%jm|?cJOcfarQG*RZZ~$G( z$coxVAA!$$^fe`%uK(Yq2ZGHV_pd=lF_%jOQ8or6;i~p&HinF;Iwh&d_y9tZ%eMBr z8W*AII`io5JGF=YB6KGo!SyzNU&SmfC#258^ZJYL8PQ}pJ{0q+=FzJYP0DI*gmVtl zH6)5onKu=tMvapBk<=)YNgD@E2ueK zZ04-csS5!Dl<9@{PZi8eVEz4vYf=R2MmMI37?%4uWThw_@c`!BvO*x`KVP!{D-1C{ zcM!t;#a@0)I?UJ!5LGboEgZYRjSu`CNafWd3fvq{id<;0k%=J}Ed;_cGXYB)i`tKX zISEM@v)dm!_TSAKP-+qUMfc+DB2?rBk1H3tZ#ez?hyLvtY&?ndy7eGjdR58o`#L;^ z2?HT}(aL}qj=uv`Zx;&RIDgV%Px+s}??sJ4L?j33`3e9WC?O^W-3Q1(O{7<&B{We7 z=8Y~d3u0q25MejPAT7+{Ej0gn0XXk%UIAD8{$LpCq3?fPTo=MOtd}VetbRu&{j7h# zYI|bXRh2;`@S(xz$oZ&>do@dW5oJmNtp<}v_uGse#o`&*_W_~*NJ5NY zm%%UcHf?6h-=Y$6-u*{7C}BkwBO5dQUNg&%5qZmEw= zZ&94SaXTkvZeO+5E@D&1RwGo$vl*XmPyDBDpg==_!i&aL)E8bLVtbc(`#Gd)W~NJq z9^l=?7feJG;9p&1w{Se8ug#~XBcU_l7J1Cqsi@z`&%dkX8akY>P`m4KiH;7V)xS2& zt`sFN@*fP6gQcR*i3^q4*Uk$_L@!YrsQg5<+BcGt_&dwZ1jMCIXh#~_1;j&0v22() z7$_j4qZb`e^6s|xJVl#wU|#<|K2`=C6|>t!0Kz*ZPa=;mDl9BEf*b@dyT zW-SQ5C9}smj`;8oYNxu%Q!j1JBw_xgfv1Lk;2CK!3*Vbvrec#n`bR^!;=AuE^fjha zqZ<2Qm1ur}eYadVk`q0x>r%WM2UzsMS2mFjQ0jiAVi9&x^TjxbDeVQHJDI1aC+$VG zP<9B0(e3OhzJy?zd~^2F%3TMEtMm4y#Qbfu0r`Z?IBTmxa_2XBB=Hk>}uAZ^*kD<`a+YnP4)f z8-E@Y3{pa=n9=1F?uOhq^#SIJS{`IX^tWpKba`R@E<4`w=^eJ|?~j0L5V8}~sFgEC##|K#D(2^)z#6Z&BH^*9G?X#KT#i%ZAM@| z4V_T`?wK#4?ppf1jwH`+ttV^Y^yo={A zR?g%T2V5FbkbjAbi%%D;Pz!io6r(5uVj_kFmk(L2zQ1M>a$r#E z>ek+91VmS)Y(KNbA2H+31{W;yU#bfxtgAHjf>M7`=GGZ9~IRcu|t)E#Pul=f`~m!%Q;{OisY%={<1PmG;p z&!R-K>L3uz?tv!V#7nJA z#ftk_t$*2bzBy5u7rFsvIhWknT#ha%EA#uQ>}1x%ReV$10eaRyO6w8| ze{dcU6AyLz3Ng;}z6Hj4hBNsS`u10Rcw?>(1wjWCbPu25>Pi3x7w=apBZ+{!e0E+2pUsKc(tA?z2PC_LN6bSaQ9mF<%-9Circ(;x%@T^6EdYqo)*kQ8-uCz{)gDMv)5YlV0hysFTl0PyQjdJa59=l~) z{8z->rL2^@zgpp4c7GmX=xE*{Bi~*(1R;;`cZUS_U6dnWeO$9Z^Gm)p=TJc}r7Mq{bnxG{q zuESPQu6mt}8_UtSTm9Ph*~4{PThFQg@XPgf5?#dii6-{x?!YdbIhyz50#)xNx6OiV zCVJr?boFLuBqOE8<&X*2RhzG?0YaAR1sk%vp_ccP^9|E}CZ9vZdmllK?BzNOa+k+1 zbp}I%?=S32SE}Jq$$4TwE+OGM_KDVeY!LCk-t11GQlLkvGeSh2$55ez@QUPJVUXGO z4L4i>Lp8v-Guf@x!WYU9I8DhQ1NF0T4_u~L!y^fv4->Un2t|bSZPn!?^|f)4KHV8- z2UVSg13fR$?j!ywLlZh3T*!=N0d<8UAnMA$*qb`23NC3WCI2r7&wm5MpW|eEyXL~M zo~0d58mZGWkm_S*!Efe{T=g_ZJ(7oi1S`|p<;~(xmzW0zv9B-{U&5v}+oq|iDvhOa z!e9QL_!J$<%`R!?e)YRK>JHMVr1(gnJ<=;cwz)BT%sZDez!$qk>n*IA-J3pDJYgDa z%NsUXa2`Q9XE7EBWDeM}Zm#?7We~2s~hDHvA3e5R7*iNXkEQnkF#B7omDIQ5;rp|b} zyk1eS-}Sotn2P|rgn`5WtxCN;!~rIq`L#1dy>DbgihF8+P#05nw6&teEDV?}!2iw} zIB^>b0hO0SO{&{L#kqIj-$gIQDFquaolSrQ=5~U@0zfjj-SF#i;*3(}L)L3FGVvMc zWMva%8ijyQfniH7g@N8+(g{-YS*lq2lXdOK)lmvhqAPWVDPZ!M2A_UEGG!4+R!3&s z=)lWI6sv*Pc?tFH$Yx7I!Woni0kcn*j95@zM6thh3-p^IbDF!-*Y>i zLNx^HyODw}z9GX&fqway}|XsUkgDz_~+du-6& z-s5{GxT%7~Q31qISo}H61|F`2U7Q{%=nZ7Kt$7QN^6iEMqsLlXuKL` z&zJ6XQp!WEin{=$F#D^cQVMmaeocB9)G_h-5Bq@O%NL9Ca&E1;YSHEY5(wW@o$P+w z1|GI($R6MIuy@)Ab;eKyw?aWjk7yTK#~1?6Xa)ssX9 z4Si@tjvO)11Ly!ucFeT74m3!zrfuP1SLh-#N8+Oc3Jv8lT=f+!bu(qJG_us@NBZ-X zRxiWB?WF=Lwp>pQb^O;ZpLUnr>g2XIF6=t6Uwi&4j)o{1wEAXwUXp>%X)_WGC&=XF zC6;NGvnauIV>Zd+}w!JNk3gpchC(le8vy(4b}-j8Lm_HIh-Su1FdKm##U zIP6gyZ6AXfG$sjcN?RB;%j2$lz?jWa^zSs%fSKW|H|o3pkT>{ZFUW$n2UXJ?h&PE! zbXwztmVjB;9wJ$bZlCAnSApEkRGY#>|5$fq#p~6Rb2ujsGM=C6q1O@M-geQ#`aAtC z(}cLowdusRQuo+X;wu8-OO`+sAkSrA5*FS|+-0@kdxf79%rSURjVzKM7KHY=@Uv$) zb^ygD8%+Pd&J;7RZ}(1YLkGy(U;*KQQW0meY9aHjG9w- zE{vN^ibT8=1nh)Z;Gto+E9`SrCtK~7WB)Srq4 z0wvggnx~umby_@#t1SgG4=^S)CPfRTjmlg70WZM}>f{@6W!4 zQA~j?iW!Y@c^iyjH9v-`*zC)+^V+f-!9A}qRffd~$UV>-pWEINiO-Z0ip|(e7jaSv z`S4>deT%IJtpoxl0@-A|T-Mskh8@pc;^F*e$G>~(CQ~y3 z7C(OchT(+$FLs$odi6u=G4FR>1}`=F#?WfxA|(`;od?+*+qHSAxPPP^}CLBD0?-5m2K9? zl20WZ7Xh&*h;a~-4gV+H$X3}Gq*`Fnlk^v_PbqPi&&^fW5HSg9Zoz)Lq9PB3=g>Y| z?Z=Xi8t%{lqU-q$1RY=y+vCP#I5q>FWjR05yN=7){!7h|Jcyp=brME?GDj2OO7Z0q*CrJ4;92=}*)Go|^+ zxASYgJRD=y1zw1(jVA(<>Mt=Wjp=K`{2vG}4`$+wxeSH;@>n?w-l(s+Lg-VfLwwI} zO4L2q2qKuI098@0=%^tiG;tsoW#f-tccIm;vx7vi(QXA3NoMMNn4w4K>TpUz*Qyt( zwc~{LVRIweQ!1&s#yCsZZJCO&2RnI^Ld_${4yli{_{06EVTy8iaJTOZ{ktz>)Zjau8{vz(dlsiRrBeQ!H=*n8zWVjwUgHnwX^HyB z_+_e2{fn$Irp|us6M?ZbE~U5M&fIOG16o|Cky!}W3qX=U+FM;!?MFHDeI3uyCmgE} zm|(&MRMIRG+37Y=SzK)iSmVQDKrLsU>MgmzM%NkG*b}^R5+s6S>K0FEG`m$SM3!5hk$anTfDMWQ&}M)+2grQ!c*mEqZ0()#AG?wZCaOs1$2aeX zDJ=#E%HMFgz}=Gkz0jp{?U(DF@07DNzOqLGM;HRX{rWe0tE`|ty3L>fjpwg9zHxFr z`utA)+NnV<=m^HI#k9W>J>I5Jf=M;ya`V=9!gvy}V< z4kl+m)42WScfP1M70bR5tWShF2Y(0=uazpP=1*G1vR_3zr=82RI}~>sIFwKMZISP% zSFl4OM@ysg8$+BLFVk1EyLy^?#wLVx_gC zRtRBdR1f6z-0f6r7QW80X<2+?Uryh~Ck`Ks<#2S3EUA56VzSm}$bf{2g$I=)bf-H) zT96Qw5=kec;{8NFOl#Hv%){?TK4F9y4H8zIeWBQ)5W@5E;T#Dr7y+*dXfP=iuTb|0 zX;f+ItUPtZipNrOh-}_3)Sbpx6NEbAz|vS|FE&>*z8ylpVGRoAZj%~AreSA9#0CGY z)c>3Qs-RenYX?c`3tGjKCe8yoF8aQCKu>hhT=eM|FqWejQlPbC-1ORGw6|Accp?nr z^KPU zS`X2e8p;$nVKS=~g#qTkxEwcSYY2Wygb@Fr0CzP2da>;Q3L~9+F?%i?5qpxknD#q% z-i~y4j&5quTdXXO0ev5voo-fN^x1tKMlJ6W&sAhtkr{q3+wQU+Z4YDm;N<<4RQz7g zko(dO;l@(G-eyMML;mOrpT~QJqQ$p+Npj1KA>KOsy=2$Wf~OD6YVIaBN7)>0bhd|c z^OwIbTjd8midT~A8Ub#d=XO2n*(0$pWY+GdLcX-$TLY{1Z=4;0>fj~pNNfrwDhkmW z&j5|b4mzd~Oc>%@*<6SyRgVQ#l|$NOfqD|(hqV&KV}VWFMb@^#*g5nFHYez~jG)_L z9y0z@qI>QSfAQXep2fwsQNt#HM+W#kO2_8J*kQUszS;f|?*u_Nr4n^P0AvKFmVX4s zQY!tFK~UKw_GW4G%I^zAb{Al3gA;F-a#tiLCtqke#0P8B7CeAcDWPI;?NOfeRY9GD z?_gf}1HE?Q&Wsjz-W&Z|=U{|q5BU}8q>>M=HG?N}hTZ$I)sX3S8PUA}1m%w4$Yd<= zcj`ILBVu;~DpBg57^(+GJRu_Pa@JqH0;G|Uc?GEGB)U;ATD8?;@k_v}U3WMNg7H)< z4B2j0`9a;cJ~LHhJo)*dDCg_QxZ=qTK+XIIz8AAWFa!OHkEiweMIji@7s{b$RTF!V zyV{#h(zBAnsI_1=W!>X%Q+c8*@orGQPBP4Eli`~eRaCcTg!gD{6~zIwZkxgi{Ok#Z za-N<0p%3e4Q-7mX)Mhf+X5wgAK*^Q+$Gz&oBNj7HTXGZLoGsi`17F%EOyOmWwEUUP z3`3Gx=lM2kVNfVqBu2^9R_gzu>#d`zTBGh^L{Lz=JEXfirKP)5q#Nl*y1P528>B(H z8|m)uu5Y7w-+SNp_l>c~8Ttq3?EO5?UNP5Pb6u0GPiqNn@q$4&;ZEVQuD?fZN$ZDb6Mr$rCg2M-m zQ5~J}3Jyp6!D+8Iq4-2EU!6KKYKWs>mdl<@PE+ald?1mj@V@mHqFWk?SSS!?$|qDj zR_N{(T=)}g_US9)uDu)|Hb3w^&JwP(<`e<-_xE(L!MvvMq(Cz((D);TcE&i0>A`3= zE1wGR^<;-pCJL2Mhp*=3Yh0M#<<0Oq)!=6nLEK2B4;W9@dvPjiLF6zP08L!-T|&;e})vX`J?T{;pvDo||cMo~gz z1fxjY03aH9P@>sD9b_`~E_|xq)sNcxP+Iwh zPoDL^@F5U_bYw7D{XU5qHJ6V@)-lASZ%$4IG=zW!E?!?dpyGehm4F$gHl8Zbso3e} z)2C7_@-KSt2n-ff?Q6?}T4Pv0c+6IlBHI%bZi>WlB9D|zTTJ`(x&=5lJ9^SR72!wv z!->>qGD>;!a%ixjG1jht{LEM-wBuUNpZjs7#HZ2IHU3=^&-)B;7ny_h z41lnSkHOBI#a7SFPX{P(t7A=1mnCUQyPH}LCUbQy+@Io#P7g60KWf(1&?YqyWTY$y zgCT|7fG(Tfaq0UN_6duTWaB9_z9}D;&GVgHE?D@5;tJY%EKZwfMi+s%05LSG(cwlE z7x!IXt$XKNmdTB94*B}BGpg&$!v%`SkExNdsUzn0M~fP`Z`ESk z5^X8O2OF9LAWe%+jwd^jDfGeVL%p*> z#++5SuIVz6myfQJ^#gw&1;BC}4uMGQQuJ#wmKOL(aZdi2aSf*@f2e3m4o(4Z!F;^3 z@7+{g-mqgB+%K)EuC>r{gYCDqwRxBAp!p1BeZAV57~x;npnSctBQ4URr zxeed281mktcFT$?-G!cz6E!`X zp2Y8G;0#V50h7MvvBEdH;9bO zrx|S0>IW*?<~XrK{BPQh`V>;_V>dsSKz`&=sZCMTv+0kK~Nr3{bS`wS_dfBK+X^@GLrWnw)dRcR%!TGgUa8 zYdjEZtZSnc%X*Fm=(@YaZZN#G9~Wd#_G2f?Ru*O;lslzx;A4bk{ot`|Gm>p&@@}?H z0&QGxg2j(B>?CBv)D^ruOYi1axRkb8Fu{kYdy=7~sCMW%l8$Dg8|5?N8vqo{0S2Fh zr={UaB(utNRB{O;Q|z`?5P~^yzWE(D9R`9}BP0-TPS4AHG&FB^S+s={NxG~4zGxyv zXJGw!FPV+S9aDO<2-P>~L=P7G-e``xv~R@%*>u72 z+k!v1$fwLQQ9&c`Ra}2Y+9YRsOSwcHjY_~~8hxNs_TB8pV(`6%{h^wV4q9L;^5MPDprA6r50T;KtLb{*d_|?7W9k zIizmRHgZDtlw{P~`=U0$Q=&R-~{v2xvT_Ug7g?)*|LxLe|1o^VK{a8Tx2#KI@mvqk0}M zf48&%qOE~C429VkqG{L3MZPaFC2AB06sts7Qy5OAs1OX!m2 zT&^+%ywvD6HzmP*5-Y6<*xm^vAF(oD6=yk=8?^MGdRh2{lwNwHN z{{eHv(HprFtEYV(;F8{j-yDt#QIU~RURYOu7>GO^^p`*LN6rY~v#EaCURxt*nn~q! z{Lmi4?Q$IsoLD^uj2eeF^mnr&4Mq;8W_S~wXyrz_#Zpw!y4<^2;BNb!UWrj08Z`FF zh$Sp;O47l#Yt^*IXB%rlRD^x8&!O`)_es|)NZkl&I9-o0ZBmmOjIs@m5;qksaNPzcv3AS}QZMTC>|Keq`6Dw0DFv_O_K0pP5xJ;yH;a zZyAUYT;BU&iI8nqeG4$qTv*jnK1M7q>u~w!M*|RE^*8|V^|&w{9~g3vBftnE1I<0IdR;xrBqChJ~O&|Bt-Ip)W|A zsO|o=3^_QwF{by393ruJI6zrWWp}=$oXl@`45+d>$ZEIMbnG3^9zjqWc>mja|6UnG zG*5uzBL~#h4S@#MNU>~XPs%*L{=3`TJ_tloO4)4xqA2PVYS7^=S=?E5X!T3L#I5EH0Y9xWJGf*u2@PuzYtBnajKxKhp z7Cf5{{%(Uy?oT_`%mq#-=&<+Sj;=?dD8jyc4O36OtxH;C;$BOq+AN@b1A`Z==kIyq z*seRn>w>PEH`Hy9iJaRXd}Fd8fN}smk@H zlYg?8?^BSdivQUz55zF>e!Jy>yoQ<#FFC3S*bFFrB*vWT!*ndaP^XLOCs@R}=4x5o zuO0XEuA#kABvbF!?Y3T9qn2c4xxKYBV1>ahV8eL)-jRVR!6H*pfwJx_{L1Ia^rCqg z;D0WZ=DRcvZ3c83fXzccQ{3t?w>feD9)eaBFyPn;2cgpB0x~0V0K95ylv(QK<6z<) zN30}`z|HQgCD~b6CIyufpYd&ARz0Mj&R*K(_WEi`sRGtifoGJj7wq6$`IPq?&Y z;ypDAdFs+AnMYKPR6ed!NC1@s2+#6I?0)PMJ&R`f7I>xh32LtQA>nHjsVO(IFj(Rm zBwUqmIF?a^9CuYQkch5JR;tBfKW^n0SSk$gW;bK>LogfB;wsI)g6`mlGj>klo?DN~)K*uK{tiKX4>SNFi}KN6?#=-4Su! z-Q5Ac&<2u`dJ+6}t8(b=6MxHfZ6zob-2i+bk?;b*6&m#>Rcd*as>_#tFikg6ZL?20 zw1<86y6&v$T|)9R1rsX>gaQ&fh~{eOuL0EIlju- zZDKxte$-*9IrXu9trSQoCkNg0Xn@@;iZ1U&%Xg6z6I7ASh!fqwv|rSDz`}iRsN3B7 z6eJ&Ejq$0oEr9E!H3%N5W&5miVapmSO?_uW(N#wrjxRPNb){Sf+xax-mTA7(<(MzD z^bpd39Fk5+ZmKt2s~VQOd|9s_w7_^R&usm|a>ka}UF)4#&e^SWZ2_Gp4T>_hE7zpM z<#fRlrjiPp9WwWUm02w;a2`a^z??32iJDsJW}k6YKu;i=!`}S#^fVJt^ojsNHK6bJ zxAtoY@3(K?zPyVC0H4UPurQadXXV!`fcR0Piu^Qr-61Sg!RQ~^GJnIv46N*FWY!_P z*p(DtO#TwcFkJ?m{QztD(Mief&=h>nipJ=3&p6Jrl8_}OXc3_eW%E48UmF5P0T#`- z0h~{3PklgG<@T}+=V+$#`y*@lAuk<-MZJMN!CDTX4VYUmr_H-TC3r}SgLq~scE0#Q zfbt(HH5wcmpDK2lFfX^o1dk2hQdSSicC&4{@DMdH?%M7^M3~Bn^82S$KjO*diaRL+ z16kI98tESiFFloJmzzAG0aW%A8XB6&>o-v0^!QNSywZ3WQ!(KGmp=OHl_J8sk;g~= zIJrFO9Tre$tg?0Dzb=Be5iU=uG_~0^mQuwK;Jn}JE?PkY?OPHg=+Jj_PD8lP!=x%0 zDSTw)^GE zEpqceA?7$lYnC(_1hh%(9NbD7bg#NbJA32s-&X{PlZ3T*t1JK=yc#vV^Tnn+n*&w< zNhcc3#`I@uVrZ)d5{8psBC~~Vb%>P@fpFM((ahQTyEZ11seU(dg?vHXW;9``w7_|q z(w)l#>D@UC2td3@=GRQiQ#yGjG$ym0ws!dAw1(ZU$Fh$@GxIKQpfIS*K`wX4H==MV zZk;@Pt9C4~K;ftzddfx_Kd+EO#f!jAtrx21tTAe-^6(eV9QMTn@+KZEXZa%u7uMxPz%2 zOU7Ji2vn-HNd@vHq-P46E#?~KhVwh$e8hIvhOpOn4mj*ai;kMVXYk*SpXR*ZUIYTg zXJ(u)Q%*_RC2`vMV%5L6aZU7<{C+iz7C#ZtnHLC@ZsG z95VFGOWSb_uLvEyA+rBhAXE~}>u@YLSc!{W(hu<1CH4hab4cX_`JE-@$;5ujRrPdk z2fGAcCWjSXbh43Z90by}{I6vKAy^KC;6+D+gTrh0qId*!AVq;#F4Ohy66k@=nJ}uH z^Ml2OZ|ogPeefcWrV$%0)!f;8yjpUvvYn%``OT?{b~T%81SrN^QpfvqwN~#J+>bqc zp>g?jxp5_p#vDcf!L7_RH<;|>W6J{Na?WatDOK{UZ+1sn08=)QHjRz|ejjDa{&1Fn zFCsVd4fL)o(57^*TbP2$@{|DtS))Z3-}~g8y{#+uNK$gf;7OiaoGvhH(pTEwj1{Y8 z00Xv{8m*vnL?V){H%(Vj&`cBg*4y+I`>Mg9ylLXnX6si(+7&L=XN34~z&`kvFT zn2-{hrUm1QULrAa*u=Y54LK;p|6?6*UL zhbJqoGd4Lg%e*42Vo9IJ{cALTM;heny7JzaUvGRgCO0O}TvG0&#Y8AllOw`p#8?TD zXjYVLMa_mjCP@3AvHqVe2#<$H<8gBVNJnj;Y#=iFA(@$(d0I~y&&}1w(k(CtGxi>U zmo2uau^gq(cX^km=mW5-GB2^Ya|@?Rr3RCjGUfASMK@%Rn!WPxh*o@fK8VOfL>`l;gOX`~gp>$J$p%LP zBa?Y0MoR~A{asM>9U86Ai0r4jrj6!14(DNgJBCUIj)qDOhC7a%`GNfbvf(o>gUw{N zVY2&=poF}?ukcTx%ElleuP9+Nu!SOZByK7y=v@Q4p%4uhJGd6;gBib%8f96iJROE5 zCX23VtYSlthA|w;Y7e~p{hx37{h0`&52af7<;n()lH%rsB(3M+Y9asDHCLQXkr>N5 zyFTPGorB;Gg!}G030PMvqSSo>eTR-zOAz&a&3@%D#7wiUUm~492qFx(G|J;e*f$k} zl!zIB3jzHns<46SB&WVl>~*ySv9(y74m51*;a-!J?O9>mvfAgOHu0ZW)7_t@H*}k= zqwmiRzUrkl36ri(54JRFESMM@$6D!LDOqV=oneBB1vOv%;^;fJoz6hiUC{yIPrlhM zli&6_b0=u2zvyDUc)D5bKaFeQrdeimDE(-4b^N+NVO6R@&HT}a`(j^&Aj7~AoenY_ zw!2?n9$S0Anz+@A03&Z`uyoaBUXZ#+tp zE`HPFDu?>6xybk)eRU5K!laW z=YCw5v%SA%84Bw3AR_MXAAH-gy4c=wlXAc3u7$kM;lCjqmg*u;X}a1Qp~d}SZ0kG{ z>+5{4vEu5CK?;61&ewCC%2${l?g$hGR>xo%w#vd5&3-Hu2S?EIH9uU^>(O?Ie;n{` zILTGpXbXBw3&v$pd>rm2>F5l|ktko+=dSO@apxQSkW7o8*q!+5^e`9Gow_BE*46US zf}p=n=nmxKAwlVhS2E?&{X-?>+`5l@Go{kKcJAyMe1DzO2B;2U2W4Pamr#B|!D-;@ zHKJDtc);bE4A0y71WZTk6UKE#QW5$bANiW#Ckmx99-xI0!gxup2k4qtIGlV2gq2l? z)&~^Y=(2`A7N8YqzN~0EX-exQ=Oc^=S#crCVkS0COVKOLY^Q;Vc>L!&jcG0K#-RX4 z+ZN^D)*5Wx3SP#|mFdVO|9E<|4{_Pp?j37TqOrvm`jNr^ru!ZV6}5XPgyf3nIK1(0 z(S7}wT1nVGIIH+3&$)k*#$Cp!*gRV-Y?IER)P^6=eQM+7E~fQCm^*bf6O%KgSKU;) z=V@PIX=huB@<~Z+k8Rh}y_PMsGfW%aOp7~@-n}yqJ;&*$|IflQ+WM!JA2jjQ!q|=u zl=rbzY5k}z*FMunE^IS(m6}x8&Ua=k2N|c)Yt0|7F%c4GAhT%ozhJ}>P?3`(taCg{ za;`Wyp4+#?#ZW9MICCGutN2o1yGgbESaMSc{H zO;cs3qA*Ft-gS9gD&o_uRD0s#!z;h34xjN8BliSu)lRKnH0*6~Ld4nmDUv)VKblhm zvO?8x8Q=}rtqA)fuII?j2d1m*<1Qpc+)V|aHP~%?+*{xMN<3g7c)Aer3XFShfssmhoE}%i=`;3hmZP$ zkNFewQ$5+A{0e%NlYW>kv~$D~`mD${Nb$_!p=#W7sr)c+GF@uc&`#!js4|jOmCaPv z_Qi*aR(3nb71NB)iO`dh;#?_YclaXJX$!AAZJuSYFVrLXc)!&`wot7K45t0^#iIK` zK6TgR7J>i|tM9cwv>Q(a&-&(|+PRrg-~gilH=s`WDb@L~6#n&!v$0lR{99N_7oI4% zu8*8w0BL!}B+bwIKB(qBdF(WqddV;5cR3IQBiM-$<-<(;ZjHYmYoDc8 z{KfLi(tzFqy}&8B9;jY>p|uVXOCMyizC0smeK(2zD$zK$9%z4#$5(2N%zGh~s(X&5 z5I2$4)L-M|9Fm31c4wC=T6pgmX7 za2}kr?oPSNYtd|S>T7CgCivVPFcjE<6G&_M6Ai`g>iQ@RW&IUY6YcQ=*Achl@?(S9 zgr)=_ z5glUs&9O$;l@4QmDC6v1NoIk7?U$JwmPKJ@uGM)5uI;T6u_tg1)U11*Uy$`ay*pcd zQcma;zi7*IsUL}GEth$#Czw-TNAsY)ee<36_8kN4K{7LI_8er1UQqz0!ivv$R*^QT zAcmS~rcl~g&!}0VzZ}id$V{y>NMzDALOWq!5+t!9>`#a4l@^&b=_MNIY5uFBzC5e< zJD7U(sr<1WOFMl(atP{+MD&KqNAKwD+@^^q+Y2YRJ4{=6idm<3LQg%yk|TTkd(_!U zPEB~i8R%NRk~L_|(!wap%Y$`^K(y0gzj)d|{ucN&1f_lR*#zy!VOcwjj1V_kq_Oep zTf(;5OWrSaqnn$XJwJ?O*5_=lWV5)OfAvO5-7BK+((b{TuV_7y0(Bo`G+bLAuo4=T zMrXwp4vVI5V&qh48E`Dk{i0%759GVKD?F59PKRs;y=TKTvF}^%s5Y(w`)Oj1+>a29 zEG(2LG|?OTU#)eMC(z+BT3Oy@3W`k>wKqrTDYmbN`$-8s1|P2YxnbW82{s!a3h}T? z&AY=r5KX5^H{7|oe&-(C9i0+tGn>oA*10=uC`|@NF&gvaPHDMogmRvW2#1%+C#8%F z`40_UMzf3tbC=Z}iC2u%P2QpX3>^|#gNl`3JI-=%EIMA+Yp5I(L!r&h!15i;82gBR zZoFBBskwt8GoRf{dm{nj`ws0Zz#Sw4`aeU0DOJgV5f6hFq!WvDo*k|SSZ}k1fBW5M z?>h{sUE`{tprFpaoz%)}M9E@dgI4Ad%DHA=6r-ifni};x(g9ZfI*vEfbA*&EmZsWz zme>Ez5c7N|D)AMy$~^lZ!{e6x&52Zr(nG~8w?`KD)MIeBz-#=&rkh_J)}ua4%ueqQ z9HkZe%lkmIFd^y2&|t>xthkNF2vy2I`{)wrw75MKorh{nRg!9_NKHb3yytqPJ>?XK z@xj0)?!~#s+YN#xTQ5IZBlmYg)ANmhyNSN`G&)D@_-aOIBWndN!_y}Y+6#fUBt!dd zC<#@=9OSirR~T*@CFzl#2S~8V^m}S-r6&7gZKHnQNe;oIw0KDu^EPISK<@{MWEqNpK1Ut|rs1ph|caFn3&2@Z3` zEZJ1&G$jqp2drox?I5maMIgLj^kubCI$yoTN)H95bZXi4&?3L=Q4hW6S{M&Ebtfbu zaZjz)+C;Dpk|a{GnMKDaZM@2wFsT;;zA^8KRNV5gf5H zw~NqeHmN_+(7nWR@sCA>s;f}eRsWtx?*0v+0Y8o(mP;O(JO^kySBp;pJ*0ZT&=_OO zz2lYkjRA(?Xn6)1pvzMs- z7#b@*)jq@3C!1xv{z=X$c|Y5!XNPO$jNYP>IMa+`_t46)&+hbq^`${PF(-~@_(Okz z%Hi8RjMI_YRoSxa?^T3wP@v7s2%sy|<+|X|xBPwhILZFUsGN#gO2CbY%fJ0Is%_Et20G6aJ#~0Xl(qhS_hP! znT3UfqR+EsYIGFeVTo_5jD34*W+wl!t$<*+xy-B*=~rW>=1-z!X9E0@Oe@jXI+pLz ziAY|eY8wb`cb;1HgQK|6{REh~GX3v?6;5f}!QaHYkBFP&f7 zfxMAg=YmRi>vKkwaSZq!JmW!nJ{za9VMcu<9M|(v>q!Nrd}M+u8A!lEU0l#R9BX?< zSnmBY#Du_}zXqn4R>j{)M1Gksc6+$(d|rUP=6nCXAr#F9PJiuvu=n&6@=-lfndB}L&OeKFjOz)@ea-v$c-2y%0Sr%bCBjRiH;<-F@LB$Tiv2*@v0mM>9uq?UA*+S@$#RpN>lTHwDrFm$_h&3 z5sl9?ZKgxC+sNlG8TZc-l(z74URG%2TO0>o>Xv(JCNZPkiTv`lM#nRG%K=6#9=Ar- z53tUtnszgK#waTQ`ZVF{{ps8!j{4{yga3Tz9>}jSARBt4r>?&WG%IwSu>bbQyw{MN zX9Elcx`x{$8T5eN0Kn=xEW2r)6(!Cf3})eAp#(dHJAtdV@qSBvcDJrL_E%^l+JsO+ zbRl{a7xb-g&v&@|7F1d2{CO@nU|__|%*;$%Dgg_Z*91vNT2w;K?t$)%0?fQn1DZrB zo188J4+McX2ew}3&C6@{J8{%TNROb6zY)s+lQo=rv;sY{)b>lRKh6*4lx*RE$_z1V z6^w5nHuPpc_pP84m6nyBjbfJ8dM4ICfhGb27=}u8Y;3^;WXP0dsGW9ZIZZ^VJv=GjqYVTB6#7m6GuHZIk@mporUPkftnx#c97K$<_H9@_GyPi|tvidjq~^ z0atboj-29RiF5|6F%jbLv8ASljst1qWdTNW59V_-1&uaHHeC+i2rkF=N3(=YW4$#v z6Y5LPCgS5HZ7j^p6o$XKQPUGi6`Zg}XzgXK)lk6BYL$eMB06Yg-wpM~;y7&f_4ilC zV2$Jdu@(RR^ejRI7Im*D0q-UFnns*1)A2H$sSq>=ddq%V%UwGIO}UieE-0&a5h z{VNRWXQ+HZ_$~89WX2lp)I`!(|%T~i&j*&vs zIhUo!sI%&p#2$wHb*k1jl^HHe;aLq;u_$+$X9jK3khpy`GV8j;XE&o6yMx)BU?s(? zYM#~yzg1i$0{lfYn|}_%|NH|^ACwWnm(4yO z^Us0ThCJV&kwd4n+n>&eO}M>38`ir%UJ1Rh`n=sriO!1FKW4Qp(oNZBvsNDUv0F7Z#CxT0Wpv%B}uFc-lID!d1r5K-uX3-P9dyyU6@9%b=V-f zb40XQX;jVs3f;*G_HIbDQ`wC{bEkGUY5quupc)gSPXA^0e;(=|;|YL%I~VWtWfA@r znGk>wECGSbdi`FBTqT4KLIGZ_=1S2)5-k{Zvam)ej zQ1;`&|3a6Z|J#ZQ>Pd&deY>4yJ*8pq$d8X;lI9tc+BxX|k0GHK=A|J>Fr@uN;#1(7 z$$*^FWu)KpiR3}tXR?csN-K92+KKaHVt@e)qUcXwr-5uETj_IPRXoKUxh zV&>%6ZP%Qf<3s}KNT}cLby5x^31-^=jhnb$?X!eXDFnlqHOI!HtP$CUn$#NDD7uBX zIY|Bu!+xJ(NeCpilV}Q_gM$Nli$%_xA^T>6kdP3vpwVBy^f7ZQE9GuxCMWBJ2^Oen zF)kpql$8y)n53^V5N-AVYni@YgUB50v_l^cBoWtfO(0DNl6=+OV_?o7>uOJeX@nY2!_hoDQ3ALcIY9=5&wAo+7D%pXZqD4qI!Bc z%XgnU{Nb&4^S}22dgl|%+lh%77gPZI)drcTM%}XoU<~xU~LZ!S85fW)zj1OU!X(bw!t1nwKYH zgJs3?`kp^b6Dmmt%n2D4^)0KxC6Y!M9&}O$#xT+&g7CoMCp>4Rf`WpII5fErp5~yi zJojY-fPV#u15~)~_vIMze5{M`t&!2w{jg%PxhCrUU)0SR4-JEBEY44}{Q37f9^Ng$ zT^PiVxowD+#Y*H?>pbK`=X?NMhvzY(!%j}zm-FpW>n?Nyh&O^-ZZ{j&>k-0zKrR2v z;d~wF+RER=V&w4uFR?&zbC?MK*MhVnKF8#lC!D|#qMU1h{`6&~&Br)8MGgUo2P!TK z3`k?+;=~GsK+yDo;38=Sk^!Q>uaA#~AE9#WcoaDoJ#qx{He1!s3^y3dx%DkWu(t#C zjtHI>WK~T~!PatyA5P@O-c&yj@^1hIh#@7c)a`|QXrq|X&2Z+t9U{i@PmEDkIRt)m zMX_XRcgPsyn~s|hRi^$JVEwmBB1TK}$X5Nnn*&6x@qerVCxPYICz8%);quR5%?&3D zUIfhwE4NoirL%6VxD5JGFtTcDg`wN1<)?+5$2|WEV_qSMM0f!BPEJk^J%G#PAn1dy zvgpf=yqqxJX-LyKlm&P5CD*H%${}{K5OVj2i>XP&uO#&x3D{vOxAEnBUmOp=7=3O9 zT@_)$sbplIot@k$Ib=k5sFgtUg2zxgkRMeD%~Px(fM(4$Lbd4c%FD=2FX@@EAh*gF zFnb*LB3T{`^l3H-?#m0p7Sm<@zSX-5#*fxe*+l=*+0~}*Mx(Q#|FT45p}$`^RMGK$ zm+~R|)KJkr+J?n_k!FDMe1pIs-{`68PR`NY3Pcwv;zyNNuTFigz<{3Pl^W2~E@SqITbON;b6y7-=5ul}n+)j`w%&n{vWY(y$5j8ldg zT<*_?fMlCHk~y<<0k+0_?5>!^;KpNDFPHOOHrm{n!n3jxalQ3`8m`%|I&Mqa=>fRS zI>GY{uAxql%&*viH9mrH7~ehPT?B@s^-U^i9ef-Jj(j;|_rmF!nS7A8^H$xELnIQ3 zgg_s-r72-Y_qUXGKYVV|v4=cf&g*bV790l0Im}Fo|YNkVy&<@ z?Asd6przC)jD4SwFOgrB4Vb-u>v;0^`v%kd%<;*q;QD1OY840Up`G&lIc3$^A1<&k zs+$4{$z2D(wANIM+4yBm z$iXKx$dlkh~;*RwM@fKyjtZqi_>nB5q$aD*f^T`lU<99sB-~{6xxgl(dKd5gak11{Iw0cLfF0>+4l%XI&-> z6s%icz0F&5yF1uY?g5ORTFdsAHb1#~vAayU_qby~L`ZyWfGcRQKN-5OhtV>}7&FjG zMc(^O!~l8qCp=6RQc9P}#;}AsxmD0ptNj^C@oow7`}v8TUBlq|Dx0w8iCbfy9V`x> zFt;)Vn1WEcLd+?(8k#wBGn2%e;SO##%sP{Sq_#H0C{*FK3xS1EnQvRvaV3RB#ziIj zD#%gQ=JFOQG=(`g?ZiLb;w(D_JB@qUs7&aas?yYPM+085jjAAmp>E1-eO#78|AZF| z_INYwPF`Jxnqik`KVr_GWC5f)6*fDv3GB87i4PTqqaWB#IuJLir!=Edxtt5GniI6J z;}&FwWyLpP5BMkiGzYVV8V%FHa;QbR`gS$BxBad66wu3869@Mk-i$oLG=v%^`KSn2 zZ5*TOW1pydHx*?jj{z^dgP4a!u(8?C<-HihgQ2uX_D~_>9ALkN9mC6!aH#=_Mw@69jd%Ae`ujxIjl+AmkKu zJOAswQ{mA#?23S7Q>cuFMju6gc88sI{6wFC+l+D4mx0A-mx#arPR}hJZgrkoEk}?4 z3-P)#%UIp}*IuKWO59&jSvxYSenR_hq;nK|rOLzy7~pS<{|Sn~d|EqEwM@x(0dWz% z`C6;7`T3$)JRg#Qi9|rp&~&j;1t6Cp&kZAcbs;ZKnov zk5eKn(5ew(M&xu3(Itvq;vjT-?90QsN>2J3*hyA`@GBucgZS;Bm$${59|YGz6Aj{P zR!EDi*#ee^c~z17W{5ZY(B>i6-F=SZH7JfafmQ2o5l8oj+rmy1=>Z~(6Z zua=f$7cF#NkK303x4lF#yl+SA=}d9D((5*YR~z!W#h#+fkc{HxL&HegN7etD=H#j13G{CIf&OHi|4wl3>qhAnZ%!daK!gMCi6X zJuyKDAlZ_QZ^vL`rOZuCx2UFSs*RhAoY*IY_0IFrKk+~Wi$L@OS}d^bSXr#J5+s&JiA z^vN(cwOD-yK>qLLSp_j75|6_D<~NM`>;NG-|E45qaB@9pubS?Oq4m)DcS$qN`m=nO z>a7^l*+7M){&TZ`Q$r-`!Bh8E&dZNk}Un7$KVO zb2UTdw6-F^=HW<>P*b>OEAo3KEPekU=)&_I%Yh2!Dmng>wc%}nF`Lhm0#A~AgxLNKEUwd8;Sq4x>`c#j#?>be~iXRb0 zk$s>Z+ZoOBGm@sER<-(3Zyx=TVN`gn$uxzfD1e$mz1m(v9i4JVEmy#B25un^fd`M| z@g2qcNv;9a!JK_jh@_{g0p>-Qub8JONS5L`7WCfV{*##fPS3t1^Wp`2U-Md+o5%L` z^##Ay_I_FDWns|&lfTsJiP_8uHhARejx(*cI!pow+Q&ym*GD5UfBtCOAA>$gEiq@h zHKRb2hE0~KBPW?GWciEn^-h=)!Y=wgz#{c$Es@Kx=bj76q|mfWIkq|qS~W^Pz>cH z7Dg3%BLLXZtIf)4Cq_OppRzbubgruM%Sje#%Bv7r0Fb7b%#Si_mo*A%QNAaV##?l2 zT%K2g(oh!5Y6_DNpDjy>UH=qO{a@hkN^JS||afI~m_LhG9;*O8^dR z1<6hSyF|XNfTFA3-mhY7K($j;O)Y8nzU8R-ZvESPYD**yplW3L@YCZpfsU{ zoO7rjHfwZZS$V9p^7(mr{!x|Ltj197qZ0MBhRp70OwBN8EQVp(QJp)42cdzA$RxnR zOyNMPse7yx2v1xRGr1a5t?h54N+=2I#?(yOK8I~9P1t>Vnto6r;Q83I>1kU4PG>;Sy6`o2SOE>V?YHdrC?@ zfjSu?3_8l$zfQ=u|S~@00OPA#f9RAm?kbt?E5q9_= z0xD~oOp&9?nl+{gSoZT)lINMYFUALg@s-URXe?Igosp4|bap==oy0awA$75XoCwi% z?4`EK6?*Y4y^yV}wQdhiz|7ZxLk!vG6XQ(hG08M;4UHC{!XN$b6q(#K zQ_DN+<@R4}9n14QdGk%b{W6%yblUnFHg9Mw0Fi|K7vdfC4BLRB{M~)+wEG)^C;IZZ zsFdKDX4s}ODEaAFWj@WqjoA-k8a|yyDV9)C?PGxs)DQA+=nOqW!K?+f*LxzY0a$a3 z{H9U#hw%}Hk#eQnuF_GsjsE@x)|{}_8~~z}Uh9eSXpzNiwaJJ14^f&aBWm0-4O>aO zJ}<^G(<_&)#_QFf(@|mE-ZGu`=%VYxp9P-)4pU5DpJ)Og8$zkss62>;#qCn7-Tw@G zKiAd39`N;lm(@&~$guu;!Dr~*9rC()%K7GW<8;{zwhv%0Q%4a?hz1a1EZa%mjS6!- zb=?^bwAVqJ1a|}aW$)dc!pK^Bw-j;Ecp{X#^i=1&HsUOM2#VvhzVvxx)kEFx%wz(! zLAHKYkyaisRhDW}oxa<+Zb$`rI*2axdvAsWQ*Bv&7E)ny=_j#b3W?7S(AXdB)y zL2F}llZRyKdNz!ERv_WjtfTM==(z|7QROK`yM5*LYZSJ^0pIHv4en_;yOYef3RHvU z=t%qsar?04$t{6S*H;@wut1U}JIcqz)KtFm6$N?b-4@|lk^?La zDH_Z@;~bfc5KGHXY+M{4A0P8?cg#@wbNFfP^5xpZ6sP?XHy36?f?!@Nh&KwFI7^O4 z1_@*Uw#!=vB=qL8pm7&cO^@B;{Ixdv7zGg5T3wJpp1*10*fMd(wASW;rX!;_5r3eA z5S;kOZHs}GZKa>gsbPXxX~4=)xWZ2Rb`F%v$*`Ese%V7_io4|)|5f=OcH8S`x^$5y zlA>QRXe;eLyKlY)Q90#@r^Lj}gT4-Dof~NEa!}0Fn=UC!bM0F2d76sL}GH;DN19s(c?g5k_MPnMLk zu1yXomls9jd6bDSk;+P$cfOYTnb1|2R?9Z;bLI$Kr$Hc>>Aova*cY_*6H`roV0;Kf1IVEDw*>^wGwNLgiK-T+Fj4Auu^Z$hMFu?!aRq5r!C)Jm;ATJ$mB_(v|>pWk)+EThf^z@*uA9k2LN1aU189_(I};_W{lU6ad3A zp}mFlZZ8io8Q^yJ6x}Xd|4R;RC3`hQXd@c<_~%TE;Pr!*1>7exnXG%h#R-3|%K>Wf z*kWaRK@arF(??~6g<`?|8f=oS%kWl=%*>)6J?(YFFfcHn$O0Kz1h2^FCr8Nwu2wl! z?+s0Y4%w!EEux^}w5%YMVrCgV7Rfx!D@-Dz{@Q-K6%GwkfkM(#YMyJH~(x=d7RmS=>n|L*e?{S*ZJ8=fPL;ui^Vnabk)%f;MM1J zzttq}Q_Z!Z3wnD5*=XPBq75>%|ip$%vq;t1tTv0p>s<%pK4_6}>8X4n+VSD=fj1+Tjq=g1BZ* zWhDFK{k!+-Icm!Cd2Ohu$lX4rIPzH~_U2|`4d&4~wqJv8RamOxPEK)vXDzA9o}e$` z0##8rBo7^O5Eon;o2}p)D@Ic$;#gXs)|lhCsx^qH+StIJ%knksNQmcQhbu7{7xBOM z78_7f{~C!)tEporRFaH%gOAxKucDHGfEX-hoJo&rSL=*Zkz-+CP&E(UDH1sM%te;q|I78|`@ zL|{XRXfNpJSSa?Nbk5}1Z&l!h>rV)y@aYb}Wge;oQE$-fr(VS8xp$_M6AATi_J~tq zQrle-SSqN8PyVu?-ypb3oDw#mQ9P2{Vl5F^2p72V5RE~AO4;el4$1LnprZz?(0Kiu z{27+|ACaQdYfn`&-QxBQ_Z~2}!@6`-S@s`zK-)?4^g7`;KKB=5f;*dC^0?6SUw?Jw z@5cfPkLx-AjcfkAe6&FAwT#0)uH}>(+FOTuXCma;T!RWdYm^(uE*<<>!ifTAMUPtd z62*16opo?|VpDJ{c{+z4t#LK)qRjxY5yT3M~wO+kto)^by~7GNy*S|g@L94+2w_iu`$BF8Vd2$;^N`Wn2*k?phnv#?N*Oh*4^0l-g0%E zqXmsxKBjTSV-@%njJwmEGVI;P=4v<^piHD)OIT~4PyZh~&I{@&neJR%!ucIe=INn$ zv`HNXXD*KRe- zlcfYT`y{BkwBQ{&tQQ%G z@1pB=IoGk59;KS8R7(xwd@%GjG* z{AZs;@F>AtS`>c)#jr1Hz1Bm1(DKLmgm(-AgC?O3ZCDL8e-Q6M`g1`XMUEdzB_v*dxeZSwU{~XTDoY-fd zy`J@~XRQTC)}$~VrY;b{oU7qd?InLM<7`;NsptC1-nth^iBREf`*AVh&0BfL@fs98 zx8m#X_eE{}sbSy0@3vC!++mCU%WwdansjX&Uf0#7fB-hI18|tx6&tb?0DJ)O{pAwn zoh&MYFQ|G!-{_#9o~cMWc0K|pnVITXfIi;e#u1@ll)ydT{@h#V+Y=-BUlV8eMh(!Q z`|=3=8ev>v3@$5vK78HK(C{IGLhC}I>*-0p7q%ETgJ$|AX^@%hbv2lHZ179T zGPN#+8~PYm7g@2-LdbYgIUij{+dIOBEt`yKQkOW}bM7uni5%##7Fg>Q0h=_#8* zzV_gPc!-7UnC{b?H*Y?;fK%WmDJf}Hzw7gE+{%W~>Sd?9Jp|e&3ekdW*I8eYs;tvE zNe!{b&R50Rfqe~#BztOS9?QkCBM^3JU?`2~n+)R#{Ls|cEa=0`bx{FYTq2rc=nC|q z+V{BHOLk)(YBzdBJ<3u_O1>!E(HWCAIs-fJF+k_Web&MAVRNEBo-2y7aQ01|G#!}o zR#LR%J9G!q%hV%M+C*MNvQXXTTf;8S-RP=RgA)&D;2m)-!@h}E>AagGRx<^J9HjMRJInbh5X(Ve-(8yH$329MBa#N7> zV0(mHHD4*CxAP?4qHiwUYEAVCDo!XH;oqzZ_8cwdvCmk2LD>a-YvyG4G&Znom8o zy$4&Tkr38fQRMz6Nm8BQw;^!1x#PLBeZr|=W`OBN?l;!$jZ2tEd-kGKt;6Pr0?M6n zdmRcOXN%iYy883YT=P4#B+}i({p7bdmEr6s;&V}^m;dnJe)vGnau^lEpQ74>UQtS+ z)lupcfHg2LtUFx|jFS@~Df*Xq<3245_LqAd7m+u9a~B-M!9m1kC5(;J4%(wN6F&T0 zFM8zNY-!(M{X)kdWoZQ;!y}Emb`mJAX#Z~db8qO5-($}uY7qGO+ds)yhPQFpB{X`d zZvsVslDU{WS|dLDsr5L7Jd~jVSTO?giHAJDZWM#y&qiQhyttP(O9u7)o52^6!p)VB zCH3?3!VV^ziZFjDSn-#<^{;dO+r~7;hV5;HQvU65f8mFJY=}Grp2>~I`sjb&&c7X+ zf#e>R`_fy8b4SL-UiV+7Dh%!vO?a+AYyW^u>>SFKG=Au z0fvU&o&76u?BOes9yB}O0?_Tv-_VG!!_HcXW7b@Dzq;d0VB#9gmE*ZbXc#)#>HvWF zC3E+kdR~Y4g21}N*KW3lkvw=VVM>?1e-HsbCekls_aA>&VBq?$U(|0C;n(v0k8uMM z``18YSk*>!@lX5q|Bv7Vz=}OiO>p=B=~A2}-K4~H3~^rm7gGKob7&Q>=l+6_e)7LQ zwEx&ybsgMiPQGW||8sZ0K62Xy6L%|?OZmra{l|&_^G_X8aG&bKqI&<&K>zxv#tF;8 zl;OF#c|=!N7k}FxfU8|4CQUS2T3UU5eNQSrc2QAM8i1NGPMSmHBp3AjyO`M%Y53-m z#?y~Lew3jN6bkjIR*6A8LiM%FRvEC?)GSv$ma>C)8Wgs3@K7k7JbL_?Eu}|C1&Pm~wO zA|9!AZ(MUP=ZLK2SVpfI7-IyZ%(u3QWQ&RH54CUW8>XbF3O&CXk<=GNh1`!`cJV9e zs1vzXUfB7a30y(xcqkrAROc3Fva#Ld>vAs58HW!Ouj=Ksd=G>XR5h}^0HPS)KH=RA zH1TzW)K86}QTg*-tnlo1uPFE!lWSDc_kM*&jW&4Lh2 zo8XZf%C0I1#y71oaDgMYy;L>R&_Ny5h%&R06NM3Wr15!qX&&h9NqA9#jdL1x=WKqv zbOCRH7HU>jx_I&d5>{r)5zVE*7`S{?HrTr?^s?~nX^SF{QCPS3($jDnyUD`0lW^(c z)h9W&x4(9pFpw}{Ns5y3D(BC<%m?(a!_j*4+}_u~2yvpj5|YQw!Y4`-4)f5(@$zEy z)BTCvDke$Ea#A)#zQk3wM-1R)Z=>Z0@~XMj?DFryfM>mR^X6Mj`}DMwSjtOR{6)u_ zD}NJRJ-JFgBi~GSV!QOY72`DvA1^8mo_Q1}!A}pNp#)G3~>SzVTHDfeLart8r+YbEz#GNb@XELo89w=2iR2p3nQRgboTZ$oS%Ox8Npx*d(X&$u#$RK#`*kLq>hp1o?r`38 z_?qJaUFq@8sHBc(kD6ohL!WXNj(2%=0Vks{v@1t z?6yf<6Bgt9$h>?L{p%Nbglq@Yx?>Q-ibZVUt=xJkDT9ZNZ|uU6&GZ=SI_u#UT~>pJ zmRilpIsnC)iU8^A^Q|CwBqv>RIKssV>~h@Dx+ZtqDp&?;8;#-S!$6j(Mt0S~GyR9b zz6b2=Vm`thXk@XeYxyTRh>e5*GvYDtr4?2m1o?cY{JnQYftj&NTBx9>>^3%sgoeq9 zqdQjVlMgH@W~Y1}LpvvwVRu`c$8CpzN3MBYXRnTY%W%;A>F3=gTc<%*P>W!kFDokG zc}R192ou8;p8NP!PQ?$qMjun*IxgF)gX?LGM?ifxt8;n~G4|rCf4V1$6r{te2A|M> z2n_mRzHTj6lz@FUH*Qy)u+CKu?M#@yRN%EN0`nJoS{RkxR!r7PygL~f-TSKR5u^bl-Y{^%Xvkb_Iz+0#Cpw?A zwKDu(-``5l$PNZ=wD4Xy&#~wP=?C1Ex`>ajzah9ipp50x)3TkYJ@t%nQqKo^1I!ga zO^`p(rt!K$6C?mk9mw;IfAlj^6kPXuk2+ZVAqe8$0P;}g#2ku5FmX7V8asWXk37y& z8j>FsnV6V_kn1=r&CP>Y$(EtRSAV|XZ|gKCYd%6Y@<$fFlHb-EWUtx-7UAMc%z z2y4HJjKT5Qo8lZLJ|X-1kgtDlwMU#-)sZ66&2K@_Lt#kM+Mf~;5Fp62PeMd!?&Th| z*6n&yz#TAQH)@Ke{I0)4UU#6HW3W+s-wEWqXAE-{k6FEWcZ&zv0ZC<~mkv;I@OS=P zpbg+&3M|mStS$%XwQ2J{`bf+%Qr>=}m8m&c3L)n3ndiwiVYwi0zp9U|)9sM+aSRU}u8Noecov|`6+?1&N6%$2y$sJ4QYAqN@u(5nsFSq!?NV{obhn>Ec zO0NasMl3_$Fp}j|pE#;kPnY_D_))47^Ly0i&Iy6ED*et0ay#1+RmvB9|Yy0!!32bC2{ziUmbO65BlVX@5DLryz1hKsmJ|e{q?Q9(<{`olK>bS!WbN)L?nDJ0G^rG!N*x68(!#Ozp=R@4m`BG9cL>Y4Ne@0p1I^JC&cMkURfkGLGqxYG#k+EZ zX6jU&%MRl1N@4$u*`Z_(f5M(8wwTnJcBdM>DT45rrUG1}-GIhJQhKVq**o_Hx5$zJ z3GcLOFaursNHk>2wbip~IWU@C!Edez(7*%_s5^+J9^klbM6lVyG9;LsvN%F1KG5Z_%iUb(DHm%DP&Fl0d}T{ zEhxpN`tBu4+kq8H>PkB`7@FHCyh=%JY-lC&c_Cxxtc)FD_jS#DZlkLcrcT3|NADWr zT20Js8#*3VC=fymBZxv;>9-F0BC0+joAs_j`+U|V1zLO*gjeFprB?M?RXX6}&6jp?YBn;Y z$gwNQN)w;BWk;&wom+^gJ~Aw7NK)dkxx8ed>)vI_BGqIO1uJgn;9JyaHBZin-dm|# zND}L{#EacqdkoT_wKyH7Uy@_fZ=y~%>8R2rg;V?SnE1Z!akdDzRB-;b<-7B3GdqMhG8EtHO->&OWya4M!@c z=eo&4)Zx!1v=U;XVxv;)V=91I8(uUXRO5Ohx3sYJR9!eKug$R1q`6JjoJZ(^S|Lw) zTo!kN;eEj;2)SjP*HP6P({&4(ZC+8=q=ft}HDX4?@CqyzUgbM|?`UJ0y|-K*_h{%I9jRteNfs+hW+0M)piIkJS;yd;1cV_PK=Nc53_Y@u9;vhDz(` z@%G*T-+FxC-H?To`D|hW=XL5sj@k#WtTTK4DLjD}0YH<9roIe8g@Im$TfG$p#5fTu zB^gimN@yl`mU0Z3^JIb`&WfnUqS;D+DzEJf?bccGIiDo8?S*vEqFR$8E1rG>;vn>-0XIyCGxW$|B-~9sMEHoqqa3((kY65md_UPXwPVGH1-Q53S-QzHhP?5bB)Zcq(T!Q_9m; zYmJ#0YxJ0ju`CdH)>z|C6Mrfzf~o`UvUGQ2Ao*QZOmr@FT=1fk>8^TQjjF_`g*P&Ej%C^K-5KepI4fO__ST=} z+}JDK>XXxF{=fwi;1@I`eZB&T^x*OxNGt|pAL*63KGDp><+k{+UAHXy{OOzHXFYpT z^wbA>rP3`prM+&F^JKI2%fxCQT8PGRFCvO0pI1?qFiNgt4}~0 zDAb!eSJD&N*wLHgdc5?ScViC}9!k)?JVwYj77rVnqS1UH6V25o!rS=aK4bM0cesL$ zV2L5d9KDlRJO~ay-@Mr+pm@z`nX8C_gW2r4EOAO{{Zw`gkxvuv$&|(N^0JDEtTnY$or{^^i`Ev_EYQr9UPkC6-0q! zf6_vLXK8P*%;V3QgpmpY?RjE1u4UN_7PosKJP|%?xcV2U9o=`VoqFOFUM;Of7c3#*LzGoiA7mFWhkV? z13!=9EBi}NS3`G)%tJk^_y^`^jI;$=@!b^^DpWeDrTTC4@ili+-rkIOLD+6w^98Ay zGiIvkYbmhr?|mydt6t>kH%?D7LTjNSD5~b{bYVgh>-))V?hxVv=7b2#Zz)QA3;s!> zxpCpy4HlDrL0ptZE>Jf6|@gn*Ls+{vhwFt*;F`h-MEcF|Q+R5q?o%#bpUK`T0X5szE_?#m ztElH{mcz>ayLx|_7iR79@#>DPFD~i>CuQ1&OW^4#d8>4Fwqe(eE-o?$kG8o+Y{eb^<+g%XD&c_<^5B{vC_E*^V-!~}n5EuUCf_^*q&rfN)F-meH3I*F= zA&~$4)~`KMV&VUKM)wN(9!4#P6rL-;M=<~u4@wL8-~LBx=YM0o9YlZ-U9iO<{f|_Y z{~)0M@jEGi0V$0!bLZFf{nzacHvkPB-nQ<4m@#)fe0+C*HpK97XN4`&yz3ZBg`}Ik= z`)6fpylXHj>72@)cY;T2^=(E@PUSE=TiaIq>O(E}1dG$--3Sbi63(v0%u%uC0SL(9 z26Wu$Bbw9u5;8vrK*Ru4gwF>|h`XpMAS6M8>1RlI_3?_iRlhu+3Mt1%|nO zZ`~C%d3v&oeucnkB0T_*r{bNZ+pslY7)zgz6v{NNV+f(s1uwzF<$^izO?%BT*Zp># znVDX`NvBmILt4SPP~{(4PWbF4BJbY4n+0imgW6A|ZIIdk`FIq9>h)z81U&`~y%T!1#Ky)3lNEKu5C~;B0V6jlH*5ZsSaQ-~B+lsG zQL}P+KsLivcaPS5ghSaLf4VuTW(!5r4)6iSC`A(_XFfw#aUFmJY38q!BSj|u5rcQp z$P%X57h0SU%SrQ`6(< zinHa+OQtWV4lVUgM`&94R;)KsF;n}wr$*;(oI$S?PdLhH4V@y2E^YlOjXRQz_t{#D z5D5kGDO!E(FU1Vc!dSty%Dm5Y9fQAG@UdD)n%~Prl1tXm$bLAt3g~1tSJ1pb4eAJb z(gp*4<9*OtCbX82hlq2@97r}cYH?_8)>FYqZ26z|4G&YK^k9hUZK@a-$bQl|;GWVI zNNL7E-d{?Q6{wgTS8BBA$ApH!Hmlyz()twqGwN61_t^@?zT$sAH(k|_3H)@CH z4*e6*3o1R4l!s}HRkA~6c^nY@eia}EKy?e0Es3w#{}#Owv+68O!M(J!r0T-}W4z_hXi4WGME}@Q>bl#|H`8dk>oWmP1mhy4DQm`4pp~G$zV;jC6 z{AwZOvp^6iew62=iF*cv*;V;7^&wrY;OVh-pRQ@*P}#O9FI}JyDWS_?s;I^D;_)=uRv~c9ba_g3_!1phC;>Vv)6Y5Eb+T)?t z9b8tMoqX-;)d#AEf?n$3O%hb#2SKP;kj3R z5tyC#J6|`LXVG^N3oLVPQ#swPO{llp{MMO%?#iw%!{BbHPm3$3SY3knWga#?YBp9@ zm7zTva4*c*AKGz~$vjXpv;^3?v=TzE53rl~1}r0|%~XddY^%Who&(}dPHkDo02rb1 zQ}suW(iOHl99+iJ&H8PV5#=IOYZ#dyM%#l?^@6;hflL<&F7e%25?iQTg4l(QEotf3 zc9C3rpmbHL=siwqF*Qy%@%K*?7tTtRAO{uhQx{@a|E=W5FkMX*BX~tpK63pixdl`` zT?_=S*A5lx&k^y9v|=YxhI7_i8ID-kgZzNz)1^>~@-h!U~Oaix=blUL|}Veoh{bKhs9ulk5Rz zf&uUXXyS8bocJUKJJTI#7<7K2H*s)^;&`-`^n#4vMiY1J`Sa)VU_~V*{Ol#FBGuH^g!jRh9G&Wto4M+jcAnP3 zJ(A=i(kW1!P2-@ZZW|3uIxj^DXisW5V9?%DTpySBQ$2dVNg}=X8{xvNb33h|*zhY- zdV}MG?Ka}A0fnUu*RQWEEO2pr3JX0+Nu^pqQ3tJDP3FEjGK45j4eVMk`8$W|}R59ssiK znObg@7fJapoW^H2qiQvHRXA7zU(3~zaX#h1zC=)?_ik&~kQnS5g*1_Jd=p$klj*twb%uuar%`DEG)CU|7L zpDCxao&%SS?gXGs(hG>>Ku?&+Rv(1BM))$m&Yp+h@m4=`dc&No9^_~}&^0rhMcjub zoUD;Mba5<)Qq&5|k7@QvWC2mT65RwzXb*VkbTd8aNSw~qxok#HsuUdeQ20jSFMJ%33)2D;U2ag~@QyMm zs>rX2el`x2EIo(@SwQaw&myLBj}}zbwUTB<-dQ}ly8V~9-;L0{))OZ~$Xt(A;@HCw z1`1lRF2SHN**e>+4T*W|{ksan$2LVBDHFmZa-OKA$CG`j*wwyA^K5?~PjRe&hPp>tf%Ah>> zt@o+|qTO~Xv6yB0FJX#^8UTB~E^-Jq3%DN!?TNwTrA;0iMSLc1zxDm~k!_)U+u;&l zo2U+Ty7~HjEaOWhz-rHdc#}USVEBxNRwA;*ivroCNAZv~@C?1q4eA}rI5e|HrH{Hfj)lpNM&pxUSj@ZuU_&6B$w{3e1k>G`l*Vv zG#R#TZ=$}20C-2fW&zTFN*m~Yo;)}Ko`r?T)Z}V*gp&B7oRVe2WeLA?2Y2_eMxlfti}eAoAIp$B@`>f=t^ zkH9y0N*^W8Y-diSFmT1IYJsA>VUxa|CLMJ*GDb5;&T}5so_YF>Bu>@E?3<2``1{r! z2)OPZ%eCJfsJB8`YA)<*rY$xM`jZb~TafS{P7(+S0ez13cP}_E>$vLU$K}mdadgTd z=${kAEeBUu1b>H|n(K*I&g=)yzxiHonZcTtB!~du^_`{>XI29O^Y+k~xhJmcK?njId-d3k8|1skK>SO-4vqcg3 ze&39$luds8__t5Mv2YpPvmZQ@O!{TTz$t5>7+;+dZ=B2U=D+;rKRs_;R&Y<}qHQn# zZ~o;NM!y8*^ZuDm^!F?J=h5A3FeUAB5z@8)lh<7X1(z~zssBG-ID`8&(lmU>ts0Q? z__s0mbL9WIlQt8(tgK98^t>f2|CHM~1JFGt|4HLT(CXB0VLU0|iXme-0ZD7NR`~!; zS5f_)6|$Tqrvn&j$=XFiV@0u9-_FZ*kEbaJ!po%q&8adY$jD)A(hKL!=5pCE+W)#~ zEUthAwv6ExZvbzrt9#D?%|siMRBTY9I{%?(}L?U*{h37rKnRL7nJK_erlkvA*8yK z`Y7=T(oS+TU2NxTiFP_DkTUy#jbM$>$LW^l9@JKva5gzjq z7LYzk+cetW9oi+H6wW-gsZ0!fvAQ^adsyJ@s&Lim0|md;w+;Cr8p$@LeMA0w+eHoh znQgS~G~mAuGOjxP^~1q?Qqd5*8v6;vjRItM&^qbi)G5wZa|-^e94D+Z;Gc}7f<(5M HuE+lYfNQ8X literal 0 HcmV?d00001 diff --git a/metricbeat/docs/modules/istio.asciidoc b/metricbeat/docs/modules/istio.asciidoc index bfda2a9588d..c80e2d84c09 100644 --- a/metricbeat/docs/modules/istio.asciidoc +++ b/metricbeat/docs/modules/istio.asciidoc @@ -11,9 +11,12 @@ beta[] This is the Istio module. This module is compatible with versions before `1.5` of Istio where microservices architecture is used. If using versions priot to `1.5` then `mesh`, `mixer`, `pilot`, `galley`, `citadel` metricsets should be used. -wehre the Istio module collects metrics from the +where the Istio module collects metrics from the Istio https://istio.io/v1.4/docs/tasks/observability/metrics/querying-metrics/#about-the-prometheus-add-on[prometheus exporters endpoints]. -For versions after `1.5`, `istiod` metricset can be used which collects metrics directly from Istio Daemon. + +For versions after `1.5`, `istiod` and `proxy` metricsets can be used. + +`istiod` collects metrics directly from Istio Daemon while `proxy` collects from each of the proxy sidecars. The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. @@ -21,16 +24,24 @@ The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. === Compatibility The Istio module is tested with Istio `1.4` for `mesh`, `mixer`, `pilot`, `galley`, `citadel`. -The Istio module is tested with Istio `1.7` for `istiod`. +The Istio module is tested with Istio `1.7` for `istiod` and `proxy`. [float] === Dashboard -The Istio module includes a predefined dashboard with overview information about Istio Daemon. -This dashboard is only compatible with versions of Istio after `1.5` which should be monitored with `istiod` metricset. +The Istio module includes predefined dashboards: + +1. overview information about Istio Daemon. + +2. Traffic information collected from istio-proxies. + +These dashboards are only compatible with versions of Istio after `1.5` which should be monitored with `istiod` +and `proxy` metricsets. image::./images/metricbeat-istio-overview.png[] +image::./images/metricbeat-istio-traffic.png[] + [float] === Example configuration @@ -82,6 +93,13 @@ metricbeat.modules: period: 10s # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ['localhost:15014'] + +# Istio proxy to monitor Envoy sidecars for versions after 1.5 of Istio. +- module: istio + metricsets: ['proxy'] + period: 10s + # it's recommended to deploy this metricset with autodiscovery, see metricset's docs for more info + hosts: ['localhost:15090'] ---- [float] @@ -93,19 +111,27 @@ The following metricsets are available: * <> +* <> + * <> * <> * <> +* <> + include::istio/citadel.asciidoc[] include::istio/galley.asciidoc[] +include::istio/istiod.asciidoc[] + include::istio/mesh.asciidoc[] include::istio/mixer.asciidoc[] include::istio/pilot.asciidoc[] +include::istio/proxy.asciidoc[] + diff --git a/metricbeat/docs/modules/istio/istiod.asciidoc b/metricbeat/docs/modules/istio/istiod.asciidoc new file mode 100644 index 00000000000..c13ab7e5244 --- /dev/null +++ b/metricbeat/docs/modules/istio/istiod.asciidoc @@ -0,0 +1,18 @@ +//// +This file is generated! See scripts/mage/docs_collector.go +//// + +[[metricbeat-metricset-istio-istiod]] +[role="xpack"] +=== Istio istiod metricset + +beta[] + +include::../../../../x-pack/metricbeat/module/istio/istiod/_meta/docs.asciidoc[] + + +==== Fields + +For a description of each field in the metricset, see the +<> section. + diff --git a/metricbeat/docs/modules/istio/proxy.asciidoc b/metricbeat/docs/modules/istio/proxy.asciidoc new file mode 100644 index 00000000000..71f5fd2b891 --- /dev/null +++ b/metricbeat/docs/modules/istio/proxy.asciidoc @@ -0,0 +1,18 @@ +//// +This file is generated! See scripts/mage/docs_collector.go +//// + +[[metricbeat-metricset-istio-proxy]] +[role="xpack"] +=== Istio proxy metricset + +beta[] + +include::../../../../x-pack/metricbeat/module/istio/proxy/_meta/docs.asciidoc[] + + +==== Fields + +For a description of each field in the metricset, see the +<> section. + diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index 1bc81071e76..530958eb8f3 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -133,11 +133,13 @@ This file is generated! See scripts/mage/docs_collector.go |<> beta[] |<> beta[] |<> beta[] |image:./images/icon-yes.png[Prebuilt dashboards are available] | -.5+| .5+| |<> beta[] +.7+| .7+| |<> beta[] |<> beta[] +|<> beta[] |<> beta[] |<> beta[] |<> beta[] +|<> beta[] |<> |image:./images/icon-no.png[No prebuilt dashboards] | .1+| .1+| |<> |<> |image:./images/icon-yes.png[Prebuilt dashboards are available] | diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index 41552410a38..ef7f167940e 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -701,6 +701,13 @@ metricbeat.modules: # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ['localhost:15014'] +# Istio proxy to monitor Envoy sidecars for versions after 1.5 of Istio. +- module: istio + metricsets: ['proxy'] + period: 10s + # it's recommended to deploy this metricset with autodiscovery, see metricset's docs for more info + hosts: ['localhost:15090'] + #------------------------------- Jolokia Module ------------------------------- - module: jolokia #metricsets: ["jmx"] diff --git a/x-pack/metricbeat/module/istio/_meta/config.reference.yml b/x-pack/metricbeat/module/istio/_meta/config.reference.yml index 146728fdfcd..7efe2adea30 100644 --- a/x-pack/metricbeat/module/istio/_meta/config.reference.yml +++ b/x-pack/metricbeat/module/istio/_meta/config.reference.yml @@ -39,3 +39,10 @@ period: 10s # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ['localhost:15014'] + +# Istio proxy to monitor Envoy sidecars for versions after 1.5 of Istio. +- module: istio + metricsets: ['proxy'] + period: 10s + # it's recommended to deploy this metricset with autodiscovery, see metricset's docs for more info + hosts: ['localhost:15090'] diff --git a/x-pack/metricbeat/module/istio/_meta/config.yml b/x-pack/metricbeat/module/istio/_meta/config.yml index 146728fdfcd..7efe2adea30 100644 --- a/x-pack/metricbeat/module/istio/_meta/config.yml +++ b/x-pack/metricbeat/module/istio/_meta/config.yml @@ -39,3 +39,10 @@ period: 10s # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ['localhost:15014'] + +# Istio proxy to monitor Envoy sidecars for versions after 1.5 of Istio. +- module: istio + metricsets: ['proxy'] + period: 10s + # it's recommended to deploy this metricset with autodiscovery, see metricset's docs for more info + hosts: ['localhost:15090'] diff --git a/x-pack/metricbeat/module/istio/_meta/docs.asciidoc b/x-pack/metricbeat/module/istio/_meta/docs.asciidoc index cfba8ec7ce8..f3b1825a9b1 100644 --- a/x-pack/metricbeat/module/istio/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/istio/_meta/docs.asciidoc @@ -1,9 +1,12 @@ This is the Istio module. This module is compatible with versions before `1.5` of Istio where microservices architecture is used. If using versions priot to `1.5` then `mesh`, `mixer`, `pilot`, `galley`, `citadel` metricsets should be used. -wehre the Istio module collects metrics from the +where the Istio module collects metrics from the Istio https://istio.io/v1.4/docs/tasks/observability/metrics/querying-metrics/#about-the-prometheus-add-on[prometheus exporters endpoints]. -For versions after `1.5`, `istiod` metricset can be used which collects metrics directly from Istio Daemon. + +For versions after `1.5`, `istiod` and `proxy` metricsets can be used. + +`istiod` collects metrics directly from Istio Daemon while `proxy` collects from each of the proxy sidecars. The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. @@ -11,12 +14,20 @@ The default metricsets are `mesh`, `mixer`, `pilot`, `galley`, `citadel`. === Compatibility The Istio module is tested with Istio `1.4` for `mesh`, `mixer`, `pilot`, `galley`, `citadel`. -The Istio module is tested with Istio `1.7` for `istiod`. +The Istio module is tested with Istio `1.7` for `istiod` and `proxy`. [float] === Dashboard -The Istio module includes a predefined dashboard with overview information about Istio Daemon. -This dashboard is only compatible with versions of Istio after `1.5` which should be monitored with `istiod` metricset. +The Istio module includes predefined dashboards: + +1. overview information about Istio Daemon. + +2. Traffic information collected from istio-proxies. + +These dashboards are only compatible with versions of Istio after `1.5` which should be monitored with `istiod` +and `proxy` metricsets. image::./images/metricbeat-istio-overview.png[] + +image::./images/metricbeat-istio-traffic.png[] diff --git a/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json index 72b995c2382..ce73d05972b 100644 --- a/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json +++ b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-overview.json @@ -1,1762 +1,1828 @@ { - "objects": [ - { - "attributes": { - "description": "Overview of the Istiod Service status", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "title": "Pilot Proxy Queue Time" - }, - "gridData": { - "h": 9, - "i": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", - "w": 12, - "x": 0, - "y": 0 - }, - "panelIndex": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", - "panelRefName": "panel_0", - "title": "Pilot Proxy Queue Time", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot xds Push Time" - }, - "gridData": { - "h": 9, - "i": "06af11e6-e026-48db-a06b-b34b402b535b", - "w": 12, - "x": 12, - "y": 0 - }, - "panelIndex": "06af11e6-e026-48db-a06b-b34b402b535b", - "panelRefName": "panel_1", - "title": "Pilot xds Push Time", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot xds Pushes" - }, - "gridData": { - "h": 9, - "i": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", - "w": 11, - "x": 24, - "y": 0 - }, - "panelIndex": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", - "panelRefName": "panel_2", - "title": "Pilot xds Pushes", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot Inbound Updates" - }, - "gridData": { - "h": 9, - "i": "a8e47ef0-03db-419f-890f-0880d674682c", - "w": 13, - "x": 35, - "y": 0 - }, - "panelIndex": "a8e47ef0-03db-419f-890f-0880d674682c", - "panelRefName": "panel_3", - "title": "Pilot Inbound Updates", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Citadel Cert Issuane" - }, - "gridData": { - "h": 9, - "i": "e708abfa-5a95-483c-9bb2-4470ee913f3c", - "w": 12, - "x": 0, - "y": 9 - }, - "panelIndex": "e708abfa-5a95-483c-9bb2-4470ee913f3c", - "panelRefName": "panel_4", - "title": "Citadel Cert Issuane", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Galley Validation Failed" - }, - "gridData": { - "h": 9, - "i": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", - "w": 12, - "x": 12, - "y": 9 - }, - "panelIndex": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", - "panelRefName": "panel_5", - "title": "Galley Validation Failed", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pods witout IP", - "vis": null - }, - "gridData": { - "h": 9, - "i": "32eaa989-a4f9-4d31-97cb-684f31488aa8", - "w": 8, - "x": 24, - "y": 9 - }, - "panelIndex": "32eaa989-a4f9-4d31-97cb-684f31488aa8", - "panelRefName": "panel_6", - "title": "Pods witout IP", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot Virtual Services", - "vis": null - }, - "gridData": { - "h": 9, - "i": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", - "w": 8, - "x": 32, - "y": 9 - }, - "panelIndex": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", - "panelRefName": "panel_7", - "title": "Pilot Virtual Services", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot Services", - "vis": null - }, - "gridData": { - "h": 9, - "i": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", - "w": 8, - "x": 40, - "y": 9 - }, - "panelIndex": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", - "panelRefName": "panel_8", - "title": "Pilot Services", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot Conflict Inbound Listener", - "vis": null - }, - "gridData": { - "h": 9, - "i": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", - "w": 9, - "x": 0, - "y": 18 - }, - "panelIndex": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", - "panelRefName": "panel_9", - "title": "Pilot Conflict Inbound Listener", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot eds instances", - "vis": null - }, - "gridData": { - "h": 9, - "i": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", - "w": 10, - "x": 9, - "y": 18 - }, - "panelIndex": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", - "panelRefName": "panel_10", - "title": "Pilot eds instances", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot xds endpoints" - }, - "gridData": { - "h": 9, - "i": "d6b2845f-9582-4863-853e-ab753f3d763e", - "w": 14, - "x": 19, - "y": 18 - }, - "panelIndex": "d6b2845f-9582-4863-853e-ab753f3d763e", - "panelRefName": "panel_11", - "title": "Pilot xds endpoints", - "version": "7.8.0" - }, - { - "embeddableConfig": { - "title": "Pilot xds expired" - }, - "gridData": { - "h": 9, - "i": "3d0dec37-26c3-490b-a45f-48b6d1baa160", - "w": 15, - "x": 33, - "y": 18 - }, - "panelIndex": "3d0dec37-26c3-490b-a45f-48b6d1baa160", - "panelRefName": "panel_12", - "title": "Pilot xds expired", - "version": "7.8.0" - } - ], - "timeRestore": false, - "title": "[Metricbeat Istio] Overview", - "version": 1 + "objects": [ + { + "attributes": { + "description": "Overview of the Istiod Service status", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "" }, - "id": "d899d3f0-0883-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "dashboard": "7.3.0" + "gridData": { + "h": 3, + "i": "3ab7d813-a0b5-48b8-9c10-5ac962a4177c", + "w": 12, + "x": 0, + "y": 0 }, - "references": [ - { - "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", - "name": "panel_9", - "type": "visualization" - }, - { - "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", - "name": "panel_10", - "type": "visualization" - }, - { - "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", - "name": "panel_11", - "type": "visualization" - }, - { - "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", - "name": "panel_12", - "type": "visualization" - } - ], - "type": "dashboard", - "updated_at": "2020-10-07T10:23:52.518Z", - "version": "WzQ0OTIsMV0=" - }, - { - "attributes": { - "description": "Time in seconds, a proxy is in the push queue before being dequeued.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Pilot Proxy Queue Time [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "queue_time", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_proxy_queue_time.histogram.values", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "03ef6580-0887-11eb-876a-9d8e5e94d2f5", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "071fe4f0-0887-11eb-876a-9d8e5e94d2f5", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "0b7164c0-0887-11eb-876a-9d8e5e94d2f5", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "90" - }, - { - "id": "0f611580-0887-11eb-876a-9d8e5e94d2f5", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "136f98e0-0887-11eb-876a-9d8e5e94d2f5", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "percentile" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot Proxy Queue Time [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "3ab7d813-a0b5-48b8-9c10-5ac962a4177c", + "panelRefName": "panel_0", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds Push Time" }, - "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 9, + "i": "06af11e6-e026-48db-a06b-b34b402b535b", + "w": 12, + "x": 12, + "y": 0 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T10:23:11.367Z", - "version": "WzQ0ODMsMV0=" - }, - { - "attributes": { - "description": "Total time in seconds Pilot takes to push lds, rds, cds and eds.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Pilot xds Push Time [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "filter": { - "language": "kuery", - "query": "prometheus.labels.type: \"rds\" OR prometheus.labels.type: \"lds\" OR prometheus.labels.type: \"cds\" OR prometheus.labels.type: \"eds\"" - }, - "formatter": "s,s,", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "pilot_xds_push_time", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_xds_push_time.histogram.values", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "percentile" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "prometheus.labels.type", - "terms_size": "20", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot xds Push Time [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "06af11e6-e026-48db-a06b-b34b402b535b", + "panelRefName": "panel_1", + "title": "Pilot xds Push Time", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds Pushes" }, - "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 9, + "i": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", + "w": 11, + "x": 24, + "y": 0 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T10:23:48.176Z", - "version": "WzQ0ODgsMV0=" - }, - { - "attributes": { - "description": "Pilot build and send errors for lds, rds, cds and eds.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Pilot xds Pushes [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "pilot_xds_pushes", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_xds_pushes.counter", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "max", - "unit": "" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "prometheus.labels.type", - "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "terms_size": "4", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot xds Pushes [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "d9a49bf0-f88b-4d4f-a1e2-74fbd482f77c", + "panelRefName": "panel_2", + "title": "Pilot xds Pushes", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot Inbound Updates" }, - "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 9, + "i": "a8e47ef0-03db-419f-890f-0880d674682c", + "w": 13, + "x": 35, + "y": 0 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T09:24:59.040Z", - "version": "WzQzOTAsMV0=" - }, - { - "attributes": { - "description": "Total number of updates received by pilot.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Pilot Inbound Updates [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "pilot_inbound_updates", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_inbound_updates.counter", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "max", - "unit": "" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "prometheus.labels.type", - "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "terms_size": "10", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot Inbound Updates [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "a8e47ef0-03db-419f-890f-0880d674682c", + "panelRefName": "panel_3", + "title": "Pilot Inbound Updates", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot Conflict Inbound Listener", + "vis": null }, - "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 6, + "i": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", + "w": 12, + "x": 0, + "y": 3 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T09:21:43.250Z", - "version": "WzQzODcsMV0=" - }, - { - "attributes": { - "description": "The number of certificates issuances that have succeeded.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Citadel Cert Issuance [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "success_cert_issuance", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.citadel_server_success_cert_issuance_count.counter", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "max", - "unit": "" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "terms_field": "prometheus.labels.type", - "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "terms_size": "4", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Citadel Cert Issuance [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "0a63d980-8d93-4ce1-b5a1-ab77e589ceec", + "panelRefName": "panel_4", + "title": "Pilot Conflict Inbound Listener", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot Proxy Queue Time" }, - "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 9, + "i": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", + "w": 12, + "x": 0, + "y": 9 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T10:15:51.172Z", - "version": "WzQ0NzYsMV0=" - }, - { - "attributes": { - "description": "Resource validation failed.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Galley Validation Failed [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "galley_validation_failed", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.galley_validation_failed.counter", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "max", - "unit": "" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "prometheus.labels.resource", - "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "terms_size": "10", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Galley Validation Failed [Metricbeat Istio]", - "type": "metrics" - } + "panelIndex": "cd1bbc4f-95de-4156-a3ef-c091cf6402c0", + "panelRefName": "panel_5", + "title": "Pilot Proxy Queue Time", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Galley Validation Failed" + }, + "gridData": { + "h": 9, + "i": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", + "w": 12, + "x": 12, + "y": 9 + }, + "panelIndex": "724f0f9e-2186-4ddd-859c-edb2649b8c0f", + "panelRefName": "panel_6", + "title": "Galley Validation Failed", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pods witout IP", + "vis": null + }, + "gridData": { + "h": 9, + "i": "32eaa989-a4f9-4d31-97cb-684f31488aa8", + "w": 8, + "x": 24, + "y": 9 + }, + "panelIndex": "32eaa989-a4f9-4d31-97cb-684f31488aa8", + "panelRefName": "panel_7", + "title": "Pods witout IP", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot Virtual Services", + "vis": null + }, + "gridData": { + "h": 9, + "i": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", + "w": 8, + "x": 32, + "y": 9 + }, + "panelIndex": "6a8463fe-b7cb-4cd8-bf01-f7ca6a185178", + "panelRefName": "panel_8", + "title": "Pilot Virtual Services", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot Services", + "vis": null }, - "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "gridData": { + "h": 9, + "i": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", + "w": 8, + "x": 40, + "y": 9 }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T09:30:05.212Z", - "version": "WzQzOTksMV0=" + "panelIndex": "51ecc2f8-3c3f-4a80-b4b6-b52db10e68ad", + "panelRefName": "panel_9", + "title": "Pilot Services", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot eds instances", + "vis": null + }, + "gridData": { + "h": 9, + "i": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", + "w": 10, + "x": 0, + "y": 18 + }, + "panelIndex": "9fbfca4c-37b5-4a1a-924e-49fc9ef2294c", + "panelRefName": "panel_10", + "title": "Pilot eds instances", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Citadel Cert Issuane" + }, + "gridData": { + "h": 9, + "i": "e708abfa-5a95-483c-9bb2-4470ee913f3c", + "w": 12, + "x": 10, + "y": 18 + }, + "panelIndex": "e708abfa-5a95-483c-9bb2-4470ee913f3c", + "panelRefName": "panel_11", + "title": "Citadel Cert Issuane", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds endpoints" + }, + "gridData": { + "h": 9, + "i": "d6b2845f-9582-4863-853e-ab753f3d763e", + "w": 11, + "x": 22, + "y": 18 + }, + "panelIndex": "d6b2845f-9582-4863-853e-ab753f3d763e", + "panelRefName": "panel_12", + "title": "Pilot xds endpoints", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Pilot xds expired" + }, + "gridData": { + "h": 9, + "i": "3d0dec37-26c3-490b-a45f-48b6d1baa160", + "w": 15, + "x": 33, + "y": 18 + }, + "panelIndex": "3d0dec37-26c3-490b-a45f-48b6d1baa160", + "panelRefName": "panel_13", + "title": "Pilot xds expired", + "version": "7.9.0" + } + ], + "timeRestore": false, + "title": "[Metricbeat Istio] Overview", + "version": 1 + }, + "id": "d899d3f0-0883-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "19a8b9c0-0c7f-11eb-a3fd-1b45ec532bb3", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_8", + "type": "visualization" }, { - "attributes": { - "description": "Pods not found in the endpoint table, possibly invalid.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", + "name": "panel_13", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2020-10-13T13:01:42.340Z", + "version": "WzI5OCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Dashboards Navigation Overview [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 12, + "markdown": "**Overview** | [Traffic](#/dashboard/3b88a120-0c7c-11eb-a3fd-1b45ec532bb3)\n", + "openLinksInNewTab": false + }, + "title": "Dashboards Navigation Overview [Metricbeat Istio]", + "type": "markdown" + } + }, + "id": "19a8b9c0-0c7f-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzQ2LDFd" + }, + { + "attributes": { + "description": "Total time in seconds Pilot takes to push lds, rds, cds and eds.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot xds Push Time [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "prometheus.labels.type: \"rds\" OR prometheus.labels.type: \"lds\" OR prometheus.labels.type: \"cds\" OR prometheus.labels.type: \"eds\"" }, - "title": "Pilot Pods without IP [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Pilot No IP pods", - "field": "prometheus.pilot_no_ip.value" - }, - "schema": "metric", - "type": "avg" - } + "formatter": "s,s,2", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_push_time", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_push_time.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } ], - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "automatic", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 50 - }, - { - "from": 50, - "to": 75 - }, - { - "from": 75, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "rgba(105,112,125,0.2)", - "labels": false, - "show": true - }, - "style": { - "bgColor": true, - "bgFill": "rgba(105,112,125,0.2)", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "title": "Pilot Pods without IP [Metricbeat Istio]", - "type": "gauge" - } - }, - "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" - }, - "references": [ - { - "id": "metricbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_size": "20", + "type": "timeseries", + "value_template": "{{value}}" + } ], - "type": "visualization", - "updated_at": "2020-10-07T09:48:31.873Z", - "version": "WzQ0MjcsMV0=" + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Pilot xds Push Time [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "b5b3abb0-087c-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:01:21.843Z", + "version": "WzI2MCwxXQ==" + }, + { + "attributes": { + "description": "Pilot build and send errors for lds, rds, cds and eds.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} }, - { - "attributes": { - "description": "Total virtual services known to pilot.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "title": "Pilot xds Pushes [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" }, - "title": "Pilot Virtual Services [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Pilot Virtual Services", - "field": "prometheus.pilot_virt_services.value" - }, - "schema": "metric", - "type": "avg" - } + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_pushes", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_pushes.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } ], - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "automatic", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 50 - }, - { - "from": 50, - "to": 75 - }, - { - "from": 75, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "rgba(105,112,125,0.2)", - "labels": false, - "show": true - }, - "style": { - "bgColor": true, - "bgFill": "rgba(105,112,125,0.2)", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "title": "Pilot Virtual Services [Metricbeat Istio]", - "type": "gauge" - } - }, - "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" - }, - "references": [ - { - "id": "metricbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "4", + "type": "timeseries", + "value_template": "{{value}}" + } ], - "type": "visualization", - "updated_at": "2020-10-07T09:50:53.286Z", - "version": "WzQ0MzMsMV0=" + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot xds Pushes [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "f858c200-087e-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzQ4LDFd" + }, + { + "attributes": { + "description": "Total number of updates received by pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} }, - { - "attributes": { - "description": "Total services known to pilot.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "title": "Pilot Inbound Updates [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" }, - "title": "Pilot Services [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Pilot Services", - "field": "prometheus.pilot_services.value" - }, - "schema": "metric", - "type": "avg" - } + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_inbound_updates", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_inbound_updates.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } ], - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "automatic", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 50 - }, - { - "from": 50, - "to": 75 - }, - { - "from": 75, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "rgba(105,112,125,0.2)", - "labels": false, - "show": true - }, - "style": { - "bgColor": true, - "bgFill": "rgba(105,112,125,0.2)", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "title": "Pilot Services [Metricbeat Istio]", - "type": "gauge" - } - }, - "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" - }, - "references": [ - { - "id": "metricbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "10", + "type": "timeseries", + "value_template": "{{value}}" + } ], - "type": "visualization", - "updated_at": "2020-10-07T10:04:27.677Z", - "version": "WzQ0NTksMV0=" + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot Inbound Updates [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "aa997510-087d-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzQ5LDFd" + }, + { + "attributes": { + "description": "Number of conflicting inbound listeners.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } }, - { - "attributes": { - "description": "Number of conflicting inbound listeners.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot conflict inbound listener", + "field": "prometheus.pilot_conflict_inbound_listener.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 }, - "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Pilot conflict inbound listener", - "field": "prometheus.pilot_conflict_inbound_listener.value" - }, - "schema": "metric", - "type": "avg" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "automatic", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 50 - }, - { - "from": 50, - "to": 75 - }, - { - "from": 75, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "rgba(105,112,125,0.2)", - "labels": false, - "show": true - }, - "style": { - "bgColor": true, - "bgFill": "rgba(105,112,125,0.2)", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", - "type": "gauge" + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" }, - "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Conflict Inbound Listener [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "d62a1e60-0881-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzUwLDFd" + }, + { + "attributes": { + "description": "Time in seconds, a proxy is in the push queue before being dequeued.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Proxy Queue Time [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" }, - "references": [ - { - "id": "metricbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "queue_time", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_proxy_queue_time.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "03ef6580-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "071fe4f0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "0b7164c0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "90" + }, + { + "id": "0f611580-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "136f98e0-0887-11eb-876a-9d8e5e94d2f5", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } ], - "type": "visualization", - "updated_at": "2020-10-07T09:45:30.182Z", - "version": "WzQ0MjAsMV0=" + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Pilot Proxy Queue Time [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "dd1392f0-07d8-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:59:52.108Z", + "version": "WzI0NywxXQ==" + }, + { + "attributes": { + "description": "Resource validation failed.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} }, - { - "attributes": { - "description": "Number of clusters without instances.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "title": "Galley Validation Failed [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" }, - "title": "Pilot eds Instances [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Pilot eds instnaces", - "field": "prometheus.pilot_eds_no_instances.value" - }, - "schema": "metric", - "type": "avg" - } + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "galley_validation_failed", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.galley_validation_failed.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } ], - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "automatic", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 50 - }, - { - "from": 50, - "to": 75 - }, - { - "from": 75, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "rgba(105,112,125,0.2)", - "labels": false, - "show": true - }, - "style": { - "bgColor": true, - "bgFill": "rgba(105,112,125,0.2)", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "title": "Pilot eds Instances [Metricbeat Istio]", - "type": "gauge" + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.resource", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "10", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Galley Validation Failed [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "98b01f00-087f-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzUyLDFd" + }, + { + "attributes": { + "description": "Pods not found in the endpoint table, possibly invalid.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Pods without IP [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot No IP pods", + "field": "prometheus.pilot_no_ip.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" }, - "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" - }, - "references": [ + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Pods without IP [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "4275f710-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzUzLDFd" + }, + { + "attributes": { + "description": "Total virtual services known to pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Virtual Services [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot Virtual Services", + "field": "prometheus.pilot_virt_services.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ { - "id": "metricbeat-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 + }, + { + "from": 75, + "to": 100 } - ], - "type": "visualization", - "updated_at": "2020-10-07T09:47:11.918Z", - "version": "WzQ0MjQsMV0=" - }, + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" + }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Virtual Services [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "96bfe060-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ { - "attributes": { - "description": "Number of endpoints connected to this pilot using XDS.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU0LDFd" + }, + { + "attributes": { + "description": "Total services known to pilot.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot Services [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot Services", + "field": "prometheus.pilot_services.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 }, - "title": "Pilot XDS endpoints [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "pilot_xds", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_xds.value", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot XDS endpoints [Metricbeat Istio]", - "type": "metrics" + { + "from": 75, + "to": 100 } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" }, - "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T09:53:38.583Z", - "version": "WzQ0NDEsMV0=" - }, + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot Services [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "6cfbe3f0-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ { - "attributes": { - "description": "Total number of XDS requests with an expired nonce.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU1LDFd" + }, + { + "attributes": { + "description": "Number of clusters without instances.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pilot eds Instances [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "Pilot eds instnaces", + "field": "prometheus.pilot_eds_no_instances.value" + }, + "schema": "metric", + "type": "avg" + } + ], + "params": { + "addLegend": true, + "addTooltip": true, + "gauge": { + "alignment": "automatic", + "backStyle": "Full", + "colorSchema": "Green to Red", + "colorsRange": [ + { + "from": 0, + "to": 50 + }, + { + "from": 50, + "to": 75 }, - "title": "Pilot XDS expired [Metricbeat Istio]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", - "index_pattern": "metricbeat-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#6092C0", - "fill": 0, - "formatter": "number", - "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", - "label": "pilot_xds_expired_nonce", - "line_width": 2, - "metrics": [ - { - "field": "prometheus.pilot_xds_expired_nonce.counter", - "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", - "percentiles": [ - { - "id": "88c0d000-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "50" - }, - { - "id": "95c750d0-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "25" - }, - { - "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "75" - }, - { - "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "95" - }, - { - "id": "a3581040-07d8-11eb-86d1-6521145f6524", - "mode": "line", - "percentile": "", - "shade": 0.2, - "value": "99" - } - ], - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Pilot XDS expired [Metricbeat Istio]", - "type": "metrics" + { + "from": 75, + "to": 100 } + ], + "extendRange": true, + "gaugeColorMode": "Labels", + "gaugeStyle": "Full", + "gaugeType": "Arc", + "invertColors": false, + "labels": { + "color": "black", + "show": true + }, + "orientation": "vertical", + "percentageMode": false, + "scale": { + "color": "rgba(105,112,125,0.2)", + "labels": false, + "show": true + }, + "style": { + "bgColor": true, + "bgFill": "rgba(105,112,125,0.2)", + "bgMask": false, + "bgWidth": 0.9, + "fontSize": 60, + "mask": false, + "maskBars": 50, + "subText": "", + "width": 0.9 + }, + "type": "meter" }, - "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", - "migrationVersion": { - "visualization": "7.8.0" + "isDisplayWarning": false, + "type": "gauge" + }, + "title": "Pilot eds Instances [Metricbeat Istio]", + "type": "gauge" + } + }, + "id": "12cdcce0-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU2LDFd" + }, + { + "attributes": { + "description": "The number of certificates issuances that have succeeded.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Citadel Cert Issuance [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" }, - "references": [], - "type": "visualization", - "updated_at": "2020-10-07T09:54:14.728Z", - "version": "WzQ0NDMsMV0=" + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "success_cert_issuance", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.citadel_server_success_cert_issuance_count.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max", + "unit": "" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "terms_field": "prometheus.labels.type", + "terms_order_by": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "terms_size": "4", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Citadel Cert Issuance [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "506c8490-087f-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU3LDFd" + }, + { + "attributes": { + "description": "Number of endpoints connected to this pilot using XDS.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Pilot XDS endpoints [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds.value", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot XDS endpoints [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "e5f3e870-0882-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU4LDFd" + }, + { + "attributes": { + "description": "Total number of XDS requests with an expired nonce.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Pilot XDS expired [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "pilot_xds_expired_nonce", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.pilot_xds_expired_nonce.counter", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Pilot XDS expired [Metricbeat Istio]", + "type": "metrics" } - ], - "version": "7.8.0" + }, + "id": "0ed17c80-0883-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.050Z", + "version": "WzU5LDFd" + } + ], + "version": "7.9.0" } diff --git a/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-traffic.json b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-traffic.json new file mode 100644 index 00000000000..5998c84f3c3 --- /dev/null +++ b/x-pack/metricbeat/module/istio/_meta/kibana/7/dashboard/Metricbeat-istio-traffic.json @@ -0,0 +1,1274 @@ +{ + "objects": [ + { + "attributes": { + "description": "Istio traffic statistics based on metrics collected from istio proxies", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 3, + "i": "fbc3815e-eb3a-46dd-b37a-a61b741b754e", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "fbc3815e-eb3a-46dd-b37a-a61b741b754e", + "panelRefName": "panel_0", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Number of requests per source" + }, + "gridData": { + "h": 11, + "i": "1f88dc8b-1c21-40e0-8507-b468643d5507", + "w": 15, + "x": 10, + "y": 0 + }, + "panelIndex": "1f88dc8b-1c21-40e0-8507-b468643d5507", + "panelRefName": "panel_1", + "title": "Number of requests per source", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Number of requests per destination" + }, + "gridData": { + "h": 11, + "i": "7c7c491b-c55c-4892-a73e-3bfb5af9a610", + "w": 23, + "x": 25, + "y": 0 + }, + "panelIndex": "7c7c491b-c55c-4892-a73e-3bfb5af9a610", + "panelRefName": "panel_2", + "title": "Number of requests per destination", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Destination Apps" + }, + "gridData": { + "h": 8, + "i": "c87dc307-71f1-4642-8d2a-60066f5ab114", + "w": 10, + "x": 0, + "y": 3 + }, + "panelIndex": "c87dc307-71f1-4642-8d2a-60066f5ab114", + "panelRefName": "panel_3", + "title": "Destination Apps", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Duration of requests per destination" + }, + "gridData": { + "h": 10, + "i": "894e458b-c822-4df1-ae43-aa99d73bfedc", + "w": 12, + "x": 12, + "y": 11 + }, + "panelIndex": "894e458b-c822-4df1-ae43-aa99d73bfedc", + "panelRefName": "panel_4", + "title": "Duration of requests per destination", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Size of requests per source" + }, + "gridData": { + "h": 10, + "i": "28d6f60d-1b2c-4688-9cbc-5ebf3d587469", + "w": 12, + "x": 24, + "y": 11 + }, + "panelIndex": "28d6f60d-1b2c-4688-9cbc-5ebf3d587469", + "panelRefName": "panel_5", + "title": "Size of requests per source", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Size of requests per destination" + }, + "gridData": { + "h": 10, + "i": "1b1f0dcb-613d-4b71-a8a9-e30f79734ede", + "w": 12, + "x": 36, + "y": 11 + }, + "panelIndex": "1b1f0dcb-613d-4b71-a8a9-e30f79734ede", + "panelRefName": "panel_6", + "title": "Size of requests per destination", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Duration of requests per source" + }, + "gridData": { + "h": 10, + "i": "ae905bb4-456f-4122-8f5c-44a9ced608f1", + "w": 12, + "x": 0, + "y": 11 + }, + "panelIndex": "ae905bb4-456f-4122-8f5c-44a9ced608f1", + "panelRefName": "panel_7", + "title": "Duration of requests per source", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Size of response per source" + }, + "gridData": { + "h": 10, + "i": "3f4222fc-a243-4141-8787-1dd41d9f1661", + "w": 17, + "x": 12, + "y": 21 + }, + "panelIndex": "3f4222fc-a243-4141-8787-1dd41d9f1661", + "panelRefName": "panel_8", + "title": "Size of response per source", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Size of response per destination" + }, + "gridData": { + "h": 10, + "i": "4c498b69-296c-4e30-8a35-1510566ea5ef", + "w": 19, + "x": 29, + "y": 21 + }, + "panelIndex": "4c498b69-296c-4e30-8a35-1510566ea5ef", + "panelRefName": "panel_9", + "title": "Size of response per destination", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "hidePanelTitles": false, + "title": "Response Codes" + }, + "gridData": { + "h": 10, + "i": "2a128040-ef73-40a2-8b52-62c8180bcad7", + "w": 12, + "x": 0, + "y": 21 + }, + "panelIndex": "2a128040-ef73-40a2-8b52-62c8180bcad7", + "panelRefName": "panel_10", + "title": "Response Codes", + "version": "7.9.0" + } + ], + "timeRestore": false, + "title": "[Metricbeat Istio] Traffic", + "version": 1 + }, + "id": "3b88a120-0c7c-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "96c4a5c0-0c7c-11eb-a3fd-1b45ec532bb3", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "e14e3560-0c78-11eb-a3fd-1b45ec532bb3", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "c7468af0-0c78-11eb-a3fd-1b45ec532bb3", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "1d076a90-0c7e-11eb-a3fd-1b45ec532bb3", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "3ae9b3f0-0c7a-11eb-a3fd-1b45ec532bb3", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "60dacbe0-0c79-11eb-a3fd-1b45ec532bb3", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "78375380-0c79-11eb-a3fd-1b45ec532bb3", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "5fd462f0-0c7a-11eb-a3fd-1b45ec532bb3", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "b4235550-0c7a-11eb-a3fd-1b45ec532bb3", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "8d818070-0c7a-11eb-a3fd-1b45ec532bb3", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "09404610-0c7b-11eb-a3fd-1b45ec532bb3", + "name": "panel_10", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2020-10-13T13:18:36.737Z", + "version": "WzUxNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Dashboards Navigation Overview Traffic [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 12, + "markdown": "[Overview](#/dashboard/d899d3f0-0883-11eb-a3fd-1b45ec532bb3) | **Traffic**", + "openLinksInNewTab": false + }, + "title": "Dashboards Navigation Overview Traffic [Metricbeat Istio]", + "type": "markdown" + } + }, + "id": "96c4a5c0-0c7c-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.894Z", + "version": "WzYxLDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Number of requests per source [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Number of requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_requests_total.rate", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.source_app", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Number of requests per source [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "e14e3560-0c78-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.894Z", + "version": "WzYyLDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Number of requests per destination [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Number of requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_requests_total.rate", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "9f8e3700-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "max" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.destination_app", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Number of requests per destination [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "c7468af0-0c78-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.894Z", + "version": "WzYzLDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Destination Apps [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [ + { + "enabled": true, + "id": "1", + "params": { + "customLabel": "some" + }, + "schema": "metric", + "type": "count" + }, + { + "enabled": true, + "id": "2", + "params": { + "field": "prometheus.labels.destination_app", + "missingBucket": false, + "missingBucketLabel": "Missing", + "order": "desc", + "orderBy": "1", + "otherBucket": false, + "otherBucketLabel": "Other", + "size": 25 + }, + "schema": "segment", + "type": "terms" + } + ], + "params": { + "maxFontSize": 49, + "minFontSize": 13, + "orientation": "single", + "scale": "linear", + "showLabel": false + }, + "title": "Destination Apps [Metricbeat Istio]", + "type": "tagcloud" + } + }, + "id": "1d076a90-0c7e-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "metricbeat-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.894Z", + "version": "WzY0LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Duration of requests per destination [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "ms,s,2", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Duration of Requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_request_duration_milliseconds.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.destination_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Duration of requests per destination [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "3ae9b3f0-0c7a-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:04:46.542Z", + "version": "WzM0MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Size of requests per source [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "bytes", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Size of Requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_request_bytes.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile", + "values": [ + "99" + ] + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.source_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Size of requests per source [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "60dacbe0-0c79-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:15:39.548Z", + "version": "WzQ4NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Size of requests per destination [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "bytes", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Size of Requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_request_bytes.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile", + "values": [ + "99" + ] + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.destination_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Size of requests per destination [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "78375380-0c79-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:15:47.103Z", + "version": "WzQ5MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Duration of requests per source [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "ms,s,2", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Duration of Requests", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_request_duration_milliseconds.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.source_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Duration of requests per source [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "5fd462f0-0c7a-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:03:54.986Z", + "version": "WzMyNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Size of response per source [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "bytes", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Size of Responses", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_response_bytes.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile_rank", + "values": [ + "99" + ] + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.source_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Size of response per source [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "b4235550-0c7a-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:13:05.112Z", + "version": "WzQ0NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Size of response per destination [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "bytes", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Size of Responses", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_response_bytes.histogram", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "percentile", + "values": [ + "99" + ] + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.destination_app", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Size of response per destination [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "8d818070-0c7a-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T13:16:05.893Z", + "version": "WzQ5NywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": {} + }, + "title": "Response Codes [Metricbeat Istio]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "7ccbe640-07d8-11eb-985d-2f490d4c2901", + "index_pattern": "metricbeat-*", + "interval": "auto", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#6092C0", + "fill": 0, + "formatter": "number", + "id": "7ccbe641-07d8-11eb-985d-2f490d4c2901", + "label": "Response Codes", + "line_width": 2, + "metrics": [ + { + "field": "prometheus.istio_response_bytes.histogram.values", + "id": "7ccbe642-07d8-11eb-985d-2f490d4c2901", + "percentiles": [ + { + "id": "88c0d000-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "25" + }, + { + "id": "95c750d0-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "50" + }, + { + "id": "9c5ec900-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "75" + }, + { + "id": "a3581040-07d8-11eb-86d1-6521145f6524", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "95" + }, + { + "id": "257a4bc0-0c79-11eb-a187-45e4454f723b", + "mode": "line", + "percentile": "", + "shade": 0.2, + "value": "99" + } + ], + "type": "count" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "none", + "terms_field": "prometheus.labels.response_code", + "terms_size": "100", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Response Codes [Metricbeat Istio]", + "type": "metrics" + } + }, + "id": "09404610-0c7b-11eb-a3fd-1b45ec532bb3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-10-13T12:53:51.894Z", + "version": "WzcxLDFd" + } + ], + "version": "7.9.0" +} diff --git a/x-pack/metricbeat/module/istio/fields.go b/x-pack/metricbeat/module/istio/fields.go index ccd41e55fe8..49ad72ab697 100644 --- a/x-pack/metricbeat/module/istio/fields.go +++ b/x-pack/metricbeat/module/istio/fields.go @@ -19,5 +19,5 @@ func init() { // AssetIstio returns asset data. // This is the base64 encoded gzipped contents of module/istio. func AssetIstio() string { - return "eJzUXE2T47bRvu+v6PLltd+a5V5Te0hVap2PrcSuza5TSeUiQ2BLhAUCNNCURv71KXyRFEVp9AFq1nPYnZFIPM8DNIBGd5NvYYP79yAsCf0GgARJfA/ffHR/f/MGoETLjWhIaPUe/vgGAMK18IMuW4lvAAxKZBbfwxKJvQFYCZSlfe8vfQuK1dg3735o3+B7WBvdNvGTCQz387O/62fgWhETyoIlRu4zboEqRrBDg2CQlbAyuoaPA5AhiSERLoiVKLvPp+icoeR+PkzQMSgZYQmkgSoMTOBDwAKLZis4DhoZd1n6GbMeMl+bhhc1UqXLg++Tgg3ud9qMvzujw/38VKFvGCYaPgA+1pALearlA2gHkhfX3Q565YfKoG2Qk9ieoDPJyyI3SAtnmEZLiWZht3zBOF9wg84QFhwNFVy3iiapS63W1/NWbb1E45i75sVKcEZoIWJC2aIzwKgAGPf44WuhVXFCitmiWRityZNe4HMjzH5hkWtV2kn2K6nZWNcF9FslnoFEjZZY3TyBUBBRnmBXoeomjCPjJcJOSAmeERbwbwSLBIKcSoVr5kdNKODM+vEUitAoJgGN0WZab2fNaIqKqVLi9HS6YYQ0MTkYo8+fPljgum4kutHRyttbgH4Cg2tmSonWumtty7n/1cCKCdkafJl9bdeFQY5iO6cEsGSQ1VCjtWyNbqkLkIeCLqNrMd98GFFdT3F1eLDcX8XTEjM0r1FEiFM9eJndCrUu3Kaj+L6obbFs+Qap+P9J3nr5C/Jxz4cPF/csSG7x1MoiRCLwbS2kFHFWf9eNi9+tK1bCElEBaxrpli6h1VuJW5QQJ+K1QzXVD7atLx26lTY1o/dQtsaTyaA/Cn4C29buj/C5QOuWqWHf3KQt935ymn5vsDWSEdweG2dHmkmJ+4c4VAEqkz/l/s3rVrgWB26Fbg1H/0foQxBDWSc52Ybl9rP+3i7RKHS+QocwJjrJZ4vGHk+MO9nERhOBibWpc9adb8UnpuadDPp2EwmhLDH1ktvnzyMFa6lCRXEFK2q0VaOlcLN8Fl9vy6QoA/a7Q+x3Q2zYKL1TbsLEacIIGDRaKHKLj/O7Lhf1WoLyiHHdUvyAtvqg1UqMueYX4fDe9Xj3kVdIO202bukv0ZJQvmdMKx8wGj32uzF2NlGotnq/EpLQPFTQEDebmDUj3LH9Q4UkzGwirCiRs8eORsLMJmIrDLVMRt/goVpG0PdJ8ivgvmBERixbwpopsUJL8ysKyO+OkbMICi7+A4wsykh4Wcgn9+Bh7DvALPQfs3lE6lfvFud9LtMqd3XRGM3RWm0K3KKihW2YKtLJ7dUOwImAO3js3NkWGa9AKK5rodbgqQKzUAlLem1YDYHmZefBi7U/9NB7iebuAJwuziw490n4Mk0XnIrPq7GKNbbStPANvpLN9ioCixSd2WIIz0S6WE4a7o1Kr7DQnBI6OwzX3Uj+925tUqzQf/f1rJduSJzoxDHnInle9+uslWO92RbI82Jns9xjPTeaqyVG6G1qMa+X5ZN+vV/VoAkf/evzP14gaBjhel9oteAVU+vp4Nzd9ESNNkS/I+D/WdDqg0eEitmwsnHnTk3naY8Iu7/M4tdWoOW4MG688uU1JsgziFg93SnQLvPo446LTbvERdzmQxZsQZqYnJXopo+IxjhtxF61Uu67fARTYTGeDo463zfMNJ843eC+aJuSUTYD/mvwnXsg2OGy0nozzP/CFOYURx+bKqRmuWxg8wfbE/Ktp9XhW4PfOaBLSeXtttO8xjhvT2QOEtMabfVmTGiOzIYDypTXOAplD7kTPt+QuG+MrpEqbO106wn6F72cRL05UD8AHrfdrXr4a5szPOLztanRYWKSqThWjdHP+3NcXtfN+hxI9Fv1jW7VhJaHuU6fU/+n2291lyZE5HSJJnj2e82kZY6ZWfEbFss94StayhfxG1560Dumne9kd4LPGOAMlxnGdszmEOIEsZBW//0N7jHvVxzdYzJfy/A22hCafFvd59giiBKV8+viSSAh9bn6YPHwkUBYXwxHGgaZOhCreJP73hfFslhNM9y8gKky+b1Td3ApUNHwjhO1g76JYqfNxnl7Re6SCmHHPZJKLCL5hAy7SvAKYj1mPEYFchcTz153Mc3+oPhiJOMs2cYIxUVz4mCUjWODaKDDSkTJsNVK8MRlYIC+cNPfdJjKd9+3Fs9rYk0zr5rYwaxpYMlsKLlzf0i2RHnLKMxQEXPMelQhc5LfJNHBcvAaM3O4Gp3v0ZNEX2Mm3kb7q5iTQ0J3T8xhY7PPzmGnn5+ik8PzsoLXmK3nLelFyjEIUFTaTrs6WXgPSabnBRxicrvEUqI7w7lTb5eXSO7HxRrmX3WmdDjU6zg+esGZYP2ChaSub4wmzfXc601EOe93/unTx/5KsXK/b0WJ5RNoqtDshO3uBG2cc6Zi0WW6a3qUOs+f6zJfrP1YZVf97HCOpPo7whokLDQG/bMEWsm9W6D+9tNPn1KeY1pFL7ewyFsjaB/LMWb2eNLTP4eLfoA+P6B1Sy2TC5I2bB7B/4/bhb+AbVxv1XWrUrteG/oDxegYcWJbIg2tCtUhHmR0V4rGC+X+jR2X2HOmlCZYegtt0Ej3TdP6eGo/Cl3wVjwfHNJmjN46pFzh21DBypsiDRLjm3kyYmlyOoD+sZ70DMaZ41OM2rOSNYSmEGqlC//IlY0B/VnoBgRA5c/oaPwTb8ZtTDEb6n6NBh6pgaN2mAO4XFH4bJ6uDxMgwvlYpmPNW2PcKhPZnGWaqvRm5deB3MAwFuA9oBu7Ur/bSUbr7TNTj7LgJXLWWkwahrk+g9QaheW5pxmjjJSV+cpmYaJ1xQzslMxvNn0twPV2Y1r5tXW2o3RFRw8V1Ix4Nc8WE0mVIiRtwmP7zILbxxtmLLKlPL/LeKLzW0MoW73eEgjrxrkEX5k1JFpXWESnZP7OTlC3dHirrPPGVgLLgnkHexEXz1kIB4houSsmZP+gfbfvLNH1fKvYlgl52qBLYRs309AsBs6xXTRoFltmBNJ+xtKXH7yTmhyjIQHv8iV7iUQ86LSMtGcm+QWX2s5UWNR1cf++j4CWLD8YBZBhyorTJp44lwxrrXKadrLcQ4vZIgQoMLoloYKlM1iLLXZ+H6DaCqNVjepEUCXRju8EsMWyFfIRPR0NPb064sbe7mj7MXvUmrirhAxm4ih3um6T0Bm5wt2jLFzhTu4Hb/W4i7fB9oGT0+Db9vbZOe8j2XFCwtRu0Zem+dVvPhJjgATcCKnpIcEKj5QpWPFc5k3Kf/AvrNErZzhpYX3+/ktKSPcxNeuD05+clGmTcsya1lbZzscdNcfn4AUjT8As7FBK939cj/w67d0x467xvw5vPGreyZGlfQLj/uGl9SE1LE9EF5M8X+P7OtX8vlDOwYdhAGIbtM7UHK9pLU8v16JdKDfj4yR36oh1aaGw+DYxWYv075TDk5l7QacFOMvMXa//sTuQu9ngHy/gsrWExk8x/zoVS15IAf9Fo4dHeOuLtU9HSrpe51oRPlM8r2Wi/uPYIfnW9Z9uyX4HQgkSjPw5zY1BInCSZnqNVV6K4zcRdS/L+s/3XxJrocL2cPoAJgWnQgpLqHycdKlblcu76DsxIbk+ixiQQE/nW0bkdEv+zqIiagq9RVPEPaUgPp3ZzsV5J2TJmSnBQffMYSeo6k4M3UXE+2vuEOd+y2/PQ1k+6zVS4ze+cKp3X3+BRhu6foyIj4bIqXnMGA27/9QQHYzj/eLmtr8zkl42tlDwx7Xavo5j4fYuhViGXFTcxeL+9We11fvDmNbtXsWh0IwuxT0KrvcnDmVkdSbuEXKJJ3H2bR1ug1ofRfUu2uWOX8VxZlvbCkNF7veGeBrxxSDX0VG6ELlWh0+6DKH2ld9CY7AVVRnexEBsKfEJGm2tWMo9COXTTyfWt+CKTTK77bGiLj30l39+/+M0KJ169+ttiMFmQw304ZNhIdz5vwAAAP//h0iIoA==" + return "eJzUXE2T47bRvu+v6PLltd+a5V5Te0hVap2PrcSuza5TSeUiQ2BLhAUCNNCURv71KXyRFEVp9AFq1nPYnZFIPM8DNIBGd5NvYYP79yAsCf0GgARJfA/ffHR/f/MGoETLjWhIaPUe/vgGAMK18IMuW4lvAAxKZBbfwxKJvQFYCZSlfe8vfQuK1dg3735o3+B7WBvdNvGTCQz387O/62fgWhETyoIlRu4zboEqRrBDg2CQlbAyuoaPA5AhiSERLoiVKLvPp+icoeR+PkzQMSgZYQmkgSoMTOBDwAKLZis4DhoZd1n6GbMeMl+bhhc1UqXLg++Tgg3ud9qMvzujw/38VKFvGCYaPgA+1pALearlA2gHkhfX3Q565YfKoG2Qk9ieoDPJyyI3SAtnmEZLiWZht3zBOF9wg84QFhwNFVy3iiapS63W1/NWbb1E45i75sVKcEZoIWJC2aIzwKgAGPf44WuhVXFCitmiWRityZNe4HMjzH5hkWtV2kn2K6nZWNcF9FslnoFEjZZY3TyBUBBRnmBXoeomjCPjJcJOSAmeERbwbwSLBIKcSoVr5kdNKODM+vEUitAoJgGN0WZab2fNaIqKqVLi9HS6YYQ0MTkYo8+fPljgum4kutHRyttbgH4Cg2tmSonWumtty7n/1cCKCdkafJl9bdeFQY5iO6cEsGSQ1VCjtWyNbqkLkIeCLqNrMd98GFFdT3F1eLDcX8XTEjM0r1FEiFM9eJndCrUu3Kaj+L6obbFs+Qap+P9J3nr5C/Jxz4cPF/csSG7x1MoiRCLwbS2kFHFWf9eNi9+tK1bCElEBaxrpli6h1VuJW5QQJ+K1QzXVD7atLx26lTY1o/dQtsaTyaA/Cn4C29buj/C5QOuWqWHf3KQt935ymn5vsDWSEdweG2dHmkmJ+4c4VAEqkz/l/s3rVrgWB26Fbg1H/0foQxBDWSc52Ybl9rP+3i7RKHS+QocwJjrJZ4vGHk+MO9nERhOBibWpc9adb8UnpuadDPp2EwmhLDH1ktvnzyMFa6lCRXEFK2q0VaOlcLN8Fl9vy6QoA/a7Q+x3Q2zYKL1TbsLEacIIGDRaKHKLj/O7Lhf1WoLyiHHdUvyAtvqg1UqMueYX4fDe9Xj3kVdIO202bukv0ZJQvmdMKx8wGj32uzF2NlGotnq/EpLQPFTQEDebmDUj3LH9Q4UkzGwirCiRs8eORsLMJmIrDLVMRt/goVpG0PdJ8ivgvmBERixbwpopsUJL8ysKyO+OkbMICi7+A4wsykh4Wcgn9+Bh7DvALPQfs3lE6lfvFud9LtMqd3XRGM3RWm0K3KKihW2YKtLJ7dUOwImAO3js3NkWGa9AKK5rodbgqQKzUAlLem1YDYHmZefBi7U/9NB7iebuAJwuziw490n4Mk0XnIrPq7GKNbbStPANvpLN9ioCixSd2WIIz0S6WE4a7o1Kr7DQnBI6OwzX3Uj+925tUqzQf/f1rJduSJzoxDHnInle9+uslWO92RbI82Jns9xjPTeaqyVG6G1qMa+X5ZN+vV/VoAkf/evzP14gaBjhel9oteAVU+vp4Nzd9ESNNkS/I+D/WdDqg0eEitmwsnHnTk3naY8Iu7/M4tdWoOW4MG688uU1JsgziFg93SnQLvPo446LTbvERdzmQxZsQZqYnJXopo+IxjhtxF61Uu67fARTYTGeDo463zfMNJ843eC+aJuSUTYD/mvwnXsg2OGy0nozzP/CFOYURx+bKqRmuWxg8wfbE/Ktp9XhW4PfOaBLSeXtttO8xjgHp6Vht0znMC5NM6Rma7TVi43mSIw4oExpkaNI+JA74fMNef/G6BqpwtZOt56gf9HLSdSb4/wD4HHb3aKJv7Y5oys+3ZsaHeY1mYpj1Rj9vD/H5XW9tM+BRL/T3+iVTWh5mOf1OfV/uv1Wb2tCRE6PaoJnv1VNWuaYmRW/YbHcE76ipXwRv+Gl58Rj2vkOhif4jAHOcJlhbMdsDiFOEAtZ+d/f4B7zfsXRPSbztQxvow2hybfVfY4tgihRObcwHiQSUp/qDxYPHwmE9bV0pGGQ6AOxije5731NLYvFOMPNC5gqk9s8dQeXAhUN7zhReuibKHbabJyzWOSuyBB23COpQiOST8iwqwSvIJZzxlNYIHcx8exlG9PsD2o3RjLOkm2MUFw0J85V2Tg2iAY6rESUDFutBE9cBgbo6z79TYeVAO771uJ5Taxp5lUTO5g1DSyZDRV77g/JlihvGYUZCmqOWY8KbE7ymyQ6WA5eY2YOV6PzPXqS6GvMxNtofxVzckjo7ok5bGz22Tns9PNTdHJ4XlbwGrP1vCW9SDkGAYpK22lXJwvvIcn0uIFDTG6XWEp0Zzh36u3SGsn9uFjD/KvOlA6Heh3HRy84E6xfsJDU9Y3RpLmee72JKOf9zj99+thfKVbu960osXwCTRWanbDdnaCNc85UrNlMd02PUuf5c13mC9Ufq+yKpx3OkVR/R1iDhIXGoH8UQSu5dwvU33766VNKk0yr6OUWFnlrBO1jNcfMHk96eOhw0Q/Q5we0bqllckHShs0j+P9xu/AXsI3rrbpuVWrXa0N/oBgdI05sS6ShVaG4xIOM7krBfKHcv7HjEnvOlNIES2+hDRrpvmlaH0/tR6EL3orng0PajNFbh5QrfBsKYHlTpEFifDNPQi1NTgfQPxWUHuE4c3yKQX9WsobQFEKtdOGf2LIxHzAL3YAAqPwZHY1/YM64jSkmU92v0cAjNXDUDlMIlysKn83T9WECRDgfy3SseWuMW2Uim7NMU5HfrPw6kBsYxvq9B3RjVyl4O8lovX1i61EWvETOWotJwzBVaJBao7A89zBklJGyMl/ZLEy0rpiBnZL5zaYvJbjebkwrv7bOdpSu6OihgpoRr+bZYiKpUoSkTXjqn1lw+3jDjEW2lOd3GU90fmsIVa/XWwJh3TiX4CuzhkTrCovolMzf2Qnqlg5vlXXe2EpgWTDvYC/i4jkL4QARLXfFhOyf0+/2nSW6nm8V2zIhTxt0KWzjZhqaxcA5tosGzWLLjEDaz1g584N3UpNjNCTgXb5kL5GIB52WkfbMJL/gUtuZ6pK6Lu5fFxLQkuUHowAyTFlx2sQT55JhrVVO006We2gxW4QABUa3JFSwdAZrscXO7wNUW2G0qlGdCKok2vGVArZYtkI+oqejoac3T9zY2x1tP2aPWhN3lZDBTBzlTtdtEjojV7h7lIUr3Mn94KUgd/E22D5wchp8294+O+d9ojtOSJjaLfrKNr/6zUdiDJCAGyE1PSRY4ZEyBSuey7xJ+Q/+fTd65QwnLazP339JCek+pmZ9cPqTkzJtUo5Z09oq2/m4o+b4HLyf5AmYhR1K6f6P65Ffp707Ztw1/tfhjUfNOzmytE9g3D+8tD6khuWJ6GKS50uEX+dhAF8o5+DDMACxDVpnao7XtJanl2vRLpSb8WmUO3XEurRQl3ybmKw1/nfK4cnMvaDTApxl5i73/9gdyN1s8E8ncNlaQuOnmH8biyUvpID/otHDI7z1td6nIyVdr3OtCJ8pntcyUf9x7JB86/pPt2S/A6EECUb+nObGIBE4STO9BSsvxfGLjLp3bf3n+y+JtVBhezh9AJOCUyGFJVQ+TrrUrcrlXfSdmJBcn0UMSKCn8y0jcrolf2dRETWF3qIp4p5SEJ/ObOfivBOy5MyU4KB75rATVHUnhu4i4v01d4hzv+W356Esn/UaqfEbXzjVu6+/QKMNXT9GxEdD5NQ8ZoyG3X9qiA7G8X5xc9vfGUkvG1so+ONabV/HsXB7l0IsQy4q7mJx//qz2ur9YUzrdq/iUGhGl+IeBdf7E4cysjoT9wi5xJM4+7IPt0Gtj6J6F+1yx2/yOLOtbYWhIvdrRzyN+F6R6+goXYhcq8MnXYZQ+8pvoTHYiqoML3IgtpT4BI22VizlHoTy6acT61twxSaZ3fZYUZce+ss/v/9xGpROvTr2NsRgs6EG+vDBssNw58HUevFU/tLJ+X8BAAD//yTCrUI=" } diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc b/x-pack/metricbeat/module/istio/istiod/_meta/docs.asciidoc similarity index 100% rename from x-pack/metricbeat/module/istio/istiod/_meta/docs.ascoodoc rename to x-pack/metricbeat/module/istio/istiod/_meta/docs.asciidoc diff --git a/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml b/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml index 8033a27f5ac..dee384f91b1 100644 --- a/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml +++ b/x-pack/metricbeat/module/istio/istiod/_meta/fields.yml @@ -1 +1,4 @@ -- release: beta +- name: istiod + type: group + release: beta + fields: diff --git a/x-pack/metricbeat/module/istio/module.yml b/x-pack/metricbeat/module/istio/module.yml index de29503fca5..027290884dd 100644 --- a/x-pack/metricbeat/module/istio/module.yml +++ b/x-pack/metricbeat/module/istio/module.yml @@ -1,3 +1,4 @@ name: istio metricsets: - istiod +- proxy diff --git a/x-pack/metricbeat/module/istio/proxy/_meta/docs.asciidoc b/x-pack/metricbeat/module/istio/proxy/_meta/docs.asciidoc new file mode 100644 index 00000000000..4f7aa03a9ef --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/_meta/docs.asciidoc @@ -0,0 +1,33 @@ +This is the proxy metricset of the module istio. +This metricset collects metrics from the Envoy proxy's Prometheus exporter for Istio versions higher than 1.5 + +Tested with Istio 1.7 + +[float] +=== Deployment + +Istio-proxy is a sidecar container that is being injected into every Pod that is +being deployed on a Kubernetes cluster which's traffic is managed by Istio. +Because of this reason, in oder to collect metrics from this sidecars we need +to automatically identify these sidecar containers and start monitoring them +using their IP and the predifined port (15090). This can be achieved easily by +defining the proper autodiscover provider that will automatically identifies +all these sidecar containers and will start `proxy` metricset for each one of +them. Here is an example configuration that can be used for that purpose: + + +["source", "yaml"] +-------------------------------------------- +metricbeat.autodiscover: + providers: + - type: kubernetes + include_annotations: ["prometheus.io.scrape"] + templates: + - condition: + contains: + kubernetes.annotations.prometheus.io/path: "/stats/prometheus" + config: + - module: istio + metricsets: ["proxy"] + hosts: "${data.host}:15090" +-------------------------------------------- diff --git a/x-pack/metricbeat/module/istio/proxy/_meta/fields.yml b/x-pack/metricbeat/module/istio/proxy/_meta/fields.yml new file mode 100644 index 00000000000..1c1fa1b036d --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/_meta/fields.yml @@ -0,0 +1,4 @@ +- name: proxy + type: group + release: beta + fields: diff --git a/x-pack/metricbeat/module/istio/proxy/_meta/testdata/config.yml b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/config.yml new file mode 100644 index 00000000000..a22f2cf7133 --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/config.yml @@ -0,0 +1,5 @@ +type: http +url: "/stats/prometheus" +suffix: plain +remove_fields_from_comparison: ["prometheus.labels.instance"] +omit_documented_fields_check: ["prometheus.labels.*"] diff --git a/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain new file mode 100644 index 00000000000..c5a3fb5335d --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain @@ -0,0 +1,1146 @@ +# TYPE istio_requests_total counter +istio_requests_total{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 6 +istio_requests_total{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 5 +istio_requests_total{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 2 +istio_requests_total{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 6 +istio_requests_total{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 3 +istio_requests_total{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 2 +istio_requests_total{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 1 + +# TYPE envoy_cluster_assignment_stale counter +envoy_cluster_assignment_stale{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_assignment_timeout_received counter +envoy_cluster_assignment_timeout_received{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_bind_errors counter +envoy_cluster_bind_errors{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_client_ssl_socket_factory_downstream_context_secrets_not_ready counter +envoy_cluster_client_ssl_socket_factory_downstream_context_secrets_not_ready{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_client_ssl_socket_factory_ssl_context_update_by_sds counter +envoy_cluster_client_ssl_socket_factory_ssl_context_update_by_sds{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_client_ssl_socket_factory_upstream_context_secrets_not_ready counter +envoy_cluster_client_ssl_socket_factory_upstream_context_secrets_not_ready{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_default_total_match_count counter +envoy_cluster_default_total_match_count{cluster_name="xds-grpc"} 473 + +# TYPE envoy_cluster_http2_dropped_headers_with_underscores counter +envoy_cluster_http2_dropped_headers_with_underscores{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_header_overflow counter +envoy_cluster_http2_header_overflow{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_headers_cb_no_stream counter +envoy_cluster_http2_headers_cb_no_stream{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_inbound_empty_frames_flood counter +envoy_cluster_http2_inbound_empty_frames_flood{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_inbound_priority_frames_flood counter +envoy_cluster_http2_inbound_priority_frames_flood{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_inbound_window_update_frames_flood counter +envoy_cluster_http2_inbound_window_update_frames_flood{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_outbound_control_flood counter +envoy_cluster_http2_outbound_control_flood{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_outbound_flood counter +envoy_cluster_http2_outbound_flood{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_requests_rejected_with_underscores_in_headers counter +envoy_cluster_http2_requests_rejected_with_underscores_in_headers{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_rx_messaging_error counter +envoy_cluster_http2_rx_messaging_error{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_rx_reset counter +envoy_cluster_http2_rx_reset{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_too_many_header_frames counter +envoy_cluster_http2_too_many_header_frames{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_trailers counter +envoy_cluster_http2_trailers{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_tx_flush_timeout counter +envoy_cluster_http2_tx_flush_timeout{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_tx_reset counter +envoy_cluster_http2_tx_reset{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_internal_upstream_rq counter +envoy_cluster_internal_upstream_rq{response_code_class="2xx",cluster_name="xds-grpc"} 8 +envoy_cluster_internal_upstream_rq{response_code_class="5xx",cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_internal_upstream_rq_200 counter +envoy_cluster_internal_upstream_rq_200{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_internal_upstream_rq_503 counter +envoy_cluster_internal_upstream_rq_503{cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_internal_upstream_rq_completed counter +envoy_cluster_internal_upstream_rq_completed{cluster_name="xds-grpc"} 12 + +# TYPE envoy_cluster_lb_healthy_panic counter +envoy_cluster_lb_healthy_panic{cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_lb_local_cluster_not_ok counter +envoy_cluster_lb_local_cluster_not_ok{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_recalculate_zone_structures counter +envoy_cluster_lb_recalculate_zone_structures{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_subsets_created counter +envoy_cluster_lb_subsets_created{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_subsets_fallback counter +envoy_cluster_lb_subsets_fallback{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_subsets_fallback_panic counter +envoy_cluster_lb_subsets_fallback_panic{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_subsets_removed counter +envoy_cluster_lb_subsets_removed{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_subsets_selected counter +envoy_cluster_lb_subsets_selected{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_cluster_too_small counter +envoy_cluster_lb_zone_cluster_too_small{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_no_capacity_left counter +envoy_cluster_lb_zone_no_capacity_left{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_number_differs counter +envoy_cluster_lb_zone_number_differs{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_routing_all_directly counter +envoy_cluster_lb_zone_routing_all_directly{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_routing_cross_zone counter +envoy_cluster_lb_zone_routing_cross_zone{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_lb_zone_routing_sampled counter +envoy_cluster_lb_zone_routing_sampled{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_membership_change counter +envoy_cluster_membership_change{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_original_dst_host_invalid counter +envoy_cluster_original_dst_host_invalid{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_retry_or_shadow_abandoned counter +envoy_cluster_retry_or_shadow_abandoned{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_ciphers_ECDHE_RSA_AES128_GCM_SHA256 counter +envoy_cluster_ssl_ciphers_ECDHE_RSA_AES128_GCM_SHA256{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_ssl_connection_error counter +envoy_cluster_ssl_connection_error{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_curves_X25519 counter +envoy_cluster_ssl_curves_X25519{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_ssl_fail_verify_cert_hash counter +envoy_cluster_ssl_fail_verify_cert_hash{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_fail_verify_error counter +envoy_cluster_ssl_fail_verify_error{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_fail_verify_no_cert counter +envoy_cluster_ssl_fail_verify_no_cert{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_fail_verify_san counter +envoy_cluster_ssl_fail_verify_san{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_handshake counter +envoy_cluster_ssl_handshake{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_ssl_no_certificate counter +envoy_cluster_ssl_no_certificate{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_ssl_session_reused counter +envoy_cluster_ssl_session_reused{cluster_name="xds-grpc"} 5 + +# TYPE envoy_cluster_ssl_sigalgs_rsa_pss_rsae_sha256 counter +envoy_cluster_ssl_sigalgs_rsa_pss_rsae_sha256{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_ssl_versions_TLSv1_2 counter +envoy_cluster_ssl_versions_TLSv1_2{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_update_attempt counter +envoy_cluster_update_attempt{cluster_name="xds-grpc"} 473 + +# TYPE envoy_cluster_update_empty counter +envoy_cluster_update_empty{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_update_failure counter +envoy_cluster_update_failure{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_update_no_rebuild counter +envoy_cluster_update_no_rebuild{cluster_name="xds-grpc"} 472 + +# TYPE envoy_cluster_update_success counter +envoy_cluster_update_success{cluster_name="xds-grpc"} 473 + +# TYPE envoy_cluster_upstream_cx_close_notify counter +envoy_cluster_upstream_cx_close_notify{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_cx_connect_attempts_exceeded counter +envoy_cluster_upstream_cx_connect_attempts_exceeded{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_connect_fail counter +envoy_cluster_upstream_cx_connect_fail{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_connect_timeout counter +envoy_cluster_upstream_cx_connect_timeout{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_destroy counter +envoy_cluster_upstream_cx_destroy{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_cx_destroy_local counter +envoy_cluster_upstream_cx_destroy_local{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_destroy_local_with_active_rq counter +envoy_cluster_upstream_cx_destroy_local_with_active_rq{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_destroy_remote counter +envoy_cluster_upstream_cx_destroy_remote{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_cx_destroy_remote_with_active_rq counter +envoy_cluster_upstream_cx_destroy_remote_with_active_rq{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_cx_destroy_with_active_rq counter +envoy_cluster_upstream_cx_destroy_with_active_rq{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_cx_http1_total counter +envoy_cluster_upstream_cx_http1_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_http2_total counter +envoy_cluster_upstream_cx_http2_total{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_cx_idle_timeout counter +envoy_cluster_upstream_cx_idle_timeout{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_max_requests counter +envoy_cluster_upstream_cx_max_requests{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_cx_none_healthy counter +envoy_cluster_upstream_cx_none_healthy{cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_upstream_cx_overflow counter +envoy_cluster_upstream_cx_overflow{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_pool_overflow counter +envoy_cluster_upstream_cx_pool_overflow{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_protocol_error counter +envoy_cluster_upstream_cx_protocol_error{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_cx_rx_bytes_total counter +envoy_cluster_upstream_cx_rx_bytes_total{cluster_name="xds-grpc"} 1435518 + +# TYPE envoy_cluster_upstream_cx_total counter +envoy_cluster_upstream_cx_total{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_cx_tx_bytes_total counter +envoy_cluster_upstream_cx_tx_bytes_total{cluster_name="xds-grpc"} 1272824 + +# TYPE envoy_cluster_upstream_flow_control_backed_up_total counter +envoy_cluster_upstream_flow_control_backed_up_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_flow_control_drained_total counter +envoy_cluster_upstream_flow_control_drained_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_flow_control_paused_reading_total counter +envoy_cluster_upstream_flow_control_paused_reading_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_flow_control_resumed_reading_total counter +envoy_cluster_upstream_flow_control_resumed_reading_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_internal_redirect_failed_total counter +envoy_cluster_upstream_internal_redirect_failed_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_internal_redirect_succeeded_total counter +envoy_cluster_upstream_internal_redirect_succeeded_total{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq counter +envoy_cluster_upstream_rq{response_code_class="2xx",cluster_name="xds-grpc"} 8 +envoy_cluster_upstream_rq{response_code_class="5xx",cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_upstream_rq_200 counter +envoy_cluster_upstream_rq_200{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_rq_503 counter +envoy_cluster_upstream_rq_503{cluster_name="xds-grpc"} 4 + +# TYPE envoy_cluster_upstream_rq_cancelled counter +envoy_cluster_upstream_rq_cancelled{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_completed counter +envoy_cluster_upstream_rq_completed{cluster_name="xds-grpc"} 12 + +# TYPE envoy_cluster_upstream_rq_maintenance_mode counter +envoy_cluster_upstream_rq_maintenance_mode{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_max_duration_reached counter +envoy_cluster_upstream_rq_max_duration_reached{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_pending_failure_eject counter +envoy_cluster_upstream_rq_pending_failure_eject{cluster_name="xds-grpc"} 7 + +# TYPE envoy_cluster_upstream_rq_pending_overflow counter +envoy_cluster_upstream_rq_pending_overflow{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_pending_total counter +envoy_cluster_upstream_rq_pending_total{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_rq_per_try_timeout counter +envoy_cluster_upstream_rq_per_try_timeout{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_retry counter +envoy_cluster_upstream_rq_retry{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_retry_limit_exceeded counter +envoy_cluster_upstream_rq_retry_limit_exceeded{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_retry_overflow counter +envoy_cluster_upstream_rq_retry_overflow{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_retry_success counter +envoy_cluster_upstream_rq_retry_success{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_rx_reset counter +envoy_cluster_upstream_rq_rx_reset{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_timeout counter +envoy_cluster_upstream_rq_timeout{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_total counter +envoy_cluster_upstream_rq_total{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_rq_tx_reset counter +envoy_cluster_upstream_rq_tx_reset{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_manager_cds_init_fetch_timeout counter +envoy_cluster_manager_cds_init_fetch_timeout{} 0 + +# TYPE envoy_cluster_manager_cds_update_attempt counter +envoy_cluster_manager_cds_update_attempt{} 23 + +# TYPE envoy_cluster_manager_cds_update_failure counter +envoy_cluster_manager_cds_update_failure{} 7 + +# TYPE envoy_cluster_manager_cds_update_rejected counter +envoy_cluster_manager_cds_update_rejected{} 0 + +# TYPE envoy_cluster_manager_cds_update_success counter +envoy_cluster_manager_cds_update_success{} 15 + +# TYPE envoy_cluster_manager_cluster_added counter +envoy_cluster_manager_cluster_added{} 38 + +# TYPE envoy_cluster_manager_cluster_modified counter +envoy_cluster_manager_cluster_modified{} 3 + +# TYPE envoy_cluster_manager_cluster_removed counter +envoy_cluster_manager_cluster_removed{} 0 + +# TYPE envoy_cluster_manager_cluster_updated counter +envoy_cluster_manager_cluster_updated{} 29 + +# TYPE envoy_cluster_manager_cluster_updated_via_merge counter +envoy_cluster_manager_cluster_updated_via_merge{} 0 + +# TYPE envoy_cluster_manager_update_merge_cancelled counter +envoy_cluster_manager_update_merge_cancelled{} 0 + +# TYPE envoy_cluster_manager_update_out_of_merge_window counter +envoy_cluster_manager_update_out_of_merge_window{} 0 + +# TYPE envoy_listener_manager_lds_init_fetch_timeout counter +envoy_listener_manager_lds_init_fetch_timeout{} 0 + +# TYPE envoy_listener_manager_lds_update_attempt counter +envoy_listener_manager_lds_update_attempt{} 23 + +# TYPE envoy_listener_manager_lds_update_failure counter +envoy_listener_manager_lds_update_failure{} 7 + +# TYPE envoy_listener_manager_lds_update_rejected counter +envoy_listener_manager_lds_update_rejected{} 0 + +# TYPE envoy_listener_manager_lds_update_success counter +envoy_listener_manager_lds_update_success{} 15 + +# TYPE envoy_listener_manager_listener_added counter +envoy_listener_manager_listener_added{} 20 + +# TYPE envoy_listener_manager_listener_create_failure counter +envoy_listener_manager_listener_create_failure{} 0 + +# TYPE envoy_listener_manager_listener_create_success counter +envoy_listener_manager_listener_create_success{} 150 + +# TYPE envoy_listener_manager_listener_in_place_updated counter +envoy_listener_manager_listener_in_place_updated{} 55 + +# TYPE envoy_listener_manager_listener_modified counter +envoy_listener_manager_listener_modified{} 55 + +# TYPE envoy_listener_manager_listener_removed counter +envoy_listener_manager_listener_removed{} 0 + +# TYPE envoy_listener_manager_listener_stopped counter +envoy_listener_manager_listener_stopped{} 0 + +# TYPE envoy_metric_cache_count counter +envoy_metric_cache_count{cache="hit",wasm_filter="stats_filter"} 0 +envoy_metric_cache_count{cache="miss",wasm_filter="stats_filter"} 16 + +# TYPE envoy_server_debug_assertion_failures counter +envoy_server_debug_assertion_failures{} 0 + +# TYPE envoy_server_dynamic_unknown_fields counter +envoy_server_dynamic_unknown_fields{} 0 + +# TYPE envoy_server_envoy_bug_failures counter +envoy_server_envoy_bug_failures{} 0 + +# TYPE envoy_server_main_thread_watchdog_mega_miss counter +envoy_server_main_thread_watchdog_mega_miss{} 5 + +# TYPE envoy_server_main_thread_watchdog_miss counter +envoy_server_main_thread_watchdog_miss{} 14 + +# TYPE envoy_server_static_unknown_fields counter +envoy_server_static_unknown_fields{} 0 + +# TYPE envoy_server_watchdog_mega_miss counter +envoy_server_watchdog_mega_miss{} 8 + +# TYPE envoy_server_watchdog_miss counter +envoy_server_watchdog_miss{} 45 + +# TYPE envoy_server_worker_0_watchdog_mega_miss counter +envoy_server_worker_0_watchdog_mega_miss{} 2 + +# TYPE envoy_server_worker_0_watchdog_miss counter +envoy_server_worker_0_watchdog_miss{} 21 + +# TYPE envoy_server_worker_1_watchdog_mega_miss counter +envoy_server_worker_1_watchdog_mega_miss{} 1 + +# TYPE envoy_server_worker_1_watchdog_miss counter +envoy_server_worker_1_watchdog_miss{} 10 + +# TYPE envoy_wasm_envoy_wasm_runtime_v8_created counter +envoy_wasm_envoy_wasm_runtime_v8_created{} 25 + +# TYPE envoy_wasm_vm_null_cloned counter +envoy_wasm_vm_null_cloned{} 0 + +# TYPE envoy_wasm_vm_null_created counter +envoy_wasm_vm_null_created{} 50 + +# TYPE istio_build gauge +istio_build{component="proxy",tag="1.7.1"} 1 + +# TYPE envoy_cluster_circuit_breakers_default_cx_open gauge +envoy_cluster_circuit_breakers_default_cx_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_default_cx_pool_open gauge +envoy_cluster_circuit_breakers_default_cx_pool_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_default_rq_open gauge +envoy_cluster_circuit_breakers_default_rq_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_default_rq_pending_open gauge +envoy_cluster_circuit_breakers_default_rq_pending_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_default_rq_retry_open gauge +envoy_cluster_circuit_breakers_default_rq_retry_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_high_cx_open gauge +envoy_cluster_circuit_breakers_high_cx_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_high_cx_pool_open gauge +envoy_cluster_circuit_breakers_high_cx_pool_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_high_rq_open gauge +envoy_cluster_circuit_breakers_high_rq_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_high_rq_pending_open gauge +envoy_cluster_circuit_breakers_high_rq_pending_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_circuit_breakers_high_rq_retry_open gauge +envoy_cluster_circuit_breakers_high_rq_retry_open{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_pending_send_bytes gauge +envoy_cluster_http2_pending_send_bytes{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_http2_streams_active gauge +envoy_cluster_http2_streams_active{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_lb_subsets_active gauge +envoy_cluster_lb_subsets_active{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_max_host_weight gauge +envoy_cluster_max_host_weight{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_membership_degraded gauge +envoy_cluster_membership_degraded{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_membership_excluded gauge +envoy_cluster_membership_excluded{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_membership_healthy gauge +envoy_cluster_membership_healthy{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_membership_total gauge +envoy_cluster_membership_total{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_upstream_cx_active gauge +envoy_cluster_upstream_cx_active{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_upstream_cx_rx_bytes_buffered gauge +envoy_cluster_upstream_cx_rx_bytes_buffered{cluster_name="xds-grpc"} 17 + +# TYPE envoy_cluster_upstream_cx_tx_bytes_buffered gauge +envoy_cluster_upstream_cx_tx_bytes_buffered{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_upstream_rq_active gauge +envoy_cluster_upstream_rq_active{cluster_name="xds-grpc"} 1 + +# TYPE envoy_cluster_upstream_rq_pending_active gauge +envoy_cluster_upstream_rq_pending_active{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_version gauge +envoy_cluster_version{cluster_name="xds-grpc"} 0 + +# TYPE envoy_cluster_manager_active_clusters gauge +envoy_cluster_manager_active_clusters{} 38 + +# TYPE envoy_cluster_manager_cds_update_time gauge +envoy_cluster_manager_cds_update_time{} 1602160603301 + +# TYPE envoy_cluster_manager_cds_version gauge +envoy_cluster_manager_cds_version{} 14451656482200925263 + +# TYPE envoy_cluster_manager_warming_clusters gauge +envoy_cluster_manager_warming_clusters{} 0 + +# TYPE envoy_listener_manager_lds_update_time gauge +envoy_listener_manager_lds_update_time{} 1602160603305 + +# TYPE envoy_listener_manager_lds_version gauge +envoy_listener_manager_lds_version{} 14451656482200925263 + +# TYPE envoy_listener_manager_total_filter_chains_draining gauge +envoy_listener_manager_total_filter_chains_draining{} 0 + +# TYPE envoy_listener_manager_total_listeners_active gauge +envoy_listener_manager_total_listeners_active{} 20 + +# TYPE envoy_listener_manager_total_listeners_draining gauge +envoy_listener_manager_total_listeners_draining{} 0 + +# TYPE envoy_listener_manager_total_listeners_warming gauge +envoy_listener_manager_total_listeners_warming{} 0 + +# TYPE envoy_listener_manager_workers_started gauge +envoy_listener_manager_workers_started{} 1 + +# TYPE envoy_server_concurrency gauge +envoy_server_concurrency{} 2 + +# TYPE envoy_server_days_until_first_cert_expiring gauge +envoy_server_days_until_first_cert_expiring{} 0 + +# TYPE envoy_server_hot_restart_epoch gauge +envoy_server_hot_restart_epoch{} 0 + +# TYPE envoy_server_hot_restart_generation gauge +envoy_server_hot_restart_generation{} 1 + +# TYPE envoy_server_live gauge +envoy_server_live{} 1 + +# TYPE envoy_server_memory_allocated gauge +envoy_server_memory_allocated{} 56508688 + +# TYPE envoy_server_memory_heap_size gauge +envoy_server_memory_heap_size{} 97271808 + +# TYPE envoy_server_memory_physical_size gauge +envoy_server_memory_physical_size{} 100016128 + +# TYPE envoy_server_parent_connections gauge +envoy_server_parent_connections{} 0 + +# TYPE envoy_server_state gauge +envoy_server_state{} 0 + +# TYPE envoy_server_stats_recent_lookups gauge +envoy_server_stats_recent_lookups{} 25928 + +# TYPE envoy_server_total_connections gauge +envoy_server_total_connections{} 0 + +# TYPE envoy_server_uptime gauge +envoy_server_uptime{} 19413 + +# TYPE envoy_server_version gauge +envoy_server_version{} 2499155 + +# TYPE envoy_wasm_envoy_wasm_runtime_v8_active gauge +envoy_wasm_envoy_wasm_runtime_v8_active{} 40 + +# TYPE envoy_wasm_vm_null_active gauge +envoy_wasm_vm_null_active{} 20 + +# TYPE istio_request_bytes histogram +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 6 +istio_request_bytes_sum{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 3690 +istio_request_bytes_count{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 6 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 4 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 5 +istio_request_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 5 +istio_request_bytes_sum{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 1235 +istio_request_bytes_count{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 5 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 2 +istio_request_bytes_sum{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 510 +istio_request_bytes_count{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 6 +istio_request_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 7500 +istio_request_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 6 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 3 +istio_request_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 3750 +istio_request_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 3 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="500"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1000"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="2500"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="30000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="60000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="300000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="600000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1800000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="3600000"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="+Inf"} 2 +istio_request_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 2500 +istio_request_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 2 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="0.5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="25"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="50"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="100"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="250"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="500"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1000"} 0 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="2500"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="30000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="60000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="300000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="600000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1800000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="3600000"} 1 +istio_request_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="+Inf"} 1 +istio_request_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 1250 +istio_request_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 1 + +# TYPE istio_request_duration_milliseconds histogram +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 5 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 5 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 6 +istio_request_duration_milliseconds_sum{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 712.5 +istio_request_duration_milliseconds_count{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 6 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 5 +istio_request_duration_milliseconds_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 5 +istio_request_duration_milliseconds_sum{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 0 +istio_request_duration_milliseconds_count{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 5 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 2 +istio_request_duration_milliseconds_sum{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 17.5500000000000007105427357601 +istio_request_duration_milliseconds_count{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 5 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 5 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 6 +istio_request_duration_milliseconds_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 31.75 +istio_request_duration_milliseconds_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 6 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 3 +istio_request_duration_milliseconds_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 429.54999999999995452526491135359 +istio_request_duration_milliseconds_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 3 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="25"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="50"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="100"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="250"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="500"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="2500"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="30000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="60000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="300000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="600000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1800000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="3600000"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="+Inf"} 2 +istio_request_duration_milliseconds_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 76 +istio_request_duration_milliseconds_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 2 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="0.5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="25"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="50"} 0 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="100"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="250"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="500"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="2500"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="30000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="60000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="300000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="600000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1800000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="3600000"} 1 +istio_request_duration_milliseconds_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="+Inf"} 1 +istio_request_duration_milliseconds_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 63.5 +istio_request_duration_milliseconds_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 1 + +# TYPE istio_response_bytes histogram +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 6 +istio_response_bytes_sum{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 34500 +istio_response_bytes_count{response_code="200",reporter="destination",source_workload="istio-ingressgateway",source_workload_namespace="istio-system",source_principal="spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",source_app="istio-ingressgateway",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",destination_app="productpage",destination_version="v1",destination_service="productpage.default.svc.cluster.local",destination_service_name="productpage",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="mutual_tls",source_canonical_service="istio-ingressgateway",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 6 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 5 +istio_response_bytes_bucket{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 5 +istio_response_bytes_sum{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 1125.0000000000002273736754432321 +istio_response_bytes_count{response_code="503",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15000",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="UF",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 5 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="2500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="5000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="10000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="30000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="60000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="300000"} 0 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="600000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="1800000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="3600000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1",le="+Inf"} 2 +istio_response_bytes_sum{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 800000 +istio_response_bytes_count{response_code="200",reporter="destination",source_workload="unknown",source_workload_namespace="unknown",source_principal="unknown",source_app="unknown",source_version="unknown",destination_workload="productpage-v1",destination_workload_namespace="default",destination_principal="unknown",destination_app="productpage",destination_version="v1",destination_service="172.17.0.12:15090",destination_service_name="InboundPassthroughClusterIpv4",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="none",source_canonical_service="unknown",destination_canonical_service="productpage",source_canonical_revision="latest",destination_canonical_revision="v1"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 6 +istio_response_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 1830 +istio_response_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="details-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-details",destination_app="details",destination_version="v1",destination_service="details.default.svc.cluster.local",destination_service_name="details",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="details",source_canonical_revision="v1",destination_canonical_revision="v1"} 6 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="500"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="2500"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="5000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="10000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="30000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="60000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="300000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="600000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="1800000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="3600000"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1",le="+Inf"} 3 +istio_response_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 1405 +istio_response_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v1",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v1",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v1"} 3 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="2500"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="5000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="10000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="30000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="60000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="300000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="600000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="1800000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="3600000"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2",le="+Inf"} 2 +istio_response_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 1110 +istio_response_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v2",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v2",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v2"} 2 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="0.5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="25"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="50"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="100"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="250"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="500"} 0 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="2500"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="5000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="10000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="30000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="60000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="300000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="600000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="1800000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="3600000"} 1 +istio_response_bytes_bucket{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3",le="+Inf"} 1 +istio_response_bytes_sum{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 545 +istio_response_bytes_count{response_code="200",reporter="source",source_workload="productpage-v1",source_workload_namespace="default",source_principal="spiffe://cluster.local/ns/default/sa/bookinfo-productpage",source_app="productpage",source_version="v1",destination_workload="reviews-v3",destination_workload_namespace="default",destination_principal="spiffe://cluster.local/ns/default/sa/bookinfo-reviews",destination_app="reviews",destination_version="v3",destination_service="reviews.default.svc.cluster.local",destination_service_name="reviews",destination_service_namespace="default",request_protocol="http",response_flags="-",grpc_response_status="",connection_security_policy="unknown",source_canonical_service="productpage",destination_canonical_service="reviews",source_canonical_revision="v1",destination_canonical_revision="v3"} 1 + +# TYPE envoy_cluster_upstream_cx_connect_ms histogram +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="0.5"} 0 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="1"} 0 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="5"} 6 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="10"} 7 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="25"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="50"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="100"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="250"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="500"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="1000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="2500"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="5000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="10000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="30000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="60000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="300000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="600000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="1800000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="3600000"} 8 +envoy_cluster_upstream_cx_connect_ms_bucket{cluster_name="xds-grpc",le="+Inf"} 8 +envoy_cluster_upstream_cx_connect_ms_sum{cluster_name="xds-grpc"} 30.8500000000000014210854715202 +envoy_cluster_upstream_cx_connect_ms_count{cluster_name="xds-grpc"} 8 + +# TYPE envoy_cluster_upstream_cx_length_ms histogram +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="0.5"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="1"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="5"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="10"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="25"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="50"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="100"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="250"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="500"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="1000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="2500"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="5000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="10000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="30000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="60000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="300000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="600000"} 0 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="1800000"} 4 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="3600000"} 7 +envoy_cluster_upstream_cx_length_ms_bucket{cluster_name="xds-grpc",le="+Inf"} 7 +envoy_cluster_upstream_cx_length_ms_sum{cluster_name="xds-grpc"} 12450000 +envoy_cluster_upstream_cx_length_ms_count{cluster_name="xds-grpc"} 7 + +# TYPE envoy_server_initialization_time_ms histogram +envoy_server_initialization_time_ms_bucket{le="0.5"} 0 +envoy_server_initialization_time_ms_bucket{le="1"} 0 +envoy_server_initialization_time_ms_bucket{le="5"} 0 +envoy_server_initialization_time_ms_bucket{le="10"} 0 +envoy_server_initialization_time_ms_bucket{le="25"} 0 +envoy_server_initialization_time_ms_bucket{le="50"} 0 +envoy_server_initialization_time_ms_bucket{le="100"} 0 +envoy_server_initialization_time_ms_bucket{le="250"} 0 +envoy_server_initialization_time_ms_bucket{le="500"} 0 +envoy_server_initialization_time_ms_bucket{le="1000"} 0 +envoy_server_initialization_time_ms_bucket{le="2500"} 0 +envoy_server_initialization_time_ms_bucket{le="5000"} 0 +envoy_server_initialization_time_ms_bucket{le="10000"} 1 +envoy_server_initialization_time_ms_bucket{le="30000"} 1 +envoy_server_initialization_time_ms_bucket{le="60000"} 1 +envoy_server_initialization_time_ms_bucket{le="300000"} 1 +envoy_server_initialization_time_ms_bucket{le="600000"} 1 +envoy_server_initialization_time_ms_bucket{le="1800000"} 1 +envoy_server_initialization_time_ms_bucket{le="3600000"} 1 +envoy_server_initialization_time_ms_bucket{le="+Inf"} 1 +envoy_server_initialization_time_ms_sum{} 6650 +envoy_server_initialization_time_ms_count{} 1 + diff --git a/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain-expected.json b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain-expected.json new file mode 100644 index 00000000000..742e696fe76 --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/_meta/testdata/proxy.v1.7.1.plain-expected.json @@ -0,0 +1,1365 @@ +[ + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 5, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "none", + "destination_app": "productpage", + "destination_canonical_revision": "v1", + "destination_canonical_service": "productpage", + "destination_principal": "unknown", + "destination_service": "172.17.0.12:15000", + "destination_service_name": "InboundPassthroughClusterIpv4", + "destination_service_namespace": "default", + "destination_version": "v1", + "destination_workload": "productpage-v1", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "destination", + "request_protocol": "http", + "response_code": "503", + "response_flags": "UF", + "source_app": "unknown", + "source_canonical_revision": "latest", + "source_canonical_service": "unknown", + "source_principal": "unknown", + "source_version": "unknown", + "source_workload": "unknown", + "source_workload_namespace": "unknown" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 2, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "unknown", + "destination_app": "reviews", + "destination_canonical_revision": "v2", + "destination_canonical_service": "reviews", + "destination_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-reviews", + "destination_service": "reviews.default.svc.cluster.local", + "destination_service_name": "reviews", + "destination_service_namespace": "default", + "destination_version": "v2", + "destination_workload": "reviews-v2", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "source", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "productpage", + "source_canonical_revision": "v1", + "source_canonical_service": "productpage", + "source_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage", + "source_version": "v1", + "source_workload": "productpage-v1", + "source_workload_namespace": "default" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 6, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "unknown", + "destination_app": "details", + "destination_canonical_revision": "v1", + "destination_canonical_service": "details", + "destination_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-details", + "destination_service": "details.default.svc.cluster.local", + "destination_service_name": "details", + "destination_service_namespace": "default", + "destination_version": "v1", + "destination_workload": "details-v1", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "source", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "productpage", + "source_canonical_revision": "v1", + "source_canonical_service": "productpage", + "source_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage", + "source_version": "v1", + "source_workload": "productpage-v1", + "source_workload_namespace": "default" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 2, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "none", + "destination_app": "productpage", + "destination_canonical_revision": "v1", + "destination_canonical_service": "productpage", + "destination_principal": "unknown", + "destination_service": "172.17.0.12:15090", + "destination_service_name": "InboundPassthroughClusterIpv4", + "destination_service_namespace": "default", + "destination_version": "v1", + "destination_workload": "productpage-v1", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "destination", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "unknown", + "source_canonical_revision": "latest", + "source_canonical_service": "unknown", + "source_principal": "unknown", + "source_version": "unknown", + "source_workload": "unknown", + "source_workload_namespace": "unknown" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 6, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "mutual_tls", + "destination_app": "productpage", + "destination_canonical_revision": "v1", + "destination_canonical_service": "productpage", + "destination_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage", + "destination_service": "productpage.default.svc.cluster.local", + "destination_service_name": "productpage", + "destination_service_namespace": "default", + "destination_version": "v1", + "destination_workload": "productpage-v1", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "destination", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "istio-ingressgateway", + "source_canonical_revision": "latest", + "source_canonical_service": "istio-ingressgateway", + "source_principal": "spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account", + "source_version": "unknown", + "source_workload": "istio-ingressgateway", + "source_workload_namespace": "istio-system" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_build": { + "value": 1 + }, + "labels": { + "component": "proxy", + "instance": "127.0.0.1:49701", + "job": "istio", + "tag": "1.7.1" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 1, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "unknown", + "destination_app": "reviews", + "destination_canonical_revision": "v3", + "destination_canonical_service": "reviews", + "destination_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-reviews", + "destination_service": "reviews.default.svc.cluster.local", + "destination_service_name": "reviews", + "destination_service_namespace": "default", + "destination_version": "v3", + "destination_workload": "reviews-v3", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "source", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "productpage", + "source_canonical_revision": "v1", + "source_canonical_service": "productpage", + "source_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage", + "source_version": "v1", + "source_workload": "productpage-v1", + "source_workload_namespace": "default" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + }, + { + "event": { + "dataset": "istio.proxy", + "duration": 115000, + "module": "istio" + }, + "metricset": { + "name": "proxy", + "period": 10000 + }, + "prometheus": { + "istio_request_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_request_duration_milliseconds": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "istio_requests_total": { + "counter": 3, + "rate": 0 + }, + "istio_response_bytes": { + "histogram": { + "counts": [ + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0, + 0 + ], + "values": [ + 0.25, + 0.75, + 3, + 7.5, + 17.5, + 37.5, + 75, + 175, + 375, + 750, + 1750, + 3750, + 7500, + 20000, + 45000, + 180000, + 450000, + 1200000, + 2700000, + 5400000 + ] + } + }, + "labels": { + "connection_security_policy": "unknown", + "destination_app": "reviews", + "destination_canonical_revision": "v1", + "destination_canonical_service": "reviews", + "destination_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-reviews", + "destination_service": "reviews.default.svc.cluster.local", + "destination_service_name": "reviews", + "destination_service_namespace": "default", + "destination_version": "v1", + "destination_workload": "reviews-v1", + "destination_workload_namespace": "default", + "instance": "127.0.0.1:49701", + "job": "istio", + "reporter": "source", + "request_protocol": "http", + "response_code": "200", + "response_flags": "-", + "source_app": "productpage", + "source_canonical_revision": "v1", + "source_canonical_service": "productpage", + "source_principal": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage", + "source_version": "v1", + "source_workload": "productpage-v1", + "source_workload_namespace": "default" + } + }, + "service": { + "address": "127.0.0.1:55555", + "type": "istio" + } + } +] \ No newline at end of file diff --git a/x-pack/metricbeat/module/istio/proxy/manifest.yml b/x-pack/metricbeat/module/istio/proxy/manifest.yml new file mode 100644 index 00000000000..856d6d5f38e --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/manifest.yml @@ -0,0 +1,11 @@ +default: false +input: + module: prometheus + metricset: collector + defaults: + metrics_path: /stats/prometheus + metrics_filters: + include: ["istio_*"] + exclude: ["^up$"] + use_types: true + rate_counters: true diff --git a/x-pack/metricbeat/module/istio/proxy/proxy_test.go b/x-pack/metricbeat/module/istio/proxy/proxy_test.go new file mode 100644 index 00000000000..eec0bfec301 --- /dev/null +++ b/x-pack/metricbeat/module/istio/proxy/proxy_test.go @@ -0,0 +1,32 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !integration + +package proxy + +import ( + "os" + "testing" + + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/metricbeat/mb" + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + + // Register input module and metricset + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/prometheus" + _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/prometheus/collector" +) + +func init() { + // To be moved to some kind of helper + os.Setenv("BEAT_STRICT_PERMS", "false") + mb.Registry.SetSecondarySource(mb.NewLightModulesSource("../../../module")) +} + +func TestEventMapping(t *testing.T) { + logp.TestingSetup() + + mbtest.TestDataFiles(t, "istio", "proxy") +} diff --git a/x-pack/metricbeat/modules.d/istio.yml.disabled b/x-pack/metricbeat/modules.d/istio.yml.disabled index b65bcdef949..119bc603d80 100644 --- a/x-pack/metricbeat/modules.d/istio.yml.disabled +++ b/x-pack/metricbeat/modules.d/istio.yml.disabled @@ -42,3 +42,10 @@ period: 10s # use istiod.istio-system:15014, when deploying Metricbeat in a kubernetes cluster as Pod or Daemonset hosts: ['localhost:15014'] + +# Istio proxy to monitor Envoy sidecars for versions after 1.5 of Istio. +- module: istio + metricsets: ['proxy'] + period: 10s + # it's recommended to deploy this metricset with autodiscovery, see metricset's docs for more info + hosts: ['localhost:15090'] From be5c2902cd5c492f98d299740de03cf9d19626b4 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 15 Oct 2020 09:06:27 +0100 Subject: [PATCH 215/216] [BUILD][CI] fetch dependencies with retry (#21614) --- Jenkinsfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Jenkinsfile b/Jenkinsfile index 8f05b4522cd..31d62c416ce 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -275,6 +275,13 @@ def withBeatsEnv(Map args = [:], Closure body) { fi''') } try { + // Add more stability when dependencies are not accessible temporarily + // See https://github.com/elastic/beats/issues/21609 + // retry/try/catch approach reports errors, let's avoid it to keep the + // notifications cleaner. + if (cmd(label: 'Download modules to local cache', script: 'go mod download', returnStatus: true) > 0) { + cmd(label: 'Download modules to local cache - retry', script: 'go mod download', returnStatus: true) + } body() } finally { if (archive) { From f8ff7cec3c28efb747738442fec0a47b2a968841 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 15 Oct 2020 10:28:43 +0100 Subject: [PATCH 216/216] [CI] Enable build stage for arm architecture (#21284) --- .ci/scripts/install-go.sh | 15 +++++++++++++-- Jenkinsfile | 23 +++++++++++++++++------ auditbeat/Jenkinsfile.yml | 15 ++++++++++++++- filebeat/Jenkinsfile.yml | 13 +++++++++++++ heartbeat/Jenkinsfile.yml | 13 +++++++++++++ journalbeat/Jenkinsfile.yml | 13 +++++++++++++ libbeat/Jenkinsfile.yml | 11 +++++++++++ packetbeat/Jenkinsfile.yml | 13 +++++++++++++ x-pack/auditbeat/Jenkinsfile.yml | 13 +++++++++++++ x-pack/elastic-agent/Jenkinsfile.yml | 13 +++++++++++++ x-pack/filebeat/Jenkinsfile.yml | 13 +++++++++++++ x-pack/functionbeat/Jenkinsfile.yml | 11 +++++++++++ x-pack/libbeat/Jenkinsfile.yml | 13 +++++++++++++ 13 files changed, 170 insertions(+), 9 deletions(-) diff --git a/.ci/scripts/install-go.sh b/.ci/scripts/install-go.sh index 49e12c7a18d..59f56445a80 100755 --- a/.ci/scripts/install-go.sh +++ b/.ci/scripts/install-go.sh @@ -5,7 +5,8 @@ MSG="environment variable missing" GO_VERSION=${GO_VERSION:?$MSG} PROPERTIES_FILE=${PROPERTIES_FILE:-"go_env.properties"} HOME=${HOME:?$MSG} -ARCH=$(uname -s| tr '[:upper:]' '[:lower:]') +OS=$(uname -s| tr '[:upper:]' '[:lower:]') +ARCH=$(uname -m| tr '[:upper:]' '[:lower:]') GVM_CMD="${HOME}/bin/gvm" if command -v go @@ -19,10 +20,20 @@ then fi fi +if [ "${ARCH}" == "aarch64" ] ; then + GVM_ARCH_SUFFIX=arm64 +elif [ "${ARCH}" == "x86_64" ] ; then + GVM_ARCH_SUFFIX=amd64 +elif [ "${ARCH}" == "i686" ] ; then + GVM_ARCH_SUFFIX=386 +else + GVM_ARCH_SUFFIX=arm +fi + echo "UNMET DEP: Installing Go" mkdir -p "${HOME}/bin" -curl -sSLo "${GVM_CMD}" "https://github.com/andrewkroh/gvm/releases/download/v0.2.2/gvm-${ARCH}-amd64" +curl -sSLo "${GVM_CMD}" "https://github.com/andrewkroh/gvm/releases/download/v0.2.2/gvm-${OS}-${GVM_ARCH_SUFFIX}" chmod +x "${GVM_CMD}" gvm ${GO_VERSION}|cut -d ' ' -f 2|tr -d '\"' > ${PROPERTIES_FILE} diff --git a/Jenkinsfile b/Jenkinsfile index 31d62c416ce..f3618d6615f 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -17,7 +17,6 @@ pipeline { DOCKERELASTIC_SECRET = 'secret/observability-team/ci/docker-registry/prod' DOCKER_COMPOSE_VERSION = "1.21.0" DOCKER_REGISTRY = 'docker.elastic.co' - GOX_FLAGS = "-arch amd64" JOB_GCS_BUCKET = 'beats-ci-temp' JOB_GCS_CREDENTIALS = 'beats-ci-gcs-plugin' OSS_MODULE_PATTERN = '^[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' @@ -29,7 +28,7 @@ pipeline { XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' } options { - timeout(time: 2, unit: 'HOURS') + timeout(time: 3, unit: 'HOURS') buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20', daysToKeepStr: '30')) timestamps() ansiColor('xterm') @@ -46,6 +45,7 @@ pipeline { booleanParam(name: 'awsCloudTests', defaultValue: true, description: 'Run AWS cloud integration tests.') string(name: 'awsRegion', defaultValue: 'eu-central-1', description: 'Default AWS region to use for testing.') booleanParam(name: 'runAllStages', defaultValue: false, description: 'Allow to run all stages.') + booleanParam(name: 'armTest', defaultValue: false, description: 'Allow ARM stages.') booleanParam(name: 'macosTest', defaultValue: false, description: 'Allow macOS stages.') string(name: 'PYTEST_ADDOPTS', defaultValue: '', description: 'Additional options to pass to pytest. Use PYTEST_ADDOPTS="-k pattern" to only run tests matching the specified pattern. For retries you can use `--reruns 3 --reruns-delay 15`') } @@ -223,10 +223,17 @@ def withBeatsEnv(Map args = [:], Closure body) { def withModule = args.get('withModule', false) def directory = args.get('directory', '') - def goRoot, path, magefile, pythonEnv, testResults, artifacts + def goRoot, path, magefile, pythonEnv, testResults, artifacts, gox_flags if(isUnix()) { - goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${nodeOS()}.amd64" + if (isArm() && is64arm()) { + // TODO: nodeOS() should support ARM + goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.linux.arm64" + gox_flags = '-arch arm' + } else { + goRoot = "${env.WORKSPACE}/.gvm/versions/go${GO_VERSION}.${nodeOS()}.amd64" + gox_flags = '-arch amd64' + } path = "${env.WORKSPACE}/bin:${goRoot}/bin:${env.PATH}" magefile = "${WORKSPACE}/.magefile" pythonEnv = "${WORKSPACE}/python-env" @@ -241,6 +248,7 @@ def withBeatsEnv(Map args = [:], Closure body) { magefile = "${env.WORKSPACE}\\.magefile" testResults = "**\\build\\TEST*.xml" artifacts = "**\\build\\TEST*.out" + gox_flags = '-arch amd64' } deleteDir() @@ -258,7 +266,8 @@ def withBeatsEnv(Map args = [:], Closure body) { "PYTHON_ENV=${pythonEnv}", "RACE_DETECTOR=true", "TEST_COVERAGE=true", - "TEST_TAGS=${env.TEST_TAGS},oracle" + "TEST_TAGS=${env.TEST_TAGS},oracle", + "GOX_FLAGS=${gox_flags}" ]) { if(isDockerInstalled()) { dockerLogin(secret: "${DOCKERELASTIC_SECRET}", registry: "${DOCKER_REGISTRY}") @@ -369,7 +378,9 @@ def archiveTestOutput(Map args = [:]) { def folder = cmd(label: 'Find system-tests', returnStdout: true, script: 'python .ci/scripts/search_system_tests.py').trim() log(level: 'INFO', text: "system-tests='${folder}'. If no empty then let's create a tarball") if (folder.trim()) { - def name = folder.replaceAll('/', '-').replaceAll('\\\\', '-').replaceAll('build', '').replaceAll('^-', '') + '-' + nodeOS() + // TODO: nodeOS() should support ARM + def os_suffix = isArm() ? 'linux' : nodeOS() + def name = folder.replaceAll('/', '-').replaceAll('\\\\', '-').replaceAll('build', '').replaceAll('^-', '') + '-' + os_suffix tar(file: "${name}.tgz", archive: true, dir: folder) } } diff --git a/auditbeat/Jenkinsfile.yml b/auditbeat/Jenkinsfile.yml index 33d708e2635..b3f20af2d37 100644 --- a/auditbeat/Jenkinsfile.yml +++ b/auditbeat/Jenkinsfile.yml @@ -13,9 +13,22 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test auditbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" - crosscompile: + crosscompile: make: "make -C auditbeat crosscompile" macos: mage: "mage build unitTest" diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml index ffe2cec98b4..09dbe948c72 100644 --- a/filebeat/Jenkinsfile.yml +++ b/filebeat/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test filebeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" withModule: true ## run the ITs only if the changeset affects a specific module. diff --git a/heartbeat/Jenkinsfile.yml b/heartbeat/Jenkinsfile.yml index 8d8b00a865d..1d41dbe581e 100644 --- a/heartbeat/Jenkinsfile.yml +++ b/heartbeat/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test heartbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" macos: diff --git a/journalbeat/Jenkinsfile.yml b/journalbeat/Jenkinsfile.yml index 12bb63f4cc6..5715712dd4a 100644 --- a/journalbeat/Jenkinsfile.yml +++ b/journalbeat/Jenkinsfile.yml @@ -13,5 +13,18 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test journalbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags unitTest: mage: "mage build unitTest" diff --git a/libbeat/Jenkinsfile.yml b/libbeat/Jenkinsfile.yml index 64a43269b13..692400e7253 100644 --- a/libbeat/Jenkinsfile.yml +++ b/libbeat/Jenkinsfile.yml @@ -12,6 +12,17 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test libbeat for arm" + labels: + - "arm" + parameters: + - "armTest" build: mage: "mage build test" crosscompile: diff --git a/packetbeat/Jenkinsfile.yml b/packetbeat/Jenkinsfile.yml index 9fbe272b382..adf6471b82a 100644 --- a/packetbeat/Jenkinsfile.yml +++ b/packetbeat/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test packetbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" macos: diff --git a/x-pack/auditbeat/Jenkinsfile.yml b/x-pack/auditbeat/Jenkinsfile.yml index 5e0e2223dfa..1294c4681b4 100644 --- a/x-pack/auditbeat/Jenkinsfile.yml +++ b/x-pack/auditbeat/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test x-pack/auditbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage update build test" withModule: true ## run the ITs only if the changeset affects a specific module. diff --git a/x-pack/elastic-agent/Jenkinsfile.yml b/x-pack/elastic-agent/Jenkinsfile.yml index a36472d123b..bf1bfed3ddd 100644 --- a/x-pack/elastic-agent/Jenkinsfile.yml +++ b/x-pack/elastic-agent/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test x-pack/elastic-agent for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" macos: diff --git a/x-pack/filebeat/Jenkinsfile.yml b/x-pack/filebeat/Jenkinsfile.yml index 4b17c13b6ac..5bd2bcd40cf 100644 --- a/x-pack/filebeat/Jenkinsfile.yml +++ b/x-pack/filebeat/Jenkinsfile.yml @@ -13,6 +13,19 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test x-pack/filebeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test" withModule: true ## run the ITs only if the changeset affects a specific module. diff --git a/x-pack/functionbeat/Jenkinsfile.yml b/x-pack/functionbeat/Jenkinsfile.yml index 29f2ecf8b5a..ecb2bd14e0e 100644 --- a/x-pack/functionbeat/Jenkinsfile.yml +++ b/x-pack/functionbeat/Jenkinsfile.yml @@ -13,6 +13,17 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test x-pack/functionbeat for arm" + labels: + - "arm" + parameters: + - "armTest" build: mage: "mage build test && GO_VERSION=1.13.1 mage testGCPFunctions" macos: diff --git a/x-pack/libbeat/Jenkinsfile.yml b/x-pack/libbeat/Jenkinsfile.yml index 87019f071a0..ed22a8dfe70 100644 --- a/x-pack/libbeat/Jenkinsfile.yml +++ b/x-pack/libbeat/Jenkinsfile.yml @@ -13,5 +13,18 @@ when: tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: + arm: + mage: "mage build unitTest" + platforms: ## override default label in this specific stage. + - "arm" + when: ## Override the top-level when. + comments: + - "/test x-pack/libbeat for arm" + labels: + - "arm" + parameters: + - "armTest" + branches: true ## for all the branches + tags: true ## for all the tags build: mage: "mage build test"

z;o+xVr}K0ZdZjO$dHYmEpeE(Yc-Qd1BTWnK>R3CmjR^E|CxVxpd7YE_=!770QVgtI zY-;Wcp}5t%UMWOHAjxxxdt6Gb?Wgp&8zC(tezLf)1OeAn z?2T%5P3qkXDFO44pGO2Cz-YnC?Bid!DYv&Q((dfq3{vDl%*_G?Z$!}urq1E1>g5V< zf0}K;g+2c@=>v4rlSO*`p&<8>8BR(e=M+Y$ zi(ySuXQ|r`)c34f%zJ?!Jx-)VepJrNSsL8bJf6SWc!yFfwP4Kuq}?*_t5BSX{_YwX zE6h$^7^YW*5DsG%HUl4IC+=?4dE6sgonZp?(cwPZ?>hA8*hJw|UjmHOMcl0M{l!i3 z{vTeR-6z#$Cd!_npd%c@)Fv>S#=V;tu{4NnSYjq5h;z}j{hn%QWt$n?VVv|nVLWTo z&12;=N-*&kib-McoL8s=Xf{d%Tisc@h4;5d6#^F(&-$@!|H`xwm0Z?P(HfZj-_ zGzC(JFL1G`(68jA+#nHuaOxQ00_OhFJZ8oCTBYtsIeRYA83j~Vb4 z66yUe63wsMJHe{_1@?l@tMVn2=w5`H9n!wmq{j|A%cECiVD?);)p!dBv(#{}@n`aqOd{HimaP8ek#QMUK^1GyZ|TA%&sWbN!Km_S;` zYR?cE)0H8Y8PVE?_YgLGqmYE_^VS2pwm#_&>wdYx6fXm%DL(1u8%x>&*MF7lcpW~Ln#gOgSL=rE%-wqG@)E0z{ zp(f6n6jGVIHkBP1K^vr`brA};?eef5hh9hftN#WVzQBdT??LA8JF>HO1gRSRe2^2XO-3&QB%4k^Gjp*9_v7H{l_pX4%Q+j zF8hLp&{c6=rPHHnUZ$F?E|xlq)E*ML0kz&U<;c4VXd^p+&w~R1+HUliEo|$OqGUg+ zn@MMD;U1v6VDT$3`;ktLrgRz9RNgu#eDT8db*$F#zQrE80M=Gz4lZ4=FOc9Wl z4YR~>QelZ`(*gCLrG5H!Q!j3LpTN~MCb41hVd_3S5})w(gg39TH;8)@5n;CHhLHj9 zFD{SwIS$6mN3z~>{?A?9etxT4oiBrGGTP~Lca(^u^K1oMXJPyo-lr4HudMGurb-zn z@7k|?P>iiJe?k$vnvAG(9?+Q6NQ{wMXX-+5G|)c}gj+`Fc|Fukq~IJH_M#y6oc!TM z#&fE2)^^s6XkDr$ob-H>nP@7u>)5?aJ3A#XeXqf3QkDc<4Hi^3RBiyC^U%@em>a4!>GOYTfd_1O%=3kY@b7A7 zd99z$&|7yGRomDkT`>B;uKTt*3fDzn=bWP3&`X(tHto9d+s(Avxr3CQ!xvufeyjQQ zt-IP)?>MaQ`0BShg@2(o2uVq<_PDuJ+!tV_qDgGx-N5^V&l?BytTVcqxmUKn3+2gi z=01oi$LMp6e@;_%CDEPbwHzQNv{>1Y2s!8S6Ui!4Lc(~W&xPhU%wVM``%ZdF6X~K( z%AS@1pKQ}mS=ASW<8_(Z+vFU29`cMGb&ss^|7`jntEBR3>`qT-iI7P82&>1{cDpGz zc)`4*fdAad|Lk7h*3UL&TaX7l7bNyCkM(Me;?KYG@u(K43z8*u`PxWuvlCpu5yQeS zrLLLVWT2E#580c_>8vPEO_`f0snfW@ACBy@x9%>ju@Q?|O>rK5NgwhuEx)^F?=v6g zc-j|Bs%p%0iQbi3SBa96_cEO6j`kMDK%b~RZ#Cps1nh+)(_4-z8sG;m&XM7i6+IZ0y?9QqXdW$5T-x3C+6 z#&rFDA@B1G*^8TF9SV2CQJEh!_fMWF498dt=`TO5PPjEUsOu^!AfJ}PY2#L;$3X)y zQ)RMN6wRE=LR!wCjTSsLQM=8N&W8Lpkq!-<^uOWspRNp{?tR92Xd{O>8G|JZqT`o_ruM5Eosi>MbJLac;RQ*eisq1RnPRP=i7m%}7zt`>&9 zad{f%V;a>{An9?AQuWc(g^ySajA!ZziyzUoVIW(f80~(>hV8vefuhUH|Qs z|HncUlv8(3`HH4gOvk!7>?NZ~=WKQAYw;~pL{!_qIX4XokM*M7)A5!9>)gQ6Xo}^DJXMk_ zcM1OZa~rMjI*6_MWei#O<^9c6E52DCMUC?^wzlzX2mYRL&c-&Q@8z|`y+{zh3spfr z^`Y+4ZsJH%d@=HRlvy%KXRj5f42eRfx;Dj44V&4uGsy(DZ{OUUiA(~O$IW@*73$fA zMob!-OCMJLoEgD7BCJlP-7;vWGy73d-ZbBDUu)MZId}Gzy?$#psC$3Gq4zZfe*!YjT?3o@dT)-EqV*rl)R7$qJd%W(C+= zKIpz;!p&_kDLFb+uc16yhpfyw`^-mOZ;pcIS_f79`5@)-)0tV>222h@$f%>?7O=Ms zB9+c4E&#k?ilH4wSlC@`GlFwf{%-1b@XNjre>P)3O;AFTgni16LS7kp`l26UMxjQe z?iJd^68)B%<9uFvA9EhOlGCowHg4Rk4$cna4@MO_C-S$hpW~~}_liWbVg~A;IbsxY z3BJ?+mc05Wjrhjim|reO#;!W0jo7IZaq|x>yqvky29HpLL)_I~&j5n8XYD@a0Ia=Jyx;XR5=D2ORF<6G#$mrzp;ax_N_BExE0RkHlNX)&Js2pOpzzE z6vgZ6>-sZw4GhBLGQRoNhP`?QKXtO6d@UUzUf?zE1QbrZ;rQ?>F5vFg1ci-d)YO7> zG%E*Z-D%Ke^FyoE8dIR!bUyW}ZK7NB`Wm|gZ|`JOX5q1Raj2AD+s*A*N(dLjlqJ<= zrdy>roqyd4&T$f|()vo~pO4H5Bv15`Y$8R;wMZNq0v`SoNLY)kr<9rp>iprsmvk9I zaIRW1%#7DIGzITyXhMWTt!@vf2yz{|WwT;!pOsbcC>N`@k|`mh+BsvT?_+;Yj^}4f z!16n%LwtOC{&*()b^Q(aU&{(>gj~{81J?@y=Iil{2VGaj9Q#8?`0zdibb2y$J-+|( z@VYuHTe-5!=F4TFc&!$sMR9X8%OA}XPAq}mNc9V=F!zJVigGrCp+lff!})G~5P?Ru zI-LA{vYXPm`{A?W+%g|Uu?UoqY3&9alsT?9>n5B~&SY5=^TX2!foh!NRB}C*c|!W2w!f zhcDLa_Z5$D*GFCS7TMvi0JeA5e4HNMSC;fkum6Jf9?kk_kD4x2Us75^g8r8NcWwPY zrX>|0H;ci&qu{CVAzx|1go;G?IzBF$2`l_*BvneWK+a^IjPnYSjGS!)^vB1@RGeRV zMZ)OzOxrwFvxYIzpS2I$q>KjF=jl#qT%_#Ac18y~fJt*bgOt@9ao3uo(7RXXu;g0- zsEs_Ew5q__hS7D4cqc-zlS`&8+%&&y{usfV)L;kKkqmVNIh)%^TeNsQ zdWmFYP6(( z@*0mmt8iew3{@4aMmx0EW6M0H(x+6Tu1rDpL5csERJ^gxKop9a@$s|QjFWiE)t(uu z;nBl_8dc6+lZ9NWt}JcVI51H=Wn*FJllIf`2zLawsU=QO5O3a&71;~T`~e~g&4!(^ zwk`#>ik5la^#wA6)u(U%=L-u}^40C8ng*CiU-sDurMSn=@zMi=hNrCA307wDEF z^-Tb84SP*t4S-@$q1US5tx2je@jo~2elaID4bq!+WzRaV3L z3AWyltNt05|E99$dbo_|dT!lYs)LnQ?OzsT#ob=4tOO(_-@Q8<-6v=e$r!3OJue2J z`lNZ;@_l{taB(cB^RjRig0#Ji!J6=Loii9H@}Yc?`{d&T>_aRuG-t22NYCww1P3)< zg*>a(Qd9jTue!uF=Mdh44;m3fn}&I=!v}~t`lboqv@t?mcaP{PgK8zl=%Ywn-F#go zh}#l^C}?=`hE@U#H|IC)`Q8fWl{o$3MT8F2EOTS+j^&h|)g2bA!E0!zL<b-oeeuV%%4W#GHm`|xBb8V!ltSbiK+ksv?zKcvd6oBwwIIQh{u7q=U!WW50LD9 zH~X~x@{#0Q)?`I5#LKBU&D%b@s< z$0jCu5+Ld6^vQTF6FeAKX;HX76?sDjgaGb1LBbUrhMEJ$u4sj6fAvNfb^YbcTacZu zJ@_!J6AxEcIxoIcrs1n^^tC z{dqFN&m3Qlg!#LVL{=6CHvT93h;-y$d!X#@8w0XD)g`!2Dw6!|;E%2X#oBcVtR|(veZe|hW{N*Z9Qsfyb(nfT4np?3*a)R>R z*Z(<0ZXdHNm z=kQ%MeFGm*J!6IwHIO2^-n_{l9fMlL`6W5-kaa zR@*wassDfQ%R^jKA4sOo00rn|X8{+~E4CZ;OtRp74c*~;WBZ8gw8u1&BXX&7Oul%|SpfLpv;M1pYFQZTwFpnebi(#E2WgMxg zO&|Up4q5NEQ02_{8glA>Kd9|;i?~mA2yUHwgrkeq54m&fZSD<~YGg6z^6JtXpM{ra_cZfRSJ^ z>=ncvg_L|;gy)2o^B%XbjpV1LjOwqVWF`lbf0-;*cyD)lECL~x+jkBrNZCZo)Xxt) z`S<$sZ;{1$Yrl)+wUPIXKO^GzO!(%QED`+R$`Id(^Blr7^Hfr9e^?GaFzzXT9)M2d zWsBZNP@%gaOIEvhuII07D?^HQ%@sCgUDqS2FWznYFZf^F`+rETQ303syrVe*N|mIR zDC$}JOcIXiew$%Ft(4+(psU6gbbRlGjq6<6JMu(eoYLFpqz-5t!tF3$VhdfmtUn3X zn-uhWyr0M|RVqw@svdnwx;A8Hd#=hvlw*FdPJ$>m`K*WjY9|%Zv!<1Oh}ni|uJv+z zy7ajDP0E<}H6ElJs{u}boB?+ zCJ$HkP7R7ro$IaCY$VF;(_brS+j>fQd#(v#c0(hPg?Ra?xZM70s`2=aCkshhki!@n z^{l$3#c??j(*rg6PvMpvZ@E-nzNmPJ(&ZiGe`=I-fE=r;%>6#O+t7NXeNt)JF2|MY zH0)h#q@MH+B@DLuR=t>3c2idOC}s-dmQ1wdmfZ+045VCe>utr?l%vJa%y5VR%Ho4_=u@|K4ZFpR3tpR=? z@Fc%>=g$e9pWdaLpRd#%QGBaco6$nB<}1ByWmJ?H9DI_9z197Nbd(9(ox|My}_9_#$tqdMWf{Z?Z2*_kO>jEDx6Vs%5|4*&^^ zNP`0S^g!JC$vUG#{SqyqrS|HV03>x)?R)=#n3c^h2~Wz(W7b}1_yyc$?H$SMzK89`vMxhlK4{3ICe6%J zn*31mJ=x!+%;Hx2fzh$#1=YFA{uD~)o0VL9f!L`@qZ8B%?v_ucGc5yAS>xHR!_KM@ zA613r5Zgl*$~$mu#VDDF`LKylwPPd^?MMcI4nKdgkyL>;CG&#|2PrvqZsT9@RlR11 zXmYZG+*}EY@J)>|3b6TTrDI2D`|gP6iq-RibhP~7km3eM*kamEQ;!jcIz(oZ75S*B z8gO$wyQt0TO?V4>=i5DE@&@cB-Lc*%m?NZ89$YludZ3#4N_-TSY%ys#+NtjJqlAyc z6A03;2gV=c(Iype6B_QP05lp_wT&w_?*C(S=syVQkDO)RflJG^LvirZeJceRa7_t(R*|H+^rm8e=lP7k(wB@UaH!NPf692hulwzBEE( z0zDPJg(xZJ7-DBv_wy0k+24&0N2pX6mdP_@nXt04s2d#Iu-1WUEOlb`?-eb1(*qWZ zM^RLZ$MW@JSL7TC<3**w>u$gRk(yK4o#@SxL#~r@$5;jlngBwz*u^^pH=Rin_O_$J zkZ_oR4+AR;o0`Sz;<7O70aS&&J7UKQpn2G}mZ1!RA3a)5#>GLotjZJW9e#nK(JmCk zS=za$awpK!(DQ+h-S2rH7r(#jxu*g#&>!N=v{_J-qwzmGSewezuOnXGirJU#-su~H zQB^M74yEmXi8C$QV|7`=<6pKy{`OB*_|UU0J6L+ zt4nG*UxXi1ED2_KBTVAC_uuko@#9TYE z1V_!)-xuzYDL)W*c5Sb>C{~X<)vEP-?@*1GQ7(y)*Q>f=t{8UmxoPp>x&9-Fu`8x+ z+q{YjLLDAnf2t{{#?XPC#T+}fWk z*@*BH9E4H}%5$B<&xhZ+iYuePN_O;eDLbgz-owM784vBloEE#Z&FJR*`@{cStp1Z^ zwq$Xvgca(Ig2KRF+QA3W9wtEs;Ha#kR&U#48%wKJnF%tX@_mIfo3AXf-#^(wzg(zE*5XftS@ysYgC0>-7VmlXS z$V?*^Z%zppd{ph))Oq(c@O{)y-z_LV0m*;E_54jPGY@dW&%f8J3~`wZxGn90Ju&{B zx1`hHKtp#G!@?u=M80AtF$n9H883QUt@o$L7RvqK81exjGw0SRH=9aN;pk#kU4jxg z%XQt&|1eHFa47w}eU8o!X^lU5a$nIxqpVMMF6p zWceD}njs0r#Wa|%Zj86(8`(h>1XO^2eFl_(g$I+ggC*y0hMduRms9jb&~MS=K&mtL zvF?2K=g+TxM$FOvn0zDj=8{j*`)fQyLPE0AhQD=Hz4%`w8prV-qI(BKBkwM3t_ON( z_*j!pI|tFmM`nJ)H#8~=t$ifj-b)Yb=CwNzO^BO`U#5*OyZKJ%%`9SlSO!o4tfoBO zarC<;S*_X#EH&EfZ=jzYfELq>WyLRf+5Qr0sDj#>j@)UuS|Q zc>908y|;7YecOUg@3kDKoNwtXoWKoNO8E^O$z&qoQ9pPS2v6({7-X=F2 zY979yxeaEbqoL{PVXPg<#w-F!PwEO=NG>zqTRJ$px(a8Qvjji|ROG;~2s!H&skQss zV=Ir&TqlGnA5g=R-NIMT;GV3n4i4d*`v><_`G(<=eyawJz# z9Iq@2UMii&($e*-*0Zgq-^)!Y2j$XDPlK@?M}A}w|9Z;sTYl?zc=(QAl|S$Kp5R@# zzf1)Y3f|!ut3+t$ay_~)VOCb29O?CHO7v&42kY5+>}@k8`(r|IL9LE+arQmtMsL$_ z{1O0eaq094f@m|9wcfm@OQ+E^uHrrW!h5n!x8iwatm7sM=1vxyg?KD_P(WuT`|NYT zPJYxRO+=B8gBR}xnXdV?Ai9cfD$mE-tNtO~=F6t^@w z3X8yu)aiGjtH~`#w-ho;roVGe0&MpLpf~I1li7uR6SovA7{Pa6Kjd!G;MZ4rcF}^?BguhrH^wxTLhQXQZ?|^Yzx! zaZj>vyMRkkH}gZc1Jz1`pkOXA-y8jVn>#mB{v|rRAjGMMGlMED;bJ*)nh1B9;klG9Pq2onLMNl=i2b>W z*3u1+8NYbSes1~Vb7XCM$CKY?Zu}FBsVX-sXq>BjhI^F^4oVwh}J|fdd~6>8EIy*5moqA?4AGpP-Ph#+*~ky!v)U6QiE)SIDKb(`&sf&(CL&}7Yu~a z4xehU?QOK~%f3VvjJ^*L4#sG7GxPF3hrmwLY3)hTJbc)c_FBifyh}{Rxe&)x3~NRo zxRjyIc_=f}r$-A|xghwb?f;K?nTf`&RNhZGqZb{wfh~e+pHUs~mVQyJ)S7f!qW5r; zCe}Y;n(b<^JZQqkxUqEtxl$@LV+H=;-~i{Zc9kV!3A-6)LoOI9or+nxbq?pRsf6a& z!PP40sf=(-9i%UQ6d;e!28Yg{L9u@jzFA0YV3@j4pyoU_Rc)p>HwswI^OIy;#$1!m z1x&;8xv2;*Naml?#_IJWFrO%b@DtU|sB4xWwqCO1awsYn_EMizzn2okpTf*>;r+KC z%QRLz1ZfQBVP_kb2H0S+8W;rY)%($j1=u@>cQ%8vB9 z-aIq878Lui7)qNnPn4Wbw0(I>i1#*5;==&3Ogd+}{9=${suFx8%`p@d2dC#uJbE;S6AFPI1*+xz~b7Dq4LVeEKZ0pr&f-!^WU&GaaVXu3;hj%J$aX z!Vw%Jfb+(!Nm9BE0EnwzB`E2lOfJMcxv>&bS?nqGRbTJa4IJI!Ra#W$k`TJsT4~D~ zCwwx`hIGzz0V88fy2cZ9#xa$GVjnXj-KZ;jH67h@R?L1&3lJJ5=AGPfro(S#;QZPi9i0dpl*oE@&`!1!OQ+bScy*eAxW^hHi?DVb5ne%S9k#pxa zOc0^%-^h$9iYOe)0AGNt!Dh(iz;yxWZ~(Hp{?4 z|GH}!X`Fyw#>pYFBtjBFU;BVe+bM^@h~En*`1Ijjz=q%XaCLo#?3rb7<@#9qLczhx zD!ApXFVCJe3BwTWyy!e8C%)Zu)_RMW*BnDn3gc@-Qt~V^z6_;F zrM@M%mEA(u%rB7_oT3#hy@&ZlWK{@jTa&;#htx$YqSBT-h1#-8`Vasckac}t(8ORb zACdEkoP%tjFwq8^aOP)d$#eHrAT&Qlcv$zR1>XG7nzuP3z!090u3bepT6Xw zQd32_*?Kr)6D9yFTITcb&k67G=+L8G)!qibI@U=%+BZgD@caH7kD;=Sdsut!A@xie@ z-MMAUsZT1B=Ell76oe1y`r91?peC!>9wx>EVwS>AnP0|QS<__1_t!}ZO7OL{yRoAT zRW)jd`qGE(i{>{6xJ7y6S{To_Dp7(Sl}6xfxwZq#@k$yYyZNXdlefdeM#Y@rTFvh0 z%E7*fmzETR+LI@TYT!6!f)m8&p2+UEnsj(*K};Gmw2qrF*z29QvGsh*9J?3}LGVU) z1W#y#`Vz4XGHm_CdA>_~T^nu?5IkX_x7%qJOj&rRodZ$tY{tNFr~x^s2U-=&TvjIZ zI~DkSWSl9*3RhX$9%h!^Yfp~S-C7WmDTNow3VUdU!;TZmM+{{hK%?s}9QLH=JYiJ2 zFC=_b(R+hQ51OUy;jAxdFVpzcycUg8!7#O0bsdA^ zog}@5ntYg=a$M8d+cItIotvTRdeaeBX zK!fr3Lt<<*bdz8~=F_?vA^Hrg-(i_I&6Jk=Hn^Y;XNt)^oEq*@H4YBDdW-j{$vF)Z z6*Lp!O%H{0H@`nX-J#1FS$^T~f0d;%=c#7QTPL=RY!U+5Y6bYw*$Xmcg=F%Ww($+i z>|ALTlk)7pd@K>}zO6zo8Uj;^uG2Y5g}Xw|ypjP2wuspAFgAEsF+tmOKu{31;8Z&2 zBreUS8feZNm0P$>akt3k3YJ)y<~E;KJWTXw;}uYbh1M^p%RRk!$zYLxv687@39zU0 zhS5nXg`0sFo9z4GbXht8>Q~G#v!mCmXA>34q7LLg!N0`$&r3x5MMAyHK@MWk$3!og^@G; zHHCP6S^)fAqLkp_f&Pg_m%L0s&@+7jXL*??M5`k!yR}hklZ-u%sFGB9KYd~=gvPqnC$HJ zmfu^~yVrK=w;*$#&#G2~OIg}ORBeJVX*Dx!gprH#q6?cAy``~Z;)MXm;@geERnfK; zkfS?y3%)OiM>p%**6>F+Z_h+&E%wr8pO-BF44;nT9TN@zDkCm=EVv5e`rj z&6Wu7SYyT-+F7yda&xv6>i4Vx2>hVxdc(3qD8L!hO-5jp$6I@OE!m$=!ntF6Pt!4H zCKu!A$4oCEo^l!yT?2)$AAr(?u)weq%^5Z^@jd~^r#LF(?}^(qP2=fg3c8vTo{STD zd)Lr5_xsmh?bzBmvH0RqH#N4b{UgVW;$0}Wyz9;qE|#rizc$*We^JGR;cfc$8q>^} zP)(+d-_imB;7iDQY?n1p{EG)UILrI;+@zA{M;PccpWBg9s@D}6F7G`1^Ibjl^}m_y zMioOhns=UtIefPD4(UzRIQ6(&{y4Jt^7@KCLe#R8+dt3#(|qIK{X!MulSDZuesu0X zx)3#==J+~wi=R-p0iUziT^% ze4;fBoL6&4J!vjZuZ@p)51z@;mT@s{DBeZ3_w!3enuu#JPo~NJ>qJCCeC$SW#w-tV zAHLejU(Q1B?{zkWI4*pUpvKJdj0 zFYoA*yp^{E9GiP@p{W(|@p5u8Cs|nXU{~@N6*@HutUcl9S!DhZcdN8 z`s0N=eo|?C>cmn}q)J2CsjU|K*F9v>B>XHvk7Yp8hRyGnbkg_(ms_lw-bY>9afu%} zs5GV`F508gxUtisg(UoeHBc`^Z=+?LQ!|*O5NK@#Y>_F5Th6 z7de#_&)}^TXF5GQQ?-l6%3W;~CPG=aP{ejOqltg?0$Ss8e<<=t34HU(B`R03Al$fG z0D?`9R!?tI9`_mRIQ*waM8(y2B{Q0<^i1rq4f^cO!G5#Ukx{@E~ z)t>`yJ3bHdsPAV5`>%|Y3-6$qd#sDgbQ`EP9`e}tC=<7|kU!4?m|2UJDZV`P;y1F03w=k_w^tD{=x{`m z(2-(7pm1nPg=1f#wJYu`$7sOrX#8;H4tx;J!}}q{VJtTWI}`K`xPQEp%7w)=Lcn7g z=~Mjib6C$>pv#r=&9OX0UX}h&T-{C!CnS6NV0uQyE_5!t z-rxalY~(Bntu_ih+kxI6IXHZRql{?Vx$)WfpMCik(=)p7&DK&&NwAt!TxOULXc%(4 z!V^7wF7L>eu6;{>yBwa>E*A`mtyI+dW5vdIW ztX7LH>lpL><(l2DujWql*hwXW+^VCc?TF8UGR?I)RS~taU_)B8eKn?avR&sDlyQpZExW}l|w2|tNz5~ zs>%++r9Qnjai*O8^yMoi9qWgdyn)vl9&G3Xuc^B(~uQ4^um_pX!f zr&Rq{0F4|En)TqRE=_CIXLq>tr!He8pDaqH?Dt=AoV(&gmh0?z3#IojD0>$&yZ77K zaelVzzY_9yA*x3&WT3ma>{nQO@sbGSfU{vchw1++`ls6axel)4aR-0thyOv}R)5GU z5QF8V-|syA6|Q%-zQfpMhF$3We-Oog7&&v~Ft*{a`kB1}IuYb{Ki9>72>8`M{sH;V z1^W-ke?-*(he6(Ykrmuuh!)WICNG$1WVs`h4GES?ztbjgk@x^Gums%BJB-#$ly{?tvyAag;xnW?Zg8$bD_P$C=PKos}8h&TrFM^jQ zzEhIUfW2z%l^SIHCJD}x)ho}*E7#3K<;g*>iFks5vsA8#v~y?KSX7+Xd;8G-1$;HY^13Ab;D~jx^4Ul*sJh`VE8Pm z5_H)x(VfBynnG_;O*={Z?S1PFks%p^X~a5msYJb-lLymA2)Jx9d~ zN;6sR&w5@Mp5%b;by)B#MpDK5N#LjTEb4%#PW2G#hE_BvaM5|skNjQg|Mos-O}wkF z;$NMG<{*NSuXx^|EHHuwO3})@C?d-HZ&vLqvMm?hJQ~dG_Yo8fIk%Wq2rH-1+Z$Yx zs@zV-<&s~()0EhaqAIZSSo|YytIpb#KQKtX^84%Z#B<+D z^>4zpnx%L0xw5j=Qe{*G(hW!iaN=Fh4g99j{eJd>SC62H&bf-Y5j*v}e-X{6Ia~F| z?|(MzUeP~2$Yl3iN>%0zD6LD$8fvor>jfqxV`_O>$}Glu$D>1}^1n?x=E*)vNfZF(Qn zRO^fEiCSb6%)OJ}io{qz@!o^ei-Rs8G3SM~tL`${vqKgdvwItHi8+OnW4>y>yERVR zeRv4sX`Jq?fh_Oy1n-d#e@W6LZ|j^}vF_dttE>CCHgb$5D)QC;EwyBSF19wm`{PHu zWUz>B`6Ww}kdu}s4o%VJwNkr?KEIHDaNJB_C3?gAA^V`Z&xfs>x+Uxi>EnK-zr8c? zyd_DamN-%`>BAW4Y z#I8E6mi(RwCc%%`Ku&d?alh~_OFP41H@tf56NfY=s!}<2bMgOt&7Iq_bwFxWgOa#LFlzEdThf$tlG>AI zjVvD#kPq)_hVF@AQaR3!XZfXMn(axjuahSNk}utFhfUaD<4l&CxUZ~<`m(CDCqAs? zFmXS|NAvcc2<9K>zLn1Yaqe4K!#~b_tGM%zbKk<4{&DVGWd{E^_brU+pUi!W_T)dA z`&NSaCv)GTKle}OzLj98$)Xrarco#pfy*lo=G>-6>6n=OM@J7#&pNxr(=sv5x4B@~ zr{)bjn3CKghQ7NLlaMApS*SS{^CVR7a70J`8Mr_bl4tr#7$o>W{E7hv* z(z8|hw0Qyg;9)!|{(L;f&fRXVH&3L{X87e({CO*6|EA^@u*OHvJ=wV<4l6{F_a+4? zzcPYGORuARA3^ySdW20Xhrg(UKoK>AU=I&^a?z67FK&=MslfMnmy^+77|#Na#L+QJ zpJ1AAU^}vAWo4C7hPh{(o1A7PugmsfVu$Jc@0uxFgx?==Bv0{m3}|gFhpxxTu5Tlw z$m^luey~vXZ&P-&ydo*U5ZxQfw7+`uAD8>p7N8H9bpTzu-hw2mDc|gXb1?`g)Zkv?cX zVEO2tbZho``7TA^yV6h79Q+k?eC3T2qcb>w5t->JUVj5 zd%vVFQC6wBPX*wIiJFg%Xcp|ucc8AyzqLp zagWDMSZFGXNQxl8sMFq%QhDbq4rb>KWL7KM7a^bbgC#`3qQnWX8#13aKmU$bP=vMX z3U2F_im$-Xn(|5pR*bs-2p+6uceJP(yT;$xoKItH-;el@~i#eb)pnbUB-|?0X zxIO7>?z&&6wFH^(q25a>r*iJI%e}WeSO4} zmGgH&o5OA#2btYCj-k@XuuY`xeeI{Zfe+oRONr+Ilj1;=dGWMMB29i=t5yOZ$3nXI1%=}ZfNsCFu^^kat}byHdGOxIt#a(7IoFbA$Rp_ZsYO6yX~mux zYXXP&RiaHO7Zen9*>3KU+e|vC{o)0*eahljp2OP(`jt+Z$2kIf=4&FXIjs2^_Gm)j zEoqcrU!C+Gd4M_MV2AKpg(AdY+!?(mcCw#@Sff&xMmOyVkRHkUetk4_?Lom#55fML z0BgQJPu$gS`)j}6;a6(L#9iO>()t;@f)2()tmn_O0Cs`SZ*n==9O4eJ-)bSlRvFx` zi^-p{6sk?!qxGc(SpDqFZ|K-LmHd$qwRGapfN{n5hX?#ka613>aptj4o%DMmnbX|F zy>V^3vRx_oe^%=MZ=nA_OXeTA|7b^leDV+6x5Co@i#+{SByQzi|DW;hm1C#ZR>wST z?3BOB@4qL~yNVQ7W_kCE@Q&F<7**XEA>!<~-AkNxuIQY6dusO&Pe0tbT1gnv@HOfB zZCihx!a6dnsd}JAeTRxpTa6fjDeCPUcDU|;)yTi%97hN-a$Sl|HvF4n)wiNGxA{W06zy^@gQA|tC6<`TCEmbD7GeHZ5P>B+t9w+DhkYK1{u%Xjpjo~e>OMGCupf0@fS>!LkLNaDRy z1I{LfY5<8VuJI0b!w}2>WDxX*AQB(qIJ}GyLr5Z)W2~q#UK=jIjJk_4q^GeAD(|Ls zfB6>M3DHQFjCgxBFZR7r{^)NBb;BplG@X=7j4!?Moo`yvuSD#V5@94)yx1&vH+1FY z);cuGCSQZtWCtlB(G8-Q%#?RKByqAJk_r^4;2d~W$7+u@HcF}0#8|7!>TBNbCxvM-^wzL$T^m+tth)gv5BfcOxtU#4%{6%zFJ%i~MWw|@tx z|KsB3-*)naop_ieNJV!Ch;0qlZRzs1B^ump`1L({v{o&icns&Nn8iP!{}Dp}fc{6B z{Q1cj_Et4up0~v+ONybIC~7)IH6TPqQlK^%4D`goJB;fUoBcvm#O;m5C(`%Gs;RuM z7>s9qLB!)7RV{>tJzX^J;&ID_%QX5Pn)k@|Deuj)Mi&ns^*slcSsNOzRdqr7GD&zb zmbnnDBsVErYCBX3CZlG}HF?G#%`*K^@L>@;$<@6%Tq@|UH|y?=hfjMT&@A8fGac)IB3im$-=ia5u1-}!!S zvsx&U(s($H@a~~z#Bu}>J-yZzY#5M2812>GtOLT9`XiishZOcm3DG2*>f>3tpZMq2 z?C<8RMDfOe@$t1-gtEUsf1FP5W&Hg?IBJb*_;bdr?I;?mPtT95nLrH&MpMAJsj25| zW%~D|{(2;G%xBd#$s;oB0Q+zg4tGtFePh9P(nu7g%B&Mt*N2AVx4Gh|R-zmbV`UwKI zYkhJ#NRcd;&U{cmF*5TsBKt9x8{&d{BoKbGr`KLWvkW~zO6!j?Fje5Drv7T@20UfM zt25*C4fZ%~^W{lBJEwlFJxXF*8A#;b)(ua?hgpCI*&Nbdwa>oZx# zs~W=$52_(^mCqrP#U?+xtCg}xEgtK!14p*?wsgiM5CD_$f#k9saN2ss=sFEnf+%TY zEKpy!I5Nv-(`#;{X_kqvk$jIL%`nNP?l`iAVC*&UaCT{J!9@hdU{~Jz&MNld3`GY5daH$w35)kd<|eeis7OHkV5P!x{~fb`eZ?>~wEsn^`%d!xU@uwudPVGcp-kb-8vr zez$Vp5ytuM9-{KI+9&5YS%MC+6!Y`NNeK?Q!kg;IH|L4Y-87_hQk8{(k6bx~3>F!3 zlW@l2fU|vOiz4(Vd#R34Ja*4#lUUDwh!JF1$TBsxP_Df~4 z)%+?i{-e?7z@|@6YjB+2kciP@l8)IF{=S*=Ni$(-7+<4G+L!r7Zr{_+7aQef+Q(A- zx2YUmbW$-*%Z^5E)V2$6>e86*CVQHM_5U zPvSR@#QP0LYjnwzE4Rn_8J;Z5;8T2ZdQk6ZgI$%9W7ZXYK+e!o|>dZBo&q77C< za7VbH>^8ipz@m5zTq+QD?DcH>_fMTCSb5JKh@TtA^@f5Dz5vm@09{av>@)PE@S+sj zACEa&aIyoqHA1{Ua*cR&eiXkXg^WOIde}}K-rf?dt@7Dy80?@$xVOLxJxx z5!4$DX9UoRnCg#@k+pVUmy2HLdMgwXOsJ*{=?avFuqxd9aFFUd30+JiJ)UxtfW)DV z7+vA>Yw=LGyjBdHL4ij4K%F#&8r<&sF*AeMRX0@wCHn7;{;y=3(=Jw6O4JAl!aX`o z?!PzK;Rua``UzPMN7&krkQa;}#NB*mf5;0vlLaq+dfOg{g2{h+f4i-<^#q$@(0iSj zEK&LzRaMe}<}3G_9Z7P_lDkofkdm{=UkUp*w*56U8(loIX6SS= zP+=HdgGmL=&QAT6@o((rU(#*8{gt_6OsW=5vgG%`=|HZsNMclalYfr;u;|hQuH(di zVjQoUFm|t(nQzX2bQRIu&r`ruCoLiJje1sMiA)>-xm-|Ou=7qg1fs<%->)F?wQvSw zM-z9^%DUUr4v*$i)*d{X%kyqetOVXLo~l?cH=7E4&HQ7Q_XkVfkW-7BK;UQbg$L9` zQ+mME8`M4F(HV51>#rPt=Npd7>@V>i6-mxCH>X%};=A$^dc_TV?~@^p_$oy$x|d$2 z;6-rp-8+oT_M!?Y88D#$C3*bunm6gKK=&qHS~LfNJ`|9w@vYECB5AG@YWY2TLQW_I zFzRqjif~l~(TDkMu!y8CM*YW%;vP~=bWT2fAuIe;8hPgGf#kGrZ}SbM2hJ1i$omxw zDPpx^<}4kl!B2Ga7o1cs(oDhhe?JF)yr@-=e@<8&HI`-Fc!ysp!duXvJod8b9#paV zWBQ58H!d39&^zP&n;_Tq*!erfQDev|>y6UF^ZeftBMYXuM`%^mK)DEqG$nzNDG?{9 zyNQ^q946`wN0bLTs>@WS*Nmj*L+J>x-;!VM=2-?6qJ#Lr+M%h^>pFTjI)NBeKh^JnYh`EWAFV|Z$A;{TJE!K&C(HiIP z*Wy_L^rfJ!GWQwHU+DV2ERj0F5jL6T_Pnb0PCowzFpB^53d75KY|5C|yLP|1VM1@| z!yB?>cuVo)ZDB9!8@ z{p+ekg6OW1*u)>CHq3?IBqn4@;MtT@;OSv}ud3Dv|Eyg}HtH6q ze$uYQq<(UJFblmroYrNRv`v!m2N8_kvNDKMr?C>h=bU+-T=VGa`ZE5cPAB9m7{o6f zPl|Y{a~GN)lfg;7nikWd75%*ouKe~wdX3W)t>NAju6`c+(kHCfx?f5D4fM(v4}(CPk3b)>>QCp=g3 z%!Hrv{bzwh0Y7b0D?PCd*bTo%lB|&9Z3otgZ(2VdW4nbb`?sq!QlnS_{sDFnTc`v8 zXF|Bsnw8--{QP9E5=wy+XIp0G=P^!Ge@Ni_7n~e5-e0qM5H+%LquX<+gFXHDcByqb zv2+nne^yjmgEcHT=%=}Z09zGFDxz-@ca(#le#knmca-yAf`pfv(=D@uuVt~)XWE7Y<1zUfk=rEkbdw|#$cCp_ zpVD&XBcVttVn%2Cew1U~PRY%`X^@996oj-`&a?)DuMM{jz2H^MlVL^$kx*CjNMbEQrJ zpi$x53;(|ys-5CMwBEGh0{T<$J9KVJdm+M8f8u%MZnvSl*GcQe@^$AogjrJRfV|6B z$}?T_4)YuzV{I4OK@oq_aFos4*f1l~fZ-%aXHHexmTpj(Z?|Jbj|~&-mhJs;$JQAV z20nf=2z|^maDmB^;G}(9I#O(x1e`egf{H^rtT>yiNsFhTK%5bzNu+~MC6nD|~>z@cor<65)R)e~>Muvfh%RzV%Kio1RO!uu}Q#kY})+}F-@ zSc}DKDP0a{3#tHol}hB$Exv8K72jk)k8c?5Tly-MWQGI=j8<1-2B_H)N6?{=(ZDfh|s_VmqGlVPVMJ^$rQtbG6%E|I>R>{2Ki2-7oLW z&CQ>`WXm%$>Hb_h^X9X{OaYMP`KBEtc2==l@v~6Dx5l>}=x1o&AEyhFLP?>92sTQZ zccEh0x`wB9EiIhDkMHh>@;a^z z6Y#!YYp-i?)UiPt3PycE^7lpimiABV+T_mZ&e~Dd;zfpn2-s*53d#?ggJsCt4cKOx z-(26QsAn<$DtO6W&U9rpWXt<}E09ls1pX!aFkNDal}d3$%T{EVVk;5L!kV|l(yU)bOvuZjc{O1_f<~Zwm z6Dx;}=vY91I+QK-_b+%<=CHqziV<$eHq{8XXvnn*3qF$>gVaw^kmjRaYq)?dZtk?+ zZE*00P))^p>O;VOxCyC)o*yoaYr7kxyhVmNS7yJW;pHIdgk1fqDU5d9iRh?OH-%WHu z#l4Dp)6u@t*Lo3sG|?=4<@K;*1KQ%dK36rAEa(CYU`RrS7(s_j9z}4e2XU50`p{D{ z(U0(n?fwkjscR!@;SSu_hPjsQ3g`j05y5Ha?=kIGzDJq8*O%=JHqz^WHWB*``k766 zBuk4y7P1@T<68>h`vZF-NxZZvg{-^F?t3TMQ8;b@l4R05V-EPN#i$e^q~64;U#;`K_Xho z?`8A)T|8cRvW;c8z~VTIpskbOZtp+KmeaOj?8Q#0s+tjc^MEUI$f5CTSDFuRL<=BVO+Y%!~N>VZgx zSHTQ#F#$VNaDTGa%110wBx=saOs8B0XB;|ytpO5V)q?M)yvD%@=x$oXy(_9cbOC=O zMi`Y}JcFNavn#+KFRT{Hl;MpPiQV|pVLU;J?&<^v9u6f98kdqW!nl3N`>w|MM(zIr z*FmUkxD)sIV9?nWXHsPkk_W%(ypD@8E1s7yDq+PIk2-Ug#Kn;_S_f|O)&$tyYVhtM zXsJ?~gLi=tZ?;pSQJ(t!M-&)UI!?wa!P#imCeolmaC(Ir6pV%T*gFMzIXSriMzM1W z0d#F%>0=zHpPgfPWsPlpBZpcjdo~sZ%2MoFk_#Ck9!3rmJcO<;6|#blmNENAh%=^h z((vk>h%o4945@YOalOOsEaPUS1huf)faD>uhUsxKIUu*Xru+q8A1awM4BX-nbWMCs zeh9bLN}Kg;gB3hqbwJmCrKKhq%@<@(ZFSJS(5Yoz)TXv+&>3DOCQ@xmfvB0|q$;)P zcR8kOGPnvpYafeJEij;MV-+`t}L}745 z#B3Um{q|R|ZWX8%d9$rBS>z>!N8qYKx8ErwD-G0z`ud~wV?1L#2igYoKV4wyzAQ!4 z6h-Yo@YGVm8}X9~l+~q6d949Jp z*m!IZ_|e-HVI;nE!c)YqcTx79i~ynm)k4|qpR>B}*jwSw&3VhvgSq{RggB(D2Br%n z{ero9H%_b-L(==$mOJioKZe~};!~TM>3W90+{iUh1cUhfCHu0%8oAyUKRpw)6gYy} zZ{Q0z+)yH~i=G$CLA#cQxYh~#P@u{=T;y77lLK1)UDP!D;JBremuxrFb0^FI69X_f z)OUbIz{_yJsUzThJpVj&l z0osmQ01w8faH2*Twf3|CwH8&7BjA&LygWok8~#DV_;yWd1JWW$={}p3h7)=zzJ@=dkmh%*z`#`*lLCo~TB@a%IveZv;?Cr1 zLlBIa{Vl8TddmPqNhcSB*^lVyoS8PCY32qln!;Lc{`6qeG+{(gktw#zyd;^kcA`sn z>Vs^{&@#w{*k~-BQ~lFde_L#PYvKvI31&L4XWlV2G!PL;pNTD|PD9j0R`GVwOLPx2 za*K>3vP!E%Z6M6)7q%w9=Oq**37)j24aMOiUQHjOQiSD#8pH1d&`t z9-bXR#oW|bE6JWy3{Y%QjtDnT1bIP0(Cbs(2A9seln=^iGpNp6@Scvd8XTq%;Ws$Z zQHzK=O-mj&eY{#@`bH8%yc;VzrN9Ih&y*K!R!e5)q^`DTL=LqXKCM@18yvflE0t?u ztt4$`sV{1!pu`LesH5%%;8Zr|@uOX?Gq0IYIDRyZZ~&8xfV6vaiTy`64HJEGwF1>? z`fjPEqPAD-fa2ONOzi--S@ptdaE(Y@Z&*~)a%?vvfKbCyqcObJ-!rUrH>~YgHi7kI2*dC!z^st{KKJ)eB9sp3fGOo^zvCH7<{A9mZ&R=5>dr?j4 z1opwer!+tfUQi*TqQCY{(us{!spD)n%L~dm=0hGdhBy8#?Dz zds`ZAy>9knE}H9$Yu?bG!$qiPUYt0oL4*4Jj0QZk+1SdipgK>chp|PvD6MCB&hjXXQTbUM^ z4gf>3;));^hWO4*htwk zV?oL#v#>7XTN9@GoTwQuo!jGC4+eNHFK-&OxnA{a%P*{*qEu1# z!PLtCnWRat2JpjLn4K1H*+I$r~;i!MDr?8TmDfGPEHNP~FC>?PsVrZw!LnG-$d1BT+_h=7t6nV#vyXi-b7p zZ7`cPLs>6mxt(R{%;MCaVgxkO0eeeBUI~V1S%dwR6~5AOKt z{!x&&ZR{$P9f_S<^m!H1lLS~OVw%G5@tKhWC_mNDt#CEC& z+&?9bg;G=BSU`~)b*)~9??YYD#ImN&LQY8feJ&CJF@qCe*8(;A*(Ms>#xk*YbHzak zeddNa8K8+d4+w1o%}y7eH>k?IypYFrsq{meLA2K?fJi|^H8&Eyj$W(O0fa_$=;M0^gHPH4whY_2F|5c0xh6E!CC_**tmTDd3^_sXCz>Mb?@rgD~>QK~rz&oG5=1 zrY1>~Z&Z}dKPqWsWrHsRGiYRtked>u+3pzU~EbQ#U z(&@lI8Pv1v(?$Qx+y<0U+c%c_uECq>`7=Z(-(m#QYEq{SalW8LbI^rJ-GOs994g42 zYnvnq>6OwCs zw>bA=L;?70@~}p|a`=Y6xX&(nJCzSksg2u-2Ht1tzBJ$7FP`5QS#`Oi1^d9$s4B&H zG&aq6kka|uE%_$safy{Nzg~ajbLs{fN71oc+|o=fh3B84k$qaLU%IAq#@e9%^DUnI zTD);_{VwqK0#yA+Yfbk{^N6hH5fAk=ydgD3H3ki~b=30>Q9NZfpt&qdhL`6{{Va0k zM9m7xV3~0*!Rl7e2E}#kv9IQI5l%g&rqh0|(r&>vmO*6;*oOn6?D1;cbb}$kYe!tx zq^?hszB6xS=!gKA%)bK$QKUr;drZ?Bn~C`5QXu%Rv*x5Sb&S=s7qRHj*?d|r#^5z` zE^U+`7K$yah`yG)kovejPl70a7k_N0*IR(s;&sU(NNCgL8iO<_RkVmFx9#hY{u2y# zeW!VS1XNXh4K{p=MWABMF?nZgbv)%7GfRVb8vr%UMXB^fyuv}Y0meBMO(h3u`8HGr zq|-J~S-rtNz@UO*yd_WS4D1$nCdWY>xtXP}-R0p}3A4fnqgDOJov|XP?LHsZD>G~Z zAhESMW-uRz$(o7f1{r^v=JdAL$&n8p3OtXH%5WL-^Hg7IBo+!d8<3zgoyo6#tfveb z7M}as=#=7yYLY6-x+b++Y~$MH@8=V%gwJ92gF=AX&S^xc{4{HW4d!kJ$~T!TXT5*e zkD4L{(R|Y0g(uCk*txTdnLjyT^etBN&F8sJe?8=PcGjj-TADg_0#O$`QNxE)Dm(RRbcurf%thKo> zB^}XY#3oeCY)9$5hl%d;6LUAL&%nC2tEs;8ZGjbs`u0N_QqX8)xE__UI=PHcQ1mI2 zJba-ft$)#^OBt#y1s?8y;k1_FCM}{iJ&)UO-$Ea~hhA1dj^>qutC|JL493e*=LN9i zj;Teu?-oxF7M=j$kH+#37T{s_tDyou2f@NlH$BapGpGZLYBcx@t9cPkerYX!t`kp~ zavsWwB?(KA+w$wBTW)m!3WV^-R3VTHDz&aFRtCl4P+`{J|bRhEbTE z&8k_rCy2ox>R&%4fX#wXfuW-v)MSh<@(pFvoaM)Ob8Iaj9K)~uq2YdqnmG;*hU=f9 zY{6>FUw@z{N$~HA)Mt|^^q6JKv31kTslZ~s=0-OS=5Rt%t3`4$;hx;WgO>}kTk?+) zPQxE=UazupsWxrsKm+Hd)Djn$G>846mV86|9L!=F0I?ckPh(x)%>_^d!0BQlJ(F5~`Kx>CQ z+ADx2kNWhs8yxv>Cs2)MDlJ_Jdvvu$^M27d{HdGtLdJm{nFbn2KmEH7-rNmhvj>aC zrr)VIC$H>sjWkdf}wD2hSFwqXFd=2r83qxF$s`Ji&U1H7?>Y08@A zHyy^*&mG=wP0nf1tu>OB%}V{UY_pkR>_a%m=|@&Ju_sK#Pp@$^8?VaM5W})M{78)v z!2VV&RKvbl-5Y8hoMYDH-^p27^g!8-Fz7*<=wo~>wIKD8(dJ?e!SfEk0DDXVC5Pz35C37{fCMkw=3obIwtu8v~w~BMti6Zso$-bN+SHuBZ*Xf zn|l~u%-LjrOJ1s?>i{pRKJGwUd#;GHbY3B&m(}d;E9}&DdOB^N=8iytrI3tDU?JqL zextH#)nG-zd7l~eJ4>q^r=O-%N9pSrjMyoVmkf65!#EO`ae7WNQDe8dRd_KxtMJ@1 zJAa92Zok8sUVOT?w`|Z0oJHJ?AU<18>W>ZKu#^pS-0SJ-E^6enR4Gedbb|-P)Z=nX z{j&otN;SuB`AEV?hFmQ*Aud^rp1jTw*Rw;P7m^Ys+#9QlFE-g&SfSe;%HBHN)&MQo zY`E^KQ&~v1exAF7DaUglCoH&s-Dj=t3~*{GQ`Dii%2=R`Pw&`3EexPZW0ckwTr=#~ z3-4He*W}IXYB!fzr*z+}*uLran9upM5!G{{8Uxz!6~zimpi>(a9;VA7(D~M(B-|a#EQrl~`%(I;SQ2xoDA`u*oyFBDgKE4anAEqqJm=3FGJRPbDlOg^cRQF z)D;&U^l*qmB5pp`#)|OU24sz2iaUfZN>;juIu|S~(oezUba>}&7uk67FMbg#(?^&* z9~=(2r3%HRDa-ixYqaH85OTTWK(>16dYw70x`}E{i0q-()yypxj6>?$AD(GEvx4Nqg;b+n zHkZ9Ur_^(QVD!towD!B~P!T@WK;|rS?asHxw*q_5#QQh72*V=pWM>z=5uonrr=GRl zu$H{TyrAvYgcY!uRqcy^QAU`^KrPnW)z%;Dw`9zQry2`X`>hJzuX%0472Yvdyqp;T z73YU$#w9V(PRQ9B%y;Cl0Gy{_J-!+bYv#^TD_h_2S)kYBlFbd_v7T9U9JqmKyvZQ! z(&-b`zrG>`exT}!n&VzVwk1o9^^2GyrwciylGel8J^N>Cqcf+(U$|YC7fNfsyUk%g z|H&FgdZ?y4(v_HEmh55L(wSu*#K6e{CaZ-GB;4YNa&8f3d zl6UpJl;PEpQf$WXF5FBUPXVM;AiAU&t6{*L8yXn%ptXg8yoR}mc~dlO!G>;fU>=gc;~J8ls;-+ zosSh5=8tZrHoAkD903cJJ`1@b3Cr!8-2Y~ZPK$)?S!ZW)7Y7v?ig6?oDjeh+iI1Qex((bO!?5WnJ z#?-Y|c4-Y4Z)m&4!>kJJv$hjSF0h3l9q7QcxWW6*;9-W2H?BZ?0*)@OSG2U_Q&+{C zvCX&&jK@k`mRoz5HYQ&B4CO>&Q$UkdRwHc}V_0*nl?JS;C77ln$i!-=S=6tQ>mrWS zU67lN1<<|8%F<1(p)v4~P&5_~^)h95%jw%dKXlJR-$?CFHg+Or?fw*Lmp~^4;piH{ zdP*nhK1S_6ei@;f9(w!QOuJf=E3E3DYaq9xH{JWiObuDvGftDD0|7sVxB3 zbwt?>7dY#3?Pj*K_`KJB4eNnB>%H`4KviXlfR>&qx_D(WGS&H&Yy-RZn6@Q{+H3rY zEM*J+89xcJ|JgA9*B{=jXVvTmj1TMk@i}w1=1Sd<1<9A+vFurySnEx8n^@G;mC3YF z7=X+`T+M5nlC)0hX{@C<87gsQaW*Hh$3Q|R>%DU~Q8z18dk2Pd76*sGy)R|tomPLyYG4Y%=s~Jx<|G(IK52&WLZf*DoB34kO zh%`NjNLP_wEvSfq^iC86giwt18nFWcN{7&-DlOE|2`UijozR2y9w0ynqrvXx|~yK0PrH~j0s*1JlQQ?aeR*3YV8@|)I1 zsDO;Uo%K4=UBvQ5J@9@Hh8Km!+$B+XD2yj^sMpFdYb}Ytq{9WE!N1f zO6B~VMCLtFN$6{>@P01m5cP#GW=CFL>D83UxpewgHXGxJbN%%D%DDeFJ^!_$_KzRA ziFAFHi(U=x$Bi8B%FIJ|&(t$bKY4tj+6q5D5a;oP zP*uW@g-i0HhYjDrYtx&T*SB8=$1f^k-gY+5&XlBGI;IcF(@idXXQt6=GP2q0weez` z{%+NytHg~tqb3nbL~*W)pLjCqdzhEsSH$*8W;}{R1*kHO+8Udh_^gO#n+%U{`?PTC z^^6X04Cj|ORdLug_S^MWgj-^Gd*`5tQR()4Kp(c!l{X6T8))i)R`btTizG6yhK3r% zBZKqVPf9rr8-aaiY|`S5K!_ z9&blyA!MO1Ncl-L#?*4rtDU)_1Rh&{t7MR3F_=#nsyB&d*WEJ1H+)6wufSAv13qPA3B+!B(K5wyVO#Oe@b78;+9(@M zo|_6|zfDbk86A0IR(j>`8+E(8Z<{}To0)c7iR?VZAtsSM31htTUA1##<*75nUoV7z z5>-{50+VfRrl%aLJxUCf#rI_r(YI7&&nme|D>We2BtI9i)i8>Ze0K{*uVGST@47*C3WVnC_W!f z=+tp0Y;Q-s5!F^es~B2-i~}cLyd<7y9M&eE57Yma$L0!-9Oo;Vn?YMaeb(HiLpyjy z6Un}XdyS&iRZ7WYWb@@wKwnL0TsLA4P+}wPsZ%lk+Q#?KroLyU1TV&8fwSrn*QLP=G;O~B7d%9OYE4bv#gY@3E9_HL`E|p7w z>FRt{S}=tcDb;y3XXnuAp6KmJ9$bhwDjH1htrP3$yM6Av zRLyoa)JB`smr_Q>JIvg7lEs{j`7p*v<$*Gi;(AwbockhyXIJvUHJ?ex*AOo;CL$cs zTMjg7#aNz@=wH;d)@w^j!4y6rqb9%eEeDYpO(%z>JW)WQW<n~t(1p{($R&`o+3WHWx_KLiPg}7a;An3L2Q_}$Ob*c8y97DqJdf3V66Ov zXBK{*gRgygpy^8x4@S_yqD^9ZO({jiIN;M3huIW=Y=8jrvX~|>&Qy_NepostKo`<6 zcLcv0C%YHnUAf(AYms8Ed+?&tO1V^Mca?9!8}9`rWjH~v(dw;6`RujC$|PEvHx3^E z$U6VP@TPJB3-0#p%+zGQ=z=k}?^I+*QZks>6D%^Bqkzt0JnIrHVY&6)xLB&Z62vad zw)mB!sdBtJg<$LV@g{G6>DLO$ z4)Jz&kmnc=U!{YZ<6T0j%c!^0>(~7V8RZ97ZS8Cvqui1(ql`3v`vzTSu~zuF0ya_z z=A(9{Q=KrhdHj2)%NWc9!v(tA+TJeID@~CsT1(JI)h>Cmp(;OIYD!Kl4s+KA1-T2^ zRZGse;j>*mSQj+XKar^;MGW4J@>_o8 zS>6PSYC(yaq5oM#UQ2$9*l5|Kn-Fgx+djkKg_vH9bPBOKQa&?`Mi$By5F2KP+hMD3 zRKUVbP2xMmXK%o~Lgi-uu72l8eaY+%l|#L^xz0C<2`z8#NJXQoq?6z|Palk2?J$=X zX|ln-DxlLZ(>9(PzGXH3HW>VI6x`ttG=8y(v%^NHTMOz7&61!a?(eAspA#{N0YyH4BsWoBHGFo$q6gRgP^z3ATu{LYu} zc7T;RJ!c0>#WH-Cm)FarGwN-=e;S>dY|6(sws1z{hY@j=ZvMpO&$CuKb;H%@`CEsF z+vSjv12PR_95xJMy-`hTDsao=;Sz1(L)TkH_U<{FqOr+!a|%l8U`O+0PjM*=zlCg# zk`=h!IKi{X-b(LomDg2K(;7rt{VZa7qsVx4{IW`k)k2*p?f>L2liYdEgM!JQ_1%-@0gKtD_>w~taikXi1A{%cxOgvk#?_y6% zBZH8uCy)=Sm#}9~2Ewd08p|9_++AY{{kpwH3!ghVvR=0MTQAWUT_m|FNi~gTfGY^_DR`jG9tLO^k*>qB ze=ntXG1KwyedpG?^k#okQu#SDbbFOvD?G=XdkrQw)P6qjoa&h?`%d0rQC0O}WIK3p zm(kwxp2XEp9LF;`7;5Q+KWhZ(GVDM5^q79|m4(BHYWE-fUEsDlT}Es>w8L?`b>N}Q zh-XSAQUcQ!@7j@wOB|}@OTpIRP@+3IpGHn_jPYVdD|Um@TN|%(gxWjw4sR_UnCMeB zn|pNQZT0Ls;{ct735mp0vE1g_clck&j(XqCi;vi{F>{bvZIBOV%a=FU!_;rUY46;>z_vho7*)k8&5I?uqa`!h+R0XZk*W(6_nPxLf3?;5mZ z@00r8kk6%HhO7xB48Zl%9|}$7>68@uHY=4kA)c3fjmld~%fh6;Wa{a7mt_4V6q9ez zxAxf?g05)98-H~#X6$7e6I{*N!#zPAf_zSLkvjFpsKO{gF)YbyR7ETA&c(_{$HA+~ zt0PILxpcYR9#74kcIZn>AsiT}y@;wiW|9BBSgM7cK_IKle?I3G7AvnQqqzP`_OVV{ zr+hXy4KnP(1Vwal#LH{syh_JmM;xW=}_{9S9CkTirT*dn2; z^V@Unw>s{xT)(M#-c*jT38i0B_&s1CW2a7@L+iE4#*MQ+zACc-rYs5tmCX51a(KsZr<(sXx$M~ODuDQCZn zmNl+-$q)Mz1U=e!E0;cvSdW~Q(kK!9l&m7eTLHPtt?w)Q@=kgf;lY5o@0W!)i!WXn zWFwTw+oDf}z_Gl3W-cQ_9aYl!T;Nc?(x#N0UOo z*ZAzytL7zt^_qB@JB53`xT*4}cV|k)xjp%S8TgDzrnZ$9ySb4ISCzTwoewc7!`nN# zI61ze3^|O6;Ky98Y_Pa#`85c{Ffg_^PBj9L{l$Ulj}sLRs>1 z@q;nKQa7c3k1-2aH@+FL^crHw(+c7Z@F)6ykHAJ>2~*cNg*uU)4KcTvv()~2A*A%x zg572WPCJC3XX<6G9R0@o_kQs7x4`p=}6;idQ1DPfSgw*{_GZX~)lj;&9UV*75b zEioaT=))A#I>1paRW$THXW87FJf||(r=xPlW2Bfw!?D%4;*T5{St~bo`h><*@$Z3M zLIrDqqK7aA2G=h%aPYeA8mwEfM;eNp#k^@xvpqGPFmyc~)Mf?Z3K8LsZgkCx8=69B zYYSVJ3Otu7cCVVRehD^6$?@Skfl6{Uxa&1l)JM1?bB>~-4JWLn;krh59KqpNoh!G*2{yXVklTa9dp;Toy$V==)=YuM?rKl_C{~VJ z>gwvOY+J#WwLWYK2Km?ebu$FiQPI)Sm!MZ|YNWjHWF&ljop1UPYe1#=al77$ z3IE*aI!O`@ctn^f&VUGLAipGXx~ApjiE1mx){5bz=OTfocjB9kx*>O1S7#z;N&`yL zb`C8fA`!k3oE0jgTkRMyGc;so4&x z;->|2@tRRlQq5V9yBCu@5?r@tOi4beiWDVwMj|45(2N7=xQ!oM{60o$lCUwqSvA`+c7*{t6HF zT(muF?uQ^-9toIT@*MaQp|%9Wj7lnZ(Cufu)&AnC*s=vJ@2CirX7&2s?}@8GNWD55 zJUN*rdcNR7NKnXW2t?>+fx~Z;Qw=C7FOludor)I`jjrt`?;06zvX2f%{nm2etU|?O z&Z&A`(fQ>loHz`>;jgDSm$*ZE&((0rQ#84=6YDL+l(+ud_eDvA_1sTtw&>Bgde-YQ z0@aV%jbsHI*_a$mk2(ZXh+ZDS7Gj-~oG{+!2~7zuLy9n^fxe5Op0)$Gf(65v7i58CB%xB22`SSWq$MT+w(V%2hKL2#DX#^ zKZt28wpJEgcqb5U7I1GX@>Z+WWA@U%zI^#dcJa@`9LzIB1=#W+HKk+4qMQ>G%l*q@ zV7(;OJUKLY+dZZ$wbE7dGgvHmWNE*vB^|0q+XneT_cx1%%XyxQN=Rg`VYOPA2H!#i zxbM`h_H24I_zI;=)@?p^a{RO)lRV{>tbK|mF8eTYcR2~-*uEcXQme!7Ah<8DyY%}Q zJF!h>^udukN0wk)?*(>BXknwr9~lI)H?#mznS2NMr_O}@+k|37d3xIE*avOyFi~r6 z<6s6c@Xa=d_Ez=)WiY$6y9&wjBhxgvX{(o%q%u+d32mYe_sMH_L{#{kcG2KAuC=|GIGhiX0z5Q}{4Y@yerSgG6eldZ5RN3!JAh za*!LNdpM56v3o1cpm0pGxoloZiJsqF$n~WtIa>FH(gNLoTr+<=FfFXc%gk~w2(=or zS$tytQJ@@;(r;+2F5L*P-1#tY&zoBf0(f)Q6i|VBv;hrD2o=0kbB_Q9cGu+@U^Tvn zt5>Gwc>)Urx||}3?)f$shn)rP73(&28To#xac^w;1u>zp z@mh`aj0)L1ckZNp{Ajef*q?i`Bgf#QX>jSeg^J?h%d-+6-Fb;$Le38TS*qrksktWrRGGEo!n>fxgn-oq;*&5a1LpK>f0;AU8~5< z5qA&qfAwnu=RN4u#++}S|DVsQqs6EG@*4TusTs8ed%#RdE$D`)?Dd}SH`C1wio}Fo zm*6`2)zH#iy+854A7e*DaHeIl@`dm9<J^izJ{4qo?Nk20jT*Ska=`(9q>_o& ziT}BA%&*c}2sdM5%&;sA{ZaXH?y#N|`M;RYzwof1`y$|=Ir~4ps^|O^&1ZT1+*i!s z-ltBM*Tt0m8n`k$bbAA>7E@xx!I}NwS4?)Q;1S>(B8@Pkzh(di4Ce@71Fa;QSntm| zs;V~og@xcq%#$UHs>#C8_@7<7H2GXrrK*lhO3K1783DkhPhPMu7b*MlGTCdn&Tw9h zgQkc2>7|kCv_E(_%Z!#SWIugxAR|Z?Jkt#7G;@_a|BqNpOSGcxnm}omchm6D`|cXF zUH_A?rKGJIflMx+wY~dGZtrvsunpJe#h72>o<7M>&q0-3+S}uP$?b=41GbTV)-U#x zHl@vrHx&W&^chcp(R?h|PoZ<^d%!kM`*Y2H1+zOo?@bp$+^Uh1vHm5uf5Z>iX853C zIc=u=DZ>D%8*cwO!jd=Gx#`#3{w83XvJ-jEzb2~8QNto`VD#;;xqT>L8!*4|*sln< zPgOfl0$?_mU&;AD9~=6AiAAbhRNLGvtok+d^WQ-KT1^iUTX5XsjY$pjb>7q{A@KrBMli=6KxLru|a=K2>wjqsZ_Z_{2GQ~PtzFHC4gD>!ga4xE>gX~>(EqgSY}BSLps8&jSlK)B;)H0LRC? zyf!GRBkofAmI9ieDrel-EjZ&Jqlw`e{FBr32%NDjNT0TdRmJW1;}}i(NW#2E7V`D zqqC511_2!b{SR441{z+po?ZV_YD-|)@%adKvcvfuF6reGhVoL0ZcyOYUnAa^mZ-*R zY#7OW#tdqpSikku-GDMMDg21`{69HOR|j3v@6DL$PkNIrd#hoQE<5hr?)`&V+UUTE^pXZ+m%D zLlC^N@Igv@B%%NAn$cL6d^hI(t(13Y9u@M!AOy9NqwP!kY-_T_$+!gE-P@UpQ-KCV zZLRXqGcvsanxe$YoNR1tYAEE_MHlywrD90p6P@ntPTi4Df4jK;VG=jyKqk!%&z@uG zrd*1*%x-inDr_nI4bQ9ax0-0ORzhS@Ayd(S^^Ttq6U=-N*^JX@dfd zu4t+~kzYO@=8yEaoxHg^072WVo0H7oIIXVUS-$|jCN$MAa`zErG zRw|}E+(US1)MZjF7|83L*^|uB3jRA98dKAeVd25SVH$lNQ!XyR+aJf@oV{)sKe zC;HtS?ol>>m;)vS_Tcv3JhVO;B7x>w?fcX_+1Cp_mCmeirOtn+d@%{SStK~Qb5iS* zQS#v?b2ocM{OA$Ls+`>o2n6!n{j~61b^1;P%9ow~86(sd+LHGf}J)vux%nX zz*%bI=lqSgsOjl3E{B21Vr`WqUT8Hw@RaOhRZ#$x8%bpu&&x3Zf@HTnkoDdQqPfZ> zuJ#-ucgedoA1QHeXM_Rf6}N%v!Tyi;!UsHnzEyy-lHT%i420xgl~uWCZrkBWD_gK4XF~N{ERo zemlF6t?1ZBXt=Vl_9lMRRif|C1|FqC%Iq5JH?lmA9769ggJ7hNC+@lpdhEPM!>g4lU0Wt+ulw`jQ1tvaDQtO`R-p4W;o5fU5G8Aw@ z{c5(mPio{Rv5+*Aww$@E7SuHIN1_g6>lEa8z1F^aZS|vZi@n*MZ(yh~cK_YYpgK0T zOAdXphYwBbz8orggptBW!2}*u;O5QDL&E!r}LRmgt)%?Yl)MM|j5_*)b&VSl~?GdNQcGp(XLsr!I|D8r-&b1hQ|NJTH&?OFwgjmWvilgC8?{Ut0qAlUHOH#vrqIiNfXUWlk>g1zAeY(?FQtfRE=oshPmOZP?BX$mgpg2B zrwc+odD>+lZ^$I+c@&RT`A*Ma-_4JyWyn%`W!q%}%?u(^0 z%NrmP$j^DIv6;bh%myX9U4f;(aGaBaxS3Y5&;+Ko%g=TsaZ!3fSlf2d zZVMpA`Sh5$W4Ga&n=gINxq{sC@#DvD;WDi(nEa|mVQ;$n?Bs;wxY_phxww?&8fs>@IWpQpb~eI~q?gqF+MoXb)2VkJPP8x>;F|f%bd!W+rgcAySr4bO zK!ipFa^0mSnc3_0cYc`CTEZc6Ph`H#*rsdy>UDbB9Ka{JK0`=b43}ZngIHAqGSgU& zOng**fo%lRzE?TSm+S!wAT!#fn2LM`3Ew@0>5#`o?F>Nq;ss-2R~A6;SsKNR?{Svc zwzrJrmre%11k9N#tHFeiq>!#AAG}!R@(3nxW2$c`{x&UbIB52CPIX2x)oaC8c*2#) z;j-Tw^l&*sK^Q5c(9mGzGQNWfK*mh;I}N&{Z|pkaf`m70kGP!7Wiqh|Qr~bu*kef} z*b2!4O1mb(hM54Tw@z{&$dP$*Yyc!-h8e~c7zv30XBfv?Z6^+Gy(Q1>M4rw`j$NUY zQ8+-YiH@||*?~?hs2Qw2Ql&LX$hlGFqX-&vU&%wQL`-9!!J**zIp}n^U_&mvju#*? zKtg$gLMFvjN*trDtUE79r)O7N(iZ8YJ~C^*nI4|iK#hUtmzcOtOWL-zvFwOlaMRJ( zXB9bmT3>cGnkPHo6We240Hyd*a&qCVCm93Qk0_v8M3_4wr;nW~^b07Eqm24uoCoS{6_&Q=t+gA%1N^Qk*GQqwl>m}2Gvfbo%9&sxiu9wL@*k9O z5O8iioR;DRt_&*obov^{SiAv%iIQ0su!NVLCfSD?CzLP9#ia z^`o)p*oU&5WY<-K_cLSwX}8J5E^+k!gkAmtCfdUHnXZ@n$y;!lBk4*zNG6eG83e9H z(xvUF-&e&0kTsb-kxjeGsO1Z(tc#G)wiLbdX*LCTnvedj-Ii}U+-k(^D~CS zqEZXxKZE2eF?D-aPS2HfD*HCMxKv4LJM3hSP);vIBb*T9m$wH=Aw`Wbu*Uj*^c%$; zo1K!K%6zDl$9I%70_hnW;7#N-9dxW^fPighG8^zmBk{|DB{;{7%}m*1hIDyYwfKQ! zr%xRLxPE8mi*PuSd@~UyaLR9`OdZk~jc&37qIK=VkTUrvG;-H{bnWcNJJEzGLPG6F zp3&5=k;E}7Rqor#o}!|7ti_WDXS+dn*6?%7hdTemds$l)23u!n^xfa-==bv2`Pzy2 z%c0U`PO0#9?trNZ!O}OIkcZEN9Mwki~R_5z)qyG=U^9=k@^_u(IKN6R(CO@+yK(P`a-zH z=lgq)h!c?YT$CPhjQmm=HtxN$rT+3pu+Sk)bS#KlB=6$K@xs|oSW0YrqMV4XRb3Mz z*3w5nMar&YbXiGY!>opEV^do)9aswx(vMv=6&145gZFDiizd`A$!pB-G;z5!S$K|d zfd<{@^2R3-FAvbF%XA%LXut){ExjnWfiZsqjLoCG3%lgK0o`~J@Y-)`1TxDh*a+an z`1BuYVGREliOPQH$$J-mqdEHkqD65uneM>w*kUAD?! zn&?&pEBiYn8C!?;PeGx69_*g(PipYv(8=f^c#~5(=~A-yHX%;l-IO?yh?|U!4gC}? zTVTj2#pDwk)072sG*8d4ufE0S?v?yzHO?9tDs}S2_8akQ5Ppa zepEw4!z$X~017eU%x0GY&~5@jd!tH7ecX5Gy0wB2Oy0?q+kZLe_WB z=gz|goM4jBb-yIZWVjr7aA=WANi=2heX4Lku5?A75;czn7_e}n3hr&B6^f@^gd2e4 z2@GGe_DbPbM5uudjW%ayHMS$x0tj+hNA`0nZg`A(hs%;*=uPIAW12fvqyUN2DmTeGR$`eATO(O%2m_?b#++P3 zfy7*ID}Y2_^3^h+01PDGJ4bCVI@+L_SXYByHTi<{->BpD+3DVCKPJPms~JRLlAVVE zCzJX%U1wG?yZ|3Jk<-{gn;@dztj$|%iB?#WTR{y?Tw;U(K=b?EW6UPo?=YG&o8`6m z=}=i#UO@r=4onu`2M*hEV zZQ)<%L=ac{Uc7kPzfwcnA?r%gzCVLkxN>bt=T~ z+kT>Y*_y4L<(nyelp+-OiR-TmB0b%K{Ji072+QuV(^oF;ZhpFR*K=S#}V} z0$Yh)XV6?RAvvH)&Knl>n@hBTq4UDMm`c*9H|{bva;gk{e#SpzI$&mIX1%SX6YX0| zY{@MvDCrzeKa9G?OB$<~bHSscg!HU?GN6qQUi0xt)a^V8AlK7xhXm3eU|lrCX54rq z^ugMcvbdxKj0rNfg$&j4UEy%4S+})xf6apkN=visZ>Q1ds;L?W|3Etd=RQO3hj3BY z)EC2Lcy|F6@lL6Hj|WKEhnJ~+H$`OD8`zA<@&z@ERfBGkq1MYb)(L|-q}*EE_$?h% zUG7@n*qiDQNJjlA>%;hGrn%)m+$@)y>nnIqV**HVzl9r_+Gm>1032*yHgNOx$pvO{ zs)z$<{5&$pjezcHRT;K8C0~!WR&u>C>8gRfy}e9QrajPno;tPPwj+`A2)pPv%38VX zp7_^4>VNqn?^v#6s>8$3wzHtYp?Fs zrOH1r76D!J+&`>8p)HZbr(H*SEnqo?%Y|n41Au!Zi^9%LTCqN&KCC-5r(CW>+$at? z+&moMPLP81_oFlQLY# zh;wHrVWHTHo#6n`Cj&(3^Qer+7&s4$kPs$+svvg@QyD3UWyQCsbKF~Ez_F@F>Vjst(fMwJz;M6>K>et!VyO?+J{1s)cm1+{tGq&mhqj2_<;a^`-x_Q&7jKu`%5vUFDfLRfeM=0lTLL0DSXrm$5wdFR-PznepGV+3H{*6O zfS@|H0V4k{4d}@I27jatdkdsV%AWn}^E(>!LLDqOW!%B@5A@BP*9jG?!>zcCSMGaq z3wtP(eRcrS@ENko{j@wUz+`u*;#3)$csWdIRw3#4&!Fp5`ZSil1G9j&o~z5!iH@qy z1fv(qE{+U?4_k{@U7=DKYKjCI65z1?oJ)#X=%E(X>#DGyhfWq`qXHS1xsrgBL;mY& z1rN1LwD%RLsVxXKhVbeo3VG?SN4UK7#?3a0z-w5rwRp?6cuB#MWgaf4Qk}e-jh0Yp z^TPXA6}S5Iy5S(?DP=#ee4kIm0W+7-;^Jb{nT0bpqLvR{vRUjc#=n@NlmS9!LJ{!*0p^Xp z0{u)>JfD@Oo${)xz(Cr%sZG?`{=w#g-uNnpAz-69yYjlXx5;+hnHaMIXnv9V>*vfW z#0#L1A(I+COdVTyl+?lMuur2{rcZH@g z10bJzx8Lu82OqFDQmuhctEW7T0M$&DWsP&tpE{JV6Kk9m)}t0>djOBkH62L?61UOn z3b}QN#$xp%q(vjAJ9zFU-*%{%1F`oKWD*SNyMzgq)K(GF-a#j7=$C6AB1?}woYG2} zfXlh+l|KMplI$nh6vktQovy`?bB#EbX!;RaK?Ttli>f98F@*=YH-_Cf2VH_A1IQ@z z{<$7L&&=OuqPVj@h%xN5^j#?{`pTrx!0Wr*eV=lyOphjSy{}Fu^vU7|iBWIBQSx#9 z(}dTW!+f%Z1Sj3e%CO-oYh7ejj7UMnHOtaG=CAo9DKzgoc%%eKlLj$LXOrPus|mAP zeFf@d-NH#gZfT$vtOa)!rnxX-Q9D>5GWDZe#FgoH?Zn3SuR0pAu@V8n-iSy~-VSKRuwP=ElW61#eh;eq2!b0qfa#2nv+vWYhRgBfH0LZmNJG_|K4voPFwc; zGAgm87LNH+pjvNZhg-&@2%O#f{eiJ4f z71Z(*JCDSt?CfFqf*2{}$H}7-Nw?MaY0Hx5Yr>#a<@MCnj+^TQ3UNL&%{v38;C#O? zz&);;`>i(uGC6i8Xa_OukXzGH0hzM;^5Rh0J>9(~1fan*0;)M{{~@w&ty|6RVlIk- z!~8gK)QR^ORdw>|llruAc$$hhf9A!int>kL8%F-?Q5g~fTh$vaU~A$FyU8#WOgu8D zQ)aVn;XKz|GikuW^U?L}X!q-ZKzcM?GVF(IPX{y`VL%iQ16F{7IFh)rvojTLJ&$4Tyoqh}TjN!<}et*v~cO%8Mdit&5ezDst4$hxQfHwbLa7V)* zUbUDbr9DD>9|w)XDB!=U>2y2^({LaCr2>U3Jxi(d_+0S~tuq{h{`fKe+C}HyEX@!k zX~o5RT{t%{0_ewL6cPgYWag)({SF27sOV+g4LTxGb5Z+v++ur*ii)nu76MzhcM}j$ zbD3*t%RgwA!u}Z5{h&YEaaeB6p9?%q2PkcC51l;U0J!*JfOge-o>d2ZDCAV2_HLz@ zfqWJ+2Op(}9#-Gal|N7Od({78@&0h7Uj}wZjUKSLIk8fX30o?t7FQ-rNBXq^6MV^M za~=?Jq+-080HF{9q=M)>EV4kZE6}91w9M>ubDmR;#0x1d){ys#=oj&HxlEPg2)C!x8oy>Oqt|dkYI{j6DM+ z$|gD{CY(Y;0lQciAd~{XU!c0nblC~;Gl#LTtv~ReFgLjAE$y^`%L}D0VN;_s{t~dd z6isRrW^%LurGk(F7El)3pPQA`lZU^(>OREL_|D--hDtqvxv)uqp$R1pK4}%R28e}@ zp`qagvzR2-yt<7R5wwPJVTb$@RcD`ie+zg+Gblh#n^(`=yhb$k5n7sToNrNS@wT3Y zp{LWj9nB)5piWJi+u1)76b9^4ZE^P0c$;~6N2yx>cQ$I2{ylK9v#=j4ws`lCc=S== z9?3+SZCA-Gq-h^@lxnHFc*iZ@T(_K)RBrOa>HLcyxm^dQxaxbFN48L=%F&&6mw=NJ zHEY+D^UKhd3fmYc1!yg~pL^GpOeBPEmvrCcno%cHGbEsskX$y4m<$#{n0oRB>^vAZ zx?}o?Up3YBU|W)c4E1~yPwcpu*6m?A+lQ>cL(QAhEqE>i^PN^xqX=~JD4-|aQeV3~ zrkV;wENw54j?M{-vkU$*XJi02=98+ryV{HQR(kwhGybLhMsxc;-lkY*dCJ^)64+CyhpeSfm|Z2YxnNdN62LBzPvk|B@D z9j4wv=>XymQGfUA3&hUUi%mw`{Ms_LlzgR|q!aT(bPIDuv$@%ABZ@#g?Xskkf}(bh z_E|0#Tz{&n&9df;5X?tZvYhGCq3cJ26&8030OSr_6~0H>E8DHD?&z(dj)3|@P%cKn zft&i{KO+iF9|AkXyS!eNbSOWWTH5{-E2eSFXgCNEF)u3<*S=l=1cOco{7Rib%jsCHt-h*`@ePOYi~AIpfJ63+tymh=z+}&Yx+<^t?#K zUJQ(y212BU*_|f*6d$GHb5X|rr`bs!ruoy*V}_2YkAc;{UXnt}3zRfa19URoWxx$X zlRc@Opfpb^t!9)0cFpI0dVthB1hh__(PgR2bONC4n4yq}NNelf_KF$S&)eI(wm5-d zfhb4z zQJZytffe$F?)4=kErif=?|OyRU_xboD!CkNM?#KQbB9=cv*mm@7&lzHAUj52Om}Z^b9n!W_R`% za6Z6XB;hmPK*%SHG@R`9bK&L>2fkyX`VOgU>F@e0c+qcx0c^*o;UGD8nzANZSJZzl z(M(amG(zyY%3r~eo~j}bAKXC06Xk!&sZ4>o?0{*ae%WCiAcp;fC8J+;SclM&gBwOI zxh|{!IT!!R4_$D&XT&X$?2f-+5;Vktzxl1yD8Mu#GyO7D+2#NJcK_XL=Z*GVCGSS- z+5L)}pSjlpm?nB-5k_k-_s@-RGZ(-zQp+dFUt*dIHi5yq$u&QcsL;5iX7RH0T1L|e@0N+9<*MMOd)2VR$E$HCawAQjNfufW}$pu()yr}r|Fb1 z!CT+(=m=V3>Yvw4T-d)_jjdb#4NA>Aa|^130WK7|)i*xQ3nFjCrk9m%6)I)l59E?| zd?TO{^Ux_bCx>ZBu*`cQGq!kxwaaDt+k5Zu2VY}ZYgiPkGuHbnzm*Xtq1?8svL~MU+1g(nH=Z17XzKp zQ;@H(FS{Fd7z}SuuJ%Zgw9`s->rpq^1`@di;nj6-R2Yv^44-*iSUF(CWmy9Q14g6P z|1*AFw6JUW^DKbB#wb;l!}^=npsJrb3r&_T5P?AC8JL(1oz2%6+s**%OCh5! z_smMQ*ZQQW@qHlg9`(fd7r8C;6fD-vu};HFN+f~K^+WfGAl(OY{TLHD`4*}plM#)+YV z78Z6p5NM!JJO$KTSDn!yF2IqO;00BC_AV~iam3Z9s^1S~;G?5z43D@ty?ygr;0G~a zIm9H5Wa2^C&)0qP+rxef{BrU!lerhz>c;+qQLmo5PV^Ytm7G&ey~vPA&oNtdiftd= zbx^(BT9?HX;A_Xmn&UYGS*Wbz1qY^&c61B;%yE04F|XG|;LcEIz<^Smoa=1E78=9{ zR3m_H)Z+JayP9zq&uS^Glvd0pfT@Z1lJnhjJ_>P*F@%QUuxjlkq8_Z7`VMJrZ-lRfq=8V3S_i_ zY>$}~3&+C%CK)KcZ?4{gB^emP#WlK)K*sUW6Ts(p`xEJz$5NhOvTi#1e?L|>V3s&0 zb3r5r_BR5d4*}K1A*aq>5CepckJ$RyYXc6;%v9d(MYfW0PwcJxc}wY^i^G zP?nMRxGf{_=FR%Ez)+aa>QGggeZa&j-tS`q&LRy|1P1HPeHk#z1uuYE91aLNdht+3 z$VPI&?!sWHy`IO3?{7}bR%DHS-JoA# z)filX>rhB9F5Y-Y(rcJhk38R)rWP{UCfTW&VM$eZXyXd=%z?+aq#KarC8VtdAbB_T z8-bD-CN)M#NeM7m$x{gc(;$y2pF}eY050Lbygr4(o5gBsYMOv7tXIp!+;32+b;fUc zLf-k?BDqwO_t-cvI5=3e0<_zqrj3b}b!0qE#guxTBeIOj4)O}X;XM;^!1VH+Oi2P} z`te=BRN+CL9l#UIIso>$rD=Byc>JTm0DF1%4sK^mosu(WSjC zOMEXgDg_>RNGP&K-Q2zQl;(qHQRgS_@9-tz6KGa*IH$IZOJj@GziJ z^J0(MYZVHi(|TjN*`yH3S}IYd>B*wCPzLvR0%*p0-HY|C4CE9FA!Q0nUd0wy_qe;q ztupNbPb$+I6B}#SdF#*^`%2;IH_9hN&MQf1ownZFEj1cv{zI ziVJhf$;s)x^F5fe!$@>bnF|nZLQe4CY;f&V;$T+VycdI9%*jn#N+>Tt_$x8XdMybZs$mP~6q!A^a2lV|*G`Zw{7vmL7W_ANLA3^Z_SX=!9*GyO?7;fA`}H zyPkpW)BG*BVhZcK5_~j9RzK#QQYt-fkXABOW#@l4FTpUagwM2hyw=6+EswPKBh41a zKa5v@=8&5OHin5Zh7Bl3>kzy7NIHq`119Su7_#)@(vtOLLr^VZCI5Ge=lCp{TA@0i zix`D)8ky8f+10-bpguTxLkMU%Yp{v6h;iEEqZLHBVNYGg`Cuuv;U)E}W7Q@6iBK}3 zn+@0;kfFeqt#BfH!e7B-`HhnAc0;jEYcYbVCzf<7D~xDSGzgL%vi!RB^{mq_<2Bx6 z?h73#rA&YVEI(@mq6R?2mp=tv{tqxqeX~D#XrtA5tm4Wd*HUr)g%WM!Q+COZO%mm7 zt{&w(KLI)+mid9{Y#{4F8_iXz%Bm0I$s^mjapvw0ZOK&^Z8c3!^)|KhUX$e6)l=UW zJa9!UWH)QnXLi8NOZ?qp{DQx9d5qoNO0RkPqeYy`NGBUajJA`{MN4Pqo;3 zgz0c=Hz`t%UQp)-4MXJLRrOQVuoIJ$mrnL?WH z3ep(#lSt?eDjy`7>OTmeNCX=M4iepVBgbfayh7uQotMne_>a%2hX!LZ_@j+H@}o;j zmzFonxlO`m&jA>oRqr#J$iUtEvq3Plb`!Y*Hx{=S)QQoO71nJ z+(1k>4u7ibn7H^2#h@cM&cE4F?y~iHyaLVcmYSNU?nKUA`pl|g?NlKO!pcjoHnQNXm`r%ji)or)ShaYBkt@utLjBdP?|6`g|d?PkLx6zI9KF@g9Ea8h5#!(TsDM;>z z_{7*$L7ip(<4?P@vaK(TShTlvM;yL=^0s`+co>Vur6!Emh~4->ZI}KJcwb)0j>h5d zIGO(1>T^se` zS+^oH!9Z%0#8WvGW#)mZw|)4c9_fDc;MkY<@dEnx<>DyLPMl>t5{e^nt0L;M+Vc)7a&*I>H(|!t zaU$m#PR7CPAoW%@N$f&Qj@;r!T$x|RPQwGE>hDDlHy#rj7B4j1_apJ8(8S0~!{Whb z!hAj(Sx@7r`1#HoZlu)s#o6P^wS47s8|ALRqPua93Pig>d2RRMkeqs7fJLtluan-Y=j<8?E8ZVf3I|??dr^n8sdf3U-z27 z^|ZqaH7^h{Gh}&SP&O@d1I8RL(1`$2l2oXcL0^x#Zc*V`J9?9Yju~?`=QV+BKnwCovZz%OK<55yT#E=XS(qZ zafy#1l^pT=^j@@GCo3}z0BlY9GRuC``pz?>=HUwq3sU_d_QrGLKV&roe$}yQ^g3+~ zPh9wHSetbr08eG8^qKW4mC|m88-|M=bGhLLC(;hdT{o+BZF=3l(ByU7s&r@T#e1Ka zUFPm%yuA$PF8-ja+iFjR#!EFvSTFAtw(ystp8d>u2M?L~>;Gc^wIGAzs0TE=C$ z&%|CrzBfD{tU@ZXkywgCzKh27jx{8BnlY8rokM-18~g_Ch;3I34!A@>7l+>I7eEnPt}QMiujVd0O)BkfVA;WOw6fBr|6 z8a@liq#nD?pSK)GN^>^oVcm(zG7+;qA^^%O@@6iHGnn~s)5^-%!THDM=u44jPD4)P zoSKIIyhE~QG}o*$%%$gvQr9=$a3760&7!YQc)FqBGujc0msp??c1bH~O1EsR9~X=)Kt1>XRGGDPrGiKn?Hiuj9{Vt z>HGfT_fwB}aefObcdTxxzCHKAYnz%QHT%uWYE)j!leQ;!G#V|?C%r^>GU&WW7feA7 zn`AYl(1q-ePYFAnbu)i^^VL}@^*@UmQnoTD_;c%4%Go}SFTKjte0N4n&$4;T#U~m% zW&3rL47_y1bB|wEGE;gU2%{X&tYvoZzgBg;nCW+PkDs}^Jw?IH%uG-xCQ>B{eMMi|IWD&la7iGGl$o}poJF_Iolt2G8d;{*a73lg_X z=@diCwMpkrT08G$=;_@4SmDvOsK#!r|L)*|!QFf;SUIho4 zIgVkrn^l3`j5{KZN*i2q_x)*${{3nhbyC;hUqiIrdzb9Xl66mdCCK;>`OClmGMF}Q zKCZ6>dcC?g$D$dMdI^+KLKox@r7_|lOW@Ml+QGEv(1owTeQ*>^+Oq7b>*^Q)Ku{T{ z{2D2k3CKuoFw)i4)$FKUt~lNwBKVaMChNXm_Hq@Ta^V@T>R9HOgiS}t%!|8B=OJNu zpkQffc?F_sNbGYqJ!LBX>T_4Yd|Qb4%*=#00gbCX7k+}$_DaI_Ot{q*rZ5FJ|8~HJ zM@<#}`0T~pvBCG97B*YM<}s)2lz(&JAMRFB|DmzH`Lxk&UD?~WdUxf54@ErBoLQ6h(*H&q#O?3*LO+L8}9IbC48onXX_7j zHh2z6rImU_;R^vR(^i1*3<|5F_@yq`3?`RwltJwNVZZEx3_F``lKg@^2YR+7Yx-ma z1FB|tqELx{->ak8Q}nN79e-TAM=qE9kuoxKb!)fy10H6naoL9BRZnsmPnG@ne3%D) z&Y?agd{#Q-TDC|4rG6N*?{g{2c7*Z0!eP&R%GlhsCHdLoLCf|X{l>*TVe(}&*^#9i z8JluQ(Q}_BEf-JposK16%X95pZZ%_lai4oU+K_zd*qB>P_k~-LDWcTYt^-35<|j9PjB32@ zW_A9)$oRc_45xqoG$(rJbYx&VtH$S&ndURSowVdbBue6nqtL}8b8VDxib133 z46Wc(A6N_w_6|B58=j0)S7RWi-cPg0_dl3Fwm>u4PmXoYJr#Eje{_*%Qc{kYUUI49 zIgMciaG9mJnV;w2rkWj0=-^lIFU|iPM5n?3M>Y$}1v3;GSA?Y`RdQjD@*1*5+GDmn zr7`3RU5*Nln`TOrZohLd-|65#xv8*ee){@2;dPb5oxQ1bJc zuT>>_PFL>Q92*!YVfE+-<7eY94}V;GLd&ED*ihOFfr~@unlTtL&*j4-hA=&fKb)#5 z{b%xHYH0OJHqy!Vkmy+@m8s8@BYvvWArAmv=xc*&yV`{A%hEaoFO&3zWyERW z(r5!?_Eh*%f2xS2Cxp zb_9_|eQJ3Pl9tn7%Y-Lzh`rA`q}~;Y79%-_-x9JPeof(UFrM)l5q~Wg9A)+1g*syt z&7b+Qtm}PS|9574$!%wGMGSw)EmfRA*I0U+?LV_`v4!LmUKT?L<&SRciT}2^Y%RK< zBy$D&DuqvIPNZ8aHca;fJ<1M#_tH$#QYG-q63NkSa9{RPezx4$S&ej=-5VRr*dINW zpx$g~)L#+W%vB5-@Z3Eyr0@7V;Ev@h<(tVWFE(KBB5e>`Wn%^S@tB!-6u?YZ zD|G{5zSPp*=n%@=^)qV+eW2d$a}7kSQ1oNjl+*O%NTSp zElOWCo}Am`ZJf8cIkWI(zDRM@CEQT%la{yiH!ooAlvG6?C-1vXq#8VQIoSEuS5z@O zbA5e*LPzeEi8@Hi_a_-n2x^7%ST)UDK-?e_aTF*(lk-;FtlouqX?}3tG?>COO|c4= z!kvcasTOCxMLpesm7_NJcG?GE92?&cG16ukj4?iI#ui3wox9y1ktD+hR_T-Ych9X* zg@j8DJ)FvpC$KqIP|T0cr8CGQ6O)<6pN{rVi;FlaDi}c) zG?9r}%*5S1G$>p}bggtZhHx_(nkB%1e~7e000BL@;5uq)$U4aV%kL=a8mXA*cTn?c zgzhgi412g8`-z^u6DQj6M*a+PN9A*>m9Sf{_`lNQ;t}&PVWjUQYNKe)FdHc}Ww*m! zMKhri4H`|^E1K%I_%|s}`=I@`>UsbEh1x?Z)V$EA*W&3HEJmMWpB9~<(yVe?~OIq z*w+F*t0GYKF17!d7!W~Cx-Xul?HZF`()J+JbuiWQC>5Jj$}}kGU{gE-sYL_m|-N?=A_w5|?q3 zAo{8@~fwoq}-7x~5#D87M^J+$ppKG8OlI-61xm4-PadDfW ziq?OW#{c&pE}YoS_l^tW?=cx}JX*XXInLE)Y(9Ff+C;!u|MLUEJBIp8>UQnJ!jFn< zzS32sjDJ7AOH0XPIybY}%3sibFI=Fz%YRjoqXm*or&991RmSNE9xyZ8Sd%k;W|N4z{muXik0xrmP}Q+ zI5|K!-C4Cajx%vP<5N^t_fl;?m8!U4dGH|lS>pGyH6upWu(+KrG}|o#@a~=tHXf7e zk|mt^!^?iO2BZfgPcqb-{XHEB+*2G!Z(s3PyeC;iR#)}*ZOtg&Qb55^Q7uI;6yY!? z8HE1jDKD>)zmyM*ZqkySh9A2O_Qp;gIt~|oo%dPYNbN4UzFx?mfL~Y;d}T;8o#`}s zwB7zf>-&*C;R_}4Di-dx3nk8EyAUbQQ}OL-+%L)GH+e&uhG|@J$|pAr4{7z*|79Py zTVd-}99{Q#%tXaAD#fe_b8kpyj_*}07UxAgvUBC27k>OOrEh3BC8ZUUeB!bKep79$q4T+y`WaUP z@SF5+t@gVgq$pS}cD%FsPKOxOYPGPG?6m^P{{C#J-J#mFuSWzmr+d4Vbo4iATB`!VxHI)bN_rt_4%$Nmp-N+qP1ZF|iLn`+5}u_Y_k0giX0=j^jh zamGJh+ozEIISij@3IFzyq7JCbckqG1tU0_=@g9GKs87X=*=f%wr)QgfG^>2-ydAYsFgSWuHT{P?b2d{ zkh>Jlzwv^+Y?)14fe9{yAD4ane?D2AWbc;wU@iBes^F-->v)A2s5b5Hu^G)V zJK_V9N*v;)mJ~~ZW95n9Mx~jrmvktdMxIA4Em9}bgC%;>|8m|eSE(wk^mjpNpftFy zt>v_<>w21`?avj86xeRI=PY68O)FexuF*Mv9PX$x3r@ErZP`9zap09<;Gbr{?xBJ? zO}zQlmy#2Zfzz7^#P+OfWN8$!a#%mbzS{^8GnyNV+j3e-{Q+yN$bB1 zQH6J?=Y!z@YiEu%Yv+!=b}1)kqbrDk_&J^MnZtjD)(+e1B!#`%%Y$=L#1KQJJJq+& zhAK^AUV+WF&qvG5ODA{sHC8Ib&PBN{L`q!3x{X2E zI@dm;f57E0v#VyL(w&m0qrx`xLCTeU9EuUYzxRKC!EzJ3aoc3zA;(%@&aZt=t)tFG zVC0-5`Un5z2`)qwKvD0^)Ww|r>%00N>EE%uyC4!pa>EfA0MBK9_j`ts1M}sV=0Ng zfH`_~%>1(8)il0}6I0(4jVphyn8L>LXbBW+7?96au2?+VUK+Pj4T*zJe%Z+D- z>L(Ix&;mHY8<&&t!PYtav>kzy{Paf9#sh3f>BVVe>7t*+ldZ@l_E|0M(>bTb9^ML7k^Naz1<*3iv1~A>p)TPWj`qaL&M6!B>RR z7Xpz92|_D)wQ$N{cyZFT&p9NOr94tTv3yd0<0e*UO8Ci)J$(7{rFMabs~)i2#ehUG zhQ9U7BHR;5!bKh*Vx5AfllQ8VeHfW!0Y}wIlY%M zM}8p25sajc_o+^LEJGU+)HM7V-VqC*-<@R-S%GJq2I}YpGiHJrfkgI#x>ncRWFVeR zH`CfT7Bp`_P_sSX(&Ffi(&qy-P* zak#Oa-%bMtDgd@80~O+?jZNj%6T0`| z(vB9IvjCp{1J>36EnSS|XCDT9*EcHii@-o7E2~j#{ja(a_9R17N`Dc8uyW;jrIowR z6|9d8^gTABGwh2GsV_(5PoI4cD_4R(a?JWzN=r-2jA6v!!(RmORAYF6N~6fx<&m5mgBdt>w%Dve*MyH$X(i5=azI! zEsXPfK!^BU=0a@+cyu|(-TNE|-?ndMJ22i=rdmwQkbkY^R-D!7MZmZoIQR^t!J)k(@YvaKK$hE!tC#Qk6$2zE-I#{-O3&vbRKVHsps7{fJ zDa5J89I>}9An9RJ9wh$cZpn65iTKWD51oY0z^@yW&vNB+(0M$ss#AFZJ!b9P8?FWf zUjI;LD3mXzIE9@byuQ=J-*M*^>0#>_0E>p)AvI%Doeoe@pI46eTl zQpB*H#LO6ac8+Bjnng8C18(7?Zo*bOQvWICS%HYqQmrFnwxTR7EV^)%A)GO&pzEmN zfxPhQgzN1#z|1ED%>vkJM<=Nkq6;zk(EuOkrJW38`CEKh#P$Qliq=H!%*lv{sM&PMlB2DdFv)vU7Yh!P$I5v4-(UC%^FTxw z9?)?bT(+0gfm5*kPX&+YxgOV4+=gYM5qNJtB%4-bt2ZLv&ji5SB=4Of=j7kG*qMsseFWg_||*xxz;TB5P)n3#i`i_|%HW2sVL+ z;tZ6CKR`CYheK96Mm0Q4lA@pMR0O!l+_D-ue!k8n5`j}yZvMKaocruZJZ|ia#Lq|p zyOH@FK`+qxyS+un`WBBB-fRUTHlM&Xwvq#Cnwm^F%+fG&oph=SR6Qr3+0~rmEdrBj zOd4y~AvEgQmvetyKpKeQ^WV+fWM@IDv#V49HP34$pren z>k#a$hIeXwRK53)(06m$9-so^kWMP-HgVRF0b%+GQT-9Hv9|U@L_z?dco_=HF0+@rH+v-RyjRg`liobY+G=@fwik<;@ zdrJ`!@<~?i^$V>I3c%(2CcIP?3LVYQCJWPpiq3aUe@ZNzKifHP1x!tL)xL5UgHguy zEom@3RdD6rQLO#f`m*ssl;CV65u@s&;=}1`Z18#=gEDHGbD&Of>go=Y-zBU8rklez zAI0wD9I1%)bxmLA4yD>nu<(p6k6GwecT3?=QjVQYURzsL!lg?Fd+jZm9s8|**9`ve zFCyp>F@i4|Vu!%0uKYRdI~%>ASX-y^;K|AL%)b+&RPspG+z>cy58Y%{^h}vN{}r2uu2M7z;F>3n9(4B1kC=70-ApS8VoM(BI9V> znj4SPLU5)Dau&aF;`pz8U@1Q;%b=INGoIGvx@*{@h&pO; z5sgS~yeAi^A>A-AZp<`mX|~k_Vdc(uNJz`bq&g|T6#N!+MMGnz;R@g!*5YZmk(9TlHWv2s?z7l=PY}g4Rlj(0UXJ{OP6>AKC4S(oH_ZC8 zMo`I!+*&03s}xkHL_?i*ySFrNAuW8(jKw7ZwGMpy;9tr@g~{9E%|Db4ch*fznUKHk znfiO1t?+)^NJqX*@FWc1sD;I3ybyGZe}$Sj2JAdQ!Ta6Hja?pXN{);*UNc*>s*;Lv zsV#i$ufxEW4s1Qk_?Bsf4$72j&XF|~qt0JKU~0imkT!Nq%gD$e+p5z%H_;8%B0*e% zz_U_j5d*f-(NU0F+(l}4HWbv)NsDV)>wLMbJexTJSG549BN2g)hwlYew;XG-N4q`g z7*Nhe#-iTl9qDTjUP~K2nlFHAdg)s@`JBHxrth^`7p!5$5QGX1mI3&>2;gwLM~y;A zISr`0wbgP8?da)yh*A+lzx62K<}}{xVa&nz(b2sxjy1jnt~3PnzJ4rX#&`TjY~kAQSs~={ z0XI5ft8GY#Usy=%kiRSqqXONP02P*oV2NfIf@J}UFVM;6V!Om13RwZdE_Y}wNJ+Up zaIxb1*5^sE%m?%4VpcVs_zqwb+zlUV1bYTaMrDh8uj$^SE{oW}Dt;J&3 zKKn<>&e?SZ?@0!3gwr}rV;O(n(EO-&%BH#YLLkKEMXAPe(d^eNZ1B+eGf*dCoz@_RjeAI>0yKube{mPPFE@@yStkZU3P2JQC&@YKNi^{1$=Z1MZ?0W#P0qk1_ zfF3?CGp&L|Y$G<&o{-qjEqYKLNlL1L+AkaweFTBk|H*|}fx7*?Nt^XM?~nQ`xv{imV=_zzY;A__HDus9}IXb7oZ9vmir^V*mfXvb9}^S9B5_Mw@*Lm+efEhT{ty>u z0!Yn?dz@r0Si9~Z%fv^p%wtZ!5~08MYn^k5LGyEE~>&F!gyytoK z*U}t`7EA()P7`n<&WsNmE=$)$#yU{u`^`=+K_P5koMysfL^tH)GE@uxGW`E79AMGL zPGV(4BLA|5Uzs82@D3I7ZNJah`$7!R7i*}V@;M?En=?vECD-msk9^ zA!GzKHB!ysr2OFYbBR%^q1>evemEWQzu)cu{gsGiROupKS@w4`kzVQu)@sF6j#XNo zSa(=T(E$h)#S&g7ufE}fR|;t8UF}st0>$9Dp!LO-FgycCP?UDH`21?`!{0eGEMQ|RTpc8EgU&1|^5&^T3k`Ov8S z(oACsNQZ^ik3t*?<|#5edp;oJeZ;@Dx^$8XIapT*fBKz|NQe~oOdX`;q5H!f))`Az z1f()UvBay}{Enk~TC?m-5Dr~1T0^6rn}*-kkmh^fWg1E*P|6WFTn=vJZ7g&P;)5N2YstT6I+wy>pwLQU(#pfq-7_3pzLsM3bKy6!cO~SaIJnV>4xS zXQj0ptTl#y$d*6WfK=UBKYRCHXPPl*pr@8V3vSA^4Md9qRbK;3^7LWQjDP6wIUU)K zok#p|R_{yQlpI97OXMp;AVO4FXla`2ua&9>O9)vP%=aNx%e%B7r4ilz^H@#$7Y;%H z$FDDB4)ceOj_dkX8y;U$IPk()FMT)b6iCha-7GFIFW1Qhb(UhV%ekc2Qg+7BiMT$0 zZ*hoU+sHy&L*oUC_ChOvRm87EXga)bwr@wWMeUL+dxfmsIs@{G4y#>?-y}I!L(eB5 z;0-KQCGff+H3pG^ceHZgtknE+c>W?baq`2|{bl8|XSY5QGTN$k6-9IZ`Q?a6t8`R+ zMn+-Il!eUD=+(%~vRTJ7p^gc}+Ya*=L-!5~;@D%QG4YnoPI>j!nHHm?-|y@k?PQ>~ z3KY_QOr4C0Rp3e{(=PAc?b1wV@8`;8uDE;afpD{g&&~Lyk^FEo%&8y8LOfI<1!}+p zpuQ=`(egrwlvv#Il>G8h15n|LM}r3r7nRhHoO+U&e*N3io0gW|F!d4f9 z!in-sN1wL7U(Iu73!&`=AOPi!{oVAPmox2?x=8 zrVUw8*qHOe%z5!qFECP3E)NiTzCE*_avo{g1r0!FhPxDm$U4L52ZL9|z+uuv|AOvB za8gT1^eR$JeesE$n(6B)kY2GJYx2$9tT;c5mI}Qax`s&H$JluGhv)q}_&OaeEv@ae zf;**KZbID@La~wR<3Lq6zj^baqSsDGj>KQM*6EX-z5113%5ptl>t3t)^K|yre?%zw zFBTZSg-z9o7`av8O1c=4TKJez0O3S`&#|zy?A9l`X)z6vV48&KNl#VzB?qQyNf2!5 zN`rtfYc!+vZB$fLQzpzh0?IJ2aeIzqGE7xK^tSd5S@e8+06? zQ}$;@dirUg#?H2t-MGLbIsoD>WMa0gO8jfa8>2Q`F<4@>EF!r1Ox*NPARd!Lb`#cw)wS9S=-q>gHPkG$`Eefu1+Q^MD zThyvrGNal;$KlhS>ufgaoY&1>1V`}F<;%Mp^_}&ZCbcwQE(;MlI>O2ahXTR>-r&Y8 zl8FA(14LCEE+JubC?$W$(%QPBZ-yj0J7juczXI1D!~#I7&H{?yKz3H+R_J_JxG-8~ zLU^O)&2%H0(XOb6H8L$Ktts|oL@X5|{Wwtd200;r?N7ua)P3Fo1L+NE$$;*uZT((nm8q%-r{ zQ}iPpufxk~Q1gI;lfS2_YTCuRtEfA1*LdKbOTYH?zir9d&K#F03w6c20Q@rXqgR)# zWCt6moq+yIK$9>6tW%vNPbn7i=$mkAWOl+xQ*yI~zwE5`F$oDKtqw#}jFd|#AA-IM z)8`H9B_NGv0=kteqEPNp$>0{7=Xk?Cjs&Y48glagQT1yDrwxqyu?fkZttQzhQ-9r8 zag6KmDOSx7%XX?8W}gm8Sh)#PrjLfp?E9XPpp;o#lOkC#S&u8K;S}KlC{N(ICLzDKw(zV;@k7x`X%k zBtO$BB+S`4$`*tk%Mg{6m3i<$0YGON)vyC$Nk3rRNeQUJGr?)DtNT)*?BV3f4= z`Hr45`&ct?Y{bBAFd3@jpP0d+4|X`VV}`4R(2KgHVouD+EX;cdt8AE)mnU1-)me`K_R5pElO+ zGn^l4+39$ zPAae9_w`+@L)eY9^SUY1+D&C|?-TuydzWq=B!lT_O}&Hv6qIl9{g2i13dq1WC81A` zSh=TXnKmbtzT)Y@4ZQj1cK1J-lfuqD$eN^EhJQQOUy+|y`C-cM0XaG{$uyif?YDDQ zz;8Wv4EHs`exeC=>FN=|b>5cUe5~)v)6z!Dg=H}v8u}fddbJE{Z(y`S&3$FM6Zzts z>siphKR~ROQRByA7pK<9Z0`yVJfD`p8jbp@Is9)&UbKn&{1yvE%Lch;`Z+N%IhC1e z+W)>5;i!EvsoA)_x*Kz$ppo#VK zU{>L&hBJjKg``r)^w&2O{m7>#tri?4(_b@E6D%Ry*sseMFJ?7#A8k;!dJ;EMp_yH7 zG^S3JjyY!E?+eRZ=apwcZ5Hgo-N_!5T%w(4U_LN8V6%Xv% zV~<`}<8=nPkHM0}(bxS!;+50Q=}Bj)P<(i4c{&kHL zH^&v;xla}{a1b20G3fsiP$!i$Eu=wlyieL0X&TE}H?cjxd%FvQNy)A^Ml4$|>BYvU z?eDvwtsO7EhI94%`uxoc(N`fUeI&ItZVwdHvE{1BnzS-G-hv^e|k zKe9;xvDeO=w7vtx4tCgHqtVRwnYH;yp%V(!Z_`DWkJbdaIbaDnOQ(dO)960k)7a(qO_ zOB2nyU$j^DSzoVk^}e0HuC`Ra(`W0v0M{~!uI+PeJs9;V)Pb#)J( zDh#T%#OMF60Zro+6sJnt?%HsOOBP?z4_IFV$+zu!sCjUHm!Im)z{{|#DV+PUiinQ~ ztE#JaA!Rj~eWHX$qpj^hZ_XbIf4vJihYwwNMUQB}dvUlSv)L}P)W9eWlVYDo_i33C z5uJ-txYfSEA=|mHKs<3Y_cLk88eU)9rKr;BLp#rEVYp#Y_Ba+GV~NC%JP=a|j|62|D@g;^N}j z!~8#E9qhv$N{SR|&KXDAxA6`x{lZp%g{l8%!v<(-czT$6W%%-IsshujCLdrL>hq>!beSxKCLcm*Yza} z@VQ+8Hr2_B2*9&t{&a9(67RKkHCy@j9WeFJ3KeD?Cbou>l=H@`= zYXQhxXc5}EVBm}7O@$J_Cpda&8~wNrW&Gza*vkqpSgsZd@(PP%US#`K^HliL5?oHN zuTy-(XDe8Ai*Kwgtda)H(BeFtkO@6~C8nHA5H&-Pa_%0)$`ex;ZndQGKiI*_1QV$3 z**K|QF-aGQ=v%^!kZQP%(b3Te8i>QNQekD+MXyjdhzpll&2;5B_pGnE`hXbag%|SP zv!QoqYk1gUxnv8bHf`DY1-XvChG{o1L0>CG)ER1gc7RV~zV|P^j^r}e`%^#leGAnX z5Q_?2)ws5X{*X+m_1*F-s6WX&>TzWHCeqV`%5Q5pZ7_;A=dcQk{KpPxUBfX84?K+`ELM?hzjA_L=-Wuc zJTfX?Qvfkz$X+V1o$RG|&j1`Owf|^$VjBuu0Ck$%QVqA}8{1AX`vx&nc9uTjyLeAw zVJba8U)KHki+Ms&t-{!Dz!-@^J$dIBkoiniGB+QjZ_OVCC)8O-JJOm-tTX(AjBynO z0?=^Nw3`I``%xrH#8Mc~5&~5SFr8Ke8ma??q67&pDzHPFZtF86IH!O6%>U&pqD`o% zYujgWhqPqZz`+d$!9;er%5n$z9CN6^VJ1 zrF;UzluTE!ewkGKY@+wcqXfLX`!p%Gv9Y1S$$j*hEKKJKQ5ht*2L)_!Z~&|~5-MfdyAqY|6spmm<)qTMdNoKEPWo|%j9dO-_N5Z21{YC- zgsNH+Z4GG$+duXMRp|<(K{I{-M&(W)W)LFQLgte zYmdRR>T`(sVcAcWOK0sr)5=jcI$L8WxfTm#J4pqkyb1DDWeGCE;Tu$| z9vq!ZOxSBGWOy)}oQD*c0-pR!6X||{t3u|(Jyt{vE<_U(O(y*c)w$W*T`m@4ZM)tTQYec6_v zRWSJiw4%#*C=FIvxoYnkgn$TIc1_243rn(L063~%nZXoBOaLU6_(ZQCxd8*>kEf;9Caq< zlbAM9kb=A^HyVamRrW2n6PEPJMTX?lvj#cGoXTDbHB0kXA+b=V>B1eo-xY+v`^eM& z;GrmXX{F}7`SRY|LaVObzz$J-%!bZ~k{ge)mJ$F9wAzab94H8+5E)ws@uTxPQXY&dy&)RHgK&=E&%esD^8XaQq5MS^InU*Tx~&n-#tYmS;PQQ=T1J?}`mqrFN@@PC#r&NMSuj-iYPcMH^~tYuAo`9P z-iggJgRE?=np$iayoN?$;kRvR(A3{k2PGF)@9AIy$bjYS!TT6o}M+ zl4mN)1%K^hVZg4Yro1DwoGlt{Hag~~zrRjO(niev->d?!NWiHXIT*_1e0(BSe#x9o z%9cw;66Ssjmqb++z_2dslDt6`o6?FGFWBAV24I>TqF>;S4B`VKq@d1jZ)Ooc8~9o}`T!8<)?lFySQe;k_+%#UC`{khI~+ zUCJ4M4tC&f>kHM!7668TWbUc;jF$VMerPQ?!a|sLZ&-6_>pu25ncG_sf3%P4zFPnE zg0Sq0|Fd17&f6@9Zb$^66}E!PV3Tu06|~O_2N}or%}u-I?t_h_fiE*3*i4uL(e%xP zm=TznM?cvw`FpOJLMD~_)nMbLjFQ{^BJ9rSwG>*=d(N(yI{$ET4{yW8!!bKrb@S1mHZ@V_biNXX>f=&v3z6fE;6sc@ThevhVTLS%sz5^RRC>Iwb@o9- zhNbNwhz-4}M-0NBAA7Ddz*GLc$pMN;XkoIm{fu?us@(#nj&{Tw^BdOAHqy@4b(;Cd z*HV*p<4uA(5&&nv9Wn&*1s!@rdwY98x0&(_ah3sHmolC z--SB#Qs&r{XJOY6{`$|5ErMBUw^G;pa{r#$eeIC?8`|UCzBod2{gYcSV zToS^OxqI?+_dZqK`o0B5WeI*4ag4FWpDHw@p(P`HAE6ebCfW6VOTu*|yI8J?j7cZdE|~Xba=@%@Hj23wgelW4A`jiriD=(Bx#=tqOLD zMj^5IZdI%K{qsz!tcOt*Xdt~l%Ey_uO@wz^x+wO6kxm@eKj{Q_O zWH~JkV6n_l>wSob!T~8WvY?=#mDR2Hg;rN1p5h2fOM<{=K*j?j@XM~bv|>d%Sq3EF zE;xmxozNrPL(41-okCNF9N86?DfT3PRaM&lof$;_u>_B%hp+5Ay4LyT^76vX?aA}u zF#6xULVM@ur#384a4w65!K7HdWgt13RD>L#C?MsFKv;v!<+X#lk(A50k+t3%gb?ws zJwu6D+lrr6MwSay!x^$ctrh?OSc8jT4Tx>urOT=K18~X7Vo2&dQVOAne#b|D47uC5 zkbtO278J;7;tbefTn-{~hIC|&L71W_+dLE*|EZ(Db$eR@+8r8)@(%$Zubpn8p@*KS zhXSJd7VALbsun;<nHLyR!{#<+dS~8qf1F{C&v$`#E@S)m>i-cuQ zrmDvI8Yr@cmc_T%)a;gDY_3e1l_AVmWX-miaGyqoqu6+Kvrd4}MKM&yp3%<#OGEM7 z`!FC)q_=`eGBdhJ+{#e%m1#R5-}I z(o+;}sj3RNKj{m4T8Y_xL0utFpFY)wUKrDuBova2F%}MtOs^Iovws^uqP^LaW}m~# zqCsSvWI9~amSO4>8os{X5-RE?m%m^14BJb6(OZFLAa|xg7pcY4w!=x$IYF80=GBuy zO~5#AWu0XWEqz94B|Sz2laML&DJe%llZpfC6I0u!E-U4n>F4?PW@ANc`U=RUFoM1* zC6+sb1MMIu%#K0#UtV)ndJX4=`gi5p0LzdT$T0}~jG@^s$T7ZGEP-&IKf`7hvKWR! z&Y~;~+rRNd20iBz3v!zpA%%R8vqk3ZAV-~V)$s6)$BoK=8@*BUuIz21+xfK=F8;~! z7O@pPKHAg&`edii9;nrS8#AvAlWm>?Z7gFDdb*_PBv^L4=rQ9Hstx|~LBYY1Ko@m) z*g2=%jm$NxdZSpPdg-TyOf~3a4(9wedabx=O;v_}@R0d?q+WV9Xq=ut~VpJByN*cCArEhc{W@VM1FSBM7k+Aj#d;Sq1xLzuEwgjDz8 zq*&(+#&m^HETU{bQsm(DEV!Q=-o;g=jAfv2f#x(6ZJO;x0>yj_`FFWk_gB76UvkEn zJ%6EDTxZ|sg;%<`E%UVMlhp<#!>Lf!>S#e_2-3OvZ95CGQXX@*vwT7`dv_^LN@7*^ zaM_+m&5pJ@pKr`WYEvMm@5UZ%P#MFMzJj6yMDXBZ%HU!u^u5^G*_U#&>No!p5ffvo zkU0GIm&;tuGX5s^gzlma`($HNmJs6gVq)BqFrg#F1JqEUP=_u@Ey8xGetX((d5Kh# zsGs|Gimob#AP?lzW;!m1f-g|K^QRPicvK&!Rf3Gb<-CZ<8}xG{Y$E8h#xu@oOii}s ztFkW5vKUD3U*~A6W7~G^uY{WDGGhcl+YosY%^xqqj^Gf>`YQZfr#d*M{N-|_HRJWz z1^ng045rGu@)#y10pXl{^GB}#ga41Vua1j4-TvQ2Pyt;OBoqZ)N=3pzP|^fNL`4N8 z20=xnMLNc@SV=`vQV~(uQ7Zp_S-EvvTYy1dA`d?01PwlcTwK zjPeLX;|hgl(f-7rWaz`yBij&^5@L$WiE`eq63eX%=fplb7C}vz|f?r$R{$-{q z*UkbdrtN^VtO;aE!N=1B;>$G>R5qS0EP`Y8CDzL3_n@qsg7(zrTX6{h;yLK22m6|h%*ZNO@ z)v*HcfIf*Cd>b!{JP~N^66OK;D9t>3t7X)dWi6AbaRV0^UWWOo6k~I(-z?Fu{&6yY z)HV7(A}*VDjC2us)F{;z&SK1ixzitbhxfK8P9E9$5uYI5ve|>9KqllV@Rnt!xABhE zIq2O)k9wJ&cnwb}uK9TR@WqRt^+LTj%`_P{Xja2}7+E*=e*DDNzi*75}oLm>b1N z3%YAAA+4zmz~SH=*ke~7ZPgS{i86ZX?R^U4@*v7O_iJ5?^_EIJb2=p&q!5FLTn;_CqxPGo1_v&GMU{`LjpLxnvYp_!fqz zi*`YEPHSi`L|to$gwRc1xaY%dMG%(f7_dqy?mS*+q|QTZWl^(zJAO}5A8syt0A(kQ z&zm$L&W&e-A8!(L9;mBBSQPGEdoMT5a`gEJUMhkDlzaM0>U6IKQ3YehdF|v|Hny3} zy(pV1J6(14Z3E||x7dL^`n@$w*D@;}D84HyGHda+T86d*TrIp|rmOjq(KpfG+*6*c zaIQY3+n#ox2q4ggFmGOkgbKU7t0U^kx68yA^1KT1HAvlFJ4@7ox~tLCz};cOBcVLDRTjc z2OQ7x9rY@cUQx$Aq7vrA5RAdTqVmrxoEU)A z*aEtQO~bjf94ntZY2#?_(r1%A6{uGD%1k@;iN|#m2Q1E8sXX&&`QL+zis@aG=bvmn z?$UC1h3oO^{AV3+28$9#l4Qo!QnvUhn#zNq=IN%_Sx4 z6eBTi?wRol$GFffm=yKY;gWbqybDEUG?${i2d+_8aJK-`Lro!r{A}xN@v9=y!b6hh zad2-Tm(-^XWM@Gl>)B*Z;?161-fsZXw7)s2(3hcLI80pW`4T?sI2bTGU&?DwQQhOJ zqs!4aTZ7FPma>B3O1?3weapp;T%+4izhAiQKM=94Y;!h~Z*Q2jX?JtUn;!cTP8;Ow zd-DFnA8>EjrTLGLZ{B>{g(UNEmKl~*p*>`4rLk?zBL6Yg5Ll1hrJo& z8gc}b_P7iaU+`&9q$Kj3z5LLRA#{7N-fqJW&9xal4lQQ8Pg8rd`!c;qK_ zF8wVby-R!xNJ6|Bhs|6hw>;yiu+ov8*|x&DSj?q%PsVwbrqj<|>|6%QO^aDv@orj? zs4Ik>&Ej%ZPm0#giF~qOK619Q)m!S|+JfFP8x+;g+poYj`<|1u?`QH0D>9kxKOa~Y zw#|;%5K$C{$`WzfBouvU+knoNKkT;j`6oJVcd%RCma}G>uY3QnVq%UXq$-tMy}bSf z)5+pBq-c;^$gY0T_3LuZm3mCyTZ7k#}!G6 zLpUbm4)#~Kl5r9>XVEB9|$s;-oU1Z~ERq z{+f=f)+Qgcdr@G1cxBH-+`vZZsH0@ocYULCQv**d*{OLqbhNd00h#?`S_WREl{9vR zzq5)_YSW7H&^AcB&>1;@Y8!~Mj7~iq38gi}#pg9pv=$Z?*vuX35_FS6?sSK!s9cB6 zAeVxxGt%GF?t1RV1HL5gY()qjJ!p@iLC5$jYWdl+Rx5q@}2Oj z>87Plg}JMUP~a%U$z%}JjWcxNIf4I`3CM;E0D*1jCfx; zy+65F$ojtf|NaM17&}5fVkt`*g%sV*5Ro>zQXkG4p-=%RSJ)DOph8fdWw< z^V3xR-SNwP{JitZwJ3!C0ft6$u4DIjk3lUa?sEFBgo1^^-CPnf1Ju44pXEbF(|YpL z=51ck=11C2G+{z~aVgh6yZ?-a>9>N;ZxOS2-Ug(w2Z~u)05_t#p8=C-)iSgDM};bk zJdlZpR)xQb(c@#7b)gX2e4u&RD^`0^AGIY3I0?#ETp|{}#TY;-Df^%N$-#UW*Q)OA=F^P(T?AZf-UYId^f$i>p14j8{-IcxdaY(VagY|)Tr zK)F@Gq1K=C2M^jMBy6_vQp*3l_cOoB=Dz3UTi*OqzU8=nq`muj-cJOp9SoZv25@Y8 z=qG=K_v-=GDuH~GSsz7M#^-$F{(0f~;dEOvf#8I%_@yHPZCCJzX52j{ZdJ+cJn=feLUW|`tR;a&v!pHgnc$XRjsBn(WgxX4!P3} z@T3c8wrn118ugBM8`TQAXm?`2l<1>?qG(n!yZ_cdtR^Cnl6%PoSg8@b@7`u^H* zo=GFoX~Li~YVG9mjb{1z+}Iy?Wb z)F%yH-E9>L6lYn&aB5{k!)9oPc}V3CsGdWi6mDSmE47KXe9Qs{+U|FVW_IZ9s*^6U z+ZNk&z8mMJ1DdQ&f@Mf?(r;STV{YxBTMFiX-(BKk+abFtlOkvRW^apBCQv=%baVR3 z7Z;Z=E(|+w-aP(Ap;sbfw1vxUYR`c!Ky6pR4H+1dMJZMjKLffw_UF9S} zEO$5sX<8@9w)okXN!A_fcvX0t&9LJ{;WtY_upSj!^JTrj;;xF~OUkghXkOb3F<+C0 zOk~H}muq?uTL`iH*>yk=5r*n_gnwDMoQ#Gr@`;#7B4gbdsBJUd5zV$S0%$k(^WU+P z)Q>Mdio?eiAFT=cQ#OMe-vD!L|9Xq{1$tY2t8S>>;I}tcKsZ8Jw9NoEuWV}K-dWiO zu!t8>daoDT20Xl;&VqN)yflPE>>TLhX4WrSi*VUsVj4$162fOX553*>>f`$c{H~&3 zmKW2XzWDdkn<#{6gd;8JE)Xs*c?N_FsWS(A{4|DMQ6cj}cW||GAqGROs%~=C@lH}j z8To2T>Mh1@W-;Fl4i=Atb%A%U4%d)Evx-2+UR-fZ=Iz+_s zt>Nd&q#Ninv9q(w(73dae!W@mhVY3yxYvxsz=Tu@itz2_bj9*OvJeC#)pb@MKs8-s zaiNGk*r}s@`EIIsqv`-}YKW1@qZ_bpn3^|T$cv1LF|uDH)%betx4Jr?(mWxmczz|P zGDV!yBaYsTs1jT4VdmKV8;f)Ms%*l5yMM8LyKA-~{kJe2*QPP8Ij+1LqyXYjZN#j| zW?ARq`G{hCh4GfW^E-d0;}?58iV|xs4qf`%TXe0fd_vQM*KP=^r*lPx)z`H(u<@O} z48IPnole?9M=#`krvg)qPq$TQo6FBAH#K1X^l(pdA|>k(A+`gN8i=RB0WtMA-r*m+KWffqCqTR6E7n0_KlKY#J!1?8*3VvThd-N+i-;#az} zJ-zaVMGiD=BCgZzK&11)!@1OOwB|esPz5R7t^mtg&@c1 zoPgRW4L=}@NRJj%eFM1kFn;|7F)_kb_-fx)mc;l<*k)ffaD5Igl3O9P>f6&-VON3o zrI8buUyiN2iSSbpLPrI26*eNKf|-f(3o7pRQsnVu#30950cpg-$V3$I=0F(9Z}?zS zJwD#tEN&-j9L8i=o;HCQ25?UH+qF< zvr#I<*mg@;1-xgJwjtM1T_pCH-=K$QSeJQc7WYB)CRk*w-KvM{!@13#L%<5>*&cT% zeoOdmdaJ*pz=1HcyGFs#qugeTMiw;(kT(37((;K_-wr=A{!aWv;k| zyN>tdY2-gWj?uD-QEJQ_ZMm>}2rUsy_Pp^{CLW!PY{=iOj;&HZV-tC#F0cA?zFmAc zk|^zItPJ}GQcrfoG&2wJI{g2d3B*hT=s*c(%rYn4m`=!JV?*15C!<&(M>h~`S(!G9ki8F+L_@|zlhNm^Fsz#p&H|*k5|4R!Q;fpE0 z=I0qKki#Rursr?{sVjq?RhlxJ@QIZaZ;>lgYmvJTvV%>jgJ*ntUqx5m+VQhKoF{C` zAKrWyl0m*f@y*&PlFM{SJl5Te5bj;nSZzR#ns$ zFeS7tVB6iXfzUEA{+z{SM^%~I0ON-T-L7vsnzOCDd?<51fQS(ql7cP$Gl{_Qask@h zg`j2t&eVAp{)W_Xmv~FZl9^CihA%mP@R#r0xxXC;iTem$tDm=G$861Hud~EuyLg|cYC)V2u!qIME?#E* z!#al#t7H(E59x3F8ESzQz@1PgoYh8@7&McA&9G?W0k}|Qbv2uCsO1qbujQ}n0WPA` z%a+BwtjHHv#EJJ=B}ed3Nq8H?%4~$X;JNL;&EogHx%k6FR{L}U{^4LuDD}lR(LWnJ zBeK=;Phtsz{9n&n-z!izyP*k_{0E2`SpS4#hbkN8(_|KGkZ&P>n}#I6Ei1y2AZw%z+gi z$+KHv=KPCnlD-$+AJds=YxE3WeiqPc@Z){|FQ(1U`;GuQ+FCS@YCDU>2SxoZkJ(~O ztG9u}#X>)6>sp4w`j!340OTuefDE|0-L*x{m>xw#IjIkSEV0X;n41{LWb9#G$BzTxA3pFO-%)XZQF%hcvF@Y$@+%~pPY#B@ZyqozEKv`! zzP23HmSgGvG^jh|em+S)g@2~Gap{=gtIbF#-I=yutgLWlzepANqRAXh_Qfxfz%Yd0 z%oWdZlJTIs$gbY`rGayk;bKPjKfTa@7VOy^WZFj4lb5V}^zR}^+%CJ`GUSLGyiZde z^^a5ahZ#7fuIP)c$`iW;#AxIdPoKritjg_rli_sBNC9hQywa-#>Teo3bw$f&!;Cw| z<^m#m${qi2HrsC4Y&%igOqPnWLZPtNVsG_98O!@9?PIjOqW^X`V0<~@?$a&)gkdT7 zWIL`u6t0@=g15L8(^QqV(x+(}Bt#-3LxwhsPlTgq)tr4l*xXPa=6dN%aHFpX+lp>& zV`iAN#=7Fc#eu*u3LvGgQPU7`?poo~tpGV{&|Yzm7Z+*JPjuXkqh6z}<(^h_+xU|E|feEYUFZ02{%Ofh|rsE2yl+og6wH8#;j?g8p zotm2Z$nPV|3V8X-s;Y@og&UL*OAr}+-oBjNT*HB?XeiD3r=K=#zFn<)PFGhh(g-|i z5Ni{Vh4KYb7SGwl#i3Z2sYt*C8W=X^XJ66YveJ{{xgKI*QISnbDPDsTX+N3UQtIw zgA=5y&MA)tZh2`BggvY28Vw~23yT1qv%c7$Z&O{E^@Hd$MqCax&X5jBJrh9Fa_^*l zxQqN0=YuZC7oJhZ1nM~sNQT*+T4(=RG!tRP7&fLEyN$?PNWp?k`{VhcB8G zZxzR+$19Ytm$O^Y8qYDFT;X(pONI{n+2DX}tw}W7>E%X8|G+?r?`XVMs?ccOWci0( z#DzMnHv+03QCO(-DQcsT+Q4(W@3BkOR+r5Ebs)qM1w~(=v~<0EdS+02WU)xJE*8fh zVo~N**SykqB7IZHn4~fi>h9~9EjJ~$*6PoWwpe{wFLl*S9!f_=X~xwl^q8YIjexw? zu`ZK5r#w~H(z5MMT#_iNKz49wi21q3Vx=LDjyt1`ttCHE;6>Plb8JTC3knZye!2IT z8qW_8v!#sczXVy_CnmqEzF6zlx^MBq*rm6<8kI+KxE$lW$q zR1f-%doXQhcR>I+dJ*ACEwvgXuW~Qm0o!j-)F4_AIM$e3N7&&+!18xpxYBD`HSEflsgmihIfFE)_1e5Vo&mw&LWAgLzh&z-j zsT<@WE7+^HoxNC!5DMG57^z1AqtSV~`Dm*>7S-1?-itL(Z<%N>eS zbVBcHa2qPFVdy%~M@p^*J(GwqZJ0&bh5o1~tfq+Q8Cw7GE=15ySt=&NrdI3tJ!qkU z-^`ZBN$p_8Rn`djP?u!z)Ef3-1D!{A(qjJ-W5{klQHbh(7$iS$V^#F!c=p~Ey{3A~ zVa};c1o}?8bYfi&fhuB1zUvS^ar6Glwhm=CL(dOhiRPw^Q!_KynaPO8mN6bn0@**L zI|Q;eJ1^PT*>U<1cz5e$Nt~ya{Y`mCW9p>#@1Kg8c-;kV?QwXh`@iOV$^SDQOuoP1 z<}eV>1-)pt?GlRZ(dG@_`ZiR?-))9mY~|Yol}h@3j^YtQjVcfqzIH)!e0N`HYPJ(ty#@W(+w3adsJ98 zcc`6QHrU<@CBNNFrP}ujSHp(C&78kKDD6K;G}0Y4l9o9m zG8EE|uTl|n7kBMQ9q(aBc{RDF2+0HOhSLZ*y&mqx5AI#C9Vx~4HBIv#eSxK`yYCne zo|)iD#UkAYEgpN2p8Pdm&+;9^9;o5!gg{ll2>O;D*Nj8I&Gacy9FSO`JI!;=RA1Q_vh#X>7IUfl zsZu0y?&)jjxABttQK>n8Q{w*7qFzrjc56i*LkB+)--y`qK{&qdbZ9i9I}zk=3ue+2 z*PpBbH`72}+lI%}yQo1HSGiWU8MN=r^gj6N>|VjN>nBXIh{TJNWckSk@sHthPAq~` zAs0`VYDB7(EHE(=n6BN+C)X+D$X3bM2S6QPdsfr5AxE@IC)RwvL%+<=>k0;BZ%wBG zW21DN0|XSF%!G%B>k!B#DF;6&J` zQpVR;_@ZH`5$P-t=vuTnrZ5vbU-!g!EWTi5#*{Z1C_62-%?p*OzA&RUD){CbK?4~s|uHLMp^rPHV6D2Nf(Y}klVko&`ar;Yn()r|D zYMZA8OIrLE@G5$xPY5$iX{DyCi>~egvksdi$vDEuKC6*!3LdK3nOAFKDxPiA*qtlU zdT4fbwF%FIWTwP>2hJ}WOK=^>q(dH9CbrV01FP*4zn&x`C-328vHYnQhd*PjcVxGf zqDZnDnWGJDAB77DEaNeKs0|uCr)KKV+Ie$%nzQ|hUH5p&Hz;rI`!O=B{dO+zVb7Pi zjQom^9)$2R)q{ywtX8&sgRAG{dLn=(1z)eY>F(E#Pf=;B!S1Rh%>+Y5rKP)MoT5h@ z)vQY48x&T1R5QfmZ9$wW)@sqRMvJ#P-oWRQki9=M+QOaLk|C5~+ESZYx`;c0gzXzO z9n}5+1;gT@S7j9|oDU9DH?A8`R@cSCg#0cetq}3NSyJ*#hr`LFYZflrw$3%8Qpavi z#w(EQlM^g0d)U#e#^R=Zd4^gYUqzNqC;bZywHduniIP%cn`@?n7W-K%RBG||QJf#& zJkzh#k~RGx&bo~r{h%@+jVLzI_9|YR>9`(MY64O?LGdJ4f^KECQ)E{8Np{IfsO0Xk zrTqd&Lz3O46xr=d+{QTaPTF3eEN!_^?ROv7SgUP4bi@2It9q>3mld8M=e2%1zSw=& z!~9BG)5(v1es3o?pPOA-MhH{@+Gd= zu|qfbA1u8&X5%LNEITB~4=j;VE7vS8rt{t>=!%EG`#J)CT)oO<|QzNxAjb=Z~ub8fEAIUrP3;rS$!2 z^_`h6cy}AS^roUd`HlgGQlwz+LB%hGZ^mD2hIl+gwKI=DGpP|(*gA7?-SPo0%?i0Y zMY?Xc;9SV%md7+r(gG7A-T^o_ZVQLc+ArV^Xi;;;XLh8C6S4ON#bHE99YMod6>T;; zrlqBo&<5K5U5Lo<#KgOZjdD&i!>?bz{xrRj)(wR-;pD0mKx?3Fjyn^dM!1V=XB4@| zCU}bzeJVC-5W`F;JIx6t6)AH*tymoRAojhR9k56@4GM{GQ63sjwT32VUNqgRFDGNwQX>_PlWSC$sBnWs}LzK zNFaQRk!Rm$RKB|w#5u)4o4>6kR%%U-IHH$^_Wu*;>hDKHFACT0W8mU- zZ>#a-zH({N0#X^)+wZ=`v{|OnBl7t+zfgRme_MqwC7S*Yn&f41;?zPNTIE{XT!;mG zlWy)rPBYhE6I{=SxExNhhIu2BS|XTTT8a;md7_H|5>}$*JfmN)Z1S~ln$mt}eAe^*2#V)@6;fcA!q`L!o>ekt;rbq#&vRJd99RTh5=y zRk(~=yYcwx1QsF^_s&DwZSG+*c17xHa$p20s^tLK+Lu@FpvO7U8v!Jy@NDPwa?&wUe;({|xDc6Rchm_vr7wnT6inl1A*?(mh9%}}7M3GY@w=Mks zP0J@zlwgt#{#AV?nKyd?`cU1p^r83|q2;pG<}MbgSc1L9-cJZh5@z#_K2l4cX)rRf zL4c}yEZ}dAcwz)}12j}fWby%xvDQk>?KD+t0EVYTp|S*QcKTPV+IwShd( z^+XpeBC*m@t){RoKR^G8FERS#9bk@7ZAFkc1{F)-k*3*KhqP`2Z5fwbnPryW4`<47 z16R5L+PG}z$+oxJuF~BT6_6=yA7WxpJaFQ9*kTnLPG)6lX+cUAP9mC03sdX}H1@sU z9Wc7+{Ou`GHC*-}NP!suNg^50lm$nxmk`4p2j9fSrA*jmx{o%di$J+Cg+ztyqw*bX zbO3dT>_wgIKX0bxOVM9m&HIf0g{Q=AExyygE+qwiuW$<^cH44J7UX7SL0Y{B?oKqN z)m&#V!TXG^pCr2yyLgL-P?UurNs~(f?f7?Vcs;$irLL>n*ilCH9)e0cXH57Zo13A~ zB&&ougC3Iw6eCXnSRGhoNCh&3JK>(6j%8Nndx!P2Sw;K^1Q_bQDHvkrA=&T~u%&QM zn2>HzRYm*Mq?F*}45W^L`^0F^B73X$I=qS^>SsKLuvkm{#00-iX}u0Ne8s~!r}n!a z=bS`kKUxvPg7^I@k<4&vZ%NxxmS(_myQc~-jzZB($nY;_+ek@?Ju-gEO;eKwXNiFF z3XgN@Zt_te+XsB?f%5-}{rmTSgbkMR(&fQHCMitJeOHJJJ`gV?1H@505InV>LK&_Y z)HA1%PC-CFG!q>PbKY|mFDz84h;JL(uxcS@x)Jcsx|peb!e*?e{YNEJ01;6Xqj)Mo zXKq!6-=_v@ZJb}YU2g1?R>&jRqAm=1Yer)`kb{O_1o^dN2y*-}z@RX*cHz?t3S5a{ ze*1n^b;K3gl=1llVP>@np>aEjdh;Ug6hL`YzjJPeH{p^BrWIJ+%_*b z>W?8h=tOYliGsqL3OUgC=T{@csTJijyZa}j6B5LzBK{!M$O)TJ>n`pH9ZtT?d%zNO z;ETUuE&8U`FdK^qh!1P`1^tAn+PFhtcCzi}fDW6;c13-IwJ$%q8mlRwN$bM7>YBA! z`2Z#b82v?nCZFTi_2>^q7*#0!E1r&UUH z&Vb!l)_4(jDq*CGWWCcEg;-)ZjRA+_#pAieq<{+n8Ap7vN9HZ_&w!>>*27&wdqekL zD^2n;=7W|DDiYc(+~3f#A1q7|qx7w3_()bRj`%>bt3eVrP+A8?#Y$M3BAE7&h*k*0 z(wAXf_*^;z9i6pXb72IR@aXfAd%# z?b3Jgqi)-ekg(_MTJ!bScc}8CKfankBfxR(sE_MZl>KmWaSEY}Lrh0Al#g_-2FNT= z3XMXoPP}w$bL|m9mH5uNbo29;@PulcI``{?%aWEfD7`D6q+5iC(-0+Lm_|PyI-roR zq|DdinFYXRgxQn2nOSZ9s0;}-NYzh|1%}H~4f=pa*NG5LSrQSgKfr)oIP*hH;=zIGtgf_G! zwBo@vrR^hVYq23rH9IV!rQw4KGfPfBX{O1LOq@S=?%b0Wal0-rsq2iSn}&JhY#xRI(O1qqcbz8;`=ui=2`YB+o}s98L%C74%T|Ex?kRuwLJU z1;>U$x)UKNz)^QgO7PWRn)&2L10-kc7a1Gt)h0aLW4F+-$LOXCO+{kqP(?^Z10pS6 z9{?V%1%Hb$a>T@)gbPY2$o(R%IYh||L4BW*pYN{Eu`vP1J8_d#=lO}<<0vMvys`J1 z*|)9@!&#e$2sL(hTc#+X6f!B)*{&J!&r)5j&&GPW!k{SJYwe9j5x1y>epUxi44qR`9a4E6>j#qTQw=z_F6`Az!ClZ$SAW`)6y#l9PbJFm zSxQqY6E(ClLdI^=?JUs)u0`$cZL@7vN6o5hGsRlCXOZiQ2p(jdjlvy-pv=MgQ$e2` z{!u`H2G4o>g@Kr2H=w^7Q2d$`AGce;f*H@Qa1qP36XX7}Ty|JIFa9>IfS4kL!PsH8 zRa+in1Afo#s19}wos9#Gg#$$&B~5BShS{|q)c1YQ_9z0T0Xn9oHTe2ue#9UMK+v+4u=?UC=p$$1# z6s*ID@L{`< z{HV3H6Uo=a5Xiv)HndC+39$5 z+5iK^>U@H0L*b)0sy-PF9HL0H@DILT295q`cdy-=4BK1jbaaO%tFqeW0thbFD&{wC z>=0re)&_P@t<;xoiLl8b6mt!%R$lB8_KSb5%$Evp9oJ9Die72_B<>?C9ODMMct-0C z#4Rv-IPc1-cMjZGow@^vA0SUR^#1dqD`3?~b*p_2>FN=nbnEWXDg&xIsu zh_NQp@OFVZb z`W#em-QvpAr%6xm?V-3Z-`LU;HsbH^8h=pi(`rFQ{UglC?ZnZ^DHRY7&PTMVRF$nP z7_g7o=5xi1N@{hZuOj?kAsiGBc#gY15bmF^sjV#nltM@t3DGW`LnvZ`^FZ=FuTu|Q z#up$wOjvdQh?b+=^fz_>mQSugR4fD&suYDYP_yZ8`ncGd_zh)2IC-XHY5*HSOJcYj z`F)k~1J5Ze0-m2H+QBh^Sx-Sf2~mWr!MRAV zT}6ze{|inbr7cnL?_dfdi!g<=e}E|v9Du)y$9`tP?>@2IS)}=>sOQ|lONeP-xAxeK z+ht%PCEMX!>%r^tCtu*aUAsnlx-hM_P?y<-*icGP0SEmeUDTqIFLG@;_}jm^O8=9$QgRb&AztSUSMv7pvU!M=YaKih0=1>m=<9gM=E8=w^U;B8zBAPBk& zIZS7J7G%J?2o~pKlx?P#YtKvk>Byx0$^P3p#J6kn1}+vl zxM7Wt+F@nLJt(r^`4U%?Wj}(*gGHwv!OE!@yb-J#jbpr; zCan#SSCh!08`7JzGXGh)Hk`H0%a_=5b|pDvK{&b|wz=l8LrY<=U6Pp!EQ!fp@z(Q4 z4&>xRp^elQkL|qG7|t14cA2J#ifL#`(sXP87r{9hAxbXN;i-`z@vy$x&|94$b)!7d z-qU6!E8P7w0EoR*aw2xQ6r*=fks^RDTknB7YN1MN?)Afb24b=PuZWDo#)K5>C666% zt@gIe7ONYc_X@3qE`B>Z1Hu+^P;mk$DOMHtEW>`Rc&8{D)xO4E(zzlFNL zd0T<`Nx9|NZO@MJ9?c*BQtoyu{uy@wO-16r`Plz&oe^;nbcR<3C<5QE(pbHnx4}-7_8s=af%%2e zPyPF-ePWKY$Q40-6+gvDuFY&|NxZP!*Zck_|I-h@Up1c?r?w7zPdBkdbc@^A-y(!% zyRImwjPEgh>7M1?ur}}4$E?KZDck(>5+5rcj@T*T--U0#$^K_40-DdM|1t--W5@yV zLeHUZNko0!uCG;D0;QjKt%)DfuCGd)I-BcWaNK((xx9t``9puWqS!7&d63a%e)((9ZkX${iSULdtN8t+1ynYciOyE`p4JoVAH7^j z)j~E+McZeL&g07m?}o~T7M?a;!gzg3-_kRm#Rm*5$SC8d>0o8&~35VJ{ zwp4=1@}&H52mWZ36c5Ae-@U)o`q6*S2zU(nOY%f?acjc1Y->myJ$fdwn;eP>dcMuZ}Z8-FBI|XwRz@>VJrK}mI81a+4jiy zz~aiqWo@({Q!xK6Le{42&g4PT$H~r#qm1NN7iw8vtN+jQ`-h?Mz5tWW?_af~kE1dxgW(k-z;8gNKI5~-TrwzVyK zdGaYD1z8D37^V?LSp%;^UO<0R^OAJ`;GjFS28+P>ofZ6z9~dMeuORV|f$Y!{V*uTz z)uHbm#GvxWT{KKFISJ*DU?X0Py~-;FGKkMIJ1p~tKfW(_HV30U%i zX*txlezwLpqzV^IhT%7T<`liW36SICu_)3mMAVH;!23XRWRJ>>#tpy4Zp4EJ_c2Ww zW**!Yd3!+XsjJlq?_~%7HR#--`aAuR1z+?V&U=O;4d~XV$uX&-nVo~BImpsJVcpgF zFIvn$ik;NGwayJz_lM^og$WD%)y*K>xyd=aROq?#(9@WxdqDsU+{6PbhQ(Qc*x3bo`?$OJ@mwy~#nvV>BWQ}_AKKqHJ>bA$>>KBd{NphtEfHsuWM6Orw7 zDK740K=}-oJ_=sGr>{^7aP~CBN%uF#aoaa4vyKS*bVIGNb!02(u{jF(*zq7cZ4Ixp z#Cl%vZDcq}2D`VeoS_5{=NE{=nzF&XAv8wMX=ntBJ0d6)3@eA`LbE~<7He;P{Q+;N z?e$O@O6h5x6?)jEMZWF5;29p`w)oU1{!vV*e$es zI)U#h(y!t9KHQi27hB>s8QXQ#y8b4u$VFL0#0AksY+~#oH=iY;@w35)jN;YD$o7s^ zS2#buc!S=o$GvYqG`}AxPAnkRefeFxh(=|vvtA!Kd`IylBgjV{2hQ<=GC8D?S}iPO zN8l@?cc?XAj4P&F{y=tws&{wu(!VOV2CBA3sJ4p3VY+j){RB4$2IBLT;JTOpYGmk7 z1bTb*C_Rd|kf70(t=2*V+O7_m;VY?w&yb^x=w zC(e&aK&kcuf!$Z=(6f4a@=1@ZkvZkMj`0o;m}}SL~ok!E~4(y$mgKP*{LXLCdC4laTo5i5j=gq~04XMrg6%>h#hI_=9S zZ;Hh{`cdYg)*b!w1uqVihoO&uk?HTgn??6CU6fiR*cHOyzksU0uQkfGE4W{GAn~MdWBDP{pYrvQcG zFyVT5q5$(_Gx|U86I)SO=?S{Wlp=BN>>>+nM3+JJ2zM6r+y{J)hr4?Vg-I6Fa*Zk7 zENn!p_qpe9A~Av_l+;nyGv3vM@=gfPxOe_-|dAT=M?-7}oD+2#_b_&&{sSyehPS z`?k+u{BG=CD_T+o+W$sE2hz{=fq4#V1d{+~sLX?x-6bN@^)_}!zN8wQ`nXFzPy=1G z_?X8s6Uj8wLIGQIT(^qvyuiP@ZNZAq$2jC0P^CH1pa^gY3SRtn~IjdkXpTs+uGY z>X%CtG3c4P?sd)S6sfFiInTGp`2BXP(Yqp@W2+Q2H)#Ahy8UQ_{^4@{mp}fKOqk&X z{hn8AI=wGyT(?z-H`m)OKk@d)>-p5v-=zsx=A_yo2?^b)5qC`l{07J4Jvyw@fRR<( z0{*(K>oJmBS2KggiL$JdG$oQaO%CYaDj_fUsdnX*oF#@i|A@cHM??HwEJM z05RPy#apdU@7Bw+PgF(#I7rg<%FK5duYy`Q4vXyL}W!nYQ~ zd*8LWu@F=k$?iu@sY1U0xLox87;oFz6+@@HQwlq;nv)8iu=$N0;O#(QBlg_NmIeSv z*Xtnsmo~1be{=H4x(o zTv1WcVXs6sTB9%VB;Ra|y3x|vhWn`8U8Bz4J*^7+ihh)|u%nzTH>p2}z z74BVjfSbN)OOE6SfUf#xgy&S~5M*+ckNlx{?Oa>4g<)Qrm!TBK-DN0YDGn>@;~Ab^ zKJZaNoDy=wyh-z`v5tf4ZaqsR_wu9WUQ6%r_iv8lWq@3cQ$xq<_~lPMx2yoYSY(oz zpP?ZO=I~Ho^2-PVtM^wGAbMR@k93?7guf^LA6L@v!UE7^M>NuhA{J`I7hoBiZxOju-EntU1t?=C%-mNF^ViC1okfo`91Yk1{sg65OE^BMA@pHFsY-rF5 z{dzd?-Le({#`DM>+~c*~Xr;-DqkA76Muv}%|8d@^kPif|sVByZ6L3`MF?P00fu-Tt zYU*W{?&nz?!&WAk_4-7*d8anwq-$97RrtSLALvFgO87!vDf8z3me8<`@C(p=?eMS| zqAn4A^jg`4s)|nXbX(bJ8wk49^k~U0p=-1yUhcw=1svw*iWPW7G!i@op0rVQjv%>1 z7CnHn2*Ph)b3OC%&qzy~syG)1F0kGP>#uDE2(=<|Iowu*AKcKs1<~Yp+MrC%+DF+E zDsbBtNm+1Ywoh1c&YD(qFO_TXYdcSU1yXl?sD_gp8*2y&2K5Kgb{_jFJ@iTP34D5b zYO<)r{)nP2O|NX1@&+Och7dt=v%md8Z7&aVOgN86A8LL^>V7Y+lgSB_>4PN?VZC|D zV{U*B@&*{?DdAw)7y!_IRYLK-dgrJW;&7AT`=z^2WpJVoe*i6iC6Xl*8{+3k2U0p} zrk!>+_KEiz7&mZ*(3Rw0oLCr=v^Uj5=L#w6&(SxpVu{EPhDkDN8UYxUIjKqmxi=v6T(XzPttPk?sM&ZiAG#vB_+l5<5+~JBk8D&a;SHZ7DsrUHgwM~@mR{=j z(}Sf_Csj!WAa+*d`M%=!510wUL%^2<2zGQ2z)ok2!)VQiaqY+@Ixj4o`eb)-GW3^o zTiwxmt|#+SNCS4?juB%VP+o?wBAz~CrsXp?X&_?bRR}f<^BB|78Yv4 z+4us20Rkh}(+jU{b0v%*gdLEML;RjP#XjCxd;nx|EFbg#^#`sfWRX-dTQpJsIkKKE zL|e}@LT)mJ{yw#s+l^GNb$o^evea`b#7!7?wH5`9v2Jr0DTlh zsvV)$)F$Y1pKS3JROx(t^p{6YZCsqo!Y@<&fSoU3Tw<|YBf0_1@t zY8muyxXPM44kLw7NPE@$ss~p%Pb)TptF#{ODwXY!q3V zIQF3naiY3xYGL8i7lD>n9Scl52;MVM$;o@#zU}+bz%Gx|aFk-9{7l_a63o>_Cvu>L z7prM=@x+zJj}Fx2Jn~sEP08v{a6Ae;nwOu=t{Abs16;Zy#KY<|>73FwcI2`TRIU?n zqZcUo>1oFN%R9k;vOW5TvrS?LACFrOto`$;6qwz-?O zR310Rcmd@1!OP{L#n0Dio7RoSS-6*fuq{>?yg@5rlAM>RA@>wf0xDl zXlZbXAbZYV#4LjP7?H|!3cBMpnz{2GUv9*dEwpv{1yi(X3(Ws8r+@mVB449Lbrmd#W83&>_2dTBkg1-V&UQm5u7i46H>z~D3C7) z++z^XieBjV(%Fs{Gv_UPpYe{BdtZN zs*}Qnn~g#@0t9wdY#6K}{V$BB<__DZ{Tt(l1+U){tF?Vf?e94w;;Lu`j7xGQl zdA!irMV_%8x_}!q+gzP)-@Z*1V&$Fxr1T;o!93IOHInb#;Iw}}Kb}Pz5Q&OT&DM`y zb0&zxNJ@`qpD;y@wgmY{i*-4UL7WX>NZDLfl=3h?Fiz1o4UZ_1LXV^+Vb94?yC$>D zLhw0aZXAB2hODCf`;W=LLsjkBsTLtGmyq5245`nutv)rOq4*Y_n~T+cFrCmD7#nyD zg;IN$5K~*`1=YLFYihpiUh%OPL&l!M$hDn-9~fvbyo)6s0L*T0Sd2oA5epw*m7&J8xp$C9(8?cTAUlSzgb7!8I|$yZB!Z>PfuT7k9KRbR3{G`k;g>T#Vsf)hC0211BBx~l`TYamk z>G24MTu?%YepG96#NN3}7oOIx-l*%#K~(8ShLsxL#m~Vg06uV5nAyniLgbq_#+fpx z)a$BHhkP+V6J~QR^w8v8+LFkB5&CyP#XIrqQDaX= zs2Ud|jAV#MBpL8=@j@>q^Y$WWDzhUh256V$Gc!Q9PO=_`Dpiv1G{0ixCpt*5 z5&t`&9}HMOaT8y#jMr`I3O5S;C}I)+$&*yMnIh)RTqr;c&qdIEzl>eX| z5(^cr7<^~1J)JdrI*TZLy31r$K0F=?kw~*w5?s4zTI)-bQ7Oj9U9>j)y$k=iUaQYZ#yd~S#F#sd%c!dms*kq`ya@c zPJnLqg^L%D-x@_CE~b-7U{Qw?ny3Q#;t5piEs3)@g2O7wP~;9IO$Viwfj}83wY`RR zM0q4azW)j7Y?AJFQxw!%#g$v7EdTW>hD(48OjEi?Ki9_Buj@&PxTk9J!Mg;|LG3 zvu&LnoM=C-h4*iGeXRRX8?*OjuGzfxU+tYA{&7+uUCP|Bpx^aq{R^;2y$MK{-jUA0Fx-7G z`Qn$DFL;-^Yu&Z-$CV6I-uJxw?7h$4&wd`SQf<7{4N8xlD;J!uO$73P=T?y%krq%iw1aY!_4ZQN%@M}STi_|rTL07pbL^C$rfA5ygIjZ=LuJY@aQuk z>w(SRI~!;I)Cnf54zwh1$&ddt2P^nMj9H1cG#&^CP>77|KH9-zx`RMZx^$o1qlZRvmg1B zT*p?5CV@;-(@_4^X`xpW57t+dUOTz1Z+9y)AT&^~{^$ON;&Bq3Yrpqmb7u36CVr#o zXF__fo3HgO-do>6_y7KPcayBH;F;c@;UO@m2i#SbU>vN(v6NR36kNB+d`}-mN=|)A zGB$$c+J5)7i`^bqgiBeuNFe&R@yiKKyr_Bm#Ii7SeWj@NE%2I|79**V#aQXjNBL!~ z?s*l}l7OFi5JicG(OmX5$K}}DX#hLfA7Pl!dE-5k^7rojlFs{}JzV;Mb1m_U z)F(;oT(oYVt9)Pgp+TK@pfNYcyqZwa)1CX_```8|B=gy;NmZYFiSugRXm@FRb0OP6R2V!^itmT@kA;H#}J>iC4jE8C~+F z|L!#^()m>M!_941%R9*a8~p z5vP{A%P(AS{l_9PuM;HQJ3hBIAeUp@te)HHDH5T*yT)`yD;79HUB|&FcQ;UJiykQ@?Nzx z#3XgT)bG)zgq_~$^gKRlbEVX8_kQPdaXm=Tq*|ri_5bWbuCA1r^#q!+EshR#szvgl zNG!JcGDux8@4F`fkN-=tujEBhFa4yuW0R8zD=!4%6R*2Aswl6s{_Dl zvE^Agkv=MQ-$huQZ^7@oTlG;b1e955y}CAd?zs^w5}~$Rp!60R__5*}5|fzc4gcVnOSSaQ2b-FFuL?y2;73{;8hane_WBte{i zmAP)a{a~1ZA1=pokmk^Y+$|ufqJf^7GZcfV?Lc~B0`2RiD^~(iry)VXI`6hKXj3+C=I?S(PUfNYw3K}R+T5o1I$t8O z<@?{vOLQ}8%|?|e0!55_iCxup+c7?nqF(0+H9>5EQnWqCJr4U1)a3foNcxBzjh{bCYI;kPZ6 zkk$x-F?b>RB!tbMb!tjdn_8K4l>kWdwPN?ZYf8;tY^#k;P11mQ=-Wd$oE9w#^bxNH zf{hTliadAFAquNqEf|uvR>5Mdit<9U)xf?Vu(3_FJrB(-8}^0U&0%^b-mB`}2svqg z$;priTy9mA)!)6s!HSsWd~K^r+TB6g53>+l-@r6)i!a;4P8MjJKik(Cc zp}48(c+S-F?|-idvg&K!QBs-kE2WJmw5?AJcm7s#XI$uNX`zz^n+ye&B@y}QW|i7T<&nlJC; z;%$e!_0)E=F%cyzqh?31YFf5c_=rOP3Z|yV~0snzd}TT$PIcGzOz+g$<|{ z%GziI?OFEsJiXW`Y6v;!hr=KYLFqoN|H#ioK7F8^u zuAC42;QB3Paqwd{2f?*)EB-7UE(xuau`03}whKYKVCG?k{z5em8l@@x`XtThq;k?D zvBR_sV+_C}#$c?va!== zs__S>Bo{yxWbHnVJDP~fsYiF0xl+CB%#Sq@i2fKZ-lKU>p+wg^@c{Ww@+?2r~YA z;>cQG7-0zo#!92sHqFw{&^^;)38ThDdrV1v;5XEK)=D8!YT#GuoUBW0JJHnBtxY?T zk+x)+XxtbC9_MqqlLXxq*kTvjoOHlsA=m?F+d0N!;`|bDArUSw6GF#CPWeUO_4Ymd zLT4nRbjFOEUd2WlJWUSo3VC4*WwU)-aUs!9;=-rWt$E73yHv6EWMK@psf7+cZy3Z@LKpk;Qzz2A z%IkM6e(YVV8kGmJU$t37tXo#uDOR)0+>hw*OGDUFr1G%tu{?bSyOnE*n#+CvvS5!_;j>P3Z zw>M^=7P}l|E2fE038hP?zvww9?=xmIgeMDo*(SU<<}h#S$7r!5K>OO?SFir!{ogGC zTBgUIlGAsyKnBk?9|-sm3)>0Vu1?O04|)+^A*Q+P4YSoElb$m*5)x~XKDV#JjLEJW zOPnrx)K_7{lQ;GfRKDoxY%Z?rD=srdZGwg%q;Mt7PP_i!mOK$9$Jz}(Jt07mpsVQ2*oj1A;k2miuq&lZrbnVhY1DrhdNKHrr-5FxU0AB>PJ7X@j6tH{s zxTAKp=wS)>w;4eXNB1z3Fo7^A!6ZTWNXd%7(bIRw9k2WP_U5T!1y^B=CwLm-j8@p8 zxwtSJ^-wqq`8s{7I}HPVJ4J5(c*qAvewtf8q@6S@ZKj-iT*AbHT^c#l`|}$K+R_Uv zR{4c1cY}_bOAl+w)j5PBgO4vOY zg$|-|_>75|KyCL!?=TjJFrFb!MMy=06`u%@D((ro@z+VzBn zU*Ds1b+aES7LEOMtr8c8g{R-GOnU?$zkVKS1{tqld7XrgTnwcvJz%Q|0xP9RAREm& z99jwi(*OY7d^ShZyP_PAlQ)3aBJJLB-~~9tT-($X;2nI3#~L|j1XO3UokB51qR}y%P(gH|L zv-wH9J->UUDoi9BmvZ$Gz)*_!C%7`m8ZEJh?m8-qJ!G$Mv8cuMu0r<`biA)&`>X}+ zcU%lF*y7VeVPXUUC;FCSw_iRdjTGR&cHN{D-NOBn3s~Y`!mNSZeEn4j-cgzW_&$m& z%96QN6ptD!jao|dpWCDBah5QBEeW$TNE35dK(8uzFRkXy)20 z2|{d&4kUPqiP=1LhvpJ@I1zLp8cSgErUIN6p9^8Ju0Smh0ovWRz9QpJqqueoR$?DK zH{AiHwxb}7cC?%E6)BJVVJZZCYTxAJR$=@I-okXF09)JpwUurOu8WV zGJG~J+`-WGHtvw(l`Aw%%Ppn#Fi`6k*mtgVVRrVc-%XC^Om=;bZUQcUM-oSgz28r< zEi%*hDIl{uugV<3**Ix9tj)>+dJb0G4lTI66T_@c99U`V=CMddT7f|ZPGqKmxPf#w zJj6O@=W%Zk0HC=^soC0GIsyw(ur@G~naK}tiIX(P8CqNI|FHK9)BC&U7a2|J7tMwL z$r(x0B*8I<%L~+QLH$~f(9yM`#i{o4kUU|by2PkCMgGhlwu_!lN=3F=m(~d{-heHD zo}}4ia>lQeg6rBf+dYaXc=C4%b~#zLgD3)=j_Bbzo7bKui!oBmwK6bn&3Nvr1yf}= z2%yz2UxDEF0Inrw$*zL-%zU;M*qbN-$qnowHv3lK^$jGv_pI~rZdZ!D_HgC50i$(Y z?yjSLh*W)cZf@Kr19))wpz^c_xJWOyA<7&Censvq3YNBTxnmL)pJ0Md#;=d(l%K$0 zsO81rSChI-%U9cBTF;;ZhWe_4Ks>nhNLSXgXDo=^<;1`@44!SoWapZ>ID89SdtQxM z_N6M!Gk8A=#mzwdwyLoz^b|khkf0MZ)l`RyOJhX0*)KnDox028bP!UGfTjcHZ>gqK zUFTGNnM7nK0u??X8u?eV^>R_Uxl3UU$JYD%Ma-lxBS`4qGUu)*cmB_Nwrl@}U+LKS z+u$`QdG7^zaX};xQ&(TV8xVfJp4Mdt??(@AY7-O?C_zCx3(d;`p#d4Aoz8`DQF|SJ zguwYdT>f^D`pPRWd=NB^HF9FTA3*WtBlWr6%koc-Ur!DAq}@94{?@w7Gm_HGfo|)( zwEuC{fAOa~h%8*uSa?18*!q^|%OAof!7)^A57j#N+&BKfAEqY0{NZnKe1DmAl>t9i z;7O|W%2a*hPyV~`|1SJDIFQfQ_5ZoW$J1Tr2_t{}LK5`SMPb~puC;YPD0m~au^=%= z8;Fu~sSe<^&EM=0jGkM0y^$?PlN&|8#WERjrCKw|J#pW>Wb5z>WdL0YJV-_NjwDev z)my_f=WzPnLm#>V3uj}{T<|F5cu@eIcm8Srs!vg>%UmMDylTRP2o$(;@^19}6W26^ zAY2i@ygNtRl5cMbi6zV!lrp(GWn^T$g*lIgpIngW64G!$SX^0W3zTBO7$rUkjzAz` z7d-`8bFmp{-~b;K?X}(#ui=@{Q2MIGTw ze>L8pX4;XfZ)`kG*@e4LMgv>`rnZ6}Qs-ZA9mD>pwj~h*5z*BW%zTL9sy5Ca2#RtqC#772s z@xytbj=Xr|H#*zDbf;fQVg7!d#?D7xQ$5W`!YYr%9}t@Qw~77!1>n^J+KKwBQc@p% zoPg!49Y_h$;fp8^ouFX_QXy9&0a)A+?EQ&!>V_N$Yk0_Rt0L2$n?183% zZRhgphrB&Ua}tEjiv+`>_q^Oyw&l>lgDj+KEQ#bK+uUEtTamuKBsx(c#2p`{*I38D z`ubFLx6qJheD{N>ukjE~8=g`}yaG55igAsFmCp7Y1K`QLKvm;ZtM?lhK=Yinz7uIEunq!)q-RCnG8B&^ubI}%rzrp{utIgf) z9N6l)|73#wU3R2+x1L4)^*va>TgwA8C2)~KtPix*7y2Igd_E~I7HTEFgsKi zV-cM83F?6-qk>GYBi62trewJ68PY7%j^MUO`pVbT*1$Of+l)K&Pc1B?5wT;-c2#1J z>f!cyk0YwPpw)11vUw3gG!iLID$7|sW^6ZQAoK8D9!2} zMt82CBI(4$)SJ$ytw_{zvaETQ@st`ojq|>(+5@pgJrh8)H=`g>OLw zb6`RR8sS$opXV1|Ns1DtqGKnS>e9v6oXat72Jsv0)7?kSbmy@5&Ue^@ImnW#E_;>D<-7(s-}ifnu-F z?CMMPpY+Z>$@!vL+c5?eY=(ils^att%o0C}Rfq`Z>`m!>M2l6m+7=$5f+%HZVFR zCFNRX+hF1HL68RAraJMLV>Tcbo|4cIDK;0H8 zk>hYsKN6616g?$!tiEnGSOFsU0?}29H7(U(&Rwn|W?hA1@%#;@_bcSpq z6ra&azfqMCQ2bfd^&3g+^XBIlOu`sPZke|j+vf5!$!8MHZpQ=TG${+)1du>Fj*U0+5 z=}Ok|=7g=})2i~tSy_7?6gdGT>>BWT=GBk9Pi%k|SJ;i3@UTsbNdFE~^E@s*c+;vs zMw4_S0c6N77d~&Z0G$*E5b$g7eP#M2X&t}zZMzx1u)Bujz#;POv{;}#jsXp6R!lWi zH0se~WGTXsZg48*(DvOa`l+Zs#>U1bARv+JEuRdNv(*w1r-aXgw5*|;@vrnV-~8ME zD^^QVV)?|fS|lUApj|Zf!s^p&vbg(9E<#{;TvEI^@_N;Mjb<>WHyp8wk7!#wukxMw zz1GU%SE#|z_D;GB?>MIevyTQqbg}8!o7b?r{;#r$|MjUMA4wV4ofg}_d8hubFa7;0 zYn3G*;=+$)t?%96x?iy_VC2m_0%ZSC{Un^^Hev2W+PcN1zwP2 zaBU5R^8GD;C=k|W<(lQL^;*KWUBVDMa~VcqkH)v$@cNBF5=RPaLmP7EANqQQji-qY z!7aZjNB{1LzSXyUb#a#t!`k3l7}m|>xBi7ePQYOsxU+`0pV=(G%LRYA%C$VOHcQ0= zpvL^=%irsF{&n?#ZEXL#`oE5Gk^i)-r)x-!f*mUWJ>8#Y z1Dj!c?kyXeTDLGb(ou24asMN319!v*>}lHC>Yc)Ad*Jx{%VuBa_L+OUFT=)7!FMjqnTh0_Y<-Ar@If5OaprbG=e7+kh1&Thm=Cc_O!%-5@7$mLT zugz7C!M7~!t|iVN{z(FTp@Jm6s9n~1I8sY;Z5%h_3Y%}&6UR7q3T7Uu4V09@>>Fc~ zjGWs{P{^H|^xeNUk_I39yG>kFw7D{n{?*gnfA_}E&xXzk%Xi0hn;zhRkCI-{WY~6n zkXaE|1bVCWh=uXzt$XUhVm%UY#nYp!%|D`?}!AjUZWkez_z z{nAc9#K}QALW6*b4p75Uf?hZRp>&kK`%PF(KkF9WqKZa^5tbVs?Qz->T=PKNF<FRhhezVX`r*U{+n&FZ5F z+d5PD{Ny@J@Y~lXBNCDuE<5GR-&j0b=f$+5^T>R@nc=q^w^8#U?}4|A8g~>`w}me%uz6@?W3B_(s$E*X+OQ4LbmTjq zo9`TCF6+{XKlTXid+Gcl?*k&z`5QO~dKf${jyeGYzZO6%fWD^ucl9Nvh9!=Wz znMvV0duXgLIEb!u`J*W);(X^XhcDbBrBfOCI6-mkt07-OqC`D1YlZ#SRH!%U&a~!N zx5(&Zci7N}-u7QpTU65l?zKZ`*Xuka6&4n*hpcAHbF1RDsI8|LXVaAWrF@(9R=TL? z9vyB6pw&{w5^0{QEybxZv7g6u}3a zFL9t%{YE#tjtG7RMet9t&yW8TCPcC;qS5|Bub0|F7BqwKMtG?EiYB{r~Rmv3w?1 z^;AAX#qY4Za9*BY>mtiOIuZjQ{}&^tY{puA1319_X=i&e5V1&i?eZI3vey_L4T1kOQhM_JhtP^^v>Hz5ym$`llzzqhF ziWFp3`Qwuzzl&5Mz4t6k3+PHGC{wla1Qzrb0Ev^K^ZItp%P6AlnS#^Yd(}90 z<=ALl?^CfFUDhy=iD!7f&244^`tBXmsugFs*!>2yPTZ)aFXBrtrySAR|G#q^C z1?G}`l(%Kv*u2WwOJS&jMoIklR3;-~W0wX!BXLOD(6;%Xq$pNed(+Y!`;R?rXC)!0Lga^*69&zqIPX&q-+f}hoCpO*h z<;rgN>rpGv^$`=0;8$vKD2#siN%mIJx!v(61r&v5Pm)EKsp3DB(Mhw~bJXafzU25( zMYA?_1re>$B_l7}vu*Ucd#BW%^x#JxWb#>$G?r^Mp=;LJ0O`h#4K+_uvca2A+T-It z=`<*Ur}QDuSKarDha@-@Fh1;sC%6=%WPC2dDB_i1K3!@20As~e|C`OUnh!S-R3=1w zJ^3vj-n!<gIAE(#v%DMb-GkV(tNhf=I&{FH)>XJ8E z==i?y+N`xJaVBCRe#$a@CUo{?U_sK;NJsNR5ANKf3ZJ}r&Y{7@KyM%Cx@NELqwkga zRuTNM9K+>f0t=)sg)J=6i>jW>D1D!j>`OF&jSyCW;0759MLJpO{mq(2PCsC>G|PX_ zuCPse;`PR^N9um`s@!34$ZXUg0g){4-!o)17W+iEd7$Z}jaeUPTi8)-w_y@0Uj+h? z@SfL%a%vuPr%A`Iw((QcU<-$lE$CsNj)5)I$H+Al(_%tp5gy9)G*J|DJk+&86Abn} z>C%4squ$SvIVk_Z9F8d}w5gkkbcCG7^d8X2HkHRL{z6+1yebJab#46JD*SD0r8VoV zR*n90D7^=J@Z8)(>Hk20m~7_Ef$4`Tpo6AKA0FWZwtZSi(i7tl1DH__o`ty!p_Sqm zll)U&^|&kD!T~@-f=fN)DDd)gGfj`1xr!uTO?zf#$7(M}rUr3Z(qr3O$r`x)Fhqc< z`Nr_|QqTAvKDWb4q-tUSP-=i#t?=e3XHOpGD6SN?WZ3>IHLC=L)J+#ImB7%M(lJBA z;?#2jn+^52CHtebhy9{RF(VxWSIyXqFc}RzcCRTcYMXT2=J6q2gd6JM4z3tVcjes8 zQSpLO@6lammsaOeUBdu3(qDRLwA>0fAN)xO2vD_Bj3Gz`11h%KW<0Yww%CJKl~Ku3 z%-c=ymCVT4*jRvI>&noKw7ZKDO#cTU{%=z};Hi+&KU-~SUNqJ`v*s{NzUDCIJdwjt z|I%TE|F^?XQ1(I&1NXbbAUd+L0Y@)phKrJnG{c4~u+BSsB92n<9#_fV zGAoic=k*6@#gv@H#B>|r7xPEyb z38G!ZNi;RC43xn;KP_M>otWiA1h|;^ff-@8muXdKWx^IG2Uucmlhi9Z8R=c{|B2%x zX(kYZ?Au1cjUddpz<06B%S71UEOS22+*ohC3Q>qUPEKp%Dp>=^*20H3oy|R;h7{!DUrH_4OHyY}e z043vkh;qK!3s)|tiB&t|`vYkc#cpqt4x#7S9|TxL(?`8>Yo$(b)su_H1>@#sTfAl! z=-;)q;f;Z7T{4k;yNXC#+2YTI#)$-*_}@iBuyLd#2OJGbuG+C$p4tCyx$*r~II>7C zlQ)Xk>``s>Of#|^Z5^~dBM%}vPS~d-n`AVYYJ$!RFLvK)Fv2Xio`4dN)h}DwqPu|9 zX1HFCM;>BznFJb`S}MBZIvECb62`&X=-l07*qe`Z#a(PtTdv@T@qVA9k_^_NWXt|1 zo0O{Jefd14r>}?vt~p3rtV3IqL+h}5v*x6o%wwvWsI$j>?0p3n*M^+8$QL!Z-jPn! zLEc553=7DlXElZ;Iz$u`Ld^i_vgW}L>=^}3kFwFJ&BlFR)Ywg{6O%-4vP};nRnizK zxr;+ww3q4w2Sle7NM+fZSZ}HHfm?mfyar0Ugaxvz1+{d#Xmy}kueP0j$7V~>2Sit; z{gO&`h1@VoH|W-nB3w?`%7+@4E5~q)*D^Dn2Hq7C@8o7O04FehIIs#`9wqj*zMgKR z`0Whzj4vX`GSN$8@(I*z&u=9DaP+nsz`b~Mr6d#eb?L`NvhQc8?`DPq)iW_qT*LDD zDVi>S4%Go;q_)id5OblD`!=C8dW`(u{^u{ls_4O&jV*&mtI5w=p2!=lDHnb#NB)fR zfbKT)ov2DP&Z$_lW)eb|v(msQbQx4JSz)drjbR(Gh9q}7s%Zw3^qg3xM=EHped$ZQ zB@4bxK4g^SVV~B%LcYYy(^97MoWEs|Zb**xQ)Vdtbt{mZc~6FNFqcaXmE#Zeq{|2G z7#xP48nnMMkI{HWsrl>$AU%0$>B_}#p0-EuL%SP1tsRCujb1JpgL2!rK*j^2l0)g1 zk+4m>$Mx_t&R(8B1|=`X^V3lMSoOuB$xB8rj?tFFU8a%bdEL z7y5PG^{!02yRJDD#myz#4TraVRvO^q+=cNg?B_CjN9iK{sUU*T$2J^@BV4cAkLVaW z3N^is&v&`55&|k0?;PFo>{=Tj+$>M|yIR4ZuAntQ$3#kjohYoi*C!4FQNaBBM}nO# zN8rXIRW?5>fJssDfJ9o%y>LLz8hm(p{bb@Y%rX|V5y|QHj{le+7DpbsdtXoTZeNzG z=Y4ys0+0$JvFGG%B?LV!PGOAT>)vbazA?$}mV|gzA=v>dMQDCq@gWExN4amnrM^Oc|O#IsM&@=GyFU_2^m3mJE7IrWK3gO$yc9ePipopAXMp z3kD|ka_@KdzjK@I-4&bMB z2{u{2Q(K)sTp@a05?qV@D6jTCR$JC0M|V<}Gru$Epn0M6w6x2bak3~*w#eh>z}sk< z>`c$G?)M7-Pcw|Hi4kV(g@>abDUmL>T@TdCP3r<8w^JL8GIf-fiaO!}Psr;@dM}rf z!HTcu)IgtsZL~`^YXN%o>}a1#DR7QpG4jPlW~NN?Y*II zOQC`kXY|9NJXMu`c@3MI@l?`@UEPUK7{HhbsxPcZo9cCxMR_q#fGaOhu$bw%l>3HD z{Cd?FAOY5MsTIF1FXb-r@Yw2$CjutwF7%3_Y`009Lb8Pd6;J~BvIukvEa#p%d%QdL zUdhRPKgL~J5(n5%n+m1v+oc}jSc_R}8OGb{xM75GYBHt<>Y%{B0i=rwO$`05cLK?M3KU-Y>Fb9N+u;Vib>txWF!a z&mx`N(M~Ixwgk|C6FWj#qH#wz6e)CHFltJ2s}ie!Ln#rOEk!KfdOuLx!N6g;tt;F; z&7F~~4H*Ru zB`Kam$Wff?p5#PMu&!W}=Pm|>eq9Pk-+ zD|$a=>y&9@gU%>dFr(TxN^ZC9-fBl;ZY zPj{FqF)1{7bSBh^CWlx?FKC*S=eh)ZF->9FbYzU|DJiI9bXW4ah=y_Mf-)vcn;nlr z!LPls@FL05Upyka<|=obnyo#4*Q_xE~C3N1L+qv6F9=GK-N4*y+LL%J-v>Z-_7qFf%FD7E1Fs&6d`OS|V>`anqNUUL8dq`W?oCWXG?Fi@ZlS}< zuK&XEc^<;r>9BVmt5am=+u|TU6?1y~ zHL32$Iy4hu0L^4`;T|I(efEGLO8mtr}nU^AJ^T4y6Qe$_2s#P73CoC(a5yOsLK4Q{2n;lRlCC&lv1~xe(K072luq=v z6T(><8QGcnv)7G=TM+qH=jPe#j@fCy^W7BP+&yFhvBfB9L8Rhns&D>WI7S?~tzgNh z-u6w&xE$+Ed#zx~iuF=tr}(FX_Zj>m1l0``(Tn+v1v4Snw(jfSTtQHt(%eWS^b z^<}H|6#pc)(EbPsFA+#)vJ1vdVsh;6-ry7DX_~`Q>_u*ZE=V$JJUho>(~QjtI0r0o z?80W~a?b)0U;|JE_--OdsiA?tTsUaV%wXX(aS^w=GTDImx*YeHqQ0r*T?iz5nXjys zeI#Qf32D128Kn|V-lTs0%%KejvBZfG#Fx3+Oz%p4(oc|f1knd%eE)g>T=X=F7DU7c-EP(W#pW!@@?k~NAM#LE1*mQLIy4eqFx#$}Tq zn|nrE5KqlK2NkxOjd5FAZA}jftDr5eMKVV`z%;IxnE~1$gp%|Y+Kut4Ks_Y-{1YS{ zK+B!c0rI)I@18ifA!>`*^D?bt^+_%c1p)OUyZA^w{WRNh2kZG(Y!eq>6_NU zvUpk3C3!x*N$3;rGfQ@~>2f7Al9yh}>!~oq;(gw#*n@lMhTt^PrDkJo-9MUeQhLw6 z;FCT-mF)^c2J?<}Iyc-gqX7m0^W+C74ghT_r9zXxVo7H#4~`ek9=A zx`+bB`T3i63NdF_h4btiz+L9{0lGIT{pb||RkL%ZZjaFJO+Z1qA+K{TC1Lp@C?8va zh;J-H9@!PDuQf^swl;d7Xw08E`Wb^ znvEO#W_Q-WNI?voT>G=-ALFoG-aZa*6)se|EuBNwxszm*iC%LmCPIAqLrtt*&;U@V zy1Ini{J7g>h61WK86cF^?y@suQuFaB@}1*{cA3fgP>)}q#Z)NIaxmHV`Q|@=IjI(& zdX-qr<8p~JKs;)t019Qw0HX?TEPyd7!o81nmn5&dziameRa2#$3SoGZ($SKvD-F`q z-sdjR0z?LTg#2v8slu-MKogQ!mfu}6D0+iSrpH&m^vyq0*=>a`*#i5N5lWk;WoBu6 zb~D%hLb7RmlLVYLhZ8X?hC3PO1_W`Ze0*pF>3L`zq5c+u%0&6HOs^hJp{)0D@CPz) z;y99YWK7ELbTD#{u(LVrB8sWMQ?}-2Icv`?cbx0I$I-KfCx~a?Rg?c#w9rocu*)$7 zPP2H3d*FOCY_}gw;|wO|!Pto9%||^-y_8STm~kqS!tN-v zh|tD zkYsBG3!-9qf8J6i!{Dn=zfd%=iBGxBqTE1cpO5&G{>}%xO;!O2*QATvfi{i|7Mqnm z^~pJ-R6!j76JvDhiL2nuI;r>k7+hzY!r6r$g1QznG2AEXc;S#|HZdU1ZpMtN#TD30 z`t#0LOkKm$=67!%eyn_veIOc^kvtj{WytHof}xlT0Fm0XPtt|y z#)r&2(w{TJHErRnEfcbJN)>welWB+KEQ8#wqMOuo`bdZfIm#(1=Mt3A24^PKN2 zmSQXNujk~Sco0x|5cf9U>7q8L&p!SmdnR$KMEjIZM#r&__}w^UHTr&%kaZ1=oZPC# z2md>CzX%OY6P)Hw4Td&w-H@i99}uVYz_l#FX4)Ot!OiGJ|9b^zSr;pRN@X(>WSvAwR{e@8W`UI84`sTv<%zR~N5-w=Al9yJ)CGwJdw;?$H@^csB672I-}FJTeL@HpLGmTYla3LYlOQC|hFN zWh1@OyKXLK`FN-~X!CuUjRpL^^^;?w1>hmjF<_-jQ#b~Bn>9ErM@Rhq!0r07@Yafd zg6#abO647Iyd9r7BYR0}YTiVy)l8M(;9L;JGs;kQM7oCcE0SC)s;g$SZoFh)t%VQG zzsemhd+OuQd!{uDf>(xq%rp=&01#7hv#a>8Zzl3IBrpFLqn4UQCm{oFgTZ|RX`0DzUg$gLh1qiA5Ob}HupDb%p{Y= z8V)Q+yA~kI&pwJE93ta&d(h{5P4YRx$A5VeC((hp$VVEV+q;swJ4|_CLR}!Qjczl; zi8;?kF;!ue++NUR%=J01ZFhP?@=dC z^Q<11*s#A;<`m?Q8c=b$Z}IR^XZe_kW4=EZNm5Dl6QO2^Iu;@MK+jo!5FH4^d6ipr z5bc}^b8V81z*4*iEl>4$pLywlz_vG19yBpfURk|}$_-0#u1j$YH;-+Z)D=^@aNIL1 z*KS#z)p<}LQbh_@pl?HCL1ud0d>HVf4_ihoYpMfRlS`u7teyuBue(~IJ^!*@ddv0e zB5m|$qy^s8<0hdZ%h^BP}CXek{MnFnWg4h z?^|1*X(j0yXZz-lkHsURo+0^2iE-oWY6Y1MOE3ME*4j?LCHIoaxUIo_G@WJb52dHG z!lMy2Ph<{>m$#N`^^c~}0?-|Kb{J@E-<;OrT`rocC7^<;Y3^_=L+vE=kF>(m87S+_ zT3#HSDNbkQqdep%e)GmBN_fsMi*#nOy^fVVd6oLB9?_JV=N3_ls{kj0v7ERis8eNh zdG#gRxU`|il|qu)+T@UGFgNo4l(v*;jcR8$mv`#PPAY6FYs(x+6E*;yU^qHOqNz=k zG5CiMiuXTOu7~{7qX(UCZb|MT6%JOs_c>4&z1W3#n+m-bpJf~`K2$7NIOS!4TbZxO z>-mW9`ElhArMOU-%hGViPWH}Rfg6>|Q&tf(p@Y$jQAd;r8?P`hnQ1%LICef_NwD|b z|4xIU7sdHxZp93*DPFzn?k1DK)oNMm*FtOZ(^N@0ZNZQfDjZDOoFhH%cDb`UK<{X4 zBVF{d0FM>ESJdOC+s{g^!KkUac}AvEYzsKXVb)U0X6?vKkG%obkOgqPtTt;Vi?V~m zjmipDZO?e<$8S(|rw-N7j2lKd51O*Q1e`mTX77Wnv?0|iqjyT)jv=C~m{wZX85!4E zc{2y)V4%%2z+~EFWuzNF6~bH(VbG=M@1>|?q13w+H)Ga%X-aFU33B%E>rK0%Yxa9D&4@h#X{9f* zDMBx;E^V~+&hfI}xB#v>9ci62e7?w7-=1qIoCSyadeSXHIu2&OKMBoMfNE>H`;mV#b~KC0oi5xbxi` zO1vWHU$gLA|0HYeynL)ywQYa%dsPvwS)(Yf6XU(XG%9*oRWC!?R}|(F@w;c zwb+pSKx6mll*DV3w!Hc?u2;i)T$9Nr1QTECLt_wT`S*~5X9?&TH>e9&fQAT8KH1k0 zy75QEfK$Vju=<0ZyTsdarrA`^INyB#Qgw7T6xntbvxp^QJlB?GQZe3#>V*CrpH2x7Tj#bd+D|Jv8GjdStg{Sw!$TM$10pfRHD9(CXxcuU?LdZVNHW@-ssQv0BidkQ-IgIAcPB?ooyUMeDaVmma_-wde|Btb=Sm`5t+orSkm_1fr zFQ8TO42f5zPom0AndGo}l<|UN_@BSBwsXGmJ#!Q=KaTSc{qA49_JxrMBzV$(3>@;m z7ypMR`0vX9rK$dFHh=9*{xzF_&E^lDWIew7U$gliW>XXt>^T0l7^Ndg0>~@O$k5P= z7Ck~O)NSVFg!8qR;B0&n)79XA+0hXST}Bg&$~ip5ls6tx@Rw^&bA>ft`>l zBIL#L9{c$#@evz#2*yY*-nLc$Q{2aXcwYB$ z)hCw%QE8^QEs!4{YQ5A4t*WqyB@Nmm#qLX)n4 z%0uXUNu*xn7IM45>3o!AN<%`sOP~6KtYfA)hWw?=(`lO zvE@3B2%n3}l;Sc_A8OT$aIP=$qHh4U=Rg6I*2hTtA_D-lSHu*IJuUYRbD7!8t+j%m zg-%nC>Xv$QbzQbTRqoK|D^nkTDavA>dFNFkApJr>6D%ANi;4BLdQ2l|@dT7sPuNfQ zX$~NZv;oM6X+IM}nLr&XCn=~;m2?^2$fa>5cOH(VBADeJg6$7~Ih=$zy^ME7^cxJ< z$KYFg<;$r~++3@KHn{KQs0SXr^BY%CpRGc>z`+^;{MgM}QsK*|7Qj3Z(WTch*=3Z`NFl1Kg*xS6lm^zT-|+fI6|(;sg;(DlSsu$@?8BlhRr zkjx3ABOF}^tpChQG<4)Yn=;0P30gh%2>EIS>~)W`_EJFEmez7Z?lm!SR3No#Qq$|# zvF~s5=ttG4;Z)*C>iLabDTPZTvuQrgNiAX5Rss5{DNF?4>b$F!=U%8Ky0 z1IEg67v)i-e`h@H#?2KqwgXS}VqxngSdI7hyNoDDoJR~&oz$myAv9g!w3NPiPQ4Pjxaq7ppExhXYrXbyoFHGOdLt03Pl3$DgY(j$b>JGLDk>$ zrP6BemGJm$t5URDjiZ^aP%*p!Am@tWv$enc!Xa=WLR`#@XEiR{GGLG$!(F*-N%;n; zhFGU=B=(4MTuCa!ZWRQ7?V=9t>2)j?6k-KP{4IZ}#Ese;RpCa(@7ELZ!f~uwU-_*5 z*~n$(Ixhxxq!0CnFUN*)Dw29YX>+9>DvQlg0;n6=0G>q&e1!W3=YDo?XN1@ZUv3`^ zFuTZSZVsEXBg>!6m4h-R8^#Mv@#U(}Qt~qew^Sc{bOF(-F9FEYk30XO}r3&%~&2j!_EJBIX=I_TS@9}uQ$-8;(93sZ_5r|ppqD6 z3jzm!T--Cm`<5+N2Ni zhGRp{x3MzokamoYja9aB0~pn6{)1lNyv)r)(7_C7s-X22n{PorBF4P8BnDJa0w+hZ z7&dP3V7^6_WD1CA_7ROI;>0PRI6mEyXj<6u{&|KesaMljoL85-6o4M@yqQxkeS=6B zzS=3d_%s#6Br3`wHip6g3hq~tE&e^@xn3|PArK?SopY!P)S#G_P>Xn_0!NUGDxM8q z1+0U%Fcj!5HvEFvKLhB{Q>gvj&3^eOK!52FA#yucJw35%`ij^*iHJ78dr{<1h9>Gx<+{ z3g+6iv6V$g)7Kloyt5$OSa7u}f~s}`fVq=d<7KQq7f`R6>L|~VW70*r(^iP}82I|8 zt(QLkua z1+kN4iypcxE#065sUj>|E&(pa@)oXT5ilpOGE#9AlXj&d02_VgIVd`KYK1GIxwj|$ zaU3}(-NyZ_bAyc14~w}pvL3s8I<8Cy;zSDu#U^C~F)sEyf3Yjxs~Y{P3jsGAfEMpk zxzT#1XWpnm{-cJU4|Y{`-Wh|peS^ojG)w=fSR$_`<4-}DpM`E44;h80~#yipl+ z$#@zX%746%uf2l(kxPfDHJP35#2tdd%p5V~8fqN;!IrSCFdy@NKJCxycae8DhfjIx z&Bk{?*6d(xWc3Czk_5(=fJ{*B&^FN}rEwZJ!f2SN?i5BID)2TzrK+*C1RnFOZ&Xg+ z^0s3w?dd!6GkO>c`wsKSB78CQvOFBPW_vt%E=~a-vlANbs9HlIg0{`-T;aCE?MbnLK3&D8(?xc)ij+t~-8{NLe?5H{I!fQh%!@bMQc z7?xiHB|_b|Y8eg&{w1FFhVh&Mx^0puCbR-a_VWkuL}D@+D1e+3lRb9@^8wg*aS1}e zGiq9Tw_?(Db=kCSDP3t&Yz%~#&cK=eEnbd74vY`isd7~BqzO)~+~(F;4WWqp;|V9 z_r9+`4GgT?*A2-IYl&6JuVSULg(jC`;Q~zy( z+hd9Vy+E%ZI(0TpNaITFI85SsK&x%eik%}RaBq_c(AGP)z6=BSMoe6-CXM@YwQb=Z zBvqxBeq*mh`XIxQ4R8g`i}nCIQ3a9Q`|jOUnFTF&X+R9s;Ip!_ga9ew=-pK#0<&!1 zl+HtE#Ln13N7_TTY8&s3%|sd=Z3e)BT&%&5gtgwf_Ehn~SfMd}CBuy_H{`S?at6Zz zQz6m=07owb)-7i7cAb@RrB>ClR+$?e|H{GlYa6%w0o6mCQQ`9d_~%p|>z`cCMiMfX zS_@{uyg&P#TSbZ#?J!E|yKm%}oiJi4 zJ!Q{C=qA$zrDw6pavL~`QnSja(;mLx^G9d%wPk^(&5s<+uFaat9PrP~Q^7yFVzBd_ zmy2A}93pQ|e4Y>Z@*Q-$vG8b8Y8J9GGmDXaK+j25Y0n1;2#z$b+Qs0s8_)5{79#yy zCce1ZqdUI#$S4~U6->RtFJGsnP;au^>c`sycbc^=i?v!jjV7gA)Fg?Q74m>A=~NzWIq!Yd{8#+M*P2++7tx6!kXT=TFofk9u~!F}}xDN6ez{|FHL- zaZPUPzUZ7PG8F+8As|gfK{^p>((FvSiu5LgBAw771ST?3IwI1$G^ruDv3=k!ib78!8mAUzyqY-Sq&N zpve|aTB|}u)NM48X5_Jck7MK`_fut(N|G>}l5eOjkPY)xms z1w$&u*wfN`G+X7sP)Y_WZ&LdHAWBJ^75q-DZ zZU_=(G3@`$ncBWEbYmDPT<5Cjcf3!sx-0&O?x0{kiMReH<}QvaYq{?KZ~FW{*iSLM zB77pziI=+dCPJCAvG!Gkm-{s!{&<`ni=zOe`G>B zN$z`RJ3cb}CnDu%R5kNEfW~8~F5jimP%O{)_>BK7Y|byMzpyeFNdM7Y^W#_lJ0m3V ztZwt8Qj=q9qd)HCzaAl7dNL2w<`MW29o9de(&{vUiH6N%17Fc70Z16 ziJnB`%ntG2^FQh8`%whTKS^s%H-Y}Y^<(bi$Ja$*yQ_&*75*zs(TB5#pqW)*F z1Z4x*<@QX!e6J()GyMK=qW@xTKlw;P;nXD}C(rK7OaGrt|K-$)@I$Hg>&qv8T-pD? z$T{X;A5mW;6fV>K4@~ys?%odi<65Am#F>Ww%T4}^$3H)~8{0YyjCuT{hx;#{_%EH2 z<`o+4v1q&!`*C6a10!u)=by~G`1I#I{U4a@N8I0K`R(Qo>Qr3T_k7l$;P(G=gZ>Ts zf3d0mhW%f2lYhhhUr^q^x&6OjR{!Sqe@#{Y=Jx-B9sgU&`4?36ZzboiZJU29IsbyH z{{K*N_%jg~G^drPj&EHDUw9kC8JPk(uFg9{p(*(ovPHt)_f*w?K_~yskEQ`M`>k0# zU-c&@_Hp0wuK{}Zzw`RHo7+M&c%nb9?^ligcz^R(royInklM|%R-)`9YKm1pS>8f( z*mUZzzWn26-3StCH0TjW7Iq^>V_zQkxgbJtTfhz&%6KofwZ-E#$%Ho>k&R0s{NOtK ztE~*GX!`@}e6l6`kpFv<%JF`8X6wv3XA;)fM>a+{2#UT?~jd= zb81;>o@<1G9WW)|?dox{buPW_k6kdaOlT*O@UkK2lC20Ec_PuT#>IRe_B}h~c#Alf ze%CXh^u6mEuJ0E>b$kqGgWR6YF`qsE5g=)xL;tLc7P@m`NTm#}Adz<52QW1mR*S*|Ba zW%&iPclzVphJ|3&Se(T=u7CNfXlHYJ>mmM&*U-d|KCGWlKNAYLX*(W1UW0BkhTVzU z1(!|{>$rEo&AoER_9MJedErW|>w@ac!{F*Hv{H?r{Uf{A(Mo_xhYbH)kQeKjHz(%1UxS=R`xM}jqp(GiW!hjCNiuJG!=jaj49kUTB~ zxGaN$<6??Ep2fC?cfQ?Rcomg*4%7>b4h5=kv#P|%6^*qX9j?fqr7#jTR*nm-XoVn= zwj}GZ3emnQ>+u>9tlngUvKl@9XkVC@fE1rYou!Oo?T*V-f*uIDULn>^-$4#foY{CF z{C0txU~SqRPRV-~iH)Y*U7v0i2-uy@@PU#iwr8245?ujXCxQ9ZH%ebMWqQniVd^~o znL~xjX^kkybjP^mkCsr|mF9=q;7d8ikJ%)h3~Nd=rKoN>n~J=(@@5!hdW?E*mVza|Hd!kY}>aaE1GucrHE81zd9I(Un0f*PU>o?k$0z_kCnnBz=6zAthvFWMnzt zT@?Thp7YNezp2?Xy$5&MoF1#Rby=UTlxICqzt>}q3%@V4XM22s_r^F2|M4kse+&pD zeN1@&#vzOr-H;#RsPZ_x!_&o3x~wVl=zR>Ww&gMJ!fCnD7i4L!_nfCywCZls9w!Xz z;3i%`21T4Eqv5@_Sn@M4?H}z%&j{o(+dPI(oq`MK{@P!rn+INA>`Of+5lW=dRro;- z%bcF~!mFd5!+@oB@QK)*XJw*fK~b+%>#1I27dmRi?he@c#<3Z<#J3allDw#wA~cWb zGmf1aN3?n#x#9^nbWfY@?Ih}!(0e{MEjYrh|uIZ95=A?e32wS0}bHtk-KOX5{ zj7+~dAy}z*PCUOXhFz}0px@;=iAzdIR1ZSC`ms&0>#J}w>?*BTU=kXrZ(dJ%#w6CL zuO#*c`xmqQh%ctRwyOh(1^KdW^XVMH=!%)S7HHlT5Zeol@$Raq(1dQUia?bPoQQ0_ zx3S)PB}q9R0)ejw`I#7f&n< z`!l{VR7eirw?0bTkD#MG&Rww60k=LayxLc3?G*p+4~p=Xen6tXiQ%Vzq;4Na4d8MN z%I-(##ypB`wU6ST7}ArSu5~d7UQaGHF)7&v# z|M$$r9}o3sBkXVQdN;riVs){7XDNA7_Bvs$@2&d+DozBBvj~S!!V?*nZ>-=v;`}Fn z`D$|PyO3ajtOl{pjh>Y#tbTjNRPBcSdn!Q1mKIOhf+Epw}##5$+ z!`?^Kid1_B(kKsMt=$vQ^IuXqAMm>#?0~}$xhqr^>X^ku{nO5pJW-pRz-tqN(5K-? zUV*l1E(6?LlhHnxf4;sS@x|4Cg1(^6Tq?`or1~}V*a*2C6r38PGw<@!2K>cEG=!sa zLYVI8T7&QrBdO5&XBj0w=Q7P_xF%;TVJ<6%7(Jyj89rKW>W{DZvk_MbIwn&kt=QIJ zIqf$@!%@1UUf6WOw0ZLJ>FC^(tas|1Gg0)!9W`Y?p`#H0$$O9YWskW9T=!1Io1kYo zs;&jTK@iKE7hD5_m?qkqj@|7v`sJ_0IzB%VW5zL6oK4}N*v;bURgvQ!?a%h@uRXjk zErSyHaj9k8S#2#)`h#C;k88=al>^v;a}=3}#5w{dZRNNDAxyPxPZqJ4i1L$_(6<=< zGeSkn-f!&`kDEcH^5@+fZ;&tR^3MM8;DSfVp1M-m*Z!BsRZfCh=!E2|9;3L?{%O|& zqxw_pO82ZU7&y)e4oe*q0O$CEo|%=tH|4zWreZA9e^P>krsV(~@8J})nJ?eh?m!a1 zn-@$b-J~}>O!+oSEq3^*(Eq(0&9SIJsk&k6KWYJ-?>_Th?}nIk-c(Tzu6VyQTWDW^ zH!=0M{V`e_YI>A5L0eAnKx-HO&>`j|tOLuM68kpYfEk zTWd7Ndl(6RH3*aCX|fF50e{|Wv@$r}($2r+54zfo5Zpm&nE!DaTF5A2lig$57{Jo% z@2!7$2ij5#(I)hEGdd&x(O>UalQP|X@vvy!o2K<1v?YB7uLD7r8l-*zne)Q9RPZ>d zA3HT!alJpeE{OJH&+x3G5n7iUCS+HK6``9EJ6u|K9^f?4KIY^dT2bT(=oHkq5 zRw~2j%-laFTF%R!I`Kw`S087u?u)Q>Kl3fYtp7yR(I_6XU0ihsTmwCLz#AzdGJdDQ zy0!B}s)Lo^Pr{{t&c$7h)|WJ6B#P=jZhUiKmO?(9zVF}uIlxkY>5tg(pmMZSRNqGJJ zzzcl)eOGvE&94EDdsuB2=h=al58)ZcdLvGga9-INe-o!f6{NJR^XZ_~6M+{R&u+37 zE7&ON%)mGnRd|m@>@=r^)tPm)Zs`44ROdNk=^gIYLr>s@o)B8U;^XwDsftpWH>d3} zr~2Lkv*LcBVN|Unr@xXI#{Cg>hvz}Sb8a^gm_gHSpcg9{PqS*v4YtAE@`WdlMP9U@ zcI`NGxG1yP3E5=5)>mO|EI3gkUevpfx4XuR5{QXA?lcmAo}ej(?TgsUp2o4QkA)tf z^}^&Ihb!5rv`*twEn~W9RB&}8Iq}#6Dps`ILH}wr&&acf-4#xq9mcx&mZGWCPjagSgo z^wL-@?EU{X%S0!7lWSL-r(Jtdy$C#i?)UB%$J(yf_p?maoXUxHt4hK<`lY}Qay@IL zPB@$k+OMQyrOa0m_+L<@mrwOFpc4GPm{!2Zd=7oqvki^O4(g}`F^vA<`}c`}aF@dBU*aI}0#acwnbkhBHE_BE3xN}^2 zBJg%$GTg9sRkC?$+HbHMp&LB@W03C8P0t`37WNlPWi@1)moWVHXYh?qcDv>|o8?%g z<1&?Bg3L~-$<+qrP5FuS4ucixn-%nr?QuKLt`_v`Jl4LUu-lyR_e$ zDfn)0owZ>t6|f!`BY&=Pj`g_Uam_k$auBg#{*mUe0Ch+2kMeUl#Jnl7eQ-2)Kl^;h z)B_B&BCSqx;|O7G>XQU_n#Hkr0j&)nu`W9^_#XaBACB>9m725b6G`b@8CG|nii`($ z=*^B}5q~lH9z2KgpNF{T0!R~6teD2t_p;WXc)J976>s2#p<3-; z)+Y^nFXkzHjrR6>eDgk1d@u^rEU49A0b$V!Q^!r5e>jU=!KuF2CgSHsX=Zn0Bq&<9FY8%2sH7#mdLB&l-5LGN+aTm< z3aBk9iJZ^qyYr#g&F9O0jY9gT&}uQ6vgyrTPCv6z@WH1@^2TheXL|zR&KwNZP|hx* zNGVZ{P?i&*q~Q@@zq84MP4j~W+ng9 z)gnu3wTH{GJ|7Bf*XHInc{70fO%;Y-UM^8|x=I4ktwPd-3(chz=l71Ak)mYbhbhx> zthyx`5iAHy)e$+RQ&ssGvPR`CEzVKpi&g8 z4u?(q=!n$K=NsU=s677c?!i&OeT-i}Rb0>CUbddch!$FSk{ow zmuF!zaM#!&nh<#4T7n+3>@?-PQxqTgF?0UmB9hNF2y7)1ds`$Bu!+{X0nCn~%_Ro)}SJZPG7E_8Rx zK4<{bEW{?Vwqzngb`$Yw@^^C3ND1^E%~|Z6-0jlmo;Y65)hzL#lLOV<%M?%OM7ln7vV#(#oK`TV2`7PcNdZFHjl{Hgc`pfxAPA2MO66*II(#+SMcRL6 zi)z|jEnl1f%mROJdg?CtF_!-a?uWI z!WQvVLL4>HB~EQ;Ub=LM-bZ0y-`7hkmoj2@2Ovdop-zBW84;1X1(let6rpR453aur z7oD#3F&*eD=;T%hbc`27M{&cP!r!n>r=%83$>jT{>!+Z?BweCqYQ=<3&lxcj044b- zrsG)?vJyc9+TsJ&Ar%FtPH?h?g4KGGE(Q#q8zrBk3C zqbl(26wb@Lvq8DfGteiabqbF!%1vn zFuOH!`Ieq-iBYpOvK7rCKb!?s(m(DS$$sq zECR74p2^}Qg(*h2*kD3bm-1V*GA|0?_Xms005#so5I0`viaa>LH>n^G=wG5JCbuD} zi&EqgZ-(F0QVS9G_9%-M$P8>WxLZ-4b3RV2ftJkbLBf^#9PoY+W~CMrAL}0&)Lkj9sy0j!p+u+2d7g{91K^?;Xeec`_ooP5Df3WUS_v4gICOZu*KiK~N30t@AX z>fGO@up!{ATQHv#Wi!g!E#< zuKA`%7a_r=`<2BCmHVsL;0+)l#w#!FMTIYr=07h;^VjQ7rvQje=)qF>+=?gM608Iv ze5uHTW2=Di{x1j$d&!*ZPW`s|z`zol{_(A1a+;f^t*M)D+Ehw~3pcl2fEqOVy=f}s zsZfb@eIl_Z!(E~lUC*9sEj*F4wotwO5Fx3U+#a^nA2u|Q$|0aT1kzQm$y+-D<0b8I z>T=bpO9P?mOPWKrz~Zu@4e5iyD0#Vs$-#7Vex|Ak!-1KVjJlTq*wcgtzE+}vZ z7el?an86C4+kW5PSCO+qD71JjVf)ru^FfkdPbaX@K6dq2>vP3Ra%5*MRl_b2RomZX zoDVM7S7bx%@=fd@7I?m4p_iw=uJ75K)G2<-k`i) zvxZhKds8jxDV_f8{4~c+Ou-((L5D=fJC0&tA}W4bkhJuQ+~x(VH`g1DY?DtX?evas z_LaQ%-H@_PogM#M;Ty!K_dN-W8=j-AaWatRkBZ4Ldfd7ERpn9N$ERP1hcEJ}M2BAB z6Urm2{YMs9GlbBEQ-pxX#+whl7FJl4-L@cU;fGLsPG+cpUxor7(g}KnKfgqGY9EKJ zJ1WxdP;^)u+`Da3zO`vN9wiAmo5N~m%2VKfn4huxRY|-|u2K>g*!1<;heU)VY?>>s z;qyyRf>x`rS)i5KP-TuXrG5c!;I;6+S1~?gZ{5k4l%M3~q$E4$?nY`}Nq2W60PgTc z>DWx8-Bq0naHRVs4dfz&at~8n#cHr5+axE(TtT3dPk17FFuLyLqUW|+UZL~ms}PJ9 zQZQ0qiB{N@>Ng#-{elm@Bej7-G(?Bg6Q?Tt>@y3BZE&YAaceF*F%hv+ zS-e=YIyi)JgL+JDM-_eY8<|Tk#e}IY4BEI8R`yI+b6_YDip8WvLH0d3U~0@||GxBB@<$49-KqKvn47#(^sl+RLDLW zG>$H?)H52Zso01VfRV5U&nZyxOvhFQTvENFv*C_L{SBKb%4Y-VR?CV&#J&M(9R#d3 zIWJD8q7DP%cfG1x0J+|Zw;;Ctjz=0|Ck=%4II?vu>PJxg(?}cnah7{uAS)T2Ny}9XUfsNt z3RV1E&v)-iX_8;y*^Q~nOn8|gX(4HZWKhyl1HoexR-YI))Vup)XDqktnGuo2{Ljx4 zN2iSiZ2?~~)XD7-gD<4#3T}p!@O(0d+R7e!&2qrl-BOS3^4c^~VOTw=b%#zjb8VBX zA+&|kcNLtAw?=h70!;|n2sRN$DVGlV%-}XFiI%emZd+n>%g&S9L9OfggD$zR0vxn9b94iISKS~%!)k4;mCZ}4r zSibrl#$Z$28&Bphkc*X!IS=Vly%%-id*q0@!%F^+I$WZbf{TqtNdv5D0&Se#{B%M1 z^!_;h6P1Dg@sbP(ZHJvR4|MYtx-DD2)R=M%89mc|AqhHbOXgbd@e=vkp`*%|8wa&@9&VQddmrhtym>KRb)E!Me{|yHsg7>{BSrhK=u^AORoWv9H_4MBPmM_(H z79F2zFFIm_QPN^tiBl+|>*TP$BiuYX9lnJ%53NZIIIlxcd5SeoTY<-6g?Dw*5eVUv zhSe4hMt{nX#opJ5ikAs*CMfB^I|>c;+{-yWrvzN$H6o@IeD(zr(rzcUM+YwDE4js8 zV9q}gNbdsS*Hgf-#uc@^naJ2&uDoJ~Z=_GO<}zXO>>H866||WnD?L}_{hjh$EsU}b z6TX89XB2mUfYWxlJPyut%J>r<;qB*ZRuBFA`l$iG{I&}_`>b011 znfvzo(0U*Cb%;KqB!yaH*mPUEbz)hN;y_M~){JM+xx4IAbl*0f1rHhT9o$Wrk8`sX zsS{0r`3oh8rNlN~l{AJ|Th-*an~tiLja!dc_IL-L=gc^=5HXb%^~Mx&CL(I43RluK zx1S7zH=!me8wP|!<<6Zv)DkYta`w}+ks|uCzD#xD1F^M(dkVV;%|PKmel{gjutDqk zAnC>8ULU9jTAN1}0y$rrcD(JaKb@hcjPns;8yalg%ZO;XU|g|{uSr)>WJC3PcSypw zK4^EW&>TO>i6*Rsz*;`(7WC)@i=UlK6s-b9=+IE6KGD$CcgkD1kr=tZop)fDE$OUE z8E{HoB4ie22G>bCuZ*QMe*5)!9s+uP3H*oDHJ)<&9#7y#nsPJ?!knGK+5EC_K$T#_ zKJU|F$l#01Hlj_U36pNVQ>8EwqDIMP^le5VakfHslz!`z#MzYUt;ITQLh+iLZ|&sd z1^HFK*o7vw*&by>|Z6>~UlGXd070a5K{lS!7jC_J38@FeD`(To{ z10qY*K9CpXANXLDP<}o&(=20cIzCZDFo2#(udDnZU95|vQNXu7EoltB4Eff&4GWw> zHel+Pdo&kcyFFpzIV34R_x0=yr(-5;)&~##ZyAzdysuGa4iIS)&M+iv!*OH+^3Y6) z1!HVX`dquA!i-?4Z>*5>5y~(m8caTk<1_W#SY2KnjAeS{g^wSV!i~V9RrIM6(h8}h zJBl))276P09mby(W%$o@6vStiwGayUr93dGN@z8lbN6bRB%5M_-o=b(P2Q`$yebpx z$`KR7)l-&VcQm)_JM(s{#gjbAI`H+1p3cRgfeao7w0J*jbt7ebu+GvA3sE1k|B@Mk ziH_zhNW32qAr}3{jbaGk)TwiN1_49I(712hfz*8n$Y1DB?;-SXp+3%l$M{*GK>kE+ zNx*f$aD&B4Gu(aFbNj`V&NXSTd3|!T+X^$*!M)++TU({`w&^w3^FZv%Va$$#Ez}XIvGV=@ih`ikb zm6|_r9dUqssV5BEsA7y386l8UBfF9`EQ}tkmn)NVR`F=Al#*^$P@>jg7w2Rvw-$$^ zYq9U;y!A-K+9h}Lf4x2kRU10c`(vvIbwzUWkcWhZjHXY_llxJ zrW#gkU|^iNDMPQnMMBI>FMzt^gFDiM_Ugqt*F{AMw~!4=l$RJ7^*=(bHzZ>z?`t^V z9t%!DLO(@RIIYZ?gI8bSZHfEDpaFRFGrVZBdaiyA8~Z44(;gL3?2f@ovgLjXiLgy* zi37?_E4bh9SAbQx?H5@KmM7^Y4#0fUA=$@ENQdvx2WIMgmxu0%YWg=M5}F`2vR&7c zh}bbU3-x6@oAt=3$wRmIMyZjWQMWtt0|Xl#;{IXdeBMnLpF;$Az&EdCc+zeI+>6*{ zs3;pNSIi&eQ2y9t;L&`Z!C}V`umA^w3726o}fx7k1%R;?8y_`)I2yXh5 zuG9T>d;OtK2*+@;zTSOeW1XR2RswSYW0qDs%@KG>W3*mSd1KV6QDj!&H{wuSQR z|K_xdEVGJlkrYR21o-t2+a8HV3G|H*L>SsCas}RM6(Z|XQtlv%K~u;_Q}ykkm4Ub9 zaKzgm<7Sk?!!-*?!?Aq`?VyQ&W6 z<;KH;6M_CWpaV30F1XG@3qsNYd?*(f@J69iFzEr&N6TIHJ%QTNhNsInC#_DVJ=WZH ziO56b(W*k~-W2DC;J0^lnYM+0?Fad%t zpz6oM)WwqlaazAOt~8QYA$~y638Dl`G>#2n&#(ZTazB7pGWyGy?J^t z_ikAY%F~cWO$khhtjNz<5#+&M9=bi<%&ha5?5U2!Gp5h{X_6;%qM2I!MowJ&f%yvXB z!qK7~JqwlHUFt<^a#@upp79rNX$g5Go}I%(Z+)SA2_j!Tjh<lZN5j3P1AiRKp9HNM#NT2Wm3olV^d}@Ao=G zw!72(f-9AwzGZaNwYEf{?luVPZytm+Cl_V?skYw;6y1lEnEiio@r;v@8B~I z*5TUwQSeZd zd9*;UVftxi!|M44gK8_t;hMG(N7m^?#xgsSDcD*UT#p=C?AQrmMl=<5>dLf|GA|T% zV_xi7PDnd-6N)K|bsrkr%(ov3W#OwQV9`qr6}d*eUs$^kV+|()^HfA2<hiaX z2j>C^t8f}R?Q)ELZ&J2*uZ?gAb@2M{Al;gWqsZsea% zz0b^y&7Mm)%ZvV^;C&CG@Km?MX+l0v1f7uRuoyTCnxe&*Z|52hHOeMvv`VrqgfGVr zj>>gSz(EeSjv`Bw&$27R7z*-=g4Wbza&Nq@rRrNec|`r-dEca=Tu~42zbQZRq16|zIAg>B~2?-Jf?YV67_Z}aMBruyGr;D@jgH-u%9 zn_JB%wt@H&_o8(^wtTwUCE6cKd}s-%OehotE(ZC}e%TQ|oobzS`y1_44GH1xMv-R^eWzT;T zmwJy}>rWTt`9`p{F%7JEi$)COMI#nFIi8+5J4I9ak~}8|eacsVwVk{r zz@PtQJi4eRV@fe(4C(#^ZRoiH5E33nrU~KCuY{sYn~3hPk#;@dvz4v50A zX4yHc##7?9CNo#uSAgK#b-3ji&v3fhyS*Q0qCYytGL-f%T8JZ8zX9->Tf?km3%6e+ zpkm^xN_o|!BW`?2$6Y@!IOPQ7!mj1qCerM7IhJ9tq&C$D*A$8nW~gEFN(dieT<;+k zuXXu9r6dVxX>XdkIV^NdvvKk0#7*A89W*o<53t7DN~1aNvXy?_Sf~L@g|JVA*TipX ztTf#BXpVJh-04TFI!0C64E`R{lOd?wuvCczKGSj=?C&+foA|u-8q7#vw6e3-;_>&= z@!tSRf_5v3k3wO|%6ZS@W7w=}H33a!Dg0n#SfioNuz@#{Qy6Tna8zQKVjIx8-B zjn3EmL9PuDS#%iz{jG8>ZX2E8{WI~H5^h*o)EivjZJc?1*=p~!H|Ie6YWaknjLUZQoSz zs46-tPRk+2a92DAro0pEvpdR**l84p)#H=L4j)g|mMy0ATFj0{CsoYMsy#qA&g}Dc zu*Owd2Qym*QBo6=i$w5q-@O9vK5TMA~O7eJf_ zdu9f}&9Oc{_kl*H8Tnzq)vCG*l3ff;o!Gen2iti*t>XZ$rL_Z8)}%mV68y5=+o(ZJ zh;d}0lX{>k({id=zh`umwwR_a&FlR9&uuJ`E+5w9g}!I@qAu;bvjx8{oEfeH7+78b z=cG%;U^v_diJuL&?d_g5WSCzr2s~7$h;8Zn+oTg_d&;6y{e4TwxPhqGx_0UjKH_P+ zw%eo8rSa0o2(<{h{siEgbw5ihOZsL_g=7t7BQ41Qzaf|#Z;{zOC0hm#{m6eMd8)!; zX`)^p`P*D zpR7dBlZN|JEwK#Z9quv8EU-O~EXdOKn&qgjBna2DB3H^X7p`I!qdqcbK3*k=Y^}O# zrq-SB{b3LuRr7q$zcDt=l$z7+TQ!R}z z-#5mmH8)o;lD|-r(DkVSP=!h#o2q=W`dPcdaIqEHMrleFk4#G$^TKO90Sa6cHPly% zl-D~_F+pdD^iBYsfKsKuH0}{;u^GK?ppKNpTEx=jl40Ze4-gkyTakkUPvYV@p{t_r zvVZKZekWsJ!1>DIroDdelqr)0FK?0=vZTpm_qR94g1_Z{NGA8&PuVR2chlw40Nzfa z$+pn!cW`^!MUJ^5Odu}aGp`it=kK)Aygjp5r16DztDGkx&X3&3Pu*WvbBez`96hEN zf3K)n!MiD^rF>!^CA}aP1`>L6av(ypNVTBU4;a#+q?o`b#Dr-*(r|;=qMKPF?5GdDRhy|jU+M>Tm`bW`Zo2BNQVqsE^tKX5 zN&gXytf}elGVR&T`{dbbbjgV^wARHS6|%!oC~LAHuL~7YZdsM|Buj1ju2jEoSCBEk zPAj7R4e8p~y7cN%Aiz9T@oEujZotjikT*g@@UsjqM^S|_bIcahcW^NOVc*A9Rj#{E zK~I6yxNU;hWLWIXy``4GSu)Ke0WzR`9Hw4Dm>W04c0-o^2s|XeU^n#%6?g2Z?rb&LWJ`J&kN8bbNY)4L|bK7c)2Yj{V+p_&@t}{#gZ|3BAbf z`!EXmg8s%A($_OUVeh5S@YPQL-@w@3H}3i!>w@5Cavr+S{9Rhml^eb}i$}t?gM-MfGsfV=K6r-b)nhQ*k4w)BF@0snDV1^Q=>NHCOP2W~O^Sb*WNx*DTyLm^)nM*U>)Y(C z9e`&~PSlrd$}R0EC=8j_2{R|Y*(Cb&WVln8S_6jaV`36{TX%gfa>bu|%*exP%def; zvd|(2Tp}uWJVIO=ym4m6B%#W;HM-|dP7qZT&^7jy-o~ACtkO%VQ#39oy$IX!;gjKZ zjxoc@Ck}HceQ5Q^$G9x}FEiHHIX`GirF(Dv{KD$#drCasB^{k)TC}>&zyiYVOkH!@Aw%xw?v~O4KU< ztBCfm0#E~6oJDE<1>OcJGm)26>Tc!S&SX9Rw0RP#*{3ASsU$!#0Q$A$gI*4E;o#g` zBNp)*_je`bFB`G1=e8{^4wv7W9GdI|bQ^A4rn|yF>^sT&%!b=-Kezb(#YGr?GjUL8 z72Zz2QU=>bznaT+c*MxSv0pZ%?INuplmd=eG zY?OMpbP?dhkeSKDw`Oqe^6jjTT7Aq#mM_x{s*?dz+%VRzfo6iwp~DpYFEHMhOH&b> z>B&R>ZxtTO0Z;~HC0G0hA8`AJkA}RTQOMtGEpoa5qPwf=fd+4{0N)*S%@TJvxIsyq zbx~_DbY6qj`eMn!%1Ic&^Jt8FBpj*hQE`J_u^1b{a@kH|`#rl+l0msyH4<^FhM!3) zK{OIjNpC0sFOE@8KfJ^gEuJAIm_OyF-5*G)Pg1IvExR>5HYz2xZS%EhC={_|1}I3E z5Mr8ka6Pwf?&0>ieKFKjliIk2-nG+kX=qWtp$xc?qn*yKT!+iQzJlokt}Qai^ovhG z0x7}SYnSBzJ}a-rC`inBqgS+vctUp+xStz}nSy8cEF2w#j1i|DKzlPS+i0i`$b>3b zThl-ec~*P?4}`dE?0iNH_5&4qt8|e2=we7S*%sF?pB7Pi^e&P zYYPqd6;4Jvg%)BP!E)ZWa!2!87b3Dipz}-aQ{5pYJlYDChtoc)V6Iq_FQA}Ad=v&b zMtRoI$ZLs6Ub zJMsqkU>_$hetv$aC*LOOn<1p7*bb2#R@gsiFKXb)rNdODwd%aJ&!lTa9WUOH3 zc}|0c!}*=l3=G5UJ@WUN?);d%%QQ9|V zLtu(-V3W+4xQQ=o%aq}@=^Ce{)j5OeP|mq8pd!mId{1+OrI$%S2Vk|cf8lWnx^%F4 z_X`m?TTyh--hpQC45{3V)`^yD{7Cus#w;2hW&X(o71g4@5%6NaZK0U61SrOI^swF2 zWr_WB!-JXtO0cEJMe;%8D+j-&4!*dK4}=c8H;kcxK;q}?(O!B}vqn(=tvbOABZDwh z!0H+DH{oLAFKC0VmyfvY2aGE%=YgHOX?_?M!!*a|H@1sa`yI9u9>S1h5u;1IBHH$O zwf6=-&F@yklD*wK%A&&#P@r&LHYn*EWNs3uYVvX?YpI38fSZ~NxpRza3sxuWUZzCd zjXRMu)Bv1|76*JwXVK?UZ;QRYeuj{Oe$Az*q?IY#e8s>` z&(iCzhGXt5>r#~3yLR2q*`>%B+3G7-JkaCYJ@cbm(n?I1O<3g#igI#_#aX?KKsTRZ z70+kS1zdrpd&J<2*ilcdNwC*?a#PB5k>#F#nI`THj7>K^`PAz{k(;Ums{*9raQKob zC(EYjOL=k%dp$;qPL#o0rK?``yc1}mZ75p%)sb`P+)OJ6(0A^&6$Fpg(+>OWU8ryL z{K+l}3U;$N(KR_fe5NAhO;{FVYGTFM2s2P4$ zDagHI`d9&}Rhm~+fAK_f+jiguSP|C-()_^vX=oo*Vn%?$Mvqc3cI*1Iz0FgD(UK$u z3q5R;Fn+Y;uT)i--b2iF0a zjwH%u4)3{*POLQ2rMNeay}=I{U(G$`+t~@fO0-NL6qro9-skXm%Oc&zleySSSwu|J zd7_7zHBA+}#U$9odv=f&#~*E;DXoM{D{ptQ*(qPt=7*iGoo|R7Tui%e>wuS*cx>+W z(uAfB_$i)Kf5*Uv_*(4}Y0>g>+>LY<@dj+liy*MU~4_0f_>LVa4&(E2rA$>8q z);%EoxS;`Yt>3AQPtMEuK`#RQpnTwL@Ng14dY^ZD&RYKO38Lm@P`IeyK7Xs~snyp* zR>6*e1_}^_ObT#18%P<7vp;zv^=YGXd<3qg-0;lahw)tw4$1sXF3(IlBL(O5toBcF z6has*^SQzKZ9FzL;G#Y98l#Z^e3!^qQ!q0==Cx*nqEf5UOZORDfzEGtKuDLT#<%b- zVb$8PTC@uVZu3^7r)_o{D=e@Efiq?r!)N$|OmyM|`fBVatiL_pd~-n{%Hc{oh7|j* zCPv`b{DJYoW^5xTv(M@+i9zU{GhL2awub53Jrs$uFmm>IdMPX^qFe1mw-{6wGUpnn z_&ks=K*HHIZuI#N65^*eLKgAFN#^8B-sZO|#u>G=Eel)f^fU2zaz~iH>G*ohBi1$k zGT}RhgseOHn5L`wrMlaes)=@uD{;dGZPIXV$r}M)B$A)QwbjRcQtaYmlYW}#(v|Mw zaq5Wch4s>o4<2j2l+DLwk8j(ssQ%`F@?U;EczHtoUACh9N?X?;QrzW5GhTR9P}OqZ ztN}(x=u_42QU{c3-%R!zZA-$#9!(X;r#{F$m}7Q!83XF)4MHq1@-ZowYPB4@n&T9# zeMr`wD4165fD)JASl#KhfbFEybHEA7uJWL##*Ne#Ncv<`X8kK5!xTe!DqLQoOG{K* zo>CIa83mn`&=Ur67+-jES=DXSebZ%e=-!Ux7XE4QHT7qHy1U8+5#`bk)>mhjC|A|3 z3~tAqX71{Yyq;ZjjPh7dZeHmz&wfpLnC0@^)0y3J<|+$lkgqi~LhDXd``H5RmRmf5 z3;D7>_EVAUL9U=`=_-3dzpufqqYI6>rI*M3*b?)lJec1*3B*}UNyvInnz1Aa~KpPo@S!w zVINs+;gWRDxR~RvUTj?IXJrE3RRk`TGRU|oKUc|YsYbOFsn04tsjX~41WO) zgFng<(CV3sYe|pEE8;G*Cjfy0VGg|u9qOODDxAht0bM0anGtp@XA3-Ep1W+oX?xq1 zFdHH;*DudAc(H9X>gwg#JxS~eWVK_gTFgv@duyf=7lzo>n(II7hHy&i&IW(|X5Nvu zc9tg`U9Wvk)HRfy3wk*m;ON|JRnAgCy_)>_z2BLo$Jc=`Ds3>AeoJ=e{*PJ!nX9c9 zkH^h+W~LgC4kKgwTEl#>Wk zmVyKhLd`gBxy2M!sCo`lV%N#csN|E#2!CxCIXAmB#Zno79BbC$wl#ADDUki9AX2qE zd(a0>rWSS$=0h@~lM7jO9w*g}-Z|QK%r;7K6{C27uNepVIBW51+JTEU8f53@gSHDS z@5aWi>+S889N`0>GsiU48qKa0Wq2aZmdr53N&!TeYOuwq;A9;;5HWvwEzoRHYy5YA``J#o_TQSxj+!UZkvArgRWk!{Bysb9vG<;F zO=esB@Q5HHBPa+eNRcj8lqTIlK)R^(5)`FFq<3Ou6zND+iXdI-AiV@fiquH&gx(?a z8j^R%nK@_XIpY}5|2LoB^X(?wWtX+qzSdgTUb~7u%1B(XFE^?q&2e_FGfn00U8ex` z1o7#NJDxOF0`eY8os;0i(uM_L>&YAvw7k9}@}k7lB6K^UM|cfOD%_D{zWxC9u;~u` zfbEEh(E{?_%vR;(q+deyc-=jnhIj+3#3lWrC12eaWboIPLz0XDQ+BNg(cj7o(ck7Wm@>j6Z) zgF;d*YB?(nZmJHRk$*(f6Y>cYzMoYoPbbz}YPYJJuu#5_M(kYYRbBDDcX0PC>2p3W zNrjWRpQ^&3t_qUUuD6$lKUZ}Xpj7OBo?^^Y$}_^5WecF7hY3IBZQ5udYt-^Gd_`y?Ji!mb&DlG+b6y4IJKpdEu6Qyje>3bKe!# zInoDLTfO9j#MYl;FECYWc$5RxJcsLEaw~XmOJ^RPoo7Im64k(K`%X8l&&S>8f=BNr zW?uoa?FV4r*iu=Vbue3d4o89i)SK*_EBqa?8-cd>InPqR8Z=*vYOCstohzB|vaB+3 zK%|G{RII!*)pE*G-dC!yEaO<8T^-NjIT%5GB*5*vqABjC}T3&-|J6{>AUxQ!?o>%Mb%ZZY4Osm`^;50G) zOP3FdON*l0{6mNOPn}E~9@O=oJ>GpH^@GWwHFdP@l2Qu&XbSowb?pHYQf`l||I>zVOU3T9|!5j2h#p8xqlZoNyiiSVB zi1wx2G^pqmDuTpK9E#V*iW-)0!r#;1XK`GMdO9mQ;6o?SPy4CLw8ck3WWZy=Ww>4N znR8{Rb}piR$Fmx)qLY6ww;cJ=EGS`AhtFS5t&(@Y)wbc>UfJMG-6xlz{+{kDDnAbd zO~3uiqeT8J#TLBFwC6#%Rfy#ljb9=*__?1?**J!wsq0mQj_Hs*HHAUqQf>iVGeI81 zzwnq48?#ICMVg2IH$?a6Zv#9h+en)^*WYzjf{0i=Sr+BXQTLv#r!97H{toU`#&TDD zMz%CuDBSg~zpaqz`0-A3{8sHApbGPlt3txwDUgmvgI(F|U z3vGKqzq!d>=c-Gwnt>$1XOrKlQ<-E8txQKz#i+(<4$E!5vEN@ay}$HQQ_#s%r|Mke z>Hp~2e+bAIAu72A=U3u2adr+mC&o-GEyVMTa{Y&XzD?y=5jfv1*`)`y zBl@hq?BG(`smv=`UA#t)FESQyWZfTxo<2xgVn$SPbgar(4*lM*>eW>`EfW5&< zJw)M{;#hS#f`;Oo(*1wu@fI&Y(FK02|IFJzTOCotg7g5vC38<%B*@OTCm8hI;vu|6 zNgv5?uJ?@#ydWcVB4o?S?rOVSDrMIrxTM1==6qw>aG6rV&+g$WkS%@pjw;lG&8C`Rx^npDd^eE865k)tD#{>lHH-LDoei%faU2Ag)%%JC=k5%DTnv~hK^ zbzd`uj0W|$L*xH44f-5F!dj}jIlkJMf7$5YE|xhymue)=_2#@A+3zCMjDhdv?~zp4 zU@yHSkWUYWxZi`sV`qV8cz}CCgJ><+AckibBi;H}7v+{-6Kix`Xe_<}doR|H%6z zfdU~qg>&T!P~D?=SLHSjR?U{f4V2_Y}i!Z=8VF3NdCW6;F}llD>UHkssh;$ z2`Z@apELLOzsSy$uLsKP&%Ljrt$3`I;Gi{6Apx zRgL-|u=$!9K0@^WFJMzkEAZJe5CSJ55YL17*gnznX(rAlh_?>=cjI+}-25ahd{iqy z?H`Ie-GTsLaGyi@>mu;~(kKFPpedcdo^7Vgh0XIAgn*8(ECF`q;1p&QzuMAX5yTFq0^6_79>0jv00tn&ipl%S7 z(EKm@XAuQdD(8L|!Dmf;SKE(w<6}cL{#0MZDgQ;2|2-w2xq(XQ*Qb9+B$OZ<{F^jn z3IM6}rv9Iy|IbPKpP~Qy(jxo2q0g@;=hc7D)fp4~13ZK;-)X+{Cge*cA+DU-<|v*b zBq}yGwv)m}2(KNVq+#BqF08=xCv6hd9E}+revbc@Y**@$`Y#gTYsx%h5|1pagB89= z=O8!pXim z`S1+~Dc^?VUsJyQ?}@DYa@%SS_zg;Ix+qdz@egrP-Gt4C`QX%Gr1$XWpupGhdQ3=$ z_Ups)pF;GnUu69OY~VTl{@(W)7Xp{bBn&PZHT-H)-I~+^n{e&{vvlGp|u9kw!lLQFtLwC`?)+lRS4aX==RSM$?56oA+6D{{)a7)Cp3f(p{yqvW)JZ? z1cjLy%>)I%H`=9mJT~V#jEzdm5+znJ?yaw`ik6^!D#f+}IThvQGiZ0-5S;#s^n1Kp zvR)Rl*qal$n2Qjk6)+Cxv)EgwG@Wja($vz@Vk9?2oB$KE;Gq8_VIn`xvf6tf&`<=$ znYVhQU+H4TF*bUK73gzJXc@`vQEcY9_ig!Vh23c?I9kfqc$&j~TWagx>;X1Yq0%n* zjhRL$de8g9`n+#A$6|O48?3GPPUycB=wVMH%6?y06-!VWWNf6eVHN z;TYSCXPbox%YF2F5c?dgKV0jsLUkLgR<@vmHn$)fJ`4vdLLwm}lfxd)gZj7h^jeGB`$!3sID=x$?+E(g7D-X>DVb~{geb6|uo%pMh z>r93tB@_~mtWQ5<*qwMu;1O>IF|zwVPtLIIw!BSsM!WB=i@Ah4I?Ctxz-9(!C*Nh| zwUt6@yxa{Pm)|eB^%=>~Dl$0VkZyv+o3=Zy;F{pWu~FcH0Ef_ z+qL8zFiu9#CI960&9U}MpBFudF^rO?rsnCc3>-J(%WFIk=-LGPnlFz}JVWB%R^A!* z@fIDc>GswK@!(NW>*~pnp~hKtF=_X>C{7sNSFp3KSf6D3thmhfp6^9DEI&VXdr$BnEoSm8qDn$y3z-pr#`oCr8P6r` zj^29p`_&OwRNz$(^=472m9h@|)$62n5@-yfZ2g^e;X2N9ep=9^R&k>C=ypq=%Fzu6 zGAxCd35xfX@hsaL$o}2Yj6`>SA5SFO6y@#L_=#1qt|LXUA%jx-@=E#6&OrJ5h^Diz zBiPPoKbMpCHmO0DtVm*3Q}&2qmic4dOgLr_C-iIQgN(++R?c0OqsNir8(D&nYD?BW zXDgcSBVjb;XZZu(_F>uhC2{d}>30k=lBEcfO=9uv$GajxHmk4c51-rkX8@!neLl2BO}eKhuX zcRfbk-)`hxz>M>T1{C=^K8_YUg@T>&L>FHyAA9~0r{T5S3T?n^-ZaidYuLH54On>^ z%SWRysV&uBjo34f)=4aXsTr(uv-}0&50T(hnc4Y;T;L(xla$FzR(mHc2GZ8tC1M&P zA63qsUv)wnF)n9LHC1naB=f|k0sA16v9|^ohByU(go<;kJvZfpQ zJk*wUntN@(6%`|o9<2^oNFy!(*%w-KO`t|*I$*cap0iF}V)@)irE6fWQeo}&rWyiv zjC_Hn2EMWe_qzu>OV~>$hQ!UhhANyFCl-KF=YL2Sv!emoZHzYT<*UdAYw+guRd)g* zU!?jN47U@EG2uMyirF{_Uas0-z}2l(o@}DpQ;T=gSKW=td#IIH?xLTX=OnSx56+wg z>t~|I3Jri+dU~Fi0*emFqH_cXS1bFjiiXe1&w?ib6&M+O-qC5;y-%Pp^%2hKZJlGROx!Eq|f85@4q#wFA73Mp!znI%hbzJ0b9;_2`XUMhY;BfcgqOU0c z4}Dp&9IFTQn+6lTLq4=JhoM6ov$)OO2>c*aSo@s&=m)z3Yo{R46gO+idc^^BINXP> zIWYEuHq+>Jv4)CCZV#B}=~lYfW*e092Ob&}nW@zbMe*oN?|=#j;RuKF@LmEaqQDuc zr3GiE;k@+|rUYya0&-l@#(VdCHnJp=VK}T_zEMrSiMdhs7iEvU@gv>)J6`C{z{w$$ zxWK6UEUrEax1o<&k8y3>z#ZP_HLhZ-acqh#!w&MK0L98Qk|QBt?XuK6l5c>mE{+BlhG>owYikg1^{dWqATv#2e>Wfl(I;n`WM?oQ9>Y4rxGP-I+UO|lcX49^dbN9yBuxv{-A2R%$wziA^atZx8 z{DNrc)v;$kO@l(dONBp0^X|gR7YN(NdW!j0G?A^prnSmYv`GMT(QVCk{^OI~L%$WV$Do$r2o2k85=$zgvXZ43FffTjF&vxm85ZD_DMHtmaTztmi7 z=E-Xi@NsvQT%SvvC>es$;=G!b2FiujP<`zfv(|(I1(xY!hsNeN$1C%yw`0ntAOeA#M`~ic%pEotMtF|l zMsiQ~qNvDuO6rv2HhM3uj{7k+u!c&81EWk*;dH58b0AA6PvIUnx5)4UpHinNbhK*s z5Di0FAk+zR=`A$iliOkf$6ya|X0ES#)rQ{BmbBzbn2+!Qowuvl>vgl=Zc%D&ugc~P z9(Z*b8#sUs6sS3aTMf;qgCQ%K?{Rr*l2XSgv2MLR!hPz2icH>;LueEN5?+<>Spw^*k71b(9x0GxqOz>J7>|3=Wcu8n^bx-vfI;v$GSC5m8pX77G9qxnzEFyY>dOydg zQbfXM3{J}8op!y!kIBbPu5B?YN57ccu4=8pWBLR^>R_V`zq4J={k!*XMnHo&mor#7xJO8KTXX|&# zsOjTpr^u21qt%|~vz@ZlWRtjS=_9L5Yn>{2b^egu+rG9n*y64f$JzEh$DW>IC2Z%D zOEHjFQLqi*w=zk)dex{KxByE=tAiOz6Es`$*AqpF&Hl1GkRa36ixZ%(dCAUe2)s}{ zq8AZs)j?d5_I&clm-CyOOMWx1Nv*_nrT$QBq(Q~yy#B#r>%pQ$iVhulzn4#yPW3;p zjTN?zRb7p-Hhu}Ls7mN;TU-p#fzZZKCZ=kSEwJabA_pv(K8K5tM!%-6(u3{g%8m+k zg826qQ23^QBlUJ1ttAU0bhG~&x43h=@jSLhA~=}r0Q(?IN{) zCv=8wI&Mj(Fk_2WL^-kBb3?6Gn97t5twz}dDPpC*L0Q3 zB|{3AZhu6>a0dk-B){8gE=>(Az^KLHaMSE-PyUsP#oQ(R1n=zuLFa|;%(rj-$@$Be zaZYQ7BO$vr79Ghp`bUrbIQP8kDkl+fFL`RB+I%#2^7xli6C>44K!9+-wKCVJQeg$Q zt1Mda0;pKNGx;t>l`{mE#VKpDK?bh(mV)uIFcf?QeC-ng%&&7I$47W)+dACwpUhieP~A`S5bajwpWPF zPR`Jfj#bAqs;*HOXJ-WT21Ecp4t%tvlw7SPLN*-SoLn^a-s*9iO>kX@o!$4>@M4kP z?+6tc%{-cL8r=)$fA;p2#f@6mB?Xf+z#B86CePL_VCh7AjD+Km+-}LhNhgxTP=VouO)s?fN ziN!NzR|HbKm`65MniqPq;)J{W7(KXDR%1$J)<3bv^_VG9IZ1l&Z)UGFaVEx-sH8)} zZ2s2O`+W^75rGT6HM+4J;XrTTiLfoPT)LYweYjs-rG|VRCy=jq8=)YOM!n1x*3dZO zGGr@g-X71UXO<^6_V{S5>iSLtJ+#ib&qxPKd)2%>$d^K#D@1C$pW`62PnV$JG@MTs z#B!JAsZhQ4P;Diw_)4*0k;n;vi^WzDIBa%IfoY?e2G;Ifi_pz=@UbAFMNG}X3O$f| z1H4zxPUfK6XoI%BvpF#8*v$mb(PQ4Z8taLQ<;%vO6P$MDCbd{bVs*LBrA86_R)-Q7 z_^>N#_@H;?-XRztuBgZ8+O%*Hylb&QK2>utGrHJ!>kBC$?x$MUF|{{?g8SK-nRDl; z1$JHvaJAEKG8expZ)V8Umw<=? z`$3CNA;BlQvY!TdDYn*Q0~d&j%-Witsrl0G3|i-zsoiS`IuAU@`T^yy!SkV7>m6%0Q@>n4AtMmK5+_&dljm2Dgnedi>$`K9q(v zJF>t%Z*jHPR(M>iEs$^W;Yr!fsOJWSQH2o0=pOK^&0w>y8cGse1}zI(_$wbQ%WS+t z)`h|_lXzX5=ul(|2B=lmOWC-WP)|;o^|R9%UCWt!XNZ=$!;US<>dUJGEry!Q<_Ce%U)E>tT%g2^u7$!Z72?Q^Q^KBzu~p={tTH&_6ZMo7F!?Obm&;IH+7$rBA!V#j;vbFxGr)!|QXS9UQ@6XA0R zqA2xk9wvG#7xNERDxuOJAcIPD0k)1M;jjh=tC&s@rn8`tx5V*DI&<4p zsuKYC(Cgi=5z@8q&%f8kcrE4vbY-~wMa_a8P{~%RUzW;eUoXF&LbEdM-Ncttssd7! zom1PYO>K2EiH)cnc|j(NeO%-?P=R&)cBPIqm6$mI6Yk=X*)rZv)TW;WqR>T8j~|PZ zz}ydq1>keBkqSUXI>qRpf}fqiP~`GVyaboT;uW=dK3iEgskfKG+GD@jq1Xs~gE--7 zA$LfHGms+VLlSb@2M;aRhc*$x1e`^Ke<@Jb96;?z+Y-_DCw}d@Qf`wP>b+#z0Yup> zIF`fx8nA<`-rNr3(Z_zmu7$!{11O|-$L2uX$oKk-r?!Mf)_@MA6N4m2z1#kL2CG`b zjs|X1qu@bPczWy#ZA@m#=9bf8~SIyNWK_@y&p(wGHvdLtC7}r3(y>#P|o-Cb4fXUC#ADmXa zaC)S|IZH>8AoKcV+${WSL3xGA+{%^aSTF2GVkkH?ykVj~(4bRZbHsVEx4sA|P2ZKF zfsDy0un(^PJk2veD5neVg3qImC^?s1BIzXdv1FcTC;{%QC13uR`KhRMty1`8f$o)&T`0g9|Y(XUH5{Zm$j;ZVw4aulZ{{ z;Oq43NjCri*TC?Nwm4A%yYlJi-7#Ov!fhHF8bKe-?l~cgTQ0++FhE?$tgZ|~94>XF-n$fj+2LP~A5JnN*3L6#m`B69P!g$$ z^(E`4=fG6%@iqXuqJ`)YSWBN>q&W9e+5NL!<;)EY*l_W)b1|<`W^uN33EC?%LBU%Q z)-OY1YB~|;zBKVyJ@^I`g_oSD+M9_3=`jq*^+YfGbH4sG(LL(1n3K(`mb}w%8Y+)` zEoF+X-mw!JhwM}4;sK%?c5im$&L9kTXbN)9AXgA2Fhu2onJnNN=YBQW%N>UGqOB>> zCS3%gF8h|`gp8-R4tH_Q8dzmwNxZOjZ91qyvQz!>MCItJ@}0J8XHD@di}mSG-aBf2 ziyN-i-#3BhmrQ_PQk#Vxj-r{TZXCYM`uVsMxHb!2$ zBcjhK_3GG_^t|*E06#^pnceXg`*xX;-+>JsmD}nE(nXp)@aRhQ&gjj_zHP9Q9*e-F z9l@23xEQp)mXfeWEap}=l-W-vgXqiFzBT%ZZRtqKNCjpQf{WdX@_YoXbj}8#Zcq)6 zgI`GBl{i!#?4){LLjMGR6j1(o;!fl!$aKh;+KsRrmY(^Q4HGOYFE0<+DICD#c)>m; z(3Yw2WiR?&=EH;x6m`YfF9saGiB1uBUN|%FI=1=Y&hJm|d-{R3%{*^&hZ6r22DZII zQkI*gdS){(#g9)<9TSeSe;&MiN`g`%^`d&NZ-f)GziB|@Lyx5SxBN-5$raBeM(Q6v zdu#dZ-dy{%`pF0@#-nH8r^Gj%(%?ddvFgVQsDEOddN^^@Uu{CnN5#cPv4pYLx_#7= zjKLtB-5}IEq$VL8Y3!L(y^W|zD=JQn-(Vt2;{(JoOJrWhcaSm9Q;Xp+8@W%~3<)&n3YA)DXka-e}KB03jGN2VP#F=S_Dk@7LXQ z=U)?x`2j9-oDGS@LSUH%iui21>7~!OQR^I`=+1q-EWUYs0Da>}1!Sq=PSOseoX7JGiJM`p(lFKgO&!7xhw0G%_y=309J{}fd#sd0hFru7?AUF0`g^SQN0T|3O z9C3$ibicPW9a#Q_1rXHE(}=KQw~dX9n*_i#@b&B0yS1d!r+RvN)|QHp=^1^!y$t}d zPkw$QXX#KoDqUGw*|iRY!-LYD&<&<=d%%T-#wQsO%xb}RF;Z4XM@N68qvHj~CJzsf zN=qIB>k*3)0H@h@awu)bux+W7Og4r##?)-4IpMlt;lz&d3E!d?GT6CUHTMGn2kgn#&Y=r0bl#_3AoMislwCG zxW4%vLi_NihRd$u8L}8h3*ztS5#e77I}M=Yl`E%zA+)!IzZ%c1o4_N2-PzB_|B=CA zW(A7-@Bz!ugr#Z-S}_06zj{1Fb`AOF^q(f=d*AZ4X_Hj|_^;*DjpKyo#J~2UzivHu07b z@$9gbd~V?n;$d#7? z0l!>`DlRVe4H1kv_*m-k@ZogQG9L8+2Am7zu(;2d9__PJi62L)?Kl*M12EtUYCI(V zAPV0*xnI?$Ie}X**>hmQ-bCk5_ak61uVrgUV0(M}MOKeSiP6(KM$THB8gqRkBMH&4 zy%vbVdKBBSD(wCu>GEt^jInaw9c^t|*xFgxX{dXPL1)QgUtTBzcYp{zN=i|e2RmGJ zo0UN6JxaJParYlsW@=NZKB>LyptI3D;pFU`Aou}-uH6T@rx5mODbMXxGHm#IBXEH- zb8^&NNQc$q#a=LKgp+IojtE60IFTKQc4viYV~D)9wRHuW>7NnQ%sEKD26G@$;8}qX z0iU%%OA953Y5_2oAJzB4urj!gIO}+<>~AfSQ|+7->K&c(26#6^3uF;xq@vj97clW*g2#nO`XSt5y;dqYe%K7xTcCp@_s#&QQUI`Tp zQXWD+KmgMHW|4^kO{llB&HsQnrULu9r@*BLXH^WTJ4z`T7J_$YAb0NuVTPoXxOagY z&>(ZzC9`$ScJTcr5VqZKPATr{=n&L5+S=*@16K<51CduUV4yOtyXTsL0w^~?G=kj8 z#YMq^Qhf!n@*z#CPeJjq>^5;WyhxOjg+UV5Tk$f-CAt zX-1s{Y43eE!v+x0{+?wgz6junS=CHm-V}CCP>>M%^(7eLMH!vGD5iG9loq z)@G9F9u1{S`}P^ae^wkZ6#y>UsoE_EX#0T={l2s`L&<=@db9H$X&l?`!3Rp8Qvy}1 zKY6svpEWwewEx-f{!Htuk1LZl^zAPNCv7yOmaD*qgiT#FwKhv<3J|GcfU|wLTL=Wr zT>ZvRk87t+WoBmH?DGd1OVijocLxhPcF+I?4wI9TR|IlEcMt2%|bRZ*$L21HX3O@WPTNc4`6Cg6Bs_0WsqjN(~Z{YEXysC9&e5}?Ugw4KKWEZ6L zfz6=QDSAn;*)ByTLX$`KODszJ5OE^y<5m4w&sqj)iU7PY~h=+df(pVK8=SAw2Bdp4)m zAF~1Iq4uf(&>sg$JpfFRF2Ru;$Bv>%>Rn#cw>QBi4;RU;4S>E2}$B4Iv3 z*gOEWc|)Y8rnWZ8gcCb_Gz?-z_o`{_emd%6|Ep4%bQAl)cKtJ) zactRKvJMRAi_nQdb z_AR*IE^M!aHD9RTE04Olbitl;Zj-G5^6>*k{1VP<#B=GXuG8o{jH9!61)$e)jH8Iv zTCN$1C@sYd!y>lO+v$+TpoORN6{32$nujwqv)!c;oa$p~>53c3uC{sox2%a}UOiP9 z^i{`oWDmwPcd2cMTEoyO*Gq)Rb2Jm?co+xaWDsAo;!SYxiCaWrkax-QkP1!{$ZLZx zNoezhEXCLU?!{1VaART@NtceQ*JGA*1+wecPj3b9CB7wPQtqo2rkPFK8BtkBbX7UG zODGN}QWsuaT^~oKZw!Pb4$W*gIE}<%f-mpA5>GP>39@PJ{FE%_hMC?(*EFGgc0>_p z&c?&^_OA->9r*qXV=Zb`UYz8FXw1Hs##Jt~2ra!tq{zWG<+B@wfh>pMT;nG#g+!q=E*_iaeF8O1I{(M*E~`gxi?VrQk><%YSu z-hxKxC{+AY(F~SX;iai5IA~&jv_92j0fi#-kXiSe&j{R4Ff4+;2TK1QtTH!{j~Bt( zs|OYz&c#-G(IZ59r}B@r|HAtm4j$zK=KQ?*$V;+QFOS2|x-6+c`dmId(c7c6Ynz5p z$Fv|g_;JZ~Q;AM0#;iLtulpJgC7RAju`xaJJXkJOT$lL7S2`Syg?(llM*$l3{jPL1 zQ>UJe#oomc1>|iF;s)hfI?wC}TPkD2B-lg;qB_9lgqM2@-wQVJ^A=g3 zI6Dqoon-m*l|n=tr$d#`XAhbIYBw{q#w6z!gia_w zixwec=Q#vpd~YnjO&p#Y4B6Wv-Pq$5C;idRr7e7SQy3>?lHfZ)v)eFx_NSWKo5oC{-4??n z&pI`~#LNjaS)cN25ttSPa6x9;6X^SlJ#E>V%6>~p%g&RtDXAX=%!eRp_Y@bo$>>hM z%RdpFKWkw@x9|Q^Qlrwd;;QtC@vXCNzz$uf#;`Aklrn|HP|9@R&K#USdow)#$EYy@ zGQ=pdI|w;3Kb~O8;FP}K<>~YwnPh=pl=A#9?W`J#>s}=^p|asq5Aum&OxPyV z5j`ew?TwU7;z{#eBbV9`1~%EGDdJ|2b%Um0ZquWKo@0;hYDX$+X+69f83T4;%46>Y zMrd5(UkvQ#q}kEzKTmQb(MIyb^9tt66huuK8Jt6#^U`V-7s`zA)mpuYq>XAqf5B59 z8jJvl8g4QQ13$lgESwJ|21|l!Jka5~fyygKh$8S<(gBI+0P5^R#JZPyKQENN(%l{8 z$0j{d2gX=o|MJ~M1a|SIl&1@x-n0hd*OK_iK%9szU1ebCZKN?;L^-VD;^k*Vz5S-o zv#g0`nOC6_HFTjh`@R=F%PeN1)@Gr&!7$sqW;#hZIeg;c;`bN2-)e&Wjw7=2BAH+c zrf`^^Ez2jd*Xh$}U~aIE&&%CrawcWa`m1>ZFZ0F~1moR>Gd}jTDo8lS2D_hY<7%C^ zurf=@8*jCwdV2sBnXxX@{L$RFZT^vPQAc~cnJJ^f)d28M2PtGv$6cm_nrBz@W}KF0 z?+N9Zs4L#NO7H!u%ck|Cg@XOewQ8FWm6N_%h|95Od(Ivqn&i41-q(1NM!Wu2)B<7n z?KfWmZ$W4gfCkrDi=EQIvVlU*XPP&d6yj}~NU1`5dgER~g$`sup4h@ALja&&O=hLb zQEdAvHR0aCtPh+5rb*8H#|N`7GE7n9Iuliw9FhInzDr~Pg)5qyn*#?vcz%%IlT{$$ zxv}K?hv$IzzV>>rEh#PK$}5HY#wyT~wzt>#q~M+OFJ>+0+bplJZ0LJzSgE&J&XYyX zJeSl_fg1nej<;==a+4oBM!Fcv3k~0%Y;yx11iZGt`iV91bqm1HAsG8IU-p87otRhD z%A(>sIyrG#w~>_z~^)M1OnJ?c*=R9hJQBt0%ss z+sq}e9|e*spHx|Ct=l)hu%epy@uO9?W;*dc$}=bGim>oUigeBjzY%S`L-ZG}85bXX z3fJMZ<1`b2(TeJ=4SMzi{4^*?Bg(=bOfaql9Uh?CZPM^@(3b^Z${yvtQ$HO8kzP>3 z0w>3DaI1a0_Kloh=N$m_ktO7_r3=yKf9<=%d5;@9b;#R)JSm#$U+OWb zMD+oWqhGM?#$9tX!*nnmYVsPE<(GPNGqyB0E9B&jhBPE2M{A_0m><~@HEk5(`pUOv zY=GdZjD@@RB?va5*d0+((lEuv*!}YmICjU_I&H0(DJM%STEl-zEq;gsvB2*}vRu=xzGLY@UJX!K!F1zznvawVFt7~p*dI}Hp7>{!^5oXS;1 zsB7LXlb=n>6$2uO=Tb_C8)nD%m~h^9&f427^sh^x&srzL-WFPh;(R}>Vmr~)Y-fe z({PPnR_;eTS79^=8BBi?yytHFb7ajTgfvIzg%n&7Qq8%7THBF3wq1~gMctH^{6+f$ z5oxSzohT!&=%TN8UuS6JvxiLd;1f1vUehmj8aql3eUC*+Dn`t{%W)%K$--5Fr5y3& z`Bih&R$%5^N!TY5?jqJzFD$xdM;eDXdH(azLNBFWUN}Hd7nz$-Q!mX^2+i68sZqXZ z0x10WNYu1L`R=?1j1KIsu(avVAMdt$_^a9^-5} zBmr69GPm~qixHS=+ZAWc7aE)9JdAKQ_`)qEY`Et}z_rByb6J+)fu6uFVvan95%Elg zb;GudnqQ|udpaVUB5De4t90doV{ElQJxem1{R;lkt+nh0dAZFbZfhc*4HZ8Fi6^8_`T9tLf62L7;%H~AeJ7)l|CZ$k(DDMs!XbSS~?)z`c z%ME?VhS3o=e}$pvI~T&IrLRA*F@NXep&|YB+5qsil+AA`{FFpY0s_=snreyC)x?VC zH-Tb)%B^jR;7qBmmO@D91zft5{s3q^{>#JwHmf|kebWC2crt*^`~j9!Y)6RLxj{TF znc7;H`1k|kS~{_fJ8ZIGT5pU!WjN^UD>lkE(T_#g3-&=O=8e@2KXSVFj;WKB5CV5SQrP{~%6-|hVTxB+N3MN;fC)#yi zYec@N`fycgHHIy=kS0&oz`(%C$*B(T!%{#N!;O?>U2J$=znf{8>ZF>%ePn^H{b;xQ z{Kn>l*OQ2}qFlDSKNHy|G^V_ z#GK?A5JRt{RQ4CFp+V0ujzZ<6XvuY_icvKx8g?aToo=Ok{U8)e!U*SNJ!a#*G(uf@ zrkDp}thd92J#>v-yl*9MD@bA8*;uu)m9epyD%yvDzGn!kpUw06;t;mI)w?q99dLSV zY)xmPJ{{vI45J)HVeYrKa%!nj^|D!~v0vpEXt=1h|1yFycaS%gF>bA3P%k>KwIQw7 zchdHXTe@Z~)+N*mp*+%X)*R0b(DkY?oRqUG_T#beS+nq;rT1P{*laV=pdR12z+jZ) zZH=1Ri>;F8a1Sw-oNYtM+?|Fs41%bFG5kf9v|XkqP>#rUt{$azQGmhDmpnczMG>bg zM?}p%)|NosjGh2s@BR@1$;7${=p48%1HkWR4fqcr5}FDkZ4pirC*yvAtAgm7`F%QK zz#?ZmlYi{>&k=T?z|GGAxUb^^K~(jQlu&6pnZtRFNxTGzF7RfrE zfZNmNH!zw%iebI13O{TcnxqfK>0MuxfgSWsCcm;K54m(E51(E+G}MRg1r|!CvQ4Al{Uto-v|`+5~O5#ROam3np;8_&(80m^qwgPO>XL*cO7a#!3e-oL?U^L82QPIFdaqkC@Qc86 zb94J)Q&BIqinsthB!JIrje_OTmBdwn0k&;=;!pR8T!jiZh6D|hl?^%OcsLEzy zty%U8e`7bL@qPYWR&Mf`JUuUREKl|ZTvmhxl!%zAidVUNhsO#z?KEq4H>t!*U4fOl zci_a$Ro4=S0V$0qh^6+n0fp!m&enw6E4FC!#h9KA@Z3Ucytg40CZXC$8=0LeCez&P zpm$Qk(EQRZ1K|T+q?5ij{_S7xn$>tQyuY+n=$=01GZ24P^Yo`Dk9%Bb&949W9sT(i zT7lm?QT6DNj75JmNP4q2ZXv#=eEmQ; z5U^Z-(EP)@{{pzy5(AQp=m+Yt_5Z4C<0piKZ22uJtVU02Y8e|nQvE_F{F^RvXoEDg z|CX!sU!&D;G&Y}j)B>2i20jwoKK^0dTiSnr{||6~kn4p`%*y^(6dr)Vfr-DcoWQw1 z*rVMRGVPeV!ZY*@PA=di0e(iX`>C(M)xUt~f9QnCO*p=HTh?bsw7=cE|F=)wg7<}B z`CS;@E0TPclY>bfek&m+L(as8WE5;C-<^eFXXlodF0B6K z?CgA$Q2-Du#f&vC%9tH_{;gO2-iUw8PLRK>+~mv?AM-w5e{yp}&2L+?LU!gmdL=V* zLZ)o1b<`SPcG+C?)S%isoKM7Bf~W+5&F+vPKt^@KWkC+DmPRT?`77p!87lsND8eBMQ*L`%fJE_y-9v$V+5*9|*9WK7Gy`zO~rb z2y%%D9J8K#(=n6n66g!t@)S(c7i10wke%DGZF3l{FowG1&@ppFNQ3=sja2&b1 zk+i2#w{{!9So*i*bATG?zo#QhvLF?x`=;v2s1#lUCJw*3s%t|V6cYmF4w+KsoKy(6 zLBER_micq1JujWQ(t4@Ocn-|M>b`YGrn zxh@YKh*eZCeqjR~qs~9ZsM>%}g9TN~q6Yyjdns@3i+uPPTbpgn%Wo7ue%@dOCl@WSBN~RFt4VD2y zQ=??;+dCN{gTjM@gPk>O6!gNk8BU+0hOe)$zlR`u1jl99}A?G^_O zFwf_xL8Ar1sj%R`?I1PerND9$-xo8`Xj6qOQ!qC_0#=D6TPWa{{GnM~RCr&)v~e7D z=0+u9hEoUNu3u+h3?F@D#V;v)8?&MALMeNe8`VnKcUf7Dl6GgAWyh9C#3dxUBBXSX zqn}@a&x+B*r`op44f)@JQ@ffYFPV2eb;LJjj2AfTNWh4|-=he6;z;Zyj_=9!TDsi} ztMT}ajE=yGmnN0W_!Gfj){J<8Qu^+xmM8N(rasH-1YiLpxS@+2^?A5I_1wxz2-pdq ze#FqZN6V7xrGH>U)OW9nCRczM+g>`i68n^%{M(D7Eq+myl1YwZ#*>R~I668;Mn%H=T)?Jy0`5^qC2Zj# zpd7_A>Q^|;C)uh?DH6O{;op)RA6Q#Z;#;s>>q}ykZIn+4Ogo$T$>%u>+vN%(a$4T! zLr{eGCv_;;e0j5m;9Z-tCcGru%R^`J^pW=^B?=&i#H&}x7EYPT$HPP4`*3Jz$P^G> z?B_ne*^IyDI8z6Rp`eW&o`MO>VUxd99#oWud037RTBb%4Q7TvfF*)G%_+ILEAK0?q%KSSr%`+DuKP^NJFv|Z zrg}d>SSj1=RME(C{Ou#3N@V4_qM!WG$4iLAG;!(^jpEDX?|}l5A+^4g()}@G(DwLi z_APv+bpbRyokv_;TpC0{$rHT2cBhiH|q)Z+2d zlDQ0h^>S|cOzdv6PEB|(C=kJ81~&4I?NR*p{Q+tVi{aa+x}RRneXiFN2tqu6-~7k2 z_Q$6JSXDK@tNn8LbYaMaYvCN*m0P_AU5%qJjO^=a1Rpj>j!qpJ|~w(l@oc>BtBrp)fG>tWWkcD&zS0N0M+J)@Dy@;wIc45Ai9 zO(((jtWY*h2mt9H9@Ej$C4<1PL-`w-#%uGe1Hg#Tfodj!^?_$Ira`uw&jmf2umXAX zfn+`f_N%FYFOh>ls(*^@!2wYl;4vj=LQ&JfT zAcl6b!KzdGi_A5a`U_a`OZ`xZtqLW6&ngI!4UTeTNZ~g^ia%@kfmE4eJg_S-^S3Ea)JV zK}KAQ1|;3^rM_;2|M)0Br?BvfcDC+m4av0|gQ=qB5aqN;cVdvj9K=#cu`G7F@x;e8oF=?noYPcD-QRHvl{N zAI~PXd`QK0jD|4DNDmq}CW$X`CXE?~FbqNobF+5Hr)_C6{3$ z*X1yJ10)Zio0P099&YZcL-S7Wqvt?L25OGagM)MH%km`EoQ-6P|3vVNi%I#>XjZcaO8dcGR%gI4=u`gFs1Ch^(!x?fj1o zH$k_BkKkgU-CTgU`VDLJ?*;MHx$@d4B;+i6%Ksm4-vJa=w*0LKDq$?Blw==v~^=;Kw z!GO%%d(Y|9-M`S8h&?^pE#NNUdW?u}pNU^lm)A*6nMs`{H^7TWQ+-^M1V*t))R>1` zw6eq%%CLeXMK;K5=lg569GLSF^Er3L^!AaR0>096^X>d5I8-A{;B5=aopKElP}_atJmkTXY;OFhmW$ z0;+;(Tw7^dCo4+4B7~6-dgV0{5~uH9md_$u(w=cWIsN>r*iRmBr3EJk0W5hr| z5t}h$EGh92l%*=evG^59up5`**hnvFHBp(3_rI(W6_TVp1l_<&(59!SANCs*P;Rli zRFed1h_#K5W2VF|b=|VB4Gr6@T?h2(nzAx8W4b|XakEp8f5Myd<9-h>>{$k-u<*sA zy@|JMw`}8q*i%VkC=g!2AEWv7xQ*HwyEPL<)2DgVtMJPs_sW}?Qn$Esmb9LLhv>U{ zqV3j2bWXv7o@jG)VJq!TNG2Ju6im0aDegv@C0tHU4Qtp^)W_7XIkfckgI5Nyf6D_C zy%%|TQhbQ^4c>ZN5lQ)U7~t!34J|Fqax-r>bbxn?H@k!h_y|;hvB*moa2PWs5*GX1 z#;PCfQS1P_3FVJKc^gn&*-(%D;~3kHdF*XQY9hT)JOAw^1#wmbz|o0X%~;w+Bd2e7NXqJ&(awvTi_YpO-zg%^y^4o^{djyK$qLGDrKE*L=VQuYGQc?o? zZ${(mw%2=v!XH54dc_jXlRh)Q>=Z|RaM!usu_gR|TP{%8;rEcL8rUEQw(=V^G`IZx zaJ~mgz3XF!sqH=FJ9+de@<&GR^4n4Vfgw*?!%jOddbx?7N!0Q_Y>UHwK`Ee(>ZuNA zL)HDZFAzC9rkbq<#2?dx^~F}>nYWBJ)EJa|MpeVPek%RKv0V2iT43LkxQuH|lnaBIDdqm(7_AJ8c>MoUk*u;9;+r6ofp%Y>5P=Rvs@I3sp2JQJ0Q%>;~|Fs-VPEi55{Y7kS zV#?69<2@x~68J&#NLI~85K0R7*w%Q$zvP72T-Z?H;#d(PA*7z~*xwHRIINCPW5nO< zG?$y#yWW31+yip>@RRjKAZ~7 zW~sGvbaXsjUpIMAQ$~$vZqdHu{ex^UB$=ziy*i_SY>N3fX;-?>ykjc?Bdht)GfyZ_ z=l)ouA$si@k@{x!pUvrZBvXV(Menk4ew<#j?a8qKUo2s9zSF{Z{xoRO!fbV5qRs>M zr^bHEMufs=)k53}vwafKo%R8BD$^tOQ7OAFC74oTjxEf*-2B*xQ-YWlzG$fyE-Q1{ zu~MY|y>8)HV7e9PSyA_Od9@?rzbaP8)iQB`mA!2agi+K+%FOmE@`Dempgqpf4u79#oCz3j9?Lq zlgKOrszVmY3JjhGxv6QKl-kGO)oqC#_c8y_Jvyuz7cftXGU zILMI-bH(08bg$Vb!Q=?}$s=9ZAZRZy2eW_A>wc_XbwL=c9@8tq3Dyi(==#V&su9M5 zWPpzMwfh?yMs||548;e@kB2143uztS=a#mH`pn&89AEkUx>7d0C*$O%q6VRSbMPl^ z77fU)B+~)cfIc3ZV41OByFeqS~zGqOrE2&+DE?Sa1qt;r^hAY75zVU z&y|FOQ)xMxo&)(xL!qk+yYe!8cBl7DaM5gVTtY&>MYB7n^4@G@e%Mv3sq1~(M`xIuFB)|vKQwEvOY$6 z4-$ENFIc4s%xf;V_Xl==av^4{tom>pd?Vn;(3Za#(|A-qRHY+)g0IyAL4Rpb4 zLVJMF7BJlIiG1pQZY+%7R-~y~2bfezHdNZ=6QqF0P-sVsgdZKpQ^C#lLJoeew6kHb z+h^{%&)fsp(-SIM=#@~Qgc=C3dDx%eOgH?|{0C7qk(^VMUa?8J~oMeNv%^0p`bkactE@EQM zsTI>IPS7^M&d>qq^24)d=O&=&wc=NRM9(9%TkEas`m{Rb4qX=V(-}WbrH zR0G!ls-~ICEoSn^;zg_Y?8)}&d#paL*247fQLBi81so=yJaPBzVgC~mVh@ZVvk?{% zVGv{&Xv52hf+^a~+_po2jbrBotJ52jiyQ5XiVW8WKd6+CU_QQU9UBuKz{&|+ULbMabJ`bF2WW%E18bSeJ~ z5x-)^a;in@(~{mL_$i`((Vk5fTiZ^P=K|Hx$8lAj*?uA(xfvYsOSg`A2|W{%V7I=A zFbU1<2SxLFMGx6WaSyg|*4WuqL4H;hBr{*BDFX@wb75iO_h8vkGwe5RT{zn_^EIoG z0n#ViQWnRkUPlLq7@#a4RSt&S$<=Qm+LZ9`z1M%ZD$E;dBk^nr4Tp@06ZJZk_fL!` z<0;5N89oFKfAUPCr`fk}-;4ZwX_nKk-TO1a2y*5lh@>Fqt0cm-!@121t-uGdZN8i} z8LAB(hv8|wIkaNIoACOJ_5}d#qK4ohclw7foJCCjlnwudA%@9L3?ow(J#(QYA&)$0 zsFh0i-)Ky3;m`y*YHlI zQoCm*ufodHb9OT`GefMPp*=anFOEE{Sv=m%^Otz@4>$R@HT1{9L!g>(bK38~?3P4) zekyO|D+L=j8J#>*S^myvmF@!&it@bY8oEDMrYDBfxp6MI{)U3kBPc<=Z*QrfmmkH889Ko0FpyX^sB1frk&f0>}YS1{H9D3w`c&C_h$;F^w%b)xgz|;p(b20RZ zYu>wMwK-eNH83?W=o)M~9;4RBw|=hS)2EF9@SvUxqU_8!agV1L2P29P=3+=-u|vE*b#WFDWJ zV>{vI!z4pWqL9BL)PiL~^+%VWV}v#(Bopdm^-SepT5JjlQmP}qtzn9o=9rRtHPG?J z2(fUl_YiH4aqz|G%0cV~+U2{Vgu6GZXdH^zr*=ZUZbMvLpq5DBzR@%L)IpPfFc>hX|x)@7Gc z0^dcK6ymt_K+eL+jwDL~V*S^bdZW;MYP@ja0+(>#bX!f0Utj?MU`XuaHi`PbrgaG? z9+mu|DNqo2wb(v)L2C4vZN#&L+*6V+>ifyE*UVJmj-_5Le2E4IkY9+T-{BI%3^iw! zqESJXC&8}E7Ai0BG;52Xom*2jFH4x|9L!eb&tXS_fl18D6A3Gz*`yXCzW=d+vC;WN zksoXlK}i}1Ve1ckgRh_R*r$>^rb5(~SPsLi>33-K{sm3=1+hw9y{{50+1Mu()yySTW3N!!^JZKC^J2xm8lzE*oK z$3SCf|0@+$C`RS4(MAolU0DpyOt&Ttl>W9!DSS4j+P$`SJ#6-OLUG6L9@*L2iKb1< z8)ItPGU~D%_fz~7VUuAa&;$SvxPE>x1NSB|j<<~--4JIkZr=t%FgO&e2meL~KDQ8RwNIjA|CU3V{;v<8#P(SFQmiH}k6 zEfun{Lt_!N?TSz*@R;6gy}4+8eSN9ASSx)sFu5br28V_!`_OEQie=L&)X z`5JSmTskyHc}5P;=RdqJFF}jaPLQI%fEyijJ3XYwoS(Y*wR7Q8QPn@NQ^8ysg0pVJcca)kgtJq+^U9CzY)udM zTa13s=b8l&(F9*VBcog6C1B_rQ<~AeFadJF^LgCc4?>>syg};6N)V)`a-VIN>umo_ z3>}zFkg%X&r-h-Nh7ZxFd@+ezW7@`t&kQNHly*$JlM_XC(;p;3>-*=qBv2s8)YG~<@VXli#vNJ-0umb)VG zYBKRZmfKE2VJfL-^}Uitf|K^gjHM*VFE={X2>R*L9Q%Q{lD+4bz&$Z&r-HNfL1J?5 zK3GKo920Z1sTXn`D~svi?mQhd5UJ~8K6gt>I4(6$3#gYB>_^&0c9jiYdq3f}sN z3HJEAz$9YZCCO$OW?VY)`?Xx=Jl*kfvASE*7-BX5Rx&XS+dv=39Q-l!5~Xn(?eGt@ zEnrAl%0v+Bx@3In}AetGIzohjz86A*Mey?+VXSfIUx7 zd6gPRsCkRQ%6sFg_00F70SLY{KG6I>3e}^PHVR$y_#!#o$2Y%}4rSq3d32LK!QYuT zIVq`PPF!M_NzsZwMx%3VYH%2dHjsN#IcG}2jb;F4)nM2>okKUww)UFFxyzwCVRCYE zMe-h*M@}#`$QCT@fvsEBgotUemU3F0fHyn<$cWQrvmNw<3}C#2Z5hXtwO@38XPE!{ z2`kQt3HX#^tzDEh#MP?mm@wa0l_@av1CGTAZE3*G^*T*Q*4ukMsWS3^Nb~Q1Y^NaN zbTj4k5^fq?v$nRD9K%_=sO0M%Amy}P^ak>6}I^$k#6SffxPb)K*=J38`igCblN&|;7V zd(|Kh2W?BXt=UP(T6M8vm~I&|Bmm=Y++e6iDKPU)(b@w^$p)wVr4(yFHt)7pDyj9C z@9!xM_IL;rhdin)jE;Mf#;^SA5u{95*v{pGfn!eyrWpGzvjVM#elmHz=E1(bL(rFCHt9R`}Z=NH4S8*op-Mp6B& zp6mm8S+6O?qHc~)FnmBg&i6xl{&{mzh=_1|5hrFsg*K}8BdMwPjK4tNcpPU9*mSDRx3>rDL;V(8VXj#! zOu0&Gg^kXif4Eofme&x zWUnM77GG%g@3Kx0JvQ)X$J^!`Z9Z-+w!!7Bg;huR(=<`aubEQ|QXrT(rN~c<^MfIL z;MSSyP9!)@w>oMDcOmw0F||8wTujW~uSt4ae5A*eP&omQ{{>(qQ4Z_Yt>YNLgE~~t z*vd*^d%XARwGZTX<%Aa{D!ffRj%p_D2;UZK2#&|}^5ug*ta|c2kh^;U8*^;KgUWVS&eKs@(6m$tvQu%Zk9z*OB&dpg@wk7r9b43bZ90oavi( zY86u5DT=%^Jr)}O6jqnX71}6^!ij|BqpoO={pJF8=tYjw?}>8 zaz5Mhzr4K+L#IjlQPIdrlM-0u*@Cc+je~kClYZxFX$@0x<~Ey+7s_?TTF)RMm-sX+4X!Hih8DzZBd0oFPQ?j2e#h5$7wJx$ z0P=+916r>0ks~-UOW3hDYtj+`L)-{>4$8pM0dtZ7$!#&BVIt%d@p~ZZb%1}_^^;jJ zC-_v6o9q715I(07Svyfb-^o@-SJ!;LkWBvl_cIdvow32;dvwcg#_H@{ZY;#B1>kV~7E2PY-ZN33H4! zrG%&+r0X+=JmlD#eD%9(8nb#(aQ*w^ z`~4Mhy@;_ctSrWkF)lgT8y1D-vx`Oe$9@y8;D+lBSCEvDlamwFZVgk7QeiS)$1d35 zjfAqrsKc0Fg@z%pl=r{EL0#B^c;3jUs#tdLzjzQ^8$NTs!Fk@*EX5gJDgJJhPOh@X zUZaIX&B3TuA_)6w%@=5JfDTFQ`%b9Zyx11nR{{H)p8Fzhw6oL<+*)Az3pfU-qd_1xsxMyVR3HgW=`Exib%9{ee zXAtu5rxXObw{2C+osxFp?TM; zGkr;v#KDzl`q55?bN|)5ZAG;uF^|yp;-JFNms8T6C8m~S`CB0>(0Dyw#X;2 zl7#)bLZItw;n^N_3WB@_2c*LBX9JeJI^m9*X`A3mrA&1{#~nEl+ShuxCfOQ`eiwar~?iUd!zXEd~QPGMZ@H&@~4Ru)J`E95o1@@{guo_?p_9* zYzH)ockfIvST@3pcu6EMTvr3P3)we-&|}_n6>tTurD6J7>7xIxNK*b^;Q+ z4}t5p0_MYk(IW-nEp zd5sbix!?Q!V`FMo>*(m5RVJ({7y?rj!q}6d_l2(WsLA{rBDj5Iapc>(Q8Wf8ael78 zh;<96h9{)(%bWN86hN+I6#v}H8a%xyTmRidFRP1!obEX6_|?8endo=2D| zl{+tkCJ{olZrYZA?UCQ|uuB6&Ltbc3va_>u2jITmK)5*ywA6^wkOYD5A8Shfy|==^ z9*#L4%g#jN-p5r&$5$7SJE_2&1)h5nY39YhFU8;1E$nIl?jO=_+4~+0e$b$i50dUc zwuI_)ziOM^BGYE`l@!S$7XWS#qsz!29d)H;$5UzQJc=hQt^?Ln0XdL8<6OUDI3G zH;$XgQE+se9$9-S;LIkaX(!;g?);>S)trTVa4ARaJ1#*O9Icd+{u0_jtWNEi!59Mc ztw(aj0%~f{{_{F1{_Y-29_f!q6E2 z;MqFb_O0GNG260L}zrX`gGBfH&{73HycrsSZxVpsGFK>;6zCCdyT;^~!N+ zXk8b-#yG$ld);A}=WxV%vK6(hk?k%J9|NV!a7Zb>-m%ISs2vVToK4|E&sWf{&B4M- zeNFuW9_fComh4?@)yt@l9x^#T&XjY;T$KO5s<{AabFIxnw!n`+T!Wy&Q542BoUsjA z+%WpdgN6(_4Bn>QvU{lc$D^XTt|6Y^29FW?z)|5M(c#CUb?0USNa^`q#htFhHXyqm zw7)kodyDki(JaVvBj*>q%j?iqZ*wOuo&w7WZem&kkRuRDGg8s#yqu0QF+RV;gGZy$ zO)w5x4XA_#DrE6wy)ph?=daW8x5fS+qBTZnvy#|Q>{)j>7Z&}_v%sYHPqNxCUZMd^ zjf=LNVwQlgz(gJip1GD@S;js_(}Dhe4J%XBRf501O}<@op6JU{VA)enL9%2HiZWcI z$3?jpRNUX%gsP>tAdp1ae{V62hMuo9hsNwEpl4G&?o*BCouGhx0F=|IM5d&jts~jM za^PLD`1;&O05R68qJ{`XM^MPgi099DS@^Tc1`j{T8?TZ|bNNyuV@I3~CvFFMT2+6o ztKCHqIaD@9&mqC$UbUc&aCUy^*C6=Kxq!Yg?Os#c_3=tH*x5gE=w~Eav3jBVR((h0 zR6)+O=rrrfV)B7M6Gk?Lz6_e$v)4CFZ~+X@&e9TU*b@@xiKFUb2T)M2=s5+oBbwrV zr3L2EYy|9BuN6&kIsz-}YtI#9B+mze%tGI@c*@HJb6!F4NyzR`NJJA9^bQqWZq6)z z|6ofebk=NP^(BSR&CMZ`u1w-*MYdwFbWb~c1Axm|=2+lvY465PsLaDB_fz>{^2fEt zQfflmR&K~Z()Eb&7mX_NonLI@8dO?m%3RPix&H?UQW3^`J@+|uYJ54yRcV(&ZrU~& zQ+lOhVRpO|+1LUck9fRbH58VdIJmMDPK~bgA>dh1lJKJ6G3T*C+&CDtY}#4kg}6oc z*0bz$AT{fu^;*}l;xcfs({jP+!ZaA;P_x3O*5cLS8!K31e{lOfPhc{)@TFeE;q5;b znf6dp4D`a#L|jgs#Q9S+HI;V(b&q8c%23u6(P;h&j?h;_-VHVdk7T}O+pu0av*`~n zfHbpxa&?cxOcy|Ks|e}%SEK>fsMC?4beV4yx4;Cv!e=&HJ!G=V-nE`td?Td!jWQO{ zitq#hiGlkscvMu&ci0ChlvgHb|75wY-T7(=y7@IFwzXz}sMu4G$MB=&{P3CC-4iCm zEjgp_*a(75LL99~#=KH(t{yret?j1_4Ozx}t9>9hMxF*=MO)j^tRkVXX;7@1j`vhP znwtY=-FD(!3h|i?_pGPXC(6l@AsBg;@AYEwxb4g_v_Ec>78NFI!-7lllVTyO4-{<4 zWONOQA)R+mL_iaoDJ3gQ4Ek0p)yAG|UKaBbNDHja-=8Zf6E)guj(g+5N(wPZ%8D1K zHh^;**u7Z49z&!1P}U0A?{K{a*(TZFmajn&)x2!mro0VAZn4?wiX0L0O&@H|8fbqe z+j;Xyk-(G?ZD8b(0aLU$zxh9D*ZI;DIyxaOmP%7T%o5sTZgdYesJ5lTkb15MSZH#k zxg{hn+8b=v3WbxSeJu^l1l-gYm^@pvWDG@fgA??-|J=3_IsiJptiCE@-O;^2?Ti}* zjrOV&@+Y6$2ihCx(UEX;01(U{5NZzN+~$X7>QdYoV5_AT*@Ah|RUo4QXI0F}ON=C970#lM37>x#jiPZbyxZ`^zw?y8v9U z3^7mqnP`&^ChY9$iK(gg!7kxtS8W@U1Sn~tvY~Wau{!k}x9{eR7SJQ)+~z|?U1OSg zDUwA3e#8Pu9|Q=?mhAod$D!Ak4~96Oftgh5!{!4+1(Fs5b&VdthDQNkC2RyWgE_{f zL8)veG7ILE$G6V-U3V{D1{#+hUmC;8{ZcIL2NRShn{{8=?$URIs}Ed=NBSq1XRMh zkZKZd)61f(JI~|Rc3*O*;B6}IH#$uVhAfB98p2U+vJ7*j@`+L3dGUaeEF2FF61O#tqIO3JEO54vA_%cMgU5j{O|lpJ+JlZC zh@c4mFPcON=|D;mYu{o|u(kK018>~c{XxI^%Zm9kH2lLA$?MS#il^@qD~g{C_tezP z*-JqOuotD7vuh;XP9a<+Ey{Jpy3^1R0mR-#8pd{_q-O@ENiuVf8Uud3HP#IICjh&v zY&{N%TEPctuV$FEmSgd2upF_h2;dbQQXSKcN+sv~_;(ti@|2dn0GYFrR&#=mefN$xdu&Eop@q0MOOZtNTTiA`X zf1o87@V}uY0USM2(DkVZ+K+N-U#a0|7Re7LBwHVEUKwUpQ9Jp3Ni9s$(l~n3r1_0p z&)$(f?vJK+tsxX_!GJ?hUTSmoM-Ea0=!YQab7BHpV8{PubCazkFyBbM6YD`&NwJZ0 zLe^E}vkR?#m~!o_QUBGnTzQE#mU1)N6B7;$v7*m=UYw$cyG^aa4UQe$B9nmV|MQdn zmt_$UihUe&HAjN)nXM}YjW%rv*}5v~uD_q`l)mdZ4x6~40upo0KG*JRKLwRzG(9M0 z1D?$-`N5$BT*YMm&1BAO#ie}V9>XiwC`dT|ryCiFjd3lit~4)$M4Ez4e;O^&hv4e9 zT*b4N`4@&UG&xTl}w{+pbrWpXhR~AuNEh%1=HX8J%Rr z5y)<^zh69N6Qj6uN90T`q1SFa`+5%}1vhi;9cZ5@JWtT1usQJielR&qmk*sE~{m z$eIF8&CQXyxspAV!Hmd73YzmFa}oZRkhcT~B_1HRCg3rAf!;R^4r3KMUm+eJXh^y; z!Axog=F@B}hKdg#Cck{PQMI?_G1W@dA$*y*ZZ+jD zwn%qO|HKoXEx+%We~R~*=Ris?ubNc}ZZC9X%ho*R)!S@5-&FqsqzlM{5;W!Kr6<1}M~UWO zT|>i6{R+({7idQ9=2)Rt3Wjz#4^6i*f4$57ow0I@7k{Vt>6~=lJE45V0euvc06I&l zY}u^0ed`!YV`B~cDY^SwZR)>j(G4u6TCnj$1%G68G>7V^EYOb*7HGM42kN5E*_v%gBkLy@~Y6aUM&DEH+>#?UcIoacda-s>X=>il0OWW3C z`oC>^zYS8BSD>zQ0@q73-~)p1ubfFe5>OrY_5rI@q@T#+NzU#F7@BvefhxC;yR=Wa zBt8Y`MA=X!Au5h*um{Bt4y#A&2_~9W$U?b{0BS_L(qTyV^Q>RKwj1dcXY`w%l##vq z6^s@qpU%a_$CphC{3y60^-Ss&gFD}u<=LwmNK!<5c!!3!*>EvMo~1(M;R>PZ_ef7z z69poP(GE9PJQ&@xx=ws{>qc|Dk&nWD$Ke*YtDKC3Z3R-SZZqHfAHH6M_<}@otkB)4 zlo81>Rv^dn|1+~S*@%JOCU2SXb7kk5A!Fz;H)L5GTejwk@DPx*FVL^<>|JcreR-Op zug(!o?9Lx~OQ$yqc1j$x19a>#KOUS$`9`MR5I?-Me)FZexGPtJl2dU#<_+7pB(sp< zN{kS_k|v8Atftr0?tQ+0VeEf3bEdLY`G86p-eC|1^`lzNDMFxc#(1HFu{Z&#(5!O0 zAIE_pr5s?WZ7Bs)r&HU=X-obLP~yfUSt5)MhBv=6UkBmZ@#Kam^$nj}^RL;r0JQRG zI7<~2C9Mu8T|@Aa%s-;*QSFGx`BV8h(|s-UTQ!R)U|~VMhB*EPdzkKFx32->c=4?b zvfEJmSH_e=lK%jl8)YTRn#u&^MG+3J8)*&*!AJhrw(VF9$wdu}P#^iNCV_wyMOWyn z7&tVZLtHg+rx6oa^h|n=$Wv8VRJ7#n9XieC#kK+$l8X$mC&ev-hpqGGhx0nOgwMRc z=p*xFWo2b$uU$h#Y1F+5)GpJ+Ks_vO+i@5sE}X@8OQ@#p-k6#(D`&TM%cZ@=vBdL7 zX2kZE?#{kJT{GP};X>aR=%)CV)M0+N$9HpYEKXBZph!+sy5}gs^YWXOiij3Jbc_s2 z_4#*JDMtSk(D}&ERfxF~f@K|{tI8U7(CYv%RUhjHRM^g~nc+4z-elWI8%5`bX4W;K zK@q{kKg0*VVHZL+PlDipca5e5>xJicHY`smoa+Z&!k6TPgnceAMyuTkh{4ft!6*gNjsAgATeem3zze+-tTG zQSM;vq&HSDaXWW*ycZ@$=S9ZHb6W&kxv7cqg<0{OeU_4#I8ZM<8JHPBn*-iC#sy^2 zsb5h8_z8W4Or)&*iLB-cytFZJUN-boS84G40(Lr}9bd*7?g>EBxykUkFR>jw#KmFK%cpncOY%O#zKO(_g!vGk zO^9BdZ@gylu1J7`>TBiw)loQoB(H!IX`bcoCW#d*Ipj@}*1)-Q1dQvDaJQ!L2YRZD zC3fDeZ@vI3*~_SHIB2fJ?S6HpQ~*X}4pqKTDx zIf63FB?{)O(C7}YF}w{1vf3K%}q zZ&_%C&b94OMt#`SHZ%kS`jQtI5Noidre~qDBgpY{Hzk2q15^Hux#AS{UG1Ic?h9CQ zzcKbexzVXtCI?T3_$?zK@16@QVxZPjNKvSeV%q0v1!>*{cj!H>q+8`f4`yItRQ7z{p3V_SE0S*p@26a zSW>DJPfF0Rc#@VPifOmwP!j_h z9(0gpRRt>{>(Dv`9b}I8Ul2}EbqG4+dM1V@>U6ZJ{I4zs^TUfP>A{>?1x@crg^nuk za~!x7nnFwd(eSK_@o9dFrY#LHd_$4Ddp<<}TYG0!HN^>&Def$g+;UfqqqbdLqHZaqgC6Ii+mywO9y_aA zq{59OPyup6lsEu=sGn^)A7mTsfxG_1!^Jv7)X0GeFtLvn5s}k!r z?zA~WOJB%nd@4;;A8ximHq{+`UNT0Y#r{GMEP!o1RET`ypxFe`Gcq!A4=99m4CbPr z80|1#?AMKiAkLGBB&u{9{MDv|8T^)S-LS*N{OxVp6#@HxbcZ5U+cnjzd$*=v07|14 z1)^Y(!XR;&4Op;$phm2b!di7tAiChiG@d7ciptpV`OemMVwb<>QRjVjO|p~mn#D)} z86{NG*`NteH*h3`IlG#odW$Y~hCufxL z&F$svRp!#W*1_@-yi0Ac!sogF<#_7V0fC_IcrD4YSK$VB8vrZPB^ue?n|Er70vPeJ zM<-}CDxN|>@jc-1pGC04-}TbY7sECW=RpAPA3bN!BbZ1Qwvw+ah>!H=&Iz5Q0E*g1 z3$2Z#hgyRac55khJPFfk0pDs6ycXNm2xvvWPLF2VshM%P@pW`iJ04t!kqzCHj=HLm zkyD2qw-mp0Moxfh|HEaN8d`dS_trMm`m`_<=S&0~mL6@4V}5YZOWA~r8boqikvufl4FX2zhevxF-Bd=h zV0Z@@Syx(h6?OTkz8*uhKdZ}N>P#!%jS<)xkD3YqebY09$cSdD{8NylAgv(9e-sgq zs+rUln%kKPJaeO@1^Z}o9BVwrOSRpA8l}!>udiUyUoy-QQp^p?!Hy@H5D!a`d#z;= z{z<^H5f|LN(PP0^)}enz!G3+#fBE9BkqN%EIWm4Sv_)RG!YGh}Zc`NXKE+EWotwoO zF;J9&r$YI9^?BDU@Cqx=0_8s{0TN)W@X5Pns$_gZx&6Sp^H8 zdE56aj&fGa&$9-zi{2@(4`*NCj$~hyq0vWGBHSORKYI4SmKKf*;DWU{;#_ZKhDbSD zflfs3K4e^oY6bzM)N{Mg3v0VVi{zZWHHoi);1`yOKctWU_k->q@=w77R5ArJqa|&z z_O~cq9VmljpY)PBOU0do8*EIwm*mbuY3A~?F9VV5!)k!vWOJP*J#N*XtSdF|N#>&f z&{d+-@t&aeTuQs@*Hw!j$5hUTRf-r&cixSQXAY-iAOF18B{iLXro17k0FxHZe7whG zKO_*GdVm6$R0)ldtue>WEcrR2qkz^@YDPP`6-kp~DH6_N|Ht=RNRc6GCb#0$i)6`P zoV*0`E?#f`hWTH1_<#Bl<{(Ym{DtGF|5o2q-bjHw{>K0Mewo5D;fcoLL*o=`Hp>qJ z++rtA*Ym65S;7|}I0Z-LwkD!wvfC(SknTh1Yj@l2t+@4TOHuyCHZ7CV=j(FDfR)uz z-k3-MD@zNpvI0Lo72H7THZS4Q(Ag}H5t}0L>lR)pnWTWYTds`mq$E=hX>!IAw?Y^7 z`iufb7w-k#M-zc$5YOX8qY>f1-YcWe6pQxE(_rfBl1}jDR2^w{zrgctY2ZAuw=7Z|(w^ zqM#{-(0AB^h;GOZ0vrW^{?65#Xieeg3ka4!lB0gXvnm$IS8br~Z2-v@h&D=Ks!eBY zIN?eKSekiyoDxO1(Q_pxtZf)D4ZNMIp77!vC7>dQmdAW2z@`alk+|0ks8PDmT(qeF zI3Eu_qF%tsbF+8-c875{G?o1Ks(ZLEl)8I@TR`CnQwpyDD#j$LzB5_GF#+OckV`F= zEWYQI-Gl>s%1G4b3;ogO1KmHebqQ-r?hr23C8~psSuO>t`fh$Lz2Pmwa#YduGeG(3 zgv|T$m8*-BcYO*M!H~)1A3mK@Q)`Qn1>+4=@uUAy>o}nacr^#QH z(5z}%9iY+vay#!C z%ZStm%bVrZEZ%<1tk{F~HGG!MbozWPcd&BvZT2(;Nq=Pr#~O{?TFbpc+=faq6&vqf z7Hix^qjp2^7m$~}U20G^1 z+l{GmxqG}H->|=$ezr6P*JhuQUlBb%Q~CA-Th45I^M3Q1oISWy)>3tBj-=H@q_atp zu4160fh1l=x3s%`z2qgTs=8y5ELq+z)hFt)ouV|6b|&@M$hVTop_00#f$m?{4^Q{U zefHKbE$HpfrfJ7U?rt|=Vfbo0ls;_${hQ=k!H!jq>!drPBoWaSLq(68Mo8@SkhirK zkcKDc2E4qyM%!;~C~3;D=mZZFBtRRK&8A|$=}U@C@%GDGe-}@7|6?7i)cbL6oY9@JBWkT1YSq8PBfW)@a_k&SAqdDOgip6 zHi_$DhUUeJt+V79n4X1uJL((x)LJmUpIygedd4;KwmauTDUJEq4G$I_N}s(mzSlcB zQk@ONeTtgG@h_LNpP{-%=?{JDbTv`;qhxDA};6;r6)hKql z*dMRl5fb2JQbxZvbCzR>RAd$JMtDAIoCEzb8=4h!Z#AZ~_`qRDb*x_Z;*T7L{t?zX zb5WS_a<2PSNG*S59rr&U7Jr6y%ppdu0f~HiXWwF0++#<_BPY%sQG2Gt5Xis)HV4QLI74W??q$h1EXkfTP~v6 z8fw9!F9niegjjLWVslaPQ}eLx?vuLifilI}Vtu%KvJ=nI1Ty31Lq^K`W6uHTa)&vl zL1X907k!)$@%s31XJ+mtg7MMLd}4QY^JOk+%*2`0BI2ybJ>%vLlS~HZX1iu^CkbjV zirlWQ$*RdYooz4F@*y`@s)KmF|8#G^&2qXca=n)@8Wqa7yA5P$^QqeEa!zCYg(^OU zB)+@NGtwH8NF#gj-RkNb$+hXb8;WyIQ~L|Q-x!*xK+WUVQ&qS7Y22>ceFiL4CpU>) zP2T$X?79Owz5P3%dn7%z&-k!cEgSlIx3L!1mX*U6Qub37adBML!=)avx~oBA=Cz4paM*((bs380)JRY&@kj|go# zMn++a1s9Wi@J{F#Dfh$cv8i+M}Gt$fjTg;&J&2(QddTpXB*^o}it z?NLNpb+{<~4r}6+HOXEO%;kjL7CPC$X1`?|1EGnW`^6T<%0jCbYjNUm$N#NLiMUN&?z~=r zLpbavbNP?WRs1bh_vDf8Z@jsIfr0m|pQ&nc6Y!<uatlSyu1I%x}LcRf8R*7vCNM$dLqJ-zS0+H9Vn zZd)%v>^(R!@@C+}&K(v9hN*5X23i=Ex+dJE$C~uig{%h!8q#$>jD!|LDJX8QrCUixa}au z-DT3cQ>>X#kWxB6p!+`DaKe2u@a4uJB`T1Mc|hz!TL|Ds^{D4eJdhcdoM?x+uE;6@ z1mVYQXVPwLMcLanCJZ>p4azIJ^*CC34|1Wsl1&Bt6@=dN;tx4z2atkr$(f7rQf<*|&mBm97|5f0p1SX1iI42ug{do@>cOJL zpa8KiTdw#ve)?$fqwk4XK5b$mE+5^t`e5fO27<#pKlX~Q zeVuXs4p+N^;T>@v)7|nBTGTZP_YkwBIm_DTicd50Zu>+SWh3tQcH1_r^nTDS>yg%% zRhW)VO0+S~;P4v0l`4|sQ=6;clXd}?-VHIX!Yx~5PIt`lUBLvHWPlKHJ|SshH2hGw zz$hS3l4#o5Bfrq76d2xEvpwh$?6e3hjkX^*sXO5LQa-mwy}sz8^1vStXQI&BnJ5Og zeltN&MG?DrIa=rmh2T%(mu&C8_tZj`GB+A z-84OH4IB$E3}=i!tRz-vm$bM4`#V6y_6fOmSuHX2q>91;(hUo0r$RDR&M>FlFmuS~ z2>7dNbS9-$d7zFwTvuQsTl~%W)}t!ga?~CQ5in;M?jE8x?Y}nG)v@|?z!C0|atpb# z;)1v{=d#%(6<-Lxp{_CC20qKCxYI65S69sIIZO0c(|w5xhA9n`FTb<;k1{lk~-j&{jg z7wFeX$oKY>wpH(?V`{a&H?JhGe~@@#hm`Ka^9d_i;_R<}(m7IRBiMUMVMyYL$lf<3 zA}(eNav3-}H&TbJ9Fa^}rXdsj%rdQUZZG&Pf50C!dr;+&nsH8nKdgA&aBKyJi_GGc zKZYic>C|#GeBPSfev_^Pguq@C?>{5otI=L}La$y=XFv-cvx@bD)qOR+@4zAY@_GFc zB6Y{Y9K(ve>s6aSt|yvvvtsVt>rHxn-R_D*)+E!FbHxFtzI?i1G+)QvqSAZmTUDja z9{p3e?*=UVM$7TN27K*h+s|L9syp+RVaBSejw(Fj%AnmcuRiY+r76W zbRXKBI`ji2U$JJQtrXaN^k}L8qC)A-L++DJB+PeWF)Q?Pa&w)rZk9hpdv|ueavRXJ zI};+)xySaaCmkglGl;r;z1+);*dQwYl2cjvc{~74!!AgOONzS>FejIQT*$M;!CPGh z`0BUw#~;P82i9(Jkjl%Ayx2U<>s9}DL-;YzcLLeSD<7Tfz279be9(k-G`GRP6YaoK zHh1YnReNFhx&a0kiL%8X;2`K{+nliqKg0tnNAq3L4SdCXBUT@oQlHQEHN0Ak=lzE3 z%V6^!-@u7cE$i5EshWHEjrynWdAU-i@4Q7un|nkWtKa*|+FT(dF*N3%4A52AdfLI7 zX`hkZn^N>WG;uMW-rW$NGuQ0s&f2`e(qrzKz3JyZo<$?Rj(Es*N4wT-bS9N3%c6ES zcNy@#re!*tT~&AR5W_K{-b2y z*;H~~Y&y@&D=l)P_;$?1$RJQX-c29UM5%MQn(h>bjRB^JSe+PIFtA9S5&wCzmylvR zt9NHnYB2j&Dh9inmRa%&*UzwZ>_j(f=O)uS#Bb2xvKeWAqeMG#yk^1UT{ulT+G5y- z)f0u)*Cx!}N_)PeScZAP?MwI?z`7%Fj2}c&YHHMxurjgYtD~k_YUVfexvttU#B`6= zMhPx^t+ol*bm_V;(d_Ok`aD000{p((?sje?_>3bZsNU;hWbLzPGy*JbQRLInvZ+$$x4s-- zcczwM(0hKp@ru}cOxY{>8@P9zG=Z&~$}pjkjG=ROzRM6|(GK4(pl{tg?lMH+65pBf zd=E8P!8kFoR!W={3LO;du{2U5@77m{jJ)a_gjqV6U9@Yv_Z|fq#bK$alD-lm8omOB zymuoW5l?`3Ja_;7!%|`H`)j827~Tu7zKOkoln@`xI#;i@v?Lr^C>khgsXvZNzOmPJ z$AsdOQ>xZr9za(XcR1v#*Xh7BfZRr{qfRIbe)SJu$nRehz-ac#^heD9_gv@y{v{9n_CUw*igoSj z{c`umIc7gTC40HH=yF5G_b$bD|L4_eeW4N%mI-?3en!D8Iq6?73jGU@6R=uMLnUmN z4BIcm>}I&oG<|8%>T>xJ_cwj@UF8&{nJ9_+`g99yf~DO=payGWjIFP+GtNo~33%OY zvbUootNkC|?hqzjH1Fl6kJ>odbgg&EkCDVkiGZ6Ejq3PnEFhjIe$lg z!gkxwg98+02LIFBWdyU8AIX39e1F2en67?uvmI~9??Wm%7^!W@i3?3Ja6l}AL)`boQvl8~ZwL~Ry8Hh8)q`92`+d#Vc#cO$ zw)`LVK?GU9pk#oD=|vY(j^zwnftGiv*l*uy@KRthRZ&qv{HThu$UtaZ0qoEV++}v>_6AvjPy~|YK!sK4F?m!f zi}GyaIZqFji=tHZ;&GXAa)HyN!ESomB$ZtneJJYxM=f+5zfl-}21J#xW3 zb006{_y%duR=p{)Id~^CQG?2%ZtDkB{h$)H^4WcltTS4e%iw?#7P&liJu-sYx$z$l z9u##wZ3L|iu1DnGEg z>bj8Zi3C*Lw^XIJm_dee%{C-JYJ^CF2^Qoru`6KE%twMLrVYcc)7ip61)Xow+qcSN zf_y^`Uy|*(w8*`ao4qoVS3cX-v14bLgDf9-OPy*2g9wqQYl!INY=9UXe_LRR4Su`?jyT8=!_m2DsE@h1fV7nrh0OUOa+#w|KiL~ZX;pMnZ6L^vHPV1s^Qxnp*XD|XsWy~u>+V!+ z_5_uqMIc)=Aa%hPO<+&(kj{RtH#RaMffprd2=r_wnoRT!QBx6TKvIdK!#Rf?>E^F&WE#NRu3T3_!io5q<#uPLau<)b>-i!`B3Jqv#T zNB~%3n8&-P49a&~2l;FsD#A@jpCC017Vs(8*%*+e)+vRE>}=6&0##;k+e+-1Li3%fcOt-rZ11v}|#iHf*RM zAjT#XnCyo#yOZ<&1kRr1$0;b4{@DGDO4t_DdEZ>X~CZX?tfx{k=-pX zo_)oLA^#C}uG1|`u={xkbi)DwEwzmnu^^GXB49DJ0h4%8lk-)-(ufdL4KunPnt*2RlXT!6S zBdG)UGi*YWeU*5%vH=sy{ts3g%0p_b)8CJvgl{uun5~#W3uY7K+%ynkWU+ z03v~0$v+K0RXc-2)IM;dV3?m8>`zz9GPZ(_PhA=!RvJl+KRWnY@A)|}1Zjk_)aYD4 z^a#r&SwQ^OuqDk^lu5?$LNt`iPVNYkYFCh-t5EU* z)K?LpFeWDjFtd>AjHwYKRwQl;K>2G$zuUq^^kBFpV^c_|fE6D>TIOA08EYY+s5 zfOd%-Q)oJA1?M_VUl|0A+298l@R>5AB%JwzZjL@@^q;}nVE;&47fbgRq3(c_0!vjS z<)(dPk^b>7s;WH`St$TjmTBMNE1P^-3#ma^$yY<8qy}@RKdvU zCN->fXBs>N_J7eEu7GG05LZ5X_jN1WT__c9_cX19rXT~zGU_4TGq8~mPtTF=H;LH} ze;4^RYV9}ZI;dSoZky&oX}7)k$fKhpq&t*sIvs(eIDvPS(H-WLEDp8T_Iun3!sdLv zVd-#HOqi(@FFMjKM8AiNqVcWO{Lb@V*E&~{are08)A3v!TR@%ga2MKFg0V5Q~}J!!@(t> z!WFq~X1WAc$66xdgEMYS=64WL6`bPQ5#4f50f@1Fd8tu?z_I6KpZ##;>*8CU-|rLs zFF#=Y8RVw(-^x;P;^}=YJNh-(b(8{M=$RrScYw&j9PD=4!#hO<4jrqkyWj9cjLlXDCUFLKu8w% zljQM$kz?Tor&;;AuoGFq5@q*sXUMKD_u0Lq=Crkdmp!Gft1BV6-i98n(>oBrtD@ur zE3i$jCbxG^h{w2zcy}1E-ESUO8eWQ-WahOxz z0}|roAT9`;lmZ^{`dVs$-bzg#VY1zu!z>RZZ`xvl&F_Jxx#12EwXQaRLGK#x$U?L| zU!1pY#bzJOv>j$U95L_07JO;RV_el(z7GA$>kG~ph>M|>Pt+O&Y2?q<$Wb0LA041~ z_x_>70-dm_!G^$B7c#93dGG3Fl?@uO%%6MMG2G+c8~o#LPTuL4=&zb+JkOyd@Dso_cwe% zozc#9d9e@CGhaVM261woQN{DPIJWo;=oHj9rN~hcPHXm-xrxu;hD=upg#lv%sJ~{q zDH4j3c*c!LdlE$bQ;2OgBBX)K3a}%qG*m8RNzj|M5 zPj^=*zFWDOfj^mC*Gx_I za}uu~#?4r}3(a>z*S8egvKdq~~d;hH7sYbiEn}za`A}(Noph0Sv|3WJT1(J|!d_Q0NsWpg7 z@tzs@ddS#ZN`q%*ExSCaNT??2@1+b-iF&;gfxd{B?@CXOmSzscnM*h*9nrZ7*z{Gs zC_x6-;rlK1h7W-&>I_od$!!4a@;vQA^dbRNuaBYIv$@N48QpQ3;aqy>U)oFEW#@gl zmzU2kz8rg(Lsg`FooNoqj|WHcC_O^fI>S-A>&Av66G?D8oypFd&#nbOIV41Nh87Ru zanNBS2;qO6}S3qG>^u*Yo6N?#L@=bV#UQDjva(-4$%T#B8DRaviTZ z$@9m5^Cq-@@h|TZr_#urUF$7+Qxv`{+gg#HgrNq%yy&idd>7d~J*r{v@bD|bEc>*32>^e>X0R1oiG;?yxp z=?`|fTU{s%aXs#QwTq=|<%TQ%#CEhSm#Fw%Nj_V?Pcgq7Hqw6~RIf$&o%qq^%<~s> zK_`nQ?Qo6EDz4CP@8-sn^m2B4d3kkxI_BhT6oBz+N$8J2*_pLC97Fkwhx)I7!c$V{ z)-LELl*~?YKOwCn$x5>azKnEHyB`|`a6s|QJfnrBdL8u#pX)tZdBd$C8>TvYi&fQ> z42)mA0dU8OlpBv8J(@WJhVjTw%hz>xE?D@W;uKWb#(R_&9|k{ujIwNGsRoKb0&tB7 zNn%{{%+yyApAp9^B7g!KaqW#G%JCB1+m32KAYsdrH^V|J%lqRAEyQw25>SqE1_UxL zl|MO|IRj2pZA6)l0KW7uc~lC4yk4k6l>RI+0rF+s(&BJYum!G8Gf=~IDka?TE`=lr z*PPVS(lQTTv6=9{hsh}|{id$!%rCHPNjTZokg;qCz$9JslDbHhnwC}wPCx!oxboG| z*c}{c1>js4N&-l%?*h&B-uVN-gM)XX+cE}K%wdI*bWlf>lV5}k+JA5wh?51ty|8*C zu?pvx<>d*jbyEimX#|1UY(yI1W`i^9b<>Bb)M;95P`rk|j|Zq}#qoiw#Bu1f83yxZ zcKFSJsFsLorE5AOKZ0mupjkEqrS0`5i6x%{VL5>oh+Pg?_>PW!;4AubyKe0;;lOHd zWz}oYj7}`wY)ts*Q`o4sjf5lVH!L;zd&zUJWFq(}K*9`!`i@gff4*R0I0$3AuA0yz zgJkKBB{bT%dudtap(0B4*8<^x?d^ZwOHkg-$>{vjNK=-mM?$!| zhRgx`-ud)hsV|ftLq&yfqh1!5v5>tNrsF2#+c_3ZEG)|EK_aCPSsy{6#g}%XBwSMR zj1?}`H76QC&H#`NH5~_giya^kI{KbF@dP9^$Pc*`+9F5~);m4>@1EZOyNdrMj1LIG ze`pAM=Vg4Ydg2^HiL6{n-p~P2!UrcVhNsB!Yn#@oe9hCR%Pk=57zD=S$9nOpT7yhq zvBinX)0&#wk=Pm}UtQ2;sfE-^W1*7|vqMG9H*d#2Gvt$i%C~DdsKk;b`$-@A<;mc> zf_+k#g0LKpe-A=@#*d|3U{%60hOgR(>mJy z*cLk|x6gnfRmi@L119$Qr(mUM^bHz8*#miP6Wbg4w-7wJw=%W}YWS}Cx@;-+&CL>r zn3>BJjEuUs?u&!|%ws7{P0ek7)~`NYkr4w%T$U85B1hG)SyVGm1YIoMyA|_VTD=;v6~XFk---5IH?Y(7kK3o`bxZ$r z05mfRr4`oeFK&wJ`5Zm17Dd)8eMT)-8FlyzVctUEfRfe%hwZ2iXCxelL|DP?haO6f zLpLK8iwWk?O-0IjpNC+td%?lLjX31?$f*p`yMc(ZW}dOH&}DvVvrQmf8mQrkUt|Jt zKSoKcwEGsr^?~}=7P|1hlr%v>pvYr2yk0CjJDZc^7HU7~hoEtw%Xv%7%KwEzd#%b0 zhU_=^ud*;C?RSPh0YvpG{1`2|2o_%4O|N&LhS&0H#*#6dYnagIO|Gjf^`c0TAz*tm zZ*zSM0sdvh6aNWIO9Pn-IY&87^LCJ1y2t1Ig=*32An-+Xq5F!wRyJ`wY6gn^9Av6n z)LMj^?G2Db?Mo2rMa>A$39okO1M~?^eK{LLeK4wkZooa#h=t66^HXpmuqJK0yg_~e z%YL7BK00w?uK#Fl9wj`nXFN>i%SqcK@bd)B@z8@21Wh&IgF62}39~Q!ERR2$gjxUd zR$vstzPg~%ee6Q*Cz9@-ML@&V^fUq8T`!Uf^`-j!(JkI3TsJg zZ(UO_T#Mthn;0hvdm$Bpf$V$E?(~H}$N>MLEjIR!P3sm8fylMm9yVV@z;;k0e8>Q0 zAg4H=SuH@oR7W%It}O90G&FQEgQnPn_}F09eI0!UFIPm>d|PO5>4`f62qfZHhR@oK zmk1TXD)O$gy?hc5183;F_<$=dfK+Dc%3L1~&OcLeIbg@4o#4A1k_cn*Sv+ypJf(4Z zTPKgQyk8lsfv_|I(|Yj_rACSO3YFs$VbPbCFv*K<2~;B3m9BnnlMX?FM;ihv%+wrvjt!;&5E=O{ZGsp zJB7*q>T1kM-!owD1EAA`HRh*D!lP~2r6(1W+}==o<|bM1v$vp4w{*;6kAbyP~lUc-%NBT;uwM?rD6Ym-U6|5l_zK6PU_a6(5k( zy=+$D6@a{<^_*70g#)s%L}rxv^o6*A8AtJJ^tB z*wy+wo0dt_Tzz)Zl z$yglnghqv5U5CyG=#&J&Pd>zaflUf_6RyiMug?$CCOOQaQx@-!>YU3X1=LHv4w)zD zvs~~v%PRgz*d_GiAzGJ^kE4SMKXS?CcBV~gKH^7 z)sS7$p-TbD-vEH*(%eL^n|0 zcg@1eHK?C{i>JR7z%5bKiTarbMf5fzTm#(DVH{u zc$x+h2Dh)pZbk9LCumUvqM#faPm8vmsr{*tl4eab9B-4qcQs;8PmbeXFE@11s zxlb5**k%Jc*r0w|(@rtc|0(Jb$`6FLynLwlQxXAvaM$bN1dI-&GBL0R3|x{_}4bDX~*iQ}&=Wo}9pon`sLYFpvQ- z4w8+Z$DMJ2U`Z<&lnZ8RFpD)aftcAqWEJr6lLeR!)TM!Co@kh3-?M||de7x332395 zHh}lyljMr=h{Ky&P}B#Pv5C*AvGgR@0?O&~mCw{3J$&ee#q6j1zE?z7{=xH})TyeP z@^atFT(E(b(_7^ETJ18tyQJ$fS&g)mVE$k9Y8izxP;EPS2SOEbq(gqNyaj@LgCcL{ zx~Zxu0B{W_Ua%ofZ7U--CO0u3Cq3NNM;eC+^{C&kZ#k<#>e@h)0jLew7G9_&XnXia zOAtla^HG!EqlyIRVe%2fibha|7XZ`}ZfY5+f|nxWGj-)kpM4vvyUj>Zl#ir^q8ni~ zqV(!#JJJ=GG)N{Pn^7U~wLNZUoinw+yaj3gf4le3Wai|EDN8O+n7VvgziiXXkps08 zSHHu;iLNI}V1sPfgme!7axh+vOeWXyFOuFH(+B{j2EKE>SR9%_3R;N>y4ir}OEBT`q}T zg~``H-y?yFMZ=f{ObuzFl=VM7HK`|;BOE}Q-G$c+_jebG#OgdIX)t-AW%a3KVD*d# z@_V|if0j^p6(%K-gdHGvJ&F(621*j*Pcn+BzCoFzdI#{N*Atto`N4 zY|?|(`K6(b$d&z;&i?X$e7_gyqw!S1EFTMU;T*qG9YRVo?*Hrc&P1eSixc8zd$k9s z`ZYpR9x>IK0OQ)ucb|6XCyvj{tL0C$RZ%@7ci4qb;ay(H{lY^?gE7X>7DPOyoG#+ zSSloTuJ&LCZ6S~&H+buf^JelPAmx>83w@~D*DyIU z5Lb_WlBPZhI6cL1iADR8s#T9;1jV+`iFcBd-_sRlB>i>zRvz5};}zG;I?n5Dc~#U2 zEb$vWAAhIue8!y0nvS<{>Ccc~s&8n)ytxbk4ssJKZ)|j)aSKRBJyTR!y1=3sfv7bL zb2WM1Rb_gFPQ5~uKOOaY> zn@PPybm@V^!pGYZ!D&FI9?B8_@@W{54Lp-Uqe>kZN3f zd3AGyOC{z9&gHqfKsj?C!2ao47KiNGKj;yx9&#lme%Z?X%m=v|K~jrs_AG&*A_FTY z;K2jt@@qFVsF{x)X@k1>4Nv=UkoMH?Aa^V)Zw_bsX4=7uQV6-kTvYt7kuozwH3F%9cg9v8XGz22YR z{g@%o5Gf-&CudAkx4}40Q>C^Sgc13n_`92-Q$qLp?+2I7k^VmEe_IcDR*D4%*ZZoE z8E~lEgoI?Tl!okp8ngAoR=$(DFdpYpt|*BSX4+puhFqI!toAS`F>kB*Xg(b*PGo5^ zS_DeGTK>&U`D#z{nkNZU;&oY&5%~|c1ue?5S+)wSKYjcrK8d2j-2*We1pi`2uXqsK zOl=oKUba6oWw`>N3`B%lEm2xn3*PkCH#_nvF0+R0xj8rxZ9MpGR!i()6M0UQkNxcaHk{jp`)YTKH)8$$DWA!XzQO?x79L0 zP*lAeZj;=|T;=J*@|BZ_N5|P8z{(bK^=APAD+)`F7(!GT1)^WA4vpn;R zV5f{fd|mm;g!kfXrdLJfA+~R48rEvtRdXHYr4|-GkB4R!T>@vXn6$ky)-1YnvAr!b zrln})@k`69j7o!!q{Xqm%>P})KW6dUj5H%78fvMP#~{~1H(Kfo98LluFrZLlJQfd3iRjTkskY02*jUK*H_vY%LCbL)NWwe)IdB#!!=~h8#wJod*8!2;Pyn zDn-_m;YBEA;f*)t+%#&%3e~W|Curesaa(?Rel8>IgA#@IE>7MSf?ec-o~y{E+CPFM z7at2>ubNj2+t231Ys6srF0==${|$o;5$0V*N_sO8FByF56xjs5bp z-{6`%i)}P(FwQ|>iKu(`@^G#=*vR=7U%u2=^~@!VhC_aLt>y*ZVm&>;5XZeVcK;2# zL@P&omm_$%dg+iQFdVU1ns--HdJpT2HJ(#bJ4~a~M|2h-sNoMM@gY9$CU1Dp*OoP? zZ20{>`Gv{CuwFrkq4-c!OV*9bElNd_`VNfmGeh{_K3H#SGO(kdK2P;V<{y zrwl-~?jHLNJvjP70_Ud(`?i{XnxB6zJ;sArcg^OV)4A7mj!(;a2h(j=&OYX*E=V6h zLWsKvsfFHB-8F}s6aYgBnVNz4@Pyxp1st5cHcn1X3lp)DUJwMJveI2T&X`eXaf=|W zYBm|qJDJwqF@~Vdx}VX;s->;KqjJ9NSpN$~LDO@`iBMyb9{<}5ZF0jWYHBn2;O6{q zC8&frAO9%c_kqF^=I)no59P=u03q~a48$k?k^&7M04)utBI75?LT_d!@T9Q>G7i!2 z?X5et540Okz~SgvCej^32MW!-vq;YrjK_S+BV~tEbG7;9X@e#n4HRdxV?=hK-LjgO zSf|!H6`My}2HK#nX-b7>65DROJ7=--uC!ZVt$Iq?>SvWxVR2i(_GD6Db~qRD_!s9R zm`BkrYsH<-5UV{N;RCD303F28g^pR+g`GQhR*W|fPMn=7^N-5AtWuu@2f@m#_NUM2 zCs7>Bs&8BG<8m#Ql29r+mZvZxR7(|wS>ffmoUjWAjSb7zMATA1hR_BgRdt>G{$n0| zIAPSYMJO9cAYhLQ7*|B~gnk?b+c59TEtMKNI=KxJ(>L<0R``Y=51GV`G)0NV%uppq zcX$4st(F5Xi{OZCPcW}D6w6!!sD=*MapvzZ3fWq0)Q9MUtg4P=CGm0Xg++Wm>FGFM zq0GK}SsB;oss(HscQ{zCyw&h{2#|zEx*T`?h6RsIIa`wZpEO(=Sa%jz;US>m-1@Tb zr4MGI-4fKx7y<@)M<84+fPf{KVATkH$di6~O&9k=B!Q=4I9Hc*#N4$lrGf6PZC8o@ zjlqs1uUiOgKE)o{KStxf=69VetEg~O--`MDPfJ=AN5+>k^1I5dJX1j?5P;AH<^Q<# z9YD~!1J&sX?cv@Iq#cixbe*2ZgrGy;Es1zq2Jc=9zD16i_Yo5$q|@Q(XcsnrDL8s# zg(>9{!M^tk_N83SBE5GGRjmP>6XKl&eG%NqpL{34XUtI?j-CwYhoD9o5F>WdaVj^q zD*{co9XQ;L2I53Ap?=Rsv7E8b8N+|}Z{*;&Sy+FGkQx{H{7D)qXFH=9cA(WJ-e`rF z`gvxg9Kg&zMq8B=}-9X}1474*&inppcp@>~@j<=Ooy7E0 zzM{MSd|Y>^e%b;5v6%|k;9?wo@h8&LCG|KpJaC`AI~&sFOJCmn`AiBDKjfnkh`hT| zZ%PI(o{vESY~I3ccc2p9WOfFxBN#*c<@ZiSWZFzlkz>NWlrGeCdd0;g3-E^6s_!~# zuB_WgvEn7D>I}73hL*>S(DEa7Y*jhPyQI zLmH3x)ajJRb${Ybcs{gomMu;LHSJ@Zz_r?dnH1?I3684WJ9H0^U)84J(!zGw2sub7 zPO+~^CFV}+WLV`R!r7}-rc4Dz`9u4N8O0^2ToJXu^lwu588vsz3f1{p6OUrJH^;&( z#t0T;IO(wuznMj|eX6ZJcg$aa4jhsd@p)sDJEGlIbB8(4;l9T27K+!$){N093;(4@M;N^3*@h+} zX_)MTkQk#~-Uw!Uqj2VE5Nz&|$DQ!kO{+MySzWVf|rtBq2dIUe*bWzW5XFcZ7G)ontVI*}RoQs*DB`-4xG5txP`CnEA&QdV#}bwW zSQ~?}j$$YA_v~9+L3tyTgSmDzhW%ozG_`nun_m>Rm^vRcScc9Oh@f3W|JRRz)HgI| zsi>{Yd*=7!+AE(1U&&rxp2TB_w1?%|gU(}w7^~dDj9C~JubnErU zV9@oySRuQyZRH8af7%MjmYx?6d{@Cm*vI;*zJ4bRp;L%Fq+aJ^K@(K`%ArS1&1yh# zD8^-V@SV zJxsd4k(B-hDrEAFn=P>zn%p#%=IXa;1jX3>w(3OB8SM72!Qwqw4e$D$O&4DaEcL`0 zTx$0vDYX5BtRk-_1S8b#%4_=P&){ij?H!vIExVKBHp)1U^w71x>D7c1i6tq=8vg(1 zd$-!#cg9<`P}MMaPW3F7de2rS-ZhPRLQ*W3g{GkC)nU@Jj&H-lWrfvC%n;n|GRa91 z8RCG~%g=OQG9%?AV4Oo=x_I=+s;lQTT)$%*!U?CurVDRVu!;76Dl0TzuXBc!jeANO z+IJP_WK({gvlW*p`Y?9y)}Eeg9>FY2ra5WGTFrM3Ju-E^(O1*9NGBPx-EQSpXTU=^ zGooLG843g=+ySzv1v;{JRZUHINhSpG;9o;m{Brs;ct${tM8I*Pr}-pB4OG2e0#xi= zy15Pt9-vax9%SHs7mV+>S23*iC8U%gl(K=SkKv_pf4w%BxZqizyHv4y%p)TQ zg!8Wsm_^!sSxYTObJ(cV)5p1k4GLP0+p|}x#~bmHLPL>J(5@{$m61hS9os_s&MHcq!^<`k^}*zkwC?#$;l%h?B2R<7N;bD^4XZ* zD1g9E>gY6?^MG`C8z^-2JUa|1tEY*HKI>VW`Tgd%gRtK)FsmvqW5geXka+8UJ4{rk z$W#)uC5NQsjk^Qu8kD3lZRysmrco*r-y#$Di{md8l_5d~IyQYHKm4f6X z)Wm)cFSz)=7uQ}#`Gnf*Y6}ncy)#`ZTUlZ)z~|;c!_Jh?(zY@3Z8)f*D znd#`YD&6W~9b<@UjjtAZ?ttm=lLAc~LWZHo)=E-XNrTjN#?A_`&NH{lB;oRJpo6~tTlfAeFF!)V} zdl92(&H7z52;T+3I$3LLYa(fY4?m2! zQiZ0{WNIZuv(`g@{Dy6#d*|ZQZDEmYtSir!9f#RSI(Q|~sbx{3U|R@T{OJo9n81nM8x_us zZ{=N12H%qNM4>}ej2Z<(UjbAa8D)1_=I>@kFnz>(bEI8=C8chrDprC47?pMHxx+DU zpcdIuVwRn21T4mE9!)ujG!afScI`;+v5fu*J2LY3Dy*|#N*hhC`&HEu_w`!N`%a6K zo5ZenIim5}+q$E+26e61sX#xawXXlsZ`iSIBb&6d`uU3WdK2OweJf|V`QhJpMUTGa zl-wSwvoyK`-&o6eWcQA7AKbCRYL*Zxk(I+!L!iRz?cj5Lrj!fHQ3)As_d=CTN<&1@ z_A5a21mHc1#`{xo+|@PDTb#1*dlqZ;moTVHwZCN{TnFiwiTt^_DCj5IKD^A~UmT^g z&oFabd@@vlvFGieliwL-{p%D~ca@wIw+tQY356G-mkW#ctIhK>?UI-Y7#2Qm)B5rTFht$*ruAN=Nv~ujw(=&rA z{o6IoXfT~a}+mk%m}j|_J@kw zbI#W-IS%7(Rcb1OIt52py5|4qJT+uT<-r=|YGjo|BX;@HgxU zDL+ZQ_0p#zAWDEPf!(pLUp0dKLip-Rp%DZaC&e;7pjw~?LkHAN207#x{dnZ*XS^(& z*~EtzW&M7;4)f+vyyRG8xf;wS%n<$)1B$63n6n=3D~uiEIIVt~X}h8hjqI?U1}U{Y zDScV&fcN%NO8RV6QiSU*>aAj_T_Y4~wc(j9KME8@eL*c_$|XN?jC|e6?K<=j0QF|> zlm8rOnrZ7te(OS-Y484)YIz9t67J=%G6Z65Blb|TJqS-&U$;E1mme)|C&ZFtq@7(h zuP8*n=?^K_hpE_}(=6o8w-HHL+q&dvw&|Yzd7#l}(46D&5=s?N-!)9B3p!$aM&(dm zV+m)tvlY9OxkBGy!l1VJYI|^})btI%v!p|&0q@*x3 zwU1ysh^lR68Y2Tpgzo^cBK1F8?dK5jAOAGq^}U^}I(g@1EDGIisx$<*kVjdvecGL+Wlw>hrJwDdYBg9L^N9tYM4 z>3rw=R*oKijMbc6>lb$xZ;)Kfj(EjBHR^*AgRWl2tz_o4NHP#oSl1#|M*@B=bv~33 z+u2xV<8&IR{& z^N*+b_2-G9#ISrTh(z>2d%NUHd(L>NhgQm!$y5ggYOfBPG$ z@C|3DtBB7eo+O%P&>T~vKYtWco z@zuZmzE<%KsC${~1Of*rE5!pxrVVtz6+ZZ#aD_@~ufwpU)pS{qKqTjDy)&^-p6rFR zBUqzlIcJ^1Ril{Y{h3zkID!r20ap|sv0y9*g!avFe@NWuzhYXo$f;U~Q8FRr^}ZDu zr1Xu*pm=MX0f6SjjO7xOf1!-`t{smQITFR}d=;8CFI)(wn%o7WC#i>@U zTiqf+WJtuMquS1^c;OkefMG8V+IYa(heEv!5O8%IdIXB`y#C}U+>pUYA2opz2SML7|C2*#tJWcDqWT4}qYH9K{jRlYR+MsEe;&~F1+ zcyDN=jMu#nyx9k#*EID!8dV|9GdmyJgV1*698@PHK>4QtNOMzt1ebWomQoYb2VS}= zD16x6{}eSLHvHVh+)~Ol6<_0Zp{9_z%w@metN4;^%Nv7hESq2J-MRZp?QOsEZZ9~$ z@2RpnG%1Bq`-{u}wu}hHZbeilh=FgY5M00gRV{?}_#08%(RS?FDi`MD-`#Rqq0|iR zPJVu}Vkcbjd|vVVmSVoOsbF0I;J;qQLPhxO;WbO|Ym5SRu7>S4kSjHII}S;f0>v#> z$PkJ)OAF%$073K(88%j+C2t0H)hHwylV`>MmOP>=UqlGGu8Gz*NgYCG&%m`0!BYWW ziV8E=V+3Tj1m7nqi0VNV$T?~CV3Lm>SVK)4zBMml^ps3M#g`j}=it!YT%xn29>6}6 zJ^A@UJGAbUZm(y)q3S$fz~XT_Qf5&z+VvQdsI6)EtH!FTfV57b`sp3d+%`;PN{uwn29f{l_LdJMq+{R5YUXqZdPQ7~ioKZs+ol4kCsB?J_u)PSq#@_v{3klsf z`@1#K|mRui@PHG{m@$R2WUQ`I?s{UdSh?Z0CVS{2$HekGP7vH*k?erOE(0_i1Rn{ z5E-27C|2@C7SE6iA)G44<~@PMgPLXZ&s!PaPW4}WTZAOqbt*b$Bot-8Z%9W)S8>@XOm|PYCvF^et_L| z|L%=mLJQmSVn$hPtj~w4Yx*zgB@SiD9t zh^@{ptpvasN_|KxssQP9aSST>E$u5N_(i!EPa)n6Qfdlq3gg(I4dOStV|k$(^w5bz za2SI+_0f-6^Hf*(r=KR~-}UciASv!%3$@D@DXxAZaP|A}{`!ZJaOC(5uG_CZ$U}@>eo**HcPlZyu+bd9JYhw>nRYp2sk zHTwG<)Rzn*{+Ogwh4Ct!D(lW`V@~cF0S%r4#GUzrPWg_hV6ae3{DpKG zC{K5|wvT%MS!|)~3N}F7U9(5M50tJhJEnfpThs}L3 zkhJIAgq~AcC;avSs7Y-@!dL8+^WLC41Eq$KOl7bGh#d`Gs6r#)5-6sp8N4H+4t|Ok zz7^PhTC{)L$%_X^ChF(gN{teDdpd(Cy9+7Qwx2Le%Oa&43S!)-GwGHkv0kYaJmS5P zHVLZo)S24Gwx7#&v{7*e$hmlTaWMp@kq}(*b*P7AyKthoS66wq&BaV$30E7<3A|R?L#px`*ou(%8gv8gGQ>)b$~O zu!JJ8j9{==pswS7^Q_(&ovA=}a>YKR%ZIQnyP;5T04fZqe5cbK`?p2(>!(Do1dwD@ zz+#aYO@Dc<-7jYylSyGTB>|uhhe@gGv#Kh>N@J+J#;B0D@hl+725YLT2b06$u0^Fn zBu@?&JARtTQ~OT4kE8@|R?m|ol=`}Vk&qex?S`8>@fAe3#M6Aug(oqW(n~f!$C&C; z+f*b8a;T~w(Q}UXF*e+!Lfj$06PV(Mkcz^U>jicS_9L&?N5;qV5J8ck9EiLmW^18u zI+s%deHIA|wcAiC2*ty8sVqFey*QjPeD)Pm{t~BRFS98QW4BdaMh|Za0a^k!i3$ib4n-U;6=pNX&34%n zX1fhW+X^hfr7Xr~&MGOBWvuUmAgFB4C5u3O{;7xz8Z^cpIL&!R4Qp6IwYR0lvVwEg zaTc+^Oj(BU0n=s#uhoyrAItrsx9E8LcS6e7og=NHUzauC9{VBT0OQO&CqYY_e=^Ru zWafqJ8WLnER0GiTbtW@b=~E)y41qAbgo~I5xFWc=V|Fi1s4UT=`~{SrBvi&~044Zo zID0dc6r$4SHct&}d~zWN?BVQ}Czr=_kMTDQff_Z+y^O$d%ImQLSOzONKc&*`6^yJ529s`xzVV zX}u-;2`Rh)8m=pFmE3c%@ifCz__3tcXW5uMz8(jOcj6LQ1IfWInt}-RBX_@t2UJog zPaZaAf~H8ZJ!BR1iBdyON9+zZ`|d;{dEg2KVyJ%N4$b2`wa=TF2*M}wq=syS><$vP zG9j4LDQW107{7?rg3#dzg;g0Yv;9-ZpF~x@9@G?aG`W)h@Hk3@bMwOFWq<6iTi~bdj})&2PVfJ(U-x5Q{B0%Z*N}bqyeR0JHDE%);2nNMh&L!J zf~1Yl_#6dj)ejC2xo$_`Blc_(?y#SS4?E3~bhX;2J*+!V?bAEs^}0Kam~FL4L9Ma! z2cWqBeVoz2f4tUzh7bUia|&NFU$|JEx6N}bhfRVdc4%poq*PS@DdO5xX?~hnGv;dY5(%-0{B8r9FTa(HW`dzXHL#Oo) zkW?=?h3w?d=xB|v;`_gTCnXdpRN92N6L@+CJ#Q}^kg$IjOGN@g`8Vvcd!c4cBMIx` z$56qCKb4V9JckXSi zywI6k(IvmqI{7hD0Rd6~?ON!OmAnW1ngo4akV!N`lA;1oY`8^K9hmqN(R~(ripz?) zOH?|J3dIcF%+RmbL~W}wQs{FV0{o@YLO4tkNE)W)X9E@64B*KC)60ulR1jgXKqgcr z7EEV%v@8*(Az_F=8)LE?LM>ltsXd-)W(%ZepApsXupA96TBN2V+`AgTiO6yJ@vi@} zff#pT-@oqF_?fi)FQ59KjW?_ju}lgGX?D%uDw`i2sJjy?;E2oe;USL)sGMQEP!{&; zn))u=+Kab*~9%jtJVr}62R&hw8GoVx#H)XBzpT8MEywD6g1R(@=C8ttx0k_rL=@lX&j%%0#_g@wo_ zbu7R@Z}b36Pk*EQSYCRwBe$0iqrj60?VD11RIqgU@~N1%bso)5c93VE7cawbO3V_L zI8myd*m%;C3a(W%%i-~*5TSSJ=k>gRH19HUKhOK{7J{UcyABB@-1q0X)R$j9ipT%4*J0|z^y@fdy z3yD-swuN`6_3rKPm(0?%Q77S~4e*B{?M$ujT7|(!zzfuyM@n(%z>2mO>xsDC20iUv zwBv(AL%V6)kG%UG+o|NFyly(bFMDsDS@gc^U4I1@-1X<((2^JZDgn@oQllH#6B9*; z3JxCvkxGC^QVq=1_iLr6*3=I`U0MPQ$iPvrk9T0zsy-&mtZ8a|dBn(A16DEmw|?`X zbIxo>p4f5UFTUJ77(c`&74ZjzPu#$UJxcOYmx`F6I3_CEj*1|drD@FYqXAIsYj5-5 z^CryDI6z%fMbgD)464u*>T2~n^s$B}yBS+|+h`snV-gbjbGYe}*5-C7vC>ndnKhtB zn6FsBy2jjS_!(^jxMe}I6BLOeA^%fKeOz+I!}`7qauTJbhn|%6u{eUgWD0qvB1+a> z_TCqp<|xZ6e#rhf8I^tU_zmpC^BluV9Kgj&EJ&-^3N_4wp~XR9Rp`Resy935c}AMl z9SwI57R!K6oW|>KHye`$MRh|B`$%TXMR#Vwq_qw{xwBuIrZ))RNjEy|r@LwIQiN@2 z$=L~oz2(P415g=P^#ob*c)7RJ*3BiVXg(^)L~&Dd+1KRxUKK-2<}yrAW8=$rZbrgr zdgQT}3GaZtcYhaUr7*#QX)IOE{rm!e!V=4@eIs zZ_AropM8hMn(ct{_IVl6#c=uFutYQCh0I19mjU!(_WzrlljUa3*|vh zRe_EPq4arpB_F-r+`-|Eol>$j%6AuKcc*-?BEbs>YX!D2iH&(=ZnX>kE&0fuz5qnC zw?P;96y5Nk`9`>aEx{e{gkNf6WTZhN2nB%_6Jq0TJ2G#vG-Y8qTClwcG}?8DeLxcL zrgdkKxcMEBBuM>$3{e+7wPA+>GH+rNnl;2j25~QO0Z#I{^AQQx>~~4n+KRPIjPM4B z2@ZMcJlqeS+mVH(b!L8fk%i&9A!~&Wtb9^P`2q?^lbz}!qtiAZcP;{=N0Dw}-z#oz zyQR)xcJc-Iix7^PhTu8*(2`)GB5KUc+m0j2b*3S%bG^Nb9@}{CX*&T&-V+$DrmLwBW*G zi>e0YnTmvV9eT%BCBE`RL}XCdhVP5dC^ElcxHkzT`e&M_ae;(~UtAuIfrI?EGRdU{ zTqA9n*tlZ7il5Yog5KPjBZ7i4(`C?BPRO0APc^N6uI{%m=>L3KP@9A!;8P7*G2g4E z;P~gyuUR~QCfzDdH6S?_BsXPEop-3YE^W`wYYV@3PJ14Ex7qVqFm1|~nGZn%U&;)c zVgd~oMs9=X-j(~Z(M~JRHU1NrQdnGlp{C`NoRVT44$K)KVk4hxs7WDYJRmyjxZgs{ zD`pb<54!=VC_e4ETl^SY%QVRS(zHJH87DyhS02aZ*9P?!P{rR>Y|f_YNk+TC(EdCp zUBGLnU~lfxRucT}q#nUZs(FP;-ZGdit~$_TkcG9zhcU%z*8F3Dj>!-6a<;CdS@?)^HJ`5?wVn_Xcz01kS%&;Cy+Q z=F7e)I@5Z4I!l~kwdIPH&QElN^Fh`3y-BWuYZ}O_gF?~DX*Ccg!nGaG3zL4dPK3%pGbYl?(pnuX+8ql z3Vyk8P&KVjFhasnH*Xs0>#c?FW!!~e@$CtkuteFRxb4CWhk*WdaYkAX`R8 z<{PoaBnjXanYb%(;agJKuj3t>6adTbQ<_lRUgm13F2JjKU=TkW9OZ$>@wopQ3g>=g z9xF}}5Iw?D!Zt_OF`8&mi2)WA>8tNVZKK@|9lmn3^E^6PN4$6dGm2P8;F{(ky+tGn z{~Wr8yMf((BrIU5T5nPPaVsAsh!%=}>$gI!_xr_M<#gJvdMZo2ik3GMiiwZ zJwmnH>+jHTabO#%?dEiOV$=md3iv%BpvXeSIKdwIB#0e}DApm`x9Sn}hFA7)0`kux zI(Wk?ROVSQU=N_j^yK`O+k2!UJYiA;%P$2VAZ_D(9Ukmn0KO&4Z7)n}4kjX0Zmolw zb6Z08&^D=z0i5J^0G;frZZ2%Ai7ZI5NlJiMTvGpdbP+fM ztZ2QZbz56+Q+q?Q2OxQ(yqGMD%MIt&wJbgRUBRiq0K`TRA{jMLAciE$b-b$4^_U;d zlLS!%Iu1p-ej$)KH%o7N7zV->)9h;pj6Xv3zKX#j@xy5lW_Ewjm!kyypp2c}w1k&P zCTAUD$__b!%-f~eu};MKJrY)YxeXzFS-@Vo960zbv!!;IAb9R|k@x$5?7ewB)#>{O zJV~LNB%!j7M6yektSv%hOUPa#OPo;lrPFSWRAet(lC5y;N0TLF&yr&)`!4&=bKPd< zJKvc!bNao0^Sqwl^P2zEIp?$7_jO9vqR;67Wn7GfKW&UCAedwm(+viP#&&!>^D6`pL*8V7!Dmkg~j;H*O_g7zd(g>TapD4Y!_6J4(JWgI>=fRBJ)h#keVpMjc7ti~raK>TbKJ4*w2k#}@sE=oT7d#;4vPllO}5p)F(pdbOc zIY(w&?GzbThhJC6aV2M6kZDKM8~QMqaR4|J8B?n_6RY^l@?{K%R6cL}=GLsIR;Eb- zX!tO~srSiM;706i>ngpU5@c1F3GMjtFgf-hW^8CkF+R-p)RE7(s3#T>^b457f*$ke z3V#y)Tax?VRCClcNtcetmP_At&Ysf(JoEU%pcXzv^QE?0e)d!!5JJV1?+}G{;wdeU zX)W{ehn(}xkeU<-qF+R_EQMe%>rBdt=JDURuSP_$_`r9m=cqks2#`o%zF|A`H}^~f zqq*4W5TS%u7?`VN4&=x0hA?^KCrxrGiQR}ADXh(i_@hHqyZ2xbzEKj|7zXa`^XnH8 zut}}kw;Fw4DrCFFm%^n(+665mkmWjsQa*d38^E0~jwIT&Izm6R^2mDoyY4f91pa)B zV!+#Q>4H>pN(!I8^FXXQ1mLk1AAxAWuKf|0R&Uo#yUSSK3Z&=bf>&wHBi&}o6jy&2 z;=kTW8JA6@^Oh;N*FT;y0<6;juvNaN-VuK~^fA;A38_UHmQ8UO_sLLmaB##_4M`X1 z4_ZM}mOfx-2DI=CXYns#7?I0%?z!6g?n1tM4#jmy5kHAA>Kqnw1%1aaSnE-xr(E76 z$K-So2*q;iylA-Un(!;rr)2P~g@&Zd-a&*@>#ol_FIVFZPEHGE)Q50j$A(2F=l-YV z^mj^qEtiJq1DR4leK36DQx?-$d8Q*hU#4m16`|E1C@TsQeJ>^(gC}e zq304L`3HBbx@oRXy|_69T^};Jn_dtM++yvA#F;mcs z=0#lWHXTmB=Fp)}@kIpI;A)F`d{30S^y0_ry1H1!`hE8$9x-`0do6`q>y|I7QWo<@6q`hK#UtmMyL=b*WC{hE}FNB-d|0Z zYeQawe;ttU)Pr8LjT+M2RNc461F~_GW{N?$$QCbwniAxIrk`S2$gf@X-Gz-~Lu%RV zzD!ZI=Xl3%hkKdYgG^YMdvUe8IBO>f=}DzR{Q|0J4b?=_&O29MZ&U>s}jIXko&5Qj9A^zQe%yEtQmxM z*s6G6F)KR#t7`5)un05QzWZrFw_`!mU11bBoBZ1+BW5*bGIAp-!>ZrrR+^P5M&*-? zcU+oQaj70fbi)1m*uhLK!vqHpNXUI60~`!EMt-x%7K?f>!SimYlO za0E&8Ndr}0{dVzT|BWj@PM!5E| zR6}5fhyw7M$0tKgk}n~hOcCdPt|>`3s2xV1=ZyeG(g0l%9~0>u%G=yr@}+MIF@FX; zR>NA6pI;U!y6rm+El8rpqA=2zb_=4gmvs>Y@Pz~)?smMo5K^xi6ekGu)rX5Fw;@B> z(uD}-$2aieRLP67j{AresrX3Cqkq@5kt99IZ)h`3wiYMfB@$!o&wGRu(oK8QX{8rx z@7o#`K&N7l$c_#eK7X?}sSWXp8VXVSh8he;3@f z?B6lj&l+qPgW8xJ^12w8l^OXy_Xqtwq9O*j=-2!zG+;OO;P@*7nl7870@iuww$ul2h(1nc*@an;Bi~Svrz^0q z3(!(i^JRUyft(B1UPoh_7@My0)f~B0yo%f48FOe(m~XCEk(NYObf7`Y@HAqTJu;fr zW&6XMJiA*fFlYQD`J*Yq1<)nS1e!?5L0=;g_d>$=pHS@%k+ z=b)jl%ZO|ha(+4jvux{uux(Nz5Q=1dg>IK3oJZf`S z8YGB}!_rJAZ1iex)X^2m&U^d7FtRGT*zG2480W?4wC$K*FAfYmQUIiH}855T!Et}#2H1|$`*`3 zoV$P8;P#2?hQ>Bnxy++7%#QRm45)3FYDWzj(}okWNQ4XRse&b(Y^BDO#YcobEkWY& z9f9?VVZcm>$LiF8ipLTCYYk_eMq9zMcvMY%!9pHbcN zq~*XDL|0V!@d63dV%vk;r;{CG-`rTDq12%X+@H8L0hi>wdPN#K&5g5UHT(==8vV-f zk25qonaO=lVOdiju4>BlG)1eEl3z_Lgqp|1M&9uq??GYK6l)FE!Q=2Rkb)d^I6ONE za&QOa0OMMn{NM*{Ev$*e5j?U0B_n0H5=At>L5({2M>^$+U+lLGgYPx~EhVP~ z&f(?9ogmiXBw0EQ#Da`=?*)GBP|_o9(MdN`^SbWQ5Xj(N=mZ+G5+lZ2C7@mb75;#O zFVvN}%3tmp-3a?ldtim0=kZ%!)eUQ^63nk%?F_AS?Dhu;$w7MZL{$GGZ3Pvl#!u*T z{unqg{wD-stD{UvWIJ%$nZqZxtaZP-lPnZ2i>~Q08A|dZ320a&B#|Y5*iU4ZFUpS8 zo&LupyTO-nq=Q?ALDD(hEzU>?O?NS`iZX&bH~`iqVb~z+%K02{bLwEQd_6Sw2HwmI zyIQAU4rBuZ*?kd;4sF-8oS|zkXydZ%bv#NA&o{%2iJ7fz+MG2+tEYAR({JUfoDIMl zN37EHb6*E#5D(>4;j;sx>~(;9TwtWbF0GwYK%AA&fC?6Y0u%=iOm1p}(dl9}hNK%1 z`C1kAhK<#tT|TGWi9Q5>XKeoaFsbs?Xytbv!q)QgLtG~W(0RSeIX!lo`O^E$9ej)3 zWr1W551GCXo?pTC$ zQ!nm2z;nbJS#Y>uQ;+@pK*qN)Mj=prY0Yo=mIVCwT7S=X4sg|I2}ir4bM-wxBl62K z#-K0uE;bXN#Qv`5IJFg$#v!Lp674^K*DKa&!}^y<%@CL?6GF6*G)}vp|Ich}R5~P$V-twZpn($qo{jZId4*wPzVG}Qk@q;j14(1^gDBkj zE_opC%m0e}H@D$mk^lA~_*dk=c^Lm`EpMdP)dotwri=s_YDc;U6U8A8Lmb}KdWl}d?$a0m4+MR!Q)ZM*QMA_oiNw6hL7f3nGbuHYZABL|H-yX<=$Y)N8Cy>Ryz$1-*W zDZ#PdEr4}Ql+8P5)>-5UxetYXn#nhi$QzkK(Du}~8@&P-gfqHNUns#nA5zzl@%FLN zAs1hVrQ~`v^JNCd7?VeGYo=6(!)Qfm=<*{aBR0~hG`VAHd*BXc21WpOG;hnfW)2*m zFpkLHqTmNPq{s_}DPHPj3tF{i35>j|;5CQpK0)KoO?3MxCoG~*vTDmYJOU|VbC_LI zN%x5yy*1>>0bgeR@s&veBzJ%}C3>KXaZS+^*i!-4Hw8KE7z%3k7?>|&t^1Q7LjPm^ zsQQP3LtY&CXUx;?9&ikNC-~&2zpX94sbc^Bks!n&ogWGtJ9YXWv42Jn!6y?b$Fnqi zN2eC?FN&=~#c;aG%G`ZxeyyRKp zr;-cpGji8Eq%%RRCo01MXo@C^jt57G{l#~^t&AMHJe6VKsek73|33Y^!!^7h5IQ{>u>9CI}F1O`mn3#Ya`t~aQ`cX|1sM2dgB11XE zYnZ>i=5=)v}nm0Q3=5p`eLI(M6>n6`@%CH`zm;Y$y7&#uN)l z!Ha&np|#OeG@d? z_Etwm!hp0u)E3n~lZlIksVDIUjUSZSb2c?2M`Ak_YS(t|4v?#Z!cRSPDd^!Eb#d0G zx6*RUD?a8fTf9^m@@Tv0r|U3q&Gqsm3{ntG0-^-QYai4$`WZrMMknX0xplN9*DH9I zbU=N@!A$qY(N|E0!TQmd$uTg|ECay$gaFu(SNMO+S z;vsJl2V{f=9eQ0&1};3()mq{BIfm-F5dfwxPtYxLqb!ssiAjk^S5A3){d6+^$;#zJ zPD9}ph&uS{1DQlZ$Ilm@+iZ91I9863Kj8>+eaThDVvY19T83qFh;`n0$x`YfP+`@z zX4{c{7(}2~C=V}QAK{2_yl`Z3`1Rd9sxMG1js>u(Md3Kr^TFzs;p)1%@h+~#kTPAd zcc>_O^|?%|YSzla(B#`dfjxP`R}7Ux<`FLRW~8QJXLFiyeIy`;;=xbV#8}Tc0g_^% z#WLmec&cfbB|t=%Cjb^UGytuIBT#eifr_nT+p3&K-#B7n4`;0zl)CcJ0~#~qgRdBb zUJ$GV;_}v%ADhUM&w|(hrXu|{C4(Pd!Q6#~Q3rge!lmknHokX}QddM)4=&I<+NJ}Zo%)EybcLv!7V%=(-9Gpb#TRbgZv-n zO605Dc3XrMxfLic^Qgn5pG?`PhLJHecpZ^sZa7PS$W$o@+QI9e-euDH*e7Lp`)63t z96h7wi`F*tZ`~S`L-?yu7fv^wcd2(a8lO=9+BuCcVxy-K$FzF)DgnPtIJM&JbQzL1 zG92)xEA&n3apB1hm6cPMLd$f=^fDm`iK-{n`M9E~E3~(-W;W^Z#M;9CRMWJlK|^s( zm8ZIGY6Nn6=w68cprpml4RRLsfSCbMA01}nLR-gjTRI3~&t(uyLnx--wV)ipF;O+_ zD^!RfH@LPi5FZafKfx5fbFbK>&6qu|%382vqza{B#rjpTX0vE=dckD)ST`4HWV_Dg zDS;+vL51%q3MecYuJjnHb63PTzV4-T|8nyvbGwhA0rZ!hQbRDa7b~8O z;=`%OP4Eb~+kX*jKZV^VV^8%710DCL@sr~CK%f>6{MdPP0m#>1*4-J}=rDl^%%Ntf z@sY`0EL6ie&h>e5B|q1AZQpvFIqO&#r~ye9RnyBX3oj60H)pa+{I&da#ksvyhu1X4 z$-Z=yObTaJ&9vgFR~E_X73^Y!q+_BFRjDIpdiRyqw}~RkZT(?0zsGrIIGNm%Cm7&+ zKXo0SRq6oj;TpY4t}ww+QJ^nLzOtLgFAYgsJjKI39lOi2DNRZgTKk65J6Nap%NXe* zjj;kJ=LPAUw@qigvN#W(oO_Udc?>iqZ*jA2nw0uvh#htXV19)MXb#wQSY=hWG#EHb zMB;!JCC>?9!^`%itCY{~GbGF~8MclQOoH?mdT3x+GkCh~JUH=Xv=CVt|8lXnAF#xc$p4Oq`cO_C~#3 z1)7Sd&_F8Gpo+n;WAg3L;4?rO>=?07nsXmcD_uBycylCRI5Z5Ed^|6w&G zJL0%!}TlVFJ;%s(RG$+{s-cJMEZ5_HfulrgR4#fG$=>&YG&3 z*@XCr@{@t=r%!o|(|H5{*dad8y-tCnCn%tFsdvqU41Ja|lv_EH08q)(4r2IxD!ede^bO2QXWcEil+ii=tZu z;3DO3rKzIWtXofd*>;_;fv!fp!nh`G?(Gn0!tzCB>E$UnK+RtwX7e~YNd2Tq=(x3O zG}`r|JW$f%DG5OMOZ*St&m8ZQUUjNMCMy7cBwgoZJRMD7eF*`zCLQM43)RSre_%eJ-Q59eM z@^(^J$a~s!p`uveFv*EQ_+70wD7ow%E{A8kVT?V)HAtODatmgDG zlSUwCiOu63tIHiude4S;pY+jsSgGsd@bJaMwNgtgiAhW2tC6dE7g}F0F5*`g0o~=s zNk;8yWl}26I)>(&1t9E95IW_cf6!{yD3FZoz2uioCy>I+^!&byo2*w9N3nC>2jK~@ zU3+U%U2-y#6&J?C5$%?M`XHB)Uwi5)`#nr8q@s~vgR zQq!40Xs2bKJj52z-6rvrCA^X%1g+)tF@Td0S?>5AqN3r zD!ah_$mU1OJQ?qR*O>b-wD@?WI;5-77k@t4^9Sr3Qk}LH+CH8`Ra8#XZd=hKkYDvH z%&JOw5weyE!p>|R1`{{{$KO_J96*ngx_2xwBpOWz*?C6618E3F@T^JSR#B;TBL+_P z!I#=;tkTWrblb(-$Nk((?*q@-2(;#Nwp*x??&KDP75LTWvg{B!yV`$$DojYM?4~ZCOho;DNzg5TvVTz z!UL)$ww9?Z8>$LaLIMO>9LyrItLYkEQzzu0PV!&^NgNOcEOXvirojmF`gB&7%DU)Y z=6bwPc>C7=4J2*sHKS5j=87xZ$Yp2-0wb3$=72L>hk&2X)6%k`FDdnsI-%;=2HSR- zWo2a*Q2D`pk|moF8FD(f!AChelime%ZsKo9c)$B(0A8tm&f^{;`UOQ!$b4)bzxAe> zL)VJ#_=BM4_V8jHejY#x7QSW`80!S^_jAP|DZ{nWXg>+obTqfP$FJzMy+A2X#A-7JzdTW~ zsbFO~h0>pUbiCNkb-WWxXXq**jl-2Pxx~EPF3#O#TzFI%X^oqt<$kNe^~y~%Zi!;$ zQ`)2P%F?zYx|@TgsjFbeL$G^|T1|DR_DM0LemJ=SZ-Pah5#QJ-+s^Y-k^$ z3!QjnHby3{bEW0PskE-{OeM4Y%Xq#beP zXNmzB73-1%alq!e!HtwGfFZ~7(jHiN<6E-XOQKfGudv}}Z2wqE1=$5|5q5u(HDBgU z6-FFwt^$gBx-CB_mtK?0rSB@NZSr-&$R6~=2(?o!cFOVxARdU$nmnJN0yJxSc_4Dd zoGGOrSHI;KMTC;bYOFPWHob%Hb`t!1yI2~`AzE}&*7LD}bC|O&5``t^Bn@5LZ~8Kd zh_B-8!?IgqL=B_Y=j$rn)!?s{a(GVBXaE6P9d3 z`>GG4+z(o_^T*@?C`(8Bg3zHUX{jYz64r@Suyph|na3A0b0Cr`PIj*dzRSQlK{x5| zy{!XUHR>am$|7Sr=O0}7MWjzhy`RJAoq1w^WTIilEfkqCk*fX3F%H~>l$CJ9$gEKp zLx5HXZpUlnp7oJ03D?Q?eK_}v|5Ny!`W|k(+zYxNQgdEWJs$&lxA&C0+yFKIeE8r> zuvciscww#4z(9PYGU7yO*JmGt)5TNs!6-Nr{7)K^+7()>D`_ts&Qk^Ru{RXacObrj z-bm;9J1v>eT`#eLW1_gQ6_DAH%)MZm#Lwg{cLEVdC3S=J)KkhI&pup60_li-*4EZ2 zb%m!8fcZ}V!S0tQW=$)Xixf-m-5XwZ0~?!Ooa2Di+Vt!+cT4ewbJgdcOMOA)_J(Xb zs4J0ibC&J4S}43(*9`1S*q=5bL%T~l0Gxl_oMrc+B;2V!o)YmpFMYP58~%g^?B;&A znb(nRaa?|BcOCg(%cJgp_vSu?BIjcV&qsCv=dp;J0@tp<@P{|7c%(y+{YQ#w$L>*4 zyQ$DF1A~~8vs;XrT04uqL(A#yhER77_)s>OlqcDg4PEambF!+NUIs6%{qO4$3~AyE z_r~Z(ld=c<2jZod&GD7c2J(K=D>_myEJb^!Vs4eI!S2Z52oCYdw6UnB-}Ein-g$(~ zrIB|g2?Bq&KJgCE`vW(&^2#HR$OfNm;FXyn564X9$Z+c0iRJvPYC7XxLHhRR7JjBH z@HZSh+r75&DO*3xxK-K=O?QwtsX%`gsRg0Kv^sH&u=a2}npdE3WVJdb^W&O}bC*$RII}`S^0!2>TpY& zpaOH&T3h+moI?32EcE_;yb3{OFGa7%QmKaoi>N|awEVATi1ZFe&E>_ms&T*1`cI^F?y)j2R%odA8JN5ujutGAPJx|bL#A95i zYg)=VnEh~1?!6$65^qz;0Q?$YHj$pR7`?gZnm-fT^zxlTU?hKQ6E2cc;EDR>EqNRk7KVJ<5A_W)^X-l}S z+1={}81aYUh%9IyAHW0Ng&tf3Z91zO0Uyr%3)CNoZ+vqja2JMSuZ5~5bl6sj&~#oj znb`g)o(z95NC}cN6ekw<+*A+Po8eTuBHUv5*aTWgW?{VwM%K}GA;K! zo#?)?1k4QB?XQRmz%8406#Xlsa#k90qhf}g5Wbee}*=kc+ML2);?A31=l zTqtB*+8RAbO7624YuYk)fkauOKyB4NrbPVYj}N?%5bh!`dMgt-|NhcoV>b$Pz%NjQ z*i}(rGxzV&YQF~7w1jgredqy~6#g4QAi`%(H-y4+nUFqP_7&15=sXlqw_|>Pjq3yt z&^TSg23UJ^G3irD9PG`e;iHI@_Hf_M-B9IJnZMGO;|^dToXp4Z>u(}5T!7QA9*vsk zvqckqfm8C`h7}l-_z+jTl!-bnrExZMpYO)Q%sCwIJJciVCppuMx{=~UI$RG)j|pf* z=2;&_*r_No(vUsk!lg-M?my|V0!mArW#QFALG(nT8Yi3+pe$G1_*cIP_4w(i8RJ@*WyWLMgLBWp~o9 zPLvbO(J+Epk4k6al`A*MYbNW7eL5HkCnV1*#`=%7_Y3{< zKJ=)<+_Y4xx}-J*2Vpw52;8IuL30~8@WZ$iZBG{V@w*xlqEm1z=t3t2nPTqaC}od) zy1sFO{!V#sCE5I4SUP>~9f8I(Fw5Tc_Bd^3mYQyi*%?Hvl;;dH6{fZ_o$WR^-P5zy z)y!o$e<}y)Y{(d(T`i?Iv_LH$OrJ@iJL;jYu_Adpvhl8*(sNHEk7B}+MBiunJnDy* zdpdWo1viOE3*U!SmPFaoP39#dNL58O1fXmbZVcj?g~GN4?`}XcnB~eG8gY@AmY~rjR}HyScx# z6FOFATyLQERI>79DFTWqELv53oUB2Vc}p)L;~FX>-X|42)M$m5Oosln&*a;1%f3=J zK9qQfi{|(9XIyg{$!MC0BTqiE(`}?>A_=PKYhqOGIQSu9048n@iQq?2AK3V1`53cE z6>t=;qG>F_cF-{DA+}od+O2_ep#*Vvw(q*;m8r9auv;L3ykn(JBF2mho?C}!$7Iu# zn{LueS9m6$Jiwms!@M{FfA8o&iY4z|YuW2TBLWMs^jut8$x2%K*Uq*}xy%foIx&@X z^a|)y#Ja#LyQ45G?F*!L#rtxhea|i`Q2QekB64P0EYGxlVU%`v^}_8w94JE94>2tH z)$Bs(w2esNXD@@c{Ed$i^N}Nt)KODkRk-d)L?PTNy!z#?G{YBv)BR_{DQ%)zTPEaf zBFImjjX^~c$)mCl7`9uzckx{$Q^*n^#Bvgp$(+PbB)SU>^~x@) zW%k=OIq+=RDl}ixQypxl9z>%OOJcm@@c3LwNW>KaP>A~mGb*MXj z6P=kcd>A=&m66iY_vovNhzqqog{H%y)ZCf8{#Xz!pvinA1o?nxqDZ^_DpinU9Bw{7qUW7; z-vOxs=GD2 zn?(*iGDl;qa?VDni8D6o5oUd@WL?hnishS5ocxIJQO>ePx-A_#p>ImWrra!JUn2E) zh;-pdbjUCDG15%DOrDb?xRcqey;2C{B_ zn|+yPHz^St1^ANF;upbRa>_T*WfJ$wlxi94v{RFj$eM@Qvcf7=o>qvtWPhPydL{Dg z>ZBHj&#Vzu$dqnP&!J?%s(G`x*SgEqd|)l?I7-I&u;9yWK8=&rzYZ#DQ~PCW^7b z5Atge_BI{X5Z9lwjOIxS+Ux63Bp|Ta71Ag@$Bpw?Nmhy_bDQam_l)xw{Fh@wO{ybV ztqcLn$K40`TRY*r3_8K08f=9YfXQF?v8D< z=W?BWWSO%vll%m{25r2|;=RSn1bD|$12L|4x;%aDg$~r1E#a~vp0*4)yLFf@yoS=u z;6;o-dnOM|b3+*_N4&i_0oG}`p$ zX(wewL4m;X=3DNQJWIWa_fpszjUUX#RqEC~(|Q~q?Ckz!gNwcJtrjF>a-^N-BT@1T z@5{5IiW=Y-GUks96s?j)fUAjy5*e=IjgPfJ1MtMFb{jD04tZ-u8ewd)H(fj;?4QlP z^gcKsPC2~gm7-5*0m_(o;Vg=}D}aV0KVhc8gysxCNO|^wcZzGhnMRN9y9?p7U#0F{x+vJS0M#f5f>Fc-h<@tAt z1(4e^zR~vnp$K8f8&3CL_K})j1l$Bf4|xP#--tc2Ouyvbm9{G-Fx}V_59Ae${a^+ ztP{;^kca>M$1g{1tnH_i|B;npsZoWVgF6zxMYjLTkB^;zRMsQh1LB(*zH4KIc0s$x zPxr(Bm!JAqA^cb5zbSJ6iu^Z4?q8ArwgUgZt>v*cKhCzSr{oKt(`p0f$KVkCl0FmA zJ1GQms3^ZSt!&|K8b{cGfftF%<$dkohSee7M0Vw{Ed9aGm~V>EpNt^T&P}!=+PU?9 zaM=TlPv)va)aG?Q%~UX|eI`2)&Ai<2U&@4rpFr=UIz{|# zui8f`Lq#ykDCez{zp&bzOUIvEK5=DgOz#1O(LGl69`-9Ts$bM)B=4o4;5y;Ab9`rB z!?XQ8tU867u2X!OIy!GyuPCeT%8;@+Dx+vDM&-3b=OF{v7ry%^o+`Y#q31)wPJYq$ ziC712#=s>d|5EiuQ^CNCg7{5`7IizU+&VBL`F&1~2JO=t5MD_kz8#c`r`Oll*LCJh z{-x*h+k*A$yJO9NVyUvaj5`-bXwI8LoG*V`%2Xbp?#A(SFk1c&kNMBH_-_<``t*rB zsWJ}OibPa0ub@U!-8rwfhP){z5XJ^XZVA6HJ$F<39*XW^YNbjXv80iq`_Xf`cD9!E z#)|yunc)6dt8*~0%4&X88^x1t|^L@W5PwoZ^e;w?ur>m&dan+6@Sj*YJ)XznuFYY#)RkFn`-DP&yr z#}QI9jbNQy3?g^|vaLQr`NJl)5tqlHxakMr$@Hv}!a^BfLzNnTf2g_$P$3rpsf&{N zrNE1~NRQ5*))7(8>eQwkX(geu_cSF8nWSC{>Qg_A`Eh~ z$Hyj=)%<#~zy6;RF8{93qHIq)>OSFi6@Qy`ev}yo!^U*0S{{A<>r5Lg8M7-tEnuFs zd*mSRlm(%VF>u%T=DfP{(Ikk5qQ87{$$52owiE_coMWpMECVc5 z*L5N=k~?%C&JZ}We8)THN<>a70f{>0V>xB{;J}HV6V46M%XuxDJbn52aN6JM@ij|4$_dS-n#+!}rA1>+5KEl{A)H8!|8`6C{ zy3Dsa!PfWOveb_9^|&|y3C>e5^$Y>r{e`^J z91wbH@g=U2W3ICVe_A-Kz}ECq15Z2pQwOS&4r{7~5o%`d?OjK}b&o|&uj;h#)VliP zI-j075v4@y0LiQ(OT)#MpAuJc@r${L8+hBcZ6}m#v?M2*1C@_(u0YZ(Rfkb5Y66a@ zSwbSaMC5kFX#b8V;-M$28+=y5{pUV@mMiVzpxTq1rU5%HIDpL-Qkdnx^P zDYJ(Jnw60SpodNXf%?=vbz2%Tn9b?j+pr)pgL2E7zAwU30%qL-;zU=rlR&l%nf}Wu z2dfqr7sVTKT1?Q4Fg}A5iTo5suzOV~z4%(%yH!|JR5aNIcqm0O^#)Z|x>Y(uJC;nB zmOED6ymhzlO=>4RKC1ku_4}4C;8(^97AS`4_L0?j*?I5i6Rx5RI={|#2%m{^I8;i% z4h5A_F3mfNA;g}wc9taDf$+)wR7KQ<3Zylz!HN~mYvJ=#_5A;(b;qphUWN+Xl*g5E3d$3v4W1FjZgc=U$t-5$n#n_kB z!^sa4$hLWBeiY~J2pkNc-r7s*JHNYH^1T8raHci|3w8_v-*zcXiTaGRj2D{^G~jr; z;)8f}X)#U}x_jM-T|#~;SVDWg-No70{Lb#`6Q+t3v|GnP*&Qh}Hg{(afM)+J_(qF# z&Cpl0*K@eMEt6w-5yWE;GMyE@ozrN5y(mHs$hfgX6g4uZSuzvl;q^Frv9ZT2QWn& zLd{yiYu9lG9@wWnuB^&0EUhCk07c_D8=ZX@eA96+tvps}JZKf1ff}s$(itYy(t_Cj z#=%8Qc{xGkj87~D6`WuRqw@O9~kq%E(^`C^doje=2J1B`?$aU zFmzWOA1u)s2Rw#7!^AVX{O87Q@#SIKUnIwzRN~`U2R^CEF*e9gG^N$EAA~)|c`{KG z@)BZhP`hMQMkeLm1#6>+K)DXC=-}AbAqMz~YU$;A>0&rll9#0s^yEKQ?Jxe=op@ao zm*(Y*$BW{|347LwoQ#fafm!H`V>yyvw^#d|V&TBJ3@945)XgF~@QQih>-=CFp(6DK zOIZY%rM*Kj!v9W%DQJ48G{xiF#O;CZ$*HU>YT_ zuVU{lJ3?0)G%~!C?iqg_x%^T-PMdvE7b<|Q9;?eHllM}3f?E@m-f3^&T`BqA7+Pai zVzsM*sA0`1PjR149EY|n+3jJ=(7mwck%*bR)X&XS)BKBV|L>0qPmtfU3nef13_l)5 zC~^*2o6Pn{=_%Bp>5q7^6}R5_y+9sRoG*E#WpIw|QUyiZ3ShSc09ad>by+z%hQadViv~zfsDNKP z>asE!X~^c~(l%s32Y4sDS{{xkE?@?rQ`6=|tIJsa@ds5s1)(lzC^pX-*ZB%V-kr<& z-TV1G5gRa%6-W40_3m4@2ybg4taKW4Xtj|u78ffsSo!z?@xccJ_B)z@!lzO&NrR#g z@O44N=9kv~7PzU4!A06DR%;{$7y}wum&*bjuOp^kq7Z|=sr)ufiDS#jm2`;RR7~WA zu23F`pkGsPTqS`MR&EYs)V^AsGn$2~YDY{k;p>n!D8&`><_-&XPUVhd>MkL`acw-z zltq0C;1)~jlyF1dM*ar=zWY@4I8vIi9gfOq-oo4`GU;YPAr89BDqm)yhAz=Q@fepr zMPFT3SXk(Ir`WO7_iCC5$ilwEbXJQaxDJ1*{QP{InxkYtCU`&#>jjV%vJ1V7AKmpJ zL>fni=Uu*ZZ?JJo?vZtzi2o!b{_BsztW8DP*TQz?{Kf^4QRgdSV3pUUlhW?YUX|4F zcAb%M*ntBqWgS=ZhGxF@(^D0&Vf=g?<0zyOi9uY=%z*X5b!At(Sx55(+1cXIP*vX? zi=W8O^cG=~1IZLPc0Z;F9~fJVzU3>KZIe){_K-sA>Gf z>G_f7uf2$JihB?*H?G8u>`H`)M86Cu?*A-H*wb5;PPpnd866RJ8m53@L%R=sd}Jv`$O2e7*@5;|z7#mDmOhQXQel?vYic&Muq0PqPg zob>1_D_b&{`f!)&*NoiVhajRTTV_(4O@;hrH$0CbL~=Z(DJB}Wg^%@@Mj5kiPQqZ-W1LKBrVT8F6 zpFh6`T!#PArkwbR&Ll)VzWzo2>!^PJcP=ZU^qQi>+w~m2b@t;co&VS0F**eaPmx$m zWbxM?mQsui27{@%3a08zMK(3jZ8ZV6zfRGw(4Hd| zkh!IxCkxs}*0F$Sh57f8+zb>*Sf^Thau;~XtoPSv^i{f7c%rEEn##LVO3;b=k8IX0 zHjj4Fe?SOe4~=e+vdxFG$k+e%e*TYNOkpLDjL1Xro$_2r3Ud=hj{3(D3v$>%Qm+tY zdBm#GU>z4`-Pbp2AqRaN#^zDqJ8~iVAK3u@k8lo8XQs{*`%K@p6Yv7CMpo7tzW)eK zRpCW+%0K?xOQc8feWwF!z7Jf9^y~&_q25(}Ur$6)r+9Li!v;2=gih2#sXSn`{ z?+7Z4clKLMjatysU)w_TGZ|TI5xUuVlAf8PtV7r~Ue4uhWPGKBTN^W} z8k7+Wse#5iTavCH9Rj;C6>ZT1dI?+;f!^MsN7}{3?<5WoAODo>S1rl$bxxhjQadvM zq=v+;m9C1>`*E8j#Yf#K4aTA3il2RCU*X@Rzk2g#i2zgz#9f3mGeYL@<0RV8nuZm- znJu`atcTi;YY}@Wuun;-X_$j9J?_RlA8Sl8Cq2@*C0{awkZ#|0CkZdiMQr{FYtExu z^6F8Vm6}9(=2E!%-lJEJhwnX|aZE*0D%sGrRh8>7vGSKHyGfW!D%mRb!BPhHa$CJl z&4qn;(h7o~9CGol3*m_Tm{VbQjo9!jc!tD;TbGK^$n-_{rE=d~R)Mo?tHrp@+j4WF zUyWxUf5BW4Gx~m>OHuB-cslCw7Q~^ zG0z==VgdW&mr&X(J$J}!dU+y%gKdE@=ul4bUkCNCR)Bw*)b zkjq`b^%%d@#s4(w@~J6p$S#6LJU-{#A(#3y{vuS2+1GHLKuYk9GykVE!Y{jNGZ~rj zNY0OGy=9j=MO2oOn~UGKkFv(`lxF%0mKs)!%6Y+v5@%OEzb8Y~%uSuWw}?Gw?8-)h zon0>yhfdKQuq`{w^@v0Bw?ct{U9V67$be^idwc(=ay8$me^`pWhz0HREMy2JXWBZQ;rXDYxGeSqmd2SMrx}xqiOGCt~V)%Q*qNlNhhNL%tCa zqf;z|QTd;2ruUVWJnCuG0$svXMdV7!7!6S9Ix3ENLbU*3;+yP&$VKP|#hT&T%DJdfc&9HP%{qw2_U>#pOb(CBJEG{;yp063EL`Ai?UVMMlpHoqlx1Eo-<*Xfbi^t`7JiMWh@_N&xD-*9 zam$2fT+4$4$`mWk>a9A;Q$dDj^jFFRtTUn|KX=q9c89dWUR9osGrZ+zrm=FmuN@K zNSyA#naOLdrnSKjW_mo-v*r7n9xjh(wE$9BCBj!+9#Uy9YvTnYq?kgT(|=GixQ=7qNMWy$Orv^uM_UH>Cz5G!Q=JYXl9si=G@-l@l3~7qWhE4b}xp@q;ieSx55T< zbRH}K4?+`gOmbv?4>YV6$x`^&o>V&}4K>h}=sF;cVhr;Xd>S6(~&Y*anXwsBaH=2YOT zFTF9ce)*5XJSqcciaY`Xrc(AWd{mmFtJQm}ktN$m^wrNO7+u&%cb5PQ@cH5gV*T#I zZgM3!IvDpD>qEEOy16}ELNZbXkU_u4Ju@bcu(HY^2d``jC)vggC_jPhP`Y<8#~+Q`VQ^h)bgCZ`KQ% z%TjhY$w;JXA@|{i-w%Dj*miX}SNxFISvR0FZ#$wew723#X_-~ZXWO@+{Q;t7UDLC zaMf&5$@)d>;8)gv38jd_?vm2!#@7oCjgiTR8>eh4Z`lX#&K7aXG4E~hlM6IT(K`t| zNFfXvqS|d9X9Q*$>+nZj?$#QLT=Y%%``lYrPjg6!PZ$5Qzn619@s36fud3%w#p3dF z`Nn>CD~df;W;mphmkmUTEmmSZsh^)HvU&>Q;asF&!DR8q_EGV}q(?7aiK?sT*fwV_ z>x{-^mOoB+#8{MOJ#5kr=BCi5 z)(6qNWStFy)rT|d<&~R!niEOK9<_O;7ED~+lCLRz`27oAN%dm|tto;peG@5K$kM3fNe(h^DlA%qq}2rZBh__FUk_kQ1Z&wGyh{*f^l8H|kI zZ_TyVeC9LfGiSCeB9Pn`yj9UiH3$Wuo;#749(g!%mi3#`znC#4YfHoJ{(-Z+BYN88 z>G#Ch!ineD{%quEb#{h*9{9S-Y)w_L%tr8@qGLE-es{lxYT$XE_1m|sJ{%yGI=S-x z9>w&l_4_-ha16JbHN&xDp6GG0^^1moDur9=4F~Nnote7bc8_kP{qcPYXn)nT9Qz`Y z46t<-XYe#;lwCV}JaUhNxkk+%9_5mE-O~nzlF8(xjSc9|=uBklHC<++6@13&VFPD_{Hx`U_Hz+RE?;Ot4Ej+x4c+m$JZNgWEF^<|G z)RmOE6}I4Dzl!-G#EjM(aP6iq|*(L16g5 z!nL+9@=OvTD@FYhYhqe#{%cAIqTjo#lbFzq`5IvJRJsXzMIg(GSV;wkvGAAm0zq}S z;@=2F|LqodrOTNeyWg@`T59H}Vg=3o3CpyT5zChJV7;Do-_NEp-}U>wSFAFd$8l@? zq-jbE+QoUwlxkerqqtjS6W_uA=%~Q-Xng9ut9!qe^V|qDryZuKisLYhw-Nvj()y%q_-W4Y>P)B$?BGx zH}?f9OW*#3Bm6%MeGBN|xInPMO#*Ixl#C+9xBKn>)^=!exvwkWpdob)>gieF)mt>K z2-v7^=;_%zm!N70Hqrf=#TYl)%g`*f*02U5L6XLW)ru0hthl3i#*Y#39qggE*R%S+ z`JDs9fBbU4pRj%SA8gr}jB{xMS~eY;kL3NFZ; z1oX*Ua#ZWfs`x++e3f3@->}%Lpb78^#!d}6gboOmb*JKN7!@_B3BL$X%~@tHLmUwA zrP!2vF5@-iVH&ga5yb7jWwEi7L#}exG#9h6sXUccdf9gU?9ajapqDb*|DOqXzqmC$ zPrtgGSrhBkhl6!pw1^k7V2vN(r5ePi^kD?4V4-%if1@q@w>#rY=4C!eIR1zEUYTG- z<9-`7-w0Y|0mTeoC~G@3hJv)t_}#Qun1x2(ofv5(mPEwY_}E+flxFjqtcxK7iJswJ zI!2CGd<`i*VMfQ;w~O5+=4>k)gWHSS>ehiZqV%c^KS0Rh#m0`-GOX+_=pIKm{le<4 z(qfRdu{G(RpH5HiS1fKXfdrkal{>>`;%OJ3C3#~${zKbExtQ@cnN)Dd`rCUtn)Ee4 z3x@bVjX_vvK)kk<3LbCV3oLyUdGNi5*bCv;W%`;TI|_TCnaR-1Rw$p+qUDtc%X6IR2mJiQ!W+fpZSp{IC@ zLVrmGmnQvV`SyhS2|`?ofHxd@a#gqGakibbBlO7~%Uh+A*U7!9yIp=KcYn0$4I=7v z2#uK~P;lD-x3*rU<((2FmQx7(Y~*6RM(OLw$1k5>F}KPu?GT>_E>(y!^p_tmp!{bG z-X9TP{MD*)#)M)hO4kSQ>$FL_4Zc#ZR(4--=KNZR{l7@7jGS=h1Dtyx^>wX{#PLli zQmEA_qydA;*!{;w-Go$J6N6PbS5)m*Vn#A5Hhi6>!9ZqRYgmmd zQnMUZC0ye=p6T^5zu89E87@i%R!VV-lo>fkY*=<(#RlbiovXhN26`K4RhVu7^>ZhL zq6OGYKB00S2SG*pCp6wz2O&Fh8(@I~y;Ssd_q3(e1UGlyiez2Gi~rOwUabu{<$K>= z;i%T?@g*=0tkGJk9Dl!~+xq|NXb7BeN=)$p`s-~q!!sX1|CQYrx8lA^j`#O{4B$8E zyJKnWZdvdNi~3watgBKqO7hjvuFdR+Njua|1XWh4jdAXaCO6b;AKSQeynQyQ_=iAo zxf;umAk2ahi?+NLKF&~5E6tfV;nNH`e=qgTi0^;gIkzPor=Z$mWoa%kSrHXK|5KMvo_}oj4!X* z?!{b{@zWQRebSE~rv8LUwqA}{yRzSgKsY)@^&b1v{L%M=q%Zya`Nd%|&)lh6RNp{j z4chn!lC&E*PA67f^sWXXCan;W1iM%N6bJmvQ}or&;dJMY6kc!@%Oj!OAGIbI(5j%N zhWqDiSJUHHau`gb_a~YPYmAl+!Sm~BVWHsbF6Z}3Zg<=Gq83hwPXmv{me2IRN)l&t zcqTLLJD02j9o$auIjt6G(uzJsXB2DEKfyo=066&Lkw1Aw7q{VMCjK`=^z~FY#^4|D zFkc#YzjI)`RHlY(`3pSdPb?6ca%`Vp`<3bb=bdh#!CD17%nSC#*Wo7t2dUr0@4~+? zW$B4O0~&2+nI4XF?h)I1_2OSdHg4nXg};>?N#|QGv714K01A?+^4%SN=aoN6a>(2E1IqO#~Z-gFPC|PB_eP& zm8_3V<1KmwE}-M1>7iQLex3zt=%_591N}?>{L5?h#Xp*__t#t@HT8HTek9#m=KmPY zI3@I&L>1k3dDw5SH}D0V(&qWYNue&~Kg&-46Oy@~@FjSGu*T(I zddk=Kwi(p9XLRia8loi_QSb5y2&AtTTtdo+ekv~)YeSeup>C#*Fu8>XUO=KBe?`4Y z|HFsXF`fG5Mv6{Q@4xonp9}=GWHi@QWs286(^~tQn*kX8G48Q-#hS>FVR)-MSEil1OdX6id06iBUA@sL!5b-SG*LeKR~=Lf zszFABy90oAGF!D zbC$ntP}*9ayTj>i@D40qBtnU4sJ6Tf9(~sx8&p7@R9@{mSVeR%*Pcv~_?0`lBlC(V zDJ*k+ZZEV`MqC)GhW-}7%h4h2G}Vh!50Tb`^HgR#&21g9+O5Q=2;61`fTsWon%;Ko zl^0n+dYmuJIvoFbzyjZ-+`$}xbvfe{oJM;)WedW5^L^K%l;;&pl`QJ~q<;2*`Z^otm z>8Z_M?sfh|G(h~i++)$D7m?9`lNA%Dr{tGzMyd=0HFM7%NpRtECAhgv*9HB}3&KL| z0_UyKLqu_vN$~qLbMPARW6ET~XE6%YzC&5F{-yP!-mqqRYAlx~69>k}##LaurY^Wy zo03P{4>Mb&j_vm0${U9eU0o55ji2g!l`38j-Nlh~r*YZ0XPz|$c&T_5i77>{Ryu>f zs^~QAc&JzhOuu6#Dv?@qBA85Gt9o@!zs)>C-6d%FD7Uz{9X&1xcv(vg6xpBSUQ~Q( zPtk64Z%?S64n^dp0#w^vVy=J)G zlyO$1=-_uPcGMrV0yR(-CJ2uVerD&(lyx#nHngjE4c|FdamqhS>)_NsA}sE2h){eX1&kIECh%k+aE*JocOvcC7BQ@|q0FuliL~@`?;}XrO{;rnS&bwcidG z=ckNW;N!LuF2iO-HzqN%6^PVKDSGELPyqMY_}=rb5@)SU>u+IHxF`8u`_T-^udQ{Y zmL)8F=QSHtDsEYWk_f#dXtE@%MKx0jsfw-kDyRm{JtU0jjUxt&M8b@zADTs%+f`&* z0?eH)r(LM!2_13^%kvw@w7lu1ujPcwk+cs=89!lfi1GCcqD5AM55J|^hI;XeO^*f{ zTJq;Sm04MD_s4{N%Lc;Z{3!F zu8M0y-QX&sRB+xHf+1ogAlC`(JC#)=%nswzyyBogr>nM_!ac_fmlAj4g4x>ZwD9GbHg=({>5K9t1q!9Ow|=8V#B6g_}R{w+;&W@ zg$3&xi^*`&iCqwJGEjA(GhQVX=qVzs7)9l{UD}0--@eQ zwnJSLd?1}6tki{rY&sk=50Mf9@u`IsVfa=W`r+~p?<@C+2rk}GZ1ZS7&(Dt8rdHG6 zh+-n`vYJyxqp7>-Q}%7dHm)#Vf4ks=s3#o18RF(<1x>C|(g+bwf#pX@%cOI1R>Y3bobP@fS@@ zsa#N#^02XpgICT3%2|wVkwK%sva5sb9}{JxZeHy7x!`Z}TVMt((s2oAuwpq_G{StG zLx)uh40z=5`P_@}^KInT2f2~kHbn>m%fiE-)fS05UGs>DtH~O$NlGt?lDKX19@TN7 z%CScY#mlkOo!;WMTGzrzRlhFcxA4wV=n||* zN$Fz91L-$*H62@ONw!oGeZrD0C2<-;br`<0e42rohlLupZ+yPt*nGKtRCz=g#_Xjz zn%e;3n4@L%S%|ulh18L@-bQBe;K*)ru80_N_c%5Wb%eA64AtW1P=5J7TZgO=0h5Kn z!R#~ZWJ<5lEivA(P+U;s9m5W~41&*$5sz3|?*zNx~AA22!|=RzQRmdDO_~gqC}eI|=d&uhakX z+T9`%rkjuMUb^+oh*GT3N0_#hN@#p@eCJF?j#ynV@vDHzdvuy@nrA6{wH{?a665>v zB4t^HAt8QY)^CZr}DaaOm`}bKQf5} z-*~SB!o0A$Z4q8K>bf)$jEic8+qQwEi;}XWW4Y{256&-=&s&r7m9GM}zbgqAXv!9c zQ<#q6Ln_friSVcYT<)^MBU)0q?*(4SCr=J?s=m; zoT*GswQ@>D^hi($-8;X5lHJg3PLtBdA!~eRUQoAoW}i^d5AAW_{V1|1D1kEo3@s`l(ve2=1naqSNiK+W$#EjYHw&4HGZ8fvL)_%$f~d;8k~uv>>I zkG&8|>)1(J0|scio1Bk==mV&;h~3QnVF><;WIRf4mDw?L1fF=NgCPMMAv=wbTUB#; zA;x6N@`Y899eoy<8klxmm`*9m|K4yQl+}9>5wLccy`4Y=leJ`%^EPUZ3#OJ8sDnEN zVf&f^eOpL4y$MUnCGlWHVK!X#su7k=8$bR}&;-i#*!W+)0R9svJu%2ChKfs>zDor& zIb=X_D!n4rpjm2TFyP9$fT!_6^x|kj1RD}LLXiYxWHmX%%J*B=;O+-?R=xx;Fb&x_ zQKTYnM0tlRi707-BBu#$l~f6**lk;+ueBW`Iz5;Yzm@?@mX%gjzL?Xfy3~L{njw;& z9-)p829-DZv3w(Vrp{bV_vz$24<_$r?pOL6gnBji8HR~uuh05;df?5R`+w{=j48)k zwLQbUG>2s@#B6jB>HZK?b(7>2JzNM=z(mS96ja^e0S*tFgvF$!8f>4Bt9RA zk#}LW^wAieo-W8776KfU5-*ncLw2`cy?Qlq=MEo-=3%hjZ_0dZsFx|-BMCCQ$trO_ zSCWrf_8NFGS8(Q`JNqxnj^8CaKEf=!iBfa)!+nqVTfOXniy-y{r zMM;bf_=oq2;seJW_l`%F4tZzyw}Y1-M8FpiBKl`%a(hV0jPF3q?>LBr%<4`9Rw+U; zau0o4T6fGs7APn-s3sXXl^^rTJLA-Tkb!r30)rvt_j23+W7Wz?{GQm*dyHEUcS?u(Wn(lbtP=bYhj1y zOIZ*yVWOxFcRh*Ny^@NJu$S-hyh#ITaL}jUYcXwb1DA8A{l^~ z2w88dD-bwEj+^8}$jksHo}|C+p!LyQR9yQ=??P;BNTljBwoqM<$j5!TRX3(!jjLh) zK2mK|5yI=}%2&ZGh-{1!8*FJGjVWuN8U`PX$aaG>?*Blb!k!C;EtNXQB*Vy*n4O-u zJXuZoqy4V}s(UbVVFAly3|c(SHSe2S&qunD>7dVM4|s#+0Lo=irPXn`qGK2}Dadj* z1}7U|%p2J;tXbl-$!7YgBjp~~?uFH-RV|G8(S-@WN)O;W&7vY{%_8!{x9yguF@7+{ zkTQ|j6ZxIi*-2e?6%@>pa*xb1U$*rpK$>Rihr`(#XGqs@)%G8y$|)ZhTAYZ|j;#DZ z1G}dO)#)1iFh4EfzK%d&>Z#4Wp^#!@Yd&I-fqLUAsY6qA8gZDvM0><=-P;vuy?qg} zUHu$exUt>qUsMIE@l8s?9bKE_l3N6s6#E^n94cX=9%l?0O$Uv{8zO1fBbvMoifVRf z)#_6k({n=y%h#sQA(c#7+3?=V!{^>M;+%s+2%%1>B$KHP0!GsujDx2SmAz-%mA#J+uXh56Cv4*aB_yVXOo>JVZrT#ktv=bTj&DB# zL=w1UJL*-`Pg4)kw>S@pgG$o$QDs7W25Y8LCi>8j)hDh%i@9+u-x28=ajfx7S0>oU z37Vy-cL@Vf*9z3P9f~{1)v1#<*wjiVU9 zEy|t}r|)e$o{#bx;60!AQRVb@ibTI;N7&%s4=g#u$-Z28C5VQDPC2p*r)gtsrQ2*g5O*$C)635Sj-6GS+>*K97WVpPM^!q38^S<0-OVhIO3J=@vlnZH zgli8+l<6N}U6mIOUbNiMNM&N(qfk3J8pn&+`y;(SI+)AoPfF$zCRCk1(x&trTkFu) z-;FS_^0Pihm(ufCQ=1FJW_$;h*j{`OdI~zXc)0WT<2{yQPAe}wOfa454mU$5#1Eph z>ET{h+*u{3%5U7_F{qzySlP*jQ0tZsz5HhV=Y3dD`_8{;2*z5J5vkIfAC=6b?EJok zEH{X9dhI3On4?jZDO?bt>8Sib?cLR% zgj2Q_cQ8s0@3T35%j_(>{&=n;{{3d5ZEf7usNC<~a8Joo2%)@3go#w?htVT>-{gpY znf5PQ9kp~E#U_Y>Pd0`bm^MehIBQ}l44B3Tku}2hY{K@w6#o7eHm9c;RuhB-l4#Jz zWe%-S3q>0sM-IyZ^KO50;SWeCEMRy^SnU zqDSxhoea&BXBm1q^vYFw-6CYtLRwr%m{8R1VWFCHP}-O=(@7~1pB$;K(!7GwASS@q z2ci4aIiz4jYd$2J+qiSEeNfGj&{p~|bha6uYq07AGG3P&%jOmk3AtVvM(a=eJp$`u8Q50pY^>b>>a2~w2w$2FfXvWOvwpsrPi}k&1jvaD7`MbH& zfVYrIeQMO>syYvVa>-huf&c-%sL_hNp@{bjs?G)`;w7%kq;Z-8fQEVsC21xPm>%|# z%h7OhD#FRgus960Q`7mvN1^--$Fh_?e?t7Icmd)VR48CwSHXS;A&6hqs#U@Yi9G?= zZsjzMGOgSOBt}D*P+De_8iPSd1^1K-Gbxxo={!gKj{zX5LkrRGn@`lo0S0zT<=Yz* zNLu;u_BTTX4}@A|ZL^?qE68%7-DQq5g&cghkkLbchXy{cwc7oDf8p!p30hXc^f@tE z+i)Gv>D@=32ujnRA)&|qhx>0{T^*46IP>-+dt3O-4E*_c01;DBw)^ur1XRr!2|B}} zuSV7{X2fX4djT4qX1PgCBDb*vBBj4gFx9qBuePGx_23_T#so(-ZNp_~>N8>M3`E3p z&lbvt>QMK_ezy~M^e{9a(igLTK`%};%c}>MWR+gHJEIkHz3ndLu!(>*@onQePSOP_ z%)QRd5aS!O2AiyORh ze_-y-8@X*-%n2m`uO?EyMATW$q=su;fO&nqpa&i%d(y9(h=SOS5}E z2*uR$g=a-j3C;>~9^aaToWsY}WHB`Ng>M%4ZRSb{z5Jomz}_r>*sP4PgBjevICi*K zn-tcjwo&~$^@9CzwH0Kj%&Gu5cP*gq#p`Lu`R;`{)(pOVq>vUrCvPU&mAQXkrfTu0 z)k!rm$!>|qqvHt}jns*;sS3qNsqRX!q{1(&j9YC(bY8qP0XvG4UQmJQ}DV z2UOVws^-KeM_Q?vLjiXxOwE+FqN007v$~rChPuCA&E?H=4CE@R{r zZ`G)67^qDh*|QgwMK}@~zgiQ5lZ`uF)4KMJjBQcRE$zJZ{w2bgym0BY7}`<9y;Q*BqngRm&E=;f}cO1jp8cfO=5E zMyrnFWUgvw{6p+Y=88(K#MGHBU%msir#QhLM2dxKW3i|uxv4Ts&LU@~!19>*^!9C??HYLlaz zFfzx=h+BHs+n2Ii*P33gYH>y!`(LHYY{YKt3O&np3=8wrYEe`5#WAKj(?8y|S*XeK z5N+D!wV$3J9eT`3&sa-O*iy%_HZ*>#DVo(NCtb5;PYW_1^X6d+)h-w$>`cNiHg zm>ELPzt9SKX?bZ?cp7M02vG|hsMvZ=j!+k8W{%ZlpL3nN1XFJ>IYb0A@hw{(MTzFE zABH0Y_O$0l_FjgR?s$wP6Vk4_@x8l6n>g)=E`d4a1M z!_6K+*Pb>|3XU4OSwfvO&f7<z``R16`f zYKs~?&gM2ZJChpGI~_3GctdnV67A(I+9;fEMCNcd=l)x~)e>cp3C9 zyFlfx$Mo&DP zzs=%Oaf)HhAZRhnv0B@^?DQ{I@{g-NZKt*Q3;o)b!vd2b4e1!!WMMV2`DA|Ivg zlTWfcJ;YSML^LQs0gWm==_lY4^2Tvn_L0!gcVyOlj661$_RFZDKX#hZE?TH3+dJ?l zfzBxJD!F#{NKc`dfgqlOOg`H_{jKas!V*fOEEqj_ zMVSg`Pci0(?pg{#@S(VH(?R7Ch2z!Ay@@paAA!g9$Jy`MFAi7)OjfRw+cV@$N1D-n z*A@3(j0#L#>`LVr@h(PP4MTAkwe8qubO)ehZJVnFyDVtytFrluh#NfUlkfls2{lXa zln#>Rh02?< zOfa$3bYbdpOmjIsxa)mYq!LfS>?L{F%Op2)eKBJ`eX+_#qYO|$pR!$*TtEO1{MUiu z`cl~%8dD|?bMY}sI(~+E**`ehEdnnl7Ilm;akRZoWqi=>i$|s)&w&{&>(X9;@8A{wM;8q}rpM4;M#vDOGk5Ne%sYw`2&6t=KeQM80c7JrMu6I^a=e zDOvs~x3naYQc?neY1%$%u&gng6(EBQ4*m4*+pJV;94%DISBkFAw$4Kv!LB+oIZm|t z;pRZ?g4c;21Y?%TorN0g>hD-|1)XDx^wi1Qho9qBNn$M2qr)h5<^?Cu9`$C8`wk?n z){y4JgFE(V5n!@w%#nAdZQ{nI&~jB(;3kh0dAzw>dp{G+4ZJfOAGXB&AQ}aH1t5g`@e5($z` znkqUEu@Y!PvZCVdBbS@qYmasseyzJS%K8%f&Cdw;XlMhRcZQR3!R~SI9L`L4#-RRg?dp)f6Rs5-R-g4nY<^1rDRYJk z@4V~bety;Q(dl|htWMT4XJ*o8s+E}$&GcL{LR?h0`c`Y$)xyvaZyQXEFW1Wy0he+q zFGTWUZzZD9@qmWatENW!idJ`)6BvFxA zS!KFg7@js!Pkgo0!(AHo$%E(xcLb`ovn)KsYuy;KV6TD9j?`tS}zXWJ5E~{ShnPAACZfzPLD^T|&zKU-gV%8230)`b! z%j)OcU?GYowO*n5c^;9`{6JD}j|fR=rQjqLH?wMpTWt=LYV!R$jDJ#})#aS#i*XC` zCGF&1ojO@s5|frNKJqNdN$=!@q87J^>x|^gJ>XM$pHNa@Z>q}I8ZG*qjAHA&Un2^a z=C~v>pf_Yc7*1nrGFsId?U9jmcBOwlp56iaOifS@c}I3JjFo6cp2aE-)~h$``c# z<4Im;uanSn)`fh>DjOSD480-D)%p6&Gy#2?zo`*n@~&f=604Hc&^1W^=>Kp*NFW)e z2M(7vjWs@c(`ucFXOhBvqjjWgn#C<3r8jKOIL2!W=_`%!)o>(tdA!MaWRPdV$J#ryT5j*{B=pR>+3Hq z@{T;q^qXfm56n#u%xPz2BR<^LU$LBdi|s2C32mD4oj^+Em~Y6pI_rh{t>Rlk24>)- zp90igC`BiJ02DcBpZ{!^rvy?1OoeMZ1 zPf395vIvF(oz%R8bJVL?N_BI<#zWPyqLLSHdDe?lrZ(kqs{l1O8fb%Cdch(8nkR|Zrfx;Nm`NzxTQNp zp$2IrnDv}{(gMGEU(B2&>Xp($FHtKVV*yYKNBg@BWgsLWQlv z`W3B5kb}v_7$sIPkJATnb{umRC5m1U+pn5qmV|aji%Hjb>J3^zCU#s_Gkxn?@COCP z9Co(Q>b7YS7!x3;JKOH@Hmshy5e%AWtl631ilDq;6az_m#ze~V$mrQfnI-$913CRo z%ly$V&yWg76D8e+#Dg?P#~C95srHw8{gP%gJVS@yYJ(nksUhKh4Cq8_)nUlmB%SsM z`TE@e@A#=no^A~lHfaS&aWYs`%=JE!D+K4s{Fbw{5@I!Cc{@R^f_Lyl9u52CfHUJdW?ReSR0s+?`GWtRdiA4YdM` zaD=#Zi069TV+GuC!~8(Cw7u*@_*C8VWYg(ORqfWtv$vCcMjWf->)kb9O^iK|qY2wJ0K!7XOzpg7n{01=dgRK5M%P}lw_2$-bMcZ1ubAOSc z-Qpafq(Ed;jy?eDoeMx`IRS}gj2UV-^v#?5m6>~!;4oa-{>HkkWaD*K;LBvP7uVRB z%<6;EBV@_uTu`CpX7@QMo9Qy&@Zc4aHOJAnzKnVz#g4OcX=e$iW6JsU+wquyERycq zzQ0~i9m|{<_o!&V`+BS&PT{k8#P{zslf$neuh8gNJKd6wi;sYTzfUU4iJn2c$i5j( zQBN<->e=gS-Ra!om_ay=qR9~USaiBmZwH*r$jrQYI?Cwi5wR_gFqM%ZIz22&wO!J&3M zml~;kw{`mn0C(`yag*^X0`Q|k{dC)RIaVh_<|l)f-eftEk_)e~rVk!G#UH*wIBm^o zT&7|33+g?+@OKazQ#KG;dgQ(s+=uY=ugm2&6GyI;k1WzcPGzdovYC7Bd{Av0BQ85g z*KfylNi=Th_Tv38luFsfvu~?+u=$)>_PlVXpwg>>P)aVwkk7~cnXkj&Ic^!msjPyh zTbrl+XEdgrI*Zv!XWBGJnP@Ald5u6R3S#PenmFSc%F!K#J)}^7+REt}9$wM&yv2Z^$Hn^R<&lB9q2TSN2~$64crZY!PvF_5USCV*zvhgv z`x$E|n!8x$j}P)*OjK1gPc(o2O6XU2+3zQoUwvuW{>eWStKa{A)7e(^0#IchD3b@w z{OykZnB`}4RppRl1JC3?*D7a0-Po*z)rz{#J>0FR1Z;NtX+QI*C<*x~hE;o}N96u^ z;kBMl33Cq=EntRwXmP5W!M1=Qg`FE;0*u<9(_9NfD%tm+fEOCQvVzeblklQ&df@AH1|Nw%6yW?jiNYG;3& znP7j>B}@CeqGe@^)?TGU=}s&^r2E?*?#-h>odw8j5UwKI`DBDqe8^mjb9QJmx;^}Z zOM#84tn_SFn7yXS-JHz#>K2;P6cN1#5iy^%M2GvEOjec=5mX!TR-zxZ-%qwQ!!s$* z0vf-uUNgiN$uo@wSPDuX?3OPF99K=&r!|Hs?p~3jNET4Z103Zg5L9fT4wh%S@##?v0^|Mb$_zyuZOX6I=ARP3q`zsR%aR`%Ig^u3a zod`4sA5Gd#%hY5yWO*)-qla-pCHXHvfBGSl&-6{XWN`^zX1``n7P5bq$|uKBykxbbI+}_R-XGRJLJ1uGtB6Z&>jd9W79L_s3ma4|YHUU6Mp;7o4j)`?&yD zc=~F24QhY7eK}@`d#a;}IqZuxWm1x(6`nVghu&xY3VOYgH@hEh=l#43Z&-BJZnOrMvvr=5g{K;kuhStn*q>`9o29^8(| zR~N_SyK6k<4Jz@e9tQC?U<~`-y3K|-&G6POd88JoryULh?n>+~$lk5E6e^4wR7GdM|xRXN`Z1e$pl;`ffpPGAT)msq@%Ig(&p zRc<0>x(540Kgdmg2U%$E6LAyiqk>qj^L+QsTkJ-6rM>#bzZ^}`Ru>SeM*rX>$9xe# z%T&=?(e}+SBrZl6W?Y64o2=bL4}e~vZy7kOWch`DQFcL_k2YKIgiq2!0i#v@2&4CS<>##L-8zfp^FFgu&C-OR(N9y${q9r|4KZ%Ma=PJAT zj_JR{;Z-$wO0l+VjQ(zh3qPePTk+tD`e=mZK(M%+MdtU-bWcQaF%vq`6y#=*x0yoC z>O%>td35K5JoYfu-Q7HrKEB~%q(}05pcjf&wcCPUt}>_O%AzEjP(Q9@0eqALXKA}F zN|fxkRz8W~DtYCzVd76^*p)n`aF%-Xz}@Otq(<~f%Je?5h5CI4yuGeVHKXAOh%h$e zqywWq1wYeI^=xme=i3=eJZUenIo8`096n22e6lVqmoQyGWVFJ9!tlz+*oiEU=|&o_ z9EDlf;(es#S9%G6C`>s`7SFNuJ9lU>^Z?w~z|mbabnG}E0-W7_RK4*ePRR6qdk^o$ zAX#q4np*hnU2`LTT-N*2fW_JS1tRt2_$#Y-iXPR8@z@`YTS0(rO-IqgtxIZ`$Q616 z8ri$UnFcpR7pgqfa1gl-cMYdn$XC}oh z?OD|-J1%Fsr_dr-`{V*J(Q>c=-}SlijM=C5g2B&pG7VsdhnBVl`N#?u?2%mf_~#c= z$A&F|qfI29J4nV5RBMFVMRai6#vIz0kg@?s173)>V9H|(08A+0MHfqsP7j-Y*ah0} z62ETq!S6v|N*}*(v_q(*xo9JkC@(J=A7TCWzLI;ZpUe)BVzX3#B7)uFiE(UjrJ zaQ6nd|EPV7B-C~^jRawF&u-=h`oEVB@EY)Q8czW$Ri>=k@OQ*FYv6n}OD&EYUt@(@ zt=iU)TBr`bZYf7fLFmdP@ukn+QZpqj3-qx-P$Rjm6`0VYwjqN)w|A@)%Gxkmaf9J@ z_;o{Scd^j7ZkNJDzACQ2EB!K1G3&p&a#;YP_%E|NPPJ<~#ksFRcS3-MUr}<|+K)nu zmj`UU<0vwbAMW4_p&)c2^v`GW4&SyWi3Hsmu-7@MsWf)sz7ykEX_ELD=+GfZ>cCFs zfl0@6h7dJ|Onjt=i*$19vh+QB%9OL*xYU^GX7?`ze=Q4v?)>)QZqdgJpQvh zoY99ZJ>@ky`jnwK6JE+S1-Z>LI0$&y0XxWZoE2@2%2mqhPDVIB=lPKp1&_>#g1?W?hJkua9dS_O?-ILuxiT5^;(X#1jFv+ zgLJo~qlPdyPk;p=O#`qRX;jo^YqK4)8tEMg(Uvmi?#QbeQ=yFx=co-*WLP<3(XBj_ zP*dO8bwq)9&XP|OPf%CG&dPeqw*#o7hhAN4fb+-CN1dWV)QLJ&3Rg=L^^BLmKCVaQ5%X_b^ck z9NNptcK!N$Cq}E@CaAQ^Am25-nrNsd5xgiolI!@*T^7JzF1;BwQ~c!mMEGj8RY6<3 z(wrA#s--D)KjT@qr2??_W)e0{fcmjzBmQ!Vl0o>?1 zl8R;Q8kzO6glbhbckuS-O2VAS6XypnO2hn+4<(6u$?`*X18s=E6E=WVFLV;O zeSHi}Xr;;)`tDbpXud2fF}haWu-~G3Tj6nlW1zeHWsdqTH`&sxbsqf`aKpVokgYNw z*A?+4V(ShkLAz<(cH=g(y)m^7+)sL$>|qJ5nI0INJsHrK0-WGvZ{y*qlm>Y5W!1(NJFExyXhv-Yub%#-U@9Rp zXwSD@*V3fwCxiS+U!^Er=Ey+H&)nI(OKu~WoiqM3as0Cr3xJwibSnKiQCax+bWv?~ z$i1wel$WE!CcP**{?PAtEF+!$+Noc;;PCqF{Fg>DSFr7a2qzjlDs~z+#9daHD@%@5 z+S3%y$PX@6iYwddvA#qW)I?>UU)2dk~- zc8i0Z{A7Z?4@+&ZR4s@(6P7|EcXd!W;IZQyJo%MuF%0Cn~C~5T%UM!QZaJl9GWq=5? z=s#%hAV^itTcf1bm#H}f&-GactVGW(RC6C!jh7G5>3uomX&0#-4MbzVN^AP?d@8Sk zdt}>j-Mg@Z_1nwu5;C}1+WO5|@(9zW3>0Vk_j=?oj zw$;ti!JlVH^^a#IhQnj{TwFY1|9aO?z7etVRdJLlRW86c)mmw7Hr8J8QsX@$K%^U- zU(FJs;u}26KfSI$*kNmzTO)CskjRanjNpHi@hDgt zgis{qm)84d!m``~K)={FKhzm=tpOv$yX-VICY0{1Js-~+@cLF%S~w#CeRg}w{eGQS z;sYndx}Bq-mAsUq`n-+$dz7DE^N+cn!7DCaP&$ef>>0>Qg3e!=&gZac1sf&}I^Sqk zNSI6gc_mG184jB^hew%c(?fhIARXH?`IBr@{{?@>0Z}R-@bS&-*3v;vXiL_H=XVM zLgomD(i9hn@&XL?)A72B;e_FXG7EKKi>l%Vh?50xOtN7QDo|R~Wp3Jh(-~K31y`sc zv{LkVdQFkZ`=^fzUs|Ht22G+57Dkx1d_h`G^r?1Zrj5CIaUQ*N^Vj~Qg}E6Ned?Um zg#Ni}Q^WjoNUy**Skh9m?tZI@`yt_`VdOM#{DbEGKR%v5pSk+!HfZ^+!)=Di2jbF< zPtASxj^}Oc2lSO2B$wp-dTv3C>+(X~HUr|qAnGtuHKA-_=#s&>LJfNG4r=i%@34}% zB3=u+-X1UalSP=Yl59h`FhXaU)Opl(5xFiQ#wJa*#cPe!Ev^CO7DopAsh_YO!_aa| zbsv5`)B4=2c1umVCLn>_&d+T$;MnZ*(66a-DrOBUT8Jj@^S&^hlcWnr@|Z_^x&{U; zbkyT&u2nAys~n+L3q$4}oWH+^v54~*J%poK+Er0Pc&&%=Clj4*W{69AH%QBtn49*n zJ;C9_*~_d}CF|}cr(l`!uM0LF;QKN{k&9+$#T+LM6d|uF&Ln=gD5YlY(Hc9X-{}2b ziw3<;N`1tm=oXw5rJeLqU)P~ikTYP?{605cmNl0NR@<^+4EYS=c5 ztE1i}=-Wr5BO_>>oazn?Uh#%e_7noK*!Nc#K~2=Tb%}C(iEb#NM}7qbIqqeIfL2w} zGF@o{s@fzXr!GOqY{`e^G9QnkS9Di=J9Aa6{9%$)<0=*>L=}GOj2d1jEFBPG_}^Zv zs!-`GTGA#^h86|lH4^cjxh2A_X7IjKBb7z@t#--cimNn@p06Ry2F`f>8`{4f!u1a_ z)Rb4VdK+i!R@gDVSEl6Ul8M!EM*{9S2)0HOtI0j;&4Ijz#U5nEd8Lv<%SeQjKzT_z z8DA*4vMO&FyvZck<{9*j!GeVbCc4c%f}l~MPjn%!rY7bJ5qVi2Nh+fw14TX9>D4-J zXxPgB;gKRF7K)_hMH?806!Qps6CLaEU70O-g?kDK;Oh_ru1_AZe$BHT-Z0MVp@tI% z5anpFqnvmV^VUg8p)eJGCr7KxX<_e($l;tK<@`DjyCRoSXsZ3`Hkm{tF-ms3$$K5f zW2+LF1%eeQ7!v58367|87ZqnP7vs&IUYvYJ%S5Tpw$6FrzF%vpREFQ|)e8{PcMVMM zY4kRf{<=?w3omc<{_RS@Ylv}LIR2Qmk+VX~W_Po9v)R6`y*@k=p}-nRk5V-@A3u5Y zZEKo|J^`*j3g<%JNH)^vTr_v@8AP7V#fZIq|872mL_vb~9ucZ6Xc90pIG=UX9TPLz zbNN`CV&>^w%p(6BrtemiLby#8Po#So``PMlX}PI~^L@#?Nhr>U2K~DiAEqO+J4)@t z_1rs4*-6N~1jJB<6KZstDJ90^SfXurKU~9svA?XI+Qz*1YCPOLC2SwO^x6V&eqDe2 z>!ZDaruBAtvE-CX#l(wCru;Q+UySh}P(|`!z~aS|XDfv}f>nIqaE~Lq*OlX9l26UO zr_j{f$?-{c%^XBZrl$z4m;98%Lzl@Ba`^tu;rwU6m%$%!A*Dho!y`@DOdr0ln=Leh ziVa^Lwv~Udn&eR$%Mu4`=Fg=IhgBj=8bccLIU7daEZKXs7~XR3bPexC712tLpxoJ9 z!DlN7C#^eySN+huk_O{xK9CVl?DRt zwolhE0iQiY=|pQ;^s9Ei@~hLkw&m2Lhm~D}$|{w~^&bfu=Y4Kfy7#`1 z88tZXE%VHJQ}+J3R^^P`Y!WuKcu=J1JlgbiO`lCbDL!4dag3hh&y>bm8s;8YgnQ5M zC_mX}X0`Thzd%(@dLhjj^J$dbA+^k2_=;dY|G-cT0I9-7$f;TH(}0KrI+Kx)sk|266V=! zXJ-Qo$X%juFn&F_*Ik`pnkL>6x%&jg;5&aV|;=PVBe^REg4RA4w@5Dj=+C zL)_8+f~b|($dJqJC*W6_SBDi;HecKUU3IYpu6L*vVEXGL^j|v7W&=)KL{Ej2Im)^2 za$&(2J%4GlZk`2Irn!Z`FHm=6&*tLT738k_ast`cmZz(_kWV>51wiY3Bzl>yvo9~ z(oqV?ca-b#5egioDSu_7l5Pw-UY~}`-+i*#+1kb-^3p!P6_ze2->IqoM8oRbNE5^r zl$&>?AG1tES2$_5$s9CoiGb3-*ZHu1o5*8VvE*#%a~Lqvq!~6->D$Ml@HNf;0z7@w zNN-@13HuvgUOh8LEc8g)$Q2pXesJ}myq}uP7T*4CID-R+-+m$*)eypS+>UK!fOsB0 z@1zC&R3HOgUVRp8J~5;tC&XzhZ*Kb;7vqhBqW7BP(ifzhO<_2{ewVSONy)9|#N2dg z_TQTiLGlI{qHyxgdM%qr@N5zZ@t5tk!GbufRj364jBcN`Sh$wL=&=qcKey)h*uv{-&a);8uMEl19N|3GFW_w)sLPPM0v+@JDY{ZY+XC$f613_RXzW|xQxF#_i+*b zAujIKB)u50HHPMPmD~{byi*^9OnTj>YBDwm}^w)WkY*+KWDu zzq)|Ku5hMgWo_>5Y}+1yf&~?_F5MDqv=&>Y!vNDZM|VoJom_#ge6P6^s*}{qW*ZQN z3-e~4pro{iFgFzF9(mtAtv^X+2x$!4wd?3(?JE~={kK*9Q`jZ04klfnkJIiHU+-Th zK~+H)Y*7+=wscOttxTGK>fUBu8V|31SXf2;-8k_!pM~$!aMtZyf$HMc{97)?vo%Bc zU7u{&M%s)XBUtOC@yYZG*_{yJVdcyF#KXp_6rtFOm_sX52$nypdZBD}!!m7|kt{zQ zJaOyZ)9)SsE8F`M!f%i9!OdODPL1=@OG_D+1MlZC#Y?c3#QzD`{IMqhxw?xqBAg!J zTDcuVBLnHs_F0zHnWYkH&BbvZBD4#5h|PI*l2`F2hWBenDZA( z00~I){9wJ=(tev_`ArUkqdx$+xd|?9 zy#&FwbpBEl4)UG@fJ`I;!$iniNecE9Rl}-@uIW|tx3k7}h~01P2Kcr!HcJi6!I~^O zC;F$!<_`q+4^*<2Uj)zyKA9_+l!C0Rti?v|7qMKuZWZ*&6k+0pja`Us;k2cPlQ`Ib zJ2j1xw~CgHYTSb{q4Q%}Pej>T>~)vp5Dnq({Zu) zv{~%DtT76#K-yciT*~y$p*q=}un_&6pG5<$KOwaH;M$FFo!Jw5UG4j$7_kJny^%rx z4s8P<01GKJNsFlk!@kwHS>Z|&g>20w)e;!;*w_Q?k=Ke0wMCSp6el-}+4x6*)HWV_ zK1v<+>!#)bS6Wlsz^OgXFB>oX2r(sp@mpKCOz0N2+^DSczc<#f@C~eoQRj(+Q5N1(%z@g{!<3-IFUw+iFpbZJ`v@adw0Lv2nmp$1gBRP}1``1E!Oa7&(BE&rMCLr;Vs0|Iz=R1Z{$z+_U9n8t#|#u`aeMm9e^ zK_vF>k`7C8-e5#QU_wu5N2I`4U5jJU3dGg~G!P>)x*Uw6y=YJ`0@DE2rNG-(;v$NY z`((yu1*A_6@L%Utz6tlknVrY)fGQqVu4ZGQzNZ2`$q{=ix+3s-DQ=9WYrbxK`V~UO z4xz&quR94(Fi*FfxzfyKuPd}e^T-jOg;pg%F{Nm(AYX(S7-48A_5zVE3Y*1Aa}9nj zKcl@{>)WH_JAuGymj`T54lUK=nEg1NdG7}iTnfTaw8bZ^D@1l|u30m-6AkJ@ycq}# z#+!buNt>`S_M+zzo97&|x1RrgI~GS()FM#E-atK|77njSGihb$382I}i*W53Qp|zkq`*fOXdt}F@t*3=5D72O z=Ogs$GAecC^)uN}@@hEwDTf5{MOiopYB7!1>e4z2$oc~dcI{nh&j@;m28|#9K`tlv z>+~`;TaMlGF1Go(7bC`AvNP+Ro`Zs_ohMj?1p?mOnL$O`*@YaG#hz}+v~cHLp6Nef zn5iEQY@duk?hjxKQ+s{ohF2rQA|q`=7zqvaSPl>b0n#S7E1Lnyj!R;4sdX`gg6GA~ zr++~-L>o}zq%^rlEkw3Oyjy&@jWdYbkcjmrGdu-RQ+Mbi&{I##SxYlW=C4{KN`VVX lBi6z+6VL|)Ms1e0U!EhvJZB(#?=Ik{eO3QT{-rw){tqFMQZ@hp diff --git a/x-pack/metricbeat/module/googlecloud/_meta/kibana/7/dashboard/Metricbeat-googlecloud-pubsub-overview.json b/x-pack/metricbeat/module/googlecloud/_meta/kibana/7/dashboard/Metricbeat-googlecloud-pubsub-overview.json index 52041a1c64c..6b937817527 100644 --- a/x-pack/metricbeat/module/googlecloud/_meta/kibana/7/dashboard/Metricbeat-googlecloud-pubsub-overview.json +++ b/x-pack/metricbeat/module/googlecloud/_meta/kibana/7/dashboard/Metricbeat-googlecloud-pubsub-overview.json @@ -2,7 +2,7 @@ "objects": [ { "attributes": { - "description": "Overview of Googlecloud Pubsub Metrics", + "description": "Overview of Googlecloud PubSub Metrics", "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { @@ -23,212 +23,242 @@ "title": "Filters" }, "gridData": { - "h": 13, - "i": "575df0fe-b44d-471f-8386-c4bd118a3810", - "w": 10, + "h": 6, + "i": "3674673e-83e6-42df-8392-5284960a12ea", + "w": 48, "x": 0, "y": 0 }, - "panelIndex": "575df0fe-b44d-471f-8386-c4bd118a3810", + "panelIndex": "3674673e-83e6-42df-8392-5284960a12ea", "panelRefName": "panel_0", "title": "Filters", - "version": "7.6.1" + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Oldest Unacked Message" + "title": "Topic Send Request" }, "gridData": { "h": 13, - "i": "5c336037-7c71-4eab-b544-926aaff73736", - "w": 17, - "x": 11, - "y": 0 + "i": "c1d89f36-43ed-42e6-98a0-8820b28f7953", + "w": 16, + "x": 0, + "y": 6 }, - "panelIndex": "5c336037-7c71-4eab-b544-926aaff73736", + "panelIndex": "c1d89f36-43ed-42e6-98a0-8820b28f7953", "panelRefName": "panel_1", - "title": "Subscription Oldest Unacked Message", - "version": "7.6.1" + "title": "Topic Send Request", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Undelivered Messages" + "title": "Topic Oldest Retained Acked Message Age" }, "gridData": { "h": 13, - "i": "389bc633-eeaf-4deb-815c-3a6b8e5d95ac", - "w": 19, - "x": 29, - "y": 0 + "i": "b26a6238-b982-4082-9e4e-3e3d9361a865", + "w": 16, + "x": 16, + "y": 6 }, - "panelIndex": "389bc633-eeaf-4deb-815c-3a6b8e5d95ac", + "panelIndex": "b26a6238-b982-4082-9e4e-3e3d9361a865", "panelRefName": "panel_2", - "title": "Subscription Undelivered Messages", - "version": "7.6.1" + "title": "Topic Oldest Retained Acked Message Age", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Backlog Size" + "title": "Topic Oldest Unacked Message Age" }, "gridData": { - "h": 15, - "i": "2e8dc479-ba85-4424-87c4-40b93e801006", - "w": 24, - "x": 0, - "y": 13 + "h": 13, + "i": "c7bbeabc-b158-4bdd-9ba3-9d45264d250b", + "w": 16, + "x": 32, + "y": 6 }, - "panelIndex": "2e8dc479-ba85-4424-87c4-40b93e801006", + "panelIndex": "c7bbeabc-b158-4bdd-9ba3-9d45264d250b", "panelRefName": "panel_3", - "title": "Subscription Backlog Size", - "version": "7.6.1" + "title": "Topic Oldest Unacked Message Age", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Pull Request Count" + "title": "Subsciption Oldest Unacked Message" }, "gridData": { - "h": 15, - "i": "aefce32f-71e4-4770-9a4b-bedb2c608abd", - "w": 24, - "x": 24, - "y": 13 + "h": 13, + "i": "b822a795-7086-4559-b7c0-176dfcc7380e", + "w": 16, + "x": 0, + "y": 19 }, - "panelIndex": "aefce32f-71e4-4770-9a4b-bedb2c608abd", + "panelIndex": "b822a795-7086-4559-b7c0-176dfcc7380e", "panelRefName": "panel_4", - "title": "Subscription Pull Request Count", - "version": "7.6.1" + "title": "Subsciption Oldest Unacked Message", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Topic Message Size" + "title": "Subscription Number of Undelivered Messages" }, "gridData": { - "h": 15, - "i": "ca4cce89-0d1d-4d96-b35f-443a05d1b410", - "w": 24, - "x": 0, - "y": 28 + "h": 13, + "i": "9c99d7bb-88f0-415c-abc1-c12ec1295236", + "w": 16, + "x": 16, + "y": 19 }, - "panelIndex": "ca4cce89-0d1d-4d96-b35f-443a05d1b410", + "panelIndex": "9c99d7bb-88f0-415c-abc1-c12ec1295236", "panelRefName": "panel_5", - "title": "Topic Message Size", - "version": "7.6.1" + "title": "Subscription Number of Undelivered Messages", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Undelivered Messages" + "title": "Snapshot Oldest Message" }, "gridData": { - "h": 15, - "i": "95c5c1f6-194c-4814-8281-02fecf7a81a5", - "w": 24, - "x": 24, - "y": 28 + "h": 13, + "i": "8cc0ccbd-5798-4d68-a519-07ef1d9693fd", + "w": 16, + "x": 32, + "y": 32 }, - "panelIndex": "95c5c1f6-194c-4814-8281-02fecf7a81a5", + "panelIndex": "8cc0ccbd-5798-4d68-a519-07ef1d9693fd", "panelRefName": "panel_6", - "title": "Subscription Undelivered Messages", - "version": "7.6.1" + "title": "Snapshot Oldest Message", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Pull Message Operation Count" + "title": "Snapshot Number of Messages" }, "gridData": { - "h": 15, - "i": "ab2fad6a-f888-4b49-92c4-c220f3b8669c", - "w": 24, + "h": 13, + "i": "f9e45ec1-72e5-4f49-82cf-2132162d642c", + "w": 16, "x": 0, - "y": 43 + "y": 32 }, - "panelIndex": "ab2fad6a-f888-4b49-92c4-c220f3b8669c", + "panelIndex": "f9e45ec1-72e5-4f49-82cf-2132162d642c", "panelRefName": "panel_7", - "title": "Subscription Pull Message Operation Count", - "version": "7.6.1" + "title": "Snapshot Number of Messages", + "version": "7.9.0" }, { "embeddableConfig": { - "title": "Subscription Sent Message Count" + "title": "Snapshot Backlog Bytes" }, "gridData": { - "h": 15, - "i": "2121bde6-3a01-4339-8508-a20c107c62c9", - "w": 24, - "x": 24, - "y": 43 + "h": 13, + "i": "d8876e62-daf0-4654-8618-8746d5da43e0", + "w": 16, + "x": 16, + "y": 32 }, - "panelIndex": "2121bde6-3a01-4339-8508-a20c107c62c9", + "panelIndex": "d8876e62-daf0-4654-8618-8746d5da43e0", "panelRefName": "panel_8", - "title": "Subscription Sent Message Count", - "version": "7.6.1" + "title": "Snapshot Backlog Bytes", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Subscription Backlog Bytes" + }, + "gridData": { + "h": 13, + "i": "6079e9ed-da9f-4457-bb3a-7ed20f98605e", + "w": 16, + "x": 32, + "y": 19 + }, + "panelIndex": "6079e9ed-da9f-4457-bb3a-7ed20f98605e", + "panelRefName": "panel_9", + "title": "Subscription Backlog Bytes", + "version": "7.9.0" } ], "timeRestore": false, - "title": "[Metricbeat Googlecloud] Pubsub Overview", + "title": "[Metricbeat Googlecloud] PubSub Overview", "version": 1 }, - "id": "ac97c2f0-6ac5-11ea-b657-e57ec854315f", + "id": "2b0fd7b0-feac-11ea-b032-d59f894a5072", "migrationVersion": { "dashboard": "7.3.0" }, + "namespaces": [ + "default" + ], "references": [ { - "id": "8897e920-6ac5-11ea-b657-e57ec854315f", + "id": "f6e33a00-feaf-11ea-b032-d59f894a5072", "name": "panel_0", "type": "visualization" }, { - "id": "1a83ede0-6ab5-11ea-b657-e57ec854315f", + "id": "bd399790-01a2-11eb-b032-d59f894a5072", "name": "panel_1", - "type": "visualization" + "type": "lens" }, { - "id": "fddf3a50-6ac8-11ea-b657-e57ec854315f", + "id": "25b76dc0-01a2-11eb-b032-d59f894a5072", "name": "panel_2", - "type": "visualization" + "type": "lens" }, { - "id": "5067cf60-6a2b-11ea-b657-e57ec854315f", + "id": "5f97d300-01a1-11eb-b032-d59f894a5072", "name": "panel_3", - "type": "visualization" + "type": "lens" }, { - "id": "8e4a1d50-6ab8-11ea-b657-e57ec854315f", + "id": "403d81e0-01a0-11eb-b032-d59f894a5072", "name": "panel_4", - "type": "visualization" + "type": "lens" }, { - "id": "0cb2b3f0-6abe-11ea-b657-e57ec854315f", + "id": "11d06fc0-01a0-11eb-b032-d59f894a5072", "name": "panel_5", - "type": "visualization" + "type": "lens" }, { - "id": "afe5e1b0-6ab3-11ea-b657-e57ec854315f", + "id": "f3e92c10-019d-11eb-b032-d59f894a5072", "name": "panel_6", - "type": "visualization" + "type": "lens" }, { - "id": "8355dab0-6ab8-11ea-b657-e57ec854315f", + "id": "6de1f430-019d-11eb-b032-d59f894a5072", "name": "panel_7", - "type": "visualization" + "type": "lens" }, { - "id": "97ee1230-6ab8-11ea-b657-e57ec854315f", + "id": "0776dbf0-019f-11eb-b032-d59f894a5072", "name": "panel_8", - "type": "visualization" + "type": "lens" + }, + { + "id": "79d80f10-01a0-11eb-b032-d59f894a5072", + "name": "panel_9", + "type": "lens" } ], "type": "dashboard", - "updated_at": "2020-03-20T16:52:13.023Z", - "version": "WzEwMDUsM10=" + "updated_at": "2020-09-28T16:57:22.839Z", + "version": "WzY5MDQsMV0=" }, { "attributes": { "description": "", "kibanaSavedObjectMeta": { - "searchSourceJSON": {} + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } }, - "title": "Pubsub Filters [Metricbeat Googlecloud]", + "title": "PubSub Filter [Metricbeat Googlecloud]", "uiStateJSON": {}, "version": 1, "visState": { @@ -237,7 +267,7 @@ "controls": [ { "fieldName": "googlecloud.labels.resource.subscription_id", - "id": "1584720667458", + "id": "1600984143264", "indexPatternRefName": "control_0_index_pattern", "label": "Subscription ID", "options": { @@ -252,7 +282,7 @@ }, { "fieldName": "googlecloud.labels.resource.topic_id", - "id": "1584720684072", + "id": "1600984164459", "indexPatternRefName": "control_1_index_pattern", "label": "Topic ID", "options": { @@ -264,20 +294,53 @@ }, "parent": "", "type": "list" + }, + { + "fieldName": "googlecloud.labels.resource.snapshot_id", + "id": "1601305675297", + "indexPatternRefName": "control_2_index_pattern", + "label": "Snapshot ID", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "", + "type": "list" + }, + { + "fieldName": "googlecloud.labels.metrics.region", + "id": "1601307561260", + "indexPatternRefName": "control_3_index_pattern", + "label": "Region", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "", + "type": "list" } ], - "pinFilters": true, - "updateFiltersOnChange": true, - "useTimeFilter": true + "pinFilters": false, + "updateFiltersOnChange": false, + "useTimeFilter": false }, - "title": "Pubsub Filters [Metricbeat Googlecloud]", + "title": "PubSub Filter [Metricbeat Googlecloud]", "type": "input_control_vis" } }, - "id": "8897e920-6ac5-11ea-b657-e57ec854315f", + "id": "f6e33a00-feaf-11ea-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "visualization": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [ { "id": "metricbeat-*", @@ -288,640 +351,1038 @@ "id": "metricbeat-*", "name": "control_1_index_pattern", "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_2_index_pattern", + "type": "index-pattern" + }, + { + "id": "metricbeat-*", + "name": "control_3_index_pattern", + "type": "index-pattern" } ], "type": "visualization", - "updated_at": "2020-03-20T16:34:17.599Z", - "version": "Wzk5MywzXQ==" + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNjcsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Oldest Unacked Message [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "e0957450-6ab4-11ea-b946-0f4b813ed42e" - } - ], - "bar_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"4f8dae5f-b49c-4a10-8f94-a29039f93919\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.topic_id\\\",\\\"orderBy\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.topic.send_request_count.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-4f8dae5f-b49c-4a10-8f94-a29039f93919\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.resource.topic_id\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.topic_id\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"4f8dae5f-b49c-4a10-8f94-a29039f93919\\\"},\\\"col-2-f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"id\\\":\\\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\"},\\\"col-3-27a71166-d245-471d-b550-ee0b1899ea88\\\":{\\\"label\\\":\\\"Topic Send Request Count\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.topic.send_request_count.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Topic Send Request Count\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"4f8dae5f-b49c-4a10-8f94-a29039f93919\" seriesType=\"line\" accessors=\"27a71166-d245-471d-b550-ee0b1899ea88\" columnToLabel=\"{\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\":\\\"Topic Send Request Count\\\",\\\"4f8dae5f-b49c-4a10-8f94-a29039f93919\\\":\\\"Top values of googlecloud.labels.resource.topic_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "8a3465a0-6ac6-11ea-a262-61aa6533c46b" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "df2ac0c0-6ab4-11ea-b946-0f4b813ed42e" + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "4f8dae5f-b49c-4a10-8f94-a29039f93919", + "f0d11f8d-e2f9-408a-9114-a0b9b18142d4", + "27a71166-d245-471d-b550-ee0b1899ea88" + ], + "columns": { + "27a71166-d245-471d-b550-ee0b1899ea88": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Topic Send Request Count", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.topic.send_request_count.value", + "suggestedPriority": 0 + }, + "4f8dae5f-b49c-4a10-8f94-a29039f93919": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.topic_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "27a71166-d245-471d-b550-ee0b1899ea88", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.topic_id" + }, + "f0d11f8d-e2f9-408a-9114-a0b9b18142d4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "event.dataset: \"googlecloud.pubsub\" " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Oldest Unacknowledged Message(s)", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.oldest_unacked_message_age.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - } + "accessors": [ + "27a71166-d245-471d-b550-ee0b1899ea88" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "filter", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "seriesType": "line", + "splitAccessor": "4f8dae5f-b49c-4a10-8f94-a29039f93919", + "xAccessor": "f0d11f8d-e2f9-408a-9114-a0b9b18142d4" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "metric" - }, - "title": "Pubsub Subscription Oldest Unacked Message [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Topic Send Request [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "1a83ede0-6ab5-11ea-b657-e57ec854315f", + "id": "bd399790-01a2-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T16:22:19.360Z", - "version": "Wzk4OCwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNjgsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Number of Undelivered Messages [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"89c8d41d-6896-470d-8318-c0a691fa638e\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.metrics.region\\\",\\\"orderBy\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.topic.oldest_retained_acked_message_age_by_region.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"id\\\":\\\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\\\"},\\\"col-2-89c8d41d-6896-470d-8318-c0a691fa638e\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.metrics.region\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.metrics.region\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"89c8d41d-6896-470d-8318-c0a691fa638e\\\"},\\\"col-3-27a71166-d245-471d-b550-ee0b1899ea88\\\":{\\\"label\\\":\\\"Topic Oldest Retained Acked Message Age By Region\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.topic.oldest_retained_acked_message_age_by_region.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Topic Oldest Retained Acked Message Age By Region\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"f0d11f8d-e2f9-408a-9114-a0b9b18142d4\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"89c8d41d-6896-470d-8318-c0a691fa638e\" seriesType=\"line\" accessors=\"27a71166-d245-471d-b550-ee0b1899ea88\" columnToLabel=\"{\\\"27a71166-d245-471d-b550-ee0b1899ea88\\\":\\\"Topic Oldest Retained Acked Message Age By Region\\\",\\\"89c8d41d-6896-470d-8318-c0a691fa638e\\\":\\\"Top values of googlecloud.labels.metrics.region\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "eed2b050-6ac8-11ea-a765-0512a055c04c" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "f0d11f8d-e2f9-408a-9114-a0b9b18142d4", + "89c8d41d-6896-470d-8318-c0a691fa638e", + "27a71166-d245-471d-b550-ee0b1899ea88" + ], + "columns": { + "27a71166-d245-471d-b550-ee0b1899ea88": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Topic Oldest Retained Acked Message Age By Region", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.topic.oldest_retained_acked_message_age_by_region.value", + "suggestedPriority": 0 + }, + "89c8d41d-6896-470d-8318-c0a691fa638e": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.metrics.region", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "27a71166-d245-471d-b550-ee0b1899ea88", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.metrics.region" + }, + "f0d11f8d-e2f9-408a-9114-a0b9b18142d4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Number of Undelivered Messages", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.num_undelivered_messages.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "accessors": [ + "27a71166-d245-471d-b550-ee0b1899ea88" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "seriesType": "line", + "splitAccessor": "89c8d41d-6896-470d-8318-c0a691fa638e", + "xAccessor": "f0d11f8d-e2f9-408a-9114-a0b9b18142d4" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "metric" - }, - "title": "Pubsub Subscription Number of Undelivered Messages [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Topic Oldest Retained Acked Message Age By Region [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "fddf3a50-6ac8-11ea-b657-e57ec854315f", + "id": "25b76dc0-01a2-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T16:36:54.809Z", - "version": "Wzk5NywzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNjksMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Backlog Size [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"ed36f31e-ed2a-460a-a881-18e191f75d04\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.metrics.region\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.topic.oldest_unacked_message_age_by_region.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-ed36f31e-ed2a-460a-a881-18e191f75d04\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.metrics.region\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.metrics.region\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"ed36f31e-ed2a-460a-a881-18e191f75d04\\\"},\\\"col-2-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"label\\\":\\\"Topic Oldest Unacked Message Age By Region\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.topic.oldest_unacked_message_age_by_region.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Topic Oldest Unacked Message Age By Region\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"ed36f31e-ed2a-460a-a881-18e191f75d04\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Topic Oldest Unacked Message Age By Region\\\",\\\"ed36f31e-ed2a-460a-a881-18e191f75d04\\\":\\\"Top values of googlecloud.labels.metrics.region\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "cb6bee00-6a1f-11ea-b594-a5f826db7e0b" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "bar_color_rules": [ + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "ed36f31e-ed2a-460a-a881-18e191f75d04", + "6be62612-437b-448d-9631-c6cc0938225d", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "0888bf93-1ecf-467a-b0b5-9e0deee6545c": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.topic_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.topic_id" + }, + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Topic Oldest Unacked Message Age By Region", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.topic.oldest_unacked_message_age_by_region.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ed36f31e-ed2a-460a-a881-18e191f75d04": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.metrics.region", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.metrics.region" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "id": "cc54ee70-6a1f-11ea-b594-a5f826db7e0b" + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ed36f31e-ed2a-460a-a881-18e191f75d04", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Topic Oldest Unacked Message Age By Region [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" + }, + "id": "5f97d300-01a1-11eb-b032-d59f894a5072", + "migrationVersion": { + "lens": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNzAsMV0=" + }, + { + "attributes": { + "description": "", + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.subscription.oldest_unacked_message_age.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"dataType\\\":\\\"date\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"@timestamp\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"scale\\\":\\\"interval\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-2251f8b6-6091-4386-890b-4d0d33e79a96\\\":{\\\"dataType\\\":\\\"string\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\",\\\"operationType\\\":\\\"terms\\\",\\\"params\\\":{\\\"orderBy\\\":{\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"type\\\":\\\"column\\\"},\\\"orderDirection\\\":\\\"desc\\\",\\\"size\\\":3},\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"customLabel\\\":true,\\\"dataType\\\":\\\"number\\\",\\\"isBucketed\\\":false,\\\"label\\\":\\\"Subscription Oldest Unacked Message Age\\\",\\\"operationType\\\":\\\"avg\\\",\\\"scale\\\":\\\"ratio\\\",\\\"sourceField\\\":\\\"googlecloud.pubsub.subscription.oldest_unacked_message_age.value\\\",\\\"suggestedPriority\\\":0,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Subscription Oldest Unacked Message Age\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"2251f8b6-6091-4386-890b-4d0d33e79a96\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Subscription Oldest Unacked Message Age\\\",\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "cce19e10-6a1f-11ea-b594-a5f826db7e0b" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "2251f8b6-6091-4386-890b-4d0d33e79a96", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "2251f8b6-6091-4386-890b-4d0d33e79a96": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.subscription_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.subscription_id" + }, + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Subscription Oldest Unacked Message Age", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.subscription.oldest_unacked_message_age.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.backlog_bytes.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "2251f8b6-6091-4386-890b-4d0d33e79a96", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Subscription Backlog Size [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Subscription Oldest Unacked Message [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "5067cf60-6a2b-11ea-b657-e57ec854315f", + "id": "403d81e0-01a0-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-19T21:48:05.334Z", - "version": "Wzk1NiwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:53:54.651Z", + "version": "WzY4NDIsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Pull Request Count [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.subscription.num_undelivered_messages.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"dataType\\\":\\\"date\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"@timestamp\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"scale\\\":\\\"interval\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-2251f8b6-6091-4386-890b-4d0d33e79a96\\\":{\\\"dataType\\\":\\\"string\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\",\\\"operationType\\\":\\\"terms\\\",\\\"params\\\":{\\\"orderBy\\\":{\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"type\\\":\\\"column\\\"},\\\"orderDirection\\\":\\\"desc\\\",\\\"size\\\":3},\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"customLabel\\\":true,\\\"dataType\\\":\\\"number\\\",\\\"isBucketed\\\":false,\\\"label\\\":\\\"Subscription Number of Undelivered Messages\\\",\\\"operationType\\\":\\\"avg\\\",\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"bytes\\\",\\\"params\\\":{\\\"decimals\\\":0}}},\\\"scale\\\":\\\"ratio\\\",\\\"sourceField\\\":\\\"googlecloud.pubsub.subscription.num_undelivered_messages.value\\\",\\\"suggestedPriority\\\":0,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\" | lens_format_column format=\"bytes\" columnId=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" decimals=0}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Subscription Number of Undelivered Messages\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"2251f8b6-6091-4386-890b-4d0d33e79a96\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Subscription Number of Undelivered Messages\\\",\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "e0957450-6ab4-11ea-b946-0f4b813ed42e" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "df2ac0c0-6ab4-11ea-b946-0f4b813ed42e" + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "2251f8b6-6091-4386-890b-4d0d33e79a96", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "2251f8b6-6091-4386-890b-4d0d33e79a96": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.subscription_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.subscription_id" + }, + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Subscription Number of Undelivered Messages", + "operationType": "avg", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "googlecloud.pubsub.subscription.num_undelivered_messages.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.pull_request_count.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "2251f8b6-6091-4386-890b-4d0d33e79a96", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Subscription Pull Request Count [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Subscription Number of Undelivered Messages [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "8e4a1d50-6ab8-11ea-b657-e57ec854315f", + "id": "11d06fc0-01a0-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T16:10:38.696Z", - "version": "Wzk3OCwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:55:54.581Z", + "version": "WzY4NzYsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Topic Message Size [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.snapshot.oldest_message_age.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-921ee447-0c37-4e9d-9f42-a491f412baef\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"label\\\":\\\"Snapshot Oldest Message\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.snapshot.oldest_message_age.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Snapshot Oldest Message\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"921ee447-0c37-4e9d-9f42-a491f412baef\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Snapshot Oldest Message\\\",\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "e0957450-6ab4-11ea-b946-0f4b813ed42e" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "df2ac0c0-6ab4-11ea-b946-0f4b813ed42e" + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "921ee447-0c37-4e9d-9f42-a491f412baef", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Snapshot Oldest Message", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.snapshot.oldest_message_age.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "921ee447-0c37-4e9d-9f42-a491f412baef": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.snapshot_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.snapshot_id" + } + }, + "indexPatternId": "metricbeat-*" + } } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.topic.message_sizes.bucket_options.Options.ExponentialBuckets.num_finite_buckets.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.topic_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "921ee447-0c37-4e9d-9f42-a491f412baef", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Topic Message Size [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Snapshot Oldest Message [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "0cb2b3f0-6abe-11ea-b657-e57ec854315f", + "id": "f3e92c10-019d-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T16:53:34.774Z", - "version": "WzEwMDcsM10=" + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNzMsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Undelivered Messages [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"ef2fc668-040b-4c82-9f65-5d3fb25c9536\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"orderBy\\\":\\\"_key\\\",\\\"order\\\":\\\"asc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.snapshot.num_messages.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-ef2fc668-040b-4c82-9f65-5d3fb25c9536\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"alphabetical\\\"},\\\"orderDirection\\\":\\\"asc\\\"},\\\"id\\\":\\\"ef2fc668-040b-4c82-9f65-5d3fb25c9536\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"label\\\":\\\"Snapshot Number of Messages\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.snapshot.num_messages.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"customLabel\\\":true,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Snapshot Number of Messages\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"ef2fc668-040b-4c82-9f65-5d3fb25c9536\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Snapshot Number of Messages\\\",\\\"ef2fc668-040b-4c82-9f65-5d3fb25c9536\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.num_undelivered_messages.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "id": "metricbeat-*", + "title": "metricbeat-*" + } + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "ef2fc668-040b-4c82-9f65-5d3fb25c9536", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Snapshot Number of Messages", + "operationType": "avg", + "scale": "ratio", + "sourceField": "googlecloud.pubsub.snapshot.num_messages.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ef2fc668-040b-4c82-9f65-5d3fb25c9536": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.snapshot_id", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.snapshot_id" + } + }, + "indexPatternId": "metricbeat-*" + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ef2fc668-040b-4c82-9f65-5d3fb25c9536", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Subscription Undelivered Messages [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Snapshot Number of Messages [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "afe5e1b0-6ab3-11ea-b657-e57ec854315f", + "id": "6de1f430-019d-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T14:04:17.099Z", - "version": "Wzk1OCwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNzQsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Pull Message Operation Count [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.snapshot.backlog_bytes.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-921ee447-0c37-4e9d-9f42-a491f412baef\\\":{\\\"label\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.snapshot_id\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"label\\\":\\\"Snapshot Backlog Bytes\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"googlecloud.pubsub.snapshot.backlog_bytes.value\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"bytes\\\",\\\"params\\\":{\\\"decimals\\\":0}}},\\\"customLabel\\\":true,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\" | lens_format_column format=\"bytes\" columnId=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" decimals=0}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Snapshot Backlog Bytes\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"921ee447-0c37-4e9d-9f42-a491f412baef\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Snapshot Backlog Bytes\\\",\\\"921ee447-0c37-4e9d-9f42-a491f412baef\\\":\\\"Top values of googlecloud.labels.resource.snapshot_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "e0957450-6ab4-11ea-b946-0f4b813ed42e" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "df2ac0c0-6ab4-11ea-b946-0f4b813ed42e" + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "921ee447-0c37-4e9d-9f42-a491f412baef", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Snapshot Backlog Bytes", + "operationType": "avg", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "googlecloud.pubsub.snapshot.backlog_bytes.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "921ee447-0c37-4e9d-9f42-a491f412baef": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.snapshot_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.snapshot_id" + } + }, + "indexPatternId": "metricbeat-*" + } } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.pull_message_operation_count.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - } + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "921ee447-0c37-4e9d-9f42-a491f412baef", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Subscription Pull Message Operation Count [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Snapshot Backlog Bytes [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "8355dab0-6ab8-11ea-b657-e57ec854315f", + "id": "0776dbf0-019f-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T14:38:49.818Z", - "version": "Wzk2MSwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:24:38.594Z", + "version": "WzYzNzUsMV0=" }, { "attributes": { "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Pubsub Subscription Sent Message Count [Metricbeat Googlecloud]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + "expression": "kibana\n| kibana_context query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"91e62734-6524-424c-b2b5-3974c835dd6c\" \n tables={esaggs index=\"metricbeat-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true timeFields=\"@timestamp\" aggConfigs=\"[{\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"1m\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"orderBy\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"googlecloud.pubsub.subscription.backlog_bytes.value\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-6be62612-437b-448d-9631-c6cc0938225d\\\":{\\\"dataType\\\":\\\"date\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"@timestamp\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"params\\\":{\\\"interval\\\":\\\"1m\\\"},\\\"scale\\\":\\\"interval\\\",\\\"sourceField\\\":\\\"@timestamp\\\",\\\"id\\\":\\\"6be62612-437b-448d-9631-c6cc0938225d\\\"},\\\"col-2-2251f8b6-6091-4386-890b-4d0d33e79a96\\\":{\\\"dataType\\\":\\\"string\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\",\\\"operationType\\\":\\\"terms\\\",\\\"params\\\":{\\\"orderBy\\\":{\\\"columnId\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\",\\\"type\\\":\\\"column\\\"},\\\"orderDirection\\\":\\\"desc\\\",\\\"size\\\":3},\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"googlecloud.labels.resource.subscription_id\\\",\\\"id\\\":\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\"},\\\"col-3-5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":{\\\"customLabel\\\":true,\\\"dataType\\\":\\\"number\\\",\\\"isBucketed\\\":false,\\\"label\\\":\\\"Subscription Backlog Bytes\\\",\\\"operationType\\\":\\\"avg\\\",\\\"params\\\":{\\\"format\\\":{\\\"id\\\":\\\"bytes\\\",\\\"params\\\":{\\\"decimals\\\":0}}},\\\"scale\\\":\\\"ratio\\\",\\\"sourceField\\\":\\\"googlecloud.pubsub.subscription.backlog_bytes.value\\\",\\\"suggestedPriority\\\":0,\\\"id\\\":\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\"}}\" | lens_format_column format=\"bytes\" columnId=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" decimals=0}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Subscription Backlog Bytes\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} fittingFunction=\"None\" \n layers={lens_xy_layer layerId=\"91e62734-6524-424c-b2b5-3974c835dd6c\" hide=false xAccessor=\"6be62612-437b-448d-9631-c6cc0938225d\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"2251f8b6-6091-4386-890b-4d0d33e79a96\" seriesType=\"line\" accessors=\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\" columnToLabel=\"{\\\"5424865c-c988-4e26-b00b-b3cf90e1e4cf\\\":\\\"Subscription Backlog Bytes\\\",\\\"2251f8b6-6091-4386-890b-4d0d33e79a96\\\":\\\"Top values of googlecloud.labels.resource.subscription_id\\\"}\"}", + "state": { + "datasourceMetaData": { + "filterableIndexPatterns": [ { - "id": "e0957450-6ab4-11ea-b946-0f4b813ed42e" + "id": "metricbeat-*", + "title": "metricbeat-*" } - ], - "default_index_pattern": "metricbeat-*", - "default_timefield": "@timestamp", - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "df2ac0c0-6ab4-11ea-b946-0f4b813ed42e" + ] + }, + "datasourceStates": { + "indexpattern": { + "currentIndexPatternId": "metricbeat-*", + "layers": { + "91e62734-6524-424c-b2b5-3974c835dd6c": { + "columnOrder": [ + "6be62612-437b-448d-9631-c6cc0938225d", + "2251f8b6-6091-4386-890b-4d0d33e79a96", + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" + ], + "columns": { + "2251f8b6-6091-4386-890b-4d0d33e79a96": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of googlecloud.labels.resource.subscription_id", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5424865c-c988-4e26-b00b-b3cf90e1e4cf", + "type": "column" + }, + "orderDirection": "desc", + "size": 3 + }, + "scale": "ordinal", + "sourceField": "googlecloud.labels.resource.subscription_id" + }, + "5424865c-c988-4e26-b00b-b3cf90e1e4cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Subscription Backlog Bytes", + "operationType": "avg", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "googlecloud.pubsub.subscription.backlog_bytes.value", + "suggestedPriority": 0 + }, + "6be62612-437b-448d-9631-c6cc0938225d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "indexPatternId": "metricbeat-*" + } } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metricbeat-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "googlecloud.pubsub.subscription.sent_message_count.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } + "accessors": [ + "5424865c-c988-4e26-b00b-b3cf90e1e4cf" ], - "point_size": "3", - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "googlecloud.labels.resource.subscription_id", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "layerId": "91e62734-6524-424c-b2b5-3974c835dd6c", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "2251f8b6-6091-4386-890b-4d0d33e79a96", + "xAccessor": "6be62612-437b-448d-9631-c6cc0938225d" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries" - }, - "title": "Pubsub Subscription Sent Message Count [Metricbeat Googlecloud]", - "type": "metrics" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line" + } + }, + "title": "Subscription Backlog [Metricbeat Googlecloud]", + "visualizationType": "lnsXY" }, - "id": "97ee1230-6ab8-11ea-b657-e57ec854315f", + "id": "79d80f10-01a0-11eb-b032-d59f894a5072", "migrationVersion": { - "visualization": "7.4.2" + "lens": "7.8.0" }, + "namespaces": [ + "default" + ], "references": [], - "type": "visualization", - "updated_at": "2020-03-20T15:12:11.523Z", - "version": "Wzk2NCwzXQ==" + "type": "lens", + "updated_at": "2020-09-28T16:56:57.481Z", + "version": "WzY4OTYsMV0=" } ], - "version": "7.6.1" + "version": "7.9.0" } From 8eb3529199b62192359871fa72998d95ed4e08d3 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Tue, 29 Sep 2020 09:23:22 +0100 Subject: [PATCH 069/216] [CI] Archive build reasons (#21347) --- Jenkinsfile | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 9121d0d48cf..27f97aa4b14 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -107,18 +107,11 @@ pipeline { mapParallelTasks["${k}"] = v } } + notifyBuildReason() parallel(mapParallelTasks) } } } - post { - always { - dir("${BASE_DIR}"){ - // Archive the markdown files that contain the build reasons - archiveArtifacts(allowEmptyArchive: false, artifacts: 'build-reasons/*.md') - } - } - } } } post { @@ -546,6 +539,17 @@ def isDockerInstalled(){ } } +/** +* Notify the build reason. +*/ +def notifyBuildReason() { + // Archive the build reason here, since the workspace can be deleted when running the parallel stages. + archiveArtifacts(allowEmptyArchive: true, artifacts: 'build-reasons/*.*') + if (isPR()) { + echo 'TODO: Add a comment with the build reason (this is required to be implemented in the shared library)' + } +} + /** * This class is the one used for running the parallel stages, therefore * its arguments are passed by the beatsStages step. From 452c6d2b9fe2a6831a337e309efa210bcdf91f36 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 29 Sep 2020 10:42:48 +0200 Subject: [PATCH 070/216] [Filebeat] Fix checkpoint (#21344) * fix checkpoint @timestamp already exists * Fix checkpoint @timestamp already existing, test logs * testfile * Updated CHANGELOG * fix ASCIIDOC * remove timestamp renaming since it produced strange error messages about too much compiled scrips * reenable tiemestamp rename * move comment in asciidoc to bugfixes * move comment in asciidoc to bugfixes * fix asciidoc * fix asciidoc * fix tes log * remove empty lines * Fix pipeline and re generate test files * Reorder changelog entry Co-authored-by: bernhard.fluehmann --- CHANGELOG.next.asciidoc | 1 + .../checkpoint/firewall/ingest/pipeline.yml | 21 +- .../test/checkpoint.log-expected.json | 200 +++++++++--------- .../firewall/test/checkpoint_with_time.log | 1 + .../checkpoint_with_time.log-expected.json | 56 +++++ 5 files changed, 171 insertions(+), 108 deletions(-) create mode 100644 x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log create mode 100644 x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log-expected.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 13602e72d21..e94e6111d54 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -269,6 +269,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix an error updating file size being logged when EOF is reached. {pull}21048[21048] - Fix error when processing AWS Cloudtrail Digest logs. {pull}21086[21086] {issue}20943[20943] - Provide backwards compatibility for the `append` processor when Elasticsearch is less than 7.10.0. {pull}21159[21159] +- Fix checkpoint module when logs contain time field. {pull}20567[20567] *Heartbeat* diff --git a/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml b/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml index d21d421ce0f..d22d9a65eaf 100644 --- a/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml +++ b/x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml @@ -40,10 +40,14 @@ processors: - message - host ignore_missing: true -- set: - field: '@timestamp' - value: '{{syslog5424_ts}}' - if: ctx.checkpoint?.time == null +- rename: + field: "@timestamp" + target_field: "event.created" + ignore_missing: true +- date: + field: "syslog5424_ts" + formats: ["ISO8601", "UNIX"] + if: "ctx.checkpoint?.time == null" - set: field: event.module value: checkpoint @@ -578,10 +582,10 @@ processors: field: checkpoint.industry_reference target_field: vulnerability.id ignore_missing: true -- rename: - field: checkpoint.time - target_field: '@timestamp' - ignore_missing: true +- date: + field: "checkpoint.time" + formats: ["ISO8601", "UNIX"] + if: "ctx.checkpoint?.time != null" - rename: field: checkpoint.message target_field: message @@ -795,6 +799,7 @@ processors: - checkpoint.xlatesrc - checkpoint.xlatedst - checkpoint.uid + - checkpoint.time - syslog5424_ts ignore_missing: true on_failure: diff --git a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json index 72aede80ce5..fd07aa51eca 100644 --- a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json +++ b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json @@ -1,6 +1,6 @@ [ { - "@timestamp": "2020-03-29T13:19:20Z", + "@timestamp": "2020-03-29T13:19:20.000Z", "checkpoint.sys_message": "The eth0 interface is not protected by the anti-spoofing feature. Your network may be at risk", "event.category": [ "network" @@ -27,7 +27,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:20Z", + "@timestamp": "2020-03-29T13:19:20.000Z", "checkpoint.sys_message": "The eth1 interface is not protected by the anti-spoofing feature. Your network may be at risk", "event.category": [ "network" @@ -54,7 +54,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:21Z", + "@timestamp": "2020-03-29T13:19:21.000Z", "checkpoint.sys_message": "installed Standard", "event.category": [ "network" @@ -81,7 +81,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -135,7 +135,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -202,7 +202,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -256,7 +256,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -320,7 +320,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -374,7 +374,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -438,7 +438,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -492,7 +492,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -556,7 +556,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -610,7 +610,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -674,7 +674,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -728,7 +728,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -792,7 +792,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -846,7 +846,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -910,7 +910,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -964,7 +964,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1028,7 +1028,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1082,7 +1082,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1146,7 +1146,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1200,7 +1200,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1264,7 +1264,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1318,7 +1318,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1382,7 +1382,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1436,7 +1436,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1500,7 +1500,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1554,7 +1554,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1618,7 +1618,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1672,7 +1672,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1736,7 +1736,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1790,7 +1790,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1854,7 +1854,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -1908,7 +1908,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -1972,7 +1972,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2026,7 +2026,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2090,7 +2090,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2144,7 +2144,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:22Z", + "@timestamp": "2020-03-29T13:19:22.000Z", "checkpoint.additional_info": "Access Control Policy : Standard", "checkpoint.audit_status": "Success", "checkpoint.machine": "192.168.1.117", @@ -2192,7 +2192,7 @@ ] }, { - "@timestamp": "2020-03-29T13:19:23Z", + "@timestamp": "2020-03-29T13:19:23.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2256,7 +2256,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:26Z", + "@timestamp": "2020-03-29T13:20:26.000Z", "checkpoint.blade_name": "Anti Bot & Anti Virus", "checkpoint.information": "policy installation for blade Anti Bot & Anti Virus completed successfully", "event.category": [ @@ -2283,7 +2283,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2350,7 +2350,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2404,7 +2404,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2458,7 +2458,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2512,7 +2512,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2576,7 +2576,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2630,7 +2630,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2694,7 +2694,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2748,7 +2748,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2812,7 +2812,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2866,7 +2866,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -2930,7 +2930,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -2984,7 +2984,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3048,7 +3048,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3102,7 +3102,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3166,7 +3166,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:28Z", + "@timestamp": "2020-03-29T13:20:28.000Z", "checkpoint.additional_info": "Threat Prevention Policy : Standard", "checkpoint.audit_status": "Success", "checkpoint.machine": "192.168.1.117", @@ -3214,7 +3214,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3268,7 +3268,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3332,7 +3332,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3386,7 +3386,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:29Z", + "@timestamp": "2020-03-29T13:20:29.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3450,7 +3450,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3504,7 +3504,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3568,7 +3568,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3622,7 +3622,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3686,7 +3686,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3740,7 +3740,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:30Z", + "@timestamp": "2020-03-29T13:20:30.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3804,7 +3804,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -3868,7 +3868,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3922,7 +3922,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -3976,7 +3976,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4040,7 +4040,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4094,7 +4094,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:31Z", + "@timestamp": "2020-03-29T13:20:31.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4158,7 +4158,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:46Z", + "@timestamp": "2020-03-29T13:20:46.000Z", "checkpoint.sys_message": "The eth0 interface is not protected by the anti-spoofing feature. Your network may be at risk", "event.category": [ "network" @@ -4185,7 +4185,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:46Z", + "@timestamp": "2020-03-29T13:20:46.000Z", "checkpoint.sys_message": "The eth1 interface is not protected by the anti-spoofing feature. Your network may be at risk", "event.category": [ "network" @@ -4212,7 +4212,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:46Z", + "@timestamp": "2020-03-29T13:20:46.000Z", "checkpoint.sys_message": "installed Standard", "event.category": [ "network" @@ -4239,7 +4239,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4306,7 +4306,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4360,7 +4360,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4414,7 +4414,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4478,7 +4478,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4532,7 +4532,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4596,7 +4596,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4650,7 +4650,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4714,7 +4714,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4768,7 +4768,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:47Z", + "@timestamp": "2020-03-29T13:20:47.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4832,7 +4832,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -4886,7 +4886,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -4950,7 +4950,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5004,7 +5004,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -5068,7 +5068,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5122,7 +5122,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -5186,7 +5186,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5240,7 +5240,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -5304,7 +5304,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5358,7 +5358,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -5422,7 +5422,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5476,7 +5476,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:48Z", + "@timestamp": "2020-03-29T13:20:48.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", @@ -5540,7 +5540,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:49Z", + "@timestamp": "2020-03-29T13:20:49.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.parent_rule": "0", @@ -5594,7 +5594,7 @@ ] }, { - "@timestamp": "2020-03-29T13:20:49Z", + "@timestamp": "2020-03-29T13:20:49.000Z", "checkpoint.logid": "0", "checkpoint.match_id": "1", "checkpoint.nat_addtnl_rulenum": "0", diff --git a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log new file mode 100644 index 00000000000..c2a7b014e15 --- /dev/null +++ b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log @@ -0,0 +1 @@ +<134>1 2020-03-30T07:20:35Z gw-da58d3 CheckPoint 7776 - [action:"Accept"; flags:"444676"; ifdir:"outbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e819dc3,0x0,0x353707c7,0xee78a1dc}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"1"; time:"1594646954"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={880771B0-FD92-2C4F-82FC-B96FC3DE5A07};mgmt=gw-da58d3;date=1585502566;policy_name=Standard\]"; dst:"192.168.1.153"; inzone:"Local"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"External"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"43103"; service:"514"; service_id:"syslog"; src:"192.168.1.100"] diff --git a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log-expected.json b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log-expected.json new file mode 100644 index 00000000000..7df3da49b7b --- /dev/null +++ b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint_with_time.log-expected.json @@ -0,0 +1,56 @@ +[ + { + "@timestamp": "2020-07-13T13:29:14.000Z", + "checkpoint.logid": "0", + "checkpoint.match_id": "1", + "checkpoint.parent_rule": "0", + "checkpoint.rule_action": "Accept", + "client.ip": "192.168.1.100", + "client.port": 43103, + "destination.ip": "192.168.1.153", + "destination.port": 514, + "event.action": "Accept", + "event.category": [ + "network" + ], + "event.dataset": "checkpoint.firewall", + "event.id": "{0x5e819dc3,0x0,0x353707c7,0xee78a1dc}", + "event.kind": "event", + "event.module": "checkpoint", + "event.outcome": "success", + "event.sequence": 1, + "event.timezone": "-02:00", + "event.type": [ + "allowed", + "connection" + ], + "fileset.name": "firewall", + "input.type": "log", + "log.offset": 0, + "network.application": "syslog", + "network.direction": "outbound", + "network.iana_number": "17", + "network.name": "Network", + "observer.egress.interface.name": "eth0", + "observer.egress.zone": "External", + "observer.ingress.zone": "Local", + "observer.name": "192.168.1.100", + "observer.product": "VPN-1 & FireWall-1", + "observer.type": "firewall", + "observer.vendor": "Checkpoint", + "related.ip": [ + "192.168.1.100", + "192.168.1.153" + ], + "rule.uuid": "1fde807b-6300-4b1a-914f-f1c1f3e2e7d2", + "server.ip": "192.168.1.153", + "server.port": 514, + "service.type": "checkpoint", + "source.ip": "192.168.1.100", + "source.port": 43103, + "tags": [ + "checkpoint-firewall", + "forwarded" + ] + } +] \ No newline at end of file From 4d18e788be63ad9eb89410a987d03f841efefb90 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Tue, 29 Sep 2020 09:52:54 +0100 Subject: [PATCH 071/216] [CI] Fix runbld when workspace does not exist (#21350) --- Jenkinsfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Jenkinsfile b/Jenkinsfile index 27f97aa4b14..119cea9b3ab 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -116,6 +116,8 @@ pipeline { } post { always { + deleteDir() + unstashV2(name: 'source', bucket: "${JOB_GCS_BUCKET}", credentialsId: "${JOB_GCS_CREDENTIALS}") runbld(stashedTestReports: stashedTestReports, project: env.REPO) } cleanup { From b65b12322b01c538c01a543cd98b8e7508c30a40 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Tue, 29 Sep 2020 12:19:43 +0300 Subject: [PATCH 072/216] Handle multiple upstreams in ingress-controller (#21215) --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 64 +++- filebeat/module/nginx/fields.go | 2 +- .../nginx/ingress_controller/_meta/fields.yml | 43 ++- .../ingress_controller/ingest/pipeline.yml | 102 +++++- .../nginx/ingress_controller/test/test.log | 1 + .../test/test.log-expected.json | 346 ++++++++++++++++-- 7 files changed, 512 insertions(+), 47 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e94e6111d54..67d355a2733 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -268,6 +268,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove wrongly mapped `tls.client.server_name` from `fortinet/firewall` fileset. {pull}20983[20983] - Fix an error updating file size being logged when EOF is reached. {pull}21048[21048] - Fix error when processing AWS Cloudtrail Digest logs. {pull}21086[21086] {issue}20943[20943] +- Handle multiple upstreams in ingress-controller. {pull}21215[21215] - Provide backwards compatibility for the `append` processor when Elasticsearch is less than 7.10.0. {pull}21159[21159] - Fix checkpoint module when logs contain time field. {pull}20567[20567] diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index b4888ec8c5e..8a145ff8724 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -105135,6 +105135,46 @@ type: array -- +*`nginx.ingress_controller.upstream_address_list`*:: ++ +-- +An array of the upstream addresses. It is a list because it is common that several upstream servers were contacted during request processing. + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.response.length_list`*:: ++ +-- +An array of upstream response lengths. It is a list because it is common that several upstream servers were contacted during request processing. + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.response.time_list`*:: ++ +-- +An array of upstream response durations. It is a list because it is common that several upstream servers were contacted during request processing. + + +type: keyword + +-- + +*`nginx.ingress_controller.upstream.response.status_code_list`*:: ++ +-- +An array of upstream response status codes. It is a list because it is common that several upstream servers were contacted during request processing. + + +type: keyword + +-- + *`nginx.ingress_controller.http.request.length`*:: + -- @@ -105182,7 +105222,7 @@ type: keyword *`nginx.ingress_controller.upstream.response.length`*:: + -- -The length of the response obtained from the upstream server +The length of the response obtained from the upstream server. If several servers were contacted during request process, the summary of the multiple response lengths is stored. type: long @@ -105194,7 +105234,7 @@ format: bytes *`nginx.ingress_controller.upstream.response.time`*:: + -- -The time spent on receiving the response from the upstream server as seconds with millisecond resolution +The time spent on receiving the response from the upstream as seconds with millisecond resolution. If several servers were contacted during request process, the summary of the multiple response times is stored. type: double @@ -105206,40 +105246,40 @@ format: duration *`nginx.ingress_controller.upstream.response.status_code`*:: + -- -The status code of the response obtained from the upstream server +The status code of the response obtained from the upstream server. If several servers were contacted during request process, only the status code of the response from the last one is stored in this field. type: long -- -*`nginx.ingress_controller.http.request.id`*:: +*`nginx.ingress_controller.upstream.ip`*:: + -- -The randomly generated ID of the request +The IP address of the upstream server. If several servers were contacted during request process, only the last one is stored in this field. -type: keyword +type: ip -- -*`nginx.ingress_controller.upstream.ip`*:: +*`nginx.ingress_controller.upstream.port`*:: + -- -The IP address of the upstream server. If several servers were contacted during request processing, their addresses are separated by commas. +The port of the upstream server. If several servers were contacted during request process, only the last one is stored in this field. -type: ip +type: long -- -*`nginx.ingress_controller.upstream.port`*:: +*`nginx.ingress_controller.http.request.id`*:: + -- -The port of the upstream server. +The randomly generated ID of the request -type: long +type: keyword -- diff --git a/filebeat/module/nginx/fields.go b/filebeat/module/nginx/fields.go index 2f9e50ceb60..4e622f85db6 100644 --- a/filebeat/module/nginx/fields.go +++ b/filebeat/module/nginx/fields.go @@ -32,5 +32,5 @@ func init() { // AssetNginx returns asset data. // This is the base64 encoded gzipped contents of module/nginx. func AssetNginx() string { - return "eJzsWM9u48YPvucpiP1dfgUSPYAPBYotFsihRVH00Jt3rKFkIqOhSo6c+u2LkeQ/kUe25GS3PUinRDK/7+OQwxnyCV5wvwJfkv/7ASBQcLiCT7/G/z89AFjUXKgOxH4FPz4AAPzCtnEIBQvURpR8CWGL0JqA4xIKcqjZA4BuWcI6Z19QuYIgDT4AFITO6qqFegJvKjzRxyfsa1xBKdzU/ZuEhvh8aYGgEK7GBMTnnO+c0+Q5qh5fp4ivkMfnM/tgyGtP0a7ISUiHH/UcpaTknEsSrDjgmuq1Iw1vfnKQZ0TMfvDlisT4/OQ7K+CiZ4Dn38BYK6iKmsFzAFIwEElhg7lpFIHalzlXFXsIDORz11h8hA0qWdTW09wR+qFQOIN/fEPVxWqLxqIoOHpB+Prn0xeWVyMWbfzra3aB9jsaB8qN5K1wUhDUwII26vrafcmoPjNNru6G7X6t6EO22QfU9PI6MsMvtQnbFWxDqDNBrdkrZhErCVNRKaaLRJ/vl0IaRVnHP2dKiHZZwm4KZ4Vhy/Y+n/9qUEOWRJjkrri5jorLWKgkb4amUwij7PUORYn9PR6nTacwH/JjnbOdG923CabBhEZTONN0FCiC8p54j2BMoTflZVWYktzr1nBu6Mf32LiOYZWHkcp8DmlxR/kwGtddS7rX4aQ28jUvh2pGzGdqeacITpHMlMCaFY1zqYI4T8oYwnw975WSzt97tIwjzdoNJTIN0/3+jZCzD+TRh/eseH9sl8jZTbypC59z44Ps16Scqpx3SbuJOFWc47z92ftFXUGaKkawJPYfFL/rYJODR2H/UQl1BWrmCn1cKt0GHJN2kIQiLN+uYWnhZ/UrOXuPeWjdSt8tHftyXrfy+YgJZNEHKgjlxs3e4Q7n3jEdl1nKbsr9ph7xdpytFo7dYHZpOYUv3M0XtoLGZnexVqhqyrnX2LTVrdQmX8YWcR2PAmHn8Jvk+XPH0uf7iWvp1f8rvfr/DpnwdBYdrTGngvI+HqM937F1cejLsJ1akAqWyoQVpNr5G+H6Y4vQk0JHCv/vFp98efpCHh/7pXwE4+3xy4bt/ofb/gQamRVYbjZu+Ongj20kdU245RJVCOhMrWhByefYZk9BEvXGJYJXlOi2safZWyK5jp1YrUHQVKlbdefFC+5fWYYlasLSR8S4U6KCI811EcYFFG8C7XB8BPMhgs6Ypoo7dv/fNYH7xO1lHzQAb2INxbMgH3SCouwGg4FxX75r8m4RIl8sGT4AexDMkXaHGfXRuTGfwCgo5uytwiuFLVTkHHVvojW75kLVuOvjQ5x7b0fRwQ4VIuoHBe1NsRm5a9y9J8R4y5XbQ4kexQS08PzzSXhLen09R1rXi9cTxJxOuGHd6Ncng+cCFHco8SBrX/UFLx5IJo/ybSPn5b2/a5EvHyMiydkhagRBsTad35t9e0gbvVEHapb0jeK+hIlwY+5ev1gvI/NlZL6MzJeR+TIyX0bm1/UsI/NlZL6MzJeR+b88Mv8nAAD///5cnQ8=" + return "eJzsWcFu4zYQvecrBttLCyT6AB8KFFsskEOLouihNy8tjuTBUhx1SCX13xeUZFmRKFuSkzQLWKdEMue9eTNDDskH+IaHDdic7L93AJ68wQ18+j38/+kOQKNLhUpPbDfw8x0AwG+sK4OQsUCpxJHNwe8R6iFgOIeMDLrkDsDtWfw2ZZtRvgEvFd4BZIRGu01t6gGsKvAEHx5/KHEDuXBVtm8iHMLzpTYEmXAxRSA8fbw+pkpTdK57HQM+Ax6ez2y9IutaiFqRE5HGfuDTUYnR6VMSLNjjlsqtIedf/ORIT4mow+DLGYrh+cU2o4CzFgEe/wCltaBz6BJ49EAOFARQ2GGqKodA9cuUi4IteAayqak03sMOHWl0taepIbRDotAzf/8CqonVHpVGcWDoG8LXvx++sDwr0ajDX1+TkbU/URlwXElaEycHgs6zoA68vjZfEip7Q6Pq7lgftg6tT3YHjy4uryE1/FIqv9/A3vsyEXQlW4dJsBU1U1AuqolEm+9jIpVD2YY/F1II45LIuDmYBfo963U+/1Oh80nUwix3xSx1VEzCQjlZNRw6BzDQ3j6hOGK7xuP40DnIx/zYpqyXRvdlgjmvfOVidubxyFAE5Zp4T9iYA6/y8awwJ7m39cCloZ+usWkew1keJmbmvkmNT5QOo3Hetah7jZ1YIZ/zcshmYvhCLleS4BjIQgrskqwyJjYhLqMyZWE5n2upxPN3DZdpS4uqIUemYbqvL4SUrSeL1l+jeLts58jJRXtzhU+5sl4OW3IcmzlXUbtocS45w2n9s+tJnbE0l4xgTmxfKX7njc0OHvnDayXUGVMLFXq9VLpscIrakRKKsLzdhqU2v2i/krK1mPrarXhvadjmy3YrnzubQBqtp4xQLnT2Bp9waY9pOE9i4+b0N+WEt9NopXDYDSbjkXPw/Go8vxdUOlmFWqBzKl/axsZHXUptsnnYIm7DUiBsDL5Jnj82KG2+n7Bue/WPslf/4ZgJD73ouBJTyiht4xHv90vnBVWxbR2Yjso3PDyzDAtiQVyCmEe4haHZKw8On1CUOZlwKGHHOcJ8RsE6SVXqUYOuhGwO7fbsWOFk8+SsIKctpUGb+/0bCtN5dISEBvI70MZTge+qjK6a+fA70KZ3FPGuEjW4EHA/nEovTkqaLJ/b/2QshfIbiJ0eXtDrrz12DBtQ+LGZ6/vcDVm8b2fue1BWd192rA8/XfYnFEPUG83Vzgw/Hf05ZvRCl6hAQKNKhxoc2RTr+TUjCXyDRE2kQhtzOuqPrGWj/J08YF2VqkH6YHG4AFwoImU8ilWennD6xPdVCPWQ5pIbrAzvlMBt4ra0u2rnXWjZsBfkQQkn8Jh15d1W9bwqvh/xCOZdVRRKuhW9qIyn0uBo8QozTNPCLFlM3q1+9ggBLzRJ1gNbEEyRno63cp03Y1mVA4cpW+3gmfweCjKGmjdhGJsqgI57vNVhmCd78GaF6NMH5mt3okHa3hr0lhk7wh5Jx9YcGv3OMOqIGOVCLuBJRqCwQFK7Jbog6sRZ4ej1DAFPW4pR6/z6Zd2JdKX/JUu8y1mXRMHcx/f+RQswceCweqUSZTUX5gA5WhQV3Hr89ZS/Nej5M57b7e3t9vZ2e3u7vb3d3t5ub8/zud3e3m5vb7e3t9vb//n29r8AAAD//ydZrLw=" } diff --git a/filebeat/module/nginx/ingress_controller/_meta/fields.yml b/filebeat/module/nginx/ingress_controller/_meta/fields.yml index 2c467e3856a..30bc1f5ad9e 100644 --- a/filebeat/module/nginx/ingress_controller/_meta/fields.yml +++ b/filebeat/module/nginx/ingress_controller/_meta/fields.yml @@ -11,6 +11,26 @@ Real source IP is restored to `source.ip`. # ingress-controller specific fields + - name: upstream_address_list + type: keyword + description: > + An array of the upstream addresses. It is a list because it is common that several upstream servers + were contacted during request processing. + - name: upstream.response.length_list + type: keyword + description: > + An array of upstream response lengths. It is a list because it is common that several upstream servers + were contacted during request processing. + - name: upstream.response.time_list + type: keyword + description: > + An array of upstream response durations. It is a list because it is common that several upstream servers + were contacted during request processing. + - name: upstream.response.status_code_list + type: keyword + description: > + An array of upstream response status codes. It is a list because it is common that several upstream servers + were contacted during request processing. - name: http.request.length type: long format: bytes @@ -33,28 +53,33 @@ type: long format: bytes description: > - The length of the response obtained from the upstream server + The length of the response obtained from the upstream server. If several servers were contacted during request process, + the summary of the multiple response lengths is stored. - name: upstream.response.time type: double format: duration description: > - The time spent on receiving the response from the upstream server as seconds with millisecond resolution + The time spent on receiving the response from the upstream as seconds with millisecond resolution. + If several servers were contacted during request process, the summary of the multiple response times is stored. - name: upstream.response.status_code type: long description: > - The status code of the response obtained from the upstream server - - name: http.request.id - type: keyword - description: > - The randomly generated ID of the request + The status code of the response obtained from the upstream server. If several servers were contacted during + request process, only the status code of the response from the last one is stored in this field. - name: upstream.ip type: ip description: > - The IP address of the upstream server. If several servers were contacted during request processing, their addresses are separated by commas. + The IP address of the upstream server. If several servers were contacted during request process, + only the last one is stored in this field. - name: upstream.port type: long description: > - The port of the upstream server. + The port of the upstream server. If several servers were contacted during request process, + only the last one is stored in this field. + - name: http.request.id + type: keyword + description: > + The randomly generated ID of the request - name: body_sent.bytes type: alias diff --git a/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml b/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml index c9f4a5860c7..0eca28c6084 100644 --- a/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml +++ b/filebeat/module/nginx/ingress_controller/ingest/pipeline.yml @@ -12,14 +12,17 @@ processors: %{NUMBER:http.response.status_code:long} %{NUMBER:http.response.body.bytes:long} "(-|%{DATA:http.request.referrer})" "(-|%{DATA:user_agent.original})" %{NUMBER:nginx.ingress_controller.http.request.length:long} %{NUMBER:nginx.ingress_controller.http.request.time:double} \[%{DATA:nginx.ingress_controller.upstream.name}\] - \[%{DATA:nginx.ingress_controller.upstream.alternative_name}\] (%{UPSTREAM_ADDRESS}|-) - (%{NUMBER:nginx.ingress_controller.upstream.response.length:long}|-) (%{NUMBER:nginx.ingress_controller.upstream.response.time:double}|-) - (%{NUMBER:nginx.ingress_controller.upstream.response.status_code:long}|-) %{GREEDYDATA:nginx.ingress_controller.http.request.id} + \[%{DATA:nginx.ingress_controller.upstream.alternative_name}\] (%{UPSTREAM_ADDRESS_LIST:nginx.ingress_controller.upstream_address_list}|-) + (%{UPSTREAM_RESPONSE_LENGTH_LIST:nginx.ingress_controller.upstream.response.length_list}|-) (%{UPSTREAM_RESPONSE_TIME_LIST:nginx.ingress_controller.upstream.response.time_list}|-) + (%{UPSTREAM_RESPONSE_STATUS_CODE_LIST:nginx.ingress_controller.upstream.response.status_code_list}|-) %{GREEDYDATA:nginx.ingress_controller.http.request.id} pattern_definitions: NGINX_HOST: (?:%{IP:destination.ip}|%{NGINX_NOTSEPARATOR:destination.domain})(:%{NUMBER:destination.port})? NGINX_NOTSEPARATOR: "[^\t ,:]+" NGINX_ADDRESS_LIST: (?:%{IP}|%{WORD})("?,?\s*(?:%{IP}|%{WORD}))* - UPSTREAM_ADDRESS: '%{IP:nginx.ingress_controller.upstream.ip}(:%{NUMBER:nginx.ingress_controller.upstream.port})?' + UPSTREAM_ADDRESS_LIST: (?:%{IP}(:%{NUMBER})?)("?,?\s*(?:%{IP}(:%{NUMBER})?))* + UPSTREAM_RESPONSE_LENGTH_LIST: (?:%{NUMBER})("?,?\s*(?:%{NUMBER}))* + UPSTREAM_RESPONSE_TIME_LIST: (?:%{NUMBER})("?,?\s*(?:%{NUMBER}))* + UPSTREAM_RESPONSE_STATUS_CODE_LIST: (?:%{NUMBER})("?,?\s*(?:%{NUMBER}))* ignore_missing: true - grok: field: nginx.ingress_controller.info @@ -33,6 +36,22 @@ processors: field: nginx.ingress_controller.remote_ip_list separator: '"?,?\s+' ignore_missing: true +- split: + field: nginx.ingress_controller.upstream_address_list + separator: '"?,?\s+' + ignore_missing: true +- split: + field: nginx.ingress_controller.upstream.response.length_list + separator: '"?,?\s+' + ignore_missing: true +- split: + field: nginx.ingress_controller.upstream.response.time_list + separator: '"?,?\s+' + ignore_missing: true +- split: + field: nginx.ingress_controller.upstream.response.status_code_list + separator: '"?,?\s+' + ignore_missing: true - split: field: nginx.ingress_controller.origin separator: '"?,?\s+' @@ -41,6 +60,81 @@ processors: field: source.address if: ctx.source?.address == null value: "" +- script: + if: ctx.nginx?.ingress_controller?.upstream?.response?.length_list != null && ctx.nginx.ingress_controller.upstream.response.length_list.length > 0 + lang: painless + source: >- + try { + if (ctx.nginx.ingress_controller.upstream.response.length_list.length == null) { + return; + } + int last_length = 0; + for (def item : ctx.nginx.ingress_controller.upstream.response.length_list) { + last_length = Integer.parseInt(item); + } + ctx.nginx.ingress_controller.upstream.response.length = last_length; + } + catch (Exception e) { + ctx.nginx.ingress_controller.upstream.response.length = null; + } +- script: + if: ctx.nginx?.ingress_controller?.upstream?.response?.time_list != null && ctx.nginx.ingress_controller.upstream.response.time_list.length > 0 + lang: painless + source: >- + try { + if (ctx.nginx.ingress_controller.upstream.response.time_list.length == null) { + return; + } + float res_time = 0; + for (def item : ctx.nginx.ingress_controller.upstream.response.time_list) { + res_time = res_time + Float.parseFloat(item); + } + ctx.nginx.ingress_controller.upstream.response.time = res_time; + } + catch (Exception e) { + ctx.nginx.ingress_controller.upstream.response.time = null; + } +- script: + if: ctx.nginx?.ingress_controller?.upstream?.response?.status_code_list != null && ctx.nginx.ingress_controller.upstream.response.status_code_list.length > 0 + lang: painless + source: >- + try { + if (ctx.nginx.ingress_controller.upstream.response.status_code_list.length == null) { + return; + } + int last_status_code; + for (def item : ctx.nginx.ingress_controller.upstream.response.status_code_list) { + last_status_code = Integer.parseInt(item); + } + ctx.nginx.ingress_controller.upstream.response.status_code = last_status_code; + } + catch (Exception e) { + ctx.nginx.ingress_controller.upstream.response.time = null; + } +- script: + if: ctx.nginx?.ingress_controller?.upstream_address_list != null && ctx.nginx.ingress_controller.upstream_address_list.length > 0 + lang: painless + source: >- + try { + if (ctx.nginx.ingress_controller.upstream_address_list.length == null) { + return; + } + def last_upstream = ""; + for (def item : ctx.nginx.ingress_controller.upstream_address_list) { + last_upstream = item; + } + StringTokenizer tok = new StringTokenizer(last_upstream, ":"); + if (tok.countTokens()>1) { + ctx.nginx.ingress_controller.upstream.ip = tok.nextToken(); + ctx.nginx.ingress_controller.upstream.port = Integer.parseInt(tok.nextToken()); + } else { + ctx.nginx.ingress_controller.upstream.ip = last_upstream; + } + } + catch (Exception e) { + ctx.nginx.ingress_controller.upstream.ip = null; + ctx.nginx.ingress_controller.upstream.port = null; + } - script: if: ctx.nginx?.ingress_controller?.remote_ip_list != null && ctx.nginx.ingress_controller.remote_ip_list.length > 0 lang: painless diff --git a/filebeat/module/nginx/ingress_controller/test/test.log b/filebeat/module/nginx/ingress_controller/test/test.log index 862c03a4af2..c8ba580f64d 100644 --- a/filebeat/module/nginx/ingress_controller/test/test.log +++ b/filebeat/module/nginx/ingress_controller/test/test.log @@ -20,3 +20,4 @@ 192.168.64.1 - - [07/Feb/2020:12:02:38 +0000] "GET /v2 HTTP/1.1" 200 61 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0" 343 0.000 [default-web2-8080] [] 172.17.0.6:8080 61 0.001 200 ba91c30454893c121879396b0a78be79 192.168.64.1 - - [07/Feb/2020:12:02:38 +0000] "GET /favicon.ico HTTP/1.1" 200 59 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0" 262 0.001 [default-web-8080] [] 172.17.0.5:8080 59 0.000 200 98c81aa2d50c67f6fb1fa16d5ce62f8f 192.168.64.1 - - [07/Feb/2020:12:02:42 +0000] "GET /v2/some HTTP/1.1" 200 61 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0" 348 0.001 [default-web2-8080] [] 172.17.0.6:8080 61 0.000 200 835136ae24486dbb4156dcbe21f5d402 +192.168.64.14 - - [07/Feb/2020:12:02:42 +0000] "GET /v2/some HTTP/1.1" 200 61 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0" 348 0.001 [default-web2-8080] [] 172.17.0.6:8080, 172.17.0.7:8080 61, 100 0.100, 0.004 200, 203 835136ae24486dbb4156dcbe21f5d402 diff --git a/filebeat/module/nginx/ingress_controller/test/test.log-expected.json b/filebeat/module/nginx/ingress_controller/test/test.log-expected.json index 4bf393a5906..e8b09bc1abd 100644 --- a/filebeat/module/nginx/ingress_controller/test/test.log-expected.json +++ b/filebeat/module/nginx/ingress_controller/test/test.log-expected.json @@ -28,10 +28,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -73,10 +85,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -118,10 +142,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -163,10 +199,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -280,10 +328,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -325,10 +385,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -374,10 +446,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -422,10 +506,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.6", "nginx.ingress_controller.upstream.name": "default-web2-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 61, + "nginx.ingress_controller.upstream.response.length_list": [ + "61" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.6:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -471,10 +567,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.002, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.002" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -519,10 +627,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -568,10 +688,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -616,10 +748,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.002, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.002" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -664,10 +808,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -713,10 +869,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.002, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.002" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -761,10 +929,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.6", "nginx.ingress_controller.upstream.name": "default-web2-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 61, + "nginx.ingress_controller.upstream.response.length_list": [ + "61" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.002, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.002" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.6:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -810,10 +990,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -858,10 +1050,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -903,10 +1107,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.6", "nginx.ingress_controller.upstream.name": "default-web2-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 61, + "nginx.ingress_controller.upstream.response.length_list": [ + "61" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.001, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.001" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.6:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -951,10 +1167,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.5", "nginx.ingress_controller.upstream.name": "default-web-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 59, + "nginx.ingress_controller.upstream.response.length_list": [ + "59" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.5:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -999,10 +1227,22 @@ "nginx.ingress_controller.upstream.alternative_name": "", "nginx.ingress_controller.upstream.ip": "172.17.0.6", "nginx.ingress_controller.upstream.name": "default-web2-8080", - "nginx.ingress_controller.upstream.port": "8080", + "nginx.ingress_controller.upstream.port": 8080, "nginx.ingress_controller.upstream.response.length": 61, + "nginx.ingress_controller.upstream.response.length_list": [ + "61" + ], "nginx.ingress_controller.upstream.response.status_code": 200, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200" + ], "nginx.ingress_controller.upstream.response.time": 0.0, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.000" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.6:8080" + ], "related.ip": [ "192.168.64.1" ], @@ -1017,5 +1257,69 @@ "user_agent.os.name": "Mac OS X", "user_agent.os.version": "10.14", "user_agent.version": "72.0." + }, + { + "@timestamp": "2020-02-07T12:02:42.000Z", + "event.category": [ + "web" + ], + "event.dataset": "nginx.ingress_controller", + "event.kind": "event", + "event.module": "nginx", + "event.outcome": "success", + "event.timezone": "-02:00", + "event.type": [ + "info" + ], + "fileset.name": "ingress_controller", + "http.request.method": "GET", + "http.response.body.bytes": 61, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 5730, + "nginx.ingress_controller.http.request.id": "835136ae24486dbb4156dcbe21f5d402", + "nginx.ingress_controller.http.request.length": 348, + "nginx.ingress_controller.http.request.time": 0.001, + "nginx.ingress_controller.remote_ip_list": [ + "192.168.64.14" + ], + "nginx.ingress_controller.upstream.alternative_name": "", + "nginx.ingress_controller.upstream.ip": "172.17.0.7", + "nginx.ingress_controller.upstream.name": "default-web2-8080", + "nginx.ingress_controller.upstream.port": 8080, + "nginx.ingress_controller.upstream.response.length": 100, + "nginx.ingress_controller.upstream.response.length_list": [ + "61", + "100" + ], + "nginx.ingress_controller.upstream.response.status_code": 203, + "nginx.ingress_controller.upstream.response.status_code_list": [ + "200", + "203" + ], + "nginx.ingress_controller.upstream.response.time": 0.104, + "nginx.ingress_controller.upstream.response.time_list": [ + "0.100", + "0.004" + ], + "nginx.ingress_controller.upstream_address_list": [ + "172.17.0.6:8080", + "172.17.0.7:8080" + ], + "related.ip": [ + "192.168.64.14" + ], + "service.type": "nginx", + "source.address": "192.168.64.14", + "source.ip": "192.168.64.14", + "url.original": "/v2/some", + "user_agent.device.name": "Mac", + "user_agent.name": "Firefox", + "user_agent.original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0", + "user_agent.os.full": "Mac OS X 10.14", + "user_agent.os.name": "Mac OS X", + "user_agent.os.version": "10.14", + "user_agent.version": "72.0." } -] \ No newline at end of file +] From 27e8bd36a229fc4a71ee5ef6106912ba1a837b14 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Tue, 29 Sep 2020 11:26:32 +0200 Subject: [PATCH 073/216] Fix panic in cgroups monitoring (#21355) Gosigar's cgroups GetStatsForProcesses can return a nil Stats pointer and no error when the ["blkio", "cpu", "cpuacct", "memory"] subsystems are on the root cgroup. Related #21113 --- libbeat/cmd/instance/metrics.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libbeat/cmd/instance/metrics.go b/libbeat/cmd/instance/metrics.go index fa0d42bbeaf..24d3d12e3e1 100644 --- a/libbeat/cmd/instance/metrics.go +++ b/libbeat/cmd/instance/metrics.go @@ -285,6 +285,10 @@ func reportBeatCgroups(_ monitoring.Mode, V monitoring.Visitor) { logp.Err("error getting group status: %v", err) return } + // GetStatsForProcess returns a nil selfStats and no error when there's no stats + if selfStats == nil { + return + } if cpu := selfStats.CPU; cpu != nil { monitoring.ReportNamespace(V, "cpu", func() { From 8716d98860a03cc77456c7766b8a34f8e3482021 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Tue, 29 Sep 2020 11:29:28 +0200 Subject: [PATCH 074/216] o365input: Restart after fatal error (#21258) Update the o365input to restart the input after a fatal error is encountered, for example an authentication token refresh error or a parsing error. This enables the input to be more resilient against transient errors. Before this patch, the input would index an error document and terminate. Now it will index an error and restart after a fixed timeout of 5 minutes. --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/o365audit/input.go | 44 +++++++++++++++++------- 2 files changed, 33 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 67d355a2733..58ca2acb35c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -175,6 +175,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - [Autodiscover] Handle input-not-finished errors in config reload. {pull}20915[20915] - Explicitly detect missing variables in autodiscover configuration, log them at the debug level. {issue}20568[20568] {pull}20898[20898] - Fix `libbeat.output.write.bytes` and `libbeat.output.read.bytes` metrics of the Elasticsearch output. {issue}20752[20752] {pull}21197[21197] +- The `o365input` and `o365` module now recover from an authentication problem or other fatal errors, instead of terminating. {pull}21259[21258] *Auditbeat* diff --git a/x-pack/filebeat/input/o365audit/input.go b/x-pack/filebeat/input/o365audit/input.go index ceff10751de..67013dc6a71 100644 --- a/x-pack/filebeat/input/o365audit/input.go +++ b/x-pack/filebeat/input/o365audit/input.go @@ -26,6 +26,9 @@ import ( const ( pluginName = "o365audit" fieldsPrefix = pluginName + + // How long to retry when a fatal error is encountered in the input. + failureRetryInterval = time.Minute * 5 ) type o365input struct { @@ -107,6 +110,34 @@ func (inp *o365input) Run( src cursor.Source, cursor cursor.Cursor, publisher cursor.Publisher, +) error { + for ctx.Cancelation.Err() == nil { + err := inp.runOnce(ctx, src, cursor, publisher) + if err == nil { + break + } + if ctx.Cancelation.Err() != err && err != context.Canceled { + msg := common.MapStr{} + msg.Put("error.message", err.Error()) + msg.Put("event.kind", "pipeline_error") + event := beat.Event{ + Timestamp: time.Now(), + Fields: msg, + } + publisher.Publish(event, nil) + ctx.Logger.Errorf("Input failed: %v", err) + ctx.Logger.Infof("Restarting in %v", failureRetryInterval) + time.Sleep(failureRetryInterval) + } + } + return nil +} + +func (inp *o365input) runOnce( + ctx v2.Context, + src cursor.Source, + cursor cursor.Cursor, + publisher cursor.Publisher, ) error { stream := src.(*stream) tenantID, contentType := stream.tenantID, stream.contentType @@ -156,18 +187,7 @@ func (inp *o365input) Run( } log.Infow("Start fetching events", "cursor", start) - err = poller.Run(action) - if err != nil && ctx.Cancelation.Err() != err && err != context.Canceled { - msg := common.MapStr{} - msg.Put("error.message", err.Error()) - msg.Put("event.kind", "pipeline_error") - event := beat.Event{ - Timestamp: time.Now(), - Fields: msg, - } - publisher.Publish(event, nil) - } - return err + return poller.Run(action) } func initCheckpoint(log *logp.Logger, c cursor.Cursor, maxRetention time.Duration) checkpoint { From 24e972f0da3e7434ebaaf35c24b2e552004da370 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Tue, 29 Sep 2020 11:30:45 +0200 Subject: [PATCH 075/216] Fixes for new 7.10 rsa2elk datasets (#21240) * Fix bad unicode character used in juniper/netscreen Some parsers from netwitness wrongly use ’ XML entity as a quote character. This entity translates to UNICODE codepoint U+0092 (PRIVATE USE 2), which is not printable and can cause problems. My understanding is that this is the result of either: - Device logs are encoded in the windows-1252 codepage, or - Log parsers originally written in windows-1252 codepage. In this codepage, \x92 represents a quotation mark similar to the ASCII \x27 single quotation mark ('). I believe someone misunderstood XML's &#xNNN entity as escaping a byte value, instead of a UNICODE codepoint. As it is unclear if the original logs contain this special quote, or it's the result of writting the parsers in a Windows editor, it's better to replace it's usage with empty captures that skip over this quote. * Update pipelines for new 7.10 rsa2elk datasets The original pipelines had been generated with some debugging comments in them, which made them much larger than necessary. --- .../barracuda/spamfirewall/config/pipeline.js | 159 +- .../module/cisco/meraki/config/pipeline.js | 204 +- .../citrix/netscaler/config/pipeline.js | 1140 +- .../cyberark/corepas/config/pipeline.js | 864 +- .../module/f5/bigipafm/config/pipeline.js | 3 +- .../fortinet/fortimail/config/pipeline.js | 630 +- .../fortinet/fortimanager/config/pipeline.js | 66 +- .../juniper/netscreen/config/pipeline.js | 13437 +++++++--------- .../emailsecurity/config/pipeline.js | 831 +- .../module/snort/log/config/pipeline.js | 852 +- .../module/sophos/utm/config/pipeline.js | 567 +- .../endpointprotection/config/pipeline.js | 3225 ++-- 12 files changed, 8297 insertions(+), 13681 deletions(-) diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/config/pipeline.js b/x-pack/filebeat/module/barracuda/spamfirewall/config/pipeline.js index 37a1fa68d5e..3c8db034ee1 100644 --- a/x-pack/filebeat/module/barracuda/spamfirewall/config/pipeline.js +++ b/x-pack/filebeat/module/barracuda/spamfirewall/config/pipeline.js @@ -152,11 +152,9 @@ var map_getEventLegacyCategory = { "default": constant("1901000000"), }; -var dup1 = // "Pattern{Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(info,false)}" -match("MESSAGE#0:000001/1_0", "nwparser.p0", "%{fld3->} %{resultcode->} %{info}"); +var dup1 = match("MESSAGE#0:000001/1_0", "nwparser.p0", "%{fld3->} %{resultcode->} %{info}"); -var dup2 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); +var dup2 = match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); var dup3 = setc("eventcategory","1207010201"); @@ -194,8 +192,7 @@ var dup13 = setc("eventcategory","1207010000"); var dup14 = setc("direction","outbound"); -var dup15 = // "Pattern{Constant('SZ:'), Field(fld9,true), Constant(' SUBJ:'), Field(subject,false)}" -match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); +var dup15 = match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); var dup16 = setc("eventcategory","1207040000"); @@ -259,8 +256,7 @@ var dup33 = linear_select([ dup2, ]); -var hdr1 = // "Pattern{Field(messageid,false), Constant('['), Field(hfld14,false), Constant(']: '), Field(p0,false)}" -match("HEADER#0:0001", "message", "%{messageid}[%{hfld14}]: %{p0}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{messageid}[%{hfld14}]: %{p0}", processor_chain([ setc("header_id","0001"), call({ dest: "nwparser.payload", @@ -275,8 +271,7 @@ match("HEADER#0:0001", "message", "%{messageid}[%{hfld14}]: %{p0}", processor_ch }), ])); -var hdr2 = // "Pattern{Field(hfld1,false), Constant('/'), Field(messageid,false), Constant('['), Field(hfld14,false), Constant(']: '), Field(p0,false)}" -match("HEADER#1:0002", "message", "%{hfld1}/%{messageid}[%{hfld14}]: %{p0}", processor_chain([ +var hdr2 = match("HEADER#1:0002", "message", "%{hfld1}/%{messageid}[%{hfld14}]: %{p0}", processor_chain([ setc("header_id","0002"), call({ dest: "nwparser.payload", @@ -293,8 +288,7 @@ match("HEADER#1:0002", "message", "%{hfld1}/%{messageid}[%{hfld14}]: %{p0}", pro }), ])); -var hdr3 = // "Pattern{Field(messageid,false), Constant(': '), Field(p0,false)}" -match("HEADER#2:0003", "message", "%{messageid}: %{p0}", processor_chain([ +var hdr3 = match("HEADER#2:0003", "message", "%{messageid}: %{p0}", processor_chain([ setc("header_id","0003"), call({ dest: "nwparser.payload", @@ -313,8 +307,7 @@ var select1 = linear_select([ hdr3, ]); -var part1 = // "Pattern{Constant('inbound/pass1['), Field(fld14,false), Constant(']: '), Field(username,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' RECV '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:000001/0", "nwparser.payload", "inbound/pass1[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); +var part1 = match("MESSAGE#0:000001/0", "nwparser.payload", "inbound/pass1[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); var all1 = all_match({ processors: [ @@ -337,14 +330,11 @@ var all1 = all_match({ var msg1 = msg("000001", all1); -var part2 = // "Pattern{Constant('inbound/pass1: '), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' SCAN '), Field(fld4,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1:inbound/pass1/0", "nwparser.payload", "inbound/pass1: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} SCAN %{fld4->} %{from->} %{to->} %{fld5->} %{fld3->} %{resultcode->} %{p0}"); +var part2 = match("MESSAGE#1:inbound/pass1/0", "nwparser.payload", "inbound/pass1: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} SCAN %{fld4->} %{from->} %{to->} %{fld5->} %{fld3->} %{resultcode->} %{p0}"); -var part3 = // "Pattern{Field(fld6,true), Constant(' SZ:'), Field(fld8,true), Constant(' SUBJ:'), Field(subject,false)}" -match("MESSAGE#1:inbound/pass1/1_0", "nwparser.p0", "%{fld6->} SZ:%{fld8->} SUBJ:%{subject}"); +var part3 = match("MESSAGE#1:inbound/pass1/1_0", "nwparser.p0", "%{fld6->} SZ:%{fld8->} SUBJ:%{subject}"); -var part4 = // "Pattern{Field(domain,true), Constant(' '), Field(info,false)}" -match("MESSAGE#1:inbound/pass1/1_1", "nwparser.p0", "%{domain->} %{info}"); +var part4 = match("MESSAGE#1:inbound/pass1/1_1", "nwparser.p0", "%{domain->} %{info}"); var select2 = linear_select([ part3, @@ -372,8 +362,7 @@ var all2 = all_match({ var msg2 = msg("inbound/pass1", all2); -var part5 = // "Pattern{Constant('inbound/pass1:'), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' RECV '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#2:inbound/pass1:01/0", "nwparser.payload", "inbound/pass1:%{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); +var part5 = match("MESSAGE#2:inbound/pass1:01/0", "nwparser.payload", "inbound/pass1:%{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} RECV %{from->} %{to->} %{p0}"); var all3 = all_match({ processors: [ @@ -402,11 +391,9 @@ var select3 = linear_select([ msg3, ]); -var part6 = // "Pattern{Constant('outbound/smtp['), Field(fld14,false), Constant(']: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#3:000002/0", "nwparser.payload", "outbound/smtp[%{fld14}]: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{p0}"); +var part6 = match("MESSAGE#3:000002/0", "nwparser.payload", "outbound/smtp[%{fld14}]: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{p0}"); -var part7 = // "Pattern{Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(info,false)}" -match("MESSAGE#3:000002/1_0", "nwparser.p0", "%{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{info}"); +var part7 = match("MESSAGE#3:000002/1_0", "nwparser.p0", "%{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{info}"); var select4 = linear_select([ part7, @@ -430,37 +417,28 @@ var all4 = all_match({ var msg4 = msg("000002", all4); -var part8 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#4:outbound/smtp/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{fld5->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); +var part8 = match("MESSAGE#4:outbound/smtp/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{fld5->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); -var part9 = // "Pattern{Field(fld8,true), Constant(' <<'), Field(from,false), Constant('> '), Field(p0,false)}" -match("MESSAGE#4:outbound/smtp/1_0", "nwparser.p0", "%{fld8->} \u003c\u003c%{from}> %{p0}"); +var part9 = match("MESSAGE#4:outbound/smtp/1_0", "nwparser.p0", "%{fld8->} \u003c\u003c%{from}> %{p0}"); -var part10 = // "Pattern{Constant('<<'), Field(from,false), Constant('>'), Field(p0,false)}" -match("MESSAGE#4:outbound/smtp/1_1", "nwparser.p0", "\u003c\u003c%{from}>%{p0}"); +var part10 = match("MESSAGE#4:outbound/smtp/1_1", "nwparser.p0", "\u003c\u003c%{from}>%{p0}"); var select5 = linear_select([ part9, part10, ]); -var part11 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#4:outbound/smtp/2", "nwparser.p0", "%{} %{p0}"); +var part11 = match("MESSAGE#4:outbound/smtp/2", "nwparser.p0", "%{} %{p0}"); -var part12 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant(', Hostname='), Field(hostname,false), Constant('] '), Field(event_description,true), Constant(' #to#'), Field(ddomain,false)}" -match("MESSAGE#4:outbound/smtp/3_0", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{event_description->} #to#%{ddomain}"); +var part12 = match("MESSAGE#4:outbound/smtp/3_0", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{event_description->} #to#%{ddomain}"); -var part13 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant('] '), Field(event_description,true), Constant(' #to#'), Field(daddr,false)}" -match("MESSAGE#4:outbound/smtp/3_1", "nwparser.p0", "[InternalId=%{id}] %{event_description->} #to#%{daddr}"); +var part13 = match("MESSAGE#4:outbound/smtp/3_1", "nwparser.p0", "[InternalId=%{id}] %{event_description->} #to#%{daddr}"); -var part14 = // "Pattern{Constant('[InternalId='), Field(id,false), Constant(', Hostname='), Field(hostname,false), Constant('] '), Field(info,false)}" -match("MESSAGE#4:outbound/smtp/3_2", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{info}"); +var part14 = match("MESSAGE#4:outbound/smtp/3_2", "nwparser.p0", "[InternalId=%{id}, Hostname=%{hostname}] %{info}"); -var part15 = // "Pattern{Field(event_description,true), Constant(' #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" -match("MESSAGE#4:outbound/smtp/3_3", "nwparser.p0", "%{event_description->} #to#%{ddomain}[%{daddr}]:%{dport}"); +var part15 = match("MESSAGE#4:outbound/smtp/3_3", "nwparser.p0", "%{event_description->} #to#%{ddomain}[%{daddr}]:%{dport}"); -var part16 = // "Pattern{Field(event_description,true), Constant(' #to#'), Field(ddomain,false)}" -match("MESSAGE#4:outbound/smtp/3_4", "nwparser.p0", "%{event_description->} #to#%{ddomain}"); +var part16 = match("MESSAGE#4:outbound/smtp/3_4", "nwparser.p0", "%{event_description->} #to#%{ddomain}"); var select6 = linear_select([ part12, @@ -489,22 +467,18 @@ var all5 = all_match({ var msg5 = msg("outbound/smtp", all5); -var part17 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#5:000009/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); +var part17 = match("MESSAGE#5:000009/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{p0}"); -var part18 = // "Pattern{Field(fld8,true), Constant(' ok'), Field(p0,false)}" -match("MESSAGE#5:000009/1_0", "nwparser.p0", "%{fld8->} ok%{p0}"); +var part18 = match("MESSAGE#5:000009/1_0", "nwparser.p0", "%{fld8->} ok%{p0}"); -var part19 = // "Pattern{Constant('ok'), Field(p0,false)}" -match("MESSAGE#5:000009/1_1", "nwparser.p0", "ok%{p0}"); +var part19 = match("MESSAGE#5:000009/1_1", "nwparser.p0", "ok%{p0}"); var select7 = linear_select([ part18, part19, ]); -var part20 = // "Pattern{Field(fld9,true), Constant(' Message '), Field(fld10,true), Constant(' accepted #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" -match("MESSAGE#5:000009/2", "nwparser.p0", "%{fld9->} Message %{fld10->} accepted #to#%{ddomain}[%{daddr}]:%{dport}"); +var part20 = match("MESSAGE#5:000009/2", "nwparser.p0", "%{fld9->} Message %{fld10->} accepted #to#%{ddomain}[%{daddr}]:%{dport}"); var all6 = all_match({ processors: [ @@ -524,8 +498,7 @@ var all6 = all_match({ var msg6 = msg("000009", all6); -var part21 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' Message accepted for delivery #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" -match("MESSAGE#6:outbound/smtp:01", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} Message accepted for delivery #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ +var part21 = match("MESSAGE#6:outbound/smtp:01", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} Message accepted for delivery #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ dup13, dup4, dup14, @@ -537,8 +510,7 @@ match("MESSAGE#6:outbound/smtp:01", "nwparser.payload", "outbound/smtp: %{saddr- var msg7 = msg("outbound/smtp:01", part21); -var part22 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' conversation with '), Field(fld5,false), Constant('['), Field(fld6,false), Constant('] timed out while sending '), Field(fld7,true), Constant(' #to#'), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']:'), Field(dport,false)}" -match("MESSAGE#7:outbound/smtp:02", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} conversation with %{fld5}[%{fld6}] timed out while sending %{fld7->} #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ +var part22 = match("MESSAGE#7:outbound/smtp:02", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} conversation with %{fld5}[%{fld6}] timed out while sending %{fld7->} #to#%{ddomain}[%{daddr}]:%{dport}", processor_chain([ dup13, dup4, dup14, @@ -549,26 +521,19 @@ match("MESSAGE#7:outbound/smtp:02", "nwparser.payload", "outbound/smtp: %{saddr- var msg8 = msg("outbound/smtp:02", part22); -var part23 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#8:000010/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} %{p0}"); +var part23 = match("MESSAGE#8:000010/0", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} %{p0}"); -var part24 = // "Pattern{Constant('Ok '), Field(fld9,true), Constant(' '), Field(fld10,true), Constant(' - gsmtp #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_0", "nwparser.p0", "Ok %{fld9->} %{fld10->} - gsmtp #to#%{p0}"); +var part24 = match("MESSAGE#8:000010/1_0", "nwparser.p0", "Ok %{fld9->} %{fld10->} - gsmtp #to#%{p0}"); -var part25 = // "Pattern{Constant('Ok: queued as '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_1", "nwparser.p0", "Ok: queued as %{fld9->} #to#%{p0}"); +var part25 = match("MESSAGE#8:000010/1_1", "nwparser.p0", "Ok: queued as %{fld9->} #to#%{p0}"); -var part26 = // "Pattern{Constant('ok '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_2", "nwparser.p0", "ok %{fld9->} #to#%{p0}"); +var part26 = match("MESSAGE#8:000010/1_2", "nwparser.p0", "ok %{fld9->} #to#%{p0}"); -var part27 = // "Pattern{Constant('Ok ('), Field(fld9,false), Constant(') #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_3", "nwparser.p0", "Ok (%{fld9}) #to#%{p0}"); +var part27 = match("MESSAGE#8:000010/1_3", "nwparser.p0", "Ok (%{fld9}) #to#%{p0}"); -var part28 = // "Pattern{Constant('OK '), Field(fld9,true), Constant(' #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_4", "nwparser.p0", "OK %{fld9->} #to#%{p0}"); +var part28 = match("MESSAGE#8:000010/1_4", "nwparser.p0", "OK %{fld9->} #to#%{p0}"); -var part29 = // "Pattern{Field(fld9,true), Constant(' #to#'), Field(p0,false)}" -match("MESSAGE#8:000010/1_5", "nwparser.p0", "%{fld9->} #to#%{p0}"); +var part29 = match("MESSAGE#8:000010/1_5", "nwparser.p0", "%{fld9->} #to#%{p0}"); var select8 = linear_select([ part24, @@ -579,8 +544,7 @@ var select8 = linear_select([ part29, ]); -var part30 = // "Pattern{Field(daddr,false)}" -match_copy("MESSAGE#8:000010/2", "nwparser.p0", "daddr"); +var part30 = match_copy("MESSAGE#8:000010/2", "nwparser.p0", "daddr"); var all7 = all_match({ processors: [ @@ -600,8 +564,7 @@ var all7 = all_match({ var msg9 = msg("000010", all7); -var part31 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' connect to '), Field(ddomain,false), Constant('['), Field(daddr,false), Constant(']: '), Field(event_description,false)}" -match("MESSAGE#9:000011", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} connect to %{ddomain}[%{daddr}]: %{event_description}", processor_chain([ +var part31 = match("MESSAGE#9:000011", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} connect to %{ddomain}[%{daddr}]: %{event_description}", processor_chain([ dup13, dup4, dup14, @@ -612,8 +575,7 @@ match("MESSAGE#9:000011", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} var msg10 = msg("000011", part31); -var part32 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(fld7,true), Constant(' ['), Field(ddomain,false), Constant(']: '), Field(event_description,false)}" -match("MESSAGE#10:000012", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} [%{ddomain}]: %{event_description}", processor_chain([ +var part32 = match("MESSAGE#10:000012", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{fld7->} [%{ddomain}]: %{event_description}", processor_chain([ dup13, dup4, dup14, @@ -624,8 +586,7 @@ match("MESSAGE#10:000012", "nwparser.payload", "outbound/smtp: %{saddr->} %{id-> var msg11 = msg("000012", part32); -var part33 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' <<'), Field(from,false), Constant('>: '), Field(event_description,false)}" -match("MESSAGE#11:000013", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld7->} \u003c\u003c%{from}>: %{event_description}", processor_chain([ +var part33 = match("MESSAGE#11:000013", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld7->} \u003c\u003c%{from}>: %{event_description}", processor_chain([ dup13, dup4, dup14, @@ -636,8 +597,7 @@ match("MESSAGE#11:000013", "nwparser.payload", "outbound/smtp: %{saddr->} %{id-> var msg12 = msg("000013", part33); -var part34 = // "Pattern{Constant('outbound/smtp: '), Field(saddr,true), Constant(' '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld8,true), Constant(' '), Field(event_description,false)}" -match("MESSAGE#12:000014", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld8->} %{event_description}", processor_chain([ +var part34 = match("MESSAGE#12:000014", "nwparser.payload", "outbound/smtp: %{saddr->} %{id->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{resultcode->} %{fld8->} %{event_description}", processor_chain([ dup13, dup4, dup14, @@ -661,8 +621,7 @@ var select9 = linear_select([ msg13, ]); -var part35 = // "Pattern{Constant('scan['), Field(fld14,false), Constant(']: '), Field(username,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld8,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#13:000003/0", "nwparser.payload", "scan[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); +var part35 = match("MESSAGE#13:000003/0", "nwparser.payload", "scan[%{fld14}]: %{username}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); var all8 = all_match({ processors: [ @@ -683,8 +642,7 @@ var all8 = all_match({ var msg14 = msg("000003", all8); -var part36 = // "Pattern{Constant('scan: '), Field(web_domain,false), Constant('['), Field(saddr,false), Constant('] '), Field(id,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld8,true), Constant(' '), Field(from,true), Constant(' '), Field(to,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(fld7,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#14:scan/0", "nwparser.payload", "scan: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); +var part36 = match("MESSAGE#14:scan/0", "nwparser.payload", "scan: %{web_domain}[%{saddr}] %{id->} %{fld1->} %{fld2->} %{action->} %{fld8->} %{from->} %{to->} %{fld4->} %{fld3->} %{resultcode->} %{fld7->} %{p0}"); var all9 = all_match({ processors: [ @@ -710,16 +668,14 @@ var select10 = linear_select([ msg15, ]); -var part37 = // "Pattern{Constant('web: Ret Policy Summary (Del:'), Field(fld1,true), Constant(' Kept:'), Field(fld2,false), Constant(')')}" -match("MESSAGE#15:000004", "nwparser.payload", "web: Ret Policy Summary (Del:%{fld1->} Kept:%{fld2})", processor_chain([ +var part37 = match("MESSAGE#15:000004", "nwparser.payload", "web: Ret Policy Summary (Del:%{fld1->} Kept:%{fld2})", processor_chain([ dup17, dup4, ])); var msg16 = msg("000004", part37); -var part38 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] FAILED_LOGIN ('), Field(username,false), Constant(')')}" -match("MESSAGE#16:000005", "nwparser.payload", "web: [%{saddr}] FAILED_LOGIN (%{username})", processor_chain([ +var part38 = match("MESSAGE#16:000005", "nwparser.payload", "web: [%{saddr}] FAILED_LOGIN (%{username})", processor_chain([ setc("eventcategory","1401030000"), dup18, dup19, @@ -731,16 +687,14 @@ match("MESSAGE#16:000005", "nwparser.payload", "web: [%{saddr}] FAILED_LOGIN (%{ var msg17 = msg("000005", part38); -var part39 = // "Pattern{Constant('web: Retention violating accounts: '), Field(fld1,true), Constant(' total')}" -match("MESSAGE#17:000006", "nwparser.payload", "web: Retention violating accounts: %{fld1->} total", processor_chain([ +var part39 = match("MESSAGE#17:000006", "nwparser.payload", "web: Retention violating accounts: %{fld1->} total", processor_chain([ setc("eventcategory","1605000000"), dup4, ])); var msg18 = msg("000006", part39); -var part40 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] global CHANGE '), Field(category,true), Constant(' ('), Field(info,false), Constant(')')}" -match("MESSAGE#18:000007", "nwparser.payload", "web: [%{saddr}] global CHANGE %{category->} (%{info})", processor_chain([ +var part40 = match("MESSAGE#18:000007", "nwparser.payload", "web: [%{saddr}] global CHANGE %{category->} (%{info})", processor_chain([ dup17, dup4, setc("action","CHANGE"), @@ -748,8 +702,7 @@ match("MESSAGE#18:000007", "nwparser.payload", "web: [%{saddr}] global CHANGE %{ var msg19 = msg("000007", part40); -var part41 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] LOGOUT ('), Field(username,false), Constant(')')}" -match("MESSAGE#19:000029", "nwparser.payload", "web: [%{saddr}] LOGOUT (%{username})", processor_chain([ +var part41 = match("MESSAGE#19:000029", "nwparser.payload", "web: [%{saddr}] LOGOUT (%{username})", processor_chain([ setc("eventcategory","1401070000"), dup18, setc("ec_activity","Logoff"), @@ -760,8 +713,7 @@ match("MESSAGE#19:000029", "nwparser.payload", "web: [%{saddr}] LOGOUT (%{userna var msg20 = msg("000029", part41); -var part42 = // "Pattern{Constant('web: ['), Field(saddr,false), Constant('] LOGIN ('), Field(username,false), Constant(')')}" -match("MESSAGE#20:000030", "nwparser.payload", "web: [%{saddr}] LOGIN (%{username})", processor_chain([ +var part42 = match("MESSAGE#20:000030", "nwparser.payload", "web: [%{saddr}] LOGIN (%{username})", processor_chain([ setc("eventcategory","1401060000"), dup18, dup19, @@ -781,8 +733,7 @@ var select11 = linear_select([ msg21, ]); -var part43 = // "Pattern{Constant('notify/smtp['), Field(fld14,false), Constant(']: '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(action,true), Constant(' '), Field(fld4,true), Constant(' '), Field(fld3,true), Constant(' '), Field(sessionid,true), Constant(' '), Field(bytes,true), Constant(' '), Field(version,true), Constant(' '), Field(from,true), Constant(' '), Field(info,false)}" -match("MESSAGE#21:000008", "nwparser.payload", "notify/smtp[%{fld14}]: %{saddr->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{bytes->} %{version->} %{from->} %{info}", processor_chain([ +var part43 = match("MESSAGE#21:000008", "nwparser.payload", "notify/smtp[%{fld14}]: %{saddr->} %{fld1->} %{fld2->} %{action->} %{fld4->} %{fld3->} %{sessionid->} %{bytes->} %{version->} %{from->} %{info}", processor_chain([ dup13, dup4, dup32, @@ -792,8 +743,7 @@ match("MESSAGE#21:000008", "nwparser.payload", "notify/smtp[%{fld14}]: %{saddr-> var msg22 = msg("000008", part43); -var part44 = // "Pattern{Constant('reports: REPORTS ('), Field(process,false), Constant(') queued as '), Field(fld1,false)}" -match("MESSAGE#22:reports", "nwparser.payload", "reports: REPORTS (%{process}) queued as %{fld1}", processor_chain([ +var part44 = match("MESSAGE#22:reports", "nwparser.payload", "reports: REPORTS (%{process}) queued as %{fld1}", processor_chain([ dup16, dup4, setc("event_description","report queued"), @@ -813,14 +763,11 @@ var chain1 = processor_chain([ }), ]); -var part45 = // "Pattern{Field(fld3,true), Constant(' '), Field(resultcode,true), Constant(' '), Field(info,false)}" -match("MESSAGE#0:000001/1_0", "nwparser.p0", "%{fld3->} %{resultcode->} %{info}"); +var part45 = match("MESSAGE#0:000001/1_0", "nwparser.p0", "%{fld3->} %{resultcode->} %{info}"); -var part46 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); +var part46 = match_copy("MESSAGE#0:000001/1_1", "nwparser.p0", "info"); -var part47 = // "Pattern{Constant('SZ:'), Field(fld9,true), Constant(' SUBJ:'), Field(subject,false)}" -match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); +var part47 = match("MESSAGE#13:000003/1_0", "nwparser.p0", "SZ:%{fld9->} SUBJ:%{subject}"); var select12 = linear_select([ dup1, diff --git a/x-pack/filebeat/module/cisco/meraki/config/pipeline.js b/x-pack/filebeat/module/cisco/meraki/config/pipeline.js index 45a7b628d63..53a05ad2527 100644 --- a/x-pack/filebeat/module/cisco/meraki/config/pipeline.js +++ b/x-pack/filebeat/module/cisco/meraki/config/pipeline.js @@ -29,8 +29,7 @@ var map_actionType = { }, }; -var dup1 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,false), Constant('.'), Field(hfld3,true), Constant(' '), Field(p0,false)}" -match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); +var dup1 = match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); var dup2 = call({ dest: "nwparser.payload", @@ -52,8 +51,7 @@ var dup3 = call({ ], }); -var dup4 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); +var dup4 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); var dup5 = setc("eventcategory","1605020000"); @@ -71,20 +69,15 @@ var dup9 = date_time({ ], }); -var dup10 = // "Pattern{}" -match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); +var dup10 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); -var dup11 = // "Pattern{Constant('dhost='), Field(dmacaddr,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); +var dup11 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); -var dup12 = // "Pattern{Constant('shost='), Field(smacaddr,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); +var dup12 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); -var dup13 = // "Pattern{Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); +var dup13 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); -var dup14 = // "Pattern{Field(signame,false)}" -match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); +var dup14 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); var dup15 = setc("eventcategory","1607000000"); @@ -102,13 +95,11 @@ var dup18 = setc("event_type","security_event"); var dup19 = constant("Allow"); -var dup20 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" -match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ +var dup20 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ dup2, ])); -var dup21 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" -match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ +var dup21 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ dup3, ])); @@ -122,8 +113,7 @@ var dup23 = linear_select([ dup21, ]); -var part1 = // "Pattern{Constant('urls '), Field(p0,false)}" -match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); +var part1 = match("HEADER#0:0003/2", "nwparser.p0", "urls %{p0}"); var all1 = all_match({ processors: [ @@ -137,19 +127,16 @@ var all1 = all_match({ ]), }); -var part2 = // "Pattern{Field(node,false), Constant('_appliance events '), Field(p0,false)}" -match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); +var part2 = match("HEADER#1:0002/1_0", "nwparser.p0", "%{node}_appliance events %{p0}"); -var part3 = // "Pattern{Field(node,true), Constant(' events '), Field(p0,false)}" -match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); +var part3 = match("HEADER#1:0002/1_1", "nwparser.p0", "%{node->} events %{p0}"); var select1 = linear_select([ part2, part3, ]); -var part4 = // "Pattern{Field(payload,false)}" -match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); +var part4 = match_copy("HEADER#1:0002/2", "nwparser.p0", "payload"); var all2 = all_match({ processors: [ @@ -163,8 +150,7 @@ var all2 = all_match({ ]), }); -var part5 = // "Pattern{Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); +var part5 = match("HEADER#2:0001/2", "nwparser.p0", "%{messageid->} %{p0}"); var all3 = all_match({ processors: [ @@ -177,19 +163,16 @@ var all3 = all_match({ ]), }); -var part6 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" -match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); +var part6 = match("HEADER#3:0005/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}"); -var part7 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" -match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); +var part7 = match("HEADER#3:0005/1_1", "nwparser.p0", "%{hfld4->} %{p0}"); var select2 = linear_select([ part6, part7, ]); -var part8 = // "Pattern{Field(,true), Constant(' '), Field(hfld5,true), Constant(' '), Field(hfld6,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ +var part8 = match("HEADER#3:0005/2", "nwparser.p0", "%{} %{hfld5->} %{hfld6->} %{messageid->} %{p0}", processor_chain([ call({ dest: "nwparser.payload", fn: STRCAT, @@ -214,8 +197,7 @@ var all4 = all_match({ ]), }); -var hdr1 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,false), Constant('.'), Field(hfld3,true), Constant(' '), Field(hfld4,false), Constant('_'), Field(space,true), Constant(' '), Field(messageid,true), Constant(' '), Field(payload,false)}" -match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ +var hdr1 = match("HEADER#4:0004", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{hfld4}_%{space->} %{messageid->} %{payload}", processor_chain([ setc("header_id","0004"), ])); @@ -227,36 +209,29 @@ var select3 = linear_select([ hdr1, ]); -var part9 = // "Pattern{Field(node,false), Constant('_appliance '), Field(p0,false)}" -match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); +var part9 = match("MESSAGE#0:flows/0_0", "nwparser.payload", "%{node}_appliance %{p0}"); -var part10 = // "Pattern{Field(node,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); +var part10 = match("MESSAGE#0:flows/0_1", "nwparser.payload", "%{node->} %{p0}"); var select4 = linear_select([ part9, part10, ]); -var part11 = // "Pattern{Constant('flows src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); +var part11 = match("MESSAGE#0:flows/1", "nwparser.p0", "flows src=%{saddr->} dst=%{daddr->} %{p0}"); -var part12 = // "Pattern{Constant('mac='), Field(dmacaddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); +var part12 = match("MESSAGE#0:flows/2_0", "nwparser.p0", "mac=%{dmacaddr->} %{p0}"); var select5 = linear_select([ part12, dup4, ]); -var part13 = // "Pattern{Constant('protocol='), Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); +var part13 = match("MESSAGE#0:flows/3", "nwparser.p0", "protocol=%{protocol->} %{p0}"); -var part14 = // "Pattern{Constant('sport='), Field(sport,true), Constant(' dport='), Field(dport,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); +var part14 = match("MESSAGE#0:flows/4_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} %{p0}"); -var part15 = // "Pattern{Constant('type='), Field(event_type,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); +var part15 = match("MESSAGE#0:flows/4_1", "nwparser.p0", "type=%{event_type->} %{p0}"); var select6 = linear_select([ part14, @@ -264,8 +239,7 @@ var select6 = linear_select([ dup4, ]); -var part16 = // "Pattern{Constant('pattern: '), Field(fld21,true), Constant(' '), Field(info,false)}" -match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); +var part16 = match("MESSAGE#0:flows/5", "nwparser.p0", "pattern: %{fld21->} %{info}"); var all5 = all_match({ processors: [ @@ -292,14 +266,11 @@ var all5 = all_match({ var msg1 = msg("flows", all5); -var part17 = // "Pattern{Field(node,true), Constant(' flows '), Field(action,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' mac='), Field(smacaddr,true), Constant(' protocol='), Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); +var part17 = match("MESSAGE#1:flows:01/0", "nwparser.payload", "%{node->} flows %{action->} src=%{saddr->} dst=%{daddr->} mac=%{smacaddr->} protocol=%{protocol->} %{p0}"); -var part18 = // "Pattern{Constant('sport='), Field(sport,true), Constant(' dport='), Field(dport,true), Constant(' ')}" -match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); +var part18 = match("MESSAGE#1:flows:01/1_0", "nwparser.p0", "sport=%{sport->} dport=%{dport->} "); -var part19 = // "Pattern{Constant('type='), Field(event_type,true), Constant(' ')}" -match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); +var part19 = match("MESSAGE#1:flows:01/1_1", "nwparser.p0", "type=%{event_type->} "); var select7 = linear_select([ part18, @@ -323,8 +294,7 @@ var all6 = all_match({ var msg2 = msg("flows:01", all6); -var part20 = // "Pattern{Field(node,true), Constant(' flows '), Field(action,false)}" -match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ +var part20 = match("MESSAGE#2:flows:02", "nwparser.payload", "%{node->} flows %{action}", processor_chain([ dup5, dup6, dup7, @@ -340,14 +310,11 @@ var select8 = linear_select([ msg3, ]); -var part21 = // "Pattern{Field(node,false), Constant('_appliance urls src='), Field(p0,false)}" -match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); +var part21 = match("MESSAGE#3:urls/0_0", "nwparser.payload", "%{node}_appliance urls src=%{p0}"); -var part22 = // "Pattern{Field(node,true), Constant(' urls src='), Field(p0,false)}" -match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); +var part22 = match("MESSAGE#3:urls/0_1", "nwparser.payload", "%{node->} urls src=%{p0}"); -var part23 = // "Pattern{Constant('src='), Field(p0,false)}" -match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); +var part23 = match("MESSAGE#3:urls/0_2", "nwparser.payload", "src=%{p0}"); var select9 = linear_select([ part21, @@ -355,17 +322,13 @@ var select9 = linear_select([ part23, ]); -var part24 = // "Pattern{Field(sport,false), Constant(':'), Field(saddr,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' mac='), Field(macaddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); +var part24 = match("MESSAGE#3:urls/1", "nwparser.p0", "%{sport}:%{saddr->} dst=%{daddr}:%{dport->} mac=%{macaddr->} %{p0}"); -var part25 = // "Pattern{Constant('agent=''), Field(user_agent,false), Constant('' request: '), Field(p0,false)}" -match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); +var part25 = match("MESSAGE#3:urls/2_0", "nwparser.p0", "agent='%{user_agent}' request: %{p0}"); -var part26 = // "Pattern{Constant('agent='), Field(user_agent,true), Constant(' request: '), Field(p0,false)}" -match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); +var part26 = match("MESSAGE#3:urls/2_1", "nwparser.p0", "agent=%{user_agent->} request: %{p0}"); -var part27 = // "Pattern{Constant('request: '), Field(p0,false)}" -match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); +var part27 = match("MESSAGE#3:urls/2_2", "nwparser.p0", "request: %{p0}"); var select10 = linear_select([ part25, @@ -373,8 +336,7 @@ var select10 = linear_select([ part27, ]); -var part28 = // "Pattern{Field(,true), Constant(' '), Field(web_method,false), Constant(''), Field(url,false)}" -match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); +var part28 = match("MESSAGE#3:urls/3", "nwparser.p0", "%{} %{web_method}%{url}"); var all7 = all_match({ processors: [ @@ -394,22 +356,18 @@ var all7 = all_match({ var msg4 = msg("urls", all7); -var part29 = // "Pattern{Constant('dhcp lease of ip '), Field(saddr,true), Constant(' from server mac '), Field(smacaddr,true), Constant(' for client mac '), Field(p0,false)}" -match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); +var part29 = match("MESSAGE#4:events/0", "nwparser.payload", "dhcp lease of ip %{saddr->} from server mac %{smacaddr->} for client mac %{p0}"); -var part30 = // "Pattern{Field(dmacaddr,true), Constant(' with hostname '), Field(hostname,true), Constant(' from router '), Field(p0,false)}" -match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); +var part30 = match("MESSAGE#4:events/1_0", "nwparser.p0", "%{dmacaddr->} with hostname %{hostname->} from router %{p0}"); -var part31 = // "Pattern{Field(dmacaddr,true), Constant(' from router '), Field(p0,false)}" -match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); +var part31 = match("MESSAGE#4:events/1_1", "nwparser.p0", "%{dmacaddr->} from router %{p0}"); var select11 = linear_select([ part30, part31, ]); -var part32 = // "Pattern{Field(hostip,true), Constant(' on subnet '), Field(mask,true), Constant(' with dns '), Field(dns_a_record,false)}" -match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); +var part32 = match("MESSAGE#4:events/2", "nwparser.p0", "%{hostip->} on subnet %{mask->} with dns %{dns_a_record}"); var all8 = all_match({ processors: [ @@ -428,11 +386,9 @@ var all8 = all_match({ var msg5 = msg("events", all8); -var part33 = // "Pattern{Constant('content_filtering_block url=''), Field(url,false), Constant('' category0=''), Field(category,false), Constant('' server=''), Field(daddr,false), Constant(':'), Field(dport,false), Constant('''), Field(p0,false)}" -match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); +var part33 = match("MESSAGE#5:events:02/0", "nwparser.payload", "content_filtering_block url='%{url}' category0='%{category}' server='%{daddr}:%{dport}'%{p0}"); -var part34 = // "Pattern{Constant(' client_mac=''), Field(dmacaddr,false), Constant(''')}" -match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); +var part34 = match("MESSAGE#5:events:02/1_0", "nwparser.p0", " client_mac='%{dmacaddr}'"); var select12 = linear_select([ part34, @@ -502,8 +458,7 @@ var part35 = tagval("MESSAGE#6:events:01", "nwparser.payload", tvm, { var msg7 = msg("events:01", part35); -var part36 = // "Pattern{Constant('IDS: '), Field(info,false)}" -match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ +var part36 = match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain([ dup5, dup6, setc("event_description","events IDS"), @@ -513,22 +468,18 @@ match("MESSAGE#7:events:03", "nwparser.payload", "IDS: %{info}", processor_chain var msg8 = msg("events:03", part36); -var part37 = // "Pattern{Constant('dhcp '), Field(p0,false)}" -match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); +var part37 = match("MESSAGE#8:events:04/0", "nwparser.payload", "dhcp %{p0}"); -var part38 = // "Pattern{Constant('no offers'), Field(p0,false)}" -match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); +var part38 = match("MESSAGE#8:events:04/1_0", "nwparser.p0", "no offers%{p0}"); -var part39 = // "Pattern{Constant('release'), Field(p0,false)}" -match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); +var part39 = match("MESSAGE#8:events:04/1_1", "nwparser.p0", "release%{p0}"); var select13 = linear_select([ part38, part39, ]); -var part40 = // "Pattern{Field(,false), Constant('for mac '), Field(macaddr,false)}" -match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); +var part40 = match("MESSAGE#8:events:04/2", "nwparser.p0", "%{}for mac %{macaddr}"); var all10 = all_match({ processors: [ @@ -547,8 +498,7 @@ var all10 = all_match({ var msg9 = msg("events:04", all10); -var part41 = // "Pattern{Constant('MAC '), Field(macaddr,true), Constant(' and MAC '), Field(macaddr,true), Constant(' both claim IP: '), Field(saddr,false)}" -match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ +var part41 = match("MESSAGE#9:events:05", "nwparser.payload", "MAC %{macaddr->} and MAC %{macaddr->} both claim IP: %{saddr}", processor_chain([ dup5, dup6, setc("event_description"," events MAC"), @@ -567,14 +517,11 @@ var select14 = linear_select([ msg10, ]); -var part42 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); +var part42 = match("MESSAGE#10:ids-alerts:01/0", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); -var part43 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' message: '), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); +var part43 = match("MESSAGE#10:ids-alerts:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message: %{p0}"); -var part44 = // "Pattern{Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' message: '), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); +var part44 = match("MESSAGE#10:ids-alerts:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message: %{p0}"); var select15 = linear_select([ part43, @@ -600,8 +547,7 @@ var all11 = all_match({ var msg11 = msg("ids-alerts:01", all11); -var part45 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,false), Constant('direction='), Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ +var part45 = match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}direction=%{direction->} protocol=%{protocol->} src=%{saddr}:%{sport}", processor_chain([ dup15, dup6, dup16, @@ -611,8 +557,7 @@ match("MESSAGE#11:ids-alerts:03", "nwparser.payload", "%{node->} ids-alerts sign var msg12 = msg("ids-alerts:03", part45); -var part46 = // "Pattern{Field(node,true), Constant(' ids-alerts signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,false), Constant('protocol='), Field(protocol,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,false), Constant('message: '), Field(signame,false)}" -match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ +var part46 = match("MESSAGE#12:ids-alerts:02", "nwparser.payload", "%{node->} ids-alerts signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4}protocol=%{protocol->} src=%{saddr->} dst=%{daddr}message: %{signame}", processor_chain([ dup15, dup6, dup16, @@ -628,8 +573,7 @@ var select16 = linear_select([ msg13, ]); -var part47 = // "Pattern{Field(node,false), Constant('security_event '), Field(event_description,true), Constant(' url='), Field(url,true), Constant(' src='), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' mac='), Field(smacaddr,true), Constant(' name='), Field(fld10,true), Constant(' sha256='), Field(fld11,true), Constant(' disposition='), Field(disposition,true), Constant(' action='), Field(action,false)}" -match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ +var part47 = match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{event_description->} url=%{url->} src=%{saddr}:%{sport->} dst=%{daddr}:%{dport->} mac=%{smacaddr->} name=%{fld10->} sha256=%{fld11->} disposition=%{disposition->} action=%{action}", processor_chain([ dup5, dup6, dup18, @@ -639,14 +583,11 @@ match("MESSAGE#13:security_event", "nwparser.payload", "%{node}security_event %{ var msg14 = msg("security_event", part47); -var part48 = // "Pattern{Field(node,true), Constant(' security_event '), Field(event_description,true), Constant(' signature='), Field(fld1,true), Constant(' priority='), Field(fld2,true), Constant(' timestamp='), Field(fld3,false), Constant('.'), Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); +var part48 = match("MESSAGE#14:security_event:01/0", "nwparser.payload", "%{node->} security_event %{event_description->} signature=%{fld1->} priority=%{fld2->} timestamp=%{fld3}.%{fld4->} %{p0}"); -var part49 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' dst='), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' message:'), Field(p0,false)}" -match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); +var part49 = match("MESSAGE#14:security_event:01/3_0", "nwparser.p0", "%{saddr}:%{sport->} dst=%{daddr}:%{dport->} message:%{p0}"); -var part50 = // "Pattern{Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' message:'), Field(p0,false)}" -match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); +var part50 = match("MESSAGE#14:security_event:01/3_1", "nwparser.p0", "%{saddr->} dst=%{daddr->} message:%{p0}"); var select17 = linear_select([ part49, @@ -688,34 +629,25 @@ var chain1 = processor_chain([ }), ]); -var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,false), Constant('.'), Field(hfld3,true), Constant(' '), Field(p0,false)}" -match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); +var hdr2 = match("HEADER#0:0003/0", "message", "%{hfld1->} %{hfld2}.%{hfld3->} %{p0}"); -var part51 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); +var part51 = match_copy("MESSAGE#0:flows/2_1", "nwparser.p0", "p0"); -var part52 = // "Pattern{}" -match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); +var part52 = match_copy("MESSAGE#1:flows:01/1_2", "nwparser.p0", ""); -var part53 = // "Pattern{Constant('dhost='), Field(dmacaddr,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); +var part53 = match("MESSAGE#10:ids-alerts:01/1_0", "nwparser.p0", "dhost=%{dmacaddr->} direction=%{p0}"); -var part54 = // "Pattern{Constant('shost='), Field(smacaddr,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); +var part54 = match("MESSAGE#10:ids-alerts:01/1_1", "nwparser.p0", "shost=%{smacaddr->} direction=%{p0}"); -var part55 = // "Pattern{Field(direction,true), Constant(' protocol='), Field(protocol,true), Constant(' src='), Field(p0,false)}" -match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); +var part55 = match("MESSAGE#10:ids-alerts:01/2", "nwparser.p0", "%{direction->} protocol=%{protocol->} src=%{p0}"); -var part56 = // "Pattern{Field(signame,false)}" -match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); +var part56 = match_copy("MESSAGE#10:ids-alerts:01/4", "nwparser.p0", "signame"); -var part57 = // "Pattern{Field(hfld4,false), Constant('_appliance '), Field(p0,false)}" -match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ +var part57 = match("HEADER#0:0003/1_0", "nwparser.p0", "%{hfld4}_appliance %{p0}", processor_chain([ dup2, ])); -var part58 = // "Pattern{Field(hfld4,true), Constant(' '), Field(p0,false)}" -match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ +var part58 = match("HEADER#0:0003/1_1", "nwparser.p0", "%{hfld4->} %{p0}", processor_chain([ dup3, ])); diff --git a/x-pack/filebeat/module/citrix/netscaler/config/pipeline.js b/x-pack/filebeat/module/citrix/netscaler/config/pipeline.js index 0da0631e21e..55f1931192c 100644 --- a/x-pack/filebeat/module/citrix/netscaler/config/pipeline.js +++ b/x-pack/filebeat/module/citrix/netscaler/config/pipeline.js @@ -77,14 +77,11 @@ var dup12 = setc("eventcategory","1201000000"); var dup13 = setc("event_description","AppFw Buffer Overflow violation in URL"); -var dup14 = // "Pattern{Field(saddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/0", "nwparser.payload", "%{saddr->} %{p0}"); +var dup14 = match("MESSAGE#6:APPFW_APPFW_COOKIE/0", "nwparser.payload", "%{saddr->} %{p0}"); -var dup15 = // "Pattern{Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); +var dup15 = match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); -var dup16 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); +var dup16 = match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); var dup17 = setc("event_description","AppFw SQL Injection violation"); @@ -92,25 +89,19 @@ var dup18 = setc("event_description","AppFw Request error. Generated 400 Respons var dup19 = setc("severity","Warning"); -var dup20 = // "Pattern{Constant('"'), Field(p0,false)}" -match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); +var dup20 = match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); -var dup21 = // "Pattern{Constant('HASTATE '), Field(p0,false)}" -match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); +var dup21 = match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); -var dup22 = // "Pattern{Field(network_service,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); +var dup22 = match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); -var dup23 = // "Pattern{Field(info,false), Constant('"')}" -match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); +var dup23 = match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); var dup24 = setc("event_description","Routing details"); -var dup25 = // "Pattern{Constant('for '), Field(dclass_counter1,false)}" -match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); +var dup25 = match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); -var dup26 = // "Pattern{Field(space,false)}" -match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); +var dup26 = match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); var dup27 = setc("ec_subject","Configuration"); @@ -120,14 +111,11 @@ var dup29 = setc("ec_theme","Configuration"); var dup30 = setc("ec_activity","Start"); -var dup31 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); +var dup31 = match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); -var dup32 = // "Pattern{Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); +var dup32 = match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); -var dup33 = // "Pattern{}" -match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); +var dup33 = match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); var dup34 = setc("ec_subject","Service"); @@ -140,14 +128,11 @@ var dup35 = date_time({ ], }); -var dup36 = // "Pattern{Field(obj_type,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); +var dup36 = match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); -var dup37 = // "Pattern{Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); +var dup37 = match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); -var dup38 = // "Pattern{Constant(''), Field(obj_name,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); +var dup38 = match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); var dup39 = setc("event_description","The monitor bound to the service is up"); @@ -155,11 +140,9 @@ var dup40 = setc("ec_subject","NetworkComm"); var dup41 = setc("severity","Debug"); -var dup42 = // "Pattern{Constant('" '), Field(p0,false)}" -match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); +var dup42 = match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); -var dup43 = // "Pattern{Constant(''), Field(info,false), Constant('"')}" -match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); +var dup43 = match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); var dup44 = date_time({ dest: "starttime", @@ -171,16 +154,13 @@ var dup44 = date_time({ var dup45 = setc("event_description","Process"); -var dup46 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); +var dup46 = match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); var dup47 = setc("event_description","SNMP TRAP SENT"); -var dup48 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); +var dup48 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); -var dup49 = // "Pattern{Constant('ClientIP '), Field(p0,false)}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); +var dup49 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); var dup50 = date_time({ dest: "event_time", @@ -193,23 +173,17 @@ var dup50 = date_time({ var dup51 = setc("ec_activity","Request"); -var dup52 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); +var dup52 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); -var dup53 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); +var dup53 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); -var dup54 = // "Pattern{Field(fld10,true), Constant(' - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); +var dup54 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); -var dup55 = // "Pattern{Constant('" '), Field(fld11,true), Constant(' GMT" - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); +var dup55 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); -var dup56 = // "Pattern{Constant('" '), Field(fld11,false), Constant('" - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); +var dup56 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); -var dup57 = // "Pattern{Field(fld11,true), Constant(' - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); +var dup57 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); var dup58 = setc("event_description","ICA connection related information for a connection belonging to a SSLVPN session"); @@ -233,61 +207,45 @@ var dup62 = date_time({ ], }); -var dup63 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); +var dup63 = match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); -var dup64 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); +var dup64 = match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); -var dup65 = // "Pattern{Constant('User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); +var dup65 = match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); -var dup66 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); +var dup66 = match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); -var dup67 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); +var dup67 = match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); -var dup68 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); +var dup68 = match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); var dup69 = setc("eventcategory","1401060000"); -var dup70 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start_time '), Field(p0,false)}" -match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); +var dup70 = match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); var dup71 = setc("eventcategory","1401070000"); var dup72 = setc("ec_activity","Logoff"); -var dup73 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(username,true), Constant(' - Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); +var dup73 = match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); -var dup74 = // "Pattern{Field(,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); +var dup74 = match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); -var dup75 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); +var dup75 = match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); -var dup76 = // "Pattern{Field(fld11,true), Constant(' GMT - Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); +var dup76 = match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); -var dup77 = // "Pattern{Field(fld11,true), Constant(' - Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); +var dup77 = match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); -var dup78 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); +var dup78 = match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); var dup79 = setc("event_description","A Server side and a Client side TCP connection is delinked"); -var dup80 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); +var dup80 = match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); -var dup81 = // "Pattern{Field(fld10,true), Constant(' GMT - End Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); +var dup81 = match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); -var dup82 = // "Pattern{Field(fld10,true), Constant(' - End Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); +var dup82 = match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); var dup83 = setc("event_description","TCP connection terminated"); @@ -317,27 +275,21 @@ var dup88 = setc("eventcategory","1401040000"); var dup89 = setc("event_description","CLI or GUI command executed in NetScaler"); -var dup90 = // "Pattern{Field(info,true), Constant(' "')}" -match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); +var dup90 = match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); var dup91 = setf("msg","$MSG"); var dup92 = setc("event_description","GUI command executed in NetScaler"); -var dup93 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); +var dup93 = match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); -var dup94 = // "Pattern{Constant('Sessionid '), Field(sessionid,true), Constant(' - User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); +var dup94 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); -var dup95 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); +var dup95 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); -var dup96 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); +var dup96 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); -var dup97 = // "Pattern{Field(daddr,true), Constant(' - Errmsg " '), Field(event_description,true), Constant(' "')}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); +var dup97 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); var dup98 = linear_select([ dup21, @@ -354,8 +306,7 @@ var dup100 = linear_select([ dup33, ]); -var dup101 = // "Pattern{Field(fld1,false), Constant(':UserLogin:'), Field(username,true), Constant(' - '), Field(event_description,true), Constant(' from client IP Address '), Field(saddr,false)}" -match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ +var dup101 = match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ dup5, dup4, ])); @@ -393,28 +344,24 @@ var dup107 = linear_select([ dup82, ]); -var dup108 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" -match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ +var dup108 = match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ dup88, dup89, dup3, dup4, ])); -var dup109 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" -match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ +var dup109 = match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ dup9, dup91, ])); -var dup110 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" -match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ +var dup110 = match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ dup11, dup91, ])); -var dup111 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ +var dup111 = match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ dup9, dup4, ])); @@ -450,34 +397,28 @@ var dup114 = all_match({ ]), }); -var hdr1 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(hfld2,false), Constant(':'), Field(payload,false)}" -match("HEADER#0:0001", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} %{hfld2}:%{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} %{hfld2}:%{payload}", processor_chain([ setc("header_id","0001"), dup1, ])); -var hdr2 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' :'), Field(payload,false)}" -match("HEADER#1:0005", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} :%{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0005", "message", "%{hdatetime->} %{hfld1->} : %{msgIdPart1->} %{msgIdPart2->} :%{payload}", processor_chain([ setc("header_id","0005"), dup1, ])); -var hdr3 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hfld1,true), Constant(' : '), Field(hfld2,true), Constant(' '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#2:0002/0", "message", "%{hdatetime->} %{hfld1->} : %{hfld2->} %{msgIdPart1->} %{msgIdPart2->} %{p0}"); +var hdr3 = match("HEADER#2:0002/0", "message", "%{hdatetime->} %{hfld1->} : %{hfld2->} %{msgIdPart1->} %{msgIdPart2->} %{p0}"); -var part1 = // "Pattern{Field(hfld3,true), Constant(' '), Field(p0,false)}" -match("HEADER#2:0002/1_0", "nwparser.p0", "%{hfld3->} %{p0}"); +var part1 = match("HEADER#2:0002/1_0", "nwparser.p0", "%{hfld3->} %{p0}"); -var part2 = // "Pattern{Field(p0,false)}" -match_copy("HEADER#2:0002/1_1", "nwparser.p0", "p0"); +var part2 = match_copy("HEADER#2:0002/1_1", "nwparser.p0", "p0"); var select1 = linear_select([ part1, part2, ]); -var part3 = // "Pattern{Constant(':'), Field(payload,false)}" -match("HEADER#2:0002/2", "nwparser.p0", ":%{payload}"); +var part3 = match("HEADER#2:0002/2", "nwparser.p0", ":%{payload}"); var all1 = all_match({ processors: [ @@ -491,8 +432,7 @@ var all1 = all_match({ ]), }); -var hdr4 = // "Pattern{Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#3:0003", "message", "%{messageid->} %{p0}", processor_chain([ +var hdr4 = match("HEADER#3:0003", "message", "%{messageid->} %{p0}", processor_chain([ setc("header_id","0003"), call({ dest: "nwparser.payload", @@ -505,8 +445,7 @@ match("HEADER#3:0003", "message", "%{messageid->} %{p0}", processor_chain([ }), ])); -var hdr5 = // "Pattern{Constant('CEF:0|Citrix|'), Field(fld1,false), Constant('|'), Field(fld2,false), Constant('|'), Field(fld3,false), Constant('|'), Field(messageid,false), Constant('| '), Field(p0,false)}" -match("HEADER#4:0004", "message", "CEF:0|Citrix|%{fld1}|%{fld2}|%{fld3}|%{messageid}| %{p0}", processor_chain([ +var hdr5 = match("HEADER#4:0004", "message", "CEF:0|Citrix|%{fld1}|%{fld2}|%{fld3}|%{messageid}| %{p0}", processor_chain([ setc("header_id","0004"), call({ dest: "nwparser.payload", @@ -525,8 +464,7 @@ match("HEADER#4:0004", "message", "CEF:0|Citrix|%{fld1}|%{fld2}|%{fld3}|%{messag }), ])); -var hdr6 = // "Pattern{Constant('CEF:0|Citrix|'), Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(hfld1,false), Constant('|'), Field(severity,false), Constant('| '), Field(payload,false)}" -match("HEADER#5:0006", "message", "CEF:0|Citrix|%{product}|%{version}|%{rule}|%{hfld1}|%{severity}| %{payload}", processor_chain([ +var hdr6 = match("HEADER#5:0006", "message", "CEF:0|Citrix|%{product}|%{version}|%{rule}|%{hfld1}|%{severity}| %{payload}", processor_chain([ setc("header_id","0006"), setc("messageid","CITRIX_TVM"), ])); @@ -540,11 +478,9 @@ var select2 = linear_select([ hdr6, ]); -var part4 = // "Pattern{Constant('Extracted_groups "'), Field(group,false), Constant('" ')}" -match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_0", "nwparser.payload", "Extracted_groups \"%{group}\" "); +var part4 = match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_0", "nwparser.payload", "Extracted_groups \"%{group}\" "); -var part5 = // "Pattern{Constant(' Extracted_groups "'), Field(group,false)}" -match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_1", "nwparser.payload", " Extracted_groups \"%{group}"); +var part5 = match("MESSAGE#0:AAA_EXTRACTED_GROUPS/0_1", "nwparser.payload", " Extracted_groups \"%{group}"); var select3 = linear_select([ part4, @@ -565,8 +501,7 @@ var all2 = all_match({ var msg1 = msg("AAA_EXTRACTED_GROUPS", all2); -var part6 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Failure_reason "'), Field(result,false), Constant('"')}" -match("MESSAGE#1:AAA_LOGIN_FAILED", "nwparser.payload", "User %{username->} - Client_ip %{saddr->} - Failure_reason \"%{result}\"", processor_chain([ +var part6 = match("MESSAGE#1:AAA_LOGIN_FAILED", "nwparser.payload", "User %{username->} - Client_ip %{saddr->} - Failure_reason \"%{result}\"", processor_chain([ dup5, setc("ec_subject","User"), dup6, @@ -579,8 +514,7 @@ match("MESSAGE#1:AAA_LOGIN_FAILED", "nwparser.payload", "User %{username->} - Cl var msg2 = msg("AAA_LOGIN_FAILED", part6); -var part7 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' --> Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Protocol '), Field(protocol,true), Constant(' - TimeStamp '), Field(info,true), Constant(' - Hitcount '), Field(dclass_counter1,true), Constant(' - Hit Rule '), Field(rulename,true), Constant(' - Data '), Field(message_body,false)}" -match("MESSAGE#2:ACL_ACL_PKT_LOG", "nwparser.payload", "Source %{saddr}:%{sport->} --> Destination %{daddr}:%{dport->} - Protocol %{protocol->} - TimeStamp %{info->} - Hitcount %{dclass_counter1->} - Hit Rule %{rulename->} - Data %{message_body}", processor_chain([ +var part7 = match("MESSAGE#2:ACL_ACL_PKT_LOG", "nwparser.payload", "Source %{saddr}:%{sport->} --> Destination %{daddr}:%{dport->} - Protocol %{protocol->} - TimeStamp %{info->} - Hitcount %{dclass_counter1->} - Hit Rule %{rulename->} - Data %{message_body}", processor_chain([ dup9, setc("event_description","ACL_PKT_LOG"), dup10, @@ -589,8 +523,7 @@ match("MESSAGE#2:ACL_ACL_PKT_LOG", "nwparser.payload", "Source %{saddr}:%{sport- var msg3 = msg("ACL_ACL_PKT_LOG", part7); -var part8 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#3:APPFW_APPFW_BUFFEROVERFLOW_COOKIE", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ +var part8 = match("MESSAGE#3:APPFW_APPFW_BUFFEROVERFLOW_COOKIE", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ dup11, setc("event_description","AppFw Buffer Overflow violation in Cookie"), dup3, @@ -599,8 +532,7 @@ match("MESSAGE#3:APPFW_APPFW_BUFFEROVERFLOW_COOKIE", "nwparser.payload", "%{sadd var msg4 = msg("APPFW_APPFW_BUFFEROVERFLOW_COOKIE", part8); -var part9 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#4:APPFW_APPFW_BUFFEROVERFLOW_HDR", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ +var part9 = match("MESSAGE#4:APPFW_APPFW_BUFFEROVERFLOW_HDR", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ dup11, setc("event_description","AppFw Buffer Overflow violation in HTTP Headers"), dup3, @@ -609,8 +541,7 @@ match("MESSAGE#4:APPFW_APPFW_BUFFEROVERFLOW_HDR", "nwparser.payload", "%{saddr-> var msg5 = msg("APPFW_APPFW_BUFFEROVERFLOW_HDR", part9); -var part10 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(info,false), Constant(': '), Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#5:APPFW_APPFW_BUFFEROVERFLOW_URL", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ +var part10 = match("MESSAGE#5:APPFW_APPFW_BUFFEROVERFLOW_URL", "nwparser.payload", "%{saddr->} %{fld2->} %{rule_group->} %{info}: %{url->} \u003c\u003c%{disposition}>", processor_chain([ dup12, dup13, dup3, @@ -619,8 +550,7 @@ match("MESSAGE#5:APPFW_APPFW_BUFFEROVERFLOW_URL", "nwparser.payload", "%{saddr-> var msg6 = msg("APPFW_APPFW_BUFFEROVERFLOW_URL", part10); -var part11 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(info,false), Constant(': '), Field(url,false)}" -match("MESSAGE#137:APPFW_APPFW_BUFFEROVERFLOW_URL:01", "nwparser.payload", "%{saddr->} %{fld2->} %{info}: %{url}", processor_chain([ +var part11 = match("MESSAGE#137:APPFW_APPFW_BUFFEROVERFLOW_URL:01", "nwparser.payload", "%{saddr->} %{fld2->} %{info}: %{url}", processor_chain([ dup12, dup13, dup3, @@ -634,14 +564,11 @@ var select4 = linear_select([ msg7, ]); -var part12 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Cookie%{p0}"); +var part12 = match("MESSAGE#6:APPFW_APPFW_COOKIE/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Cookie%{p0}"); -var part13 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Cookie%{p0}"); +var part13 = match("MESSAGE#6:APPFW_APPFW_COOKIE/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Cookie%{p0}"); -var part14 = // "Pattern{Field(rule_group,true), Constant(' Cookie'), Field(p0,false)}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/1_2", "nwparser.p0", "%{rule_group->} Cookie%{p0}"); +var part14 = match("MESSAGE#6:APPFW_APPFW_COOKIE/1_2", "nwparser.p0", "%{rule_group->} Cookie%{p0}"); var select5 = linear_select([ part12, @@ -649,8 +576,7 @@ var select5 = linear_select([ part14, ]); -var part15 = // "Pattern{Field(url,true), Constant(' validation failed for '), Field(fld3,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/2", "nwparser.p0", "%{url->} validation failed for %{fld3->} \u003c\u003c%{disposition}>"); +var part15 = match("MESSAGE#6:APPFW_APPFW_COOKIE/2", "nwparser.p0", "%{url->} validation failed for %{fld3->} \u003c\u003c%{disposition}>"); var all3 = all_match({ processors: [ @@ -668,11 +594,9 @@ var all3 = all_match({ var msg8 = msg("APPFW_APPFW_COOKIE", all3); -var part16 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Deny URL: '), Field(p0,false)}" -match("MESSAGE#7:APPFW_APPFW_DENYURL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Deny URL: %{p0}"); +var part16 = match("MESSAGE#7:APPFW_APPFW_DENYURL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Deny URL: %{p0}"); -var part17 = // "Pattern{Field(rule_group,true), Constant(' Disallow Deny URL: '), Field(p0,false)}" -match("MESSAGE#7:APPFW_APPFW_DENYURL/1_1", "nwparser.p0", "%{rule_group->} Disallow Deny URL: %{p0}"); +var part17 = match("MESSAGE#7:APPFW_APPFW_DENYURL/1_1", "nwparser.p0", "%{rule_group->} Disallow Deny URL: %{p0}"); var select6 = linear_select([ part16, @@ -697,14 +621,11 @@ var all4 = all_match({ var msg9 = msg("APPFW_APPFW_DENYURL", all4); -var part18 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" -match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_0", "nwparser.p0", "%{fld1->} %{fld2->} %{rule_group->} Field consistency%{p0}"); +var part18 = match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_0", "nwparser.p0", "%{fld1->} %{fld2->} %{rule_group->} Field consistency%{p0}"); -var part19 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" -match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Field consistency%{p0}"); +var part19 = match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Field consistency%{p0}"); -var part20 = // "Pattern{Field(rule_group,true), Constant(' Field consistency'), Field(p0,false)}" -match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_2", "nwparser.p0", "%{rule_group->} Field consistency%{p0}"); +var part20 = match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/1_2", "nwparser.p0", "%{rule_group->} Field consistency%{p0}"); var select7 = linear_select([ part18, @@ -728,19 +649,16 @@ var all5 = all_match({ var msg10 = msg("APPFW_APPFW_FIELDCONSISTENCY", all5); -var part21 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Field'), Field(p0,false)}" -match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Field%{p0}"); +var part21 = match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Field%{p0}"); -var part22 = // "Pattern{Field(rule_group,true), Constant(' Field'), Field(p0,false)}" -match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_1", "nwparser.p0", "%{rule_group->} Field%{p0}"); +var part22 = match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/1_1", "nwparser.p0", "%{rule_group->} Field%{p0}"); var select8 = linear_select([ part21, part22, ]); -var part23 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' ="'), Field(fld4,false), Constant('" <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/2", "nwparser.p0", "%{url->} %{info->} =\"%{fld4}\" \u003c\u003c%{disposition}>"); +var part23 = match("MESSAGE#9:APPFW_APPFW_FIELDFORMAT/2", "nwparser.p0", "%{url->} %{info->} =\"%{fld4}\" \u003c\u003c%{disposition}>"); var all6 = all_match({ processors: [ @@ -758,11 +676,9 @@ var all6 = all_match({ var msg11 = msg("APPFW_APPFW_FIELDFORMAT", all6); -var part24 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' SQL'), Field(p0,false)}" -match("MESSAGE#10:APPFW_APPFW_SQL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} SQL%{p0}"); +var part24 = match("MESSAGE#10:APPFW_APPFW_SQL/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} SQL%{p0}"); -var part25 = // "Pattern{Field(rule_group,true), Constant(' SQL'), Field(p0,false)}" -match("MESSAGE#10:APPFW_APPFW_SQL/1_1", "nwparser.p0", "%{rule_group->} SQL%{p0}"); +var part25 = match("MESSAGE#10:APPFW_APPFW_SQL/1_1", "nwparser.p0", "%{rule_group->} SQL%{p0}"); var select9 = linear_select([ part24, @@ -785,11 +701,9 @@ var all7 = all_match({ var msg12 = msg("APPFW_APPFW_SQL", all7); -var part26 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#11:APPFW_APPFW_SQL_1/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{p0}"); +var part26 = match("MESSAGE#11:APPFW_APPFW_SQL_1/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{p0}"); -var part27 = // "Pattern{Field(rule_group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#11:APPFW_APPFW_SQL_1/1_1", "nwparser.p0", "%{rule_group->} %{p0}"); +var part27 = match("MESSAGE#11:APPFW_APPFW_SQL_1/1_1", "nwparser.p0", "%{rule_group->} %{p0}"); var select10 = linear_select([ part26, @@ -817,19 +731,16 @@ var select11 = linear_select([ msg13, ]); -var part28 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Maximum no. '), Field(p0,false)}" -match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Maximum no. %{p0}"); +var part28 = match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Maximum no. %{p0}"); -var part29 = // "Pattern{Field(rule_group,true), Constant(' Maximum no. '), Field(p0,false)}" -match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_1", "nwparser.p0", "%{rule_group->} Maximum no. %{p0}"); +var part29 = match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/1_1", "nwparser.p0", "%{rule_group->} Maximum no. %{p0}"); var select12 = linear_select([ part28, part29, ]); -var part30 = // "Pattern{Field(url,true), Constant(' of potential credit card numbers seen <<'), Field(info,false), Constant('>')}" -match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/2", "nwparser.p0", "%{url->} of potential credit card numbers seen \u003c\u003c%{info}>"); +var part30 = match("MESSAGE#12:APPFW_APPFW_SAFECOMMERCE/2", "nwparser.p0", "%{url->} of potential credit card numbers seen \u003c\u003c%{info}>"); var all9 = all_match({ processors: [ @@ -847,19 +758,16 @@ var all9 = all_match({ var msg14 = msg("APPFW_APPFW_SAFECOMMERCE", all9); -var part31 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Transformed ('), Field(info,false), Constant(') Maximum no. '), Field(p0,false)}" -match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{url->} Transformed (%{info}) Maximum no. %{p0}"); +var part31 = match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} %{url->} Transformed (%{info}) Maximum no. %{p0}"); -var part32 = // "Pattern{Field(rule_group,true), Constant(' '), Field(url,true), Constant(' ('), Field(info,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_1", "nwparser.p0", "%{rule_group->} %{url->} (%{info}) %{p0}"); +var part32 = match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/1_1", "nwparser.p0", "%{rule_group->} %{url->} (%{info}) %{p0}"); var select13 = linear_select([ part31, part32, ]); -var part33 = // "Pattern{Constant('potential credit card numbers seen in server response'), Field(,false)}" -match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/2", "nwparser.p0", "potential credit card numbers seen in server response%{}"); +var part33 = match("MESSAGE#13:APPFW_APPFW_SAFECOMMERCE_XFORM/2", "nwparser.p0", "potential credit card numbers seen in server response%{}"); var all10 = all_match({ processors: [ @@ -877,14 +785,11 @@ var all10 = all_match({ var msg15 = msg("APPFW_APPFW_SAFECOMMERCE_XFORM", all10); -var part34 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" -match("MESSAGE#14:APPFW_APPFW_STARTURL/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Disallow Illegal URL: %{p0}"); +var part34 = match("MESSAGE#14:APPFW_APPFW_STARTURL/1_0", "nwparser.p0", "%{fld2->} %{fld3->} %{rule_group->} Disallow Illegal URL: %{p0}"); -var part35 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" -match("MESSAGE#14:APPFW_APPFW_STARTURL/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Illegal URL: %{p0}"); +var part35 = match("MESSAGE#14:APPFW_APPFW_STARTURL/1_1", "nwparser.p0", "%{fld2->} %{rule_group->} Disallow Illegal URL: %{p0}"); -var part36 = // "Pattern{Field(rule_group,true), Constant(' Disallow Illegal URL: '), Field(p0,false)}" -match("MESSAGE#14:APPFW_APPFW_STARTURL/1_2", "nwparser.p0", "%{rule_group->} Disallow Illegal URL: %{p0}"); +var part36 = match("MESSAGE#14:APPFW_APPFW_STARTURL/1_2", "nwparser.p0", "%{rule_group->} Disallow Illegal URL: %{p0}"); var select14 = linear_select([ part34, @@ -908,19 +813,16 @@ var all11 = all_match({ var msg16 = msg("APPFW_APPFW_STARTURL", all11); -var part37 = // "Pattern{Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' Cross-site'), Field(p0,false)}" -match("MESSAGE#15:APPFW_APPFW_XSS/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Cross-site%{p0}"); +var part37 = match("MESSAGE#15:APPFW_APPFW_XSS/1_0", "nwparser.p0", "%{fld2->} %{rule_group->} Cross-site%{p0}"); -var part38 = // "Pattern{Field(rule_group,true), Constant(' Cross-site'), Field(p0,false)}" -match("MESSAGE#15:APPFW_APPFW_XSS/1_1", "nwparser.p0", "%{rule_group->} Cross-site%{p0}"); +var part38 = match("MESSAGE#15:APPFW_APPFW_XSS/1_1", "nwparser.p0", "%{rule_group->} Cross-site%{p0}"); var select15 = linear_select([ part37, part38, ]); -var part39 = // "Pattern{Field(url,true), Constant(' script '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#15:APPFW_APPFW_XSS/2", "nwparser.p0", "%{url->} script %{info->} \u003c\u003c%{disposition}>"); +var part39 = match("MESSAGE#15:APPFW_APPFW_XSS/2", "nwparser.p0", "%{url->} script %{info->} \u003c\u003c%{disposition}>"); var all12 = all_match({ processors: [ @@ -938,8 +840,7 @@ var all12 = all_match({ var msg17 = msg("APPFW_APPFW_XSS", all12); -var part40 = // "Pattern{Field(saddr,true), Constant(' "'), Field(info,false), Constant('"')}" -match("MESSAGE#16:APPFW_AF_400_RESP", "nwparser.payload", "%{saddr->} \"%{info}\"", processor_chain([ +var part40 = match("MESSAGE#16:APPFW_AF_400_RESP", "nwparser.payload", "%{saddr->} \"%{info}\"", processor_chain([ dup11, dup18, dup3, @@ -948,8 +849,7 @@ match("MESSAGE#16:APPFW_AF_400_RESP", "nwparser.payload", "%{saddr->} \"%{info}\ var msg18 = msg("APPFW_AF_400_RESP", part40); -var part41 = // "Pattern{Field(saddr,true), Constant(' '), Field(info,false)}" -match("MESSAGE#138:APPFW_AF_400_RESP:01", "nwparser.payload", "%{saddr->} %{info}", processor_chain([ +var part41 = match("MESSAGE#138:APPFW_AF_400_RESP:01", "nwparser.payload", "%{saddr->} %{info}", processor_chain([ dup11, dup18, dup3, @@ -963,8 +863,7 @@ var select16 = linear_select([ msg19, ]); -var part42 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld10,true), Constant(' Match found with Safe Object: '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#17:APPFW_APPFW_SAFEOBJECT", "nwparser.payload", "%{saddr->} %{fld10->} Match found with Safe Object: %{info->} \u003c\u003c%{disposition}>", processor_chain([ +var part42 = match("MESSAGE#17:APPFW_APPFW_SAFEOBJECT", "nwparser.payload", "%{saddr->} %{fld10->} Match found with Safe Object: %{info->} \u003c\u003c%{disposition}>", processor_chain([ dup11, setc("event_description","AppFw Safe Object"), dup3, @@ -973,8 +872,7 @@ match("MESSAGE#17:APPFW_APPFW_SAFEOBJECT", "nwparser.payload", "%{saddr->} %{fld var msg20 = msg("APPFW_APPFW_SAFEOBJECT", part42); -var part43 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld10,true), Constant(' CSRF Tag validation failed: <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#18:APPFW_APPFW_CSRF_TAG", "nwparser.payload", "%{saddr->} %{fld10->} CSRF Tag validation failed: \u003c\u003c%{disposition}>", processor_chain([ +var part43 = match("MESSAGE#18:APPFW_APPFW_CSRF_TAG", "nwparser.payload", "%{saddr->} %{fld10->} CSRF Tag validation failed: \u003c\u003c%{disposition}>", processor_chain([ dup11, setc("event_description","AppFw CSRF Tag Validation Failed"), dup3, @@ -983,8 +881,7 @@ match("MESSAGE#18:APPFW_APPFW_CSRF_TAG", "nwparser.payload", "%{saddr->} %{fld10 var msg21 = msg("APPFW_APPFW_CSRF_TAG", part43); -var part44 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(url,false)}" -match("MESSAGE#135:APPFW_APPFW_CSRF_TAG:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url}", processor_chain([ +var part44 = match("MESSAGE#135:APPFW_APPFW_CSRF_TAG:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url}", processor_chain([ dup9, dup3, dup4, @@ -997,8 +894,7 @@ var select17 = linear_select([ msg22, ]); -var part45 = // "Pattern{Constant('Memory allocation request for '), Field(bytes,true), Constant(' bytes failed. Call stack PCs: '), Field(fld1,false)}" -match("MESSAGE#19:APPFW_AF_MEMORY_ERR", "nwparser.payload", "Memory allocation request for %{bytes->} bytes failed. Call stack PCs: %{fld1}", processor_chain([ +var part45 = match("MESSAGE#19:APPFW_AF_MEMORY_ERR", "nwparser.payload", "Memory allocation request for %{bytes->} bytes failed. Call stack PCs: %{fld1}", processor_chain([ dup11, setc("event_description","Memory allocation request for some bytes failed"), dup19, @@ -1007,19 +903,16 @@ match("MESSAGE#19:APPFW_AF_MEMORY_ERR", "nwparser.payload", "Memory allocation r var msg23 = msg("APPFW_AF_MEMORY_ERR", part45); -var part46 = // "Pattern{Constant('Invalid rule id '), Field(p0,false)}" -match("MESSAGE#20:APPFW_Message/1_0", "nwparser.p0", "Invalid rule id %{p0}"); +var part46 = match("MESSAGE#20:APPFW_Message/1_0", "nwparser.p0", "Invalid rule id %{p0}"); -var part47 = // "Pattern{Constant('Duplicate rule id '), Field(p0,false)}" -match("MESSAGE#20:APPFW_Message/1_1", "nwparser.p0", "Duplicate rule id %{p0}"); +var part47 = match("MESSAGE#20:APPFW_Message/1_1", "nwparser.p0", "Duplicate rule id %{p0}"); var select18 = linear_select([ part46, part47, ]); -var part48 = // "Pattern{Field(fld1,false), Constant('"')}" -match("MESSAGE#20:APPFW_Message/2", "nwparser.p0", "%{fld1}\""); +var part48 = match("MESSAGE#20:APPFW_Message/2", "nwparser.p0", "%{fld1}\""); var all13 = all_match({ processors: [ @@ -1037,8 +930,7 @@ var all13 = all_match({ var msg24 = msg("APPFW_Message", all13); -var part49 = // "Pattern{Constant('"Setting default custom settings for profile '), Field(fld1,true), Constant(' ('), Field(fld2,false), Constant(')"')}" -match("MESSAGE#21:APPFW_Message:01", "nwparser.payload", "\"Setting default custom settings for profile %{fld1->} (%{fld2})\"", processor_chain([ +var part49 = match("MESSAGE#21:APPFW_Message:01", "nwparser.payload", "\"Setting default custom settings for profile %{fld1->} (%{fld2})\"", processor_chain([ dup9, setc("event_description","Setting default custom settings for profile"), dup19, @@ -1047,8 +939,7 @@ match("MESSAGE#21:APPFW_Message:01", "nwparser.payload", "\"Setting default cust var msg25 = msg("APPFW_Message:01", part49); -var part50 = // "Pattern{Constant('"Setting same CustomSettings( ) to profile. '), Field(fld2,false), Constant('"')}" -match("MESSAGE#22:APPFW_Message:02", "nwparser.payload", "\"Setting same CustomSettings( ) to profile. %{fld2}\"", processor_chain([ +var part50 = match("MESSAGE#22:APPFW_Message:02", "nwparser.payload", "\"Setting same CustomSettings( ) to profile. %{fld2}\"", processor_chain([ dup9, setc("event_description","Setting same CustomSettings( ) to profile."), dup4, @@ -1064,8 +955,7 @@ var select19 = linear_select([ var msg27 = msg("DR_HA_Message", dup113); -var part51 = // "Pattern{Field(process,true), Constant(' ended '), Field(p0,false)}" -match("MESSAGE#24:EVENT_ALERTENDED/0", "nwparser.payload", "%{process->} ended %{p0}"); +var part51 = match("MESSAGE#24:EVENT_ALERTENDED/0", "nwparser.payload", "%{process->} ended %{p0}"); var all14 = all_match({ processors: [ @@ -1082,8 +972,7 @@ var all14 = all_match({ var msg28 = msg("EVENT_ALERTENDED", all14); -var part52 = // "Pattern{Field(process,true), Constant(' started '), Field(p0,false)}" -match("MESSAGE#25:EVENT_ALERTSTARTED/0", "nwparser.payload", "%{process->} started %{p0}"); +var part52 = match("MESSAGE#25:EVENT_ALERTSTARTED/0", "nwparser.payload", "%{process->} started %{p0}"); var all15 = all_match({ processors: [ @@ -1100,8 +989,7 @@ var all15 = all_match({ var msg29 = msg("EVENT_ALERTSTARTED", all15); -var part53 = // "Pattern{Constant('CONFIG '), Field(info,false)}" -match("MESSAGE#26:EVENT_CONFIGEND", "nwparser.payload", "CONFIG %{info}", processor_chain([ +var part53 = match("MESSAGE#26:EVENT_CONFIGEND", "nwparser.payload", "CONFIG %{info}", processor_chain([ dup2, dup27, dup28, @@ -1113,8 +1001,7 @@ match("MESSAGE#26:EVENT_CONFIGEND", "nwparser.payload", "CONFIG %{info}", proces var msg30 = msg("EVENT_CONFIGEND", part53); -var part54 = // "Pattern{Constant('CONFIG '), Field(info,false)}" -match("MESSAGE#27:EVENT_CONFIGSTART", "nwparser.payload", "CONFIG %{info}", processor_chain([ +var part54 = match("MESSAGE#27:EVENT_CONFIGSTART", "nwparser.payload", "CONFIG %{info}", processor_chain([ dup2, dup27, dup30, @@ -1143,8 +1030,7 @@ var all16 = all_match({ var msg32 = msg("EVENT_DEVICEDOWN", all16); -var part55 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" -match("MESSAGE#29:EVENT_DEVICEOFS", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ +var part55 = match("MESSAGE#29:EVENT_DEVICEOFS", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ dup11, dup34, dup28, @@ -1172,8 +1058,7 @@ var all17 = all_match({ var msg34 = msg("EVENT_DEVICEUP", all17); -var part56 = // "Pattern{Constant('"'), Field(obj_name,false), Constant('"')}" -match("MESSAGE#31:EVENT_MONITORDOWN/1_1", "nwparser.p0", "\"%{obj_name}\""); +var part56 = match("MESSAGE#31:EVENT_MONITORDOWN/1_1", "nwparser.p0", "\"%{obj_name}\""); var select20 = linear_select([ dup37, @@ -1216,8 +1101,7 @@ var all19 = all_match({ var msg36 = msg("EVENT_MONITORUP", all19); -var part57 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" -match("MESSAGE#33:EVENT_NICRESET", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ +var part57 = match("MESSAGE#33:EVENT_NICRESET", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ dup2, dup39, dup3, @@ -1226,8 +1110,7 @@ match("MESSAGE#33:EVENT_NICRESET", "nwparser.payload", "%{obj_type->} \"%{obj_na var msg37 = msg("EVENT_NICRESET", part57); -var part58 = // "Pattern{Field(obj_type,true), Constant(' '), Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#34:EVENT_ROUTEDOWN", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ +var part58 = match("MESSAGE#34:EVENT_ROUTEDOWN", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ dup11, dup40, dup28, @@ -1238,8 +1121,7 @@ match("MESSAGE#34:EVENT_ROUTEDOWN", "nwparser.payload", "%{obj_type->} %{obj_nam var msg38 = msg("EVENT_ROUTEDOWN", part58); -var part59 = // "Pattern{Field(obj_type,true), Constant(' '), Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#35:EVENT_ROUTEUP", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ +var part59 = match("MESSAGE#35:EVENT_ROUTEUP", "nwparser.payload", "%{obj_type->} %{obj_name->} - State %{event_state}", processor_chain([ dup2, dup40, dup30, @@ -1250,8 +1132,7 @@ match("MESSAGE#35:EVENT_ROUTEUP", "nwparser.payload", "%{obj_type->} %{obj_name- var msg39 = msg("EVENT_ROUTEUP", part59); -var part60 = // "Pattern{Constant('CPU_started '), Field(info,false)}" -match("MESSAGE#36:EVENT_STARTCPU", "nwparser.payload", "CPU_started %{info}", processor_chain([ +var part60 = match("MESSAGE#36:EVENT_STARTCPU", "nwparser.payload", "CPU_started %{info}", processor_chain([ dup2, setc("event_description","CPU Started"), dup3, @@ -1260,8 +1141,7 @@ match("MESSAGE#36:EVENT_STARTCPU", "nwparser.payload", "CPU_started %{info}", pr var msg40 = msg("EVENT_STARTCPU", part60); -var part61 = // "Pattern{Constant('SAVECONFIG '), Field(info,false)}" -match("MESSAGE#37:EVENT_STARTSAVECONFIG", "nwparser.payload", "SAVECONFIG %{info}", processor_chain([ +var part61 = match("MESSAGE#37:EVENT_STARTSAVECONFIG", "nwparser.payload", "SAVECONFIG %{info}", processor_chain([ dup2, setc("event_description","Save configuration started"), dup3, @@ -1270,8 +1150,7 @@ match("MESSAGE#37:EVENT_STARTSAVECONFIG", "nwparser.payload", "SAVECONFIG %{info var msg41 = msg("EVENT_STARTSAVECONFIG", part61); -var part62 = // "Pattern{Constant('System started - '), Field(info,false)}" -match("MESSAGE#38:EVENT_STARTSYS", "nwparser.payload", "System started - %{info}", processor_chain([ +var part62 = match("MESSAGE#38:EVENT_STARTSYS", "nwparser.payload", "System started - %{info}", processor_chain([ dup2, dup34, dup30, @@ -1282,8 +1161,7 @@ match("MESSAGE#38:EVENT_STARTSYS", "nwparser.payload", "System started - %{info} var msg42 = msg("EVENT_STARTSYS", part62); -var part63 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - State '), Field(event_state,false)}" -match("MESSAGE#39:EVENT_STATECHANGE", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ +var part63 = match("MESSAGE#39:EVENT_STATECHANGE", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - State %{event_state}", processor_chain([ dup2, dup34, dup30, @@ -1294,8 +1172,7 @@ match("MESSAGE#39:EVENT_STATECHANGE", "nwparser.payload", "%{obj_type->} \"%{obj var msg43 = msg("EVENT_STATECHANGE", part63); -var part64 = // "Pattern{Field(obj_type,true), Constant(' ('), Field(obj_name,false), Constant(') - '), Field(event_state,true), Constant(' '), Field(info,false)}" -match("MESSAGE#40:EVENT_STATECHANGE_HEARTBEAT", "nwparser.payload", "%{obj_type->} (%{obj_name}) - %{event_state->} %{info}", processor_chain([ +var part64 = match("MESSAGE#40:EVENT_STATECHANGE_HEARTBEAT", "nwparser.payload", "%{obj_type->} (%{obj_name}) - %{event_state->} %{info}", processor_chain([ dup2, setc("event_description","Heartbeat State report"), dup3, @@ -1304,8 +1181,7 @@ match("MESSAGE#40:EVENT_STATECHANGE_HEARTBEAT", "nwparser.payload", "%{obj_type- var msg44 = msg("EVENT_STATECHANGE_HEARTBEAT", part64); -var part65 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('" - '), Field(event_state,true), Constant(' '), Field(info,false)}" -match("MESSAGE#41:EVENT_STATECHANGE:01", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - %{event_state->} %{info}", processor_chain([ +var part65 = match("MESSAGE#41:EVENT_STATECHANGE:01", "nwparser.payload", "%{obj_type->} \"%{obj_name}\" - %{event_state->} %{info}", processor_chain([ dup2, dup4, ])); @@ -1318,8 +1194,7 @@ var select22 = linear_select([ msg45, ]); -var part66 = // "Pattern{Constant('SAVECONFIG'), Field(info,false)}" -match("MESSAGE#42:EVENT_STOPSAVECONFIG", "nwparser.payload", "SAVECONFIG%{info}", processor_chain([ +var part66 = match("MESSAGE#42:EVENT_STOPSAVECONFIG", "nwparser.payload", "SAVECONFIG%{info}", processor_chain([ dup2, dup27, dup28, @@ -1330,8 +1205,7 @@ match("MESSAGE#42:EVENT_STOPSAVECONFIG", "nwparser.payload", "SAVECONFIG%{info}" var msg46 = msg("EVENT_STOPSAVECONFIG", part66); -var part67 = // "Pattern{Constant('System stopped - '), Field(info,false)}" -match("MESSAGE#43:EVENT_STOPSYS", "nwparser.payload", "System stopped - %{info}", processor_chain([ +var part67 = match("MESSAGE#43:EVENT_STOPSYS", "nwparser.payload", "System stopped - %{info}", processor_chain([ dup2, dup34, dup28, @@ -1342,8 +1216,7 @@ match("MESSAGE#43:EVENT_STOPSYS", "nwparser.payload", "System stopped - %{info}" var msg47 = msg("EVENT_STOPSYS", part67); -var part68 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#44:EVENT_UNKNOWN", "nwparser.payload", "info", processor_chain([ +var part68 = match_copy("MESSAGE#44:EVENT_UNKNOWN", "nwparser.payload", "info", processor_chain([ dup11, setc("event_description","Unknown Event"), dup3, @@ -1352,11 +1225,9 @@ match_copy("MESSAGE#44:EVENT_UNKNOWN", "nwparser.payload", "info", processor_cha var msg48 = msg("EVENT_UNKNOWN", part68); -var part69 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' Adding '), Field(p0,false)}" -match("MESSAGE#45:PITBOSS_Message1/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Adding %{p0}"); +var part69 = match("MESSAGE#45:PITBOSS_Message1/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Adding %{p0}"); -var part70 = // "Pattern{Constant('Adding '), Field(p0,false)}" -match("MESSAGE#45:PITBOSS_Message1/1_1", "nwparser.p0", "Adding %{p0}"); +var part70 = match("MESSAGE#45:PITBOSS_Message1/1_1", "nwparser.p0", "Adding %{p0}"); var select23 = linear_select([ part69, @@ -1379,11 +1250,9 @@ var all20 = all_match({ var msg49 = msg("PITBOSS_Message1", all20); -var part71 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' Deleting '), Field(p0,false)}" -match("MESSAGE#46:PITBOSS_Message2/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Deleting %{p0}"); +var part71 = match("MESSAGE#46:PITBOSS_Message2/1_0", "nwparser.p0", "%{fld1->} %{fld10->} Deleting %{p0}"); -var part72 = // "Pattern{Constant('Deleting '), Field(p0,false)}" -match("MESSAGE#46:PITBOSS_Message2/1_1", "nwparser.p0", "Deleting %{p0}"); +var part72 = match("MESSAGE#46:PITBOSS_Message2/1_1", "nwparser.p0", "Deleting %{p0}"); var select24 = linear_select([ part71, @@ -1406,17 +1275,13 @@ var all21 = all_match({ var msg50 = msg("PITBOSS_Message2", all21); -var part73 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#47:PITBOSS_Message3/0", "nwparser.payload", "\"%{fld1->} %{fld10->} %{p0}"); +var part73 = match("MESSAGE#47:PITBOSS_Message3/0", "nwparser.payload", "\"%{fld1->} %{fld10->} %{p0}"); -var part74 = // "Pattern{Constant('Pitboss policy is'), Field(p0,false)}" -match("MESSAGE#47:PITBOSS_Message3/1_0", "nwparser.p0", "Pitboss policy is%{p0}"); +var part74 = match("MESSAGE#47:PITBOSS_Message3/1_0", "nwparser.p0", "Pitboss policy is%{p0}"); -var part75 = // "Pattern{Constant('PB_OP_CHANGE_POLICY new policy'), Field(p0,false)}" -match("MESSAGE#47:PITBOSS_Message3/1_1", "nwparser.p0", "PB_OP_CHANGE_POLICY new policy%{p0}"); +var part75 = match("MESSAGE#47:PITBOSS_Message3/1_1", "nwparser.p0", "PB_OP_CHANGE_POLICY new policy%{p0}"); -var part76 = // "Pattern{Constant('pb_op_longer_hb'), Field(p0,false)}" -match("MESSAGE#47:PITBOSS_Message3/1_2", "nwparser.p0", "pb_op_longer_hb%{p0}"); +var part76 = match("MESSAGE#47:PITBOSS_Message3/1_2", "nwparser.p0", "pb_op_longer_hb%{p0}"); var select25 = linear_select([ part74, @@ -1424,8 +1289,7 @@ var select25 = linear_select([ part76, ]); -var part77 = // "Pattern{Field(,true), Constant(' '), Field(info,false), Constant('"')}" -match("MESSAGE#47:PITBOSS_Message3/2", "nwparser.p0", "%{} %{info}\""); +var part77 = match("MESSAGE#47:PITBOSS_Message3/2", "nwparser.p0", "%{} %{info}\""); var all22 = all_match({ processors: [ @@ -1444,11 +1308,9 @@ var all22 = all_match({ var msg51 = msg("PITBOSS_Message3", all22); -var part78 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' process '), Field(p0,false)}" -match("MESSAGE#48:PITBOSS_Message4/1_0", "nwparser.p0", "%{fld1->} %{fld10->} process %{p0}"); +var part78 = match("MESSAGE#48:PITBOSS_Message4/1_0", "nwparser.p0", "%{fld1->} %{fld10->} process %{p0}"); -var part79 = // "Pattern{Constant('process '), Field(p0,false)}" -match("MESSAGE#48:PITBOSS_Message4/1_1", "nwparser.p0", "process %{p0}"); +var part79 = match("MESSAGE#48:PITBOSS_Message4/1_1", "nwparser.p0", "process %{p0}"); var select26 = linear_select([ part78, @@ -1472,11 +1334,9 @@ var all23 = all_match({ var msg52 = msg("PITBOSS_Message4", all23); -var part80 = // "Pattern{Field(fld1,true), Constant(' '), Field(fld10,true), Constant(' New '), Field(p0,false)}" -match("MESSAGE#49:PITBOSS_Message5/1_0", "nwparser.p0", "%{fld1->} %{fld10->} New %{p0}"); +var part80 = match("MESSAGE#49:PITBOSS_Message5/1_0", "nwparser.p0", "%{fld1->} %{fld10->} New %{p0}"); -var part81 = // "Pattern{Constant('New '), Field(p0,false)}" -match("MESSAGE#49:PITBOSS_Message5/1_1", "nwparser.p0", "New %{p0}"); +var part81 = match("MESSAGE#49:PITBOSS_Message5/1_1", "nwparser.p0", "New %{p0}"); var select27 = linear_select([ part80, @@ -1508,8 +1368,7 @@ var select28 = linear_select([ msg53, ]); -var part82 = // "Pattern{Constant('"IMI: '), Field(event_description,true), Constant(' : nodeID('), Field(fld1,false), Constant(') IP('), Field(saddr,false), Constant(') instance('), Field(fld2,false), Constant(') Configuration Coordinator('), Field(fld3,false), Constant(') Nodeset('), Field(fld4,false), Constant(')"')}" -match("MESSAGE#50:ROUTING_Message", "nwparser.payload", "\"IMI: %{event_description->} : nodeID(%{fld1}) IP(%{saddr}) instance(%{fld2}) Configuration Coordinator(%{fld3}) Nodeset(%{fld4})\"", processor_chain([ +var part82 = match("MESSAGE#50:ROUTING_Message", "nwparser.payload", "\"IMI: %{event_description->} : nodeID(%{fld1}) IP(%{saddr}) instance(%{fld2}) Configuration Coordinator(%{fld3}) Nodeset(%{fld4})\"", processor_chain([ dup9, dup4, ])); @@ -1518,8 +1377,7 @@ var msg54 = msg("ROUTING_Message", part82); var msg55 = msg("ROUTING_Message:01", dup113); -var part83 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' started"')}" -match("MESSAGE#52:ROUTING_Message:02", "nwparser.payload", "\"%{fld1->} started\"", processor_chain([ +var part83 = match("MESSAGE#52:ROUTING_Message:02", "nwparser.payload", "\"%{fld1->} started\"", processor_chain([ dup9, dup4, ])); @@ -1532,8 +1390,7 @@ var select29 = linear_select([ msg56, ]); -var part84 = // "Pattern{Field(obj_type,true), Constant(' Command "'), Field(action,false), Constant('" '), Field(info,false)}" -match("MESSAGE#53:ROUTING_ZEBOS_CMD_EXECUTED", "nwparser.payload", "%{obj_type->} Command \"%{action}\" %{info}", processor_chain([ +var part84 = match("MESSAGE#53:ROUTING_ZEBOS_CMD_EXECUTED", "nwparser.payload", "%{obj_type->} Command \"%{action}\" %{info}", processor_chain([ dup2, setc("event_description","User has executed a command in ZebOS(vtysh)"), dup3, @@ -1542,31 +1399,24 @@ match("MESSAGE#53:ROUTING_ZEBOS_CMD_EXECUTED", "nwparser.payload", "%{obj_type-> var msg57 = msg("ROUTING_ZEBOS_CMD_EXECUTED", part84); -var part85 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,false), Constant('entityName = "'), Field(p0,false)}" -match("MESSAGE#54:SNMP_TRAP_SENT7/0", "nwparser.payload", "%{obj_type->} ( %{space}entityName = \"%{p0}"); +var part85 = match("MESSAGE#54:SNMP_TRAP_SENT7/0", "nwparser.payload", "%{obj_type->} ( %{space}entityName = \"%{p0}"); -var part86 = // "Pattern{Field(obj_name,false), Constant('('), Field(info,false), Constant('...",'), Field(p0,false)}" -match("MESSAGE#54:SNMP_TRAP_SENT7/1_0", "nwparser.p0", "%{obj_name}(%{info}...\",%{p0}"); +var part86 = match("MESSAGE#54:SNMP_TRAP_SENT7/1_0", "nwparser.p0", "%{obj_name}(%{info}...\",%{p0}"); -var part87 = // "Pattern{Field(obj_name,false), Constant('...",'), Field(p0,false)}" -match("MESSAGE#54:SNMP_TRAP_SENT7/1_1", "nwparser.p0", "%{obj_name}...\",%{p0}"); +var part87 = match("MESSAGE#54:SNMP_TRAP_SENT7/1_1", "nwparser.p0", "%{obj_name}...\",%{p0}"); var select30 = linear_select([ part86, part87, ]); -var part88 = // "Pattern{Field(,false), Constant('alarmEntityCurState = '), Field(event_state,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#54:SNMP_TRAP_SENT7/2", "nwparser.p0", "%{}alarmEntityCurState = %{event_state}, %{p0}"); +var part88 = match("MESSAGE#54:SNMP_TRAP_SENT7/2", "nwparser.p0", "%{}alarmEntityCurState = %{event_state}, %{p0}"); -var part89 = // "Pattern{Constant('svcServiceFullName.'), Field(fld2,true), Constant(' = "'), Field(service,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" -match("MESSAGE#54:SNMP_TRAP_SENT7/3_0", "nwparser.p0", "svcServiceFullName.%{fld2->} = \"%{service}\", nsPartitionName = %{fld4})"); +var part89 = match("MESSAGE#54:SNMP_TRAP_SENT7/3_0", "nwparser.p0", "svcServiceFullName.%{fld2->} = \"%{service}\", nsPartitionName = %{fld4})"); -var part90 = // "Pattern{Constant('vsvrFullName.'), Field(fld3,true), Constant(' = "'), Field(obj_server,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" -match("MESSAGE#54:SNMP_TRAP_SENT7/3_1", "nwparser.p0", "vsvrFullName.%{fld3->} = \"%{obj_server}\", nsPartitionName = %{fld4})"); +var part90 = match("MESSAGE#54:SNMP_TRAP_SENT7/3_1", "nwparser.p0", "vsvrFullName.%{fld3->} = \"%{obj_server}\", nsPartitionName = %{fld4})"); -var part91 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(fld6,true), Constant(' = "'), Field(fld7,false), Constant('", nsPartitionName = '), Field(fld4,false), Constant(')')}" -match("MESSAGE#54:SNMP_TRAP_SENT7/3_2", "nwparser.p0", "svcGrpMemberFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld4})"); +var part91 = match("MESSAGE#54:SNMP_TRAP_SENT7/3_2", "nwparser.p0", "svcGrpMemberFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld4})"); var select31 = linear_select([ part89, @@ -1592,8 +1442,7 @@ var all25 = all_match({ var msg58 = msg("SNMP_TRAP_SENT7", all25); -var part92 = // "Pattern{Field(obj_type,true), Constant(' ( entityName = "'), Field(obj_name,false), Constant('...", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#55:SNMP_TRAP_SENT8", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name}...\", sysIpAddress = %{hostip})", processor_chain([ +var part92 = match("MESSAGE#55:SNMP_TRAP_SENT8", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name}...\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup4, @@ -1601,8 +1450,7 @@ match("MESSAGE#55:SNMP_TRAP_SENT8", "nwparser.payload", "%{obj_type->} ( entityN var msg59 = msg("SNMP_TRAP_SENT8", part92); -var part93 = // "Pattern{Field(obj_type,true), Constant(' ( haNicsMonitorFailed = '), Field(obj_name,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#56:SNMP_TRAP_SENT9", "nwparser.payload", "%{obj_type->} ( haNicsMonitorFailed = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ +var part93 = match("MESSAGE#56:SNMP_TRAP_SENT9", "nwparser.payload", "%{obj_type->} ( haNicsMonitorFailed = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup4, @@ -1610,8 +1458,7 @@ match("MESSAGE#56:SNMP_TRAP_SENT9", "nwparser.payload", "%{obj_type->} ( haNicsM var msg60 = msg("SNMP_TRAP_SENT9", part93); -var part94 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,false), Constant('haPeerSystemState = "'), Field(event_state,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#57:SNMP_TRAP_SENT10", "nwparser.payload", "%{obj_type->} ( %{space}haPeerSystemState = \"%{event_state}\", sysIpAddress = %{hostip})", processor_chain([ +var part94 = match("MESSAGE#57:SNMP_TRAP_SENT10", "nwparser.payload", "%{obj_type->} ( %{space}haPeerSystemState = \"%{event_state}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1620,8 +1467,7 @@ match("MESSAGE#57:SNMP_TRAP_SENT10", "nwparser.payload", "%{obj_type->} ( %{spac var msg61 = msg("SNMP_TRAP_SENT10", part94); -var part95 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthDiskName = "'), Field(obj_name,false), Constant('", sysHealthDiskPerusage = '), Field(fld2,false), Constant(', alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#58:SNMP_TRAP_SENT11", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{obj_name}\", sysHealthDiskPerusage = %{fld2}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part95 = match("MESSAGE#58:SNMP_TRAP_SENT11", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{obj_name}\", sysHealthDiskPerusage = %{fld2}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1630,8 +1476,7 @@ match("MESSAGE#58:SNMP_TRAP_SENT11", "nwparser.payload", "%{obj_type->} ( sysHea var msg62 = msg("SNMP_TRAP_SENT11", part95); -var part96 = // "Pattern{Field(obj_type,true), Constant(' ( vsvrName = "'), Field(dclass_counter1_string,false), Constant('", vsvrRequestRate = "'), Field(dclass_counter1,false), Constant('", alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', vsvrFullName = "'), Field(fld1,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#59:SNMP_TRAP_SENT12", "nwparser.payload", "%{obj_type->} ( vsvrName = \"%{dclass_counter1_string}\", vsvrRequestRate = \"%{dclass_counter1}\", alarmHighThreshold = %{dclass_counter2}, vsvrFullName = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ +var part96 = match("MESSAGE#59:SNMP_TRAP_SENT12", "nwparser.payload", "%{obj_type->} ( vsvrName = \"%{dclass_counter1_string}\", vsvrRequestRate = \"%{dclass_counter1}\", alarmHighThreshold = %{dclass_counter2}, vsvrFullName = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1640,8 +1485,7 @@ match("MESSAGE#59:SNMP_TRAP_SENT12", "nwparser.payload", "%{obj_type->} ( vsvrNa var msg63 = msg("SNMP_TRAP_SENT12", part96); -var part97 = // "Pattern{Field(obj_type,true), Constant(' ( monServiceName = "'), Field(fld1,false), Constant('", monitorName = "'), Field(dclass_counter1_string,false), Constant('", responseTimeoutThreshold = '), Field(dclass_counter1,false), Constant(', alarmMonrespto = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#60:SNMP_TRAP_SENT13", "nwparser.payload", "%{obj_type->} ( monServiceName = \"%{fld1}\", monitorName = \"%{dclass_counter1_string}\", responseTimeoutThreshold = %{dclass_counter1}, alarmMonrespto = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part97 = match("MESSAGE#60:SNMP_TRAP_SENT13", "nwparser.payload", "%{obj_type->} ( monServiceName = \"%{fld1}\", monitorName = \"%{dclass_counter1_string}\", responseTimeoutThreshold = %{dclass_counter1}, alarmMonrespto = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1650,8 +1494,7 @@ match("MESSAGE#60:SNMP_TRAP_SENT13", "nwparser.payload", "%{obj_type->} ( monSer var msg64 = msg("SNMP_TRAP_SENT13", part97); -var part98 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmNormalThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#61:SNMP_TRAP_SENT14", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part98 = match("MESSAGE#61:SNMP_TRAP_SENT14", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1660,8 +1503,7 @@ match("MESSAGE#61:SNMP_TRAP_SENT14", "nwparser.payload", "%{obj_type->} ( sysHea var msg65 = msg("SNMP_TRAP_SENT14", part98); -var part99 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmLowThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#62:SNMP_TRAP_SENT15", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmLowThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part99 = match("MESSAGE#62:SNMP_TRAP_SENT15", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmLowThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1670,8 +1512,7 @@ match("MESSAGE#62:SNMP_TRAP_SENT15", "nwparser.payload", "%{obj_type->} ( sysHea var msg66 = msg("SNMP_TRAP_SENT15", part99); -var part100 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthCounterName = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue = '), Field(dclass_counter1,false), Constant(', alarmHighThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#63:SNMP_TRAP_SENT16", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part100 = match("MESSAGE#63:SNMP_TRAP_SENT16", "nwparser.payload", "%{obj_type->} ( sysHealthCounterName = \"%{dclass_counter1_string}\", sysHealthCounterValue = %{dclass_counter1}, alarmHighThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1680,8 +1521,7 @@ match("MESSAGE#63:SNMP_TRAP_SENT16", "nwparser.payload", "%{obj_type->} ( sysHea var msg67 = msg("SNMP_TRAP_SENT16", part100); -var part101 = // "Pattern{Field(obj_type,true), Constant(' ( alarmRateLmtThresholdExceeded = "'), Field(obj_name,false), Constant(': "'), Field(info,false), Constant('...", ipAddressGathered = "'), Field(fld1,false), Constant('", stringComputed = "'), Field(fld2,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#64:SNMP_TRAP_SENT17", "nwparser.payload", "%{obj_type->} ( alarmRateLmtThresholdExceeded = \"%{obj_name}: \"%{info}...\", ipAddressGathered = \"%{fld1}\", stringComputed = \"%{fld2}\", sysIpAddress = %{hostip})", processor_chain([ +var part101 = match("MESSAGE#64:SNMP_TRAP_SENT17", "nwparser.payload", "%{obj_type->} ( alarmRateLmtThresholdExceeded = \"%{obj_name}: \"%{info}...\", ipAddressGathered = \"%{fld1}\", stringComputed = \"%{fld2}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1690,22 +1530,18 @@ match("MESSAGE#64:SNMP_TRAP_SENT17", "nwparser.payload", "%{obj_type->} ( alarmR var msg68 = msg("SNMP_TRAP_SENT17", part101); -var part102 = // "Pattern{Field(obj_type,true), Constant(' ( entityName = "'), Field(obj_name,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#65:SNMP_TRAP_SENT/0", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name->} (%{p0}"); +var part102 = match("MESSAGE#65:SNMP_TRAP_SENT/0", "nwparser.payload", "%{obj_type->} ( entityName = \"%{obj_name->} (%{p0}"); -var part103 = // "Pattern{Field(info,false), Constant('..." '), Field(p0,false)}" -match("MESSAGE#65:SNMP_TRAP_SENT/1_0", "nwparser.p0", "%{info}...\" %{p0}"); +var part103 = match("MESSAGE#65:SNMP_TRAP_SENT/1_0", "nwparser.p0", "%{info}...\" %{p0}"); -var part104 = // "Pattern{Field(info,false), Constant('" '), Field(p0,false)}" -match("MESSAGE#65:SNMP_TRAP_SENT/1_1", "nwparser.p0", "%{info}\" %{p0}"); +var part104 = match("MESSAGE#65:SNMP_TRAP_SENT/1_1", "nwparser.p0", "%{info}\" %{p0}"); var select32 = linear_select([ part103, part104, ]); -var part105 = // "Pattern{Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#65:SNMP_TRAP_SENT/2", "nwparser.p0", ", sysIpAddress = %{hostip})"); +var part105 = match("MESSAGE#65:SNMP_TRAP_SENT/2", "nwparser.p0", ", sysIpAddress = %{hostip})"); var all26 = all_match({ processors: [ @@ -1723,8 +1559,7 @@ var all26 = all_match({ var msg69 = msg("SNMP_TRAP_SENT", all26); -var part106 = // "Pattern{Field(obj_type,true), Constant(' ( appfwLogMsg = '), Field(obj_name,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#66:SNMP_TRAP_SENT6", "nwparser.payload", "%{obj_type->} ( appfwLogMsg = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ +var part106 = match("MESSAGE#66:SNMP_TRAP_SENT6", "nwparser.payload", "%{obj_type->} ( appfwLogMsg = %{obj_name}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1733,37 +1568,28 @@ match("MESSAGE#66:SNMP_TRAP_SENT6", "nwparser.payload", "%{obj_type->} ( appfwLo var msg70 = msg("SNMP_TRAP_SENT6", part106); -var part107 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#67:SNMP_TRAP_SENT5/0", "nwparser.payload", "%{obj_type->} ( %{space->} %{p0}"); +var part107 = match("MESSAGE#67:SNMP_TRAP_SENT5/0", "nwparser.payload", "%{obj_type->} ( %{space->} %{p0}"); -var part108 = // "Pattern{Constant('partition id = '), Field(fld12,false), Constant(', nsUserName = "'), Field(p0,false)}" -match("MESSAGE#67:SNMP_TRAP_SENT5/1_0", "nwparser.p0", "partition id = %{fld12}, nsUserName = \"%{p0}"); +var part108 = match("MESSAGE#67:SNMP_TRAP_SENT5/1_0", "nwparser.p0", "partition id = %{fld12}, nsUserName = \"%{p0}"); -var part109 = // "Pattern{Constant('nsUserName = "'), Field(p0,false)}" -match("MESSAGE#67:SNMP_TRAP_SENT5/1_1", "nwparser.p0", "nsUserName = \"%{p0}"); +var part109 = match("MESSAGE#67:SNMP_TRAP_SENT5/1_1", "nwparser.p0", "nsUserName = \"%{p0}"); var select33 = linear_select([ part108, part109, ]); -var part110 = // "Pattern{Constant('",'), Field(username,true), Constant(' configurationCmd = "'), Field(action,false), Constant('", authorizationStatus = '), Field(event_state,false), Constant(', commandExecutionStatus = '), Field(disposition,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#67:SNMP_TRAP_SENT5/2", "nwparser.p0", "\",%{username->} configurationCmd = \"%{action}\", authorizationStatus = %{event_state}, commandExecutionStatus = %{disposition}, %{p0}"); +var part110 = match("MESSAGE#67:SNMP_TRAP_SENT5/2", "nwparser.p0", "\",%{username->} configurationCmd = \"%{action}\", authorizationStatus = %{event_state}, commandExecutionStatus = %{disposition}, %{p0}"); -var part111 = // "Pattern{Constant('commandFailureReason = "'), Field(result,false), Constant('", nsClientIPAddr = '), Field(saddr,false), Constant(', sysIpAddress ='), Field(hostip,false), Constant(')')}" -match("MESSAGE#67:SNMP_TRAP_SENT5/3_0", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip})"); +var part111 = match("MESSAGE#67:SNMP_TRAP_SENT5/3_0", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip})"); -var part112 = // "Pattern{Constant('commandFailureReason = "'), Field(result,false), Constant('", nsClientIPAddr = '), Field(saddr,false), Constant(', nsPartitionName = '), Field(fld1,false), Constant(')')}" -match("MESSAGE#67:SNMP_TRAP_SENT5/3_1", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); +var part112 = match("MESSAGE#67:SNMP_TRAP_SENT5/3_1", "nwparser.p0", "commandFailureReason = \"%{result}\", nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); -var part113 = // "Pattern{Constant('nsClientIPAddr = '), Field(saddr,false), Constant(', nsPartitionName = '), Field(fld1,false), Constant(')')}" -match("MESSAGE#67:SNMP_TRAP_SENT5/3_2", "nwparser.p0", "nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); +var part113 = match("MESSAGE#67:SNMP_TRAP_SENT5/3_2", "nwparser.p0", "nsClientIPAddr = %{saddr}, nsPartitionName = %{fld1})"); -var part114 = // "Pattern{Constant('nsClientIPAddr = '), Field(saddr,false), Constant(', sysIpAddress ='), Field(hostip,true), Constant(' )')}" -match("MESSAGE#67:SNMP_TRAP_SENT5/3_3", "nwparser.p0", "nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip->} )"); +var part114 = match("MESSAGE#67:SNMP_TRAP_SENT5/3_3", "nwparser.p0", "nsClientIPAddr = %{saddr}, sysIpAddress =%{hostip->} )"); -var part115 = // "Pattern{Constant('sysIpAddress ='), Field(hostip,false), Constant(')')}" -match("MESSAGE#67:SNMP_TRAP_SENT5/3_4", "nwparser.p0", "sysIpAddress =%{hostip})"); +var part115 = match("MESSAGE#67:SNMP_TRAP_SENT5/3_4", "nwparser.p0", "sysIpAddress =%{hostip})"); var select34 = linear_select([ part111, @@ -1790,8 +1616,7 @@ var all27 = all_match({ var msg71 = msg("SNMP_TRAP_SENT5", all27); -var part116 = // "Pattern{Field(obj_type,true), Constant(' ( nsUserName = "'), Field(username,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#68:SNMP_TRAP_SENT1", "nwparser.payload", "%{obj_type->} ( nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ +var part116 = match("MESSAGE#68:SNMP_TRAP_SENT1", "nwparser.payload", "%{obj_type->} ( nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, setf("obj_name","username"), @@ -1801,8 +1626,7 @@ match("MESSAGE#68:SNMP_TRAP_SENT1", "nwparser.payload", "%{obj_type->} ( nsUserN var msg72 = msg("SNMP_TRAP_SENT1", part116); -var part117 = // "Pattern{Field(obj_type,true), Constant(' ( nsCPUusage = '), Field(dclass_counter1,false), Constant(', alarm '), Field(trigger_val,true), Constant(' = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#69:SNMP_TRAP_SENT2", "nwparser.payload", "%{obj_type->} ( nsCPUusage = %{dclass_counter1}, alarm %{trigger_val->} = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part117 = match("MESSAGE#69:SNMP_TRAP_SENT2", "nwparser.payload", "%{obj_type->} ( nsCPUusage = %{dclass_counter1}, alarm %{trigger_val->} = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1811,8 +1635,7 @@ match("MESSAGE#69:SNMP_TRAP_SENT2", "nwparser.payload", "%{obj_type->} ( nsCPUus var msg73 = msg("SNMP_TRAP_SENT2", part117); -var part118 = // "Pattern{Field(obj_type,true), Constant(' ( sysHealthDiskName = "'), Field(filename,false), Constant('", sysHealthDiskPerusage = '), Field(dclass_counter1,false), Constant(', alarmNormalThreshold = '), Field(dclass_counter2,false), Constant(', sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#70:SNMP_TRAP_SENT3", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{filename}\", sysHealthDiskPerusage = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ +var part118 = match("MESSAGE#70:SNMP_TRAP_SENT3", "nwparser.payload", "%{obj_type->} ( sysHealthDiskName = \"%{filename}\", sysHealthDiskPerusage = %{dclass_counter1}, alarmNormalThreshold = %{dclass_counter2}, sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1821,8 +1644,7 @@ match("MESSAGE#70:SNMP_TRAP_SENT3", "nwparser.payload", "%{obj_type->} ( sysHeal var msg74 = msg("SNMP_TRAP_SENT3", part118); -var part119 = // "Pattern{Field(obj_type,true), Constant(' ( sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#71:SNMP_TRAP_SENT4", "nwparser.payload", "%{obj_type->} ( sysIpAddress = %{hostip})", processor_chain([ +var part119 = match("MESSAGE#71:SNMP_TRAP_SENT4", "nwparser.payload", "%{obj_type->} ( sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1831,8 +1653,7 @@ match("MESSAGE#71:SNMP_TRAP_SENT4", "nwparser.payload", "%{obj_type->} ( sysIpAd var msg75 = msg("SNMP_TRAP_SENT4", part119); -var part120 = // "Pattern{Field(obj_type,true), Constant(' (entityName = "'), Field(obj_name,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#72:SNMP_TRAP_SENT18", "nwparser.payload", "%{obj_type->} (entityName = \"%{obj_name}\", sysIpAddress = %{hostip})", processor_chain([ +var part120 = match("MESSAGE#72:SNMP_TRAP_SENT18", "nwparser.payload", "%{obj_type->} (entityName = \"%{obj_name}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup4, @@ -1840,8 +1661,7 @@ match("MESSAGE#72:SNMP_TRAP_SENT18", "nwparser.payload", "%{obj_type->} (entityN var msg76 = msg("SNMP_TRAP_SENT18", part120); -var part121 = // "Pattern{Field(obj_type,true), Constant(' ( '), Field(space,true), Constant(' nsUserName = "'), Field(username,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#73:SNMP_TRAP_SENT19", "nwparser.payload", "%{obj_type->} ( %{space->} nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ +var part121 = match("MESSAGE#73:SNMP_TRAP_SENT19", "nwparser.payload", "%{obj_type->} ( %{space->} nsUserName = \"%{username}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -1850,28 +1670,22 @@ match("MESSAGE#73:SNMP_TRAP_SENT19", "nwparser.payload", "%{obj_type->} ( %{spac var msg77 = msg("SNMP_TRAP_SENT19", part121); -var part122 = // "Pattern{Field(obj_type,true), Constant(' (partition id = '), Field(fld12,false), Constant(', entityName = "'), Field(p0,false)}" -match("MESSAGE#74:SNMP_TRAP_SENT21/0", "nwparser.payload", "%{obj_type->} (partition id = %{fld12}, entityName = \"%{p0}"); +var part122 = match("MESSAGE#74:SNMP_TRAP_SENT21/0", "nwparser.payload", "%{obj_type->} (partition id = %{fld12}, entityName = \"%{p0}"); -var part123 = // "Pattern{Field(obj_name,false), Constant('('), Field(fld4,false), Constant('...", '), Field(p0,false)}" -match("MESSAGE#74:SNMP_TRAP_SENT21/1_0", "nwparser.p0", "%{obj_name}(%{fld4}...\", %{p0}"); +var part123 = match("MESSAGE#74:SNMP_TRAP_SENT21/1_0", "nwparser.p0", "%{obj_name}(%{fld4}...\", %{p0}"); -var part124 = // "Pattern{Field(obj_name,false), Constant('...", '), Field(p0,false)}" -match("MESSAGE#74:SNMP_TRAP_SENT21/1_1", "nwparser.p0", "%{obj_name}...\", %{p0}"); +var part124 = match("MESSAGE#74:SNMP_TRAP_SENT21/1_1", "nwparser.p0", "%{obj_name}...\", %{p0}"); var select35 = linear_select([ part123, part124, ]); -var part125 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,true), Constant(' )')}" -match("MESSAGE#74:SNMP_TRAP_SENT21/2_0", "nwparser.p0", "svcGrpMemberFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); +var part125 = match("MESSAGE#74:SNMP_TRAP_SENT21/2_0", "nwparser.p0", "svcGrpMemberFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); -var part126 = // "Pattern{Constant('vsvrFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,true), Constant(' )')}" -match("MESSAGE#74:SNMP_TRAP_SENT21/2_1", "nwparser.p0", "vsvrFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); +var part126 = match("MESSAGE#74:SNMP_TRAP_SENT21/2_1", "nwparser.p0", "vsvrFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip->} )"); -var part127 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,true), Constant(' )')}" -match("MESSAGE#74:SNMP_TRAP_SENT21/2_2", "nwparser.p0", "sysIpAddress = %{hostip->} )"); +var part127 = match("MESSAGE#74:SNMP_TRAP_SENT21/2_2", "nwparser.p0", "sysIpAddress = %{hostip->} )"); var select36 = linear_select([ part125, @@ -1895,31 +1709,24 @@ var all28 = all_match({ var msg78 = msg("SNMP_TRAP_SENT21", all28); -var part128 = // "Pattern{Field(obj_type,true), Constant(' (entityName = "'), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/0", "nwparser.payload", "%{obj_type->} (entityName = \"%{p0}"); +var part128 = match("MESSAGE#75:SNMP_TRAP_SENT22/0", "nwparser.payload", "%{obj_type->} (entityName = \"%{p0}"); -var part129 = // "Pattern{Field(obj_name,false), Constant('..." '), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/1_0", "nwparser.p0", "%{obj_name}...\" %{p0}"); +var part129 = match("MESSAGE#75:SNMP_TRAP_SENT22/1_0", "nwparser.p0", "%{obj_name}...\" %{p0}"); -var part130 = // "Pattern{Field(obj_name,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/1_1", "nwparser.p0", "%{obj_name}\"%{p0}"); +var part130 = match("MESSAGE#75:SNMP_TRAP_SENT22/1_1", "nwparser.p0", "%{obj_name}\"%{p0}"); var select37 = linear_select([ part129, part130, ]); -var part131 = // "Pattern{Constant(', '), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/2", "nwparser.p0", ", %{p0}"); +var part131 = match("MESSAGE#75:SNMP_TRAP_SENT22/2", "nwparser.p0", ", %{p0}"); -var part132 = // "Pattern{Constant('svcGrpMemberFullName.'), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/3_0", "nwparser.p0", "svcGrpMemberFullName.%{p0}"); +var part132 = match("MESSAGE#75:SNMP_TRAP_SENT22/3_0", "nwparser.p0", "svcGrpMemberFullName.%{p0}"); -var part133 = // "Pattern{Constant('vsvrFullName.'), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/3_1", "nwparser.p0", "vsvrFullName.%{p0}"); +var part133 = match("MESSAGE#75:SNMP_TRAP_SENT22/3_1", "nwparser.p0", "vsvrFullName.%{p0}"); -var part134 = // "Pattern{Constant('svcServiceFullName.'), Field(p0,false)}" -match("MESSAGE#75:SNMP_TRAP_SENT22/3_2", "nwparser.p0", "svcServiceFullName.%{p0}"); +var part134 = match("MESSAGE#75:SNMP_TRAP_SENT22/3_2", "nwparser.p0", "svcServiceFullName.%{p0}"); var select38 = linear_select([ part132, @@ -1927,8 +1734,7 @@ var select38 = linear_select([ part134, ]); -var part135 = // "Pattern{Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", nsPartitionName = '), Field(fld1,false), Constant(')')}" -match("MESSAGE#75:SNMP_TRAP_SENT22/4", "nwparser.p0", "%{fld2->} = \"%{fld3}\", nsPartitionName = %{fld1})"); +var part135 = match("MESSAGE#75:SNMP_TRAP_SENT22/4", "nwparser.p0", "%{fld2->} = \"%{fld3}\", nsPartitionName = %{fld1})"); var all29 = all_match({ processors: [ @@ -1948,8 +1754,7 @@ var all29 = all_match({ var msg79 = msg("SNMP_TRAP_SENT22", all29); -var part136 = // "Pattern{Field(obj_type,true), Constant(' (platformRateLimitPacketDropCount = '), Field(dclass_counter1,false), Constant(', platformLicensedThroughput = '), Field(fld2,false), Constant(', nsPartitionName = '), Field(fld3,false), Constant(')')}" -match("MESSAGE#76:SNMP_TRAP_SENT23", "nwparser.payload", "%{obj_type->} (platformRateLimitPacketDropCount = %{dclass_counter1}, platformLicensedThroughput = %{fld2}, nsPartitionName = %{fld3})", processor_chain([ +var part136 = match("MESSAGE#76:SNMP_TRAP_SENT23", "nwparser.payload", "%{obj_type->} (platformRateLimitPacketDropCount = %{dclass_counter1}, platformLicensedThroughput = %{fld2}, nsPartitionName = %{fld3})", processor_chain([ dup9, dup47, dup10, @@ -1958,8 +1763,7 @@ match("MESSAGE#76:SNMP_TRAP_SENT23", "nwparser.payload", "%{obj_type->} (platfor var msg80 = msg("SNMP_TRAP_SENT23", part136); -var part137 = // "Pattern{Field(obj_type,true), Constant(' (vsvrName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", vsvrCurSoValue = '), Field(fld4,false), Constant(', vsvrSoMethod = "'), Field(fld5,false), Constant('", vsvrSoThresh = "'), Field(info,false), Constant('", vsvrFullName.'), Field(fld6,true), Constant(' = "'), Field(fld7,false), Constant('", nsPartitionName = '), Field(fld8,false), Constant(')')}" -match("MESSAGE#77:SNMP_TRAP_SENT24", "nwparser.payload", "%{obj_type->} (vsvrName.%{fld2->} = \"%{fld3}\", vsvrCurSoValue = %{fld4}, vsvrSoMethod = \"%{fld5}\", vsvrSoThresh = \"%{info}\", vsvrFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld8})", processor_chain([ +var part137 = match("MESSAGE#77:SNMP_TRAP_SENT24", "nwparser.payload", "%{obj_type->} (vsvrName.%{fld2->} = \"%{fld3}\", vsvrCurSoValue = %{fld4}, vsvrSoMethod = \"%{fld5}\", vsvrSoThresh = \"%{info}\", vsvrFullName.%{fld6->} = \"%{fld7}\", nsPartitionName = %{fld8})", processor_chain([ dup9, dup47, dup10, @@ -1968,25 +1772,20 @@ match("MESSAGE#77:SNMP_TRAP_SENT24", "nwparser.payload", "%{obj_type->} (vsvrNam var msg81 = msg("SNMP_TRAP_SENT24", part137); -var part138 = // "Pattern{Field(obj_type,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#78:SNMP_TRAP_SENT25/0", "nwparser.payload", "%{obj_type->} (%{p0}"); +var part138 = match("MESSAGE#78:SNMP_TRAP_SENT25/0", "nwparser.payload", "%{obj_type->} (%{p0}"); -var part139 = // "Pattern{Constant('partition id = '), Field(fld12,false), Constant(', sslCertKeyName.'), Field(p0,false)}" -match("MESSAGE#78:SNMP_TRAP_SENT25/1_0", "nwparser.p0", "partition id = %{fld12}, sslCertKeyName.%{p0}"); +var part139 = match("MESSAGE#78:SNMP_TRAP_SENT25/1_0", "nwparser.p0", "partition id = %{fld12}, sslCertKeyName.%{p0}"); -var part140 = // "Pattern{Constant(' sslCertKeyName.'), Field(p0,false)}" -match("MESSAGE#78:SNMP_TRAP_SENT25/1_1", "nwparser.p0", " sslCertKeyName.%{p0}"); +var part140 = match("MESSAGE#78:SNMP_TRAP_SENT25/1_1", "nwparser.p0", " sslCertKeyName.%{p0}"); var select39 = linear_select([ part139, part140, ]); -var part141 = // "Pattern{Constant('",'), Field(fld2,true), Constant(' = "'), Field(fld1,true), Constant(' sslDaysToExpire.'), Field(fld3,true), Constant(' = '), Field(dclass_counter1,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#78:SNMP_TRAP_SENT25/2", "nwparser.p0", "\",%{fld2->} = \"%{fld1->} sslDaysToExpire.%{fld3->} = %{dclass_counter1}, %{p0}"); +var part141 = match("MESSAGE#78:SNMP_TRAP_SENT25/2", "nwparser.p0", "\",%{fld2->} = \"%{fld1->} sslDaysToExpire.%{fld3->} = %{dclass_counter1}, %{p0}"); -var part142 = // "Pattern{Constant('nsPartitionName = '), Field(fld4,false), Constant(')')}" -match("MESSAGE#78:SNMP_TRAP_SENT25/3_0", "nwparser.p0", "nsPartitionName = %{fld4})"); +var part142 = match("MESSAGE#78:SNMP_TRAP_SENT25/3_0", "nwparser.p0", "nsPartitionName = %{fld4})"); var select40 = linear_select([ part142, @@ -2010,8 +1809,7 @@ var all30 = all_match({ var msg82 = msg("SNMP_TRAP_SENT25", all30); -var part143 = // "Pattern{Field(obj_type,true), Constant(' (nsUserName = "'), Field(username,false), Constant('", nsPartitionName = '), Field(fld1,false), Constant(')')}" -match("MESSAGE#79:SNMP_TRAP_SENT26", "nwparser.payload", "%{obj_type->} (nsUserName = \"%{username}\", nsPartitionName = %{fld1})", processor_chain([ +var part143 = match("MESSAGE#79:SNMP_TRAP_SENT26", "nwparser.payload", "%{obj_type->} (nsUserName = \"%{username}\", nsPartitionName = %{fld1})", processor_chain([ dup9, dup47, dup4, @@ -2019,8 +1817,7 @@ match("MESSAGE#79:SNMP_TRAP_SENT26", "nwparser.payload", "%{obj_type->} (nsUserN var msg83 = msg("SNMP_TRAP_SENT26", part143); -var part144 = // "Pattern{Field(info,true), Constant(' (sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#80:SNMP_TRAP_SENT20", "nwparser.payload", "%{info->} (sysIpAddress = %{hostip})", processor_chain([ +var part144 = match("MESSAGE#80:SNMP_TRAP_SENT20", "nwparser.payload", "%{info->} (sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -2029,8 +1826,7 @@ match("MESSAGE#80:SNMP_TRAP_SENT20", "nwparser.payload", "%{info->} (sysIpAddres var msg84 = msg("SNMP_TRAP_SENT20", part144); -var part145 = // "Pattern{Field(obj_type,false), Constant('(lldpRemLocalPortNum.'), Field(fld1,false), Constant('= "'), Field(fld5,false), Constant('", lldpRemChassisId.'), Field(fld2,false), Constant('= "'), Field(dmacaddr,false), Constant('", lldpRemPortId.'), Field(fld3,false), Constant('= "'), Field(dinterface,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" -match("MESSAGE#81:SNMP_TRAP_SENT28", "nwparser.payload", "%{obj_type}(lldpRemLocalPortNum.%{fld1}= \"%{fld5}\", lldpRemChassisId.%{fld2}= \"%{dmacaddr}\", lldpRemPortId.%{fld3}= \"%{dinterface}\", sysIpAddress =%{hostip})", processor_chain([ +var part145 = match("MESSAGE#81:SNMP_TRAP_SENT28", "nwparser.payload", "%{obj_type}(lldpRemLocalPortNum.%{fld1}= \"%{fld5}\", lldpRemChassisId.%{fld2}= \"%{dmacaddr}\", lldpRemPortId.%{fld3}= \"%{dinterface}\", sysIpAddress =%{hostip})", processor_chain([ dup9, dup47, dup10, @@ -2039,8 +1835,7 @@ match("MESSAGE#81:SNMP_TRAP_SENT28", "nwparser.payload", "%{obj_type}(lldpRemLoc var msg85 = msg("SNMP_TRAP_SENT28", part145); -var part146 = // "Pattern{Field(obj_type,false), Constant('(haNicMonitorSucceeded = "'), Field(fld1,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" -match("MESSAGE#82:SNMP_TRAP_SENT29", "nwparser.payload", "%{obj_type}(haNicMonitorSucceeded = \"%{fld1}\", sysIpAddress =%{hostip})", processor_chain([ +var part146 = match("MESSAGE#82:SNMP_TRAP_SENT29", "nwparser.payload", "%{obj_type}(haNicMonitorSucceeded = \"%{fld1}\", sysIpAddress =%{hostip})", processor_chain([ dup9, dup47, dup10, @@ -2049,8 +1844,7 @@ match("MESSAGE#82:SNMP_TRAP_SENT29", "nwparser.payload", "%{obj_type}(haNicMonit var msg86 = msg("SNMP_TRAP_SENT29", part146); -var part147 = // "Pattern{Field(fld1,false), Constant(':StatusPoll:'), Field(fld2,true), Constant(' - Device State changed to '), Field(disposition,true), Constant(' for '), Field(saddr,false)}" -match("MESSAGE#83:SNMP_TRAP_SENT:04", "nwparser.payload", "%{fld1}:StatusPoll:%{fld2->} - Device State changed to %{disposition->} for %{saddr}", processor_chain([ +var part147 = match("MESSAGE#83:SNMP_TRAP_SENT:04", "nwparser.payload", "%{fld1}:StatusPoll:%{fld2->} - Device State changed to %{disposition->} for %{saddr}", processor_chain([ dup9, dup4, setc("event_description","Device State changed"), @@ -2060,14 +1854,11 @@ var msg87 = msg("SNMP_TRAP_SENT:04", part147); var msg88 = msg("SNMP_TRAP_SENT:05", dup101); -var part148 = // "Pattern{Field(obj_type,true), Constant(' (appfwLogMsg = "'), Field(obj_name,true), Constant(' '), Field(info,false), Constant('",'), Field(p0,false)}" -match("MESSAGE#136:SNMP_TRAP_SENT:01/0", "nwparser.payload", "%{obj_type->} (appfwLogMsg = \"%{obj_name->} %{info}\",%{p0}"); +var part148 = match("MESSAGE#136:SNMP_TRAP_SENT:01/0", "nwparser.payload", "%{obj_type->} (appfwLogMsg = \"%{obj_name->} %{info}\",%{p0}"); -var part149 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false)}" -match("MESSAGE#136:SNMP_TRAP_SENT:01/1_0", "nwparser.p0", "sysIpAddress = %{hostip}"); +var part149 = match("MESSAGE#136:SNMP_TRAP_SENT:01/1_0", "nwparser.p0", "sysIpAddress = %{hostip}"); -var part150 = // "Pattern{Constant('nsPartitionName ='), Field(fld1,false)}" -match("MESSAGE#136:SNMP_TRAP_SENT:01/1_1", "nwparser.p0", "nsPartitionName =%{fld1}"); +var part150 = match("MESSAGE#136:SNMP_TRAP_SENT:01/1_1", "nwparser.p0", "nsPartitionName =%{fld1}"); var select41 = linear_select([ part149, @@ -2089,8 +1880,7 @@ var all31 = all_match({ var msg89 = msg("SNMP_TRAP_SENT:01", all31); -var part151 = // "Pattern{Field(obj_type,true), Constant(' (haNicsMonitorFailed = "'), Field(fld1,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#143:SNMP_TRAP_SENT:02", "nwparser.payload", "%{obj_type->} (haNicsMonitorFailed = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ +var part151 = match("MESSAGE#143:SNMP_TRAP_SENT:02", "nwparser.payload", "%{obj_type->} (haNicsMonitorFailed = \"%{fld1}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -2099,8 +1889,7 @@ match("MESSAGE#143:SNMP_TRAP_SENT:02", "nwparser.payload", "%{obj_type->} (haNic var msg90 = msg("SNMP_TRAP_SENT:02", part151); -var part152 = // "Pattern{Field(obj_type,true), Constant(' (partition id = '), Field(fld1,false), Constant(', entityName = "'), Field(obj_name,false), Constant('('), Field(fld31,false), Constant('", svcServiceFullName.'), Field(fld2,true), Constant(' = "'), Field(fld3,false), Constant('", sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#178:SNMP_TRAP_SENT27", "nwparser.payload", "%{obj_type->} (partition id = %{fld1}, entityName = \"%{obj_name}(%{fld31}\", svcServiceFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip})", processor_chain([ +var part152 = match("MESSAGE#178:SNMP_TRAP_SENT27", "nwparser.payload", "%{obj_type->} (partition id = %{fld1}, entityName = \"%{obj_name}(%{fld31}\", svcServiceFullName.%{fld2->} = \"%{fld3}\", sysIpAddress = %{hostip})", processor_chain([ dup9, dup47, dup10, @@ -2109,8 +1898,7 @@ match("MESSAGE#178:SNMP_TRAP_SENT27", "nwparser.payload", "%{obj_type->} (partit var msg91 = msg("SNMP_TRAP_SENT27", part152); -var part153 = // "Pattern{Field(obj_type,false), Constant('(sysHealthCounterName.PowerSupply1Status = "'), Field(dclass_counter1_string,false), Constant('", sysHealthCounterValue.PowerSupply1Status = '), Field(dclass_counter1,false), Constant(', sysHealthPowerSupplyStatus = "'), Field(result,false), Constant('", sysIpAddress ='), Field(hostip,false), Constant(')')}" -match("MESSAGE#179:SNMP_TRAP_SENT:03", "nwparser.payload", "%{obj_type}(sysHealthCounterName.PowerSupply1Status = \"%{dclass_counter1_string}\", sysHealthCounterValue.PowerSupply1Status = %{dclass_counter1}, sysHealthPowerSupplyStatus = \"%{result}\", sysIpAddress =%{hostip})", processor_chain([ +var part153 = match("MESSAGE#179:SNMP_TRAP_SENT:03", "nwparser.payload", "%{obj_type}(sysHealthCounterName.PowerSupply1Status = \"%{dclass_counter1_string}\", sysHealthCounterValue.PowerSupply1Status = %{dclass_counter1}, sysHealthPowerSupplyStatus = \"%{result}\", sysIpAddress =%{hostip})", processor_chain([ dup9, dup47, dup4, @@ -2156,8 +1944,7 @@ var select42 = linear_select([ msg92, ]); -var part154 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Client IP '), Field(hostip,true), Constant(' - Vserver '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Client_security_expression "CLIENT.REG(''), Field(info,false), Constant('').VALUE == '), Field(trigger_val,true), Constant(' || '), Field(change_new,true), Constant(' - '), Field(result,false)}" -match("MESSAGE#85:SSLVPN_CLISEC_CHECK", "nwparser.payload", "User %{username->} - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client_security_expression \"CLIENT.REG('%{info}').VALUE == %{trigger_val->} || %{change_new->} - %{result}", processor_chain([ +var part154 = match("MESSAGE#85:SSLVPN_CLISEC_CHECK", "nwparser.payload", "User %{username->} - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client_security_expression \"CLIENT.REG('%{info}').VALUE == %{trigger_val->} || %{change_new->} - %{result}", processor_chain([ dup9, dup47, dup4, @@ -2165,16 +1952,14 @@ match("MESSAGE#85:SSLVPN_CLISEC_CHECK", "nwparser.payload", "User %{username->} var msg93 = msg("SSLVPN_CLISEC_CHECK", part154); -var part155 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - ClientIP '), Field(p0,false)}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_1", "nwparser.p0", "SPCBId %{sessionid->} - ClientIP %{p0}"); +var part155 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_1", "nwparser.p0", "SPCBId %{sessionid->} - ClientIP %{p0}"); var select43 = linear_select([ dup49, part155, ]); -var part156 = // "Pattern{Field(,true), Constant(' '), Field(saddr,false), Constant('- ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - Reason "'), Field(result,false), Constant('"')}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/2", "nwparser.p0", "%{} %{saddr}- ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Reason \"%{result}\""); +var part156 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/2", "nwparser.p0", "%{} %{saddr}- ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Reason \"%{result}\""); var all32 = all_match({ processors: [ @@ -2194,16 +1979,14 @@ var all32 = all_match({ var msg94 = msg("SSLLOG_SSL_HANDSHAKE_FAILURE", all32); -var part157 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' ClientIP '), Field(p0,false)}" -match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/1_0", "nwparser.p0", "SPCBId %{sessionid->} ClientIP %{p0}"); +var part157 = match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/1_0", "nwparser.p0", "SPCBId %{sessionid->} ClientIP %{p0}"); var select44 = linear_select([ part157, dup49, ]); -var part158 = // "Pattern{Constant(''), Field(saddr,true), Constant(' - ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - Session '), Field(info,false)}" -match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/2", "nwparser.p0", "%{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Session %{info}"); +var part158 = match("MESSAGE#87:SSLLOG_SSL_HANDSHAKE_SUCCESS/2", "nwparser.p0", "%{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - Session %{info}"); var all33 = all_match({ processors: [ @@ -2223,8 +2006,7 @@ var all33 = all_match({ var msg95 = msg("SSLLOG_SSL_HANDSHAKE_SUCCESS", all33); -var part159 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - SubjectName "'), Field(cert_subject,false), Constant('"')}" -match("MESSAGE#88:SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", "nwparser.payload", "SPCBId %{sessionid->} - SubjectName \"%{cert_subject}\"", processor_chain([ +var part159 = match("MESSAGE#88:SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", "nwparser.payload", "SPCBId %{sessionid->} - SubjectName \"%{cert_subject}\"", processor_chain([ dup9, dup41, dup50, @@ -2232,8 +2014,7 @@ match("MESSAGE#88:SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", "nwparser.payload", "SPCBId var msg96 = msg("SSLLOG_SSL_HANDSHAKE_SUBJECTNAME", part159); -var part160 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - IssuerName "'), Field(fld1,false), Constant('"')}" -match("MESSAGE#89:SSLLOG_SSL_HANDSHAKE_ISSUERNAME", "nwparser.payload", "SPCBId %{sessionid->} - IssuerName \"%{fld1}\"", processor_chain([ +var part160 = match("MESSAGE#89:SSLLOG_SSL_HANDSHAKE_ISSUERNAME", "nwparser.payload", "SPCBId %{sessionid->} - IssuerName \"%{fld1}\"", processor_chain([ dup9, dup41, dup50, @@ -2241,8 +2022,7 @@ match("MESSAGE#89:SSLLOG_SSL_HANDSHAKE_ISSUERNAME", "nwparser.payload", "SPCBId var msg97 = msg("SSLLOG_SSL_HANDSHAKE_ISSUERNAME", part160); -var part161 = // "Pattern{Constant('Extracted_groups "'), Field(group,false), Constant('"')}" -match("MESSAGE#90:SSLVPN_AAAEXTRACTED_GROUPS", "nwparser.payload", "Extracted_groups \"%{group}\"", processor_chain([ +var part161 = match("MESSAGE#90:SSLVPN_AAAEXTRACTED_GROUPS", "nwparser.payload", "Extracted_groups \"%{group}\"", processor_chain([ dup2, setc("event_description","The groups extracted after user logs into SSLVPN"), dup3, @@ -2251,22 +2031,18 @@ match("MESSAGE#90:SSLVPN_AAAEXTRACTED_GROUPS", "nwparser.payload", "Extracted_gr var msg98 = msg("SSLVPN_AAAEXTRACTED_GROUPS", part161); -var part162 = // "Pattern{Constant('User '), Field(username,true), Constant(' : - Client IP '), Field(hostip,true), Constant(' - Vserver '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Client security expression CLIENT.REG(''), Field(info,false), Constant('') '), Field(p0,false)}" -match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/0", "nwparser.payload", "User %{username->} : - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client security expression CLIENT.REG('%{info}') %{p0}"); +var part162 = match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/0", "nwparser.payload", "User %{username->} : - Client IP %{hostip->} - Vserver %{saddr}:%{sport->} - Client security expression CLIENT.REG('%{info}') %{p0}"); -var part163 = // "Pattern{Constant('EXISTS '), Field(p0,false)}" -match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_0", "nwparser.p0", "EXISTS %{p0}"); +var part163 = match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_0", "nwparser.p0", "EXISTS %{p0}"); -var part164 = // "Pattern{Constant('.VALUE == '), Field(trigger_val,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_1", "nwparser.p0", ".VALUE == %{trigger_val->} %{p0}"); +var part164 = match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/1_1", "nwparser.p0", ".VALUE == %{trigger_val->} %{p0}"); var select45 = linear_select([ part163, part164, ]); -var part165 = // "Pattern{Constant('evaluated to '), Field(change_new,false), Constant('('), Field(ntype,false), Constant(')')}" -match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/2", "nwparser.p0", "evaluated to %{change_new}(%{ntype})"); +var part165 = match("MESSAGE#91:SSLVPN_CLISEC_EXP_EVAL/2", "nwparser.p0", "evaluated to %{change_new}(%{ntype})"); var all34 = all_match({ processors: [ @@ -2284,47 +2060,38 @@ var all34 = all_match({ var msg99 = msg("SSLVPN_CLISEC_EXP_EVAL", all34); -var part166 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - %{p0}"); +var part166 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - %{p0}"); -var part167 = // "Pattern{Constant('SessionId: '), Field(sessionid,true), Constant(' User '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_0", "nwparser.p0", "SessionId: %{sessionid->} User %{p0}"); +var part167 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_0", "nwparser.p0", "SessionId: %{sessionid->} User %{p0}"); -var part168 = // "Pattern{Field(fld5,true), Constant(' User '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_1", "nwparser.p0", "%{fld5->} User %{p0}"); +var part168 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/1_1", "nwparser.p0", "%{fld5->} User %{p0}"); var select46 = linear_select([ part167, part168, ]); -var part169 = // "Pattern{Field(username,true), Constant(' : Group(s) '), Field(group,true), Constant(' : '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/2", "nwparser.p0", "%{username->} : Group(s) %{group->} : %{p0}"); +var part169 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/2", "nwparser.p0", "%{username->} : Group(s) %{group->} : %{p0}"); -var part170 = // "Pattern{Constant('Vserver '), Field(hostip,true), Constant(' - '), Field(fld6,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_0", "nwparser.p0", "Vserver %{hostip->} - %{fld6->} %{p0}"); +var part170 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_0", "nwparser.p0", "Vserver %{hostip->} - %{fld6->} %{p0}"); -var part171 = // "Pattern{Constant('- '), Field(fld7,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_1", "nwparser.p0", "- %{fld7->} %{p0}"); +var part171 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/3_1", "nwparser.p0", "- %{fld7->} %{p0}"); var select47 = linear_select([ part170, part171, ]); -var part172 = // "Pattern{Constant('GMT '), Field(web_method,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_0", "nwparser.p0", "GMT %{web_method->} %{p0}"); +var part172 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_0", "nwparser.p0", "GMT %{web_method->} %{p0}"); -var part173 = // "Pattern{Field(web_method,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_1", "nwparser.p0", "%{web_method->} %{p0}"); +var part173 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/4_1", "nwparser.p0", "%{web_method->} %{p0}"); var select48 = linear_select([ part172, part173, ]); -var part174 = // "Pattern{Field(url,true), Constant(' '), Field(fld8,false)}" -match("MESSAGE#92:SSLVPN_HTTPREQUEST/5", "nwparser.p0", "%{url->} %{fld8}"); +var part174 = match("MESSAGE#92:SSLVPN_HTTPREQUEST/5", "nwparser.p0", "%{url->} %{fld8}"); var all35 = all_match({ processors: [ @@ -2346,11 +2113,9 @@ var all35 = all_match({ var msg100 = msg("SSLVPN_HTTPREQUEST", all35); -var part175 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); +var part175 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); -var part176 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2}"); +var part176 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2}"); var all36 = all_match({ processors: [ @@ -2373,17 +2138,13 @@ var all36 = all_match({ var msg101 = msg("SSLVPN_ICAEND_CONNSTAT", all36); -var part177 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - username:domainname '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - startTime '), Field(p0,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - startTime %{p0}"); +var part177 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - startTime %{p0}"); -var part178 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - endTime '), Field(p0,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - endTime %{p0}"); +var part178 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - endTime %{p0}"); -var part179 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - endTime '), Field(p0,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_1", "nwparser.p0", "\" %{fld10}\" - endTime %{p0}"); +var part179 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_1", "nwparser.p0", "\" %{fld10}\" - endTime %{p0}"); -var part180 = // "Pattern{Field(fld10,true), Constant(' - endTime '), Field(p0,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_2", "nwparser.p0", "%{fld10->} - endTime %{p0}"); +var part180 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/1_2", "nwparser.p0", "%{fld10->} - endTime %{p0}"); var select49 = linear_select([ part178, @@ -2391,14 +2152,11 @@ var select49 = linear_select([ part180, ]); -var part181 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} %{p0}"); +var part181 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/3", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} %{p0}"); -var part182 = // "Pattern{Constant('- connectionId '), Field(connectionid,false)}" -match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_0", "nwparser.p0", "- connectionId %{connectionid}"); +var part182 = match("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_0", "nwparser.p0", "- connectionId %{connectionid}"); -var part183 = // "Pattern{Field(fld2,false)}" -match_copy("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_1", "nwparser.p0", "fld2"); +var part183 = match_copy("MESSAGE#139:SSLVPN_ICAEND_CONNSTAT:01/4_1", "nwparser.p0", "fld2"); var select50 = linear_select([ part182, @@ -2432,8 +2190,7 @@ var select51 = linear_select([ msg102, ]); -var part184 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Browser_type '), Field(fld2,true), Constant(' - SSLVPN_client_type '), Field(info,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#94:SSLVPN_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{fld2->} - SSLVPN_client_type %{info->} - Group(s) \"%{group}\""); +var part184 = match("MESSAGE#94:SSLVPN_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{fld2->} - SSLVPN_client_type %{info->} - Group(s) \"%{group}\""); var all38 = all_match({ processors: [ @@ -2455,8 +2212,7 @@ var all38 = all_match({ var msg103 = msg("SSLVPN_LOGIN", all38); -var part185 = // "Pattern{Field(duration_string,true), Constant(' - Http_resources_accessed '), Field(fld3,true), Constant(' - NonHttp_services_accessed '), Field(fld4,true), Constant(' - Total_TCP_connections '), Field(fld5,true), Constant(' - Total_UDP_flows '), Field(fld6,true), Constant(' - Total_policies_allowed '), Field(fld7,true), Constant(' - Total_policies_denied '), Field(fld8,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - LogoutMethod "'), Field(result,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#95:SSLVPN_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - NonHttp_services_accessed %{fld4->} - Total_TCP_connections %{fld5->} - Total_UDP_flows %{fld6->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); +var part185 = match("MESSAGE#95:SSLVPN_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - NonHttp_services_accessed %{fld4->} - Total_TCP_connections %{fld5->} - Total_UDP_flows %{fld6->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); var all39 = all_match({ processors: [ @@ -2486,8 +2242,7 @@ var all39 = all_match({ var msg104 = msg("SSLVPN_LOGOUT", all39); -var part186 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Last_contact '), Field(fld2,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#96:SSLVPN_TCPCONN_TIMEDOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Last_contact %{fld2->} - Group(s) \"%{group}\""); +var part186 = match("MESSAGE#96:SSLVPN_TCPCONN_TIMEDOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Last_contact %{fld2->} - Group(s) \"%{group}\""); var all40 = all_match({ processors: [ @@ -2509,11 +2264,9 @@ var all40 = all_match({ var msg105 = msg("SSLVPN_TCPCONN_TIMEDOUT", all40); -var part187 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" -match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); +var part187 = match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); -var part188 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Access '), Field(disposition,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Access %{disposition->} - Group(s) \"%{group}\""); +var part188 = match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Access %{disposition->} - Group(s) \"%{group}\""); var all41 = all_match({ processors: [ @@ -2536,8 +2289,7 @@ var all41 = all_match({ var msg106 = msg("SSLVPN_UDPFLOWSTAT", all41); -var part189 = // "Pattern{Constant('Server port = '), Field(dport,true), Constant(' - Server server ip = '), Field(daddr,true), Constant(' - username:domain_name = '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - application name = '), Field(application,false)}" -match("MESSAGE#98:SSLVPN_ICASTART", "nwparser.payload", "Server port = %{dport->} - Server server ip = %{daddr->} - username:domain_name = %{username}:%{ddomain->} - application name = %{application}", processor_chain([ +var part189 = match("MESSAGE#98:SSLVPN_ICASTART", "nwparser.payload", "Server port = %{dport->} - Server server ip = %{daddr->} - username:domain_name = %{username}:%{ddomain->} - application name = %{application}", processor_chain([ dup69, setc("event_description","ICA started"), dup3, @@ -2546,17 +2298,13 @@ match("MESSAGE#98:SSLVPN_ICASTART", "nwparser.payload", "Server port = %{dport-> var msg107 = msg("SSLVPN_ICASTART", part189); -var part190 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - username:domainname '), Field(username,false), Constant(':'), Field(ddomain,true), Constant(' - applicationName '), Field(application,true), Constant(' - startTime '), Field(p0,false)}" -match("MESSAGE#99:SSLVPN_ICASTART:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - applicationName %{application->} - startTime %{p0}"); +var part190 = match("MESSAGE#99:SSLVPN_ICASTART:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - username:domainname %{username}:%{ddomain->} - applicationName %{application->} - startTime %{p0}"); -var part191 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - connectionId '), Field(p0,false)}" -match("MESSAGE#99:SSLVPN_ICASTART:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - connectionId %{p0}"); +var part191 = match("MESSAGE#99:SSLVPN_ICASTART:01/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - connectionId %{p0}"); -var part192 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - connectionId '), Field(p0,false)}" -match("MESSAGE#99:SSLVPN_ICASTART:01/1_1", "nwparser.p0", "\" %{fld10}\" - connectionId %{p0}"); +var part192 = match("MESSAGE#99:SSLVPN_ICASTART:01/1_1", "nwparser.p0", "\" %{fld10}\" - connectionId %{p0}"); -var part193 = // "Pattern{Field(fld10,true), Constant(' - connectionId '), Field(p0,false)}" -match("MESSAGE#99:SSLVPN_ICASTART:01/1_2", "nwparser.p0", "%{fld10->} - connectionId %{p0}"); +var part193 = match("MESSAGE#99:SSLVPN_ICASTART:01/1_2", "nwparser.p0", "%{fld10->} - connectionId %{p0}"); var select52 = linear_select([ part191, @@ -2564,8 +2312,7 @@ var select52 = linear_select([ part193, ]); -var part194 = // "Pattern{Field(fld5,false)}" -match_copy("MESSAGE#99:SSLVPN_ICASTART:01/2", "nwparser.p0", "fld5"); +var part194 = match_copy("MESSAGE#99:SSLVPN_ICASTART:01/2", "nwparser.p0", "fld5"); var all42 = all_match({ processors: [ @@ -2587,14 +2334,11 @@ var select53 = linear_select([ msg108, ]); -var part195 = // "Pattern{Field(action,false), Constant(': '), Field(fld1,true), Constant(' "')}" -match("MESSAGE#100:SSLVPN_Message/1_0", "nwparser.p0", "%{action}: %{fld1->} \""); +var part195 = match("MESSAGE#100:SSLVPN_Message/1_0", "nwparser.p0", "%{action}: %{fld1->} \""); -var part196 = // "Pattern{Field(action,true), Constant(' '), Field(fld1,false), Constant('"')}" -match("MESSAGE#100:SSLVPN_Message/1_1", "nwparser.p0", "%{action->} %{fld1}\""); +var part196 = match("MESSAGE#100:SSLVPN_Message/1_1", "nwparser.p0", "%{action->} %{fld1}\""); -var part197 = // "Pattern{Field(action,false), Constant(': '), Field(fld1,false)}" -match("MESSAGE#100:SSLVPN_Message/1_2", "nwparser.p0", "%{action}: %{fld1}"); +var part197 = match("MESSAGE#100:SSLVPN_Message/1_2", "nwparser.p0", "%{action}: %{fld1}"); var select54 = linear_select([ part195, @@ -2617,11 +2361,9 @@ var all43 = all_match({ var msg109 = msg("SSLVPN_Message", all43); -var part198 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(stransaddr,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start_time '), Field(p0,false)}" -match("MESSAGE#101:SSLVPN_TCPCONNSTAT/2", "nwparser.p0", "%{} %{username}- Client_ip %{hostip->} - Nat_ip %{stransaddr->} - Vserver %{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); +var part198 = match("MESSAGE#101:SSLVPN_TCPCONNSTAT/2", "nwparser.p0", "%{} %{username}- Client_ip %{hostip->} - Nat_ip %{stransaddr->} - Vserver %{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Start_time %{p0}"); -var part199 = // "Pattern{Field(duration_string,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(comp_sbytes,true), Constant(' - Total_compressedbytes_recv '), Field(comp_rbytes,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - Access '), Field(disposition,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#101:SSLVPN_TCPCONNSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - Access %{disposition->} - Group(s) \"%{group}\""); +var part199 = match("MESSAGE#101:SSLVPN_TCPCONNSTAT/5", "nwparser.p0", "%{duration_string->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{comp_sbytes->} - Total_compressedbytes_recv %{comp_rbytes->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - Access %{disposition->} - Group(s) \"%{group}\""); var all44 = all_match({ processors: [ @@ -2686,8 +2428,7 @@ var all46 = all_match({ var msg112 = msg("TCP_CONN_TERMINATE", all46); -var part200 = // "Pattern{Constant('Source '), Field(saddr,false), Constant('Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" -match("MESSAGE#140:TCP_CONN_TERMINATE:01", "nwparser.payload", "Source %{saddr}Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes}", processor_chain([ +var part200 = match("MESSAGE#140:TCP_CONN_TERMINATE:01", "nwparser.payload", "Source %{saddr}Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes}", processor_chain([ dup2, dup40, dup28, @@ -2703,11 +2444,9 @@ var select55 = linear_select([ msg113, ]); -var part201 = // "Pattern{Field(fld11,true), Constant(' GMT Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT Total_bytes_send %{p0}"); +var part201 = match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT Total_bytes_send %{p0}"); -var part202 = // "Pattern{Field(fld11,true), Constant(' Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld11->} Total_bytes_send %{p0}"); +var part202 = match("MESSAGE#104:TCP_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld11->} Total_bytes_send %{p0}"); var select56 = linear_select([ part201, @@ -2733,22 +2472,18 @@ var all47 = all_match({ var msg114 = msg("TCP_OTHERCONN_DELINK", all47); -var part203 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Start Time '), Field(p0,false)}" -match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Start Time %{p0}"); +var part203 = match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Start Time %{p0}"); -var part204 = // "Pattern{Field(fld10,true), Constant(' GMT - Delink Time '), Field(p0,false)}" -match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld10->} GMT - Delink Time %{p0}"); +var part204 = match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_0", "nwparser.p0", "%{fld10->} GMT - Delink Time %{p0}"); -var part205 = // "Pattern{Field(fld10,true), Constant(' - Delink Time '), Field(p0,false)}" -match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld10->} - Delink Time %{p0}"); +var part205 = match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/1_1", "nwparser.p0", "%{fld10->} - Delink Time %{p0}"); var select57 = linear_select([ part204, part205, ]); -var part206 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - '), Field(info,false)}" -match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/3", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes->} - %{info}"); +var part206 = match("MESSAGE#105:TCP_NAT_OTHERCONN_DELINK/3", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes->} - %{info}"); var all48 = all_match({ processors: [ @@ -2770,8 +2505,7 @@ var all48 = all_match({ var msg115 = msg("TCP_NAT_OTHERCONN_DELINK", all48); -var part207 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" -match("MESSAGE#106:UI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ +var part207 = match("MESSAGE#106:UI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ dup69, dup84, dup3, @@ -2783,8 +2517,7 @@ match("MESSAGE#106:UI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username- var msg116 = msg("UI_CMD_EXECUTED:Login", part207); -var part208 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "ERROR:'), Field(info,false), Constant('"')}" -match("MESSAGE#107:UI_CMD_EXECUTED:LoginFail", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"ERROR:%{info}\"", processor_chain([ +var part208 = match("MESSAGE#107:UI_CMD_EXECUTED:LoginFail", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"ERROR:%{info}\"", processor_chain([ dup5, dup84, dup3, @@ -2796,8 +2529,7 @@ match("MESSAGE#107:UI_CMD_EXECUTED:LoginFail", "nwparser.payload", "User %{usern var msg117 = msg("UI_CMD_EXECUTED:LoginFail", part208); -var part209 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" -match("MESSAGE#108:UI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ +var part209 = match("MESSAGE#108:UI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ dup71, dup84, dup3, @@ -2811,8 +2543,7 @@ var msg118 = msg("UI_CMD_EXECUTED:Logout", part209); var msg119 = msg("UI_CMD_EXECUTED", dup108); -var part210 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('"')}" -match("MESSAGE#144:UI_CMD_EXECUTED:01_Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\"", processor_chain([ +var part210 = match("MESSAGE#144:UI_CMD_EXECUTED:01_Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\"", processor_chain([ dup69, dup84, dup3, @@ -2823,8 +2554,7 @@ match("MESSAGE#144:UI_CMD_EXECUTED:01_Login", "nwparser.payload", "User %{userna var msg120 = msg("UI_CMD_EXECUTED:01_Login", part210); -var part211 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('"')}" -match("MESSAGE#145:UI_CMD_EXECUTED:01_Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\"", processor_chain([ +var part211 = match("MESSAGE#145:UI_CMD_EXECUTED:01_Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\"", processor_chain([ dup71, dup84, dup3, @@ -2835,8 +2565,7 @@ match("MESSAGE#145:UI_CMD_EXECUTED:01_Logout", "nwparser.payload", "User %{usern var msg121 = msg("UI_CMD_EXECUTED:01_Logout", part211); -var part212 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('"')}" -match("MESSAGE#146:UI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\"", processor_chain([ +var part212 = match("MESSAGE#146:UI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\"", processor_chain([ dup88, dup89, dup3, @@ -2855,8 +2584,7 @@ var select58 = linear_select([ msg122, ]); -var part213 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Total_bytes_send '), Field(comp_sbytes,true), Constant(' - Total_bytes_recv '), Field(comp_rbytes,true), Constant(' - Denied_by_policy "'), Field(fld2,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#110:SSLVPN_NONHTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Total_bytes_send %{comp_sbytes->} - Total_bytes_recv %{comp_rbytes->} - Denied_by_policy \"%{fld2}\" - Group(s) \"%{group}\""); +var part213 = match("MESSAGE#110:SSLVPN_NONHTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{daddr}:%{dport->} - Source %{saddr}:%{sport->} - Destination %{dtransaddr}:%{dtransport->} - Total_bytes_send %{comp_sbytes->} - Total_bytes_recv %{comp_rbytes->} - Denied_by_policy \"%{fld2}\" - Group(s) \"%{group}\""); var all49 = all_match({ processors: [ @@ -2874,24 +2602,21 @@ var all49 = all_match({ var msg123 = msg("SSLVPN_NONHTTP_RESOURCEACCESS_DENIED", all49); -var part214 = // "Pattern{Field(fld1,true), Constant(' - State Init')}" -match("MESSAGE#111:EVENT_VRIDINIT", "nwparser.payload", "%{fld1->} - State Init", processor_chain([ +var part214 = match("MESSAGE#111:EVENT_VRIDINIT", "nwparser.payload", "%{fld1->} - State Init", processor_chain([ dup9, dup4, ])); var msg124 = msg("EVENT_VRIDINIT", part214); -var part215 = // "Pattern{Constant('"REC: status '), Field(info,true), Constant(' from client '), Field(fld1,true), Constant(' for ID '), Field(id,false), Constant('"')}" -match("MESSAGE#112:CLUSTERD_Message:01", "nwparser.payload", "\"REC: status %{info->} from client %{fld1->} for ID %{id}\"", processor_chain([ +var part215 = match("MESSAGE#112:CLUSTERD_Message:01", "nwparser.payload", "\"REC: status %{info->} from client %{fld1->} for ID %{id}\"", processor_chain([ dup9, dup4, ])); var msg125 = msg("CLUSTERD_Message:01", part215); -var part216 = // "Pattern{Field(info,false), Constant('('), Field(saddr,false), Constant(') port('), Field(sport,false), Constant(') msglen('), Field(fld1,false), Constant(') rcv('), Field(packets,false), Constant(') R('), Field(result,false), Constant(') " ')}" -match("MESSAGE#113:CLUSTERD_Message:02/1_0", "nwparser.p0", "%{info}(%{saddr}) port(%{sport}) msglen(%{fld1}) rcv(%{packets}) R(%{result}) \" "); +var part216 = match("MESSAGE#113:CLUSTERD_Message:02/1_0", "nwparser.p0", "%{info}(%{saddr}) port(%{sport}) msglen(%{fld1}) rcv(%{packets}) R(%{result}) \" "); var select59 = linear_select([ part216, @@ -2916,11 +2641,9 @@ var select60 = linear_select([ msg126, ]); -var part217 = // "Pattern{Constant('"crypto: driver '), Field(fld1,true), Constant(' registers alg '), Field(fld2,true), Constant(' flags '), Field(fld3,true), Constant(' maxoplen '), Field(fld4,true), Constant(' "')}" -match("MESSAGE#114:IPSEC_Message/0_0", "nwparser.payload", "\"crypto: driver %{fld1->} registers alg %{fld2->} flags %{fld3->} maxoplen %{fld4->} \""); +var part217 = match("MESSAGE#114:IPSEC_Message/0_0", "nwparser.payload", "\"crypto: driver %{fld1->} registers alg %{fld2->} flags %{fld3->} maxoplen %{fld4->} \""); -var part218 = // "Pattern{Constant(' "'), Field(info,true), Constant(' "')}" -match("MESSAGE#114:IPSEC_Message/0_1", "nwparser.payload", " \"%{info->} \""); +var part218 = match("MESSAGE#114:IPSEC_Message/0_1", "nwparser.payload", " \"%{info->} \""); var select61 = linear_select([ part217, @@ -2939,16 +2662,14 @@ var all51 = all_match({ var msg127 = msg("IPSEC_Message", all51); -var part219 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(info,true), Constant(' "')}" -match("MESSAGE#115:NSNETSVC_Message", "nwparser.payload", "\"%{event_type}: %{info->} \"", processor_chain([ +var part219 = match("MESSAGE#115:NSNETSVC_Message", "nwparser.payload", "\"%{event_type}: %{info->} \"", processor_chain([ dup9, dup4, ])); var msg128 = msg("NSNETSVC_Message", part219); -var part220 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Remote_host '), Field(hostname,true), Constant(' - Denied_url '), Field(url,true), Constant(' - Denied_by_policy '), Field(policyname,true), Constant(' - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#116:SSLVPN_HTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{} %{username}- Vserver %{daddr}:%{dport->} - Total_bytes_send %{sbytes->} - Remote_host %{hostname->} - Denied_url %{url->} - Denied_by_policy %{policyname->} - Group(s) \"%{group}\""); +var part220 = match("MESSAGE#116:SSLVPN_HTTP_RESOURCEACCESS_DENIED/2", "nwparser.p0", "%{} %{username}- Vserver %{daddr}:%{dport->} - Total_bytes_send %{sbytes->} - Remote_host %{hostname->} - Denied_url %{url->} - Denied_by_policy %{policyname->} - Group(s) \"%{group}\""); var all52 = all_match({ processors: [ @@ -2964,14 +2685,11 @@ var all52 = all_match({ var msg129 = msg("SSLVPN_HTTP_RESOURCEACCESS_DENIED", all52); -var part221 = // "Pattern{Constant('Client '), Field(saddr,true), Constant(' - Profile '), Field(p0,false)}" -match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/0", "nwparser.payload", "Client %{saddr->} - Profile %{p0}"); +var part221 = match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/0", "nwparser.payload", "Client %{saddr->} - Profile %{p0}"); -var part222 = // "Pattern{Field(info,false), Constant(', '), Field(event_description,true), Constant(' - URL')}" -match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_0", "nwparser.p0", "%{info}, %{event_description->} - URL"); +var part222 = match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_0", "nwparser.p0", "%{info}, %{event_description->} - URL"); -var part223 = // "Pattern{Field(info,true), Constant(' - '), Field(event_description,true), Constant(' - URL')}" -match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_1", "nwparser.p0", "%{info->} - %{event_description->} - URL"); +var part223 = match("MESSAGE#117:NSNETSVC_REQ_PARSE_ERROR/1_1", "nwparser.p0", "%{info->} - %{event_description->} - URL"); var select62 = linear_select([ part222, @@ -2991,20 +2709,15 @@ var all53 = all_match({ var msg130 = msg("NSNETSVC_REQ_PARSE_ERROR", all53); -var part224 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(fld11,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#118:Source:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{fld11->} %{p0}"); +var part224 = match("MESSAGE#118:Source:01/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{fld11->} %{p0}"); -var part225 = // "Pattern{Constant('GMT - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" -match("MESSAGE#118:Source:01/1_0", "nwparser.p0", "GMT - Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); +var part225 = match("MESSAGE#118:Source:01/1_0", "nwparser.p0", "GMT - Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); -var part226 = // "Pattern{Constant('- Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" -match("MESSAGE#118:Source:01/1_1", "nwparser.p0", "- Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); +var part226 = match("MESSAGE#118:Source:01/1_1", "nwparser.p0", "- Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); -var part227 = // "Pattern{Constant('GMT Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" -match("MESSAGE#118:Source:01/1_2", "nwparser.p0", "GMT Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); +var part227 = match("MESSAGE#118:Source:01/1_2", "nwparser.p0", "GMT Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); -var part228 = // "Pattern{Constant('Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(p0,false)}" -match("MESSAGE#118:Source:01/1_3", "nwparser.p0", "Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); +var part228 = match("MESSAGE#118:Source:01/1_3", "nwparser.p0", "Total_bytes_send %{sbytes->} - Total_bytes_recv %{p0}"); var select63 = linear_select([ part225, @@ -3013,8 +2726,7 @@ var select63 = linear_select([ part228, ]); -var part229 = // "Pattern{Field(rbytes,false)}" -match_copy("MESSAGE#118:Source:01/2", "nwparser.p0", "rbytes"); +var part229 = match_copy("MESSAGE#118:Source:01/2", "nwparser.p0", "rbytes"); var all54 = all_match({ processors: [ @@ -3051,15 +2763,13 @@ var select64 = linear_select([ msg132, ]); -var part230 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(fld1,false), Constant('" - Status "'), Field(result,false), Constant('"')}" -match("MESSAGE#120:User", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{fld1}\" - Status \"%{result}\"", processor_chain([ +var part230 = match("MESSAGE#120:User", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{fld1}\" - Status \"%{result}\"", processor_chain([ dup2, ])); var msg133 = msg("User", part230); -var part231 = // "Pattern{Constant('SPCBId '), Field(sessionid,true), Constant(' - ClientIP '), Field(saddr,true), Constant(' - ClientPort '), Field(sport,true), Constant(' - VserverServiceIP '), Field(daddr,true), Constant(' - VserverServicePort '), Field(dport,true), Constant(' - ClientVersion '), Field(s_sslver,true), Constant(' - CipherSuite "'), Field(s_cipher,false), Constant('" - '), Field(result,false)}" -match("MESSAGE#121:SPCBId", "nwparser.payload", "SPCBId %{sessionid->} - ClientIP %{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - %{result}", processor_chain([ +var part231 = match("MESSAGE#121:SPCBId", "nwparser.payload", "SPCBId %{sessionid->} - ClientIP %{saddr->} - ClientPort %{sport->} - VserverServiceIP %{daddr->} - VserverServicePort %{dport->} - ClientVersion %{s_sslver->} - CipherSuite \"%{s_cipher}\" - %{result}", processor_chain([ dup11, dup40, dup8, @@ -3078,8 +2788,7 @@ var msg138 = msg("APPFW_FIELDCONSISTENCY", dup109); var msg139 = msg("APPFW_REFERER_HEADER", dup109); -var part232 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' cs6='), Field(fld9,true), Constant(' act='), Field(action,false)}" -match("MESSAGE#127:APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} cs6=%{fld9->} act=%{action}", processor_chain([ +var part232 = match("MESSAGE#127:APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} cs6=%{fld9->} act=%{action}", processor_chain([ dup9, dup91, ])); @@ -3122,8 +2831,7 @@ var part233 = tagval("MESSAGE#130:CITRIX_TVM", "nwparser.payload", tvm, { var msg143 = msg("CITRIX_TVM", part233); -var part234 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(url,true), Constant(' '), Field(event_description,false)}" -match("MESSAGE#131:APPFW_APPFW_POLICY_HIT", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url->} %{event_description}", processor_chain([ +var part234 = match("MESSAGE#131:APPFW_APPFW_POLICY_HIT", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{fld3->} %{url->} %{event_description}", processor_chain([ dup9, dup40, dup3, @@ -3132,8 +2840,7 @@ match("MESSAGE#131:APPFW_APPFW_POLICY_HIT", "nwparser.payload", "%{saddr->} %{fl var msg144 = msg("APPFW_APPFW_POLICY_HIT", part234); -var part235 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Unknown content-type header value='), Field(fld4,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#132:APPFW_APPFW_CONTENT_TYPE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Unknown content-type header value=%{fld4->} %{info->} \u003c\u003c%{disposition}>", processor_chain([ +var part235 = match("MESSAGE#132:APPFW_APPFW_CONTENT_TYPE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Unknown content-type header value=%{fld4->} %{info->} \u003c\u003c%{disposition}>", processor_chain([ dup9, dup91, dup4, @@ -3141,8 +2848,7 @@ match("MESSAGE#132:APPFW_APPFW_CONTENT_TYPE", "nwparser.payload", "%{saddr->} %{ var msg145 = msg("APPFW_APPFW_CONTENT_TYPE", part235); -var part236 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' WSI check failed: '), Field(fld4,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#133:APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} WSI check failed: %{fld4}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ +var part236 = match("MESSAGE#133:APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} WSI check failed: %{fld4}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ dup9, dup91, dup4, @@ -3150,8 +2856,7 @@ match("MESSAGE#133:APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", "nwparser.p var msg146 = msg("APPFW_RESP_APPFW_XML_WSI_ERR_BODY_ENV_NAMESPACE", part236); -var part237 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Referer header check failed: referer header URL ''), Field(web_referer,false), Constant('' not in Start URL or closure list <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#134:APPFW_APPFW_REFERER_HEADER", "nwparser.payload", "%{saddr->} %{fld2->} %{fld3->} %{rule_group->} %{url->} Referer header check failed: referer header URL '%{web_referer}' not in Start URL or closure list \u003c\u003c%{disposition}>", processor_chain([ +var part237 = match("MESSAGE#134:APPFW_APPFW_REFERER_HEADER", "nwparser.payload", "%{saddr->} %{fld2->} %{fld3->} %{rule_group->} %{url->} Referer header check failed: referer header URL '%{web_referer}' not in Start URL or closure list \u003c\u003c%{disposition}>", processor_chain([ dup9, dup40, dup3, @@ -3161,8 +2866,7 @@ match("MESSAGE#134:APPFW_APPFW_REFERER_HEADER", "nwparser.payload", "%{saddr->} var msg147 = msg("APPFW_APPFW_REFERER_HEADER", part237); -var part238 = // "Pattern{Constant('"URL'), Field(url,false), Constant('Client IP'), Field(hostip,false), Constant('Client Dest'), Field(fld1,false)}" -match("MESSAGE#141:RESPONDER_Message", "nwparser.payload", "\"URL%{url}Client IP%{hostip}Client Dest%{fld1}", processor_chain([ +var part238 = match("MESSAGE#141:RESPONDER_Message", "nwparser.payload", "\"URL%{url}Client IP%{hostip}Client Dest%{fld1}", processor_chain([ dup9, dup3, dup4, @@ -3170,8 +2874,7 @@ match("MESSAGE#141:RESPONDER_Message", "nwparser.payload", "\"URL%{url}Client IP var msg148 = msg("RESPONDER_Message", part238); -var part239 = // "Pattern{Constant('"NSRateLimit='), Field(filter,false), Constant(', ClientIP='), Field(saddr,false), Constant('"')}" -match("MESSAGE#142:RESPONDER_Message:01", "nwparser.payload", "\"NSRateLimit=%{filter}, ClientIP=%{saddr}\"", processor_chain([ +var part239 = match("MESSAGE#142:RESPONDER_Message:01", "nwparser.payload", "\"NSRateLimit=%{filter}, ClientIP=%{saddr}\"", processor_chain([ dup9, dup3, dup4, @@ -3184,8 +2887,7 @@ var select65 = linear_select([ msg149, ]); -var part240 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' - '), Field(fld2,true), Constant(' - '), Field(event_description,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#147:APPFW_AF_MALFORMED_REQ_ERR", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{event_description->} \u003c\u003c%{disposition}>", processor_chain([ +var part240 = match("MESSAGE#147:APPFW_AF_MALFORMED_REQ_ERR", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{event_description->} \u003c\u003c%{disposition}>", processor_chain([ dup11, dup3, dup4, @@ -3193,8 +2895,7 @@ match("MESSAGE#147:APPFW_AF_MALFORMED_REQ_ERR", "nwparser.payload", "%{saddr->} var msg150 = msg("APPFW_AF_MALFORMED_REQ_ERR", part240); -var part241 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' - '), Field(fld2,true), Constant(' - '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' '), Field(event_description,true), Constant(' rule ID '), Field(rule_uid,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#148:APPFW_APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{rule_group->} %{url->} %{event_description->} rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ +var part241 = match("MESSAGE#148:APPFW_APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{saddr->} %{fld1->} - %{fld2->} - %{rule_group->} %{url->} %{event_description->} rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ dup9, domain("web_domain","url"), root("web_root","url"), @@ -3206,8 +2907,7 @@ match("MESSAGE#148:APPFW_APPFW_SIGNATURE_MATCH", "nwparser.payload", "%{saddr->} var msg151 = msg("APPFW_APPFW_SIGNATURE_MATCH", part241); -var part242 = // "Pattern{Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(rule_group,true), Constant(' '), Field(url,true), Constant(' Signature violation rule ID '), Field(rule_uid,false), Constant(': '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#149:APPFW_APPFW_SIGNATURE_MATCH:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Signature violation rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ +var part242 = match("MESSAGE#149:APPFW_APPFW_SIGNATURE_MATCH:01", "nwparser.payload", "%{saddr->} %{fld1->} %{fld2->} %{rule_group->} %{url->} Signature violation rule ID %{rule_uid}: %{info->} \u003c\u003c%{disposition}>", processor_chain([ dup9, dup91, dup4, @@ -3221,8 +2921,7 @@ var select66 = linear_select([ msg152, ]); -var part243 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" -serverIP '), Field(daddr,true), Constant(' -serverPort '), Field(dport,true), Constant(' -logLevel '), Field(fld1,true), Constant(' -dateFormat '), Field(fld2,true), Constant(' -logFacility '), Field(fld3,true), Constant(' -tcp '), Field(fld4,true), Constant(' -acl '), Field(fld5,true), Constant(' -timeZone '), Field(fld6,true), Constant(' -userDefinedAuditlog '), Field(fld7,true), Constant(' -appflowExport '), Field(fld8,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" -match("MESSAGE#150:GUI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" -serverIP %{daddr->} -serverPort %{dport->} -logLevel %{fld1->} -dateFormat %{fld2->} -logFacility %{fld3->} -tcp %{fld4->} -acl %{fld5->} -timeZone %{fld6->} -userDefinedAuditlog %{fld7->} -appflowExport %{fld8}\" - Status \"%{disposition}\"", processor_chain([ +var part243 = match("MESSAGE#150:GUI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" -serverIP %{daddr->} -serverPort %{dport->} -logLevel %{fld1->} -dateFormat %{fld2->} -logFacility %{fld3->} -tcp %{fld4->} -acl %{fld5->} -timeZone %{fld6->} -userDefinedAuditlog %{fld7->} -appflowExport %{fld8}\" - Status \"%{disposition}\"", processor_chain([ dup88, dup89, dup3, @@ -3231,8 +2930,7 @@ match("MESSAGE#150:GUI_CMD_EXECUTED:01", "nwparser.payload", "User %{username->} var msg153 = msg("GUI_CMD_EXECUTED:01", part243); -var part244 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,true), Constant(' -priority '), Field(fld1,true), Constant(' -devno '), Field(fld2,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" -match("MESSAGE#151:GUI_CMD_EXECUTED:02", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} -priority %{fld1->} -devno %{fld2}\" - Status \"%{disposition}\"", processor_chain([ +var part244 = match("MESSAGE#151:GUI_CMD_EXECUTED:02", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} -priority %{fld1->} -devno %{fld2}\" - Status \"%{disposition}\"", processor_chain([ dup88, dup89, dup3, @@ -3241,8 +2939,7 @@ match("MESSAGE#151:GUI_CMD_EXECUTED:02", "nwparser.payload", "User %{username->} var msg154 = msg("GUI_CMD_EXECUTED:02", part244); -var part245 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "login '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" -match("MESSAGE#152:GUI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ +var part245 = match("MESSAGE#152:GUI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"login %{fld11}\" - Status \"Success%{info}\"", processor_chain([ dup69, dup92, dup3, @@ -3254,8 +2951,7 @@ match("MESSAGE#152:GUI_CMD_EXECUTED:Login", "nwparser.payload", "User %{username var msg155 = msg("GUI_CMD_EXECUTED:Login", part245); -var part246 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "logout '), Field(fld11,false), Constant('" - Status "Success'), Field(info,false), Constant('"')}" -match("MESSAGE#153:GUI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ +var part246 = match("MESSAGE#153:GUI_CMD_EXECUTED:Logout", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"logout %{fld11}\" - Status \"Success%{info}\"", processor_chain([ dup71, dup92, dup3, @@ -3269,8 +2965,7 @@ var msg156 = msg("GUI_CMD_EXECUTED:Logout", part246); var msg157 = msg("GUI_CMD_EXECUTED", dup108); -var part247 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,true), Constant(' - Status "'), Field(disposition,false), Constant('" - Message "'), Field(info,false), Constant('"')}" -match("MESSAGE#155:GUI_CMD_EXECUTED:03", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} - Status \"%{disposition}\" - Message \"%{info}\"", processor_chain([ +var part247 = match("MESSAGE#155:GUI_CMD_EXECUTED:03", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action->} - Status \"%{disposition}\" - Message \"%{info}\"", processor_chain([ dup88, dup89, dup4, @@ -3289,8 +2984,7 @@ var select67 = linear_select([ var msg159 = msg("CLI_CMD_EXECUTED", dup108); -var part248 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" -match("MESSAGE#157:API_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ +var part248 = match("MESSAGE#157:API_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ dup88, setc("event_description","API command executed in NetScaler"), dup3, @@ -3299,11 +2993,9 @@ match("MESSAGE#157:API_CMD_EXECUTED", "nwparser.payload", "User %{username->} - var msg160 = msg("API_CMD_EXECUTED", part248); -var part249 = // "Pattern{Field(result,true), Constant(' for user '), Field(username,true), Constant(' = '), Field(fld1,true), Constant(' "')}" -match("MESSAGE#158:AAA_Message/1_0", "nwparser.p0", "%{result->} for user %{username->} = %{fld1->} \""); +var part249 = match("MESSAGE#158:AAA_Message/1_0", "nwparser.p0", "%{result->} for user %{username->} = %{fld1->} \""); -var part250 = // "Pattern{Constant(''), Field(info,true), Constant(' "')}" -match("MESSAGE#158:AAA_Message/1_1", "nwparser.p0", "%{info->} \""); +var part250 = match("MESSAGE#158:AAA_Message/1_1", "nwparser.p0", "%{info->} \""); var select68 = linear_select([ part249, @@ -3323,8 +3015,7 @@ var all56 = all_match({ var msg161 = msg("AAA_Message", all56); -var part251 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': created session for <<'), Field(domain,false), Constant('> with cookie: <<'), Field(web_cookie,false), Constant('>"')}" -match("MESSAGE#159:AAATM_Message:04", "nwparser.payload", "\"%{event_type}: created session for \u003c\u003c%{domain}> with cookie: \u003c\u003c%{web_cookie}>\"", processor_chain([ +var part251 = match("MESSAGE#159:AAATM_Message:04", "nwparser.payload", "\"%{event_type}: created session for \u003c\u003c%{domain}> with cookie: \u003c\u003c%{web_cookie}>\"", processor_chain([ dup9, dup91, dup4, @@ -3332,8 +3023,7 @@ match("MESSAGE#159:AAATM_Message:04", "nwparser.payload", "\"%{event_type}: crea var msg162 = msg("AAATM_Message:04", part251); -var part252 = // "Pattern{Field(fld1,true), Constant(' for user '), Field(username,true), Constant(' "')}" -match("MESSAGE#160:AAATM_Message/1_0", "nwparser.p0", "%{fld1->} for user %{username->} \""); +var part252 = match("MESSAGE#160:AAATM_Message/1_0", "nwparser.p0", "%{fld1->} for user %{username->} \""); var select69 = linear_select([ part252, @@ -3353,8 +3043,7 @@ var all57 = all_match({ var msg163 = msg("AAATM_Message", all57); -var part253 = // "Pattern{Constant('"'), Field(fld1,true), Constant(' creating session '), Field(info,false), Constant('"')}" -match("MESSAGE#161:AAATM_Message:01", "nwparser.payload", "\"%{fld1->} creating session %{info}\"", processor_chain([ +var part253 = match("MESSAGE#161:AAATM_Message:01", "nwparser.payload", "\"%{fld1->} creating session %{info}\"", processor_chain([ dup9, dup4, setc("event_type","creating session"), @@ -3362,8 +3051,7 @@ match("MESSAGE#161:AAATM_Message:01", "nwparser.payload", "\"%{fld1->} creating var msg164 = msg("AAATM_Message:01", part253); -var part254 = // "Pattern{Constant('"cookie idx is '), Field(fld1,false), Constant(', '), Field(info,false), Constant('"')}" -match("MESSAGE#162:AAATM_Message:02", "nwparser.payload", "\"cookie idx is %{fld1}, %{info}\"", processor_chain([ +var part254 = match("MESSAGE#162:AAATM_Message:02", "nwparser.payload", "\"cookie idx is %{fld1}, %{info}\"", processor_chain([ dup9, dup4, setc("event_type","cookie idx"), @@ -3371,8 +3059,7 @@ match("MESSAGE#162:AAATM_Message:02", "nwparser.payload", "\"cookie idx is %{fld var msg165 = msg("AAATM_Message:02", part254); -var part255 = // "Pattern{Constant('"sent request to '), Field(fld1,true), Constant(' for authentication, user <<'), Field(domain,false), Constant('\'), Field(username,false), Constant('>, client ip '), Field(saddr,false), Constant('"')}" -match("MESSAGE#163:AAATM_Message:03", "nwparser.payload", "\"sent request to %{fld1->} for authentication, user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}\"", processor_chain([ +var part255 = match("MESSAGE#163:AAATM_Message:03", "nwparser.payload", "\"sent request to %{fld1->} for authentication, user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}\"", processor_chain([ setc("eventcategory","1304000000"), dup4, setc("event_type","sent request"), @@ -3380,8 +3067,7 @@ match("MESSAGE#163:AAATM_Message:03", "nwparser.payload", "\"sent request to %{f var msg166 = msg("AAATM_Message:03", part255); -var part256 = // "Pattern{Constant('"authentication succeeded for user <<'), Field(domain,false), Constant('\'), Field(username,false), Constant('>, client ip '), Field(saddr,false), Constant(', setting up session"')}" -match("MESSAGE#164:AAATM_Message:05", "nwparser.payload", "\"authentication succeeded for user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}, setting up session\"", processor_chain([ +var part256 = match("MESSAGE#164:AAATM_Message:05", "nwparser.payload", "\"authentication succeeded for user \u003c\u003c%{domain}\\%{username}>, client ip %{saddr}, setting up session\"", processor_chain([ setc("eventcategory","1302000000"), dup4, setc("event_type","setting up session"), @@ -3401,22 +3087,18 @@ var select70 = linear_select([ msg168, ]); -var part257 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- '), Field(event_computer,true), Constant(' User '), Field(username,true), Constant(' : Group(s) '), Field(group,true), Constant(' : Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#166:AAATM_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- %{event_computer->} User %{username->} : Group(s) %{group->} : Vserver %{daddr}:%{dport->} - %{fld2->} %{p0}"); +var part257 = match("MESSAGE#166:AAATM_HTTPREQUEST/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- %{event_computer->} User %{username->} : Group(s) %{group->} : Vserver %{daddr}:%{dport->} - %{fld2->} %{p0}"); -var part258 = // "Pattern{Field(timezone,false), Constant(': SSO is '), Field(fld3,true), Constant(' : '), Field(p0,false)}" -match("MESSAGE#166:AAATM_HTTPREQUEST/1_0", "nwparser.p0", "%{timezone}: SSO is %{fld3->} : %{p0}"); +var part258 = match("MESSAGE#166:AAATM_HTTPREQUEST/1_0", "nwparser.p0", "%{timezone}: SSO is %{fld3->} : %{p0}"); -var part259 = // "Pattern{Field(timezone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#166:AAATM_HTTPREQUEST/1_1", "nwparser.p0", "%{timezone->} %{p0}"); +var part259 = match("MESSAGE#166:AAATM_HTTPREQUEST/1_1", "nwparser.p0", "%{timezone->} %{p0}"); var select71 = linear_select([ part258, part259, ]); -var part260 = // "Pattern{Field(web_method,true), Constant(' '), Field(url,true), Constant(' '), Field(fld4,false)}" -match("MESSAGE#166:AAATM_HTTPREQUEST/2", "nwparser.p0", "%{web_method->} %{url->} %{fld4}"); +var part260 = match("MESSAGE#166:AAATM_HTTPREQUEST/2", "nwparser.p0", "%{web_method->} %{url->} %{fld4}"); var all58 = all_match({ processors: [ @@ -3446,16 +3128,14 @@ var msg171 = msg("SSLVPN_REMOVE_SESSION", dup114); var msg172 = msg("SSLVPN_REMOVE_SESSION_INFO", dup114); -var part261 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - ica_rtt '), Field(fld5,true), Constant(' - clientside_rxbytes '), Field(rbytes,false), Constant('- clientside_txbytes '), Field(sbytes,true), Constant(' - clientside_packet_retransmits '), Field(fld6,true), Constant(' - serverside_packet_retransmits '), Field(fld7,true), Constant(' - clientside_rtt '), Field(fld8,true), Constant(' - serverside_rtt '), Field(fld9,true), Constant(' - clientside_jitter '), Field(fld10,true), Constant(' - serverside_jitter '), Field(fld11,false)}" -match("MESSAGE#170:ICA_NETWORK_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - ica_rtt %{fld5->} - clientside_rxbytes %{rbytes}- clientside_txbytes %{sbytes->} - clientside_packet_retransmits %{fld6->} - serverside_packet_retransmits %{fld7->} - clientside_rtt %{fld8->} - serverside_rtt %{fld9->} - clientside_jitter %{fld10->} - serverside_jitter %{fld11}", processor_chain([ +var part261 = match("MESSAGE#170:ICA_NETWORK_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - ica_rtt %{fld5->} - clientside_rxbytes %{rbytes}- clientside_txbytes %{sbytes->} - clientside_packet_retransmits %{fld6->} - serverside_packet_retransmits %{fld7->} - clientside_rtt %{fld8->} - serverside_rtt %{fld9->} - clientside_jitter %{fld10->} - serverside_jitter %{fld11}", processor_chain([ dup9, dup4, ])); var msg173 = msg("ICA_NETWORK_UPDATE", part261); -var part262 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - channel_update_begin '), Field(fld5,true), Constant(' - channel_update_end '), Field(fld6,true), Constant(' - channel_id_1 '), Field(fld7,true), Constant(' - channel_id_1_val '), Field(fld8,true), Constant(' - channel_id_2 '), Field(fld9,true), Constant(' - channel_id_2_val '), Field(fld10,true), Constant(' -channel_id_3 '), Field(fld11,true), Constant(' - channel_id_3_val '), Field(fld12,true), Constant(' - channel_id_4 '), Field(fld13,true), Constant(' - channel_id_4_val '), Field(fld14,true), Constant(' -channel_id_5 '), Field(fld15,true), Constant(' - channel_id_5_val '), Field(fld16,false)}" -match("MESSAGE#171:ICA_CHANNEL_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - channel_update_begin %{fld5->} - channel_update_end %{fld6->} - channel_id_1 %{fld7->} - channel_id_1_val %{fld8->} - channel_id_2 %{fld9->} - channel_id_2_val %{fld10->} -channel_id_3 %{fld11->} - channel_id_3_val %{fld12->} - channel_id_4 %{fld13->} - channel_id_4_val %{fld14->} -channel_id_5 %{fld15->} - channel_id_5_val %{fld16}", processor_chain([ +var part262 = match("MESSAGE#171:ICA_CHANNEL_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - channel_update_begin %{fld5->} - channel_update_end %{fld6->} - channel_id_1 %{fld7->} - channel_id_1_val %{fld8->} - channel_id_2 %{fld9->} - channel_id_2_val %{fld10->} -channel_id_3 %{fld11->} - channel_id_3_val %{fld12->} - channel_id_4 %{fld13->} - channel_id_4_val %{fld14->} -channel_id_5 %{fld15->} - channel_id_5_val %{fld16}", processor_chain([ dup9, date_time({ dest: "starttime", @@ -3476,8 +3156,7 @@ match("MESSAGE#171:ICA_CHANNEL_UPDATE", "nwparser.payload", "session_guid %{fld1 var msg174 = msg("ICA_CHANNEL_UPDATE", part262); -var part263 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - nsica_session_status '), Field(fld5,true), Constant(' - nsica_session_client_ip '), Field(saddr,true), Constant(' - nsica_session_client_port '), Field(sport,true), Constant(' - nsica_session_server_ip '), Field(daddr,true), Constant(' - nsica_session_server_port '), Field(dport,true), Constant(' - nsica_session_reconnect_count '), Field(fld6,true), Constant(' - nsica_session_acr_count '), Field(fld7,true), Constant(' - connection_priority '), Field(fld8,true), Constant(' - timestamp '), Field(fld9,false)}" -match("MESSAGE#172:ICA_SESSION_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - nsica_session_status %{fld5->} - nsica_session_client_ip %{saddr->} - nsica_session_client_port %{sport->} - nsica_session_server_ip %{daddr->} - nsica_session_server_port %{dport->} - nsica_session_reconnect_count %{fld6->} - nsica_session_acr_count %{fld7->} - connection_priority %{fld8->} - timestamp %{fld9}", processor_chain([ +var part263 = match("MESSAGE#172:ICA_SESSION_UPDATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - nsica_session_status %{fld5->} - nsica_session_client_ip %{saddr->} - nsica_session_client_port %{sport->} - nsica_session_server_ip %{daddr->} - nsica_session_server_port %{dport->} - nsica_session_reconnect_count %{fld6->} - nsica_session_acr_count %{fld7->} - connection_priority %{fld8->} - timestamp %{fld9}", processor_chain([ dup9, dup4, ])); @@ -3486,16 +3165,14 @@ var msg175 = msg("ICA_SESSION_UPDATE", part263); var msg176 = msg("ICA_Message", dup111); -var part264 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - session_setup_time '), Field(fld5,true), Constant(' - client_ip '), Field(saddr,true), Constant(' - client_type '), Field(fld6,true), Constant(' - client_launcher '), Field(fld7,true), Constant(' - client_version '), Field(version,true), Constant(' - client_hostname '), Field(shost,true), Constant(' - domain_name '), Field(domain,true), Constant(' - server_name '), Field(dhost,true), Constant(' - connection_priority '), Field(fld8,false)}" -match("MESSAGE#174:ICA_SESSION_SETUP", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_setup_time %{fld5->} - client_ip %{saddr->} - client_type %{fld6->} - client_launcher %{fld7->} - client_version %{version->} - client_hostname %{shost->} - domain_name %{domain->} - server_name %{dhost->} - connection_priority %{fld8}", processor_chain([ +var part264 = match("MESSAGE#174:ICA_SESSION_SETUP", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_setup_time %{fld5->} - client_ip %{saddr->} - client_type %{fld6->} - client_launcher %{fld7->} - client_version %{version->} - client_hostname %{shost->} - domain_name %{domain->} - server_name %{dhost->} - connection_priority %{fld8}", processor_chain([ dup9, dup4, ])); var msg177 = msg("ICA_SESSION_SETUP", part264); -var part265 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - launch_mechanism '), Field(fld5,true), Constant(' - app_launch_time '), Field(fld6,true), Constant(' - app_process_id '), Field(fld7,true), Constant(' - app_name '), Field(fld8,true), Constant(' - module_path '), Field(filename,false)}" -match("MESSAGE#175:ICA_APPLICATION_LAUNCH", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - launch_mechanism %{fld5->} - app_launch_time %{fld6->} - app_process_id %{fld7->} - app_name %{fld8->} - module_path %{filename}", processor_chain([ +var part265 = match("MESSAGE#175:ICA_APPLICATION_LAUNCH", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - launch_mechanism %{fld5->} - app_launch_time %{fld6->} - app_process_id %{fld7->} - app_name %{fld8->} - module_path %{filename}", processor_chain([ dup9, date_time({ dest: "starttime", @@ -3509,8 +3186,7 @@ match("MESSAGE#175:ICA_APPLICATION_LAUNCH", "nwparser.payload", "session_guid %{ var msg178 = msg("ICA_APPLICATION_LAUNCH", part265); -var part266 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - session_end_time '), Field(fld5,false)}" -match("MESSAGE#176:ICA_SESSION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_end_time %{fld5}", processor_chain([ +var part266 = match("MESSAGE#176:ICA_SESSION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - session_end_time %{fld5}", processor_chain([ dup9, date_time({ dest: "endtime", @@ -3524,8 +3200,7 @@ match("MESSAGE#176:ICA_SESSION_TERMINATE", "nwparser.payload", "session_guid %{f var msg179 = msg("ICA_SESSION_TERMINATE", part266); -var part267 = // "Pattern{Constant('session_guid '), Field(fld1,true), Constant(' - device_serial_number '), Field(fld2,true), Constant(' - client_cookie '), Field(fld3,true), Constant(' - flags '), Field(fld4,true), Constant(' - app_termination_type '), Field(fld5,true), Constant(' - app_process_id '), Field(fld6,true), Constant(' - app_termination_time '), Field(fld7,false)}" -match("MESSAGE#177:ICA_APPLICATION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - app_termination_type %{fld5->} - app_process_id %{fld6->} - app_termination_time %{fld7}", processor_chain([ +var part267 = match("MESSAGE#177:ICA_APPLICATION_TERMINATE", "nwparser.payload", "session_guid %{fld1->} - device_serial_number %{fld2->} - client_cookie %{fld3->} - flags %{fld4->} - app_termination_type %{fld5->} - app_process_id %{fld6->} - app_termination_time %{fld7}", processor_chain([ dup9, date_time({ dest: "endtime", @@ -3553,8 +3228,7 @@ var all59 = all_match({ var msg181 = msg("SSLVPN_REMOVE_SESSION_DEBUG", all59); -var part268 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Browser_type '), Field(user_agent,false), Constant('- Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#181:AAATM_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{user_agent}- Group(s) \"%{group}\""); +var part268 = match("MESSAGE#181:AAATM_LOGIN/4", "nwparser.p0", "%{daddr}:%{dport->} - Browser_type %{user_agent}- Group(s) \"%{group}\""); var all60 = all_match({ processors: [ @@ -3574,8 +3248,7 @@ var all60 = all_match({ var msg182 = msg("AAATM_LOGIN", all60); -var part269 = // "Pattern{Field(duration_string,true), Constant(' - Http_resources_accessed '), Field(fld3,true), Constant(' - Total_TCP_connections '), Field(fld5,true), Constant(' - Total_policies_allowed '), Field(fld7,true), Constant(' - Total_policies_denied '), Field(fld8,true), Constant(' - Total_bytes_send '), Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,true), Constant(' - Total_compressedbytes_send '), Field(fld12,true), Constant(' - Total_compressedbytes_recv '), Field(fld13,true), Constant(' - Compression_ratio_send '), Field(dclass_ratio1,true), Constant(' - Compression_ratio_recv '), Field(dclass_ratio2,true), Constant(' - LogoutMethod "'), Field(result,false), Constant('" - Group(s) "'), Field(group,false), Constant('"')}" -match("MESSAGE#182:AAATM_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - Total_TCP_connections %{fld5->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{fld12->} - Total_compressedbytes_recv %{fld13->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); +var part269 = match("MESSAGE#182:AAATM_LOGOUT/7", "nwparser.p0", "%{duration_string->} - Http_resources_accessed %{fld3->} - Total_TCP_connections %{fld5->} - Total_policies_allowed %{fld7->} - Total_policies_denied %{fld8->} - Total_bytes_send %{sbytes->} - Total_bytes_recv %{rbytes->} - Total_compressedbytes_send %{fld12->} - Total_compressedbytes_recv %{fld13->} - Compression_ratio_send %{dclass_ratio1->} - Compression_ratio_recv %{dclass_ratio2->} - LogoutMethod \"%{result}\" - Group(s) \"%{group}\""); var all61 = all_match({ processors: [ @@ -3722,149 +3395,101 @@ var chain1 = processor_chain([ }), ]); -var part270 = // "Pattern{Field(saddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#6:APPFW_APPFW_COOKIE/0", "nwparser.payload", "%{saddr->} %{p0}"); +var part270 = match("MESSAGE#6:APPFW_APPFW_COOKIE/0", "nwparser.payload", "%{saddr->} %{p0}"); -var part271 = // "Pattern{Field(url,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); +var part271 = match("MESSAGE#7:APPFW_APPFW_DENYURL/2", "nwparser.p0", "%{url->} \u003c\u003c%{disposition}>"); -var part272 = // "Pattern{Field(url,true), Constant(' '), Field(info,true), Constant(' <<'), Field(disposition,false), Constant('>')}" -match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); +var part272 = match("MESSAGE#8:APPFW_APPFW_FIELDCONSISTENCY/2", "nwparser.p0", "%{url->} %{info->} \u003c\u003c%{disposition}>"); -var part273 = // "Pattern{Constant('"'), Field(p0,false)}" -match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); +var part273 = match("MESSAGE#20:APPFW_Message/0", "nwparser.payload", "\"%{p0}"); -var part274 = // "Pattern{Constant('HASTATE '), Field(p0,false)}" -match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); +var part274 = match("MESSAGE#23:DR_HA_Message/1_0", "nwparser.p0", "HASTATE %{p0}"); -var part275 = // "Pattern{Field(network_service,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); +var part275 = match("MESSAGE#23:DR_HA_Message/1_1", "nwparser.p0", "%{network_service}: %{p0}"); -var part276 = // "Pattern{Field(info,false), Constant('"')}" -match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); +var part276 = match("MESSAGE#23:DR_HA_Message/2", "nwparser.p0", "%{info}\""); -var part277 = // "Pattern{Constant('for '), Field(dclass_counter1,false)}" -match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); +var part277 = match("MESSAGE#24:EVENT_ALERTENDED/1_0", "nwparser.p0", "for %{dclass_counter1}"); -var part278 = // "Pattern{Field(space,false)}" -match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); +var part278 = match_copy("MESSAGE#24:EVENT_ALERTENDED/1_1", "nwparser.p0", "space"); -var part279 = // "Pattern{Field(obj_type,true), Constant(' "'), Field(obj_name,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); +var part279 = match("MESSAGE#28:EVENT_DEVICEDOWN/0", "nwparser.payload", "%{obj_type->} \"%{obj_name}\"%{p0}"); -var part280 = // "Pattern{Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); +var part280 = match("MESSAGE#28:EVENT_DEVICEDOWN/1_0", "nwparser.p0", " - State %{event_state}"); -var part281 = // "Pattern{}" -match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); +var part281 = match_copy("MESSAGE#28:EVENT_DEVICEDOWN/1_1", "nwparser.p0", ""); -var part282 = // "Pattern{Field(obj_type,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); +var part282 = match("MESSAGE#31:EVENT_MONITORDOWN/0", "nwparser.payload", "%{obj_type->} %{p0}"); -var part283 = // "Pattern{Field(obj_name,true), Constant(' - State '), Field(event_state,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); +var part283 = match("MESSAGE#31:EVENT_MONITORDOWN/1_0", "nwparser.p0", "%{obj_name->} - State %{event_state}"); -var part284 = // "Pattern{Constant(''), Field(obj_name,false)}" -match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); +var part284 = match("MESSAGE#31:EVENT_MONITORDOWN/1_2", "nwparser.p0", "%{obj_name}"); -var part285 = // "Pattern{Constant('" '), Field(p0,false)}" -match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); +var part285 = match("MESSAGE#45:PITBOSS_Message1/0", "nwparser.payload", "\" %{p0}"); -var part286 = // "Pattern{Constant(''), Field(info,false), Constant('"')}" -match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); +var part286 = match("MESSAGE#45:PITBOSS_Message1/2", "nwparser.p0", "%{info}\""); -var part287 = // "Pattern{Constant('sysIpAddress = '), Field(hostip,false), Constant(')')}" -match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); +var part287 = match("MESSAGE#54:SNMP_TRAP_SENT7/3_3", "nwparser.p0", "sysIpAddress = %{hostip})"); -var part288 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); +var part288 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/0", "nwparser.payload", "%{} %{p0}"); -var part289 = // "Pattern{Constant('ClientIP '), Field(p0,false)}" -match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); +var part289 = match("MESSAGE#86:SSLLOG_SSL_HANDSHAKE_FAILURE/1_0", "nwparser.p0", "ClientIP %{p0}"); -var part290 = // "Pattern{Constant('" '), Field(fld10,true), Constant(' GMT" - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); +var part290 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_0", "nwparser.p0", "\" %{fld10->} GMT\" - End_time %{p0}"); -var part291 = // "Pattern{Constant('" '), Field(fld10,false), Constant('" - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); +var part291 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_1", "nwparser.p0", "\" %{fld10}\" - End_time %{p0}"); -var part292 = // "Pattern{Field(fld10,true), Constant(' - End_time '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); +var part292 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/1_2", "nwparser.p0", "%{fld10->} - End_time %{p0}"); -var part293 = // "Pattern{Constant('" '), Field(fld11,true), Constant(' GMT" - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); +var part293 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_0", "nwparser.p0", "\" %{fld11->} GMT\" - Duration %{p0}"); -var part294 = // "Pattern{Constant('" '), Field(fld11,false), Constant('" - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); +var part294 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_1", "nwparser.p0", "\" %{fld11}\" - Duration %{p0}"); -var part295 = // "Pattern{Field(fld11,true), Constant(' - Duration '), Field(p0,false)}" -match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); +var part295 = match("MESSAGE#93:SSLVPN_ICAEND_CONNSTAT/2_2", "nwparser.p0", "%{fld11->} - Duration %{p0}"); -var part296 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); +var part296 = match("MESSAGE#94:SSLVPN_LOGIN/1_0", "nwparser.p0", "Context %{fld1->} - SessionId: %{sessionid}- User %{p0}"); -var part297 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); +var part297 = match("MESSAGE#94:SSLVPN_LOGIN/1_1", "nwparser.p0", "Context %{fld1->} - User %{p0}"); -var part298 = // "Pattern{Constant('User '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); +var part298 = match("MESSAGE#94:SSLVPN_LOGIN/1_2", "nwparser.p0", "User %{p0}"); -var part299 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('- Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); +var part299 = match("MESSAGE#94:SSLVPN_LOGIN/2", "nwparser.p0", "%{} %{username}- Client_ip %{saddr->} - Nat_ip %{p0}"); -var part300 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); +var part300 = match("MESSAGE#94:SSLVPN_LOGIN/3_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver %{p0}"); -var part301 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver '), Field(p0,false)}" -match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); +var part301 = match("MESSAGE#94:SSLVPN_LOGIN/3_1", "nwparser.p0", "%{stransaddr->} - Vserver %{p0}"); -var part302 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start_time '), Field(p0,false)}" -match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); +var part302 = match("MESSAGE#95:SSLVPN_LOGOUT/4", "nwparser.p0", "%{daddr}:%{dport->} - Start_time %{p0}"); -var part303 = // "Pattern{Constant('Context '), Field(fld1,true), Constant(' - SessionId: '), Field(sessionid,false), Constant('- User '), Field(username,true), Constant(' - Client_ip '), Field(hostip,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); +var part303 = match("MESSAGE#97:SSLVPN_UDPFLOWSTAT/0", "nwparser.payload", "Context %{fld1->} - SessionId: %{sessionid}- User %{username->} - Client_ip %{hostip->} - Nat_ip %{p0}"); -var part304 = // "Pattern{Field(,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); +var part304 = match("MESSAGE#100:SSLVPN_Message/0", "nwparser.payload", "%{}\"%{p0}"); -var part305 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Vserver '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - NatIP '), Field(stransaddr,false), Constant(':'), Field(stransport,true), Constant(' - Destination '), Field(dtransaddr,false), Constant(':'), Field(dtransport,true), Constant(' - Delink Time '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); +var part305 = match("MESSAGE#102:TCP_CONN_DELINK/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Vserver %{daddr}:%{dport->} - NatIP %{stransaddr}:%{stransport->} - Destination %{dtransaddr}:%{dtransport->} - Delink Time %{p0}"); -var part306 = // "Pattern{Field(fld11,true), Constant(' GMT - Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); +var part306 = match("MESSAGE#102:TCP_CONN_DELINK/1_0", "nwparser.p0", "%{fld11->} GMT - Total_bytes_send %{p0}"); -var part307 = // "Pattern{Field(fld11,true), Constant(' - Total_bytes_send '), Field(p0,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); +var part307 = match("MESSAGE#102:TCP_CONN_DELINK/1_1", "nwparser.p0", "%{fld11->} - Total_bytes_send %{p0}"); -var part308 = // "Pattern{Field(sbytes,true), Constant(' - Total_bytes_recv '), Field(rbytes,false)}" -match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); +var part308 = match("MESSAGE#102:TCP_CONN_DELINK/2", "nwparser.p0", "%{sbytes->} - Total_bytes_recv %{rbytes}"); -var part309 = // "Pattern{Constant('Source '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' - Destination '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' - Start Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); +var part309 = match("MESSAGE#103:TCP_CONN_TERMINATE/0", "nwparser.payload", "Source %{saddr}:%{sport->} - Destination %{daddr}:%{dport->} - Start Time %{p0}"); -var part310 = // "Pattern{Field(fld10,true), Constant(' GMT - End Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); +var part310 = match("MESSAGE#103:TCP_CONN_TERMINATE/1_0", "nwparser.p0", "%{fld10->} GMT - End Time %{p0}"); -var part311 = // "Pattern{Field(fld10,true), Constant(' - End Time '), Field(p0,false)}" -match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); +var part311 = match("MESSAGE#103:TCP_CONN_TERMINATE/1_1", "nwparser.p0", "%{fld10->} - End Time %{p0}"); -var part312 = // "Pattern{Field(info,true), Constant(' "')}" -match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); +var part312 = match("MESSAGE#113:CLUSTERD_Message:02/1_1", "nwparser.p0", "%{info->} \""); -var part313 = // "Pattern{Constant('"'), Field(event_type,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); +var part313 = match("MESSAGE#158:AAA_Message/0", "nwparser.payload", "\"%{event_type}: %{p0}"); -var part314 = // "Pattern{Constant('Sessionid '), Field(sessionid,true), Constant(' - User '), Field(username,true), Constant(' - Client_ip '), Field(saddr,true), Constant(' - Nat_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); +var part314 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/0", "nwparser.payload", "Sessionid %{sessionid->} - User %{username->} - Client_ip %{saddr->} - Nat_ip %{p0}"); -var part315 = // "Pattern{Constant('"'), Field(stransaddr,false), Constant('" - Vserver_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); +var part315 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_0", "nwparser.p0", "\"%{stransaddr}\" - Vserver_ip %{p0}"); -var part316 = // "Pattern{Field(stransaddr,true), Constant(' - Vserver_ip '), Field(p0,false)}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); +var part316 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/1_1", "nwparser.p0", "%{stransaddr->} - Vserver_ip %{p0}"); -var part317 = // "Pattern{Field(daddr,true), Constant(' - Errmsg " '), Field(event_description,true), Constant(' "')}" -match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); +var part317 = match("MESSAGE#167:SSLVPN_REMOVE_SESSION_ERR/2", "nwparser.p0", "%{daddr->} - Errmsg \" %{event_description->} \""); var select72 = linear_select([ dup21, @@ -3881,8 +3506,7 @@ var select74 = linear_select([ dup33, ]); -var part318 = // "Pattern{Field(fld1,false), Constant(':UserLogin:'), Field(username,true), Constant(' - '), Field(event_description,true), Constant(' from client IP Address '), Field(saddr,false)}" -match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ +var part318 = match("MESSAGE#84:SNMP_TRAP_SENT:05", "nwparser.payload", "%{fld1}:UserLogin:%{username->} - %{event_description->} from client IP Address %{saddr}", processor_chain([ dup5, dup4, ])); @@ -3920,28 +3544,24 @@ var select80 = linear_select([ dup82, ]); -var part319 = // "Pattern{Constant('User '), Field(username,true), Constant(' - Remote_ip '), Field(saddr,true), Constant(' - Command "'), Field(action,false), Constant('" - Status "'), Field(disposition,false), Constant('"')}" -match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ +var part319 = match("MESSAGE#109:UI_CMD_EXECUTED", "nwparser.payload", "User %{username->} - Remote_ip %{saddr->} - Command \"%{action}\" - Status \"%{disposition}\"", processor_chain([ dup88, dup89, dup3, dup4, ])); -var part320 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs3='), Field(fld6,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" -match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ +var part320 = match("MESSAGE#122:APPFW_COOKIE", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs3=%{fld6->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ dup9, dup91, ])); -var part321 = // "Pattern{Field(product,false), Constant('|'), Field(version,false), Constant('|'), Field(rule,false), Constant('|'), Field(fld1,false), Constant('|'), Field(severity,false), Constant('|src='), Field(saddr,true), Constant(' spt='), Field(sport,true), Constant(' method='), Field(web_method,true), Constant(' request='), Field(url,true), Constant(' msg='), Field(info,true), Constant(' cn1='), Field(fld2,true), Constant(' cn2='), Field(fld3,true), Constant(' cs1='), Field(policyname,true), Constant(' cs2='), Field(fld5,true), Constant(' cs4='), Field(severity,true), Constant(' cs5='), Field(fld8,true), Constant(' act='), Field(action,false)}" -match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ +var part321 = match("MESSAGE#128:AF_400_RESP", "nwparser.payload", "%{product}|%{version}|%{rule}|%{fld1}|%{severity}|src=%{saddr->} spt=%{sport->} method=%{web_method->} request=%{url->} msg=%{info->} cn1=%{fld2->} cn2=%{fld3->} cs1=%{policyname->} cs2=%{fld5->} cs4=%{severity->} cs5=%{fld8->} act=%{action}", processor_chain([ dup11, dup91, ])); -var part322 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ +var part322 = match_copy("MESSAGE#165:AAATM_Message:06", "nwparser.payload", "info", processor_chain([ dup9, dup4, ])); diff --git a/x-pack/filebeat/module/cyberark/corepas/config/pipeline.js b/x-pack/filebeat/module/cyberark/corepas/config/pipeline.js index 02a511984c0..0f8be954311 100644 --- a/x-pack/filebeat/module/cyberark/corepas/config/pipeline.js +++ b/x-pack/filebeat/module/cyberark/corepas/config/pipeline.js @@ -93,146 +93,99 @@ var dup29 = setc("ec_activity","Disable"); var dup30 = setc("eventcategory","1401050200"); -var dup31 = // "Pattern{Constant('Version='), Field(p0,false)}" -match("MESSAGE#568:300:02/0", "nwparser.payload", "Version=%{p0}"); +var dup31 = match("MESSAGE#568:300:02/0", "nwparser.payload", "Version=%{p0}"); -var dup32 = // "Pattern{Constant('"'), Field(version,false), Constant('";Message='), Field(p0,false)}" -match("MESSAGE#568:300:02/1_0", "nwparser.p0", "\"%{version}\";Message=%{p0}"); +var dup32 = match("MESSAGE#568:300:02/1_0", "nwparser.p0", "\"%{version}\";Message=%{p0}"); -var dup33 = // "Pattern{Field(version,false), Constant(';Message='), Field(p0,false)}" -match("MESSAGE#568:300:02/1_1", "nwparser.p0", "%{version};Message=%{p0}"); +var dup33 = match("MESSAGE#568:300:02/1_1", "nwparser.p0", "%{version};Message=%{p0}"); -var dup34 = // "Pattern{Constant('"'), Field(action,false), Constant('";Issuer='), Field(p0,false)}" -match("MESSAGE#568:300:02/2_0", "nwparser.p0", "\"%{action}\";Issuer=%{p0}"); +var dup34 = match("MESSAGE#568:300:02/2_0", "nwparser.p0", "\"%{action}\";Issuer=%{p0}"); -var dup35 = // "Pattern{Field(action,false), Constant(';Issuer='), Field(p0,false)}" -match("MESSAGE#568:300:02/2_1", "nwparser.p0", "%{action};Issuer=%{p0}"); +var dup35 = match("MESSAGE#568:300:02/2_1", "nwparser.p0", "%{action};Issuer=%{p0}"); -var dup36 = // "Pattern{Constant('"'), Field(username,false), Constant('";Station='), Field(p0,false)}" -match("MESSAGE#568:300:02/3_0", "nwparser.p0", "\"%{username}\";Station=%{p0}"); +var dup36 = match("MESSAGE#568:300:02/3_0", "nwparser.p0", "\"%{username}\";Station=%{p0}"); -var dup37 = // "Pattern{Field(username,false), Constant(';Station='), Field(p0,false)}" -match("MESSAGE#568:300:02/3_1", "nwparser.p0", "%{username};Station=%{p0}"); +var dup37 = match("MESSAGE#568:300:02/3_1", "nwparser.p0", "%{username};Station=%{p0}"); -var dup38 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";File='), Field(p0,false)}" -match("MESSAGE#568:300:02/4_0", "nwparser.p0", "\"%{hostip}\";File=%{p0}"); +var dup38 = match("MESSAGE#568:300:02/4_0", "nwparser.p0", "\"%{hostip}\";File=%{p0}"); -var dup39 = // "Pattern{Field(hostip,false), Constant(';File='), Field(p0,false)}" -match("MESSAGE#568:300:02/4_1", "nwparser.p0", "%{hostip};File=%{p0}"); +var dup39 = match("MESSAGE#568:300:02/4_1", "nwparser.p0", "%{hostip};File=%{p0}"); -var dup40 = // "Pattern{Constant('"'), Field(filename,false), Constant('";Safe='), Field(p0,false)}" -match("MESSAGE#568:300:02/5_0", "nwparser.p0", "\"%{filename}\";Safe=%{p0}"); +var dup40 = match("MESSAGE#568:300:02/5_0", "nwparser.p0", "\"%{filename}\";Safe=%{p0}"); -var dup41 = // "Pattern{Field(filename,false), Constant(';Safe='), Field(p0,false)}" -match("MESSAGE#568:300:02/5_1", "nwparser.p0", "%{filename};Safe=%{p0}"); +var dup41 = match("MESSAGE#568:300:02/5_1", "nwparser.p0", "%{filename};Safe=%{p0}"); -var dup42 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";Location='), Field(p0,false)}" -match("MESSAGE#568:300:02/6_0", "nwparser.p0", "\"%{group_object}\";Location=%{p0}"); +var dup42 = match("MESSAGE#568:300:02/6_0", "nwparser.p0", "\"%{group_object}\";Location=%{p0}"); -var dup43 = // "Pattern{Field(group_object,false), Constant(';Location='), Field(p0,false)}" -match("MESSAGE#568:300:02/6_1", "nwparser.p0", "%{group_object};Location=%{p0}"); +var dup43 = match("MESSAGE#568:300:02/6_1", "nwparser.p0", "%{group_object};Location=%{p0}"); -var dup44 = // "Pattern{Constant('"'), Field(directory,false), Constant('";Category='), Field(p0,false)}" -match("MESSAGE#568:300:02/7_0", "nwparser.p0", "\"%{directory}\";Category=%{p0}"); +var dup44 = match("MESSAGE#568:300:02/7_0", "nwparser.p0", "\"%{directory}\";Category=%{p0}"); -var dup45 = // "Pattern{Field(directory,false), Constant(';Category='), Field(p0,false)}" -match("MESSAGE#568:300:02/7_1", "nwparser.p0", "%{directory};Category=%{p0}"); +var dup45 = match("MESSAGE#568:300:02/7_1", "nwparser.p0", "%{directory};Category=%{p0}"); -var dup46 = // "Pattern{Constant('"'), Field(category,false), Constant('";RequestId='), Field(p0,false)}" -match("MESSAGE#568:300:02/8_0", "nwparser.p0", "\"%{category}\";RequestId=%{p0}"); +var dup46 = match("MESSAGE#568:300:02/8_0", "nwparser.p0", "\"%{category}\";RequestId=%{p0}"); -var dup47 = // "Pattern{Field(category,false), Constant(';RequestId='), Field(p0,false)}" -match("MESSAGE#568:300:02/8_1", "nwparser.p0", "%{category};RequestId=%{p0}"); +var dup47 = match("MESSAGE#568:300:02/8_1", "nwparser.p0", "%{category};RequestId=%{p0}"); -var dup48 = // "Pattern{Constant('"'), Field(id1,false), Constant('";Reason='), Field(p0,false)}" -match("MESSAGE#568:300:02/9_0", "nwparser.p0", "\"%{id1}\";Reason=%{p0}"); +var dup48 = match("MESSAGE#568:300:02/9_0", "nwparser.p0", "\"%{id1}\";Reason=%{p0}"); -var dup49 = // "Pattern{Field(id1,false), Constant(';Reason='), Field(p0,false)}" -match("MESSAGE#568:300:02/9_1", "nwparser.p0", "%{id1};Reason=%{p0}"); +var dup49 = match("MESSAGE#568:300:02/9_1", "nwparser.p0", "%{id1};Reason=%{p0}"); -var dup50 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";Severity='), Field(p0,false)}" -match("MESSAGE#568:300:02/10_0", "nwparser.p0", "\"%{event_description}\";Severity=%{p0}"); +var dup50 = match("MESSAGE#568:300:02/10_0", "nwparser.p0", "\"%{event_description}\";Severity=%{p0}"); -var dup51 = // "Pattern{Field(event_description,false), Constant(';Severity='), Field(p0,false)}" -match("MESSAGE#568:300:02/10_1", "nwparser.p0", "%{event_description};Severity=%{p0}"); +var dup51 = match("MESSAGE#568:300:02/10_1", "nwparser.p0", "%{event_description};Severity=%{p0}"); -var dup52 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/11_0", "nwparser.p0", "\"%{severity}\";SourceUser=%{p0}"); +var dup52 = match("MESSAGE#568:300:02/11_0", "nwparser.p0", "\"%{severity}\";SourceUser=%{p0}"); -var dup53 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/11_1", "nwparser.p0", "%{severity};SourceUser=%{p0}"); +var dup53 = match("MESSAGE#568:300:02/11_1", "nwparser.p0", "%{severity};SourceUser=%{p0}"); -var dup54 = // "Pattern{Constant('"'), Field(group,false), Constant('";TargetUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/12_0", "nwparser.p0", "\"%{group}\";TargetUser=%{p0}"); +var dup54 = match("MESSAGE#568:300:02/12_0", "nwparser.p0", "\"%{group}\";TargetUser=%{p0}"); -var dup55 = // "Pattern{Field(group,false), Constant(';TargetUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/12_1", "nwparser.p0", "%{group};TargetUser=%{p0}"); +var dup55 = match("MESSAGE#568:300:02/12_1", "nwparser.p0", "%{group};TargetUser=%{p0}"); -var dup56 = // "Pattern{Constant('"'), Field(uid,false), Constant('";GatewayStation='), Field(p0,false)}" -match("MESSAGE#568:300:02/13_0", "nwparser.p0", "\"%{uid}\";GatewayStation=%{p0}"); +var dup56 = match("MESSAGE#568:300:02/13_0", "nwparser.p0", "\"%{uid}\";GatewayStation=%{p0}"); -var dup57 = // "Pattern{Field(uid,false), Constant(';GatewayStation='), Field(p0,false)}" -match("MESSAGE#568:300:02/13_1", "nwparser.p0", "%{uid};GatewayStation=%{p0}"); +var dup57 = match("MESSAGE#568:300:02/13_1", "nwparser.p0", "%{uid};GatewayStation=%{p0}"); -var dup58 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";TicketID='), Field(p0,false)}" -match("MESSAGE#568:300:02/14_0", "nwparser.p0", "\"%{saddr}\";TicketID=%{p0}"); +var dup58 = match("MESSAGE#568:300:02/14_0", "nwparser.p0", "\"%{saddr}\";TicketID=%{p0}"); -var dup59 = // "Pattern{Field(saddr,false), Constant(';TicketID='), Field(p0,false)}" -match("MESSAGE#568:300:02/14_1", "nwparser.p0", "%{saddr};TicketID=%{p0}"); +var dup59 = match("MESSAGE#568:300:02/14_1", "nwparser.p0", "%{saddr};TicketID=%{p0}"); -var dup60 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";PolicyID='), Field(p0,false)}" -match("MESSAGE#568:300:02/15_0", "nwparser.p0", "\"%{operation_id}\";PolicyID=%{p0}"); +var dup60 = match("MESSAGE#568:300:02/15_0", "nwparser.p0", "\"%{operation_id}\";PolicyID=%{p0}"); -var dup61 = // "Pattern{Field(operation_id,false), Constant(';PolicyID='), Field(p0,false)}" -match("MESSAGE#568:300:02/15_1", "nwparser.p0", "%{operation_id};PolicyID=%{p0}"); +var dup61 = match("MESSAGE#568:300:02/15_1", "nwparser.p0", "%{operation_id};PolicyID=%{p0}"); -var dup62 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";UserName='), Field(p0,false)}" -match("MESSAGE#568:300:02/16_0", "nwparser.p0", "\"%{policyname}\";UserName=%{p0}"); +var dup62 = match("MESSAGE#568:300:02/16_0", "nwparser.p0", "\"%{policyname}\";UserName=%{p0}"); -var dup63 = // "Pattern{Field(policyname,false), Constant(';UserName='), Field(p0,false)}" -match("MESSAGE#568:300:02/16_1", "nwparser.p0", "%{policyname};UserName=%{p0}"); +var dup63 = match("MESSAGE#568:300:02/16_1", "nwparser.p0", "%{policyname};UserName=%{p0}"); -var dup64 = // "Pattern{Constant('"'), Field(fld11,false), Constant('";LogonDomain='), Field(p0,false)}" -match("MESSAGE#568:300:02/17_0", "nwparser.p0", "\"%{fld11}\";LogonDomain=%{p0}"); +var dup64 = match("MESSAGE#568:300:02/17_0", "nwparser.p0", "\"%{fld11}\";LogonDomain=%{p0}"); -var dup65 = // "Pattern{Field(fld11,false), Constant(';LogonDomain='), Field(p0,false)}" -match("MESSAGE#568:300:02/17_1", "nwparser.p0", "%{fld11};LogonDomain=%{p0}"); +var dup65 = match("MESSAGE#568:300:02/17_1", "nwparser.p0", "%{fld11};LogonDomain=%{p0}"); -var dup66 = // "Pattern{Constant('"'), Field(domain,false), Constant('";Address='), Field(p0,false)}" -match("MESSAGE#568:300:02/18_0", "nwparser.p0", "\"%{domain}\";Address=%{p0}"); +var dup66 = match("MESSAGE#568:300:02/18_0", "nwparser.p0", "\"%{domain}\";Address=%{p0}"); -var dup67 = // "Pattern{Field(domain,false), Constant(';Address='), Field(p0,false)}" -match("MESSAGE#568:300:02/18_1", "nwparser.p0", "%{domain};Address=%{p0}"); +var dup67 = match("MESSAGE#568:300:02/18_1", "nwparser.p0", "%{domain};Address=%{p0}"); -var dup68 = // "Pattern{Constant('"'), Field(fld14,false), Constant('";CPMStatus='), Field(p0,false)}" -match("MESSAGE#568:300:02/19_0", "nwparser.p0", "\"%{fld14}\";CPMStatus=%{p0}"); +var dup68 = match("MESSAGE#568:300:02/19_0", "nwparser.p0", "\"%{fld14}\";CPMStatus=%{p0}"); -var dup69 = // "Pattern{Field(fld14,false), Constant(';CPMStatus='), Field(p0,false)}" -match("MESSAGE#568:300:02/19_1", "nwparser.p0", "%{fld14};CPMStatus=%{p0}"); +var dup69 = match("MESSAGE#568:300:02/19_1", "nwparser.p0", "%{fld14};CPMStatus=%{p0}"); -var dup70 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";Port='), Field(p0,false)}" -match("MESSAGE#568:300:02/20_0", "nwparser.p0", "\"%{disposition}\";Port=%{p0}"); +var dup70 = match("MESSAGE#568:300:02/20_0", "nwparser.p0", "\"%{disposition}\";Port=%{p0}"); -var dup71 = // "Pattern{Field(disposition,false), Constant(';Port='), Field(p0,false)}" -match("MESSAGE#568:300:02/20_1", "nwparser.p0", "%{disposition};Port=%{p0}"); +var dup71 = match("MESSAGE#568:300:02/20_1", "nwparser.p0", "%{disposition};Port=%{p0}"); -var dup72 = // "Pattern{Constant('"'), Field(dport,false), Constant('";Database='), Field(p0,false)}" -match("MESSAGE#568:300:02/21_0", "nwparser.p0", "\"%{dport}\";Database=%{p0}"); +var dup72 = match("MESSAGE#568:300:02/21_0", "nwparser.p0", "\"%{dport}\";Database=%{p0}"); -var dup73 = // "Pattern{Field(dport,false), Constant(';Database='), Field(p0,false)}" -match("MESSAGE#568:300:02/21_1", "nwparser.p0", "%{dport};Database=%{p0}"); +var dup73 = match("MESSAGE#568:300:02/21_1", "nwparser.p0", "%{dport};Database=%{p0}"); -var dup74 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";DeviceType='), Field(p0,false)}" -match("MESSAGE#568:300:02/22_0", "nwparser.p0", "\"%{db_name}\";DeviceType=%{p0}"); +var dup74 = match("MESSAGE#568:300:02/22_0", "nwparser.p0", "\"%{db_name}\";DeviceType=%{p0}"); -var dup75 = // "Pattern{Field(db_name,false), Constant(';DeviceType='), Field(p0,false)}" -match("MESSAGE#568:300:02/22_1", "nwparser.p0", "%{db_name};DeviceType=%{p0}"); +var dup75 = match("MESSAGE#568:300:02/22_1", "nwparser.p0", "%{db_name};DeviceType=%{p0}"); -var dup76 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="ApplicationType='), Field(p0,false)}" -match("MESSAGE#568:300:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"ApplicationType=%{p0}"); +var dup76 = match("MESSAGE#568:300:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"ApplicationType=%{p0}"); -var dup77 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="ApplicationType='), Field(p0,false)}" -match("MESSAGE#568:300:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"ApplicationType=%{p0}"); +var dup77 = match("MESSAGE#568:300:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"ApplicationType=%{p0}"); var dup78 = setc("eventcategory","1502000000"); @@ -248,203 +201,137 @@ var dup83 = setc("eventcategory","1501000000"); var dup84 = setc("eventcategory","1206000000"); -var dup85 = // "Pattern{Constant('"'), Field(version,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/1_0", "nwparser.p0", "\"%{version}\";%{p0}"); +var dup85 = match("MESSAGE#621:411/1_0", "nwparser.p0", "\"%{version}\";%{p0}"); -var dup86 = // "Pattern{Field(version,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/1_1", "nwparser.p0", "%{version};%{p0}"); +var dup86 = match("MESSAGE#621:411/1_1", "nwparser.p0", "%{version};%{p0}"); -var dup87 = // "Pattern{Constant('Message='), Field(p0,false)}" -match("MESSAGE#621:411/2", "nwparser.p0", "Message=%{p0}"); +var dup87 = match("MESSAGE#621:411/2", "nwparser.p0", "Message=%{p0}"); -var dup88 = // "Pattern{Constant('"'), Field(action,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/3_0", "nwparser.p0", "\"%{action}\";%{p0}"); +var dup88 = match("MESSAGE#621:411/3_0", "nwparser.p0", "\"%{action}\";%{p0}"); -var dup89 = // "Pattern{Field(action,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/3_1", "nwparser.p0", "%{action};%{p0}"); +var dup89 = match("MESSAGE#621:411/3_1", "nwparser.p0", "%{action};%{p0}"); -var dup90 = // "Pattern{Constant('Issuer='), Field(p0,false)}" -match("MESSAGE#621:411/4", "nwparser.p0", "Issuer=%{p0}"); +var dup90 = match("MESSAGE#621:411/4", "nwparser.p0", "Issuer=%{p0}"); -var dup91 = // "Pattern{Constant('"'), Field(username,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/5_0", "nwparser.p0", "\"%{username}\";%{p0}"); +var dup91 = match("MESSAGE#621:411/5_0", "nwparser.p0", "\"%{username}\";%{p0}"); -var dup92 = // "Pattern{Field(username,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/5_1", "nwparser.p0", "%{username};%{p0}"); +var dup92 = match("MESSAGE#621:411/5_1", "nwparser.p0", "%{username};%{p0}"); -var dup93 = // "Pattern{Constant('Station='), Field(p0,false)}" -match("MESSAGE#621:411/6", "nwparser.p0", "Station=%{p0}"); +var dup93 = match("MESSAGE#621:411/6", "nwparser.p0", "Station=%{p0}"); -var dup94 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/7_0", "nwparser.p0", "\"%{hostip}\";%{p0}"); +var dup94 = match("MESSAGE#621:411/7_0", "nwparser.p0", "\"%{hostip}\";%{p0}"); -var dup95 = // "Pattern{Field(hostip,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/7_1", "nwparser.p0", "%{hostip};%{p0}"); +var dup95 = match("MESSAGE#621:411/7_1", "nwparser.p0", "%{hostip};%{p0}"); -var dup96 = // "Pattern{Constant('File='), Field(p0,false)}" -match("MESSAGE#621:411/8", "nwparser.p0", "File=%{p0}"); +var dup96 = match("MESSAGE#621:411/8", "nwparser.p0", "File=%{p0}"); -var dup97 = // "Pattern{Constant('"'), Field(filename,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/9_0", "nwparser.p0", "\"%{filename}\";%{p0}"); +var dup97 = match("MESSAGE#621:411/9_0", "nwparser.p0", "\"%{filename}\";%{p0}"); -var dup98 = // "Pattern{Field(filename,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/9_1", "nwparser.p0", "%{filename};%{p0}"); +var dup98 = match("MESSAGE#621:411/9_1", "nwparser.p0", "%{filename};%{p0}"); -var dup99 = // "Pattern{Constant('Safe='), Field(p0,false)}" -match("MESSAGE#621:411/10", "nwparser.p0", "Safe=%{p0}"); +var dup99 = match("MESSAGE#621:411/10", "nwparser.p0", "Safe=%{p0}"); -var dup100 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/11_0", "nwparser.p0", "\"%{group_object}\";%{p0}"); +var dup100 = match("MESSAGE#621:411/11_0", "nwparser.p0", "\"%{group_object}\";%{p0}"); -var dup101 = // "Pattern{Field(group_object,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/11_1", "nwparser.p0", "%{group_object};%{p0}"); +var dup101 = match("MESSAGE#621:411/11_1", "nwparser.p0", "%{group_object};%{p0}"); -var dup102 = // "Pattern{Constant('Location='), Field(p0,false)}" -match("MESSAGE#621:411/12", "nwparser.p0", "Location=%{p0}"); +var dup102 = match("MESSAGE#621:411/12", "nwparser.p0", "Location=%{p0}"); -var dup103 = // "Pattern{Constant('"'), Field(directory,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/13_0", "nwparser.p0", "\"%{directory}\";%{p0}"); +var dup103 = match("MESSAGE#621:411/13_0", "nwparser.p0", "\"%{directory}\";%{p0}"); -var dup104 = // "Pattern{Field(directory,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/13_1", "nwparser.p0", "%{directory};%{p0}"); +var dup104 = match("MESSAGE#621:411/13_1", "nwparser.p0", "%{directory};%{p0}"); -var dup105 = // "Pattern{Constant('Category='), Field(p0,false)}" -match("MESSAGE#621:411/14", "nwparser.p0", "Category=%{p0}"); +var dup105 = match("MESSAGE#621:411/14", "nwparser.p0", "Category=%{p0}"); -var dup106 = // "Pattern{Constant('"'), Field(category,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/15_0", "nwparser.p0", "\"%{category}\";%{p0}"); +var dup106 = match("MESSAGE#621:411/15_0", "nwparser.p0", "\"%{category}\";%{p0}"); -var dup107 = // "Pattern{Field(category,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/15_1", "nwparser.p0", "%{category};%{p0}"); +var dup107 = match("MESSAGE#621:411/15_1", "nwparser.p0", "%{category};%{p0}"); -var dup108 = // "Pattern{Constant('RequestId='), Field(p0,false)}" -match("MESSAGE#621:411/16", "nwparser.p0", "RequestId=%{p0}"); +var dup108 = match("MESSAGE#621:411/16", "nwparser.p0", "RequestId=%{p0}"); -var dup109 = // "Pattern{Constant('"'), Field(id1,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/17_0", "nwparser.p0", "\"%{id1}\";%{p0}"); +var dup109 = match("MESSAGE#621:411/17_0", "nwparser.p0", "\"%{id1}\";%{p0}"); -var dup110 = // "Pattern{Field(id1,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/17_1", "nwparser.p0", "%{id1};%{p0}"); +var dup110 = match("MESSAGE#621:411/17_1", "nwparser.p0", "%{id1};%{p0}"); -var dup111 = // "Pattern{Constant('Reason='), Field(p0,false)}" -match("MESSAGE#621:411/18", "nwparser.p0", "Reason=%{p0}"); +var dup111 = match("MESSAGE#621:411/18", "nwparser.p0", "Reason=%{p0}"); -var dup112 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/19_0", "nwparser.p0", "\"%{event_description}\";%{p0}"); +var dup112 = match("MESSAGE#621:411/19_0", "nwparser.p0", "\"%{event_description}\";%{p0}"); -var dup113 = // "Pattern{Field(event_description,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/19_1", "nwparser.p0", "%{event_description};%{p0}"); +var dup113 = match("MESSAGE#621:411/19_1", "nwparser.p0", "%{event_description};%{p0}"); -var dup114 = // "Pattern{Constant('Severity='), Field(p0,false)}" -match("MESSAGE#621:411/20", "nwparser.p0", "Severity=%{p0}"); +var dup114 = match("MESSAGE#621:411/20", "nwparser.p0", "Severity=%{p0}"); -var dup115 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser="'), Field(group,false), Constant('";TargetUser="'), Field(uid,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/21_0", "nwparser.p0", "\"%{severity}\";SourceUser=\"%{group}\";TargetUser=\"%{uid}\";%{p0}"); +var dup115 = match("MESSAGE#621:411/21_0", "nwparser.p0", "\"%{severity}\";SourceUser=\"%{group}\";TargetUser=\"%{uid}\";%{p0}"); -var dup116 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(group,false), Constant(';TargetUser='), Field(uid,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/21_1", "nwparser.p0", "%{severity};SourceUser=%{group};TargetUser=%{uid};%{p0}"); +var dup116 = match("MESSAGE#621:411/21_1", "nwparser.p0", "%{severity};SourceUser=%{group};TargetUser=%{uid};%{p0}"); -var dup117 = // "Pattern{Constant('"'), Field(severity,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/21_2", "nwparser.p0", "\"%{severity}\";%{p0}"); +var dup117 = match("MESSAGE#621:411/21_2", "nwparser.p0", "\"%{severity}\";%{p0}"); -var dup118 = // "Pattern{Field(severity,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/21_3", "nwparser.p0", "%{severity};%{p0}"); +var dup118 = match("MESSAGE#621:411/21_3", "nwparser.p0", "%{severity};%{p0}"); -var dup119 = // "Pattern{Constant('GatewayStation='), Field(p0,false)}" -match("MESSAGE#621:411/22", "nwparser.p0", "GatewayStation=%{p0}"); +var dup119 = match("MESSAGE#621:411/22", "nwparser.p0", "GatewayStation=%{p0}"); -var dup120 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/23_0", "nwparser.p0", "\"%{saddr}\";%{p0}"); +var dup120 = match("MESSAGE#621:411/23_0", "nwparser.p0", "\"%{saddr}\";%{p0}"); -var dup121 = // "Pattern{Field(saddr,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/23_1", "nwparser.p0", "%{saddr};%{p0}"); +var dup121 = match("MESSAGE#621:411/23_1", "nwparser.p0", "%{saddr};%{p0}"); -var dup122 = // "Pattern{Constant('TicketID='), Field(p0,false)}" -match("MESSAGE#621:411/24", "nwparser.p0", "TicketID=%{p0}"); +var dup122 = match("MESSAGE#621:411/24", "nwparser.p0", "TicketID=%{p0}"); -var dup123 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/25_0", "nwparser.p0", "\"%{operation_id}\";%{p0}"); +var dup123 = match("MESSAGE#621:411/25_0", "nwparser.p0", "\"%{operation_id}\";%{p0}"); -var dup124 = // "Pattern{Field(operation_id,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/25_1", "nwparser.p0", "%{operation_id};%{p0}"); +var dup124 = match("MESSAGE#621:411/25_1", "nwparser.p0", "%{operation_id};%{p0}"); -var dup125 = // "Pattern{Constant('PolicyID='), Field(p0,false)}" -match("MESSAGE#621:411/26", "nwparser.p0", "PolicyID=%{p0}"); +var dup125 = match("MESSAGE#621:411/26", "nwparser.p0", "PolicyID=%{p0}"); -var dup126 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/27_0", "nwparser.p0", "\"%{policyname}\";%{p0}"); +var dup126 = match("MESSAGE#621:411/27_0", "nwparser.p0", "\"%{policyname}\";%{p0}"); -var dup127 = // "Pattern{Field(policyname,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/27_1", "nwparser.p0", "%{policyname};%{p0}"); +var dup127 = match("MESSAGE#621:411/27_1", "nwparser.p0", "%{policyname};%{p0}"); -var dup128 = // "Pattern{Constant('UserName='), Field(p0,false)}" -match("MESSAGE#621:411/28", "nwparser.p0", "UserName=%{p0}"); +var dup128 = match("MESSAGE#621:411/28", "nwparser.p0", "UserName=%{p0}"); -var dup129 = // "Pattern{Constant('"'), Field(c_username,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/29_0", "nwparser.p0", "\"%{c_username}\";%{p0}"); +var dup129 = match("MESSAGE#621:411/29_0", "nwparser.p0", "\"%{c_username}\";%{p0}"); -var dup130 = // "Pattern{Field(c_username,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/29_1", "nwparser.p0", "%{c_username};%{p0}"); +var dup130 = match("MESSAGE#621:411/29_1", "nwparser.p0", "%{c_username};%{p0}"); -var dup131 = // "Pattern{Constant('LogonDomain='), Field(p0,false)}" -match("MESSAGE#621:411/30", "nwparser.p0", "LogonDomain=%{p0}"); +var dup131 = match("MESSAGE#621:411/30", "nwparser.p0", "LogonDomain=%{p0}"); -var dup132 = // "Pattern{Constant('"'), Field(domain,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/31_0", "nwparser.p0", "\"%{domain}\";%{p0}"); +var dup132 = match("MESSAGE#621:411/31_0", "nwparser.p0", "\"%{domain}\";%{p0}"); -var dup133 = // "Pattern{Field(domain,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/31_1", "nwparser.p0", "%{domain};%{p0}"); +var dup133 = match("MESSAGE#621:411/31_1", "nwparser.p0", "%{domain};%{p0}"); -var dup134 = // "Pattern{Constant('Address='), Field(p0,false)}" -match("MESSAGE#621:411/32", "nwparser.p0", "Address=%{p0}"); +var dup134 = match("MESSAGE#621:411/32", "nwparser.p0", "Address=%{p0}"); -var dup135 = // "Pattern{Constant('"'), Field(dhost,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/33_0", "nwparser.p0", "\"%{dhost}\";%{p0}"); +var dup135 = match("MESSAGE#621:411/33_0", "nwparser.p0", "\"%{dhost}\";%{p0}"); -var dup136 = // "Pattern{Field(dhost,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/33_1", "nwparser.p0", "%{dhost};%{p0}"); +var dup136 = match("MESSAGE#621:411/33_1", "nwparser.p0", "%{dhost};%{p0}"); -var dup137 = // "Pattern{Constant('CPMStatus='), Field(p0,false)}" -match("MESSAGE#621:411/34", "nwparser.p0", "CPMStatus=%{p0}"); +var dup137 = match("MESSAGE#621:411/34", "nwparser.p0", "CPMStatus=%{p0}"); -var dup138 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/35_0", "nwparser.p0", "\"%{disposition}\";%{p0}"); +var dup138 = match("MESSAGE#621:411/35_0", "nwparser.p0", "\"%{disposition}\";%{p0}"); -var dup139 = // "Pattern{Field(disposition,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/35_1", "nwparser.p0", "%{disposition};%{p0}"); +var dup139 = match("MESSAGE#621:411/35_1", "nwparser.p0", "%{disposition};%{p0}"); -var dup140 = // "Pattern{Constant('Port='), Field(p0,false)}" -match("MESSAGE#621:411/36", "nwparser.p0", "Port=%{p0}"); +var dup140 = match("MESSAGE#621:411/36", "nwparser.p0", "Port=%{p0}"); -var dup141 = // "Pattern{Constant('"'), Field(dport,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/37_0", "nwparser.p0", "\"%{dport}\";%{p0}"); +var dup141 = match("MESSAGE#621:411/37_0", "nwparser.p0", "\"%{dport}\";%{p0}"); -var dup142 = // "Pattern{Field(dport,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/37_1", "nwparser.p0", "%{dport};%{p0}"); +var dup142 = match("MESSAGE#621:411/37_1", "nwparser.p0", "%{dport};%{p0}"); -var dup143 = // "Pattern{Constant('Database='), Field(p0,false)}" -match("MESSAGE#621:411/38", "nwparser.p0", "Database=%{p0}"); +var dup143 = match("MESSAGE#621:411/38", "nwparser.p0", "Database=%{p0}"); -var dup144 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/39_0", "nwparser.p0", "\"%{db_name}\";%{p0}"); +var dup144 = match("MESSAGE#621:411/39_0", "nwparser.p0", "\"%{db_name}\";%{p0}"); -var dup145 = // "Pattern{Field(db_name,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/39_1", "nwparser.p0", "%{db_name};%{p0}"); +var dup145 = match("MESSAGE#621:411/39_1", "nwparser.p0", "%{db_name};%{p0}"); -var dup146 = // "Pattern{Constant('DeviceType='), Field(p0,false)}" -match("MESSAGE#621:411/40", "nwparser.p0", "DeviceType=%{p0}"); +var dup146 = match("MESSAGE#621:411/40", "nwparser.p0", "DeviceType=%{p0}"); -var dup147 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/41_0", "nwparser.p0", "\"%{obj_type}\";%{p0}"); +var dup147 = match("MESSAGE#621:411/41_0", "nwparser.p0", "\"%{obj_type}\";%{p0}"); -var dup148 = // "Pattern{Field(obj_type,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/41_1", "nwparser.p0", "%{obj_type};%{p0}"); +var dup148 = match("MESSAGE#621:411/41_1", "nwparser.p0", "%{obj_type};%{p0}"); -var dup149 = // "Pattern{Constant('ExtraDetails='), Field(p0,false)}" -match("MESSAGE#621:411/42", "nwparser.p0", "ExtraDetails=%{p0}"); +var dup149 = match("MESSAGE#621:411/42", "nwparser.p0", "ExtraDetails=%{p0}"); -var dup150 = // "Pattern{Field(info,false), Constant(';')}" -match("MESSAGE#621:411/43_1", "nwparser.p0", "%{info};"); +var dup150 = match("MESSAGE#621:411/43_1", "nwparser.p0", "%{info};"); var dup151 = tagval("MESSAGE#0:1:01", "nwparser.payload", tvm, { "Address": "dhost", @@ -477,8 +364,7 @@ var dup151 = tagval("MESSAGE#0:1:01", "nwparser.payload", tvm, { dup3, ])); -var dup152 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#1:1", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup152 = match("MESSAGE#1:1", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup1, dup2, ])); @@ -514,8 +400,7 @@ var dup153 = tagval("MESSAGE#2:2:01", "nwparser.payload", tvm, { dup3, ])); -var dup154 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup154 = match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup4, dup2, ])); @@ -555,8 +440,7 @@ var dup155 = tagval("MESSAGE#6:4:01", "nwparser.payload", tvm, { dup3, ])); -var dup156 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup156 = match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup5, dup6, dup7, @@ -599,8 +483,7 @@ var dup157 = tagval("MESSAGE#20:13:01", "nwparser.payload", tvm, { dup3, ])); -var dup158 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup158 = match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup16, dup17, @@ -639,8 +522,7 @@ var dup159 = tagval("MESSAGE#26:16:01", "nwparser.payload", tvm, { dup3, ])); -var dup160 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup160 = match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup19, dup2, ])); @@ -676,8 +558,7 @@ var dup161 = tagval("MESSAGE#30:18:01", "nwparser.payload", tvm, { dup3, ])); -var dup162 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup162 = match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup2, ])); @@ -713,8 +594,7 @@ var dup163 = tagval("MESSAGE#38:22:01", "nwparser.payload", tvm, { dup3, ])); -var dup164 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup164 = match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup21, dup2, ])); @@ -750,8 +630,7 @@ var dup165 = tagval("MESSAGE#70:38:01", "nwparser.payload", tvm, { dup3, ])); -var dup166 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup166 = match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup23, dup2, ])); @@ -787,8 +666,7 @@ var dup167 = tagval("MESSAGE#116:61:01", "nwparser.payload", tvm, { dup3, ])); -var dup168 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup168 = match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup20, dup2, ])); @@ -824,8 +702,7 @@ var dup169 = tagval("MESSAGE#126:66:01", "nwparser.payload", tvm, { dup3, ])); -var dup170 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup170 = match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup26, dup2, ])); @@ -1011,8 +888,7 @@ var dup195 = tagval("MESSAGE#591:317:01", "nwparser.payload", tvm, { dup3, ])); -var dup196 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup196 = match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup79, dup80, dup81, @@ -1050,8 +926,7 @@ var dup197 = tagval("MESSAGE#595:355:01", "nwparser.payload", tvm, { dup3, ])); -var dup198 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup198 = match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup82, dup2, ])); @@ -1087,14 +962,12 @@ var dup199 = tagval("MESSAGE#599:357:01", "nwparser.payload", tvm, { dup3, ])); -var dup200 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var dup200 = match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup83, dup2, ])); -var dup201 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location='), Field(directory,false), Constant(';Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false), Constant(';')}" -match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ +var dup201 = match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ dup4, dup2, dup3, @@ -1207,8 +1080,7 @@ var dup222 = linear_select([ dup148, ]); -var hdr1 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hproduct,true), Constant(' ProductName="'), Field(hdevice,false), Constant('",ProductAccount="'), Field(hfld1,false), Constant('",ProductProcess="'), Field(process,false), Constant('",EventId="'), Field(messageid,false), Constant('", '), Field(p0,false)}" -match("HEADER#0:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld1}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld1}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ setc("header_id","0001"), call({ dest: "nwparser.payload", @@ -1227,8 +1099,7 @@ match("HEADER#0:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct-> }), ])); -var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hdatetime,true), Constant(' '), Field(hproduct,true), Constant(' ProductName="'), Field(hdevice,false), Constant('",ProductAccount="'), Field(hfld4,false), Constant('",ProductProcess="'), Field(process,false), Constant('",EventId="'), Field(messageid,false), Constant('", '), Field(p0,false)}" -match("HEADER#1:0005", "message", "%{hfld1->} %{hdatetime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld4}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ +var hdr2 = match("HEADER#1:0005", "message", "%{hfld1->} %{hdatetime->} %{hproduct->} ProductName=\"%{hdevice}\",ProductAccount=\"%{hfld4}\",ProductProcess=\"%{process}\",EventId=\"%{messageid}\", %{p0}", processor_chain([ setc("header_id","0005"), call({ dest: "nwparser.payload", @@ -1247,23 +1118,19 @@ match("HEADER#1:0005", "message", "%{hfld1->} %{hdatetime->} %{hproduct->} Produ }), ])); -var hdr3 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hproduct,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" -match("HEADER#2:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ +var hdr3 = match("HEADER#2:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hproduct->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ setc("header_id","0002"), ])); -var hdr4 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hdatetime,true), Constant(' '), Field(hostname,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" -match("HEADER#3:0003", "message", "%{hfld1->} %{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ +var hdr4 = match("HEADER#3:0003", "message", "%{hfld1->} %{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ setc("header_id","0003"), ])); -var hdr5 = // "Pattern{Constant('%CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" -match("HEADER#4:0004", "message", "%CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ +var hdr5 = match("HEADER#4:0004", "message", "%CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ setc("header_id","0004"), ])); -var hdr6 = // "Pattern{Field(hdatetime,true), Constant(' '), Field(hostname,true), Constant(' %CYBERARK: MessageID="'), Field(messageid,false), Constant('";'), Field(payload,false)}" -match("HEADER#5:0006", "message", "%{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ +var hdr6 = match("HEADER#5:0006", "message", "%{hdatetime->} %{hostname->} %CYBERARK: MessageID=\"%{messageid}\";%{payload}", processor_chain([ setc("header_id","0006"), ])); @@ -1349,8 +1216,7 @@ var part1 = tagval("MESSAGE#8:7:01", "nwparser.payload", tvm, { var msg9 = msg("7:01", part1); -var part2 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#9:7", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part2 = match("MESSAGE#9:7", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup10, dup6, dup7, @@ -1403,8 +1269,7 @@ var part3 = tagval("MESSAGE#10:8:01", "nwparser.payload", tvm, { var msg11 = msg("8:01", part3); -var part4 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#11:8", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part4 = match("MESSAGE#11:8", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup12, dup6, dup13, @@ -1455,8 +1320,7 @@ var part5 = tagval("MESSAGE#12:9:01", "nwparser.payload", tvm, { var msg13 = msg("9:01", part5); -var part6 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#13:9", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part6 = match("MESSAGE#13:9", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup1, dup14, dup9, @@ -1550,8 +1414,7 @@ var part7 = tagval("MESSAGE#24:15:01", "nwparser.payload", tvm, { var msg25 = msg("15:01", part7); -var part8 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#25:15", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part8 = match("MESSAGE#25:15", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup18, dup9, @@ -1627,8 +1490,7 @@ var part9 = tagval("MESSAGE#32:19:01", "nwparser.payload", tvm, { var msg33 = msg("19:01", part9); -var part10 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#33:19", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part10 = match("MESSAGE#33:19", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup20, dup16, dup11, @@ -1676,8 +1538,7 @@ var part11 = tagval("MESSAGE#34:20:01", "nwparser.payload", tvm, { var msg35 = msg("20:01", part11); -var part12 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#35:20", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part12 = match("MESSAGE#35:20", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup19, dup16, dup2, @@ -1725,8 +1586,7 @@ var part13 = tagval("MESSAGE#36:21:01", "nwparser.payload", tvm, { var msg37 = msg("21:01", part13); -var part14 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#37:21", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part14 = match("MESSAGE#37:21", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup16, dup9, @@ -1782,8 +1642,7 @@ var part15 = tagval("MESSAGE#40:23:01", "nwparser.payload", tvm, { var msg41 = msg("23:01", part15); -var part16 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#41:23", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part16 = match("MESSAGE#41:23", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup22, dup2, ])); @@ -2576,8 +2435,7 @@ var part18 = tagval("MESSAGE#200:103:01", "nwparser.payload", tvm, { var msg201 = msg("103:01", part18); -var part19 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#201:103", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part19 = match("MESSAGE#201:103", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup27, dup6, dup7, @@ -2628,8 +2486,7 @@ var part20 = tagval("MESSAGE#202:104:01", "nwparser.payload", tvm, { var msg203 = msg("104:01", part20); -var part21 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#203:104", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part21 = match("MESSAGE#203:104", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup27, dup6, dup29, @@ -2928,8 +2785,7 @@ var part22 = tagval("MESSAGE#260:134:01", "nwparser.payload", tvm, { var msg261 = msg("134:01", part22); -var part23 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#261:134", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part23 = match("MESSAGE#261:134", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup30, dup2, ])); @@ -4318,8 +4174,7 @@ var select285 = linear_select([ msg568, ]); -var part24 = // "Pattern{Field(application,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld10,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" -match("MESSAGE#568:300:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); +var part24 = match("MESSAGE#568:300:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); var all1 = all_match({ processors: [ @@ -4410,8 +4265,7 @@ var select287 = linear_select([ msg573, ]); -var part26 = // "Pattern{Field(application,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld12,false), Constant(';SessionDuration='), Field(duration_string,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" -match("MESSAGE#573:302:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld12};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); +var part26 = match("MESSAGE#573:302:02/24", "nwparser.p0", "%{application};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld12};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); var all2 = all_match({ processors: [ @@ -4470,19 +4324,16 @@ var select289 = linear_select([ msg578, ]); -var part27 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="DstHost='), Field(p0,false)}" -match("MESSAGE#578:304:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"DstHost=%{p0}"); +var part27 = match("MESSAGE#578:304:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"DstHost=%{p0}"); -var part28 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="DstHost='), Field(p0,false)}" -match("MESSAGE#578:304:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"DstHost=%{p0}"); +var part28 = match("MESSAGE#578:304:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"DstHost=%{p0}"); var select290 = linear_select([ part27, part28, ]); -var part29 = // "Pattern{Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld10,false), Constant(';SessionDuration='), Field(duration_string,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';"')}" -match("MESSAGE#578:304:02/24", "nwparser.p0", "%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); +var part29 = match("MESSAGE#578:304:02/24", "nwparser.p0", "%{dhost};Protocol=%{protocol};PSMID=%{fld10};SessionDuration=%{duration_string};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};\""); var all3 = all_match({ processors: [ @@ -4592,8 +4443,7 @@ var part30 = tagval("MESSAGE#587:308:01", "nwparser.payload", tvm, { var msg588 = msg("308:01", part30); -var part31 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#588:308", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part31 = match("MESSAGE#588:308", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup78, dup2, ])); @@ -4642,8 +4492,7 @@ var part32 = tagval("MESSAGE#589:309:01", "nwparser.payload", tvm, { var msg590 = msg("309:01", part32); -var part33 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#590:309", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part33 = match("MESSAGE#590:309", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup10, dup6, dup7, @@ -4746,8 +4595,7 @@ var part34 = tagval("MESSAGE#603:190:01", "nwparser.payload", tvm, { var msg604 = msg("190:01", part34); -var part35 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#604:190", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part35 = match("MESSAGE#604:190", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup84, dup2, ])); @@ -4819,30 +4667,25 @@ var msg619 = msg("374", dup201); var msg620 = msg("376", dup201); -var part36 = // "Pattern{Constant('"'), Field(fld89,false), Constant('";LogonDomain='), Field(p0,false)}" -match("MESSAGE#620:411:01/17_0", "nwparser.p0", "\"%{fld89}\";LogonDomain=%{p0}"); +var part36 = match("MESSAGE#620:411:01/17_0", "nwparser.p0", "\"%{fld89}\";LogonDomain=%{p0}"); -var part37 = // "Pattern{Field(fld89,false), Constant(';LogonDomain='), Field(p0,false)}" -match("MESSAGE#620:411:01/17_1", "nwparser.p0", "%{fld89};LogonDomain=%{p0}"); +var part37 = match("MESSAGE#620:411:01/17_1", "nwparser.p0", "%{fld89};LogonDomain=%{p0}"); var select310 = linear_select([ part36, part37, ]); -var part38 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="Command='), Field(p0,false)}" -match("MESSAGE#620:411:01/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"Command=%{p0}"); +var part38 = match("MESSAGE#620:411:01/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"Command=%{p0}"); -var part39 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="Command='), Field(p0,false)}" -match("MESSAGE#620:411:01/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"Command=%{p0}"); +var part39 = match("MESSAGE#620:411:01/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"Command=%{p0}"); var select311 = linear_select([ part38, part39, ]); -var part40 = // "Pattern{Field(param,false), Constant(';ConnectionComponentId='), Field(fld67,false), Constant(';DstHost='), Field(dhost,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld11,false), Constant(';RDPOffset='), Field(fld12,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(c_username,false), Constant(';VIDOffset='), Field(fld13,false), Constant(';')}" -match("MESSAGE#620:411:01/24", "nwparser.p0", "%{param};ConnectionComponentId=%{fld67};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld11};RDPOffset=%{fld12};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};VIDOffset=%{fld13};"); +var part40 = match("MESSAGE#620:411:01/24", "nwparser.p0", "%{param};ConnectionComponentId=%{fld67};DstHost=%{dhost};Protocol=%{protocol};PSMID=%{fld11};RDPOffset=%{fld12};SessionID=%{sessionid};SrcHost=%{shost};User=%{c_username};VIDOffset=%{fld13};"); var all4 = all_match({ processors: [ @@ -4882,8 +4725,7 @@ var all4 = all_match({ var msg621 = msg("411:01", all4); -var part41 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';ProcessId='), Field(process_id,false), Constant(';ProcessName='), Field(process,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';RDPOffset='), Field(fld4,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" -match("MESSAGE#621:411/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};ProcessId=%{process_id};ProcessName=%{process};Protocol=%{protocol};PSMID=%{fld3};RDPOffset=%{fld4};SessionID=%{sessionid};SrcHost=%{shost};User=%{fld5};VIDOffset=%{fld6};\""); +var part41 = match("MESSAGE#621:411/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};ProcessId=%{process_id};ProcessName=%{process};Protocol=%{protocol};PSMID=%{fld3};RDPOffset=%{fld4};SessionID=%{sessionid};SrcHost=%{shost};User=%{fld5};VIDOffset=%{fld6};\""); var select312 = linear_select([ part41, @@ -4951,8 +4793,7 @@ var select313 = linear_select([ msg622, ]); -var part42 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location="'), Field(directory,false), Constant('";Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false)}" -match("MESSAGE#622:385", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=\"%{directory}\";Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info}", processor_chain([ +var part42 = match("MESSAGE#622:385", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=\"%{directory}\";Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info}", processor_chain([ dup4, dup2, dup3, @@ -4960,8 +4801,7 @@ match("MESSAGE#622:385", "nwparser.payload", "Version=%{version};Message=%{actio var msg623 = msg("385", part42); -var part43 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';SSHOffset='), Field(fld4,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" -match("MESSAGE#623:361/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};SSHOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); +var part43 = match("MESSAGE#623:361/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};SSHOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); var select314 = linear_select([ part43, @@ -5024,8 +4864,7 @@ var all6 = all_match({ var msg624 = msg("361", all6); -var part44 = // "Pattern{Constant('"Command='), Field(param,false), Constant(';ConnectionComponentId='), Field(fld1,false), Constant(';DstHost='), Field(fld2,false), Constant(';Protocol='), Field(protocol,false), Constant(';PSMID='), Field(fld3,false), Constant(';SessionID='), Field(sessionid,false), Constant(';SrcHost='), Field(shost,false), Constant(';TXTOffset='), Field(fld4,false), Constant(';User='), Field(fld5,false), Constant(';VIDOffset='), Field(fld6,false), Constant(';"')}" -match("MESSAGE#624:412/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};TXTOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); +var part44 = match("MESSAGE#624:412/43_0", "nwparser.p0", "\"Command=%{param};ConnectionComponentId=%{fld1};DstHost=%{fld2};Protocol=%{protocol};PSMID=%{fld3};SessionID=%{sessionid};SrcHost=%{shost};TXTOffset=%{fld4};User=%{fld5};VIDOffset=%{fld6};\""); var select315 = linear_select([ part44, @@ -5426,344 +5265,231 @@ var chain1 = processor_chain([ }), ]); -var part45 = // "Pattern{Constant('Version='), Field(p0,false)}" -match("MESSAGE#568:300:02/0", "nwparser.payload", "Version=%{p0}"); +var part45 = match("MESSAGE#568:300:02/0", "nwparser.payload", "Version=%{p0}"); -var part46 = // "Pattern{Constant('"'), Field(version,false), Constant('";Message='), Field(p0,false)}" -match("MESSAGE#568:300:02/1_0", "nwparser.p0", "\"%{version}\";Message=%{p0}"); +var part46 = match("MESSAGE#568:300:02/1_0", "nwparser.p0", "\"%{version}\";Message=%{p0}"); -var part47 = // "Pattern{Field(version,false), Constant(';Message='), Field(p0,false)}" -match("MESSAGE#568:300:02/1_1", "nwparser.p0", "%{version};Message=%{p0}"); +var part47 = match("MESSAGE#568:300:02/1_1", "nwparser.p0", "%{version};Message=%{p0}"); -var part48 = // "Pattern{Constant('"'), Field(action,false), Constant('";Issuer='), Field(p0,false)}" -match("MESSAGE#568:300:02/2_0", "nwparser.p0", "\"%{action}\";Issuer=%{p0}"); +var part48 = match("MESSAGE#568:300:02/2_0", "nwparser.p0", "\"%{action}\";Issuer=%{p0}"); -var part49 = // "Pattern{Field(action,false), Constant(';Issuer='), Field(p0,false)}" -match("MESSAGE#568:300:02/2_1", "nwparser.p0", "%{action};Issuer=%{p0}"); +var part49 = match("MESSAGE#568:300:02/2_1", "nwparser.p0", "%{action};Issuer=%{p0}"); -var part50 = // "Pattern{Constant('"'), Field(username,false), Constant('";Station='), Field(p0,false)}" -match("MESSAGE#568:300:02/3_0", "nwparser.p0", "\"%{username}\";Station=%{p0}"); +var part50 = match("MESSAGE#568:300:02/3_0", "nwparser.p0", "\"%{username}\";Station=%{p0}"); -var part51 = // "Pattern{Field(username,false), Constant(';Station='), Field(p0,false)}" -match("MESSAGE#568:300:02/3_1", "nwparser.p0", "%{username};Station=%{p0}"); +var part51 = match("MESSAGE#568:300:02/3_1", "nwparser.p0", "%{username};Station=%{p0}"); -var part52 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";File='), Field(p0,false)}" -match("MESSAGE#568:300:02/4_0", "nwparser.p0", "\"%{hostip}\";File=%{p0}"); +var part52 = match("MESSAGE#568:300:02/4_0", "nwparser.p0", "\"%{hostip}\";File=%{p0}"); -var part53 = // "Pattern{Field(hostip,false), Constant(';File='), Field(p0,false)}" -match("MESSAGE#568:300:02/4_1", "nwparser.p0", "%{hostip};File=%{p0}"); +var part53 = match("MESSAGE#568:300:02/4_1", "nwparser.p0", "%{hostip};File=%{p0}"); -var part54 = // "Pattern{Constant('"'), Field(filename,false), Constant('";Safe='), Field(p0,false)}" -match("MESSAGE#568:300:02/5_0", "nwparser.p0", "\"%{filename}\";Safe=%{p0}"); +var part54 = match("MESSAGE#568:300:02/5_0", "nwparser.p0", "\"%{filename}\";Safe=%{p0}"); -var part55 = // "Pattern{Field(filename,false), Constant(';Safe='), Field(p0,false)}" -match("MESSAGE#568:300:02/5_1", "nwparser.p0", "%{filename};Safe=%{p0}"); +var part55 = match("MESSAGE#568:300:02/5_1", "nwparser.p0", "%{filename};Safe=%{p0}"); -var part56 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";Location='), Field(p0,false)}" -match("MESSAGE#568:300:02/6_0", "nwparser.p0", "\"%{group_object}\";Location=%{p0}"); +var part56 = match("MESSAGE#568:300:02/6_0", "nwparser.p0", "\"%{group_object}\";Location=%{p0}"); -var part57 = // "Pattern{Field(group_object,false), Constant(';Location='), Field(p0,false)}" -match("MESSAGE#568:300:02/6_1", "nwparser.p0", "%{group_object};Location=%{p0}"); +var part57 = match("MESSAGE#568:300:02/6_1", "nwparser.p0", "%{group_object};Location=%{p0}"); -var part58 = // "Pattern{Constant('"'), Field(directory,false), Constant('";Category='), Field(p0,false)}" -match("MESSAGE#568:300:02/7_0", "nwparser.p0", "\"%{directory}\";Category=%{p0}"); +var part58 = match("MESSAGE#568:300:02/7_0", "nwparser.p0", "\"%{directory}\";Category=%{p0}"); -var part59 = // "Pattern{Field(directory,false), Constant(';Category='), Field(p0,false)}" -match("MESSAGE#568:300:02/7_1", "nwparser.p0", "%{directory};Category=%{p0}"); +var part59 = match("MESSAGE#568:300:02/7_1", "nwparser.p0", "%{directory};Category=%{p0}"); -var part60 = // "Pattern{Constant('"'), Field(category,false), Constant('";RequestId='), Field(p0,false)}" -match("MESSAGE#568:300:02/8_0", "nwparser.p0", "\"%{category}\";RequestId=%{p0}"); +var part60 = match("MESSAGE#568:300:02/8_0", "nwparser.p0", "\"%{category}\";RequestId=%{p0}"); -var part61 = // "Pattern{Field(category,false), Constant(';RequestId='), Field(p0,false)}" -match("MESSAGE#568:300:02/8_1", "nwparser.p0", "%{category};RequestId=%{p0}"); +var part61 = match("MESSAGE#568:300:02/8_1", "nwparser.p0", "%{category};RequestId=%{p0}"); -var part62 = // "Pattern{Constant('"'), Field(id1,false), Constant('";Reason='), Field(p0,false)}" -match("MESSAGE#568:300:02/9_0", "nwparser.p0", "\"%{id1}\";Reason=%{p0}"); +var part62 = match("MESSAGE#568:300:02/9_0", "nwparser.p0", "\"%{id1}\";Reason=%{p0}"); -var part63 = // "Pattern{Field(id1,false), Constant(';Reason='), Field(p0,false)}" -match("MESSAGE#568:300:02/9_1", "nwparser.p0", "%{id1};Reason=%{p0}"); +var part63 = match("MESSAGE#568:300:02/9_1", "nwparser.p0", "%{id1};Reason=%{p0}"); -var part64 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";Severity='), Field(p0,false)}" -match("MESSAGE#568:300:02/10_0", "nwparser.p0", "\"%{event_description}\";Severity=%{p0}"); +var part64 = match("MESSAGE#568:300:02/10_0", "nwparser.p0", "\"%{event_description}\";Severity=%{p0}"); -var part65 = // "Pattern{Field(event_description,false), Constant(';Severity='), Field(p0,false)}" -match("MESSAGE#568:300:02/10_1", "nwparser.p0", "%{event_description};Severity=%{p0}"); +var part65 = match("MESSAGE#568:300:02/10_1", "nwparser.p0", "%{event_description};Severity=%{p0}"); -var part66 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/11_0", "nwparser.p0", "\"%{severity}\";SourceUser=%{p0}"); +var part66 = match("MESSAGE#568:300:02/11_0", "nwparser.p0", "\"%{severity}\";SourceUser=%{p0}"); -var part67 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/11_1", "nwparser.p0", "%{severity};SourceUser=%{p0}"); +var part67 = match("MESSAGE#568:300:02/11_1", "nwparser.p0", "%{severity};SourceUser=%{p0}"); -var part68 = // "Pattern{Constant('"'), Field(group,false), Constant('";TargetUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/12_0", "nwparser.p0", "\"%{group}\";TargetUser=%{p0}"); +var part68 = match("MESSAGE#568:300:02/12_0", "nwparser.p0", "\"%{group}\";TargetUser=%{p0}"); -var part69 = // "Pattern{Field(group,false), Constant(';TargetUser='), Field(p0,false)}" -match("MESSAGE#568:300:02/12_1", "nwparser.p0", "%{group};TargetUser=%{p0}"); +var part69 = match("MESSAGE#568:300:02/12_1", "nwparser.p0", "%{group};TargetUser=%{p0}"); -var part70 = // "Pattern{Constant('"'), Field(uid,false), Constant('";GatewayStation='), Field(p0,false)}" -match("MESSAGE#568:300:02/13_0", "nwparser.p0", "\"%{uid}\";GatewayStation=%{p0}"); +var part70 = match("MESSAGE#568:300:02/13_0", "nwparser.p0", "\"%{uid}\";GatewayStation=%{p0}"); -var part71 = // "Pattern{Field(uid,false), Constant(';GatewayStation='), Field(p0,false)}" -match("MESSAGE#568:300:02/13_1", "nwparser.p0", "%{uid};GatewayStation=%{p0}"); +var part71 = match("MESSAGE#568:300:02/13_1", "nwparser.p0", "%{uid};GatewayStation=%{p0}"); -var part72 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";TicketID='), Field(p0,false)}" -match("MESSAGE#568:300:02/14_0", "nwparser.p0", "\"%{saddr}\";TicketID=%{p0}"); +var part72 = match("MESSAGE#568:300:02/14_0", "nwparser.p0", "\"%{saddr}\";TicketID=%{p0}"); -var part73 = // "Pattern{Field(saddr,false), Constant(';TicketID='), Field(p0,false)}" -match("MESSAGE#568:300:02/14_1", "nwparser.p0", "%{saddr};TicketID=%{p0}"); +var part73 = match("MESSAGE#568:300:02/14_1", "nwparser.p0", "%{saddr};TicketID=%{p0}"); -var part74 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";PolicyID='), Field(p0,false)}" -match("MESSAGE#568:300:02/15_0", "nwparser.p0", "\"%{operation_id}\";PolicyID=%{p0}"); +var part74 = match("MESSAGE#568:300:02/15_0", "nwparser.p0", "\"%{operation_id}\";PolicyID=%{p0}"); -var part75 = // "Pattern{Field(operation_id,false), Constant(';PolicyID='), Field(p0,false)}" -match("MESSAGE#568:300:02/15_1", "nwparser.p0", "%{operation_id};PolicyID=%{p0}"); +var part75 = match("MESSAGE#568:300:02/15_1", "nwparser.p0", "%{operation_id};PolicyID=%{p0}"); -var part76 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";UserName='), Field(p0,false)}" -match("MESSAGE#568:300:02/16_0", "nwparser.p0", "\"%{policyname}\";UserName=%{p0}"); +var part76 = match("MESSAGE#568:300:02/16_0", "nwparser.p0", "\"%{policyname}\";UserName=%{p0}"); -var part77 = // "Pattern{Field(policyname,false), Constant(';UserName='), Field(p0,false)}" -match("MESSAGE#568:300:02/16_1", "nwparser.p0", "%{policyname};UserName=%{p0}"); +var part77 = match("MESSAGE#568:300:02/16_1", "nwparser.p0", "%{policyname};UserName=%{p0}"); -var part78 = // "Pattern{Constant('"'), Field(fld11,false), Constant('";LogonDomain='), Field(p0,false)}" -match("MESSAGE#568:300:02/17_0", "nwparser.p0", "\"%{fld11}\";LogonDomain=%{p0}"); +var part78 = match("MESSAGE#568:300:02/17_0", "nwparser.p0", "\"%{fld11}\";LogonDomain=%{p0}"); -var part79 = // "Pattern{Field(fld11,false), Constant(';LogonDomain='), Field(p0,false)}" -match("MESSAGE#568:300:02/17_1", "nwparser.p0", "%{fld11};LogonDomain=%{p0}"); +var part79 = match("MESSAGE#568:300:02/17_1", "nwparser.p0", "%{fld11};LogonDomain=%{p0}"); -var part80 = // "Pattern{Constant('"'), Field(domain,false), Constant('";Address='), Field(p0,false)}" -match("MESSAGE#568:300:02/18_0", "nwparser.p0", "\"%{domain}\";Address=%{p0}"); +var part80 = match("MESSAGE#568:300:02/18_0", "nwparser.p0", "\"%{domain}\";Address=%{p0}"); -var part81 = // "Pattern{Field(domain,false), Constant(';Address='), Field(p0,false)}" -match("MESSAGE#568:300:02/18_1", "nwparser.p0", "%{domain};Address=%{p0}"); +var part81 = match("MESSAGE#568:300:02/18_1", "nwparser.p0", "%{domain};Address=%{p0}"); -var part82 = // "Pattern{Constant('"'), Field(fld14,false), Constant('";CPMStatus='), Field(p0,false)}" -match("MESSAGE#568:300:02/19_0", "nwparser.p0", "\"%{fld14}\";CPMStatus=%{p0}"); +var part82 = match("MESSAGE#568:300:02/19_0", "nwparser.p0", "\"%{fld14}\";CPMStatus=%{p0}"); -var part83 = // "Pattern{Field(fld14,false), Constant(';CPMStatus='), Field(p0,false)}" -match("MESSAGE#568:300:02/19_1", "nwparser.p0", "%{fld14};CPMStatus=%{p0}"); +var part83 = match("MESSAGE#568:300:02/19_1", "nwparser.p0", "%{fld14};CPMStatus=%{p0}"); -var part84 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";Port='), Field(p0,false)}" -match("MESSAGE#568:300:02/20_0", "nwparser.p0", "\"%{disposition}\";Port=%{p0}"); +var part84 = match("MESSAGE#568:300:02/20_0", "nwparser.p0", "\"%{disposition}\";Port=%{p0}"); -var part85 = // "Pattern{Field(disposition,false), Constant(';Port='), Field(p0,false)}" -match("MESSAGE#568:300:02/20_1", "nwparser.p0", "%{disposition};Port=%{p0}"); +var part85 = match("MESSAGE#568:300:02/20_1", "nwparser.p0", "%{disposition};Port=%{p0}"); -var part86 = // "Pattern{Constant('"'), Field(dport,false), Constant('";Database='), Field(p0,false)}" -match("MESSAGE#568:300:02/21_0", "nwparser.p0", "\"%{dport}\";Database=%{p0}"); +var part86 = match("MESSAGE#568:300:02/21_0", "nwparser.p0", "\"%{dport}\";Database=%{p0}"); -var part87 = // "Pattern{Field(dport,false), Constant(';Database='), Field(p0,false)}" -match("MESSAGE#568:300:02/21_1", "nwparser.p0", "%{dport};Database=%{p0}"); +var part87 = match("MESSAGE#568:300:02/21_1", "nwparser.p0", "%{dport};Database=%{p0}"); -var part88 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";DeviceType='), Field(p0,false)}" -match("MESSAGE#568:300:02/22_0", "nwparser.p0", "\"%{db_name}\";DeviceType=%{p0}"); +var part88 = match("MESSAGE#568:300:02/22_0", "nwparser.p0", "\"%{db_name}\";DeviceType=%{p0}"); -var part89 = // "Pattern{Field(db_name,false), Constant(';DeviceType='), Field(p0,false)}" -match("MESSAGE#568:300:02/22_1", "nwparser.p0", "%{db_name};DeviceType=%{p0}"); +var part89 = match("MESSAGE#568:300:02/22_1", "nwparser.p0", "%{db_name};DeviceType=%{p0}"); -var part90 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";ExtraDetails="ApplicationType='), Field(p0,false)}" -match("MESSAGE#568:300:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"ApplicationType=%{p0}"); +var part90 = match("MESSAGE#568:300:02/23_0", "nwparser.p0", "\"%{obj_type}\";ExtraDetails=\"ApplicationType=%{p0}"); -var part91 = // "Pattern{Field(obj_type,false), Constant(';ExtraDetails="ApplicationType='), Field(p0,false)}" -match("MESSAGE#568:300:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"ApplicationType=%{p0}"); +var part91 = match("MESSAGE#568:300:02/23_1", "nwparser.p0", "%{obj_type};ExtraDetails=\"ApplicationType=%{p0}"); -var part92 = // "Pattern{Constant('"'), Field(version,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/1_0", "nwparser.p0", "\"%{version}\";%{p0}"); +var part92 = match("MESSAGE#621:411/1_0", "nwparser.p0", "\"%{version}\";%{p0}"); -var part93 = // "Pattern{Field(version,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/1_1", "nwparser.p0", "%{version};%{p0}"); +var part93 = match("MESSAGE#621:411/1_1", "nwparser.p0", "%{version};%{p0}"); -var part94 = // "Pattern{Constant('Message='), Field(p0,false)}" -match("MESSAGE#621:411/2", "nwparser.p0", "Message=%{p0}"); +var part94 = match("MESSAGE#621:411/2", "nwparser.p0", "Message=%{p0}"); -var part95 = // "Pattern{Constant('"'), Field(action,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/3_0", "nwparser.p0", "\"%{action}\";%{p0}"); +var part95 = match("MESSAGE#621:411/3_0", "nwparser.p0", "\"%{action}\";%{p0}"); -var part96 = // "Pattern{Field(action,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/3_1", "nwparser.p0", "%{action};%{p0}"); +var part96 = match("MESSAGE#621:411/3_1", "nwparser.p0", "%{action};%{p0}"); -var part97 = // "Pattern{Constant('Issuer='), Field(p0,false)}" -match("MESSAGE#621:411/4", "nwparser.p0", "Issuer=%{p0}"); +var part97 = match("MESSAGE#621:411/4", "nwparser.p0", "Issuer=%{p0}"); -var part98 = // "Pattern{Constant('"'), Field(username,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/5_0", "nwparser.p0", "\"%{username}\";%{p0}"); +var part98 = match("MESSAGE#621:411/5_0", "nwparser.p0", "\"%{username}\";%{p0}"); -var part99 = // "Pattern{Field(username,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/5_1", "nwparser.p0", "%{username};%{p0}"); +var part99 = match("MESSAGE#621:411/5_1", "nwparser.p0", "%{username};%{p0}"); -var part100 = // "Pattern{Constant('Station='), Field(p0,false)}" -match("MESSAGE#621:411/6", "nwparser.p0", "Station=%{p0}"); +var part100 = match("MESSAGE#621:411/6", "nwparser.p0", "Station=%{p0}"); -var part101 = // "Pattern{Constant('"'), Field(hostip,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/7_0", "nwparser.p0", "\"%{hostip}\";%{p0}"); +var part101 = match("MESSAGE#621:411/7_0", "nwparser.p0", "\"%{hostip}\";%{p0}"); -var part102 = // "Pattern{Field(hostip,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/7_1", "nwparser.p0", "%{hostip};%{p0}"); +var part102 = match("MESSAGE#621:411/7_1", "nwparser.p0", "%{hostip};%{p0}"); -var part103 = // "Pattern{Constant('File='), Field(p0,false)}" -match("MESSAGE#621:411/8", "nwparser.p0", "File=%{p0}"); +var part103 = match("MESSAGE#621:411/8", "nwparser.p0", "File=%{p0}"); -var part104 = // "Pattern{Constant('"'), Field(filename,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/9_0", "nwparser.p0", "\"%{filename}\";%{p0}"); +var part104 = match("MESSAGE#621:411/9_0", "nwparser.p0", "\"%{filename}\";%{p0}"); -var part105 = // "Pattern{Field(filename,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/9_1", "nwparser.p0", "%{filename};%{p0}"); +var part105 = match("MESSAGE#621:411/9_1", "nwparser.p0", "%{filename};%{p0}"); -var part106 = // "Pattern{Constant('Safe='), Field(p0,false)}" -match("MESSAGE#621:411/10", "nwparser.p0", "Safe=%{p0}"); +var part106 = match("MESSAGE#621:411/10", "nwparser.p0", "Safe=%{p0}"); -var part107 = // "Pattern{Constant('"'), Field(group_object,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/11_0", "nwparser.p0", "\"%{group_object}\";%{p0}"); +var part107 = match("MESSAGE#621:411/11_0", "nwparser.p0", "\"%{group_object}\";%{p0}"); -var part108 = // "Pattern{Field(group_object,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/11_1", "nwparser.p0", "%{group_object};%{p0}"); +var part108 = match("MESSAGE#621:411/11_1", "nwparser.p0", "%{group_object};%{p0}"); -var part109 = // "Pattern{Constant('Location='), Field(p0,false)}" -match("MESSAGE#621:411/12", "nwparser.p0", "Location=%{p0}"); +var part109 = match("MESSAGE#621:411/12", "nwparser.p0", "Location=%{p0}"); -var part110 = // "Pattern{Constant('"'), Field(directory,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/13_0", "nwparser.p0", "\"%{directory}\";%{p0}"); +var part110 = match("MESSAGE#621:411/13_0", "nwparser.p0", "\"%{directory}\";%{p0}"); -var part111 = // "Pattern{Field(directory,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/13_1", "nwparser.p0", "%{directory};%{p0}"); +var part111 = match("MESSAGE#621:411/13_1", "nwparser.p0", "%{directory};%{p0}"); -var part112 = // "Pattern{Constant('Category='), Field(p0,false)}" -match("MESSAGE#621:411/14", "nwparser.p0", "Category=%{p0}"); +var part112 = match("MESSAGE#621:411/14", "nwparser.p0", "Category=%{p0}"); -var part113 = // "Pattern{Constant('"'), Field(category,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/15_0", "nwparser.p0", "\"%{category}\";%{p0}"); +var part113 = match("MESSAGE#621:411/15_0", "nwparser.p0", "\"%{category}\";%{p0}"); -var part114 = // "Pattern{Field(category,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/15_1", "nwparser.p0", "%{category};%{p0}"); +var part114 = match("MESSAGE#621:411/15_1", "nwparser.p0", "%{category};%{p0}"); -var part115 = // "Pattern{Constant('RequestId='), Field(p0,false)}" -match("MESSAGE#621:411/16", "nwparser.p0", "RequestId=%{p0}"); +var part115 = match("MESSAGE#621:411/16", "nwparser.p0", "RequestId=%{p0}"); -var part116 = // "Pattern{Constant('"'), Field(id1,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/17_0", "nwparser.p0", "\"%{id1}\";%{p0}"); +var part116 = match("MESSAGE#621:411/17_0", "nwparser.p0", "\"%{id1}\";%{p0}"); -var part117 = // "Pattern{Field(id1,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/17_1", "nwparser.p0", "%{id1};%{p0}"); +var part117 = match("MESSAGE#621:411/17_1", "nwparser.p0", "%{id1};%{p0}"); -var part118 = // "Pattern{Constant('Reason='), Field(p0,false)}" -match("MESSAGE#621:411/18", "nwparser.p0", "Reason=%{p0}"); +var part118 = match("MESSAGE#621:411/18", "nwparser.p0", "Reason=%{p0}"); -var part119 = // "Pattern{Constant('"'), Field(event_description,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/19_0", "nwparser.p0", "\"%{event_description}\";%{p0}"); +var part119 = match("MESSAGE#621:411/19_0", "nwparser.p0", "\"%{event_description}\";%{p0}"); -var part120 = // "Pattern{Field(event_description,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/19_1", "nwparser.p0", "%{event_description};%{p0}"); +var part120 = match("MESSAGE#621:411/19_1", "nwparser.p0", "%{event_description};%{p0}"); -var part121 = // "Pattern{Constant('Severity='), Field(p0,false)}" -match("MESSAGE#621:411/20", "nwparser.p0", "Severity=%{p0}"); +var part121 = match("MESSAGE#621:411/20", "nwparser.p0", "Severity=%{p0}"); -var part122 = // "Pattern{Constant('"'), Field(severity,false), Constant('";SourceUser="'), Field(group,false), Constant('";TargetUser="'), Field(uid,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/21_0", "nwparser.p0", "\"%{severity}\";SourceUser=\"%{group}\";TargetUser=\"%{uid}\";%{p0}"); +var part122 = match("MESSAGE#621:411/21_0", "nwparser.p0", "\"%{severity}\";SourceUser=\"%{group}\";TargetUser=\"%{uid}\";%{p0}"); -var part123 = // "Pattern{Field(severity,false), Constant(';SourceUser='), Field(group,false), Constant(';TargetUser='), Field(uid,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/21_1", "nwparser.p0", "%{severity};SourceUser=%{group};TargetUser=%{uid};%{p0}"); +var part123 = match("MESSAGE#621:411/21_1", "nwparser.p0", "%{severity};SourceUser=%{group};TargetUser=%{uid};%{p0}"); -var part124 = // "Pattern{Constant('"'), Field(severity,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/21_2", "nwparser.p0", "\"%{severity}\";%{p0}"); +var part124 = match("MESSAGE#621:411/21_2", "nwparser.p0", "\"%{severity}\";%{p0}"); -var part125 = // "Pattern{Field(severity,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/21_3", "nwparser.p0", "%{severity};%{p0}"); +var part125 = match("MESSAGE#621:411/21_3", "nwparser.p0", "%{severity};%{p0}"); -var part126 = // "Pattern{Constant('GatewayStation='), Field(p0,false)}" -match("MESSAGE#621:411/22", "nwparser.p0", "GatewayStation=%{p0}"); +var part126 = match("MESSAGE#621:411/22", "nwparser.p0", "GatewayStation=%{p0}"); -var part127 = // "Pattern{Constant('"'), Field(saddr,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/23_0", "nwparser.p0", "\"%{saddr}\";%{p0}"); +var part127 = match("MESSAGE#621:411/23_0", "nwparser.p0", "\"%{saddr}\";%{p0}"); -var part128 = // "Pattern{Field(saddr,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/23_1", "nwparser.p0", "%{saddr};%{p0}"); +var part128 = match("MESSAGE#621:411/23_1", "nwparser.p0", "%{saddr};%{p0}"); -var part129 = // "Pattern{Constant('TicketID='), Field(p0,false)}" -match("MESSAGE#621:411/24", "nwparser.p0", "TicketID=%{p0}"); +var part129 = match("MESSAGE#621:411/24", "nwparser.p0", "TicketID=%{p0}"); -var part130 = // "Pattern{Constant('"'), Field(operation_id,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/25_0", "nwparser.p0", "\"%{operation_id}\";%{p0}"); +var part130 = match("MESSAGE#621:411/25_0", "nwparser.p0", "\"%{operation_id}\";%{p0}"); -var part131 = // "Pattern{Field(operation_id,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/25_1", "nwparser.p0", "%{operation_id};%{p0}"); +var part131 = match("MESSAGE#621:411/25_1", "nwparser.p0", "%{operation_id};%{p0}"); -var part132 = // "Pattern{Constant('PolicyID='), Field(p0,false)}" -match("MESSAGE#621:411/26", "nwparser.p0", "PolicyID=%{p0}"); +var part132 = match("MESSAGE#621:411/26", "nwparser.p0", "PolicyID=%{p0}"); -var part133 = // "Pattern{Constant('"'), Field(policyname,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/27_0", "nwparser.p0", "\"%{policyname}\";%{p0}"); +var part133 = match("MESSAGE#621:411/27_0", "nwparser.p0", "\"%{policyname}\";%{p0}"); -var part134 = // "Pattern{Field(policyname,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/27_1", "nwparser.p0", "%{policyname};%{p0}"); +var part134 = match("MESSAGE#621:411/27_1", "nwparser.p0", "%{policyname};%{p0}"); -var part135 = // "Pattern{Constant('UserName='), Field(p0,false)}" -match("MESSAGE#621:411/28", "nwparser.p0", "UserName=%{p0}"); +var part135 = match("MESSAGE#621:411/28", "nwparser.p0", "UserName=%{p0}"); -var part136 = // "Pattern{Constant('"'), Field(c_username,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/29_0", "nwparser.p0", "\"%{c_username}\";%{p0}"); +var part136 = match("MESSAGE#621:411/29_0", "nwparser.p0", "\"%{c_username}\";%{p0}"); -var part137 = // "Pattern{Field(c_username,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/29_1", "nwparser.p0", "%{c_username};%{p0}"); +var part137 = match("MESSAGE#621:411/29_1", "nwparser.p0", "%{c_username};%{p0}"); -var part138 = // "Pattern{Constant('LogonDomain='), Field(p0,false)}" -match("MESSAGE#621:411/30", "nwparser.p0", "LogonDomain=%{p0}"); +var part138 = match("MESSAGE#621:411/30", "nwparser.p0", "LogonDomain=%{p0}"); -var part139 = // "Pattern{Constant('"'), Field(domain,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/31_0", "nwparser.p0", "\"%{domain}\";%{p0}"); +var part139 = match("MESSAGE#621:411/31_0", "nwparser.p0", "\"%{domain}\";%{p0}"); -var part140 = // "Pattern{Field(domain,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/31_1", "nwparser.p0", "%{domain};%{p0}"); +var part140 = match("MESSAGE#621:411/31_1", "nwparser.p0", "%{domain};%{p0}"); -var part141 = // "Pattern{Constant('Address='), Field(p0,false)}" -match("MESSAGE#621:411/32", "nwparser.p0", "Address=%{p0}"); +var part141 = match("MESSAGE#621:411/32", "nwparser.p0", "Address=%{p0}"); -var part142 = // "Pattern{Constant('"'), Field(dhost,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/33_0", "nwparser.p0", "\"%{dhost}\";%{p0}"); +var part142 = match("MESSAGE#621:411/33_0", "nwparser.p0", "\"%{dhost}\";%{p0}"); -var part143 = // "Pattern{Field(dhost,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/33_1", "nwparser.p0", "%{dhost};%{p0}"); +var part143 = match("MESSAGE#621:411/33_1", "nwparser.p0", "%{dhost};%{p0}"); -var part144 = // "Pattern{Constant('CPMStatus='), Field(p0,false)}" -match("MESSAGE#621:411/34", "nwparser.p0", "CPMStatus=%{p0}"); +var part144 = match("MESSAGE#621:411/34", "nwparser.p0", "CPMStatus=%{p0}"); -var part145 = // "Pattern{Constant('"'), Field(disposition,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/35_0", "nwparser.p0", "\"%{disposition}\";%{p0}"); +var part145 = match("MESSAGE#621:411/35_0", "nwparser.p0", "\"%{disposition}\";%{p0}"); -var part146 = // "Pattern{Field(disposition,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/35_1", "nwparser.p0", "%{disposition};%{p0}"); +var part146 = match("MESSAGE#621:411/35_1", "nwparser.p0", "%{disposition};%{p0}"); -var part147 = // "Pattern{Constant('Port='), Field(p0,false)}" -match("MESSAGE#621:411/36", "nwparser.p0", "Port=%{p0}"); +var part147 = match("MESSAGE#621:411/36", "nwparser.p0", "Port=%{p0}"); -var part148 = // "Pattern{Constant('"'), Field(dport,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/37_0", "nwparser.p0", "\"%{dport}\";%{p0}"); +var part148 = match("MESSAGE#621:411/37_0", "nwparser.p0", "\"%{dport}\";%{p0}"); -var part149 = // "Pattern{Field(dport,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/37_1", "nwparser.p0", "%{dport};%{p0}"); +var part149 = match("MESSAGE#621:411/37_1", "nwparser.p0", "%{dport};%{p0}"); -var part150 = // "Pattern{Constant('Database='), Field(p0,false)}" -match("MESSAGE#621:411/38", "nwparser.p0", "Database=%{p0}"); +var part150 = match("MESSAGE#621:411/38", "nwparser.p0", "Database=%{p0}"); -var part151 = // "Pattern{Constant('"'), Field(db_name,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/39_0", "nwparser.p0", "\"%{db_name}\";%{p0}"); +var part151 = match("MESSAGE#621:411/39_0", "nwparser.p0", "\"%{db_name}\";%{p0}"); -var part152 = // "Pattern{Field(db_name,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/39_1", "nwparser.p0", "%{db_name};%{p0}"); +var part152 = match("MESSAGE#621:411/39_1", "nwparser.p0", "%{db_name};%{p0}"); -var part153 = // "Pattern{Constant('DeviceType='), Field(p0,false)}" -match("MESSAGE#621:411/40", "nwparser.p0", "DeviceType=%{p0}"); +var part153 = match("MESSAGE#621:411/40", "nwparser.p0", "DeviceType=%{p0}"); -var part154 = // "Pattern{Constant('"'), Field(obj_type,false), Constant('";'), Field(p0,false)}" -match("MESSAGE#621:411/41_0", "nwparser.p0", "\"%{obj_type}\";%{p0}"); +var part154 = match("MESSAGE#621:411/41_0", "nwparser.p0", "\"%{obj_type}\";%{p0}"); -var part155 = // "Pattern{Field(obj_type,false), Constant(';'), Field(p0,false)}" -match("MESSAGE#621:411/41_1", "nwparser.p0", "%{obj_type};%{p0}"); +var part155 = match("MESSAGE#621:411/41_1", "nwparser.p0", "%{obj_type};%{p0}"); -var part156 = // "Pattern{Constant('ExtraDetails='), Field(p0,false)}" -match("MESSAGE#621:411/42", "nwparser.p0", "ExtraDetails=%{p0}"); +var part156 = match("MESSAGE#621:411/42", "nwparser.p0", "ExtraDetails=%{p0}"); -var part157 = // "Pattern{Field(info,false), Constant(';')}" -match("MESSAGE#621:411/43_1", "nwparser.p0", "%{info};"); +var part157 = match("MESSAGE#621:411/43_1", "nwparser.p0", "%{info};"); var part158 = tagval("MESSAGE#0:1:01", "nwparser.payload", tvm, { "Address": "dhost", @@ -5796,8 +5522,7 @@ var part158 = tagval("MESSAGE#0:1:01", "nwparser.payload", tvm, { dup3, ])); -var part159 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#1:1", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part159 = match("MESSAGE#1:1", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup1, dup2, ])); @@ -5833,8 +5558,7 @@ var part160 = tagval("MESSAGE#2:2:01", "nwparser.payload", tvm, { dup3, ])); -var part161 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part161 = match("MESSAGE#3:2", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup4, dup2, ])); @@ -5874,8 +5598,7 @@ var part162 = tagval("MESSAGE#6:4:01", "nwparser.payload", tvm, { dup3, ])); -var part163 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part163 = match("MESSAGE#7:4", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup5, dup6, dup7, @@ -5918,8 +5641,7 @@ var part164 = tagval("MESSAGE#20:13:01", "nwparser.payload", tvm, { dup3, ])); -var part165 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part165 = match("MESSAGE#21:13", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup16, dup17, @@ -5958,8 +5680,7 @@ var part166 = tagval("MESSAGE#26:16:01", "nwparser.payload", tvm, { dup3, ])); -var part167 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part167 = match("MESSAGE#27:16", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup19, dup2, ])); @@ -5995,8 +5716,7 @@ var part168 = tagval("MESSAGE#30:18:01", "nwparser.payload", tvm, { dup3, ])); -var part169 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part169 = match("MESSAGE#31:18", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup15, dup2, ])); @@ -6032,8 +5752,7 @@ var part170 = tagval("MESSAGE#38:22:01", "nwparser.payload", tvm, { dup3, ])); -var part171 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part171 = match("MESSAGE#39:22", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup21, dup2, ])); @@ -6069,8 +5788,7 @@ var part172 = tagval("MESSAGE#70:38:01", "nwparser.payload", tvm, { dup3, ])); -var part173 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part173 = match("MESSAGE#71:38", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup23, dup2, ])); @@ -6106,8 +5824,7 @@ var part174 = tagval("MESSAGE#116:61:01", "nwparser.payload", tvm, { dup3, ])); -var part175 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part175 = match("MESSAGE#117:61", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup20, dup2, ])); @@ -6143,8 +5860,7 @@ var part176 = tagval("MESSAGE#126:66:01", "nwparser.payload", tvm, { dup3, ])); -var part177 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part177 = match("MESSAGE#127:66", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup26, dup2, ])); @@ -6330,8 +6046,7 @@ var part179 = tagval("MESSAGE#591:317:01", "nwparser.payload", tvm, { dup3, ])); -var part180 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part180 = match("MESSAGE#592:317", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup79, dup80, dup81, @@ -6369,8 +6084,7 @@ var part181 = tagval("MESSAGE#595:355:01", "nwparser.payload", tvm, { dup3, ])); -var part182 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part182 = match("MESSAGE#596:355", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup82, dup2, ])); @@ -6406,14 +6120,12 @@ var part183 = tagval("MESSAGE#599:357:01", "nwparser.payload", tvm, { dup3, ])); -var part184 = // "Pattern{Field(product,true), Constant(' '), Field(version,false), Constant('",ProductAccount="'), Field(service_account,false), Constant('",ProductProcess="'), Field(fld2,false), Constant('",EventId="'), Field(id,false), Constant('",EventClass="'), Field(fld3,false), Constant('",EventSeverity="'), Field(severity,false), Constant('",EventMessage="'), Field(action,false), Constant('",ActingUserName="'), Field(username,false), Constant('",ActingAddress="'), Field(hostip,false), Constant('",ActionSourceUser="'), Field(fld4,false), Constant('",ActionTargetUser="'), Field(c_username,false), Constant('",ActionObject="'), Field(filename,false), Constant('",ActionSafe="'), Field(group_object,false), Constant('",ActionLocation="'), Field(directory,false), Constant('",ActionCategory="'), Field(category,false), Constant('",ActionRequestId="'), Field(id1,false), Constant('",ActionReason="'), Field(event_description,false), Constant('",ActionExtraDetails="'), Field(info,false), Constant('"')}" -match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ +var part184 = match("MESSAGE#600:357", "nwparser.payload", "%{product->} %{version}\",ProductAccount=\"%{service_account}\",ProductProcess=\"%{fld2}\",EventId=\"%{id}\",EventClass=\"%{fld3}\",EventSeverity=\"%{severity}\",EventMessage=\"%{action}\",ActingUserName=\"%{username}\",ActingAddress=\"%{hostip}\",ActionSourceUser=\"%{fld4}\",ActionTargetUser=\"%{c_username}\",ActionObject=\"%{filename}\",ActionSafe=\"%{group_object}\",ActionLocation=\"%{directory}\",ActionCategory=\"%{category}\",ActionRequestId=\"%{id1}\",ActionReason=\"%{event_description}\",ActionExtraDetails=\"%{info}\"", processor_chain([ dup83, dup2, ])); -var part185 = // "Pattern{Constant('Version='), Field(version,false), Constant(';Message='), Field(action,false), Constant(';Issuer='), Field(username,false), Constant(';Station='), Field(hostip,false), Constant(';File='), Field(filename,false), Constant(';Safe='), Field(group_object,false), Constant(';Location='), Field(directory,false), Constant(';Category='), Field(category,false), Constant(';RequestId='), Field(id1,false), Constant(';Reason='), Field(event_description,false), Constant(';Severity='), Field(severity,false), Constant(';GatewayStation='), Field(saddr,false), Constant(';TicketID='), Field(operation_id,false), Constant(';PolicyID='), Field(policyname,false), Constant(';UserName='), Field(c_username,false), Constant(';LogonDomain='), Field(domain,false), Constant(';Address='), Field(dhost,false), Constant(';CPMStatus='), Field(disposition,false), Constant(';Port="'), Field(dport,false), Constant('";Database='), Field(db_name,false), Constant(';DeviceType='), Field(obj_type,false), Constant(';ExtraDetails='), Field(info,false), Constant(';')}" -match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ +var part185 = match("MESSAGE#617:372", "nwparser.payload", "Version=%{version};Message=%{action};Issuer=%{username};Station=%{hostip};File=%{filename};Safe=%{group_object};Location=%{directory};Category=%{category};RequestId=%{id1};Reason=%{event_description};Severity=%{severity};GatewayStation=%{saddr};TicketID=%{operation_id};PolicyID=%{policyname};UserName=%{c_username};LogonDomain=%{domain};Address=%{dhost};CPMStatus=%{disposition};Port=\"%{dport}\";Database=%{db_name};DeviceType=%{obj_type};ExtraDetails=%{info};", processor_chain([ dup4, dup2, dup3, diff --git a/x-pack/filebeat/module/f5/bigipafm/config/pipeline.js b/x-pack/filebeat/module/f5/bigipafm/config/pipeline.js index a32c606c1ba..e749db584be 100644 --- a/x-pack/filebeat/module/f5/bigipafm/config/pipeline.js +++ b/x-pack/filebeat/module/f5/bigipafm/config/pipeline.js @@ -33,8 +33,7 @@ var map_getEventCategoryActivity = { var dup1 = constant("Deny"); -var hdr1 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hhostname,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(hfld4,true), Constant(' '), Field(hfld5,true), Constant(' [F5@'), Field(hfld6,true), Constant(' '), Field(payload,false)}" -match("HEADER#0:0001", "message", "%{hfld1->} %{hfld2->} %{hhostname->} %{hfld3->} %{hfld4->} %{hfld5->} [F5@%{hfld6->} %{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{hfld1->} %{hfld2->} %{hhostname->} %{hfld3->} %{hfld4->} %{hfld5->} [F5@%{hfld6->} %{payload}", processor_chain([ setc("header_id","0001"), setc("messageid","BIGIP_AFM"), ])); diff --git a/x-pack/filebeat/module/fortinet/fortimail/config/pipeline.js b/x-pack/filebeat/module/fortinet/fortimail/config/pipeline.js index b40147eb1d5..28f099e0484 100644 --- a/x-pack/filebeat/module/fortinet/fortimail/config/pipeline.js +++ b/x-pack/filebeat/module/fortinet/fortimail/config/pipeline.js @@ -31,20 +31,15 @@ var dup1 = call({ ], }); -var dup2 = // "Pattern{Constant('user='), Field(username,true), Constant(' ui='), Field(p0,false)}" -match("MESSAGE#0:event_admin/0", "nwparser.payload", "user=%{username->} ui=%{p0}"); +var dup2 = match("MESSAGE#0:event_admin/0", "nwparser.payload", "user=%{username->} ui=%{p0}"); -var dup3 = // "Pattern{Field(network_service,false), Constant('('), Field(saddr,false), Constant(') action='), Field(p0,false)}" -match("MESSAGE#0:event_admin/1_0", "nwparser.p0", "%{network_service}(%{saddr}) action=%{p0}"); +var dup3 = match("MESSAGE#0:event_admin/1_0", "nwparser.p0", "%{network_service}(%{saddr}) action=%{p0}"); -var dup4 = // "Pattern{Field(network_service,true), Constant(' action='), Field(p0,false)}" -match("MESSAGE#0:event_admin/1_1", "nwparser.p0", "%{network_service->} action=%{p0}"); +var dup4 = match("MESSAGE#0:event_admin/1_1", "nwparser.p0", "%{network_service->} action=%{p0}"); -var dup5 = // "Pattern{Constant('"'), Field(event_description,false), Constant('"')}" -match("MESSAGE#0:event_admin/3_0", "nwparser.p0", "\"%{event_description}\""); +var dup5 = match("MESSAGE#0:event_admin/3_0", "nwparser.p0", "\"%{event_description}\""); -var dup6 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#0:event_admin/3_1", "nwparser.p0", "event_description"); +var dup6 = match_copy("MESSAGE#0:event_admin/3_1", "nwparser.p0", "event_description"); var dup7 = setc("eventcategory","1401000000"); @@ -70,139 +65,97 @@ var dup14 = setf("category","msgIdPart2"); var dup15 = setf("severity","hseverity"); -var dup16 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#1:event_pop3/2", "nwparser.p0", "%{action->} status=%{event_state->} msg=%{p0}"); +var dup16 = match("MESSAGE#1:event_pop3/2", "nwparser.p0", "%{action->} status=%{event_state->} msg=%{p0}"); var dup17 = setc("eventcategory","1602000000"); -var dup18 = // "Pattern{Constant('user='), Field(username,false), Constant('ui='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/0", "nwparser.payload", "user=%{username}ui=%{p0}"); +var dup18 = match("MESSAGE#5:event_smtp:01/0", "nwparser.payload", "user=%{username}ui=%{p0}"); -var dup19 = // "Pattern{Field(network_service,false), Constant('('), Field(hostip,false), Constant(') action='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/1_0", "nwparser.p0", "%{network_service}(%{hostip}) action=%{p0}"); +var dup19 = match("MESSAGE#5:event_smtp:01/1_0", "nwparser.p0", "%{network_service}(%{hostip}) action=%{p0}"); -var dup20 = // "Pattern{Field(network_service,false), Constant('action='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/1_1", "nwparser.p0", "%{network_service}action=%{p0}"); +var dup20 = match("MESSAGE#5:event_smtp:01/1_1", "nwparser.p0", "%{network_service}action=%{p0}"); -var dup21 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/2", "nwparser.p0", "%{action}status=%{event_state}session_id=%{p0}"); +var dup21 = match("MESSAGE#5:event_smtp:01/2", "nwparser.p0", "%{action}status=%{event_state}session_id=%{p0}"); -var dup22 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('"msg="STARTTLS='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/3_0", "nwparser.p0", "\"%{sessionid}\"msg=\"STARTTLS=%{p0}"); +var dup22 = match("MESSAGE#5:event_smtp:01/3_0", "nwparser.p0", "\"%{sessionid}\"msg=\"STARTTLS=%{p0}"); -var dup23 = // "Pattern{Field(sessionid,false), Constant('msg="STARTTLS='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/3_1", "nwparser.p0", "%{sessionid}msg=\"STARTTLS=%{p0}"); +var dup23 = match("MESSAGE#5:event_smtp:01/3_1", "nwparser.p0", "%{sessionid}msg=\"STARTTLS=%{p0}"); -var dup24 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" msg='), Field(p0,false)}" -match("MESSAGE#16:event_smtp/3_0", "nwparser.p0", "\"%{sessionid}\" msg=%{p0}"); +var dup24 = match("MESSAGE#16:event_smtp/3_0", "nwparser.p0", "\"%{sessionid}\" msg=%{p0}"); -var dup25 = // "Pattern{Field(sessionid,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#16:event_smtp/3_1", "nwparser.p0", "%{sessionid->} msg=%{p0}"); +var dup25 = match("MESSAGE#16:event_smtp/3_1", "nwparser.p0", "%{sessionid->} msg=%{p0}"); -var dup26 = // "Pattern{Constant('from='), Field(p0,false)}" -match("MESSAGE#20:virus/0", "nwparser.payload", "from=%{p0}"); +var dup26 = match("MESSAGE#20:virus/0", "nwparser.payload", "from=%{p0}"); -var dup27 = // "Pattern{Constant('"'), Field(from,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#20:virus/1_0", "nwparser.p0", "\"%{from}\" to=%{p0}"); +var dup27 = match("MESSAGE#20:virus/1_0", "nwparser.p0", "\"%{from}\" to=%{p0}"); -var dup28 = // "Pattern{Field(from,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#20:virus/1_1", "nwparser.p0", "%{from->} to=%{p0}"); +var dup28 = match("MESSAGE#20:virus/1_1", "nwparser.p0", "%{from->} to=%{p0}"); -var dup29 = // "Pattern{Constant('"'), Field(to,false), Constant('" src='), Field(p0,false)}" -match("MESSAGE#20:virus/2_0", "nwparser.p0", "\"%{to}\" src=%{p0}"); +var dup29 = match("MESSAGE#20:virus/2_0", "nwparser.p0", "\"%{to}\" src=%{p0}"); -var dup30 = // "Pattern{Field(to,true), Constant(' src='), Field(p0,false)}" -match("MESSAGE#20:virus/2_1", "nwparser.p0", "%{to->} src=%{p0}"); +var dup30 = match("MESSAGE#20:virus/2_1", "nwparser.p0", "%{to->} src=%{p0}"); -var dup31 = // "Pattern{Constant('"'), Field(saddr,false), Constant('" session_id='), Field(p0,false)}" -match("MESSAGE#20:virus/3_0", "nwparser.p0", "\"%{saddr}\" session_id=%{p0}"); +var dup31 = match("MESSAGE#20:virus/3_0", "nwparser.p0", "\"%{saddr}\" session_id=%{p0}"); -var dup32 = // "Pattern{Field(saddr,true), Constant(' session_id='), Field(p0,false)}" -match("MESSAGE#20:virus/3_1", "nwparser.p0", "%{saddr->} session_id=%{p0}"); +var dup32 = match("MESSAGE#20:virus/3_1", "nwparser.p0", "%{saddr->} session_id=%{p0}"); var dup33 = setc("eventcategory","1003010000"); var dup34 = setf("event_type","messageid"); -var dup35 = // "Pattern{Constant('session_id='), Field(p0,false)}" -match("MESSAGE#23:statistics/0", "nwparser.payload", "session_id=%{p0}"); +var dup35 = match("MESSAGE#23:statistics/0", "nwparser.payload", "session_id=%{p0}"); -var dup36 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" from='), Field(p0,false)}" -match("MESSAGE#23:statistics/1_0", "nwparser.p0", "\"%{sessionid}\" from=%{p0}"); +var dup36 = match("MESSAGE#23:statistics/1_0", "nwparser.p0", "\"%{sessionid}\" from=%{p0}"); -var dup37 = // "Pattern{Field(sessionid,true), Constant(' from='), Field(p0,false)}" -match("MESSAGE#23:statistics/1_1", "nwparser.p0", "%{sessionid->} from=%{p0}"); +var dup37 = match("MESSAGE#23:statistics/1_1", "nwparser.p0", "%{sessionid->} from=%{p0}"); -var dup38 = // "Pattern{Constant('"'), Field(from,false), Constant('" mailer='), Field(p0,false)}" -match("MESSAGE#23:statistics/2_0", "nwparser.p0", "\"%{from}\" mailer=%{p0}"); +var dup38 = match("MESSAGE#23:statistics/2_0", "nwparser.p0", "\"%{from}\" mailer=%{p0}"); -var dup39 = // "Pattern{Field(from,true), Constant(' mailer='), Field(p0,false)}" -match("MESSAGE#23:statistics/2_1", "nwparser.p0", "%{from->} mailer=%{p0}"); +var dup39 = match("MESSAGE#23:statistics/2_1", "nwparser.p0", "%{from->} mailer=%{p0}"); -var dup40 = // "Pattern{Constant('"'), Field(agent,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#23:statistics/3_0", "nwparser.p0", "\"%{agent}\" client_name=\"%{p0}"); +var dup40 = match("MESSAGE#23:statistics/3_0", "nwparser.p0", "\"%{agent}\" client_name=\"%{p0}"); -var dup41 = // "Pattern{Field(agent,true), Constant(' client_name="'), Field(p0,false)}" -match("MESSAGE#23:statistics/3_1", "nwparser.p0", "%{agent->} client_name=\"%{p0}"); +var dup41 = match("MESSAGE#23:statistics/3_1", "nwparser.p0", "%{agent->} client_name=\"%{p0}"); -var dup42 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(info,false), Constant(')"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); +var dup42 = match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); -var dup43 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); +var dup43 = match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); -var dup44 = // "Pattern{Field(saddr,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); +var dup44 = match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); -var dup45 = // "Pattern{Constant('"'), Field(context,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); +var dup45 = match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); -var dup46 = // "Pattern{Field(context,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); +var dup46 = match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); -var dup47 = // "Pattern{Constant('"'), Field(to,false), Constant('" direction='), Field(p0,false)}" -match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); +var dup47 = match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); -var dup48 = // "Pattern{Field(to,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); +var dup48 = match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); -var dup49 = // "Pattern{Constant('"'), Field(direction,false), Constant('" message_length='), Field(p0,false)}" -match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); +var dup49 = match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); -var dup50 = // "Pattern{Field(direction,true), Constant(' message_length='), Field(p0,false)}" -match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); +var dup50 = match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); -var dup51 = // "Pattern{Field(fld4,true), Constant(' virus='), Field(p0,false)}" -match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); +var dup51 = match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); -var dup52 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" disposition='), Field(p0,false)}" -match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); +var dup52 = match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); -var dup53 = // "Pattern{Field(virusname,true), Constant(' disposition='), Field(p0,false)}" -match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); +var dup53 = match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); -var dup54 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" classifier='), Field(p0,false)}" -match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); +var dup54 = match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); -var dup55 = // "Pattern{Field(disposition,true), Constant(' classifier='), Field(p0,false)}" -match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); +var dup55 = match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); -var dup56 = // "Pattern{Constant('"'), Field(filter,false), Constant('" subject='), Field(p0,false)}" -match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); +var dup56 = match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); -var dup57 = // "Pattern{Field(filter,true), Constant(' subject='), Field(p0,false)}" -match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); +var dup57 = match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); -var dup58 = // "Pattern{Constant('"'), Field(subject,false), Constant('"')}" -match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); +var dup58 = match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); -var dup59 = // "Pattern{Field(subject,false)}" -match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); +var dup59 = match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); var dup60 = setc("eventcategory","1207000000"); -var dup61 = // "Pattern{Field(,false), Constant('resolved='), Field(p0,false)}" -match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); +var dup61 = match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); var dup62 = setc("eventcategory","1207040000"); @@ -322,25 +275,21 @@ var dup82 = all_match({ ]), }); -var hdr1 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' log_part='), Field(hfld3,true), Constant(' type='), Field(msgIdPart1,true), Constant(' subtype='), Field(msgIdPart2,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" -match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ setc("header_id","0001"), dup1, ])); -var hdr2 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' log_part='), Field(hfld3,true), Constant(' type='), Field(messageid,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" -match("HEADER#1:0002", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0002", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} log_part=%{hfld3->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ setc("header_id","0002"), ])); -var hdr3 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' type='), Field(msgIdPart1,true), Constant(' subtype='), Field(msgIdPart2,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" -match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ +var hdr3 = match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{msgIdPart1->} subtype=%{msgIdPart2->} pri=%{hseverity->} %{payload}", processor_chain([ setc("header_id","0003"), dup1, ])); -var hdr4 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(hfld2,true), Constant(' type='), Field(messageid,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" -match("HEADER#3:0004", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ +var hdr4 = match("HEADER#3:0004", "message", "date=%{hdate->} time=%{htime->} device_id=%{hfld1->} log_id=%{hfld2->} type=%{messageid->} pri=%{hseverity->} %{payload}", processor_chain([ setc("header_id","0004"), ])); @@ -351,8 +300,7 @@ var select1 = linear_select([ hdr4, ]); -var part1 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' reason='), Field(result,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#0:event_admin/2", "nwparser.p0", "%{action->} status=%{event_state->} reason=%{result->} msg=%{p0}"); +var part1 = match("MESSAGE#0:event_admin/2", "nwparser.p0", "%{action->} status=%{event_state->} reason=%{result->} msg=%{p0}"); var all1 = all_match({ processors: [ @@ -404,22 +352,18 @@ var msg4 = msg("event_system", dup82); var msg5 = msg("event_imap", dup82); -var part2 = // "Pattern{Field(fld1,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/4", "nwparser.p0", "%{fld1}, relay=%{p0}"); +var part2 = match("MESSAGE#5:event_smtp:01/4", "nwparser.p0", "%{fld1}, relay=%{p0}"); -var part3 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant('], version='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/5_0", "nwparser.p0", "%{shost}[%{saddr}], version=%{p0}"); +var part3 = match("MESSAGE#5:event_smtp:01/5_0", "nwparser.p0", "%{shost}[%{saddr}], version=%{p0}"); -var part4 = // "Pattern{Field(shost,false), Constant(', version='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/5_1", "nwparser.p0", "%{shost}, version=%{p0}"); +var part4 = match("MESSAGE#5:event_smtp:01/5_1", "nwparser.p0", "%{shost}, version=%{p0}"); var select2 = linear_select([ part3, part4, ]); -var part5 = // "Pattern{Field(version,false), Constant(', verify='), Field(fld2,false), Constant(', cipher='), Field(s_cipher,false), Constant(', bits='), Field(fld3,false), Constant('"')}" -match("MESSAGE#5:event_smtp:01/6", "nwparser.p0", "%{version}, verify=%{fld2}, cipher=%{s_cipher}, bits=%{fld3}\""); +var part5 = match("MESSAGE#5:event_smtp:01/6", "nwparser.p0", "%{version}, verify=%{fld2}, cipher=%{s_cipher}, bits=%{fld3}\""); var all3 = all_match({ processors: [ @@ -446,8 +390,7 @@ var all3 = all_match({ var msg6 = msg("event_smtp:01", all3); -var part6 = // "Pattern{Field(fld1,false), Constant(', cert-subject='), Field(cert_subject,false), Constant(', cert-issuer='), Field(fld2,false), Constant(', verifymsg='), Field(fld3,false), Constant('"')}" -match("MESSAGE#6:event_smtp:02/4", "nwparser.p0", "%{fld1}, cert-subject=%{cert_subject}, cert-issuer=%{fld2}, verifymsg=%{fld3}\""); +var part6 = match("MESSAGE#6:event_smtp:02/4", "nwparser.p0", "%{fld1}, cert-subject=%{cert_subject}, cert-issuer=%{fld2}, verifymsg=%{fld3}\""); var all4 = all_match({ processors: [ @@ -472,8 +415,7 @@ var all4 = all_match({ var msg7 = msg("event_smtp:02", all4); -var part7 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="to=<<'), Field(to,false), Constant('>, delay='), Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant(', relay='), Field(shost,false), Constant('['), Field(saddr,false), Constant('], dsn='), Field(fld4,false), Constant(', stat='), Field(fld5,false), Constant('"')}" -match("MESSAGE#7:event_smtp:03/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"to=\u003c\u003c%{to}>, delay=%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}[%{saddr}], dsn=%{fld4}, stat=%{fld5}\""); +var part7 = match("MESSAGE#7:event_smtp:03/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"to=\u003c\u003c%{to}>, delay=%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}[%{saddr}], dsn=%{fld4}, stat=%{fld5}\""); var all5 = all_match({ processors: [ @@ -496,31 +438,24 @@ var all5 = all_match({ var msg8 = msg("event_smtp:03", all5); -var part8 = // "Pattern{Constant('user='), Field(username,false), Constant('ui='), Field(network_service,false), Constant('action='), Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="from=<<'), Field(from,false), Constant('>, size='), Field(bytes,false), Constant(', class='), Field(fld2,false), Constant(', nrcpts='), Field(p0,false)}" -match("MESSAGE#8:event_smtp:04/0", "nwparser.payload", "user=%{username}ui=%{network_service}action=%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"from=\u003c\u003c%{from}>, size=%{bytes}, class=%{fld2}, nrcpts=%{p0}"); +var part8 = match("MESSAGE#8:event_smtp:04/0", "nwparser.payload", "user=%{username}ui=%{network_service}action=%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"from=\u003c\u003c%{from}>, size=%{bytes}, class=%{fld2}, nrcpts=%{p0}"); -var part9 = // "Pattern{Field(fld3,false), Constant(', msgid=<<'), Field(fld4,false), Constant('>, proto='), Field(p0,false)}" -match("MESSAGE#8:event_smtp:04/1_0", "nwparser.p0", "%{fld3}, msgid=\u003c\u003c%{fld4}>, proto=%{p0}"); +var part9 = match("MESSAGE#8:event_smtp:04/1_0", "nwparser.p0", "%{fld3}, msgid=\u003c\u003c%{fld4}>, proto=%{p0}"); -var part10 = // "Pattern{Field(fld3,false), Constant(', proto='), Field(p0,false)}" -match("MESSAGE#8:event_smtp:04/1_1", "nwparser.p0", "%{fld3}, proto=%{p0}"); +var part10 = match("MESSAGE#8:event_smtp:04/1_1", "nwparser.p0", "%{fld3}, proto=%{p0}"); var select3 = linear_select([ part9, part10, ]); -var part11 = // "Pattern{Field(protocol,false), Constant(', daemon='), Field(process,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#8:event_smtp:04/2", "nwparser.p0", "%{protocol}, daemon=%{process}, relay=%{p0}"); +var part11 = match("MESSAGE#8:event_smtp:04/2", "nwparser.p0", "%{protocol}, daemon=%{process}, relay=%{p0}"); -var part12 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant('] (may be forged)"')}" -match("MESSAGE#8:event_smtp:04/3_0", "nwparser.p0", "%{shost}[%{saddr}] (may be forged)\""); +var part12 = match("MESSAGE#8:event_smtp:04/3_0", "nwparser.p0", "%{shost}[%{saddr}] (may be forged)\""); -var part13 = // "Pattern{Field(shost,false), Constant('['), Field(saddr,false), Constant(']"')}" -match("MESSAGE#8:event_smtp:04/3_1", "nwparser.p0", "%{shost}[%{saddr}]\""); +var part13 = match("MESSAGE#8:event_smtp:04/3_1", "nwparser.p0", "%{shost}[%{saddr}]\""); -var part14 = // "Pattern{Field(shost,false), Constant('"')}" -match("MESSAGE#8:event_smtp:04/3_2", "nwparser.p0", "%{shost}\""); +var part14 = match("MESSAGE#8:event_smtp:04/3_2", "nwparser.p0", "%{shost}\""); var select4 = linear_select([ part12, @@ -550,8 +485,7 @@ var all6 = all_match({ var msg9 = msg("event_smtp:04", all6); -var part15 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="Milter: to=<<'), Field(to,false), Constant('>, reject='), Field(fld1,false), Constant('"')}" -match("MESSAGE#9:event_smtp:05/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"Milter: to=\u003c\u003c%{to}>, reject=%{fld1}\""); +var part15 = match("MESSAGE#9:event_smtp:05/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"Milter: to=\u003c\u003c%{to}>, reject=%{fld1}\""); var all7 = all_match({ processors: [ @@ -574,22 +508,18 @@ var all7 = all_match({ var msg10 = msg("event_smtp:05", all7); -var part16 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="timeout waiting for input from'), Field(p0,false)}" -match("MESSAGE#10:event_smtp:06/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"timeout waiting for input from%{p0}"); +var part16 = match("MESSAGE#10:event_smtp:06/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"timeout waiting for input from%{p0}"); -var part17 = // "Pattern{Constant('['), Field(saddr,false), Constant(']during server cmd'), Field(p0,false)}" -match("MESSAGE#10:event_smtp:06/3_0", "nwparser.p0", "[%{saddr}]during server cmd%{p0}"); +var part17 = match("MESSAGE#10:event_smtp:06/3_0", "nwparser.p0", "[%{saddr}]during server cmd%{p0}"); -var part18 = // "Pattern{Field(saddr,false), Constant('during server cmd'), Field(p0,false)}" -match("MESSAGE#10:event_smtp:06/3_1", "nwparser.p0", "%{saddr}during server cmd%{p0}"); +var part18 = match("MESSAGE#10:event_smtp:06/3_1", "nwparser.p0", "%{saddr}during server cmd%{p0}"); var select5 = linear_select([ part17, part18, ]); -var part19 = // "Pattern{Field(fld5,false), Constant('"')}" -match("MESSAGE#10:event_smtp:06/4", "nwparser.p0", "%{fld5}\""); +var part19 = match("MESSAGE#10:event_smtp:06/4", "nwparser.p0", "%{fld5}\""); var all8 = all_match({ processors: [ @@ -614,8 +544,7 @@ var all8 = all_match({ var msg11 = msg("event_smtp:06", all8); -var part20 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="collect:'), Field(fld1,false), Constant('timeout on connection from'), Field(shost,false), Constant(', from=<<'), Field(from,false), Constant('>"')}" -match("MESSAGE#11:event_smtp:07/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"collect:%{fld1}timeout on connection from%{shost}, from=\u003c\u003c%{from}>\""); +var part20 = match("MESSAGE#11:event_smtp:07/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"collect:%{fld1}timeout on connection from%{shost}, from=\u003c\u003c%{from}>\""); var all9 = all_match({ processors: [ @@ -638,8 +567,7 @@ var all9 = all_match({ var msg12 = msg("event_smtp:07", all9); -var part21 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="DSN: to <<'), Field(to,false), Constant('>; reason:'), Field(result,false), Constant('; sessionid:'), Field(fld5,false), Constant('"')}" -match("MESSAGE#12:event_smtp:08/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"DSN: to \u003c\u003c%{to}>; reason:%{result}; sessionid:%{fld5}\""); +var part21 = match("MESSAGE#12:event_smtp:08/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"DSN: to \u003c\u003c%{to}>; reason:%{result}; sessionid:%{fld5}\""); var all10 = all_match({ processors: [ @@ -662,8 +590,7 @@ var all10 = all_match({ var msg13 = msg("event_smtp:08", all10); -var part22 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="lost input channel from'), Field(shost,false), Constant('['), Field(saddr,false), Constant('] (may be forged) to SMTP_MTA after rcpt"')}" -match("MESSAGE#13:event_smtp:09/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"lost input channel from%{shost}[%{saddr}] (may be forged) to SMTP_MTA after rcpt\""); +var part22 = match("MESSAGE#13:event_smtp:09/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"lost input channel from%{shost}[%{saddr}] (may be forged) to SMTP_MTA after rcpt\""); var all11 = all_match({ processors: [ @@ -686,8 +613,7 @@ var all11 = all_match({ var msg14 = msg("event_smtp:09", all11); -var part23 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" msg="'), Field(shost,false), Constant('['), Field(saddr,false), Constant(']: possible SMTP attack: command='), Field(fld1,false), Constant(', count='), Field(dclass_counter1,false), Constant('"')}" -match("MESSAGE#14:event_smtp:10/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"%{shost}[%{saddr}]: possible SMTP attack: command=%{fld1}, count=%{dclass_counter1}\""); +var part23 = match("MESSAGE#14:event_smtp:10/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" msg=\"%{shost}[%{saddr}]: possible SMTP attack: command=%{fld1}, count=%{dclass_counter1}\""); var all12 = all_match({ processors: [ @@ -711,20 +637,15 @@ var all12 = all_match({ var msg15 = msg("event_smtp:10", all12); -var part24 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id="'), Field(sessionid,false), Constant('" log_part='), Field(id1,true), Constant(' msg="to=<<'), Field(to,false), Constant(', delay='), Field(p0,false)}" -match("MESSAGE#15:event_smtp:11/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" log_part=%{id1->} msg=\"to=\u003c\u003c%{to}, delay=%{p0}"); +var part24 = match("MESSAGE#15:event_smtp:11/2", "nwparser.p0", "%{action}status=%{event_state}session_id=\"%{sessionid}\" log_part=%{id1->} msg=\"to=\u003c\u003c%{to}, delay=%{p0}"); -var part25 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant(', relay='), Field(shost,false), Constant('"')}" -match("MESSAGE#15:event_smtp:11/3_0", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}\""); +var part25 = match("MESSAGE#15:event_smtp:11/3_0", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}, relay=%{shost}\""); -var part26 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant(', pri='), Field(fld3,false), Constant('"')}" -match("MESSAGE#15:event_smtp:11/3_1", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}\""); +var part26 = match("MESSAGE#15:event_smtp:11/3_1", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}, pri=%{fld3}\""); -var part27 = // "Pattern{Field(fld1,false), Constant(', xdelay='), Field(fld2,false), Constant(', mailer='), Field(protocol,false), Constant('"')}" -match("MESSAGE#15:event_smtp:11/3_2", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}\""); +var part27 = match("MESSAGE#15:event_smtp:11/3_2", "nwparser.p0", "%{fld1}, xdelay=%{fld2}, mailer=%{protocol}\""); -var part28 = // "Pattern{Field(fld1,false), Constant('"')}" -match("MESSAGE#15:event_smtp:11/3_3", "nwparser.p0", "%{fld1}\""); +var part28 = match("MESSAGE#15:event_smtp:11/3_3", "nwparser.p0", "%{fld1}\""); var select6 = linear_select([ part25, @@ -755,8 +676,7 @@ var all13 = all_match({ var msg16 = msg("event_smtp:11", all13); -var part29 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' session_id='), Field(p0,false)}" -match("MESSAGE#16:event_smtp/2", "nwparser.p0", "%{action->} status=%{event_state->} session_id=%{p0}"); +var part29 = match("MESSAGE#16:event_smtp/2", "nwparser.p0", "%{action->} status=%{event_state->} session_id=%{p0}"); var all14 = all_match({ processors: [ @@ -819,8 +739,7 @@ var select7 = linear_select([ msg18, ]); -var part31 = // "Pattern{Constant('msg='), Field(p0,false)}" -match("MESSAGE#18:event_update/0", "nwparser.payload", "msg=%{p0}"); +var part31 = match("MESSAGE#18:event_update/0", "nwparser.payload", "msg=%{p0}"); var all15 = all_match({ processors: [ @@ -842,19 +761,16 @@ var all15 = all_match({ var msg19 = msg("event_update", all15); -var part32 = // "Pattern{Field(network_service,false), Constant('('), Field(saddr,false), Constant(') module='), Field(p0,false)}" -match("MESSAGE#19:event_config/1_0", "nwparser.p0", "%{network_service}(%{saddr}) module=%{p0}"); +var part32 = match("MESSAGE#19:event_config/1_0", "nwparser.p0", "%{network_service}(%{saddr}) module=%{p0}"); -var part33 = // "Pattern{Field(network_service,true), Constant(' module='), Field(p0,false)}" -match("MESSAGE#19:event_config/1_1", "nwparser.p0", "%{network_service->} module=%{p0}"); +var part33 = match("MESSAGE#19:event_config/1_1", "nwparser.p0", "%{network_service->} module=%{p0}"); var select8 = linear_select([ part32, part33, ]); -var part34 = // "Pattern{Field(fld1,true), Constant(' submodule='), Field(fld2,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#19:event_config/2", "nwparser.p0", "%{fld1->} submodule=%{fld2->} msg=%{p0}"); +var part34 = match("MESSAGE#19:event_config/2", "nwparser.p0", "%{fld1->} submodule=%{fld2->} msg=%{p0}"); var all16 = all_match({ processors: [ @@ -906,19 +822,16 @@ var all17 = all_match({ var msg21 = msg("virus", all17); -var part35 = // "Pattern{Constant('"'), Field(to,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#21:virus_infected/2_0", "nwparser.p0", "\"%{to}\" client_name=\"%{p0}"); +var part35 = match("MESSAGE#21:virus_infected/2_0", "nwparser.p0", "\"%{to}\" client_name=\"%{p0}"); -var part36 = // "Pattern{Field(to,true), Constant(' client_name="'), Field(p0,false)}" -match("MESSAGE#21:virus_infected/2_1", "nwparser.p0", "%{to->} client_name=\"%{p0}"); +var part36 = match("MESSAGE#21:virus_infected/2_1", "nwparser.p0", "%{to->} client_name=\"%{p0}"); var select10 = linear_select([ part35, part36, ]); -var part37 = // "Pattern{Field(fqdn,false), Constant('" client_ip="'), Field(saddr,false), Constant('" session_id='), Field(p0,false)}" -match("MESSAGE#21:virus_infected/3", "nwparser.p0", "%{fqdn}\" client_ip=\"%{saddr}\" session_id=%{p0}"); +var part37 = match("MESSAGE#21:virus_infected/3", "nwparser.p0", "%{fqdn}\" client_ip=\"%{saddr}\" session_id=%{p0}"); var all18 = all_match({ processors: [ @@ -943,28 +856,22 @@ var all18 = all_match({ var msg22 = msg("virus_infected", all18); -var part38 = // "Pattern{Constant('from="'), Field(from,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/0_0", "nwparser.payload", "from=\"%{from}\" to=%{p0}"); +var part38 = match("MESSAGE#22:virus_file-signature/0_0", "nwparser.payload", "from=\"%{from}\" to=%{p0}"); -var part39 = // "Pattern{Field(from,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/0_1", "nwparser.payload", "%{from->} to=%{p0}"); +var part39 = match("MESSAGE#22:virus_file-signature/0_1", "nwparser.payload", "%{from->} to=%{p0}"); var select11 = linear_select([ part38, part39, ]); -var part40 = // "Pattern{Constant('"'), Field(sdomain,true), Constant(' ['), Field(saddr,false), Constant(']" session_id='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/2_0", "nwparser.p0", "\"%{sdomain->} [%{saddr}]\" session_id=%{p0}"); +var part40 = match("MESSAGE#22:virus_file-signature/2_0", "nwparser.p0", "\"%{sdomain->} [%{saddr}]\" session_id=%{p0}"); -var part41 = // "Pattern{Field(sdomain,true), Constant(' ['), Field(saddr,false), Constant('] session_id='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/2_1", "nwparser.p0", "%{sdomain->} [%{saddr}] session_id=%{p0}"); +var part41 = match("MESSAGE#22:virus_file-signature/2_1", "nwparser.p0", "%{sdomain->} [%{saddr}] session_id=%{p0}"); -var part42 = // "Pattern{Constant('"['), Field(saddr,false), Constant(']" session_id='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/2_2", "nwparser.p0", "\"[%{saddr}]\" session_id=%{p0}"); +var part42 = match("MESSAGE#22:virus_file-signature/2_2", "nwparser.p0", "\"[%{saddr}]\" session_id=%{p0}"); -var part43 = // "Pattern{Constant('['), Field(saddr,false), Constant('] session_id='), Field(p0,false)}" -match("MESSAGE#22:virus_file-signature/2_3", "nwparser.p0", "[%{saddr}] session_id=%{p0}"); +var part43 = match("MESSAGE#22:virus_file-signature/2_3", "nwparser.p0", "[%{saddr}] session_id=%{p0}"); var select12 = linear_select([ part40, @@ -975,8 +882,7 @@ var select12 = linear_select([ dup32, ]); -var part44 = // "Pattern{Constant('"Attachment file ('), Field(filename,false), Constant(') has sha1 hash value: '), Field(checksum,false), Constant('"')}" -match("MESSAGE#22:virus_file-signature/4_0", "nwparser.p0", "\"Attachment file (%{filename}) has sha1 hash value: %{checksum}\""); +var part44 = match("MESSAGE#22:virus_file-signature/4_0", "nwparser.p0", "\"Attachment file (%{filename}) has sha1 hash value: %{checksum}\""); var select13 = linear_select([ part44, @@ -1006,8 +912,7 @@ var all19 = all_match({ var msg23 = msg("virus_file-signature", all19); -var part45 = // "Pattern{Field(,false), Constant('MSISDN='), Field(fld3,true), Constant(' resolved='), Field(p0,false)}" -match("MESSAGE#23:statistics/5", "nwparser.p0", "%{}MSISDN=%{fld3->} resolved=%{p0}"); +var part45 = match("MESSAGE#23:statistics/5", "nwparser.p0", "%{}MSISDN=%{fld3->} resolved=%{p0}"); var all20 = all_match({ processors: [ @@ -1071,74 +976,61 @@ var all21 = all_match({ var msg25 = msg("statistics:01", all21); -var part46 = // "Pattern{Constant('"'), Field(direction,false), Constant('" subject='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/4_0", "nwparser.p0", "\"%{direction}\" subject=%{p0}"); +var part46 = match("MESSAGE#25:statistics:02/4_0", "nwparser.p0", "\"%{direction}\" subject=%{p0}"); -var part47 = // "Pattern{Field(direction,true), Constant(' subject='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/4_1", "nwparser.p0", "%{direction->} subject=%{p0}"); +var part47 = match("MESSAGE#25:statistics:02/4_1", "nwparser.p0", "%{direction->} subject=%{p0}"); var select14 = linear_select([ part46, part47, ]); -var part48 = // "Pattern{Constant('"'), Field(subject,false), Constant('" classifier='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/5_0", "nwparser.p0", "\"%{subject}\" classifier=%{p0}"); +var part48 = match("MESSAGE#25:statistics:02/5_0", "nwparser.p0", "\"%{subject}\" classifier=%{p0}"); -var part49 = // "Pattern{Field(subject,true), Constant(' classifier='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/5_1", "nwparser.p0", "%{subject->} classifier=%{p0}"); +var part49 = match("MESSAGE#25:statistics:02/5_1", "nwparser.p0", "%{subject->} classifier=%{p0}"); var select15 = linear_select([ part48, part49, ]); -var part50 = // "Pattern{Constant('"'), Field(filter,false), Constant('" disposition='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/6_0", "nwparser.p0", "\"%{filter}\" disposition=%{p0}"); +var part50 = match("MESSAGE#25:statistics:02/6_0", "nwparser.p0", "\"%{filter}\" disposition=%{p0}"); -var part51 = // "Pattern{Field(filter,true), Constant(' disposition='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/6_1", "nwparser.p0", "%{filter->} disposition=%{p0}"); +var part51 = match("MESSAGE#25:statistics:02/6_1", "nwparser.p0", "%{filter->} disposition=%{p0}"); var select16 = linear_select([ part50, part51, ]); -var part52 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#25:statistics:02/7_0", "nwparser.p0", "\"%{disposition}\" client_name=\"%{p0}"); +var part52 = match("MESSAGE#25:statistics:02/7_0", "nwparser.p0", "\"%{disposition}\" client_name=\"%{p0}"); -var part53 = // "Pattern{Field(disposition,true), Constant(' client_name="'), Field(p0,false)}" -match("MESSAGE#25:statistics:02/7_1", "nwparser.p0", "%{disposition->} client_name=\"%{p0}"); +var part53 = match("MESSAGE#25:statistics:02/7_1", "nwparser.p0", "%{disposition->} client_name=\"%{p0}"); var select17 = linear_select([ part52, part53, ]); -var part54 = // "Pattern{Constant('"'), Field(context,false), Constant('" virus='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/10_0", "nwparser.p0", "\"%{context}\" virus=%{p0}"); +var part54 = match("MESSAGE#25:statistics:02/10_0", "nwparser.p0", "\"%{context}\" virus=%{p0}"); -var part55 = // "Pattern{Field(context,true), Constant(' virus='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/10_1", "nwparser.p0", "%{context->} virus=%{p0}"); +var part55 = match("MESSAGE#25:statistics:02/10_1", "nwparser.p0", "%{context->} virus=%{p0}"); var select18 = linear_select([ part54, part55, ]); -var part56 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" message_length='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/11_0", "nwparser.p0", "\"%{virusname}\" message_length=%{p0}"); +var part56 = match("MESSAGE#25:statistics:02/11_0", "nwparser.p0", "\"%{virusname}\" message_length=%{p0}"); -var part57 = // "Pattern{Field(virusname,true), Constant(' message_length='), Field(p0,false)}" -match("MESSAGE#25:statistics:02/11_1", "nwparser.p0", "%{virusname->} message_length=%{p0}"); +var part57 = match("MESSAGE#25:statistics:02/11_1", "nwparser.p0", "%{virusname->} message_length=%{p0}"); var select19 = linear_select([ part56, part57, ]); -var part58 = // "Pattern{Field(fld4,false)}" -match_copy("MESSAGE#25:statistics:02/12", "nwparser.p0", "fld4"); +var part58 = match_copy("MESSAGE#25:statistics:02/12", "nwparser.p0", "fld4"); var all22 = all_match({ processors: [ @@ -1170,17 +1062,13 @@ var all22 = all_match({ var msg26 = msg("statistics:02", all22); -var part59 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{p0}"); +var part59 = match("MESSAGE#26:statistics:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{p0}"); -var part60 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant('] (may be forged)"'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/1_0", "nwparser.p0", "%{fqdn}[%{saddr}] (may be forged)\"%{p0}"); +var part60 = match("MESSAGE#26:statistics:03/1_0", "nwparser.p0", "%{fqdn}[%{saddr}] (may be forged)\"%{p0}"); -var part61 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']"'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/1_1", "nwparser.p0", "%{fqdn}[%{saddr}]\"%{p0}"); +var part61 = match("MESSAGE#26:statistics:03/1_1", "nwparser.p0", "%{fqdn}[%{saddr}]\"%{p0}"); -var part62 = // "Pattern{Constant('['), Field(saddr,false), Constant(']"'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/1_2", "nwparser.p0", "[%{saddr}]\"%{p0}"); +var part62 = match("MESSAGE#26:statistics:03/1_2", "nwparser.p0", "[%{saddr}]\"%{p0}"); var select20 = linear_select([ part60, @@ -1188,22 +1076,18 @@ var select20 = linear_select([ part62, ]); -var part63 = // "Pattern{Constant('dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/2", "nwparser.p0", "dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\"%{p0}"); +var part63 = match("MESSAGE#26:statistics:03/2", "nwparser.p0", "dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\"%{p0}"); -var part64 = // "Pattern{Constant(' polid="'), Field(fld5,false), Constant('" domain="'), Field(domain,false), Constant('" subject="'), Field(subject,false), Constant('" mailer="'), Field(agent,false), Constant('" resolved="'), Field(context,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#26:statistics:03/3_0", "nwparser.p0", " polid=\"%{fld5}\" domain=\"%{domain}\" subject=\"%{subject}\" mailer=\"%{agent}\" resolved=\"%{context}\"%{p0}"); +var part64 = match("MESSAGE#26:statistics:03/3_0", "nwparser.p0", " polid=\"%{fld5}\" domain=\"%{domain}\" subject=\"%{subject}\" mailer=\"%{agent}\" resolved=\"%{context}\"%{p0}"); -var part65 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#26:statistics:03/3_1", "nwparser.p0", "p0"); +var part65 = match_copy("MESSAGE#26:statistics:03/3_1", "nwparser.p0", "p0"); var select21 = linear_select([ part64, part65, ]); -var part66 = // "Pattern{Field(,false), Constant('direction="'), Field(direction,false), Constant('" virus="'), Field(virusname,false), Constant('" disposition="'), Field(disposition,false), Constant('" classifier="'), Field(filter,false), Constant('" message_length='), Field(fld4,false)}" -match("MESSAGE#26:statistics:03/4", "nwparser.p0", "%{}direction=\"%{direction}\" virus=\"%{virusname}\" disposition=\"%{disposition}\" classifier=\"%{filter}\" message_length=%{fld4}"); +var part66 = match("MESSAGE#26:statistics:03/4", "nwparser.p0", "%{}direction=\"%{direction}\" virus=\"%{virusname}\" disposition=\"%{disposition}\" classifier=\"%{filter}\" message_length=%{fld4}"); var all23 = all_match({ processors: [ @@ -1227,34 +1111,26 @@ var all23 = all_match({ var msg27 = msg("statistics:03", all23); -var part67 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" client_name='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=%{p0}"); +var part67 = match("MESSAGE#27:statistics:04/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=%{p0}"); -var part68 = // "Pattern{Field(sessionid,true), Constant(' client_name='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/1_1", "nwparser.p0", "%{sessionid->} client_name=%{p0}"); +var part68 = match("MESSAGE#27:statistics:04/1_1", "nwparser.p0", "%{sessionid->} client_name=%{p0}"); var select22 = linear_select([ part67, part68, ]); -var part69 = // "Pattern{Constant('"'), Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']"dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_0", "nwparser.p0", "\"%{fqdn}[%{saddr}]\"dst_ip=%{p0}"); +var part69 = match("MESSAGE#27:statistics:04/2_0", "nwparser.p0", "\"%{fqdn}[%{saddr}]\"dst_ip=%{p0}"); -var part70 = // "Pattern{Field(fqdn,false), Constant('['), Field(saddr,false), Constant(']dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_1", "nwparser.p0", "%{fqdn}[%{saddr}]dst_ip=%{p0}"); +var part70 = match("MESSAGE#27:statistics:04/2_1", "nwparser.p0", "%{fqdn}[%{saddr}]dst_ip=%{p0}"); -var part71 = // "Pattern{Constant('"['), Field(saddr,false), Constant(']"dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_2", "nwparser.p0", "\"[%{saddr}]\"dst_ip=%{p0}"); +var part71 = match("MESSAGE#27:statistics:04/2_2", "nwparser.p0", "\"[%{saddr}]\"dst_ip=%{p0}"); -var part72 = // "Pattern{Constant('['), Field(saddr,false), Constant(']dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_3", "nwparser.p0", "[%{saddr}]dst_ip=%{p0}"); +var part72 = match("MESSAGE#27:statistics:04/2_3", "nwparser.p0", "[%{saddr}]dst_ip=%{p0}"); -var part73 = // "Pattern{Constant('"'), Field(saddr,false), Constant('"dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_4", "nwparser.p0", "\"%{saddr}\"dst_ip=%{p0}"); +var part73 = match("MESSAGE#27:statistics:04/2_4", "nwparser.p0", "\"%{saddr}\"dst_ip=%{p0}"); -var part74 = // "Pattern{Field(saddr,false), Constant('dst_ip='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/2_5", "nwparser.p0", "%{saddr}dst_ip=%{p0}"); +var part74 = match("MESSAGE#27:statistics:04/2_5", "nwparser.p0", "%{saddr}dst_ip=%{p0}"); var select23 = linear_select([ part69, @@ -1265,132 +1141,108 @@ var select23 = linear_select([ part74, ]); -var part75 = // "Pattern{Constant('"'), Field(daddr,false), Constant('" from='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/3_0", "nwparser.p0", "\"%{daddr}\" from=%{p0}"); +var part75 = match("MESSAGE#27:statistics:04/3_0", "nwparser.p0", "\"%{daddr}\" from=%{p0}"); -var part76 = // "Pattern{Field(daddr,true), Constant(' from='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/3_1", "nwparser.p0", "%{daddr->} from=%{p0}"); +var part76 = match("MESSAGE#27:statistics:04/3_1", "nwparser.p0", "%{daddr->} from=%{p0}"); var select24 = linear_select([ part75, part76, ]); -var part77 = // "Pattern{Constant('"'), Field(from,false), Constant('" hfrom='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/4_0", "nwparser.p0", "\"%{from}\" hfrom=%{p0}"); +var part77 = match("MESSAGE#27:statistics:04/4_0", "nwparser.p0", "\"%{from}\" hfrom=%{p0}"); -var part78 = // "Pattern{Field(from,true), Constant(' hfrom='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/4_1", "nwparser.p0", "%{from->} hfrom=%{p0}"); +var part78 = match("MESSAGE#27:statistics:04/4_1", "nwparser.p0", "%{from->} hfrom=%{p0}"); var select25 = linear_select([ part77, part78, ]); -var part79 = // "Pattern{Constant('"'), Field(fld3,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/5_0", "nwparser.p0", "\"%{fld3}\" to=%{p0}"); +var part79 = match("MESSAGE#27:statistics:04/5_0", "nwparser.p0", "\"%{fld3}\" to=%{p0}"); -var part80 = // "Pattern{Field(fld3,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/5_1", "nwparser.p0", "%{fld3->} to=%{p0}"); +var part80 = match("MESSAGE#27:statistics:04/5_1", "nwparser.p0", "%{fld3->} to=%{p0}"); var select26 = linear_select([ part79, part80, ]); -var part81 = // "Pattern{Constant('"'), Field(to,false), Constant('" polid='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/6_0", "nwparser.p0", "\"%{to}\" polid=%{p0}"); +var part81 = match("MESSAGE#27:statistics:04/6_0", "nwparser.p0", "\"%{to}\" polid=%{p0}"); -var part82 = // "Pattern{Field(to,true), Constant(' polid='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/6_1", "nwparser.p0", "%{to->} polid=%{p0}"); +var part82 = match("MESSAGE#27:statistics:04/6_1", "nwparser.p0", "%{to->} polid=%{p0}"); var select27 = linear_select([ part81, part82, ]); -var part83 = // "Pattern{Constant('"'), Field(fld5,false), Constant('" domain='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/7_0", "nwparser.p0", "\"%{fld5}\" domain=%{p0}"); +var part83 = match("MESSAGE#27:statistics:04/7_0", "nwparser.p0", "\"%{fld5}\" domain=%{p0}"); -var part84 = // "Pattern{Field(fld5,true), Constant(' domain='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/7_1", "nwparser.p0", "%{fld5->} domain=%{p0}"); +var part84 = match("MESSAGE#27:statistics:04/7_1", "nwparser.p0", "%{fld5->} domain=%{p0}"); var select28 = linear_select([ part83, part84, ]); -var part85 = // "Pattern{Constant('"'), Field(domain,false), Constant('" subject='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/8_0", "nwparser.p0", "\"%{domain}\" subject=%{p0}"); +var part85 = match("MESSAGE#27:statistics:04/8_0", "nwparser.p0", "\"%{domain}\" subject=%{p0}"); -var part86 = // "Pattern{Field(domain,true), Constant(' subject='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/8_1", "nwparser.p0", "%{domain->} subject=%{p0}"); +var part86 = match("MESSAGE#27:statistics:04/8_1", "nwparser.p0", "%{domain->} subject=%{p0}"); var select29 = linear_select([ part85, part86, ]); -var part87 = // "Pattern{Constant('"'), Field(subject,false), Constant('" mailer='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/9_0", "nwparser.p0", "\"%{subject}\" mailer=%{p0}"); +var part87 = match("MESSAGE#27:statistics:04/9_0", "nwparser.p0", "\"%{subject}\" mailer=%{p0}"); -var part88 = // "Pattern{Field(subject,true), Constant(' mailer='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/9_1", "nwparser.p0", "%{subject->} mailer=%{p0}"); +var part88 = match("MESSAGE#27:statistics:04/9_1", "nwparser.p0", "%{subject->} mailer=%{p0}"); var select30 = linear_select([ part87, part88, ]); -var part89 = // "Pattern{Constant('"'), Field(agent,false), Constant('" resolved='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/10_0", "nwparser.p0", "\"%{agent}\" resolved=%{p0}"); +var part89 = match("MESSAGE#27:statistics:04/10_0", "nwparser.p0", "\"%{agent}\" resolved=%{p0}"); -var part90 = // "Pattern{Field(agent,true), Constant(' resolved='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/10_1", "nwparser.p0", "%{agent->} resolved=%{p0}"); +var part90 = match("MESSAGE#27:statistics:04/10_1", "nwparser.p0", "%{agent->} resolved=%{p0}"); var select31 = linear_select([ part89, part90, ]); -var part91 = // "Pattern{Constant('"'), Field(context,false), Constant('" direction='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/11_0", "nwparser.p0", "\"%{context}\" direction=%{p0}"); +var part91 = match("MESSAGE#27:statistics:04/11_0", "nwparser.p0", "\"%{context}\" direction=%{p0}"); -var part92 = // "Pattern{Field(context,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/11_1", "nwparser.p0", "%{context->} direction=%{p0}"); +var part92 = match("MESSAGE#27:statistics:04/11_1", "nwparser.p0", "%{context->} direction=%{p0}"); var select32 = linear_select([ part91, part92, ]); -var part93 = // "Pattern{Constant('"'), Field(direction,false), Constant('" virus='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/12_0", "nwparser.p0", "\"%{direction}\" virus=%{p0}"); +var part93 = match("MESSAGE#27:statistics:04/12_0", "nwparser.p0", "\"%{direction}\" virus=%{p0}"); -var part94 = // "Pattern{Field(direction,true), Constant(' virus='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/12_1", "nwparser.p0", "%{direction->} virus=%{p0}"); +var part94 = match("MESSAGE#27:statistics:04/12_1", "nwparser.p0", "%{direction->} virus=%{p0}"); var select33 = linear_select([ part93, part94, ]); -var part95 = // "Pattern{Constant('"'), Field(filter,false), Constant('" message_length='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/15_0", "nwparser.p0", "\"%{filter}\" message_length=%{p0}"); +var part95 = match("MESSAGE#27:statistics:04/15_0", "nwparser.p0", "\"%{filter}\" message_length=%{p0}"); -var part96 = // "Pattern{Field(filter,true), Constant(' message_length='), Field(p0,false)}" -match("MESSAGE#27:statistics:04/15_1", "nwparser.p0", "%{filter->} message_length=%{p0}"); +var part96 = match("MESSAGE#27:statistics:04/15_1", "nwparser.p0", "%{filter->} message_length=%{p0}"); var select34 = linear_select([ part95, part96, ]); -var part97 = // "Pattern{Constant('"'), Field(fld6,false), Constant('"')}" -match("MESSAGE#27:statistics:04/16_0", "nwparser.p0", "\"%{fld6}\""); +var part97 = match("MESSAGE#27:statistics:04/16_0", "nwparser.p0", "\"%{fld6}\""); -var part98 = // "Pattern{Field(fld6,false)}" -match_copy("MESSAGE#27:statistics:04/16_1", "nwparser.p0", "fld6"); +var part98 = match_copy("MESSAGE#27:statistics:04/16_1", "nwparser.p0", "fld6"); var select35 = linear_select([ part97, @@ -1472,36 +1324,29 @@ var select36 = linear_select([ msg29, ]); -var part100 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#29:spam/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=\"%{p0}"); +var part100 = match("MESSAGE#29:spam/1_0", "nwparser.p0", "\"%{sessionid}\" client_name=\"%{p0}"); -var part101 = // "Pattern{Field(sessionid,true), Constant(' client_name="'), Field(p0,false)}" -match("MESSAGE#29:spam/1_1", "nwparser.p0", "%{sessionid->} client_name=\"%{p0}"); +var part101 = match("MESSAGE#29:spam/1_1", "nwparser.p0", "%{sessionid->} client_name=\"%{p0}"); var select37 = linear_select([ part100, part101, ]); -var part102 = // "Pattern{Field(,false), Constant('from='), Field(p0,false)}" -match("MESSAGE#29:spam/3", "nwparser.p0", "%{}from=%{p0}"); +var part102 = match("MESSAGE#29:spam/3", "nwparser.p0", "%{}from=%{p0}"); -var part103 = // "Pattern{Constant('"'), Field(to,false), Constant('" subject='), Field(p0,false)}" -match("MESSAGE#29:spam/5_0", "nwparser.p0", "\"%{to}\" subject=%{p0}"); +var part103 = match("MESSAGE#29:spam/5_0", "nwparser.p0", "\"%{to}\" subject=%{p0}"); -var part104 = // "Pattern{Field(to,true), Constant(' subject='), Field(p0,false)}" -match("MESSAGE#29:spam/5_1", "nwparser.p0", "%{to->} subject=%{p0}"); +var part104 = match("MESSAGE#29:spam/5_1", "nwparser.p0", "%{to->} subject=%{p0}"); var select38 = linear_select([ part103, part104, ]); -var part105 = // "Pattern{Constant('"'), Field(subject,false), Constant('" msg='), Field(p0,false)}" -match("MESSAGE#29:spam/6_0", "nwparser.p0", "\"%{subject}\" msg=%{p0}"); +var part105 = match("MESSAGE#29:spam/6_0", "nwparser.p0", "\"%{subject}\" msg=%{p0}"); -var part106 = // "Pattern{Field(subject,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#29:spam/6_1", "nwparser.p0", "%{subject->} msg=%{p0}"); +var part106 = match("MESSAGE#29:spam/6_1", "nwparser.p0", "%{subject->} msg=%{p0}"); var select39 = linear_select([ part105, @@ -1533,8 +1378,7 @@ var all25 = all_match({ var msg30 = msg("spam", all25); -var part107 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name="'), Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(fld2,false), Constant(')" dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" -match("MESSAGE#30:spam:04", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{fqdn->} [%{saddr}] (%{fld2})\" dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ +var part107 = match("MESSAGE#30:spam:04", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=\"%{fqdn->} [%{saddr}] (%{fld2})\" dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ dup62, dup8, dup9, @@ -1547,22 +1391,18 @@ match("MESSAGE#30:spam:04", "nwparser.payload", "session_id=\"%{sessionid}\" cli var msg31 = msg("spam:04", part107); -var part108 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" client_name='), Field(p0,false)}" -match("MESSAGE#31:spam:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=%{p0}"); +var part108 = match("MESSAGE#31:spam:03/0", "nwparser.payload", "session_id=\"%{sessionid}\" client_name=%{p0}"); -var part109 = // "Pattern{Constant('"'), Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']" '), Field(p0,false)}" -match("MESSAGE#31:spam:03/1_0", "nwparser.p0", "\"%{fqdn->} [%{saddr}]\" %{p0}"); +var part109 = match("MESSAGE#31:spam:03/1_0", "nwparser.p0", "\"%{fqdn->} [%{saddr}]\" %{p0}"); -var part110 = // "Pattern{Constant(' "'), Field(fqdn,false), Constant('" client_ip="'), Field(saddr,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#31:spam:03/1_1", "nwparser.p0", " \"%{fqdn}\" client_ip=\"%{saddr}\"%{p0}"); +var part110 = match("MESSAGE#31:spam:03/1_1", "nwparser.p0", " \"%{fqdn}\" client_ip=\"%{saddr}\"%{p0}"); var select40 = linear_select([ part109, part110, ]); -var part111 = // "Pattern{Field(,false), Constant('dst_ip="'), Field(daddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" -match("MESSAGE#31:spam:03/2", "nwparser.p0", "%{}dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\""); +var part111 = match("MESSAGE#31:spam:03/2", "nwparser.p0", "%{}dst_ip=\"%{daddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\""); var all26 = all_match({ processors: [ @@ -1584,8 +1424,7 @@ var all26 = all_match({ var msg32 = msg("spam:03", all26); -var part112 = // "Pattern{Constant('session_id="'), Field(sessionid,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" msg="'), Field(event_description,false), Constant('"')}" -match("MESSAGE#32:spam:02", "nwparser.payload", "session_id=\"%{sessionid}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ +var part112 = match("MESSAGE#32:spam:02", "nwparser.payload", "session_id=\"%{sessionid}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" msg=\"%{event_description}\"", processor_chain([ dup62, dup8, dup9, @@ -1598,11 +1437,9 @@ match("MESSAGE#32:spam:02", "nwparser.payload", "session_id=\"%{sessionid}\" fro var msg33 = msg("spam:02", part112); -var part113 = // "Pattern{Constant('"'), Field(to,false), Constant('" msg='), Field(p0,false)}" -match("MESSAGE#33:spam:01/3_0", "nwparser.p0", "\"%{to}\" msg=%{p0}"); +var part113 = match("MESSAGE#33:spam:01/3_0", "nwparser.p0", "\"%{to}\" msg=%{p0}"); -var part114 = // "Pattern{Field(to,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#33:spam:01/3_1", "nwparser.p0", "%{to->} msg=%{p0}"); +var part114 = match("MESSAGE#33:spam:01/3_1", "nwparser.p0", "%{to->} msg=%{p0}"); var select41 = linear_select([ part113, @@ -1658,146 +1495,99 @@ var chain1 = processor_chain([ }), ]); -var part115 = // "Pattern{Constant('user='), Field(username,true), Constant(' ui='), Field(p0,false)}" -match("MESSAGE#0:event_admin/0", "nwparser.payload", "user=%{username->} ui=%{p0}"); +var part115 = match("MESSAGE#0:event_admin/0", "nwparser.payload", "user=%{username->} ui=%{p0}"); -var part116 = // "Pattern{Field(network_service,false), Constant('('), Field(saddr,false), Constant(') action='), Field(p0,false)}" -match("MESSAGE#0:event_admin/1_0", "nwparser.p0", "%{network_service}(%{saddr}) action=%{p0}"); +var part116 = match("MESSAGE#0:event_admin/1_0", "nwparser.p0", "%{network_service}(%{saddr}) action=%{p0}"); -var part117 = // "Pattern{Field(network_service,true), Constant(' action='), Field(p0,false)}" -match("MESSAGE#0:event_admin/1_1", "nwparser.p0", "%{network_service->} action=%{p0}"); +var part117 = match("MESSAGE#0:event_admin/1_1", "nwparser.p0", "%{network_service->} action=%{p0}"); -var part118 = // "Pattern{Constant('"'), Field(event_description,false), Constant('"')}" -match("MESSAGE#0:event_admin/3_0", "nwparser.p0", "\"%{event_description}\""); +var part118 = match("MESSAGE#0:event_admin/3_0", "nwparser.p0", "\"%{event_description}\""); -var part119 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#0:event_admin/3_1", "nwparser.p0", "event_description"); +var part119 = match_copy("MESSAGE#0:event_admin/3_1", "nwparser.p0", "event_description"); -var part120 = // "Pattern{Field(action,true), Constant(' status='), Field(event_state,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#1:event_pop3/2", "nwparser.p0", "%{action->} status=%{event_state->} msg=%{p0}"); +var part120 = match("MESSAGE#1:event_pop3/2", "nwparser.p0", "%{action->} status=%{event_state->} msg=%{p0}"); -var part121 = // "Pattern{Constant('user='), Field(username,false), Constant('ui='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/0", "nwparser.payload", "user=%{username}ui=%{p0}"); +var part121 = match("MESSAGE#5:event_smtp:01/0", "nwparser.payload", "user=%{username}ui=%{p0}"); -var part122 = // "Pattern{Field(network_service,false), Constant('('), Field(hostip,false), Constant(') action='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/1_0", "nwparser.p0", "%{network_service}(%{hostip}) action=%{p0}"); +var part122 = match("MESSAGE#5:event_smtp:01/1_0", "nwparser.p0", "%{network_service}(%{hostip}) action=%{p0}"); -var part123 = // "Pattern{Field(network_service,false), Constant('action='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/1_1", "nwparser.p0", "%{network_service}action=%{p0}"); +var part123 = match("MESSAGE#5:event_smtp:01/1_1", "nwparser.p0", "%{network_service}action=%{p0}"); -var part124 = // "Pattern{Field(action,false), Constant('status='), Field(event_state,false), Constant('session_id='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/2", "nwparser.p0", "%{action}status=%{event_state}session_id=%{p0}"); +var part124 = match("MESSAGE#5:event_smtp:01/2", "nwparser.p0", "%{action}status=%{event_state}session_id=%{p0}"); -var part125 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('"msg="STARTTLS='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/3_0", "nwparser.p0", "\"%{sessionid}\"msg=\"STARTTLS=%{p0}"); +var part125 = match("MESSAGE#5:event_smtp:01/3_0", "nwparser.p0", "\"%{sessionid}\"msg=\"STARTTLS=%{p0}"); -var part126 = // "Pattern{Field(sessionid,false), Constant('msg="STARTTLS='), Field(p0,false)}" -match("MESSAGE#5:event_smtp:01/3_1", "nwparser.p0", "%{sessionid}msg=\"STARTTLS=%{p0}"); +var part126 = match("MESSAGE#5:event_smtp:01/3_1", "nwparser.p0", "%{sessionid}msg=\"STARTTLS=%{p0}"); -var part127 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" msg='), Field(p0,false)}" -match("MESSAGE#16:event_smtp/3_0", "nwparser.p0", "\"%{sessionid}\" msg=%{p0}"); +var part127 = match("MESSAGE#16:event_smtp/3_0", "nwparser.p0", "\"%{sessionid}\" msg=%{p0}"); -var part128 = // "Pattern{Field(sessionid,true), Constant(' msg='), Field(p0,false)}" -match("MESSAGE#16:event_smtp/3_1", "nwparser.p0", "%{sessionid->} msg=%{p0}"); +var part128 = match("MESSAGE#16:event_smtp/3_1", "nwparser.p0", "%{sessionid->} msg=%{p0}"); -var part129 = // "Pattern{Constant('from='), Field(p0,false)}" -match("MESSAGE#20:virus/0", "nwparser.payload", "from=%{p0}"); +var part129 = match("MESSAGE#20:virus/0", "nwparser.payload", "from=%{p0}"); -var part130 = // "Pattern{Constant('"'), Field(from,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#20:virus/1_0", "nwparser.p0", "\"%{from}\" to=%{p0}"); +var part130 = match("MESSAGE#20:virus/1_0", "nwparser.p0", "\"%{from}\" to=%{p0}"); -var part131 = // "Pattern{Field(from,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#20:virus/1_1", "nwparser.p0", "%{from->} to=%{p0}"); +var part131 = match("MESSAGE#20:virus/1_1", "nwparser.p0", "%{from->} to=%{p0}"); -var part132 = // "Pattern{Constant('"'), Field(to,false), Constant('" src='), Field(p0,false)}" -match("MESSAGE#20:virus/2_0", "nwparser.p0", "\"%{to}\" src=%{p0}"); +var part132 = match("MESSAGE#20:virus/2_0", "nwparser.p0", "\"%{to}\" src=%{p0}"); -var part133 = // "Pattern{Field(to,true), Constant(' src='), Field(p0,false)}" -match("MESSAGE#20:virus/2_1", "nwparser.p0", "%{to->} src=%{p0}"); +var part133 = match("MESSAGE#20:virus/2_1", "nwparser.p0", "%{to->} src=%{p0}"); -var part134 = // "Pattern{Constant('"'), Field(saddr,false), Constant('" session_id='), Field(p0,false)}" -match("MESSAGE#20:virus/3_0", "nwparser.p0", "\"%{saddr}\" session_id=%{p0}"); +var part134 = match("MESSAGE#20:virus/3_0", "nwparser.p0", "\"%{saddr}\" session_id=%{p0}"); -var part135 = // "Pattern{Field(saddr,true), Constant(' session_id='), Field(p0,false)}" -match("MESSAGE#20:virus/3_1", "nwparser.p0", "%{saddr->} session_id=%{p0}"); +var part135 = match("MESSAGE#20:virus/3_1", "nwparser.p0", "%{saddr->} session_id=%{p0}"); -var part136 = // "Pattern{Constant('session_id='), Field(p0,false)}" -match("MESSAGE#23:statistics/0", "nwparser.payload", "session_id=%{p0}"); +var part136 = match("MESSAGE#23:statistics/0", "nwparser.payload", "session_id=%{p0}"); -var part137 = // "Pattern{Constant('"'), Field(sessionid,false), Constant('" from='), Field(p0,false)}" -match("MESSAGE#23:statistics/1_0", "nwparser.p0", "\"%{sessionid}\" from=%{p0}"); +var part137 = match("MESSAGE#23:statistics/1_0", "nwparser.p0", "\"%{sessionid}\" from=%{p0}"); -var part138 = // "Pattern{Field(sessionid,true), Constant(' from='), Field(p0,false)}" -match("MESSAGE#23:statistics/1_1", "nwparser.p0", "%{sessionid->} from=%{p0}"); +var part138 = match("MESSAGE#23:statistics/1_1", "nwparser.p0", "%{sessionid->} from=%{p0}"); -var part139 = // "Pattern{Constant('"'), Field(from,false), Constant('" mailer='), Field(p0,false)}" -match("MESSAGE#23:statistics/2_0", "nwparser.p0", "\"%{from}\" mailer=%{p0}"); +var part139 = match("MESSAGE#23:statistics/2_0", "nwparser.p0", "\"%{from}\" mailer=%{p0}"); -var part140 = // "Pattern{Field(from,true), Constant(' mailer='), Field(p0,false)}" -match("MESSAGE#23:statistics/2_1", "nwparser.p0", "%{from->} mailer=%{p0}"); +var part140 = match("MESSAGE#23:statistics/2_1", "nwparser.p0", "%{from->} mailer=%{p0}"); -var part141 = // "Pattern{Constant('"'), Field(agent,false), Constant('" client_name="'), Field(p0,false)}" -match("MESSAGE#23:statistics/3_0", "nwparser.p0", "\"%{agent}\" client_name=\"%{p0}"); +var part141 = match("MESSAGE#23:statistics/3_0", "nwparser.p0", "\"%{agent}\" client_name=\"%{p0}"); -var part142 = // "Pattern{Field(agent,true), Constant(' client_name="'), Field(p0,false)}" -match("MESSAGE#23:statistics/3_1", "nwparser.p0", "%{agent->} client_name=\"%{p0}"); +var part142 = match("MESSAGE#23:statistics/3_1", "nwparser.p0", "%{agent->} client_name=\"%{p0}"); -var part143 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant('] ('), Field(info,false), Constant(')"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); +var part143 = match("MESSAGE#23:statistics/4_0", "nwparser.p0", "%{fqdn->} [%{saddr}] (%{info})\"%{p0}"); -var part144 = // "Pattern{Field(fqdn,true), Constant(' ['), Field(saddr,false), Constant(']"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); +var part144 = match("MESSAGE#23:statistics/4_1", "nwparser.p0", "%{fqdn->} [%{saddr}]\"%{p0}"); -var part145 = // "Pattern{Field(saddr,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); +var part145 = match("MESSAGE#23:statistics/4_2", "nwparser.p0", "%{saddr}\"%{p0}"); -var part146 = // "Pattern{Constant('"'), Field(context,false), Constant('" to='), Field(p0,false)}" -match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); +var part146 = match("MESSAGE#23:statistics/6_0", "nwparser.p0", "\"%{context}\" to=%{p0}"); -var part147 = // "Pattern{Field(context,true), Constant(' to='), Field(p0,false)}" -match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); +var part147 = match("MESSAGE#23:statistics/6_1", "nwparser.p0", "%{context->} to=%{p0}"); -var part148 = // "Pattern{Constant('"'), Field(to,false), Constant('" direction='), Field(p0,false)}" -match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); +var part148 = match("MESSAGE#23:statistics/7_0", "nwparser.p0", "\"%{to}\" direction=%{p0}"); -var part149 = // "Pattern{Field(to,true), Constant(' direction='), Field(p0,false)}" -match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); +var part149 = match("MESSAGE#23:statistics/7_1", "nwparser.p0", "%{to->} direction=%{p0}"); -var part150 = // "Pattern{Constant('"'), Field(direction,false), Constant('" message_length='), Field(p0,false)}" -match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); +var part150 = match("MESSAGE#23:statistics/8_0", "nwparser.p0", "\"%{direction}\" message_length=%{p0}"); -var part151 = // "Pattern{Field(direction,true), Constant(' message_length='), Field(p0,false)}" -match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); +var part151 = match("MESSAGE#23:statistics/8_1", "nwparser.p0", "%{direction->} message_length=%{p0}"); -var part152 = // "Pattern{Field(fld4,true), Constant(' virus='), Field(p0,false)}" -match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); +var part152 = match("MESSAGE#23:statistics/9", "nwparser.p0", "%{fld4->} virus=%{p0}"); -var part153 = // "Pattern{Constant('"'), Field(virusname,false), Constant('" disposition='), Field(p0,false)}" -match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); +var part153 = match("MESSAGE#23:statistics/10_0", "nwparser.p0", "\"%{virusname}\" disposition=%{p0}"); -var part154 = // "Pattern{Field(virusname,true), Constant(' disposition='), Field(p0,false)}" -match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); +var part154 = match("MESSAGE#23:statistics/10_1", "nwparser.p0", "%{virusname->} disposition=%{p0}"); -var part155 = // "Pattern{Constant('"'), Field(disposition,false), Constant('" classifier='), Field(p0,false)}" -match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); +var part155 = match("MESSAGE#23:statistics/11_0", "nwparser.p0", "\"%{disposition}\" classifier=%{p0}"); -var part156 = // "Pattern{Field(disposition,true), Constant(' classifier='), Field(p0,false)}" -match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); +var part156 = match("MESSAGE#23:statistics/11_1", "nwparser.p0", "%{disposition->} classifier=%{p0}"); -var part157 = // "Pattern{Constant('"'), Field(filter,false), Constant('" subject='), Field(p0,false)}" -match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); +var part157 = match("MESSAGE#23:statistics/12_0", "nwparser.p0", "\"%{filter}\" subject=%{p0}"); -var part158 = // "Pattern{Field(filter,true), Constant(' subject='), Field(p0,false)}" -match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); +var part158 = match("MESSAGE#23:statistics/12_1", "nwparser.p0", "%{filter->} subject=%{p0}"); -var part159 = // "Pattern{Constant('"'), Field(subject,false), Constant('"')}" -match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); +var part159 = match("MESSAGE#23:statistics/13_0", "nwparser.p0", "\"%{subject}\""); -var part160 = // "Pattern{Field(subject,false)}" -match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); +var part160 = match_copy("MESSAGE#23:statistics/13_1", "nwparser.p0", "subject"); -var part161 = // "Pattern{Field(,false), Constant('resolved='), Field(p0,false)}" -match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); +var part161 = match("MESSAGE#24:statistics:01/5", "nwparser.p0", "%{}resolved=%{p0}"); var select43 = linear_select([ dup3, diff --git a/x-pack/filebeat/module/fortinet/fortimanager/config/pipeline.js b/x-pack/filebeat/module/fortinet/fortimanager/config/pipeline.js index ca32adec710..4cb7669b950 100644 --- a/x-pack/filebeat/module/fortinet/fortimanager/config/pipeline.js +++ b/x-pack/filebeat/module/fortinet/fortimanager/config/pipeline.js @@ -124,8 +124,7 @@ var dup23 = lookup({ key: dup15, }); -var hdr1 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' devname='), Field(hdevice,true), Constant(' device_id='), Field(hfld1,true), Constant(' log_id='), Field(id,true), Constant(' type='), Field(hfld2,true), Constant(' subtype='), Field(hfld3,true), Constant(' pri='), Field(hseverity,true), Constant(' '), Field(payload,false)}" -match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} devname=%{hdevice->} device_id=%{hfld1->} log_id=%{id->} type=%{hfld2->} subtype=%{hfld3->} pri=%{hseverity->} %{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} devname=%{hdevice->} device_id=%{hfld1->} log_id=%{id->} type=%{hfld2->} subtype=%{hfld3->} pri=%{hseverity->} %{payload}", processor_chain([ setc("header_id","0001"), call({ dest: "nwparser.messageid", @@ -137,26 +136,22 @@ match("HEADER#0:0001", "message", "date=%{hdate->} time=%{htime->} devname=%{hde }), ])); -var hdr2 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' log_id='), Field(id,true), Constant(' '), Field(payload,false)}" -match("HEADER#1:0002", "message", "logver=%{hfld1->} date=%{hdate->} time=%{htime->} log_id=%{id->} %{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0002", "message", "logver=%{hfld1->} date=%{hdate->} time=%{htime->} log_id=%{id->} %{payload}", processor_chain([ setc("header_id","0002"), dup1, ])); -var hdr3 = // "Pattern{Constant('date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' logver='), Field(fld1,true), Constant(' '), Field(payload,false)}" -match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} logver=%{fld1->} %{payload}", processor_chain([ +var hdr3 = match("HEADER#2:0003", "message", "date=%{hdate->} time=%{htime->} logver=%{fld1->} %{payload}", processor_chain([ setc("header_id","0003"), dup1, ])); -var hdr4 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' dtime='), Field(hdatetime,true), Constant(' devid='), Field(hfld2,true), Constant(' devname='), Field(hdevice,true), Constant(' '), Field(payload,false)}" -match("HEADER#3:0004", "message", "logver=%{hfld1->} dtime=%{hdatetime->} devid=%{hfld2->} devname=%{hdevice->} %{payload}", processor_chain([ +var hdr4 = match("HEADER#3:0004", "message", "logver=%{hfld1->} dtime=%{hdatetime->} devid=%{hfld2->} devname=%{hdevice->} %{payload}", processor_chain([ setc("header_id","0004"), dup2, ])); -var hdr5 = // "Pattern{Constant('logver='), Field(hfld1,true), Constant(' devname="'), Field(hdevice,false), Constant('" devid="'), Field(hfld2,false), Constant('" '), Field(payload,false)}" -match("HEADER#4:0005", "message", "logver=%{hfld1->} devname=\"%{hdevice}\" devid=\"%{hfld2}\" %{payload}", processor_chain([ +var hdr5 = match("HEADER#4:0005", "message", "logver=%{hfld1->} devname=\"%{hdevice}\" devid=\"%{hfld2}\" %{payload}", processor_chain([ setc("header_id","0005"), dup2, ])); @@ -169,8 +164,7 @@ var select1 = linear_select([ hdr5, ]); -var part1 = // "Pattern{Constant('user='), Field(fld1,true), Constant(' adom='), Field(domain,true), Constant(' user='), Field(username,true), Constant(' ui='), Field(fld2,true), Constant(' action='), Field(action,true), Constant(' status='), Field(event_state,true), Constant(' msg="'), Field(event_description,false), Constant('"')}" -match("MESSAGE#0:fortinetmgr:01", "nwparser.payload", "user=%{fld1->} adom=%{domain->} user=%{username->} ui=%{fld2->} action=%{action->} status=%{event_state->} msg=\"%{event_description}\"", processor_chain([ +var part1 = match("MESSAGE#0:fortinetmgr:01", "nwparser.payload", "user=%{fld1->} adom=%{domain->} user=%{username->} ui=%{fld2->} action=%{action->} status=%{event_state->} msg=\"%{event_description}\"", processor_chain([ dup3, dup4, dup5, @@ -183,8 +177,7 @@ match("MESSAGE#0:fortinetmgr:01", "nwparser.payload", "user=%{fld1->} adom=%{dom var msg1 = msg("fortinetmgr:01", part1); -var part2 = // "Pattern{Constant('user='), Field(username,true), Constant(' adom='), Field(domain,true), Constant(' msg="'), Field(event_description,false), Constant('"')}" -match("MESSAGE#1:fortinetmgr", "nwparser.payload", "user=%{username->} adom=%{domain->} msg=\"%{event_description}\"", processor_chain([ +var part2 = match("MESSAGE#1:fortinetmgr", "nwparser.payload", "user=%{username->} adom=%{domain->} msg=\"%{event_description}\"", processor_chain([ dup3, dup4, dup5, @@ -197,42 +190,33 @@ match("MESSAGE#1:fortinetmgr", "nwparser.payload", "user=%{username->} adom=%{do var msg2 = msg("fortinetmgr", part2); -var part3 = // "Pattern{Constant('user="'), Field(username,false), Constant('" userfrom='), Field(fld7,true), Constant(' msg="'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/0", "nwparser.payload", "user=\"%{username}\" userfrom=%{fld7->} msg=\"%{p0}"); +var part3 = match("MESSAGE#2:fortinetmgr:04/0", "nwparser.payload", "user=\"%{username}\" userfrom=%{fld7->} msg=\"%{p0}"); -var part4 = // "Pattern{Constant('User'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/1_0", "nwparser.p0", "User%{p0}"); +var part4 = match("MESSAGE#2:fortinetmgr:04/1_0", "nwparser.p0", "User%{p0}"); -var part5 = // "Pattern{Constant('user'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/1_1", "nwparser.p0", "user%{p0}"); +var part5 = match("MESSAGE#2:fortinetmgr:04/1_1", "nwparser.p0", "user%{p0}"); var select2 = linear_select([ part4, part5, ]); -var part6 = // "Pattern{Field(,false), Constant('''), Field(fld3,false), Constant('' with profile ''), Field(fld4,false), Constant('' '), Field(fld5,true), Constant(' from '), Field(fld6,false), Constant('('), Field(hostip,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/2", "nwparser.p0", "%{}'%{fld3}' with profile '%{fld4}' %{fld5->} from %{fld6}(%{hostip})%{p0}"); +var part6 = match("MESSAGE#2:fortinetmgr:04/2", "nwparser.p0", "%{}'%{fld3}' with profile '%{fld4}' %{fld5->} from %{fld6}(%{hostip})%{p0}"); -var part7 = // "Pattern{Constant('."'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/3_0", "nwparser.p0", ".\"%{p0}"); +var part7 = match("MESSAGE#2:fortinetmgr:04/3_0", "nwparser.p0", ".\"%{p0}"); -var part8 = // "Pattern{Constant('"'), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/3_1", "nwparser.p0", "\"%{p0}"); +var part8 = match("MESSAGE#2:fortinetmgr:04/3_1", "nwparser.p0", "\"%{p0}"); var select3 = linear_select([ part7, part8, ]); -var part9 = // "Pattern{Field(,false), Constant('adminprof='), Field(p0,false)}" -match("MESSAGE#2:fortinetmgr:04/4", "nwparser.p0", "%{}adminprof=%{p0}"); +var part9 = match("MESSAGE#2:fortinetmgr:04/4", "nwparser.p0", "%{}adminprof=%{p0}"); -var part10 = // "Pattern{Field(fld2,true), Constant(' sid='), Field(sid,true), Constant(' user_type="'), Field(profile,false), Constant('"')}" -match("MESSAGE#2:fortinetmgr:04/5_0", "nwparser.p0", "%{fld2->} sid=%{sid->} user_type=\"%{profile}\""); +var part10 = match("MESSAGE#2:fortinetmgr:04/5_0", "nwparser.p0", "%{fld2->} sid=%{sid->} user_type=\"%{profile}\""); -var part11 = // "Pattern{Field(fld2,false)}" -match_copy("MESSAGE#2:fortinetmgr:04/5_1", "nwparser.p0", "fld2"); +var part11 = match_copy("MESSAGE#2:fortinetmgr:04/5_1", "nwparser.p0", "fld2"); var select4 = linear_select([ part10, @@ -268,8 +252,7 @@ var all1 = all_match({ var msg3 = msg("fortinetmgr:04", all1); -var part12 = // "Pattern{Constant('user='), Field(username,true), Constant(' userfrom='), Field(fld4,true), Constant(' msg="'), Field(event_description,false), Constant('" adminprof='), Field(fld2,false)}" -match("MESSAGE#3:fortinetmgr:02", "nwparser.payload", "user=%{username->} userfrom=%{fld4->} msg=\"%{event_description}\" adminprof=%{fld2}", processor_chain([ +var part12 = match("MESSAGE#3:fortinetmgr:02", "nwparser.payload", "user=%{username->} userfrom=%{fld4->} msg=\"%{event_description}\" adminprof=%{fld2}", processor_chain([ dup3, dup4, dup5, @@ -282,8 +265,7 @@ match("MESSAGE#3:fortinetmgr:02", "nwparser.payload", "user=%{username->} userfr var msg4 = msg("fortinetmgr:02", part12); -var part13 = // "Pattern{Constant('user="'), Field(username,false), Constant('" msg="Login from ssh:'), Field(fld1,true), Constant(' for '), Field(fld2,true), Constant(' from '), Field(saddr,true), Constant(' port '), Field(sport,false), Constant('" remote_ip="'), Field(daddr,false), Constant('" remote_port='), Field(dport,true), Constant(' valid='), Field(fld3,true), Constant(' authmsg="'), Field(result,false), Constant('" extrainfo='), Field(fld5,false)}" -match("MESSAGE#4:fortinetmgr:03", "nwparser.payload", "user=\"%{username}\" msg=\"Login from ssh:%{fld1->} for %{fld2->} from %{saddr->} port %{sport}\" remote_ip=\"%{daddr}\" remote_port=%{dport->} valid=%{fld3->} authmsg=\"%{result}\" extrainfo=%{fld5}", processor_chain([ +var part13 = match("MESSAGE#4:fortinetmgr:03", "nwparser.payload", "user=\"%{username}\" msg=\"Login from ssh:%{fld1->} for %{fld2->} from %{saddr->} port %{sport}\" remote_ip=\"%{daddr}\" remote_port=%{dport->} valid=%{fld3->} authmsg=\"%{result}\" extrainfo=%{fld5}", processor_chain([ dup11, dup4, dup5, @@ -302,22 +284,18 @@ match("MESSAGE#4:fortinetmgr:03", "nwparser.payload", "user=\"%{username}\" msg= var msg5 = msg("fortinetmgr:03", part13); -var part14 = // "Pattern{Constant('user="'), Field(username,false), Constant('" userfrom="'), Field(fld1,false), Constant('"msg="'), Field(p0,false)}" -match("MESSAGE#5:fortinetmgr:05/0", "nwparser.payload", "user=\"%{username}\" userfrom=\"%{fld1}\"msg=\"%{p0}"); +var part14 = match("MESSAGE#5:fortinetmgr:05/0", "nwparser.payload", "user=\"%{username}\" userfrom=\"%{fld1}\"msg=\"%{p0}"); -var part15 = // "Pattern{Constant('dev='), Field(fld2,false), Constant(',vdom='), Field(fld3,false), Constant(',type='), Field(fld4,false), Constant(',key='), Field(fld5,false), Constant(',act='), Field(action,false), Constant(',pkgname='), Field(fld7,false), Constant(',allowaccess='), Field(fld8,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#5:fortinetmgr:05/1_0", "nwparser.p0", "dev=%{fld2},vdom=%{fld3},type=%{fld4},key=%{fld5},act=%{action},pkgname=%{fld7},allowaccess=%{fld8}\"%{p0}"); +var part15 = match("MESSAGE#5:fortinetmgr:05/1_0", "nwparser.p0", "dev=%{fld2},vdom=%{fld3},type=%{fld4},key=%{fld5},act=%{action},pkgname=%{fld7},allowaccess=%{fld8}\"%{p0}"); -var part16 = // "Pattern{Field(event_description,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#5:fortinetmgr:05/1_1", "nwparser.p0", "%{event_description}\"%{p0}"); +var part16 = match("MESSAGE#5:fortinetmgr:05/1_1", "nwparser.p0", "%{event_description}\"%{p0}"); var select5 = linear_select([ part15, part16, ]); -var part17 = // "Pattern{Field(domain,false), Constant('" adom="')}" -match("MESSAGE#5:fortinetmgr:05/2", "nwparser.p0", "%{domain}\" adom=\""); +var part17 = match("MESSAGE#5:fortinetmgr:05/2", "nwparser.p0", "%{domain}\" adom=\""); var all2 = all_match({ processors: [ diff --git a/x-pack/filebeat/module/juniper/netscreen/config/pipeline.js b/x-pack/filebeat/module/juniper/netscreen/config/pipeline.js index 4f4110c94a8..a35f5d2a21f 100644 --- a/x-pack/filebeat/module/juniper/netscreen/config/pipeline.js +++ b/x-pack/filebeat/module/juniper/netscreen/config/pipeline.js @@ -49,14 +49,11 @@ var dup4 = setf("msg","$MSG"); var dup5 = setf("severity","hseverity"); -var dup6 = // "Pattern{Constant('Address '), Field(group_object,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); +var dup6 = match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); -var dup7 = // "Pattern{Constant('domain address '), Field(domain,true), Constant(' in zone '), Field(p0,false)}" -match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); +var dup7 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); -var dup8 = // "Pattern{Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); +var dup8 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); var dup9 = date_time({ dest: "event_time", @@ -66,26 +63,19 @@ var dup9 = date_time({ ], }); -var dup10 = // "Pattern{Constant('('), Field(fld1,false), Constant(')')}" -match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); +var dup10 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); -var dup11 = // "Pattern{Field(fld1,false)}" -match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); +var dup11 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); -var dup12 = // "Pattern{Constant('Address '), Field(p0,false)}" -match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); +var dup12 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); -var dup13 = // "Pattern{Constant('MIP('), Field(interface,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); +var dup13 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); -var dup14 = // "Pattern{Field(group_object,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); +var dup14 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); -var dup15 = // "Pattern{Constant('admin '), Field(p0,false)}" -match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); +var dup15 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); -var dup16 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); +var dup16 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); var dup17 = setc("eventcategory","1502000000"); @@ -93,25 +83,19 @@ var dup18 = setc("eventcategory","1703000000"); var dup19 = setc("eventcategory","1603000000"); -var dup20 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ')}" -match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); +var dup20 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); -var dup21 = // "Pattern{}" -match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); +var dup21 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); var dup22 = setc("eventcategory","1502050000"); -var dup23 = // "Pattern{Constant(''), Field(p0,false)}" -match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); +var dup23 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); -var dup24 = // "Pattern{Constant('password '), Field(p0,false)}" -match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); +var dup24 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); -var dup25 = // "Pattern{Constant('name '), Field(p0,false)}" -match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); +var dup25 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); -var dup26 = // "Pattern{Field(administrator,false)}" -match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); +var dup26 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); var dup27 = setc("eventcategory","1801010000"); @@ -131,8 +115,7 @@ var dup34 = setc("ec_activity","Logoff"); var dup35 = setc("eventcategory","1303000000"); -var dup36 = // "Pattern{Field(disposition,false)}" -match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); +var dup36 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); var dup37 = setc("eventcategory","1402020200"); @@ -140,11 +123,9 @@ var dup38 = setc("ec_theme","UserGroup"); var dup39 = setc("ec_outcome","Error"); -var dup40 = // "Pattern{Constant('via '), Field(p0,false)}" -match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); +var dup40 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); -var dup41 = // "Pattern{Field(fld1,false), Constant(')')}" -match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); +var dup41 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); var dup42 = setc("eventcategory","1402020300"); @@ -152,40 +133,31 @@ var dup43 = setc("ec_activity","Modify"); var dup44 = setc("eventcategory","1605000000"); -var dup45 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(p0,false)}" -match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); +var dup45 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); -var dup46 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); +var dup46 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); -var dup47 = // "Pattern{Field(username,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); +var dup47 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); -var dup48 = // "Pattern{Constant('NSRP Peer . ('), Field(p0,false)}" -match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); +var dup48 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); -var dup49 = // "Pattern{Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); +var dup49 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); var dup50 = setc("eventcategory","1701020000"); var dup51 = setc("ec_theme","Configuration"); -var dup52 = // "Pattern{Constant('changed'), Field(p0,false)}" -match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); +var dup52 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); var dup53 = setc("eventcategory","1301000000"); var dup54 = setc("ec_outcome","Failure"); -var dup55 = // "Pattern{Constant('The '), Field(p0,false)}" -match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); +var dup55 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); -var dup56 = // "Pattern{Constant('interface'), Field(p0,false)}" -match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); +var dup56 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); -var dup57 = // "Pattern{Constant('Interface'), Field(p0,false)}" -match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); +var dup57 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); var dup58 = setc("eventcategory","1001000000"); @@ -215,68 +187,47 @@ var dup61 = call({ var dup62 = setc("eventcategory","1608010000"); -var dup63 = // "Pattern{Constant('DNS entries have been '), Field(p0,false)}" -match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); +var dup63 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); -var dup64 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" -match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); +var dup64 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); -var dup65 = // "Pattern{Field(zone,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); +var dup65 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); -var dup66 = // "Pattern{Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); +var dup66 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); -var dup67 = // "Pattern{Constant('int '), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); +var dup67 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); -var dup68 = // "Pattern{Field(dport,false), Constant(','), Field(p0,false)}" -match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); +var dup68 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); -var dup69 = // "Pattern{Field(dport,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); +var dup69 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); -var dup70 = // "Pattern{Field(space,false), Constant('using protocol '), Field(p0,false)}" -match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); +var dup70 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); -var dup71 = // "Pattern{Field(protocol,false), Constant(','), Field(p0,false)}" -match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); +var dup71 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); -var dup72 = // "Pattern{Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); +var dup72 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); -var dup73 = // "Pattern{Constant('. '), Field(p0,false)}" -match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); +var dup73 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); -var dup74 = // "Pattern{Field(fld2,false), Constant(': SYN '), Field(p0,false)}" -match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); +var dup74 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); -var dup75 = // "Pattern{Constant('SYN '), Field(p0,false)}" -match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); +var dup75 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); -var dup76 = // "Pattern{Constant('timeout value '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); +var dup76 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); -var dup77 = // "Pattern{Constant('destination '), Field(p0,false)}" -match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); +var dup77 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); -var dup78 = // "Pattern{Constant('source '), Field(p0,false)}" -match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); +var dup78 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); -var dup79 = // "Pattern{Constant('A '), Field(p0,false)}" -match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); +var dup79 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); -var dup80 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var dup80 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var dup81 = // "Pattern{Constant(', int '), Field(p0,false)}" -match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); +var dup81 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); -var dup82 = // "Pattern{Constant('int '), Field(p0,false)}" -match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); +var dup82 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); -var dup83 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); +var dup83 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); var dup84 = setc("eventcategory","1002020000"); @@ -284,176 +235,123 @@ var dup85 = setc("eventcategory","1002000000"); var dup86 = setc("eventcategory","1603110000"); -var dup87 = // "Pattern{Constant('HA '), Field(p0,false)}" -match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); +var dup87 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); -var dup88 = // "Pattern{Constant('encryption '), Field(p0,false)}" -match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); +var dup88 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); -var dup89 = // "Pattern{Constant('authentication '), Field(p0,false)}" -match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); +var dup89 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); -var dup90 = // "Pattern{Constant('key '), Field(p0,false)}" -match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); +var dup90 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); var dup91 = setc("eventcategory","1613040200"); -var dup92 = // "Pattern{Constant('disabled'), Field(,false)}" -match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); +var dup92 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); -var dup93 = // "Pattern{Constant('set to '), Field(trigger_val,false)}" -match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); +var dup93 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); -var dup94 = // "Pattern{Constant('up'), Field(,false)}" -match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); +var dup94 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); -var dup95 = // "Pattern{Constant('down'), Field(,false)}" -match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); +var dup95 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); -var dup96 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); +var dup96 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); var dup97 = setc("eventcategory","1613050200"); -var dup98 = // "Pattern{Constant('set'), Field(,false)}" -match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); +var dup98 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); -var dup99 = // "Pattern{Constant('unset'), Field(,false)}" -match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); +var dup99 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); -var dup100 = // "Pattern{Constant('undefined '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); +var dup100 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); -var dup101 = // "Pattern{Constant('set '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); +var dup101 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); -var dup102 = // "Pattern{Constant('active '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); +var dup102 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); -var dup103 = // "Pattern{Constant('to '), Field(p0,false)}" -match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); +var dup103 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); -var dup104 = // "Pattern{Constant('created '), Field(p0,false)}" -match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); +var dup104 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); -var dup105 = // "Pattern{Constant(', '), Field(p0,false)}" -match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); +var dup105 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); -var dup106 = // "Pattern{Constant('is '), Field(p0,false)}" -match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); +var dup106 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); -var dup107 = // "Pattern{Constant('was '), Field(p0,false)}" -match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); +var dup107 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); -var dup108 = // "Pattern{Constant(''), Field(fld2,false)}" -match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); +var dup108 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); -var dup109 = // "Pattern{Constant('threshold '), Field(p0,false)}" -match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); +var dup109 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); -var dup110 = // "Pattern{Constant('interval '), Field(p0,false)}" -match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); +var dup110 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); -var dup111 = // "Pattern{Constant('of '), Field(p0,false)}" -match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); +var dup111 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); -var dup112 = // "Pattern{Constant('that '), Field(p0,false)}" -match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); +var dup112 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); -var dup113 = // "Pattern{Constant('Zone '), Field(p0,false)}" -match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); +var dup113 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); -var dup114 = // "Pattern{Constant('Interface '), Field(p0,false)}" -match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); +var dup114 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); -var dup115 = // "Pattern{Constant('n '), Field(p0,false)}" -match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); +var dup115 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); -var dup116 = // "Pattern{Constant('.'), Field(,false)}" -match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); +var dup116 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); var dup117 = setc("eventcategory","1603090000"); -var dup118 = // "Pattern{Constant('for '), Field(p0,false)}" -match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); +var dup118 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); -var dup119 = // "Pattern{Constant('the '), Field(p0,false)}" -match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); +var dup119 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); -var dup120 = // "Pattern{Constant('removed '), Field(p0,false)}" -match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); +var dup120 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); var dup121 = setc("eventcategory","1603030000"); -var dup122 = // "Pattern{Constant('interface '), Field(p0,false)}" -match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); +var dup122 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); -var dup123 = // "Pattern{Constant('the interface '), Field(p0,false)}" -match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); +var dup123 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); -var dup124 = // "Pattern{Field(interface,false)}" -match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); +var dup124 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); -var dup125 = // "Pattern{Constant('s '), Field(p0,false)}" -match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); +var dup125 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); -var dup126 = // "Pattern{Constant('on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); +var dup126 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); -var dup127 = // "Pattern{Constant('has been '), Field(p0,false)}" -match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); +var dup127 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); -var dup128 = // "Pattern{Constant(''), Field(disposition,false), Constant('.')}" -match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); +var dup128 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); -var dup129 = // "Pattern{Constant('removed from '), Field(p0,false)}" -match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); +var dup129 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); -var dup130 = // "Pattern{Constant('added to '), Field(p0,false)}" -match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); +var dup130 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); -var dup131 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); +var dup131 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); -var dup132 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); +var dup132 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); -var dup133 = // "Pattern{Constant('Interface '), Field(p0,false)}" -match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); +var dup133 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); -var dup134 = // "Pattern{Constant('set to '), Field(fld2,false)}" -match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); +var dup134 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); -var dup135 = // "Pattern{Constant('gateway '), Field(p0,false)}" -match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); +var dup135 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); -var dup136 = // "Pattern{Field(,true), Constant(' '), Field(disposition,false)}" -match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); +var dup136 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); -var dup137 = // "Pattern{Constant('port number '), Field(p0,false)}" -match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); +var dup137 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); -var dup138 = // "Pattern{Constant('has been '), Field(disposition,false)}" -match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); +var dup138 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); -var dup139 = // "Pattern{Constant('IP '), Field(p0,false)}" -match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); +var dup139 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); -var dup140 = // "Pattern{Constant('port '), Field(p0,false)}" -match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); +var dup140 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); var dup141 = setc("eventcategory","1702030000"); -var dup142 = // "Pattern{Constant('up '), Field(p0,false)}" -match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); +var dup142 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); -var dup143 = // "Pattern{Constant('down '), Field(p0,false)}" -match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); +var dup143 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); var dup144 = setc("eventcategory","1601000000"); -var dup145 = // "Pattern{Constant('('), Field(fld1,false), Constant(') ')}" -match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); +var dup145 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); var dup146 = date_time({ dest: "event_time", @@ -473,360 +371,251 @@ var dup150 = setc("ec_theme","TEV"); var dup151 = setc("eventcategory","1103010000"); -var dup152 = // "Pattern{Constant(': '), Field(p0,false)}" -match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); +var dup152 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); -var dup153 = // "Pattern{Constant('IP '), Field(p0,false)}" -match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); +var dup153 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); -var dup154 = // "Pattern{Constant('address pool '), Field(p0,false)}" -match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); +var dup154 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); -var dup155 = // "Pattern{Constant('pool '), Field(p0,false)}" -match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); +var dup155 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); -var dup156 = // "Pattern{Constant('enabled '), Field(p0,false)}" -match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); +var dup156 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); -var dup157 = // "Pattern{Constant('disabled '), Field(p0,false)}" -match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); +var dup157 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); -var dup158 = // "Pattern{Constant('AH '), Field(p0,false)}" -match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); +var dup158 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); -var dup159 = // "Pattern{Constant('ESP '), Field(p0,false)}" -match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); +var dup159 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); -var dup160 = // "Pattern{Constant('’'), Field(p0,false)}" -match("MESSAGE#347:00018:02/1_0", "nwparser.p0", "’%{p0}"); +var dup160 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); -var dup161 = // "Pattern{Constant('&'), Field(p0,false)}" -match("MESSAGE#347:00018:02/1_1", "nwparser.p0", "\u0026%{p0}"); +var dup161 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); -var dup162 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); +var dup162 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); -var dup163 = // "Pattern{Constant('Source'), Field(p0,false)}" -match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); +var dup163 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); -var dup164 = // "Pattern{Constant('Destination'), Field(p0,false)}" -match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); +var dup164 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); -var dup165 = // "Pattern{Constant('from '), Field(p0,false)}" -match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); +var dup165 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); -var dup166 = // "Pattern{Constant('policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); +var dup166 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); -var dup167 = // "Pattern{Constant('Attempt to enable '), Field(p0,false)}" -match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); +var dup167 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); -var dup168 = // "Pattern{Constant('traffic logging via syslog '), Field(p0,false)}" -match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); +var dup168 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); -var dup169 = // "Pattern{Constant('syslog '), Field(p0,false)}" -match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); +var dup169 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); -var dup170 = // "Pattern{Constant('Syslog '), Field(p0,false)}" -match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); +var dup170 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); -var dup171 = // "Pattern{Constant('host '), Field(p0,false)}" -match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); +var dup171 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); -var dup172 = // "Pattern{Constant('domain name '), Field(p0,false)}" -match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); +var dup172 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); -var dup173 = // "Pattern{Constant('has been changed to '), Field(fld2,false)}" -match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); +var dup173 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); -var dup174 = // "Pattern{Constant('security facility '), Field(p0,false)}" -match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); +var dup174 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); -var dup175 = // "Pattern{Constant('facility '), Field(p0,false)}" -match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); +var dup175 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); -var dup176 = // "Pattern{Constant('local0'), Field(,false)}" -match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); +var dup176 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); -var dup177 = // "Pattern{Constant('local1'), Field(,false)}" -match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); +var dup177 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); -var dup178 = // "Pattern{Constant('local2'), Field(,false)}" -match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); +var dup178 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); -var dup179 = // "Pattern{Constant('local3'), Field(,false)}" -match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); +var dup179 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); -var dup180 = // "Pattern{Constant('local4'), Field(,false)}" -match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); +var dup180 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); -var dup181 = // "Pattern{Constant('local5'), Field(,false)}" -match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); +var dup181 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); -var dup182 = // "Pattern{Constant('local6'), Field(,false)}" -match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); +var dup182 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); -var dup183 = // "Pattern{Constant('local7'), Field(,false)}" -match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); +var dup183 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); -var dup184 = // "Pattern{Constant('auth/sec'), Field(,false)}" -match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); +var dup184 = setc("eventcategory","1603020000"); -var dup185 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); +var dup185 = setc("eventcategory","1803000000"); -var dup186 = setc("eventcategory","1603020000"); +var dup186 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); -var dup187 = setc("eventcategory","1803000000"); +var dup187 = setc("eventcategory","1603010000"); -var dup188 = // "Pattern{Constant('All '), Field(p0,false)}" -match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); +var dup188 = setc("eventcategory","1603100000"); -var dup189 = setc("eventcategory","1603010000"); +var dup189 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); -var dup190 = setc("eventcategory","1603100000"); +var dup190 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); -var dup191 = // "Pattern{Constant('primary '), Field(p0,false)}" -match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); +var dup191 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); -var dup192 = // "Pattern{Constant('secondary '), Field(p0,false)}" -match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); +var dup192 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); -var dup193 = // "Pattern{Constant('t '), Field(p0,false)}" -match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); +var dup193 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); -var dup194 = // "Pattern{Constant('w '), Field(p0,false)}" -match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); +var dup194 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); -var dup195 = // "Pattern{Constant('server '), Field(p0,false)}" -match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); +var dup195 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); -var dup196 = // "Pattern{Constant('has '), Field(p0,false)}" -match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); +var dup196 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); -var dup197 = // "Pattern{Constant('SCS'), Field(p0,false)}" -match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); +var dup197 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); -var dup198 = // "Pattern{Constant('bound to '), Field(p0,false)}" -match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); +var dup198 = setc("eventcategory","1801030000"); -var dup199 = // "Pattern{Constant('unbound from '), Field(p0,false)}" -match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); +var dup199 = setc("eventcategory","1302010200"); -var dup200 = setc("eventcategory","1801030000"); +var dup200 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); -var dup201 = setc("eventcategory","1302010200"); +var dup201 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); -var dup202 = // "Pattern{Constant('PKA RSA '), Field(p0,false)}" -match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); +var dup202 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); -var dup203 = // "Pattern{Constant('unbind '), Field(p0,false)}" -match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); +var dup203 = setc("eventcategory","1304000000"); -var dup204 = // "Pattern{Constant('PKA key '), Field(p0,false)}" -match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); +var dup204 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); -var dup205 = setc("eventcategory","1304000000"); +var dup205 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); -var dup206 = // "Pattern{Constant('Multiple login failures '), Field(p0,false)}" -match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); +var dup206 = setc("eventcategory","1401030000"); -var dup207 = // "Pattern{Constant('occurred for '), Field(p0,false)}" -match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); +var dup207 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); -var dup208 = setc("eventcategory","1401030000"); +var dup208 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); -var dup209 = // "Pattern{Constant('aborted'), Field(,false)}" -match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); +var dup209 = setc("eventcategory","1605020000"); -var dup210 = // "Pattern{Constant('performed'), Field(,false)}" -match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); +var dup210 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); -var dup211 = setc("eventcategory","1605020000"); +var dup211 = setc("ec_subject","Certificate"); -var dup212 = // "Pattern{Constant('IP pool of DHCP server on '), Field(p0,false)}" -match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); +var dup212 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); -var dup213 = setc("ec_subject","Certificate"); +var dup213 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); -var dup214 = // "Pattern{Constant('certificate '), Field(p0,false)}" -match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); +var dup214 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); -var dup215 = // "Pattern{Constant('CRL '), Field(p0,false)}" -match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); +var dup215 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); -var dup216 = // "Pattern{Constant('auto '), Field(p0,false)}" -match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); +var dup216 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); -var dup217 = // "Pattern{Constant('RSA '), Field(p0,false)}" -match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); +var dup217 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); -var dup218 = // "Pattern{Constant('DSA '), Field(p0,false)}" -match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); +var dup218 = setc("ec_subject","CryptoKey"); -var dup219 = // "Pattern{Constant('key pair.'), Field(,false)}" -match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); +var dup219 = setc("ec_subject","Configuration"); -var dup220 = setc("ec_subject","CryptoKey"); +var dup220 = setc("ec_activity","Request"); -var dup221 = setc("ec_subject","Configuration"); +var dup221 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); -var dup222 = setc("ec_activity","Request"); +var dup222 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); -var dup223 = // "Pattern{Constant('FIPS test for '), Field(p0,false)}" -match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); +var dup223 = setc("eventcategory","1612000000"); -var dup224 = // "Pattern{Constant('ECDSA '), Field(p0,false)}" -match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); +var dup224 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); -var dup225 = setc("eventcategory","1612000000"); +var dup225 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); -var dup226 = // "Pattern{Constant('yes '), Field(p0,false)}" -match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); +var dup226 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); -var dup227 = // "Pattern{Constant('no '), Field(p0,false)}" -match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); +var dup227 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); -var dup228 = // "Pattern{Constant('location '), Field(p0,false)}" -match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); +var dup228 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); -var dup229 = // "Pattern{Field(,true), Constant(' '), Field(interface,false)}" -match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); +var dup229 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); -var dup230 = // "Pattern{Constant('arp re'), Field(p0,false)}" -match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); +var dup230 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); -var dup231 = // "Pattern{Constant('q '), Field(p0,false)}" -match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); +var dup231 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); -var dup232 = // "Pattern{Constant('ply '), Field(p0,false)}" -match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); +var dup232 = setc("eventcategory","1201000000"); -var dup233 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); +var dup233 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); -var dup234 = setc("eventcategory","1201000000"); +var dup234 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); -var dup235 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" -match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); +var dup235 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); -var dup236 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); +var dup236 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); -var dup237 = // "Pattern{Constant('NACN Policy Manager '), Field(p0,false)}" -match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); +var dup237 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); -var dup238 = // "Pattern{Constant('1 '), Field(p0,false)}" -match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); +var dup238 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); -var dup239 = // "Pattern{Constant('2 '), Field(p0,false)}" -match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); +var dup239 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var dup240 = // "Pattern{Constant('unset '), Field(p0,false)}" -match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); +var dup240 = setc("eventcategory","1401000000"); -var dup241 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var dup241 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); -var dup242 = setc("eventcategory","1401000000"); +var dup242 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); -var dup243 = // "Pattern{Constant('SSH '), Field(p0,false)}" -match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); +var dup243 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); -var dup244 = // "Pattern{Constant('SCS: NetScreen '), Field(p0,false)}" -match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); +var dup244 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); -var dup245 = // "Pattern{Constant('NetScreen '), Field(p0,false)}" -match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); +var dup245 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); -var dup246 = // "Pattern{Constant('S'), Field(p0,false)}" -match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); +var dup246 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); -var dup247 = // "Pattern{Constant('CS: SSH'), Field(p0,false)}" -match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); +var dup247 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); -var dup248 = // "Pattern{Constant('SH'), Field(p0,false)}" -match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); +var dup248 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); -var dup249 = // "Pattern{Constant('the root system '), Field(p0,false)}" -match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); +var dup249 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); -var dup250 = // "Pattern{Constant('vsys '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); +var dup250 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); -var dup251 = // "Pattern{Constant('CS: SSH '), Field(p0,false)}" -match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); +var dup251 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); -var dup252 = // "Pattern{Constant('SH '), Field(p0,false)}" -match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); +var dup252 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); -var dup253 = // "Pattern{Constant('a '), Field(p0,false)}" -match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); +var dup253 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); -var dup254 = // "Pattern{Constant('ert '), Field(p0,false)}" -match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); +var dup254 = setc("eventcategory","1608000000"); -var dup255 = // "Pattern{Constant('SSL '), Field(p0,false)}" -match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); +var dup255 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); -var dup256 = setc("eventcategory","1608000000"); +var dup256 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); -var dup257 = // "Pattern{Constant('id: '), Field(p0,false)}" -match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); +var dup257 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); -var dup258 = // "Pattern{Constant('ID '), Field(p0,false)}" -match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); +var dup258 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); -var dup259 = // "Pattern{Constant('permit '), Field(p0,false)}" -match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); +var dup259 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); -var dup260 = // "Pattern{Constant('IGMP '), Field(p0,false)}" -match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); +var dup260 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); -var dup261 = // "Pattern{Constant('IGMP will '), Field(p0,false)}" -match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); +var dup261 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); -var dup262 = // "Pattern{Constant('not do '), Field(p0,false)}" -match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); +var dup262 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); -var dup263 = // "Pattern{Constant('do '), Field(p0,false)}" -match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); +var dup263 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); -var dup264 = // "Pattern{Constant('shut down '), Field(p0,false)}" -match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); +var dup264 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); -var dup265 = // "Pattern{Constant('NSRP: '), Field(p0,false)}" -match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); +var dup265 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); -var dup266 = // "Pattern{Constant('Unit '), Field(p0,false)}" -match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); +var dup266 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); -var dup267 = // "Pattern{Constant('local unit= '), Field(p0,false)}" -match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); +var dup267 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); -var dup268 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); +var dup268 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); -var dup269 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Sec'), Field(p0,false)}" -match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); +var dup269 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); -var dup270 = // "Pattern{Constant('ruity'), Field(p0,false)}" -match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); +var dup270 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); -var dup271 = // "Pattern{Constant('urity'), Field(p0,false)}" -match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); +var dup271 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); -var dup272 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state')}" -match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); +var dup272 = setc("eventcategory","1805010000"); -var dup273 = // "Pattern{Constant(''), Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); +var dup273 = setc("eventcategory","1805000000"); -var dup274 = setc("eventcategory","1805010000"); - -var dup275 = setc("eventcategory","1805000000"); - -var dup276 = date_time({ +var dup274 = date_time({ dest: "starttime", args: ["fld2"], fmts: [ @@ -834,7 +623,7 @@ var dup276 = date_time({ ], }); -var dup277 = call({ +var dup275 = call({ dest: "nwparser.bytes", fn: CALC, args: [ @@ -844,13 +633,13 @@ var dup277 = call({ ], }); -var dup278 = setc("action","Deny"); +var dup276 = setc("action","Deny"); -var dup279 = setc("disposition","Deny"); +var dup277 = setc("disposition","Deny"); -var dup280 = setc("direction","outgoing"); +var dup278 = setc("direction","outgoing"); -var dup281 = call({ +var dup279 = call({ dest: "nwparser.inout", fn: DIRCHK, args: [ @@ -862,36 +651,29 @@ var dup281 = call({ ], }); -var dup282 = setc("direction","incoming"); +var dup280 = setc("direction","incoming"); -var dup283 = setc("eventcategory","1801000000"); +var dup281 = setc("eventcategory","1801000000"); -var dup284 = setf("action","disposition"); +var dup282 = setf("action","disposition"); -var dup285 = // "Pattern{Constant('start_time='), Field(p0,false)}" -match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); +var dup283 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); -var dup286 = // "Pattern{Constant('\"'), Field(fld2,false), Constant('\"'), Field(p0,false)}" -match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); +var dup284 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); -var dup287 = // "Pattern{Constant(' "'), Field(fld2,false), Constant('" '), Field(p0,false)}" -match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); +var dup285 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); -var dup288 = // "Pattern{Field(daddr,false)}" -match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); +var dup286 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); -var dup289 = // "Pattern{Constant('Admin '), Field(p0,false)}" -match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); +var dup287 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); -var dup290 = // "Pattern{Constant('Vsys admin '), Field(p0,false)}" -match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); +var dup288 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); -var dup291 = // "Pattern{Constant('Telnet '), Field(p0,false)}" -match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); +var dup289 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); -var dup292 = setc("eventcategory","1401050200"); +var dup290 = setc("eventcategory","1401050200"); -var dup293 = call({ +var dup291 = call({ dest: "nwparser.inout", fn: DIRCHK, args: [ @@ -901,7 +683,7 @@ var dup293 = call({ ], }); -var dup294 = call({ +var dup292 = call({ dest: "nwparser.inout", fn: DIRCHK, args: [ @@ -913,117 +695,85 @@ var dup294 = call({ ], }); -var dup295 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); +var dup293 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); -var dup296 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); +var dup294 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); -var dup297 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.'), Field(p0,false)}" -match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); +var dup295 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); -var dup298 = // "Pattern{Field(obj_type,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var dup296 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var dup299 = setc("eventcategory","1204000000"); +var dup297 = setc("eventcategory","1204000000"); -var dup300 = // "Pattern{Field(signame,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var dup298 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var dup301 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" -match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); +var dup299 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); -var dup302 = // "Pattern{Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); +var dup300 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); -var dup303 = setc("eventcategory","1801020000"); +var dup301 = setc("eventcategory","1801020000"); -var dup304 = setc("disposition","failed"); +var dup302 = setc("disposition","failed"); -var dup305 = // "Pattern{Constant('ut '), Field(p0,false)}" -match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); +var dup303 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); -var dup306 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); +var dup304 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); -var dup307 = // "Pattern{Constant('user '), Field(p0,false)}" -match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); +var dup305 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); -var dup308 = // "Pattern{Constant('the '), Field(logon_type,false)}" -match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); +var dup306 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); -var dup309 = // "Pattern{Constant('WebAuth user '), Field(p0,false)}" -match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); +var dup307 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); -var dup310 = // "Pattern{Constant('backup1 '), Field(p0,false)}" -match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); +var dup308 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); -var dup311 = // "Pattern{Constant('backup2 '), Field(p0,false)}" -match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); +var dup309 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); -var dup312 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); +var dup310 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); -var dup313 = // "Pattern{Constant('assigned '), Field(p0,false)}" -match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); +var dup311 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); -var dup314 = // "Pattern{Constant('assigned to '), Field(p0,false)}" -match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); +var dup312 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); -var dup315 = setc("eventcategory","1803020000"); +var dup313 = setc("eventcategory","1803020000"); -var dup316 = setc("eventcategory","1613030000"); +var dup314 = setc("eventcategory","1613030000"); -var dup317 = // "Pattern{Constant('''), Field(administrator,false), Constant('' '), Field(p0,false)}" -match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); +var dup315 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); -var dup318 = // "Pattern{Constant('SSH: P'), Field(p0,false)}" -match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); +var dup316 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); -var dup319 = // "Pattern{Constant('KA '), Field(p0,false)}" -match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); +var dup317 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); -var dup320 = // "Pattern{Constant('assword '), Field(p0,false)}" -match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); +var dup318 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); -var dup321 = // "Pattern{Constant('\''), Field(administrator,false), Constant('\' '), Field(p0,false)}" -match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); +var dup319 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); -var dup322 = // "Pattern{Constant('at host '), Field(saddr,false)}" -match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); +var dup320 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); -var dup323 = // "Pattern{Field(,false), Constant('S'), Field(p0,false)}" -match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); +var dup321 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); -var dup324 = // "Pattern{Constant('CS '), Field(p0,false)}" -match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); +var dup322 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); -var dup325 = setc("event_description","Cannot connect to NSM server"); +var dup323 = setc("event_description","Cannot connect to NSM server"); -var dup326 = setc("eventcategory","1603040000"); +var dup324 = setc("eventcategory","1603040000"); -var dup327 = // "Pattern{Constant('from server.ini file.'), Field(,false)}" -match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); +var dup325 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); -var dup328 = // "Pattern{Constant('pattern '), Field(p0,false)}" -match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); +var dup326 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); -var dup329 = // "Pattern{Constant('server.ini '), Field(p0,false)}" -match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); +var dup327 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); -var dup330 = // "Pattern{Constant('file.'), Field(,false)}" -match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); +var dup328 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); -var dup331 = // "Pattern{Constant('AV pattern '), Field(p0,false)}" -match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); +var dup329 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); -var dup332 = // "Pattern{Constant('added into '), Field(p0,false)}" -match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); +var dup330 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); -var dup333 = // "Pattern{Constant('loader '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); +var dup331 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); -var dup334 = call({ +var dup332 = call({ dest: "nwparser.inout", fn: DIRCHK, args: [ @@ -1035,13 +785,12 @@ var dup334 = call({ ], }); -var dup335 = linear_select([ +var dup333 = linear_select([ dup10, dup11, ]); -var dup336 = // "Pattern{Constant('Policy ID='), Field(policy_id,true), Constant(' Rate='), Field(fld2,true), Constant(' exceeds threshold')}" -match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ +var dup334 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ dup1, dup2, dup3, @@ -1049,38 +798,37 @@ match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=% dup5, ])); -var dup337 = linear_select([ +var dup335 = linear_select([ dup13, dup14, ]); -var dup338 = linear_select([ +var dup336 = linear_select([ dup15, dup16, ]); -var dup339 = linear_select([ +var dup337 = linear_select([ dup56, dup57, ]); -var dup340 = linear_select([ +var dup338 = linear_select([ dup65, dup66, ]); -var dup341 = linear_select([ +var dup339 = linear_select([ dup68, dup69, ]); -var dup342 = linear_select([ +var dup340 = linear_select([ dup71, dup72, ]); -var dup343 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(interface,false), Constant(')')}" -match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ +var dup341 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ dup58, dup2, dup3, @@ -1089,138 +837,135 @@ match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{s dup61, ])); -var dup344 = linear_select([ +var dup342 = linear_select([ dup74, dup75, ]); -var dup345 = linear_select([ +var dup343 = linear_select([ dup81, dup82, ]); -var dup346 = linear_select([ +var dup344 = linear_select([ dup24, dup90, ]); -var dup347 = linear_select([ +var dup345 = linear_select([ dup94, dup95, ]); -var dup348 = linear_select([ +var dup346 = linear_select([ dup98, dup99, ]); -var dup349 = linear_select([ +var dup347 = linear_select([ dup100, dup101, dup102, ]); -var dup350 = linear_select([ +var dup348 = linear_select([ dup113, dup114, ]); -var dup351 = linear_select([ +var dup349 = linear_select([ dup111, dup16, ]); -var dup352 = linear_select([ +var dup350 = linear_select([ dup127, dup107, ]); -var dup353 = linear_select([ +var dup351 = linear_select([ dup8, dup21, ]); -var dup354 = linear_select([ +var dup352 = linear_select([ dup122, dup133, ]); -var dup355 = linear_select([ +var dup353 = linear_select([ dup142, dup143, ]); -var dup356 = linear_select([ +var dup354 = linear_select([ dup145, dup21, ]); -var dup357 = linear_select([ +var dup355 = linear_select([ dup127, dup106, ]); -var dup358 = linear_select([ +var dup356 = linear_select([ dup152, dup96, ]); -var dup359 = linear_select([ +var dup357 = linear_select([ dup154, dup155, ]); -var dup360 = linear_select([ +var dup358 = linear_select([ dup156, dup157, ]); -var dup361 = linear_select([ +var dup359 = linear_select([ dup99, dup134, ]); -var dup362 = linear_select([ +var dup360 = linear_select([ dup158, dup159, ]); -var dup363 = linear_select([ - dup160, +var dup361 = linear_select([ dup161, + dup162, ]); -var dup364 = linear_select([ +var dup362 = linear_select([ dup163, - dup164, -]); - -var dup365 = linear_select([ - dup165, dup103, ]); -var dup366 = linear_select([ - dup164, - dup163, +var dup363 = linear_select([ + dup162, + dup161, ]); -var dup367 = linear_select([ +var dup364 = linear_select([ dup46, dup47, ]); -var dup368 = linear_select([ - dup168, - dup169, +var dup365 = linear_select([ + dup166, + dup167, ]); -var dup369 = linear_select([ - dup174, - dup175, +var dup366 = linear_select([ + dup172, + dup173, ]); -var dup370 = linear_select([ +var dup367 = linear_select([ + dup174, + dup175, dup176, dup177, dup178, @@ -1228,47 +973,44 @@ var dup370 = linear_select([ dup180, dup181, dup182, - dup183, - dup184, ]); -var dup371 = linear_select([ +var dup368 = linear_select([ dup49, dup21, ]); -var dup372 = linear_select([ - dup191, - dup192, +var dup369 = linear_select([ + dup189, + dup190, ]); -var dup373 = linear_select([ +var dup370 = linear_select([ dup96, dup152, ]); -var dup374 = linear_select([ - dup198, - dup199, +var dup371 = linear_select([ + dup196, + dup197, ]); -var dup375 = linear_select([ +var dup372 = linear_select([ dup24, - dup202, + dup200, ]); -var dup376 = linear_select([ +var dup373 = linear_select([ dup103, - dup165, + dup163, ]); -var dup377 = linear_select([ - dup207, +var dup374 = linear_select([ + dup205, dup118, ]); -var dup378 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var dup375 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -1276,88 +1018,87 @@ match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var dup379 = linear_select([ - dup214, +var dup376 = linear_select([ + dup212, + dup213, +]); + +var dup377 = linear_select([ dup215, + dup216, ]); -var dup380 = linear_select([ - dup217, - dup218, +var dup378 = linear_select([ + dup222, + dup215, ]); -var dup381 = linear_select([ +var dup379 = linear_select([ dup224, - dup217, + dup225, ]); -var dup382 = linear_select([ - dup226, - dup227, +var dup380 = linear_select([ + dup231, + dup124, ]); -var dup383 = linear_select([ - dup233, - dup124, +var dup381 = linear_select([ + dup229, + dup230, ]); -var dup384 = linear_select([ - dup231, - dup232, +var dup382 = linear_select([ + dup233, + dup234, ]); -var dup385 = linear_select([ - dup235, +var dup383 = linear_select([ dup236, + dup237, ]); -var dup386 = linear_select([ - dup238, - dup239, +var dup384 = linear_select([ + dup242, + dup243, ]); -var dup387 = linear_select([ - dup244, +var dup385 = linear_select([ dup245, + dup246, ]); -var dup388 = linear_select([ +var dup386 = linear_select([ dup247, dup248, ]); -var dup389 = linear_select([ +var dup387 = linear_select([ dup249, dup250, ]); -var dup390 = linear_select([ +var dup388 = linear_select([ dup251, dup252, ]); -var dup391 = linear_select([ - dup253, - dup254, -]); - -var dup392 = linear_select([ - dup262, - dup263, +var dup389 = linear_select([ + dup260, + dup261, ]); -var dup393 = linear_select([ - dup266, - dup267, +var dup390 = linear_select([ + dup264, + dup265, ]); -var dup394 = linear_select([ - dup270, - dup271, +var dup391 = linear_select([ + dup268, + dup269, ]); -var dup395 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ +var dup392 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ dup1, dup2, dup3, @@ -1365,18 +1106,17 @@ match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in th dup5, ])); -var dup396 = linear_select([ - dup286, - dup287, +var dup393 = linear_select([ + dup284, + dup285, ]); -var dup397 = linear_select([ - dup289, - dup290, +var dup394 = linear_select([ + dup287, + dup288, ]); -var dup398 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var dup395 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup59, @@ -1386,8 +1126,7 @@ match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to dup60, ])); -var dup399 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to zone '), Field(zone,false), Constant(', proto '), Field(protocol,true), Constant(' (int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var dup396 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup4, dup59, @@ -1398,116 +1137,112 @@ match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to dup60, ])); -var dup400 = linear_select([ - dup302, +var dup397 = linear_select([ + dup300, dup26, ]); -var dup401 = linear_select([ +var dup398 = linear_select([ dup115, - dup305, + dup303, ]); -var dup402 = linear_select([ +var dup399 = linear_select([ dup125, dup96, ]); -var dup403 = linear_select([ - dup191, - dup310, - dup311, +var dup400 = linear_select([ + dup189, + dup308, + dup309, ]); -var dup404 = linear_select([ - dup312, +var dup401 = linear_select([ + dup310, dup16, ]); -var dup405 = linear_select([ - dup319, - dup320, +var dup402 = linear_select([ + dup317, + dup318, ]); -var dup406 = linear_select([ - dup321, - dup317, +var dup403 = linear_select([ + dup319, + dup315, ]); -var dup407 = linear_select([ - dup324, - dup252, +var dup404 = linear_select([ + dup322, + dup250, ]); -var dup408 = linear_select([ +var dup405 = linear_select([ + dup327, dup329, - dup331, ]); -var dup409 = linear_select([ - dup332, +var dup406 = linear_select([ + dup330, dup129, ]); -var dup410 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup283, +var dup407 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup60, - dup284, + dup282, ])); -var dup411 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup187, +var dup408 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, + dup275, + dup276, dup277, - dup278, - dup279, dup60, ])); -var dup412 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup283, +var dup409 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup60, - dup284, + dup282, ])); -var dup413 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var dup410 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, + dup275, + dup276, dup277, - dup278, - dup279, dup61, ])); -var dup414 = all_match({ +var dup411 = all_match({ processors: [ - dup265, - dup393, - dup268, + dup263, + dup390, + dup266, ], on_success: processor_chain([ dup1, @@ -1518,11 +1253,11 @@ var dup414 = all_match({ ]), }); -var dup415 = all_match({ +var dup412 = all_match({ processors: [ - dup269, - dup394, - dup272, + dup267, + dup391, + dup270, ], on_success: processor_chain([ dup1, @@ -1533,11 +1268,11 @@ var dup415 = all_match({ ]), }); -var dup416 = all_match({ +var dup413 = all_match({ processors: [ dup80, - dup345, - dup295, + dup343, + dup293, ], on_success: processor_chain([ dup58, @@ -1550,14 +1285,14 @@ var dup416 = all_match({ ]), }); -var dup417 = all_match({ +var dup414 = all_match({ processors: [ - dup298, - dup345, + dup296, + dup343, dup131, ], on_success: processor_chain([ - dup299, + dup297, dup2, dup3, dup9, @@ -1568,14 +1303,14 @@ var dup417 = all_match({ ]), }); -var dup418 = all_match({ +var dup415 = all_match({ processors: [ - dup300, - dup345, + dup298, + dup343, dup131, ], on_success: processor_chain([ - dup299, + dup297, dup2, dup3, dup9, @@ -1586,32 +1321,25 @@ var dup418 = all_match({ ]), }); -var hdr1 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' [No Name]system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" -match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [No Name]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ setc("header_id","0001"), ])); -var hdr2 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' ['), Field(hvsys,false), Constant(']system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" -match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0003", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} [%{hvsys}]system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ setc("header_id","0003"), ])); -var hdr3 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' system-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant('('), Field(hfld3,false), Constant('): '), Field(payload,false)}" -match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ +var hdr3 = match("HEADER#2:0004", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} system-%{hseverity}-%{messageid}(%{hfld3}): %{payload}", processor_chain([ setc("header_id","0004"), ])); -var hdr4 = // "Pattern{Field(hfld1,false), Constant(': NetScreen device_id='), Field(hfld2,true), Constant(' '), Field(p0,false)}" -match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); +var hdr4 = match("HEADER#3:0002/0", "message", "%{hfld1}: NetScreen device_id=%{hfld2->} %{p0}"); -var part1 = // "Pattern{Constant('[No Name]system'), Field(p0,false)}" -match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); +var part1 = match("HEADER#3:0002/1_0", "nwparser.p0", "[No Name]system%{p0}"); -var part2 = // "Pattern{Constant('['), Field(hvsys,false), Constant(']system'), Field(p0,false)}" -match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); +var part2 = match("HEADER#3:0002/1_1", "nwparser.p0", "[%{hvsys}]system%{p0}"); -var part3 = // "Pattern{Constant('system'), Field(p0,false)}" -match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); +var part3 = match("HEADER#3:0002/1_2", "nwparser.p0", "system%{p0}"); var select1 = linear_select([ part1, @@ -1619,8 +1347,7 @@ var select1 = linear_select([ part3, ]); -var part4 = // "Pattern{Constant('-'), Field(hseverity,false), Constant('-'), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); +var part4 = match("HEADER#3:0002/2", "nwparser.p0", "-%{hseverity}-%{messageid}: %{payload}"); var all1 = all_match({ processors: [ @@ -1640,8 +1367,7 @@ var select2 = linear_select([ all1, ]); -var part5 = // "Pattern{Field(zone,true), Constant(' address '), Field(interface,true), Constant(' with ip address '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ +var part5 = match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} with ip address %{hostip->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1651,8 +1377,7 @@ match("MESSAGE#0:00001", "nwparser.payload", "%{zone->} address %{interface->} w var msg1 = msg("00001", part5); -var part6 = // "Pattern{Field(zone,true), Constant(' address '), Field(interface,true), Constant(' with domain name '), Field(domain,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ +var part6 = match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface->} with domain name %{domain->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1662,16 +1387,14 @@ match("MESSAGE#1:00001:01", "nwparser.payload", "%{zone->} address %{interface-> var msg2 = msg("00001:01", part6); -var part7 = // "Pattern{Constant('ip address '), Field(hostip,true), Constant(' in zone '), Field(p0,false)}" -match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); +var part7 = match("MESSAGE#2:00001:02/1_0", "nwparser.p0", "ip address %{hostip->} in zone %{p0}"); var select3 = linear_select([ part7, dup7, ]); -var part8 = // "Pattern{Field(zone,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); +var part8 = match("MESSAGE#2:00001:02/2", "nwparser.p0", "%{zone->} has been %{disposition}"); var all2 = all_match({ processors: [ @@ -1690,8 +1413,7 @@ var all2 = all_match({ var msg3 = msg("00001:02", all2); -var part9 = // "Pattern{Constant('arp entry '), Field(hostip,true), Constant(' interface changed!')}" -match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ +var part9 = match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface changed!", processor_chain([ dup1, dup2, dup3, @@ -1701,19 +1423,16 @@ match("MESSAGE#3:00001:03", "nwparser.payload", "arp entry %{hostip->} interface var msg4 = msg("00001:03", part9); -var part10 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' in zone '), Field(p0,false)}" -match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); +var part10 = match("MESSAGE#4:00001:04/1_0", "nwparser.p0", "IP address %{hostip->} in zone %{p0}"); var select4 = linear_select([ part10, dup7, ]); -var part11 = // "Pattern{Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' session'), Field(p0,false)}" -match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); +var part11 = match("MESSAGE#4:00001:04/2", "nwparser.p0", "%{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} session%{p0}"); -var part12 = // "Pattern{Constant('.'), Field(fld1,false)}" -match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); +var part12 = match("MESSAGE#4:00001:04/3_1", "nwparser.p0", ".%{fld1}"); var select5 = linear_select([ dup8, @@ -1739,13 +1458,12 @@ var all3 = all_match({ var msg5 = msg("00001:04", all3); -var part13 = // "Pattern{Field(fld2,false), Constant(': Address '), Field(group_object,true), Constant(' for ip address '), Field(hostip,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' session '), Field(p0,false)}" -match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); +var part13 = match("MESSAGE#5:00001:05/0", "nwparser.payload", "%{fld2}: Address %{group_object->} for ip address %{hostip->} in zone %{zone->} has been %{disposition->} from host %{saddr->} session %{p0}"); var all4 = all_match({ processors: [ part13, - dup335, + dup333, ], on_success: processor_chain([ dup1, @@ -1759,8 +1477,7 @@ var all4 = all_match({ var msg6 = msg("00001:05", all4); -var part14 = // "Pattern{Constant('Address group '), Field(group_object,true), Constant(' '), Field(info,false)}" -match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ +var part14 = match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} %{info}", processor_chain([ dup1, dup2, dup3, @@ -1770,20 +1487,18 @@ match("MESSAGE#6:00001:06", "nwparser.payload", "Address group %{group_object->} var msg7 = msg("00001:06", part14); -var msg8 = msg("00001:07", dup336); +var msg8 = msg("00001:07", dup334); -var part15 = // "Pattern{Constant('for IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); +var part15 = match("MESSAGE#8:00001:08/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{p0}"); -var part16 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('via NSRP Peer session. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); +var part16 = match("MESSAGE#8:00001:08/4", "nwparser.p0", "%{} %{username}via NSRP Peer session. (%{fld1})"); var all5 = all_match({ processors: [ dup12, - dup337, + dup335, part15, - dup338, + dup336, part16, ], on_success: processor_chain([ @@ -1798,13 +1513,12 @@ var all5 = all_match({ var msg9 = msg("00001:08", all5); -var part17 = // "Pattern{Constant('for IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' in zone '), Field(zone,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' session. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); +var part17 = match("MESSAGE#9:00001:09/2", "nwparser.p0", "for IP address %{hostip}/%{mask->} in zone %{zone->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} session. (%{fld1})"); var all6 = all_match({ processors: [ dup12, - dup337, + dup335, part17, ], on_success: processor_chain([ @@ -1832,8 +1546,7 @@ var select6 = linear_select([ msg10, ]); -var part18 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ +var part18 = match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1843,8 +1556,7 @@ match("MESSAGE#10:00002:03", "nwparser.payload", "Admin user %{administrator->} var msg11 = msg("00002:03", part18); -var part19 = // "Pattern{Constant('E-mail address '), Field(user_address,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ +var part19 = match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1854,8 +1566,7 @@ match("MESSAGE#11:00002:04", "nwparser.payload", "E-mail address %{user_address- var msg12 = msg("00002:04", part19); -var part20 = // "Pattern{Constant('E-mail notification has been '), Field(disposition,false)}" -match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ +var part20 = match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1865,8 +1576,7 @@ match("MESSAGE#12:00002:05", "nwparser.payload", "E-mail notification has been % var msg13 = msg("00002:05", part20); -var part21 = // "Pattern{Constant('Inclusion of traffic logs with e-mail notification of event alarms has been '), Field(disposition,false)}" -match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ +var part21 = match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with e-mail notification of event alarms has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1876,8 +1586,7 @@ match("MESSAGE#13:00002:06", "nwparser.payload", "Inclusion of traffic logs with var msg14 = msg("00002:06", part21); -var part22 = // "Pattern{Constant('LCD display has been '), Field(action,true), Constant(' and the LCD control keys have been '), Field(disposition,false)}" -match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ +var part22 = match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action->} and the LCD control keys have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1887,8 +1596,7 @@ match("MESSAGE#14:00002:07", "nwparser.payload", "LCD display has been %{action- var msg15 = msg("00002:07", part22); -var part23 = // "Pattern{Constant('HTTP component blocking for '), Field(fld2,true), Constant(' is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part23 = match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{fld2->} is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup1, dup2, dup4, @@ -1898,8 +1606,7 @@ match("MESSAGE#15:00002:55", "nwparser.payload", "HTTP component blocking for %{ var msg16 = msg("00002:55", part23); -var part24 = // "Pattern{Constant('LCD display has been '), Field(disposition,false)}" -match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ +var part24 = match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1909,8 +1616,7 @@ match("MESSAGE#16:00002:08", "nwparser.payload", "LCD display has been %{disposi var msg17 = msg("00002:08", part24); -var part25 = // "Pattern{Constant('LCD control keys have been '), Field(disposition,false)}" -match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ +var part25 = match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1920,8 +1626,7 @@ match("MESSAGE#17:00002:09", "nwparser.payload", "LCD control keys have been %{d var msg18 = msg("00002:09", part25); -var part26 = // "Pattern{Constant('Mail server '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ +var part26 = match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -1931,8 +1636,7 @@ match("MESSAGE#18:00002:10", "nwparser.payload", "Mail server %{hostip->} has be var msg19 = msg("00002:10", part26); -var part27 = // "Pattern{Constant('Management restriction for '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ +var part27 = match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ dup17, dup2, dup3, @@ -1942,8 +1646,7 @@ match("MESSAGE#19:00002:11", "nwparser.payload", "Management restriction for %{h var msg20 = msg("00002:11", part27); -var part28 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to default port '), Field(change_new,false)}" -match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ +var part28 = match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -1953,8 +1656,7 @@ match("MESSAGE#20:00002:12", "nwparser.payload", "%{change_attribute->} has been var msg21 = msg("00002:12", part28); -var part29 = // "Pattern{Constant('System configuration has been '), Field(disposition,false)}" -match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ +var part29 = match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been %{disposition}", processor_chain([ dup18, dup2, dup3, @@ -1964,24 +1666,20 @@ match("MESSAGE#21:00002:15", "nwparser.payload", "System configuration has been var msg22 = msg("00002:15", part29); -var msg23 = msg("00002:17", dup336); +var msg23 = msg("00002:17", dup334); -var part30 = // "Pattern{Constant('Unexpected error from e'), Field(p0,false)}" -match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); +var part30 = match("MESSAGE#23:00002:18/0", "nwparser.payload", "Unexpected error from e%{p0}"); -var part31 = // "Pattern{Constant('-mail '), Field(p0,false)}" -match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); +var part31 = match("MESSAGE#23:00002:18/1_0", "nwparser.p0", "-mail %{p0}"); -var part32 = // "Pattern{Constant('mail '), Field(p0,false)}" -match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); +var part32 = match("MESSAGE#23:00002:18/1_1", "nwparser.p0", "mail %{p0}"); var select7 = linear_select([ part31, part32, ]); -var part33 = // "Pattern{Constant('server('), Field(fld2,false), Constant('):')}" -match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); +var part33 = match("MESSAGE#23:00002:18/2", "nwparser.p0", "server(%{fld2}):"); var all7 = all_match({ processors: [ @@ -2000,8 +1698,7 @@ var all7 = all_match({ var msg24 = msg("00002:18", all7); -var part34 = // "Pattern{Constant('Web Admin '), Field(change_attribute,true), Constant(' value has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part34 = match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute->} value has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -2011,11 +1708,9 @@ match("MESSAGE#24:00002:19", "nwparser.payload", "Web Admin %{change_attribute-> var msg25 = msg("00002:19", part34); -var part35 = // "Pattern{Constant('Root admin password restriction of minimum '), Field(fld2,true), Constant(' characters has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); +var part35 = match("MESSAGE#25:00002:20/0", "nwparser.payload", "Root admin password restriction of minimum %{fld2->} characters has been %{disposition->} by admin %{administrator->} %{p0}"); -var part36 = // "Pattern{Constant('from Console '), Field(,false)}" -match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); +var part36 = match("MESSAGE#25:00002:20/1_0", "nwparser.p0", "from Console %{}"); var select8 = linear_select([ part36, @@ -2039,11 +1734,9 @@ var all8 = all_match({ var msg26 = msg("00002:20", all8); -var part37 = // "Pattern{Constant('Root admin '), Field(p0,false)}" -match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); +var part37 = match("MESSAGE#26:00002:21/0_0", "nwparser.payload", "Root admin %{p0}"); -var part38 = // "Pattern{Field(fld2,true), Constant(' admin '), Field(p0,false)}" -match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); +var part38 = match("MESSAGE#26:00002:21/0_1", "nwparser.payload", "%{fld2->} admin %{p0}"); var select9 = linear_select([ part37, @@ -2055,8 +1748,7 @@ var select10 = linear_select([ dup25, ]); -var part39 = // "Pattern{Constant('has been changed by admin '), Field(administrator,false)}" -match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); +var part39 = match("MESSAGE#26:00002:21/3", "nwparser.p0", "has been changed by admin %{administrator}"); var all9 = all_match({ processors: [ @@ -2076,14 +1768,11 @@ var all9 = all_match({ var msg27 = msg("00002:21", all9); -var part40 = // "Pattern{Field(change_attribute,true), Constant(' from '), Field(protocol,true), Constant(' before administrative session disconnects has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' by admin '), Field(p0,false)}" -match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); +var part40 = match("MESSAGE#27:00002:22/0", "nwparser.payload", "%{change_attribute->} from %{protocol->} before administrative session disconnects has been changed from %{change_old->} to %{change_new->} by admin %{p0}"); -var part41 = // "Pattern{Field(administrator,true), Constant(' from Console')}" -match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); +var part41 = match("MESSAGE#27:00002:22/1_0", "nwparser.p0", "%{administrator->} from Console"); -var part42 = // "Pattern{Field(administrator,true), Constant(' from host '), Field(saddr,false)}" -match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); +var part42 = match("MESSAGE#27:00002:22/1_1", "nwparser.p0", "%{administrator->} from host %{saddr}"); var select11 = linear_select([ part41, @@ -2107,11 +1796,9 @@ var all10 = all_match({ var msg28 = msg("00002:22", all10); -var part43 = // "Pattern{Constant('Root admin access restriction through console only has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); +var part43 = match("MESSAGE#28:00002:23/0", "nwparser.payload", "Root admin access restriction through console only has been %{disposition->} by admin %{administrator->} %{p0}"); -var part44 = // "Pattern{Constant('from Console'), Field(,false)}" -match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); +var part44 = match("MESSAGE#28:00002:23/1_1", "nwparser.p0", "from Console%{}"); var select12 = linear_select([ dup20, @@ -2135,14 +1822,11 @@ var all11 = all_match({ var msg29 = msg("00002:23", all11); -var part45 = // "Pattern{Constant('Admin access restriction of '), Field(protocol,true), Constant(' administration through tunnel only has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' from '), Field(p0,false)}" -match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); +var part45 = match("MESSAGE#29:00002:24/0", "nwparser.payload", "Admin access restriction of %{protocol->} administration through tunnel only has been %{disposition->} by admin %{administrator->} from %{p0}"); -var part46 = // "Pattern{Constant('host '), Field(saddr,false)}" -match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); +var part46 = match("MESSAGE#29:00002:24/1_0", "nwparser.p0", "host %{saddr}"); -var part47 = // "Pattern{Constant('Console'), Field(,false)}" -match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); +var part47 = match("MESSAGE#29:00002:24/1_1", "nwparser.p0", "Console%{}"); var select13 = linear_select([ part46, @@ -2165,8 +1849,7 @@ var all12 = all_match({ var msg30 = msg("00002:24", all12); -var part48 = // "Pattern{Constant('Admin AUTH: Local instance of an '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part48 = match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of an %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ setc("eventcategory","1402000000"), dup2, dup3, @@ -2176,8 +1859,7 @@ match("MESSAGE#30:00002:25", "nwparser.payload", "Admin AUTH: Local instance of var msg31 = msg("00002:25", part48); -var part49 = // "Pattern{Constant('Cannot connect to e-mail server '), Field(hostip,false), Constant('.')}" -match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ +var part49 = match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail server %{hostip}.", processor_chain([ dup27, dup2, dup3, @@ -2187,8 +1869,7 @@ match("MESSAGE#31:00002:26", "nwparser.payload", "Cannot connect to e-mail serve var msg32 = msg("00002:26", part49); -var part50 = // "Pattern{Constant('Mail server is not configured.'), Field(,false)}" -match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ +var part50 = match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured.%{}", processor_chain([ dup18, dup2, dup3, @@ -2198,8 +1879,7 @@ match("MESSAGE#32:00002:27", "nwparser.payload", "Mail server is not configured. var msg33 = msg("00002:27", part50); -var part51 = // "Pattern{Constant('Mail recipients were not configured.'), Field(,false)}" -match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ +var part51 = match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not configured.%{}", processor_chain([ dup18, dup2, dup3, @@ -2209,8 +1889,7 @@ match("MESSAGE#33:00002:28", "nwparser.payload", "Mail recipients were not confi var msg34 = msg("00002:28", part51); -var part52 = // "Pattern{Constant('Single use password restriction for read-write administrators has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false)}" -match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ +var part52 = match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restriction for read-write administrators has been %{disposition->} by admin %{administrator}", processor_chain([ dup1, dup2, dup3, @@ -2220,8 +1899,7 @@ match("MESSAGE#34:00002:29", "nwparser.payload", "Single use password restrictio var msg35 = msg("00002:29", part52); -var part53 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ +var part53 = match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ dup28, dup29, dup30, @@ -2235,8 +1913,7 @@ match("MESSAGE#35:00002:30", "nwparser.payload", "Admin user \"%{administrator}\ var msg36 = msg("00002:30", part53); -var part54 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged out for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ +var part54 = match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport}", processor_chain([ dup33, dup29, dup34, @@ -2248,8 +1925,7 @@ match("MESSAGE#36:00002:41", "nwparser.payload", "Admin user \"%{administrator}\ var msg37 = msg("00002:41", part54); -var part55 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,true), Constant(' '), Field(space,true), Constant(' ('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false)}" -match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ +var part55 = match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} %{space->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ dup35, dup29, dup30, @@ -2262,19 +1938,16 @@ match("MESSAGE#37:00002:31", "nwparser.payload", "Admin user \"%{administrator}\ var msg38 = msg("00002:31", part55); -var part56 = // "Pattern{Constant('E-mail notification '), Field(p0,false)}" -match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); +var part56 = match("MESSAGE#38:00002:32/0_0", "nwparser.payload", "E-mail notification %{p0}"); -var part57 = // "Pattern{Constant('Transparent virutal '), Field(p0,false)}" -match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); +var part57 = match("MESSAGE#38:00002:32/0_1", "nwparser.payload", "Transparent virutal %{p0}"); var select14 = linear_select([ part56, part57, ]); -var part58 = // "Pattern{Constant('wire mode has been '), Field(disposition,false)}" -match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); +var part58 = match("MESSAGE#38:00002:32/1", "nwparser.p0", "wire mode has been %{disposition}"); var all13 = all_match({ processors: [ @@ -2292,8 +1965,7 @@ var all13 = all_match({ var msg39 = msg("00002:32", all13); -var part59 = // "Pattern{Constant('Malicious URL '), Field(url,true), Constant(' has been '), Field(disposition,true), Constant(' for zone '), Field(zone,false)}" -match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ +var part59 = match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has been %{disposition->} for zone %{zone}", processor_chain([ dup1, dup2, dup3, @@ -2303,22 +1975,18 @@ match("MESSAGE#39:00002:35", "nwparser.payload", "Malicious URL %{url->} has bee var msg40 = msg("00002:35", part59); -var part60 = // "Pattern{Constant('Bypass'), Field(p0,false)}" -match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); +var part60 = match("MESSAGE#40:00002:36/0", "nwparser.payload", "Bypass%{p0}"); -var part61 = // "Pattern{Constant('-others-IPSec '), Field(p0,false)}" -match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); +var part61 = match("MESSAGE#40:00002:36/1_0", "nwparser.p0", "-others-IPSec %{p0}"); -var part62 = // "Pattern{Constant(' non-IP traffic '), Field(p0,false)}" -match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); +var part62 = match("MESSAGE#40:00002:36/1_1", "nwparser.p0", " non-IP traffic %{p0}"); var select15 = linear_select([ part61, part62, ]); -var part63 = // "Pattern{Constant('option has been '), Field(disposition,false)}" -match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); +var part63 = match("MESSAGE#40:00002:36/2", "nwparser.p0", "option has been %{disposition}"); var all14 = all_match({ processors: [ @@ -2337,20 +2005,15 @@ var all14 = all_match({ var msg41 = msg("00002:36", all14); -var part64 = // "Pattern{Constant('Logging of '), Field(p0,false)}" -match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); +var part64 = match("MESSAGE#41:00002:37/0", "nwparser.payload", "Logging of %{p0}"); -var part65 = // "Pattern{Constant('dropped '), Field(p0,false)}" -match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); +var part65 = match("MESSAGE#41:00002:37/1_0", "nwparser.p0", "dropped %{p0}"); -var part66 = // "Pattern{Constant('IKE '), Field(p0,false)}" -match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); +var part66 = match("MESSAGE#41:00002:37/1_1", "nwparser.p0", "IKE %{p0}"); -var part67 = // "Pattern{Constant('SNMP '), Field(p0,false)}" -match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); +var part67 = match("MESSAGE#41:00002:37/1_2", "nwparser.p0", "SNMP %{p0}"); -var part68 = // "Pattern{Constant('ICMP '), Field(p0,false)}" -match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); +var part68 = match("MESSAGE#41:00002:37/1_3", "nwparser.p0", "ICMP %{p0}"); var select16 = linear_select([ part65, @@ -2359,8 +2022,7 @@ var select16 = linear_select([ part68, ]); -var part69 = // "Pattern{Constant('traffic to self has been '), Field(disposition,false)}" -match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); +var part69 = match("MESSAGE#41:00002:37/2", "nwparser.p0", "traffic to self has been %{disposition}"); var all15 = all_match({ processors: [ @@ -2379,11 +2041,9 @@ var all15 = all_match({ var msg42 = msg("00002:37", all15); -var part70 = // "Pattern{Constant('Logging of dropped traffic to self (excluding multicast) has been '), Field(p0,false)}" -match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); +var part70 = match("MESSAGE#42:00002:38/0", "nwparser.payload", "Logging of dropped traffic to self (excluding multicast) has been %{p0}"); -var part71 = // "Pattern{Field(disposition,true), Constant(' on '), Field(zone,false)}" -match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); +var part71 = match("MESSAGE#42:00002:38/1_0", "nwparser.p0", "%{disposition->} on %{zone}"); var select17 = linear_select([ part71, @@ -2406,8 +2066,7 @@ var all16 = all_match({ var msg43 = msg("00002:38", all16); -var part72 = // "Pattern{Constant('Traffic shaping is '), Field(disposition,false)}" -match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ +var part72 = match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -2417,8 +2076,7 @@ match("MESSAGE#43:00002:39", "nwparser.payload", "Traffic shaping is %{dispositi var msg44 = msg("00002:39", part72); -var part73 = // "Pattern{Constant('Admin account created for ''), Field(username,false), Constant('' by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ +var part73 = match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{username}' by %{administrator->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ dup37, dup29, setc("ec_activity","Create"), @@ -2432,8 +2090,7 @@ match("MESSAGE#44:00002:40", "nwparser.payload", "Admin account created for '%{u var msg45 = msg("00002:40", part73); -var part74 = // "Pattern{Constant('ADMIN AUTH: Privilege requested for unknown user '), Field(username,false), Constant('. Possible HA syncronization problem.')}" -match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ +var part74 = match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requested for unknown user %{username}. Possible HA syncronization problem.", processor_chain([ dup35, dup31, dup39, @@ -2445,25 +2102,20 @@ match("MESSAGE#45:00002:44", "nwparser.payload", "ADMIN AUTH: Privilege requeste var msg46 = msg("00002:44", part74); -var part75 = // "Pattern{Field(change_attribute,true), Constant(' for account ''), Field(change_old,false), Constant('' has been '), Field(disposition,true), Constant(' to ''), Field(change_new,false), Constant('' '), Field(p0,false)}" -match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); +var part75 = match("MESSAGE#46:00002:42/0", "nwparser.payload", "%{change_attribute->} for account '%{change_old}' has been %{disposition->} to '%{change_new}' %{p0}"); -var part76 = // "Pattern{Constant('by '), Field(administrator,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); +var part76 = match("MESSAGE#46:00002:42/1_0", "nwparser.p0", "by %{administrator->} via %{p0}"); var select18 = linear_select([ part76, dup40, ]); -var part77 = // "Pattern{Constant(''), Field(logon_type,true), Constant(' from host '), Field(p0,false)}" -match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); +var part77 = match("MESSAGE#46:00002:42/2", "nwparser.p0", "%{logon_type->} from host %{p0}"); -var part78 = // "Pattern{Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); +var part78 = match("MESSAGE#46:00002:42/3_0", "nwparser.p0", "%{saddr->} to %{daddr}:%{dport->} (%{p0}"); -var part79 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); +var part79 = match("MESSAGE#46:00002:42/3_1", "nwparser.p0", "%{saddr}:%{sport->} (%{p0}"); var select19 = linear_select([ part78, @@ -2492,22 +2144,18 @@ var all17 = all_match({ var msg47 = msg("00002:42", all17); -var part80 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); +var part80 = match("MESSAGE#47:00002:43/0", "nwparser.payload", "Admin account %{disposition->} for %{p0}"); -var part81 = // "Pattern{Constant('''), Field(username,false), Constant('''), Field(p0,false)}" -match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); +var part81 = match("MESSAGE#47:00002:43/1_0", "nwparser.p0", "'%{username}'%{p0}"); -var part82 = // "Pattern{Constant('"'), Field(username,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); +var part82 = match("MESSAGE#47:00002:43/1_1", "nwparser.p0", "\"%{username}\"%{p0}"); var select20 = linear_select([ part81, part82, ]); -var part83 = // "Pattern{Field(,false), Constant('by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); +var part83 = match("MESSAGE#47:00002:43/2", "nwparser.p0", "%{}by %{administrator->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); var all18 = all_match({ processors: [ @@ -2530,8 +2178,7 @@ var all18 = all_match({ var msg48 = msg("00002:43", all18); -var part84 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for "'), Field(username,false), Constant('" by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ +var part84 = match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ dup42, dup29, dup43, @@ -2545,8 +2192,7 @@ match("MESSAGE#48:00002:50", "nwparser.payload", "Admin account %{disposition->} var msg49 = msg("00002:50", part84); -var part85 = // "Pattern{Constant('Admin account '), Field(disposition,true), Constant(' for "'), Field(username,false), Constant('" by '), Field(administrator,true), Constant(' '), Field(fld2,true), Constant(' via '), Field(logon_type,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ +var part85 = match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} for \"%{username}\" by %{administrator->} %{fld2->} via %{logon_type->} (%{fld1})", processor_chain([ dup42, dup29, dup43, @@ -2560,8 +2206,7 @@ match("MESSAGE#49:00002:51", "nwparser.payload", "Admin account %{disposition->} var msg50 = msg("00002:51", part85); -var part86 = // "Pattern{Constant('Extraneous exit is issued by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ +var part86 = match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by %{username->} via %{logon_type->} from host %{saddr}:%{sport->} (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -2572,20 +2217,15 @@ match("MESSAGE#50:00002:45", "nwparser.payload", "Extraneous exit is issued by % var msg51 = msg("00002:45", part86); -var part87 = // "Pattern{Constant('Ping of Death attack protection '), Field(p0,false)}" -match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); +var part87 = match("MESSAGE#51:00002:47/0_0", "nwparser.payload", "Ping of Death attack protection %{p0}"); -var part88 = // "Pattern{Constant('Src Route IP option filtering '), Field(p0,false)}" -match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); +var part88 = match("MESSAGE#51:00002:47/0_1", "nwparser.payload", "Src Route IP option filtering %{p0}"); -var part89 = // "Pattern{Constant('Teardrop attack protection '), Field(p0,false)}" -match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); +var part89 = match("MESSAGE#51:00002:47/0_2", "nwparser.payload", "Teardrop attack protection %{p0}"); -var part90 = // "Pattern{Constant('Land attack protection '), Field(p0,false)}" -match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); +var part90 = match("MESSAGE#51:00002:47/0_3", "nwparser.payload", "Land attack protection %{p0}"); -var part91 = // "Pattern{Constant('SYN flood protection '), Field(p0,false)}" -match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); +var part91 = match("MESSAGE#51:00002:47/0_4", "nwparser.payload", "SYN flood protection %{p0}"); var select21 = linear_select([ part87, @@ -2595,8 +2235,7 @@ var select21 = linear_select([ part91, ]); -var part92 = // "Pattern{Constant('is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); +var part92 = match("MESSAGE#51:00002:47/1", "nwparser.p0", "is %{disposition->} on zone %{zone->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})"); var all19 = all_match({ processors: [ @@ -2615,25 +2254,20 @@ var all19 = all_match({ var msg52 = msg("00002:47", all19); -var part93 = // "Pattern{Constant('Dropping pkts if not '), Field(p0,false)}" -match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); +var part93 = match("MESSAGE#52:00002:48/0", "nwparser.payload", "Dropping pkts if not %{p0}"); -var part94 = // "Pattern{Constant('exactly same with incoming if '), Field(p0,false)}" -match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); +var part94 = match("MESSAGE#52:00002:48/1_0", "nwparser.p0", "exactly same with incoming if %{p0}"); -var part95 = // "Pattern{Constant('in route table '), Field(p0,false)}" -match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); +var part95 = match("MESSAGE#52:00002:48/1_1", "nwparser.p0", "in route table %{p0}"); var select22 = linear_select([ part94, part95, ]); -var part96 = // "Pattern{Constant('(IP spoof protection) is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(username,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); +var part96 = match("MESSAGE#52:00002:48/2", "nwparser.p0", "(IP spoof protection) is %{disposition->} on zone %{zone->} by %{username->} via %{p0}"); -var part97 = // "Pattern{Constant('NSRP Peer. ('), Field(p0,false)}" -match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); +var part97 = match("MESSAGE#52:00002:48/3_0", "nwparser.p0", "NSRP Peer. (%{p0}"); var select23 = linear_select([ part97, @@ -2660,20 +2294,15 @@ var all20 = all_match({ var msg53 = msg("00002:48", all20); -var part98 = // "Pattern{Field(signame,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); +var part98 = match("MESSAGE#53:00002:52/0", "nwparser.payload", "%{signame->} %{p0}"); -var part99 = // "Pattern{Constant('protection'), Field(p0,false)}" -match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); +var part99 = match("MESSAGE#53:00002:52/1_0", "nwparser.p0", "protection%{p0}"); -var part100 = // "Pattern{Constant('limiting'), Field(p0,false)}" -match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); +var part100 = match("MESSAGE#53:00002:52/1_1", "nwparser.p0", "limiting%{p0}"); -var part101 = // "Pattern{Constant('detection'), Field(p0,false)}" -match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); +var part101 = match("MESSAGE#53:00002:52/1_2", "nwparser.p0", "detection%{p0}"); -var part102 = // "Pattern{Constant('filtering '), Field(p0,false)}" -match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); +var part102 = match("MESSAGE#53:00002:52/1_3", "nwparser.p0", "filtering %{p0}"); var select24 = linear_select([ part99, @@ -2682,11 +2311,9 @@ var select24 = linear_select([ part102, ]); -var part103 = // "Pattern{Field(,false), Constant('is '), Field(disposition,true), Constant(' on zone '), Field(zone,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); +var part103 = match("MESSAGE#53:00002:52/2", "nwparser.p0", "%{}is %{disposition->} on zone %{zone->} by %{p0}"); -var part104 = // "Pattern{Constant('admin via '), Field(p0,false)}" -match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); +var part104 = match("MESSAGE#53:00002:52/3_1", "nwparser.p0", "admin via %{p0}"); var select25 = linear_select([ dup46, @@ -2720,8 +2347,7 @@ var all21 = all_match({ var msg54 = msg("00002:52", all21); -var part105 = // "Pattern{Constant('Admin password for account "'), Field(username,false), Constant('" has been '), Field(disposition,true), Constant(' by '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ +var part105 = match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"%{username}\" has been %{disposition->} by %{administrator->} via %{logon_type->} (%{fld1})", processor_chain([ dup42, dup43, dup38, @@ -2734,14 +2360,11 @@ match("MESSAGE#54:00002:53", "nwparser.payload", "Admin password for account \"% var msg55 = msg("00002:53", part105); -var part106 = // "Pattern{Constant('Traffic shaping clearing DSCP selector is turned O'), Field(p0,false)}" -match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); +var part106 = match("MESSAGE#55:00002:54/0", "nwparser.payload", "Traffic shaping clearing DSCP selector is turned O%{p0}"); -var part107 = // "Pattern{Constant('FF'), Field(p0,false)}" -match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); +var part107 = match("MESSAGE#55:00002:54/1_0", "nwparser.p0", "FF%{p0}"); -var part108 = // "Pattern{Constant('N'), Field(p0,false)}" -match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); +var part108 = match("MESSAGE#55:00002:54/1_1", "nwparser.p0", "N%{p0}"); var select27 = linear_select([ part107, @@ -2768,19 +2391,16 @@ var all22 = all_match({ var msg56 = msg("00002:54", all22); -var part109 = // "Pattern{Field(change_attribute,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); +var part109 = match("MESSAGE#56:00002/0", "nwparser.payload", "%{change_attribute->} %{p0}"); -var part110 = // "Pattern{Constant('has been changed'), Field(p0,false)}" -match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); +var part110 = match("MESSAGE#56:00002/1_0", "nwparser.p0", "has been changed%{p0}"); var select28 = linear_select([ part110, dup52, ]); -var part111 = // "Pattern{Field(,false), Constant('from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); +var part111 = match("MESSAGE#56:00002/2", "nwparser.p0", "%{}from %{change_old->} to %{change_new}"); var all23 = all_match({ processors: [ @@ -2799,8 +2419,7 @@ var all23 = all_match({ var msg57 = msg("00002", all23); -var part112 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' failed. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ +var part112 = match("MESSAGE#1215:00002:56", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed. (%{fld1})", processor_chain([ dup53, dup9, dup2, @@ -2862,8 +2481,7 @@ var select29 = linear_select([ msg58, ]); -var part113 = // "Pattern{Constant('Multiple authentication failures have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false)}" -match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ +var part113 = match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ dup53, dup31, dup54, @@ -2875,8 +2493,7 @@ match("MESSAGE#57:00003", "nwparser.payload", "Multiple authentication failures var msg59 = msg("00003", part113); -var part114 = // "Pattern{Constant('Multiple authentication failures have been detected!'), Field(,false)}" -match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ +var part114 = match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failures have been detected!%{}", processor_chain([ dup53, dup31, dup54, @@ -2888,8 +2505,7 @@ match("MESSAGE#58:00003:01", "nwparser.payload", "Multiple authentication failur var msg60 = msg("00003:01", part114); -var part115 = // "Pattern{Constant('The console debug buffer has been '), Field(disposition,false)}" -match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ +var part115 = match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has been %{disposition}", processor_chain([ dup44, dup2, dup3, @@ -2899,8 +2515,7 @@ match("MESSAGE#59:00003:02", "nwparser.payload", "The console debug buffer has b var msg61 = msg("00003:02", part115); -var part116 = // "Pattern{Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" -match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ +var part116 = match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed from %{change_old->} to %{change_new}.", processor_chain([ dup44, dup2, dup3, @@ -2910,19 +2525,16 @@ match("MESSAGE#60:00003:03", "nwparser.payload", "%{change_attribute->} changed var msg62 = msg("00003:03", part116); -var part117 = // "Pattern{Constant('serial'), Field(p0,false)}" -match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); +var part117 = match("MESSAGE#61:00003:05/1_0", "nwparser.p0", "serial%{p0}"); -var part118 = // "Pattern{Constant('local'), Field(p0,false)}" -match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); +var part118 = match("MESSAGE#61:00003:05/1_1", "nwparser.p0", "local%{p0}"); var select30 = linear_select([ part117, part118, ]); -var part119 = // "Pattern{Field(,false), Constant('console has been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false), Constant('.')}" -match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); +var part119 = match("MESSAGE#61:00003:05/2", "nwparser.p0", "%{}console has been %{disposition->} by admin %{administrator}."); var all24 = all_match({ processors: [ @@ -2949,8 +2561,7 @@ var select31 = linear_select([ msg63, ]); -var part120 = // "Pattern{Field(info,false), Constant('DNS server IP has been changed')}" -match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ +var part120 = match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been changed", processor_chain([ dup44, dup2, dup3, @@ -2960,8 +2571,7 @@ match("MESSAGE#62:00004", "nwparser.payload", "%{info}DNS server IP has been cha var msg64 = msg("00004", part120); -var part121 = // "Pattern{Constant('DNS cache table has been '), Field(disposition,false)}" -match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ +var part121 = match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{disposition}", processor_chain([ dup44, dup2, dup3, @@ -2971,8 +2581,7 @@ match("MESSAGE#63:00004:01", "nwparser.payload", "DNS cache table has been %{dis var msg65 = msg("00004:01", part121); -var part122 = // "Pattern{Constant('Daily DNS lookup has been '), Field(disposition,false)}" -match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ +var part122 = match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{disposition}", processor_chain([ dup44, dup2, dup3, @@ -2982,8 +2591,7 @@ match("MESSAGE#64:00004:02", "nwparser.payload", "Daily DNS lookup has been %{di var msg66 = msg("00004:02", part122); -var part123 = // "Pattern{Constant('Daily DNS lookup time has been '), Field(disposition,false)}" -match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ +var part123 = match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been %{disposition}", processor_chain([ dup44, dup2, dup3, @@ -2993,16 +2601,14 @@ match("MESSAGE#65:00004:03", "nwparser.payload", "Daily DNS lookup time has been var msg67 = msg("00004:03", part123); -var part124 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); +var part124 = match("MESSAGE#66:00004:04/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on %{p0}"); -var part125 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' '), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); +var part125 = match("MESSAGE#66:00004:04/2", "nwparser.p0", "%{} %{interface->} %{space}The attack occurred %{dclass_counter1->} times"); var all25 = all_match({ processors: [ part124, - dup339, + dup337, part125, ], on_success: processor_chain([ @@ -3018,8 +2624,7 @@ var all25 = all_match({ var msg68 = msg("00004:04", all25); -var part126 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,false)}" -match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ +var part126 = match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol}", processor_chain([ dup58, dup2, dup4, @@ -3030,8 +2635,7 @@ match("MESSAGE#67:00004:05", "nwparser.payload", "%{signame->} from %{saddr}/%{s var msg69 = msg("00004:05", part126); -var part127 = // "Pattern{Constant('DNS lookup time has been changed to start at '), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' with an interval of '), Field(fld4,false)}" -match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ +var part127 = match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been changed to start at %{fld2}:%{fld3->} with an interval of %{fld4}", processor_chain([ dup1, dup2, dup3, @@ -3041,8 +2645,7 @@ match("MESSAGE#68:00004:06", "nwparser.payload", "DNS lookup time has been chang var msg70 = msg("00004:06", part127); -var part128 = // "Pattern{Constant('DNS cache table entries have been refreshed as result of external event.'), Field(,false)}" -match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ +var part128 = match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have been refreshed as result of external event.%{}", processor_chain([ dup44, dup2, dup3, @@ -3052,8 +2655,7 @@ match("MESSAGE#69:00004:07", "nwparser.payload", "DNS cache table entries have b var msg71 = msg("00004:07", part128); -var part129 = // "Pattern{Constant('DNS Proxy module has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ +var part129 = match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -3063,8 +2665,7 @@ match("MESSAGE#70:00004:08", "nwparser.payload", "DNS Proxy module has been %{di var msg72 = msg("00004:08", part129); -var part130 = // "Pattern{Constant('DNS Proxy module has more concurrent client requests than allowed.'), Field(,false)}" -match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ +var part130 = match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more concurrent client requests than allowed.%{}", processor_chain([ dup62, dup2, dup3, @@ -3074,8 +2675,7 @@ match("MESSAGE#71:00004:09", "nwparser.payload", "DNS Proxy module has more conc var msg73 = msg("00004:09", part130); -var part131 = // "Pattern{Constant('DNS Proxy server select table entries exceeded maximum limit.'), Field(,false)}" -match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ +var part131 = match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table entries exceeded maximum limit.%{}", processor_chain([ dup62, dup2, dup3, @@ -3085,8 +2685,7 @@ match("MESSAGE#72:00004:10", "nwparser.payload", "DNS Proxy server select table var msg74 = msg("00004:10", part131); -var part132 = // "Pattern{Constant('Proxy server select table added with domain '), Field(domain,false), Constant(', interface '), Field(interface,false), Constant(', primary-ip '), Field(fld2,false), Constant(', secondary-ip '), Field(fld3,false), Constant(', tertiary-ip '), Field(fld4,false), Constant(', failover '), Field(disposition,false)}" -match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ +var part132 = match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table added with domain %{domain}, interface %{interface}, primary-ip %{fld2}, secondary-ip %{fld3}, tertiary-ip %{fld4}, failover %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3096,8 +2695,7 @@ match("MESSAGE#73:00004:11", "nwparser.payload", "Proxy server select table adde var msg75 = msg("00004:11", part132); -var part133 = // "Pattern{Constant('DNS Proxy server select table entry '), Field(disposition,true), Constant(' with domain '), Field(domain,false)}" -match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ +var part133 = match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table entry %{disposition->} with domain %{domain}", processor_chain([ dup1, dup2, dup3, @@ -3107,8 +2705,7 @@ match("MESSAGE#74:00004:12", "nwparser.payload", "DNS Proxy server select table var msg76 = msg("00004:12", part133); -var part134 = // "Pattern{Constant('DDNS server '), Field(domain,true), Constant(' returned incorrect ip '), Field(fld2,false), Constant(', local-ip should be '), Field(fld3,false)}" -match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ +var part134 = match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} returned incorrect ip %{fld2}, local-ip should be %{fld3}", processor_chain([ dup19, dup2, dup3, @@ -3118,11 +2715,9 @@ match("MESSAGE#75:00004:13", "nwparser.payload", "DDNS server %{domain->} return var msg77 = msg("00004:13", part134); -var part135 = // "Pattern{Constant('automatically refreshed '), Field(p0,false)}" -match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); +var part135 = match("MESSAGE#76:00004:14/1_0", "nwparser.p0", "automatically refreshed %{p0}"); -var part136 = // "Pattern{Constant('refreshed by HA '), Field(p0,false)}" -match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); +var part136 = match("MESSAGE#76:00004:14/1_1", "nwparser.p0", "refreshed by HA %{p0}"); var select32 = linear_select([ part135, @@ -3147,8 +2742,7 @@ var all26 = all_match({ var msg78 = msg("00004:14", all26); -var part137 = // "Pattern{Constant('DNS entries have been refreshed as result of DNS server address change. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ +var part137 = match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshed as result of DNS server address change. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -3159,8 +2753,7 @@ match("MESSAGE#77:00004:15", "nwparser.payload", "DNS entries have been refreshe var msg79 = msg("00004:15", part137); -var part138 = // "Pattern{Constant('DNS entries have been manually refreshed. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ +var part138 = match("MESSAGE#78:00004:16", "nwparser.payload", "DNS entries have been manually refreshed. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -3174,7 +2767,7 @@ var msg80 = msg("00004:16", part138); var all27 = all_match({ processors: [ dup64, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -3212,8 +2805,7 @@ var select33 = linear_select([ msg81, ]); -var part139 = // "Pattern{Field(signame,true), Constant(' alarm threshold from the same source has been changed to '), Field(trigger_val,false)}" -match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ +var part139 = match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from the same source has been changed to %{trigger_val}", processor_chain([ dup1, dup2, dup3, @@ -3223,8 +2815,7 @@ match("MESSAGE#80:00005", "nwparser.payload", "%{signame->} alarm threshold from var msg82 = msg("00005", part139); -var part140 = // "Pattern{Constant('Logging of '), Field(fld2,true), Constant(' traffic to self has been '), Field(disposition,false)}" -match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ +var part140 = match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic to self has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3234,8 +2825,7 @@ match("MESSAGE#81:00005:01", "nwparser.payload", "Logging of %{fld2->} traffic t var msg83 = msg("00005:01", part140); -var part141 = // "Pattern{Constant('SYN flood '), Field(fld2,true), Constant(' has been changed to '), Field(fld3,false)}" -match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ +var part141 = match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been changed to %{fld3}", processor_chain([ dup1, dup2, dup3, @@ -3245,29 +2835,25 @@ match("MESSAGE#82:00005:02", "nwparser.payload", "SYN flood %{fld2->} has been c var msg84 = msg("00005:02", part141); -var part142 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(p0,false)}" -match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); +var part142 = match("MESSAGE#83:00005:03/0", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); -var part143 = // "Pattern{Field(fld99,false), Constant('interface '), Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); +var part143 = match("MESSAGE#83:00005:03/4", "nwparser.p0", "%{fld99}interface %{interface->} %{p0}"); -var part144 = // "Pattern{Constant('in zone '), Field(zone,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); +var part144 = match("MESSAGE#83:00005:03/5_0", "nwparser.p0", "in zone %{zone}. %{p0}"); var select34 = linear_select([ part144, dup73, ]); -var part145 = // "Pattern{Constant(''), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); +var part145 = match("MESSAGE#83:00005:03/6", "nwparser.p0", "%{space}The attack occurred %{dclass_counter1->} times"); var all28 = all_match({ processors: [ part142, - dup341, + dup339, dup70, - dup342, + dup340, part143, select34, part145, @@ -3285,10 +2871,9 @@ var all28 = all_match({ var msg85 = msg("00005:03", all28); -var msg86 = msg("00005:04", dup343); +var msg86 = msg("00005:04", dup341); -var part146 = // "Pattern{Constant('SYN flood drop pak in '), Field(fld2,true), Constant(' mode when receiving unknown dst mac has been '), Field(disposition,true), Constant(' on '), Field(zone,false), Constant('.')}" -match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ +var part146 = match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2->} mode when receiving unknown dst mac has been %{disposition->} on %{zone}.", processor_chain([ setc("eventcategory","1001020100"), dup2, dup3, @@ -3298,12 +2883,11 @@ match("MESSAGE#85:00005:05", "nwparser.payload", "SYN flood drop pak in %{fld2-> var msg87 = msg("00005:05", part146); -var part147 = // "Pattern{Constant('flood timeout has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" -match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); +var part147 = match("MESSAGE#86:00005:06/1", "nwparser.p0", "flood timeout has been set to %{trigger_val->} on %{zone}."); var all29 = all_match({ processors: [ - dup344, + dup342, part147, ], on_success: processor_chain([ @@ -3317,20 +2901,15 @@ var all29 = all_match({ var msg88 = msg("00005:06", all29); -var part148 = // "Pattern{Constant('SYN flood '), Field(p0,false)}" -match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); +var part148 = match("MESSAGE#87:00005:07/0", "nwparser.payload", "SYN flood %{p0}"); -var part149 = // "Pattern{Constant('alarm threshold '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); +var part149 = match("MESSAGE#87:00005:07/1_0", "nwparser.p0", "alarm threshold %{p0}"); -var part150 = // "Pattern{Constant('packet queue size '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); +var part150 = match("MESSAGE#87:00005:07/1_1", "nwparser.p0", "packet queue size %{p0}"); -var part151 = // "Pattern{Constant('attack threshold '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); +var part151 = match("MESSAGE#87:00005:07/1_3", "nwparser.p0", "attack threshold %{p0}"); -var part152 = // "Pattern{Constant('same source IP threshold '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); +var part152 = match("MESSAGE#87:00005:07/1_4", "nwparser.p0", "same source IP threshold %{p0}"); var select35 = linear_select([ part149, @@ -3340,8 +2919,7 @@ var select35 = linear_select([ part152, ]); -var part153 = // "Pattern{Constant('is set to '), Field(trigger_val,false), Constant('.')}" -match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); +var part153 = match("MESSAGE#87:00005:07/2", "nwparser.p0", "is set to %{trigger_val}."); var all30 = all_match({ processors: [ @@ -3360,20 +2938,18 @@ var all30 = all_match({ var msg89 = msg("00005:07", all30); -var part154 = // "Pattern{Constant('flood same '), Field(p0,false)}" -match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); +var part154 = match("MESSAGE#88:00005:08/1", "nwparser.p0", "flood same %{p0}"); var select36 = linear_select([ dup77, dup78, ]); -var part155 = // "Pattern{Constant('ip threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" -match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); +var part155 = match("MESSAGE#88:00005:08/3", "nwparser.p0", "ip threshold has been set to %{trigger_val->} on %{zone}."); var all31 = all_match({ processors: [ - dup344, + dup342, part154, select36, part155, @@ -3389,8 +2965,7 @@ var all31 = all_match({ var msg90 = msg("00005:08", all31); -var part156 = // "Pattern{Constant('Screen service '), Field(service,true), Constant(' is '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ +var part156 = match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is %{disposition->} on interface %{interface}.", processor_chain([ dup1, dup2, dup3, @@ -3400,8 +2975,7 @@ match("MESSAGE#89:00005:09", "nwparser.payload", "Screen service %{service->} is var msg91 = msg("00005:09", part156); -var part157 = // "Pattern{Constant('Screen service '), Field(service,true), Constant(' is '), Field(disposition,true), Constant(' on '), Field(zone,false)}" -match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ +var part157 = match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is %{disposition->} on %{zone}", processor_chain([ dup1, dup2, dup3, @@ -3411,23 +2985,17 @@ match("MESSAGE#90:00005:10", "nwparser.payload", "Screen service %{service->} is var msg92 = msg("00005:10", part157); -var part158 = // "Pattern{Constant('The SYN flood '), Field(p0,false)}" -match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); +var part158 = match("MESSAGE#91:00005:11/0", "nwparser.payload", "The SYN flood %{p0}"); -var part159 = // "Pattern{Constant('alarm threshold'), Field(,false)}" -match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); +var part159 = match("MESSAGE#91:00005:11/1_0", "nwparser.p0", "alarm threshold%{}"); -var part160 = // "Pattern{Constant('packet queue size'), Field(,false)}" -match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); +var part160 = match("MESSAGE#91:00005:11/1_1", "nwparser.p0", "packet queue size%{}"); -var part161 = // "Pattern{Constant('timeout value'), Field(,false)}" -match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); +var part161 = match("MESSAGE#91:00005:11/1_2", "nwparser.p0", "timeout value%{}"); -var part162 = // "Pattern{Constant('attack threshold'), Field(,false)}" -match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); +var part162 = match("MESSAGE#91:00005:11/1_3", "nwparser.p0", "attack threshold%{}"); -var part163 = // "Pattern{Constant('same source IP'), Field(,false)}" -match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); +var part163 = match("MESSAGE#91:00005:11/1_4", "nwparser.p0", "same source IP%{}"); var select37 = linear_select([ part159, @@ -3453,8 +3021,7 @@ var all32 = all_match({ var msg93 = msg("00005:11", all32); -var part164 = // "Pattern{Constant('The SYN-ACK-ACK proxy threshold value has been set to '), Field(trigger_val,true), Constant(' on '), Field(interface,false), Constant('.')}" -match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ +var part164 = match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshold value has been set to %{trigger_val->} on %{interface}.", processor_chain([ dup1, dup2, dup3, @@ -3464,8 +3031,7 @@ match("MESSAGE#92:00005:12", "nwparser.payload", "The SYN-ACK-ACK proxy threshol var msg94 = msg("00005:12", part164); -var part165 = // "Pattern{Constant('The session limit threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" -match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ +var part165 = match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ dup1, dup2, dup3, @@ -3475,8 +3041,7 @@ match("MESSAGE#93:00005:13", "nwparser.payload", "The session limit threshold ha var msg95 = msg("00005:13", part165); -var part166 = // "Pattern{Constant('syn proxy drop packet with unknown mac!'), Field(,false)}" -match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ +var part166 = match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unknown mac!%{}", processor_chain([ dup19, dup2, dup3, @@ -3486,8 +3051,7 @@ match("MESSAGE#94:00005:14", "nwparser.payload", "syn proxy drop packet with unk var msg96 = msg("00005:14", part166); -var part167 = // "Pattern{Field(signame,true), Constant(' alarm threshold has been changed to '), Field(trigger_val,false)}" -match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ +var part167 = match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold has been changed to %{trigger_val}", processor_chain([ dup1, dup2, dup3, @@ -3497,8 +3061,7 @@ match("MESSAGE#95:00005:15", "nwparser.payload", "%{signame->} alarm threshold h var msg97 = msg("00005:15", part167); -var part168 = // "Pattern{Field(signame,true), Constant(' threshold has been set to '), Field(trigger_val,true), Constant(' on '), Field(zone,false), Constant('.')}" -match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ +var part168 = match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has been set to %{trigger_val->} on %{zone}.", processor_chain([ dup1, dup2, dup3, @@ -3508,19 +3071,16 @@ match("MESSAGE#96:00005:16", "nwparser.payload", "%{signame->} threshold has bee var msg98 = msg("00005:16", part168); -var part169 = // "Pattern{Constant('destination-based '), Field(p0,false)}" -match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); +var part169 = match("MESSAGE#97:00005:17/1_0", "nwparser.p0", "destination-based %{p0}"); -var part170 = // "Pattern{Constant('source-based '), Field(p0,false)}" -match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); +var part170 = match("MESSAGE#97:00005:17/1_1", "nwparser.p0", "source-based %{p0}"); var select38 = linear_select([ part169, part170, ]); -var part171 = // "Pattern{Constant('session-limit threshold has been set at '), Field(trigger_val,true), Constant(' in zone '), Field(zone,false), Constant('.')}" -match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); +var part171 = match("MESSAGE#97:00005:17/2", "nwparser.p0", "session-limit threshold has been set at %{trigger_val->} in zone %{zone}."); var all33 = all_match({ processors: [ @@ -3542,7 +3102,7 @@ var msg99 = msg("00005:17", all33); var all34 = all_match({ processors: [ dup80, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -3559,8 +3119,7 @@ var all34 = all_match({ var msg100 = msg("00005:18", all34); -var part172 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part172 = match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times.", processor_chain([ dup84, dup2, dup3, @@ -3572,8 +3131,7 @@ match("MESSAGE#99:00005:19", "nwparser.payload", "%{signame->} From %{saddr}:%{s var msg101 = msg("00005:19", part172); -var part173 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' int '), Field(interface,false), Constant(').'), Field(space,true), Constant(' Occurred '), Field(fld2,true), Constant(' times. ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" -match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ +var part173 = match("MESSAGE#100:00005:20", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} int %{interface}).%{space->} Occurred %{fld2->} times. (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ dup84, dup9, dup2, @@ -3608,8 +3166,7 @@ var select39 = linear_select([ msg102, ]); -var part174 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part174 = match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup85, dup2, dup3, @@ -3621,8 +3178,7 @@ match("MESSAGE#101:00006", "nwparser.payload", "%{signame->} has been detected! var msg103 = msg("00006", part174); -var part175 = // "Pattern{Constant('Hostname set to "'), Field(hostname,false), Constant('"')}" -match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ +var part175 = match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname}\"", processor_chain([ dup1, dup2, dup3, @@ -3632,8 +3188,7 @@ match("MESSAGE#102:00006:01", "nwparser.payload", "Hostname set to \"%{hostname} var msg104 = msg("00006:01", part175); -var part176 = // "Pattern{Constant('Domain set to '), Field(domain,false)}" -match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ +var part176 = match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", processor_chain([ dup1, dup2, dup3, @@ -3643,8 +3198,7 @@ match("MESSAGE#103:00006:02", "nwparser.payload", "Domain set to %{domain}", pro var msg105 = msg("00006:02", part176); -var part177 = // "Pattern{Constant('An optional ScreenOS feature has been activated via a software key.'), Field(,false)}" -match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ +var part177 = match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key.%{}", processor_chain([ dup1, dup2, dup3, @@ -3654,13 +3208,12 @@ match("MESSAGE#104:00006:03", "nwparser.payload", "An optional ScreenOS feature var msg106 = msg("00006:03", part177); -var part178 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" -match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); +var part178 = match("MESSAGE#105:00006:04/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); var all35 = all_match({ processors: [ part178, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -3680,7 +3233,7 @@ var msg107 = msg("00006:04", all35); var all36 = all_match({ processors: [ dup64, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -3706,8 +3259,7 @@ var select40 = linear_select([ msg108, ]); -var part179 = // "Pattern{Constant('HA cluster ID has been changed to '), Field(fld2,false)}" -match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ +var part179 = match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -3717,8 +3269,7 @@ match("MESSAGE#107:00007", "nwparser.payload", "HA cluster ID has been changed t var msg109 = msg("00007", part179); -var part180 = // "Pattern{Field(change_attribute,true), Constant(' of the local NetScreen device has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ +var part180 = match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the local NetScreen device has changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -3728,14 +3279,11 @@ match("MESSAGE#108:00007:01", "nwparser.payload", "%{change_attribute->} of the var msg110 = msg("00007:01", part180); -var part181 = // "Pattern{Constant('HA state of the local device has changed to backup because a device with a '), Field(p0,false)}" -match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); +var part181 = match("MESSAGE#109:00007:02/0", "nwparser.payload", "HA state of the local device has changed to backup because a device with a %{p0}"); -var part182 = // "Pattern{Constant('higher priority has been detected'), Field(,false)}" -match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); +var part182 = match("MESSAGE#109:00007:02/1_0", "nwparser.p0", "higher priority has been detected%{}"); -var part183 = // "Pattern{Constant('lower MAC value has been detected'), Field(,false)}" -match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); +var part183 = match("MESSAGE#109:00007:02/1_1", "nwparser.p0", "lower MAC value has been detected%{}"); var select41 = linear_select([ part182, @@ -3758,8 +3306,7 @@ var all37 = all_match({ var msg111 = msg("00007:02", all37); -var part184 = // "Pattern{Constant('HA state of the local device has changed to init because IP tracking has failed'), Field(,false)}" -match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ +var part184 = match("MESSAGE#110:00007:03", "nwparser.payload", "HA state of the local device has changed to init because IP tracking has failed%{}", processor_chain([ dup86, dup2, dup3, @@ -3774,15 +3321,14 @@ var select42 = linear_select([ dup89, ]); -var part185 = // "Pattern{Constant('has been changed'), Field(,false)}" -match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); +var part185 = match("MESSAGE#111:00007:04/4", "nwparser.p0", "has been changed%{}"); var all38 = all_match({ processors: [ dup87, select42, dup23, - dup346, + dup344, part185, ], on_success: processor_chain([ @@ -3796,8 +3342,7 @@ var all38 = all_match({ var msg113 = msg("00007:04", all38); -var part186 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because a master already exists'), Field(,false)}" -match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ +var part186 = match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device has been elected backup because a master already exists%{}", processor_chain([ dup1, dup2, dup3, @@ -3807,8 +3352,7 @@ match("MESSAGE#112:00007:05", "nwparser.payload", "HA: Local NetScreen device ha var msg114 = msg("00007:05", part186); -var part187 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster'), Field(,false)}" -match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ +var part187 = match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its MAC value is higher than those of other devices in the cluster%{}", processor_chain([ dup1, dup2, dup3, @@ -3818,8 +3362,7 @@ match("MESSAGE#113:00007:06", "nwparser.payload", "HA: Local NetScreen device ha var msg115 = msg("00007:06", part187); -var part188 = // "Pattern{Constant('HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster'), Field(,false)}" -match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ +var part188 = match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device has been elected backup because its priority value is higher than those of other devices in the cluster%{}", processor_chain([ dup1, dup2, dup3, @@ -3829,8 +3372,7 @@ match("MESSAGE#114:00007:07", "nwparser.payload", "HA: Local NetScreen device ha var msg116 = msg("00007:07", part188); -var part189 = // "Pattern{Constant('HA: Local device has been elected master because no other master exists'), Field(,false)}" -match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ +var part189 = match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been elected master because no other master exists%{}", processor_chain([ dup1, dup2, dup3, @@ -3840,8 +3382,7 @@ match("MESSAGE#115:00007:08", "nwparser.payload", "HA: Local device has been ele var msg117 = msg("00007:08", part189); -var part190 = // "Pattern{Constant('HA: Local device priority has been changed to '), Field(fld2,false)}" -match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ +var part190 = match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has been changed to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -3851,8 +3392,7 @@ match("MESSAGE#116:00007:09", "nwparser.payload", "HA: Local device priority has var msg118 = msg("00007:09", part190); -var part191 = // "Pattern{Constant('HA: Previous master has promoted the local NetScreen device to master'), Field(,false)}" -match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ +var part191 = match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promoted the local NetScreen device to master%{}", processor_chain([ dup1, dup2, dup3, @@ -3862,8 +3402,7 @@ match("MESSAGE#117:00007:10", "nwparser.payload", "HA: Previous master has promo var msg119 = msg("00007:10", part191); -var part192 = // "Pattern{Constant('IP tracking device failover threshold has been '), Field(p0,false)}" -match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); +var part192 = match("MESSAGE#118:00007:11/0", "nwparser.payload", "IP tracking device failover threshold has been %{p0}"); var select43 = linear_select([ dup92, @@ -3886,8 +3425,7 @@ var all39 = all_match({ var msg120 = msg("00007:11", all39); -var part193 = // "Pattern{Constant('IP tracking has been '), Field(disposition,false)}" -match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ +var part193 = match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3897,8 +3435,7 @@ match("MESSAGE#119:00007:12", "nwparser.payload", "IP tracking has been %{dispos var msg121 = msg("00007:12", part193); -var part194 = // "Pattern{Constant('IP tracking to '), Field(hostip,true), Constant(' with interval '), Field(fld2,true), Constant(' threshold '), Field(trigger_val,true), Constant(' weight '), Field(fld4,true), Constant(' interface '), Field(interface,true), Constant(' method '), Field(fld5,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ +var part194 = match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} with interval %{fld2->} threshold %{trigger_val->} weight %{fld4->} interface %{interface->} method %{fld5->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3908,8 +3445,7 @@ match("MESSAGE#120:00007:13", "nwparser.payload", "IP tracking to %{hostip->} wi var msg122 = msg("00007:13", part194); -var part195 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part195 = match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup85, dup2, dup3, @@ -3921,8 +3457,7 @@ match("MESSAGE#121:00007:14", "nwparser.payload", "%{signame->} From %{saddr->} var msg123 = msg("00007:14", part195); -var part196 = // "Pattern{Constant('Primary HA interface has been changed to '), Field(interface,false)}" -match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ +var part196 = match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been changed to %{interface}", processor_chain([ dup1, dup2, dup3, @@ -3932,8 +3467,7 @@ match("MESSAGE#122:00007:15", "nwparser.payload", "Primary HA interface has been var msg124 = msg("00007:15", part196); -var part197 = // "Pattern{Constant('Reporting of HA configuration and status changes to NetScreen-Global Manager has been '), Field(disposition,false)}" -match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ +var part197 = match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration and status changes to NetScreen-Global Manager has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3943,8 +3477,7 @@ match("MESSAGE#123:00007:16", "nwparser.payload", "Reporting of HA configuration var msg125 = msg("00007:16", part197); -var part198 = // "Pattern{Constant('Tracked IP '), Field(hostip,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ +var part198 = match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -3954,28 +3487,22 @@ match("MESSAGE#124:00007:17", "nwparser.payload", "Tracked IP %{hostip->} has be var msg126 = msg("00007:17", part198); -var part199 = // "Pattern{Constant('Tracked IP '), Field(hostip,true), Constant(' options have been changed from int '), Field(fld2,true), Constant(' thr '), Field(fld3,true), Constant(' wgt '), Field(fld4,true), Constant(' inf '), Field(fld5,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); +var part199 = match("MESSAGE#125:00007:18/0", "nwparser.payload", "Tracked IP %{hostip->} options have been changed from int %{fld2->} thr %{fld3->} wgt %{fld4->} inf %{fld5->} %{p0}"); -var part200 = // "Pattern{Constant('ping '), Field(p0,false)}" -match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); +var part200 = match("MESSAGE#125:00007:18/1_0", "nwparser.p0", "ping %{p0}"); -var part201 = // "Pattern{Constant('ARP '), Field(p0,false)}" -match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); +var part201 = match("MESSAGE#125:00007:18/1_1", "nwparser.p0", "ARP %{p0}"); var select44 = linear_select([ part200, part201, ]); -var part202 = // "Pattern{Constant('to '), Field(fld6,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); +var part202 = match("MESSAGE#125:00007:18/2", "nwparser.p0", "to %{fld6->} %{p0}"); -var part203 = // "Pattern{Constant('ping'), Field(,false)}" -match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); +var part203 = match("MESSAGE#125:00007:18/3_0", "nwparser.p0", "ping%{}"); -var part204 = // "Pattern{Constant('ARP'), Field(,false)}" -match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); +var part204 = match("MESSAGE#125:00007:18/3_1", "nwparser.p0", "ARP%{}"); var select45 = linear_select([ part203, @@ -4000,8 +3527,7 @@ var all40 = all_match({ var msg127 = msg("00007:18", all40); -var part205 = // "Pattern{Constant('Change '), Field(change_attribute,true), Constant(' path from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" -match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ +var part205 = match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} path from %{change_old->} to %{change_new}.", processor_chain([ dup1, dup2, dup3, @@ -4011,13 +3537,12 @@ match("MESSAGE#126:00007:20", "nwparser.payload", "Change %{change_attribute->} var msg128 = msg("00007:20", part205); -var part206 = // "Pattern{Constant('HA Slave is '), Field(p0,false)}" -match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); +var part206 = match("MESSAGE#127:00007:21/0", "nwparser.payload", "HA Slave is %{p0}"); var all41 = all_match({ processors: [ part206, - dup347, + dup345, ], on_success: processor_chain([ dup44, @@ -4030,8 +3555,7 @@ var all41 = all_match({ var msg129 = msg("00007:21", all41); -var part207 = // "Pattern{Constant('HA change group id to '), Field(groupid,false)}" -match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ +var part207 = match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{groupid}", processor_chain([ dup1, dup2, dup3, @@ -4041,8 +3565,7 @@ match("MESSAGE#128:00007:22", "nwparser.payload", "HA change group id to %{group var msg130 = msg("00007:22", part207); -var part208 = // "Pattern{Constant('HA change priority to '), Field(fld2,false)}" -match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ +var part208 = match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -4052,8 +3575,7 @@ match("MESSAGE#129:00007:23", "nwparser.payload", "HA change priority to %{fld2} var msg131 = msg("00007:23", part208); -var part209 = // "Pattern{Constant('HA change state to init'), Field(,false)}" -match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ +var part209 = match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", processor_chain([ dup1, dup2, dup3, @@ -4063,8 +3585,7 @@ match("MESSAGE#130:00007:24", "nwparser.payload", "HA change state to init%{}", var msg132 = msg("00007:24", part209); -var part210 = // "Pattern{Constant('HA: Change state to initial state.'), Field(,false)}" -match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ +var part210 = match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial state.%{}", processor_chain([ dup1, dup2, dup3, @@ -4074,14 +3595,11 @@ match("MESSAGE#131:00007:25", "nwparser.payload", "HA: Change state to initial s var msg133 = msg("00007:25", part210); -var part211 = // "Pattern{Constant('HA: Change state to slave for '), Field(p0,false)}" -match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); +var part211 = match("MESSAGE#132:00007:26/0", "nwparser.payload", "HA: Change state to slave for %{p0}"); -var part212 = // "Pattern{Constant('tracking ip failed'), Field(,false)}" -match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); +var part212 = match("MESSAGE#132:00007:26/1_0", "nwparser.p0", "tracking ip failed%{}"); -var part213 = // "Pattern{Constant('linkdown'), Field(,false)}" -match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); +var part213 = match("MESSAGE#132:00007:26/1_1", "nwparser.p0", "linkdown%{}"); var select46 = linear_select([ part212, @@ -4104,8 +3622,7 @@ var all42 = all_match({ var msg134 = msg("00007:26", all42); -var part214 = // "Pattern{Constant('HA: Change to master command issued from original master to change state'), Field(,false)}" -match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ +var part214 = match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command issued from original master to change state%{}", processor_chain([ dup1, dup2, dup3, @@ -4115,8 +3632,7 @@ match("MESSAGE#133:00007:27", "nwparser.payload", "HA: Change to master command var msg135 = msg("00007:27", part214); -var part215 = // "Pattern{Constant('HA: Elected master no other master'), Field(,false)}" -match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ +var part215 = match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other master%{}", processor_chain([ dup1, dup2, dup3, @@ -4126,23 +3642,17 @@ match("MESSAGE#134:00007:28", "nwparser.payload", "HA: Elected master no other m var msg136 = msg("00007:28", part215); -var part216 = // "Pattern{Constant('HA: Elected slave '), Field(p0,false)}" -match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); +var part216 = match("MESSAGE#135:00007:29/0", "nwparser.payload", "HA: Elected slave %{p0}"); -var part217 = // "Pattern{Constant('lower priority'), Field(,false)}" -match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); +var part217 = match("MESSAGE#135:00007:29/1_0", "nwparser.p0", "lower priority%{}"); -var part218 = // "Pattern{Constant('MAC value is larger'), Field(,false)}" -match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); +var part218 = match("MESSAGE#135:00007:29/1_1", "nwparser.p0", "MAC value is larger%{}"); -var part219 = // "Pattern{Constant('master already exists'), Field(,false)}" -match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); +var part219 = match("MESSAGE#135:00007:29/1_2", "nwparser.p0", "master already exists%{}"); -var part220 = // "Pattern{Constant('detect new master with higher priority'), Field(,false)}" -match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); +var part220 = match("MESSAGE#135:00007:29/1_3", "nwparser.p0", "detect new master with higher priority%{}"); -var part221 = // "Pattern{Constant('detect new master with smaller MAC value'), Field(,false)}" -match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); +var part221 = match("MESSAGE#135:00007:29/1_4", "nwparser.p0", "detect new master with smaller MAC value%{}"); var select47 = linear_select([ part217, @@ -4168,8 +3678,7 @@ var all43 = all_match({ var msg137 = msg("00007:29", all43); -var part222 = // "Pattern{Constant('HA: Promoted master command issued from original master to change state'), Field(,false)}" -match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ +var part222 = match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command issued from original master to change state%{}", processor_chain([ dup1, dup2, dup3, @@ -4179,13 +3688,12 @@ match("MESSAGE#136:00007:30", "nwparser.payload", "HA: Promoted master command i var msg138 = msg("00007:30", part222); -var part223 = // "Pattern{Constant('HA: ha link '), Field(p0,false)}" -match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); +var part223 = match("MESSAGE#137:00007:31/0", "nwparser.payload", "HA: ha link %{p0}"); var all44 = all_match({ processors: [ part223, - dup347, + dup345, ], on_success: processor_chain([ dup44, @@ -4198,23 +3706,21 @@ var all44 = all_match({ var msg139 = msg("00007:31", all44); -var part224 = // "Pattern{Constant('NSRP '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); +var part224 = match("MESSAGE#138:00007:32/0", "nwparser.payload", "NSRP %{fld2->} %{p0}"); var select48 = linear_select([ dup89, dup88, ]); -var part225 = // "Pattern{Constant('changed.'), Field(,false)}" -match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); +var part225 = match("MESSAGE#138:00007:32/4", "nwparser.p0", "changed.%{}"); var all45 = all_match({ processors: [ part224, select48, dup23, - dup346, + dup344, part225, ], on_success: processor_chain([ @@ -4228,30 +3734,25 @@ var all45 = all_match({ var msg140 = msg("00007:32", all45); -var part226 = // "Pattern{Constant('NSRP: VSD '), Field(p0,false)}" -match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); +var part226 = match("MESSAGE#139:00007:33/0_0", "nwparser.payload", "NSRP: VSD %{p0}"); -var part227 = // "Pattern{Constant('Virtual Security Device group '), Field(p0,false)}" -match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); +var part227 = match("MESSAGE#139:00007:33/0_1", "nwparser.payload", "Virtual Security Device group %{p0}"); var select49 = linear_select([ part226, part227, ]); -var part228 = // "Pattern{Constant(''), Field(fld2,true), Constant(' change'), Field(p0,false)}" -match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); +var part228 = match("MESSAGE#139:00007:33/1", "nwparser.p0", "%{fld2->} change%{p0}"); -var part229 = // "Pattern{Constant('d '), Field(p0,false)}" -match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); +var part229 = match("MESSAGE#139:00007:33/2_0", "nwparser.p0", "d %{p0}"); var select50 = linear_select([ part229, dup96, ]); -var part230 = // "Pattern{Constant('to '), Field(fld3,true), Constant(' mode.')}" -match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); +var part230 = match("MESSAGE#139:00007:33/3", "nwparser.p0", "to %{fld3->} mode."); var all46 = all_match({ processors: [ @@ -4271,8 +3772,7 @@ var all46 = all_match({ var msg141 = msg("00007:33", all46); -var part231 = // "Pattern{Constant('NSRP: message '), Field(fld2,true), Constant(' dropped: invalid encryption password.')}" -match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ +var part231 = match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropped: invalid encryption password.", processor_chain([ dup97, dup2, dup3, @@ -4282,8 +3782,7 @@ match("MESSAGE#140:00007:34", "nwparser.payload", "NSRP: message %{fld2->} dropp var msg142 = msg("00007:34", part231); -var part232 = // "Pattern{Constant('NSRP: nsrp interface change to '), Field(interface,false), Constant('.')}" -match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ +var part232 = match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change to %{interface}.", processor_chain([ dup44, dup2, dup3, @@ -4293,8 +3792,7 @@ match("MESSAGE#141:00007:35", "nwparser.payload", "NSRP: nsrp interface change t var msg143 = msg("00007:35", part232); -var part233 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' local unit='), Field(fld3,true), Constant(' duplicate from unit='), Field(fld4,false)}" -match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ +var part233 = match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} local unit=%{fld3->} duplicate from unit=%{fld4}", processor_chain([ dup44, dup2, dup3, @@ -4304,13 +3802,12 @@ match("MESSAGE#142:00007:36", "nwparser.payload", "RTO mirror group id=%{groupid var msg144 = msg("00007:36", part233); -var part234 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' is '), Field(p0,false)}" -match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); +var part234 = match("MESSAGE#143:00007:37/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} is %{p0}"); var all47 = all_match({ processors: [ part234, - dup348, + dup346, ], on_success: processor_chain([ dup44, @@ -4323,17 +3820,13 @@ var all47 = all_match({ var msg145 = msg("00007:37", all47); -var part235 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' direction= '), Field(direction,true), Constant(' peer='), Field(fld3,true), Constant(' from '), Field(p0,false)}" -match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); +var part235 = match("MESSAGE#144:00007:38/0", "nwparser.payload", "RTO mirror group id=%{groupid->} direction= %{direction->} peer=%{fld3->} from %{p0}"); -var part236 = // "Pattern{Constant('state '), Field(p0,false)}" -match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); +var part236 = match("MESSAGE#144:00007:38/4", "nwparser.p0", "state %{p0}"); -var part237 = // "Pattern{Constant('missed heartbeat'), Field(,false)}" -match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); +var part237 = match("MESSAGE#144:00007:38/5_0", "nwparser.p0", "missed heartbeat%{}"); -var part238 = // "Pattern{Constant('group detached'), Field(,false)}" -match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); +var part238 = match("MESSAGE#144:00007:38/5_1", "nwparser.p0", "group detached%{}"); var select51 = linear_select([ part237, @@ -4343,9 +3836,9 @@ var select51 = linear_select([ var all48 = all_match({ processors: [ part235, - dup349, + dup347, dup103, - dup349, + dup347, part236, select51, ], @@ -4360,13 +3853,12 @@ var all48 = all_match({ var msg146 = msg("00007:38", all48); -var part239 = // "Pattern{Constant('RTO mirror group id='), Field(groupid,true), Constant(' is '), Field(p0,false)}" -match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); +var part239 = match("MESSAGE#145:00007:39/0", "nwparser.payload", "RTO mirror group id=%{groupid->} is %{p0}"); var all49 = all_match({ processors: [ part239, - dup348, + dup346, ], on_success: processor_chain([ dup44, @@ -4379,8 +3871,7 @@ var all49 = all_match({ var msg147 = msg("00007:39", all49); -var part240 = // "Pattern{Constant('Remove pathname '), Field(fld2,true), Constant(' (ifnum='), Field(fld3,false), Constant(') as secondary HA path')}" -match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ +var part240 = match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (ifnum=%{fld3}) as secondary HA path", processor_chain([ dup44, dup2, dup3, @@ -4390,8 +3881,7 @@ match("MESSAGE#146:00007:40", "nwparser.payload", "Remove pathname %{fld2->} (if var msg148 = msg("00007:40", part240); -var part241 = // "Pattern{Constant('Session sync ended by unit='), Field(fld2,false)}" -match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ +var part241 = match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{fld2}", processor_chain([ dup44, dup2, dup3, @@ -4401,8 +3891,7 @@ match("MESSAGE#147:00007:41", "nwparser.payload", "Session sync ended by unit=%{ var msg149 = msg("00007:41", part241); -var part242 = // "Pattern{Constant('Set secondary HA path to '), Field(fld2,true), Constant(' (ifnum='), Field(fld3,false), Constant(')')}" -match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ +var part242 = match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fld2->} (ifnum=%{fld3})", processor_chain([ dup1, dup2, dup3, @@ -4412,8 +3901,7 @@ match("MESSAGE#148:00007:42", "nwparser.payload", "Set secondary HA path to %{fl var msg150 = msg("00007:42", part242); -var part243 = // "Pattern{Constant('VSD '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ +var part243 = match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -4423,8 +3911,7 @@ match("MESSAGE#149:00007:43", "nwparser.payload", "VSD %{change_attribute->} cha var msg151 = msg("00007:43", part243); -var part244 = // "Pattern{Constant('vsd group id='), Field(groupid,true), Constant(' is '), Field(disposition,true), Constant(' total number='), Field(fld3,false)}" -match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ +var part244 = match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is %{disposition->} total number=%{fld3}", processor_chain([ dup1, dup2, dup3, @@ -4434,8 +3921,7 @@ match("MESSAGE#150:00007:44", "nwparser.payload", "vsd group id=%{groupid->} is var msg152 = msg("00007:44", part244); -var part245 = // "Pattern{Constant('vsd group '), Field(group,true), Constant(' local unit '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ +var part245 = match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local unit %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -4445,8 +3931,7 @@ match("MESSAGE#151:00007:45", "nwparser.payload", "vsd group %{group->} local un var msg153 = msg("00007:45", part245); -var part246 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part246 = match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup85, dup2, dup3, @@ -4458,8 +3943,7 @@ match("MESSAGE#152:00007:46", "nwparser.payload", "%{signame->} has been detecte var msg154 = msg("00007:46", part246); -var part247 = // "Pattern{Constant('The HA channel changed to interface '), Field(interface,false)}" -match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ +var part247 = match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to interface %{interface}", processor_chain([ dup1, dup2, dup3, @@ -4469,8 +3953,7 @@ match("MESSAGE#153:00007:47", "nwparser.payload", "The HA channel changed to int var msg155 = msg("00007:47", part247); -var part248 = // "Pattern{Constant('Message '), Field(fld2,true), Constant(' was dropped because it contained an invalid encryption password.')}" -match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ +var part248 = match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped because it contained an invalid encryption password.", processor_chain([ dup97, dup2, dup3, @@ -4481,8 +3964,7 @@ match("MESSAGE#154:00007:48", "nwparser.payload", "Message %{fld2->} was dropped var msg156 = msg("00007:48", part248); -var part249 = // "Pattern{Constant('The '), Field(change_attribute,true), Constant(' of all Virtual Security Device groups changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ +var part249 = match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of all Virtual Security Device groups changed from %{change_old->} to %{change_new}", processor_chain([ setc("eventcategory","1604000000"), dup2, dup3, @@ -4492,22 +3974,18 @@ match("MESSAGE#155:00007:49", "nwparser.payload", "The %{change_attribute->} of var msg157 = msg("00007:49", part249); -var part250 = // "Pattern{Constant('Device '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); +var part250 = match("MESSAGE#156:00007:50/0", "nwparser.payload", "Device %{fld2->} %{p0}"); -var part251 = // "Pattern{Constant('has joined '), Field(p0,false)}" -match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); +var part251 = match("MESSAGE#156:00007:50/1_0", "nwparser.p0", "has joined %{p0}"); -var part252 = // "Pattern{Constant('quit current '), Field(p0,false)}" -match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); +var part252 = match("MESSAGE#156:00007:50/1_1", "nwparser.p0", "quit current %{p0}"); var select52 = linear_select([ part251, part252, ]); -var part253 = // "Pattern{Constant('NSRP cluster '), Field(fld3,false)}" -match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); +var part253 = match("MESSAGE#156:00007:50/2", "nwparser.p0", "NSRP cluster %{fld3}"); var all50 = all_match({ processors: [ @@ -4526,11 +4004,9 @@ var all50 = all_match({ var msg158 = msg("00007:50", all50); -var part254 = // "Pattern{Constant('Virtual Security Device group '), Field(group,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); +var part254 = match("MESSAGE#157:00007:51/0", "nwparser.payload", "Virtual Security Device group %{group->} was %{p0}"); -var part255 = // "Pattern{Constant('deleted '), Field(p0,false)}" -match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); +var part255 = match("MESSAGE#157:00007:51/1_1", "nwparser.p0", "deleted %{p0}"); var select53 = linear_select([ dup104, @@ -4542,8 +4018,7 @@ var select54 = linear_select([ dup73, ]); -var part256 = // "Pattern{Constant('The total number of members in the group '), Field(p0,false)}" -match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); +var part256 = match("MESSAGE#157:00007:51/4", "nwparser.p0", "The total number of members in the group %{p0}"); var select55 = linear_select([ dup106, @@ -4571,8 +4046,7 @@ var all51 = all_match({ var msg159 = msg("00007:51", all51); -var part257 = // "Pattern{Constant('Virtual Security Device group '), Field(group,true), Constant(' '), Field(change_attribute,true), Constant(' changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ +var part257 = match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group %{group->} %{change_attribute->} changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -4582,8 +4056,7 @@ match("MESSAGE#158:00007:52", "nwparser.payload", "Virtual Security Device group var msg160 = msg("00007:52", part257); -var part258 = // "Pattern{Constant('The secondary HA path of the devices was set to interface '), Field(interface,true), Constant(' with ifnum '), Field(fld2,false)}" -match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ +var part258 = match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the devices was set to interface %{interface->} with ifnum %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -4593,8 +4066,7 @@ match("MESSAGE#159:00007:53", "nwparser.payload", "The secondary HA path of the var msg161 = msg("00007:53", part258); -var part259 = // "Pattern{Constant('The '), Field(change_attribute,true), Constant(' of the devices changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ +var part259 = match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of the devices changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -4604,8 +4076,7 @@ match("MESSAGE#160:00007:54", "nwparser.payload", "The %{change_attribute->} of var msg162 = msg("00007:54", part259); -var part260 = // "Pattern{Constant('The interface '), Field(interface,true), Constant(' with ifnum '), Field(fld2,true), Constant(' was removed from the secondary HA path of the devices.')}" -match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ +var part260 = match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} with ifnum %{fld2->} was removed from the secondary HA path of the devices.", processor_chain([ dup1, dup2, dup3, @@ -4615,8 +4086,7 @@ match("MESSAGE#161:00007:55", "nwparser.payload", "The interface %{interface->} var msg163 = msg("00007:55", part260); -var part261 = // "Pattern{Constant('The probe that detects the status of High Availability link '), Field(fld2,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ +var part261 = match("MESSAGE#162:00007:56", "nwparser.payload", "The probe that detects the status of High Availability link %{fld2->} was %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -4636,8 +4106,7 @@ var select57 = linear_select([ dup112, ]); -var part262 = // "Pattern{Constant('the probe detecting the status of High Availability link '), Field(fld2,true), Constant(' was set to '), Field(fld3,false)}" -match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); +var part262 = match("MESSAGE#163:00007:57/4", "nwparser.p0", "the probe detecting the status of High Availability link %{fld2->} was set to %{fld3}"); var all52 = all_match({ processors: [ @@ -4658,8 +4127,7 @@ var all52 = all_match({ var msg165 = msg("00007:57", all52); -var part263 = // "Pattern{Constant('A request by device '), Field(fld2,true), Constant(' for session synchronization(s) was accepted.')}" -match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ +var part263 = match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} for session synchronization(s) was accepted.", processor_chain([ dup44, dup2, dup3, @@ -4669,8 +4137,7 @@ match("MESSAGE#164:00007:58", "nwparser.payload", "A request by device %{fld2->} var msg166 = msg("00007:58", part263); -var part264 = // "Pattern{Constant('The current session synchronization by device '), Field(fld2,true), Constant(' completed.')}" -match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ +var part264 = match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchronization by device %{fld2->} completed.", processor_chain([ dup1, dup2, dup3, @@ -4680,8 +4147,7 @@ match("MESSAGE#165:00007:59", "nwparser.payload", "The current session synchroni var msg167 = msg("00007:59", part264); -var part265 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' direction was set to '), Field(direction,false)}" -match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ +var part265 = match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group %{group->} direction was set to %{direction}", processor_chain([ dup1, dup2, dup3, @@ -4691,8 +4157,7 @@ match("MESSAGE#166:00007:60", "nwparser.payload", "Run Time Object mirror group var msg168 = msg("00007:60", part265); -var part266 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' was set.')}" -match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ +var part266 = match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group %{group->} was set.", processor_chain([ dup1, dup2, dup3, @@ -4702,8 +4167,7 @@ match("MESSAGE#167:00007:61", "nwparser.payload", "Run Time Object mirror group var msg169 = msg("00007:61", part266); -var part267 = // "Pattern{Constant('Run Time Object mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' was unset.')}" -match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ +var part267 = match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group %{group->} with direction %{direction->} was unset.", processor_chain([ dup1, dup2, dup3, @@ -4713,8 +4177,7 @@ match("MESSAGE#168:00007:62", "nwparser.payload", "Run Time Object mirror group var msg170 = msg("00007:62", part267); -var part268 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' was unset.')}" -match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ +var part268 = match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} was unset.", processor_chain([ dup1, dup2, dup3, @@ -4724,17 +4187,15 @@ match("MESSAGE#169:00007:63", "nwparser.payload", "RTO mirror group %{group->} w var msg171 = msg("00007:63", part268); -var part269 = // "Pattern{Constant(''), Field(fld2,true), Constant(' was removed from the monitoring list '), Field(p0,false)}" -match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); +var part269 = match("MESSAGE#170:00007:64/1", "nwparser.p0", "%{fld2->} was removed from the monitoring list %{p0}"); -var part270 = // "Pattern{Constant(''), Field(fld3,false)}" -match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); +var part270 = match("MESSAGE#170:00007:64/3", "nwparser.p0", "%{fld3}"); var all53 = all_match({ processors: [ - dup350, + dup348, part269, - dup351, + dup349, part270, ], on_success: processor_chain([ @@ -4748,33 +4209,28 @@ var all53 = all_match({ var msg172 = msg("00007:64", all53); -var part271 = // "Pattern{Constant(''), Field(fld2,true), Constant(' with weight '), Field(fld3,true), Constant(' was added'), Field(p0,false)}" -match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); +var part271 = match("MESSAGE#171:00007:65/1", "nwparser.p0", "%{fld2->} with weight %{fld3->} was added%{p0}"); -var part272 = // "Pattern{Constant(' to or updated on '), Field(p0,false)}" -match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); +var part272 = match("MESSAGE#171:00007:65/2_0", "nwparser.p0", " to or updated on %{p0}"); -var part273 = // "Pattern{Constant('/updated to '), Field(p0,false)}" -match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); +var part273 = match("MESSAGE#171:00007:65/2_1", "nwparser.p0", "/updated to %{p0}"); var select58 = linear_select([ part272, part273, ]); -var part274 = // "Pattern{Constant('the monitoring list '), Field(p0,false)}" -match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); +var part274 = match("MESSAGE#171:00007:65/3", "nwparser.p0", "the monitoring list %{p0}"); -var part275 = // "Pattern{Constant(''), Field(fld4,false)}" -match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); +var part275 = match("MESSAGE#171:00007:65/5", "nwparser.p0", "%{fld4}"); var all54 = all_match({ processors: [ - dup350, + dup348, part271, select58, part274, - dup351, + dup349, part275, ], on_success: processor_chain([ @@ -4788,22 +4244,18 @@ var all54 = all_match({ var msg173 = msg("00007:65", all54); -var part276 = // "Pattern{Constant('The monitoring '), Field(p0,false)}" -match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); +var part276 = match("MESSAGE#172:00007:66/0_0", "nwparser.payload", "The monitoring %{p0}"); -var part277 = // "Pattern{Constant('Monitoring '), Field(p0,false)}" -match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); +var part277 = match("MESSAGE#172:00007:66/0_1", "nwparser.payload", "Monitoring %{p0}"); var select59 = linear_select([ part276, part277, ]); -var part278 = // "Pattern{Constant('threshold was modified to '), Field(trigger_val,true), Constant(' o'), Field(p0,false)}" -match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); +var part278 = match("MESSAGE#172:00007:66/1", "nwparser.p0", "threshold was modified to %{trigger_val->} o%{p0}"); -var part279 = // "Pattern{Constant('f '), Field(p0,false)}" -match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); +var part279 = match("MESSAGE#172:00007:66/2_0", "nwparser.p0", "f %{p0}"); var select60 = linear_select([ part279, @@ -4828,8 +4280,7 @@ var all55 = all_match({ var msg174 = msg("00007:66", all55); -var part280 = // "Pattern{Constant('NSRP data forwarding '), Field(disposition,false), Constant('.')}" -match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ +var part280 = match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -4839,28 +4290,22 @@ match("MESSAGE#173:00007:67", "nwparser.payload", "NSRP data forwarding %{dispos var msg175 = msg("00007:67", part280); -var part281 = // "Pattern{Constant('NSRP b'), Field(p0,false)}" -match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); +var part281 = match("MESSAGE#174:00007:68/0", "nwparser.payload", "NSRP b%{p0}"); -var part282 = // "Pattern{Constant('lack '), Field(p0,false)}" -match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); +var part282 = match("MESSAGE#174:00007:68/1_0", "nwparser.p0", "lack %{p0}"); -var part283 = // "Pattern{Constant('ack '), Field(p0,false)}" -match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); +var part283 = match("MESSAGE#174:00007:68/1_1", "nwparser.p0", "ack %{p0}"); var select61 = linear_select([ part282, part283, ]); -var part284 = // "Pattern{Constant('hole prevention '), Field(disposition,false), Constant('. Master(s) of Virtual Security Device groups '), Field(p0,false)}" -match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); +var part284 = match("MESSAGE#174:00007:68/2", "nwparser.p0", "hole prevention %{disposition}. Master(s) of Virtual Security Device groups %{p0}"); -var part285 = // "Pattern{Constant('may not exist '), Field(p0,false)}" -match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); +var part285 = match("MESSAGE#174:00007:68/3_0", "nwparser.p0", "may not exist %{p0}"); -var part286 = // "Pattern{Constant('always exists '), Field(p0,false)}" -match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); +var part286 = match("MESSAGE#174:00007:68/3_1", "nwparser.p0", "always exists %{p0}"); var select62 = linear_select([ part285, @@ -4886,8 +4331,7 @@ var all56 = all_match({ var msg176 = msg("00007:68", all56); -var part287 = // "Pattern{Constant('NSRP Run Time Object synchronization between devices was '), Field(disposition,false)}" -match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ +var part287 = match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchronization between devices was %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -4897,8 +4341,7 @@ match("MESSAGE#175:00007:69", "nwparser.payload", "NSRP Run Time Object synchron var msg177 = msg("00007:69", part287); -var part288 = // "Pattern{Constant('The NSRP encryption key was changed.'), Field(,false)}" -match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ +var part288 = match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was changed.%{}", processor_chain([ dup1, dup2, dup3, @@ -4908,8 +4351,7 @@ match("MESSAGE#176:00007:70", "nwparser.payload", "The NSRP encryption key was c var msg178 = msg("00007:70", part288); -var part289 = // "Pattern{Constant('NSRP transparent Active-Active mode was '), Field(disposition,false), Constant('.')}" -match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ +var part289 = match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Active mode was %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -4919,8 +4361,7 @@ match("MESSAGE#177:00007:71", "nwparser.payload", "NSRP transparent Active-Activ var msg179 = msg("00007:71", part289); -var part290 = // "Pattern{Constant('NSRP: nsrp link probe enable on '), Field(interface,false)}" -match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ +var part290 = match("MESSAGE#178:00007:72", "nwparser.payload", "NSRP: nsrp link probe enable on %{interface}", processor_chain([ dup1, dup2, dup3, @@ -5005,8 +4446,7 @@ var select63 = linear_select([ msg180, ]); -var part291 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part291 = match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -5018,10 +4458,9 @@ match("MESSAGE#179:00008", "nwparser.payload", "%{signame->} has been detected! var msg181 = msg("00008", part291); -var msg182 = msg("00008:01", dup343); +var msg182 = msg("00008:01", dup341); -var part292 = // "Pattern{Constant('NTP settings have been changed'), Field(,false)}" -match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ +var part292 = match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been changed%{}", processor_chain([ dup1, dup2, dup3, @@ -5031,8 +4470,7 @@ match("MESSAGE#181:00008:02", "nwparser.payload", "NTP settings have been change var msg183 = msg("00008:02", part292); -var part293 = // "Pattern{Constant('The system clock has been updated through NTP'), Field(,false)}" -match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ +var part293 = match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been updated through NTP%{}", processor_chain([ dup1, dup2, dup3, @@ -5042,17 +4480,13 @@ match("MESSAGE#182:00008:03", "nwparser.payload", "The system clock has been upd var msg184 = msg("00008:03", part293); -var part294 = // "Pattern{Constant('System clock '), Field(p0,false)}" -match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); +var part294 = match("MESSAGE#183:00008:04/0", "nwparser.payload", "System clock %{p0}"); -var part295 = // "Pattern{Constant('configurations have been'), Field(p0,false)}" -match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); +var part295 = match("MESSAGE#183:00008:04/1_0", "nwparser.p0", "configurations have been%{p0}"); -var part296 = // "Pattern{Constant('was'), Field(p0,false)}" -match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); +var part296 = match("MESSAGE#183:00008:04/1_1", "nwparser.p0", "was%{p0}"); -var part297 = // "Pattern{Constant('is'), Field(p0,false)}" -match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); +var part297 = match("MESSAGE#183:00008:04/1_2", "nwparser.p0", "is%{p0}"); var select64 = linear_select([ part295, @@ -5060,23 +4494,17 @@ var select64 = linear_select([ part297, ]); -var part298 = // "Pattern{Field(,false), Constant('changed'), Field(p0,false)}" -match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); +var part298 = match("MESSAGE#183:00008:04/2", "nwparser.p0", "%{}changed%{p0}"); -var part299 = // "Pattern{Constant(' by admin '), Field(administrator,false)}" -match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); +var part299 = match("MESSAGE#183:00008:04/3_0", "nwparser.p0", " by admin %{administrator}"); -var part300 = // "Pattern{Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); +var part300 = match("MESSAGE#183:00008:04/3_1", "nwparser.p0", " by %{username->} (%{fld1})"); -var part301 = // "Pattern{Constant(' by '), Field(username,false)}" -match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); +var part301 = match("MESSAGE#183:00008:04/3_2", "nwparser.p0", " by %{username}"); -var part302 = // "Pattern{Constant(' manually.'), Field(,false)}" -match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); +var part302 = match("MESSAGE#183:00008:04/3_3", "nwparser.p0", " manually.%{}"); -var part303 = // "Pattern{Constant(' manually'), Field(,false)}" -match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); +var part303 = match("MESSAGE#183:00008:04/3_4", "nwparser.p0", " manually%{}"); var select65 = linear_select([ part299, @@ -5106,8 +4534,7 @@ var all57 = all_match({ var msg185 = msg("00008:04", all57); -var part304 = // "Pattern{Constant('failed to get clock through NTP'), Field(,false)}" -match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ +var part304 = match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ dup117, dup2, dup3, @@ -5117,8 +4544,7 @@ match("MESSAGE#184:00008:05", "nwparser.payload", "failed to get clock through N var msg186 = msg("00008:05", part304); -var part305 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part305 = match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -5130,8 +4556,7 @@ match("MESSAGE#185:00008:06", "nwparser.payload", "%{signame->} has been detecte var msg187 = msg("00008:06", part305); -var part306 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part306 = match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -5143,8 +4568,7 @@ match("MESSAGE#186:00008:07", "nwparser.payload", "%{signame->} has been detecte var msg188 = msg("00008:07", part306); -var part307 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part307 = match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup3, @@ -5156,8 +4580,7 @@ match("MESSAGE#187:00008:08", "nwparser.payload", "%{signame->} From %{saddr->} var msg189 = msg("00008:08", part307); -var part308 = // "Pattern{Constant('system clock is changed manually'), Field(,false)}" -match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ +var part308 = match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manually%{}", processor_chain([ dup1, dup2, dup3, @@ -5167,13 +4590,12 @@ match("MESSAGE#188:00008:09", "nwparser.payload", "system clock is changed manua var msg190 = msg("00008:09", part308); -var part309 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,false), Constant('(zone '), Field(p0,false)}" -match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); +var part309 = match("MESSAGE#189:00008:10/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol}(zone %{p0}"); var all58 = all_match({ processors: [ part309, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -5204,8 +4626,7 @@ var select66 = linear_select([ msg191, ]); -var part310 = // "Pattern{Constant('802.1Q VLAN trunking for the interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ +var part310 = match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the interface %{interface->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5215,8 +4636,7 @@ match("MESSAGE#190:00009", "nwparser.payload", "802.1Q VLAN trunking for the int var msg192 = msg("00009", part310); -var part311 = // "Pattern{Constant('802.1Q VLAN tag '), Field(fld1,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ +var part311 = match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5226,8 +4646,7 @@ match("MESSAGE#191:00009:01", "nwparser.payload", "802.1Q VLAN tag %{fld1->} has var msg193 = msg("00009:01", part311); -var part312 = // "Pattern{Constant('DHCP on the interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ +var part312 = match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{interface->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5237,8 +4656,7 @@ match("MESSAGE#192:00009:02", "nwparser.payload", "DHCP on the interface %{inter var msg194 = msg("00009:02", part312); -var part313 = // "Pattern{Field(change_attribute,true), Constant(' for interface '), Field(interface,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part313 = match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for interface %{interface->} has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -5248,8 +4666,7 @@ match("MESSAGE#193:00009:03", "nwparser.payload", "%{change_attribute->} for int var msg195 = msg("00009:03", part313); -var part314 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part314 = match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -5261,11 +4678,9 @@ match("MESSAGE#194:00009:05", "nwparser.payload", "%{signame->} has been detecte var msg196 = msg("00009:05", part314); -var part315 = // "Pattern{Field(fld2,false), Constant(': The 802.1Q tag '), Field(p0,false)}" -match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); +var part315 = match("MESSAGE#195:00009:06/0_0", "nwparser.payload", "%{fld2}: The 802.1Q tag %{p0}"); -var part316 = // "Pattern{Constant('The 802.1Q tag '), Field(p0,false)}" -match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); +var part316 = match("MESSAGE#195:00009:06/0_1", "nwparser.payload", "The 802.1Q tag %{p0}"); var select67 = linear_select([ part315, @@ -5277,22 +4692,18 @@ var select68 = linear_select([ dup16, ]); -var part317 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); +var part317 = match("MESSAGE#195:00009:06/3", "nwparser.p0", "interface %{interface->} has been %{p0}"); -var part318 = // "Pattern{Constant('changed to '), Field(p0,false)}" -match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); +var part318 = match("MESSAGE#195:00009:06/4_1", "nwparser.p0", "changed to %{p0}"); var select69 = linear_select([ dup120, part318, ]); -var part319 = // "Pattern{Field(info,true), Constant(' from host '), Field(saddr,false)}" -match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); +var part319 = match("MESSAGE#195:00009:06/6_0", "nwparser.p0", "%{info->} from host %{saddr}"); -var part320 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); +var part320 = match_copy("MESSAGE#195:00009:06/6_1", "nwparser.p0", "info"); var select70 = linear_select([ part319, @@ -5320,30 +4731,25 @@ var all59 = all_match({ var msg197 = msg("00009:06", all59); -var part321 = // "Pattern{Constant('Maximum bandwidth '), Field(fld2,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); +var part321 = match("MESSAGE#196:00009:07/0", "nwparser.payload", "Maximum bandwidth %{fld2->} on %{p0}"); -var part322 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is less than t'), Field(p0,false)}" -match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); +var part322 = match("MESSAGE#196:00009:07/2", "nwparser.p0", "%{} %{interface->} is less than t%{p0}"); -var part323 = // "Pattern{Constant('he total '), Field(p0,false)}" -match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); +var part323 = match("MESSAGE#196:00009:07/3_0", "nwparser.p0", "he total %{p0}"); -var part324 = // "Pattern{Constant('otal '), Field(p0,false)}" -match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); +var part324 = match("MESSAGE#196:00009:07/3_1", "nwparser.p0", "otal %{p0}"); var select71 = linear_select([ part323, part324, ]); -var part325 = // "Pattern{Constant('guaranteed bandwidth '), Field(fld3,false)}" -match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); +var part325 = match("MESSAGE#196:00009:07/4", "nwparser.p0", "guaranteed bandwidth %{fld3}"); var all60 = all_match({ processors: [ part321, - dup339, + dup337, part322, select71, part325, @@ -5359,8 +4765,7 @@ var all60 = all_match({ var msg198 = msg("00009:07", all60); -var part326 = // "Pattern{Constant('The configured bandwidth setting on the interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,false)}" -match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ +var part326 = match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth setting on the interface %{interface->} has been changed to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -5370,14 +4775,11 @@ match("MESSAGE#197:00009:09", "nwparser.payload", "The configured bandwidth sett var msg199 = msg("00009:09", part326); -var part327 = // "Pattern{Constant('The operational mode for the interface '), Field(interface,true), Constant(' has been changed to '), Field(p0,false)}" -match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); +var part327 = match("MESSAGE#198:00009:10/0", "nwparser.payload", "The operational mode for the interface %{interface->} has been changed to %{p0}"); -var part328 = // "Pattern{Constant('Route'), Field(,false)}" -match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); +var part328 = match("MESSAGE#198:00009:10/1_0", "nwparser.p0", "Route%{}"); -var part329 = // "Pattern{Constant('NAT'), Field(,false)}" -match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); +var part329 = match("MESSAGE#198:00009:10/1_1", "nwparser.p0", "NAT%{}"); var select72 = linear_select([ part328, @@ -5400,19 +4802,16 @@ var all61 = all_match({ var msg200 = msg("00009:10", all61); -var part330 = // "Pattern{Field(fld1,false), Constant(': VLAN '), Field(p0,false)}" -match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); +var part330 = match("MESSAGE#199:00009:11/0_0", "nwparser.payload", "%{fld1}: VLAN %{p0}"); -var part331 = // "Pattern{Constant('VLAN '), Field(p0,false)}" -match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); +var part331 = match("MESSAGE#199:00009:11/0_1", "nwparser.payload", "VLAN %{p0}"); var select73 = linear_select([ part330, part331, ]); -var part332 = // "Pattern{Constant('tag '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); +var part332 = match("MESSAGE#199:00009:11/1", "nwparser.p0", "tag %{fld2->} has been %{disposition}"); var all62 = all_match({ processors: [ @@ -5430,8 +4829,7 @@ var all62 = all_match({ var msg201 = msg("00009:11", all62); -var part333 = // "Pattern{Constant('DHCP client has been '), Field(disposition,true), Constant(' on interface '), Field(interface,false)}" -match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ +var part333 = match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{disposition->} on interface %{interface}", processor_chain([ dup1, dup2, dup3, @@ -5441,8 +4839,7 @@ match("MESSAGE#200:00009:12", "nwparser.payload", "DHCP client has been %{dispos var msg202 = msg("00009:12", part333); -var part334 = // "Pattern{Constant('DHCP relay agent settings on '), Field(interface,true), Constant(' have been '), Field(disposition,false)}" -match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ +var part334 = match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on %{interface->} have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5452,14 +4849,11 @@ match("MESSAGE#201:00009:13", "nwparser.payload", "DHCP relay agent settings on var msg203 = msg("00009:13", part334); -var part335 = // "Pattern{Constant('Global-PRO has been '), Field(p0,false)}" -match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); +var part335 = match("MESSAGE#202:00009:14/0_0", "nwparser.payload", "Global-PRO has been %{p0}"); -var part336 = // "Pattern{Constant('Global PRO has been '), Field(p0,false)}" -match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); +var part336 = match("MESSAGE#202:00009:14/0_1", "nwparser.payload", "Global PRO has been %{p0}"); -var part337 = // "Pattern{Constant('DNS proxy was '), Field(p0,false)}" -match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); +var part337 = match("MESSAGE#202:00009:14/0_2", "nwparser.payload", "DNS proxy was %{p0}"); var select74 = linear_select([ part335, @@ -5467,16 +4861,14 @@ var select74 = linear_select([ part337, ]); -var part338 = // "Pattern{Constant(''), Field(disposition,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); +var part338 = match("MESSAGE#202:00009:14/1", "nwparser.p0", "%{disposition->} on %{p0}"); var select75 = linear_select([ dup122, dup123, ]); -var part339 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); +var part339 = match("MESSAGE#202:00009:14/4_0", "nwparser.p0", "%{interface->} (%{fld2})"); var select76 = linear_select([ part339, @@ -5502,11 +4894,9 @@ var all63 = all_match({ var msg204 = msg("00009:14", all63); -var part340 = // "Pattern{Constant('Route between secondary IP'), Field(p0,false)}" -match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); +var part340 = match("MESSAGE#203:00009:15/0", "nwparser.payload", "Route between secondary IP%{p0}"); -var part341 = // "Pattern{Constant(' addresses '), Field(p0,false)}" -match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); +var part341 = match("MESSAGE#203:00009:15/1_0", "nwparser.p0", " addresses %{p0}"); var select77 = linear_select([ part341, @@ -5518,7 +4908,7 @@ var all64 = all_match({ part340, select77, dup126, - dup352, + dup350, dup128, ], on_success: processor_chain([ @@ -5532,11 +4922,9 @@ var all64 = all_match({ var msg205 = msg("00009:15", all64); -var part342 = // "Pattern{Constant('Secondary IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); +var part342 = match("MESSAGE#204:00009:16/0", "nwparser.payload", "Secondary IP address %{hostip}/%{mask->} %{p0}"); -var part343 = // "Pattern{Constant('deleted from '), Field(p0,false)}" -match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); +var part343 = match("MESSAGE#204:00009:16/3_2", "nwparser.p0", "deleted from %{p0}"); var select78 = linear_select([ dup129, @@ -5544,13 +4932,12 @@ var select78 = linear_select([ part343, ]); -var part344 = // "Pattern{Constant('interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); +var part344 = match("MESSAGE#204:00009:16/4", "nwparser.p0", "interface %{interface}."); var all65 = all_match({ processors: [ part342, - dup352, + dup350, dup23, select78, part344, @@ -5566,22 +4953,18 @@ var all65 = all_match({ var msg206 = msg("00009:16", all65); -var part345 = // "Pattern{Constant('Secondary IP address '), Field(p0,false)}" -match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); +var part345 = match("MESSAGE#205:00009:17/0", "nwparser.payload", "Secondary IP address %{p0}"); -var part346 = // "Pattern{Field(hostip,false), Constant('/'), Field(mask,true), Constant(' was added to interface '), Field(p0,false)}" -match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); +var part346 = match("MESSAGE#205:00009:17/1_0", "nwparser.p0", "%{hostip}/%{mask->} was added to interface %{p0}"); -var part347 = // "Pattern{Field(hostip,true), Constant(' was added to interface '), Field(p0,false)}" -match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); +var part347 = match("MESSAGE#205:00009:17/1_1", "nwparser.p0", "%{hostip->} was added to interface %{p0}"); var select79 = linear_select([ part346, part347, ]); -var part348 = // "Pattern{Field(interface,false), Constant('.')}" -match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); +var part348 = match("MESSAGE#205:00009:17/2", "nwparser.p0", "%{interface}."); var all66 = all_match({ processors: [ @@ -5600,8 +4983,7 @@ var all66 = all_match({ var msg207 = msg("00009:17", all66); -var part349 = // "Pattern{Constant('The configured bandwidth on the interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,false)}" -match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ +var part349 = match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on the interface %{interface->} has been changed to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -5611,8 +4993,7 @@ match("MESSAGE#206:00009:18", "nwparser.payload", "The configured bandwidth on t var msg208 = msg("00009:18", part349); -var part350 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ +var part350 = match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5622,8 +5003,7 @@ match("MESSAGE#207:00009:19", "nwparser.payload", "interface %{interface->} with var msg209 = msg("00009:19", part350); -var part351 = // "Pattern{Constant('interface '), Field(interface,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ +var part351 = match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5633,31 +5013,24 @@ match("MESSAGE#208:00009:27", "nwparser.payload", "interface %{interface->} has var msg210 = msg("00009:27", part351); -var part352 = // "Pattern{Field(fld2,false), Constant(': '), Field(service,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); +var part352 = match("MESSAGE#209:00009:20/0_0", "nwparser.payload", "%{fld2}: %{service->} has been %{p0}"); -var part353 = // "Pattern{Field(service,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); +var part353 = match("MESSAGE#209:00009:20/0_1", "nwparser.payload", "%{service->} has been %{p0}"); var select80 = linear_select([ part352, part353, ]); -var part354 = // "Pattern{Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); +var part354 = match("MESSAGE#209:00009:20/1", "nwparser.p0", "%{disposition->} on interface %{interface->} %{p0}"); -var part355 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false)}" -match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); +var part355 = match("MESSAGE#209:00009:20/2_0", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}"); -var part356 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); +var part356 = match("MESSAGE#209:00009:20/2_1", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}:%{sport}"); -var part357 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false)}" -match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); +var part357 = match("MESSAGE#209:00009:20/2_2", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr}"); -var part358 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); +var part358 = match("MESSAGE#209:00009:20/2_3", "nwparser.p0", "from host %{saddr->} (%{fld1})"); var select81 = linear_select([ part355, @@ -5684,13 +5057,12 @@ var all67 = all_match({ var msg211 = msg("00009:20", all67); -var part359 = // "Pattern{Constant('Source Route IP option! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part359 = match("MESSAGE#210:00009:21/0", "nwparser.payload", "Source Route IP option! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); var all68 = all_match({ processors: [ part359, - dup345, + dup343, dup131, ], on_success: processor_chain([ @@ -5707,8 +5079,7 @@ var all68 = all_match({ var msg212 = msg("00009:21", all68); -var part360 = // "Pattern{Constant('MTU for interface '), Field(interface,true), Constant(' has been changed to '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ +var part360 = match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface->} has been changed to %{fld2->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -5719,8 +5090,7 @@ match("MESSAGE#211:00009:22", "nwparser.payload", "MTU for interface %{interface var msg213 = msg("00009:22", part360); -var part361 = // "Pattern{Constant('Secondary IP address '), Field(hostip,true), Constant(' has been added to interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ +var part361 = match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip->} has been added to interface %{interface->} (%{fld1})", processor_chain([ dup44, dup2, dup9, @@ -5731,22 +5101,18 @@ match("MESSAGE#212:00009:23", "nwparser.payload", "Secondary IP address %{hostip var msg214 = msg("00009:23", part361); -var part362 = // "Pattern{Constant('Web has been enabled on interface '), Field(interface,true), Constant(' by admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); +var part362 = match("MESSAGE#213:00009:24/0", "nwparser.payload", "Web has been enabled on interface %{interface->} by admin %{administrator->} via %{p0}"); -var part363 = // "Pattern{Field(logon_type,true), Constant(' '), Field(space,false), Constant('('), Field(p0,false)}" -match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); +var part363 = match("MESSAGE#213:00009:24/1_0", "nwparser.p0", "%{logon_type->} %{space}(%{p0}"); -var part364 = // "Pattern{Field(logon_type,false), Constant('. ('), Field(p0,false)}" -match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); +var part364 = match("MESSAGE#213:00009:24/1_1", "nwparser.p0", "%{logon_type}. (%{p0}"); var select82 = linear_select([ part363, part364, ]); -var part365 = // "Pattern{Constant(')'), Field(fld1,false)}" -match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); +var part365 = match("MESSAGE#213:00009:24/2", "nwparser.p0", ")%{fld1}"); var all69 = all_match({ processors: [ @@ -5766,8 +5132,7 @@ var all69 = all_match({ var msg215 = msg("00009:24", all69); -var part366 = // "Pattern{Constant('Web has been enabled on interface '), Field(interface,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ +var part366 = match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on interface %{interface->} by %{username->} via %{logon_type}. (%{fld1})", processor_chain([ dup1, dup2, dup9, @@ -5778,13 +5143,12 @@ match("MESSAGE#214:00009:25", "nwparser.payload", "Web has been enabled on inter var msg216 = msg("00009:25", part366); -var part367 = // "Pattern{Field(protocol,true), Constant(' has been '), Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' by '), Field(username,true), Constant(' via NSRP Peer . '), Field(p0,false)}" -match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); +var part367 = match("MESSAGE#215:00009:26/0", "nwparser.payload", "%{protocol->} has been %{disposition->} on interface %{interface->} by %{username->} via NSRP Peer . %{p0}"); var all70 = all_match({ processors: [ part367, - dup335, + dup333, ], on_success: processor_chain([ dup1, @@ -5827,28 +5191,22 @@ var select83 = linear_select([ msg217, ]); -var part368 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); +var part368 = match("MESSAGE#216:00010/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} %{p0}"); -var part369 = // "Pattern{Constant('using protocol '), Field(p0,false)}" -match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); +var part369 = match("MESSAGE#216:00010/1_0", "nwparser.p0", "using protocol %{p0}"); -var part370 = // "Pattern{Constant('proto '), Field(p0,false)}" -match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); +var part370 = match("MESSAGE#216:00010/1_1", "nwparser.p0", "proto %{p0}"); var select84 = linear_select([ part369, part370, ]); -var part371 = // "Pattern{Constant(''), Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); +var part371 = match("MESSAGE#216:00010/2", "nwparser.p0", "%{protocol->} %{p0}"); -var part372 = // "Pattern{Constant('( zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); +var part372 = match("MESSAGE#216:00010/3_0", "nwparser.p0", "( zone %{zone}, int %{interface}) %{p0}"); -var part373 = // "Pattern{Constant('zone '), Field(zone,true), Constant(' int '), Field(interface,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); +var part373 = match("MESSAGE#216:00010/3_1", "nwparser.p0", "zone %{zone->} int %{interface}) %{p0}"); var select85 = linear_select([ part372, @@ -5856,8 +5214,7 @@ var select85 = linear_select([ dup126, ]); -var part374 = // "Pattern{Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times'), Field(p0,false)}" -match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); +var part374 = match("MESSAGE#216:00010/4", "nwparser.p0", ".%{space}The attack occurred %{dclass_counter1->} times%{p0}"); var all71 = all_match({ processors: [ @@ -5866,7 +5223,7 @@ var all71 = all_match({ part371, select85, part374, - dup353, + dup351, ], on_success: processor_chain([ dup58, @@ -5882,8 +5239,7 @@ var all71 = all_match({ var msg218 = msg("00010", all71); -var part375 = // "Pattern{Constant('MIP '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ +var part375 = match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5893,8 +5249,7 @@ match("MESSAGE#217:00010:01", "nwparser.payload", "MIP %{hostip}/%{fld2->} has b var msg219 = msg("00010:01", part375); -var part376 = // "Pattern{Constant('Mapped IP '), Field(hostip,true), Constant(' '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ +var part376 = match("MESSAGE#218:00010:02", "nwparser.payload", "Mapped IP %{hostip->} %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -5907,7 +5262,7 @@ var msg220 = msg("00010:02", part376); var all72 = all_match({ processors: [ dup132, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -5931,8 +5286,7 @@ var select86 = linear_select([ msg221, ]); -var part377 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part377 = match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -5944,16 +5298,14 @@ match("MESSAGE#220:00011", "nwparser.payload", "%{signame->} From %{saddr}:%{spo var msg222 = msg("00011", part377); -var part378 = // "Pattern{Constant('Route to '), Field(daddr,false), Constant('/'), Field(fld2,true), Constant(' [ '), Field(p0,false)}" -match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); +var part378 = match("MESSAGE#221:00011:01/0", "nwparser.payload", "Route to %{daddr}/%{fld2->} [ %{p0}"); var select87 = linear_select([ dup57, dup56, ]); -var part379 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' gateway '), Field(fld3,true), Constant(' ] has been '), Field(disposition,false)}" -match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); +var part379 = match("MESSAGE#221:00011:01/2", "nwparser.p0", "%{} %{interface->} gateway %{fld3->} ] has been %{disposition}"); var all73 = all_match({ processors: [ @@ -5972,8 +5324,7 @@ var all73 = all_match({ var msg223 = msg("00011:01", all73); -var part380 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ +var part380 = match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} to %{daddr->} protocol %{protocol->} (%{fld2})", processor_chain([ dup58, dup2, dup3, @@ -5983,28 +5334,22 @@ match("MESSAGE#222:00011:02", "nwparser.payload", "%{signame->} from %{saddr->} var msg224 = msg("00011:02", part380); -var part381 = // "Pattern{Constant('An '), Field(p0,false)}" -match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); +var part381 = match("MESSAGE#223:00011:03/0", "nwparser.payload", "An %{p0}"); -var part382 = // "Pattern{Constant('import '), Field(p0,false)}" -match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); +var part382 = match("MESSAGE#223:00011:03/1_0", "nwparser.p0", "import %{p0}"); -var part383 = // "Pattern{Constant('export '), Field(p0,false)}" -match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); +var part383 = match("MESSAGE#223:00011:03/1_1", "nwparser.p0", "export %{p0}"); var select88 = linear_select([ part382, part383, ]); -var part384 = // "Pattern{Constant('rule in virtual router '), Field(node,true), Constant(' to virtual router '), Field(fld4,true), Constant(' with '), Field(p0,false)}" -match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); +var part384 = match("MESSAGE#223:00011:03/2", "nwparser.p0", "rule in virtual router %{node->} to virtual router %{fld4->} with %{p0}"); -var part385 = // "Pattern{Constant('route-map '), Field(fld3,true), Constant(' and protocol '), Field(protocol,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); +var part385 = match("MESSAGE#223:00011:03/3_0", "nwparser.p0", "route-map %{fld3->} and protocol %{protocol->} has been %{p0}"); -var part386 = // "Pattern{Constant('IP-prefix '), Field(hostip,false), Constant('/'), Field(interface,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); +var part386 = match("MESSAGE#223:00011:03/3_1", "nwparser.p0", "IP-prefix %{hostip}/%{interface->} has been %{p0}"); var select89 = linear_select([ part385, @@ -6030,16 +5375,14 @@ var all74 = all_match({ var msg225 = msg("00011:03", all74); -var part387 = // "Pattern{Constant('A route in virtual router '), Field(node,true), Constant(' that has IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' through '), Field(p0,false)}" -match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); +var part387 = match("MESSAGE#224:00011:04/0", "nwparser.payload", "A route in virtual router %{node->} that has IP address %{hostip}/%{fld2->} through %{p0}"); -var part388 = // "Pattern{Constant(''), Field(interface,true), Constant(' and gateway '), Field(fld3,true), Constant(' with metric '), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); +var part388 = match("MESSAGE#224:00011:04/2", "nwparser.p0", "%{interface->} and gateway %{fld3->} with metric %{fld4->} has been %{disposition}"); var all75 = all_match({ processors: [ part387, - dup354, + dup352, part388, ], on_success: processor_chain([ @@ -6053,19 +5396,16 @@ var all75 = all_match({ var msg226 = msg("00011:04", all75); -var part389 = // "Pattern{Constant('sharable virtual router using name'), Field(p0,false)}" -match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); +var part389 = match("MESSAGE#225:00011:05/1_0", "nwparser.p0", "sharable virtual router using name%{p0}"); -var part390 = // "Pattern{Constant('virtual router with name'), Field(p0,false)}" -match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); +var part390 = match("MESSAGE#225:00011:05/1_1", "nwparser.p0", "virtual router with name%{p0}"); var select90 = linear_select([ part389, part390, ]); -var part391 = // "Pattern{Field(,true), Constant(' '), Field(node,true), Constant(' and id '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); +var part391 = match("MESSAGE#225:00011:05/2", "nwparser.p0", "%{} %{node->} and id %{fld2->} has been %{disposition}"); var all76 = all_match({ processors: [ @@ -6084,8 +5424,7 @@ var all76 = all_match({ var msg227 = msg("00011:05", all76); -var part392 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part392 = match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup4, @@ -6097,8 +5436,7 @@ match("MESSAGE#226:00011:07", "nwparser.payload", "%{signame->} From %{saddr->} var msg228 = msg("00011:07", part392); -var part393 = // "Pattern{Constant('Route(s) in virtual router '), Field(node,true), Constant(' with an IP address '), Field(hostip,true), Constant(' and gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ +var part393 = match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{node->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6108,8 +5446,7 @@ match("MESSAGE#227:00011:08", "nwparser.payload", "Route(s) in virtual router %{ var msg229 = msg("00011:08", part393); -var part394 = // "Pattern{Constant('The auto-route-export feature in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ +var part394 = match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature in virtual router %{node->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6119,8 +5456,7 @@ match("MESSAGE#228:00011:09", "nwparser.payload", "The auto-route-export feature var msg230 = msg("00011:09", part394); -var part395 = // "Pattern{Constant('The maximum number of routes that can be created in virtual router '), Field(node,true), Constant(' is '), Field(fld2,false)}" -match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ +var part395 = match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes that can be created in virtual router %{node->} is %{fld2}", processor_chain([ dup44, dup2, dup3, @@ -6130,8 +5466,7 @@ match("MESSAGE#229:00011:10", "nwparser.payload", "The maximum number of routes var msg231 = msg("00011:10", part395); -var part396 = // "Pattern{Constant('The maximum routes limit in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ +var part396 = match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in virtual router %{node->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6141,8 +5476,7 @@ match("MESSAGE#230:00011:11", "nwparser.payload", "The maximum routes limit in v var msg232 = msg("00011:11", part396); -var part397 = // "Pattern{Constant('The router-id of virtual router '), Field(node,true), Constant(' used by OSPF BGP routing instances id has been uninitialized')}" -match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ +var part397 = match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual router %{node->} used by OSPF BGP routing instances id has been uninitialized", processor_chain([ dup1, dup2, dup3, @@ -6152,8 +5486,7 @@ match("MESSAGE#231:00011:12", "nwparser.payload", "The router-id of virtual rout var msg233 = msg("00011:12", part397); -var part398 = // "Pattern{Constant('The router-id that can be used by OSPF BGP routing instances in virtual router '), Field(node,true), Constant(' has been set to '), Field(fld2,false)}" -match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ +var part398 = match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be used by OSPF BGP routing instances in virtual router %{node->} has been set to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -6163,11 +5496,9 @@ match("MESSAGE#232:00011:13", "nwparser.payload", "The router-id that can be use var msg234 = msg("00011:13", part398); -var part399 = // "Pattern{Constant('The routing preference for protocol '), Field(protocol,true), Constant(' in virtual router '), Field(node,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); +var part399 = match("MESSAGE#233:00011:14/0", "nwparser.payload", "The routing preference for protocol %{protocol->} in virtual router %{node->} has been %{p0}"); -var part400 = // "Pattern{Constant('reset'), Field(,false)}" -match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); +var part400 = match("MESSAGE#233:00011:14/1_1", "nwparser.p0", "reset%{}"); var select91 = linear_select([ dup134, @@ -6190,8 +5521,7 @@ var all77 = all_match({ var msg235 = msg("00011:14", all77); -var part401 = // "Pattern{Constant('The system default-route in virtual router '), Field(node,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ +var part401 = match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in virtual router %{node->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6201,8 +5531,7 @@ match("MESSAGE#234:00011:15", "nwparser.payload", "The system default-route in v var msg236 = msg("00011:15", part401); -var part402 = // "Pattern{Constant('The system default-route through virtual router '), Field(node,true), Constant(' has been added in virtual router '), Field(fld2,false)}" -match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ +var part402 = match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route through virtual router %{node->} has been added in virtual router %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -6212,17 +5541,13 @@ match("MESSAGE#235:00011:16", "nwparser.payload", "The system default-route thro var msg237 = msg("00011:16", part402); -var part403 = // "Pattern{Constant('The virtual router '), Field(node,true), Constant(' has been made '), Field(p0,false)}" -match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); +var part403 = match("MESSAGE#236:00011:17/0", "nwparser.payload", "The virtual router %{node->} has been made %{p0}"); -var part404 = // "Pattern{Constant('sharable'), Field(,false)}" -match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); +var part404 = match("MESSAGE#236:00011:17/1_0", "nwparser.p0", "sharable%{}"); -var part405 = // "Pattern{Constant('unsharable'), Field(,false)}" -match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); +var part405 = match("MESSAGE#236:00011:17/1_1", "nwparser.p0", "unsharable%{}"); -var part406 = // "Pattern{Constant('default virtual router for virtual system '), Field(fld2,false)}" -match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); +var part406 = match("MESSAGE#236:00011:17/1_2", "nwparser.p0", "default virtual router for virtual system %{fld2}"); var select92 = linear_select([ part404, @@ -6246,44 +5571,36 @@ var all78 = all_match({ var msg238 = msg("00011:17", all78); -var part407 = // "Pattern{Constant('Source route(s) '), Field(p0,false)}" -match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); +var part407 = match("MESSAGE#237:00011:18/0_0", "nwparser.payload", "Source route(s) %{p0}"); -var part408 = // "Pattern{Constant('A source route '), Field(p0,false)}" -match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); +var part408 = match("MESSAGE#237:00011:18/0_1", "nwparser.payload", "A source route %{p0}"); var select93 = linear_select([ part407, part408, ]); -var part409 = // "Pattern{Constant('in virtual router '), Field(node,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); +var part409 = match("MESSAGE#237:00011:18/1", "nwparser.p0", "in virtual router %{node->} %{p0}"); -var part410 = // "Pattern{Constant('with route addresses of '), Field(p0,false)}" -match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); +var part410 = match("MESSAGE#237:00011:18/2_0", "nwparser.p0", "with route addresses of %{p0}"); -var part411 = // "Pattern{Constant('that has IP address '), Field(p0,false)}" -match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); +var part411 = match("MESSAGE#237:00011:18/2_1", "nwparser.p0", "that has IP address %{p0}"); var select94 = linear_select([ part410, part411, ]); -var part412 = // "Pattern{Constant(''), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' through interface '), Field(interface,true), Constant(' and '), Field(p0,false)}" -match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); +var part412 = match("MESSAGE#237:00011:18/3", "nwparser.p0", "%{hostip}/%{fld2->} through interface %{interface->} and %{p0}"); -var part413 = // "Pattern{Constant('a default gateway address '), Field(p0,false)}" -match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); +var part413 = match("MESSAGE#237:00011:18/4_0", "nwparser.p0", "a default gateway address %{p0}"); var select95 = linear_select([ part413, dup135, ]); -var part414 = // "Pattern{Constant(''), Field(fld3,true), Constant(' with metric '), Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); +var part414 = match("MESSAGE#237:00011:18/5", "nwparser.p0", "%{fld3->} with metric %{fld4->} %{p0}"); var all79 = all_match({ processors: [ @@ -6293,7 +5610,7 @@ var all79 = all_match({ part412, select95, part414, - dup352, + dup350, dup128, ], on_success: processor_chain([ @@ -6307,36 +5624,29 @@ var all79 = all_match({ var msg239 = msg("00011:18", all79); -var part415 = // "Pattern{Constant('Source Route(s) in virtual router '), Field(node,true), Constant(' with '), Field(p0,false)}" -match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); +var part415 = match("MESSAGE#238:00011:19/0", "nwparser.payload", "Source Route(s) in virtual router %{node->} with %{p0}"); -var part416 = // "Pattern{Constant('route addresses of '), Field(p0,false)}" -match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); +var part416 = match("MESSAGE#238:00011:19/1_0", "nwparser.p0", "route addresses of %{p0}"); -var part417 = // "Pattern{Constant('an IP address '), Field(p0,false)}" -match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); +var part417 = match("MESSAGE#238:00011:19/1_1", "nwparser.p0", "an IP address %{p0}"); var select96 = linear_select([ part416, part417, ]); -var part418 = // "Pattern{Constant(''), Field(hostip,false), Constant('/'), Field(fld3,true), Constant(' and '), Field(p0,false)}" -match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); +var part418 = match("MESSAGE#238:00011:19/2", "nwparser.p0", "%{hostip}/%{fld3->} and %{p0}"); -var part419 = // "Pattern{Constant('a default gateway address of '), Field(p0,false)}" -match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); +var part419 = match("MESSAGE#238:00011:19/3_0", "nwparser.p0", "a default gateway address of %{p0}"); var select97 = linear_select([ part419, dup135, ]); -var part420 = // "Pattern{Constant(''), Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); +var part420 = match("MESSAGE#238:00011:19/4", "nwparser.p0", "%{fld4->} %{p0}"); -var part421 = // "Pattern{Constant('has been'), Field(p0,false)}" -match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); +var part421 = match("MESSAGE#238:00011:19/5_1", "nwparser.p0", "has been%{p0}"); var select98 = linear_select([ dup107, @@ -6364,16 +5674,14 @@ var all80 = all_match({ var msg240 = msg("00011:19", all80); -var part422 = // "Pattern{Field(fld2,false), Constant(': A '), Field(p0,false)}" -match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); +var part422 = match("MESSAGE#239:00011:20/0_0", "nwparser.payload", "%{fld2}: A %{p0}"); var select99 = linear_select([ part422, dup79, ]); -var part423 = // "Pattern{Constant('route has been created in virtual router "'), Field(node,false), Constant('"'), Field(space,false), Constant('with an IP address '), Field(hostip,true), Constant(' and next-hop as virtual router "'), Field(fld3,false), Constant('"')}" -match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); +var part423 = match("MESSAGE#239:00011:20/1", "nwparser.p0", "route has been created in virtual router \"%{node}\"%{space}with an IP address %{hostip->} and next-hop as virtual router \"%{fld3}\""); var all81 = all_match({ processors: [ @@ -6391,8 +5699,7 @@ var all81 = all_match({ var msg241 = msg("00011:20", all81); -var part424 = // "Pattern{Constant('SIBR route(s) in virtual router '), Field(node,true), Constant(' for interface '), Field(interface,true), Constant(' with an IP address '), Field(hostip,true), Constant(' and gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ +var part424 = match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual router %{node->} for interface %{interface->} with an IP address %{hostip->} and gateway %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6402,8 +5709,7 @@ match("MESSAGE#240:00011:21", "nwparser.payload", "SIBR route(s) in virtual rout var msg242 = msg("00011:21", part424); -var part425 = // "Pattern{Constant('SIBR route in virtual router '), Field(node,true), Constant(' for interface '), Field(interface,true), Constant(' that has IP address '), Field(hostip,true), Constant(' through interface '), Field(fld3,true), Constant(' and gateway '), Field(fld4,true), Constant(' with metric '), Field(fld5,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ +var part425 = match("MESSAGE#241:00011:22", "nwparser.payload", "SIBR route in virtual router %{node->} for interface %{interface->} that has IP address %{hostip->} through interface %{fld3->} and gateway %{fld4->} with metric %{fld5->} was %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6416,7 +5722,7 @@ var msg243 = msg("00011:22", part425); var all82 = all_match({ processors: [ dup132, - dup345, + dup343, dup131, ], on_success: processor_chain([ @@ -6441,8 +5747,7 @@ var all82 = all_match({ var msg244 = msg("00011:23", all82); -var part426 = // "Pattern{Constant('Route in virtual router "'), Field(node,false), Constant('" that has IP address '), Field(hostip,true), Constant(' through interface '), Field(interface,true), Constant(' and gateway '), Field(fld2,true), Constant(' with metric '), Field(fld3,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ +var part426 = match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{node}\" that has IP address %{hostip->} through interface %{interface->} and gateway %{fld2->} with metric %{fld3->} %{disposition}. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -6453,8 +5758,7 @@ match("MESSAGE#243:00011:24", "nwparser.payload", "Route in virtual router \"%{n var msg245 = msg("00011:24", part426); -var part427 = // "Pattern{Constant('Route(s) in virtual router "'), Field(node,false), Constant('" with an IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' and gateway '), Field(fld3,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ +var part427 = match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \"%{node}\" with an IP address %{hostip}/%{fld2->} and gateway %{fld3->} %{disposition}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -6465,8 +5769,7 @@ match("MESSAGE#244:00011:25", "nwparser.payload", "Route(s) in virtual router \" var msg246 = msg("00011:25", part427); -var part428 = // "Pattern{Constant('Route in virtual router "'), Field(node,false), Constant('" with IP address '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' and next-hop as virtual router "'), Field(fld3,false), Constant('" created. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ +var part428 = match("MESSAGE#245:00011:26", "nwparser.payload", "Route in virtual router \"%{node}\" with IP address %{hostip}/%{fld2->} and next-hop as virtual router \"%{fld3}\" created. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -6506,8 +5809,7 @@ var select100 = linear_select([ msg247, ]); -var part429 = // "Pattern{Constant('Service group '), Field(group,true), Constant(' comments have been '), Field(disposition,false)}" -match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ +var part429 = match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comments have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6517,8 +5819,7 @@ match("MESSAGE#246:00012:02", "nwparser.payload", "Service group %{group->} comm var msg248 = msg("00012:02", part429); -var part430 = // "Pattern{Constant('Service group '), Field(change_old,true), Constant(' '), Field(change_attribute,true), Constant(' has been changed to '), Field(change_new,false)}" -match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ +var part430 = match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} %{change_attribute->} has been changed to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -6528,8 +5829,7 @@ match("MESSAGE#247:00012:03", "nwparser.payload", "Service group %{change_old->} var msg249 = msg("00012:03", part430); -var part431 = // "Pattern{Field(fld2,true), Constant(' Service group '), Field(group,true), Constant(' has '), Field(disposition,true), Constant(' member '), Field(username,true), Constant(' from host '), Field(saddr,false)}" -match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ +var part431 = match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{group->} has %{disposition->} member %{username->} from host %{saddr}", processor_chain([ dup1, dup2, dup3, @@ -6539,8 +5839,7 @@ match("MESSAGE#248:00012:04", "nwparser.payload", "%{fld2->} Service group %{gro var msg250 = msg("00012:04", part431); -var part432 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(') ('), Field(fld3,false), Constant(')')}" -match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ +var part432 = match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2}) (%{fld3})", processor_chain([ dup58, dup2, dup3, @@ -6551,8 +5850,7 @@ match("MESSAGE#249:00012:05", "nwparser.payload", "%{signame->} from %{saddr}/%{ var msg251 = msg("00012:05", part432); -var part433 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part433 = match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -6564,8 +5862,7 @@ match("MESSAGE#250:00012:06", "nwparser.payload", "%{signame->} has been detecte var msg252 = msg("00012:06", part433); -var part434 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part434 = match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -6577,8 +5874,7 @@ match("MESSAGE#251:00012:07", "nwparser.payload", "%{signame->} has been detecte var msg253 = msg("00012:07", part434); -var part435 = // "Pattern{Field(fld2,false), Constant(': Service '), Field(service,true), Constant(' has been '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ +var part435 = match("MESSAGE#252:00012:08", "nwparser.payload", "%{fld2}: Service %{service->} has been %{disposition->} from host %{saddr->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -6592,7 +5888,7 @@ var msg254 = msg("00012:08", part435); var all83 = all_match({ processors: [ dup80, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -6612,7 +5908,7 @@ var msg255 = msg("00012:09", all83); var all84 = all_match({ processors: [ dup132, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -6629,8 +5925,7 @@ var all84 = all_match({ var msg256 = msg("00012:10", all84); -var part436 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part436 = match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -6643,8 +5938,7 @@ match("MESSAGE#255:00012:11", "nwparser.payload", "%{signame->} From %{saddr}:%{ var msg257 = msg("00012:11", part436); -var part437 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(zone,false), Constant(') '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ +var part437 = match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{zone}) %{info->} (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -6655,8 +5949,7 @@ match("MESSAGE#256:00012:12", "nwparser.payload", "%{signame->} from %{saddr}/%{ var msg258 = msg("00012:12", part437); -var part438 = // "Pattern{Constant('Service group '), Field(group,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ +var part438 = match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6666,8 +5959,7 @@ match("MESSAGE#257:00012", "nwparser.payload", "Service group %{group->} has bee var msg259 = msg("00012", part438); -var part439 = // "Pattern{Constant('Service '), Field(service,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ +var part439 = match("MESSAGE#258:00012:01", "nwparser.payload", "Service %{service->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -6693,8 +5985,7 @@ var select101 = linear_select([ msg260, ]); -var part440 = // "Pattern{Constant('Global Manager error in decoding bytes has been detected'), Field(,false)}" -match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ +var part440 = match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding bytes has been detected%{}", processor_chain([ dup86, dup2, dup3, @@ -6704,8 +5995,7 @@ match("MESSAGE#259:00013", "nwparser.payload", "Global Manager error in decoding var msg261 = msg("00013", part440); -var part441 = // "Pattern{Constant('Intruder has attempted to connect to the NetScreen-Global Manager port! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part441 = match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to connect to the NetScreen-Global Manager port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -6718,8 +6008,7 @@ match("MESSAGE#260:00013:01", "nwparser.payload", "Intruder has attempted to con var msg262 = msg("00013:01", part441); -var part442 = // "Pattern{Constant('URL Filtering '), Field(fld2,true), Constant(' has been changed to '), Field(fld3,false)}" -match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ +var part442 = match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has been changed to %{fld3}", processor_chain([ dup1, dup2, dup3, @@ -6729,8 +6018,7 @@ match("MESSAGE#261:00013:02", "nwparser.payload", "URL Filtering %{fld2->} has b var msg263 = msg("00013:02", part442); -var part443 = // "Pattern{Constant('Web Filtering has been '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ +var part443 = match("MESSAGE#262:00013:03", "nwparser.payload", "Web Filtering has been %{disposition->} (%{fld1})", processor_chain([ dup50, dup43, dup51, @@ -6749,8 +6037,7 @@ var select102 = linear_select([ msg264, ]); -var part444 = // "Pattern{Field(change_attribute,true), Constant(' in minutes has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ +var part444 = match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes has changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -6760,14 +6047,11 @@ match("MESSAGE#263:00014", "nwparser.payload", "%{change_attribute->} in minutes var msg265 = msg("00014", part444); -var part445 = // "Pattern{Constant('The group member '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); +var part445 = match("MESSAGE#264:00014:01/0", "nwparser.payload", "The group member %{username->} has been %{disposition->} %{p0}"); -var part446 = // "Pattern{Constant('to a group'), Field(,false)}" -match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); +var part446 = match("MESSAGE#264:00014:01/1_0", "nwparser.p0", "to a group%{}"); -var part447 = // "Pattern{Constant('from a group'), Field(,false)}" -match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); +var part447 = match("MESSAGE#264:00014:01/1_1", "nwparser.p0", "from a group%{}"); var select103 = linear_select([ part446, @@ -6790,8 +6074,7 @@ var all85 = all_match({ var msg266 = msg("00014:01", all85); -var part448 = // "Pattern{Constant('The user group '), Field(group,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,false)}" -match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ +var part448 = match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has been %{disposition->} by %{username}", processor_chain([ dup1, dup2, dup3, @@ -6801,8 +6084,7 @@ match("MESSAGE#265:00014:02", "nwparser.payload", "The user group %{group->} has var msg267 = msg("00014:02", part448); -var part449 = // "Pattern{Constant('The user '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(administrator,false)}" -match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ +var part449 = match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has been %{disposition->} by %{administrator}", processor_chain([ dup1, dup2, dup3, @@ -6812,8 +6094,7 @@ match("MESSAGE#266:00014:03", "nwparser.payload", "The user %{username->} has be var msg268 = msg("00014:03", part449); -var part450 = // "Pattern{Constant('Communication error with '), Field(hostname,true), Constant(' server { '), Field(hostip,true), Constant(' }: SrvErr ('), Field(fld2,false), Constant('), SockErr ('), Field(fld3,false), Constant('), Valid ('), Field(fld4,false), Constant('),Connected ('), Field(fld5,false), Constant(')')}" -match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ +var part450 = match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{hostname->} server { %{hostip->} }: SrvErr (%{fld2}), SockErr (%{fld3}), Valid (%{fld4}),Connected (%{fld5})", processor_chain([ dup19, dup2, dup3, @@ -6823,8 +6104,7 @@ match("MESSAGE#267:00014:04", "nwparser.payload", "Communication error with %{ho var msg269 = msg("00014:04", part450); -var part451 = // "Pattern{Constant('System clock configurations have been '), Field(disposition,true), Constant(' by admin '), Field(administrator,false)}" -match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ +var part451 = match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations have been %{disposition->} by admin %{administrator}", processor_chain([ dup1, dup2, dup3, @@ -6834,8 +6114,7 @@ match("MESSAGE#268:00014:05", "nwparser.payload", "System clock configurations h var msg270 = msg("00014:05", part451); -var part452 = // "Pattern{Constant('System clock is '), Field(disposition,true), Constant(' manually.')}" -match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ +var part452 = match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition->} manually.", processor_chain([ dup1, dup2, dup3, @@ -6845,8 +6124,7 @@ match("MESSAGE#269:00014:06", "nwparser.payload", "System clock is %{disposition var msg271 = msg("00014:06", part452); -var part453 = // "Pattern{Constant('System up time is '), Field(disposition,true), Constant(' by '), Field(fld2,false)}" -match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ +var part453 = match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{disposition->} by %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -6856,8 +6134,7 @@ match("MESSAGE#270:00014:07", "nwparser.payload", "System up time is %{dispositi var msg272 = msg("00014:07", part453); -var part454 = // "Pattern{Constant('Communication error with '), Field(hostname,true), Constant(' server['), Field(hostip,false), Constant(']: SrvErr('), Field(fld2,false), Constant('),SockErr('), Field(fld3,false), Constant('),Valid('), Field(fld4,false), Constant('),Connected('), Field(fld5,false), Constant(') ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ +var part454 = match("MESSAGE#271:00014:08", "nwparser.payload", "Communication error with %{hostname->} server[%{hostip}]: SrvErr(%{fld2}),SockErr(%{fld3}),Valid(%{fld4}),Connected(%{fld5}) (%{fld1})", processor_chain([ dup27, dup2, dup3, @@ -6880,8 +6157,7 @@ var select104 = linear_select([ msg273, ]); -var part455 = // "Pattern{Constant('Authentication type has been changed to '), Field(authmethod,false)}" -match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ +var part455 = match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been changed to %{authmethod}", processor_chain([ dup1, dup2, dup3, @@ -6891,8 +6167,7 @@ match("MESSAGE#272:00015", "nwparser.payload", "Authentication type has been cha var msg274 = msg("00015", part455); -var part456 = // "Pattern{Constant('IP tracking to '), Field(daddr,true), Constant(' has '), Field(disposition,false)}" -match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ +var part456 = match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has %{disposition}", processor_chain([ dup86, dup2, dup3, @@ -6902,17 +6177,13 @@ match("MESSAGE#273:00015:01", "nwparser.payload", "IP tracking to %{daddr->} has var msg275 = msg("00015:01", part456); -var part457 = // "Pattern{Constant('LDAP '), Field(p0,false)}" -match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); +var part457 = match("MESSAGE#274:00015:02/0", "nwparser.payload", "LDAP %{p0}"); -var part458 = // "Pattern{Constant('server name '), Field(p0,false)}" -match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); +var part458 = match("MESSAGE#274:00015:02/1_0", "nwparser.p0", "server name %{p0}"); -var part459 = // "Pattern{Constant('distinguished name '), Field(p0,false)}" -match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); +var part459 = match("MESSAGE#274:00015:02/1_2", "nwparser.p0", "distinguished name %{p0}"); -var part460 = // "Pattern{Constant('common name '), Field(p0,false)}" -match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); +var part460 = match("MESSAGE#274:00015:02/1_3", "nwparser.p0", "common name %{p0}"); var select105 = linear_select([ part458, @@ -6938,8 +6209,7 @@ var all86 = all_match({ var msg276 = msg("00015:02", all86); -var part461 = // "Pattern{Constant('Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link'), Field(,false)}" -match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ +var part461 = match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down. Local NetScreen device has begun using the secondary HA link%{}", processor_chain([ dup44, dup2, dup3, @@ -6949,11 +6219,9 @@ match("MESSAGE#275:00015:03", "nwparser.payload", "Primary HA link has gone down var msg277 = msg("00015:03", part461); -var part462 = // "Pattern{Constant('RADIUS server '), Field(p0,false)}" -match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); +var part462 = match("MESSAGE#276:00015:04/0", "nwparser.payload", "RADIUS server %{p0}"); -var part463 = // "Pattern{Constant('secret '), Field(p0,false)}" -match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); +var part463 = match("MESSAGE#276:00015:04/1_2", "nwparser.p0", "secret %{p0}"); var select106 = linear_select([ dup139, @@ -6978,17 +6246,13 @@ var all87 = all_match({ var msg278 = msg("00015:04", all87); -var part464 = // "Pattern{Constant('SecurID '), Field(p0,false)}" -match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); +var part464 = match("MESSAGE#277:00015:05/0", "nwparser.payload", "SecurID %{p0}"); -var part465 = // "Pattern{Constant('authentication port '), Field(p0,false)}" -match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); +var part465 = match("MESSAGE#277:00015:05/1_0", "nwparser.p0", "authentication port %{p0}"); -var part466 = // "Pattern{Constant('duress mode '), Field(p0,false)}" -match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); +var part466 = match("MESSAGE#277:00015:05/1_1", "nwparser.p0", "duress mode %{p0}"); -var part467 = // "Pattern{Constant('number of retries value '), Field(p0,false)}" -match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); +var part467 = match("MESSAGE#277:00015:05/1_3", "nwparser.p0", "number of retries value %{p0}"); var select107 = linear_select([ part465, @@ -7014,19 +6278,16 @@ var all88 = all_match({ var msg279 = msg("00015:05", all88); -var part468 = // "Pattern{Constant('Master '), Field(p0,false)}" -match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); +var part468 = match("MESSAGE#278:00015:06/0_0", "nwparser.payload", "Master %{p0}"); -var part469 = // "Pattern{Constant('Backup '), Field(p0,false)}" -match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); +var part469 = match("MESSAGE#278:00015:06/0_1", "nwparser.payload", "Backup %{p0}"); var select108 = linear_select([ part468, part469, ]); -var part470 = // "Pattern{Constant('SecurID server IP address has been '), Field(disposition,false)}" -match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); +var part470 = match("MESSAGE#278:00015:06/1", "nwparser.p0", "SecurID server IP address has been %{disposition}"); var all89 = all_match({ processors: [ @@ -7044,8 +6305,7 @@ var all89 = all_match({ var msg280 = msg("00015:06", all89); -var part471 = // "Pattern{Constant('HA change from slave to master'), Field(,false)}" -match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ +var part471 = match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to master%{}", processor_chain([ dup1, dup2, dup3, @@ -7055,8 +6315,7 @@ match("MESSAGE#279:00015:07", "nwparser.payload", "HA change from slave to maste var msg281 = msg("00015:07", part471); -var part472 = // "Pattern{Constant('inconsistent configuration between master and slave'), Field(,false)}" -match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ +var part472 = match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration between master and slave%{}", processor_chain([ dup141, dup2, dup3, @@ -7066,19 +6325,16 @@ match("MESSAGE#280:00015:08", "nwparser.payload", "inconsistent configuration be var msg282 = msg("00015:08", part472); -var part473 = // "Pattern{Constant('configuration '), Field(p0,false)}" -match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); +var part473 = match("MESSAGE#281:00015:09/0_0", "nwparser.payload", "configuration %{p0}"); -var part474 = // "Pattern{Constant('Configuration '), Field(p0,false)}" -match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); +var part474 = match("MESSAGE#281:00015:09/0_1", "nwparser.payload", "Configuration %{p0}"); var select109 = linear_select([ part473, part474, ]); -var part475 = // "Pattern{Constant('out of sync between local unit and remote unit'), Field(,false)}" -match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); +var part475 = match("MESSAGE#281:00015:09/1", "nwparser.p0", "out of sync between local unit and remote unit%{}"); var all90 = all_match({ processors: [ @@ -7096,8 +6352,7 @@ var all90 = all_match({ var msg283 = msg("00015:09", all90); -var part476 = // "Pattern{Constant('HA control channel change to '), Field(interface,false)}" -match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ +var part476 = match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to %{interface}", processor_chain([ dup1, dup2, dup3, @@ -7107,8 +6362,7 @@ match("MESSAGE#282:00015:10", "nwparser.payload", "HA control channel change to var msg284 = msg("00015:10", part476); -var part477 = // "Pattern{Constant('HA data channel change to '), Field(interface,false)}" -match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ +var part477 = match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{interface}", processor_chain([ dup1, dup2, dup3, @@ -7118,31 +6372,27 @@ match("MESSAGE#283:00015:11", "nwparser.payload", "HA data channel change to %{i var msg285 = msg("00015:11", part477); -var part478 = // "Pattern{Constant('control '), Field(p0,false)}" -match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); +var part478 = match("MESSAGE#284:00015:12/1_0", "nwparser.p0", "control %{p0}"); -var part479 = // "Pattern{Constant('data '), Field(p0,false)}" -match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); +var part479 = match("MESSAGE#284:00015:12/1_1", "nwparser.p0", "data %{p0}"); var select110 = linear_select([ part478, part479, ]); -var part480 = // "Pattern{Constant('channel moved from link '), Field(p0,false)}" -match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); +var part480 = match("MESSAGE#284:00015:12/2", "nwparser.p0", "channel moved from link %{p0}"); -var part481 = // "Pattern{Constant('('), Field(interface,false), Constant(')')}" -match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); +var part481 = match("MESSAGE#284:00015:12/6", "nwparser.p0", "(%{interface})"); var all91 = all_match({ processors: [ dup87, select110, part480, - dup355, + dup353, dup103, - dup355, + dup353, part481, ], on_success: processor_chain([ @@ -7156,8 +6406,7 @@ var all91 = all_match({ var msg286 = msg("00015:12", all91); -var part482 = // "Pattern{Constant('HA: Slave is down'), Field(,false)}" -match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ +var part482 = match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", processor_chain([ dup144, dup2, dup3, @@ -7167,13 +6416,12 @@ match("MESSAGE#285:00015:13", "nwparser.payload", "HA: Slave is down%{}", proces var msg287 = msg("00015:13", part482); -var part483 = // "Pattern{Constant('NSRP link '), Field(p0,false)}" -match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); +var part483 = match("MESSAGE#286:00015:14/0", "nwparser.payload", "NSRP link %{p0}"); var all92 = all_match({ processors: [ part483, - dup355, + dup353, dup116, ], on_success: processor_chain([ @@ -7187,8 +6435,7 @@ var all92 = all_match({ var msg288 = msg("00015:14", all92); -var part484 = // "Pattern{Constant('no HA '), Field(fld2,true), Constant(' channel available ('), Field(fld3,true), Constant(' used by other channel)')}" -match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ +var part484 = match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel available (%{fld3->} used by other channel)", processor_chain([ dup117, dup2, dup3, @@ -7198,8 +6445,7 @@ match("MESSAGE#287:00015:15", "nwparser.payload", "no HA %{fld2->} channel avail var msg289 = msg("00015:15", part484); -var part485 = // "Pattern{Constant('The NSRP configuration is out of synchronization between the local device and the peer device.'), Field(,false)}" -match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ +var part485 = match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out of synchronization between the local device and the peer device.%{}", processor_chain([ dup18, dup2, dup3, @@ -7209,8 +6455,7 @@ match("MESSAGE#288:00015:16", "nwparser.payload", "The NSRP configuration is out var msg290 = msg("00015:16", part485); -var part486 = // "Pattern{Constant('NSRP '), Field(change_attribute,true), Constant(' '), Field(change_old,true), Constant(' changed to link channel '), Field(change_new,false)}" -match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ +var part486 = match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{change_old->} changed to link channel %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -7220,8 +6465,7 @@ match("MESSAGE#289:00015:17", "nwparser.payload", "NSRP %{change_attribute->} %{ var msg291 = msg("00015:17", part486); -var part487 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' on peer device '), Field(fld2,true), Constant(' changed from '), Field(fld3,true), Constant(' to '), Field(fld4,true), Constant(' state.')}" -match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ +var part487 = match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on peer device %{fld2->} changed from %{fld3->} to %{fld4->} state.", processor_chain([ dup121, dup2, dup3, @@ -7232,8 +6476,7 @@ match("MESSAGE#290:00015:18", "nwparser.payload", "RTO mirror group %{group->} w var msg292 = msg("00015:18", part487); -var part488 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' on local device '), Field(fld2,false), Constant(', detected a duplicate direction on the peer device '), Field(fld3,false)}" -match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ +var part488 = match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} on local device %{fld2}, detected a duplicate direction on the peer device %{fld3}", processor_chain([ dup18, dup2, dup3, @@ -7243,8 +6486,7 @@ match("MESSAGE#291:00015:19", "nwparser.payload", "RTO mirror group %{group->} w var msg293 = msg("00015:19", part488); -var part489 = // "Pattern{Constant('RTO mirror group '), Field(group,true), Constant(' with direction '), Field(direction,true), Constant(' changed on the local device from '), Field(fld2,true), Constant(' to up state, it had peer device '), Field(fld3,false)}" -match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ +var part489 = match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} with direction %{direction->} changed on the local device from %{fld2->} to up state, it had peer device %{fld3}", processor_chain([ dup44, dup2, dup3, @@ -7254,14 +6496,11 @@ match("MESSAGE#292:00015:20", "nwparser.payload", "RTO mirror group %{group->} w var msg294 = msg("00015:20", part489); -var part490 = // "Pattern{Constant('Peer device '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); +var part490 = match("MESSAGE#293:00015:21/0", "nwparser.payload", "Peer device %{fld2->} %{p0}"); -var part491 = // "Pattern{Constant('disappeared '), Field(p0,false)}" -match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); +var part491 = match("MESSAGE#293:00015:21/1_0", "nwparser.p0", "disappeared %{p0}"); -var part492 = // "Pattern{Constant('was discovered '), Field(p0,false)}" -match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); +var part492 = match("MESSAGE#293:00015:21/1_1", "nwparser.p0", "was discovered %{p0}"); var select111 = linear_select([ part491, @@ -7285,14 +6524,11 @@ var all93 = all_match({ var msg295 = msg("00015:21", all93); -var part493 = // "Pattern{Constant('The local '), Field(p0,false)}" -match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); +var part493 = match("MESSAGE#294:00015:22/0_0", "nwparser.payload", "The local %{p0}"); -var part494 = // "Pattern{Constant('The peer '), Field(p0,false)}" -match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); +var part494 = match("MESSAGE#294:00015:22/0_1", "nwparser.payload", "The peer %{p0}"); -var part495 = // "Pattern{Constant('Peer '), Field(p0,false)}" -match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); +var part495 = match("MESSAGE#294:00015:22/0_2", "nwparser.payload", "Peer %{p0}"); var select112 = linear_select([ part493, @@ -7300,14 +6536,13 @@ var select112 = linear_select([ part495, ]); -var part496 = // "Pattern{Constant('device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed '), Field(change_attribute,true), Constant(' from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); +var part496 = match("MESSAGE#294:00015:22/1", "nwparser.p0", "device %{fld2->} in the Virtual Security Device group %{group->} changed %{change_attribute->} from %{change_old->} to %{change_new->} %{p0}"); var all94 = all_match({ processors: [ select112, part496, - dup356, + dup354, ], on_success: processor_chain([ dup44, @@ -7321,8 +6556,7 @@ var all94 = all_match({ var msg296 = msg("00015:22", all94); -var part497 = // "Pattern{Constant('WebAuth is set to '), Field(fld2,false)}" -match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ +var part497 = match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -7332,8 +6566,7 @@ match("MESSAGE#295:00015:23", "nwparser.payload", "WebAuth is set to %{fld2}", p var msg297 = msg("00015:23", part497); -var part498 = // "Pattern{Constant('Default firewall authentication server has been changed to '), Field(hostname,false)}" -match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ +var part498 = match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authentication server has been changed to %{hostname}", processor_chain([ dup1, dup2, dup3, @@ -7343,8 +6576,7 @@ match("MESSAGE#296:00015:24", "nwparser.payload", "Default firewall authenticati var msg298 = msg("00015:24", part498); -var part499 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' attempted to verify the encrypted password '), Field(fld2,false), Constant('. Verification was successful')}" -match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ +var part499 = match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification was successful", processor_chain([ setc("eventcategory","1613050100"), dup2, dup3, @@ -7354,8 +6586,7 @@ match("MESSAGE#297:00015:25", "nwparser.payload", "Admin user %{administrator->} var msg299 = msg("00015:25", part499); -var part500 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' attempted to verify the encrypted password '), Field(fld2,false), Constant('. Verification failed')}" -match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ +var part500 = match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} attempted to verify the encrypted password %{fld2}. Verification failed", processor_chain([ dup97, dup2, dup3, @@ -7365,14 +6596,11 @@ match("MESSAGE#298:00015:29", "nwparser.payload", "Admin user %{administrator->} var msg300 = msg("00015:29", part500); -var part501 = // "Pattern{Constant('unit '), Field(fld2,true), Constant(' just dis'), Field(p0,false)}" -match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); +var part501 = match("MESSAGE#299:00015:26/0", "nwparser.payload", "unit %{fld2->} just dis%{p0}"); -var part502 = // "Pattern{Constant('appeared'), Field(,false)}" -match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); +var part502 = match("MESSAGE#299:00015:26/1_0", "nwparser.p0", "appeared%{}"); -var part503 = // "Pattern{Constant('covered'), Field(,false)}" -match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); +var part503 = match("MESSAGE#299:00015:26/1_1", "nwparser.p0", "covered%{}"); var select113 = linear_select([ part502, @@ -7395,8 +6623,7 @@ var all95 = all_match({ var msg301 = msg("00015:26", all95); -var part504 = // "Pattern{Constant('NSRP: HA data channel change to '), Field(interface,false), Constant('. ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ +var part504 = match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change to %{interface}. (%{fld2})", processor_chain([ dup44, dup2, dup3, @@ -7407,8 +6634,7 @@ match("MESSAGE#300:00015:33", "nwparser.payload", "NSRP: HA data channel change var msg302 = msg("00015:33", part504); -var part505 = // "Pattern{Constant('NSRP: '), Field(fld2,false)}" -match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ +var part505 = match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_chain([ dup44, dup2, dup3, @@ -7418,8 +6644,7 @@ match("MESSAGE#301:00015:27", "nwparser.payload", "NSRP: %{fld2}", processor_cha var msg303 = msg("00015:27", part505); -var part506 = // "Pattern{Constant('Auth server '), Field(hostname,true), Constant(' RADIUS retry timeout has been set to default of '), Field(fld2,false)}" -match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ +var part506 = match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RADIUS retry timeout has been set to default of %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -7429,16 +6654,14 @@ match("MESSAGE#302:00015:28", "nwparser.payload", "Auth server %{hostname->} RAD var msg304 = msg("00015:28", part506); -var part507 = // "Pattern{Constant('Number of RADIUS retries for auth server '), Field(hostname,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); +var part507 = match("MESSAGE#303:00015:30/0", "nwparser.payload", "Number of RADIUS retries for auth server %{hostname->} %{p0}"); -var part508 = // "Pattern{Constant('set to '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); +var part508 = match("MESSAGE#303:00015:30/2", "nwparser.p0", "set to %{fld2->} (%{fld1})"); var all96 = all_match({ processors: [ part507, - dup357, + dup355, part508, ], on_success: processor_chain([ @@ -7453,8 +6676,7 @@ var all96 = all_match({ var msg305 = msg("00015:30", all96); -var part509 = // "Pattern{Constant('Forced timeout for Auth server '), Field(hostname,true), Constant(' is unset to its default value, '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ +var part509 = match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth server %{hostname->} is unset to its default value, %{info->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -7465,8 +6687,7 @@ match("MESSAGE#304:00015:31", "nwparser.payload", "Forced timeout for Auth serve var msg306 = msg("00015:31", part509); -var part510 = // "Pattern{Constant('Accounting port of server RADIUS is set to '), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ +var part510 = match("MESSAGE#305:00015:32", "nwparser.payload", "Accounting port of server RADIUS is set to %{network_port}. (%{fld1})", processor_chain([ dup50, dup43, dup51, @@ -7515,8 +6736,7 @@ var select114 = linear_select([ msg307, ]); -var part511 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part511 = match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup147, dup148, dup149, @@ -7531,8 +6751,7 @@ match("MESSAGE#306:00016", "nwparser.payload", "%{signame->} From %{saddr}:%{spo var msg308 = msg("00016", part511); -var part512 = // "Pattern{Constant('Address VIP ('), Field(fld2,false), Constant(') for '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ +var part512 = match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{fld3->} has been %{disposition}.", processor_chain([ dup1, dup148, dup149, @@ -7545,8 +6764,7 @@ match("MESSAGE#307:00016:01", "nwparser.payload", "Address VIP (%{fld2}) for %{f var msg309 = msg("00016:01", part512); -var part513 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(') has been '), Field(disposition,false)}" -match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ +var part513 = match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disposition}", processor_chain([ dup1, dup148, dup149, @@ -7559,8 +6777,7 @@ match("MESSAGE#308:00016:02", "nwparser.payload", "VIP (%{fld2}) has been %{disp var msg310 = msg("00016:02", part513); -var part514 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ +var part514 = match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{fld2})", processor_chain([ dup147, dup148, dup149, @@ -7573,8 +6790,7 @@ match("MESSAGE#309:00016:03", "nwparser.payload", "%{signame->} from %{saddr}/%{ var msg311 = msg("00016:03", part514); -var part515 = // "Pattern{Constant('VIP multi-port was '), Field(disposition,false)}" -match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ +var part515 = match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7584,8 +6800,7 @@ match("MESSAGE#310:00016:05", "nwparser.payload", "VIP multi-port was %{disposit var msg312 = msg("00016:05", part515); -var part516 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part516 = match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup147, dup148, dup149, @@ -7600,13 +6815,12 @@ match("MESSAGE#311:00016:06", "nwparser.payload", "%{signame->} has been detecte var msg313 = msg("00016:06", part516); -var part517 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' ( zone '), Field(p0,false)}" -match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); +var part517 = match("MESSAGE#312:00016:07/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} ( zone %{p0}"); var all97 = all_match({ processors: [ part517, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -7626,8 +6840,7 @@ var all97 = all_match({ var msg314 = msg("00016:07", all97); -var part518 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' HTTP '), Field(fld4,false), Constant(') Modify by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part518 = match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) Modify by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ setc("eventcategory","1001020305"), dup2, dup3, @@ -7638,8 +6851,7 @@ match("MESSAGE#313:00016:08", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP % var msg315 = msg("00016:08", part518); -var part519 = // "Pattern{Constant('VIP ('), Field(fld2,false), Constant(':'), Field(fld3,true), Constant(' HTTP '), Field(fld4,false), Constant(') New by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part519 = match("MESSAGE#314:00016:09", "nwparser.payload", "VIP (%{fld2}:%{fld3->} HTTP %{fld4}) New by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ setc("eventcategory","1001030305"), dup2, dup3, @@ -7662,8 +6874,7 @@ var select115 = linear_select([ msg316, ]); -var part520 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part520 = match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup151, dup2, dup3, @@ -7674,22 +6885,18 @@ match("MESSAGE#315:00017", "nwparser.payload", "%{signame->} From %{saddr}:%{spo var msg317 = msg("00017", part520); -var part521 = // "Pattern{Constant('Gateway '), Field(fld2,true), Constant(' at '), Field(fld3,true), Constant(' in '), Field(fld5,true), Constant(' mode with ID '), Field(p0,false)}" -match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); +var part521 = match("MESSAGE#316:00017:23/0", "nwparser.payload", "Gateway %{fld2->} at %{fld3->} in %{fld5->} mode with ID %{p0}"); -var part522 = // "Pattern{Constant('['), Field(fld4,false), Constant('] '), Field(p0,false)}" -match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); +var part522 = match("MESSAGE#316:00017:23/1_0", "nwparser.p0", "[%{fld4}] %{p0}"); -var part523 = // "Pattern{Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); +var part523 = match("MESSAGE#316:00017:23/1_1", "nwparser.p0", "%{fld4->} %{p0}"); var select116 = linear_select([ part522, part523, ]); -var part524 = // "Pattern{Constant('has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(fld,false)}" -match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); +var part524 = match("MESSAGE#316:00017:23/2", "nwparser.p0", "has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} %{fld}"); var all98 = all_match({ processors: [ @@ -7708,28 +6915,24 @@ var all98 = all_match({ var msg318 = msg("00017:23", all98); -var part525 = // "Pattern{Field(fld1,false), Constant(': Gateway '), Field(p0,false)}" -match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); +var part525 = match("MESSAGE#317:00017:01/0_0", "nwparser.payload", "%{fld1}: Gateway %{p0}"); -var part526 = // "Pattern{Constant('Gateway '), Field(p0,false)}" -match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); +var part526 = match("MESSAGE#317:00017:01/0_1", "nwparser.payload", "Gateway %{p0}"); var select117 = linear_select([ part525, part526, ]); -var part527 = // "Pattern{Constant(''), Field(fld2,true), Constant(' at '), Field(fld3,true), Constant(' in '), Field(fld5,true), Constant(' mode with ID'), Field(p0,false)}" -match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); +var part527 = match("MESSAGE#317:00017:01/1", "nwparser.p0", "%{fld2->} at %{fld3->} in %{fld5->} mode with ID%{p0}"); -var part528 = // "Pattern{Constant(''), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); +var part528 = match("MESSAGE#317:00017:01/3", "nwparser.p0", "%{fld4->} has been %{disposition}"); var all99 = all_match({ processors: [ select117, part527, - dup358, + dup356, part528, ], on_success: processor_chain([ @@ -7743,8 +6946,7 @@ var all99 = all_match({ var msg319 = msg("00017:01", all99); -var part529 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Gateway settings have been '), Field(disposition,false)}" -match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ +var part529 = match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settings have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7754,8 +6956,7 @@ match("MESSAGE#318:00017:02", "nwparser.payload", "IKE %{hostip}: Gateway settin var msg320 = msg("00017:02", part529); -var part530 = // "Pattern{Constant('IKE key '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ +var part530 = match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7765,13 +6966,12 @@ match("MESSAGE#319:00017:03", "nwparser.payload", "IKE key %{fld2->} has been %{ var msg321 = msg("00017:03", part530); -var part531 = // "Pattern{Constant(''), Field(group_object,true), Constant(' with range '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); +var part531 = match("MESSAGE#320:00017:04/2", "nwparser.p0", "%{group_object->} with range %{fld2->} has been %{disposition}"); var all100 = all_match({ processors: [ dup153, - dup359, + dup357, part531, ], on_success: processor_chain([ @@ -7785,8 +6985,7 @@ var all100 = all_match({ var msg322 = msg("00017:04", all100); -var part532 = // "Pattern{Constant('IPSec NAT-T for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ +var part532 = match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7796,14 +6995,11 @@ match("MESSAGE#321:00017:05", "nwparser.payload", "IPSec NAT-T for VPN %{group-> var msg323 = msg("00017:05", part532); -var part533 = // "Pattern{Constant('The DF-BIT for VPN '), Field(group,true), Constant(' has been set to '), Field(p0,false)}" -match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); +var part533 = match("MESSAGE#322:00017:06/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been set to %{p0}"); -var part534 = // "Pattern{Constant('clear '), Field(p0,false)}" -match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); +var part534 = match("MESSAGE#322:00017:06/1_0", "nwparser.p0", "clear %{p0}"); -var part535 = // "Pattern{Constant('copy '), Field(p0,false)}" -match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); +var part535 = match("MESSAGE#322:00017:06/1_2", "nwparser.p0", "copy %{p0}"); var select118 = linear_select([ part534, @@ -7828,20 +7024,15 @@ var all101 = all_match({ var msg324 = msg("00017:06", all101); -var part536 = // "Pattern{Constant('The DF-BIT for VPN '), Field(group,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); +var part536 = match("MESSAGE#323:00017:07/0", "nwparser.payload", "The DF-BIT for VPN %{group->} has been %{p0}"); -var part537 = // "Pattern{Constant('clear'), Field(,false)}" -match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); +var part537 = match("MESSAGE#323:00017:07/1_0", "nwparser.p0", "clear%{}"); -var part538 = // "Pattern{Constant('cleared'), Field(,false)}" -match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); +var part538 = match("MESSAGE#323:00017:07/1_1", "nwparser.p0", "cleared%{}"); -var part539 = // "Pattern{Constant('copy'), Field(,false)}" -match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); +var part539 = match("MESSAGE#323:00017:07/1_3", "nwparser.p0", "copy%{}"); -var part540 = // "Pattern{Constant('copied'), Field(,false)}" -match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); +var part540 = match("MESSAGE#323:00017:07/1_4", "nwparser.p0", "copied%{}"); var select119 = linear_select([ part537, @@ -7867,8 +7058,7 @@ var all102 = all_match({ var msg325 = msg("00017:07", all102); -var part541 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and SPI '), Field(fld3,false), Constant('/'), Field(fld4,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ +var part541 = match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and SPI %{fld3}/%{fld4->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7878,28 +7068,22 @@ match("MESSAGE#324:00017:08", "nwparser.payload", "VPN %{group->} with gateway % var msg326 = msg("00017:08", part541); -var part542 = // "Pattern{Field(fld1,false), Constant(': VPN '), Field(p0,false)}" -match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); +var part542 = match("MESSAGE#325:00017:09/0_0", "nwparser.payload", "%{fld1}: VPN %{p0}"); -var part543 = // "Pattern{Constant('VPN '), Field(p0,false)}" -match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); +var part543 = match("MESSAGE#325:00017:09/0_1", "nwparser.payload", "VPN %{p0}"); var select120 = linear_select([ part542, part543, ]); -var part544 = // "Pattern{Constant(''), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); +var part544 = match("MESSAGE#325:00017:09/1", "nwparser.p0", "%{group->} with gateway %{fld2->} %{p0}"); -var part545 = // "Pattern{Constant('no-rekey '), Field(p0,false)}" -match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); +var part545 = match("MESSAGE#325:00017:09/2_0", "nwparser.p0", "no-rekey %{p0}"); -var part546 = // "Pattern{Constant('rekey, '), Field(p0,false)}" -match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); +var part546 = match("MESSAGE#325:00017:09/2_1", "nwparser.p0", "rekey, %{p0}"); -var part547 = // "Pattern{Constant('rekey '), Field(p0,false)}" -match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); +var part547 = match("MESSAGE#325:00017:09/2_2", "nwparser.p0", "rekey %{p0}"); var select121 = linear_select([ part545, @@ -7907,14 +7091,11 @@ var select121 = linear_select([ part547, ]); -var part548 = // "Pattern{Constant('and p2-proposal '), Field(fld3,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); +var part548 = match("MESSAGE#325:00017:09/3", "nwparser.p0", "and p2-proposal %{fld3->} has been %{p0}"); -var part549 = // "Pattern{Field(disposition,true), Constant(' from peer unit')}" -match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); +var part549 = match("MESSAGE#325:00017:09/4_0", "nwparser.p0", "%{disposition->} from peer unit"); -var part550 = // "Pattern{Field(disposition,true), Constant(' from host '), Field(saddr,false)}" -match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); +var part550 = match("MESSAGE#325:00017:09/4_1", "nwparser.p0", "%{disposition->} from host %{saddr}"); var select122 = linear_select([ part549, @@ -7941,13 +7122,12 @@ var all103 = all_match({ var msg327 = msg("00017:09", all103); -var part551 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false), Constant('. Src IF '), Field(sinterface,true), Constant(' dst IP '), Field(daddr,true), Constant(' with rekeying '), Field(p0,false)}" -match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); +var part551 = match("MESSAGE#326:00017:10/0", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}. Src IF %{sinterface->} dst IP %{daddr->} with rekeying %{p0}"); var all104 = all_match({ processors: [ part551, - dup360, + dup358, dup116, ], on_success: processor_chain([ @@ -7961,8 +7141,7 @@ var all104 = all_match({ var msg328 = msg("00017:10", all104); -var part552 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ +var part552 = match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{group->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -7972,11 +7151,9 @@ match("MESSAGE#327:00017:11", "nwparser.payload", "VPN monitoring for VPN %{grou var msg329 = msg("00017:11", part552); -var part553 = // "Pattern{Constant('VPN monitoring '), Field(p0,false)}" -match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); +var part553 = match("MESSAGE#328:00017:12/0", "nwparser.payload", "VPN monitoring %{p0}"); -var part554 = // "Pattern{Constant('frequency '), Field(p0,false)}" -match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); +var part554 = match("MESSAGE#328:00017:12/1_2", "nwparser.p0", "frequency %{p0}"); var select123 = linear_select([ dup109, @@ -7989,7 +7166,7 @@ var all105 = all_match({ part553, select123, dup127, - dup361, + dup359, ], on_success: processor_chain([ dup1, @@ -8002,8 +7179,7 @@ var all105 = all_match({ var msg330 = msg("00017:12", all105); -var part555 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal '), Field(fld3,true), Constant(' has been added by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ +var part555 = match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been added by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8014,8 +7190,7 @@ match("MESSAGE#329:00017:26", "nwparser.payload", "VPN %{group->} with gateway % var msg331 = msg("00017:26", part555); -var part556 = // "Pattern{Constant('No IP pool has been assigned. You cannot allocate an IP address.'), Field(,false)}" -match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ +var part556 = match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. You cannot allocate an IP address.%{}", processor_chain([ dup18, dup2, dup3, @@ -8025,8 +7200,7 @@ match("MESSAGE#330:00017:13", "nwparser.payload", "No IP pool has been assigned. var msg332 = msg("00017:13", part556); -var part557 = // "Pattern{Constant('P1 proposal '), Field(fld2,true), Constant(' with '), Field(protocol_detail,false), Constant(', DH group '), Field(group,false), Constant(', ESP '), Field(encryption_type,false), Constant(', auth '), Field(authmethod,false), Constant(', and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part557 = match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail}, DH group %{group}, ESP %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8037,16 +7211,14 @@ match("MESSAGE#331:00017:14", "nwparser.payload", "P1 proposal %{fld2->} with %{ var msg333 = msg("00017:14", part557); -var part558 = // "Pattern{Constant('P2 proposal '), Field(fld2,true), Constant(' with DH group '), Field(group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); +var part558 = match("MESSAGE#332:00017:15/0", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group->} %{p0}"); -var part559 = // "Pattern{Constant(''), Field(encryption_type,true), Constant(' auth '), Field(authmethod,true), Constant(' and lifetime ('), Field(fld3,false), Constant(') ('), Field(fld4,false), Constant(') has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); +var part559 = match("MESSAGE#332:00017:15/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime (%{fld3}) (%{fld4}) has been %{disposition}."); var all106 = all_match({ processors: [ part558, - dup362, + dup360, part559, ], on_success: processor_chain([ @@ -8060,16 +7232,14 @@ var all106 = all_match({ var msg334 = msg("00017:15", all106); -var part560 = // "Pattern{Constant('P1 proposal '), Field(fld2,true), Constant(' with '), Field(protocol_detail,true), Constant(' DH group '), Field(group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); +var part560 = match("MESSAGE#333:00017:31/0", "nwparser.payload", "P1 proposal %{fld2->} with %{protocol_detail->} DH group %{group->} %{p0}"); -var part561 = // "Pattern{Constant(''), Field(encryption_type,true), Constant(' auth '), Field(authmethod,true), Constant(' and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); +var part561 = match("MESSAGE#333:00017:31/2", "nwparser.p0", "%{encryption_type->} auth %{authmethod->} and lifetime %{fld3->} has been %{disposition}."); var all107 = all_match({ processors: [ part560, - dup362, + dup360, part561, ], on_success: processor_chain([ @@ -8083,13 +7253,12 @@ var all107 = all_match({ var msg335 = msg("00017:31", all107); -var part562 = // "Pattern{Constant('vpnmonitor interval is '), Field(p0,false)}" -match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); +var part562 = match("MESSAGE#334:00017:16/0", "nwparser.payload", "vpnmonitor interval is %{p0}"); var all108 = all_match({ processors: [ part562, - dup361, + dup359, ], on_success: processor_chain([ dup1, @@ -8102,8 +7271,7 @@ var all108 = all_match({ var msg336 = msg("00017:16", all108); -var part563 = // "Pattern{Constant('vpnmonitor threshold is '), Field(p0,false)}" -match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); +var part563 = match("MESSAGE#335:00017:17/0", "nwparser.payload", "vpnmonitor threshold is %{p0}"); var select124 = linear_select([ dup99, @@ -8126,13 +7294,12 @@ var all109 = all_match({ var msg337 = msg("00017:17", all109); -var part564 = // "Pattern{Constant(''), Field(group_object,true), Constant(' with range '), Field(fld2,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); +var part564 = match("MESSAGE#336:00017:18/2", "nwparser.p0", "%{group_object->} with range %{fld2->} was %{disposition}"); var all110 = all_match({ processors: [ dup153, - dup359, + dup357, part564, ], on_success: processor_chain([ @@ -8148,16 +7315,14 @@ var all110 = all_match({ var msg338 = msg("00017:18", all110); -var part565 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at '), Field(p0,false)}" -match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); +var part565 = match("MESSAGE#337:00017:19/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at %{p0}"); -var part566 = // "Pattern{Field(,true), Constant(' '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); +var part566 = match("MESSAGE#337:00017:19/2", "nwparser.p0", "%{} %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times"); var all111 = all_match({ processors: [ part565, - dup339, + dup337, part566, ], on_success: processor_chain([ @@ -8175,7 +7340,7 @@ var msg339 = msg("00017:19", all111); var all112 = all_match({ processors: [ dup64, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -8191,8 +7356,7 @@ var all112 = all_match({ var msg340 = msg("00017:20", all112); -var part567 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part567 = match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup151, dup2, dup3, @@ -8203,8 +7367,7 @@ match("MESSAGE#339:00017:21", "nwparser.payload", "%{signame->} From %{saddr->} var msg341 = msg("00017:21", part567); -var part568 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part568 = match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8215,8 +7378,7 @@ match("MESSAGE#340:00017:22", "nwparser.payload", "VPN %{group->} with gateway % var msg342 = msg("00017:22", part568); -var part569 = // "Pattern{Constant('VPN "'), Field(group,false), Constant('" has been bound to tunnel interface '), Field(interface,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ +var part569 = match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bound to tunnel interface %{interface}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8227,8 +7389,7 @@ match("MESSAGE#341:00017:24", "nwparser.payload", "VPN \"%{group}\" has been bou var msg343 = msg("00017:24", part569); -var part570 = // "Pattern{Constant('VPN '), Field(group,true), Constant(' with gateway '), Field(fld2,true), Constant(' and P2 proposal standard has been added by admin '), Field(administrator,true), Constant(' via NSRP Peer ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ +var part570 = match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway %{fld2->} and P2 proposal standard has been added by admin %{administrator->} via NSRP Peer (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8239,8 +7400,7 @@ match("MESSAGE#342:00017:25", "nwparser.payload", "VPN %{group->} with gateway % var msg344 = msg("00017:25", part570); -var part571 = // "Pattern{Constant('P2 proposal '), Field(fld2,true), Constant(' with DH group '), Field(group,false), Constant(', ESP, enc '), Field(encryption_type,false), Constant(', auth '), Field(authmethod,false), Constant(', and lifetime '), Field(fld3,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part571 = match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH group %{group}, ESP, enc %{encryption_type}, auth %{authmethod}, and lifetime %{fld3->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8251,8 +7411,7 @@ match("MESSAGE#343:00017:28", "nwparser.payload", "P2 proposal %{fld2->} with DH var msg345 = msg("00017:28", part571); -var part572 = // "Pattern{Constant('L2TP "'), Field(fld2,false), Constant('", all-L2TP-users secret "'), Field(fld3,false), Constant('" keepalive '), Field(fld4,true), Constant(' has been '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part572 = match("MESSAGE#344:00017:29", "nwparser.payload", "L2TP \"%{fld2}\", all-L2TP-users secret \"%{fld3}\" keepalive %{fld4->} has been %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup1, dup2, dup4, @@ -8295,8 +7454,7 @@ var select125 = linear_select([ msg346, ]); -var part573 = // "Pattern{Constant('Positions of policies '), Field(fld2,true), Constant(' and '), Field(fld3,true), Constant(' have been exchanged')}" -match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ +var part573 = match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} and %{fld3->} have been exchanged", processor_chain([ dup1, dup2, dup3, @@ -8306,8 +7464,7 @@ match("MESSAGE#345:00018", "nwparser.payload", "Positions of policies %{fld2->} var msg347 = msg("00018", part573); -var part574 = // "Pattern{Constant('Deny Policy Alarm'), Field(,false)}" -match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ +var part574 = match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", processor_chain([ setc("eventcategory","1502010000"), dup2, dup4, @@ -8317,31 +7474,17 @@ match("MESSAGE#346:00018:01", "nwparser.payload", "Deny Policy Alarm%{}", proces var msg348 = msg("00018:01", part574); -var part575 = // "Pattern{Constant('Device'), Field(p0,false)}" -match("MESSAGE#347:00018:02/0", "nwparser.payload", "Device%{p0}"); - -var part576 = // "Pattern{Constant('s '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' by admin '), Field(administrator,false)}" -match("MESSAGE#347:00018:02/2", "nwparser.p0", "s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}"); - -var all113 = all_match({ - processors: [ - part575, - dup363, - part576, - ], - on_success: processor_chain([ - dup1, - dup2, - dup3, - dup4, - dup5, - ]), -}); +var part575 = match("MESSAGE#347:00018:02", "nwparser.payload", "Device%{quote}s %{change_attribute->} has been changed from %{change_old->} to %{change_new->} by admin %{administrator}", processor_chain([ + dup1, + dup2, + dup3, + dup4, + dup5, +])); -var msg349 = msg("00018:02", all113); +var msg349 = msg("00018:02", part575); -var part577 = // "Pattern{Field(fld2,true), Constant(' Policy ('), Field(policy_id,false), Constant(', '), Field(info,true), Constant(' ) was '), Field(disposition,true), Constant(' from host '), Field(saddr,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ +var part576 = match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8350,10 +7493,9 @@ match("MESSAGE#348:00018:04", "nwparser.payload", "%{fld2->} Policy (%{policy_id dup5, ])); -var msg350 = msg("00018:04", part577); +var msg350 = msg("00018:04", part576); -var part578 = // "Pattern{Field(fld2,true), Constant(' Policy ('), Field(policy_id,false), Constant(', '), Field(info,true), Constant(' ) was '), Field(disposition,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer')}" -match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ +var part577 = match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id}, %{info->} ) was %{disposition->} by admin %{administrator->} via NSRP Peer", processor_chain([ dup17, dup2, dup3, @@ -8361,30 +7503,26 @@ match("MESSAGE#349:00018:16", "nwparser.payload", "%{fld2->} Policy (%{policy_id dup5, ])); -var msg351 = msg("00018:16", part578); +var msg351 = msg("00018:16", part577); -var part579 = // "Pattern{Field(fld2,true), Constant(' Policy '), Field(policy_id,true), Constant(' has been moved '), Field(p0,false)}" -match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); +var part578 = match("MESSAGE#350:00018:06/0", "nwparser.payload", "%{fld2->} Policy %{policy_id->} has been moved %{p0}"); -var part580 = // "Pattern{Constant('before '), Field(p0,false)}" -match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); +var part579 = match("MESSAGE#350:00018:06/1_0", "nwparser.p0", "before %{p0}"); -var part581 = // "Pattern{Constant('after '), Field(p0,false)}" -match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); +var part580 = match("MESSAGE#350:00018:06/1_1", "nwparser.p0", "after %{p0}"); var select126 = linear_select([ + part579, part580, - part581, ]); -var part582 = // "Pattern{Constant(''), Field(fld3,true), Constant(' by admin '), Field(administrator,false)}" -match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); +var part581 = match("MESSAGE#350:00018:06/2", "nwparser.p0", "%{fld3->} by admin %{administrator}"); -var all114 = all_match({ +var all113 = all_match({ processors: [ - part579, + part578, select126, - part582, + part581, ], on_success: processor_chain([ dup17, @@ -8395,10 +7533,9 @@ var all114 = all_match({ ]), }); -var msg352 = msg("00018:06", all114); +var msg352 = msg("00018:06", all113); -var part583 = // "Pattern{Constant('Policy '), Field(policy_id,true), Constant(' application was modified to '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part582 = match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} application was modified to %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8407,10 +7544,9 @@ match("MESSAGE#351:00018:08", "nwparser.payload", "Policy %{policy_id->} applica dup5, ])); -var msg353 = msg("00018:08", part583); +var msg353 = msg("00018:08", part582); -var part584 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part583 = match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup17, dup3, dup2, @@ -8419,30 +7555,26 @@ match("MESSAGE#352:00018:09", "nwparser.payload", "Policy (%{policy_id}, %{info} dup5, ])); -var msg354 = msg("00018:09", part584); +var msg354 = msg("00018:09", part583); -var part585 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(p0,false)}" -match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); +var part584 = match("MESSAGE#353:00018:10/0", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{p0}"); -var part586 = // "Pattern{Field(disposition,true), Constant(' from peer unit by '), Field(p0,false)}" -match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); +var part585 = match("MESSAGE#353:00018:10/1_0", "nwparser.p0", "%{disposition->} from peer unit by %{p0}"); -var part587 = // "Pattern{Field(disposition,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); +var part586 = match("MESSAGE#353:00018:10/1_1", "nwparser.p0", "%{disposition->} by %{p0}"); var select127 = linear_select([ + part585, part586, - part587, ]); -var part588 = // "Pattern{Field(username,true), Constant(' via '), Field(interface,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); +var part587 = match("MESSAGE#353:00018:10/2", "nwparser.p0", "%{username->} via %{interface->} from host %{saddr->} (%{fld1})"); -var all115 = all_match({ +var all114 = all_match({ processors: [ - part585, + part584, select127, - part588, + part587, ], on_success: processor_chain([ dup17, @@ -8454,35 +7586,31 @@ var all115 = all_match({ ]), }); -var msg355 = msg("00018:10", all115); +var msg355 = msg("00018:10", all114); -var part589 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); +var part588 = match("MESSAGE#354:00018:11/1_0", "nwparser.p0", "Service %{service->} was %{p0}"); -var part590 = // "Pattern{Constant('Attack group '), Field(signame,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); +var part589 = match("MESSAGE#354:00018:11/1_1", "nwparser.p0", "Attack group %{signame->} was %{p0}"); var select128 = linear_select([ + part588, part589, - part590, ]); -var part591 = // "Pattern{Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); +var part590 = match("MESSAGE#354:00018:11/2", "nwparser.p0", "%{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} %{p0}"); -var part592 = // "Pattern{Constant('to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); +var part591 = match("MESSAGE#354:00018:11/3_0", "nwparser.p0", "to %{daddr}:%{dport}. %{p0}"); var select129 = linear_select([ - part592, + part591, dup16, ]); -var all116 = all_match({ +var all115 = all_match({ processors: [ - dup162, + dup160, select128, - part591, + part590, select129, dup10, ], @@ -8496,34 +7624,29 @@ var all116 = all_match({ ]), }); -var msg356 = msg("00018:11", all116); +var msg356 = msg("00018:11", all115); -var part593 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the '), Field(p0,false)}" -match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); +var part592 = match("MESSAGE#355:00018:12/0", "nwparser.payload", "In policy %{policy_id}, the %{p0}"); -var part594 = // "Pattern{Constant('application '), Field(p0,false)}" -match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); +var part593 = match("MESSAGE#355:00018:12/1_0", "nwparser.p0", "application %{p0}"); -var part595 = // "Pattern{Constant('attack severity '), Field(p0,false)}" -match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); +var part594 = match("MESSAGE#355:00018:12/1_1", "nwparser.p0", "attack severity %{p0}"); -var part596 = // "Pattern{Constant('DI attack component '), Field(p0,false)}" -match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); +var part595 = match("MESSAGE#355:00018:12/1_2", "nwparser.p0", "DI attack component %{p0}"); var select130 = linear_select([ + part593, part594, part595, - part596, ]); -var part597 = // "Pattern{Constant('was modified by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); +var part596 = match("MESSAGE#355:00018:12/2", "nwparser.p0", "was modified by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); -var all117 = all_match({ +var all116 = all_match({ processors: [ - part593, + part592, select130, - part597, + part596, ], on_success: processor_chain([ dup17, @@ -8535,17 +7658,16 @@ var all117 = all_match({ ]), }); -var msg357 = msg("00018:12", all117); +var msg357 = msg("00018:12", all116); -var part598 = // "Pattern{Field(,false), Constant('address '), Field(dhost,false), Constant('('), Field(daddr,false), Constant(') was '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); +var part597 = match("MESSAGE#356:00018:32/1", "nwparser.p0", "%{}address %{dhost}(%{daddr}) was %{disposition->} %{p0}"); -var all118 = all_match({ +var all117 = all_match({ processors: [ - dup364, - part598, - dup365, - dup166, + dup361, + part597, + dup362, + dup164, ], on_success: processor_chain([ dup17, @@ -8557,17 +7679,16 @@ var all118 = all_match({ ]), }); -var msg358 = msg("00018:32", all118); +var msg358 = msg("00018:32", all117); -var part599 = // "Pattern{Field(,false), Constant('address '), Field(dhost,true), Constant(' was '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); +var part598 = match("MESSAGE#357:00018:22/1", "nwparser.p0", "%{}address %{dhost->} was %{disposition->} %{p0}"); -var all119 = all_match({ +var all118 = all_match({ processors: [ - dup364, - part599, - dup365, - dup166, + dup361, + part598, + dup362, + dup164, ], on_success: processor_chain([ dup17, @@ -8579,24 +7700,22 @@ var all119 = all_match({ ]), }); -var msg359 = msg("00018:22", all119); +var msg359 = msg("00018:22", all118); -var part600 = // "Pattern{Field(agent,true), Constant(' was '), Field(disposition,true), Constant(' from policy '), Field(policy_id,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); +var part599 = match("MESSAGE#358:00018:15/0", "nwparser.payload", "%{agent->} was %{disposition->} from policy %{policy_id->} %{p0}"); var select131 = linear_select([ dup78, dup77, ]); -var part601 = // "Pattern{Constant('address by admin '), Field(administrator,true), Constant(' via NSRP Peer')}" -match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); +var part600 = match("MESSAGE#358:00018:15/2", "nwparser.p0", "address by admin %{administrator->} via NSRP Peer"); -var all120 = all_match({ +var all119 = all_match({ processors: [ - part600, + part599, select131, - part601, + part600, ], on_success: processor_chain([ dup17, @@ -8607,50 +7726,42 @@ var all120 = all_match({ ]), }); -var msg360 = msg("00018:15", all120); +var msg360 = msg("00018:15", all119); -var part602 = // "Pattern{Field(agent,true), Constant(' was '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); +var part601 = match("MESSAGE#359:00018:14/0", "nwparser.payload", "%{agent->} was %{disposition->} %{p0}"); -var part603 = // "Pattern{Constant('to'), Field(p0,false)}" -match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); +var part602 = match("MESSAGE#359:00018:14/1_0", "nwparser.p0", "to%{p0}"); -var part604 = // "Pattern{Constant('from'), Field(p0,false)}" -match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); +var part603 = match("MESSAGE#359:00018:14/1_1", "nwparser.p0", "from%{p0}"); var select132 = linear_select([ + part602, part603, - part604, ]); -var part605 = // "Pattern{Field(,false), Constant('policy '), Field(policy_id,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); +var part604 = match("MESSAGE#359:00018:14/2", "nwparser.p0", "%{}policy %{policy_id->} %{p0}"); -var part606 = // "Pattern{Constant('service '), Field(p0,false)}" -match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); +var part605 = match("MESSAGE#359:00018:14/3_0", "nwparser.p0", "service %{p0}"); -var part607 = // "Pattern{Constant('source address '), Field(p0,false)}" -match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); +var part606 = match("MESSAGE#359:00018:14/3_1", "nwparser.p0", "source address %{p0}"); -var part608 = // "Pattern{Constant('destination address '), Field(p0,false)}" -match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); +var part607 = match("MESSAGE#359:00018:14/3_2", "nwparser.p0", "destination address %{p0}"); var select133 = linear_select([ + part605, part606, part607, - part608, ]); -var part609 = // "Pattern{Constant('by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); +var part608 = match("MESSAGE#359:00018:14/4", "nwparser.p0", "by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})"); -var all121 = all_match({ +var all120 = all_match({ processors: [ - part602, + part601, select132, - part605, + part604, select133, - part609, + part608, ], on_success: processor_chain([ dup17, @@ -8662,10 +7773,9 @@ var all121 = all_match({ ]), }); -var msg361 = msg("00018:14", all121); +var msg361 = msg("00018:14", all120); -var part610 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ +var part609 = match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8674,10 +7784,9 @@ match("MESSAGE#360:00018:29", "nwparser.payload", "Service %{service->} was %{di dup5, ])); -var msg362 = msg("00018:29", part610); +var msg362 = msg("00018:29", part609); -var part611 = // "Pattern{Field(agent,true), Constant(' was added to policy '), Field(policy_id,true), Constant(' '), Field(rule_group,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer '), Field(space,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ +var part610 = match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to policy %{policy_id->} %{rule_group->} by admin %{administrator->} via NSRP Peer %{space->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8686,10 +7795,9 @@ match("MESSAGE#361:00018:07", "nwparser.payload", "%{agent->} was added to polic dup5, ])); -var msg363 = msg("00018:07", part611); +var msg363 = msg("00018:07", part610); -var part612 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part611 = match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8698,10 +7806,9 @@ match("MESSAGE#362:00018:18", "nwparser.payload", "Service %{service->} was %{di dup5, ])); -var msg364 = msg("00018:18", part612); +var msg364 = msg("00018:18", part611); -var part613 = // "Pattern{Constant('AntiSpam ns-profile was '), Field(disposition,true), Constant(' from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part612 = match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{disposition->} from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8710,10 +7817,9 @@ match("MESSAGE#363:00018:17", "nwparser.payload", "AntiSpam ns-profile was %{dis dup5, ])); -var msg365 = msg("00018:17", part613); +var msg365 = msg("00018:17", part612); -var part614 = // "Pattern{Constant('Source address Info '), Field(info,true), Constant(' was '), Field(disposition,true), Constant(' to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part613 = match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} was %{disposition->} to policy ID %{policy_id->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8722,52 +7828,45 @@ match("MESSAGE#364:00018:19", "nwparser.payload", "Source address Info %{info->} dup5, ])); -var msg366 = msg("00018:19", part614); +var msg366 = msg("00018:19", part613); -var part615 = // "Pattern{Constant('Destination '), Field(p0,false)}" -match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); +var part614 = match("MESSAGE#365:00018:23/0_0", "nwparser.payload", "Destination %{p0}"); -var part616 = // "Pattern{Constant('Source '), Field(p0,false)}" -match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); +var part615 = match("MESSAGE#365:00018:23/0_1", "nwparser.payload", "Source %{p0}"); var select134 = linear_select([ + part614, part615, - part616, ]); -var part617 = // "Pattern{Constant('address '), Field(info,true), Constant(' was added to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); +var part616 = match("MESSAGE#365:00018:23/1", "nwparser.p0", "address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} %{p0}"); -var part618 = // "Pattern{Constant('from host '), Field(p0,false)}" -match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); +var part617 = match("MESSAGE#365:00018:23/2_0", "nwparser.p0", "from host %{p0}"); var select135 = linear_select([ - part618, + part617, dup103, ]); -var part619 = // "Pattern{Field(saddr,true), Constant(' to '), Field(daddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); +var part618 = match("MESSAGE#365:00018:23/4_0", "nwparser.p0", "%{saddr->} to %{daddr->} %{p0}"); -var part620 = // "Pattern{Field(daddr,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); +var part619 = match("MESSAGE#365:00018:23/4_1", "nwparser.p0", "%{daddr->} %{p0}"); var select136 = linear_select([ + part618, part619, - part620, ]); -var part621 = // "Pattern{Field(dport,false), Constant(':('), Field(fld1,false), Constant(')')}" -match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); +var part620 = match("MESSAGE#365:00018:23/5", "nwparser.p0", "%{dport}:(%{fld1})"); -var all122 = all_match({ +var all121 = all_match({ processors: [ select134, - part617, + part616, select135, dup23, select136, - part621, + part620, ], on_success: processor_chain([ dup17, @@ -8779,10 +7878,9 @@ var all122 = all_match({ ]), }); -var msg367 = msg("00018:23", all122); +var msg367 = msg("00018:23", all121); -var part622 = // "Pattern{Constant('Service '), Field(service,true), Constant(' was deleted from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ +var part621 = match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8791,10 +7889,9 @@ match("MESSAGE#366:00018:21", "nwparser.payload", "Service %{service->} was dele dup5, ])); -var msg368 = msg("00018:21", part622); +var msg368 = msg("00018:21", part621); -var part623 = // "Pattern{Constant('Policy ('), Field(policyname,false), Constant(') was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part622 = match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{disposition->} by %{username->} via %{logon_type->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -8803,15 +7900,14 @@ match("MESSAGE#367:00018:24", "nwparser.payload", "Policy (%{policyname}) was %{ dup5, ])); -var msg369 = msg("00018:24", part623); +var msg369 = msg("00018:24", part622); -var part624 = // "Pattern{Field(,false), Constant('address '), Field(info,true), Constant(' was added to policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); +var part623 = match("MESSAGE#368:00018:25/1", "nwparser.p0", "%{}address %{info->} was added to policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); -var all123 = all_match({ +var all122 = all_match({ processors: [ - dup366, - part624, + dup363, + part623, ], on_success: processor_chain([ dup17, @@ -8823,15 +7919,14 @@ var all123 = all_match({ ]), }); -var msg370 = msg("00018:25", all123); +var msg370 = msg("00018:25", all122); -var part625 = // "Pattern{Field(,false), Constant('address '), Field(info,true), Constant(' was deleted from policy ID '), Field(policy_id,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); +var part624 = match("MESSAGE#369:00018:30/1", "nwparser.p0", "%{}address %{info->} was deleted from policy ID %{policy_id->} by %{username->} via %{logon_type->} from host %{saddr}. (%{fld1})"); -var all124 = all_match({ +var all123 = all_match({ processors: [ - dup366, - part625, + dup363, + part624, ], on_success: processor_chain([ dup17, @@ -8843,23 +7938,21 @@ var all124 = all_match({ ]), }); -var msg371 = msg("00018:30", all124); +var msg371 = msg("00018:30", all123); -var part626 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the application was modified to '), Field(disposition,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); +var part625 = match("MESSAGE#370:00018:26/0", "nwparser.payload", "In policy %{policy_id}, the application was modified to %{disposition->} by %{p0}"); -var part627 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant('. ('), Field(p0,false)}" -match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); +var part626 = match("MESSAGE#370:00018:26/2_1", "nwparser.p0", "%{logon_type->} from host %{saddr}. (%{p0}"); var select137 = linear_select([ dup48, - part627, + part626, ]); -var all125 = all_match({ +var all124 = all_match({ processors: [ - part626, - dup367, + part625, + dup364, select137, dup41, ], @@ -8873,10 +7966,9 @@ var all125 = all_match({ ]), }); -var msg372 = msg("00018:26", all125); +var msg372 = msg("00018:26", all124); -var part628 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the DI attack component was modified by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ +var part627 = match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the DI attack component was modified by %{username->} via %{logon_type->} from host %{saddr}:%{sport}. (%{fld1})", processor_chain([ dup17, dup2, dup4, @@ -8884,10 +7976,9 @@ match("MESSAGE#371:00018:27", "nwparser.payload", "In policy %{policy_id}, the D dup9, ])); -var msg373 = msg("00018:27", part628); +var msg373 = msg("00018:27", part627); -var part629 = // "Pattern{Constant('In policy '), Field(policyname,false), Constant(', the DI attack component was modified by admin '), Field(administrator,true), Constant(' via '), Field(logon_type,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ +var part628 = match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the DI attack component was modified by admin %{administrator->} via %{logon_type}. (%{fld1})", processor_chain([ dup17, dup2, dup4, @@ -8896,10 +7987,9 @@ match("MESSAGE#372:00018:28", "nwparser.payload", "In policy %{policyname}, the setc("info","the DI attack component was modified"), ])); -var msg374 = msg("00018:28", part629); +var msg374 = msg("00018:28", part628); -var part630 = // "Pattern{Constant('Policy ('), Field(policy_id,false), Constant(', '), Field(info,false), Constant(') was '), Field(disposition,false)}" -match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ +var part629 = match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info}) was %{disposition}", processor_chain([ dup17, dup2, dup3, @@ -8907,10 +7997,9 @@ match("MESSAGE#373:00018:03", "nwparser.payload", "Policy (%{policy_id}, %{info} dup5, ])); -var msg375 = msg("00018:03", part630); +var msg375 = msg("00018:03", part629); -var part631 = // "Pattern{Constant('In policy '), Field(policy_id,false), Constant(', the option '), Field(fld2,true), Constant(' was '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ +var part630 = match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the option %{fld2->} was %{disposition}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -8919,7 +8008,7 @@ match("MESSAGE#1213:00018:31", "nwparser.payload", "In policy %{policy_id}, the dup5, ])); -var msg376 = msg("00018:31", part631); +var msg376 = msg("00018:31", part630); var select138 = linear_select([ msg347, @@ -8954,8 +8043,7 @@ var select138 = linear_select([ msg376, ]); -var part632 = // "Pattern{Constant('Attempt to enable WebTrends has '), Field(disposition,true), Constant(' because WebTrends settings have not yet been configured')}" -match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ +var part631 = match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has %{disposition->} because WebTrends settings have not yet been configured", processor_chain([ dup18, dup2, dup3, @@ -8963,16 +8051,15 @@ match("MESSAGE#374:00019", "nwparser.payload", "Attempt to enable WebTrends has dup5, ])); -var msg377 = msg("00019", part632); +var msg377 = msg("00019", part631); -var part633 = // "Pattern{Constant('has '), Field(disposition,true), Constant(' because syslog settings have not yet been configured')}" -match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); +var part632 = match("MESSAGE#375:00019:01/2", "nwparser.p0", "has %{disposition->} because syslog settings have not yet been configured"); -var all126 = all_match({ +var all125 = all_match({ processors: [ - dup167, - dup368, - part633, + dup165, + dup365, + part632, ], on_success: processor_chain([ dup1, @@ -8983,25 +8070,22 @@ var all126 = all_match({ ]), }); -var msg378 = msg("00019:01", all126); +var msg378 = msg("00019:01", all125); -var part634 = // "Pattern{Constant('Socket cannot be assigned for '), Field(p0,false)}" -match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); +var part633 = match("MESSAGE#376:00019:02/0", "nwparser.payload", "Socket cannot be assigned for %{p0}"); -var part635 = // "Pattern{Constant('WebTrends'), Field(,false)}" -match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); +var part634 = match("MESSAGE#376:00019:02/1_0", "nwparser.p0", "WebTrends%{}"); -var part636 = // "Pattern{Constant('syslog'), Field(,false)}" -match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); +var part635 = match("MESSAGE#376:00019:02/1_1", "nwparser.p0", "syslog%{}"); var select139 = linear_select([ + part634, part635, - part636, ]); -var all127 = all_match({ +var all126 = all_match({ processors: [ - part634, + part633, select139, ], on_success: processor_chain([ @@ -9013,10 +8097,9 @@ var all127 = all_match({ ]), }); -var msg379 = msg("00019:02", all127); +var msg379 = msg("00019:02", all126); -var part637 = // "Pattern{Constant('Syslog VPN encryption has been '), Field(disposition,false)}" -match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ +var part636 = match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has been %{disposition}", processor_chain([ dup91, dup2, dup3, @@ -9024,27 +8107,27 @@ match("MESSAGE#377:00019:03", "nwparser.payload", "Syslog VPN encryption has bee dup5, ])); -var msg380 = msg("00019:03", part637); +var msg380 = msg("00019:03", part636); var select140 = linear_select([ - dup171, + dup169, dup78, ]); var select141 = linear_select([ dup139, - dup172, + dup170, dup137, dup122, ]); -var all128 = all_match({ +var all127 = all_match({ processors: [ - dup170, + dup168, select140, dup23, select141, - dup173, + dup171, ], on_success: processor_chain([ dup1, @@ -9055,36 +8138,28 @@ var all128 = all_match({ ]), }); -var msg381 = msg("00019:04", all128); +var msg381 = msg("00019:04", all127); -var part638 = // "Pattern{Constant('Syslog message level has been changed to '), Field(p0,false)}" -match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); +var part637 = match("MESSAGE#379:00019:05/0", "nwparser.payload", "Syslog message level has been changed to %{p0}"); -var part639 = // "Pattern{Constant('debug'), Field(,false)}" -match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); +var part638 = match("MESSAGE#379:00019:05/1_0", "nwparser.p0", "debug%{}"); -var part640 = // "Pattern{Constant('information'), Field(,false)}" -match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); +var part639 = match("MESSAGE#379:00019:05/1_1", "nwparser.p0", "information%{}"); -var part641 = // "Pattern{Constant('notification'), Field(,false)}" -match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); +var part640 = match("MESSAGE#379:00019:05/1_2", "nwparser.p0", "notification%{}"); -var part642 = // "Pattern{Constant('warning'), Field(,false)}" -match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); +var part641 = match("MESSAGE#379:00019:05/1_3", "nwparser.p0", "warning%{}"); -var part643 = // "Pattern{Constant('error'), Field(,false)}" -match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); +var part642 = match("MESSAGE#379:00019:05/1_4", "nwparser.p0", "error%{}"); -var part644 = // "Pattern{Constant('critical'), Field(,false)}" -match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); +var part643 = match("MESSAGE#379:00019:05/1_5", "nwparser.p0", "critical%{}"); -var part645 = // "Pattern{Constant('alert'), Field(,false)}" -match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); +var part644 = match("MESSAGE#379:00019:05/1_6", "nwparser.p0", "alert%{}"); -var part646 = // "Pattern{Constant('emergency'), Field(,false)}" -match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); +var part645 = match("MESSAGE#379:00019:05/1_7", "nwparser.p0", "emergency%{}"); var select142 = linear_select([ + part638, part639, part640, part641, @@ -9092,12 +8167,11 @@ var select142 = linear_select([ part643, part644, part645, - part646, ]); -var all129 = all_match({ +var all128 = all_match({ processors: [ - part638, + part637, select142, ], on_success: processor_chain([ @@ -9109,17 +8183,16 @@ var all129 = all_match({ ]), }); -var msg382 = msg("00019:05", all129); +var msg382 = msg("00019:05", all128); -var part647 = // "Pattern{Constant('has been changed to '), Field(p0,false)}" -match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); +var part646 = match("MESSAGE#380:00019:06/2", "nwparser.p0", "has been changed to %{p0}"); -var all130 = all_match({ +var all129 = all_match({ processors: [ - dup170, - dup369, - part647, - dup370, + dup168, + dup366, + part646, + dup367, ], on_success: processor_chain([ dup1, @@ -9130,10 +8203,9 @@ var all130 = all_match({ ]), }); -var msg383 = msg("00019:06", all130); +var msg383 = msg("00019:06", all129); -var part648 = // "Pattern{Constant('WebTrends VPN encryption has been '), Field(disposition,false)}" -match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ +var part647 = match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has been %{disposition}", processor_chain([ dup91, dup2, dup3, @@ -9141,10 +8213,9 @@ match("MESSAGE#381:00019:07", "nwparser.payload", "WebTrends VPN encryption has dup5, ])); -var msg384 = msg("00019:07", part648); +var msg384 = msg("00019:07", part647); -var part649 = // "Pattern{Constant('WebTrends has been '), Field(disposition,false)}" -match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ +var part648 = match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9152,22 +8223,21 @@ match("MESSAGE#382:00019:08", "nwparser.payload", "WebTrends has been %{disposit dup5, ])); -var msg385 = msg("00019:08", part649); +var msg385 = msg("00019:08", part648); -var part650 = // "Pattern{Constant('WebTrends host '), Field(p0,false)}" -match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); +var part649 = match("MESSAGE#383:00019:09/0", "nwparser.payload", "WebTrends host %{p0}"); var select143 = linear_select([ dup139, - dup172, + dup170, dup137, ]); -var all131 = all_match({ +var all130 = all_match({ processors: [ - part650, + part649, select143, - dup173, + dup171, ], on_success: processor_chain([ dup1, @@ -9178,22 +8248,20 @@ var all131 = all_match({ ]), }); -var msg386 = msg("00019:09", all131); +var msg386 = msg("00019:09", all130); -var part651 = // "Pattern{Constant('Traffic logging via syslog '), Field(p0,false)}" -match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); +var part650 = match("MESSAGE#384:00019:10/1_0", "nwparser.p0", "Traffic logging via syslog %{p0}"); -var part652 = // "Pattern{Constant('Syslog '), Field(p0,false)}" -match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); +var part651 = match("MESSAGE#384:00019:10/1_1", "nwparser.p0", "Syslog %{p0}"); var select144 = linear_select([ + part650, part651, - part652, ]); -var all132 = all_match({ +var all131 = all_match({ processors: [ - dup185, + dup183, select144, dup138, ], @@ -9206,16 +8274,15 @@ var all132 = all_match({ ]), }); -var msg387 = msg("00019:10", all132); +var msg387 = msg("00019:10", all131); -var part653 = // "Pattern{Constant('has '), Field(disposition,true), Constant(' because there is no syslog server defined')}" -match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); +var part652 = match("MESSAGE#385:00019:11/2", "nwparser.p0", "has %{disposition->} because there is no syslog server defined"); -var all133 = all_match({ +var all132 = all_match({ processors: [ - dup167, - dup368, - part653, + dup165, + dup365, + part652, ], on_success: processor_chain([ dup18, @@ -9226,10 +8293,9 @@ var all133 = all_match({ ]), }); -var msg388 = msg("00019:11", all133); +var msg388 = msg("00019:11", all132); -var part654 = // "Pattern{Constant('Removing all syslog servers'), Field(,false)}" -match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ +var part653 = match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{}", processor_chain([ dup1, dup2, dup3, @@ -9237,24 +8303,22 @@ match("MESSAGE#386:00019:12", "nwparser.payload", "Removing all syslog servers%{ dup5, ])); -var msg389 = msg("00019:12", part654); +var msg389 = msg("00019:12", part653); -var part655 = // "Pattern{Constant('Syslog server '), Field(hostip,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); +var part654 = match("MESSAGE#387:00019:13/0", "nwparser.payload", "Syslog server %{hostip->} %{p0}"); var select145 = linear_select([ dup107, dup106, ]); -var part656 = // "Pattern{Constant(''), Field(disposition,false)}" -match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); +var part655 = match("MESSAGE#387:00019:13/2", "nwparser.p0", "%{disposition}"); -var all134 = all_match({ +var all133 = all_match({ processors: [ - part655, + part654, select145, - part656, + part655, ], on_success: processor_chain([ dup1, @@ -9265,17 +8329,16 @@ var all134 = all_match({ ]), }); -var msg390 = msg("00019:13", all134); +var msg390 = msg("00019:13", all133); -var part657 = // "Pattern{Constant('for '), Field(hostip,true), Constant(' has been changed to '), Field(p0,false)}" -match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); +var part656 = match("MESSAGE#388:00019:14/2", "nwparser.p0", "for %{hostip->} has been changed to %{p0}"); -var all135 = all_match({ +var all134 = all_match({ processors: [ - dup170, - dup369, - part657, - dup370, + dup168, + dup366, + part656, + dup367, ], on_success: processor_chain([ dup50, @@ -9288,10 +8351,9 @@ var all135 = all_match({ ]), }); -var msg391 = msg("00019:14", all135); +var msg391 = msg("00019:14", all134); -var part658 = // "Pattern{Constant('Syslog cannot connect to the TCP server '), Field(hostip,false), Constant('; the connection is closed.')}" -match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ +var part657 = match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the TCP server %{hostip}; the connection is closed.", processor_chain([ dup27, dup2, dup3, @@ -9299,10 +8361,9 @@ match("MESSAGE#389:00019:15", "nwparser.payload", "Syslog cannot connect to the dup5, ])); -var msg392 = msg("00019:15", part658); +var msg392 = msg("00019:15", part657); -var part659 = // "Pattern{Constant('All syslog servers were removed.'), Field(,false)}" -match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ +var part658 = match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were removed.%{}", processor_chain([ setc("eventcategory","1701030000"), setc("ec_activity","Delete"), dup51, @@ -9312,10 +8373,9 @@ match("MESSAGE#390:00019:16", "nwparser.payload", "All syslog servers were remov dup5, ])); -var msg393 = msg("00019:16", part659); +var msg393 = msg("00019:16", part658); -var part660 = // "Pattern{Constant('Syslog server '), Field(hostip,true), Constant(' host port number has been changed to '), Field(network_port,true), Constant(' '), Field(fld5,false)}" -match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ +var part659 = match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} host port number has been changed to %{network_port->} %{fld5}", processor_chain([ dup50, dup43, dup51, @@ -9325,25 +8385,22 @@ match("MESSAGE#391:00019:17", "nwparser.payload", "Syslog server %{hostip->} hos dup5, ])); -var msg394 = msg("00019:17", part660); +var msg394 = msg("00019:17", part659); -var part661 = // "Pattern{Constant('Traffic logging '), Field(p0,false)}" -match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); +var part660 = match("MESSAGE#392:00019:18/0", "nwparser.payload", "Traffic logging %{p0}"); -var part662 = // "Pattern{Constant('via syslog '), Field(p0,false)}" -match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); +var part661 = match("MESSAGE#392:00019:18/1_0", "nwparser.p0", "via syslog %{p0}"); -var part663 = // "Pattern{Constant('for syslog server '), Field(hostip,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); +var part662 = match("MESSAGE#392:00019:18/1_1", "nwparser.p0", "for syslog server %{hostip->} %{p0}"); var select146 = linear_select([ + part661, part662, - part663, ]); -var all136 = all_match({ +var all135 = all_match({ processors: [ - part661, + part660, select146, dup138, ], @@ -9356,10 +8413,9 @@ var all136 = all_match({ ]), }); -var msg395 = msg("00019:18", all136); +var msg395 = msg("00019:18", all135); -var part664 = // "Pattern{Constant('Transport protocol for syslog server '), Field(hostip,true), Constant(' was changed to udp')}" -match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ +var part663 = match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog server %{hostip->} was changed to udp", processor_chain([ dup50, dup43, dup51, @@ -9369,10 +8425,9 @@ match("MESSAGE#393:00019:19", "nwparser.payload", "Transport protocol for syslog dup5, ])); -var msg396 = msg("00019:19", part664); +var msg396 = msg("00019:19", part663); -var part665 = // "Pattern{Constant('The traffic/IDP syslog is enabled on backup device by netscreen via web from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ +var part664 = match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is enabled on backup device by netscreen via web from host %{saddr->} to %{daddr}:%{dport}. (%{fld1})", processor_chain([ dup50, dup43, dup51, @@ -9382,7 +8437,7 @@ match("MESSAGE#394:00019:20", "nwparser.payload", "The traffic/IDP syslog is ena dup5, ])); -var msg397 = msg("00019:20", part665); +var msg397 = msg("00019:20", part664); var select147 = linear_select([ msg377, @@ -9408,8 +8463,7 @@ var select147 = linear_select([ msg397, ]); -var part666 = // "Pattern{Constant('Schedule '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ +var part665 = match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9417,42 +8471,37 @@ match("MESSAGE#395:00020", "nwparser.payload", "Schedule %{fld2->} has been %{di dup5, ])); -var msg398 = msg("00020", part666); +var msg398 = msg("00020", part665); -var part667 = // "Pattern{Constant('System memory is low '), Field(p0,false)}" -match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); +var part666 = match("MESSAGE#396:00020:01/0", "nwparser.payload", "System memory is low %{p0}"); -var part668 = // "Pattern{Constant('( '), Field(p0,false)}" -match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); +var part667 = match("MESSAGE#396:00020:01/1_1", "nwparser.p0", "( %{p0}"); var select148 = linear_select([ dup152, - part668, + part667, ]); -var part669 = // "Pattern{Constant(''), Field(fld2,true), Constant(' bytes allocated out of '), Field(p0,false)}" -match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); +var part668 = match("MESSAGE#396:00020:01/2", "nwparser.p0", "%{fld2->} bytes allocated out of %{p0}"); -var part670 = // "Pattern{Constant('total '), Field(fld3,true), Constant(' bytes')}" -match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); +var part669 = match("MESSAGE#396:00020:01/3_0", "nwparser.p0", "total %{fld3->} bytes"); -var part671 = // "Pattern{Field(fld4,true), Constant(' bytes total')}" -match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); +var part670 = match("MESSAGE#396:00020:01/3_1", "nwparser.p0", "%{fld4->} bytes total"); var select149 = linear_select([ + part669, part670, - part671, ]); -var all137 = all_match({ +var all136 = all_match({ processors: [ - part667, + part666, select148, - part669, + part668, select149, ], on_success: processor_chain([ - dup186, + dup184, dup2, dup3, dup4, @@ -9460,18 +8509,17 @@ var all137 = all_match({ ]), }); -var msg399 = msg("00020:01", all137); +var msg399 = msg("00020:01", all136); -var part672 = // "Pattern{Constant('System memory is low ('), Field(fld2,true), Constant(' allocated out of '), Field(fld3,true), Constant(' ) '), Field(fld4,true), Constant(' times in '), Field(fld5,false)}" -match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ - dup186, +var part671 = match("MESSAGE#397:00020:02", "nwparser.payload", "System memory is low (%{fld2->} allocated out of %{fld3->} ) %{fld4->} times in %{fld5}", processor_chain([ + dup184, dup2, dup3, dup4, dup5, ])); -var msg400 = msg("00020:02", part672); +var msg400 = msg("00020:02", part671); var select150 = linear_select([ msg398, @@ -9479,8 +8527,7 @@ var select150 = linear_select([ msg400, ]); -var part673 = // "Pattern{Constant('DIP '), Field(fld2,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ +var part672 = match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9488,10 +8535,9 @@ match("MESSAGE#398:00021", "nwparser.payload", "DIP %{fld2->} has been %{disposi dup5, ])); -var msg401 = msg("00021", part673); +var msg401 = msg("00021", part672); -var part674 = // "Pattern{Constant('IP pool '), Field(fld2,true), Constant(' with range '), Field(info,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ +var part673 = match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range %{info->} has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9499,10 +8545,9 @@ match("MESSAGE#399:00021:01", "nwparser.payload", "IP pool %{fld2->} with range dup5, ])); -var msg402 = msg("00021:01", part674); +var msg402 = msg("00021:01", part673); -var part675 = // "Pattern{Constant('DNS server is not configured'), Field(,false)}" -match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ +var part674 = match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured%{}", processor_chain([ dup18, dup2, dup3, @@ -9510,21 +8555,19 @@ match("MESSAGE#400:00021:02", "nwparser.payload", "DNS server is not configured% dup5, ])); -var msg403 = msg("00021:02", part675); +var msg403 = msg("00021:02", part674); -var part676 = // "Pattern{Constant('Connection refused by the DNS server'), Field(,false)}" -match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ - dup187, +var part675 = match("MESSAGE#401:00021:03", "nwparser.payload", "Connection refused by the DNS server%{}", processor_chain([ + dup185, dup2, dup3, dup4, dup5, ])); -var msg404 = msg("00021:03", part676); +var msg404 = msg("00021:03", part675); -var part677 = // "Pattern{Constant('Unknown DNS error'), Field(,false)}" -match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ +var part676 = match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", processor_chain([ dup117, dup2, dup3, @@ -9532,10 +8575,9 @@ match("MESSAGE#402:00021:04", "nwparser.payload", "Unknown DNS error%{}", proces dup5, ])); -var msg405 = msg("00021:04", part677); +var msg405 = msg("00021:04", part676); -var part678 = // "Pattern{Constant('DIP port-translatation stickiness was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ +var part677 = match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -9544,10 +8586,9 @@ match("MESSAGE#403:00021:05", "nwparser.payload", "DIP port-translatation sticki dup5, ])); -var msg406 = msg("00021:05", part678); +var msg406 = msg("00021:05", part677); -var part679 = // "Pattern{Constant('DIP port-translation stickiness was '), Field(disposition,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ +var part678 = match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickiness was %{disposition->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} (%{fld1})", processor_chain([ dup1, dup2, dup4, @@ -9556,7 +8597,7 @@ match("MESSAGE#404:00021:06", "nwparser.payload", "DIP port-translation stickine setc("info","DIP port-translation stickiness was modified"), ])); -var msg407 = msg("00021:06", part679); +var msg407 = msg("00021:06", part678); var select151 = linear_select([ msg401, @@ -9568,25 +8609,22 @@ var select151 = linear_select([ msg407, ]); -var part680 = // "Pattern{Constant('power supplies '), Field(p0,false)}" -match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); +var part679 = match("MESSAGE#405:00022/1_0", "nwparser.p0", "power supplies %{p0}"); -var part681 = // "Pattern{Constant('fans '), Field(p0,false)}" -match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); +var part680 = match("MESSAGE#405:00022/1_1", "nwparser.p0", "fans %{p0}"); var select152 = linear_select([ + part679, part680, - part681, ]); -var part682 = // "Pattern{Constant('are '), Field(fld2,true), Constant(' functioning properly')}" -match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); +var part681 = match("MESSAGE#405:00022/2", "nwparser.p0", "are %{fld2->} functioning properly"); -var all138 = all_match({ +var all137 = all_match({ processors: [ - dup188, + dup186, select152, - part682, + part681, ], on_success: processor_chain([ dup44, @@ -9597,34 +8635,30 @@ var all138 = all_match({ ]), }); -var msg408 = msg("00022", all138); +var msg408 = msg("00022", all137); -var part683 = // "Pattern{Constant('At least one power supply '), Field(p0,false)}" -match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); +var part682 = match("MESSAGE#406:00022:01/0_0", "nwparser.payload", "At least one power supply %{p0}"); -var part684 = // "Pattern{Constant('The power supply '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); +var part683 = match("MESSAGE#406:00022:01/0_1", "nwparser.payload", "The power supply %{fld2->} %{p0}"); -var part685 = // "Pattern{Constant('At least one fan '), Field(p0,false)}" -match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); +var part684 = match("MESSAGE#406:00022:01/0_2", "nwparser.payload", "At least one fan %{p0}"); var select153 = linear_select([ + part682, part683, part684, - part685, ]); -var part686 = // "Pattern{Constant('is not functioning properly'), Field(p0,false)}" -match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); +var part685 = match("MESSAGE#406:00022:01/1", "nwparser.p0", "is not functioning properly%{p0}"); -var all139 = all_match({ +var all138 = all_match({ processors: [ select153, - part686, - dup371, + part685, + dup368, ], on_success: processor_chain([ - dup189, + dup187, dup2, dup3, dup9, @@ -9633,10 +8667,9 @@ var all139 = all_match({ ]), }); -var msg409 = msg("00022:01", all139); +var msg409 = msg("00022:01", all138); -var part687 = // "Pattern{Constant('Global Manager VPN management tunnel has been '), Field(disposition,false)}" -match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ +var part686 = match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management tunnel has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9644,10 +8677,9 @@ match("MESSAGE#407:00022:02", "nwparser.payload", "Global Manager VPN management dup5, ])); -var msg410 = msg("00022:02", part687); +var msg410 = msg("00022:02", part686); -var part688 = // "Pattern{Constant('Global Manager domain name has been defined as '), Field(domain,false)}" -match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ +var part687 = match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name has been defined as %{domain}", processor_chain([ dup1, dup2, dup3, @@ -9655,38 +8687,32 @@ match("MESSAGE#408:00022:03", "nwparser.payload", "Global Manager domain name ha dup5, ])); -var msg411 = msg("00022:03", part688); +var msg411 = msg("00022:03", part687); -var part689 = // "Pattern{Constant('Reporting of the '), Field(p0,false)}" -match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); +var part688 = match("MESSAGE#409:00022:04/0", "nwparser.payload", "Reporting of the %{p0}"); -var part690 = // "Pattern{Constant('network activities '), Field(p0,false)}" -match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); +var part689 = match("MESSAGE#409:00022:04/1_0", "nwparser.p0", "network activities %{p0}"); -var part691 = // "Pattern{Constant('device resources '), Field(p0,false)}" -match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); +var part690 = match("MESSAGE#409:00022:04/1_1", "nwparser.p0", "device resources %{p0}"); -var part692 = // "Pattern{Constant('event logs '), Field(p0,false)}" -match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); +var part691 = match("MESSAGE#409:00022:04/1_2", "nwparser.p0", "event logs %{p0}"); -var part693 = // "Pattern{Constant('summary logs '), Field(p0,false)}" -match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); +var part692 = match("MESSAGE#409:00022:04/1_3", "nwparser.p0", "summary logs %{p0}"); var select154 = linear_select([ + part689, part690, part691, part692, - part693, ]); -var part694 = // "Pattern{Constant('to Global Manager has been '), Field(disposition,false)}" -match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); +var part693 = match("MESSAGE#409:00022:04/2", "nwparser.p0", "to Global Manager has been %{disposition}"); -var all140 = all_match({ +var all139 = all_match({ processors: [ - part689, + part688, select154, - part694, + part693, ], on_success: processor_chain([ dup1, @@ -9697,10 +8723,9 @@ var all140 = all_match({ ]), }); -var msg412 = msg("00022:04", all140); +var msg412 = msg("00022:04", all139); -var part695 = // "Pattern{Constant('Global Manager has been '), Field(disposition,false)}" -match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ +var part694 = match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -9708,30 +8733,26 @@ match("MESSAGE#410:00022:05", "nwparser.payload", "Global Manager has been %{dis dup5, ])); -var msg413 = msg("00022:05", part695); +var msg413 = msg("00022:05", part694); -var part696 = // "Pattern{Constant('Global Manager '), Field(p0,false)}" -match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); +var part695 = match("MESSAGE#411:00022:06/0", "nwparser.payload", "Global Manager %{p0}"); -var part697 = // "Pattern{Constant('report '), Field(p0,false)}" -match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); +var part696 = match("MESSAGE#411:00022:06/1_0", "nwparser.p0", "report %{p0}"); -var part698 = // "Pattern{Constant('listen '), Field(p0,false)}" -match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); +var part697 = match("MESSAGE#411:00022:06/1_1", "nwparser.p0", "listen %{p0}"); var select155 = linear_select([ + part696, part697, - part698, ]); -var part699 = // "Pattern{Constant('port has been set to '), Field(interface,false)}" -match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); +var part698 = match("MESSAGE#411:00022:06/2", "nwparser.p0", "port has been set to %{interface}"); -var all141 = all_match({ +var all140 = all_match({ processors: [ - part696, + part695, select155, - part699, + part698, ], on_success: processor_chain([ dup1, @@ -9742,10 +8763,9 @@ var all141 = all_match({ ]), }); -var msg414 = msg("00022:06", all141); +var msg414 = msg("00022:06", all140); -var part700 = // "Pattern{Constant('The Global Manager keep-alive value has been changed to '), Field(fld2,false)}" -match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ +var part699 = match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive value has been changed to %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -9753,59 +8773,51 @@ match("MESSAGE#412:00022:07", "nwparser.payload", "The Global Manager keep-alive dup5, ])); -var msg415 = msg("00022:07", part700); +var msg415 = msg("00022:07", part699); -var part701 = // "Pattern{Constant('System temperature '), Field(p0,false)}" -match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); +var part700 = match("MESSAGE#413:00022:08/0_0", "nwparser.payload", "System temperature %{p0}"); -var part702 = // "Pattern{Constant('System's temperature: '), Field(p0,false)}" -match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); +var part701 = match("MESSAGE#413:00022:08/0_1", "nwparser.payload", "System's temperature: %{p0}"); -var part703 = // "Pattern{Constant('The system temperature '), Field(p0,false)}" -match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); +var part702 = match("MESSAGE#413:00022:08/0_2", "nwparser.payload", "The system temperature %{p0}"); var select156 = linear_select([ + part700, part701, part702, - part703, ]); -var part704 = // "Pattern{Constant('('), Field(fld2,true), Constant(' C'), Field(p0,false)}" -match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); +var part703 = match("MESSAGE#413:00022:08/1", "nwparser.p0", "(%{fld2->} C%{p0}"); -var part705 = // "Pattern{Constant('entigrade, '), Field(p0,false)}" -match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); +var part704 = match("MESSAGE#413:00022:08/2_0", "nwparser.p0", "entigrade, %{p0}"); var select157 = linear_select([ - part705, + part704, dup96, ]); -var part706 = // "Pattern{Constant(''), Field(fld3,true), Constant(' F'), Field(p0,false)}" -match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); +var part705 = match("MESSAGE#413:00022:08/3", "nwparser.p0", "%{fld3->} F%{p0}"); -var part707 = // "Pattern{Constant('ahrenheit '), Field(p0,false)}" -match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); +var part706 = match("MESSAGE#413:00022:08/4_0", "nwparser.p0", "ahrenheit %{p0}"); var select158 = linear_select([ - part707, + part706, dup96, ]); -var part708 = // "Pattern{Constant(') is too high'), Field(,false)}" -match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); +var part707 = match("MESSAGE#413:00022:08/5", "nwparser.p0", ") is too high%{}"); -var all142 = all_match({ +var all141 = all_match({ processors: [ select156, - part704, + part703, select157, - part706, + part705, select158, - part708, + part707, ], on_success: processor_chain([ - dup190, + dup188, dup2, dup3, dup4, @@ -9813,29 +8825,27 @@ var all142 = all_match({ ]), }); -var msg416 = msg("00022:08", all142); +var msg416 = msg("00022:08", all141); -var part709 = // "Pattern{Constant('power supply is no'), Field(p0,false)}" -match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); +var part708 = match("MESSAGE#414:00022:09/2", "nwparser.p0", "power supply is no%{p0}"); var select159 = linear_select([ - dup193, - dup194, + dup191, + dup192, ]); -var part710 = // "Pattern{Constant('functioning properly'), Field(,false)}" -match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); +var part709 = match("MESSAGE#414:00022:09/4", "nwparser.p0", "functioning properly%{}"); -var all143 = all_match({ +var all142 = all_match({ processors: [ dup55, - dup372, - part709, + dup369, + part708, select159, - part710, + part709, ], on_success: processor_chain([ - dup190, + dup188, dup2, dup3, dup4, @@ -9843,25 +8853,22 @@ var all143 = all_match({ ]), }); -var msg417 = msg("00022:09", all143); +var msg417 = msg("00022:09", all142); -var part711 = // "Pattern{Constant('The NetScreen device was unable to upgrade the file system'), Field(p0,false)}" -match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); +var part710 = match("MESSAGE#415:00022:10/0", "nwparser.payload", "The NetScreen device was unable to upgrade the file system%{p0}"); -var part712 = // "Pattern{Constant(' due to an internal conflict'), Field(,false)}" -match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); +var part711 = match("MESSAGE#415:00022:10/1_0", "nwparser.p0", " due to an internal conflict%{}"); -var part713 = // "Pattern{Constant(', but the old file system is intact'), Field(,false)}" -match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); +var part712 = match("MESSAGE#415:00022:10/1_1", "nwparser.p0", ", but the old file system is intact%{}"); var select160 = linear_select([ + part711, part712, - part713, ]); -var all144 = all_match({ +var all143 = all_match({ processors: [ - part711, + part710, select160, ], on_success: processor_chain([ @@ -9873,25 +8880,22 @@ var all144 = all_match({ ]), }); -var msg418 = msg("00022:10", all144); +var msg418 = msg("00022:10", all143); -var part714 = // "Pattern{Constant('The NetScreen device was unable to upgrade '), Field(p0,false)}" -match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); +var part713 = match("MESSAGE#416:00022:11/0", "nwparser.payload", "The NetScreen device was unable to upgrade %{p0}"); -var part715 = // "Pattern{Constant('due to an internal conflict'), Field(,false)}" -match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); +var part714 = match("MESSAGE#416:00022:11/1_0", "nwparser.p0", "due to an internal conflict%{}"); -var part716 = // "Pattern{Constant('the loader, but the loader is intact'), Field(,false)}" -match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); +var part715 = match("MESSAGE#416:00022:11/1_1", "nwparser.p0", "the loader, but the loader is intact%{}"); var select161 = linear_select([ + part714, part715, - part716, ]); -var all145 = all_match({ +var all144 = all_match({ processors: [ - part714, + part713, select161, ], on_success: processor_chain([ @@ -9903,27 +8907,25 @@ var all145 = all_match({ ]), }); -var msg419 = msg("00022:11", all145); +var msg419 = msg("00022:11", all144); -var part717 = // "Pattern{Constant('Battery is no'), Field(p0,false)}" -match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); +var part716 = match("MESSAGE#417:00022:12/0", "nwparser.payload", "Battery is no%{p0}"); var select162 = linear_select([ - dup194, - dup193, + dup192, + dup191, ]); -var part718 = // "Pattern{Constant('functioning properly.'), Field(,false)}" -match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); +var part717 = match("MESSAGE#417:00022:12/2", "nwparser.p0", "functioning properly.%{}"); -var all146 = all_match({ +var all145 = all_match({ processors: [ - part717, + part716, select162, - part718, + part717, ], on_success: processor_chain([ - dup190, + dup188, dup2, dup3, dup4, @@ -9931,10 +8933,9 @@ var all146 = all_match({ ]), }); -var msg420 = msg("00022:12", all146); +var msg420 = msg("00022:12", all145); -var part719 = // "Pattern{Constant('System's temperature ('), Field(fld2,true), Constant(' Centigrade, '), Field(fld3,true), Constant(' Fahrenheit) is OK now.')}" -match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ +var part718 = match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2->} Centigrade, %{fld3->} Fahrenheit) is OK now.", processor_chain([ dup44, dup2, dup3, @@ -9942,10 +8943,9 @@ match("MESSAGE#418:00022:13", "nwparser.payload", "System's temperature (%{fld2- dup5, ])); -var msg421 = msg("00022:13", part719); +var msg421 = msg("00022:13", part718); -var part720 = // "Pattern{Constant('The power supply '), Field(fld2,true), Constant(' is functioning properly. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ +var part719 = match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is functioning properly. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -9954,7 +8954,7 @@ match("MESSAGE#419:00022:14", "nwparser.payload", "The power supply %{fld2->} is dup5, ])); -var msg422 = msg("00022:14", part720); +var msg422 = msg("00022:14", part719); var select163 = linear_select([ msg408, @@ -9974,38 +8974,35 @@ var select163 = linear_select([ msg422, ]); -var part721 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' is not responding')}" -match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ - dup189, +var part720 = match("MESSAGE#420:00023", "nwparser.payload", "VIP server %{hostip->} is not responding", processor_chain([ + dup187, dup2, dup3, dup4, dup5, ])); -var msg423 = msg("00023", part721); +var msg423 = msg("00023", part720); -var part722 = // "Pattern{Constant('VIP/load balance server '), Field(hostip,true), Constant(' cannot be contacted')}" -match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ - dup189, +var part721 = match("MESSAGE#421:00023:01", "nwparser.payload", "VIP/load balance server %{hostip->} cannot be contacted", processor_chain([ + dup187, dup2, dup3, dup4, dup5, ])); -var msg424 = msg("00023:01", part722); +var msg424 = msg("00023:01", part721); -var part723 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' cannot be contacted')}" -match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ - dup189, +var part722 = match("MESSAGE#422:00023:02", "nwparser.payload", "VIP server %{hostip->} cannot be contacted", processor_chain([ + dup187, dup2, dup3, dup4, dup5, ])); -var msg425 = msg("00023:02", part723); +var msg425 = msg("00023:02", part722); var select164 = linear_select([ msg423, @@ -10013,35 +9010,31 @@ var select164 = linear_select([ msg425, ]); -var part724 = // "Pattern{Constant('The DHCP '), Field(p0,false)}" -match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); +var part723 = match("MESSAGE#423:00024/0_0", "nwparser.payload", "The DHCP %{p0}"); -var part725 = // "Pattern{Constant(' DHCP '), Field(p0,false)}" -match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); +var part724 = match("MESSAGE#423:00024/0_1", "nwparser.payload", " DHCP %{p0}"); var select165 = linear_select([ + part723, part724, - part725, ]); -var part726 = // "Pattern{Constant('IP address pool has '), Field(p0,false)}" -match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); +var part725 = match("MESSAGE#423:00024/2_0", "nwparser.p0", "IP address pool has %{p0}"); -var part727 = // "Pattern{Constant('options have been '), Field(p0,false)}" -match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); +var part726 = match("MESSAGE#423:00024/2_1", "nwparser.p0", "options have been %{p0}"); var select166 = linear_select([ + part725, part726, - part727, ]); -var all147 = all_match({ +var all146 = all_match({ processors: [ select165, - dup195, + dup193, select166, dup52, - dup371, + dup368, ], on_success: processor_chain([ dup1, @@ -10053,38 +9046,32 @@ var all147 = all_match({ ]), }); -var msg426 = msg("00024", all147); +var msg426 = msg("00024", all146); -var part728 = // "Pattern{Constant('Traffic log '), Field(p0,false)}" -match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); +var part727 = match("MESSAGE#424:00024:01/0_0", "nwparser.payload", "Traffic log %{p0}"); -var part729 = // "Pattern{Constant('Alarm log '), Field(p0,false)}" -match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); +var part728 = match("MESSAGE#424:00024:01/0_1", "nwparser.payload", "Alarm log %{p0}"); -var part730 = // "Pattern{Constant('Event log '), Field(p0,false)}" -match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); +var part729 = match("MESSAGE#424:00024:01/0_2", "nwparser.payload", "Event log %{p0}"); -var part731 = // "Pattern{Constant('Self log '), Field(p0,false)}" -match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); +var part730 = match("MESSAGE#424:00024:01/0_3", "nwparser.payload", "Self log %{p0}"); -var part732 = // "Pattern{Constant('Asset Recovery log '), Field(p0,false)}" -match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); +var part731 = match("MESSAGE#424:00024:01/0_4", "nwparser.payload", "Asset Recovery log %{p0}"); var select167 = linear_select([ + part727, part728, part729, part730, part731, - part732, ]); -var part733 = // "Pattern{Constant('has overflowed'), Field(,false)}" -match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); +var part732 = match("MESSAGE#424:00024:01/1", "nwparser.p0", "has overflowed%{}"); -var all148 = all_match({ +var all147 = all_match({ processors: [ select167, - part733, + part732, ], on_success: processor_chain([ dup117, @@ -10095,30 +9082,26 @@ var all148 = all_match({ ]), }); -var msg427 = msg("00024:01", all148); +var msg427 = msg("00024:01", all147); -var part734 = // "Pattern{Constant('DHCP relay agent settings on '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); +var part733 = match("MESSAGE#425:00024:02/0", "nwparser.payload", "DHCP relay agent settings on %{fld2->} %{p0}"); -var part735 = // "Pattern{Constant('are '), Field(p0,false)}" -match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); +var part734 = match("MESSAGE#425:00024:02/1_0", "nwparser.p0", "are %{p0}"); -var part736 = // "Pattern{Constant('have been '), Field(p0,false)}" -match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); +var part735 = match("MESSAGE#425:00024:02/1_1", "nwparser.p0", "have been %{p0}"); var select168 = linear_select([ + part734, part735, - part736, ]); -var part737 = // "Pattern{Constant(''), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); +var part736 = match("MESSAGE#425:00024:02/2", "nwparser.p0", "%{disposition->} (%{fld1})"); -var all149 = all_match({ +var all148 = all_match({ processors: [ - part734, + part733, select168, - part737, + part736, ], on_success: processor_chain([ dup1, @@ -10130,24 +9113,22 @@ var all149 = all_match({ ]), }); -var msg428 = msg("00024:02", all149); +var msg428 = msg("00024:02", all148); -var part738 = // "Pattern{Constant('DHCP server IP address pool '), Field(p0,false)}" -match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); +var part737 = match("MESSAGE#426:00024:03/0", "nwparser.payload", "DHCP server IP address pool %{p0}"); var select169 = linear_select([ - dup196, + dup194, dup106, ]); -var part739 = // "Pattern{Constant('changed. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); +var part738 = match("MESSAGE#426:00024:03/2", "nwparser.p0", "changed. (%{fld1})"); -var all150 = all_match({ +var all149 = all_match({ processors: [ - part738, + part737, select169, - part739, + part738, ], on_success: processor_chain([ dup1, @@ -10159,7 +9140,7 @@ var all150 = all_match({ ]), }); -var msg429 = msg("00024:03", all150); +var msg429 = msg("00024:03", all149); var select170 = linear_select([ msg426, @@ -10168,8 +9149,7 @@ var select170 = linear_select([ msg429, ]); -var part740 = // "Pattern{Constant('The DHCP server IP address pool has changed'), Field(,false)}" -match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ +var part739 = match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool has changed%{}", processor_chain([ dup1, dup2, dup3, @@ -10177,10 +9157,9 @@ match("MESSAGE#427:00025", "nwparser.payload", "The DHCP server IP address pool dup5, ])); -var msg430 = msg("00025", part740); +var msg430 = msg("00025", part739); -var part741 = // "Pattern{Constant('PKI: The current device '), Field(disposition,true), Constant(' to save the certificate authority configuration.')}" -match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ +var part740 = match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{disposition->} to save the certificate authority configuration.", processor_chain([ dup86, dup2, dup3, @@ -10188,10 +9167,9 @@ match("MESSAGE#428:00025:01", "nwparser.payload", "PKI: The current device %{dis dup5, ])); -var msg431 = msg("00025:01", part741); +var msg431 = msg("00025:01", part740); -var part742 = // "Pattern{Field(disposition,true), Constant(' to send the X509 request file via e-mail')}" -match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ +var part741 = match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the X509 request file via e-mail", processor_chain([ dup86, dup2, dup3, @@ -10199,10 +9177,9 @@ match("MESSAGE#429:00025:02", "nwparser.payload", "%{disposition->} to send the dup5, ])); -var msg432 = msg("00025:02", part742); +var msg432 = msg("00025:02", part741); -var part743 = // "Pattern{Field(disposition,true), Constant(' to save the CA configuration')}" -match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ +var part742 = match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the CA configuration", processor_chain([ dup86, dup2, dup3, @@ -10210,10 +9187,9 @@ match("MESSAGE#430:00025:03", "nwparser.payload", "%{disposition->} to save the dup5, ])); -var msg433 = msg("00025:03", part743); +var msg433 = msg("00025:03", part742); -var part744 = // "Pattern{Constant('Cannot load more X509 certificates. The '), Field(result,false)}" -match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ +var part743 = match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certificates. The %{result}", processor_chain([ dup86, dup2, dup3, @@ -10221,7 +9197,7 @@ match("MESSAGE#431:00025:04", "nwparser.payload", "Cannot load more X509 certifi dup5, ])); -var msg434 = msg("00025:04", part744); +var msg434 = msg("00025:04", part743); var select171 = linear_select([ msg430, @@ -10231,8 +9207,7 @@ var select171 = linear_select([ msg434, ]); -var part745 = // "Pattern{Field(signame,true), Constant(' have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part744 = match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup3, @@ -10242,10 +9217,9 @@ match("MESSAGE#432:00026", "nwparser.payload", "%{signame->} have been detected! dup61, ])); -var msg435 = msg("00026", part745); +var msg435 = msg("00026", part744); -var part746 = // "Pattern{Field(signame,true), Constant(' have been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on interface '), Field(interface,false)}" -match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ +var part745 = match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on interface %{interface}", processor_chain([ dup58, dup2, dup3, @@ -10254,21 +9228,19 @@ match("MESSAGE#433:00026:13", "nwparser.payload", "%{signame->} have been detect dup61, ])); -var msg436 = msg("00026:13", part746); +var msg436 = msg("00026:13", part745); -var part747 = // "Pattern{Constant('PKA key has been '), Field(p0,false)}" -match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); +var part746 = match("MESSAGE#434:00026:01/2", "nwparser.p0", "PKA key has been %{p0}"); -var part748 = // "Pattern{Constant('admin user '), Field(administrator,false), Constant('. (Key ID = '), Field(fld2,false), Constant(')')}" -match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); +var part747 = match("MESSAGE#434:00026:01/4", "nwparser.p0", "admin user %{administrator}. (Key ID = %{fld2})"); -var all151 = all_match({ +var all150 = all_match({ processors: [ - dup197, - dup373, + dup195, + dup370, + part746, + dup371, part747, - dup374, - part748, ], on_success: processor_chain([ dup1, @@ -10279,35 +9251,31 @@ var all151 = all_match({ ]), }); -var msg437 = msg("00026:01", all151); +var msg437 = msg("00026:01", all150); -var part749 = // "Pattern{Constant(': SCS '), Field(p0,false)}" -match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); +var part748 = match("MESSAGE#435:00026:02/1_0", "nwparser.p0", ": SCS %{p0}"); var select172 = linear_select([ - part749, + part748, dup96, ]); -var part750 = // "Pattern{Constant('has been '), Field(disposition,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); +var part749 = match("MESSAGE#435:00026:02/2", "nwparser.p0", "has been %{disposition->} for %{p0}"); -var part751 = // "Pattern{Constant('root system '), Field(p0,false)}" -match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); +var part750 = match("MESSAGE#435:00026:02/3_0", "nwparser.p0", "root system %{p0}"); -var part752 = // "Pattern{Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); +var part751 = match("MESSAGE#435:00026:02/3_1", "nwparser.p0", "%{interface->} %{p0}"); var select173 = linear_select([ + part750, part751, - part752, ]); -var all152 = all_match({ +var all151 = all_match({ processors: [ - dup197, + dup195, select172, - part750, + part749, select173, dup116, ], @@ -10320,16 +9288,15 @@ var all152 = all_match({ ]), }); -var msg438 = msg("00026:02", all152); +var msg438 = msg("00026:02", all151); -var part753 = // "Pattern{Constant(''), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); +var part752 = match("MESSAGE#436:00026:03/2", "nwparser.p0", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}"); -var all153 = all_match({ +var all152 = all_match({ processors: [ - dup197, - dup373, - part753, + dup195, + dup370, + part752, ], on_success: processor_chain([ dup1, @@ -10340,33 +9307,30 @@ var all153 = all_match({ ]), }); -var msg439 = msg("00026:03", all153); +var msg439 = msg("00026:03", all152); -var part754 = // "Pattern{Constant('SCS: Connection has been terminated for admin user '), Field(administrator,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,false)}" -match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ - dup200, +var part753 = match("MESSAGE#437:00026:04", "nwparser.payload", "SCS: Connection has been terminated for admin user %{administrator->} at %{hostip}:%{network_port}", processor_chain([ + dup198, dup2, dup4, dup5, dup3, ])); -var msg440 = msg("00026:04", part754); +var msg440 = msg("00026:04", part753); -var part755 = // "Pattern{Constant('SCS: Host client has requested NO cipher from '), Field(interface,false)}" -match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ - dup200, +var part754 = match("MESSAGE#438:00026:05", "nwparser.payload", "SCS: Host client has requested NO cipher from %{interface}", processor_chain([ + dup198, dup2, dup3, dup4, dup5, ])); -var msg441 = msg("00026:05", part755); +var msg441 = msg("00026:05", part754); -var part756 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' has been authenticated using PKA RSA from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. (key-ID='), Field(fld2,false)}" -match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ - dup201, +var part755 = match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using PKA RSA from %{saddr}:%{sport}. (key-ID=%{fld2}", processor_chain([ + dup199, dup29, dup30, dup31, @@ -10377,11 +9341,10 @@ match("MESSAGE#439:00026:06", "nwparser.payload", "SCS: SSH user %{username->} h dup5, ])); -var msg442 = msg("00026:06", part756); +var msg442 = msg("00026:06", part755); -var part757 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' has been authenticated using password from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" -match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ - dup201, +var part756 = match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} has been authenticated using password from %{saddr}:%{sport}.", processor_chain([ + dup199, dup29, dup30, dup31, @@ -10392,22 +9355,20 @@ match("MESSAGE#440:00026:07", "nwparser.payload", "SCS: SSH user %{username->} h dup5, ])); -var msg443 = msg("00026:07", part757); +var msg443 = msg("00026:07", part756); -var part758 = // "Pattern{Constant('SSH user '), Field(username,true), Constant(' has been authenticated using '), Field(p0,false)}" -match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); +var part757 = match("MESSAGE#441:00026:08/0", "nwparser.payload", "SSH user %{username->} has been authenticated using %{p0}"); -var part759 = // "Pattern{Constant('from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' [ with key ID '), Field(fld2,true), Constant(' ]')}" -match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); +var part758 = match("MESSAGE#441:00026:08/2", "nwparser.p0", "from %{saddr}:%{sport->} [ with key ID %{fld2->} ]"); -var all154 = all_match({ +var all153 = all_match({ processors: [ + part757, + dup372, part758, - dup375, - part759, ], on_success: processor_chain([ - dup201, + dup199, dup29, dup30, dup31, @@ -10419,10 +9380,9 @@ var all154 = all_match({ ]), }); -var msg444 = msg("00026:08", all154); +var msg444 = msg("00026:08", all153); -var part760 = // "Pattern{Constant('IPSec tunnel on int '), Field(interface,true), Constant(' with tunnel ID '), Field(fld2,true), Constant(' received a packet with a bad SPI.')}" -match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ +var part759 = match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interface->} with tunnel ID %{fld2->} received a packet with a bad SPI.", processor_chain([ dup19, dup2, dup3, @@ -10430,45 +9390,40 @@ match("MESSAGE#442:00026:09", "nwparser.payload", "IPSec tunnel on int %{interfa dup5, ])); -var msg445 = msg("00026:09", part760); +var msg445 = msg("00026:09", part759); -var part761 = // "Pattern{Constant('SSH: '), Field(p0,false)}" -match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); +var part760 = match("MESSAGE#443:00026:10/0", "nwparser.payload", "SSH: %{p0}"); -var part762 = // "Pattern{Constant('Failed '), Field(p0,false)}" -match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); +var part761 = match("MESSAGE#443:00026:10/1_0", "nwparser.p0", "Failed %{p0}"); -var part763 = // "Pattern{Constant('Attempt '), Field(p0,false)}" -match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); +var part762 = match("MESSAGE#443:00026:10/1_1", "nwparser.p0", "Attempt %{p0}"); var select174 = linear_select([ + part761, part762, - part763, ]); -var part764 = // "Pattern{Constant('bind duplicate '), Field(p0,false)}" -match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); +var part763 = match("MESSAGE#443:00026:10/3_0", "nwparser.p0", "bind duplicate %{p0}"); var select175 = linear_select([ - part764, - dup203, + part763, + dup201, ]); -var part765 = // "Pattern{Constant('admin user ''), Field(administrator,false), Constant('' (Key ID '), Field(fld2,false), Constant(')')}" -match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); +var part764 = match("MESSAGE#443:00026:10/6", "nwparser.p0", "admin user '%{administrator}' (Key ID %{fld2})"); -var all155 = all_match({ +var all154 = all_match({ processors: [ - part761, + part760, select174, dup103, select175, - dup204, - dup376, - part765, + dup202, + dup373, + part764, ], on_success: processor_chain([ - dup205, + dup203, dup2, dup3, dup4, @@ -10476,10 +9431,9 @@ var all155 = all_match({ ]), }); -var msg446 = msg("00026:10", all155); +var msg446 = msg("00026:10", all154); -var part766 = // "Pattern{Constant('SSH: Maximum number of PKA keys ('), Field(fld2,false), Constant(') has been bound to user ''), Field(username,false), Constant('' Key not bound. (Key ID '), Field(fld3,false), Constant(')')}" -match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ +var part765 = match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA keys (%{fld2}) has been bound to user '%{username}' Key not bound. (Key ID %{fld3})", processor_chain([ dup44, dup2, dup3, @@ -10487,10 +9441,9 @@ match("MESSAGE#444:00026:11", "nwparser.payload", "SSH: Maximum number of PKA ke dup5, ])); -var msg447 = msg("00026:11", part766); +var msg447 = msg("00026:11", part765); -var part767 = // "Pattern{Constant('IKE '), Field(fld2,false), Constant(': Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed')}" -match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ +var part766 = match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbeats have exceeded the threshold. All Phase 1 and 2 SAs have been removed", processor_chain([ dup44, dup2, dup3, @@ -10498,7 +9451,7 @@ match("MESSAGE#445:00026:12", "nwparser.payload", "IKE %{fld2}: Missing heartbea dup5, ])); -var msg448 = msg("00026:12", part767); +var msg448 = msg("00026:12", part766); var select176 = linear_select([ msg435, @@ -10517,33 +9470,29 @@ var select176 = linear_select([ msg448, ]); -var part768 = // "Pattern{Constant('user '), Field(username,true), Constant(' from '), Field(p0,false)}" -match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); +var part767 = match("MESSAGE#446:00027/2", "nwparser.p0", "user %{username->} from %{p0}"); -var part769 = // "Pattern{Constant('IP address '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); +var part768 = match("MESSAGE#446:00027/3_0", "nwparser.p0", "IP address %{saddr}:%{sport}"); -var part770 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); +var part769 = match("MESSAGE#446:00027/3_1", "nwparser.p0", "%{saddr}:%{sport}"); -var part771 = // "Pattern{Constant('console'), Field(,false)}" -match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); +var part770 = match("MESSAGE#446:00027/3_2", "nwparser.p0", "console%{}"); var select177 = linear_select([ + part768, part769, part770, - part771, ]); -var all156 = all_match({ +var all155 = all_match({ processors: [ - dup206, - dup377, - part768, + dup204, + dup374, + part767, select177, ], on_success: processor_chain([ - dup208, + dup206, dup30, dup31, dup54, @@ -10554,10 +9503,9 @@ var all156 = all_match({ ]), }); -var msg449 = msg("00027", all156); +var msg449 = msg("00027", all155); -var part772 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to default port '), Field(change_new,false), Constant('. '), Field(info,false)}" -match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ +var part771 = match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to default port %{change_new}. %{info}", processor_chain([ dup1, dup2, dup3, @@ -10565,10 +9513,9 @@ match("MESSAGE#447:00027:01", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var msg450 = msg("00027:01", part772); +var msg450 = msg("00027:01", part771); -var part773 = // "Pattern{Field(change_attribute,true), Constant(' has been restored from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('. '), Field(info,false)}" -match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ +var part772 = match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has been restored from %{change_old->} to %{change_new}. %{info}", processor_chain([ dup1, dup2, dup3, @@ -10576,10 +9523,9 @@ match("MESSAGE#448:00027:02", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var msg451 = msg("00027:02", part773); +var msg451 = msg("00027:02", part772); -var part774 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to port '), Field(change_new,false), Constant('. '), Field(info,false)}" -match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ +var part773 = match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}. %{info}", processor_chain([ dup1, dup2, dup3, @@ -10587,10 +9533,9 @@ match("MESSAGE#449:00027:03", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var msg452 = msg("00027:03", part774); +var msg452 = msg("00027:03", part773); -var part775 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to port '), Field(change_new,false)}" -match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ +var part774 = match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to port %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -10598,43 +9543,38 @@ match("MESSAGE#450:00027:04", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var msg453 = msg("00027:04", part775); +var msg453 = msg("00027:04", part774); -var part776 = // "Pattern{Constant('ScreenOS '), Field(version,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); +var part775 = match("MESSAGE#451:00027:05/0", "nwparser.payload", "ScreenOS %{version->} %{p0}"); -var part777 = // "Pattern{Constant('Serial '), Field(p0,false)}" -match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); +var part776 = match("MESSAGE#451:00027:05/1_0", "nwparser.p0", "Serial %{p0}"); -var part778 = // "Pattern{Constant('serial '), Field(p0,false)}" -match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); +var part777 = match("MESSAGE#451:00027:05/1_1", "nwparser.p0", "serial %{p0}"); var select178 = linear_select([ + part776, part777, - part778, ]); -var part779 = // "Pattern{Constant('# '), Field(fld2,false), Constant(': Asset recovery '), Field(p0,false)}" -match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); +var part778 = match("MESSAGE#451:00027:05/2", "nwparser.p0", "# %{fld2}: Asset recovery %{p0}"); -var part780 = // "Pattern{Constant('performed '), Field(p0,false)}" -match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); +var part779 = match("MESSAGE#451:00027:05/3_0", "nwparser.p0", "performed %{p0}"); var select179 = linear_select([ - part780, + part779, dup127, ]); var select180 = linear_select([ - dup209, - dup210, + dup207, + dup208, ]); -var all157 = all_match({ +var all156 = all_match({ processors: [ - part776, + part775, select178, - part779, + part778, select179, dup23, select180, @@ -10648,19 +9588,18 @@ var all157 = all_match({ ]), }); -var msg454 = msg("00027:05", all157); +var msg454 = msg("00027:05", all156); -var part781 = // "Pattern{Constant('Device Reset (Asset Recovery) has been '), Field(p0,false)}" -match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); +var part780 = match("MESSAGE#452:00027:06/0", "nwparser.payload", "Device Reset (Asset Recovery) has been %{p0}"); var select181 = linear_select([ - dup210, - dup209, + dup208, + dup207, ]); -var all158 = all_match({ +var all157 = all_match({ processors: [ - part781, + part780, select181, ], on_success: processor_chain([ @@ -10672,10 +9611,9 @@ var all158 = all_match({ ]), }); -var msg455 = msg("00027:06", all158); +var msg455 = msg("00027:06", all157); -var part782 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('. '), Field(info,false)}" -match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ +var part781 = match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}. %{info}", processor_chain([ dup1, dup2, dup3, @@ -10683,10 +9621,9 @@ match("MESSAGE#453:00027:07", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); -var msg456 = msg("00027:07", part782); +var msg456 = msg("00027:07", part781); -var part783 = // "Pattern{Constant('System configuration has been erased'), Field(,false)}" -match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ +var part782 = match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been erased%{}", processor_chain([ dup1, dup2, dup3, @@ -10694,10 +9631,9 @@ match("MESSAGE#454:00027:08", "nwparser.payload", "System configuration has been dup5, ])); -var msg457 = msg("00027:08", part783); +var msg457 = msg("00027:08", part782); -var part784 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' is due to expire in '), Field(fld3,false), Constant('.')}" -match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ +var part783 = match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due to expire in %{fld3}.", processor_chain([ dup44, dup2, dup3, @@ -10705,10 +9641,9 @@ match("MESSAGE#455:00027:09", "nwparser.payload", "License key %{fld2->} is due dup5, ])); -var msg458 = msg("00027:09", part784); +var msg458 = msg("00027:09", part783); -var part785 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' has expired.')}" -match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ +var part784 = match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has expired.", processor_chain([ dup44, dup2, dup3, @@ -10716,10 +9651,9 @@ match("MESSAGE#456:00027:10", "nwparser.payload", "License key %{fld2->} has exp dup5, ])); -var msg459 = msg("00027:10", part785); +var msg459 = msg("00027:10", part784); -var part786 = // "Pattern{Constant('License key '), Field(fld2,true), Constant(' expired after 30-day grace period.')}" -match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ +var part785 = match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired after 30-day grace period.", processor_chain([ dup44, dup2, dup3, @@ -10727,27 +9661,24 @@ match("MESSAGE#457:00027:11", "nwparser.payload", "License key %{fld2->} expired dup5, ])); -var msg460 = msg("00027:11", part786); +var msg460 = msg("00027:11", part785); -var part787 = // "Pattern{Constant('Request to retrieve license key failed to reach '), Field(p0,false)}" -match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); +var part786 = match("MESSAGE#458:00027:12/0", "nwparser.payload", "Request to retrieve license key failed to reach %{p0}"); -var part788 = // "Pattern{Constant('the server '), Field(p0,false)}" -match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); +var part787 = match("MESSAGE#458:00027:12/1_0", "nwparser.p0", "the server %{p0}"); var select182 = linear_select([ - part788, - dup195, + part787, + dup193, ]); -var part789 = // "Pattern{Constant('by '), Field(fld2,false), Constant('. Server url: '), Field(url,false)}" -match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); +var part788 = match("MESSAGE#458:00027:12/2", "nwparser.p0", "by %{fld2}. Server url: %{url}"); -var all159 = all_match({ +var all158 = all_match({ processors: [ - part787, + part786, select182, - part789, + part788, ], on_success: processor_chain([ dup19, @@ -10758,19 +9689,18 @@ var all159 = all_match({ ]), }); -var msg461 = msg("00027:12", all159); +var msg461 = msg("00027:12", all158); -var part790 = // "Pattern{Constant('user '), Field(username,false)}" -match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); +var part789 = match("MESSAGE#459:00027:13/2", "nwparser.p0", "user %{username}"); -var all160 = all_match({ +var all159 = all_match({ processors: [ - dup206, - dup377, - part790, + dup204, + dup374, + part789, ], on_success: processor_chain([ - dup208, + dup206, dup30, dup31, dup54, @@ -10781,30 +9711,26 @@ var all160 = all_match({ ]), }); -var msg462 = msg("00027:13", all160); +var msg462 = msg("00027:13", all159); -var part791 = // "Pattern{Constant('Configuration Erasure Process '), Field(p0,false)}" -match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); +var part790 = match("MESSAGE#460:00027:14/0", "nwparser.payload", "Configuration Erasure Process %{p0}"); -var part792 = // "Pattern{Constant('has been initiated '), Field(p0,false)}" -match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); +var part791 = match("MESSAGE#460:00027:14/1_0", "nwparser.p0", "has been initiated %{p0}"); -var part793 = // "Pattern{Constant('aborted '), Field(p0,false)}" -match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); +var part792 = match("MESSAGE#460:00027:14/1_1", "nwparser.p0", "aborted %{p0}"); var select183 = linear_select([ + part791, part792, - part793, ]); -var part794 = // "Pattern{Constant('.'), Field(space,false), Constant('('), Field(fld1,false), Constant(')')}" -match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); +var part793 = match("MESSAGE#460:00027:14/2", "nwparser.p0", ".%{space}(%{fld1})"); -var all161 = all_match({ +var all160 = all_match({ processors: [ - part791, + part790, select183, - part794, + part793, ], on_success: processor_chain([ dup1, @@ -10816,10 +9742,9 @@ var all161 = all_match({ ]), }); -var msg463 = msg("00027:14", all161); +var msg463 = msg("00027:14", all160); -var part795 = // "Pattern{Constant('Waiting for 2nd confirmation. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ +var part794 = match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -10828,10 +9753,9 @@ match("MESSAGE#461:00027:15", "nwparser.payload", "Waiting for 2nd confirmation. dup5, ])); -var msg464 = msg("00027:15", part795); +var msg464 = msg("00027:15", part794); -var part796 = // "Pattern{Constant('Admin '), Field(fld3,true), Constant(' policy id '), Field(policy_id,true), Constant(' name "'), Field(fld2,true), Constant(' has been re-enabled by NetScreen system after being locked due to excessive failed login attempts ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ +var part795 = match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{policy_id->} name \"%{fld2->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -10840,10 +9764,9 @@ match("MESSAGE#1220:00027:16", "nwparser.payload", "Admin %{fld3->} policy id %{ dup5, ])); -var msg465 = msg("00027:16", part796); +var msg465 = msg("00027:16", part795); -var part797 = // "Pattern{Constant('Admin '), Field(username,true), Constant(' is locked and will be unlocked after '), Field(duration,true), Constant(' minutes ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ +var part796 = match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locked and will be unlocked after %{duration->} minutes (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -10851,10 +9774,9 @@ match("MESSAGE#1225:00027:17", "nwparser.payload", "Admin %{username->} is locke dup9, ])); -var msg466 = msg("00027:17", part797); +var msg466 = msg("00027:17", part796); -var part798 = // "Pattern{Constant('Login attempt by admin '), Field(username,true), Constant(' from '), Field(saddr,true), Constant(' is refused as this account is locked ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ +var part797 = match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{username->} from %{saddr->} is refused as this account is locked (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -10862,10 +9784,9 @@ match("MESSAGE#1226:00027:18", "nwparser.payload", "Login attempt by admin %{use dup9, ])); -var msg467 = msg("00027:18", part798); +var msg467 = msg("00027:18", part797); -var part799 = // "Pattern{Constant('Admin '), Field(username,true), Constant(' has been re-enabled by NetScreen system after being locked due to excessive failed login attempts ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ +var part798 = match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been re-enabled by NetScreen system after being locked due to excessive failed login attempts (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -10873,7 +9794,7 @@ match("MESSAGE#1227:00027:19", "nwparser.payload", "Admin %{username->} has been dup9, ])); -var msg468 = msg("00027:19", part799); +var msg468 = msg("00027:19", part798); var select184 = linear_select([ msg449, @@ -10898,28 +9819,24 @@ var select184 = linear_select([ msg468, ]); -var part800 = // "Pattern{Constant('An Intruder'), Field(p0,false)}" -match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); +var part799 = match("MESSAGE#462:00028/0_0", "nwparser.payload", "An Intruder%{p0}"); -var part801 = // "Pattern{Constant('Intruder'), Field(p0,false)}" -match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); +var part800 = match("MESSAGE#462:00028/0_1", "nwparser.payload", "Intruder%{p0}"); -var part802 = // "Pattern{Constant('An intruter'), Field(p0,false)}" -match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); +var part801 = match("MESSAGE#462:00028/0_2", "nwparser.payload", "An intruter%{p0}"); var select185 = linear_select([ + part799, part800, part801, - part802, ]); -var part803 = // "Pattern{Field(,false), Constant('has attempted to connect to the NetScreen-Global PRO port! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); +var part802 = match("MESSAGE#462:00028/1", "nwparser.p0", "%{}has attempted to connect to the NetScreen-Global PRO port! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); -var all162 = all_match({ +var all161 = all_match({ processors: [ select185, - part803, + part802, ], on_success: processor_chain([ dup58, @@ -10933,52 +9850,46 @@ var all162 = all_match({ ]), }); -var msg469 = msg("00028", all162); +var msg469 = msg("00028", all161); -var part804 = // "Pattern{Constant('DNS has been refreshed'), Field(,false)}" -match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ - dup211, +var part803 = match("MESSAGE#463:00029", "nwparser.payload", "DNS has been refreshed%{}", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg470 = msg("00029", part804); +var msg470 = msg("00029", part803); -var part805 = // "Pattern{Constant('DHCP file write: out of memory.'), Field(,false)}" -match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ - dup186, +var part804 = match("MESSAGE#464:00029:01", "nwparser.payload", "DHCP file write: out of memory.%{}", processor_chain([ + dup184, dup2, dup3, dup4, dup5, ])); -var msg471 = msg("00029:01", part805); +var msg471 = msg("00029:01", part804); -var part806 = // "Pattern{Constant('The DHCP process cannot open file '), Field(fld2,true), Constant(' to '), Field(p0,false)}" -match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); +var part805 = match("MESSAGE#465:00029:02/0", "nwparser.payload", "The DHCP process cannot open file %{fld2->} to %{p0}"); -var part807 = // "Pattern{Constant('read '), Field(p0,false)}" -match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); +var part806 = match("MESSAGE#465:00029:02/1_0", "nwparser.p0", "read %{p0}"); -var part808 = // "Pattern{Constant('write '), Field(p0,false)}" -match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); +var part807 = match("MESSAGE#465:00029:02/1_1", "nwparser.p0", "write %{p0}"); var select186 = linear_select([ + part806, part807, - part808, ]); -var part809 = // "Pattern{Constant('data.'), Field(,false)}" -match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); +var part808 = match("MESSAGE#465:00029:02/2", "nwparser.p0", "data.%{}"); -var all163 = all_match({ +var all162 = all_match({ processors: [ - part806, + part805, select186, - part809, + part808, ], on_success: processor_chain([ dup117, @@ -10989,32 +9900,28 @@ var all163 = all_match({ ]), }); -var msg472 = msg("00029:02", all163); +var msg472 = msg("00029:02", all162); -var part810 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is full. Unable to '), Field(p0,false)}" -match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); +var part809 = match("MESSAGE#466:00029:03/2", "nwparser.p0", "%{} %{interface->} is full. Unable to %{p0}"); -var part811 = // "Pattern{Constant('commit '), Field(p0,false)}" -match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); +var part810 = match("MESSAGE#466:00029:03/3_0", "nwparser.p0", "commit %{p0}"); -var part812 = // "Pattern{Constant('offer '), Field(p0,false)}" -match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); +var part811 = match("MESSAGE#466:00029:03/3_1", "nwparser.p0", "offer %{p0}"); var select187 = linear_select([ + part810, part811, - part812, ]); -var part813 = // "Pattern{Constant('IP address to client at '), Field(fld2,false)}" -match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); +var part812 = match("MESSAGE#466:00029:03/4", "nwparser.p0", "IP address to client at %{fld2}"); -var all164 = all_match({ +var all163 = all_match({ processors: [ - dup212, - dup339, - part810, + dup210, + dup337, + part809, select187, - part813, + part812, ], on_success: processor_chain([ dup117, @@ -11025,10 +9932,9 @@ var all164 = all_match({ ]), }); -var msg473 = msg("00029:03", all164); +var msg473 = msg("00029:03", all163); -var part814 = // "Pattern{Constant('DHCP server set to OFF on '), Field(interface,true), Constant(' (another server found on '), Field(hostip,false), Constant(').')}" -match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ +var part813 = match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{interface->} (another server found on %{hostip}).", processor_chain([ dup44, dup2, dup3, @@ -11036,7 +9942,7 @@ match("MESSAGE#467:00029:04", "nwparser.payload", "DHCP server set to OFF on %{i dup5, ])); -var msg474 = msg("00029:04", part814); +var msg474 = msg("00029:04", part813); var select188 = linear_select([ msg470, @@ -11046,8 +9952,7 @@ var select188 = linear_select([ msg474, ]); -var part815 = // "Pattern{Constant('CA configuration is invalid'), Field(,false)}" -match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ +var part814 = match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", processor_chain([ dup18, dup2, dup3, @@ -11055,25 +9960,22 @@ match("MESSAGE#468:00030", "nwparser.payload", "CA configuration is invalid%{}", dup5, ])); -var msg475 = msg("00030", part815); +var msg475 = msg("00030", part814); -var part816 = // "Pattern{Constant('DSS checking of CRLs has been changed from '), Field(p0,false)}" -match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); +var part815 = match("MESSAGE#469:00030:01/0", "nwparser.payload", "DSS checking of CRLs has been changed from %{p0}"); -var part817 = // "Pattern{Constant('0 to 1'), Field(,false)}" -match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); +var part816 = match("MESSAGE#469:00030:01/1_0", "nwparser.p0", "0 to 1%{}"); -var part818 = // "Pattern{Constant('1 to 0'), Field(,false)}" -match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); +var part817 = match("MESSAGE#469:00030:01/1_1", "nwparser.p0", "1 to 0%{}"); var select189 = linear_select([ + part816, part817, - part818, ]); -var all165 = all_match({ +var all164 = all_match({ processors: [ - part816, + part815, select189, ], on_success: processor_chain([ @@ -11085,10 +9987,9 @@ var all165 = all_match({ ]), }); -var msg476 = msg("00030:01", all165); +var msg476 = msg("00030:01", all164); -var part819 = // "Pattern{Constant('For the X509 certificate '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part818 = match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -11096,10 +9997,9 @@ match("MESSAGE#470:00030:05", "nwparser.payload", "For the X509 certificate %{ch dup5, ])); -var msg477 = msg("00030:05", part819); +var msg477 = msg("00030:05", part818); -var part820 = // "Pattern{Constant('In the X509 certificate request the '), Field(fld2,true), Constant(' field has been changed from '), Field(fld3,false)}" -match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ +var part819 = match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate request the %{fld2->} field has been changed from %{fld3}", processor_chain([ dup1, dup2, dup3, @@ -11107,10 +10007,9 @@ match("MESSAGE#471:00030:06", "nwparser.payload", "In the X509 certificate reque dup5, ])); -var msg478 = msg("00030:06", part820); +var msg478 = msg("00030:06", part819); -var part821 = // "Pattern{Constant('RA X509 certificate cannot be loaded'), Field(,false)}" -match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ +var part820 = match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be loaded%{}", processor_chain([ dup19, dup2, dup3, @@ -11118,10 +10017,9 @@ match("MESSAGE#472:00030:07", "nwparser.payload", "RA X509 certificate cannot be dup5, ])); -var msg479 = msg("00030:07", part821); +var msg479 = msg("00030:07", part820); -var part822 = // "Pattern{Constant('Self-signed X509 certificate cannot be generated'), Field(,false)}" -match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ +var part821 = match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate cannot be generated%{}", processor_chain([ dup86, dup2, dup3, @@ -11129,10 +10027,9 @@ match("MESSAGE#473:00030:10", "nwparser.payload", "Self-signed X509 certificate dup5, ])); -var msg480 = msg("00030:10", part822); +var msg480 = msg("00030:10", part821); -var part823 = // "Pattern{Constant('The public key for ScreenOS image has successfully been updated'), Field(,false)}" -match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ +var part822 = match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS image has successfully been updated%{}", processor_chain([ dup1, dup2, dup3, @@ -11140,25 +10037,22 @@ match("MESSAGE#474:00030:12", "nwparser.payload", "The public key for ScreenOS i dup5, ])); -var msg481 = msg("00030:12", part823); +var msg481 = msg("00030:12", part822); -var part824 = // "Pattern{Constant('The public key used for ScreenOS image authentication cannot be '), Field(p0,false)}" -match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); +var part823 = match("MESSAGE#475:00030:13/0", "nwparser.payload", "The public key used for ScreenOS image authentication cannot be %{p0}"); -var part825 = // "Pattern{Constant('decoded'), Field(,false)}" -match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); +var part824 = match("MESSAGE#475:00030:13/1_0", "nwparser.p0", "decoded%{}"); -var part826 = // "Pattern{Constant('loaded'), Field(,false)}" -match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); +var part825 = match("MESSAGE#475:00030:13/1_1", "nwparser.p0", "loaded%{}"); var select190 = linear_select([ + part824, part825, - part826, ]); -var all166 = all_match({ +var all165 = all_match({ processors: [ - part824, + part823, select190, ], on_success: processor_chain([ @@ -11172,48 +10066,41 @@ var all166 = all_match({ ]), }); -var msg482 = msg("00030:13", all166); +var msg482 = msg("00030:13", all165); -var part827 = // "Pattern{Constant('CA IDENT '), Field(p0,false)}" -match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); +var part826 = match("MESSAGE#476:00030:14/1_0", "nwparser.p0", "CA IDENT %{p0}"); -var part828 = // "Pattern{Constant('Challenge password '), Field(p0,false)}" -match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); +var part827 = match("MESSAGE#476:00030:14/1_1", "nwparser.p0", "Challenge password %{p0}"); -var part829 = // "Pattern{Constant('CA CGI URL '), Field(p0,false)}" -match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); +var part828 = match("MESSAGE#476:00030:14/1_2", "nwparser.p0", "CA CGI URL %{p0}"); -var part830 = // "Pattern{Constant('RA CGI URL '), Field(p0,false)}" -match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); +var part829 = match("MESSAGE#476:00030:14/1_3", "nwparser.p0", "RA CGI URL %{p0}"); var select191 = linear_select([ + part826, part827, part828, part829, - part830, ]); -var part831 = // "Pattern{Constant('for SCEP '), Field(p0,false)}" -match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); +var part830 = match("MESSAGE#476:00030:14/2", "nwparser.p0", "for SCEP %{p0}"); -var part832 = // "Pattern{Constant('requests '), Field(p0,false)}" -match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); +var part831 = match("MESSAGE#476:00030:14/3_0", "nwparser.p0", "requests %{p0}"); var select192 = linear_select([ - part832, + part831, dup16, ]); -var part833 = // "Pattern{Constant('has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); +var part832 = match("MESSAGE#476:00030:14/4", "nwparser.p0", "has been changed from %{change_old->} to %{change_new}"); -var all167 = all_match({ +var all166 = all_match({ processors: [ dup55, select191, - part831, + part830, select192, - part833, + part832, ], on_success: processor_chain([ dup1, @@ -11224,14 +10111,13 @@ var all167 = all_match({ ]), }); -var msg483 = msg("00030:14", all167); +var msg483 = msg("00030:14", all166); -var msg484 = msg("00030:02", dup378); +var msg484 = msg("00030:02", dup375); -var part834 = // "Pattern{Constant('X509 certificate for ScreenOS image authentication is invalid'), Field(,false)}" -match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ +var part833 = match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS image authentication is invalid%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11240,10 +10126,9 @@ match("MESSAGE#478:00030:15", "nwparser.payload", "X509 certificate for ScreenOS dup5, ])); -var msg485 = msg("00030:15", part834); +var msg485 = msg("00030:15", part833); -var part835 = // "Pattern{Constant('X509 certificate has been deleted'), Field(,false)}" -match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ +var part834 = match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been deleted%{}", processor_chain([ dup1, dup2, dup3, @@ -11251,10 +10136,9 @@ match("MESSAGE#479:00030:16", "nwparser.payload", "X509 certificate has been del dup5, ])); -var msg486 = msg("00030:16", part835); +var msg486 = msg("00030:16", part834); -var part836 = // "Pattern{Constant('PKI CRL: no revoke info accept per config DN '), Field(interface,false), Constant('.')}" -match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ +var part835 = match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accept per config DN %{interface}.", processor_chain([ dup1, dup2, dup3, @@ -11262,30 +10146,26 @@ match("MESSAGE#480:00030:18", "nwparser.payload", "PKI CRL: no revoke info accep dup5, ])); -var msg487 = msg("00030:18", part836); +var msg487 = msg("00030:18", part835); -var part837 = // "Pattern{Constant('PKI: A configurable item '), Field(change_attribute,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); +var part836 = match("MESSAGE#481:00030:19/0", "nwparser.payload", "PKI: A configurable item %{change_attribute->} %{p0}"); -var part838 = // "Pattern{Constant('mode '), Field(p0,false)}" -match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); +var part837 = match("MESSAGE#481:00030:19/1_0", "nwparser.p0", "mode %{p0}"); -var part839 = // "Pattern{Constant('field'), Field(p0,false)}" -match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); +var part838 = match("MESSAGE#481:00030:19/1_1", "nwparser.p0", "field%{p0}"); var select193 = linear_select([ + part837, part838, - part839, ]); -var part840 = // "Pattern{Field(,false), Constant('has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); +var part839 = match("MESSAGE#481:00030:19/2", "nwparser.p0", "%{}has changed from %{change_old->} to %{change_new}"); -var all168 = all_match({ +var all167 = all_match({ processors: [ - part837, + part836, select193, - part840, + part839, ], on_success: processor_chain([ dup1, @@ -11296,10 +10176,9 @@ var all168 = all_match({ ]), }); -var msg488 = msg("00030:19", all168); +var msg488 = msg("00030:19", all167); -var part841 = // "Pattern{Constant('PKI: NSRP cold sync start for total of '), Field(fld2,true), Constant(' items.')}" -match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ +var part840 = match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for total of %{fld2->} items.", processor_chain([ dup44, dup2, dup3, @@ -11307,10 +10186,9 @@ match("MESSAGE#482:00030:30", "nwparser.payload", "PKI: NSRP cold sync start for dup5, ])); -var msg489 = msg("00030:30", part841); +var msg489 = msg("00030:30", part840); -var part842 = // "Pattern{Constant('PKI: NSRP sync received cold sync item '), Field(fld2,true), Constant(' out of order expect '), Field(fld3,true), Constant(' of '), Field(fld4,false), Constant('.')}" -match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ +var part841 = match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} out of order expect %{fld3->} of %{fld4}.", processor_chain([ dup86, dup2, dup3, @@ -11318,10 +10196,9 @@ match("MESSAGE#483:00030:31", "nwparser.payload", "PKI: NSRP sync received cold dup5, ])); -var msg490 = msg("00030:31", part842); +var msg490 = msg("00030:31", part841); -var part843 = // "Pattern{Constant('PKI: NSRP sync received cold sync item '), Field(fld2,true), Constant(' without first item.')}" -match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ +var part842 = match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold sync item %{fld2->} without first item.", processor_chain([ dup86, dup2, dup3, @@ -11329,10 +10206,9 @@ match("MESSAGE#484:00030:32", "nwparser.payload", "PKI: NSRP sync received cold dup5, ])); -var msg491 = msg("00030:32", part843); +var msg491 = msg("00030:32", part842); -var part844 = // "Pattern{Constant('PKI: NSRP sync received normal item during cold sync.'), Field(,false)}" -match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ +var part843 = match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received normal item during cold sync.%{}", processor_chain([ dup44, dup2, dup3, @@ -11340,10 +10216,9 @@ match("MESSAGE#485:00030:33", "nwparser.payload", "PKI: NSRP sync received norma dup5, ])); -var msg492 = msg("00030:33", part844); +var msg492 = msg("00030:33", part843); -var part845 = // "Pattern{Constant('PKI: The CRL '), Field(policy_id,true), Constant(' is deleted.')}" -match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ +var part844 = match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} is deleted.", processor_chain([ dup1, dup2, dup3, @@ -11351,10 +10226,9 @@ match("MESSAGE#486:00030:34", "nwparser.payload", "PKI: The CRL %{policy_id->} i dup5, ])); -var msg493 = msg("00030:34", part845); +var msg493 = msg("00030:34", part844); -var part846 = // "Pattern{Constant('PKI: The NSRP high availability synchronization '), Field(fld2,true), Constant(' failed.')}" -match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ +var part845 = match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availability synchronization %{fld2->} failed.", processor_chain([ dup86, dup2, dup3, @@ -11362,10 +10236,9 @@ match("MESSAGE#487:00030:35", "nwparser.payload", "PKI: The NSRP high availabili dup5, ])); -var msg494 = msg("00030:35", part846); +var msg494 = msg("00030:35", part845); -var part847 = // "Pattern{Constant('PKI: The '), Field(change_attribute,true), Constant(' has changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false), Constant('.')}" -match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ +var part846 = match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute->} has changed from %{change_old->} to %{change_new}.", processor_chain([ dup1, dup2, dup3, @@ -11373,12 +10246,11 @@ match("MESSAGE#488:00030:36", "nwparser.payload", "PKI: The %{change_attribute-> dup5, ])); -var msg495 = msg("00030:36", part847); +var msg495 = msg("00030:36", part846); -var part848 = // "Pattern{Constant('PKI: The X.509 certificate for the ScreenOS image authentication is invalid.'), Field(,false)}" -match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ +var part847 = match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate for the ScreenOS image authentication is invalid.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11387,12 +10259,11 @@ match("MESSAGE#489:00030:37", "nwparser.payload", "PKI: The X.509 certificate fo dup5, ])); -var msg496 = msg("00030:37", part848); +var msg496 = msg("00030:37", part847); -var part849 = // "Pattern{Constant('PKI: The X.509 local certificate cannot be sync to vsd member.'), Field(,false)}" -match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ +var part848 = match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certificate cannot be sync to vsd member.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11401,31 +10272,28 @@ match("MESSAGE#490:00030:38", "nwparser.payload", "PKI: The X.509 local certific dup5, ])); -var msg497 = msg("00030:38", part849); +var msg497 = msg("00030:38", part848); -var part850 = // "Pattern{Constant('PKI: The X.509 certificate '), Field(p0,false)}" -match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); +var part849 = match("MESSAGE#491:00030:39/0", "nwparser.payload", "PKI: The X.509 certificate %{p0}"); -var part851 = // "Pattern{Constant('revocation list '), Field(p0,false)}" -match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); +var part850 = match("MESSAGE#491:00030:39/1_0", "nwparser.p0", "revocation list %{p0}"); var select194 = linear_select([ - part851, + part850, dup16, ]); -var part852 = // "Pattern{Constant('cannot be loaded during NSRP synchronization.'), Field(,false)}" -match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); +var part851 = match("MESSAGE#491:00030:39/2", "nwparser.p0", "cannot be loaded during NSRP synchronization.%{}"); -var all169 = all_match({ +var all168 = all_match({ processors: [ - part850, + part849, select194, - part852, + part851, ], on_success: processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11435,23 +10303,21 @@ var all169 = all_match({ ]), }); -var msg498 = msg("00030:39", all169); +var msg498 = msg("00030:39", all168); -var part853 = // "Pattern{Constant('X509 '), Field(p0,false)}" -match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); +var part852 = match("MESSAGE#492:00030:17/0", "nwparser.payload", "X509 %{p0}"); -var part854 = // "Pattern{Constant('cannot be loaded'), Field(,false)}" -match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); +var part853 = match("MESSAGE#492:00030:17/2", "nwparser.p0", "cannot be loaded%{}"); -var all170 = all_match({ +var all169 = all_match({ processors: [ + part852, + dup376, part853, - dup379, - part854, ], on_success: processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11461,31 +10327,28 @@ var all170 = all_match({ ]), }); -var msg499 = msg("00030:17", all170); +var msg499 = msg("00030:17", all169); -var part855 = // "Pattern{Constant('PKI: The certificate '), Field(fld2,true), Constant(' will expire '), Field(p0,false)}" -match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); +var part854 = match("MESSAGE#493:00030:40/0", "nwparser.payload", "PKI: The certificate %{fld2->} will expire %{p0}"); -var part856 = // "Pattern{Constant('please '), Field(p0,false)}" -match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); +var part855 = match("MESSAGE#493:00030:40/1_1", "nwparser.p0", "please %{p0}"); var select195 = linear_select([ - dup216, - part856, + dup214, + part855, ]); -var part857 = // "Pattern{Constant('renew.'), Field(,false)}" -match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); +var part856 = match("MESSAGE#493:00030:40/2", "nwparser.p0", "renew.%{}"); -var all171 = all_match({ +var all170 = all_match({ processors: [ - part855, + part854, select195, - part857, + part856, ], on_success: processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11495,12 +10358,11 @@ var all171 = all_match({ ]), }); -var msg500 = msg("00030:40", all171); +var msg500 = msg("00030:40", all170); -var part858 = // "Pattern{Constant('PKI: The certificate revocation list has expired issued by certificate authority '), Field(fld2,false), Constant('.')}" -match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ +var part857 = match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocation list has expired issued by certificate authority %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11509,12 +10371,11 @@ match("MESSAGE#494:00030:41", "nwparser.payload", "PKI: The certificate revocati dup5, ])); -var msg501 = msg("00030:41", part858); +var msg501 = msg("00030:41", part857); -var part859 = // "Pattern{Constant('PKI: The configuration content of certificate authority '), Field(fld2,true), Constant(' is not valid.')}" -match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ +var part858 = match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration content of certificate authority %{fld2->} is not valid.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11523,12 +10384,11 @@ match("MESSAGE#495:00030:42", "nwparser.payload", "PKI: The configuration conten dup5, ])); -var msg502 = msg("00030:42", part859); +var msg502 = msg("00030:42", part858); -var part860 = // "Pattern{Constant('PKI: The device cannot allocate this object id number '), Field(fld2,false), Constant('.')}" -match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ +var part859 = match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot allocate this object id number %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11537,12 +10397,11 @@ match("MESSAGE#496:00030:43", "nwparser.payload", "PKI: The device cannot alloca dup5, ])); -var msg503 = msg("00030:43", part860); +var msg503 = msg("00030:43", part859); -var part861 = // "Pattern{Constant('PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].'), Field(,false)}" -match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ +var part860 = match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extract the X.509 certificate revocation list [ (CRL) ].%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11551,12 +10410,11 @@ match("MESSAGE#497:00030:44", "nwparser.payload", "PKI: The device cannot extrac dup5, ])); -var msg504 = msg("00030:44", part861); +var msg504 = msg("00030:44", part860); -var part862 = // "Pattern{Constant('PKI: The device cannot find the PKI object '), Field(fld2,true), Constant(' during cold sync.')}" -match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ +var part861 = match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find the PKI object %{fld2->} during cold sync.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11565,12 +10423,11 @@ match("MESSAGE#498:00030:45", "nwparser.payload", "PKI: The device cannot find t dup5, ])); -var msg505 = msg("00030:45", part862); +var msg505 = msg("00030:45", part861); -var part863 = // "Pattern{Constant('PKI: The device cannot load X.509 certificate onto the device certificate '), Field(fld2,false), Constant('.')}" -match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ +var part862 = match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X.509 certificate onto the device certificate %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11579,12 +10436,11 @@ match("MESSAGE#499:00030:46", "nwparser.payload", "PKI: The device cannot load X dup5, ])); -var msg506 = msg("00030:46", part863); +var msg506 = msg("00030:46", part862); -var part864 = // "Pattern{Constant('PKI: The device cannot load a certificate pending SCEP completion.'), Field(,false)}" -match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ +var part863 = match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a certificate pending SCEP completion.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11593,12 +10449,11 @@ match("MESSAGE#500:00030:47", "nwparser.payload", "PKI: The device cannot load a dup5, ])); -var msg507 = msg("00030:47", part864); +var msg507 = msg("00030:47", part863); -var part865 = // "Pattern{Constant('PKI: The device cannot load an X.509 certificate revocation list (CRL).'), Field(,false)}" -match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ +var part864 = match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load an X.509 certificate revocation list (CRL).%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11607,12 +10462,11 @@ match("MESSAGE#501:00030:48", "nwparser.payload", "PKI: The device cannot load a dup5, ])); -var msg508 = msg("00030:48", part865); +var msg508 = msg("00030:48", part864); -var part866 = // "Pattern{Constant('PKI: The device cannot load the CA certificate received through SCEP.'), Field(,false)}" -match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ +var part865 = match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load the CA certificate received through SCEP.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11621,12 +10475,11 @@ match("MESSAGE#502:00030:49", "nwparser.payload", "PKI: The device cannot load t dup5, ])); -var msg509 = msg("00030:49", part866); +var msg509 = msg("00030:49", part865); -var part867 = // "Pattern{Constant('PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.'), Field(,false)}" -match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ +var part866 = match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load the X.509 certificate revocation list (CRL) from the file.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11635,12 +10488,11 @@ match("MESSAGE#503:00030:50", "nwparser.payload", "PKI: The device cannot load t dup5, ])); -var msg510 = msg("00030:50", part867); +var msg510 = msg("00030:50", part866); -var part868 = // "Pattern{Constant('PKI: The device cannot load the X.509 local certificate received through SCEP.'), Field(,false)}" -match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ +var part867 = match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load the X.509 local certificate received through SCEP.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11649,12 +10501,11 @@ match("MESSAGE#504:00030:51", "nwparser.payload", "PKI: The device cannot load t dup5, ])); -var msg511 = msg("00030:51", part868); +var msg511 = msg("00030:51", part867); -var part869 = // "Pattern{Constant('PKI: The device cannot load the X.509 '), Field(product,true), Constant(' during boot.')}" -match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ +var part868 = match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load the X.509 %{product->} during boot.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11663,12 +10514,11 @@ match("MESSAGE#505:00030:52", "nwparser.payload", "PKI: The device cannot load t dup5, ])); -var msg512 = msg("00030:52", part869); +var msg512 = msg("00030:52", part868); -var part870 = // "Pattern{Constant('PKI: The device cannot load the X.509 certificate file.'), Field(,false)}" -match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ +var part869 = match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load the X.509 certificate file.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11677,12 +10527,11 @@ match("MESSAGE#506:00030:53", "nwparser.payload", "PKI: The device cannot load t dup5, ])); -var msg513 = msg("00030:53", part870); +var msg513 = msg("00030:53", part869); -var part871 = // "Pattern{Constant('PKI: The device completed the coldsync of the PKI object at '), Field(fld2,true), Constant(' attempt.')}" -match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ +var part870 = match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the coldsync of the PKI object at %{fld2->} attempt.", processor_chain([ dup44, - dup213, + dup211, dup31, dup2, dup3, @@ -11690,20 +10539,19 @@ match("MESSAGE#507:00030:54", "nwparser.payload", "PKI: The device completed the dup5, ])); -var msg514 = msg("00030:54", part871); +var msg514 = msg("00030:54", part870); -var part872 = // "Pattern{Constant('PKI: The device could not generate '), Field(p0,false)}" -match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); +var part871 = match("MESSAGE#508:00030:55/0", "nwparser.payload", "PKI: The device could not generate %{p0}"); -var all172 = all_match({ +var all171 = all_match({ processors: [ - part872, - dup380, - dup219, + part871, + dup377, + dup217, ], on_success: processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11713,12 +10561,11 @@ var all172 = all_match({ ]), }); -var msg515 = msg("00030:55", all172); +var msg515 = msg("00030:55", all171); -var part873 = // "Pattern{Constant('PKI: The device detected an invalid RSA key.'), Field(,false)}" -match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ +var part872 = match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an invalid RSA key.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11727,12 +10574,11 @@ match("MESSAGE#509:00030:56", "nwparser.payload", "PKI: The device detected an i dup5, ])); -var msg516 = msg("00030:56", part873); +var msg516 = msg("00030:56", part872); -var part874 = // "Pattern{Constant('PKI: The device detected an invalid digital signature algorithm (DSA) key.'), Field(,false)}" -match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ +var part873 = match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an invalid digital signature algorithm (DSA) key.%{}", processor_chain([ dup35, - dup220, + dup218, dup31, dup39, dup2, @@ -11741,12 +10587,11 @@ match("MESSAGE#510:00030:57", "nwparser.payload", "PKI: The device detected an i dup5, ])); -var msg517 = msg("00030:57", part874); +var msg517 = msg("00030:57", part873); -var part875 = // "Pattern{Constant('PKI: The device failed to coldsync the PKI object at '), Field(fld2,true), Constant(' attempt.')}" -match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ +var part874 = match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to coldsync the PKI object at %{fld2->} attempt.", processor_chain([ dup86, - dup220, + dup218, dup31, dup54, dup2, @@ -11755,38 +10600,24 @@ match("MESSAGE#511:00030:58", "nwparser.payload", "PKI: The device failed to col dup5, ])); -var msg518 = msg("00030:58", part875); - -var part876 = // "Pattern{Constant('PKI: The device failed to decode the public key of the image'), Field(p0,false)}" -match("MESSAGE#512:00030:59/0", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{p0}"); +var msg518 = msg("00030:58", part874); -var part877 = // "Pattern{Constant('s signer certificate.'), Field(,false)}" -match("MESSAGE#512:00030:59/2", "nwparser.p0", "s signer certificate.%{}"); - -var all173 = all_match({ - processors: [ - part876, - dup363, - part877, - ], - on_success: processor_chain([ - dup35, - dup220, - dup31, - dup54, - dup2, - dup3, - dup4, - dup5, - ]), -}); +var part875 = match("MESSAGE#512:00030:59", "nwparser.payload", "PKI: The device failed to decode the public key of the image%{quote}s signer certificate.", processor_chain([ + dup35, + dup218, + dup31, + dup54, + dup2, + dup3, + dup4, + dup5, +])); -var msg519 = msg("00030:59", all173); +var msg519 = msg("00030:59", part875); -var part878 = // "Pattern{Constant('PKI: The device failed to install the RSA key.'), Field(,false)}" -match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ +var part876 = match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to install the RSA key.%{}", processor_chain([ dup35, - dup220, + dup218, dup31, dup54, dup2, @@ -11795,12 +10626,11 @@ match("MESSAGE#513:00030:60", "nwparser.payload", "PKI: The device failed to ins dup5, ])); -var msg520 = msg("00030:60", part878); +var msg520 = msg("00030:60", part876); -var part879 = // "Pattern{Constant('PKI: The device failed to retrieve the pending certificate '), Field(fld2,false), Constant('.')}" -match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ +var part877 = match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to retrieve the pending certificate %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup54, dup2, @@ -11809,12 +10639,11 @@ match("MESSAGE#514:00030:61", "nwparser.payload", "PKI: The device failed to ret dup5, ])); -var msg521 = msg("00030:61", part879); +var msg521 = msg("00030:61", part877); -var part880 = // "Pattern{Constant('PKI: The device failed to save the certificate authority related configuration.'), Field(,false)}" -match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ +var part878 = match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to save the certificate authority related configuration.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup54, dup2, @@ -11823,12 +10652,11 @@ match("MESSAGE#515:00030:62", "nwparser.payload", "PKI: The device failed to sav dup5, ])); -var msg522 = msg("00030:62", part880); +var msg522 = msg("00030:62", part878); -var part881 = // "Pattern{Constant('PKI: The device failed to store the authority configuration.'), Field(,false)}" -match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ +var part879 = match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to store the authority configuration.%{}", processor_chain([ dup18, - dup221, + dup219, dup51, dup54, dup2, @@ -11837,12 +10665,11 @@ match("MESSAGE#516:00030:63", "nwparser.payload", "PKI: The device failed to sto dup5, ])); -var msg523 = msg("00030:63", part881); +var msg523 = msg("00030:63", part879); -var part882 = // "Pattern{Constant('PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.'), Field(,false)}" -match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ +var part880 = match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to synchronize new DSA/RSA key pair to NSRP peer.%{}", processor_chain([ dup18, - dup220, + dup218, dup51, dup54, dup2, @@ -11851,12 +10678,11 @@ match("MESSAGE#517:00030:64", "nwparser.payload", "PKI: The device failed to syn dup5, ])); -var msg524 = msg("00030:64", part882); +var msg524 = msg("00030:64", part880); -var part883 = // "Pattern{Constant('PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.'), Field(,false)}" -match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ +var part881 = match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to synchronize DSA/RSA key pair to NSRP peer.%{}", processor_chain([ dup18, - dup220, + dup218, dup51, dup54, dup2, @@ -11865,12 +10691,11 @@ match("MESSAGE#518:00030:65", "nwparser.payload", "PKI: The device failed to syn dup5, ])); -var msg525 = msg("00030:65", part883); +var msg525 = msg("00030:65", part881); -var part884 = // "Pattern{Constant('PKI: The device has detected an invalid X.509 object attribute '), Field(fld2,false), Constant('.')}" -match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ +var part882 = match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected an invalid X.509 object attribute %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11879,12 +10704,11 @@ match("MESSAGE#519:00030:66", "nwparser.payload", "PKI: The device has detected dup5, ])); -var msg526 = msg("00030:66", part884); +var msg526 = msg("00030:66", part882); -var part885 = // "Pattern{Constant('PKI: The device has detected invalid X.509 object content.'), Field(,false)}" -match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ +var part883 = match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected invalid X.509 object content.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11893,12 +10717,11 @@ match("MESSAGE#520:00030:67", "nwparser.payload", "PKI: The device has detected dup5, ])); -var msg527 = msg("00030:67", part885); +var msg527 = msg("00030:67", part883); -var part886 = // "Pattern{Constant('PKI: The device has failed to load an invalid X.509 object.'), Field(,false)}" -match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ +var part884 = match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to load an invalid X.509 object.%{}", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -11907,10 +10730,9 @@ match("MESSAGE#521:00030:68", "nwparser.payload", "PKI: The device has failed to dup5, ])); -var msg528 = msg("00030:68", part886); +var msg528 = msg("00030:68", part884); -var part887 = // "Pattern{Constant('PKI: The device is loading the version 0 PKI data.'), Field(,false)}" -match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ +var part885 = match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading the version 0 PKI data.%{}", processor_chain([ dup44, dup2, dup3, @@ -11918,16 +10740,15 @@ match("MESSAGE#522:00030:69", "nwparser.payload", "PKI: The device is loading th dup5, ])); -var msg529 = msg("00030:69", part887); +var msg529 = msg("00030:69", part885); -var part888 = // "Pattern{Constant('PKI: The device successfully generated a new '), Field(p0,false)}" -match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); +var part886 = match("MESSAGE#523:00030:70/0", "nwparser.payload", "PKI: The device successfully generated a new %{p0}"); -var all174 = all_match({ +var all172 = all_match({ processors: [ - part888, - dup380, - dup219, + part886, + dup377, + dup217, ], on_success: processor_chain([ dup44, @@ -11938,87 +10759,56 @@ var all174 = all_match({ ]), }); -var msg530 = msg("00030:70", all174); +var msg530 = msg("00030:70", all172); -var part889 = // "Pattern{Constant('PKI: The public key of image'), Field(p0,false)}" -match("MESSAGE#524:00030:71/0", "nwparser.payload", "PKI: The public key of image%{p0}"); +var part887 = match("MESSAGE#524:00030:71", "nwparser.payload", "PKI: The public key of image%{quote}s signer has been loaded successfully, for future image authentication.", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); -var part890 = // "Pattern{Constant('s signer has been loaded successfully, for future image authentication.'), Field(,false)}" -match("MESSAGE#524:00030:71/2", "nwparser.p0", "s signer has been loaded successfully, for future image authentication.%{}"); +var msg531 = msg("00030:71", part887); -var all175 = all_match({ - processors: [ - part889, - dup363, - part890, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), -}); +var part888 = match("MESSAGE#525:00030:72", "nwparser.payload", "PKI: The signature of the image%{quote}s signer certificate cannot be verified.", processor_chain([ + dup35, + dup211, + dup31, + dup39, + dup2, + dup3, + dup4, + dup5, +])); -var msg531 = msg("00030:71", all175); +var msg532 = msg("00030:72", part888); -var part891 = // "Pattern{Constant('PKI: The signature of the image'), Field(p0,false)}" -match("MESSAGE#525:00030:72/0", "nwparser.payload", "PKI: The signature of the image%{p0}"); +var part889 = match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); -var part892 = // "Pattern{Constant('s signer certificate cannot be verified.'), Field(,false)}" -match("MESSAGE#525:00030:72/2", "nwparser.p0", "s signer certificate cannot be verified.%{}"); +var part890 = match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); -var all176 = all_match({ - processors: [ - part891, - dup363, - part892, - ], - on_success: processor_chain([ - dup35, - dup213, - dup31, - dup39, - dup2, - dup3, - dup4, - dup5, - ]), -}); - -var msg532 = msg("00030:72", all176); - -var part893 = // "Pattern{Constant('PKI: The '), Field(p0,false)}" -match("MESSAGE#526:00030:73/0", "nwparser.payload", "PKI: The %{p0}"); +var part891 = match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); -var part894 = // "Pattern{Constant('file name '), Field(p0,false)}" -match("MESSAGE#526:00030:73/1_0", "nwparser.p0", "file name %{p0}"); - -var part895 = // "Pattern{Constant('friendly name of a certificate '), Field(p0,false)}" -match("MESSAGE#526:00030:73/1_1", "nwparser.p0", "friendly name of a certificate %{p0}"); - -var part896 = // "Pattern{Constant('vsys name '), Field(p0,false)}" -match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); +var part892 = match("MESSAGE#526:00030:73/1_2", "nwparser.p0", "vsys name %{p0}"); var select196 = linear_select([ - part894, - part895, - part896, + part890, + part891, + part892, ]); -var part897 = // "Pattern{Constant('is too long '), Field(fld2,true), Constant(' to do NSRP synchronization allowed '), Field(fld3,false), Constant('.')}" -match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); +var part893 = match("MESSAGE#526:00030:73/2", "nwparser.p0", "is too long %{fld2->} to do NSRP synchronization allowed %{fld3}."); -var all177 = all_match({ +var all173 = all_match({ processors: [ - part893, + part889, select196, - part897, + part893, ], on_success: processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -12028,10 +10818,9 @@ var all177 = all_match({ ]), }); -var msg533 = msg("00030:73", all177); +var msg533 = msg("00030:73", all173); -var part898 = // "Pattern{Constant('PKI: Upgrade from earlier version save to file.'), Field(,false)}" -match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ +var part894 = match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier version save to file.%{}", processor_chain([ dup44, dup2, dup3, @@ -12039,10 +10828,9 @@ match("MESSAGE#527:00030:74", "nwparser.payload", "PKI: Upgrade from earlier ver dup5, ])); -var msg534 = msg("00030:74", part898); +var msg534 = msg("00030:74", part894); -var part899 = // "Pattern{Constant('PKI: X.509 certificate has been deleted distinguished name '), Field(username,false), Constant('.')}" -match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ +var part895 = match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has been deleted distinguished name %{username}.", processor_chain([ dup44, dup2, dup3, @@ -12050,19 +10838,17 @@ match("MESSAGE#528:00030:75", "nwparser.payload", "PKI: X.509 certificate has be dup5, ])); -var msg535 = msg("00030:75", part899); +var msg535 = msg("00030:75", part895); -var part900 = // "Pattern{Constant('PKI: X.509 '), Field(p0,false)}" -match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); +var part896 = match("MESSAGE#529:00030:76/0", "nwparser.payload", "PKI: X.509 %{p0}"); -var part901 = // "Pattern{Constant('file has been loaded successfully filename '), Field(fld2,false), Constant('.')}" -match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); +var part897 = match("MESSAGE#529:00030:76/2", "nwparser.p0", "file has been loaded successfully filename %{fld2}."); -var all178 = all_match({ +var all174 = all_match({ processors: [ - part900, - dup379, - part901, + part896, + dup376, + part897, ], on_success: processor_chain([ dup44, @@ -12073,12 +10859,11 @@ var all178 = all_match({ ]), }); -var msg536 = msg("00030:76", all178); +var msg536 = msg("00030:76", all174); -var part902 = // "Pattern{Constant('PKI: failed to install DSA key.'), Field(,false)}" -match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ +var part898 = match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA key.%{}", processor_chain([ dup18, - dup220, + dup218, dup51, dup54, dup2, @@ -12087,13 +10872,12 @@ match("MESSAGE#530:00030:77", "nwparser.payload", "PKI: failed to install DSA ke dup5, ])); -var msg537 = msg("00030:77", part902); +var msg537 = msg("00030:77", part898); -var part903 = // "Pattern{Constant('PKI: no FQDN available when requesting certificate.'), Field(,false)}" -match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ +var part899 = match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when requesting certificate.%{}", processor_chain([ dup35, - dup213, - dup222, + dup211, + dup220, dup31, dup39, dup2, @@ -12102,13 +10886,12 @@ match("MESSAGE#531:00030:78", "nwparser.payload", "PKI: no FQDN available when r dup5, ])); -var msg538 = msg("00030:78", part903); +var msg538 = msg("00030:78", part899); -var part904 = // "Pattern{Constant('PKI: no cert revocation check per config DN '), Field(username,false), Constant('.')}" -match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ +var part900 = match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check per config DN %{username}.", processor_chain([ dup35, - dup213, - dup222, + dup211, + dup220, dup31, dup39, dup2, @@ -12117,10 +10900,9 @@ match("MESSAGE#532:00030:79", "nwparser.payload", "PKI: no cert revocation check dup5, ])); -var msg539 = msg("00030:79", part904); +var msg539 = msg("00030:79", part900); -var part905 = // "Pattern{Constant('PKI: no nsrp sync for pre 2.5 objects.'), Field(,false)}" -match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ +var part901 = match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 objects.%{}", processor_chain([ dup44, dup2, dup3, @@ -12128,10 +10910,9 @@ match("MESSAGE#533:00030:80", "nwparser.payload", "PKI: no nsrp sync for pre 2.5 dup5, ])); -var msg540 = msg("00030:80", part905); +var msg540 = msg("00030:80", part901); -var part906 = // "Pattern{Constant('X509 certificate with subject name '), Field(fld2,true), Constant(' is deleted.')}" -match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ +var part902 = match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject name %{fld2->} is deleted.", processor_chain([ dup44, dup2, dup3, @@ -12139,10 +10920,9 @@ match("MESSAGE#534:00030:81", "nwparser.payload", "X509 certificate with subject dup5, ])); -var msg541 = msg("00030:81", part906); +var msg541 = msg("00030:81", part902); -var part907 = // "Pattern{Constant('create new authcfg for CA '), Field(fld2,false)}" -match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ +var part903 = match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{fld2}", processor_chain([ dup44, dup2, dup3, @@ -12150,12 +10930,11 @@ match("MESSAGE#535:00030:82", "nwparser.payload", "create new authcfg for CA %{f dup5, ])); -var msg542 = msg("00030:82", part907); +var msg542 = msg("00030:82", part903); -var part908 = // "Pattern{Constant('loadCert: Cannot acquire authcfg for this CA cert '), Field(fld2,false), Constant('.')}" -match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ +var part904 = match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire authcfg for this CA cert %{fld2}.", processor_chain([ dup35, - dup213, + dup211, dup31, dup39, dup2, @@ -12164,10 +10943,9 @@ match("MESSAGE#536:00030:83", "nwparser.payload", "loadCert: Cannot acquire auth dup5, ])); -var msg543 = msg("00030:83", part908); +var msg543 = msg("00030:83", part904); -var part909 = // "Pattern{Constant('upgrade to 4.0 copy authcfg from global.'), Field(,false)}" -match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ +var part905 = match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg from global.%{}", processor_chain([ dup44, dup2, dup3, @@ -12175,10 +10953,9 @@ match("MESSAGE#537:00030:84", "nwparser.payload", "upgrade to 4.0 copy authcfg f dup5, ])); -var msg544 = msg("00030:84", part909); +var msg544 = msg("00030:84", part905); -var part910 = // "Pattern{Constant('System CPU utilization is high ('), Field(fld2,true), Constant(' alarm threshold: '), Field(trigger_val,false), Constant(') '), Field(info,false)}" -match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ +var part906 = match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is high (%{fld2->} alarm threshold: %{trigger_val}) %{info}", processor_chain([ setc("eventcategory","1603080000"), dup2, dup3, @@ -12186,19 +10963,18 @@ match("MESSAGE#538:00030:85", "nwparser.payload", "System CPU utilization is hig dup5, ])); -var msg545 = msg("00030:85", part910); +var msg545 = msg("00030:85", part906); -var part911 = // "Pattern{Constant('Pair-wise invoked by started after key generation. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); +var part907 = match("MESSAGE#539:00030:86/2", "nwparser.p0", "Pair-wise invoked by started after key generation. (%{fld1})"); -var all179 = all_match({ +var all175 = all_match({ processors: [ - dup223, - dup381, - part911, + dup221, + dup378, + part907, ], on_success: processor_chain([ - dup225, + dup223, dup2, dup4, dup5, @@ -12206,11 +10982,10 @@ var all179 = all_match({ ]), }); -var msg546 = msg("00030:86", all179); +var msg546 = msg("00030:86", all175); -var part912 = // "Pattern{Constant('SYSTEM CPU utilization is high ('), Field(fld2,true), Constant(' > '), Field(fld3,true), Constant(' ) '), Field(fld4,true), Constant(' times in '), Field(fld5,true), Constant(' minute ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" -match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ - dup211, +var part908 = match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is high (%{fld2->} > %{fld3->} ) %{fld4->} times in %{fld5->} minute (%{fld1})\u003c\u003c%{fld6}>", processor_chain([ + dup209, dup2, dup3, dup4, @@ -12218,19 +10993,18 @@ match("MESSAGE#1214:00030:87", "nwparser.payload", "SYSTEM CPU utilization is hi dup9, ])); -var msg547 = msg("00030:87", part912); +var msg547 = msg("00030:87", part908); -var part913 = // "Pattern{Constant('Pair-wise invoked by passed. ('), Field(fld1,false), Constant(')<<'), Field(fld6,false), Constant('>')}" -match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); +var part909 = match("MESSAGE#1217:00030:88/2", "nwparser.p0", "Pair-wise invoked by passed. (%{fld1})\u003c\u003c%{fld6}>"); -var all180 = all_match({ +var all176 = all_match({ processors: [ - dup223, - dup381, - part913, + dup221, + dup378, + part909, ], on_success: processor_chain([ - dup225, + dup223, dup2, dup4, dup5, @@ -12238,7 +11012,7 @@ var all180 = all_match({ ]), }); -var msg548 = msg("00030:88", all180); +var msg548 = msg("00030:88", all176); var select197 = linear_select([ msg475, @@ -12317,8 +11091,7 @@ var select197 = linear_select([ msg548, ]); -var part914 = // "Pattern{Constant('ARP detected IP conflict: IP address '), Field(hostip,true), Constant(' changed from '), Field(sinterface,true), Constant(' to interface '), Field(dinterface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ +var part910 = match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP address %{hostip->} changed from %{sinterface->} to interface %{dinterface->} (%{fld1})", processor_chain([ dup121, dup2, dup3, @@ -12327,10 +11100,9 @@ match("MESSAGE#540:00031:13", "nwparser.payload", "ARP detected IP conflict: IP dup5, ])); -var msg549 = msg("00031:13", part914); +var msg549 = msg("00031:13", part910); -var part915 = // "Pattern{Constant('SNMP AuthenTraps have been '), Field(disposition,false)}" -match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ +var part911 = match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -12338,10 +11110,9 @@ match("MESSAGE#541:00031", "nwparser.payload", "SNMP AuthenTraps have been %{dis dup5, ])); -var msg550 = msg("00031", part915); +var msg550 = msg("00031", part911); -var part916 = // "Pattern{Constant('SNMP VPN has been '), Field(disposition,false)}" -match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ +var part912 = match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -12349,29 +11120,25 @@ match("MESSAGE#542:00031:01", "nwparser.payload", "SNMP VPN has been %{dispositi dup5, ])); -var msg551 = msg("00031:01", part916); +var msg551 = msg("00031:01", part912); -var part917 = // "Pattern{Constant('SNMP community '), Field(fld2,true), Constant(' attributes-write access '), Field(p0,false)}" -match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); +var part913 = match("MESSAGE#543:00031:02/0", "nwparser.payload", "SNMP community %{fld2->} attributes-write access %{p0}"); -var part918 = // "Pattern{Constant('; receive traps '), Field(p0,false)}" -match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); +var part914 = match("MESSAGE#543:00031:02/2", "nwparser.p0", "; receive traps %{p0}"); -var part919 = // "Pattern{Constant('; receive traffic alarms '), Field(p0,false)}" -match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); +var part915 = match("MESSAGE#543:00031:02/4", "nwparser.p0", "; receive traffic alarms %{p0}"); -var part920 = // "Pattern{Constant('-have been modified'), Field(,false)}" -match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); +var part916 = match("MESSAGE#543:00031:02/6", "nwparser.p0", "-have been modified%{}"); -var all181 = all_match({ +var all177 = all_match({ processors: [ - part917, - dup382, - part918, - dup382, - part919, - dup382, - part920, + part913, + dup379, + part914, + dup379, + part915, + dup379, + part916, ], on_success: processor_chain([ dup1, @@ -12382,24 +11149,22 @@ var all181 = all_match({ ]), }); -var msg552 = msg("00031:02", all181); +var msg552 = msg("00031:02", all177); -var part921 = // "Pattern{Field(fld2,true), Constant(' SNMP host '), Field(hostip,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); +var part917 = match("MESSAGE#544:00031:03/0", "nwparser.payload", "%{fld2->} SNMP host %{hostip->} has been %{p0}"); var select198 = linear_select([ dup130, dup129, ]); -var part922 = // "Pattern{Constant('SNMP community '), Field(fld3,false)}" -match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); +var part918 = match("MESSAGE#544:00031:03/2", "nwparser.p0", "SNMP community %{fld3}"); -var all182 = all_match({ +var all178 = all_match({ processors: [ - part921, + part917, select198, - part922, + part918, ], on_success: processor_chain([ dup1, @@ -12410,27 +11175,24 @@ var all182 = all_match({ ]), }); -var msg553 = msg("00031:03", all182); +var msg553 = msg("00031:03", all178); -var part923 = // "Pattern{Constant('SNMP '), Field(p0,false)}" -match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); +var part919 = match("MESSAGE#545:00031:04/0", "nwparser.payload", "SNMP %{p0}"); -var part924 = // "Pattern{Constant('contact '), Field(p0,false)}" -match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); +var part920 = match("MESSAGE#545:00031:04/1_0", "nwparser.p0", "contact %{p0}"); var select199 = linear_select([ - part924, - dup228, + part920, + dup226, ]); -var part925 = // "Pattern{Constant('description has been modified'), Field(,false)}" -match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); +var part921 = match("MESSAGE#545:00031:04/2", "nwparser.p0", "description has been modified%{}"); -var all183 = all_match({ +var all179 = all_match({ processors: [ - part923, + part919, select199, - part925, + part921, ], on_success: processor_chain([ dup1, @@ -12441,24 +11203,22 @@ var all183 = all_match({ ]), }); -var msg554 = msg("00031:04", all183); +var msg554 = msg("00031:04", all179); -var part926 = // "Pattern{Constant('SNMP system '), Field(p0,false)}" -match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); +var part922 = match("MESSAGE#546:00031:11/0", "nwparser.payload", "SNMP system %{p0}"); var select200 = linear_select([ - dup228, + dup226, dup25, ]); -var part927 = // "Pattern{Constant('has been changed to '), Field(fld2,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); +var part923 = match("MESSAGE#546:00031:11/2", "nwparser.p0", "has been changed to %{fld2}. (%{fld1})"); -var all184 = all_match({ +var all180 = all_match({ processors: [ - part926, + part922, select200, - part927, + part923, ], on_success: processor_chain([ dup1, @@ -12470,58 +11230,49 @@ var all184 = all_match({ ]), }); -var msg555 = msg("00031:11", all184); +var msg555 = msg("00031:11", all180); -var part928 = // "Pattern{Field(fld2,false), Constant(': SNMP community name "'), Field(fld3,false), Constant('" '), Field(p0,false)}" -match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); +var part924 = match("MESSAGE#547:00031:08/0", "nwparser.payload", "%{fld2}: SNMP community name \"%{fld3}\" %{p0}"); -var part929 = // "Pattern{Constant('attributes -- '), Field(p0,false)}" -match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); +var part925 = match("MESSAGE#547:00031:08/1_0", "nwparser.p0", "attributes -- %{p0}"); -var part930 = // "Pattern{Constant('-- '), Field(p0,false)}" -match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); +var part926 = match("MESSAGE#547:00031:08/1_1", "nwparser.p0", "-- %{p0}"); var select201 = linear_select([ - part929, - part930, + part925, + part926, ]); -var part931 = // "Pattern{Constant('write access, '), Field(p0,false)}" -match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); +var part927 = match("MESSAGE#547:00031:08/2", "nwparser.p0", "write access, %{p0}"); -var part932 = // "Pattern{Constant('; receive traps, '), Field(p0,false)}" -match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); +var part928 = match("MESSAGE#547:00031:08/4", "nwparser.p0", "; receive traps, %{p0}"); -var part933 = // "Pattern{Constant('; receive traffic alarms, '), Field(p0,false)}" -match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); +var part929 = match("MESSAGE#547:00031:08/6", "nwparser.p0", "; receive traffic alarms, %{p0}"); -var part934 = // "Pattern{Constant('-'), Field(p0,false)}" -match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); +var part930 = match("MESSAGE#547:00031:08/8", "nwparser.p0", "-%{p0}"); -var part935 = // "Pattern{Constant('- '), Field(p0,false)}" -match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); +var part931 = match("MESSAGE#547:00031:08/9_0", "nwparser.p0", "- %{p0}"); var select202 = linear_select([ - part935, + part931, dup96, ]); -var part936 = // "Pattern{Constant('have been modified'), Field(,false)}" -match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); +var part932 = match("MESSAGE#547:00031:08/10", "nwparser.p0", "have been modified%{}"); -var all185 = all_match({ +var all181 = all_match({ processors: [ - part928, + part924, select201, - part931, - dup382, - part932, - dup382, - part933, - dup382, - part934, + part927, + dup379, + part928, + dup379, + part929, + dup379, + part930, select202, - part936, + part932, ], on_success: processor_chain([ dup1, @@ -12532,16 +11283,15 @@ var all185 = all_match({ ]), }); -var msg556 = msg("00031:08", all185); +var msg556 = msg("00031:08", all181); -var part937 = // "Pattern{Constant('Detect IP conflict ('), Field(fld2,false), Constant(') on '), Field(p0,false)}" -match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); +var part933 = match("MESSAGE#548:00031:05/0", "nwparser.payload", "Detect IP conflict (%{fld2}) on %{p0}"); -var all186 = all_match({ +var all182 = all_match({ processors: [ - part937, - dup339, - dup229, + part933, + dup337, + dup227, ], on_success: processor_chain([ dup121, @@ -12552,43 +11302,39 @@ var all186 = all_match({ ]), }); -var msg557 = msg("00031:05", all186); +var msg557 = msg("00031:05", all182); -var part938 = // "Pattern{Constant('q, '), Field(p0,false)}" -match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); +var part934 = match("MESSAGE#549:00031:06/1_0", "nwparser.p0", "q, %{p0}"); var select203 = linear_select([ - part938, - dup231, - dup232, + part934, + dup229, + dup230, ]); -var part939 = // "Pattern{Constant('detect IP conflict ( '), Field(hostip,true), Constant(' )'), Field(p0,false)}" -match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); +var part935 = match("MESSAGE#549:00031:06/2", "nwparser.p0", "detect IP conflict ( %{hostip->} )%{p0}"); var select204 = linear_select([ dup105, dup96, ]); -var part940 = // "Pattern{Constant('mac'), Field(p0,false)}" -match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); +var part936 = match("MESSAGE#549:00031:06/4", "nwparser.p0", "mac%{p0}"); -var part941 = // "Pattern{Constant(''), Field(macaddr,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); +var part937 = match("MESSAGE#549:00031:06/6", "nwparser.p0", "%{macaddr->} on %{p0}"); -var all187 = all_match({ +var all183 = all_match({ processors: [ - dup230, + dup228, select203, - part939, + part935, select204, - part940, - dup358, - part941, - dup354, + part936, + dup356, + part937, + dup352, dup23, - dup383, + dup380, ], on_success: processor_chain([ dup121, @@ -12600,18 +11346,17 @@ var all187 = all_match({ ]), }); -var msg558 = msg("00031:06", all187); +var msg558 = msg("00031:06", all183); -var part942 = // "Pattern{Constant('detects a duplicate virtual security device group master IP address '), Field(hostip,false), Constant(', MAC address '), Field(macaddr,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); +var part938 = match("MESSAGE#550:00031:07/2", "nwparser.p0", "detects a duplicate virtual security device group master IP address %{hostip}, MAC address %{macaddr->} on %{p0}"); -var all188 = all_match({ +var all184 = all_match({ processors: [ - dup230, - dup384, - part942, - dup339, - dup229, + dup228, + dup381, + part938, + dup337, + dup227, ], on_success: processor_chain([ dup121, @@ -12622,17 +11367,16 @@ var all188 = all_match({ ]), }); -var msg559 = msg("00031:07", all188); +var msg559 = msg("00031:07", all184); -var part943 = // "Pattern{Constant('detected an IP conflict (IP '), Field(hostip,false), Constant(', MAC '), Field(macaddr,false), Constant(') on interface '), Field(p0,false)}" -match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); +var part939 = match("MESSAGE#551:00031:09/2", "nwparser.p0", "detected an IP conflict (IP %{hostip}, MAC %{macaddr}) on interface %{p0}"); -var all189 = all_match({ +var all185 = all_match({ processors: [ - dup230, - dup384, - part943, - dup383, + dup228, + dup381, + part939, + dup380, ], on_success: processor_chain([ dup121, @@ -12644,10 +11388,9 @@ var all189 = all_match({ ]), }); -var msg560 = msg("00031:09", all189); +var msg560 = msg("00031:09", all185); -var part944 = // "Pattern{Field(fld2,false), Constant(': SNMP community "'), Field(fld3,false), Constant('" has been moved. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ +var part940 = match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{fld3}\" has been moved. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -12656,10 +11399,9 @@ match("MESSAGE#552:00031:10", "nwparser.payload", "%{fld2}: SNMP community \"%{f dup5, ])); -var msg561 = msg("00031:10", part944); +var msg561 = msg("00031:10", part940); -var part945 = // "Pattern{Field(fld2,true), Constant(' system contact has been changed to '), Field(fld3,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ +var part941 = match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has been changed to %{fld3}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -12668,7 +11410,7 @@ match("MESSAGE#553:00031:12", "nwparser.payload", "%{fld2->} system contact has dup5, ])); -var msg562 = msg("00031:12", part945); +var msg562 = msg("00031:12", part941); var select205 = linear_select([ msg549, @@ -12687,9 +11429,8 @@ var select205 = linear_select([ msg562, ]); -var part946 = // "Pattern{Field(signame,true), Constant(' has been detected and blocked! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup234, +var part942 = match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup232, dup2, dup3, dup59, @@ -12698,11 +11439,10 @@ match("MESSAGE#554:00032", "nwparser.payload", "%{signame->} has been detected a dup61, ])); -var msg563 = msg("00032", part946); +var msg563 = msg("00032", part942); -var part947 = // "Pattern{Field(signame,true), Constant(' has been detected and blocked! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false)}" -match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ - dup234, +var part943 = match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detected and blocked! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}", processor_chain([ + dup232, dup2, dup3, dup4, @@ -12710,33 +11450,28 @@ match("MESSAGE#555:00032:01", "nwparser.payload", "%{signame->} has been detecte dup61, ])); -var msg564 = msg("00032:01", part947); +var msg564 = msg("00032:01", part943); -var part948 = // "Pattern{Constant('Vsys '), Field(fld2,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); +var part944 = match("MESSAGE#556:00032:03/0", "nwparser.payload", "Vsys %{fld2->} has been %{p0}"); -var part949 = // "Pattern{Constant('changed to '), Field(fld3,false)}" -match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); +var part945 = match("MESSAGE#556:00032:03/1_0", "nwparser.p0", "changed to %{fld3}"); -var part950 = // "Pattern{Constant('created'), Field(,false)}" -match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); +var part946 = match("MESSAGE#556:00032:03/1_1", "nwparser.p0", "created%{}"); -var part951 = // "Pattern{Constant('deleted'), Field(,false)}" -match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); +var part947 = match("MESSAGE#556:00032:03/1_2", "nwparser.p0", "deleted%{}"); -var part952 = // "Pattern{Constant('removed'), Field(,false)}" -match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); +var part948 = match("MESSAGE#556:00032:03/1_3", "nwparser.p0", "removed%{}"); var select206 = linear_select([ - part949, - part950, - part951, - part952, + part945, + part946, + part947, + part948, ]); -var all190 = all_match({ +var all186 = all_match({ processors: [ - part948, + part944, select206, ], on_success: processor_chain([ @@ -12748,11 +11483,10 @@ var all190 = all_match({ ]), }); -var msg565 = msg("00032:03", all190); +var msg565 = msg("00032:03", all186); -var part953 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' on interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ - dup234, +var part949 = match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} on interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ + dup232, dup2, dup3, dup4, @@ -12761,10 +11495,9 @@ match("MESSAGE#557:00032:04", "nwparser.payload", "%{signame->} From %{saddr}:%{ dup61, ])); -var msg566 = msg("00032:04", part953); +var msg566 = msg("00032:04", part949); -var part954 = // "Pattern{Field(change_attribute,true), Constant(' for vsys '), Field(fld2,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part950 = match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsys %{fld2->} has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -12772,9 +11505,9 @@ match("MESSAGE#558:00032:05", "nwparser.payload", "%{change_attribute->} for vsy dup5, ])); -var msg567 = msg("00032:05", part954); +var msg567 = msg("00032:05", part950); -var msg568 = msg("00032:02", dup378); +var msg568 = msg("00032:02", dup375); var select207 = linear_select([ msg563, @@ -12785,8 +11518,7 @@ var select207 = linear_select([ msg568, ]); -var part955 = // "Pattern{Constant('NSM has been '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ +var part951 = match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -12796,28 +11528,25 @@ match("MESSAGE#560:00033:25", "nwparser.payload", "NSM has been %{disposition}. setc("agent","NSM"), ])); -var msg569 = msg("00033:25", part955); +var msg569 = msg("00033:25", part951); -var part956 = // "Pattern{Constant('timeout value has been '), Field(p0,false)}" -match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); +var part952 = match("MESSAGE#561:00033/1", "nwparser.p0", "timeout value has been %{p0}"); -var part957 = // "Pattern{Constant('returned'), Field(p0,false)}" -match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); +var part953 = match("MESSAGE#561:00033/2_1", "nwparser.p0", "returned%{p0}"); var select208 = linear_select([ dup52, - part957, + part953, ]); -var part958 = // "Pattern{Field(,false), Constant('to '), Field(fld2,false)}" -match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); +var part954 = match("MESSAGE#561:00033/3", "nwparser.p0", "%{}to %{fld2}"); -var all191 = all_match({ +var all187 = all_match({ processors: [ - dup385, - part956, + dup382, + part952, select208, - part958, + part954, ], on_success: processor_chain([ dup1, @@ -12828,29 +11557,26 @@ var all191 = all_match({ ]), }); -var msg570 = msg("00033", all191); +var msg570 = msg("00033", all187); -var part959 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" -match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); +var part955 = match("MESSAGE#562:00033:03/1_0", "nwparser.p0", "Global PRO %{p0}"); -var part960 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); +var part956 = match("MESSAGE#562:00033:03/1_1", "nwparser.p0", "%{fld3->} %{p0}"); var select209 = linear_select([ - part959, - part960, + part955, + part956, ]); -var part961 = // "Pattern{Constant('host has been set to '), Field(fld4,false)}" -match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); +var part957 = match("MESSAGE#562:00033:03/4", "nwparser.p0", "host has been set to %{fld4}"); -var all192 = all_match({ +var all188 = all_match({ processors: [ - dup162, + dup160, select209, dup23, - dup372, - part961, + dup369, + part957, ], on_success: processor_chain([ dup1, @@ -12861,17 +11587,16 @@ var all192 = all_match({ ]), }); -var msg571 = msg("00033:03", all192); +var msg571 = msg("00033:03", all188); -var part962 = // "Pattern{Constant('host has been '), Field(disposition,false)}" -match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); +var part958 = match("MESSAGE#563:00033:02/3", "nwparser.p0", "host has been %{disposition}"); -var all193 = all_match({ +var all189 = all_match({ processors: [ - dup385, + dup382, dup23, - dup372, - part962, + dup369, + part958, ], on_success: processor_chain([ dup1, @@ -12882,10 +11607,9 @@ var all193 = all_match({ ]), }); -var msg572 = msg("00033:02", all193); +var msg572 = msg("00033:02", all189); -var part963 = // "Pattern{Constant('Reporting of '), Field(fld2,true), Constant(' to '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ +var part959 = match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{fld3->} has been %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -12893,10 +11617,9 @@ match("MESSAGE#564:00033:04", "nwparser.payload", "Reporting of %{fld2->} to %{f dup5, ])); -var msg573 = msg("00033:04", part963); +var msg573 = msg("00033:04", part959); -var part964 = // "Pattern{Constant('Global PRO has been '), Field(disposition,false)}" -match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ +var part960 = match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -12904,10 +11627,9 @@ match("MESSAGE#565:00033:05", "nwparser.payload", "Global PRO has been %{disposi dup5, ])); -var msg574 = msg("00033:05", part964); +var msg574 = msg("00033:05", part960); -var part965 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('. The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ +var part961 = match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The attack occurred %{dclass_counter1->} times", processor_chain([ dup27, dup2, dup3, @@ -12917,10 +11639,9 @@ match("MESSAGE#566:00033:06", "nwparser.payload", "%{signame}! From %{saddr}:%{s dup61, ])); -var msg575 = msg("00033:06", part965); +var msg575 = msg("00033:06", part961); -var part966 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('. The threshold was exceeded '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ +var part962 = match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}. The threshold was exceeded %{dclass_counter1->} times", processor_chain([ dup27, dup2, dup3, @@ -12930,10 +11651,9 @@ match("MESSAGE#567:00033:01", "nwparser.payload", "%{signame}! From %{saddr}:%{s dup61, ])); -var msg576 = msg("00033:01", part966); +var msg576 = msg("00033:01", part962); -var part967 = // "Pattern{Constant('User-defined service '), Field(service,true), Constant(' has been '), Field(disposition,true), Constant(' from '), Field(fld2,true), Constant(' distribution')}" -match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ +var part963 = match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{service->} has been %{disposition->} from %{fld2->} distribution", processor_chain([ dup1, dup2, dup3, @@ -12941,16 +11661,15 @@ match("MESSAGE#568:00033:07", "nwparser.payload", "User-defined service %{servic dup5, ])); -var msg577 = msg("00033:07", part967); +var msg577 = msg("00033:07", part963); -var part968 = // "Pattern{Constant('?s CA certificate field has not been specified.'), Field(,false)}" -match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); +var part964 = match("MESSAGE#569:00033:08/2", "nwparser.p0", "?s CA certificate field has not been specified.%{}"); -var all194 = all_match({ +var all190 = all_match({ processors: [ - dup237, - dup386, - part968, + dup235, + dup383, + part964, ], on_success: processor_chain([ dup1, @@ -12961,16 +11680,15 @@ var all194 = all_match({ ]), }); -var msg578 = msg("00033:08", all194); +var msg578 = msg("00033:08", all190); -var part969 = // "Pattern{Constant('?s Cert-Subject field has not been specified.'), Field(,false)}" -match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); +var part965 = match("MESSAGE#570:00033:09/2", "nwparser.p0", "?s Cert-Subject field has not been specified.%{}"); -var all195 = all_match({ +var all191 = all_match({ processors: [ - dup237, - dup386, - part969, + dup235, + dup383, + part965, ], on_success: processor_chain([ dup1, @@ -12981,24 +11699,22 @@ var all195 = all_match({ ]), }); -var msg579 = msg("00033:09", all195); +var msg579 = msg("00033:09", all191); -var part970 = // "Pattern{Constant('?s host field has been '), Field(p0,false)}" -match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); +var part966 = match("MESSAGE#571:00033:10/2", "nwparser.p0", "?s host field has been %{p0}"); -var part971 = // "Pattern{Constant('set to '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); +var part967 = match("MESSAGE#571:00033:10/3_0", "nwparser.p0", "set to %{fld2->} %{p0}"); var select210 = linear_select([ - part971, - dup240, + part967, + dup238, ]); -var all196 = all_match({ +var all192 = all_match({ processors: [ - dup237, - dup386, - part970, + dup235, + dup383, + part966, select210, dup116, ], @@ -13011,21 +11727,19 @@ var all196 = all_match({ ]), }); -var msg580 = msg("00033:10", all196); +var msg580 = msg("00033:10", all192); -var part972 = // "Pattern{Constant('?s outgoing interface used to report NACN to Policy Manager '), Field(p0,false)}" -match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); +var part968 = match("MESSAGE#572:00033:11/2", "nwparser.p0", "?s outgoing interface used to report NACN to Policy Manager %{p0}"); -var part973 = // "Pattern{Constant('has not been specified.'), Field(,false)}" -match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); +var part969 = match("MESSAGE#572:00033:11/4", "nwparser.p0", "has not been specified.%{}"); -var all197 = all_match({ +var all193 = all_match({ processors: [ - dup237, - dup386, - part972, - dup386, - part973, + dup235, + dup383, + part968, + dup383, + part969, ], on_success: processor_chain([ dup1, @@ -13036,21 +11750,20 @@ var all197 = all_match({ ]), }); -var msg581 = msg("00033:11", all197); +var msg581 = msg("00033:11", all193); -var part974 = // "Pattern{Constant('?s password field has been '), Field(p0,false)}" -match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); +var part970 = match("MESSAGE#573:00033:12/2", "nwparser.p0", "?s password field has been %{p0}"); var select211 = linear_select([ dup101, - dup240, + dup238, ]); -var all198 = all_match({ +var all194 = all_match({ processors: [ - dup237, - dup386, - part974, + dup235, + dup383, + part970, select211, dup116, ], @@ -13063,27 +11776,24 @@ var all198 = all_match({ ]), }); -var msg582 = msg("00033:12", all198); +var msg582 = msg("00033:12", all194); -var part975 = // "Pattern{Constant('?s policy-domain field has been '), Field(p0,false)}" -match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); +var part971 = match("MESSAGE#574:00033:13/2", "nwparser.p0", "?s policy-domain field has been %{p0}"); -var part976 = // "Pattern{Constant('unset .'), Field(,false)}" -match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); +var part972 = match("MESSAGE#574:00033:13/3_0", "nwparser.p0", "unset .%{}"); -var part977 = // "Pattern{Constant('set to '), Field(domain,false), Constant('.')}" -match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); +var part973 = match("MESSAGE#574:00033:13/3_1", "nwparser.p0", "set to %{domain}."); var select212 = linear_select([ - part976, - part977, + part972, + part973, ]); -var all199 = all_match({ +var all195 = all_match({ processors: [ - dup237, - dup386, - part975, + dup235, + dup383, + part971, select212, ], on_success: processor_chain([ @@ -13095,16 +11805,15 @@ var all199 = all_match({ ]), }); -var msg583 = msg("00033:13", all199); +var msg583 = msg("00033:13", all195); -var part978 = // "Pattern{Constant('?s CA certificate field has been set to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); +var part974 = match("MESSAGE#575:00033:14/2", "nwparser.p0", "?s CA certificate field has been set to %{fld2}."); -var all200 = all_match({ +var all196 = all_match({ processors: [ - dup237, - dup386, - part978, + dup235, + dup383, + part974, ], on_success: processor_chain([ dup1, @@ -13115,16 +11824,15 @@ var all200 = all_match({ ]), }); -var msg584 = msg("00033:14", all200); +var msg584 = msg("00033:14", all196); -var part979 = // "Pattern{Constant('?s Cert-Subject field has been set to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); +var part975 = match("MESSAGE#576:00033:15/2", "nwparser.p0", "?s Cert-Subject field has been set to %{fld2}."); -var all201 = all_match({ +var all197 = all_match({ processors: [ - dup237, - dup386, - part979, + dup235, + dup383, + part975, ], on_success: processor_chain([ dup1, @@ -13135,16 +11843,15 @@ var all201 = all_match({ ]), }); -var msg585 = msg("00033:15", all201); +var msg585 = msg("00033:15", all197); -var part980 = // "Pattern{Constant('?s outgoing-interface field has been set to '), Field(interface,false), Constant('.')}" -match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); +var part976 = match("MESSAGE#577:00033:16/2", "nwparser.p0", "?s outgoing-interface field has been set to %{interface}."); -var all202 = all_match({ +var all198 = all_match({ processors: [ - dup237, - dup386, - part980, + dup235, + dup383, + part976, ], on_success: processor_chain([ dup1, @@ -13155,27 +11862,24 @@ var all202 = all_match({ ]), }); -var msg586 = msg("00033:16", all202); +var msg586 = msg("00033:16", all198); -var part981 = // "Pattern{Constant('?s port field has been '), Field(p0,false)}" -match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); +var part977 = match("MESSAGE#578:00033:17/2", "nwparser.p0", "?s port field has been %{p0}"); -var part982 = // "Pattern{Constant('set to '), Field(network_port,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); +var part978 = match("MESSAGE#578:00033:17/3_0", "nwparser.p0", "set to %{network_port->} %{p0}"); -var part983 = // "Pattern{Constant('reset to the default value '), Field(p0,false)}" -match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); +var part979 = match("MESSAGE#578:00033:17/3_1", "nwparser.p0", "reset to the default value %{p0}"); var select213 = linear_select([ - part982, - part983, + part978, + part979, ]); -var all203 = all_match({ +var all199 = all_match({ processors: [ - dup237, - dup386, - part981, + dup235, + dup383, + part977, select213, dup116, ], @@ -13188,21 +11892,19 @@ var all203 = all_match({ ]), }); -var msg587 = msg("00033:17", all203); +var msg587 = msg("00033:17", all199); -var part984 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(p0,false)}" -match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); +var part980 = match("MESSAGE#579:00033:19/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{p0}"); -var part985 = // "Pattern{Field(fld99,false), Constant('arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' time.')}" -match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); +var part981 = match("MESSAGE#579:00033:19/4", "nwparser.p0", "%{fld99}arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time."); -var all204 = all_match({ +var all200 = all_match({ processors: [ - part984, - dup341, + part980, + dup339, dup70, - dup342, - part985, + dup340, + part981, ], on_success: processor_chain([ dup27, @@ -13215,10 +11917,9 @@ var all204 = all_match({ ]), }); -var msg588 = msg("00033:19", all204); +var msg588 = msg("00033:19", all200); -var part986 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' time.')}" -match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ +var part982 = match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} time.", processor_chain([ dup27, dup2, dup4, @@ -13228,12 +11929,12 @@ match("MESSAGE#580:00033:20", "nwparser.payload", "%{signame}! From %{saddr->} t dup60, ])); -var msg589 = msg("00033:20", part986); +var msg589 = msg("00033:20", part982); -var all205 = all_match({ +var all201 = all_match({ processors: [ - dup241, - dup345, + dup239, + dup343, dup83, ], on_success: processor_chain([ @@ -13248,15 +11949,14 @@ var all205 = all_match({ ]), }); -var msg590 = msg("00033:21", all205); +var msg590 = msg("00033:21", all201); -var part987 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part983 = match("MESSAGE#582:00033:22/0", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); -var all206 = all_match({ +var all202 = all_match({ processors: [ - part987, - dup345, + part983, + dup343, dup83, ], on_success: processor_chain([ @@ -13271,10 +11971,9 @@ var all206 = all_match({ ]), }); -var msg591 = msg("00033:22", all206); +var msg591 = msg("00033:22", all202); -var part988 = // "Pattern{Constant('NSM primary server with name '), Field(hostname,true), Constant(' was set: addr '), Field(hostip,false), Constant(', port '), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ +var part984 = match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name %{hostname->} was set: addr %{hostip}, port %{network_port}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -13283,10 +11982,9 @@ match("MESSAGE#583:00033:23", "nwparser.payload", "NSM primary server with name dup5, ])); -var msg592 = msg("00033:23", part988); +var msg592 = msg("00033:23", part984); -var part989 = // "Pattern{Constant('session threshold From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(info,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ +var part985 = match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{info}. (%{fld1})", processor_chain([ setc("eventcategory","1001030500"), dup2, dup3, @@ -13295,7 +11993,7 @@ match("MESSAGE#584:00033:24", "nwparser.payload", "session threshold From %{sadd dup5, ])); -var msg593 = msg("00033:24", part989); +var msg593 = msg("00033:24", part985); var select214 = linear_select([ msg569, @@ -13325,49 +12023,44 @@ var select214 = linear_select([ msg593, ]); -var part990 = // "Pattern{Constant('SCS: Failed '), Field(p0,false)}" -match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); +var part986 = match("MESSAGE#585:00034/0_0", "nwparser.payload", "SCS: Failed %{p0}"); -var part991 = // "Pattern{Constant('Failed '), Field(p0,false)}" -match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); +var part987 = match("MESSAGE#585:00034/0_1", "nwparser.payload", "Failed %{p0}"); var select215 = linear_select([ - part990, - part991, + part986, + part987, ]); -var part992 = // "Pattern{Constant('bind '), Field(p0,false)}" -match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); +var part988 = match("MESSAGE#585:00034/2_0", "nwparser.p0", "bind %{p0}"); -var part993 = // "Pattern{Constant('retrieve '), Field(p0,false)}" -match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); +var part989 = match("MESSAGE#585:00034/2_2", "nwparser.p0", "retrieve %{p0}"); var select216 = linear_select([ - part992, - dup203, - part993, + part988, + dup201, + part989, ]); var select217 = linear_select([ - dup198, + dup196, dup103, - dup165, + dup163, ]); -var part994 = // "Pattern{Constant('SSH user '), Field(username,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" -match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); +var part990 = match("MESSAGE#585:00034/5", "nwparser.p0", "SSH user %{username}. (Key ID=%{fld2})"); -var all207 = all_match({ +var all203 = all_match({ processors: [ select215, dup103, select216, - dup204, + dup202, select217, - part994, + part990, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13375,42 +12068,37 @@ var all207 = all_match({ ]), }); -var msg594 = msg("00034", all207); +var msg594 = msg("00034", all203); -var part995 = // "Pattern{Constant('SCS: Incompatible '), Field(p0,false)}" -match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); +var part991 = match("MESSAGE#586:00034:01/0_0", "nwparser.payload", "SCS: Incompatible %{p0}"); -var part996 = // "Pattern{Constant('Incompatible '), Field(p0,false)}" -match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); +var part992 = match("MESSAGE#586:00034:01/0_1", "nwparser.payload", "Incompatible %{p0}"); var select218 = linear_select([ - part995, - part996, + part991, + part992, ]); -var part997 = // "Pattern{Constant('SSH version '), Field(version,true), Constant(' has been received from '), Field(p0,false)}" -match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); +var part993 = match("MESSAGE#586:00034:01/1", "nwparser.p0", "SSH version %{version->} has been received from %{p0}"); -var part998 = // "Pattern{Constant('the SSH '), Field(p0,false)}" -match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); +var part994 = match("MESSAGE#586:00034:01/2_0", "nwparser.p0", "the SSH %{p0}"); var select219 = linear_select([ - part998, - dup243, + part994, + dup241, ]); -var part999 = // "Pattern{Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); +var part995 = match("MESSAGE#586:00034:01/3", "nwparser.p0", "client at %{saddr}:%{sport}"); -var all208 = all_match({ +var all204 = all_match({ processors: [ select218, - part997, + part993, select219, - part999, + part995, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13418,29 +12106,27 @@ var all208 = all_match({ ]), }); -var msg595 = msg("00034:01", all208); +var msg595 = msg("00034:01", all204); -var part1000 = // "Pattern{Constant('Maximum number of SCS sessions '), Field(fld2,true), Constant(' has been reached. Connection request from SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been '), Field(disposition,false)}" -match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ - dup242, +var part996 = match("MESSAGE#587:00034:02", "nwparser.payload", "Maximum number of SCS sessions %{fld2->} has been reached. Connection request from SSH user %{username->} at %{saddr}:%{sport->} has been %{disposition}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg596 = msg("00034:02", part1000); +var msg596 = msg("00034:02", part996); -var part1001 = // "Pattern{Constant('device failed to authenticate the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); +var part997 = match("MESSAGE#588:00034:03/1", "nwparser.p0", "device failed to authenticate the SSH client at %{saddr}:%{sport}"); -var all209 = all_match({ +var all205 = all_match({ processors: [ - dup387, - part1001, + dup384, + part997, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13448,56 +12134,50 @@ var all209 = all_match({ ]), }); -var msg597 = msg("00034:03", all209); +var msg597 = msg("00034:03", all205); -var part1002 = // "Pattern{Constant('SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" -match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ - dup242, +var part998 = match("MESSAGE#589:00034:04", "nwparser.payload", "SCS: NetScreen device failed to generate a PKA RSA challenge for SSH user %{username->} at %{saddr}:%{sport}. (Key ID=%{fld2})", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg598 = msg("00034:04", part1002); +var msg598 = msg("00034:04", part998); -var part1003 = // "Pattern{Constant('NetScreen device failed to generate a PKA RSA challenge for SSH user '), Field(username,false), Constant('. (Key ID='), Field(fld2,false), Constant(')')}" -match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ - dup242, +var part999 = match("MESSAGE#590:00034:05", "nwparser.payload", "NetScreen device failed to generate a PKA RSA challenge for SSH user %{username}. (Key ID=%{fld2})", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg599 = msg("00034:05", part1003); +var msg599 = msg("00034:05", part999); -var part1004 = // "Pattern{Constant('device failed to '), Field(p0,false)}" -match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); +var part1000 = match("MESSAGE#591:00034:06/1", "nwparser.p0", "device failed to %{p0}"); -var part1005 = // "Pattern{Constant('identify itself '), Field(p0,false)}" -match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); +var part1001 = match("MESSAGE#591:00034:06/2_0", "nwparser.p0", "identify itself %{p0}"); -var part1006 = // "Pattern{Constant('send the identification string '), Field(p0,false)}" -match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); +var part1002 = match("MESSAGE#591:00034:06/2_1", "nwparser.p0", "send the identification string %{p0}"); var select220 = linear_select([ - part1005, - part1006, + part1001, + part1002, ]); -var part1007 = // "Pattern{Constant('to the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); +var part1003 = match("MESSAGE#591:00034:06/3", "nwparser.p0", "to the SSH client at %{saddr}:%{sport}"); -var all210 = all_match({ +var all206 = all_match({ processors: [ - dup387, - part1004, + dup384, + part1000, select220, - part1007, + part1003, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13505,73 +12185,65 @@ var all210 = all_match({ ]), }); -var msg600 = msg("00034:06", all210); +var msg600 = msg("00034:06", all206); -var part1008 = // "Pattern{Constant('SCS connection has been terminated for admin user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ - dup242, +var part1004 = match("MESSAGE#592:00034:07", "nwparser.payload", "SCS connection has been terminated for admin user %{username->} at %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg601 = msg("00034:07", part1008); +var msg601 = msg("00034:07", part1004); -var part1009 = // "Pattern{Constant('SCS: SCS has been '), Field(disposition,true), Constant(' for '), Field(username,true), Constant(' with '), Field(fld2,true), Constant(' existing PKA keys already bound to '), Field(fld3,true), Constant(' SSH users.')}" -match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ - dup242, +var part1005 = match("MESSAGE#593:00034:08", "nwparser.payload", "SCS: SCS has been %{disposition->} for %{username->} with %{fld2->} existing PKA keys already bound to %{fld3->} SSH users.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg602 = msg("00034:08", part1009); +var msg602 = msg("00034:08", part1005); -var part1010 = // "Pattern{Constant('SCS has been '), Field(disposition,true), Constant(' for '), Field(username,true), Constant(' with '), Field(fld2,true), Constant(' PKA keys already bound to '), Field(fld3,true), Constant(' SSH users')}" -match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ - dup242, +var part1006 = match("MESSAGE#594:00034:09", "nwparser.payload", "SCS has been %{disposition->} for %{username->} with %{fld2->} PKA keys already bound to %{fld3->} SSH users", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg603 = msg("00034:09", part1010); +var msg603 = msg("00034:09", part1006); -var part1011 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" -match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); +var part1007 = match("MESSAGE#595:00034:10/2", "nwparser.p0", "%{}client at %{saddr->} has attempted to make an SCS connection to %{p0}"); -var part1012 = // "Pattern{Constant(''), Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); +var part1008 = match("MESSAGE#595:00034:10/4", "nwparser.p0", "%{interface->} %{p0}"); -var part1013 = // "Pattern{Constant('with'), Field(p0,false)}" -match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); +var part1009 = match("MESSAGE#595:00034:10/5_0", "nwparser.p0", "with%{p0}"); -var part1014 = // "Pattern{Constant('at'), Field(p0,false)}" -match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); +var part1010 = match("MESSAGE#595:00034:10/5_1", "nwparser.p0", "at%{p0}"); var select221 = linear_select([ - part1013, - part1014, + part1009, + part1010, ]); -var part1015 = // "Pattern{Field(,false), Constant('IP '), Field(hostip,true), Constant(' but '), Field(disposition,true), Constant(' because '), Field(result,false)}" -match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); +var part1011 = match("MESSAGE#595:00034:10/6", "nwparser.p0", "%{}IP %{hostip->} but %{disposition->} because %{result}"); -var all211 = all_match({ +var all207 = all_match({ processors: [ - dup246, - dup388, - part1011, - dup354, - part1012, + dup244, + dup385, + part1007, + dup352, + part1008, select221, - part1015, + part1011, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13579,24 +12251,22 @@ var all211 = all_match({ ]), }); -var msg604 = msg("00034:10", all211); +var msg604 = msg("00034:10", all207); -var part1016 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" -match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); +var part1012 = match("MESSAGE#596:00034:12/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has attempted to make an SCS connection to %{p0}"); -var part1017 = // "Pattern{Constant('but '), Field(disposition,true), Constant(' because '), Field(result,false)}" -match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); +var part1013 = match("MESSAGE#596:00034:12/4", "nwparser.p0", "but %{disposition->} because %{result}"); -var all212 = all_match({ +var all208 = all_match({ processors: [ - dup246, - dup388, - part1016, - dup389, - part1017, + dup244, + dup385, + part1012, + dup386, + part1013, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13604,24 +12274,22 @@ var all212 = all_match({ ]), }); -var msg605 = msg("00034:12", all212); +var msg605 = msg("00034:12", all208); -var part1018 = // "Pattern{Field(,false), Constant('client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection to '), Field(p0,false)}" -match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); +var part1014 = match("MESSAGE#597:00034:11/2", "nwparser.p0", "%{}client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to %{p0}"); -var part1019 = // "Pattern{Constant('because '), Field(result,false)}" -match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); +var part1015 = match("MESSAGE#597:00034:11/4", "nwparser.p0", "because %{result}"); -var all213 = all_match({ +var all209 = all_match({ processors: [ - dup246, - dup388, - part1018, - dup389, - part1019, + dup244, + dup385, + part1014, + dup386, + part1015, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13629,30 +12297,28 @@ var all213 = all_match({ ]), }); -var msg606 = msg("00034:11", all213); +var msg606 = msg("00034:11", all209); -var part1020 = // "Pattern{Constant('SSH client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection because '), Field(result,false)}" -match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ - dup242, +var part1016 = match("MESSAGE#598:00034:15", "nwparser.payload", "SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection because %{result}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg607 = msg("00034:15", part1020); +var msg607 = msg("00034:15", part1016); -var part1021 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' cannot log in via SCS to '), Field(service,true), Constant(' using the shared '), Field(interface,true), Constant(' interface because '), Field(result,false)}" -match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); +var part1017 = match("MESSAGE#599:00034:18/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} cannot log in via SCS to %{service->} using the shared %{interface->} interface because %{result}"); -var all214 = all_match({ +var all210 = all_match({ processors: [ - dup246, - dup390, - part1021, + dup244, + dup387, + part1017, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13660,19 +12326,18 @@ var all214 = all_match({ ]), }); -var msg608 = msg("00034:18", all214); +var msg608 = msg("00034:18", all210); -var part1022 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' the PKA RSA challenge')}" -match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); +var part1018 = match("MESSAGE#600:00034:20/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has %{disposition->} the PKA RSA challenge"); -var all215 = all_match({ +var all211 = all_match({ processors: [ - dup246, - dup390, - part1022, + dup244, + dup387, + part1018, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13680,49 +12345,43 @@ var all215 = all_match({ ]), }); -var msg609 = msg("00034:20", all215); +var msg609 = msg("00034:20", all211); -var part1023 = // "Pattern{Constant('user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has requested '), Field(p0,false)}" -match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); +var part1019 = match("MESSAGE#601:00034:21/2", "nwparser.p0", "user %{username->} at %{saddr}:%{sport->} has requested %{p0}"); -var part1024 = // "Pattern{Constant('authentication which is not '), Field(p0,false)}" -match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); +var part1020 = match("MESSAGE#601:00034:21/4", "nwparser.p0", "authentication which is not %{p0}"); -var part1025 = // "Pattern{Constant('supported '), Field(p0,false)}" -match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); +var part1021 = match("MESSAGE#601:00034:21/5_0", "nwparser.p0", "supported %{p0}"); var select222 = linear_select([ - part1025, + part1021, dup156, ]); -var part1026 = // "Pattern{Constant('for that '), Field(p0,false)}" -match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); +var part1022 = match("MESSAGE#601:00034:21/6", "nwparser.p0", "for that %{p0}"); -var part1027 = // "Pattern{Constant('client'), Field(,false)}" -match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); +var part1023 = match("MESSAGE#601:00034:21/7_0", "nwparser.p0", "client%{}"); -var part1028 = // "Pattern{Constant('user'), Field(,false)}" -match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); +var part1024 = match("MESSAGE#601:00034:21/7_1", "nwparser.p0", "user%{}"); var select223 = linear_select([ - part1027, - part1028, + part1023, + part1024, ]); -var all216 = all_match({ +var all212 = all_match({ processors: [ - dup246, - dup390, - part1023, - dup375, - part1024, + dup244, + dup387, + part1019, + dup372, + part1020, select222, - part1026, + part1022, select223, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13730,41 +12389,37 @@ var all216 = all_match({ ]), }); -var msg610 = msg("00034:21", all216); +var msg610 = msg("00034:21", all212); -var part1029 = // "Pattern{Constant('SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has unsuccessfully attempted to log in via SCS to vsys '), Field(fld2,true), Constant(' using the shared untrusted interface')}" -match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ - dup242, +var part1025 = match("MESSAGE#602:00034:22", "nwparser.payload", "SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to vsys %{fld2->} using the shared untrusted interface", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg611 = msg("00034:22", part1029); +var msg611 = msg("00034:22", part1025); -var part1030 = // "Pattern{Constant('SCS: Unable '), Field(p0,false)}" -match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); +var part1026 = match("MESSAGE#603:00034:23/1_0", "nwparser.p0", "SCS: Unable %{p0}"); -var part1031 = // "Pattern{Constant('Unable '), Field(p0,false)}" -match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); +var part1027 = match("MESSAGE#603:00034:23/1_1", "nwparser.p0", "Unable %{p0}"); var select224 = linear_select([ - part1030, - part1031, + part1026, + part1027, ]); -var part1032 = // "Pattern{Constant('to validate cookie from the SSH client at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); +var part1028 = match("MESSAGE#603:00034:23/2", "nwparser.p0", "to validate cookie from the SSH client at %{saddr}:%{sport}"); -var all217 = all_match({ +var all213 = all_match({ processors: [ - dup162, + dup160, select224, - part1032, + part1028, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13772,32 +12427,29 @@ var all217 = all_match({ ]), }); -var msg612 = msg("00034:23", all217); +var msg612 = msg("00034:23", all213); -var part1033 = // "Pattern{Constant('AC '), Field(username,true), Constant(' is advertising URL '), Field(fld2,false)}" -match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ - dup242, +var part1029 = match("MESSAGE#604:00034:24", "nwparser.payload", "AC %{username->} is advertising URL %{fld2}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg613 = msg("00034:24", part1033); +var msg613 = msg("00034:24", part1029); -var part1034 = // "Pattern{Constant('Message from AC '), Field(username,false), Constant(': '), Field(fld2,false)}" -match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ - dup242, +var part1030 = match("MESSAGE#605:00034:25", "nwparser.payload", "Message from AC %{username}: %{fld2}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg614 = msg("00034:25", part1034); +var msg614 = msg("00034:25", part1030); -var part1035 = // "Pattern{Constant('PPPoE Settings changed'), Field(,false)}" -match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ +var part1031 = match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", processor_chain([ dup1, dup2, dup3, @@ -13805,10 +12457,9 @@ match("MESSAGE#606:00034:26", "nwparser.payload", "PPPoE Settings changed%{}", p dup5, ])); -var msg615 = msg("00034:26", part1035); +var msg615 = msg("00034:26", part1031); -var part1036 = // "Pattern{Constant('PPPoE is '), Field(disposition,true), Constant(' on '), Field(interface,true), Constant(' interface')}" -match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ +var part1032 = match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on %{interface->} interface", processor_chain([ dup1, dup2, dup3, @@ -13816,121 +12467,99 @@ match("MESSAGE#607:00034:27", "nwparser.payload", "PPPoE is %{disposition->} on dup5, ])); -var msg616 = msg("00034:27", part1036); - -var part1037 = // "Pattern{Constant('PPPoE'), Field(p0,false)}" -match("MESSAGE#608:00034:28/0", "nwparser.payload", "PPPoE%{p0}"); +var msg616 = msg("00034:27", part1032); -var part1038 = // "Pattern{Constant('s session closed by AC'), Field(,false)}" -match("MESSAGE#608:00034:28/2", "nwparser.p0", "s session closed by AC%{}"); - -var all218 = all_match({ - processors: [ - part1037, - dup363, - part1038, - ], - on_success: processor_chain([ - dup211, - dup2, - dup3, - dup4, - dup5, - ]), -}); +var part1033 = match("MESSAGE#608:00034:28", "nwparser.payload", "PPPoE%{quote}s session closed by AC", processor_chain([ + dup209, + dup2, + dup3, + dup4, + dup5, +])); -var msg617 = msg("00034:28", all218); +var msg617 = msg("00034:28", part1033); -var part1039 = // "Pattern{Constant('SCS: Disabled for '), Field(username,false), Constant('. Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup242, +var part1034 = match("MESSAGE#609:00034:29", "nwparser.payload", "SCS: Disabled for %{username}. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg618 = msg("00034:29", part1039); +var msg618 = msg("00034:29", part1034); -var part1040 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to remove PKA key removed.')}" -match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ - dup242, +var part1035 = match("MESSAGE#610:00034:30", "nwparser.payload", "SCS: %{disposition->} to remove PKA key removed.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg619 = msg("00034:30", part1040); +var msg619 = msg("00034:30", part1035); -var part1041 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to retrieve host key')}" -match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ - dup242, +var part1036 = match("MESSAGE#611:00034:31", "nwparser.payload", "SCS: %{disposition->} to retrieve host key", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg620 = msg("00034:31", part1041); +var msg620 = msg("00034:31", part1036); -var part1042 = // "Pattern{Constant('SCS: '), Field(disposition,true), Constant(' to send identification string to client host at '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" -match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ - dup242, +var part1037 = match("MESSAGE#612:00034:32", "nwparser.payload", "SCS: %{disposition->} to send identification string to client host at %{saddr}:%{sport}.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg621 = msg("00034:32", part1042); +var msg621 = msg("00034:32", part1037); -var part1043 = // "Pattern{Constant('SCS: Max '), Field(fld2,true), Constant(' sessions reached unabel to accept connection : '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ - dup242, +var part1038 = match("MESSAGE#613:00034:33", "nwparser.payload", "SCS: Max %{fld2->} sessions reached unabel to accept connection : %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg622 = msg("00034:33", part1043); +var msg622 = msg("00034:33", part1038); -var part1044 = // "Pattern{Constant('SCS: Maximum number for SCS sessions '), Field(fld2,true), Constant(' has been reached. Connection request from SSH user at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ - dup242, +var part1039 = match("MESSAGE#614:00034:34", "nwparser.payload", "SCS: Maximum number for SCS sessions %{fld2->} has been reached. Connection request from SSH user at %{saddr}:%{sport->} has been %{disposition}.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg623 = msg("00034:34", part1044); +var msg623 = msg("00034:34", part1039); -var part1045 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has unsuccessfully attempted to log in via SCS to '), Field(service,true), Constant(' using the shared untrusted interface because SCS is disabled on that interface.')}" -match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ - dup242, +var part1040 = match("MESSAGE#615:00034:35", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has unsuccessfully attempted to log in via SCS to %{service->} using the shared untrusted interface because SCS is disabled on that interface.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg624 = msg("00034:35", part1045); +var msg624 = msg("00034:35", part1040); -var part1046 = // "Pattern{Constant('SCS: Unsupported cipher type '), Field(fld2,true), Constant(' requested from: '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ - dup242, +var part1041 = match("MESSAGE#616:00034:36", "nwparser.payload", "SCS: Unsupported cipher type %{fld2->} requested from: %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg625 = msg("00034:36", part1046); +var msg625 = msg("00034:36", part1041); -var part1047 = // "Pattern{Constant('The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed'), Field(,false)}" -match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ +var part1042 = match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol over Ethernet (PPPoE) protocol settings changed%{}", processor_chain([ dup1, dup2, dup3, @@ -13938,21 +12567,19 @@ match("MESSAGE#617:00034:37", "nwparser.payload", "The Point-to-Point Protocol o dup5, ])); -var msg626 = msg("00034:37", part1047); +var msg626 = msg("00034:37", part1042); -var part1048 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to retreive PKA key bound to SSH user '), Field(username,true), Constant(' (Key ID '), Field(fld2,false), Constant(')')}" -match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ - dup242, +var part1043 = match("MESSAGE#618:00034:38", "nwparser.payload", "SSH: %{disposition->} to retreive PKA key bound to SSH user %{username->} (Key ID %{fld2})", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg627 = msg("00034:38", part1048); +var msg627 = msg("00034:38", part1043); -var part1049 = // "Pattern{Constant('SSH: Error processing packet from host '), Field(saddr,true), Constant(' (Code '), Field(fld2,false), Constant(')')}" -match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ +var part1044 = match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet from host %{saddr->} (Code %{fld2})", processor_chain([ dup19, dup2, dup3, @@ -13960,10 +12587,9 @@ match("MESSAGE#619:00034:39", "nwparser.payload", "SSH: Error processing packet dup5, ])); -var msg628 = msg("00034:39", part1049); +var msg628 = msg("00034:39", part1044); -var part1050 = // "Pattern{Constant('SSH: Device failed to send initialization string to client at '), Field(saddr,false)}" -match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ +var part1045 = match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send initialization string to client at %{saddr}", processor_chain([ dup19, dup2, dup3, @@ -13971,22 +12597,20 @@ match("MESSAGE#620:00034:40", "nwparser.payload", "SSH: Device failed to send in dup5, ])); -var msg629 = msg("00034:40", part1050); +var msg629 = msg("00034:40", part1045); -var part1051 = // "Pattern{Constant('SCP: Admin user ''), Field(administrator,false), Constant('' attempted to transfer file '), Field(p0,false)}" -match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); +var part1046 = match("MESSAGE#621:00034:41/0", "nwparser.payload", "SCP: Admin user '%{administrator}' attempted to transfer file %{p0}"); -var part1052 = // "Pattern{Constant('the device with insufficient privilege.'), Field(,false)}" -match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); +var part1047 = match("MESSAGE#621:00034:41/2", "nwparser.p0", "the device with insufficient privilege.%{}"); -var all219 = all_match({ +var all214 = all_match({ processors: [ - part1051, - dup376, - part1052, + part1046, + dup373, + part1047, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -13994,21 +12618,19 @@ var all219 = all_match({ ]), }); -var msg630 = msg("00034:41", all219); +var msg630 = msg("00034:41", all214); -var part1053 = // "Pattern{Constant('SSH: Maximum number of SSH sessions ('), Field(fld2,false), Constant(') exceeded. Connection request from SSH user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' denied.')}" -match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ - dup242, +var part1048 = match("MESSAGE#622:00034:42", "nwparser.payload", "SSH: Maximum number of SSH sessions (%{fld2}) exceeded. Connection request from SSH user %{username->} at %{saddr->} denied.", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg631 = msg("00034:42", part1053); +var msg631 = msg("00034:42", part1048); -var part1054 = // "Pattern{Constant('Ethernet driver ran out of rx bd (port '), Field(network_port,false), Constant(')')}" -match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ +var part1049 = match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx bd (port %{network_port})", processor_chain([ dup19, dup2, dup3, @@ -14016,10 +12638,9 @@ match("MESSAGE#623:00034:43", "nwparser.payload", "Ethernet driver ran out of rx dup5, ])); -var msg632 = msg("00034:43", part1054); +var msg632 = msg("00034:43", part1049); -var part1055 = // "Pattern{Constant('Potential replay attack detected on SSH connection initiated from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ +var part1050 = match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack detected on SSH connection initiated from %{saddr}:%{sport->} (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -14027,7 +12648,7 @@ match("MESSAGE#1224:00034:44", "nwparser.payload", "Potential replay attack dete dup9, ])); -var msg633 = msg("00034:44", part1055); +var msg633 = msg("00034:44", part1050); var select225 = linear_select([ msg594, @@ -14072,8 +12693,7 @@ var select225 = linear_select([ msg633, ]); -var part1056 = // "Pattern{Constant('PKI Verify Error: '), Field(resultcode,false), Constant(':'), Field(result,false)}" -match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ +var part1051 = match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}:%{result}", processor_chain([ dup117, dup2, dup3, @@ -14081,10 +12701,9 @@ match("MESSAGE#624:00035", "nwparser.payload", "PKI Verify Error: %{resultcode}: dup5, ])); -var msg634 = msg("00035", part1056); +var msg634 = msg("00035", part1051); -var part1057 = // "Pattern{Constant('SSL - Error MessageID in incoming mail - '), Field(fld2,false)}" -match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ +var part1052 = match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in incoming mail - %{fld2}", processor_chain([ dup117, dup2, dup3, @@ -14092,10 +12711,9 @@ match("MESSAGE#625:00035:01", "nwparser.payload", "SSL - Error MessageID in inco dup5, ])); -var msg635 = msg("00035:01", part1057); +var msg635 = msg("00035:01", part1052); -var part1058 = // "Pattern{Constant('SSL - cipher type '), Field(fld2,true), Constant(' is not allowed in export or firewall only system')}" -match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ +var part1053 = match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} is not allowed in export or firewall only system", processor_chain([ dup117, dup2, dup3, @@ -14103,10 +12721,9 @@ match("MESSAGE#626:00035:02", "nwparser.payload", "SSL - cipher type %{fld2->} i dup5, ])); -var msg636 = msg("00035:02", part1058); +var msg636 = msg("00035:02", part1053); -var part1059 = // "Pattern{Constant('SSL CA changed'), Field(,false)}" -match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ +var part1054 = match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor_chain([ dup1, dup2, dup3, @@ -14114,34 +12731,29 @@ match("MESSAGE#627:00035:03", "nwparser.payload", "SSL CA changed%{}", processor dup5, ])); -var msg637 = msg("00035:03", part1059); +var msg637 = msg("00035:03", part1054); -var part1060 = // "Pattern{Constant('SSL Error when retrieve local c'), Field(p0,false)}" -match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); +var part1055 = match("MESSAGE#628:00035:04/0", "nwparser.payload", "SSL Error when retrieve local c%{p0}"); -var part1061 = // "Pattern{Constant('a(verify) '), Field(p0,false)}" -match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); +var part1056 = match("MESSAGE#628:00035:04/1_0", "nwparser.p0", "a(verify) %{p0}"); -var part1062 = // "Pattern{Constant('ert(verify) '), Field(p0,false)}" -match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); +var part1057 = match("MESSAGE#628:00035:04/1_1", "nwparser.p0", "ert(verify) %{p0}"); -var part1063 = // "Pattern{Constant('ert(all) '), Field(p0,false)}" -match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); +var part1058 = match("MESSAGE#628:00035:04/1_2", "nwparser.p0", "ert(all) %{p0}"); var select226 = linear_select([ - part1061, - part1062, - part1063, + part1056, + part1057, + part1058, ]); -var part1064 = // "Pattern{Constant(': '), Field(fld2,false)}" -match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); +var part1059 = match("MESSAGE#628:00035:04/2", "nwparser.p0", ": %{fld2}"); -var all220 = all_match({ +var all215 = all_match({ processors: [ - part1060, + part1055, select226, - part1064, + part1059, ], on_success: processor_chain([ dup117, @@ -14152,10 +12764,9 @@ var all220 = all_match({ ]), }); -var msg638 = msg("00035:04", all220); +var msg638 = msg("00035:04", all215); -var part1065 = // "Pattern{Constant('SSL No ssl context. Not ready for connections.'), Field(,false)}" -match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ +var part1060 = match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready for connections.%{}", processor_chain([ dup117, dup2, dup3, @@ -14163,19 +12774,17 @@ match("MESSAGE#629:00035:05", "nwparser.payload", "SSL No ssl context. Not ready dup5, ])); -var msg639 = msg("00035:05", part1065); +var msg639 = msg("00035:05", part1060); -var part1066 = // "Pattern{Constant('SSL c'), Field(p0,false)}" -match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); +var part1061 = match("MESSAGE#630:00035:06/0", "nwparser.payload", "SSL c%{p0}"); -var part1067 = // "Pattern{Constant('changed to none'), Field(,false)}" -match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); +var part1062 = match("MESSAGE#630:00035:06/2", "nwparser.p0", "changed to none%{}"); -var all221 = all_match({ +var all216 = all_match({ processors: [ - part1066, - dup391, - part1067, + part1061, + dup388, + part1062, ], on_success: processor_chain([ dup1, @@ -14186,10 +12795,9 @@ var all221 = all_match({ ]), }); -var msg640 = msg("00035:06", all221); +var msg640 = msg("00035:06", all216); -var part1068 = // "Pattern{Constant('SSL cert subject mismatch: '), Field(fld2,true), Constant(' recieved '), Field(fld3,true), Constant(' is expected')}" -match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ +var part1063 = match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{fld2->} recieved %{fld3->} is expected", processor_chain([ dup19, dup2, dup3, @@ -14197,10 +12805,9 @@ match("MESSAGE#631:00035:07", "nwparser.payload", "SSL cert subject mismatch: %{ dup5, ])); -var msg641 = msg("00035:07", part1068); +var msg641 = msg("00035:07", part1063); -var part1069 = // "Pattern{Constant('SSL certificate changed'), Field(,false)}" -match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ +var part1064 = match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", processor_chain([ dup1, dup2, dup3, @@ -14208,19 +12815,18 @@ match("MESSAGE#632:00035:08", "nwparser.payload", "SSL certificate changed%{}", dup5, ])); -var msg642 = msg("00035:08", part1069); +var msg642 = msg("00035:08", part1064); -var part1070 = // "Pattern{Constant('enabled'), Field(,false)}" -match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); +var part1065 = match("MESSAGE#633:00035:09/1_0", "nwparser.p0", "enabled%{}"); var select227 = linear_select([ - part1070, + part1065, dup92, ]); -var all222 = all_match({ +var all217 = all_match({ processors: [ - dup255, + dup253, select227, ], on_success: processor_chain([ @@ -14232,29 +12838,26 @@ var all222 = all_match({ ]), }); -var msg643 = msg("00035:09", all222); +var msg643 = msg("00035:09", all217); -var part1071 = // "Pattern{Constant('SSL memory allocation fails in process_c'), Field(p0,false)}" -match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); +var part1066 = match("MESSAGE#634:00035:10/0", "nwparser.payload", "SSL memory allocation fails in process_c%{p0}"); -var part1072 = // "Pattern{Constant('a()'), Field(,false)}" -match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); +var part1067 = match("MESSAGE#634:00035:10/1_0", "nwparser.p0", "a()%{}"); -var part1073 = // "Pattern{Constant('ert()'), Field(,false)}" -match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); +var part1068 = match("MESSAGE#634:00035:10/1_1", "nwparser.p0", "ert()%{}"); var select228 = linear_select([ - part1072, - part1073, + part1067, + part1068, ]); -var all223 = all_match({ +var all218 = all_match({ processors: [ - part1071, + part1066, select228, ], on_success: processor_chain([ - dup186, + dup184, dup2, dup3, dup4, @@ -14262,25 +12865,22 @@ var all223 = all_match({ ]), }); -var msg644 = msg("00035:10", all223); +var msg644 = msg("00035:10", all218); -var part1074 = // "Pattern{Constant('SSL no ssl c'), Field(p0,false)}" -match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); +var part1069 = match("MESSAGE#635:00035:11/0", "nwparser.payload", "SSL no ssl c%{p0}"); -var part1075 = // "Pattern{Constant('a'), Field(,false)}" -match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); +var part1070 = match("MESSAGE#635:00035:11/1_0", "nwparser.p0", "a%{}"); -var part1076 = // "Pattern{Constant('ert'), Field(,false)}" -match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); +var part1071 = match("MESSAGE#635:00035:11/1_1", "nwparser.p0", "ert%{}"); var select229 = linear_select([ - part1075, - part1076, + part1070, + part1071, ]); -var all224 = all_match({ +var all219 = all_match({ processors: [ - part1074, + part1069, select229, ], on_success: processor_chain([ @@ -14292,19 +12892,17 @@ var all224 = all_match({ ]), }); -var msg645 = msg("00035:11", all224); +var msg645 = msg("00035:11", all219); -var part1077 = // "Pattern{Constant('SSL set c'), Field(p0,false)}" -match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); +var part1072 = match("MESSAGE#636:00035:12/0", "nwparser.payload", "SSL set c%{p0}"); -var part1078 = // "Pattern{Constant('id is invalid '), Field(fld2,false)}" -match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); +var part1073 = match("MESSAGE#636:00035:12/2", "nwparser.p0", "id is invalid %{fld2}"); -var all225 = all_match({ +var all220 = all_match({ processors: [ - part1077, - dup391, - part1078, + part1072, + dup388, + part1073, ], on_success: processor_chain([ dup19, @@ -14315,24 +12913,22 @@ var all225 = all_match({ ]), }); -var msg646 = msg("00035:12", all225); +var msg646 = msg("00035:12", all220); -var part1079 = // "Pattern{Constant('verify '), Field(p0,false)}" -match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); +var part1074 = match("MESSAGE#637:00035:13/1_1", "nwparser.p0", "verify %{p0}"); var select230 = linear_select([ dup101, - part1079, + part1074, ]); -var part1080 = // "Pattern{Constant('cert failed. Key type is not RSA'), Field(,false)}" -match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); +var part1075 = match("MESSAGE#637:00035:13/2", "nwparser.p0", "cert failed. Key type is not RSA%{}"); -var all226 = all_match({ +var all221 = all_match({ processors: [ - dup255, + dup253, select230, - part1080, + part1075, ], on_success: processor_chain([ dup19, @@ -14343,10 +12939,9 @@ var all226 = all_match({ ]), }); -var msg647 = msg("00035:13", all226); +var msg647 = msg("00035:13", all221); -var part1081 = // "Pattern{Constant('SSL ssl context init failed'), Field(,false)}" -match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ +var part1076 = match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{}", processor_chain([ dup19, dup2, dup3, @@ -14354,29 +12949,26 @@ match("MESSAGE#638:00035:14", "nwparser.payload", "SSL ssl context init failed%{ dup5, ])); -var msg648 = msg("00035:14", part1081); +var msg648 = msg("00035:14", part1076); -var part1082 = // "Pattern{Field(change_attribute,true), Constant(' has been changed '), Field(p0,false)}" -match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); +var part1077 = match("MESSAGE#639:00035:15/0", "nwparser.payload", "%{change_attribute->} has been changed %{p0}"); -var part1083 = // "Pattern{Constant('from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); +var part1078 = match("MESSAGE#639:00035:15/1_0", "nwparser.p0", "from %{change_old->} to %{change_new}"); -var part1084 = // "Pattern{Constant('to '), Field(fld2,false)}" -match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); +var part1079 = match("MESSAGE#639:00035:15/1_1", "nwparser.p0", "to %{fld2}"); var select231 = linear_select([ - part1083, - part1084, + part1078, + part1079, ]); -var all227 = all_match({ +var all222 = all_match({ processors: [ - part1082, + part1077, select231, ], on_success: processor_chain([ - dup186, + dup184, dup2, dup3, dup4, @@ -14384,10 +12976,9 @@ var all227 = all_match({ ]), }); -var msg649 = msg("00035:15", all227); +var msg649 = msg("00035:15", all222); -var part1085 = // "Pattern{Constant('web SSL certificate changed to by '), Field(username,true), Constant(' via web from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' '), Field(fld5,false)}" -match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ +var part1080 = match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed to by %{username->} via web from host %{saddr->} to %{daddr}:%{dport->} %{fld5}", processor_chain([ dup1, dup2, dup3, @@ -14395,7 +12986,7 @@ match("MESSAGE#640:00035:16", "nwparser.payload", "web SSL certificate changed t dup5, ])); -var msg650 = msg("00035:16", part1085); +var msg650 = msg("00035:16", part1080); var select232 = linear_select([ msg634, @@ -14417,39 +13008,35 @@ var select232 = linear_select([ msg650, ]); -var part1086 = // "Pattern{Constant('An optional ScreenOS feature has been activated via a software key'), Field(,false)}" -match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ - dup211, +var part1081 = match("MESSAGE#641:00036", "nwparser.payload", "An optional ScreenOS feature has been activated via a software key%{}", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg651 = msg("00036", part1086); +var msg651 = msg("00036", part1081); -var part1087 = // "Pattern{Field(fld2,true), Constant(' license keys were updated successfully by '), Field(p0,false)}" -match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); +var part1082 = match("MESSAGE#642:00036:01/0", "nwparser.payload", "%{fld2->} license keys were updated successfully by %{p0}"); -var part1088 = // "Pattern{Constant('manual '), Field(p0,false)}" -match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); +var part1083 = match("MESSAGE#642:00036:01/1_1", "nwparser.p0", "manual %{p0}"); var select233 = linear_select([ - dup216, - part1088, + dup214, + part1083, ]); -var part1089 = // "Pattern{Constant('retrieval'), Field(,false)}" -match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); +var part1084 = match("MESSAGE#642:00036:01/2", "nwparser.p0", "retrieval%{}"); -var all228 = all_match({ +var all223 = all_match({ processors: [ - part1087, + part1082, select233, - part1089, + part1084, ], on_success: processor_chain([ - dup256, + dup254, dup2, dup3, dup4, @@ -14457,30 +13044,27 @@ var all228 = all_match({ ]), }); -var msg652 = msg("00036:01", all228); +var msg652 = msg("00036:01", all223); var select234 = linear_select([ msg651, msg652, ]); -var part1090 = // "Pattern{Constant('Intra-zone block for zone '), Field(zone,true), Constant(' was set to o'), Field(p0,false)}" -match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); +var part1085 = match("MESSAGE#643:00037/0", "nwparser.payload", "Intra-zone block for zone %{zone->} was set to o%{p0}"); -var part1091 = // "Pattern{Constant('n'), Field(,false)}" -match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); +var part1086 = match("MESSAGE#643:00037/1_0", "nwparser.p0", "n%{}"); -var part1092 = // "Pattern{Constant('ff'), Field(,false)}" -match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); +var part1087 = match("MESSAGE#643:00037/1_1", "nwparser.p0", "ff%{}"); var select235 = linear_select([ - part1091, - part1092, + part1086, + part1087, ]); -var all229 = all_match({ +var all224 = all_match({ processors: [ - part1090, + part1085, select235, ], on_success: processor_chain([ @@ -14492,25 +13076,23 @@ var all229 = all_match({ ]), }); -var msg653 = msg("00037", all229); +var msg653 = msg("00037", all224); -var part1093 = // "Pattern{Constant('New zone '), Field(zone,true), Constant(' ( '), Field(p0,false)}" -match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); +var part1088 = match("MESSAGE#644:00037:01/0", "nwparser.payload", "New zone %{zone->} ( %{p0}"); var select236 = linear_select([ - dup257, - dup258, + dup255, + dup256, ]); -var part1094 = // "Pattern{Constant(''), Field(fld2,false), Constant(') was created.'), Field(p0,false)}" -match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); +var part1089 = match("MESSAGE#644:00037:01/2", "nwparser.p0", "%{fld2}) was created.%{p0}"); -var all230 = all_match({ +var all225 = all_match({ processors: [ - part1093, + part1088, select236, - part1094, - dup353, + part1089, + dup351, ], on_success: processor_chain([ dup1, @@ -14522,10 +13104,9 @@ var all230 = all_match({ ]), }); -var msg654 = msg("00037:01", all230); +var msg654 = msg("00037:01", all225); -var part1095 = // "Pattern{Constant('Tunnel zone '), Field(src_zone,true), Constant(' was bound to out zone '), Field(dst_zone,false), Constant('.')}" -match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ +var part1090 = match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was bound to out zone %{dst_zone}.", processor_chain([ dup1, dup2, dup3, @@ -14533,39 +13114,34 @@ match("MESSAGE#645:00037:02", "nwparser.payload", "Tunnel zone %{src_zone->} was dup5, ])); -var msg655 = msg("00037:02", part1095); +var msg655 = msg("00037:02", part1090); -var part1096 = // "Pattern{Constant('was was '), Field(p0,false)}" -match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); +var part1091 = match("MESSAGE#646:00037:03/1_0", "nwparser.p0", "was was %{p0}"); -var part1097 = // "Pattern{Field(zone,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); +var part1092 = match("MESSAGE#646:00037:03/1_1", "nwparser.p0", "%{zone->} was %{p0}"); var select237 = linear_select([ - part1096, - part1097, + part1091, + part1092, ]); -var part1098 = // "Pattern{Constant('virtual router '), Field(p0,false)}" -match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); +var part1093 = match("MESSAGE#646:00037:03/3", "nwparser.p0", "virtual router %{p0}"); -var part1099 = // "Pattern{Field(node,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); +var part1094 = match("MESSAGE#646:00037:03/4_0", "nwparser.p0", "%{node->} (%{fld1})"); -var part1100 = // "Pattern{Field(node,false), Constant('.')}" -match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); +var part1095 = match("MESSAGE#646:00037:03/4_1", "nwparser.p0", "%{node}."); var select238 = linear_select([ - part1099, - part1100, + part1094, + part1095, ]); -var all231 = all_match({ +var all226 = all_match({ processors: [ dup113, select237, - dup374, - part1098, + dup371, + part1093, select238, ], on_success: processor_chain([ @@ -14578,10 +13154,9 @@ var all231 = all_match({ ]), }); -var msg656 = msg("00037:03", all231); +var msg656 = msg("00037:03", all226); -var part1101 = // "Pattern{Constant('Zone '), Field(zone,true), Constant(' was changed to non-shared.')}" -match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ +var part1096 = match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to non-shared.", processor_chain([ dup1, dup2, dup3, @@ -14589,32 +13164,29 @@ match("MESSAGE#647:00037:04", "nwparser.payload", "Zone %{zone->} was changed to dup5, ])); -var msg657 = msg("00037:04", part1101); +var msg657 = msg("00037:04", part1096); -var part1102 = // "Pattern{Constant('Zone '), Field(zone,true), Constant(' ( '), Field(p0,false)}" -match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); +var part1097 = match("MESSAGE#648:00037:05/0", "nwparser.payload", "Zone %{zone->} ( %{p0}"); var select239 = linear_select([ - dup258, - dup257, + dup256, + dup255, ]); -var part1103 = // "Pattern{Constant(''), Field(fld2,false), Constant(') was deleted. '), Field(p0,false)}" -match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); +var part1098 = match("MESSAGE#648:00037:05/2", "nwparser.p0", "%{fld2}) was deleted. %{p0}"); -var part1104 = // "Pattern{Field(space,false)}" -match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); +var part1099 = match_copy("MESSAGE#648:00037:05/3_1", "nwparser.p0", "space"); var select240 = linear_select([ dup10, - part1104, + part1099, ]); -var all232 = all_match({ +var all227 = all_match({ processors: [ - part1102, + part1097, select239, - part1103, + part1098, select240, ], on_success: processor_chain([ @@ -14627,10 +13199,9 @@ var all232 = all_match({ ]), }); -var msg658 = msg("00037:05", all232); +var msg658 = msg("00037:05", all227); -var part1105 = // "Pattern{Constant('IP/TCP reassembly for ALG was '), Field(disposition,true), Constant(' on zone '), Field(zone,false), Constant('.')}" -match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ +var part1100 = match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was %{disposition->} on zone %{zone}.", processor_chain([ dup1, dup2, dup3, @@ -14638,7 +13209,7 @@ match("MESSAGE#649:00037:06", "nwparser.payload", "IP/TCP reassembly for ALG was dup5, ])); -var msg659 = msg("00037:06", part1105); +var msg659 = msg("00037:06", part1100); var select241 = linear_select([ msg653, @@ -14650,23 +13221,20 @@ var select241 = linear_select([ msg659, ]); -var part1106 = // "Pattern{Constant('OSPF routing instance in vrouter '), Field(p0,false)}" -match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); +var part1101 = match("MESSAGE#650:00038/0", "nwparser.payload", "OSPF routing instance in vrouter %{p0}"); -var part1107 = // "Pattern{Field(node,true), Constant(' is '), Field(p0,false)}" -match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); +var part1102 = match("MESSAGE#650:00038/1_0", "nwparser.p0", "%{node->} is %{p0}"); -var part1108 = // "Pattern{Field(node,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); +var part1103 = match("MESSAGE#650:00038/1_1", "nwparser.p0", "%{node->} %{p0}"); var select242 = linear_select([ - part1107, - part1108, + part1102, + part1103, ]); -var all233 = all_match({ +var all228 = all_match({ processors: [ - part1106, + part1101, select242, dup36, ], @@ -14679,10 +13247,9 @@ var all233 = all_match({ ]), }); -var msg660 = msg("00038", all233); +var msg660 = msg("00038", all228); -var part1109 = // "Pattern{Constant('BGP instance name created for vr '), Field(node,false)}" -match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ +var part1104 = match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr %{node}", processor_chain([ dup1, dup2, dup3, @@ -14690,26 +13257,23 @@ match("MESSAGE#651:00039", "nwparser.payload", "BGP instance name created for vr dup5, ])); -var msg661 = msg("00039", part1109); +var msg661 = msg("00039", part1104); -var part1110 = // "Pattern{Constant('Low watermark'), Field(p0,false)}" -match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); +var part1105 = match("MESSAGE#652:00040/0_0", "nwparser.payload", "Low watermark%{p0}"); -var part1111 = // "Pattern{Constant('High watermark'), Field(p0,false)}" -match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); +var part1106 = match("MESSAGE#652:00040/0_1", "nwparser.payload", "High watermark%{p0}"); var select243 = linear_select([ - part1110, - part1111, + part1105, + part1106, ]); -var part1112 = // "Pattern{Field(,false), Constant('for early aging has been changed to the default '), Field(fld2,false)}" -match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); +var part1107 = match("MESSAGE#652:00040/1", "nwparser.p0", "%{}for early aging has been changed to the default %{fld2}"); -var all234 = all_match({ +var all229 = all_match({ processors: [ select243, - part1112, + part1107, ], on_success: processor_chain([ dup1, @@ -14720,10 +13284,9 @@ var all234 = all_match({ ]), }); -var msg662 = msg("00040", all234); +var msg662 = msg("00040", all229); -var part1113 = // "Pattern{Constant('VPN ''), Field(group,false), Constant('' from '), Field(daddr,true), Constant(' is '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ +var part1108 = match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -14732,15 +13295,14 @@ match("MESSAGE#653:00040:01", "nwparser.payload", "VPN '%{group}' from %{daddr-> dup5, ])); -var msg663 = msg("00040:01", part1113); +var msg663 = msg("00040:01", part1108); var select244 = linear_select([ msg662, msg663, ]); -var part1114 = // "Pattern{Constant('A route-map name in virtual router '), Field(node,true), Constant(' has been removed')}" -match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ +var part1109 = match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual router %{node->} has been removed", processor_chain([ dup1, dup2, dup3, @@ -14748,10 +13310,9 @@ match("MESSAGE#654:00041", "nwparser.payload", "A route-map name in virtual rout dup5, ])); -var msg664 = msg("00041", part1114); +var msg664 = msg("00041", part1109); -var part1115 = // "Pattern{Constant('VPN ''), Field(group,false), Constant('' from '), Field(daddr,true), Constant(' is '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ +var part1110 = match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr->} is %{disposition->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -14760,15 +13321,14 @@ match("MESSAGE#655:00041:01", "nwparser.payload", "VPN '%{group}' from %{daddr-> dup5, ])); -var msg665 = msg("00041:01", part1115); +var msg665 = msg("00041:01", part1110); var select245 = linear_select([ msg664, msg665, ]); -var part1116 = // "Pattern{Constant('Replay packet detected on IPSec tunnel on '), Field(interface,true), Constant(' with tunnel ID '), Field(fld2,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,false), Constant(', '), Field(info,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ +var part1111 = match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec tunnel on %{interface->} with tunnel ID %{fld2}! From %{saddr->} to %{daddr}/%{dport}, %{info->} (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -14777,10 +13337,9 @@ match("MESSAGE#656:00042", "nwparser.payload", "Replay packet detected on IPSec dup5, ])); -var msg666 = msg("00042", part1116); +var msg666 = msg("00042", part1111); -var part1117 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1112 = match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -14791,15 +13350,14 @@ match("MESSAGE#657:00042:01", "nwparser.payload", "%{signame->} From %{saddr->} dup60, ])); -var msg667 = msg("00042:01", part1117); +var msg667 = msg("00042:01", part1112); var select246 = linear_select([ msg666, msg667, ]); -var part1118 = // "Pattern{Constant('Receive StopCCN_msg, remove l2tp tunnel ('), Field(fld2,false), Constant('-'), Field(fld3,false), Constant('), Result code '), Field(resultcode,true), Constant(' ('), Field(result,false), Constant('). ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ +var part1113 = match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp tunnel (%{fld2}-%{fld3}), Result code %{resultcode->} (%{result}). (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -14808,27 +13366,24 @@ match("MESSAGE#658:00043", "nwparser.payload", "Receive StopCCN_msg, remove l2tp dup5, ])); -var msg668 = msg("00043", part1118); +var msg668 = msg("00043", part1113); -var part1119 = // "Pattern{Constant('access list '), Field(listnum,true), Constant(' sequence number '), Field(fld3,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); +var part1114 = match("MESSAGE#659:00044/0", "nwparser.payload", "access list %{listnum->} sequence number %{fld3->} %{p0}"); -var part1120 = // "Pattern{Constant('deny '), Field(p0,false)}" -match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); +var part1115 = match("MESSAGE#659:00044/1_1", "nwparser.p0", "deny %{p0}"); var select247 = linear_select([ - dup259, - part1120, + dup257, + part1115, ]); -var part1121 = // "Pattern{Constant('ip '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' '), Field(disposition,true), Constant(' in vrouter '), Field(node,false)}" -match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); +var part1116 = match("MESSAGE#659:00044/2", "nwparser.p0", "ip %{hostip}/%{mask->} %{disposition->} in vrouter %{node}"); -var all235 = all_match({ +var all230 = all_match({ processors: [ - part1119, + part1114, select247, - part1121, + part1116, ], on_success: processor_chain([ dup1, @@ -14839,10 +13394,9 @@ var all235 = all_match({ ]), }); -var msg669 = msg("00044", all235); +var msg669 = msg("00044", all230); -var part1122 = // "Pattern{Constant('access list '), Field(listnum,true), Constant(' '), Field(disposition,true), Constant(' in vrouter '), Field(node,false), Constant('.')}" -match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ +var part1117 = match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{disposition->} in vrouter %{node}.", processor_chain([ dup1, dup2, dup3, @@ -14850,15 +13404,14 @@ match("MESSAGE#660:00044:01", "nwparser.payload", "access list %{listnum->} %{di dup5, ])); -var msg670 = msg("00044:01", part1122); +var msg670 = msg("00044:01", part1117); var select248 = linear_select([ msg669, msg670, ]); -var part1123 = // "Pattern{Constant('RIP instance in virtual router '), Field(node,true), Constant(' was '), Field(disposition,false), Constant('.')}" -match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ +var part1118 = match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router %{node->} was %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -14866,27 +13419,24 @@ match("MESSAGE#661:00045", "nwparser.payload", "RIP instance in virtual router % dup5, ])); -var msg671 = msg("00045", part1123); +var msg671 = msg("00045", part1118); -var part1124 = // "Pattern{Constant('remove '), Field(p0,false)}" -match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); +var part1119 = match("MESSAGE#662:00047/1_0", "nwparser.p0", "remove %{p0}"); -var part1125 = // "Pattern{Constant('add '), Field(p0,false)}" -match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); +var part1120 = match("MESSAGE#662:00047/1_1", "nwparser.p0", "add %{p0}"); var select249 = linear_select([ - part1124, - part1125, + part1119, + part1120, ]); -var part1126 = // "Pattern{Constant('multicast policy from '), Field(src_zone,true), Constant(' '), Field(fld4,true), Constant(' to '), Field(dst_zone,true), Constant(' '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); +var part1121 = match("MESSAGE#662:00047/2", "nwparser.p0", "multicast policy from %{src_zone->} %{fld4->} to %{dst_zone->} %{fld3->} (%{fld1})"); -var all236 = all_match({ +var all231 = all_match({ processors: [ - dup185, + dup183, select249, - part1126, + part1121, ], on_success: processor_chain([ dup1, @@ -14898,79 +13448,68 @@ var all236 = all_match({ ]), }); -var msg672 = msg("00047", all236); +var msg672 = msg("00047", all231); -var part1127 = // "Pattern{Constant('Access list entry '), Field(listnum,true), Constant(' with '), Field(p0,false)}" -match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); +var part1122 = match("MESSAGE#663:00048/0", "nwparser.payload", "Access list entry %{listnum->} with %{p0}"); -var part1128 = // "Pattern{Constant('a sequence '), Field(p0,false)}" -match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); +var part1123 = match("MESSAGE#663:00048/1_0", "nwparser.p0", "a sequence %{p0}"); -var part1129 = // "Pattern{Constant('sequence '), Field(p0,false)}" -match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); +var part1124 = match("MESSAGE#663:00048/1_1", "nwparser.p0", "sequence %{p0}"); var select250 = linear_select([ - part1128, - part1129, + part1123, + part1124, ]); -var part1130 = // "Pattern{Constant('number '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); +var part1125 = match("MESSAGE#663:00048/2", "nwparser.p0", "number %{fld2->} %{p0}"); -var part1131 = // "Pattern{Constant('with an action of '), Field(p0,false)}" -match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); +var part1126 = match("MESSAGE#663:00048/3_0", "nwparser.p0", "with an action of %{p0}"); var select251 = linear_select([ - part1131, + part1126, dup112, ]); -var part1132 = // "Pattern{Constant('with an IP '), Field(p0,false)}" -match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); +var part1127 = match("MESSAGE#663:00048/5_0", "nwparser.p0", "with an IP %{p0}"); var select252 = linear_select([ - part1132, + part1127, dup139, ]); -var part1133 = // "Pattern{Constant('address '), Field(p0,false)}" -match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); +var part1128 = match("MESSAGE#663:00048/6", "nwparser.p0", "address %{p0}"); -var part1134 = // "Pattern{Constant('and subnetwork mask of '), Field(p0,false)}" -match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); +var part1129 = match("MESSAGE#663:00048/7_0", "nwparser.p0", "and subnetwork mask of %{p0}"); var select253 = linear_select([ - part1134, + part1129, dup16, ]); -var part1135 = // "Pattern{Field(,true), Constant(' '), Field(fld3,false), Constant('was '), Field(p0,false)}" -match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); +var part1130 = match("MESSAGE#663:00048/8", "nwparser.p0", "%{} %{fld3}was %{p0}"); -var part1136 = // "Pattern{Constant('created on '), Field(p0,false)}" -match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); +var part1131 = match("MESSAGE#663:00048/9_0", "nwparser.p0", "created on %{p0}"); var select254 = linear_select([ - part1136, + part1131, dup129, ]); -var part1137 = // "Pattern{Constant('virtual router '), Field(node,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); +var part1132 = match("MESSAGE#663:00048/10", "nwparser.p0", "virtual router %{node->} (%{fld1})"); -var all237 = all_match({ +var all232 = all_match({ processors: [ - part1127, + part1122, select250, - part1130, + part1125, select251, - dup259, + dup257, select252, - part1133, + part1128, select253, - part1135, + part1130, select254, - part1137, + part1132, ], on_success: processor_chain([ setc("eventcategory","1501000000"), @@ -14982,43 +13521,37 @@ var all237 = all_match({ ]), }); -var msg673 = msg("00048", all237); +var msg673 = msg("00048", all232); -var part1138 = // "Pattern{Constant('Route '), Field(p0,false)}" -match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); +var part1133 = match("MESSAGE#664:00048:01/0", "nwparser.payload", "Route %{p0}"); -var part1139 = // "Pattern{Constant('map entry '), Field(p0,false)}" -match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); +var part1134 = match("MESSAGE#664:00048:01/1_0", "nwparser.p0", "map entry %{p0}"); -var part1140 = // "Pattern{Constant('entry '), Field(p0,false)}" -match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); +var part1135 = match("MESSAGE#664:00048:01/1_1", "nwparser.p0", "entry %{p0}"); var select255 = linear_select([ - part1139, - part1140, + part1134, + part1135, ]); -var part1141 = // "Pattern{Constant('with sequence number '), Field(fld2,true), Constant(' in route map binck-ospf'), Field(p0,false)}" -match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); +var part1136 = match("MESSAGE#664:00048:01/2", "nwparser.p0", "with sequence number %{fld2->} in route map binck-ospf%{p0}"); -var part1142 = // "Pattern{Constant(' in '), Field(p0,false)}" -match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); +var part1137 = match("MESSAGE#664:00048:01/3_0", "nwparser.p0", " in %{p0}"); var select256 = linear_select([ - part1142, + part1137, dup105, ]); -var part1143 = // "Pattern{Constant('virtual router '), Field(node,true), Constant(' was '), Field(disposition,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); +var part1138 = match("MESSAGE#664:00048:01/4", "nwparser.p0", "virtual router %{node->} was %{disposition->} (%{fld1})"); -var all238 = all_match({ +var all233 = all_match({ processors: [ - part1138, + part1133, select255, - part1141, + part1136, select256, - part1143, + part1138, ], on_success: processor_chain([ dup1, @@ -15030,11 +13563,10 @@ var all238 = all_match({ ]), }); -var msg674 = msg("00048:01", all238); +var msg674 = msg("00048:01", all233); -var part1144 = // "Pattern{Field(space,false), Constant('set match interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ - dup211, +var part1139 = match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface %{interface->} (%{fld1})", processor_chain([ + dup209, dup2, dup3, dup9, @@ -15042,7 +13574,7 @@ match("MESSAGE#665:00048:02", "nwparser.payload", "%{space}set match interface % dup5, ])); -var msg675 = msg("00048:02", part1144); +var msg675 = msg("00048:02", part1139); var select257 = linear_select([ msg673, @@ -15050,8 +13582,7 @@ var select257 = linear_select([ msg675, ]); -var part1145 = // "Pattern{Constant('Route-lookup preference changed to '), Field(fld8,true), Constant(' ('), Field(fld2,false), Constant(') => '), Field(fld3,true), Constant(' ('), Field(fld4,false), Constant(') => '), Field(fld5,true), Constant(' ('), Field(fld6,false), Constant(') in virtual router ('), Field(node,false), Constant(')')}" -match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ +var part1140 = match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed to %{fld8->} (%{fld2}) => %{fld3->} (%{fld4}) => %{fld5->} (%{fld6}) in virtual router (%{node})", processor_chain([ dup1, dup2, dup3, @@ -15059,10 +13590,9 @@ match("MESSAGE#666:00049", "nwparser.payload", "Route-lookup preference changed dup5, ])); -var msg676 = msg("00049", part1145); +var msg676 = msg("00049", part1140); -var part1146 = // "Pattern{Constant('SIBR routing '), Field(disposition,true), Constant(' in virtual router '), Field(node,false)}" -match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ +var part1141 = match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} in virtual router %{node}", processor_chain([ dup1, dup2, dup3, @@ -15070,10 +13600,9 @@ match("MESSAGE#667:00049:01", "nwparser.payload", "SIBR routing %{disposition->} dup5, ])); -var msg677 = msg("00049:01", part1146); +var msg677 = msg("00049:01", part1141); -var part1147 = // "Pattern{Constant('A virtual router with name '), Field(node,true), Constant(' and ID '), Field(fld2,true), Constant(' has been removed')}" -match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ +var part1142 = match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{node->} and ID %{fld2->} has been removed", processor_chain([ dup1, dup2, dup3, @@ -15081,10 +13610,9 @@ match("MESSAGE#668:00049:02", "nwparser.payload", "A virtual router with name %{ dup5, ])); -var msg678 = msg("00049:02", part1147); +var msg678 = msg("00049:02", part1142); -var part1148 = // "Pattern{Constant('The router-id of virtual router "'), Field(node,false), Constant('" used by OSPF, BGP routing instances id has been uninitialized. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ +var part1143 = match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual router \"%{node}\" used by OSPF, BGP routing instances id has been uninitialized. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -15092,10 +13620,9 @@ match("MESSAGE#669:00049:03", "nwparser.payload", "The router-id of virtual rout dup5, ])); -var msg679 = msg("00049:03", part1148); +var msg679 = msg("00049:03", part1143); -var part1149 = // "Pattern{Constant('The system default-route through virtual router "'), Field(node,false), Constant('" has been added in virtual router "'), Field(fld4,false), Constant('" ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ +var part1144 = match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route through virtual router \"%{node}\" has been added in virtual router \"%{fld4}\" (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -15103,10 +13630,9 @@ match("MESSAGE#670:00049:04", "nwparser.payload", "The system default-route thro dup5, ])); -var msg680 = msg("00049:04", part1149); +var msg680 = msg("00049:04", part1144); -var part1150 = // "Pattern{Constant('Subnetwork conflict checking for interfaces in virtual router ('), Field(node,false), Constant(') has been enabled. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ +var part1145 = match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking for interfaces in virtual router (%{node}) has been enabled. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -15114,7 +13640,7 @@ match("MESSAGE#671:00049:05", "nwparser.payload", "Subnetwork conflict checking dup5, ])); -var msg681 = msg("00049:05", part1150); +var msg681 = msg("00049:05", part1145); var select258 = linear_select([ msg676, @@ -15125,8 +13651,7 @@ var select258 = linear_select([ msg681, ]); -var part1151 = // "Pattern{Constant('Track IP enabled ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ +var part1146 = match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -15135,10 +13660,9 @@ match("MESSAGE#672:00050", "nwparser.payload", "Track IP enabled (%{fld1})", pro dup5, ])); -var msg682 = msg("00050", part1151); +var msg682 = msg("00050", part1146); -var part1152 = // "Pattern{Constant('Session utilization has reached '), Field(fld2,false), Constant(', which is '), Field(fld3,true), Constant(' of the system capacity!')}" -match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ +var part1147 = match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached %{fld2}, which is %{fld3->} of the system capacity!", processor_chain([ dup117, dup2, dup3, @@ -15146,10 +13670,9 @@ match("MESSAGE#673:00051", "nwparser.payload", "Session utilization has reached dup5, ])); -var msg683 = msg("00051", part1152); +var msg683 = msg("00051", part1147); -var part1153 = // "Pattern{Constant('AV: Suspicious client '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' used '), Field(fld2,true), Constant(' percent of AV resources, which exceeded the max of '), Field(fld3,true), Constant(' percent.')}" -match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ +var part1148 = match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:%{sport}->%{daddr}:%{dport->} used %{fld2->} percent of AV resources, which exceeded the max of %{fld3->} percent.", processor_chain([ dup117, dup2, dup3, @@ -15157,24 +13680,22 @@ match("MESSAGE#674:00052", "nwparser.payload", "AV: Suspicious client %{saddr}:% dup5, ])); -var msg684 = msg("00052", part1153); +var msg684 = msg("00052", part1148); -var part1154 = // "Pattern{Constant('router '), Field(p0,false)}" -match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); +var part1149 = match("MESSAGE#675:00055/1_1", "nwparser.p0", "router %{p0}"); var select259 = linear_select([ - dup171, - part1154, + dup169, + part1149, ]); -var part1155 = // "Pattern{Constant('instance was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); +var part1150 = match("MESSAGE#675:00055/2", "nwparser.p0", "instance was %{disposition->} on interface %{interface}."); -var all239 = all_match({ +var all234 = all_match({ processors: [ - dup260, + dup258, select259, - part1155, + part1150, ], on_success: processor_chain([ dup1, @@ -15185,27 +13706,24 @@ var all239 = all_match({ ]), }); -var msg685 = msg("00055", all239); +var msg685 = msg("00055", all234); -var part1156 = // "Pattern{Constant('proxy '), Field(p0,false)}" -match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); +var part1151 = match("MESSAGE#676:00055:01/1_0", "nwparser.p0", "proxy %{p0}"); -var part1157 = // "Pattern{Constant('function '), Field(p0,false)}" -match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); +var part1152 = match("MESSAGE#676:00055:01/1_1", "nwparser.p0", "function %{p0}"); var select260 = linear_select([ - part1156, - part1157, + part1151, + part1152, ]); -var part1158 = // "Pattern{Constant('was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); +var part1153 = match("MESSAGE#676:00055:01/2", "nwparser.p0", "was %{disposition->} on interface %{interface}."); -var all240 = all_match({ +var all235 = all_match({ processors: [ - dup260, + dup258, select260, - part1158, + part1153, ], on_success: processor_chain([ dup1, @@ -15216,16 +13734,15 @@ var all240 = all_match({ ]), }); -var msg686 = msg("00055:01", all240); +var msg686 = msg("00055:01", all235); -var part1159 = // "Pattern{Constant('same subnet check on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); +var part1154 = match("MESSAGE#677:00055:02/2", "nwparser.p0", "same subnet check on interface %{interface}."); -var all241 = all_match({ +var all236 = all_match({ processors: [ - dup261, - dup392, - part1159, + dup259, + dup389, + part1154, ], on_success: processor_chain([ dup19, @@ -15236,16 +13753,15 @@ var all241 = all_match({ ]), }); -var msg687 = msg("00055:02", all241); +var msg687 = msg("00055:02", all236); -var part1160 = // "Pattern{Constant('router alert IP option check on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); +var part1155 = match("MESSAGE#678:00055:03/2", "nwparser.p0", "router alert IP option check on interface %{interface}."); -var all242 = all_match({ +var all237 = all_match({ processors: [ - dup261, - dup392, - part1160, + dup259, + dup389, + part1155, ], on_success: processor_chain([ dup44, @@ -15256,10 +13772,9 @@ var all242 = all_match({ ]), }); -var msg688 = msg("00055:03", all242); +var msg688 = msg("00055:03", all237); -var part1161 = // "Pattern{Constant('IGMP version was changed to '), Field(version,true), Constant(' on interface '), Field(interface,false)}" -match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ +var part1156 = match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to %{version->} on interface %{interface}", processor_chain([ dup1, dup2, dup3, @@ -15267,27 +13782,24 @@ match("MESSAGE#679:00055:04", "nwparser.payload", "IGMP version was changed to % dup5, ])); -var msg689 = msg("00055:04", part1161); +var msg689 = msg("00055:04", part1156); -var part1162 = // "Pattern{Constant('IGMP query '), Field(p0,false)}" -match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); +var part1157 = match("MESSAGE#680:00055:05/0", "nwparser.payload", "IGMP query %{p0}"); -var part1163 = // "Pattern{Constant('max response time '), Field(p0,false)}" -match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); +var part1158 = match("MESSAGE#680:00055:05/1_1", "nwparser.p0", "max response time %{p0}"); var select261 = linear_select([ dup110, - part1163, + part1158, ]); -var part1164 = // "Pattern{Constant('was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false)}" -match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); +var part1159 = match("MESSAGE#680:00055:05/2", "nwparser.p0", "was changed to %{fld2->} on interface %{interface}"); -var all243 = all_match({ +var all238 = all_match({ processors: [ - part1162, + part1157, select261, - part1164, + part1159, ], on_success: processor_chain([ dup1, @@ -15298,30 +13810,26 @@ var all243 = all_match({ ]), }); -var msg690 = msg("00055:05", all243); +var msg690 = msg("00055:05", all238); -var part1165 = // "Pattern{Constant('IGMP l'), Field(p0,false)}" -match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); +var part1160 = match("MESSAGE#681:00055:06/0", "nwparser.payload", "IGMP l%{p0}"); -var part1166 = // "Pattern{Constant('eave '), Field(p0,false)}" -match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); +var part1161 = match("MESSAGE#681:00055:06/1_0", "nwparser.p0", "eave %{p0}"); -var part1167 = // "Pattern{Constant('ast member query '), Field(p0,false)}" -match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); +var part1162 = match("MESSAGE#681:00055:06/1_1", "nwparser.p0", "ast member query %{p0}"); var select262 = linear_select([ - part1166, - part1167, + part1161, + part1162, ]); -var part1168 = // "Pattern{Constant('interval was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); +var part1163 = match("MESSAGE#681:00055:06/2", "nwparser.p0", "interval was changed to %{fld2->} on interface %{interface}."); -var all244 = all_match({ +var all239 = all_match({ processors: [ - part1165, + part1160, select262, - part1168, + part1163, ], on_success: processor_chain([ dup1, @@ -15332,31 +13840,27 @@ var all244 = all_match({ ]), }); -var msg691 = msg("00055:06", all244); +var msg691 = msg("00055:06", all239); -var part1169 = // "Pattern{Constant('routers '), Field(p0,false)}" -match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); +var part1164 = match("MESSAGE#682:00055:07/1_0", "nwparser.p0", "routers %{p0}"); -var part1170 = // "Pattern{Constant('hosts '), Field(p0,false)}" -match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); +var part1165 = match("MESSAGE#682:00055:07/1_1", "nwparser.p0", "hosts %{p0}"); -var part1171 = // "Pattern{Constant('groups '), Field(p0,false)}" -match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); +var part1166 = match("MESSAGE#682:00055:07/1_2", "nwparser.p0", "groups %{p0}"); var select263 = linear_select([ - part1169, - part1170, - part1171, + part1164, + part1165, + part1166, ]); -var part1172 = // "Pattern{Constant('accept list ID was changed to '), Field(fld2,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); +var part1167 = match("MESSAGE#682:00055:07/2", "nwparser.p0", "accept list ID was changed to %{fld2->} on interface %{interface}."); -var all245 = all_match({ +var all240 = all_match({ processors: [ - dup260, + dup258, select263, - part1172, + part1167, ], on_success: processor_chain([ dup1, @@ -15367,27 +13871,24 @@ var all245 = all_match({ ]), }); -var msg692 = msg("00055:07", all245); +var msg692 = msg("00055:07", all240); -var part1173 = // "Pattern{Constant('all groups '), Field(p0,false)}" -match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); +var part1168 = match("MESSAGE#683:00055:08/1_0", "nwparser.p0", "all groups %{p0}"); -var part1174 = // "Pattern{Constant('group '), Field(p0,false)}" -match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); +var part1169 = match("MESSAGE#683:00055:08/1_1", "nwparser.p0", "group %{p0}"); var select264 = linear_select([ - part1173, - part1174, + part1168, + part1169, ]); -var part1175 = // "Pattern{Constant(''), Field(group,true), Constant(' static flag was '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); +var part1170 = match("MESSAGE#683:00055:08/2", "nwparser.p0", "%{group->} static flag was %{disposition->} on interface %{interface}."); -var all246 = all_match({ +var all241 = all_match({ processors: [ - dup260, + dup258, select264, - part1175, + part1170, ], on_success: processor_chain([ dup1, @@ -15398,29 +13899,27 @@ var all246 = all_match({ ]), }); -var msg693 = msg("00055:08", all246); +var msg693 = msg("00055:08", all241); -var part1176 = // "Pattern{Constant('IGMP static group '), Field(group,true), Constant(' was added on interface '), Field(interface,false)}" -match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ - dup211, +var part1171 = match("MESSAGE#684:00055:09", "nwparser.payload", "IGMP static group %{group->} was added on interface %{interface}", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg694 = msg("00055:09", part1176); +var msg694 = msg("00055:09", part1171); -var part1177 = // "Pattern{Constant('IGMP proxy always is '), Field(disposition,true), Constant(' on interface '), Field(interface,false), Constant('.')}" -match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ - dup211, +var part1172 = match("MESSAGE#685:00055:10", "nwparser.payload", "IGMP proxy always is %{disposition->} on interface %{interface}.", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg695 = msg("00055:10", part1177); +var msg695 = msg("00055:10", part1172); var select265 = linear_select([ msg685, @@ -15436,8 +13935,7 @@ var select265 = linear_select([ msg695, ]); -var part1178 = // "Pattern{Constant('Remove multicast policy from '), Field(src_zone,true), Constant(' '), Field(saddr,true), Constant(' to '), Field(dst_zone,true), Constant(' '), Field(daddr,false)}" -match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ +var part1173 = match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{src_zone->} %{saddr->} to %{dst_zone->} %{daddr}", processor_chain([ dup1, dup2, dup3, @@ -15445,10 +13943,9 @@ match("MESSAGE#686:00056", "nwparser.payload", "Remove multicast policy from %{s dup5, ])); -var msg696 = msg("00056", part1178); +var msg696 = msg("00056", part1173); -var part1179 = // "Pattern{Field(fld2,false), Constant(': static multicast route src='), Field(saddr,false), Constant(', grp='), Field(group,true), Constant(' input ifp = '), Field(sinterface,true), Constant(' output ifp = '), Field(dinterface,true), Constant(' added')}" -match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ +var part1174 = match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route src=%{saddr}, grp=%{group->} input ifp = %{sinterface->} output ifp = %{dinterface->} added", processor_chain([ dup1, dup2, dup3, @@ -15456,10 +13953,9 @@ match("MESSAGE#687:00057", "nwparser.payload", "%{fld2}: static multicast route dup5, ])); -var msg697 = msg("00057", part1179); +var msg697 = msg("00057", part1174); -var part1180 = // "Pattern{Constant('PIMSM protocol configured on interface '), Field(interface,false)}" -match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ +var part1175 = match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on interface %{interface}", processor_chain([ dup19, dup2, dup3, @@ -15467,29 +13963,27 @@ match("MESSAGE#688:00058", "nwparser.payload", "PIMSM protocol configured on int dup5, ])); -var msg698 = msg("00058", part1180); +var msg698 = msg("00058", part1175); -var part1181 = // "Pattern{Constant('DDNS module is '), Field(p0,false)}" -match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); +var part1176 = match("MESSAGE#689:00059/0", "nwparser.payload", "DDNS module is %{p0}"); -var part1182 = // "Pattern{Constant('initialized '), Field(p0,false)}" -match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); +var part1177 = match("MESSAGE#689:00059/1_0", "nwparser.p0", "initialized %{p0}"); var select266 = linear_select([ - part1182, - dup264, + part1177, + dup262, dup157, dup156, ]); -var all247 = all_match({ +var all242 = all_match({ processors: [ - part1181, + part1176, select266, dup116, ], on_success: processor_chain([ - dup211, + dup209, dup2, dup3, dup4, @@ -15497,33 +13991,29 @@ var all247 = all_match({ ]), }); -var msg699 = msg("00059", all247); +var msg699 = msg("00059", all242); -var part1183 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with server type "'), Field(fld3,false), Constant('" name "'), Field(hostname,false), Constant('" refresh-interval '), Field(fld5,true), Constant(' hours minimum update interval '), Field(fld6,true), Constant(' minutes with '), Field(p0,false)}" -match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); +var part1178 = match("MESSAGE#690:00059:02/0", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with server type \"%{fld3}\" name \"%{hostname}\" refresh-interval %{fld5->} hours minimum update interval %{fld6->} minutes with %{p0}"); -var part1184 = // "Pattern{Constant('secure '), Field(p0,false)}" -match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); +var part1179 = match("MESSAGE#690:00059:02/1_0", "nwparser.p0", "secure %{p0}"); -var part1185 = // "Pattern{Constant('clear-text '), Field(p0,false)}" -match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); +var part1180 = match("MESSAGE#690:00059:02/1_1", "nwparser.p0", "clear-text %{p0}"); var select267 = linear_select([ - part1184, - part1185, + part1179, + part1180, ]); -var part1186 = // "Pattern{Constant('secure connection.'), Field(,false)}" -match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); +var part1181 = match("MESSAGE#690:00059:02/2", "nwparser.p0", "secure connection.%{}"); -var all248 = all_match({ +var all243 = all_match({ processors: [ - part1183, + part1178, select267, - part1186, + part1181, ], on_success: processor_chain([ - dup211, + dup209, dup2, dup3, dup4, @@ -15531,59 +14021,52 @@ var all248 = all_match({ ]), }); -var msg700 = msg("00059:02", all248); +var msg700 = msg("00059:02", all243); -var part1187 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with user name "'), Field(username,false), Constant('" agent "'), Field(fld3,false), Constant('"')}" -match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ - dup211, +var part1182 = match("MESSAGE#691:00059:03", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with user name \"%{username}\" agent \"%{fld3}\"", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg701 = msg("00059:03", part1187); +var msg701 = msg("00059:03", part1182); -var part1188 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is configured with interface "'), Field(interface,false), Constant('" host-name "'), Field(hostname,false), Constant('"')}" -match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ - dup211, +var part1183 = match("MESSAGE#692:00059:04", "nwparser.payload", "DDNS entry with id %{fld2->} is configured with interface \"%{interface}\" host-name \"%{hostname}\"", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg702 = msg("00059:04", part1188); +var msg702 = msg("00059:04", part1183); -var part1189 = // "Pattern{Constant('Hostname '), Field(p0,false)}" -match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); +var part1184 = match("MESSAGE#693:00059:05/0_0", "nwparser.payload", "Hostname %{p0}"); -var part1190 = // "Pattern{Constant('Source interface '), Field(p0,false)}" -match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); +var part1185 = match("MESSAGE#693:00059:05/0_1", "nwparser.payload", "Source interface %{p0}"); -var part1191 = // "Pattern{Constant('Username and password '), Field(p0,false)}" -match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); +var part1186 = match("MESSAGE#693:00059:05/0_2", "nwparser.payload", "Username and password %{p0}"); -var part1192 = // "Pattern{Constant('Server '), Field(p0,false)}" -match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); +var part1187 = match("MESSAGE#693:00059:05/0_3", "nwparser.payload", "Server %{p0}"); var select268 = linear_select([ - part1189, - part1190, - part1191, - part1192, + part1184, + part1185, + part1186, + part1187, ]); -var part1193 = // "Pattern{Constant('of DDNS entry with id '), Field(fld2,true), Constant(' is cleared.')}" -match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); +var part1188 = match("MESSAGE#693:00059:05/1", "nwparser.p0", "of DDNS entry with id %{fld2->} is cleared."); -var all249 = all_match({ +var all244 = all_match({ processors: [ select268, - part1193, + part1188, ], on_success: processor_chain([ - dup211, + dup209, dup2, dup3, dup4, @@ -15591,51 +14074,46 @@ var all249 = all_match({ ]), }); -var msg703 = msg("00059:05", all249); +var msg703 = msg("00059:05", all244); -var part1194 = // "Pattern{Constant('Agent of DDNS entry with id '), Field(fld2,true), Constant(' is reset to its default value.')}" -match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ - dup211, +var part1189 = match("MESSAGE#694:00059:06", "nwparser.payload", "Agent of DDNS entry with id %{fld2->} is reset to its default value.", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg704 = msg("00059:06", part1194); +var msg704 = msg("00059:06", part1189); -var part1195 = // "Pattern{Constant('Updates for DDNS entry with id '), Field(fld2,true), Constant(' are set to be sent in secure ('), Field(protocol,false), Constant(') mode.')}" -match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ - dup211, +var part1190 = match("MESSAGE#695:00059:07", "nwparser.payload", "Updates for DDNS entry with id %{fld2->} are set to be sent in secure (%{protocol}) mode.", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg705 = msg("00059:07", part1195); +var msg705 = msg("00059:07", part1190); -var part1196 = // "Pattern{Constant('Refresh '), Field(p0,false)}" -match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); +var part1191 = match("MESSAGE#696:00059:08/0_0", "nwparser.payload", "Refresh %{p0}"); -var part1197 = // "Pattern{Constant('Minimum update '), Field(p0,false)}" -match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); +var part1192 = match("MESSAGE#696:00059:08/0_1", "nwparser.payload", "Minimum update %{p0}"); var select269 = linear_select([ - part1196, - part1197, + part1191, + part1192, ]); -var part1198 = // "Pattern{Constant('interval of DDNS entry with id '), Field(fld2,true), Constant(' is set to default value ('), Field(fld3,false), Constant(').')}" -match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); +var part1193 = match("MESSAGE#696:00059:08/1", "nwparser.p0", "interval of DDNS entry with id %{fld2->} is set to default value (%{fld3})."); -var all250 = all_match({ +var all245 = all_match({ processors: [ select269, - part1198, + part1193, ], on_success: processor_chain([ - dup211, + dup209, dup2, dup3, dup4, @@ -15643,43 +14121,38 @@ var all250 = all_match({ ]), }); -var msg706 = msg("00059:08", all250); +var msg706 = msg("00059:08", all245); -var part1199 = // "Pattern{Constant('No-Change '), Field(p0,false)}" -match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); +var part1194 = match("MESSAGE#697:00059:09/1_0", "nwparser.p0", "No-Change %{p0}"); -var part1200 = // "Pattern{Constant('Error '), Field(p0,false)}" -match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); +var part1195 = match("MESSAGE#697:00059:09/1_1", "nwparser.p0", "Error %{p0}"); var select270 = linear_select([ - part1199, - part1200, + part1194, + part1195, ]); -var part1201 = // "Pattern{Constant('response received for DDNS entry update for id '), Field(fld2,true), Constant(' user "'), Field(username,false), Constant('" domain "'), Field(domain,false), Constant('" server type " d'), Field(p0,false)}" -match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); +var part1196 = match("MESSAGE#697:00059:09/2", "nwparser.p0", "response received for DDNS entry update for id %{fld2->} user \"%{username}\" domain \"%{domain}\" server type \" d%{p0}"); -var part1202 = // "Pattern{Constant('yndns '), Field(p0,false)}" -match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); +var part1197 = match("MESSAGE#697:00059:09/3_1", "nwparser.p0", "yndns %{p0}"); var select271 = linear_select([ - dup263, - part1202, + dup261, + part1197, ]); -var part1203 = // "Pattern{Constant('", server name "'), Field(hostname,false), Constant('"')}" -match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); +var part1198 = match("MESSAGE#697:00059:09/4", "nwparser.p0", "\", server name \"%{hostname}\""); -var all251 = all_match({ +var all246 = all_match({ processors: [ - dup162, + dup160, select270, - part1201, + part1196, select271, - part1203, + part1198, ], on_success: processor_chain([ - dup211, + dup209, dup2, dup3, dup4, @@ -15687,18 +14160,17 @@ var all251 = all_match({ ]), }); -var msg707 = msg("00059:09", all251); +var msg707 = msg("00059:09", all246); -var part1204 = // "Pattern{Constant('DDNS entry with id '), Field(fld2,true), Constant(' is '), Field(disposition,false), Constant('.')}" -match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ - dup211, +var part1199 = match("MESSAGE#698:00059:01", "nwparser.payload", "DDNS entry with id %{fld2->} is %{disposition}.", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg708 = msg("00059:01", part1204); +var msg708 = msg("00059:01", part1199); var select272 = linear_select([ msg699, @@ -15713,8 +14185,7 @@ var select272 = linear_select([ msg708, ]); -var part1205 = // "Pattern{Constant('Track IP IP address '), Field(hostip,true), Constant(' failed. ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ +var part1200 = match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip->} failed. (%{event_time_string})", processor_chain([ dup19, dup2, dup3, @@ -15723,10 +14194,9 @@ match("MESSAGE#699:00062:01", "nwparser.payload", "Track IP IP address %{hostip- setc("event_description","Track IP failed"), ])); -var msg709 = msg("00062:01", part1205); +var msg709 = msg("00062:01", part1200); -var part1206 = // "Pattern{Constant('Track IP failure reached threshold. ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ +var part1201 = match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached threshold. (%{event_time_string})", processor_chain([ dup19, dup2, dup3, @@ -15735,10 +14205,9 @@ match("MESSAGE#700:00062:02", "nwparser.payload", "Track IP failure reached thre setc("event_description","Track IP failure reached threshold"), ])); -var msg710 = msg("00062:02", part1206); +var msg710 = msg("00062:02", part1201); -var part1207 = // "Pattern{Constant('Track IP IP address '), Field(hostip,true), Constant(' succeeded. ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ +var part1202 = match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip->} succeeded. (%{event_time_string})", processor_chain([ dup44, dup2, dup3, @@ -15747,10 +14216,9 @@ match("MESSAGE#701:00062:03", "nwparser.payload", "Track IP IP address %{hostip- setc("event_description","Track IP succeeded"), ])); -var msg711 = msg("00062:03", part1207); +var msg711 = msg("00062:03", part1202); -var part1208 = // "Pattern{Constant('HA linkdown'), Field(,false)}" -match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ +var part1203 = match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain([ dup86, dup2, dup3, @@ -15758,7 +14226,7 @@ match("MESSAGE#702:00062", "nwparser.payload", "HA linkdown%{}", processor_chain dup5, ])); -var msg712 = msg("00062", part1208); +var msg712 = msg("00062", part1203); var select273 = linear_select([ msg709, @@ -15767,8 +14235,7 @@ var select273 = linear_select([ msg712, ]); -var part1209 = // "Pattern{Constant('nsrp track-ip ip '), Field(hostip,true), Constant(' '), Field(disposition,false), Constant('!')}" -match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ +var part1204 = match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{disposition}!", processor_chain([ dup86, dup2, dup3, @@ -15776,10 +14243,9 @@ match("MESSAGE#703:00063", "nwparser.payload", "nsrp track-ip ip %{hostip->} %{d dup5, ])); -var msg713 = msg("00063", part1209); +var msg713 = msg("00063", part1204); -var part1210 = // "Pattern{Constant('Can not create track-ip list'), Field(,false)}" -match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ +var part1205 = match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}", processor_chain([ dup86, dup2, dup3, @@ -15787,10 +14253,9 @@ match("MESSAGE#704:00064", "nwparser.payload", "Can not create track-ip list%{}" dup5, ])); -var msg714 = msg("00064", part1210); +var msg714 = msg("00064", part1205); -var part1211 = // "Pattern{Constant('track ip fail reaches threshold system may fail over!'), Field(,false)}" -match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ +var part1206 = match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches threshold system may fail over!%{}", processor_chain([ dup86, dup2, dup3, @@ -15798,10 +14263,9 @@ match("MESSAGE#705:00064:01", "nwparser.payload", "track ip fail reaches thresho dup5, ])); -var msg715 = msg("00064:01", part1211); +var msg715 = msg("00064:01", part1206); -var part1212 = // "Pattern{Constant('Anti-Spam is detached from policy ID '), Field(policy_id,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ +var part1207 = match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from policy ID %{policy_id}. (%{fld1})", processor_chain([ dup17, dup2, dup3, @@ -15810,7 +14274,7 @@ match("MESSAGE#706:00064:02", "nwparser.payload", "Anti-Spam is detached from po dup5, ])); -var msg716 = msg("00064:02", part1212); +var msg716 = msg("00064:02", part1207); var select274 = linear_select([ msg714, @@ -15818,27 +14282,24 @@ var select274 = linear_select([ msg716, ]); -var msg717 = msg("00070", dup414); +var msg717 = msg("00070", dup411); -var part1213 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state from '), Field(fld3,true), Constant(' to '), Field(p0,false)}" -match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); +var part1208 = match("MESSAGE#708:00070:01/2", "nwparser.p0", "%{}Device group %{group->} changed state from %{fld3->} to %{p0}"); -var part1214 = // "Pattern{Constant('Init'), Field(,false)}" -match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); +var part1209 = match("MESSAGE#708:00070:01/3_0", "nwparser.p0", "Init%{}"); -var part1215 = // "Pattern{Constant('init. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); +var part1210 = match("MESSAGE#708:00070:01/3_1", "nwparser.p0", "init. (%{fld1})"); var select275 = linear_select([ - part1214, - part1215, + part1209, + part1210, ]); -var all252 = all_match({ +var all247 = all_match({ processors: [ - dup269, - dup394, - part1213, + dup267, + dup391, + part1208, select275, ], on_success: processor_chain([ @@ -15851,10 +14312,9 @@ var all252 = all_match({ ]), }); -var msg718 = msg("00070:01", all252); +var msg718 = msg("00070:01", all247); -var part1216 = // "Pattern{Constant('NSRP: nsrp control channel change to '), Field(interface,false)}" -match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ +var part1211 = match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel change to %{interface}", processor_chain([ dup1, dup2, dup3, @@ -15862,7 +14322,7 @@ match("MESSAGE#709:00070:02", "nwparser.payload", "NSRP: nsrp control channel ch dup5, ])); -var msg719 = msg("00070:02", part1216); +var msg719 = msg("00070:02", part1211); var select276 = linear_select([ msg717, @@ -15870,10 +14330,9 @@ var select276 = linear_select([ msg719, ]); -var msg720 = msg("00071", dup414); +var msg720 = msg("00071", dup411); -var part1217 = // "Pattern{Constant('The local device '), Field(fld1,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed state')}" -match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ +var part1212 = match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in the Virtual Security Device group %{group->} changed state", processor_chain([ dup1, dup2, dup3, @@ -15881,38 +14340,38 @@ match("MESSAGE#711:00071:01", "nwparser.payload", "The local device %{fld1->} in dup5, ])); -var msg721 = msg("00071:01", part1217); +var msg721 = msg("00071:01", part1212); var select277 = linear_select([ msg720, msg721, ]); -var msg722 = msg("00072", dup414); +var msg722 = msg("00072", dup411); -var msg723 = msg("00072:01", dup415); +var msg723 = msg("00072:01", dup412); var select278 = linear_select([ msg722, msg723, ]); -var msg724 = msg("00073", dup414); +var msg724 = msg("00073", dup411); -var msg725 = msg("00073:01", dup415); +var msg725 = msg("00073:01", dup412); var select279 = linear_select([ msg724, msg725, ]); -var msg726 = msg("00074", dup395); +var msg726 = msg("00074", dup392); -var all253 = all_match({ +var all248 = all_match({ processors: [ - dup265, - dup393, - dup273, + dup263, + dup390, + dup271, ], on_success: processor_chain([ dup1, @@ -15923,10 +14382,9 @@ var all253 = all_match({ ]), }); -var msg727 = msg("00075", all253); +var msg727 = msg("00075", all248); -var part1218 = // "Pattern{Constant('The local device '), Field(hardware_id,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' changed state from '), Field(event_state,true), Constant(' to inoperable. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ +var part1213 = match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} changed state from %{event_state->} to inoperable. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -15936,10 +14394,9 @@ match("MESSAGE#718:00075:02", "nwparser.payload", "The local device %{hardware_i setc("event_description","local device in the Virtual Security Device group changed state to inoperable"), ])); -var msg728 = msg("00075:02", part1218); +var msg728 = msg("00075:02", part1213); -var part1219 = // "Pattern{Constant('The local device '), Field(hardware_id,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ +var part1214 = match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_id->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ dup1, dup2, dup3, @@ -15947,7 +14404,7 @@ match("MESSAGE#719:00075:01", "nwparser.payload", "The local device %{hardware_i dup5, ])); -var msg729 = msg("00075:01", part1219); +var msg729 = msg("00075:01", part1214); var select280 = linear_select([ msg727, @@ -15955,16 +14412,15 @@ var select280 = linear_select([ msg729, ]); -var msg730 = msg("00076", dup395); +var msg730 = msg("00076", dup392); -var part1220 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' send 2nd path request to unit='), Field(fld3,false)}" -match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); +var part1215 = match("MESSAGE#721:00076:01/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} send 2nd path request to unit=%{fld3}"); -var all254 = all_match({ +var all249 = all_match({ processors: [ - dup265, - dup393, - part1220, + dup263, + dup390, + part1215, ], on_success: processor_chain([ dup44, @@ -15975,15 +14431,14 @@ var all254 = all_match({ ]), }); -var msg731 = msg("00076:01", all254); +var msg731 = msg("00076:01", all249); var select281 = linear_select([ msg730, msg731, ]); -var part1221 = // "Pattern{Constant('HA link disconnect. Begin to use second path of HA'), Field(,false)}" -match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ +var part1216 = match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use second path of HA%{}", processor_chain([ dup144, dup2, dup3, @@ -15991,13 +14446,13 @@ match("MESSAGE#722:00077", "nwparser.payload", "HA link disconnect. Begin to use dup5, ])); -var msg732 = msg("00077", part1221); +var msg732 = msg("00077", part1216); -var all255 = all_match({ +var all250 = all_match({ processors: [ - dup265, - dup393, - dup273, + dup263, + dup390, + dup271, ], on_success: processor_chain([ dup44, @@ -16008,10 +14463,9 @@ var all255 = all_match({ ]), }); -var msg733 = msg("00077:01", all255); +var msg733 = msg("00077:01", all250); -var part1222 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,false)}" -match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ +var part1217 = match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group}", processor_chain([ setc("eventcategory","1607000000"), dup2, dup3, @@ -16019,7 +14473,7 @@ match("MESSAGE#724:00077:02", "nwparser.payload", "The local device %{fld2->} in dup5, ])); -var msg734 = msg("00077:02", part1222); +var msg734 = msg("00077:02", part1217); var select282 = linear_select([ msg732, @@ -16027,37 +14481,33 @@ var select282 = linear_select([ msg734, ]); -var part1223 = // "Pattern{Constant('RTSYNC: NSRP route synchronization is '), Field(disposition,false)}" -match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ - dup274, +var part1218 = match("MESSAGE#725:00084", "nwparser.payload", "RTSYNC: NSRP route synchronization is %{disposition}", processor_chain([ + dup272, dup2, dup3, dup4, dup5, ])); -var msg735 = msg("00084", part1223); +var msg735 = msg("00084", part1218); -var part1224 = // "Pattern{Constant('Failover '), Field(p0,false)}" -match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); +var part1219 = match("MESSAGE#726:00090/0_0", "nwparser.payload", "Failover %{p0}"); -var part1225 = // "Pattern{Constant('Recovery '), Field(p0,false)}" -match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); +var part1220 = match("MESSAGE#726:00090/0_1", "nwparser.payload", "Recovery %{p0}"); var select283 = linear_select([ - part1224, - part1225, + part1219, + part1220, ]); -var part1226 = // "Pattern{Constant('untrust interface occurred.'), Field(,false)}" -match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); +var part1221 = match("MESSAGE#726:00090/3", "nwparser.p0", "untrust interface occurred.%{}"); -var all256 = all_match({ +var all251 = all_match({ processors: [ select283, dup103, - dup372, - part1226, + dup369, + part1221, ], on_success: processor_chain([ dup44, @@ -16068,10 +14518,9 @@ var all256 = all_match({ ]), }); -var msg736 = msg("00090", all256); +var msg736 = msg("00090", all251); -var part1227 = // "Pattern{Constant('A new route cannot be added to the device because the maximum number of system route entries '), Field(fld2,true), Constant(' has been exceeded')}" -match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ +var part1222 = match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to the device because the maximum number of system route entries %{fld2->} has been exceeded", processor_chain([ dup117, dup2, dup3, @@ -16079,10 +14528,9 @@ match("MESSAGE#727:00200", "nwparser.payload", "A new route cannot be added to t dup5, ])); -var msg737 = msg("00200", part1227); +var msg737 = msg("00200", part1222); -var part1228 = // "Pattern{Constant('A route '), Field(hostip,false), Constant('/'), Field(fld2,true), Constant(' cannot be added to the virtual router '), Field(node,true), Constant(' because the number of route entries in the virtual router exceeds the maximum number of routes '), Field(fld3,true), Constant(' allowed')}" -match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ +var part1223 = match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cannot be added to the virtual router %{node->} because the number of route entries in the virtual router exceeds the maximum number of routes %{fld3->} allowed", processor_chain([ dup117, dup2, dup3, @@ -16090,55 +14538,49 @@ match("MESSAGE#728:00201", "nwparser.payload", "A route %{hostip}/%{fld2->} cann dup5, ])); -var msg738 = msg("00201", part1228); +var msg738 = msg("00201", part1223); -var part1229 = // "Pattern{Field(fld2,true), Constant(' hello-packet flood from neighbor (ip = '), Field(hostip,true), Constant(' router-id = '), Field(fld3,false), Constant(') on interface '), Field(interface,true), Constant(' packet is dropped')}" -match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ - dup274, +var part1224 = match("MESSAGE#729:00202", "nwparser.payload", "%{fld2->} hello-packet flood from neighbor (ip = %{hostip->} router-id = %{fld3}) on interface %{interface->} packet is dropped", processor_chain([ + dup272, dup2, dup4, dup5, dup3, ])); -var msg739 = msg("00202", part1229); +var msg739 = msg("00202", part1224); -var part1230 = // "Pattern{Field(fld2,true), Constant(' lsa flood on interface '), Field(interface,true), Constant(' has dropped a packet.')}" -match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ - dup274, +var part1225 = match("MESSAGE#730:00203", "nwparser.payload", "%{fld2->} lsa flood on interface %{interface->} has dropped a packet.", processor_chain([ + dup272, dup2, dup4, dup5, dup3, ])); -var msg740 = msg("00203", part1230); +var msg740 = msg("00203", part1225); -var part1231 = // "Pattern{Constant('The total number of redistributed routes into '), Field(p0,false)}" -match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); +var part1226 = match("MESSAGE#731:00206/0", "nwparser.payload", "The total number of redistributed routes into %{p0}"); -var part1232 = // "Pattern{Constant('BGP '), Field(p0,false)}" -match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); +var part1227 = match("MESSAGE#731:00206/1_0", "nwparser.p0", "BGP %{p0}"); -var part1233 = // "Pattern{Constant('OSPF '), Field(p0,false)}" -match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); +var part1228 = match("MESSAGE#731:00206/1_1", "nwparser.p0", "OSPF %{p0}"); var select284 = linear_select([ - part1232, - part1233, + part1227, + part1228, ]); -var part1234 = // "Pattern{Constant('in vrouter '), Field(node,true), Constant(' exceeded system limit ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); +var part1229 = match("MESSAGE#731:00206/2", "nwparser.p0", "in vrouter %{node->} exceeded system limit (%{fld2})"); -var all257 = all_match({ +var all252 = all_match({ processors: [ - part1231, + part1226, select284, - part1234, + part1229, ], on_success: processor_chain([ - dup274, + dup272, dup2, dup3, dup4, @@ -16146,22 +14588,20 @@ var all257 = all_match({ ]), }); -var msg741 = msg("00206", all257); +var msg741 = msg("00206", all252); -var part1235 = // "Pattern{Constant('LSA flood in OSPF with router-id '), Field(fld2,true), Constant(' on '), Field(p0,false)}" -match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); +var part1230 = match("MESSAGE#732:00206:01/0", "nwparser.payload", "LSA flood in OSPF with router-id %{fld2->} on %{p0}"); -var part1236 = // "Pattern{Constant(''), Field(interface,true), Constant(' forced the interface to drop a packet.')}" -match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); +var part1231 = match("MESSAGE#732:00206:01/2", "nwparser.p0", "%{interface->} forced the interface to drop a packet."); -var all258 = all_match({ +var all253 = all_match({ processors: [ - part1235, - dup354, - part1236, + part1230, + dup352, + part1231, ], on_success: processor_chain([ - dup275, + dup273, dup2, dup3, dup4, @@ -16169,22 +14609,20 @@ var all258 = all_match({ ]), }); -var msg742 = msg("00206:01", all258); +var msg742 = msg("00206:01", all253); -var part1237 = // "Pattern{Constant('OSPF instance with router-id '), Field(fld3,true), Constant(' received a Hello packet flood from neighbor (IP address '), Field(hostip,false), Constant(', router ID '), Field(fld2,false), Constant(') on '), Field(p0,false)}" -match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); +var part1232 = match("MESSAGE#733:00206:02/0", "nwparser.payload", "OSPF instance with router-id %{fld3->} received a Hello packet flood from neighbor (IP address %{hostip}, router ID %{fld2}) on %{p0}"); -var part1238 = // "Pattern{Constant(''), Field(interface,true), Constant(' forcing the interface to drop the packet.')}" -match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); +var part1233 = match("MESSAGE#733:00206:02/2", "nwparser.p0", "%{interface->} forcing the interface to drop the packet."); -var all259 = all_match({ +var all254 = all_match({ processors: [ - part1237, - dup354, - part1238, + part1232, + dup352, + part1233, ], on_success: processor_chain([ - dup275, + dup273, dup2, dup3, dup4, @@ -16192,29 +14630,27 @@ var all259 = all_match({ ]), }); -var msg743 = msg("00206:02", all259); +var msg743 = msg("00206:02", all254); -var part1239 = // "Pattern{Constant('Link State Advertisement Id '), Field(fld2,false), Constant(', router ID '), Field(fld3,false), Constant(', type '), Field(fld4,true), Constant(' cannot be deleted from the real-time database in area '), Field(fld5,false)}" -match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ - dup275, +var part1234 = match("MESSAGE#734:00206:03", "nwparser.payload", "Link State Advertisement Id %{fld2}, router ID %{fld3}, type %{fld4->} cannot be deleted from the real-time database in area %{fld5}", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg744 = msg("00206:03", part1239); +var msg744 = msg("00206:03", part1234); -var part1240 = // "Pattern{Constant('Reject second OSPF neighbor ('), Field(fld2,false), Constant(') on interface ('), Field(interface,false), Constant(') since it_s configured as point-to-point interface')}" -match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ - dup275, +var part1235 = match("MESSAGE#735:00206:04", "nwparser.payload", "Reject second OSPF neighbor (%{fld2}) on interface (%{interface}) since it_s configured as point-to-point interface", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg745 = msg("00206:04", part1240); +var msg745 = msg("00206:04", part1235); var select285 = linear_select([ msg741, @@ -16224,49 +14660,45 @@ var select285 = linear_select([ msg745, ]); -var part1241 = // "Pattern{Constant('System wide RIP route limit exceeded, RIP route dropped.'), Field(,false)}" -match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ - dup275, +var part1236 = match("MESSAGE#736:00207", "nwparser.payload", "System wide RIP route limit exceeded, RIP route dropped.%{}", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg746 = msg("00207", part1241); +var msg746 = msg("00207", part1236); -var part1242 = // "Pattern{Field(fld2,true), Constant(' RIP routes dropped from last system wide RIP route limit exceed.')}" -match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ - dup275, +var part1237 = match("MESSAGE#737:00207:01", "nwparser.payload", "%{fld2->} RIP routes dropped from last system wide RIP route limit exceed.", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg747 = msg("00207:01", part1242); +var msg747 = msg("00207:01", part1237); -var part1243 = // "Pattern{Constant('RIP database size limit exceeded for '), Field(fld2,false), Constant(', RIP route dropped.')}" -match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ - dup275, +var part1238 = match("MESSAGE#738:00207:02", "nwparser.payload", "RIP database size limit exceeded for %{fld2}, RIP route dropped.", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg748 = msg("00207:02", part1243); +var msg748 = msg("00207:02", part1238); -var part1244 = // "Pattern{Field(fld2,true), Constant(' RIP routes dropped from the last database size exceed in vr '), Field(fld3,false), Constant('.')}" -match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ - dup275, +var part1239 = match("MESSAGE#739:00207:03", "nwparser.payload", "%{fld2->} RIP routes dropped from the last database size exceed in vr %{fld3}.", processor_chain([ + dup273, dup2, dup3, dup4, dup5, ])); -var msg749 = msg("00207:03", part1244); +var msg749 = msg("00207:03", part1239); var select286 = linear_select([ msg746, @@ -16275,423 +14707,396 @@ var select286 = linear_select([ msg749, ]); -var part1245 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=outgoing action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" -match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup187, +var part1240 = match("MESSAGE#740:00257", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup61, dup276, dup277, - dup61, dup278, - dup279, - dup280, ])); -var msg750 = msg("00257", part1245); +var msg750 = msg("00257", part1240); -var part1246 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=incoming action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,false)}" -match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup187, +var part1241 = match("MESSAGE#741:00257:14", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup279, dup276, dup277, - dup281, - dup278, - dup279, - dup282, + dup280, ])); -var msg751 = msg("00257:14", part1246); +var msg751 = msg("00257:14", part1241); -var part1247 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=outgoing action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" -match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup283, +var part1242 = match("MESSAGE#742:00257:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=outgoing action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, - dup280, + dup282, + dup278, ])); -var msg752 = msg("00257:01", part1247); +var msg752 = msg("00257:01", part1242); -var part1248 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction=incoming action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' translated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,false)}" -match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ - dup283, +var part1243 = match("MESSAGE#743:00257:15", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=incoming action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} translated ip=%{dtransaddr->} port=%{dtransport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, - dup281, - dup284, + dup274, + dup275, + dup279, dup282, + dup280, ])); -var msg753 = msg("00257:15", part1248); +var msg753 = msg("00257:15", part1243); -var part1249 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var part1244 = match("MESSAGE#744:00257:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup61, dup276, dup277, - dup61, - dup278, - dup279, ])); -var msg754 = msg("00257:02", part1249); +var msg754 = msg("00257:02", part1244); -var part1250 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1245 = match("MESSAGE#745:00257:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, + dup282, ])); -var msg755 = msg("00257:03", part1250); +var msg755 = msg("00257:03", part1245); -var part1251 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,false)}" -match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ - dup187, +var part1246 = match("MESSAGE#746:00257:04", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport}", processor_chain([ + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup61, dup276, dup277, - dup61, - dup278, - dup279, ])); -var msg756 = msg("00257:04", part1251); +var msg756 = msg("00257:04", part1246); -var part1252 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" -match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ - dup283, +var part1247 = match("MESSAGE#747:00257:05", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid->} reason=%{result}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, + dup282, ])); -var msg757 = msg("00257:05", part1252); +var msg757 = msg("00257:05", part1247); -var part1253 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,true), Constant(' icmp code='), Field(icmpcode,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" -match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); +var part1248 = match("MESSAGE#748:00257:19/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} icmp code=%{icmpcode->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid->} reason=%{result}"); -var all260 = all_match({ +var all255 = all_match({ processors: [ - dup285, - dup396, - part1253, + dup283, + dup393, + part1248, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup60, - dup284, + dup282, ]), }); -var msg758 = msg("00257:19", all260); +var msg758 = msg("00257:19", all255); -var part1254 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); +var part1249 = match("MESSAGE#749:00257:16/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype->} src-xlated ip=%{stransaddr->} dst-xlated ip=%{dtransaddr->} session_id=%{sessionid}"); -var all261 = all_match({ +var all256 = all_match({ processors: [ - dup285, - dup396, - part1254, + dup283, + dup393, + part1249, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup60, - dup284, + dup282, ]), }); -var msg759 = msg("00257:16", all261); +var msg759 = msg("00257:16", all256); -var part1255 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' dst-xlated ip='), Field(dtransaddr,true), Constant(' port='), Field(dtransport,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); +var part1250 = match("MESSAGE#750:00257:17/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} dst-xlated ip=%{dtransaddr->} port=%{dtransport->} session_id=%{sessionid}"); -var all262 = all_match({ +var all257 = all_match({ processors: [ - dup285, - dup396, - part1255, + dup283, + dup393, + part1250, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, + dup282, ]), }); -var msg760 = msg("00257:17", all262); +var msg760 = msg("00257:17", all257); -var part1256 = // "Pattern{Field(,false), Constant('duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,true), Constant(' src-xlated ip='), Field(stransaddr,true), Constant(' port='), Field(stransport,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); +var part1251 = match("MESSAGE#751:00257:18/2", "nwparser.p0", "%{}duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport->} src-xlated ip=%{stransaddr->} port=%{stransport->} session_id=%{sessionid}"); -var all263 = all_match({ +var all258 = all_match({ processors: [ - dup285, - dup396, - part1256, + dup283, + dup393, + part1251, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, + dup282, ]), }); -var msg761 = msg("00257:18", all263); +var msg761 = msg("00257:18", all258); -var part1257 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(p0,false)}" -match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); +var part1252 = match("MESSAGE#752:00257:06/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{p0}"); -var part1258 = // "Pattern{Field(dport,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); +var part1253 = match("MESSAGE#752:00257:06/1_0", "nwparser.p0", "%{dport->} session_id=%{sessionid}"); -var part1259 = // "Pattern{Field(dport,false)}" -match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); +var part1254 = match_copy("MESSAGE#752:00257:06/1_1", "nwparser.p0", "dport"); var select287 = linear_select([ - part1258, - part1259, + part1253, + part1254, ]); -var all264 = all_match({ +var all259 = all_match({ processors: [ - part1257, + part1252, select287, ], on_success: processor_chain([ - dup187, + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup61, dup276, dup277, - dup61, - dup278, - dup279, ]), }); -var msg762 = msg("00257:06", all264); +var msg762 = msg("00257:06", all259); -var part1260 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1255 = match("MESSAGE#753:00257:07", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup61, - dup284, + dup282, ])); -var msg763 = msg("00257:07", part1260); +var msg763 = msg("00257:07", part1255); -var part1261 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' tcp='), Field(icmptype,false)}" -match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ - dup187, +var part1256 = match("MESSAGE#754:00257:08", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} tcp=%{icmptype}", processor_chain([ + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup60, dup276, dup277, - dup60, - dup278, - dup279, ])); -var msg764 = msg("00257:08", part1261); +var msg764 = msg("00257:08", part1256); -var part1262 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(p0,false)}" -match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); +var part1257 = match("MESSAGE#755:00257:09/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{p0}"); -var part1263 = // "Pattern{Field(icmptype,true), Constant(' icmp code='), Field(icmpcode,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" -match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); +var part1258 = match("MESSAGE#755:00257:09/1_0", "nwparser.p0", "%{icmptype->} icmp code=%{icmpcode->} session_id=%{sessionid->} reason=%{result}"); -var part1264 = // "Pattern{Field(icmptype,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); +var part1259 = match("MESSAGE#755:00257:09/1_1", "nwparser.p0", "%{icmptype->} session_id=%{sessionid}"); -var part1265 = // "Pattern{Field(icmptype,false)}" -match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); +var part1260 = match_copy("MESSAGE#755:00257:09/1_2", "nwparser.p0", "icmptype"); var select288 = linear_select([ - part1263, - part1264, - part1265, + part1258, + part1259, + part1260, ]); -var all265 = all_match({ +var all260 = all_match({ processors: [ - part1262, + part1257, select288, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup60, - dup284, + dup282, ]), }); -var msg765 = msg("00257:09", all265); +var msg765 = msg("00257:09", all260); -var part1266 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(p0,false)}" -match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); +var part1261 = match("MESSAGE#756:00257:10/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); -var part1267 = // "Pattern{Field(daddr,true), Constant(' session_id='), Field(sessionid,false)}" -match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); +var part1262 = match("MESSAGE#756:00257:10/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid}"); var select289 = linear_select([ - part1267, - dup288, + part1262, + dup286, ]); -var all266 = all_match({ +var all261 = all_match({ processors: [ - part1266, + part1261, select289, ], on_success: processor_chain([ - dup187, + dup185, dup2, dup4, dup5, dup3, + dup274, + dup275, + dup60, dup276, dup277, - dup60, - dup278, - dup279, ]), }); -var msg766 = msg("00257:10", all266); +var msg766 = msg("00257:10", all261); -var part1268 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(p0,false)}" -match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); +var part1263 = match("MESSAGE#757:00257:11/0", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{p0}"); -var part1269 = // "Pattern{Field(daddr,true), Constant(' session_id='), Field(sessionid,true), Constant(' reason='), Field(result,false)}" -match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); +var part1264 = match("MESSAGE#757:00257:11/1_0", "nwparser.p0", "%{daddr->} session_id=%{sessionid->} reason=%{result}"); var select290 = linear_select([ - part1269, - dup288, + part1264, + dup286, ]); -var all267 = all_match({ +var all262 = all_match({ processors: [ - part1268, + part1263, select290, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup60, - dup284, + dup282, ]), }); -var msg767 = msg("00257:11", all267); +var msg767 = msg("00257:11", all262); -var part1270 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' type='), Field(fld3,false)}" -match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ - dup283, +var part1265 = match("MESSAGE#758:00257:12", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} type=%{fld3}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, - dup276, - dup277, + dup274, + dup275, dup60, - dup284, + dup282, ])); -var msg768 = msg("00257:12", part1270); +var msg768 = msg("00257:12", part1265); -var part1271 = // "Pattern{Constant('start_time="'), Field(fld2,false)}" -match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ - dup283, +var part1266 = match("MESSAGE#759:00257:13", "nwparser.payload", "start_time=\"%{fld2}", processor_chain([ + dup281, dup2, dup3, - dup276, + dup274, dup4, dup5, ])); -var msg769 = msg("00257:13", part1271); +var msg769 = msg("00257:13", part1266); var select291 = linear_select([ msg750, @@ -16716,27 +15121,24 @@ var select291 = linear_select([ msg769, ]); -var part1272 = // "Pattern{Constant('user '), Field(username,true), Constant(' has logged on via '), Field(p0,false)}" -match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); +var part1267 = match("MESSAGE#760:00259/1", "nwparser.p0", "user %{username->} has logged on via %{p0}"); -var part1273 = // "Pattern{Constant('the console '), Field(p0,false)}" -match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); +var part1268 = match("MESSAGE#760:00259/2_0", "nwparser.p0", "the console %{p0}"); var select292 = linear_select([ - part1273, - dup291, - dup243, + part1268, + dup289, + dup241, ]); -var part1274 = // "Pattern{Constant('from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); +var part1269 = match("MESSAGE#760:00259/3", "nwparser.p0", "from %{saddr}:%{sport}"); -var all268 = all_match({ +var all263 = all_match({ processors: [ - dup397, - part1272, + dup394, + part1267, select292, - part1274, + part1269, ], on_success: processor_chain([ dup28, @@ -16751,15 +15153,14 @@ var all268 = all_match({ ]), }); -var msg770 = msg("00259", all268); +var msg770 = msg("00259", all263); -var part1275 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' has logged out via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); +var part1270 = match("MESSAGE#761:00259:07/1", "nwparser.p0", "user %{administrator->} has logged out via %{logon_type->} from %{saddr}:%{sport}"); -var all269 = all_match({ +var all264 = all_match({ processors: [ - dup397, - part1275, + dup394, + part1270, ], on_success: processor_chain([ dup33, @@ -16772,33 +15173,30 @@ var all269 = all_match({ ]), }); -var msg771 = msg("00259:07", all269); +var msg771 = msg("00259:07", all264); -var part1276 = // "Pattern{Constant('Management session via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for [vsys] admin '), Field(administrator,true), Constant(' has timed out')}" -match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ - dup292, +var part1271 = match("MESSAGE#762:00259:01", "nwparser.payload", "Management session via %{logon_type->} from %{saddr}:%{sport->} for [vsys] admin %{administrator->} has timed out", processor_chain([ + dup290, dup2, dup3, dup4, dup5, ])); -var msg772 = msg("00259:01", part1276); +var msg772 = msg("00259:01", part1271); -var part1277 = // "Pattern{Constant('Management session via '), Field(logon_type,true), Constant(' for [ vsys ] admin '), Field(administrator,true), Constant(' has timed out')}" -match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ - dup292, +var part1272 = match("MESSAGE#763:00259:02", "nwparser.payload", "Management session via %{logon_type->} for [ vsys ] admin %{administrator->} has timed out", processor_chain([ + dup290, dup2, dup3, dup4, dup5, ])); -var msg773 = msg("00259:02", part1277); +var msg773 = msg("00259:02", part1272); -var part1278 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via the '), Field(logon_type,true), Constant(' has failed')}" -match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ - dup208, +var part1273 = match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by admin %{administrator->} via the %{logon_type->} has failed", processor_chain([ + dup206, dup29, dup30, dup31, @@ -16809,11 +15207,10 @@ match("MESSAGE#764:00259:03", "nwparser.payload", "Login attempt to system by ad dup5, ])); -var msg774 = msg("00259:03", part1278); +var msg774 = msg("00259:03", part1273); -var part1279 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has failed')}" -match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ - dup208, +var part1274 = match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{logon_type->} from %{saddr}:%{sport->} has failed", processor_chain([ + dup206, dup29, dup30, dup31, @@ -16824,31 +15221,28 @@ match("MESSAGE#765:00259:04", "nwparser.payload", "Login attempt to system by ad dup5, ])); -var msg775 = msg("00259:04", part1279); +var msg775 = msg("00259:04", part1274); -var part1280 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log out of the '), Field(p0,false)}" -match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); +var part1275 = match("MESSAGE#766:00259:05/0", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the %{p0}"); -var part1281 = // "Pattern{Constant('Web '), Field(p0,false)}" -match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); +var part1276 = match("MESSAGE#766:00259:05/1_2", "nwparser.p0", "Web %{p0}"); var select293 = linear_select([ - dup243, - dup291, - part1281, + dup241, + dup289, + part1276, ]); -var part1282 = // "Pattern{Constant('session on host '), Field(daddr,false), Constant(':'), Field(dport,false)}" -match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); +var part1277 = match("MESSAGE#766:00259:05/2", "nwparser.p0", "session on host %{daddr}:%{dport}"); -var all270 = all_match({ +var all265 = all_match({ processors: [ - part1280, + part1275, select293, - part1282, + part1277, ], on_success: processor_chain([ - dup292, + dup290, dup2, dup3, dup4, @@ -16856,18 +15250,17 @@ var all270 = all_match({ ]), }); -var msg776 = msg("00259:05", all270); +var msg776 = msg("00259:05", all265); -var part1283 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log out of the serial console session.')}" -match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ - dup292, +var part1278 = match("MESSAGE#767:00259:06", "nwparser.payload", "Admin user %{administrator->} has been forced to log out of the serial console session.", processor_chain([ + dup290, dup2, dup3, dup4, dup5, ])); -var msg777 = msg("00259:06", part1283); +var msg777 = msg("00259:06", part1278); var select294 = linear_select([ msg770, @@ -16880,19 +15273,17 @@ var select294 = linear_select([ msg777, ]); -var part1284 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been rejected via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ - dup292, +var part1279 = match("MESSAGE#768:00262", "nwparser.payload", "Admin user %{administrator->} has been rejected via the %{logon_type->} server at %{hostip}", processor_chain([ + dup290, dup2, dup3, dup4, dup5, ])); -var msg778 = msg("00262", part1284); +var msg778 = msg("00262", part1279); -var part1285 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been accepted via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ +var part1280 = match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} has been accepted via the %{logon_type->} server at %{hostip}", processor_chain([ setc("eventcategory","1401050100"), dup2, dup3, @@ -16900,34 +15291,29 @@ match("MESSAGE#769:00263", "nwparser.payload", "Admin user %{administrator->} ha dup5, ])); -var msg779 = msg("00263", part1285); +var msg779 = msg("00263", part1280); -var part1286 = // "Pattern{Constant('ActiveX control '), Field(p0,false)}" -match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); +var part1281 = match("MESSAGE#770:00400/0_0", "nwparser.payload", "ActiveX control %{p0}"); -var part1287 = // "Pattern{Constant('JAVA applet '), Field(p0,false)}" -match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); +var part1282 = match("MESSAGE#770:00400/0_1", "nwparser.payload", "JAVA applet %{p0}"); -var part1288 = // "Pattern{Constant('EXE file '), Field(p0,false)}" -match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); +var part1283 = match("MESSAGE#770:00400/0_2", "nwparser.payload", "EXE file %{p0}"); -var part1289 = // "Pattern{Constant('ZIP file '), Field(p0,false)}" -match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); +var part1284 = match("MESSAGE#770:00400/0_3", "nwparser.payload", "ZIP file %{p0}"); var select295 = linear_select([ - part1286, - part1287, - part1288, - part1289, + part1281, + part1282, + part1283, + part1284, ]); -var part1290 = // "Pattern{Constant('has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('. '), Field(info,false)}" -match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); +var part1285 = match("MESSAGE#770:00400/1", "nwparser.p0", "has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{dinterface->} in zone %{dst_zone}. %{info}"); -var all271 = all_match({ +var all266 = all_match({ processors: [ select295, - part1290, + part1285, ], on_success: processor_chain([ setc("eventcategory","1003000000"), @@ -16939,43 +15325,39 @@ var all271 = all_match({ ]), }); -var msg780 = msg("00400", all271); +var msg780 = msg("00400", all266); -var part1291 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" -match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ +var part1286 = match("MESSAGE#771:00401", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ dup85, dup2, dup4, dup5, dup3, - dup293, + dup291, ])); -var msg781 = msg("00401", part1291); +var msg781 = msg("00401", part1286); -var part1292 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" -match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ +var part1287 = match("MESSAGE#772:00402", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ dup85, dup2, dup4, dup5, dup3, - dup294, + dup292, ])); -var msg782 = msg("00402", part1292); +var msg782 = msg("00402", part1287); -var part1293 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at '), Field(p0,false)}" -match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); +var part1288 = match("MESSAGE#773:00402:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at %{p0}"); -var part1294 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' in zone '), Field(zone,false), Constant('. '), Field(info,false)}" -match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); +var part1289 = match("MESSAGE#773:00402:01/2", "nwparser.p0", "%{} %{interface->} in zone %{zone}. %{info}"); -var all272 = all_match({ +var all267 = all_match({ processors: [ - part1293, - dup339, - part1294, + part1288, + dup337, + part1289, ], on_success: processor_chain([ dup85, @@ -16983,31 +15365,29 @@ var all272 = all_match({ dup4, dup5, dup3, - dup294, + dup292, ]), }); -var msg783 = msg("00402:01", all272); +var msg783 = msg("00402:01", all267); var select296 = linear_select([ msg782, msg783, ]); -var part1295 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" -match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ +var part1290 = match("MESSAGE#774:00403", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ dup85, dup2, dup4, dup5, dup3, - dup293, + dup291, ])); -var msg784 = msg("00403", part1295); +var msg784 = msg("00403", part1290); -var part1296 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" -match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ +var part1291 = match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ dup147, dup148, dup149, @@ -17016,34 +15396,33 @@ match("MESSAGE#775:00404", "nwparser.payload", "%{signame}! From %{saddr}:%{spor dup4, dup5, dup3, - dup294, + dup292, ])); -var msg785 = msg("00404", part1296); +var msg785 = msg("00404", part1291); -var part1297 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). '), Field(info,false)}" -match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ +var part1292 = match("MESSAGE#776:00405", "nwparser.payload", "%{signame}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). %{info}", processor_chain([ dup147, dup2, dup4, dup5, dup3, - dup293, + dup291, ])); -var msg786 = msg("00405", part1297); +var msg786 = msg("00405", part1292); -var msg787 = msg("00406", dup416); +var msg787 = msg("00406", dup413); -var msg788 = msg("00407", dup416); +var msg788 = msg("00407", dup413); -var msg789 = msg("00408", dup416); +var msg789 = msg("00408", dup413); -var all273 = all_match({ +var all268 = all_match({ processors: [ dup132, - dup345, - dup295, + dup343, + dup293, ], on_success: processor_chain([ dup58, @@ -17056,12 +15435,11 @@ var all273 = all_match({ ]), }); -var msg790 = msg("00409", all273); +var msg790 = msg("00409", all268); -var msg791 = msg("00410", dup416); +var msg791 = msg("00410", dup413); -var part1298 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part1293 = match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup3, @@ -17071,21 +15449,20 @@ match("MESSAGE#782:00410:01", "nwparser.payload", "%{signame->} From %{saddr->} dup60, ])); -var msg792 = msg("00410:01", part1298); +var msg792 = msg("00410:01", part1293); var select297 = linear_select([ msg791, msg792, ]); -var part1299 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto TCP (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); +var part1294 = match("MESSAGE#783:00411/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto TCP (zone %{zone->} %{p0}"); -var all274 = all_match({ +var all269 = all_match({ processors: [ - part1299, - dup345, - dup295, + part1294, + dup343, + dup293, ], on_success: processor_chain([ dup58, @@ -17098,19 +15475,17 @@ var all274 = all_match({ ]), }); -var msg793 = msg("00411", all274); +var msg793 = msg("00411", all269); -var part1300 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at '), Field(p0,false)}" -match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); +var part1295 = match("MESSAGE#784:00413/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at %{p0}"); -var part1301 = // "Pattern{Field(,true), Constant(' '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); +var part1296 = match("MESSAGE#784:00413/2", "nwparser.p0", "%{} %{interface}.%{space}The attack occurred %{dclass_counter1->} times"); -var all275 = all_match({ +var all270 = all_match({ processors: [ - part1300, - dup339, - part1301, + part1295, + dup337, + part1296, ], on_success: processor_chain([ dup58, @@ -17123,15 +15498,14 @@ var all275 = all_match({ ]), }); -var msg794 = msg("00413", all275); +var msg794 = msg("00413", all270); -var part1302 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,false), Constant('(zone '), Field(group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); +var part1297 = match("MESSAGE#785:00413:01/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}(zone %{group->} %{p0}"); -var all276 = all_match({ +var all271 = all_match({ processors: [ - part1302, - dup345, + part1297, + dup343, dup83, ], on_success: processor_chain([ @@ -17146,10 +15520,9 @@ var all276 = all_match({ ]), }); -var msg795 = msg("00413:01", all276); +var msg795 = msg("00413:01", all271); -var part1303 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1298 = match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -17159,7 +15532,7 @@ match("MESSAGE#786:00413:02", "nwparser.payload", "%{signame->} From %{saddr}:%{ dup9, ])); -var msg796 = msg("00413:02", part1303); +var msg796 = msg("00413:02", part1298); var select298 = linear_select([ msg794, @@ -17167,8 +15540,7 @@ var select298 = linear_select([ msg796, ]); -var part1304 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant(', int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1299 = match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}, int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup59, @@ -17178,10 +15550,9 @@ match("MESSAGE#787:00414", "nwparser.payload", "%{signame->} From %{saddr->} to dup9, ])); -var msg797 = msg("00414", part1304); +var msg797 = msg("00414", part1299); -var part1305 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1300 = match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup3, @@ -17191,15 +15562,14 @@ match("MESSAGE#788:00414:01", "nwparser.payload", "%{signame->} From %{saddr->} dup9, ])); -var msg798 = msg("00414:01", part1305); +var msg798 = msg("00414:01", part1300); var select299 = linear_select([ msg797, msg798, ]); -var part1306 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part1301 = match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup59, @@ -17209,13 +15579,13 @@ match("MESSAGE#789:00415", "nwparser.payload", "%{signame->} From %{saddr}:%{spo dup61, ])); -var msg799 = msg("00415", part1306); +var msg799 = msg("00415", part1301); -var all277 = all_match({ +var all272 = all_match({ processors: [ dup132, - dup345, - dup296, + dup343, + dup294, ], on_success: processor_chain([ dup58, @@ -17228,12 +15598,12 @@ var all277 = all_match({ ]), }); -var msg800 = msg("00423", all277); +var msg800 = msg("00423", all272); -var all278 = all_match({ +var all273 = all_match({ processors: [ dup80, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -17248,12 +15618,12 @@ var all278 = all_match({ ]), }); -var msg801 = msg("00429", all278); +var msg801 = msg("00429", all273); -var all279 = all_match({ +var all274 = all_match({ processors: [ dup132, - dup345, + dup343, dup83, ], on_success: processor_chain([ @@ -17268,19 +15638,19 @@ var all279 = all_match({ ]), }); -var msg802 = msg("00429:01", all279); +var msg802 = msg("00429:01", all274); var select300 = linear_select([ msg801, msg802, ]); -var all280 = all_match({ +var all275 = all_match({ processors: [ dup80, - dup345, - dup297, - dup353, + dup343, + dup295, + dup351, ], on_success: processor_chain([ dup85, @@ -17294,14 +15664,14 @@ var all280 = all_match({ ]), }); -var msg803 = msg("00430", all280); +var msg803 = msg("00430", all275); -var all281 = all_match({ +var all276 = all_match({ processors: [ dup132, - dup345, - dup297, - dup353, + dup343, + dup295, + dup351, ], on_success: processor_chain([ dup85, @@ -17315,28 +15685,28 @@ var all281 = all_match({ ]), }); -var msg804 = msg("00430:01", all281); +var msg804 = msg("00430:01", all276); var select301 = linear_select([ msg803, msg804, ]); -var msg805 = msg("00431", dup417); +var msg805 = msg("00431", dup414); -var msg806 = msg("00432", dup417); +var msg806 = msg("00432", dup414); -var msg807 = msg("00433", dup418); +var msg807 = msg("00433", dup415); -var msg808 = msg("00434", dup418); +var msg808 = msg("00434", dup415); -var msg809 = msg("00435", dup398); +var msg809 = msg("00435", dup395); -var all282 = all_match({ +var all277 = all_match({ processors: [ dup132, - dup345, - dup296, + dup343, + dup294, ], on_success: processor_chain([ dup58, @@ -17349,19 +15719,19 @@ var all282 = all_match({ ]), }); -var msg810 = msg("00435:01", all282); +var msg810 = msg("00435:01", all277); var select302 = linear_select([ msg809, msg810, ]); -var msg811 = msg("00436", dup398); +var msg811 = msg("00436", dup395); -var all283 = all_match({ +var all278 = all_match({ processors: [ dup64, - dup340, + dup338, dup67, ], on_success: processor_chain([ @@ -17376,15 +15746,14 @@ var all283 = all_match({ ]), }); -var msg812 = msg("00436:01", all283); +var msg812 = msg("00436:01", all278); var select303 = linear_select([ msg811, msg812, ]); -var part1307 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part1302 = match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup59, @@ -17394,12 +15763,12 @@ match("MESSAGE#803:00437", "nwparser.payload", "%{signame->} has been detected! dup61, ])); -var msg813 = msg("00437", part1307); +var msg813 = msg("00437", part1302); -var all284 = all_match({ +var all279 = all_match({ processors: [ - dup301, - dup340, + dup299, + dup338, dup67, ], on_success: processor_chain([ @@ -17414,10 +15783,9 @@ var all284 = all_match({ ]), }); -var msg814 = msg("00437:01", all284); +var msg814 = msg("00437:01", all279); -var part1308 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1303 = match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup59, @@ -17428,7 +15796,7 @@ match("MESSAGE#805:00437:02", "nwparser.payload", "%{signame->} From %{saddr}:%{ dup9, ])); -var msg815 = msg("00437:02", part1308); +var msg815 = msg("00437:02", part1303); var select304 = linear_select([ msg813, @@ -17436,8 +15804,7 @@ var select304 = linear_select([ msg815, ]); -var part1309 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' using protocol '), Field(protocol,true), Constant(' and arriving at interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times')}" -match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ +var part1304 = match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport->} using protocol %{protocol->} and arriving at interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times", processor_chain([ dup58, dup2, dup59, @@ -17447,10 +15814,9 @@ match("MESSAGE#806:00438", "nwparser.payload", "%{signame->} has been detected! dup61, ])); -var msg816 = msg("00438", part1309); +var msg816 = msg("00438", part1304); -var part1310 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', on zone '), Field(zone,true), Constant(' interface '), Field(interface,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part1305 = match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, on zone %{zone->} interface %{interface}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup59, @@ -17460,12 +15826,12 @@ match("MESSAGE#807:00438:01", "nwparser.payload", "%{signame->} From %{saddr}:%{ dup61, ])); -var msg817 = msg("00438:01", part1310); +var msg817 = msg("00438:01", part1305); -var all285 = all_match({ +var all280 = all_match({ processors: [ - dup301, - dup340, + dup299, + dup338, dup67, ], on_success: processor_chain([ @@ -17480,7 +15846,7 @@ var all285 = all_match({ ]), }); -var msg818 = msg("00438:02", all285); +var msg818 = msg("00438:02", all280); var select305 = linear_select([ msg816, @@ -17488,8 +15854,7 @@ var select305 = linear_select([ msg818, ]); -var part1311 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1306 = match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup59, @@ -17500,10 +15865,9 @@ match("MESSAGE#809:00440", "nwparser.payload", "%{signame->} has been detected! dup60, ])); -var msg819 = msg("00440", part1311); +var msg819 = msg("00440", part1306); -var part1312 = // "Pattern{Field(signame,true), Constant(' has been detected! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part1307 = match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detected! From %{saddr}:%{sport->} to %{daddr}:%{dport}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup59, @@ -17513,12 +15877,12 @@ match("MESSAGE#810:00440:02", "nwparser.payload", "%{signame->} has been detecte dup61, ])); -var msg820 = msg("00440:02", part1312); +var msg820 = msg("00440:02", part1307); -var all286 = all_match({ +var all281 = all_match({ processors: [ - dup241, - dup345, + dup239, + dup343, dup83, ], on_success: processor_chain([ @@ -17533,15 +15897,14 @@ var all286 = all_match({ ]), }); -var msg821 = msg("00440:01", all286); +var msg821 = msg("00440:01", all281); -var part1313 = // "Pattern{Constant('Fragmented traffic! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); +var part1308 = match("MESSAGE#812:00440:03/0", "nwparser.payload", "Fragmented traffic! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{group->} %{p0}"); -var all287 = all_match({ +var all282 = all_match({ processors: [ - part1313, - dup345, + part1308, + dup343, dup83, ], on_success: processor_chain([ @@ -17556,7 +15919,7 @@ var all287 = all_match({ ]), }); -var msg822 = msg("00440:03", all287); +var msg822 = msg("00440:03", all282); var select306 = linear_select([ msg819, @@ -17565,8 +15928,7 @@ var select306 = linear_select([ msg822, ]); -var part1314 = // "Pattern{Field(signame,true), Constant(' id='), Field(fld2,false), Constant('! From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1309 = match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup4, dup59, @@ -17577,14 +15939,13 @@ match("MESSAGE#813:00441", "nwparser.payload", "%{signame->} id=%{fld2}! From %{ dup60, ])); -var msg823 = msg("00441", part1314); +var msg823 = msg("00441", part1309); -var msg824 = msg("00442", dup399); +var msg824 = msg("00442", dup396); -var msg825 = msg("00443", dup399); +var msg825 = msg("00443", dup396); -var part1315 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' issued command '), Field(fld2,true), Constant(' to redirect output.')}" -match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ +var part1310 = match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued command %{fld2->} to redirect output.", processor_chain([ dup1, dup2, dup3, @@ -17592,15 +15953,14 @@ match("MESSAGE#816:00511", "nwparser.payload", "admin %{administrator->} issued dup5, ])); -var msg826 = msg("00511", part1315); +var msg826 = msg("00511", part1310); -var part1316 = // "Pattern{Constant('All System Config saved by admin '), Field(p0,false)}" -match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); +var part1311 = match("MESSAGE#817:00511:01/0", "nwparser.payload", "All System Config saved by admin %{p0}"); -var all288 = all_match({ +var all283 = all_match({ processors: [ - part1316, - dup400, + part1311, + dup397, ], on_success: processor_chain([ dup1, @@ -17612,10 +15972,9 @@ var all288 = all_match({ ]), }); -var msg827 = msg("00511:01", all288); +var msg827 = msg("00511:01", all283); -var part1317 = // "Pattern{Constant('All logged events or alarms are cleared by admin '), Field(administrator,false), Constant('.')}" -match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ +var part1312 = match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms are cleared by admin %{administrator}.", processor_chain([ dup1, dup2, dup3, @@ -17623,15 +15982,14 @@ match("MESSAGE#818:00511:02", "nwparser.payload", "All logged events or alarms a dup5, ])); -var msg828 = msg("00511:02", part1317); +var msg828 = msg("00511:02", part1312); -var part1318 = // "Pattern{Constant('Get new software from flash to slot (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" -match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); +var part1313 = match("MESSAGE#819:00511:03/0", "nwparser.payload", "Get new software from flash to slot (file: %{fld2}) by admin %{p0}"); -var all289 = all_match({ +var all284 = all_match({ processors: [ - part1318, - dup400, + part1313, + dup397, ], on_success: processor_chain([ dup1, @@ -17643,15 +16001,14 @@ var all289 = all_match({ ]), }); -var msg829 = msg("00511:03", all289); +var msg829 = msg("00511:03", all284); -var part1319 = // "Pattern{Constant('Get new software from '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') to slot (file: '), Field(fld3,false), Constant(') by admin '), Field(p0,false)}" -match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); +var part1314 = match("MESSAGE#820:00511:04/0", "nwparser.payload", "Get new software from %{hostip->} (file: %{fld2}) to slot (file: %{fld3}) by admin %{p0}"); -var all290 = all_match({ +var all285 = all_match({ processors: [ - part1319, - dup400, + part1314, + dup397, ], on_success: processor_chain([ dup1, @@ -17663,15 +16020,14 @@ var all290 = all_match({ ]), }); -var msg830 = msg("00511:04", all290); +var msg830 = msg("00511:04", all285); -var part1320 = // "Pattern{Constant('Get new software to '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" -match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); +var part1315 = match("MESSAGE#821:00511:05/0", "nwparser.payload", "Get new software to %{hostip->} (file: %{fld2}) by admin %{p0}"); -var all291 = all_match({ +var all286 = all_match({ processors: [ - part1320, - dup400, + part1315, + dup397, ], on_success: processor_chain([ dup1, @@ -17683,15 +16039,14 @@ var all291 = all_match({ ]), }); -var msg831 = msg("00511:05", all291); +var msg831 = msg("00511:05", all286); -var part1321 = // "Pattern{Constant('Log setting is modified by admin '), Field(p0,false)}" -match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); +var part1316 = match("MESSAGE#822:00511:06/0", "nwparser.payload", "Log setting is modified by admin %{p0}"); -var all292 = all_match({ +var all287 = all_match({ processors: [ - part1321, - dup400, + part1316, + dup397, ], on_success: processor_chain([ dup1, @@ -17703,15 +16058,14 @@ var all292 = all_match({ ]), }); -var msg832 = msg("00511:06", all292); +var msg832 = msg("00511:06", all287); -var part1322 = // "Pattern{Constant('Save configuration to '), Field(hostip,true), Constant(' (file: '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" -match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); +var part1317 = match("MESSAGE#823:00511:07/0", "nwparser.payload", "Save configuration to %{hostip->} (file: %{fld2}) by admin %{p0}"); -var all293 = all_match({ +var all288 = all_match({ processors: [ - part1322, - dup400, + part1317, + dup397, ], on_success: processor_chain([ dup1, @@ -17723,15 +16077,14 @@ var all293 = all_match({ ]), }); -var msg833 = msg("00511:07", all293); +var msg833 = msg("00511:07", all288); -var part1323 = // "Pattern{Constant('Save new software from slot (file: '), Field(fld2,false), Constant(') to flash by admin '), Field(p0,false)}" -match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); +var part1318 = match("MESSAGE#824:00511:08/0", "nwparser.payload", "Save new software from slot (file: %{fld2}) to flash by admin %{p0}"); -var all294 = all_match({ +var all289 = all_match({ processors: [ - part1323, - dup400, + part1318, + dup397, ], on_success: processor_chain([ dup1, @@ -17743,15 +16096,14 @@ var all294 = all_match({ ]), }); -var msg834 = msg("00511:08", all294); +var msg834 = msg("00511:08", all289); -var part1324 = // "Pattern{Constant('Save new software from '), Field(hostip,true), Constant(' (file: '), Field(result,false), Constant(') to flash by admin '), Field(p0,false)}" -match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); +var part1319 = match("MESSAGE#825:00511:09/0", "nwparser.payload", "Save new software from %{hostip->} (file: %{result}) to flash by admin %{p0}"); -var all295 = all_match({ +var all290 = all_match({ processors: [ - part1324, - dup400, + part1319, + dup397, ], on_success: processor_chain([ dup1, @@ -17763,15 +16115,14 @@ var all295 = all_match({ ]), }); -var msg835 = msg("00511:09", all295); +var msg835 = msg("00511:09", all290); -var part1325 = // "Pattern{Constant('System Config from flash to slot - '), Field(fld2,true), Constant(' by admin '), Field(p0,false)}" -match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); +var part1320 = match("MESSAGE#826:00511:10/0", "nwparser.payload", "System Config from flash to slot - %{fld2->} by admin %{p0}"); -var all296 = all_match({ +var all291 = all_match({ processors: [ - part1325, - dup400, + part1320, + dup397, ], on_success: processor_chain([ dup1, @@ -17783,15 +16134,14 @@ var all296 = all_match({ ]), }); -var msg836 = msg("00511:10", all296); +var msg836 = msg("00511:10", all291); -var part1326 = // "Pattern{Constant('System Config load from '), Field(hostip,true), Constant(' (file '), Field(fld2,false), Constant(') to slot - '), Field(fld3,true), Constant(' by admin '), Field(p0,false)}" -match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); +var part1321 = match("MESSAGE#827:00511:11/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) to slot - %{fld3->} by admin %{p0}"); -var all297 = all_match({ +var all292 = all_match({ processors: [ - part1326, - dup400, + part1321, + dup397, ], on_success: processor_chain([ dup1, @@ -17803,15 +16153,14 @@ var all297 = all_match({ ]), }); -var msg837 = msg("00511:11", all297); +var msg837 = msg("00511:11", all292); -var part1327 = // "Pattern{Constant('System Config load from '), Field(hostip,true), Constant(' (file '), Field(fld2,false), Constant(') by admin '), Field(p0,false)}" -match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); +var part1322 = match("MESSAGE#828:00511:12/0", "nwparser.payload", "System Config load from %{hostip->} (file %{fld2}) by admin %{p0}"); -var all298 = all_match({ +var all293 = all_match({ processors: [ - part1327, - dup400, + part1322, + dup397, ], on_success: processor_chain([ dup1, @@ -17823,15 +16172,14 @@ var all298 = all_match({ ]), }); -var msg838 = msg("00511:12", all298); +var msg838 = msg("00511:12", all293); -var part1328 = // "Pattern{Constant('The system configuration was loaded from the slot by admin '), Field(p0,false)}" -match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); +var part1323 = match("MESSAGE#829:00511:13/0", "nwparser.payload", "The system configuration was loaded from the slot by admin %{p0}"); -var all299 = all_match({ +var all294 = all_match({ processors: [ - part1328, - dup400, + part1323, + dup397, ], on_success: processor_chain([ dup1, @@ -17843,10 +16191,9 @@ var all299 = all_match({ ]), }); -var msg839 = msg("00511:13", all299); +var msg839 = msg("00511:13", all294); -var part1329 = // "Pattern{Constant('FIPS: Attempt to set RADIUS shared secret with invalid length '), Field(fld2,false)}" -match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ +var part1324 = match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS shared secret with invalid length %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -17854,7 +16201,7 @@ match("MESSAGE#830:00511:14", "nwparser.payload", "FIPS: Attempt to set RADIUS s dup5, ])); -var msg840 = msg("00511:14", part1329); +var msg840 = msg("00511:14", part1324); var select307 = linear_select([ msg826, @@ -17874,37 +16221,32 @@ var select307 = linear_select([ msg840, ]); -var part1330 = // "Pattern{Constant('The physical state of '), Field(p0,false)}" -match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); +var part1325 = match("MESSAGE#831:00513/0", "nwparser.payload", "The physical state of %{p0}"); -var part1331 = // "Pattern{Constant('the Interface '), Field(p0,false)}" -match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); +var part1326 = match("MESSAGE#831:00513/1_1", "nwparser.p0", "the Interface %{p0}"); var select308 = linear_select([ dup123, - part1331, + part1326, dup122, ]); -var part1332 = // "Pattern{Constant(''), Field(interface,true), Constant(' has changed to '), Field(p0,false)}" -match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); +var part1327 = match("MESSAGE#831:00513/2", "nwparser.p0", "%{interface->} has changed to %{p0}"); -var part1333 = // "Pattern{Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); +var part1328 = match("MESSAGE#831:00513/3_0", "nwparser.p0", "%{result}. (%{fld1})"); -var part1334 = // "Pattern{Field(result,false)}" -match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); +var part1329 = match_copy("MESSAGE#831:00513/3_1", "nwparser.p0", "result"); var select309 = linear_select([ - part1333, - part1334, + part1328, + part1329, ]); -var all300 = all_match({ +var all295 = all_match({ processors: [ - part1330, + part1325, select308, - part1332, + part1327, select309, ], on_success: processor_chain([ @@ -17917,39 +16259,35 @@ var all300 = all_match({ ]), }); -var msg841 = msg("00513", all300); +var msg841 = msg("00513", all295); -var part1335 = // "Pattern{Constant('Vsys Admin '), Field(p0,false)}" -match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); +var part1330 = match("MESSAGE#832:00515/0_0", "nwparser.payload", "Vsys Admin %{p0}"); var select310 = linear_select([ - part1335, - dup289, + part1330, + dup287, ]); -var part1336 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has logged on via the '), Field(logon_type,true), Constant(' ( HTTP'), Field(p0,false)}" -match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); +var part1331 = match("MESSAGE#832:00515/1", "nwparser.p0", "%{administrator->} has logged on via the %{logon_type->} ( HTTP%{p0}"); -var part1337 = // "Pattern{Constant('S'), Field(p0,false)}" -match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); +var part1332 = match("MESSAGE#832:00515/2_1", "nwparser.p0", "S%{p0}"); var select311 = linear_select([ dup96, - part1337, + part1332, ]); -var part1338 = // "Pattern{Field(,false), Constant(') to port '), Field(interface,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); +var part1333 = match("MESSAGE#832:00515/3", "nwparser.p0", "%{}) to port %{interface->} from %{saddr}:%{sport}"); -var all301 = all_match({ +var all296 = all_match({ processors: [ select310, - part1336, + part1331, select311, - part1338, + part1333, ], on_success: processor_chain([ - dup303, + dup301, dup2, dup3, dup4, @@ -17957,33 +16295,29 @@ var all301 = all_match({ ]), }); -var msg842 = msg("00515", all301); +var msg842 = msg("00515", all296); -var part1339 = // "Pattern{Constant('Login attempt to system by admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); +var part1334 = match("MESSAGE#833:00515:01/0", "nwparser.payload", "Login attempt to system by admin %{administrator->} via %{p0}"); -var part1340 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' has failed '), Field(p0,false)}" -match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); +var part1335 = match("MESSAGE#833:00515:01/1_0", "nwparser.p0", "the %{logon_type->} has failed %{p0}"); -var part1341 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has failed '), Field(p0,false)}" -match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); +var part1336 = match("MESSAGE#833:00515:01/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} has failed %{p0}"); var select312 = linear_select([ - part1340, - part1341, + part1335, + part1336, ]); -var part1342 = // "Pattern{Field(fld2,false)}" -match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); +var part1337 = match_copy("MESSAGE#833:00515:01/2", "nwparser.p0", "fld2"); -var all302 = all_match({ +var all297 = all_match({ processors: [ - part1339, + part1334, select312, - part1342, + part1337, ], on_success: processor_chain([ - dup208, + dup206, dup29, dup30, dup31, @@ -17991,48 +16325,42 @@ var all302 = all_match({ dup2, dup4, dup5, - dup304, + dup302, dup3, ]), }); -var msg843 = msg("00515:01", all302); +var msg843 = msg("00515:01", all297); -var part1343 = // "Pattern{Constant('Management session via '), Field(p0,false)}" -match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); +var part1338 = match("MESSAGE#834:00515:02/0", "nwparser.payload", "Management session via %{p0}"); -var part1344 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); +var part1339 = match("MESSAGE#834:00515:02/1_0", "nwparser.p0", "the %{logon_type->} for %{p0}"); -var part1345 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); +var part1340 = match("MESSAGE#834:00515:02/1_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} for %{p0}"); var select313 = linear_select([ - part1344, - part1345, + part1339, + part1340, ]); -var part1346 = // "Pattern{Constant('[vsys] admin '), Field(p0,false)}" -match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); +var part1341 = match("MESSAGE#834:00515:02/2_0", "nwparser.p0", "[vsys] admin %{p0}"); -var part1347 = // "Pattern{Constant('vsys admin '), Field(p0,false)}" -match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); +var part1342 = match("MESSAGE#834:00515:02/2_1", "nwparser.p0", "vsys admin %{p0}"); var select314 = linear_select([ - part1346, - part1347, + part1341, + part1342, dup15, ]); -var part1348 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has timed out')}" -match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); +var part1343 = match("MESSAGE#834:00515:02/3", "nwparser.p0", "%{administrator->} has timed out"); -var all303 = all_match({ +var all298 = all_match({ processors: [ - part1343, + part1338, select313, select314, - part1348, + part1343, ], on_success: processor_chain([ dup27, @@ -18043,40 +16371,36 @@ var all303 = all_match({ ]), }); -var msg844 = msg("00515:02", all303); +var msg844 = msg("00515:02", all298); -var part1349 = // "Pattern{Constant('[Vsys] '), Field(p0,false)}" -match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); +var part1344 = match("MESSAGE#835:00515:04/0_0", "nwparser.payload", "[Vsys] %{p0}"); -var part1350 = // "Pattern{Constant('Vsys '), Field(p0,false)}" -match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); +var part1345 = match("MESSAGE#835:00515:04/0_1", "nwparser.payload", "Vsys %{p0}"); var select315 = linear_select([ - part1349, - part1350, + part1344, + part1345, ]); -var part1351 = // "Pattern{Constant('Admin '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" -match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); +var part1346 = match("MESSAGE#835:00515:04/1", "nwparser.p0", "Admin %{administrator->} has logged o%{p0}"); -var part1352 = // "Pattern{Field(logon_type,false)}" -match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); +var part1347 = match_copy("MESSAGE#835:00515:04/4_1", "nwparser.p0", "logon_type"); var select316 = linear_select([ - dup306, - part1352, + dup304, + part1347, ]); -var all304 = all_match({ +var all299 = all_match({ processors: [ select315, - part1351, - dup401, + part1346, + dup398, dup40, select316, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18084,50 +16408,46 @@ var all304 = all_match({ ]), }); -var msg845 = msg("00515:04", all304); +var msg845 = msg("00515:04", all299); -var part1353 = // "Pattern{Constant('Admin User '), Field(administrator,true), Constant(' has logged on via '), Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ - dup242, +var part1348 = match("MESSAGE#836:00515:06", "nwparser.payload", "Admin User %{administrator->} has logged on via %{logon_type->} from %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg846 = msg("00515:06", part1353); +var msg846 = msg("00515:06", part1348); -var part1354 = // "Pattern{Field(,false), Constant('Admin '), Field(p0,false)}" -match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); +var part1349 = match("MESSAGE#837:00515:05/0", "nwparser.payload", "%{}Admin %{p0}"); var select317 = linear_select([ - dup307, + dup305, dup16, ]); -var part1355 = // "Pattern{Constant(''), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" -match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); +var part1350 = match("MESSAGE#837:00515:05/2", "nwparser.p0", "%{administrator->} has logged o%{p0}"); -var part1356 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld2,false), Constant(')')}" -match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); +var part1351 = match("MESSAGE#837:00515:05/5_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{fld2})"); var select318 = linear_select([ - dup308, - part1356, dup306, + part1351, + dup304, ]); -var all305 = all_match({ +var all300 = all_match({ processors: [ - part1354, + part1349, select317, - part1355, - dup401, + part1350, + dup398, dup40, select318, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18135,44 +16455,39 @@ var all305 = all_match({ ]), }); -var msg847 = msg("00515:05", all305); +var msg847 = msg("00515:05", all300); -var part1357 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' login attempt for '), Field(logon_type,false), Constant('(http) management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false)}" -match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ - dup242, +var part1352 = match("MESSAGE#838:00515:07", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(http) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg848 = msg("00515:07", part1357); +var msg848 = msg("00515:07", part1352); -var part1358 = // "Pattern{Field(fld2,true), Constant(' Admin User "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('(http'), Field(p0,false)}" -match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); +var part1353 = match("MESSAGE#839:00515:08/0", "nwparser.payload", "%{fld2->} Admin User \"%{administrator}\" logged in for %{logon_type}(http%{p0}"); -var part1359 = // "Pattern{Constant(') '), Field(p0,false)}" -match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); +var part1354 = match("MESSAGE#839:00515:08/1_0", "nwparser.p0", ") %{p0}"); -var part1360 = // "Pattern{Constant('s) '), Field(p0,false)}" -match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); +var part1355 = match("MESSAGE#839:00515:08/1_1", "nwparser.p0", "s) %{p0}"); var select319 = linear_select([ - part1359, - part1360, + part1354, + part1355, ]); -var part1361 = // "Pattern{Constant('management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); +var part1356 = match("MESSAGE#839:00515:08/2", "nwparser.p0", "management (port %{network_port}) from %{saddr}:%{sport}"); -var all306 = all_match({ +var all301 = all_match({ processors: [ - part1358, + part1353, select319, - part1361, + part1356, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18180,32 +16495,29 @@ var all306 = all_match({ ]), }); -var msg849 = msg("00515:08", all306); +var msg849 = msg("00515:08", all301); -var part1362 = // "Pattern{Constant('User '), Field(username,true), Constant(' telnet management session from ('), Field(saddr,false), Constant(':'), Field(sport,false), Constant(') timed out')}" -match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ - dup242, +var part1357 = match("MESSAGE#840:00515:09", "nwparser.payload", "User %{username->} telnet management session from (%{saddr}:%{sport}) timed out", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg850 = msg("00515:09", part1362); +var msg850 = msg("00515:09", part1357); -var part1363 = // "Pattern{Constant('User '), Field(username,true), Constant(' logged out of telnet session from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ - dup242, +var part1358 = match("MESSAGE#841:00515:10", "nwparser.payload", "User %{username->} logged out of telnet session from %{saddr}:%{sport}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg851 = msg("00515:10", part1363); +var msg851 = msg("00515:10", part1358); -var part1364 = // "Pattern{Constant('The session limit threshold has been set to '), Field(trigger_val,true), Constant(' on zone '), Field(zone,false), Constant('.')}" -match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ +var part1359 = match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold has been set to %{trigger_val->} on zone %{zone}.", processor_chain([ dup1, dup2, dup3, @@ -18213,22 +16525,20 @@ match("MESSAGE#842:00515:11", "nwparser.payload", "The session limit threshold h dup5, ])); -var msg852 = msg("00515:11", part1364); +var msg852 = msg("00515:11", part1359); -var part1365 = // "Pattern{Constant('[ Vsys ] Admin User "'), Field(administrator,false), Constant('" logged in for Web( http'), Field(p0,false)}" -match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); +var part1360 = match("MESSAGE#843:00515:12/0", "nwparser.payload", "[ Vsys ] Admin User \"%{administrator}\" logged in for Web( http%{p0}"); -var part1366 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(')')}" -match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); +var part1361 = match("MESSAGE#843:00515:12/2", "nwparser.p0", ") management (port %{network_port})"); -var all307 = all_match({ +var all302 = all_match({ processors: [ - part1365, - dup402, - part1366, + part1360, + dup399, + part1361, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18236,31 +16546,30 @@ var all307 = all_match({ ]), }); -var msg853 = msg("00515:12", all307); +var msg853 = msg("00515:12", all302); var select320 = linear_select([ - dup290, - dup289, + dup288, + dup287, ]); -var part1367 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" -match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); +var part1362 = match("MESSAGE#844:00515:13/1", "nwparser.p0", "user %{administrator->} has logged o%{p0}"); var select321 = linear_select([ - dup308, dup306, + dup304, ]); -var all308 = all_match({ +var all303 = all_match({ processors: [ select320, - part1367, - dup401, + part1362, + dup398, dup40, select321, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18268,46 +16577,40 @@ var all308 = all_match({ ]), }); -var msg854 = msg("00515:13", all308); +var msg854 = msg("00515:13", all303); -var part1368 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been forced to log o'), Field(p0,false)}" -match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); +var part1363 = match("MESSAGE#845:00515:14/0_0", "nwparser.payload", "Admin user %{administrator->} has been forced to log o%{p0}"); -var part1369 = // "Pattern{Field(username,true), Constant(' '), Field(fld1,true), Constant(' has been forced to log o'), Field(p0,false)}" -match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); +var part1364 = match("MESSAGE#845:00515:14/0_1", "nwparser.payload", "%{username->} %{fld1->} has been forced to log o%{p0}"); var select322 = linear_select([ - part1368, - part1369, + part1363, + part1364, ]); -var part1370 = // "Pattern{Constant('of the '), Field(p0,false)}" -match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); +var part1365 = match("MESSAGE#845:00515:14/2", "nwparser.p0", "of the %{p0}"); -var part1371 = // "Pattern{Constant('serial '), Field(logon_type,true), Constant(' session.')}" -match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); +var part1366 = match("MESSAGE#845:00515:14/3_0", "nwparser.p0", "serial %{logon_type->} session."); -var part1372 = // "Pattern{Field(logon_type,true), Constant(' session on host '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' ('), Field(event_time,false), Constant(')')}" -match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); +var part1367 = match("MESSAGE#845:00515:14/3_1", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port->} (%{event_time})"); -var part1373 = // "Pattern{Field(logon_type,true), Constant(' session on host '), Field(hostip,false), Constant(':'), Field(network_port,false)}" -match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); +var part1368 = match("MESSAGE#845:00515:14/3_2", "nwparser.p0", "%{logon_type->} session on host %{hostip}:%{network_port}"); var select323 = linear_select([ - part1371, - part1372, - part1373, + part1366, + part1367, + part1368, ]); -var all309 = all_match({ +var all304 = all_match({ processors: [ select322, - dup401, - part1370, + dup398, + part1365, select323, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18315,32 +16618,29 @@ var all309 = all_match({ ]), }); -var msg855 = msg("00515:14", all309); +var msg855 = msg("00515:14", all304); -var part1374 = // "Pattern{Field(fld2,false), Constant(': Admin User '), Field(administrator,true), Constant(' has logged o'), Field(p0,false)}" -match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); +var part1369 = match("MESSAGE#846:00515:15/0", "nwparser.payload", "%{fld2}: Admin User %{administrator->} has logged o%{p0}"); -var part1375 = // "Pattern{Constant('the '), Field(logon_type,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); +var part1370 = match("MESSAGE#846:00515:15/3_0", "nwparser.p0", "the %{logon_type->} (%{p0}"); -var part1376 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); +var part1371 = match("MESSAGE#846:00515:15/3_1", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport->} (%{p0}"); var select324 = linear_select([ - part1375, - part1376, + part1370, + part1371, ]); -var all310 = all_match({ +var all305 = all_match({ processors: [ - part1374, - dup401, + part1369, + dup398, dup40, select324, dup41, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup9, @@ -18349,31 +16649,28 @@ var all310 = all_match({ ]), }); -var msg856 = msg("00515:15", all310); +var msg856 = msg("00515:15", all305); -var part1377 = // "Pattern{Field(fld2,false), Constant(': Admin '), Field(p0,false)}" -match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); +var part1372 = match("MESSAGE#847:00515:16/0_0", "nwparser.payload", "%{fld2}: Admin %{p0}"); var select325 = linear_select([ - part1377, - dup289, + part1372, + dup287, ]); -var part1378 = // "Pattern{Constant('user '), Field(administrator,true), Constant(' attempt access to '), Field(url,true), Constant(' illegal from '), Field(logon_type,false), Constant('( http'), Field(p0,false)}" -match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); +var part1373 = match("MESSAGE#847:00515:16/1", "nwparser.p0", "user %{administrator->} attempt access to %{url->} illegal from %{logon_type}( http%{p0}"); -var part1379 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); +var part1374 = match("MESSAGE#847:00515:16/3", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}. (%{fld1})"); -var all311 = all_match({ +var all306 = all_match({ processors: [ select325, - part1378, - dup402, - part1379, + part1373, + dup399, + part1374, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup9, @@ -18382,33 +16679,29 @@ var all311 = all_match({ ]), }); -var msg857 = msg("00515:16", all311); +var msg857 = msg("00515:16", all306); -var part1380 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged out for '), Field(logon_type,false), Constant('('), Field(p0,false)}" -match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); +var part1375 = match("MESSAGE#848:00515:17/0", "nwparser.payload", "Admin user \"%{administrator}\" logged out for %{logon_type}(%{p0}"); -var part1381 = // "Pattern{Constant('https '), Field(p0,false)}" -match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); +var part1376 = match("MESSAGE#848:00515:17/1_0", "nwparser.p0", "https %{p0}"); -var part1382 = // "Pattern{Constant(' http '), Field(p0,false)}" -match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); +var part1377 = match("MESSAGE#848:00515:17/1_1", "nwparser.p0", " http %{p0}"); var select326 = linear_select([ - part1381, - part1382, + part1376, + part1377, ]); -var part1383 = // "Pattern{Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); +var part1378 = match("MESSAGE#848:00515:17/2", "nwparser.p0", ") management (port %{network_port}) from %{saddr}:%{sport}"); -var all312 = all_match({ +var all307 = all_match({ processors: [ - part1380, + part1375, select326, - part1383, + part1378, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup4, @@ -18416,11 +16709,10 @@ var all312 = all_match({ ]), }); -var msg858 = msg("00515:17", all312); +var msg858 = msg("00515:17", all307); -var part1384 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' login attempt for '), Field(logon_type,false), Constant('(https) management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup242, +var part1379 = match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} login attempt for %{logon_type}(https) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ + dup240, dup2, dup3, dup9, @@ -18428,30 +16720,27 @@ match("MESSAGE#849:00515:18", "nwparser.payload", "Admin user %{administrator->} dup5, ])); -var msg859 = msg("00515:18", part1384); +var msg859 = msg("00515:18", part1379); -var part1385 = // "Pattern{Constant('Vsys admin user '), Field(administrator,true), Constant(' logged on via '), Field(p0,false)}" -match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); +var part1380 = match("MESSAGE#850:00515:19/0", "nwparser.payload", "Vsys admin user %{administrator->} logged on via %{p0}"); -var part1386 = // "Pattern{Field(logon_type,true), Constant(' from remote IP address '), Field(saddr,true), Constant(' using port '), Field(sport,false), Constant('. ('), Field(p0,false)}" -match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); +var part1381 = match("MESSAGE#850:00515:19/1_0", "nwparser.p0", "%{logon_type->} from remote IP address %{saddr->} using port %{sport}. (%{p0}"); -var part1387 = // "Pattern{Constant('the console. ('), Field(p0,false)}" -match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); +var part1382 = match("MESSAGE#850:00515:19/1_1", "nwparser.p0", "the console. (%{p0}"); var select327 = linear_select([ - part1386, - part1387, + part1381, + part1382, ]); -var all313 = all_match({ +var all308 = all_match({ processors: [ - part1385, + part1380, select327, dup41, ], on_success: processor_chain([ - dup242, + dup240, dup2, dup3, dup9, @@ -18460,11 +16749,10 @@ var all313 = all_match({ ]), }); -var msg860 = msg("00515:19", all313); +var msg860 = msg("00515:19", all308); -var part1388 = // "Pattern{Constant('netscreen: Management session via SCS from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' for admin netscreen has timed out ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ - dup242, +var part1383 = match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session via SCS from %{saddr}:%{sport->} for admin netscreen has timed out (%{fld1})", processor_chain([ + dup240, dup2, dup3, dup9, @@ -18472,7 +16760,7 @@ match("MESSAGE#851:00515:20", "nwparser.payload", "netscreen: Management session dup5, ])); -var msg861 = msg("00515:20", part1388); +var msg861 = msg("00515:20", part1383); var select328 = linear_select([ msg842, @@ -18497,85 +16785,77 @@ var select328 = linear_select([ msg861, ]); -var part1389 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' '), Field(fld1,false), Constant('at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup283, +var part1384 = match("MESSAGE#852:00518", "nwparser.payload", "Admin user %{administrator->} %{fld1}at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg862 = msg("00518", part1389); +var msg862 = msg("00518", part1384); -var part1390 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup283, +var part1385 = match("MESSAGE#853:00518:17", "nwparser.payload", "Admin user %{administrator->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg863 = msg("00518:17", part1390); +var msg863 = msg("00518:17", part1385); -var part1391 = // "Pattern{Constant('Local authentication for WebAuth user '), Field(username,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ - dup283, +var part1386 = match("MESSAGE#854:00518:01", "nwparser.payload", "Local authentication for WebAuth user %{username->} was %{disposition}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg864 = msg("00518:01", part1391); +var msg864 = msg("00518:01", part1386); -var part1392 = // "Pattern{Constant('Local authentication for user '), Field(username,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ - dup283, +var part1387 = match("MESSAGE#855:00518:02", "nwparser.payload", "Local authentication for user %{username->} was %{disposition}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg865 = msg("00518:02", part1392); +var msg865 = msg("00518:02", part1387); -var part1393 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' must enter "Next Code" for SecurID '), Field(hostip,false)}" -match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ - dup205, +var part1388 = match("MESSAGE#856:00518:03", "nwparser.payload", "User %{username->} at %{saddr->} must enter \"Next Code\" for SecurID %{hostip}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg866 = msg("00518:03", part1393); +var msg866 = msg("00518:03", part1388); -var part1394 = // "Pattern{Constant('WebAuth user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup205, +var part1389 = match("MESSAGE#857:00518:04", "nwparser.payload", "WebAuth user %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup203, dup2, dup4, dup5, dup3, ])); -var msg867 = msg("00518:04", part1394); +var msg867 = msg("00518:04", part1389); -var part1395 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been challenged via the '), Field(authmethod,true), Constant(' server at '), Field(hostip,true), Constant(' (Rejected since challenge is not supported for '), Field(logon_type,false), Constant(')')}" -match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ - dup205, +var part1390 = match("MESSAGE#858:00518:05", "nwparser.payload", "User %{username->} at %{saddr->} has been challenged via the %{authmethod->} server at %{hostip->} (Rejected since challenge is not supported for %{logon_type})", processor_chain([ + dup203, dup2, dup4, dup5, dup3, ])); -var msg868 = msg("00518:05", part1395); +var msg868 = msg("00518:05", part1390); -var part1396 = // "Pattern{Constant('Error in authentication for WebAuth user '), Field(username,false)}" -match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ +var part1391 = match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for WebAuth user %{username}", processor_chain([ dup35, dup29, dup31, @@ -18586,27 +16866,24 @@ match("MESSAGE#859:00518:06", "nwparser.payload", "Error in authentication for W dup3, ])); -var msg869 = msg("00518:06", part1396); +var msg869 = msg("00518:06", part1391); -var part1397 = // "Pattern{Constant('Authentication for user '), Field(username,true), Constant(' was denied (long '), Field(p0,false)}" -match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); +var part1392 = match("MESSAGE#860:00518:07/0", "nwparser.payload", "Authentication for user %{username->} was denied (long %{p0}"); -var part1398 = // "Pattern{Constant('username '), Field(p0,false)}" -match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); +var part1393 = match("MESSAGE#860:00518:07/1_1", "nwparser.p0", "username %{p0}"); var select329 = linear_select([ dup24, - part1398, + part1393, ]); -var part1399 = // "Pattern{Constant(')'), Field(,false)}" -match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); +var part1394 = match("MESSAGE#860:00518:07/2", "nwparser.p0", ")%{}"); -var all314 = all_match({ +var all309 = all_match({ processors: [ - part1397, + part1392, select329, - part1399, + part1394, ], on_success: processor_chain([ dup53, @@ -18620,10 +16897,9 @@ var all314 = all_match({ ]), }); -var msg870 = msg("00518:07", all314); +var msg870 = msg("00518:07", all309); -var part1400 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' '), Field(authmethod,true), Constant(' authentication attempt has timed out')}" -match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ +var part1395 = match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr->} %{authmethod->} authentication attempt has timed out", processor_chain([ dup35, dup29, dup31, @@ -18634,22 +16910,20 @@ match("MESSAGE#861:00518:08", "nwparser.payload", "User %{username->} at %{saddr dup3, ])); -var msg871 = msg("00518:08", part1400); +var msg871 = msg("00518:08", part1395); -var part1401 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ - dup205, +var part1396 = match("MESSAGE#862:00518:09", "nwparser.payload", "User %{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}", processor_chain([ + dup203, dup2, dup4, dup5, dup3, ])); -var msg872 = msg("00518:09", part1401); +var msg872 = msg("00518:09", part1396); -var part1402 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,true), Constant(' ('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' failed due to '), Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ - dup208, +var part1397 = match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type->} (%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} failed due to %{result}. (%{fld1})", processor_chain([ + dup206, dup29, dup30, dup31, @@ -18659,36 +16933,32 @@ match("MESSAGE#863:00518:10", "nwparser.payload", "Admin user \"%{administrator} dup9, dup5, dup3, - dup304, + dup302, ])); -var msg873 = msg("00518:10", part1402); +var msg873 = msg("00518:10", part1397); -var part1403 = // "Pattern{Constant('ADM: Local admin authentication failed for login name '), Field(p0,false)}" -match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); +var part1398 = match("MESSAGE#864:00518:11/0", "nwparser.payload", "ADM: Local admin authentication failed for login name %{p0}"); -var part1404 = // "Pattern{Constant('''), Field(username,false), Constant('': '), Field(p0,false)}" -match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); +var part1399 = match("MESSAGE#864:00518:11/1_0", "nwparser.p0", "'%{username}': %{p0}"); -var part1405 = // "Pattern{Field(username,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); +var part1400 = match("MESSAGE#864:00518:11/1_1", "nwparser.p0", "%{username}: %{p0}"); var select330 = linear_select([ - part1404, - part1405, + part1399, + part1400, ]); -var part1406 = // "Pattern{Field(result,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); +var part1401 = match("MESSAGE#864:00518:11/2", "nwparser.p0", "%{result->} (%{fld1})"); -var all315 = all_match({ +var all310 = all_match({ processors: [ - part1403, + part1398, select330, - part1406, + part1401, ], on_success: processor_chain([ - dup208, + dup206, dup29, dup30, dup31, @@ -18701,11 +16971,10 @@ var all315 = all_match({ ]), }); -var msg874 = msg("00518:11", all315); +var msg874 = msg("00518:11", all310); -var part1407 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" login attempt for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ - dup242, +var part1402 = match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator}\" login attempt for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{disposition}. (%{fld1})", processor_chain([ + dup240, dup2, dup4, dup9, @@ -18713,11 +16982,10 @@ match("MESSAGE#865:00518:12", "nwparser.payload", "Admin user \"%{administrator} dup3, ])); -var msg875 = msg("00518:12", part1407); +var msg875 = msg("00518:12", part1402); -var part1408 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' is rejected by the Radius server at '), Field(hostip,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ - dup292, +var part1403 = match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr->} is rejected by the Radius server at %{hostip}. (%{fld1})", processor_chain([ + dup290, dup2, dup3, dup4, @@ -18725,18 +16993,17 @@ match("MESSAGE#866:00518:13", "nwparser.payload", "User %{username->} at %{saddr dup5, ])); -var msg876 = msg("00518:13", part1408); +var msg876 = msg("00518:13", part1403); -var part1409 = // "Pattern{Field(fld2,false), Constant(': Admin user has been rejected via the Radius server at '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ - dup292, +var part1404 = match("MESSAGE#867:00518:14", "nwparser.payload", "%{fld2}: Admin user has been rejected via the Radius server at %{hostip->} (%{fld1})", processor_chain([ + dup290, dup2, dup4, dup5, dup9, ])); -var msg877 = msg("00518:14", part1409); +var msg877 = msg("00518:14", part1404); var select331 = linear_select([ msg862, @@ -18757,45 +17024,39 @@ var select331 = linear_select([ msg877, ]); -var part1410 = // "Pattern{Constant('Admin user '), Field(administrator,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); +var part1405 = match("MESSAGE#868:00519/0", "nwparser.payload", "Admin user %{administrator->} %{p0}"); -var part1411 = // "Pattern{Constant('of group '), Field(group,true), Constant(' at '), Field(saddr,true), Constant(' has '), Field(p0,false)}" -match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); +var part1406 = match("MESSAGE#868:00519/1_1", "nwparser.p0", "of group %{group->} at %{saddr->} has %{p0}"); -var part1412 = // "Pattern{Field(group,true), Constant(' at '), Field(saddr,true), Constant(' has '), Field(p0,false)}" -match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); +var part1407 = match("MESSAGE#868:00519/1_2", "nwparser.p0", "%{group->} at %{saddr->} has %{p0}"); var select332 = linear_select([ - dup196, - part1411, - part1412, + dup194, + part1406, + part1407, ]); -var part1413 = // "Pattern{Constant('been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server '), Field(p0,false)}" -match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); +var part1408 = match("MESSAGE#868:00519/2", "nwparser.p0", "been %{disposition->} via the %{logon_type->} server %{p0}"); -var part1414 = // "Pattern{Constant('at '), Field(p0,false)}" -match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); +var part1409 = match("MESSAGE#868:00519/3_0", "nwparser.p0", "at %{p0}"); var select333 = linear_select([ - part1414, + part1409, dup16, ]); -var part1415 = // "Pattern{Constant(''), Field(hostip,false)}" -match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); +var part1410 = match("MESSAGE#868:00519/4", "nwparser.p0", "%{hostip}"); -var all316 = all_match({ +var all311 = all_match({ processors: [ - part1410, + part1405, select332, - part1413, + part1408, select333, - part1415, + part1410, ], on_success: processor_chain([ - dup205, + dup203, dup2, dup3, dup4, @@ -18803,27 +17064,25 @@ var all316 = all_match({ ]), }); -var msg878 = msg("00519", all316); +var msg878 = msg("00519", all311); -var part1416 = // "Pattern{Constant('Local authentication for '), Field(p0,false)}" -match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); +var part1411 = match("MESSAGE#869:00519:01/0", "nwparser.payload", "Local authentication for %{p0}"); var select334 = linear_select([ - dup309, dup307, + dup305, ]); -var part1417 = // "Pattern{Constant(''), Field(username,true), Constant(' was '), Field(disposition,false)}" -match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); +var part1412 = match("MESSAGE#869:00519:01/2", "nwparser.p0", "%{username->} was %{disposition}"); -var all317 = all_match({ +var all312 = all_match({ processors: [ - part1416, + part1411, select334, - part1417, + part1412, ], on_success: processor_chain([ - dup205, + dup203, dup2, dup3, dup4, @@ -18831,27 +17090,25 @@ var all317 = all_match({ ]), }); -var msg879 = msg("00519:01", all317); +var msg879 = msg("00519:01", all312); -var part1418 = // "Pattern{Constant('User '), Field(p0,false)}" -match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); +var part1413 = match("MESSAGE#870:00519:02/1_1", "nwparser.p0", "User %{p0}"); var select335 = linear_select([ - dup309, - part1418, + dup307, + part1413, ]); -var part1419 = // "Pattern{Constant(''), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' has been '), Field(disposition,true), Constant(' via the '), Field(logon_type,true), Constant(' server at '), Field(hostip,false)}" -match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); +var part1414 = match("MESSAGE#870:00519:02/2", "nwparser.p0", "%{username->} at %{saddr->} has been %{disposition->} via the %{logon_type->} server at %{hostip}"); -var all318 = all_match({ +var all313 = all_match({ processors: [ - dup162, + dup160, select335, - part1419, + part1414, ], on_success: processor_chain([ - dup205, + dup203, dup2, dup3, dup4, @@ -18859,40 +17116,37 @@ var all318 = all_match({ ]), }); -var msg880 = msg("00519:02", all318); +var msg880 = msg("00519:02", all313); -var part1420 = // "Pattern{Constant('Admin user "'), Field(administrator,false), Constant('" logged in for '), Field(logon_type,false), Constant('('), Field(network_service,false), Constant(') management (port '), Field(network_port,false), Constant(') from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' '), Field(fld4,false)}" -match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ - dup242, +var part1415 = match("MESSAGE#871:00519:03", "nwparser.payload", "Admin user \"%{administrator}\" logged in for %{logon_type}(%{network_service}) management (port %{network_port}) from %{saddr}:%{sport->} %{fld4}", processor_chain([ + dup240, dup2, dup3, dup4, dup5, ])); -var msg881 = msg("00519:03", part1420); +var msg881 = msg("00519:03", part1415); -var part1421 = // "Pattern{Constant('ADM: Local admin authentication successful for login name '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ - dup242, +var part1416 = match("MESSAGE#872:00519:04", "nwparser.payload", "ADM: Local admin authentication successful for login name %{username->} (%{fld1})", processor_chain([ + dup240, dup2, dup4, dup5, dup9, ])); -var msg882 = msg("00519:04", part1421); +var msg882 = msg("00519:04", part1416); -var part1422 = // "Pattern{Field(fld2,false), Constant('Admin user '), Field(administrator,true), Constant(' has been accepted via the Radius server at '), Field(hostip,false), Constant('('), Field(fld1,false), Constant(')')}" -match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ - dup242, +var part1417 = match("MESSAGE#873:00519:05", "nwparser.payload", "%{fld2}Admin user %{administrator->} has been accepted via the Radius server at %{hostip}(%{fld1})", processor_chain([ + dup240, dup2, dup4, dup5, dup9, ])); -var msg883 = msg("00519:05", part1422); +var msg883 = msg("00519:05", part1417); var select336 = linear_select([ msg878, @@ -18903,8 +17157,7 @@ var select336 = linear_select([ msg883, ]); -var part1423 = // "Pattern{Field(hostname,true), Constant(' user authentication attempt has timed out')}" -match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ +var part1418 = match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authentication attempt has timed out", processor_chain([ dup35, dup31, dup39, @@ -18914,38 +17167,32 @@ match("MESSAGE#874:00520", "nwparser.payload", "%{hostname->} user authenticatio dup5, ])); -var msg884 = msg("00520", part1423); +var msg884 = msg("00520", part1418); -var part1424 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); +var part1419 = match("MESSAGE#875:00520:01/0", "nwparser.payload", "User %{username->} at %{hostip->} %{p0}"); -var part1425 = // "Pattern{Constant('RADIUS '), Field(p0,false)}" -match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); +var part1420 = match("MESSAGE#875:00520:01/1_0", "nwparser.p0", "RADIUS %{p0}"); -var part1426 = // "Pattern{Constant('SecurID '), Field(p0,false)}" -match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); +var part1421 = match("MESSAGE#875:00520:01/1_1", "nwparser.p0", "SecurID %{p0}"); -var part1427 = // "Pattern{Constant('LDAP '), Field(p0,false)}" -match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); +var part1422 = match("MESSAGE#875:00520:01/1_2", "nwparser.p0", "LDAP %{p0}"); -var part1428 = // "Pattern{Constant('Local '), Field(p0,false)}" -match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); +var part1423 = match("MESSAGE#875:00520:01/1_3", "nwparser.p0", "Local %{p0}"); var select337 = linear_select([ - part1425, - part1426, - part1427, - part1428, + part1420, + part1421, + part1422, + part1423, ]); -var part1429 = // "Pattern{Constant('authentication attempt has timed out'), Field(,false)}" -match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); +var part1424 = match("MESSAGE#875:00520:01/2", "nwparser.p0", "authentication attempt has timed out%{}"); -var all319 = all_match({ +var all314 = all_match({ processors: [ - part1424, + part1419, select337, - part1429, + part1424, ], on_success: processor_chain([ dup35, @@ -18958,19 +17205,17 @@ var all319 = all_match({ ]), }); -var msg885 = msg("00520:01", all319); +var msg885 = msg("00520:01", all314); -var part1430 = // "Pattern{Constant('Trying '), Field(p0,false)}" -match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); +var part1425 = match("MESSAGE#876:00520:02/0", "nwparser.payload", "Trying %{p0}"); -var part1431 = // "Pattern{Constant('server '), Field(fld2,false)}" -match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); +var part1426 = match("MESSAGE#876:00520:02/2", "nwparser.p0", "server %{fld2}"); -var all320 = all_match({ +var all315 = all_match({ processors: [ - part1430, - dup403, - part1431, + part1425, + dup400, + part1426, ], on_success: processor_chain([ dup44, @@ -18981,41 +17226,35 @@ var all320 = all_match({ ]), }); -var msg886 = msg("00520:02", all320); +var msg886 = msg("00520:02", all315); -var part1432 = // "Pattern{Constant('Primary '), Field(p0,false)}" -match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); +var part1427 = match("MESSAGE#877:00520:03/1_0", "nwparser.p0", "Primary %{p0}"); -var part1433 = // "Pattern{Constant('Backup1 '), Field(p0,false)}" -match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); +var part1428 = match("MESSAGE#877:00520:03/1_1", "nwparser.p0", "Backup1 %{p0}"); -var part1434 = // "Pattern{Constant('Backup2 '), Field(p0,false)}" -match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); +var part1429 = match("MESSAGE#877:00520:03/1_2", "nwparser.p0", "Backup2 %{p0}"); var select338 = linear_select([ - part1432, - part1433, - part1434, + part1427, + part1428, + part1429, ]); -var part1435 = // "Pattern{Constant(''), Field(fld2,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); +var part1430 = match("MESSAGE#877:00520:03/2", "nwparser.p0", "%{fld2}, %{p0}"); -var part1436 = // "Pattern{Constant(''), Field(fld3,false), Constant(', and '), Field(p0,false)}" -match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); +var part1431 = match("MESSAGE#877:00520:03/4", "nwparser.p0", "%{fld3}, and %{p0}"); -var part1437 = // "Pattern{Constant(''), Field(fld4,true), Constant(' servers failed')}" -match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); +var part1432 = match("MESSAGE#877:00520:03/6", "nwparser.p0", "%{fld4->} servers failed"); -var all321 = all_match({ +var all316 = all_match({ processors: [ - dup162, + dup160, select338, - part1435, - dup403, - part1436, - dup403, - part1437, + part1430, + dup400, + part1431, + dup400, + part1432, ], on_success: processor_chain([ dup19, @@ -19026,10 +17265,9 @@ var all321 = all_match({ ]), }); -var msg887 = msg("00520:03", all321); +var msg887 = msg("00520:03", all316); -var part1438 = // "Pattern{Constant('Trying '), Field(fld2,true), Constant(' Server '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ +var part1433 = match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hostip->} (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -19037,10 +17275,9 @@ match("MESSAGE#878:00520:04", "nwparser.payload", "Trying %{fld2->} Server %{hos dup9, ])); -var msg888 = msg("00520:04", part1438); +var msg888 = msg("00520:04", part1433); -var part1439 = // "Pattern{Constant('Active Server Switchover: New requests for '), Field(fld31,true), Constant(' server will try '), Field(fld32,true), Constant(' from now on. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ +var part1434 = match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: New requests for %{fld31->} server will try %{fld32->} from now on. (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -19048,7 +17285,7 @@ match("MESSAGE#1221:00520:05", "nwparser.payload", "Active Server Switchover: Ne dup9, ])); -var msg889 = msg("00520:05", part1439); +var msg889 = msg("00520:05", part1434); var select339 = linear_select([ msg884, @@ -19059,8 +17296,7 @@ var select339 = linear_select([ msg889, ]); -var part1440 = // "Pattern{Constant('Can't connect to E-mail server '), Field(hostip,false)}" -match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ +var part1435 = match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server %{hostip}", processor_chain([ dup27, dup2, dup3, @@ -19068,10 +17304,9 @@ match("MESSAGE#879:00521", "nwparser.payload", "Can't connect to E-mail server % dup5, ])); -var msg890 = msg("00521", part1440); +var msg890 = msg("00521", part1435); -var part1441 = // "Pattern{Constant('HA link state has '), Field(fld2,false)}" -match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ +var part1436 = match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", processor_chain([ dup117, dup2, dup3, @@ -19079,32 +17314,29 @@ match("MESSAGE#880:00522", "nwparser.payload", "HA link state has %{fld2}", proc dup5, ])); -var msg891 = msg("00522", part1441); +var msg891 = msg("00522", part1436); -var part1442 = // "Pattern{Constant('URL filtering received an error from '), Field(fld2,true), Constant(' (error '), Field(resultcode,false), Constant(').')}" -match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ - dup234, +var part1437 = match("MESSAGE#881:00523", "nwparser.payload", "URL filtering received an error from %{fld2->} (error %{resultcode}).", processor_chain([ + dup232, dup2, dup3, dup4, dup5, ])); -var msg892 = msg("00523", part1442); +var msg892 = msg("00523", part1437); -var part1443 = // "Pattern{Constant('NetScreen device at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has responded successfully to SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ - dup211, +var part1438 = match("MESSAGE#882:00524", "nwparser.payload", "NetScreen device at %{hostip}:%{network_port->} has responded successfully to SNMP request from %{saddr}:%{sport}", processor_chain([ + dup209, dup2, dup3, dup4, dup5, ])); -var msg893 = msg("00524", part1443); +var msg893 = msg("00524", part1438); -var part1444 = // "Pattern{Constant('SNMP request from an unknown SNMP community public at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ +var part1439 = match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown SNMP community public at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -19113,10 +17345,9 @@ match("MESSAGE#883:00524:02", "nwparser.payload", "SNMP request from an unknown dup5, ])); -var msg894 = msg("00524:02", part1444); +var msg894 = msg("00524:02", part1439); -var part1445 = // "Pattern{Constant('SNMP: NetScreen device has responded successfully to the SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ +var part1440 = match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has responded successfully to the SNMP request from %{saddr}:%{sport}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -19125,10 +17356,9 @@ match("MESSAGE#884:00524:03", "nwparser.payload", "SNMP: NetScreen device has re dup5, ])); -var msg895 = msg("00524:03", part1445); +var msg895 = msg("00524:03", part1440); -var part1446 = // "Pattern{Constant('SNMP request from an unknown SNMP community admin at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ +var part1441 = match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown SNMP community admin at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -19137,10 +17367,9 @@ match("MESSAGE#885:00524:04", "nwparser.payload", "SNMP request from an unknown dup5, ])); -var msg896 = msg("00524:04", part1446); +var msg896 = msg("00524:04", part1441); -var part1447 = // "Pattern{Constant('SNMP request from an unknown SNMP community '), Field(fld2,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,true), Constant(' has been received. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ +var part1442 = match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{hostip}:%{network_port->} has been received. (%{fld1})", processor_chain([ dup18, dup2, dup4, @@ -19148,10 +17377,9 @@ match("MESSAGE#886:00524:05", "nwparser.payload", "SNMP request from an unknown dup9, ])); -var msg897 = msg("00524:05", part1447); +var msg897 = msg("00524:05", part1442); -var part1448 = // "Pattern{Constant('SNMP request has been received from an unknown host in SNMP community '), Field(fld2,true), Constant(' at '), Field(hostip,false), Constant(':'), Field(network_port,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ +var part1443 = match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been received from an unknown host in SNMP community %{fld2->} at %{hostip}:%{network_port}. (%{fld1})", processor_chain([ dup18, dup2, dup4, @@ -19159,20 +17387,18 @@ match("MESSAGE#887:00524:06", "nwparser.payload", "SNMP request has been receive dup9, ])); -var msg898 = msg("00524:06", part1448); +var msg898 = msg("00524:06", part1443); -var part1449 = // "Pattern{Constant('SNMP request from an unknown SNMP community '), Field(fld2,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' has been received')}" -match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ +var part1444 = match("MESSAGE#888:00524:12", "nwparser.payload", "SNMP request from an unknown SNMP community %{fld2->} at %{saddr}:%{sport->} to %{daddr}:%{dport->} has been received", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg899 = msg("00524:12", part1449); +var msg899 = msg("00524:12", part1444); -var part1450 = // "Pattern{Constant('SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has been received, but the SNMP version type is incorrect. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ +var part1445 = match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{sport->} has been received, but the SNMP version type is incorrect. (%{fld1})", processor_chain([ dup19, dup2, dup4, @@ -19181,19 +17407,17 @@ match("MESSAGE#889:00524:14", "nwparser.payload", "SNMP request from %{saddr}:%{ dup9, ])); -var msg900 = msg("00524:14", part1450); +var msg900 = msg("00524:14", part1445); -var part1451 = // "Pattern{Constant('SNMP request has been received'), Field(p0,false)}" -match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); +var part1446 = match("MESSAGE#890:00524:13/0", "nwparser.payload", "SNMP request has been received%{p0}"); -var part1452 = // "Pattern{Field(,false), Constant('but '), Field(result,false)}" -match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); +var part1447 = match("MESSAGE#890:00524:13/2", "nwparser.p0", "%{}but %{result}"); -var all322 = all_match({ +var all317 = all_match({ processors: [ - part1451, - dup404, - part1452, + part1446, + dup401, + part1447, ], on_success: processor_chain([ dup18, @@ -19203,60 +17427,54 @@ var all322 = all_match({ ]), }); -var msg901 = msg("00524:13", all322); +var msg901 = msg("00524:13", all317); -var part1453 = // "Pattern{Constant('Response to SNMP request from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' has '), Field(disposition,true), Constant(' due to '), Field(result,false)}" -match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ +var part1448 = match("MESSAGE#891:00524:07", "nwparser.payload", "Response to SNMP request from %{saddr}:%{sport->} to %{daddr}:%{dport->} has %{disposition->} due to %{result}", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg902 = msg("00524:07", part1453); +var msg902 = msg("00524:07", part1448); -var part1454 = // "Pattern{Constant('SNMP community '), Field(fld2,true), Constant(' cannot be added because '), Field(result,false)}" -match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ +var part1449 = match("MESSAGE#892:00524:08", "nwparser.payload", "SNMP community %{fld2->} cannot be added because %{result}", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg903 = msg("00524:08", part1454); +var msg903 = msg("00524:08", part1449); -var part1455 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be added to community '), Field(fld2,true), Constant(' because of '), Field(result,false)}" -match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ +var part1450 = match("MESSAGE#893:00524:09", "nwparser.payload", "SNMP host %{hostip->} cannot be added to community %{fld2->} because of %{result}", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg904 = msg("00524:09", part1455); +var msg904 = msg("00524:09", part1450); -var part1456 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be added because '), Field(result,false)}" -match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ +var part1451 = match("MESSAGE#894:00524:10", "nwparser.payload", "SNMP host %{hostip->} cannot be added because %{result}", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg905 = msg("00524:10", part1456); +var msg905 = msg("00524:10", part1451); -var part1457 = // "Pattern{Constant('SNMP host '), Field(hostip,true), Constant(' cannot be removed from community '), Field(fld2,true), Constant(' because '), Field(result,false)}" -match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ +var part1452 = match("MESSAGE#895:00524:11", "nwparser.payload", "SNMP host %{hostip->} cannot be removed from community %{fld2->} because %{result}", processor_chain([ dup18, dup2, dup4, dup5, ])); -var msg906 = msg("00524:11", part1457); +var msg906 = msg("00524:11", part1452); -var part1458 = // "Pattern{Constant('SNMP user/community '), Field(fld34,true), Constant(' doesn't exist. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ +var part1453 = match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34->} doesn't exist. (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -19264,7 +17482,7 @@ match("MESSAGE#1222:00524:16", "nwparser.payload", "SNMP user/community %{fld34- dup9, ])); -var msg907 = msg("00524:16", part1458); +var msg907 = msg("00524:16", part1453); var select340 = linear_select([ msg893, @@ -19284,9 +17502,8 @@ var select340 = linear_select([ msg907, ]); -var part1459 = // "Pattern{Constant('The new PIN for user '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' has been '), Field(disposition,true), Constant(' by SecurID '), Field(fld2,false)}" -match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ - dup205, +var part1454 = match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username->} at %{hostip->} has been %{disposition->} by SecurID %{fld2}", processor_chain([ + dup203, setc("ec_subject","Password"), dup38, dup2, @@ -19295,40 +17512,37 @@ match("MESSAGE#896:00525", "nwparser.payload", "The new PIN for user %{username- dup5, ])); -var msg908 = msg("00525", part1459); +var msg908 = msg("00525", part1454); -var part1460 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' has selected a system-generated PIN for authentication with SecurID '), Field(fld2,false)}" -match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ - dup205, +var part1455 = match("MESSAGE#897:00525:01", "nwparser.payload", "User %{username->} at %{hostip->} has selected a system-generated PIN for authentication with SecurID %{fld2}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg909 = msg("00525:01", part1460); +var msg909 = msg("00525:01", part1455); -var part1461 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' must enter the "new PIN" for SecurID '), Field(fld2,false)}" -match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ - dup205, +var part1456 = match("MESSAGE#898:00525:02", "nwparser.payload", "User %{username->} at %{hostip->} must enter the \"new PIN\" for SecurID %{fld2}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg910 = msg("00525:02", part1461); +var msg910 = msg("00525:02", part1456); -var part1462 = // "Pattern{Constant('User '), Field(username,true), Constant(' at '), Field(hostip,true), Constant(' must make a "New PIN" choice for SecurID '), Field(fld2,false)}" -match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ - dup205, +var part1457 = match("MESSAGE#899:00525:03", "nwparser.payload", "User %{username->} at %{hostip->} must make a \"New PIN\" choice for SecurID %{fld2}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg911 = msg("00525:03", part1462); +var msg911 = msg("00525:03", part1457); var select341 = linear_select([ msg908, @@ -19337,10 +17551,9 @@ var select341 = linear_select([ msg911, ]); -var part1463 = // "Pattern{Constant('The user limit has been exceeded and '), Field(hostip,true), Constant(' cannot be added')}" -match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ +var part1458 = match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded and %{hostip->} cannot be added", processor_chain([ dup37, - dup221, + dup219, dup38, dup39, dup2, @@ -19349,39 +17562,34 @@ match("MESSAGE#900:00526", "nwparser.payload", "The user limit has been exceeded dup5, ])); -var msg912 = msg("00526", part1463); +var msg912 = msg("00526", part1458); -var part1464 = // "Pattern{Constant('A DHCP-'), Field(p0,false)}" -match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); +var part1459 = match("MESSAGE#901:00527/0", "nwparser.payload", "A DHCP-%{p0}"); -var part1465 = // "Pattern{Constant(' assigned '), Field(p0,false)}" -match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); +var part1460 = match("MESSAGE#901:00527/1_1", "nwparser.p0", " assigned %{p0}"); var select342 = linear_select([ - dup313, - part1465, + dup311, + part1460, ]); -var part1466 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' has been '), Field(p0,false)}" -match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); +var part1461 = match("MESSAGE#901:00527/2", "nwparser.p0", "IP address %{hostip->} has been %{p0}"); -var part1467 = // "Pattern{Constant('freed from '), Field(p0,false)}" -match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); +var part1462 = match("MESSAGE#901:00527/3_1", "nwparser.p0", "freed from %{p0}"); -var part1468 = // "Pattern{Constant('freed '), Field(p0,false)}" -match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); +var part1463 = match("MESSAGE#901:00527/3_2", "nwparser.p0", "freed %{p0}"); var select343 = linear_select([ - dup314, - part1467, - part1468, + dup312, + part1462, + part1463, ]); -var all323 = all_match({ +var all318 = all_match({ processors: [ - part1464, + part1459, select342, - part1466, + part1461, select343, dup108, ], @@ -19394,10 +17602,9 @@ var all323 = all_match({ ]), }); -var msg913 = msg("00527", all323); +var msg913 = msg("00527", all318); -var part1469 = // "Pattern{Constant('A DHCP-assigned IP address has been manually released'), Field(,false)}" -match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ +var part1464 = match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address has been manually released%{}", processor_chain([ dup44, dup2, dup3, @@ -19405,31 +17612,27 @@ match("MESSAGE#902:00527:01", "nwparser.payload", "A DHCP-assigned IP address ha dup5, ])); -var msg914 = msg("00527:01", part1469); +var msg914 = msg("00527:01", part1464); -var part1470 = // "Pattern{Constant('DHCP server has '), Field(p0,false)}" -match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); +var part1465 = match("MESSAGE#903:00527:02/0", "nwparser.payload", "DHCP server has %{p0}"); -var part1471 = // "Pattern{Constant('released '), Field(p0,false)}" -match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); +var part1466 = match("MESSAGE#903:00527:02/1_1", "nwparser.p0", "released %{p0}"); -var part1472 = // "Pattern{Constant('assigned or released '), Field(p0,false)}" -match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); +var part1467 = match("MESSAGE#903:00527:02/1_2", "nwparser.p0", "assigned or released %{p0}"); var select344 = linear_select([ - dup313, - part1471, - part1472, + dup311, + part1466, + part1467, ]); -var part1473 = // "Pattern{Constant('an IP address'), Field(,false)}" -match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); +var part1468 = match("MESSAGE#903:00527:02/2", "nwparser.p0", "an IP address%{}"); -var all324 = all_match({ +var all319 = all_match({ processors: [ - part1470, + part1465, select344, - part1473, + part1468, ], on_success: processor_chain([ dup44, @@ -19440,21 +17643,19 @@ var all324 = all_match({ ]), }); -var msg915 = msg("00527:02", all324); +var msg915 = msg("00527:02", all319); -var part1474 = // "Pattern{Constant('MAC address '), Field(macaddr,true), Constant(' has detected an IP conflict and has declined address '), Field(hostip,false)}" -match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ - dup274, +var part1469 = match("MESSAGE#904:00527:03", "nwparser.payload", "MAC address %{macaddr->} has detected an IP conflict and has declined address %{hostip}", processor_chain([ + dup272, dup2, dup3, dup4, dup5, ])); -var msg916 = msg("00527:03", part1474); +var msg916 = msg("00527:03", part1469); -var part1475 = // "Pattern{Constant('One or more DHCP-assigned IP addresses have been manually released.'), Field(,false)}" -match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ +var part1470 = match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP addresses have been manually released.%{}", processor_chain([ dup44, dup2, dup3, @@ -19462,16 +17663,15 @@ match("MESSAGE#905:00527:04", "nwparser.payload", "One or more DHCP-assigned IP dup5, ])); -var msg917 = msg("00527:04", part1475); +var msg917 = msg("00527:04", part1470); -var part1476 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' is more than '), Field(fld2,true), Constant(' allocated.')}" -match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); +var part1471 = match("MESSAGE#906:00527:05/2", "nwparser.p0", "%{} %{interface->} is more than %{fld2->} allocated."); -var all325 = all_match({ +var all320 = all_match({ processors: [ - dup212, - dup339, - part1476, + dup210, + dup337, + part1471, ], on_success: processor_chain([ dup44, @@ -19482,34 +17682,31 @@ var all325 = all_match({ ]), }); -var msg918 = msg("00527:05", all325); +var msg918 = msg("00527:05", all320); -var part1477 = // "Pattern{Constant('IP address '), Field(hostip,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); +var part1472 = match("MESSAGE#907:00527:06/0", "nwparser.payload", "IP address %{hostip->} %{p0}"); var select345 = linear_select([ dup106, dup127, ]); -var part1478 = // "Pattern{Constant('released from '), Field(p0,false)}" -match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); +var part1473 = match("MESSAGE#907:00527:06/3_1", "nwparser.p0", "released from %{p0}"); var select346 = linear_select([ - dup314, - part1478, + dup312, + part1473, ]); -var part1479 = // "Pattern{Constant(''), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); +var part1474 = match("MESSAGE#907:00527:06/4", "nwparser.p0", "%{fld2->} (%{fld1})"); -var all326 = all_match({ +var all321 = all_match({ processors: [ - part1477, + part1472, select345, dup23, select346, - part1479, + part1474, ], on_success: processor_chain([ dup44, @@ -19521,10 +17718,9 @@ var all326 = all_match({ ]), }); -var msg919 = msg("00527:06", all326); +var msg919 = msg("00527:06", all321); -var part1480 = // "Pattern{Constant('One or more IP addresses have expired. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ +var part1475 = match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have expired. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -19533,10 +17729,9 @@ match("MESSAGE#908:00527:07", "nwparser.payload", "One or more IP addresses have dup5, ])); -var msg920 = msg("00527:07", part1480); +var msg920 = msg("00527:07", part1475); -var part1481 = // "Pattern{Constant('DHCP server on interface '), Field(interface,true), Constant(' received '), Field(protocol_detail,true), Constant(' from '), Field(smacaddr,true), Constant(' requesting out-of-scope IP address '), Field(hostip,false), Constant('/'), Field(mask,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ +var part1476 = match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{interface->} received %{protocol_detail->} from %{smacaddr->} requesting out-of-scope IP address %{hostip}/%{mask->} (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -19545,30 +17740,27 @@ match("MESSAGE#909:00527:08", "nwparser.payload", "DHCP server on interface %{in dup5, ])); -var msg921 = msg("00527:08", part1481); +var msg921 = msg("00527:08", part1476); -var part1482 = // "Pattern{Constant('MAC address '), Field(macaddr,true), Constant(' has '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); +var part1477 = match("MESSAGE#910:00527:09/0", "nwparser.payload", "MAC address %{macaddr->} has %{disposition->} %{p0}"); -var part1483 = // "Pattern{Constant('address '), Field(hostip,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); +var part1478 = match("MESSAGE#910:00527:09/1_0", "nwparser.p0", "address %{hostip->} (%{p0}"); -var part1484 = // "Pattern{Field(hostip,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); +var part1479 = match("MESSAGE#910:00527:09/1_1", "nwparser.p0", "%{hostip->} (%{p0}"); var select347 = linear_select([ - part1483, - part1484, + part1478, + part1479, ]); -var all327 = all_match({ +var all322 = all_match({ processors: [ - part1482, + part1477, select347, dup41, ], on_success: processor_chain([ - dup274, + dup272, dup2, dup3, dup9, @@ -19577,10 +17769,9 @@ var all327 = all_match({ ]), }); -var msg922 = msg("00527:09", all327); +var msg922 = msg("00527:09", all322); -var part1485 = // "Pattern{Constant('One or more IP addresses are expired. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ +var part1480 = match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are expired. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -19589,7 +17780,7 @@ match("MESSAGE#911:00527:10", "nwparser.payload", "One or more IP addresses are dup5, ])); -var msg923 = msg("00527:10", part1485); +var msg923 = msg("00527:10", part1480); var select348 = linear_select([ msg913, @@ -19605,8 +17796,7 @@ var select348 = linear_select([ msg923, ]); -var part1486 = // "Pattern{Constant('SCS: User ''), Field(username,false), Constant('' authenticated using password :')}" -match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ +var part1481 = match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenticated using password :", processor_chain([ setc("eventcategory","1302010000"), dup29, dup31, @@ -19617,66 +17807,60 @@ match("MESSAGE#912:00528", "nwparser.payload", "SCS: User '%{username}' authenti dup5, ])); -var msg924 = msg("00528", part1486); +var msg924 = msg("00528", part1481); -var part1487 = // "Pattern{Constant('SCS: Connection terminated for user '), Field(username,true), Constant(' from')}" -match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ - dup205, +var part1482 = match("MESSAGE#913:00528:01", "nwparser.payload", "SCS: Connection terminated for user %{username->} from", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg925 = msg("00528:01", part1487); +var msg925 = msg("00528:01", part1482); -var part1488 = // "Pattern{Constant('SCS: Disabled for all root/vsys on device. Client host attempting connection to interface ''), Field(interface,false), Constant('' with address '), Field(hostip,true), Constant(' from '), Field(saddr,false)}" -match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ - dup205, +var part1483 = match("MESSAGE#914:00528:02", "nwparser.payload", "SCS: Disabled for all root/vsys on device. Client host attempting connection to interface '%{interface}' with address %{hostip->} from %{saddr}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg926 = msg("00528:02", part1488); +var msg926 = msg("00528:02", part1483); -var part1489 = // "Pattern{Constant('SSH: NetScreen device '), Field(disposition,true), Constant(' to identify itself to the SSH client at '), Field(hostip,false)}" -match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ - dup205, +var part1484 = match("MESSAGE#915:00528:03", "nwparser.payload", "SSH: NetScreen device %{disposition->} to identify itself to the SSH client at %{hostip}", processor_chain([ + dup203, dup2, dup4, dup5, dup3, ])); -var msg927 = msg("00528:03", part1489); +var msg927 = msg("00528:03", part1484); -var part1490 = // "Pattern{Constant('SSH: Incompatible SSH version string has been received from SSH client at '), Field(hostip,false)}" -match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ - dup205, +var part1485 = match("MESSAGE#916:00528:04", "nwparser.payload", "SSH: Incompatible SSH version string has been received from SSH client at %{hostip}", processor_chain([ + dup203, dup2, dup4, dup5, dup3, ])); -var msg928 = msg("00528:04", part1490); +var msg928 = msg("00528:04", part1485); -var part1491 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to send identification string to client host at '), Field(hostip,false)}" -match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ - dup205, +var part1486 = match("MESSAGE#917:00528:05", "nwparser.payload", "SSH: %{disposition->} to send identification string to client host at %{hostip}", processor_chain([ + dup203, dup2, dup3, dup4, dup5, ])); -var msg929 = msg("00528:05", part1491); +var msg929 = msg("00528:05", part1486); -var part1492 = // "Pattern{Constant('SSH: Client at '), Field(saddr,true), Constant(' attempted to connect with invalid version string.')}" -match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ - dup315, +var part1487 = match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} attempted to connect with invalid version string.", processor_chain([ + dup313, dup2, dup3, dup4, @@ -19684,38 +17868,33 @@ match("MESSAGE#918:00528:06", "nwparser.payload", "SSH: Client at %{saddr->} att setc("result","invalid version string"), ])); -var msg930 = msg("00528:06", part1492); +var msg930 = msg("00528:06", part1487); -var part1493 = // "Pattern{Constant('SSH: '), Field(disposition,true), Constant(' to negotiate '), Field(p0,false)}" -match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); +var part1488 = match("MESSAGE#919:00528:07/0", "nwparser.payload", "SSH: %{disposition->} to negotiate %{p0}"); -var part1494 = // "Pattern{Constant('MAC '), Field(p0,false)}" -match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); +var part1489 = match("MESSAGE#919:00528:07/1_1", "nwparser.p0", "MAC %{p0}"); -var part1495 = // "Pattern{Constant('key exchange '), Field(p0,false)}" -match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); +var part1490 = match("MESSAGE#919:00528:07/1_2", "nwparser.p0", "key exchange %{p0}"); -var part1496 = // "Pattern{Constant('host key '), Field(p0,false)}" -match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); +var part1491 = match("MESSAGE#919:00528:07/1_3", "nwparser.p0", "host key %{p0}"); var select349 = linear_select([ dup88, - part1494, - part1495, - part1496, + part1489, + part1490, + part1491, ]); -var part1497 = // "Pattern{Constant('algorithm with host '), Field(hostip,false)}" -match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); +var part1492 = match("MESSAGE#919:00528:07/2", "nwparser.p0", "algorithm with host %{hostip}"); -var all328 = all_match({ +var all323 = all_match({ processors: [ - part1493, + part1488, select349, - part1497, + part1492, ], on_success: processor_chain([ - dup316, + dup314, dup2, dup4, dup5, @@ -19723,55 +17902,50 @@ var all328 = all_match({ ]), }); -var msg931 = msg("00528:07", all328); +var msg931 = msg("00528:07", all323); -var part1498 = // "Pattern{Constant('SSH: Unsupported cipher type '), Field(fld2,true), Constant(' requested from '), Field(saddr,false)}" -match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ - dup316, +var part1493 = match("MESSAGE#920:00528:08", "nwparser.payload", "SSH: Unsupported cipher type %{fld2->} requested from %{saddr}", processor_chain([ + dup314, dup2, dup4, dup5, dup3, ])); -var msg932 = msg("00528:08", part1498); +var msg932 = msg("00528:08", part1493); -var part1499 = // "Pattern{Constant('SSH: Host client has requested NO cipher from '), Field(saddr,false)}" -match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ - dup316, +var part1494 = match("MESSAGE#921:00528:09", "nwparser.payload", "SSH: Host client has requested NO cipher from %{saddr}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg933 = msg("00528:09", part1499); +var msg933 = msg("00528:09", part1494); -var part1500 = // "Pattern{Constant('SSH: Disabled for ''), Field(vsys,false), Constant(''. Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup283, +var part1495 = match("MESSAGE#922:00528:10", "nwparser.payload", "SSH: Disabled for '%{vsys}'. Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg934 = msg("00528:10", part1500); +var msg934 = msg("00528:10", part1495); -var part1501 = // "Pattern{Constant('SSH: Disabled for '), Field(fld2,true), Constant(' Attempted connection '), Field(disposition,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ - dup283, +var part1496 = match("MESSAGE#923:00528:11", "nwparser.payload", "SSH: Disabled for %{fld2->} Attempted connection %{disposition->} from %{saddr}:%{sport}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg935 = msg("00528:11", part1501); +var msg935 = msg("00528:11", part1496); -var part1502 = // "Pattern{Constant('SSH: SSH user '), Field(username,true), Constant(' at '), Field(saddr,true), Constant(' tried unsuccessfully to log in to '), Field(vsys,true), Constant(' using the shared untrusted interface. SSH disabled on that interface.')}" -match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ - dup283, +var part1497 = match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} at %{saddr->} tried unsuccessfully to log in to %{vsys->} using the shared untrusted interface. SSH disabled on that interface.", processor_chain([ + dup281, dup2, dup4, dup5, @@ -19779,51 +17953,44 @@ match("MESSAGE#924:00528:12", "nwparser.payload", "SSH: SSH user %{username->} a setc("disposition","disabled"), ])); -var msg936 = msg("00528:12", part1502); +var msg936 = msg("00528:12", part1497); -var part1503 = // "Pattern{Constant('SSH: SSH client at '), Field(saddr,true), Constant(' tried unsuccessfully to '), Field(p0,false)}" -match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); +var part1498 = match("MESSAGE#925:00528:13/0", "nwparser.payload", "SSH: SSH client at %{saddr->} tried unsuccessfully to %{p0}"); -var part1504 = // "Pattern{Constant('make '), Field(p0,false)}" -match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); +var part1499 = match("MESSAGE#925:00528:13/1_0", "nwparser.p0", "make %{p0}"); -var part1505 = // "Pattern{Constant('establish '), Field(p0,false)}" -match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); +var part1500 = match("MESSAGE#925:00528:13/1_1", "nwparser.p0", "establish %{p0}"); var select350 = linear_select([ - part1504, - part1505, + part1499, + part1500, ]); -var part1506 = // "Pattern{Constant('an SSH connection to '), Field(p0,false)}" -match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); +var part1501 = match("MESSAGE#925:00528:13/2", "nwparser.p0", "an SSH connection to %{p0}"); -var part1507 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' SSH '), Field(p0,false)}" -match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); +var part1502 = match("MESSAGE#925:00528:13/4", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} SSH %{p0}"); -var part1508 = // "Pattern{Constant('not enabled '), Field(p0,false)}" -match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); +var part1503 = match("MESSAGE#925:00528:13/5_0", "nwparser.p0", "not enabled %{p0}"); var select351 = linear_select([ - part1508, + part1503, dup157, ]); -var part1509 = // "Pattern{Constant('on that interface.'), Field(,false)}" -match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); +var part1504 = match("MESSAGE#925:00528:13/6", "nwparser.p0", "on that interface.%{}"); -var all329 = all_match({ +var all324 = all_match({ processors: [ - part1503, + part1498, select350, - part1506, - dup339, - part1507, + part1501, + dup337, + part1502, select351, - part1509, + part1504, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -19831,54 +17998,48 @@ var all329 = all_match({ ]), }); -var msg937 = msg("00528:13", all329); +var msg937 = msg("00528:13", all324); -var part1510 = // "Pattern{Constant('SSH: SSH client '), Field(saddr,true), Constant(' unsuccessfully attempted to make an SSH connection to '), Field(vsys,true), Constant(' SSH was not completely initialized for that system.')}" -match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ - dup283, +var part1505 = match("MESSAGE#926:00528:14", "nwparser.payload", "SSH: SSH client %{saddr->} unsuccessfully attempted to make an SSH connection to %{vsys->} SSH was not completely initialized for that system.", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg938 = msg("00528:14", part1510); +var msg938 = msg("00528:14", part1505); -var part1511 = // "Pattern{Constant('SSH: Admin user '), Field(p0,false)}" -match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); +var part1506 = match("MESSAGE#927:00528:15/0", "nwparser.payload", "SSH: Admin user %{p0}"); -var part1512 = // "Pattern{Field(administrator,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); +var part1507 = match("MESSAGE#927:00528:15/1_1", "nwparser.p0", "%{administrator->} %{p0}"); var select352 = linear_select([ - dup317, - part1512, + dup315, + part1507, ]); -var part1513 = // "Pattern{Constant('at host '), Field(saddr,true), Constant(' requested unsupported '), Field(p0,false)}" -match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); +var part1508 = match("MESSAGE#927:00528:15/2", "nwparser.p0", "at host %{saddr->} requested unsupported %{p0}"); -var part1514 = // "Pattern{Constant('PKA algorithm '), Field(p0,false)}" -match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); +var part1509 = match("MESSAGE#927:00528:15/3_0", "nwparser.p0", "PKA algorithm %{p0}"); -var part1515 = // "Pattern{Constant('authentication method '), Field(p0,false)}" -match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); +var part1510 = match("MESSAGE#927:00528:15/3_1", "nwparser.p0", "authentication method %{p0}"); var select353 = linear_select([ - part1514, - part1515, + part1509, + part1510, ]); -var all330 = all_match({ +var all325 = all_match({ processors: [ - part1511, + part1506, select352, - part1513, + part1508, select353, dup108, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -19886,43 +18047,40 @@ var all330 = all_match({ ]), }); -var msg939 = msg("00528:15", all330); +var msg939 = msg("00528:15", all325); -var part1516 = // "Pattern{Constant('SCP: Admin ''), Field(administrator,false), Constant('' at host '), Field(saddr,true), Constant(' executed invalid scp command: ''), Field(fld2,false), Constant(''')}" -match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ - dup283, +var part1511 = match("MESSAGE#928:00528:16", "nwparser.payload", "SCP: Admin '%{administrator}' at host %{saddr->} executed invalid scp command: '%{fld2}'", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg940 = msg("00528:16", part1516); +var msg940 = msg("00528:16", part1511); -var part1517 = // "Pattern{Constant('SCP: Disabled for ''), Field(username,false), Constant(''. Attempted file transfer failed from host '), Field(saddr,false)}" -match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ - dup283, +var part1512 = match("MESSAGE#929:00528:17", "nwparser.payload", "SCP: Disabled for '%{username}'. Attempted file transfer failed from host %{saddr}", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg941 = msg("00528:17", part1517); +var msg941 = msg("00528:17", part1512); -var part1518 = // "Pattern{Constant('authentication successful for admin user '), Field(p0,false)}" -match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); +var part1513 = match("MESSAGE#930:00528:18/2", "nwparser.p0", "authentication successful for admin user %{p0}"); -var all331 = all_match({ +var all326 = all_match({ processors: [ - dup318, - dup405, - part1518, - dup406, - dup322, + dup316, + dup402, + part1513, + dup403, + dup320, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -19932,46 +18090,44 @@ var all331 = all_match({ ]), }); -var msg942 = msg("00528:18", all331); +var msg942 = msg("00528:18", all326); -var part1519 = // "Pattern{Constant('authentication failed for admin user '), Field(p0,false)}" -match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); +var part1514 = match("MESSAGE#931:00528:26/2", "nwparser.p0", "authentication failed for admin user %{p0}"); -var all332 = all_match({ +var all327 = all_match({ processors: [ - dup318, - dup405, - part1519, - dup406, - dup322, + dup316, + dup402, + part1514, + dup403, + dup320, ], on_success: processor_chain([ - dup208, + dup206, dup29, dup31, dup54, dup2, dup4, dup5, - dup304, + dup302, dup3, setc("event_description","authentication failed for admin user"), ]), }); -var msg943 = msg("00528:26", all332); +var msg943 = msg("00528:26", all327); -var part1520 = // "Pattern{Constant(': SSH user '), Field(username,true), Constant(' has been '), Field(disposition,true), Constant(' using password from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); +var part1515 = match("MESSAGE#932:00528:19/2", "nwparser.p0", ": SSH user %{username->} has been %{disposition->} using password from %{saddr}:%{sport}"); -var all333 = all_match({ +var all328 = all_match({ processors: [ - dup323, - dup407, - part1520, + dup321, + dup404, + part1515, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -19979,19 +18135,18 @@ var all333 = all_match({ ]), }); -var msg944 = msg("00528:19", all333); +var msg944 = msg("00528:19", all328); -var part1521 = // "Pattern{Constant(': Connection has been '), Field(disposition,true), Constant(' for admin user '), Field(administrator,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); +var part1516 = match("MESSAGE#933:00528:20/2", "nwparser.p0", ": Connection has been %{disposition->} for admin user %{administrator->} at %{saddr}:%{sport}"); -var all334 = all_match({ +var all329 = all_match({ processors: [ - dup323, - dup407, - part1521, + dup321, + dup404, + part1516, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -19999,33 +18154,30 @@ var all334 = all_match({ ]), }); -var msg945 = msg("00528:20", all334); +var msg945 = msg("00528:20", all329); -var part1522 = // "Pattern{Constant('SCS: SSH user '), Field(username,true), Constant(' at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has requested PKA RSA authentication, which is not supported for that client.')}" -match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ - dup283, +var part1517 = match("MESSAGE#934:00528:21", "nwparser.payload", "SCS: SSH user %{username->} at %{saddr}:%{sport->} has requested PKA RSA authentication, which is not supported for that client.", processor_chain([ + dup281, dup2, dup4, dup5, dup3, ])); -var msg946 = msg("00528:21", part1522); +var msg946 = msg("00528:21", part1517); -var part1523 = // "Pattern{Constant('SCS: SSH client at '), Field(saddr,true), Constant(' has attempted to make an SCS connection to '), Field(p0,false)}" -match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); +var part1518 = match("MESSAGE#935:00528:22/0", "nwparser.payload", "SCS: SSH client at %{saddr->} has attempted to make an SCS connection to %{p0}"); -var part1524 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' with IP '), Field(hostip,true), Constant(' but '), Field(disposition,true), Constant(' because SCS is not enabled for that interface.')}" -match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); +var part1519 = match("MESSAGE#935:00528:22/2", "nwparser.p0", "%{} %{interface->} with IP %{hostip->} but %{disposition->} because SCS is not enabled for that interface."); -var all335 = all_match({ +var all330 = all_match({ processors: [ - part1523, - dup339, - part1524, + part1518, + dup337, + part1519, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -20034,11 +18186,10 @@ var all335 = all_match({ ]), }); -var msg947 = msg("00528:22", all335); +var msg947 = msg("00528:22", all330); -var part1525 = // "Pattern{Constant('SCS: SSH client at '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' has '), Field(disposition,true), Constant(' to make an SCS connection to vsys '), Field(vsys,true), Constant(' because SCS cannot generate the host and server keys before timing out.')}" -match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ - dup283, +var part1520 = match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:%{sport->} has %{disposition->} to make an SCS connection to vsys %{vsys->} because SCS cannot generate the host and server keys before timing out.", processor_chain([ + dup281, dup2, dup4, dup5, @@ -20046,33 +18197,30 @@ match("MESSAGE#936:00528:23", "nwparser.payload", "SCS: SSH client at %{saddr}:% setc("result","SCS cannot generate the host and server keys before timing out"), ])); -var msg948 = msg("00528:23", part1525); +var msg948 = msg("00528:23", part1520); -var part1526 = // "Pattern{Constant('SSH: '), Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ - dup283, +var part1521 = match("MESSAGE#937:00528:24", "nwparser.payload", "SSH: %{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ + dup281, dup2, dup3, dup4, dup5, ])); -var msg949 = msg("00528:24", part1526); +var msg949 = msg("00528:24", part1521); -var part1527 = // "Pattern{Constant('SSH: Admin '), Field(p0,false)}" -match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); +var part1522 = match("MESSAGE#938:00528:25/0", "nwparser.payload", "SSH: Admin %{p0}"); -var part1528 = // "Pattern{Constant('at host '), Field(saddr,true), Constant(' attempted to be authenticated with no authentication methods enabled.')}" -match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); +var part1523 = match("MESSAGE#938:00528:25/2", "nwparser.p0", "at host %{saddr->} attempted to be authenticated with no authentication methods enabled."); -var all336 = all_match({ +var all331 = all_match({ processors: [ - part1527, - dup406, - part1528, + part1522, + dup403, + part1523, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -20080,7 +18228,7 @@ var all336 = all_match({ ]), }); -var msg950 = msg("00528:25", all336); +var msg950 = msg("00528:25", all331); var select354 = linear_select([ msg924, @@ -20112,25 +18260,22 @@ var select354 = linear_select([ msg950, ]); -var part1529 = // "Pattern{Constant('manually '), Field(p0,false)}" -match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); +var part1524 = match("MESSAGE#939:00529/1_0", "nwparser.p0", "manually %{p0}"); -var part1530 = // "Pattern{Constant('automatically '), Field(p0,false)}" -match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); +var part1525 = match("MESSAGE#939:00529/1_1", "nwparser.p0", "automatically %{p0}"); var select355 = linear_select([ - part1529, - part1530, + part1524, + part1525, ]); -var part1531 = // "Pattern{Constant('refreshed'), Field(,false)}" -match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); +var part1526 = match("MESSAGE#939:00529/2", "nwparser.p0", "refreshed%{}"); -var all337 = all_match({ +var all332 = all_match({ processors: [ dup63, select355, - part1531, + part1526, ], on_success: processor_chain([ dup44, @@ -20141,25 +18286,22 @@ var all337 = all_match({ ]), }); -var msg951 = msg("00529", all337); +var msg951 = msg("00529", all332); -var part1532 = // "Pattern{Constant('DNS entries have been refreshed by '), Field(p0,false)}" -match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); +var part1527 = match("MESSAGE#940:00529:01/0", "nwparser.payload", "DNS entries have been refreshed by %{p0}"); -var part1533 = // "Pattern{Constant('state change'), Field(,false)}" -match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); +var part1528 = match("MESSAGE#940:00529:01/1_0", "nwparser.p0", "state change%{}"); -var part1534 = // "Pattern{Constant('HA'), Field(,false)}" -match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); +var part1529 = match("MESSAGE#940:00529:01/1_1", "nwparser.p0", "HA%{}"); var select356 = linear_select([ - part1533, - part1534, + part1528, + part1529, ]); -var all338 = all_match({ +var all333 = all_match({ processors: [ - part1532, + part1527, select356, ], on_success: processor_chain([ @@ -20171,35 +18313,32 @@ var all338 = all_match({ ]), }); -var msg952 = msg("00529:01", all338); +var msg952 = msg("00529:01", all333); var select357 = linear_select([ msg951, msg952, ]); -var part1535 = // "Pattern{Constant('An IP conflict has been detected and the DHCP client has declined address '), Field(hostip,false)}" -match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ - dup274, +var part1530 = match("MESSAGE#941:00530", "nwparser.payload", "An IP conflict has been detected and the DHCP client has declined address %{hostip}", processor_chain([ + dup272, dup2, dup3, dup4, dup5, ])); -var msg953 = msg("00530", part1535); +var msg953 = msg("00530", part1530); -var part1536 = // "Pattern{Constant('DHCP client IP '), Field(hostip,true), Constant(' for the '), Field(p0,false)}" -match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); +var part1531 = match("MESSAGE#942:00530:01/0", "nwparser.payload", "DHCP client IP %{hostip->} for the %{p0}"); -var part1537 = // "Pattern{Field(,true), Constant(' '), Field(interface,true), Constant(' has been manually released')}" -match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); +var part1532 = match("MESSAGE#942:00530:01/2", "nwparser.p0", "%{} %{interface->} has been manually released"); -var all339 = all_match({ +var all334 = all_match({ processors: [ - part1536, - dup339, - part1537, + part1531, + dup337, + part1532, ], on_success: processor_chain([ dup44, @@ -20210,10 +18349,9 @@ var all339 = all_match({ ]), }); -var msg954 = msg("00530:01", all339); +var msg954 = msg("00530:01", all334); -var part1538 = // "Pattern{Constant('DHCP client is unable to get an IP address for the '), Field(interface,true), Constant(' interface')}" -match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ +var part1533 = match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get an IP address for the %{interface->} interface", processor_chain([ dup18, dup2, dup3, @@ -20221,10 +18359,9 @@ match("MESSAGE#943:00530:02", "nwparser.payload", "DHCP client is unable to get dup5, ])); -var msg955 = msg("00530:02", part1538); +var msg955 = msg("00530:02", part1533); -var part1539 = // "Pattern{Constant('DHCP client lease for '), Field(hostip,true), Constant(' has expired')}" -match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ +var part1534 = match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hostip->} has expired", processor_chain([ dup44, dup2, dup3, @@ -20232,10 +18369,9 @@ match("MESSAGE#944:00530:03", "nwparser.payload", "DHCP client lease for %{hosti dup5, ])); -var msg956 = msg("00530:03", part1539); +var msg956 = msg("00530:03", part1534); -var part1540 = // "Pattern{Constant('DHCP server '), Field(hostip,true), Constant(' has assigned the untrust Interface '), Field(interface,true), Constant(' with lease '), Field(fld2,false), Constant('.')}" -match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ +var part1535 = match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has assigned the untrust Interface %{interface->} with lease %{fld2}.", processor_chain([ dup44, dup2, dup3, @@ -20243,10 +18379,9 @@ match("MESSAGE#945:00530:04", "nwparser.payload", "DHCP server %{hostip->} has a dup5, ])); -var msg957 = msg("00530:04", part1540); +var msg957 = msg("00530:04", part1535); -var part1541 = // "Pattern{Constant('DHCP server '), Field(hostip,true), Constant(' has assigned the '), Field(interface,true), Constant(' interface '), Field(fld2,true), Constant(' with lease '), Field(fld3,false)}" -match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ +var part1536 = match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has assigned the %{interface->} interface %{fld2->} with lease %{fld3}", processor_chain([ dup44, dup2, dup3, @@ -20254,10 +18389,9 @@ match("MESSAGE#946:00530:05", "nwparser.payload", "DHCP server %{hostip->} has a dup5, ])); -var msg958 = msg("00530:05", part1541); +var msg958 = msg("00530:05", part1536); -var part1542 = // "Pattern{Constant('DHCP client is unable to get IP address for the untrust interface.'), Field(,false)}" -match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ +var part1537 = match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get IP address for the untrust interface.%{}", processor_chain([ dup18, dup2, dup3, @@ -20265,7 +18399,7 @@ match("MESSAGE#947:00530:06", "nwparser.payload", "DHCP client is unable to get dup5, ])); -var msg959 = msg("00530:06", part1542); +var msg959 = msg("00530:06", part1537); var select358 = linear_select([ msg953, @@ -20277,13 +18411,12 @@ var select358 = linear_select([ msg959, ]); -var part1543 = // "Pattern{Constant('System clock configurations have been changed by admin '), Field(p0,false)}" -match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); +var part1538 = match("MESSAGE#948:00531/0", "nwparser.payload", "System clock configurations have been changed by admin %{p0}"); -var all340 = all_match({ +var all335 = all_match({ processors: [ - part1543, - dup400, + part1538, + dup397, ], on_success: processor_chain([ dup1, @@ -20295,10 +18428,9 @@ var all340 = all_match({ ]), }); -var msg960 = msg("00531", all340); +var msg960 = msg("00531", all335); -var part1544 = // "Pattern{Constant('failed to get clock through NTP'), Field(,false)}" -match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ +var part1539 = match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through NTP%{}", processor_chain([ dup86, dup2, dup3, @@ -20306,10 +18438,9 @@ match("MESSAGE#949:00531:01", "nwparser.payload", "failed to get clock through N dup5, ])); -var msg961 = msg("00531:01", part1544); +var msg961 = msg("00531:01", part1539); -var part1545 = // "Pattern{Constant('The system clock has been updated through NTP.'), Field(,false)}" -match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ +var part1540 = match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been updated through NTP.%{}", processor_chain([ dup1, dup2, dup3, @@ -20317,38 +18448,33 @@ match("MESSAGE#950:00531:02", "nwparser.payload", "The system clock has been upd dup5, ])); -var msg962 = msg("00531:02", part1545); +var msg962 = msg("00531:02", part1540); -var part1546 = // "Pattern{Constant('The system clock was updated from '), Field(type,true), Constant(' NTP server type '), Field(hostname,true), Constant(' with a'), Field(p0,false)}" -match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); +var part1541 = match("MESSAGE#951:00531:03/0", "nwparser.payload", "The system clock was updated from %{type->} NTP server type %{hostname->} with a%{p0}"); -var part1547 = // "Pattern{Constant(' ms '), Field(p0,false)}" -match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); +var part1542 = match("MESSAGE#951:00531:03/1_0", "nwparser.p0", " ms %{p0}"); var select359 = linear_select([ - part1547, + part1542, dup115, ]); -var part1548 = // "Pattern{Constant('adjustment of '), Field(fld3,false), Constant('. Authentication was '), Field(fld4,false), Constant('. Update mode was '), Field(p0,false)}" -match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); +var part1543 = match("MESSAGE#951:00531:03/2", "nwparser.p0", "adjustment of %{fld3}. Authentication was %{fld4}. Update mode was %{p0}"); -var part1549 = // "Pattern{Field(fld5,false), Constant('('), Field(fld2,false), Constant(')')}" -match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); +var part1544 = match("MESSAGE#951:00531:03/3_0", "nwparser.p0", "%{fld5}(%{fld2})"); -var part1550 = // "Pattern{Field(fld5,false)}" -match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); +var part1545 = match_copy("MESSAGE#951:00531:03/3_1", "nwparser.p0", "fld5"); var select360 = linear_select([ - part1549, - part1550, + part1544, + part1545, ]); -var all341 = all_match({ +var all336 = all_match({ processors: [ - part1546, + part1541, select359, - part1548, + part1543, select360, ], on_success: processor_chain([ @@ -20361,31 +18487,27 @@ var all341 = all_match({ ]), }); -var msg963 = msg("00531:03", all341); +var msg963 = msg("00531:03", all336); -var part1551 = // "Pattern{Constant('The NetScreen device is attempting to contact the '), Field(p0,false)}" -match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); +var part1546 = match("MESSAGE#952:00531:04/0", "nwparser.payload", "The NetScreen device is attempting to contact the %{p0}"); -var part1552 = // "Pattern{Constant('primary backup '), Field(p0,false)}" -match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); +var part1547 = match("MESSAGE#952:00531:04/1_0", "nwparser.p0", "primary backup %{p0}"); -var part1553 = // "Pattern{Constant('secondary backup '), Field(p0,false)}" -match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); +var part1548 = match("MESSAGE#952:00531:04/1_1", "nwparser.p0", "secondary backup %{p0}"); var select361 = linear_select([ - part1552, - part1553, - dup191, + part1547, + part1548, + dup189, ]); -var part1554 = // "Pattern{Constant('NTP server '), Field(hostname,false)}" -match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); +var part1549 = match("MESSAGE#952:00531:04/2", "nwparser.p0", "NTP server %{hostname}"); -var all342 = all_match({ +var all337 = all_match({ processors: [ - part1551, + part1546, select361, - part1554, + part1549, ], on_success: processor_chain([ dup1, @@ -20396,10 +18518,9 @@ var all342 = all_match({ ]), }); -var msg964 = msg("00531:04", all342); +var msg964 = msg("00531:04", all337); -var part1555 = // "Pattern{Constant('No NTP server could be contacted. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ +var part1550 = match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contacted. (%{fld1})", processor_chain([ dup86, dup2, dup3, @@ -20408,10 +18529,9 @@ match("MESSAGE#953:00531:05", "nwparser.payload", "No NTP server could be contac dup5, ])); -var msg965 = msg("00531:05", part1555); +var msg965 = msg("00531:05", part1550); -var part1556 = // "Pattern{Constant('Network Time Protocol adjustment of '), Field(fld2,true), Constant(' from NTP server '), Field(hostname,true), Constant(' exceeds the allowed adjustment of '), Field(fld3,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ +var part1551 = match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustment of %{fld2->} from NTP server %{hostname->} exceeds the allowed adjustment of %{fld3}. (%{fld1})", processor_chain([ dup86, dup2, dup3, @@ -20420,10 +18540,9 @@ match("MESSAGE#954:00531:06", "nwparser.payload", "Network Time Protocol adjustm dup5, ])); -var msg966 = msg("00531:06", part1556); +var msg966 = msg("00531:06", part1551); -var part1557 = // "Pattern{Constant('No acceptable time could be obtained from any NTP server. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ +var part1552 = match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be obtained from any NTP server. (%{fld1})", processor_chain([ dup86, dup2, dup3, @@ -20432,10 +18551,9 @@ match("MESSAGE#955:00531:07", "nwparser.payload", "No acceptable time could be o dup5, ])); -var msg967 = msg("00531:07", part1557); +var msg967 = msg("00531:07", part1552); -var part1558 = // "Pattern{Constant('Administrator '), Field(administrator,true), Constant(' changed the '), Field(change_attribute,true), Constant(' from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' (by '), Field(fld3,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(') ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ +var part1553 = match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator->} changed the %{change_attribute->} from %{change_old->} to %{change_new->} (by %{fld3->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport}) (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -20444,10 +18562,9 @@ match("MESSAGE#956:00531:08", "nwparser.payload", "Administrator %{administrator dup5, ])); -var msg968 = msg("00531:08", part1558); +var msg968 = msg("00531:08", part1553); -var part1559 = // "Pattern{Constant('Network Time Protocol settings changed. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ +var part1554 = match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol settings changed. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -20456,10 +18573,9 @@ match("MESSAGE#957:00531:09", "nwparser.payload", "Network Time Protocol setting dup5, ])); -var msg969 = msg("00531:09", part1559); +var msg969 = msg("00531:09", part1554); -var part1560 = // "Pattern{Constant('NTP server is '), Field(disposition,true), Constant(' on interface '), Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ +var part1555 = match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition->} on interface %{interface->} (%{fld1})", processor_chain([ dup86, dup2, dup3, @@ -20468,10 +18584,9 @@ match("MESSAGE#958:00531:10", "nwparser.payload", "NTP server is %{disposition-> dup5, ])); -var msg970 = msg("00531:10", part1560); +var msg970 = msg("00531:10", part1555); -var part1561 = // "Pattern{Constant('The system clock will be changed from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' received from primary NTP server '), Field(hostip,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ +var part1556 = match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be changed from %{change_old->} to %{change_new->} received from primary NTP server %{hostip->} (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -20481,10 +18596,9 @@ match("MESSAGE#959:00531:11", "nwparser.payload", "The system clock will be chan setc("event_description","system clock changed based on receive from primary NTP server"), ])); -var msg971 = msg("00531:11", part1561); +var msg971 = msg("00531:11", part1556); -var part1562 = // "Pattern{Field(fld35,true), Constant(' NTP server '), Field(saddr,true), Constant(' could not be contacted. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ +var part1557 = match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{saddr->} could not be contacted. (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -20492,7 +18606,7 @@ match("MESSAGE#1223:00531:12", "nwparser.payload", "%{fld35->} NTP server %{sadd dup9, ])); -var msg972 = msg("00531:12", part1562); +var msg972 = msg("00531:12", part1557); var select362 = linear_select([ msg960, @@ -20510,8 +18624,7 @@ var select362 = linear_select([ msg972, ]); -var part1563 = // "Pattern{Constant('VIP server '), Field(hostip,true), Constant(' is now responding')}" -match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ +var part1558 = match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now responding", processor_chain([ dup44, dup2, dup3, @@ -20519,10 +18632,9 @@ match("MESSAGE#960:00533", "nwparser.payload", "VIP server %{hostip->} is now re dup5, ])); -var msg973 = msg("00533", part1563); +var msg973 = msg("00533", part1558); -var part1564 = // "Pattern{Field(fld2,true), Constant(' has been cleared')}" -match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ +var part1559 = match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", processor_chain([ dup44, dup2, dup3, @@ -20530,55 +18642,50 @@ match("MESSAGE#961:00534", "nwparser.payload", "%{fld2->} has been cleared", pro dup5, ])); -var msg974 = msg("00534", part1564); +var msg974 = msg("00534", part1559); -var part1565 = // "Pattern{Constant('Cannot find the CA certificate with distinguished name '), Field(fld2,false)}" -match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ - dup316, +var part1560 = match("MESSAGE#962:00535", "nwparser.payload", "Cannot find the CA certificate with distinguished name %{fld2}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg975 = msg("00535", part1565); +var msg975 = msg("00535", part1560); -var part1566 = // "Pattern{Constant('Distinguished name '), Field(dn,true), Constant(' in the X509 certificate request is '), Field(disposition,false)}" -match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ - dup316, +var part1561 = match("MESSAGE#963:00535:01", "nwparser.payload", "Distinguished name %{dn->} in the X509 certificate request is %{disposition}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg976 = msg("00535:01", part1566); +var msg976 = msg("00535:01", part1561); -var part1567 = // "Pattern{Constant('Local certificate with distinguished name '), Field(dn,true), Constant(' is '), Field(disposition,false)}" -match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ - dup316, +var part1562 = match("MESSAGE#964:00535:02", "nwparser.payload", "Local certificate with distinguished name %{dn->} is %{disposition}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg977 = msg("00535:02", part1567); +var msg977 = msg("00535:02", part1562); -var part1568 = // "Pattern{Constant('PKCS #7 data cannot be decapsulated'), Field(,false)}" -match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ - dup316, +var part1563 = match("MESSAGE#965:00535:03", "nwparser.payload", "PKCS #7 data cannot be decapsulated%{}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg978 = msg("00535:03", part1568); +var msg978 = msg("00535:03", part1563); -var part1569 = // "Pattern{Constant('SCEP_FAILURE message has been received from the CA'), Field(,false)}" -match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ - dup316, +var part1564 = match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been received from the CA%{}", processor_chain([ + dup314, dup2, dup3, dup4, @@ -20586,22 +18693,20 @@ match("MESSAGE#966:00535:04", "nwparser.payload", "SCEP_FAILURE message has been setc("result","SCEP_FAILURE message"), ])); -var msg979 = msg("00535:04", part1569); +var msg979 = msg("00535:04", part1564); -var part1570 = // "Pattern{Constant('PKI error message has been received: '), Field(result,false)}" -match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ - dup316, +var part1565 = match("MESSAGE#967:00535:05", "nwparser.payload", "PKI error message has been received: %{result}", processor_chain([ + dup314, dup2, dup3, dup4, dup5, ])); -var msg980 = msg("00535:05", part1570); +var msg980 = msg("00535:05", part1565); -var part1571 = // "Pattern{Constant('PKI: Saved CA configuration (CA cert subject name '), Field(dn,false), Constant('). ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ - dup316, +var part1566 = match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration (CA cert subject name %{dn}). (%{event_time_string})", processor_chain([ + dup314, dup2, dup3, dup4, @@ -20609,7 +18714,7 @@ match("MESSAGE#968:00535:06", "nwparser.payload", "PKI: Saved CA configuration ( setc("event_description","Saved CA configuration - cert subject name"), ])); -var msg981 = msg("00535:06", part1571); +var msg981 = msg("00535:06", part1566); var select363 = linear_select([ msg975, @@ -20621,31 +18726,26 @@ var select363 = linear_select([ msg981, ]); -var part1572 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); +var part1567 = match("MESSAGE#969:00536:49/0", "nwparser.payload", "IKE %{hostip->} %{p0}"); -var part1573 = // "Pattern{Constant('Phase 2 msg ID '), Field(sessionid,false), Constant(': '), Field(disposition,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); +var part1568 = match("MESSAGE#969:00536:49/1_0", "nwparser.p0", "Phase 2 msg ID %{sessionid}: %{disposition}. %{p0}"); -var part1574 = // "Pattern{Constant('Phase 1: '), Field(disposition,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); +var part1569 = match("MESSAGE#969:00536:49/1_1", "nwparser.p0", "Phase 1: %{disposition->} %{p0}"); -var part1575 = // "Pattern{Constant('phase 2:'), Field(disposition,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); +var part1570 = match("MESSAGE#969:00536:49/1_2", "nwparser.p0", "phase 2:%{disposition}. %{p0}"); -var part1576 = // "Pattern{Constant('phase 1:'), Field(disposition,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); +var part1571 = match("MESSAGE#969:00536:49/1_3", "nwparser.p0", "phase 1:%{disposition}. %{p0}"); var select364 = linear_select([ - part1573, - part1574, - part1575, - part1576, + part1568, + part1569, + part1570, + part1571, ]); -var all343 = all_match({ +var all338 = all_match({ processors: [ - part1572, + part1567, select364, dup10, ], @@ -20659,10 +18759,9 @@ var all343 = all_match({ ]), }); -var msg982 = msg("00536:49", all343); +var msg982 = msg("00536:49", all338); -var part1577 = // "Pattern{Constant('UDP packets have been received from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' at interface '), Field(interface,true), Constant(' at '), Field(daddr,false), Constant('/'), Field(dport,false)}" -match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ +var part1572 = match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received from %{saddr}/%{sport->} at interface %{interface->} at %{daddr}/%{dport}", processor_chain([ dup44, dup2, dup4, @@ -20671,10 +18770,9 @@ match("MESSAGE#970:00536", "nwparser.payload", "UDP packets have been received f dup61, ])); -var msg983 = msg("00536", part1577); +var msg983 = msg("00536", part1572); -var part1578 = // "Pattern{Constant('Attempt to set tunnel ('), Field(fld2,false), Constant(') without IP address at both end points! Check outgoing interface.')}" -match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ +var part1573 = match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2}) without IP address at both end points! Check outgoing interface.", processor_chain([ dup18, dup2, dup3, @@ -20682,10 +18780,9 @@ match("MESSAGE#971:00536:01", "nwparser.payload", "Attempt to set tunnel (%{fld2 dup5, ])); -var msg984 = msg("00536:01", part1578); +var msg984 = msg("00536:01", part1573); -var part1579 = // "Pattern{Constant('Gateway '), Field(fld2,true), Constant(' at '), Field(hostip,true), Constant(' in '), Field(fld4,true), Constant(' mode with ID: '), Field(fld3,true), Constant(' has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ +var part1574 = match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip->} in %{fld4->} mode with ID: %{fld3->} has been %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -20693,10 +18790,9 @@ match("MESSAGE#972:00536:02", "nwparser.payload", "Gateway %{fld2->} at %{hostip dup5, ])); -var msg985 = msg("00536:02", part1579); +var msg985 = msg("00536:02", part1574); -var part1580 = // "Pattern{Constant('IKE gateway '), Field(fld2,true), Constant(' has been '), Field(disposition,false), Constant('. '), Field(info,false)}" -match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ +var part1575 = match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has been %{disposition}. %{info}", processor_chain([ dup1, dup2, dup3, @@ -20704,10 +18800,9 @@ match("MESSAGE#973:00536:03", "nwparser.payload", "IKE gateway %{fld2->} has bee dup5, ])); -var msg986 = msg("00536:03", part1580); +var msg986 = msg("00536:03", part1575); -var part1581 = // "Pattern{Constant('VPN monitoring for VPN '), Field(group,true), Constant(' has deactivated the SA with ID '), Field(fld2,false), Constant('.')}" -match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ +var part1576 = match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{group->} has deactivated the SA with ID %{fld2}.", processor_chain([ setc("eventcategory","1801010100"), dup2, dup3, @@ -20715,10 +18810,9 @@ match("MESSAGE#974:00536:04", "nwparser.payload", "VPN monitoring for VPN %{grou dup5, ])); -var msg987 = msg("00536:04", part1581); +var msg987 = msg("00536:04", part1576); -var part1582 = // "Pattern{Constant('VPN ID number cannot be assigned'), Field(,false)}" -match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ +var part1577 = match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assigned%{}", processor_chain([ dup44, dup2, dup3, @@ -20726,10 +18820,9 @@ match("MESSAGE#975:00536:05", "nwparser.payload", "VPN ID number cannot be assig dup5, ])); -var msg988 = msg("00536:05", part1582); +var msg988 = msg("00536:05", part1577); -var part1583 = // "Pattern{Constant('Local gateway IP address has changed to '), Field(fld2,false), Constant('. VPNs cannot terminate at an interface with IP '), Field(hostip,false)}" -match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ +var part1578 = match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has changed to %{fld2}. VPNs cannot terminate at an interface with IP %{hostip}", processor_chain([ dup1, dup2, dup3, @@ -20737,10 +18830,9 @@ match("MESSAGE#976:00536:06", "nwparser.payload", "Local gateway IP address has dup5, ])); -var msg989 = msg("00536:06", part1583); +var msg989 = msg("00536:06", part1578); -var part1584 = // "Pattern{Constant('Local gateway IP address has changed from '), Field(change_old,true), Constant(' to another setting')}" -match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ +var part1579 = match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has changed from %{change_old->} to another setting", processor_chain([ dup1, dup2, dup3, @@ -20748,10 +18840,9 @@ match("MESSAGE#977:00536:07", "nwparser.payload", "Local gateway IP address has dup5, ])); -var msg990 = msg("00536:07", part1584); +var msg990 = msg("00536:07", part1579); -var part1585 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Sent initial contact notification message')}" -match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ +var part1580 = match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification message", processor_chain([ dup44, dup2, dup3, @@ -20759,10 +18850,9 @@ match("MESSAGE#978:00536:08", "nwparser.payload", "IKE %{hostip}: Sent initial c dup5, ])); -var msg991 = msg("00536:08", part1585); +var msg991 = msg("00536:08", part1580); -var part1586 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Sent initial contact notification')}" -match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ +var part1581 = match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial contact notification", processor_chain([ dup44, dup2, dup3, @@ -20770,10 +18860,9 @@ match("MESSAGE#979:00536:09", "nwparser.payload", "IKE %{hostip}: Sent initial c dup5, ])); -var msg992 = msg("00536:09", part1586); +var msg992 = msg("00536:09", part1581); -var part1587 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Responded to a packet with a bad SPI after rebooting')}" -match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ +var part1582 = match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a packet with a bad SPI after rebooting", processor_chain([ dup44, dup2, dup3, @@ -20781,10 +18870,9 @@ match("MESSAGE#980:00536:10", "nwparser.payload", "IKE %{hostip}: Responded to a dup5, ])); -var msg993 = msg("00536:10", part1587); +var msg993 = msg("00536:10", part1582); -var part1588 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Removed Phase 2 SAs after receiving a notification message')}" -match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ +var part1583 = match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase 2 SAs after receiving a notification message", processor_chain([ dup44, dup2, dup3, @@ -20792,10 +18880,9 @@ match("MESSAGE#981:00536:11", "nwparser.payload", "IKE %{hostip}: Removed Phase dup5, ])); -var msg994 = msg("00536:11", part1588); +var msg994 = msg("00536:11", part1583); -var part1589 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Rejected first Phase 1 packet from an unrecognized source')}" -match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ +var part1584 = match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first Phase 1 packet from an unrecognized source", processor_chain([ dup44, dup2, dup3, @@ -20803,10 +18890,9 @@ match("MESSAGE#982:00536:12", "nwparser.payload", "IKE %{hostip}: Rejected first dup5, ])); -var msg995 = msg("00536:12", part1589); +var msg995 = msg("00536:12", part1584); -var part1590 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Rejected an initial Phase 1 packet from an unrecognized peer gateway')}" -match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ +var part1585 = match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an initial Phase 1 packet from an unrecognized peer gateway", processor_chain([ dup44, dup2, dup3, @@ -20814,19 +18900,17 @@ match("MESSAGE#983:00536:13", "nwparser.payload", "IKE %{hostip}: Rejected an in dup5, ])); -var msg996 = msg("00536:13", part1590); +var msg996 = msg("00536:13", part1585); -var part1591 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received initial contact notification and removed Phase '), Field(p0,false)}" -match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); +var part1586 = match("MESSAGE#984:00536:14/0", "nwparser.payload", "IKE %{hostip}: Received initial contact notification and removed Phase %{p0}"); -var part1592 = // "Pattern{Constant('SAs'), Field(,false)}" -match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); +var part1587 = match("MESSAGE#984:00536:14/2", "nwparser.p0", "SAs%{}"); -var all344 = all_match({ +var all339 = all_match({ processors: [ - part1591, - dup386, - part1592, + part1586, + dup383, + part1587, ], on_success: processor_chain([ dup44, @@ -20837,10 +18921,9 @@ var all344 = all_match({ ]), }); -var msg997 = msg("00536:14", all344); +var msg997 = msg("00536:14", all339); -var part1593 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received a notification message for '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ +var part1588 = match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a notification message for %{disposition}. (%{fld1})", processor_chain([ dup44, dup2, dup9, @@ -20849,10 +18932,9 @@ match("MESSAGE#985:00536:50", "nwparser.payload", "IKE %{hostip}: Received a not dup5, ])); -var msg998 = msg("00536:50", part1593); +var msg998 = msg("00536:50", part1588); -var part1594 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received incorrect ID payload: IP address '), Field(fld2,true), Constant(' instead of IP address '), Field(fld3,false)}" -match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ +var part1589 = match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incorrect ID payload: IP address %{fld2->} instead of IP address %{fld3}", processor_chain([ dup44, dup2, dup3, @@ -20860,10 +18942,9 @@ match("MESSAGE#986:00536:15", "nwparser.payload", "IKE %{hostip}: Received incor dup5, ])); -var msg999 = msg("00536:15", part1594); +var msg999 = msg("00536:15", part1589); -var part1595 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Phase 2 negotiation request is already in the task list')}" -match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ +var part1590 = match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negotiation request is already in the task list", processor_chain([ dup44, dup2, dup3, @@ -20871,10 +18952,9 @@ match("MESSAGE#987:00536:16", "nwparser.payload", "IKE %{hostip}: Phase 2 negoti dup5, ])); -var msg1000 = msg("00536:16", part1595); +var msg1000 = msg("00536:16", part1590); -var part1596 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Heartbeats have been lost '), Field(fld2,true), Constant(' times')}" -match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ +var part1591 = match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats have been lost %{fld2->} times", processor_chain([ dup44, dup2, dup3, @@ -20882,10 +18962,9 @@ match("MESSAGE#988:00536:17", "nwparser.payload", "IKE %{hostip}: Heartbeats hav dup5, ])); -var msg1001 = msg("00536:17", part1596); +var msg1001 = msg("00536:17", part1591); -var part1597 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Dropped peer packet because no policy uses the peer configuration')}" -match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ +var part1592 = match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer packet because no policy uses the peer configuration", processor_chain([ dup44, dup2, dup3, @@ -20893,10 +18972,9 @@ match("MESSAGE#989:00536:18", "nwparser.payload", "IKE %{hostip}: Dropped peer p dup5, ])); -var msg1002 = msg("00536:18", part1597); +var msg1002 = msg("00536:18", part1592); -var part1598 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Dropped packet because remote gateway OK is not used in any VPN tunnel configurations')}" -match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ +var part1593 = match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet because remote gateway OK is not used in any VPN tunnel configurations", processor_chain([ dup44, dup2, dup3, @@ -20904,10 +18982,9 @@ match("MESSAGE#990:00536:19", "nwparser.payload", "IKE %{hostip}: Dropped packet dup5, ])); -var msg1003 = msg("00536:19", part1598); +var msg1003 = msg("00536:19", part1593); -var part1599 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Added the initial contact task to the task list')}" -match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ +var part1594 = match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the initial contact task to the task list", processor_chain([ dup44, dup2, dup3, @@ -20915,10 +18992,9 @@ match("MESSAGE#991:00536:20", "nwparser.payload", "IKE %{hostip}: Added the init dup5, ])); -var msg1004 = msg("00536:20", part1599); +var msg1004 = msg("00536:20", part1594); -var part1600 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Added Phase 2 session tasks to the task list')}" -match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ +var part1595 = match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 session tasks to the task list", processor_chain([ dup44, dup2, dup3, @@ -20926,10 +19002,9 @@ match("MESSAGE#992:00536:21", "nwparser.payload", "IKE %{hostip}: Added Phase 2 dup5, ])); -var msg1005 = msg("00536:21", part1600); +var msg1005 = msg("00536:21", part1595); -var part1601 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1 : '), Field(disposition,true), Constant(' proposals from peer. Negotiations failed')}" -match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ +var part1596 = match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{disposition->} proposals from peer. Negotiations failed", processor_chain([ dup44, dup2, dup3, @@ -20938,10 +19013,9 @@ match("MESSAGE#993:00536:22", "nwparser.payload", "IKE %{hostip->} Phase 1 : %{d setc("result","Negotiations failed"), ])); -var msg1006 = msg("00536:22", part1601); +var msg1006 = msg("00536:22", part1596); -var part1602 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1 : Aborted negotiations because the time limit has elapsed')}" -match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ +var part1597 = match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Aborted negotiations because the time limit has elapsed", processor_chain([ dup44, dup2, dup3, @@ -20951,10 +19025,9 @@ match("MESSAGE#994:00536:23", "nwparser.payload", "IKE %{hostip->} Phase 1 : Abo setc("disposition","Aborted"), ])); -var msg1007 = msg("00536:23", part1602); +var msg1007 = msg("00536:23", part1597); -var part1603 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled')}" -match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ +var part1598 = match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Received a message but did not check a policy because id-mode is set to IP or policy-checking is disabled", processor_chain([ dup44, dup2, dup3, @@ -20962,10 +19035,9 @@ match("MESSAGE#995:00536:24", "nwparser.payload", "IKE %{hostip->} Phase 2: Rece dup5, ])); -var msg1008 = msg("00536:24", part1603); +var msg1008 = msg("00536:24", part1598); -var part1604 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Received DH group '), Field(fld2,true), Constant(' instead of expected group '), Field(fld3,true), Constant(' for PFS')}" -match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ +var part1599 = match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Received DH group %{fld2->} instead of expected group %{fld3->} for PFS", processor_chain([ dup44, dup2, dup3, @@ -20973,10 +19045,9 @@ match("MESSAGE#996:00536:25", "nwparser.payload", "IKE %{hostip->} Phase 2: Rece dup5, ])); -var msg1009 = msg("00536:25", part1604); +var msg1009 = msg("00536:25", part1599); -var part1605 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: No policy exists for the proxy ID received: local ID '), Field(fld2,true), Constant(' remote ID '), Field(fld3,false)}" -match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ +var part1600 = match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No policy exists for the proxy ID received: local ID %{fld2->} remote ID %{fld3}", processor_chain([ dup44, dup2, dup3, @@ -20984,10 +19055,9 @@ match("MESSAGE#997:00536:26", "nwparser.payload", "IKE %{hostip->} Phase 2: No p dup5, ])); -var msg1010 = msg("00536:26", part1605); +var msg1010 = msg("00536:26", part1600); -var part1606 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: RSA private key is needed to sign packets')}" -match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ +var part1601 = match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA private key is needed to sign packets", processor_chain([ dup44, dup2, dup3, @@ -20995,10 +19065,9 @@ match("MESSAGE#998:00536:27", "nwparser.payload", "IKE %{hostip->} Phase 1: RSA dup5, ])); -var msg1011 = msg("00536:27", part1606); +var msg1011 = msg("00536:27", part1601); -var part1607 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Aggressive mode negotiations have '), Field(disposition,false)}" -match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ +var part1602 = match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggressive mode negotiations have %{disposition}", processor_chain([ dup44, dup2, dup3, @@ -21006,10 +19075,9 @@ match("MESSAGE#999:00536:28", "nwparser.payload", "IKE %{hostip->} Phase 1: Aggr dup5, ])); -var msg1012 = msg("00536:28", part1607); +var msg1012 = msg("00536:28", part1602); -var part1608 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Vendor ID payload indicates that the peer does not support NAT-T')}" -match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ +var part1603 = match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Vendor ID payload indicates that the peer does not support NAT-T", processor_chain([ dup44, dup2, dup3, @@ -21017,10 +19085,9 @@ match("MESSAGE#1000:00536:29", "nwparser.payload", "IKE %{hostip->} Phase 1: Ven dup5, ])); -var msg1013 = msg("00536:29", part1608); +var msg1013 = msg("00536:29", part1603); -var part1609 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Retransmission limit has been reached')}" -match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ +var part1604 = match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Retransmission limit has been reached", processor_chain([ dup44, dup2, dup3, @@ -21028,10 +19095,9 @@ match("MESSAGE#1001:00536:30", "nwparser.payload", "IKE %{hostip->} Phase 1: Ret dup5, ])); -var msg1014 = msg("00536:30", part1609); +var msg1014 = msg("00536:30", part1604); -var part1610 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Received an invalid RSA signature')}" -match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ +var part1605 = match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an invalid RSA signature", processor_chain([ dup44, dup2, dup3, @@ -21039,10 +19105,9 @@ match("MESSAGE#1002:00536:31", "nwparser.payload", "IKE %{hostip->} Phase 1: Rec dup5, ])); -var msg1015 = msg("00536:31", part1610); +var msg1015 = msg("00536:31", part1605); -var part1611 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Received an incorrect public key authentication method')}" -match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ +var part1606 = match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Received an incorrect public key authentication method", processor_chain([ dup44, dup2, dup3, @@ -21050,10 +19115,9 @@ match("MESSAGE#1003:00536:32", "nwparser.payload", "IKE %{hostip->} Phase 1: Rec dup5, ])); -var msg1016 = msg("00536:32", part1611); +var msg1016 = msg("00536:32", part1606); -var part1612 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: No private key exists to sign packets')}" -match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ +var part1607 = match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No private key exists to sign packets", processor_chain([ dup44, dup2, dup3, @@ -21061,10 +19125,9 @@ match("MESSAGE#1004:00536:33", "nwparser.payload", "IKE %{hostip->} Phase 1: No dup5, ])); -var msg1017 = msg("00536:33", part1612); +var msg1017 = msg("00536:33", part1607); -var part1613 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID')}" -match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ +var part1608 = match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Main mode packet has arrived with ID type IP address but no user configuration was found for that ID", processor_chain([ dup44, dup2, dup3, @@ -21072,10 +19135,9 @@ match("MESSAGE#1005:00536:34", "nwparser.payload", "IKE %{hostip->} Phase 1: Mai dup5, ])); -var msg1018 = msg("00536:34", part1613); +var msg1018 = msg("00536:34", part1608); -var part1614 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: IKE initiator has detected NAT in front of the local device')}" -match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ +var part1609 = match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE initiator has detected NAT in front of the local device", processor_chain([ dup44, dup2, dup3, @@ -21083,19 +19145,17 @@ match("MESSAGE#1006:00536:35", "nwparser.payload", "IKE %{hostip->} Phase 1: IKE dup5, ])); -var msg1019 = msg("00536:35", part1614); +var msg1019 = msg("00536:35", part1609); -var part1615 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Discarded a second initial packet'), Field(p0,false)}" -match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); +var part1610 = match("MESSAGE#1007:00536:36/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Discarded a second initial packet%{p0}"); -var part1616 = // "Pattern{Field(,false), Constant('which arrived within '), Field(fld2,true), Constant(' after the first')}" -match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); +var part1611 = match("MESSAGE#1007:00536:36/2", "nwparser.p0", "%{}which arrived within %{fld2->} after the first"); -var all345 = all_match({ +var all340 = all_match({ processors: [ - part1615, - dup404, - part1616, + part1610, + dup401, + part1611, ], on_success: processor_chain([ dup44, @@ -21106,10 +19166,19 @@ var all345 = all_match({ ]), }); -var msg1020 = msg("00536:36", all345); +var msg1020 = msg("00536:36", all340); + +var part1612 = match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ + dup44, + dup2, + dup3, + dup4, + dup5, +])); + +var msg1021 = msg("00536:37", part1612); -var part1617 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Completed Aggressive mode negotiations with a '), Field(fld2,true), Constant(' lifetime')}" -match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Completed Aggressive mode negotiations with a %{fld2->} lifetime", processor_chain([ +var part1613 = match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ dup44, dup2, dup3, @@ -21117,10 +19186,9 @@ match("MESSAGE#1008:00536:37", "nwparser.payload", "IKE %{hostip->} Phase 1: Com dup5, ])); -var msg1021 = msg("00536:37", part1617); +var msg1022 = msg("00536:38", part1613); -var part1618 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Certificate received has a subject name that does not match the ID payload')}" -match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a subject name that does not match the ID payload", processor_chain([ +var part1614 = match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ dup44, dup2, dup3, @@ -21128,10 +19196,9 @@ match("MESSAGE#1009:00536:38", "nwparser.payload", "IKE %{hostip->} Phase 1: Cer dup5, ])); -var msg1022 = msg("00536:38", part1618); +var msg1023 = msg("00536:39", part1614); -var part1619 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Certificate received has a different IP address '), Field(fld2,true), Constant(' than expected')}" -match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Certificate received has a different IP address %{fld2->} than expected", processor_chain([ +var part1615 = match("MESSAGE#1011:00536:40", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{quote}s gateway has a dynamic IP address and negotiations are in Main mode", processor_chain([ dup44, dup2, dup3, @@ -21139,33 +19206,9 @@ match("MESSAGE#1010:00536:39", "nwparser.payload", "IKE %{hostip->} Phase 1: Cer dup5, ])); -var msg1023 = msg("00536:39", part1619); - -var part1620 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Cannot use a preshared key because the peer'), Field(p0,false)}" -match("MESSAGE#1011:00536:40/0", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot use a preshared key because the peer%{p0}"); - -var part1621 = // "Pattern{Constant('s gateway has a dynamic IP address and negotiations are in Main mode'), Field(,false)}" -match("MESSAGE#1011:00536:40/2", "nwparser.p0", "s gateway has a dynamic IP address and negotiations are in Main mode%{}"); - -var all346 = all_match({ - processors: [ - part1620, - dup363, - part1621, - ], - on_success: processor_chain([ - dup44, - dup2, - dup3, - dup4, - dup5, - ]), -}); - -var msg1024 = msg("00536:40", all346); +var msg1024 = msg("00536:40", part1615); -var part1622 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Initiated negotiations in Aggressive mode')}" -match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ +var part1616 = match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated negotiations in Aggressive mode", processor_chain([ dup44, dup2, dup3, @@ -21173,10 +19216,9 @@ match("MESSAGE#1012:00536:47", "nwparser.payload", "IKE %{hostip->} Phase 1: Ini dup5, ])); -var msg1025 = msg("00536:47", part1622); +var msg1025 = msg("00536:47", part1616); -var part1623 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Cannot verify RSA signature')}" -match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ +var part1617 = match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Cannot verify RSA signature", processor_chain([ dup44, dup2, dup3, @@ -21184,10 +19226,9 @@ match("MESSAGE#1013:00536:41", "nwparser.payload", "IKE %{hostip->} Phase 1: Can dup5, ])); -var msg1026 = msg("00536:41", part1623); +var msg1026 = msg("00536:41", part1617); -var part1624 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 1: Initiated Main mode negotiations')}" -match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ +var part1618 = match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Initiated Main mode negotiations", processor_chain([ dup44, dup2, dup3, @@ -21195,10 +19236,9 @@ match("MESSAGE#1014:00536:42", "nwparser.payload", "IKE %{hostip->} Phase 1: Ini dup5, ])); -var msg1027 = msg("00536:42", part1624); +var msg1027 = msg("00536:42", part1618); -var part1625 = // "Pattern{Constant('IKE '), Field(hostip,true), Constant(' Phase 2: Initiated negotiations')}" -match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ +var part1619 = match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Initiated negotiations", processor_chain([ dup44, dup2, dup3, @@ -21206,10 +19246,9 @@ match("MESSAGE#1015:00536:43", "nwparser.payload", "IKE %{hostip->} Phase 2: Ini dup5, ])); -var msg1028 = msg("00536:43", part1625); +var msg1028 = msg("00536:43", part1619); -var part1626 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Changed heartbeat interval to '), Field(fld2,false)}" -match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ +var part1620 = match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heartbeat interval to %{fld2}", processor_chain([ dup44, dup2, dup3, @@ -21217,10 +19256,9 @@ match("MESSAGE#1016:00536:44", "nwparser.payload", "IKE %{hostip}: Changed heart dup5, ])); -var msg1029 = msg("00536:44", part1626); +var msg1029 = msg("00536:44", part1620); -var part1627 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Heartbeats have been '), Field(disposition,true), Constant(' because '), Field(result,false)}" -match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ +var part1621 = match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats have been %{disposition->} because %{result}", processor_chain([ dup44, dup2, dup3, @@ -21228,10 +19266,9 @@ match("MESSAGE#1017:00536:45", "nwparser.payload", "IKE %{hostip}: Heartbeats ha dup5, ])); -var msg1030 = msg("00536:45", part1627); +var msg1030 = msg("00536:45", part1621); -var part1628 = // "Pattern{Constant('Received an IKE packet on '), Field(interface,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('/'), Field(fld1,false), Constant('. Cookies: '), Field(ike_cookie1,false), Constant(', '), Field(ike_cookie2,false), Constant('. ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ +var part1622 = match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{interface->} from %{saddr}:%{sport->} to %{daddr}:%{dport}/%{fld1}. Cookies: %{ike_cookie1}, %{ike_cookie2}. (%{event_time_string})", processor_chain([ dup44, dup2, dup3, @@ -21240,10 +19277,9 @@ match("MESSAGE#1018:00536:48", "nwparser.payload", "Received an IKE packet on %{ setc("event_description","Received an IKE packet on interface"), ])); -var msg1031 = msg("00536:48", part1628); +var msg1031 = msg("00536:48", part1622); -var part1629 = // "Pattern{Constant('IKE '), Field(hostip,false), Constant(': Received a bad SPI')}" -match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ +var part1623 = match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a bad SPI", processor_chain([ dup44, dup2, dup3, @@ -21251,7 +19287,7 @@ match("MESSAGE#1019:00536:46", "nwparser.payload", "IKE %{hostip}: Received a ba dup5, ])); -var msg1032 = msg("00536:46", part1629); +var msg1032 = msg("00536:46", part1623); var select365 = linear_select([ msg982, @@ -21307,8 +19343,7 @@ var select365 = linear_select([ msg1032, ]); -var part1630 = // "Pattern{Constant('PPPoE '), Field(disposition,true), Constant(' to establish a session: '), Field(info,false)}" -match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ +var part1624 = match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to establish a session: %{info}", processor_chain([ dup18, dup2, dup4, @@ -21316,10 +19351,9 @@ match("MESSAGE#1020:00537", "nwparser.payload", "PPPoE %{disposition->} to estab dup3, ])); -var msg1033 = msg("00537", part1630); +var msg1033 = msg("00537", part1624); -var part1631 = // "Pattern{Constant('PPPoE session shuts down: '), Field(result,false)}" -match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ +var part1625 = match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{result}", processor_chain([ dup18, dup2, dup3, @@ -21327,10 +19361,9 @@ match("MESSAGE#1021:00537:01", "nwparser.payload", "PPPoE session shuts down: %{ dup5, ])); -var msg1034 = msg("00537:01", part1631); +var msg1034 = msg("00537:01", part1625); -var part1632 = // "Pattern{Constant('The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: '), Field(result,false)}" -match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ +var part1626 = match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethernet (PPPoE) connection failed to establish a session: %{result}", processor_chain([ dup18, dup2, dup3, @@ -21338,10 +19371,9 @@ match("MESSAGE#1022:00537:02", "nwparser.payload", "The Point-to-Point over Ethe dup5, ])); -var msg1035 = msg("00537:02", part1632); +var msg1035 = msg("00537:02", part1626); -var part1633 = // "Pattern{Constant('PPPoE session has successfully established'), Field(,false)}" -match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ +var part1627 = match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successfully established%{}", processor_chain([ dup44, dup2, dup3, @@ -21349,7 +19381,7 @@ match("MESSAGE#1023:00537:03", "nwparser.payload", "PPPoE session has successful dup5, ])); -var msg1036 = msg("00537:03", part1633); +var msg1036 = msg("00537:03", part1627); var select366 = linear_select([ msg1033, @@ -21358,22 +19390,20 @@ var select366 = linear_select([ msg1036, ]); -var part1634 = // "Pattern{Constant('NACN failed to register to Policy Manager '), Field(fld2,true), Constant(' because '), Field(p0,false)}" -match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); +var part1628 = match("MESSAGE#1024:00538/0", "nwparser.payload", "NACN failed to register to Policy Manager %{fld2->} because %{p0}"); var select367 = linear_select([ dup111, dup119, ]); -var part1635 = // "Pattern{Constant(''), Field(result,false)}" -match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); +var part1629 = match("MESSAGE#1024:00538/2", "nwparser.p0", "%{result}"); -var all347 = all_match({ +var all341 = all_match({ processors: [ - part1634, + part1628, select367, - part1635, + part1629, ], on_success: processor_chain([ dup44, @@ -21384,10 +19414,9 @@ var all347 = all_match({ ]), }); -var msg1037 = msg("00538", all347); +var msg1037 = msg("00538", all341); -var part1636 = // "Pattern{Constant('NACN successfully registered to Policy Manager '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ +var part1630 = match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered to Policy Manager %{fld2}.", processor_chain([ dup44, dup2, dup3, @@ -21395,10 +19424,9 @@ match("MESSAGE#1025:00538:01", "nwparser.payload", "NACN successfully registered dup5, ])); -var msg1038 = msg("00538:01", part1636); +var msg1038 = msg("00538:01", part1630); -var part1637 = // "Pattern{Constant('The NACN protocol has started for Policy Manager '), Field(fld2,true), Constant(' on hostname '), Field(hostname,true), Constant(' IP address '), Field(hostip,true), Constant(' port '), Field(network_port,false), Constant('.')}" -match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ +var part1631 = match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has started for Policy Manager %{fld2->} on hostname %{hostname->} IP address %{hostip->} port %{network_port}.", processor_chain([ dup44, dup2, dup3, @@ -21406,10 +19434,9 @@ match("MESSAGE#1026:00538:02", "nwparser.payload", "The NACN protocol has starte dup5, ])); -var msg1039 = msg("00538:02", part1637); +var msg1039 = msg("00538:02", part1631); -var part1638 = // "Pattern{Constant('Cannot connect to NSM Server at '), Field(hostip,true), Constant(' ('), Field(fld2,true), Constant(' connect attempt(s)) '), Field(fld3,false)}" -match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ +var part1632 = match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server at %{hostip->} (%{fld2->} connect attempt(s)) %{fld3}", processor_chain([ dup19, dup2, dup4, @@ -21417,10 +19444,9 @@ match("MESSAGE#1027:00538:03", "nwparser.payload", "Cannot connect to NSM Server dup3, ])); -var msg1040 = msg("00538:03", part1638); +var msg1040 = msg("00538:03", part1632); -var part1639 = // "Pattern{Constant('Device is not known to Global PRO data collector at '), Field(hostip,false)}" -match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ +var part1633 = match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Global PRO data collector at %{hostip}", processor_chain([ dup27, dup2, dup3, @@ -21428,30 +19454,26 @@ match("MESSAGE#1028:00538:04", "nwparser.payload", "Device is not known to Globa dup5, ])); -var msg1041 = msg("00538:04", part1639); +var msg1041 = msg("00538:04", part1633); -var part1640 = // "Pattern{Constant('Lost '), Field(p0,false)}" -match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); +var part1634 = match("MESSAGE#1029:00538:05/0", "nwparser.payload", "Lost %{p0}"); -var part1641 = // "Pattern{Constant('socket connection'), Field(p0,false)}" -match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); +var part1635 = match("MESSAGE#1029:00538:05/1_0", "nwparser.p0", "socket connection%{p0}"); -var part1642 = // "Pattern{Constant('connection'), Field(p0,false)}" -match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); +var part1636 = match("MESSAGE#1029:00538:05/1_1", "nwparser.p0", "connection%{p0}"); var select368 = linear_select([ - part1641, - part1642, + part1635, + part1636, ]); -var part1643 = // "Pattern{Field(,false), Constant('to Global PRO data collector at '), Field(hostip,false)}" -match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); +var part1637 = match("MESSAGE#1029:00538:05/2", "nwparser.p0", "%{}to Global PRO data collector at %{hostip}"); -var all348 = all_match({ +var all342 = all_match({ processors: [ - part1640, + part1634, select368, - part1643, + part1637, ], on_success: processor_chain([ dup27, @@ -21462,30 +19484,26 @@ var all348 = all_match({ ]), }); -var msg1042 = msg("00538:05", all348); +var msg1042 = msg("00538:05", all342); -var part1644 = // "Pattern{Constant('Device has connected to the Global PRO'), Field(p0,false)}" -match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); +var part1638 = match("MESSAGE#1030:00538:06/0", "nwparser.payload", "Device has connected to the Global PRO%{p0}"); -var part1645 = // "Pattern{Constant(' '), Field(fld2,true), Constant(' primary data collector at '), Field(p0,false)}" -match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); +var part1639 = match("MESSAGE#1030:00538:06/1_0", "nwparser.p0", " %{fld2->} primary data collector at %{p0}"); -var part1646 = // "Pattern{Constant(' primary data collector at '), Field(p0,false)}" -match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); +var part1640 = match("MESSAGE#1030:00538:06/1_1", "nwparser.p0", " primary data collector at %{p0}"); var select369 = linear_select([ - part1645, - part1646, + part1639, + part1640, ]); -var part1647 = // "Pattern{Field(hostip,false)}" -match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); +var part1641 = match_copy("MESSAGE#1030:00538:06/2", "nwparser.p0", "hostip"); -var all349 = all_match({ +var all343 = all_match({ processors: [ - part1644, + part1638, select369, - part1647, + part1641, ], on_success: processor_chain([ dup27, @@ -21496,22 +19514,20 @@ var all349 = all_match({ ]), }); -var msg1043 = msg("00538:06", all349); +var msg1043 = msg("00538:06", all343); -var part1648 = // "Pattern{Constant('Connection to Global PRO data collector at '), Field(hostip,true), Constant(' has'), Field(p0,false)}" -match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); +var part1642 = match("MESSAGE#1031:00538:07/0", "nwparser.payload", "Connection to Global PRO data collector at %{hostip->} has%{p0}"); -var part1649 = // "Pattern{Constant(' been'), Field(p0,false)}" -match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); +var part1643 = match("MESSAGE#1031:00538:07/1_0", "nwparser.p0", " been%{p0}"); var select370 = linear_select([ - part1649, + part1643, dup16, ]); -var all350 = all_match({ +var all344 = all_match({ processors: [ - part1648, + part1642, select370, dup136, ], @@ -21524,10 +19540,9 @@ var all350 = all_match({ ]), }); -var msg1044 = msg("00538:07", all350); +var msg1044 = msg("00538:07", all344); -var part1650 = // "Pattern{Constant('Cannot connect to Global PRO data collector at '), Field(hostip,false)}" -match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ +var part1644 = match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO data collector at %{hostip}", processor_chain([ dup27, dup2, dup3, @@ -21535,11 +19550,10 @@ match("MESSAGE#1032:00538:08", "nwparser.payload", "Cannot connect to Global PRO dup5, ])); -var msg1045 = msg("00538:08", part1650); +var msg1045 = msg("00538:08", part1644); -var part1651 = // "Pattern{Constant('NSM: Connected to NSM server at '), Field(hostip,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ - dup303, +var part1645 = match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server at %{hostip->} (%{info}) (%{fld1})", processor_chain([ + dup301, dup2, dup3, dup9, @@ -21548,26 +19562,24 @@ match("MESSAGE#1033:00538:09", "nwparser.payload", "NSM: Connected to NSM server setc("event_description","Connected to NSM server"), ])); -var msg1046 = msg("00538:09", part1651); +var msg1046 = msg("00538:09", part1645); -var part1652 = // "Pattern{Constant('NSM: Connection to NSM server at '), Field(hostip,true), Constant(' is down. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(p0,false)}" -match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); +var part1646 = match("MESSAGE#1034:00538:10/0", "nwparser.payload", "NSM: Connection to NSM server at %{hostip->} is down. Reason: %{resultcode}, %{result->} (%{p0}"); -var part1653 = // "Pattern{Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); +var part1647 = match("MESSAGE#1034:00538:10/1_0", "nwparser.p0", "%{info}) (%{fld1})"); var select371 = linear_select([ - part1653, + part1647, dup41, ]); -var all351 = all_match({ +var all345 = all_match({ processors: [ - part1652, + part1646, select371, ], on_success: processor_chain([ - dup200, + dup198, dup2, dup3, dup9, @@ -21577,36 +19589,33 @@ var all351 = all_match({ ]), }); -var msg1047 = msg("00538:10", all351); +var msg1047 = msg("00538:10", all345); -var part1654 = // "Pattern{Constant('NSM: Cannot connect to NSM server at '), Field(hostip,false), Constant('. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld2,true), Constant(' connect attempt(s)) ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ - dup200, +var part1648 = match("MESSAGE#1035:00538:11", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld2->} connect attempt(s)) (%{fld1})", processor_chain([ + dup198, dup2, dup3, dup9, dup4, dup5, - dup325, + dup323, ])); -var msg1048 = msg("00538:11", part1654); +var msg1048 = msg("00538:11", part1648); -var part1655 = // "Pattern{Constant('NSM: Cannot connect to NSM server at '), Field(hostip,false), Constant('. Reason: '), Field(resultcode,false), Constant(', '), Field(result,true), Constant(' ('), Field(info,false), Constant(') ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ - dup200, +var part1649 = match("MESSAGE#1036:00538:12", "nwparser.payload", "NSM: Cannot connect to NSM server at %{hostip}. Reason: %{resultcode}, %{result->} (%{info}) (%{fld1})", processor_chain([ + dup198, dup2, dup3, dup9, dup4, dup5, - dup325, + dup323, ])); -var msg1049 = msg("00538:12", part1655); +var msg1049 = msg("00538:12", part1649); -var part1656 = // "Pattern{Constant('NSM: Sent 2B message ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ +var part1650 = match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -21616,7 +19625,7 @@ match("MESSAGE#1037:00538:13", "nwparser.payload", "NSM: Sent 2B message (%{fld1 setc("event_description","Sent 2B message"), ])); -var msg1050 = msg("00538:13", part1656); +var msg1050 = msg("00538:13", part1650); var select372 = linear_select([ msg1037, @@ -21635,8 +19644,7 @@ var select372 = linear_select([ msg1050, ]); -var part1657 = // "Pattern{Constant('No IP address in L2TP IP pool for user '), Field(username,false)}" -match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ +var part1651 = match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool for user %{username}", processor_chain([ dup117, dup2, dup3, @@ -21644,10 +19652,9 @@ match("MESSAGE#1038:00539", "nwparser.payload", "No IP address in L2TP IP pool f dup5, ])); -var msg1051 = msg("00539", part1657); +var msg1051 = msg("00539", part1651); -var part1658 = // "Pattern{Constant('No L2TP IP pool for user '), Field(username,false)}" -match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ +var part1652 = match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{username}", processor_chain([ dup117, dup2, dup3, @@ -21655,10 +19662,9 @@ match("MESSAGE#1039:00539:01", "nwparser.payload", "No L2TP IP pool for user %{u dup5, ])); -var msg1052 = msg("00539:01", part1658); +var msg1052 = msg("00539:01", part1652); -var part1659 = // "Pattern{Constant('Cannot allocate IP addr from Pool '), Field(group_object,true), Constant(' for user '), Field(username,false)}" -match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ +var part1653 = match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from Pool %{group_object->} for user %{username}", processor_chain([ dup117, dup2, dup3, @@ -21666,10 +19672,9 @@ match("MESSAGE#1040:00539:02", "nwparser.payload", "Cannot allocate IP addr from dup5, ])); -var msg1053 = msg("00539:02", part1659); +var msg1053 = msg("00539:02", part1653); -var part1660 = // "Pattern{Constant('Dialup HDLC PPP failed to establish a session: '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ +var part1654 = match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to establish a session: %{fld2}.", processor_chain([ dup19, dup2, dup3, @@ -21677,10 +19682,9 @@ match("MESSAGE#1041:00539:03", "nwparser.payload", "Dialup HDLC PPP failed to es dup5, ])); -var msg1054 = msg("00539:03", part1660); +var msg1054 = msg("00539:03", part1654); -var part1661 = // "Pattern{Constant('Dialup HDLC PPP session has successfully established.'), Field(,false)}" -match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ +var part1655 = match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has successfully established.%{}", processor_chain([ dup44, dup2, dup3, @@ -21688,10 +19692,9 @@ match("MESSAGE#1042:00539:04", "nwparser.payload", "Dialup HDLC PPP session has dup5, ])); -var msg1055 = msg("00539:04", part1661); +var msg1055 = msg("00539:04", part1655); -var part1662 = // "Pattern{Constant('No IP Pool has been assigned. You cannot allocate an IP address'), Field(,false)}" -match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ +var part1656 = match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned. You cannot allocate an IP address%{}", processor_chain([ dup18, dup2, dup3, @@ -21699,10 +19702,9 @@ match("MESSAGE#1043:00539:05", "nwparser.payload", "No IP Pool has been assigned dup5, ])); -var msg1056 = msg("00539:05", part1662); +var msg1056 = msg("00539:05", part1656); -var part1663 = // "Pattern{Constant('PPP settings changed.'), Field(,false)}" -match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ +var part1657 = match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", processor_chain([ dup1, dup2, dup3, @@ -21710,7 +19712,7 @@ match("MESSAGE#1044:00539:06", "nwparser.payload", "PPP settings changed.%{}", p dup5, ])); -var msg1057 = msg("00539:06", part1663); +var msg1057 = msg("00539:06", part1657); var select373 = linear_select([ msg1051, @@ -21722,20 +19724,18 @@ var select373 = linear_select([ msg1057, ]); -var part1664 = // "Pattern{Constant('ScreenOS '), Field(fld2,true), Constant(' serial # '), Field(serial_number,false), Constant(': Asset recovery has been '), Field(disposition,false)}" -match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ - dup326, +var part1658 = match("MESSAGE#1045:00541", "nwparser.payload", "ScreenOS %{fld2->} serial # %{serial_number}: Asset recovery has been %{disposition}", processor_chain([ + dup324, dup2, dup3, dup4, dup5, ])); -var msg1058 = msg("00541", part1664); +var msg1058 = msg("00541", part1658); -var part1665 = // "Pattern{Constant('Neighbor router ID - '), Field(fld2,true), Constant(' IP address - '), Field(hostip,true), Constant(' changed its state to '), Field(change_new,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ - dup275, +var part1659 = match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2->} IP address - %{hostip->} changed its state to %{change_new}. (%{fld1})", processor_chain([ + dup273, dup9, dup2, dup3, @@ -21743,11 +19743,10 @@ match("MESSAGE#1216:00541:01", "nwparser.payload", "Neighbor router ID - %{fld2- dup5, ])); -var msg1059 = msg("00541:01", part1665); +var msg1059 = msg("00541:01", part1659); -var part1666 = // "Pattern{Constant('The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from '), Field(change_old,true), Constant(' to '), Field(change_new,true), Constant(' state, (neighbor router-id 1'), Field(fld2,false), Constant(', ip-address '), Field(hostip,false), Constant('). ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ - dup275, +var part1660 = match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neighbor because the current router could not see itself in the hello packet. Neighbor changed state from %{change_old->} to %{change_new->} state, (neighbor router-id 1%{fld2}, ip-address %{hostip}). (%{fld1})", processor_chain([ + dup273, dup9, dup2, dup3, @@ -21755,22 +19754,20 @@ match("MESSAGE#1218:00541:02", "nwparser.payload", "The system killed OSPF neigh dup5, ])); -var msg1060 = msg("00541:02", part1666); +var msg1060 = msg("00541:02", part1660); -var part1667 = // "Pattern{Constant('LSA in following area aged out: LSA area ID '), Field(fld3,false), Constant(', LSA ID '), Field(fld4,false), Constant(', router ID '), Field(fld2,false), Constant(', type '), Field(fld7,true), Constant(' in OSPF. ('), Field(fld1,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); +var part1661 = match("MESSAGE#1219:00541:03/0", "nwparser.payload", "LSA in following area aged out: LSA area ID %{fld3}, LSA ID %{fld4}, router ID %{fld2}, type %{fld7->} in OSPF. (%{fld1})%{p0}"); -var part1668 = // "Pattern{Constant('<<'), Field(fld16,false), Constant('>')}" -match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); +var part1662 = match("MESSAGE#1219:00541:03/1_0", "nwparser.p0", "\u003c\u003c%{fld16}>"); var select374 = linear_select([ - part1668, + part1662, dup21, ]); -var all352 = all_match({ +var all346 = all_match({ processors: [ - part1667, + part1661, select374, ], on_success: processor_chain([ @@ -21783,7 +19780,7 @@ var all352 = all_match({ ]), }); -var msg1061 = msg("00541:03", all352); +var msg1061 = msg("00541:03", all346); var select375 = linear_select([ msg1058, @@ -21792,8 +19789,7 @@ var select375 = linear_select([ msg1061, ]); -var part1669 = // "Pattern{Constant('BGP of vr: '), Field(node,false), Constant(', prefix adding: '), Field(fld2,false), Constant(', ribin overflow '), Field(fld3,true), Constant(' times (max rib-in '), Field(fld4,false), Constant(')')}" -match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ +var part1663 = match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix adding: %{fld2}, ribin overflow %{fld3->} times (max rib-in %{fld4})", processor_chain([ dup1, dup2, dup3, @@ -21801,46 +19797,40 @@ match("MESSAGE#1046:00542", "nwparser.payload", "BGP of vr: %{node}, prefix addi dup5, ])); -var msg1062 = msg("00542", part1669); +var msg1062 = msg("00542", part1663); -var part1670 = // "Pattern{Constant('Access for '), Field(p0,false)}" -match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); +var part1664 = match("MESSAGE#1047:00543/0", "nwparser.payload", "Access for %{p0}"); -var part1671 = // "Pattern{Constant('WebAuth firewall '), Field(p0,false)}" -match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); +var part1665 = match("MESSAGE#1047:00543/1_0", "nwparser.p0", "WebAuth firewall %{p0}"); -var part1672 = // "Pattern{Constant('firewall '), Field(p0,false)}" -match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); +var part1666 = match("MESSAGE#1047:00543/1_1", "nwparser.p0", "firewall %{p0}"); var select376 = linear_select([ - part1671, - part1672, + part1665, + part1666, ]); -var part1673 = // "Pattern{Constant('user '), Field(username,true), Constant(' '), Field(space,false), Constant('at '), Field(hostip,true), Constant(' (accepted at '), Field(fld2,true), Constant(' for duration '), Field(duration,true), Constant(' via the '), Field(logon_type,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); +var part1667 = match("MESSAGE#1047:00543/2", "nwparser.p0", "user %{username->} %{space}at %{hostip->} (accepted at %{fld2->} for duration %{duration->} via the %{logon_type}) %{p0}"); -var part1674 = // "Pattern{Constant('by policy id '), Field(policy_id,true), Constant(' is '), Field(p0,false)}" -match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); +var part1668 = match("MESSAGE#1047:00543/3_0", "nwparser.p0", "by policy id %{policy_id->} is %{p0}"); var select377 = linear_select([ - part1674, + part1668, dup106, ]); -var part1675 = // "Pattern{Constant('now over ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); +var part1669 = match("MESSAGE#1047:00543/4", "nwparser.p0", "now over (%{fld1})"); -var all353 = all_match({ +var all347 = all_match({ processors: [ - part1670, + part1664, select376, - part1673, + part1667, select377, - part1675, + part1669, ], on_success: processor_chain([ - dup283, + dup281, dup2, dup4, dup5, @@ -21849,11 +19839,10 @@ var all353 = all_match({ ]), }); -var msg1063 = msg("00543", all353); +var msg1063 = msg("00543", all347); -var part1676 = // "Pattern{Constant('User '), Field(username,true), Constant(' [ of group '), Field(group,true), Constant(' ] at '), Field(hostip,true), Constant(' has been challenged by the RADIUS server at '), Field(daddr,false)}" -match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ - dup283, +var part1670 = match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group %{group->} ] at %{hostip->} has been challenged by the RADIUS server at %{daddr}", processor_chain([ + dup281, dup2, dup4, dup5, @@ -21862,21 +19851,19 @@ match("MESSAGE#1048:00544", "nwparser.payload", "User %{username->} [ of group % setc("action","RADIUS server challenge"), ])); -var msg1064 = msg("00544", part1676); +var msg1064 = msg("00544", part1670); -var part1677 = // "Pattern{Constant('delete-route-> trust-vr: '), Field(fld2,false)}" -match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ - dup283, +var part1671 = match("MESSAGE#1049:00546", "nwparser.payload", "delete-route-> trust-vr: %{fld2}", processor_chain([ + dup281, dup2, dup3, dup4, dup5, ])); -var msg1065 = msg("00546", part1677); +var msg1065 = msg("00546", part1671); -var part1678 = // "Pattern{Constant('AV: Content from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' was not scanned because max content size was exceeded.')}" -match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ +var part1672 = match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned because max content size was exceeded.", processor_chain([ dup44, dup2, dup4, @@ -21885,10 +19872,9 @@ match("MESSAGE#1050:00547", "nwparser.payload", "AV: Content from %{saddr}:%{spo dup61, ])); -var msg1066 = msg("00547", part1678); +var msg1066 = msg("00547", part1672); -var part1679 = // "Pattern{Constant('AV: Content from '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' was not scanned due to a scan engine error or constraint.')}" -match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ +var part1673 = match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{sport}->%{daddr}:%{dport->} was not scanned due to a scan engine error or constraint.", processor_chain([ dup44, dup2, dup4, @@ -21897,10 +19883,9 @@ match("MESSAGE#1051:00547:01", "nwparser.payload", "AV: Content from %{saddr}:%{ dup61, ])); -var msg1067 = msg("00547:01", part1679); +var msg1067 = msg("00547:01", part1673); -var part1680 = // "Pattern{Constant('AV object scan-mgr data has been '), Field(disposition,false), Constant('.')}" -match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ +var part1674 = match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has been %{disposition}.", processor_chain([ dup1, dup2, dup3, @@ -21908,30 +19893,26 @@ match("MESSAGE#1052:00547:02", "nwparser.payload", "AV object scan-mgr data has dup5, ])); -var msg1068 = msg("00547:02", part1680); +var msg1068 = msg("00547:02", part1674); -var part1681 = // "Pattern{Constant('AV: Content from '), Field(location_desc,false), Constant(', http url: '), Field(url,false), Constant(', is passed '), Field(p0,false)}" -match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); +var part1675 = match("MESSAGE#1053:00547:03/0", "nwparser.payload", "AV: Content from %{location_desc}, http url: %{url}, is passed %{p0}"); -var part1682 = // "Pattern{Constant('due to '), Field(p0,false)}" -match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); +var part1676 = match("MESSAGE#1053:00547:03/1_0", "nwparser.p0", "due to %{p0}"); -var part1683 = // "Pattern{Constant('because '), Field(p0,false)}" -match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); +var part1677 = match("MESSAGE#1053:00547:03/1_1", "nwparser.p0", "because %{p0}"); var select378 = linear_select([ - part1682, - part1683, + part1676, + part1677, ]); -var part1684 = // "Pattern{Constant(''), Field(result,false), Constant('. ('), Field(event_time_string,false), Constant(')')}" -match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); +var part1678 = match("MESSAGE#1053:00547:03/2", "nwparser.p0", "%{result}. (%{event_time_string})"); -var all354 = all_match({ +var all348 = all_match({ processors: [ - part1681, + part1675, select378, - part1684, + part1678, ], on_success: processor_chain([ dup1, @@ -21943,7 +19924,7 @@ var all354 = all_match({ ]), }); -var msg1069 = msg("00547:03", all354); +var msg1069 = msg("00547:03", all348); var select379 = linear_select([ msg1066, @@ -21952,19 +19933,17 @@ var select379 = linear_select([ msg1069, ]); -var part1685 = // "Pattern{Constant('add-route-> untrust-vr: '), Field(fld2,false)}" -match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ - dup283, +var part1679 = match("MESSAGE#1054:00549", "nwparser.payload", "add-route-> untrust-vr: %{fld2}", processor_chain([ + dup281, dup2, dup3, dup4, dup5, ])); -var msg1070 = msg("00549", part1685); +var msg1070 = msg("00549", part1679); -var part1686 = // "Pattern{Constant('Error '), Field(resultcode,true), Constant(' occurred during configlet file processing.')}" -match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ +var part1680 = match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred during configlet file processing.", processor_chain([ dup18, dup2, dup3, @@ -21972,10 +19951,9 @@ match("MESSAGE#1055:00551", "nwparser.payload", "Error %{resultcode->} occurred dup5, ])); -var msg1071 = msg("00551", part1686); +var msg1071 = msg("00551", part1680); -var part1687 = // "Pattern{Constant('Error '), Field(resultcode,true), Constant(' occurred, causing failure to establish secure management with Management System.')}" -match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ +var part1681 = match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurred, causing failure to establish secure management with Management System.", processor_chain([ dup86, dup2, dup3, @@ -21983,22 +19961,20 @@ match("MESSAGE#1056:00551:01", "nwparser.payload", "Error %{resultcode->} occurr dup5, ])); -var msg1072 = msg("00551:01", part1687); +var msg1072 = msg("00551:01", part1681); -var part1688 = // "Pattern{Constant('Configlet file '), Field(p0,false)}" -match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); +var part1682 = match("MESSAGE#1057:00551:02/0", "nwparser.payload", "Configlet file %{p0}"); -var part1689 = // "Pattern{Constant('decryption '), Field(p0,false)}" -match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); +var part1683 = match("MESSAGE#1057:00551:02/1_0", "nwparser.p0", "decryption %{p0}"); var select380 = linear_select([ - part1689, + part1683, dup89, ]); -var all355 = all_match({ +var all349 = all_match({ processors: [ - part1688, + part1682, select380, dup128, ], @@ -22011,10 +19987,9 @@ var all355 = all_match({ ]), }); -var msg1073 = msg("00551:02", all355); +var msg1073 = msg("00551:02", all349); -var part1690 = // "Pattern{Constant('Rapid Deployment cannot start because gateway has undergone configuration changes. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ +var part1684 = match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot start because gateway has undergone configuration changes. (%{fld1})", processor_chain([ dup18, dup2, dup3, @@ -22023,10 +19998,9 @@ match("MESSAGE#1058:00551:03", "nwparser.payload", "Rapid Deployment cannot star dup5, ])); -var msg1074 = msg("00551:03", part1690); +var msg1074 = msg("00551:03", part1684); -var part1691 = // "Pattern{Constant('Secure management established successfully with remote server. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ +var part1685 = match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management established successfully with remote server. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -22035,7 +20009,7 @@ match("MESSAGE#1059:00551:04", "nwparser.payload", "Secure management establishe dup5, ])); -var msg1075 = msg("00551:04", part1691); +var msg1075 = msg("00551:04", part1685); var select381 = linear_select([ msg1071, @@ -22045,29 +20019,25 @@ var select381 = linear_select([ msg1075, ]); -var part1692 = // "Pattern{Constant('SCAN-MGR: Failed to get '), Field(p0,false)}" -match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); +var part1686 = match("MESSAGE#1060:00553/0", "nwparser.payload", "SCAN-MGR: Failed to get %{p0}"); -var part1693 = // "Pattern{Constant('AltServer '), Field(p0,false)}" -match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); +var part1687 = match("MESSAGE#1060:00553/1_0", "nwparser.p0", "AltServer %{p0}"); -var part1694 = // "Pattern{Constant('Version '), Field(p0,false)}" -match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); +var part1688 = match("MESSAGE#1060:00553/1_1", "nwparser.p0", "Version %{p0}"); -var part1695 = // "Pattern{Constant('Path_GateLockCE '), Field(p0,false)}" -match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); +var part1689 = match("MESSAGE#1060:00553/1_2", "nwparser.p0", "Path_GateLockCE %{p0}"); var select382 = linear_select([ - part1693, - part1694, - part1695, + part1687, + part1688, + part1689, ]); -var all356 = all_match({ +var all350 = all_match({ processors: [ - part1692, + part1686, select382, - dup327, + dup325, ], on_success: processor_chain([ dup18, @@ -22078,10 +20048,9 @@ var all356 = all_match({ ]), }); -var msg1076 = msg("00553", all356); +var msg1076 = msg("00553", all350); -var part1696 = // "Pattern{Constant('SCAN-MGR: Zero pattern size from server.ini.'), Field(,false)}" -match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ +var part1690 = match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size from server.ini.%{}", processor_chain([ dup18, dup2, dup3, @@ -22089,10 +20058,9 @@ match("MESSAGE#1061:00553:01", "nwparser.payload", "SCAN-MGR: Zero pattern size dup5, ])); -var msg1077 = msg("00553:01", part1696); +var msg1077 = msg("00553:01", part1690); -var part1697 = // "Pattern{Constant('SCAN-MGR: Pattern size from server.ini is too large: '), Field(bytes,true), Constant(' (bytes).')}" -match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ +var part1691 = match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from server.ini is too large: %{bytes->} (bytes).", processor_chain([ dup18, dup2, dup3, @@ -22100,10 +20068,9 @@ match("MESSAGE#1062:00553:02", "nwparser.payload", "SCAN-MGR: Pattern size from dup5, ])); -var msg1078 = msg("00553:02", part1697); +var msg1078 = msg("00553:02", part1691); -var part1698 = // "Pattern{Constant('SCAN-MGR: Pattern URL from server.ini is too long: '), Field(fld2,false), Constant('; max is '), Field(fld3,false), Constant('.')}" -match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ +var part1692 = match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from server.ini is too long: %{fld2}; max is %{fld3}.", processor_chain([ dup18, dup2, dup3, @@ -22111,24 +20078,22 @@ match("MESSAGE#1063:00553:03", "nwparser.payload", "SCAN-MGR: Pattern URL from s dup5, ])); -var msg1079 = msg("00553:03", part1698); +var msg1079 = msg("00553:03", part1692); -var part1699 = // "Pattern{Constant('SCAN-MGR: Failed to retrieve '), Field(p0,false)}" -match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); +var part1693 = match("MESSAGE#1064:00553:04/0", "nwparser.payload", "SCAN-MGR: Failed to retrieve %{p0}"); var select383 = linear_select([ - dup328, - dup329, + dup326, + dup327, ]); -var part1700 = // "Pattern{Constant('file: '), Field(fld2,false), Constant('; http status code: '), Field(resultcode,false), Constant('.')}" -match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); +var part1694 = match("MESSAGE#1064:00553:04/2", "nwparser.p0", "file: %{fld2}; http status code: %{resultcode}."); -var all357 = all_match({ +var all351 = all_match({ processors: [ - part1699, + part1693, select383, - part1700, + part1694, ], on_success: processor_chain([ dup18, @@ -22139,10 +20104,9 @@ var all357 = all_match({ ]), }); -var msg1080 = msg("00553:04", all357); +var msg1080 = msg("00553:04", all351); -var part1701 = // "Pattern{Constant('SCAN-MGR: Failed to write pattern into a RAM file.'), Field(,false)}" -match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ +var part1695 = match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pattern into a RAM file.%{}", processor_chain([ dup18, dup2, dup3, @@ -22150,10 +20114,9 @@ match("MESSAGE#1065:00553:05", "nwparser.payload", "SCAN-MGR: Failed to write pa dup5, ])); -var msg1081 = msg("00553:05", part1701); +var msg1081 = msg("00553:05", part1695); -var part1702 = // "Pattern{Constant('SCAN-MGR: Check Pattern File failed: code from VSAPI: '), Field(resultcode,false)}" -match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ +var part1696 = match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File failed: code from VSAPI: %{resultcode}", processor_chain([ dup18, dup2, dup3, @@ -22161,10 +20124,9 @@ match("MESSAGE#1066:00553:06", "nwparser.payload", "SCAN-MGR: Check Pattern File dup5, ])); -var msg1082 = msg("00553:06", part1702); +var msg1082 = msg("00553:06", part1696); -var part1703 = // "Pattern{Constant('SCAN-MGR: Failed to write pattern into flash.'), Field(,false)}" -match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ +var part1697 = match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pattern into flash.%{}", processor_chain([ dup18, dup2, dup3, @@ -22172,21 +20134,20 @@ match("MESSAGE#1067:00553:07", "nwparser.payload", "SCAN-MGR: Failed to write pa dup5, ])); -var msg1083 = msg("00553:07", part1703); +var msg1083 = msg("00553:07", part1697); -var part1704 = // "Pattern{Constant('SCAN-MGR: Internal error while setting up for retrieving '), Field(p0,false)}" -match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); +var part1698 = match("MESSAGE#1068:00553:08/0", "nwparser.payload", "SCAN-MGR: Internal error while setting up for retrieving %{p0}"); var select384 = linear_select([ - dup329, - dup328, + dup327, + dup326, ]); -var all358 = all_match({ +var all352 = all_match({ processors: [ - part1704, + part1698, select384, - dup330, + dup328, ], on_success: processor_chain([ dup19, @@ -22197,10 +20158,9 @@ var all358 = all_match({ ]), }); -var msg1084 = msg("00553:08", all358); +var msg1084 = msg("00553:08", all352); -var part1705 = // "Pattern{Constant('SCAN-MGR: '), Field(fld2,true), Constant(' '), Field(disposition,false), Constant(': Err: '), Field(resultcode,false), Constant('.')}" -match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ +var part1699 = match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{disposition}: Err: %{resultcode}.", processor_chain([ dup19, dup2, dup3, @@ -22208,10 +20168,9 @@ match("MESSAGE#1069:00553:09", "nwparser.payload", "SCAN-MGR: %{fld2->} %{dispos dup5, ])); -var msg1085 = msg("00553:09", part1705); +var msg1085 = msg("00553:09", part1699); -var part1706 = // "Pattern{Constant('SCAN-MGR: TMIntCPVSInit '), Field(disposition,true), Constant(' due to '), Field(result,false)}" -match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ +var part1700 = match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{disposition->} due to %{result}", processor_chain([ dup19, dup2, dup3, @@ -22219,10 +20178,9 @@ match("MESSAGE#1070:00553:10", "nwparser.payload", "SCAN-MGR: TMIntCPVSInit %{di dup5, ])); -var msg1086 = msg("00553:10", part1706); +var msg1086 = msg("00553:10", part1700); -var part1707 = // "Pattern{Constant('SCAN-MGR: Attempted Pattern Creation Date('), Field(fld2,false), Constant(') is after AV Key Expiration date('), Field(fld3,false), Constant(').')}" -match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ +var part1701 = match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern Creation Date(%{fld2}) is after AV Key Expiration date(%{fld3}).", processor_chain([ dup18, dup2, dup3, @@ -22230,10 +20188,9 @@ match("MESSAGE#1071:00553:11", "nwparser.payload", "SCAN-MGR: Attempted Pattern dup5, ])); -var msg1087 = msg("00553:11", part1707); +var msg1087 = msg("00553:11", part1701); -var part1708 = // "Pattern{Constant('SCAN-MGR: TMIntSetDecompressLayer '), Field(disposition,false), Constant(': Layer: '), Field(fld2,false), Constant(', Err: '), Field(resultcode,false), Constant('.')}" -match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ +var part1702 = match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompressLayer %{disposition}: Layer: %{fld2}, Err: %{resultcode}.", processor_chain([ dup19, dup2, dup3, @@ -22241,10 +20198,9 @@ match("MESSAGE#1072:00553:12", "nwparser.payload", "SCAN-MGR: TMIntSetDecompress dup5, ])); -var msg1088 = msg("00553:12", part1708); +var msg1088 = msg("00553:12", part1702); -var part1709 = // "Pattern{Constant('SCAN-MGR: TMIntSetExtractFileSizeLimit '), Field(disposition,false), Constant(': Limit: '), Field(fld2,false), Constant(', Err: '), Field(resultcode,false), Constant('.')}" -match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ +var part1703 = match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFileSizeLimit %{disposition}: Limit: %{fld2}, Err: %{resultcode}.", processor_chain([ dup19, dup2, dup3, @@ -22252,10 +20208,9 @@ match("MESSAGE#1073:00553:13", "nwparser.payload", "SCAN-MGR: TMIntSetExtractFil dup5, ])); -var msg1089 = msg("00553:13", part1709); +var msg1089 = msg("00553:13", part1703); -var part1710 = // "Pattern{Constant('SCAN-MGR: TMIntScanFile '), Field(disposition,false), Constant(': ret: '), Field(fld2,false), Constant('; cpapiErrCode: '), Field(resultcode,false), Constant('.')}" -match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ +var part1704 = match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{disposition}: ret: %{fld2}; cpapiErrCode: %{resultcode}.", processor_chain([ dup19, dup2, dup3, @@ -22263,10 +20218,9 @@ match("MESSAGE#1074:00553:14", "nwparser.payload", "SCAN-MGR: TMIntScanFile %{di dup5, ])); -var msg1090 = msg("00553:14", part1710); +var msg1090 = msg("00553:14", part1704); -var part1711 = // "Pattern{Constant('SCAN-MGR: VSAPI resource usage error. Left usage: '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ +var part1705 = match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usage error. Left usage: %{fld2}.", processor_chain([ dup19, dup2, dup3, @@ -22274,10 +20228,9 @@ match("MESSAGE#1075:00553:15", "nwparser.payload", "SCAN-MGR: VSAPI resource usa dup5, ])); -var msg1091 = msg("00553:15", part1711); +var msg1091 = msg("00553:15", part1705); -var part1712 = // "Pattern{Constant('SCAN-MGR: Set decompress layer to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ +var part1706 = match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress layer to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22285,10 +20238,9 @@ match("MESSAGE#1076:00553:16", "nwparser.payload", "SCAN-MGR: Set decompress lay dup5, ])); -var msg1092 = msg("00553:16", part1712); +var msg1092 = msg("00553:16", part1706); -var part1713 = // "Pattern{Constant('SCAN-MGR: Set maximum content size to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ +var part1707 = match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum content size to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22296,10 +20248,9 @@ match("MESSAGE#1077:00553:17", "nwparser.payload", "SCAN-MGR: Set maximum conten dup5, ])); -var msg1093 = msg("00553:17", part1713); +var msg1093 = msg("00553:17", part1707); -var part1714 = // "Pattern{Constant('SCAN-MGR: Set maximum number of concurrent messages to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ +var part1708 = match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number of concurrent messages to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22307,10 +20258,9 @@ match("MESSAGE#1078:00553:18", "nwparser.payload", "SCAN-MGR: Set maximum number dup5, ])); -var msg1094 = msg("00553:18", part1714); +var msg1094 = msg("00553:18", part1708); -var part1715 = // "Pattern{Constant('SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ +var part1709 = match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximum number of concurrent messages exceeds max to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22318,10 +20268,9 @@ match("MESSAGE#1079:00553:19", "nwparser.payload", "SCAN-MGR: Set drop if maximu dup5, ])); -var msg1095 = msg("00553:19", part1715); +var msg1095 = msg("00553:19", part1709); -var part1716 = // "Pattern{Constant('SCAN-MGR: Set Pattern URL to '), Field(fld2,false), Constant('; update interval is '), Field(fld3,false), Constant('.')}" -match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ +var part1710 = match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to %{fld2}; update interval is %{fld3}.", processor_chain([ dup1, dup2, dup3, @@ -22329,10 +20278,9 @@ match("MESSAGE#1080:00553:20", "nwparser.payload", "SCAN-MGR: Set Pattern URL to dup5, ])); -var msg1096 = msg("00553:20", part1716); +var msg1096 = msg("00553:20", part1710); -var part1717 = // "Pattern{Constant('SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.'), Field(,false)}" -match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ +var part1711 = match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; Pattern will not be updated automatically.%{}", processor_chain([ dup1, dup2, dup3, @@ -22340,10 +20288,9 @@ match("MESSAGE#1081:00553:21", "nwparser.payload", "SCAN-MGR: Unset Pattern URL; dup5, ])); -var msg1097 = msg("00553:21", part1717); +var msg1097 = msg("00553:21", part1711); -var part1718 = // "Pattern{Constant('SCAN-MGR: New pattern updated: version: '), Field(version,false), Constant(', size: '), Field(bytes,true), Constant(' (bytes).')}" -match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ +var part1712 = match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern updated: version: %{version}, size: %{bytes->} (bytes).", processor_chain([ dup1, dup2, dup3, @@ -22351,7 +20298,7 @@ match("MESSAGE#1082:00553:22", "nwparser.payload", "SCAN-MGR: New pattern update dup5, ])); -var msg1098 = msg("00553:22", part1718); +var msg1098 = msg("00553:22", part1712); var select385 = linear_select([ msg1076, @@ -22379,29 +20326,25 @@ var select385 = linear_select([ msg1098, ]); -var part1719 = // "Pattern{Constant('SCAN-MGR: Cannot get '), Field(p0,false)}" -match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); +var part1713 = match("MESSAGE#1083:00554/0", "nwparser.payload", "SCAN-MGR: Cannot get %{p0}"); -var part1720 = // "Pattern{Constant('AltServer info '), Field(p0,false)}" -match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); +var part1714 = match("MESSAGE#1083:00554/1_0", "nwparser.p0", "AltServer info %{p0}"); -var part1721 = // "Pattern{Constant('Version number '), Field(p0,false)}" -match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); +var part1715 = match("MESSAGE#1083:00554/1_1", "nwparser.p0", "Version number %{p0}"); -var part1722 = // "Pattern{Constant('Path_GateLockCE info '), Field(p0,false)}" -match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); +var part1716 = match("MESSAGE#1083:00554/1_2", "nwparser.p0", "Path_GateLockCE info %{p0}"); var select386 = linear_select([ - part1720, - part1721, - part1722, + part1714, + part1715, + part1716, ]); -var all359 = all_match({ +var all353 = all_match({ processors: [ - part1719, + part1713, select386, - dup327, + dup325, ], on_success: processor_chain([ dup144, @@ -22412,10 +20355,9 @@ var all359 = all_match({ ]), }); -var msg1099 = msg("00554", all359); +var msg1099 = msg("00554", all353); -var part1723 = // "Pattern{Constant('SCAN-MGR: Per server.ini file, the AV pattern file size is zero.'), Field(,false)}" -match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ +var part1717 = match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini file, the AV pattern file size is zero.%{}", processor_chain([ dup19, dup2, dup3, @@ -22423,10 +20365,9 @@ match("MESSAGE#1084:00554:01", "nwparser.payload", "SCAN-MGR: Per server.ini fil dup5, ])); -var msg1100 = msg("00554:01", part1723); +var msg1100 = msg("00554:01", part1717); -var part1724 = // "Pattern{Constant('SCAN-MGR: AV pattern file size is too large ('), Field(bytes,true), Constant(' bytes).')}" -match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ +var part1718 = match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file size is too large (%{bytes->} bytes).", processor_chain([ dup19, dup2, dup3, @@ -22434,10 +20375,9 @@ match("MESSAGE#1085:00554:02", "nwparser.payload", "SCAN-MGR: AV pattern file si dup5, ])); -var msg1101 = msg("00554:02", part1724); +var msg1101 = msg("00554:02", part1718); -var part1725 = // "Pattern{Constant('SCAN-MGR: Alternate AV pattern file server URL is too long: '), Field(bytes,true), Constant(' bytes. Max: '), Field(fld2,true), Constant(' bytes.')}" -match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ +var part1719 = match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV pattern file server URL is too long: %{bytes->} bytes. Max: %{fld2->} bytes.", processor_chain([ dup19, dup2, dup3, @@ -22445,19 +20385,17 @@ match("MESSAGE#1086:00554:03", "nwparser.payload", "SCAN-MGR: Alternate AV patte dup5, ])); -var msg1102 = msg("00554:03", part1725); +var msg1102 = msg("00554:03", part1719); -var part1726 = // "Pattern{Constant('SCAN-MGR: Cannot retrieve '), Field(p0,false)}" -match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); +var part1720 = match("MESSAGE#1087:00554:04/0", "nwparser.payload", "SCAN-MGR: Cannot retrieve %{p0}"); -var part1727 = // "Pattern{Constant('file from '), Field(hostip,false), Constant(':'), Field(network_port,false), Constant('. HTTP status code: '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); +var part1721 = match("MESSAGE#1087:00554:04/2", "nwparser.p0", "file from %{hostip}:%{network_port}. HTTP status code: %{fld2}."); -var all360 = all_match({ +var all354 = all_match({ processors: [ - part1726, - dup408, - part1727, + part1720, + dup405, + part1721, ], on_success: processor_chain([ dup144, @@ -22468,25 +20406,22 @@ var all360 = all_match({ ]), }); -var msg1103 = msg("00554:04", all360); +var msg1103 = msg("00554:04", all354); -var part1728 = // "Pattern{Constant('SCAN-MGR: Cannot write AV pattern file to '), Field(p0,false)}" -match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); +var part1722 = match("MESSAGE#1088:00554:05/0", "nwparser.payload", "SCAN-MGR: Cannot write AV pattern file to %{p0}"); -var part1729 = // "Pattern{Constant('RAM '), Field(p0,false)}" -match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); +var part1723 = match("MESSAGE#1088:00554:05/1_0", "nwparser.p0", "RAM %{p0}"); -var part1730 = // "Pattern{Constant('flash '), Field(p0,false)}" -match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); +var part1724 = match("MESSAGE#1088:00554:05/1_1", "nwparser.p0", "flash %{p0}"); var select387 = linear_select([ - part1729, - part1730, + part1723, + part1724, ]); -var all361 = all_match({ +var all355 = all_match({ processors: [ - part1728, + part1722, select387, dup116, ], @@ -22499,10 +20434,9 @@ var all361 = all_match({ ]), }); -var msg1104 = msg("00554:05", all361); +var msg1104 = msg("00554:05", all355); -var part1731 = // "Pattern{Constant('SCAN-MGR: Cannot check AV pattern file. VSAPI code: '), Field(fld2,false)}" -match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ +var part1725 = match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pattern file. VSAPI code: %{fld2}", processor_chain([ dup144, dup2, dup3, @@ -22510,16 +20444,15 @@ match("MESSAGE#1089:00554:06", "nwparser.payload", "SCAN-MGR: Cannot check AV pa dup5, ])); -var msg1105 = msg("00554:06", part1731); +var msg1105 = msg("00554:06", part1725); -var part1732 = // "Pattern{Constant('SCAN-MGR: Internal error occurred while retrieving '), Field(p0,false)}" -match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); +var part1726 = match("MESSAGE#1090:00554:07/0", "nwparser.payload", "SCAN-MGR: Internal error occurred while retrieving %{p0}"); -var all362 = all_match({ +var all356 = all_match({ processors: [ - part1732, - dup408, - dup330, + part1726, + dup405, + dup328, ], on_success: processor_chain([ dup19, @@ -22530,29 +20463,25 @@ var all362 = all_match({ ]), }); -var msg1106 = msg("00554:07", all362); +var msg1106 = msg("00554:07", all356); -var part1733 = // "Pattern{Constant('SCAN-MGR: Internal error occurred when calling this function: '), Field(fld2,false), Constant('. '), Field(fld3,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); +var part1727 = match("MESSAGE#1091:00554:08/0", "nwparser.payload", "SCAN-MGR: Internal error occurred when calling this function: %{fld2}. %{fld3->} %{p0}"); -var part1734 = // "Pattern{Constant('Error: '), Field(resultcode,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); +var part1728 = match("MESSAGE#1091:00554:08/1_0", "nwparser.p0", "Error: %{resultcode->} %{p0}"); -var part1735 = // "Pattern{Constant('Returned a NULL VSC handler '), Field(p0,false)}" -match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); +var part1729 = match("MESSAGE#1091:00554:08/1_1", "nwparser.p0", "Returned a NULL VSC handler %{p0}"); -var part1736 = // "Pattern{Constant('cpapiErrCode: '), Field(resultcode,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); +var part1730 = match("MESSAGE#1091:00554:08/1_2", "nwparser.p0", "cpapiErrCode: %{resultcode->} %{p0}"); var select388 = linear_select([ - part1734, - part1735, - part1736, + part1728, + part1729, + part1730, ]); -var all363 = all_match({ +var all357 = all_match({ processors: [ - part1733, + part1727, select388, dup116, ], @@ -22565,10 +20494,9 @@ var all363 = all_match({ ]), }); -var msg1107 = msg("00554:08", all363); +var msg1107 = msg("00554:08", all357); -var part1737 = // "Pattern{Constant('SCAN-MGR: Number of decompression layers has been set to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ +var part1731 = match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompression layers has been set to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22576,10 +20504,9 @@ match("MESSAGE#1092:00554:09", "nwparser.payload", "SCAN-MGR: Number of decompre dup5, ])); -var msg1108 = msg("00554:09", part1737); +var msg1108 = msg("00554:09", part1731); -var part1738 = // "Pattern{Constant('SCAN-MGR: Maximum content size has been set to '), Field(fld2,true), Constant(' KB.')}" -match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ +var part1732 = match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content size has been set to %{fld2->} KB.", processor_chain([ dup1, dup2, dup3, @@ -22587,10 +20514,9 @@ match("MESSAGE#1093:00554:10", "nwparser.payload", "SCAN-MGR: Maximum content si dup5, ])); -var msg1109 = msg("00554:10", part1738); +var msg1109 = msg("00554:10", part1732); -var part1739 = // "Pattern{Constant('SCAN-MGR: Maximum number of concurrent messages has been set to '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ +var part1733 = match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of concurrent messages has been set to %{fld2}.", processor_chain([ dup1, dup2, dup3, @@ -22598,46 +20524,39 @@ match("MESSAGE#1094:00554:11", "nwparser.payload", "SCAN-MGR: Maximum number of dup5, ])); -var msg1110 = msg("00554:11", part1739); +var msg1110 = msg("00554:11", part1733); -var part1740 = // "Pattern{Constant('SCAN-MGR: Fail mode has been set to '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); +var part1734 = match("MESSAGE#1095:00554:12/0", "nwparser.payload", "SCAN-MGR: Fail mode has been set to %{p0}"); -var part1741 = // "Pattern{Constant('drop '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); +var part1735 = match("MESSAGE#1095:00554:12/1_0", "nwparser.p0", "drop %{p0}"); -var part1742 = // "Pattern{Constant('pass '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); +var part1736 = match("MESSAGE#1095:00554:12/1_1", "nwparser.p0", "pass %{p0}"); var select389 = linear_select([ - part1741, - part1742, + part1735, + part1736, ]); -var part1743 = // "Pattern{Constant('unexamined traffic if '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); +var part1737 = match("MESSAGE#1095:00554:12/2", "nwparser.p0", "unexamined traffic if %{p0}"); -var part1744 = // "Pattern{Constant('content size '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); +var part1738 = match("MESSAGE#1095:00554:12/3_0", "nwparser.p0", "content size %{p0}"); -var part1745 = // "Pattern{Constant('number of concurrent messages '), Field(p0,false)}" -match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); +var part1739 = match("MESSAGE#1095:00554:12/3_1", "nwparser.p0", "number of concurrent messages %{p0}"); var select390 = linear_select([ - part1744, - part1745, + part1738, + part1739, ]); -var part1746 = // "Pattern{Constant('exceeds max.'), Field(,false)}" -match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); +var part1740 = match("MESSAGE#1095:00554:12/4", "nwparser.p0", "exceeds max.%{}"); -var all364 = all_match({ +var all358 = all_match({ processors: [ - part1740, + part1734, select389, - part1743, + part1737, select390, - part1746, + part1740, ], on_success: processor_chain([ dup1, @@ -22648,10 +20567,9 @@ var all364 = all_match({ ]), }); -var msg1111 = msg("00554:12", all364); +var msg1111 = msg("00554:12", all358); -var part1747 = // "Pattern{Constant('SCAN-MGR: URL for AV pattern update server has been set to '), Field(fld2,false), Constant(', and the update interval to '), Field(fld3,true), Constant(' minutes.')}" -match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ +var part1741 = match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been set to %{fld2}, and the update interval to %{fld3->} minutes.", processor_chain([ dup1, dup2, dup3, @@ -22659,10 +20577,9 @@ match("MESSAGE#1096:00554:13", "nwparser.payload", "SCAN-MGR: URL for AV pattern dup5, ])); -var msg1112 = msg("00554:13", part1747); +var msg1112 = msg("00554:13", part1741); -var part1748 = // "Pattern{Constant('SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.'), Field(,false)}" -match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ +var part1742 = match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern update server has been unset, and the update interval returned to its default.%{}", processor_chain([ dup1, dup2, dup3, @@ -22670,10 +20587,9 @@ match("MESSAGE#1097:00554:14", "nwparser.payload", "SCAN-MGR: URL for AV pattern dup5, ])); -var msg1113 = msg("00554:14", part1748); +var msg1113 = msg("00554:14", part1742); -var part1749 = // "Pattern{Constant('SCAN-MGR: New AV pattern file has been updated. Version: '), Field(version,false), Constant('; size: '), Field(bytes,true), Constant(' bytes.')}" -match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ +var part1743 = match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern file has been updated. Version: %{version}; size: %{bytes->} bytes.", processor_chain([ dup1, dup2, dup3, @@ -22681,10 +20597,9 @@ match("MESSAGE#1098:00554:15", "nwparser.payload", "SCAN-MGR: New AV pattern fil dup5, ])); -var msg1114 = msg("00554:15", part1749); +var msg1114 = msg("00554:15", part1743); -var part1750 = // "Pattern{Constant('SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ +var part1744 = match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exceeded its resource allotment. Remaining available resources: %{fld2}.", processor_chain([ dup19, dup2, dup3, @@ -22692,10 +20607,9 @@ match("MESSAGE#1099:00554:16", "nwparser.payload", "SCAN-MGR: AV client has exce dup5, ])); -var msg1115 = msg("00554:16", part1750); +var msg1115 = msg("00554:16", part1744); -var part1751 = // "Pattern{Constant('SCAN-MGR: Attempted to load AV pattern file created '), Field(fld2,true), Constant(' after the AV subscription expired. (Exp: '), Field(fld3,false), Constant(')')}" -match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ +var part1745 = match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load AV pattern file created %{fld2->} after the AV subscription expired. (Exp: %{fld3})", processor_chain([ dup1, dup2, dup3, @@ -22703,7 +20617,7 @@ match("MESSAGE#1100:00554:17", "nwparser.payload", "SCAN-MGR: Attempted to load dup5, ])); -var msg1116 = msg("00554:17", part1751); +var msg1116 = msg("00554:17", part1745); var select391 = linear_select([ msg1099, @@ -22726,8 +20640,7 @@ var select391 = linear_select([ msg1116, ]); -var part1752 = // "Pattern{Constant('Vrouter '), Field(node,true), Constant(' PIMSM cannot process non-multicast address '), Field(hostip,false)}" -match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ +var part1746 = match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot process non-multicast address %{hostip}", processor_chain([ dup19, dup2, dup3, @@ -22735,10 +20648,9 @@ match("MESSAGE#1101:00555", "nwparser.payload", "Vrouter %{node->} PIMSM cannot dup5, ])); -var msg1117 = msg("00555", part1752); +var msg1117 = msg("00555", part1746); -var part1753 = // "Pattern{Constant('UF-MGR: Failed to process a request. Reason: '), Field(result,false)}" -match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ +var part1747 = match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a request. Reason: %{result}", processor_chain([ dup19, dup2, dup3, @@ -22746,10 +20658,9 @@ match("MESSAGE#1102:00556", "nwparser.payload", "UF-MGR: Failed to process a req dup5, ])); -var msg1118 = msg("00556", part1753); +var msg1118 = msg("00556", part1747); -var part1754 = // "Pattern{Constant('UF-MGR: Failed to abort a transaction. Reason: '), Field(result,false)}" -match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ +var part1748 = match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a transaction. Reason: %{result}", processor_chain([ dup19, dup2, dup3, @@ -22757,49 +20668,42 @@ match("MESSAGE#1103:00556:01", "nwparser.payload", "UF-MGR: Failed to abort a tr dup5, ])); -var msg1119 = msg("00556:01", part1754); +var msg1119 = msg("00556:01", part1748); -var part1755 = // "Pattern{Constant('UF-MGR: UF '), Field(p0,false)}" -match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); +var part1749 = match("MESSAGE#1104:00556:02/0", "nwparser.payload", "UF-MGR: UF %{p0}"); -var part1756 = // "Pattern{Constant('K'), Field(p0,false)}" -match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); +var part1750 = match("MESSAGE#1104:00556:02/1_0", "nwparser.p0", "K%{p0}"); -var part1757 = // "Pattern{Constant('k'), Field(p0,false)}" -match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); +var part1751 = match("MESSAGE#1104:00556:02/1_1", "nwparser.p0", "k%{p0}"); var select392 = linear_select([ - part1756, - part1757, + part1750, + part1751, ]); -var part1758 = // "Pattern{Constant('ey '), Field(p0,false)}" -match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); +var part1752 = match("MESSAGE#1104:00556:02/2", "nwparser.p0", "ey %{p0}"); -var part1759 = // "Pattern{Constant('Expired'), Field(p0,false)}" -match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); +var part1753 = match("MESSAGE#1104:00556:02/3_0", "nwparser.p0", "Expired%{p0}"); -var part1760 = // "Pattern{Constant('expired'), Field(p0,false)}" -match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); +var part1754 = match("MESSAGE#1104:00556:02/3_1", "nwparser.p0", "expired%{p0}"); var select393 = linear_select([ - part1759, - part1760, + part1753, + part1754, ]); -var part1761 = // "Pattern{Field(,false), Constant('(expiration date: '), Field(fld2,false), Constant('; current date: '), Field(fld3,false), Constant(').')}" -match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); +var part1755 = match("MESSAGE#1104:00556:02/4", "nwparser.p0", "%{}(expiration date: %{fld2}; current date: %{fld3})."); -var all365 = all_match({ +var all359 = all_match({ processors: [ - part1755, + part1749, select392, - part1758, + part1752, select393, - part1761, + part1755, ], on_success: processor_chain([ - dup256, + dup254, dup2, dup3, dup4, @@ -22807,30 +20711,26 @@ var all365 = all_match({ ]), }); -var msg1120 = msg("00556:02", all365); +var msg1120 = msg("00556:02", all359); -var part1762 = // "Pattern{Constant('UF-MGR: Failed to '), Field(p0,false)}" -match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); +var part1756 = match("MESSAGE#1105:00556:03/0", "nwparser.payload", "UF-MGR: Failed to %{p0}"); -var part1763 = // "Pattern{Constant('enable '), Field(p0,false)}" -match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); +var part1757 = match("MESSAGE#1105:00556:03/1_0", "nwparser.p0", "enable %{p0}"); -var part1764 = // "Pattern{Constant('disable '), Field(p0,false)}" -match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); +var part1758 = match("MESSAGE#1105:00556:03/1_1", "nwparser.p0", "disable %{p0}"); var select394 = linear_select([ - part1763, - part1764, + part1757, + part1758, ]); -var part1765 = // "Pattern{Constant('cache.'), Field(,false)}" -match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); +var part1759 = match("MESSAGE#1105:00556:03/2", "nwparser.p0", "cache.%{}"); -var all366 = all_match({ +var all360 = all_match({ processors: [ - part1762, + part1756, select394, - part1765, + part1759, ], on_success: processor_chain([ dup19, @@ -22841,10 +20741,9 @@ var all366 = all_match({ ]), }); -var msg1121 = msg("00556:03", all366); +var msg1121 = msg("00556:03", all360); -var part1766 = // "Pattern{Constant('UF-MGR: Internal Error: '), Field(resultcode,false)}" -match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ +var part1760 = match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{resultcode}", processor_chain([ dup19, dup2, dup3, @@ -22852,10 +20751,9 @@ match("MESSAGE#1106:00556:04", "nwparser.payload", "UF-MGR: Internal Error: %{re dup5, ])); -var msg1122 = msg("00556:04", part1766); +var msg1122 = msg("00556:04", part1760); -var part1767 = // "Pattern{Constant('UF-MGR: Cache size changed to '), Field(fld2,false), Constant('(K).')}" -match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ +var part1761 = match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed to %{fld2}(K).", processor_chain([ dup19, dup2, dup3, @@ -22863,10 +20761,9 @@ match("MESSAGE#1107:00556:05", "nwparser.payload", "UF-MGR: Cache size changed t dup5, ])); -var msg1123 = msg("00556:05", part1767); +var msg1123 = msg("00556:05", part1761); -var part1768 = // "Pattern{Constant('UF-MGR: Cache timeout changes to '), Field(fld2,true), Constant(' (hours).')}" -match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ +var part1762 = match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout changes to %{fld2->} (hours).", processor_chain([ dup19, dup2, dup3, @@ -22874,10 +20771,9 @@ match("MESSAGE#1108:00556:06", "nwparser.payload", "UF-MGR: Cache timeout change dup5, ])); -var msg1124 = msg("00556:06", part1768); +var msg1124 = msg("00556:06", part1762); -var part1769 = // "Pattern{Constant('UF-MGR: Category update interval changed to '), Field(fld2,true), Constant(' (weeks).')}" -match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ +var part1763 = match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update interval changed to %{fld2->} (weeks).", processor_chain([ dup19, dup2, dup3, @@ -22885,15 +20781,14 @@ match("MESSAGE#1109:00556:07", "nwparser.payload", "UF-MGR: Category update inte dup5, ])); -var msg1125 = msg("00556:07", part1769); +var msg1125 = msg("00556:07", part1763); -var part1770 = // "Pattern{Constant('UF-MGR: Cache '), Field(p0,false)}" -match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); +var part1764 = match("MESSAGE#1110:00556:08/0", "nwparser.payload", "UF-MGR: Cache %{p0}"); -var all367 = all_match({ +var all361 = all_match({ processors: [ - part1770, - dup360, + part1764, + dup358, dup116, ], on_success: processor_chain([ @@ -22905,33 +20800,30 @@ var all367 = all_match({ ]), }); -var msg1126 = msg("00556:08", all367); +var msg1126 = msg("00556:08", all361); -var part1771 = // "Pattern{Constant('UF-MGR: URL BLOCKED: ip_addr ('), Field(fld2,false), Constant(') -> ip_addr ('), Field(fld3,false), Constant('), '), Field(fld4,true), Constant(' action: '), Field(disposition,false), Constant(', category: '), Field(fld5,false), Constant(', reason '), Field(result,false)}" -match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ - dup234, +var part1765 = match("MESSAGE#1111:00556:09", "nwparser.payload", "UF-MGR: URL BLOCKED: ip_addr (%{fld2}) -> ip_addr (%{fld3}), %{fld4->} action: %{disposition}, category: %{fld5}, reason %{result}", processor_chain([ + dup232, dup2, dup3, dup4, dup5, - dup284, + dup282, ])); -var msg1127 = msg("00556:09", part1771); +var msg1127 = msg("00556:09", part1765); -var part1772 = // "Pattern{Constant('UF-MGR: URL FILTER ERR: ip_addr ('), Field(fld2,false), Constant(') -> ip_addr ('), Field(fld3,false), Constant('), host: '), Field(fld5,true), Constant(' page: '), Field(fld4,true), Constant(' code: '), Field(resultcode,true), Constant(' reason: '), Field(result,false), Constant('.')}" -match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ - dup234, +var part1766 = match("MESSAGE#1112:00556:10", "nwparser.payload", "UF-MGR: URL FILTER ERR: ip_addr (%{fld2}) -> ip_addr (%{fld3}), host: %{fld5->} page: %{fld4->} code: %{resultcode->} reason: %{result}.", processor_chain([ + dup232, dup2, dup3, dup4, dup5, ])); -var msg1128 = msg("00556:10", part1772); +var msg1128 = msg("00556:10", part1766); -var part1773 = // "Pattern{Constant('UF-MGR: Primary CPA server changed to '), Field(fld2,false)}" -match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ +var part1767 = match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server changed to %{fld2}", processor_chain([ dup19, dup2, dup3, @@ -22939,24 +20831,22 @@ match("MESSAGE#1113:00556:11", "nwparser.payload", "UF-MGR: Primary CPA server c dup5, ])); -var msg1129 = msg("00556:11", part1773); +var msg1129 = msg("00556:11", part1767); -var part1774 = // "Pattern{Constant('UF-MGR: '), Field(fld2,true), Constant(' CPA server '), Field(p0,false)}" -match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); +var part1768 = match("MESSAGE#1114:00556:12/0", "nwparser.payload", "UF-MGR: %{fld2->} CPA server %{p0}"); var select395 = linear_select([ dup140, - dup171, + dup169, ]); -var part1775 = // "Pattern{Constant('changed to '), Field(fld3,false), Constant('.')}" -match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); +var part1769 = match("MESSAGE#1114:00556:12/2", "nwparser.p0", "changed to %{fld3}."); -var all368 = all_match({ +var all362 = all_match({ processors: [ - part1774, + part1768, select395, - part1775, + part1769, ], on_success: processor_chain([ dup19, @@ -22967,10 +20857,9 @@ var all368 = all_match({ ]), }); -var msg1130 = msg("00556:12", all368); +var msg1130 = msg("00556:12", all362); -var part1776 = // "Pattern{Constant('UF-MGR: SurfControl URL filtering '), Field(disposition,false), Constant('.')}" -match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ +var part1770 = match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filtering %{disposition}.", processor_chain([ dup19, dup2, dup3, @@ -22978,19 +20867,17 @@ match("MESSAGE#1115:00556:13", "nwparser.payload", "UF-MGR: SurfControl URL filt dup5, ])); -var msg1131 = msg("00556:13", part1776); +var msg1131 = msg("00556:13", part1770); -var part1777 = // "Pattern{Constant('UF-MGR: The url '), Field(url,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); +var part1771 = match("MESSAGE#1116:00556:14/0", "nwparser.payload", "UF-MGR: The url %{url->} was %{p0}"); -var part1778 = // "Pattern{Constant('category '), Field(fld2,false), Constant('.')}" -match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); +var part1772 = match("MESSAGE#1116:00556:14/2", "nwparser.p0", "category %{fld2}."); -var all369 = all_match({ +var all363 = all_match({ processors: [ - part1777, - dup409, - part1778, + part1771, + dup406, + part1772, ], on_success: processor_chain([ dup19, @@ -23001,19 +20888,17 @@ var all369 = all_match({ ]), }); -var msg1132 = msg("00556:14", all369); +var msg1132 = msg("00556:14", all363); -var part1779 = // "Pattern{Constant('UF-MGR: The category '), Field(fld2,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); +var part1773 = match("MESSAGE#1117:00556:15/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was %{p0}"); -var part1780 = // "Pattern{Constant('profile '), Field(fld3,true), Constant(' with action '), Field(disposition,false), Constant('.')}" -match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); +var part1774 = match("MESSAGE#1117:00556:15/2", "nwparser.p0", "profile %{fld3->} with action %{disposition}."); -var all370 = all_match({ +var all364 = all_match({ processors: [ - part1779, - dup409, - part1780, + part1773, + dup406, + part1774, ], on_success: processor_chain([ dup19, @@ -23021,39 +20906,35 @@ var all370 = all_match({ dup3, dup4, dup5, - dup284, + dup282, ]), }); -var msg1133 = msg("00556:15", all370); +var msg1133 = msg("00556:15", all364); -var part1781 = // "Pattern{Constant('UF-MGR: The '), Field(p0,false)}" -match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); +var part1775 = match("MESSAGE#1118:00556:16/0", "nwparser.payload", "UF-MGR: The %{p0}"); -var part1782 = // "Pattern{Constant('profile '), Field(p0,false)}" -match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); +var part1776 = match("MESSAGE#1118:00556:16/1_0", "nwparser.p0", "profile %{p0}"); -var part1783 = // "Pattern{Constant('category '), Field(p0,false)}" -match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); +var part1777 = match("MESSAGE#1118:00556:16/1_1", "nwparser.p0", "category %{p0}"); var select396 = linear_select([ - part1782, - part1783, + part1776, + part1777, ]); -var part1784 = // "Pattern{Constant(''), Field(fld2,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); +var part1778 = match("MESSAGE#1118:00556:16/2", "nwparser.p0", "%{fld2->} was %{p0}"); var select397 = linear_select([ dup104, dup120, ]); -var all371 = all_match({ +var all365 = all_match({ processors: [ - part1781, + part1775, select396, - part1784, + part1778, select397, dup116, ], @@ -23066,30 +20947,26 @@ var all371 = all_match({ ]), }); -var msg1134 = msg("00556:16", all371); +var msg1134 = msg("00556:16", all365); -var part1785 = // "Pattern{Constant('UF-MGR: The category '), Field(fld2,true), Constant(' was set in profile '), Field(profile,true), Constant(' as the '), Field(p0,false)}" -match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); +var part1779 = match("MESSAGE#1119:00556:17/0", "nwparser.payload", "UF-MGR: The category %{fld2->} was set in profile %{profile->} as the %{p0}"); -var part1786 = // "Pattern{Constant('black '), Field(p0,false)}" -match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); +var part1780 = match("MESSAGE#1119:00556:17/1_0", "nwparser.p0", "black %{p0}"); -var part1787 = // "Pattern{Constant('white '), Field(p0,false)}" -match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); +var part1781 = match("MESSAGE#1119:00556:17/1_1", "nwparser.p0", "white %{p0}"); var select398 = linear_select([ - part1786, - part1787, + part1780, + part1781, ]); -var part1788 = // "Pattern{Constant('list.'), Field(,false)}" -match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); +var part1782 = match("MESSAGE#1119:00556:17/2", "nwparser.p0", "list.%{}"); -var all372 = all_match({ +var all366 = all_match({ processors: [ - part1785, + part1779, select398, - part1788, + part1782, ], on_success: processor_chain([ dup19, @@ -23100,27 +20977,24 @@ var all372 = all_match({ ]), }); -var msg1135 = msg("00556:17", all372); +var msg1135 = msg("00556:17", all366); -var part1789 = // "Pattern{Constant('UF-MGR: The action for '), Field(fld2,true), Constant(' in profile '), Field(profile,true), Constant(' was '), Field(p0,false)}" -match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); +var part1783 = match("MESSAGE#1120:00556:18/0", "nwparser.payload", "UF-MGR: The action for %{fld2->} in profile %{profile->} was %{p0}"); -var part1790 = // "Pattern{Constant('changed '), Field(p0,false)}" -match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); +var part1784 = match("MESSAGE#1120:00556:18/1_1", "nwparser.p0", "changed %{p0}"); var select399 = linear_select([ dup101, - part1790, + part1784, ]); -var part1791 = // "Pattern{Constant('to '), Field(fld3,false), Constant('.')}" -match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); +var part1785 = match("MESSAGE#1120:00556:18/2", "nwparser.p0", "to %{fld3}."); -var all373 = all_match({ +var all367 = all_match({ processors: [ - part1789, + part1783, select399, - part1791, + part1785, ], on_success: processor_chain([ dup19, @@ -23131,29 +21005,26 @@ var all373 = all_match({ ]), }); -var msg1136 = msg("00556:18", all373); +var msg1136 = msg("00556:18", all367); -var part1792 = // "Pattern{Constant('UF-MGR: The category list from the CPA server '), Field(p0,false)}" -match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); +var part1786 = match("MESSAGE#1121:00556:20/0", "nwparser.payload", "UF-MGR: The category list from the CPA server %{p0}"); -var part1793 = // "Pattern{Constant('updated on'), Field(p0,false)}" -match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); +var part1787 = match("MESSAGE#1121:00556:20/2", "nwparser.p0", "updated on%{p0}"); var select400 = linear_select([ dup103, dup96, ]); -var part1794 = // "Pattern{Constant('the device.'), Field(,false)}" -match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); +var part1788 = match("MESSAGE#1121:00556:20/4", "nwparser.p0", "the device.%{}"); -var all374 = all_match({ +var all368 = all_match({ processors: [ - part1792, - dup357, - part1793, + part1786, + dup355, + part1787, select400, - part1794, + part1788, ], on_success: processor_chain([ dup19, @@ -23164,24 +21035,22 @@ var all374 = all_match({ ]), }); -var msg1137 = msg("00556:20", all374); +var msg1137 = msg("00556:20", all368); -var part1795 = // "Pattern{Constant('UF-MGR: URL BLOCKED: '), Field(saddr,false), Constant('('), Field(sport,false), Constant(')->'), Field(daddr,false), Constant('('), Field(dport,false), Constant('), '), Field(fld2,true), Constant(' action: '), Field(disposition,false), Constant(', category: '), Field(category,false), Constant(', reason: '), Field(result,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ - dup234, +var part1789 = match("MESSAGE#1122:00556:21", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} action: %{disposition}, category: %{category}, reason: %{result->} (%{fld1})", processor_chain([ + dup232, dup2, dup3, dup9, dup4, dup5, - dup284, + dup282, ])); -var msg1138 = msg("00556:21", part1795); +var msg1138 = msg("00556:21", part1789); -var part1796 = // "Pattern{Constant('UF-MGR: URL BLOCKED: '), Field(saddr,false), Constant('('), Field(sport,false), Constant(')->'), Field(daddr,false), Constant('('), Field(dport,false), Constant('), '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ - dup234, +var part1790 = match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr}(%{sport})->%{daddr}(%{dport}), %{fld2->} (%{fld1})", processor_chain([ + dup232, dup2, dup3, dup9, @@ -23189,7 +21058,7 @@ match("MESSAGE#1123:00556:22", "nwparser.payload", "UF-MGR: URL BLOCKED: %{saddr dup5, ])); -var msg1139 = msg("00556:22", part1796); +var msg1139 = msg("00556:22", part1790); var select401 = linear_select([ msg1118, @@ -23216,8 +21085,7 @@ var select401 = linear_select([ msg1139, ]); -var part1797 = // "Pattern{Constant('PPP LCP on interface '), Field(interface,true), Constant(' is '), Field(fld2,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ +var part1791 = match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interface->} is %{fld2}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -23226,10 +21094,9 @@ match("MESSAGE#1124:00572", "nwparser.payload", "PPP LCP on interface %{interfac dup5, ])); -var msg1140 = msg("00572", part1797); +var msg1140 = msg("00572", part1791); -var part1798 = // "Pattern{Constant('PPP authentication state on interface '), Field(interface,false), Constant(': '), Field(result,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ +var part1792 = match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on interface %{interface}: %{result}. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -23238,10 +21105,9 @@ match("MESSAGE#1125:00572:01", "nwparser.payload", "PPP authentication state on dup5, ])); -var msg1141 = msg("00572:01", part1798); +var msg1141 = msg("00572:01", part1792); -var part1799 = // "Pattern{Constant('PPP on interface '), Field(interface,true), Constant(' is '), Field(disposition,true), Constant(' by receiving Terminate-Request. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ +var part1793 = match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface->} is %{disposition->} by receiving Terminate-Request. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -23250,7 +21116,7 @@ match("MESSAGE#1126:00572:03", "nwparser.payload", "PPP on interface %{interface dup5, ])); -var msg1142 = msg("00572:03", part1799); +var msg1142 = msg("00572:03", part1793); var select402 = linear_select([ msg1140, @@ -23258,8 +21124,7 @@ var select402 = linear_select([ msg1142, ]); -var part1800 = // "Pattern{Constant('PBR policy "'), Field(policyname,false), Constant('" rebuilding lookup tree for virtual router "'), Field(node,false), Constant('". ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ +var part1794 = match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" rebuilding lookup tree for virtual router \"%{node}\". (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -23267,10 +21132,9 @@ match("MESSAGE#1127:00615", "nwparser.payload", "PBR policy \"%{policyname}\" re dup9, ])); -var msg1143 = msg("00615", part1800); +var msg1143 = msg("00615", part1794); -var part1801 = // "Pattern{Constant('PBR policy "'), Field(policyname,false), Constant('" lookup tree rebuilt successfully in virtual router "'), Field(node,false), Constant('". ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ +var part1795 = match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" lookup tree rebuilt successfully in virtual router \"%{node}\". (%{fld1})", processor_chain([ dup44, dup2, dup4, @@ -23278,15 +21142,14 @@ match("MESSAGE#1128:00615:01", "nwparser.payload", "PBR policy \"%{policyname}\" dup9, ])); -var msg1144 = msg("00615:01", part1801); +var msg1144 = msg("00615:01", part1795); var select403 = linear_select([ msg1143, msg1144, ]); -var part1802 = // "Pattern{Field(signame,true), Constant(' attack! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,false), Constant(', through policy '), Field(policyname,false), Constant('. Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1796 = match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol}, through policy %{policyname}. Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup59, @@ -23297,10 +21160,9 @@ match("MESSAGE#1129:00601", "nwparser.payload", "%{signame->} attack! From %{sad dup61, ])); -var msg1145 = msg("00601", part1802); +var msg1145 = msg("00601", part1796); -var part1803 = // "Pattern{Field(signame,true), Constant(' has been detected from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' through policy '), Field(policyname,true), Constant(' '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part1797 = match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detected from %{saddr}/%{sport->} to %{daddr}/%{dport->} through policy %{policyname->} %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup2, dup59, @@ -23311,10 +21173,9 @@ match("MESSAGE#1130:00601:01", "nwparser.payload", "%{signame->} has been detect dup61, ])); -var msg1146 = msg("00601:01", part1803); +var msg1146 = msg("00601:01", part1797); -var part1804 = // "Pattern{Constant('Error in initializing multicast.'), Field(,false)}" -match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ +var part1798 = match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multicast.%{}", processor_chain([ dup19, dup2, dup3, @@ -23322,7 +21183,7 @@ match("MESSAGE#1131:00601:18", "nwparser.payload", "Error in initializing multic dup5, ])); -var msg1147 = msg("00601:18", part1804); +var msg1147 = msg("00601:18", part1798); var select404 = linear_select([ msg1145, @@ -23330,8 +21191,7 @@ var select404 = linear_select([ msg1147, ]); -var part1805 = // "Pattern{Constant('PIMSM Error in initializing interface state change'), Field(,false)}" -match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ +var part1799 = match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing interface state change%{}", processor_chain([ dup19, dup2, dup3, @@ -23339,48 +21199,41 @@ match("MESSAGE#1132:00602", "nwparser.payload", "PIMSM Error in initializing int dup5, ])); -var msg1148 = msg("00602", part1805); +var msg1148 = msg("00602", part1799); -var part1806 = // "Pattern{Constant('Switch event: the status of ethernet port '), Field(fld2,true), Constant(' changed to link '), Field(p0,false)}" -match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); +var part1800 = match("MESSAGE#1133:00612/0", "nwparser.payload", "Switch event: the status of ethernet port %{fld2->} changed to link %{p0}"); -var part1807 = // "Pattern{Constant(', duplex '), Field(p0,false)}" -match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); +var part1801 = match("MESSAGE#1133:00612/2", "nwparser.p0", ", duplex %{p0}"); -var part1808 = // "Pattern{Constant('full '), Field(p0,false)}" -match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); +var part1802 = match("MESSAGE#1133:00612/3_0", "nwparser.p0", "full %{p0}"); -var part1809 = // "Pattern{Constant('half '), Field(p0,false)}" -match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); +var part1803 = match("MESSAGE#1133:00612/3_1", "nwparser.p0", "half %{p0}"); var select405 = linear_select([ - part1808, - part1809, + part1802, + part1803, ]); -var part1810 = // "Pattern{Constant(', speed 10'), Field(p0,false)}" -match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); +var part1804 = match("MESSAGE#1133:00612/4", "nwparser.p0", ", speed 10%{p0}"); -var part1811 = // "Pattern{Constant('0 '), Field(p0,false)}" -match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); +var part1805 = match("MESSAGE#1133:00612/5_0", "nwparser.p0", "0 %{p0}"); var select406 = linear_select([ - part1811, + part1805, dup96, ]); -var part1812 = // "Pattern{Constant('M. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); +var part1806 = match("MESSAGE#1133:00612/6", "nwparser.p0", "M. (%{fld1})"); -var all375 = all_match({ +var all369 = all_match({ processors: [ - part1806, - dup355, - part1807, + part1800, + dup353, + part1801, select405, - part1810, + part1804, select406, - part1812, + part1806, ], on_success: processor_chain([ dup1, @@ -23392,11 +21245,10 @@ var all375 = all_match({ ]), }); -var msg1149 = msg("00612", all375); +var msg1149 = msg("00612", all369); -var part1813 = // "Pattern{Constant('RTSYNC: Event posted to send all the DRP routes to backup device. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ - dup274, +var part1807 = match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send all the DRP routes to backup device. (%{fld1})", processor_chain([ + dup272, dup2, dup3, dup9, @@ -23404,33 +21256,29 @@ match("MESSAGE#1134:00620", "nwparser.payload", "RTSYNC: Event posted to send al dup5, ])); -var msg1150 = msg("00620", part1813); +var msg1150 = msg("00620", part1807); -var part1814 = // "Pattern{Constant('RTSYNC: '), Field(p0,false)}" -match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); +var part1808 = match("MESSAGE#1135:00620:01/0", "nwparser.payload", "RTSYNC: %{p0}"); -var part1815 = // "Pattern{Constant('Serviced'), Field(p0,false)}" -match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); +var part1809 = match("MESSAGE#1135:00620:01/1_0", "nwparser.p0", "Serviced%{p0}"); -var part1816 = // "Pattern{Constant('Recieved'), Field(p0,false)}" -match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); +var part1810 = match("MESSAGE#1135:00620:01/1_1", "nwparser.p0", "Recieved%{p0}"); var select407 = linear_select([ - part1815, - part1816, + part1809, + part1810, ]); -var part1817 = // "Pattern{Field(,false), Constant('coldstart request for route synchronization from NSRP peer. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); +var part1811 = match("MESSAGE#1135:00620:01/2", "nwparser.p0", "%{}coldstart request for route synchronization from NSRP peer. (%{fld1})"); -var all376 = all_match({ +var all370 = all_match({ processors: [ - part1814, + part1808, select407, - part1817, + part1811, ], on_success: processor_chain([ - dup274, + dup272, dup2, dup3, dup9, @@ -23439,11 +21287,10 @@ var all376 = all_match({ ]), }); -var msg1151 = msg("00620:01", all376); +var msg1151 = msg("00620:01", all370); -var part1818 = // "Pattern{Constant('RTSYNC: Started timer to purge all the DRP backup routes - '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ - dup274, +var part1812 = match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to purge all the DRP backup routes - %{fld2->} (%{fld1})", processor_chain([ + dup272, dup2, dup3, dup9, @@ -23451,11 +21298,10 @@ match("MESSAGE#1136:00620:02", "nwparser.payload", "RTSYNC: Started timer to pur dup5, ])); -var msg1152 = msg("00620:02", part1818); +var msg1152 = msg("00620:02", part1812); -var part1819 = // "Pattern{Constant('RTSYNC: Event posted to purge backup routes in all vrouters. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ - dup274, +var part1813 = match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purge backup routes in all vrouters. (%{fld1})", processor_chain([ + dup272, dup2, dup3, dup9, @@ -23463,11 +21309,10 @@ match("MESSAGE#1137:00620:03", "nwparser.payload", "RTSYNC: Event posted to purg dup5, ])); -var msg1153 = msg("00620:03", part1819); +var msg1153 = msg("00620:03", part1813); -var part1820 = // "Pattern{Constant('RTSYNC: Timer to purge the DRP backup routes is stopped. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ - dup274, +var part1814 = match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the DRP backup routes is stopped. (%{fld1})", processor_chain([ + dup272, dup2, dup3, dup9, @@ -23475,7 +21320,7 @@ match("MESSAGE#1138:00620:04", "nwparser.payload", "RTSYNC: Timer to purge the D dup5, ])); -var msg1154 = msg("00620:04", part1820); +var msg1154 = msg("00620:04", part1814); var select408 = linear_select([ msg1150, @@ -23485,9 +21330,8 @@ var select408 = linear_select([ msg1154, ]); -var part1821 = // "Pattern{Constant('NHRP : NHRP instance in virtual router '), Field(node,true), Constant(' is created. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ - dup275, +var part1815 = match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual router %{node->} is created. (%{fld1})", processor_chain([ + dup273, dup2, dup3, dup9, @@ -23495,30 +21339,27 @@ match("MESSAGE#1139:00622", "nwparser.payload", "NHRP : NHRP instance in virtual dup5, ])); -var msg1155 = msg("00622", part1821); +var msg1155 = msg("00622", part1815); -var part1822 = // "Pattern{Constant('Session (id '), Field(sessionid,true), Constant(' src-ip '), Field(saddr,true), Constant(' dst-ip '), Field(daddr,true), Constant(' dst port '), Field(dport,false), Constant(') route is '), Field(p0,false)}" -match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); +var part1816 = match("MESSAGE#1140:00625/0", "nwparser.payload", "Session (id %{sessionid->} src-ip %{saddr->} dst-ip %{daddr->} dst port %{dport}) route is %{p0}"); -var part1823 = // "Pattern{Constant('invalid'), Field(p0,false)}" -match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); +var part1817 = match("MESSAGE#1140:00625/1_0", "nwparser.p0", "invalid%{p0}"); -var part1824 = // "Pattern{Constant('valid'), Field(p0,false)}" -match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); +var part1818 = match("MESSAGE#1140:00625/1_1", "nwparser.p0", "valid%{p0}"); var select409 = linear_select([ - part1823, - part1824, + part1817, + part1818, ]); -var all377 = all_match({ +var all371 = all_match({ processors: [ - part1822, + part1816, select409, dup49, ], on_success: processor_chain([ - dup275, + dup273, dup2, dup4, dup5, @@ -23526,37 +21367,32 @@ var all377 = all_match({ ]), }); -var msg1156 = msg("00625", all377); +var msg1156 = msg("00625", all371); -var part1825 = // "Pattern{Constant('audit log queue '), Field(p0,false)}" -match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); +var part1819 = match("MESSAGE#1141:00628/0", "nwparser.payload", "audit log queue %{p0}"); -var part1826 = // "Pattern{Constant('Traffic Log '), Field(p0,false)}" -match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); +var part1820 = match("MESSAGE#1141:00628/1_0", "nwparser.p0", "Traffic Log %{p0}"); -var part1827 = // "Pattern{Constant('Event Alarm Log '), Field(p0,false)}" -match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); +var part1821 = match("MESSAGE#1141:00628/1_1", "nwparser.p0", "Event Alarm Log %{p0}"); -var part1828 = // "Pattern{Constant('Event Log '), Field(p0,false)}" -match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); +var part1822 = match("MESSAGE#1141:00628/1_2", "nwparser.p0", "Event Log %{p0}"); var select410 = linear_select([ - part1826, - part1827, - part1828, + part1820, + part1821, + part1822, ]); -var part1829 = // "Pattern{Constant('is overwritten ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); +var part1823 = match("MESSAGE#1141:00628/2", "nwparser.p0", "is overwritten (%{fld1})"); -var all378 = all_match({ +var all372 = all_match({ processors: [ - part1825, + part1819, select410, - part1829, + part1823, ], on_success: processor_chain([ - dup225, + dup223, dup2, dup4, dup5, @@ -23564,22 +21400,20 @@ var all378 = all_match({ ]), }); -var msg1157 = msg("00628", all378); +var msg1157 = msg("00628", all372); -var part1830 = // "Pattern{Constant('Log setting was modified to '), Field(disposition,true), Constant(' '), Field(fld2,true), Constant(' level by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ +var part1824 = match("MESSAGE#1142:00767:50", "nwparser.payload", "Log setting was modified to %{disposition->} %{fld2->} level by admin %{administrator->} (%{fld1})", processor_chain([ dup1, dup2, dup4, dup5, dup9, - dup284, + dup282, ])); -var msg1158 = msg("00767:50", part1830); +var msg1158 = msg("00767:50", part1824); -var part1831 = // "Pattern{Constant('Attack CS:Man in Middle is created by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ +var part1825 = match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ dup58, dup2, dup4, @@ -23587,10 +21421,9 @@ match("MESSAGE#1143:00767:51", "nwparser.payload", "Attack CS:Man in Middle is c dup9, ])); -var msg1159 = msg("00767:51", part1831); +var msg1159 = msg("00767:51", part1825); -var part1832 = // "Pattern{Constant('Attack group '), Field(group,true), Constant(' is created by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ +var part1826 = match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is created by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ dup58, dup2, dup4, @@ -23598,10 +21431,9 @@ match("MESSAGE#1144:00767:52", "nwparser.payload", "Attack group %{group->} is c dup9, ])); -var msg1160 = msg("00767:52", part1832); +var msg1160 = msg("00767:52", part1826); -var part1833 = // "Pattern{Constant('Attack CS:Man in Middle is added to attack group '), Field(group,true), Constant(' by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ +var part1827 = match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is added to attack group %{group->} by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by admin %{administrator->} (%{fld1})", processor_chain([ dup58, dup2, dup4, @@ -23609,10 +21441,9 @@ match("MESSAGE#1145:00767:53", "nwparser.payload", "Attack CS:Man in Middle is a dup9, ])); -var msg1161 = msg("00767:53", part1833); +var msg1161 = msg("00767:53", part1827); -var part1834 = // "Pattern{Constant('Cannot contact the SecurID server'), Field(,false)}" -match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ +var part1828 = match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID server%{}", processor_chain([ dup27, setc("ec_theme","Communication"), dup39, @@ -23622,25 +21453,22 @@ match("MESSAGE#1146:00767", "nwparser.payload", "Cannot contact the SecurID serv dup5, ])); -var msg1162 = msg("00767", part1834); +var msg1162 = msg("00767", part1828); -var part1835 = // "Pattern{Constant('System auto-config of file '), Field(fld2,true), Constant(' from TFTP server '), Field(hostip,true), Constant(' has '), Field(p0,false)}" -match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); +var part1829 = match("MESSAGE#1147:00767:01/0", "nwparser.payload", "System auto-config of file %{fld2->} from TFTP server %{hostip->} has %{p0}"); -var part1836 = // "Pattern{Constant('been loaded successfully'), Field(,false)}" -match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); +var part1830 = match("MESSAGE#1147:00767:01/1_0", "nwparser.p0", "been loaded successfully%{}"); -var part1837 = // "Pattern{Constant('failed'), Field(,false)}" -match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); +var part1831 = match("MESSAGE#1147:00767:01/1_1", "nwparser.p0", "failed%{}"); var select411 = linear_select([ - part1836, - part1837, + part1830, + part1831, ]); -var all379 = all_match({ +var all373 = all_match({ processors: [ - part1835, + part1829, select411, ], on_success: processor_chain([ @@ -23652,10 +21480,9 @@ var all379 = all_match({ ]), }); -var msg1163 = msg("00767:01", all379); +var msg1163 = msg("00767:01", all373); -var part1838 = // "Pattern{Constant('netscreen: System Config saved from host '), Field(saddr,false)}" -match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ +var part1832 = match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config saved from host %{saddr}", processor_chain([ setc("eventcategory","1702000000"), dup2, dup3, @@ -23663,10 +21490,9 @@ match("MESSAGE#1148:00767:02", "nwparser.payload", "netscreen: System Config sav dup5, ])); -var msg1164 = msg("00767:02", part1838); +var msg1164 = msg("00767:02", part1832); -var part1839 = // "Pattern{Constant('System Config saved to filename '), Field(filename,false)}" -match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ +var part1833 = match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filename %{filename}", processor_chain([ dup1, dup2, dup3, @@ -23674,10 +21500,9 @@ match("MESSAGE#1149:00767:03", "nwparser.payload", "System Config saved to filen dup5, ])); -var msg1165 = msg("00767:03", part1839); +var msg1165 = msg("00767:03", part1833); -var part1840 = // "Pattern{Constant('System is operational.'), Field(,false)}" -match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ +var part1834 = match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", processor_chain([ dup44, dup2, dup3, @@ -23685,10 +21510,9 @@ match("MESSAGE#1150:00767:04", "nwparser.payload", "System is operational.%{}", dup5, ])); -var msg1166 = msg("00767:04", part1840); +var msg1166 = msg("00767:04", part1834); -var part1841 = // "Pattern{Constant('The device cannot contact the SecurID server'), Field(,false)}" -match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ +var part1835 = match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact the SecurID server%{}", processor_chain([ dup27, dup2, dup3, @@ -23696,10 +21520,9 @@ match("MESSAGE#1151:00767:05", "nwparser.payload", "The device cannot contact th dup5, ])); -var msg1167 = msg("00767:05", part1841); +var msg1167 = msg("00767:05", part1835); -var part1842 = // "Pattern{Constant('The device cannot send data to the SecurID server'), Field(,false)}" -match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ +var part1836 = match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data to the SecurID server%{}", processor_chain([ dup27, dup2, dup3, @@ -23707,10 +21530,9 @@ match("MESSAGE#1152:00767:06", "nwparser.payload", "The device cannot send data dup5, ])); -var msg1168 = msg("00767:06", part1842); +var msg1168 = msg("00767:06", part1836); -var part1843 = // "Pattern{Constant('The system configuration was saved from peer unit by admin'), Field(,false)}" -match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ +var part1837 = match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was saved from peer unit by admin%{}", processor_chain([ dup1, dup2, dup3, @@ -23718,15 +21540,14 @@ match("MESSAGE#1153:00767:07", "nwparser.payload", "The system configuration was dup5, ])); -var msg1169 = msg("00767:07", part1843); +var msg1169 = msg("00767:07", part1837); -var part1844 = // "Pattern{Constant('The system configuration was saved by admin '), Field(p0,false)}" -match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); +var part1838 = match("MESSAGE#1154:00767:08/0", "nwparser.payload", "The system configuration was saved by admin %{p0}"); -var all380 = all_match({ +var all374 = all_match({ processors: [ - part1844, - dup400, + part1838, + dup397, ], on_success: processor_chain([ dup1, @@ -23738,25 +21559,22 @@ var all380 = all_match({ ]), }); -var msg1170 = msg("00767:08", all380); +var msg1170 = msg("00767:08", all374); -var part1845 = // "Pattern{Constant('traffic shaping is turned O'), Field(p0,false)}" -match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); +var part1839 = match("MESSAGE#1155:00767:09/0", "nwparser.payload", "traffic shaping is turned O%{p0}"); -var part1846 = // "Pattern{Constant('N'), Field(,false)}" -match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); +var part1840 = match("MESSAGE#1155:00767:09/1_0", "nwparser.p0", "N%{}"); -var part1847 = // "Pattern{Constant('FF'), Field(,false)}" -match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); +var part1841 = match("MESSAGE#1155:00767:09/1_1", "nwparser.p0", "FF%{}"); var select412 = linear_select([ - part1846, - part1847, + part1840, + part1841, ]); -var all381 = all_match({ +var all375 = all_match({ processors: [ - part1845, + part1839, select412, ], on_success: processor_chain([ @@ -23768,15 +21586,14 @@ var all381 = all_match({ ]), }); -var msg1171 = msg("00767:09", all381); +var msg1171 = msg("00767:09", all375); -var part1848 = // "Pattern{Constant('The system configuration was saved from host '), Field(saddr,true), Constant(' by admin '), Field(p0,false)}" -match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); +var part1842 = match("MESSAGE#1156:00767:10/0", "nwparser.payload", "The system configuration was saved from host %{saddr->} by admin %{p0}"); -var all382 = all_match({ +var all376 = all_match({ processors: [ - part1848, - dup400, + part1842, + dup397, ], on_success: processor_chain([ dup1, @@ -23788,40 +21605,35 @@ var all382 = all_match({ ]), }); -var msg1172 = msg("00767:10", all382); +var msg1172 = msg("00767:10", all376); -var part1849 = // "Pattern{Constant('Fatal error. The NetScreen device was unable to upgrade the '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); +var part1843 = match("MESSAGE#1157:00767:11/0", "nwparser.payload", "Fatal error. The NetScreen device was unable to upgrade the %{p0}"); -var part1850 = // "Pattern{Constant('file system '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); +var part1844 = match("MESSAGE#1157:00767:11/1_1", "nwparser.p0", "file system %{p0}"); var select413 = linear_select([ - dup333, - part1850, + dup331, + part1844, ]); -var part1851 = // "Pattern{Constant(', and the '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); +var part1845 = match("MESSAGE#1157:00767:11/2", "nwparser.p0", ", and the %{p0}"); -var part1852 = // "Pattern{Constant('old file system '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); +var part1846 = match("MESSAGE#1157:00767:11/3_1", "nwparser.p0", "old file system %{p0}"); var select414 = linear_select([ - dup333, - part1852, + dup331, + part1846, ]); -var part1853 = // "Pattern{Constant('is damaged.'), Field(,false)}" -match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); +var part1847 = match("MESSAGE#1157:00767:11/4", "nwparser.p0", "is damaged.%{}"); -var all383 = all_match({ +var all377 = all_match({ processors: [ - part1849, + part1843, select413, - part1851, + part1845, select414, - part1853, + part1847, ], on_success: processor_chain([ dup18, @@ -23832,10 +21644,9 @@ var all383 = all_match({ ]), }); -var msg1173 = msg("00767:11", all383); +var msg1173 = msg("00767:11", all377); -var part1854 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ +var part1848 = match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from host %{saddr->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -23844,15 +21655,14 @@ match("MESSAGE#1158:00767:12", "nwparser.payload", "System configuration saved b dup5, ])); -var msg1174 = msg("00767:12", part1854); +var msg1174 = msg("00767:12", part1848); -var part1855 = // "Pattern{Field(fld2,false), Constant('Environment variable '), Field(fld3,true), Constant(' is changed to '), Field(fld4,true), Constant(' by admin '), Field(p0,false)}" -match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); +var part1849 = match("MESSAGE#1159:00767:13/0", "nwparser.payload", "%{fld2}Environment variable %{fld3->} is changed to %{fld4->} by admin %{p0}"); -var all384 = all_match({ +var all378 = all_match({ processors: [ - part1855, - dup400, + part1849, + dup397, ], on_success: processor_chain([ dup1, @@ -23864,38 +21674,33 @@ var all384 = all_match({ ]), }); -var msg1175 = msg("00767:13", all384); +var msg1175 = msg("00767:13", all378); -var part1856 = // "Pattern{Constant('System was '), Field(p0,false)}" -match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); +var part1850 = match("MESSAGE#1160:00767:14/0", "nwparser.payload", "System was %{p0}"); -var part1857 = // "Pattern{Constant('reset '), Field(p0,false)}" -match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); +var part1851 = match("MESSAGE#1160:00767:14/1_0", "nwparser.p0", "reset %{p0}"); var select415 = linear_select([ - part1857, - dup264, + part1851, + dup262, ]); -var part1858 = // "Pattern{Constant('at '), Field(fld2,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); +var part1852 = match("MESSAGE#1160:00767:14/2", "nwparser.p0", "at %{fld2->} by %{p0}"); -var part1859 = // "Pattern{Constant('admin '), Field(administrator,false)}" -match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); +var part1853 = match("MESSAGE#1160:00767:14/3_0", "nwparser.p0", "admin %{administrator}"); -var part1860 = // "Pattern{Field(username,false)}" -match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); +var part1854 = match_copy("MESSAGE#1160:00767:14/3_1", "nwparser.p0", "username"); var select416 = linear_select([ - part1859, - part1860, + part1853, + part1854, ]); -var all385 = all_match({ +var all379 = all_match({ processors: [ - part1856, + part1850, select415, - part1858, + part1852, select416, ], on_success: processor_chain([ @@ -23907,39 +21712,34 @@ var all385 = all_match({ ]), }); -var msg1176 = msg("00767:14", all385); +var msg1176 = msg("00767:14", all379); -var part1861 = // "Pattern{Constant('System '), Field(p0,false)}" -match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); +var part1855 = match("MESSAGE#1161:00767:15/1_0", "nwparser.p0", "System %{p0}"); -var part1862 = // "Pattern{Constant('Event '), Field(p0,false)}" -match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); +var part1856 = match("MESSAGE#1161:00767:15/1_1", "nwparser.p0", "Event %{p0}"); -var part1863 = // "Pattern{Constant('Traffic '), Field(p0,false)}" -match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); +var part1857 = match("MESSAGE#1161:00767:15/1_2", "nwparser.p0", "Traffic %{p0}"); var select417 = linear_select([ - part1861, - part1862, - part1863, + part1855, + part1856, + part1857, ]); -var part1864 = // "Pattern{Constant('log was reviewed by '), Field(p0,false)}" -match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); +var part1858 = match("MESSAGE#1161:00767:15/2", "nwparser.p0", "log was reviewed by %{p0}"); -var part1865 = // "Pattern{Field(,true), Constant(' '), Field(username,false), Constant('.')}" -match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); +var part1859 = match("MESSAGE#1161:00767:15/4", "nwparser.p0", "%{} %{username}."); -var all386 = all_match({ +var all380 = all_match({ processors: [ - dup185, + dup183, select417, - part1864, - dup338, - part1865, + part1858, + dup336, + part1859, ], on_success: processor_chain([ - dup225, + dup223, dup2, dup3, dup4, @@ -23947,10 +21747,9 @@ var all386 = all_match({ ]), }); -var msg1177 = msg("00767:15", all386); +var msg1177 = msg("00767:15", all380); -var part1866 = // "Pattern{Field(fld2,true), Constant(' Admin '), Field(administrator,true), Constant(' issued command '), Field(info,true), Constant(' to redirect output.')}" -match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ +var part1860 = match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administrator->} issued command %{info->} to redirect output.", processor_chain([ dup1, dup2, dup3, @@ -23958,15 +21757,14 @@ match("MESSAGE#1162:00767:16", "nwparser.payload", "%{fld2->} Admin %{administra dup5, ])); -var msg1178 = msg("00767:16", part1866); +var msg1178 = msg("00767:16", part1860); -var part1867 = // "Pattern{Field(fld2,true), Constant(' Save new software from '), Field(fld3,true), Constant(' to flash by admin '), Field(p0,false)}" -match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); +var part1861 = match("MESSAGE#1163:00767:17/0", "nwparser.payload", "%{fld2->} Save new software from %{fld3->} to flash by admin %{p0}"); -var all387 = all_match({ +var all381 = all_match({ processors: [ - part1867, - dup400, + part1861, + dup397, ], on_success: processor_chain([ dup1, @@ -23978,10 +21776,9 @@ var all387 = all_match({ ]), }); -var msg1179 = msg("00767:17", all387); +var msg1179 = msg("00767:17", all381); -var part1868 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' has been '), Field(fld2,true), Constant(' saved to flash.')}" -match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ +var part1862 = match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{version->} has been %{fld2->} saved to flash.", processor_chain([ dup1, dup2, dup3, @@ -23989,10 +21786,9 @@ match("MESSAGE#1164:00767:18", "nwparser.payload", "Attack database version %{ve dup5, ])); -var msg1180 = msg("00767:18", part1868); +var msg1180 = msg("00767:18", part1862); -var part1869 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' was rejected because the authentication check failed.')}" -match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ +var part1863 = match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{version->} was rejected because the authentication check failed.", processor_chain([ dup1, dup2, dup3, @@ -24000,10 +21796,9 @@ match("MESSAGE#1165:00767:19", "nwparser.payload", "Attack database version %{ve dup5, ])); -var msg1181 = msg("00767:19", part1869); +var msg1181 = msg("00767:19", part1863); -var part1870 = // "Pattern{Constant('The dictionary file version of the RADIUS server '), Field(hostname,true), Constant(' does not match '), Field(fld2,false)}" -match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ +var part1864 = match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version of the RADIUS server %{hostname->} does not match %{fld2}", processor_chain([ dup1, dup2, dup3, @@ -24011,10 +21806,9 @@ match("MESSAGE#1166:00767:20", "nwparser.payload", "The dictionary file version dup5, ])); -var msg1182 = msg("00767:20", part1870); +var msg1182 = msg("00767:20", part1864); -var part1871 = // "Pattern{Constant('Session ('), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(', '), Field(fld4,false), Constant(') cleared '), Field(fld5,false)}" -match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ +var part1865 = match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, %{fld4}) cleared %{fld5}", processor_chain([ dup1, dup2, dup3, @@ -24022,47 +21816,40 @@ match("MESSAGE#1167:00767:21", "nwparser.payload", "Session (%{fld2->} %{fld3}, dup5, ])); -var msg1183 = msg("00767:21", part1871); +var msg1183 = msg("00767:21", part1865); -var part1872 = // "Pattern{Constant('The system configuration was not saved '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); +var part1866 = match("MESSAGE#1168:00767:22/0", "nwparser.payload", "The system configuration was not saved %{p0}"); -var part1873 = // "Pattern{Field(fld2,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); +var part1867 = match("MESSAGE#1168:00767:22/1_0", "nwparser.p0", "%{fld2->} by admin %{administrator->} via NSRP Peer %{p0}"); -var part1874 = // "Pattern{Constant(''), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); +var part1868 = match("MESSAGE#1168:00767:22/1_1", "nwparser.p0", "%{fld2->} %{p0}"); var select418 = linear_select([ - part1873, - part1874, + part1867, + part1868, ]); -var part1875 = // "Pattern{Constant('by administrator '), Field(fld3,false), Constant('. '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); +var part1869 = match("MESSAGE#1168:00767:22/2", "nwparser.p0", "by administrator %{fld3}. %{p0}"); -var part1876 = // "Pattern{Constant('It was locked '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); +var part1870 = match("MESSAGE#1168:00767:22/3_0", "nwparser.p0", "It was locked %{p0}"); -var part1877 = // "Pattern{Constant('Locked '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); +var part1871 = match("MESSAGE#1168:00767:22/3_1", "nwparser.p0", "Locked %{p0}"); var select419 = linear_select([ - part1876, - part1877, + part1870, + part1871, ]); -var part1878 = // "Pattern{Constant('by administrator '), Field(fld4,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); +var part1872 = match("MESSAGE#1168:00767:22/4", "nwparser.p0", "by administrator %{fld4->} %{p0}"); -var all388 = all_match({ +var all382 = all_match({ processors: [ - part1872, + part1866, select418, - part1875, + part1869, select419, - part1878, - dup356, + part1872, + dup354, ], on_success: processor_chain([ dup50, @@ -24076,10 +21863,9 @@ var all388 = all_match({ ]), }); -var msg1184 = msg("00767:22", all388); +var msg1184 = msg("00767:22", all382); -var part1879 = // "Pattern{Constant('Save new software from slot filename '), Field(filename,true), Constant(' to flash memory by administrator '), Field(administrator,false)}" -match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ +var part1873 = match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot filename %{filename->} to flash memory by administrator %{administrator}", processor_chain([ dup1, dup2, dup3, @@ -24087,30 +21873,27 @@ match("MESSAGE#1169:00767:23", "nwparser.payload", "Save new software from slot dup5, ])); -var msg1185 = msg("00767:23", part1879); +var msg1185 = msg("00767:23", part1873); -var part1880 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' from '), Field(p0,false)}" -match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); +var part1874 = match("MESSAGE#1170:00767:25/0", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} from %{p0}"); var select420 = linear_select([ - dup171, + dup169, dup16, ]); -var part1881 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); +var part1875 = match("MESSAGE#1170:00767:25/3_0", "nwparser.p0", "%{saddr}:%{sport->} by %{p0}"); -var part1882 = // "Pattern{Field(saddr,true), Constant(' by '), Field(p0,false)}" -match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); +var part1876 = match("MESSAGE#1170:00767:25/3_1", "nwparser.p0", "%{saddr->} by %{p0}"); var select421 = linear_select([ - part1881, - part1882, + part1875, + part1876, ]); -var all389 = all_match({ +var all383 = all_match({ processors: [ - part1880, + part1874, select420, dup23, select421, @@ -24125,41 +21908,35 @@ var all389 = all_match({ ]), }); -var msg1186 = msg("00767:25", all389); +var msg1186 = msg("00767:25", all383); -var part1883 = // "Pattern{Constant('Lock configuration '), Field(p0,false)}" -match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); +var part1877 = match("MESSAGE#1171:00767:26/0", "nwparser.payload", "Lock configuration %{p0}"); -var part1884 = // "Pattern{Constant('started'), Field(p0,false)}" -match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); +var part1878 = match("MESSAGE#1171:00767:26/1_0", "nwparser.p0", "started%{p0}"); -var part1885 = // "Pattern{Constant('ended'), Field(p0,false)}" -match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); +var part1879 = match("MESSAGE#1171:00767:26/1_1", "nwparser.p0", "ended%{p0}"); var select422 = linear_select([ - part1884, - part1885, + part1878, + part1879, ]); -var part1886 = // "Pattern{Field(,false), Constant('by task '), Field(p0,false)}" -match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); +var part1880 = match("MESSAGE#1171:00767:26/2", "nwparser.p0", "%{}by task %{p0}"); -var part1887 = // "Pattern{Constant(''), Field(fld3,false), Constant(', with a timeout value of '), Field(fld2,false)}" -match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); +var part1881 = match("MESSAGE#1171:00767:26/3_0", "nwparser.p0", "%{fld3}, with a timeout value of %{fld2}"); -var part1888 = // "Pattern{Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); +var part1882 = match("MESSAGE#1171:00767:26/3_1", "nwparser.p0", "%{fld2->} (%{fld1})"); var select423 = linear_select([ - part1887, - part1888, + part1881, + part1882, ]); -var all390 = all_match({ +var all384 = all_match({ processors: [ - part1883, + part1877, select422, - part1886, + part1880, select423, ], on_success: processor_chain([ @@ -24174,29 +21951,26 @@ var all390 = all_match({ ]), }); -var msg1187 = msg("00767:26", all390); +var msg1187 = msg("00767:26", all384); -var part1889 = // "Pattern{Constant('Environment variable '), Field(fld2,true), Constant(' changed to '), Field(p0,false)}" -match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); +var part1883 = match("MESSAGE#1172:00767:27/0", "nwparser.payload", "Environment variable %{fld2->} changed to %{p0}"); -var part1890 = // "Pattern{Field(fld3,true), Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); +var part1884 = match("MESSAGE#1172:00767:27/1_0", "nwparser.p0", "%{fld3->} by %{username->} (%{fld1})"); -var part1891 = // "Pattern{Field(fld3,false)}" -match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); +var part1885 = match_copy("MESSAGE#1172:00767:27/1_1", "nwparser.p0", "fld3"); var select424 = linear_select([ - part1890, - part1891, + part1884, + part1885, ]); -var all391 = all_match({ +var all385 = all_match({ processors: [ - part1889, + part1883, select424, ], on_success: processor_chain([ - dup225, + dup223, dup2, dup3, dup9, @@ -24205,10 +21979,9 @@ var all391 = all_match({ ]), }); -var msg1188 = msg("00767:27", all391); +var msg1188 = msg("00767:27", all385); -var part1892 = // "Pattern{Constant('The system configuration was loaded from IP address '), Field(hostip,true), Constant(' under filename '), Field(filename,true), Constant(' by administrator by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ +var part1886 = match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was loaded from IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24217,10 +21990,9 @@ match("MESSAGE#1173:00767:28", "nwparser.payload", "The system configuration was dup5, ])); -var msg1189 = msg("00767:28", part1892); +var msg1189 = msg("00767:28", part1886); -var part1893 = // "Pattern{Constant('Save configuration to IP address '), Field(hostip,true), Constant(' under filename '), Field(filename,true), Constant(' by administrator by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ +var part1887 = match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP address %{hostip->} under filename %{filename->} by administrator by admin %{administrator->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24229,10 +22001,9 @@ match("MESSAGE#1174:00767:29", "nwparser.payload", "Save configuration to IP add dup5, ])); -var msg1190 = msg("00767:29", part1893); +var msg1190 = msg("00767:29", part1887); -var part1894 = // "Pattern{Field(fld2,false), Constant(': The system configuration was saved from host '), Field(saddr,true), Constant(' by admin '), Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ +var part1888 = match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configuration was saved from host %{saddr->} by admin %{administrator->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24241,28 +22012,25 @@ match("MESSAGE#1175:00767:30", "nwparser.payload", "%{fld2}: The system configur dup5, ])); -var msg1191 = msg("00767:30", part1894); +var msg1191 = msg("00767:30", part1888); -var part1895 = // "Pattern{Constant('logged events or alarms '), Field(p0,false)}" -match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); +var part1889 = match("MESSAGE#1176:00767:31/1_0", "nwparser.p0", "logged events or alarms %{p0}"); -var part1896 = // "Pattern{Constant('traffic logs '), Field(p0,false)}" -match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); +var part1890 = match("MESSAGE#1176:00767:31/1_1", "nwparser.p0", "traffic logs %{p0}"); var select425 = linear_select([ - part1895, - part1896, + part1889, + part1890, ]); -var part1897 = // "Pattern{Constant('were cleared by admin '), Field(p0,false)}" -match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); +var part1891 = match("MESSAGE#1176:00767:31/2", "nwparser.p0", "were cleared by admin %{p0}"); -var all392 = all_match({ +var all386 = all_match({ processors: [ - dup188, + dup186, select425, - part1897, - dup400, + part1891, + dup397, ], on_success: processor_chain([ dup1, @@ -24274,30 +22042,26 @@ var all392 = all_match({ ]), }); -var msg1192 = msg("00767:31", all392); +var msg1192 = msg("00767:31", all386); -var part1898 = // "Pattern{Constant('SIP parser error '), Field(p0,false)}" -match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); +var part1892 = match("MESSAGE#1177:00767:32/0", "nwparser.payload", "SIP parser error %{p0}"); -var part1899 = // "Pattern{Constant('SIP-field'), Field(p0,false)}" -match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); +var part1893 = match("MESSAGE#1177:00767:32/1_0", "nwparser.p0", "SIP-field%{p0}"); -var part1900 = // "Pattern{Constant('Message'), Field(p0,false)}" -match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); +var part1894 = match("MESSAGE#1177:00767:32/1_1", "nwparser.p0", "Message%{p0}"); var select426 = linear_select([ - part1899, - part1900, + part1893, + part1894, ]); -var part1901 = // "Pattern{Constant(': '), Field(result,false), Constant('('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); +var part1895 = match("MESSAGE#1177:00767:32/2", "nwparser.p0", ": %{result}(%{fld1})"); -var all393 = all_match({ +var all387 = all_match({ processors: [ - part1898, + part1892, select426, - part1901, + part1895, ], on_success: processor_chain([ dup27, @@ -24309,10 +22073,9 @@ var all393 = all_match({ ]), }); -var msg1193 = msg("00767:32", all393); +var msg1193 = msg("00767:32", all387); -var part1902 = // "Pattern{Constant('Daylight Saving Time has started. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ +var part1896 = match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has started. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -24321,11 +22084,10 @@ match("MESSAGE#1178:00767:33", "nwparser.payload", "Daylight Saving Time has sta dup5, ])); -var msg1194 = msg("00767:33", part1902); +var msg1194 = msg("00767:33", part1896); -var part1903 = // "Pattern{Constant('NetScreen devices do not support multiple IP addresses '), Field(hostip,true), Constant(' or ports '), Field(network_port,true), Constant(' in SIP headers RESPONSE ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ - dup315, +var part1897 = match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not support multiple IP addresses %{hostip->} or ports %{network_port->} in SIP headers RESPONSE (%{fld1})", processor_chain([ + dup313, dup2, dup3, dup9, @@ -24333,10 +22095,9 @@ match("MESSAGE#1179:00767:34", "nwparser.payload", "NetScreen devices do not sup dup5, ])); -var msg1195 = msg("00767:34", part1903); +var msg1195 = msg("00767:34", part1897); -var part1904 = // "Pattern{Constant('Environment variable '), Field(fld2,true), Constant(' set to '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ +var part1898 = match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2->} set to %{fld3->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24345,10 +22106,9 @@ match("MESSAGE#1180:00767:35", "nwparser.payload", "Environment variable %{fld2- dup5, ])); -var msg1196 = msg("00767:35", part1904); +var msg1196 = msg("00767:35", part1898); -var part1905 = // "Pattern{Constant('System configuration saved from '), Field(fld2,true), Constant(' by '), Field(username,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ +var part1899 = match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved from %{fld2->} by %{username->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24357,11 +22117,10 @@ match("MESSAGE#1181:00767:36", "nwparser.payload", "System configuration saved f dup5, ])); -var msg1197 = msg("00767:36", part1905); +var msg1197 = msg("00767:36", part1899); -var part1906 = // "Pattern{Constant('Trial keys are available to download to enable advanced features. '), Field(space,true), Constant(' To find out, please visit '), Field(url,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ - dup256, +var part1900 = match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to download to enable advanced features. %{space->} To find out, please visit %{url->} (%{fld1})", processor_chain([ + dup254, dup2, dup3, dup9, @@ -24369,10 +22128,9 @@ match("MESSAGE#1182:00767:37", "nwparser.payload", "Trial keys are available to dup5, ])); -var msg1198 = msg("00767:37", part1906); +var msg1198 = msg("00767:37", part1900); -var part1907 = // "Pattern{Constant('Log buffer was full and remaining messages were sent to external destination. '), Field(fld2,true), Constant(' packets were dropped. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ +var part1901 = match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and remaining messages were sent to external destination. %{fld2->} packets were dropped. (%{fld1})", processor_chain([ setc("eventcategory","1602000000"), dup2, dup3, @@ -24381,46 +22139,40 @@ match("MESSAGE#1183:00767:38", "nwparser.payload", "Log buffer was full and rema dup5, ])); -var msg1199 = msg("00767:38", part1907); +var msg1199 = msg("00767:38", part1901); -var part1908 = // "Pattern{Constant('Cannot '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); +var part1902 = match("MESSAGE#1184:00767:39/0", "nwparser.payload", "Cannot %{p0}"); -var part1909 = // "Pattern{Constant('download '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); +var part1903 = match("MESSAGE#1184:00767:39/1_0", "nwparser.p0", "download %{p0}"); -var part1910 = // "Pattern{Constant('parse '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); +var part1904 = match("MESSAGE#1184:00767:39/1_1", "nwparser.p0", "parse %{p0}"); var select427 = linear_select([ - part1909, - part1910, + part1903, + part1904, ]); -var part1911 = // "Pattern{Constant('attack database '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); +var part1905 = match("MESSAGE#1184:00767:39/2", "nwparser.p0", "attack database %{p0}"); -var part1912 = // "Pattern{Constant('from '), Field(url,true), Constant(' ('), Field(result,false), Constant('). '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); +var part1906 = match("MESSAGE#1184:00767:39/3_0", "nwparser.p0", "from %{url->} (%{result}). %{p0}"); -var part1913 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); +var part1907 = match("MESSAGE#1184:00767:39/3_1", "nwparser.p0", "%{fld2->} %{p0}"); var select428 = linear_select([ - part1912, - part1913, + part1906, + part1907, ]); -var all394 = all_match({ +var all388 = all_match({ processors: [ - part1908, + part1902, select427, - part1911, + part1905, select428, dup10, ], on_success: processor_chain([ - dup326, + dup324, dup2, dup3, dup9, @@ -24429,10 +22181,9 @@ var all394 = all_match({ ]), }); -var msg1200 = msg("00767:39", all394); +var msg1200 = msg("00767:39", all388); -var part1914 = // "Pattern{Constant('Deep Inspection update key is '), Field(disposition,false), Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ +var part1908 = match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key is %{disposition}. (%{fld1})", processor_chain([ dup62, dup2, dup3, @@ -24441,10 +22192,9 @@ match("MESSAGE#1185:00767:40", "nwparser.payload", "Deep Inspection update key i dup5, ])); -var msg1201 = msg("00767:40", part1914); +var msg1201 = msg("00767:40", part1908); -var part1915 = // "Pattern{Constant('System configuration saved by '), Field(username,true), Constant(' via '), Field(logon_type,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ +var part1909 = match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved by %{username->} via %{logon_type->} to %{daddr}:%{dport->} by %{fld2->} (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24453,10 +22203,9 @@ match("MESSAGE#1186:00767:42", "nwparser.payload", "System configuration saved b dup5, ])); -var msg1202 = msg("00767:42", part1915); +var msg1202 = msg("00767:42", part1909); -var part1916 = // "Pattern{Constant('Daylight Saving Time ended. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ +var part1910 = match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -24465,10 +22214,9 @@ match("MESSAGE#1187:00767:43", "nwparser.payload", "Daylight Saving Time ended. dup5, ])); -var msg1203 = msg("00767:43", part1916); +var msg1203 = msg("00767:43", part1910); -var part1917 = // "Pattern{Constant('New GMT zone ahead or behind by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ +var part1911 = match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind by %{fld2->} (%{fld1})", processor_chain([ dup44, dup2, dup3, @@ -24477,10 +22225,9 @@ match("MESSAGE#1188:00767:44", "nwparser.payload", "New GMT zone ahead or behind dup5, ])); -var msg1204 = msg("00767:44", part1917); +var msg1204 = msg("00767:44", part1911); -var part1918 = // "Pattern{Constant('Attack database version '), Field(version,true), Constant(' is saved to flash. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ +var part1912 = match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{version->} is saved to flash. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24489,10 +22236,9 @@ match("MESSAGE#1189:00767:45", "nwparser.payload", "Attack database version %{ve dup5, ])); -var msg1205 = msg("00767:45", part1918); +var msg1205 = msg("00767:45", part1912); -var part1919 = // "Pattern{Constant('System configuration saved by netscreen via '), Field(logon_type,true), Constant(' by netscreen. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ +var part1913 = match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved by netscreen via %{logon_type->} by netscreen. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24501,10 +22247,9 @@ match("MESSAGE#1190:00767:46", "nwparser.payload", "System configuration saved b dup5, ])); -var msg1206 = msg("00767:46", part1919); +var msg1206 = msg("00767:46", part1913); -var part1920 = // "Pattern{Constant('User '), Field(username,true), Constant(' belongs to a different group in the RADIUS server than that allowed in the device. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ +var part1914 = match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs to a different group in the RADIUS server than that allowed in the device. (%{fld1})", processor_chain([ dup1, dup2, dup3, @@ -24513,19 +22258,17 @@ match("MESSAGE#1191:00767:47", "nwparser.payload", "User %{username->} belongs t dup9, ])); -var msg1207 = msg("00767:47", part1920); +var msg1207 = msg("00767:47", part1914); -var part1921 = // "Pattern{Constant('System configuration saved by '), Field(p0,false)}" -match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); +var part1915 = match("MESSAGE#1192:00767:24/0", "nwparser.payload", "System configuration saved by %{p0}"); -var part1922 = // "Pattern{Field(logon_type,true), Constant(' by '), Field(fld2,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); +var part1916 = match("MESSAGE#1192:00767:24/2", "nwparser.p0", "%{logon_type->} by %{fld2->} (%{fld1})"); -var all395 = all_match({ +var all389 = all_match({ processors: [ - part1921, - dup367, - part1922, + part1915, + dup364, + part1916, ], on_success: processor_chain([ dup1, @@ -24537,11 +22280,10 @@ var all395 = all_match({ ]), }); -var msg1208 = msg("00767:24", all395); +var msg1208 = msg("00767:24", all389); -var part1923 = // "Pattern{Constant('HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ - dup274, +var part1917 = match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) hidden file end with c sent to backup device in cluster. (%{fld1})", processor_chain([ + dup272, dup2, dup3, dup9, @@ -24549,30 +22291,26 @@ match("MESSAGE#1193:00767:48", "nwparser.payload", "HA: Synchronization file(s) dup5, ])); -var msg1209 = msg("00767:48", part1923); +var msg1209 = msg("00767:48", part1917); -var part1924 = // "Pattern{Field(fld2,true), Constant(' turn o'), Field(p0,false)}" -match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); +var part1918 = match("MESSAGE#1194:00767:49/0", "nwparser.payload", "%{fld2->} turn o%{p0}"); -var part1925 = // "Pattern{Constant('n'), Field(p0,false)}" -match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); +var part1919 = match("MESSAGE#1194:00767:49/1_0", "nwparser.p0", "n%{p0}"); -var part1926 = // "Pattern{Constant('ff'), Field(p0,false)}" -match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); +var part1920 = match("MESSAGE#1194:00767:49/1_1", "nwparser.p0", "ff%{p0}"); var select429 = linear_select([ - part1925, - part1926, + part1919, + part1920, ]); -var part1927 = // "Pattern{Field(,false), Constant('debug switch for '), Field(fld3,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); +var part1921 = match("MESSAGE#1194:00767:49/2", "nwparser.p0", "%{}debug switch for %{fld3->} (%{fld1})"); -var all396 = all_match({ +var all390 = all_match({ processors: [ - part1924, + part1918, select429, - part1927, + part1921, ], on_success: processor_chain([ dup1, @@ -24583,7 +22321,7 @@ var all396 = all_match({ ]), }); -var msg1210 = msg("00767:49", all396); +var msg1210 = msg("00767:49", all390); var select430 = linear_select([ msg1158, @@ -24641,26 +22379,25 @@ var select430 = linear_select([ msg1210, ]); -var part1928 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup187, +var part1922 = match("MESSAGE#1195:01269", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, - dup279, - dup3, + dup274, dup277, + dup3, + dup275, dup60, ])); -var msg1211 = msg("01269", part1928); +var msg1211 = msg("01269", part1922); -var msg1212 = msg("01269:01", dup410); +var msg1212 = msg("01269:01", dup407); -var msg1213 = msg("01269:02", dup411); +var msg1213 = msg("01269:02", dup408); -var msg1214 = msg("01269:03", dup412); +var msg1214 = msg("01269:03", dup409); var select431 = linear_select([ msg1211, @@ -24669,67 +22406,63 @@ var select431 = linear_select([ msg1214, ]); -var part1929 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var part1923 = match("MESSAGE#1199:17852", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup278, - dup279, + dup276, dup277, - dup334, + dup275, + dup332, ])); -var msg1215 = msg("17852", part1929); +var msg1215 = msg("17852", part1923); -var part1930 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1924 = match("MESSAGE#1200:17852:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, - dup334, - dup284, + dup275, + dup332, + dup282, ])); -var msg1216 = msg("17852:01", part1930); +var msg1216 = msg("17852:01", part1924); -var part1931 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var part1925 = match("MESSAGE#1201:17852:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, + dup275, + dup276, dup277, - dup278, - dup279, dup61, ])); -var msg1217 = msg("17852:02", part1931); +var msg1217 = msg("17852:02", part1925); -var part1932 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1926 = match("MESSAGE#1202:17852:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, - dup334, - dup284, + dup275, + dup332, + dup282, ])); -var msg1218 = msg("17852:03", part1932); +var msg1218 = msg("17852:03", part1926); var select432 = linear_select([ msg1215, @@ -24738,53 +22471,50 @@ var select432 = linear_select([ msg1218, ]); -var msg1219 = msg("23184", dup413); +var msg1219 = msg("23184", dup410); -var part1933 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1927 = match("MESSAGE#1204:23184:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup61, - dup284, + dup282, ])); -var msg1220 = msg("23184:01", part1933); +var msg1220 = msg("23184:01", part1927); -var part1934 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var part1928 = match("MESSAGE#1205:23184:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup278, - dup279, + dup276, dup277, + dup275, dup61, ])); -var msg1221 = msg("23184:02", part1934); +var msg1221 = msg("23184:02", part1928); -var part1935 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1929 = match("MESSAGE#1206:23184:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, - dup334, - dup284, + dup275, + dup332, + dup282, ])); -var msg1222 = msg("23184:03", part1935); +var msg1222 = msg("23184:03", part1929); var select433 = linear_select([ msg1219, @@ -24793,49 +22523,47 @@ var select433 = linear_select([ msg1222, ]); -var msg1223 = msg("27052", dup413); +var msg1223 = msg("27052", dup410); -var part1936 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,false), Constant('direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup283, +var part1930 = match("MESSAGE#1208:27052:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol}direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup61, - dup284, + dup282, ])); -var msg1224 = msg("27052:01", part1936); +var msg1224 = msg("27052:01", part1930); var select434 = linear_select([ msg1223, msg1224, ]); -var part1937 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup187, +var part1931 = match("MESSAGE#1209:39568", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup185, dup2, dup4, - dup279, + dup277, dup5, - dup276, + dup274, dup3, - dup277, - dup278, + dup275, + dup276, dup60, ])); -var msg1225 = msg("39568", part1937); +var msg1225 = msg("39568", part1931); -var msg1226 = msg("39568:01", dup410); +var msg1226 = msg("39568:01", dup407); -var msg1227 = msg("39568:02", dup411); +var msg1227 = msg("39568:02", dup408); -var msg1228 = msg("39568:03", dup412); +var msg1228 = msg("39568:03", dup409); var select435 = linear_select([ msg1225, @@ -25010,751 +22738,500 @@ var chain1 = processor_chain([ }), ]); -var part1938 = // "Pattern{Constant('Address '), Field(group_object,true), Constant(' for '), Field(p0,false)}" -match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); - -var part1939 = // "Pattern{Constant('domain address '), Field(domain,true), Constant(' in zone '), Field(p0,false)}" -match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); +var part1932 = match("MESSAGE#2:00001:02/0", "nwparser.payload", "Address %{group_object->} for %{p0}"); -var part1940 = // "Pattern{Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); +var part1933 = match("MESSAGE#2:00001:02/1_1", "nwparser.p0", "domain address %{domain->} in zone %{p0}"); -var part1941 = // "Pattern{Constant('('), Field(fld1,false), Constant(')')}" -match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); +var part1934 = match("MESSAGE#4:00001:04/3_0", "nwparser.p0", " (%{fld1})"); -var part1942 = // "Pattern{Field(fld1,false)}" -match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); +var part1935 = match("MESSAGE#5:00001:05/1_0", "nwparser.p0", "(%{fld1})"); -var part1943 = // "Pattern{Constant('Address '), Field(p0,false)}" -match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); +var part1936 = match_copy("MESSAGE#5:00001:05/1_1", "nwparser.p0", "fld1"); -var part1944 = // "Pattern{Constant('MIP('), Field(interface,false), Constant(') '), Field(p0,false)}" -match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); +var part1937 = match("MESSAGE#8:00001:08/0", "nwparser.payload", "Address %{p0}"); -var part1945 = // "Pattern{Field(group_object,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); +var part1938 = match("MESSAGE#8:00001:08/1_0", "nwparser.p0", "MIP(%{interface}) %{p0}"); -var part1946 = // "Pattern{Constant('admin '), Field(p0,false)}" -match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); +var part1939 = match("MESSAGE#8:00001:08/1_1", "nwparser.p0", "%{group_object->} %{p0}"); -var part1947 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); +var part1940 = match("MESSAGE#8:00001:08/3_0", "nwparser.p0", "admin %{p0}"); -var part1948 = // "Pattern{Constant('from host '), Field(saddr,true), Constant(' ')}" -match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); +var part1941 = match_copy("MESSAGE#8:00001:08/3_1", "nwparser.p0", "p0"); -var part1949 = // "Pattern{}" -match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); +var part1942 = match("MESSAGE#25:00002:20/1_1", "nwparser.p0", "from host %{saddr->} "); -var part1950 = // "Pattern{Constant(''), Field(p0,false)}" -match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); +var part1943 = match_copy("MESSAGE#25:00002:20/1_2", "nwparser.p0", ""); -var part1951 = // "Pattern{Constant('password '), Field(p0,false)}" -match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); +var part1944 = match("MESSAGE#26:00002:21/1", "nwparser.p0", "%{p0}"); -var part1952 = // "Pattern{Constant('name '), Field(p0,false)}" -match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); +var part1945 = match("MESSAGE#26:00002:21/2_0", "nwparser.p0", "password %{p0}"); -var part1953 = // "Pattern{Field(administrator,false)}" -match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); +var part1946 = match("MESSAGE#26:00002:21/2_1", "nwparser.p0", "name %{p0}"); -var part1954 = // "Pattern{Field(disposition,false)}" -match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); +var part1947 = match_copy("MESSAGE#27:00002:22/1_2", "nwparser.p0", "administrator"); -var part1955 = // "Pattern{Constant('via '), Field(p0,false)}" -match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); +var part1948 = match_copy("MESSAGE#42:00002:38/1_1", "nwparser.p0", "disposition"); -var part1956 = // "Pattern{Field(fld1,false), Constant(')')}" -match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); +var part1949 = match("MESSAGE#46:00002:42/1_1", "nwparser.p0", "via %{p0}"); -var part1957 = // "Pattern{Field(logon_type,true), Constant(' from host '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant('. ('), Field(p0,false)}" -match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); +var part1950 = match("MESSAGE#46:00002:42/4", "nwparser.p0", "%{fld1})"); -var part1958 = // "Pattern{Constant('admin '), Field(administrator,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); +var part1951 = match("MESSAGE#52:00002:48/3_1", "nwparser.p0", "%{logon_type->} from host %{saddr->} to %{daddr}:%{dport}. (%{p0}"); -var part1959 = // "Pattern{Field(username,true), Constant(' via '), Field(p0,false)}" -match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); +var part1952 = match("MESSAGE#53:00002:52/3_0", "nwparser.p0", "admin %{administrator->} via %{p0}"); -var part1960 = // "Pattern{Constant('NSRP Peer . ('), Field(p0,false)}" -match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); +var part1953 = match("MESSAGE#53:00002:52/3_2", "nwparser.p0", "%{username->} via %{p0}"); -var part1961 = // "Pattern{Constant('. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); +var part1954 = match("MESSAGE#53:00002:52/4_0", "nwparser.p0", "NSRP Peer . (%{p0}"); -var part1962 = // "Pattern{Constant('changed'), Field(p0,false)}" -match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); +var part1955 = match("MESSAGE#55:00002:54/2", "nwparser.p0", ". (%{fld1})"); -var part1963 = // "Pattern{Constant('The '), Field(p0,false)}" -match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); +var part1956 = match("MESSAGE#56:00002/1_1", "nwparser.p0", "changed%{p0}"); -var part1964 = // "Pattern{Constant('interface'), Field(p0,false)}" -match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); +var part1957 = match("MESSAGE#61:00003:05/0", "nwparser.payload", "The %{p0}"); -var part1965 = // "Pattern{Constant('Interface'), Field(p0,false)}" -match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); +var part1958 = match("MESSAGE#66:00004:04/1_0", "nwparser.p0", "interface%{p0}"); -var part1966 = // "Pattern{Constant('DNS entries have been '), Field(p0,false)}" -match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); +var part1959 = match("MESSAGE#66:00004:04/1_1", "nwparser.p0", "Interface%{p0}"); -var part1967 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" -match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); +var part1960 = match("MESSAGE#76:00004:14/0", "nwparser.payload", "DNS entries have been %{p0}"); -var part1968 = // "Pattern{Field(zone,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); +var part1961 = match("MESSAGE#79:00004:17/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{p0}"); -var part1969 = // "Pattern{Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); +var part1962 = match("MESSAGE#79:00004:17/1_0", "nwparser.p0", "%{zone}, %{p0}"); -var part1970 = // "Pattern{Constant('int '), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); +var part1963 = match("MESSAGE#79:00004:17/1_1", "nwparser.p0", "%{zone->} %{p0}"); -var part1971 = // "Pattern{Field(dport,false), Constant(','), Field(p0,false)}" -match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); +var part1964 = match("MESSAGE#79:00004:17/2", "nwparser.p0", "int %{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); -var part1972 = // "Pattern{Field(dport,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); +var part1965 = match("MESSAGE#83:00005:03/1_0", "nwparser.p0", "%{dport},%{p0}"); -var part1973 = // "Pattern{Field(space,false), Constant('using protocol '), Field(p0,false)}" -match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); +var part1966 = match("MESSAGE#83:00005:03/1_1", "nwparser.p0", "%{dport->} %{p0}"); -var part1974 = // "Pattern{Field(protocol,false), Constant(','), Field(p0,false)}" -match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); +var part1967 = match("MESSAGE#83:00005:03/2", "nwparser.p0", "%{space}using protocol %{p0}"); -var part1975 = // "Pattern{Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); +var part1968 = match("MESSAGE#83:00005:03/3_0", "nwparser.p0", "%{protocol},%{p0}"); -var part1976 = // "Pattern{Constant('. '), Field(p0,false)}" -match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); +var part1969 = match("MESSAGE#83:00005:03/3_1", "nwparser.p0", "%{protocol->} %{p0}"); -var part1977 = // "Pattern{Field(fld2,false), Constant(': SYN '), Field(p0,false)}" -match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); +var part1970 = match("MESSAGE#83:00005:03/5_1", "nwparser.p0", ". %{p0}"); -var part1978 = // "Pattern{Constant('SYN '), Field(p0,false)}" -match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); +var part1971 = match("MESSAGE#86:00005:06/0_0", "nwparser.payload", "%{fld2}: SYN %{p0}"); -var part1979 = // "Pattern{Constant('timeout value '), Field(p0,false)}" -match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); +var part1972 = match("MESSAGE#86:00005:06/0_1", "nwparser.payload", "SYN %{p0}"); -var part1980 = // "Pattern{Constant('destination '), Field(p0,false)}" -match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); +var part1973 = match("MESSAGE#87:00005:07/1_2", "nwparser.p0", "timeout value %{p0}"); -var part1981 = // "Pattern{Constant('source '), Field(p0,false)}" -match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); +var part1974 = match("MESSAGE#88:00005:08/2_0", "nwparser.p0", "destination %{p0}"); -var part1982 = // "Pattern{Constant('A '), Field(p0,false)}" -match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); +var part1975 = match("MESSAGE#88:00005:08/2_1", "nwparser.p0", "source %{p0}"); -var part1983 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part1976 = match("MESSAGE#97:00005:17/0", "nwparser.payload", "A %{p0}"); -var part1984 = // "Pattern{Constant(', int '), Field(p0,false)}" -match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); +var part1977 = match("MESSAGE#98:00005:18/0", "nwparser.payload", "%{signame->} From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var part1985 = // "Pattern{Constant('int '), Field(p0,false)}" -match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); +var part1978 = match("MESSAGE#98:00005:18/1_0", "nwparser.p0", ", int %{p0}"); -var part1986 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); +var part1979 = match("MESSAGE#98:00005:18/1_1", "nwparser.p0", "int %{p0}"); -var part1987 = // "Pattern{Constant('HA '), Field(p0,false)}" -match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); +var part1980 = match("MESSAGE#98:00005:18/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times. (%{fld1})"); -var part1988 = // "Pattern{Constant('encryption '), Field(p0,false)}" -match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); +var part1981 = match("MESSAGE#111:00007:04/0", "nwparser.payload", "HA %{p0}"); -var part1989 = // "Pattern{Constant('authentication '), Field(p0,false)}" -match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); +var part1982 = match("MESSAGE#111:00007:04/1_0", "nwparser.p0", "encryption %{p0}"); -var part1990 = // "Pattern{Constant('key '), Field(p0,false)}" -match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); +var part1983 = match("MESSAGE#111:00007:04/1_1", "nwparser.p0", "authentication %{p0}"); -var part1991 = // "Pattern{Constant('disabled'), Field(,false)}" -match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); +var part1984 = match("MESSAGE#111:00007:04/3_1", "nwparser.p0", "key %{p0}"); -var part1992 = // "Pattern{Constant('set to '), Field(trigger_val,false)}" -match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); +var part1985 = match("MESSAGE#118:00007:11/1_0", "nwparser.p0", "disabled%{}"); -var part1993 = // "Pattern{Constant('up'), Field(,false)}" -match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); +var part1986 = match("MESSAGE#118:00007:11/1_1", "nwparser.p0", "set to %{trigger_val}"); -var part1994 = // "Pattern{Constant('down'), Field(,false)}" -match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); +var part1987 = match("MESSAGE#127:00007:21/1_0", "nwparser.p0", "up%{}"); -var part1995 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); +var part1988 = match("MESSAGE#127:00007:21/1_1", "nwparser.p0", "down%{}"); -var part1996 = // "Pattern{Constant('set'), Field(,false)}" -match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); +var part1989 = match("MESSAGE#139:00007:33/2_1", "nwparser.p0", " %{p0}"); -var part1997 = // "Pattern{Constant('unset'), Field(,false)}" -match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); +var part1990 = match("MESSAGE#143:00007:37/1_0", "nwparser.p0", "set%{}"); -var part1998 = // "Pattern{Constant('undefined '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); +var part1991 = match("MESSAGE#143:00007:37/1_1", "nwparser.p0", "unset%{}"); -var part1999 = // "Pattern{Constant('set '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); +var part1992 = match("MESSAGE#144:00007:38/1_0", "nwparser.p0", "undefined %{p0}"); -var part2000 = // "Pattern{Constant('active '), Field(p0,false)}" -match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); +var part1993 = match("MESSAGE#144:00007:38/1_1", "nwparser.p0", "set %{p0}"); -var part2001 = // "Pattern{Constant('to '), Field(p0,false)}" -match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); +var part1994 = match("MESSAGE#144:00007:38/1_2", "nwparser.p0", "active %{p0}"); -var part2002 = // "Pattern{Constant('created '), Field(p0,false)}" -match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); +var part1995 = match("MESSAGE#144:00007:38/2", "nwparser.p0", "to %{p0}"); -var part2003 = // "Pattern{Constant(', '), Field(p0,false)}" -match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); +var part1996 = match("MESSAGE#157:00007:51/1_0", "nwparser.p0", "created %{p0}"); -var part2004 = // "Pattern{Constant('is '), Field(p0,false)}" -match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); +var part1997 = match("MESSAGE#157:00007:51/3_0", "nwparser.p0", ", %{p0}"); -var part2005 = // "Pattern{Constant('was '), Field(p0,false)}" -match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); +var part1998 = match("MESSAGE#157:00007:51/5_0", "nwparser.p0", "is %{p0}"); -var part2006 = // "Pattern{Constant(''), Field(fld2,false)}" -match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); +var part1999 = match("MESSAGE#157:00007:51/5_1", "nwparser.p0", "was %{p0}"); -var part2007 = // "Pattern{Constant('threshold '), Field(p0,false)}" -match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); +var part2000 = match("MESSAGE#157:00007:51/6", "nwparser.p0", "%{fld2}"); -var part2008 = // "Pattern{Constant('interval '), Field(p0,false)}" -match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); +var part2001 = match("MESSAGE#163:00007:57/1_0", "nwparser.p0", "threshold %{p0}"); -var part2009 = // "Pattern{Constant('of '), Field(p0,false)}" -match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); +var part2002 = match("MESSAGE#163:00007:57/1_1", "nwparser.p0", "interval %{p0}"); -var part2010 = // "Pattern{Constant('that '), Field(p0,false)}" -match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); +var part2003 = match("MESSAGE#163:00007:57/3_0", "nwparser.p0", "of %{p0}"); -var part2011 = // "Pattern{Constant('Zone '), Field(p0,false)}" -match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); +var part2004 = match("MESSAGE#163:00007:57/3_1", "nwparser.p0", "that %{p0}"); -var part2012 = // "Pattern{Constant('Interface '), Field(p0,false)}" -match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); +var part2005 = match("MESSAGE#170:00007:64/0_0", "nwparser.payload", "Zone %{p0}"); -var part2013 = // "Pattern{Constant('n '), Field(p0,false)}" -match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); +var part2006 = match("MESSAGE#170:00007:64/0_1", "nwparser.payload", "Interface %{p0}"); -var part2014 = // "Pattern{Constant('.'), Field(,false)}" -match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); +var part2007 = match("MESSAGE#172:00007:66/2_1", "nwparser.p0", "n %{p0}"); -var part2015 = // "Pattern{Constant('for '), Field(p0,false)}" -match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); +var part2008 = match("MESSAGE#174:00007:68/4", "nwparser.p0", ".%{}"); -var part2016 = // "Pattern{Constant('the '), Field(p0,false)}" -match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); +var part2009 = match("MESSAGE#195:00009:06/1", "nwparser.p0", "for %{p0}"); -var part2017 = // "Pattern{Constant('removed '), Field(p0,false)}" -match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); +var part2010 = match("MESSAGE#195:00009:06/2_0", "nwparser.p0", "the %{p0}"); -var part2018 = // "Pattern{Constant('interface '), Field(p0,false)}" -match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); +var part2011 = match("MESSAGE#195:00009:06/4_0", "nwparser.p0", "removed %{p0}"); -var part2019 = // "Pattern{Constant('the interface '), Field(p0,false)}" -match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); +var part2012 = match("MESSAGE#202:00009:14/2_0", "nwparser.p0", "interface %{p0}"); -var part2020 = // "Pattern{Field(interface,false)}" -match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); +var part2013 = match("MESSAGE#202:00009:14/2_1", "nwparser.p0", "the interface %{p0}"); -var part2021 = // "Pattern{Constant('s '), Field(p0,false)}" -match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); +var part2014 = match_copy("MESSAGE#202:00009:14/4_1", "nwparser.p0", "interface"); -var part2022 = // "Pattern{Constant('on interface '), Field(interface,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); +var part2015 = match("MESSAGE#203:00009:15/1_1", "nwparser.p0", "s %{p0}"); -var part2023 = // "Pattern{Constant('has been '), Field(p0,false)}" -match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); +var part2016 = match("MESSAGE#203:00009:15/2", "nwparser.p0", "on interface %{interface->} %{p0}"); -var part2024 = // "Pattern{Constant(''), Field(disposition,false), Constant('.')}" -match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); +var part2017 = match("MESSAGE#203:00009:15/3_0", "nwparser.p0", "has been %{p0}"); -var part2025 = // "Pattern{Constant('removed from '), Field(p0,false)}" -match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); +var part2018 = match("MESSAGE#203:00009:15/4", "nwparser.p0", "%{disposition}."); -var part2026 = // "Pattern{Constant('added to '), Field(p0,false)}" -match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); +var part2019 = match("MESSAGE#204:00009:16/3_0", "nwparser.p0", "removed from %{p0}"); -var part2027 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); +var part2020 = match("MESSAGE#204:00009:16/3_1", "nwparser.p0", "added to %{p0}"); -var part2028 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part2021 = match("MESSAGE#210:00009:21/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times. (%{fld1})"); -var part2029 = // "Pattern{Constant('Interface '), Field(p0,false)}" -match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); +var part2022 = match("MESSAGE#219:00010:03/0", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, proto %{protocol->} (zone %{zone->} %{p0}"); -var part2030 = // "Pattern{Constant('set to '), Field(fld2,false)}" -match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); +var part2023 = match("MESSAGE#224:00011:04/1_1", "nwparser.p0", "Interface %{p0}"); -var part2031 = // "Pattern{Constant('gateway '), Field(p0,false)}" -match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); +var part2024 = match("MESSAGE#233:00011:14/1_0", "nwparser.p0", "set to %{fld2}"); -var part2032 = // "Pattern{Field(,true), Constant(' '), Field(disposition,false)}" -match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); +var part2025 = match("MESSAGE#237:00011:18/4_1", "nwparser.p0", "gateway %{p0}"); -var part2033 = // "Pattern{Constant('port number '), Field(p0,false)}" -match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); +var part2026 = match("MESSAGE#238:00011:19/6", "nwparser.p0", "%{} %{disposition}"); -var part2034 = // "Pattern{Constant('has been '), Field(disposition,false)}" -match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); +var part2027 = match("MESSAGE#274:00015:02/1_1", "nwparser.p0", "port number %{p0}"); -var part2035 = // "Pattern{Constant('IP '), Field(p0,false)}" -match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); +var part2028 = match("MESSAGE#274:00015:02/2", "nwparser.p0", "has been %{disposition}"); -var part2036 = // "Pattern{Constant('port '), Field(p0,false)}" -match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); +var part2029 = match("MESSAGE#276:00015:04/1_0", "nwparser.p0", "IP %{p0}"); -var part2037 = // "Pattern{Constant('up '), Field(p0,false)}" -match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); +var part2030 = match("MESSAGE#276:00015:04/1_1", "nwparser.p0", "port %{p0}"); -var part2038 = // "Pattern{Constant('down '), Field(p0,false)}" -match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); +var part2031 = match("MESSAGE#284:00015:12/3_0", "nwparser.p0", "up %{p0}"); -var part2039 = // "Pattern{Constant('('), Field(fld1,false), Constant(') ')}" -match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); +var part2032 = match("MESSAGE#284:00015:12/3_1", "nwparser.p0", "down %{p0}"); -var part2040 = // "Pattern{Constant(': '), Field(p0,false)}" -match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); +var part2033 = match("MESSAGE#294:00015:22/2_0", "nwparser.p0", "(%{fld1}) "); -var part2041 = // "Pattern{Constant('IP '), Field(p0,false)}" -match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); +var part2034 = match("MESSAGE#317:00017:01/2_0", "nwparser.p0", ": %{p0}"); -var part2042 = // "Pattern{Constant('address pool '), Field(p0,false)}" -match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); +var part2035 = match("MESSAGE#320:00017:04/0", "nwparser.payload", "IP %{p0}"); -var part2043 = // "Pattern{Constant('pool '), Field(p0,false)}" -match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); +var part2036 = match("MESSAGE#320:00017:04/1_0", "nwparser.p0", "address pool %{p0}"); -var part2044 = // "Pattern{Constant('enabled '), Field(p0,false)}" -match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); +var part2037 = match("MESSAGE#320:00017:04/1_1", "nwparser.p0", "pool %{p0}"); -var part2045 = // "Pattern{Constant('disabled '), Field(p0,false)}" -match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); +var part2038 = match("MESSAGE#326:00017:10/1_0", "nwparser.p0", "enabled %{p0}"); -var part2046 = // "Pattern{Constant('AH '), Field(p0,false)}" -match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); +var part2039 = match("MESSAGE#326:00017:10/1_1", "nwparser.p0", "disabled %{p0}"); -var part2047 = // "Pattern{Constant('ESP '), Field(p0,false)}" -match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); +var part2040 = match("MESSAGE#332:00017:15/1_0", "nwparser.p0", "AH %{p0}"); -var part2048 = // "Pattern{Constant('’'), Field(p0,false)}" -match("MESSAGE#347:00018:02/1_0", "nwparser.p0", "’%{p0}"); +var part2041 = match("MESSAGE#332:00017:15/1_1", "nwparser.p0", "ESP %{p0}"); -var part2049 = // "Pattern{Constant('&'), Field(p0,false)}" -match("MESSAGE#347:00018:02/1_1", "nwparser.p0", "\u0026%{p0}"); +var part2042 = match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); -var part2050 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#354:00018:11/0", "nwparser.payload", "%{} %{p0}"); +var part2043 = match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); -var part2051 = // "Pattern{Constant('Source'), Field(p0,false)}" -match("MESSAGE#356:00018:32/0_0", "nwparser.payload", "Source%{p0}"); +var part2044 = match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); -var part2052 = // "Pattern{Constant('Destination'), Field(p0,false)}" -match("MESSAGE#356:00018:32/0_1", "nwparser.payload", "Destination%{p0}"); +var part2045 = match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); -var part2053 = // "Pattern{Constant('from '), Field(p0,false)}" -match("MESSAGE#356:00018:32/2_0", "nwparser.p0", "from %{p0}"); +var part2046 = match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); -var part2054 = // "Pattern{Constant('policy ID '), Field(policy_id,true), Constant(' by admin '), Field(administrator,true), Constant(' via NSRP Peer . ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#356:00018:32/3", "nwparser.p0", "policy ID %{policy_id->} by admin %{administrator->} via NSRP Peer . (%{fld1})"); +var part2047 = match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); -var part2055 = // "Pattern{Constant('Attempt to enable '), Field(p0,false)}" -match("MESSAGE#375:00019:01/0", "nwparser.payload", "Attempt to enable %{p0}"); +var part2048 = match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); -var part2056 = // "Pattern{Constant('traffic logging via syslog '), Field(p0,false)}" -match("MESSAGE#375:00019:01/1_0", "nwparser.p0", "traffic logging via syslog %{p0}"); +var part2049 = match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); -var part2057 = // "Pattern{Constant('syslog '), Field(p0,false)}" -match("MESSAGE#375:00019:01/1_1", "nwparser.p0", "syslog %{p0}"); +var part2050 = match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); -var part2058 = // "Pattern{Constant('Syslog '), Field(p0,false)}" -match("MESSAGE#378:00019:04/0", "nwparser.payload", "Syslog %{p0}"); +var part2051 = match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); -var part2059 = // "Pattern{Constant('host '), Field(p0,false)}" -match("MESSAGE#378:00019:04/1_0", "nwparser.p0", "host %{p0}"); +var part2052 = match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); -var part2060 = // "Pattern{Constant('domain name '), Field(p0,false)}" -match("MESSAGE#378:00019:04/3_1", "nwparser.p0", "domain name %{p0}"); +var part2053 = match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); -var part2061 = // "Pattern{Constant('has been changed to '), Field(fld2,false)}" -match("MESSAGE#378:00019:04/4", "nwparser.p0", "has been changed to %{fld2}"); +var part2054 = match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); -var part2062 = // "Pattern{Constant('security facility '), Field(p0,false)}" -match("MESSAGE#380:00019:06/1_0", "nwparser.p0", "security facility %{p0}"); +var part2055 = match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); -var part2063 = // "Pattern{Constant('facility '), Field(p0,false)}" -match("MESSAGE#380:00019:06/1_1", "nwparser.p0", "facility %{p0}"); +var part2056 = match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); -var part2064 = // "Pattern{Constant('local0'), Field(,false)}" -match("MESSAGE#380:00019:06/3_0", "nwparser.p0", "local0%{}"); +var part2057 = match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); -var part2065 = // "Pattern{Constant('local1'), Field(,false)}" -match("MESSAGE#380:00019:06/3_1", "nwparser.p0", "local1%{}"); +var part2058 = match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); -var part2066 = // "Pattern{Constant('local2'), Field(,false)}" -match("MESSAGE#380:00019:06/3_2", "nwparser.p0", "local2%{}"); +var part2059 = match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); -var part2067 = // "Pattern{Constant('local3'), Field(,false)}" -match("MESSAGE#380:00019:06/3_3", "nwparser.p0", "local3%{}"); +var part2060 = match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); -var part2068 = // "Pattern{Constant('local4'), Field(,false)}" -match("MESSAGE#380:00019:06/3_4", "nwparser.p0", "local4%{}"); +var part2061 = match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); -var part2069 = // "Pattern{Constant('local5'), Field(,false)}" -match("MESSAGE#380:00019:06/3_5", "nwparser.p0", "local5%{}"); +var part2062 = match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); -var part2070 = // "Pattern{Constant('local6'), Field(,false)}" -match("MESSAGE#380:00019:06/3_6", "nwparser.p0", "local6%{}"); +var part2063 = match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); -var part2071 = // "Pattern{Constant('local7'), Field(,false)}" -match("MESSAGE#380:00019:06/3_7", "nwparser.p0", "local7%{}"); +var part2064 = match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); -var part2072 = // "Pattern{Constant('auth/sec'), Field(,false)}" -match("MESSAGE#380:00019:06/3_8", "nwparser.p0", "auth/sec%{}"); +var part2065 = match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); -var part2073 = // "Pattern{Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#384:00019:10/0", "nwparser.payload", "%{fld2->} %{p0}"); +var part2066 = match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); -var part2074 = // "Pattern{Constant('All '), Field(p0,false)}" -match("MESSAGE#405:00022/0", "nwparser.payload", "All %{p0}"); +var part2067 = match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); -var part2075 = // "Pattern{Constant('primary '), Field(p0,false)}" -match("MESSAGE#414:00022:09/1_0", "nwparser.p0", "primary %{p0}"); +var part2068 = match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); -var part2076 = // "Pattern{Constant('secondary '), Field(p0,false)}" -match("MESSAGE#414:00022:09/1_1", "nwparser.p0", "secondary %{p0}"); +var part2069 = match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); -var part2077 = // "Pattern{Constant('t '), Field(p0,false)}" -match("MESSAGE#414:00022:09/3_0", "nwparser.p0", "t %{p0}"); +var part2070 = match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); -var part2078 = // "Pattern{Constant('w '), Field(p0,false)}" -match("MESSAGE#414:00022:09/3_1", "nwparser.p0", "w %{p0}"); +var part2071 = match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); -var part2079 = // "Pattern{Constant('server '), Field(p0,false)}" -match("MESSAGE#423:00024/1", "nwparser.p0", "server %{p0}"); +var part2072 = match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); -var part2080 = // "Pattern{Constant('has '), Field(p0,false)}" -match("MESSAGE#426:00024:03/1_0", "nwparser.p0", "has %{p0}"); +var part2073 = match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); -var part2081 = // "Pattern{Constant('SCS'), Field(p0,false)}" -match("MESSAGE#434:00026:01/0", "nwparser.payload", "SCS%{p0}"); +var part2074 = match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); -var part2082 = // "Pattern{Constant('bound to '), Field(p0,false)}" -match("MESSAGE#434:00026:01/3_0", "nwparser.p0", "bound to %{p0}"); +var part2075 = match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); -var part2083 = // "Pattern{Constant('unbound from '), Field(p0,false)}" -match("MESSAGE#434:00026:01/3_1", "nwparser.p0", "unbound from %{p0}"); +var part2076 = match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); -var part2084 = // "Pattern{Constant('PKA RSA '), Field(p0,false)}" -match("MESSAGE#441:00026:08/1_1", "nwparser.p0", "PKA RSA %{p0}"); +var part2077 = match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); -var part2085 = // "Pattern{Constant('unbind '), Field(p0,false)}" -match("MESSAGE#443:00026:10/3_1", "nwparser.p0", "unbind %{p0}"); +var part2078 = match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); -var part2086 = // "Pattern{Constant('PKA key '), Field(p0,false)}" -match("MESSAGE#443:00026:10/4", "nwparser.p0", "PKA key %{p0}"); +var part2079 = match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); -var part2087 = // "Pattern{Constant('Multiple login failures '), Field(p0,false)}" -match("MESSAGE#446:00027/0", "nwparser.payload", "Multiple login failures %{p0}"); +var part2080 = match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); -var part2088 = // "Pattern{Constant('occurred for '), Field(p0,false)}" -match("MESSAGE#446:00027/1_0", "nwparser.p0", "occurred for %{p0}"); +var part2081 = match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); -var part2089 = // "Pattern{Constant('aborted'), Field(,false)}" -match("MESSAGE#451:00027:05/5_0", "nwparser.p0", "aborted%{}"); +var part2082 = match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); -var part2090 = // "Pattern{Constant('performed'), Field(,false)}" -match("MESSAGE#451:00027:05/5_1", "nwparser.p0", "performed%{}"); +var part2083 = match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); -var part2091 = // "Pattern{Constant('IP pool of DHCP server on '), Field(p0,false)}" -match("MESSAGE#466:00029:03/0", "nwparser.payload", "IP pool of DHCP server on %{p0}"); +var part2084 = match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); -var part2092 = // "Pattern{Constant('certificate '), Field(p0,false)}" -match("MESSAGE#492:00030:17/1_0", "nwparser.p0", "certificate %{p0}"); +var part2085 = match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); -var part2093 = // "Pattern{Constant('CRL '), Field(p0,false)}" -match("MESSAGE#492:00030:17/1_1", "nwparser.p0", "CRL %{p0}"); +var part2086 = match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); -var part2094 = // "Pattern{Constant('auto '), Field(p0,false)}" -match("MESSAGE#493:00030:40/1_0", "nwparser.p0", "auto %{p0}"); +var part2087 = match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); -var part2095 = // "Pattern{Constant('RSA '), Field(p0,false)}" -match("MESSAGE#508:00030:55/1_0", "nwparser.p0", "RSA %{p0}"); +var part2088 = match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); -var part2096 = // "Pattern{Constant('DSA '), Field(p0,false)}" -match("MESSAGE#508:00030:55/1_1", "nwparser.p0", "DSA %{p0}"); +var part2089 = match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); -var part2097 = // "Pattern{Constant('key pair.'), Field(,false)}" -match("MESSAGE#508:00030:55/2", "nwparser.p0", "key pair.%{}"); +var part2090 = match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); -var part2098 = // "Pattern{Constant('FIPS test for '), Field(p0,false)}" -match("MESSAGE#539:00030:86/0", "nwparser.payload", "FIPS test for %{p0}"); +var part2091 = match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); -var part2099 = // "Pattern{Constant('ECDSA '), Field(p0,false)}" -match("MESSAGE#539:00030:86/1_0", "nwparser.p0", "ECDSA %{p0}"); +var part2092 = match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); -var part2100 = // "Pattern{Constant('yes '), Field(p0,false)}" -match("MESSAGE#543:00031:02/1_0", "nwparser.p0", "yes %{p0}"); +var part2093 = match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); -var part2101 = // "Pattern{Constant('no '), Field(p0,false)}" -match("MESSAGE#543:00031:02/1_1", "nwparser.p0", "no %{p0}"); +var part2094 = match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); -var part2102 = // "Pattern{Constant('location '), Field(p0,false)}" -match("MESSAGE#545:00031:04/1_1", "nwparser.p0", "location %{p0}"); +var part2095 = match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); -var part2103 = // "Pattern{Field(,true), Constant(' '), Field(interface,false)}" -match("MESSAGE#548:00031:05/2", "nwparser.p0", "%{} %{interface}"); +var part2096 = match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); -var part2104 = // "Pattern{Constant('arp re'), Field(p0,false)}" -match("MESSAGE#549:00031:06/0", "nwparser.payload", "arp re%{p0}"); +var part2097 = match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); -var part2105 = // "Pattern{Constant('q '), Field(p0,false)}" -match("MESSAGE#549:00031:06/1_1", "nwparser.p0", "q %{p0}"); +var part2098 = match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); -var part2106 = // "Pattern{Constant('ply '), Field(p0,false)}" -match("MESSAGE#549:00031:06/1_2", "nwparser.p0", "ply %{p0}"); +var part2099 = match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); -var part2107 = // "Pattern{Field(interface,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#549:00031:06/9_0", "nwparser.p0", "%{interface->} (%{fld1})"); +var part2100 = match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); -var part2108 = // "Pattern{Constant('Global PRO '), Field(p0,false)}" -match("MESSAGE#561:00033/0_0", "nwparser.payload", "Global PRO %{p0}"); +var part2101 = match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); -var part2109 = // "Pattern{Field(fld3,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#561:00033/0_1", "nwparser.payload", "%{fld3->} %{p0}"); +var part2102 = match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); -var part2110 = // "Pattern{Constant('NACN Policy Manager '), Field(p0,false)}" -match("MESSAGE#569:00033:08/0", "nwparser.payload", "NACN Policy Manager %{p0}"); +var part2103 = match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); -var part2111 = // "Pattern{Constant('1 '), Field(p0,false)}" -match("MESSAGE#569:00033:08/1_0", "nwparser.p0", "1 %{p0}"); +var part2104 = match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); -var part2112 = // "Pattern{Constant('2 '), Field(p0,false)}" -match("MESSAGE#569:00033:08/1_1", "nwparser.p0", "2 %{p0}"); +var part2105 = match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); -var part2113 = // "Pattern{Constant('unset '), Field(p0,false)}" -match("MESSAGE#571:00033:10/3_1", "nwparser.p0", "unset %{p0}"); +var part2106 = match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var part2114 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#581:00033:21/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part2107 = match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); -var part2115 = // "Pattern{Constant('SSH '), Field(p0,false)}" -match("MESSAGE#586:00034:01/2_1", "nwparser.p0", "SSH %{p0}"); +var part2108 = match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); -var part2116 = // "Pattern{Constant('SCS: NetScreen '), Field(p0,false)}" -match("MESSAGE#588:00034:03/0_0", "nwparser.payload", "SCS: NetScreen %{p0}"); +var part2109 = match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); -var part2117 = // "Pattern{Constant('NetScreen '), Field(p0,false)}" -match("MESSAGE#588:00034:03/0_1", "nwparser.payload", "NetScreen %{p0}"); +var part2110 = match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); -var part2118 = // "Pattern{Constant('S'), Field(p0,false)}" -match("MESSAGE#595:00034:10/0", "nwparser.payload", "S%{p0}"); +var part2111 = match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); -var part2119 = // "Pattern{Constant('CS: SSH'), Field(p0,false)}" -match("MESSAGE#595:00034:10/1_0", "nwparser.p0", "CS: SSH%{p0}"); +var part2112 = match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); -var part2120 = // "Pattern{Constant('SH'), Field(p0,false)}" -match("MESSAGE#595:00034:10/1_1", "nwparser.p0", "SH%{p0}"); +var part2113 = match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); -var part2121 = // "Pattern{Constant('the root system '), Field(p0,false)}" -match("MESSAGE#596:00034:12/3_0", "nwparser.p0", "the root system %{p0}"); +var part2114 = match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); -var part2122 = // "Pattern{Constant('vsys '), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#596:00034:12/3_1", "nwparser.p0", "vsys %{fld2->} %{p0}"); +var part2115 = match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); -var part2123 = // "Pattern{Constant('CS: SSH '), Field(p0,false)}" -match("MESSAGE#599:00034:18/1_0", "nwparser.p0", "CS: SSH %{p0}"); +var part2116 = match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); -var part2124 = // "Pattern{Constant('SH '), Field(p0,false)}" -match("MESSAGE#599:00034:18/1_1", "nwparser.p0", "SH %{p0}"); +var part2117 = match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); -var part2125 = // "Pattern{Constant('a '), Field(p0,false)}" -match("MESSAGE#630:00035:06/1_0", "nwparser.p0", "a %{p0}"); +var part2118 = match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); -var part2126 = // "Pattern{Constant('ert '), Field(p0,false)}" -match("MESSAGE#630:00035:06/1_1", "nwparser.p0", "ert %{p0}"); +var part2119 = match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); -var part2127 = // "Pattern{Constant('SSL '), Field(p0,false)}" -match("MESSAGE#633:00035:09/0", "nwparser.payload", "SSL %{p0}"); +var part2120 = match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); -var part2128 = // "Pattern{Constant('id: '), Field(p0,false)}" -match("MESSAGE#644:00037:01/1_0", "nwparser.p0", "id: %{p0}"); +var part2121 = match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); -var part2129 = // "Pattern{Constant('ID '), Field(p0,false)}" -match("MESSAGE#644:00037:01/1_1", "nwparser.p0", "ID %{p0}"); +var part2122 = match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); -var part2130 = // "Pattern{Constant('permit '), Field(p0,false)}" -match("MESSAGE#659:00044/1_0", "nwparser.p0", "permit %{p0}"); +var part2123 = match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); -var part2131 = // "Pattern{Constant('IGMP '), Field(p0,false)}" -match("MESSAGE#675:00055/0", "nwparser.payload", "IGMP %{p0}"); +var part2124 = match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); -var part2132 = // "Pattern{Constant('IGMP will '), Field(p0,false)}" -match("MESSAGE#677:00055:02/0", "nwparser.payload", "IGMP will %{p0}"); +var part2125 = match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); -var part2133 = // "Pattern{Constant('not do '), Field(p0,false)}" -match("MESSAGE#677:00055:02/1_0", "nwparser.p0", "not do %{p0}"); +var part2126 = match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); -var part2134 = // "Pattern{Constant('do '), Field(p0,false)}" -match("MESSAGE#677:00055:02/1_1", "nwparser.p0", "do %{p0}"); +var part2127 = match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); -var part2135 = // "Pattern{Constant('shut down '), Field(p0,false)}" -match("MESSAGE#689:00059/1_1", "nwparser.p0", "shut down %{p0}"); +var part2128 = match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); -var part2136 = // "Pattern{Constant('NSRP: '), Field(p0,false)}" -match("MESSAGE#707:00070/0", "nwparser.payload", "NSRP: %{p0}"); +var part2129 = match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); -var part2137 = // "Pattern{Constant('Unit '), Field(p0,false)}" -match("MESSAGE#707:00070/1_0", "nwparser.p0", "Unit %{p0}"); +var part2130 = match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); -var part2138 = // "Pattern{Constant('local unit= '), Field(p0,false)}" -match("MESSAGE#707:00070/1_1", "nwparser.p0", "local unit= %{p0}"); +var part2131 = match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); -var part2139 = // "Pattern{Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#707:00070/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); +var part2132 = match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); -var part2140 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Sec'), Field(p0,false)}" -match("MESSAGE#708:00070:01/0", "nwparser.payload", "The local device %{fld2->} in the Virtual Sec%{p0}"); +var part2133 = match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); -var part2141 = // "Pattern{Constant('ruity'), Field(p0,false)}" -match("MESSAGE#708:00070:01/1_0", "nwparser.p0", "ruity%{p0}"); +var part2134 = match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); -var part2142 = // "Pattern{Constant('urity'), Field(p0,false)}" -match("MESSAGE#708:00070:01/1_1", "nwparser.p0", "urity%{p0}"); +var part2135 = match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); -var part2143 = // "Pattern{Field(,false), Constant('Device group '), Field(group,true), Constant(' changed state')}" -match("MESSAGE#713:00072:01/2", "nwparser.p0", "%{}Device group %{group->} changed state"); +var part2136 = match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); -var part2144 = // "Pattern{Constant(''), Field(fld2,true), Constant(' of VSD group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#717:00075/2", "nwparser.p0", "%{fld2->} of VSD group %{group->} %{info}"); +var part2137 = match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); -var part2145 = // "Pattern{Constant('start_time='), Field(p0,false)}" -match("MESSAGE#748:00257:19/0", "nwparser.payload", "start_time=%{p0}"); +var part2138 = match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); -var part2146 = // "Pattern{Constant('\"'), Field(fld2,false), Constant('\"'), Field(p0,false)}" -match("MESSAGE#748:00257:19/1_0", "nwparser.p0", "\\\"%{fld2}\\\"%{p0}"); +var part2139 = match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); -var part2147 = // "Pattern{Constant(' "'), Field(fld2,false), Constant('" '), Field(p0,false)}" -match("MESSAGE#748:00257:19/1_1", "nwparser.p0", " \"%{fld2}\" %{p0}"); +var part2140 = match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); -var part2148 = // "Pattern{Field(daddr,false)}" -match_copy("MESSAGE#756:00257:10/1_1", "nwparser.p0", "daddr"); +var part2141 = match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); -var part2149 = // "Pattern{Constant('Admin '), Field(p0,false)}" -match("MESSAGE#760:00259/0_0", "nwparser.payload", "Admin %{p0}"); +var part2142 = match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); -var part2150 = // "Pattern{Constant('Vsys admin '), Field(p0,false)}" -match("MESSAGE#760:00259/0_1", "nwparser.payload", "Vsys admin %{p0}"); +var part2143 = match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); -var part2151 = // "Pattern{Constant('Telnet '), Field(p0,false)}" -match("MESSAGE#760:00259/2_1", "nwparser.p0", "Telnet %{p0}"); +var part2144 = match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); -var part2152 = // "Pattern{Constant(''), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#777:00406/2", "nwparser.p0", "%{interface}). Occurred %{dclass_counter1->} times."); +var part2145 = match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); -var part2153 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#790:00423/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times."); +var part2146 = match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); -var part2154 = // "Pattern{Constant(''), Field(interface,false), Constant(').'), Field(space,false), Constant('Occurred '), Field(dclass_counter1,true), Constant(' times.'), Field(p0,false)}" -match("MESSAGE#793:00430/2", "nwparser.p0", "%{interface}).%{space}Occurred %{dclass_counter1->} times.%{p0}"); +var part2147 = match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var part2155 = // "Pattern{Field(obj_type,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#795:00431/0", "nwparser.payload", "%{obj_type->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part2148 = match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); -var part2156 = // "Pattern{Field(signame,true), Constant(' '), Field(disposition,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(zone,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#797:00433/0", "nwparser.payload", "%{signame->} %{disposition}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{zone->} %{p0}"); +var part2149 = match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); -var part2157 = // "Pattern{Field(signame,false), Constant('! From '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(', proto '), Field(protocol,true), Constant(' (zone '), Field(p0,false)}" -match("MESSAGE#804:00437:01/0", "nwparser.payload", "%{signame}! From %{saddr}:%{sport->} to %{daddr}:%{dport}, proto %{protocol->} (zone %{p0}"); +var part2150 = match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); -var part2158 = // "Pattern{Field(administrator,true), Constant(' ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#817:00511:01/1_0", "nwparser.p0", "%{administrator->} (%{fld1})"); +var part2151 = match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); -var part2159 = // "Pattern{Constant('ut '), Field(p0,false)}" -match("MESSAGE#835:00515:04/2_1", "nwparser.p0", "ut %{p0}"); +var part2152 = match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); -var part2160 = // "Pattern{Field(logon_type,true), Constant(' from '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#835:00515:04/4_0", "nwparser.p0", "%{logon_type->} from %{saddr}:%{sport}"); +var part2153 = match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); -var part2161 = // "Pattern{Constant('user '), Field(p0,false)}" -match("MESSAGE#837:00515:05/1_0", "nwparser.p0", "user %{p0}"); +var part2154 = match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); -var part2162 = // "Pattern{Constant('the '), Field(logon_type,false)}" -match("MESSAGE#837:00515:05/5_0", "nwparser.p0", "the %{logon_type}"); +var part2155 = match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); -var part2163 = // "Pattern{Constant('WebAuth user '), Field(p0,false)}" -match("MESSAGE#869:00519:01/1_0", "nwparser.p0", "WebAuth user %{p0}"); +var part2156 = match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); -var part2164 = // "Pattern{Constant('backup1 '), Field(p0,false)}" -match("MESSAGE#876:00520:02/1_1", "nwparser.p0", "backup1 %{p0}"); +var part2157 = match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); -var part2165 = // "Pattern{Constant('backup2 '), Field(p0,false)}" -match("MESSAGE#876:00520:02/1_2", "nwparser.p0", "backup2 %{p0}"); +var part2158 = match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); -var part2166 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#890:00524:13/1_0", "nwparser.p0", ",%{p0}"); +var part2159 = match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); -var part2167 = // "Pattern{Constant('assigned '), Field(p0,false)}" -match("MESSAGE#901:00527/1_0", "nwparser.p0", "assigned %{p0}"); +var part2160 = match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); -var part2168 = // "Pattern{Constant('assigned to '), Field(p0,false)}" -match("MESSAGE#901:00527/3_0", "nwparser.p0", "assigned to %{p0}"); +var part2161 = match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); -var part2169 = // "Pattern{Constant('''), Field(administrator,false), Constant('' '), Field(p0,false)}" -match("MESSAGE#927:00528:15/1_0", "nwparser.p0", "'%{administrator}' %{p0}"); +var part2162 = match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); -var part2170 = // "Pattern{Constant('SSH: P'), Field(p0,false)}" -match("MESSAGE#930:00528:18/0", "nwparser.payload", "SSH: P%{p0}"); +var part2163 = match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); -var part2171 = // "Pattern{Constant('KA '), Field(p0,false)}" -match("MESSAGE#930:00528:18/1_0", "nwparser.p0", "KA %{p0}"); +var part2164 = match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); -var part2172 = // "Pattern{Constant('assword '), Field(p0,false)}" -match("MESSAGE#930:00528:18/1_1", "nwparser.p0", "assword %{p0}"); +var part2165 = match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); -var part2173 = // "Pattern{Constant('\''), Field(administrator,false), Constant('\' '), Field(p0,false)}" -match("MESSAGE#930:00528:18/3_0", "nwparser.p0", "\\'%{administrator}\\' %{p0}"); +var part2166 = match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); -var part2174 = // "Pattern{Constant('at host '), Field(saddr,false)}" -match("MESSAGE#930:00528:18/4", "nwparser.p0", "at host %{saddr}"); +var part2167 = match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); -var part2175 = // "Pattern{Field(,false), Constant('S'), Field(p0,false)}" -match("MESSAGE#932:00528:19/0", "nwparser.payload", "%{}S%{p0}"); +var part2168 = match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); -var part2176 = // "Pattern{Constant('CS '), Field(p0,false)}" -match("MESSAGE#932:00528:19/1_0", "nwparser.p0", "CS %{p0}"); +var part2169 = match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); -var part2177 = // "Pattern{Constant('from server.ini file.'), Field(,false)}" -match("MESSAGE#1060:00553/2", "nwparser.p0", "from server.ini file.%{}"); +var part2170 = match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); -var part2178 = // "Pattern{Constant('pattern '), Field(p0,false)}" -match("MESSAGE#1064:00553:04/1_0", "nwparser.p0", "pattern %{p0}"); +var part2171 = match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); -var part2179 = // "Pattern{Constant('server.ini '), Field(p0,false)}" -match("MESSAGE#1064:00553:04/1_1", "nwparser.p0", "server.ini %{p0}"); +var part2172 = match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); -var part2180 = // "Pattern{Constant('file.'), Field(,false)}" -match("MESSAGE#1068:00553:08/2", "nwparser.p0", "file.%{}"); +var part2173 = match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); -var part2181 = // "Pattern{Constant('AV pattern '), Field(p0,false)}" -match("MESSAGE#1087:00554:04/1_1", "nwparser.p0", "AV pattern %{p0}"); +var part2174 = match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); -var part2182 = // "Pattern{Constant('added into '), Field(p0,false)}" -match("MESSAGE#1116:00556:14/1_0", "nwparser.p0", "added into %{p0}"); - -var part2183 = // "Pattern{Constant('loader '), Field(p0,false)}" -match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); +var part2175 = match("MESSAGE#1157:00767:11/1_0", "nwparser.p0", "loader %{p0}"); var select436 = linear_select([ dup10, dup11, ]); -var part2184 = // "Pattern{Constant('Policy ID='), Field(policy_id,true), Constant(' Rate='), Field(fld2,true), Constant(' exceeds threshold')}" -match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ +var part2176 = match("MESSAGE#7:00001:07", "nwparser.payload", "Policy ID=%{policy_id->} Rate=%{fld2->} exceeds threshold", processor_chain([ dup1, dup2, dup3, @@ -25792,8 +23269,7 @@ var select442 = linear_select([ dup72, ]); -var part2185 = // "Pattern{Field(signame,true), Constant(' from '), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' protocol '), Field(protocol,true), Constant(' ('), Field(interface,false), Constant(')')}" -match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ +var part2177 = match("MESSAGE#84:00005:04", "nwparser.payload", "%{signame->} from %{saddr}/%{sport->} to %{daddr}/%{dport->} protocol %{protocol->} (%{interface})", processor_chain([ dup58, dup2, dup3, @@ -25899,41 +23375,38 @@ var select461 = linear_select([ ]); var select462 = linear_select([ - dup160, dup161, + dup162, ]); var select463 = linear_select([ dup163, - dup164, + dup103, ]); var select464 = linear_select([ - dup165, - dup103, + dup162, + dup161, ]); var select465 = linear_select([ - dup164, - dup163, + dup46, + dup47, ]); var select466 = linear_select([ - dup46, - dup47, + dup166, + dup167, ]); var select467 = linear_select([ - dup168, - dup169, + dup172, + dup173, ]); var select468 = linear_select([ dup174, dup175, -]); - -var select469 = linear_select([ dup176, dup177, dup178, @@ -25941,47 +23414,44 @@ var select469 = linear_select([ dup180, dup181, dup182, - dup183, - dup184, ]); -var select470 = linear_select([ +var select469 = linear_select([ dup49, dup21, ]); -var select471 = linear_select([ - dup191, - dup192, +var select470 = linear_select([ + dup189, + dup190, ]); -var select472 = linear_select([ +var select471 = linear_select([ dup96, dup152, ]); -var select473 = linear_select([ - dup198, - dup199, +var select472 = linear_select([ + dup196, + dup197, ]); -var select474 = linear_select([ +var select473 = linear_select([ dup24, - dup202, + dup200, ]); -var select475 = linear_select([ +var select474 = linear_select([ dup103, - dup165, + dup163, ]); -var select476 = linear_select([ - dup207, +var select475 = linear_select([ + dup205, dup118, ]); -var part2186 = // "Pattern{Field(change_attribute,true), Constant(' has been changed from '), Field(change_old,true), Constant(' to '), Field(change_new,false)}" -match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ +var part2178 = match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has been changed from %{change_old->} to %{change_new}", processor_chain([ dup1, dup2, dup3, @@ -25989,49 +23459,54 @@ match("MESSAGE#477:00030:02", "nwparser.payload", "%{change_attribute->} has bee dup5, ])); +var select476 = linear_select([ + dup212, + dup213, +]); + var select477 = linear_select([ - dup214, dup215, + dup216, ]); var select478 = linear_select([ - dup217, - dup218, + dup222, + dup215, ]); var select479 = linear_select([ dup224, - dup217, + dup225, ]); var select480 = linear_select([ - dup226, - dup227, + dup231, + dup124, ]); var select481 = linear_select([ - dup233, - dup124, + dup229, + dup230, ]); var select482 = linear_select([ - dup231, - dup232, + dup233, + dup234, ]); var select483 = linear_select([ - dup235, dup236, + dup237, ]); var select484 = linear_select([ - dup238, - dup239, + dup242, + dup243, ]); var select485 = linear_select([ - dup244, dup245, + dup246, ]); var select486 = linear_select([ @@ -26050,27 +23525,21 @@ var select488 = linear_select([ ]); var select489 = linear_select([ - dup253, - dup254, + dup260, + dup261, ]); var select490 = linear_select([ - dup262, - dup263, + dup264, + dup265, ]); var select491 = linear_select([ - dup266, - dup267, -]); - -var select492 = linear_select([ - dup270, - dup271, + dup268, + dup269, ]); -var part2187 = // "Pattern{Constant('The local device '), Field(fld2,true), Constant(' in the Virtual Security Device group '), Field(group,true), Constant(' '), Field(info,false)}" -match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ +var part2179 = match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in the Virtual Security Device group %{group->} %{info}", processor_chain([ dup1, dup2, dup3, @@ -26078,18 +23547,17 @@ match("MESSAGE#716:00074", "nwparser.payload", "The local device %{fld2->} in th dup5, ])); -var select493 = linear_select([ - dup286, - dup287, +var select492 = linear_select([ + dup284, + dup285, ]); -var select494 = linear_select([ - dup289, - dup290, +var select493 = linear_select([ + dup287, + dup288, ]); -var part2188 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to '), Field(daddr,false), Constant(', using protocol '), Field(protocol,false), Constant(', and arriving at interface '), Field(dinterface,true), Constant(' in zone '), Field(dst_zone,false), Constant('.'), Field(space,false), Constant('The attack occurred '), Field(dclass_counter1,true), Constant(' times.')}" -match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ +var part2180 = match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to %{daddr}, using protocol %{protocol}, and arriving at interface %{dinterface->} in zone %{dst_zone}.%{space}The attack occurred %{dclass_counter1->} times.", processor_chain([ dup58, dup2, dup59, @@ -26099,8 +23567,7 @@ match("MESSAGE#799:00435", "nwparser.payload", "%{signame->} From %{saddr->} to dup60, ])); -var part2189 = // "Pattern{Field(signame,true), Constant(' From '), Field(saddr,true), Constant(' to zone '), Field(zone,false), Constant(', proto '), Field(protocol,true), Constant(' (int '), Field(interface,false), Constant('). Occurred '), Field(dclass_counter1,true), Constant(' times. ('), Field(fld1,false), Constant(')')}" -match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ +var part2181 = match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to zone %{zone}, proto %{protocol->} (int %{interface}). Occurred %{dclass_counter1->} times. (%{fld1})", processor_chain([ dup58, dup4, dup59, @@ -26111,116 +23578,112 @@ match("MESSAGE#814:00442", "nwparser.payload", "%{signame->} From %{saddr->} to dup60, ])); -var select495 = linear_select([ - dup302, +var select494 = linear_select([ + dup300, dup26, ]); -var select496 = linear_select([ +var select495 = linear_select([ dup115, - dup305, + dup303, ]); -var select497 = linear_select([ +var select496 = linear_select([ dup125, dup96, ]); +var select497 = linear_select([ + dup189, + dup308, + dup309, +]); + var select498 = linear_select([ - dup191, dup310, - dup311, + dup16, ]); var select499 = linear_select([ - dup312, - dup16, + dup317, + dup318, ]); var select500 = linear_select([ dup319, - dup320, + dup315, ]); var select501 = linear_select([ - dup321, - dup317, + dup322, + dup250, ]); var select502 = linear_select([ - dup324, - dup252, -]); - -var select503 = linear_select([ + dup327, dup329, - dup331, ]); -var select504 = linear_select([ - dup332, +var select503 = linear_select([ + dup330, dup129, ]); -var part2190 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup283, +var part2182 = match("MESSAGE#1196:01269:01", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} direction=%{direction->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup60, - dup284, + dup282, ])); -var part2191 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup187, +var part2183 = match("MESSAGE#1197:01269:02", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, + dup275, + dup276, dup277, - dup278, - dup279, dup60, ])); -var part2192 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' proto='), Field(protocol,true), Constant(' src zone='), Field(src_zone,true), Constant(' dst zone='), Field(dst_zone,true), Constant(' action='), Field(disposition,true), Constant(' sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' icmp type='), Field(icmptype,false)}" -match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ - dup283, +var part2184 = match("MESSAGE#1198:01269:03", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} proto=%{protocol->} src zone=%{src_zone->} dst zone=%{dst_zone->} action=%{disposition->} sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} icmp type=%{icmptype}", processor_chain([ + dup281, dup2, dup4, dup5, - dup276, + dup274, dup3, - dup277, + dup275, dup60, - dup284, + dup282, ])); -var part2193 = // "Pattern{Constant('start_time="'), Field(fld2,false), Constant('" duration='), Field(duration,true), Constant(' policy_id='), Field(policy_id,true), Constant(' service='), Field(service,true), Constant(' ('), Field(fld3,false), Constant(') proto='), Field(protocol,true), Constant(' direction='), Field(direction,true), Constant(' action=Deny sent='), Field(sbytes,true), Constant(' rcvd='), Field(rbytes,true), Constant(' src='), Field(saddr,true), Constant(' dst='), Field(daddr,true), Constant(' src_port='), Field(sport,true), Constant(' dst_port='), Field(dport,false)}" -match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ - dup187, +var part2185 = match("MESSAGE#1203:23184", "nwparser.payload", "start_time=\"%{fld2}\" duration=%{duration->} policy_id=%{policy_id->} service=%{service->} (%{fld3}) proto=%{protocol->} direction=%{direction->} action=Deny sent=%{sbytes->} rcvd=%{rbytes->} src=%{saddr->} dst=%{daddr->} src_port=%{sport->} dst_port=%{dport}", processor_chain([ + dup185, dup2, dup4, dup5, - dup276, + dup274, dup3, + dup275, + dup276, dup277, - dup278, - dup279, dup61, ])); -var all397 = all_match({ +var all391 = all_match({ processors: [ - dup265, - dup393, - dup268, + dup263, + dup390, + dup266, ], on_success: processor_chain([ dup1, @@ -26231,11 +23694,11 @@ var all397 = all_match({ ]), }); -var all398 = all_match({ +var all392 = all_match({ processors: [ - dup269, - dup394, - dup272, + dup267, + dup391, + dup270, ], on_success: processor_chain([ dup1, @@ -26246,11 +23709,11 @@ var all398 = all_match({ ]), }); -var all399 = all_match({ +var all393 = all_match({ processors: [ dup80, - dup345, - dup295, + dup343, + dup293, ], on_success: processor_chain([ dup58, @@ -26263,14 +23726,14 @@ var all399 = all_match({ ]), }); -var all400 = all_match({ +var all394 = all_match({ processors: [ - dup298, - dup345, + dup296, + dup343, dup131, ], on_success: processor_chain([ - dup299, + dup297, dup2, dup3, dup9, @@ -26281,14 +23744,14 @@ var all400 = all_match({ ]), }); -var all401 = all_match({ +var all395 = all_match({ processors: [ - dup300, - dup345, + dup298, + dup343, dup131, ], on_success: processor_chain([ - dup299, + dup297, dup2, dup3, dup9, diff --git a/x-pack/filebeat/module/proofpoint/emailsecurity/config/pipeline.js b/x-pack/filebeat/module/proofpoint/emailsecurity/config/pipeline.js index 618356e4723..bc962bd964d 100644 --- a/x-pack/filebeat/module/proofpoint/emailsecurity/config/pipeline.js +++ b/x-pack/filebeat/module/proofpoint/emailsecurity/config/pipeline.js @@ -21,20 +21,15 @@ function DeviceProcessor() { } } -var dup1 = // "Pattern{Constant('info'), Field(p0,false)}" -match("HEADER#0:0024/1_0", "nwparser.p0", "info%{p0}"); +var dup1 = match("HEADER#0:0024/1_0", "nwparser.p0", "info%{p0}"); -var dup2 = // "Pattern{Constant('rprt'), Field(p0,false)}" -match("HEADER#0:0024/1_1", "nwparser.p0", "rprt%{p0}"); +var dup2 = match("HEADER#0:0024/1_1", "nwparser.p0", "rprt%{p0}"); -var dup3 = // "Pattern{Constant('warn'), Field(p0,false)}" -match("HEADER#0:0024/1_2", "nwparser.p0", "warn%{p0}"); +var dup3 = match("HEADER#0:0024/1_2", "nwparser.p0", "warn%{p0}"); -var dup4 = // "Pattern{Constant('err'), Field(p0,false)}" -match("HEADER#0:0024/1_3", "nwparser.p0", "err%{p0}"); +var dup4 = match("HEADER#0:0024/1_3", "nwparser.p0", "err%{p0}"); -var dup5 = // "Pattern{Constant('note'), Field(p0,false)}" -match("HEADER#0:0024/1_4", "nwparser.p0", "note%{p0}"); +var dup5 = match("HEADER#0:0024/1_4", "nwparser.p0", "note%{p0}"); var dup6 = call({ dest: "nwparser.messageid", @@ -74,24 +69,19 @@ var dup12 = setc("dclass_counter1_string","No of attachments:"); var dup13 = setc("dclass_counter2_string","No of recipients:"); -var dup14 = // "Pattern{Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" -match("MESSAGE#11:mail_env_from:ofrom/1_0", "nwparser.p0", "%{hostip->} sampling=%{fld19}"); +var dup14 = match("MESSAGE#11:mail_env_from:ofrom/1_0", "nwparser.p0", "%{hostip->} sampling=%{fld19}"); -var dup15 = // "Pattern{Field(hostip,false)}" -match_copy("MESSAGE#11:mail_env_from:ofrom/1_1", "nwparser.p0", "hostip"); +var dup15 = match_copy("MESSAGE#11:mail_env_from:ofrom/1_1", "nwparser.p0", "hostip"); var dup16 = setc("eventcategory","1207030000"); var dup17 = setc("eventcategory","1207000000"); -var dup18 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#25:session_judge/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); +var dup18 = match("MESSAGE#25:session_judge/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); -var dup19 = // "Pattern{Constant('attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(p0,false)}" -match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); +var dup19 = match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); -var dup20 = // "Pattern{Constant('mod='), Field(p0,false)}" -match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); +var dup20 = match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); var dup21 = call({ dest: "nwparser.filename", @@ -103,11 +93,9 @@ var dup21 = call({ var dup22 = setc("eventcategory","1207040200"); -var dup23 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' version="'), Field(component_version,false), Constant('" duration='), Field(p0,false)}" -match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); +var dup23 = match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); -var dup24 = // "Pattern{Field(duration_string,false)}" -match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); +var dup24 = match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); var dup25 = setc("eventcategory","1003010000"); @@ -115,29 +103,21 @@ var dup26 = setc("eventcategory","1003000000"); var dup27 = setc("eventcategory","1207040000"); -var dup28 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); +var dup28 = match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); -var dup29 = // "Pattern{Constant('['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); +var dup29 = match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); -var dup30 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); +var dup30 = match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); -var dup31 = // "Pattern{Field(dhost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); +var dup31 = match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); -var dup32 = // "Pattern{Field(,false), Constant('dsn='), Field(resultcode,false), Constant(', stat='), Field(info,false)}" -match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); +var dup32 = match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); -var dup33 = // "Pattern{Constant('['), Field(daddr,false), Constant(']')}" -match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); +var dup33 = match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); -var dup34 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant(']')}" -match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); +var dup34 = match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); -var dup35 = // "Pattern{Field(dhost,false)}" -match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); +var dup35 = match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); var dup36 = date_time({ dest: "event_time", @@ -147,29 +127,21 @@ var dup36 = date_time({ ], }); -var dup37 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); +var dup37 = match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); -var dup38 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); +var dup38 = match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); -var dup39 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); +var dup39 = match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); -var dup40 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant(']')}" -match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); +var dup40 = match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); -var dup41 = // "Pattern{Field(,false), Constant('field='), Field(fld2,false), Constant(', status='), Field(info,false)}" -match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); +var dup41 = match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); -var dup42 = // "Pattern{Field(,false), Constant('version='), Field(fld55,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" -match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); +var dup42 = match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); -var dup43 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(fld71,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); +var dup43 = match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); -var dup44 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); +var dup44 = match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); var dup45 = linear_select([ dup1, @@ -189,62 +161,52 @@ var dup47 = linear_select([ dup20, ]); -var dup48 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" -match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ +var dup48 = match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ dup26, dup9, ])); -var dup49 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var dup49 = match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); -var dup50 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var dup50 = match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); -var dup51 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" -match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ +var dup51 = match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ dup17, dup9, ])); -var dup52 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" -match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ +var dup52 = match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ dup17, dup9, ])); -var dup53 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" -match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ +var dup53 = match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ dup27, dup9, ])); -var dup54 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' version='), Field(fld55,false)}" -match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ +var dup54 = match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ dup17, dup9, ])); -var dup55 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sig='), Field(fld60,false)}" -match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ +var dup55 = match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ dup17, dup9, ])); -var dup56 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,false)}" -match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ +var dup56 = match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ dup17, dup9, ])); -var dup57 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' addr='), Field(saddr,false)}" -match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ +var dup57 = match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ dup17, dup9, ])); @@ -263,20 +225,17 @@ var dup59 = linear_select([ dup35, ]); -var dup60 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': timeout waiting for input from '), Field(fld11,true), Constant(' during server cmd read')}" -match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ +var dup60 = match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ dup17, dup9, ])); -var dup61 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(event_description,false)}" -match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ +var dup61 = match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ dup17, dup9, ])); -var dup62 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" -match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ +var dup62 = match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ dup17, dup9, ])); @@ -351,8 +310,7 @@ var dup68 = all_match({ ]), }); -var hdr1 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld3,false), Constant(']: '), Field(p0,false)}" -match("HEADER#0:0024/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{hinstance}[%{hfld3}]: %{p0}", processor_chain([ +var hdr1 = match("HEADER#0:0024/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{hinstance}[%{hfld3}]: %{p0}", processor_chain([ call({ dest: "nwparser.payload", fn: STRCAT, @@ -366,8 +324,7 @@ match("HEADER#0:0024/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{h }), ])); -var part1 = // "Pattern{Field(,false), Constant('s='), Field(hfld4,true), Constant(' cmd=send '), Field(p0,false)}" -match("HEADER#0:0024/2", "nwparser.p0", "%{}s=%{hfld4->} cmd=send %{p0}"); +var part1 = match("HEADER#0:0024/2", "nwparser.p0", "%{}s=%{hfld4->} cmd=send %{p0}"); var all1 = all_match({ processors: [ @@ -381,11 +338,9 @@ var all1 = all_match({ ]), }); -var hdr2 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld3,false), Constant(']: '), Field(p0,false)}" -match("HEADER#1:0023/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]: %{p0}"); +var hdr2 = match("HEADER#1:0023/0", "message", "%{hdate}T%{htime}.%{hfld1->} %{hfld2->} %{messageid}[%{hfld3}]: %{p0}"); -var part2 = // "Pattern{Field(,true), Constant(' '), Field(payload,false)}" -match("HEADER#1:0023/2", "nwparser.p0", "%{} %{payload}"); +var part2 = match("HEADER#1:0023/2", "nwparser.p0", "%{} %{payload}"); var all2 = all_match({ processors: [ @@ -398,8 +353,7 @@ var all2 = all_match({ ]), }); -var hdr3 = // "Pattern{Field(hdate,false), Constant('T'), Field(htime,false), Constant('.'), Field(hfld1,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(p0,false)}" -match("HEADER#2:0025", "message", "%{hdate}T%{htime}.%{hfld1->} %{hinstance->} %{messageid}[%{hfld2}]: %{p0}", processor_chain([ +var hdr3 = match("HEADER#2:0025", "message", "%{hdate}T%{htime}.%{hfld1->} %{hinstance->} %{messageid}[%{hfld2}]: %{p0}", processor_chain([ setc("header_id","0025"), call({ dest: "nwparser.payload", @@ -414,8 +368,7 @@ match("HEADER#2:0025", "message", "%{hdate}T%{htime}.%{hfld1->} %{hinstance->} % }), ])); -var hdr4 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld4,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' attachment='), Field(hfld7,true), Constant(' file='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#3:0026", "message", "%{hmonth->} %{hday->} %{htime->} %{hostname->} %{hinstance}[%{hfld4}]: %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr4 = match("HEADER#3:0026", "message", "%{hmonth->} %{hday->} %{htime->} %{hostname->} %{hinstance}[%{hfld4}]: %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0026"), dup6, call({ @@ -447,8 +400,7 @@ match("HEADER#3:0026", "message", "%{hmonth->} %{hday->} %{htime->} %{hostname-> }), ])); -var hdr5 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' attachment='), Field(hfld7,true), Constant(' file='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#4:0003", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr5 = match("HEADER#4:0003", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} attachment=%{hfld7->} file=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0003"), dup6, call({ @@ -478,8 +430,7 @@ match("HEADER#4:0003", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance- }), ])); -var hdr6 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld3,true), Constant(' m='), Field(hfld4,true), Constant(' x='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#5:0015", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} m=%{hfld4->} x=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr6 = match("HEADER#5:0015", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} m=%{hfld4->} x=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0015"), dup6, call({ @@ -507,8 +458,7 @@ match("HEADER#5:0015", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} % }), ])); -var hdr7 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' s='), Field(hfld3,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#6:0016", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr7 = match("HEADER#6:0016", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} s=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0016"), dup6, call({ @@ -532,8 +482,7 @@ match("HEADER#6:0016", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} % }), ])); -var hdr8 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(severity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(p0,false)}" -match("HEADER#7:0017", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ +var hdr8 = match("HEADER#7:0017", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ setc("header_id","0017"), call({ dest: "nwparser.messageid", @@ -546,8 +495,7 @@ match("HEADER#7:0017", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} % dup7, ])); -var hdr9 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant(': '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' m='), Field(hfld3,true), Constant(' x='), Field(hfld4,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#8:0018", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} cmd=%{messageid->} %{p0}", processor_chain([ +var hdr9 = match("HEADER#8:0018", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} cmd=%{messageid->} %{p0}", processor_chain([ setc("header_id","0018"), call({ dest: "nwparser.payload", @@ -570,8 +518,7 @@ match("HEADER#8:0018", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} % }), ])); -var hdr10 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#9:0019", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance->} %{hseverity->} s=%{hfld2->} mod=%{messageid->} %{p0}", processor_chain([ +var hdr10 = match("HEADER#9:0019", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance->} %{hseverity->} s=%{hfld2->} mod=%{messageid->} %{p0}", processor_chain([ setc("header_id","0019"), call({ dest: "nwparser.payload", @@ -590,8 +537,7 @@ match("HEADER#9:0019", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} % }), ])); -var hdr11 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,false), Constant('='), Field(hfld3,true), Constant(' '), Field(p0,false)}" -match("HEADER#10:0020", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} mod=%{msgIdPart1->} %{msgIdPart2}=%{hfld3->} %{p0}", processor_chain([ +var hdr11 = match("HEADER#10:0020", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{hseverity->} mod=%{msgIdPart1->} %{msgIdPart2}=%{hfld3->} %{p0}", processor_chain([ setc("header_id","0020"), dup6, call({ @@ -615,8 +561,7 @@ match("HEADER#10:0020", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} }), ])); -var hdr12 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld2,false), Constant(']: '), Field(severity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' '), Field(p0,false)}" -match("HEADER#11:0021", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ +var hdr12 = match("HEADER#11:0021", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}[%{hfld2}]: %{severity->} mod=%{msgIdPart1->} %{p0}", processor_chain([ setc("header_id","0021"), call({ dest: "nwparser.messageid", @@ -629,8 +574,7 @@ match("HEADER#11:0021", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} dup7, ])); -var hdr13 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld1,true), Constant(' '), Field(hinstance,false), Constant(': '), Field(hseverity,true), Constant(' s='), Field(hfld2,true), Constant(' m='), Field(hfld3,true), Constant(' x='), Field(hfld4,true), Constant(' '), Field(msgIdPart1,false), Constant('='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#12:0022", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} %{msgIdPart1}=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr13 = match("HEADER#12:0022", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} %{hinstance}: %{hseverity->} s=%{hfld2->} m=%{hfld3->} x=%{hfld4->} %{msgIdPart1}=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0022"), dup6, call({ @@ -656,8 +600,7 @@ match("HEADER#12:0022", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld1->} }), ])); -var hdr14 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#13:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr14 = match("HEADER#13:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0001"), dup6, call({ @@ -683,8 +626,7 @@ match("HEADER#13:0001", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr15 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' m='), Field(hfld2,true), Constant(' x='), Field(hfld3,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#14:0008", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} cmd=%{messageid->} %{p0}", processor_chain([ +var hdr15 = match("HEADER#14:0008", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} m=%{hfld2->} x=%{hfld3->} cmd=%{messageid->} %{p0}", processor_chain([ setc("header_id","0008"), call({ dest: "nwparser.payload", @@ -707,8 +649,7 @@ match("HEADER#14:0008", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr16 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#15:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr16 = match("HEADER#15:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0002"), dup6, call({ @@ -730,8 +671,7 @@ match("HEADER#15:0002", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr17 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#16:0007", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{messageid->} %{p0}", processor_chain([ +var hdr17 = match("HEADER#16:0007", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} mod=%{messageid->} %{p0}", processor_chain([ setc("header_id","0007"), call({ dest: "nwparser.payload", @@ -750,8 +690,7 @@ match("HEADER#16:0007", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr18 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' s='), Field(hfld1,true), Constant(' cmd='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#17:0012", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} cmd=%{messageid->} %{p0}", processor_chain([ +var hdr18 = match("HEADER#17:0012", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} s=%{hfld1->} cmd=%{messageid->} %{p0}", processor_chain([ setc("header_id","0012"), call({ dest: "nwparser.payload", @@ -770,8 +709,7 @@ match("HEADER#17:0012", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr19 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' type='), Field(hfld5,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#18:0004", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} type=%{hfld5->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr19 = match("HEADER#18:0004", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} type=%{hfld5->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0004"), dup6, call({ @@ -793,8 +731,7 @@ match("HEADER#18:0004", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr20 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' pid='), Field(hfld5,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#19:0005", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} pid=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr20 = match("HEADER#19:0005", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} pid=%{hfld5->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0005"), dup6, call({ @@ -816,8 +753,7 @@ match("HEADER#19:0005", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr21 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(msgIdPart1,true), Constant(' cmd='), Field(msgIdPart2,true), Constant(' '), Field(p0,false)}" -match("HEADER#20:0006", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ +var hdr21 = match("HEADER#20:0006", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{msgIdPart1->} cmd=%{msgIdPart2->} %{p0}", processor_chain([ setc("header_id","0006"), dup6, call({ @@ -837,8 +773,7 @@ match("HEADER#20:0006", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr22 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(hseverity,true), Constant(' mod='), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#21:0009", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{messageid->} %{p0}", processor_chain([ +var hdr22 = match("HEADER#21:0009", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{hseverity->} mod=%{messageid->} %{p0}", processor_chain([ setc("header_id","0009"), call({ dest: "nwparser.payload", @@ -855,8 +790,7 @@ match("HEADER#21:0009", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr23 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hinstance,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#22:0014", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld2->} %{hinstance}[%{hfld1}]: %{messageid->} %{p0}", processor_chain([ +var hdr23 = match("HEADER#22:0014", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld2->} %{hinstance}[%{hfld1}]: %{messageid->} %{p0}", processor_chain([ setc("header_id","0014"), call({ dest: "nwparser.payload", @@ -873,8 +807,7 @@ match("HEADER#22:0014", "message", "%{hmonth->} %{hday->} %{htime->} %{hfld2->} }), ])); -var hdr24 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(p0,false)}" -match("HEADER#23:0013", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid}[%{hfld1}]: %{p0}", processor_chain([ +var hdr24 = match("HEADER#23:0013", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid}[%{hfld1}]: %{p0}", processor_chain([ setc("header_id","0013"), call({ dest: "nwparser.payload", @@ -891,8 +824,7 @@ match("HEADER#23:0013", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr25 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(htime,true), Constant(' '), Field(hinstance,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#24:0011", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid->} %{p0}", processor_chain([ +var hdr25 = match("HEADER#24:0011", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance->} %{messageid->} %{p0}", processor_chain([ setc("header_id","0011"), call({ dest: "nwparser.payload", @@ -907,8 +839,7 @@ match("HEADER#24:0011", "message", "%{hmonth->} %{hday->} %{htime->} %{hinstance }), ])); -var hdr26 = // "Pattern{Field(messageid,false), Constant('['), Field(hfld1,false), Constant(']: '), Field(p0,false)}" -match("HEADER#25:0010", "message", "%{messageid}[%{hfld1}]: %{p0}", processor_chain([ +var hdr26 = match("HEADER#25:0010", "message", "%{messageid}[%{hfld1}]: %{p0}", processor_chain([ setc("header_id","0010"), call({ dest: "nwparser.payload", @@ -952,16 +883,14 @@ var select1 = linear_select([ hdr26, ]); -var part3 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' r='), Field(event_counter,true), Constant(' value='), Field(to,true), Constant(' verified='), Field(fld3,true), Constant(' routes='), Field(fld4,false)}" -match("MESSAGE#0:mail_env_rcpt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ +var part3 = match("MESSAGE#0:mail_env_rcpt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ dup8, dup9, ])); var msg1 = msg("mail_env_rcpt", part3); -var part4 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' r='), Field(event_counter,true), Constant(' value='), Field(to,true), Constant(' verified='), Field(fld3,true), Constant(' routes='), Field(fld4,false)}" -match("MESSAGE#1:mail_env_rcpt:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ +var part4 = match("MESSAGE#1:mail_env_rcpt:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} r=%{event_counter->} value=%{to->} verified=%{fld3->} routes=%{fld4}", processor_chain([ dup8, dup9, ])); @@ -973,32 +902,28 @@ var select2 = linear_select([ msg2, ]); -var part5 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,true), Constant(' a='), Field(fld12,false)}" -match("MESSAGE#2:mail_attachment", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ +var part5 = match("MESSAGE#2:mail_attachment", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ dup10, dup9, ])); var msg3 = msg("mail_attachment", part5); -var part6 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,true), Constant(' a='), Field(fld12,false)}" -match("MESSAGE#3:mail_attachment:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ +var part6 = match("MESSAGE#3:mail_attachment:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11->} a=%{fld12}", processor_chain([ dup10, dup9, ])); var msg4 = msg("mail_attachment:01", part6); -var part7 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,false)}" -match("MESSAGE#4:mail_attachment:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ +var part7 = match("MESSAGE#4:mail_attachment:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ dup10, dup9, ])); var msg5 = msg("mail_attachment:02", part7); -var part8 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' file='), Field(filename,true), Constant(' mime='), Field(content_type,true), Constant(' type='), Field(fld6,true), Constant(' omime='), Field(fld7,true), Constant(' oext='), Field(fld8,true), Constant(' corrupted='), Field(fld9,true), Constant(' protected='), Field(fld10,true), Constant(' size='), Field(bytes,true), Constant(' virtual='), Field(fld11,false)}" -match("MESSAGE#5:mail_attachment:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ +var part8 = match("MESSAGE#5:mail_attachment:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} file=%{filename->} mime=%{content_type->} type=%{fld6->} omime=%{fld7->} oext=%{fld8->} corrupted=%{fld9->} protected=%{fld10->} size=%{bytes->} virtual=%{fld11}", processor_chain([ dup10, dup9, ])); @@ -1012,8 +937,7 @@ var select3 = linear_select([ msg6, ]); -var part9 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#6:mail_msg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part9 = match("MESSAGE#6:mail_msg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup11, dup9, dup12, @@ -1022,8 +946,7 @@ match("MESSAGE#6:mail_msg", "nwparser.payload", "%{fld0->} %{severity->} s=%{ses var msg7 = msg("mail_msg", part9); -var part10 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#7:mail_msg:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part10 = match("MESSAGE#7:mail_msg:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup11, dup9, dup12, @@ -1032,8 +955,7 @@ match("MESSAGE#7:mail_msg:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{ var msg8 = msg("mail_msg:01", part10); -var part11 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#8:mail_msg:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part11 = match("MESSAGE#8:mail_msg:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} virusname=%{threat_name->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup11, dup9, dup12, @@ -1042,8 +964,7 @@ match("MESSAGE#8:mail_msg:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{ var msg9 = msg("mail_msg:04", part11); -var part12 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#9:mail_msg:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part12 = match("MESSAGE#9:mail_msg:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup11, dup9, dup12, @@ -1052,8 +973,7 @@ match("MESSAGE#9:mail_msg:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{ var msg10 = msg("mail_msg:02", part12); -var part13 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject='), Field(subject,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#10:mail_msg:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part13 = match("MESSAGE#10:mail_msg:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=%{subject->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup11, dup9, dup12, @@ -1070,8 +990,7 @@ var select4 = linear_select([ msg11, ]); -var part14 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(to,true), Constant(' ofrom='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(p0,false)}" -match("MESSAGE#11:mail_env_from:ofrom/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); +var part14 = match("MESSAGE#11:mail_env_from:ofrom/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); var all3 = all_match({ processors: [ @@ -1086,16 +1005,14 @@ var all3 = all_match({ var msg12 = msg("mail_env_from:ofrom", all3); -var part15 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(to,true), Constant(' ofrom='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" -match("MESSAGE#12:mail_env_from:ofrom:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ +var part15 = match("MESSAGE#12:mail_env_from:ofrom:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{to->} ofrom=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ dup16, dup9, ])); var msg13 = msg("mail_env_from:ofrom:01", part15); -var part16 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(p0,false)}" -match("MESSAGE#13:mail_env_from/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); +var part16 = match("MESSAGE#13:mail_env_from/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{p0}"); var all4 = all_match({ processors: [ @@ -1110,8 +1027,7 @@ var all4 = all_match({ var msg14 = msg("mail_env_from", all4); -var part17 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(from,true), Constant(' qid='), Field(fld15,true), Constant(' tls='), Field(fld17,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' host='), Field(hostname,true), Constant(' ip='), Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" -match("MESSAGE#14:mail_env_from:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ +var part17 = match("MESSAGE#14:mail_env_from:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{from->} qid=%{fld15->} tls=%{fld17->} routes=%{fld4->} notroutes=%{fld18->} host=%{hostname->} ip=%{hostip->} sampling=%{fld19}", processor_chain([ dup16, dup9, ])); @@ -1125,16 +1041,14 @@ var select5 = linear_select([ msg15, ]); -var part18 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(ddomain,true), Constant(' routes='), Field(fld4,false)}" -match("MESSAGE#15:mail_helo", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ +var part18 = match("MESSAGE#15:mail_helo", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ dup17, dup9, ])); var msg16 = msg("mail_helo", part18); -var part19 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' value='), Field(ddomain,true), Constant(' routes='), Field(fld4,false)}" -match("MESSAGE#16:mail_helo:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ +var part19 = match("MESSAGE#16:mail_helo:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} value=%{ddomain->} routes=%{fld4}", processor_chain([ dup17, dup9, ])); @@ -1146,33 +1060,27 @@ var select6 = linear_select([ msg17, ]); -var part20 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#17:mail_continue-system-sendmail", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} err=%{fld58}", processor_chain([ +var part20 = match("MESSAGE#17:mail_continue-system-sendmail", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} err=%{fld58}", processor_chain([ dup17, dup9, ])); var msg18 = msg("mail_continue-system-sendmail", part20); -var part21 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#18:mail_release", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=%{result->} err=%{fld58}", processor_chain([ +var part21 = match("MESSAGE#18:mail_release", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=%{result->} err=%{fld58}", processor_chain([ dup17, dup9, ])); var msg19 = msg("mail_release", part21); -var part22 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#19:session_data/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} %{p0}"); +var part22 = match("MESSAGE#19:session_data/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} %{p0}"); -var part23 = // "Pattern{Constant('rcpt_notroutes='), Field(fld20,true), Constant(' data_routes='), Field(fld21,false)}" -match("MESSAGE#19:session_data/1_0", "nwparser.p0", "rcpt_notroutes=%{fld20->} data_routes=%{fld21}"); +var part23 = match("MESSAGE#19:session_data/1_0", "nwparser.p0", "rcpt_notroutes=%{fld20->} data_routes=%{fld21}"); -var part24 = // "Pattern{Constant('rcpt='), Field(to,true), Constant(' suborg='), Field(fld22,false)}" -match("MESSAGE#19:session_data/1_1", "nwparser.p0", "rcpt=%{to->} suborg=%{fld22}"); +var part24 = match("MESSAGE#19:session_data/1_1", "nwparser.p0", "rcpt=%{to->} suborg=%{fld22}"); -var part25 = // "Pattern{Constant('from='), Field(from,true), Constant(' suborg='), Field(fld22,false)}" -match("MESSAGE#19:session_data/1_2", "nwparser.p0", "from=%{from->} suborg=%{fld22}"); +var part25 = match("MESSAGE#19:session_data/1_2", "nwparser.p0", "from=%{from->} suborg=%{fld22}"); var select7 = linear_select([ part23, @@ -1193,8 +1101,7 @@ var all5 = all_match({ var msg20 = msg("session_data", all5); -var part26 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rcpt_notroutes='), Field(fld20,true), Constant(' data_routes='), Field(fld21,false)}" -match("MESSAGE#20:session_data:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rcpt_notroutes=%{fld20->} data_routes=%{fld21}", processor_chain([ +var part26 = match("MESSAGE#20:session_data:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rcpt_notroutes=%{fld20->} data_routes=%{fld21}", processor_chain([ dup17, dup9, ])); @@ -1206,16 +1113,14 @@ var select8 = linear_select([ msg21, ]); -var part27 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' folder='), Field(fld22,true), Constant(' pri='), Field(fld23,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#21:session_store", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ +var part27 = match("MESSAGE#21:session_store", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg22 = msg("session_store", part27); -var part28 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' folder='), Field(fld22,true), Constant(' pri='), Field(fld23,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#22:session_store:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ +var part28 = match("MESSAGE#22:session_store:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} folder=%{fld22->} pri=%{fld23->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); @@ -1227,16 +1132,14 @@ var select9 = linear_select([ msg23, ]); -var part29 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" -match("MESSAGE#23:session_headers", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ +var part29 = match("MESSAGE#23:session_headers", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ dup17, dup9, ])); var msg24 = msg("session_headers", part29); -var part30 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" -match("MESSAGE#24:session_headers:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ +var part30 = match("MESSAGE#24:session_headers:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ dup17, dup9, ])); @@ -1248,8 +1151,7 @@ var select10 = linear_select([ msg25, ]); -var part31 = // "Pattern{Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,false)}" -match("MESSAGE#25:session_judge/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}"); +var part31 = match("MESSAGE#25:session_judge/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}"); var all6 = all_match({ processors: [ @@ -1266,8 +1168,7 @@ var all6 = all_match({ var msg26 = msg("session_judge", all6); -var part32 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,false)}" -match("MESSAGE#26:session_judge:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}", processor_chain([ +var part32 = match("MESSAGE#26:session_judge:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename}", processor_chain([ dup17, dup9, ])); @@ -1279,16 +1180,14 @@ var select11 = linear_select([ msg27, ]); -var part33 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ip='), Field(hostip,true), Constant(' country='), Field(location_country,true), Constant(' lip='), Field(fld24,true), Constant(' prot='), Field(fld25,true), Constant(' hops_active='), Field(fld26,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' perlwait='), Field(fld27,false)}" -match("MESSAGE#27:session_connect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ +var part33 = match("MESSAGE#27:session_connect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ dup17, dup9, ])); var msg28 = msg("session_connect", part33); -var part34 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ip='), Field(hostip,true), Constant(' country='), Field(location_country,true), Constant(' lip='), Field(fld24,true), Constant(' prot='), Field(fld25,true), Constant(' hops_active='), Field(fld26,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,true), Constant(' perlwait='), Field(fld27,false)}" -match("MESSAGE#28:session_connect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ +var part34 = match("MESSAGE#28:session_connect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} ip=%{hostip->} country=%{location_country->} lip=%{fld24->} prot=%{fld25->} hops_active=%{fld26->} routes=%{fld4->} notroutes=%{fld18->} perlwait=%{fld27}", processor_chain([ dup17, dup9, ])); @@ -1300,16 +1199,14 @@ var select12 = linear_select([ msg29, ]); -var part35 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' host='), Field(hostname,true), Constant(' resolve='), Field(fld28,true), Constant(' reverse='), Field(fld13,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" -match("MESSAGE#29:session_resolve", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ +var part35 = match("MESSAGE#29:session_resolve", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ dup17, dup9, ])); var msg30 = msg("session_resolve", part35); -var part36 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' host='), Field(hostname,true), Constant(' resolve='), Field(fld28,true), Constant(' reverse='), Field(fld13,true), Constant(' routes='), Field(fld4,true), Constant(' notroutes='), Field(fld18,false)}" -match("MESSAGE#30:session_resolve:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ +var part36 = match("MESSAGE#30:session_resolve:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} host=%{hostname->} resolve=%{fld28->} reverse=%{fld13->} routes=%{fld4->} notroutes=%{fld18}", processor_chain([ dup17, dup9, ])); @@ -1321,16 +1218,14 @@ var select13 = linear_select([ msg31, ]); -var part37 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' ip='), Field(hostip,true), Constant(' rate='), Field(fld29,true), Constant(' crate='), Field(fld30,true), Constant(' limit='), Field(fld31,false)}" -match("MESSAGE#31:session_throttle", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ +var part37 = match("MESSAGE#31:session_throttle", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ dup17, dup9, ])); var msg32 = msg("session_throttle", part37); -var part38 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' ip='), Field(hostip,true), Constant(' rate='), Field(fld29,true), Constant(' crate='), Field(fld30,true), Constant(' limit='), Field(fld31,false)}" -match("MESSAGE#32:session_throttle:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ +var part38 = match("MESSAGE#32:session_throttle:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} ip=%{hostip->} rate=%{fld29->} crate=%{fld30->} limit=%{fld31}", processor_chain([ dup17, dup9, ])); @@ -1342,24 +1237,21 @@ var select14 = linear_select([ msg33, ]); -var part39 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' rate='), Field(fld58,false)}" -match("MESSAGE#33:session_dispose", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ +var part39 = match("MESSAGE#33:session_dispose", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ dup22, dup9, ])); var msg34 = msg("session_dispose", part39); -var part40 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' rate='), Field(fld58,false)}" -match("MESSAGE#34:session_dispose:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ +var part40 = match("MESSAGE#34:session_dispose:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} rate=%{fld58}", processor_chain([ dup22, dup9, ])); var msg35 = msg("session_dispose:01", part40); -var part41 = // "Pattern{Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,false)}" -match("MESSAGE#35:session_dispose:02/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}"); +var part41 = match("MESSAGE#35:session_dispose:02/2", "nwparser.p0", "%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}"); var all7 = all_match({ processors: [ @@ -1376,8 +1268,7 @@ var all7 = all_match({ var msg36 = msg("session_dispose:02", all7); -var part42 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,false)}" -match("MESSAGE#36:session_dispose:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}", processor_chain([ +var part42 = match("MESSAGE#36:session_dispose:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action}", processor_chain([ dup22, dup9, ])); @@ -1391,8 +1282,7 @@ var select15 = linear_select([ msg37, ]); -var part43 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#37:session_disconnect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part43 = match("MESSAGE#37:session_disconnect", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup17, dup9, dup13, @@ -1400,8 +1290,7 @@ match("MESSAGE#37:session_disconnect", "nwparser.payload", "%{fld0->} %{severity var msg38 = msg("session_disconnect", part43); -var part44 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#38:session_disconnect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part44 = match("MESSAGE#38:session_disconnect:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup17, dup9, dup13, @@ -1414,14 +1303,11 @@ var select16 = linear_select([ msg39, ]); -var part45 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#39:av_run:02/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{fld1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} %{p0}"); +var part45 = match("MESSAGE#39:av_run:02/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{fld1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} %{p0}"); -var part46 = // "Pattern{Constant('cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" -match("MESSAGE#39:av_run:02/1_0", "nwparser.p0", "cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); +var part46 = match("MESSAGE#39:av_run:02/1_0", "nwparser.p0", "cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); -var part47 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" -match("MESSAGE#39:av_run:02/1_2", "nwparser.p0", "vendor=%{fld36->} duration=%{p0}"); +var part47 = match("MESSAGE#39:av_run:02/1_2", "nwparser.p0", "vendor=%{fld36->} duration=%{p0}"); var select17 = linear_select([ part46, @@ -1444,22 +1330,18 @@ var all8 = all_match({ var msg40 = msg("av_run:02", all8); -var part48 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#40:av_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ +var part48 = match("MESSAGE#40:av_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ dup25, dup9, ])); var msg41 = msg("av_run:03", part48); -var part49 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#41:av_run/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} %{p0}"); +var part49 = match("MESSAGE#41:av_run/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} %{p0}"); -var part50 = // "Pattern{Constant('name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" -match("MESSAGE#41:av_run/1_1", "nwparser.p0", "name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); +var part50 = match("MESSAGE#41:av_run/1_1", "nwparser.p0", "name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{p0}"); -var part51 = // "Pattern{Constant('name='), Field(fld34,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(p0,false)}" -match("MESSAGE#41:av_run/1_2", "nwparser.p0", "name=%{fld34->} vendor=%{fld36->} duration=%{p0}"); +var part51 = match("MESSAGE#41:av_run/1_2", "nwparser.p0", "name=%{fld34->} vendor=%{fld36->} duration=%{p0}"); var select18 = linear_select([ dup23, @@ -1481,8 +1363,7 @@ var all9 = all_match({ var msg42 = msg("av_run", all9); -var part52 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' name='), Field(fld34,true), Constant(' cleaned='), Field(fld35,true), Constant(' vendor='), Field(fld36,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#42:av_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ +var part52 = match("MESSAGE#42:av_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} name=%{fld34->} cleaned=%{fld35->} vendor=%{fld36->} duration=%{duration_string}", processor_chain([ dup25, dup9, ])); @@ -1500,24 +1381,21 @@ var msg44 = msg("av_refresh", dup48); var msg45 = msg("av_init", dup48); -var part53 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" -match("MESSAGE#45:av_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ +var part53 = match("MESSAGE#45:av_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ dup26, dup9, ])); var msg46 = msg("av_load", part53); -var part54 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#46:access_run:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var part54 = match("MESSAGE#46:access_run:02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg47 = msg("access_run:02", part54); -var part55 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' attachment='), Field(fld58,true), Constant(' file='), Field(filename,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#47:access_run:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var part55 = match("MESSAGE#47:access_run:04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} attachment=%{fld58->} file=%{filename->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); @@ -1535,8 +1413,7 @@ var select20 = linear_select([ msg50, ]); -var part56 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" -match("MESSAGE#50:access_refresh", "nwparser.payload", "%{fld0->} %{severity->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ +var part56 = match("MESSAGE#50:access_refresh", "nwparser.payload", "%{fld0->} %{severity->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ dup17, dup9, ])); @@ -1556,36 +1433,29 @@ var msg54 = msg("regulation_init", dup51); var msg55 = msg("regulation_refresh", dup51); -var part57 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} %{p0}"); +var part57 = match("MESSAGE#55:spam_run:rule/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} %{p0}"); -var part58 = // "Pattern{Constant('ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/1_0", "nwparser.p0", "ipscore=%{fld40->} suspectscore=%{p0}"); +var part58 = match("MESSAGE#55:spam_run:rule/1_0", "nwparser.p0", "ipscore=%{fld40->} suspectscore=%{p0}"); -var part59 = // "Pattern{Constant('suspectscore='), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/1_1", "nwparser.p0", "suspectscore=%{p0}"); +var part59 = match("MESSAGE#55:spam_run:rule/1_1", "nwparser.p0", "suspectscore=%{p0}"); var select22 = linear_select([ part58, part59, ]); -var part60 = // "Pattern{Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/2", "nwparser.p0", "%{fld41->} phishscore=%{fld42->} %{p0}"); +var part60 = match("MESSAGE#55:spam_run:rule/2", "nwparser.p0", "%{fld41->} phishscore=%{fld42->} %{p0}"); -var part61 = // "Pattern{Constant('bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/3_0", "nwparser.p0", "bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{p0}"); +var part61 = match("MESSAGE#55:spam_run:rule/3_0", "nwparser.p0", "bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{p0}"); -var part62 = // "Pattern{Constant('adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' classifier='), Field(p0,false)}" -match("MESSAGE#55:spam_run:rule/3_1", "nwparser.p0", "adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{p0}"); +var part62 = match("MESSAGE#55:spam_run:rule/3_1", "nwparser.p0", "adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{p0}"); var select23 = linear_select([ part61, part62, ]); -var part63 = // "Pattern{Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#55:spam_run:rule/4", "nwparser.p0", "%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}"); +var part63 = match("MESSAGE#55:spam_run:rule/4", "nwparser.p0", "%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}"); var all10 = all_match({ processors: [ @@ -1603,64 +1473,56 @@ var all10 = all_match({ var msg56 = msg("spam_run:rule", all10); -var part64 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#56:spam_run:rule_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ +var part64 = match("MESSAGE#56:spam_run:rule_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ dup27, dup9, ])); var msg57 = msg("spam_run:rule_02", part64); -var part65 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' ndrscore='), Field(fld57,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' adjustscore='), Field(fld58,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#57:spam_run:rule_03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld57->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld58->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ +var part65 = match("MESSAGE#57:spam_run:rule_03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld57->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld58->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ dup27, dup9, ])); var msg58 = msg("spam_run:rule_03", part65); -var part66 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' kscore.is_bulkscore='), Field(fld57,true), Constant(' kscore.compositescore='), Field(fld40,true), Constant(' circleOfTrustscore='), Field(fld41,true), Constant(' compositescore='), Field(fld42,true), Constant(' urlsuspect_oldscore='), Field(fld43,true), Constant(' suspectscore='), Field(reputation_num,true), Constant(' recipient_domain_to_sender_totalscore='), Field(fld58,true), Constant(' phishscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld45,true), Constant(' kscore.is_spamscore='), Field(fld46,true), Constant(' recipient_to_sender_totalscore='), Field(fld47,true), Constant(' recipient_domain_to_sender_domain_totalscore='), Field(fld48,true), Constant(' rbsscore='), Field(fld49,true), Constant(' spamscore='), Field(fld50,true), Constant(' recipient_to_sender_domain_totalscore='), Field(fld51,true), Constant(' urlsuspectscore='), Field(fld52,true), Constant(' '), Field(fld53,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#58:spam_run:rule_04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} kscore.is_bulkscore=%{fld57->} kscore.compositescore=%{fld40->} circleOfTrustscore=%{fld41->} compositescore=%{fld42->} urlsuspect_oldscore=%{fld43->} suspectscore=%{reputation_num->} recipient_domain_to_sender_totalscore=%{fld58->} phishscore=%{fld44->} bulkscore=%{fld45->} kscore.is_spamscore=%{fld46->} recipient_to_sender_totalscore=%{fld47->} recipient_domain_to_sender_domain_totalscore=%{fld48->} rbsscore=%{fld49->} spamscore=%{fld50->} recipient_to_sender_domain_totalscore=%{fld51->} urlsuspectscore=%{fld52->} %{fld53->} duration=%{duration_string}", processor_chain([ +var part66 = match("MESSAGE#58:spam_run:rule_04", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} kscore.is_bulkscore=%{fld57->} kscore.compositescore=%{fld40->} circleOfTrustscore=%{fld41->} compositescore=%{fld42->} urlsuspect_oldscore=%{fld43->} suspectscore=%{reputation_num->} recipient_domain_to_sender_totalscore=%{fld58->} phishscore=%{fld44->} bulkscore=%{fld45->} kscore.is_spamscore=%{fld46->} recipient_to_sender_totalscore=%{fld47->} recipient_domain_to_sender_domain_totalscore=%{fld48->} rbsscore=%{fld49->} spamscore=%{fld50->} recipient_to_sender_domain_totalscore=%{fld51->} urlsuspectscore=%{fld52->} %{fld53->} duration=%{duration_string}", processor_chain([ dup27, dup9, ])); var msg59 = msg("spam_run:rule_04", part66); -var part67 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' ndrscore='), Field(fld53,true), Constant(' suspectscore='), Field(fld40,true), Constant(' malwarescore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' adjustscore='), Field(fld54,true), Constant(' adultscore='), Field(fld44,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' raw='), Field(fld51,true), Constant(' tests='), Field(fld52,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#59:spam_run:rule_05", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld53->} suspectscore=%{fld40->} malwarescore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld54->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ +var part67 = match("MESSAGE#59:spam_run:rule_05", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} policy=%{fld38->} score=%{fld39->} ndrscore=%{fld53->} suspectscore=%{fld40->} malwarescore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} spamscore=%{reputation_num->} adjustscore=%{fld54->} adultscore=%{fld44->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50->} raw=%{fld51->} tests=%{fld52->} duration=%{duration_string}", processor_chain([ dup27, dup9, ])); var msg60 = msg("spam_run:rule_05", part67); -var part68 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' mod='), Field(agent,true), Constant(' total_uri_count='), Field(dclass_counter1,true), Constant(' uris_excluded_from_report_info='), Field(dclass_counter2,false)}" -match("MESSAGE#60:spam_run:rule_06", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} mod=%{agent->} total_uri_count=%{dclass_counter1->} uris_excluded_from_report_info=%{dclass_counter2}", processor_chain([ +var part68 = match("MESSAGE#60:spam_run:rule_06", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} mod=%{agent->} total_uri_count=%{dclass_counter1->} uris_excluded_from_report_info=%{dclass_counter2}", processor_chain([ dup27, dup9, ])); var msg61 = msg("spam_run:rule_06", part68); -var part69 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' tests='), Field(fld52,false)}" -match("MESSAGE#61:spam_run:action_01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ +var part69 = match("MESSAGE#61:spam_run:action_01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ dup27, dup9, ])); var msg62 = msg("spam_run:action_01", part69); -var part70 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' ipscore='), Field(fld40,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' bulkscore='), Field(fld43,true), Constant(' adultscore='), Field(fld44,true), Constant(' tests='), Field(fld52,false)}" -match("MESSAGE#62:spam_run:action", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ +var part70 = match("MESSAGE#62:spam_run:action", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} ipscore=%{fld40->} suspectscore=%{fld41->} phishscore=%{fld42->} bulkscore=%{fld43->} adultscore=%{fld44->} tests=%{fld52}", processor_chain([ dup27, dup9, ])); var msg63 = msg("spam_run:action", part70); -var part71 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' action='), Field(action,true), Constant(' num_domains='), Field(fld53,true), Constant(' num_domains_to_lookup='), Field(fld40,false)}" -match("MESSAGE#63:spam_run:action_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} num_domains=%{fld53->} num_domains_to_lookup=%{fld40}", processor_chain([ +var part71 = match("MESSAGE#63:spam_run:action_02", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} action=%{action->} num_domains=%{fld53->} num_domains_to_lookup=%{fld40}", processor_chain([ dup27, dup9, ])); @@ -1683,24 +1545,21 @@ var msg65 = msg("spam_refresh", dup53); var msg66 = msg("spam_init", dup53); -var part72 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" -match("MESSAGE#66:spam_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ +var part72 = match("MESSAGE#66:spam_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ dup27, dup9, ])); var msg67 = msg("spam_load", part72); -var part73 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' policy='), Field(fld38,true), Constant(' address='), Field(fld54,false)}" -match("MESSAGE#67:batv_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ +var part73 = match("MESSAGE#67:batv_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ dup17, dup9, ])); var msg68 = msg("batv_run", part73); -var part74 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' policy='), Field(fld38,true), Constant(' address='), Field(fld54,false)}" -match("MESSAGE#68:batv_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ +var part74 = match("MESSAGE#68:batv_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} policy=%{fld38->} address=%{fld54}", processor_chain([ dup17, dup9, ])); @@ -1724,16 +1583,14 @@ var msg73 = msg("zerohour_init", dup54); var msg74 = msg("zerohour_load", dup52); -var part75 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' count='), Field(fld2,true), Constant(' name='), Field(fld34,true), Constant(' init_time='), Field(fld3,true), Constant(' init_virusthreat='), Field(fld4,true), Constant(' virusthreat='), Field(fld5,true), Constant(' virusthreatid='), Field(fld6,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#74:zerohour_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ +var part75 = match("MESSAGE#74:zerohour_run", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg75 = msg("zerohour_run", part75); -var part76 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' count='), Field(fld2,true), Constant(' name='), Field(fld34,true), Constant(' init_time='), Field(fld3,true), Constant(' init_virusthreat='), Field(fld4,true), Constant(' virusthreat='), Field(fld5,true), Constant(' virusthreatid='), Field(fld6,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#75:zerohour_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ +var part76 = match("MESSAGE#75:zerohour_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} count=%{fld2->} name=%{fld34->} init_time=%{fld3->} init_virusthreat=%{fld4->} virusthreat=%{fld5->} virusthreatid=%{fld6->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); @@ -1745,40 +1602,35 @@ var select26 = linear_select([ msg76, ]); -var part77 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#76:service_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} duration=%{duration_string}", processor_chain([ +var part77 = match("MESSAGE#76:service_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg77 = msg("service_refresh", part77); -var part78 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#77:perl_clone", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} duration=%{duration_string}", processor_chain([ +var part78 = match("MESSAGE#77:perl_clone", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} id=%{fld5->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg78 = msg("perl_clone", part78); -var part79 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#78:cvt_convert", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ +var part79 = match("MESSAGE#78:cvt_convert", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ dup17, dup9, ])); var msg79 = msg("cvt_convert", part79); -var part80 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#79:cvt_convert:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ +var part80 = match("MESSAGE#79:cvt_convert:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ dup17, dup9, ])); var msg80 = msg("cvt_convert:01", part80); -var part81 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cset='), Field(fld56,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#80:cvt_convert:02", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ +var part81 = match("MESSAGE#80:cvt_convert:02", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} cset=%{fld56->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ dup17, dup9, ])); @@ -1791,8 +1643,7 @@ var select27 = linear_select([ msg81, ]); -var part82 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' name='), Field(fld34,true), Constant(' status='), Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#81:cvt_detect", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ +var part82 = match("MESSAGE#81:cvt_detect", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} mod=%{agent->} cmd=%{obj_type->} name=%{fld34->} status=%{result->} err=%{fld58}", processor_chain([ dup17, dup9, ])); @@ -1808,8 +1659,7 @@ var select28 = linear_select([ msg84, ]); -var part83 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(fld5,true), Constant(' mod='), Field(agent,true), Constant(' encrypted='), Field(fld6,false)}" -match("MESSAGE#84:cvtd_encrypted", "nwparser.payload", "%{fld0->} %{severity->} pid=%{fld5->} mod=%{agent->} encrypted=%{fld6}", processor_chain([ +var part83 = match("MESSAGE#84:cvtd_encrypted", "nwparser.payload", "%{fld0->} %{severity->} pid=%{fld5->} mod=%{agent->} encrypted=%{fld6}", processor_chain([ dup17, dup9, ])); @@ -1829,8 +1679,7 @@ var msg88 = msg("soap_listen", dup57); var msg89 = msg("http_listen", dup57); -var part84 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(event_description,false)}" -match("MESSAGE#89:mltr", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{event_description}", processor_chain([ +var part84 = match("MESSAGE#89:mltr", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{event_description}", processor_chain([ dup17, dup9, ])); @@ -1843,22 +1692,18 @@ var msg92 = msg("smtpsrv_load", dup52); var msg93 = msg("smtpsrv_listen", dup57); -var part85 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#93:smtpsrv_run", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var part85 = match("MESSAGE#93:smtpsrv_run", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg94 = msg("smtpsrv_run", part85); -var part86 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#94:smtpsrv/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{p0}"); +var part86 = match("MESSAGE#94:smtpsrv/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} %{p0}"); -var part87 = // "Pattern{Field(result,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#94:smtpsrv/1_0", "nwparser.p0", "%{result->} err=%{fld58}"); +var part87 = match("MESSAGE#94:smtpsrv/1_0", "nwparser.p0", "%{result->} err=%{fld58}"); -var part88 = // "Pattern{Field(result,false)}" -match_copy("MESSAGE#94:smtpsrv/1_1", "nwparser.p0", "result"); +var part88 = match_copy("MESSAGE#94:smtpsrv/1_1", "nwparser.p0", "result"); var select30 = linear_select([ part87, @@ -1878,24 +1723,21 @@ var all11 = all_match({ var msg95 = msg("smtpsrv", all11); -var part89 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' cmd='), Field(obj_type,true), Constant(' profile='), Field(fld52,true), Constant(' qid='), Field(fld15,true), Constant(' rcpts='), Field(to,false)}" -match("MESSAGE#95:send", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ +var part89 = match("MESSAGE#95:send", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ dup17, dup9, ])); var msg96 = msg("send", part89); -var part90 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' cmd='), Field(obj_type,true), Constant(' profile='), Field(fld52,true), Constant(' qid='), Field(fld15,true), Constant(' rcpts='), Field(to,false)}" -match("MESSAGE#96:send:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ +var part90 = match("MESSAGE#96:send:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} cmd=%{obj_type->} profile=%{fld52->} qid=%{fld15->} rcpts=%{to}", processor_chain([ dup17, dup9, ])); var msg97 = msg("send:01", part90); -var part91 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' cmd='), Field(obj_type,true), Constant(' rcpt='), Field(to,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#97:send:02", "nwparser.payload", "%{fld0}: %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} rcpt=%{to->} err=%{fld58}", processor_chain([ +var part91 = match("MESSAGE#97:send:02", "nwparser.payload", "%{fld0}: %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} cmd=%{obj_type->} rcpt=%{to->} err=%{fld58}", processor_chain([ dup17, dup9, ])); @@ -1908,22 +1750,18 @@ var select31 = linear_select([ msg98, ]); -var part92 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(p0,false)}" -match("MESSAGE#98:queued-alert/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{p0}"); +var part92 = match("MESSAGE#98:queued-alert/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{p0}"); -var part93 = // "Pattern{Field(fld55,true), Constant(' tls_verify='), Field(fld70,false), Constant(', pri='), Field(p0,false)}" -match("MESSAGE#98:queued-alert/1_0", "nwparser.p0", "%{fld55->} tls_verify=%{fld70}, pri=%{p0}"); +var part93 = match("MESSAGE#98:queued-alert/1_0", "nwparser.p0", "%{fld55->} tls_verify=%{fld70}, pri=%{p0}"); -var part94 = // "Pattern{Field(fld55,false), Constant(', pri='), Field(p0,false)}" -match("MESSAGE#98:queued-alert/1_1", "nwparser.p0", "%{fld55}, pri=%{p0}"); +var part94 = match("MESSAGE#98:queued-alert/1_1", "nwparser.p0", "%{fld55}, pri=%{p0}"); var select32 = linear_select([ part93, part94, ]); -var part95 = // "Pattern{Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#98:queued-alert/2", "nwparser.p0", "%{fld23}, relay=%{p0}"); +var part95 = match("MESSAGE#98:queued-alert/2", "nwparser.p0", "%{fld23}, relay=%{p0}"); var all12 = all_match({ processors: [ @@ -1941,11 +1779,9 @@ var all12 = all_match({ var msg99 = msg("queued-alert", all12); -var part96 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#99:queued-alert:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); +var part96 = match("MESSAGE#99:queued-alert:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); -var part97 = // "Pattern{Constant('['), Field(fld50,false), Constant('] ['), Field(daddr,false), Constant(']')}" -match("MESSAGE#99:queued-alert:01/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}]"); +var part97 = match("MESSAGE#99:queued-alert:01/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}]"); var select33 = linear_select([ part97, @@ -1968,8 +1804,7 @@ var all13 = all_match({ var msg100 = msg("queued-alert:01", all13); -var part98 = // "Pattern{Constant('['), Field(fld50,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#100:queued-alert:02/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}],%{p0}"); +var part98 = match("MESSAGE#100:queued-alert:02/1_0", "nwparser.p0", "[%{fld50}] [%{daddr}],%{p0}"); var select34 = linear_select([ part98, @@ -1978,8 +1813,7 @@ var select34 = linear_select([ dup31, ]); -var part99 = // "Pattern{Field(,false), Constant('version='), Field(version,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(s_cipher,false), Constant(', bits='), Field(fld59,false)}" -match("MESSAGE#100:queued-alert:02/2", "nwparser.p0", "%{}version=%{version}, verify=%{fld57}, cipher=%{s_cipher}, bits=%{fld59}"); +var part99 = match("MESSAGE#100:queued-alert:02/2", "nwparser.p0", "%{}version=%{version}, verify=%{fld57}, cipher=%{s_cipher}, bits=%{fld59}"); var all14 = all_match({ processors: [ @@ -2037,8 +1871,7 @@ var msg111 = msg("queued-reinject:02", dup65); var msg112 = msg("queued-reinject:03", dup66); -var part100 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': maxrcpts='), Field(fld56,false), Constant(', rcpts='), Field(fld57,false), Constant(', count='), Field(fld58,false), Constant(', ids='), Field(fld59,false)}" -match("MESSAGE#111:queued-reinject:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: maxrcpts=%{fld56}, rcpts=%{fld57}, count=%{fld58}, ids=%{fld59}", processor_chain([ +var part100 = match("MESSAGE#111:queued-reinject:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: maxrcpts=%{fld56}, rcpts=%{fld57}, count=%{fld58}, ids=%{fld59}", processor_chain([ dup17, dup9, ])); @@ -2059,8 +1892,7 @@ var select38 = linear_select([ msg115, ]); -var part101 = // "Pattern{Field(,false), Constant('version='), Field(version,false), Constant(', verify='), Field(disposition,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" -match("MESSAGE#114:queued-eurort/2", "nwparser.p0", "%{}version=%{version}, verify=%{disposition}, cipher=%{fld58}, bits=%{fld59}"); +var part101 = match("MESSAGE#114:queued-eurort/2", "nwparser.p0", "%{}version=%{version}, verify=%{disposition}, cipher=%{fld58}, bits=%{fld59}"); var all15 = all_match({ processors: [ @@ -2100,16 +1932,14 @@ var select40 = linear_select([ var msg122 = msg("sm-msp-queue", dup66); -var part102 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: starting daemon ('), Field(fld7,false), Constant('): '), Field(fld6,false)}" -match("MESSAGE#122:sm-msp-queue:01", "nwparser.payload", "%{agent}[%{process_id}]: starting daemon (%{fld7}): %{fld6}", processor_chain([ +var part102 = match("MESSAGE#122:sm-msp-queue:01", "nwparser.payload", "%{agent}[%{process_id}]: starting daemon (%{fld7}): %{fld6}", processor_chain([ setc("eventcategory","1605000000"), dup9, ])); var msg123 = msg("sm-msp-queue:01", part102); -var part103 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', ctladdr='), Field(fld13,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#123:sm-msp-queue:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, ctladdr=%{fld13}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); +var part103 = match("MESSAGE#123:sm-msp-queue:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, ctladdr=%{fld13}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); var all16 = all_match({ processors: [ @@ -2131,14 +1961,11 @@ var select41 = linear_select([ msg124, ]); -var part104 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', tls_verify='), Field(fld24,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#124:sendmail:15/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, tls_verify=%{fld24}, pri=%{fld23}, relay=%{p0}"); +var part104 = match("MESSAGE#124:sendmail:15/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, tls_verify=%{fld24}, pri=%{fld23}, relay=%{p0}"); -var part105 = // "Pattern{Field(dhost,false), Constant('. ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#124:sendmail:15/1_1", "nwparser.p0", "%{dhost}. [%{daddr}],%{p0}"); +var part105 = match("MESSAGE#124:sendmail:15/1_1", "nwparser.p0", "%{dhost}. [%{daddr}],%{p0}"); -var part106 = // "Pattern{Field(dhost,false), Constant('.,'), Field(p0,false)}" -match("MESSAGE#124:sendmail:15/1_2", "nwparser.p0", "%{dhost}.,%{p0}"); +var part106 = match("MESSAGE#124:sendmail:15/1_2", "nwparser.p0", "%{dhost}.,%{p0}"); var select42 = linear_select([ dup28, @@ -2160,14 +1987,11 @@ var all17 = all_match({ var msg125 = msg("sendmail:15", all17); -var part107 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld54,false), Constant(', nrcpts='), Field(fld55,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(p0,false)}" -match("MESSAGE#125:sendmail:14/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld54}, nrcpts=%{fld55}, msgid=%{id}, proto=%{protocol}, daemon=%{p0}"); +var part107 = match("MESSAGE#125:sendmail:14/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld54}, nrcpts=%{fld55}, msgid=%{id}, proto=%{protocol}, daemon=%{p0}"); -var part108 = // "Pattern{Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#125:sendmail:14/1_0", "nwparser.p0", "%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); +var part108 = match("MESSAGE#125:sendmail:14/1_0", "nwparser.p0", "%{fld69}, tls_verify=%{fld70}, auth=%{authmethod}, relay=%{p0}"); -var part109 = // "Pattern{Field(fld69,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#125:sendmail:14/1_1", "nwparser.p0", "%{fld69}, relay=%{p0}"); +var part109 = match("MESSAGE#125:sendmail:14/1_1", "nwparser.p0", "%{fld69}, relay=%{p0}"); var select43 = linear_select([ part108, @@ -2190,62 +2014,53 @@ var msg126 = msg("sendmail:14", all18); var msg127 = msg("sendmail", dup68); -var part110 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': available mech='), Field(fld2,false), Constant(', allowed mech='), Field(fld3,false)}" -match("MESSAGE#127:sendmail:01", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: available mech=%{fld2}, allowed mech=%{fld3}", processor_chain([ +var part110 = match("MESSAGE#127:sendmail:01", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: available mech=%{fld2}, allowed mech=%{fld3}", processor_chain([ dup17, dup9, ])); var msg128 = msg("sendmail:01", part110); -var part111 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': milter='), Field(fld2,false), Constant(', action='), Field(action,false), Constant(', reject='), Field(fld3,false)}" -match("MESSAGE#128:sendmail:02", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: milter=%{fld2}, action=%{action}, reject=%{fld3}", processor_chain([ +var part111 = match("MESSAGE#128:sendmail:02", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: milter=%{fld2}, action=%{action}, reject=%{fld3}", processor_chain([ dup17, dup9, ])); var msg129 = msg("sendmail:02", part111); -var part112 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': '), Field(fld57,false), Constant(': host='), Field(hostname,false), Constant(', addr='), Field(saddr,false), Constant(', reject='), Field(fld3,false)}" -match("MESSAGE#129:sendmail:03", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}: host=%{hostname}, addr=%{saddr}, reject=%{fld3}", processor_chain([ +var part112 = match("MESSAGE#129:sendmail:03", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}: host=%{hostname}, addr=%{saddr}, reject=%{fld3}", processor_chain([ dup17, dup9, ])); var msg130 = msg("sendmail:03", part112); -var part113 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': '), Field(fld2,false), Constant(': '), Field(fld3,false), Constant(': vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" -match("MESSAGE#130:sendmail:08", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ +var part113 = match("MESSAGE#130:sendmail:08", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ dup17, dup9, ])); var msg131 = msg("sendmail:08", part113); -var part114 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': '), Field(fld2,false), Constant(': '), Field(fld3,false), Constant(': rule='), Field(rulename,true), Constant(' policy='), Field(fld38,true), Constant(' score='), Field(fld39,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' suspectscore='), Field(fld41,true), Constant(' phishscore='), Field(fld42,true), Constant(' adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' classifier='), Field(fld45,true), Constant(' adjust='), Field(fld46,true), Constant(' reason='), Field(fld47,true), Constant(' scancount='), Field(fld48,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" -match("MESSAGE#131:sendmail:09", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} suspectscore=%{fld41->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ +var part114 = match("MESSAGE#131:sendmail:09", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: %{fld2}: %{fld3}: rule=%{rulename->} policy=%{fld38->} score=%{fld39->} spamscore=%{reputation_num->} suspectscore=%{fld41->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} classifier=%{fld45->} adjust=%{fld46->} reason=%{fld47->} scancount=%{fld48->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ dup17, dup9, ])); var msg132 = msg("sendmail:09", part114); -var part115 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': Milter '), Field(action,false), Constant(': rcpt'), Field(p0,false)}" -match("MESSAGE#132:sendmail:10/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: rcpt%{p0}"); +var part115 = match("MESSAGE#132:sendmail:10/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: Milter %{action}: rcpt%{p0}"); -var part116 = // "Pattern{Constant(': '), Field(p0,false)}" -match("MESSAGE#132:sendmail:10/1_0", "nwparser.p0", ": %{p0}"); +var part116 = match("MESSAGE#132:sendmail:10/1_0", "nwparser.p0", ": %{p0}"); -var part117 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#132:sendmail:10/1_1", "nwparser.p0", "p0"); +var part117 = match_copy("MESSAGE#132:sendmail:10/1_1", "nwparser.p0", "p0"); var select44 = linear_select([ part116, part117, ]); -var part118 = // "Pattern{Field(,true), Constant(' '), Field(fld2,false)}" -match("MESSAGE#132:sendmail:10/2", "nwparser.p0", "%{} %{fld2}"); +var part118 = match("MESSAGE#132:sendmail:10/2", "nwparser.p0", "%{} %{fld2}"); var all19 = all_match({ processors: [ @@ -2261,8 +2076,7 @@ var all19 = all_match({ var msg133 = msg("sendmail:10", all19); -var part119 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#133:sendmail:11/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); +var part119 = match("MESSAGE#133:sendmail:11/0", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); var all20 = all_match({ processors: [ @@ -2278,27 +2092,23 @@ var all20 = all_match({ var msg134 = msg("sendmail:11", all20); -var part120 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': SYSERR('), Field(fld2,false), Constant('): '), Field(action,false), Constant(': '), Field(event_description,true), Constant(' from '), Field(from,false), Constant(', from='), Field(fld3,false)}" -match("MESSAGE#134:sendmail:12", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} from %{from}, from=%{fld3}", processor_chain([ +var part120 = match("MESSAGE#134:sendmail:12", "nwparser.payload", "%{fld10->} %{agent}[%{process_id}]: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} from %{from}, from=%{fld3}", processor_chain([ dup17, dup9, ])); var msg135 = msg("sendmail:12", part120); -var part121 = // "Pattern{Field(fld10,true), Constant(' '), Field(agent,false), Constant(']'), Field(p0,false)}" -match("MESSAGE#135:sendmail:13/0_0", "nwparser.payload", "%{fld10->} %{agent}]%{p0}"); +var part121 = match("MESSAGE#135:sendmail:13/0_0", "nwparser.payload", "%{fld10->} %{agent}]%{p0}"); -var part122 = // "Pattern{Field(agent,false), Constant(']'), Field(p0,false)}" -match("MESSAGE#135:sendmail:13/0_1", "nwparser.payload", "%{agent}]%{p0}"); +var part122 = match("MESSAGE#135:sendmail:13/0_1", "nwparser.payload", "%{agent}]%{p0}"); var select45 = linear_select([ part121, part122, ]); -var part123 = // "Pattern{Field(process_id,false), Constant('[: '), Field(fld1,false), Constant(': SYSERR('), Field(fld2,false), Constant('): '), Field(action,false), Constant(': '), Field(event_description,true), Constant(' file '), Field(filename,false), Constant(': '), Field(fld3,false)}" -match("MESSAGE#135:sendmail:13/1", "nwparser.p0", "%{process_id}[: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} file %{filename}: %{fld3}"); +var part123 = match("MESSAGE#135:sendmail:13/1", "nwparser.p0", "%{process_id}[: %{fld1}: SYSERR(%{fld2}): %{action}: %{event_description->} file %{filename}: %{fld3}"); var all21 = all_match({ processors: [ @@ -2313,27 +2123,23 @@ var all21 = all_match({ var msg136 = msg("sendmail:13", all21); -var part124 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': '), Field(fld57,false), Constant(':'), Field(event_description,false)}" -match("MESSAGE#136:sendmail:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}:%{event_description}", processor_chain([ +var part124 = match("MESSAGE#136:sendmail:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: %{fld57}:%{event_description}", processor_chain([ dup17, dup9, ])); var msg137 = msg("sendmail:04", part124); -var part125 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(':'), Field(event_description,false)}" -match("MESSAGE#137:sendmail:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}:%{event_description}", processor_chain([ +var part125 = match("MESSAGE#137:sendmail:05", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}:%{event_description}", processor_chain([ dup17, dup9, ])); var msg138 = msg("sendmail:05", part125); -var part126 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: AUTH='), Field(authmethod,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#169:sendmail:06/0", "nwparser.payload", "%{agent}[%{process_id}]: AUTH=%{authmethod}, relay=%{p0}"); +var part126 = match("MESSAGE#169:sendmail:06/0", "nwparser.payload", "%{agent}[%{process_id}]: AUTH=%{authmethod}, relay=%{p0}"); -var part127 = // "Pattern{Field(,false), Constant('authid='), Field(uid,false), Constant(', mech='), Field(scheme,false), Constant(', bits='), Field(fld59,false)}" -match("MESSAGE#169:sendmail:06/2", "nwparser.p0", "%{}authid=%{uid}, mech=%{scheme}, bits=%{fld59}"); +var part127 = match("MESSAGE#169:sendmail:06/2", "nwparser.p0", "%{}authid=%{uid}, mech=%{scheme}, bits=%{fld59}"); var all22 = all_match({ processors: [ @@ -2370,24 +2176,21 @@ var select46 = linear_select([ msg140, ]); -var part128 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' pid='), Field(process_id,true), Constant(' status='), Field(fld29,false)}" -match("MESSAGE#138:info:eid_pid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} pid=%{process_id->} status=%{fld29}", processor_chain([ +var part128 = match("MESSAGE#138:info:eid_pid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} pid=%{process_id->} status=%{fld29}", processor_chain([ dup17, dup9, ])); var msg141 = msg("info:eid_pid_status", part128); -var part129 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status='), Field(fld29,false)}" -match("MESSAGE#139:info:eid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=%{fld29}", processor_chain([ +var part129 = match("MESSAGE#139:info:eid_status", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=%{fld29}", processor_chain([ dup17, dup9, ])); var msg142 = msg("info:eid_status", part129); -var part130 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' '), Field(info,false)}" -match("MESSAGE#140:info:eid", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} %{info}", processor_chain([ +var part130 = match("MESSAGE#140:info:eid", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} %{info}", processor_chain([ dup17, dup9, ])); @@ -2396,17 +2199,13 @@ var msg143 = msg("info:eid", part130); var msg144 = msg("info:pid", dup62); -var part131 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(p0,false)}" -match("MESSAGE#143:info/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{p0}"); +var part131 = match("MESSAGE#143:info/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{p0}"); -var part132 = // "Pattern{Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' ofrom='), Field(from,false)}" -match("MESSAGE#143:info/1_0", "nwparser.p0", "%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ofrom=%{from}"); +var part132 = match("MESSAGE#143:info/1_0", "nwparser.p0", "%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} ofrom=%{from}"); -var part133 = // "Pattern{Field(sessionid1,true), Constant(' status='), Field(info,true), Constant(' restquery_stage='), Field(fld3,false)}" -match("MESSAGE#143:info/1_1", "nwparser.p0", "%{sessionid1->} status=%{info->} restquery_stage=%{fld3}"); +var part133 = match("MESSAGE#143:info/1_1", "nwparser.p0", "%{sessionid1->} status=%{info->} restquery_stage=%{fld3}"); -var part134 = // "Pattern{Field(sessionid1,false)}" -match_copy("MESSAGE#143:info/1_2", "nwparser.p0", "sessionid1"); +var part134 = match_copy("MESSAGE#143:info/1_2", "nwparser.p0", "sessionid1"); var select47 = linear_select([ part132, @@ -2427,38 +2226,32 @@ var all23 = all_match({ var msg145 = msg("info", all23); -var part135 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sys='), Field(fld1,true), Constant(' evt='), Field(action,true), Constant(' active='), Field(fld2,true), Constant(' expires='), Field(fld3,true), Constant(' msg='), Field(event_description,false)}" -match("MESSAGE#144:info:02", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{action->} active=%{fld2->} expires=%{fld3->} msg=%{event_description}", processor_chain([ +var part135 = match("MESSAGE#144:info:02", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{action->} active=%{fld2->} expires=%{fld3->} msg=%{event_description}", processor_chain([ dup17, dup9, ])); var msg146 = msg("info:02", part135); -var part136 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' server='), Field(saddr,true), Constant(' elapsed='), Field(duration_string,true), Constant(' avgtime='), Field(fld2,true), Constant(' qname='), Field(fld3,true), Constant(' qtype='), Field(fld4,false)}" -match("MESSAGE#145:info:03", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} server=%{saddr->} elapsed=%{duration_string->} avgtime=%{fld2->} qname=%{fld3->} qtype=%{fld4}", processor_chain([ +var part136 = match("MESSAGE#145:info:03", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} server=%{saddr->} elapsed=%{duration_string->} avgtime=%{fld2->} qname=%{fld3->} qtype=%{fld4}", processor_chain([ dup17, dup9, ])); var msg147 = msg("info:03", part136); -var part137 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" -match("MESSAGE#146:info:01", "nwparser.payload", "%{fld0->} %{severity->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ +var part137 = match("MESSAGE#146:info:01", "nwparser.payload", "%{fld0->} %{severity->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ dup17, dup9, ])); var msg148 = msg("info:01", part137); -var part138 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sys='), Field(fld1,true), Constant(' evt='), Field(p0,false)}" -match("MESSAGE#147:info:04/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{p0}"); +var part138 = match("MESSAGE#147:info:04/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sys=%{fld1->} evt=%{p0}"); -var part139 = // "Pattern{Field(action,true), Constant(' msg='), Field(event_description,false)}" -match("MESSAGE#147:info:04/1_0", "nwparser.p0", "%{action->} msg=%{event_description}"); +var part139 = match("MESSAGE#147:info:04/1_0", "nwparser.p0", "%{action->} msg=%{event_description}"); -var part140 = // "Pattern{Field(action,false)}" -match_copy("MESSAGE#147:info:04/1_1", "nwparser.p0", "action"); +var part140 = match_copy("MESSAGE#147:info:04/1_1", "nwparser.p0", "action"); var select48 = linear_select([ part139, @@ -2478,14 +2271,11 @@ var all24 = all_match({ var msg149 = msg("info:04", all24); -var part141 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#148:info:05/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} %{p0}"); +var part141 = match("MESSAGE#148:info:05/0", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} %{p0}"); -var part142 = // "Pattern{Constant('type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" -match("MESSAGE#148:info:05/1_0", "nwparser.p0", "type=%{fld6->} cmd=%{obj_type->} id=%{fld5}"); +var part142 = match("MESSAGE#148:info:05/1_0", "nwparser.p0", "type=%{fld6->} cmd=%{obj_type->} id=%{fld5}"); -var part143 = // "Pattern{Constant('cmd='), Field(obj_type,false)}" -match("MESSAGE#148:info:05/1_1", "nwparser.p0", "cmd=%{obj_type}"); +var part143 = match("MESSAGE#148:info:05/1_1", "nwparser.p0", "cmd=%{obj_type}"); var select49 = linear_select([ part142, @@ -2520,8 +2310,7 @@ var select50 = linear_select([ var msg151 = msg("note:pid", dup62); -var part144 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' module='), Field(agent,true), Constant(' action='), Field(action,true), Constant(' size='), Field(bytes,false)}" -match("MESSAGE#149:note:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} module=%{agent->} action=%{action->} size=%{bytes}", processor_chain([ +var part144 = match("MESSAGE#149:note:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} module=%{agent->} action=%{action->} size=%{bytes}", processor_chain([ dup17, dup9, ])); @@ -2533,40 +2322,35 @@ var select51 = linear_select([ msg152, ]); -var part145 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' secprofile_name='), Field(fld3,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#150:rprt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} secprofile_name=%{fld3->} rcpts=%{dclass_counter2->} duration=%{duration_string}", processor_chain([ +var part145 = match("MESSAGE#150:rprt", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} secprofile_name=%{fld3->} rcpts=%{dclass_counter2->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); var msg153 = msg("rprt", part145); -var part146 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' module='), Field(agent,true), Constant(' age='), Field(fld6,true), Constant(' limit='), Field(fld31,false)}" -match("MESSAGE#151:err", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} module=%{agent->} age=%{fld6->} limit=%{fld31}", processor_chain([ +var part146 = match("MESSAGE#151:err", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} module=%{agent->} age=%{fld6->} limit=%{fld31}", processor_chain([ dup17, dup9, ])); var msg154 = msg("err", part146); -var part147 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' eid='), Field(fld4,true), Constant(' result='), Field(result,false)}" -match("MESSAGE#152:warn", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} eid=%{fld4->} result=%{result}", processor_chain([ +var part147 = match("MESSAGE#152:warn", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} eid=%{fld4->} result=%{result}", processor_chain([ dup17, dup9, ])); var msg155 = msg("warn", part147); -var part148 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status="'), Field(event_state,true), Constant(' file: '), Field(filename,false), Constant('"')}" -match("MESSAGE#153:warn:01", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file: %{filename}\"", processor_chain([ +var part148 = match("MESSAGE#153:warn:01", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file: %{filename}\"", processor_chain([ dup17, dup9, ])); var msg156 = msg("warn:01", part148); -var part149 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' eid='), Field(fld4,true), Constant(' status="'), Field(event_state,true), Constant(' file '), Field(filename,true), Constant(' does not contain enough (or correct) info. Fix this or remove the file."')}" -match("MESSAGE#154:warn:02", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file %{filename->} does not contain enough (or correct) info. Fix this or remove the file.\"", processor_chain([ +var part149 = match("MESSAGE#154:warn:02", "nwparser.payload", "%{fld0->} %{severity->} eid=%{fld4->} status=\"%{event_state->} file %{filename->} does not contain enough (or correct) info. Fix this or remove the file.\"", processor_chain([ dup17, dup9, setc("event_description","does not contain enough (or correct) info. Fix this or remove the file"), @@ -2584,14 +2368,11 @@ var msg158 = msg("queued-aglife", dup68); var msg159 = msg("pdr_run", dup50); -var part150 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' ttl='), Field(fld1,true), Constant(' reply="'), Field(p0,false)}" -match("MESSAGE#157:pdr_ttl/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} ttl=%{fld1->} reply=\"%{p0}"); +var part150 = match("MESSAGE#157:pdr_ttl/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} ttl=%{fld1->} reply=\"%{p0}"); -var part151 = // "Pattern{Constant('\"'), Field(fld2,true), Constant(' rscore='), Field(fld3,false), Constant('\""')}" -match("MESSAGE#157:pdr_ttl/1_0", "nwparser.p0", "\\\"%{fld2->} rscore=%{fld3}\\\"\""); +var part151 = match("MESSAGE#157:pdr_ttl/1_0", "nwparser.p0", "\\\"%{fld2->} rscore=%{fld3}\\\"\""); -var part152 = // "Pattern{Field(fld2,false), Constant('"')}" -match("MESSAGE#157:pdr_ttl/1_1", "nwparser.p0", "%{fld2}\""); +var part152 = match("MESSAGE#157:pdr_ttl/1_1", "nwparser.p0", "%{fld2}\""); var select53 = linear_select([ part151, @@ -2611,16 +2392,14 @@ var all26 = all_match({ var msg160 = msg("pdr_ttl", all26); -var part153 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' signature='), Field(fld1,true), Constant(' identity='), Field(sigid_string,true), Constant(' host='), Field(hostname,true), Constant(' result='), Field(result,true), Constant(' result_detail='), Field(fld2,false)}" -match("MESSAGE#158:dkimv_run:signature", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} signature=%{fld1->} identity=%{sigid_string->} host=%{hostname->} result=%{result->} result_detail=%{fld2}", processor_chain([ +var part153 = match("MESSAGE#158:dkimv_run:signature", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} signature=%{fld1->} identity=%{sigid_string->} host=%{hostname->} result=%{result->} result_detail=%{fld2}", processor_chain([ dup17, dup9, ])); var msg161 = msg("dkimv_run:signature", part153); -var part154 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' status="'), Field(info,false), Constant(', '), Field(event_state,false), Constant('"')}" -match("MESSAGE#159:dkimv_run:status", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=\"%{info}, %{event_state}\"", processor_chain([ +var part154 = match("MESSAGE#159:dkimv_run:status", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} status=\"%{info}, %{event_state}\"", processor_chain([ dup17, dup9, ])); @@ -2632,8 +2411,7 @@ var select54 = linear_select([ msg162, ]); -var part155 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' unexpected response type='), Field(fld1,false)}" -match("MESSAGE#160:dkimv_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} unexpected response type=%{fld1}", processor_chain([ +var part155 = match("MESSAGE#160:dkimv_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} unexpected response type=%{fld1}", processor_chain([ dup17, dup9, setc("result","unexpected response"), @@ -2641,8 +2419,7 @@ match("MESSAGE#160:dkimv_type", "nwparser.payload", "%{fld0}: %{severity->} mod= var msg163 = msg("dkimv_type", part155); -var part156 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' publickey_cache_entries='), Field(fld6,false)}" -match("MESSAGE#161:dkimv_type:01", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} publickey_cache_entries=%{fld6}", processor_chain([ +var part156 = match("MESSAGE#161:dkimv_type:01", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} publickey_cache_entries=%{fld6}", processor_chain([ dup17, dup9, ])); @@ -2656,8 +2433,7 @@ var select55 = linear_select([ var msg165 = msg("dmarc_run:rule", dup49); -var part157 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' result='), Field(result,true), Constant(' result_detail='), Field(fld2,false)}" -match("MESSAGE#163:dmarc_run:result", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} result=%{result->} result_detail=%{fld2}", processor_chain([ +var part157 = match("MESSAGE#163:dmarc_run:result", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} result=%{result->} result_detail=%{fld2}", processor_chain([ dup17, dup9, ])); @@ -2669,8 +2445,7 @@ var select56 = linear_select([ msg166, ]); -var part158 = // "Pattern{Field(fld0,false), Constant(': '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' policy_cache_entries='), Field(fld6,false)}" -match("MESSAGE#164:dmarc_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} policy_cache_entries=%{fld6}", processor_chain([ +var part158 = match("MESSAGE#164:dmarc_type", "nwparser.payload", "%{fld0}: %{severity->} mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{fld5->} policy_cache_entries=%{fld6}", processor_chain([ dup17, dup9, ])); @@ -2679,8 +2454,7 @@ var msg167 = msg("dmarc_type", part158); var msg168 = msg("spf_run:rule", dup49); -var part159 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' cmd='), Field(obj_type,true), Constant(' result='), Field(result,false)}" -match("MESSAGE#166:spf_run:cmd", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cmd=%{obj_type->} result=%{result}", processor_chain([ +var part159 = match("MESSAGE#166:spf_run:cmd", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} cmd=%{obj_type->} result=%{result}", processor_chain([ dup17, dup9, ])); @@ -2692,24 +2466,21 @@ var select57 = linear_select([ msg169, ]); -var part160 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' action='), Field(action,true), Constant(' score='), Field(fld39,true), Constant(' submsgadjust='), Field(fld53,true), Constant(' spamscore='), Field(reputation_num,true), Constant(' suspectscore='), Field(fld41,true), Constant(' malwarescore='), Field(fld49,true), Constant(' phishscore='), Field(fld42,true), Constant(' adultscore='), Field(fld44,true), Constant(' bulkscore='), Field(fld43,true), Constant(' tests='), Field(fld52,false)}" -match("MESSAGE#167:action_checksubmsg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} suspectscore=%{fld41->} malwarescore=%{fld49->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} tests=%{fld52}", processor_chain([ +var part160 = match("MESSAGE#167:action_checksubmsg", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} action=%{action->} score=%{fld39->} submsgadjust=%{fld53->} spamscore=%{reputation_num->} suspectscore=%{fld41->} malwarescore=%{fld49->} phishscore=%{fld42->} adultscore=%{fld44->} bulkscore=%{fld43->} tests=%{fld52}", processor_chain([ dup17, dup9, ])); var msg170 = msg("action_checksubmsg", part160); -var part161 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' authscope='), Field(fld5,true), Constant(' err='), Field(fld58,false)}" -match("MESSAGE#168:rest_oauth", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} authscope=%{fld5->} err=%{fld58}", processor_chain([ +var part161 = match("MESSAGE#168:rest_oauth", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} authscope=%{fld5->} err=%{fld58}", processor_chain([ dup17, dup9, ])); var msg171 = msg("rest_oauth", part161); -var part162 = // "Pattern{Constant('mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(id,true), Constant(' load smartid ccard')}" -match("MESSAGE#171:filter_instance1:01", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid ccard", processor_chain([ +var part162 = match("MESSAGE#171:filter_instance1:01", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid ccard", processor_chain([ dup17, dup9, setc("event_description","load smartid ccard"), @@ -2718,8 +2489,7 @@ match("MESSAGE#171:filter_instance1:01", "nwparser.payload", "mod=%{agent->} typ var msg172 = msg("filter_instance1:01", part162); -var part163 = // "Pattern{Constant('mod='), Field(agent,true), Constant(' type='), Field(fld1,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(id,true), Constant(' load smartid jcb')}" -match("MESSAGE#172:filter_instance1:02", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid jcb", processor_chain([ +var part163 = match("MESSAGE#172:filter_instance1:02", "nwparser.payload", "mod=%{agent->} type=%{fld1->} cmd=%{obj_type->} id=%{id->} load smartid jcb", processor_chain([ dup17, dup9, setc("event_description","load smartid jcb"), @@ -2728,22 +2498,18 @@ match("MESSAGE#172:filter_instance1:02", "nwparser.payload", "mod=%{agent->} typ var msg173 = msg("filter_instance1:02", part163); -var part164 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' attachments='), Field(dclass_counter1,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' size='), Field(bytes,true), Constant(' guid='), Field(fld14,true), Constant(' hdr_mid='), Field(id,true), Constant(' qid='), Field(fld15,true), Constant(' subject="'), Field(subject,false), Constant('" '), Field(p0,false)}" -match("MESSAGE#173:filter_instance1:03/0", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=\"%{subject}\" %{p0}"); +var part164 = match("MESSAGE#173:filter_instance1:03/0", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} attachments=%{dclass_counter1->} rcpts=%{dclass_counter2->} routes=%{fld4->} size=%{bytes->} guid=%{fld14->} hdr_mid=%{id->} qid=%{fld15->} subject=\"%{subject}\" %{p0}"); -var part165 = // "Pattern{Constant('spamscore='), Field(reputation_num,true), Constant(' virusname='), Field(threat_name,true), Constant(' duration='), Field(p0,false)}" -match("MESSAGE#173:filter_instance1:03/1_0", "nwparser.p0", "spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{p0}"); +var part165 = match("MESSAGE#173:filter_instance1:03/1_0", "nwparser.p0", "spamscore=%{reputation_num->} virusname=%{threat_name->} duration=%{p0}"); -var part166 = // "Pattern{Constant('duration='), Field(p0,false)}" -match("MESSAGE#173:filter_instance1:03/1_1", "nwparser.p0", "duration=%{p0}"); +var part166 = match("MESSAGE#173:filter_instance1:03/1_1", "nwparser.p0", "duration=%{p0}"); var select58 = linear_select([ part165, part166, ]); -var part167 = // "Pattern{Field(fld16,true), Constant(' elapsed='), Field(duration_string,false)}" -match("MESSAGE#173:filter_instance1:03/2", "nwparser.p0", "%{fld16->} elapsed=%{duration_string}"); +var part167 = match("MESSAGE#173:filter_instance1:03/2", "nwparser.p0", "%{fld16->} elapsed=%{duration_string}"); var all27 = all_match({ processors: [ @@ -2762,8 +2528,7 @@ var all27 = all_match({ var msg174 = msg("filter_instance1:03", all27); -var part168 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' module='), Field(event_source,true), Constant(' rule='), Field(rulename,true), Constant(' action='), Field(action,true), Constant(' helo='), Field(fld32,true), Constant(' msgs='), Field(fld33,true), Constant(' rcpts='), Field(dclass_counter2,true), Constant(' routes='), Field(fld4,true), Constant(' duration='), Field(duration_string,true), Constant(' elapsed='), Field(fld16,false)}" -match("MESSAGE#174:filter_instance1:04", "nwparser.payload", "s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ +var part168 = match("MESSAGE#174:filter_instance1:04", "nwparser.payload", "s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} module=%{event_source->} rule=%{rulename->} action=%{action->} helo=%{fld32->} msgs=%{fld33->} rcpts=%{dclass_counter2->} routes=%{fld4->} duration=%{duration_string->} elapsed=%{fld16}", processor_chain([ dup17, dup9, dup13, @@ -2772,8 +2537,7 @@ match("MESSAGE#174:filter_instance1:04", "nwparser.payload", "s=%{sessionid->} m var msg175 = msg("filter_instance1:04", part168); -var part169 = // "Pattern{Constant('s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' header.from="\"'), Field(info,false), Constant('\" '), Field(fld4,true), Constant(' <<'), Field(user_address,false), Constant('>"')}" -match("MESSAGE#175:filter_instance1:05", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} header.from=\"\\\"%{info}\\\" %{fld4->} \u003c\u003c%{user_address}>\"", processor_chain([ +var part169 = match("MESSAGE#175:filter_instance1:05", "nwparser.payload", "s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} header.from=\"\\\"%{info}\\\" %{fld4->} \u003c\u003c%{user_address}>\"", processor_chain([ dup17, dup9, dup36, @@ -3001,89 +2765,61 @@ var chain1 = processor_chain([ }), ]); -var part171 = // "Pattern{Constant('info'), Field(p0,false)}" -match("HEADER#0:0024/1_0", "nwparser.p0", "info%{p0}"); +var part171 = match("HEADER#0:0024/1_0", "nwparser.p0", "info%{p0}"); -var part172 = // "Pattern{Constant('rprt'), Field(p0,false)}" -match("HEADER#0:0024/1_1", "nwparser.p0", "rprt%{p0}"); +var part172 = match("HEADER#0:0024/1_1", "nwparser.p0", "rprt%{p0}"); -var part173 = // "Pattern{Constant('warn'), Field(p0,false)}" -match("HEADER#0:0024/1_2", "nwparser.p0", "warn%{p0}"); +var part173 = match("HEADER#0:0024/1_2", "nwparser.p0", "warn%{p0}"); -var part174 = // "Pattern{Constant('err'), Field(p0,false)}" -match("HEADER#0:0024/1_3", "nwparser.p0", "err%{p0}"); +var part174 = match("HEADER#0:0024/1_3", "nwparser.p0", "err%{p0}"); -var part175 = // "Pattern{Constant('note'), Field(p0,false)}" -match("HEADER#0:0024/1_4", "nwparser.p0", "note%{p0}"); +var part175 = match("HEADER#0:0024/1_4", "nwparser.p0", "note%{p0}"); -var part176 = // "Pattern{Field(hostip,true), Constant(' sampling='), Field(fld19,false)}" -match("MESSAGE#11:mail_env_from:ofrom/1_0", "nwparser.p0", "%{hostip->} sampling=%{fld19}"); +var part176 = match("MESSAGE#11:mail_env_from:ofrom/1_0", "nwparser.p0", "%{hostip->} sampling=%{fld19}"); -var part177 = // "Pattern{Field(hostip,false)}" -match_copy("MESSAGE#11:mail_env_from:ofrom/1_1", "nwparser.p0", "hostip"); +var part177 = match_copy("MESSAGE#11:mail_env_from:ofrom/1_1", "nwparser.p0", "hostip"); -var part178 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#25:session_judge/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); +var part178 = match("MESSAGE#25:session_judge/0", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} %{p0}"); -var part179 = // "Pattern{Constant('attachment='), Field(fld58,true), Constant(' file='), Field(fld1,true), Constant(' mod='), Field(p0,false)}" -match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); +var part179 = match("MESSAGE#25:session_judge/1_0", "nwparser.p0", "attachment=%{fld58->} file=%{fld1->} mod=%{p0}"); -var part180 = // "Pattern{Constant('mod='), Field(p0,false)}" -match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); +var part180 = match("MESSAGE#25:session_judge/1_1", "nwparser.p0", "mod=%{p0}"); -var part181 = // "Pattern{Constant('vendor='), Field(fld36,true), Constant(' version="'), Field(component_version,false), Constant('" duration='), Field(p0,false)}" -match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); +var part181 = match("MESSAGE#39:av_run:02/1_1", "nwparser.p0", "vendor=%{fld36->} version=\"%{component_version}\" duration=%{p0}"); -var part182 = // "Pattern{Field(duration_string,false)}" -match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); +var part182 = match_copy("MESSAGE#39:av_run:02/2", "nwparser.p0", "duration_string"); -var part183 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); +var part183 = match("MESSAGE#98:queued-alert/3_0", "nwparser.p0", "[%{daddr}] [%{daddr}],%{p0}"); -var part184 = // "Pattern{Constant('['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); +var part184 = match("MESSAGE#98:queued-alert/3_1", "nwparser.p0", "[%{daddr}],%{p0}"); -var part185 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant('],'), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); +var part185 = match("MESSAGE#98:queued-alert/3_2", "nwparser.p0", "%{dhost->} [%{daddr}],%{p0}"); -var part186 = // "Pattern{Field(dhost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); +var part186 = match("MESSAGE#98:queued-alert/3_3", "nwparser.p0", "%{dhost},%{p0}"); -var part187 = // "Pattern{Field(,false), Constant('dsn='), Field(resultcode,false), Constant(', stat='), Field(info,false)}" -match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); +var part187 = match("MESSAGE#98:queued-alert/4", "nwparser.p0", "%{}dsn=%{resultcode}, stat=%{info}"); -var part188 = // "Pattern{Constant('['), Field(daddr,false), Constant(']')}" -match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); +var part188 = match("MESSAGE#99:queued-alert:01/1_1", "nwparser.p0", "[%{daddr}]"); -var part189 = // "Pattern{Field(dhost,true), Constant(' ['), Field(daddr,false), Constant(']')}" -match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); +var part189 = match("MESSAGE#99:queued-alert:01/1_2", "nwparser.p0", "%{dhost->} [%{daddr}]"); -var part190 = // "Pattern{Field(dhost,false)}" -match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); +var part190 = match_copy("MESSAGE#99:queued-alert:01/1_3", "nwparser.p0", "dhost"); -var part191 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: STARTTLS='), Field(fld1,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); +var part191 = match("MESSAGE#100:queued-alert:02/0", "nwparser.payload", "%{agent}[%{process_id}]: STARTTLS=%{fld1}, relay=%{p0}"); -var part192 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld51,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); +var part192 = match("MESSAGE#101:queued-VoltageEncrypt/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld51}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); -var part193 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); +var part193 = match("MESSAGE#120:queued-VoltageEncrypt:01/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, relay=%{p0}"); -var part194 = // "Pattern{Constant('['), Field(daddr,false), Constant('] ['), Field(daddr,false), Constant(']')}" -match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); +var part194 = match("MESSAGE#120:queued-VoltageEncrypt:01/1_0", "nwparser.p0", "[%{daddr}] [%{daddr}]"); -var part195 = // "Pattern{Field(,false), Constant('field='), Field(fld2,false), Constant(', status='), Field(info,false)}" -match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); +var part195 = match("MESSAGE#104:queued-default:02/2", "nwparser.p0", "%{}field=%{fld2}, status=%{info}"); -var part196 = // "Pattern{Field(,false), Constant('version='), Field(fld55,false), Constant(', verify='), Field(fld57,false), Constant(', cipher='), Field(fld58,false), Constant(', bits='), Field(fld59,false)}" -match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); +var part196 = match("MESSAGE#105:queued-default:03/2", "nwparser.p0", "%{}version=%{fld55}, verify=%{fld57}, cipher=%{fld58}, bits=%{fld59}"); -var part197 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': from='), Field(from,false), Constant(', size='), Field(bytes,false), Constant(', class='), Field(fld57,false), Constant(', nrcpts='), Field(fld58,false), Constant(', msgid='), Field(id,false), Constant(', proto='), Field(protocol,false), Constant(', daemon='), Field(fld69,false), Constant(', tls_verify='), Field(fld70,false), Constant(', auth='), Field(fld71,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); +var part197 = match("MESSAGE#116:queued-eurort:02/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: from=%{from}, size=%{bytes}, class=%{fld57}, nrcpts=%{fld58}, msgid=%{id}, proto=%{protocol}, daemon=%{fld69}, tls_verify=%{fld70}, auth=%{fld71}, relay=%{p0}"); -var part198 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': to='), Field(to,false), Constant(', delay='), Field(fld53,false), Constant(', xdelay='), Field(fld54,false), Constant(', mailer='), Field(fld55,false), Constant(', pri='), Field(fld23,false), Constant(', relay='), Field(p0,false)}" -match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); +var part198 = match("MESSAGE#126:sendmail/0", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: to=%{to}, delay=%{fld53}, xdelay=%{fld54}, mailer=%{fld55}, pri=%{fld23}, relay=%{p0}"); var select60 = linear_select([ dup1, @@ -3103,62 +2839,52 @@ var select62 = linear_select([ dup20, ]); -var part199 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' vendor='), Field(fld36,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,true), Constant(' signatures='), Field(fld94,false)}" -match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ +var part199 = match("MESSAGE#43:av_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} vendor=%{fld36->} engine=%{fld49->} definitions=%{fld50->} signatures=%{fld94}", processor_chain([ dup26, dup9, ])); -var part200 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' m='), Field(mail_id,true), Constant(' x='), Field(sessionid1,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var part200 = match("MESSAGE#48:access_run:03", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} m=%{mail_id->} x=%{sessionid1->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); -var part201 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' s='), Field(sessionid,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' rule='), Field(rulename,true), Constant(' duration='), Field(duration_string,false)}" -match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ +var part201 = match("MESSAGE#49:access_run:01", "nwparser.payload", "%{fld0->} %{severity->} s=%{sessionid->} mod=%{agent->} cmd=%{obj_type->} rule=%{rulename->} duration=%{duration_string}", processor_chain([ dup17, dup9, ])); -var part202 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' action='), Field(action,true), Constant(' dict='), Field(fld37,true), Constant(' file='), Field(filename,false)}" -match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ +var part202 = match("MESSAGE#51:access_refresh:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} action=%{action->} dict=%{fld37->} file=%{filename}", processor_chain([ dup17, dup9, ])); -var part203 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,false)}" -match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ +var part203 = match("MESSAGE#52:access_load", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5}", processor_chain([ dup17, dup9, ])); -var part204 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' engine='), Field(fld49,true), Constant(' definitions='), Field(fld50,false)}" -match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ +var part204 = match("MESSAGE#64:spam_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} engine=%{fld49->} definitions=%{fld50}", processor_chain([ dup27, dup9, ])); -var part205 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' type='), Field(fld6,true), Constant(' cmd='), Field(obj_type,true), Constant(' id='), Field(fld5,true), Constant(' version='), Field(fld55,false)}" -match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ +var part205 = match("MESSAGE#71:zerohour_refresh", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} type=%{fld6->} cmd=%{obj_type->} id=%{fld5->} version=%{fld55}", processor_chain([ dup17, dup9, ])); -var part206 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' sig='), Field(fld60,false)}" -match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ +var part206 = match("MESSAGE#82:cvtd:01", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} sig=%{fld60}", processor_chain([ dup17, dup9, ])); -var part207 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,false)}" -match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ +var part207 = match("MESSAGE#83:cvtd", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type}", processor_chain([ dup17, dup9, ])); -var part208 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' mod='), Field(agent,true), Constant(' cmd='), Field(obj_type,true), Constant(' addr='), Field(saddr,false)}" -match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ +var part208 = match("MESSAGE#87:soap_listen", "nwparser.payload", "%{fld0->} %{severity->} mod=%{agent->} cmd=%{obj_type->} addr=%{saddr}", processor_chain([ dup17, dup9, ])); @@ -3177,20 +2903,17 @@ var select64 = linear_select([ dup35, ]); -var part209 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(fld1,false), Constant(': timeout waiting for input from '), Field(fld11,true), Constant(' during server cmd read')}" -match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ +var part209 = match("MESSAGE#106:queued-default:04", "nwparser.payload", "%{agent}[%{process_id}]: %{fld1}: timeout waiting for input from %{fld11->} during server cmd read", processor_chain([ dup17, dup9, ])); -var part210 = // "Pattern{Field(agent,false), Constant('['), Field(process_id,false), Constant(']: '), Field(event_description,false)}" -match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ +var part210 = match("MESSAGE#113:queued-reinject:06", "nwparser.payload", "%{agent}[%{process_id}]: %{event_description}", processor_chain([ dup17, dup9, ])); -var part211 = // "Pattern{Field(fld0,true), Constant(' '), Field(severity,true), Constant(' pid='), Field(process_id,true), Constant(' '), Field(web_method,true), Constant(' /'), Field(info,false), Constant(': '), Field(resultcode,false)}" -match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ +var part211 = match("MESSAGE#141:info:pid", "nwparser.payload", "%{fld0->} %{severity->} pid=%{process_id->} %{web_method->} /%{info}: %{resultcode}", processor_chain([ dup17, dup9, ])); diff --git a/x-pack/filebeat/module/snort/log/config/pipeline.js b/x-pack/filebeat/module/snort/log/config/pipeline.js index d4d6aec1028..18f0ec783e3 100644 --- a/x-pack/filebeat/module/snort/log/config/pipeline.js +++ b/x-pack/filebeat/module/snort/log/config/pipeline.js @@ -46,44 +46,31 @@ var map_getEventLegacyCategoryName = { var dup1 = setc("messageid","FTD_events"); -var dup2 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#2:00010/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var dup2 = match("HEADER#2:00010/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); -var dup3 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Impact: '), Field(p0,false)}" -match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); +var dup3 = match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); -var dup4 = // "Pattern{Field(hfld10,true), Constant(' [Impact: '), Field(p0,false)}" -match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); +var dup4 = match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); -var dup5 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var dup5 = match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); -var dup6 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Classification: '), Field(p0,false)}" -match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); +var dup6 = match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); -var dup7 = // "Pattern{Field(hfld10,true), Constant(' [Classification: '), Field(p0,false)}" -match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); +var dup7 = match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); -var dup8 = // "Pattern{Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); +var dup8 = match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); -var dup9 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" ['), Field(p0,false)}" -match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); +var dup9 = match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); -var dup10 = // "Pattern{Field(hfld10,true), Constant(' ['), Field(p0,false)}" -match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); +var dup10 = match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); -var dup11 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); +var dup11 = match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); -var dup12 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var dup12 = match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); -var dup13 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var dup13 = match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); -var dup14 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var dup14 = match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); var dup15 = call({ dest: "nwparser.payload", @@ -135,11 +122,9 @@ var dup19 = call({ ], }); -var dup20 = // "Pattern{Constant('at'), Field(p0,false)}" -match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); +var dup20 = match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); -var dup21 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); +var dup21 = match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); var dup22 = call({ dest: "nwparser.messageid", @@ -171,19 +156,15 @@ var dup24 = setc("messageid","HMNOTIFY"); var dup25 = setc("messageid","SystemSettings"); -var dup26 = // "Pattern{Constant('['), Field(hpid,false), Constant(']: ['), Field(p0,false)}" -match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); +var dup26 = match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); -var dup27 = // "Pattern{Constant(': ['), Field(p0,false)}" -match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); +var dup27 = match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); -var dup28 = // "Pattern{Constant(']'), Field(hversion,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hevent_source,true), Constant(' '), Field(payload,false)}" -match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); +var dup28 = match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); var dup29 = setc("messageid","Snort_AlertLog"); -var dup30 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); +var dup30 = match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); var dup31 = date_time({ dest: "event_time", @@ -195,38 +176,27 @@ var dup31 = date_time({ var dup32 = setf("msg","$MSG"); -var dup33 = // "Pattern{Field(threat_val,true), Constant(' ]:alert {'), Field(p0,false)}" -match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); +var dup33 = match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); -var dup34 = // "Pattern{Field(threat_val,true), Constant(' ]: '), Field(fld1,true), Constant(' {'), Field(p0,false)}" -match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); +var dup34 = match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); -var dup35 = // "Pattern{Field(threat_val,false), Constant(']: {'), Field(p0,false)}" -match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); +var dup35 = match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); -var dup36 = // "Pattern{Field(threat_val,true), Constant(' ] {'), Field(p0,false)}" -match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); +var dup36 = match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); -var dup37 = // "Pattern{Field(protocol,false), Constant('} '), Field(p0,false)}" -match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); +var dup37 = match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); -var dup38 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(') -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); +var dup38 = match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); -var dup39 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); +var dup39 = match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); -var dup40 = // "Pattern{Field(saddr,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); +var dup40 = match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); -var dup41 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(location_dst,false), Constant(')')}" -match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); +var dup41 = match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); -var dup42 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false)}" -match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); +var dup42 = match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); -var dup43 = // "Pattern{Field(daddr,false)}" -match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); +var dup43 = match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); var dup44 = setc("eventcategory","1003030000"); @@ -266,17 +236,13 @@ var dup56 = date_time({ ], }); -var dup57 = // "Pattern{Field(context,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); +var dup57 = match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); -var dup58 = // "Pattern{Constant('<<'), Field(interface,false), Constant('> '), Field(p0,false)}" -match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); +var dup58 = match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); -var dup59 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); +var dup59 = match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); -var dup60 = // "Pattern{Constant('{'), Field(protocol,false), Constant('} '), Field(p0,false)}" -match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); +var dup60 = match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); var dup61 = setc("eventcategory","1103000000"); @@ -288,17 +254,13 @@ var dup64 = setc("eventcategory","1002000000"); var dup65 = setc("eventcategory","1001020200"); -var dup66 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" -match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); +var dup66 = match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); -var dup67 = // "Pattern{Constant(' <<'), Field(interface,false), Constant('> '), Field(p0,false)}" -match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); +var dup67 = match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); -var dup68 = // "Pattern{Constant(': '), Field(p0,false)}" -match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); +var dup68 = match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); -var dup69 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); +var dup69 = match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); var dup70 = setc("eventcategory","1001020100"); @@ -310,8 +272,7 @@ var dup73 = setc("ec_activity","Detect"); var dup74 = setc("ec_theme","TEV"); -var dup75 = // "Pattern{Field(context,true), Constant(' <<'), Field(interface,false), Constant('> '), Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); +var dup75 = match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); var dup76 = setf("signame","context"); @@ -387,17 +348,13 @@ var dup111 = setc("eventcategory","1001020307"); var dup112 = setc("eventcategory","1401060000"); -var dup113 = // "Pattern{Field(threat_val,true), Constant(' ]:alert '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); +var dup113 = match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); -var dup114 = // "Pattern{Field(threat_val,false), Constant(']: '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); +var dup114 = match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); -var dup115 = // "Pattern{Field(threat_val,true), Constant(' ] '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); +var dup115 = match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); -var dup116 = // "Pattern{Constant(''), Field(p0,false)}" -match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); +var dup116 = match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); var dup117 = setc("eventcategory","1003050000"); @@ -413,14 +370,11 @@ var dup122 = setc("eventcategory","1603090000"); var dup123 = setc("eventcategory","1003040000"); -var dup124 = // "Pattern{Constant(':alert '), Field(p0,false)}" -match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); +var dup124 = match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); -var dup125 = // "Pattern{Constant(''), Field(saddr,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); +var dup125 = match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); -var dup126 = // "Pattern{Constant(''), Field(daddr,false)}" -match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); +var dup126 = match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); var dup127 = setc("eventcategory","1605000000"); @@ -434,25 +388,19 @@ var dup129 = date_time({ ], }); -var dup130 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' MAC: '), Field(smacaddr,true), Constant(' TTL '), Field(p0,false)}" -match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); +var dup130 = match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); -var dup131 = // "Pattern{Field(sinterface,true), Constant(' ('), Field(protocol,true), Constant(' detected)')}" -match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); +var dup131 = match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); -var dup132 = // "Pattern{Field(sinterface,false)}" -match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); +var dup132 = match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); -var dup133 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> '), Field(p0,false)}" -match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); +var dup133 = match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); -var dup134 = // "Pattern{Field(protocol,false)}" -match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); +var dup134 = match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); var dup135 = setc("eventcategory","1605020000"); -var dup136 = // "Pattern{Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); +var dup136 = match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); var dup137 = setc("ec_subject","User"); @@ -470,19 +418,15 @@ var dup143 = setf("hostip","hfld2"); var dup144 = setc("ec_activity","Logoff"); -var dup145 = // "Pattern{Constant('>'), Field(p0,false)}" -match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); +var dup145 = match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); var dup146 = setc("category","Session Expiration"); -var dup147 = // "Pattern{Field(fld1,false), Constant(']['), Field(policyname,false), Constant('] Connection Type: '), Field(event_state,false), Constant(', User: '), Field(username,false), Constant(', Client: '), Field(application,false), Constant(', Application Protocol: '), Field(protocol,false), Constant(', Web App: '), Field(application,false), Constant(', Access Control Rule Name: '), Field(rulename,false), Constant(', Access Control Rule Action: '), Field(action,false), Constant(', Access Control Rule Reasons: '), Field(result,false), Constant(', URL Category: '), Field(category,false), Constant(', URL Reputation: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); +var dup147 = match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); -var dup148 = // "Pattern{Constant('Risk unknown, URL: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); +var dup148 = match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); -var dup149 = // "Pattern{Field(reputation_num,false), Constant(', URL: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); +var dup149 = match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); var dup150 = setc("eventcategory","1801000000"); @@ -490,20 +434,15 @@ var dup151 = setc("dclass_counter1_string","Number of File Events"); var dup152 = setc("dclass_counter2_string","Number of IPS Events"); -var dup153 = // "Pattern{Constant('-*> '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); +var dup153 = match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); -var dup154 = // "Pattern{Constant('> '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); +var dup154 = match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); -var dup155 = // "Pattern{Constant('From "'), Field(sensor,false), Constant('" at '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); +var dup155 = match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); -var dup156 = // "Pattern{Constant('at '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); +var dup156 = match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); -var dup157 = // "Pattern{Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); +var dup157 = match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); var dup158 = date_time({ dest: "event_time", @@ -513,11 +452,9 @@ var dup158 = date_time({ ], }); -var dup159 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' '), Field(network_service,false)}" -match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); +var dup159 = match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); -var dup160 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" -match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); +var dup160 = match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); var dup161 = date_time({ dest: "event_time", @@ -564,8 +501,7 @@ var dup169 = linear_select([ dup10, ]); -var dup170 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(p0,false)}" -match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ +var dup170 = match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ dup19, ])); @@ -637,8 +573,7 @@ var dup182 = linear_select([ dup132, ]); -var dup183 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(version,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ +var dup183 = match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ dup127, dup31, dup32, @@ -646,8 +581,7 @@ match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} Fr dup129, ])); -var dup184 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ +var dup184 = match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ dup135, dup31, dup32, @@ -660,8 +594,7 @@ var dup185 = linear_select([ dup134, ]); -var dup186 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' '), Field(product,false)}" -match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ +var dup186 = match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ dup135, dup31, dup32, @@ -669,8 +602,7 @@ match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} dup129, ])); -var dup187 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" -match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ +var dup187 = match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ dup135, dup31, dup32, @@ -678,8 +610,7 @@ match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \" dup129, ])); -var dup188 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,false)}" -match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ +var dup188 = match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ dup135, dup31, dup32, @@ -4814,34 +4745,28 @@ var dup356 = all_match({ ]), }); -var hdr1 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z %FTD-'), Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" -match("HEADER#0:0055", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0055", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ setc("header_id","0055"), dup1, ])); -var hdr2 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z '), Field(hostname,true), Constant(' '), Field(fld1,true), Constant(' %NGIPS-'), Field(severity,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" -match("HEADER#1:0056", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %{fld1->} %NGIPS-%{severity}-%{hfld3}:%{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0056", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %{fld1->} %NGIPS-%{severity}-%{hfld3}:%{payload}", processor_chain([ setc("header_id","0056"), setc("messageid","NGIPS_events"), ])); -var part1 = // "Pattern{Field(result,false), Constant('] From '), Field(p0,false)}" -match("HEADER#2:00010/2", "nwparser.p0", "%{result}] From %{p0}"); +var part1 = match("HEADER#2:00010/2", "nwparser.p0", "%{result}] From %{p0}"); -var part2 = // "Pattern{Constant('"'), Field(group_object,false), Constant('/'), Field(hfld11,false), Constant('" at '), Field(p0,false)}" -match("HEADER#2:00010/3_0", "nwparser.p0", "\"%{group_object}/%{hfld11}\" at %{p0}"); +var part2 = match("HEADER#2:00010/3_0", "nwparser.p0", "\"%{group_object}/%{hfld11}\" at %{p0}"); -var part3 = // "Pattern{Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(p0,false)}" -match("HEADER#2:00010/3_1", "nwparser.p0", "%{group_object}/%{hfld11->} at %{p0}"); +var part3 = match("HEADER#2:00010/3_1", "nwparser.p0", "%{group_object}/%{hfld11->} at %{p0}"); var select1 = linear_select([ part2, part3, ]); -var part4 = // "Pattern{Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#2:00010/4", "nwparser.p0", "%{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var part4 = match("HEADER#2:00010/4", "nwparser.p0", "%{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); var all1 = all_match({ processors: [ @@ -4889,8 +4814,7 @@ var all4 = all_match({ ]), }); -var hdr3 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant(':'), Field(hfld3,true), Constant(' at '), Field(hfld4,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant(']'), Field(payload,false)}" -match("HEADER#6:0015", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: %{hfld2}:%{hfld3->} at %{hfld4}: [%{hevent_source}:%{messageid}:%{hversion}]%{payload}", processor_chain([ +var hdr3 = match("HEADER#6:0015", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: %{hfld2}:%{hfld3->} at %{hfld4}: [%{hevent_source}:%{messageid}:%{hversion}]%{payload}", processor_chain([ setc("header_id","0015"), ])); @@ -4982,8 +4906,7 @@ var all12 = all_match({ ]), }); -var hdr4 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#15:0030/0", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var hdr4 = match("HEADER#15:0030/0", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); var all13 = all_match({ processors: [ @@ -4996,64 +4919,53 @@ var all13 = all_match({ ]), }); -var hdr5 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" -match("HEADER#16:0004", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ +var hdr5 = match("HEADER#16:0004", "message", "snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ setc("header_id","0004"), ])); -var hdr6 = // "Pattern{Constant('snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" -match("HEADER#17:0005", "message", "snort: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ +var hdr6 = match("HEADER#17:0005", "message", "snort: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ setc("header_id","0005"), ])); -var hdr7 = // "Pattern{Constant('snort['), Field(hpid,false), Constant(']: '), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#18:0018", "message", "snort[%{hpid}]: %{messageid}: %{payload}", processor_chain([ +var hdr7 = match("HEADER#18:0018", "message", "snort[%{hpid}]: %{messageid}: %{payload}", processor_chain([ setc("header_id","0018"), ])); -var hdr8 = // "Pattern{Constant('snort: '), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#19:0006", "message", "snort: %{messageid}: %{payload}", processor_chain([ +var hdr8 = match("HEADER#19:0006", "message", "snort: %{messageid}: %{payload}", processor_chain([ setc("header_id","0006"), ])); -var hdr9 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort['), Field(hpid,false), Constant(']: '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#20:0007", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: %{messageid->} %{p0}", processor_chain([ +var hdr9 = match("HEADER#20:0007", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: %{messageid->} %{p0}", processor_chain([ setc("header_id","0007"), dup15, ])); -var hdr10 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" -match("HEADER#21:0008", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ +var hdr10 = match("HEADER#21:0008", "message", "%{month->} %{day->} %{time->} %{host->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ setc("header_id","0008"), ])); -var hdr11 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hfld1,false), Constant(': [Primary Detection Engine ('), Field(hfld10,false), Constant(')]['), Field(policyname,false), Constant(']['), Field(hfld2,false), Constant(':'), Field(id,false), Constant(':'), Field(hfld3,false), Constant(']'), Field(payload,false)}" -match("HEADER#22:0046", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine (%{hfld10})][%{policyname}][%{hfld2}:%{id}:%{hfld3}]%{payload}", processor_chain([ +var hdr11 = match("HEADER#22:0046", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine (%{hfld10})][%{policyname}][%{hfld2}:%{id}:%{hfld3}]%{payload}", processor_chain([ setc("header_id","0046"), dup16, ])); -var hdr12 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hpid,false), Constant(']['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" -match("HEADER#23:0009", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hpid}][%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ +var hdr12 = match("HEADER#23:0009", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hpid}][%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ setc("header_id","0009"), ])); -var hdr13 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld5,false), Constant(': '), Field(hfld6,false), Constant(': '), Field(hfld7,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" -match("HEADER#24:0022", "message", "%{hfld1->} %{hfld2->} %{hfld3->} %{host->} %{hfld5}: %{hfld6}: %{hfld7}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ +var hdr13 = match("HEADER#24:0022", "message", "%{hfld1->} %{hfld2->} %{hfld3->} %{host->} %{hfld5}: %{hfld6}: %{hfld7}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ setc("header_id","0022"), dup17, dup18, ])); -var hdr14 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" -match("HEADER#25:0010", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ +var hdr14 = match("HEADER#25:0010", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} From %{hsensor->} at %{p0}", processor_chain([ setc("header_id","0010"), dup17, dup18, ])); -var part5 = // "Pattern{Constant('From '), Field(hsensor,true), Constant(' at'), Field(p0,false)}" -match("HEADER#26:0011/1_0", "nwparser.p0", "From %{hsensor->} at%{p0}"); +var part5 = match("HEADER#26:0011/1_0", "nwparser.p0", "From %{hsensor->} at%{p0}"); var select2 = linear_select([ part5, @@ -5072,8 +4984,7 @@ var all14 = all_match({ ]), }); -var part6 = // "Pattern{Field(fld10,true), Constant(' From '), Field(hsensor,true), Constant(' at'), Field(p0,false)}" -match("HEADER#27:0014/1_0", "nwparser.p0", "%{fld10->} From %{hsensor->} at%{p0}"); +var part6 = match("HEADER#27:0014/1_0", "nwparser.p0", "%{fld10->} From %{hsensor->} at%{p0}"); var select3 = linear_select([ part6, @@ -5092,8 +5003,7 @@ var all15 = all_match({ ]), }); -var hdr15 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(msgIdPart4,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" -match("HEADER#28:0012", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} From %{hsensor->} at %{p0}", processor_chain([ +var hdr15 = match("HEADER#28:0012", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} From %{hsensor->} at %{p0}", processor_chain([ setc("header_id","0012"), dup23, call({ @@ -5115,8 +5025,7 @@ match("HEADER#28:0012", "message", "%{month->} %{day->} %{time->} %{host->} %{hf }), ])); -var hdr16 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(msgIdPart4,true), Constant(' '), Field(hfld12,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" -match("HEADER#29:0016", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} %{hfld12->} From %{hsensor->} at %{p0}", processor_chain([ +var hdr16 = match("HEADER#29:0016", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{msgIdPart4->} %{hfld12->} From %{hsensor->} at %{p0}", processor_chain([ setc("header_id","0016"), dup23, call({ @@ -5140,72 +5049,60 @@ match("HEADER#29:0016", "message", "%{month->} %{day->} %{time->} %{host->} %{hf }), ])); -var hdr17 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' snort: '), Field(messageid,false), Constant(':'), Field(payload,false)}" -match("HEADER#30:0013", "message", "%{month->} %{day->} %{time->} %{host->} snort: %{messageid}:%{payload}", processor_chain([ +var hdr17 = match("HEADER#30:0013", "message", "%{month->} %{day->} %{time->} %{host->} snort: %{messageid}:%{payload}", processor_chain([ setc("header_id","0013"), ])); -var hdr18 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': HMNOTIFY: '), Field(payload,false)}" -match("HEADER#31:0020", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: HMNOTIFY: %{payload}", processor_chain([ +var hdr18 = match("HEADER#31:0020", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: HMNOTIFY: %{payload}", processor_chain([ setc("header_id","0020"), dup24, ])); -var hdr19 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' : HMNOTIFY: '), Field(payload,false)}" -match("HEADER#32:0035", "message", "%{month->} %{day->} %{time->} %{host->} : HMNOTIFY: %{payload}", processor_chain([ +var hdr19 = match("HEADER#32:0035", "message", "%{month->} %{day->} %{time->} %{host->} : HMNOTIFY: %{payload}", processor_chain([ setc("header_id","0035"), dup24, ])); -var hdr20 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hsigid,false), Constant(':'), Field(hversion,false), Constant('] "'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#33:0017", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] \"%{messageid->} %{p0}", processor_chain([ +var hdr20 = match("HEADER#33:0017", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] \"%{messageid->} %{p0}", processor_chain([ setc("header_id","0017"), dup15, ])); -var hdr21 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(fld,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hsigid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#34:0019", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] %{messageid->} %{p0}", processor_chain([ +var hdr21 = match("HEADER#34:0019", "message", "%{month->} %{day->} %{time->} %{host->} %{fld}: [%{hevent_source}:%{hsigid}:%{hversion}] %{messageid->} %{p0}", processor_chain([ setc("header_id","0019"), dup15, ])); -var hdr22 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hostname,true), Constant(' '), Field(hfld1,false), Constant(': [Primary Detection Engine'), Field(payload,false)}" -match("HEADER#35:0041", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine%{payload}", processor_chain([ +var hdr22 = match("HEADER#35:0041", "message", "%{month->} %{day->} %{time->} %{hostname->} %{hfld1}: [Primary Detection Engine%{payload}", processor_chain([ setc("header_id","0041"), dup16, ])); -var hdr23 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': Protocol: '), Field(hprotocol,false), Constant(', '), Field(payload,false)}" -match("HEADER#36:0045", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Protocol: %{hprotocol}, %{payload}", processor_chain([ +var hdr23 = match("HEADER#36:0045", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Protocol: %{hprotocol}, %{payload}", processor_chain([ setc("header_id","0045"), setc("messageid","connection_events"), ])); -var hdr24 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(hfld4,true), Constant(' '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" -match("HEADER#37:0042", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{hfld4->} %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ +var hdr24 = match("HEADER#37:0042", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{hfld4->} %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ setc("header_id","0042"), dup25, ])); -var hdr25 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hfld5,false), Constant('] '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" -match("HEADER#38:00212", "message", "%{month->} %{day->} %{time->} %{hfld1}: [%{hfld5}] %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ +var hdr25 = match("HEADER#38:00212", "message", "%{month->} %{day->} %{time->} %{hfld1}: [%{hfld5}] %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ setc("header_id","00212"), dup25, ])); -var hdr26 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(hfld1,false), Constant(': '), Field(host,false), Constant(': '), Field(hfld3,false), Constant('@'), Field(hfld2,false), Constant(', '), Field(payload,false)}" -match("HEADER#39:0021", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ +var hdr26 = match("HEADER#39:0021", "message", "%{month->} %{day->} %{time->} %{hfld1}: %{host}: %{hfld3}@%{hfld2}, %{payload}", processor_chain([ setc("header_id","0021"), dup25, ])); -var hdr27 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(payload,false)}" -match("HEADER#40:0029", "message", "%{month->} %{day->} %{time->} %{host}: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ +var hdr27 = match("HEADER#40:0029", "message", "%{month->} %{day->} %{time->} %{host}: [%{hevent_source}:%{messageid}:%{hversion}] %{payload}", processor_chain([ setc("header_id","0029"), ])); -var hdr28 = // "Pattern{Constant('snort'), Field(p0,false)}" -match("HEADER#41:0024/0", "message", "snort%{p0}"); +var hdr28 = match("HEADER#41:0024/0", "message", "snort%{p0}"); var all16 = all_match({ processors: [ @@ -5219,8 +5116,7 @@ var all16 = all_match({ ]), }); -var hdr29 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort'), Field(p0,false)}" -match("HEADER#42:0025/0", "message", "%{month->} %{day->} %{time->} snort%{p0}"); +var hdr29 = match("HEADER#42:0025/0", "message", "%{month->} %{day->} %{time->} snort%{p0}"); var all17 = all_match({ processors: [ @@ -5234,8 +5130,7 @@ var all17 = all_match({ ]), }); -var part7 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#43:0023/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var part7 = match("HEADER#43:0023/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); var all18 = all_match({ processors: [ @@ -5249,8 +5144,7 @@ var all18 = all_match({ ]), }); -var part8 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#44:0026/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var part8 = match("HEADER#44:0026/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); var all19 = all_match({ processors: [ @@ -5288,8 +5182,7 @@ var all21 = all_match({ ]), }); -var hdr30 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': Sha256:'), Field(hfld2,true), Constant(' Disposition: Malware'), Field(p0,false)}" -match("HEADER#47:0040", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Sha256:%{hfld2->} Disposition: Malware%{p0}", processor_chain([ +var hdr30 = match("HEADER#47:0040", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: Sha256:%{hfld2->} Disposition: Malware%{p0}", processor_chain([ setc("header_id","0040"), setc("messageid","MALWARE"), call({ @@ -5303,8 +5196,7 @@ match("HEADER#47:0040", "message", "%{month->} %{day->} %{time->} %{host->} %{hf }), ])); -var hdr31 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' From '), Field(hsensor,true), Constant(' at '), Field(p0,false)}" -match("HEADER#48:0043", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} From %{hsensor->} at %{p0}", processor_chain([ +var hdr31 = match("HEADER#48:0043", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} From %{hsensor->} at %{p0}", processor_chain([ setc("header_id","0043"), dup22, call({ @@ -5324,27 +5216,22 @@ match("HEADER#48:0043", "message", "%{month->} %{day->} %{time->} %{host->} %{hf }), ])); -var hdr32 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(messageid,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" -match("HEADER#49:0044", "message", "%{month->} %{day->} %{time->} %{host->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ +var hdr32 = match("HEADER#49:0044", "message", "%{month->} %{day->} %{time->} %{host->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ setc("header_id","0044"), ])); -var hdr33 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(hyear,true), Constant(' '), Field(time,true), Constant(' '), Field(p0,false)}" -match("HEADER#50:0057/0", "message", "%{month->} %{day->} %{hyear->} %{time->} %{p0}"); +var hdr33 = match("HEADER#50:0057/0", "message", "%{month->} %{day->} %{hyear->} %{time->} %{p0}"); -var part9 = // "Pattern{Field(hostname,false), Constant(': %FTD-'), Field(p0,false)}" -match("HEADER#50:0057/1_0", "nwparser.p0", "%{hostname}: %FTD-%{p0}"); +var part9 = match("HEADER#50:0057/1_0", "nwparser.p0", "%{hostname}: %FTD-%{p0}"); -var part10 = // "Pattern{Field(hostname,true), Constant(' %FTD-'), Field(p0,false)}" -match("HEADER#50:0057/1_1", "nwparser.p0", "%{hostname->} %FTD-%{p0}"); +var part10 = match("HEADER#50:0057/1_1", "nwparser.p0", "%{hostname->} %FTD-%{p0}"); var select4 = linear_select([ part9, part10, ]); -var part11 = // "Pattern{Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" -match("HEADER#50:0057/2", "nwparser.p0", "%{fld2}-%{hfld3}:%{payload}"); +var part11 = match("HEADER#50:0057/2", "nwparser.p0", "%{fld2}-%{hfld3}:%{payload}"); var all22 = all_match({ processors: [ @@ -5358,8 +5245,7 @@ var all22 = all_match({ ]), }); -var hdr34 = // "Pattern{Field(hyear,false), Constant('-'), Field(hmonth,false), Constant('-'), Field(day,false), Constant('T'), Field(time,false), Constant('Z '), Field(hostname,true), Constant(' %FTD-'), Field(fld2,false), Constant('-'), Field(hfld3,false), Constant(':'), Field(payload,false)}" -match("HEADER#51:0058", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ +var hdr34 = match("HEADER#51:0058", "message", "%{hyear}-%{hmonth}-%{day}T%{time}Z %{hostname->} %FTD-%{fld2}-%{hfld3}:%{payload}", processor_chain([ setc("header_id","0058"), dup1, ])); @@ -5419,8 +5305,7 @@ var select5 = linear_select([ hdr34, ]); -var part12 = // "Pattern{Field(event_type,true), Constant(' (Sensor '), Field(sensor,false), Constant('): Severity:'), Field(severity,false), Constant(': '), Field(result,false)}" -match("MESSAGE#0:HMNOTIFY", "nwparser.payload", "%{event_type->} (Sensor %{sensor}): Severity:%{severity}: %{result}", processor_chain([ +var part12 = match("MESSAGE#0:HMNOTIFY", "nwparser.payload", "%{event_type->} (Sensor %{sensor}): Severity:%{severity}: %{result}", processor_chain([ setc("eventcategory","1604000000"), dup31, dup32, @@ -95633,17 +95518,13 @@ var all66 = all_match({ var msg38452 = msg("snort-sid-template", all66); -var part13 = // "Pattern{Constant('PORTSCAN DETECTED from '), Field(p0,false)}" -match("MESSAGE#38452:spp_portscan/0", "nwparser.payload", "PORTSCAN DETECTED from %{p0}"); +var part13 = match("MESSAGE#38452:spp_portscan/0", "nwparser.payload", "PORTSCAN DETECTED from %{p0}"); -var part14 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(')(THRESHOLD '), Field(p0,false)}" -match("MESSAGE#38452:spp_portscan/1_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src})(THRESHOLD %{p0}"); +var part14 = match("MESSAGE#38452:spp_portscan/1_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src})(THRESHOLD %{p0}"); -var part15 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,false), Constant('(THRESHOLD '), Field(p0,false)}" -match("MESSAGE#38452:spp_portscan/1_1", "nwparser.p0", "%{saddr}:%{sport}(THRESHOLD %{p0}"); +var part15 = match("MESSAGE#38452:spp_portscan/1_1", "nwparser.p0", "%{saddr}:%{sport}(THRESHOLD %{p0}"); -var part16 = // "Pattern{Field(saddr,false), Constant('(THRESHOLD '), Field(p0,false)}" -match("MESSAGE#38452:spp_portscan/1_2", "nwparser.p0", "%{saddr}(THRESHOLD %{p0}"); +var part16 = match("MESSAGE#38452:spp_portscan/1_2", "nwparser.p0", "%{saddr}(THRESHOLD %{p0}"); var select2444 = linear_select([ part14, @@ -95651,8 +95532,7 @@ var select2444 = linear_select([ part16, ]); -var part17 = // "Pattern{Field(dclass_counter1,true), Constant(' connections exceeded in '), Field(duration,true), Constant(' seconds)')}" -match("MESSAGE#38452:spp_portscan/2", "nwparser.p0", "%{dclass_counter1->} connections exceeded in %{duration->} seconds)"); +var part17 = match("MESSAGE#38452:spp_portscan/2", "nwparser.p0", "%{dclass_counter1->} connections exceeded in %{duration->} seconds)"); var all67 = all_match({ processors: [ @@ -95676,8 +95556,7 @@ var all67 = all_match({ var msg38453 = msg("spp_portscan", all67); -var part18 = // "Pattern{Constant('portscan status from '), Field(saddr,false), Constant(': '), Field(dclass_counter1,true), Constant(' connections across '), Field(fld1,true), Constant(' hosts: '), Field(fld2,false), Constant(', '), Field(fld3,false)}" -match("MESSAGE#38453:spp_portscan:01", "nwparser.payload", "portscan status from %{saddr}: %{dclass_counter1->} connections across %{fld1->} hosts: %{fld2}, %{fld3}", processor_chain([ +var part18 = match("MESSAGE#38453:spp_portscan:01", "nwparser.payload", "portscan status from %{saddr}: %{dclass_counter1->} connections across %{fld1->} hosts: %{fld2}, %{fld3}", processor_chain([ dup61, dup31, dup32, @@ -95692,8 +95571,7 @@ match("MESSAGE#38453:spp_portscan:01", "nwparser.payload", "portscan status from var msg38454 = msg("spp_portscan:01", part18); -var part19 = // "Pattern{Constant('End of portscan from '), Field(saddr,false), Constant(': TOTAL time('), Field(fld1,false), Constant(') hosts('), Field(fld2,false), Constant(') '), Field(fld3,true), Constant(' '), Field(fld4,false)}" -match("MESSAGE#38454:spp_portscan:02", "nwparser.payload", "End of portscan from %{saddr}: TOTAL time(%{fld1}) hosts(%{fld2}) %{fld3->} %{fld4}", processor_chain([ +var part19 = match("MESSAGE#38454:spp_portscan:02", "nwparser.payload", "End of portscan from %{saddr}: TOTAL time(%{fld1}) hosts(%{fld2}) %{fld3->} %{fld4}", processor_chain([ dup61, dup31, dup32, @@ -95716,8 +95594,7 @@ var select2445 = linear_select([ msg38456, ]); -var part20 = // "Pattern{Constant('Portscan detected from '), Field(saddr,true), Constant(' Talker('), Field(fld1,false), Constant(') Scanner('), Field(fld2,false), Constant(')')}" -match("MESSAGE#38456:Portscan", "nwparser.payload", "Portscan detected from %{saddr->} Talker(%{fld1}) Scanner(%{fld2})", processor_chain([ +var part20 = match("MESSAGE#38456:Portscan", "nwparser.payload", "Portscan detected from %{saddr->} Talker(%{fld1}) Scanner(%{fld2})", processor_chain([ dup61, dup31, dup32, @@ -95725,8 +95602,7 @@ match("MESSAGE#38456:Portscan", "nwparser.payload", "Portscan detected from %{sa var msg38457 = msg("Portscan", part20); -var part21 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Hops: '), Field(result,false)}" -match("MESSAGE#38457:Hops_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Hops: %{result}", processor_chain([ +var part21 = match("MESSAGE#38457:Hops_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Hops: %{result}", processor_chain([ dup127, dup31, dup32, @@ -95740,8 +95616,7 @@ var msg38459 = msg("MAC_Information_Change", dup354); var msg38460 = msg("Additional_MAC_Detected_for", dup354); -var part22 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' NETBIOS Name: '), Field(result,false)}" -match("MESSAGE#38460:NETBIOS_Name_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} NETBIOS Name: %{result}", processor_chain([ +var part22 = match("MESSAGE#38460:NETBIOS_Name_Change", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} NETBIOS Name: %{result}", processor_chain([ dup127, dup31, dup32, @@ -95751,19 +95626,16 @@ match("MESSAGE#38460:NETBIOS_Name_Change", "nwparser.payload", "%{context->} Fro var msg38461 = msg("NETBIOS_Name_Change", part22); -var part23 = // "Pattern{Constant('MAC Address: '), Field(smacaddr,true), Constant(' Host Type: '), Field(p0,false)}" -match("MESSAGE#38461:New_Host/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Host Type: %{p0}"); +var part23 = match("MESSAGE#38461:New_Host/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Host Type: %{p0}"); -var part24 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Host Type: '), Field(p0,false)}" -match("MESSAGE#38461:New_Host/1_1", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{p0}"); +var part24 = match("MESSAGE#38461:New_Host/1_1", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{p0}"); var select2446 = linear_select([ part23, part24, ]); -var part25 = // "Pattern{Field(fld7,false)}" -match_copy("MESSAGE#38461:New_Host/2", "nwparser.p0", "fld7"); +var part25 = match_copy("MESSAGE#38461:New_Host/2", "nwparser.p0", "fld7"); var all68 = all_match({ processors: [ @@ -95782,11 +95654,9 @@ var all68 = all_match({ var msg38462 = msg("New_Host", all68); -var part26 = // "Pattern{Constant('MAC Address: '), Field(smacaddr,true), Constant(' Network Protocol: '), Field(p0,false)}" -match("MESSAGE#38462:New_Network_Protocol/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Network Protocol: %{p0}"); +var part26 = match("MESSAGE#38462:New_Network_Protocol/1_0", "nwparser.p0", "MAC Address: %{smacaddr->} Network Protocol: %{p0}"); -var part27 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Network Protocol: '), Field(p0,false)}" -match("MESSAGE#38462:New_Network_Protocol/1_1", "nwparser.p0", "IP Address: %{saddr->} Network Protocol: %{p0}"); +var part27 = match("MESSAGE#38462:New_Network_Protocol/1_1", "nwparser.p0", "IP Address: %{saddr->} Network Protocol: %{p0}"); var select2447 = linear_select([ part26, @@ -95810,8 +95680,7 @@ var all69 = all_match({ var msg38463 = msg("New_Network_Protocol", all69); -var part28 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(protocol,false)}" -match("MESSAGE#38463:New_UDP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{protocol}", processor_chain([ +var part28 = match("MESSAGE#38463:New_UDP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{protocol}", processor_chain([ dup135, dup31, dup32, @@ -95821,8 +95690,7 @@ match("MESSAGE#38463:New_UDP_Service", "nwparser.payload", "%{context->} From \" var msg38464 = msg("New_UDP_Service", part28); -var part29 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Transport Protocol: '), Field(protocol,false)}" -match("MESSAGE#38464:New_Transport_Protocol", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Transport Protocol: %{protocol}", processor_chain([ +var part29 = match("MESSAGE#38464:New_Transport_Protocol", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Transport Protocol: %{protocol}", processor_chain([ dup135, dup31, dup32, @@ -95838,8 +95706,7 @@ var msg38467 = msg("OS_Information_Update", dup183); var msg38468 = msg("TCP_Service_Confidence_Update", dup184); -var part30 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" -match("MESSAGE#38468:TCP_Service_Information_Update/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); +var part30 = match("MESSAGE#38468:TCP_Service_Information_Update/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); var all70 = all_match({ processors: [ @@ -95857,8 +95724,7 @@ var all70 = all_match({ var msg38469 = msg("TCP_Service_Information_Update", all70); -var part31 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> MAC Address: '), Field(saddr,true), Constant(' VLAN ID: '), Field(sport,true), Constant(' Type: '), Field(protocol,true), Constant(' Priority: '), Field(threat_val,false)}" -match("MESSAGE#38469:VLAN_Tag_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> MAC Address: %{saddr->} VLAN ID: %{sport->} Type: %{protocol->} Priority: %{threat_val}", processor_chain([ +var part31 = match("MESSAGE#38469:VLAN_Tag_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> MAC Address: %{saddr->} VLAN ID: %{sport->} Type: %{protocol->} Priority: %{threat_val}", processor_chain([ dup135, dup31, dup32, @@ -95869,14 +95735,11 @@ match("MESSAGE#38469:VLAN_Tag_Information_Update", "nwparser.payload", "%{contex var msg38470 = msg("VLAN_Tag_Information_Update", part31); -var part32 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(p0,false)}" -match("MESSAGE#38470:New_OS/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{p0}"); +var part32 = match("MESSAGE#38470:New_OS/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{p0}"); -var part33 = // "Pattern{Field(os,true), Constant(' Device Info: '), Field(fld7,false)}" -match("MESSAGE#38470:New_OS/1_0", "nwparser.p0", "%{os->} Device Info: %{fld7}"); +var part33 = match("MESSAGE#38470:New_OS/1_0", "nwparser.p0", "%{os->} Device Info: %{fld7}"); -var part34 = // "Pattern{Field(os,false)}" -match_copy("MESSAGE#38470:New_OS/1_1", "nwparser.p0", "os"); +var part34 = match_copy("MESSAGE#38470:New_OS/1_1", "nwparser.p0", "os"); var select2448 = linear_select([ part33, @@ -95909,8 +95772,7 @@ var msg38475 = msg("TCP_Port_Closed", dup187); var msg38476 = msg("TCP_Port_Timeout", dup188); -var part35 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' web browser '), Field(application,false)}" -match("MESSAGE#38476:Client_Application_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} web browser %{application}", processor_chain([ +var part35 = match("MESSAGE#38476:Client_Application_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} web browser %{application}", processor_chain([ dup135, dup31, dup32, @@ -95922,8 +95784,7 @@ var msg38477 = msg("Client_Application_Timeout", part35); var msg38478 = msg("Host_Timeout", dup188); -var part36 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS'), Field(os,false)}" -match("MESSAGE#38478:Identity_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS%{os}", processor_chain([ +var part36 = match("MESSAGE#38478:Identity_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS%{os}", processor_chain([ dup135, dup31, dup32, @@ -95933,22 +95794,18 @@ match("MESSAGE#38478:Identity_Timeout", "nwparser.payload", "%{context->} From % var msg38479 = msg("Identity_Timeout", part36); -var part37 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Serv'), Field(p0,false)}" -match("MESSAGE#38479:Identity_Timeout:01/0", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Serv%{p0}"); +var part37 = match("MESSAGE#38479:Identity_Timeout:01/0", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Serv%{p0}"); -var part38 = // "Pattern{Constant('ice'), Field(p0,false)}" -match("MESSAGE#38479:Identity_Timeout:01/1_0", "nwparser.p0", "ice%{p0}"); +var part38 = match("MESSAGE#38479:Identity_Timeout:01/1_0", "nwparser.p0", "ice%{p0}"); -var part39 = // "Pattern{Constant('er'), Field(p0,false)}" -match("MESSAGE#38479:Identity_Timeout:01/1_1", "nwparser.p0", "er%{p0}"); +var part39 = match("MESSAGE#38479:Identity_Timeout:01/1_1", "nwparser.p0", "er%{p0}"); var select2449 = linear_select([ part38, part39, ]); -var part40 = // "Pattern{Field(,false), Constant('port: '), Field(sport,false), Constant('/'), Field(protocol,true), Constant(' '), Field(network_service,false)}" -match("MESSAGE#38479:Identity_Timeout:01/2", "nwparser.p0", "%{}port: %{sport}/%{protocol->} %{network_service}"); +var part40 = match("MESSAGE#38479:Identity_Timeout:01/2", "nwparser.p0", "%{}port: %{sport}/%{protocol->} %{network_service}"); var all72 = all_match({ processors: [ @@ -95976,8 +95833,7 @@ var msg38481 = msg("UDP_Port_Timeout", dup188); var msg38482 = msg("UDP_Service_Confidence_Update", dup184); -var part41 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,true), Constant(' Subtypes: '), Field(fld1,false)}" -match("MESSAGE#38482:UDP_Service_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result->} Subtypes: %{fld1}", processor_chain([ +var part41 = match("MESSAGE#38482:UDP_Service_Information_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result->} Subtypes: %{fld1}", processor_chain([ dup135, dup31, dup32, @@ -95994,17 +95850,13 @@ var select2451 = linear_select([ msg38484, ]); -var part42 = // "Pattern{Field(context,true), Constant(' ['), Field(p0,false)}" -match("MESSAGE#38484:EmergingThreats/0", "nwparser.payload", "%{context->} [%{p0}"); +var part42 = match("MESSAGE#38484:EmergingThreats/0", "nwparser.payload", "%{context->} [%{p0}"); -var part43 = // "Pattern{Constant('Impact: '), Field(result,false), Constant('] From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(p0,false)}" -match("MESSAGE#38484:EmergingThreats/1_0", "nwparser.p0", "Impact: %{result}] From \"%{sensor}\" at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{p0}"); +var part43 = match("MESSAGE#38484:EmergingThreats/1_0", "nwparser.p0", "Impact: %{result}] From \"%{sensor}\" at %{fld6->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{p0}"); -var part44 = // "Pattern{Constant('Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(p0,false)}" -match("MESSAGE#38484:EmergingThreats/1_1", "nwparser.p0", "Classification: %{sigtype}] [Priority: %{p0}"); +var part44 = match("MESSAGE#38484:EmergingThreats/1_1", "nwparser.p0", "Classification: %{sigtype}] [Priority: %{p0}"); -var part45 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(p0,false)}" -match("MESSAGE#38484:EmergingThreats/1_2", "nwparser.p0", "%{info}] [Priority: %{p0}"); +var part45 = match("MESSAGE#38484:EmergingThreats/1_2", "nwparser.p0", "%{info}] [Priority: %{p0}"); var select2452 = linear_select([ part43, @@ -96012,8 +95864,7 @@ var select2452 = linear_select([ part45, ]); -var part46 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" -match("MESSAGE#38484:EmergingThreats/2", "nwparser.p0", "%{threat_val->} ]%{p0}"); +var part46 = match("MESSAGE#38484:EmergingThreats/2", "nwparser.p0", "%{threat_val->} ]%{p0}"); var all73 = all_match({ processors: [ @@ -96043,8 +95894,7 @@ var all73 = all_match({ var msg38485 = msg("EmergingThreats", all73); -var part47 = // "Pattern{Constant('Pruned session from cache that was using '), Field(bytes,true), Constant(' bytes ('), Field(result,false), Constant('). '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' --> '), Field(daddr,true), Constant(' '), Field(fld2,true), Constant(' ('), Field(fld3,false), Constant(') : '), Field(info,false)}" -match("MESSAGE#38485:S5", "nwparser.payload", "Pruned session from cache that was using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ +var part47 = match("MESSAGE#38485:S5", "nwparser.payload", "Pruned session from cache that was using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ dup127, dup31, dup32, @@ -96052,8 +95902,7 @@ match("MESSAGE#38485:S5", "nwparser.payload", "Pruned session from cache that wa var msg38486 = msg("S5", part47); -var part48 = // "Pattern{Constant('Session exceeded configured max bytes to queue '), Field(fld4,true), Constant(' using '), Field(bytes,true), Constant(' bytes ('), Field(result,false), Constant('). '), Field(saddr,true), Constant(' '), Field(fld1,true), Constant(' --> '), Field(daddr,true), Constant(' '), Field(fld2,true), Constant(' ('), Field(fld3,false), Constant(') : '), Field(info,false)}" -match("MESSAGE#38486:S5:01", "nwparser.payload", "Session exceeded configured max bytes to queue %{fld4->} using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ +var part48 = match("MESSAGE#38486:S5:01", "nwparser.payload", "Session exceeded configured max bytes to queue %{fld4->} using %{bytes->} bytes (%{result}). %{saddr->} %{fld1->} --> %{daddr->} %{fld2->} (%{fld3}) : %{info}", processor_chain([ dup127, dup31, dup32, @@ -96066,8 +95915,7 @@ var select2453 = linear_select([ msg38487, ]); -var part49 = // "Pattern{Constant('Login, Login Success'), Field(,false)}" -match("MESSAGE#38487:SystemSettings:01", "nwparser.payload", "Login, Login Success%{}", processor_chain([ +var part49 = match("MESSAGE#38487:SystemSettings:01", "nwparser.payload", "Login, Login Success%{}", processor_chain([ dup112, dup31, dup32, @@ -96083,8 +95931,7 @@ match("MESSAGE#38487:SystemSettings:01", "nwparser.payload", "Login, Login Succe var msg38488 = msg("SystemSettings:01", part49); -var part50 = // "Pattern{Constant('Logout, Logout Success'), Field(,false)}" -match("MESSAGE#38488:SystemSettings:02", "nwparser.payload", "Logout, Logout Success%{}", processor_chain([ +var part50 = match("MESSAGE#38488:SystemSettings:02", "nwparser.payload", "Logout, Logout Success%{}", processor_chain([ setc("eventcategory","1802000000"), dup31, dup32, @@ -96100,8 +95947,7 @@ match("MESSAGE#38488:SystemSettings:02", "nwparser.payload", "Logout, Logout Suc var msg38489 = msg("SystemSettings:02", part50); -var part51 = // "Pattern{Constant('System > '), Field(info,false)}" -match("MESSAGE#38489:SystemSettings:03", "nwparser.payload", "System > %{info}", processor_chain([ +var part51 = match("MESSAGE#38489:SystemSettings:03", "nwparser.payload", "System > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96114,8 +95960,7 @@ match("MESSAGE#38489:SystemSettings:03", "nwparser.payload", "System > %{info}", var msg38490 = msg("SystemSettings:03", part51); -var part52 = // "Pattern{Constant('Policies > '), Field(info,false)}" -match("MESSAGE#38490:SystemSettings:04", "nwparser.payload", "Policies > %{info}", processor_chain([ +var part52 = match("MESSAGE#38490:SystemSettings:04", "nwparser.payload", "Policies > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96128,8 +95973,7 @@ match("MESSAGE#38490:SystemSettings:04", "nwparser.payload", "Policies > %{info} var msg38491 = msg("SystemSettings:04", part52); -var part53 = // "Pattern{Constant('Object > '), Field(info,false)}" -match("MESSAGE#38491:SystemSettings:05", "nwparser.payload", "Object > %{info}", processor_chain([ +var part53 = match("MESSAGE#38491:SystemSettings:05", "nwparser.payload", "Object > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96141,8 +95985,7 @@ match("MESSAGE#38491:SystemSettings:05", "nwparser.payload", "Object > %{info}", var msg38492 = msg("SystemSettings:05", part53); -var part54 = // "Pattern{Constant('Overview > '), Field(info,false)}" -match("MESSAGE#38492:SystemSettings:06", "nwparser.payload", "Overview > %{info}", processor_chain([ +var part54 = match("MESSAGE#38492:SystemSettings:06", "nwparser.payload", "Overview > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96154,8 +95997,7 @@ match("MESSAGE#38492:SystemSettings:06", "nwparser.payload", "Overview > %{info} var msg38493 = msg("SystemSettings:06", part54); -var part55 = // "Pattern{Constant('Task Queue, '), Field(info,false)}" -match("MESSAGE#38493:SystemSettings:07", "nwparser.payload", "Task Queue, %{info}", processor_chain([ +var part55 = match("MESSAGE#38493:SystemSettings:07", "nwparser.payload", "Task Queue, %{info}", processor_chain([ dup127, dup31, dup32, @@ -96168,8 +96010,7 @@ match("MESSAGE#38493:SystemSettings:07", "nwparser.payload", "Task Queue, %{info var msg38494 = msg("SystemSettings:07", part55); -var part56 = // "Pattern{Constant('Intrusion Policy > '), Field(info,false)}" -match("MESSAGE#38494:SystemSettings:08", "nwparser.payload", "Intrusion Policy > %{info}", processor_chain([ +var part56 = match("MESSAGE#38494:SystemSettings:08", "nwparser.payload", "Intrusion Policy > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96182,19 +96023,16 @@ match("MESSAGE#38494:SystemSettings:08", "nwparser.payload", "Intrusion Policy > var msg38495 = msg("SystemSettings:08", part56); -var part57 = // "Pattern{Constant('Analysis & Reporting '), Field(p0,false)}" -match("MESSAGE#38495:SystemSettings:09/0", "nwparser.payload", "Analysis \u0026 Reporting %{p0}"); +var part57 = match("MESSAGE#38495:SystemSettings:09/0", "nwparser.payload", "Analysis \u0026 Reporting %{p0}"); -var part58 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#38495:SystemSettings:09/1_1", "nwparser.p0", ",%{p0}"); +var part58 = match("MESSAGE#38495:SystemSettings:09/1_1", "nwparser.p0", ",%{p0}"); var select2454 = linear_select([ dup145, part58, ]); -var part59 = // "Pattern{Field(,true), Constant(' '), Field(info,false)}" -match("MESSAGE#38495:SystemSettings:09/2", "nwparser.p0", "%{} %{info}"); +var part59 = match("MESSAGE#38495:SystemSettings:09/2", "nwparser.p0", "%{} %{info}"); var all74 = all_match({ processors: [ @@ -96216,8 +96054,7 @@ var all74 = all_match({ var msg38496 = msg("SystemSettings:09", all74); -var part60 = // "Pattern{Constant('Heartbeat, '), Field(info,false)}" -match("MESSAGE#38496:SystemSettings:10", "nwparser.payload", "Heartbeat, %{info}", processor_chain([ +var part60 = match("MESSAGE#38496:SystemSettings:10", "nwparser.payload", "Heartbeat, %{info}", processor_chain([ dup127, dup31, dup32, @@ -96230,8 +96067,7 @@ match("MESSAGE#38496:SystemSettings:10", "nwparser.payload", "Heartbeat, %{info} var msg38497 = msg("SystemSettings:10", part60); -var part61 = // "Pattern{Constant('FailD, '), Field(info,false)}" -match("MESSAGE#38497:SystemSettings:11", "nwparser.payload", "FailD, %{info}", processor_chain([ +var part61 = match("MESSAGE#38497:SystemSettings:11", "nwparser.payload", "FailD, %{info}", processor_chain([ dup127, dup31, dup32, @@ -96243,8 +96079,7 @@ match("MESSAGE#38497:SystemSettings:11", "nwparser.payload", "FailD, %{info}", p var msg38498 = msg("SystemSettings:11", part61); -var part62 = // "Pattern{Constant('Health > '), Field(info,false)}" -match("MESSAGE#38498:SystemSettings:12", "nwparser.payload", "Health > %{info}", processor_chain([ +var part62 = match("MESSAGE#38498:SystemSettings:12", "nwparser.payload", "Health > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96257,8 +96092,7 @@ match("MESSAGE#38498:SystemSettings:12", "nwparser.payload", "Health > %{info}", var msg38499 = msg("SystemSettings:12", part62); -var part63 = // "Pattern{Constant('Session Expiration, '), Field(info,false)}" -match("MESSAGE#38499:SystemSettings:13", "nwparser.payload", "Session Expiration, %{info}", processor_chain([ +var part63 = match("MESSAGE#38499:SystemSettings:13", "nwparser.payload", "Session Expiration, %{info}", processor_chain([ dup127, dup31, dup32, @@ -96271,8 +96105,7 @@ match("MESSAGE#38499:SystemSettings:13", "nwparser.payload", "Session Expiration var msg38500 = msg("SystemSettings:13", part63); -var part64 = // "Pattern{Constant('Analysis '), Field(info,false)}" -match("MESSAGE#38500:SystemSettings:14", "nwparser.payload", "Analysis %{info}", processor_chain([ +var part64 = match("MESSAGE#38500:SystemSettings:14", "nwparser.payload", "Analysis %{info}", processor_chain([ dup127, dup31, dup32, @@ -96285,8 +96118,7 @@ match("MESSAGE#38500:SystemSettings:14", "nwparser.payload", "Analysis %{info}", var msg38501 = msg("SystemSettings:14", part64); -var part65 = // "Pattern{Constant('Devices '), Field(info,false)}" -match("MESSAGE#38501:SystemSettings:15", "nwparser.payload", "Devices %{info}", processor_chain([ +var part65 = match("MESSAGE#38501:SystemSettings:15", "nwparser.payload", "Devices %{info}", processor_chain([ dup127, dup31, dup32, @@ -96299,8 +96131,7 @@ match("MESSAGE#38501:SystemSettings:15", "nwparser.payload", "Devices %{info}", var msg38502 = msg("SystemSettings:15", part65); -var part66 = // "Pattern{Constant('Intrusion Events,'), Field(info,false)}" -match("MESSAGE#38502:SystemSettings:16", "nwparser.payload", "Intrusion Events,%{info}", processor_chain([ +var part66 = match("MESSAGE#38502:SystemSettings:16", "nwparser.payload", "Intrusion Events,%{info}", processor_chain([ dup127, dup31, dup32, @@ -96313,8 +96144,7 @@ match("MESSAGE#38502:SystemSettings:16", "nwparser.payload", "Intrusion Events,% var msg38503 = msg("SystemSettings:16", part66); -var part67 = // "Pattern{Constant('Login, Login Failed'), Field(,false)}" -match("MESSAGE#38503:SystemSettings:17", "nwparser.payload", "Login, Login Failed%{}", processor_chain([ +var part67 = match("MESSAGE#38503:SystemSettings:17", "nwparser.payload", "Login, Login Failed%{}", processor_chain([ dup91, dup31, dup137, @@ -96331,8 +96161,7 @@ match("MESSAGE#38503:SystemSettings:17", "nwparser.payload", "Login, Login Faile var msg38504 = msg("SystemSettings:17", part67); -var part68 = // "Pattern{Constant('Command Line,'), Field(info,false)}" -match("MESSAGE#38504:SystemSettings:18", "nwparser.payload", "Command Line,%{info}", processor_chain([ +var part68 = match("MESSAGE#38504:SystemSettings:18", "nwparser.payload", "Command Line,%{info}", processor_chain([ dup127, dup31, dup32, @@ -96344,8 +96173,7 @@ match("MESSAGE#38504:SystemSettings:18", "nwparser.payload", "Command Line,%{inf var msg38505 = msg("SystemSettings:18", part68); -var part69 = // "Pattern{Constant('Access Control Policy > '), Field(info,false)}" -match("MESSAGE#38505:SystemSettings:19", "nwparser.payload", "Access Control Policy > %{info}", processor_chain([ +var part69 = match("MESSAGE#38505:SystemSettings:19", "nwparser.payload", "Access Control Policy > %{info}", processor_chain([ dup127, dup31, dup32, @@ -96357,8 +96185,7 @@ match("MESSAGE#38505:SystemSettings:19", "nwparser.payload", "Access Control Pol var msg38506 = msg("SystemSettings:19", part69); -var part70 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#38506:SystemSettings:20", "nwparser.payload", "info", processor_chain([ +var part70 = match_copy("MESSAGE#38506:SystemSettings:20", "nwparser.payload", "info", processor_chain([ dup127, dup31, dup32, @@ -96407,8 +96234,7 @@ var msg38513 = msg("2101867", dup192); var msg38514 = msg("2101918", dup192); -var part71 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(sbytes,false), Constant(', Context: '), Field(context,false), Constant(', SSL Rule Name: '), Field(fld9,false), Constant(', SSL Flow Status: '), Field(fld10,false), Constant(', SSL Cipher Suite: '), Field(fld11,false), Constant(', SSL Certificate: '), Field(fld12,false), Constant(', SSL Subject CN: '), Field(fld13,false), Constant(', SSL Subject Country: '), Field(fld14,false), Constant(', SSL Subject OU: '), Field(fld15,false), Constant(', SSL Subject Org: '), Field(fld16,false), Constant(', SSL Issuer CN: '), Field(fld17,false), Constant(', SSL Issuer Country: '), Field(fld18,false), Constant(', SSL Issuer OU: '), Field(fld19,false), Constant(', SSL Issuer Org: '), Field(fld20,false), Constant(', SSL Valid Start Date: '), Field(fld21,false), Constant(', SSL Valid End Date: '), Field(fld22,false), Constant(', SSL Version: '), Field(fld23,false), Constant(', SSL Server Certificate Status: '), Field(fld24,false), Constant(', SSL Actual Action: '), Field(fld25,false), Constant(', SSL Expected Action: '), Field(fld26,false), Constant(', SSL Server Name: '), Field(fld27,false), Constant(', SSL URL Category: '), Field(fld28,false), Constant(', SSL Session ID: '), Field(fld29,false), Constant(', SSL Ticket Id: '), Field(fld30,false), Constant(', {'), Field(protocol,false), Constant('} '), Field(saddr,true), Constant(' -> '), Field(daddr,false), Constant(', type:'), Field(event_type,false), Constant(', code:'), Field(event_description,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{saddr->} -> %{daddr}, type:%{event_type}, code:%{event_description}"); +var part71 = match("MESSAGE#38514:Primary_Detection_Engine/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{saddr->} -> %{daddr}, type:%{event_type}, code:%{event_description}"); var all75 = all_match({ processors: [ @@ -96428,8 +96254,7 @@ var all75 = all_match({ var msg38515 = msg("Primary_Detection_Engine", all75); -var part72 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(sbytes,false), Constant(', Context: '), Field(context,false), Constant(', SSL Rule Name: '), Field(fld9,false), Constant(', SSL Flow Status: '), Field(fld10,false), Constant(', SSL Cipher Suite: '), Field(fld11,false), Constant(', SSL Certificate: '), Field(fld12,false), Constant(', SSL Subject CN: '), Field(fld13,false), Constant(', SSL Subject Country: '), Field(fld14,false), Constant(', SSL Subject OU: '), Field(fld15,false), Constant(', SSL Subject Org: '), Field(fld16,false), Constant(', SSL Issuer CN: '), Field(fld17,false), Constant(', SSL Issuer Country: '), Field(fld18,false), Constant(', SSL Issuer OU: '), Field(fld19,false), Constant(', SSL Issuer Org: '), Field(fld20,false), Constant(', SSL Valid Start Date: '), Field(fld21,false), Constant(', SSL Valid End Date: '), Field(fld22,false), Constant(', SSL Version: '), Field(fld23,false), Constant(', SSL Server Certificate Status: '), Field(fld24,false), Constant(', SSL Actual Action: '), Field(fld25,false), Constant(', SSL Expected Action: '), Field(fld26,false), Constant(', SSL Server Name: '), Field(fld27,false), Constant(', SSL URL Category: '), Field(fld28,false), Constant(', SSL Session ID: '), Field(fld29,false), Constant(', SSL Ticket Id: '), Field(fld30,false), Constant(', {'), Field(protocol,false), Constant('} '), Field(p0,false)}" -match("MESSAGE#38515:Primary_Detection_Engine:01/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{p0}"); +var part72 = match("MESSAGE#38515:Primary_Detection_Engine:01/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{sbytes}, Context: %{context}, SSL Rule Name: %{fld9}, SSL Flow Status: %{fld10}, SSL Cipher Suite: %{fld11}, SSL Certificate: %{fld12}, SSL Subject CN: %{fld13}, SSL Subject Country: %{fld14}, SSL Subject OU: %{fld15}, SSL Subject Org: %{fld16}, SSL Issuer CN: %{fld17}, SSL Issuer Country: %{fld18}, SSL Issuer OU: %{fld19}, SSL Issuer Org: %{fld20}, SSL Valid Start Date: %{fld21}, SSL Valid End Date: %{fld22}, SSL Version: %{fld23}, SSL Server Certificate Status: %{fld24}, SSL Actual Action: %{fld25}, SSL Expected Action: %{fld26}, SSL Server Name: %{fld27}, SSL URL Category: %{fld28}, SSL Session ID: %{fld29}, SSL Ticket Id: %{fld30}, {%{protocol}} %{p0}"); var all76 = all_match({ processors: [ @@ -96451,14 +96276,11 @@ var all76 = all_match({ var msg38516 = msg("Primary_Detection_Engine:01", all76); -var part73 = // "Pattern{Field(url,false), Constant(', Interface Ingress: '), Field(dinterface,false), Constant(', Interface Egress: '), Field(sinterface,false), Constant(', Security Zone Ingress: '), Field(dst_zone,false), Constant(', Security Zone Egress: '), Field(src_zone,false), Constant(', Security Intelligence Matching IP: '), Field(fld4,false), Constant(', Security Intelligence Category: '), Field(fld5,false), Constant(', Client Version: '), Field(version,false), Constant(', Number of File Events: '), Field(dclass_counter1,false), Constant(', Number of IPS Events: '), Field(dclass_counter2,false), Constant(', TCP Flags: '), Field(fld6,false), Constant(', NetBIOS Domain: '), Field(domain_id,false), Constant(', Initiator Packets: '), Field(fld7,false), Constant(', Responder Packets: '), Field(fld8,false), Constant(', Initiator Bytes: '), Field(rbytes,false), Constant(', Responder Bytes: '), Field(p0,false)}" -match("MESSAGE#38516:Primary_Detection_Engine:02/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{p0}"); +var part73 = match("MESSAGE#38516:Primary_Detection_Engine:02/2", "nwparser.p0", "%{url}, Interface Ingress: %{dinterface}, Interface Egress: %{sinterface}, Security Zone Ingress: %{dst_zone}, Security Zone Egress: %{src_zone}, Security Intelligence Matching IP: %{fld4}, Security Intelligence Category: %{fld5}, Client Version: %{version}, Number of File Events: %{dclass_counter1}, Number of IPS Events: %{dclass_counter2}, TCP Flags: %{fld6}, NetBIOS Domain: %{domain_id}, Initiator Packets: %{fld7}, Responder Packets: %{fld8}, Initiator Bytes: %{rbytes}, Responder Bytes: %{p0}"); -var part74 = // "Pattern{Field(sbytes,false), Constant(', Context: '), Field(context,true), Constant(' {'), Field(p0,false)}" -match("MESSAGE#38516:Primary_Detection_Engine:02/3_0", "nwparser.p0", "%{sbytes}, Context: %{context->} {%{p0}"); +var part74 = match("MESSAGE#38516:Primary_Detection_Engine:02/3_0", "nwparser.p0", "%{sbytes}, Context: %{context->} {%{p0}"); -var part75 = // "Pattern{Field(sbytes,true), Constant(' {'), Field(p0,false)}" -match("MESSAGE#38516:Primary_Detection_Engine:02/3_1", "nwparser.p0", "%{sbytes->} {%{p0}"); +var part75 = match("MESSAGE#38516:Primary_Detection_Engine:02/3_1", "nwparser.p0", "%{sbytes->} {%{p0}"); var select2456 = linear_select([ part74, @@ -96487,8 +96309,7 @@ var all77 = all_match({ var msg38517 = msg("Primary_Detection_Engine:02", all77); -var part76 = // "Pattern{Constant('"'), Field(context,false), Constant('" [Classification:'), Field(sigtype,false), Constant('] User:'), Field(username,false), Constant(', Application:'), Field(application,false), Constant(', Client:'), Field(fld12,false), Constant(', App Protocol:'), Field(fld14,false), Constant(', Interface Ingress:'), Field(dinterface,false), Constant(', Interface Egress:'), Field(sinterface,false), Constant(', Security Zone Ingress:'), Field(dst_zone,false), Constant(', Security Zone Egress:'), Field(src_zone,false), Constant(', Context:'), Field(fld13,false), Constant(', SSL Flow Status:'), Field(fld1,false), Constant(', SSL Actual Action:'), Field(fld22,false), Constant(', SSL Certificate:'), Field(fld3,false), Constant(', SSL Subject CN:'), Field(fld4,false), Constant(', SSL Subject Country:'), Field(fld5,false), Constant(', SSL Subject OU:'), Field(fld6,false), Constant(', SSL Subject Org:'), Field(fld7,false), Constant(', SSL Issuer CN:'), Field(fld8,false), Constant(', SSL Issuer Country:'), Field(fld9,false), Constant(', SSL Issuer OU:'), Field(fld10,false), Constant(', SSL Issuer Org:'), Field(fld11,false), Constant(', SSL Valid Start Date:'), Field(fld12,false), Constant(', SSL Valid End Date:'), Field(fld13,false), Constant(', [Priority:'), Field(threat_val,false), Constant('] {'), Field(protocol,false), Constant('}'), Field(saddr,false), Constant(':'), Field(sport,false), Constant('->'), Field(daddr,false), Constant(':'), Field(dport,false)}" -match("MESSAGE#38517:Primary_Detection_Engine:03", "nwparser.payload", "\"%{context}\" [Classification:%{sigtype}] User:%{username}, Application:%{application}, Client:%{fld12}, App Protocol:%{fld14}, Interface Ingress:%{dinterface}, Interface Egress:%{sinterface}, Security Zone Ingress:%{dst_zone}, Security Zone Egress:%{src_zone}, Context:%{fld13}, SSL Flow Status:%{fld1}, SSL Actual Action:%{fld22}, SSL Certificate:%{fld3}, SSL Subject CN:%{fld4}, SSL Subject Country:%{fld5}, SSL Subject OU:%{fld6}, SSL Subject Org:%{fld7}, SSL Issuer CN:%{fld8}, SSL Issuer Country:%{fld9}, SSL Issuer OU:%{fld10}, SSL Issuer Org:%{fld11}, SSL Valid Start Date:%{fld12}, SSL Valid End Date:%{fld13}, [Priority:%{threat_val}] {%{protocol}}%{saddr}:%{sport}->%{daddr}:%{dport}", processor_chain([ +var part76 = match("MESSAGE#38517:Primary_Detection_Engine:03", "nwparser.payload", "\"%{context}\" [Classification:%{sigtype}] User:%{username}, Application:%{application}, Client:%{fld12}, App Protocol:%{fld14}, Interface Ingress:%{dinterface}, Interface Egress:%{sinterface}, Security Zone Ingress:%{dst_zone}, Security Zone Egress:%{src_zone}, Context:%{fld13}, SSL Flow Status:%{fld1}, SSL Actual Action:%{fld22}, SSL Certificate:%{fld3}, SSL Subject CN:%{fld4}, SSL Subject Country:%{fld5}, SSL Subject OU:%{fld6}, SSL Subject Org:%{fld7}, SSL Issuer CN:%{fld8}, SSL Issuer Country:%{fld9}, SSL Issuer OU:%{fld10}, SSL Issuer Org:%{fld11}, SSL Valid Start Date:%{fld12}, SSL Valid End Date:%{fld13}, [Priority:%{threat_val}] {%{protocol}}%{saddr}:%{sport}->%{daddr}:%{dport}", processor_chain([ dup44, dup31, dup32, @@ -96507,8 +96328,7 @@ var select2457 = linear_select([ msg38518, ]); -var part77 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC > Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('>'), Field(daddr,false)}" -match("MESSAGE#38518:Network_Based_Malware", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC > Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}>%{daddr}", processor_chain([ +var part77 = match("MESSAGE#38518:Network_Based_Malware", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC > Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}>%{daddr}", processor_chain([ dup100, dup31, dup129, @@ -96518,19 +96338,16 @@ match("MESSAGE#38518:Network_Based_Malware", "nwparser.payload", "%{context->} F var msg38519 = msg("Network_Based_Malware", part77); -var part78 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -'), Field(p0,false)}" -match("MESSAGE#38519:Network_Based_Malware:01/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -%{p0}"); +var part78 = match("MESSAGE#38519:Network_Based_Malware:01/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -%{p0}"); -var part79 = // "Pattern{Constant('*>'), Field(p0,false)}" -match("MESSAGE#38519:Network_Based_Malware:01/1_0", "nwparser.p0", "*>%{p0}"); +var part79 = match("MESSAGE#38519:Network_Based_Malware:01/1_0", "nwparser.p0", "*>%{p0}"); var select2458 = linear_select([ part79, dup145, ]); -var part80 = // "Pattern{Field(,true), Constant(' '), Field(space,false), Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" -match("MESSAGE#38519:Network_Based_Malware:01/2", "nwparser.p0", "%{} %{space}Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); +var part80 = match("MESSAGE#38519:Network_Based_Malware:01/2", "nwparser.p0", "%{} %{space}Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); var all78 = all_match({ processors: [ @@ -96549,8 +96366,7 @@ var all78 = all_match({ var msg38520 = msg("Network_Based_Malware:01", all78); -var part81 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('->'), Field(daddr,false)}" -match("MESSAGE#38520:Network_Based_Malware:02", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ +var part81 = match("MESSAGE#38520:Network_Based_Malware:02", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ dup100, dup31, dup129, @@ -96566,17 +96382,13 @@ var select2459 = linear_select([ msg38521, ]); -var part82 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC %{p0}"); +var part82 = match("MESSAGE#38521:Network_Based_Retrospective/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC %{p0}"); -var part83 = // "Pattern{Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/2", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{p0}"); +var part83 = match("MESSAGE#38521:Network_Based_Retrospective/2", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{p0}"); -var part84 = // "Pattern{Field(saddr,false), Constant('->'), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/3_0", "nwparser.p0", "%{saddr}->%{p0}"); +var part84 = match("MESSAGE#38521:Network_Based_Retrospective/3_0", "nwparser.p0", "%{saddr}->%{p0}"); -var part85 = // "Pattern{Field(saddr,false), Constant('>'), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/3_1", "nwparser.p0", "%{saddr}>%{p0}"); +var part85 = match("MESSAGE#38521:Network_Based_Retrospective/3_1", "nwparser.p0", "%{saddr}>%{p0}"); var select2460 = linear_select([ part84, @@ -96602,14 +96414,11 @@ var all79 = all_match({ var msg38522 = msg("Network_Based_Retrospective", all79); -var part86 = // "Pattern{Constant('Sha256: '), Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/4", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{p0}"); +var part86 = match("MESSAGE#38522:Network_Based_Retrospective:01/4", "nwparser.p0", "Sha256: %{checksum->} Disposition: %{disposition->} Threat name: %{p0}"); -var part87 = // "Pattern{Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/5_0", "nwparser.p0", "%{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); +var part87 = match("MESSAGE#38522:Network_Based_Retrospective:01/5_0", "nwparser.p0", "%{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}"); -var part88 = // "Pattern{Field(threat_name,false)}" -match_copy("MESSAGE#38522:Network_Based_Retrospective:01/5_1", "nwparser.p0", "threat_name"); +var part88 = match_copy("MESSAGE#38522:Network_Based_Retrospective:01/5_1", "nwparser.p0", "threat_name"); var select2461 = linear_select([ part87, @@ -96641,8 +96450,7 @@ var select2462 = linear_select([ msg38523, ]); -var part89 = // "Pattern{Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(daddr,false), Constant('<<-'), Field(saddr,false)}" -match("MESSAGE#38523:MALWARE:02", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}", processor_chain([ +var part89 = match("MESSAGE#38523:MALWARE:02", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{daddr}\u003c\u003c-%{saddr}", processor_chain([ dup100, dup32, dup47, @@ -96651,8 +96459,7 @@ match("MESSAGE#38523:MALWARE:02", "nwparser.payload", "%{checksum->} Disposition var msg38524 = msg("MALWARE:02", part89); -var part90 = // "Pattern{Field(checksum,true), Constant(' Disposition: '), Field(disposition,true), Constant(' Threat name: '), Field(threat_name,true), Constant(' IP Addresses: '), Field(saddr,false), Constant('->'), Field(daddr,false)}" -match("MESSAGE#38524:MALWARE:01", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ +var part90 = match("MESSAGE#38524:MALWARE:01", "nwparser.payload", "%{checksum->} Disposition: %{disposition->} Threat name: %{threat_name->} IP Addresses: %{saddr}->%{daddr}", processor_chain([ dup100, dup32, dup47, @@ -96661,8 +96468,7 @@ match("MESSAGE#38524:MALWARE:01", "nwparser.payload", "%{checksum->} Disposition var msg38525 = msg("MALWARE:01", part90); -var part91 = // "Pattern{Field(threat_val,false)}" -match_copy("MESSAGE#38537:MALWARE", "nwparser.payload", "threat_val", processor_chain([ +var part91 = match_copy("MESSAGE#38537:MALWARE", "nwparser.payload", "threat_val", processor_chain([ dup71, dup31, dup45, @@ -96704,14 +96510,11 @@ var all81 = all_match({ var msg38527 = msg("Snort_AlertLog", all81); -var part92 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(p0,false)}" -match("MESSAGE#38526:New_TCP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{p0}"); +var part92 = match("MESSAGE#38526:New_TCP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{p0}"); -var part93 = // "Pattern{Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38526:New_TCP_Port/5_0", "nwparser.p0", "%{sport->} Service: %{protocol->} Confidence: %{result}"); +var part93 = match("MESSAGE#38526:New_TCP_Port/5_0", "nwparser.p0", "%{sport->} Service: %{protocol->} Confidence: %{result}"); -var part94 = // "Pattern{Field(sport,false)}" -match_copy("MESSAGE#38526:New_TCP_Port/5_1", "nwparser.p0", "sport"); +var part94 = match_copy("MESSAGE#38526:New_TCP_Port/5_1", "nwparser.p0", "sport"); var select2464 = linear_select([ part93, @@ -96737,8 +96540,7 @@ var all82 = all_match({ var msg38528 = msg("New_TCP_Port", all82); -var part95 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" -match("MESSAGE#38527:New_UDP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport}"); +var part95 = match("MESSAGE#38527:New_UDP_Port/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport}"); var all83 = all_match({ processors: [ @@ -96766,8 +96568,7 @@ var msg38532 = msg("UDP_Server_Information_Update", dup356); var msg38533 = msg("TCP_Server_Information_Update", dup356); -var part96 = // "Pattern{Constant('From '), Field(sensor,true), Constant(' at '), Field(p0,false)}" -match("MESSAGE#38532:Client_Timeout/1_1", "nwparser.p0", "From %{sensor->} at %{p0}"); +var part96 = match("MESSAGE#38532:Client_Timeout/1_1", "nwparser.p0", "From %{sensor->} at %{p0}"); var select2465 = linear_select([ dup155, @@ -96793,8 +96594,7 @@ var all84 = all_match({ var msg38534 = msg("Client_Timeout", all84); -var part97 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Category: '), Field(category,true), Constant(' Event Type: '), Field(event_type,false)}" -match("MESSAGE#38533:Host_IOC_Set/4", "nwparser.p0", "IP Address: %{saddr->} Category: %{category->} Event Type: %{event_type}"); +var part97 = match("MESSAGE#38533:Host_IOC_Set/4", "nwparser.p0", "IP Address: %{saddr->} Category: %{category->} Event Type: %{event_type}"); var all85 = all_match({ processors: [ @@ -96814,8 +96614,7 @@ var all85 = all_match({ var msg38535 = msg("Host_IOC_Set", all85); -var part98 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Host Type: '), Field(fld10,false)}" -match("MESSAGE#38534:Host_Type_Changed/4", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{fld10}"); +var part98 = match("MESSAGE#38534:Host_Type_Changed/4", "nwparser.p0", "IP Address: %{saddr->} Host Type: %{fld10}"); var all86 = all_match({ processors: [ @@ -96835,8 +96634,7 @@ var all86 = all_match({ var msg38536 = msg("Host_Type_Changed", all86); -var part99 = // "Pattern{Constant('Login Success'), Field(,false)}" -match("MESSAGE#38535:Login", "nwparser.payload", "Login Success%{}", processor_chain([ +var part99 = match("MESSAGE#38535:Login", "nwparser.payload", "Login Success%{}", processor_chain([ dup112, dup31, dup32, @@ -96849,8 +96647,7 @@ match("MESSAGE#38535:Login", "nwparser.payload", "Login Success%{}", processor_c var msg38537 = msg("Login", part99); -var part100 = // "Pattern{Constant('Logout Success'), Field(,false)}" -match("MESSAGE#38536:Logout", "nwparser.payload", "Logout Success%{}", processor_chain([ +var part100 = match("MESSAGE#38536:Logout", "nwparser.payload", "Logout Success%{}", processor_chain([ setc("eventcategory","1401070000"), dup31, dup32, @@ -96957,8 +96754,7 @@ var part101 = tagval("MESSAGE#38538:connection_events", "nwparser.payload", tvm, var msg38539 = msg("connection_events", part101); -var part102 = // "Pattern{Constant('SrcIP: '), Field(daddr,false), Constant(', DstIP: '), Field(saddr,false), Constant(', SrcPort: '), Field(dport,false), Constant(', DstPort: '), Field(sport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', FileDirection: Download, FileAction: '), Field(action,false), Constant(', FileSHA256: '), Field(checksum,false), Constant(', SHA_Disposition: '), Field(disposition,false), Constant(', SperoDisposition: '), Field(info,false), Constant(', ThreatName: '), Field(threat_name,false), Constant(', ThreatScore: '), Field(fld1,false), Constant(', FileName: '), Field(filename,false), Constant(', FileType: '), Field(filetype,false), Constant(', FileSize: '), Field(filename_size,false), Constant(', ApplicationProtocol: '), Field(protocol,false), Constant(', Client: '), Field(application,false), Constant(', User: '), Field(username,false), Constant(', FirstPacketSecond: '), Field(fld21,false), Constant(', FilePolicy: '), Field(policyname,false), Constant(', FileSandboxStatus: '), Field(result,false), Constant(', URI: '), Field(url,false)}" -match("MESSAGE#38539:FTD_events_01", "nwparser.payload", "SrcIP: %{daddr}, DstIP: %{saddr}, SrcPort: %{dport}, DstPort: %{sport}, Protocol: %{protocol}, FileDirection: Download, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ +var part102 = match("MESSAGE#38539:FTD_events_01", "nwparser.payload", "SrcIP: %{daddr}, DstIP: %{saddr}, SrcPort: %{dport}, DstPort: %{sport}, Protocol: %{protocol}, FileDirection: Download, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ dup150, dup161, dup162, @@ -96970,8 +96766,7 @@ match("MESSAGE#38539:FTD_events_01", "nwparser.payload", "SrcIP: %{daddr}, DstIP var msg38540 = msg("FTD_events_01", part102); -var part103 = // "Pattern{Constant('SrcIP: '), Field(saddr,false), Constant(', DstIP: '), Field(daddr,false), Constant(', SrcPort: '), Field(sport,false), Constant(', DstPort: '), Field(dport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', FileDirection: Upload, FileAction: '), Field(action,false), Constant(', FileSHA256: '), Field(checksum,false), Constant(', SHA_Disposition: '), Field(disposition,false), Constant(', SperoDisposition: '), Field(info,false), Constant(', ThreatName: '), Field(threat_name,false), Constant(', ThreatScore: '), Field(fld1,false), Constant(', FileName: '), Field(filename,false), Constant(', FileType: '), Field(filetype,false), Constant(', FileSize: '), Field(filename_size,false), Constant(', ApplicationProtocol: '), Field(protocol,false), Constant(', Client: '), Field(application,false), Constant(', User: '), Field(username,false), Constant(', FirstPacketSecond: '), Field(fld21,false), Constant(', FilePolicy: '), Field(policyname,false), Constant(', FileSandboxStatus: '), Field(result,false), Constant(', URI: '), Field(url,false)}" -match("MESSAGE#38540:FTD_events_02", "nwparser.payload", "SrcIP: %{saddr}, DstIP: %{daddr}, SrcPort: %{sport}, DstPort: %{dport}, Protocol: %{protocol}, FileDirection: Upload, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ +var part103 = match("MESSAGE#38540:FTD_events_02", "nwparser.payload", "SrcIP: %{saddr}, DstIP: %{daddr}, SrcPort: %{sport}, DstPort: %{dport}, Protocol: %{protocol}, FileDirection: Upload, FileAction: %{action}, FileSHA256: %{checksum}, SHA_Disposition: %{disposition}, SperoDisposition: %{info}, ThreatName: %{threat_name}, ThreatScore: %{fld1}, FileName: %{filename}, FileType: %{filetype}, FileSize: %{filename_size}, ApplicationProtocol: %{protocol}, Client: %{application}, User: %{username}, FirstPacketSecond: %{fld21}, FilePolicy: %{policyname}, FileSandboxStatus: %{result}, URI: %{url}", processor_chain([ dup150, dup161, dup162, @@ -96983,8 +96778,7 @@ match("MESSAGE#38540:FTD_events_02", "nwparser.payload", "SrcIP: %{saddr}, DstIP var msg38541 = msg("FTD_events_02", part103); -var part104 = // "Pattern{Constant('User ''), Field(username,false), Constant('' executed the ''), Field(fld1,false), Constant('' command.')}" -match("MESSAGE#38541:FTD_events_03", "nwparser.payload", "User '%{username}' executed the '%{fld1}' command.", processor_chain([ +var part104 = match("MESSAGE#38541:FTD_events_03", "nwparser.payload", "User '%{username}' executed the '%{fld1}' command.", processor_chain([ dup150, dup162, dup32, @@ -96993,8 +96787,7 @@ match("MESSAGE#38541:FTD_events_03", "nwparser.payload", "User '%{username}' exe var msg38542 = msg("FTD_events_03", part104); -var part105 = // "Pattern{Constant('User ''), Field(username,false), Constant('', running ''), Field(application,false), Constant('' from IP'), Field(hostip,false), Constant(', executed ''), Field(fld1,false), Constant(''')}" -match("MESSAGE#38542:FTD_events_04", "nwparser.payload", "User '%{username}', running '%{application}' from IP%{hostip}, executed '%{fld1}'", processor_chain([ +var part105 = match("MESSAGE#38542:FTD_events_04", "nwparser.payload", "User '%{username}', running '%{application}' from IP%{hostip}, executed '%{fld1}'", processor_chain([ dup150, dup162, dup32, @@ -97003,8 +96796,7 @@ match("MESSAGE#38542:FTD_events_04", "nwparser.payload", "User '%{username}', ru var msg38543 = msg("FTD_events_04", part105); -var part106 = // "Pattern{Field(dclass_counter1,false), Constant('in use,'), Field(fld2,false), Constant('most used')}" -match("MESSAGE#38543:FTD_events_05", "nwparser.payload", "%{dclass_counter1}in use,%{fld2}most used", processor_chain([ +var part106 = match("MESSAGE#38543:FTD_events_05", "nwparser.payload", "%{dclass_counter1}in use,%{fld2}most used", processor_chain([ dup150, dup162, dup32, @@ -97014,8 +96806,7 @@ match("MESSAGE#38543:FTD_events_05", "nwparser.payload", "%{dclass_counter1}in u var msg38544 = msg("FTD_events_05", part106); -var part107 = // "Pattern{Constant('Offloaded TCP Flow for connection'), Field(connectionid,false), Constant('from'), Field(dinterface,false), Constant(':'), Field(daddr,false), Constant('/'), Field(dport,false), Constant('('), Field(dtransaddr,false), Constant('/'), Field(dtransport,false), Constant(') to'), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,false), Constant('('), Field(stransaddr,false), Constant('/'), Field(stransport,false), Constant(')')}" -match("MESSAGE#38544:FTD_events_06", "nwparser.payload", "Offloaded TCP Flow for connection%{connectionid}from%{dinterface}:%{daddr}/%{dport}(%{dtransaddr}/%{dtransport}) to%{sinterface}:%{saddr}/%{sport}(%{stransaddr}/%{stransport})", processor_chain([ +var part107 = match("MESSAGE#38544:FTD_events_06", "nwparser.payload", "Offloaded TCP Flow for connection%{connectionid}from%{dinterface}:%{daddr}/%{dport}(%{dtransaddr}/%{dtransport}) to%{sinterface}:%{saddr}/%{sport}(%{stransaddr}/%{stransport})", processor_chain([ dup150, dup162, dup32, @@ -97025,8 +96816,7 @@ match("MESSAGE#38544:FTD_events_06", "nwparser.payload", "Offloaded TCP Flow for var msg38545 = msg("FTD_events_06", part107); -var part108 = // "Pattern{Constant('Failed to locate egress interface for '), Field(protocol,true), Constant(' from '), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' to '), Field(daddr,false), Constant('/'), Field(dport,false)}" -match("MESSAGE#38545:FTD_events_07", "nwparser.payload", "Failed to locate egress interface for %{protocol->} from %{sinterface}:%{saddr}/%{sport->} to %{daddr}/%{dport}", processor_chain([ +var part108 = match("MESSAGE#38545:FTD_events_07", "nwparser.payload", "Failed to locate egress interface for %{protocol->} from %{sinterface}:%{saddr}/%{sport->} to %{daddr}/%{dport}", processor_chain([ setc("eventcategory","1801010000"), dup162, dup32, @@ -97036,8 +96826,7 @@ match("MESSAGE#38545:FTD_events_07", "nwparser.payload", "Failed to locate egres var msg38546 = msg("FTD_events_07", part108); -var part109 = // "Pattern{Constant('TCP Flow is no longer offloaded for connection '), Field(connectionid,true), Constant(' from '), Field(dinterface,false), Constant(':'), Field(daddr,false), Constant('/'), Field(dport,true), Constant(' ('), Field(dtransaddr,false), Constant('/'), Field(dtransport,false), Constant(') to '), Field(sinterface,false), Constant(':'), Field(saddr,false), Constant('/'), Field(sport,true), Constant(' ('), Field(stransaddr,false), Constant('/'), Field(stransport,false), Constant(')')}" -match("MESSAGE#38546:FTD_events_08", "nwparser.payload", "TCP Flow is no longer offloaded for connection %{connectionid->} from %{dinterface}:%{daddr}/%{dport->} (%{dtransaddr}/%{dtransport}) to %{sinterface}:%{saddr}/%{sport->} (%{stransaddr}/%{stransport})", processor_chain([ +var part109 = match("MESSAGE#38546:FTD_events_08", "nwparser.payload", "TCP Flow is no longer offloaded for connection %{connectionid->} from %{dinterface}:%{daddr}/%{dport->} (%{dtransaddr}/%{dtransport}) to %{sinterface}:%{saddr}/%{sport->} (%{stransaddr}/%{stransport})", processor_chain([ dup150, dup162, dup32, @@ -97047,8 +96836,7 @@ match("MESSAGE#38546:FTD_events_08", "nwparser.payload", "TCP Flow is no longer var msg38547 = msg("FTD_events_08", part109); -var part110 = // "Pattern{Constant('CLOCK: System clock set, source: '), Field(event_source,false), Constant(', IP: '), Field(hostip,false), Constant(', before: '), Field(change_old,false), Constant(', after: '), Field(change_new,false)}" -match("MESSAGE#38547:FTD_events_09", "nwparser.payload", "CLOCK: System clock set, source: %{event_source}, IP: %{hostip}, before: %{change_old}, after: %{change_new}", processor_chain([ +var part110 = match("MESSAGE#38547:FTD_events_09", "nwparser.payload", "CLOCK: System clock set, source: %{event_source}, IP: %{hostip}, before: %{change_old}, after: %{change_new}", processor_chain([ dup150, dup162, dup32, @@ -97148,19 +96936,16 @@ var select2466 = linear_select([ msg38549, ]); -var part112 = // "Pattern{Constant('AccessControlRuleAction:'), Field(action,false), Constant(', AccessControlRuleReason:'), Field(result,false), Constant(', SrcIP:'), Field(saddr,false), Constant(', DstIP:'), Field(daddr,false), Constant(', SrcPort:'), Field(sport,false), Constant(', DstPort:'), Field(dport,false), Constant(', Protocol: '), Field(protocol,false), Constant(', IngressInterface: '), Field(dinterface,false), Constant(', IngressZone:'), Field(dst_zone,false), Constant(', ACPolicy:'), Field(fld44,false), Constant(', AccessControlRuleName:'), Field(rulename,false), Constant(', Prefilter Policy:'), Field(fld2,false), Constant(', User:'), Field(fld48,false), Constant(', Client:'), Field(application,false), Constant(', ApplicationProtocol:'), Field(protocol,false), Constant(', InitiatorPackets:'), Field(fld14,false), Constant(', ResponderPackets:'), Field(fld13,false), Constant(', InitiatorBytes:'), Field(sbytes,false), Constant(', ResponderBytes:'), Field(rbytes,false), Constant(', NAPPolicy:'), Field(policyname,false), Constant(', DNSQuery:'), Field(hostname,false), Constant(', DNSRecordType: a host address,'), Field(p0,false)}" -match("MESSAGE#38549:NGIPS_events_01/0", "nwparser.payload", "AccessControlRuleAction:%{action}, AccessControlRuleReason:%{result}, SrcIP:%{saddr}, DstIP:%{daddr}, SrcPort:%{sport}, DstPort:%{dport}, Protocol: %{protocol}, IngressInterface: %{dinterface}, IngressZone:%{dst_zone}, ACPolicy:%{fld44}, AccessControlRuleName:%{rulename}, Prefilter Policy:%{fld2}, User:%{fld48}, Client:%{application}, ApplicationProtocol:%{protocol}, InitiatorPackets:%{fld14}, ResponderPackets:%{fld13}, InitiatorBytes:%{sbytes}, ResponderBytes:%{rbytes}, NAPPolicy:%{policyname}, DNSQuery:%{hostname}, DNSRecordType: a host address,%{p0}"); +var part112 = match("MESSAGE#38549:NGIPS_events_01/0", "nwparser.payload", "AccessControlRuleAction:%{action}, AccessControlRuleReason:%{result}, SrcIP:%{saddr}, DstIP:%{daddr}, SrcPort:%{sport}, DstPort:%{dport}, Protocol: %{protocol}, IngressInterface: %{dinterface}, IngressZone:%{dst_zone}, ACPolicy:%{fld44}, AccessControlRuleName:%{rulename}, Prefilter Policy:%{fld2}, User:%{fld48}, Client:%{application}, ApplicationProtocol:%{protocol}, InitiatorPackets:%{fld14}, ResponderPackets:%{fld13}, InitiatorBytes:%{sbytes}, ResponderBytes:%{rbytes}, NAPPolicy:%{policyname}, DNSQuery:%{hostname}, DNSRecordType: a host address,%{p0}"); -var part113 = // "Pattern{Constant(' DNS_TTL: '), Field(fld7,false), Constant(','), Field(p0,false)}" -match("MESSAGE#38549:NGIPS_events_01/1_0", "nwparser.p0", " DNS_TTL: %{fld7},%{p0}"); +var part113 = match("MESSAGE#38549:NGIPS_events_01/1_0", "nwparser.p0", " DNS_TTL: %{fld7},%{p0}"); var select2467 = linear_select([ part113, dup59, ]); -var part114 = // "Pattern{Field(,false), Constant('DNSSICategory:'), Field(category,false)}" -match("MESSAGE#38549:NGIPS_events_01/2", "nwparser.p0", "%{}DNSSICategory:%{category}"); +var part114 = match("MESSAGE#38549:NGIPS_events_01/2", "nwparser.p0", "%{}DNSSICategory:%{category}"); var all87 = all_match({ processors: [ @@ -133327,194 +133112,131 @@ var chain1 = processor_chain([ }), ]); -var hdr35 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#2:00010/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var hdr35 = match("HEADER#2:00010/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); -var part116 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Impact: '), Field(p0,false)}" -match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); +var part116 = match("HEADER#2:00010/1_0", "nwparser.p0", "\"%{hfld10}\" [Impact: %{p0}"); -var part117 = // "Pattern{Field(hfld10,true), Constant(' [Impact: '), Field(p0,false)}" -match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); +var part117 = match("HEADER#2:00010/1_1", "nwparser.p0", "%{hfld10->} [Impact: %{p0}"); -var part118 = // "Pattern{Field(result,false), Constant('] From '), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var part118 = match("HEADER#3:00011/2", "nwparser.p0", "%{result}] From %{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); -var part119 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" [Classification: '), Field(p0,false)}" -match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); +var part119 = match("HEADER#4:00012/1_0", "nwparser.p0", "\"%{hfld10}\" [Classification: %{p0}"); -var part120 = // "Pattern{Field(hfld10,true), Constant(' [Classification: '), Field(p0,false)}" -match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); +var part120 = match("HEADER#4:00012/1_1", "nwparser.p0", "%{hfld10->} [Classification: %{p0}"); -var part121 = // "Pattern{Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); +var part121 = match("HEADER#4:00012/2", "nwparser.p0", "%{sigtype}] [Priority: %{payload}"); -var part122 = // "Pattern{Constant('"'), Field(hfld10,false), Constant('" ['), Field(p0,false)}" -match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); +var part122 = match("HEADER#5:00013/1_0", "nwparser.p0", "\"%{hfld10}\" [%{p0}"); -var part123 = // "Pattern{Field(hfld10,true), Constant(' ['), Field(p0,false)}" -match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); +var part123 = match("HEADER#5:00013/1_1", "nwparser.p0", "%{hfld10->} [%{p0}"); -var part124 = // "Pattern{Field(info,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); +var part124 = match("HEADER#5:00013/2", "nwparser.p0", "%{info}] [Priority: %{payload}"); -var hdr36 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort['), Field(hpid,false), Constant(']: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var hdr36 = match("HEADER#7:00020/0", "message", "%{month->} %{day->} %{time->} snort[%{hpid}]: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); -var part125 = // "Pattern{Field(result,false), Constant('] From '), Field(group_object,false), Constant('/'), Field(hfld11,true), Constant(' at '), Field(fld9,true), Constant(' '), Field(event_time_string,true), Constant(' [Classification: '), Field(sigtype,false), Constant('] [Priority: '), Field(payload,false)}" -match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); +var part125 = match("HEADER#7:00020/2", "nwparser.p0", "%{result}] From %{group_object}/%{hfld11->} at %{fld9->} %{event_time_string->} [Classification: %{sigtype}] [Priority: %{payload}"); -var hdr37 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' snort: ['), Field(hevent_source,false), Constant(':'), Field(messageid,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); +var hdr37 = match("HEADER#11:00030/0", "message", "%{month->} %{day->} %{time->} snort: [%{hevent_source}:%{messageid}:%{hversion}] %{p0}"); -var part126 = // "Pattern{Constant('at'), Field(p0,false)}" -match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); +var part126 = match("HEADER#26:0011/1_1", "nwparser.p0", "at%{p0}"); -var part127 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); +var part127 = match("HEADER#26:0011/2", "nwparser.p0", "%{} %{p0}"); -var part128 = // "Pattern{Constant('['), Field(hpid,false), Constant(']: ['), Field(p0,false)}" -match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); +var part128 = match("HEADER#41:0024/1_0", "nwparser.p0", "[%{hpid}]: [%{p0}"); -var part129 = // "Pattern{Constant(': ['), Field(p0,false)}" -match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); +var part129 = match("HEADER#41:0024/1_1", "nwparser.p0", ": [%{p0}"); -var part130 = // "Pattern{Constant(']'), Field(hversion,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hevent_source,true), Constant(' '), Field(payload,false)}" -match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); +var part130 = match("HEADER#41:0024/2", "nwparser.p0", "]%{hversion}:%{hfld2}:%{hevent_source->} %{payload}"); -var hdr38 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': ['), Field(hevent_source,false), Constant(':'), Field(hfld2,false), Constant(':'), Field(hversion,false), Constant('] '), Field(p0,false)}" -match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); +var hdr38 = match("HEADER#43:0023/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: [%{hevent_source}:%{hfld2}:%{hversion}] %{p0}"); -var part131 = // "Pattern{Field(threat_val,true), Constant(' ]:alert {'), Field(p0,false)}" -match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); +var part131 = match("MESSAGE#1:0/0_0", "nwparser.payload", "%{threat_val->} ]:alert {%{p0}"); -var part132 = // "Pattern{Field(threat_val,true), Constant(' ]: '), Field(fld1,true), Constant(' {'), Field(p0,false)}" -match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); +var part132 = match("MESSAGE#1:0/0_1", "nwparser.payload", "%{threat_val->} ]: %{fld1->} {%{p0}"); -var part133 = // "Pattern{Field(threat_val,false), Constant(']: {'), Field(p0,false)}" -match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); +var part133 = match("MESSAGE#1:0/0_2", "nwparser.payload", "%{threat_val}]: {%{p0}"); -var part134 = // "Pattern{Field(threat_val,true), Constant(' ] {'), Field(p0,false)}" -match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); +var part134 = match("MESSAGE#1:0/0_3", "nwparser.payload", "%{threat_val->} ] {%{p0}"); -var part135 = // "Pattern{Field(protocol,false), Constant('} '), Field(p0,false)}" -match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); +var part135 = match("MESSAGE#1:0/1", "nwparser.p0", "%{protocol}} %{p0}"); -var part136 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(location_src,false), Constant(') -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); +var part136 = match("MESSAGE#1:0/2_0", "nwparser.p0", "%{saddr}:%{sport->} (%{location_src}) -> %{p0}"); -var part137 = // "Pattern{Field(saddr,false), Constant(':'), Field(sport,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); +var part137 = match("MESSAGE#1:0/2_1", "nwparser.p0", "%{saddr}:%{sport->} -> %{p0}"); -var part138 = // "Pattern{Field(saddr,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); +var part138 = match("MESSAGE#1:0/2_2", "nwparser.p0", "%{saddr->} -> %{p0}"); -var part139 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(location_dst,false), Constant(')')}" -match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); +var part139 = match("MESSAGE#1:0/3_0", "nwparser.p0", "%{daddr}:%{dport->} (%{location_dst})"); -var part140 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false)}" -match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); +var part140 = match("MESSAGE#1:0/3_1", "nwparser.p0", "%{daddr}:%{dport}"); -var part141 = // "Pattern{Field(daddr,false)}" -match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); +var part141 = match_copy("MESSAGE#1:0/3_2", "nwparser.p0", "daddr"); -var part142 = // "Pattern{Field(context,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); +var part142 = match("MESSAGE#2:0:01/0", "nwparser.payload", "%{context->} %{p0}"); -var part143 = // "Pattern{Constant('<<'), Field(interface,false), Constant('> '), Field(p0,false)}" -match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); +var part143 = match("MESSAGE#2:0:01/1_0", "nwparser.p0", "\u003c\u003c%{interface}> %{p0}"); -var part144 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); +var part144 = match_copy("MESSAGE#2:0:01/1_1", "nwparser.p0", "p0"); -var part145 = // "Pattern{Constant('{'), Field(protocol,false), Constant('} '), Field(p0,false)}" -match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); +var part145 = match("MESSAGE#2:0:01/2", "nwparser.p0", "{%{protocol}} %{p0}"); -var part146 = // "Pattern{Field(threat_val,true), Constant(' ]'), Field(p0,false)}" -match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); +var part146 = match("MESSAGE#33:10/0", "nwparser.payload", "%{threat_val->} ]%{p0}"); -var part147 = // "Pattern{Constant(' <<'), Field(interface,false), Constant('> '), Field(p0,false)}" -match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); +var part147 = match("MESSAGE#33:10/1_0", "nwparser.p0", " \u003c\u003c%{interface}> %{p0}"); -var part148 = // "Pattern{Constant(': '), Field(p0,false)}" -match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); +var part148 = match("MESSAGE#33:10/1_1", "nwparser.p0", ": %{p0}"); -var part149 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); +var part149 = match("MESSAGE#33:10/1_2", "nwparser.p0", " %{p0}"); -var part150 = // "Pattern{Field(context,true), Constant(' <<'), Field(interface,false), Constant('> '), Field(protocol,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); +var part150 = match("MESSAGE#80:103:01/0", "nwparser.payload", "%{context->} \u003c\u003c%{interface}> %{protocol->} %{p0}"); -var part151 = // "Pattern{Field(threat_val,true), Constant(' ]:alert '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); +var part151 = match("MESSAGE#5535:3086/0_0", "nwparser.payload", "%{threat_val->} ]:alert %{p0}"); -var part152 = // "Pattern{Field(threat_val,false), Constant(']: '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); +var part152 = match("MESSAGE#5535:3086/0_1", "nwparser.payload", "%{threat_val}]: %{p0}"); -var part153 = // "Pattern{Field(threat_val,true), Constant(' ] '), Field(p0,false)}" -match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); +var part153 = match("MESSAGE#5535:3086/0_2", "nwparser.payload", "%{threat_val->} ] %{p0}"); -var part154 = // "Pattern{Constant(''), Field(p0,false)}" -match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); +var part154 = match("MESSAGE#5535:3086/1", "nwparser.p0", "%{p0}"); -var part155 = // "Pattern{Constant(':alert '), Field(p0,false)}" -match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); +var part155 = match("MESSAGE#30119:28015/1_1", "nwparser.p0", ":alert %{p0}"); -var part156 = // "Pattern{Constant(''), Field(saddr,true), Constant(' -> '), Field(p0,false)}" -match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); +var part156 = match("MESSAGE#36377:34596/3_1", "nwparser.p0", "%{saddr->} -> %{p0}"); -var part157 = // "Pattern{Constant(''), Field(daddr,false)}" -match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); +var part157 = match("MESSAGE#36377:34596/4_1", "nwparser.p0", "%{daddr}"); -var part158 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' MAC: '), Field(smacaddr,true), Constant(' TTL '), Field(p0,false)}" -match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); +var part158 = match("MESSAGE#38458:MAC_Information_Change/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} MAC: %{smacaddr->} TTL %{p0}"); -var part159 = // "Pattern{Field(sinterface,true), Constant(' ('), Field(protocol,true), Constant(' detected)')}" -match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); +var part159 = match("MESSAGE#38458:MAC_Information_Change/1_0", "nwparser.p0", "%{sinterface->} (%{protocol->} detected)"); -var part160 = // "Pattern{Field(sinterface,false)}" -match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); +var part160 = match_copy("MESSAGE#38458:MAC_Information_Change/1_1", "nwparser.p0", "sinterface"); -var part161 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> '), Field(p0,false)}" -match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); +var part161 = match("MESSAGE#38461:New_Host/0", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> %{p0}"); -var part162 = // "Pattern{Field(protocol,false)}" -match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); +var part162 = match_copy("MESSAGE#38462:New_Network_Protocol/2", "nwparser.p0", "protocol"); -var part163 = // "Pattern{Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); +var part163 = match("MESSAGE#38468:TCP_Service_Information_Update/1_0", "nwparser.p0", "%{protocol->} Confidence: %{result}"); -var part164 = // "Pattern{Constant('>'), Field(p0,false)}" -match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); +var part164 = match("MESSAGE#38495:SystemSettings:09/1_0", "nwparser.p0", ">%{p0}"); -var part165 = // "Pattern{Field(fld1,false), Constant(']['), Field(policyname,false), Constant('] Connection Type: '), Field(event_state,false), Constant(', User: '), Field(username,false), Constant(', Client: '), Field(application,false), Constant(', Application Protocol: '), Field(protocol,false), Constant(', Web App: '), Field(application,false), Constant(', Access Control Rule Name: '), Field(rulename,false), Constant(', Access Control Rule Action: '), Field(action,false), Constant(', Access Control Rule Reasons: '), Field(result,false), Constant(', URL Category: '), Field(category,false), Constant(', URL Reputation: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); +var part165 = match("MESSAGE#38514:Primary_Detection_Engine/0", "nwparser.payload", "%{fld1}][%{policyname}] Connection Type: %{event_state}, User: %{username}, Client: %{application}, Application Protocol: %{protocol}, Web App: %{application}, Access Control Rule Name: %{rulename}, Access Control Rule Action: %{action}, Access Control Rule Reasons: %{result}, URL Category: %{category}, URL Reputation: %{p0}"); -var part166 = // "Pattern{Constant('Risk unknown, URL: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); +var part166 = match("MESSAGE#38514:Primary_Detection_Engine/1_0", "nwparser.p0", "Risk unknown, URL: %{p0}"); -var part167 = // "Pattern{Field(reputation_num,false), Constant(', URL: '), Field(p0,false)}" -match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); +var part167 = match("MESSAGE#38514:Primary_Detection_Engine/1_1", "nwparser.p0", "%{reputation_num}, URL: %{p0}"); -var part168 = // "Pattern{Constant('-*> '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); +var part168 = match("MESSAGE#38521:Network_Based_Retrospective/1_0", "nwparser.p0", "-*> %{p0}"); -var part169 = // "Pattern{Constant('> '), Field(p0,false)}" -match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); +var part169 = match("MESSAGE#38521:Network_Based_Retrospective/1_1", "nwparser.p0", "> %{p0}"); -var part170 = // "Pattern{Constant('From "'), Field(sensor,false), Constant('" at '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); +var part170 = match("MESSAGE#38522:Network_Based_Retrospective:01/1_0", "nwparser.p0", "From \"%{sensor}\" at %{p0}"); -var part171 = // "Pattern{Constant('at '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); +var part171 = match("MESSAGE#38522:Network_Based_Retrospective:01/1_1", "nwparser.p0", "at %{p0}"); -var part172 = // "Pattern{Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC '), Field(p0,false)}" -match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); +var part172 = match("MESSAGE#38522:Network_Based_Retrospective:01/2", "nwparser.p0", "%{fld6->} %{event_time_string->} UTC %{p0}"); -var part173 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' '), Field(network_service,false)}" -match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); +var part173 = match("MESSAGE#38528:Client_Update/4", "nwparser.p0", "IP Address: %{saddr->} %{network_service}"); -var part174 = // "Pattern{Constant('IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(p0,false)}" -match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); +var part174 = match("MESSAGE#38530:UDP_Server_Information_Update/4", "nwparser.p0", "IP Address: %{saddr->} Port: %{sport->} Service: %{p0}"); var select2469 = linear_select([ dup3, @@ -133531,8 +133253,7 @@ var select2471 = linear_select([ dup10, ]); -var hdr39 = // "Pattern{Field(month,true), Constant(' '), Field(day,true), Constant(' '), Field(time,true), Constant(' '), Field(host,true), Constant(' '), Field(hfld1,false), Constant(': <<*- '), Field(msgIdPart1,true), Constant(' '), Field(msgIdPart2,true), Constant(' '), Field(msgIdPart3,true), Constant(' '), Field(p0,false)}" -match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ +var hdr39 = match("HEADER#26:0011/0", "message", "%{month->} %{day->} %{time->} %{host->} %{hfld1}: \u003c\u003c*- %{msgIdPart1->} %{msgIdPart2->} %{msgIdPart3->} %{p0}", processor_chain([ dup19, ])); @@ -133604,8 +133325,7 @@ var select2483 = linear_select([ dup132, ]); -var part175 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' OS: '), Field(version,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ +var part175 = match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} OS: %{version->} Confidence: %{result}", processor_chain([ dup127, dup31, dup32, @@ -133613,8 +133333,7 @@ match("MESSAGE#38465:OS_Confidence_Update", "nwparser.payload", "%{context->} Fr dup129, ])); -var part176 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,true), Constant(' Service: '), Field(protocol,true), Constant(' Confidence: '), Field(result,false)}" -match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ +var part176 = match("MESSAGE#38467:TCP_Service_Confidence_Update", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport->} Service: %{protocol->} Confidence: %{result}", processor_chain([ dup135, dup31, dup32, @@ -133627,8 +133346,7 @@ var select2484 = linear_select([ dup134, ]); -var part177 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' '), Field(product,false)}" -match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ +var part177 = match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} %{product}", processor_chain([ dup135, dup31, dup32, @@ -133636,8 +133354,7 @@ match("MESSAGE#38471:New_Client_Application", "nwparser.payload", "%{context->} dup129, ])); -var part178 = // "Pattern{Field(context,true), Constant(' From "'), Field(sensor,false), Constant('" at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,true), Constant(' Port: '), Field(sport,false)}" -match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ +var part178 = match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \"%{sensor}\" at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr->} Port: %{sport}", processor_chain([ dup135, dup31, dup32, @@ -133645,8 +133362,7 @@ match("MESSAGE#38473:New_TCP_Service", "nwparser.payload", "%{context->} From \" dup129, ])); -var part179 = // "Pattern{Field(context,true), Constant(' From '), Field(sensor,true), Constant(' at '), Field(fld6,true), Constant(' '), Field(event_time_string,true), Constant(' UTC -*> IP Address: '), Field(saddr,false)}" -match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ +var part179 = match("MESSAGE#38475:TCP_Port_Timeout", "nwparser.payload", "%{context->} From %{sensor->} at %{fld6->} %{event_time_string->} UTC -*> IP Address: %{saddr}", processor_chain([ dup135, dup31, dup32, diff --git a/x-pack/filebeat/module/sophos/utm/config/pipeline.js b/x-pack/filebeat/module/sophos/utm/config/pipeline.js index 8b482480f25..47802f0ee26 100644 --- a/x-pack/filebeat/module/sophos/utm/config/pipeline.js +++ b/x-pack/filebeat/module/sophos/utm/config/pipeline.js @@ -105,8 +105,7 @@ var dup17 = setc("eventcategory","1702000000"); var dup18 = setc("comments","server certificate has a different hostname from actual hostname"); -var dup19 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); +var dup19 = match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); var dup20 = setc("eventcategory","1603060000"); @@ -170,35 +169,29 @@ var dup46 = lookup({ key: dup15, }); -var hdr1 = // "Pattern{Field(hfld1,true), Constant(' '), Field(messageid,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" -match("HEADER#0:0001", "message", "%{hfld1->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ +var hdr1 = match("HEADER#0:0001", "message", "%{hfld1->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ setc("header_id","0001"), ])); -var hdr2 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' '), Field(messageid,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" -match("HEADER#1:0002", "message", "%{hfld1->} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ +var hdr2 = match("HEADER#1:0002", "message", "%{hfld1->} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ setc("header_id","0002"), ])); -var hdr3 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' reverseproxy: '), Field(payload,false)}" -match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ +var hdr3 = match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ setc("header_id","0003"), setc("messageid","reverseproxy"), ])); -var hdr4 = // "Pattern{Field(hfld1,true), Constant(' '), Field(hostname,true), Constant(' '), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ +var hdr4 = match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ setc("header_id","0005"), ])); -var hdr5 = // "Pattern{Field(hfld1,true), Constant(' '), Field(id,false), Constant('['), Field(process_id,false), Constant(']: '), Field(payload,false)}" -match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ +var hdr5 = match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ setc("header_id","0004"), setc("messageid","astarosg_TVM"), ])); -var hdr6 = // "Pattern{Constant('device="'), Field(product,false), Constant('" date='), Field(hdate,true), Constant(' time='), Field(htime,true), Constant(' timezone="'), Field(timezone,false), Constant('" device_name="'), Field(device,false), Constant('" device_id='), Field(hardware_id,true), Constant(' log_id='), Field(id,true), Constant(' '), Field(payload,false)}" -match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ +var hdr6 = match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ setc("header_id","0006"), setc("messageid","Sophos_Firewall"), ])); @@ -212,8 +205,7 @@ var select1 = linear_select([ hdr6, ]); -var part1 = // "Pattern{Constant('received control channel command ''), Field(action,false), Constant(''')}" -match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ +var part1 = match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ dup1, dup2, dup3, @@ -221,8 +213,7 @@ match("MESSAGE#0:named:01", "nwparser.payload", "received control channel comman var msg1 = msg("named:01", part1); -var part2 = // "Pattern{Constant('flushing caches in all views '), Field(disposition,false)}" -match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ +var part2 = match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ dup1, dup2, dup3, @@ -230,8 +221,7 @@ match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{ var msg2 = msg("named:02", part2); -var part3 = // "Pattern{Constant('error ('), Field(result,false), Constant(') resolving ''), Field(dhost,false), Constant('': '), Field(daddr,false), Constant('#'), Field(dport,false)}" -match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ +var part3 = match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ dup4, dup2, dup3, @@ -239,8 +229,7 @@ match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{ var msg3 = msg("named:03", part3); -var part4 = // "Pattern{Constant('received '), Field(action,true), Constant(' signal to '), Field(fld3,false)}" -match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ +var part4 = match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ dup5, dup2, dup3, @@ -248,8 +237,7 @@ match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to var msg4 = msg("named:04", part4); -var part5 = // "Pattern{Constant('loading configuration from ''), Field(filename,false), Constant(''')}" -match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ +var part5 = match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ dup6, dup2, dup3, @@ -257,8 +245,7 @@ match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{f var msg5 = msg("named:05", part5); -var part6 = // "Pattern{Constant('no '), Field(protocol,true), Constant(' interfaces found')}" -match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ +var part6 = match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ setc("eventcategory","1804000000"), dup2, dup3, @@ -266,8 +253,7 @@ match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces fou var msg6 = msg("named:06", part6); -var part7 = // "Pattern{Constant('sizing zone task pool based on '), Field(fld3,true), Constant(' zones')}" -match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ +var part7 = match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ dup7, dup2, dup3, @@ -275,8 +261,7 @@ match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on var msg7 = msg("named:07", part7); -var part8 = // "Pattern{Constant('automatic empty zone: view '), Field(fld3,false), Constant(': '), Field(dns_ptr_record,false)}" -match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ +var part8 = match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ dup8, dup2, dup3, @@ -284,8 +269,7 @@ match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fl var msg8 = msg("named:08", part8); -var part9 = // "Pattern{Constant('reloading '), Field(obj_type,true), Constant(' '), Field(disposition,false)}" -match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ +var part9 = match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ dup7, dup2, dup3, @@ -294,8 +278,7 @@ match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{dispo var msg9 = msg("named:09", part9); -var part10 = // "Pattern{Constant('zone '), Field(dhost,false), Constant('/'), Field(fld3,false), Constant(': loaded serial '), Field(operation_id,false)}" -match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ +var part10 = match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ dup7, dup9, dup2, @@ -304,8 +287,7 @@ match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded s var msg10 = msg("named:10", part10); -var part11 = // "Pattern{Constant('all zones loaded'), Field(,false)}" -match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ +var part11 = match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ dup7, dup9, dup2, @@ -315,8 +297,7 @@ match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processo var msg11 = msg("named:11", part11); -var part12 = // "Pattern{Constant('running'), Field(,false)}" -match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ +var part12 = match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ dup7, setc("disposition","running"), dup2, @@ -326,8 +307,7 @@ match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ var msg12 = msg("named:12", part12); -var part13 = // "Pattern{Constant('using built-in root key for view '), Field(fld3,false)}" -match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ +var part13 = match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ dup7, setc("context","built-in root key"), dup2, @@ -336,8 +316,7 @@ match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for vi var msg13 = msg("named:13", part13); -var part14 = // "Pattern{Constant('zone '), Field(dns_ptr_record,false), Constant('/'), Field(fld3,false), Constant(': ('), Field(username,false), Constant(') '), Field(action,false)}" -match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ +var part14 = match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ dup8, dup2, dup3, @@ -345,8 +324,7 @@ match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3} var msg14 = msg("named:14", part14); -var part15 = // "Pattern{Constant('too many timeouts resolving ''), Field(fld3,false), Constant('' ('), Field(fld4,false), Constant('): disabling EDNS')}" -match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ +var part15 = match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ dup10, setc("event_description","named:too many timeouts resolving DNS."), dup11, @@ -355,8 +333,7 @@ match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '% var msg15 = msg("named:15", part15); -var part16 = // "Pattern{Constant('FORMERR resolving ''), Field(hostname,false), Constant('': '), Field(saddr,false), Constant('#'), Field(fld3,false)}" -match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ +var part16 = match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ dup10, setc("event_description","named:FORMERR resolving DNS."), dup11, @@ -365,8 +342,7 @@ match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname} var msg16 = msg("named:16", part16); -var part17 = // "Pattern{Constant('unexpected RCODE (SERVFAIL) resolving ''), Field(hostname,false), Constant('': '), Field(saddr,false), Constant('#'), Field(fld3,false)}" -match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ +var part17 = match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ dup10, setc("event_description","named:unexpected RCODE (SERVFAIL) resolving DNS."), dup11, @@ -395,8 +371,7 @@ var select2 = linear_select([ msg17, ]); -var part18 = // "Pattern{Constant('Integrated HTTP-Proxy '), Field(version,false)}" -match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ +var part18 = match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ dup12, setc("event_description","httpproxy:Integrated HTTP-Proxy."), dup11, @@ -405,8 +380,7 @@ match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{ve var msg18 = msg("httpproxy:09", part18); -var part19 = // "Pattern{Constant('['), Field(fld2,false), Constant('] parse_address ('), Field(fld3,false), Constant(') getaddrinfo: passthrough.fw-notify.net: Name or service not known')}" -match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ +var part19 = match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ dup10, setc("event_description","httpproxy:Name or service not known."), dup11, @@ -415,8 +389,7 @@ match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (% var msg19 = msg("httpproxy:10", part19); -var part20 = // "Pattern{Constant('['), Field(fld2,false), Constant('] confd_config_filter ('), Field(fld3,false), Constant(') failed to resolve passthrough.fw-notify.net, using '), Field(saddr,false)}" -match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ +var part20 = match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ dup10, setc("event_description","httpproxy:failed to resolve passthrough."), dup11, @@ -425,8 +398,7 @@ match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_fil var msg20 = msg("httpproxy:11", part20); -var part21 = // "Pattern{Constant('['), Field(fld2,false), Constant('] ssl_log_errors ('), Field(fld3,false), Constant(') '), Field(fld4,false), Constant('ssl handshake failure'), Field(fld5,false)}" -match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ +var part21 = match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ dup10, setc("event_description","httpproxy:ssl handshake failure."), dup11, @@ -435,8 +407,7 @@ match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors ( var msg21 = msg("httpproxy:12", part21); -var part22 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_decrypt ('), Field(fld3,false), Constant(') EVP_DecryptFinal failed')}" -match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ +var part22 = match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ dup10, setc("event_description","httpproxy:EVP_DecryptFinal failed."), dup11, @@ -445,8 +416,7 @@ match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fl var msg22 = msg("httpproxy:13", part22); -var part23 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_server_cmd ('), Field(fld3,false), Constant(') decrypt failed')}" -match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ +var part23 = match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ dup10, setc("event_description","httpproxy:decrypt failed."), dup11, @@ -455,8 +425,7 @@ match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (% var msg23 = msg("httpproxy:14", part23); -var part24 = // "Pattern{Constant('['), Field(fld2,false), Constant('] clamav_reload ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ +var part24 = match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:reloading av pattern"), dup11, @@ -465,8 +434,7 @@ match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (% var msg24 = msg("httpproxy:15", part24); -var part25 = // "Pattern{Constant('['), Field(fld2,false), Constant('] sc_check_servers ('), Field(fld3,false), Constant(') server ''), Field(hostname,false), Constant('' access time: '), Field(fld4,false)}" -match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ +var part25 = match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ dup12, setc("event_description","httpproxy:sc_check_servers.Server checked."), dup11, @@ -475,8 +443,7 @@ match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers var msg25 = msg("httpproxy:16", part25); -var part26 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') shutdown finished, exiting')}" -match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ +var part26 = match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ dup12, setc("event_description","httpproxy:shutdown finished, exiting."), dup11, @@ -485,8 +452,7 @@ match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) s var msg26 = msg("httpproxy:17", part26); -var part27 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') reading configuration')}" -match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ +var part27 = match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ dup12, setc("event_description","httpproxy:"), dup11, @@ -495,8 +461,7 @@ match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) r var msg27 = msg("httpproxy:18", part27); -var part28 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') reading profiles')}" -match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ +var part28 = match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ dup12, setc("event_description","httpproxy:reading profiles"), dup11, @@ -505,8 +470,7 @@ match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) r var msg28 = msg("httpproxy:19", part28); -var part29 = // "Pattern{Constant('['), Field(fld2,false), Constant('] main ('), Field(fld3,false), Constant(') finished startup')}" -match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ +var part29 = match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ dup12, setc("event_description","httpproxy:finished startup"), dup11, @@ -515,8 +479,7 @@ match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) f var msg29 = msg("httpproxy:20", part29); -var part30 = // "Pattern{Constant('['), Field(fld2,false), Constant('] read_request_headers ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ +var part30 = match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:read_request_headers related message."), dup11, @@ -525,8 +488,7 @@ match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_hea var msg30 = msg("httpproxy:21", part30); -var part31 = // "Pattern{Constant('['), Field(fld2,false), Constant('] epoll_loop ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ +var part31 = match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:epoll_loop related message."), dup11, @@ -535,8 +497,7 @@ match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fl var msg31 = msg("httpproxy:22", part31); -var part32 = // "Pattern{Constant('['), Field(fld2,false), Constant('] scan_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ +var part32 = match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:scan_exit related message."), dup11, @@ -545,8 +506,7 @@ match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld var msg32 = msg("httpproxy:23", part32); -var part33 = // "Pattern{Constant('['), Field(fld2,false), Constant('] epoll_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ +var part33 = match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:epoll_exit related message."), dup11, @@ -555,8 +515,7 @@ match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fl var msg33 = msg("httpproxy:24", part33); -var part34 = // "Pattern{Constant('['), Field(fld2,false), Constant('] disk_cache_exit ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ +var part34 = match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:disk_cache_exit related message."), dup11, @@ -565,8 +524,7 @@ match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit var msg34 = msg("httpproxy:25", part34); -var part35 = // "Pattern{Constant('['), Field(fld2,false), Constant('] disk_cache_zap ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ +var part35 = match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:disk_cache_zap related message."), dup11, @@ -575,8 +533,7 @@ match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap ( var msg35 = msg("httpproxy:26", part35); -var part36 = // "Pattern{Constant('['), Field(fld2,false), Constant('] scanner_init ('), Field(fld3,false), Constant(') '), Field(info,false)}" -match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ +var part36 = match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ dup12, setc("event_description","httpproxy:scanner_init related message."), dup11, @@ -663,8 +620,7 @@ var select3 = linear_select([ msg37, ]); -var part38 = // "Pattern{Constant('T='), Field(fld3,true), Constant(' ------ 1 - [exit] '), Field(action,false), Constant(': '), Field(disposition,false)}" -match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ +var part38 = match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ dup16, dup2, dup3, @@ -711,8 +667,7 @@ var part39 = tagval("MESSAGE#38:ulogd:01", "nwparser.payload", tvm, { var msg39 = msg("ulogd:01", part39); -var part40 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity for Apache/'), Field(fld5,true), Constant(' ('), Field(fld6,false), Constant(') configured.')}" -match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ +var part40 = match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ dup6, setc("disposition","configured"), dup2, @@ -721,8 +676,7 @@ match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log} var msg40 = msg("reverseproxy:01", part40); -var part41 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity: '), Field(fld5,true), Constant(' compiled version="'), Field(fld6,false), Constant('"; loaded version="'), Field(fld7,false), Constant('"')}" -match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ +var part41 = match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ dup17, dup2, dup3, @@ -730,8 +684,7 @@ match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log} var msg41 = msg("reverseproxy:02", part41); -var part42 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ModSecurity: '), Field(fld5,true), Constant(' compiled version="'), Field(fld6,false), Constant('"')}" -match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ +var part42 = match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ dup17, dup2, dup3, @@ -739,8 +692,7 @@ match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log} var msg42 = msg("reverseproxy:03", part42); -var part43 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] '), Field(fld5,true), Constant(' configured -- '), Field(disposition,true), Constant(' normal operations')}" -match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ +var part43 = match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ dup17, setc("event_id","AH00292"), dup2, @@ -749,8 +701,7 @@ match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log} var msg43 = msg("reverseproxy:04", part43); -var part44 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] ['), Field(fld5,false), Constant('] Hostname in '), Field(network_service,true), Constant(' request ('), Field(fld6,false), Constant(') does not match the server name ('), Field(ddomain,false), Constant(')')}" -match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ +var part44 = match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ setc("eventcategory","1805010000"), dup18, dup2, @@ -759,15 +710,13 @@ match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log} var msg44 = msg("reverseproxy:06", part44); -var part45 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00297: '), Field(action,true), Constant(' received. Doing'), Field(p0,false)}" -match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); +var part45 = match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); var select4 = linear_select([ dup19, ]); -var part46 = // "Pattern{Field(,false), Constant('graceful '), Field(disposition,false)}" -match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); +var part46 = match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); var all1 = all_match({ processors: [ @@ -785,8 +734,7 @@ var all1 = all_match({ var msg45 = msg("reverseproxy:07", all1); -var part47 = // "Pattern{Constant('AH00112: Warning: DocumentRoot ['), Field(web_root,false), Constant('] does not exist')}" -match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ +var part47 = match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ dup4, setc("event_id","AH00112"), dup2, @@ -795,8 +743,7 @@ match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: Docum var msg46 = msg("reverseproxy:08", part47); -var part48 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00094: Command line: ''), Field(web_root,false), Constant(''')}" -match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ +var part48 = match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ setc("eventcategory","1605010000"), setc("event_id","AH00094"), dup2, @@ -805,8 +752,7 @@ match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log} var msg47 = msg("reverseproxy:09", part48); -var part49 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00291: long lost child came home! (pid '), Field(fld5,false), Constant(')')}" -match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ +var part49 = match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ dup12, setc("event_id","AH00291"), dup2, @@ -815,8 +761,7 @@ match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log} var msg48 = msg("reverseproxy:10", part49); -var part50 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH02572: Failed to configure at least one certificate and key for '), Field(fld5,false), Constant(':'), Field(fld6,false)}" -match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ +var part50 = match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ dup20, setc("event_id","AH02572"), dup2, @@ -825,8 +770,7 @@ match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log} var msg49 = msg("reverseproxy:11", part50); -var part51 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] SSL Library Error: error:'), Field(resultcode,false), Constant(':'), Field(result,false)}" -match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ +var part51 = match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ dup20, setc("context","SSL Library Error"), dup2, @@ -835,8 +779,7 @@ match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log} var msg50 = msg("reverseproxy:12", part51); -var part52 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH02312: Fatal error initialising mod_ssl, '), Field(disposition,false), Constant('.')}" -match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ +var part52 = match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ dup20, setc("result","Fatal error"), setc("event_id","AH02312"), @@ -846,8 +789,7 @@ match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log} var msg51 = msg("reverseproxy:13", part52); -var part53 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00020: Configuration Failed, '), Field(disposition,false)}" -match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ +var part53 = match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ dup20, setc("result","Configuration Failed"), setc("event_id","AH00020"), @@ -857,8 +799,7 @@ match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log} var msg52 = msg("reverseproxy:14", part53); -var part54 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00098: pid file '), Field(filename,true), Constant(' overwritten -- Unclean shutdown of previous Apache run?')}" -match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ +var part54 = match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ setc("eventcategory","1609000000"), setc("context","Unclean shutdown"), setc("event_id","AH00098"), @@ -868,8 +809,7 @@ match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log} var msg53 = msg("reverseproxy:15", part54); -var part55 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00295: caught '), Field(action,false), Constant(', '), Field(disposition,false)}" -match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ +var part55 = match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ dup16, setc("event_id","AH00295"), dup2, @@ -878,19 +818,16 @@ match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log} var msg54 = msg("reverseproxy:16", part55); -var part56 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(result,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"]'), Field(p0,false)}" -match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); +var part56 = match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); -var part57 = // "Pattern{Constant(' [rev "'), Field(fld6,false), Constant('"]'), Field(p0,false)}" -match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); +var part57 = match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); var select5 = linear_select([ part57, dup19, ]); -var part58 = // "Pattern{Field(,false), Constant('[msg "'), Field(comments,false), Constant('"] [data "'), Field(daddr,false), Constant('"] [severity "'), Field(severity,false), Constant('"] [ver "'), Field(policyname,false), Constant('"] [maturity "'), Field(fld7,false), Constant('"] [accuracy "'), Field(fld8,false), Constant('"] '), Field(context,true), Constant(' [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); +var part58 = match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); var all2 = all_match({ processors: [ @@ -907,8 +844,7 @@ var all2 = all_match({ var msg55 = msg("reverseproxy:17", all2); -var part59 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] No signature found, cookie: '), Field(fld5,false)}" -match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ +var part59 = match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ dup4, dup22, dup2, @@ -917,8 +853,7 @@ match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log} var msg56 = msg("reverseproxy:18", part59); -var part60 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] '), Field(disposition,true), Constant(' ''), Field(fld5,false), Constant('' from request due to missing/invalid signature')}" -match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ +var part60 = match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ dup23, dup22, dup2, @@ -927,8 +862,7 @@ match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log} var msg57 = msg("reverseproxy:19", part60); -var part61 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"] [msg "'), Field(comments,false), Constant('"] [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ +var part61 = match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ dup21, dup2, dup3, @@ -936,8 +870,7 @@ match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log} var msg58 = msg("reverseproxy:20", part61); -var part62 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH01909: '), Field(daddr,false), Constant(':'), Field(dport,false), Constant(':'), Field(fld5,true), Constant(' server certificate does NOT include an ID which matches the server name')}" -match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ +var part62 = match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ dup20, dup18, setc("event_id","AH01909"), @@ -947,8 +880,7 @@ match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log} var msg59 = msg("reverseproxy:21", part62); -var part63 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH01915: Init: ('), Field(daddr,false), Constant(':'), Field(dport,false), Constant(') You configured '), Field(network_service,false), Constant('('), Field(fld5,false), Constant(') on the '), Field(fld6,false), Constant('('), Field(fld7,false), Constant(') port!')}" -match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ +var part63 = match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ dup20, setc("comments","Invalid port configuration"), dup2, @@ -957,8 +889,7 @@ match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log} var msg60 = msg("reverseproxy:22", part63); -var part64 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Rule '), Field(rulename,true), Constant(' [id "'), Field(rule,false), Constant('"][file "'), Field(filename,false), Constant('"][line "'), Field(fld5,false), Constant('"] - Execution error - PCRE limits exceeded ('), Field(fld6,false), Constant('): ('), Field(fld7,false), Constant('). [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ +var part64 = match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ dup21, dup2, dup3, @@ -966,8 +897,7 @@ match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log} var msg61 = msg("reverseproxy:23", part64); -var part65 = // "Pattern{Constant('rManage\\x22,\\x22manageLiveSystemSettings\\x22,\\x22accessViewJobs\\x22,\\x22exportList\\..."] [ver "'), Field(policyname,false), Constant('"] [maturity "'), Field(fld3,false), Constant('"] [accuracy "'), Field(fld4,false), Constant('"] '), Field(context,true), Constant(' [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ +var part65 = match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ dup21, dup2, dup3, @@ -975,8 +905,7 @@ match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22m var msg62 = msg("reverseproxy:24", part65); -var part66 = // "Pattern{Constant('ARGS:userPermissions: [\\x22dashletAccessAlertingRecentAlertsPanel\\x22,\\x22dashletAccessAlerterTopAlertsDashlet\\x22,\\x22accessViewRules\\x22,\\x22deployLiveResources\\x22,\\x22vi..."] [severity [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ +var part66 = match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ dup21, dup2, dup3, @@ -984,33 +913,27 @@ match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [ var msg63 = msg("reverseproxy:25", part66); -var part67 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: '), Field(disposition,true), Constant(' with code '), Field(resultcode,true), Constant(' ('), Field(fld5,false), Constant('). '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld6,false), Constant('"] [id "'), Field(rule,false), Constant('"]'), Field(p0,false)}" -match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); +var part67 = match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); -var part68 = // "Pattern{Constant(' [rev "'), Field(fld7,false), Constant('"]'), Field(p0,false)}" -match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); +var part68 = match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); var select6 = linear_select([ part68, dup19, ]); -var part69 = // "Pattern{Field(,false), Constant('[msg "'), Field(comments,false), Constant('"] [data "Last Matched Data: '), Field(p0,false)}" -match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); +var part69 = match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); -var part70 = // "Pattern{Field(daddr,false), Constant(':'), Field(dport,false), Constant('"] [hostname "'), Field(p0,false)}" -match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); +var part70 = match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); -var part71 = // "Pattern{Field(daddr,false), Constant('"] [hostname "'), Field(p0,false)}" -match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); +var part71 = match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); var select7 = linear_select([ part70, part71, ]); -var part72 = // "Pattern{Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]')}" -match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); +var part72 = match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); var all3 = all_match({ processors: [ @@ -1029,8 +952,7 @@ var all3 = all_match({ var msg64 = msg("reverseproxy:26", all3); -var part73 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] '), Field(disposition,true), Constant(' while reading reply from cssd, referer: '), Field(web_referer,false)}" -match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ +var part73 = match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ dup25, dup2, dup3, @@ -1038,8 +960,7 @@ match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log} var msg65 = msg("reverseproxy:27", part73); -var part74 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon error found in request '), Field(web_root,false), Constant(', referer: '), Field(web_referer,false)}" -match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ +var part74 = match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ dup26, setc("result","virus daemon error"), dup2, @@ -1048,8 +969,7 @@ match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log} var msg66 = msg("reverseproxy:28", part74); -var part75 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] mod_avscan_input_filter: virus found, referer: '), Field(web_referer,false)}" -match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ +var part75 = match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ dup27, setc("result","virus found"), dup2, @@ -1058,8 +978,7 @@ match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log} var msg67 = msg("reverseproxy:29", part75); -var part76 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (13)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] AH01095: prefetch request body failed to '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld5,false), Constant(') from '), Field(fld6,true), Constant(' (), referer: '), Field(web_referer,false)}" -match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ +var part76 = match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ dup24, dup28, dup2, @@ -1068,8 +987,7 @@ match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log} var msg68 = msg("reverseproxy:30", part76); -var part77 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot read reply: Operation now in progress (115), referer: '), Field(web_referer,false)}" -match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ +var part77 = match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ dup25, setc("result","Cannot read reply"), dup2, @@ -1078,8 +996,7 @@ match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log} var msg69 = msg("reverseproxy:31", part77); -var part78 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot connect: '), Field(result,true), Constant(' (111), referer: '), Field(web_referer,false)}" -match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ +var part78 = match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ dup25, dup2, dup3, @@ -1087,8 +1004,7 @@ match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log} var msg70 = msg("reverseproxy:32", part78); -var part79 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] cannot connect: '), Field(result,true), Constant(' (111)')}" -match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ +var part79 = match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ dup25, dup2, dup3, @@ -1096,8 +1012,7 @@ match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log} var msg71 = msg("reverseproxy:33", part79); -var part80 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon connection problem found in request '), Field(url,false), Constant(', referer: '), Field(web_referer,false)}" -match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ +var part80 = match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ dup26, dup29, dup2, @@ -1106,8 +1021,7 @@ match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log} var msg72 = msg("reverseproxy:34", part80); -var part81 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] virus daemon connection problem found in request '), Field(url,false)}" -match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ +var part81 = match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ dup26, dup29, dup2, @@ -1116,8 +1030,7 @@ match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log} var msg73 = msg("reverseproxy:35", part81); -var part82 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] mod_avscan_input_filter: virus found')}" -match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ +var part82 = match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ dup27, setc("result","Virus found"), dup2, @@ -1126,8 +1039,7 @@ match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log} var msg74 = msg("reverseproxy:36", part82); -var part83 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (13)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] AH01095: prefetch request body failed to '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' ('), Field(fld5,false), Constant(') from '), Field(fld6,true), Constant(' ()')}" -match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ +var part83 = match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ dup24, dup28, dup2, @@ -1136,8 +1048,7 @@ match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log} var msg75 = msg("reverseproxy:37", part83); -var part84 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] Invalid signature, cookie: JSESSIONID')}" -match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ +var part84 = match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ dup25, dup2, dup3, @@ -1145,8 +1056,7 @@ match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log} var msg76 = msg("reverseproxy:38", part84); -var part85 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] Form validation failed: Received unhardened form data, referer: '), Field(web_referer,false)}" -match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ +var part85 = match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ dup23, setc("result","Form validation failed"), dup2, @@ -1155,8 +1065,7 @@ match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log} var msg77 = msg("reverseproxy:39", part85); -var part86 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] sending trickle failed: 103')}" -match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ +var part86 = match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ dup25, setc("result","Sending trickle failed"), dup2, @@ -1165,8 +1074,7 @@ match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log} var msg78 = msg("reverseproxy:40", part86); -var part87 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] client requesting '), Field(web_root,true), Constant(' has '), Field(disposition,false)}" -match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ +var part87 = match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ dup30, dup2, dup3, @@ -1174,8 +1082,7 @@ match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log} var msg79 = msg("reverseproxy:41", part87); -var part88 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] mod_avscan_check_file_single_part() called with parameter filename='), Field(filename,false)}" -match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ +var part88 = match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ setc("eventcategory","1603050000"), dup2, dup3, @@ -1183,8 +1090,7 @@ match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log} var msg80 = msg("reverseproxy:42", part88); -var part89 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (70007)The '), Field(disposition,true), Constant(' specified has expired: [client '), Field(gateway,false), Constant('] AH01110: error reading response')}" -match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ +var part89 = match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ dup30, setc("event_id","AH01110"), setc("result","Error reading response"), @@ -1194,8 +1100,7 @@ match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log} var msg81 = msg("reverseproxy:43", part89); -var part90 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (22)'), Field(result,false), Constant(': [client '), Field(gateway,false), Constant('] No form context found when parsing '), Field(fld5,true), Constant(' tag, referer: '), Field(web_referer,false)}" -match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ +var part90 = match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ setc("eventcategory","1601020000"), setc("result","No form context found"), dup2, @@ -1204,8 +1109,7 @@ match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log} var msg82 = msg("reverseproxy:44", part90); -var part91 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] (111)'), Field(result,false), Constant(': AH00957: '), Field(network_service,false), Constant(': attempt to connect to '), Field(daddr,false), Constant(':'), Field(dport,true), Constant(' ('), Field(fld5,false), Constant(') failed')}" -match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ +var part91 = match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ dup25, setc("event_id","AH00957"), dup2, @@ -1214,8 +1118,7 @@ match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log} var msg83 = msg("reverseproxy:45", part91); -var part92 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] AH00959: ap_proxy_connect_backend disabling worker for ('), Field(daddr,false), Constant(') for '), Field(processing_time,false), Constant('s')}" -match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ +var part92 = match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ dup16, setc("event_id","AH00959"), setc("result","disabling worker"), @@ -1225,8 +1128,7 @@ match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log} var msg84 = msg("reverseproxy:46", part92); -var part93 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ['), Field(fld5,false), Constant('] not all the file sent to the client: '), Field(fld6,false), Constant(', referer: '), Field(web_referer,false)}" -match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ +var part93 = match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ setc("eventcategory","1801000000"), setc("context","Not all file sent to client"), dup2, @@ -1235,8 +1137,7 @@ match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log} var msg85 = msg("reverseproxy:47", part93); -var part94 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] AH01114: '), Field(network_service,false), Constant(': failed to make connection to backend: '), Field(daddr,false), Constant(', referer: '), Field(web_referer,false)}" -match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ +var part94 = match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ dup25, dup31, dup32, @@ -1246,8 +1147,7 @@ match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log} var msg86 = msg("reverseproxy:48", part94); -var part95 = // "Pattern{Constant('['), Field(fld3,false), Constant('] ['), Field(event_log,false), Constant(':'), Field(severity,false), Constant('] [pid '), Field(process_id,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] AH01114: '), Field(network_service,false), Constant(': failed to make connection to backend: '), Field(daddr,false)}" -match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ +var part95 = match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ dup25, dup31, dup32, @@ -1376,8 +1276,7 @@ var part98 = tagval("MESSAGE#89:confd:01", "nwparser.payload", tvm, { var msg90 = msg("confd:01", part98); -var part99 = // "Pattern{Constant('Frox started'), Field(,false)}" -match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ +var part99 = match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ dup12, setc("event_description","frox:FTP Proxy Frox started."), dup11, @@ -1386,8 +1285,7 @@ match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain( var msg91 = msg("frox", part99); -var part100 = // "Pattern{Constant('Listening on '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ +var part100 = match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ dup12, setc("event_description","frox:FTP Proxy listening on port."), dup11, @@ -1396,8 +1294,7 @@ match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}" var msg92 = msg("frox:01", part100); -var part101 = // "Pattern{Constant('Dropped privileges'), Field(,false)}" -match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ +var part101 = match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ dup12, setc("event_description","frox:FTP Proxy dropped priveleges."), dup11, @@ -1412,8 +1309,7 @@ var select9 = linear_select([ msg93, ]); -var part102 = // "Pattern{Constant('Classifier configuration reloaded successfully'), Field(,false)}" -match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ +var part102 = match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ dup12, setc("event_description","afcd: IM/P2P Classifier configuration reloaded successfully."), dup11, @@ -1422,8 +1318,7 @@ match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded var msg94 = msg("afcd", part102); -var part103 = // "Pattern{Constant('Starting strongSwan '), Field(fld2,true), Constant(' IPsec [starter]...')}" -match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ +var part103 = match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ dup12, setc("event_description","ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]..."), dup11, @@ -1432,8 +1327,7 @@ match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld var msg95 = msg("ipsec_starter", part103); -var part104 = // "Pattern{Constant('IP address or index of physical interface changed -> reinit of ipsec interface'), Field(,false)}" -match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ +var part104 = match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ dup12, setc("event_description","ipsec_starter: IP address or index of physical interface changed."), dup11, @@ -1447,8 +1341,7 @@ var select10 = linear_select([ msg96, ]); -var part105 = // "Pattern{Constant('Starting Pluto ('), Field(info,false), Constant(')')}" -match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ +var part105 = match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ dup12, setc("event_description","pluto: Starting Pluto."), dup11, @@ -1457,8 +1350,7 @@ match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", proces var msg97 = msg("pluto", part105); -var part106 = // "Pattern{Constant('including NAT-Traversal patch ('), Field(info,false), Constant(')')}" -match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ +var part106 = match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ dup12, setc("event_description","pluto: including NAT-Traversal patch."), dup11, @@ -1467,8 +1359,7 @@ match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch var msg98 = msg("pluto:01", part106); -var part107 = // "Pattern{Constant('ike_alg: Activating '), Field(info,true), Constant(' encryption: Ok')}" -match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ +var part107 = match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ dup33, setc("event_description","pluto: Activating encryption algorithm."), dup11, @@ -1477,8 +1368,7 @@ match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} var msg99 = msg("pluto:02", part107); -var part108 = // "Pattern{Constant('ike_alg: Activating '), Field(info,true), Constant(' hash: Ok')}" -match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ +var part108 = match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ dup33, setc("event_description","pluto: Activating hash algorithm."), dup11, @@ -1487,8 +1377,7 @@ match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} var msg100 = msg("pluto:03", part108); -var part109 = // "Pattern{Constant('Testing registered IKE encryption algorithms:'), Field(,false)}" -match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ +var part109 = match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ dup12, setc("event_description","pluto: Testing registered IKE encryption algorithms"), dup11, @@ -1497,8 +1386,7 @@ match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryp var msg101 = msg("pluto:04", part109); -var part110 = // "Pattern{Field(info,true), Constant(' self-test not available')}" -match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ +var part110 = match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ dup12, setc("event_description","pluto: Algorithm self-test not available."), dup11, @@ -1507,8 +1395,7 @@ match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not avail var msg102 = msg("pluto:05", part110); -var part111 = // "Pattern{Field(info,true), Constant(' self-test passed')}" -match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ +var part111 = match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ dup12, setc("event_description","pluto: Algorithm self-test passed."), dup11, @@ -1517,8 +1404,7 @@ match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", var msg103 = msg("pluto:06", part111); -var part112 = // "Pattern{Constant('Using KLIPS IPsec interface code'), Field(,false)}" -match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ +var part112 = match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ dup12, setc("event_description","pluto: Using KLIPS IPsec interface code"), dup11, @@ -1527,8 +1413,7 @@ match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface c var msg104 = msg("pluto:07", part112); -var part113 = // "Pattern{Constant('adding interface '), Field(interface,true), Constant(' '), Field(saddr,false), Constant(':'), Field(sport,false)}" -match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ +var part113 = match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ dup12, setc("event_description","pluto: adding interface"), dup11, @@ -1537,8 +1422,7 @@ match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface- var msg105 = msg("pluto:08", part113); -var part114 = // "Pattern{Constant('loading secrets from "'), Field(filename,false), Constant('"')}" -match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ +var part114 = match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ dup34, setc("event_description","pluto: loading secrets"), dup11, @@ -1547,8 +1431,7 @@ match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{file var msg106 = msg("pluto:09", part114); -var part115 = // "Pattern{Constant('loaded private key file ''), Field(filename,false), Constant('' ('), Field(filename_size,true), Constant(' bytes)')}" -match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ +var part115 = match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ dup34, setc("event_description","pluto: loaded private key file"), dup11, @@ -1557,8 +1440,7 @@ match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{fi var msg107 = msg("pluto:10", part115); -var part116 = // "Pattern{Constant('added connection description "'), Field(fld2,false), Constant('"')}" -match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ +var part116 = match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ dup12, setc("event_description","pluto: added connection description"), dup11, @@ -1567,8 +1449,7 @@ match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description var msg108 = msg("pluto:11", part116); -var part117 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': initiating Main Mode')}" -match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ +var part117 = match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ dup12, dup35, dup11, @@ -1577,8 +1458,7 @@ match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiat var msg109 = msg("pluto:12", part117); -var part118 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': max number of retransmissions ('), Field(fld4,false), Constant(') reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message')}" -match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ +var part118 = match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ dup10, dup36, dup11, @@ -1587,8 +1467,7 @@ match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max num var msg110 = msg("pluto:13", part118); -var part119 = // "Pattern{Constant('"'), Field(fld2,false), Constant('" #'), Field(fld3,false), Constant(': starting keying attempt '), Field(fld4,true), Constant(' of an unlimited number')}" -match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ +var part119 = match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ dup12, dup37, dup11, @@ -1597,8 +1476,7 @@ match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: startin var msg111 = msg("pluto:14", part119); -var part120 = // "Pattern{Constant('forgetting secrets'), Field(,false)}" -match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ +var part120 = match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ dup12, setc("event_description","pluto:forgetting secrets"), dup11, @@ -1607,8 +1485,7 @@ match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", proce var msg112 = msg("pluto:15", part120); -var part121 = // "Pattern{Constant('Changing to directory ''), Field(directory,false), Constant(''')}" -match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ +var part121 = match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ dup12, setc("event_description","pluto:Changing to directory"), dup11, @@ -1617,8 +1494,7 @@ match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{dire var msg113 = msg("pluto:17", part121); -var part122 = // "Pattern{Constant('| *time to handle event'), Field(,false)}" -match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ +var part122 = match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ dup12, setc("event_description","pluto:*time to handle event"), dup11, @@ -1627,8 +1503,7 @@ match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", var msg114 = msg("pluto:18", part122); -var part123 = // "Pattern{Constant('| *received kernel message'), Field(,false)}" -match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ +var part123 = match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ dup12, setc("event_description","pluto:*received kernel message"), dup11, @@ -1637,8 +1512,7 @@ match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{} var msg115 = msg("pluto:19", part123); -var part124 = // "Pattern{Constant('| rejected packet:'), Field(,false)}" -match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ +var part124 = match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ dup25, setc("event_description","pluto:rejected packet"), dup11, @@ -1647,8 +1521,7 @@ match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", proce var msg116 = msg("pluto:20", part124); -var part125 = // "Pattern{Constant('| next event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds for #'), Field(fld3,false)}" -match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ +var part125 = match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ dup12, dup11, dup2, @@ -1656,8 +1529,7 @@ match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} var msg117 = msg("pluto:21", part125); -var part126 = // "Pattern{Constant('| next event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds')}" -match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ +var part126 = match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ dup12, dup11, dup2, @@ -1665,8 +1537,7 @@ match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} var msg118 = msg("pluto:22", part126); -var part127 = // "Pattern{Constant('| inserting event '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds for #'), Field(fld3,false)}" -match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ +var part127 = match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ dup12, dup11, dup2, @@ -1674,8 +1545,7 @@ match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_typ var msg119 = msg("pluto:23", part127); -var part128 = // "Pattern{Constant('| event after this is '), Field(event_type,true), Constant(' in '), Field(fld2,true), Constant(' seconds')}" -match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ +var part128 = match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ dup12, dup11, dup2, @@ -1683,8 +1553,7 @@ match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event var msg120 = msg("pluto:24", part128); -var part129 = // "Pattern{Constant('| recent '), Field(action,true), Constant(' activity '), Field(fld2,true), Constant(' seconds ago, '), Field(info,false)}" -match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ +var part129 = match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ dup12, dup11, dup2, @@ -1692,8 +1561,7 @@ match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity var msg121 = msg("pluto:25", part129); -var part130 = // "Pattern{Constant('| *received '), Field(rbytes,true), Constant(' bytes from '), Field(saddr,false), Constant(':'), Field(sport,true), Constant(' on '), Field(dinterface,false)}" -match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ +var part130 = match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ dup12, dup11, dup2, @@ -1701,8 +1569,7 @@ match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes var msg122 = msg("pluto:26", part130); -var part131 = // "Pattern{Constant('| received '), Field(action,true), Constant(' notification '), Field(msg,true), Constant(' with seqno = '), Field(fld2,false)}" -match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ +var part131 = match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ dup12, dup11, dup2, @@ -1710,8 +1577,7 @@ match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notifi var msg123 = msg("pluto:27", part131); -var part132 = // "Pattern{Constant('| sent '), Field(action,true), Constant(' notification '), Field(msg,true), Constant(' with seqno = '), Field(fld2,false)}" -match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ +var part132 = match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ dup12, dup11, dup2, @@ -1719,8 +1585,7 @@ match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notificati var msg124 = msg("pluto:28", part132); -var part133 = // "Pattern{Constant('| inserting event '), Field(event_type,false), Constant(', timeout in '), Field(fld2,true), Constant(' seconds')}" -match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ +var part133 = match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ dup12, dup11, dup2, @@ -1728,8 +1593,7 @@ match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_typ var msg125 = msg("pluto:29", part133); -var part134 = // "Pattern{Constant('| handling event '), Field(event_type,true), Constant(' for '), Field(saddr,true), Constant(' "'), Field(fld2,false), Constant('" #'), Field(fld3,false)}" -match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ +var part134 = match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ dup12, dup11, dup2, @@ -1737,8 +1601,7 @@ match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type var msg126 = msg("pluto:30", part134); -var part135 = // "Pattern{Constant('| '), Field(event_description,false)}" -match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ +var part135 = match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ dup12, dup11, dup2, @@ -1746,8 +1609,7 @@ match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", proc var msg127 = msg("pluto:31", part135); -var part136 = // "Pattern{Field(fld2,false), Constant(': asynchronous network error report on '), Field(interface,true), Constant(' for message to '), Field(daddr,true), Constant(' port '), Field(dport,false), Constant(', complainant '), Field(saddr,false), Constant(': Connection refused [errno '), Field(fld4,false), Constant(', origin ICMP type '), Field(icmptype,true), Constant(' code '), Field(icmpcode,true), Constant(' (not authenticated)]')}" -match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ +var part136 = match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ dup12, setc("event_description","not authenticated"), dup11, @@ -1756,8 +1618,7 @@ match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network var msg128 = msg("pluto:32", part136); -var part137 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': initiating Main Mode')}" -match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ +var part137 = match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ dup12, dup35, dup11, @@ -1766,8 +1627,7 @@ match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr- var msg129 = msg("pluto:33", part137); -var part138 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': max number of retransmissions ('), Field(fld5,false), Constant(') reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message')}" -match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ +var part138 = match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ dup12, dup36, dup11, @@ -1776,8 +1636,7 @@ match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr- var msg130 = msg("pluto:34", part138); -var part139 = // "Pattern{Constant('"'), Field(fld2,false), Constant('"['), Field(fld4,false), Constant('] '), Field(saddr,true), Constant(' #'), Field(fld3,false), Constant(': starting keying attempt '), Field(fld5,true), Constant(' of an unlimited number')}" -match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ +var part139 = match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ dup12, dup37, dup11, @@ -1824,8 +1683,7 @@ var select11 = linear_select([ msg131, ]); -var part140 = // "Pattern{Constant('This binary does not support kernel L2TP.'), Field(,false)}" -match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ +var part140 = match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ setc("eventcategory","1607000000"), setc("event_description","xl2tpd:This binary does not support kernel L2TP."), dup11, @@ -1834,8 +1692,7 @@ match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support ke var msg132 = msg("xl2tpd", part140); -var part141 = // "Pattern{Constant('xl2tpd version '), Field(version,true), Constant(' started on PID:'), Field(fld2,false)}" -match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ +var part141 = match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ dup12, setc("event_description","xl2tpd:xl2tpd started."), dup11, @@ -1844,8 +1701,7 @@ match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} var msg133 = msg("xl2tpd:01", part141); -var part142 = // "Pattern{Constant('Written by '), Field(info,false)}" -match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ +var part142 = match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ dup12, dup38, dup11, @@ -1854,8 +1710,7 @@ match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", process var msg134 = msg("xl2tpd:02", part142); -var part143 = // "Pattern{Constant('Forked by '), Field(info,false)}" -match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ +var part143 = match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ dup12, dup38, dup11, @@ -1864,8 +1719,7 @@ match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processo var msg135 = msg("xl2tpd:03", part143); -var part144 = // "Pattern{Constant('Inherited by '), Field(info,false)}" -match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ +var part144 = match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ dup12, dup38, dup11, @@ -1874,8 +1728,7 @@ match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", proce var msg136 = msg("xl2tpd:04", part144); -var part145 = // "Pattern{Constant('Listening on IP address '), Field(saddr,false), Constant(', port '), Field(sport,false)}" -match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ +var part145 = match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ dup12, dup38, dup11, @@ -1893,8 +1746,7 @@ var select12 = linear_select([ msg137, ]); -var part146 = // "Pattern{Constant('Exiting'), Field(,false)}" -match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ +var part146 = match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ dup12, setc("event_description","barnyard: Exiting"), dup11, @@ -1903,8 +1755,7 @@ match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_cha var msg138 = msg("barnyard:01", part146); -var part147 = // "Pattern{Constant('Initializing daemon mode'), Field(,false)}" -match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ +var part147 = match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ dup12, setc("event_description","barnyard:Initializing daemon mode"), dup11, @@ -1913,8 +1764,7 @@ match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{ var msg139 = msg("barnyard:02", part147); -var part148 = // "Pattern{Constant('Opened spool file ''), Field(filename,false), Constant(''')}" -match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ +var part148 = match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ dup12, setc("event_description","barnyard:Opened spool file."), dup11, @@ -1923,8 +1773,7 @@ match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filen var msg140 = msg("barnyard:03", part148); -var part149 = // "Pattern{Constant('Waiting for new data'), Field(,false)}" -match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ +var part149 = match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ dup12, setc("event_description","barnyard:Waiting for new data"), dup11, @@ -1940,8 +1789,7 @@ var select13 = linear_select([ msg141, ]); -var part150 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP connection from localhost ('), Field(hostname,false), Constant(') ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' closed by QUIT')}" -match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ +var part150 = match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ dup12, setc("event_description","exim:SMTP connection from localhost closed by QUIT"), dup11, @@ -1950,8 +1798,7 @@ match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg142 = msg("exim:01", part150); -var part151 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' ['), Field(saddr,false), Constant('] F=<<'), Field(from,false), Constant('> R=<<'), Field(to,false), Constant('> Accepted: '), Field(info,false)}" -match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ +var part151 = match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ setc("eventcategory","1207010000"), setc("event_description","exim:e-mail accepted from relay."), dup11, @@ -1960,8 +1807,7 @@ match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg143 = msg("exim:02", part151); -var part152 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' <<= '), Field(from,true), Constant(' H=localhost ('), Field(hostname,false), Constant(') ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' P='), Field(protocol,true), Constant(' S='), Field(fld9,true), Constant(' id='), Field(info,false)}" -match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ +var part152 = match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ setc("eventcategory","1207000000"), setc("event_description","exim: e-mail sent."), dup11, @@ -1970,8 +1816,7 @@ match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg144 = msg("exim:03", part152); -var part153 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' == '), Field(from,true), Constant(' R=dnslookup defer ('), Field(fld9,false), Constant('): host lookup did not complete')}" -match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ +var part153 = match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ dup39, setc("event_description","exim: e-mail host lookup did not complete in DNS."), dup11, @@ -1980,8 +1825,7 @@ match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg145 = msg("exim:04", part153); -var part154 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld8,true), Constant(' == '), Field(from,true), Constant(' routing defer ('), Field(fld9,false), Constant('): retry time not reached')}" -match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ +var part154 = match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ dup39, setc("event_description","exim: e-mail routing defer:retry time not reached."), dup11, @@ -1990,8 +1834,7 @@ match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg146 = msg("exim:05", part154); -var part155 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' exim '), Field(version,true), Constant(' daemon started: pid='), Field(fld8,false), Constant(', no queue runs, listening for SMTP on port '), Field(sport,true), Constant(' ('), Field(info,false), Constant(') port '), Field(fld9,true), Constant(' ('), Field(fld10,false), Constant(') and for SMTPS on port '), Field(fld11,true), Constant(' ('), Field(fld12,false), Constant(')')}" -match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ +var part155 = match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ dup12, setc("event_description","exim: exim daemon started."), dup11, @@ -2000,8 +1843,7 @@ match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg147 = msg("exim:06", part155); -var part156 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' Start queue run: pid='), Field(fld8,false)}" -match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ +var part156 = match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ dup12, setc("event_description","exim: Start queue run."), dup11, @@ -2010,8 +1852,7 @@ match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg148 = msg("exim:07", part156); -var part157 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' pid '), Field(fld8,false), Constant(': SIGHUP received: re-exec daemon')}" -match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ +var part157 = match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ dup12, setc("event_description","exim: SIGHUP received: re-exec daemon."), dup11, @@ -2020,8 +1861,7 @@ match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg149 = msg("exim:08", part157); -var part158 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP connection from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" -match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ +var part158 = match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ dup12, setc("event_description","exim: SMTP connection from host."), dup11, @@ -2030,8 +1870,7 @@ match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg150 = msg("exim:09", part158); -var part159 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' rejected EHLO from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" -match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ +var part159 = match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ dup12, setc("event_description","exim:rejected EHLO from host."), dup11, @@ -2040,8 +1879,7 @@ match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg151 = msg("exim:10", part159); -var part160 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' SMTP protocol synchronization error ('), Field(result,false), Constant('): '), Field(fld8,true), Constant(' H=['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" -match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ +var part160 = match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ dup12, setc("event_description","exim:SMTP protocol synchronization error rejected connection from host."), dup11, @@ -2050,8 +1888,7 @@ match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg152 = msg("exim:11", part160); -var part161 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' TLS error on connection from ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" -match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ +var part161 = match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ dup12, setc("event_description","exim:TLS error on connection from host."), dup11, @@ -2060,8 +1897,7 @@ match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg153 = msg("exim:12", part161); -var part162 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld10,true), Constant(' == '), Field(hostname,true), Constant(' R='), Field(fld8,true), Constant(' T='), Field(fld9,false), Constant(': '), Field(info,false)}" -match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ +var part162 = match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ dup12, dup40, dup11, @@ -2070,8 +1906,7 @@ match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg154 = msg("exim:13", part162); -var part163 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' '), Field(fld10,true), Constant(' '), Field(hostname,true), Constant(' ['), Field(saddr,false), Constant(']:'), Field(sport,true), Constant(' '), Field(info,false)}" -match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ +var part163 = match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ dup12, dup40, dup11, @@ -2080,8 +1915,7 @@ match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg155 = msg("exim:14", part163); -var part164 = // "Pattern{Field(fld2,false), Constant('-'), Field(fld3,false), Constant('-'), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(':'), Field(fld6,false), Constant(':'), Field(fld7,true), Constant(' End queue run: '), Field(info,false)}" -match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ +var part164 = match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ dup12, dup40, dup11, @@ -2090,8 +1924,7 @@ match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fl var msg156 = msg("exim:15", part164); -var part165 = // "Pattern{Field(fld2,true), Constant(' '), Field(fld3,false)}" -match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ +var part165 = match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ dup12, dup11, dup2, @@ -2118,8 +1951,7 @@ var select14 = linear_select([ msg157, ]); -var part166 = // "Pattern{Constant('QMGR['), Field(fld2,false), Constant(']: '), Field(fld3,true), Constant(' moved to work queue')}" -match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ +var part166 = match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ dup12, setc("event_description","smtpd: Process moved to work queue."), dup11, @@ -2128,8 +1960,7 @@ match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} move var msg158 = msg("smtpd:01", part166); -var part167 = // "Pattern{Constant('SCANNER['), Field(fld3,false), Constant(']: id="1000" severity="'), Field(severity,false), Constant('" sys="'), Field(fld4,false), Constant('" sub="'), Field(service,false), Constant('" name="'), Field(event_description,false), Constant('" srcip="'), Field(saddr,false), Constant('" from="'), Field(from,false), Constant('" to="'), Field(to,false), Constant('" subject="'), Field(subject,false), Constant('" queueid="'), Field(fld5,false), Constant('" size="'), Field(rbytes,false), Constant('"')}" -match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ +var part167 = match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ setc("eventcategory","1207010100"), dup11, dup2, @@ -2137,8 +1968,7 @@ match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" var msg159 = msg("smtpd:02", part167); -var part168 = // "Pattern{Constant('SCANNER['), Field(fld3,false), Constant(']: Nothing to do, exiting.')}" -match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ +var part168 = match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ dup12, setc("event_description","smtpd: SCANNER: Nothing to do,exiting."), dup11, @@ -2147,8 +1977,7 @@ match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to var msg160 = msg("smtpd:03", part168); -var part169 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: QR globally disabled, status two set to 'disabled'')}" -match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ +var part169 = match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ dup12, setc("event_description","smtpd: MASTER:QR globally disabled, status two set to disabled."), dup11, @@ -2157,8 +1986,7 @@ match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally var msg161 = msg("smtpd:04", part169); -var part170 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: QR globally disabled, status one set to 'disabled'')}" -match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ +var part170 = match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ dup12, setc("event_description","smtpd: MASTER:QR globally disabled, status one set to disabled."), dup11, @@ -2167,8 +1995,7 @@ match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally var msg162 = msg("smtpd:07", part170); -var part171 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: (Re-)loading configuration from Confd')}" -match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ +var part171 = match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ dup12, setc("event_description","smtpd: MASTER:(Re-)loading configuration from Confd."), dup11, @@ -2177,8 +2004,7 @@ match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading var msg163 = msg("smtpd:05", part171); -var part172 = // "Pattern{Constant('MASTER['), Field(fld3,false), Constant(']: Sending QR one')}" -match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ +var part172 = match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ dup12, setc("event_description","smtpd: MASTER:Sending QR one."), dup11, @@ -2197,8 +2023,7 @@ var select15 = linear_select([ msg164, ]); -var part173 = // "Pattern{Constant('Did not receive identification string from '), Field(fld18,false)}" -match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ +var part173 = match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ dup10, setc("event_description","sshd: Did not receive identification string."), dup11, @@ -2207,8 +2032,7 @@ match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification var msg165 = msg("sshd:01", part173); -var part174 = // "Pattern{Constant('Received SIGHUP; restarting.'), Field(,false)}" -match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ +var part174 = match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ dup12, setc("event_description","sshd:Received SIGHUP restarting."), dup11, @@ -2217,8 +2041,7 @@ match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{ var msg166 = msg("sshd:02", part174); -var part175 = // "Pattern{Constant('Server listening on '), Field(saddr,true), Constant(' port '), Field(sport,false), Constant('.')}" -match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ +var part175 = match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ dup12, setc("event_description","sshd:Server listening; restarting."), dup11, @@ -2227,8 +2050,7 @@ match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} var msg167 = msg("sshd:03", part175); -var part176 = // "Pattern{Constant('Invalid user admin from '), Field(fld18,false)}" -match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ +var part176 = match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ dup41, setc("event_description","sshd:Invalid user admin."), dup11, @@ -2237,8 +2059,7 @@ match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld1 var msg168 = msg("sshd:04", part176); -var part177 = // "Pattern{Constant('Failed none for invalid user admin from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" -match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ +var part177 = match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ dup41, setc("event_description","sshd:Failed none for invalid user admin."), dup11, @@ -2247,8 +2068,7 @@ match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user a var msg169 = msg("sshd:05", part177); -var part178 = // "Pattern{Constant('error: Could not get shadow information for NOUSER'), Field(,false)}" -match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ +var part178 = match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ dup10, setc("event_description","sshd:error:Could not get shadow information for NOUSER"), dup11, @@ -2257,8 +2077,7 @@ match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow in var msg170 = msg("sshd:06", part178); -var part179 = // "Pattern{Constant('Failed password for root from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" -match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ +var part179 = match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ dup41, setc("event_description","sshd:Failed password for root."), dup11, @@ -2267,8 +2086,7 @@ match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from var msg171 = msg("sshd:07", part179); -var part180 = // "Pattern{Constant('Accepted password for loginuser from '), Field(saddr,true), Constant(' port '), Field(sport,true), Constant(' '), Field(fld3,false)}" -match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ +var part180 = match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ setc("eventcategory","1302000000"), setc("event_description","sshd:Accepted password for loginuser."), dup11, @@ -2277,8 +2095,7 @@ match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuse var msg172 = msg("sshd:08", part180); -var part181 = // "Pattern{Constant('subsystem request for sftp failed, subsystem not found'), Field(,false)}" -match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ +var part181 = match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ dup10, setc("event_description","sshd:subsystem request for sftp failed,subsystem not found."), dup11, @@ -2319,8 +2136,7 @@ var part182 = tagval("MESSAGE#173:aua:01", "nwparser.payload", tvm, { var msg174 = msg("aua:01", part182); -var part183 = // "Pattern{Constant('created new negotiatorchild'), Field(,false)}" -match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ +var part183 = match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ dup12, setc("event_description","sockd: created new negotiatorchild."), dup11, @@ -2329,8 +2145,7 @@ match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{ var msg175 = msg("sockd:01", part183); -var part184 = // "Pattern{Constant('dante/server '), Field(version,true), Constant(' running')}" -match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ +var part184 = match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ dup12, setc("event_description","sockd:dante/server running."), dup11, @@ -2339,8 +2154,7 @@ match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} run var msg176 = msg("sockd:02", part184); -var part185 = // "Pattern{Constant('sockdexit(): terminating on signal '), Field(fld2,false)}" -match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ +var part185 = match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ dup12, setc("event_description","sockd:sockdexit():terminating on signal."), dup11, @@ -2355,8 +2169,7 @@ var select17 = linear_select([ msg177, ]); -var part186 = // "Pattern{Constant('Master started'), Field(,false)}" -match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ +var part186 = match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ dup12, setc("event_description","pop3proxy:Master started."), dup11, @@ -2546,8 +2359,7 @@ var part188 = tagval("MESSAGE#179:httpd", "nwparser.payload", tvm, { var msg180 = msg("httpd", part188); -var part189 = // "Pattern{Constant('['), Field(event_log,false), Constant(':'), Field(result,false), Constant('] [pid '), Field(fld3,false), Constant(':'), Field(fld4,false), Constant('] [client '), Field(gateway,false), Constant('] ModSecurity: Warning. '), Field(rulename,true), Constant(' [file "'), Field(filename,false), Constant('"] [line "'), Field(fld5,false), Constant('"] [id "'), Field(rule,false), Constant('"] [rev "'), Field(fld2,false), Constant('"] [msg "'), Field(event_description,false), Constant('"] [severity "'), Field(severity,false), Constant('"] [ver "'), Field(version,false), Constant('"] [maturity "'), Field(fld22,false), Constant('"] [accuracy "'), Field(fld23,false), Constant('"] [tag "'), Field(fld24,false), Constant('"] [hostname "'), Field(dhost,false), Constant('"] [uri "'), Field(web_root,false), Constant('"] [unique_id "'), Field(operation_id,false), Constant('"]'), Field(fld25,false)}" -match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ +var part189 = match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ setc("eventcategory","1502000000"), dup2, dup3, @@ -2663,5 +2475,4 @@ var chain1 = processor_chain([ }), ]); -var part191 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); +var part191 = match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); diff --git a/x-pack/filebeat/module/symantec/endpointprotection/config/pipeline.js b/x-pack/filebeat/module/symantec/endpointprotection/config/pipeline.js index 8ad35b18ca1..f05bc1b7497 100644 --- a/x-pack/filebeat/module/symantec/endpointprotection/config/pipeline.js +++ b/x-pack/filebeat/module/symantec/endpointprotection/config/pipeline.js @@ -143,11 +143,9 @@ var dup8 = call({ ], }); -var dup9 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#0:Active/1_0", "nwparser.p0", "%{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var dup9 = match("MESSAGE#0:Active/1_0", "nwparser.p0", "%{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); -var dup10 = // "Pattern{Field(domain,false)}" -match_copy("MESSAGE#0:Active/1_1", "nwparser.p0", "domain"); +var dup10 = match_copy("MESSAGE#0:Active/1_1", "nwparser.p0", "domain"); var dup11 = setc("eventcategory","1001020100"); @@ -257,8 +255,7 @@ var dup48 = setc("fld14","1"); var dup49 = field("fld14"); -var dup50 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#15:Somebody:01/1_0", "nwparser.p0", "%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var dup50 = match("MESSAGE#15:Somebody:01/1_0", "nwparser.p0", "%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var dup51 = setc("fld14","0"); @@ -282,29 +279,23 @@ var dup57 = setc("event_description","Proactive Threat Protection has been disab var dup58 = setc("event_description","Application has changed since the last time you opened it"); -var dup59 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#27:Application:06/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); +var dup59 = match("MESSAGE#27:Application:06/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); -var dup60 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#27:Application:06/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var dup60 = match("MESSAGE#27:Application:06/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); -var dup61 = // "Pattern{Constant('Intrusion URL: '), Field(url,false)}" -match("MESSAGE#27:Application:06/1_2", "nwparser.p0", "Intrusion URL: %{url}"); +var dup61 = match("MESSAGE#27:Application:06/1_2", "nwparser.p0", "Intrusion URL: %{url}"); var dup62 = setc("event_description","Traffic has been blocked from application."); -var dup63 = // "Pattern{Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#31:scanning:01/1_0", "nwparser.p0", "%{url},Intrusion Payload URL:%{fld25}"); +var dup63 = match("MESSAGE#31:scanning:01/1_0", "nwparser.p0", "%{url},Intrusion Payload URL:%{fld25}"); -var dup64 = // "Pattern{Field(url,false)}" -match_copy("MESSAGE#31:scanning:01/1_1", "nwparser.p0", "url"); +var dup64 = match_copy("MESSAGE#31:scanning:01/1_1", "nwparser.p0", "url"); var dup65 = setc("eventcategory","1401000000"); var dup66 = setc("event_description","Somebody is scanning your computer."); -var dup67 = // "Pattern{Constant('Domain:'), Field(p0,false)}" -match("MESSAGE#33:Informational/1_1", "nwparser.p0", "Domain:%{p0}"); +var dup67 = match("MESSAGE#33:Informational/1_1", "nwparser.p0", "Domain:%{p0}"); var dup68 = setc("event_description","Informational: File Download Hash."); @@ -312,8 +303,7 @@ var dup69 = setc("eventcategory","1001030000"); var dup70 = setc("event_description","Web Attack : Malvertisement Website Redirect"); -var dup71 = // "Pattern{Constant(':'), Field(p0,false)}" -match("MESSAGE#38:Web_Attack:16/1_1", "nwparser.p0", ":%{p0}"); +var dup71 = match("MESSAGE#38:Web_Attack:16/1_1", "nwparser.p0", ":%{p0}"); var dup72 = setc("event_description","Web Attack: Mass Injection Website."); @@ -323,23 +313,17 @@ var dup74 = setc("eventcategory","1603110000"); var dup75 = setc("event_description","The most recent Host Integrity content has not completed a download or cannot be authenticated."); -var dup76 = // "Pattern{Constant('"'), Field(p0,false)}" -match("MESSAGE#307:process:12/1_0", "nwparser.p0", "\"%{p0}"); +var dup76 = match("MESSAGE#307:process:12/1_0", "nwparser.p0", "\"%{p0}"); -var dup77 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#307:process:12/1_1", "nwparser.p0", "p0"); +var dup77 = match_copy("MESSAGE#307:process:12/1_1", "nwparser.p0", "p0"); -var dup78 = // "Pattern{Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(','), Field(p0,false)}" -match("MESSAGE#307:process:12/4", "nwparser.p0", ",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{p0}"); +var dup78 = match("MESSAGE#307:process:12/4", "nwparser.p0", ",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{p0}"); -var dup79 = // "Pattern{Constant('Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#307:process:12/5_0", "nwparser.p0", "Intrusion ID: %{fld33},Begin: %{p0}"); +var dup79 = match("MESSAGE#307:process:12/5_0", "nwparser.p0", "Intrusion ID: %{fld33},Begin: %{p0}"); -var dup80 = // "Pattern{Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#307:process:12/5_1", "nwparser.p0", "%{fld33},Begin: %{p0}"); +var dup80 = match("MESSAGE#307:process:12/5_1", "nwparser.p0", "%{fld33},Begin: %{p0}"); -var dup81 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#307:process:12/6", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var dup81 = match("MESSAGE#307:process:12/6", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var dup82 = setc("result","Traffic has not been blocked from application."); @@ -357,11 +341,9 @@ var dup88 = setc("event_description","Host Integrity check passed"); var dup89 = setc("event_description","Host Integrity check failed."); -var dup90 = // "Pattern{Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); +var dup90 = match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); -var dup91 = // "Pattern{}" -match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); +var dup91 = match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); var dup92 = setc("eventcategory","1702010000"); @@ -381,39 +363,29 @@ var dup96 = setc("ec_activity","Create"); var dup97 = setc("ec_theme","Configuration"); -var dup98 = // "Pattern{Constant('"Location: '), Field(p0,false)}" -match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); +var dup98 = match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); -var dup99 = // "Pattern{Constant('Location: '), Field(p0,false)}" -match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); +var dup99 = match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); -var dup100 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); +var dup100 = match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); -var dup101 = // "Pattern{Field(fld4,false), Constant(',MD-5:'), Field(fld5,false), Constant(',Local:'), Field(p0,false)}" -match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); +var dup101 = match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); -var dup102 = // "Pattern{Constant('Local:'), Field(p0,false)}" -match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); +var dup102 = match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); var dup103 = setc("event_description","Active Response"); var dup104 = setc("dclass_counter1_string","Occurrences"); -var dup105 = // "Pattern{Constant('Rule: '), Field(rulename,false), Constant(',Location: '), Field(p0,false)}" -match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); +var dup105 = match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); -var dup106 = // "Pattern{Constant(' "Rule: '), Field(rulename,false), Constant('",Location: '), Field(p0,false)}" -match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); +var dup106 = match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); -var dup107 = // "Pattern{Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" -match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); +var dup107 = match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); -var dup108 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); +var dup108 = match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); -var dup109 = // "Pattern{Constant(' Domain: '), Field(domain,false)}" -match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); +var dup109 = match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); var dup110 = setc("eventcategory","1003010000"); @@ -427,27 +399,21 @@ var dup111 = call({ ], }); -var dup112 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(p0,false)}" -match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); +var dup112 = match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); -var dup113 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(p0,false)}" -match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); +var dup113 = match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); -var dup114 = // "Pattern{Field(fld25,false)}" -match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); +var dup114 = match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); var dup115 = setc("ec_subject","Virus"); var dup116 = setc("ec_activity","Detect"); -var dup117 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var dup117 = match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var dup118 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var dup118 = match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var dup119 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); +var dup119 = match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); var dup120 = setc("eventcategory","1801000000"); @@ -499,14 +465,11 @@ var dup137 = setf("domain","hdomain"); var dup138 = setc("event_description","The client has downloaded file successfully."); -var dup139 = // "Pattern{Constant('The client will block traffic from IP address '), Field(fld14,true), Constant(' for the next '), Field(duration_string,true), Constant(' (from '), Field(fld13,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); +var dup139 = match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); -var dup140 = // "Pattern{Constant('.,'), Field(p0,false)}" -match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); +var dup140 = match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); -var dup141 = // "Pattern{Constant(' . ,'), Field(p0,false)}" -match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); +var dup141 = match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); var dup142 = setf("shost","hclient"); @@ -514,26 +477,19 @@ var dup143 = setc("event_description","The client will block traffic."); var dup144 = setc("event_description","The client has successfully downloaded and applied a license file"); -var dup145 = // "Pattern{Constant('Commercial application detected,Computer name: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); +var dup145 = match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); -var dup146 = // "Pattern{Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); +var dup146 = match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); -var dup147 = // "Pattern{Field(shost,false), Constant(',Detection type: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); +var dup147 = match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); -var dup148 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var dup148 = match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); -var dup149 = // "Pattern{Constant('"'), Field(filename,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); +var dup149 = match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); -var dup150 = // "Pattern{Field(filename,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); +var dup150 = match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); -var dup151 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var dup151 = match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var dup152 = setf("threat_name","virusname"); @@ -557,19 +513,15 @@ var dup155 = setc("event_description","Commercial application detected"); var dup156 = setc("eventcategory","1701030000"); -var dup157 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); +var dup157 = match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); var dup158 = setf("administrator","husername"); -var dup159 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(p0,false)}" -match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); +var dup159 = match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); -var dup160 = // "Pattern{Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); +var dup160 = match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); -var dup161 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(','), Field(fld53,false), Constant(',Permitted application reason: '), Field(fld54,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var dup161 = match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var dup162 = setc("event_description","Security risk found"); @@ -617,8 +569,7 @@ var dup174 = setc("eventcategory","1301000000"); var dup175 = setc("event_description","Failed to Login to Remote Site"); -var dup176 = // "Pattern{Constant('"'), Field(,false)}" -match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); +var dup176 = match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); var dup177 = setc("ec_subject","Group"); @@ -630,18 +581,15 @@ var dup180 = setc("event_description","Host Integrity check is disabled."); var dup181 = setc("event_description","Host Integrity failed but reported as pass"); -var dup182 = // "Pattern{Constant(' Domain:'), Field(p0,false)}" -match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); +var dup182 = match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); -var dup183 = // "Pattern{Constant('is '), Field(p0,false)}" -match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); +var dup183 = match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); var dup184 = setc("event_description","LiveUpdate"); var dup185 = setc("event_description","Submitting information to Symantec failed."); -var dup186 = // "Pattern{Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); +var dup186 = match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); var dup187 = setc("ec_outcome","Error"); @@ -651,8 +599,7 @@ var dup189 = setf("hostid","hhost"); var dup190 = setc("event_description","The latest SONAR Definitions update failed to load."); -var dup191 = // "Pattern{Constant('",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); +var dup191 = match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); var dup192 = date_time({ dest: "event_time", @@ -664,59 +611,43 @@ var dup192 = date_time({ var dup193 = setc("event_description","Virus Found"); -var dup194 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); +var dup194 = match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); var dup195 = setc("event_description","Virus Definition File Update"); var dup196 = setf("event_description","hfld1"); -var dup197 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); +var dup197 = match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); -var dup198 = // "Pattern{Constant('"'), Field(fld1,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); +var dup198 = match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); -var dup199 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); +var dup199 = match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); var dup200 = setc("event_description","Virus found"); -var dup201 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(p0,false)}" -match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); +var dup201 = match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); -var dup202 = // "Pattern{Constant('Source: '), Field(p0,false)}" -match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); +var dup202 = match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); -var dup203 = // "Pattern{Constant('"Group: '), Field(group,false), Constant('",Server: '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); +var dup203 = match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); -var dup204 = // "Pattern{Constant('Group: '), Field(group,false), Constant(',Server: '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); +var dup204 = match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); -var dup205 = // "Pattern{Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); +var dup205 = match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); -var dup206 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" -match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); +var dup206 = match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); -var dup207 = // "Pattern{Field(filename_size,false)}" -match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); +var dup207 = match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); -var dup208 = // "Pattern{Constant('Virus found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); +var dup208 = match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); -var dup209 = // "Pattern{Constant('"'), Field(info,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); +var dup209 = match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); -var dup210 = // "Pattern{Field(info,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); +var dup210 = match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); -var dup211 = // "Pattern{Constant(''), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); +var dup211 = match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); -var dup212 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); +var dup212 = match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); var dup213 = setc("eventcategory","1701060000"); @@ -724,8 +655,7 @@ var dup214 = setc("event_description","Network Audit Search Unagented Hosts From var dup215 = setc("event_description","Network Intrusion Prevention is malfunctioning"); -var dup216 = // "Pattern{Constant(' by policy'), Field(,false)}" -match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); +var dup216 = match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); var dup217 = setc("event_description","Generic Exploit Mitigation"); @@ -745,16 +675,13 @@ var dup224 = setc("event_description","Policy has been added"); var dup225 = setc("event_description","Policy has been edited"); -var dup226 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); +var dup226 = match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); var dup227 = setc("event_description","Potential risk found"); -var dup228 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(p0,false)}" -match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); +var dup228 = match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); -var dup229 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var dup229 = match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var dup230 = date_time({ dest: "recorded_time", @@ -764,8 +691,7 @@ var dup230 = date_time({ ], }); -var dup231 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was denied by user'), Field(fld6,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); +var dup231 = match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); var dup232 = setc("eventcategory","1606000000"); @@ -807,17 +733,13 @@ var dup247 = setc("dclass_counter1_string","Risk Count."); var dup248 = setc("dclass_counter2_string","Scan Count."); -var dup249 = // "Pattern{Constant('''), Field(context,false), Constant('','), Field(p0,false)}" -match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); +var dup249 = match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); -var dup250 = // "Pattern{Constant('Security risk found,Computer name: '), Field(p0,false)}" -match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); +var dup250 = match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); -var dup251 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); +var dup251 = match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); -var dup252 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false)}" -match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); +var dup252 = match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); var dup253 = setc("event_description","Compressed File"); @@ -833,39 +755,29 @@ var dup258 = setc("event_description","services failed to start"); var dup259 = setc("eventcategory","1608010000"); -var dup260 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); +var dup260 = match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); -var dup261 = // "Pattern{Constant('[Antivirus'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); +var dup261 = match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); -var dup262 = // "Pattern{Constant('"[Antivirus'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); +var dup262 = match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); -var dup263 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); +var dup263 = match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); -var dup264 = // "Pattern{Constant('detection'), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); +var dup264 = match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); -var dup265 = // "Pattern{Constant('advanced heuristic detection'), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); +var dup265 = match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); -var dup266 = // "Pattern{Constant(' Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); +var dup266 = match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); -var dup267 = // "Pattern{Constant('Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); +var dup267 = match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); var dup268 = setc("ec_theme","Communication"); -var dup269 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); +var dup269 = match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); var dup270 = setc("event_description","Traffic from IP address is blocked."); -var dup271 = // "Pattern{Constant(''), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); +var dup271 = match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); var dup272 = setc("event_description","Unexpected server error."); @@ -873,26 +785,21 @@ var dup273 = setc("event_description","Unsolicited incoming ARP reply detected." var dup274 = setc("event_description","Windows Version info."); -var dup275 = // "Pattern{Constant('"'), Field(filename,false), Constant('",User: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); +var dup275 = match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); -var dup276 = // "Pattern{Field(filename,false), Constant(',User: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); +var dup276 = match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); var dup277 = setc("event_description","File Write"); -var dup278 = // "Pattern{Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); +var dup278 = match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); var dup279 = setc("event_description","File Delete"); var dup280 = setc("event_description","File Delete Begin."); -var dup281 = // "Pattern{Constant('""'), Field(action,true), Constant(' . Description: '), Field(p0,false)}" -match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); +var dup281 = match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); -var dup282 = // "Pattern{Field(action,true), Constant(' . Description: '), Field(p0,false)}" -match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); +var dup282 = match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); var dup283 = setc("dclass_counter1_string","Virus Count."); @@ -920,17 +827,13 @@ var dup288 = setc("ec_subject","Configuration"); var dup289 = setc("eventcategory","1801030000"); -var dup290 = // "Pattern{Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); +var dup290 = match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); -var dup291 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); +var dup291 = match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); -var dup292 = // "Pattern{Field(event_description,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); +var dup292 = match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); -var dup293 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); +var dup293 = match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); var dup294 = setc("eventcategory","1803000000"); @@ -966,8 +869,7 @@ var dup303 = setc("event_description","Block Local File Sharing to external comp var dup304 = setc("event_description","Block all other traffic"); -var dup305 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); +var dup305 = match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); var dup306 = field("fld11"); @@ -1139,55 +1041,47 @@ var dup341 = linear_select([ dup282, ]); -var dup342 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" -match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ +var dup342 = match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ dup53, dup15, ])); -var dup343 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" -match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ +var dup343 = match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ dup43, dup15, ])); -var dup344 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup344 = match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup43, dup15, dup287, ])); -var dup345 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup345 = match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup43, dup15, dup287, ])); -var dup346 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup346 = match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup74, dup15, dup287, ])); -var dup347 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup347 = match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup74, dup15, dup287, ])); -var dup348 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup348 = match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup168, dup15, dup287, ])); -var dup349 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup349 = match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup168, dup15, dup287, @@ -1235,8 +1129,7 @@ var dup356 = lookup({ key: dup306, }); -var dup357 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var dup357 = match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup294, dup295, dup37, @@ -1250,8 +1143,7 @@ match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos dup302, ])); -var dup358 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var dup358 = match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -1265,8 +1157,7 @@ match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ dup302, ])); -var dup359 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var dup359 = match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup43, dup15, dup353, @@ -1277,8 +1168,7 @@ match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos dup302, ])); -var dup360 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" -match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ +var dup360 = match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ dup43, dup15, dup355, @@ -1289,8 +1179,7 @@ match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id} dup308, ])); -var dup361 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" -match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ +var dup361 = match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ dup43, dup15, dup355, @@ -1301,20 +1190,15 @@ match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ dup308, ])); -var hdr1 = // "Pattern{Constant('%SYMANTECAV '), Field(p0,false)}" -match("HEADER#0:0001/0", "message", "%SYMANTECAV %{p0}"); +var hdr1 = match("HEADER#0:0001/0", "message", "%SYMANTECAV %{p0}"); -var part1 = // "Pattern{Constant('Delete '), Field(p0,false)}" -match("HEADER#0:0001/1_0", "nwparser.p0", "Delete %{p0}"); +var part1 = match("HEADER#0:0001/1_0", "nwparser.p0", "Delete %{p0}"); -var part2 = // "Pattern{Constant('Leave Alone '), Field(p0,false)}" -match("HEADER#0:0001/1_1", "nwparser.p0", "Leave Alone %{p0}"); +var part2 = match("HEADER#0:0001/1_1", "nwparser.p0", "Leave Alone %{p0}"); -var part3 = // "Pattern{Constant('Quarantine '), Field(p0,false)}" -match("HEADER#0:0001/1_2", "nwparser.p0", "Quarantine %{p0}"); +var part3 = match("HEADER#0:0001/1_2", "nwparser.p0", "Quarantine %{p0}"); -var part4 = // "Pattern{Constant('Undefined '), Field(p0,false)}" -match("HEADER#0:0001/1_3", "nwparser.p0", "Undefined %{p0}"); +var part4 = match("HEADER#0:0001/1_3", "nwparser.p0", "Undefined %{p0}"); var select1 = linear_select([ part1, @@ -1323,8 +1207,7 @@ var select1 = linear_select([ part4, ]); -var part5 = // "Pattern{Field(,false), Constant('..Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" -match("HEADER#0:0001/2", "nwparser.p0", "%{}..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ +var part5 = match("HEADER#0:0001/2", "nwparser.p0", "%{}..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ dup1, ])); @@ -1339,20 +1222,17 @@ var all1 = all_match({ ]), }); -var hdr2 = // "Pattern{Constant('%SYMANTECAV Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" -match("HEADER#1:0002", "message", "%SYMANTECAV Alert: %{messageid->} %{data}..%{p0}", processor_chain([ +var hdr2 = match("HEADER#1:0002", "message", "%SYMANTECAV Alert: %{messageid->} %{data}..%{p0}", processor_chain([ setc("header_id","0002"), dup1, ])); -var hdr3 = // "Pattern{Constant('%SYMANTECAV ..'), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" -match("HEADER#2:0003", "message", "%SYMANTECAV ..%{messageid->} %{data}..%{p0}", processor_chain([ +var hdr3 = match("HEADER#2:0003", "message", "%SYMANTECAV ..%{messageid->} %{data}..%{p0}", processor_chain([ setc("header_id","0003"), dup1, ])); -var hdr4 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' ..'), Field(messageid,true), Constant(' '), Field(hfld2,false), Constant('.. '), Field(p0,false)}" -match("HEADER#3:0004", "message", "%SYMANTECAV %{hfld1->} ..%{messageid->} %{hfld2}.. %{p0}", processor_chain([ +var hdr4 = match("HEADER#3:0004", "message", "%SYMANTECAV %{hfld1->} ..%{messageid->} %{hfld2}.. %{p0}", processor_chain([ setc("header_id","0004"), call({ dest: "nwparser.payload", @@ -1367,8 +1247,7 @@ match("HEADER#3:0004", "message", "%SYMANTECAV %{hfld1->} ..%{messageid->} %{hfl }), ])); -var hdr5 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(messageid,true), Constant(' Found '), Field(p0,false)}" -match("HEADER#4:0005", "message", "%SYMANTECAV %{hfld1->} %{messageid->} Found %{p0}", processor_chain([ +var hdr5 = match("HEADER#4:0005", "message", "%SYMANTECAV %{hfld1->} %{messageid->} Found %{p0}", processor_chain([ setc("header_id","0005"), call({ dest: "nwparser.payload", @@ -1381,8 +1260,7 @@ match("HEADER#4:0005", "message", "%SYMANTECAV %{hfld1->} %{messageid->} Found % }), ])); -var hdr6 = // "Pattern{Constant('%SYMANTECAV '), Field(messageid,true), Constant(' '), Field(hfld1,false), Constant('..'), Field(p0,false)}" -match("HEADER#5:0006", "message", "%SYMANTECAV %{messageid->} %{hfld1}..%{p0}", processor_chain([ +var hdr6 = match("HEADER#5:0006", "message", "%SYMANTECAV %{messageid->} %{hfld1}..%{p0}", processor_chain([ setc("header_id","0006"), call({ dest: "nwparser.payload", @@ -1397,242 +1275,202 @@ match("HEADER#5:0006", "message", "%SYMANTECAV %{messageid->} %{hfld1}..%{p0}", }), ])); -var hdr7 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#6:00081", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ +var hdr7 = match("HEADER#6:00081", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ setc("header_id","00081"), dup2, ])); -var hdr8 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#7:0008", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ +var hdr8 = match("HEADER#7:0008", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},%{messageid->} %{p0}", processor_chain([ setc("header_id","0008"), dup2, ])); -var hdr9 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#8:00091", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ +var hdr9 = match("HEADER#8:00091", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ setc("header_id","00091"), dup2, ])); -var hdr10 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#9:0009", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ +var hdr10 = match("HEADER#9:0009", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},The %{messageid->} %{p0}", processor_chain([ setc("header_id","0009"), dup2, ])); -var hdr11 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#10:00421", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ +var hdr11 = match("HEADER#10:00421", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ setc("header_id","00421"), dup2, ])); -var hdr12 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(',Admin: '), Field(husername,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#11:0042", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ +var hdr12 = match("HEADER#11:0042", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},Admin: %{husername},The %{messageid->} %{p0}", processor_chain([ setc("header_id","0042"), dup2, ])); -var hdr13 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#12:99991", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ +var hdr13 = match("HEADER#12:99991", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ setc("header_id","99991"), dup2, ])); -var hdr14 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',Domain: '), Field(hdomain,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#13:9999", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ +var hdr14 = match("HEADER#13:9999", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},Domain: %{hdomain},%{messageid->} %{p0}", processor_chain([ setc("header_id","9999"), dup2, ])); -var hdr15 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#14:00101", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ +var hdr15 = match("HEADER#14:00101", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","00101"), dup2, ])); -var hdr16 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#15:0010", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ +var hdr16 = match("HEADER#15:0010", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","0010"), dup2, ])); -var hdr17 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("HEADER#16:00111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ +var hdr17 = match("HEADER#16:00111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ setc("header_id","00111"), dup3, ])); -var hdr18 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("HEADER#17:0011", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ +var hdr18 = match("HEADER#17:0011", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid}.%{fld2->} %{p0}", processor_chain([ setc("header_id","0011"), dup3, ])); -var hdr19 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#18:00121", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ +var hdr19 = match("HEADER#18:00121", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ setc("header_id","00121"), dup2, ])); -var hdr20 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#19:0012", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ +var hdr20 = match("HEADER#19:0012", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{messageid->} %{p0}", processor_chain([ setc("header_id","0012"), dup2, ])); -var hdr21 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(fld20,true), Constant(' '), Field(fld21,true), Constant(' '), Field(fld23,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#20:11111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ +var hdr21 = match("HEADER#20:11111", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ setc("header_id","11111"), dup2, ])); -var hdr22 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(','), Field(fld20,true), Constant(' '), Field(fld21,true), Constant(' '), Field(fld23,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#21:1111", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ +var hdr22 = match("HEADER#21:1111", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},%{fld20->} %{fld21->} %{fld23->} %{messageid->} %{p0}", processor_chain([ setc("header_id","1111"), dup2, ])); -var hdr23 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#22:13131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ +var hdr23 = match("HEADER#22:13131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","13131"), dup2, ])); -var hdr24 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#23:1313", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ +var hdr24 = match("HEADER#23:1313", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","1313"), dup2, ])); -var hdr25 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#24:00131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ +var hdr25 = match("HEADER#24:00131", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ setc("header_id","00131"), dup2, ])); -var hdr26 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#25:0013", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ +var hdr26 = match("HEADER#25:0013", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{messageid->} %{p0}", processor_chain([ setc("header_id","0013"), dup2, ])); -var hdr27 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#26:13142", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ +var hdr27 = match("HEADER#26:13142", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ setc("header_id","13142"), dup2, ])); -var hdr28 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#27:13141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ +var hdr28 = match("HEADER#27:13141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ setc("header_id","13141"), dup2, ])); -var hdr29 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"[SID: '), Field(hfld1,false), Constant('] '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#28:1314", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ +var hdr29 = match("HEADER#28:1314", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"[SID: %{hfld1}] %{messageid->} %{p0}", processor_chain([ setc("header_id","1314"), dup2, ])); -var hdr30 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',[SID: '), Field(hdata,false), Constant('] '), Field(hfld1,false), Constant('. Traffic has been '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#29:00141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ +var hdr30 = match("HEADER#29:00141", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ setc("header_id","00141"), dup4, ])); -var hdr31 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',[SID: '), Field(hdata,false), Constant('] '), Field(hfld1,false), Constant('. Traffic has been '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#30:0014", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ +var hdr31 = match("HEADER#30:0014", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},[SID: %{hdata}] %{hfld1}. Traffic has been %{messageid->} %{p0}", processor_chain([ setc("header_id","0014"), dup4, ])); -var hdr32 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#31:00161", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{messageid->} %{p0}", processor_chain([ +var hdr32 = match("HEADER#31:00161", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{messageid->} %{p0}", processor_chain([ setc("header_id","00161"), dup2, ])); -var hdr33 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#32:0016", "message", "%{htime->} SymantecServer %{hhost}: %{messageid->} %{p0}", processor_chain([ +var hdr33 = match("HEADER#32:0016", "message", "%{htime->} SymantecServer %{hhost}: %{messageid->} %{p0}", processor_chain([ setc("header_id","0016"), dup2, ])); -var hdr34 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#33:29292", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{fld1->} %{messageid->} %{p0}", processor_chain([ +var hdr34 = match("HEADER#33:29292", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{fld1->} %{messageid->} %{p0}", processor_chain([ setc("header_id","29292"), dup5, ])); -var hdr35 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#34:29291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ +var hdr35 = match("HEADER#34:29291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ setc("header_id","29291"), dup5, ])); -var hdr36 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#35:2929", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ +var hdr36 = match("HEADER#35:2929", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{fld1->} %{messageid->} %{p0}", processor_chain([ setc("header_id","2929"), dup5, ])); -var hdr37 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#36:00291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{fld1->} %{messageid->} %{p0}", processor_chain([ +var hdr37 = match("HEADER#36:00291", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{fld1->} %{messageid->} %{p0}", processor_chain([ setc("header_id","00291"), dup5, ])); -var hdr38 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(fld1,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#37:0029", "message", "%{htime->} SymantecServer %{hhost}: %{fld1->} %{messageid->} %{p0}", processor_chain([ +var hdr38 = match("HEADER#37:0029", "message", "%{htime->} SymantecServer %{hhost}: %{fld1->} %{messageid->} %{p0}", processor_chain([ setc("header_id","0029"), dup5, ])); -var hdr39 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhostip,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#38:00173", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhostip->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ +var hdr39 = match("HEADER#38:00173", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhostip->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ setc("header_id","00173"), dup2, ])); -var hdr40 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#39:00172", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ +var hdr40 = match("HEADER#39:00172", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},SHA-256:%{checksum},MD-5:%{checksum},%{messageid->} %{p0}", processor_chain([ setc("header_id","00172"), dup2, ])); -var hdr41 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#40:00171", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid->} %{p0}", processor_chain([ +var hdr41 = match("HEADER#40:00171", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid->} %{p0}", processor_chain([ setc("header_id","00171"), dup2, ])); -var hdr42 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#41:0017", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid->} %{p0}", processor_chain([ +var hdr42 = match("HEADER#41:0017", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid->} %{p0}", processor_chain([ setc("header_id","0017"), dup2, ])); -var hdr43 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hname,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#42:00151", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ +var hdr43 = match("HEADER#42:00151", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ setc("header_id","00151"), dup6, ])); -var hdr44 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(hname,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#43:0015", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ +var hdr44 = match("HEADER#43:0015", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{hname},%{messageid->} %{p0}", processor_chain([ setc("header_id","0015"), dup6, ])); -var hdr45 = // "Pattern{Constant('%SYMANTECAV Actual Name: '), Field(hfld1,true), Constant(' ..Alert: '), Field(messageid,true), Constant(' '), Field(data,false), Constant('..'), Field(p0,false)}" -match("HEADER#44:0018", "message", "%SYMANTECAV Actual Name: %{hfld1->} ..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ +var hdr45 = match("HEADER#44:0018", "message", "%SYMANTECAV Actual Name: %{hfld1->} ..Alert: %{messageid->} %{data}..%{p0}", processor_chain([ setc("header_id","0018"), dup1, ])); -var hdr46 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(messageid,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(p0,false)}" -match("HEADER#45:0021", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{messageid->} %{hfld3->} %{p0}", processor_chain([ +var hdr46 = match("HEADER#45:0021", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{messageid->} %{hfld3->} %{p0}", processor_chain([ setc("header_id","0021"), call({ dest: "nwparser.payload", @@ -1651,8 +1489,7 @@ match("HEADER#45:0021", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{messagei }), ])); -var hdr47 = // "Pattern{Constant('%SYMANTECAV '), Field(hfld1,true), Constant(' '), Field(hfld2,true), Constant(' '), Field(hfld3,true), Constant(' '), Field(messageid,true), Constant(' '), Field(hfld4,true), Constant(' '), Field(p0,false)}" -match("HEADER#46:0022", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{hfld3->} %{messageid->} %{hfld4->} %{p0}", processor_chain([ +var hdr47 = match("HEADER#46:0022", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{hfld3->} %{messageid->} %{hfld4->} %{p0}", processor_chain([ setc("header_id","0022"), call({ dest: "nwparser.payload", @@ -1673,74 +1510,61 @@ match("HEADER#46:0022", "message", "%SYMANTECAV %{hfld1->} %{hfld2->} %{hfld3->} }), ])); -var hdr48 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(fld40,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#47:00191", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ +var hdr48 = match("HEADER#47:00191", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ setc("header_id","00191"), dup7, ])); -var hdr49 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',Category: '), Field(hdata,false), Constant(','), Field(hfld1,false), Constant(','), Field(fld40,true), Constant(' '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#48:0019", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ +var hdr49 = match("HEADER#48:0019", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},Category: %{hdata},%{hfld1},%{fld40->} %{messageid->} %{p0}", processor_chain([ setc("header_id","0019"), dup7, ])); -var hdr50 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#49:00201", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ +var hdr50 = match("HEADER#49:00201", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ setc("header_id","00201"), dup2, ])); -var hdr51 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hurl,false), Constant(',Server: '), Field(hhostid,false), Constant(',The '), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#50:0020", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ +var hdr51 = match("HEADER#50:0020", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hurl},Server: %{hhostid},The %{messageid->} %{p0}", processor_chain([ setc("header_id","0020"), dup2, ])); -var hdr52 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#51:00231", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{messageid->} %{p0}", processor_chain([ +var hdr52 = match("HEADER#51:00231", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","00231"), dup2, ])); -var hdr53 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#52:0023", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{messageid->} %{p0}", processor_chain([ +var hdr53 = match("HEADER#52:0023", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{messageid->} %{p0}", processor_chain([ setc("header_id","0023"), dup2, ])); -var hdr54 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" -match("HEADER#53:00241", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid},%{payload}", processor_chain([ +var hdr54 = match("HEADER#53:00241", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid},%{payload}", processor_chain([ setc("header_id","00241"), ])); -var hdr55 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" -match("HEADER#54:0024", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid},%{payload}", processor_chain([ +var hdr55 = match("HEADER#54:0024", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid},%{payload}", processor_chain([ setc("header_id","0024"), ])); -var hdr56 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' """"'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" -match("HEADER#55:00261", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ +var hdr56 = match("HEADER#55:00261", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ setc("header_id","00261"), ])); -var hdr57 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' """"'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" -match("HEADER#56:0026", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ +var hdr57 = match("HEADER#56:0026", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"\"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ setc("header_id","0026"), ])); -var hdr58 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' ""'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" -match("HEADER#57:00371", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ +var hdr58 = match("HEADER#57:00371", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ setc("header_id","00371"), ])); -var hdr59 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(',"'), Field(haction,true), Constant(' ""'), Field(messageid,true), Constant(' of Death"" '), Field(payload,false)}" -match("HEADER#58:0037", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ +var hdr59 = match("HEADER#58:0037", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},\"%{haction->} \"\"%{messageid->} of Death\"\" %{payload}", processor_chain([ setc("header_id","0037"), ])); -var hdr60 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: Site: '), Field(hsite,false), Constant(','), Field(messageid,false), Constant(': '), Field(p0,false)}" -match("HEADER#59:00271", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ +var hdr60 = match("HEADER#59:00271", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ setc("header_id","00271"), call({ dest: "nwparser.payload", @@ -1757,8 +1581,7 @@ match("HEADER#59:00271", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hs }), ])); -var hdr61 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': Site: '), Field(hsite,false), Constant(','), Field(messageid,false), Constant(': '), Field(p0,false)}" -match("HEADER#60:0027", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ +var hdr61 = match("HEADER#60:0027", "message", "%{htime->} SymantecServer %{hhost}: Site: %{hsite},%{messageid}: %{p0}", processor_chain([ setc("header_id","0027"), call({ dest: "nwparser.payload", @@ -1775,23 +1598,19 @@ match("HEADER#60:0027", "message", "%{htime->} SymantecServer %{hhost}: Site: %{ }), ])); -var hdr62 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#61:00301", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid}: %{payload}", processor_chain([ +var hdr62 = match("HEADER#61:00301", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{messageid}: %{payload}", processor_chain([ setc("header_id","00301"), ])); -var hdr63 = // "Pattern{Field(htime,true), Constant(' SymantecServer '), Field(hhost,false), Constant(': '), Field(hshost,false), Constant(','), Field(messageid,false), Constant(': '), Field(payload,false)}" -match("HEADER#62:0030", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid}: %{payload}", processor_chain([ +var hdr63 = match("HEADER#62:0030", "message", "%{htime->} SymantecServer %{hhost}: %{hshost},%{messageid}: %{payload}", processor_chain([ setc("header_id","0030"), ])); -var hdr64 = // "Pattern{Field(hmonth,true), Constant(' '), Field(hday,true), Constant(' '), Field(hhour,false), Constant(':'), Field(hmin,false), Constant(':'), Field(hsec,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" -match("HEADER#63:00242", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ +var hdr64 = match("HEADER#63:00242", "message", "%{hmonth->} %{hday->} %{hhour}:%{hmin}:%{hsec->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ setc("header_id","00242"), ])); -var hdr65 = // "Pattern{Field(htime,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(hfld1,false), Constant(','), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#64:00243", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{hfld1},%{messageid->} %{p0}", processor_chain([ +var hdr65 = match("HEADER#64:00243", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{hfld1},%{messageid->} %{p0}", processor_chain([ setc("header_id","00243"), call({ dest: "nwparser.payload", @@ -1806,25 +1625,21 @@ match("HEADER#64:00243", "message", "%{htime->} %{hhost->} SymantecServer: %{hsh }), ])); -var hdr66 = // "Pattern{Field(htime,true), Constant(' '), Field(hhost,true), Constant(' SymantecServer: '), Field(hshost,false), Constant(','), Field(hsaddr,false), Constant(','), Field(messageid,false), Constant(','), Field(payload,false)}" -match("HEADER#65:00244", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ +var hdr66 = match("HEADER#65:00244", "message", "%{htime->} %{hhost->} SymantecServer: %{hshost},%{hsaddr},%{messageid},%{payload}", processor_chain([ setc("header_id","00244"), ])); -var hdr67 = // "Pattern{Constant('%SymantecEP: '), Field(messageid,false), Constant('^^'), Field(hhost,false), Constant('^^'), Field(p0,false)}" -match("HEADER#66:0031", "message", "%SymantecEP: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ +var hdr67 = match("HEADER#66:0031", "message", "%SymantecEP: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ setc("header_id","0031"), dup8, ])); -var hdr68 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(messageid,true), Constant(' '), Field(p0,false)}" -match("HEADER#67:0032", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid->} %{p0}", processor_chain([ +var hdr68 = match("HEADER#67:0032", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid->} %{p0}", processor_chain([ setc("header_id","0032"), dup2, ])); -var hdr69 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#68:0040", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ +var hdr69 = match("HEADER#68:0040", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0040"), call({ dest: "nwparser.payload", @@ -1849,14 +1664,12 @@ match("HEADER#68:0040", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr70 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(messageid,false), Constant('.'), Field(fld2,true), Constant(' '), Field(p0,false)}" -match("HEADER#69:0033", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid}.%{fld2->} %{p0}", processor_chain([ +var hdr70 = match("HEADER#69:0033", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{fld1}^^%{messageid}.%{fld2->} %{p0}", processor_chain([ setc("header_id","0033"), dup3, ])); -var hdr71 = // "Pattern{Constant('%SymantecEP-'), Field(hevent,false), Constant(': '), Field(hdomain,false), Constant('^^'), Field(hlevel,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#70:0034", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{messageid}^^%{p0}", processor_chain([ +var hdr71 = match("HEADER#70:0034", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0034"), call({ dest: "nwparser.payload", @@ -1869,14 +1682,12 @@ match("HEADER#70:0034", "message", "%SymantecEP-%{hevent}: %{hdomain}^^%{hlevel} }), ])); -var hdr72 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(messageid,false), Constant('^^'), Field(hhost,false), Constant('^^'), Field(p0,false)}" -match("HEADER#71:0035", "message", "%SymantecEP-%{hfld1}: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ +var hdr72 = match("HEADER#71:0035", "message", "%SymantecEP-%{hfld1}: %{messageid}^^%{hhost}^^%{p0}", processor_chain([ setc("header_id","0035"), dup8, ])); -var hdr73 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#72:0038", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{messageid}^^%{p0}", processor_chain([ +var hdr73 = match("HEADER#72:0038", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0038"), call({ dest: "nwparser.payload", @@ -1899,8 +1710,7 @@ match("HEADER#72:0038", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr74 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#73:0041", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{messageid}^^%{p0}", processor_chain([ +var hdr74 = match("HEADER#73:0041", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0041"), call({ dest: "nwparser.payload", @@ -1919,8 +1729,7 @@ match("HEADER#73:0041", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr75 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#74:0043", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ +var hdr75 = match("HEADER#74:0043", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0043"), call({ dest: "nwparser.payload", @@ -1941,8 +1750,7 @@ match("HEADER#74:0043", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr76 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld5,false), Constant('^^'), Field(hfld6,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(hfld8,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#75:0039", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ +var hdr76 = match("HEADER#75:0039", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld5}^^%{hfld6}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0039"), call({ dest: "nwparser.payload", @@ -1969,8 +1777,7 @@ match("HEADER#75:0039", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr77 = // "Pattern{Constant('%SymantecEP-'), Field(hfld1,false), Constant(': '), Field(hfld2,false), Constant('^^'), Field(hfld3,false), Constant('^^'), Field(hfld4,false), Constant('^^'), Field(hfld7,false), Constant('^^'), Field(hfld8,false), Constant('^^'), Field(messageid,false), Constant('^^'), Field(p0,false)}" -match("HEADER#76:0044", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ +var hdr77 = match("HEADER#76:0044", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{hfld4}^^%{hfld7}^^%{hfld8}^^%{messageid}^^%{p0}", processor_chain([ setc("header_id","0044"), call({ dest: "nwparser.payload", @@ -1993,8 +1800,7 @@ match("HEADER#76:0044", "message", "%SymantecEP-%{hfld1}: %{hfld2}^^%{hfld3}^^%{ }), ])); -var hdr78 = // "Pattern{Constant('%NICWIN-4-'), Field(msgIdPart1,false), Constant('_'), Field(msgIdPart2,false), Constant('_Symantec: '), Field(payload,false)}" -match("HEADER#77:0045", "message", "%NICWIN-4-%{msgIdPart1}_%{msgIdPart2}_Symantec: %{payload}", processor_chain([ +var hdr78 = match("HEADER#77:0045", "message", "%NICWIN-4-%{msgIdPart1}_%{msgIdPart2}_Symantec: %{payload}", processor_chain([ setc("header_id","0045"), call({ dest: "nwparser.messageid", @@ -2007,8 +1813,7 @@ match("HEADER#77:0045", "message", "%NICWIN-4-%{msgIdPart1}_%{msgIdPart2}_Symant }), ])); -var hdr79 = // "Pattern{Constant('%NICWIN-4-'), Field(messageid,false), Constant('_'), Field(hfld2,false), Constant('_Symantec AntiVirus: '), Field(payload,false)}" -match("HEADER#78:0046", "message", "%NICWIN-4-%{messageid}_%{hfld2}_Symantec AntiVirus: %{payload}", processor_chain([ +var hdr79 = match("HEADER#78:0046", "message", "%NICWIN-4-%{messageid}_%{hfld2}_Symantec AntiVirus: %{payload}", processor_chain([ setc("header_id","0046"), ])); @@ -2094,8 +1899,7 @@ var select2 = linear_select([ hdr79, ]); -var part6 = // "Pattern{Constant('Active Response that started at '), Field(fld1,true), Constant(' is disengaged. The traffic from IP address '), Field(hostip,true), Constant(' was blocked for '), Field(fld2,true), Constant(' second(s).,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(','), Field(direction,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" -match("MESSAGE#0:Active/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{fld2->} second(s).,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); +var part6 = match("MESSAGE#0:Active/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{fld2->} second(s).,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); var all2 = all_match({ processors: [ @@ -2117,8 +1921,7 @@ var all2 = all_match({ var msg1 = msg("Active", all2); -var part7 = // "Pattern{Constant('Active Response that started at '), Field(fld1,true), Constant(' is disengaged. The traffic from IP address '), Field(hostip,true), Constant(' was blocked for '), Field(duration,true), Constant(' second(s). ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(','), Field(direction,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" -match("MESSAGE#1:Active:01/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{duration->} second(s). ,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); +var part7 = match("MESSAGE#1:Active:01/0", "nwparser.payload", "Active Response that started at %{fld1->} is disengaged. The traffic from IP address %{hostip->} was blocked for %{duration->} second(s). ,Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},%{direction},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); var all3 = all_match({ processors: [ @@ -2145,8 +1948,7 @@ var select3 = linear_select([ msg2, ]); -var part8 = // "Pattern{Constant('Administrator logout'), Field(,false)}" -match("MESSAGE#2:Administrator", "nwparser.payload", "Administrator logout%{}", processor_chain([ +var part8 = match("MESSAGE#2:Administrator", "nwparser.payload", "Administrator logout%{}", processor_chain([ setc("eventcategory","1401070000"), dup12, dup13, @@ -2162,8 +1964,7 @@ match("MESSAGE#2:Administrator", "nwparser.payload", "Administrator logout%{}", var msg3 = msg("Administrator", part8); -var part9 = // "Pattern{Constant('Administrator'), Field(space,false), Constant('log on failed')}" -match("MESSAGE#3:Administrator:01", "nwparser.payload", "Administrator%{space}log on failed", processor_chain([ +var part9 = match("MESSAGE#3:Administrator:01", "nwparser.payload", "Administrator%{space}log on failed", processor_chain([ setc("eventcategory","1401030000"), dup12, dup13, @@ -2179,8 +1980,7 @@ match("MESSAGE#3:Administrator:01", "nwparser.payload", "Administrator%{space}lo var msg4 = msg("Administrator:01", part9); -var part10 = // "Pattern{Constant('Administrator'), Field(space,false), Constant('log on succeeded')}" -match("MESSAGE#4:Administrator:02", "nwparser.payload", "Administrator%{space}log on succeeded", processor_chain([ +var part10 = match("MESSAGE#4:Administrator:02", "nwparser.payload", "Administrator%{space}log on succeeded", processor_chain([ setc("eventcategory","1401060000"), dup12, dup13, @@ -2202,8 +2002,7 @@ var select4 = linear_select([ msg5, ]); -var part11 = // "Pattern{Constant('password of System administrator ''), Field(username,false), Constant('' has been changed.')}" -match("MESSAGE#5:Administrator:03", "nwparser.payload", "password of System administrator '%{username}' has been changed.", processor_chain([ +var part11 = match("MESSAGE#5:Administrator:03", "nwparser.payload", "password of System administrator '%{username}' has been changed.", processor_chain([ dup26, dup12, dup13, @@ -2219,8 +2018,7 @@ match("MESSAGE#5:Administrator:03", "nwparser.payload", "password of System admi var msg6 = msg("Administrator:03", part11); -var part12 = // "Pattern{Constant('password of administrator "'), Field(c_username,false), Constant('" was changed')}" -match("MESSAGE#290:password", "nwparser.payload", "password of administrator \"%{c_username}\" was changed", processor_chain([ +var part12 = match("MESSAGE#290:password", "nwparser.payload", "password of administrator \"%{c_username}\" was changed", processor_chain([ dup26, dup12, dup13, @@ -2236,8 +2034,7 @@ match("MESSAGE#290:password", "nwparser.payload", "password of administrator \"% var msg7 = msg("password", part12); -var part13 = // "Pattern{Constant('password of System administrator "'), Field(c_username,false), Constant('" has been changed')}" -match("MESSAGE#291:password:01", "nwparser.payload", "password of System administrator \"%{c_username}\" has been changed", processor_chain([ +var part13 = match("MESSAGE#291:password:01", "nwparser.payload", "password of System administrator \"%{c_username}\" has been changed", processor_chain([ dup26, dup12, dup13, @@ -2259,8 +2056,7 @@ var select5 = linear_select([ msg8, ]); -var part14 = // "Pattern{Field(fld6,true), Constant(' detected. Traffic has been allowed from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#6:allowed", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ +var part14 = match("MESSAGE#6:allowed", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ dup32, dup12, dup13, @@ -2275,8 +2071,7 @@ match("MESSAGE#6:allowed", "nwparser.payload", "%{fld6->} detected. Traffic has var msg9 = msg("allowed", part14); -var part15 = // "Pattern{Field(fld6,true), Constant(' detected. Traffic has been allowed from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#7:allowed:11", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ +var part15 = match("MESSAGE#7:allowed:11", "nwparser.payload", "%{fld6->} detected. Traffic has been allowed from this application: %{fld1},Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ dup32, dup12, dup13, @@ -2296,8 +2091,7 @@ var select6 = linear_select([ msg10, ]); -var part16 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(dport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(sport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',"!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant('",!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld33,false)}" -match("MESSAGE#8:Malicious", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ +var part16 = match("MESSAGE#8:Malicious", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{daddr},Local: %{fld7},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ dup36, dup12, dup13, @@ -2314,8 +2108,7 @@ match("MESSAGE#8:Malicious", "nwparser.payload", "Malicious Site: Malicious Web var msg11 = msg("Malicious", part16); -var part17 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(sport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(dport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',"!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant('",!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld33,false)}" -match("MESSAGE#9:Malicious:01", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ +var part17 = match("MESSAGE#9:Malicious:01", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID:%{fld23},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},\"!ExternalLoggingTask.strcidssignid! %{sigid_string}\",!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld33}", processor_chain([ dup36, dup12, dup13, @@ -2332,22 +2125,18 @@ match("MESSAGE#9:Malicious:01", "nwparser.payload", "Malicious Site: Malicious W var msg12 = msg("Malicious:01", part17); -var part18 = // "Pattern{Constant('Malicious Site: Malicious Web Site, Domain, or URL ('), Field(fld11,false), Constant(') attack blocked. Traffic has been blocked for this application: '), Field(fld12,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld7,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(p0,false)}" -match("MESSAGE#10:Malicious:02/0", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Inbound,%{p0}"); +var part18 = match("MESSAGE#10:Malicious:02/0", "nwparser.payload", "Malicious Site: Malicious Web Site, Domain, or URL (%{fld11}) attack blocked. Traffic has been blocked for this application: %{fld12}\",Local: %{saddr},Local: %{fld7},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Inbound,%{p0}"); -var part19 = // "Pattern{Field(protocol,false), Constant(',Intrusion ID:'), Field(fld23,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#10:Malicious:02/1_0", "nwparser.p0", "%{protocol},Intrusion ID:%{fld23},Begin: %{p0}"); +var part19 = match("MESSAGE#10:Malicious:02/1_0", "nwparser.p0", "%{protocol},Intrusion ID:%{fld23},Begin: %{p0}"); -var part20 = // "Pattern{Field(protocol,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#10:Malicious:02/1_1", "nwparser.p0", "%{protocol},Begin: %{p0}"); +var part20 = match("MESSAGE#10:Malicious:02/1_1", "nwparser.p0", "%{protocol},Begin: %{p0}"); var select7 = linear_select([ part19, part20, ]); -var part21 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld39,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',"CIDS Signature string: '), Field(sigid_string,false), Constant('",CIDS Signature SubID: '), Field(fld29,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#10:Malicious:02/2", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},\"CIDS Signature string: %{sigid_string}\",CIDS Signature SubID: %{fld29},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}"); +var part21 = match("MESSAGE#10:Malicious:02/2", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld39},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},\"CIDS Signature string: %{sigid_string}\",CIDS Signature SubID: %{fld29},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}"); var all4 = all_match({ processors: [ @@ -2377,8 +2166,7 @@ var select8 = linear_select([ msg13, ]); -var part22 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' failed to update.')}" -match("MESSAGE#11:Antivirus", "nwparser.payload", "%{product->} definitions %{info->} failed to update.", processor_chain([ +var part22 = match("MESSAGE#11:Antivirus", "nwparser.payload", "%{product->} definitions %{info->} failed to update.", processor_chain([ dup43, dup12, dup13, @@ -2393,8 +2181,7 @@ match("MESSAGE#11:Antivirus", "nwparser.payload", "%{product->} definitions %{in var msg14 = msg("Antivirus", part22); -var part23 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' is up-to-date.')}" -match("MESSAGE#12:Antivirus:01", "nwparser.payload", "%{product->} definitions %{info->} is up-to-date.", processor_chain([ +var part23 = match("MESSAGE#12:Antivirus:01", "nwparser.payload", "%{product->} definitions %{info->} is up-to-date.", processor_chain([ dup43, dup12, dup13, @@ -2405,8 +2192,7 @@ match("MESSAGE#12:Antivirus:01", "nwparser.payload", "%{product->} definitions % var msg15 = msg("Antivirus:01", part23); -var part24 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,true), Constant(' was successfully updated.')}" -match("MESSAGE#13:Antivirus:02", "nwparser.payload", "%{product->} definitions %{info->} was successfully updated.", processor_chain([ +var part24 = match("MESSAGE#13:Antivirus:02", "nwparser.payload", "%{product->} definitions %{info->} was successfully updated.", processor_chain([ dup43, dup44, dup45, @@ -2424,8 +2210,7 @@ var select9 = linear_select([ msg16, ]); -var part25 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',1,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" -match("MESSAGE#14:Somebody/0", "nwparser.payload", "%{event_description}\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},1,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); +var part25 = match("MESSAGE#14:Somebody/0", "nwparser.payload", "%{event_description}\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},1,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); var all5 = all_match({ processors: [ @@ -2448,8 +2233,7 @@ var all5 = all_match({ var msg17 = msg("Somebody", all5); -var part26 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',0,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" -match("MESSAGE#15:Somebody:01/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},0,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); +var part26 = match("MESSAGE#15:Somebody:01/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},0,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); var all6 = all_match({ processors: [ @@ -2472,8 +2256,7 @@ var all6 = all_match({ var msg18 = msg("Somebody:01", all6); -var part27 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',2,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(p0,false)}" -match("MESSAGE#16:Somebody:02/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},2,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); +var part27 = match("MESSAGE#16:Somebody:02/0", "nwparser.payload", "%{event_description}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},2,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username}, Domain: %{p0}"); var all7 = all_match({ processors: [ @@ -2502,11 +2285,9 @@ var select10 = linear_select([ msg19, ]); -var part28 = // "Pattern{Field(fld44,false), Constant(',Application and Device Control is ready,'), Field(fld8,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(p0,false)}" -match("MESSAGE#17:Application/0", "nwparser.payload", "%{fld44},Application and Device Control is ready,%{fld8},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{p0}"); +var part28 = match("MESSAGE#17:Application/0", "nwparser.payload", "%{fld44},Application and Device Control is ready,%{fld8},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{p0}"); -var part29 = // "Pattern{Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#17:Application/1_0", "nwparser.p0", "%{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); +var part29 = match("MESSAGE#17:Application/1_0", "nwparser.p0", "%{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); var select11 = linear_select([ part29, @@ -2531,8 +2312,7 @@ var all8 = all_match({ var msg20 = msg("Application", all8); -var part30 = // "Pattern{Field(fld44,false), Constant(',Application and Device Control engine is not verified,'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#18:Application:01", "nwparser.payload", "%{fld44},Application and Device Control engine is not verified,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ +var part30 = match("MESSAGE#18:Application:01", "nwparser.payload", "%{fld44},Application and Device Control engine is not verified,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ dup53, dup12, dup13, @@ -2545,8 +2325,7 @@ match("MESSAGE#18:Application:01", "nwparser.payload", "%{fld44},Application and var msg21 = msg("Application:01", part30); -var part31 = // "Pattern{Field(fld44,false), Constant('Blocked,['), Field(fld5,false), Constant('] '), Field(event_description,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld45,false)}" -match("MESSAGE#19:Application:02", "nwparser.payload", "%{fld44}Blocked,[%{fld5}] %{event_description->} - Caller MD5=%{fld6},Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld45}", processor_chain([ +var part31 = match("MESSAGE#19:Application:02", "nwparser.payload", "%{fld44}Blocked,[%{fld5}] %{event_description->} - Caller MD5=%{fld6},Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld45}", processor_chain([ dup53, dup12, dup13, @@ -2559,8 +2338,7 @@ match("MESSAGE#19:Application:02", "nwparser.payload", "%{fld44}Blocked,[%{fld5} var msg22 = msg("Application:02", part31); -var part32 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(event_description,false), Constant(',, Scan Complete: Risks: '), Field(fld7,true), Constant(' Scanned: '), Field(fld8,true), Constant(' Omitted: '), Field(fld9,true), Constant(' Trusted Files Skipped: '), Field(fld10,false)}" -match("MESSAGE#683:Application:03", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, Scan Complete: Risks: %{fld7->} Scanned: %{fld8->} Omitted: %{fld9->} Trusted Files Skipped: %{fld10}", processor_chain([ +var part32 = match("MESSAGE#683:Application:03", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, Scan Complete: Risks: %{fld7->} Scanned: %{fld8->} Omitted: %{fld9->} Trusted Files Skipped: %{fld10}", processor_chain([ dup43, dup15, dup55, @@ -2568,8 +2346,7 @@ match("MESSAGE#683:Application:03", "nwparser.payload", "Application,rn=%{fld1-> var msg23 = msg("Application:03", part32); -var part33 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(event_description,false), Constant(',, '), Field(info,false), Constant('.')}" -match("MESSAGE#684:Application:04", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, %{info}.", processor_chain([ +var part33 = match("MESSAGE#684:Application:04", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{event_description},, %{info}.", processor_chain([ dup43, dup15, dup55, @@ -2577,8 +2354,7 @@ match("MESSAGE#684:Application:04", "nwparser.payload", "Application,rn=%{fld1-> var msg24 = msg("Application:04", part33); -var part34 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,'), Field(hostname,false), Constant(',Classic,'), Field(shost,false), Constant(','), Field(fld22,false), Constant(',,'), Field(space,false), Constant('Proactive Threat Protection has been disabled')}" -match("MESSAGE#685:Application:05", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{fld22},,%{space}Proactive Threat Protection has been disabled", processor_chain([ +var part34 = match("MESSAGE#685:Application:05", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,%{hostname},Classic,%{shost},%{fld22},,%{space}Proactive Threat Protection has been disabled", processor_chain([ dup43, dup56, dup15, @@ -2597,8 +2373,7 @@ var select12 = linear_select([ msg25, ]); -var part35 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"Application has changed since the last time you opened it, process id:'), Field(process_id,true), Constant(' Filename: '), Field(fld8,true), Constant(' The change was denied by user.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld11,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#20:Application:07", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id:%{process_id->} Filename: %{fld8->} The change was denied by user.\",Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld11},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part35 = match("MESSAGE#20:Application:07", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id:%{process_id->} Filename: %{fld8->} The change was denied by user.\",Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld11},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup53, dup34, dup58, @@ -2613,8 +2388,7 @@ match("MESSAGE#20:Application:07", "nwparser.payload", "SHA-256:%{checksum},MD-5 var msg26 = msg("Application:07", part35); -var part36 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' '), Field(fld1,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#27:Application:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} %{fld1}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part36 = match("MESSAGE#27:Application:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} %{fld1}\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all9 = all_match({ processors: [ @@ -2637,8 +2411,7 @@ var all9 = all_match({ var msg27 = msg("Application:06", all9); -var part37 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',REMEDIATION WAS NEEDED - '), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#28:REMEDIATION/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},REMEDIATION WAS NEEDED - %{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part37 = match("MESSAGE#28:REMEDIATION/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},REMEDIATION WAS NEEDED - %{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all10 = all_match({ processors: [ @@ -2658,8 +2431,7 @@ var all10 = all_match({ var msg28 = msg("REMEDIATION", all10); -var part38 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#29:blocked:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part38 = match("MESSAGE#29:blocked:06/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all11 = all_match({ processors: [ @@ -2682,8 +2454,7 @@ var all11 = all_match({ var msg29 = msg("blocked:06", all11); -var part39 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#30:blocked:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part39 = match("MESSAGE#30:blocked:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all12 = all_match({ processors: [ @@ -2706,8 +2477,7 @@ var all12 = all_match({ var msg30 = msg("blocked:16", all12); -var part40 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,"Somebody is scanning your computer. Your computer's TCP ports: '), Field(fld60,false), Constant(', '), Field(fld61,false), Constant(', '), Field(fld62,false), Constant(', '), Field(fld63,true), Constant(' and '), Field(fld64,true), Constant(' have been scanned from '), Field(fld65,false), Constant('.",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#31:scanning:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part40 = match("MESSAGE#31:scanning:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all13 = all_match({ processors: [ @@ -2730,8 +2500,7 @@ var all13 = all_match({ var msg31 = msg("scanning:01", all13); -var part41 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,"Somebody is scanning your computer. Your computer's TCP ports: '), Field(fld60,false), Constant(', '), Field(fld61,false), Constant(', '), Field(fld62,false), Constant(', '), Field(fld63,true), Constant(' and '), Field(fld64,true), Constant(' have been scanned from '), Field(fld65,false), Constant('.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#32:scanning/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part41 = match("MESSAGE#32:scanning/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,\"Somebody is scanning your computer. Your computer's TCP ports: %{fld60}, %{fld61}, %{fld62}, %{fld63->} and %{fld64->} have been scanned from %{fld65}.\",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all14 = all_match({ processors: [ @@ -2754,19 +2523,16 @@ var all14 = all_match({ var msg32 = msg("scanning", all14); -var part42 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Informational: File Download Hash,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" -match("MESSAGE#33:Informational/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},%{p0}"); +var part42 = match("MESSAGE#33:Informational/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},%{p0}"); -var part43 = // "Pattern{Constant(' Domain: '), Field(p0,false)}" -match("MESSAGE#33:Informational/1_0", "nwparser.p0", " Domain: %{p0}"); +var part43 = match("MESSAGE#33:Informational/1_0", "nwparser.p0", " Domain: %{p0}"); var select13 = linear_select([ part43, dup67, ]); -var part44 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#33:Informational/2", "nwparser.p0", "%{} %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part44 = match("MESSAGE#33:Informational/2", "nwparser.p0", "%{} %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all15 = all_match({ processors: [ @@ -2791,8 +2557,7 @@ var all15 = all_match({ var msg33 = msg("Informational", all15); -var part45 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Informational: File Download Hash,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#34:Informational:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part45 = match("MESSAGE#34:Informational:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,Informational: File Download Hash,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all16 = all_match({ processors: [ @@ -2815,8 +2580,7 @@ var all16 = all_match({ var msg34 = msg("Informational:01", all16); -var part46 = // "Pattern{Field(shost,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',CCD Notification: REMEDIATION NOT REQUIRED,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote:'), Field(fld2,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application:'), Field(fld6,false), Constant(',Location: '), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(', Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string:'), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:')}" -match("MESSAGE#35:SHA-256::01", "nwparser.payload", "%{shost}, SHA-256:%{checksum},MD-5:%{checksum},CCD Notification: REMEDIATION NOT REQUIRED,Local: %{saddr},Local: %{fld1},Remote:%{fld2},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application:%{fld6},Location: %{fld7},User: %{username}, Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string:%{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:", processor_chain([ +var part46 = match("MESSAGE#35:SHA-256::01", "nwparser.payload", "%{shost}, SHA-256:%{checksum},MD-5:%{checksum},CCD Notification: REMEDIATION NOT REQUIRED,Local: %{saddr},Local: %{fld1},Remote:%{fld2},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application:%{fld6},Location: %{fld7},User: %{username}, Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string:%{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:", processor_chain([ dup53, dup12, dup13, @@ -2831,8 +2595,7 @@ match("MESSAGE#35:SHA-256::01", "nwparser.payload", "%{shost}, SHA-256:%{checksu var msg35 = msg("SHA-256::01", part46); -var part47 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#36:Web_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part47 = match("MESSAGE#36:Web_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all17 = all_match({ processors: [ @@ -2855,8 +2618,7 @@ var all17 = all_match({ var msg36 = msg("Web_Attack", all17); -var part48 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Fake Flash Player Download '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#37:Web_Attack:13/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Flash Player Download %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part48 = match("MESSAGE#37:Web_Attack:13/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Flash Player Download %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all18 = all_match({ processors: [ @@ -2879,19 +2641,16 @@ var all18 = all_match({ var msg37 = msg("Web_Attack:13", all18); -var part49 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] Web Attack'), Field(p0,false)}" -match("MESSAGE#38:Web_Attack:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack%{p0}"); +var part49 = match("MESSAGE#38:Web_Attack:16/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack%{p0}"); -var part50 = // "Pattern{Constant(' : '), Field(p0,false)}" -match("MESSAGE#38:Web_Attack:16/1_0", "nwparser.p0", " : %{p0}"); +var part50 = match("MESSAGE#38:Web_Attack:16/1_0", "nwparser.p0", " : %{p0}"); var select14 = linear_select([ part50, dup71, ]); -var part51 = // "Pattern{Field(,false), Constant('JSCoinminer Download '), Field(fld21,true), Constant(' attack blocked. Traffic has been blocked for this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#38:Web_Attack:16/2", "nwparser.p0", "%{}JSCoinminer Download %{fld21->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); +var part51 = match("MESSAGE#38:Web_Attack:16/2", "nwparser.p0", "%{}JSCoinminer Download %{fld21->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); var all19 = all_match({ processors: [ @@ -2915,8 +2674,7 @@ var all19 = all_match({ var msg38 = msg("Web_Attack:16", all19); -var part52 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,[SID: '), Field(fld26,false), Constant('] Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked. '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#39:Web_Attack:03", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,[SID: %{fld26}] Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked. %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ +var part52 = match("MESSAGE#39:Web_Attack:03", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum->} ,[SID: %{fld26}] Web Attack: Apache Struts2 devMode OGNL Execution attack detected but not blocked. %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ dup69, dup12, dup13, @@ -2931,8 +2689,7 @@ match("MESSAGE#39:Web_Attack:03", "nwparser.payload", "SHA-256:%{checksum},MD-5: var msg39 = msg("Web_Attack:03", part52); -var part53 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] Web Attack : Malvertisement Website Redirect '), Field(fld2,true), Constant(' attack blocked. Traffic has been blocked for this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#40:Web_Attack:15", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack : Malvertisement Website Redirect %{fld2->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ +var part53 = match("MESSAGE#40:Web_Attack:15", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] Web Attack : Malvertisement Website Redirect %{fld2->} attack blocked. Traffic has been blocked for this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,OTHERS,,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}", processor_chain([ dup69, dup12, dup13, @@ -2947,8 +2704,7 @@ match("MESSAGE#40:Web_Attack:15", "nwparser.payload", "SHA-256:%{checksum},MD-5: var msg40 = msg("Web_Attack:15", part53); -var part54 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#41:Web_Attack:11/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part54 = match("MESSAGE#41:Web_Attack:11/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack : Malvertisement Website Redirect %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all20 = all_match({ processors: [ @@ -2971,8 +2727,7 @@ var all20 = all_match({ var msg41 = msg("Web_Attack:11", all20); -var part55 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#42:Web_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part55 = match("MESSAGE#42:Web_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all21 = all_match({ processors: [ @@ -2995,8 +2750,7 @@ var all21 = all_match({ var msg42 = msg("Web_Attack:01", all21); -var part56 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#43:Web_Attack:12/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part56 = match("MESSAGE#43:Web_Attack:12/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Web Attack: Mass Injection Website %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all22 = all_match({ processors: [ @@ -3019,8 +2773,7 @@ var all22 = all_match({ var msg43 = msg("Web_Attack:12", all22); -var part57 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Mass Injection Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#44:Web_Attack:14/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part57 = match("MESSAGE#44:Web_Attack:14/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Mass Injection Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all23 = all_match({ processors: [ @@ -3043,8 +2796,7 @@ var all23 = all_match({ var msg44 = msg("Web_Attack:14", all23); -var part58 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack : Malvertisement Website Redirect '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#45:Web_Attack:17/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part58 = match("MESSAGE#45:Web_Attack:17/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack : Malvertisement Website Redirect %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all24 = all_match({ processors: [ @@ -3067,8 +2819,7 @@ var all24 = all_match({ var msg45 = msg("Web_Attack:17", all24); -var part59 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Web Attack: Fake Tech Support Website '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#46:Web_Attack:18/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Tech Support Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part59 = match("MESSAGE#46:Web_Attack:18/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Web Attack: Fake Tech Support Website %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all25 = all_match({ processors: [ @@ -3091,8 +2842,7 @@ var all25 = all_match({ var msg46 = msg("Web_Attack:18", all25); -var part60 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#47:App_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part60 = match("MESSAGE#47:App_Attack/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all26 = all_match({ processors: [ @@ -3115,8 +2865,7 @@ var all26 = all_match({ var msg47 = msg("App_Attack", all26); -var part61 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#48:App_Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part61 = match("MESSAGE#48:App_Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Fake App Attack: Misleading Application Website%{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all27 = all_match({ processors: [ @@ -3139,8 +2888,7 @@ var all27 = all_match({ var msg48 = msg("App_Attack:02", all27); -var part62 = // "Pattern{Field(fld3,false), Constant(', SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,true), Constant(' ,Fake App Attack: Misleading Application Website'), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#49:App_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Fake App Attack: Misleading Application Website%{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part62 = match("MESSAGE#49:App_Attack:01/0", "nwparser.payload", "%{fld3}, SHA-256:%{checksum},MD-5:%{checksum->} ,Fake App Attack: Misleading Application Website%{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all28 = all_match({ processors: [ @@ -3163,8 +2911,7 @@ var all28 = all_match({ var msg49 = msg("App_Attack:01", all28); -var part63 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#50:Host_Integrity/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part63 = match("MESSAGE#50:Host_Integrity/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all29 = all_match({ processors: [ @@ -3186,11 +2933,9 @@ var all29 = all_match({ var msg50 = msg("Host_Integrity", all29); -var part64 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',"'), Field(p0,false)}" -match("MESSAGE#307:process:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"%{p0}"); +var part64 = match("MESSAGE#307:process:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},\"%{p0}"); -var part65 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile'), Field(fld6,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#307:process:12/2", "nwparser.p0", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile%{fld6}\"%{p0}"); +var part65 = match("MESSAGE#307:process:12/2", "nwparser.p0", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile%{fld6}\"%{p0}"); var all30 = all_match({ processors: [ @@ -3218,8 +2963,7 @@ var all30 = all_match({ var msg51 = msg("process:12", all30); -var part66 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('attack detected but not blocked. Application path:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#461:Audit:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part66 = match("MESSAGE#461:Audit:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all31 = all_match({ processors: [ @@ -3242,8 +2986,7 @@ var all31 = all_match({ var msg52 = msg("Audit:01", all31); -var part67 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('attack detected but not blocked. Application path:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#462:Audit:11/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part67 = match("MESSAGE#462:Audit:11/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}attack detected but not blocked. Application path:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all32 = all_match({ processors: [ @@ -3266,8 +3009,7 @@ var all32 = all_match({ var msg53 = msg("Audit:11", all32); -var part68 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('. Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(','), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#463:Audit:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part68 = match("MESSAGE#463:Audit:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all33 = all_match({ processors: [ @@ -3290,8 +3032,7 @@ var all33 = all_match({ var msg54 = msg("Audit:02", all33); -var part69 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,false), Constant('. Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(','), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#464:Audit:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part69 = match("MESSAGE#464:Audit:12/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld26}] %{category}: %{event_description}. Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all34 = all_match({ processors: [ @@ -3314,8 +3055,7 @@ var all34 = all_match({ var msg55 = msg("Audit:12", all34); -var part70 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld111,false), Constant('] '), Field(category,false), Constant(':'), Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#507:Attack:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part70 = match("MESSAGE#507:Attack:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all35 = all_match({ processors: [ @@ -3337,8 +3077,7 @@ var all35 = all_match({ var msg56 = msg("Attack:03", all35); -var part71 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',[SID: '), Field(fld111,false), Constant('] '), Field(category,false), Constant(':'), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#508:Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part71 = match("MESSAGE#508:Attack:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},[SID: %{fld111}] %{category}:%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all36 = all_match({ processors: [ @@ -3360,8 +3099,7 @@ var all36 = all_match({ var msg57 = msg("Attack:02", all36); -var part72 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Auto-Block Event,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#710:Auto-block/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Auto-Block Event,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part72 = match("MESSAGE#710:Auto-block/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Auto-Block Event,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all37 = all_match({ processors: [ @@ -3383,8 +3121,7 @@ var all37 = all_match({ var msg58 = msg("Auto-block", all37); -var part73 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Denial of Service 'Smurf' attack detected. Description: '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#711:Denial/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part73 = match("MESSAGE#711:Denial/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all38 = all_match({ processors: [ @@ -3407,8 +3144,7 @@ var all38 = all_match({ var msg59 = msg("Denial", all38); -var part74 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Denial of Service 'Smurf' attack detected. Description: '), Field(info,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#712:Denial:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part74 = match("MESSAGE#712:Denial:01/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Denial of Service 'Smurf' attack detected. Description: %{info},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all39 = all_match({ processors: [ @@ -3431,8 +3167,7 @@ var all39 = all_match({ var msg60 = msg("Denial:01", all39); -var part75 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Denial of Service ''Smurf'' attack detected. Description: '), Field(info,false), Constant('',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#713:Denial:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part75 = match("MESSAGE#713:Denial:02/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all40 = all_match({ processors: [ @@ -3455,8 +3190,7 @@ var all40 = all_match({ var msg61 = msg("Denial:02", all40); -var part76 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Denial of Service ''Smurf'' attack detected. Description: '), Field(info,false), Constant('',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#714:Denial:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part76 = match("MESSAGE#714:Denial:03/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Denial of Service ''Smurf'' attack detected. Description: %{info}',Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all41 = all_match({ processors: [ @@ -3479,8 +3213,7 @@ var all41 = all_match({ var msg62 = msg("Denial:03", all41); -var part77 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Host Integrity check passed'), Field(space,false), Constant('Requirement: '), Field(fld11,true), Constant(' passed ',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#715:Host:18", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check passed%{space}Requirement: %{fld11->} passed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part77 = match("MESSAGE#715:Host:18", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check passed%{space}Requirement: %{fld11->} passed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup86, dup87, dup12, @@ -3494,8 +3227,7 @@ match("MESSAGE#715:Host:18", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{che var msg63 = msg("Host:18", part77); -var part78 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(','Host Integrity check failed Requirement: '''), Field(fld11,false), Constant(''' passed Requirement: '''), Field(fld12,false), Constant(''' failed ',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#716:Host:19", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check failed Requirement: ''%{fld11}'' passed Requirement: ''%{fld12}'' failed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part78 = match("MESSAGE#716:Host:19", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},'Host Integrity check failed Requirement: ''%{fld11}'' passed Requirement: ''%{fld12}'' failed ',Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup86, dup12, dup13, @@ -3508,8 +3240,7 @@ match("MESSAGE#716:Host:19", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{che var msg64 = msg("Host:19", part78); -var part79 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',DLP version is latest,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld41,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld55,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#719:DLP_version", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},DLP version is latest,Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part79 = match("MESSAGE#719:DLP_version", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},DLP version is latest,Local: %{saddr},Local: %{fld3},Remote: %{fld41},Remote: %{daddr},Remote: %{fld55},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup53, dup12, dup13, @@ -3524,8 +3255,7 @@ match("MESSAGE#719:DLP_version", "nwparser.payload", "SHA-256:%{checksum},MD-5:% var msg65 = msg("DLP_version", part79); -var part80 = // "Pattern{Constant('SHA-256:'), Field(checksum,false), Constant(',MD-5:'), Field(checksum,false), Constant(',Brute force remote login,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld27,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#720:Brute_force/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Brute force remote login,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld27},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part80 = match("MESSAGE#720:Brute_force/0", "nwparser.payload", "SHA-256:%{checksum},MD-5:%{checksum},Brute force remote login,Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld27},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all42 = all_match({ processors: [ @@ -3592,8 +3322,7 @@ var select15 = linear_select([ msg66, ]); -var part81 = // "Pattern{Constant('Applied new policy with '), Field(info,false), Constant('successfully.'), Field(p0,false)}" -match("MESSAGE#21:Applied/0", "nwparser.payload", "Applied new policy with %{info}successfully.%{p0}"); +var part81 = match("MESSAGE#21:Applied/0", "nwparser.payload", "Applied new policy with %{info}successfully.%{p0}"); var all43 = all_match({ processors: [ @@ -3613,8 +3342,7 @@ var all43 = all_match({ var msg67 = msg("Applied", all43); -var part82 = // "Pattern{Constant('Applied new profile with serial number '), Field(fld23,true), Constant(' successfully.')}" -match("MESSAGE#700:Smc:04", "nwparser.payload", "Applied new profile with serial number %{fld23->} successfully.", processor_chain([ +var part82 = match("MESSAGE#700:Smc:04", "nwparser.payload", "Applied new profile with serial number %{fld23->} successfully.", processor_chain([ dup53, dup94, dup13, @@ -3630,8 +3358,7 @@ var select16 = linear_select([ msg68, ]); -var part83 = // "Pattern{Constant('Add shared policy upon system install,LiveUpdate Settings policy'), Field(,false)}" -match("MESSAGE#22:Add", "nwparser.payload", "Add shared policy upon system install,LiveUpdate Settings policy%{}", processor_chain([ +var part83 = match("MESSAGE#22:Add", "nwparser.payload", "Add shared policy upon system install,LiveUpdate Settings policy%{}", processor_chain([ dup95, dup12, dup13, @@ -3645,11 +3372,9 @@ match("MESSAGE#22:Add", "nwparser.payload", "Add shared policy upon system insta var msg69 = msg("Add", part83); -var part84 = // "Pattern{Constant('System Infected: '), Field(threat_name,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#23:blocked:01/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part84 = match("MESSAGE#23:blocked:01/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part85 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#23:blocked:01/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); +var part85 = match("MESSAGE#23:blocked:01/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); var all44 = all_match({ processors: [ @@ -3673,11 +3398,9 @@ var all44 = all_match({ var msg70 = msg("blocked:01", all44); -var part86 = // "Pattern{Constant('System Infected: '), Field(threat_name,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#24:blocked:12/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part86 = match("MESSAGE#24:blocked:12/0", "nwparser.payload", "System Infected: %{threat_name->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part87 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#24:blocked:12/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); +var part87 = match("MESSAGE#24:blocked:12/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); var all45 = all_match({ processors: [ @@ -3701,11 +3424,9 @@ var all45 = all_match({ var msg71 = msg("blocked:12", all45); -var part88 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#25:blocked:05/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{daddr},Remote: %{fld15},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part88 = match("MESSAGE#25:blocked:05/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{daddr},Remote: %{fld15},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part89 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#25:blocked:05/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part89 = match("MESSAGE#25:blocked:05/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var all46 = all_match({ processors: [ @@ -3729,11 +3450,9 @@ var all46 = all_match({ var msg72 = msg("blocked:05", all46); -var part90 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#26:blocked:15/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{saddr},Remote: %{fld15},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part90 = match("MESSAGE#26:blocked:15/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{saddr},Remote: %{fld15},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part91 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#26:blocked:15/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part91 = match("MESSAGE#26:blocked:15/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var all47 = all_match({ processors: [ @@ -3757,8 +3476,7 @@ var all47 = all_match({ var msg73 = msg("blocked:15", all47); -var part92 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#52:blocked/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part92 = match("MESSAGE#52:blocked/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{saddr},Local: %{fld12},Remote: %{fld15},Remote: %{daddr},Remote: %{fld51},Outbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); var all48 = all_match({ processors: [ @@ -3782,8 +3500,7 @@ var all48 = all_match({ var msg74 = msg("blocked", all48); -var part93 = // "Pattern{Field(fld28,true), Constant(' detected. Traffic has been blocked from this application: '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld52,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#53:blocked:11/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part93 = match("MESSAGE#53:blocked:11/0", "nwparser.payload", "%{fld28->} detected. Traffic has been blocked from this application: %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},Intrusion ID: %{fld52},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); var all49 = all_match({ processors: [ @@ -3816,8 +3533,7 @@ var select17 = linear_select([ msg75, ]); -var part94 = // "Pattern{Constant('The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Unknown,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#51:Host_Integrity:01/0", "nwparser.payload", "The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part94 = match("MESSAGE#51:Host_Integrity:01/0", "nwparser.payload", "The most recent Host Integrity content has not completed a download or cannot be authenticated.,Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Unknown,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all50 = all_match({ processors: [ @@ -3839,8 +3555,7 @@ var all50 = all_match({ var msg76 = msg("Host_Integrity:01", all50); -var part95 = // "Pattern{Field(,true), Constant(' '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Inbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Rule: '), Field(rulename,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#190:Local::01/1", "nwparser.p0", "%{} %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); +var part95 = match("MESSAGE#190:Local::01/1", "nwparser.p0", "%{} %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); var all51 = all_match({ processors: [ @@ -3863,8 +3578,7 @@ var all51 = all_match({ var msg77 = msg("Local::01", all51); -var part96 = // "Pattern{Field(,true), Constant(' '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Outbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Rule: '), Field(rulename,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#191:Local::13/1", "nwparser.p0", "%{} %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); +var part96 = match("MESSAGE#191:Local::13/1", "nwparser.p0", "%{} %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Rule: %{rulename},Location: %{fld11},User: %{username},Domain: %{domain},Action: %{action}"); var all52 = all_match({ processors: [ @@ -3887,8 +3601,7 @@ var all52 = all_match({ var msg78 = msg("Local::13", all52); -var part97 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Outbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(','), Field(p0,false)}" -match("MESSAGE#192:Local:/0", "nwparser.payload", "Local: %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); +var part97 = match("MESSAGE#192:Local:/0", "nwparser.payload", "Local: %{saddr},Local: %{sport},Local: %{fld12},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Remote: %{fld15},%{protocol},Outbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); var all53 = all_match({ processors: [ @@ -3913,8 +3626,7 @@ var all53 = all_match({ var msg79 = msg("Local:", all53); -var part98 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',Inbound,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(','), Field(p0,false)}" -match("MESSAGE#193:Local:11/0", "nwparser.payload", "Local: %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); +var part98 = match("MESSAGE#193:Local:11/0", "nwparser.payload", "Local: %{daddr},Local: %{dport},Local: %{fld12},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Remote: %{fld15},%{protocol},Inbound,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},%{p0}"); var all54 = all_match({ processors: [ @@ -3939,8 +3651,7 @@ var all54 = all_match({ var msg80 = msg("Local:11", all54); -var part99 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,true), Constant(' CVE-'), Field(cve,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#194:Local::09", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part99 = match("MESSAGE#194:Local::09", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup110, dup12, dup13, @@ -3955,8 +3666,7 @@ match("MESSAGE#194:Local::09", "nwparser.payload", "[SID: %{fld26}] %{category}: var msg81 = msg("Local::09", part99); -var part100 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,true), Constant(' CVE-'), Field(cve,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#195:Local::20", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part100 = match("MESSAGE#195:Local::20", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string->} CVE-%{cve},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup110, dup12, dup13, @@ -3971,8 +3681,7 @@ match("MESSAGE#195:Local::20", "nwparser.payload", "[SID: %{fld26}] %{category}: var msg82 = msg("Local::20", part100); -var part101 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#196:Local::08", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part101 = match("MESSAGE#196:Local::08", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup110, dup12, dup13, @@ -3986,8 +3695,7 @@ match("MESSAGE#196:Local::08", "nwparser.payload", "[SID: %{fld26}] %{category}: var msg83 = msg("Local::08", part101); -var part102 = // "Pattern{Constant('[SID: '), Field(fld26,false), Constant('] '), Field(category,false), Constant(': '), Field(event_description,true), Constant(' Traffic has been blocked for this application:'), Field(fld27,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#197:Local::18", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part102 = match("MESSAGE#197:Local::18", "nwparser.payload", "[SID: %{fld26}] %{category}: %{event_description->} Traffic has been blocked for this application:%{fld27},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup110, dup12, dup13, @@ -4001,8 +3709,7 @@ match("MESSAGE#197:Local::18", "nwparser.payload", "[SID: %{fld26}] %{category}: var msg84 = msg("Local::18", part102); -var part103 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#198:Local::04/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part103 = match("MESSAGE#198:Local::04/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all55 = all_match({ processors: [ @@ -4028,8 +3735,7 @@ var all55 = all_match({ var msg85 = msg("Local::04", all55); -var part104 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(','), Field(p0,false)}" -match("MESSAGE#199:Local::17/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); +var part104 = match("MESSAGE#199:Local::17/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},%{p0}"); var all56 = all_match({ processors: [ @@ -4055,8 +3761,7 @@ var all56 = all_match({ var msg86 = msg("Local::17", all56); -var part105 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant('Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(dport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(sport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant(',!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld23,false)}" -match("MESSAGE#200:Local::06", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol}Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ +var part105 = match("MESSAGE#200:Local::06", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol}Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{dport},!ExternalLoggingTask.remoteport! %{sport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ dup86, dup12, dup13, @@ -4070,8 +3775,7 @@ match("MESSAGE#200:Local::06", "nwparser.payload", "%{event_description},Local: var msg87 = msg("Local::06", part105); -var part106 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',!ExternalLoggingTask.localport! '), Field(sport,false), Constant(',!ExternalLoggingTask.remoteport! '), Field(dport,false), Constant(',!ExternalLoggingTask.cidssignid! '), Field(sigid,false), Constant(',!ExternalLoggingTask.strcidssignid! '), Field(sigid_string,false), Constant(',!ExternalLoggingTask.cidssignsubid! '), Field(sigid1,false), Constant(',!ExternalLoggingTask.intrusionurl! '), Field(url,false), Constant(',!ExternalLoggingTask.intrusionpayloadurl! '), Field(fld23,false)}" -match("MESSAGE#201:Local::16", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ +var part106 = match("MESSAGE#201:Local::16", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},!ExternalLoggingTask.localport! %{sport},!ExternalLoggingTask.remoteport! %{dport},!ExternalLoggingTask.cidssignid! %{sigid},!ExternalLoggingTask.strcidssignid! %{sigid_string},!ExternalLoggingTask.cidssignsubid! %{sigid1},!ExternalLoggingTask.intrusionurl! %{url},!ExternalLoggingTask.intrusionpayloadurl! %{fld23}", processor_chain([ dup86, dup12, dup13, @@ -4085,8 +3789,7 @@ match("MESSAGE#201:Local::16", "nwparser.payload", "%{event_description},Local: var msg88 = msg("Local::16", part106); -var part107 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',0,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#202:Local::02", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},0,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ +var part107 = match("MESSAGE#202:Local::02", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},0,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ dup86, dup12, dup13, @@ -4101,8 +3804,7 @@ match("MESSAGE#202:Local::02", "nwparser.payload", "%{event_description},Local: var msg89 = msg("Local::02", part107); -var part108 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',1,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#203:Local::22", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},%{protocol},1,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ +var part108 = match("MESSAGE#203:Local::22", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},%{protocol},1,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ dup86, dup12, dup13, @@ -4117,8 +3819,7 @@ match("MESSAGE#203:Local::22", "nwparser.payload", "%{event_description},Local: var msg90 = msg("Local::22", part108); -var part109 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(','), Field(protocol,false), Constant(',2,Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#204:Local::23", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},2,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ +var part109 = match("MESSAGE#204:Local::23", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},%{protocol},2,Intrusion ID: %{fld33},Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain}", processor_chain([ dup86, dup12, dup13, @@ -4133,8 +3834,7 @@ match("MESSAGE#204:Local::23", "nwparser.payload", "%{event_description},Local: var msg91 = msg("Local::23", part109); -var part110 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(': '), Field(fld22,true), Constant(' CVE-'), Field(cve,true), Constant(' '), Field(fld26,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#205:Local::07/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part110 = match("MESSAGE#205:Local::07/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var all57 = all_match({ processors: [ @@ -4157,8 +3857,7 @@ var all57 = all_match({ var msg92 = msg("Local::07", all57); -var part111 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(': '), Field(fld22,true), Constant(' CVE-'), Field(cve,true), Constant(' '), Field(fld26,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#206:Local::19/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part111 = match("MESSAGE#206:Local::19/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string}: %{fld22->} CVE-%{cve->} %{fld26},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var all58 = all_match({ processors: [ @@ -4181,8 +3880,7 @@ var all58 = all_match({ var msg93 = msg("Local::19", all58); -var part112 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#207:Local::05/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); +var part112 = match("MESSAGE#207:Local::05/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); var all59 = all_match({ processors: [ @@ -4208,8 +3906,7 @@ var all59 = all_match({ var msg94 = msg("Local::05", all59); -var part113 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#208:Local::15/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); +var part113 = match("MESSAGE#208:Local::15/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}"); var all60 = all_match({ processors: [ @@ -4283,8 +3980,7 @@ var all62 = all_match({ var msg97 = msg("Local::14", all62); -var part114 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(dport,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(sport,false), Constant(',Inbound,Application: '), Field(application,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#211:Local::10", "nwparser.payload", "Local: %{daddr},Local: %{dport},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Inbound,Application: %{application},Action: %{action}", processor_chain([ +var part114 = match("MESSAGE#211:Local::10", "nwparser.payload", "Local: %{daddr},Local: %{dport},Remote: %{saddr},Remote: %{fld13},Remote: %{sport},Inbound,Application: %{application},Action: %{action}", processor_chain([ dup86, dup12, dup13, @@ -4296,8 +3992,7 @@ match("MESSAGE#211:Local::10", "nwparser.payload", "Local: %{daddr},Local: %{dpo var msg98 = msg("Local::10", part114); -var part115 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(sport,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(dport,false), Constant(',Outbound,Application: '), Field(application,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#212:Local::21", "nwparser.payload", "Local: %{saddr},Local: %{sport},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Outbound,Application: %{application},Action: %{action}", processor_chain([ +var part115 = match("MESSAGE#212:Local::21", "nwparser.payload", "Local: %{saddr},Local: %{sport},Remote: %{daddr},Remote: %{fld13},Remote: %{dport},Outbound,Application: %{application},Action: %{action}", processor_chain([ dup86, dup12, dup13, @@ -4309,8 +4004,7 @@ match("MESSAGE#212:Local::21", "nwparser.payload", "Local: %{saddr},Local: %{spo var msg99 = msg("Local::21", part115); -var part116 = // "Pattern{Constant('Event Description: '), Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local Host MAC: '), Field(dmacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(saddr,false), Constant(',Remote Host MAC: '), Field(smacaddr,false), Constant(',Inbound,'), Field(protocol,false), Constant(',Intrusion ID: 0,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(dport,false), Constant(',Remote Port: '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" -match("MESSAGE#213:Local::24", "nwparser.payload", "Event Description: %{event_description},Local: %{daddr},Local Host MAC: %{dmacaddr},Remote Host Name: %{fld3},Remote Host IP: %{saddr},Remote Host MAC: %{smacaddr},Inbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{dport},Remote Port: %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ +var part116 = match("MESSAGE#213:Local::24", "nwparser.payload", "Event Description: %{event_description},Local: %{daddr},Local Host MAC: %{dmacaddr},Remote Host Name: %{fld3},Remote Host IP: %{saddr},Remote Host MAC: %{smacaddr},Inbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{dport},Remote Port: %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ dup120, dup12, dup13, @@ -4321,8 +4015,7 @@ match("MESSAGE#213:Local::24", "nwparser.payload", "Event Description: %{event_d var msg100 = msg("Local::24", part116); -var part117 = // "Pattern{Constant('Event Description: '), Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local Host MAC: '), Field(smacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(daddr,false), Constant(',Remote Host MAC: '), Field(dmacaddr,false), Constant(',Outbound,'), Field(protocol,false), Constant(',Intrusion ID: 0,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(sport,false), Constant(',Remote Port: '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" -match("MESSAGE#214:Local::25", "nwparser.payload", "Event Description: %{event_description},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},Outbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ +var part117 = match("MESSAGE#214:Local::25", "nwparser.payload", "Event Description: %{event_description},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},Outbound,%{protocol},Intrusion ID: 0,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ dup36, dup12, dup13, @@ -4333,8 +4026,7 @@ match("MESSAGE#214:Local::25", "nwparser.payload", "Event Description: %{event_d var msg101 = msg("Local::25", part117); -var part118 = // "Pattern{Constant('Event Description: '), Field(event_description,true), Constant(' [Volume]: '), Field(disk_volume,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant(',Local: '), Field(saddr,false), Constant(',Local Host MAC: '), Field(smacaddr,false), Constant(',Remote Host Name: '), Field(fld3,false), Constant(',Remote Host IP: '), Field(daddr,false), Constant(',Remote Host MAC: '), Field(dmacaddr,false), Constant(','), Field(direction,false), Constant(','), Field(fld2,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port: '), Field(sport,false), Constant(',Remote Port: '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL: '), Field(fld12,false), Constant(',SHA-256: '), Field(checksum,false), Constant(',MD-5: '), Field(checksum,false)}" -match("MESSAGE#215:Local::26", "nwparser.payload", "Event Description: %{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},%{direction},%{fld2},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ +var part118 = match("MESSAGE#215:Local::26", "nwparser.payload", "Event Description: %{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses},Local: %{saddr},Local Host MAC: %{smacaddr},Remote Host Name: %{fld3},Remote Host IP: %{daddr},Remote Host MAC: %{dmacaddr},%{direction},%{fld2},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port: %{sport},Remote Port: %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL: %{fld12},SHA-256: %{checksum},MD-5: %{checksum}", processor_chain([ dup53, dup12, dup13, @@ -4374,8 +4066,7 @@ var select18 = linear_select([ msg102, ]); -var part119 = // "Pattern{Constant('Blocked Attack: Memory Heap Spray attack against '), Field(fld1,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld15,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld51,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#54:Blocked:13/0", "nwparser.payload", "Blocked Attack: Memory Heap Spray attack against %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part119 = match("MESSAGE#54:Blocked:13/0", "nwparser.payload", "Blocked Attack: Memory Heap Spray attack against %{fld1},Local: %{daddr},Local: %{fld12},Remote: %{fld15},Remote: %{saddr},Remote: %{fld51},Inbound,%{protocol},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld2},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all63 = all_match({ processors: [ @@ -4398,8 +4089,7 @@ var all63 = all_match({ var msg103 = msg("Blocked:13", all63); -var part120 = // "Pattern{Constant('"'), Field(fld23,false), Constant(',",File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#483:File:01", "nwparser.payload", "\"%{fld23},\",File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part120 = match("MESSAGE#483:File:01", "nwparser.payload", "\"%{fld23},\",File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4415,8 +4105,7 @@ match("MESSAGE#483:File:01", "nwparser.payload", "\"%{fld23},\",File Read,Begin: var msg104 = msg("File:01", part120); -var part121 = // "Pattern{Constant('"'), Field(info,false), Constant('",Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld1,false), Constant(','), Field(process,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#484:File:11", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part121 = match("MESSAGE#484:File:11", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4429,8 +4118,7 @@ match("MESSAGE#484:File:11", "nwparser.payload", "\"%{info}\",Create Process,Beg var msg105 = msg("File:11", part121); -var part122 = // "Pattern{Constant('"'), Field(info,false), Constant('",Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld1,false), Constant(','), Field(process,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(application,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#485:File:02", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain}", processor_chain([ +var part122 = match("MESSAGE#485:File:02", "nwparser.payload", "\"%{info}\",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld1},%{process},%{fld3},%{fld4},%{application},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4443,8 +4131,7 @@ match("MESSAGE#485:File:02", "nwparser.payload", "\"%{info}\",Create Process,Beg var msg106 = msg("File:02", part122); -var part123 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#486:File:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part123 = match("MESSAGE#486:File:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4459,8 +4146,7 @@ match("MESSAGE#486:File:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fl var msg107 = msg("File:03", part123); -var part124 = // "Pattern{Field(info,false), Constant('.'), Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#487:Blocked:04", "nwparser.payload", "%{info}.%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part124 = match("MESSAGE#487:Blocked:04", "nwparser.payload", "%{info}.%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4476,8 +4162,7 @@ match("MESSAGE#487:Blocked:04", "nwparser.payload", "%{info}.%{fld1},File Read,B var msg108 = msg("Blocked:04", part124); -var part125 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" -match("MESSAGE#488:File:05", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ +var part125 = match("MESSAGE#488:File:05", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ dup121, dup12, dup13, @@ -4492,8 +4177,7 @@ match("MESSAGE#488:File:05", "nwparser.payload", "%{fld1},File Read,Begin: %{fld var msg109 = msg("File:05", part125); -var part126 = // "Pattern{Constant('"'), Field(fld23,false), Constant('",,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#489:File:04", "nwparser.payload", "\"%{fld23}\",,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part126 = match("MESSAGE#489:File:04", "nwparser.payload", "\"%{fld23}\",,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4507,8 +4191,7 @@ match("MESSAGE#489:File:04", "nwparser.payload", "\"%{fld23}\",,Begin: %{fld50-> var msg110 = msg("File:04", part126); -var part127 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',"Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#490:File:06", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part127 = match("MESSAGE#490:File:06", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4523,8 +4206,7 @@ match("MESSAGE#490:File:06", "nwparser.payload", "%{fld1},File Write,Begin: %{fl var msg111 = msg("File:06", part127); -var part128 = // "Pattern{Constant('''), Field(fld23,false), Constant('',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#491:File:07", "nwparser.payload", "'%{fld23}',,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part128 = match("MESSAGE#491:File:07", "nwparser.payload", "'%{fld23}',,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4538,8 +4220,7 @@ match("MESSAGE#491:File:07", "nwparser.payload", "'%{fld23}',,Begin: %{fld50->} var msg112 = msg("File:07", part128); -var part129 = // "Pattern{Field(fld23,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#492:File:12", "nwparser.payload", "%{fld23},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{process_id},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part129 = match("MESSAGE#492:File:12", "nwparser.payload", "%{fld23},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{process_id},%{process},%{fld4},,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4550,8 +4231,7 @@ match("MESSAGE#492:File:12", "nwparser.payload", "%{fld23},,Begin: %{fld50->} %{ var msg113 = msg("File:12", part129); -var part130 = // "Pattern{Field(fld1,false), Constant(','), Field(fld7,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',"Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#493:File:08", "nwparser.payload", "%{fld1},%{fld7},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part130 = match("MESSAGE#493:File:08", "nwparser.payload", "%{fld1},%{fld7},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},\"Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4564,8 +4244,7 @@ match("MESSAGE#493:File:08", "nwparser.payload", "%{fld1},%{fld7},Begin: %{fld50 var msg114 = msg("File:08", part130); -var part131 = // "Pattern{Field(fld1,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#494:File:09", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part131 = match("MESSAGE#494:File:09", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4580,8 +4259,7 @@ match("MESSAGE#494:File:09", "nwparser.payload", "%{fld1},File Delete,Begin: %{f var msg115 = msg("File:09", part131); -var part132 = // "Pattern{Constant('Unauthorized NT call rejected by protection driver.,'), Field(fld22,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(fld23,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#496:Blocked", "nwparser.payload", "Unauthorized NT call rejected by protection driver.,%{fld22},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{fld23},User: %{username},Domain: %{domain}", processor_chain([ +var part132 = match("MESSAGE#496:Blocked", "nwparser.payload", "Unauthorized NT call rejected by protection driver.,%{fld22},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{fld23},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -4596,8 +4274,7 @@ match("MESSAGE#496:Blocked", "nwparser.payload", "Unauthorized NT call rejected var msg116 = msg("Blocked", part132); -var part133 = // "Pattern{Constant(',Create Process,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" -match("MESSAGE#497:Blocked:01", "nwparser.payload", ",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ +var part133 = match("MESSAGE#497:Blocked:01", "nwparser.payload", ",Create Process,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ dup121, dup12, dup13, @@ -4610,8 +4287,7 @@ match("MESSAGE#497:Blocked:01", "nwparser.payload", ",Create Process,Begin: %{fl var msg117 = msg("Blocked:01", part133); -var part134 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',Registry Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#498:Blocked:02", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},Registry Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part134 = match("MESSAGE#498:Blocked:02", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},Registry Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -4624,19 +4300,16 @@ match("MESSAGE#498:Blocked:02", "nwparser.payload", "%{fld5->} - Caller MD5=%{fl var msg118 = msg("Blocked:02", part134); -var part135 = // "Pattern{Field(fld21,true), Constant(' - Caller MD5='), Field(fld22,false), Constant(',Create Process'), Field(p0,false)}" -match("MESSAGE#499:Blocked:03/0_0", "nwparser.payload", "%{fld21->} - Caller MD5=%{fld22},Create Process%{p0}"); +var part135 = match("MESSAGE#499:Blocked:03/0_0", "nwparser.payload", "%{fld21->} - Caller MD5=%{fld22},Create Process%{p0}"); -var part136 = // "Pattern{Field(fld23,false), Constant(',Load Dll'), Field(p0,false)}" -match("MESSAGE#499:Blocked:03/0_1", "nwparser.payload", "%{fld23},Load Dll%{p0}"); +var part136 = match("MESSAGE#499:Blocked:03/0_1", "nwparser.payload", "%{fld23},Load Dll%{p0}"); var select19 = linear_select([ part135, part136, ]); -var part137 = // "Pattern{Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld24,false), Constant(','), Field(process,false), Constant(','), Field(fld25,false), Constant(','), Field(fld26,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" -match("MESSAGE#499:Blocked:03/1", "nwparser.p0", ",Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld24},%{process},%{fld25},%{fld26},%{filename},User: %{username},Domain: %{domain},Action Type: %{fld8},File size (bytes):%{filename_size},Device ID:%{device}"); +var part137 = match("MESSAGE#499:Blocked:03/1", "nwparser.p0", ",Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld24},%{process},%{fld25},%{fld26},%{filename},User: %{username},Domain: %{domain},Action Type: %{fld8},File size (bytes):%{filename_size},Device ID:%{device}"); var all64 = all_match({ processors: [ @@ -4658,8 +4331,7 @@ var all64 = all_match({ var msg119 = msg("Blocked:03", all64); -var part138 = // "Pattern{Field(event_description,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(sdomain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID:')}" -match("MESSAGE#500:Blocked:05", "nwparser.payload", "%{event_description->} - Caller MD5=%{checksum},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{sdomain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID:", processor_chain([ +var part138 = match("MESSAGE#500:Blocked:05", "nwparser.payload", "%{event_description->} - Caller MD5=%{checksum},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{sdomain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID:", processor_chain([ dup121, dup12, dup13, @@ -4671,8 +4343,7 @@ match("MESSAGE#500:Blocked:05", "nwparser.payload", "%{event_description->} - Ca var msg120 = msg("Blocked:05", part138); -var part139 = // "Pattern{Constant('['), Field(id,false), Constant('] '), Field(event_description,true), Constant(' - '), Field(fld11,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#501:Blocked:06", "nwparser.payload", "[%{id}] %{event_description->} - %{fld11},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ +var part139 = match("MESSAGE#501:Blocked:06", "nwparser.payload", "[%{id}] %{event_description->} - %{fld11},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4684,8 +4355,7 @@ match("MESSAGE#501:Blocked:06", "nwparser.payload", "[%{id}] %{event_description var msg121 = msg("Blocked:06", part139); -var part140 = // "Pattern{Constant('['), Field(id,false), Constant('] '), Field(event_description,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#502:Blocked:07", "nwparser.payload", "[%{id}] %{event_description},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ +var part140 = match("MESSAGE#502:Blocked:07", "nwparser.payload", "[%{id}] %{event_description},%{fld1},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -4697,23 +4367,17 @@ match("MESSAGE#502:Blocked:07", "nwparser.payload", "[%{id}] %{event_description var msg122 = msg("Blocked:07", part140); -var part141 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('/service''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_0", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}/service'%{fld33->} ,Create Process,Begin: %{p0}"); +var part141 = match("MESSAGE#504:Blocked:09/0_0", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}/service'%{fld33->} ,Create Process,Begin: %{p0}"); -var part142 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('chrome-extension:'), Field(fld99,false), Constant('''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_1", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}chrome-extension:%{fld99}'%{fld33->} ,Create Process,Begin: %{p0}"); +var part142 = match("MESSAGE#504:Blocked:09/0_1", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}chrome-extension:%{fld99}'%{fld33->} ,Create Process,Begin: %{p0}"); -var part143 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('-ServerName:'), Field(hostid,false), Constant('''), Field(fld33,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_2", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}'%{fld33->} ,Create Process,Begin: %{p0}"); +var part143 = match("MESSAGE#504:Blocked:09/0_2", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}'%{fld33->} ,Create Process,Begin: %{p0}"); -var part144 = // "Pattern{Constant('- Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,false), Constant('-ServerName:'), Field(hostid,false), Constant('' ,Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_3", "nwparser.payload", "- Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}' ,Create Process,Begin: %{p0}"); +var part144 = match("MESSAGE#504:Blocked:09/0_3", "nwparser.payload", "- Target MD5=%{fld6->} - Target Arguments=%{fld7}-ServerName:%{hostid}' ,Create Process,Begin: %{p0}"); -var part145 = // "Pattern{Field(fld11,true), Constant(' - Target MD5='), Field(fld6,true), Constant(' - Target Arguments='), Field(fld7,true), Constant(' ,Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_4", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7->} ,Create Process,Begin: %{p0}"); +var part145 = match("MESSAGE#504:Blocked:09/0_4", "nwparser.payload", "%{fld11->} - Target MD5=%{fld6->} - Target Arguments=%{fld7->} ,Create Process,Begin: %{p0}"); -var part146 = // "Pattern{Constant('- Target MD5='), Field(fld6,false), Constant(',Create Process,Begin: '), Field(p0,false)}" -match("MESSAGE#504:Blocked:09/0_5", "nwparser.payload", "- Target MD5=%{fld6},Create Process,Begin: %{p0}"); +var part146 = match("MESSAGE#504:Blocked:09/0_5", "nwparser.payload", "- Target MD5=%{fld6},Create Process,Begin: %{p0}"); var select20 = linear_select([ part141, @@ -4724,8 +4388,7 @@ var select20 = linear_select([ part146, ]); -var part147 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,true), Constant(' ,File size ('), Field(fld10,false), Constant('):'), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#504:Blocked:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44->} ,File size (%{fld10}):%{filename_size},Device ID: %{device}"); +var part147 = match("MESSAGE#504:Blocked:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44->} ,File size (%{fld10}):%{filename_size},Device ID: %{device}"); var all65 = all_match({ processors: [ @@ -4770,8 +4433,7 @@ var select21 = linear_select([ msg123, ]); -var part148 = // "Pattern{Constant('Changed value ''), Field(change_attribute,false), Constant('' from ''), Field(change_old,false), Constant('' to ''), Field(change_new,false), Constant('''), Field(p0,false)}" -match("MESSAGE#55:Changed/0", "nwparser.payload", "Changed value '%{change_attribute}' from '%{change_old}' to '%{change_new}'%{p0}"); +var part148 = match("MESSAGE#55:Changed/0", "nwparser.payload", "Changed value '%{change_attribute}' from '%{change_old}' to '%{change_new}'%{p0}"); var all66 = all_match({ processors: [ @@ -4795,8 +4457,7 @@ var all66 = all_match({ var msg124 = msg("Changed", all66); -var part149 = // "Pattern{Constant('Cleaned up '), Field(dclass_counter1,true), Constant(' LiveUpdate downloaded content')}" -match("MESSAGE#56:Cleaned", "nwparser.payload", "Cleaned up %{dclass_counter1->} LiveUpdate downloaded content", processor_chain([ +var part149 = match("MESSAGE#56:Cleaned", "nwparser.payload", "Cleaned up %{dclass_counter1->} LiveUpdate downloaded content", processor_chain([ dup43, dup12, dup13, @@ -4808,8 +4469,7 @@ match("MESSAGE#56:Cleaned", "nwparser.payload", "Cleaned up %{dclass_counter1->} var msg125 = msg("Cleaned", part149); -var part150 = // "Pattern{Constant('Client has downloaded the issued Command,'), Field(username,false)}" -match("MESSAGE#57:Client", "nwparser.payload", "Client has downloaded the issued Command,%{username}", processor_chain([ +var part150 = match("MESSAGE#57:Client", "nwparser.payload", "Client has downloaded the issued Command,%{username}", processor_chain([ dup53, dup12, dup13, @@ -4821,14 +4481,11 @@ match("MESSAGE#57:Client", "nwparser.payload", "Client has downloaded the issued var msg126 = msg("Client", part150); -var part151 = // "Pattern{Field(event_description,false), Constant(', type SymDelta version'), Field(version,true), Constant(' filesize'), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#58:Client:01/0_0", "nwparser.payload", "%{event_description}, type SymDelta version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); +var part151 = match("MESSAGE#58:Client:01/0_0", "nwparser.payload", "%{event_description}, type SymDelta version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); -var part152 = // "Pattern{Field(event_description,false), Constant(', type full version'), Field(version,true), Constant(' filesize'), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#58:Client:01/0_1", "nwparser.payload", "%{event_description}, type full version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); +var part152 = match("MESSAGE#58:Client:01/0_1", "nwparser.payload", "%{event_description}, type full version%{version->} filesize%{filename_size}.\",Event time:%{fld17->} %{fld18}"); -var part153 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#58:Client:01/0_2", "nwparser.payload", "event_description"); +var part153 = match_copy("MESSAGE#58:Client:01/0_2", "nwparser.payload", "event_description"); var select22 = linear_select([ part151, @@ -4857,17 +4514,13 @@ var select23 = linear_select([ msg127, ]); -var part154 = // "Pattern{Constant('client has downloaded the '), Field(p0,false)}" -match("MESSAGE#59:client/0", "nwparser.payload", "client has downloaded the %{p0}"); +var part154 = match("MESSAGE#59:client/0", "nwparser.payload", "client has downloaded the %{p0}"); -var part155 = // "Pattern{Constant('content package'), Field(p0,false)}" -match("MESSAGE#59:client/1_0", "nwparser.p0", "content package%{p0}"); +var part155 = match("MESSAGE#59:client/1_0", "nwparser.p0", "content package%{p0}"); -var part156 = // "Pattern{Constant('policy'), Field(p0,false)}" -match("MESSAGE#59:client/1_1", "nwparser.p0", "policy%{p0}"); +var part156 = match("MESSAGE#59:client/1_1", "nwparser.p0", "policy%{p0}"); -var part157 = // "Pattern{Constant('Intrusion Prevention policy'), Field(p0,false)}" -match("MESSAGE#59:client/1_2", "nwparser.p0", "Intrusion Prevention policy%{p0}"); +var part157 = match("MESSAGE#59:client/1_2", "nwparser.p0", "Intrusion Prevention policy%{p0}"); var select24 = linear_select([ part155, @@ -4875,8 +4528,7 @@ var select24 = linear_select([ part157, ]); -var part158 = // "Pattern{Field(,false), Constant('successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#59:client/2", "nwparser.p0", "%{}successfully,%{shost},%{username},%{group}"); +var part158 = match("MESSAGE#59:client/2", "nwparser.p0", "%{}successfully,%{shost},%{username},%{group}"); var all68 = all_match({ processors: [ @@ -4896,8 +4548,7 @@ var all68 = all_match({ var msg128 = msg("client", all68); -var part159 = // "Pattern{Constant('client has reconnected with the management server,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#60:client:01", "nwparser.payload", "client has reconnected with the management server,%{shost},%{username},%{group}", processor_chain([ +var part159 = match("MESSAGE#60:client:01", "nwparser.payload", "client has reconnected with the management server,%{shost},%{username},%{group}", processor_chain([ dup43, dup12, dup13, @@ -4908,8 +4559,7 @@ match("MESSAGE#60:client:01", "nwparser.payload", "client has reconnected with t var msg129 = msg("client:01", part159); -var part160 = // "Pattern{Constant('client has downloaded '), Field(filename,true), Constant(' successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#61:client:02", "nwparser.payload", "client has downloaded %{filename->} successfully,%{shost},%{username},%{group}", processor_chain([ +var part160 = match("MESSAGE#61:client:02", "nwparser.payload", "client has downloaded %{filename->} successfully,%{shost},%{username},%{group}", processor_chain([ dup43, dup12, dup13, @@ -4920,8 +4570,7 @@ match("MESSAGE#61:client:02", "nwparser.payload", "client has downloaded %{filen var msg130 = msg("client:02", part160); -var part161 = // "Pattern{Constant('client registered with the management server successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#62:client:03", "nwparser.payload", "client registered with the management server successfully,%{shost},%{username},%{group}", processor_chain([ +var part161 = match("MESSAGE#62:client:03", "nwparser.payload", "client registered with the management server successfully,%{shost},%{username},%{group}", processor_chain([ dup43, dup12, dup13, @@ -4932,8 +4581,7 @@ match("MESSAGE#62:client:03", "nwparser.payload", "client registered with the ma var msg131 = msg("client:03", part161); -var part162 = // "Pattern{Constant('client has downloaded '), Field(filename,false), Constant(','), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#63:client:04", "nwparser.payload", "client has downloaded %{filename},%{shost},%{username},%{group}", processor_chain([ +var part162 = match("MESSAGE#63:client:04", "nwparser.payload", "client has downloaded %{filename},%{shost},%{username},%{group}", processor_chain([ dup43, dup12, dup13, @@ -4944,8 +4592,7 @@ match("MESSAGE#63:client:04", "nwparser.payload", "client has downloaded %{filen var msg132 = msg("client:04", part162); -var part163 = // "Pattern{Constant('Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" -match("MESSAGE#64:client:05/2", "nwparser.p0", "Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); +var part163 = match("MESSAGE#64:client:05/2", "nwparser.p0", "Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); var all69 = all_match({ processors: [ @@ -4970,8 +4617,7 @@ var all69 = all_match({ var msg133 = msg("client:05", all69); -var part164 = // "Pattern{Constant('Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" -match("MESSAGE#65:client:15/2", "nwparser.p0", "Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); +var part164 = match("MESSAGE#65:client:15/2", "nwparser.p0", "Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}"); var all70 = all_match({ processors: [ @@ -4996,8 +4642,7 @@ var all70 = all_match({ var msg134 = msg("client:15", all70); -var part165 = // "Pattern{Constant('client computer has been added to the group,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#66:client:06", "nwparser.payload", "client computer has been added to the group,%{shost},%{username},%{group}", processor_chain([ +var part165 = match("MESSAGE#66:client:06", "nwparser.payload", "client computer has been added to the group,%{shost},%{username},%{group}", processor_chain([ dup43, dup12, dup13, @@ -5008,8 +4653,7 @@ match("MESSAGE#66:client:06", "nwparser.payload", "client computer has been adde var msg135 = msg("client:06", part165); -var part166 = // "Pattern{Constant('client computer has been renamed,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(sdomain,false)}" -match("MESSAGE#67:client:07", "nwparser.payload", "client computer has been renamed,%{shost},%{username},%{sdomain}", processor_chain([ +var part166 = match("MESSAGE#67:client:07", "nwparser.payload", "client computer has been renamed,%{shost},%{username},%{sdomain}", processor_chain([ dup43, dup12, dup13, @@ -5020,8 +4664,7 @@ match("MESSAGE#67:client:07", "nwparser.payload", "client computer has been rena var msg136 = msg("client:07", part166); -var part167 = // "Pattern{Constant('The client does not have a paid license. The current license cannot be used to obtain a client authentication token.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#68:client:08", "nwparser.payload", "The client does not have a paid license. The current license cannot be used to obtain a client authentication token.,Event time: %{event_time_string}", processor_chain([ +var part167 = match("MESSAGE#68:client:08", "nwparser.payload", "The client does not have a paid license. The current license cannot be used to obtain a client authentication token.,Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -5032,8 +4675,7 @@ match("MESSAGE#68:client:08", "nwparser.payload", "The client does not have a pa var msg137 = msg("client:08", part167); -var part168 = // "Pattern{Constant('The client has successfully downloaded and applied a license from the server.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#69:client:09", "nwparser.payload", "The client has successfully downloaded and applied a license from the server.,Event time: %{event_time_string}", processor_chain([ +var part168 = match("MESSAGE#69:client:09", "nwparser.payload", "The client has successfully downloaded and applied a license from the server.,Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -5050,22 +4692,18 @@ match("MESSAGE#69:client:09", "nwparser.payload", "The client has successfully d var msg138 = msg("client:09", part168); -var part169 = // "Pattern{Constant('The client opted to download a full definitions package for AV definitions from the management server or GUP '), Field(p0,false)}" -match("MESSAGE#693:SYLINK:01/0", "nwparser.payload", "The client opted to download a full definitions package for AV definitions from the management server or GUP %{p0}"); +var part169 = match("MESSAGE#693:SYLINK:01/0", "nwparser.payload", "The client opted to download a full definitions package for AV definitions from the management server or GUP %{p0}"); -var part170 = // "Pattern{Constant('because LiveUpdate had no AV updates available'), Field(p0,false)}" -match("MESSAGE#693:SYLINK:01/1_0", "nwparser.p0", "because LiveUpdate had no AV updates available%{p0}"); +var part170 = match("MESSAGE#693:SYLINK:01/1_0", "nwparser.p0", "because LiveUpdate had no AV updates available%{p0}"); -var part171 = // "Pattern{Constant('rather than download a large package from LiveUpdate'), Field(p0,false)}" -match("MESSAGE#693:SYLINK:01/1_1", "nwparser.p0", "rather than download a large package from LiveUpdate%{p0}"); +var part171 = match("MESSAGE#693:SYLINK:01/1_1", "nwparser.p0", "rather than download a large package from LiveUpdate%{p0}"); var select25 = linear_select([ part170, part171, ]); -var part172 = // "Pattern{Constant('.'), Field(p0,false)}" -match("MESSAGE#693:SYLINK:01/2", "nwparser.p0", ".%{p0}"); +var part172 = match("MESSAGE#693:SYLINK:01/2", "nwparser.p0", ".%{p0}"); var all71 = all_match({ processors: [ @@ -5084,8 +4722,7 @@ var all71 = all_match({ var msg139 = msg("SYLINK:01", all71); -var part173 = // "Pattern{Constant('The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the management server or GUP.'), Field(,false)}" -match("MESSAGE#694:SYLINK:02", "nwparser.payload", "The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the management server or GUP.%{}", processor_chain([ +var part173 = match("MESSAGE#694:SYLINK:02", "nwparser.payload", "The client opted to download an update for AV definitions from LiveUpdate rather than download a full definitions package from the management server or GUP.%{}", processor_chain([ dup43, dup15, setc("event_description","The client opted to download an update for AV definitions from LiveUpdate"), @@ -5093,8 +4730,7 @@ match("MESSAGE#694:SYLINK:02", "nwparser.payload", "The client opted to download var msg140 = msg("SYLINK:02", part173); -var part174 = // "Pattern{Constant('The client has obtained an invalid license file ('), Field(filename,false), Constant(') from the server.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#695:SYLINK:04", "nwparser.payload", "The client has obtained an invalid license file (%{filename}) from the server.,Event time:%{fld17->} %{fld18}", processor_chain([ +var part174 = match("MESSAGE#695:SYLINK:04", "nwparser.payload", "The client has obtained an invalid license file (%{filename}) from the server.,Event time:%{fld17->} %{fld18}", processor_chain([ dup121, dup12, dup13, @@ -5105,8 +4741,7 @@ match("MESSAGE#695:SYLINK:04", "nwparser.payload", "The client has obtained an i var msg141 = msg("SYLINK:04", part174); -var part175 = // "Pattern{Constant('The client has successfully downloaded a license file ('), Field(filename,false), Constant(') from the server.')}" -match("MESSAGE#697:Smc", "nwparser.payload", "The client has successfully downloaded a license file (%{filename}) from the server.", processor_chain([ +var part175 = match("MESSAGE#697:Smc", "nwparser.payload", "The client has successfully downloaded a license file (%{filename}) from the server.", processor_chain([ dup121, dup12, dup13, @@ -5117,8 +4752,7 @@ match("MESSAGE#697:Smc", "nwparser.payload", "The client has successfully downlo var msg142 = msg("Smc", part175); -var part176 = // "Pattern{Constant('The client has successfully downloaded and applied a license file ('), Field(filename,false), Constant(') from the server.'), Field(p0,false)}" -match("MESSAGE#698:Smc:01/0", "nwparser.payload", "The client has successfully downloaded and applied a license file (%{filename}) from the server.%{p0}"); +var part176 = match("MESSAGE#698:Smc:01/0", "nwparser.payload", "The client has successfully downloaded and applied a license file (%{filename}) from the server.%{p0}"); var all72 = all_match({ processors: [ @@ -5138,8 +4772,7 @@ var all72 = all_match({ var msg143 = msg("Smc:01", all72); -var part177 = // "Pattern{Constant('"The client has successfully downloaded and applied a license file ('), Field(filename,false), Constant(', Serial: '), Field(serial_number,false), Constant(') from the server."'), Field(p0,false)}" -match("MESSAGE#701:Smc:05/0", "nwparser.payload", "\"The client has successfully downloaded and applied a license file (%{filename}, Serial: %{serial_number}) from the server.\"%{p0}"); +var part177 = match("MESSAGE#701:Smc:05/0", "nwparser.payload", "\"The client has successfully downloaded and applied a license file (%{filename}, Serial: %{serial_number}) from the server.\"%{p0}"); var all73 = all_match({ processors: [ @@ -5203,19 +4836,16 @@ var all74 = all_match({ var msg145 = msg("Commercial", all74); -var part178 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Application name: '), Field(p0,false)}" -match("MESSAGE#71:Commercial:02/2_0", "nwparser.p0", "%{severity},First Seen: %{fld50},Application name: %{p0}"); +var part178 = match("MESSAGE#71:Commercial:02/2_0", "nwparser.p0", "%{severity},First Seen: %{fld50},Application name: %{p0}"); -var part179 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(p0,false)}" -match("MESSAGE#71:Commercial:02/2_1", "nwparser.p0", "%{severity},Application name: %{p0}"); +var part179 = match("MESSAGE#71:Commercial:02/2_1", "nwparser.p0", "%{severity},Application name: %{p0}"); var select27 = linear_select([ part178, part179, ]); -var part180 = // "Pattern{Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(',Detection Submissions No,Permitted application reason: '), Field(fld42,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#71:Commercial:02/3", "nwparser.p0", "%{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var part180 = match("MESSAGE#71:Commercial:02/3", "nwparser.p0", "%{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); var all75 = all_match({ processors: [ @@ -5242,8 +4872,7 @@ var all75 = all_match({ var msg146 = msg("Commercial:02", all75); -var part181 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',"Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#72:Commercial:01/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part181 = match("MESSAGE#72:Commercial:01/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all76 = all_match({ processors: [ @@ -5275,8 +4904,7 @@ var select28 = linear_select([ msg147, ]); -var part182 = // "Pattern{Constant('Computer has been deleted'), Field(,false)}" -match("MESSAGE#73:Computer:deleted", "nwparser.payload", "Computer has been deleted%{}", processor_chain([ +var part182 = match("MESSAGE#73:Computer:deleted", "nwparser.payload", "Computer has been deleted%{}", processor_chain([ dup156, dup12, dup13, @@ -5291,8 +4919,7 @@ match("MESSAGE#73:Computer:deleted", "nwparser.payload", "Computer has been dele var msg148 = msg("Computer:deleted", part182); -var part183 = // "Pattern{Constant('Computer has been moved'), Field(,false)}" -match("MESSAGE#74:Computer:moved", "nwparser.payload", "Computer has been moved%{}", processor_chain([ +var part183 = match("MESSAGE#74:Computer:moved", "nwparser.payload", "Computer has been moved%{}", processor_chain([ dup136, dup12, dup13, @@ -5307,8 +4934,7 @@ match("MESSAGE#74:Computer:moved", "nwparser.payload", "Computer has been moved% var msg149 = msg("Computer:moved", part183); -var part184 = // "Pattern{Constant('Computer properties have been changed'), Field(,false)}" -match("MESSAGE#75:Computer:propertieschanged", "nwparser.payload", "Computer properties have been changed%{}", processor_chain([ +var part184 = match("MESSAGE#75:Computer:propertieschanged", "nwparser.payload", "Computer properties have been changed%{}", processor_chain([ dup136, dup12, dup13, @@ -5323,19 +4949,16 @@ match("MESSAGE#75:Computer:propertieschanged", "nwparser.payload", "Computer pro var msg150 = msg("Computer:propertieschanged", part184); -var part185 = // "Pattern{Constant('"'), Field(filename,false), Constant('","'), Field(p0,false)}" -match("MESSAGE#76:Computer/1_0", "nwparser.p0", "\"%{filename}\",\"%{p0}"); +var part185 = match("MESSAGE#76:Computer/1_0", "nwparser.p0", "\"%{filename}\",\"%{p0}"); -var part186 = // "Pattern{Field(filename,false), Constant(',"'), Field(p0,false)}" -match("MESSAGE#76:Computer/1_1", "nwparser.p0", "%{filename},\"%{p0}"); +var part186 = match("MESSAGE#76:Computer/1_1", "nwparser.p0", "%{filename},\"%{p0}"); var select29 = linear_select([ part185, part186, ]); -var part187 = // "Pattern{Field(fld1,false), Constant('",Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" -match("MESSAGE#76:Computer/2", "nwparser.p0", "%{fld1}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); +var part187 = match("MESSAGE#76:Computer/2", "nwparser.p0", "%{fld1}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); var all77 = all_match({ processors: [ @@ -5355,19 +4978,16 @@ var all77 = all_match({ var msg151 = msg("Computer", all77); -var part188 = // "Pattern{Constant('"'), Field(filename,false), Constant('",''), Field(p0,false)}" -match("MESSAGE#77:Computer:01/1_0", "nwparser.p0", "\"%{filename}\",'%{p0}"); +var part188 = match("MESSAGE#77:Computer:01/1_0", "nwparser.p0", "\"%{filename}\",'%{p0}"); -var part189 = // "Pattern{Field(filename,false), Constant(',''), Field(p0,false)}" -match("MESSAGE#77:Computer:01/1_1", "nwparser.p0", "%{filename},'%{p0}"); +var part189 = match("MESSAGE#77:Computer:01/1_1", "nwparser.p0", "%{filename},'%{p0}"); var select30 = linear_select([ part188, part189, ]); -var part190 = // "Pattern{Field(fld1,false), Constant('',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" -match("MESSAGE#77:Computer:01/2", "nwparser.p0", "%{fld1}',Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); +var part190 = match("MESSAGE#77:Computer:01/2", "nwparser.p0", "%{fld1}',Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); var all78 = all_match({ processors: [ @@ -5387,11 +5007,9 @@ var all78 = all_match({ var msg152 = msg("Computer:01", all78); -var part191 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Intensive Protection Level: '), Field(fld55,false), Constant(',Certificate issuer: '), Field(cert_subject,false), Constant(',Certificate signer: '), Field(fld68,false), Constant(',Certificate thumbprint: '), Field(fld57,false), Constant(',Signing timestamp: '), Field(fld69,false), Constant(',Certificate serial number: '), Field(cert.serial,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#78:Computer:03/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Intensive Protection Level: %{fld55},Certificate issuer: %{cert_subject},Certificate signer: %{fld68},Certificate thumbprint: %{fld57},Signing timestamp: %{fld69},Certificate serial number: %{cert.serial},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); +var part191 = match("MESSAGE#78:Computer:03/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Intensive Protection Level: %{fld55},Certificate issuer: %{cert_subject},Certificate signer: %{fld68},Certificate thumbprint: %{fld57},Signing timestamp: %{fld69},Certificate serial number: %{cert.serial},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); -var part192 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld52,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(','), Field(fld67,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false), Constant(',Location:'), Field(fld65,false)}" -match("MESSAGE#78:Computer:03/2", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},%{fld67},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type},Location:%{fld65}"); +var part192 = match("MESSAGE#78:Computer:03/2", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld52},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},%{fld67},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type},Location:%{fld65}"); var all79 = all_match({ processors: [ @@ -5411,8 +5029,7 @@ var all79 = all_match({ var msg153 = msg("Computer:03", all79); -var part193 = // "Pattern{Constant('Computer name: '), Field(p0,false)}" -match("MESSAGE#79:Computer:02/0", "nwparser.payload", "Computer name: %{p0}"); +var part193 = match("MESSAGE#79:Computer:02/0", "nwparser.payload", "Computer name: %{p0}"); var all80 = all_match({ processors: [ @@ -5449,8 +5066,7 @@ var select31 = linear_select([ msg154, ]); -var part194 = // "Pattern{Constant('Configuration Change..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Description: '), Field(event_description,true), Constant(' ..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#80:Configuration", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{event_description->} ..Severity: %{severity}..Source: %{product}", processor_chain([ +var part194 = match("MESSAGE#80:Configuration", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{event_description->} ..Severity: %{severity}..Source: %{product}", processor_chain([ dup165, dup166, dup15, @@ -5458,8 +5074,7 @@ match("MESSAGE#80:Configuration", "nwparser.payload", "Configuration Change..Com var msg155 = msg("Configuration", part194); -var part195 = // "Pattern{Constant('Configuration Change..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('........'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..')}" -match("MESSAGE#81:Configuration:01", "nwparser.payload", "Configuration Change..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6->} %{fld7}..", processor_chain([ +var part195 = match("MESSAGE#81:Configuration:01", "nwparser.payload", "Configuration Change..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6->} %{fld7}..", processor_chain([ dup165, dup166, setc("event_description","Configuration Change"), @@ -5468,8 +5083,7 @@ match("MESSAGE#81:Configuration:01", "nwparser.payload", "Configuration Change.. var msg156 = msg("Configuration:01", part195); -var part196 = // "Pattern{Constant('Configuration Change..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#82:Configuration:02", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part196 = match("MESSAGE#82:Configuration:02", "nwparser.payload", "Configuration Change..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ dup165, dup166, dup15, @@ -5483,14 +5097,11 @@ var select32 = linear_select([ msg157, ]); -var part197 = // "Pattern{Constant('Connected to Symantec Endpoint Protection Manager '), Field(p0,false)}" -match("MESSAGE#83:Connected/0", "nwparser.payload", "Connected to Symantec Endpoint Protection Manager %{p0}"); +var part197 = match("MESSAGE#83:Connected/0", "nwparser.payload", "Connected to Symantec Endpoint Protection Manager %{p0}"); -var part198 = // "Pattern{Field(fld11,true), Constant(' ,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#83:Connected/1_0", "nwparser.p0", "%{fld11->} ,Event time: %{fld17->} %{fld18}"); +var part198 = match("MESSAGE#83:Connected/1_0", "nwparser.p0", "%{fld11->} ,Event time: %{fld17->} %{fld18}"); -var part199 = // "Pattern{Constant(''), Field(fld11,false)}" -match("MESSAGE#83:Connected/1_1", "nwparser.p0", "%{fld11}"); +var part199 = match("MESSAGE#83:Connected/1_1", "nwparser.p0", "%{fld11}"); var select33 = linear_select([ part198, @@ -5515,8 +5126,7 @@ var all81 = all_match({ var msg158 = msg("Connected", all81); -var part200 = // "Pattern{Constant('Connected to Management Server '), Field(hostip,false), Constant('.')}" -match("MESSAGE#686:Connected:01", "nwparser.payload", "Connected to Management Server %{hostip}.", processor_chain([ +var part200 = match("MESSAGE#686:Connected:01", "nwparser.payload", "Connected to Management Server %{hostip}.", processor_chain([ dup43, dup12, dup13, @@ -5532,8 +5142,7 @@ var select34 = linear_select([ msg159, ]); -var part201 = // "Pattern{Constant('Connection reset'), Field(,false)}" -match("MESSAGE#84:Connection", "nwparser.payload", "Connection reset%{}", processor_chain([ +var part201 = match("MESSAGE#84:Connection", "nwparser.payload", "Connection reset%{}", processor_chain([ dup43, dup12, dup13, @@ -5544,8 +5153,7 @@ match("MESSAGE#84:Connection", "nwparser.payload", "Connection reset%{}", proces var msg160 = msg("Connection", part201); -var part202 = // "Pattern{Constant('Could '), Field(space,false), Constant('not start Service Engine err='), Field(resultcode,false)}" -match("MESSAGE#85:Could", "nwparser.payload", "Could %{space}not start Service Engine err=%{resultcode}", processor_chain([ +var part202 = match("MESSAGE#85:Could", "nwparser.payload", "Could %{space}not start Service Engine err=%{resultcode}", processor_chain([ dup86, dup12, dup13, @@ -5556,8 +5164,7 @@ match("MESSAGE#85:Could", "nwparser.payload", "Could %{space}not start Service E var msg161 = msg("Could", part202); -var part203 = // "Pattern{Constant('Could not scan '), Field(dclass_counter1,true), Constant(' files inside '), Field(directory,true), Constant(' due to extraction errors encountered by the Decomposer Engines.')}" -match("MESSAGE#86:Could:01", "nwparser.payload", "Could not scan %{dclass_counter1->} files inside %{directory->} due to extraction errors encountered by the Decomposer Engines.", processor_chain([ +var part203 = match("MESSAGE#86:Could:01", "nwparser.payload", "Could not scan %{dclass_counter1->} files inside %{directory->} due to extraction errors encountered by the Decomposer Engines.", processor_chain([ dup86, dup12, dup13, @@ -5574,8 +5181,7 @@ var select35 = linear_select([ msg162, ]); -var part204 = // "Pattern{Constant('Create trident engine failed.'), Field(,false)}" -match("MESSAGE#87:Create", "nwparser.payload", "Create trident engine failed.%{}", processor_chain([ +var part204 = match("MESSAGE#87:Create", "nwparser.payload", "Create trident engine failed.%{}", processor_chain([ dup168, dup12, dup13, @@ -5586,8 +5192,7 @@ match("MESSAGE#87:Create", "nwparser.payload", "Create trident engine failed.%{} var msg163 = msg("Create", part204); -var part205 = // "Pattern{Constant('Database Maintenance Finished Successfully'), Field(,false)}" -match("MESSAGE#88:Database", "nwparser.payload", "Database Maintenance Finished Successfully%{}", processor_chain([ +var part205 = match("MESSAGE#88:Database", "nwparser.payload", "Database Maintenance Finished Successfully%{}", processor_chain([ dup43, dup12, dup13, @@ -5598,8 +5203,7 @@ match("MESSAGE#88:Database", "nwparser.payload", "Database Maintenance Finished var msg164 = msg("Database", part205); -var part206 = // "Pattern{Constant('Database maintenance started.'), Field(,false)}" -match("MESSAGE#89:Database:01", "nwparser.payload", "Database maintenance started.%{}", processor_chain([ +var part206 = match("MESSAGE#89:Database:01", "nwparser.payload", "Database maintenance started.%{}", processor_chain([ dup43, dup15, setc("event_description","Database maintenance started."), @@ -5607,8 +5211,7 @@ match("MESSAGE#89:Database:01", "nwparser.payload", "Database maintenance starte var msg165 = msg("Database:01", part206); -var part207 = // "Pattern{Constant('Database maintenance finished successfully.'), Field(,false)}" -match("MESSAGE#90:Database:02", "nwparser.payload", "Database maintenance finished successfully.%{}", processor_chain([ +var part207 = match("MESSAGE#90:Database:02", "nwparser.payload", "Database maintenance finished successfully.%{}", processor_chain([ dup43, dup15, setc("event_description","Database maintenance finished successfully."), @@ -5616,8 +5219,7 @@ match("MESSAGE#90:Database:02", "nwparser.payload", "Database maintenance finish var msg166 = msg("Database:02", part207); -var part208 = // "Pattern{Constant('Database properties are changed'), Field(,false)}" -match("MESSAGE#91:Database:03", "nwparser.payload", "Database properties are changed%{}", processor_chain([ +var part208 = match("MESSAGE#91:Database:03", "nwparser.payload", "Database properties are changed%{}", processor_chain([ dup43, dup15, setc("event_description","Database properties are changed"), @@ -5632,8 +5234,7 @@ var select36 = linear_select([ msg167, ]); -var part209 = // "Pattern{Constant('Disconnected from Symantec Endpoint Protection Manager. --- server address : '), Field(hostid,false)}" -match("MESSAGE#92:Disconnected", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager. --- server address : %{hostid}", processor_chain([ +var part209 = match("MESSAGE#92:Disconnected", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager. --- server address : %{hostid}", processor_chain([ dup43, dup12, dup13, @@ -5644,8 +5245,7 @@ match("MESSAGE#92:Disconnected", "nwparser.payload", "Disconnected from Symantec var msg168 = msg("Disconnected", part209); -var part210 = // "Pattern{Constant('Disconnected from Symantec Endpoint Protection Manager ('), Field(hostip,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#93:Disconnected:01/0", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager (%{hostip})%{p0}"); +var part210 = match("MESSAGE#93:Disconnected:01/0", "nwparser.payload", "Disconnected from Symantec Endpoint Protection Manager (%{hostip})%{p0}"); var all82 = all_match({ processors: [ @@ -5667,8 +5267,7 @@ var all82 = all_match({ var msg169 = msg("Disconnected:01", all82); -var part211 = // "Pattern{Constant('Disconnected to Management Server '), Field(hostip,false), Constant('.')}" -match("MESSAGE#687:Disconnected:02", "nwparser.payload", "Disconnected to Management Server %{hostip}.", processor_chain([ +var part211 = match("MESSAGE#687:Disconnected:02", "nwparser.payload", "Disconnected to Management Server %{hostip}.", processor_chain([ dup43, dup12, dup13, @@ -5685,8 +5284,7 @@ var select37 = linear_select([ msg170, ]); -var part212 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#94:Decomposer", "nwparser.payload", "event_description", processor_chain([ +var part212 = match_copy("MESSAGE#94:Decomposer", "nwparser.payload", "event_description", processor_chain([ dup92, dup12, dup13, @@ -5696,8 +5294,7 @@ match_copy("MESSAGE#94:Decomposer", "nwparser.payload", "event_description", pro var msg171 = msg("Decomposer", part212); -var part213 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was added')}" -match("MESSAGE#95:Domain:added", "nwparser.payload", "Domain \"%{domain}\" was added", processor_chain([ +var part213 = match("MESSAGE#95:Domain:added", "nwparser.payload", "Domain \"%{domain}\" was added", processor_chain([ dup95, dup12, dup13, @@ -5712,8 +5309,7 @@ match("MESSAGE#95:Domain:added", "nwparser.payload", "Domain \"%{domain}\" was a var msg172 = msg("Domain:added", part213); -var part214 = // "Pattern{Constant('Domain "'), Field(change_old,false), Constant('" was renamed to "'), Field(change_new,false), Constant('"')}" -match("MESSAGE#96:Domain:renamed", "nwparser.payload", "Domain \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ +var part214 = match("MESSAGE#96:Domain:renamed", "nwparser.payload", "Domain \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ dup136, dup12, dup13, @@ -5729,8 +5325,7 @@ match("MESSAGE#96:Domain:renamed", "nwparser.payload", "Domain \"%{change_old}\" var msg173 = msg("Domain:renamed", part214); -var part215 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was deleted!')}" -match("MESSAGE#97:Domain:deleted", "nwparser.payload", "Domain \"%{domain}\" was deleted!", processor_chain([ +var part215 = match("MESSAGE#97:Domain:deleted", "nwparser.payload", "Domain \"%{domain}\" was deleted!", processor_chain([ dup156, dup12, dup13, @@ -5745,8 +5340,7 @@ match("MESSAGE#97:Domain:deleted", "nwparser.payload", "Domain \"%{domain}\" was var msg174 = msg("Domain:deleted", part215); -var part216 = // "Pattern{Constant('Domain administrator "'), Field(username,false), Constant('" was added')}" -match("MESSAGE#98:Domain:administratoradded", "nwparser.payload", "Domain administrator \"%{username}\" was added", processor_chain([ +var part216 = match("MESSAGE#98:Domain:administratoradded", "nwparser.payload", "Domain administrator \"%{username}\" was added", processor_chain([ dup170, dup12, dup13, @@ -5762,8 +5356,7 @@ match("MESSAGE#98:Domain:administratoradded", "nwparser.payload", "Domain admini var msg175 = msg("Domain:administratoradded", part216); -var part217 = // "Pattern{Constant('Domain administrator "'), Field(username,false), Constant('" was deleted')}" -match("MESSAGE#99:Domain:administratordeleted", "nwparser.payload", "Domain administrator \"%{username}\" was deleted", processor_chain([ +var part217 = match("MESSAGE#99:Domain:administratordeleted", "nwparser.payload", "Domain administrator \"%{username}\" was deleted", processor_chain([ dup171, dup12, dup13, @@ -5779,8 +5372,7 @@ match("MESSAGE#99:Domain:administratordeleted", "nwparser.payload", "Domain admi var msg176 = msg("Domain:administratordeleted", part217); -var part218 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was disabled')}" -match("MESSAGE#100:Domain:disabled", "nwparser.payload", "Domain \"%{domain}\" was disabled", processor_chain([ +var part218 = match("MESSAGE#100:Domain:disabled", "nwparser.payload", "Domain \"%{domain}\" was disabled", processor_chain([ dup136, dup12, dup13, @@ -5795,8 +5387,7 @@ match("MESSAGE#100:Domain:disabled", "nwparser.payload", "Domain \"%{domain}\" w var msg177 = msg("Domain:disabled", part218); -var part219 = // "Pattern{Constant('Domain "'), Field(domain,false), Constant('" was enabled')}" -match("MESSAGE#101:Domain:enabled", "nwparser.payload", "Domain \"%{domain}\" was enabled", processor_chain([ +var part219 = match("MESSAGE#101:Domain:enabled", "nwparser.payload", "Domain \"%{domain}\" was enabled", processor_chain([ dup136, dup12, dup13, @@ -5821,8 +5412,7 @@ var select38 = linear_select([ msg178, ]); -var part220 = // "Pattern{Constant('Failed to connect to the server. '), Field(action,false), Constant('. ErrorCode: '), Field(resultcode,false)}" -match("MESSAGE#102:Failed", "nwparser.payload", "Failed to connect to the server. %{action}. ErrorCode: %{resultcode}", processor_chain([ +var part220 = match("MESSAGE#102:Failed", "nwparser.payload", "Failed to connect to the server. %{action}. ErrorCode: %{resultcode}", processor_chain([ dup168, dup12, dup13, @@ -5833,14 +5423,11 @@ match("MESSAGE#102:Failed", "nwparser.payload", "Failed to connect to the server var msg179 = msg("Failed", part220); -var part221 = // "Pattern{Constant('Failed to contact server for more than '), Field(p0,false)}" -match("MESSAGE#103:Failed:01/0", "nwparser.payload", "Failed to contact server for more than %{p0}"); +var part221 = match("MESSAGE#103:Failed:01/0", "nwparser.payload", "Failed to contact server for more than %{p0}"); -var part222 = // "Pattern{Constant(''), Field(fld1,true), Constant(' times.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#103:Failed:01/1_0", "nwparser.p0", "%{fld1->} times.,Event time:%{fld17->} %{fld18}"); +var part222 = match("MESSAGE#103:Failed:01/1_0", "nwparser.p0", "%{fld1->} times.,Event time:%{fld17->} %{fld18}"); -var part223 = // "Pattern{Field(fld1,true), Constant(' times.')}" -match("MESSAGE#103:Failed:01/1_1", "nwparser.p0", "%{fld1->} times."); +var part223 = match("MESSAGE#103:Failed:01/1_1", "nwparser.p0", "%{fld1->} times."); var select39 = linear_select([ part222, @@ -5865,8 +5452,7 @@ var all83 = all_match({ var msg180 = msg("Failed:01", all83); -var part224 = // "Pattern{Constant('Failed to disable Windows firewall'), Field(,false)}" -match("MESSAGE#104:Failed:02", "nwparser.payload", "Failed to disable Windows firewall%{}", processor_chain([ +var part224 = match("MESSAGE#104:Failed:02", "nwparser.payload", "Failed to disable Windows firewall%{}", processor_chain([ dup168, dup12, dup13, @@ -5877,8 +5463,7 @@ match("MESSAGE#104:Failed:02", "nwparser.payload", "Failed to disable Windows fi var msg181 = msg("Failed:02", part224); -var part225 = // "Pattern{Constant('Failed to install teefer driver'), Field(,false)}" -match("MESSAGE#105:Failed:03", "nwparser.payload", "Failed to install teefer driver%{}", processor_chain([ +var part225 = match("MESSAGE#105:Failed:03", "nwparser.payload", "Failed to install teefer driver%{}", processor_chain([ dup168, dup12, dup13, @@ -5889,8 +5474,7 @@ match("MESSAGE#105:Failed:03", "nwparser.payload", "Failed to install teefer dri var msg182 = msg("Failed:03", part225); -var part226 = // "Pattern{Constant('Failed to connect to '), Field(fld22,false), Constant('. Make sure the server can ping or resolve this domain. ErrorCode: '), Field(resultcode,false)}" -match("MESSAGE#106:Failed:04", "nwparser.payload", "Failed to connect to %{fld22}. Make sure the server can ping or resolve this domain. ErrorCode: %{resultcode}", processor_chain([ +var part226 = match("MESSAGE#106:Failed:04", "nwparser.payload", "Failed to connect to %{fld22}. Make sure the server can ping or resolve this domain. ErrorCode: %{resultcode}", processor_chain([ dup168, dup14, dup15, @@ -5899,8 +5483,7 @@ match("MESSAGE#106:Failed:04", "nwparser.payload", "Failed to connect to %{fld22 var msg183 = msg("Failed:04", part226); -var part227 = // "Pattern{Constant('Failed to download new client upgrade package from the management server. New Version: '), Field(version,true), Constant(' Package size: '), Field(filename_size,true), Constant(' bytes. Package url: '), Field(url,false)}" -match("MESSAGE#107:Failed:05", "nwparser.payload", "Failed to download new client upgrade package from the management server. New Version: %{version->} Package size: %{filename_size->} bytes. Package url: %{url}", processor_chain([ +var part227 = match("MESSAGE#107:Failed:05", "nwparser.payload", "Failed to download new client upgrade package from the management server. New Version: %{version->} Package size: %{filename_size->} bytes. Package url: %{url}", processor_chain([ dup168, dup12, dup13, @@ -5914,8 +5497,7 @@ match("MESSAGE#107:Failed:05", "nwparser.payload", "Failed to download new clien var msg184 = msg("Failed:05", part227); -var part228 = // "Pattern{Constant('Failed to import server policy.'), Field(,false)}" -match("MESSAGE#108:Failed:06", "nwparser.payload", "Failed to import server policy.%{}", processor_chain([ +var part228 = match("MESSAGE#108:Failed:06", "nwparser.payload", "Failed to import server policy.%{}", processor_chain([ dup168, dup12, dup13, @@ -5928,8 +5510,7 @@ match("MESSAGE#108:Failed:06", "nwparser.payload", "Failed to import server poli var msg185 = msg("Failed:06", part228); -var part229 = // "Pattern{Constant('Failed to load plugin:'), Field(filename,false)}" -match("MESSAGE#109:Failed:07", "nwparser.payload", "Failed to load plugin:%{filename}", processor_chain([ +var part229 = match("MESSAGE#109:Failed:07", "nwparser.payload", "Failed to load plugin:%{filename}", processor_chain([ dup168, dup12, dup13, @@ -5942,8 +5523,7 @@ match("MESSAGE#109:Failed:07", "nwparser.payload", "Failed to load plugin:%{file var msg186 = msg("Failed:07", part229); -var part230 = // "Pattern{Constant('Failed to clean up LiveUpdate downloaded content'), Field(,false)}" -match("MESSAGE#110:Failed:08", "nwparser.payload", "Failed to clean up LiveUpdate downloaded content%{}", processor_chain([ +var part230 = match("MESSAGE#110:Failed:08", "nwparser.payload", "Failed to clean up LiveUpdate downloaded content%{}", processor_chain([ dup168, dup12, dup13, @@ -5956,8 +5536,7 @@ match("MESSAGE#110:Failed:08", "nwparser.payload", "Failed to clean up LiveUpdat var msg187 = msg("Failed:08", part230); -var part231 = // "Pattern{Constant('Failed to Login to Remote Site ['), Field(node,false), Constant('] Failed to connect to the server. Make sure that the server is running and your session has not timed out. If you can reach the server but cannot log on, make sure that you provided the correct parameters. If you are experiencing network issues, contact your system administrator.')}" -match("MESSAGE#111:Failed:09", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Failed to connect to the server. Make sure that the server is running and your session has not timed out. If you can reach the server but cannot log on, make sure that you provided the correct parameters. If you are experiencing network issues, contact your system administrator.", processor_chain([ +var part231 = match("MESSAGE#111:Failed:09", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Failed to connect to the server. Make sure that the server is running and your session has not timed out. If you can reach the server but cannot log on, make sure that you provided the correct parameters. If you are experiencing network issues, contact your system administrator.", processor_chain([ dup174, dup12, dup13, @@ -5970,8 +5549,7 @@ match("MESSAGE#111:Failed:09", "nwparser.payload", "Failed to Login to Remote Si var msg188 = msg("Failed:09", part231); -var part232 = // "Pattern{Constant('Failed to Login to Remote Site ['), Field(node,false), Constant('] Replication partnership has been deleted from remote site.')}" -match("MESSAGE#112:Failed:10", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Replication partnership has been deleted from remote site.", processor_chain([ +var part232 = match("MESSAGE#112:Failed:10", "nwparser.payload", "Failed to Login to Remote Site [%{node}] Replication partnership has been deleted from remote site.", processor_chain([ dup174, dup12, dup13, @@ -5984,8 +5562,7 @@ match("MESSAGE#112:Failed:10", "nwparser.payload", "Failed to Login to Remote Si var msg189 = msg("Failed:10", part232); -var part233 = // "Pattern{Constant('Failed to import new policy.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#113:Failed:11", "nwparser.payload", "Failed to import new policy.,Event time: %{event_time_string}", processor_chain([ +var part233 = match("MESSAGE#113:Failed:11", "nwparser.payload", "Failed to import new policy.,Event time: %{event_time_string}", processor_chain([ setc("eventcategory","1601000000"), dup12, dup13, @@ -5995,8 +5572,7 @@ match("MESSAGE#113:Failed:11", "nwparser.payload", "Failed to import new policy. var msg190 = msg("Failed:11", part233); -var part234 = // "Pattern{Constant('Failed to set a custom action for IPS signature '), Field(sigid,true), Constant(' (errcode=0x'), Field(resultcode,false), Constant('). Most probably, this IPS signature was removed from the IPS content.'), Field(p0,false)}" -match("MESSAGE#250:Network:24/0", "nwparser.payload", "Failed to set a custom action for IPS signature %{sigid->} (errcode=0x%{resultcode}). Most probably, this IPS signature was removed from the IPS content.%{p0}"); +var part234 = match("MESSAGE#250:Network:24/0", "nwparser.payload", "Failed to set a custom action for IPS signature %{sigid->} (errcode=0x%{resultcode}). Most probably, this IPS signature was removed from the IPS content.%{p0}"); var select40 = linear_select([ dup176, @@ -6020,8 +5596,7 @@ var all84 = all_match({ var msg191 = msg("Network:24", all84); -var part235 = // "Pattern{Constant('Failed to connect to all GUPs, now trying to connect SEPM"'), Field(,false)}" -match("MESSAGE#696:SYLINK:03", "nwparser.payload", "Failed to connect to all GUPs, now trying to connect SEPM\"%{}", processor_chain([ +var part235 = match("MESSAGE#696:SYLINK:03", "nwparser.payload", "Failed to connect to all GUPs, now trying to connect SEPM\"%{}", processor_chain([ dup74, dup12, dup13, @@ -6049,8 +5624,7 @@ var select41 = linear_select([ msg192, ]); -var part236 = // "Pattern{Constant('Firewall driver failed to '), Field(info,false)}" -match("MESSAGE#114:Firewall", "nwparser.payload", "Firewall driver failed to %{info}", processor_chain([ +var part236 = match("MESSAGE#114:Firewall", "nwparser.payload", "Firewall driver failed to %{info}", processor_chain([ dup168, dup12, dup13, @@ -6061,8 +5635,7 @@ match("MESSAGE#114:Firewall", "nwparser.payload", "Firewall driver failed to %{i var msg193 = msg("Firewall", part236); -var part237 = // "Pattern{Constant('Firewall is enabled,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#115:Firewall:01", "nwparser.payload", "Firewall is enabled,Event time: %{event_time_string}", processor_chain([ +var part237 = match("MESSAGE#115:Firewall:01", "nwparser.payload", "Firewall is enabled,Event time: %{event_time_string}", processor_chain([ dup168, dup12, dup13, @@ -6073,8 +5646,7 @@ match("MESSAGE#115:Firewall:01", "nwparser.payload", "Firewall is enabled,Event var msg194 = msg("Firewall:01", part237); -var part238 = // "Pattern{Constant('Firewall is disabled by policy,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#116:Firewall:02", "nwparser.payload", "Firewall is disabled by policy,Event time: %{event_time_string}", processor_chain([ +var part238 = match("MESSAGE#116:Firewall:02", "nwparser.payload", "Firewall is disabled by policy,Event time: %{event_time_string}", processor_chain([ dup53, dup12, dup13, @@ -6085,8 +5657,7 @@ match("MESSAGE#116:Firewall:02", "nwparser.payload", "Firewall is disabled by po var msg195 = msg("Firewall:02", part238); -var part239 = // "Pattern{Constant('Firewall is disabled,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#117:Firewall:03", "nwparser.payload", "Firewall is disabled,Event time: %{event_time_string}", processor_chain([ +var part239 = match("MESSAGE#117:Firewall:03", "nwparser.payload", "Firewall is disabled,Event time: %{event_time_string}", processor_chain([ dup53, dup12, dup13, @@ -6104,8 +5675,7 @@ var select42 = linear_select([ msg196, ]); -var part240 = // "Pattern{Constant('Group has been created'), Field(,false)}" -match("MESSAGE#118:Group:created", "nwparser.payload", "Group has been created%{}", processor_chain([ +var part240 = match("MESSAGE#118:Group:created", "nwparser.payload", "Group has been created%{}", processor_chain([ dup95, dup12, dup13, @@ -6121,8 +5691,7 @@ match("MESSAGE#118:Group:created", "nwparser.payload", "Group has been created%{ var msg197 = msg("Group:created", part240); -var part241 = // "Pattern{Constant('Group has been deleted'), Field(,false)}" -match("MESSAGE#119:Group:deleted", "nwparser.payload", "Group has been deleted%{}", processor_chain([ +var part241 = match("MESSAGE#119:Group:deleted", "nwparser.payload", "Group has been deleted%{}", processor_chain([ dup156, dup12, dup13, @@ -6138,8 +5707,7 @@ match("MESSAGE#119:Group:deleted", "nwparser.payload", "Group has been deleted%{ var msg198 = msg("Group:deleted", part241); -var part242 = // "Pattern{Constant('Group ''), Field(group,false), Constant('' was deleted')}" -match("MESSAGE#120:Group:deleted_01", "nwparser.payload", "Group '%{group}' was deleted", processor_chain([ +var part242 = match("MESSAGE#120:Group:deleted_01", "nwparser.payload", "Group '%{group}' was deleted", processor_chain([ dup156, dup12, dup13, @@ -6155,8 +5723,7 @@ match("MESSAGE#120:Group:deleted_01", "nwparser.payload", "Group '%{group}' was var msg199 = msg("Group:deleted_01", part242); -var part243 = // "Pattern{Constant('Group has been moved'), Field(,false)}" -match("MESSAGE#121:Group:moved", "nwparser.payload", "Group has been moved%{}", processor_chain([ +var part243 = match("MESSAGE#121:Group:moved", "nwparser.payload", "Group has been moved%{}", processor_chain([ dup136, dup12, dup13, @@ -6172,8 +5739,7 @@ match("MESSAGE#121:Group:moved", "nwparser.payload", "Group has been moved%{}", var msg200 = msg("Group:moved", part243); -var part244 = // "Pattern{Constant('Group has been renamed'), Field(,false)}" -match("MESSAGE#122:Group:renamed", "nwparser.payload", "Group has been renamed%{}", processor_chain([ +var part244 = match("MESSAGE#122:Group:renamed", "nwparser.payload", "Group has been renamed%{}", processor_chain([ dup136, dup12, dup13, @@ -6189,8 +5755,7 @@ match("MESSAGE#122:Group:renamed", "nwparser.payload", "Group has been renamed%{ var msg201 = msg("Group:renamed", part244); -var part245 = // "Pattern{Constant('Group ''), Field(group,false), Constant('' was added')}" -match("MESSAGE#123:Group:added", "nwparser.payload", "Group '%{group}' was added", processor_chain([ +var part245 = match("MESSAGE#123:Group:added", "nwparser.payload", "Group '%{group}' was added", processor_chain([ dup95, dup12, dup13, @@ -6215,8 +5780,7 @@ var select43 = linear_select([ msg202, ]); -var part246 = // "Pattern{Constant('Host Integrity check is disabled. '), Field(info,true), Constant(' by the '), Field(username,false)}" -match("MESSAGE#124:Host", "nwparser.payload", "Host Integrity check is disabled. %{info->} by the %{username}", processor_chain([ +var part246 = match("MESSAGE#124:Host", "nwparser.payload", "Host Integrity check is disabled. %{info->} by the %{username}", processor_chain([ dup179, dup12, dup13, @@ -6230,8 +5794,7 @@ match("MESSAGE#124:Host", "nwparser.payload", "Host Integrity check is disabled. var msg203 = msg("Host", part246); -var part247 = // "Pattern{Field(info,true), Constant(' up-to-date')}" -match("MESSAGE#125:Host:01", "nwparser.payload", "%{info->} up-to-date", processor_chain([ +var part247 = match("MESSAGE#125:Host:01", "nwparser.payload", "%{info->} up-to-date", processor_chain([ dup92, dup12, dup13, @@ -6242,8 +5805,7 @@ match("MESSAGE#125:Host:01", "nwparser.payload", "%{info->} up-to-date", process var msg204 = msg("Host:01", part247); -var part248 = // "Pattern{Constant('Host Integrity check failed Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" failed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" passed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#126:Host:02", "nwparser.payload", "Host Integrity check failed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" failed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ +var part248 = match("MESSAGE#126:Host:02", "nwparser.payload", "Host Integrity check failed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" failed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ dup179, dup12, dup13, @@ -6255,8 +5817,7 @@ match("MESSAGE#126:Host:02", "nwparser.payload", "Host Integrity check failed Re var msg205 = msg("Host:02", part248); -var part249 = // "Pattern{Constant('Host Integrity failed but reported as pass Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" passed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" failed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#127:Host:05", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" failed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part249 = match("MESSAGE#127:Host:05", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" failed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup12, dup13, @@ -6268,8 +5829,7 @@ match("MESSAGE#127:Host:05", "nwparser.payload", "Host Integrity failed but repo var msg206 = msg("Host:05", part249); -var part250 = // "Pattern{Constant('Host Integrity failed but reported as pass Requirement: "'), Field(fld11,false), Constant('" '), Field(fld18,true), Constant(' Requirement: "'), Field(fld12,false), Constant('" '), Field(fld17,true), Constant(' Requirement: "'), Field(fld13,false), Constant('" '), Field(fld16,true), Constant(' Requirement: "'), Field(fld14,false), Constant('" '), Field(fld15,true), Constant(' '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#128:Host:06", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" %{fld18->} Requirement: \"%{fld12}\" %{fld17->} Requirement: \"%{fld13}\" %{fld16->} Requirement: \"%{fld14}\" %{fld15->} %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part250 = match("MESSAGE#128:Host:06", "nwparser.payload", "Host Integrity failed but reported as pass Requirement: \"%{fld11}\" %{fld18->} Requirement: \"%{fld12}\" %{fld17->} Requirement: \"%{fld13}\" %{fld16->} Requirement: \"%{fld14}\" %{fld15->} %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup12, dup13, @@ -6281,8 +5841,7 @@ match("MESSAGE#128:Host:06", "nwparser.payload", "Host Integrity failed but repo var msg207 = msg("Host:06", part250); -var part251 = // "Pattern{Constant('Host Integrity check failed '), Field(result,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#129:Host:04", "nwparser.payload", "Host Integrity check failed %{result},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part251 = match("MESSAGE#129:Host:04", "nwparser.payload", "Host Integrity check failed %{result},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup12, dup13, @@ -6294,8 +5853,7 @@ match("MESSAGE#129:Host:04", "nwparser.payload", "Host Integrity check failed %{ var msg208 = msg("Host:04", part251); -var part252 = // "Pattern{Constant('Host Integrity check passed Requirement: "'), Field(fld11,false), Constant('" passed Requirement: "'), Field(fld12,false), Constant('" passed Requirement: "'), Field(fld13,false), Constant('" passed Requirement: "'), Field(fld14,false), Constant('" passed '), Field(fld44,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#130:Host:03", "nwparser.payload", "Host Integrity check passed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part252 = match("MESSAGE#130:Host:03", "nwparser.payload", "Host Integrity check passed Requirement: \"%{fld11}\" passed Requirement: \"%{fld12}\" passed Requirement: \"%{fld13}\" passed Requirement: \"%{fld14}\" passed %{fld44},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup12, dup13, @@ -6307,8 +5865,7 @@ match("MESSAGE#130:Host:03", "nwparser.payload", "Host Integrity check passed Re var msg209 = msg("Host:03", part252); -var part253 = // "Pattern{Constant('Host Integrity check passed'), Field(space,false), Constant('Requirement: ''), Field(fld11,false), Constant('' passed '), Field(fld12,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#132:Host:07", "nwparser.payload", "Host Integrity check passed%{space}Requirement: '%{fld11}' passed %{fld12},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part253 = match("MESSAGE#132:Host:07", "nwparser.payload", "Host Integrity check passed%{space}Requirement: '%{fld11}' passed %{fld12},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup87, dup12, @@ -6321,19 +5878,16 @@ match("MESSAGE#132:Host:07", "nwparser.payload", "Host Integrity check passed%{s var msg210 = msg("Host:07", part253); -var part254 = // "Pattern{Field(shost,false), Constant(', Host Integrity check passed '), Field(p0,false)}" -match("MESSAGE#133:Host:08/0_0", "nwparser.payload", "%{shost}, Host Integrity check passed %{p0}"); +var part254 = match("MESSAGE#133:Host:08/0_0", "nwparser.payload", "%{shost}, Host Integrity check passed %{p0}"); -var part255 = // "Pattern{Constant('Host Integrity check passed'), Field(p0,false)}" -match("MESSAGE#133:Host:08/0_1", "nwparser.payload", "Host Integrity check passed%{p0}"); +var part255 = match("MESSAGE#133:Host:08/0_1", "nwparser.payload", "Host Integrity check passed%{p0}"); var select44 = linear_select([ part254, part255, ]); -var part256 = // "Pattern{Field(,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#133:Host:08/1", "nwparser.p0", "%{},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); +var part256 = match("MESSAGE#133:Host:08/1", "nwparser.p0", "%{},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); var all85 = all_match({ processors: [ @@ -6355,16 +5909,14 @@ var all85 = all_match({ var msg211 = msg("Host:08", all85); -var part257 = // "Pattern{Field(shost,false), Constant(', Host Integrity check pass.'), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" -match("MESSAGE#134:Host:09/0", "nwparser.payload", "%{shost}, Host Integrity check pass.%{info},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); +var part257 = match("MESSAGE#134:Host:09/0", "nwparser.payload", "%{shost}, Host Integrity check pass.%{info},Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); var select45 = linear_select([ dup67, dup182, ]); -var part258 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#134:Host:09/2", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); +var part258 = match("MESSAGE#134:Host:09/2", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}"); var all86 = all_match({ processors: [ @@ -6385,8 +5937,7 @@ var all86 = all_match({ var msg212 = msg("Host:09", all86); -var part259 = // "Pattern{Constant('Host Integrity check is disabled. Only do Host Integrity checking when connected to the Symantec Endpoint Protection Manager is checked.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#702:Smc:06", "nwparser.payload", "Host Integrity check is disabled. Only do Host Integrity checking when connected to the Symantec Endpoint Protection Manager is checked.,Event time: %{fld17->} %{fld18}", processor_chain([ +var part259 = match("MESSAGE#702:Smc:06", "nwparser.payload", "Host Integrity check is disabled. Only do Host Integrity checking when connected to the Symantec Endpoint Protection Manager is checked.,Event time: %{fld17->} %{fld18}", processor_chain([ dup53, dup12, dup13, @@ -6412,8 +5963,7 @@ var select46 = linear_select([ msg213, ]); -var part260 = // "Pattern{Field(fld31,true), Constant(' ??????????????? ??: "'), Field(fld11,false), Constant('"?? ??: "'), Field(fld12,false), Constant('"?? ??: "'), Field(fld13,false), Constant('"?? ??: "'), Field(fld14,false), Constant('"??,??????????? ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#131:??:", "nwparser.payload", "%{fld31->} ??????????????? ??: \"%{fld11}\"?? ??: \"%{fld12}\"?? ??: \"%{fld13}\"?? ??: \"%{fld14}\"??,??????????? ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ +var part260 = match("MESSAGE#131:??:", "nwparser.payload", "%{fld31->} ??????????????? ??: \"%{fld11}\"?? ??: \"%{fld12}\"?? ??: \"%{fld13}\"?? ??: \"%{fld14}\"??,??????????? ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld25}", processor_chain([ dup179, dup12, dup13, @@ -6423,19 +5973,16 @@ match("MESSAGE#131:??:", "nwparser.payload", "%{fld31->} ??????????????? ??: \"% var msg214 = msg("??:", part260); -var part261 = // "Pattern{Field(info,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#135:Intrusion/0", "nwparser.payload", "%{info->} %{p0}"); +var part261 = match("MESSAGE#135:Intrusion/0", "nwparser.payload", "%{info->} %{p0}"); -var part262 = // "Pattern{Constant('was '), Field(p0,false)}" -match("MESSAGE#135:Intrusion/1_1", "nwparser.p0", "was %{p0}"); +var part262 = match("MESSAGE#135:Intrusion/1_1", "nwparser.p0", "was %{p0}"); var select47 = linear_select([ dup183, part262, ]); -var part263 = // "Pattern{Constant(''), Field(action,false)}" -match("MESSAGE#135:Intrusion/2", "nwparser.p0", "%{action}"); +var part263 = match("MESSAGE#135:Intrusion/2", "nwparser.p0", "%{action}"); var all87 = all_match({ processors: [ @@ -6455,8 +6002,7 @@ var all87 = all_match({ var msg215 = msg("Intrusion", all87); -var part264 = // "Pattern{Field(info,true), Constant(' failed to update')}" -match("MESSAGE#136:Intrusion:01", "nwparser.payload", "%{info->} failed to update", processor_chain([ +var part264 = match("MESSAGE#136:Intrusion:01", "nwparser.payload", "%{info->} failed to update", processor_chain([ dup92, dup12, dup13, @@ -6472,8 +6018,7 @@ var select48 = linear_select([ msg216, ]); -var part265 = // "Pattern{Constant('Invalid log record:'), Field(info,false)}" -match("MESSAGE#137:Invalid", "nwparser.payload", "Invalid log record:%{info}", processor_chain([ +var part265 = match("MESSAGE#137:Invalid", "nwparser.payload", "Invalid log record:%{info}", processor_chain([ dup168, dup12, dup13, @@ -6484,8 +6029,7 @@ match("MESSAGE#137:Invalid", "nwparser.payload", "Invalid log record:%{info}", p var msg217 = msg("Invalid", part265); -var part266 = // "Pattern{Constant('Limited Administrator administrator "'), Field(change_old,false), Constant('" was renamed to "'), Field(change_new,false), Constant('"')}" -match("MESSAGE#138:Limited", "nwparser.payload", "Limited Administrator administrator \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ +var part266 = match("MESSAGE#138:Limited", "nwparser.payload", "Limited Administrator administrator \"%{change_old}\" was renamed to \"%{change_new}\"", processor_chain([ setc("eventcategory","1402020300"), dup12, dup13, @@ -6500,8 +6044,7 @@ match("MESSAGE#138:Limited", "nwparser.payload", "Limited Administrator administ var msg218 = msg("Limited", part266); -var part267 = // "Pattern{Constant('LiveUpdate will start next on '), Field(info,true), Constant(' on '), Field(product,false)}" -match("MESSAGE#139:LiveUpdate:08", "nwparser.payload", "LiveUpdate will start next on %{info->} on %{product}", processor_chain([ +var part267 = match("MESSAGE#139:LiveUpdate:08", "nwparser.payload", "LiveUpdate will start next on %{info->} on %{product}", processor_chain([ dup43, dup15, dup184, @@ -6509,8 +6052,7 @@ match("MESSAGE#139:LiveUpdate:08", "nwparser.payload", "LiveUpdate will start ne var msg219 = msg("LiveUpdate:08", part267); -var part268 = // "Pattern{Constant('LiveUpdate '), Field(info,true), Constant(' on '), Field(product,false), Constant('"')}" -match("MESSAGE#140:LiveUpdate:01", "nwparser.payload", "LiveUpdate %{info->} on %{product}\"", processor_chain([ +var part268 = match("MESSAGE#140:LiveUpdate:01", "nwparser.payload", "LiveUpdate %{info->} on %{product}\"", processor_chain([ dup43, dup12, dup13, @@ -6521,8 +6063,7 @@ match("MESSAGE#140:LiveUpdate:01", "nwparser.payload", "LiveUpdate %{info->} on var msg220 = msg("LiveUpdate:01", part268); -var part269 = // "Pattern{Constant('LiveUpdate failed.'), Field(,false)}" -match("MESSAGE#141:LiveUpdate", "nwparser.payload", "LiveUpdate failed.%{}", processor_chain([ +var part269 = match("MESSAGE#141:LiveUpdate", "nwparser.payload", "LiveUpdate failed.%{}", processor_chain([ dup168, dup12, dup13, @@ -6533,8 +6074,7 @@ match("MESSAGE#141:LiveUpdate", "nwparser.payload", "LiveUpdate failed.%{}", pro var msg221 = msg("LiveUpdate", part269); -var part270 = // "Pattern{Constant('LiveUpdate encountered one or more errors. Return code = '), Field(resultcode,false)}" -match("MESSAGE#142:LiveUpdate:04", "nwparser.payload", "LiveUpdate encountered one or more errors. Return code = %{resultcode}", processor_chain([ +var part270 = match("MESSAGE#142:LiveUpdate:04", "nwparser.payload", "LiveUpdate encountered one or more errors. Return code = %{resultcode}", processor_chain([ dup168, dup15, setc("event_description","LiveUpdate encountered one or more errors"), @@ -6542,8 +6082,7 @@ match("MESSAGE#142:LiveUpdate:04", "nwparser.payload", "LiveUpdate encountered o var msg222 = msg("LiveUpdate:04", part270); -var part271 = // "Pattern{Constant('LiveUpdate succeeded'), Field(,false)}" -match("MESSAGE#143:LiveUpdate:02", "nwparser.payload", "LiveUpdate succeeded%{}", processor_chain([ +var part271 = match("MESSAGE#143:LiveUpdate:02", "nwparser.payload", "LiveUpdate succeeded%{}", processor_chain([ dup43, dup12, dup13, @@ -6554,8 +6093,7 @@ match("MESSAGE#143:LiveUpdate:02", "nwparser.payload", "LiveUpdate succeeded%{}" var msg223 = msg("LiveUpdate:02", part271); -var part272 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,[LiveUpdate error submission] Submitting information to Symantec failed.')}" -match("MESSAGE#144:LiveUpdate:09", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Submitting information to Symantec failed.", processor_chain([ +var part272 = match("MESSAGE#144:LiveUpdate:09", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Submitting information to Symantec failed.", processor_chain([ dup43, dup12, dup13, @@ -6566,8 +6104,7 @@ match("MESSAGE#144:LiveUpdate:09", "nwparser.payload", "Category: %{fld22},LiveU var msg224 = msg("LiveUpdate:09", part272); -var part273 = // "Pattern{Constant('LiveUpdate encountered an error: Failed to connect to the LiveUpdate server ('), Field(resultcode,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#145:LiveUpdate:10/0", "nwparser.payload", "LiveUpdate encountered an error: Failed to connect to the LiveUpdate server (%{resultcode})%{p0}"); +var part273 = match("MESSAGE#145:LiveUpdate:10/0", "nwparser.payload", "LiveUpdate encountered an error: Failed to connect to the LiveUpdate server (%{resultcode})%{p0}"); var select49 = linear_select([ dup186, @@ -6592,8 +6129,7 @@ var all88 = all_match({ var msg225 = msg("LiveUpdate:10", all88); -var part274 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"An update for '), Field(application,true), Constant(' failed to install. Error: '), Field(resultcode,false), Constant(', DuResult:'), Field(fld23,false), Constant('."'), Field(p0,false)}" -match("MESSAGE#146:LiveUpdate:11/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"An update for %{application->} failed to install. Error: %{resultcode}, DuResult:%{fld23}.\"%{p0}"); +var part274 = match("MESSAGE#146:LiveUpdate:11/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"An update for %{application->} failed to install. Error: %{resultcode}, DuResult:%{fld23}.\"%{p0}"); var all89 = all_match({ processors: [ @@ -6613,8 +6149,7 @@ var all89 = all_match({ var msg226 = msg("LiveUpdate:11", all89); -var part275 = // "Pattern{Constant('LiveUpdate re-run triggered by the download of content catalog.'), Field(,false)}" -match("MESSAGE#147:LiveUpdate:12", "nwparser.payload", "LiveUpdate re-run triggered by the download of content catalog.%{}", processor_chain([ +var part275 = match("MESSAGE#147:LiveUpdate:12", "nwparser.payload", "LiveUpdate re-run triggered by the download of content catalog.%{}", processor_chain([ dup43, dup12, dup13, @@ -6625,8 +6160,7 @@ match("MESSAGE#147:LiveUpdate:12", "nwparser.payload", "LiveUpdate re-run trigge var msg227 = msg("LiveUpdate:12", part275); -var part276 = // "Pattern{Constant('LiveUpdate cannot be run because all licenses have expired.'), Field(,false)}" -match("MESSAGE#148:LiveUpdate:13", "nwparser.payload", "LiveUpdate cannot be run because all licenses have expired.%{}", processor_chain([ +var part276 = match("MESSAGE#148:LiveUpdate:13", "nwparser.payload", "LiveUpdate cannot be run because all licenses have expired.%{}", processor_chain([ dup43, dup14, dup15, @@ -6635,8 +6169,7 @@ match("MESSAGE#148:LiveUpdate:13", "nwparser.payload", "LiveUpdate cannot be run var msg228 = msg("LiveUpdate:13", part276); -var part277 = // "Pattern{Constant('LiveUpdate started.'), Field(,false)}" -match("MESSAGE#149:LiveUpdate::05", "nwparser.payload", "LiveUpdate started.%{}", processor_chain([ +var part277 = match("MESSAGE#149:LiveUpdate::05", "nwparser.payload", "LiveUpdate started.%{}", processor_chain([ dup43, dup15, setc("action","LiveUpdate started."), @@ -6644,8 +6177,7 @@ match("MESSAGE#149:LiveUpdate::05", "nwparser.payload", "LiveUpdate started.%{}" var msg229 = msg("LiveUpdate::05", part277); -var part278 = // "Pattern{Constant('LiveUpdate retry started.'), Field(,false)}" -match("MESSAGE#150:LiveUpdate::06", "nwparser.payload", "LiveUpdate retry started.%{}", processor_chain([ +var part278 = match("MESSAGE#150:LiveUpdate::06", "nwparser.payload", "LiveUpdate retry started.%{}", processor_chain([ dup43, dup15, setc("action","LiveUpdate retry started."), @@ -6653,8 +6185,7 @@ match("MESSAGE#150:LiveUpdate::06", "nwparser.payload", "LiveUpdate retry starte var msg230 = msg("LiveUpdate::06", part278); -var part279 = // "Pattern{Constant('LiveUpdate retry succeeded.'), Field(,false)}" -match("MESSAGE#151:LiveUpdate::07", "nwparser.payload", "LiveUpdate retry succeeded.%{}", processor_chain([ +var part279 = match("MESSAGE#151:LiveUpdate::07", "nwparser.payload", "LiveUpdate retry succeeded.%{}", processor_chain([ dup43, dup15, setc("action","LiveUpdate retry succeeded."), @@ -6662,8 +6193,7 @@ match("MESSAGE#151:LiveUpdate::07", "nwparser.payload", "LiveUpdate retry succee var msg231 = msg("LiveUpdate::07", part279); -var part280 = // "Pattern{Constant('LiveUpdate retry failed. Will try again.'), Field(,false)}" -match("MESSAGE#152:LiveUpdate::08", "nwparser.payload", "LiveUpdate retry failed. Will try again.%{}", processor_chain([ +var part280 = match("MESSAGE#152:LiveUpdate::08", "nwparser.payload", "LiveUpdate retry failed. Will try again.%{}", processor_chain([ dup43, dup12, dup13, @@ -6673,8 +6203,7 @@ match("MESSAGE#152:LiveUpdate::08", "nwparser.payload", "LiveUpdate retry failed var msg232 = msg("LiveUpdate::08", part280); -var part281 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Centralized Reputation Settings from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#153:LiveUpdate:14", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Centralized Reputation Settings from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part281 = match("MESSAGE#153:LiveUpdate:14", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Centralized Reputation Settings from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6685,8 +6214,7 @@ match("MESSAGE#153:LiveUpdate:14", "nwparser.payload", "Category: %{fld11},LiveU var msg233 = msg("LiveUpdate:14", part281); -var part282 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#154:LiveUpdate:15", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part282 = match("MESSAGE#154:LiveUpdate:15", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6700,8 +6228,7 @@ match("MESSAGE#154:LiveUpdate:15", "nwparser.payload", "Category: %{fld11},LiveU var msg234 = msg("LiveUpdate:15", part282); -var part283 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Intrusion Prevention Signatures from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#155:LiveUpdate:16", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part283 = match("MESSAGE#155:LiveUpdate:16", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Intrusion Prevention Signatures from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6715,8 +6242,7 @@ match("MESSAGE#155:LiveUpdate:16", "nwparser.payload", "Category: %{fld11},LiveU var msg235 = msg("LiveUpdate:16", part283); -var part284 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Revocation Data from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#156:LiveUpdate:17", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Revocation Data from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part284 = match("MESSAGE#156:LiveUpdate:17", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Revocation Data from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6727,8 +6253,7 @@ match("MESSAGE#156:LiveUpdate:17", "nwparser.payload", "Category: %{fld11},LiveU var msg236 = msg("LiveUpdate:17", part284); -var part285 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for SONAR Definitions from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#157:LiveUpdate:18/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for SONAR Definitions from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); +var part285 = match("MESSAGE#157:LiveUpdate:18/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for SONAR Definitions from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); var all90 = all_match({ processors: [ @@ -6748,8 +6273,7 @@ var all90 = all_match({ var msg237 = msg("LiveUpdate:18", all90); -var part286 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Symantec Whitelist from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#158:LiveUpdate:19/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Symantec Whitelist from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); +var part286 = match("MESSAGE#158:LiveUpdate:19/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Symantec Whitelist from LiveUpdate failed to install. Error:%{result}(%{resultcode})%{p0}"); var all91 = all_match({ processors: [ @@ -6769,8 +6293,7 @@ var all91 = all_match({ var msg238 = msg("LiveUpdate:19", all91); -var part287 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#159:LiveUpdate:20", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part287 = match("MESSAGE#159:LiveUpdate:20", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6784,8 +6307,7 @@ match("MESSAGE#159:LiveUpdate:20", "nwparser.payload", "Category: %{fld11},LiveU var msg239 = msg("LiveUpdate:20", part287); -var part288 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#160:LiveUpdate:21", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part288 = match("MESSAGE#160:LiveUpdate:21", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win32 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6799,8 +6321,7 @@ match("MESSAGE#160:LiveUpdate:21", "nwparser.payload", "Category: %{fld11},LiveU var msg240 = msg("LiveUpdate:21", part288); -var part289 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#161:LiveUpdate:22", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part289 = match("MESSAGE#161:LiveUpdate:22", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 (hub) from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup12, dup13, @@ -6814,8 +6335,7 @@ match("MESSAGE#161:LiveUpdate:22", "nwparser.payload", "Category: %{fld11},LiveU var msg241 = msg("LiveUpdate:22", part289); -var part290 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install. Error:'), Field(result,false), Constant('('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#162:LiveUpdate:23", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ +var part290 = match("MESSAGE#162:LiveUpdate:23", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,An update for Virus and Spyware Definitions Win64 from LiveUpdate failed to install. Error:%{result}(%{resultcode})", processor_chain([ dup43, dup94, dup13, @@ -6829,8 +6349,7 @@ match("MESSAGE#162:LiveUpdate:23", "nwparser.payload", "Category: %{fld11},LiveU var msg242 = msg("LiveUpdate:23", part290); -var part291 = // "Pattern{Constant('LiveUpdate encountered an error: '), Field(result,true), Constant(' ('), Field(resultcode,false), Constant(').'), Field(p0,false)}" -match("MESSAGE#163:LiveUpdate:24/0", "nwparser.payload", "LiveUpdate encountered an error: %{result->} (%{resultcode}).%{p0}"); +var part291 = match("MESSAGE#163:LiveUpdate:24/0", "nwparser.payload", "LiveUpdate encountered an error: %{result->} (%{resultcode}).%{p0}"); var all92 = all_match({ processors: [ @@ -6852,8 +6371,7 @@ var all92 = all_match({ var msg243 = msg("LiveUpdate:24", all92); -var part292 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated.')}" -match("MESSAGE#164:LiveUpdate:25", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ +var part292 = match("MESSAGE#164:LiveUpdate:25", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ dup43, dup12, dup13, @@ -6864,8 +6382,7 @@ match("MESSAGE#164:LiveUpdate:25", "nwparser.payload", "Category: %{fld11},LiveU var msg244 = msg("LiveUpdate:25", part292); -var part293 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated.')}" -match("MESSAGE#165:LiveUpdate:26", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ +var part293 = match("MESSAGE#165:LiveUpdate:26", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Symantec Whitelist update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ dup43, dup12, dup13, @@ -6876,8 +6393,7 @@ match("MESSAGE#165:LiveUpdate:26", "nwparser.payload", "Category: %{fld11},LiveU var msg245 = msg("LiveUpdate:26", part293); -var part294 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,A LiveUpdate session encountered errors. '), Field(fld1,true), Constant(' update(s) were available. '), Field(fld2,true), Constant(' update(s) installed successfully. '), Field(fld3,true), Constant(' update(s) failed to install.'), Field(p0,false)}" -match("MESSAGE#166:LiveUpdate:27/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,A LiveUpdate session encountered errors. %{fld1->} update(s) were available. %{fld2->} update(s) installed successfully. %{fld3->} update(s) failed to install.%{p0}"); +var part294 = match("MESSAGE#166:LiveUpdate:27/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,A LiveUpdate session encountered errors. %{fld1->} update(s) were available. %{fld2->} update(s) installed successfully. %{fld3->} update(s) failed to install.%{p0}"); var all93 = all_match({ processors: [ @@ -6897,8 +6413,7 @@ var all93 = all_match({ var msg246 = msg("LiveUpdate:27", all93); -var part295 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Revocation Data update failed to load. The component will continue to use its previous content.'), Field(p0,false)}" -match("MESSAGE#167:LiveUpdate:28/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component will continue to use its previous content.%{p0}"); +var part295 = match("MESSAGE#167:LiveUpdate:28/0", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Revocation Data update failed to load. The component will continue to use its previous content.%{p0}"); var all94 = all_match({ processors: [ @@ -6918,8 +6433,7 @@ var all94 = all_match({ var msg247 = msg("LiveUpdate:28", all94); -var part296 = // "Pattern{Field(fld11,false), Constant(': Impossible de se connecter au serveur LiveUpdate '), Field(fld12,false), Constant('.')}" -match("MESSAGE#168:LiveUpdate:29", "nwparser.payload", "%{fld11}: Impossible de se connecter au serveur LiveUpdate %{fld12}.", processor_chain([ +var part296 = match("MESSAGE#168:LiveUpdate:29", "nwparser.payload", "%{fld11}: Impossible de se connecter au serveur LiveUpdate %{fld12}.", processor_chain([ dup43, dup12, dup13, @@ -6930,14 +6444,11 @@ match("MESSAGE#168:LiveUpdate:29", "nwparser.payload", "%{fld11}: Impossible de var msg248 = msg("LiveUpdate:29", part296); -var part297 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' was successfully installed.'), Field(space,false), Constant('The new sequence number is '), Field(fld23,false), Constant('.'), Field(p0,false)}" -match("MESSAGE#169:LiveUpdate:30/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} was successfully installed.%{space}The new sequence number is %{fld23}.%{p0}"); +var part297 = match("MESSAGE#169:LiveUpdate:30/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} was successfully installed.%{space}The new sequence number is %{fld23}.%{p0}"); -var part298 = // "Pattern{Field(space,false), Constant('Content was downloaded from '), Field(url,true), Constant(' ('), Field(sport,false), Constant(').,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#169:LiveUpdate:30/1_0", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport}).,Event time:%{fld17->} %{fld18}"); +var part298 = match("MESSAGE#169:LiveUpdate:30/1_0", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport}).,Event time:%{fld17->} %{fld18}"); -var part299 = // "Pattern{Field(space,false), Constant('Content was downloaded from '), Field(url,true), Constant(' ('), Field(sport,false), Constant(').')}" -match("MESSAGE#169:LiveUpdate:30/1_1", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport})."); +var part299 = match("MESSAGE#169:LiveUpdate:30/1_1", "nwparser.p0", "%{space}Content was downloaded from %{url->} (%{sport})."); var select50 = linear_select([ part298, @@ -6964,8 +6475,7 @@ var all95 = all_match({ var msg249 = msg("LiveUpdate:30", all95); -var part300 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest '), Field(application,true), Constant(' update failed to load. The component will continue to use its previous content.'), Field(p0,false)}" -match("MESSAGE#170:LiveUpdate:31/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest %{application->} update failed to load. The component will continue to use its previous content.%{p0}"); +var part300 = match("MESSAGE#170:LiveUpdate:31/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest %{application->} update failed to load. The component will continue to use its previous content.%{p0}"); var all96 = all_match({ processors: [ @@ -6985,8 +6495,7 @@ var all96 = all_match({ var msg250 = msg("LiveUpdate:31", all96); -var part301 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,Scheduled LiveUpdate switched to '), Field(change_new,false), Constant('.')}" -match("MESSAGE#171:LiveUpdate:32", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate switched to %{change_new}.", processor_chain([ +var part301 = match("MESSAGE#171:LiveUpdate:32", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate switched to %{change_new}.", processor_chain([ dup136, dup12, dup13, @@ -7000,8 +6509,7 @@ match("MESSAGE#171:LiveUpdate:32", "nwparser.payload", "Category: %{fld22},LiveU var msg251 = msg("LiveUpdate:32", part301); -var part302 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' from LiveUpdate failed to install. Error: '), Field(result,false), Constant('('), Field(resultcode,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#172:LiveUpdate:33/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from LiveUpdate failed to install. Error: %{result}(%{resultcode})%{p0}"); +var part302 = match("MESSAGE#172:LiveUpdate:33/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from LiveUpdate failed to install. Error: %{result}(%{resultcode})%{p0}"); var all97 = all_match({ processors: [ @@ -7021,8 +6529,7 @@ var all97 = all_match({ var msg252 = msg("LiveUpdate:33", all97); -var part303 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,An update for '), Field(application,true), Constant(' from Intelligent Updater was already installed.')}" -match("MESSAGE#173:LiveUpdate:34", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from Intelligent Updater was already installed.", processor_chain([ +var part303 = match("MESSAGE#173:LiveUpdate:34", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,An update for %{application->} from Intelligent Updater was already installed.", processor_chain([ dup43, dup12, dup13, @@ -7033,33 +6540,27 @@ match("MESSAGE#173:LiveUpdate:34", "nwparser.payload", "Category: %{fld22},LiveU var msg253 = msg("LiveUpdate:34", part303); -var part304 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,'), Field(p0,false)}" -match("MESSAGE#174:LiveUpdate:35/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,%{p0}"); +var part304 = match("MESSAGE#174:LiveUpdate:35/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,%{p0}"); -var part305 = // "Pattern{Constant('A '), Field(p0,false)}" -match("MESSAGE#174:LiveUpdate:35/1_0", "nwparser.p0", "A %{p0}"); +var part305 = match("MESSAGE#174:LiveUpdate:35/1_0", "nwparser.p0", "A %{p0}"); -var part306 = // "Pattern{Constant(' The'), Field(p0,false)}" -match("MESSAGE#174:LiveUpdate:35/1_1", "nwparser.p0", " The%{p0}"); +var part306 = match("MESSAGE#174:LiveUpdate:35/1_1", "nwparser.p0", " The%{p0}"); var select51 = linear_select([ part305, part306, ]); -var part307 = // "Pattern{Field(,false), Constant('LiveUpdate session '), Field(p0,false)}" -match("MESSAGE#174:LiveUpdate:35/2", "nwparser.p0", "%{}LiveUpdate session %{p0}"); +var part307 = match("MESSAGE#174:LiveUpdate:35/2", "nwparser.p0", "%{}LiveUpdate session %{p0}"); -var part308 = // "Pattern{Constant('was'), Field(p0,false)}" -match("MESSAGE#174:LiveUpdate:35/3_1", "nwparser.p0", "was%{p0}"); +var part308 = match("MESSAGE#174:LiveUpdate:35/3_1", "nwparser.p0", "was%{p0}"); var select52 = linear_select([ dup183, part308, ]); -var part309 = // "Pattern{Field(,false), Constant('cancelled.')}" -match("MESSAGE#174:LiveUpdate:35/4", "nwparser.p0", "%{}cancelled."); +var part309 = match("MESSAGE#174:LiveUpdate:35/4", "nwparser.p0", "%{}cancelled."); var all98 = all_match({ processors: [ @@ -7081,8 +6582,7 @@ var all98 = all_match({ var msg254 = msg("LiveUpdate:35", all98); -var part310 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"A LiveUpdate session is already running, so the scheduled LiveUpdate was skipped."'), Field(p0,false)}" -match("MESSAGE#175:LiveUpdate:36/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"A LiveUpdate session is already running, so the scheduled LiveUpdate was skipped.\"%{p0}"); +var part310 = match("MESSAGE#175:LiveUpdate:36/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"A LiveUpdate session is already running, so the scheduled LiveUpdate was skipped.\"%{p0}"); var all99 = all_match({ processors: [ @@ -7102,8 +6602,7 @@ var all99 = all_match({ var msg255 = msg("LiveUpdate:36", all99); -var part311 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,Scheduled LiveUpdate keep trying to connect to Server for '), Field(fld23,true), Constant(' times.')}" -match("MESSAGE#176:LiveUpdate:37", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate keep trying to connect to Server for %{fld23->} times.", processor_chain([ +var part311 = match("MESSAGE#176:LiveUpdate:37", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,Scheduled LiveUpdate keep trying to connect to Server for %{fld23->} times.", processor_chain([ dup43, dup94, dup13, @@ -7114,14 +6613,11 @@ match("MESSAGE#176:LiveUpdate:37", "nwparser.payload", "Category: %{fld22},LiveU var msg256 = msg("LiveUpdate:37", part311); -var part312 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,A LiveUpdate session ran successfully. '), Field(p0,false)}" -match("MESSAGE#177:LiveUpdate:38/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,A LiveUpdate session ran successfully. %{p0}"); +var part312 = match("MESSAGE#177:LiveUpdate:38/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,A LiveUpdate session ran successfully. %{p0}"); -var part313 = // "Pattern{Constant(''), Field(fld23,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#177:LiveUpdate:38/1_0", "nwparser.p0", "%{fld23},Event time:%{fld17->} %{fld18}"); +var part313 = match("MESSAGE#177:LiveUpdate:38/1_0", "nwparser.p0", "%{fld23},Event time:%{fld17->} %{fld18}"); -var part314 = // "Pattern{Field(fld23,false)}" -match_copy("MESSAGE#177:LiveUpdate:38/1_1", "nwparser.p0", "fld23"); +var part314 = match_copy("MESSAGE#177:LiveUpdate:38/1_1", "nwparser.p0", "fld23"); var select53 = linear_select([ part313, @@ -7146,8 +6642,7 @@ var all100 = all_match({ var msg257 = msg("LiveUpdate:38", all100); -var part315 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,[LiveUpdate error submission] Information submitted to Symantec.'), Field(p0,false)}" -match("MESSAGE#178:LiveUpdate:39/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Information submitted to Symantec.%{p0}"); +var part315 = match("MESSAGE#178:LiveUpdate:39/0", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,[LiveUpdate error submission] Information submitted to Symantec.%{p0}"); var all101 = all_match({ processors: [ @@ -7167,8 +6662,7 @@ var all101 = all_match({ var msg258 = msg("LiveUpdate:39", all101); -var part316 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Submission Control Thresholds update failed to load. The component has no valid content and will not function correctly until it is updated.')}" -match("MESSAGE#180:LiveUpdate:41", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Submission Control Thresholds update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ +var part316 = match("MESSAGE#180:LiveUpdate:41", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Submission Control Thresholds update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ dup43, dup12, dup13, @@ -7179,8 +6673,7 @@ match("MESSAGE#180:LiveUpdate:41", "nwparser.payload", "Category: %{fld11},LiveU var msg259 = msg("LiveUpdate:41", part316); -var part317 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest SONAR Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.')}" -match("MESSAGE#181:LiveUpdate:42", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest SONAR Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ +var part317 = match("MESSAGE#181:LiveUpdate:42", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest SONAR Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.", processor_chain([ dup43, dup12, dup13, @@ -7191,8 +6684,7 @@ match("MESSAGE#181:LiveUpdate:42", "nwparser.payload", "Category: %{fld11},LiveU var msg260 = msg("LiveUpdate:42", part317); -var part318 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',LiveUpdate Manager,The latest Endpoint Detection and Response update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#182:LiveUpdate:43", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Endpoint Detection and Response update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part318 = match("MESSAGE#182:LiveUpdate:43", "nwparser.payload", "Category: %{fld11},LiveUpdate Manager,The latest Endpoint Detection and Response update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -7203,8 +6695,7 @@ match("MESSAGE#182:LiveUpdate:43", "nwparser.payload", "Category: %{fld11},LiveU var msg261 = msg("LiveUpdate:43", part318); -var part319 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,"[LiveUpdate error submission] Submitting information to Symantec failed. Network error : ''), Field(result,false), Constant('''), Field(fld23,false), Constant('",Event time: '), Field(event_time_string,false)}" -match("MESSAGE#183:LiveUpdate:44", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"[LiveUpdate error submission] Submitting information to Symantec failed. Network error : '%{result}'%{fld23}\",Event time: %{event_time_string}", processor_chain([ +var part319 = match("MESSAGE#183:LiveUpdate:44", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,\"[LiveUpdate error submission] Submitting information to Symantec failed. Network error : '%{result}'%{fld23}\",Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7214,8 +6705,7 @@ match("MESSAGE#183:LiveUpdate:44", "nwparser.payload", "Category: %{fld22},LiveU var msg262 = msg("LiveUpdate:44", part319); -var part320 = // "Pattern{Constant('LiveUpdate encountered an error.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#184:LiveUpdate:45", "nwparser.payload", "LiveUpdate encountered an error.,Event time: %{fld17->} %{fld18}", processor_chain([ +var part320 = match("MESSAGE#184:LiveUpdate:45", "nwparser.payload", "LiveUpdate encountered an error.,Event time: %{fld17->} %{fld18}", processor_chain([ dup86, dup12, dup13, @@ -7226,8 +6716,7 @@ match("MESSAGE#184:LiveUpdate:45", "nwparser.payload", "LiveUpdate encountered a var msg263 = msg("LiveUpdate:45", part320); -var part321 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest AP Portal List update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#185:LiveUpdate:46", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest AP Portal List update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part321 = match("MESSAGE#185:LiveUpdate:46", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest AP Portal List update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7237,8 +6726,7 @@ match("MESSAGE#185:LiveUpdate:46", "nwparser.payload", "Category: %{fld22},LiveU var msg264 = msg("LiveUpdate:46", part321); -var part322 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Centralized Reputation Settings update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#186:LiveUpdate:47", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Centralized Reputation Settings update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part322 = match("MESSAGE#186:LiveUpdate:47", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Centralized Reputation Settings update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7248,8 +6736,7 @@ match("MESSAGE#186:LiveUpdate:47", "nwparser.payload", "Category: %{fld22},LiveU var msg265 = msg("LiveUpdate:47", part322); -var part323 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Power Eraser Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#187:LiveUpdate:48", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Power Eraser Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part323 = match("MESSAGE#187:LiveUpdate:48", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Power Eraser Definitions update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7259,8 +6746,7 @@ match("MESSAGE#187:LiveUpdate:48", "nwparser.payload", "Category: %{fld22},LiveU var msg266 = msg("LiveUpdate:48", part323); -var part324 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Common Network Transport Library and Configuration update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#188:LiveUpdate:49", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Common Network Transport Library and Configuration update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part324 = match("MESSAGE#188:LiveUpdate:49", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Common Network Transport Library and Configuration update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7270,8 +6756,7 @@ match("MESSAGE#188:LiveUpdate:49", "nwparser.payload", "Category: %{fld22},LiveU var msg267 = msg("LiveUpdate:49", part324); -var part325 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',LiveUpdate Manager,The latest Extended File Attributes and Signatures update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#189:LiveUpdate:50", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Extended File Attributes and Signatures update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ +var part325 = match("MESSAGE#189:LiveUpdate:50", "nwparser.payload", "Category: %{fld22},LiveUpdate Manager,The latest Extended File Attributes and Signatures update failed to load. The component has no valid content and will not function correctly until it is updated.,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -7334,8 +6819,7 @@ var select54 = linear_select([ msg268, ]); -var part326 = // "Pattern{Constant('Virus and Spyware Definitions were updated recently, so the scheduled LiveUpdate was skipped.'), Field(p0,false)}" -match("MESSAGE#179:LiveUpdate:40/0", "nwparser.payload", "Virus and Spyware Definitions were updated recently, so the scheduled LiveUpdate was skipped.%{p0}"); +var part326 = match("MESSAGE#179:LiveUpdate:40/0", "nwparser.payload", "Virus and Spyware Definitions were updated recently, so the scheduled LiveUpdate was skipped.%{p0}"); var select55 = linear_select([ dup191, @@ -7360,8 +6844,7 @@ var all102 = all_match({ var msg269 = msg("LiveUpdate:40", all102); -var part327 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Virus Name: '), Field(virusname,false), Constant('..Path: '), Field(filename,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#430:Virus", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Virus Name: %{virusname}..Path: %{filename}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part327 = match("MESSAGE#430:Virus", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Virus Name: %{virusname}..Path: %{filename}..Severity: %{severity}..Source: %{product}", processor_chain([ dup110, dup115, dup116, @@ -7374,8 +6857,7 @@ match("MESSAGE#430:Virus", "nwparser.payload", "Virus Found..Computer: %{shost}. var msg270 = msg("Virus", part327); -var part328 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#431:Virus:01", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part328 = match("MESSAGE#431:Virus:01", "nwparser.payload", "Virus Found..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Severity: %{severity}..Source: %{product}", processor_chain([ dup110, dup192, dup15, @@ -7384,19 +6866,16 @@ match("MESSAGE#431:Virus:01", "nwparser.payload", "Virus Found..Computer: %{shos var msg271 = msg("Virus:01", part328); -var part329 = // "Pattern{Constant('Virus Definition File Update..'), Field(fld4,false), Constant('..'), Field(fld5,false), Constant('..Update to computer '), Field(shost,true), Constant(' of virus definition file '), Field(fld6,true), Constant(' failed. Status '), Field(fld7,true), Constant(' ..'), Field(p0,false)}" -match("MESSAGE#432:Virus:02/0", "nwparser.payload", "Virus Definition File Update..%{fld4}..%{fld5}..Update to computer %{shost->} of virus definition file %{fld6->} failed. Status %{fld7->} ..%{p0}"); +var part329 = match("MESSAGE#432:Virus:02/0", "nwparser.payload", "Virus Definition File Update..%{fld4}..%{fld5}..Update to computer %{shost->} of virus definition file %{fld6->} failed. Status %{fld7->} ..%{p0}"); -var part330 = // "Pattern{Constant('. '), Field(p0,false)}" -match("MESSAGE#432:Virus:02/1_0", "nwparser.p0", ". %{p0}"); +var part330 = match("MESSAGE#432:Virus:02/1_0", "nwparser.p0", ". %{p0}"); var select56 = linear_select([ part330, dup194, ]); -var part331 = // "Pattern{Constant(''), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld8,false)}" -match("MESSAGE#432:Virus:02/2", "nwparser.p0", "%{severity}..%{product}..%{fld8}"); +var part331 = match("MESSAGE#432:Virus:02/2", "nwparser.p0", "%{severity}..%{product}..%{fld8}"); var all103 = all_match({ processors: [ @@ -7424,8 +6903,7 @@ var all103 = all_match({ var msg272 = msg("Virus:02", all103); -var part332 = // "Pattern{Constant('Virus Definition File Update..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" -match("MESSAGE#433:Virus:03", "nwparser.payload", "Virus Definition File Update..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ +var part332 = match("MESSAGE#433:Virus:03", "nwparser.payload", "Virus Definition File Update..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ dup43, dup44, dup45, @@ -7438,8 +6916,7 @@ match("MESSAGE#433:Virus:03", "nwparser.payload", "Virus Definition File Update. var msg273 = msg("Virus:03", part332); -var part333 = // "Pattern{Constant('Virus Found..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('.....'), Field(info,false), Constant('..'), Field(action,false), Constant('....'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" -match("MESSAGE#434:Virus:09", "nwparser.payload", "Virus Found..%{shost}..%{fld5}..%{filename}.....%{info}..%{action}....%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ +var part333 = match("MESSAGE#434:Virus:09", "nwparser.payload", "Virus Found..%{shost}..%{fld5}..%{filename}.....%{info}..%{action}....%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ dup110, dup115, dup116, @@ -7452,8 +6929,7 @@ match("MESSAGE#434:Virus:09", "nwparser.payload", "Virus Found..%{shost}..%{fld5 var msg274 = msg("Virus:09", part333); -var part334 = // "Pattern{Constant('Virus Found..'), Field(fld12,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" -match("MESSAGE#435:Virus:04", "nwparser.payload", "Virus Found..%{fld12}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ +var part334 = match("MESSAGE#435:Virus:04", "nwparser.payload", "Virus Found..%{fld12}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ dup110, dup115, dup116, @@ -7466,8 +6942,7 @@ match("MESSAGE#435:Virus:04", "nwparser.payload", "Virus Found..%{fld12}..%{fld5 var msg275 = msg("Virus:04", part334); -var part335 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(',0,Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" -match("MESSAGE#436:Virus:12/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); +var part335 = match("MESSAGE#436:Virus:12/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); var all104 = all_match({ processors: [ @@ -7493,14 +6968,11 @@ var all104 = all_match({ var msg276 = msg("Virus:12", all104); -var part336 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#437:Virus:15/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); +var part336 = match("MESSAGE#437:Virus:15/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); -var part337 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#437:Virus:15/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); +var part337 = match("MESSAGE#437:Virus:15/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); -var part338 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(url,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(filename,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" -match("MESSAGE#437:Virus:15/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{url},Web domain: %{fld45},Downloaded by: %{filename},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); +var part338 = match("MESSAGE#437:Virus:15/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{url},Web domain: %{fld45},Downloaded by: %{filename},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{event_type}"); var all105 = all_match({ processors: [ @@ -7528,8 +7000,7 @@ var all105 = all_match({ var msg277 = msg("Virus:15", all105); -var part339 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" -match("MESSAGE#438:Virus:13/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},%{p0}"); +var part339 = match("MESSAGE#438:Virus:13/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},%{p0}"); var all106 = all_match({ processors: [ @@ -7558,8 +7029,7 @@ var all106 = all_match({ var msg278 = msg("Virus:13", all106); -var part340 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" -match("MESSAGE#439:Virus:10/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}"); +var part340 = match("MESSAGE#439:Virus:10/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}"); var all107 = all_match({ processors: [ @@ -7585,19 +7055,16 @@ var all107 = all_match({ var msg279 = msg("Virus:10", all107); -var part341 = // "Pattern{Constant('"'), Field(fld22,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#440:Virus:14/1_0", "nwparser.p0", "\"%{fld22}\",Actual action: %{p0}"); +var part341 = match("MESSAGE#440:Virus:14/1_0", "nwparser.p0", "\"%{fld22}\",Actual action: %{p0}"); -var part342 = // "Pattern{Field(fld22,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#440:Virus:14/1_1", "nwparser.p0", "%{fld22},Actual action: %{p0}"); +var part342 = match("MESSAGE#440:Virus:14/1_1", "nwparser.p0", "%{fld22},Actual action: %{p0}"); var select57 = linear_select([ part341, part342, ]); -var part343 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld58,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" -match("MESSAGE#440:Virus:14/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); +var part343 = match("MESSAGE#440:Virus:14/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},First Seen: %{fld50},Sensitivity: %{fld58},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}"); var all108 = all_match({ processors: [ @@ -7649,8 +7116,7 @@ var all109 = all_match({ var msg281 = msg("Virus:05", all109); -var part344 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',"Group: '), Field(group,false), Constant('",Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#442:Virus:11/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group}\",Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part344 = match("MESSAGE#442:Virus:11/2", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},\"Group: %{group}\",Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all110 = all_match({ processors: [ @@ -7677,22 +7143,18 @@ var all110 = all_match({ var msg282 = msg("Virus:11", all110); -var part345 = // "Pattern{Constant('Virus Found..Computer: '), Field(shost,false), Constant('..'), Field(p0,false)}" -match("MESSAGE#443:Virus:06/0", "nwparser.payload", "Virus Found..Computer: %{shost}..%{p0}"); +var part345 = match("MESSAGE#443:Virus:06/0", "nwparser.payload", "Virus Found..Computer: %{shost}..%{p0}"); -var part346 = // "Pattern{Constant('Date: '), Field(fld5,false), Constant('..File Path:'), Field(p0,false)}" -match("MESSAGE#443:Virus:06/1_0", "nwparser.p0", "Date: %{fld5}..File Path:%{p0}"); +var part346 = match("MESSAGE#443:Virus:06/1_0", "nwparser.p0", "Date: %{fld5}..File Path:%{p0}"); -var part347 = // "Pattern{Field(fld5,false), Constant('..File Path:'), Field(p0,false)}" -match("MESSAGE#443:Virus:06/1_1", "nwparser.p0", "%{fld5}..File Path:%{p0}"); +var part347 = match("MESSAGE#443:Virus:06/1_1", "nwparser.p0", "%{fld5}..File Path:%{p0}"); var select58 = linear_select([ part346, part347, ]); -var part348 = // "Pattern{Field(filename,false), Constant('..'), Field(info,false), Constant('..Requested Action:'), Field(action,false), Constant('..Severity:'), Field(severity,false), Constant('..Source:'), Field(product,false), Constant('..Time:'), Field(fld6,false), Constant('..User:'), Field(username,false)}" -match("MESSAGE#443:Virus:06/2", "nwparser.p0", "%{filename}..%{info}..Requested Action:%{action}..Severity:%{severity}..Source:%{product}..Time:%{fld6}..User:%{username}"); +var part348 = match("MESSAGE#443:Virus:06/2", "nwparser.p0", "%{filename}..%{info}..Requested Action:%{action}..Severity:%{severity}..Source:%{product}..Time:%{fld6}..User:%{username}"); var all111 = all_match({ processors: [ @@ -7713,8 +7175,7 @@ var all111 = all_match({ var msg283 = msg("Virus:06", all111); -var part349 = // "Pattern{Field(fld1,true), Constant(' Virus Found '), Field(shost,true), Constant(' '), Field(fld5,true), Constant(' '), Field(filename,true), Constant(' Forward from '), Field(info,true), Constant(' '), Field(action,true), Constant(' '), Field(severity,true), Constant(' '), Field(product,true), Constant(' Edition '), Field(version,true), Constant(' '), Field(virusname,false)}" -match("MESSAGE#444:Virus:07", "nwparser.payload", "%{fld1->} Virus Found %{shost->} %{fld5->} %{filename->} Forward from %{info->} %{action->} %{severity->} %{product->} Edition %{version->} %{virusname}", processor_chain([ +var part349 = match("MESSAGE#444:Virus:07", "nwparser.payload", "%{fld1->} Virus Found %{shost->} %{fld5->} %{filename->} Forward from %{info->} %{action->} %{severity->} %{product->} Edition %{version->} %{virusname}", processor_chain([ dup110, dup115, dup116, @@ -7727,8 +7188,7 @@ match("MESSAGE#444:Virus:07", "nwparser.payload", "%{fld1->} Virus Found %{shost var msg284 = msg("Virus:07", part349); -var part350 = // "Pattern{Field(product,true), Constant(' definitions '), Field(info,false)}" -match("MESSAGE#445:Virus:08", "nwparser.payload", "%{product->} definitions %{info}", processor_chain([ +var part350 = match("MESSAGE#445:Virus:08", "nwparser.payload", "%{product->} definitions %{info}", processor_chain([ dup43, dup12, dup13, @@ -7759,8 +7219,7 @@ var select59 = linear_select([ msg285, ]); -var part351 = // "Pattern{Field(shost,false), Constant(', Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#216:Local:01", "nwparser.payload", "%{shost}, Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part351 = match("MESSAGE#216:Local:01", "nwparser.payload", "%{shost}, Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup53, dup12, dup15, @@ -7769,8 +7228,7 @@ match("MESSAGE#216:Local:01", "nwparser.payload", "%{shost}, Local Port %{sport} var msg286 = msg("Local:01", part351); -var part352 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#217:Local:02", "nwparser.payload", "Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part352 = match("MESSAGE#217:Local:02", "nwparser.payload", "Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup53, dup12, dup13, @@ -7785,22 +7243,18 @@ var select60 = linear_select([ msg287, ]); -var part353 = // "Pattern{Constant('Location has been '), Field(p0,false)}" -match("MESSAGE#218:Location/0", "nwparser.payload", "Location has been %{p0}"); +var part353 = match("MESSAGE#218:Location/0", "nwparser.payload", "Location has been %{p0}"); -var part354 = // "Pattern{Constant('changed '), Field(p0,false)}" -match("MESSAGE#218:Location/1_0", "nwparser.p0", "changed %{p0}"); +var part354 = match("MESSAGE#218:Location/1_0", "nwparser.p0", "changed %{p0}"); -var part355 = // "Pattern{Constant('switched'), Field(p0,false)}" -match("MESSAGE#218:Location/1_1", "nwparser.p0", "switched%{p0}"); +var part355 = match("MESSAGE#218:Location/1_1", "nwparser.p0", "switched%{p0}"); var select61 = linear_select([ part354, part355, ]); -var part356 = // "Pattern{Field(,false), Constant('to '), Field(p0,false)}" -match("MESSAGE#218:Location/2", "nwparser.p0", "%{}to %{p0}"); +var part356 = match("MESSAGE#218:Location/2", "nwparser.p0", "%{}to %{p0}"); var all112 = all_match({ processors: [ @@ -7825,8 +7279,7 @@ var all112 = all_match({ var msg288 = msg("Location", all112); -var part357 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#219:LUALL", "nwparser.payload", "event_description", processor_chain([ +var part357 = match_copy("MESSAGE#219:LUALL", "nwparser.payload", "event_description", processor_chain([ dup43, dup12, dup13, @@ -7835,8 +7288,7 @@ match_copy("MESSAGE#219:LUALL", "nwparser.payload", "event_description", process var msg289 = msg("LUALL", part357); -var part358 = // "Pattern{Constant('Management server started up successfully'), Field(,false)}" -match("MESSAGE#220:Management", "nwparser.payload", "Management server started up successfully%{}", processor_chain([ +var part358 = match("MESSAGE#220:Management", "nwparser.payload", "Management server started up successfully%{}", processor_chain([ dup43, dup12, dup13, @@ -7847,8 +7299,7 @@ match("MESSAGE#220:Management", "nwparser.payload", "Management server started u var msg290 = msg("Management", part358); -var part359 = // "Pattern{Constant('Management server shut down gracefully'), Field(,false)}" -match("MESSAGE#221:Management:01", "nwparser.payload", "Management server shut down gracefully%{}", processor_chain([ +var part359 = match("MESSAGE#221:Management:01", "nwparser.payload", "Management server shut down gracefully%{}", processor_chain([ dup43, dup12, dup13, @@ -7859,8 +7310,7 @@ match("MESSAGE#221:Management:01", "nwparser.payload", "Management server shut d var msg291 = msg("Management:01", part359); -var part360 = // "Pattern{Constant('Management Server has detected and ignored one or more duplicate entries.Please check the following entries in your directory server:'), Field(fld12,false)}" -match("MESSAGE#222:Management:02", "nwparser.payload", "Management Server has detected and ignored one or more duplicate entries.Please check the following entries in your directory server:%{fld12}", processor_chain([ +var part360 = match("MESSAGE#222:Management:02", "nwparser.payload", "Management Server has detected and ignored one or more duplicate entries.Please check the following entries in your directory server:%{fld12}", processor_chain([ dup43, dup12, dup13, @@ -7877,8 +7327,7 @@ var select62 = linear_select([ msg292, ]); -var part361 = // "Pattern{Constant('management server received the client log successfully,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#223:management", "nwparser.payload", "management server received the client log successfully,%{shost},%{username},%{group}", processor_chain([ +var part361 = match("MESSAGE#223:management", "nwparser.payload", "management server received the client log successfully,%{shost},%{username},%{group}", processor_chain([ dup53, dup12, dup13, @@ -7889,8 +7338,7 @@ match("MESSAGE#223:management", "nwparser.payload", "management server received var msg293 = msg("management", part361); -var part362 = // "Pattern{Constant('management server received a report that the client computer changed its hardware identity,'), Field(shost,false), Constant(','), Field(username,false), Constant(','), Field(group,false)}" -match("MESSAGE#224:management:01", "nwparser.payload", "management server received a report that the client computer changed its hardware identity,%{shost},%{username},%{group}", processor_chain([ +var part362 = match("MESSAGE#224:management:01", "nwparser.payload", "management server received a report that the client computer changed its hardware identity,%{shost},%{username},%{group}", processor_chain([ dup53, dup12, dup13, @@ -7906,22 +7354,18 @@ var select63 = linear_select([ msg294, ]); -var part363 = // "Pattern{Constant('Network Threat Protection --'), Field(p0,false)}" -match("MESSAGE#225:Network/0", "nwparser.payload", "Network Threat Protection --%{p0}"); +var part363 = match("MESSAGE#225:Network/0", "nwparser.payload", "Network Threat Protection --%{p0}"); -var part364 = // "Pattern{Constant('-- Engine version'), Field(p0,false)}" -match("MESSAGE#225:Network/1_0", "nwparser.p0", "-- Engine version%{p0}"); +var part364 = match("MESSAGE#225:Network/1_0", "nwparser.p0", "-- Engine version%{p0}"); -var part365 = // "Pattern{Constant(' Engine version'), Field(p0,false)}" -match("MESSAGE#225:Network/1_1", "nwparser.p0", " Engine version%{p0}"); +var part365 = match("MESSAGE#225:Network/1_1", "nwparser.p0", " Engine version%{p0}"); var select64 = linear_select([ part364, part365, ]); -var part366 = // "Pattern{Field(,false), Constant(': '), Field(version,true), Constant(' Windows Version info: Operating System: '), Field(os,true), Constant(' Network info:'), Field(info,false)}" -match("MESSAGE#225:Network/2", "nwparser.p0", "%{}: %{version->} Windows Version info: Operating System: %{os->} Network info:%{info}"); +var part366 = match("MESSAGE#225:Network/2", "nwparser.p0", "%{}: %{version->} Windows Version info: Operating System: %{os->} Network info:%{info}"); var all113 = all_match({ processors: [ @@ -7941,8 +7385,7 @@ var all113 = all_match({ var msg295 = msg("Network", all113); -var part367 = // "Pattern{Constant('Network Threat Protection has been activated'), Field(,false)}" -match("MESSAGE#226:Network:01", "nwparser.payload", "Network Threat Protection has been activated%{}", processor_chain([ +var part367 = match("MESSAGE#226:Network:01", "nwparser.payload", "Network Threat Protection has been activated%{}", processor_chain([ dup213, dup12, dup13, @@ -7956,22 +7399,18 @@ match("MESSAGE#226:Network:01", "nwparser.payload", "Network Threat Protection h var msg296 = msg("Network:01", part367); -var part368 = // "Pattern{Constant('Network Threat Protection applied a new IPS '), Field(p0,false)}" -match("MESSAGE#227:Network:02/0", "nwparser.payload", "Network Threat Protection applied a new IPS %{p0}"); +var part368 = match("MESSAGE#227:Network:02/0", "nwparser.payload", "Network Threat Protection applied a new IPS %{p0}"); -var part369 = // "Pattern{Constant('Library'), Field(p0,false)}" -match("MESSAGE#227:Network:02/1_0", "nwparser.p0", "Library%{p0}"); +var part369 = match("MESSAGE#227:Network:02/1_0", "nwparser.p0", "Library%{p0}"); -var part370 = // "Pattern{Constant('library'), Field(p0,false)}" -match("MESSAGE#227:Network:02/1_1", "nwparser.p0", "library%{p0}"); +var part370 = match("MESSAGE#227:Network:02/1_1", "nwparser.p0", "library%{p0}"); var select65 = linear_select([ part369, part370, ]); -var part371 = // "Pattern{Field(,false), Constant('.')}" -match("MESSAGE#227:Network:02/2", "nwparser.p0", "%{}."); +var part371 = match("MESSAGE#227:Network:02/2", "nwparser.p0", "%{}."); var all114 = all_match({ processors: [ @@ -7991,8 +7430,7 @@ var all114 = all_match({ var msg297 = msg("Network:02", all114); -var part372 = // "Pattern{Constant('The Network Threat Protection already has the newest policy.'), Field(,false)}" -match("MESSAGE#228:Network:03", "nwparser.payload", "The Network Threat Protection already has the newest policy.%{}", processor_chain([ +var part372 = match("MESSAGE#228:Network:03", "nwparser.payload", "The Network Threat Protection already has the newest policy.%{}", processor_chain([ dup92, dup12, dup13, @@ -8003,8 +7441,7 @@ match("MESSAGE#228:Network:03", "nwparser.payload", "The Network Threat Protecti var msg298 = msg("Network:03", part372); -var part373 = // "Pattern{Constant('The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.'), Field(,false)}" -match("MESSAGE#229:Network:04", "nwparser.payload", "The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ +var part373 = match("MESSAGE#229:Network:04", "nwparser.payload", "The Network Threat Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ dup43, dup12, dup13, @@ -8015,8 +7452,7 @@ match("MESSAGE#229:Network:04", "nwparser.payload", "The Network Threat Protecti var msg299 = msg("Network:04", part373); -var part374 = // "Pattern{Constant('Network Threat Protection's firewall and Intrusion Prevention features are disabled'), Field(,false)}" -match("MESSAGE#230:Network:05", "nwparser.payload", "Network Threat Protection's firewall and Intrusion Prevention features are disabled%{}", processor_chain([ +var part374 = match("MESSAGE#230:Network:05", "nwparser.payload", "Network Threat Protection's firewall and Intrusion Prevention features are disabled%{}", processor_chain([ dup92, dup12, dup13, @@ -8027,8 +7463,7 @@ match("MESSAGE#230:Network:05", "nwparser.payload", "Network Threat Protection's var msg300 = msg("Network:05", part374); -var part375 = // "Pattern{Constant('The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager.'), Field(,false)}" -match("MESSAGE#231:Network:06", "nwparser.payload", "The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ +var part375 = match("MESSAGE#231:Network:06", "nwparser.payload", "The Network Threat Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ dup92, dup12, dup13, @@ -8039,8 +7474,7 @@ match("MESSAGE#231:Network:06", "nwparser.payload", "The Network Threat Protecti var msg301 = msg("Network:06", part375); -var part376 = // "Pattern{Constant('Network Audit Search Unagented Hosts Started'), Field(,false)}" -match("MESSAGE#232:Network:07", "nwparser.payload", "Network Audit Search Unagented Hosts Started%{}", processor_chain([ +var part376 = match("MESSAGE#232:Network:07", "nwparser.payload", "Network Audit Search Unagented Hosts Started%{}", processor_chain([ dup92, dup12, dup13, @@ -8051,8 +7485,7 @@ match("MESSAGE#232:Network:07", "nwparser.payload", "Network Audit Search Unagen var msg302 = msg("Network:07", part376); -var part377 = // "Pattern{Constant('Network Audit Search Unagented Hosts From NST Finished Abnormally'), Field(,false)}" -match("MESSAGE#233:Network:08", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Abnormally%{}", processor_chain([ +var part377 = match("MESSAGE#233:Network:08", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Abnormally%{}", processor_chain([ dup92, dup12, dup13, @@ -8063,8 +7496,7 @@ match("MESSAGE#233:Network:08", "nwparser.payload", "Network Audit Search Unagen var msg303 = msg("Network:08", part377); -var part378 = // "Pattern{Constant('Network Audit Search Unagented Hosts From NST Finished Normally'), Field(,false)}" -match("MESSAGE#234:Network:09", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Normally%{}", processor_chain([ +var part378 = match("MESSAGE#234:Network:09", "nwparser.payload", "Network Audit Search Unagented Hosts From NST Finished Normally%{}", processor_chain([ dup92, dup12, dup13, @@ -8075,8 +7507,7 @@ match("MESSAGE#234:Network:09", "nwparser.payload", "Network Audit Search Unagen var msg304 = msg("Network:09", part378); -var part379 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Started'), Field(,false)}" -match("MESSAGE#235:Network:10", "nwparser.payload", "Network Audit Client Remote Pushing Install Started%{}", processor_chain([ +var part379 = match("MESSAGE#235:Network:10", "nwparser.payload", "Network Audit Client Remote Pushing Install Started%{}", processor_chain([ dup92, dup12, dup13, @@ -8087,8 +7518,7 @@ match("MESSAGE#235:Network:10", "nwparser.payload", "Network Audit Client Remote var msg305 = msg("Network:10", part379); -var part380 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Finished Normally'), Field(,false)}" -match("MESSAGE#236:Network:11", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Normally%{}", processor_chain([ +var part380 = match("MESSAGE#236:Network:11", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Normally%{}", processor_chain([ dup92, dup12, dup13, @@ -8099,8 +7529,7 @@ match("MESSAGE#236:Network:11", "nwparser.payload", "Network Audit Client Remote var msg306 = msg("Network:11", part380); -var part381 = // "Pattern{Constant('Network Intrusion Prevention is malfunctioning, '), Field(result,false), Constant('"')}" -match("MESSAGE#237:Network:12", "nwparser.payload", "Network Intrusion Prevention is malfunctioning, %{result}\"", processor_chain([ +var part381 = match("MESSAGE#237:Network:12", "nwparser.payload", "Network Intrusion Prevention is malfunctioning, %{result}\"", processor_chain([ dup92, dup12, dup13, @@ -8112,8 +7541,7 @@ match("MESSAGE#237:Network:12", "nwparser.payload", "Network Intrusion Preventio var msg307 = msg("Network:12", part381); -var part382 = // "Pattern{Constant('Category: '), Field(fld11,false), Constant(',Network Intrusion Protection Sys,Browser Intrusion Prevention is malfunctioning. Browser type: '), Field(obj_name,false), Constant('.Try to update the signatures Browser path: '), Field(filename,false)}" -match("MESSAGE#238:Network:13", "nwparser.payload", "Category: %{fld11},Network Intrusion Protection Sys,Browser Intrusion Prevention is malfunctioning. Browser type: %{obj_name}.Try to update the signatures Browser path: %{filename}", processor_chain([ +var part382 = match("MESSAGE#238:Network:13", "nwparser.payload", "Category: %{fld11},Network Intrusion Protection Sys,Browser Intrusion Prevention is malfunctioning. Browser type: %{obj_name}.Try to update the signatures Browser path: %{filename}", processor_chain([ dup92, dup12, dup13, @@ -8125,8 +7553,7 @@ match("MESSAGE#238:Network:13", "nwparser.payload", "Category: %{fld11},Network var msg308 = msg("Network:13", part382); -var part383 = // "Pattern{Constant('Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed. The IPS content is going to be installed automatically'), Field(,false)}" -match("MESSAGE#241:Network:16", "nwparser.payload", "Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed. The IPS content is going to be installed automatically%{}", processor_chain([ +var part383 = match("MESSAGE#241:Network:16", "nwparser.payload", "Network Intrusion Prevention and Browser Intrusion Prevention are malfunctioning because their content is not installed. The IPS content is going to be installed automatically%{}", processor_chain([ dup92, dup12, dup13, @@ -8138,8 +7565,7 @@ match("MESSAGE#241:Network:16", "nwparser.payload", "Network Intrusion Preventio var msg309 = msg("Network:16", part383); -var part384 = // "Pattern{Constant('Network Intrusion Prevention is malfunctioning'), Field(,false)}" -match("MESSAGE#242:Network:17", "nwparser.payload", "Network Intrusion Prevention is malfunctioning%{}", processor_chain([ +var part384 = match("MESSAGE#242:Network:17", "nwparser.payload", "Network Intrusion Prevention is malfunctioning%{}", processor_chain([ dup92, dup12, dup13, @@ -8151,8 +7577,7 @@ match("MESSAGE#242:Network:17", "nwparser.payload", "Network Intrusion Preventio var msg310 = msg("Network:17", part384); -var part385 = // "Pattern{Constant('Network Intrusion Prevention is not protecting machine because its driver was unloaded'), Field(,false)}" -match("MESSAGE#243:Network:18", "nwparser.payload", "Network Intrusion Prevention is not protecting machine because its driver was unloaded%{}", processor_chain([ +var part385 = match("MESSAGE#243:Network:18", "nwparser.payload", "Network Intrusion Prevention is not protecting machine because its driver was unloaded%{}", processor_chain([ dup92, dup12, dup13, @@ -8163,8 +7588,7 @@ match("MESSAGE#243:Network:18", "nwparser.payload", "Network Intrusion Preventio var msg311 = msg("Network:18", part385); -var part386 = // "Pattern{Constant('Network Threat Protection's firewall is disabled by policy'), Field(,false)}" -match("MESSAGE#244:Network:19", "nwparser.payload", "Network Threat Protection's firewall is disabled by policy%{}", processor_chain([ +var part386 = match("MESSAGE#244:Network:19", "nwparser.payload", "Network Threat Protection's firewall is disabled by policy%{}", processor_chain([ dup92, dup12, dup13, @@ -8175,8 +7599,7 @@ match("MESSAGE#244:Network:19", "nwparser.payload", "Network Threat Protection's var msg312 = msg("Network:19", part386); -var part387 = // "Pattern{Field(service,true), Constant(' has been restored and '), Field(result,false)}" -match("MESSAGE#246:Network:21", "nwparser.payload", "%{service->} has been restored and %{result}", processor_chain([ +var part387 = match("MESSAGE#246:Network:21", "nwparser.payload", "%{service->} has been restored and %{result}", processor_chain([ dup92, dup12, dup13, @@ -8187,8 +7610,7 @@ match("MESSAGE#246:Network:21", "nwparser.payload", "%{service->} has been resto var msg313 = msg("Network:21", part387); -var part388 = // "Pattern{Field(service,true), Constant(' is not protecting machine because its driver was disabled,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#247:Network:33", "nwparser.payload", "%{service->} is not protecting machine because its driver was disabled,Event time: %{event_time_string}", processor_chain([ +var part388 = match("MESSAGE#247:Network:33", "nwparser.payload", "%{service->} is not protecting machine because its driver was disabled,Event time: %{event_time_string}", processor_chain([ dup86, dup12, dup13, @@ -8198,8 +7620,7 @@ match("MESSAGE#247:Network:33", "nwparser.payload", "%{service->} is not protect var msg314 = msg("Network:33", part388); -var part389 = // "Pattern{Constant('Network Threat Protection's firewall is enabled'), Field(p0,false)}" -match("MESSAGE#251:Network:25/0", "nwparser.payload", "Network Threat Protection's firewall is enabled%{p0}"); +var part389 = match("MESSAGE#251:Network:25/0", "nwparser.payload", "Network Threat Protection's firewall is enabled%{p0}"); var all115 = all_match({ processors: [ @@ -8219,8 +7640,7 @@ var all115 = all_match({ var msg315 = msg("Network:25", all115); -var part390 = // "Pattern{Constant('Network Intrusion Prevention disabled'), Field(p0,false)}" -match("MESSAGE#253:Network:27/0", "nwparser.payload", "Network Intrusion Prevention disabled%{p0}"); +var part390 = match("MESSAGE#253:Network:27/0", "nwparser.payload", "Network Intrusion Prevention disabled%{p0}"); var all116 = all_match({ processors: [ @@ -8239,8 +7659,7 @@ var all116 = all_match({ var msg316 = msg("Network:27", all116); -var part391 = // "Pattern{Constant('Network Intrusion Prevention enabled'), Field(p0,false)}" -match("MESSAGE#254:Network:28/0", "nwparser.payload", "Network Intrusion Prevention enabled%{p0}"); +var part391 = match("MESSAGE#254:Network:28/0", "nwparser.payload", "Network Intrusion Prevention enabled%{p0}"); var all117 = all_match({ processors: [ @@ -8260,8 +7679,7 @@ var all117 = all_match({ var msg317 = msg("Network:28", all117); -var part392 = // "Pattern{Constant('Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage'), Field(,false)}" -match("MESSAGE#257:Network:30", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage%{}", processor_chain([ +var part392 = match("MESSAGE#257:Network:30", "nwparser.payload", "Network Audit Client Remote Pushing Install Finished Abnormally in Pusing Stage%{}", processor_chain([ dup92, dup12, dup13, @@ -8299,8 +7717,7 @@ var select66 = linear_select([ msg318, ]); -var part393 = // "Pattern{Constant('Firefox Browser Intrusion Prevention is malfunctioning'), Field(,false)}" -match("MESSAGE#239:Network:14", "nwparser.payload", "Firefox Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ +var part393 = match("MESSAGE#239:Network:14", "nwparser.payload", "Firefox Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ dup92, dup12, dup13, @@ -8312,8 +7729,7 @@ match("MESSAGE#239:Network:14", "nwparser.payload", "Firefox Browser Intrusion P var msg319 = msg("Network:14", part393); -var part394 = // "Pattern{Constant('Firefox Browser Intrusion Prevention disabled'), Field(p0,false)}" -match("MESSAGE#245:Network:20/0", "nwparser.payload", "Firefox Browser Intrusion Prevention disabled%{p0}"); +var part394 = match("MESSAGE#245:Network:20/0", "nwparser.payload", "Firefox Browser Intrusion Prevention disabled%{p0}"); var all118 = all_match({ processors: [ @@ -8332,8 +7748,7 @@ var all118 = all_match({ var msg320 = msg("Network:20", all118); -var part395 = // "Pattern{Constant('Firefox Browser Intrusion Prevention enabled'), Field(p0,false)}" -match("MESSAGE#252:Network:26/0", "nwparser.payload", "Firefox Browser Intrusion Prevention enabled%{p0}"); +var part395 = match("MESSAGE#252:Network:26/0", "nwparser.payload", "Firefox Browser Intrusion Prevention enabled%{p0}"); var all119 = all_match({ processors: [ @@ -8359,8 +7774,7 @@ var select67 = linear_select([ msg321, ]); -var part396 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention is malfunctioning'), Field(,false)}" -match("MESSAGE#240:Network:15", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ +var part396 = match("MESSAGE#240:Network:15", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention is malfunctioning%{}", processor_chain([ dup92, dup12, dup13, @@ -8372,8 +7786,7 @@ match("MESSAGE#240:Network:15", "nwparser.payload", "Internet Explorer Browser I var msg322 = msg("Network:15", part396); -var part397 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention enabled'), Field(p0,false)}" -match("MESSAGE#248:Network:22/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention enabled%{p0}"); +var part397 = match("MESSAGE#248:Network:22/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention enabled%{p0}"); var all120 = all_match({ processors: [ @@ -8393,8 +7806,7 @@ var all120 = all_match({ var msg323 = msg("Network:22", all120); -var part398 = // "Pattern{Constant('Internet Explorer Browser Intrusion Prevention disabled'), Field(p0,false)}" -match("MESSAGE#249:Network:23/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention disabled%{p0}"); +var part398 = match("MESSAGE#249:Network:23/0", "nwparser.payload", "Internet Explorer Browser Intrusion Prevention disabled%{p0}"); var all121 = all_match({ processors: [ @@ -8419,17 +7831,13 @@ var select68 = linear_select([ msg324, ]); -var part399 = // "Pattern{Constant('Generic Exploit Mitigation '), Field(p0,false)}" -match("MESSAGE#255:Network:29/0", "nwparser.payload", "Generic Exploit Mitigation %{p0}"); +var part399 = match("MESSAGE#255:Network:29/0", "nwparser.payload", "Generic Exploit Mitigation %{p0}"); -var part400 = // "Pattern{Constant('enabled'), Field(p0,false)}" -match("MESSAGE#255:Network:29/1_0", "nwparser.p0", "enabled%{p0}"); +var part400 = match("MESSAGE#255:Network:29/1_0", "nwparser.p0", "enabled%{p0}"); -var part401 = // "Pattern{Constant('disabled'), Field(p0,false)}" -match("MESSAGE#255:Network:29/1_1", "nwparser.p0", "disabled%{p0}"); +var part401 = match("MESSAGE#255:Network:29/1_1", "nwparser.p0", "disabled%{p0}"); -var part402 = // "Pattern{Constant('is malfunctioning'), Field(p0,false)}" -match("MESSAGE#255:Network:29/1_2", "nwparser.p0", "is malfunctioning%{p0}"); +var part402 = match("MESSAGE#255:Network:29/1_2", "nwparser.p0", "is malfunctioning%{p0}"); var select69 = linear_select([ part400, @@ -8437,8 +7845,7 @@ var select69 = linear_select([ part402, ]); -var part403 = // "Pattern{Constant(',Event time: '), Field(event_time_string,false)}" -match("MESSAGE#255:Network:29/2", "nwparser.p0", ",Event time: %{event_time_string}"); +var part403 = match("MESSAGE#255:Network:29/2", "nwparser.p0", ",Event time: %{event_time_string}"); var all122 = all_match({ processors: [ @@ -8458,8 +7865,7 @@ var all122 = all_match({ var msg325 = msg("Network:29", all122); -var part404 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Generic Exploit Mitigation Syste,Already running process (PID:'), Field(process_id,false), Constant(') ''), Field(process,false), Constant('' is affected by a change to the application rules.,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#256:Network:31", "nwparser.payload", "Category: %{fld22},Generic Exploit Mitigation Syste,Already running process (PID:%{process_id}) '%{process}' is affected by a change to the application rules.,Event time: %{event_time_string}", processor_chain([ +var part404 = match("MESSAGE#256:Network:31", "nwparser.payload", "Category: %{fld22},Generic Exploit Mitigation Syste,Already running process (PID:%{process_id}) '%{process}' is affected by a change to the application rules.,Event time: %{event_time_string}", processor_chain([ dup92, dup12, dup13, @@ -8475,8 +7881,7 @@ var select70 = linear_select([ msg326, ]); -var part405 = // "Pattern{Field(event_description,false), Constant(',Event time: '), Field(event_time_string,false)}" -match("MESSAGE#258:Network:32", "nwparser.payload", "%{event_description},Event time: %{event_time_string}", processor_chain([ +var part405 = match("MESSAGE#258:Network:32", "nwparser.payload", "%{event_description},Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -8486,14 +7891,11 @@ match("MESSAGE#258:Network:32", "nwparser.payload", "%{event_description},Event var msg327 = msg("Network:32", part405); -var part406 = // "Pattern{Constant('New virus definition file loaded. Version: '), Field(p0,false)}" -match("MESSAGE#259:New/0", "nwparser.payload", "New virus definition file loaded. Version: %{p0}"); +var part406 = match("MESSAGE#259:New/0", "nwparser.payload", "New virus definition file loaded. Version: %{p0}"); -var part407 = // "Pattern{Field(version,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#259:New/1_0", "nwparser.p0", "%{version},Event time:%{fld17->} %{fld18}"); +var part407 = match("MESSAGE#259:New/1_0", "nwparser.p0", "%{version},Event time:%{fld17->} %{fld18}"); -var part408 = // "Pattern{Field(version,false)}" -match_copy("MESSAGE#259:New/1_1", "nwparser.p0", "version"); +var part408 = match_copy("MESSAGE#259:New/1_1", "nwparser.p0", "version"); var select71 = linear_select([ part407, @@ -8522,8 +7924,7 @@ var all123 = all_match({ var msg328 = msg("New", all123); -var part409 = // "Pattern{Constant('New Value ''), Field(change_attribute,false), Constant('' = ''), Field(change_new,false), Constant('''), Field(p0,false)}" -match("MESSAGE#260:New:01/0", "nwparser.payload", "New Value '%{change_attribute}' = '%{change_new}'%{p0}"); +var part409 = match("MESSAGE#260:New:01/0", "nwparser.payload", "New Value '%{change_attribute}' = '%{change_new}'%{p0}"); var all124 = all_match({ processors: [ @@ -8547,8 +7948,7 @@ var all124 = all_match({ var msg329 = msg("New:01", all124); -var part410 = // "Pattern{Constant('New AgentGUID = '), Field(fld22,false)}" -match("MESSAGE#261:New:02", "nwparser.payload", "New AgentGUID = %{fld22}", processor_chain([ +var part410 = match("MESSAGE#261:New:02", "nwparser.payload", "New AgentGUID = %{fld22}", processor_chain([ dup43, dup12, dup13, @@ -8560,8 +7960,7 @@ match("MESSAGE#261:New:02", "nwparser.payload", "New AgentGUID = %{fld22}", proc var msg330 = msg("New:02", part410); -var part411 = // "Pattern{Constant('New policy has been imported.'), Field(,false)}" -match("MESSAGE#262:New:03", "nwparser.payload", "New policy has been imported.%{}", processor_chain([ +var part411 = match("MESSAGE#262:New:03", "nwparser.payload", "New policy has been imported.%{}", processor_chain([ dup43, dup12, dup13, @@ -8573,11 +7972,9 @@ match("MESSAGE#262:New:03", "nwparser.payload", "New policy has been imported.%{ var msg331 = msg("New:03", part411); -var part412 = // "Pattern{Constant('New content update failed to download from the management server. Remote file path: '), Field(p0,false)}" -match("MESSAGE#263:New:04/0", "nwparser.payload", "New content update failed to download from the management server. Remote file path: %{p0}"); +var part412 = match("MESSAGE#263:New:04/0", "nwparser.payload", "New content update failed to download from the management server. Remote file path: %{p0}"); -var part413 = // "Pattern{Field(url,false), Constant(',Event time: '), Field(event_time_string,false)}" -match("MESSAGE#263:New:04/1_0", "nwparser.p0", "%{url},Event time: %{event_time_string}"); +var part413 = match("MESSAGE#263:New:04/1_0", "nwparser.p0", "%{url},Event time: %{event_time_string}"); var select72 = linear_select([ part413, @@ -8602,8 +7999,7 @@ var all125 = all_match({ var msg332 = msg("New:04", all125); -var part414 = // "Pattern{Constant('New content update failed to download from Group Update Provider. Remote file path: '), Field(url,false)}" -match("MESSAGE#264:New:05", "nwparser.payload", "New content update failed to download from Group Update Provider. Remote file path: %{url}", processor_chain([ +var part414 = match("MESSAGE#264:New:05", "nwparser.payload", "New content update failed to download from Group Update Provider. Remote file path: %{url}", processor_chain([ dup43, dup12, dup13, @@ -8624,8 +8020,7 @@ var select73 = linear_select([ msg333, ]); -var part415 = // "Pattern{Constant('No '), Field(virusname,true), Constant(' virus found events got swept.')}" -match("MESSAGE#265:No", "nwparser.payload", "No %{virusname->} virus found events got swept.", processor_chain([ +var part415 = match("MESSAGE#265:No", "nwparser.payload", "No %{virusname->} virus found events got swept.", processor_chain([ dup43, dup12, dup13, @@ -8637,8 +8032,7 @@ match("MESSAGE#265:No", "nwparser.payload", "No %{virusname->} virus found event var msg334 = msg("No", part415); -var part416 = // "Pattern{Constant('No clients got swept.'), Field(,false)}" -match("MESSAGE#266:No:01", "nwparser.payload", "No clients got swept.%{}", processor_chain([ +var part416 = match("MESSAGE#266:No:01", "nwparser.payload", "No clients got swept.%{}", processor_chain([ dup43, dup15, setc("event_description","No clients got swept."), @@ -8646,8 +8040,7 @@ match("MESSAGE#266:No:01", "nwparser.payload", "No clients got swept.%{}", proce var msg335 = msg("No:01", part416); -var part417 = // "Pattern{Constant('No objects got swept.'), Field(,false)}" -match("MESSAGE#267:No:02", "nwparser.payload", "No objects got swept.%{}", processor_chain([ +var part417 = match("MESSAGE#267:No:02", "nwparser.payload", "No objects got swept.%{}", processor_chain([ dup43, dup15, dup218, @@ -8655,8 +8048,7 @@ match("MESSAGE#267:No:02", "nwparser.payload", "No objects got swept.%{}", proce var msg336 = msg("No:02", part417); -var part418 = // "Pattern{Constant('No clients got swept [Domain: '), Field(sdomain,false), Constant('].')}" -match("MESSAGE#268:No:06", "nwparser.payload", "No clients got swept [Domain: %{sdomain}].", processor_chain([ +var part418 = match("MESSAGE#268:No:06", "nwparser.payload", "No clients got swept [Domain: %{sdomain}].", processor_chain([ dup43, dup12, dup13, @@ -8666,8 +8058,7 @@ match("MESSAGE#268:No:06", "nwparser.payload", "No clients got swept [Domain: %{ var msg337 = msg("No:06", part418); -var part419 = // "Pattern{Constant('No old risk events got swept.'), Field(,false)}" -match("MESSAGE#269:No:03", "nwparser.payload", "No old risk events got swept.%{}", processor_chain([ +var part419 = match("MESSAGE#269:No:03", "nwparser.payload", "No old risk events got swept.%{}", processor_chain([ dup43, dup15, setc("event_description","No old risk events got swept."), @@ -8675,8 +8066,7 @@ match("MESSAGE#269:No:03", "nwparser.payload", "No old risk events got swept.%{} var msg338 = msg("No:03", part419); -var part420 = // "Pattern{Constant('No physical files got swept.'), Field(,false)}" -match("MESSAGE#270:No:04", "nwparser.payload", "No physical files got swept.%{}", processor_chain([ +var part420 = match("MESSAGE#270:No:04", "nwparser.payload", "No physical files got swept.%{}", processor_chain([ dup43, dup15, setc("event_description","No physical files got swept."), @@ -8684,8 +8074,7 @@ match("MESSAGE#270:No:04", "nwparser.payload", "No physical files got swept.%{}" var msg339 = msg("No:04", part420); -var part421 = // "Pattern{Constant('No risk events from deleted clients got swept.'), Field(,false)}" -match("MESSAGE#271:No:05", "nwparser.payload", "No risk events from deleted clients got swept.%{}", processor_chain([ +var part421 = match("MESSAGE#271:No:05", "nwparser.payload", "No risk events from deleted clients got swept.%{}", processor_chain([ dup43, dup15, setc("event_description","No risk events from deleted clients got swept."), @@ -8693,8 +8082,7 @@ match("MESSAGE#271:No:05", "nwparser.payload", "No risk events from deleted clie var msg340 = msg("No:05", part421); -var part422 = // "Pattern{Constant('No updates found for '), Field(application,false), Constant('.')}" -match("MESSAGE#272:No:07", "nwparser.payload", "No updates found for %{application}.", processor_chain([ +var part422 = match("MESSAGE#272:No:07", "nwparser.payload", "No updates found for %{application}.", processor_chain([ dup43, dup12, dup13, @@ -8715,8 +8103,7 @@ var select74 = linear_select([ msg341, ]); -var part423 = // "Pattern{Constant('Organization Unit or Container importing finished successfully'), Field(,false)}" -match("MESSAGE#273:Organization:03", "nwparser.payload", "Organization Unit or Container importing finished successfully%{}", processor_chain([ +var part423 = match("MESSAGE#273:Organization:03", "nwparser.payload", "Organization Unit or Container importing finished successfully%{}", processor_chain([ dup53, dup12, dup13, @@ -8727,8 +8114,7 @@ match("MESSAGE#273:Organization:03", "nwparser.payload", "Organization Unit or C var msg342 = msg("Organization:03", part423); -var part424 = // "Pattern{Constant('Organization Unit or Container importing started'), Field(,false)}" -match("MESSAGE#274:Organization:02", "nwparser.payload", "Organization Unit or Container importing started%{}", processor_chain([ +var part424 = match("MESSAGE#274:Organization:02", "nwparser.payload", "Organization Unit or Container importing started%{}", processor_chain([ dup53, dup12, dup13, @@ -8739,8 +8125,7 @@ match("MESSAGE#274:Organization:02", "nwparser.payload", "Organization Unit or C var msg343 = msg("Organization:02", part424); -var part425 = // "Pattern{Constant('Organization importing finished successfully'), Field(,false)}" -match("MESSAGE#275:Organization:01", "nwparser.payload", "Organization importing finished successfully%{}", processor_chain([ +var part425 = match("MESSAGE#275:Organization:01", "nwparser.payload", "Organization importing finished successfully%{}", processor_chain([ dup53, dup12, dup13, @@ -8751,8 +8136,7 @@ match("MESSAGE#275:Organization:01", "nwparser.payload", "Organization importing var msg344 = msg("Organization:01", part425); -var part426 = // "Pattern{Constant('Organization importing started'), Field(,false)}" -match("MESSAGE#276:Organization", "nwparser.payload", "Organization importing started%{}", processor_chain([ +var part426 = match("MESSAGE#276:Organization", "nwparser.payload", "Organization importing started%{}", processor_chain([ dup53, dup12, dup13, @@ -8770,8 +8154,7 @@ var select75 = linear_select([ msg345, ]); -var part427 = // "Pattern{Constant('Number of '), Field(virusname,true), Constant(' virus found events swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#277:Number:01", "nwparser.payload", "Number of %{virusname->} virus found events swept: %{dclass_counter1}", processor_chain([ +var part427 = match("MESSAGE#277:Number:01", "nwparser.payload", "Number of %{virusname->} virus found events swept: %{dclass_counter1}", processor_chain([ dup43, dup152, dup15, @@ -8781,8 +8164,7 @@ match("MESSAGE#277:Number:01", "nwparser.payload", "Number of %{virusname->} vir var msg346 = msg("Number:01", part427); -var part428 = // "Pattern{Constant('Number of virus definition records swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#278:Number", "nwparser.payload", "Number of virus definition records swept: %{dclass_counter1}", processor_chain([ +var part428 = match("MESSAGE#278:Number", "nwparser.payload", "Number of virus definition records swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8794,8 +8176,7 @@ match("MESSAGE#278:Number", "nwparser.payload", "Number of virus definition reco var msg347 = msg("Number", part428); -var part429 = // "Pattern{Constant('Number of scan events swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#279:Number:02", "nwparser.payload", "Number of scan events swept: %{dclass_counter1}", processor_chain([ +var part429 = match("MESSAGE#279:Number:02", "nwparser.payload", "Number of scan events swept: %{dclass_counter1}", processor_chain([ dup43, dup15, setc("event_description","Number of scan events swept."), @@ -8804,8 +8185,7 @@ match("MESSAGE#279:Number:02", "nwparser.payload", "Number of scan events swept: var msg348 = msg("Number:02", part429); -var part430 = // "Pattern{Constant('Number of clients swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#280:Number:04", "nwparser.payload", "Number of clients swept: %{dclass_counter1}", processor_chain([ +var part430 = match("MESSAGE#280:Number:04", "nwparser.payload", "Number of clients swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8816,8 +8196,7 @@ match("MESSAGE#280:Number:04", "nwparser.payload", "Number of clients swept: %{d var msg349 = msg("Number:04", part430); -var part431 = // "Pattern{Constant('Number of old risk events swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#281:Number:05", "nwparser.payload", "Number of old risk events swept: %{dclass_counter1}", processor_chain([ +var part431 = match("MESSAGE#281:Number:05", "nwparser.payload", "Number of old risk events swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8828,8 +8207,7 @@ match("MESSAGE#281:Number:05", "nwparser.payload", "Number of old risk events sw var msg350 = msg("Number:05", part431); -var part432 = // "Pattern{Constant('Number of unacknowledged notifications swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#282:Number:06", "nwparser.payload", "Number of unacknowledged notifications swept: %{dclass_counter1}", processor_chain([ +var part432 = match("MESSAGE#282:Number:06", "nwparser.payload", "Number of unacknowledged notifications swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8840,8 +8218,7 @@ match("MESSAGE#282:Number:06", "nwparser.payload", "Number of unacknowledged not var msg351 = msg("Number:06", part432); -var part433 = // "Pattern{Constant('Number of objects swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#283:Number:07", "nwparser.payload", "Number of objects swept: %{dclass_counter1}", processor_chain([ +var part433 = match("MESSAGE#283:Number:07", "nwparser.payload", "Number of objects swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8852,8 +8229,7 @@ match("MESSAGE#283:Number:07", "nwparser.payload", "Number of objects swept: %{d var msg352 = msg("Number:07", part433); -var part434 = // "Pattern{Constant('Number of risk events from deleted clients swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#284:Number:08", "nwparser.payload", "Number of risk events from deleted clients swept: %{dclass_counter1}", processor_chain([ +var part434 = match("MESSAGE#284:Number:08", "nwparser.payload", "Number of risk events from deleted clients swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8864,8 +8240,7 @@ match("MESSAGE#284:Number:08", "nwparser.payload", "Number of risk events from d var msg353 = msg("Number:08", part434); -var part435 = // "Pattern{Constant('Number of old risk events compressed: '), Field(dclass_counter1,false)}" -match("MESSAGE#285:Number:09", "nwparser.payload", "Number of old risk events compressed: %{dclass_counter1}", processor_chain([ +var part435 = match("MESSAGE#285:Number:09", "nwparser.payload", "Number of old risk events compressed: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8876,8 +8251,7 @@ match("MESSAGE#285:Number:09", "nwparser.payload", "Number of old risk events co var msg354 = msg("Number:09", part435); -var part436 = // "Pattern{Constant('Number of compressed risk events swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#286:Number:10", "nwparser.payload", "Number of compressed risk events swept: %{dclass_counter1}", processor_chain([ +var part436 = match("MESSAGE#286:Number:10", "nwparser.payload", "Number of compressed risk events swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8888,14 +8262,11 @@ match("MESSAGE#286:Number:10", "nwparser.payload", "Number of compressed risk ev var msg355 = msg("Number:10", part436); -var part437 = // "Pattern{Constant('Number of '), Field(info,true), Constant(' in the policy: '), Field(p0,false)}" -match("MESSAGE#287:Number:11/0", "nwparser.payload", "Number of %{info->} in the policy: %{p0}"); +var part437 = match("MESSAGE#287:Number:11/0", "nwparser.payload", "Number of %{info->} in the policy: %{p0}"); -var part438 = // "Pattern{Field(dclass_counter1,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#287:Number:11/1_0", "nwparser.p0", "%{dclass_counter1},Event time:%{fld17->} %{fld18}"); +var part438 = match("MESSAGE#287:Number:11/1_0", "nwparser.p0", "%{dclass_counter1},Event time:%{fld17->} %{fld18}"); -var part439 = // "Pattern{Field(dclass_counter1,false)}" -match_copy("MESSAGE#287:Number:11/1_1", "nwparser.p0", "dclass_counter1"); +var part439 = match_copy("MESSAGE#287:Number:11/1_1", "nwparser.p0", "dclass_counter1"); var select76 = linear_select([ part438, @@ -8920,8 +8291,7 @@ var all126 = all_match({ var msg356 = msg("Number:11", all126); -var part440 = // "Pattern{Constant('Number of physical files swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#288:Number:12", "nwparser.payload", "Number of physical files swept: %{dclass_counter1}", processor_chain([ +var part440 = match("MESSAGE#288:Number:12", "nwparser.payload", "Number of physical files swept: %{dclass_counter1}", processor_chain([ dup43, dup12, dup13, @@ -8932,8 +8302,7 @@ match("MESSAGE#288:Number:12", "nwparser.payload", "Number of physical files swe var msg357 = msg("Number:12", part440); -var part441 = // "Pattern{Constant('Number of '), Field(fld1,true), Constant(' swept: '), Field(dclass_counter1,false)}" -match("MESSAGE#289:Number:13", "nwparser.payload", "Number of %{fld1->} swept: %{dclass_counter1}", processor_chain([ +var part441 = match("MESSAGE#289:Number:13", "nwparser.payload", "Number of %{fld1->} swept: %{dclass_counter1}", processor_chain([ dup43, dup15, dup12, @@ -8978,8 +8347,7 @@ var select77 = linear_select([ msg358, ]); -var part442 = // "Pattern{Constant('Policy has been added,'), Field(info,false)}" -match("MESSAGE#292:Policy:added", "nwparser.payload", "Policy has been added,%{info}", processor_chain([ +var part442 = match("MESSAGE#292:Policy:added", "nwparser.payload", "Policy has been added,%{info}", processor_chain([ dup95, dup12, dup13, @@ -8994,8 +8362,7 @@ match("MESSAGE#292:Policy:added", "nwparser.payload", "Policy has been added,%{i var msg359 = msg("Policy:added", part442); -var part443 = // "Pattern{Constant('Policy has been added:'), Field(info,false)}" -match("MESSAGE#293:Policy:added_01", "nwparser.payload", "Policy has been added:%{info}", processor_chain([ +var part443 = match("MESSAGE#293:Policy:added_01", "nwparser.payload", "Policy has been added:%{info}", processor_chain([ dup95, dup12, dup13, @@ -9010,8 +8377,7 @@ match("MESSAGE#293:Policy:added_01", "nwparser.payload", "Policy has been added: var msg360 = msg("Policy:added_01", part443); -var part444 = // "Pattern{Constant('Policy has been edited,'), Field(info,false)}" -match("MESSAGE#294:Policy:edited", "nwparser.payload", "Policy has been edited,%{info}", processor_chain([ +var part444 = match("MESSAGE#294:Policy:edited", "nwparser.payload", "Policy has been edited,%{info}", processor_chain([ dup136, dup12, dup13, @@ -9026,8 +8392,7 @@ match("MESSAGE#294:Policy:edited", "nwparser.payload", "Policy has been edited,% var msg361 = msg("Policy:edited", part444); -var part445 = // "Pattern{Constant('Policy has been edited:'), Field(info,false), Constant(','), Field(fld1,false)}" -match("MESSAGE#295:Policy:edited_01", "nwparser.payload", "Policy has been edited:%{info},%{fld1}", processor_chain([ +var part445 = match("MESSAGE#295:Policy:edited_01", "nwparser.payload", "Policy has been edited:%{info},%{fld1}", processor_chain([ dup136, dup12, dup13, @@ -9042,8 +8407,7 @@ match("MESSAGE#295:Policy:edited_01", "nwparser.payload", "Policy has been edite var msg362 = msg("Policy:edited_01", part445); -var part446 = // "Pattern{Constant('Policy has been deleted'), Field(p0,false)}" -match("MESSAGE#296:Policy:deleted/0", "nwparser.payload", "Policy has been deleted%{p0}"); +var part446 = match("MESSAGE#296:Policy:deleted/0", "nwparser.payload", "Policy has been deleted%{p0}"); var select78 = linear_select([ dup226, @@ -9080,8 +8444,7 @@ var select79 = linear_select([ msg363, ]); -var part447 = // "Pattern{Constant('Potential risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Last update time: '), Field(fld53,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld100,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false), Constant(',Location:'), Field(fld55,false)}" -match("MESSAGE#297:Potential:03", "nwparser.payload", "Potential risk found,IP Address: %{saddr},Computer name: %{shost},Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld53},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld100},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{vendor_event_cat},Location:%{fld55}", processor_chain([ +var part447 = match("MESSAGE#297:Potential:03", "nwparser.payload", "Potential risk found,IP Address: %{saddr},Computer name: %{shost},Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Last update time: %{fld53},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld100},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size},Category set: %{category},Category type: %{vendor_event_cat},Location:%{fld55}", processor_chain([ dup110, dup12, dup152, @@ -9096,11 +8459,9 @@ match("MESSAGE#297:Potential:03", "nwparser.payload", "Potential risk found,IP A var msg364 = msg("Potential:03", part447); -var part448 = // "Pattern{Field(severity,false), Constant(',First Seen:'), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(',Detection Submissions No,Permitted application reason: '), Field(fld42,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#298:Potential:02/2", "nwparser.p0", "%{severity},First Seen:%{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); +var part448 = match("MESSAGE#298:Potential:02/2", "nwparser.p0", "%{severity},First Seen:%{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},COH Engine Version: %{fld41},Detection Submissions No,Permitted application reason: %{fld42},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); -var part449 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#298:Potential:02/4", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part449 = match("MESSAGE#298:Potential:02/4", "nwparser.p0", "%{fld1},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all128 = all_match({ processors: [ @@ -9126,8 +8487,7 @@ var all128 = all_match({ var msg365 = msg("Potential:02", all128); -var part450 = // "Pattern{Field(fld23,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#299:Potential/2", "nwparser.p0", "%{fld23},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var part450 = match("MESSAGE#299:Potential/2", "nwparser.p0", "%{fld23},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); var all129 = all_match({ processors: [ @@ -9156,8 +8516,7 @@ var all129 = all_match({ var msg366 = msg("Potential", all129); -var part451 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#300:Potential:01/0", "nwparser.payload", "Potential risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var part451 = match("MESSAGE#300:Potential:01/0", "nwparser.payload", "Potential risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); var all130 = all_match({ processors: [ @@ -9191,8 +8550,7 @@ var select80 = linear_select([ msg367, ]); -var part452 = // "Pattern{Constant('Previous virus definition file loaded. Version: '), Field(version,false)}" -match("MESSAGE#301:Previous", "nwparser.payload", "Previous virus definition file loaded. Version: %{version}", processor_chain([ +var part452 = match("MESSAGE#301:Previous", "nwparser.payload", "Previous virus definition file loaded. Version: %{version}", processor_chain([ dup92, dup12, dup13, @@ -9203,8 +8561,7 @@ match("MESSAGE#301:Previous", "nwparser.payload", "Previous virus definition fil var msg368 = msg("Previous", part452); -var part453 = // "Pattern{Constant('Proactive Threat Scan '), Field(info,true), Constant(' failed to update.')}" -match("MESSAGE#302:Proactive", "nwparser.payload", "Proactive Threat Scan %{info->} failed to update.", processor_chain([ +var part453 = match("MESSAGE#302:Proactive", "nwparser.payload", "Proactive Threat Scan %{info->} failed to update.", processor_chain([ setc("eventcategory","1703020000"), dup12, dup13, @@ -9215,8 +8572,7 @@ match("MESSAGE#302:Proactive", "nwparser.payload", "Proactive Threat Scan %{info var msg369 = msg("Proactive", part453); -var part454 = // "Pattern{Constant('Proactive Threat Scan whitelist '), Field(info,true), Constant(' is up-to-date.')}" -match("MESSAGE#303:Proactive:01", "nwparser.payload", "Proactive Threat Scan whitelist %{info->} is up-to-date.", processor_chain([ +var part454 = match("MESSAGE#303:Proactive:01", "nwparser.payload", "Proactive Threat Scan whitelist %{info->} is up-to-date.", processor_chain([ dup92, dup12, dup13, @@ -9227,8 +8583,7 @@ match("MESSAGE#303:Proactive:01", "nwparser.payload", "Proactive Threat Scan whi var msg370 = msg("Proactive:01", part454); -var part455 = // "Pattern{Constant('Proactive Threat Protection has been enabled'), Field(p0,false)}" -match("MESSAGE#399:Symantec:38/0", "nwparser.payload", "Proactive Threat Protection has been enabled%{p0}"); +var part455 = match("MESSAGE#399:Symantec:38/0", "nwparser.payload", "Proactive Threat Protection has been enabled%{p0}"); var all131 = all_match({ processors: [ @@ -9247,8 +8602,7 @@ var all131 = all_match({ var msg371 = msg("Symantec:38", all131); -var part456 = // "Pattern{Constant('Proactive Threat Protection has been disabled'), Field(,false)}" -match("MESSAGE#400:Symantec:42", "nwparser.payload", "Proactive Threat Protection has been disabled%{}", processor_chain([ +var part456 = match("MESSAGE#400:Symantec:42", "nwparser.payload", "Proactive Threat Protection has been disabled%{}", processor_chain([ dup43, dup56, dup12, @@ -9266,8 +8620,7 @@ var select81 = linear_select([ msg372, ]); -var part457 = // "Pattern{Constant('process '), Field(process,true), Constant(' can not lock the process status table. The process status has been locked by the server '), Field(info,true), Constant(' since '), Field(fld50,false), Constant('.')}" -match("MESSAGE#304:process", "nwparser.payload", "process %{process->} can not lock the process status table. The process status has been locked by the server %{info->} since %{fld50}.", processor_chain([ +var part457 = match("MESSAGE#304:process", "nwparser.payload", "process %{process->} can not lock the process status table. The process status has been locked by the server %{info->} since %{fld50}.", processor_chain([ dup168, dup12, dup13, @@ -9278,8 +8631,7 @@ match("MESSAGE#304:process", "nwparser.payload", "process %{process->} can not l var msg373 = msg("process", part457); -var part458 = // "Pattern{Constant('"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile.",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" -match("MESSAGE#305:process:01", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ +var part458 = match("MESSAGE#305:process:01", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ dup168, dup12, dup13, @@ -9294,8 +8646,7 @@ match("MESSAGE#305:process:01", "nwparser.payload", "\"Application has changed s var msg374 = msg("process:01", part458); -var part459 = // "Pattern{Constant('"Application has changed since the last time you opened it, process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was allowed by profile.",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" -match("MESSAGE#306:process:11", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ +var part459 = match("MESSAGE#306:process:11", "nwparser.payload", "\"Application has changed since the last time you opened it, process id: %{process_id->} Filename: %{filename->} The change was allowed by profile.\",Local: %{daddr},Local: %{fld1},Remote: %{fld25},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ dup168, dup12, dup13, @@ -9310,11 +8661,9 @@ match("MESSAGE#306:process:11", "nwparser.payload", "\"Application has changed s var msg375 = msg("process:11", part459); -var part460 = // "Pattern{Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(protocol,false), Constant(','), Field(p0,false)}" -match("MESSAGE#308:process:03/2", "nwparser.p0", ",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{p0}"); +var part460 = match("MESSAGE#308:process:03/2", "nwparser.p0", ",Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{protocol},%{p0}"); -var part461 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#308:process:03/4", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part461 = match("MESSAGE#308:process:03/4", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); var all132 = all_match({ processors: [ @@ -9372,22 +8721,18 @@ var select82 = linear_select([ msg377, ]); -var part462 = // "Pattern{Constant('properties of domain '), Field(p0,false)}" -match("MESSAGE#310:properties/0", "nwparser.payload", "properties of domain %{p0}"); +var part462 = match("MESSAGE#310:properties/0", "nwparser.payload", "properties of domain %{p0}"); -var part463 = // "Pattern{Constant('"'), Field(domain,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#310:properties/1_0", "nwparser.p0", "\"%{domain}\"%{p0}"); +var part463 = match("MESSAGE#310:properties/1_0", "nwparser.p0", "\"%{domain}\"%{p0}"); -var part464 = // "Pattern{Constant('''), Field(domain,false), Constant('''), Field(p0,false)}" -match("MESSAGE#310:properties/1_1", "nwparser.p0", "'%{domain}'%{p0}"); +var part464 = match("MESSAGE#310:properties/1_1", "nwparser.p0", "'%{domain}'%{p0}"); var select83 = linear_select([ part463, part464, ]); -var part465 = // "Pattern{Field(,false), Constant('were changed')}" -match("MESSAGE#310:properties/2", "nwparser.p0", "%{}were changed"); +var part465 = match("MESSAGE#310:properties/2", "nwparser.p0", "%{}were changed"); var all134 = all_match({ processors: [ @@ -9410,22 +8755,18 @@ var all134 = all_match({ var msg378 = msg("properties", all134); -var part466 = // "Pattern{Constant('properties for system administrator '), Field(p0,false)}" -match("MESSAGE#311:properties:01/0", "nwparser.payload", "properties for system administrator %{p0}"); +var part466 = match("MESSAGE#311:properties:01/0", "nwparser.payload", "properties for system administrator %{p0}"); -var part467 = // "Pattern{Constant('"'), Field(c_username,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#311:properties:01/1_0", "nwparser.p0", "\"%{c_username}\"%{p0}"); +var part467 = match("MESSAGE#311:properties:01/1_0", "nwparser.p0", "\"%{c_username}\"%{p0}"); -var part468 = // "Pattern{Constant('''), Field(c_username,false), Constant('''), Field(p0,false)}" -match("MESSAGE#311:properties:01/1_1", "nwparser.p0", "'%{c_username}'%{p0}"); +var part468 = match("MESSAGE#311:properties:01/1_1", "nwparser.p0", "'%{c_username}'%{p0}"); var select84 = linear_select([ part467, part468, ]); -var part469 = // "Pattern{Field(,false), Constant('have been changed')}" -match("MESSAGE#311:properties:01/2", "nwparser.p0", "%{}have been changed"); +var part469 = match("MESSAGE#311:properties:01/2", "nwparser.p0", "%{}have been changed"); var all135 = all_match({ processors: [ @@ -9453,8 +8794,7 @@ var select85 = linear_select([ msg379, ]); -var part470 = // "Pattern{Constant('PTS has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(info,false)}" -match("MESSAGE#312:PTS", "nwparser.payload", "PTS has generated an error: code %{resultcode}: description: %{info}", processor_chain([ +var part470 = match("MESSAGE#312:PTS", "nwparser.payload", "PTS has generated an error: code %{resultcode}: description: %{info}", processor_chain([ dup168, dup12, dup13, @@ -9465,11 +8805,9 @@ match("MESSAGE#312:PTS", "nwparser.payload", "PTS has generated an error: code % var msg380 = msg("PTS", part470); -var part471 = // "Pattern{Constant('Received a new policy with '), Field(p0,false)}" -match("MESSAGE#313:Received/0", "nwparser.payload", "Received a new policy with %{p0}"); +var part471 = match("MESSAGE#313:Received/0", "nwparser.payload", "Received a new policy with %{p0}"); -var part472 = // "Pattern{Field(info,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#313:Received/1_0", "nwparser.p0", "%{info},Event time: %{fld17->} %{fld18}"); +var part472 = match("MESSAGE#313:Received/1_0", "nwparser.p0", "%{info},Event time: %{fld17->} %{fld18}"); var select86 = linear_select([ part472, @@ -9494,8 +8832,7 @@ var all136 = all_match({ var msg381 = msg("Received", all136); -var part473 = // "Pattern{Constant('Received a new profile with serial number '), Field(fld23,true), Constant(' from Symantec Endpoint Protection Manager.')}" -match("MESSAGE#699:Smc:03", "nwparser.payload", "Received a new profile with serial number %{fld23->} from Symantec Endpoint Protection Manager.", processor_chain([ +var part473 = match("MESSAGE#699:Smc:03", "nwparser.payload", "Received a new profile with serial number %{fld23->} from Symantec Endpoint Protection Manager.", processor_chain([ dup53, dup94, dup13, @@ -9511,8 +8848,7 @@ var select87 = linear_select([ msg382, ]); -var part474 = // "Pattern{Constant('Reconfiguring Symantec Management Client....'), Field(,false)}" -match("MESSAGE#314:Reconfiguring", "nwparser.payload", "Reconfiguring Symantec Management Client....%{}", processor_chain([ +var part474 = match("MESSAGE#314:Reconfiguring", "nwparser.payload", "Reconfiguring Symantec Management Client....%{}", processor_chain([ dup136, dup12, dup13, @@ -9526,8 +8862,7 @@ match("MESSAGE#314:Reconfiguring", "nwparser.payload", "Reconfiguring Symantec M var msg383 = msg("Reconfiguring", part474); -var part475 = // "Pattern{Constant('Reconnected to server after server was unreacheable.'), Field(p0,false)}" -match("MESSAGE#315:Reconnected/0", "nwparser.payload", "Reconnected to server after server was unreacheable.%{p0}"); +var part475 = match("MESSAGE#315:Reconnected/0", "nwparser.payload", "Reconnected to server after server was unreacheable.%{p0}"); var all137 = all_match({ processors: [ @@ -9547,8 +8882,7 @@ var all137 = all_match({ var msg384 = msg("Reconnected", all137); -var part476 = // "Pattern{Constant('Please restart your computer to enable '), Field(info,true), Constant(' changes.'), Field(p0,false)}" -match("MESSAGE#316:restart/0", "nwparser.payload", "Please restart your computer to enable %{info->} changes.%{p0}"); +var part476 = match("MESSAGE#316:restart/0", "nwparser.payload", "Please restart your computer to enable %{info->} changes.%{p0}"); var all138 = all_match({ processors: [ @@ -9568,8 +8902,7 @@ var all138 = all_match({ var msg385 = msg("restart", all138); -var part477 = // "Pattern{Constant('Retry '), Field(info,false), Constant('"')}" -match("MESSAGE#317:Retry", "nwparser.payload", "Retry %{info}\"", processor_chain([ +var part477 = match("MESSAGE#317:Retry", "nwparser.payload", "Retry %{info}\"", processor_chain([ dup43, dup12, dup13, @@ -9580,8 +8913,7 @@ match("MESSAGE#317:Retry", "nwparser.payload", "Retry %{info}\"", processor_chai var msg386 = msg("Retry", part477); -var part478 = // "Pattern{Constant('Retry timestamp is equal or over the next schedule time, switching to regular schedule run.'), Field(,false)}" -match("MESSAGE#318:Retry:01", "nwparser.payload", "Retry timestamp is equal or over the next schedule time, switching to regular schedule run.%{}", processor_chain([ +var part478 = match("MESSAGE#318:Retry:01", "nwparser.payload", "Retry timestamp is equal or over the next schedule time, switching to regular schedule run.%{}", processor_chain([ dup43, dup15, setc("action","Retry timestamp is equal or over the next schedule time, switching to regular schedule run."), @@ -9589,8 +8921,7 @@ match("MESSAGE#318:Retry:01", "nwparser.payload", "Retry timestamp is equal or o var msg387 = msg("Retry:01", part478); -var part479 = // "Pattern{Constant('Retry timestamp is over the maximum retry window, switching to regular schedule run.'), Field(,false)}" -match("MESSAGE#319:Retry:02", "nwparser.payload", "Retry timestamp is over the maximum retry window, switching to regular schedule run.%{}", processor_chain([ +var part479 = match("MESSAGE#319:Retry:02", "nwparser.payload", "Retry timestamp is over the maximum retry window, switching to regular schedule run.%{}", processor_chain([ dup43, dup233, dup15, @@ -9604,8 +8935,7 @@ var select88 = linear_select([ msg388, ]); -var part480 = // "Pattern{Constant('Successfully downloaded the '), Field(application,true), Constant(' security definitions from LiveUpdate. The security definitions are now available for deployment.')}" -match("MESSAGE#320:Successfully", "nwparser.payload", "Successfully downloaded the %{application->} security definitions from LiveUpdate. The security definitions are now available for deployment.", processor_chain([ +var part480 = match("MESSAGE#320:Successfully", "nwparser.payload", "Successfully downloaded the %{application->} security definitions from LiveUpdate. The security definitions are now available for deployment.", processor_chain([ dup43, setc("event_description","Successfully Downloaded."), dup15, @@ -9613,8 +8943,7 @@ match("MESSAGE#320:Successfully", "nwparser.payload", "Successfully downloaded t var msg389 = msg("Successfully", part480); -var part481 = // "Pattern{Constant('Successfully deleted the client install package ''), Field(info,false), Constant(''.')}" -match("MESSAGE#321:Successfully:01", "nwparser.payload", "Successfully deleted the client install package '%{info}'.", processor_chain([ +var part481 = match("MESSAGE#321:Successfully:01", "nwparser.payload", "Successfully deleted the client install package '%{info}'.", processor_chain([ dup43, dup234, dup15, @@ -9622,8 +8951,7 @@ match("MESSAGE#321:Successfully:01", "nwparser.payload", "Successfully deleted t var msg390 = msg("Successfully:01", part481); -var part482 = // "Pattern{Constant('Successfully imported the Symantec Endpoint Protection version '), Field(version,true), Constant(' for '), Field(fld3,true), Constant(' package during the server upgrade. This package is now available for deployment.')}" -match("MESSAGE#322:Successfully:02", "nwparser.payload", "Successfully imported the Symantec Endpoint Protection version %{version->} for %{fld3->} package during the server upgrade. This package is now available for deployment.", processor_chain([ +var part482 = match("MESSAGE#322:Successfully:02", "nwparser.payload", "Successfully imported the Symantec Endpoint Protection version %{version->} for %{fld3->} package during the server upgrade. This package is now available for deployment.", processor_chain([ dup43, dup234, dup15, @@ -9637,8 +8965,7 @@ var select89 = linear_select([ msg391, ]); -var part483 = // "Pattern{Constant('Risk Repair Failed..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,true), Constant(' ..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#323:Risk:01", "nwparser.payload", "Risk Repair Failed..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7->} ..Severity: %{severity}..Source: %{product}", processor_chain([ +var part483 = match("MESSAGE#323:Risk:01", "nwparser.payload", "Risk Repair Failed..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7->} ..Severity: %{severity}..Source: %{product}", processor_chain([ dup110, dup166, dup15, @@ -9647,8 +8974,7 @@ match("MESSAGE#323:Risk:01", "nwparser.payload", "Risk Repair Failed..Computer: var msg392 = msg("Risk:01", part483); -var part484 = // "Pattern{Constant('Risk Repair Failed..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" -match("MESSAGE#324:Risk:02", "nwparser.payload", "Risk Repair Failed..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ +var part484 = match("MESSAGE#324:Risk:02", "nwparser.payload", "Risk Repair Failed..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ dup110, dup152, dup166, @@ -9658,8 +8984,7 @@ match("MESSAGE#324:Risk:02", "nwparser.payload", "Risk Repair Failed..%{shost}.. var msg393 = msg("Risk:02", part484); -var part485 = // "Pattern{Constant('Risk Repaired..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#325:Risk:03", "nwparser.payload", "Risk Repaired..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part485 = match("MESSAGE#325:Risk:03", "nwparser.payload", "Risk Repaired..Computer: %{shost}..Date: %{fld5}..Time: %{fld6->} %{fld7}..Severity: %{severity}..Source: %{product}", processor_chain([ dup110, dup166, dup15, @@ -9668,8 +8993,7 @@ match("MESSAGE#325:Risk:03", "nwparser.payload", "Risk Repaired..Computer: %{sho var msg394 = msg("Risk:03", part485); -var part486 = // "Pattern{Constant('Risk Repaired..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(action,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,true), Constant(' '), Field(fld7,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" -match("MESSAGE#326:Risk:04", "nwparser.payload", "Risk Repaired..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ +var part486 = match("MESSAGE#326:Risk:04", "nwparser.payload", "Risk Repaired..%{shost}..%{fld5}..%{filename}..%{info}..%{action}..%{severity}..%{product}..%{fld6->} %{fld7}..%{username}..%{virusname}", processor_chain([ dup110, dup152, dup166, @@ -9679,14 +9003,11 @@ match("MESSAGE#326:Risk:04", "nwparser.payload", "Risk Repaired..%{shost}..%{fld var msg395 = msg("Risk:04", part486); -var part487 = // "Pattern{Constant('Risk sample submitted to Symantec,Computer name: '), Field(p0,false)}" -match("MESSAGE#327:Risk:05/0", "nwparser.payload", "Risk sample submitted to Symantec,Computer name: %{p0}"); +var part487 = match("MESSAGE#327:Risk:05/0", "nwparser.payload", "Risk sample submitted to Symantec,Computer name: %{p0}"); -var part488 = // "Pattern{Field(event_type,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#327:Risk:05/2", "nwparser.p0", "%{event_type},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var part488 = match("MESSAGE#327:Risk:05/2", "nwparser.p0", "%{event_type},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); -var part489 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld16,true), Constant(' '), Field(fld17,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#327:Risk:05/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld16->} %{fld17},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part489 = match("MESSAGE#327:Risk:05/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld16->} %{fld17},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all139 = all_match({ processors: [ @@ -9726,8 +9047,7 @@ var select90 = linear_select([ msg396, ]); -var part490 = // "Pattern{Constant('Scan Start/Stop..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(filename,false), Constant('..'), Field(info,false), Constant('..'), Field(fld22,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false), Constant('..'), Field(virusname,false)}" -match("MESSAGE#328:Scan", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{filename}..%{info}..%{fld22}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ +var part490 = match("MESSAGE#328:Scan", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{filename}..%{info}..%{fld22}..%{severity}..%{product}..%{fld6}..%{username}..%{virusname}", processor_chain([ dup43, dup152, dup166, @@ -9737,8 +9057,7 @@ match("MESSAGE#328:Scan", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5 var msg397 = msg("Scan", part490); -var part491 = // "Pattern{Constant('Scan Start/Stop..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(info,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false), Constant('..'), Field(username,false)}" -match("MESSAGE#329:Scan:01", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{info}..%{severity}..%{product}..%{fld6}..%{username}", processor_chain([ +var part491 = match("MESSAGE#329:Scan:01", "nwparser.payload", "Scan Start/Stop..%{shost}..%{fld5}..%{info}..%{severity}..%{product}..%{fld6}..%{username}", processor_chain([ dup43, dup166, dup15, @@ -9747,8 +9066,7 @@ match("MESSAGE#329:Scan:01", "nwparser.payload", "Scan Start/Stop..%{shost}..%{f var msg398 = msg("Scan:01", part491); -var part492 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(',"'), Field(info,false), Constant('","'), Field(context,false), Constant('",Command: Not a command scan (),Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant('Domain: '), Field(domain,false), Constant('Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#330:Scan:02", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},\"%{info}\",\"%{context}\",Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr}Domain: %{domain}Group: %{group},Server: %{hostid}", processor_chain([ +var part492 = match("MESSAGE#330:Scan:02", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},\"%{info}\",\"%{context}\",Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr}Domain: %{domain}Group: %{group},Server: %{hostid}", processor_chain([ dup43, dup12, dup14, @@ -9762,8 +9080,7 @@ match("MESSAGE#330:Scan:02", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld var msg399 = msg("Scan:02", part492); -var part493 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld1,false), Constant(',End: '), Field(fld2,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(','), Field(fld22,false), Constant(',,Command: '), Field(fld4,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(fld5,false), Constant(',Omitted: '), Field(fld21,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',"Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#331:Scan:09", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{fld22},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},\"Group: %{group},Server: %{hostid}", processor_chain([ +var part493 = match("MESSAGE#331:Scan:09", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{fld22},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},\"Group: %{group},Server: %{hostid}", processor_chain([ dup43, dup12, dup14, @@ -9777,11 +9094,9 @@ match("MESSAGE#331:Scan:09", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld var msg400 = msg("Scan:09", part493); -var part494 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld22,false), Constant(','), Field(info,false), Constant(',Command: Not a command scan (),Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld21,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" -match("MESSAGE#332:Scan:03/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld22},%{info},Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld21}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},%{p0}"); +var part494 = match("MESSAGE#332:Scan:03/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld22},%{info},Command: Not a command scan (),Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld21}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},%{p0}"); -var part495 = // "Pattern{Field(hostid,false)}" -match_copy("MESSAGE#332:Scan:03/2", "nwparser.p0", "hostid"); +var part495 = match_copy("MESSAGE#332:Scan:03/2", "nwparser.p0", "hostid"); var all140 = all_match({ processors: [ @@ -9804,8 +9119,7 @@ var all140 = all_match({ var msg401 = msg("Scan:03", all140); -var part496 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld1,false), Constant(',End: '), Field(fld2,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(',Files scanned: '), Field(dclass_counter2,false), Constant(',,Command: '), Field(fld4,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(fld5,false), Constant(',Omitted: '), Field(fld21,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#333:Scan:08", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},Files scanned: %{dclass_counter2},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}", processor_chain([ +var part496 = match("MESSAGE#333:Scan:08", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld1},End: %{fld2},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},Files scanned: %{dclass_counter2},,Command: %{fld4},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{fld5},Omitted: %{fld21},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}", processor_chain([ dup43, dup12, dup14, @@ -9819,14 +9133,11 @@ match("MESSAGE#333:Scan:08", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld var msg402 = msg("Scan:08", part496); -var part497 = // "Pattern{Constant('Scan Delayed: Risks: '), Field(dclass_counter1,true), Constant(' Scanned: '), Field(dclass_counter2,true), Constant(' Files/Folders/Drives Omitted: '), Field(p0,false)}" -match("MESSAGE#334:Scan:04/0", "nwparser.payload", "Scan Delayed: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{p0}"); +var part497 = match("MESSAGE#334:Scan:04/0", "nwparser.payload", "Scan Delayed: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{p0}"); -var part498 = // "Pattern{Field(dclass_counter3,true), Constant(' Trusted Files Skipped: '), Field(fld1,false)}" -match("MESSAGE#334:Scan:04/1_0", "nwparser.p0", "%{dclass_counter3->} Trusted Files Skipped: %{fld1}"); +var part498 = match("MESSAGE#334:Scan:04/1_0", "nwparser.p0", "%{dclass_counter3->} Trusted Files Skipped: %{fld1}"); -var part499 = // "Pattern{Field(dclass_counter3,false)}" -match_copy("MESSAGE#334:Scan:04/1_1", "nwparser.p0", "dclass_counter3"); +var part499 = match_copy("MESSAGE#334:Scan:04/1_1", "nwparser.p0", "dclass_counter3"); var select91 = linear_select([ part498, @@ -9855,8 +9166,7 @@ var all141 = all_match({ var msg403 = msg("Scan:04", all141); -var part500 = // "Pattern{Field(action,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant(': Risks: '), Field(dclass_counter1,true), Constant(' Scanned: '), Field(dclass_counter2,true), Constant(' Files/Folders/Drives Omitted: '), Field(dclass_counter3,false), Constant('..Time: '), Field(fld6,true), Constant(' '), Field(fld4,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#335:Scan:05", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{dclass_counter3}..Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part500 = match("MESSAGE#335:Scan:05", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}: Risks: %{dclass_counter1->} Scanned: %{dclass_counter2->} Files/Folders/Drives Omitted: %{dclass_counter3}..Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ dup43, dup166, dup15, @@ -9867,8 +9177,7 @@ match("MESSAGE#335:Scan:05", "nwparser.payload", "%{action}..Computer: %{shost}. var msg404 = msg("Scan:05", part500); -var part501 = // "Pattern{Field(action,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Description: '), Field(event_description,false), Constant('...Time: '), Field(fld6,true), Constant(' '), Field(fld4,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#336:Scan:06", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}...Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part501 = match("MESSAGE#336:Scan:06", "nwparser.payload", "%{action}..Computer: %{shost}..Date: %{fld5}..Description: %{event_description}...Time: %{fld6->} %{fld4}..Severity: %{severity}..Source: %{product}", processor_chain([ dup43, dup166, dup15, @@ -9876,8 +9185,7 @@ match("MESSAGE#336:Scan:06", "nwparser.payload", "%{action}..Computer: %{shost}. var msg405 = msg("Scan:06", part501); -var part502 = // "Pattern{Constant('Scan started on all drives and all extensions.'), Field(,false)}" -match("MESSAGE#337:Scan:07", "nwparser.payload", "Scan started on all drives and all extensions.%{}", processor_chain([ +var part502 = match("MESSAGE#337:Scan:07", "nwparser.payload", "Scan started on all drives and all extensions.%{}", processor_chain([ dup43, dup12, dup13, @@ -9888,8 +9196,7 @@ match("MESSAGE#337:Scan:07", "nwparser.payload", "Scan started on all drives and var msg406 = msg("Scan:07", part502); -var part503 = // "Pattern{Constant('Scan Suspended: '), Field(info,false)}" -match("MESSAGE#338:Scan:11", "nwparser.payload", "Scan Suspended: %{info}", processor_chain([ +var part503 = match("MESSAGE#338:Scan:11", "nwparser.payload", "Scan Suspended: %{info}", processor_chain([ dup43, dup12, dup13, @@ -9900,8 +9207,7 @@ match("MESSAGE#338:Scan:11", "nwparser.payload", "Scan Suspended: %{info}", proc var msg407 = msg("Scan:11", part503); -var part504 = // "Pattern{Constant('Scan resumed on all drives and all extensions.'), Field(,false)}" -match("MESSAGE#339:Scan:10", "nwparser.payload", "Scan resumed on all drives and all extensions.%{}", processor_chain([ +var part504 = match("MESSAGE#339:Scan:10", "nwparser.payload", "Scan resumed on all drives and all extensions.%{}", processor_chain([ dup43, dup12, dup13, @@ -9912,11 +9218,9 @@ match("MESSAGE#339:Scan:10", "nwparser.payload", "Scan resumed on all drives and var msg408 = msg("Scan:10", part504); -var part505 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(uid,false), Constant(',User2: '), Field(fld3,false), Constant(',''), Field(info,false), Constant('','), Field(p0,false)}" -match("MESSAGE#340:Scan:12/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2: %{fld3},'%{info}',%{p0}"); +var part505 = match("MESSAGE#340:Scan:12/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2: %{fld3},'%{info}',%{p0}"); -var part506 = // "Pattern{Constant('Command: Update Content and Scan Active,Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#340:Scan:12/2", "nwparser.p0", "Command: Update Content and Scan Active,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); +var part506 = match("MESSAGE#340:Scan:12/2", "nwparser.p0", "Command: Update Content and Scan Active,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); var all142 = all_match({ processors: [ @@ -9939,11 +9243,9 @@ var all142 = all_match({ var msg409 = msg("Scan:12", all142); -var part507 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End:'), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(uid,false), Constant(',User2:'), Field(fld3,false), Constant(',''), Field(info,false), Constant('','), Field(p0,false)}" -match("MESSAGE#341:Scan:13/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End:%{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2:%{fld3},'%{info}',%{p0}"); +var part507 = match("MESSAGE#341:Scan:13/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End:%{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{uid},User2:%{fld3},'%{info}',%{p0}"); -var part508 = // "Pattern{Constant('Command: Full Scan,Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant('Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#341:Scan:13/2", "nwparser.p0", "Command: Full Scan,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); +var part508 = match("MESSAGE#341:Scan:13/2", "nwparser.p0", "Command: Full Scan,Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4}Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); var all143 = all_match({ processors: [ @@ -9966,33 +9268,27 @@ var all143 = all_match({ var msg410 = msg("Scan:13", all143); -var part509 = // "Pattern{Constant('Scan ID: '), Field(fld11,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,false), Constant(','), Field(disposition,false), Constant(',Duration (seconds): '), Field(duration_string,false), Constant(',User1: '), Field(username,false), Constant(',User2: '), Field(fld3,false), Constant(','), Field(p0,false)}" -match("MESSAGE#342:Scan:14/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{p0}"); +var part509 = match("MESSAGE#342:Scan:14/0", "nwparser.payload", "Scan ID: %{fld11},Begin: %{fld50->} %{fld52},End: %{fld51},%{disposition},Duration (seconds): %{duration_string},User1: %{username},User2: %{fld3},%{p0}"); -var part510 = // "Pattern{Field(info,false), Constant('","'), Field(p0,false)}" -match("MESSAGE#342:Scan:14/2_0", "nwparser.p0", "%{info}\",\"%{p0}"); +var part510 = match("MESSAGE#342:Scan:14/2_0", "nwparser.p0", "%{info}\",\"%{p0}"); -var part511 = // "Pattern{Field(info,false), Constant(','), Field(p0,false)}" -match("MESSAGE#342:Scan:14/2_1", "nwparser.p0", "%{info},%{p0}"); +var part511 = match("MESSAGE#342:Scan:14/2_1", "nwparser.p0", "%{info},%{p0}"); var select92 = linear_select([ part510, part511, ]); -var part512 = // "Pattern{Field(context,false), Constant('",'), Field(p0,false)}" -match("MESSAGE#342:Scan:14/3_0", "nwparser.p0", "%{context}\",%{p0}"); +var part512 = match("MESSAGE#342:Scan:14/3_0", "nwparser.p0", "%{context}\",%{p0}"); -var part513 = // "Pattern{Field(context,false), Constant(','), Field(p0,false)}" -match("MESSAGE#342:Scan:14/3_1", "nwparser.p0", "%{context},%{p0}"); +var part513 = match("MESSAGE#342:Scan:14/3_1", "nwparser.p0", "%{context},%{p0}"); var select93 = linear_select([ part512, part513, ]); -var part514 = // "Pattern{Constant('Command: '), Field(fld10,false), Constant(',Threats: '), Field(dclass_counter3,false), Constant(',Infected: '), Field(dclass_counter1,false), Constant(',Total files: '), Field(dclass_counter2,false), Constant(',Omitted: '), Field(fld4,false), Constant(',Computer: '), Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false)}" -match("MESSAGE#342:Scan:14/4", "nwparser.p0", "Command: %{fld10},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); +var part514 = match("MESSAGE#342:Scan:14/4", "nwparser.p0", "Command: %{fld10},Threats: %{dclass_counter3},Infected: %{dclass_counter1},Total files: %{dclass_counter2},Omitted: %{fld4},Computer: %{shost},IP Address: %{saddr},Domain: %{domain},Group: %{group},Server: %{hostid}"); var all144 = all_match({ processors: [ @@ -10035,8 +9331,7 @@ var select94 = linear_select([ msg411, ]); -var part515 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#343:Security:03/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part515 = match("MESSAGE#343:Security:03/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all145 = all_match({ processors: [ @@ -10088,33 +9383,27 @@ var all146 = all_match({ var msg413 = msg("Security:06", all146); -var part516 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Cookie:'), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Last update time: '), Field(fld57,false), Constant(',Domain: '), Field(domain,true), Constant(' ,'), Field(p0,false)}" -match("MESSAGE#345:Security:05/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie:%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain->} ,%{p0}"); +var part516 = match("MESSAGE#345:Security:05/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie:%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain->} ,%{p0}"); -var part517 = // "Pattern{Constant('" '), Field(p0,false)}" -match("MESSAGE#345:Security:05/3_0", "nwparser.p0", "\" %{p0}"); +var part517 = match("MESSAGE#345:Security:05/3_0", "nwparser.p0", "\" %{p0}"); var select95 = linear_select([ part517, dup194, ]); -var part518 = // "Pattern{Constant('Group: '), Field(group,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#345:Security:05/4", "nwparser.p0", "Group: %{group->} %{p0}"); +var part518 = match("MESSAGE#345:Security:05/4", "nwparser.p0", "Group: %{group->} %{p0}"); -var part519 = // "Pattern{Constant('", '), Field(p0,false)}" -match("MESSAGE#345:Security:05/5_0", "nwparser.p0", "\", %{p0}"); +var part519 = match("MESSAGE#345:Security:05/5_0", "nwparser.p0", "\", %{p0}"); -var part520 = // "Pattern{Constant(', '), Field(p0,false)}" -match("MESSAGE#345:Security:05/5_1", "nwparser.p0", ", %{p0}"); +var part520 = match("MESSAGE#345:Security:05/5_1", "nwparser.p0", ", %{p0}"); var select96 = linear_select([ part519, part520, ]); -var part521 = // "Pattern{Constant('Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(', File size (bytes): '), Field(p0,false)}" -match("MESSAGE#345:Security:05/6", "nwparser.p0", "Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); +var part521 = match("MESSAGE#345:Security:05/6", "nwparser.p0", "Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); var all147 = all_match({ processors: [ @@ -10146,8 +9435,7 @@ var all147 = all_match({ var msg414 = msg("Security:05", all147); -var part522 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(',0,Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(filename_size,false)}" -match("MESSAGE#346:Security:04", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}", processor_chain([ +var part522 = match("MESSAGE#346:Security:04", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},0,Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{filename_size}", processor_chain([ dup110, dup12, dup115, @@ -10165,8 +9453,7 @@ match("MESSAGE#346:Security:04", "nwparser.payload", "Security risk found,IP Add var msg415 = msg("Security:04", part522); -var part523 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Last update time: '), Field(fld57,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(', File size (bytes): '), Field(p0,false)}" -match("MESSAGE#347:Security:07/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); +var part523 = match("MESSAGE#347:Security:07/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Last update time: %{fld57},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type}, File size (bytes): %{p0}"); var all148 = all_match({ processors: [ @@ -10194,19 +9481,16 @@ var all148 = all_match({ var msg416 = msg("Security:07", all148); -var part524 = // "Pattern{Constant('Security risk found,Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#348:Security:13/0", "nwparser.payload", "Security risk found,Computer name: %{shost},%{p0}"); +var part524 = match("MESSAGE#348:Security:13/0", "nwparser.payload", "Security risk found,Computer name: %{shost},%{p0}"); -var part525 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(','), Field(p0,false)}" -match("MESSAGE#348:Security:13/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},%{p0}"); +var part525 = match("MESSAGE#348:Security:13/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},%{p0}"); var select97 = linear_select([ part525, dup77, ]); -var part526 = // "Pattern{Constant('IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(severity,false), Constant(',First Seen: '), Field(fld1,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,true), Constant(' ,Hash type: '), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld3,true), Constant(' ,File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld4,false), Constant(',Detection score: '), Field(fld5,false), Constant(',COH Engine Version: '), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',Permitted application reason: '), Field(fld8,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld10,false), Constant(',Web domain:'), Field(fld11,true), Constant(' ,Downloaded by: '), Field(fld12,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld15,false), Constant(',Risk Level: '), Field(fld16,false), Constant(',Risk type: '), Field(fld17,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name:'), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld18,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld19,true), Constant(' '), Field(fld20,false), Constant(',Inserted: '), Field(fld21,false), Constant(',End: '), Field(fld22,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld23,false), Constant(',Source IP: '), Field(fld24,false)}" -match("MESSAGE#348:Security:13/2", "nwparser.p0", "IP Address: %{saddr},Detection type: %{severity},First Seen: %{fld1},Application name: %{application},Application type: %{obj_type},Application version:%{version->} ,Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld3->} ,File size (bytes): %{filename_size},Sensitivity: %{fld4},Detection score: %{fld5},COH Engine Version: %{fld6},%{fld7},Permitted application reason: %{fld8},Disposition: %{result},Download site: %{fld10},Web domain:%{fld11->} ,Downloaded by: %{fld12},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld15},Risk Level: %{fld16},Risk type: %{fld17},Source: %{event_source},Risk name:%{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld18},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld19->} %{fld20},Inserted: %{fld21},End: %{fld22},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld23},Source IP: %{fld24}"); +var part526 = match("MESSAGE#348:Security:13/2", "nwparser.p0", "IP Address: %{saddr},Detection type: %{severity},First Seen: %{fld1},Application name: %{application},Application type: %{obj_type},Application version:%{version->} ,Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld3->} ,File size (bytes): %{filename_size},Sensitivity: %{fld4},Detection score: %{fld5},COH Engine Version: %{fld6},%{fld7},Permitted application reason: %{fld8},Disposition: %{result},Download site: %{fld10},Web domain:%{fld11->} ,Downloaded by: %{fld12},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld15},Risk Level: %{fld16},Risk type: %{fld17},Source: %{event_source},Risk name:%{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld18},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld19->} %{fld20},Inserted: %{fld21},End: %{fld22},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld23},Source IP: %{fld24}"); var all149 = all_match({ processors: [ @@ -10249,8 +9533,7 @@ var all149 = all_match({ var msg417 = msg("Security:13", all149); -var part527 = // "Pattern{Constant('Security risk found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#349:Security", "nwparser.payload", "Security risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ +var part527 = match("MESSAGE#349:Security", "nwparser.payload", "Security risk found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ dup110, dup12, dup115, @@ -10268,8 +9551,7 @@ match("MESSAGE#349:Security", "nwparser.payload", "Security risk found,Computer var msg418 = msg("Security", part527); -var part528 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Cookie: '), Field(fld1,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" -match("MESSAGE#350:Security:01", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie: %{fld1},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ +var part528 = match("MESSAGE#350:Security:01", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},Cookie: %{fld1},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ dup110, dup12, dup115, @@ -10286,8 +9568,7 @@ match("MESSAGE#350:Security:01", "nwparser.payload", "Security risk found,IP Add var msg419 = msg("Security:01", part528); -var part529 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" -match("MESSAGE#351:Security:02", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ +var part529 = match("MESSAGE#351:Security:02", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ dup110, dup12, dup115, @@ -10317,8 +9598,7 @@ var select98 = linear_select([ msg420, ]); -var part530 = // "Pattern{Constant('Compressed File,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#352:Compressed", "nwparser.payload", "Compressed File,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ +var part530 = match("MESSAGE#352:Compressed", "nwparser.payload", "Compressed File,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}", processor_chain([ dup110, dup12, dup152, @@ -10333,11 +9613,9 @@ match("MESSAGE#352:Compressed", "nwparser.payload", "Compressed File,Computer na var msg421 = msg("Compressed", part530); -var part531 = // "Pattern{Constant('Compressed File,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#353:Compressed:02/0", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},%{p0}"); +var part531 = match("MESSAGE#353:Compressed:02/0", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},%{p0}"); -var part532 = // "Pattern{Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(','), Field(p0,false)}" -match("MESSAGE#353:Compressed:02/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},%{p0}"); +var part532 = match("MESSAGE#353:Compressed:02/2", "nwparser.p0", "%{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},%{p0}"); var all150 = all_match({ processors: [ @@ -10364,8 +9642,7 @@ var all150 = all_match({ var msg422 = msg("Compressed:02", all150); -var part533 = // "Pattern{Constant('Compressed File,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(info,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false)}" -match("MESSAGE#354:Compressed:01", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ +var part533 = match("MESSAGE#354:Compressed:01", "nwparser.payload", "Compressed File,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{info},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31}", processor_chain([ dup110, dup12, dup152, @@ -10386,8 +9663,7 @@ var select99 = linear_select([ msg423, ]); -var part534 = // "Pattern{Constant('Stop serving as the Group Update Provider (proxy server)'), Field(,false)}" -match("MESSAGE#355:Stop", "nwparser.payload", "Stop serving as the Group Update Provider (proxy server)%{}", processor_chain([ +var part534 = match("MESSAGE#355:Stop", "nwparser.payload", "Stop serving as the Group Update Provider (proxy server)%{}", processor_chain([ dup43, dup12, dup13, @@ -10398,8 +9674,7 @@ match("MESSAGE#355:Stop", "nwparser.payload", "Stop serving as the Group Update var msg424 = msg("Stop", part534); -var part535 = // "Pattern{Constant('Stop Symantec Network Access Control client.'), Field(,false)}" -match("MESSAGE#356:Stop:01", "nwparser.payload", "Stop Symantec Network Access Control client.%{}", processor_chain([ +var part535 = match("MESSAGE#356:Stop:01", "nwparser.payload", "Stop Symantec Network Access Control client.%{}", processor_chain([ dup43, dup12, dup13, @@ -10410,8 +9685,7 @@ match("MESSAGE#356:Stop:01", "nwparser.payload", "Stop Symantec Network Access C var msg425 = msg("Stop:01", part535); -var part536 = // "Pattern{Constant('Stop using Group Update Provider (proxy server) @ '), Field(saddr,false), Constant(':'), Field(sport,false), Constant('.')}" -match("MESSAGE#357:Stop:02", "nwparser.payload", "Stop using Group Update Provider (proxy server) @ %{saddr}:%{sport}.", processor_chain([ +var part536 = match("MESSAGE#357:Stop:02", "nwparser.payload", "Stop using Group Update Provider (proxy server) @ %{saddr}:%{sport}.", processor_chain([ dup43, dup12, dup13, @@ -10428,8 +9702,7 @@ var select100 = linear_select([ msg426, ]); -var part537 = // "Pattern{Constant('Stopping Symantec Management Client....'), Field(p0,false)}" -match("MESSAGE#358:Stopping/0", "nwparser.payload", "Stopping Symantec Management Client....%{p0}"); +var part537 = match("MESSAGE#358:Stopping/0", "nwparser.payload", "Stopping Symantec Management Client....%{p0}"); var all151 = all_match({ processors: [ @@ -10452,8 +9725,7 @@ var all151 = all_match({ var msg427 = msg("Stopping", all151); -var part538 = // "Pattern{Constant('Submission Control signatures '), Field(version,true), Constant(' is up-to-date.')}" -match("MESSAGE#359:Submission", "nwparser.payload", "Submission Control signatures %{version->} is up-to-date.", processor_chain([ +var part538 = match("MESSAGE#359:Submission", "nwparser.payload", "Submission Control signatures %{version->} is up-to-date.", processor_chain([ dup92, dup12, dup13, @@ -10464,8 +9736,7 @@ match("MESSAGE#359:Submission", "nwparser.payload", "Submission Control signatur var msg428 = msg("Submission", part538); -var part539 = // "Pattern{Constant('Switched to server control.'), Field(,false)}" -match("MESSAGE#360:Switched", "nwparser.payload", "Switched to server control.%{}", processor_chain([ +var part539 = match("MESSAGE#360:Switched", "nwparser.payload", "Switched to server control.%{}", processor_chain([ dup136, dup12, dup13, @@ -10479,8 +9750,7 @@ match("MESSAGE#360:Switched", "nwparser.payload", "Switched to server control.%{ var msg429 = msg("Switched", part539); -var part540 = // "Pattern{Constant('Symantec Endpoint Protection Manager Content Catalog '), Field(version,true), Constant(' is up-to-date.')}" -match("MESSAGE#361:Symantec:18", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} is up-to-date.", processor_chain([ +var part540 = match("MESSAGE#361:Symantec:18", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} is up-to-date.", processor_chain([ dup86, dup15, setc("event_description","Symantec Endpoint Protection Manager Content Catalog is up to date."), @@ -10488,8 +9758,7 @@ match("MESSAGE#361:Symantec:18", "nwparser.payload", "Symantec Endpoint Protecti var msg430 = msg("Symantec:18", part540); -var part541 = // "Pattern{Constant('Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list '), Field(application,false), Constant('.')}" -match("MESSAGE#362:Symantec:33", "nwparser.payload", "Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list %{application}.", processor_chain([ +var part541 = match("MESSAGE#362:Symantec:33", "nwparser.payload", "Symantec Endpoint Protection Manager could not update TruScan proactive threat scan commercial application list %{application}.", processor_chain([ dup43, dup15, setc("event_description","Symantec Endpoint Protection Manager could not update TruScan proactive threat scan."), @@ -10497,8 +9766,7 @@ match("MESSAGE#362:Symantec:33", "nwparser.payload", "Symantec Endpoint Protecti var msg431 = msg("Symantec:33", part541); -var part542 = // "Pattern{Constant('Symantec Endpoint Protection '), Field(application,true), Constant(' '), Field(version,true), Constant(' ('), Field(info,false), Constant(') is up-to-date.')}" -match("MESSAGE#363:Symantec:17", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) is up-to-date.", processor_chain([ +var part542 = match("MESSAGE#363:Symantec:17", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) is up-to-date.", processor_chain([ dup86, dup15, setc("event_description","Symantec Endpoint Protection is up to date."), @@ -10506,8 +9774,7 @@ match("MESSAGE#363:Symantec:17", "nwparser.payload", "Symantec Endpoint Protecti var msg432 = msg("Symantec:17", part542); -var part543 = // "Pattern{Constant('Symantec Endpoint Protection '), Field(application,true), Constant(' '), Field(version,true), Constant(' ('), Field(info,false), Constant(') failed to update.')}" -match("MESSAGE#364:Symantec:20", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) failed to update.", processor_chain([ +var part543 = match("MESSAGE#364:Symantec:20", "nwparser.payload", "Symantec Endpoint Protection %{application->} %{version->} (%{info}) failed to update.", processor_chain([ dup86, dup12, dup13, @@ -10517,8 +9784,7 @@ match("MESSAGE#364:Symantec:20", "nwparser.payload", "Symantec Endpoint Protecti var msg433 = msg("Symantec:20", part543); -var part544 = // "Pattern{Constant('Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled'), Field(p0,false)}" -match("MESSAGE#365:Symantec:16/0", "nwparser.payload", "Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled%{p0}"); +var part544 = match("MESSAGE#365:Symantec:16/0", "nwparser.payload", "Symantec Endpoint Protection Microsoft Exchange E-mail Auto-Protect Disabled%{p0}"); var all152 = all_match({ processors: [ @@ -10537,8 +9803,7 @@ var all152 = all_match({ var msg434 = msg("Symantec:16", all152); -var part545 = // "Pattern{Constant('Symantec Network Access Control client started.'), Field(,false)}" -match("MESSAGE#366:Symantec:15", "nwparser.payload", "Symantec Network Access Control client started.%{}", processor_chain([ +var part545 = match("MESSAGE#366:Symantec:15", "nwparser.payload", "Symantec Network Access Control client started.%{}", processor_chain([ dup43, dup12, dup13, @@ -10548,8 +9813,7 @@ match("MESSAGE#366:Symantec:15", "nwparser.payload", "Symantec Network Access Co var msg435 = msg("Symantec:15", part545); -var part546 = // "Pattern{Constant('Symantec Endpoint Protection Tamper Protection Disabled'), Field(,false)}" -match("MESSAGE#367:Symantec:11", "nwparser.payload", "Symantec Endpoint Protection Tamper Protection Disabled%{}", processor_chain([ +var part546 = match("MESSAGE#367:Symantec:11", "nwparser.payload", "Symantec Endpoint Protection Tamper Protection Disabled%{}", processor_chain([ dup168, dup12, dup13, @@ -10560,8 +9824,7 @@ match("MESSAGE#367:Symantec:11", "nwparser.payload", "Symantec Endpoint Protecti var msg436 = msg("Symantec:11", part546); -var part547 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld5,false), Constant('..Time: '), Field(fld6,false), Constant('..Description: '), Field(info,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#368:Symantec", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{info}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part547 = match("MESSAGE#368:Symantec", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..Computer: %{shost}..Date: %{fld5}..Time: %{fld6}..Description: %{info}..Severity: %{severity}..Source: %{product}", processor_chain([ dup43, dup166, dup15, @@ -10570,8 +9833,7 @@ match("MESSAGE#368:Symantec", "nwparser.payload", "Symantec AntiVirus Startup/Sh var msg437 = msg("Symantec", part547); -var part548 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('........'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" -match("MESSAGE#369:Symantec:01", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6}", processor_chain([ +var part548 = match("MESSAGE#369:Symantec:01", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}........%{severity}..%{product}..%{fld6}", processor_chain([ dup43, dup166, dup15, @@ -10580,8 +9842,7 @@ match("MESSAGE#369:Symantec:01", "nwparser.payload", "Symantec AntiVirus Startup var msg438 = msg("Symantec:01", part548); -var part549 = // "Pattern{Constant('Symantec AntiVirus Startup/Shutdown..'), Field(shost,false), Constant('..'), Field(fld5,false), Constant('..'), Field(severity,false), Constant('..'), Field(product,false), Constant('..'), Field(fld6,false)}" -match("MESSAGE#370:Symantec:02", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ +var part549 = match("MESSAGE#370:Symantec:02", "nwparser.payload", "Symantec AntiVirus Startup/Shutdown..%{shost}..%{fld5}..%{severity}..%{product}..%{fld6}", processor_chain([ dup43, dup166, dup15, @@ -10590,22 +9851,18 @@ match("MESSAGE#370:Symantec:02", "nwparser.payload", "Symantec AntiVirus Startup var msg439 = msg("Symantec:02", part549); -var part550 = // "Pattern{Constant('Symantec Endpoint Protection Manager Content Catalog '), Field(version,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#371:Symantec:03/0", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} %{p0}"); +var part550 = match("MESSAGE#371:Symantec:03/0", "nwparser.payload", "Symantec Endpoint Protection Manager Content Catalog %{version->} %{p0}"); -var part551 = // "Pattern{Constant('is up-to-date '), Field(p0,false)}" -match("MESSAGE#371:Symantec:03/1_0", "nwparser.p0", "is up-to-date %{p0}"); +var part551 = match("MESSAGE#371:Symantec:03/1_0", "nwparser.p0", "is up-to-date %{p0}"); -var part552 = // "Pattern{Constant('was successfully updated '), Field(p0,false)}" -match("MESSAGE#371:Symantec:03/1_1", "nwparser.p0", "was successfully updated %{p0}"); +var part552 = match("MESSAGE#371:Symantec:03/1_1", "nwparser.p0", "was successfully updated %{p0}"); var select101 = linear_select([ part551, part552, ]); -var part553 = // "Pattern{Constant('.'), Field(,false)}" -match("MESSAGE#371:Symantec:03/2", "nwparser.p0", ".%{}"); +var part553 = match("MESSAGE#371:Symantec:03/2", "nwparser.p0", ".%{}"); var all153 = all_match({ processors: [ @@ -10625,8 +9882,7 @@ var all153 = all_match({ var msg440 = msg("Symantec:03", all153); -var part554 = // "Pattern{Constant('Symantec Endpoint Protection services shutdown was successful.'), Field(p0,false)}" -match("MESSAGE#372:Symantec:04/0", "nwparser.payload", "Symantec Endpoint Protection services shutdown was successful.%{p0}"); +var part554 = match("MESSAGE#372:Symantec:04/0", "nwparser.payload", "Symantec Endpoint Protection services shutdown was successful.%{p0}"); var all154 = all_match({ processors: [ @@ -10646,8 +9902,7 @@ var all154 = all_match({ var msg441 = msg("Symantec:04", all154); -var part555 = // "Pattern{Constant('Symantec Endpoint Protection services startup was successful.'), Field(p0,false)}" -match("MESSAGE#373:Symantec:05/0", "nwparser.payload", "Symantec Endpoint Protection services startup was successful.%{p0}"); +var part555 = match("MESSAGE#373:Symantec:05/0", "nwparser.payload", "Symantec Endpoint Protection services startup was successful.%{p0}"); var all155 = all_match({ processors: [ @@ -10667,8 +9922,7 @@ var all155 = all_match({ var msg442 = msg("Symantec:05", all155); -var part556 = // "Pattern{Constant('Symantec Management Client is stopped.'), Field(p0,false)}" -match("MESSAGE#374:Symantec:06/0", "nwparser.payload", "Symantec Management Client is stopped.%{p0}"); +var part556 = match("MESSAGE#374:Symantec:06/0", "nwparser.payload", "Symantec Management Client is stopped.%{p0}"); var all156 = all_match({ processors: [ @@ -10688,22 +9942,18 @@ var all156 = all_match({ var msg443 = msg("Symantec:06", all156); -var part557 = // "Pattern{Constant('Symantec Management Client has been '), Field(p0,false)}" -match("MESSAGE#375:Symantec:07/0", "nwparser.payload", "Symantec Management Client has been %{p0}"); +var part557 = match("MESSAGE#375:Symantec:07/0", "nwparser.payload", "Symantec Management Client has been %{p0}"); -var part558 = // "Pattern{Constant('started'), Field(p0,false)}" -match("MESSAGE#375:Symantec:07/1_0", "nwparser.p0", "started%{p0}"); +var part558 = match("MESSAGE#375:Symantec:07/1_0", "nwparser.p0", "started%{p0}"); -var part559 = // "Pattern{Constant('activated'), Field(p0,false)}" -match("MESSAGE#375:Symantec:07/1_1", "nwparser.p0", "activated%{p0}"); +var part559 = match("MESSAGE#375:Symantec:07/1_1", "nwparser.p0", "activated%{p0}"); var select102 = linear_select([ part558, part559, ]); -var part560 = // "Pattern{Constant(' .'), Field(,false)}" -match("MESSAGE#375:Symantec:07/2_1", "nwparser.p0", " .%{}"); +var part560 = match("MESSAGE#375:Symantec:07/2_1", "nwparser.p0", " .%{}"); var select103 = linear_select([ dup186, @@ -10729,8 +9979,7 @@ var all157 = all_match({ var msg444 = msg("Symantec:07", all157); -var part561 = // "Pattern{Constant('Symantec Management Client has been '), Field(info,false)}" -match("MESSAGE#376:Symantec:08", "nwparser.payload", "Symantec Management Client has been %{info}", processor_chain([ +var part561 = match("MESSAGE#376:Symantec:08", "nwparser.payload", "Symantec Management Client has been %{info}", processor_chain([ dup257, dup12, dup13, @@ -10741,8 +9990,7 @@ match("MESSAGE#376:Symantec:08", "nwparser.payload", "Symantec Management Client var msg445 = msg("Symantec:08", part561); -var part562 = // "Pattern{Constant('Symantec Endpoint Protection Auto-Protect failed to load.'), Field(,false)}" -match("MESSAGE#377:Symantec:09", "nwparser.payload", "Symantec Endpoint Protection Auto-Protect failed to load.%{}", processor_chain([ +var part562 = match("MESSAGE#377:Symantec:09", "nwparser.payload", "Symantec Endpoint Protection Auto-Protect failed to load.%{}", processor_chain([ dup43, dup12, dup13, @@ -10753,8 +10001,7 @@ match("MESSAGE#377:Symantec:09", "nwparser.payload", "Symantec Endpoint Protecti var msg446 = msg("Symantec:09", part562); -var part563 = // "Pattern{Constant('Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. '), Field(p0,false)}" -match("MESSAGE#378:Symantec:10/0", "nwparser.payload", "Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. %{p0}"); +var part563 = match("MESSAGE#378:Symantec:10/0", "nwparser.payload", "Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. %{p0}"); var all158 = all_match({ processors: [ @@ -10774,8 +10021,7 @@ var all158 = all_match({ var msg447 = msg("Symantec:10", all158); -var part564 = // "Pattern{Constant('Symantec AntiVirus services startup was successful'), Field(,false)}" -match("MESSAGE#379:Symantec:12", "nwparser.payload", "Symantec AntiVirus services startup was successful%{}", processor_chain([ +var part564 = match("MESSAGE#379:Symantec:12", "nwparser.payload", "Symantec AntiVirus services startup was successful%{}", processor_chain([ dup53, dup12, dup13, @@ -10786,8 +10032,7 @@ match("MESSAGE#379:Symantec:12", "nwparser.payload", "Symantec AntiVirus service var msg448 = msg("Symantec:12", part564); -var part565 = // "Pattern{Constant('Symantec AntiVirus services shutdown was successful'), Field(,false)}" -match("MESSAGE#380:Symantec:13", "nwparser.payload", "Symantec AntiVirus services shutdown was successful%{}", processor_chain([ +var part565 = match("MESSAGE#380:Symantec:13", "nwparser.payload", "Symantec AntiVirus services shutdown was successful%{}", processor_chain([ dup53, dup12, dup13, @@ -10798,8 +10043,7 @@ match("MESSAGE#380:Symantec:13", "nwparser.payload", "Symantec AntiVirus service var msg449 = msg("Symantec:13", part565); -var part566 = // "Pattern{Constant('Symantec AntiVirus services failed to start. '), Field(space,true), Constant(' ('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#381:Symantec:14", "nwparser.payload", "Symantec AntiVirus services failed to start. %{space->} (%{resultcode})", processor_chain([ +var part566 = match("MESSAGE#381:Symantec:14", "nwparser.payload", "Symantec AntiVirus services failed to start. %{space->} (%{resultcode})", processor_chain([ dup86, dup12, dup13, @@ -10810,8 +10054,7 @@ match("MESSAGE#381:Symantec:14", "nwparser.payload", "Symantec AntiVirus service var msg450 = msg("Symantec:14", part566); -var part567 = // "Pattern{Constant('Symantec Endpoint Protection services failed to start. '), Field(space,true), Constant(' ('), Field(resultcode,false), Constant(')')}" -match("MESSAGE#382:Symantec:19", "nwparser.payload", "Symantec Endpoint Protection services failed to start. %{space->} (%{resultcode})", processor_chain([ +var part567 = match("MESSAGE#382:Symantec:19", "nwparser.payload", "Symantec Endpoint Protection services failed to start. %{space->} (%{resultcode})", processor_chain([ dup86, dup12, dup13, @@ -10822,8 +10065,7 @@ match("MESSAGE#382:Symantec:19", "nwparser.payload", "Symantec Endpoint Protecti var msg451 = msg("Symantec:19", part567); -var part568 = // "Pattern{Constant('Symantec Endpoint Protection Manager server started with trial license.'), Field(,false)}" -match("MESSAGE#383:Symantec:21", "nwparser.payload", "Symantec Endpoint Protection Manager server started with trial license.%{}", processor_chain([ +var part568 = match("MESSAGE#383:Symantec:21", "nwparser.payload", "Symantec Endpoint Protection Manager server started with trial license.%{}", processor_chain([ dup43, dup15, setc("event_description","Symantec Endpoint Protection Manager server started with trial license."), @@ -10831,8 +10073,7 @@ match("MESSAGE#383:Symantec:21", "nwparser.payload", "Symantec Endpoint Protecti var msg452 = msg("Symantec:21", part568); -var part569 = // "Pattern{Constant('Symantec trial license has expired.'), Field(,false)}" -match("MESSAGE#384:Symantec:22", "nwparser.payload", "Symantec trial license has expired.%{}", processor_chain([ +var part569 = match("MESSAGE#384:Symantec:22", "nwparser.payload", "Symantec trial license has expired.%{}", processor_chain([ dup259, dup15, setc("event_description","Symantec trial license has expired."), @@ -10840,8 +10081,7 @@ match("MESSAGE#384:Symantec:22", "nwparser.payload", "Symantec trial license has var msg453 = msg("Symantec:22", part569); -var part570 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,"Reputation check timed out during unproven file evaluation, likely due to network delays."')}" -match("MESSAGE#385:Symantec:23", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,\"Reputation check timed out during unproven file evaluation, likely due to network delays.\"", processor_chain([ +var part570 = match("MESSAGE#385:Symantec:23", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,\"Reputation check timed out during unproven file evaluation, likely due to network delays.\"", processor_chain([ dup259, dup12, dup13, @@ -10851,8 +10091,7 @@ match("MESSAGE#385:Symantec:23", "nwparser.payload", "Category: %{fld22},Symante var msg454 = msg("Symantec:23", part570); -var part571 = // "Pattern{Constant('Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled'), Field(,false)}" -match("MESSAGE#386:Symantec:24", "nwparser.payload", "Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled%{}", processor_chain([ +var part571 = match("MESSAGE#386:Symantec:24", "nwparser.payload", "Symantec Endpoint Protection Lotus Notes E-mail Auto-Protect Disabled%{}", processor_chain([ dup43, dup12, dup13, @@ -10862,8 +10101,7 @@ match("MESSAGE#386:Symantec:24", "nwparser.payload", "Symantec Endpoint Protecti var msg455 = msg("Symantec:24", part571); -var part572 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,[Antivirus advanced heuristic detection submission] Submitting file to Symantec failed. File : ''), Field(filename,false), Constant(''.')}" -match("MESSAGE#387:Symantec:25", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,[Antivirus advanced heuristic detection submission] Submitting file to Symantec failed. File : '%{filename}'.", processor_chain([ +var part572 = match("MESSAGE#387:Symantec:25", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,[Antivirus advanced heuristic detection submission] Submitting file to Symantec failed. File : '%{filename}'.", processor_chain([ dup43, dup12, dup13, @@ -10878,11 +10116,9 @@ var select104 = linear_select([ dup262, ]); -var part573 = // "Pattern{Field(,false), Constant('advanced heuristic detection submission] Submitting information to Symantec about file failed. File : ''), Field(filename,false), Constant(''.'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/2", "nwparser.p0", "%{}advanced heuristic detection submission] Submitting information to Symantec about file failed. File : '%{filename}'.%{p0}"); +var part573 = match("MESSAGE#388:Symantec:26/2", "nwparser.p0", "%{}advanced heuristic detection submission] Submitting information to Symantec about file failed. File : '%{filename}'.%{p0}"); -var part574 = // "Pattern{Constant(' Network error : ''), Field(fld56,false), Constant(''.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#388:Symantec:26/3_0", "nwparser.p0", " Network error : '%{fld56}'.,Event time: %{fld17->} %{fld18}"); +var part574 = match("MESSAGE#388:Symantec:26/3_0", "nwparser.p0", " Network error : '%{fld56}'.,Event time: %{fld17->} %{fld18}"); var select105 = linear_select([ part574, @@ -10909,8 +10145,7 @@ var all159 = all_match({ var msg457 = msg("Symantec:26", all159); -var part575 = // "Pattern{Field(,false), Constant('submission] Information submitted to Symantec about file. File : ''), Field(filename,false), Constant('','), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/4", "nwparser.p0", "%{}submission] Information submitted to Symantec about file. File : '%{filename}',%{p0}"); +var part575 = match("MESSAGE#389:Symantec:39/4", "nwparser.p0", "%{}submission] Information submitted to Symantec about file. File : '%{filename}',%{p0}"); var all160 = all_match({ processors: [ @@ -10933,8 +10168,7 @@ var all160 = all_match({ var msg458 = msg("Symantec:39", all160); -var part576 = // "Pattern{Field(,false), Constant('submission] File submitted to Symantec for analysis. File : ''), Field(filename,false), Constant('','), Field(p0,false)}" -match("MESSAGE#390:Symantec:40/4", "nwparser.p0", "%{}submission] File submitted to Symantec for analysis. File : '%{filename}',%{p0}"); +var part576 = match("MESSAGE#390:Symantec:40/4", "nwparser.p0", "%{}submission] File submitted to Symantec for analysis. File : '%{filename}',%{p0}"); var all161 = all_match({ processors: [ @@ -10957,8 +10191,7 @@ var all161 = all_match({ var msg459 = msg("Symantec:40", all161); -var part577 = // "Pattern{Constant('Symantec Endpoint Protection Manager server started with paid license.'), Field(,false)}" -match("MESSAGE#391:Symantec:27", "nwparser.payload", "Symantec Endpoint Protection Manager server started with paid license.%{}", processor_chain([ +var part577 = match("MESSAGE#391:Symantec:27", "nwparser.payload", "Symantec Endpoint Protection Manager server started with paid license.%{}", processor_chain([ dup43, dup12, dup13, @@ -10968,8 +10201,7 @@ match("MESSAGE#391:Symantec:27", "nwparser.payload", "Symantec Endpoint Protecti var msg460 = msg("Symantec:27", part577); -var part578 = // "Pattern{Constant('Uninstalling Symantec Management Client....'), Field(,false)}" -match("MESSAGE#392:Symantec:28", "nwparser.payload", "Uninstalling Symantec Management Client....%{}", processor_chain([ +var part578 = match("MESSAGE#392:Symantec:28", "nwparser.payload", "Uninstalling Symantec Management Client....%{}", processor_chain([ dup43, dup12, dup13, @@ -10979,8 +10211,7 @@ match("MESSAGE#392:Symantec:28", "nwparser.payload", "Uninstalling Symantec Mana var msg461 = msg("Symantec:28", part578); -var part579 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SONAR has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(result,false)}" -match("MESSAGE#393:Symantec:29", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has generated an error: code %{resultcode}: description: %{result}", processor_chain([ +var part579 = match("MESSAGE#393:Symantec:29", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has generated an error: code %{resultcode}: description: %{result}", processor_chain([ dup43, dup12, dup13, @@ -10991,8 +10222,7 @@ match("MESSAGE#393:Symantec:29", "nwparser.payload", "Category: 2,Symantec Endpo var msg462 = msg("Symantec:29", part579); -var part580 = // "Pattern{Constant('Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager. '), Field(result,false), Constant('.')}" -match("MESSAGE#394:Symantec:30", "nwparser.payload", "Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager. %{result}.", processor_chain([ +var part580 = match("MESSAGE#394:Symantec:30", "nwparser.payload", "Symantec Endpoint Protection cannot connect to Symantec Endpoint Protection Manager. %{result}.", processor_chain([ dup43, dup12, dup13, @@ -11004,8 +10234,7 @@ match("MESSAGE#394:Symantec:30", "nwparser.payload", "Symantec Endpoint Protecti var msg463 = msg("Symantec:30", part580); -var part581 = // "Pattern{Constant('The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager.'), Field(,false)}" -match("MESSAGE#395:Symantec:31", "nwparser.payload", "The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ +var part581 = match("MESSAGE#395:Symantec:31", "nwparser.payload", "The Symantec Endpoint Protection is unable to communicate with the Symantec Endpoint Protection Manager.%{}", processor_chain([ dup43, dup12, dup13, @@ -11017,8 +10246,7 @@ match("MESSAGE#395:Symantec:31", "nwparser.payload", "The Symantec Endpoint Prot var msg464 = msg("Symantec:31", part581); -var part582 = // "Pattern{Constant('The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.'), Field(,false)}" -match("MESSAGE#396:Symantec:32", "nwparser.payload", "The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ +var part582 = match("MESSAGE#396:Symantec:32", "nwparser.payload", "The Symantec Endpoint Protection is unable to download the newest policy from the Symantec Endpoint Protection Manager.%{}", processor_chain([ dup43, dup12, dup13, @@ -11028,8 +10256,7 @@ match("MESSAGE#396:Symantec:32", "nwparser.payload", "The Symantec Endpoint Prot var msg465 = msg("Symantec:32", part582); -var part583 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SymELAM Protection has been enabled'), Field(p0,false)}" -match("MESSAGE#397:Symantec:36/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SymELAM Protection has been enabled%{p0}"); +var part583 = match("MESSAGE#397:Symantec:36/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SymELAM Protection has been enabled%{p0}"); var all162 = all_match({ processors: [ @@ -11048,8 +10275,7 @@ var all162 = all_match({ var msg466 = msg("Symantec:36", all162); -var part584 = // "Pattern{Constant('Category: 2,Symantec Endpoint Protection,SONAR has been enabled'), Field(p0,false)}" -match("MESSAGE#398:Symantec:37/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has been enabled%{p0}"); +var part584 = match("MESSAGE#398:Symantec:37/0", "nwparser.payload", "Category: 2,Symantec Endpoint Protection,SONAR has been enabled%{p0}"); var all163 = all_match({ processors: [ @@ -11068,8 +10294,7 @@ var all163 = all_match({ var msg467 = msg("Symantec:37", all163); -var part585 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,SONAR has been disabled')}" -match("MESSAGE#401:Symantec:41", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,SONAR has been disabled", processor_chain([ +var part585 = match("MESSAGE#401:Symantec:41", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,SONAR has been disabled", processor_chain([ dup43, dup56, dup12, @@ -11080,8 +10305,7 @@ match("MESSAGE#401:Symantec:41", "nwparser.payload", "Category: %{fld22},Symante var msg468 = msg("Symantec:41", part585); -var part586 = // "Pattern{Constant('Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled,Event time: '), Field(event_time_string,false)}" -match("MESSAGE#403:Symantec:44", "nwparser.payload", "Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled,Event time: %{event_time_string}", processor_chain([ +var part586 = match("MESSAGE#403:Symantec:44", "nwparser.payload", "Symantec Endpoint Protection Internet E-mail Auto-Protect Disabled,Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -11091,8 +10315,7 @@ match("MESSAGE#403:Symantec:44", "nwparser.payload", "Symantec Endpoint Protecti var msg469 = msg("Symantec:44", part586); -var part587 = // "Pattern{Constant('Symantec Network Access Control is overdeployed'), Field(,false)}" -match("MESSAGE#511:Server:02", "nwparser.payload", "Symantec Network Access Control is overdeployed%{}", processor_chain([ +var part587 = match("MESSAGE#511:Server:02", "nwparser.payload", "Symantec Network Access Control is overdeployed%{}", processor_chain([ dup86, dup12, dup222, @@ -11102,8 +10325,7 @@ match("MESSAGE#511:Server:02", "nwparser.payload", "Symantec Network Access Cont var msg470 = msg("Server:02", part587); -var part588 = // "Pattern{Constant('Symantec Endpoint Protection is overdeployed'), Field(,false)}" -match("MESSAGE#513:Server:04", "nwparser.payload", "Symantec Endpoint Protection is overdeployed%{}", processor_chain([ +var part588 = match("MESSAGE#513:Server:04", "nwparser.payload", "Symantec Endpoint Protection is overdeployed%{}", processor_chain([ dup86, dup12, dup222, @@ -11114,8 +10336,7 @@ match("MESSAGE#513:Server:04", "nwparser.payload", "Symantec Endpoint Protection var msg471 = msg("Server:04", part588); -var part589 = // "Pattern{Constant('Symantec Endpoint Protection Manager could not update '), Field(application,false), Constant('.')}" -match("MESSAGE#688:Symantec:34", "nwparser.payload", "Symantec Endpoint Protection Manager could not update %{application}.", processor_chain([ +var part589 = match("MESSAGE#688:Symantec:34", "nwparser.payload", "Symantec Endpoint Protection Manager could not update %{application}.", processor_chain([ dup43, dup14, dup15, @@ -11124,20 +10345,15 @@ match("MESSAGE#688:Symantec:34", "nwparser.payload", "Symantec Endpoint Protecti var msg472 = msg("Symantec:34", part589); -var part590 = // "Pattern{Field(event_description,false), Constant('. File : '), Field(filename,false), Constant(', Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#689:Symantec:35/0_0", "nwparser.payload", "%{event_description}. File : %{filename}, Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); +var part590 = match("MESSAGE#689:Symantec:35/0_0", "nwparser.payload", "%{event_description}. File : %{filename}, Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); -var part591 = // "Pattern{Field(event_description,false), Constant('. File : '), Field(filename,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#689:Symantec:35/0_1", "nwparser.payload", "%{event_description}. File : %{filename},Event time:%{fld17->} %{fld18}"); +var part591 = match("MESSAGE#689:Symantec:35/0_1", "nwparser.payload", "%{event_description}. File : %{filename},Event time:%{fld17->} %{fld18}"); -var part592 = // "Pattern{Field(event_description,false), Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#689:Symantec:35/0_2", "nwparser.payload", "%{event_description}.,Event time:%{fld17->} %{fld18}"); +var part592 = match("MESSAGE#689:Symantec:35/0_2", "nwparser.payload", "%{event_description}.,Event time:%{fld17->} %{fld18}"); -var part593 = // "Pattern{Field(event_description,false), Constant('Operating System: '), Field(os,false), Constant('Network info:'), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#689:Symantec:35/0_3", "nwparser.payload", "%{event_description}Operating System: %{os}Network info:%{info},Event time:%{fld17->} %{fld18}"); +var part593 = match("MESSAGE#689:Symantec:35/0_3", "nwparser.payload", "%{event_description}Operating System: %{os}Network info:%{info},Event time:%{fld17->} %{fld18}"); -var part594 = // "Pattern{Field(event_description,false), Constant('.')}" -match("MESSAGE#689:Symantec:35/0_4", "nwparser.payload", "%{event_description}."); +var part594 = match("MESSAGE#689:Symantec:35/0_4", "nwparser.payload", "%{event_description}."); var select106 = linear_select([ part590, @@ -11163,8 +10379,7 @@ var all164 = all_match({ var msg473 = msg("Symantec:35", all164); -var part595 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec Endpoint Protection,'), Field(event_description,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#690:Symantec:45", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,%{event_description},Event time:%{fld17->} %{fld18}", processor_chain([ +var part595 = match("MESSAGE#690:Symantec:45", "nwparser.payload", "Category: %{fld22},Symantec Endpoint Protection,%{event_description},Event time:%{fld17->} %{fld18}", processor_chain([ dup43, dup12, dup13, @@ -11174,8 +10389,7 @@ match("MESSAGE#690:Symantec:45", "nwparser.payload", "Category: %{fld22},Symante var msg474 = msg("Symantec:45", part595); -var part596 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#691:Server:05", "nwparser.payload", "event_description", processor_chain([ +var part596 = match_copy("MESSAGE#691:Server:05", "nwparser.payload", "event_description", processor_chain([ dup53, dup12, dup222, @@ -11234,8 +10448,7 @@ var select107 = linear_select([ msg475, ]); -var part597 = // "Pattern{Constant('Suspicious Behavior Detection has been '), Field(fld2,false), Constant(',Event time: '), Field(event_time_string,false)}" -match("MESSAGE#402:Symantec:43", "nwparser.payload", "Suspicious Behavior Detection has been %{fld2},Event time: %{event_time_string}", processor_chain([ +var part597 = match("MESSAGE#402:Symantec:43", "nwparser.payload", "Suspicious Behavior Detection has been %{fld2},Event time: %{event_time_string}", processor_chain([ dup43, dup12, dup13, @@ -11253,8 +10466,7 @@ match("MESSAGE#402:Symantec:43", "nwparser.payload", "Suspicious Behavior Detect var msg476 = msg("Symantec:43", part597); -var part598 = // "Pattern{Constant('System has been restarted '), Field(info,false), Constant('.')}" -match("MESSAGE#404:System", "nwparser.payload", "System has been restarted %{info}.", processor_chain([ +var part598 = match("MESSAGE#404:System", "nwparser.payload", "System has been restarted %{info}.", processor_chain([ dup53, dup12, dup13, @@ -11265,8 +10477,7 @@ match("MESSAGE#404:System", "nwparser.payload", "System has been restarted %{inf var msg477 = msg("System", part598); -var part599 = // "Pattern{Constant('System client-server activity logs have been swept.'), Field(,false)}" -match("MESSAGE#405:System:01", "nwparser.payload", "System client-server activity logs have been swept.%{}", processor_chain([ +var part599 = match("MESSAGE#405:System:01", "nwparser.payload", "System client-server activity logs have been swept.%{}", processor_chain([ dup53, dup12, dup13, @@ -11277,8 +10488,7 @@ match("MESSAGE#405:System:01", "nwparser.payload", "System client-server activit var msg478 = msg("System:01", part599); -var part600 = // "Pattern{Constant('System server activity logs have been swept.'), Field(,false)}" -match("MESSAGE#406:System:02", "nwparser.payload", "System server activity logs have been swept.%{}", processor_chain([ +var part600 = match("MESSAGE#406:System:02", "nwparser.payload", "System server activity logs have been swept.%{}", processor_chain([ dup53, dup12, dup13, @@ -11289,8 +10499,7 @@ match("MESSAGE#406:System:02", "nwparser.payload", "System server activity logs var msg479 = msg("System:02", part600); -var part601 = // "Pattern{Constant('System administrative logs have been swept.'), Field(,false)}" -match("MESSAGE#407:System:03", "nwparser.payload", "System administrative logs have been swept.%{}", processor_chain([ +var part601 = match("MESSAGE#407:System:03", "nwparser.payload", "System administrative logs have been swept.%{}", processor_chain([ dup53, dup12, dup13, @@ -11301,8 +10510,7 @@ match("MESSAGE#407:System:03", "nwparser.payload", "System administrative logs h var msg480 = msg("System:03", part601); -var part602 = // "Pattern{Constant('System enforcer activity logs have been swept.'), Field(,false)}" -match("MESSAGE#408:System:04", "nwparser.payload", "System enforcer activity logs have been swept.%{}", processor_chain([ +var part602 = match("MESSAGE#408:System:04", "nwparser.payload", "System enforcer activity logs have been swept.%{}", processor_chain([ dup53, dup14, dup15, @@ -11311,8 +10519,7 @@ match("MESSAGE#408:System:04", "nwparser.payload", "System enforcer activity log var msg481 = msg("System:04", part602); -var part603 = // "Pattern{Constant('System administrator "'), Field(username,false), Constant('" was added')}" -match("MESSAGE#409:System:05", "nwparser.payload", "System administrator \"%{username}\" was added", processor_chain([ +var part603 = match("MESSAGE#409:System:05", "nwparser.payload", "System administrator \"%{username}\" was added", processor_chain([ dup53, dup12, dup13, @@ -11331,16 +10538,14 @@ var select108 = linear_select([ msg482, ]); -var part604 = // "Pattern{Constant('- Caller MD5='), Field(fld6,false), Constant(','), Field(p0,false)}" -match("MESSAGE#410:Terminated/0_0", "nwparser.payload", "- Caller MD5=%{fld6},%{p0}"); +var part604 = match("MESSAGE#410:Terminated/0_0", "nwparser.payload", "- Caller MD5=%{fld6},%{p0}"); var select109 = linear_select([ part604, dup269, ]); -var part605 = // "Pattern{Field(action,false), Constant(',Begin:'), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End:'), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule:'), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User:'), Field(username,false), Constant(',Domain:'), Field(domain,false), Constant(',Action Type:'), Field(fld45,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" -match("MESSAGE#410:Terminated/1", "nwparser.p0", "%{action},Begin:%{fld50->} %{fld52},End:%{fld51->} %{fld53},Rule:%{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User:%{username},Domain:%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); +var part605 = match("MESSAGE#410:Terminated/1", "nwparser.p0", "%{action},Begin:%{fld50->} %{fld52},End:%{fld51->} %{fld53},Rule:%{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User:%{username},Domain:%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); var all165 = all_match({ processors: [ @@ -11363,20 +10568,15 @@ var all165 = all_match({ var msg483 = msg("Terminated", all165); -var part606 = // "Pattern{Constant('Compliance '), Field(p0,false)}" -match("MESSAGE#411:Compliance/0", "nwparser.payload", "Compliance %{p0}"); +var part606 = match("MESSAGE#411:Compliance/0", "nwparser.payload", "Compliance %{p0}"); -var part607 = // "Pattern{Constant('server '), Field(p0,false)}" -match("MESSAGE#411:Compliance/1_0", "nwparser.p0", "server %{p0}"); +var part607 = match("MESSAGE#411:Compliance/1_0", "nwparser.p0", "server %{p0}"); -var part608 = // "Pattern{Constant('client '), Field(p0,false)}" -match("MESSAGE#411:Compliance/1_1", "nwparser.p0", "client %{p0}"); +var part608 = match("MESSAGE#411:Compliance/1_1", "nwparser.p0", "client %{p0}"); -var part609 = // "Pattern{Constant('traffic '), Field(p0,false)}" -match("MESSAGE#411:Compliance/1_2", "nwparser.p0", "traffic %{p0}"); +var part609 = match("MESSAGE#411:Compliance/1_2", "nwparser.p0", "traffic %{p0}"); -var part610 = // "Pattern{Constant('criteria '), Field(p0,false)}" -match("MESSAGE#411:Compliance/1_3", "nwparser.p0", "criteria %{p0}"); +var part610 = match("MESSAGE#411:Compliance/1_3", "nwparser.p0", "criteria %{p0}"); var select110 = linear_select([ part607, @@ -11385,8 +10585,7 @@ var select110 = linear_select([ part610, ]); -var part611 = // "Pattern{Constant('logs have been swept.'), Field(,false)}" -match("MESSAGE#411:Compliance/2", "nwparser.p0", "logs have been swept.%{}"); +var part611 = match("MESSAGE#411:Compliance/2", "nwparser.p0", "logs have been swept.%{}"); var all166 = all_match({ processors: [ @@ -11404,8 +10603,7 @@ var all166 = all_match({ var msg484 = msg("Compliance", all166); -var part612 = // "Pattern{Constant('Download started.'), Field(,false)}" -match("MESSAGE#412:Download", "nwparser.payload", "Download started.%{}", processor_chain([ +var part612 = match("MESSAGE#412:Download", "nwparser.payload", "Download started.%{}", processor_chain([ dup43, dup14, dup15, @@ -11414,8 +10612,7 @@ match("MESSAGE#412:Download", "nwparser.payload", "Download started.%{}", proces var msg485 = msg("Download", part612); -var part613 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld14,true), Constant(' to '), Field(fld15,false), Constant('.,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Inbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld10,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#413:Traffic", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ +var part613 = match("MESSAGE#413:Traffic", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ dup11, dup12, dup13, @@ -11430,8 +10627,7 @@ match("MESSAGE#413:Traffic", "nwparser.payload", "Traffic from IP address %{host var msg486 = msg("Traffic", part613); -var part614 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld14,true), Constant(' to '), Field(fld15,false), Constant('.,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Outbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld10,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#414:Traffic:11", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ +var part614 = match("MESSAGE#414:Traffic:11", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld14->} to %{fld15}.,Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld10},User: %{username},Domain: %{domain}", processor_chain([ dup11, dup12, dup13, @@ -11446,8 +10642,7 @@ match("MESSAGE#414:Traffic:11", "nwparser.payload", "Traffic from IP address %{h var msg487 = msg("Traffic:11", part614); -var part615 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',1,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#415:Traffic:01", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},1,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ +var part615 = match("MESSAGE#415:Traffic:01", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},1,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain}", processor_chain([ dup11, dup12, dup13, @@ -11461,8 +10656,7 @@ match("MESSAGE#415:Traffic:01", "nwparser.payload", "Traffic from IP address %{h var msg488 = msg("Traffic:01", part615); -var part616 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(daddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Inbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#416:Traffic:02/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{daddr},Local: %{fld3},Remote: %{fld4},Remote: %{saddr},Remote: %{fld5},Inbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part616 = match("MESSAGE#416:Traffic:02/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{daddr},Local: %{fld3},Remote: %{fld4},Remote: %{saddr},Remote: %{fld5},Inbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); var all167 = all_match({ processors: [ @@ -11486,8 +10680,7 @@ var all167 = all_match({ var msg489 = msg("Traffic:02", all167); -var part617 = // "Pattern{Constant('Traffic from IP address '), Field(hostip,true), Constant(' is blocked from '), Field(fld1,true), Constant(' to '), Field(fld2,false), Constant('. ,Local: '), Field(saddr,false), Constant(',Local: '), Field(fld3,false), Constant(',Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Outbound,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#417:Traffic:12/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Outbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part617 = match("MESSAGE#417:Traffic:12/0", "nwparser.payload", "Traffic from IP address %{hostip->} is blocked from %{fld1->} to %{fld2}. ,Local: %{saddr},Local: %{fld3},Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Outbound,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); var all168 = all_match({ processors: [ @@ -11511,8 +10704,7 @@ var all168 = all_match({ var msg490 = msg("Traffic:12", all168); -var part618 = // "Pattern{Field(fld1,true), Constant(' Traffic Redirection disabled.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#717:Traffic:13", "nwparser.payload", "%{fld1->} Traffic Redirection disabled.,Event time: %{fld17->} %{fld18}", processor_chain([ +var part618 = match("MESSAGE#717:Traffic:13", "nwparser.payload", "%{fld1->} Traffic Redirection disabled.,Event time: %{fld17->} %{fld18}", processor_chain([ dup86, dup12, dup13, @@ -11523,8 +10715,7 @@ match("MESSAGE#717:Traffic:13", "nwparser.payload", "%{fld1->} Traffic Redirecti var msg491 = msg("Traffic:13", part618); -var part619 = // "Pattern{Field(fld1,true), Constant(' Traffic Redirection is malfunctioning.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#718:Traffic:14", "nwparser.payload", "%{fld1->} Traffic Redirection is malfunctioning.,Event time: %{fld17->} %{fld18}", processor_chain([ +var part619 = match("MESSAGE#718:Traffic:14", "nwparser.payload", "%{fld1->} Traffic Redirection is malfunctioning.,Event time: %{fld17->} %{fld18}", processor_chain([ dup86, dup12, dup13, @@ -11545,8 +10736,7 @@ var select111 = linear_select([ msg492, ]); -var part620 = // "Pattern{Constant('TruScan has generated an error: code '), Field(resultcode,false), Constant(': description: '), Field(info,false)}" -match("MESSAGE#418:TruScan", "nwparser.payload", "TruScan has generated an error: code %{resultcode}: description: %{info}", processor_chain([ +var part620 = match("MESSAGE#418:TruScan", "nwparser.payload", "TruScan has generated an error: code %{resultcode}: description: %{info}", processor_chain([ dup168, dup12, dup13, @@ -11557,11 +10747,9 @@ match("MESSAGE#418:TruScan", "nwparser.payload", "TruScan has generated an error var msg493 = msg("TruScan", part620); -var part621 = // "Pattern{Constant('Forced TruScan proactive threat detected,Computer name: '), Field(p0,false)}" -match("MESSAGE#419:TruScan:01/0", "nwparser.payload", "Forced TruScan proactive threat detected,Computer name: %{p0}"); +var part621 = match("MESSAGE#419:TruScan:01/0", "nwparser.payload", "Forced TruScan proactive threat detected,Computer name: %{p0}"); -var part622 = // "Pattern{Field(fld1,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version: '), Field(version,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld13,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score: '), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(',"'), Field(fld12,false), Constant('",Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld15,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#419:TruScan:01/2", "nwparser.p0", "%{fld1},Application name: %{application},Application type: %{obj_type},Application version: %{version},Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld13},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score: %{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},\"%{fld12}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld15},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part622 = match("MESSAGE#419:TruScan:01/2", "nwparser.p0", "%{fld1},Application name: %{application},Application type: %{obj_type},Application version: %{version},Hash type: %{encryption_type},Application hash: %{checksum},Company name: %{fld13},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score: %{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},\"%{fld12}\",Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld15},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); var all169 = all_match({ processors: [ @@ -11591,14 +10779,11 @@ var all169 = all_match({ var msg494 = msg("TruScan:01", all169); -var part623 = // "Pattern{Constant('TruScan '), Field(info,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#420:TruScan:update/0", "nwparser.payload", "TruScan %{info->} %{p0}"); +var part623 = match("MESSAGE#420:TruScan:update/0", "nwparser.payload", "TruScan %{info->} %{p0}"); -var part624 = // "Pattern{Constant('was successfully updated'), Field(,false)}" -match("MESSAGE#420:TruScan:update/1_0", "nwparser.p0", "was successfully updated%{}"); +var part624 = match("MESSAGE#420:TruScan:update/1_0", "nwparser.p0", "was successfully updated%{}"); -var part625 = // "Pattern{Constant('is up-to-date'), Field(,false)}" -match("MESSAGE#420:TruScan:update/1_1", "nwparser.p0", "is up-to-date%{}"); +var part625 = match("MESSAGE#420:TruScan:update/1_1", "nwparser.p0", "is up-to-date%{}"); var select112 = linear_select([ part624, @@ -11622,8 +10807,7 @@ var all170 = all_match({ var msg495 = msg("TruScan:update", all170); -var part626 = // "Pattern{Constant('TruScan '), Field(info,true), Constant(' failed to update.')}" -match("MESSAGE#421:TruScan:updatefailed", "nwparser.payload", "TruScan %{info->} failed to update.", processor_chain([ +var part626 = match("MESSAGE#421:TruScan:updatefailed", "nwparser.payload", "TruScan %{info->} failed to update.", processor_chain([ dup168, dup12, dup13, @@ -11641,8 +10825,7 @@ var select113 = linear_select([ msg496, ]); -var part627 = // "Pattern{Constant('Unexpected server error. ErrorCode: '), Field(resultcode,false)}" -match("MESSAGE#422:Unexpected", "nwparser.payload", "Unexpected server error. ErrorCode: %{resultcode}", processor_chain([ +var part627 = match("MESSAGE#422:Unexpected", "nwparser.payload", "Unexpected server error. ErrorCode: %{resultcode}", processor_chain([ dup43, dup12, dup13, @@ -11653,8 +10836,7 @@ match("MESSAGE#422:Unexpected", "nwparser.payload", "Unexpected server error. Er var msg497 = msg("Unexpected", part627); -var part628 = // "Pattern{Constant('Unexpected server error.'), Field(,false)}" -match("MESSAGE#423:Unexpected:01", "nwparser.payload", "Unexpected server error.%{}", processor_chain([ +var part628 = match("MESSAGE#423:Unexpected:01", "nwparser.payload", "Unexpected server error.%{}", processor_chain([ dup43, dup12, dup13, @@ -11670,8 +10852,7 @@ var select114 = linear_select([ msg498, ]); -var part629 = // "Pattern{Constant('Unsolicited incoming ARP reply detected,'), Field(info,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Inbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld20,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#424:Unsolicited", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ +var part629 = match("MESSAGE#424:Unsolicited", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{daddr},Local: %{fld16},Remote: %{fld17},Remote: %{saddr},Remote: %{fld18},Inbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ dup11, dup12, dup13, @@ -11686,8 +10867,7 @@ match("MESSAGE#424:Unsolicited", "nwparser.payload", "Unsolicited incoming ARP r var msg499 = msg("Unsolicited", part629); -var part630 = // "Pattern{Constant('Unsolicited incoming ARP reply detected,'), Field(info,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld16,false), Constant(',Remote: '), Field(fld17,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld18,false), Constant(',Outbound,'), Field(fld19,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld20,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#425:Unsolicited:01", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ +var part630 = match("MESSAGE#425:Unsolicited:01", "nwparser.payload", "Unsolicited incoming ARP reply detected,%{info}\",Local: %{saddr},Local: %{fld16},Remote: %{fld17},Remote: %{daddr},Remote: %{fld18},Outbound,%{fld19},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld20},User: %{username},Domain: %{domain}", processor_chain([ dup11, dup12, dup13, @@ -11707,11 +10887,9 @@ var select115 = linear_select([ msg500, ]); -var part631 = // "Pattern{Constant('User is attempting to terminate Symantec Management Client'), Field(p0,false)}" -match("MESSAGE#426:User/0", "nwparser.payload", "User is attempting to terminate Symantec Management Client%{p0}"); +var part631 = match("MESSAGE#426:User/0", "nwparser.payload", "User is attempting to terminate Symantec Management Client%{p0}"); -var part632 = // "Pattern{Constant('....,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#426:User/1_0", "nwparser.p0", "....,Event time:%{fld17->} %{fld18}"); +var part632 = match("MESSAGE#426:User/1_0", "nwparser.p0", "....,Event time:%{fld17->} %{fld18}"); var select116 = linear_select([ part632, @@ -11736,8 +10914,7 @@ var all171 = all_match({ var msg501 = msg("User", all171); -var part633 = // "Pattern{Field(fld44,false), Constant(',User - Kernel Hook Error,'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#427:User:01", "nwparser.payload", "%{fld44},User - Kernel Hook Error,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ +var part633 = match("MESSAGE#427:User:01", "nwparser.payload", "%{fld44},User - Kernel Hook Error,%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{fld4},%{fld5},%{fld6},%{fld7},User: %{username},Domain: %{domain}", processor_chain([ dup171, dup12, dup13, @@ -11753,8 +10930,7 @@ match("MESSAGE#427:User:01", "nwparser.payload", "%{fld44},User - Kernel Hook Er var msg502 = msg("User:01", part633); -var part634 = // "Pattern{Constant('User has been created'), Field(,false)}" -match("MESSAGE#428:User:created", "nwparser.payload", "User has been created%{}", processor_chain([ +var part634 = match("MESSAGE#428:User:created", "nwparser.payload", "User has been created%{}", processor_chain([ dup170, dup12, dup13, @@ -11770,8 +10946,7 @@ match("MESSAGE#428:User:created", "nwparser.payload", "User has been created%{}" var msg503 = msg("User:created", part634); -var part635 = // "Pattern{Constant('User has been deleted'), Field(,false)}" -match("MESSAGE#429:User:deleted", "nwparser.payload", "User has been deleted%{}", processor_chain([ +var part635 = match("MESSAGE#429:User:deleted", "nwparser.payload", "User has been deleted%{}", processor_chain([ dup171, dup12, dup13, @@ -11794,11 +10969,9 @@ var select117 = linear_select([ msg504, ]); -var part636 = // "Pattern{Constant('Windows Version info: Operating System: '), Field(os,true), Constant(' Network info:'), Field(p0,false)}" -match("MESSAGE#446:Windows/0", "nwparser.payload", "Windows Version info: Operating System: %{os->} Network info:%{p0}"); +var part636 = match("MESSAGE#446:Windows/0", "nwparser.payload", "Windows Version info: Operating System: %{os->} Network info:%{p0}"); -var part637 = // "Pattern{Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#446:Windows/1_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); +var part637 = match("MESSAGE#446:Windows/1_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); var select118 = linear_select([ part637, @@ -11823,8 +10996,7 @@ var all172 = all_match({ var msg505 = msg("Windows", all172); -var part638 = // "Pattern{Constant('Windows Host Integrity Content '), Field(version,true), Constant(' was successfully updated.')}" -match("MESSAGE#447:Windows:01", "nwparser.payload", "Windows Host Integrity Content %{version->} was successfully updated.", processor_chain([ +var part638 = match("MESSAGE#447:Windows:01", "nwparser.payload", "Windows Host Integrity Content %{version->} was successfully updated.", processor_chain([ dup92, dup12, dup13, @@ -11840,8 +11012,7 @@ var select119 = linear_select([ msg506, ]); -var part639 = // "Pattern{Constant('"=======EXCEPTION:'), Field(event_description,false), Constant('"')}" -match("MESSAGE#448:\"=======EXCEPTION:", "nwparser.payload", "\"=======EXCEPTION:%{event_description}\"", processor_chain([ +var part639 = match("MESSAGE#448:\"=======EXCEPTION:", "nwparser.payload", "\"=======EXCEPTION:%{event_description}\"", processor_chain([ dup168, dup12, dup13, @@ -11851,8 +11022,7 @@ match("MESSAGE#448:\"=======EXCEPTION:", "nwparser.payload", "\"=======EXCEPTION var msg507 = msg("\"=======EXCEPTION:", part639); -var part640 = // "Pattern{Constant('Sysfer exception: '), Field(info,false), Constant(',Sysfer exception,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(event_description,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#449:Allowed:08", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part640 = match("MESSAGE#449:Allowed:08", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -11865,8 +11035,7 @@ match("MESSAGE#449:Allowed:08", "nwparser.payload", "Sysfer exception: %{info},S var msg508 = msg("Allowed:08", part640); -var part641 = // "Pattern{Constant('Sysfer exception: '), Field(info,false), Constant(',Sysfer exception,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(','), Field(event_description,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#450:Allowed", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain}", processor_chain([ +var part641 = match("MESSAGE#450:Allowed", "nwparser.payload", "Sysfer exception: %{info},Sysfer exception,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},%{event_description},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -11879,8 +11048,7 @@ match("MESSAGE#450:Allowed", "nwparser.payload", "Sysfer exception: %{info},Sysf var msg509 = msg("Allowed", part641); -var part642 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" -match("MESSAGE#451:Allowed:05", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ +var part642 = match("MESSAGE#451:Allowed:05", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ dup121, dup12, dup13, @@ -11893,8 +11061,7 @@ match("MESSAGE#451:Allowed:05", "nwparser.payload", "\"%{filename}\",%{fld1},Beg var msg510 = msg("Allowed:05", part642); -var part643 = // "Pattern{Constant('"'), Field(filename,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" -match("MESSAGE#452:Allowed:06", "nwparser.payload", "\"%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ +var part643 = match("MESSAGE#452:Allowed:06", "nwparser.payload", "\"%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ dup121, dup12, dup13, @@ -11907,8 +11074,7 @@ match("MESSAGE#452:Allowed:06", "nwparser.payload", "\"%{filename},%{fld1},Begin var msg511 = msg("Allowed:06", part643); -var part644 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#453:Allowed:01", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain}", processor_chain([ +var part644 = match("MESSAGE#453:Allowed:01", "nwparser.payload", "\"%{filename}\",%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -11921,11 +11087,9 @@ match("MESSAGE#453:Allowed:01", "nwparser.payload", "\"%{filename}\",%{fld1},Beg var msg512 = msg("Allowed:01", part644); -var part645 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(p0,false)}" -match("MESSAGE#454:Allowed:02/0", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{p0}"); +var part645 = match("MESSAGE#454:Allowed:02/0", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{p0}"); -var part646 = // "Pattern{Field(domain,false), Constant(',Action Type:'), Field(fld45,false), Constant(',File size (bytes):'), Field(filename_size,false), Constant(',Device ID:'), Field(device,false)}" -match("MESSAGE#454:Allowed:02/1_0", "nwparser.p0", "%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); +var part646 = match("MESSAGE#454:Allowed:02/1_0", "nwparser.p0", "%{domain},Action Type:%{fld45},File size (bytes):%{filename_size},Device ID:%{device}"); var select120 = linear_select([ part646, @@ -11954,22 +11118,18 @@ var all173 = all_match({ var msg513 = msg("Allowed:02", all173); -var part647 = // "Pattern{Constant('- Caller MD5='), Field(checksum,false), Constant(',File Write,Begin: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/0_0", "nwparser.payload", "- Caller MD5=%{checksum},File Write,Begin: %{p0}"); +var part647 = match("MESSAGE#455:Allowed:09/0_0", "nwparser.payload", "- Caller MD5=%{checksum},File Write,Begin: %{p0}"); -var part648 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/0_1", "nwparser.payload", "%{fld1},File Write,Begin: %{p0}"); +var part648 = match("MESSAGE#455:Allowed:09/0_1", "nwparser.payload", "%{fld1},File Write,Begin: %{p0}"); var select121 = linear_select([ part647, part648, ]); -var part649 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); +var part649 = match("MESSAGE#455:Allowed:09/1", "nwparser.p0", "%{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); -var part650 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#455:Allowed:09/3", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); +var part650 = match("MESSAGE#455:Allowed:09/3", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); var all174 = all_match({ processors: [ @@ -11994,8 +11154,7 @@ var all174 = all_match({ var msg514 = msg("Allowed:09", all174); -var part651 = // "Pattern{Field(fld1,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" -match("MESSAGE#456:Allowed:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ +var part651 = match("MESSAGE#456:Allowed:03", "nwparser.payload", "%{fld1},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ dup121, dup12, dup13, @@ -12011,14 +11170,11 @@ match("MESSAGE#456:Allowed:03", "nwparser.payload", "%{fld1},File Write,Begin: % var msg515 = msg("Allowed:03", part651); -var part652 = // "Pattern{Constant('- Caller MD5='), Field(checksum,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" -match("MESSAGE#457:Allowed:10/0", "nwparser.payload", "- Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); +var part652 = match("MESSAGE#457:Allowed:10/0", "nwparser.payload", "- Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); -var part653 = // "Pattern{Constant('User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(p0,false)}" -match("MESSAGE#457:Allowed:10/2", "nwparser.p0", "User: %{username},Domain: %{domain},Action Type:%{p0}"); +var part653 = match("MESSAGE#457:Allowed:10/2", "nwparser.p0", "User: %{username},Domain: %{domain},Action Type:%{p0}"); -var part654 = // "Pattern{Field(fld46,false)}" -match_copy("MESSAGE#457:Allowed:10/3_1", "nwparser.p0", "fld46"); +var part654 = match_copy("MESSAGE#457:Allowed:10/3_1", "nwparser.p0", "fld46"); var select122 = linear_select([ dup278, @@ -12049,8 +11205,7 @@ var all175 = all_match({ var msg516 = msg("Allowed:10", all175); -var part655 = // "Pattern{Field(fld1,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(filename,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(directory,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld46,false)}" -match("MESSAGE#458:Allowed:04", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ +var part655 = match("MESSAGE#458:Allowed:04", "nwparser.payload", "%{fld1},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{filename},%{fld4},No Module Name,%{directory},User: %{username},Domain: %{domain},Action Type:%{fld46}", processor_chain([ dup121, dup12, dup13, @@ -12067,8 +11222,7 @@ match("MESSAGE#458:Allowed:04", "nwparser.payload", "%{fld1},File Delete,Begin: var msg517 = msg("Allowed:04", part655); -var part656 = // "Pattern{Field(filename,false), Constant(','), Field(fld1,false), Constant(',Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld4,false), Constant(','), Field(process,false), Constant(','), Field(fld5,false), Constant(','), Field(fld6,false), Constant(','), Field(info,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld8,false)}" -match("MESSAGE#459:Allowed:07", "nwparser.payload", "%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ +var part656 = match("MESSAGE#459:Allowed:07", "nwparser.payload", "%{filename},%{fld1},Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld4},%{process},%{fld5},%{fld6},%{info},User: %{username},Domain: %{domain},Action Type: %{fld8}", processor_chain([ dup121, dup12, dup13, @@ -12095,8 +11249,7 @@ var select123 = linear_select([ msg518, ]); -var part657 = // "Pattern{Constant('Audit logs have been swept.'), Field(,false)}" -match("MESSAGE#460:Audit", "nwparser.payload", "Audit logs have been swept.%{}", processor_chain([ +var part657 = match("MESSAGE#460:Audit", "nwparser.payload", "Audit logs have been swept.%{}", processor_chain([ dup43, dup12, dup13, @@ -12107,8 +11260,7 @@ match("MESSAGE#460:Audit", "nwparser.payload", "Audit logs have been swept.%{}", var msg519 = msg("Audit", part657); -var part658 = // "Pattern{Field(fld24,false), Constant(','), Field(fld1,false), Constant(',FATAL: '), Field(event_description,false)}" -match("MESSAGE#465:Category", "nwparser.payload", "%{fld24},%{fld1},FATAL: %{event_description}", processor_chain([ +var part658 = match("MESSAGE#465:Category", "nwparser.payload", "%{fld24},%{fld1},FATAL: %{event_description}", processor_chain([ dup53, dup12, dup13, @@ -12118,11 +11270,9 @@ match("MESSAGE#465:Category", "nwparser.payload", "%{fld24},%{fld1},FATAL: %{eve var msg520 = msg("Category", part658); -var part659 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(','), Field(event_description,true), Constant(' Remote file path:'), Field(p0,false)}" -match("MESSAGE#466:Category:03/0", "nwparser.payload", "%{fld1},%{fld2},%{event_description->} Remote file path:%{p0}"); +var part659 = match("MESSAGE#466:Category:03/0", "nwparser.payload", "%{fld1},%{fld2},%{event_description->} Remote file path:%{p0}"); -var part660 = // "Pattern{Field(url,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#466:Category:03/1_0", "nwparser.p0", "%{url},Event time:%{fld17->} %{fld18}"); +var part660 = match("MESSAGE#466:Category:03/1_0", "nwparser.p0", "%{url},Event time:%{fld17->} %{fld18}"); var select124 = linear_select([ part660, @@ -12148,14 +11298,11 @@ var all176 = all_match({ var msg521 = msg("Category:03", all176); -var part661 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(',Downloaded content from GUP '), Field(daddr,false), Constant(': '), Field(p0,false)}" -match("MESSAGE#467:Category:02/0", "nwparser.payload", "%{fld1},%{fld2},Downloaded content from GUP %{daddr}: %{p0}"); +var part661 = match("MESSAGE#467:Category:02/0", "nwparser.payload", "%{fld1},%{fld2},Downloaded content from GUP %{daddr}: %{p0}"); -var part662 = // "Pattern{Field(dport,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#467:Category:02/1_0", "nwparser.p0", "%{dport},Event time:%{fld17->} %{fld18}"); +var part662 = match("MESSAGE#467:Category:02/1_0", "nwparser.p0", "%{dport},Event time:%{fld17->} %{fld18}"); -var part663 = // "Pattern{Field(dport,false)}" -match_copy("MESSAGE#467:Category:02/1_1", "nwparser.p0", "dport"); +var part663 = match_copy("MESSAGE#467:Category:02/1_1", "nwparser.p0", "dport"); var select125 = linear_select([ part662, @@ -12180,29 +11327,21 @@ var all177 = all_match({ var msg522 = msg("Category:02", all177); -var part664 = // "Pattern{Field(fld1,false), Constant(','), Field(fld2,false), Constant(','), Field(p0,false)}" -match("MESSAGE#468:Category:01/0", "nwparser.payload", "%{fld1},%{fld2},%{p0}"); +var part664 = match("MESSAGE#468:Category:01/0", "nwparser.payload", "%{fld1},%{fld2},%{p0}"); -var part665 = // "Pattern{Field(event_description,false), Constant('. File : ''), Field(filename,false), Constant('',",Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#468:Category:01/1_0", "nwparser.p0", "%{event_description}. File : '%{filename}',\",Event time: %{fld17->} %{fld18}"); +var part665 = match("MESSAGE#468:Category:01/1_0", "nwparser.p0", "%{event_description}. File : '%{filename}',\",Event time: %{fld17->} %{fld18}"); -var part666 = // "Pattern{Field(event_description,false), Constant('Size (bytes): '), Field(filename_size,false), Constant('.,Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#468:Category:01/1_1", "nwparser.p0", "%{event_description}Size (bytes): %{filename_size}.,Event time: %{fld17->} %{fld18}"); +var part666 = match("MESSAGE#468:Category:01/1_1", "nwparser.p0", "%{event_description}Size (bytes): %{filename_size}.,Event time: %{fld17->} %{fld18}"); -var part667 = // "Pattern{Field(event_description,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#468:Category:01/1_2", "nwparser.p0", "%{event_description},Event time: %{fld17->} %{fld18}"); +var part667 = match("MESSAGE#468:Category:01/1_2", "nwparser.p0", "%{event_description},Event time: %{fld17->} %{fld18}"); -var part668 = // "Pattern{Field(event_description,false), Constant('. Size (bytes):'), Field(filename_size,false), Constant('.')}" -match("MESSAGE#468:Category:01/1_3", "nwparser.p0", "%{event_description}. Size (bytes):%{filename_size}."); +var part668 = match("MESSAGE#468:Category:01/1_3", "nwparser.p0", "%{event_description}. Size (bytes):%{filename_size}."); -var part669 = // "Pattern{Field(event_description,false), Constant('. '), Field(space,true), Constant(' File : ''), Field(filename,false), Constant('',"')}" -match("MESSAGE#468:Category:01/1_4", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}',\""); +var part669 = match("MESSAGE#468:Category:01/1_4", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}',\""); -var part670 = // "Pattern{Field(event_description,false), Constant('. '), Field(space,true), Constant(' File : ''), Field(filename,false), Constant(''')}" -match("MESSAGE#468:Category:01/1_5", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}'"); +var part670 = match("MESSAGE#468:Category:01/1_5", "nwparser.p0", "%{event_description}. %{space->} File : '%{filename}'"); -var part671 = // "Pattern{Field(event_description,false)}" -match_copy("MESSAGE#468:Category:01/1_6", "nwparser.p0", "event_description"); +var part671 = match_copy("MESSAGE#468:Category:01/1_6", "nwparser.p0", "event_description"); var select126 = linear_select([ part665, @@ -12238,8 +11377,7 @@ var select127 = linear_select([ msg523, ]); -var part672 = // "Pattern{Constant('Default '), Field(info,false), Constant('..Computer: '), Field(shost,false), Constant('..Date: '), Field(fld2,false), Constant('..Failed Alert Name: '), Field(action,false), Constant('..Time: '), Field(fld3,true), Constant(' '), Field(fld1,false), Constant('..Severity: '), Field(severity,false), Constant('..Source: '), Field(product,false)}" -match("MESSAGE#469:Default", "nwparser.payload", "Default %{info}..Computer: %{shost}..Date: %{fld2}..Failed Alert Name: %{action}..Time: %{fld3->} %{fld1}..Severity: %{severity}..Source: %{product}", processor_chain([ +var part672 = match("MESSAGE#469:Default", "nwparser.payload", "Default %{info}..Computer: %{shost}..Date: %{fld2}..Failed Alert Name: %{action}..Time: %{fld3->} %{fld1}..Severity: %{severity}..Source: %{product}", processor_chain([ dup43, date_time({ dest: "event_time", @@ -12254,8 +11392,7 @@ match("MESSAGE#469:Default", "nwparser.payload", "Default %{info}..Computer: %{s var msg524 = msg("Default", part672); -var part673 = // "Pattern{Constant('Default Group blocks new clients. The client cannot register with the Default Group.'), Field(,false)}" -match("MESSAGE#470:Default:01", "nwparser.payload", "Default Group blocks new clients. The client cannot register with the Default Group.%{}", processor_chain([ +var part673 = match("MESSAGE#470:Default:01", "nwparser.payload", "Default Group blocks new clients. The client cannot register with the Default Group.%{}", processor_chain([ dup43, dup12, dup13, @@ -12270,8 +11407,7 @@ var select128 = linear_select([ msg525, ]); -var part674 = // "Pattern{Field(action,false), Constant('. '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(','), Field(direction,false), Constant(','), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(fld24,false), Constant(',Intrusion Payload URL:'), Field(fld12,false)}" -match("MESSAGE#471:Device:01", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ +var part674 = match("MESSAGE#471:Device:01", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{fld24},Intrusion Payload URL:%{fld12}", processor_chain([ dup43, dup12, dup13, @@ -12285,14 +11421,11 @@ match("MESSAGE#471:Device:01", "nwparser.payload", "%{action}. %{info},Local: %{ var msg526 = msg("Device:01", part674); -var part675 = // "Pattern{Field(action,false), Constant('. '), Field(info,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld25,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(','), Field(direction,false), Constant(','), Field(fld5,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld8,false), Constant(','), Field(p0,false)}" -match("MESSAGE#472:Device/0", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},%{p0}"); +var part675 = match("MESSAGE#472:Device/0", "nwparser.payload", "%{action}. %{info},Local: %{saddr},Local: %{fld1},Remote: %{fld25},Remote: %{daddr},Remote: %{fld3},%{direction},%{fld5},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld8},%{p0}"); -var part676 = // "Pattern{Constant('"User:'), Field(username,false), Constant('",Domain:'), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld26,false)}" -match("MESSAGE#472:Device/1_0", "nwparser.p0", "\"User:%{username}\",Domain:%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld26}"); +var part676 = match("MESSAGE#472:Device/1_0", "nwparser.p0", "\"User:%{username}\",Domain:%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld26}"); -var part677 = // "Pattern{Constant(' User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#472:Device/1_1", "nwparser.p0", " User: %{username},Domain: %{domain}"); +var part677 = match("MESSAGE#472:Device/1_1", "nwparser.p0", " User: %{username},Domain: %{domain}"); var select129 = linear_select([ part676, @@ -12324,8 +11457,7 @@ var select130 = linear_select([ msg527, ]); -var part678 = // "Pattern{Constant('Email sending failed'), Field(,false)}" -match("MESSAGE#473:Email", "nwparser.payload", "Email sending failed%{}", processor_chain([ +var part678 = match("MESSAGE#473:Email", "nwparser.payload", "Email sending failed%{}", processor_chain([ dup53, dup12, dup13, @@ -12336,14 +11468,11 @@ match("MESSAGE#473:Email", "nwparser.payload", "Email sending failed%{}", proces var msg528 = msg("Email", part678); -var part679 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" -match("MESSAGE#474:FileWrite:02/0", "nwparser.payload", "%{fld5->} - Caller MD5=%{checksum},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); +var part679 = match("MESSAGE#474:FileWrite:02/0", "nwparser.payload", "%{fld5->} - Caller MD5=%{checksum},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); -var part680 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(p0,false)}" -match("MESSAGE#474:FileWrite:02/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{p0}"); +var part680 = match("MESSAGE#474:FileWrite:02/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{p0}"); -var part681 = // "Pattern{Field(fld44,false)}" -match_copy("MESSAGE#474:FileWrite:02/3_1", "nwparser.p0", "fld44"); +var part681 = match_copy("MESSAGE#474:FileWrite:02/3_1", "nwparser.p0", "fld44"); var select131 = linear_select([ dup278, @@ -12373,8 +11502,7 @@ var all180 = all_match({ var msg529 = msg("FileWrite:02", all180); -var part682 = // "Pattern{Constant('[AC5-1.1] Log files written to Removable Media,File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#475:FileWrite:01", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part682 = match("MESSAGE#475:FileWrite:01", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12389,8 +11517,7 @@ match("MESSAGE#475:FileWrite:01", "nwparser.payload", "[AC5-1.1] Log files writt var msg530 = msg("FileWrite:01", part682); -var part683 = // "Pattern{Field(fld5,false), Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#476:FileWrite:03", "nwparser.payload", "%{fld5},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part683 = match("MESSAGE#476:FileWrite:03", "nwparser.payload", "%{fld5},File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12405,8 +11532,7 @@ match("MESSAGE#476:FileWrite:03", "nwparser.payload", "%{fld5},File Write,Begin: var msg531 = msg("FileWrite:03", part683); -var part684 = // "Pattern{Constant(',File Write,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#477:FileWrite", "nwparser.payload", ",File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ +var part684 = match("MESSAGE#477:FileWrite", "nwparser.payload", ",File Write,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain}", processor_chain([ dup121, dup12, dup13, @@ -12421,8 +11547,7 @@ match("MESSAGE#477:FileWrite", "nwparser.payload", ",File Write,Begin: %{fld50-> var msg532 = msg("FileWrite", part684); -var part685 = // "Pattern{Constant('[AC5-1.1] Log files written to Removable Media,File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#478:FileDelete", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part685 = match("MESSAGE#478:FileDelete", "nwparser.payload", "[AC5-1.1] Log files written to Removable Media,File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12437,11 +11562,9 @@ match("MESSAGE#478:FileDelete", "nwparser.payload", "[AC5-1.1] Log files written var msg533 = msg("FileDelete", part685); -var part686 = // "Pattern{Field(info,true), Constant(' - Caller MD5='), Field(checksum,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(p0,false)}" -match("MESSAGE#479:Continue/0", "nwparser.payload", "%{info->} - Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); +var part686 = match("MESSAGE#479:Continue/0", "nwparser.payload", "%{info->} - Caller MD5=%{checksum},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{p0}"); -var part687 = // "Pattern{Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#479:Continue/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld44},File size (bytes): %{filename_size},Device ID: %{device}"); +var part687 = match("MESSAGE#479:Continue/2", "nwparser.p0", "%{username},Domain: %{domain},Action Type:%{fld44},File size (bytes): %{filename_size},Device ID: %{device}"); var all181 = all_match({ processors: [ @@ -12466,8 +11589,7 @@ var all181 = all_match({ var msg534 = msg("Continue", all181); -var part688 = // "Pattern{Field(fld5,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#480:FileDelete:01", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part688 = match("MESSAGE#480:FileDelete:01", "nwparser.payload", "%{fld5->} - Caller MD5=%{fld6},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12482,8 +11604,7 @@ match("MESSAGE#480:FileDelete:01", "nwparser.payload", "%{fld5->} - Caller MD5=% var msg535 = msg("FileDelete:01", part688); -var part689 = // "Pattern{Field(fld5,false), Constant(',File Delete,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(',No Module Name,'), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#481:FileDelete:02", "nwparser.payload", "%{fld5},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part689 = match("MESSAGE#481:FileDelete:02", "nwparser.payload", "%{fld5},File Delete,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},No Module Name,%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12498,8 +11619,7 @@ match("MESSAGE#481:FileDelete:02", "nwparser.payload", "%{fld5},File Delete,Begi var msg536 = msg("FileDelete:02", part689); -var part690 = // "Pattern{Field(fld5,false), Constant(',System,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld6,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld44,false)}" -match("MESSAGE#482:System:06", "nwparser.payload", "%{fld5},System,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld6},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ +var part690 = match("MESSAGE#482:System:06", "nwparser.payload", "%{fld5},System,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld6},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld44}", processor_chain([ dup121, dup12, dup13, @@ -12511,8 +11631,7 @@ match("MESSAGE#482:System:06", "nwparser.payload", "%{fld5},System,Begin: %{fld5 var msg537 = msg("System:06", part690); -var part691 = // "Pattern{Field(fld1,false), Constant(',File Read,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(fld3,false), Constant(','), Field(process,false), Constant(','), Field(fld4,false), Constant(','), Field(fld5,false), Constant(','), Field(filename,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type:'), Field(fld6,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#495:File:10", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ +var part691 = match("MESSAGE#495:File:10", "nwparser.payload", "%{fld1},File Read,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Rule: %{rulename},%{fld3},%{process},%{fld4},%{fld5},%{filename},User: %{username},Domain: %{domain},Action Type:%{fld6},File size (bytes): %{filename_size},Device ID: %{device}", processor_chain([ dup121, dup12, dup13, @@ -12527,16 +11646,14 @@ match("MESSAGE#495:File:10", "nwparser.payload", "%{fld1},File Read,Begin: %{fld var msg538 = msg("File:10", part691); -var part692 = // "Pattern{Field(fld11,true), Constant(' - Caller MD5='), Field(fld6,false), Constant(','), Field(p0,false)}" -match("MESSAGE#503:Blocked:08/0_0", "nwparser.payload", "%{fld11->} - Caller MD5=%{fld6},%{p0}"); +var part692 = match("MESSAGE#503:Blocked:08/0_0", "nwparser.payload", "%{fld11->} - Caller MD5=%{fld6},%{p0}"); var select132 = linear_select([ part692, dup269, ]); -var part693 = // "Pattern{Field(action,false), Constant(',Begin: '), Field(fld2,true), Constant(' '), Field(fld3,false), Constant(',End: '), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(',Rule: '), Field(rulename,false), Constant(','), Field(process_id,false), Constant(','), Field(process,false), Constant(','), Field(fld6,false), Constant(','), Field(fld7,false), Constant(','), Field(fld8,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Action Type: '), Field(fld9,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#503:Blocked:08/1", "nwparser.p0", "%{action},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}"); +var part693 = match("MESSAGE#503:Blocked:08/1", "nwparser.p0", "%{action},Begin: %{fld2->} %{fld3},End: %{fld4->} %{fld5},Rule: %{rulename},%{process_id},%{process},%{fld6},%{fld7},%{fld8},User: %{username},Domain: %{domain},Action Type: %{fld9},File size (%{fld10}): %{filename_size},Device ID: %{device}"); var all182 = all_match({ processors: [ @@ -12570,8 +11687,7 @@ var select133 = linear_select([ msg539, ]); -var part694 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(daddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Inbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(fld7,false)}" -match("MESSAGE#505:Ping/1", "nwparser.p0", "%{event_description}\",Local: %{daddr},Local: %{fld1},Remote: %{fld9},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); +var part694 = match("MESSAGE#505:Ping/1", "nwparser.p0", "%{event_description}\",Local: %{daddr},Local: %{fld1},Remote: %{fld9},Remote: %{saddr},Remote: %{fld3},Inbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); var all183 = all_match({ processors: [ @@ -12594,8 +11710,7 @@ var all183 = all_match({ var msg540 = msg("Ping", all183); -var part695 = // "Pattern{Field(event_description,false), Constant('",Local: '), Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Outbound,'), Field(protocol,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(fld7,false)}" -match("MESSAGE#506:Ping:01/1", "nwparser.p0", "%{event_description}\",Local: %{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); +var part695 = match("MESSAGE#506:Ping:01/1", "nwparser.p0", "%{event_description}\",Local: %{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Outbound,%{protocol},,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{fld7}"); var all184 = all_match({ processors: [ @@ -12623,8 +11738,7 @@ var select134 = linear_select([ msg541, ]); -var part696 = // "Pattern{Field(fld1,false), Constant(': Site: '), Field(fld2,false), Constant(',Server: '), Field(hostid,false), Constant(','), Field(directory,true), Constant(' '), Field(event_description,false)}" -match("MESSAGE#509:Server", "nwparser.payload", "%{fld1}: Site: %{fld2},Server: %{hostid},%{directory->} %{event_description}", processor_chain([ +var part696 = match("MESSAGE#509:Server", "nwparser.payload", "%{fld1}: Site: %{fld2},Server: %{hostid},%{directory->} %{event_description}", processor_chain([ dup53, dup12, dup13, @@ -12634,8 +11748,7 @@ match("MESSAGE#509:Server", "nwparser.payload", "%{fld1}: Site: %{fld2},Server: var msg542 = msg("Server", part696); -var part697 = // "Pattern{Constant('Server returned HTTP response code: '), Field(resultcode,true), Constant(' for URL: '), Field(url,false)}" -match("MESSAGE#510:Server:01", "nwparser.payload", "Server returned HTTP response code: %{resultcode->} for URL: %{url}", processor_chain([ +var part697 = match("MESSAGE#510:Server:01", "nwparser.payload", "Server returned HTTP response code: %{resultcode->} for URL: %{url}", processor_chain([ dup53, dup12, dup13, @@ -12645,8 +11758,7 @@ match("MESSAGE#510:Server:01", "nwparser.payload", "Server returned HTTP respons var msg543 = msg("Server:01", part697); -var part698 = // "Pattern{Constant('Server security validation failed.'), Field(,false)}" -match("MESSAGE#512:Server:03", "nwparser.payload", "Server security validation failed.%{}", processor_chain([ +var part698 = match("MESSAGE#512:Server:03", "nwparser.payload", "Server security validation failed.%{}", processor_chain([ dup174, dup94, setf("saddr","hhostid"), @@ -12662,8 +11774,7 @@ var select135 = linear_select([ msg544, ]); -var part699 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#514:1", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part699 = match("MESSAGE#514:1", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12676,8 +11787,7 @@ match("MESSAGE#514:1", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg545 = msg("1", part699); -var part700 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#515:2", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part700 = match("MESSAGE#515:2", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12690,8 +11800,7 @@ match("MESSAGE#515:2", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg546 = msg("2", part700); -var part701 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#516:3", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part701 = match("MESSAGE#516:3", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12704,8 +11813,7 @@ match("MESSAGE#516:3", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg547 = msg("3", part701); -var part702 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#517:4", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part702 = match("MESSAGE#517:4", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12718,8 +11826,7 @@ match("MESSAGE#517:4", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg548 = msg("4", part702); -var part703 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#518:5", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part703 = match("MESSAGE#518:5", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12732,8 +11839,7 @@ match("MESSAGE#518:5", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg549 = msg("5", part703); -var part704 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#519:6", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part704 = match("MESSAGE#519:6", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12746,8 +11852,7 @@ match("MESSAGE#519:6", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg550 = msg("6", part704); -var part705 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#520:7", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part705 = match("MESSAGE#520:7", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12760,8 +11865,7 @@ match("MESSAGE#520:7", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg551 = msg("7", part705); -var part706 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#521:8", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part706 = match("MESSAGE#521:8", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12774,8 +11878,7 @@ match("MESSAGE#521:8", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg552 = msg("8", part706); -var part707 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#522:9", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part707 = match("MESSAGE#522:9", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12788,8 +11891,7 @@ match("MESSAGE#522:9", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^% var msg553 = msg("9", part707); -var part708 = // "Pattern{Field(hostip,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(username,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(virusname,false), Constant('^^'), Field(info,false), Constant('^^'), Field(disposition,false), Constant('^^'), Field(action,false), Constant('^^'), Field(recorded_time,false), Constant('^^'), Field(fld33,false), Constant('^^'), Field(fld1,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(filename,false), Constant('^^'), Field(fld2,false)}" -match("MESSAGE#523:10", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ +var part708 = match("MESSAGE#523:10", "nwparser.payload", "%{hostip}^^%{hostname}^^%{domain}^^%{username}^^%{shost}^^%{saddr}^^%{event_source}^^%{virusname}^^%{info}^^%{disposition}^^%{action}^^%{recorded_time}^^%{fld33}^^%{fld1}^^%{dclass_counter1}^^%{filename}^^%{fld2}", processor_chain([ dup110, dup115, dup116, @@ -12808,8 +11910,7 @@ var msg556 = msg("257", dup342); var msg557 = msg("259", dup342); -var part709 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Organization importing started')}" -match("MESSAGE#527:264", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing started", processor_chain([ +var part709 = match("MESSAGE#527:264", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing started", processor_chain([ dup53, dup284, dup15, @@ -12818,8 +11919,7 @@ match("MESSAGE#527:264", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3- var msg558 = msg("264", part709); -var part710 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Organization importing finished successfully')}" -match("MESSAGE#528:265", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing finished successfully", processor_chain([ +var part710 = match("MESSAGE#528:265", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Organization importing finished successfully", processor_chain([ dup53, dup284, dup15, @@ -12830,8 +11930,7 @@ var msg559 = msg("265", part710); var msg560 = msg("273", dup342); -var part711 = // "Pattern{Field(id,false), Constant('^^The process '), Field(process,true), Constant(' can not lock the process status table. The process status has been locked by the server '), Field(shost,true), Constant(' ('), Field(fld22,false), Constant(') since '), Field(recorded_time,false), Constant('.')}" -match("MESSAGE#530:275", "nwparser.payload", "%{id}^^The process %{process->} can not lock the process status table. The process status has been locked by the server %{shost->} (%{fld22}) since %{recorded_time}.", processor_chain([ +var part711 = match("MESSAGE#530:275", "nwparser.payload", "%{id}^^The process %{process->} can not lock the process status table. The process status has been locked by the server %{shost->} (%{fld22}) since %{recorded_time}.", processor_chain([ dup53, dup15, setc("event_description","The process can not lock the process status table"), @@ -12851,8 +11950,7 @@ var msg566 = msg("779", dup342); var msg567 = msg("782", dup342); -var part712 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Backup succeeded and finished at '), Field(fld4,true), Constant(' '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant('. The backup file resides at the following location on the server '), Field(shost,false), Constant(': '), Field(directory,false)}" -match("MESSAGE#537:1029", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup succeeded and finished at %{fld4->} %{fld5->} %{fld6}. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ +var part712 = match("MESSAGE#537:1029", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup succeeded and finished at %{fld4->} %{fld5->} %{fld6}. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ dup53, dup284, date_time({ @@ -12868,8 +11966,7 @@ match("MESSAGE#537:1029", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3 var msg568 = msg("1029", part712); -var part713 = // "Pattern{Field(id,false), Constant('^^Backup succeeded and finished. The backup file resides at the following location on the server '), Field(shost,false), Constant(': '), Field(directory,false)}" -match("MESSAGE#538:1029:01", "nwparser.payload", "%{id}^^Backup succeeded and finished. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ +var part713 = match("MESSAGE#538:1029:01", "nwparser.payload", "%{id}^^Backup succeeded and finished. The backup file resides at the following location on the server %{shost}: %{directory}", processor_chain([ dup53, dup15, dup285, @@ -12882,8 +11979,7 @@ var select136 = linear_select([ msg569, ]); -var part714 = // "Pattern{Field(id,false), Constant('^^'), Field(fld1,true), Constant(' '), Field(fld2,true), Constant(' '), Field(fld3,true), Constant(' Backup started')}" -match("MESSAGE#539:1030", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup started", processor_chain([ +var part714 = match("MESSAGE#539:1030", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3->} Backup started", processor_chain([ dup53, dup284, dup15, @@ -12892,8 +11988,7 @@ match("MESSAGE#539:1030", "nwparser.payload", "%{id}^^%{fld1->} %{fld2->} %{fld3 var msg570 = msg("1030", part714); -var part715 = // "Pattern{Field(id,false), Constant('^^Backup started')}" -match("MESSAGE#540:1030:01", "nwparser.payload", "%{id}^^Backup started", processor_chain([ +var part715 = match("MESSAGE#540:1030:01", "nwparser.payload", "%{id}^^Backup started", processor_chain([ dup53, dup15, dup286, @@ -12914,8 +12009,7 @@ var msg574 = msg("5121", dup342); var msg575 = msg("5122", dup342); -var part716 = // "Pattern{Field(id,false), Constant('^^Sending Email Failed for following email address ['), Field(user_address,false), Constant('].')}" -match("MESSAGE#545:4609", "nwparser.payload", "%{id}^^Sending Email Failed for following email address [%{user_address}].", processor_chain([ +var part716 = match("MESSAGE#545:4609", "nwparser.payload", "%{id}^^Sending Email Failed for following email address [%{user_address}].", processor_chain([ setc("eventcategory","1207010200"), setc("event_description","Sending Email Failed"), dup15, @@ -12974,8 +12068,7 @@ var select142 = linear_select([ msg589, ]); -var part717 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#559:302449166", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part717 = match("MESSAGE#559:302449166", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup165, dup15, dup287, @@ -12983,8 +12076,7 @@ match("MESSAGE#559:302449166", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg590 = msg("302449166", part717); -var part718 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#560:302449166:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part718 = match("MESSAGE#560:302449166:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup165, dup15, dup287, @@ -12997,8 +12089,7 @@ var select143 = linear_select([ msg591, ]); -var part719 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#561:302449168", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part719 = match("MESSAGE#561:302449168", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup136, dup288, dup56, @@ -13009,8 +12100,7 @@ match("MESSAGE#561:302449168", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg592 = msg("302449168", part719); -var part720 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#562:302449168:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part720 = match("MESSAGE#562:302449168:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup136, dup288, dup56, @@ -13035,8 +12125,7 @@ var select145 = linear_select([ msg595, ]); -var part721 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#565:302449176", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part721 = match("MESSAGE#565:302449176", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup213, dup288, dup172, @@ -13047,8 +12136,7 @@ match("MESSAGE#565:302449176", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg596 = msg("302449176", part721); -var part722 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#566:302449176:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part722 = match("MESSAGE#566:302449176:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup213, dup288, dup172, @@ -13064,8 +12152,7 @@ var select146 = linear_select([ msg597, ]); -var part723 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#567:302449178", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part723 = match("MESSAGE#567:302449178", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup256, dup15, dup287, @@ -13073,8 +12160,7 @@ match("MESSAGE#567:302449178", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg598 = msg("302449178", part723); -var part724 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#568:302449178:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part724 = match("MESSAGE#568:302449178:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup256, dup15, dup287, @@ -13105,8 +12191,7 @@ var select149 = linear_select([ msg603, ]); -var part725 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#573:302449412", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part725 = match("MESSAGE#573:302449412", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup289, dup15, dup287, @@ -13114,8 +12199,7 @@ match("MESSAGE#573:302449412", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg604 = msg("302449412", part725); -var part726 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#574:302449412:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part726 = match("MESSAGE#574:302449412:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup289, dup15, dup287, @@ -13128,8 +12212,7 @@ var select150 = linear_select([ msg605, ]); -var part727 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#575:302449413", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part727 = match("MESSAGE#575:302449413", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup232, dup15, dup287, @@ -13137,8 +12220,7 @@ match("MESSAGE#575:302449413", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg606 = msg("302449413", part727); -var part728 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#576:302449413:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part728 = match("MESSAGE#576:302449413:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup232, dup15, dup287, @@ -13430,8 +12512,7 @@ var select182 = linear_select([ msg669, ]); -var part729 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); +var part729 = match("MESSAGE#639:303235080/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); var all185 = all_match({ processors: [ @@ -13448,8 +12529,7 @@ var all185 = all_match({ var msg670 = msg("303235080", all185); -var part730 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#640:303235080:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); +var part730 = match("MESSAGE#640:303235080:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{p0}"); var all186 = all_match({ processors: [ @@ -13511,8 +12591,7 @@ var select187 = linear_select([ var msg681 = msg("302448900", dup345); -var part731 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#651:301", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part731 = match("MESSAGE#651:301", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup351, @@ -13530,8 +12609,7 @@ match("MESSAGE#651:301", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg682 = msg("301", part731); -var part732 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#652:301:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part732 = match("MESSAGE#652:301:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup351, @@ -13549,8 +12627,7 @@ match("MESSAGE#652:301:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ var msg683 = msg("301:01", part732); -var part733 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#653:301:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part733 = match("MESSAGE#653:301:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup120, dup295, dup268, @@ -13572,8 +12649,7 @@ var select188 = linear_select([ msg684, ]); -var part734 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#654:302", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part734 = match("MESSAGE#654:302", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13590,8 +12666,7 @@ match("MESSAGE#654:302", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg685 = msg("302", part734); -var part735 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#655:302:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part735 = match("MESSAGE#655:302:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13613,8 +12688,7 @@ var select189 = linear_select([ msg686, ]); -var part736 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#656:306", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part736 = match("MESSAGE#656:306", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13631,8 +12705,7 @@ match("MESSAGE#656:306", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg687 = msg("306", part736); -var part737 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#657:306:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part737 = match("MESSAGE#657:306:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13654,8 +12727,7 @@ var select190 = linear_select([ msg688, ]); -var part738 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#658:307", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part738 = match("MESSAGE#658:307", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13672,8 +12744,7 @@ match("MESSAGE#658:307", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg689 = msg("307", part738); -var part739 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#659:307:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part739 = match("MESSAGE#659:307:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13695,8 +12766,7 @@ var select191 = linear_select([ msg690, ]); -var part740 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#660:308", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part740 = match("MESSAGE#660:308", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13714,8 +12784,7 @@ match("MESSAGE#660:308", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg691 = msg("308", part740); -var part741 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^Block all other IP traffic and log^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#661:308:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part741 = match("MESSAGE#661:308:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^Block all other IP traffic and log^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -13733,8 +12802,7 @@ match("MESSAGE#661:308:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ var msg692 = msg("308:01", part741); -var part742 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#662:308:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part742 = match("MESSAGE#662:308:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{id}^^%{saddr_v6}^^%{daddr_v6}^^%{saddr}^^%{daddr}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{sport}^^%{dport}^^%{fld14}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{fld17}^^%{rule}^^%{rulename}^^%{fld18}^^%{fld19}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup120, dup295, dup351, @@ -13756,8 +12824,7 @@ var select192 = linear_select([ msg693, ]); -var part743 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#663:202", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part743 = match("MESSAGE#663:202", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup36, dup295, setc("ec_activity","Scan"), @@ -13791,8 +12858,7 @@ var select194 = linear_select([ msg698, ]); -var part744 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#668:208", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part744 = match("MESSAGE#668:208", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup36, dup295, dup268, @@ -13809,8 +12875,7 @@ var msg699 = msg("208", part744); var msg700 = msg("210", dup359); -var part745 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#670:210:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part745 = match("MESSAGE#670:210:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup43, dup15, dup353, @@ -13839,8 +12904,7 @@ var select196 = linear_select([ var msg704 = msg("221", dup359); -var part746 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#674:238/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); +var part746 = match("MESSAGE#674:238/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); var all187 = all_match({ processors: [ @@ -13862,11 +12926,9 @@ var all187 = all_match({ var msg705 = msg("238", all187); -var part747 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#675:238:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); +var part747 = match("MESSAGE#675:238:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); -var part748 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#675:238:01/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); +var part748 = match("MESSAGE#675:238:01/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); var all188 = all_match({ processors: [ @@ -13902,8 +12964,7 @@ var select198 = linear_select([ msg708, ]); -var part749 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" -match("MESSAGE#678:502", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ +var part749 = match("MESSAGE#678:502", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ dup43, dup15, dup356, @@ -13917,8 +12978,7 @@ match("MESSAGE#678:502", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id} var msg709 = msg("502", part749); -var part750 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" -match("MESSAGE#679:502:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ +var part750 = match("MESSAGE#679:502:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ dup43, dup15, dup356, @@ -13946,8 +13006,7 @@ var select200 = linear_select([ msg712, ]); -var part751 = // "Pattern{Constant('Application,rn='), Field(fld1,true), Constant(' cid='), Field(fld2,true), Constant(' eid='), Field(fld3,false), Constant(','), Field(fld4,true), Constant(' '), Field(fld5,false), Constant(','), Field(fld6,false), Constant(',Symantec AntiVirus,SYSTEM,Information,'), Field(shost,false), Constant(','), Field(event_description,false), Constant('. string-data=[ Scan type: '), Field(event_type,true), Constant(' Event: '), Field(result,true), Constant(' Security risk detected: '), Field(directory,true), Constant(' File: '), Field(filename,true), Constant(' Location: '), Field(fld7,true), Constant(' Computer: '), Field(fld8,true), Constant(' User: '), Field(username,true), Constant(' Action taken:'), Field(action,true), Constant(' Date found: '), Field(fld9,false), Constant(']')}" -match("MESSAGE#682:Application_45", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,SYSTEM,Information,%{shost},%{event_description}. string-data=[ Scan type: %{event_type->} Event: %{result->} Security risk detected: %{directory->} File: %{filename->} Location: %{fld7->} Computer: %{fld8->} User: %{username->} Action taken:%{action->} Date found: %{fld9}]", processor_chain([ +var part751 = match("MESSAGE#682:Application_45", "nwparser.payload", "Application,rn=%{fld1->} cid=%{fld2->} eid=%{fld3},%{fld4->} %{fld5},%{fld6},Symantec AntiVirus,SYSTEM,Information,%{shost},%{event_description}. string-data=[ Scan type: %{event_type->} Event: %{result->} Security risk detected: %{directory->} File: %{filename->} Location: %{fld7->} Computer: %{fld8->} User: %{username->} Action taken:%{action->} Date found: %{fld9}]", processor_chain([ dup43, dup15, dup55, @@ -13955,26 +13014,19 @@ match("MESSAGE#682:Application_45", "nwparser.payload", "Application,rn=%{fld1-> var msg713 = msg("Application_45", part751); -var part752 = // "Pattern{Constant('Using Group Update Provider type: '), Field(p0,false)}" -match("MESSAGE#692:SYLINK/0", "nwparser.payload", "Using Group Update Provider type: %{p0}"); +var part752 = match("MESSAGE#692:SYLINK/0", "nwparser.payload", "Using Group Update Provider type: %{p0}"); -var part753 = // "Pattern{Constant('Single Group Update Provider,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#692:SYLINK/1_0", "nwparser.p0", "Single Group Update Provider,Event time:%{fld17->} %{fld18}"); +var part753 = match("MESSAGE#692:SYLINK/1_0", "nwparser.p0", "Single Group Update Provider,Event time:%{fld17->} %{fld18}"); -var part754 = // "Pattern{Constant('Multiple Group Update Providers,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#692:SYLINK/1_1", "nwparser.p0", "Multiple Group Update Providers,Event time:%{fld17->} %{fld18}"); +var part754 = match("MESSAGE#692:SYLINK/1_1", "nwparser.p0", "Multiple Group Update Providers,Event time:%{fld17->} %{fld18}"); -var part755 = // "Pattern{Constant('Mapped Group Update Providers,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#692:SYLINK/1_2", "nwparser.p0", "Mapped Group Update Providers,Event time:%{fld17->} %{fld18}"); +var part755 = match("MESSAGE#692:SYLINK/1_2", "nwparser.p0", "Mapped Group Update Providers,Event time:%{fld17->} %{fld18}"); -var part756 = // "Pattern{Constant('Single Group Update Provider'), Field(,false)}" -match("MESSAGE#692:SYLINK/1_3", "nwparser.p0", "Single Group Update Provider%{}"); +var part756 = match("MESSAGE#692:SYLINK/1_3", "nwparser.p0", "Single Group Update Provider%{}"); -var part757 = // "Pattern{Constant('Multiple Group Update Providers'), Field(,false)}" -match("MESSAGE#692:SYLINK/1_4", "nwparser.p0", "Multiple Group Update Providers%{}"); +var part757 = match("MESSAGE#692:SYLINK/1_4", "nwparser.p0", "Multiple Group Update Providers%{}"); -var part758 = // "Pattern{Constant('Mapped Group Update Providers'), Field(,false)}" -match("MESSAGE#692:SYLINK/1_5", "nwparser.p0", "Mapped Group Update Providers%{}"); +var part758 = match("MESSAGE#692:SYLINK/1_5", "nwparser.p0", "Mapped Group Update Providers%{}"); var select201 = linear_select([ part753, @@ -14003,8 +13055,7 @@ var all189 = all_match({ var msg714 = msg("SYLINK", all189); -var part759 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#703:242", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part759 = match("MESSAGE#703:242", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup53, dup15, dup353, @@ -14017,22 +13068,18 @@ match("MESSAGE#703:242", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos var msg715 = msg("242", part759); -var part760 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' ['), Field(p0,false)}" -match("MESSAGE#704:242:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [%{p0}"); +var part760 = match("MESSAGE#704:242:01/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [%{p0}"); -var part761 = // "Pattern{Constant('Device]: '), Field(device,true), Constant(' [guid]: '), Field(hardware_id,true), Constant(' [Volume]:'), Field(p0,false)}" -match("MESSAGE#704:242:01/1_0", "nwparser.p0", "Device]: %{device->} [guid]: %{hardware_id->} [Volume]:%{p0}"); +var part761 = match("MESSAGE#704:242:01/1_0", "nwparser.p0", "Device]: %{device->} [guid]: %{hardware_id->} [Volume]:%{p0}"); -var part762 = // "Pattern{Constant('Volume]:'), Field(p0,false)}" -match("MESSAGE#704:242:01/1_1", "nwparser.p0", "Volume]:%{p0}"); +var part762 = match("MESSAGE#704:242:01/1_1", "nwparser.p0", "Volume]:%{p0}"); var select202 = linear_select([ part761, part762, ]); -var part763 = // "Pattern{Field(,true), Constant(' '), Field(disk_volume,true), Constant(' [Vendor]:'), Field(devvendor,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#704:242:01/2", "nwparser.p0", "%{} %{disk_volume->} [Vendor]:%{devvendor->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); +var part763 = match("MESSAGE#704:242:01/2", "nwparser.p0", "%{} %{disk_volume->} [Vendor]:%{devvendor->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); var all190 = all_match({ processors: [ @@ -14054,8 +13101,7 @@ var all190 = all_match({ var msg716 = msg("242:01", all190); -var part764 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,true), Constant(' [Volume]: '), Field(disk_volume,true), Constant(' [Model]: '), Field(product,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#705:242:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part764 = match("MESSAGE#705:242:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description->} [Volume]: %{disk_volume->} [Model]: %{product->} [Access]: %{accesses}^^%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup53, dup15, dup353, @@ -14068,14 +13114,11 @@ match("MESSAGE#705:242:02", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ var msg717 = msg("242:02", part764); -var part765 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,true), Constant(' [Access]: '), Field(accesses,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#706:242:03/1_0", "nwparser.p0", "%{event_description}. %{info->} [Access]: %{accesses}^^%{p0}"); +var part765 = match("MESSAGE#706:242:03/1_0", "nwparser.p0", "%{event_description}. %{info->} [Access]: %{accesses}^^%{p0}"); -var part766 = // "Pattern{Constant(' '), Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#706:242:03/1_1", "nwparser.p0", " %{event_description}. %{info}^^%{p0}"); +var part766 = match("MESSAGE#706:242:03/1_1", "nwparser.p0", " %{event_description}. %{info}^^%{p0}"); -var part767 = // "Pattern{Constant(' '), Field(event_description,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#706:242:03/1_2", "nwparser.p0", " %{event_description}^^%{p0}"); +var part767 = match("MESSAGE#706:242:03/1_2", "nwparser.p0", " %{event_description}^^%{p0}"); var select203 = linear_select([ part765, @@ -14083,8 +13126,7 @@ var select203 = linear_select([ part767, ]); -var part768 = // "Pattern{Field(fld79,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#706:242:03/2", "nwparser.p0", "%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); +var part768 = match("MESSAGE#706:242:03/2", "nwparser.p0", "%{fld79}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}"); var all191 = all_match({ processors: [ @@ -14113,8 +13155,7 @@ var select204 = linear_select([ msg718, ]); -var part769 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#707:303169540", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part769 = match("MESSAGE#707:303169540", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ setc("eventcategory","1801010000"), dup15, dup287, @@ -14122,8 +13163,7 @@ match("MESSAGE#707:303169540", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^ var msg719 = msg("303169540", part769); -var part770 = // "Pattern{Field(shost,false), Constant(', Remote: '), Field(fld4,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld5,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL:'), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#708:Remote::01", "nwparser.payload", "%{shost}, Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}", processor_chain([ +var part770 = match("MESSAGE#708:Remote::01", "nwparser.payload", "%{shost}, Remote: %{fld4},Remote: %{daddr},Remote: %{fld5},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},Domain: %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL:%{url},Intrusion Payload URL:%{fld25}", processor_chain([ dup53, dup12, dup15, @@ -14135,27 +13175,23 @@ match("MESSAGE#708:Remote::01", "nwparser.payload", "%{shost}, Remote: %{fld4},R var msg720 = msg("Remote::01", part770); -var part771 = // "Pattern{Constant('"'), Field(info,false), Constant('",Local: '), Field(p0,false)}" -match("MESSAGE#709:Notification::01/0_0", "nwparser.payload", "\"%{info}\",Local: %{p0}"); +var part771 = match("MESSAGE#709:Notification::01/0_0", "nwparser.payload", "\"%{info}\",Local: %{p0}"); -var part772 = // "Pattern{Field(info,false), Constant(',Local: '), Field(p0,false)}" -match("MESSAGE#709:Notification::01/0_1", "nwparser.payload", "%{info},Local: %{p0}"); +var part772 = match("MESSAGE#709:Notification::01/0_1", "nwparser.payload", "%{info},Local: %{p0}"); var select205 = linear_select([ part771, part772, ]); -var part773 = // "Pattern{Field(saddr,false), Constant(',Local: '), Field(fld1,false), Constant(',Remote: '), Field(fld9,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld3,false), Constant(',Unknown,OTHERS,,Begin: '), Field(fld50,true), Constant(' '), Field(fld52,false), Constant(',End: '), Field(fld51,true), Constant(' '), Field(fld53,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" -match("MESSAGE#709:Notification::01/1", "nwparser.p0", "%{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); +var part773 = match("MESSAGE#709:Notification::01/1", "nwparser.p0", "%{saddr},Local: %{fld1},Remote: %{fld9},Remote: %{daddr},Remote: %{fld3},Unknown,OTHERS,,Begin: %{fld50->} %{fld52},End: %{fld51->} %{fld53},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld6},User: %{username},%{p0}"); var select206 = linear_select([ dup182, dup67, ]); -var part774 = // "Pattern{Field(,true), Constant(' '), Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#709:Notification::01/3", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part774 = match("MESSAGE#709:Notification::01/3", "nwparser.p0", "%{} %{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); var all192 = all_match({ processors: [ @@ -14388,299 +13424,201 @@ var chain1 = processor_chain([ }), ]); -var part775 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#0:Active/1_0", "nwparser.p0", "%{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part775 = match("MESSAGE#0:Active/1_0", "nwparser.p0", "%{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); -var part776 = // "Pattern{Field(domain,false)}" -match_copy("MESSAGE#0:Active/1_1", "nwparser.p0", "domain"); +var part776 = match_copy("MESSAGE#0:Active/1_1", "nwparser.p0", "domain"); -var part777 = // "Pattern{Field(domain,false), Constant(',Local Port '), Field(sport,false), Constant(',Remote Port '), Field(dport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#15:Somebody:01/1_0", "nwparser.p0", "%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part777 = match("MESSAGE#15:Somebody:01/1_0", "nwparser.p0", "%{domain},Local Port %{sport},Remote Port %{dport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); -var part778 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#27:Application:06/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); +var part778 = match("MESSAGE#27:Application:06/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{fld25}"); -var part779 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#27:Application:06/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); +var part779 = match("MESSAGE#27:Application:06/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{fld25}"); -var part780 = // "Pattern{Constant('Intrusion URL: '), Field(url,false)}" -match("MESSAGE#27:Application:06/1_2", "nwparser.p0", "Intrusion URL: %{url}"); +var part780 = match("MESSAGE#27:Application:06/1_2", "nwparser.p0", "Intrusion URL: %{url}"); -var part781 = // "Pattern{Field(url,false), Constant(',Intrusion Payload URL:'), Field(fld25,false)}" -match("MESSAGE#31:scanning:01/1_0", "nwparser.p0", "%{url},Intrusion Payload URL:%{fld25}"); +var part781 = match("MESSAGE#31:scanning:01/1_0", "nwparser.p0", "%{url},Intrusion Payload URL:%{fld25}"); -var part782 = // "Pattern{Field(url,false)}" -match_copy("MESSAGE#31:scanning:01/1_1", "nwparser.p0", "url"); +var part782 = match_copy("MESSAGE#31:scanning:01/1_1", "nwparser.p0", "url"); -var part783 = // "Pattern{Constant('Domain:'), Field(p0,false)}" -match("MESSAGE#33:Informational/1_1", "nwparser.p0", "Domain:%{p0}"); +var part783 = match("MESSAGE#33:Informational/1_1", "nwparser.p0", "Domain:%{p0}"); -var part784 = // "Pattern{Constant(':'), Field(p0,false)}" -match("MESSAGE#38:Web_Attack:16/1_1", "nwparser.p0", ":%{p0}"); +var part784 = match("MESSAGE#38:Web_Attack:16/1_1", "nwparser.p0", ":%{p0}"); -var part785 = // "Pattern{Constant('"'), Field(p0,false)}" -match("MESSAGE#307:process:12/1_0", "nwparser.p0", "\"%{p0}"); +var part785 = match("MESSAGE#307:process:12/1_0", "nwparser.p0", "\"%{p0}"); -var part786 = // "Pattern{Field(p0,false)}" -match_copy("MESSAGE#307:process:12/1_1", "nwparser.p0", "p0"); +var part786 = match_copy("MESSAGE#307:process:12/1_1", "nwparser.p0", "p0"); -var part787 = // "Pattern{Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(protocol,false), Constant(','), Field(p0,false)}" -match("MESSAGE#307:process:12/4", "nwparser.p0", ",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{p0}"); +var part787 = match("MESSAGE#307:process:12/4", "nwparser.p0", ",Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{protocol},%{p0}"); -var part788 = // "Pattern{Constant('Intrusion ID: '), Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#307:process:12/5_0", "nwparser.p0", "Intrusion ID: %{fld33},Begin: %{p0}"); +var part788 = match("MESSAGE#307:process:12/5_0", "nwparser.p0", "Intrusion ID: %{fld33},Begin: %{p0}"); -var part789 = // "Pattern{Field(fld33,false), Constant(',Begin: '), Field(p0,false)}" -match("MESSAGE#307:process:12/5_1", "nwparser.p0", "%{fld33},Begin: %{p0}"); +var part789 = match("MESSAGE#307:process:12/5_1", "nwparser.p0", "%{fld33},Begin: %{p0}"); -var part790 = // "Pattern{Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(',Location: '), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false), Constant(',Local Port '), Field(dport,false), Constant(',Remote Port '), Field(sport,false), Constant(',CIDS Signature ID: '), Field(sigid,false), Constant(',CIDS Signature string: '), Field(sigid_string,false), Constant(',CIDS Signature SubID: '), Field(fld23,false), Constant(',Intrusion URL: '), Field(p0,false)}" -match("MESSAGE#307:process:12/6", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); +var part790 = match("MESSAGE#307:process:12/6", "nwparser.p0", "%{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application},Location: %{fld11},User: %{username},Domain: %{domain},Local Port %{dport},Remote Port %{sport},CIDS Signature ID: %{sigid},CIDS Signature string: %{sigid_string},CIDS Signature SubID: %{fld23},Intrusion URL: %{p0}"); -var part791 = // "Pattern{Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); +var part791 = match("MESSAGE#21:Applied/1_0", "nwparser.p0", ",Event time:%{fld17->} %{fld18}"); -var part792 = // "Pattern{}" -match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); +var part792 = match_copy("MESSAGE#21:Applied/1_1", "nwparser.p0", ""); -var part793 = // "Pattern{Constant('"Location: '), Field(p0,false)}" -match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); +var part793 = match("MESSAGE#23:blocked:01/1_0", "nwparser.p0", "\"Location: %{p0}"); -var part794 = // "Pattern{Constant('Location: '), Field(p0,false)}" -match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); +var part794 = match("MESSAGE#23:blocked:01/1_1", "nwparser.p0", "Location: %{p0}"); -var part795 = // "Pattern{Constant(''), Field(fld2,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); +var part795 = match("MESSAGE#52:blocked/2", "nwparser.p0", "%{fld2},User: %{username},Domain: %{domain}"); -var part796 = // "Pattern{Field(fld4,false), Constant(',MD-5:'), Field(fld5,false), Constant(',Local:'), Field(p0,false)}" -match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); +var part796 = match("MESSAGE#190:Local::01/0_0", "nwparser.payload", "%{fld4},MD-5:%{fld5},Local:%{p0}"); -var part797 = // "Pattern{Constant('Local:'), Field(p0,false)}" -match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); +var part797 = match("MESSAGE#190:Local::01/0_1", "nwparser.payload", "Local:%{p0}"); -var part798 = // "Pattern{Constant('Rule: '), Field(rulename,false), Constant(',Location: '), Field(p0,false)}" -match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); +var part798 = match("MESSAGE#192:Local:/1_0", "nwparser.p0", "Rule: %{rulename},Location: %{p0}"); -var part799 = // "Pattern{Constant(' "Rule: '), Field(rulename,false), Constant('",Location: '), Field(p0,false)}" -match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); +var part799 = match("MESSAGE#192:Local:/1_1", "nwparser.p0", " \"Rule: %{rulename}\",Location: %{p0}"); -var part800 = // "Pattern{Field(fld11,false), Constant(',User: '), Field(username,false), Constant(','), Field(p0,false)}" -match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); +var part800 = match("MESSAGE#192:Local:/2", "nwparser.p0", "%{fld11},User: %{username},%{p0}"); -var part801 = // "Pattern{Constant('Domain: '), Field(domain,false), Constant(',Action: '), Field(action,false)}" -match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); +var part801 = match("MESSAGE#192:Local:/3_0", "nwparser.p0", "Domain: %{domain},Action: %{action}"); -var part802 = // "Pattern{Constant(' Domain: '), Field(domain,false)}" -match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); +var part802 = match("MESSAGE#192:Local:/3_1", "nwparser.p0", " Domain: %{domain}"); -var part803 = // "Pattern{Constant('"Intrusion URL: '), Field(url,false), Constant('",Intrusion Payload URL:'), Field(p0,false)}" -match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); +var part803 = match("MESSAGE#198:Local::04/1_0", "nwparser.p0", "\"Intrusion URL: %{url}\",Intrusion Payload URL:%{p0}"); -var part804 = // "Pattern{Constant('Intrusion URL: '), Field(url,false), Constant(',Intrusion Payload URL:'), Field(p0,false)}" -match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); +var part804 = match("MESSAGE#198:Local::04/1_1", "nwparser.p0", "Intrusion URL: %{url},Intrusion Payload URL:%{p0}"); -var part805 = // "Pattern{Field(fld25,false)}" -match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); +var part805 = match_copy("MESSAGE#198:Local::04/2", "nwparser.p0", "fld25"); -var part806 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(daddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(saddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Inbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part806 = match("MESSAGE#205:Local::07/0", "nwparser.payload", "%{event_description},Local: %{daddr},Local: %{fld12},Remote: %{fld13},Remote: %{saddr},Remote: %{fld15},Inbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part807 = // "Pattern{Field(event_description,false), Constant(',Local: '), Field(saddr,false), Constant(',Local: '), Field(fld12,false), Constant(',Remote: '), Field(fld13,false), Constant(',Remote: '), Field(daddr,false), Constant(',Remote: '), Field(fld15,false), Constant(',Outbound,'), Field(network_service,false), Constant(',,Begin: '), Field(fld50,true), Constant(' '), Field(fld54,false), Constant(',End: '), Field(fld16,true), Constant(' '), Field(fld19,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(',Application: '), Field(application,false), Constant(', '), Field(p0,false)}" -match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); +var part807 = match("MESSAGE#206:Local::19/0", "nwparser.payload", "%{event_description},Local: %{saddr},Local: %{fld12},Remote: %{fld13},Remote: %{daddr},Remote: %{fld15},Outbound,%{network_service},,Begin: %{fld50->} %{fld54},End: %{fld16->} %{fld19},Occurrences: %{dclass_counter1},Application: %{application}, %{p0}"); -var part808 = // "Pattern{Constant(''), Field(fld11,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); +var part808 = match("MESSAGE#209:Local::03/2", "nwparser.p0", "%{fld11},User: %{username},Domain: %{domain}"); -var part809 = // "Pattern{Constant('The client will block traffic from IP address '), Field(fld14,true), Constant(' for the next '), Field(duration_string,true), Constant(' (from '), Field(fld13,false), Constant(')'), Field(p0,false)}" -match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); +var part809 = match("MESSAGE#64:client:05/0", "nwparser.payload", "The client will block traffic from IP address %{fld14->} for the next %{duration_string->} (from %{fld13})%{p0}"); -var part810 = // "Pattern{Constant('.,'), Field(p0,false)}" -match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); +var part810 = match("MESSAGE#64:client:05/1_0", "nwparser.p0", ".,%{p0}"); -var part811 = // "Pattern{Constant(' . ,'), Field(p0,false)}" -match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); +var part811 = match("MESSAGE#64:client:05/1_1", "nwparser.p0", " . ,%{p0}"); -var part812 = // "Pattern{Constant('Commercial application detected,Computer name: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); +var part812 = match("MESSAGE#70:Commercial/0", "nwparser.payload", "Commercial application detected,Computer name: %{p0}"); -var part813 = // "Pattern{Field(shost,false), Constant(',IP Address: '), Field(saddr,false), Constant(',Detection type: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); +var part813 = match("MESSAGE#70:Commercial/1_0", "nwparser.p0", "%{shost},IP Address: %{saddr},Detection type: %{p0}"); -var part814 = // "Pattern{Field(shost,false), Constant(',Detection type: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); +var part814 = match("MESSAGE#70:Commercial/1_1", "nwparser.p0", "%{shost},Detection type: %{p0}"); -var part815 = // "Pattern{Field(severity,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld6,false), Constant(',Detection score:'), Field(fld7,false), Constant(',Submission recommendation: '), Field(fld8,false), Constant(',Permitted application reason: '), Field(fld9,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(fld1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); +var part815 = match("MESSAGE#70:Commercial/2", "nwparser.p0", "%{severity},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld6},Detection score:%{fld7},Submission recommendation: %{fld8},Permitted application reason: %{fld9},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{fld1},%{p0}"); -var part816 = // "Pattern{Constant('"'), Field(filename,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); +var part816 = match("MESSAGE#70:Commercial/3_0", "nwparser.p0", "\"%{filename}\",Actual action: %{p0}"); -var part817 = // "Pattern{Field(filename,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); +var part817 = match("MESSAGE#70:Commercial/3_1", "nwparser.p0", "%{filename},Actual action: %{p0}"); -var part818 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld19,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part818 = match("MESSAGE#70:Commercial/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld19},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); -var part819 = // "Pattern{Constant('IP Address: '), Field(hostip,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(p0,false)}" -match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); +var part819 = match("MESSAGE#76:Computer/0", "nwparser.payload", "IP Address: %{hostip},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{p0}"); -var part820 = // "Pattern{Constant('"'), Field(filename,false), Constant('",'), Field(p0,false)}" -match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); +var part820 = match("MESSAGE#78:Computer:03/1_0", "nwparser.p0", "\"%{filename}\",%{p0}"); -var part821 = // "Pattern{Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); +var part821 = match("MESSAGE#78:Computer:03/1_1", "nwparser.p0", "%{filename},%{p0}"); -var part822 = // "Pattern{Field(severity,false), Constant(',First Seen: '), Field(fld55,false), Constant(',Application name: '), Field(application,false), Constant(',Application type: '), Field(obj_type,false), Constant(',Application version:'), Field(version,false), Constant(',Hash type:'), Field(encryption_type,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Company name: '), Field(fld11,false), Constant(',File size (bytes): '), Field(filename_size,false), Constant(',Sensitivity: '), Field(fld13,false), Constant(',Detection score:'), Field(fld7,false), Constant(',COH Engine Version: '), Field(fld41,false), Constant(','), Field(fld53,false), Constant(',Permitted application reason: '), Field(fld54,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',Risk Level: '), Field(fld50,false), Constant(',Detection Source: '), Field(fld52,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(fld22,false), Constant(',Actual action: '), Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld5,true), Constant(' '), Field(fld6,false), Constant(',Inserted:'), Field(fld12,false), Constant(',End:'), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part822 = match("MESSAGE#79:Computer:02/2", "nwparser.p0", "%{severity},First Seen: %{fld55},Application name: %{application},Application type: %{obj_type},Application version:%{version},Hash type:%{encryption_type},Application hash: %{checksum},Company name: %{fld11},File size (bytes): %{filename_size},Sensitivity: %{fld13},Detection score:%{fld7},COH Engine Version: %{fld41},%{fld53},Permitted application reason: %{fld54},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},Risk Level: %{fld50},Detection Source: %{fld52},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{fld22},Actual action: %{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld5->} %{fld6},Inserted:%{fld12},End:%{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); -var part823 = // "Pattern{Constant('"'), Field(,false)}" -match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); +var part823 = match("MESSAGE#250:Network:24/1_0", "nwparser.p0", "\"%{}"); -var part824 = // "Pattern{Constant(' Domain:'), Field(p0,false)}" -match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); +var part824 = match("MESSAGE#134:Host:09/1_1", "nwparser.p0", " Domain:%{p0}"); -var part825 = // "Pattern{Constant('is '), Field(p0,false)}" -match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); +var part825 = match("MESSAGE#135:Intrusion/1_0", "nwparser.p0", "is %{p0}"); -var part826 = // "Pattern{Constant('.,Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); +var part826 = match("MESSAGE#145:LiveUpdate:10/1_0", "nwparser.p0", ".,Event time:%{fld17->} %{fld18}"); -var part827 = // "Pattern{Constant('",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); +var part827 = match("MESSAGE#179:LiveUpdate:40/1_0", "nwparser.p0", "\",Event time:%{fld17->} %{fld18}"); -var part828 = // "Pattern{Constant(' '), Field(p0,false)}" -match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); +var part828 = match("MESSAGE#432:Virus:02/1_1", "nwparser.p0", " %{p0}"); -var part829 = // "Pattern{Constant('Virus found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); +var part829 = match("MESSAGE#436:Virus:12/0", "nwparser.payload", "Virus found,IP Address: %{saddr},Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); -var part830 = // "Pattern{Constant('"'), Field(fld1,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); +var part830 = match("MESSAGE#436:Virus:12/1_0", "nwparser.p0", "\"%{fld1}\",Actual action: %{p0}"); -var part831 = // "Pattern{Field(fld1,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); +var part831 = match("MESSAGE#436:Virus:12/1_1", "nwparser.p0", "%{fld1},Actual action: %{p0}"); -var part832 = // "Pattern{Constant('Intensive Protection Level: '), Field(fld61,false), Constant(',Certificate issuer: '), Field(fld60,false), Constant(',Certificate signer: '), Field(fld62,false), Constant(',Certificate thumbprint: '), Field(fld63,false), Constant(',Signing timestamp: '), Field(fld64,false), Constant(',Certificate serial number: '), Field(fld65,false), Constant(',Source: '), Field(p0,false)}" -match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); +var part832 = match("MESSAGE#437:Virus:15/1_0", "nwparser.p0", "Intensive Protection Level: %{fld61},Certificate issuer: %{fld60},Certificate signer: %{fld62},Certificate thumbprint: %{fld63},Signing timestamp: %{fld64},Certificate serial number: %{fld65},Source: %{p0}"); -var part833 = // "Pattern{Constant('Source: '), Field(p0,false)}" -match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); +var part833 = match("MESSAGE#437:Virus:15/1_1", "nwparser.p0", "Source: %{p0}"); -var part834 = // "Pattern{Constant('"Group: '), Field(group,false), Constant('",Server: '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); +var part834 = match("MESSAGE#438:Virus:13/3_0", "nwparser.p0", "\"Group: %{group}\",Server: %{p0}"); -var part835 = // "Pattern{Constant('Group: '), Field(group,false), Constant(',Server: '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); +var part835 = match("MESSAGE#438:Virus:13/3_1", "nwparser.p0", "Group: %{group},Server: %{p0}"); -var part836 = // "Pattern{Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(fld31,false), Constant(',Disposition: '), Field(result,false), Constant(',Download site: '), Field(fld44,false), Constant(',Web domain: '), Field(fld45,false), Constant(',Downloaded by: '), Field(fld46,false), Constant(',Prevalence: '), Field(info,false), Constant(',Confidence: '), Field(context,false), Constant(',URL Tracking Status: '), Field(fld49,false), Constant(',,First Seen: '), Field(fld50,false), Constant(',Sensitivity: '), Field(fld52,false), Constant(','), Field(fld56,false), Constant(',Application hash: '), Field(checksum,false), Constant(',Hash type: '), Field(encryption_type,false), Constant(',Company name: '), Field(fld54,false), Constant(',Application name: '), Field(application,false), Constant(',Application version: '), Field(version,false), Constant(',Application type: '), Field(obj_type,false), Constant(',File size (bytes): '), Field(p0,false)}" -match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); +var part836 = match("MESSAGE#438:Virus:13/4", "nwparser.p0", "%{hostid},User: %{username},Source computer: %{fld29},Source IP: %{fld31},Disposition: %{result},Download site: %{fld44},Web domain: %{fld45},Downloaded by: %{fld46},Prevalence: %{info},Confidence: %{context},URL Tracking Status: %{fld49},,First Seen: %{fld50},Sensitivity: %{fld52},%{fld56},Application hash: %{checksum},Hash type: %{encryption_type},Company name: %{fld54},Application name: %{application},Application version: %{version},Application type: %{obj_type},File size (bytes): %{p0}"); -var part837 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(event_type,false)}" -match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); +var part837 = match("MESSAGE#438:Virus:13/5_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{event_type}"); -var part838 = // "Pattern{Field(filename_size,false)}" -match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); +var part838 = match_copy("MESSAGE#438:Virus:13/5_1", "nwparser.p0", "filename_size"); -var part839 = // "Pattern{Constant('Virus found,Computer name: '), Field(shost,false), Constant(',Source: '), Field(event_source,false), Constant(',Risk name: '), Field(virusname,false), Constant(',Occurrences: '), Field(dclass_counter1,false), Constant(','), Field(filename,false), Constant(','), Field(p0,false)}" -match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); +var part839 = match("MESSAGE#440:Virus:14/0", "nwparser.payload", "Virus found,Computer name: %{shost},Source: %{event_source},Risk name: %{virusname},Occurrences: %{dclass_counter1},%{filename},%{p0}"); -var part840 = // "Pattern{Constant('"'), Field(info,false), Constant('",Actual action: '), Field(p0,false)}" -match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); +var part840 = match("MESSAGE#441:Virus:05/1_0", "nwparser.p0", "\"%{info}\",Actual action: %{p0}"); -var part841 = // "Pattern{Field(info,false), Constant(',Actual action: '), Field(p0,false)}" -match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); +var part841 = match("MESSAGE#441:Virus:05/1_1", "nwparser.p0", "%{info},Actual action: %{p0}"); -var part842 = // "Pattern{Constant(''), Field(info,false), Constant(',Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); +var part842 = match("MESSAGE#218:Location/3_0", "nwparser.p0", "%{info},Event time:%{fld17->} %{fld18}"); -var part843 = // "Pattern{Field(info,false)}" -match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); +var part843 = match_copy("MESSAGE#218:Location/3_1", "nwparser.p0", "info"); -var part844 = // "Pattern{Constant(' by policy'), Field(,false)}" -match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); +var part844 = match("MESSAGE#253:Network:27/1_0", "nwparser.p0", " by policy%{}"); -var part845 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); +var part845 = match("MESSAGE#296:Policy:deleted/1_0", "nwparser.p0", ",%{p0}"); -var part846 = // "Pattern{Constant('Potential risk found,Computer name: '), Field(p0,false)}" -match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); +var part846 = match("MESSAGE#298:Potential:02/0", "nwparser.payload", "Potential risk found,Computer name: %{p0}"); -var part847 = // "Pattern{Field(action,false), Constant(',Requested action: '), Field(disposition,false), Constant(',Secondary action: '), Field(event_state,false), Constant(',Event time: '), Field(fld17,true), Constant(' '), Field(fld18,false), Constant(',Inserted: '), Field(fld20,false), Constant(',End: '), Field(fld51,false), Constant(',Domain: '), Field(domain,false), Constant(',Group: '), Field(group,false), Constant(',Server: '), Field(hostid,false), Constant(',User: '), Field(username,false), Constant(',Source computer: '), Field(fld29,false), Constant(',Source IP: '), Field(saddr,false)}" -match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); +var part847 = match("MESSAGE#299:Potential/4", "nwparser.p0", "%{action},Requested action: %{disposition},Secondary action: %{event_state},Event time: %{fld17->} %{fld18},Inserted: %{fld20},End: %{fld51},Domain: %{domain},Group: %{group},Server: %{hostid},User: %{username},Source computer: %{fld29},Source IP: %{saddr}"); -var part848 = // "Pattern{Field(event_description,false), Constant(', process id: '), Field(process_id,true), Constant(' Filename: '), Field(filename,true), Constant(' The change was denied by user'), Field(fld6,false), Constant('"'), Field(p0,false)}" -match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); +var part848 = match("MESSAGE#308:process:03/0", "nwparser.payload", "%{event_description}, process id: %{process_id->} Filename: %{filename->} The change was denied by user%{fld6}\"%{p0}"); -var part849 = // "Pattern{Constant('''), Field(context,false), Constant('','), Field(p0,false)}" -match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); +var part849 = match("MESSAGE#340:Scan:12/1_0", "nwparser.p0", "'%{context}',%{p0}"); -var part850 = // "Pattern{Constant('Security risk found,Computer name: '), Field(p0,false)}" -match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); +var part850 = match("MESSAGE#343:Security:03/0", "nwparser.payload", "Security risk found,Computer name: %{p0}"); -var part851 = // "Pattern{Constant('Security risk found,IP Address: '), Field(saddr,false), Constant(',Computer name: '), Field(shost,false), Constant(','), Field(p0,false)}" -match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); +var part851 = match("MESSAGE#345:Security:05/0", "nwparser.payload", "Security risk found,IP Address: %{saddr},Computer name: %{shost},%{p0}"); -var part852 = // "Pattern{Field(filename_size,false), Constant(',Category set: '), Field(category,false), Constant(',Category type: '), Field(vendor_event_cat,false)}" -match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); +var part852 = match("MESSAGE#345:Security:05/7_0", "nwparser.p0", "%{filename_size},Category set: %{category},Category type: %{vendor_event_cat}"); -var part853 = // "Pattern{Constant('Category: '), Field(fld22,false), Constant(',Symantec AntiVirus,'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); +var part853 = match("MESSAGE#388:Symantec:26/0", "nwparser.payload", "Category: %{fld22},Symantec AntiVirus,%{p0}"); -var part854 = // "Pattern{Constant('[Antivirus'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); +var part854 = match("MESSAGE#388:Symantec:26/1_0", "nwparser.p0", "[Antivirus%{p0}"); -var part855 = // "Pattern{Constant('"[Antivirus'), Field(p0,false)}" -match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); +var part855 = match("MESSAGE#388:Symantec:26/1_1", "nwparser.p0", "\"[Antivirus%{p0}"); -var part856 = // "Pattern{Field(,true), Constant(' '), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); +var part856 = match("MESSAGE#389:Symantec:39/2", "nwparser.p0", "%{} %{p0}"); -var part857 = // "Pattern{Constant('detection'), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); +var part857 = match("MESSAGE#389:Symantec:39/3_0", "nwparser.p0", "detection%{p0}"); -var part858 = // "Pattern{Constant('advanced heuristic detection'), Field(p0,false)}" -match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); +var part858 = match("MESSAGE#389:Symantec:39/3_1", "nwparser.p0", "advanced heuristic detection%{p0}"); -var part859 = // "Pattern{Constant(' Size (bytes): '), Field(filename_size,false), Constant('.",Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); +var part859 = match("MESSAGE#389:Symantec:39/5_0", "nwparser.p0", " Size (bytes): %{filename_size}.\",Event time:%{fld17->} %{fld18}"); -var part860 = // "Pattern{Constant('Event time:'), Field(fld17,true), Constant(' '), Field(fld18,false)}" -match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); +var part860 = match("MESSAGE#389:Symantec:39/5_2", "nwparser.p0", "Event time:%{fld17->} %{fld18}"); -var part861 = // "Pattern{Constant(','), Field(p0,false)}" -match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); +var part861 = match("MESSAGE#410:Terminated/0_1", "nwparser.payload", ",%{p0}"); -var part862 = // "Pattern{Constant(''), Field(fld6,false), Constant(',User: '), Field(username,false), Constant(',Domain: '), Field(domain,false)}" -match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); +var part862 = match("MESSAGE#416:Traffic:02/2", "nwparser.p0", "%{fld6},User: %{username},Domain: %{domain}"); -var part863 = // "Pattern{Constant('"'), Field(filename,false), Constant('",User: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); +var part863 = match("MESSAGE#455:Allowed:09/2_0", "nwparser.p0", "\"%{filename}\",User: %{p0}"); -var part864 = // "Pattern{Field(filename,false), Constant(',User: '), Field(p0,false)}" -match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); +var part864 = match("MESSAGE#455:Allowed:09/2_1", "nwparser.p0", "%{filename},User: %{p0}"); -var part865 = // "Pattern{Field(fld46,false), Constant(',File size ('), Field(fld10,false), Constant('): '), Field(filename_size,false), Constant(',Device ID: '), Field(device,false)}" -match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); +var part865 = match("MESSAGE#457:Allowed:10/3_0", "nwparser.p0", "%{fld46},File size (%{fld10}): %{filename_size},Device ID: %{device}"); -var part866 = // "Pattern{Constant('""'), Field(action,true), Constant(' . Description: '), Field(p0,false)}" -match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); +var part866 = match("MESSAGE#505:Ping/0_0", "nwparser.payload", "\"\"%{action->} . Description: %{p0}"); -var part867 = // "Pattern{Field(action,true), Constant(' . Description: '), Field(p0,false)}" -match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); +var part867 = match("MESSAGE#505:Ping/0_1", "nwparser.payload", "%{action->} . Description: %{p0}"); -var part868 = // "Pattern{Field(event_description,true), Constant(' [name]:'), Field(obj_name,true), Constant(' [class]:'), Field(obj_type,true), Constant(' [guid]:'), Field(hardware_id,true), Constant(' [deviceID]:'), Field(info,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); +var part868 = match("MESSAGE#639:303235080/1_0", "nwparser.p0", "%{event_description->} [name]:%{obj_name->} [class]:%{obj_type->} [guid]:%{hardware_id->} [deviceID]:%{info}^^%{p0}"); -var part869 = // "Pattern{Field(event_description,false), Constant('. '), Field(info,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); +var part869 = match("MESSAGE#639:303235080/1_1", "nwparser.p0", "%{event_description}. %{info}^^%{p0}"); -var part870 = // "Pattern{Field(event_description,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); +var part870 = match("MESSAGE#639:303235080/1_2", "nwparser.p0", "%{event_description}^^%{p0}"); -var part871 = // "Pattern{Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); +var part871 = match("MESSAGE#639:303235080/2", "nwparser.p0", "%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}"); -var part872 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(p0,false)}" -match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); +var part872 = match("MESSAGE#674:238/0", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{p0}"); var select207 = linear_select([ dup9, @@ -14836,55 +13774,47 @@ var select236 = linear_select([ dup282, ]); -var part873 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" -match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ +var part873 = match("MESSAGE#524:1281", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ dup53, dup15, ])); -var part874 = // "Pattern{Field(id,false), Constant('^^'), Field(event_description,false)}" -match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ +var part874 = match("MESSAGE#546:4868", "nwparser.payload", "%{id}^^%{event_description}", processor_chain([ dup43, dup15, ])); -var part875 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part875 = match("MESSAGE#549:302449153", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup43, dup15, dup287, ])); -var part876 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part876 = match("MESSAGE#550:302449153:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup43, dup15, dup287, ])); -var part877 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part877 = match("MESSAGE#553:302449155", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup74, dup15, dup287, ])); -var part878 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part878 = match("MESSAGE#554:302449155:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup74, dup15, dup287, ])); -var part879 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part879 = match("MESSAGE#585:302450432", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup168, dup15, dup287, ])); -var part880 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(id,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(event_source,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part880 = match("MESSAGE#586:302450432:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{id}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{event_source}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup168, dup15, dup287, @@ -14896,8 +13826,7 @@ var select237 = linear_select([ dup292, ]); -var part881 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part881 = match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup294, dup295, dup37, @@ -14911,8 +13840,7 @@ match("MESSAGE#664:206", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos dup302, ])); -var part882 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false)}" -match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ +var part882 = match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}", processor_chain([ dup294, dup295, dup37, @@ -14926,8 +13854,7 @@ match("MESSAGE#665:206:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{ dup302, ])); -var part883 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(daddr,false), Constant('^^'), Field(smacaddr,false), Constant('^^'), Field(dmacaddr,false), Constant('^^'), Field(zone,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(dhost,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(application,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(fld19,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(saddr_v6,false), Constant('^^'), Field(daddr_v6,false), Constant('^^'), Field(sport,false), Constant('^^'), Field(dport,false), Constant('^^'), Field(sigid,false), Constant('^^'), Field(sigid_string,false), Constant('^^'), Field(sigid1,false), Constant('^^'), Field(url,false), Constant('^^'), Field(web_referer,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(version,false), Constant('^^'), Field(policy_id,false)}" -match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ +var part883 = match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{id}^^%{saddr}^^%{daddr}^^%{smacaddr}^^%{dmacaddr}^^%{zone}^^%{username}^^%{sdomain}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{dhost}^^%{fld13}^^%{fld14}^^%{fld29}^^%{fld15}^^%{fld16}^^%{dclass_counter1}^^%{application}^^%{event_description}^^%{fld17}^^%{fld18}^^%{fld19}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{saddr_v6}^^%{daddr_v6}^^%{sport}^^%{dport}^^%{sigid}^^%{sigid_string}^^%{sigid1}^^%{url}^^%{web_referer}^^%{fld30}^^%{version}^^%{policy_id}", processor_chain([ dup43, dup15, dup353, @@ -14938,8 +13865,7 @@ match("MESSAGE#669:210", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{hos dup302, ])); -var part884 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(saddr,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(hostname,false), Constant('^^'), Field(group,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false), Constant('^^'), Field(fld31,false), Constant('^^'), Field(filename_size,false), Constant('^^'), Field(fld32,false), Constant('^^'), Field(fld33,false)}" -match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ +var part884 = match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{saddr}^^%{username}^^%{sdomain}^^%{hostname}^^%{group}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}^^%{fld31}^^%{filename_size}^^%{fld32}^^%{fld33}", processor_chain([ dup43, dup15, dup355, @@ -14950,8 +13876,7 @@ match("MESSAGE#676:501", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id} dup308, ])); -var part885 = // "Pattern{Field(fld1,false), Constant('^^'), Field(domain,false), Constant('^^'), Field(fld3,false), Constant('^^'), Field(id,false), Constant('^^'), Field(username,false), Constant('^^'), Field(sdomain,false), Constant('^^'), Field(fld6,false), Constant('^^'), Field(fld7,false), Constant('^^'), Field(fld8,false), Constant('^^'), Field(severity,false), Constant('^^'), Field(fld9,false), Constant('^^'), Field(fld10,false), Constant('^^'), Field(shost,false), Constant('^^'), Field(fld11,false), Constant('^^'), Field(fld12,false), Constant('^^'), Field(event_description,false), Constant('^^'), Field(fld13,false), Constant('^^'), Field(fld14,false), Constant('^^'), Field(fld15,false), Constant('^^'), Field(fld16,false), Constant('^^'), Field(rule,false), Constant('^^'), Field(rulename,false), Constant('^^'), Field(parent_pid,false), Constant('^^'), Field(parent_process,false), Constant('^^'), Field(fld17,false), Constant('^^'), Field(fld18,false), Constant('^^'), Field(param,false), Constant('^^'), Field(fld20,false), Constant('^^'), Field(fld21,false), Constant('^^'), Field(fld22,false), Constant('^^'), Field(fld23,false), Constant('^^'), Field(fld24,false), Constant('^^'), Field(fld25,false), Constant('^^'), Field(fld26,false), Constant('^^'), Field(fld27,false), Constant('^^'), Field(fld28,false), Constant('^^'), Field(fld29,false), Constant('^^'), Field(dclass_counter1,false), Constant('^^'), Field(fld30,false)}" -match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ +var part885 = match("MESSAGE#677:501:01", "nwparser.payload", "%{fld1}^^%{domain}^^%{fld3}^^%{id}^^%{username}^^%{sdomain}^^%{fld6}^^%{fld7}^^%{fld8}^^%{severity}^^%{fld9}^^%{fld10}^^%{shost}^^%{fld11}^^%{fld12}^^%{event_description}^^%{fld13}^^%{fld14}^^%{fld15}^^%{fld16}^^%{rule}^^%{rulename}^^%{parent_pid}^^%{parent_process}^^%{fld17}^^%{fld18}^^%{param}^^%{fld20}^^%{fld21}^^%{fld22}^^%{fld23}^^%{fld24}^^%{fld25}^^%{fld26}^^%{fld27}^^%{fld28}^^%{fld29}^^%{dclass_counter1}^^%{fld30}", processor_chain([ dup43, dup15, dup355, From 8c992c508b1bb3c690034b675110e2d595afd19a Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Tue, 29 Sep 2020 07:11:22 -0400 Subject: [PATCH 076/216] Add IP validation to Security module (#21325) For event 4778 (A session was reconnected to a Window Station) the `winlog.event_data.ClientAddress` could be "LOCAL" which is obviosuly not a valid IP so we don't want to copy it into `source.ip` in that case. Fixes #19627 --- CHANGELOG.next.asciidoc | 1 + .../winlogbeat/module/security/config/winlogbeat-security.js | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 58ca2acb35c..76a7f1edeb6 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -367,6 +367,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix invalid IP addresses in DNS query results from Sysmon data. {issue}18432[18432] {pull}18436[18436] - Fields from Winlogbeat modules were not being included in index templates and patterns. {pull}18983[18983] +- Add source.ip validation for event ID 4778 in the Security module. {issue}19627[19627] *Functionbeat* diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 9a117a42f6f..9a0899165b9 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -1479,11 +1479,12 @@ var security = (function () { fields: [ {from: "winlog.event_data.AccountName", to: "user.name"}, {from: "winlog.event_data.AccountDomain", to: "user.domain"}, - {from: "winlog.event_data.ClientAddress", to: "source.ip"}, + {from: "winlog.event_data.ClientAddress", to: "source.ip", type: "ip"}, {from: "winlog.event_data.ClientName", to: "source.domain"}, {from: "winlog.event_data.LogonID", to: "winlog.logon.id"}, ], ignore_missing: true, + fail_on_error: false, }) .Add(function(evt) { var user = evt.Get("winlog.event_data.AccountName"); From 0cbf4e50a5e12f331529007dd88c77b6f65b9771 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Tue, 29 Sep 2020 13:13:14 +0200 Subject: [PATCH 077/216] feat: prepare release pipelines (#21238) * feat: prepare release pipelines * Apply suggestions from code review --- .ci/jobs/beats-release-minor-major.yml | 20 ++++++++++++++++++++ .ci/jobs/beats-release-patch.yml | 20 ++++++++++++++++++++ .ci/jobs/folders.yml | 5 +++++ 3 files changed, 45 insertions(+) create mode 100644 .ci/jobs/beats-release-minor-major.yml create mode 100644 .ci/jobs/beats-release-patch.yml diff --git a/.ci/jobs/beats-release-minor-major.yml b/.ci/jobs/beats-release-minor-major.yml new file mode 100644 index 00000000000..91c7d105fb8 --- /dev/null +++ b/.ci/jobs/beats-release-minor-major.yml @@ -0,0 +1,20 @@ +--- +- job: + name: Beats/Release/beats-release-minor-major + display-name: 'Prepare Major/minor Release' + description: 'Automate the steps to prepare a new Release branch' + view: Beats + project-type: pipeline + pipeline-scm: + script-path: release_scripts/pipeline-release-minor-major.groovy + scm: + - git: + url: git@github.com:elastic/ingest-dev.git + refspec: +refs/heads/*:refs/remotes/origin/* +refs/pull/*/head:refs/remotes/origin/pr/* + wipe-workspace: 'True' + name: origin + shallow-clone: true + credentials-id: f6c7695a-671e-4f4f-a331-acdce44ff9ba + reference-repo: /var/lib/jenkins/.git-references/ingest-dev.git + branches: + - master diff --git a/.ci/jobs/beats-release-patch.yml b/.ci/jobs/beats-release-patch.yml new file mode 100644 index 00000000000..4d205f79647 --- /dev/null +++ b/.ci/jobs/beats-release-patch.yml @@ -0,0 +1,20 @@ +--- +- job: + name: Beats/Release/beats-release-patch + display-name: 'Prepare Patch Release' + description: 'Automate the steps to prepare a new Patch' + view: Beats + project-type: pipeline + pipeline-scm: + script-path: release_scripts/pipeline-release-patch.groovy + scm: + - git: + url: git@github.com:elastic/ingest-dev.git + refspec: +refs/heads/*:refs/remotes/origin/* +refs/pull/*/head:refs/remotes/origin/pr/* + wipe-workspace: 'True' + name: origin + shallow-clone: true + credentials-id: f6c7695a-671e-4f4f-a331-acdce44ff9ba + reference-repo: /var/lib/jenkins/.git-references/ingest-dev.git + branches: + - master diff --git a/.ci/jobs/folders.yml b/.ci/jobs/folders.yml index 60b6e3eff92..4b6cc5c4944 100644 --- a/.ci/jobs/folders.yml +++ b/.ci/jobs/folders.yml @@ -4,3 +4,8 @@ name: Beats description: Beats project-type: folder + +- job: + name: Beats/Release + description: Jobs for release preparation + project-type: folder From 8f9d54bef44f9745c958bb727aed4c0e180c93cd Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Tue, 29 Sep 2020 16:20:29 +0200 Subject: [PATCH 078/216] [Filebeat][httpjson] Make httpjson use cursor input when using date cursor (#20751) * Fix duplicate import * Move config to its own package * Minor improvements * Fix tests * Create input manager * Change requester to accept and store a cursor * Modify input to be embedded * Create stateless and cursor inputs * Initialize new input manager on publish * Add changelog entry and format files * Move test data folder * Change tests * Apply requested changes --- CHANGELOG.next.asciidoc | 1 + filebeat/input/v2/input-cursor/manager.go | 7 +- .../filebeat/input/default-inputs/inputs.go | 2 +- x-pack/filebeat/input/httpjson/config.go | 58 +++++------ .../filebeat/input/httpjson/config_oauth.go | 73 +++++++------- .../input/httpjson/config_oauth_test.go | 38 ++++---- x-pack/filebeat/input/httpjson/config_test.go | 18 ++-- x-pack/filebeat/input/httpjson/date_cursor.go | 41 ++++---- x-pack/filebeat/input/httpjson/input.go | 96 +++++++++---------- .../filebeat/input/httpjson/input_cursor.go | 67 +++++++++++++ .../filebeat/input/httpjson/input_manager.go | 49 ++++++++++ .../input/httpjson/input_stateless.go | 58 +++++++++++ .../{httpjson_test.go => input_test.go} | 17 ++-- x-pack/filebeat/input/httpjson/pagination.go | 4 +- .../input/httpjson/pagination_test.go | 2 +- .../filebeat/input/httpjson/rate_limiter.go | 2 +- x-pack/filebeat/input/httpjson/requester.go | 36 +++++-- 17 files changed, 385 insertions(+), 184 deletions(-) create mode 100644 x-pack/filebeat/input/httpjson/input_cursor.go create mode 100644 x-pack/filebeat/input/httpjson/input_manager.go create mode 100644 x-pack/filebeat/input/httpjson/input_stateless.go rename x-pack/filebeat/input/httpjson/{httpjson_test.go => input_test.go} (96%) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 76a7f1edeb6..1b5b1bd16bb 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -597,6 +597,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add type and sub_type to panw panos fileset {pull}20912[20912] - Always attempt community_id processor on zeek module {pull}21155[21155] - Add related.hosts ecs field to all modules {pull}21160[21160] +- Keep cursor state between httpjson input restarts {pull}20751[20751] *Heartbeat* diff --git a/filebeat/input/v2/input-cursor/manager.go b/filebeat/input/v2/input-cursor/manager.go index 2a4310dc778..766d6f17fa0 100644 --- a/filebeat/input/v2/input-cursor/manager.go +++ b/filebeat/input/v2/input-cursor/manager.go @@ -26,7 +26,6 @@ import ( "github.com/elastic/go-concert/unison" - input "github.com/elastic/beats/v7/filebeat/input/v2" v2 "github.com/elastic/beats/v7/filebeat/input/v2" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" @@ -145,7 +144,7 @@ func (cim *InputManager) shutdown() { // Create builds a new v2.Input using the provided Configure function. // The Input will run a go-routine per source that has been configured. -func (cim *InputManager) Create(config *common.Config) (input.Input, error) { +func (cim *InputManager) Create(config *common.Config) (v2.Input, error) { if err := cim.init(); err != nil { return nil, err } @@ -180,7 +179,7 @@ func (cim *InputManager) Create(config *common.Config) (input.Input, error) { // Lock locks a key for exclusive access and returns an resource that can be used to modify // the cursor state and unlock the key. -func (cim *InputManager) lock(ctx input.Context, key string) (*resource, error) { +func (cim *InputManager) lock(ctx v2.Context, key string) (*resource, error) { resource := cim.store.Get(key) err := lockResource(ctx.Logger, resource, ctx.Cancelation) if err != nil { @@ -190,7 +189,7 @@ func (cim *InputManager) lock(ctx input.Context, key string) (*resource, error) return resource, nil } -func lockResource(log *logp.Logger, resource *resource, canceler input.Canceler) error { +func lockResource(log *logp.Logger, resource *resource, canceler v2.Canceler) error { if !resource.lock.TryLock() { log.Infof("Resource '%v' currently in use, waiting...", resource.key) err := resource.lock.LockContext(canceler) diff --git a/x-pack/filebeat/input/default-inputs/inputs.go b/x-pack/filebeat/input/default-inputs/inputs.go index 1fe245b80f7..cd8562560da 100644 --- a/x-pack/filebeat/input/default-inputs/inputs.go +++ b/x-pack/filebeat/input/default-inputs/inputs.go @@ -27,7 +27,7 @@ func xpackInputs(info beat.Info, log *logp.Logger, store beater.StateStore) []v2 return []v2.Plugin{ cloudfoundry.Plugin(), http_endpoint.Plugin(), - httpjson.Plugin(), + httpjson.Plugin(log, store), o365audit.Plugin(log, store), } } diff --git a/x-pack/filebeat/input/httpjson/config.go b/x-pack/filebeat/input/httpjson/config.go index 95ca205be0d..ee1445b8a3d 100644 --- a/x-pack/filebeat/input/httpjson/config.go +++ b/x-pack/filebeat/input/httpjson/config.go @@ -17,9 +17,9 @@ import ( "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" ) -// Config contains information about httpjson configuration +// config contains information about httpjson configuration type config struct { - OAuth2 *OAuth2 `config:"oauth2"` + OAuth2 *oauth2Config `config:"oauth2"` APIKey string `config:"api_key"` AuthenticationScheme string `config:"authentication_scheme"` HTTPClientTimeout time.Duration `config:"http_client_timeout"` @@ -30,21 +30,21 @@ type config struct { JSONObjects string `config:"json_objects_array"` SplitEventsBy string `config:"split_events_by"` NoHTTPBody bool `config:"no_http_body"` - Pagination *Pagination `config:"pagination"` - RateLimit *RateLimit `config:"rate_limit"` + Pagination *paginationConfig `config:"pagination"` + RateLimit *rateLimitConfig `config:"rate_limit"` RetryMax int `config:"retry.max_attempts"` RetryWaitMin time.Duration `config:"retry.wait_min"` RetryWaitMax time.Duration `config:"retry.wait_max"` TLS *tlscommon.Config `config:"ssl"` - URL *URL `config:"url" validate:"required"` - DateCursor *DateCursor `config:"date_cursor"` + URL *urlConfig `config:"url" validate:"required"` + DateCursor *dateCursorConfig `config:"date_cursor"` } // Pagination contains information about httpjson pagination settings -type Pagination struct { +type paginationConfig struct { Enabled *bool `config:"enabled"` ExtraBodyContent common.MapStr `config:"extra_body_content"` - Header *Header `config:"header"` + Header *headerConfig `config:"header"` IDField string `config:"id_field"` RequestField string `config:"req_field"` URLField string `config:"url_field"` @@ -52,76 +52,76 @@ type Pagination struct { } // IsEnabled returns true if the `enable` field is set to true in the yaml. -func (p *Pagination) IsEnabled() bool { +func (p *paginationConfig) isEnabled() bool { return p != nil && (p.Enabled == nil || *p.Enabled) } // HTTP Header information for pagination -type Header struct { +type headerConfig struct { FieldName string `config:"field_name" validate:"required"` RegexPattern *regexp.Regexp `config:"regex_pattern" validate:"required"` } // HTTP Header Rate Limit information -type RateLimit struct { +type rateLimitConfig struct { Limit string `config:"limit"` Reset string `config:"reset"` Remaining string `config:"remaining"` } -type DateCursor struct { - Enabled *bool `config:"enabled"` - Field string `config:"field"` - URLField string `config:"url_field" validate:"required"` - ValueTemplate *Template `config:"value_template"` - DateFormat string `config:"date_format"` - InitialInterval time.Duration `config:"initial_interval"` +type dateCursorConfig struct { + Enabled *bool `config:"enabled"` + Field string `config:"field"` + URLField string `config:"url_field" validate:"required"` + ValueTemplate *templateConfig `config:"value_template"` + DateFormat string `config:"date_format"` + InitialInterval time.Duration `config:"initial_interval"` } -type Template struct { +type templateConfig struct { *template.Template } -func (t *Template) Unpack(in string) error { +func (t *templateConfig) Unpack(in string) error { tpl, err := template.New("tpl").Parse(in) if err != nil { return err } - *t = Template{Template: tpl} + *t = templateConfig{Template: tpl} return nil } -type URL struct { +type urlConfig struct { *url.URL } -func (u *URL) Unpack(in string) error { +func (u *urlConfig) Unpack(in string) error { parsed, err := url.Parse(in) if err != nil { return err } - *u = URL{URL: parsed} + *u = urlConfig{URL: parsed} return nil } // IsEnabled returns true if the `enable` field is set to true in the yaml. -func (dc *DateCursor) IsEnabled() bool { +func (dc *dateCursorConfig) isEnabled() bool { return dc != nil && (dc.Enabled == nil || *dc.Enabled) } // IsEnabled returns true if the `enable` field is set to true in the yaml. -func (dc *DateCursor) GetDateFormat() string { +func (dc *dateCursorConfig) getDateFormat() string { if dc.DateFormat == "" { return time.RFC3339 } return dc.DateFormat } -func (dc *DateCursor) Validate() error { +func (dc *dateCursorConfig) Validate() error { if dc.DateFormat == "" { return nil } @@ -154,7 +154,7 @@ func (c *config) Validate() error { } } } - if c.OAuth2.IsEnabled() { + if c.OAuth2.isEnabled() { if c.APIKey != "" || c.AuthenticationScheme != "" { return errors.New("invalid configuration: oauth2 and api_key or authentication_scheme cannot be set simultaneously") } @@ -162,7 +162,7 @@ func (c *config) Validate() error { return nil } -func defaultConfig() config { +func newDefaultConfig() config { var c config c.HTTPMethod = "GET" c.HTTPClientTimeout = 60 * time.Second diff --git a/x-pack/filebeat/input/httpjson/config_oauth.go b/x-pack/filebeat/input/httpjson/config_oauth.go index 0ff55dcbc33..d7412fd0ba8 100644 --- a/x-pack/filebeat/input/httpjson/config_oauth.go +++ b/x-pack/filebeat/input/httpjson/config_oauth.go @@ -20,32 +20,32 @@ import ( "golang.org/x/oauth2/google" ) -// An OAuth2Provider represents a supported oauth provider. -type OAuth2Provider string +// An oauth2Provider represents a supported oauth provider. +type oauth2Provider string const ( - OAuth2ProviderDefault OAuth2Provider = "" // OAuth2ProviderDefault means no specific provider is set. - OAuth2ProviderAzure OAuth2Provider = "azure" // OAuth2ProviderAzure AzureAD. - OAuth2ProviderGoogle OAuth2Provider = "google" // OAuth2ProviderGoogle Google. + oauth2ProviderDefault oauth2Provider = "" // OAuth2ProviderDefault means no specific provider is set. + oauth2ProviderAzure oauth2Provider = "azure" // OAuth2ProviderAzure AzureAD. + oauth2ProviderGoogle oauth2Provider = "google" // OAuth2ProviderGoogle Google. ) -func (p *OAuth2Provider) Unpack(in string) error { - *p = OAuth2Provider(in) +func (p *oauth2Provider) Unpack(in string) error { + *p = oauth2Provider(in) return nil } -func (p OAuth2Provider) canonical() OAuth2Provider { - return OAuth2Provider(strings.ToLower(string(p))) +func (p oauth2Provider) canonical() oauth2Provider { + return oauth2Provider(strings.ToLower(string(p))) } -// OAuth2 contains information about oauth2 authentication settings. -type OAuth2 struct { +// oauth2Config contains information about oauth2 authentication settings. +type oauth2Config struct { // common oauth fields ClientID string `config:"client.id"` ClientSecret string `config:"client.secret"` Enabled *bool `config:"enabled"` EndpointParams map[string][]string `config:"endpoint_params"` - Provider OAuth2Provider `config:"provider"` + Provider oauth2Provider `config:"provider"` Scopes []string `config:"scopes"` TokenURL string `config:"token_url"` @@ -61,25 +61,26 @@ type OAuth2 struct { } // IsEnabled returns true if the `enable` field is set to true in the yaml. -func (o *OAuth2) IsEnabled() bool { +func (o *oauth2Config) isEnabled() bool { return o != nil && (o.Enabled == nil || *o.Enabled) } // Client wraps the given http.Client and returns a new one that will use the oauth authentication. -func (o *OAuth2) Client(ctx context.Context, client *http.Client) (*http.Client, error) { - ctx = context.WithValue(ctx, oauth2.HTTPClient, client) +func (o *oauth2Config) client(ctx context.Context, client *http.Client) (*http.Client, error) { + // only required to let oauth2 library to find our custom client in the context + ctx = context.WithValue(context.Background(), oauth2.HTTPClient, client) - switch o.GetProvider() { - case OAuth2ProviderAzure, OAuth2ProviderDefault: + switch o.getProvider() { + case oauth2ProviderAzure, oauth2ProviderDefault: creds := clientcredentials.Config{ ClientID: o.ClientID, ClientSecret: o.ClientSecret, - TokenURL: o.GetTokenURL(), + TokenURL: o.getTokenURL(), Scopes: o.Scopes, - EndpointParams: o.GetEndpointParams(), + EndpointParams: o.getEndpointParams(), } return creds.Client(ctx), nil - case OAuth2ProviderGoogle: + case oauth2ProviderGoogle: if o.GoogleJWTFile != "" { cfg, err := google.JWTConfigFromJSON(o.GoogleCredentialsJSON, o.Scopes...) if err != nil { @@ -100,9 +101,9 @@ func (o *OAuth2) Client(ctx context.Context, client *http.Client) (*http.Client, } // GetTokenURL returns the TokenURL. -func (o *OAuth2) GetTokenURL() string { - switch o.GetProvider() { - case OAuth2ProviderAzure: +func (o *oauth2Config) getTokenURL() string { + switch o.getProvider() { + case oauth2ProviderAzure: if o.TokenURL == "" { return endpoints.AzureAD(o.AzureTenantID).TokenURL } @@ -112,14 +113,14 @@ func (o *OAuth2) GetTokenURL() string { } // GetProvider returns provider in its canonical form. -func (o OAuth2) GetProvider() OAuth2Provider { +func (o oauth2Config) getProvider() oauth2Provider { return o.Provider.canonical() } // GetEndpointParams returns endpoint params with any provider ones combined. -func (o OAuth2) GetEndpointParams() map[string][]string { - switch o.GetProvider() { - case OAuth2ProviderAzure: +func (o oauth2Config) getEndpointParams() map[string][]string { + switch o.getProvider() { + case oauth2ProviderAzure: if o.AzureResource != "" { if o.EndpointParams == nil { o.EndpointParams = map[string][]string{} @@ -132,18 +133,18 @@ func (o OAuth2) GetEndpointParams() map[string][]string { } // Validate checks if oauth2 config is valid. -func (o *OAuth2) Validate() error { - switch o.GetProvider() { - case OAuth2ProviderAzure: +func (o *oauth2Config) Validate() error { + switch o.getProvider() { + case oauth2ProviderAzure: return o.validateAzureProvider() - case OAuth2ProviderGoogle: + case oauth2ProviderGoogle: return o.validateGoogleProvider() - case OAuth2ProviderDefault: + case oauth2ProviderDefault: if o.TokenURL == "" || o.ClientID == "" || o.ClientSecret == "" { return errors.New("invalid configuration: both token_url and client credentials must be provided") } default: - return fmt.Errorf("invalid configuration: unknown provider %q", o.GetProvider()) + return fmt.Errorf("invalid configuration: unknown provider %q", o.getProvider()) } return nil } @@ -151,7 +152,7 @@ func (o *OAuth2) Validate() error { // findDefaultGoogleCredentials will default to google.FindDefaultCredentials and will only be changed for testing purposes var findDefaultGoogleCredentials = google.FindDefaultCredentials -func (o *OAuth2) validateGoogleProvider() error { +func (o *oauth2Config) validateGoogleProvider() error { if o.TokenURL != "" || o.ClientID != "" || o.ClientSecret != "" || o.AzureTenantID != "" || o.AzureResource != "" || len(o.EndpointParams) > 0 { return errors.New("invalid configuration: none of token_url and client credentials can be used, use google.credentials_file, google.jwt_file, google.credentials_json or ADC instead") @@ -191,7 +192,7 @@ func (o *OAuth2) validateGoogleProvider() error { return fmt.Errorf("invalid configuration: no authentication credentials were configured or detected (ADC)") } -func (o *OAuth2) populateCredentialsJSONFromFile(file string) error { +func (o *oauth2Config) populateCredentialsJSONFromFile(file string) error { if _, err := os.Stat(file); os.IsNotExist(err) { return fmt.Errorf("invalid configuration: the file %q cannot be found", file) } @@ -210,7 +211,7 @@ func (o *OAuth2) populateCredentialsJSONFromFile(file string) error { return nil } -func (o *OAuth2) validateAzureProvider() error { +func (o *oauth2Config) validateAzureProvider() error { if o.TokenURL == "" && o.AzureTenantID == "" { return errors.New("invalid configuration: at least one of token_url or tenant_id must be provided") } diff --git a/x-pack/filebeat/input/httpjson/config_oauth_test.go b/x-pack/filebeat/input/httpjson/config_oauth_test.go index 3fa0eed4284..67ec63b6650 100644 --- a/x-pack/filebeat/input/httpjson/config_oauth_test.go +++ b/x-pack/filebeat/input/httpjson/config_oauth_test.go @@ -11,8 +11,8 @@ import ( func TestProviderCanonical(t *testing.T) { const ( - a OAuth2Provider = "gOoGle" - b OAuth2Provider = "google" + a oauth2Provider = "gOoGle" + b oauth2Provider = "google" ) if a.canonical() != b.canonical() { @@ -21,74 +21,74 @@ func TestProviderCanonical(t *testing.T) { } func TestGetProviderIsCanonical(t *testing.T) { - const expected OAuth2Provider = "google" + const expected oauth2Provider = "google" - oauth2 := OAuth2{Provider: "GOogle"} - if oauth2.GetProvider() != expected { + oauth2 := oauth2Config{Provider: "GOogle"} + if oauth2.getProvider() != expected { t.Fatal("GetProvider should return canonical provider") } } func TestIsEnabled(t *testing.T) { - oauth2 := OAuth2{} - if !oauth2.IsEnabled() { + oauth2 := oauth2Config{} + if !oauth2.isEnabled() { t.Fatal("OAuth2 should be enabled by default") } var enabled = false oauth2.Enabled = &enabled - if oauth2.IsEnabled() { + if oauth2.isEnabled() { t.Fatal("OAuth2 should be disabled") } enabled = true - if !oauth2.IsEnabled() { + if !oauth2.isEnabled() { t.Fatal("OAuth2 should be enabled") } } func TestGetTokenURL(t *testing.T) { const expected = "http://localhost" - oauth2 := OAuth2{TokenURL: "http://localhost"} - if got := oauth2.GetTokenURL(); got != expected { + oauth2 := oauth2Config{TokenURL: "http://localhost"} + if got := oauth2.getTokenURL(); got != expected { t.Fatalf("GetTokenURL should return the provided TokenURL but got %q", got) } } func TestGetTokenURLWithAzure(t *testing.T) { const expectedWithoutTenantID = "http://localhost" - oauth2 := OAuth2{TokenURL: "http://localhost", Provider: "azure"} - if got := oauth2.GetTokenURL(); got != expectedWithoutTenantID { + oauth2 := oauth2Config{TokenURL: "http://localhost", Provider: "azure"} + if got := oauth2.getTokenURL(); got != expectedWithoutTenantID { t.Fatalf("GetTokenURL should return the provided TokenURL but got %q", got) } oauth2.TokenURL = "" oauth2.AzureTenantID = "a_tenant_id" const expectedWithTenantID = "https://login.microsoftonline.com/a_tenant_id/oauth2/v2.0/token" - if got := oauth2.GetTokenURL(); got != expectedWithTenantID { + if got := oauth2.getTokenURL(); got != expectedWithTenantID { t.Fatalf("GetTokenURL should return the generated TokenURL but got %q", got) } } func TestGetEndpointParams(t *testing.T) { var expected = map[string][]string{"foo": {"bar"}} - oauth2 := OAuth2{EndpointParams: map[string][]string{"foo": {"bar"}}} - if got := oauth2.GetEndpointParams(); !reflect.DeepEqual(got, expected) { + oauth2 := oauth2Config{EndpointParams: map[string][]string{"foo": {"bar"}}} + if got := oauth2.getEndpointParams(); !reflect.DeepEqual(got, expected) { t.Fatalf("GetEndpointParams should return the provided EndpointParams but got %q", got) } } func TestGetEndpointParamsWithAzure(t *testing.T) { var expectedWithoutResource = map[string][]string{"foo": {"bar"}} - oauth2 := OAuth2{Provider: "azure", EndpointParams: map[string][]string{"foo": {"bar"}}} - if got := oauth2.GetEndpointParams(); !reflect.DeepEqual(got, expectedWithoutResource) { + oauth2 := oauth2Config{Provider: "azure", EndpointParams: map[string][]string{"foo": {"bar"}}} + if got := oauth2.getEndpointParams(); !reflect.DeepEqual(got, expectedWithoutResource) { t.Fatalf("GetEndpointParams should return the provided EndpointParams but got %q", got) } oauth2.AzureResource = "baz" var expectedWithResource = map[string][]string{"foo": {"bar"}, "resource": {"baz"}} - if got := oauth2.GetEndpointParams(); !reflect.DeepEqual(got, expectedWithResource) { + if got := oauth2.getEndpointParams(); !reflect.DeepEqual(got, expectedWithResource) { t.Fatalf("GetEndpointParams should return the provided EndpointParams but got %q", got) } } diff --git a/x-pack/filebeat/input/httpjson/config_test.go b/x-pack/filebeat/input/httpjson/config_test.go index 0de07311239..85c7c64848d 100644 --- a/x-pack/filebeat/input/httpjson/config_test.go +++ b/x-pack/filebeat/input/httpjson/config_test.go @@ -25,7 +25,7 @@ func TestConfigValidationCase1(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. no_http_body and http_request_body cannot coexist.") } @@ -39,7 +39,7 @@ func TestConfigValidationCase2(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. no_http_body and pagination.extra_body_content cannot coexist.") } @@ -53,7 +53,7 @@ func TestConfigValidationCase3(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. no_http_body and pagination.req_field cannot coexist.") } @@ -66,7 +66,7 @@ func TestConfigValidationCase4(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. pagination.header and pagination.req_field cannot coexist.") } @@ -79,7 +79,7 @@ func TestConfigValidationCase5(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. pagination.header and pagination.id_field cannot coexist.") } @@ -92,7 +92,7 @@ func TestConfigValidationCase6(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. pagination.header and extra_body_content cannot coexist.") } @@ -105,7 +105,7 @@ func TestConfigValidationCase7(t *testing.T) { "url": "localhost", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() if err := cfg.Unpack(&conf); err == nil { t.Fatal("Configuration validation failed. http_method DELETE is not allowed.") } @@ -116,7 +116,7 @@ func TestConfigMustFailWithInvalidURL(t *testing.T) { "url": "::invalid::", } cfg := common.MustNewConfigFrom(m) - conf := defaultConfig() + conf := newDefaultConfig() err := cfg.Unpack(&conf) assert.EqualError(t, err, `parse "::invalid::": missing protocol scheme accessing 'url'`) } @@ -414,7 +414,7 @@ func TestConfigOauth2Validation(t *testing.T) { } cfg := common.MustNewConfigFrom(c.input) - conf := defaultConfig() + conf := newDefaultConfig() err := cfg.Unpack(&conf) switch { diff --git a/x-pack/filebeat/input/httpjson/date_cursor.go b/x-pack/filebeat/input/httpjson/date_cursor.go index 2a9db44bd2a..66ca659de78 100644 --- a/x-pack/filebeat/input/httpjson/date_cursor.go +++ b/x-pack/filebeat/input/httpjson/date_cursor.go @@ -7,6 +7,7 @@ package httpjson import ( "bytes" "net/url" + "text/template" "time" "github.com/elastic/beats/v7/libbeat/common" @@ -22,13 +23,12 @@ type dateCursor struct { initialInterval time.Duration dateFormat string - value string - valueTpl *Template + valueTpl *template.Template } func newDateCursorFromConfig(config config, log *logp.Logger) *dateCursor { c := &dateCursor{ - enabled: config.DateCursor.IsEnabled(), + enabled: config.DateCursor.isEnabled(), url: *config.URL.URL, } @@ -40,23 +40,23 @@ func newDateCursorFromConfig(config config, log *logp.Logger) *dateCursor { c.field = config.DateCursor.Field c.urlField = config.DateCursor.URLField c.initialInterval = config.DateCursor.InitialInterval - c.dateFormat = config.DateCursor.GetDateFormat() - c.valueTpl = config.DateCursor.ValueTemplate + c.dateFormat = config.DateCursor.getDateFormat() + c.valueTpl = config.DateCursor.ValueTemplate.Template return c } -func (c *dateCursor) getURL() string { +func (c *dateCursor) getURL(prevValue string) string { if !c.enabled { return c.url.String() } var dateStr string - if c.value == "" { + if prevValue == "" { t := timeNow().UTC().Add(-c.initialInterval) dateStr = t.Format(c.dateFormat) } else { - dateStr = c.value + dateStr = prevValue } q := c.url.Query() @@ -66,7 +66,7 @@ func (c *dateCursor) getURL() string { value = dateStr } else { buf := new(bytes.Buffer) - if err := c.valueTpl.Template.Execute(buf, dateStr); err != nil { + if err := c.valueTpl.Execute(buf, dateStr); err != nil { return c.url.String() } value = buf.String() @@ -74,32 +74,33 @@ func (c *dateCursor) getURL() string { q.Set(c.urlField, value) - c.url.RawQuery = q.Encode() + url := c.url + url.RawQuery = q.Encode() - return c.url.String() + return url.String() } -func (c *dateCursor) advance(m common.MapStr) { +func (c *dateCursor) getNextValue(m common.MapStr) string { if c.field == "" { - c.value = time.Now().UTC().Format(c.dateFormat) - return + return time.Now().UTC().Format(c.dateFormat) } v, err := m.GetValue(c.field) if err != nil { c.log.Warnf("date_cursor field: %q", err) - return + return "" } + switch t := v.(type) { case string: _, err := time.Parse(c.dateFormat, t) if err != nil { c.log.Warn("date_cursor field does not have the expected layout") - return + return "" } - c.value = t - default: - c.log.Warn("date_cursor field must be a string, cursor will not advance") - return + return t } + + c.log.Warn("date_cursor field must be a string, cursor will not advance") + return "" } diff --git a/x-pack/filebeat/input/httpjson/input.go b/x-pack/filebeat/input/httpjson/input.go index 766fa364864..5445197f563 100644 --- a/x-pack/filebeat/input/httpjson/input.go +++ b/x-pack/filebeat/input/httpjson/input.go @@ -9,12 +9,14 @@ import ( "fmt" "net" "net/http" + "net/url" "time" "github.com/hashicorp/go-retryablehttp" "go.uber.org/zap" v2 "github.com/elastic/beats/v7/filebeat/input/v2" + cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" stateless "github.com/elastic/beats/v7/filebeat/input/v2/input-stateless" "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" @@ -63,30 +65,25 @@ func (log *retryLogger) Warn(format string, args ...interface{}) { log.log.Warnf(format, args...) } -type httpJSONInput struct { - config config - tlsConfig *tlscommon.TLSConfig -} - -func Plugin() v2.Plugin { +func Plugin(log *logp.Logger, store cursor.StateStore) v2.Plugin { + sim := stateless.NewInputManager(statelessConfigure) return v2.Plugin{ Name: inputName, Stability: feature.Beta, Deprecated: false, - Manager: stateless.NewInputManager(configure), - } -} - -func configure(cfg *common.Config) (stateless.Input, error) { - conf := defaultConfig() - if err := cfg.Unpack(&conf); err != nil { - return nil, err + Manager: inputManager{ + stateless: &sim, + cursor: &cursor.InputManager{ + Logger: log, + StateStore: store, + Type: inputName, + Configure: cursorConfigure, + }, + }, } - - return newHTTPJSONInput(conf) } -func newHTTPJSONInput(config config) (*httpJSONInput, error) { +func newTLSConfig(config config) (*tlscommon.TLSConfig, error) { if err := config.Validate(); err != nil { return nil, err } @@ -96,54 +93,53 @@ func newHTTPJSONInput(config config) (*httpJSONInput, error) { return nil, err } - return &httpJSONInput{ - config: config, - tlsConfig: tlsConfig, - }, nil + return tlsConfig, nil } -func (*httpJSONInput) Name() string { return inputName } - -func (in *httpJSONInput) Test(v2.TestContext) error { +func test(url *url.URL) error { port := func() string { - if in.config.URL.Port() != "" { - return in.config.URL.Port() + if url.Port() != "" { + return url.Port() } - switch in.config.URL.Scheme { + switch url.Scheme { case "https": return "443" } return "80" }() - _, err := net.DialTimeout("tcp", net.JoinHostPort(in.config.URL.Hostname(), port), time.Second) + _, err := net.DialTimeout("tcp", net.JoinHostPort(url.Hostname(), port), time.Second) if err != nil { - return fmt.Errorf("url %q is unreachable", in.config.URL) + return fmt.Errorf("url %q is unreachable", url) } return nil } -// Run starts the input and blocks until it ends the execution. -// It will return on context cancellation, any other error will be retried. -func (in *httpJSONInput) Run(ctx v2.Context, publisher stateless.Publisher) error { - log := ctx.Logger.With("url", in.config.URL) +func run( + ctx v2.Context, + config config, + tlsConfig *tlscommon.TLSConfig, + publisher cursor.Publisher, + cursor *cursor.Cursor, +) error { + log := ctx.Logger.With("url", config.URL) stdCtx := ctxtool.FromCanceller(ctx.Cancelation) - httpClient, err := in.newHTTPClient(stdCtx) + httpClient, err := newHTTPClient(stdCtx, config, tlsConfig) if err != nil { return err } - dateCursor := newDateCursorFromConfig(in.config, log) + dateCursor := newDateCursorFromConfig(config, log) - rateLimiter := newRateLimiterFromConfig(in.config, log) + rateLimiter := newRateLimiterFromConfig(config, log) - pagination := newPaginationFromConfig(in.config) + pagination := newPaginationFromConfig(config) requester := newRequester( - in.config, + config, rateLimiter, dateCursor, pagination, @@ -151,12 +147,14 @@ func (in *httpJSONInput) Run(ctx v2.Context, publisher stateless.Publisher) erro log, ) + requester.loadCursor(cursor, log) + // TODO: disallow passing interval = 0 as a mean to run once. - if in.config.Interval == 0 { + if config.Interval == 0 { return requester.processHTTPRequest(stdCtx, publisher) } - err = timed.Periodic(stdCtx, in.config.Interval, func() error { + err = timed.Periodic(stdCtx, config.Interval, func() error { log.Info("Process another repeated request.") if err := requester.processHTTPRequest(stdCtx, publisher); err != nil { log.Error(err) @@ -169,29 +167,29 @@ func (in *httpJSONInput) Run(ctx v2.Context, publisher stateless.Publisher) erro return nil } -func (in *httpJSONInput) newHTTPClient(ctx context.Context) (*http.Client, error) { +func newHTTPClient(ctx context.Context, config config, tlsConfig *tlscommon.TLSConfig) (*http.Client, error) { // Make retryable HTTP client client := &retryablehttp.Client{ HTTPClient: &http.Client{ Transport: &http.Transport{ DialContext: (&net.Dialer{ - Timeout: in.config.HTTPClientTimeout, + Timeout: config.HTTPClientTimeout, }).DialContext, - TLSClientConfig: in.tlsConfig.ToConfig(), + TLSClientConfig: tlsConfig.ToConfig(), DisableKeepAlives: true, }, - Timeout: in.config.HTTPClientTimeout, + Timeout: config.HTTPClientTimeout, }, Logger: newRetryLogger(), - RetryWaitMin: in.config.RetryWaitMin, - RetryWaitMax: in.config.RetryWaitMax, - RetryMax: in.config.RetryMax, + RetryWaitMin: config.RetryWaitMin, + RetryWaitMax: config.RetryWaitMax, + RetryMax: config.RetryMax, CheckRetry: retryablehttp.DefaultRetryPolicy, Backoff: retryablehttp.DefaultBackoff, } - if in.config.OAuth2.IsEnabled() { - return in.config.OAuth2.Client(ctx, client.StandardClient()) + if config.OAuth2.isEnabled() { + return config.OAuth2.client(ctx, client.StandardClient()) } return client.StandardClient(), nil diff --git a/x-pack/filebeat/input/httpjson/input_cursor.go b/x-pack/filebeat/input/httpjson/input_cursor.go new file mode 100644 index 00000000000..d18a91f3918 --- /dev/null +++ b/x-pack/filebeat/input/httpjson/input_cursor.go @@ -0,0 +1,67 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package httpjson + +import ( + v2 "github.com/elastic/beats/v7/filebeat/input/v2" + cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" +) + +type cursorInput struct{} + +func (cursorInput) Name() string { + return "httpjson-cursor" +} + +type source struct { + config config + tlsConfig *tlscommon.TLSConfig +} + +func (src source) Name() string { + return src.config.URL.String() +} + +func cursorConfigure(cfg *common.Config) ([]cursor.Source, cursor.Input, error) { + conf := newDefaultConfig() + if err := cfg.Unpack(&conf); err != nil { + return nil, nil, err + } + return newCursorInput(conf) +} + +func newCursorInput(config config) ([]cursor.Source, cursor.Input, error) { + tlsConfig, err := newTLSConfig(config) + if err != nil { + return nil, nil, err + } + // we only allow one url per config, if we wanted to allow more than one + // each source should hold only one url + return []cursor.Source{ + &source{config: config, + tlsConfig: tlsConfig, + }, + }, + &cursorInput{}, + nil +} + +func (in *cursorInput) Test(src cursor.Source, _ v2.TestContext) error { + return test((src.(*source)).config.URL.URL) +} + +// Run starts the input and blocks until it ends the execution. +// It will return on context cancellation, any other error will be retried. +func (in *cursorInput) Run( + ctx v2.Context, + src cursor.Source, + cursor cursor.Cursor, + publisher cursor.Publisher, +) error { + s := src.(*source) + return run(ctx, s.config, s.tlsConfig, publisher, &cursor) +} diff --git a/x-pack/filebeat/input/httpjson/input_manager.go b/x-pack/filebeat/input/httpjson/input_manager.go new file mode 100644 index 00000000000..21f5066dc05 --- /dev/null +++ b/x-pack/filebeat/input/httpjson/input_manager.go @@ -0,0 +1,49 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package httpjson + +import ( + "go.uber.org/multierr" + + "github.com/elastic/go-concert/unison" + + v2 "github.com/elastic/beats/v7/filebeat/input/v2" + cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" + stateless "github.com/elastic/beats/v7/filebeat/input/v2/input-stateless" + "github.com/elastic/beats/v7/libbeat/common" +) + +// inputManager wraps one stateless input manager +// and one cursor input manager. It will create one or the other +// based on the config that is passed. +type inputManager struct { + stateless *stateless.InputManager + cursor *cursor.InputManager +} + +var _ v2.InputManager = inputManager{} + +// Init initializes both wrapped input managers. +func (m inputManager) Init(grp unison.Group, mode v2.Mode) error { + return multierr.Append( + m.stateless.Init(grp, mode), + m.cursor.Init(grp, mode), + ) +} + +// Create creates a cursor input manager if the config has a date cursor set up, +// otherwise it creates a stateless input manager. +func (m inputManager) Create(cfg *common.Config) (v2.Input, error) { + var config config + if err := cfg.Unpack(&config); err != nil { + return nil, err + } + + if config.DateCursor != nil { + return m.cursor.Create(cfg) + } + + return m.stateless.Create(cfg) +} diff --git a/x-pack/filebeat/input/httpjson/input_stateless.go b/x-pack/filebeat/input/httpjson/input_stateless.go new file mode 100644 index 00000000000..c7ebf6c3d4c --- /dev/null +++ b/x-pack/filebeat/input/httpjson/input_stateless.go @@ -0,0 +1,58 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package httpjson + +import ( + v2 "github.com/elastic/beats/v7/filebeat/input/v2" + stateless "github.com/elastic/beats/v7/filebeat/input/v2/input-stateless" + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/transport/tlscommon" +) + +type statelessInput struct { + config config + tlsConfig *tlscommon.TLSConfig +} + +func (statelessInput) Name() string { + return "httpjson-stateless" +} + +func statelessConfigure(cfg *common.Config) (stateless.Input, error) { + conf := newDefaultConfig() + if err := cfg.Unpack(&conf); err != nil { + return nil, err + } + return newStatelessInput(conf) +} + +func newStatelessInput(config config) (*statelessInput, error) { + tlsConfig, err := newTLSConfig(config) + if err != nil { + return nil, err + } + return &statelessInput{config: config, tlsConfig: tlsConfig}, nil +} + +func (in *statelessInput) Test(v2.TestContext) error { + return test(in.config.URL.URL) +} + +type statelessPublisher struct { + wrapped stateless.Publisher +} + +func (pub statelessPublisher) Publish(event beat.Event, _ interface{}) error { + pub.wrapped.Publish(event) + return nil +} + +// Run starts the input and blocks until it ends the execution. +// It will return on context cancellation, any other error will be retried. +func (in *statelessInput) Run(ctx v2.Context, publisher stateless.Publisher) error { + pub := statelessPublisher{wrapped: publisher} + return run(ctx, in.config, in.tlsConfig, pub, nil) +} diff --git a/x-pack/filebeat/input/httpjson/httpjson_test.go b/x-pack/filebeat/input/httpjson/input_test.go similarity index 96% rename from x-pack/filebeat/input/httpjson/httpjson_test.go rename to x-pack/filebeat/input/httpjson/input_test.go index b541c16002e..242811d2795 100644 --- a/x-pack/filebeat/input/httpjson/httpjson_test.go +++ b/x-pack/filebeat/input/httpjson/input_test.go @@ -23,7 +23,7 @@ import ( beattest "github.com/elastic/beats/v7/libbeat/publisher/testing" ) -func TestHTTPJSONInput(t *testing.T) { +func TestStatelessHTTPJSONInput(t *testing.T) { testCases := []struct { name string setupServer func(*testing.T, http.HandlerFunc, map[string]interface{}) @@ -224,20 +224,23 @@ func TestHTTPJSONInput(t *testing.T) { cfg := common.MustNewConfigFrom(tc.baseConfig) - input, err := configure(cfg) + conf := newDefaultConfig() + assert.NoError(t, cfg.Unpack(&conf)) + + input, err := newStatelessInput(conf) assert.NoError(t, err) - assert.Equal(t, "httpjson", input.Name()) + assert.Equal(t, "httpjson-stateless", input.Name()) assert.NoError(t, input.Test(v2.TestContext{})) - pub := beattest.NewChanClient(len(tc.expected)) - t.Cleanup(func() { _ = pub.Close() }) + chanClient := beattest.NewChanClient(len(tc.expected)) + t.Cleanup(func() { _ = chanClient.Close() }) ctx, cancel := newV2Context() t.Cleanup(cancel) var g errgroup.Group - g.Go(func() error { return input.Run(ctx, pub) }) + g.Go(func() error { return input.Run(ctx, chanClient) }) timeout := time.NewTimer(5 * time.Second) t.Cleanup(func() { _ = timeout.Stop() }) @@ -249,7 +252,7 @@ func TestHTTPJSONInput(t *testing.T) { case <-timeout.C: t.Errorf("timed out waiting for %d events", len(tc.expected)) return - case got := <-pub.Channel: + case got := <-chanClient.Channel: val, err := got.Fields.GetValue("message") assert.NoError(t, err) assert.JSONEq(t, tc.expected[receivedCount], val.(string)) diff --git a/x-pack/filebeat/input/httpjson/pagination.go b/x-pack/filebeat/input/httpjson/pagination.go index 9a7bf82b2b4..020bc783055 100644 --- a/x-pack/filebeat/input/httpjson/pagination.go +++ b/x-pack/filebeat/input/httpjson/pagination.go @@ -16,7 +16,7 @@ import ( type pagination struct { extraBodyContent common.MapStr - header *Header + header *headerConfig idField string requestField string urlField string @@ -24,7 +24,7 @@ type pagination struct { } func newPaginationFromConfig(config config) *pagination { - if !config.Pagination.IsEnabled() { + if !config.Pagination.isEnabled() { return nil } return &pagination{ diff --git a/x-pack/filebeat/input/httpjson/pagination_test.go b/x-pack/filebeat/input/httpjson/pagination_test.go index 9b04de75819..32e3261c1e6 100644 --- a/x-pack/filebeat/input/httpjson/pagination_test.go +++ b/x-pack/filebeat/input/httpjson/pagination_test.go @@ -42,7 +42,7 @@ func TestCreateRequestInfoFromBody(t *testing.T) { contentMap: common.MapStr{}, headers: common.MapStr{}, } - err := pagination.setRequestInfoFromBody( + _ = pagination.setRequestInfoFromBody( common.MapStr(m), common.MapStr(m), ri, diff --git a/x-pack/filebeat/input/httpjson/rate_limiter.go b/x-pack/filebeat/input/httpjson/rate_limiter.go index 57d206224ac..93c2b4a3fe7 100644 --- a/x-pack/filebeat/input/httpjson/rate_limiter.go +++ b/x-pack/filebeat/input/httpjson/rate_limiter.go @@ -122,7 +122,7 @@ func (r *rateLimiter) getRateLimit(header http.Header) (int64, error) { if err != nil { return 0, fmt.Errorf("failed to parse rate-limit reset value: %w", err) } - if time.Unix(epoch, 0).Sub(time.Now()) <= 0 { + if time.Until(time.Unix(epoch, 0)) <= 0 { return 0, nil } diff --git a/x-pack/filebeat/input/httpjson/requester.go b/x-pack/filebeat/input/httpjson/requester.go index b5f58179aa0..df0a1efb1eb 100644 --- a/x-pack/filebeat/input/httpjson/requester.go +++ b/x-pack/filebeat/input/httpjson/requester.go @@ -14,7 +14,7 @@ import ( "net/http" "strings" - stateless "github.com/elastic/beats/v7/filebeat/input/v2/input-stateless" + cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/logp" ) @@ -40,6 +40,8 @@ type requester struct { authScheme string jsonObjects string splitEventsBy string + + cursorState cursorState } func newRequester( @@ -72,9 +74,9 @@ type response struct { } // processHTTPRequest processes HTTP request, and handles pagination if enabled -func (r *requester) processHTTPRequest(ctx context.Context, publisher stateless.Publisher) error { +func (r *requester) processHTTPRequest(ctx context.Context, publisher cursor.Publisher) error { ri := &requestInfo{ - url: r.dateCursor.getURL(), + url: r.dateCursor.getURL(r.cursorState.LastDateCursorValue), contentMap: common.MapStr{}, headers: r.headers, } @@ -166,7 +168,7 @@ func (r *requester) processHTTPRequest(ctx context.Context, publisher stateless. } if lastObj != nil && r.dateCursor.enabled { - r.dateCursor.advance(common.MapStr(lastObj)) + r.updateCursorState(ri.url, r.dateCursor.getNextValue(common.MapStr(lastObj))) } return nil @@ -210,7 +212,7 @@ func (r *requester) createHTTPRequest(ctx context.Context, ri *requestInfo) (*ht } // processEventArray publishes an event for each object contained in the array. It returns the last object in the array and an error if any. -func (r *requester) processEventArray(publisher stateless.Publisher, events []interface{}) (map[string]interface{}, error) { +func (r *requester) processEventArray(publisher cursor.Publisher, events []interface{}) (map[string]interface{}, error) { var last map[string]interface{} for _, t := range events { switch v := t.(type) { @@ -221,7 +223,9 @@ func (r *requester) processEventArray(publisher stateless.Publisher, events []in if err != nil { return nil, fmt.Errorf("failed to marshal %+v: %w", e, err) } - publisher.Publish(makeEvent(string(d))) + if err := publisher.Publish(makeEvent(string(d)), r.cursorState); err != nil { + return nil, fmt.Errorf("failed to publish: %w", err) + } } default: return nil, fmt.Errorf("expected only JSON objects in the array but got a %T", v) @@ -273,3 +277,23 @@ func splitEvent(splitKey string, event map[string]interface{}) []map[string]inte return events } + +type cursorState struct { + LastCalledURL string + LastDateCursorValue string +} + +func (r *requester) updateCursorState(url, value string) { + r.cursorState.LastCalledURL = url + r.cursorState.LastDateCursorValue = value +} + +func (r *requester) loadCursor(c *cursor.Cursor, log *logp.Logger) { + if c == nil || c.IsNew() { + return + } + + if err := c.Unpack(&r.cursorState); err != nil { + log.Errorf("Reset http cursor state. Failed to read from registry: %v", err) + } +} From 2996b6f1891ec03f48ab5cf2d2b989b94e7ec1d9 Mon Sep 17 00:00:00 2001 From: Blake Rouse Date: Tue, 29 Sep 2020 11:01:15 -0400 Subject: [PATCH 079/216] [Elastic Agent] Add install/uninstall sub-command (#21206) * Add install command. * Fix binary name on darwin. * Fix install of mkdir. * Update shell wrapper path for darwin. * Add ability to fix broken installation. * Fix issues with install/uninstall. * Add dedicated uninstall command. * Add enrollment at the end of install command. * Fix installation of shell wrapper. * Fix root_windows.go * Fix uninstall on Windows. * Add sleep to removal on Windows. * Fix sleep to timeout in uninstall subcommand. * Fix uninstall for nested timeout with cmd.exe. * Fix uninstall on windows to actually sleep correctly. * Fix formatting. * Add changelog. * Fixes for mage check. * Create the symlink on Windows on install, fix issue with enroll questions during install. * Refactor to remove the paths.yml and symlink dance on Windows, because new install command handles that. * Cleanup repeat GA warning. * Fix symlink on Windows. * Fix control socket on windows. * Fix socket path and authority on Windows. * Fix username matching for SYSTEM. * Fix socket path on darwin. * Fix darwin service name. Fix uninstall on systemd. * Fix install on linux. * Fix RunningInstalled on Linux. * Prevent upgrade unless conditions are correct. * Add ability to force upgradable with DEV=true when built. * Fixes from code review. * Fix issue with service description. --- NOTICE.txt | 109 +++++++++++++ dev-tools/notice/rules.json | 3 +- .../templates/linux/elastic-agent.sh.tmpl | 1 - go.mod | 3 + go.sum | 11 ++ libbeat/common/cli/input.go | 43 +++++ libbeat/common/cli/input_test.go | 63 +++++++ x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + x-pack/elastic-agent/magefile.go | 1 + .../pkg/agent/application/paths/paths.go | 108 +++++------- .../agent/application/upgrade/step_mark.go | 54 +----- .../agent/application/upgrade/step_relink.go | 14 +- .../pkg/agent/application/upgrade/upgrade.go | 45 +++-- x-pack/elastic-agent/pkg/agent/cmd/checks.go | 57 ------- .../pkg/agent/cmd/checks_windows.go | 114 ------------- x-pack/elastic-agent/pkg/agent/cmd/common.go | 59 +------ x-pack/elastic-agent/pkg/agent/cmd/enroll.go | 50 +++++- x-pack/elastic-agent/pkg/agent/cmd/install.go | 154 ++++++++++++++++++ .../elastic-agent/pkg/agent/cmd/uninstall.go | 95 +++++++++++ .../elastic-agent/pkg/agent/control/addr.go | 7 + .../pkg/agent/control/addr_windows.go | 7 + .../pkg/agent/control/server/listener.go | 1 - .../agent/control/server/listener_windows.go | 31 +++- .../pkg/agent/install/install.go | 142 ++++++++++++++++ .../pkg/agent/install/install_unix.go | 13 ++ .../pkg/agent/install/install_windows.go | 35 ++++ .../pkg/agent/install/installed.go | 75 +++++++++ .../elastic-agent/pkg/agent/install/paths.go | 30 ++++ .../pkg/agent/install/paths_darwin.go | 29 ++++ .../pkg/agent/install/paths_windows.go | 27 +++ .../pkg/agent/install/root_unix.go | 19 +++ .../pkg/agent/install/root_windows.go | 27 +++ x-pack/elastic-agent/pkg/agent/install/svc.go | 38 +++++ .../pkg/agent/install/svc_unix.go | 15 ++ .../pkg/agent/install/svc_windows.go | 49 ++++++ .../pkg/agent/install/uninstall.go | 71 ++++++++ x-pack/elastic-agent/pkg/agent/warn/warn.go | 1 + x-pack/elastic-agent/pkg/release/upgrade.go | 10 ++ x-pack/elastic-agent/pkg/release/version.go | 17 ++ 39 files changed, 1242 insertions(+), 387 deletions(-) create mode 100644 libbeat/common/cli/input.go create mode 100644 libbeat/common/cli/input_test.go delete mode 100644 x-pack/elastic-agent/pkg/agent/cmd/checks.go delete mode 100644 x-pack/elastic-agent/pkg/agent/cmd/checks_windows.go create mode 100644 x-pack/elastic-agent/pkg/agent/cmd/install.go create mode 100644 x-pack/elastic-agent/pkg/agent/cmd/uninstall.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/install.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/install_unix.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/install_windows.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/installed.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/paths.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/paths_darwin.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/paths_windows.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/root_unix.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/root_windows.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/svc.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/svc_unix.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/svc_windows.go create mode 100644 x-pack/elastic-agent/pkg/agent/install/uninstall.go create mode 100644 x-pack/elastic-agent/pkg/release/upgrade.go diff --git a/NOTICE.txt b/NOTICE.txt index 748fe0f5e98..527c1304379 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -10907,6 +10907,36 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Dependency : github.com/blakerouse/service +Version: v1.1.1-0.20200924160513-057808572ffa +Licence type (autodetected): Zlib +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/blakerouse/service@v1.1.1-0.20200924160513-057808572ffa/LICENSE: + +Copyright (c) 2015 Daniel Theophanes + +This software is provided 'as-is', without any express or implied +warranty. In no event will the authors be held liable for any damages +arising from the use of this software. + +Permission is granted to anyone to use this software for any purpose, +including commercial applications, and to alter it and redistribute it +freely, subject to the following restrictions: + + 1. The origin of this software must not be misrepresented; you must not + claim that you wrote the original software. If you use this software + in a product, an acknowledgment in the product documentation would be + appreciated but is not required. + + 2. Altered source versions must be plainly marked as such, and must not be + misrepresented as being the original software. + + 3. This notice may not be removed or altered from any source + distribution. + + -------------------------------------------------------------------------------- Dependency : github.com/lib/pq Version: v1.1.2-0.20190507191818-2ff3cb3adc01 @@ -11843,6 +11873,37 @@ Contents of probable licence file $GOMODCACHE/github.com/oklog/ulid@v1.3.1/LICEN limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/otiai10/copy +Version: v1.2.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/otiai10/copy@v1.2.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2018 otiai10 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : github.com/pierrre/gotestcover Version: v0.0.0-20160517101806-924dca7d15f0 @@ -34009,6 +34070,54 @@ Contents of probable licence file $GOMODCACHE/github.com/opencontainers/runtime- limitations under the License. +-------------------------------------------------------------------------------- +Dependency : github.com/otiai10/curr +Version: v1.0.0 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/otiai10/curr@v1.0.0/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2020 Hiromu Ochiai + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/otiai10/mint +Version: v1.3.1 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/otiai10/mint@v1.3.1/LICENSE: + +Copyright 2017 otiai10 (Hiromu OCHIAI) + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : github.com/oxtoacart/bpool Version: v0.0.0-20150712133111-4e1c5567d7c2 diff --git a/dev-tools/notice/rules.json b/dev-tools/notice/rules.json index 73ce763cdae..c9638a9c6cf 100644 --- a/dev-tools/notice/rules.json +++ b/dev-tools/notice/rules.json @@ -9,7 +9,8 @@ "ISC", "MIT", "MPL-2.0", - "Public Domain" + "Public Domain", + "Zlib" ], "maybelist": [ "EPL-1.0", diff --git a/dev-tools/packaging/templates/linux/elastic-agent.sh.tmpl b/dev-tools/packaging/templates/linux/elastic-agent.sh.tmpl index 744abc05702..835b5955324 100644 --- a/dev-tools/packaging/templates/linux/elastic-agent.sh.tmpl +++ b/dev-tools/packaging/templates/linux/elastic-agent.sh.tmpl @@ -6,6 +6,5 @@ exec /usr/share/{{.BeatName}}/bin/{{.BeatName}} \ --path.home /var/lib/{{.BeatName}} \ --path.config /etc/{{.BeatName}} \ - --path.data /var/lib/{{.BeatName}}/data \ --path.logs /var/log/{{.BeatName}} \ "$@" diff --git a/go.mod b/go.mod index 2fafe750879..09cd086cbee 100644 --- a/go.mod +++ b/go.mod @@ -107,6 +107,7 @@ require ( github.com/josephspurrier/goversioninfo v0.0.0-20190209210621-63e6d1acd3dd github.com/jpillora/backoff v1.0.0 // indirect github.com/jstemmer/go-junit-report v0.9.1 + github.com/kardianos/service v1.1.0 github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect github.com/lib/pq v1.1.2-0.20190507191818-2ff3cb3adc01 github.com/magefile/mage v1.10.0 @@ -123,6 +124,7 @@ require ( github.com/oklog/ulid v1.3.1 github.com/opencontainers/go-digest v1.0.0-rc1.0.20190228220655-ac19fd6e7483 // indirect github.com/opencontainers/image-spec v1.0.2-0.20190823105129-775207bd45b6 // indirect + github.com/otiai10/copy v1.2.0 github.com/pierrre/gotestcover v0.0.0-20160517101806-924dca7d15f0 github.com/pkg/errors v0.9.1 github.com/pmezard/go-difflib v1.0.0 @@ -195,6 +197,7 @@ replace ( github.com/fsnotify/fsnotify => github.com/adriansr/fsnotify v0.0.0-20180417234312-c9bbe1f46f1d github.com/google/gopacket => github.com/adriansr/gopacket v1.1.18-0.20200327165309-dd62abfa8a41 github.com/insomniacslk/dhcp => github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3 // indirect + github.com/kardianos/service => github.com/blakerouse/service v1.1.1-0.20200924160513-057808572ffa github.com/tonistiigi/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c golang.org/x/tools => golang.org/x/tools v0.0.0-20200602230032-c00d67ef29d0 // release 1.14 ) diff --git a/go.sum b/go.sum index 44f6eeb2ba0..031f1faa095 100644 --- a/go.sum +++ b/go.sum @@ -127,6 +127,8 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/blakerouse/service v1.1.1-0.20200924160513-057808572ffa h1:aXHPZwx8Y5z8r+1WPylnu095usTf6QSshaHs6nVMBc0= +github.com/blakerouse/service v1.1.1-0.20200924160513-057808572ffa/go.mod h1:RrJI2xn5vve/r32U5suTbeaSGoMU6GbNPoj36CVYcHc= github.com/blakesmith/ar v0.0.0-20150311145944-8bd4349a67f2 h1:oMCHnXa6CCCafdPDbMh/lWRhRByN0VFLvv+g+ayx1SI= github.com/blakesmith/ar v0.0.0-20150311145944-8bd4349a67f2/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI= github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk= @@ -563,6 +565,14 @@ github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rm github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs= +github.com/otiai10/copy v1.2.0 h1:HvG945u96iNadPoG2/Ja2+AUJeW5YuFQMixq9yirC+k= +github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw= +github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE= +github.com/otiai10/curr v1.0.0 h1:TJIWdbX0B+kpNagQrjgq8bCMrbhiuX73M2XwgtDMoOI= +github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs= +github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo= +github.com/otiai10/mint v1.3.1 h1:BCmzIS3n71sGfHB5NMNDB3lHYPz8fWSkCAErHed//qc= +github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc= github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2 h1:CXwSGu/LYmbjEab5aMCs5usQRVBGThelUKBNnoSOuso= github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2/go.mod h1:L3UMQOThbttwfYRNFOWLLVXMhk5Lkio4GGOtw5UrxS0= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= @@ -817,6 +827,7 @@ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5h golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= diff --git a/libbeat/common/cli/input.go b/libbeat/common/cli/input.go new file mode 100644 index 00000000000..a6a516fd3d4 --- /dev/null +++ b/libbeat/common/cli/input.go @@ -0,0 +1,43 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package cli + +import ( + "bufio" + "fmt" + "io" + "os" + + "github.com/pkg/errors" +) + +// ReadInput shows the text and ask the user to provide input. +func ReadInput(prompt string) (string, error) { + reader := bufio.NewReader(os.Stdin) + return input(reader, prompt) +} + +func input(r io.Reader, prompt string) (string, error) { + reader := bufio.NewScanner(r) + fmt.Print(prompt + " ") + + if !reader.Scan() { + return "", errors.New("error reading user input") + } + return reader.Text(), nil +} diff --git a/libbeat/common/cli/input_test.go b/libbeat/common/cli/input_test.go new file mode 100644 index 00000000000..de87b5efe2a --- /dev/null +++ b/libbeat/common/cli/input_test.go @@ -0,0 +1,63 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package cli + +import ( + "strings" + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestReadInput(t *testing.T) { + tests := []struct { + name string + input string + res string + }{ + { + name: "Question 1?", + input: "\n", + res: "", + }, + { + name: "Question 2?", + input: "full string input\n", + res: "full string input", + }, + { + name: "Question 3?", + input: "123456789\n", + res: "123456789", + }, + { + name: "Question 4?", + input: "false\n", + res: "false", + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + r := strings.NewReader(test.input) + result, err := input(r, test.name) + assert.NoError(t, err) + assert.Equal(t, test.res, result) + }) + } +} diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 3963dda9a12..be0cfc459e8 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -26,3 +26,4 @@ - Add support for dynamic inputs with providers and `{{variable|"default"}}` substitution. {pull}20839[20839] - Add support for EQL based condition on inputs {pull}20994[20994] - Send `fleet.host.id` to Endpoint Security {pull}21042[21042] +- Add `install` and `uninstall` subcommands {pull}21206[21206] diff --git a/x-pack/elastic-agent/magefile.go b/x-pack/elastic-agent/magefile.go index 7296e8189be..4fa067f8f8b 100644 --- a/x-pack/elastic-agent/magefile.go +++ b/x-pack/elastic-agent/magefile.go @@ -658,6 +658,7 @@ func buildVars() map[string]string { if isDevFlag, devFound := os.LookupEnv(devEnv); devFound { if isDev, err := strconv.ParseBool(isDevFlag); err == nil && isDev { vars["github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release.allowEmptyPgp"] = "true" + vars["github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release.allowUpgrade"] = "true" } } diff --git a/x-pack/elastic-agent/pkg/agent/application/paths/paths.go b/x-pack/elastic-agent/pkg/agent/application/paths/paths.go index 48544ec7593..b646f3796ba 100644 --- a/x-pack/elastic-agent/pkg/agent/application/paths/paths.go +++ b/x-pack/elastic-agent/pkg/agent/application/paths/paths.go @@ -6,121 +6,87 @@ package paths import ( "flag" + "fmt" "os" "path/filepath" - "runtime" - "sync" + "strings" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) var ( - homePath string - configPath string - dataPath string - logsPath string - serviceName string - - overridesLoader sync.Once + topPath string + configPath string + logsPath string ) func init() { - initialHome := initialHome() + topPath = initialTop() + configPath = topPath + logsPath = topPath fs := flag.CommandLine - fs.StringVar(&homePath, "path.home", initialHome, "Agent root path") - fs.StringVar(&configPath, "path.config", initialHome, "Config path is the directory Agent looks for its config file") - fs.StringVar(&dataPath, "path.data", filepath.Join(initialHome, "data"), "Data path contains Agent managed binaries") - fs.StringVar(&logsPath, "path.logs", initialHome, "Logs path contains Agent log output") + fs.StringVar(&topPath, "path.home", topPath, "Agent root path") + fs.StringVar(&configPath, "path.config", configPath, "Config path is the directory Agent looks for its config file") + fs.StringVar(&logsPath, "path.logs", logsPath, "Logs path contains Agent log output") } -// UpdatePaths update paths based on changes in paths file. -func UpdatePaths() { - getOverrides() -} - -func getOverrides() { - type paths struct { - HomePath string `config:"path.home" yaml:"path.home"` - ConfigPath string `config:"path.config" yaml:"path.config"` - DataPath string `config:"path.data" yaml:"path.data"` - LogsPath string `config:"path.logs" yaml:"path.logs"` - ServiceName string `config:"path.service_name" yaml:"path.service_name"` - } - - defaults := &paths{ - HomePath: homePath, - ConfigPath: configPath, - DataPath: dataPath, - LogsPath: logsPath, - } - - pathsFile := filepath.Join(dataPath, "paths.yml") - rawConfig, err := config.LoadYAML(pathsFile) - if err != nil { - return - } - - rawConfig.Unpack(defaults) - homePath = defaults.HomePath - configPath = defaults.ConfigPath - dataPath = defaults.DataPath - logsPath = defaults.LogsPath - serviceName = defaults.ServiceName -} - -// ServiceName return predefined service name if defined by initial call. -func ServiceName() string { - // needs to do this at this place because otherwise it will - // get overwritten by flags behavior. - overridesLoader.Do(getOverrides) - return serviceName +// Top returns the top directory for Elastic Agent, all the versioned +// home directories live under this top-level/data/elastic-agent-${hash} +func Top() string { + return topPath } // Home returns a directory where binary lives -// Executable is not supported on nacl. func Home() string { - overridesLoader.Do(getOverrides) - return homePath + return versionedHome(topPath) } // Config returns a directory where configuration file lives func Config() string { - overridesLoader.Do(getOverrides) return configPath } // Data returns the data directory for Agent func Data() string { - overridesLoader.Do(getOverrides) - return dataPath + return filepath.Join(Top(), "data") } // Logs returns a the log directory for Agent func Logs() string { - overridesLoader.Do(getOverrides) return logsPath } +// initialTop returns the initial top-level path for the binary +// +// When nested in top-level/data/elastic-agent-${hash}/ the result is top-level/. +func initialTop() string { + exePath := retrieveExecutablePath() + if insideData(exePath) { + return filepath.Dir(filepath.Dir(exePath)) + } + return exePath +} + +// retrieveExecutablePath returns the executing binary, even if the started binary was a symlink func retrieveExecutablePath() string { execPath, err := os.Executable() if err != nil { panic(err) } - evalPath, err := filepath.EvalSymlinks(execPath) if err != nil { panic(err) } - return filepath.Dir(evalPath) } -func initialHome() string { - exePath := retrieveExecutablePath() - if runtime.GOOS == "windows" { - return exePath - } +// insideData returns true when the exePath is inside of the current Agents data path. +func insideData(exePath string) bool { + expectedPath := filepath.Join("data", fmt.Sprintf("elastic-agent-%s", release.ShortCommit())) + return strings.HasSuffix(exePath, expectedPath) +} - return filepath.Dir(filepath.Dir(exePath)) // is two level up the executable (symlink evaluated) +func versionedHome(base string) string { + return filepath.Join(base, "data", fmt.Sprintf("elastic-agent-%s", release.ShortCommit())) } diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go index 0d8253bb9ca..53920e6ecff 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go @@ -6,11 +6,8 @@ package upgrade import ( "context" - "fmt" "io/ioutil" - "os" "path/filepath" - "runtime" "time" "gopkg.in/yaml.v2" @@ -41,10 +38,6 @@ type updateMarker struct { // markUpgrade marks update happened so we can handle grace period func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action *fleetapi.ActionUpgrade) error { - if err := updateHomePath(hash); err != nil { - return err - } - prevVersion := release.Version() prevHash := release.Commit() if len(prevHash) > hashLen { @@ -69,55 +62,10 @@ func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action *fleetap return errors.New(err, errors.TypeFilesystem, "failed to create update marker file", errors.M(errors.MetaKeyPath, markerPath)) } - activeCommitPath := filepath.Join(paths.Config(), agentCommitFile) + activeCommitPath := filepath.Join(paths.Top(), agentCommitFile) if err := ioutil.WriteFile(activeCommitPath, []byte(hash), 0644); err != nil { return errors.New(err, errors.TypeFilesystem, "failed to update active commit", errors.M(errors.MetaKeyPath, activeCommitPath)) } return nil } - -func updateHomePath(hash string) error { - if err := createPathsSymlink(hash); err != nil { - return errors.New(err, errors.TypeFilesystem, "failed to create paths symlink") - } - - pathsMap := make(map[string]string) - pathsFilepath := filepath.Join(paths.Data(), "paths.yml") - - pathsBytes, err := ioutil.ReadFile(pathsFilepath) - if err != nil { - return errors.New(err, errors.TypeConfig, "failed to read paths file") - } - - if err := yaml.Unmarshal(pathsBytes, &pathsMap); err != nil { - return errors.New(err, errors.TypeConfig, "failed to parse paths file") - } - - pathsMap["path.home"] = filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, hash)) - - pathsBytes, err = yaml.Marshal(pathsMap) - if err != nil { - return errors.New(err, errors.TypeConfig, "failed to marshal paths file") - } - - return ioutil.WriteFile(pathsFilepath, pathsBytes, 0740) -} - -func createPathsSymlink(hash string) error { - // only on windows, as windows resolves PWD using symlinks in a different way. - // we create symlink for each versioned agent inside `data/` directory - // on other systems path is shared - if runtime.GOOS != "windows" { - return nil - } - - dir := filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash)) - versionedPath := filepath.Join(dir, "data", "paths.yml") - if err := os.MkdirAll(filepath.Dir(versionedPath), 0700); err != nil { - return err - } - - pathsCfgPath := filepath.Join(paths.Data(), "paths.yml") - return os.Symlink(pathsCfgPath, versionedPath) -} diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go index 48d22de36cf..7cbd78d4849 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go @@ -21,22 +21,22 @@ func (u *Upgrader) changeSymlink(ctx context.Context, newHash string) error { // create symlink to elastic-agent-{hash} hashedDir := fmt.Sprintf("%s-%s", agentName, newHash) - agentBakName := agentName + ".bak" - symlinkPath := filepath.Join(paths.Config(), agentName) - newPath := filepath.Join(paths.Data(), hashedDir, agentName) + agentPrevName := agentName + ".prev" + symlinkPath := filepath.Join(paths.Top(), agentName) + newPath := filepath.Join(paths.Top(), "data", hashedDir, agentName) // handle windows suffixes if runtime.GOOS == "windows" { - agentBakName = agentName + ".exe.back" //.bak is already used + agentPrevName = agentName + ".exe.prev" symlinkPath += ".exe" newPath += ".exe" } - bakNewPath := filepath.Join(paths.Config(), agentBakName) - if err := os.Symlink(newPath, bakNewPath); err != nil { + prevNewPath := filepath.Join(paths.Top(), agentPrevName) + if err := os.Symlink(newPath, prevNewPath); err != nil { return errors.New(err, errors.TypeFilesystem, "failed to update agent symlink") } // safely rotate - return file.SafeFileRotate(symlinkPath, bakNewPath) + return file.SafeFileRotate(symlinkPath, prevNewPath) } diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index 08c38aba8c5..9c2c4f02286 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -17,6 +17,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" @@ -32,11 +33,12 @@ const ( // Upgrader performs an upgrade type Upgrader struct { - settings *artifact.Config - log *logger.Logger - closers []context.CancelFunc - reexec reexecManager - acker acker + settings *artifact.Config + log *logger.Logger + closers []context.CancelFunc + reexec reexecManager + acker acker + upgradable bool } type reexecManager interface { @@ -51,16 +53,28 @@ type acker interface { // NewUpgrader creates an upgrader which is capable of performing upgrade operation func NewUpgrader(settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker) *Upgrader { return &Upgrader{ - settings: settings, - log: log, - closers: closers, - reexec: reexec, - acker: a, + settings: settings, + log: log, + closers: closers, + reexec: reexec, + acker: a, + upgradable: getUpgradable(), } } +// Upgradable returns true if the Elastic Agent can be upgraded. +func (u *Upgrader) Upgradable() bool { + return u.upgradable +} + // Upgrade upgrades running agent func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error { + if !u.upgradable { + return fmt.Errorf( + "cannot be upgraded; must be installed with install sub-command and " + + "running under control of the systems supervisor") + } + archivePath, err := u.downloadArtifact(ctx, a.Version, a.SourceURI) if err != nil { return err @@ -134,15 +148,16 @@ func (u *Upgrader) Ack(ctx context.Context) error { return ioutil.WriteFile(markerFile, markerBytes, 0600) } -func isSubdir(base, target string) (bool, error) { - relPath, err := filepath.Rel(base, target) - return strings.HasPrefix(relPath, ".."), err -} - func rollbackInstall(hash string) { os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) } +func getUpgradable() bool { + // only upgradable if running from Agent installer and running under the + // control of the system supervisor (or built specifically with upgrading enabled) + return release.Upgradable() || (install.RunningInstalled() && install.RunningUnderSupervisor()) +} + func copyActionStore(newHash string) error { currentActionStorePath := info.AgentActionStoreFile() diff --git a/x-pack/elastic-agent/pkg/agent/cmd/checks.go b/x-pack/elastic-agent/pkg/agent/cmd/checks.go deleted file mode 100644 index 4fee7497009..00000000000 --- a/x-pack/elastic-agent/pkg/agent/cmd/checks.go +++ /dev/null @@ -1,57 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -// +build !windows - -package cmd - -import ( - "fmt" - "io/ioutil" - "os" - "path/filepath" - - "github.com/spf13/cobra" - - // import logp flags - _ "github.com/elastic/beats/v7/libbeat/logp/configure" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" -) - -// preRunCheck is noop because -// - darwin.tar - symlink created during packaging -// - linux.tar - symlink created during packaging -// - linux.rpm - symlink created using install script -// - linux.deb - symlink created using install script -// - linux.docker - symlink created using Dockerfile -func preRunCheck(flags *globalFlags) func(cmd *cobra.Command, args []string) error { - return func(cmd *cobra.Command, args []string) error { - if sn := paths.ServiceName(); sn != "" { - // paths were created we're running as child. - return nil - } - - // get versioned path - smallHash := fmt.Sprintf("elastic-agent-%s", smallHash(release.Commit())) - commitFilepath := filepath.Join(paths.Config(), commitFile) // use other file in the future - if content, err := ioutil.ReadFile(commitFilepath); err == nil { - smallHash = hashedDirName(content) - } - - origExecPath, err := os.Executable() - if err != nil { - return err - } - reexecPath := filepath.Join(paths.Data(), smallHash, filepath.Base(origExecPath)) - - // generate paths - if err := generatePaths(filepath.Dir(reexecPath), origExecPath); err != nil { - return err - } - - paths.UpdatePaths() - return nil - } -} diff --git a/x-pack/elastic-agent/pkg/agent/cmd/checks_windows.go b/x-pack/elastic-agent/pkg/agent/cmd/checks_windows.go deleted file mode 100644 index 36108c8e08b..00000000000 --- a/x-pack/elastic-agent/pkg/agent/cmd/checks_windows.go +++ /dev/null @@ -1,114 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -// +build windows - -package cmd - -import ( - "fmt" - "io/ioutil" - "os" - "path/filepath" - - "github.com/spf13/cobra" - - // import logp flags - _ "github.com/elastic/beats/v7/libbeat/logp/configure" - - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/reexec" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" -) - -func preRunCheck(flags *globalFlags) func(cmd *cobra.Command, args []string) error { - return func(cmd *cobra.Command, args []string) error { - if sn := paths.ServiceName(); sn != "" { - // replacing with correct service name so we - // can talk to service manager. - if !filepath.IsAbs(os.Args[0]) { - os.Args[0] = sn - } - - // paths were created we're running as child. - return nil - } - - smallHash := fmt.Sprintf("elastic-agent-%s", smallHash(release.Commit())) - commitFilepath := filepath.Join(paths.Config(), commitFile) - if content, err := ioutil.ReadFile(commitFilepath); err == nil { - smallHash = hashedDirName(content) - } - - // rename itself - origExecPath, err := os.Executable() - if err != nil { - return err - } - - if err := os.Rename(origExecPath, origExecPath+".bak"); err != nil { - return err - } - - // create symlink to elastic-agent-{hash} - reexecPath := filepath.Join(paths.Data(), smallHash, filepath.Base(origExecPath)) - if err := os.Symlink(reexecPath, origExecPath); err != nil { - return err - } - - // generate paths - if err := generatePaths(filepath.Dir(reexecPath), origExecPath); err != nil { - return err - } - - paths.UpdatePaths() - - // reexec if running run - if cmd.Use == "run" { - pathConfigFile := flags.Config() - rawConfig, err := config.LoadYAML(pathConfigFile) - if err != nil { - return errors.New(err, - fmt.Sprintf("could not read configuration file %s", pathConfigFile), - errors.TypeFilesystem, - errors.M(errors.MetaKeyPath, pathConfigFile)) - } - - cfg, err := configuration.NewFromConfig(rawConfig) - if err != nil { - return errors.New(err, - fmt.Sprintf("could not parse configuration file %s", pathConfigFile), - errors.TypeFilesystem, - errors.M(errors.MetaKeyPath, pathConfigFile)) - } - - logger, err := logger.NewFromConfig("", cfg.Settings.LoggingConfig) - if err != nil { - return err - } - - rexLogger := logger.Named("reexec") - rm := reexec.NewManager(rexLogger, reexecPath) - - argsOverrides := []string{ - "--path.data", paths.Data(), - "--path.home", filepath.Dir(reexecPath), - "--path.config", paths.Config(), - } - rm.ReExec(argsOverrides...) - - // trigger reexec - rm.ShutdownComplete() - - // return without running Run method - os.Exit(0) - } - - return nil - } -} diff --git a/x-pack/elastic-agent/pkg/agent/cmd/common.go b/x-pack/elastic-agent/pkg/agent/cmd/common.go index d5c195566bd..8ca5700f3c6 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/common.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/common.go @@ -6,15 +6,10 @@ package cmd import ( "flag" - "fmt" - "io/ioutil" "os" "path/filepath" - "runtime" - "strings" "github.com/spf13/cobra" - "gopkg.in/yaml.v2" // import logp flags _ "github.com/elastic/beats/v7/libbeat/logp/configure" @@ -58,7 +53,6 @@ func NewCommandWithArgs(args []string, streams *cli.IOStreams) *cobra.Command { // path flags cmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.home")) cmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.config")) - cmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.data")) cmd.PersistentFlags().AddGoFlag(flag.CommandLine.Lookup("path.logs")) cmd.PersistentFlags().StringVarP(&flags.PathConfigFile, "c", "c", defaultConfig, `Configuration file, relative to path.config`) @@ -72,6 +66,8 @@ func NewCommandWithArgs(args []string, streams *cli.IOStreams) *cobra.Command { run := newRunCommandWithArgs(flags, args, streams) cmd.AddCommand(basecmd.NewDefaultCommandsWithArgs(args, streams)...) cmd.AddCommand(run) + cmd.AddCommand(newInstallCommandWithArgs(flags, args, streams)) + cmd.AddCommand(newUninstallCommandWithArgs(flags, args, streams)) cmd.AddCommand(newEnrollCommandWithArgs(flags, args, streams)) cmd.AddCommand(newInspectCommandWithArgs(flags, args, streams)) @@ -80,58 +76,7 @@ func NewCommandWithArgs(args []string, streams *cli.IOStreams) *cobra.Command { if reexec != nil { cmd.AddCommand(reexec) } - cmd.PersistentPreRunE = preRunCheck(flags) cmd.Run = run.Run return cmd } - -func hashedDirName(filecontent []byte) string { - s := strings.TrimSpace(string(filecontent)) - if len(s) == 0 { - return "elastic-agent" - } - - s = smallHash(s) - - return fmt.Sprintf("elastic-agent-%s", s) -} - -func smallHash(hash string) string { - if len(hash) > hashLen { - hash = hash[:hashLen] - } - - return hash -} - -func generatePaths(dir, origExec string) error { - pathsCfg := map[string]interface{}{ - "path.data": paths.Data(), - "path.home": dir, - "path.config": paths.Config(), - "path.service_name": origExec, - } - - pathsCfgPath := filepath.Join(paths.Data(), "paths.yml") - pathsContent, err := yaml.Marshal(pathsCfg) - if err != nil { - return err - } - - if err := ioutil.WriteFile(pathsCfgPath, pathsContent, 0740); err != nil { - return err - } - - if runtime.GOOS == "windows" { - // due to two binaries we need to do a path dance - // as versioned binary will look for path inside it's own directory - versionedPath := filepath.Join(dir, "data", "paths.yml") - if err := os.MkdirAll(filepath.Dir(versionedPath), 0700); err != nil { - return err - } - return os.Symlink(pathsCfgPath, versionedPath) - } - - return nil -} diff --git a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go index 6749b57b250..6a604554136 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go @@ -42,18 +42,55 @@ func newEnrollCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStr }, } + addEnrollFlags(cmd) + cmd.Flags().BoolP("force", "f", false, "Force overwrite the current and do not prompt for confirmation") + cmd.Flags().Bool("no-restart", false, "Skip restarting the currently running daemon") + + // used by install command + cmd.Flags().BoolP("from-install", "", false, "Set by install command to signal this was executed from install") + cmd.Flags().MarkHidden("from-install") + + return cmd +} + +func addEnrollFlags(cmd *cobra.Command) { cmd.Flags().StringP("certificate-authorities", "a", "", "Comma separated list of root certificate for server verifications") cmd.Flags().StringP("ca-sha256", "p", "", "Comma separated list of certificate authorities hash pins used for certificate verifications") - cmd.Flags().BoolP("force", "f", false, "Force overwrite the current and do not prompt for confirmation") cmd.Flags().BoolP("insecure", "i", false, "Allow insecure connection to Kibana") cmd.Flags().StringP("staging", "", "", "Configures agent to download artifacts from a staging build") - cmd.Flags().Bool("no-restart", false, "Skip restarting the currently running daemon") +} - return cmd +func buildEnrollmentFlags(cmd *cobra.Command) []string { + ca, _ := cmd.Flags().GetString("certificate-authorities") + sha256, _ := cmd.Flags().GetString("ca-sha256") + insecure, _ := cmd.Flags().GetBool("insecure") + staging, _ := cmd.Flags().GetString("staging") + + args := []string{} + if ca != "" { + args = append(args, "--certificate-authorities") + args = append(args, ca) + } + if sha256 != "" { + args = append(args, "--ca-sha256") + args = append(args, sha256) + } + if insecure { + args = append(args, "--insecure") + } + if staging != "" { + args = append(args, "--staging") + args = append(args, staging) + } + return args } func enroll(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args []string) error { - warn.PrintNotGA(streams.Out) + fromInstall, _ := cmd.Flags().GetBool("from-install") + if !fromInstall { + warn.PrintNotGA(streams.Out) + } + pathConfigFile := flags.Config() rawConfig, err := application.LoadConfigFromFile(pathConfigFile) if err != nil { @@ -79,13 +116,16 @@ func enroll(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args } force, _ := cmd.Flags().GetBool("force") + if fromInstall { + force = true + } if !force { confirm, err := c.Confirm("This will replace your current settings. Do you want to continue?", true) if err != nil { return errors.New(err, "problem reading prompt response") } if !confirm { - fmt.Fprintln(streams.Out, "Enrollment was canceled by the user") + fmt.Fprintln(streams.Out, "Enrollment was cancelled by the user") return nil } } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/install.go b/x-pack/elastic-agent/pkg/agent/cmd/install.go new file mode 100644 index 00000000000..177f79912c9 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/cmd/install.go @@ -0,0 +1,154 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package cmd + +import ( + "fmt" + "os" + "os/exec" + + "github.com/spf13/cobra" + + c "github.com/elastic/beats/v7/libbeat/common/cli" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/warn" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/cli" +) + +func newInstallCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStreams) *cobra.Command { + cmd := &cobra.Command{ + Use: "install", + Short: "Install Elastic Agent permanently on this system", + Long: `This will install Elastic Agent permanently on this system and will become managed by the systems service manager. + +Unless all the require command-line parameters are provided or -f is used this command will ask questions on how you +would like the Agent to operate. +`, + Run: func(c *cobra.Command, args []string) { + if err := installCmd(streams, c, flags, args); err != nil { + fmt.Fprintf(streams.Err, "%v\n", err) + os.Exit(1) + } + }, + } + + cmd.Flags().StringP("kibana-url", "k", "", "URL of Kibana to enroll Agent into Fleet") + cmd.Flags().StringP("enrollment-token", "t", "", "Enrollment token to use to enroll Agent into Fleet") + cmd.Flags().BoolP("force", "f", false, "Force overwrite the current and do not prompt for confirmation") + addEnrollFlags(cmd) + + return cmd +} + +func installCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args []string) error { + if !install.HasRoot() { + return fmt.Errorf("unable to perform install command, not executed with %s permissions", install.PermissionUser) + } + status, reason := install.Status() + if status == install.Installed { + return fmt.Errorf("already installed at: %s", install.InstallPath) + } + + warn.PrintNotGA(streams.Out) + force, _ := cmd.Flags().GetBool("force") + if status == install.Broken { + if !force { + fmt.Fprintf(streams.Out, "Elastic Agent is installed but currently broken: %s\n", reason) + confirm, err := c.Confirm(fmt.Sprintf("Continuing will re-install Elastic Agent over the current installation at %s. Do you want to continue?", install.InstallPath), true) + if err != nil { + return fmt.Errorf("Error: problem reading prompt response") + } + if !confirm { + return fmt.Errorf("installation was cancelled by the user") + } + } + } else { + if !force { + confirm, err := c.Confirm(fmt.Sprintf("Elastic Agent will be installed at %s and will run as a service. Do you want to continue?", install.InstallPath), true) + if err != nil { + return fmt.Errorf("Error: problem reading prompt response") + } + if !confirm { + return fmt.Errorf("installation was cancelled by the user") + } + } + } + + err := install.Install() + if err != nil { + return fmt.Errorf("Error: %s", err) + } + err = install.StartService() + if err != nil { + fmt.Fprintf(streams.Out, "Installation of required system files was successful, but starting of the service failed.\n") + return err + } + fmt.Fprintf(streams.Out, "Installation was successful and Elastic Agent is running.\n") + + askEnroll := true + kibana, _ := cmd.Flags().GetString("kibana-url") + token, _ := cmd.Flags().GetString("enrollment-token") + if kibana != "" && token != "" { + askEnroll = false + } + if force { + askEnroll = false + } + if askEnroll { + confirm, err := c.Confirm("Do you want to enroll this Agent into Fleet?", true) + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if !confirm { + // not enrolling, all done (standalone mode) + return nil + } + } + if !askEnroll && (kibana == "" || token == "") { + // force was performed without required enrollment arguments, all done (standalone mode) + return nil + } + + if kibana == "" { + kibana, err = c.ReadInput("Kibana URL you want to enroll this Agent into:") + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if kibana == "" { + fmt.Fprintf(streams.Out, "Enrollment cancelled because no URL was provided.\n") + return nil + } + } + if token == "" { + token, err = c.ReadInput("Fleet enrollment token:") + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if token == "" { + fmt.Fprintf(streams.Out, "Enrollment cancelled because no enrollment token was provided.\n") + return nil + } + } + + enrollArgs := []string{"enroll", kibana, token, "--from-install"} + enrollArgs = append(enrollArgs, buildEnrollmentFlags(cmd)...) + enrollCmd := exec.Command(install.ExecutablePath(), enrollArgs...) + enrollCmd.Stdin = os.Stdin + enrollCmd.Stdout = os.Stdout + enrollCmd.Stderr = os.Stderr + err = enrollCmd.Start() + if err != nil { + return fmt.Errorf("failed to execute enroll command: %s", err) + } + err = enrollCmd.Wait() + if err == nil { + return nil + } + exitErr, ok := err.(*exec.ExitError) + if ok { + return fmt.Errorf("enroll command failed with exit code: %d", exitErr.ExitCode()) + } + return fmt.Errorf("enroll command failed for unknown reason: %s", err) +} diff --git a/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go b/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go new file mode 100644 index 00000000000..d215a15e337 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/cmd/uninstall.go @@ -0,0 +1,95 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package cmd + +import ( + "fmt" + "os" + "os/exec" + "path/filepath" + "runtime" + + "github.com/spf13/cobra" + + c "github.com/elastic/beats/v7/libbeat/common/cli" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/cli" +) + +func newUninstallCommandWithArgs(flags *globalFlags, _ []string, streams *cli.IOStreams) *cobra.Command { + cmd := &cobra.Command{ + Use: "uninstall", + Short: "Uninstall permanent Elastic Agent from this system", + Long: `This will uninstall permanent Elastic Agent from this system and will no longer be managed by this system. + +Unless -f is used this command will ask confirmation before performing removal. +`, + Run: func(c *cobra.Command, args []string) { + if err := uninstallCmd(streams, c, flags, args); err != nil { + fmt.Fprintf(streams.Err, "%v\n", err) + os.Exit(1) + } + }, + } + + cmd.Flags().BoolP("force", "f", false, "Force overwrite the current and do not prompt for confirmation") + + return cmd +} + +func uninstallCmd(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args []string) error { + if !install.HasRoot() { + return fmt.Errorf("unable to perform uninstall command, not executed with %s permissions", install.PermissionUser) + } + status, reason := install.Status() + if status == install.NotInstalled { + return fmt.Errorf("not installed") + } + if status == install.Installed && !install.RunningInstalled() { + return fmt.Errorf("can only be uninstall by executing the installed Elastic Agent at: %s", install.ExecutablePath()) + } + + force, _ := cmd.Flags().GetBool("force") + if status == install.Broken { + if !force { + fmt.Fprintf(streams.Out, "Elastic Agent is installed but currently broken: %s\n", reason) + confirm, err := c.Confirm(fmt.Sprintf("Continuing will uninstall the broken Elastic Agent at %s. Do you want to continue?", install.InstallPath), true) + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if !confirm { + return fmt.Errorf("uninstall was cancelled by the user") + } + } + } else { + if !force { + confirm, err := c.Confirm(fmt.Sprintf("Elastic Agent will be uninstalled from your system at %s. Do you want to continue?", install.InstallPath), true) + if err != nil { + return fmt.Errorf("problem reading prompt response") + } + if !confirm { + return fmt.Errorf("uninstall was cancelled by the user") + } + } + } + + err := install.Uninstall() + if err != nil { + return err + } + fmt.Fprintf(streams.Out, "Elastic Agent has been uninstalled.\n") + + if runtime.GOOS == "windows" { + // The installation path will still exists because we are executing from that + // directory. So cmd.exe is spawned that sleeps for 2 seconds (using ping, recommend way from + // from Windows) then rmdir is performed. + rmdir := exec.Command( + filepath.Join(os.Getenv("windir"), "system32", "cmd.exe"), + "/C", "ping", "-n", "2", "127.0.0.1", "&&", "rmdir", "/s", "/q", install.InstallPath) + _ = rmdir.Start() + } + + return nil +} diff --git a/x-pack/elastic-agent/pkg/agent/control/addr.go b/x-pack/elastic-agent/pkg/agent/control/addr.go index 20bc1e6a005..31005e8e34d 100644 --- a/x-pack/elastic-agent/pkg/agent/control/addr.go +++ b/x-pack/elastic-agent/pkg/agent/control/addr.go @@ -11,10 +11,17 @@ import ( "fmt" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" ) // Address returns the address to connect to Elastic Agent daemon. func Address() string { + // when installed the control address is fixed + if install.RunningInstalled() { + return install.SocketPath + } + + // not install, adjust the path based on data path data := paths.Data() // entire string cannot be longer than 107 characters, this forces the // length to always be 88 characters (but unique per data path) diff --git a/x-pack/elastic-agent/pkg/agent/control/addr_windows.go b/x-pack/elastic-agent/pkg/agent/control/addr_windows.go index bf2e164fbae..cbfcdf2c99e 100644 --- a/x-pack/elastic-agent/pkg/agent/control/addr_windows.go +++ b/x-pack/elastic-agent/pkg/agent/control/addr_windows.go @@ -11,10 +11,17 @@ import ( "fmt" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" ) // Address returns the address to connect to Elastic Agent daemon. func Address() string { + // when installed the control address is fixed + if install.RunningInstalled() { + return install.SocketPath + } + + // not install, adjust the path based on data path data := paths.Data() // entire string cannot be longer than 256 characters, this forces the // length to always be 87 characters (but unique per data path) diff --git a/x-pack/elastic-agent/pkg/agent/control/server/listener.go b/x-pack/elastic-agent/pkg/agent/control/server/listener.go index 7edfc7b8ee9..3090f3d140d 100644 --- a/x-pack/elastic-agent/pkg/agent/control/server/listener.go +++ b/x-pack/elastic-agent/pkg/agent/control/server/listener.go @@ -8,7 +8,6 @@ package server import ( "fmt" - "net" "os" "path/filepath" diff --git a/x-pack/elastic-agent/pkg/agent/control/server/listener_windows.go b/x-pack/elastic-agent/pkg/agent/control/server/listener_windows.go index f98c32bcee3..eaedc9f88f2 100644 --- a/x-pack/elastic-agent/pkg/agent/control/server/listener_windows.go +++ b/x-pack/elastic-agent/pkg/agent/control/server/listener_windows.go @@ -10,6 +10,8 @@ import ( "net" "os/user" + "github.com/pkg/errors" + "github.com/elastic/beats/v7/libbeat/api/npipe" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/control" @@ -18,11 +20,7 @@ import ( // createListener creates a named pipe listener on Windows func createListener(_ *logger.Logger) (net.Listener, error) { - u, err := user.Current() - if err != nil { - return nil, err - } - sd, err := npipe.DefaultSD(u.Username) + sd, err := securityDescriptor() if err != nil { return nil, err } @@ -32,3 +30,26 @@ func createListener(_ *logger.Logger) (net.Listener, error) { func cleanupListener(_ *logger.Logger) { // nothing to do on windows } + +func securityDescriptor() (string, error) { + u, err := user.Current() + if err != nil { + return "", errors.Wrap(err, "failed to get current user") + } + // Named pipe security and access rights. + // We create the pipe and the specific users should only be able to write to it. + // See docs: https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights + // String definition: https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings + // Give generic read/write access to the specified user. + descriptor := "D:P(A;;GA;;;" + u.Uid + ")" + if u.Username == "NT AUTHORITY\\SYSTEM" { + // running as SYSTEM, include Administrators group so Administrators can talk over + // the named pipe to the running Elastic Agent system process + admin, err := user.LookupGroup("Administrators") + if err != nil { + return "", errors.Wrap(err, "failed to lookup Administrators group") + } + descriptor += "(A;;GA;;;" + admin.Gid + ")" + } + return descriptor, nil +} diff --git a/x-pack/elastic-agent/pkg/agent/install/install.go b/x-pack/elastic-agent/pkg/agent/install/install.go new file mode 100644 index 00000000000..2705ea0bfd9 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/install.go @@ -0,0 +1,142 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package install + +import ( + "fmt" + "io/ioutil" + "os" + "path/filepath" + "strings" + + "github.com/otiai10/copy" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" +) + +// Install installs Elastic Agent persistently on the system including creating and starting its service. +func Install() error { + dir, err := findDirectory() + if err != nil { + return errors.New(err, "failed to discover the source directory for installation", errors.TypeFilesystem) + } + + // uninstall current installation + err = Uninstall() + if err != nil { + return err + } + + // ensure parent directory exists, copy source into install path + err = os.MkdirAll(filepath.Dir(InstallPath), 0755) + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to create installation parent directory (%s)", filepath.Dir(InstallPath)), + errors.M("directory", filepath.Dir(InstallPath))) + } + err = copy.Copy(dir, InstallPath, copy.Options{ + OnSymlink: func(_ string) copy.SymlinkAction { + return copy.Shallow + }, + Sync: true, + }) + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to copy source directory (%s) to destination (%s)", dir, InstallPath), + errors.M("source", dir), errors.M("destination", InstallPath)) + } + + // place shell wrapper, if present on platform + if ShellWrapperPath != "" { + err = ioutil.WriteFile(ShellWrapperPath, []byte(ShellWrapper), 0755) + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to write shell wrapper (%s)", ShellWrapperPath), + errors.M("destination", ShellWrapperPath)) + } + } + + // post install (per platform) + err = postInstall() + if err != nil { + return err + } + + // install service + svc, err := newService() + if err != nil { + return err + } + err = svc.Install() + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to install service (%s)", ServiceName), + errors.M("service", ServiceName)) + } + return nil +} + +// StartService starts the installed service. +// +// This should only be called after Install is successful. +func StartService() error { + svc, err := newService() + if err != nil { + return err + } + err = svc.Start() + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to start service (%s)", ServiceName), + errors.M("service", ServiceName)) + } + return nil +} + +// findDirectory returns the directory to copy into the installation location. +// +// This also verifies that the discovered directory is a valid directory for installation. +func findDirectory() (string, error) { + execPath, err := os.Executable() + if err != nil { + return "", err + } + execPath, err = filepath.Abs(execPath) + if err != nil { + return "", err + } + sourceDir := filepath.Dir(execPath) + if insideData(sourceDir) { + // executable path is being reported as being down inside of data path + // move up to directories to perform the copy + sourceDir = filepath.Dir(filepath.Dir(sourceDir)) + } + err = verifyDirectory(sourceDir) + if err != nil { + return "", err + } + return sourceDir, nil +} + +// verifyDirectory ensures that the directory includes the executable. +func verifyDirectory(dir string) error { + _, err := os.Stat(filepath.Join(dir, BinaryName)) + if os.IsNotExist(err) { + return fmt.Errorf("missing %s", BinaryName) + } + return nil +} + +// insideData returns true when the exePath is inside of the current Agents data path. +func insideData(exePath string) bool { + expectedPath := filepath.Join("data", fmt.Sprintf("elastic-agent-%s", release.ShortCommit())) + return strings.HasSuffix(exePath, expectedPath) +} diff --git a/x-pack/elastic-agent/pkg/agent/install/install_unix.go b/x-pack/elastic-agent/pkg/agent/install/install_unix.go new file mode 100644 index 00000000000..07d696d580a --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/install_unix.go @@ -0,0 +1,13 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !windows + +package install + +// postInstall performs post installation for unix-based systems. +func postInstall() error { + // do nothing + return nil +} diff --git a/x-pack/elastic-agent/pkg/agent/install/install_windows.go b/x-pack/elastic-agent/pkg/agent/install/install_windows.go new file mode 100644 index 00000000000..ec10467ce79 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/install_windows.go @@ -0,0 +1,35 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build windows + +package install + +import ( + "fmt" + "os" + "path/filepath" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" +) + +// postInstall performs post installation for Windows systems. +func postInstall() error { + // delete the top-level elastic-agent.exe + binary := filepath.Join(InstallPath, BinaryName) + err := os.Remove(binary) + if err != nil { + // do not handle does not exist, it should have existed + return err + } + + // create top-level symlink to nested binary + realBinary := filepath.Join(InstallPath, "data", fmt.Sprintf("elastic-agent-%s", release.ShortCommit()), BinaryName) + err = os.Symlink(realBinary, binary) + if err != nil { + return err + } + + return nil +} diff --git a/x-pack/elastic-agent/pkg/agent/install/installed.go b/x-pack/elastic-agent/pkg/agent/install/installed.go new file mode 100644 index 00000000000..9f294078242 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/installed.go @@ -0,0 +1,75 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package install + +import ( + "os" + "path/filepath" + + "github.com/kardianos/service" +) + +// StatusType is the return status types. +type StatusType int + +const ( + // NotInstalled returned when Elastic Agent is not installed. + NotInstalled StatusType = iota + // Installed returned when Elastic Agent is installed currectly. + Installed + // Broken returned when Elastic Agent is installed but broken. + Broken +) + +// Status returns the installation status of Agent. +func Status() (StatusType, string) { + expected := filepath.Join(InstallPath, BinaryName) + status, reason := checkService() + _, err := os.Stat(expected) + if os.IsNotExist(err) { + if status == Installed { + // service installed, but no install path + return Broken, "service exists but installation path is missing" + } + return NotInstalled, "no install path or service" + } + if status == NotInstalled { + // install path present, but not service + return Broken, reason + } + return Installed, "" +} + +// RunningInstalled returns true when executing Agent is the installed Agent. +// +// This verifies the running executable path based on hard-coded paths +// for each platform type. +func RunningInstalled() bool { + expected := filepath.Join(InstallPath, BinaryName) + execPath, _ := os.Executable() + execPath, _ = filepath.Abs(execPath) + execName := filepath.Base(execPath) + execDir := filepath.Dir(execPath) + if insideData(execDir) { + // executable path is being reported as being down inside of data path + // move up to directories to perform the comparison + execDir = filepath.Dir(filepath.Dir(execDir)) + execPath = filepath.Join(execDir, execName) + } + return expected == execPath +} + +// checkService only checks the status of the service. +func checkService() (StatusType, string) { + svc, err := newService() + if err != nil { + return NotInstalled, "unable to check service status" + } + status, _ := svc.Status() + if status == service.StatusUnknown { + return NotInstalled, "service is not installed" + } + return Installed, "" +} diff --git a/x-pack/elastic-agent/pkg/agent/install/paths.go b/x-pack/elastic-agent/pkg/agent/install/paths.go new file mode 100644 index 00000000000..5936c31926a --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/paths.go @@ -0,0 +1,30 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !darwin +// +build !windows + +package install + +const ( + // BinaryName is the name of the installed binary. + BinaryName = "elastic-agent" + + // InstallPath is the installation path using for install command. + InstallPath = "/opt/Elastic/Agent" + + // SocketPath is the socket path used when installed. + SocketPath = "unix:///run/elastic-agent.sock" + + // ServiceName is the service name when installed. + ServiceName = "elastic-agent" + + // ShellWrapperPath is the path to the installed shell wrapper. + ShellWrapperPath = "/usr/bin/elastic-agent" + + // ShellWrapper is the wrapper that is installed. + ShellWrapper = `#!/bin/sh +exec /opt/Elastic/Agent/elastic-agent $@ +` +) diff --git a/x-pack/elastic-agent/pkg/agent/install/paths_darwin.go b/x-pack/elastic-agent/pkg/agent/install/paths_darwin.go new file mode 100644 index 00000000000..f6ebcdfdbae --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/paths_darwin.go @@ -0,0 +1,29 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build darwin + +package install + +const ( + // BinaryName is the name of the installed binary. + BinaryName = "elastic-agent" + + // InstallPath is the installation path using for install command. + InstallPath = "/Library/Elastic/Agent" + + // SocketPath is the socket path used when installed. + SocketPath = "unix:///var/run/elastic-agent.sock" + + // ServiceName is the service name when installed. + ServiceName = "co.elastic.elastic-agent" + + // ShellWrapperPath is the path to the installed shell wrapper. + ShellWrapperPath = "/usr/local/bin/elastic-agent" + + // ShellWrapper is the wrapper that is installed. + ShellWrapper = `#!/bin/sh +exec /Library/Elastic/Agent/elastic-agent $@ +` +) diff --git a/x-pack/elastic-agent/pkg/agent/install/paths_windows.go b/x-pack/elastic-agent/pkg/agent/install/paths_windows.go new file mode 100644 index 00000000000..3af4c79d941 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/paths_windows.go @@ -0,0 +1,27 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build windows + +package install + +const ( + // BinaryName is the name of the installed binary. + BinaryName = "elastic-agent.exe" + + // InstallPath is the installation path using for install command. + InstallPath = `C:\Program Files\Elastic\Agent` + + // SocketPath is the socket path used when installed. + SocketPath = `\\.\pipe\elastic-agent-system` + + // ServiceName is the service name when installed. + ServiceName = "Elastic Agent" + + // ShellWrapperPath is the path to the installed shell wrapper. + ShellWrapperPath = "" // no wrapper on Windows + + // ShellWrapper is the wrapper that is installed. + ShellWrapper = "" // no wrapper on Windows +) diff --git a/x-pack/elastic-agent/pkg/agent/install/root_unix.go b/x-pack/elastic-agent/pkg/agent/install/root_unix.go new file mode 100644 index 00000000000..b79f104d98d --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/root_unix.go @@ -0,0 +1,19 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !windows + +package install + +import "os" + +const ( + // PermissionUser is the permission level the user needs to be. + PermissionUser = "root" +) + +// HasRoot returns true if the user has root permissions. +func HasRoot() bool { + return os.Getegid() == 0 +} diff --git a/x-pack/elastic-agent/pkg/agent/install/root_windows.go b/x-pack/elastic-agent/pkg/agent/install/root_windows.go new file mode 100644 index 00000000000..c72432084ac --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/root_windows.go @@ -0,0 +1,27 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build windows + +package install + +import ( + "os" +) + +const ( + // PermissionUser is the permission level the user needs to be. + PermissionUser = "Administrator" +) + +// HasRoot returns true if the user has Administrator/SYSTEM permissions. +func HasRoot() bool { + // only valid rights can open the physical drive + f, err := os.Open("\\\\.\\PHYSICALDRIVE0") + if err != nil { + return false + } + defer f.Close() + return true +} diff --git a/x-pack/elastic-agent/pkg/agent/install/svc.go b/x-pack/elastic-agent/pkg/agent/install/svc.go new file mode 100644 index 00000000000..18cbc6d840f --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/svc.go @@ -0,0 +1,38 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package install + +import ( + "path/filepath" + + "github.com/kardianos/service" +) + +const ( + // ServiceDisplayName is the service display name for the service. + ServiceDisplayName = "Elastic Agent" + + // ServiceDescription is the description for the service. + ServiceDescription = "Elastic Agent is a unified agent to observe, monitor and protect your system." +) + +// ExecutablePath returns the path for the installed Agents executable. +func ExecutablePath() string { + exec := filepath.Join(InstallPath, BinaryName) + if ShellWrapperPath != "" { + exec = ShellWrapperPath + } + return exec +} + +func newService() (service.Service, error) { + return service.New(nil, &service.Config{ + Name: ServiceName, + DisplayName: ServiceDisplayName, + Description: ServiceDescription, + Executable: ExecutablePath(), + WorkingDirectory: InstallPath, + }) +} diff --git a/x-pack/elastic-agent/pkg/agent/install/svc_unix.go b/x-pack/elastic-agent/pkg/agent/install/svc_unix.go new file mode 100644 index 00000000000..c7acb998489 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/svc_unix.go @@ -0,0 +1,15 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build !windows + +package install + +import "os" + +// RunningUnderSupervisor returns true when executing Agent is running under +// the supervisor processes of the OS. +func RunningUnderSupervisor() bool { + return os.Getppid() == 1 +} diff --git a/x-pack/elastic-agent/pkg/agent/install/svc_windows.go b/x-pack/elastic-agent/pkg/agent/install/svc_windows.go new file mode 100644 index 00000000000..9084f3b5ea7 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/svc_windows.go @@ -0,0 +1,49 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// +build windows + +package install + +import ( + "golang.org/x/sys/windows" +) + +// RunningUnderSupervisor returns true when executing Agent is running under +// the supervisor processes of the OS. +func RunningUnderSupervisor() bool { + serviceSid, err := allocSid(windows.SECURITY_SERVICE_RID) + if err != nil { + return false + } + defer windows.FreeSid(serviceSid) + + t, err := windows.OpenCurrentProcessToken() + if err != nil { + return false + } + defer t.Close() + + gs, err := t.GetTokenGroups() + if err != nil { + return false + } + + for _, g := range gs.AllGroups() { + if windows.EqualSid(g.Sid, serviceSid) { + return true + } + } + return false +} + +func allocSid(subAuth0 uint32) (*windows.SID, error) { + var sid *windows.SID + err := windows.AllocateAndInitializeSid(&windows.SECURITY_NT_AUTHORITY, + 1, subAuth0, 0, 0, 0, 0, 0, 0, 0, &sid) + if err != nil { + return nil, err + } + return sid, nil +} diff --git a/x-pack/elastic-agent/pkg/agent/install/uninstall.go b/x-pack/elastic-agent/pkg/agent/install/uninstall.go new file mode 100644 index 00000000000..381427eb8c7 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/install/uninstall.go @@ -0,0 +1,71 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package install + +import ( + "fmt" + "os" + "runtime" + + "github.com/kardianos/service" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" +) + +// Uninstall uninstalls persistently Elastic Agent on the system. +func Uninstall() error { + // uninstall the current service + svc, err := newService() + if err != nil { + return err + } + status, _ := svc.Status() + if status == service.StatusRunning { + err := svc.Stop() + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to stop service (%s)", ServiceName), + errors.M("service", ServiceName)) + } + status = service.StatusStopped + } + if status == service.StatusStopped { + err := svc.Uninstall() + if err != nil { + return errors.New( + err, + fmt.Sprintf("failed to uninstall service (%s)", ServiceName), + errors.M("service", ServiceName)) + } + } + + // remove, if present on platform + if ShellWrapperPath != "" { + err = os.Remove(ShellWrapperPath) + if !os.IsNotExist(err) && err != nil { + return errors.New( + err, + fmt.Sprintf("failed to remove shell wrapper (%s)", ShellWrapperPath), + errors.M("destination", ShellWrapperPath)) + } + } + + // remove existing directory + err = os.RemoveAll(InstallPath) + if err != nil { + if runtime.GOOS == "windows" { + // possible to fail on Windows, because elastic-agent.exe is running from + // this directory. + return nil + } + return errors.New( + err, + fmt.Sprintf("failed to remove installation directory (%s)", InstallPath), + errors.M("directory", InstallPath)) + } + + return nil +} diff --git a/x-pack/elastic-agent/pkg/agent/warn/warn.go b/x-pack/elastic-agent/pkg/agent/warn/warn.go index 03d746992f6..182d2af50b0 100644 --- a/x-pack/elastic-agent/pkg/agent/warn/warn.go +++ b/x-pack/elastic-agent/pkg/agent/warn/warn.go @@ -21,4 +21,5 @@ func LogNotGA(log *logger.Logger) { // PrintNotGA writes to the received writer that the Agent is not GA. func PrintNotGA(output io.Writer) { fmt.Fprintln(output, message) + fmt.Fprintln(output) } diff --git a/x-pack/elastic-agent/pkg/release/upgrade.go b/x-pack/elastic-agent/pkg/release/upgrade.go new file mode 100644 index 00000000000..ac1e8552dd2 --- /dev/null +++ b/x-pack/elastic-agent/pkg/release/upgrade.go @@ -0,0 +1,10 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package release + +// Upgradable return true when release is built specifically for upgrading. +func Upgradable() bool { + return allowUpgrade == "true" +} diff --git a/x-pack/elastic-agent/pkg/release/version.go b/x-pack/elastic-agent/pkg/release/version.go index 37579ac86de..dae609a6733 100644 --- a/x-pack/elastic-agent/pkg/release/version.go +++ b/x-pack/elastic-agent/pkg/release/version.go @@ -12,6 +12,10 @@ import ( libbeatVersion "github.com/elastic/beats/v7/libbeat/version" ) +const ( + hashLen = 6 +) + // snapshot is a flag marking build as a snapshot. var snapshot = "" @@ -19,11 +23,24 @@ var snapshot = "" // without valid pgp var allowEmptyPgp string +// allowUpgrade is used as a debug flag and allows working +// with upgrade without requiring Agent to be installed correctly +var allowUpgrade string + // Commit returns the current build hash or unknown if it was not injected in the build process. func Commit() string { return libbeatVersion.Commit() } +// ShortCommit returns commit up to 6 characters. +func ShortCommit() string { + hash := Commit() + if len(hash) > hashLen { + hash = hash[:hashLen] + } + return hash +} + // BuildTime returns the build time of the binaries. func BuildTime() time.Time { return libbeatVersion.BuildTime() From c9827a8511ac80f1859855c1296ef63c6d2f00f9 Mon Sep 17 00:00:00 2001 From: Pier-Hugues Pellerin Date: Tue, 29 Sep 2020 11:20:12 -0400 Subject: [PATCH 080/216] [Elastic Agent] Rename *ConfigChange to PolicyChange (#20779) [Elastic Agent] Rename *ConfigChange to PolicyChange (#20779) Co-authored-by: Michal Pristas --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + .../cmd/fakewebapi/action_example.json | 4 +-- .../pkg/agent/application/action_store.go | 18 +++++------ .../agent/application/action_store_test.go | 14 ++++---- .../agent/application/fleet_gateway_test.go | 4 +-- .../handler_action_policy_change.go | 14 ++++---- .../handler_action_policy_change_test.go | 32 +++++++++---------- .../agent/application/inspect_config_cmd.go | 4 +-- .../pkg/agent/application/managed_mode.go | 4 +-- .../agent/application/managed_mode_test.go | 8 ++--- .../pkg/fleetapi/ack_cmd_test.go | 6 ++-- x-pack/elastic-agent/pkg/fleetapi/action.go | 22 ++++++------- .../pkg/fleetapi/checkin_cmd_test.go | 12 +++---- 13 files changed, 72 insertions(+), 71 deletions(-) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index be0cfc459e8..2ba08864ae8 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -10,6 +10,7 @@ - Docker container is not run as root by default. {pull}21213[21213] ==== Bugfixes +- Fix rename *ConfigChange to *PolicyChange to align on changes in the UI. {pull}20779[20779] - Thread safe sorted set {pull}21290[21290] - Copy Action store on upgrade {pull}21298[21298] - Include inputs in action store actions {pull}21298[21298] diff --git a/x-pack/elastic-agent/dev-tools/cmd/fakewebapi/action_example.json b/x-pack/elastic-agent/dev-tools/cmd/fakewebapi/action_example.json index 327b79ed347..f08e98942ea 100644 --- a/x-pack/elastic-agent/dev-tools/cmd/fakewebapi/action_example.json +++ b/x-pack/elastic-agent/dev-tools/cmd/fakewebapi/action_example.json @@ -2,9 +2,9 @@ "action": "checkin", "actions": [ { - "type": "CONFIG_CHANGE", + "type": "POLICY_CHANGE", "data": { - "config": { + "policy": { "id": "default", "outputs": { "default": { diff --git a/x-pack/elastic-agent/pkg/agent/application/action_store.go b/x-pack/elastic-agent/pkg/agent/application/action_store.go index 25dbf7a5b82..ce4ea785cf7 100644 --- a/x-pack/elastic-agent/pkg/agent/application/action_store.go +++ b/x-pack/elastic-agent/pkg/agent/application/action_store.go @@ -35,7 +35,7 @@ func newActionStore(log *logger.Logger, store storeLoad) (*actionStore, error) { } defer reader.Close() - var action actionConfigChangeSerializer + var action ActionPolicyChangeSerializer dec := yaml.NewDecoder(reader) err = dec.Decode(&action) @@ -49,7 +49,7 @@ func newActionStore(log *logger.Logger, store storeLoad) (*actionStore, error) { return nil, err } - apc := fleetapi.ActionConfigChange(action) + apc := fleetapi.ActionPolicyChange(action) return &actionStore{ log: log, @@ -62,7 +62,7 @@ func newActionStore(log *logger.Logger, store storeLoad) (*actionStore, error) { // any other type of action will be silently ignored. func (s *actionStore) Add(a action) { switch v := a.(type) { - case *fleetapi.ActionConfigChange, *fleetapi.ActionUnenroll: + case *fleetapi.ActionPolicyChange, *fleetapi.ActionUnenroll: // Only persist the action if the action is different. if s.action != nil && s.action.ID() == v.ID() { return @@ -79,8 +79,8 @@ func (s *actionStore) Save() error { } var reader io.Reader - if apc, ok := s.action.(*fleetapi.ActionConfigChange); ok { - serialize := actionConfigChangeSerializer(*apc) + if apc, ok := s.action.(*fleetapi.ActionPolicyChange); ok { + serialize := ActionPolicyChangeSerializer(*apc) r, err := yamlToReader(&serialize) if err != nil { @@ -120,7 +120,7 @@ func (s *actionStore) Actions() []action { return []action{s.action} } -// actionConfigChangeSerializer is a struct that adds a YAML serialization, I don't think serialization +// ActionPolicyChangeSerializer is a struct that adds a YAML serialization, I don't think serialization // is a concern of the fleetapi package. I went this route so I don't have to do much refactoring. // // There are four ways to achieve the same results: @@ -130,14 +130,14 @@ func (s *actionStore) Actions() []action { // 4. We have two sets of type. // // This could be done in a refactoring. -type actionConfigChangeSerializer struct { +type ActionPolicyChangeSerializer struct { ActionID string `yaml:"action_id"` ActionType string `yaml:"action_type"` - Config map[string]interface{} `yaml:"config"` + Policy map[string]interface{} `yaml:"policy"` } // Add a guards between the serializer structs and the original struct. -var _ actionConfigChangeSerializer = actionConfigChangeSerializer(fleetapi.ActionConfigChange{}) +var _ ActionPolicyChangeSerializer = ActionPolicyChangeSerializer(fleetapi.ActionPolicyChange{}) // actionUnenrollSerializer is a struct that adds a YAML serialization, type actionUnenrollSerializer struct { diff --git a/x-pack/elastic-agent/pkg/agent/application/action_store_test.go b/x-pack/elastic-agent/pkg/agent/application/action_store_test.go index 4205deda8b6..f2691d66db6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/action_store_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/action_store_test.go @@ -57,10 +57,10 @@ func TestActionStore(t *testing.T) { t.Run("can save to disk known action type", withFile(func(t *testing.T, file string) { - actionConfigChange := &fleetapi.ActionConfigChange{ + ActionPolicyChange := &fleetapi.ActionPolicyChange{ ActionID: "abc123", - ActionType: "CONFIG_CHANGE", - Config: map[string]interface{}{ + ActionType: "POLICY_CHANGE", + Policy: map[string]interface{}{ "hello": "world", }, } @@ -70,7 +70,7 @@ func TestActionStore(t *testing.T) { require.NoError(t, err) require.Equal(t, 0, len(store.Actions())) - store.Add(actionConfigChange) + store.Add(ActionPolicyChange) err = store.Save() require.NoError(t, err) require.Equal(t, 1, len(store.Actions())) @@ -82,12 +82,12 @@ func TestActionStore(t *testing.T) { actions := store1.Actions() require.Equal(t, 1, len(actions)) - require.Equal(t, actionConfigChange, actions[0]) + require.Equal(t, ActionPolicyChange, actions[0]) })) t.Run("when we ACK we save to disk", withFile(func(t *testing.T, file string) { - actionConfigChange := &fleetapi.ActionConfigChange{ + ActionPolicyChange := &fleetapi.ActionPolicyChange{ ActionID: "abc123", } @@ -98,7 +98,7 @@ func TestActionStore(t *testing.T) { acker := newActionStoreAcker(&testAcker{}, store) require.Equal(t, 0, len(store.Actions())) - require.NoError(t, acker.Ack(context.Background(), actionConfigChange)) + require.NoError(t, acker.Ack(context.Background(), ActionPolicyChange)) require.Equal(t, 1, len(store.Actions())) })) } diff --git a/x-pack/elastic-agent/pkg/agent/application/fleet_gateway_test.go b/x-pack/elastic-agent/pkg/agent/application/fleet_gateway_test.go index bd9037416dc..cfcd1f46994 100644 --- a/x-pack/elastic-agent/pkg/agent/application/fleet_gateway_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/fleet_gateway_test.go @@ -208,10 +208,10 @@ func TestFleetGateway(t *testing.T) { { "actions": [ { - "type": "CONFIG_CHANGE", + "type": "POLICY_CHANGE", "id": "id1", "data": { - "config": { + "policy": { "id": "policy-id" } } diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go index 34fd5716980..81dc1444816 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change.go @@ -13,24 +13,24 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" ) -type handlerConfigChange struct { +type handlerPolicyChange struct { log *logger.Logger emitter emitterFunc } -func (h *handlerConfigChange) Handle(ctx context.Context, a action, acker fleetAcker) error { - h.log.Debugf("handlerConfigChange: action '%+v' received", a) - action, ok := a.(*fleetapi.ActionConfigChange) +func (h *handlerPolicyChange) Handle(ctx context.Context, a action, acker fleetAcker) error { + h.log.Debugf("handlerPolicyChange: action '%+v' received", a) + action, ok := a.(*fleetapi.ActionPolicyChange) if !ok { - return fmt.Errorf("invalid type, expected ActionConfigChange and received %T", a) + return fmt.Errorf("invalid type, expected ActionPolicyChange and received %T", a) } - c, err := LoadConfig(action.Config) + c, err := LoadConfig(action.Policy) if err != nil { return errors.New(err, "could not parse the configuration from the policy", errors.TypeConfig) } - h.log.Debugf("handlerConfigChange: emit configuration for action %+v", a) + h.log.Debugf("handlerPolicyChange: emit configuration for action %+v", a) if err := h.emitter(c); err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go index b95c259e7c7..ce4802b68e6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_policy_change_test.go @@ -36,13 +36,13 @@ func TestPolicyChange(t *testing.T) { emitter := &mockEmitter{} conf := map[string]interface{}{"hello": "world"} - action := &fleetapi.ActionConfigChange{ + action := &fleetapi.ActionPolicyChange{ ActionID: "abc123", - ActionType: "CONFIG_CHANGE", - Config: conf, + ActionType: "POLICY_CHANGE", + Policy: conf, } - handler := &handlerConfigChange{log: log, emitter: emitter.Emitter} + handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} err := handler.Handle(context.Background(), action, ack) require.NoError(t, err) @@ -54,13 +54,13 @@ func TestPolicyChange(t *testing.T) { emitter := &mockEmitter{err: mockErr} conf := map[string]interface{}{"hello": "world"} - action := &fleetapi.ActionConfigChange{ + action := &fleetapi.ActionPolicyChange{ ActionID: "abc123", - ActionType: "CONFIG_CHANGE", - Config: conf, + ActionType: "POLICY_CHANGE", + Policy: conf, } - handler := &handlerConfigChange{log: log, emitter: emitter.Emitter} + handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} err := handler.Handle(context.Background(), action, ack) require.Error(t, err) @@ -77,13 +77,13 @@ func TestPolicyAcked(t *testing.T) { config := map[string]interface{}{"hello": "world"} actionID := "abc123" - action := &fleetapi.ActionConfigChange{ + action := &fleetapi.ActionPolicyChange{ ActionID: actionID, - ActionType: "CONFIG_CHANGE", - Config: config, + ActionType: "POLICY_CHANGE", + Policy: config, } - handler := &handlerConfigChange{log: log, emitter: emitter.Emitter} + handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} err := handler.Handle(context.Background(), action, tacker) require.Error(t, err) @@ -99,13 +99,13 @@ func TestPolicyAcked(t *testing.T) { config := map[string]interface{}{"hello": "world"} actionID := "abc123" - action := &fleetapi.ActionConfigChange{ + action := &fleetapi.ActionPolicyChange{ ActionID: actionID, - ActionType: "CONFIG_CHANGE", - Config: config, + ActionType: "POLICY_CHANGE", + Policy: config, } - handler := &handlerConfigChange{log: log, emitter: emitter.Emitter} + handler := &handlerPolicyChange{log: log, emitter: emitter.Emitter} err := handler.Handle(context.Background(), action, tacker) require.NoError(t, err) diff --git a/x-pack/elastic-agent/pkg/agent/application/inspect_config_cmd.go b/x-pack/elastic-agent/pkg/agent/application/inspect_config_cmd.go index 2c53fc62bf2..edf1ad8cdf2 100644 --- a/x-pack/elastic-agent/pkg/agent/application/inspect_config_cmd.go +++ b/x-pack/elastic-agent/pkg/agent/application/inspect_config_cmd.go @@ -106,13 +106,13 @@ func loadFleetConfig(cfg *config.Config) (map[string]interface{}, error) { } for _, c := range as.Actions() { - cfgChange, ok := c.(*fleetapi.ActionConfigChange) + cfgChange, ok := c.(*fleetapi.ActionPolicyChange) if !ok { continue } fmt.Println("Action ID:", cfgChange.ID()) - return cfgChange.Config, nil + return cfgChange.Policy, nil } return nil, nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index a4e4bf92379..12a9c242780 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -207,8 +207,8 @@ func newManaged( acker) actionDispatcher.MustRegister( - &fleetapi.ActionConfigChange{}, - &handlerConfigChange{ + &fleetapi.ActionPolicyChange{}, + &handlerPolicyChange{ log: log, emitter: emit, }, diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go index 9b51016a126..81f2419f936 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go @@ -40,8 +40,8 @@ func TestManagedModeRouting(t *testing.T) { require.NoError(t, err) actionDispatcher.MustRegister( - &fleetapi.ActionConfigChange{}, - &handlerConfigChange{ + &fleetapi.ActionPolicyChange{}, + &handlerPolicyChange{ log: log, emitter: emit, }, @@ -100,9 +100,9 @@ const fleetResponse = ` "action": "checkin", "actions": [{ "agent_id": "17e93530-7f42-11ea-9330-71e968b29fa4", - "type": "CONFIG_CHANGE", + "type": "POLICY_CHANGE", "data": { - "config": { + "policy": { "id": "86561d50-7f3b-11ea-9fab-3db3bdb4efa4", "outputs": { "default": { diff --git a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go index a9e3aebc25b..75940e928b7 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go +++ b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd_test.go @@ -46,10 +46,10 @@ func TestAck(t *testing.T) { return mux }, withAPIKey, func(t *testing.T, client clienter) { - action := &ActionConfigChange{ + action := &ActionPolicyChange{ ActionID: "my-id", - ActionType: "CONFIG_CHANGE", - Config: map[string]interface{}{ + ActionType: "POLICY_CHANGE", + Policy: map[string]interface{}{ "id": "config_id", }, } diff --git a/x-pack/elastic-agent/pkg/fleetapi/action.go b/x-pack/elastic-agent/pkg/fleetapi/action.go index efb4e1672aa..d53b7fdfcfb 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/action.go +++ b/x-pack/elastic-agent/pkg/fleetapi/action.go @@ -17,8 +17,8 @@ const ( ActionTypeUpgrade = "UPGRADE" // ActionTypeUnenroll specifies unenroll action. ActionTypeUnenroll = "UNENROLL" - // ActionTypeConfigChange specifies config change action. - ActionTypeConfigChange = "CONFIG_CHANGE" + // ActionTypePolicyChange specifies policy change action. + ActionTypePolicyChange = "POLICY_CHANGE" ) // Action base interface for all the implemented action from the fleet API. @@ -66,14 +66,14 @@ func (a *ActionUnknown) OriginalType() string { return a.originalType } -// ActionConfigChange is a request to apply a new -type ActionConfigChange struct { +// ActionPolicyChange is a request to apply a new +type ActionPolicyChange struct { ActionID string ActionType string - Config map[string]interface{} `json:"config"` + Policy map[string]interface{} `json:"policy"` } -func (a *ActionConfigChange) String() string { +func (a *ActionPolicyChange) String() string { var s strings.Builder s.WriteString("action_id: ") s.WriteString(a.ActionID) @@ -83,12 +83,12 @@ func (a *ActionConfigChange) String() string { } // Type returns the type of the Action. -func (a *ActionConfigChange) Type() string { +func (a *ActionPolicyChange) Type() string { return a.ActionType } // ID returns the ID of the Action. -func (a *ActionConfigChange) ID() string { +func (a *ActionPolicyChange) ID() string { return a.ActionID } @@ -169,14 +169,14 @@ func (a *Actions) UnmarshalJSON(data []byte) error { for _, response := range responses { switch response.ActionType { - case ActionTypeConfigChange: - action = &ActionConfigChange{ + case ActionTypePolicyChange: + action = &ActionPolicyChange{ ActionID: response.ActionID, ActionType: response.ActionType, } if err := json.Unmarshal(response.Data, action); err != nil { return errors.New(err, - "fail to decode CONFIG_CHANGE action", + "fail to decode POLICY_CHANGE action", errors.TypeConfig) } case ActionTypeUnenroll: diff --git a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go index 953b86a260e..af8b4da81ea 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go +++ b/x-pack/elastic-agent/pkg/fleetapi/checkin_cmd_test.go @@ -56,10 +56,10 @@ func TestCheckin(t *testing.T) { raw := ` { "actions": [{ - "type": "CONFIG_CHANGE", + "type": "POLICY_CHANGE", "id": "id1", "data": { - "config": { + "policy": { "id": "policy-id", "outputs": { "default": { @@ -102,7 +102,7 @@ func TestCheckin(t *testing.T) { // ActionPolicyChange require.Equal(t, "id1", r.Actions[0].ID()) - require.Equal(t, "CONFIG_CHANGE", r.Actions[0].Type()) + require.Equal(t, "POLICY_CHANGE", r.Actions[0].Type()) }, )) @@ -112,10 +112,10 @@ func TestCheckin(t *testing.T) { { "actions": [ { - "type": "CONFIG_CHANGE", + "type": "POLICY_CHANGE", "id": "id1", "data": { - "config": { + "policy": { "id": "policy-id", "outputs": { "default": { @@ -163,7 +163,7 @@ func TestCheckin(t *testing.T) { // ActionPolicyChange require.Equal(t, "id1", r.Actions[0].ID()) - require.Equal(t, "CONFIG_CHANGE", r.Actions[0].Type()) + require.Equal(t, "POLICY_CHANGE", r.Actions[0].Type()) // UnknownAction require.Equal(t, "id2", r.Actions[1].ID()) From a29dcc27cf8965d20b7919b01ef3f14288515653 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Tue, 29 Sep 2020 09:23:36 -0600 Subject: [PATCH 081/216] Fix debug message to show actual SQS message ID (#20614) --- x-pack/filebeat/input/s3/input.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/input/s3/input.go b/x-pack/filebeat/input/s3/input.go index 1085c9dccbd..6b57789b48f 100644 --- a/x-pack/filebeat/input/s3/input.go +++ b/x-pack/filebeat/input/s3/input.go @@ -288,7 +288,7 @@ func (p *s3Input) processorKeepAlive(svcSQS sqsiface.ClientAPI, message sqs.Mess // When ACK done, message will be deleted. Or when message is // not s3 ObjectCreated event related(handleSQSMessage function // failed), it will be removed as well. - p.logger.Debug("Deleting message from SQS: ", message.MessageId) + p.logger.Debug("Deleting message from SQS: ", *message.MessageId) // only delete sqs message when errC is closed with no error err := p.deleteMessage(queueURL, *message.ReceiptHandle, svcSQS) if err != nil { From e6c3d89234a449f671a0a68ccba2a224b0e4a31f Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 29 Sep 2020 18:40:26 +0200 Subject: [PATCH 082/216] Add UBI 8 image to the dependencies report (#21374) Red Hat certification process requires to include the UBI image in the list of dependencies for the project. Append it to the current list of dependencies. This requires to include a new sourceURL column in the CSV, because UBI images have a different url and source url. This is kept the same for existing dependencies. --- dev-tools/dependencies-report | 11 +++++++++++ dev-tools/notice/dependencies.csv.tmpl | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/dev-tools/dependencies-report b/dev-tools/dependencies-report index a824d0f4bf9..a2662a4ab9a 100755 --- a/dev-tools/dependencies-report +++ b/dev-tools/dependencies-report @@ -41,3 +41,14 @@ go list -m -json all $@ | go run go.elastic.co/go-licence-detector \ -noticeTemplate "$SRCPATH/notice/dependencies.csv.tmpl" \ -noticeOut "$outfile" \ -depsOut "" + + +# Fill-in required values for UBI images +# Check headers in $SRCPATH/notice/dependencies.csv.tmpl: +# name,url,version,revision,license +ubi8url='https://catalog.redhat.com/software/containers/ubi8/ubi-minimal/5c359a62bed8bd75a2c3fba8' +ubi8source='https://oss-dependencies.elastic.co/redhat/ubi/ubi-minimal-8-source.tar.gz' +ubilicense='Custom;https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf,https://oss-dependencies.elastic.co/redhat/ubi/ubi-minimal-8-source.tar.gz' +cat <> $outfile +Red Hat Universal Base Image,$ubi8url,8,,$ubilicense,$ubi8source +EOF diff --git a/dev-tools/notice/dependencies.csv.tmpl b/dev-tools/notice/dependencies.csv.tmpl index 6ab2a970199..088314378f6 100644 --- a/dev-tools/notice/dependencies.csv.tmpl +++ b/dev-tools/notice/dependencies.csv.tmpl @@ -1,7 +1,7 @@ {{- define "depInfo" -}} {{- range $i, $dep := . }} -{{ $dep.Name }},{{ $dep.URL }},{{ $dep.Version | canonicalVersion }},{{ $dep.Version | revision }},{{ $dep.LicenceType }} +{{ $dep.Name }},{{ $dep.URL }},{{ $dep.Version | canonicalVersion }},{{ $dep.Version | revision }},{{ $dep.LicenceType }},{{ $dep.URL }} {{- end -}} {{- end -}} -name,url,version,revision,license{{ template "depInfo" .Direct }}{{ template "depInfo" .Indirect }} +name,url,version,revision,license,sourceURL{{ template "depInfo" .Direct }}{{ template "depInfo" .Indirect }} From bb84f3f778eb8fd1f23fc5d88d118506c421b355 Mon Sep 17 00:00:00 2001 From: Fae Charlton Date: Tue, 29 Sep 2020 12:51:55 -0400 Subject: [PATCH 083/216] [libbeat] Fix position writing in the disk queue --- libbeat/publisher/queue/diskqueue/state_file.go | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/libbeat/publisher/queue/diskqueue/state_file.go b/libbeat/publisher/queue/diskqueue/state_file.go index 2ff14e3e5e2..d8cbb5690ac 100644 --- a/libbeat/publisher/queue/diskqueue/state_file.go +++ b/libbeat/publisher/queue/diskqueue/state_file.go @@ -82,12 +82,14 @@ func writeQueuePositionToHandle( } // Want to write: version (0), segment id, segment offset. - elems := []interface{}{uint32(0), position.segmentID, position.offset} - for _, elem := range elems { - err = binary.Write(file, binary.LittleEndian, &elem) - if err != nil { - return err - } + err = binary.Write(file, binary.LittleEndian, uint32(0)) + if err != nil { + return err + } + err = binary.Write(file, binary.LittleEndian, position.segmentID) + if err != nil { + return err } - return nil + err = binary.Write(file, binary.LittleEndian, position.offset) + return err } From d8d35a16b0beae02cb8048df2a66c3a743d0633f Mon Sep 17 00:00:00 2001 From: Fae Charlton Date: Tue, 29 Sep 2020 13:00:27 -0400 Subject: [PATCH 084/216] Fix shutdown tracking in s3 input (#21380) --- x-pack/filebeat/input/s3/input.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/input/s3/input.go b/x-pack/filebeat/input/s3/input.go index 6b57789b48f..83dc48428ee 100644 --- a/x-pack/filebeat/input/s3/input.go +++ b/x-pack/filebeat/input/s3/input.go @@ -190,11 +190,11 @@ func (p *s3Input) Run() { p.workerWg.Add(1) go p.run(svcSQS, svcS3, visibilityTimeout) - p.workerWg.Done() }) } func (p *s3Input) run(svcSQS sqsiface.ClientAPI, svcS3 s3iface.ClientAPI, visibilityTimeout int64) { + defer p.workerWg.Done() defer p.logger.Infof("s3 input worker for '%v' has stopped.", p.config.QueueURL) p.logger.Infof("s3 input worker has started. with queueURL: %v", p.config.QueueURL) From 7a369caadc1557699e8b86b6e2d1150e76d554b5 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Tue, 29 Sep 2020 11:21:33 -0700 Subject: [PATCH 085/216] docs: fix apt/yum formatting (#21362) --- libbeat/docs/repositories.asciidoc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libbeat/docs/repositories.asciidoc b/libbeat/docs/repositories.asciidoc index a7104414465..1b27a6c0b44 100644 --- a/libbeat/docs/repositories.asciidoc +++ b/libbeat/docs/repositories.asciidoc @@ -122,7 +122,7 @@ sudo apt-get update && sudo apt-get install {beatname_pkg} -------------------------------------------------- sudo systemctl enable {beatname_pkg} -------------------------------------------------- - ++ If your system does not use `systemd` then run: + ["source","sh",subs="attributes"] @@ -224,7 +224,7 @@ sudo yum install {beatname_pkg} -------------------------------------------------- sudo systemctl enable {beatname_pkg} -------------------------------------------------- - ++ If your system does not use `systemd` then run: + ["source","sh",subs="attributes"] @@ -233,4 +233,3 @@ sudo chkconfig --add {beatname_pkg} -------------------------------------------------- endif::[] - From ef6274d0d1e36308a333cbed69846a1bd63528ae Mon Sep 17 00:00:00 2001 From: Fae Charlton Date: Tue, 29 Sep 2020 16:13:38 -0400 Subject: [PATCH 086/216] [libbeat] Enable WriteAheadLimit in the disk queue (#21391) --- libbeat/publisher/queue/diskqueue/config.go | 12 ++++++-- .../publisher/queue/diskqueue/core_loop.go | 28 ++++++++++++------- 2 files changed, 28 insertions(+), 12 deletions(-) diff --git a/libbeat/publisher/queue/diskqueue/config.go b/libbeat/publisher/queue/diskqueue/config.go index f39f608361d..6a165a665db 100644 --- a/libbeat/publisher/queue/diskqueue/config.go +++ b/libbeat/publisher/queue/diskqueue/config.go @@ -106,8 +106,8 @@ func DefaultSettings() Settings { MaxSegmentSize: 100 * (1 << 20), // 100MiB MaxBufferSize: (1 << 30), // 1GiB - ReadAheadLimit: 256, - WriteAheadLimit: 1024, + ReadAheadLimit: 512, + WriteAheadLimit: 2048, } } @@ -129,6 +129,14 @@ func SettingsForUserConfig(config *common.Config) (Settings, error) { // divided by 10. settings.MaxSegmentSize = uint64(userConfig.MaxSize) / 10 } + + if userConfig.ReadAheadLimit != nil { + settings.ReadAheadLimit = *userConfig.ReadAheadLimit + } + if userConfig.WriteAheadLimit != nil { + settings.WriteAheadLimit = *userConfig.WriteAheadLimit + } + return settings, nil } diff --git a/libbeat/publisher/queue/diskqueue/core_loop.go b/libbeat/publisher/queue/diskqueue/core_loop.go index 56a50b5a422..638d9da2f40 100644 --- a/libbeat/publisher/queue/diskqueue/core_loop.go +++ b/libbeat/publisher/queue/diskqueue/core_loop.go @@ -58,10 +58,15 @@ func (dq *diskQueue) run() { // The writer loop completed a request, so check if there is more // data to be sent. dq.maybeWritePending() - // We also check whether the reader loop is waiting for the data - // that was just written. + + // The data that was just written is now available for reading, so check + // if we should start a new read request. dq.maybeReadPending() + // pendingFrames should now be empty. If any producers were blocked + // because pendingFrames hit settings.WriteAheadLimit, wake them up. + dq.maybeUnblockProducers() + // Reader loop handling case readerLoopResponse := <-dq.readerLoop.responseChan: dq.handleReaderLoopResponse(readerLoopResponse) @@ -417,22 +422,25 @@ func (dq *diskQueue) enqueueWriteFrame(frame *writeFrame) { }) } -// canAcceptFrameOfSize checks whether there is enough free space in the -// queue (subject to settings.MaxBufferSize) to accept a new frame with -// the given size. Size includes both the serialized data and the frame -// header / footer; the easy way to do this for a writeFrame is to pass +// canAcceptFrameOfSize checks whether there is enough free space in the queue +// (subject to settings.{MaxBufferSize, WriteAheadLimit}) to accept a new +// frame with the given size. Size includes both the serialized data and the +// frame header / footer; the easy way to do this for a writeFrame is to pass // in frame.sizeOnDisk(). // Capacity calculations do not include requests in the blockedProducers // list (that data is owned by its callers and we can't touch it until // we are ready to respond). That allows this helper to be used both while // handling producer requests and while deciding whether to unblock // producers after free capacity increases. -// If we decide to add limits on how many events / bytes can be stored -// in pendingFrames (to avoid unbounded memory use if the input is faster -// than the disk), this is the function to modify. func (dq *diskQueue) canAcceptFrameOfSize(frameSize uint64) bool { + // If pendingFrames is already at the WriteAheadLimit, we can't accept + // any new frames right now. + if len(dq.pendingFrames) >= dq.settings.WriteAheadLimit { + return false + } + + // If the queue size is unbounded (max == 0), we accept. if dq.settings.MaxBufferSize == 0 { - // Currently we impose no limitations if the queue size is unbounded. return true } From cd28ee52a701df6148ae7f452c38c0b2a4842662 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Wed, 30 Sep 2020 13:28:42 +0200 Subject: [PATCH 087/216] Move Kubernetes events metricset to its own block in reference config (#21407) In the reference configuration the event metricset was in the block of configurations for kube-state-metrics. --- deploy/kubernetes/metricbeat-kubernetes.yaml | 6 ++++-- .../metricbeat/metricbeat-daemonset-configmap.yaml | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/deploy/kubernetes/metricbeat-kubernetes.yaml b/deploy/kubernetes/metricbeat-kubernetes.yaml index 4bc1976e40e..32d1010f4d0 100644 --- a/deploy/kubernetes/metricbeat-kubernetes.yaml +++ b/deploy/kubernetes/metricbeat-kubernetes.yaml @@ -36,8 +36,6 @@ data: - state_cronjob - state_resourcequota - state_statefulset - # Uncomment this to get k8s events: - #- event - module: kubernetes metricsets: - apiserver @@ -46,6 +44,10 @@ data: ssl.certificate_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/ca.crt period: 30s + # Uncomment this to get k8s events: + #- module: kubernetes + # metricsets: + # - event # To enable hints based autodiscover uncomment this: #- type: kubernetes # node: ${NODE_NAME} diff --git a/deploy/kubernetes/metricbeat/metricbeat-daemonset-configmap.yaml b/deploy/kubernetes/metricbeat/metricbeat-daemonset-configmap.yaml index 98fffb86ad0..b95bf478765 100644 --- a/deploy/kubernetes/metricbeat/metricbeat-daemonset-configmap.yaml +++ b/deploy/kubernetes/metricbeat/metricbeat-daemonset-configmap.yaml @@ -36,8 +36,6 @@ data: - state_cronjob - state_resourcequota - state_statefulset - # Uncomment this to get k8s events: - #- event - module: kubernetes metricsets: - apiserver @@ -46,6 +44,10 @@ data: ssl.certificate_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/ca.crt period: 30s + # Uncomment this to get k8s events: + #- module: kubernetes + # metricsets: + # - event # To enable hints based autodiscover uncomment this: #- type: kubernetes # node: ${NODE_NAME} From 222b069bf496b70d7378a58a5cf756de01f60d0c Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Wed, 30 Sep 2020 15:14:15 +0200 Subject: [PATCH 088/216] fix: use a fixed version of setuptools (#21393) --- libbeat/tests/system/requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/libbeat/tests/system/requirements.txt b/libbeat/tests/system/requirements.txt index 08843d6144d..86071d5dd65 100644 --- a/libbeat/tests/system/requirements.txt +++ b/libbeat/tests/system/requirements.txt @@ -37,6 +37,7 @@ PyYAML==5.3.1 redis==2.10.6 requests==2.20.0 semver==2.8.1 +setuptools==47.3.2 six==1.15.0 stomp.py==4.1.22 termcolor==1.1.0 From 3deda877fbbc7c136bacf00b2e055f5b3093f594 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Wed, 30 Sep 2020 15:14:48 +0200 Subject: [PATCH 089/216] fix: mark flaky tests (#21300) * fix: mark flaky test * Apply suggestions from code review * Update libbeat/outputs/elasticsearch/client_integration_test.go * Apply suggestions from code review * Apply suggestions from code review --- auditbeat/module/file_integrity/eventreader_test.go | 2 ++ filebeat/tests/system/test_reload_inputs.py | 3 +++ x-pack/auditbeat/tests/system/test_metricsets.py | 3 +++ 3 files changed, 8 insertions(+) diff --git a/auditbeat/module/file_integrity/eventreader_test.go b/auditbeat/module/file_integrity/eventreader_test.go index 6d9b02f7867..a00367f350a 100644 --- a/auditbeat/module/file_integrity/eventreader_test.go +++ b/auditbeat/module/file_integrity/eventreader_test.go @@ -41,6 +41,7 @@ func init() { const ErrorSharingViolation syscall.Errno = 32 func TestEventReader(t *testing.T) { + t.Skip("Flaky test: about 1/10 of bulds fails https://github.com/elastic/beats/issues/21302") // Make dir to monitor. dir, err := ioutil.TempDir("", "audit") if err != nil { @@ -240,6 +241,7 @@ func TestEventReader(t *testing.T) { } func TestRaces(t *testing.T) { + t.Skip("Flaky test: about 1/20 of bulds fails https://github.com/elastic/beats/issues/21303") const ( fileMode os.FileMode = 0640 N = 100 diff --git a/filebeat/tests/system/test_reload_inputs.py b/filebeat/tests/system/test_reload_inputs.py index 4de554fe2c6..4c5fa1abfba 100644 --- a/filebeat/tests/system/test_reload_inputs.py +++ b/filebeat/tests/system/test_reload_inputs.py @@ -1,4 +1,5 @@ import os +import pytest import time from filebeat import BaseTest @@ -249,6 +250,8 @@ def test_load_configs(self): assert output[0]["message"] == first_line assert output[1]["message"] == second_line + # 1/20 build fails https://github.com/elastic/beats/issues/21307 + @pytest.mark.flaky(reruns=1, reruns_delay=10) def test_reload_same_config(self): """ Test reload same config with same file but different config. Makes sure reloading also works on conflicts. diff --git a/x-pack/auditbeat/tests/system/test_metricsets.py b/x-pack/auditbeat/tests/system/test_metricsets.py index 26bddcef785..d60c1b82ef8 100644 --- a/x-pack/auditbeat/tests/system/test_metricsets.py +++ b/x-pack/auditbeat/tests/system/test_metricsets.py @@ -1,6 +1,7 @@ import jinja2 import os import platform +import pytest import sys import time import unittest @@ -42,6 +43,8 @@ def test_metricset_login(self): # Metricset is beta and that generates a warning, TODO: remove later self.check_metricset("system", "login", COMMON_FIELDS + fields, config, warnings_allowed=True) + # 1/20 build fails https://github.com/elastic/beats/issues/21308 + @pytest.mark.flaky(reruns=1, reruns_delay=10) @unittest.skipIf(sys.platform == "win32", "Not implemented for Windows") @unittest.skipIf(sys.platform.startswith('linux') and not (os.path.isdir("/var/lib/dpkg") or os.path.isdir("/var/lib/rpm")), "Only implemented for dpkg and rpm") From cdfa559a7e230d4162258b639131e589a2336614 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Wed, 30 Sep 2020 15:15:17 +0200 Subject: [PATCH 090/216] docs: Prepare Changelog for 7.9.2 (#21229) (#21403) * Close changelog for 7.9.2 * Update CHANGELOG.next.asciidoc * Apply suggestions from code review --- CHANGELOG.asciidoc | 41 +++++++++++++++++++++++++++++++++++++++++ CHANGELOG.next.asciidoc | 4 ++++ 2 files changed, 45 insertions(+) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index b0b31734005..c4d0f48005f 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -3,6 +3,47 @@ :issue: https://github.com/elastic/beats/issues/ :pull: https://github.com/elastic/beats/pull/ +[[release-notes-7.9.2]] +=== Beats version 7.9.2 +https://github.com/elastic/beats/compare/v7.9.1...v7.9.2[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Autodiscover doesn't generate any configuration when a variable is missing. Previously it generated an incomplete configuration. {pull}20898[20898] + +==== Bugfixes + +*Affecting all Beats* + +- Explicitly detect missing variables in autodiscover configuration, log them at the debug level. {issue}20568[20568] {pull}20898[20898] +- Fix `libbeat.output.write.bytes` and `libbeat.output.read.bytes` metrics of the Elasticsearch output. {issue}20752[20752] {pull}21197[21197] + +*Filebeat* + +- Provide backwards compatibility for the `set` processor when Elasticsearch is less than 7.9.0. {pull}20908[20908] +- Fix an error updating file size being logged when EOF is reached. {pull}21048[21048] +- Fix error when processing AWS Cloudtrail Digest logs. {pull}21086[21086] {issue}20943[20943] + +*Metricbeat* + +- The Kibana collector applies backoff when errored at getting usage stats {pull}20772[20772] +- The `elasticsearch/index` metricset only requests wildcard expansion for hidden indices if the monitored Elasticsearch cluster supports it. {pull}20938[20938] +- Fix panic index out of range error when getting AWS account name. {pull}21101[21101] {issue}21095[21095] +- Handle missing counters in the application_pool metricset. {pull}21071[21071] + +*Functionbeat* + +- Do not need Google credentials if not required for the operation. {issue}17329[17329] {pull}21072[21072] +- Fix dependency issues of GCP functions. {issue}20830[20830] {pull}21070[21070] + +==== Added + +*Affecting all Beats* + +- Add container ECS fields in kubernetes metadata. {pull}20984[20984] + [[release-notes-7.9.1]] === Beats version 7.9.1 https://github.com/elastic/beats/compare/v7.9.0...v7.9.1[View commits] diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1b5b1bd16bb..223dace9e49 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -23,6 +23,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Autodiscover doesn't generate any configuration when a variable is missing. Previously it generated an incomplete configuration. {pull}20898[20898] - Remove redundant `cloudfoundry.*.timestamp` fields. This value is set in `@timestamp`. {pull}21175[21175] - Allow embedding of CAs, Certificate of private keys for anything that support TLS in ouputs and inputs https://github.com/elastic/beats/pull/21179 +- Update to Golang 1.12.1. {pull}11330[11330] +- Disable Alibaba Cloud and Tencent Cloud metadata providers by default. {pull}13812[12812] *Auditbeat* @@ -74,6 +76,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix PANW field spelling "veredict" to "verdict" on event.action {pull}18808[18808] - Removed experimental modules `citrix`, `kaspersky`, `rapid7` and `tenable`. {pull}20706[20706] - Add support for GMT timezone offsets in `decode_cef`. {pull}20993[20993] +- Fix parsing of Elasticsearch node name by `elasticsearch/slowlog` fileset. {pull}14547[14547] *Heartbeat* @@ -356,6 +359,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix timestamp handling in remote_write. {pull}21166[21166] - Fix remote_write flaky test. {pull}21173[21173] - Visualization title fixes in aws, azure and googlecloud compute dashboards. {pull}21098[21098] +- Add a switch to the driver definition on SQL module to use pretty names {pull}17378[17378] *Packetbeat* From cba5245b313e40d409b14b362859b427841df0b3 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Wed, 30 Sep 2020 16:21:34 +0200 Subject: [PATCH 091/216] docs: add link to release notes for 7.9.2 (#21405) (#21419) --- libbeat/docs/release.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/libbeat/docs/release.asciidoc b/libbeat/docs/release.asciidoc index 4215186d430..24e0ee43651 100644 --- a/libbeat/docs/release.asciidoc +++ b/libbeat/docs/release.asciidoc @@ -8,6 +8,7 @@ This section summarizes the changes in each release. Also read <> for more detail about changes that affect upgrade. +* <> * <> * <> * <> From cadd5ff70e679f76e41f32daa1d56734ddf3ae8c Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Wed, 30 Sep 2020 16:49:44 +0100 Subject: [PATCH 092/216] [JJBB] Set shallow cloning to 10 (#21409) --- .ci/jobs/apm-beats-update.yml | 2 +- .ci/jobs/beats-tester.yml | 2 +- .ci/jobs/beats-windows-mbp.yml | 2 +- .ci/jobs/beats.yml | 2 +- .ci/jobs/golang-crossbuild-mbp.yml | 2 +- .ci/jobs/packaging.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.ci/jobs/apm-beats-update.yml b/.ci/jobs/apm-beats-update.yml index 8bdc322f65a..2ae688ffab7 100644 --- a/.ci/jobs/apm-beats-update.yml +++ b/.ci/jobs/apm-beats-update.yml @@ -48,7 +48,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-tester.yml b/.ci/jobs/beats-tester.yml index 522abfa5e5c..808123a225e 100644 --- a/.ci/jobs/beats-tester.yml +++ b/.ci/jobs/beats-tester.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-windows-mbp.yml b/.ci/jobs/beats-windows-mbp.yml index 64efa009979..7ea26c9ba18 100644 --- a/.ci/jobs/beats-windows-mbp.yml +++ b/.ci/jobs/beats-windows-mbp.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 4 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats.yml b/.ci/jobs/beats.yml index 1e393bab6b9..3e4c8e50980 100644 --- a/.ci/jobs/beats.yml +++ b/.ci/jobs/beats.yml @@ -46,7 +46,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/golang-crossbuild-mbp.yml b/.ci/jobs/golang-crossbuild-mbp.yml index 46303790610..45175d169f6 100644 --- a/.ci/jobs/golang-crossbuild-mbp.yml +++ b/.ci/jobs/golang-crossbuild-mbp.yml @@ -31,7 +31,7 @@ before: true prune: true shallow-clone: true - depth: 4 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/packaging.yml b/.ci/jobs/packaging.yml index 0dce4d4672b..fd6fb9f90c6 100644 --- a/.ci/jobs/packaging.yml +++ b/.ci/jobs/packaging.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false From 3253dbfecbf2570aa4beea6704da6c2ea53c1666 Mon Sep 17 00:00:00 2001 From: Ivan Fernandez Calvo Date: Wed, 30 Sep 2020 18:47:13 +0200 Subject: [PATCH 093/216] ci: pipeline to generate the changelog (#21426) --- .ci/jobs/beats-release-changelog.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .ci/jobs/beats-release-changelog.yml diff --git a/.ci/jobs/beats-release-changelog.yml b/.ci/jobs/beats-release-changelog.yml new file mode 100644 index 00000000000..1cbd94c7168 --- /dev/null +++ b/.ci/jobs/beats-release-changelog.yml @@ -0,0 +1,20 @@ +--- +- job: + name: Beats/Release/beats-release-changelog + display-name: 'Prepare the Changelog for a Release' + description: 'Automate the steps to prepare the Changelog for a Release' + view: Beats + project-type: pipeline + pipeline-scm: + script-path: release_scripts/pipeline-release-changelog.groovy + scm: + - git: + url: git@github.com:elastic/ingest-dev.git + refspec: +refs/heads/*:refs/remotes/origin/* +refs/pull/*/head:refs/remotes/origin/pr/* + wipe-workspace: 'True' + name: origin + shallow-clone: true + credentials-id: f6c7695a-671e-4f4f-a331-acdce44ff9ba + reference-repo: /var/lib/jenkins/.git-references/ingest-dev.git + branches: + - master From fd52ca5adff8a68370e98ae89e101e4060776020 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Wed, 30 Sep 2020 13:02:05 -0500 Subject: [PATCH 094/216] [Winlogbeat] Move winlogbeat javascript processor to libbeat (#21402) * Move winlogbeat processor to libbeat - needed for filebeat winlog input - changed name to windows - also register as winlogbeat for backwards compatibility --- libbeat/processors/script/javascript/module/include.go | 1 + .../script/javascript/module/windows}/doc.go | 6 +++--- .../script/javascript/module/windows/windows.go | 10 ++++++---- .../script/javascript/module/windows/windows_test.go | 2 +- winlogbeat/cmd/root.go | 1 - .../module/powershell/config/winlogbeat-powershell.js | 4 ++-- .../module/security/config/winlogbeat-security.js | 4 ++-- .../module/sysmon/config/winlogbeat-sysmon.js | 4 ++-- x-pack/winlogbeat/module/testing_windows.go | 1 - 9 files changed, 17 insertions(+), 16 deletions(-) rename {winlogbeat/processors/script/javascript/module/winlogbeat => libbeat/processors/script/javascript/module/windows}/doc.go (82%) rename winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat.go => libbeat/processors/script/javascript/module/windows/windows.go (87%) rename winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat_test.go => libbeat/processors/script/javascript/module/windows/windows_test.go (99%) diff --git a/libbeat/processors/script/javascript/module/include.go b/libbeat/processors/script/javascript/module/include.go index f30e423e7a2..b498dc90e21 100644 --- a/libbeat/processors/script/javascript/module/include.go +++ b/libbeat/processors/script/javascript/module/include.go @@ -24,4 +24,5 @@ import ( _ "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/path" _ "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/processor" _ "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/require" + _ "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/windows" ) diff --git a/winlogbeat/processors/script/javascript/module/winlogbeat/doc.go b/libbeat/processors/script/javascript/module/windows/doc.go similarity index 82% rename from winlogbeat/processors/script/javascript/module/winlogbeat/doc.go rename to libbeat/processors/script/javascript/module/windows/doc.go index fc782636d09..bca46a94340 100644 --- a/winlogbeat/processors/script/javascript/module/winlogbeat/doc.go +++ b/libbeat/processors/script/javascript/module/windows/doc.go @@ -15,7 +15,7 @@ // specific language governing permissions and limitations // under the License. -// Package winlogbeat registers the winlogbeat module with the javascript script -// processor. The module has utilities specific to Winlogbeat like parsing +// Package windows registers the windows module with the javascript script +// processor. The module has utilities specific to Windows like parsing // Windows command lines. -package winlogbeat +package windows diff --git a/winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat.go b/libbeat/processors/script/javascript/module/windows/windows.go similarity index 87% rename from winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat.go rename to libbeat/processors/script/javascript/module/windows/windows.go index dc9439c5c67..2bbe7817fad 100644 --- a/winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat.go +++ b/libbeat/processors/script/javascript/module/windows/windows.go @@ -17,7 +17,7 @@ // +build windows -package winlogbeat +package windows import ( "syscall" @@ -60,11 +60,11 @@ func commandLineToArgvW(in string) ([]string, error) { return args, nil } -// Require registers the winlogbeat module that has utilities specific to -// Winlogbeat like parsing Windows command lines. It can be accessed using: +// Require registers the windows module that has utilities specific to +// Windows like parsing Windows command lines. It can be accessed using: // // // javascript -// var winlogbeat = require('winlogbeat'); +// var windows = require('windows'); // func Require(vm *goja.Runtime, module *goja.Object) { o := module.Get("exports").(*goja.Object) @@ -74,9 +74,11 @@ func Require(vm *goja.Runtime, module *goja.Object) { // Enable adds path to the given runtime. func Enable(runtime *goja.Runtime) { + runtime.Set("windows", require.Require(runtime, "windows")) runtime.Set("winlogbeat", require.Require(runtime, "winlogbeat")) } func init() { + require.RegisterNativeModule("windows", Require) require.RegisterNativeModule("winlogbeat", Require) } diff --git a/winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat_test.go b/libbeat/processors/script/javascript/module/windows/windows_test.go similarity index 99% rename from winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat_test.go rename to libbeat/processors/script/javascript/module/windows/windows_test.go index 45c339cc1f2..be213a79ba8 100644 --- a/winlogbeat/processors/script/javascript/module/winlogbeat/winlogbeat_test.go +++ b/libbeat/processors/script/javascript/module/windows/windows_test.go @@ -17,7 +17,7 @@ // +build windows -package winlogbeat +package windows import ( "testing" diff --git a/winlogbeat/cmd/root.go b/winlogbeat/cmd/root.go index 7e25e717813..2cd26a9fe8e 100644 --- a/winlogbeat/cmd/root.go +++ b/winlogbeat/cmd/root.go @@ -30,7 +30,6 @@ import ( // Import processors and supporting modules. _ "github.com/elastic/beats/v7/libbeat/processors/script" _ "github.com/elastic/beats/v7/libbeat/processors/timestamp" - _ "github.com/elastic/beats/v7/winlogbeat/processors/script/javascript/module/winlogbeat" ) const ( diff --git a/x-pack/winlogbeat/module/powershell/config/winlogbeat-powershell.js b/x-pack/winlogbeat/module/powershell/config/winlogbeat-powershell.js index 71ce567ccc7..4ef1155086b 100644 --- a/x-pack/winlogbeat/module/powershell/config/winlogbeat-powershell.js +++ b/x-pack/winlogbeat/module/powershell/config/winlogbeat-powershell.js @@ -5,7 +5,7 @@ var powershell = (function () { var path = require("path"); var processor = require("processor"); - var winlogbeat = require("winlogbeat"); + var windows = require("windows"); var normalizeCommonFieldNames = new processor.Convert({ fields: [ @@ -183,7 +183,7 @@ var powershell = (function () { if (!commandLine) { return; } - evt.Put(target, winlogbeat.splitCommandLine(commandLine)); + evt.Put(target, windows.splitCommandLine(commandLine)); }; var addProcessArgs = function (evt) { diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 9a0899165b9..5a8e91b677b 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -5,7 +5,7 @@ var security = (function () { var path = require("path"); var processor = require("processor"); - var winlogbeat = require("winlogbeat"); + var windows = require("windows"); // Logon Types // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events @@ -1670,7 +1670,7 @@ var security = (function () { if (!cl) { return; } - evt.Put("process.args", winlogbeat.splitCommandLine(cl)); + evt.Put("process.args", windows.splitCommandLine(cl)); evt.Put("process.command_line", cl); }) .Build(); diff --git a/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js b/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js index 5fcedb9e40e..5b09c98fc32 100644 --- a/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js +++ b/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js @@ -15,7 +15,7 @@ if (!String.prototype.startsWith) { var sysmon = (function () { var path = require("path"); var processor = require("processor"); - var winlogbeat = require("winlogbeat"); + var windows = require("windows"); var net = require("net"); // Windows error codes for DNS. This list was generated using @@ -311,7 +311,7 @@ var sysmon = (function () { if (!commandLine) { return; } - evt.Put(target, winlogbeat.splitCommandLine(commandLine)); + evt.Put(target, windows.splitCommandLine(commandLine)); }; var splitProcessArgs = function (evt) { diff --git a/x-pack/winlogbeat/module/testing_windows.go b/x-pack/winlogbeat/module/testing_windows.go index 12b2102070f..058e2320a9d 100644 --- a/x-pack/winlogbeat/module/testing_windows.go +++ b/x-pack/winlogbeat/module/testing_windows.go @@ -28,7 +28,6 @@ import ( // Register javascript modules. _ "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module" - _ "github.com/elastic/beats/v7/winlogbeat/processors/script/javascript/module/winlogbeat" ) var update = flag.Bool("update", false, "update golden files") From eae9f5c156467f2f23df5afc4e73b63c01e3091b Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Wed, 30 Sep 2020 13:09:57 -0500 Subject: [PATCH 095/216] Add field limit check for AWS Cloudtrail flattened fields (#21388) add 32k length check for - aws.cloudtrail.flattened.request_parameters - aws.cloudtrail.flattened.response_elements - aws.cloudtrail.flattened.additional_eventdata - aws.cloudtrail.flattened.service_event_details Closes #21382 --- CHANGELOG.next.asciidoc | 1 + .../module/aws/cloudtrail/ingest/pipeline.yml | 62 ++++++++----------- 2 files changed, 26 insertions(+), 37 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 223dace9e49..a96a23db9d8 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -275,6 +275,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Handle multiple upstreams in ingress-controller. {pull}21215[21215] - Provide backwards compatibility for the `append` processor when Elasticsearch is less than 7.10.0. {pull}21159[21159] - Fix checkpoint module when logs contain time field. {pull}20567[20567] +- Add field limit check for AWS Cloudtrail flattened fields. {pull}21388[21388] {issue}21382[21382] *Heartbeat* diff --git a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml index 8421e12d7f0..8ceec6ff100 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml @@ -146,37 +146,36 @@ processors: field: "json.errorMessage" target_field: "aws.cloudtrail.error_message" ignore_failure: true - - rename: - field: json.requestParameters - target_field: "aws.cloudtrail.flattened.request_parameters" - if: ctx?.json?.requestParameters != null - script: lang: painless source: | - if (ctx.aws.cloudtrail.flattened.request_parameters != null) { - ctx.aws.cloudtrail.request_parameters = ctx.aws.cloudtrail.flattened.request_parameters.toString(); + if (ctx.aws.cloudtrail?.flattened == null) { + Map map = new HashMap(); + ctx.aws.cloudtrail.put("flattened", map); + } + if (ctx.json.requestParameters != null) { + ctx.aws.cloudtrail.request_parameters = ctx.json.requestParameters.toString(); + if (ctx.aws.cloudtrail.request_parameters.length() < 32766) { + ctx.aws.cloudtrail.flattened.put("request_parameters", ctx.json.requestParameters); + } } - ignore_failure: true - - rename: - field: json.responseElements - target_field: "aws.cloudtrail.flattened.response_elements" - if: ctx?.json?.responseElements != null - - script: - lang: painless - source: | - if (ctx.aws.cloudtrail.flattened.response_elements != null) { - ctx.aws.cloudtrail.response_elements = ctx.aws.cloudtrail.flattened.response_elements.toString(); + if (ctx.json.responseElements != null) { + ctx.aws.cloudtrail.response_elements = ctx.json.responseElements.toString(); + if (ctx.aws.cloudtrail.response_elements.length() < 32766) { + ctx.aws.cloudtrail.flattened.put("response_elements", ctx.json.responseElements); + } } - ignore_failure: true - - rename: - field: json.additionalEventData - target_field: "aws.cloudtrail.flattened.additional_eventdata" - if: ctx?.json?.additionalEventData != null - - script: - lang: painless - source: | - if (ctx.aws.cloudtrail.flattened.additional_eventdata != null) { - ctx.aws.cloudtrail.additional_eventdata = ctx.aws.cloudtrail.flattened.additional_eventdata.toString(); + if (ctx.json.additionalEventData != null) { + ctx.aws.cloudtrail.additional_eventdata = ctx.json.additionalEventData.toString(); + if (ctx.aws.cloudtrail.additional_eventdata.length() < 32766) { + ctx.aws.cloudtrail.flattened.put("additional_eventdata", ctx.json.additionalEventData); + } + } + if (ctx.json.serviceEventDetails != null) { + ctx.aws.cloudtrail.service_event_details = ctx.json.serviceEventDetails.toString(); + if (ctx.aws.cloudtrail.service_event_details.length() < 32766) { + ctx.aws.cloudtrail.flattened.put("service_event_details", ctx.json.serviceEventDetails); + } } ignore_failure: true - rename: @@ -219,17 +218,6 @@ processors: field: "json.recipientAccountId" target_field: "aws.cloudtrail.recipient_account_id" ignore_failure: true - - rename: - field: json.serviceEventDetails - target_field: "aws.cloudtrail.flattened.service_event_details" - if: ctx?.json?.serviceEventDetails != null - - script: - lang: painless - source: | - if (ctx.aws.cloudtrail.flattened.service_event_details != null) { - ctx.aws.cloudtrail.service_event_details = ctx.aws.cloudtrail.flattened.service_event_details.toString(); - } - ignore_failure: true - rename: field: "json.sharedEventId" target_field: "aws.cloudtrail.shared_event_id" From f07eeaa02a1100be29cf1f2fa045a6c4a8d8a16d Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Thu, 1 Oct 2020 08:52:03 +0200 Subject: [PATCH 096/216] [Ingest Manager] Upgrade Action: make source URI optional (#21372) [Ingest Manager] Upgrade Action: make source URI optional (#21372) --- .../pkg/agent/application/upgrade/step_unpack.go | 4 ++-- .../pkg/agent/application/upgrade/upgrade.go | 15 +++++++++++++-- x-pack/elastic-agent/pkg/fleetapi/action.go | 2 +- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go index ae3d05edd16..8efb2de2140 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go @@ -23,8 +23,8 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" ) -// untar unpacks archive correctly, skips root (symlink, config...) unpacks data/* -func (u *Upgrader) unpack(ctx context.Context, version, sourceURI, archivePath string) (string, error) { +// unpack unpacks archive correctly, skips root (symlink, config...) unpacks data/* +func (u *Upgrader) unpack(ctx context.Context, version, archivePath string) (string, error) { // unpack must occur in directory that holds the installation directory // or the extraction will be double nested var hash string diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index 9c2c4f02286..de3a577281d 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -75,12 +75,13 @@ func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error "running under control of the systems supervisor") } - archivePath, err := u.downloadArtifact(ctx, a.Version, a.SourceURI) + sourceURI, err := u.sourceURI(a.Version, a.SourceURI) + archivePath, err := u.downloadArtifact(ctx, a.Version, sourceURI) if err != nil { return err } - newHash, err := u.unpack(ctx, a.Version, a.SourceURI, archivePath) + newHash, err := u.unpack(ctx, a.Version, archivePath) if err != nil { return err } @@ -147,6 +148,16 @@ func (u *Upgrader) Ack(ctx context.Context) error { return ioutil.WriteFile(markerFile, markerBytes, 0600) } +func (u *Upgrader) sourceURI(version, retrievedURI string) (string, error) { + if strings.HasSuffix(version, "-SNAPSHOT") && retrievedURI == "" { + return "", errors.New("snapshot upgrade requires source uri", errors.TypeConfig) + } + if retrievedURI != "" { + return retrievedURI, nil + } + + return u.settings.SourceURI, nil +} func rollbackInstall(hash string) { os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) diff --git a/x-pack/elastic-agent/pkg/fleetapi/action.go b/x-pack/elastic-agent/pkg/fleetapi/action.go index d53b7fdfcfb..2329546629c 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/action.go +++ b/x-pack/elastic-agent/pkg/fleetapi/action.go @@ -97,7 +97,7 @@ type ActionUpgrade struct { ActionID string `json:"id" yaml:"id"` ActionType string `json:"type" yaml:"type"` Version string `json:"version" yaml:"version"` - SourceURI string `json:"source_uri" yaml:"source_uri"` + SourceURI string `json:"source_uri,omitempty" yaml:"source_uri,omitempty"` } func (a *ActionUpgrade) String() string { From 690afe941f3d08f7abd49f09e1a8845331673853 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20=C3=81lvarez?= Date: Thu, 1 Oct 2020 09:14:01 +0200 Subject: [PATCH 097/216] Initial spec file for apm-server (#21225) Start with Elasticsearch output only for now --- .../elastic-agent/spec/apm-server.yml.disabled | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 x-pack/elastic-agent/spec/apm-server.yml.disabled diff --git a/x-pack/elastic-agent/spec/apm-server.yml.disabled b/x-pack/elastic-agent/spec/apm-server.yml.disabled new file mode 100644 index 00000000000..c84405dfadd --- /dev/null +++ b/x-pack/elastic-agent/spec/apm-server.yml.disabled @@ -0,0 +1,16 @@ +name: APM-Server +cmd: apm-server +artifact: apm-server +args: ["-E", "management.enabled=true", "-E", "management.mode=x-pack-fleet"] +rules: + - fix_stream: {} + - filter_values: + selector: inputs + key: type + values: + - apm + - filter: + selectors: + - inputs + - output +when: length(${inputs}) > 0 and hasKey(${output}, 'elasticsearch') From cb624cfd18ac07e06e633a3d960d0926bd759730 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 1 Oct 2020 10:24:01 +0200 Subject: [PATCH 098/216] Add initial skeleton of filestream input (#21427) ## What does this PR do? This PR adds the skeleton of the new `filestream` input. The name of the input can be changed. The input was renamed from `logfile` because we are not going to provide the same options as the current `log` input. As `logfile` is already used by Agent for the `log` input, it is easier to adopt a new input with a different name. The PR seems big, but the contents of `filebeat/input/filestream/internal/input-logfile` is basically the same as `filebeat/input/v2/input-cursor`. It is separated into a different folder because when the time comes, we would like to unify the two input types. The main difference between the two inputs is that the `configure` function of `input-logfile` returns a `Prospector` which finds inputs dynamically. Whereas `input-cursor` requires a list of paths without globbing. The following files need review: * filebeat/input/filestream/input.go * filebeat/input/filestream/internal/input-logfile/fswatch.go * filebeat/input/filestream/internal/input-logfile/harvester.go * filebeat/input/filestream/internal/input-logfile/input.go * filebeat/input/filestream/internal/input-logfile/prospector.go * filebeat/input/filestream/prospector.go The others are the same as `input-cursor`. Also, updated tests are coming in a new PR. ## Related issues First step https://github.com/elastic/beats/issues/20243 --- filebeat/input/filestream/input.go | 68 ++++ .../internal/input-logfile/clean.go | 124 +++++++ .../internal/input-logfile/clean_test.go | 162 ++++++++ .../internal/input-logfile/cursor.go | 43 +++ .../internal/input-logfile/cursor_test.go | 124 +++++++ .../filestream/internal/input-logfile/doc.go | 58 +++ .../internal/input-logfile/fswatch.go | 65 ++++ .../internal/input-logfile/harvester.go | 125 +++++++ .../internal/input-logfile/input.go | 106 ++++++ .../internal/input-logfile/manager.go | 199 ++++++++++ .../internal/input-logfile/prospector.go | 35 ++ .../internal/input-logfile/publish.go | 153 ++++++++ .../internal/input-logfile/publish_test.go | 158 ++++++++ .../internal/input-logfile/store.go | 324 ++++++++++++++++ .../internal/input-logfile/store_test.go | 351 ++++++++++++++++++ filebeat/input/filestream/prospector.go | 38 ++ 16 files changed, 2133 insertions(+) create mode 100644 filebeat/input/filestream/input.go create mode 100644 filebeat/input/filestream/internal/input-logfile/clean.go create mode 100644 filebeat/input/filestream/internal/input-logfile/clean_test.go create mode 100644 filebeat/input/filestream/internal/input-logfile/cursor.go create mode 100644 filebeat/input/filestream/internal/input-logfile/cursor_test.go create mode 100644 filebeat/input/filestream/internal/input-logfile/doc.go create mode 100644 filebeat/input/filestream/internal/input-logfile/fswatch.go create mode 100644 filebeat/input/filestream/internal/input-logfile/harvester.go create mode 100644 filebeat/input/filestream/internal/input-logfile/input.go create mode 100644 filebeat/input/filestream/internal/input-logfile/manager.go create mode 100644 filebeat/input/filestream/internal/input-logfile/prospector.go create mode 100644 filebeat/input/filestream/internal/input-logfile/publish.go create mode 100644 filebeat/input/filestream/internal/input-logfile/publish_test.go create mode 100644 filebeat/input/filestream/internal/input-logfile/store.go create mode 100644 filebeat/input/filestream/internal/input-logfile/store_test.go create mode 100644 filebeat/input/filestream/prospector.go diff --git a/filebeat/input/filestream/input.go b/filebeat/input/filestream/input.go new file mode 100644 index 00000000000..487a5f01c2a --- /dev/null +++ b/filebeat/input/filestream/input.go @@ -0,0 +1,68 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/feature" + "github.com/elastic/beats/v7/libbeat/logp" +) + +// filestream is the input for reading from files which +// are actively written by other applications. +type filestream struct{} + +const pluginName = "filestream" + +// Plugin creates a new filestream input plugin for creating a stateful input. +func Plugin(log *logp.Logger, store loginp.StateStore) input.Plugin { + return input.Plugin{ + Name: pluginName, + Stability: feature.Experimental, + Deprecated: false, + Info: "filestream input", + Doc: "The filestream input collects logs from the local filestream service", + Manager: &loginp.InputManager{ + Logger: log, + StateStore: store, + Type: pluginName, + Configure: configure, + }, + } +} + +func configure(cfg *common.Config) (loginp.Prospector, loginp.Harvester, error) { + panic("TODO: implement me") +} + +func (inp *filestream) Name() string { return pluginName } + +func (inp *filestream) Test(src loginp.Source, ctx input.TestContext) error { + panic("TODO: implement me") +} + +func (inp *filestream) Run( + ctx input.Context, + src loginp.Source, + cursor loginp.Cursor, + publisher loginp.Publisher, +) error { + panic("TODO: implement me") +} diff --git a/filebeat/input/filestream/internal/input-logfile/clean.go b/filebeat/input/filestream/internal/input-logfile/clean.go new file mode 100644 index 00000000000..d738dabbc55 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/clean.go @@ -0,0 +1,124 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "time" + + "github.com/elastic/go-concert/timed" + "github.com/elastic/go-concert/unison" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +// cleaner removes finished entries from the registry file. +type cleaner struct { + log *logp.Logger +} + +// run starts a loop that tries to clean entries from the registry. +// The cleaner locks the store, such that no new states can be created +// during the cleanup phase. Only resources that are finished and whos TTL +// (clean_timeout setting) has expired will be removed. +// +// Resources are considered "Finished" if they do not have a current owner (active input), and +// if they have no pending updates that still need to be written to the registry file after associated +// events have been ACKed by the outputs. +// The event acquisition timestamp is used as reference to clean resources. If a resources was blocked +// for a long time, and the life time has been exhausted, then the resource will be removed immediately +// once the last event has been ACKed. +func (c *cleaner) run(canceler unison.Canceler, store *store, interval time.Duration) { + started := time.Now() + timed.Periodic(canceler, interval, func() error { + gcStore(c.log, started, store) + return nil + }) +} + +// gcStore looks for resources to remove and deletes these. `gcStore` receives +// the start timestamp of the cleaner as reference. If we have entries without +// updates in the registry, that are older than `started`, we will use `started +// + ttl` to decide if an entry will be removed. This way old entries are not +// removed immediately on startup if the Beat is down for a longer period of +// time. +func gcStore(log *logp.Logger, started time.Time, store *store) { + log.Debugf("Start store cleanup") + defer log.Debugf("Done store cleanup") + + states := store.ephemeralStore + states.mu.Lock() + defer states.mu.Unlock() + + keys := gcFind(states.table, started, time.Now()) + if len(keys) == 0 { + log.Debug("No entries to remove were found") + return + } + + if err := gcClean(store, keys); err != nil { + log.Errorf("Failed to remove all entries from the registry: %+v", err) + } +} + +// gcFind searches the store of resources that can be removed. A set of keys to delete is returned. +func gcFind(table map[string]*resource, started, now time.Time) map[string]struct{} { + keys := map[string]struct{}{} + for key, resource := range table { + clean := checkCleanResource(started, now, resource) + if !clean { + // do not clean the resource if it is still live or not serialized to the persistent store yet. + continue + } + keys[key] = struct{}{} + } + + return keys +} + +// gcClean removes key value pairs in the removeSet from the store. +// If deletion in the persistent store fails the entry is kept in memory and +// eventually cleaned up later. +func gcClean(store *store, removeSet map[string]struct{}) error { + for key := range removeSet { + if err := store.persistentStore.Remove(key); err != nil { + return err + } + delete(store.ephemeralStore.table, key) + } + return nil +} + +// checkCleanResource returns true for a key-value pair is assumed to be old, +// if is not in use and there are no more pending updates that still need to be +// written to the persistent store anymore. +func checkCleanResource(started, now time.Time, resource *resource) bool { + if !resource.Finished() { + return false + } + + resource.stateMutex.Lock() + defer resource.stateMutex.Unlock() + + ttl := resource.internalState.TTL + reference := resource.internalState.Updated + if started.After(reference) { + reference = started + } + + return reference.Add(ttl).Before(now) && resource.stored +} diff --git a/filebeat/input/filestream/internal/input-logfile/clean_test.go b/filebeat/input/filestream/internal/input-logfile/clean_test.go new file mode 100644 index 00000000000..83e5bff412f --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/clean_test.go @@ -0,0 +1,162 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/logp" +) + +func TestGCStore(t *testing.T) { + t.Run("empty store", func(t *testing.T) { + started := time.Now() + + backend := createSampleStore(t, nil) + store := testOpenStore(t, "test", backend) + defer store.Release() + + gcStore(logp.NewLogger("test"), started, store) + + want := map[string]state{} + checkEqualStoreState(t, want, backend.snapshot()) + }) + + t.Run("state is still alive", func(t *testing.T) { + started := time.Now() + const ttl = 60 * time.Second + + initState := map[string]state{ + "test::key": { + TTL: ttl, + Updated: started.Add(-ttl / 2), + }, + } + + backend := createSampleStore(t, initState) + store := testOpenStore(t, "test", backend) + defer store.Release() + + gcStore(logp.NewLogger("test"), started, store) + + checkEqualStoreState(t, initState, backend.snapshot()) + }) + + t.Run("old state can be removed", func(t *testing.T) { + const ttl = 60 * time.Second + started := time.Now().Add(-5 * ttl) // cleanup process is running for a while already + + initState := map[string]state{ + "test::key": { + TTL: ttl, + Updated: started.Add(-ttl), + }, + } + + backend := createSampleStore(t, initState) + store := testOpenStore(t, "test", backend) + defer store.Release() + + gcStore(logp.NewLogger("test"), started, store) + + want := map[string]state{} + checkEqualStoreState(t, want, backend.snapshot()) + }) + + t.Run("old state is not removed if cleanup is not active long enough", func(t *testing.T) { + const ttl = 60 * time.Minute + started := time.Now() + + initState := map[string]state{ + "test::key": { + TTL: ttl, + Updated: started.Add(-2 * ttl), + }, + } + + backend := createSampleStore(t, initState) + store := testOpenStore(t, "test", backend) + defer store.Release() + + gcStore(logp.NewLogger("test"), started, store) + + checkEqualStoreState(t, initState, backend.snapshot()) + }) + + t.Run("old state but resource is accessed", func(t *testing.T) { + const ttl = 60 * time.Second + started := time.Now().Add(-5 * ttl) // cleanup process is running for a while already + + initState := map[string]state{ + "test::key": { + TTL: ttl, + Updated: started.Add(-ttl), + }, + } + + backend := createSampleStore(t, initState) + store := testOpenStore(t, "test", backend) + defer store.Release() + + // access resource and check it is not gc'ed + res := store.Get("test::key") + gcStore(logp.NewLogger("test"), started, store) + checkEqualStoreState(t, initState, backend.snapshot()) + + // release resource and check it gets gc'ed + res.Release() + want := map[string]state{} + gcStore(logp.NewLogger("test"), started, store) + checkEqualStoreState(t, want, backend.snapshot()) + }) + + t.Run("old state but resource has pending updates", func(t *testing.T) { + const ttl = 60 * time.Second + started := time.Now().Add(-5 * ttl) // cleanup process is running for a while already + + initState := map[string]state{ + "test::key": { + TTL: ttl, + Updated: started.Add(-ttl), + }, + } + + backend := createSampleStore(t, initState) + store := testOpenStore(t, "test", backend) + defer store.Release() + + // create pending update operation + res := store.Get("test::key") + op, err := createUpdateOp(store, res, "test-state-update") + require.NoError(t, err) + res.Release() + + // cleanup fails + gcStore(logp.NewLogger("test"), started, store) + checkEqualStoreState(t, initState, backend.snapshot()) + + // cancel operation (no more pending operations) and try to gc again + op.done(1) + gcStore(logp.NewLogger("test"), started, store) + want := map[string]state{} + checkEqualStoreState(t, want, backend.snapshot()) + }) +} diff --git a/filebeat/input/filestream/internal/input-logfile/cursor.go b/filebeat/input/filestream/internal/input-logfile/cursor.go new file mode 100644 index 00000000000..37de24fe56c --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/cursor.go @@ -0,0 +1,43 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +// Cursor allows the input to check if cursor status has been stored +// in the past and unpack the status into a custom structure. +type Cursor struct { + store *store + resource *resource +} + +func makeCursor(store *store, res *resource) Cursor { + return Cursor{store: store, resource: res} +} + +// IsNew returns true if no cursor information has been stored +// for the current Source. +func (c Cursor) IsNew() bool { return c.resource.IsNew() } + +// Unpack deserialized the cursor state into to. Unpack fails if no pointer is +// given, or if the structure to points to is not compatible with the document +// stored. +func (c Cursor) Unpack(to interface{}) error { + if c.IsNew() { + return nil + } + return c.resource.UnpackCursor(to) +} diff --git a/filebeat/input/filestream/internal/input-logfile/cursor_test.go b/filebeat/input/filestream/internal/input-logfile/cursor_test.go new file mode 100644 index 00000000000..db2ff0c3a30 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/cursor_test.go @@ -0,0 +1,124 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +func TestCursor_IsNew(t *testing.T) { + t.Run("true if key is not in store", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + + cursor := makeCursor(store, store.Get("test::key")) + require.True(t, cursor.IsNew()) + }) + + t.Run("true if key is in store but without cursor value", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: nil}, + })) + defer store.Release() + + cursor := makeCursor(store, store.Get("test::key")) + require.True(t, cursor.IsNew()) + }) + + t.Run("false if key with cursor value is in persistent store", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: "test"}, + })) + defer store.Release() + + cursor := makeCursor(store, store.Get("test::key")) + require.False(t, cursor.IsNew()) + }) + + t.Run("false if key with cursor value is in memory store only", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: nil}, + })) + defer store.Release() + + res := store.Get("test::key") + op, err := createUpdateOp(store, res, "test-state-update") + require.NoError(t, err) + defer op.done(1) + + cursor := makeCursor(store, res) + require.False(t, cursor.IsNew()) + }) +} + +func TestCursor_Unpack(t *testing.T) { + t.Run("nothing to unpack if key is new", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + + var st string + cursor := makeCursor(store, store.Get("test::key")) + + require.NoError(t, cursor.Unpack(&st)) + require.Equal(t, "", st) + }) + + t.Run("unpack fails if types are not compatible", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: "test"}, + })) + defer store.Release() + + var st struct{ A uint } + cursor := makeCursor(store, store.Get("test::key")) + require.Error(t, cursor.Unpack(&st)) + }) + + t.Run("unpack from state in persistent store", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: "test"}, + })) + defer store.Release() + + var st string + cursor := makeCursor(store, store.Get("test::key")) + + require.NoError(t, cursor.Unpack(&st)) + require.Equal(t, "test", st) + }) + + t.Run("unpack from in memory state if updates are pending", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": {Cursor: "test"}, + })) + defer store.Release() + + res := store.Get("test::key") + op, err := createUpdateOp(store, res, "test-state-update") + require.NoError(t, err) + defer op.done(1) + + var st string + cursor := makeCursor(store, store.Get("test::key")) + + require.NoError(t, cursor.Unpack(&st)) + require.Equal(t, "test-state-update", st) + }) +} diff --git a/filebeat/input/filestream/internal/input-logfile/doc.go b/filebeat/input/filestream/internal/input-logfile/doc.go new file mode 100644 index 00000000000..cf318d4bfed --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/doc.go @@ -0,0 +1,58 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Package cursor provides an InputManager for use with the v2 API, that is +// capable of storing an internal cursor state between restarts. +// +// The InputManager requires authors to Implement a configuration function and +// the cursor.Input interface. The configuration function returns a slice of +// sources ([]Source) that it has read from the configuration object, and the +// actual Input that will be used to collect events from each configured +// source. +// When Run a go-routine will be started per configured source. If two inputs have +// configured the same source, only one will be active, while the other waits +// for the resource to become free. +// The manager keeps track of the state per source. When publishing an event a +// new cursor value can be passed as well. Future instance of the input can +// read the last published cursor state. +// +// For each source an in-memory and a persitent state are tracked. Internal +// meta updates by the input manager can not be read by Inputs, and will be +// written to the persistent store immediately. Cursor state updates are read +// and update by the input. Cursor updates are written to the persistent store +// only after the events have been ACKed by the output. Internally the input +// manager keeps track of already ACKed updates and pending ACKs. +// In order to guarantee progress even if the pbulishing is slow or blocked, all cursor +// updates are written to the in-memory state immediately. Source without any +// pending updates are in-sync (in-memory state == persistet state). All +// updates are ordered, but we allow the in-memory state to be ahead of the +// persistent state. +// When an input is started, the cursor state is read from the in-memory state. +// This way a new input instance can continue where other inputs have been +// stopped, even if we still have in-flight events from older input instances. +// The coordination between inputs guarantees that all updates are always in +// order. +// +// When a shutdown signal is received, the publisher is directly disconnected +// from the outputs. As all coordination is directly handled by the +// InputManager, shutdown will be immediate (once the input itself has +// returned), and can not be blocked by the outputs. +// +// An input that is about to collect a source that is already collected by +// another input will wait until the other input has returned or the current +// input did receive a shutdown signal. +package input_logfile diff --git a/filebeat/input/filestream/internal/input-logfile/fswatch.go b/filebeat/input/filestream/internal/input-logfile/fswatch.go new file mode 100644 index 00000000000..685b54253a4 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/fswatch.go @@ -0,0 +1,65 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "os" + + "github.com/elastic/go-concert/unison" +) + +const ( + OpDone Operation = iota + OpCreate + OpWrite + OpDelete + OpRename +) + +// Operation describes what happened to a file. +type Operation uint8 + +// FSEvent returns inforamation about file system changes. +type FSEvent struct { + // NewPath is the new path of the file. + NewPath string + // OldPath is the previous path to the file, is it was + // deleted or renamed. + OldPath string + // Op is the file system event: create, write, rename, remove + Op Operation + // Info describes the file in the event. + Info os.FileInfo +} + +// FSScanner retrieves a list of files from the file system. +type FSScanner interface { + // GetFiles returns the list of monitored files. + // The keys of the map are the paths to the files and + // the values are the FileInfos describing the file. + GetFiles() map[string]os.FileInfo +} + +// FSWatcher returns file events of the monitored files. +type FSWatcher interface { + // Run is the event loop which watchers for changes + // in the file system and returns events based on the data. + Run(unison.Canceler) + // Event returns the next event captured by FSWatcher. + Event() FSEvent +} diff --git a/filebeat/input/filestream/internal/input-logfile/harvester.go b/filebeat/input/filestream/internal/input-logfile/harvester.go new file mode 100644 index 00000000000..d2f184cac7b --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/harvester.go @@ -0,0 +1,125 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "context" + "fmt" + "runtime/debug" + "time" + + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/go-concert/ctxtool" + "github.com/elastic/go-concert/unison" +) + +// Harvester is the reader which collects the lines from +// the configured source. +type Harvester interface { + // Name returns the type of the Harvester + Name() string + // Test checks if the Harvester can be started with the given configuration. + Test(Source, input.TestContext) error + // Run is the event loop which reads from the source + // and forwards it to the publisher. + Run(input.Context, Source, Cursor, Publisher) error +} + +// HarvesterGroup is responsible for running the +// Harvesters started by the Prospector. +type HarvesterGroup struct { + manager *InputManager + readers map[string]context.CancelFunc + pipeline beat.PipelineConnector + harvester Harvester + cleanTimeout time.Duration + store *store + tg unison.TaskGroup +} + +// Run starts the Harvester for a Source. +func (hg *HarvesterGroup) Run(ctx input.Context, s Source) error { + log := ctx.Logger.With("source", s.Name()) + log.Debug("Starting harvester for file") + + harvesterCtx, cancelHarvester := context.WithCancel(ctxtool.FromCanceller(ctx.Cancelation)) + ctx.Cancelation = harvesterCtx + + resource, err := hg.manager.lock(ctx, s.Name()) + if err != nil { + cancelHarvester() + return err + } + + if _, ok := hg.readers[s.Name()]; ok { + cancelHarvester() + log.Debug("A harvester is already running for file") + return nil + } + hg.readers[s.Name()] = cancelHarvester + + hg.store.UpdateTTL(resource, hg.cleanTimeout) + + client, err := hg.pipeline.ConnectWith(beat.ClientConfig{ + CloseRef: ctx.Cancelation, + ACKHandler: newInputACKHandler(ctx.Logger), + }) + if err != nil { + cancelHarvester() + return err + } + + cursor := makeCursor(hg.store, resource) + publisher := &cursorPublisher{canceler: ctx.Cancelation, client: client, cursor: &cursor} + + go func(cancel context.CancelFunc) { + defer client.Close() + defer log.Debug("Stopped harvester for file") + defer cancel() + defer releaseResource(resource) + defer delete(hg.readers, s.Name()) + + defer func() { + if v := recover(); v != nil { + err := fmt.Errorf("harvester panic with: %+v\n%s", v, debug.Stack()) + ctx.Logger.Errorf("Harvester crashed with: %+v", err) + } + }() + + err := hg.harvester.Run(ctx, s, cursor, publisher) + if err != nil { + log.Errorf("Harvester stopped: %v", err) + } + }(cancelHarvester) + return nil +} + +// Cancel stops the running Harvester for a given Source. +func (hg *HarvesterGroup) Cancel(s Source) error { + if cancel, ok := hg.readers[s.Name()]; ok { + cancel() + return nil + } + return fmt.Errorf("no such harvester %s", s.Name()) +} + +func releaseResource(resource *resource) { + resource.lock.Unlock() + resource.Release() +} diff --git a/filebeat/input/filestream/internal/input-logfile/input.go b/filebeat/input/filestream/internal/input-logfile/input.go new file mode 100644 index 00000000000..7084315b0c1 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/input.go @@ -0,0 +1,106 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "context" + "time" + + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common/acker" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/go-concert/ctxtool" + "github.com/elastic/go-concert/unison" +) + +type managedInput struct { + manager *InputManager + prospector Prospector + harvester Harvester + cleanTimeout time.Duration +} + +// Name is required to implement the v2.Input interface +func (inp *managedInput) Name() string { return inp.harvester.Name() } + +// Test runs the Test method for each configured source. +func (inp *managedInput) Test(ctx input.TestContext) error { + return inp.prospector.Test() +} + +// Run +func (inp *managedInput) Run( + ctx input.Context, + pipeline beat.PipelineConnector, +) (err error) { + // Setup cancellation using a custom cancel context. All workers will be + // stopped if one failed badly by returning an error. + cancelCtx, cancel := context.WithCancel(ctxtool.FromCanceller(ctx.Cancelation)) + defer cancel() + ctx.Cancelation = cancelCtx + + store := inp.manager.store + store.Retain() + defer store.Release() + + hg := &HarvesterGroup{ + pipeline: pipeline, + readers: make(map[string]context.CancelFunc), + manager: inp.manager, + cleanTimeout: inp.cleanTimeout, + harvester: inp.harvester, + store: store, + tg: unison.TaskGroup{}, + } + + stateStore, err := inp.manager.StateStore.Access() + if err != nil { + return err + } + defer stateStore.Close() + + inp.prospector.Run(ctx, stateStore, hg) + + return nil +} + +func newInputACKHandler(log *logp.Logger) beat.ACKer { + return acker.EventPrivateReporter(func(acked int, private []interface{}) { + var n uint + var last int + for i := 0; i < len(private); i++ { + current := private[i] + if current == nil { + continue + } + + if _, ok := current.(*updateOp); !ok { + continue + } + + n++ + last = i + } + + if n == 0 { + return + } + private[last].(*updateOp).Execute(n) + }) +} diff --git a/filebeat/input/filestream/internal/input-logfile/manager.go b/filebeat/input/filestream/internal/input-logfile/manager.go new file mode 100644 index 00000000000..db3c600d2bc --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/manager.go @@ -0,0 +1,199 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "errors" + "sync" + "time" + + "github.com/urso/sderr" + + "github.com/elastic/go-concert/unison" + + input "github.com/elastic/beats/v7/filebeat/input/v2" + v2 "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/statestore" +) + +// InputManager is used to create, manage, and coordinate stateful inputs and +// their persistent state. +// The InputManager ensures that only one input can be active for a unique source. +// If two inputs have overlapping sources, both can still collect data, but +// only one input will collect from the common source. +// +// The InputManager automatically cleans up old entries without an active +// input, and without any pending update operations for the persistent store. +// +// The Type field is used to create the key name in the persistent store. Users +// are allowed to add a custome per input configuration ID using the `id` +// setting, to collect the same source multiple times, but with different +// state. The key name in the persistent store becomes -[]- +type InputManager struct { + Logger *logp.Logger + + // StateStore gives the InputManager access to the persitent key value store. + StateStore StateStore + + // Type must contain the name of the input type. It is used to create the key name + // for all sources the inputs collect from. + Type string + + // DefaultCleanTimeout configures the key/value garbage collection interval. + // The InputManager will only collect keys for the configured 'Type' + DefaultCleanTimeout time.Duration + + // Configure returns an array of Sources, and a configured Input instances + // that will be used to collect events from each source. + Configure func(cfg *common.Config) (Prospector, Harvester, error) + + initOnce sync.Once + initErr error + store *store +} + +// Source describe a source the input can collect data from. +// The `Name` method must return an unique name, that will be used to identify +// the source in the persistent state store. +type Source interface { + Name() string +} + +var errNoSourceConfigured = errors.New("no source has been configured") +var errNoInputRunner = errors.New("no input runner available") + +// StateStore interface and configurations used to give the Manager access to the persistent store. +type StateStore interface { + Access() (*statestore.Store, error) + CleanupInterval() time.Duration +} + +func (cim *InputManager) init() error { + cim.initOnce.Do(func() { + if cim.DefaultCleanTimeout <= 0 { + cim.DefaultCleanTimeout = 30 * time.Minute + } + + log := cim.Logger.With("input_type", cim.Type) + var store *store + store, cim.initErr = openStore(log, cim.StateStore, cim.Type) + if cim.initErr != nil { + return + } + + cim.store = store + }) + + return cim.initErr +} + +// Init starts background processes for deleting old entries from the +// persistent store if mode is ModeRun. +func (cim *InputManager) Init(group unison.Group, mode v2.Mode) error { + if mode != v2.ModeRun { + return nil + } + + if err := cim.init(); err != nil { + return err + } + + log := cim.Logger.With("input_type", cim.Type) + + store := cim.store + cleaner := &cleaner{log: log} + store.Retain() + err := group.Go(func(canceler unison.Canceler) error { + defer cim.shutdown() + defer store.Release() + interval := cim.StateStore.CleanupInterval() + if interval <= 0 { + interval = 5 * time.Minute + } + cleaner.run(canceler, store, interval) + return nil + }) + if err != nil { + store.Release() + cim.shutdown() + return sderr.Wrap(err, "Can not start registry cleanup process") + } + + return nil +} + +func (cim *InputManager) shutdown() { + cim.store.Release() +} + +// Create builds a new v2.Input using the provided Configure function. +// The Input will run a go-routine per source that has been configured. +func (cim *InputManager) Create(config *common.Config) (input.Input, error) { + if err := cim.init(); err != nil { + return nil, err + } + + settings := struct { + ID string `config:"id"` + CleanTimeout time.Duration `config:"clean_timeout"` + }{ID: "", CleanTimeout: cim.DefaultCleanTimeout} + if err := config.Unpack(&settings); err != nil { + return nil, err + } + + prospector, harvester, err := cim.Configure(config) + if err != nil { + return nil, err + } + if harvester == nil { + return nil, errNoInputRunner + } + + return &managedInput{ + manager: cim, + prospector: prospector, + harvester: harvester, + cleanTimeout: settings.CleanTimeout, + }, nil +} + +// Lock locks a key for exclusive access and returns an resource that can be used to modify +// the cursor state and unlock the key. +func (cim *InputManager) lock(ctx input.Context, key string) (*resource, error) { + resource := cim.store.Get(key) + err := lockResource(ctx.Logger, resource, ctx.Cancelation) + if err != nil { + resource.Release() + return nil, err + } + return resource, nil +} + +func lockResource(log *logp.Logger, resource *resource, canceler input.Canceler) error { + if !resource.lock.TryLock() { + log.Infof("Resource '%v' currently in use, waiting...", resource.key) + err := resource.lock.LockContext(canceler) + if err != nil { + log.Infof("Input for resource '%v' has been stopped while waiting", resource.key) + return err + } + } + return nil +} diff --git a/filebeat/input/filestream/internal/input-logfile/prospector.go b/filebeat/input/filestream/internal/input-logfile/prospector.go new file mode 100644 index 00000000000..9488596eb2c --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/prospector.go @@ -0,0 +1,35 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/statestore" +) + +// Prospector is responsible for starting, stopping harvesters +// based on the retrieved information about the configured paths. +// It also updates the statestore with the meta data of the running harvesters. +type Prospector interface { + // Run starts the event loop and handles the incoming events + // either by starting/stopping a harvester, or updating the statestore. + Run(input.Context, *statestore.Store, *HarvesterGroup) + // Test checks if the Prospector is able to run the configuration + // specified by the user. + Test() error +} diff --git a/filebeat/input/filestream/internal/input-logfile/publish.go b/filebeat/input/filestream/internal/input-logfile/publish.go new file mode 100644 index 00000000000..547a82c479f --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/publish.go @@ -0,0 +1,153 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "time" + + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common/transform/typeconv" + "github.com/elastic/beats/v7/libbeat/statestore" +) + +// Publisher is used to publish an event and update the cursor in a single call to Publish. +// Inputs are allowed to pass `nil` as cursor state. In this case the state is not updated, but the +// event will still be published as is. +type Publisher interface { + Publish(event beat.Event, cursor interface{}) error +} + +// cursorPublisher implements the Publisher interface and used internally by the managedInput. +// When publishing an event with cursor state updates, the cursorPublisher +// updates the in memory state and create an updateOp that is used to schedule +// an update for the persistent store. The updateOp is run by the inputs ACK +// handler, persisting the pending update. +type cursorPublisher struct { + canceler input.Canceler + client beat.Client + cursor *Cursor +} + +// updateOp keeps track of pending updates that are not written to the persistent store yet. +// Update operations are ordered. The input manager guarantees that only one +// input can create update operation for a source, such that new input +// instances can add update operations to be executed after already pending +// update operations from older inputs instances that have been shutdown. +type updateOp struct { + store *store + resource *resource + + // state updates to persist + timestamp time.Time + ttl time.Duration + delta interface{} +} + +// Publish publishes an event. Publish returns false if the inputs cancellation context has been marked as done. +// If cursorUpdate is not nil, Publish updates the in memory state and create and updateOp for the pending update. +// It overwrite event.Private with the update operation, before finally sending the event. +// The ACK ordering in the publisher pipeline guarantees that update operations +// will be ACKed and executed in the correct order. +func (c *cursorPublisher) Publish(event beat.Event, cursorUpdate interface{}) error { + if cursorUpdate == nil { + return c.forward(event) + } + + op, err := createUpdateOp(c.cursor.store, c.cursor.resource, cursorUpdate) + if err != nil { + return err + } + + event.Private = op + return c.forward(event) +} + +func (c *cursorPublisher) forward(event beat.Event) error { + c.client.Publish(event) + if c.canceler == nil { + return nil + } + return c.canceler.Err() +} + +func createUpdateOp(store *store, resource *resource, updates interface{}) (*updateOp, error) { + ts := time.Now() + + resource.stateMutex.Lock() + defer resource.stateMutex.Unlock() + + cursor := resource.pendingCursor + if resource.activeCursorOperations == 0 { + var tmp interface{} + typeconv.Convert(&tmp, cursor) + resource.pendingCursor = tmp + cursor = tmp + } + if err := typeconv.Convert(&cursor, updates); err != nil { + return nil, err + } + resource.pendingCursor = cursor + + resource.Retain() + resource.activeCursorOperations++ + return &updateOp{ + resource: resource, + store: store, + timestamp: ts, + delta: updates, + }, nil +} + +// done releases resources held by the last N updateOps. +func (op *updateOp) done(n uint) { + op.resource.UpdatesReleaseN(n) + op.resource = nil + *op = updateOp{} +} + +// Execute updates the persistent store with the scheduled changes and releases the resource. +func (op *updateOp) Execute(n uint) { + resource := op.resource + defer op.done(n) + + resource.stateMutex.Lock() + defer resource.stateMutex.Unlock() + + resource.activeCursorOperations -= n + if resource.activeCursorOperations == 0 { + resource.cursor = resource.pendingCursor + resource.pendingCursor = nil + } else { + typeconv.Convert(&resource.cursor, op.delta) + } + + if resource.internalState.Updated.Before(op.timestamp) { + resource.internalState.Updated = op.timestamp + } + + err := op.store.persistentStore.Set(resource.key, resource.inSyncStateSnapshot()) + if err != nil { + if !statestore.IsClosed(err) { + op.store.log.Errorf("Failed to update state in the registry for '%v'", resource.key) + } + } else { + resource.internalInSync = true + resource.stored = true + } +} diff --git a/filebeat/input/filestream/internal/input-logfile/publish_test.go b/filebeat/input/filestream/internal/input-logfile/publish_test.go new file mode 100644 index 00000000000..ede25670a95 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/publish_test.go @@ -0,0 +1,158 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "context" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/beat" + pubtest "github.com/elastic/beats/v7/libbeat/publisher/testing" +) + +func TestPublish(t *testing.T) { + t.Run("event with cursor state creates update operation", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + cursor := makeCursor(store, store.Get("test::key")) + + var actual beat.Event + client := &pubtest.FakeClient{ + PublishFunc: func(event beat.Event) { actual = event }, + } + publisher := cursorPublisher{nil, client, &cursor} + publisher.Publish(beat.Event{}, "test") + + require.NotNil(t, actual.Private) + }) + + t.Run("event without cursor creates no update operation", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + cursor := makeCursor(store, store.Get("test::key")) + + var actual beat.Event + client := &pubtest.FakeClient{ + PublishFunc: func(event beat.Event) { actual = event }, + } + publisher := cursorPublisher{nil, client, &cursor} + publisher.Publish(beat.Event{}, nil) + require.Nil(t, actual.Private) + }) + + t.Run("publish returns error if context has been cancelled", func(t *testing.T) { + ctx, cancel := context.WithCancel(context.TODO()) + cancel() + + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + cursor := makeCursor(store, store.Get("test::key")) + + publisher := cursorPublisher{ctx, &pubtest.FakeClient{}, &cursor} + err := publisher.Publish(beat.Event{}, nil) + require.Equal(t, context.Canceled, err) + }) +} + +func TestOp_Execute(t *testing.T) { + t.Run("applying final op marks the key as finished", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + res := store.Get("test::key") + + // create op and release resource. The 'resource' must still be active + op := mustCreateUpdateOp(t, store, res, "test-updated-cursor-state") + res.Release() + require.False(t, res.Finished()) + + // this was the last op, the resource should become inactive + op.Execute(1) + require.True(t, res.Finished()) + + // validate state: + inSyncCursor := storeInSyncSnapshot(store)["test::key"].Cursor + inMemCursor := storeMemorySnapshot(store)["test::key"].Cursor + want := "test-updated-cursor-state" + assert.Equal(t, want, inSyncCursor) + assert.Equal(t, want, inMemCursor) + }) + + t.Run("acking multiple ops applies the latest update and marks key as finished", func(t *testing.T) { + // when acking N events, intermediate updates are dropped in favor of the latest update operation. + // This test checks that the resource is correctly marked as finished. + + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + res := store.Get("test::key") + + // create update operations and release resource. The 'resource' must still be active + mustCreateUpdateOp(t, store, res, "test-updated-cursor-state-dropped") + op := mustCreateUpdateOp(t, store, res, "test-updated-cursor-state-final") + res.Release() + require.False(t, res.Finished()) + + // this was the last op, the resource should become inactive + op.Execute(2) + require.True(t, res.Finished()) + + // validate state: + inSyncCursor := storeInSyncSnapshot(store)["test::key"].Cursor + inMemCursor := storeMemorySnapshot(store)["test::key"].Cursor + want := "test-updated-cursor-state-final" + assert.Equal(t, want, inSyncCursor) + assert.Equal(t, want, inMemCursor) + }) + + t.Run("ACK only subset of pending ops will only update up to ACKed state", func(t *testing.T) { + // when acking N events, intermediate updates are dropped in favor of the latest update operation. + // This test checks that the resource is correctly marked as finished. + + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + res := store.Get("test::key") + + // create update operations and release resource. The 'resource' must still be active + op1 := mustCreateUpdateOp(t, store, res, "test-updated-cursor-state-intermediate") + op2 := mustCreateUpdateOp(t, store, res, "test-updated-cursor-state-final") + res.Release() + require.False(t, res.Finished()) + + defer op2.done(1) // cleanup after test + + // this was the intermediate op, the resource should still be active + op1.Execute(1) + require.False(t, res.Finished()) + + // validate state (in memory state is always up to data to most recent update): + inSyncCursor := storeInSyncSnapshot(store)["test::key"].Cursor + inMemCursor := storeMemorySnapshot(store)["test::key"].Cursor + assert.Equal(t, "test-updated-cursor-state-intermediate", inSyncCursor) + assert.Equal(t, "test-updated-cursor-state-final", inMemCursor) + }) +} + +func mustCreateUpdateOp(t *testing.T, store *store, resource *resource, updates interface{}) *updateOp { + op, err := createUpdateOp(store, resource, updates) + if err != nil { + t.Fatalf("Failed to create update op: %v", err) + } + return op +} diff --git a/filebeat/input/filestream/internal/input-logfile/store.go b/filebeat/input/filestream/internal/input-logfile/store.go new file mode 100644 index 00000000000..8267565f551 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/store.go @@ -0,0 +1,324 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "strings" + "sync" + "time" + + "github.com/elastic/beats/v7/libbeat/common/atomic" + "github.com/elastic/beats/v7/libbeat/common/cleanup" + "github.com/elastic/beats/v7/libbeat/common/transform/typeconv" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/statestore" + "github.com/elastic/go-concert" + "github.com/elastic/go-concert/unison" +) + +// store encapsulates the persistent store and the in memory state store, that +// can be ahead of the the persistent store. +// The store lifetime is managed by a reference counter. Once all owners (the +// session, and the resource cleaner) have dropped ownership, backing resources +// will be released and closed. +type store struct { + log *logp.Logger + refCount concert.RefCount + persistentStore *statestore.Store + ephemeralStore *states +} + +// states stores resource states in memory. When a cursor for an input is updated, +// it's state is updated first. The entry in the persistent store 'follows' the internal state. +// As long as a resources stored in states is not 'Finished', the in memory +// store is assumed to be ahead (in memory and persistent state are out of +// sync). +type states struct { + mu sync.Mutex + table map[string]*resource +} + +// resource holds the in memory state and keeps track of pending updates and inputs collecting +// event for the resource its key. +// A resource is assumed active for as long as at least one input has (or tries +// to) acuired the lock, and as long as there are pending updateOp instances in +// the pipeline not ACKed yet. The key can not gc'ed by the cleaner, as long as the resource is active. +// +// State chagnes and writes to the persistent store are protected using the +// stateMutex, to ensure full consistency between direct writes and updates +// after ACK. +type resource struct { + // pending counts the number of Inputs and outstanding registry updates. + // as long as pending is > 0 the resource is in used and must not be garbage collected. + pending atomic.Uint64 + + // lock guarantees only one input create updates for this entry + lock unison.Mutex + + // key of the resource as used for the registry. + key string + + // stateMutex is used to lock the resource when it is update/read from + // multiple go-routines like the ACK handler or the input publishing an + // event. + // stateMutex is used to access the fields 'stored', 'state' and 'internalInSync' + stateMutex sync.Mutex + + // stored indicates that the state is available in the registry file. It is false for new entries. + stored bool + + // internalInSync is true if all 'Internal' metadata like TTL or update timestamp are in sync. + // Normally resources are added when being created. But if operations failed we will retry inserting + // them on each update operation until we eventually succeeded + internalInSync bool + + activeCursorOperations uint + internalState stateInternal + + // cursor states. The cursor holds the state as it is currently known to the + // persistent store, while pendingCursor contains the most recent update + // (in-memory state), that still needs to be synced to the persistent store. + // The pendingCursor is nil if there are no pending updates. + // When processing update operations on ACKs, the state is applied to cursor + // first, which is finally written to the persistent store. This ensures that + // we always write the complete state of the key/value pair. + cursor interface{} + pendingCursor interface{} +} + +type ( + // state represents the full document as it is stored in the registry. + // + // The TTL and Update fields are for internal use only. + // + // The `Cursor` namespace is used to store the cursor information that are + // required to continue processing from the last known position. Cursor + // updates in the registry file are only executed after events have been + // ACKed by the outputs. Therefore the cursor MUST NOT include any + // information that are require to identify/track the source we are + // collecting from. + state struct { + TTL time.Duration + Updated time.Time + Cursor interface{} + } + + stateInternal struct { + TTL time.Duration + Updated time.Time + } +) + +// hook into store close for testing purposes +var closeStore = (*store).close + +func openStore(log *logp.Logger, statestore StateStore, prefix string) (*store, error) { + ok := false + + persistentStore, err := statestore.Access() + if err != nil { + return nil, err + } + defer cleanup.IfNot(&ok, func() { persistentStore.Close() }) + + states, err := readStates(log, persistentStore, prefix) + if err != nil { + return nil, err + } + + ok = true + return &store{ + log: log, + persistentStore: persistentStore, + ephemeralStore: states, + }, nil +} + +func (s *store) Retain() { s.refCount.Retain() } +func (s *store) Release() { + if s.refCount.Release() { + closeStore(s) + } +} + +func (s *store) close() { + if err := s.persistentStore.Close(); err != nil { + s.log.Errorf("Closing registry store did report an error: %+v", err) + } +} + +// Get returns the resource for the key. +// A new shared resource is generated if the key is not known. The generated +// resource is not synced to disk yet. +func (s *store) Get(key string) *resource { + return s.ephemeralStore.Find(key, true) +} + +// UpdateTTL updates the time-to-live of a resource. Inactive resources with expired TTL are subject to removal. +// The TTL value is part of the internal state, and will be written immediately to the persistent store. +// On update the resource its `cursor` state is used, to keep the cursor state in sync with the current known +// on disk store state. +func (s *store) UpdateTTL(resource *resource, ttl time.Duration) { + resource.stateMutex.Lock() + defer resource.stateMutex.Unlock() + if resource.stored && resource.internalState.TTL == ttl { + return + } + + resource.internalState.TTL = ttl + if resource.internalState.Updated.IsZero() { + resource.internalState.Updated = time.Now() + } + + err := s.persistentStore.Set(resource.key, state{ + TTL: resource.internalState.TTL, + Updated: resource.internalState.Updated, + Cursor: resource.cursor, + }) + if err != nil { + s.log.Errorf("Failed to update resource management fields for '%v'", resource.key) + resource.internalInSync = false + } else { + resource.stored = true + resource.internalInSync = true + } +} + +// Find returns the resource for a given key. If the key is unknown and create is set to false nil will be returned. +// The resource returned by Find is marked as active. (*resource).Release must be called to mark the resource as inactive again. +func (s *states) Find(key string, create bool) *resource { + s.mu.Lock() + defer s.mu.Unlock() + + if resource := s.table[key]; resource != nil { + resource.Retain() + return resource + } + + if !create { + return nil + } + + // resource is owned by table(session) and input that uses the resource. + resource := &resource{ + stored: false, + key: key, + lock: unison.MakeMutex(), + } + s.table[key] = resource + resource.Retain() + return resource +} + +// IsNew returns true if we have no state recorded for the current resource. +func (r *resource) IsNew() bool { + r.stateMutex.Lock() + defer r.stateMutex.Unlock() + return r.pendingCursor == nil && r.cursor == nil +} + +// Retain is used to indicate that 'resource' gets an additional 'owner'. +// Owners of an resource can be active inputs or pending update operations +// not yet written to disk. +func (r *resource) Retain() { r.pending.Inc() } + +// Release reduced the owner ship counter of the resource. +func (r *resource) Release() { r.pending.Dec() } + +// UpdatesReleaseN is used to release ownership of N pending update operations. +func (r *resource) UpdatesReleaseN(n uint) { + r.pending.Sub(uint64(n)) +} + +// Finished returns true if the resource is not in use and if there are no pending updates +// that still need to be written to the registry. +func (r *resource) Finished() bool { return r.pending.Load() == 0 } + +// UnpackCursor deserializes the in memory state. +func (r *resource) UnpackCursor(to interface{}) error { + r.stateMutex.Lock() + defer r.stateMutex.Unlock() + if r.activeCursorOperations == 0 { + return typeconv.Convert(to, r.cursor) + } + return typeconv.Convert(to, r.pendingCursor) +} + +// syncStateSnapshot returns the current insync state based on already ACKed update operations. +func (r *resource) inSyncStateSnapshot() state { + return state{ + TTL: r.internalState.TTL, + Updated: r.internalState.Updated, + Cursor: r.cursor, + } +} + +// stateSnapshot returns the current in memory state, that already contains state updates +// not yet ACKed. +func (r *resource) stateSnapshot() state { + cursor := r.pendingCursor + if r.activeCursorOperations == 0 { + cursor = r.cursor + } + + return state{ + TTL: r.internalState.TTL, + Updated: r.internalState.Updated, + Cursor: cursor, + } +} + +func readStates(log *logp.Logger, store *statestore.Store, prefix string) (*states, error) { + keyPrefix := prefix + "::" + states := &states{ + table: map[string]*resource{}, + } + + err := store.Each(func(key string, dec statestore.ValueDecoder) (bool, error) { + if !strings.HasPrefix(string(key), keyPrefix) { + return true, nil + } + + var st state + if err := dec.Decode(&st); err != nil { + log.Errorf("Failed to read regisry state for '%v', cursor state will be ignored. Error was: %+v", + key, err) + return true, nil + } + + resource := &resource{ + key: key, + stored: true, + lock: unison.MakeMutex(), + internalInSync: true, + internalState: stateInternal{ + TTL: st.TTL, + Updated: st.Updated, + }, + cursor: st.Cursor, + } + states.table[resource.key] = resource + + return true, nil + }) + + if err != nil { + return nil, err + } + return states, nil +} diff --git a/filebeat/input/filestream/internal/input-logfile/store_test.go b/filebeat/input/filestream/internal/input-logfile/store_test.go new file mode 100644 index 00000000000..71ea41298b2 --- /dev/null +++ b/filebeat/input/filestream/internal/input-logfile/store_test.go @@ -0,0 +1,351 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package input_logfile + +import ( + "errors" + "testing" + "time" + + "github.com/google/go-cmp/cmp" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/statestore" + "github.com/elastic/beats/v7/libbeat/statestore/storetest" +) + +type testStateStore struct { + Store *statestore.Store + GCPeriod time.Duration +} + +func TestStore_OpenClose(t *testing.T) { + t.Run("releasing store closes", func(t *testing.T) { + var closed bool + cleanup := closeStoreWith(func(s *store) { + closed = true + s.close() + }) + defer cleanup() + + store := testOpenStore(t, "test", nil) + store.Release() + + require.True(t, closed) + }) + + t.Run("fail if persistent store can not be accessed", func(t *testing.T) { + _, err := openStore(logp.NewLogger("test"), testStateStore{}, "test") + require.Error(t, err) + }) + + t.Run("load from empty", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + require.Equal(t, 0, len(storeMemorySnapshot(store))) + require.Equal(t, 0, len(storeInSyncSnapshot(store))) + }) + + t.Run("already available state is loaded", func(t *testing.T) { + states := map[string]state{ + "test::key0": {Cursor: "1"}, + "test::key1": {Cursor: "2"}, + } + + store := testOpenStore(t, "test", createSampleStore(t, states)) + defer store.Release() + + checkEqualStoreState(t, states, storeMemorySnapshot(store)) + checkEqualStoreState(t, states, storeInSyncSnapshot(store)) + }) + + t.Run("ignore entries with wrong index on open", func(t *testing.T) { + states := map[string]state{ + "test::key0": {Cursor: "1"}, + "other::key": {Cursor: "2"}, + } + + store := testOpenStore(t, "test", createSampleStore(t, states)) + defer store.Release() + + want := map[string]state{ + "test::key0": {Cursor: "1"}, + } + checkEqualStoreState(t, want, storeMemorySnapshot(store)) + checkEqualStoreState(t, want, storeInSyncSnapshot(store)) + }) +} + +func TestStore_Get(t *testing.T) { + t.Run("find existing resource", func(t *testing.T) { + cursorState := state{Cursor: "1"} + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key0": cursorState, + })) + defer store.Release() + + res := store.Get("test::key0") + require.NotNil(t, res) + defer res.Release() + + // check in memory state matches matches original persistent state + require.Equal(t, cursorState, res.stateSnapshot()) + // check assumed in-sync state matches matches original persistent state + require.Equal(t, cursorState, res.inSyncStateSnapshot()) + }) + + t.Run("access unknown resource", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + + res := store.Get("test::key") + require.NotNil(t, res) + defer res.Release() + + // new resource has empty state + require.Equal(t, state{}, res.stateSnapshot()) + }) + + t.Run("same resource is returned", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + + res1 := store.Get("test::key") + require.NotNil(t, res1) + defer res1.Release() + + res2 := store.Get("test::key") + require.NotNil(t, res2) + defer res2.Release() + + assert.Equal(t, res1, res2) + }) +} + +func TestStore_UpdateTTL(t *testing.T) { + t.Run("add TTL for new entry to store", func(t *testing.T) { + // when creating a resource we set the TTL and insert a new key value pair without cursor value into the store: + store := testOpenStore(t, "test", createSampleStore(t, nil)) + defer store.Release() + + res := store.Get("test::key") + store.UpdateTTL(res, 60*time.Second) + + want := map[string]state{ + "test::key": { + TTL: 60 * time.Second, + Updated: res.internalState.Updated, + Cursor: nil, + }, + } + + checkEqualStoreState(t, want, storeMemorySnapshot(store)) + checkEqualStoreState(t, want, storeInSyncSnapshot(store)) + }) + + t.Run("update TTL for in-sync resource does not overwrite state", func(t *testing.T) { + store := testOpenStore(t, "test", createSampleStore(t, map[string]state{ + "test::key": { + TTL: 1 * time.Second, + Cursor: "test", + }, + })) + defer store.Release() + + res := store.Get("test::key") + store.UpdateTTL(res, 60*time.Second) + want := map[string]state{ + "test::key": { + Updated: res.internalState.Updated, + TTL: 60 * time.Second, + Cursor: "test", + }, + } + + checkEqualStoreState(t, want, storeMemorySnapshot(store)) + checkEqualStoreState(t, want, storeInSyncSnapshot(store)) + }) + + t.Run("update TTL for resource with pending updates", func(t *testing.T) { + // This test updates the resource TTL while update operations are still + // pending, but not synced to the persistent store yet. + // UpdateTTL changes the state in the persistent store immediately, and must therefore + // serialize the old in-sync state with update meta-data. + + // create store + backend := createSampleStore(t, map[string]state{ + "test::key": { + TTL: 1 * time.Second, + Cursor: "test", + }, + }) + store := testOpenStore(t, "test", backend) + defer store.Release() + + // create pending update operation + res := store.Get("test::key") + op, err := createUpdateOp(store, res, "test-state-update") + require.NoError(t, err) + defer op.done(1) + + // Update key/value pair TTL. This will update the internal state in the + // persistent store only, not modifying the old cursor state yet. + store.UpdateTTL(res, 60*time.Second) + + // validate + wantMemoryState := state{ + Updated: res.internalState.Updated, + TTL: 60 * time.Second, + Cursor: "test-state-update", + } + wantInSyncState := state{ + Updated: res.internalState.Updated, + TTL: 60 * time.Second, + Cursor: "test", + } + + checkEqualStoreState(t, map[string]state{"test::key": wantMemoryState}, storeMemorySnapshot(store)) + checkEqualStoreState(t, map[string]state{"test::key": wantInSyncState}, storeInSyncSnapshot(store)) + checkEqualStoreState(t, map[string]state{"test::key": wantInSyncState}, backend.snapshot()) + }) +} + +func closeStoreWith(fn func(s *store)) func() { + old := closeStore + closeStore = fn + return func() { + closeStore = old + } +} + +func testOpenStore(t *testing.T, prefix string, persistentStore StateStore) *store { + if persistentStore == nil { + persistentStore = createSampleStore(t, nil) + } + + store, err := openStore(logp.NewLogger("test"), persistentStore, prefix) + if err != nil { + t.Fatalf("failed to open the store") + } + return store +} + +func createSampleStore(t *testing.T, data map[string]state) testStateStore { + storeReg := statestore.NewRegistry(storetest.NewMemoryStoreBackend()) + store, err := storeReg.Get("test") + if err != nil { + t.Fatalf("Failed to access store: %v", err) + } + + for k, v := range data { + if err := store.Set(k, v); err != nil { + t.Fatalf("Error when populating the sample store: %v", err) + } + } + + return testStateStore{ + Store: store, + } +} + +func (ts testStateStore) WithGCPeriod(d time.Duration) testStateStore { ts.GCPeriod = d; return ts } +func (ts testStateStore) CleanupInterval() time.Duration { return ts.GCPeriod } +func (ts testStateStore) Access() (*statestore.Store, error) { + if ts.Store == nil { + return nil, errors.New("no store configured") + } + return ts.Store, nil +} + +// snapshot copies all key/value pairs from the persistent store into a table for inspection. +func (ts testStateStore) snapshot() map[string]state { + states := map[string]state{} + err := ts.Store.Each(func(key string, dec statestore.ValueDecoder) (bool, error) { + var st state + if err := dec.Decode(&st); err != nil { + return false, err + } + states[key] = st + return true, nil + }) + + if err != nil { + panic("unexpected decode error from persistent test store") + } + return states +} + +// storeMemorySnapshot copies all key/value pairs into a table for inspection. +// The state returned reflects the in memory state, which can be ahead of the +// persistent state. +// +// Note: The state returned by storeMemorySnapshot is always ahead of the state returned by storeInSyncSnapshot. +// All key value pairs are fully in-sync, if both snapshot functions return the same state. +func storeMemorySnapshot(store *store) map[string]state { + store.ephemeralStore.mu.Lock() + defer store.ephemeralStore.mu.Unlock() + + states := map[string]state{} + for k, res := range store.ephemeralStore.table { + states[k] = res.stateSnapshot() + } + return states +} + +// storeInSyncSnapshot copies all key/value pairs into the table for inspection. +// The state returned reflects the current state that the in-memory tables assumed to be +// written to the persistent store already. + +// Note: The state returned by storeMemorySnapshot is always ahead of the state returned by storeInSyncSnapshot. +// All key value pairs are fully in-sync, if both snapshot functions return the same state. +func storeInSyncSnapshot(store *store) map[string]state { + store.ephemeralStore.mu.Lock() + defer store.ephemeralStore.mu.Unlock() + + states := map[string]state{} + for k, res := range store.ephemeralStore.table { + states[k] = res.inSyncStateSnapshot() + } + return states +} + +// checkEqualStoreState compares 2 store snapshot tables for equality. The test +// fails with Errorf if the state differ. +// +// Note: testify is too strict when comparing timestamp, better use checkEqualStoreState. +func checkEqualStoreState(t *testing.T, want, got map[string]state) bool { + if d := cmp.Diff(want, got); d != "" { + t.Errorf("store state mismatch (-want +got):\n%s", d) + return false + } + return true +} + +// requireEqualStoreState compares 2 store snapshot tables for equality. The test +// fails with Fatalf if the state differ. +// +// Note: testify is too strict when comparing timestamp, better use checkEqualStoreState. +func requireEqualStoreState(t *testing.T, want, got map[string]state) bool { + if d := cmp.Diff(want, got); d != "" { + t.Fatalf("store state mismatch (-want +got):\n%s", d) + return false + } + return true +} diff --git a/filebeat/input/filestream/prospector.go b/filebeat/input/filestream/prospector.go new file mode 100644 index 00000000000..257574b9ca1 --- /dev/null +++ b/filebeat/input/filestream/prospector.go @@ -0,0 +1,38 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/statestore" +) + +// fileProspector implements the Prospector interface. +// It contains a file scanner which returns file system events. +// The FS events then trigger either new Harvester runs or updates +// the statestore. +type fileProspector struct{} + +func (p *fileProspector) Run(ctx input.Context, s *statestore.Store, hg *loginp.HarvesterGroup) { + panic("TODO: implement me") +} + +func (p *fileProspector) Test() error { + panic("TODO: implement me") +} From b2244e1b2473b862de540720e28c4747a7ab3cca Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 1 Oct 2020 09:43:21 +0100 Subject: [PATCH 099/216] [JJBB] Use reference repo for fast checkouts (#21410) --- .ci/jobs/beats.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.ci/jobs/beats.yml b/.ci/jobs/beats.yml index 3e4c8e50980..6f59a9bcdf8 100644 --- a/.ci/jobs/beats.yml +++ b/.ci/jobs/beats.yml @@ -53,6 +53,7 @@ recursive: true parent-credentials: true timeout: 100 + reference-repo: /var/lib/jenkins/.git-references/beats.git timeout: '15' use-author: true wipe-workspace: true From 514809a13cd078be71c0bccac03dccc0cc81f0e9 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Thu, 1 Oct 2020 12:03:48 +0100 Subject: [PATCH 100/216] Revert "[JJBB] Set shallow cloning to 10 (#21409)" (#21447) This reverts commit cadd5ff70e679f76e41f32daa1d56734ddf3ae8c. --- .ci/jobs/apm-beats-update.yml | 2 +- .ci/jobs/beats-tester.yml | 2 +- .ci/jobs/beats-windows-mbp.yml | 2 +- .ci/jobs/beats.yml | 2 +- .ci/jobs/golang-crossbuild-mbp.yml | 2 +- .ci/jobs/packaging.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.ci/jobs/apm-beats-update.yml b/.ci/jobs/apm-beats-update.yml index 2ae688ffab7..8bdc322f65a 100644 --- a/.ci/jobs/apm-beats-update.yml +++ b/.ci/jobs/apm-beats-update.yml @@ -48,7 +48,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 3 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-tester.yml b/.ci/jobs/beats-tester.yml index 808123a225e..522abfa5e5c 100644 --- a/.ci/jobs/beats-tester.yml +++ b/.ci/jobs/beats-tester.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 3 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-windows-mbp.yml b/.ci/jobs/beats-windows-mbp.yml index 7ea26c9ba18..64efa009979 100644 --- a/.ci/jobs/beats-windows-mbp.yml +++ b/.ci/jobs/beats-windows-mbp.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 4 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats.yml b/.ci/jobs/beats.yml index 6f59a9bcdf8..b075d8bbdf2 100644 --- a/.ci/jobs/beats.yml +++ b/.ci/jobs/beats.yml @@ -46,7 +46,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 3 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/golang-crossbuild-mbp.yml b/.ci/jobs/golang-crossbuild-mbp.yml index 45175d169f6..46303790610 100644 --- a/.ci/jobs/golang-crossbuild-mbp.yml +++ b/.ci/jobs/golang-crossbuild-mbp.yml @@ -31,7 +31,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 4 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/packaging.yml b/.ci/jobs/packaging.yml index fd6fb9f90c6..0dce4d4672b 100644 --- a/.ci/jobs/packaging.yml +++ b/.ci/jobs/packaging.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 10 + depth: 3 do-not-fetch-tags: true submodule: disable: false From 075696e6a142762600cd74a1aa1daa749f8af41e Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Thu, 1 Oct 2020 18:04:11 +0200 Subject: [PATCH 101/216] [Ingest Manager] Send snapshot flag together with metadata (#21285) [Ingest Manager] Send snapshot flag together with metadata (#21285) --- .../agent/application/info/agent_metadata.go | 16 +++++++-- .../pkg/agent/application/upgrade/upgrade.go | 36 +++++++++---------- x-pack/elastic-agent/pkg/release/upgrade.go | 4 +-- x-pack/elastic-agent/pkg/release/version.go | 2 +- 4 files changed, 35 insertions(+), 23 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/info/agent_metadata.go b/x-pack/elastic-agent/pkg/agent/application/info/agent_metadata.go index c98f9b8e015..c5712646cfb 100644 --- a/x-pack/elastic-agent/pkg/agent/application/info/agent_metadata.go +++ b/x-pack/elastic-agent/pkg/agent/application/info/agent_metadata.go @@ -10,6 +10,7 @@ import ( "runtime" "strings" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/install" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" "github.com/elastic/go-sysinfo" "github.com/elastic/go-sysinfo/types" @@ -33,6 +34,12 @@ type AgentECSMeta struct { ID string `json:"id"` // Version specifies current version of an agent. Version string `json:"version"` + // Snapshot is a flag specifying that the agent used is a snapshot build. + Snapshot bool `json:"snapshot"` + // BuildOriginal is an extended build information for the agent. + BuildOriginal string `json:"build.original"` + // Upgradeable is a flag specifying if it is possible for agent to be upgraded. + Upgradeable bool `json:"upgradeable"` } // SystemECSMeta is a collection of operating system metadata in ECS compliant object form. @@ -126,8 +133,13 @@ func (i *AgentInfo) ECSMetadata() (*ECSMeta, error) { return &ECSMeta{ Elastic: &ElasticECSMeta{ Agent: &AgentECSMeta{ - ID: i.agentID, - Version: release.Version(), + ID: i.agentID, + Version: release.Version(), + Snapshot: release.Snapshot(), + BuildOriginal: release.Info().String(), + // only upgradeable if running from Agent installer and running under the + // control of the system supervisor (or built specifically with upgrading enabled) + Upgradeable: release.Upgradeable() || (install.RunningInstalled() && install.RunningUnderSupervisor()), }, }, Host: &HostECSMeta{ diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index de3a577281d..cac36ef7922 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -33,12 +33,12 @@ const ( // Upgrader performs an upgrade type Upgrader struct { - settings *artifact.Config - log *logger.Logger - closers []context.CancelFunc - reexec reexecManager - acker acker - upgradable bool + settings *artifact.Config + log *logger.Logger + closers []context.CancelFunc + reexec reexecManager + acker acker + upgradeable bool } type reexecManager interface { @@ -53,23 +53,23 @@ type acker interface { // NewUpgrader creates an upgrader which is capable of performing upgrade operation func NewUpgrader(settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker) *Upgrader { return &Upgrader{ - settings: settings, - log: log, - closers: closers, - reexec: reexec, - acker: a, - upgradable: getUpgradable(), + settings: settings, + log: log, + closers: closers, + reexec: reexec, + acker: a, + upgradeable: getUpgradable(), } } -// Upgradable returns true if the Elastic Agent can be upgraded. -func (u *Upgrader) Upgradable() bool { - return u.upgradable +// Upgradeable returns true if the Elastic Agent can be upgraded. +func (u *Upgrader) Upgradeable() bool { + return u.upgradeable } // Upgrade upgrades running agent func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error { - if !u.upgradable { + if !u.upgradeable { return fmt.Errorf( "cannot be upgraded; must be installed with install sub-command and " + "running under control of the systems supervisor") @@ -164,9 +164,9 @@ func rollbackInstall(hash string) { } func getUpgradable() bool { - // only upgradable if running from Agent installer and running under the + // only upgradeable if running from Agent installer and running under the // control of the system supervisor (or built specifically with upgrading enabled) - return release.Upgradable() || (install.RunningInstalled() && install.RunningUnderSupervisor()) + return release.Upgradeable() || (install.RunningInstalled() && install.RunningUnderSupervisor()) } func copyActionStore(newHash string) error { diff --git a/x-pack/elastic-agent/pkg/release/upgrade.go b/x-pack/elastic-agent/pkg/release/upgrade.go index ac1e8552dd2..2e63eb47ad5 100644 --- a/x-pack/elastic-agent/pkg/release/upgrade.go +++ b/x-pack/elastic-agent/pkg/release/upgrade.go @@ -4,7 +4,7 @@ package release -// Upgradable return true when release is built specifically for upgrading. -func Upgradable() bool { +// Upgradeable return true when release is built specifically for upgrading. +func Upgradeable() bool { return allowUpgrade == "true" } diff --git a/x-pack/elastic-agent/pkg/release/version.go b/x-pack/elastic-agent/pkg/release/version.go index dae609a6733..05f0063afdf 100644 --- a/x-pack/elastic-agent/pkg/release/version.go +++ b/x-pack/elastic-agent/pkg/release/version.go @@ -76,7 +76,7 @@ func Info() VersionInfo { } // String returns the string format for the version information. -func (v *VersionInfo) String() string { +func (v VersionInfo) String() string { var sb strings.Builder sb.WriteString(v.Version) From 8e9298e222f234f158258e1a0b02d712fd6ff954 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Thu, 1 Oct 2020 11:59:55 -0700 Subject: [PATCH 102/216] Edit SQL module docs and fix broken doc structure (#21233) * Edit SQL module docs and fix broken doc structure * Apply suggestions from code review Co-authored-by: Brandon Morelli * Run make update Co-authored-by: Brandon Morelli --- metricbeat/docs/modules/sql.asciidoc | 102 +++++++++++------- .../metricbeat/module/sql/_meta/docs.asciidoc | 102 +++++++++++------- .../module/sql/query/_meta/docs.asciidoc | 6 +- 3 files changed, 127 insertions(+), 83 deletions(-) diff --git a/metricbeat/docs/modules/sql.asciidoc b/metricbeat/docs/modules/sql.asciidoc index 69726a1fe7d..6e944cf5c13 100644 --- a/metricbeat/docs/modules/sql.asciidoc +++ b/metricbeat/docs/modules/sql.asciidoc @@ -8,24 +8,45 @@ This file is generated! See scripts/mage/docs_collector.go beta[] -The SQL module allows to execute custom queries against an SQL database and store the results to Elasticsearch. +The SQL module allows you to execute custom queries against an SQL database and +store the results in {es}. -The currently supported databases are the ones already included in Metricbeat, which are: -- PostgreSQL -- MySQL -- Oracle -- Microsoft SQL -- CockroachDB +This module supports the databases that you can monitor with {metricbeat}, +including: -== Quickstart +* PostgreSQL +* MySQL +* Oracle +* Microsoft SQL +* CockroachDB -You can setup the module by activating it first running +To enable the module, run: - metricbeat module enable sql +[source,shell] +---- +metricbeat module enable sql +---- + +After enabling the module, open `modules.d/sql.yml` and set the required +fields: + +`driver`:: The driver can be any driver that has a {metricbeat} module, such as +`mssql` or `postgres`. +`sql_query`:: The single query you want to run. +`sql_response_format`:: Either `variables` or `table`: +`variables`::: Expects a two-column table that looks like a key/value result. +The left column is considered a key and the right column the value. This mode +generates a single event on each fetch operation. +`table`::: Expects any number of columns. This mode generates a single event for +each row. + +[float] +=== Example: capture Innodb-related metrics -Once it is activated, open `modules.d/sql.yml` and fill the required fields. This is an example that captures Innodb related metrics from the result of the query `SHOW GLOBAL STATUS LIKE 'Innodb_system%'` in a MySQL database: +This `sql.yml` configuration shows how to capture Innodb-related metrics that +result from the query `SHOW GLOBAL STATUS LIKE 'Innodb_system%'` in a MySQL +database: -.sql.yml [source,yaml] ---- - module: sql @@ -39,7 +60,8 @@ Once it is activated, open `modules.d/sql.yml` and fill the required fields. Thi sql_response_format: variables ---- -.SHOW GLOBAL STATUS LIKE 'Innodb_system%' +The `SHOW GLOBAL STATUS` query results in this table: + |==== |Variable_name|Value @@ -49,18 +71,11 @@ Once it is activated, open `modules.d/sql.yml` and fill the required fields. Thi |Innodb_system_rows_updated|315 |==== +Results are grouped by type in the result event for convenient mapping in +{es}. For example, `strings` values are grouped into `sql.strings`, `numeric` +into `sql.numeric`, and so on. -Keys in the YAML are defined as follow: - -- `driver`: The drivers currently supported are those which already have a Metricbeat module like `mssql` or `postgres`. -- `sql_query`: Is the single query you want to run -- `sql_response_format`: You have 2 options here: - - `variables`: Expects a table which looks like a key/value result. With 2 columns, left column will be considered a key and the right column the value. This mode generates a single event on each fetch operation. - - `table`: Table mode can contain any number of columns and a single event will be generated for each row. - -Results will be grouped by type in the result event for convenient mapping in Elasticsearch. So `strings` values will be grouped into `sql.strings`, `numeric` into `sql.numeric` and so on and so forth. - -The event generated with the example above looks like this: +The example shown earlier generates this event: [source,json] ---- @@ -112,9 +127,13 @@ The event generated with the example above looks like this: } ---- -In this example, we are querying PostgreSQL and generate a "table" result, hence a single event for each row returned +[float] +=== Example: query PostgreSQL and generate a "table" result + +This `sql.yml` configuration shows how to query PostgreSQL and generate +a "table" result. This configuration generates a single event for each row +returned: -.sql.yml [source,yaml] ---- - module: sql @@ -128,7 +147,8 @@ In this example, we are querying PostgreSQL and generate a "table" result, hence sql_response_format: table ---- -.SELECT datid, datname, blks_read, blks_hit, tup_returned, tup_fetched, stats_reset FROM pg_stat_database +The SELECT query results in this table: + |==== |datid|datname|blks_read|blks_hit|tup_returned|tup_fetched|stats_reset @@ -137,7 +157,8 @@ In this example, we are querying PostgreSQL and generate a "table" result, hence |13407|template0|0|0|0|0| |==== -With 3 rows on the table, three events will be generated with the contents of each row. As an example, below you can see the event created for the first row: +Because the table contains three rows, three events are generated, one event +for each row. For example, this event is created for the first row: [source,json] ---- @@ -194,14 +215,11 @@ With 3 rows on the table, three events will be generated with the contents of ea } ---- +[float] +=== Example: get the buffer catch hit ratio in Oracle -== More examples - -=== Oracle: - -Get the buffer cache hit ratio: +This `sql.yml` configuration shows how to get the buffer cache hit ratio: -.sql.yml [source,yaml] ---- - module: sql @@ -215,6 +233,7 @@ Get the buffer cache hit ratio: sql_response_format: table ---- +The example generates this event: [source,json] ---- @@ -269,11 +288,11 @@ Get the buffer cache hit ratio: } ---- -=== MSSQL +[float] +=== Example: get the buffer cache hit ratio for MSSQL -Get the buffer cache hit ratio: +This `sql.yml` configuration gets the buffer cache hit ratio: -.sql.yml [source,yaml] ---- - module: sql @@ -287,6 +306,8 @@ Get the buffer cache hit ratio: sql_response_format: table ---- +The example generates this event: + [source,json] ---- { @@ -338,11 +359,12 @@ Get the buffer cache hit ratio: } ---- -=== Two or more queries +[float] +=== Example: launch two or more queries -If you want to launch two or more queries, you need to specify them with their full configuration for each query. For example: +To launch two or more queries, specify the full configuration for each query. +For example: -.sql.yml [source,yaml] ---- - module: sql diff --git a/x-pack/metricbeat/module/sql/_meta/docs.asciidoc b/x-pack/metricbeat/module/sql/_meta/docs.asciidoc index 31751f264ec..d445d62e305 100644 --- a/x-pack/metricbeat/module/sql/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/sql/_meta/docs.asciidoc @@ -1,21 +1,42 @@ -The SQL module allows to execute custom queries against an SQL database and store the results to Elasticsearch. +The SQL module allows you to execute custom queries against an SQL database and +store the results in {es}. -The currently supported databases are the ones already included in Metricbeat, which are: -- PostgreSQL -- MySQL -- Oracle -- Microsoft SQL -- CockroachDB +This module supports the databases that you can monitor with {metricbeat}, +including: -== Quickstart +* PostgreSQL +* MySQL +* Oracle +* Microsoft SQL +* CockroachDB -You can setup the module by activating it first running +To enable the module, run: - metricbeat module enable sql +[source,shell] +---- +metricbeat module enable sql +---- + +After enabling the module, open `modules.d/sql.yml` and set the required +fields: + +`driver`:: The driver can be any driver that has a {metricbeat} module, such as +`mssql` or `postgres`. +`sql_query`:: The single query you want to run. +`sql_response_format`:: Either `variables` or `table`: +`variables`::: Expects a two-column table that looks like a key/value result. +The left column is considered a key and the right column the value. This mode +generates a single event on each fetch operation. +`table`::: Expects any number of columns. This mode generates a single event for +each row. -Once it is activated, open `modules.d/sql.yml` and fill the required fields. This is an example that captures Innodb related metrics from the result of the query `SHOW GLOBAL STATUS LIKE 'Innodb_system%'` in a MySQL database: +[float] +=== Example: capture Innodb-related metrics + +This `sql.yml` configuration shows how to capture Innodb-related metrics that +result from the query `SHOW GLOBAL STATUS LIKE 'Innodb_system%'` in a MySQL +database: -.sql.yml [source,yaml] ---- - module: sql @@ -29,7 +50,8 @@ Once it is activated, open `modules.d/sql.yml` and fill the required fields. Thi sql_response_format: variables ---- -.SHOW GLOBAL STATUS LIKE 'Innodb_system%' +The `SHOW GLOBAL STATUS` query results in this table: + |==== |Variable_name|Value @@ -39,18 +61,11 @@ Once it is activated, open `modules.d/sql.yml` and fill the required fields. Thi |Innodb_system_rows_updated|315 |==== +Results are grouped by type in the result event for convenient mapping in +{es}. For example, `strings` values are grouped into `sql.strings`, `numeric` +into `sql.numeric`, and so on. -Keys in the YAML are defined as follow: - -- `driver`: The drivers currently supported are those which already have a Metricbeat module like `mssql` or `postgres`. -- `sql_query`: Is the single query you want to run -- `sql_response_format`: You have 2 options here: - - `variables`: Expects a table which looks like a key/value result. With 2 columns, left column will be considered a key and the right column the value. This mode generates a single event on each fetch operation. - - `table`: Table mode can contain any number of columns and a single event will be generated for each row. - -Results will be grouped by type in the result event for convenient mapping in Elasticsearch. So `strings` values will be grouped into `sql.strings`, `numeric` into `sql.numeric` and so on and so forth. - -The event generated with the example above looks like this: +The example shown earlier generates this event: [source,json] ---- @@ -102,9 +117,13 @@ The event generated with the example above looks like this: } ---- -In this example, we are querying PostgreSQL and generate a "table" result, hence a single event for each row returned +[float] +=== Example: query PostgreSQL and generate a "table" result + +This `sql.yml` configuration shows how to query PostgreSQL and generate +a "table" result. This configuration generates a single event for each row +returned: -.sql.yml [source,yaml] ---- - module: sql @@ -118,7 +137,8 @@ In this example, we are querying PostgreSQL and generate a "table" result, hence sql_response_format: table ---- -.SELECT datid, datname, blks_read, blks_hit, tup_returned, tup_fetched, stats_reset FROM pg_stat_database +The SELECT query results in this table: + |==== |datid|datname|blks_read|blks_hit|tup_returned|tup_fetched|stats_reset @@ -127,7 +147,8 @@ In this example, we are querying PostgreSQL and generate a "table" result, hence |13407|template0|0|0|0|0| |==== -With 3 rows on the table, three events will be generated with the contents of each row. As an example, below you can see the event created for the first row: +Because the table contains three rows, three events are generated, one event +for each row. For example, this event is created for the first row: [source,json] ---- @@ -184,14 +205,11 @@ With 3 rows on the table, three events will be generated with the contents of ea } ---- +[float] +=== Example: get the buffer catch hit ratio in Oracle -== More examples +This `sql.yml` configuration shows how to get the buffer cache hit ratio: -=== Oracle: - -Get the buffer cache hit ratio: - -.sql.yml [source,yaml] ---- - module: sql @@ -205,6 +223,7 @@ Get the buffer cache hit ratio: sql_response_format: table ---- +The example generates this event: [source,json] ---- @@ -259,11 +278,11 @@ Get the buffer cache hit ratio: } ---- -=== MSSQL +[float] +=== Example: get the buffer cache hit ratio for MSSQL -Get the buffer cache hit ratio: +This `sql.yml` configuration gets the buffer cache hit ratio: -.sql.yml [source,yaml] ---- - module: sql @@ -277,6 +296,8 @@ Get the buffer cache hit ratio: sql_response_format: table ---- +The example generates this event: + [source,json] ---- { @@ -328,11 +349,12 @@ Get the buffer cache hit ratio: } ---- -=== Two or more queries +[float] +=== Example: launch two or more queries -If you want to launch two or more queries, you need to specify them with their full configuration for each query. For example: +To launch two or more queries, specify the full configuration for each query. +For example: -.sql.yml [source,yaml] ---- - module: sql diff --git a/x-pack/metricbeat/module/sql/query/_meta/docs.asciidoc b/x-pack/metricbeat/module/sql/query/_meta/docs.asciidoc index df05a99c95c..8f48f8507de 100644 --- a/x-pack/metricbeat/module/sql/query/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/sql/query/_meta/docs.asciidoc @@ -1,4 +1,4 @@ -The sql `query` metricset collect rows returned by a query. +The sql `query` metricset collects rows returned by a query. -Fields names (columns) will be returned as lowercase. -Values will be returned as numeric or string. \ No newline at end of file +Field names (columns) are returned as lowercase strings. Values are returned as numeric +or string. From 13a54632caa9c69f1126733addbfa2e69a34f2d4 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 1 Oct 2020 23:04:30 -0400 Subject: [PATCH 103/216] Update Filebeat module expected logs files (#21454) Elasticsearch added country_name to the list of default field for geo in https://github.com/elastic/elasticsearch/pull/62915. So the expected files needed updated. --- .../test/darwin-2.4.23.log-expected.json | 3 + .../access/test/ssl-request.log-expected.json | 1 + .../apache/error/test/test.log-expected.json | 2 + .../log/test/default.log-expected.json | 1 + .../log/test/haproxy.log-expected.json | 1 + .../iis/access/test/test.log-expected.json | 2 + .../test/iis_error_url.log-expected.json | 8 + .../iis/error/test/test.log-expected.json | 3 + .../access/test/access.log-expected.json | 8 + .../test/test-with-host.log-expected.json | 4 + .../nginx/access/test/test.log-expected.json | 4 + .../test/test.log-expected.json | 2 +- .../auth/test/secure-rhel7.log-expected.json | 35 ++ .../system/auth/test/test.log-expected.json | 2 + .../access/test/test.log-expected.json | 4 + .../test/assume-role-json.log-expected.json | 1 + .../create-key-pair-json.log-expected.json | 1 + .../test/update-trail-json.log-expected.json | 1 + .../application-lb-http.log-expected.json | 10 + .../aws/elb/test/elb-http.log-expected.json | 5 + .../aws/elb/test/elb-tcp.log-expected.json | 6 + .../test/example-nlb-tcp.log-expected.json | 1 + .../test/s3_server_access.log-expected.json | 6 + .../accept-reject-traffic.log-expected.json | 4 + .../test/tcp-flag-sequence.log-expected.json | 1 + .../test/activitylogs.log-expected.json | 2 + .../supporttickets_write.log-expected.json | 2 + .../test/signinlogs.log-expected.json | 2 + .../test/generated.log-expected.json | 4 +- .../module/cef/log/test/cef.log-expected.json | 3 + .../cef/log/test/checkpoint.log-expected.json | 1 + .../test/checkpoint.log-expected.json | 45 ++ .../additional_messages.log-expected.json | 10 + .../cisco/asa/test/asa-fix.log-expected.json | 1 + .../asa/test/dap_records.log-expected.json | 1 + .../cisco/ftd/test/dns.log-expected.json | 21 + .../security-connection.log-expected.json | 6 + .../security-file-malware.log-expected.json | 2 + .../security-malware-site.log-expected.json | 2 + .../test/cisco-ios-syslog.log-expected.json | 7 + .../meraki/test/generated.log-expected.json | 128 ++--- .../test/generated.log-expected.json | 40 +- .../corepas/test/generated.log-expected.json | 418 +++++++------- .../log/test/envoy-json.log-expected.json | 1 + .../log/test/envoy.log-expected.json | 1 + .../bigipafm/test/generated.log-expected.json | 402 +++++++------- .../bigipapm/test/generated.log-expected.json | 12 +- .../test/generated.log-expected.json | 176 +++--- .../firewall/test/fortinet.log-expected.json | 29 + .../test/generated.log-expected.json | 24 +- .../test/generated.log-expected.json | 320 +++++------ .../audit-log-entries.json.log-expected.json | 2 + .../firewall/test/test.log-expected.json | 3 + ...in-application-test.json.log-expected.json | 18 +- ...admin-calendar-test.json.log-expected.json | 26 +- ...ite-admin-chat-test.json.log-expected.json | 8 +- ...admin-chromeos-test.json.log-expected.json | 42 +- ...admin-contacts-test.json.log-expected.json | 2 +- ...delegatedadmin-test.json.log-expected.json | 16 +- ...ite-admin-docs-test.json.log-expected.json | 8 +- ...e-admin-domain-test.json.log-expected.json | 170 +++--- ...te-admin-gmail-test.json.log-expected.json | 20 +- ...e-admin-groups-test.json.log-expected.json | 28 +- ...admin-licenses-test.json.log-expected.json | 16 +- ...e-admin-mobile-test.json.log-expected.json | 62 +-- ...uite-admin-org-test.json.log-expected.json | 34 +- ...admin-security-test.json.log-expected.json | 48 +- ...te-admin-sites-test.json.log-expected.json | 10 +- ...ite-admin-user-test.json.log-expected.json | 150 +++--- .../gsuite-drive-test.json.log-expected.json | 56 +- .../gsuite-groups-test.json.log-expected.json | 50 +- .../gsuite-login-test.json.log-expected.json | 20 +- .../gsuite-saml-test.json.log-expected.json | 4 +- ...-user_accounts-test.json.log-expected.json | 16 +- .../test/generated.log-expected.json | 456 ++++++++-------- .../iptables/log/test/geo.log-expected.json | 1 + .../test/generated.log-expected.json | 20 +- .../test/misp-test.json.log-expected.json | 1 + .../test/generated.log-expected.json | 28 +- .../test/04-sharepoint.log-expected.json | 4 + .../06-sharepointfileop.log-expected.json | 11 + .../audit/test/08-azuread.log-expected.json | 99 ++++ .../test/14-sp-sharing-op.log-expected.json | 5 + .../15-azuread-sts-logon.log-expected.json | 69 +++ .../audit/test/22-yammer.log-expected.json | 1 + .../okta-system-test.json.log-expected.json | 3 + .../test/pan_inc_other.log-expected.json | 1 + .../test/pan_inc_threat.log-expected.json | 100 ++++ .../test/pan_inc_traffic.log-expected.json | 95 ++++ .../panw/panos/test/threat.log-expected.json | 76 +++ .../panw/panos/test/traffic.log-expected.json | 98 ++++ .../log/test/generated.log-expected.json | 54 +- .../firewall/test/general.log-expected.json | 6 + .../firewall/test/generated.log-expected.json | 80 +-- .../utm/test/generated.log-expected.json | 90 ++-- .../xg/test/anti-spam.log-expected.json | 6 + .../xg/test/anti-virus.log-expected.json | 6 + .../sophos/xg/test/atp.log-expected.json | 4 + .../sophos/xg/test/cfilter.log-expected.json | 10 + .../sophos/xg/test/event.log-expected.json | 6 + .../sophos/xg/test/firewall.log-expected.json | 9 + .../sophos/xg/test/idp.log-expected.json | 3 + .../sophos/xg/test/waf.log-expected.json | 6 + .../squid/log/test/access1.log-expected.json | 420 +++++++++------ .../eve/test/eve-alerts.log-expected.json | 20 + .../eve/test/eve-small.log-expected.json | 1 + .../test/generated.log-expected.json | 14 +- .../test/connection-json.log-expected.json | 3 + .../http/test/http-json.log-expected.json | 1 + .../zeek/irc/test/irc-json.log-expected.json | 3 + .../notice/test/notice-json.log-expected.json | 2 + .../zeek/sip/test/sip-json.log-expected.json | 5 + .../zeek/ssl/test/ssl-json.log-expected.json | 2 + .../test/traceroute-json.log-expected.json | 1 + .../tunnel/test/tunnel-json.log-expected.json | 2 + .../zia/test/generated.log-expected.json | 508 +++++++++--------- .../zscaler/zia/test/test.log-expected.json | 4 +- 117 files changed, 2951 insertions(+), 1968 deletions(-) diff --git a/filebeat/module/apache/access/test/darwin-2.4.23.log-expected.json b/filebeat/module/apache/access/test/darwin-2.4.23.log-expected.json index 9c61a6065af..1f3600f2e09 100644 --- a/filebeat/module/apache/access/test/darwin-2.4.23.log-expected.json +++ b/filebeat/module/apache/access/test/darwin-2.4.23.log-expected.json @@ -76,6 +76,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -105,6 +106,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -134,6 +136,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", diff --git a/filebeat/module/apache/access/test/ssl-request.log-expected.json b/filebeat/module/apache/access/test/ssl-request.log-expected.json index 9898d82cef0..3eb3e283b19 100644 --- a/filebeat/module/apache/access/test/ssl-request.log-expected.json +++ b/filebeat/module/apache/access/test/ssl-request.log-expected.json @@ -38,6 +38,7 @@ "source.address": "11.19.0.217", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "11.19.0.217", diff --git a/filebeat/module/apache/error/test/test.log-expected.json b/filebeat/module/apache/error/test/test.log-expected.json index fbc9605ef38..d9f470db46a 100644 --- a/filebeat/module/apache/error/test/test.log-expected.json +++ b/filebeat/module/apache/error/test/test.log-expected.json @@ -56,6 +56,7 @@ "source.geo.city_name": "Newnan", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 33.3708, "source.geo.location.lon": -84.8154, "source.geo.region_iso_code": "US-GA", @@ -84,6 +85,7 @@ "source.geo.city_name": "Beijing", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 39.9288, "source.geo.location.lon": 116.3889, "source.geo.region_iso_code": "CN-BJ", diff --git a/filebeat/module/haproxy/log/test/default.log-expected.json b/filebeat/module/haproxy/log/test/default.log-expected.json index f58515d6172..4da9bc98f17 100644 --- a/filebeat/module/haproxy/log/test/default.log-expected.json +++ b/filebeat/module/haproxy/log/test/default.log-expected.json @@ -30,6 +30,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", diff --git a/filebeat/module/haproxy/log/test/haproxy.log-expected.json b/filebeat/module/haproxy/log/test/haproxy.log-expected.json index 474b7a5e5d3..b33e80ab073 100644 --- a/filebeat/module/haproxy/log/test/haproxy.log-expected.json +++ b/filebeat/module/haproxy/log/test/haproxy.log-expected.json @@ -47,6 +47,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", diff --git a/filebeat/module/iis/access/test/test.log-expected.json b/filebeat/module/iis/access/test/test.log-expected.json index adb56a2eadd..786333c1379 100644 --- a/filebeat/module/iis/access/test/test.log-expected.json +++ b/filebeat/module/iis/access/test/test.log-expected.json @@ -34,6 +34,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -127,6 +128,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", diff --git a/filebeat/module/iis/error/test/iis_error_url.log-expected.json b/filebeat/module/iis/error/test/iis_error_url.log-expected.json index 0cb2fb038b4..8adb2e6d1d0 100644 --- a/filebeat/module/iis/error/test/iis_error_url.log-expected.json +++ b/filebeat/module/iis/error/test/iis_error_url.log-expected.json @@ -30,6 +30,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -67,6 +68,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -104,6 +106,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -141,6 +144,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -178,6 +182,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -215,6 +220,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -252,6 +258,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", @@ -289,6 +296,7 @@ "source.address": "149.42.83.135", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "149.42.83.135", diff --git a/filebeat/module/iis/error/test/test.log-expected.json b/filebeat/module/iis/error/test/test.log-expected.json index 50ec549dd6b..506ee6ba2ed 100644 --- a/filebeat/module/iis/error/test/test.log-expected.json +++ b/filebeat/module/iis/error/test/test.log-expected.json @@ -66,6 +66,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -108,6 +109,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -146,6 +148,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", diff --git a/filebeat/module/nginx/access/test/access.log-expected.json b/filebeat/module/nginx/access/test/access.log-expected.json index 92519cc1e81..7981a316c95 100644 --- a/filebeat/module/nginx/access/test/access.log-expected.json +++ b/filebeat/module/nginx/access/test/access.log-expected.json @@ -32,6 +32,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -80,6 +81,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -127,6 +129,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -174,6 +177,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -222,6 +226,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -269,6 +274,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -316,6 +322,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", @@ -363,6 +370,7 @@ "source.geo.city_name": "Germersheim", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.2231, "source.geo.location.lon": 8.3639, "source.geo.region_iso_code": "DE-RP", diff --git a/filebeat/module/nginx/access/test/test-with-host.log-expected.json b/filebeat/module/nginx/access/test/test-with-host.log-expected.json index a1968695184..e07836ce520 100644 --- a/filebeat/module/nginx/access/test/test-with-host.log-expected.json +++ b/filebeat/module/nginx/access/test/test-with-host.log-expected.json @@ -115,6 +115,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -164,6 +165,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -216,6 +218,7 @@ "source.geo.city_name": "Springfield", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 39.7647, "source.geo.location.lon": -89.7379, "source.geo.region_iso_code": "US-IL", @@ -260,6 +263,7 @@ "source.address": "2a03:0000:10ff:f00f:0000:0000:0:8000", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PT", + "source.geo.country_name": "Portugal", "source.geo.location.lat": 39.5, "source.geo.location.lon": -8.0, "source.ip": "2a03:0000:10ff:f00f:0000:0000:0:8000", diff --git a/filebeat/module/nginx/access/test/test.log-expected.json b/filebeat/module/nginx/access/test/test.log-expected.json index 75caf6cf9f8..b27c9ccf19b 100644 --- a/filebeat/module/nginx/access/test/test.log-expected.json +++ b/filebeat/module/nginx/access/test/test.log-expected.json @@ -112,6 +112,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -159,6 +160,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -209,6 +211,7 @@ "source.geo.city_name": "Springfield", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 39.7647, "source.geo.location.lon": -89.7379, "source.geo.region_iso_code": "US-IL", @@ -251,6 +254,7 @@ "source.address": "2a03:0000:10ff:f00f:0000:0000:0:8000", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PT", + "source.geo.country_name": "Portugal", "source.geo.location.lat": 39.5, "source.geo.location.lon": -8.0, "source.ip": "2a03:0000:10ff:f00f:0000:0000:0:8000", diff --git a/filebeat/module/nginx/ingress_controller/test/test.log-expected.json b/filebeat/module/nginx/ingress_controller/test/test.log-expected.json index e8b09bc1abd..89c37b4a38e 100644 --- a/filebeat/module/nginx/ingress_controller/test/test.log-expected.json +++ b/filebeat/module/nginx/ingress_controller/test/test.log-expected.json @@ -1322,4 +1322,4 @@ "user_agent.os.version": "10.14", "user_agent.version": "72.0." } -] +] \ No newline at end of file diff --git a/filebeat/module/system/auth/test/secure-rhel7.log-expected.json b/filebeat/module/system/auth/test/secure-rhel7.log-expected.json index 7d8ece1d7f2..50134594bfc 100644 --- a/filebeat/module/system/auth/test/secure-rhel7.log-expected.json +++ b/filebeat/module/system/auth/test/secure-rhel7.log-expected.json @@ -33,6 +33,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -94,6 +95,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -155,6 +157,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -284,6 +287,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -345,6 +349,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -406,6 +411,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -467,6 +473,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -528,6 +535,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -691,6 +699,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -752,6 +761,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -813,6 +823,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -874,6 +885,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -935,6 +947,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -996,6 +1009,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -1074,6 +1088,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1135,6 +1150,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1264,6 +1280,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1325,6 +1342,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1386,6 +1404,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1447,6 +1466,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1508,6 +1528,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1637,6 +1658,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1698,6 +1720,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1759,6 +1782,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1820,6 +1844,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -1881,6 +1906,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2010,6 +2036,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -2071,6 +2098,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -2132,6 +2160,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -2244,6 +2273,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2305,6 +2335,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2366,6 +2397,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2427,6 +2459,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2488,6 +2521,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", @@ -2617,6 +2651,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 28.55, "source.geo.location.lon": 115.9333, "source.geo.region_iso_code": "CN-JX", diff --git a/filebeat/module/system/auth/test/test.log-expected.json b/filebeat/module/system/auth/test/test.log-expected.json index 88d32188bb7..dc677ebb58c 100644 --- a/filebeat/module/system/auth/test/test.log-expected.json +++ b/filebeat/module/system/auth/test/test.log-expected.json @@ -140,6 +140,7 @@ "source.as.organization.name": "CHINANET Guangdong province network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 23.1167, "source.geo.location.lon": 113.25, "source.geo.region_iso_code": "CN-GD", @@ -196,6 +197,7 @@ "source.geo.city_name": "Hangzhou", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 30.294, "source.geo.location.lon": 120.1619, "source.geo.region_iso_code": "CN-ZJ", diff --git a/filebeat/module/traefik/access/test/test.log-expected.json b/filebeat/module/traefik/access/test/test.log-expected.json index a5723ed5c27..631673fe351 100644 --- a/filebeat/module/traefik/access/test/test.log-expected.json +++ b/filebeat/module/traefik/access/test/test.log-expected.json @@ -69,6 +69,7 @@ "source.geo.city_name": "Berlin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 52.4473, "source.geo.location.lon": 13.4531, "source.geo.region_iso_code": "DE-BE", @@ -116,6 +117,7 @@ "source.geo.city_name": "Ottawa", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "CA", + "source.geo.country_name": "Canada", "source.geo.location.lat": 45.2691, "source.geo.location.lon": -75.7518, "source.geo.region_iso_code": "CA-ON", @@ -203,6 +205,7 @@ "source.geo.city_name": "Warsaw", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 52.25, "source.geo.location.lon": 21.0, "source.geo.region_iso_code": "PL-14", @@ -249,6 +252,7 @@ "source.geo.city_name": "Gda\u0144sk", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 54.3605, "source.geo.location.lon": 18.649, "source.geo.region_iso_code": "PL-22", diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/assume-role-json.log-expected.json b/x-pack/filebeat/module/aws/cloudtrail/test/assume-role-json.log-expected.json index 3bdb628e7fb..47691a242dc 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/test/assume-role-json.log-expected.json +++ b/x-pack/filebeat/module/aws/cloudtrail/test/assume-role-json.log-expected.json @@ -63,6 +63,7 @@ "source.as.organization.name": "CHINA UNICOM China169 Backbone", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 29.5569, "source.geo.location.lon": 106.5531, "source.geo.region_iso_code": "CN-CQ", diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/create-key-pair-json.log-expected.json b/x-pack/filebeat/module/aws/cloudtrail/test/create-key-pair-json.log-expected.json index 5783ade81ed..41cca74d099 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/test/create-key-pair-json.log-expected.json +++ b/x-pack/filebeat/module/aws/cloudtrail/test/create-key-pair-json.log-expected.json @@ -39,6 +39,7 @@ "source.geo.city_name": "Ashburn", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 39.0481, "source.geo.location.lon": -77.4728, "source.geo.region_iso_code": "US-VA", diff --git a/x-pack/filebeat/module/aws/cloudtrail/test/update-trail-json.log-expected.json b/x-pack/filebeat/module/aws/cloudtrail/test/update-trail-json.log-expected.json index c9ee01ef238..1531a7c1e5a 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/test/update-trail-json.log-expected.json +++ b/x-pack/filebeat/module/aws/cloudtrail/test/update-trail-json.log-expected.json @@ -32,6 +32,7 @@ "source.geo.city_name": "Boardman", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 45.8491, "source.geo.location.lon": -119.7143, "source.geo.region_iso_code": "US-OR", diff --git a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json index a566b2f9478..28e1564e928 100644 --- a/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/application-lb-http.log-expected.json @@ -35,6 +35,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -83,6 +84,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -131,6 +133,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -179,6 +182,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -227,6 +231,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -275,6 +280,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -323,6 +329,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -375,6 +382,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -427,6 +435,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -479,6 +488,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", diff --git a/x-pack/filebeat/module/aws/elb/test/elb-http.log-expected.json b/x-pack/filebeat/module/aws/elb/test/elb-http.log-expected.json index c1916fd1ec2..48701c8a985 100644 --- a/x-pack/filebeat/module/aws/elb/test/elb-http.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/elb-http.log-expected.json @@ -31,6 +31,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", @@ -74,6 +75,7 @@ "source.geo.city_name": "Mytishchi", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.9089, "source.geo.location.lon": 37.7339, "source.geo.region_iso_code": "RU-MOS", @@ -117,6 +119,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -160,6 +163,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -203,6 +207,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", diff --git a/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json index 8b394e2b07e..e960e211763 100644 --- a/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/elb-tcp.log-expected.json @@ -25,6 +25,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -61,6 +62,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -97,6 +99,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -133,6 +136,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -169,6 +173,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", @@ -205,6 +210,7 @@ "source.geo.city_name": "Teruel", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.3456, "source.geo.location.lon": -1.1065, "source.geo.region_iso_code": "ES-TE", diff --git a/x-pack/filebeat/module/aws/elb/test/example-nlb-tcp.log-expected.json b/x-pack/filebeat/module/aws/elb/test/example-nlb-tcp.log-expected.json index e9564154424..b5db726de69 100644 --- a/x-pack/filebeat/module/aws/elb/test/example-nlb-tcp.log-expected.json +++ b/x-pack/filebeat/module/aws/elb/test/example-nlb-tcp.log-expected.json @@ -30,6 +30,7 @@ "source.geo.city_name": "Ashburn", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 39.0481, "source.geo.location.lon": -77.4728, "source.geo.region_iso_code": "US-VA", diff --git a/x-pack/filebeat/module/aws/s3access/test/s3_server_access.log-expected.json b/x-pack/filebeat/module/aws/s3access/test/s3_server_access.log-expected.json index 273b1512556..187f7f33589 100644 --- a/x-pack/filebeat/module/aws/s3access/test/s3_server_access.log-expected.json +++ b/x-pack/filebeat/module/aws/s3access/test/s3_server_access.log-expected.json @@ -33,6 +33,7 @@ "geo.city_name": "Ashburn", "geo.continent_name": "North America", "geo.country_iso_code": "US", + "geo.country_name": "United States", "geo.location.lat": 39.0481, "geo.location.lon": -77.4728, "geo.region_iso_code": "US-VA", @@ -95,6 +96,7 @@ "geo.city_name": "Ashburn", "geo.continent_name": "North America", "geo.country_iso_code": "US", + "geo.country_name": "United States", "geo.location.lat": 39.0481, "geo.location.lon": -77.4728, "geo.region_iso_code": "US-VA", @@ -158,6 +160,7 @@ "geo.city_name": "Ashburn", "geo.continent_name": "North America", "geo.country_iso_code": "US", + "geo.country_name": "United States", "geo.location.lat": 39.0481, "geo.location.lon": -77.4728, "geo.region_iso_code": "US-VA", @@ -220,6 +223,7 @@ "geo.city_name": "Ashburn", "geo.continent_name": "North America", "geo.country_iso_code": "US", + "geo.country_name": "United States", "geo.location.lat": 39.0481, "geo.location.lon": -77.4728, "geo.region_iso_code": "US-VA", @@ -279,6 +283,7 @@ "geo.city_name": "Teruel", "geo.continent_name": "Europe", "geo.country_iso_code": "ES", + "geo.country_name": "Spain", "geo.location.lat": 40.3456, "geo.location.lon": -1.1065, "geo.region_iso_code": "ES-TE", @@ -331,6 +336,7 @@ "geo.city_name": "Denver", "geo.continent_name": "North America", "geo.country_iso_code": "US", + "geo.country_name": "United States", "geo.location.lat": 39.7044, "geo.location.lon": -105.0023, "geo.region_iso_code": "US-CO", diff --git a/x-pack/filebeat/module/aws/vpcflow/test/accept-reject-traffic.log-expected.json b/x-pack/filebeat/module/aws/vpcflow/test/accept-reject-traffic.log-expected.json index 170b8851ec9..1f1b3e061b2 100644 --- a/x-pack/filebeat/module/aws/vpcflow/test/accept-reject-traffic.log-expected.json +++ b/x-pack/filebeat/module/aws/vpcflow/test/accept-reject-traffic.log-expected.json @@ -13,6 +13,7 @@ "destination.as.organization.name": "Consorci de Serveis Universitaris de Catalunya", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "ES", + "destination.geo.country_name": "Spain", "destination.geo.location.lat": 40.4172, "destination.geo.location.lon": -3.684, "destination.ip": "158.109.0.1", @@ -47,6 +48,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", @@ -72,6 +74,7 @@ "destination.as.organization.name": "Consorci de Serveis Universitaris de Catalunya", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "ES", + "destination.geo.country_name": "Spain", "destination.geo.location.lat": 40.4172, "destination.geo.location.lon": -3.684, "destination.ip": "158.109.0.1", @@ -106,6 +109,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", diff --git a/x-pack/filebeat/module/aws/vpcflow/test/tcp-flag-sequence.log-expected.json b/x-pack/filebeat/module/aws/vpcflow/test/tcp-flag-sequence.log-expected.json index 6b7b788ac97..ba0293752ca 100644 --- a/x-pack/filebeat/module/aws/vpcflow/test/tcp-flag-sequence.log-expected.json +++ b/x-pack/filebeat/module/aws/vpcflow/test/tcp-flag-sequence.log-expected.json @@ -49,6 +49,7 @@ "source.geo.city_name": "Dublin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "IE", + "source.geo.country_name": "Ireland", "source.geo.location.lat": 53.3338, "source.geo.location.lon": -6.2488, "source.geo.region_iso_code": "IE-L", diff --git a/x-pack/filebeat/module/azure/activitylogs/test/activitylogs.log-expected.json b/x-pack/filebeat/module/azure/activitylogs/test/activitylogs.log-expected.json index 4c0e8d4701a..3f86faee084 100644 --- a/x-pack/filebeat/module/azure/activitylogs/test/activitylogs.log-expected.json +++ b/x-pack/filebeat/module/azure/activitylogs/test/activitylogs.log-expected.json @@ -47,6 +47,7 @@ "fileset.name": "activitylogs", "geo.continent_name": "Europe", "geo.country_iso_code": "GB", + "geo.country_name": "United Kingdom", "geo.location.lat": 51.4964, "geo.location.lon": -0.1224, "input.type": "log", @@ -55,6 +56,7 @@ "service.type": "azure", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "GB", + "source.geo.country_name": "United Kingdom", "source.geo.location.lat": 51.4964, "source.geo.location.lon": -0.1224, "source.ip": "51.251.141.41", diff --git a/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json b/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json index db962bd4df6..5f14108e4c4 100644 --- a/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json +++ b/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json @@ -52,6 +52,7 @@ "fileset.name": "activitylogs", "geo.continent_name": "Asia", "geo.country_iso_code": "JP", + "geo.country_name": "Japan", "geo.location.lat": 35.69, "geo.location.lon": 139.69, "input.type": "log", @@ -62,6 +63,7 @@ "source.as.organization.name": "KDDI CORPORATION", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "JP", + "source.geo.country_name": "Japan", "source.geo.location.lat": 35.69, "source.geo.location.lon": 139.69, "source.ip": "111.111.111.11", diff --git a/x-pack/filebeat/module/azure/signinlogs/test/signinlogs.log-expected.json b/x-pack/filebeat/module/azure/signinlogs/test/signinlogs.log-expected.json index 6a0f96ae261..db0643ccf25 100644 --- a/x-pack/filebeat/module/azure/signinlogs/test/signinlogs.log-expected.json +++ b/x-pack/filebeat/module/azure/signinlogs/test/signinlogs.log-expected.json @@ -66,6 +66,7 @@ "source.geo.city_name": "Farnham Royal", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "GB", + "source.geo.country_name": "United Kingdom", "source.geo.location.lat": 51.5333, "source.geo.location.lon": -0.6167, "source.geo.region_iso_code": "GB-BKM", @@ -145,6 +146,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "8.8.8.8", diff --git a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json index ff70486fab5..ed4c2bb4d7f 100644 --- a/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json +++ b/x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json @@ -496,8 +496,8 @@ "observer.type": "Anti-Virus", "observer.vendor": "Barracuda", "related.ip": [ - "10.18.165.35", - "10.110.109.5" + "10.110.109.5", + "10.18.165.35" ], "rsa.internal.messageid": "outbound/smtp", "rsa.investigations.event_cat": 1901000000, diff --git a/x-pack/filebeat/module/cef/log/test/cef.log-expected.json b/x-pack/filebeat/module/cef/log/test/cef.log-expected.json index ca0127defbd..d2902dc24b6 100644 --- a/x-pack/filebeat/module/cef/log/test/cef.log-expected.json +++ b/x-pack/filebeat/module/cef/log/test/cef.log-expected.json @@ -45,6 +45,7 @@ "service.type": "cef", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "6.7.8.9", @@ -77,6 +78,7 @@ "destination.geo.city_name": "Moscow", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7527, "destination.geo.location.lon": 37.6172, "destination.geo.region_iso_code": "RU-MOW", @@ -114,6 +116,7 @@ "service.type": "cef", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "6.7.8.9", diff --git a/x-pack/filebeat/module/cef/log/test/checkpoint.log-expected.json b/x-pack/filebeat/module/cef/log/test/checkpoint.log-expected.json index 8d027229032..eefe063490d 100644 --- a/x-pack/filebeat/module/cef/log/test/checkpoint.log-expected.json +++ b/x-pack/filebeat/module/cef/log/test/checkpoint.log-expected.json @@ -48,6 +48,7 @@ "destination.geo.city_name": "Des Moines", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 41.6006, "destination.geo.location.lon": -93.6112, "destination.geo.region_iso_code": "US-IA", diff --git a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json index fd07aa51eca..30fc5952b01 100644 --- a/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json +++ b/x-pack/filebeat/module/checkpoint/firewall/test/checkpoint.log-expected.json @@ -150,6 +150,7 @@ "destination.geo.city_name": "Tel Aviv", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "IL", + "destination.geo.country_name": "Israel", "destination.geo.location.lat": 32.0678, "destination.geo.location.lon": 34.7647, "destination.geo.region_iso_code": "IL-TA", @@ -270,6 +271,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -388,6 +390,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -506,6 +509,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -624,6 +628,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.81.142.43", @@ -742,6 +747,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -860,6 +866,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -978,6 +985,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -1096,6 +1104,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -1214,6 +1223,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -1332,6 +1342,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -1450,6 +1461,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -1568,6 +1580,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -1686,6 +1699,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -1804,6 +1818,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -1922,6 +1937,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -2040,6 +2056,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -2206,6 +2223,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -2298,6 +2316,7 @@ "destination.geo.city_name": "Tel Aviv", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "IL", + "destination.geo.country_name": "Israel", "destination.geo.location.lat": 32.0678, "destination.geo.location.lon": 34.7647, "destination.geo.region_iso_code": "IL-TA", @@ -2526,6 +2545,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -2644,6 +2664,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -2762,6 +2783,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -2880,6 +2902,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -2998,6 +3021,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -3116,6 +3140,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -3282,6 +3307,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -3400,6 +3426,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -3518,6 +3545,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -3636,6 +3664,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -3754,6 +3783,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -3818,6 +3848,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -3990,6 +4021,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -4108,6 +4140,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -4254,6 +4287,7 @@ "destination.geo.city_name": "Tel Aviv", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "IL", + "destination.geo.country_name": "Israel", "destination.geo.location.lat": 32.0678, "destination.geo.location.lon": 34.7647, "destination.geo.region_iso_code": "IL-TA", @@ -4428,6 +4462,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.81.142.43", @@ -4546,6 +4581,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -4664,6 +4700,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -4782,6 +4819,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -4900,6 +4938,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -5018,6 +5057,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", @@ -5136,6 +5176,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -5254,6 +5295,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.41", @@ -5372,6 +5414,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.36", @@ -5490,6 +5533,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.99.234.45", @@ -5608,6 +5652,7 @@ "destination.as.organization.name": "Sucuri", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "192.124.249.31", diff --git a/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json index 73d42d43af7..66cc3da4b0c 100644 --- a/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/additional_messages.log-expected.json @@ -1136,6 +1136,7 @@ "destination.geo.city_name": "Thousand Oaks", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 34.197, "destination.geo.location.lon": -118.8199, "destination.geo.region_iso_code": "US-CA", @@ -2417,6 +2418,7 @@ "destination.geo.city_name": "Clermont-Ferrand", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 45.7838, "destination.geo.location.lon": 3.0966, "destination.geo.region_iso_code": "FR-63", @@ -2467,6 +2469,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", @@ -2542,6 +2545,7 @@ "destination.geo.city_name": "Riga", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "LV", + "destination.geo.country_name": "Latvia", "destination.geo.location.lat": 56.9496, "destination.geo.location.lon": 24.0978, "destination.geo.region_iso_code": "LV-RIX", @@ -2927,6 +2931,7 @@ "source.geo.city_name": "London", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "GB", + "source.geo.country_name": "United Kingdom", "source.geo.location.lat": 51.5888, "source.geo.location.lon": -0.0247, "source.geo.region_iso_code": "GB-ENG", @@ -2946,6 +2951,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5888, "destination.geo.location.lon": -0.0247, "destination.geo.region_iso_code": "GB-ENG", @@ -3029,6 +3035,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "8.8.8.8", @@ -3075,6 +3082,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "8.8.8.8", @@ -3093,6 +3101,7 @@ "destination.geo.city_name": "Stoke Newington", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5638, "destination.geo.location.lon": -0.0765, "destination.geo.region_iso_code": "GB-HCK", @@ -3139,6 +3148,7 @@ "source.geo.city_name": "Dublin", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "IE", + "source.geo.country_name": "Ireland", "source.geo.location.lat": 53.3338, "source.geo.location.lon": -6.2488, "source.geo.region_iso_code": "IE-L", diff --git a/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json index 94f2b616d27..a57299252ca 100644 --- a/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json @@ -509,6 +509,7 @@ "destination.address": "1.2.33.40", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "CN", + "destination.geo.country_name": "China", "destination.geo.location.lat": 23.1167, "destination.geo.location.lon": 113.25, "destination.geo.region_iso_code": "CN-GD", diff --git a/x-pack/filebeat/module/cisco/asa/test/dap_records.log-expected.json b/x-pack/filebeat/module/cisco/asa/test/dap_records.log-expected.json index bb691462f78..e86dd81aead 100644 --- a/x-pack/filebeat/module/cisco/asa/test/dap_records.log-expected.json +++ b/x-pack/filebeat/module/cisco/asa/test/dap_records.log-expected.json @@ -35,6 +35,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", diff --git a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json index 37efb99f483..b7b065dea1c 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json @@ -39,6 +39,7 @@ "destination.bytes": 145, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -147,6 +148,7 @@ "destination.bytes": 193, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -253,6 +255,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -361,6 +364,7 @@ "destination.bytes": 200, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -468,6 +472,7 @@ "destination.bytes": 193, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -574,6 +579,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -683,6 +689,7 @@ "destination.bytes": 199, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -789,6 +796,7 @@ "destination.bytes": 221, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -896,6 +904,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1004,6 +1013,7 @@ "destination.bytes": 722, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1111,6 +1121,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6109, "destination.geo.location.lon": -122.3303, "destination.geo.region_iso_code": "US-WA", @@ -1217,6 +1228,7 @@ "destination.bytes": 313, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1322,6 +1334,7 @@ "destination.bytes": 180, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 48.8582, "destination.geo.location.lon": 2.3387, "destination.ip": "9.9.9.9", @@ -1428,6 +1441,7 @@ "destination.bytes": 108, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 48.8582, "destination.geo.location.lon": 2.3387, "destination.ip": "9.9.9.9", @@ -1535,6 +1549,7 @@ "destination.bytes": 162, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 48.8582, "destination.geo.location.lon": 2.3387, "destination.ip": "9.9.9.9", @@ -1643,6 +1658,7 @@ "destination.bytes": 199, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1749,6 +1765,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1855,6 +1872,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1961,6 +1979,7 @@ "destination.bytes": 221, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2066,6 +2085,7 @@ "destination.bytes": 131, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2173,6 +2193,7 @@ "destination.bytes": 722, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json index 3cef5df9a0f..7490bc1ac57 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json @@ -217,6 +217,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -321,6 +322,7 @@ "destination.bytes": 314, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -422,6 +424,7 @@ "destination.geo.city_name": "Frankfurt am Main", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 50.1188, "destination.geo.location.lon": 8.6843, "destination.geo.region_iso_code": "DE-HE", @@ -526,6 +529,7 @@ "destination.geo.city_name": "Frankfurt am Main", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 50.1188, "destination.geo.location.lon": 8.6843, "destination.geo.region_iso_code": "DE-HE", @@ -633,6 +637,7 @@ "destination.geo.city_name": "Magdeburg", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 52.1333, "destination.geo.location.lon": 11.6167, "destination.geo.region_iso_code": "DE-ST", @@ -736,6 +741,7 @@ "destination.geo.city_name": "Magdeburg", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 52.1333, "destination.geo.location.lon": 11.6167, "destination.geo.region_iso_code": "DE-ST", diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json index 8ab3e55fc87..135a2979210 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-file-malware.log-expected.json @@ -581,6 +581,7 @@ "destination.geo.city_name": "Magdeburg", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 52.1333, "destination.geo.location.lon": 11.6167, "destination.geo.region_iso_code": "DE-ST", @@ -763,6 +764,7 @@ "destination.geo.city_name": "Frankfurt am Main", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 50.1188, "destination.geo.location.lon": 8.6843, "destination.geo.region_iso_code": "DE-HE", diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json index 73ab6378da1..0b669eb5dff 100644 --- a/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json +++ b/x-pack/filebeat/module/cisco/ftd/test/security-malware-site.log-expected.json @@ -44,6 +44,7 @@ "destination.bytes": 246, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 48.8582, "destination.geo.location.lon": 2.3387, "destination.ip": "2.2.2.2", @@ -102,6 +103,7 @@ "source.geo.city_name": "Seattle", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 47.6348, "source.geo.location.lon": -122.3451, "source.geo.region_iso_code": "US-WA", diff --git a/x-pack/filebeat/module/cisco/ios/test/cisco-ios-syslog.log-expected.json b/x-pack/filebeat/module/cisco/ios/test/cisco-ios-syslog.log-expected.json index 3485b3ff583..0695d3730aa 100644 --- a/x-pack/filebeat/module/cisco/ios/test/cisco-ios-syslog.log-expected.json +++ b/x-pack/filebeat/module/cisco/ios/test/cisco-ios-syslog.log-expected.json @@ -331,6 +331,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.10.46", @@ -828,6 +829,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.10.46", @@ -1022,6 +1024,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.10.46", @@ -1122,6 +1125,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1210,6 +1214,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "8.8.8.8", @@ -1296,6 +1301,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.10.46", @@ -1537,6 +1543,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.10.46", diff --git a/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json index beeffa9b5eb..93b25705912 100644 --- a/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cisco/meraki/test/generated.log-expected.json @@ -122,8 +122,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.155.236.240", - "10.112.46.169" + "10.112.46.169", + "10.155.236.240" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -345,8 +345,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.134.0.141", - "10.210.213.18" + "10.210.213.18", + "10.134.0.141" ], "rsa.internal.event_desc": "atquovosecurity_event iumto", "rsa.internal.messageid": "security_event", @@ -519,8 +519,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.85.10.165", - "10.53.150.119" + "10.53.150.119", + "10.85.10.165" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -623,8 +623,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.205.47.51", - "10.219.84.37" + "10.219.84.37", + "10.205.47.51" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -831,8 +831,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.31.77.157", - "10.12.182.70" + "10.12.182.70", + "10.31.77.157" ], "rsa.internal.event_desc": "uiac security_event epte", "rsa.internal.messageid": "security_event", @@ -896,8 +896,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.135.217.12", - "10.93.68.231" + "10.93.68.231", + "10.135.217.12" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -960,8 +960,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.247.30.212", - "10.66.89.5" + "10.66.89.5", + "10.247.30.212" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -1064,8 +1064,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.54.37.86", - "10.58.64.108" + "10.58.64.108", + "10.54.37.86" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -1142,8 +1142,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.183.44.198", - "10.0.200.27" + "10.0.200.27", + "10.183.44.198" ], "rsa.internal.event_desc": "uradi security_event tot", "rsa.internal.messageid": "security_event", @@ -1177,8 +1177,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.148.124.84", - "10.28.144.180" + "10.28.144.180", + "10.148.124.84" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -1215,8 +1215,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.98.194.212", - "10.204.230.166" + "10.204.230.166", + "10.98.194.212" ], "rsa.counters.dclass_r1": "enimadmi", "rsa.internal.messageid": "events", @@ -1312,8 +1312,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.150.245.88", - "10.242.77.170" + "10.242.77.170", + "10.150.245.88" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -1447,8 +1447,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.230.6.127", - "10.111.157.56" + "10.111.157.56", + "10.230.6.127" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -1486,8 +1486,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.179.40.170", - "10.193.219.34" + "10.193.219.34", + "10.179.40.170" ], "rsa.counters.dclass_r1": "emip", "rsa.internal.messageid": "events", @@ -1638,8 +1638,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.124.63.4", - "10.90.99.245" + "10.90.99.245", + "10.124.63.4" ], "rsa.internal.event_desc": "etconsec", "rsa.internal.messageid": "security_event", @@ -1733,8 +1733,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.196.96.162", - "10.81.234.34" + "10.81.234.34", + "10.196.96.162" ], "rsa.internal.event_desc": "Utenima security_event iqua", "rsa.internal.messageid": "security_event", @@ -1903,8 +1903,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.86.188.179", - "10.201.168.116" + "10.201.168.116", + "10.86.188.179" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -2011,8 +2011,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.120.4.9", - "10.97.46.16" + "10.97.46.16", + "10.120.4.9" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -2084,8 +2084,8 @@ "uames4985.mail.localdomain" ], "related.ip": [ - "10.150.163.151", - "10.144.57.239" + "10.144.57.239", + "10.150.163.151" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -2126,8 +2126,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.54.44.231", - "10.52.202.158" + "10.52.202.158", + "10.54.44.231" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -2252,8 +2252,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.2.110.73", - "10.103.49.129" + "10.103.49.129", + "10.2.110.73" ], "rsa.counters.dclass_r1": "orumS", "rsa.internal.messageid": "events", @@ -2292,8 +2292,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.132.176.96", - "10.158.61.228" + "10.158.61.228", + "10.132.176.96" ], "rsa.counters.dclass_r1": "eserun", "rsa.internal.messageid": "events", @@ -2333,8 +2333,8 @@ "lors2232.api.example" ], "related.ip": [ - "10.46.217.155", - "10.105.136.146" + "10.105.136.146", + "10.46.217.155" ], "rsa.internal.messageid": "events", "rsa.misc.event_source": "appliance", @@ -2374,8 +2374,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.123.62.215", - "10.245.199.23" + "10.245.199.23", + "10.123.62.215" ], "rsa.db.index": "iusmodt", "rsa.internal.messageid": "flows", @@ -2480,8 +2480,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.246.152.72", - "10.34.62.190" + "10.34.62.190", + "10.246.152.72" ], "rsa.internal.event_desc": "Nem", "rsa.internal.messageid": "security_event", @@ -2758,8 +2758,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.65.0.157", - "10.17.111.91" + "10.17.111.91", + "10.65.0.157" ], "rsa.db.index": "nostrum", "rsa.internal.messageid": "flows", @@ -2893,8 +2893,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.199.103.185", - "10.51.121.223" + "10.51.121.223", + "10.199.103.185" ], "rsa.internal.event_desc": "dipi security_event ecatc", "rsa.internal.messageid": "security_event", @@ -2988,8 +2988,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.113.152.241", - "10.121.37.244" + "10.121.37.244", + "10.113.152.241" ], "rsa.internal.messageid": "flows", "rsa.misc.action": [ @@ -3067,8 +3067,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.200.98.243", - "10.101.13.122" + "10.101.13.122", + "10.200.98.243" ], "rsa.counters.dclass_r1": "uteirur", "rsa.internal.messageid": "events", @@ -3143,8 +3143,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.147.165.30", - "10.195.90.73" + "10.195.90.73", + "10.147.165.30" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -3206,8 +3206,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.162.202.14", - "10.137.166.97" + "10.137.166.97", + "10.162.202.14" ], "rsa.internal.messageid": "ids-alerts", "rsa.misc.event_type": "ids-alerts", @@ -3330,8 +3330,8 @@ "observer.type": "Wireless", "observer.vendor": "Cisco", "related.ip": [ - "10.75.122.111", - "10.85.59.172" + "10.85.59.172", + "10.75.122.111" ], "rsa.counters.dclass_r1": "sequat", "rsa.internal.messageid": "events", diff --git a/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json index cb772d91268..837f7b744a7 100644 --- a/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json +++ b/x-pack/filebeat/module/citrix/netscaler/test/generated.log-expected.json @@ -101,8 +101,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.72.11.247", - "10.134.175.248" + "10.134.175.248", + "10.72.11.247" ], "rsa.counters.dclass_c1": 1279, "rsa.db.index": "antium", @@ -185,10 +185,10 @@ "observer.vendor": "Citrix", "related.ip": [ "10.96.119.12", + "10.156.210.168", "10.21.92.218", - "10.83.234.60", "10.109.68.21", - "10.156.210.168" + "10.83.234.60" ], "related.user": [ "picia" @@ -1332,11 +1332,11 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.45.114.111", - "10.180.83.140", - "10.243.226.122", "10.117.94.131", - "10.3.23.172" + "10.180.83.140", + "10.3.23.172", + "10.45.114.111", + "10.243.226.122" ], "related.user": [ "ehender" @@ -2085,8 +2085,8 @@ "observer.vendor": "Citrix", "related.ip": [ "10.225.146.5", - "10.41.65.89", - "10.80.5.101" + "10.80.5.101", + "10.41.65.89" ], "related.user": [ "picia" @@ -2209,8 +2209,8 @@ "observer.vendor": "Citrix", "related.ip": [ "10.33.231.173", - "10.183.26.222", - "10.22.34.206" + "10.22.34.206", + "10.183.26.222" ], "related.user": [ "abill" @@ -2585,10 +2585,10 @@ "observer.vendor": "Citrix", "related.ip": [ "10.148.244.55", + "10.76.129.136", "10.133.153.174", - "10.8.82.22", "10.113.135.78", - "10.76.129.136" + "10.8.82.22" ], "related.user": [ "asiar" @@ -2662,8 +2662,8 @@ "rsa.db.index": "aturE", "rsa.internal.messageid": "APPFW_REFERER_HEADER", "rsa.misc.action": [ - "remip", - "cancel" + "cancel", + "remip" ], "rsa.misc.policy_name": "oNemoeni", "rsa.misc.rule": "citation", @@ -2938,9 +2938,9 @@ "observer.vendor": "Citrix", "related.ip": [ "10.29.202.248", - "10.161.218.47", + "10.206.5.50", "10.247.251.223", - "10.206.5.50" + "10.161.218.47" ], "rsa.internal.event_desc": "A Server side and a Client side TCP connection is delinked. This is not tracked by Netscaler", "rsa.internal.messageid": "TCP_OTHERCONN_DELINK", @@ -3076,8 +3076,8 @@ "observer.type": "Firewall", "observer.vendor": "Citrix", "related.ip": [ - "10.148.72.78", - "10.37.99.189" + "10.37.99.189", + "10.148.72.78" ], "rsa.crypto.cipher_src": "ritatis", "rsa.crypto.ssl_ver_src": "ugitsed", diff --git a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json index 2bf31b06a52..4056ed473ca 100644 --- a/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json +++ b/x-pack/filebeat/module/cyberark/corepas/test/generated.log-expected.json @@ -20,9 +20,9 @@ "10.208.15.216" ], "related.user": [ - "quasiarc", "itv", - "utl" + "utl", + "quasiarc" ], "rsa.db.index": "nes", "rsa.internal.event_desc": "pexe", @@ -71,9 +71,9 @@ "10.175.75.18" ], "related.user": [ + "dolore", "nnumqu", - "orev", - "dolore" + "orev" ], "rsa.db.database": "umdo", "rsa.db.index": "vol", @@ -130,8 +130,8 @@ "anti4454.api.example" ], "related.ip": [ - "10.51.132.10", - "10.46.185.46" + "10.46.185.46", + "10.51.132.10" ], "related.user": [ "incid", @@ -197,9 +197,9 @@ "10.53.192.140" ], "related.user": [ - "psumquia", + "atcup", "ptass", - "atcup" + "psumquia" ], "rsa.db.database": "aperi", "rsa.db.index": "llumd", @@ -253,9 +253,9 @@ "10.81.199.122" ], "related.user": [ - "oremips", + "eos", "giatq", - "eos" + "oremips" ], "rsa.db.index": "tempo", "rsa.internal.event_desc": "uian", @@ -300,13 +300,13 @@ "temq1198.internal.example" ], "related.ip": [ - "10.139.186.201", - "10.172.14.142" + "10.172.14.142", + "10.139.186.201" ], "related.user": [ + "uam", "tcupida", - "aboris", - "uam" + "aboris" ], "rsa.db.database": "isiu", "rsa.db.index": "iatisu", @@ -363,13 +363,13 @@ "tenbyCic5882.api.home" ], "related.ip": [ - "10.104.111.129", - "10.47.76.251" + "10.47.76.251", + "10.104.111.129" ], "related.user": [ - "ele", "etconsec", - "ipis" + "ipis", + "ele" ], "rsa.db.database": "riat", "rsa.db.index": "umdolor", @@ -423,9 +423,9 @@ "10.116.120.216" ], "related.user": [ + "quiratio", "umdo", - "animi", - "quiratio" + "animi" ], "rsa.db.index": "oll", "rsa.internal.event_desc": "rumet", @@ -474,9 +474,9 @@ "10.62.54.220" ], "related.user": [ - "taevi", "psum", - "rnatura" + "rnatura", + "taevi" ], "rsa.db.database": "emeumfug", "rsa.db.index": "omn", @@ -530,9 +530,9 @@ "10.74.237.180" ], "related.user": [ - "tnon", "ema", - "cup" + "cup", + "tnon" ], "rsa.db.index": "remeumf", "rsa.internal.event_desc": "lup", @@ -574,8 +574,8 @@ "10.18.165.35" ], "related.user": [ - "modocons", "remeum", + "modocons", "lor" ], "rsa.db.index": "etM", @@ -618,9 +618,9 @@ "10.74.253.127" ], "related.user": [ + "onproide", "icab", - "tema", - "onproide" + "tema" ], "rsa.db.index": "mqui", "rsa.internal.event_desc": "eomnisis", @@ -664,8 +664,8 @@ "tlabo6088.www.localdomain" ], "related.ip": [ - "10.92.8.15", - "10.189.109.245" + "10.189.109.245", + "10.92.8.15" ], "related.user": [ "inima", @@ -722,9 +722,9 @@ "10.21.78.128" ], "related.user": [ - "upt", + "giatquov", "taut", - "giatquov" + "upt" ], "rsa.db.index": "iadese", "rsa.internal.event_desc": "deFinibu", @@ -766,9 +766,9 @@ "10.18.109.121" ], "related.user": [ - "pida", "hil", - "tatn" + "tatn", + "pida" ], "rsa.db.index": "quip", "rsa.internal.event_desc": "ecillu", @@ -813,13 +813,13 @@ "iavolu5352.localhost" ], "related.ip": [ - "10.63.37.192", - "10.225.115.13" + "10.225.115.13", + "10.63.37.192" ], "related.user": [ "iunt", - "reetd", - "equep" + "equep", + "reetd" ], "rsa.db.database": "aliqu", "rsa.db.index": "mipsumd", @@ -876,13 +876,13 @@ "estiae3750.api.corp" ], "related.ip": [ - "10.47.202.102", - "10.95.64.124" + "10.95.64.124", + "10.47.202.102" ], "related.user": [ "run", - "ice", - "ntor" + "ntor", + "ice" ], "rsa.db.database": "ite", "rsa.db.index": "iquipex", @@ -999,13 +999,13 @@ "etMalor4236.www5.host" ], "related.ip": [ - "10.53.168.235", - "10.125.160.129" + "10.125.160.129", + "10.53.168.235" ], "related.user": [ "abi", - "one", - "ione" + "ione", + "one" ], "rsa.db.database": "sperna", "rsa.db.index": "estia", @@ -1066,9 +1066,9 @@ "10.227.177.121" ], "related.user": [ - "iduntu", "liqui", - "tasuntex" + "tasuntex", + "iduntu" ], "rsa.db.database": "rvel", "rsa.db.index": "onsecte", @@ -1129,8 +1129,8 @@ "nsecte3304.mail.corp" ], "related.ip": [ - "10.98.182.220", - "10.167.85.181" + "10.167.85.181", + "10.98.182.220" ], "related.user": [ "fde", @@ -1189,9 +1189,9 @@ "10.89.208.95" ], "related.user": [ + "iciadese", "icabo", - "sintoc", - "iciadese" + "sintoc" ], "rsa.db.index": "eni", "rsa.internal.event_desc": "rcitati", @@ -1236,13 +1236,13 @@ "nevo4284.internal.local" ], "related.ip": [ - "10.72.148.32", - "10.214.191.180" + "10.214.191.180", + "10.72.148.32" ], "related.user": [ + "uteirure", "tDuisaut", - "luptatev", - "uteirure" + "luptatev" ], "rsa.db.database": "uamest", "rsa.db.index": "uae", @@ -1299,13 +1299,13 @@ "itas981.mail.domain" ], "related.ip": [ - "10.252.124.150", - "10.136.190.236" + "10.136.190.236", + "10.252.124.150" ], "related.user": [ - "ipsumd", + "com", "litessec", - "com" + "ipsumd" ], "rsa.db.database": "tasn", "rsa.db.index": "squirati", @@ -1424,12 +1424,12 @@ "rQuisau5300.www5.example" ], "related.ip": [ - "10.154.4.197", - "10.216.84.30" + "10.216.84.30", + "10.154.4.197" ], "related.user": [ - "untu", - "intoc" + "intoc", + "untu" ], "rsa.db.database": "oditem", "rsa.db.index": "borios", @@ -1529,13 +1529,13 @@ "uamei2389.internal.example" ], "related.ip": [ - "10.65.175.9", - "10.193.83.81" + "10.193.83.81", + "10.65.175.9" ], "related.user": [ - "umqu", "ritatise", - "essequam" + "essequam", + "umqu" ], "rsa.db.database": "ender", "rsa.db.index": "entorev", @@ -1589,9 +1589,9 @@ "10.205.72.243" ], "related.user": [ - "umdolo", "isiuta", - "tatn" + "tatn", + "umdolo" ], "rsa.db.index": "proide", "rsa.internal.event_desc": "ameiusm", @@ -1633,8 +1633,8 @@ "10.107.9.163" ], "related.user": [ - "mquisno", "sit", + "mquisno", "mac" ], "rsa.db.index": "sit", @@ -1677,9 +1677,9 @@ "10.80.101.72" ], "related.user": [ - "asiarc", + "umSe", "quidexea", - "umSe" + "asiarc" ], "rsa.db.index": "veli", "rsa.internal.event_desc": "quatu", @@ -1728,8 +1728,8 @@ "10.39.10.155" ], "related.user": [ - "aboreetd", "urExcept", + "aboreetd", "ptass" ], "rsa.db.database": "teirured", @@ -1828,9 +1828,9 @@ "10.71.238.250" ], "related.user": [ - "reseo", + "moenimi", "aec", - "moenimi" + "reseo" ], "rsa.db.index": "mac", "rsa.internal.event_desc": "quamest", @@ -1875,13 +1875,13 @@ "rum5798.home" ], "related.ip": [ - "10.226.101.180", - "10.226.20.199" + "10.226.20.199", + "10.226.101.180" ], "related.user": [ + "ritt", "rationev", - "veniamqu", - "ritt" + "veniamqu" ], "rsa.db.database": "conse", "rsa.db.index": "imveniam", @@ -1944,8 +1944,8 @@ ], "related.user": [ "quaUten", - "cab", - "utaliqu" + "utaliqu", + "cab" ], "rsa.db.database": "isciv", "rsa.db.index": "nofd", @@ -2002,9 +2002,9 @@ "10.70.147.120" ], "related.user": [ + "cidunt", "tten", - "emqu", - "cidunt" + "emqu" ], "rsa.db.index": "eaqu", "rsa.internal.event_desc": "quidol", @@ -2049,12 +2049,12 @@ "tesse1089.www.host" ], "related.ip": [ - "10.178.242.100", - "10.24.111.229" + "10.24.111.229", + "10.178.242.100" ], "related.user": [ - "loi", "dqu", + "loi", "idid" ], "rsa.db.database": "tenatuse", @@ -2110,8 +2110,8 @@ ], "related.user": [ "ritati", - "mmodoc", - "untincul" + "untincul", + "mmodoc" ], "rsa.db.index": "emvele", "rsa.internal.event_desc": "oluptas", @@ -2153,9 +2153,9 @@ "10.30.243.163" ], "related.user": [ + "illu", "mven", - "dolore", - "illu" + "dolore" ], "rsa.db.index": "idol", "rsa.internal.event_desc": "lore", @@ -2204,9 +2204,9 @@ "10.6.79.159" ], "related.user": [ - "midestl", + "amvo", "quid", - "amvo" + "midestl" ], "rsa.db.database": "urExce", "rsa.db.index": "ectiono", @@ -2263,13 +2263,13 @@ "aecatcup2241.www5.test" ], "related.ip": [ - "10.237.170.202", - "10.70.147.46" + "10.70.147.46", + "10.237.170.202" ], "related.user": [ "liquide", - "atDu", - "rcit" + "rcit", + "atDu" ], "rsa.db.database": "taedict", "rsa.db.index": "loremeu", @@ -2326,13 +2326,13 @@ "mad5185.www5.localhost" ], "related.ip": [ - "10.228.118.81", - "10.179.50.138" + "10.179.50.138", + "10.228.118.81" ], "related.user": [ "emoe", - "itasper", - "tatemU" + "tatemU", + "itasper" ], "rsa.db.database": "toditaut", "rsa.db.index": "ugit", @@ -2393,9 +2393,9 @@ "10.234.165.130" ], "related.user": [ + "henderit", "emip", - "iuntNequ", - "henderit" + "iuntNequ" ], "rsa.db.database": "veniamqu", "rsa.db.index": "atquo", @@ -2449,8 +2449,8 @@ "10.199.5.49" ], "related.user": [ - "turadipi", "emip", + "turadipi", "olorema" ], "rsa.db.index": "ataevi", @@ -2544,9 +2544,9 @@ "10.120.167.217" ], "related.user": [ - "animid", "dolorem", - "rsp" + "rsp", + "animid" ], "rsa.db.database": "tsuntinc", "rsa.db.index": "quovo", @@ -2603,13 +2603,13 @@ "mporainc2064.home" ], "related.ip": [ - "10.117.137.159", - "10.141.213.219" + "10.141.213.219", + "10.117.137.159" ], "related.user": [ "accusa", - "ate", - "atev" + "atev", + "ate" ], "rsa.db.database": "nibus", "rsa.db.index": "ser", @@ -2671,8 +2671,8 @@ ], "related.user": [ "eavol", - "rem", - "etconsec" + "etconsec", + "rem" ], "rsa.db.database": "oditempo", "rsa.db.index": "deF", @@ -2735,8 +2735,8 @@ "10.38.28.151" ], "related.user": [ - "tiumto", "incidid", + "tiumto", "mipsumqu" ], "rsa.db.database": "abor", @@ -2796,13 +2796,13 @@ "dolori6232.api.invalid" ], "related.ip": [ - "10.255.28.56", - "10.214.245.95" + "10.214.245.95", + "10.255.28.56" ], "related.user": [ "umdolors", - "uptatem", - "rerepre" + "rerepre", + "uptatem" ], "rsa.db.database": "odt", "rsa.db.index": "riosa", @@ -2856,8 +2856,8 @@ "10.45.35.180" ], "related.user": [ - "mip", "Utenima", + "mip", "qui" ], "rsa.db.index": "boree", @@ -2900,9 +2900,9 @@ "10.141.200.133" ], "related.user": [ - "enim", "iame", - "ess" + "ess", + "enim" ], "rsa.db.index": "nofdeFi", "rsa.internal.event_desc": "isnostru", @@ -2944,9 +2944,9 @@ "10.83.238.145" ], "related.user": [ - "ugi", + "runtmo", "illoi", - "runtmo" + "ugi" ], "rsa.db.index": "eetdo", "rsa.internal.event_desc": "quaer", @@ -2995,9 +2995,9 @@ "10.39.143.155" ], "related.user": [ + "sedquiac", "tem", - "tperspic", - "sedquiac" + "tperspic" ], "rsa.db.database": "radipis", "rsa.db.index": "nse", @@ -3059,8 +3059,8 @@ ], "related.user": [ "minim", - "unt", - "CSe" + "CSe", + "unt" ], "rsa.db.database": "atu", "rsa.db.index": "roi", @@ -3117,13 +3117,13 @@ "olu5333.www.domain" ], "related.ip": [ - "10.168.132.175", - "10.210.61.109" + "10.210.61.109", + "10.168.132.175" ], "related.user": [ + "eursinto", "giatquov", - "iamea", - "eursinto" + "iamea" ], "rsa.db.database": "ici", "rsa.db.index": "iquaUt", @@ -3223,8 +3223,8 @@ ], "related.user": [ "oeni", - "etquasia", - "xplic" + "xplic", + "etquasia" ], "rsa.db.index": "hend", "rsa.internal.event_desc": "piscivel", @@ -3271,8 +3271,8 @@ ], "related.user": [ "rsitvol", - "iati", - "Nemoenim" + "Nemoenim", + "iati" ], "rsa.db.index": "eFini", "rsa.internal.event_desc": "acom", @@ -3322,8 +3322,8 @@ ], "related.user": [ "orissu", - "eufug", - "ine" + "ine", + "eufug" ], "rsa.db.database": "stquidol", "rsa.db.index": "imadmini", @@ -3377,9 +3377,9 @@ "10.70.83.200" ], "related.user": [ - "ihilmole", + "metco", "riat", - "metco" + "ihilmole" ], "rsa.db.index": "urQuis", "rsa.internal.event_desc": "iutaliq", @@ -3491,9 +3491,9 @@ "10.52.150.104" ], "related.user": [ - "texplica", "eritq", - "oinBCSed" + "oinBCSed", + "texplica" ], "rsa.db.database": "lit", "rsa.db.index": "ritati", @@ -3554,9 +3554,9 @@ "10.61.175.217" ], "related.user": [ + "runtm", "ntexpl", - "tat", - "runtm" + "tat" ], "rsa.db.database": "rere", "rsa.db.index": "nonn", @@ -3610,9 +3610,9 @@ "10.150.30.95" ], "related.user": [ - "atnonpr", + "mini", "uisnos", - "mini" + "atnonpr" ], "rsa.db.index": "smod", "rsa.internal.event_desc": "isn", @@ -3654,8 +3654,8 @@ "10.98.71.45" ], "related.user": [ - "CSe", "fugitse", + "CSe", "onse" ], "rsa.db.index": "Dui", @@ -3698,9 +3698,9 @@ "10.252.251.143" ], "related.user": [ + "nonn", "remq", - "rspic", - "nonn" + "rspic" ], "rsa.db.index": "nre", "rsa.internal.event_desc": "tev", @@ -3742,8 +3742,8 @@ "10.197.203.167" ], "related.user": [ - "uta", "iumdo", + "uta", "eserun" ], "rsa.db.index": "smo", @@ -3786,9 +3786,9 @@ "10.187.170.23" ], "related.user": [ + "ibusBo", "sectetu", - "enima", - "ibusBo" + "enima" ], "rsa.db.index": "uido", "rsa.internal.event_desc": "lab", @@ -3833,13 +3833,13 @@ "involu1450.www.localhost" ], "related.ip": [ - "10.250.248.215", - "10.123.62.215" + "10.123.62.215", + "10.250.248.215" ], "related.user": [ "aevitaed", - "quaeratv", - "tinculpa" + "tinculpa", + "quaeratv" ], "rsa.db.database": "lica", "rsa.db.index": "uisnos", @@ -3997,9 +3997,9 @@ "10.154.172.82" ], "related.user": [ + "onnumqua", "nesci", - "tetura", - "onnumqua" + "tetura" ], "rsa.db.index": "oinBCSed", "rsa.internal.event_desc": "ntor", @@ -4041,9 +4041,9 @@ "10.47.63.70" ], "related.user": [ - "expl", "tpers", - "midestl" + "midestl", + "expl" ], "rsa.db.index": "olu", "rsa.internal.event_desc": "odocons", @@ -4085,9 +4085,9 @@ "10.178.160.245" ], "related.user": [ + "fdeFinib", "turQuis", - "olupta", - "fdeFinib" + "olupta" ], "rsa.db.index": "rsint", "rsa.internal.event_desc": "odico", @@ -4195,13 +4195,13 @@ "nimve2787.mail.test" ], "related.ip": [ - "10.222.32.183", - "10.65.207.234" + "10.65.207.234", + "10.222.32.183" ], "related.user": [ + "eve", "itame", - "eruntmo", - "eve" + "eruntmo" ], "rsa.db.database": "udexerc", "rsa.db.index": "volup", @@ -4255,8 +4255,8 @@ "10.16.181.60" ], "related.user": [ - "oinven", "gnama", + "oinven", "olore" ], "rsa.db.index": "uatu", @@ -4299,9 +4299,9 @@ "10.91.213.82" ], "related.user": [ - "illoin", "amnis", - "uianon" + "uianon", + "illoin" ], "rsa.db.index": "ons", "rsa.internal.event_desc": "temaccus", @@ -4343,9 +4343,9 @@ "10.204.214.98" ], "related.user": [ + "porissus", "tdolo", - "eprehe", - "porissus" + "eprehe" ], "rsa.db.index": "abo", "rsa.internal.event_desc": "ecte", @@ -4388,8 +4388,8 @@ ], "related.user": [ "etc", - "moenimip", - "evel" + "evel", + "moenimip" ], "rsa.db.index": "iarchit", "rsa.internal.event_desc": "apari", @@ -4434,13 +4434,13 @@ "ama6820.mail.example" ], "related.ip": [ - "10.26.33.181", - "10.26.137.126" + "10.26.137.126", + "10.26.33.181" ], "related.user": [ - "audant", + "taevit", "ati", - "taevit" + "audant" ], "rsa.db.database": "com", "rsa.db.index": "mveni", @@ -4497,13 +4497,13 @@ "olupt966.www5.corp" ], "related.ip": [ - "10.142.161.116", - "10.148.195.208" + "10.148.195.208", + "10.142.161.116" ], "related.user": [ - "mpori", "isi", - "quaerat" + "quaerat", + "mpori" ], "rsa.db.database": "squamest", "rsa.db.index": "pteu", @@ -4560,13 +4560,13 @@ "lit4112.www.localhost" ], "related.ip": [ - "10.10.174.253", - "10.107.24.54" + "10.107.24.54", + "10.10.174.253" ], "related.user": [ - "hend", + "itinvo", "uptasn", - "itinvo" + "hend" ], "rsa.db.database": "lup", "rsa.db.index": "isau", @@ -4621,8 +4621,8 @@ "10.87.92.17" ], "related.user": [ - "tamr", "luptate", + "tamr", "eeufug" ], "rsa.db.index": "oreeufug", @@ -4672,13 +4672,13 @@ "dictasun3408.internal.invalid" ], "related.ip": [ - "10.161.51.135", - "10.231.51.136" + "10.231.51.136", + "10.161.51.135" ], "related.user": [ "Finibus", - "asper", - "accus" + "accus", + "asper" ], "rsa.db.database": "litani", "rsa.db.index": "arch", @@ -4732,9 +4732,9 @@ "10.51.17.32" ], "related.user": [ + "itten", "mquido", - "llum", - "itten" + "llum" ], "rsa.db.index": "uscipit", "rsa.internal.event_desc": "llitani", @@ -4776,9 +4776,9 @@ "10.108.123.148" ], "related.user": [ - "cusa", + "ollita", "mmodicon", - "ollita" + "cusa" ], "rsa.db.index": "ercitati", "rsa.internal.event_desc": "pteurs", @@ -4828,8 +4828,8 @@ "10.198.187.144" ], "related.user": [ - "rsitamet", "equatD", + "rsitamet", "ons" ], "rsa.db.database": "periam", @@ -4888,9 +4888,9 @@ "10.61.140.120" ], "related.user": [ - "naaliq", "loru", - "equa" + "equa", + "naaliq" ], "rsa.db.index": "umfugiat", "rsa.internal.event_desc": "ora", @@ -4939,9 +4939,9 @@ "10.93.24.151" ], "related.user": [ - "sequamn", "ite", - "nven" + "nven", + "sequamn" ], "rsa.db.database": "fugi", "rsa.db.index": "nesciu", @@ -4995,9 +4995,9 @@ "10.101.45.225" ], "related.user": [ - "cipitla", "emi", - "uinesc" + "uinesc", + "cipitla" ], "rsa.db.index": "caecat", "rsa.internal.event_desc": "tsunt", @@ -5088,9 +5088,9 @@ "10.33.112.100" ], "related.user": [ - "ptatemse", "aliqu", - "enimad" + "enimad", + "ptatemse" ], "rsa.db.index": "Except", "rsa.internal.event_desc": "cons", @@ -5135,12 +5135,12 @@ "isno4595.local" ], "related.ip": [ - "10.151.110.250", - "10.94.152.238" + "10.94.152.238", + "10.151.110.250" ], "related.user": [ - "tla", "neavol", + "tla", "pidatatn" ], "rsa.db.database": "itaedict", @@ -5198,13 +5198,13 @@ "tatemse5403.home" ], "related.ip": [ - "10.146.61.5", - "10.77.9.17" + "10.77.9.17", + "10.146.61.5" ], "related.user": [ - "tevel", "umS", - "alorumwr" + "alorumwr", + "tevel" ], "rsa.db.database": "amremap", "rsa.db.index": "aqu", @@ -5305,8 +5305,8 @@ "reprehe650.www.corp" ], "related.ip": [ - "10.200.162.248", - "10.31.86.83" + "10.31.86.83", + "10.200.162.248" ], "related.user": [ "onnu", diff --git a/x-pack/filebeat/module/envoyproxy/log/test/envoy-json.log-expected.json b/x-pack/filebeat/module/envoyproxy/log/test/envoy-json.log-expected.json index e6ca9516ad0..483625d8bea 100644 --- a/x-pack/filebeat/module/envoyproxy/log/test/envoy-json.log-expected.json +++ b/x-pack/filebeat/module/envoyproxy/log/test/envoy-json.log-expected.json @@ -7,6 +7,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", diff --git a/x-pack/filebeat/module/envoyproxy/log/test/envoy.log-expected.json b/x-pack/filebeat/module/envoyproxy/log/test/envoy.log-expected.json index 1c9482cefdb..703b5e977b3 100644 --- a/x-pack/filebeat/module/envoyproxy/log/test/envoy.log-expected.json +++ b/x-pack/filebeat/module/envoyproxy/log/test/envoy.log-expected.json @@ -140,6 +140,7 @@ "destination.as.organization.name": "Fastly", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "151.101.66.217", diff --git a/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json index d1729062282..13fe3560c05 100644 --- a/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/f5/bigipafm/test/generated.log-expected.json @@ -24,10 +24,10 @@ "tatemac3541.api.corp" ], "related.ip": [ + "10.208.121.85", "10.165.201.71", - "10.228.193.207", "10.11.196.142", - "10.208.121.85" + "10.228.193.207" ], "related.user": [ "billoi" @@ -93,9 +93,9 @@ ], "related.ip": [ "10.51.132.10", - "10.162.9.235", + "10.92.202.200", "10.94.67.230", - "10.92.202.200" + "10.162.9.235" ], "related.user": [ "byC" @@ -228,9 +228,9 @@ ], "related.ip": [ "10.12.44.169", - "10.202.66.28", + "10.131.233.27", "10.50.112.141", - "10.131.233.27" + "10.202.66.28" ], "related.user": [ "elits" @@ -296,9 +296,9 @@ ], "related.ip": [ "10.159.182.171", + "10.206.197.113", "10.151.111.38", - "10.96.35.212", - "10.206.197.113" + "10.96.35.212" ], "related.user": [ "mol" @@ -365,8 +365,8 @@ "related.ip": [ "10.126.177.162", "10.213.113.28", - "10.169.144.147", - "10.89.163.114" + "10.89.163.114", + "10.169.144.147" ], "related.user": [ "ist" @@ -430,10 +430,10 @@ "ittenbyC7838.api.localdomain" ], "related.ip": [ - "10.101.223.43", - "10.18.124.28", + "10.146.88.52", "10.103.107.47", - "10.146.88.52" + "10.101.223.43", + "10.18.124.28" ], "related.user": [ "rudexerc" @@ -498,8 +498,8 @@ "ume465.corp" ], "related.ip": [ - "10.150.220.75", "10.189.109.245", + "10.150.220.75", "10.69.57.206", "10.110.99.17" ], @@ -565,8 +565,8 @@ "iciatisu1463.www5.localdomain" ], "related.ip": [ - "10.199.34.241", "10.121.219.204", + "10.199.34.241", "10.153.136.222", "10.19.194.101" ], @@ -632,9 +632,9 @@ "aliqu6801.api.localdomain" ], "related.ip": [ - "10.57.103.192", "10.64.141.105", "10.46.27.57", + "10.57.103.192", "10.182.199.231" ], "related.user": [ @@ -699,10 +699,10 @@ "itame189.domain" ], "related.ip": [ - "10.32.67.231", - "10.3.134.237", + "10.164.6.207", "10.160.210.31", - "10.164.6.207" + "10.3.134.237", + "10.32.67.231" ], "related.user": [ "pic" @@ -768,8 +768,8 @@ ], "related.ip": [ "10.42.138.192", - "10.201.6.10", "10.235.101.253", + "10.201.6.10", "10.182.178.217" ], "related.user": [ @@ -835,9 +835,9 @@ "stlabo1228.mail.host" ], "related.ip": [ - "10.86.101.235", - "10.194.247.171", "10.151.161.70", + "10.194.247.171", + "10.86.101.235", "10.22.102.198" ], "related.user": [ @@ -904,9 +904,9 @@ ], "related.ip": [ "10.174.252.105", - "10.204.35.15", + "10.167.172.155", "10.107.168.60", - "10.167.172.155" + "10.204.35.15" ], "related.user": [ "mnisi" @@ -971,9 +971,9 @@ ], "related.ip": [ "10.99.249.210", + "10.214.249.164", "10.182.191.174", - "10.81.26.208", - "10.214.249.164" + "10.81.26.208" ], "related.user": [ "upta" @@ -1037,9 +1037,9 @@ "sauteiru4554.api.domain" ], "related.ip": [ + "10.220.5.143", "10.88.101.53", "10.201.238.90", - "10.220.5.143", "10.101.226.128" ], "related.user": [ @@ -1104,10 +1104,10 @@ "untut4046.internal.domain" ], "related.ip": [ - "10.243.218.215", - "10.217.150.196", + "10.30.133.66", "10.157.18.252", - "10.30.133.66" + "10.243.218.215", + "10.217.150.196" ], "related.user": [ "evit" @@ -1171,10 +1171,10 @@ "quid3147.mail.home" ], "related.ip": [ - "10.167.227.44", "10.181.133.187", "10.148.161.250", - "10.66.181.6" + "10.66.181.6", + "10.167.227.44" ], "related.user": [ "adipisc" @@ -1239,10 +1239,10 @@ "umdolo1029.mail.localhost" ], "related.ip": [ - "10.74.11.43", - "10.54.17.32", "10.84.163.178", - "10.107.9.163" + "10.107.9.163", + "10.54.17.32", + "10.74.11.43" ], "related.user": [ "mquisno" @@ -1307,9 +1307,9 @@ ], "related.ip": [ "10.230.129.252", - "10.184.73.211", + "10.112.32.213", "10.192.229.221", - "10.112.32.213" + "10.184.73.211" ], "related.user": [ "odi" @@ -1374,10 +1374,10 @@ "paquioff624.mail.invalid" ], "related.ip": [ - "10.161.148.64", + "10.198.213.189", "10.199.216.143", - "10.7.200.140", - "10.198.213.189" + "10.161.148.64", + "10.7.200.140" ], "related.user": [ "ccaeca" @@ -1441,10 +1441,10 @@ "mex2054.mail.corp" ], "related.ip": [ + "10.65.232.27", "10.206.96.56", - "10.22.187.69", "10.128.157.27", - "10.65.232.27" + "10.22.187.69" ], "related.user": [ "uaeab" @@ -1509,9 +1509,9 @@ ], "related.ip": [ "10.194.210.62", - "10.68.253.120", "10.183.130.225", - "10.71.114.14" + "10.71.114.14", + "10.68.253.120" ], "related.user": [ "admin" @@ -1576,10 +1576,10 @@ "loi7596.www5.home" ], "related.ip": [ - "10.47.255.237", - "10.45.253.103", "10.107.45.175", - "10.31.177.226" + "10.31.177.226", + "10.47.255.237", + "10.45.253.103" ], "related.user": [ "remagn" @@ -1644,10 +1644,10 @@ "nsequat1971.internal.invalid" ], "related.ip": [ + "10.225.212.189", "10.44.58.106", - "10.55.105.113", "10.213.94.135", - "10.225.212.189" + "10.55.105.113" ], "related.user": [ "dquia" @@ -1711,9 +1711,9 @@ "ectiono2241.lan" ], "related.ip": [ - "10.255.74.136", "10.69.161.78", "10.163.209.70", + "10.255.74.136", "10.2.114.9" ], "related.user": [ @@ -1778,10 +1778,10 @@ "umetMal1664.mail.lan" ], "related.ip": [ - "10.46.115.216", - "10.252.102.110", + "10.184.59.148", "10.12.129.137", - "10.184.59.148" + "10.46.115.216", + "10.252.102.110" ], "related.user": [ "perspici" @@ -1848,8 +1848,8 @@ "related.ip": [ "10.81.184.7", "10.199.194.79", - "10.155.204.243", - "10.105.52.140" + "10.105.52.140", + "10.155.204.243" ], "related.user": [ "eetd" @@ -1916,8 +1916,8 @@ "related.ip": [ "10.251.231.142", "10.177.238.45", - "10.18.226.72", - "10.110.2.166" + "10.110.2.166", + "10.18.226.72" ], "related.user": [ "taliqui" @@ -1982,10 +1982,10 @@ "iutali7297.www.domain" ], "related.ip": [ + "10.192.98.247", "10.99.202.229", - "10.100.199.226", "10.190.122.27", - "10.192.98.247" + "10.100.199.226" ], "related.user": [ "lloinven" @@ -2050,10 +2050,10 @@ "orumw5960.www5.home" ], "related.ip": [ + "10.172.154.97", "10.248.111.207", - "10.162.97.197", "10.37.193.70", - "10.172.154.97" + "10.162.97.197" ], "related.user": [ "culpaq" @@ -2117,10 +2117,10 @@ "oinv5493.internal.domain" ], "related.ip": [ + "10.36.63.31", "10.171.221.230", "10.222.165.250", - "10.45.35.180", - "10.36.63.31" + "10.45.35.180" ], "related.user": [ "otamr" @@ -2184,9 +2184,9 @@ "tnonproi195.api.home" ], "related.ip": [ - "10.1.171.61", - "10.199.127.211", "10.83.238.145", + "10.199.127.211", + "10.1.171.61", "10.238.4.219" ], "related.user": [ @@ -2252,9 +2252,9 @@ ], "related.ip": [ "10.170.252.219", - "10.65.141.244", + "10.44.226.104", "10.74.213.42", - "10.44.226.104" + "10.65.141.244" ], "related.user": [ "Nequepo" @@ -2385,10 +2385,10 @@ "redo6311.api.invalid" ], "related.ip": [ - "10.176.64.28", + "10.169.123.103", "10.97.138.181", "10.205.174.181", - "10.169.123.103" + "10.176.64.28" ], "related.user": [ "eseruntm" @@ -2453,10 +2453,10 @@ "dolorem1698.www.domain" ], "related.ip": [ + "10.204.4.40", "10.75.120.11", - "10.169.101.161", "10.53.101.131", - "10.204.4.40" + "10.169.101.161" ], "related.user": [ "tquo" @@ -2521,10 +2521,10 @@ "evitae7333.www.lan" ], "related.ip": [ - "10.156.117.169", "10.28.51.219", - "10.6.222.112", - "10.87.120.87" + "10.156.117.169", + "10.87.120.87", + "10.6.222.112" ], "related.user": [ "onsequu" @@ -2589,9 +2589,9 @@ ], "related.ip": [ "10.247.44.59", + "10.4.126.103", "10.57.89.155", - "10.253.167.17", - "10.4.126.103" + "10.253.167.17" ], "related.user": [ "ntorever" @@ -2655,10 +2655,10 @@ "olorsi2746.internal.localhost" ], "related.ip": [ - "10.36.69.125", "10.15.240.220", + "10.143.183.208", "10.248.206.210", - "10.143.183.208" + "10.36.69.125" ], "related.user": [ "met" @@ -2724,8 +2724,8 @@ ], "related.ip": [ "10.69.170.107", - "10.6.32.7", "10.34.133.2", + "10.6.32.7", "10.142.186.43" ], "related.user": [ @@ -2791,10 +2791,10 @@ "ender5647.www5.example" ], "related.ip": [ - "10.59.103.10", - "10.170.165.164", "10.121.153.197", - "10.142.22.24" + "10.142.22.24", + "10.59.103.10", + "10.170.165.164" ], "related.user": [ "borumSec" @@ -2859,9 +2859,9 @@ "sis3986.internal.lan" ], "related.ip": [ - "10.19.99.129", - "10.247.114.30", "10.176.83.7", + "10.247.114.30", + "10.19.99.129", "10.133.10.122" ], "related.user": [ @@ -2927,10 +2927,10 @@ "uatu2894.api.lan" ], "related.ip": [ + "10.64.139.17", "10.70.7.23", - "10.40.177.138", "10.8.29.219", - "10.64.139.17" + "10.40.177.138" ], "related.user": [ "rep" @@ -2996,8 +2996,8 @@ "related.ip": [ "10.2.189.20", "10.67.221.220", - "10.67.173.228", - "10.180.62.222" + "10.180.62.222", + "10.67.173.228" ], "related.user": [ "uptasnul" @@ -3062,10 +3062,10 @@ "uian521.www.example" ], "related.ip": [ - "10.147.127.181", + "10.196.176.243", "10.209.52.47", "10.56.134.118", - "10.196.176.243" + "10.147.127.181" ], "related.user": [ "tasu" @@ -3130,9 +3130,9 @@ ], "related.ip": [ "10.226.24.84", - "10.248.140.59", + "10.85.13.237", "10.231.18.90", - "10.85.13.237" + "10.248.140.59" ], "related.user": [ "Nem" @@ -3197,10 +3197,10 @@ "ntsunt4894.mail.domain" ], "related.ip": [ - "10.59.215.207", - "10.207.183.204", + "10.203.46.215", "10.8.224.72", - "10.203.46.215" + "10.207.183.204", + "10.59.215.207" ], "related.user": [ "eruntmo" @@ -3265,10 +3265,10 @@ "mexer3864.api.corp" ], "related.ip": [ - "10.98.154.146", "10.73.84.95", + "10.255.145.22", "10.230.38.148", - "10.255.145.22" + "10.98.154.146" ], "related.user": [ "sitam" @@ -3332,10 +3332,10 @@ "oluptat6960.www5.test" ], "related.ip": [ - "10.166.142.198", "10.105.120.162", - "10.175.181.138", - "10.211.29.187" + "10.211.29.187", + "10.166.142.198", + "10.175.181.138" ], "related.user": [ "tium" @@ -3400,10 +3400,10 @@ "fugiatnu2498.www.localhost" ], "related.ip": [ - "10.182.213.195", - "10.195.139.25", "10.122.133.162", - "10.220.202.102" + "10.220.202.102", + "10.182.213.195", + "10.195.139.25" ], "related.user": [ "aquae" @@ -3535,10 +3535,10 @@ "exer447.internal.localhost" ], "related.ip": [ - "10.241.143.145", - "10.35.190.164", "10.21.58.162", - "10.113.65.192" + "10.35.190.164", + "10.113.65.192", + "10.241.143.145" ], "related.user": [ "porin" @@ -3672,9 +3672,9 @@ ], "related.ip": [ "10.150.153.61", - "10.22.213.196", + "10.125.150.220", "10.120.50.13", - "10.125.150.220" + "10.22.213.196" ], "related.user": [ "inculpa" @@ -3739,10 +3739,10 @@ "edquiaco6562.api.lan" ], "related.ip": [ + "10.113.2.13", "10.85.52.249", - "10.229.155.171", "10.238.171.184", - "10.113.2.13" + "10.229.155.171" ], "related.user": [ "tatiset" @@ -3808,9 +3808,9 @@ ], "related.ip": [ "10.249.174.35", + "10.198.150.185", "10.51.245.225", - "10.220.1.249", - "10.198.150.185" + "10.220.1.249" ], "related.user": [ "quela" @@ -3875,8 +3875,8 @@ "eosqui3723.api.localdomain" ], "related.ip": [ - "10.38.185.31", "10.251.82.195", + "10.38.185.31", "10.190.96.181", "10.152.157.32" ], @@ -3942,10 +3942,10 @@ "itaedict199.mail.corp" ], "related.ip": [ - "10.103.102.242", - "10.190.247.194", "10.230.112.179", - "10.211.198.50" + "10.211.198.50", + "10.103.102.242", + "10.190.247.194" ], "related.user": [ "tDuisaut" @@ -4010,9 +4010,9 @@ ], "related.ip": [ "10.219.83.199", + "10.251.101.61", "10.47.223.155", - "10.101.13.122", - "10.251.101.61" + "10.101.13.122" ], "related.user": [ "ectetur" @@ -4077,10 +4077,10 @@ "saute7421.www.invalid" ], "related.ip": [ + "10.83.136.233", "10.31.86.83", - "10.21.30.43", "10.21.80.157", - "10.83.136.233" + "10.21.30.43" ], "related.user": [ "litsed" @@ -4145,9 +4145,9 @@ "oluptas1637.home" ], "related.ip": [ - "10.27.181.27", "10.45.152.205", "10.194.197.107", + "10.27.181.27", "10.195.90.73" ], "related.user": [ @@ -4213,10 +4213,10 @@ "ididu5505.api.localdomain" ], "related.ip": [ - "10.222.2.132", - "10.183.90.25", "10.43.239.97", - "10.129.161.18" + "10.129.161.18", + "10.183.90.25", + "10.222.2.132" ], "related.user": [ "aedicta" @@ -4280,10 +4280,10 @@ "mqui1099.api.corp" ], "related.ip": [ + "10.248.156.138", "10.67.129.100", - "10.231.167.171", "10.189.162.131", - "10.248.156.138" + "10.231.167.171" ], "related.user": [ "sedquia" @@ -4348,9 +4348,9 @@ "siuta2155.lan" ], "related.ip": [ + "10.63.103.30", "10.6.146.184", "10.185.107.27", - "10.63.103.30", "10.142.106.66" ], "related.user": [ @@ -4415,10 +4415,10 @@ "tatiset4191.localdomain" ], "related.ip": [ - "10.93.39.237", "10.119.179.182", + "10.214.93.200", "10.0.202.9", - "10.214.93.200" + "10.93.39.237" ], "related.user": [ "tionofd" @@ -4484,8 +4484,8 @@ ], "related.ip": [ "10.28.145.163", - "10.252.204.162", "10.123.154.140", + "10.252.204.162", "10.30.189.166" ], "related.user": [ @@ -4550,9 +4550,9 @@ "idolo6535.internal.example" ], "related.ip": [ + "10.46.162.198", "10.145.128.250", "10.79.49.3", - "10.46.162.198", "10.29.122.183" ], "related.user": [ @@ -4618,10 +4618,10 @@ "one7728.api.localdomain" ], "related.ip": [ - "10.166.169.167", - "10.65.174.196", + "10.142.235.217", "10.177.232.136", - "10.142.235.217" + "10.65.174.196", + "10.166.169.167" ], "related.user": [ "olors" @@ -4686,9 +4686,9 @@ "uptatem4446.internal.localhost" ], "related.ip": [ - "10.29.217.44", "10.215.184.154", "10.191.78.86", + "10.29.217.44", "10.53.188.140" ], "related.user": [ @@ -4754,8 +4754,8 @@ "emq2514.api.localhost" ], "related.ip": [ - "10.135.77.156", "10.46.222.149", + "10.135.77.156", "10.76.148.147", "10.74.74.129" ], @@ -4821,10 +4821,10 @@ "agna5654.www.corp" ], "related.ip": [ - "10.145.49.29", + "10.130.203.37", "10.96.200.223", - "10.11.146.253", - "10.130.203.37" + "10.145.49.29", + "10.11.146.253" ], "related.user": [ "mvele" @@ -4888,10 +4888,10 @@ "ipi4827.mail.lan" ], "related.ip": [ - "10.24.23.209", "10.162.78.48", - "10.48.75.140", - "10.162.2.180" + "10.162.2.180", + "10.24.23.209", + "10.48.75.140" ], "related.user": [ "rumwr" @@ -4955,10 +4955,10 @@ "sequatD163.internal.example" ], "related.ip": [ - "10.151.206.38", - "10.66.92.83", "10.119.12.186", - "10.97.105.115" + "10.97.105.115", + "10.151.206.38", + "10.66.92.83" ], "related.user": [ "nproide" @@ -5022,10 +5022,10 @@ "itamet1303.invalid" ], "related.ip": [ - "10.64.76.142", "10.169.139.250", "10.12.148.73", - "10.201.132.114" + "10.201.132.114", + "10.64.76.142" ], "related.user": [ "borisnis" @@ -5090,10 +5090,10 @@ "epr3512.internal.domain" ], "related.ip": [ - "10.111.128.11", - "10.9.236.18", "10.35.38.185", - "10.200.116.191" + "10.200.116.191", + "10.111.128.11", + "10.9.236.18" ], "related.user": [ "umfug" @@ -5157,10 +5157,10 @@ "uredol2174.home" ], "related.ip": [ - "10.134.238.8", "10.191.27.182", - "10.236.67.227", - "10.240.62.238" + "10.134.238.8", + "10.240.62.238", + "10.236.67.227" ], "related.user": [ "tlabo" @@ -5224,10 +5224,10 @@ "ididunt7607.mail.localhost" ], "related.ip": [ - "10.109.14.142", "10.22.231.91", - "10.65.35.64", - "10.165.66.92" + "10.165.66.92", + "10.109.14.142", + "10.65.35.64" ], "related.user": [ "perna" @@ -5292,9 +5292,9 @@ ], "related.ip": [ "10.64.161.215", + "10.29.230.203", "10.71.112.86", - "10.89.221.90", - "10.29.230.203" + "10.89.221.90" ], "related.user": [ "rnatur" @@ -5358,10 +5358,10 @@ "nonn1650.www.test" ], "related.ip": [ - "10.221.199.137", - "10.88.226.76", + "10.140.118.182", "10.79.208.135", - "10.140.118.182" + "10.221.199.137", + "10.88.226.76" ], "related.user": [ "erspic" @@ -5426,10 +5426,10 @@ "acons3940.api.lan" ], "related.ip": [ + "10.133.48.55", "10.35.73.208", - "10.126.61.230", "10.189.244.22", - "10.133.48.55" + "10.126.61.230" ], "related.user": [ "tia" @@ -5493,8 +5493,8 @@ "suscipit587.www.localhost" ], "related.ip": [ - "10.240.94.109", "10.239.194.105", + "10.240.94.109", "10.81.154.115", "10.35.65.72" ], @@ -5562,8 +5562,8 @@ ], "related.ip": [ "10.150.56.227", - "10.52.70.192", "10.248.72.104", + "10.52.70.192", "10.38.253.213" ], "related.user": [ @@ -5629,10 +5629,10 @@ "borios1067.www5.home" ], "related.ip": [ - "10.218.15.164", - "10.62.218.239", "10.73.172.186", - "10.203.193.134" + "10.203.193.134", + "10.218.15.164", + "10.62.218.239" ], "related.user": [ "reh" @@ -5696,9 +5696,9 @@ "msequ323.www.example" ], "related.ip": [ + "10.60.20.76", "10.10.46.43", "10.131.127.113", - "10.60.20.76", "10.136.211.234" ], "related.user": [ @@ -5764,10 +5764,10 @@ "tdolorem813.internal.host" ], "related.ip": [ + "10.50.177.151", "10.248.0.74", - "10.233.181.250", "10.187.237.220", - "10.50.177.151" + "10.233.181.250" ], "related.user": [ "ugiatq" @@ -5832,10 +5832,10 @@ "volupt4626.internal.test" ], "related.ip": [ - "10.96.223.46", - "10.80.129.81", + "10.248.248.120", "10.189.43.11", - "10.248.248.120" + "10.80.129.81", + "10.96.223.46" ], "related.user": [ "iatn" @@ -5900,9 +5900,9 @@ "ntium5103.www5.localhost" ], "related.ip": [ - "10.91.115.139", - "10.102.109.199", "10.173.114.63", + "10.102.109.199", + "10.91.115.139", "10.66.106.186" ], "related.user": [ @@ -5968,9 +5968,9 @@ "orpori3334.www.local" ], "related.ip": [ + "10.159.155.88", "10.0.175.17", "10.198.157.122", - "10.159.155.88", "10.221.223.127" ], "related.user": [ @@ -6035,10 +6035,10 @@ "equu7361.www5.localdomain" ], "related.ip": [ - "10.252.136.130", - "10.189.70.237", "10.30.20.187", - "10.7.212.201" + "10.7.212.201", + "10.189.70.237", + "10.252.136.130" ], "related.user": [ "ugiat" @@ -6103,10 +6103,10 @@ "tse2979.internal.localhost" ], "related.ip": [ - "10.60.224.93", - "10.242.121.165", "10.83.105.69", - "10.102.109.194" + "10.102.109.194", + "10.60.224.93", + "10.242.121.165" ], "related.user": [ "mni" @@ -6171,10 +6171,10 @@ "uisnostr2390.mail.domain" ], "related.ip": [ + "10.17.20.93", "10.219.174.45", - "10.181.134.69", "10.251.167.219", - "10.17.20.93" + "10.181.134.69" ], "related.user": [ "Uteni" @@ -6239,10 +6239,10 @@ "luptate4811.mail.example" ], "related.ip": [ - "10.28.233.253", - "10.37.14.20", + "10.223.99.90", "10.30.117.82", - "10.223.99.90" + "10.37.14.20", + "10.28.233.253" ], "related.user": [ "numqua" @@ -6307,10 +6307,10 @@ "lites1614.www.corp" ], "related.ip": [ - "10.57.85.113", - "10.8.32.17", + "10.125.20.22", "10.50.61.114", - "10.125.20.22" + "10.57.85.113", + "10.8.32.17" ], "related.user": [ "qua" @@ -6375,9 +6375,9 @@ "lorinrep7686.mail.corp" ], "related.ip": [ - "10.200.28.55", - "10.215.224.27", "10.113.78.101", + "10.215.224.27", + "10.200.28.55", "10.181.63.82" ], "related.user": [ @@ -6443,10 +6443,10 @@ "nderit6272.mail.example" ], "related.ip": [ - "10.243.43.168", + "10.169.95.128", "10.177.14.106", "10.139.20.223", - "10.169.95.128" + "10.243.43.168" ], "related.user": [ "ofd" @@ -6512,9 +6512,9 @@ ], "related.ip": [ "10.92.168.198", - "10.90.93.4", "10.39.100.88", - "10.18.176.44" + "10.18.176.44", + "10.90.93.4" ], "related.user": [ "adminima" @@ -6579,9 +6579,9 @@ "essequam1161.domain" ], "related.ip": [ - "10.163.203.191", "10.193.43.135", "10.49.68.8", + "10.163.203.191", "10.173.13.179" ], "related.user": [ @@ -6647,9 +6647,9 @@ ], "related.ip": [ "10.240.47.113", - "10.209.226.7", + "10.84.64.28", "10.31.147.51", - "10.84.64.28" + "10.209.226.7" ], "related.user": [ "ull" @@ -6714,9 +6714,9 @@ "item3647.home" ], "related.ip": [ + "10.52.13.192", "10.225.189.229", "10.86.1.244", - "10.52.13.192", "10.32.20.4" ], "related.user": [ diff --git a/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json b/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json index fe5ce75e182..81c2af5f702 100644 --- a/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/f5/bigipapm/test/generated.log-expected.json @@ -367,8 +367,8 @@ "observer.vendor": "F5", "process.pid": 2289, "related.ip": [ - "10.204.123.107", - "10.225.160.182" + "10.225.160.182", + "10.204.123.107" ], "rsa.internal.messageid": "01490500", "rsa.misc.log_session_id": "eFinib", @@ -983,8 +983,8 @@ "observer.vendor": "F5", "process.pid": 4318, "related.ip": [ - "10.169.101.161", - "10.122.204.151" + "10.122.204.151", + "10.169.101.161" ], "rsa.internal.messageid": "01490500", "rsa.misc.log_session_id": "snulap", @@ -1565,8 +1565,8 @@ "observer.vendor": "F5", "process.pid": 1973, "related.ip": [ - "10.47.99.72", - "10.187.64.126" + "10.187.64.126", + "10.47.99.72" ], "rsa.internal.messageid": "01490500", "rsa.misc.category": "oremipsu", diff --git a/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json index 69eab97fe35..2633519ac68 100644 --- a/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/clientendpoint/test/generated.log-expected.json @@ -25,8 +25,8 @@ "litesse6379.api.domain" ], "related.ip": [ - "10.150.92.220", - "10.102.123.34" + "10.102.123.34", + "10.150.92.220" ], "related.user": [ "sumdo" @@ -143,8 +143,8 @@ "quis1130.internal.corp" ], "related.ip": [ - "10.118.175.9", - "10.173.116.41" + "10.173.116.41", + "10.118.175.9" ], "related.user": [ "uame" @@ -261,8 +261,8 @@ "enimad2283.internal.domain" ], "related.ip": [ - "10.245.142.250", - "10.70.0.60" + "10.70.0.60", + "10.245.142.250" ], "related.user": [ "eos" @@ -379,8 +379,8 @@ "iutal13.api.localdomain" ], "related.ip": [ - "10.12.44.169", - "10.214.225.125" + "10.214.225.125", + "10.12.44.169" ], "related.user": [ "erep" @@ -438,8 +438,8 @@ "uovol492.www.localhost" ], "related.ip": [ - "10.198.136.50", - "10.66.108.11" + "10.66.108.11", + "10.198.136.50" ], "related.user": [ "uptatev" @@ -556,8 +556,8 @@ "eniam7007.api.invalid" ], "related.ip": [ - "10.54.231.100", - "10.203.5.162" + "10.203.5.162", + "10.54.231.100" ], "related.user": [ "umdolore" @@ -615,8 +615,8 @@ "snulapar3794.api.domain" ], "related.ip": [ - "10.65.83.160", - "10.136.252.240" + "10.136.252.240", + "10.65.83.160" ], "related.user": [ "ender" @@ -674,8 +674,8 @@ "liq5883.localdomain" ], "related.ip": [ - "10.210.213.18", - "10.57.40.29" + "10.57.40.29", + "10.210.213.18" ], "related.user": [ "onse" @@ -969,8 +969,8 @@ "tion1761.home" ], "related.ip": [ - "10.73.69.75", - "10.19.201.13" + "10.19.201.13", + "10.73.69.75" ], "related.user": [ "tat" @@ -1028,8 +1028,8 @@ "santium4235.api.local" ], "related.ip": [ - "10.84.105.75", - "10.78.151.178" + "10.78.151.178", + "10.84.105.75" ], "related.user": [ "iquaUten" @@ -1087,8 +1087,8 @@ "CSed2857.www5.example" ], "related.ip": [ - "10.25.192.202", - "10.135.233.146" + "10.135.233.146", + "10.25.192.202" ], "related.user": [ "emeumfu" @@ -1146,8 +1146,8 @@ "equep5085.mail.domain" ], "related.ip": [ - "10.104.134.200", - "10.121.219.204" + "10.121.219.204", + "10.104.134.200" ], "related.user": [ "uptat" @@ -1205,8 +1205,8 @@ "conseq557.mail.lan" ], "related.ip": [ - "10.225.160.182", - "10.191.105.82" + "10.191.105.82", + "10.225.160.182" ], "related.user": [ "eirure" @@ -1323,8 +1323,8 @@ "lit5929.test" ], "related.ip": [ - "10.153.111.103", - "10.6.167.7" + "10.6.167.7", + "10.153.111.103" ], "related.user": [ "eumfug" @@ -1618,8 +1618,8 @@ "xeacomm6855.api.corp" ], "related.ip": [ - "10.168.90.81", - "10.101.57.120" + "10.101.57.120", + "10.168.90.81" ], "related.user": [ "eporr" @@ -1913,8 +1913,8 @@ "eprehen3224.www5.localdomain" ], "related.ip": [ - "10.195.2.130", - "10.75.99.127" + "10.75.99.127", + "10.195.2.130" ], "related.user": [ "inibusB" @@ -1972,8 +1972,8 @@ "ptasn6599.www.localhost" ], "related.ip": [ - "10.201.238.90", - "10.245.104.182" + "10.245.104.182", + "10.201.238.90" ], "related.user": [ "ovol" @@ -2090,8 +2090,8 @@ "gitsedqu2649.mail.lan" ], "related.ip": [ - "10.184.18.202", - "10.4.157.1" + "10.4.157.1", + "10.184.18.202" ], "related.user": [ "oditem" @@ -2208,8 +2208,8 @@ "tut2703.www.host" ], "related.ip": [ - "10.27.16.118", - "10.83.177.2" + "10.83.177.2", + "10.27.16.118" ], "related.user": [ "borios" @@ -2385,8 +2385,8 @@ "tot5313.mail.invalid" ], "related.ip": [ - "10.9.18.237", - "10.9.12.248" + "10.9.12.248", + "10.9.18.237" ], "related.user": [ "uradi" @@ -2444,8 +2444,8 @@ "rumet3801.internal.domain" ], "related.ip": [ - "10.41.123.102", - "10.83.130.226" + "10.83.130.226", + "10.41.123.102" ], "related.user": [ "tenim" @@ -2562,8 +2562,8 @@ "sequat7273.api.host" ], "related.ip": [ - "10.134.18.114", - "10.142.25.100" + "10.142.25.100", + "10.134.18.114" ], "related.user": [ "osqui" @@ -2621,8 +2621,8 @@ "uidol4575.localhost" ], "related.ip": [ - "10.28.118.160", - "10.223.119.218" + "10.223.119.218", + "10.28.118.160" ], "related.user": [ "ntsunt" @@ -2916,8 +2916,8 @@ "iosamnis1047.internal.localdomain" ], "related.ip": [ - "10.210.89.183", - "10.150.245.88" + "10.150.245.88", + "10.210.89.183" ], "related.user": [ "sequa" @@ -2975,8 +2975,8 @@ "orroq6677.internal.example" ], "related.ip": [ - "10.85.185.13", - "10.180.195.43" + "10.180.195.43", + "10.85.185.13" ], "related.user": [ "voluptas" @@ -3093,8 +3093,8 @@ "itaedict7233.mail.localdomain" ], "related.ip": [ - "10.86.11.48", - "10.248.165.185" + "10.248.165.185", + "10.86.11.48" ], "related.user": [ "dquiac" @@ -3152,8 +3152,8 @@ "numquam5869.internal.example" ], "related.ip": [ - "10.118.6.177", - "10.47.125.38" + "10.47.125.38", + "10.118.6.177" ], "related.user": [ "quunt" @@ -3211,8 +3211,8 @@ "onu6137.api.home" ], "related.ip": [ - "10.60.142.127", - "10.50.233.155" + "10.50.233.155", + "10.60.142.127" ], "related.user": [ "atv" @@ -3270,8 +3270,8 @@ "aecatcup2241.www5.test" ], "related.ip": [ - "10.28.82.189", - "10.120.10.211" + "10.120.10.211", + "10.28.82.189" ], "related.user": [ "rcit" @@ -3388,8 +3388,8 @@ "mveleum4322.www5.host" ], "related.ip": [ - "10.226.5.189", - "10.125.165.144" + "10.125.165.144", + "10.226.5.189" ], "related.user": [ "mvolu" @@ -3565,8 +3565,8 @@ "nreprehe715.api.home" ], "related.ip": [ - "10.17.87.79", - "10.123.199.198" + "10.123.199.198", + "10.17.87.79" ], "related.user": [ "ratvolu" @@ -3624,8 +3624,8 @@ "unte893.internal.host" ], "related.ip": [ - "10.38.86.177", - "10.115.68.40" + "10.115.68.40", + "10.38.86.177" ], "related.user": [ "mpo" @@ -4096,8 +4096,8 @@ "squira4455.api.domain" ], "related.ip": [ - "10.196.96.162", - "10.34.131.224" + "10.34.131.224", + "10.196.96.162" ], "related.user": [ "tnonproi" @@ -4804,8 +4804,8 @@ "lamcola4879.www5.localdomain" ], "related.ip": [ - "10.14.204.36", - "10.85.104.146" + "10.85.104.146", + "10.14.204.36" ], "related.user": [ "emp" @@ -4863,8 +4863,8 @@ "edquian330.mail.local" ], "related.ip": [ - "10.208.18.210", - "10.30.246.132" + "10.30.246.132", + "10.208.18.210" ], "related.user": [ "veniam" @@ -4922,8 +4922,8 @@ "santi837.api.domain" ], "related.ip": [ - "10.19.119.17", - "10.106.249.91" + "10.106.249.91", + "10.19.119.17" ], "related.user": [ "lit" @@ -5040,8 +5040,8 @@ "nonn4478.host" ], "related.ip": [ - "10.164.207.42", - "10.164.120.197" + "10.164.120.197", + "10.164.207.42" ], "related.user": [ "pta" @@ -5099,8 +5099,8 @@ "amquaer3985.www5.example" ], "related.ip": [ - "10.183.189.133", - "10.154.191.225" + "10.154.191.225", + "10.183.189.133" ], "related.user": [ "ita" @@ -5276,8 +5276,8 @@ "orumS757.www5.corp" ], "related.ip": [ - "10.91.2.135", - "10.126.245.73" + "10.126.245.73", + "10.91.2.135" ], "related.user": [ "olore" @@ -5335,8 +5335,8 @@ "emi4534.www.localdomain" ], "related.ip": [ - "10.137.85.123", - "10.183.243.246" + "10.183.243.246", + "10.137.85.123" ], "related.user": [ "cid" @@ -5453,8 +5453,8 @@ "aturQu7083.mail.host" ], "related.ip": [ - "10.79.73.195", - "10.125.143.153" + "10.125.143.153", + "10.79.73.195" ], "related.user": [ "emip" @@ -5571,8 +5571,8 @@ "siarc6339.internal.corp" ], "related.ip": [ - "10.222.245.80", - "10.87.90.49" + "10.87.90.49", + "10.222.245.80" ], "related.user": [ "ptatemse" @@ -5689,8 +5689,8 @@ "byC5766.internal.home" ], "related.ip": [ - "10.105.97.134", - "10.204.178.19" + "10.204.178.19", + "10.105.97.134" ], "related.user": [ "mexercit" @@ -5866,8 +5866,8 @@ "porissu1470.domain" ], "related.ip": [ - "10.180.90.112", - "10.116.153.19" + "10.116.153.19", + "10.180.90.112" ], "related.user": [ "itessequ" diff --git a/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json b/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json index 367d81f9868..1bc7032f6d2 100644 --- a/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json +++ b/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json @@ -6,6 +6,7 @@ "destination.bytes": 1130, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -81,6 +82,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -151,6 +153,7 @@ "destination.bytes": 6812, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -225,6 +228,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -299,6 +303,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -373,6 +378,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -442,6 +448,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -512,6 +519,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -585,6 +593,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -654,6 +663,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -714,6 +724,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.4.4", @@ -825,6 +836,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.4.4", @@ -874,6 +886,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "8.8.8.8", @@ -889,6 +902,7 @@ "destination.as.organization.name": "Level 3 Parent, LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.4.5.4", @@ -942,6 +956,7 @@ "source.as.organization.name": "Quad9", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 48.8582, "source.geo.location.lon": 2.3387, "source.ip": "9.9.9.9", @@ -1049,6 +1064,7 @@ "destination.as.organization.name": "Level 3 Parent, LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.5.4", @@ -1100,6 +1116,7 @@ "service.type": "fortinet", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "7.6.3.4", @@ -1186,6 +1203,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.6", @@ -1235,6 +1253,7 @@ "destination.as.organization.name": "Level 3 Parent, LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.5.4", @@ -1396,6 +1415,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1465,6 +1485,7 @@ "destination.bytes": 65446, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.6.4.7", @@ -1532,6 +1553,7 @@ "source.geo.city_name": "Beijing", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 39.9288, "source.geo.location.lon": 116.3889, "source.geo.region_iso_code": "CN-BJ", @@ -1553,6 +1575,7 @@ "destination.bytes": 20, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "2001:4860:4860::8888", @@ -1613,6 +1636,7 @@ "source.bytes": 3014, "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "2001:4860:4860::8888", @@ -1629,6 +1653,7 @@ "destination.bytes": 10, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1689,6 +1714,7 @@ "source.bytes": 0, "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "9.7.7.7", @@ -1772,6 +1798,7 @@ "destination.bytes": 77654, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1857,6 +1884,7 @@ "source.geo.city_name": "Ashburn", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 39.0481, "source.geo.location.lon": -77.4728, "source.geo.region_iso_code": "US-VA", @@ -1879,6 +1907,7 @@ "destination.as.organization.name": "Dailymotion S.A.", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "FR", + "destination.geo.country_name": "France", "destination.geo.location.lat": 48.8582, "destination.geo.location.lon": 2.3387, "destination.ip": "195.8.215.136", diff --git a/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json index e3803f80ef3..0f8cf25378a 100644 --- a/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/fortimail/test/generated.log-expected.json @@ -994,8 +994,8 @@ "observer.type": "Firewall", "observer.vendor": "Fortinet", "related.ip": [ - "10.68.246.187", - "10.140.7.83" + "10.140.7.83", + "10.68.246.187" ], "rsa.email.email_dst": "gna", "rsa.email.email_src": "icabo", @@ -1248,8 +1248,8 @@ "atise3421.www5.localdomain" ], "related.ip": [ - "10.179.210.218", - "10.73.207.70" + "10.73.207.70", + "10.179.210.218" ], "rsa.email.email_dst": "rumSecti", "rsa.email.email_src": "taut", @@ -3094,8 +3094,8 @@ "taevitae6868.www.corp" ], "related.ip": [ - "10.60.164.100", - "10.161.1.146" + "10.161.1.146", + "10.60.164.100" ], "rsa.email.email_dst": "nproiden", "rsa.email.email_src": "etconse", @@ -3194,8 +3194,8 @@ "tetura7106.www5.corp" ], "related.ip": [ - "10.93.239.216", - "10.44.35.57" + "10.44.35.57", + "10.93.239.216" ], "rsa.email.email_dst": "ciun", "rsa.email.email_src": "vento", @@ -3794,8 +3794,8 @@ "observer.type": "Firewall", "observer.vendor": "Fortinet", "related.ip": [ - "10.251.183.113", - "10.201.105.58" + "10.201.105.58", + "10.251.183.113" ], "rsa.email.email_dst": "ionemu", "rsa.email.email_src": "ent", @@ -3838,8 +3838,8 @@ "observer.type": "Firewall", "observer.vendor": "Fortinet", "related.ip": [ - "10.209.203.156", - "10.132.139.98" + "10.132.139.98", + "10.209.203.156" ], "rsa.email.email_dst": "borisnis", "rsa.email.email_src": "pariat", diff --git a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json index 78030aa2c53..ee8c3414d5e 100644 --- a/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json +++ b/x-pack/filebeat/module/fortinet/fortimanager/test/generated.log-expected.json @@ -26,8 +26,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.44.173.44", - "10.20.234.169", - "10.189.58.145" + "10.189.58.145", + "10.20.234.169" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -244,8 +244,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.131.233.27", "10.27.88.95", + "10.131.233.27", "10.50.112.141" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -314,8 +314,8 @@ "olo7148.mail.home" ], "related.ip": [ - "10.87.212.179", - "10.157.213.15" + "10.157.213.15", + "10.87.212.179" ], "related.user": [ "rveli" @@ -405,8 +405,8 @@ "agna7678.internal.host" ], "related.ip": [ - "10.76.73.140", - "10.114.150.67" + "10.114.150.67", + "10.76.73.140" ], "related.user": [ "aperia" @@ -507,8 +507,8 @@ "rsa.investigations.event_vcat": "quae", "rsa.misc.OS": "qui", "rsa.misc.action": [ - "accept", - "iadese" + "iadese", + "accept" ], "rsa.misc.category": "aturve", "rsa.misc.client": "utei", @@ -582,9 +582,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.114.16.155", + "10.186.85.3", "10.176.216.90", - "10.186.85.3" + "10.114.16.155" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -828,9 +828,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.58.214.16", "10.238.164.74", - "10.106.162.153", - "10.58.214.16" + "10.106.162.153" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -972,8 +972,8 @@ "rsa.investigations.event_vcat": "xer", "rsa.misc.OS": "fugi", "rsa.misc.action": [ - "umdolo", - "deny" + "deny", + "umdolo" ], "rsa.misc.category": "conseq", "rsa.misc.client": "cusant", @@ -1127,8 +1127,8 @@ "rsa.investigations.event_vcat": "psumqu", "rsa.misc.OS": "oraincid", "rsa.misc.action": [ - "ritt", - "deny" + "deny", + "ritt" ], "rsa.misc.category": "idunt", "rsa.misc.client": "siu", @@ -1202,9 +1202,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.98.194.212", "10.51.213.42", - "10.233.120.207" + "10.233.120.207", + "10.98.194.212" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -1266,9 +1266,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.245.187.229", "10.67.132.242", - "10.241.132.176", - "10.245.187.229" + "10.241.132.176" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -1335,8 +1335,8 @@ "tore7088.www.invalid" ], "related.ip": [ - "10.199.47.220", - "10.212.214.4" + "10.212.214.4", + "10.199.47.220" ], "related.user": [ "atv" @@ -1437,8 +1437,8 @@ "rsa.investigations.event_vcat": "metcons", "rsa.misc.OS": "ehende", "rsa.misc.action": [ - "deny", - "umf" + "umf", + "deny" ], "rsa.misc.category": "emUte", "rsa.misc.client": "archite", @@ -1517,8 +1517,8 @@ "eturad6143.www.home" ], "related.ip": [ - "10.128.46.70", - "10.95.117.134" + "10.95.117.134", + "10.128.46.70" ], "related.user": [ "enim" @@ -1608,8 +1608,8 @@ "orinrep5386.www.corp" ], "related.ip": [ - "10.253.228.140", - "10.208.21.135" + "10.208.21.135", + "10.253.228.140" ], "related.user": [ "inculp" @@ -1619,8 +1619,8 @@ "rsa.investigations.event_vcat": "emagn", "rsa.misc.OS": "oditempo", "rsa.misc.action": [ - "ugitse", - "cancel" + "cancel", + "ugitse" ], "rsa.misc.category": "magnid", "rsa.misc.client": "sci", @@ -1699,8 +1699,8 @@ "henderi724.www5.home" ], "related.ip": [ - "10.3.23.172", - "10.243.226.122" + "10.243.226.122", + "10.3.23.172" ], "related.user": [ "olorem" @@ -1710,8 +1710,8 @@ "rsa.investigations.event_vcat": "ess", "rsa.misc.OS": "equatDu", "rsa.misc.action": [ - "cancel", - "emullamc" + "emullamc", + "cancel" ], "rsa.misc.category": "niamquis", "rsa.misc.client": "tutlabo", @@ -1801,8 +1801,8 @@ "rsa.investigations.event_vcat": "snostrum", "rsa.misc.OS": "tiaecon", "rsa.misc.action": [ - "cancel", - "atiset" + "atiset", + "cancel" ], "rsa.misc.category": "ehende", "rsa.misc.client": "umquam", @@ -1878,8 +1878,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.117.63.181", - "10.247.53.179", - "10.168.20.20" + "10.168.20.20", + "10.247.53.179" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -1947,8 +1947,8 @@ "tasnul4179.internal.host" ], "related.ip": [ - "10.141.156.217", - "10.53.168.187" + "10.53.168.187", + "10.141.156.217" ], "related.user": [ "amqu" @@ -1958,8 +1958,8 @@ "rsa.investigations.event_vcat": "illumq", "rsa.misc.OS": "idata", "rsa.misc.action": [ - "emacc", - "block" + "block", + "emacc" ], "rsa.misc.category": "ueporro", "rsa.misc.client": "veli", @@ -2050,8 +2050,8 @@ "rsa.investigations.event_vcat": "eturadip", "rsa.misc.OS": "turadip", "rsa.misc.action": [ - "accept", - "odoc" + "odoc", + "accept" ], "rsa.misc.category": "volup", "rsa.misc.client": "tur", @@ -2232,8 +2232,8 @@ "rsa.investigations.event_vcat": "uatu", "rsa.misc.OS": "tnulapar", "rsa.misc.action": [ - "deny", - "odic" + "odic", + "deny" ], "rsa.misc.category": "deri", "rsa.misc.client": "scivelit", @@ -2307,8 +2307,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.37.161.101", "10.111.182.212", + "10.37.161.101", "10.17.209.252" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -2371,9 +2371,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.170.196.181", + "10.153.166.133", "10.158.175.98", - "10.153.166.133" + "10.170.196.181" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2526,9 +2526,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.174.17.46", + "10.38.168.190", "10.77.105.81", - "10.38.168.190" + "10.174.17.46" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2654,9 +2654,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.214.156.161", + "10.66.90.225", "10.145.194.12", - "10.66.90.225" + "10.214.156.161" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2719,8 +2719,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.156.208.5", - "10.163.36.101", - "10.6.242.108" + "10.6.242.108", + "10.163.36.101" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -2787,8 +2787,8 @@ "remeum2641.www5.corp" ], "related.ip": [ - "10.68.233.163", - "10.220.148.127" + "10.220.148.127", + "10.68.233.163" ], "related.user": [ "estiaec" @@ -2798,8 +2798,8 @@ "rsa.investigations.event_vcat": "olore", "rsa.misc.OS": "tatem", "rsa.misc.action": [ - "allow", - "itanimi" + "itanimi", + "allow" ], "rsa.misc.category": "psa", "rsa.misc.client": "ugits", @@ -2889,8 +2889,8 @@ "rsa.investigations.event_vcat": "ihi", "rsa.misc.OS": "amquaera", "rsa.misc.action": [ - "allow", - "nimides" + "nimides", + "allow" ], "rsa.misc.category": "mve", "rsa.misc.client": "plica", @@ -2970,8 +2970,8 @@ "mea6298.api.example" ], "related.ip": [ - "10.113.152.241", - "10.115.121.243" + "10.115.121.243", + "10.113.152.241" ], "related.user": [ "norumetM" @@ -3061,8 +3061,8 @@ "iqu7510.internal.corp" ], "related.ip": [ - "10.49.82.45", - "10.179.153.97" + "10.179.153.97", + "10.49.82.45" ], "related.user": [ "dictasun" @@ -3072,8 +3072,8 @@ "rsa.investigations.event_vcat": "tatemse", "rsa.misc.OS": "eturadi", "rsa.misc.action": [ - "ade", - "accept" + "accept", + "ade" ], "rsa.misc.category": "laboreet", "rsa.misc.client": "ano", @@ -3147,8 +3147,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.205.83.138", "10.98.52.184", + "10.205.83.138", "10.99.55.115" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -3211,8 +3211,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.197.128.162", "10.228.11.50", + "10.197.128.162", "10.90.189.248" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -3320,8 +3320,8 @@ "deFinibu3940.internal.lan" ], "related.ip": [ - "10.22.248.52", - "10.124.71.88" + "10.124.71.88", + "10.22.248.52" ], "related.user": [ "tcons" @@ -3331,8 +3331,8 @@ "rsa.investigations.event_vcat": "uiratio", "rsa.misc.OS": "xce", "rsa.misc.action": [ - "cancel", - "cons" + "cons", + "cancel" ], "rsa.misc.category": "ciun", "rsa.misc.client": "amquisn", @@ -3411,8 +3411,8 @@ "tatiset4191.localdomain" ], "related.ip": [ - "10.26.58.20", - "10.185.37.176" + "10.185.37.176", + "10.26.58.20" ], "related.user": [ "eumiure" @@ -3422,8 +3422,8 @@ "rsa.investigations.event_vcat": "iae", "rsa.misc.OS": "evelite", "rsa.misc.action": [ - "essequam", - "block" + "block", + "essequam" ], "rsa.misc.category": "tmollita", "rsa.misc.client": "uiinea", @@ -3497,8 +3497,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.14.145.107", "10.200.12.126", + "10.14.145.107", "10.250.231.196" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -3561,9 +3561,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.225.34.176", "10.21.203.112", - "10.103.36.192" + "10.103.36.192", + "10.225.34.176" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3625,9 +3625,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.5.67.140", + "10.140.59.161", "10.118.111.183", - "10.140.59.161" + "10.5.67.140" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -3694,8 +3694,8 @@ "nimadmi4084.api.home" ], "related.ip": [ - "10.7.70.169", - "10.28.212.191" + "10.28.212.191", + "10.7.70.169" ], "related.user": [ "itsed" @@ -3705,8 +3705,8 @@ "rsa.investigations.event_vcat": "Loremips", "rsa.misc.OS": "eritquii", "rsa.misc.action": [ - "accept", - "nostru" + "nostru", + "accept" ], "rsa.misc.category": "amnisiu", "rsa.misc.client": "rcita", @@ -3796,8 +3796,8 @@ "rsa.investigations.event_vcat": "uep", "rsa.misc.OS": "iatisund", "rsa.misc.action": [ - "block", - "nvo" + "nvo", + "block" ], "rsa.misc.category": "tenima", "rsa.misc.client": "iuntNe", @@ -4277,8 +4277,8 @@ "ntex5135.corp" ], "related.ip": [ - "10.239.194.105", - "10.234.171.117" + "10.234.171.117", + "10.239.194.105" ], "related.user": [ "tat" @@ -4288,8 +4288,8 @@ "rsa.investigations.event_vcat": "uia", "rsa.misc.OS": "mquae", "rsa.misc.action": [ - "deny", - "tenatus" + "tenatus", + "deny" ], "rsa.misc.category": "abo", "rsa.misc.client": "umtota", @@ -4743,8 +4743,8 @@ "spici5547.internal.test" ], "related.ip": [ - "10.112.242.68", - "10.216.49.112" + "10.216.49.112", + "10.112.242.68" ], "related.user": [ "urmag" @@ -4920,9 +4920,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.246.41.77", "10.228.61.5", - "10.157.22.21" + "10.157.22.21", + "10.246.41.77" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -4984,9 +4984,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.188.131.18", "10.242.119.111", - "10.239.231.168", - "10.188.131.18" + "10.239.231.168" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5064,8 +5064,8 @@ "rsa.investigations.event_vcat": "amnihil", "rsa.misc.OS": "tten", "rsa.misc.action": [ - "inea", - "accept" + "accept", + "inea" ], "rsa.misc.category": "quam", "rsa.misc.client": "oreseo", @@ -5184,8 +5184,8 @@ "riaturE1644.www5.example" ], "related.ip": [ - "10.215.144.167", - "10.162.114.52" + "10.162.114.52", + "10.215.144.167" ], "related.user": [ "erspici" @@ -5195,8 +5195,8 @@ "rsa.investigations.event_vcat": "empori", "rsa.misc.OS": "ostru", "rsa.misc.action": [ - "quepor", - "allow" + "allow", + "quepor" ], "rsa.misc.category": "cipitla", "rsa.misc.client": "exeacomm", @@ -5361,9 +5361,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.75.198.93", + "10.51.106.43", "10.137.36.151", - "10.51.106.43" + "10.75.198.93" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5425,9 +5425,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.7.230.206", "10.154.151.111", - "10.249.93.150" + "10.249.93.150", + "10.7.230.206" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5505,8 +5505,8 @@ "rsa.investigations.event_vcat": "santiumd", "rsa.misc.OS": "oris", "rsa.misc.action": [ - "deny", - "rsitame" + "rsitame", + "deny" ], "rsa.misc.category": "agnaal", "rsa.misc.client": "urmagn", @@ -5585,8 +5585,8 @@ "dquiac6194.api.lan" ], "related.ip": [ - "10.241.140.241", - "10.180.162.174" + "10.180.162.174", + "10.241.140.241" ], "related.user": [ "nulapar" @@ -5596,8 +5596,8 @@ "rsa.investigations.event_vcat": "luptatev", "rsa.misc.OS": "emipsu", "rsa.misc.action": [ - "ido", - "accept" + "accept", + "ido" ], "rsa.misc.category": "litse", "rsa.misc.client": "evita", @@ -5687,8 +5687,8 @@ "rsa.investigations.event_vcat": "atvolupt", "rsa.misc.OS": "riosam", "rsa.misc.action": [ - "ssitasp", - "deny" + "deny", + "ssitasp" ], "rsa.misc.category": "enimadmi", "rsa.misc.client": "uatDui", @@ -5767,8 +5767,8 @@ "dicta7226.mail.example" ], "related.ip": [ - "10.53.50.77", - "10.4.244.115" + "10.4.244.115", + "10.53.50.77" ], "related.user": [ "idolo" @@ -5853,9 +5853,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.236.211.111", "10.120.212.78", - "10.221.100.157" + "10.221.100.157", + "10.236.211.111" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -5933,8 +5933,8 @@ "rsa.investigations.event_vcat": "lauda", "rsa.misc.OS": "enatuser", "rsa.misc.action": [ - "accept", - "rios" + "rios", + "accept" ], "rsa.misc.category": "aUte", "rsa.misc.client": "iusm", @@ -6009,8 +6009,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.123.59.69", - "10.226.255.3", - "10.53.251.202" + "10.53.251.202", + "10.226.255.3" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6072,9 +6072,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.212.56.26", "10.3.85.176", - "10.29.141.252" + "10.29.141.252", + "10.212.56.26" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6227,9 +6227,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.11.150.136", + "10.83.98.220", "10.171.60.173", - "10.83.98.220" + "10.11.150.136" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6291,9 +6291,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.74.88.209", "10.92.3.166", - "10.238.49.73", - "10.74.88.209" + "10.238.49.73" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6355,9 +6355,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ + "10.84.200.121", "10.119.248.36", - "10.187.107.47", - "10.84.200.121" + "10.187.107.47" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6419,9 +6419,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.135.213.17", + "10.30.239.222", "10.167.128.229", - "10.30.239.222" + "10.135.213.17" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6488,8 +6488,8 @@ "rspic5637.api.local" ], "related.ip": [ - "10.169.133.219", - "10.115.166.48" + "10.115.166.48", + "10.169.133.219" ], "related.user": [ "emq" @@ -6499,8 +6499,8 @@ "rsa.investigations.event_vcat": "iumdol", "rsa.misc.OS": "min", "rsa.misc.action": [ - "eleumiur", - "block" + "block", + "eleumiur" ], "rsa.misc.category": "ero", "rsa.misc.client": "gia", @@ -6579,8 +6579,8 @@ "rror3870.www5.local" ], "related.ip": [ - "10.146.255.40", - "10.226.39.82" + "10.226.39.82", + "10.146.255.40" ], "related.user": [ "caecatcu" @@ -6729,8 +6729,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.66.149.234", "10.186.253.240", + "10.66.149.234", "10.233.128.7" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -6793,9 +6793,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.227.133.134", "10.46.11.114", - "10.173.140.201" + "10.173.140.201", + "10.227.133.134" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -6926,8 +6926,8 @@ "velill3821.mail.invalid" ], "related.ip": [ - "10.97.254.192", - "10.124.34.251" + "10.124.34.251", + "10.97.254.192" ], "related.user": [ "epor" @@ -7012,9 +7012,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.9.41.221", + "10.204.98.238", "10.81.58.91", - "10.204.98.238" + "10.9.41.221" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -7117,8 +7117,8 @@ "observer.vendor": "Fortinet", "related.ip": [ "10.35.84.125", - "10.212.208.70", - "10.37.120.29" + "10.37.120.29", + "10.212.208.70" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -7180,9 +7180,9 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.199.201.26", "10.207.207.106", - "10.143.65.84" + "10.143.65.84", + "10.199.201.26" ], "rsa.internal.messageid": "generic_fortinetmgr_1", "rsa.misc.action": [ @@ -7244,8 +7244,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.41.61.88", "10.204.27.48", + "10.41.61.88", "10.163.236.253" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -7308,8 +7308,8 @@ "observer.type": "Configuration", "observer.vendor": "Fortinet", "related.ip": [ - "10.246.81.164", "10.53.110.111", + "10.246.81.164", "10.185.44.26" ], "rsa.internal.messageid": "generic_fortinetmgr_1", @@ -7378,8 +7378,8 @@ "cupida6106.www5.local" ], "related.ip": [ - "10.146.77.206", - "10.109.172.90" + "10.109.172.90", + "10.146.77.206" ], "related.user": [ "aquaeab" @@ -7469,8 +7469,8 @@ "unt2122.internal.local" ], "related.ip": [ - "10.202.250.141", - "10.38.18.72" + "10.38.18.72", + "10.202.250.141" ], "related.user": [ "maperia" @@ -7662,8 +7662,8 @@ "rsa.investigations.event_vcat": "olupt", "rsa.misc.OS": "rumw", "rsa.misc.action": [ - "block", - "tali" + "tali", + "block" ], "rsa.misc.category": "itsedq", "rsa.misc.client": "esciu", diff --git a/x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log-expected.json b/x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log-expected.json index 2d1832bc54a..d8efe2892a5 100644 --- a/x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log-expected.json +++ b/x-pack/filebeat/module/googlecloud/audit/test/audit-log-entries.json.log-expected.json @@ -282,6 +282,7 @@ "source.geo.city_name": "Moscow", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7527, "source.geo.location.lon": 37.6172, "source.geo.region_iso_code": "RU-MOW", @@ -327,6 +328,7 @@ "source.geo.city_name": "Clermont-Ferrand", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 45.7838, "source.geo.location.lon": 3.0966, "source.geo.region_iso_code": "FR-63", diff --git a/x-pack/filebeat/module/googlecloud/firewall/test/test.log-expected.json b/x-pack/filebeat/module/googlecloud/firewall/test/test.log-expected.json index c8b16376e8f..73f9e79c29a 100644 --- a/x-pack/filebeat/module/googlecloud/firewall/test/test.log-expected.json +++ b/x-pack/filebeat/module/googlecloud/firewall/test/test.log-expected.json @@ -6,6 +6,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -801,6 +802,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -866,6 +868,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-application-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-application-test.json.log-expected.json index 7c44c612d13..a3840436672 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-application-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-application-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_APPLICATION_SETTING", "event.category": [ "iam" @@ -42,6 +41,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -56,7 +56,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_APPLICATION_SETTING", "event.category": [ "iam" @@ -97,6 +96,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -111,7 +111,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_APPLICATION_SETTING", "event.category": [ "iam" @@ -152,6 +151,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -166,7 +166,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REORDER_GROUP_BASED_POLICIES_EVENT", "event.category": [ "iam" @@ -206,6 +205,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -220,7 +220,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GPLUS_PREMIUM_FEATURES", "event.category": [ "iam" @@ -255,6 +254,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -269,7 +269,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_MANAGED_CONFIGURATION", "event.category": [ "iam" @@ -304,6 +303,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -318,7 +318,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_MANAGED_CONFIGURATION", "event.category": [ "iam" @@ -353,6 +352,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -367,7 +367,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_MANAGED_CONFIGURATION", "event.category": [ "iam" @@ -402,6 +401,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -416,7 +416,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED", "event.category": [ "iam" @@ -450,6 +449,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-calendar-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-calendar-test.json.log-expected.json index 88580177907..2a8eb8eb3fe 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-calendar-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-calendar-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_BUILDING", "event.category": [ "iam" @@ -35,6 +34,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -49,7 +49,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_BUILDING", "event.category": [ "iam" @@ -84,6 +83,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -98,7 +98,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_BUILDING", "event.category": [ "iam" @@ -136,6 +135,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -150,7 +150,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_CALENDAR_RESOURCE", "event.category": [ "iam" @@ -185,6 +184,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -199,7 +199,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_CALENDAR_RESOURCE", "event.category": [ "iam" @@ -234,6 +233,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -248,7 +248,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_CALENDAR_RESOURCE_FEATURE", "event.category": [ "iam" @@ -283,6 +282,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -297,7 +297,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_CALENDAR_RESOURCE_FEATURE", "event.category": [ "iam" @@ -332,6 +331,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -346,7 +346,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_CALENDAR_RESOURCE_FEATURE", "event.category": [ "iam" @@ -384,6 +383,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -398,7 +398,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RENAME_CALENDAR_RESOURCE", "event.category": [ "iam" @@ -434,6 +433,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -448,7 +448,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_CALENDAR_RESOURCE", "event.category": [ "iam" @@ -486,6 +485,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -500,7 +500,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CALENDAR_SETTING", "event.category": [ "iam" @@ -541,6 +540,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -555,7 +555,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CANCEL_CALENDAR_EVENTS", "event.category": [ "iam" @@ -590,6 +589,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -604,7 +604,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RELEASE_CALENDAR_RESOURCES", "event.category": [ "iam" @@ -639,6 +638,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chat-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chat-test.json.log-expected.json index 70de8368e2c..4736114f427 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chat-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chat-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MEET_INTEROP_CREATE_GATEWAY", "event.category": [ "iam" @@ -34,6 +33,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -48,7 +48,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MEET_INTEROP_DELETE_GATEWAY", "event.category": [ "iam" @@ -82,6 +81,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -96,7 +96,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MEET_INTEROP_MODIFY_GATEWAY", "event.category": [ "iam" @@ -130,6 +129,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -144,7 +144,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHAT_SETTING", "event.category": [ "iam" @@ -185,6 +184,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chromeos-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chromeos-test.json.log-expected.json index 4ce27e5aff2..00f51c0bc79 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chromeos-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-chromeos-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING", "event.category": [ "iam" @@ -42,6 +41,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -56,7 +56,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DEVICE_STATE", "event.category": [ "iam" @@ -93,6 +92,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -107,7 +107,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_APPLICATION_SETTING", "event.category": [ "iam" @@ -149,6 +148,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -163,7 +163,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SEND_CHROME_OS_DEVICE_COMMAND", "event.category": [ "iam" @@ -198,6 +197,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -212,7 +212,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_DEVICE_ANNOTATION", "event.category": [ "iam" @@ -246,6 +245,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -260,7 +260,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_DEVICE_SETTING", "event.category": [ "iam" @@ -297,6 +296,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -311,7 +311,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_DEVICE_STATE", "event.category": [ "iam" @@ -348,6 +347,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -362,7 +362,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING", "event.category": [ "iam" @@ -399,6 +398,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -413,7 +413,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "INSERT_CHROME_OS_PRINT_SERVER", "event.category": [ "iam" @@ -447,6 +446,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -461,7 +461,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_CHROME_OS_PRINT_SERVER", "event.category": [ "iam" @@ -495,6 +494,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -509,7 +509,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_CHROME_OS_PRINT_SERVER", "event.category": [ "iam" @@ -545,6 +544,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -559,7 +559,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "INSERT_CHROME_OS_PRINTER", "event.category": [ "iam" @@ -593,6 +592,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -607,7 +607,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_CHROME_OS_PRINTER", "event.category": [ "iam" @@ -641,6 +640,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -655,7 +655,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_CHROME_OS_PRINTER", "event.category": [ "iam" @@ -691,6 +690,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -705,7 +705,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_SETTING", "event.category": [ "iam" @@ -742,6 +741,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -756,7 +756,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CHROME_OS_USER_SETTING", "event.category": [ "iam" @@ -793,6 +792,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -807,7 +807,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ISSUE_DEVICE_COMMAND", "event.category": [ "iam" @@ -846,6 +845,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -860,7 +860,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOVE_DEVICE_TO_ORG_UNIT_DETAILED", "event.category": [ "iam" @@ -897,6 +896,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -911,7 +911,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_CHROME_OS_APPLICATION_SETTINGS", "event.category": [ "iam" @@ -945,6 +944,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -959,7 +959,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_DEVICE", "event.category": [ "iam" @@ -994,6 +993,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1008,7 +1008,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CONTACTS_SETTING", "event.category": [ "iam" @@ -1046,6 +1045,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-contacts-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-contacts-test.json.log-expected.json index ed54f20525a..dee1917e48d 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-contacts-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-contacts-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CONTACTS_SETTING", "event.category": [ "iam" @@ -38,6 +37,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-delegatedadmin-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-delegatedadmin-test.json.log-expected.json index c43835104fa..b5c6d47d8b3 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-delegatedadmin-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-delegatedadmin-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ASSIGN_ROLE", "event.category": [ "iam" @@ -37,6 +36,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -51,7 +51,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_ROLE", "event.category": [ "iam" @@ -86,6 +85,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -100,7 +100,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_ROLE", "event.category": [ "iam" @@ -135,6 +134,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -149,7 +149,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_PRIVILEGE", "event.category": [ "iam" @@ -185,6 +184,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -199,7 +199,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_PRIVILEGE", "event.category": [ "iam" @@ -235,6 +234,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -249,7 +249,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RENAME_ROLE", "event.category": [ "iam" @@ -284,6 +283,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -298,7 +298,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_ROLE", "event.category": [ "iam" @@ -333,6 +332,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -347,7 +347,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNASSIGN_ROLE", "event.category": [ "iam" @@ -384,6 +383,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-docs-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-docs-test.json.log-expected.json index 4fb31027b62..e0f00e25443 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-docs-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-docs-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TRANSFER_DOCUMENT_OWNERSHIP", "event.category": [ "iam" @@ -37,6 +36,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -51,7 +51,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DRIVE_DATA_RESTORE", "event.category": [ "iam" @@ -89,6 +88,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -103,7 +103,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DOCS_SETTING", "event.category": [ "iam" @@ -144,6 +143,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -157,4 +157,4 @@ "forwarded" ] } -] +] \ No newline at end of file diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-domain-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-domain-test.json.log-expected.json index a8d965c7c8d..a349010fdb4 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-domain-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-domain-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ACCOUNT_AUTO_RENEWAL", "event.category": [ "iam" @@ -35,6 +34,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -49,7 +49,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_APPLICATION", "event.category": [ "iam" @@ -85,6 +84,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -99,7 +99,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_APPLICATION_TO_WHITELIST", "event.category": [ "iam" @@ -134,6 +133,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -148,7 +148,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ADVERTISEMENT_OPTION", "event.category": [ "iam" @@ -184,6 +183,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -198,7 +198,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_ALERT", "event.category": [ "iam" @@ -232,6 +231,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -246,7 +246,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ALERT_CRITERIA", "event.category": [ "iam" @@ -280,6 +279,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -294,7 +294,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_ALERT", "event.category": [ "iam" @@ -328,6 +327,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -342,7 +342,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ALERT_RECEIVERS_CHANGED", "event.category": [ "iam" @@ -378,6 +377,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -392,7 +392,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RENAME_ALERT", "event.category": [ "iam" @@ -427,6 +426,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -441,7 +441,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ALERT_STATUS_CHANGED", "event.category": [ "iam" @@ -477,6 +476,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -491,7 +491,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_DOMAIN_ALIAS", "event.category": [ "iam" @@ -526,6 +525,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -540,7 +540,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_DOMAIN_ALIAS", "event.category": [ "iam" @@ -575,6 +574,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -589,7 +589,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SKIP_DOMAIN_ALIAS_MX", "event.category": [ "iam" @@ -624,6 +623,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -638,7 +638,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VERIFY_DOMAIN_ALIAS_MX", "event.category": [ "iam" @@ -673,6 +672,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -687,7 +687,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VERIFY_DOMAIN_ALIAS", "event.category": [ "iam" @@ -723,6 +722,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -737,7 +737,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_OAUTH_ACCESS_TO_ALL_APIS", "event.category": [ "iam" @@ -772,6 +771,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -786,7 +786,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_ALLOW_ADMIN_PASSWORD_RESET", "event.category": [ "iam" @@ -821,6 +820,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -835,7 +835,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENABLE_API_ACCESS", "event.category": [ "iam" @@ -871,6 +870,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -885,7 +885,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "AUTHORIZE_API_CLIENT_ACCESS", "event.category": [ "iam" @@ -924,6 +923,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -938,7 +938,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_API_CLIENT_ACCESS", "event.category": [ "iam" @@ -973,6 +972,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -987,7 +987,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_LICENSES_REDEEMED", "event.category": [ "iam" @@ -1023,6 +1022,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1037,7 +1037,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_AUTO_ADD_NEW_SERVICE", "event.category": [ "iam" @@ -1072,6 +1071,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1086,7 +1086,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_PRIMARY_DOMAIN", "event.category": [ "iam" @@ -1121,6 +1120,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1135,7 +1135,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_WHITELIST_SETTING", "event.category": [ "iam" @@ -1171,6 +1170,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1185,7 +1185,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMMUNICATION_PREFERENCES_SETTING_CHANGE", "event.category": [ "iam" @@ -1222,6 +1221,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1236,7 +1236,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CONFLICT_ACCOUNT_ACTION", "event.category": [ "iam" @@ -1272,6 +1271,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1286,7 +1286,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENABLE_FEEDBACK_SOLICITATION", "event.category": [ "iam" @@ -1322,6 +1321,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1336,7 +1336,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_CONTACT_SHARING", "event.category": [ "iam" @@ -1371,6 +1370,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1385,7 +1385,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_PLAY_FOR_WORK_TOKEN", "event.category": [ "iam" @@ -1419,6 +1418,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1433,7 +1433,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_USE_CUSTOM_LOGO", "event.category": [ "iam" @@ -1468,6 +1467,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1482,7 +1482,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CUSTOM_LOGO", "event.category": [ "iam" @@ -1516,6 +1515,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1530,7 +1530,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA", "event.category": [ "iam" @@ -1566,6 +1565,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1580,7 +1580,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DATA_LOCALIZATION_SETTING", "event.category": [ "iam" @@ -1616,6 +1615,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1630,7 +1630,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO", "event.category": [ "iam" @@ -1666,6 +1665,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1680,7 +1680,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_PLAY_FOR_WORK_TOKEN", "event.category": [ "iam" @@ -1714,6 +1713,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1728,7 +1728,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VIEW_DNS_LOGIN_DETAILS", "event.category": [ "iam" @@ -1762,6 +1761,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1776,7 +1776,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DOMAIN_DEFAULT_LOCALE", "event.category": [ "iam" @@ -1812,6 +1811,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1826,7 +1826,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DOMAIN_DEFAULT_TIMEZONE", "event.category": [ "iam" @@ -1862,6 +1861,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1876,7 +1876,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DOMAIN_NAME", "event.category": [ "iam" @@ -1911,6 +1910,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1925,7 +1925,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_ENABLE_PRE_RELEASE_FEATURES", "event.category": [ "iam" @@ -1960,6 +1959,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1974,7 +1974,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_DOMAIN_SUPPORT_MESSAGE", "event.category": [ "iam" @@ -2010,6 +2009,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2024,7 +2024,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_TRUSTED_DOMAINS", "event.category": [ "iam" @@ -2058,6 +2057,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2072,7 +2072,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_TRUSTED_DOMAINS", "event.category": [ "iam" @@ -2106,6 +2105,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2120,7 +2120,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_EDU_TYPE", "event.category": [ "iam" @@ -2156,6 +2155,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2170,7 +2170,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_ENABLE_OAUTH_CONSUMER_KEY", "event.category": [ "iam" @@ -2205,6 +2204,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2219,7 +2219,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_SSO_ENABLED", "event.category": [ "iam" @@ -2254,6 +2253,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2268,7 +2268,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_SSL", "event.category": [ "iam" @@ -2303,6 +2302,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2317,7 +2317,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_EU_REPRESENTATIVE_CONTACT_INFO", "event.category": [ "iam" @@ -2353,6 +2352,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2367,7 +2367,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GENERATE_TRANSFER_TOKEN", "event.category": [ "iam" @@ -2400,6 +2399,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2414,7 +2414,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_LOGIN_BACKGROUND_COLOR", "event.category": [ "iam" @@ -2450,6 +2449,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2464,7 +2464,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_LOGIN_BORDER_COLOR", "event.category": [ "iam" @@ -2500,6 +2499,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2514,7 +2514,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_LOGIN_ACTIVITY_TRACE", "event.category": [ "iam" @@ -2550,6 +2549,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2564,7 +2564,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "PLAY_FOR_WORK_ENROLL", "event.category": [ "iam" @@ -2599,6 +2598,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2613,7 +2613,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "PLAY_FOR_WORK_UNENROLL", "event.category": [ "iam" @@ -2647,6 +2646,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2661,7 +2661,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MX_RECORD_VERIFICATION_CLAIM", "event.category": [ "iam" @@ -2697,6 +2696,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2711,7 +2711,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_NEW_APP_FEATURES", "event.category": [ "iam" @@ -2746,6 +2745,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2760,7 +2760,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_USE_NEXT_GEN_CONTROL_PANEL", "event.category": [ "iam" @@ -2795,6 +2794,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2809,7 +2809,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPLOAD_OAUTH_CERTIFICATE", "event.category": [ "iam" @@ -2843,6 +2842,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2857,7 +2857,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REGENERATE_OAUTH_CONSUMER_SECRET", "event.category": [ "iam" @@ -2891,6 +2890,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2905,7 +2905,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_OPEN_ID_ENABLED", "event.category": [ "iam" @@ -2940,6 +2939,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2954,7 +2954,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ORGANIZATION_NAME", "event.category": [ "iam" @@ -2990,6 +2989,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3004,7 +3004,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_OUTBOUND_RELAY", "event.category": [ "iam" @@ -3041,6 +3040,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3055,7 +3055,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_PASSWORD_MAX_LENGTH", "event.category": [ "iam" @@ -3091,6 +3090,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3105,7 +3105,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_PASSWORD_MIN_LENGTH", "event.category": [ "iam" @@ -3141,6 +3140,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3155,7 +3155,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL", "event.category": [ "iam" @@ -3191,6 +3190,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3205,7 +3205,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS", "event.category": [ "iam" @@ -3241,6 +3240,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3255,7 +3255,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_APPLICATION", "event.category": [ "iam" @@ -3290,6 +3289,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3304,7 +3304,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_APPLICATION_FROM_WHITELIST", "event.category": [ "iam" @@ -3339,6 +3338,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3353,7 +3353,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_RENEW_DOMAIN_REGISTRATION", "event.category": [ "iam" @@ -3389,6 +3388,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3403,7 +3403,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_RESELLER_ACCESS", "event.category": [ "iam" @@ -3438,6 +3437,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3452,7 +3452,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RULE_ACTIONS_CHANGED", "event.category": [ "iam" @@ -3486,6 +3485,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3500,7 +3500,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_RULE", "event.category": [ "iam" @@ -3534,6 +3533,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3548,7 +3548,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_RULE_CRITERIA", "event.category": [ "iam" @@ -3582,6 +3581,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3596,7 +3596,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_RULE", "event.category": [ "iam" @@ -3630,6 +3629,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3644,7 +3644,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RENAME_RULE", "event.category": [ "iam" @@ -3679,6 +3678,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3693,7 +3693,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RULE_STATUS_CHANGED", "event.category": [ "iam" @@ -3729,6 +3728,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3743,7 +3743,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_SECONDARY_DOMAIN", "event.category": [ "iam" @@ -3778,6 +3777,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3792,7 +3792,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_SECONDARY_DOMAIN", "event.category": [ "iam" @@ -3827,6 +3826,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3841,7 +3841,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SKIP_SECONDARY_DOMAIN_MX", "event.category": [ "iam" @@ -3876,6 +3875,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3890,7 +3890,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VERIFY_SECONDARY_DOMAIN_MX", "event.category": [ "iam" @@ -3925,6 +3924,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3939,7 +3939,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VERIFY_SECONDARY_DOMAIN", "event.category": [ "iam" @@ -3974,6 +3973,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3988,7 +3988,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_DOMAIN_SECONDARY_EMAIL", "event.category": [ "iam" @@ -4024,6 +4023,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -4038,7 +4038,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_SSO_SETTINGS", "event.category": [ "iam" @@ -4072,6 +4071,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -4086,7 +4086,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GENERATE_PIN", "event.category": [ "iam" @@ -4119,6 +4118,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -4133,7 +4133,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_RULE", "event.category": [ "iam" @@ -4167,6 +4166,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-gmail-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-gmail-test.json.log-expected.json index bdb57f64b88..f62dad33200 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-gmail-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-gmail-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DROP_FROM_QUARANTINE", "event.category": [ "iam" @@ -35,6 +34,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -49,7 +49,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "EMAIL_LOG_SEARCH", "event.category": [ "iam" @@ -89,6 +88,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -103,7 +103,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "EMAIL_UNDELETE", "event.category": [ "iam" @@ -141,6 +140,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -155,7 +155,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_EMAIL_SETTING", "event.category": [ "iam" @@ -196,6 +195,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -210,7 +210,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_GMAIL_SETTING", "event.category": [ "iam" @@ -247,6 +246,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -261,7 +261,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_GMAIL_SETTING", "event.category": [ "iam" @@ -298,6 +297,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -312,7 +312,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_GMAIL_SETTING", "event.category": [ "iam" @@ -349,6 +348,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -363,7 +363,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REJECT_FROM_QUARANTINE", "event.category": [ "iam" @@ -398,6 +397,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -412,7 +412,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RELEASE_FROM_QUARANTINE", "event.category": [ "iam" @@ -447,6 +446,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -460,4 +460,4 @@ "forwarded" ] } -] +] \ No newline at end of file diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-groups-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-groups-test.json.log-expected.json index 42a9699094c..ff894cd6c05 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-groups-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-groups-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_GROUP", "event.category": [ "iam" @@ -37,6 +36,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -51,7 +51,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_GROUP", "event.category": [ "iam" @@ -88,6 +87,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -102,7 +102,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_GROUP_DESCRIPTION", "event.category": [ "iam" @@ -139,6 +138,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -153,7 +153,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GROUP_LIST_DOWNLOAD", "event.category": [ "iam" @@ -187,6 +186,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -201,7 +201,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_GROUP_MEMBER", "event.category": [ "iam" @@ -240,6 +239,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -254,7 +254,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_GROUP_MEMBER", "event.category": [ "iam" @@ -293,6 +292,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -307,7 +307,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_GROUP_MEMBER", "event.category": [ "iam" @@ -348,6 +347,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -362,7 +362,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS", "event.category": [ "iam" @@ -403,6 +402,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -417,7 +417,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE", "event.category": [ "iam" @@ -458,6 +457,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -472,7 +472,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GROUP_MEMBER_BULK_UPLOAD", "event.category": [ "iam" @@ -508,6 +507,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -522,7 +522,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GROUP_MEMBERS_DOWNLOAD", "event.category": [ "iam" @@ -556,6 +555,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -570,7 +570,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_GROUP_NAME", "event.category": [ "iam" @@ -608,6 +607,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -622,7 +622,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_GROUP_SETTING", "event.category": [ "iam" @@ -662,6 +661,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -676,7 +676,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "WHITELISTED_GROUPS_UPDATED", "event.category": [ "iam" @@ -715,6 +714,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-licenses-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-licenses-test.json.log-expected.json index d51d602ae7b..1fd3a0da6e2 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-licenses-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-licenses-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ORG_USERS_LICENSE_ASSIGNMENT", "event.category": [ "iam" @@ -36,6 +35,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -50,7 +50,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ORG_ALL_USERS_LICENSE_ASSIGNMENT", "event.category": [ "iam" @@ -86,6 +85,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -100,7 +100,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_LICENSE_ASSIGNMENT", "event.category": [ "iam" @@ -137,6 +136,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -151,7 +151,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_LICENSE_AUTO_ASSIGN", "event.category": [ "iam" @@ -187,6 +186,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -201,7 +201,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_LICENSE_REASSIGNMENT", "event.category": [ "iam" @@ -239,6 +238,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -253,7 +253,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ORG_LICENSE_REVOKE", "event.category": [ "iam" @@ -289,6 +288,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -303,7 +303,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_LICENSE_REVOKE", "event.category": [ "iam" @@ -340,6 +339,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -354,7 +354,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_DYNAMIC_LICENSE", "event.category": [ "iam" @@ -391,6 +390,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-mobile-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-mobile-test.json.log-expected.json index 8e2f2896bdb..99bea4702c3 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-mobile-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-mobile-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ACTION_CANCELLED", "event.category": [ "iam" @@ -40,6 +39,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -54,7 +54,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ACTION_REQUESTED", "event.category": [ "iam" @@ -94,6 +93,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -108,7 +108,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_MOBILE_CERTIFICATE", "event.category": [ "iam" @@ -144,6 +143,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -158,7 +158,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMPANY_DEVICES_BULK_CREATION", "event.category": [ "iam" @@ -192,6 +191,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -206,7 +206,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMPANY_OWNED_DEVICE_BLOCKED", "event.category": [ "iam" @@ -241,6 +240,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -255,7 +255,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMPANY_DEVICE_DELETION", "event.category": [ "iam" @@ -290,6 +289,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -304,7 +304,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMPANY_OWNED_DEVICE_UNBLOCKED", "event.category": [ "iam" @@ -339,6 +338,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -353,7 +353,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "COMPANY_OWNED_DEVICE_WIPED", "event.category": [ "iam" @@ -388,6 +387,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -402,7 +402,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT", "event.category": [ "iam" @@ -442,6 +441,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -456,7 +456,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER", "event.category": [ "iam" @@ -491,6 +490,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -505,7 +505,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_MOBILE_APPLICATION_FROM_WHITELIST", "event.category": [ "iam" @@ -542,6 +541,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -556,7 +556,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_APPLICATION_SETTINGS", "event.category": [ "iam" @@ -596,6 +595,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -610,7 +610,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_MOBILE_APPLICATION_TO_WHITELIST", "event.category": [ "iam" @@ -647,6 +646,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -661,7 +661,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_APPROVE", "event.category": [ "iam" @@ -699,6 +698,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -713,7 +713,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_BLOCK", "event.category": [ "iam" @@ -751,6 +750,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -765,7 +765,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_DELETE", "event.category": [ "iam" @@ -803,6 +802,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -817,7 +817,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_WIPE", "event.category": [ "iam" @@ -855,6 +854,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -869,7 +869,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_SETTING", "event.category": [ "iam" @@ -907,6 +906,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -921,7 +921,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ADMIN_RESTRICTIONS_PIN", "event.category": [ "iam" @@ -956,6 +955,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -970,7 +970,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_WIRELESS_NETWORK", "event.category": [ "iam" @@ -1006,6 +1005,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1020,7 +1020,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_MOBILE_WIRELESS_NETWORK", "event.category": [ "iam" @@ -1056,6 +1055,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1070,7 +1070,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_MOBILE_WIRELESS_NETWORK", "event.category": [ "iam" @@ -1106,6 +1105,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1120,7 +1120,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD", "event.category": [ "iam" @@ -1156,6 +1155,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1170,7 +1170,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_MOBILE_CERTIFICATE", "event.category": [ "iam" @@ -1206,6 +1205,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1220,7 +1220,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT", "event.category": [ "iam" @@ -1253,6 +1252,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1267,7 +1267,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USE_GOOGLE_MOBILE_MANAGEMENT", "event.category": [ "iam" @@ -1300,6 +1299,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1314,7 +1314,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS", "event.category": [ "iam" @@ -1347,6 +1346,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1361,7 +1361,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS", "event.category": [ "iam" @@ -1394,6 +1393,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1408,7 +1408,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_ACCOUNT_WIPE", "event.category": [ "iam" @@ -1446,6 +1445,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1460,7 +1460,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE", "event.category": [ "iam" @@ -1498,6 +1497,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1512,7 +1512,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK", "event.category": [ "iam" @@ -1550,6 +1549,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-org-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-org-test.json.log-expected.json index b2a88d67fe8..b4cdd02f0bd 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-org-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-org-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_LICENSES_ENABLED", "event.category": [ "iam" @@ -36,6 +35,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -50,7 +50,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_APPLICATION_LICENSE_RESERVATION_CREATED", "event.category": [ "iam" @@ -87,6 +86,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -101,7 +101,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_APPLICATION_LICENSE_RESERVATION_DELETED", "event.category": [ "iam" @@ -137,6 +136,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -151,7 +151,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED", "event.category": [ "iam" @@ -189,6 +188,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -203,7 +203,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_DEVICE_ENROLLMENT_TOKEN", "event.category": [ "iam" @@ -237,6 +236,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -251,7 +251,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ASSIGN_CUSTOM_LOGO", "event.category": [ "iam" @@ -285,6 +284,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -299,7 +299,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNASSIGN_CUSTOM_LOGO", "event.category": [ "iam" @@ -333,6 +332,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -347,7 +347,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_ENROLLMENT_TOKEN", "event.category": [ "iam" @@ -381,6 +380,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -395,7 +395,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_ENROLLMENT_TOKEN", "event.category": [ "iam" @@ -429,6 +428,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -443,7 +443,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHROME_LICENSES_ALLOWED", "event.category": [ "iam" @@ -479,6 +478,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -493,7 +493,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_ORG_UNIT", "event.category": [ "iam" @@ -527,6 +526,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -541,7 +541,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_ORG_UNIT", "event.category": [ "iam" @@ -575,6 +574,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -589,7 +589,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "EDIT_ORG_UNIT_DESCRIPTION", "event.category": [ "iam" @@ -623,6 +622,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -637,7 +637,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOVE_ORG_UNIT", "event.category": [ "iam" @@ -672,6 +671,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -686,7 +686,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "EDIT_ORG_UNIT_NAME", "event.category": [ "iam" @@ -721,6 +720,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -735,7 +735,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_DEVICE_ENROLLMENT_TOKEN", "event.category": [ "iam" @@ -769,6 +768,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -783,7 +783,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_SERVICE_ENABLED", "event.category": [ "iam" @@ -823,6 +822,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-security-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-security-test.json.log-expected.json index 65321e3842a..ccfe0f5b3ed 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-security-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-security-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ALLOW_STRONG_AUTHENTICATION", "event.category": [ "iam" @@ -36,6 +35,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -50,7 +50,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS", "event.category": [ "iam" @@ -85,6 +84,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -99,7 +99,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS", "event.category": [ "iam" @@ -134,6 +133,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -148,7 +148,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID", "event.category": [ "iam" @@ -186,6 +185,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -200,7 +200,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_TO_TRUSTED_OAUTH2_APPS", "event.category": [ "iam" @@ -237,6 +236,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -251,7 +251,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_FROM_TRUSTED_OAUTH2_APPS", "event.category": [ "iam" @@ -288,6 +287,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -302,7 +302,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "BLOCK_ON_DEVICE_ACCESS", "event.category": [ "iam" @@ -337,6 +336,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -351,7 +351,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION", "event.category": [ "iam" @@ -390,6 +389,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -404,7 +404,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY", "event.category": [ "iam" @@ -443,6 +442,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -457,7 +457,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION", "event.category": [ "iam" @@ -496,6 +495,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -510,7 +510,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_TWO_STEP_VERIFICATION_START_DATE", "event.category": [ "iam" @@ -549,6 +548,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -563,7 +563,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", "event.category": [ "iam" @@ -601,6 +600,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -615,7 +615,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_CAA_ENABLEMENT", "event.category": [ "iam" @@ -649,6 +648,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -663,7 +663,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CAA_ERROR_MESSAGE", "event.category": [ "iam" @@ -698,6 +697,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -712,7 +712,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_CAA_APP_ASSIGNMENTS", "event.category": [ "iam" @@ -750,6 +749,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -764,7 +764,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS", "event.category": [ "iam" @@ -798,6 +797,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -812,7 +812,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TRUST_DOMAIN_OWNED_OAUTH2_APPS", "event.category": [ "iam" @@ -846,6 +845,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -860,7 +860,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY", "event.category": [ "iam" @@ -899,6 +898,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -913,7 +913,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENFORCE_STRONG_AUTHENTICATION", "event.category": [ "iam" @@ -954,6 +953,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -968,7 +968,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS", "event.category": [ "iam" @@ -1004,6 +1003,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1018,7 +1018,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", "event.category": [ "iam" @@ -1057,6 +1056,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1071,7 +1071,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SESSION_CONTROL_SETTINGS_CHANGE", "event.category": [ "iam" @@ -1108,6 +1107,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1122,7 +1122,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_SESSION_LENGTH", "event.category": [ "iam" @@ -1157,6 +1156,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1171,7 +1171,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNBLOCK_ON_DEVICE_ACCESS", "event.category": [ "iam" @@ -1206,6 +1205,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-sites-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-sites-test.json.log-expected.json index b5afcff1ea3..272f4fb77e7 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-sites-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-sites-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_WEB_ADDRESS", "event.category": [ "iam" @@ -37,6 +36,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -53,7 +53,6 @@ "url.path": "/path/in/url" }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_WEB_ADDRESS", "event.category": [ "iam" @@ -90,6 +89,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -106,7 +106,6 @@ "url.path": "/path/in/url" }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_SITES_SETTING", "event.category": [ "iam" @@ -144,6 +143,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -158,7 +158,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES", "event.category": [ "iam" @@ -192,6 +191,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -208,7 +208,6 @@ "url.path": "/path/in/url" }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VIEW_SITE_DETAILS", "event.category": [ "iam" @@ -242,6 +241,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-user-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-user-test.json.log-expected.json index f6220f7fcbd..b3be5557b03 100644 --- a/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-user-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/admin/test/gsuite-admin-user-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_2SV_SCRATCH_CODES", "event.category": [ "iam" @@ -36,6 +35,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -50,7 +50,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GENERATE_2SV_SCRATCH_CODES", "event.category": [ "iam" @@ -86,6 +85,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -100,7 +100,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_3LO_DEVICE_TOKENS", "event.category": [ "iam" @@ -138,6 +137,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -152,7 +152,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_3LO_TOKEN", "event.category": [ "iam" @@ -189,6 +188,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -203,7 +203,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_RECOVERY_EMAIL", "event.category": [ "iam" @@ -239,6 +238,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -253,7 +253,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_RECOVERY_PHONE", "event.category": [ "iam" @@ -289,6 +288,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -303,7 +303,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GRANT_ADMIN_PRIVILEGE", "event.category": [ "iam" @@ -339,6 +338,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -353,7 +353,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_ADMIN_PRIVILEGE", "event.category": [ "iam" @@ -389,6 +388,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -403,7 +403,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_ASP", "event.category": [ "iam" @@ -440,6 +439,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -454,7 +454,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TOGGLE_AUTOMATIC_CONTACT_SHARING", "event.category": [ "iam" @@ -491,6 +490,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -505,7 +505,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "BULK_UPLOAD", "event.category": [ "iam" @@ -541,6 +540,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -555,7 +555,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "BULK_UPLOAD_NOTIFICATION_SENT", "event.category": [ "iam" @@ -592,6 +591,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -606,7 +606,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CANCEL_USER_INVITE", "event.category": [ "iam" @@ -643,6 +642,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -657,7 +657,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_CUSTOM_FIELD", "event.category": [ "iam" @@ -696,6 +695,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -710,7 +710,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_EXTERNAL_ID", "event.category": [ "iam" @@ -748,6 +747,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -762,7 +762,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_GENDER", "event.category": [ "iam" @@ -800,6 +799,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -814,7 +814,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_IM", "event.category": [ "iam" @@ -852,6 +851,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -866,7 +866,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ENABLE_USER_IP_WHITELIST", "event.category": [ "iam" @@ -904,6 +903,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -918,7 +918,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_KEYWORD", "event.category": [ "iam" @@ -956,6 +955,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -970,7 +970,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_LANGUAGE", "event.category": [ "iam" @@ -1008,6 +1007,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1022,7 +1022,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_LOCATION", "event.category": [ "iam" @@ -1060,6 +1059,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1074,7 +1074,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_ORGANIZATION", "event.category": [ "iam" @@ -1112,6 +1111,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1126,7 +1126,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_PHONE_NUMBER", "event.category": [ "iam" @@ -1164,6 +1163,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1178,7 +1178,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_RECOVERY_EMAIL", "event.category": [ "iam" @@ -1214,6 +1213,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1228,7 +1228,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_RECOVERY_PHONE", "event.category": [ "iam" @@ -1264,6 +1263,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1278,7 +1278,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_RELATION", "event.category": [ "iam" @@ -1316,6 +1315,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1330,7 +1330,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_USER_ADDRESS", "event.category": [ "iam" @@ -1368,6 +1367,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1382,7 +1382,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_EMAIL_MONITOR", "event.category": [ "iam" @@ -1426,6 +1425,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1440,7 +1440,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_DATA_TRANSFER_REQUEST", "event.category": [ "iam" @@ -1478,6 +1477,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1492,7 +1492,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GRANT_DELEGATED_ADMIN_PRIVILEGES", "event.category": [ "iam" @@ -1529,6 +1528,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1543,7 +1543,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_ACCOUNT_INFO_DUMP", "event.category": [ "iam" @@ -1580,6 +1579,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1594,7 +1594,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_EMAIL_MONITOR", "event.category": [ "iam" @@ -1631,6 +1630,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1645,7 +1645,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_MAILBOX_DUMP", "event.category": [ "iam" @@ -1682,6 +1681,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1696,7 +1696,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_FIRST_NAME", "event.category": [ "iam" @@ -1734,6 +1733,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1748,7 +1748,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "GMAIL_RESET_USER", "event.category": [ "iam" @@ -1785,6 +1784,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1799,7 +1799,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_LAST_NAME", "event.category": [ "iam" @@ -1837,6 +1836,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1851,7 +1851,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MAIL_ROUTING_DESTINATION_ADDED", "event.category": [ "iam" @@ -1888,6 +1887,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1902,7 +1902,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MAIL_ROUTING_DESTINATION_REMOVED", "event.category": [ "iam" @@ -1939,6 +1938,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1953,7 +1953,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ADD_NICKNAME", "event.category": [ "iam" @@ -1990,6 +1989,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2004,7 +2004,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_NICKNAME", "event.category": [ "iam" @@ -2041,6 +2040,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2055,7 +2055,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_PASSWORD", "event.category": [ "iam" @@ -2091,6 +2090,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2105,7 +2105,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CHANGE_PASSWORD_ON_NEXT_LOGIN", "event.category": [ "iam" @@ -2143,6 +2142,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2157,7 +2157,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DOWNLOAD_PENDING_INVITES_LIST", "event.category": [ "iam" @@ -2190,6 +2189,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2204,7 +2204,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_RECOVERY_EMAIL", "event.category": [ "iam" @@ -2240,6 +2239,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2254,7 +2254,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REMOVE_RECOVERY_PHONE", "event.category": [ "iam" @@ -2290,6 +2289,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2304,7 +2304,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REQUEST_ACCOUNT_INFO", "event.category": [ "iam" @@ -2340,6 +2339,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2354,7 +2354,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REQUEST_MAILBOX_DUMP", "event.category": [ "iam" @@ -2396,6 +2395,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2410,7 +2410,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RESEND_USER_INVITE", "event.category": [ "iam" @@ -2447,6 +2446,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2461,7 +2461,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RESET_SIGNIN_COOKIES", "event.category": [ "iam" @@ -2497,6 +2496,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2511,7 +2511,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SECURITY_KEY_REGISTERED_FOR_USER", "event.category": [ "iam" @@ -2547,6 +2546,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2561,7 +2561,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "REVOKE_SECURITY_KEY", "event.category": [ "iam" @@ -2597,6 +2596,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2611,7 +2611,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_INVITE", "event.category": [ "iam" @@ -2648,6 +2647,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2662,7 +2662,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "VIEW_TEMP_PASSWORD", "event.category": [ "iam" @@ -2699,6 +2698,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2713,7 +2713,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "TURN_OFF_2_STEP_VERIFICATION", "event.category": [ "iam" @@ -2749,6 +2748,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2763,7 +2763,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNBLOCK_USER_SESSION", "event.category": [ "iam" @@ -2799,6 +2798,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2813,7 +2813,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNENROLL_USER_FROM_TITANIUM", "event.category": [ "iam" @@ -2849,6 +2848,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2863,7 +2863,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ARCHIVE_USER", "event.category": [ "iam" @@ -2899,6 +2898,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2913,7 +2913,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPDATE_BIRTHDATE", "event.category": [ "iam" @@ -2950,6 +2949,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -2964,7 +2964,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "CREATE_USER", "event.category": [ "iam" @@ -3000,6 +2999,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3014,7 +3014,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DELETE_USER", "event.category": [ "iam" @@ -3050,6 +3049,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3064,7 +3064,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DOWNGRADE_USER_FROM_GPLUS", "event.category": [ "iam" @@ -3100,6 +3099,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3114,7 +3114,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_ENROLLED_IN_TWO_STEP_VERIFICATION", "event.category": [ "iam" @@ -3150,6 +3149,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3164,7 +3164,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "DOWNLOAD_USERLIST_CSV", "event.category": [ "iam" @@ -3197,6 +3196,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3211,7 +3211,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "MOVE_USER_TO_ORG_UNIT", "event.category": [ "iam" @@ -3249,6 +3248,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3263,7 +3263,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD", "event.category": [ "iam" @@ -3300,6 +3299,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3314,7 +3314,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "RENAME_USER", "event.category": [ "iam" @@ -3351,6 +3350,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3365,7 +3365,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNENROLL_USER_FROM_STRONG_AUTH", "event.category": [ "iam" @@ -3401,6 +3400,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3415,7 +3415,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "SUSPEND_USER", "event.category": [ "iam" @@ -3451,6 +3450,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3465,7 +3465,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNARCHIVE_USER", "event.category": [ "iam" @@ -3501,6 +3500,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3515,7 +3515,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNDELETE_USER", "event.category": [ "iam" @@ -3551,6 +3550,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3565,7 +3565,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UNSUSPEND_USER", "event.category": [ "iam" @@ -3601,6 +3600,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3615,7 +3615,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "UPGRADE_USER_TO_GPLUS", "event.category": [ "iam" @@ -3651,6 +3650,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3665,7 +3665,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USERS_BULK_UPLOAD", "event.category": [ "iam" @@ -3700,6 +3699,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3714,7 +3714,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "USERS_BULK_UPLOAD_NOTIFICATION_SENT", "event.category": [ "iam" @@ -3750,6 +3749,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -3763,4 +3763,4 @@ "forwarded" ] } -] +] \ No newline at end of file diff --git a/x-pack/filebeat/module/gsuite/drive/test/gsuite-drive-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/drive/test/gsuite-drive-test.json.log-expected.json index 3d75fea232d..9ffde6ce107 100644 --- a/x-pack/filebeat/module/gsuite/drive/test/gsuite-drive-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/drive/test/gsuite-drive-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "add_to_folder", "event.category": [ "file" @@ -47,6 +46,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -61,7 +61,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "approval_canceled", "event.category": [ "file", @@ -107,6 +106,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -121,7 +121,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "approval_comment_added", "event.category": [ "file", @@ -167,6 +166,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -181,7 +181,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "approval_requested", "event.category": [ "file", @@ -227,6 +226,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -241,7 +241,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "approval_reviewer_responded", "event.category": [ "file", @@ -287,6 +286,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -301,7 +301,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "create", "event.category": [ "file" @@ -346,6 +345,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -360,7 +360,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "delete", "event.category": [ "file" @@ -405,6 +404,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -419,7 +419,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "download", "event.category": [ "file" @@ -464,6 +463,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -478,7 +478,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "edit", "event.category": [ "file" @@ -523,6 +522,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -537,7 +537,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "add_lock", "event.category": [ "file" @@ -582,6 +581,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -596,7 +596,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "move", "event.category": [ "file" @@ -645,6 +644,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -659,7 +659,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "preview", "event.category": [ "file" @@ -704,6 +703,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -718,7 +718,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "print", "event.category": [ "file" @@ -763,6 +762,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -777,7 +777,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "remove_from_folder", "event.category": [ "file" @@ -824,6 +823,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -838,7 +838,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "rename", "event.category": [ "file" @@ -885,6 +884,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -899,7 +899,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "untrash", "event.category": [ "file" @@ -944,6 +943,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -958,7 +958,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "sheets_import_range", "event.category": [ "file" @@ -1003,6 +1002,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1017,7 +1017,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "trash", "event.category": [ "file" @@ -1062,6 +1061,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1076,7 +1076,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "remove_lock", "event.category": [ "file" @@ -1121,6 +1120,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1135,7 +1135,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "upload", "event.category": [ "file" @@ -1180,6 +1179,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1194,7 +1194,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "view", "event.category": [ "file" @@ -1240,6 +1239,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1254,7 +1254,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_acl_editors", "event.category": [ "file", @@ -1304,6 +1303,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1318,7 +1318,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_document_access_scope", "event.category": [ "file", @@ -1369,6 +1368,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1383,7 +1383,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_document_visibility", "event.category": [ "file", @@ -1434,6 +1433,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1448,7 +1448,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "shared_drive_membership_change", "event.category": [ "file", @@ -1499,6 +1498,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1513,7 +1513,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "shared_drive_settings_change", "event.category": [ "file", @@ -1564,6 +1563,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1578,7 +1578,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "sheets_import_range_access_change", "event.category": [ "file", @@ -1624,6 +1623,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1638,7 +1638,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_user_access", "event.category": [ "file", @@ -1690,6 +1689,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/groups/test/gsuite-groups-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/groups/test/gsuite-groups-test.json.log-expected.json index 8944e12d5e7..f62ef0391c0 100644 --- a/x-pack/filebeat/module/gsuite/groups/test/gsuite-groups-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/groups/test/gsuite-groups-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_acl_permission", "event.category": [ "iam" @@ -45,6 +44,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -59,7 +59,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "accept_invitation", "event.category": [ "iam" @@ -97,6 +96,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -111,7 +111,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "approve_join_request", "event.category": [ "iam" @@ -151,6 +150,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -165,7 +165,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "join", "event.category": [ "iam" @@ -203,6 +202,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -217,7 +217,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "request_to_join", "event.category": [ "iam" @@ -255,6 +254,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -269,7 +269,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_basic_setting", "event.category": [ "iam" @@ -309,6 +308,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -323,7 +323,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "create_group", "event.category": [ "iam" @@ -360,6 +359,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -374,7 +374,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "delete_group", "event.category": [ "iam" @@ -411,6 +410,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -425,7 +425,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_identity_setting", "event.category": [ "iam" @@ -465,6 +464,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -479,7 +479,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "add_info_setting", "event.category": [ "iam" @@ -518,6 +517,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -532,7 +532,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_info_setting", "event.category": [ "iam" @@ -572,6 +571,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -586,7 +586,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "remove_info_setting", "event.category": [ "iam" @@ -625,6 +624,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -639,7 +639,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_new_members_restrictions_setting", "event.category": [ "iam" @@ -679,6 +678,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -693,7 +693,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_post_replies_setting", "event.category": [ "iam" @@ -733,6 +732,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -747,7 +747,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_spam_moderation_setting", "event.category": [ "iam" @@ -787,6 +786,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -801,7 +801,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "change_topic_setting", "event.category": [ "iam" @@ -841,6 +840,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -855,7 +855,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "moderate_message", "event.category": [ "iam" @@ -896,6 +895,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -910,7 +910,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "always_post_from_user", "event.category": [ "iam" @@ -951,6 +950,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -965,7 +965,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "add_user", "event.category": [ "iam" @@ -1006,6 +1005,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1020,7 +1020,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "ban_user_with_moderation", "event.category": [ "iam" @@ -1061,6 +1060,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1075,7 +1075,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "revoke_invitation", "event.category": [ "iam" @@ -1115,6 +1114,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1129,7 +1129,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "invite_user", "event.category": [ "iam" @@ -1169,6 +1168,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1183,7 +1183,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "reject_join_request", "event.category": [ "iam" @@ -1223,6 +1222,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1237,7 +1237,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "reinvite_user", "event.category": [ "iam" @@ -1277,6 +1276,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -1291,7 +1291,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "remove_user", "event.category": [ "iam" @@ -1331,6 +1330,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log-expected.json index 00731f235f3..287e6245a25 100644 --- a/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "account_disabled_password_leak", "event.category": [ "authentication" @@ -35,6 +34,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -49,7 +49,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "account_disabled_generic", "event.category": [ "authentication" @@ -84,6 +83,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -98,7 +98,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "account_disabled_spamming_through_relay", "event.category": [ "authentication" @@ -133,6 +132,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -147,7 +147,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "account_disabled_spamming", "event.category": [ "authentication" @@ -182,6 +181,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -196,7 +196,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "gov_attack_warning", "event.category": [ "authentication" @@ -229,6 +228,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -243,7 +243,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "login_failure", "event.category": [ "authentication" @@ -280,6 +279,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -294,7 +294,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "login_challenge", "event.category": [ "authentication" @@ -330,6 +329,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -344,7 +344,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "login_verification", "event.category": [ "authentication" @@ -381,6 +380,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -395,7 +395,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "logout", "event.category": [ "authentication" @@ -429,6 +428,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -443,7 +443,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "login_success", "event.category": [ "authentication" @@ -480,6 +479,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json index 36dec3bfb61..6dd2d0216b0 100644 --- a/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "login_failure", "event.category": [ "authentication" @@ -40,6 +39,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -54,7 +54,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:01.000Z", "event.action": "login_success", "event.category": [ "authentication" @@ -92,6 +91,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/gsuite/user_accounts/test/gsuite-user_accounts-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/user_accounts/test/gsuite-user_accounts-test.json.log-expected.json index 47aba59e1da..689aad5cde2 100644 --- a/x-pack/filebeat/module/gsuite/user_accounts/test/gsuite-user_accounts-test.json.log-expected.json +++ b/x-pack/filebeat/module/gsuite/user_accounts/test/gsuite-user_accounts-test.json.log-expected.json @@ -1,6 +1,5 @@ [ { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "2sv_disable", "event.category": [ "iam" @@ -34,6 +33,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -48,7 +48,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "2sv_enroll", "event.category": [ "iam" @@ -82,6 +81,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -96,7 +96,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "password_edit", "event.category": [ "iam" @@ -130,6 +129,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -144,7 +144,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "recovery_email_edit", "event.category": [ "iam" @@ -178,6 +177,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -192,7 +192,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "recovery_phone_edit", "event.category": [ "iam" @@ -226,6 +225,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -240,7 +240,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "recovery_secret_qa_edit", "event.category": [ "iam" @@ -274,6 +273,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -288,7 +288,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "titanium_enroll", "event.category": [ "iam" @@ -322,6 +321,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", @@ -336,7 +336,6 @@ ] }, { - "@timestamp": "2020-10-02T15:00:00.000Z", "event.action": "titanium_unenroll", "event.category": [ "iam" @@ -370,6 +369,7 @@ "source.geo.city_name": "State College", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.7957, "source.geo.location.lon": -77.8618, "source.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json b/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json index 7894d6ff317..9aee12937a0 100644 --- a/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json +++ b/x-pack/filebeat/module/imperva/securesphere/test/generated.log-expected.json @@ -112,13 +112,13 @@ "ccusan7572.api.home" ], "related.ip": [ - "10.58.116.231", - "10.159.182.171" + "10.159.182.171", + "10.58.116.231" ], "related.user": [ - "temUten", + "qua", "uradi", - "qua" + "temUten" ], "rsa.counters.dclass_c1": 3626, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -174,9 +174,9 @@ "10.18.124.28" ], "related.user": [ - "modocons", + "mquidol", "lapariat", - "mquidol" + "modocons" ], "rsa.counters.dclass_c1": 6564, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -239,8 +239,8 @@ ], "related.user": [ "oluptas", - "occae", - "intoc" + "intoc", + "occae" ], "rsa.counters.event_counter": 7243, "rsa.db.database": "tNequepo", @@ -374,9 +374,9 @@ "10.211.105.204" ], "related.user": [ + "orema", "eveli", - "labor", - "orema" + "labor" ], "rsa.counters.dclass_c1": 6855, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -432,13 +432,13 @@ "pora6854.www5.home" ], "related.ip": [ - "10.214.191.180", - "10.112.250.193" + "10.112.250.193", + "10.214.191.180" ], "related.user": [ - "Exc", + "ipsumdol", "ide", - "ipsumdol" + "Exc" ], "rsa.counters.dclass_c1": 6852, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -493,12 +493,12 @@ "ptasn6599.www.localhost" ], "related.ip": [ - "10.192.34.76", - "10.251.20.13" + "10.251.20.13", + "10.192.34.76" ], "related.user": [ - "iquipe", "tnonpro", + "iquipe", "ovol" ], "rsa.counters.dclass_c1": 3645, @@ -556,8 +556,8 @@ ], "related.user": [ "idunt", - "archite", - "boree" + "boree", + "archite" ], "rsa.counters.dclass_c1": 248, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -617,8 +617,8 @@ "10.168.159.13" ], "related.user": [ - "atemq", "inci", + "atemq", "isnostr" ], "rsa.counters.dclass_c1": 6135, @@ -679,9 +679,9 @@ "10.49.167.57" ], "related.user": [ + "tali", "ccaeca", - "sau", - "tali" + "sau" ], "rsa.counters.dclass_c1": 6818, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -743,17 +743,17 @@ "10.216.125.252" ], "related.user": [ + "lorsita", "dolore", - "llamco", - "lorsita" + "llamco" ], "rsa.counters.event_counter": 4603, "rsa.db.database": "uptate", "rsa.internal.event_desc": "aquae", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "accept", - "quasia" + "quasia", + "accept" ], "rsa.misc.category": "boreetdo", "rsa.misc.disposition": "aturve", @@ -809,8 +809,8 @@ "umdolor4389.api.home" ], "related.ip": [ - "10.52.125.9", - "10.204.128.215" + "10.204.128.215", + "10.52.125.9" ], "related.user": [ "nci", @@ -875,8 +875,8 @@ "rationev6444.localhost" ], "related.ip": [ - "10.34.148.166", - "10.200.68.129" + "10.200.68.129", + "10.34.148.166" ], "related.user": [ "icabo", @@ -938,8 +938,8 @@ ], "related.user": [ "siu", - "conse", - "licabo" + "licabo", + "conse" ], "rsa.counters.dclass_c1": 6356, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -995,13 +995,13 @@ "spernatu5539.domain" ], "related.ip": [ - "10.30.98.10", - "10.126.26.131" + "10.126.26.131", + "10.30.98.10" ], "related.user": [ - "dipisci", + "velite", "olori", - "velite" + "dipisci" ], "rsa.counters.dclass_c1": 7717, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1061,9 +1061,9 @@ "10.190.10.219" ], "related.user": [ - "item", + "accusant", "quamnih", - "accusant" + "item" ], "rsa.counters.dclass_c1": 3278, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1147,12 +1147,12 @@ "maliquam2147.internal.home" ], "related.ip": [ - "10.100.98.56", - "10.248.184.200" + "10.248.184.200", + "10.100.98.56" ], "related.user": [ - "ritati", "proident", + "ritati", "boru" ], "rsa.counters.dclass_c1": 5923, @@ -1209,13 +1209,13 @@ "olabor2983.internal.localhost" ], "related.ip": [ - "10.197.6.245", - "10.82.28.220" + "10.82.28.220", + "10.197.6.245" ], "related.user": [ - "oluptat", "dtempo", - "aecatcup" + "aecatcup", + "oluptat" ], "rsa.counters.dclass_c1": 3071, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1276,8 +1276,8 @@ ], "related.user": [ "redol", - "asnu", - "ationul" + "ationul", + "asnu" ], "rsa.counters.dclass_c1": 6606, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1339,17 +1339,17 @@ "10.88.45.111" ], "related.user": [ + "undeomni", "lmole", - "iameaque", - "undeomni" + "iameaque" ], "rsa.counters.event_counter": 6344, "rsa.db.database": "nderi", "rsa.internal.event_desc": "iae", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "illu", - "deny" + "deny", + "illu" ], "rsa.misc.category": "quido", "rsa.misc.disposition": "emip", @@ -1407,8 +1407,8 @@ "10.214.3.140" ], "related.user": [ - "edolorin", "scipitl", + "edolorin", "taliqui" ], "rsa.counters.dclass_c1": 5140, @@ -1472,8 +1472,8 @@ ], "related.user": [ "caboNem", - "pta", - "etconsec" + "etconsec", + "pta" ], "rsa.counters.event_counter": 5347, "rsa.db.database": "urExcept", @@ -1535,13 +1535,13 @@ "nder347.www.corp" ], "related.ip": [ - "10.105.190.170", - "10.182.152.242" + "10.182.152.242", + "10.105.190.170" ], "related.user": [ + "doeiu", "litan", - "mquisn", - "doeiu" + "mquisn" ], "rsa.counters.dclass_c1": 3474, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1604,8 +1604,8 @@ ], "related.user": [ "emUte", - "liquam", - "min" + "min", + "liquam" ], "rsa.counters.event_counter": 7102, "rsa.db.database": "oluptat", @@ -1666,13 +1666,13 @@ "ectob4634.mail.localhost" ], "related.ip": [ - "10.72.75.207", - "10.201.168.116" + "10.201.168.116", + "10.72.75.207" ], "related.user": [ + "urau", "eFini", - "eufug", - "urau" + "eufug" ], "rsa.counters.dclass_c1": 3348, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1728,13 +1728,13 @@ "snu6436.www.local" ], "related.ip": [ - "10.9.46.123", - "10.58.133.175" + "10.58.133.175", + "10.9.46.123" ], "related.user": [ + "nde", "oco", - "mfu", - "nde" + "mfu" ], "rsa.counters.dclass_c1": 3795, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -1794,8 +1794,8 @@ "10.70.29.203" ], "related.user": [ - "mquisnos", "veniamq", + "mquisnos", "pta" ], "rsa.counters.dclass_c1": 2358, @@ -1856,8 +1856,8 @@ "10.165.182.111" ], "related.user": [ - "ames", "Bonorum", + "ames", "sis" ], "rsa.counters.dclass_c1": 6401, @@ -1944,8 +1944,8 @@ "upt6017.api.localdomain" ], "related.ip": [ - "10.64.184.196", - "10.173.178.109" + "10.173.178.109", + "10.64.184.196" ], "related.user": [ "tam", @@ -1957,8 +1957,8 @@ "rsa.internal.event_desc": "orin", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "block", - "lamco" + "lamco", + "block" ], "rsa.misc.category": "enia", "rsa.misc.disposition": "iavol", @@ -2012,13 +2012,13 @@ "turQuis4046.api.test" ], "related.ip": [ - "10.90.50.149", - "10.168.225.209" + "10.168.225.209", + "10.90.50.149" ], "related.user": [ "aUtenima", - "olupta", - "olu" + "olu", + "olupta" ], "rsa.counters.dclass_c1": 1127, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2079,8 +2079,8 @@ ], "related.user": [ "mtota", - "luptat", - "qua" + "qua", + "luptat" ], "rsa.counters.dclass_c1": 6112, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2163,13 +2163,13 @@ "tatnonp1371.www.invalid" ], "related.ip": [ - "10.151.240.35", - "10.228.229.144" + "10.228.229.144", + "10.151.240.35" ], "related.user": [ + "lam", "ametcons", - "ama", - "lam" + "ama" ], "rsa.counters.dclass_c1": 4325, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2289,17 +2289,17 @@ "10.254.10.98" ], "related.user": [ - "civeli", "eufugia", - "ttenb" + "ttenb", + "civeli" ], "rsa.counters.event_counter": 7365, "rsa.db.database": "utlabore", "rsa.internal.event_desc": "culpaq", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "cancel", - "uptasn" + "uptasn", + "cancel" ], "rsa.misc.category": "quamq", "rsa.misc.disposition": "usan", @@ -2383,13 +2383,13 @@ "ihi7294.www5.localhost" ], "related.ip": [ - "10.169.28.157", - "10.116.1.130" + "10.116.1.130", + "10.169.28.157" ], "related.user": [ - "reseo", + "eturadip", "amco", - "eturadip" + "reseo" ], "rsa.counters.event_counter": 1295, "rsa.db.database": "ons", @@ -2451,13 +2451,13 @@ "caecat4920.api.host" ], "related.ip": [ - "10.29.138.31", - "10.45.69.152" + "10.45.69.152", + "10.29.138.31" ], "related.user": [ - "volupta", "umq", - "tsunt" + "tsunt", + "volupta" ], "rsa.counters.dclass_c1": 744, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2513,13 +2513,13 @@ "setquas6188.internal.local" ], "related.ip": [ - "10.100.113.11", - "10.152.213.228" + "10.152.213.228", + "10.100.113.11" ], "related.user": [ - "ptatev", "itationu", - "velillum" + "velillum", + "ptatev" ], "rsa.counters.dclass_c1": 7245, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2603,13 +2603,13 @@ "nibusBo3674.www5.localhost" ], "related.ip": [ - "10.208.33.55", - "10.248.102.129" + "10.248.102.129", + "10.208.33.55" ], "related.user": [ + "ulapari", "mremaper", - "inimv", - "ulapari" + "inimv" ], "rsa.counters.dclass_c1": 6433, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2669,8 +2669,8 @@ "10.109.230.216" ], "related.user": [ - "mporin", "ectobea", + "mporin", "ibus" ], "rsa.counters.dclass_c1": 547, @@ -2731,9 +2731,9 @@ "10.117.81.75" ], "related.user": [ - "iconsequ", + "dol", "exeac", - "dol" + "iconsequ" ], "rsa.counters.dclass_c1": 484, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2793,8 +2793,8 @@ "10.45.152.205" ], "related.user": [ - "eriti", "utlabo", + "eriti", "imav" ], "rsa.counters.dclass_c1": 922, @@ -2856,17 +2856,17 @@ "10.60.164.100" ], "related.user": [ - "hite", + "adipis", "ugi", - "adipis" + "hite" ], "rsa.counters.event_counter": 508, "rsa.db.database": "abo", "rsa.internal.event_desc": "epteurs", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "taevitae", - "allow" + "allow", + "taevitae" ], "rsa.misc.category": "itse", "rsa.misc.disposition": "rever", @@ -2919,13 +2919,13 @@ "aliquip7229.mail.domain" ], "related.ip": [ - "10.248.244.203", - "10.146.228.234" + "10.146.228.234", + "10.248.244.203" ], "related.user": [ "mquamei", - "eiusm", - "sum" + "sum", + "eiusm" ], "rsa.counters.dclass_c1": 3058, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -2981,8 +2981,8 @@ "10.86.121.152" ], "related.user": [ - "ine", "consecte", + "ine", "nimv" ], "rsa.counters.dclass_c1": 2771, @@ -3039,13 +3039,13 @@ "agnama5013.internal.example" ], "related.ip": [ - "10.201.223.119", - "10.204.223.184" + "10.204.223.184", + "10.201.223.119" ], "related.user": [ + "tuserror", "rcit", - "teni", - "tuserror" + "teni" ], "rsa.counters.dclass_c1": 4113, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3106,8 +3106,8 @@ ], "related.user": [ "magnido", - "Nequepo", - "elitsedd" + "elitsedd", + "Nequepo" ], "rsa.counters.dclass_c1": 3243, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3169,17 +3169,17 @@ "10.65.225.101" ], "related.user": [ - "tuserror", "citation", - "emquel" + "emquel", + "tuserror" ], "rsa.counters.event_counter": 2513, "rsa.db.database": "rspiciat", "rsa.internal.event_desc": "atuse", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "eruntmol", - "cancel" + "cancel", + "eruntmol" ], "rsa.misc.category": "imad", "rsa.misc.disposition": "tura", @@ -3236,9 +3236,9 @@ "10.191.184.105" ], "related.user": [ + "uta", "iin", - "tione", - "uta" + "tione" ], "rsa.counters.dclass_c1": 5836, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3296,8 +3296,8 @@ "10.224.148.48" ], "related.user": [ - "equepor", "niam", + "equepor", "iosamn" ], "rsa.counters.event_counter": 7468, @@ -3360,12 +3360,12 @@ "amcorp7299.api.example" ], "related.ip": [ - "10.21.208.103", - "10.21.61.134" + "10.21.61.134", + "10.21.208.103" ], "related.user": [ - "ostr", "imidest", + "ostr", "mipsa" ], "rsa.counters.dclass_c1": 7766, @@ -3426,8 +3426,8 @@ "10.221.192.116" ], "related.user": [ - "iarchit", "iamquisn", + "iarchit", "tevelite" ], "rsa.counters.dclass_c1": 639, @@ -3486,8 +3486,8 @@ "tionevol3157.mail.invalid" ], "related.ip": [ - "10.191.142.143", - "10.240.62.238" + "10.240.62.238", + "10.191.142.143" ], "related.user": [ "nofde", @@ -3555,21 +3555,21 @@ "mquis319.api.local" ], "related.ip": [ - "10.178.79.217", - "10.111.22.134" + "10.111.22.134", + "10.178.79.217" ], "related.user": [ - "ccusan", + "tqui", "inibusBo", - "tqui" + "ccusan" ], "rsa.counters.event_counter": 3538, "rsa.db.database": "sequun", "rsa.internal.event_desc": "adeseru", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "deny", - "orisnis" + "orisnis", + "deny" ], "rsa.misc.category": "sitas", "rsa.misc.disposition": "eni", @@ -3622,13 +3622,13 @@ "urad5712.api.host" ], "related.ip": [ - "10.161.225.172", - "10.77.86.215" + "10.77.86.215", + "10.161.225.172" ], "related.user": [ - "xerc", + "rcit", "meaqu", - "rcit" + "xerc" ], "rsa.counters.dclass_c1": 7286, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3687,9 +3687,9 @@ "10.211.161.187" ], "related.user": [ - "boriosa", "sci", - "acons" + "acons", + "boriosa" ], "rsa.counters.dclass_c1": 1578, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3740,13 +3740,13 @@ "inBCSed5308.api.corp" ], "related.ip": [ - "10.254.198.47", - "10.160.147.230" + "10.160.147.230", + "10.254.198.47" ], "related.user": [ - "nimvenia", "ndeomnis", - "illoin" + "illoin", + "nimvenia" ], "rsa.counters.dclass_c1": 5988, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3802,9 +3802,9 @@ "10.40.24.93" ], "related.user": [ - "exerci", + "orisnis", "mSecti", - "orisnis" + "exerci" ], "rsa.counters.dclass_c1": 4129, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3860,13 +3860,13 @@ "itte6905.mail.invalid" ], "related.ip": [ - "10.249.13.159", - "10.108.130.106" + "10.108.130.106", + "10.249.13.159" ], "related.user": [ + "colab", "uisautei", - "exeacomm", - "colab" + "exeacomm" ], "rsa.counters.dclass_c1": 1044, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -3924,13 +3924,13 @@ "caboNemo274.www.host" ], "related.ip": [ - "10.39.244.49", - "10.64.94.174" + "10.64.94.174", + "10.39.244.49" ], "related.user": [ + "estiae", "iunt", - "Sedut", - "estiae" + "Sedut" ], "rsa.counters.event_counter": 7128, "rsa.db.database": "eFinibu", @@ -4047,13 +4047,13 @@ "qui5978.api.test" ], "related.ip": [ - "10.115.203.143", - "10.134.135.22" + "10.134.135.22", + "10.115.203.143" ], "related.user": [ + "utoditau", "involu", - "orpori", - "utoditau" + "orpori" ], "rsa.counters.dclass_c1": 7868, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4203,9 +4203,9 @@ "10.20.231.188" ], "related.user": [ - "tesseq", + "mqu", "uatDuisa", - "mqu" + "tesseq" ], "rsa.counters.dclass_c1": 1623, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4289,13 +4289,13 @@ "abor3266.mail.home" ], "related.ip": [ - "10.225.11.197", - "10.231.77.26" + "10.231.77.26", + "10.225.11.197" ], "related.user": [ + "rehe", "ineavol", - "volu", - "rehe" + "volu" ], "rsa.counters.dclass_c1": 3064, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4349,13 +4349,13 @@ "eprehe2455.www.home" ], "related.ip": [ - "10.148.3.197", - "10.106.166.105" + "10.106.166.105", + "10.148.3.197" ], "related.user": [ - "olupt", "usa", - "avolup" + "avolup", + "olupt" ], "rsa.counters.dclass_c1": 2658, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4411,9 +4411,9 @@ "10.172.121.239" ], "related.user": [ - "ipsu", + "ctas", "iuta", - "ctas" + "ipsu" ], "rsa.counters.dclass_c1": 392, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4469,13 +4469,13 @@ "exerc3694.api.home" ], "related.ip": [ - "10.129.234.200", - "10.42.218.103" + "10.42.218.103", + "10.129.234.200" ], "related.user": [ - "tevelit", "tisundeo", - "dquia" + "dquia", + "tevelit" ], "rsa.counters.dclass_c1": 6709, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4535,9 +4535,9 @@ "10.111.132.221" ], "related.user": [ - "oloremi", + "ali", "scive", - "ali" + "oloremi" ], "rsa.counters.dclass_c1": 6155, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4593,13 +4593,13 @@ "boriosa7066.www.corp" ], "related.ip": [ - "10.195.8.141", - "10.17.214.21" + "10.17.214.21", + "10.195.8.141" ], "related.user": [ "dolo", - "ota", - "enimip" + "enimip", + "ota" ], "rsa.counters.dclass_c1": 469, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4659,8 +4659,8 @@ "10.173.13.179" ], "related.user": [ - "apar", "ptasn", + "apar", "isn" ], "rsa.counters.dclass_c1": 758, @@ -4717,13 +4717,13 @@ "iatisund424.mail.localdomain" ], "related.ip": [ - "10.178.190.123", - "10.42.135.34" + "10.42.135.34", + "10.178.190.123" ], "related.user": [ - "tiset", "orsi", - "ore" + "ore", + "tiset" ], "rsa.counters.dclass_c1": 2290, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4872,9 +4872,9 @@ "10.206.221.180" ], "related.user": [ - "oNe", + "nseq", "litesseq", - "nseq" + "oNe" ], "rsa.counters.dclass_c1": 3218, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4930,9 +4930,9 @@ "10.86.180.150" ], "related.user": [ - "mnisis", + "etconsec", "itasper", - "etconsec" + "mnisis" ], "rsa.counters.dclass_c1": 4564, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -4994,8 +4994,8 @@ "10.158.161.5" ], "related.user": [ - "rrors", - "dolo" + "dolo", + "rrors" ], "rsa.counters.event_counter": 4098, "rsa.db.database": "tsed", @@ -5084,12 +5084,12 @@ "nisiutal4437.www.example" ], "related.ip": [ - "10.150.27.144", - "10.248.16.82" + "10.248.16.82", + "10.150.27.144" ], "related.user": [ - "res", "ditautf", + "res", "tuserror" ], "rsa.counters.dclass_c1": 4367, @@ -5211,9 +5211,9 @@ "10.69.5.227" ], "related.user": [ - "rumw", "ntocc", - "doloreme" + "doloreme", + "rumw" ], "rsa.counters.dclass_c1": 5201, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5269,9 +5269,9 @@ "10.253.175.129" ], "related.user": [ + "epteurs", "nrep", - "ate", - "epteurs" + "ate" ], "rsa.counters.dclass_c1": 6260, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5333,8 +5333,8 @@ "10.89.26.170" ], "related.user": [ - "atus", "aboris", + "atus", "orumetMa" ], "rsa.counters.event_counter": 5863, @@ -5398,8 +5398,8 @@ "gitse6744.api.local" ], "related.ip": [ - "10.81.108.232", - "10.52.106.68" + "10.52.106.68", + "10.81.108.232" ], "related.user": [ "uaturve", @@ -5411,8 +5411,8 @@ "rsa.internal.event_desc": "pis", "rsa.internal.messageid": "Imperva", "rsa.misc.action": [ - "allow", - "Quisaut" + "Quisaut", + "allow" ], "rsa.misc.category": "idol", "rsa.misc.disposition": "mmodico", @@ -5472,9 +5472,9 @@ "10.223.10.28" ], "related.user": [ - "erit", "untex", - "usmodte" + "usmodte", + "erit" ], "rsa.counters.event_counter": 4029, "rsa.db.database": "ommodi", @@ -5541,8 +5541,8 @@ ], "related.user": [ "sequamn", - "res", - "tasnul" + "tasnul", + "res" ], "rsa.counters.dclass_c1": 4846, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5600,12 +5600,12 @@ "labo3477.www5.domain" ], "related.ip": [ - "10.226.75.20", - "10.247.108.144" + "10.247.108.144", + "10.226.75.20" ], "related.user": [ - "maccusan", "tema", + "maccusan", "fugia" ], "rsa.counters.event_counter": 3711, @@ -5667,13 +5667,13 @@ "itseddo2209.mail.domain" ], "related.ip": [ - "10.97.22.61", - "10.192.15.65" + "10.192.15.65", + "10.97.22.61" ], "related.user": [ - "illumd", "rExcep", - "nimides" + "nimides", + "illumd" ], "rsa.counters.dclass_c1": 4173, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5798,9 +5798,9 @@ "10.28.77.79" ], "related.user": [ + "utlab", "rspic", - "upta", - "utlab" + "upta" ], "rsa.counters.dclass_c1": 4810, "rsa.counters.dclass_c1_str": "Affected Rows", @@ -5855,13 +5855,13 @@ "tsunti1164.www.example" ], "related.ip": [ - "10.18.15.43", - "10.248.177.182" + "10.248.177.182", + "10.18.15.43" ], "related.user": [ - "quei", "caecat", - "quaturve" + "quaturve", + "quei" ], "rsa.counters.dclass_c1": 983, "rsa.counters.dclass_c1_str": "Affected Rows", diff --git a/x-pack/filebeat/module/iptables/log/test/geo.log-expected.json b/x-pack/filebeat/module/iptables/log/test/geo.log-expected.json index 40bbac9e3f5..73f2a49fabc 100644 --- a/x-pack/filebeat/module/iptables/log/test/geo.log-expected.json +++ b/x-pack/filebeat/module/iptables/log/test/geo.log-expected.json @@ -55,6 +55,7 @@ "source.as.organization.name": "Consorci de Serveis Universitaris de Catalunya", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.4172, "source.geo.location.lon": -3.684, "source.ip": "158.109.0.1", diff --git a/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json index a33eb424fdd..fb4fca25df2 100644 --- a/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json +++ b/x-pack/filebeat/module/juniper/netscreen/test/generated.log-expected.json @@ -1353,8 +1353,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.142.21.251", - "10.154.16.147" + "10.154.16.147", + "10.142.21.251" ], "rsa.internal.messageid": "00625", "rsa.misc.hardware_id": "ute", @@ -1387,8 +1387,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.105.212.51", - "10.119.53.68" + "10.119.53.68", + "10.105.212.51" ], "rsa.db.index": "giatqu", "rsa.internal.messageid": "00042", @@ -1852,8 +1852,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.51.161.245", - "10.193.80.21" + "10.193.80.21", + "10.51.161.245" ], "rsa.internal.messageid": "00625", "rsa.misc.hardware_id": "modi", @@ -2318,8 +2318,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.185.50.112", - "10.126.150.15" + "10.126.150.15", + "10.185.50.112" ], "rsa.internal.messageid": "00625", "rsa.misc.hardware_id": "tot", @@ -2479,8 +2479,8 @@ "observer.type": "Firewall", "observer.vendor": "Juniper", "related.ip": [ - "10.96.165.147", - "10.96.218.99" + "10.96.218.99", + "10.96.165.147" ], "related.user": [ "utla" diff --git a/x-pack/filebeat/module/misp/threat/test/misp-test.json.log-expected.json b/x-pack/filebeat/module/misp/threat/test/misp-test.json.log-expected.json index a4b6019bc5d..163acbfd544 100644 --- a/x-pack/filebeat/module/misp/threat/test/misp-test.json.log-expected.json +++ b/x-pack/filebeat/module/misp/threat/test/misp-test.json.log-expected.json @@ -4,6 +4,7 @@ "destination.geo.city_name": "State College", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 40.7957, "destination.geo.location.lon": -77.8618, "destination.geo.region_iso_code": "US-PA", diff --git a/x-pack/filebeat/module/netscout/sightline/test/generated.log-expected.json b/x-pack/filebeat/module/netscout/sightline/test/generated.log-expected.json index 530aa6f4cc1..2ac0d3443e7 100644 --- a/x-pack/filebeat/module/netscout/sightline/test/generated.log-expected.json +++ b/x-pack/filebeat/module/netscout/sightline/test/generated.log-expected.json @@ -317,8 +317,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.66.171.247", - "10.155.162.162" + "10.155.162.162", + "10.66.171.247" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", @@ -396,8 +396,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.179.26.34", - "10.38.77.13" + "10.38.77.13", + "10.179.26.34" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", @@ -1101,8 +1101,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.97.164.220", - "10.128.31.83" + "10.128.31.83", + "10.97.164.220" ], "rsa.internal.messageid": "anomaly", "rsa.misc.category": "aera", @@ -1816,8 +1816,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.98.209.10", - "10.31.177.226" + "10.31.177.226", + "10.98.209.10" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", @@ -1848,8 +1848,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.44.47.27", - "10.179.210.218" + "10.179.210.218", + "10.44.47.27" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", @@ -2129,8 +2129,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.151.129.181", - "10.55.156.64" + "10.55.156.64", + "10.151.129.181" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", @@ -2236,8 +2236,8 @@ "observer.type": "DDOS", "observer.vendor": "Netscout", "related.ip": [ - "10.166.90.130", - "10.73.89.189" + "10.73.89.189", + "10.166.90.130" ], "rsa.internal.messageid": "Blocked_Host", "rsa.misc.msgIdPart1": "Blocked", diff --git a/x-pack/filebeat/module/o365/audit/test/04-sharepoint.log-expected.json b/x-pack/filebeat/module/o365/audit/test/04-sharepoint.log-expected.json index 56a4f778e7f..12d780947fb 100644 --- a/x-pack/filebeat/module/o365/audit/test/04-sharepoint.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/04-sharepoint.log-expected.json @@ -48,6 +48,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -116,6 +117,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -184,6 +186,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -252,6 +255,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/o365/audit/test/06-sharepointfileop.log-expected.json b/x-pack/filebeat/module/o365/audit/test/06-sharepointfileop.log-expected.json index b5c79d506d1..6f54a5ce22f 100644 --- a/x-pack/filebeat/module/o365/audit/test/06-sharepointfileop.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/06-sharepointfileop.log-expected.json @@ -55,6 +55,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -131,6 +132,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -207,6 +209,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -283,6 +286,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -360,6 +364,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -436,6 +441,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -512,6 +518,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -589,6 +596,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -665,6 +673,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -741,6 +750,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -817,6 +827,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json b/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json index cea77b1153f..78cfca3dbfb 100644 --- a/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/08-azuread.log-expected.json @@ -130,6 +130,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -273,6 +274,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -416,6 +418,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -570,6 +573,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -724,6 +728,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -885,6 +890,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1046,6 +1052,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1207,6 +1214,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1368,6 +1376,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1529,6 +1538,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1690,6 +1700,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1851,6 +1862,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2012,6 +2024,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2173,6 +2186,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2334,6 +2348,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2495,6 +2510,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2656,6 +2672,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2817,6 +2834,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2960,6 +2978,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3103,6 +3122,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3257,6 +3277,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3400,6 +3421,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3543,6 +3565,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3686,6 +3709,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3840,6 +3864,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4001,6 +4026,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4162,6 +4188,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4323,6 +4350,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4484,6 +4512,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4645,6 +4674,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4806,6 +4836,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4967,6 +4998,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5128,6 +5160,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5290,6 +5323,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5452,6 +5486,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5742,6 +5777,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5903,6 +5939,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6064,6 +6101,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6225,6 +6263,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6386,6 +6425,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6547,6 +6587,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6708,6 +6749,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6869,6 +6911,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7030,6 +7073,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7191,6 +7235,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7352,6 +7397,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7513,6 +7559,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7674,6 +7721,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7835,6 +7883,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -7996,6 +8045,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8158,6 +8208,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8320,6 +8371,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8481,6 +8533,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8642,6 +8695,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8803,6 +8857,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -8964,6 +9019,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9125,6 +9181,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9286,6 +9343,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9447,6 +9505,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9608,6 +9667,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9769,6 +9829,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -9912,6 +9973,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10055,6 +10117,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10198,6 +10261,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10341,6 +10405,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10494,6 +10559,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10648,6 +10714,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10802,6 +10869,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -10956,6 +11024,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11110,6 +11179,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11251,6 +11321,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11394,6 +11465,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11537,6 +11609,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11691,6 +11764,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11845,6 +11919,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -11999,6 +12074,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12142,6 +12218,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12285,6 +12362,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12428,6 +12506,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12582,6 +12661,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12736,6 +12816,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -12890,6 +12971,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13051,6 +13133,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13212,6 +13295,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13373,6 +13457,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13534,6 +13619,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13695,6 +13781,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -13856,6 +13943,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14017,6 +14105,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14178,6 +14267,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14339,6 +14429,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14500,6 +14591,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14661,6 +14753,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14823,6 +14916,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -14985,6 +15079,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -15147,6 +15242,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -15306,6 +15402,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -15465,6 +15562,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -15624,6 +15722,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/o365/audit/test/14-sp-sharing-op.log-expected.json b/x-pack/filebeat/module/o365/audit/test/14-sp-sharing-op.log-expected.json index cc096b3acc2..97cb1f5bb01 100644 --- a/x-pack/filebeat/module/o365/audit/test/14-sp-sharing-op.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/14-sp-sharing-op.log-expected.json @@ -305,6 +305,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -379,6 +380,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -454,6 +456,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -529,6 +532,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -604,6 +608,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/o365/audit/test/15-azuread-sts-logon.log-expected.json b/x-pack/filebeat/module/o365/audit/test/15-azuread-sts-logon.log-expected.json index 60c77401b35..5470038d6b8 100644 --- a/x-pack/filebeat/module/o365/audit/test/15-azuread-sts-logon.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/15-azuread-sts-logon.log-expected.json @@ -77,6 +77,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -174,6 +175,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -271,6 +273,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -368,6 +371,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -465,6 +469,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -562,6 +567,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -659,6 +665,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -756,6 +763,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -853,6 +861,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -950,6 +959,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1047,6 +1057,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1144,6 +1155,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1241,6 +1253,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1338,6 +1351,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1434,6 +1448,7 @@ "source.as.organization.name": "XFERA Moviles S.A.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.4172, "source.geo.location.lon": -3.684, "source.ip": "37.29.234.179", @@ -1529,6 +1544,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1626,6 +1642,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1722,6 +1739,7 @@ "source.as.organization.name": "XFERA Moviles S.A.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.4172, "source.geo.location.lon": -3.684, "source.ip": "37.29.234.179", @@ -1817,6 +1835,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -1914,6 +1933,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2011,6 +2031,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2108,6 +2129,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2205,6 +2227,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2302,6 +2325,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2399,6 +2423,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2496,6 +2521,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2593,6 +2619,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2690,6 +2717,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2787,6 +2815,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2883,6 +2912,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -2981,6 +3011,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3067,6 +3098,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3162,6 +3194,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3248,6 +3281,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3344,6 +3378,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3430,6 +3465,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3526,6 +3562,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3623,6 +3660,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3720,6 +3758,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3806,6 +3845,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3902,6 +3942,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -3998,6 +4039,7 @@ "source.as.organization.name": "XFERA Moviles S.A.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.4172, "source.geo.location.lon": -3.684, "source.ip": "37.29.234.179", @@ -4093,6 +4135,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4190,6 +4233,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4276,6 +4320,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4371,6 +4416,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4468,6 +4514,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4565,6 +4612,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4662,6 +4710,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4759,6 +4808,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4856,6 +4906,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -4953,6 +5004,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5050,6 +5102,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5147,6 +5200,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5244,6 +5298,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5341,6 +5396,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5438,6 +5494,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5535,6 +5592,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5631,6 +5689,7 @@ "source.as.organization.name": "XFERA Moviles S.A.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 40.4172, "source.geo.location.lon": -3.684, "source.ip": "37.29.234.179", @@ -5726,6 +5785,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5823,6 +5883,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -5920,6 +5981,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6017,6 +6079,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6114,6 +6177,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6211,6 +6275,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6308,6 +6373,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6405,6 +6471,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6502,6 +6569,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", @@ -6599,6 +6667,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/o365/audit/test/22-yammer.log-expected.json b/x-pack/filebeat/module/o365/audit/test/22-yammer.log-expected.json index 4bd20443e07..e6326bf27b1 100644 --- a/x-pack/filebeat/module/o365/audit/test/22-yammer.log-expected.json +++ b/x-pack/filebeat/module/o365/audit/test/22-yammer.log-expected.json @@ -48,6 +48,7 @@ "source.geo.city_name": "Barcelona", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 41.3891, "source.geo.location.lon": 2.1611, "source.geo.region_iso_code": "ES-B", diff --git a/x-pack/filebeat/module/okta/system/test/okta-system-test.json.log-expected.json b/x-pack/filebeat/module/okta/system/test/okta-system-test.json.log-expected.json index 437a7ea5627..39d00244185 100644 --- a/x-pack/filebeat/module/okta/system/test/okta-system-test.json.log-expected.json +++ b/x-pack/filebeat/module/okta/system/test/okta-system-test.json.log-expected.json @@ -55,6 +55,7 @@ "source.geo.city_name": "Dublin", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.7201, "source.geo.location.lon": -121.919, "source.geo.region_iso_code": "US-CA", @@ -130,6 +131,7 @@ "source.geo.city_name": "Dublin", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.7201, "source.geo.location.lon": -121.919, "source.geo.region_iso_code": "US-CA", @@ -220,6 +222,7 @@ "source.geo.city_name": "Dublin", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.7201, "source.geo.location.lon": -121.919, "source.geo.region_iso_code": "US-CA", diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json index 96530ab70f3..54a45d4465e 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_other.log-expected.json @@ -739,6 +739,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json index 37735ccfce0..8e5df2e94e4 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_threat.log-expected.json @@ -10,6 +10,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -104,6 +105,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -198,6 +200,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -292,6 +295,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -386,6 +390,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -480,6 +485,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -574,6 +580,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -668,6 +675,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -762,6 +770,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -856,6 +865,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -950,6 +960,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1044,6 +1055,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1138,6 +1150,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1232,6 +1245,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1325,6 +1339,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1419,6 +1434,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1512,6 +1528,7 @@ "destination.as.organization.name": "Leaseweb Deutschland GmbH", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 51.2993, "destination.geo.location.lon": 9.491, "destination.geo.name": "Germany", @@ -1603,6 +1620,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1697,6 +1715,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1791,6 +1810,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1885,6 +1905,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -1979,6 +2000,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2073,6 +2095,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2167,6 +2190,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2261,6 +2285,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2355,6 +2380,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2449,6 +2475,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2543,6 +2570,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2637,6 +2665,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2731,6 +2760,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2825,6 +2855,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -2919,6 +2950,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -3013,6 +3045,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -3106,6 +3139,7 @@ "destination.as.organization.name": "Castle Access Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3196,6 +3230,7 @@ "destination.as.organization.name": "INAMES", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "KR", + "destination.geo.country_name": "South Korea", "destination.geo.location.lat": 37.5112, "destination.geo.location.lon": 126.9741, "destination.geo.name": "Korea Republic Of", @@ -3286,6 +3321,7 @@ "destination.as.organization.name": "CJSC Registrar R01", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -3377,6 +3413,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -3469,6 +3506,7 @@ "destination.as.organization.name": "Confluence Networks Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3559,6 +3597,7 @@ "destination.as.organization.name": "Confluence Networks Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3650,6 +3689,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -3742,6 +3782,7 @@ "destination.as.organization.name": "Confluence Networks Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3832,6 +3873,7 @@ "destination.as.organization.name": "Domain names registrar REG.RU, Ltd", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -3922,6 +3964,7 @@ "destination.as.organization.name": "Domain names registrar REG.RU, Ltd", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -4079,6 +4122,7 @@ "source.geo.city_name": "Fort Lauderdale", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 26.1792, "source.geo.location.lon": -80.1749, "source.geo.name": "United States", @@ -4103,6 +4147,7 @@ "destination.geo.city_name": "Kitchener", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "CA", + "destination.geo.country_name": "Canada", "destination.geo.location.lat": 43.4419, "destination.geo.location.lon": -80.4216, "destination.geo.name": "Canada", @@ -4195,6 +4240,7 @@ "destination.as.organization.name": "Castle Access Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -4285,6 +4331,7 @@ "destination.as.organization.name": "Confluence Networks Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "VG", + "destination.geo.country_name": "British Virgin Islands", "destination.geo.location.lat": 18.5, "destination.geo.location.lon": -64.5, "destination.geo.name": "Virgin Islands British", @@ -4375,6 +4422,7 @@ "destination.as.organization.name": "Confluence Networks Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -4466,6 +4514,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -4559,6 +4608,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -4652,6 +4702,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -4745,6 +4796,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -4838,6 +4890,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -5000,6 +5053,7 @@ "source.geo.city_name": "Brea", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 33.9339, "source.geo.location.lon": -117.8854, "source.geo.name": "United States", @@ -5024,6 +5078,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -5186,6 +5241,7 @@ "source.geo.city_name": "Montreal", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "CA", + "source.geo.country_name": "Canada", "source.geo.location.lat": 45.4995, "source.geo.location.lon": -73.5848, "source.geo.name": "European Union", @@ -5278,6 +5334,7 @@ "source.as.organization.name": "No.31,Jin-rong Street", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 30.294, "source.geo.location.lon": 120.1619, "source.geo.name": "China", @@ -5302,6 +5359,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -5463,6 +5521,7 @@ "source.as.organization.name": "NForce Entertainment B.V.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "NL", + "source.geo.country_name": "Netherlands", "source.geo.location.lat": 52.3824, "source.geo.location.lon": 4.8995, "source.geo.name": "Netherlands", @@ -5554,6 +5613,7 @@ "source.geo.city_name": "Montreal", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "CA", + "source.geo.country_name": "Canada", "source.geo.location.lat": 45.4995, "source.geo.location.lon": -73.5848, "source.geo.name": "European Union", @@ -5577,6 +5637,7 @@ "destination.as.organization.name": "YANDEX LLC", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -5667,6 +5728,7 @@ "destination.as.organization.name": "YANDEX LLC", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -5757,6 +5819,7 @@ "destination.as.organization.name": "YANDEX LLC", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.geo.name": "Russian Federation", @@ -5917,6 +5980,7 @@ "source.geo.city_name": "Brea", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 33.9339, "source.geo.location.lon": -117.8854, "source.geo.name": "United States", @@ -5941,6 +6005,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.name": "United States", @@ -6034,6 +6099,7 @@ "destination.geo.city_name": "Central", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "HK", + "destination.geo.country_name": "Hong Kong", "destination.geo.location.lat": 22.2909, "destination.geo.location.lon": 114.15, "destination.geo.name": "United States", @@ -6196,6 +6262,7 @@ "source.geo.city_name": "Redmond", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 47.6722, "source.geo.location.lon": -122.1257, "source.geo.name": "United States", @@ -6289,6 +6356,7 @@ "source.geo.city_name": "Redmond", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 47.6722, "source.geo.location.lon": -122.1257, "source.geo.name": "United States", @@ -6313,6 +6381,7 @@ "destination.geo.city_name": "Los Angeles", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 34.0544, "destination.geo.location.lon": -118.244, "destination.geo.name": "United States", @@ -6474,6 +6543,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -6495,6 +6565,7 @@ "destination.as.organization.name": "Pandora Media, Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -6654,6 +6725,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -6745,6 +6817,7 @@ "source.geo.city_name": "Oliva", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "ES", + "source.geo.country_name": "Spain", "source.geo.location.lat": 38.9197, "source.geo.location.lon": -0.1193, "source.geo.name": "Ukraine", @@ -6837,6 +6910,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -6927,6 +7001,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7017,6 +7092,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7107,6 +7183,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7128,6 +7205,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -7287,6 +7365,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7377,6 +7456,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7467,6 +7547,7 @@ "source.as.organization.name": "Wikimedia Foundation Inc.", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7557,6 +7638,7 @@ "source.as.organization.name": "Wikimedia Foundation Inc.", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7648,6 +7730,7 @@ "source.geo.city_name": "Los Angeles", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 34.0544, "source.geo.location.lon": -118.244, "source.geo.name": "United States", @@ -7740,6 +7823,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7830,6 +7914,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -7921,6 +8006,7 @@ "source.geo.city_name": "Liberal", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.0438, "source.geo.location.lon": -100.9286, "source.geo.name": "United States", @@ -8013,6 +8099,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8103,6 +8190,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8194,6 +8282,7 @@ "source.geo.city_name": "Albany", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 42.7008, "source.geo.location.lon": -73.8601, "source.geo.name": "United States", @@ -8286,6 +8375,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8307,6 +8397,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -8466,6 +8557,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8556,6 +8648,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8577,6 +8670,7 @@ "destination.as.organization.name": "Pandora Media, Inc", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -8736,6 +8830,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8826,6 +8921,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -8916,6 +9012,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -9006,6 +9103,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -9096,6 +9194,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", @@ -9186,6 +9285,7 @@ "source.as.organization.name": "Google LLC", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.geo.name": "United States", diff --git a/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json b/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json index 587b481636f..44f7a7790ab 100644 --- a/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/pan_inc_traffic.log-expected.json @@ -13,6 +13,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -113,6 +114,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -211,6 +213,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -310,6 +313,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -411,6 +415,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -511,6 +516,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -609,6 +615,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -708,6 +715,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -809,6 +817,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -910,6 +919,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1011,6 +1021,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1112,6 +1123,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1213,6 +1225,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1314,6 +1327,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1415,6 +1429,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1516,6 +1531,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1617,6 +1633,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1718,6 +1735,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1819,6 +1837,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -1919,6 +1938,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -2017,6 +2037,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -2116,6 +2137,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -2216,6 +2238,7 @@ "destination.bytes": 98, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -2315,6 +2338,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -2416,6 +2440,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -2517,6 +2542,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -2617,6 +2643,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -2715,6 +2742,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -2814,6 +2842,7 @@ "destination.geo.city_name": "Westminster", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 33.7518, "destination.geo.location.lon": -117.9932, "destination.geo.region_iso_code": "US-CA", @@ -2915,6 +2944,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -3015,6 +3045,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -3114,6 +3145,7 @@ "destination.geo.city_name": "Assago", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 45.4087, "destination.geo.location.lon": 9.1225, "destination.geo.region_iso_code": "IT-MI", @@ -3215,6 +3247,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -3315,6 +3348,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -3413,6 +3447,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -3512,6 +3547,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -3613,6 +3649,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -3713,6 +3750,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -3811,6 +3849,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -3908,6 +3947,7 @@ "destination.bytes": 111, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -4000,6 +4040,7 @@ "destination.bytes": 906, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 43.1479, "destination.geo.location.lon": 12.1097, "destination.ip": "62.211.68.12", @@ -4098,6 +4139,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -4193,6 +4235,7 @@ "destination.geo.city_name": "Washington", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.7095, "destination.geo.location.lon": -78.1539, "destination.geo.region_iso_code": "US-VA", @@ -4294,6 +4337,7 @@ "destination.geo.city_name": "Washington", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.7095, "destination.geo.location.lon": -78.1539, "destination.geo.region_iso_code": "US-VA", @@ -4393,6 +4437,7 @@ "destination.bytes": 141, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -4486,6 +4531,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -4586,6 +4632,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -4685,6 +4732,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -4785,6 +4833,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -4883,6 +4932,7 @@ "destination.bytes": 316, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -4981,6 +5031,7 @@ "destination.bytes": 121, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -5079,6 +5130,7 @@ "destination.bytes": 169, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -5177,6 +5229,7 @@ "destination.bytes": 954, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 43.1479, "destination.geo.location.lon": 12.1097, "destination.ip": "62.211.68.12", @@ -5276,6 +5329,7 @@ "destination.geo.city_name": "Assago", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 45.4087, "destination.geo.location.lon": 9.1225, "destination.geo.region_iso_code": "IT-MI", @@ -5377,6 +5431,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -5477,6 +5532,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -5576,6 +5632,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -5676,6 +5733,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -5774,6 +5832,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -5873,6 +5932,7 @@ "destination.geo.city_name": "Washington", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.7095, "destination.geo.location.lon": -78.1539, "destination.geo.region_iso_code": "US-VA", @@ -5974,6 +6034,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -6074,6 +6135,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -6172,6 +6234,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -6270,6 +6333,7 @@ "destination.bytes": 906, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 43.1479, "destination.geo.location.lon": 12.1097, "destination.ip": "62.211.68.12", @@ -6368,6 +6432,7 @@ "destination.bytes": 163, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -6466,6 +6531,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -6564,6 +6630,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -6663,6 +6730,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -6763,6 +6831,7 @@ "destination.bytes": 922, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 43.1479, "destination.geo.location.lon": 12.1097, "destination.ip": "62.211.68.12", @@ -6862,6 +6931,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -6962,6 +7032,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -7060,6 +7131,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -7159,6 +7231,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -7259,6 +7332,7 @@ "destination.bytes": 26786, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.5.1.1", @@ -7357,6 +7431,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -7455,6 +7530,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -7554,6 +7630,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -7747,6 +7824,7 @@ "destination.geo.city_name": "Assago", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 45.4087, "destination.geo.location.lon": 9.1225, "destination.geo.region_iso_code": "IT-MI", @@ -7848,6 +7926,7 @@ "destination.geo.city_name": "Assago", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 45.4087, "destination.geo.location.lon": 9.1225, "destination.geo.region_iso_code": "IT-MI", @@ -8133,6 +8212,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -8233,6 +8313,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -8331,6 +8412,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -8430,6 +8512,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -8530,6 +8613,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -8720,6 +8804,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -8819,6 +8904,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -8919,6 +9005,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -9017,6 +9104,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "205.171.2.25", @@ -9115,6 +9203,7 @@ "destination.bytes": 906, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IT", + "destination.geo.country_name": "Italy", "destination.geo.location.lat": 43.1479, "destination.geo.location.lon": 12.1097, "destination.ip": "62.211.68.12", @@ -9214,6 +9303,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -9315,6 +9405,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -9416,6 +9507,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -9609,6 +9701,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -9710,6 +9803,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", @@ -9811,6 +9905,7 @@ "destination.geo.city_name": "Fort Lauderdale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 26.1792, "destination.geo.location.lon": -80.1749, "destination.geo.region_iso_code": "US-FL", diff --git a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json index 93fe08f75d9..de6c83a2fa1 100644 --- a/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/threat.log-expected.json @@ -10,6 +10,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -111,6 +112,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -212,6 +214,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -313,6 +316,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -414,6 +418,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -515,6 +520,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -616,6 +622,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -717,6 +724,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -818,6 +826,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -919,6 +928,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1020,6 +1030,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1121,6 +1132,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1222,6 +1234,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1323,6 +1336,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1424,6 +1438,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1525,6 +1540,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1626,6 +1642,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1727,6 +1744,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1828,6 +1846,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -1929,6 +1948,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2030,6 +2050,7 @@ "destination.as.organization.name": "Akamai International B.V.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2131,6 +2152,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2232,6 +2254,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2333,6 +2356,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2434,6 +2458,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2535,6 +2560,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2636,6 +2662,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2737,6 +2764,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2838,6 +2866,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -2939,6 +2968,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3040,6 +3070,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3141,6 +3172,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3242,6 +3274,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3343,6 +3376,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3444,6 +3478,7 @@ "destination.as.organization.name": "MCI Communications Services, Inc. d/b/a Verizon Business", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3545,6 +3580,7 @@ "destination.as.organization.name": "Fastly", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -3647,6 +3683,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6109, "destination.geo.location.lon": -122.3303, "destination.geo.name": "United States", @@ -3751,6 +3788,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -3855,6 +3893,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -3959,6 +3998,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4063,6 +4103,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4167,6 +4208,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4271,6 +4313,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4375,6 +4418,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4479,6 +4523,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4583,6 +4628,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4687,6 +4733,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4791,6 +4838,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4895,6 +4943,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -4999,6 +5048,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.3861, "destination.geo.location.lon": -122.0839, "destination.geo.name": "United States", @@ -5102,6 +5152,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5203,6 +5254,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5304,6 +5356,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5405,6 +5458,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5506,6 +5560,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5607,6 +5662,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5708,6 +5764,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5809,6 +5866,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -5910,6 +5968,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -6011,6 +6070,7 @@ "destination.as.organization.name": "Akamai Technologies, Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.geo.name": "United States", @@ -6113,6 +6173,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6217,6 +6278,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6321,6 +6383,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6425,6 +6488,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6529,6 +6593,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6633,6 +6698,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6737,6 +6803,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6841,6 +6908,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -6945,6 +7013,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7049,6 +7118,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7153,6 +7223,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7257,6 +7328,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7361,6 +7433,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7465,6 +7538,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7569,6 +7643,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", @@ -7673,6 +7748,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.name": "United States", diff --git a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json index 5f979092c4b..200e02370d3 100644 --- a/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json +++ b/x-pack/filebeat/module/panw/panos/test/traffic.log-expected.json @@ -13,6 +13,7 @@ "destination.bytes": 5976, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "184.51.253.152", @@ -122,6 +123,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -232,6 +234,7 @@ "destination.geo.city_name": "Dallas", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 32.7787, "destination.geo.location.lon": -96.8217, "destination.geo.region_iso_code": "US-TX", @@ -343,6 +346,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -453,6 +457,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.3861, "destination.geo.location.lon": -122.0839, "destination.geo.region_iso_code": "US-CA", @@ -564,6 +569,7 @@ "destination.bytes": 21111, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "209.234.224.22", @@ -673,6 +679,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -782,6 +789,7 @@ "destination.bytes": 3732, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.2.238", @@ -891,6 +899,7 @@ "destination.bytes": 221, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1000,6 +1009,7 @@ "destination.bytes": 221, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1109,6 +1119,7 @@ "destination.bytes": 5469, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "17.249.60.78", @@ -1218,6 +1229,7 @@ "destination.bytes": 224, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1327,6 +1339,7 @@ "destination.bytes": 117, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1436,6 +1449,7 @@ "destination.bytes": 307, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1545,6 +1559,7 @@ "destination.bytes": 365, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1654,6 +1669,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1763,6 +1779,7 @@ "destination.bytes": 161, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1872,6 +1889,7 @@ "destination.bytes": 7805, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "98.138.49.44", @@ -1981,6 +1999,7 @@ "destination.bytes": 6106, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "72.30.3.43", @@ -2090,6 +2109,7 @@ "destination.bytes": 196, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2199,6 +2219,7 @@ "destination.bytes": 3245, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.9.142", @@ -2308,6 +2329,7 @@ "destination.bytes": 179, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2418,6 +2440,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -2528,6 +2551,7 @@ "destination.geo.city_name": "Sunnyvale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.386, "destination.geo.location.lon": -122.0144, "destination.geo.region_iso_code": "US-CA", @@ -2639,6 +2663,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2748,6 +2773,7 @@ "destination.bytes": 130, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -2853,6 +2879,7 @@ "destination.bytes": 1991, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "172.217.9.142", @@ -2959,6 +2986,7 @@ "destination.bytes": 523, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "151.101.2.2", @@ -3069,6 +3097,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.3861, "destination.geo.location.lon": -122.0839, "destination.geo.region_iso_code": "US-CA", @@ -3180,6 +3209,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -3289,6 +3319,7 @@ "destination.bytes": 196, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -3398,6 +3429,7 @@ "destination.bytes": 5003, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "184.51.253.193", @@ -3507,6 +3539,7 @@ "destination.bytes": 171, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -3615,6 +3648,7 @@ "destination.geo.city_name": "Sunnyvale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.386, "destination.geo.location.lon": -122.0144, "destination.geo.region_iso_code": "US-CA", @@ -3727,6 +3761,7 @@ "destination.geo.city_name": "Sunnyvale", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.386, "destination.geo.location.lon": -122.0144, "destination.geo.region_iso_code": "US-CA", @@ -3839,6 +3874,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -3950,6 +3986,7 @@ "destination.bytes": 244, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -4059,6 +4096,7 @@ "destination.bytes": 205, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -4169,6 +4207,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -4389,6 +4428,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -4500,6 +4540,7 @@ "destination.bytes": 661, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "184.51.252.247", @@ -4610,6 +4651,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -4722,6 +4764,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -4833,6 +4876,7 @@ "destination.bytes": 182, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -4942,6 +4986,7 @@ "destination.bytes": 90, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5052,6 +5097,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -5163,6 +5209,7 @@ "destination.bytes": 661, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "184.51.252.247", @@ -5380,6 +5427,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5485,6 +5533,7 @@ "destination.bytes": 144, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5594,6 +5643,7 @@ "destination.bytes": 206, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5703,6 +5753,7 @@ "destination.bytes": 206, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5812,6 +5863,7 @@ "destination.bytes": 169, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -5921,6 +5973,7 @@ "destination.bytes": 132, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6030,6 +6083,7 @@ "destination.bytes": 127, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6139,6 +6193,7 @@ "destination.bytes": 105, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6248,6 +6303,7 @@ "destination.bytes": 172, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6357,6 +6413,7 @@ "destination.bytes": 134, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6466,6 +6523,7 @@ "destination.bytes": 179, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6575,6 +6633,7 @@ "destination.bytes": 218, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6684,6 +6743,7 @@ "destination.bytes": 172, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6793,6 +6853,7 @@ "destination.bytes": 305, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -6903,6 +6964,7 @@ "destination.geo.city_name": "Lanham", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9705, "destination.geo.location.lon": -76.8388, "destination.geo.region_iso_code": "US-MD", @@ -7014,6 +7076,7 @@ "destination.bytes": 153, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7123,6 +7186,7 @@ "destination.bytes": 169, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7232,6 +7296,7 @@ "destination.bytes": 128, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7341,6 +7406,7 @@ "destination.bytes": 181, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7450,6 +7516,7 @@ "destination.bytes": 121, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7560,6 +7627,7 @@ "destination.geo.city_name": "San Antonio", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 29.4551, "destination.geo.location.lon": -98.6498, "destination.geo.region_iso_code": "US-TX", @@ -7671,6 +7739,7 @@ "destination.bytes": 315, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7780,6 +7849,7 @@ "destination.bytes": 130, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -7890,6 +7960,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.54, "destination.geo.location.lon": -122.3032, "destination.geo.region_iso_code": "US-WA", @@ -8001,6 +8072,7 @@ "destination.bytes": 149, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8110,6 +8182,7 @@ "destination.bytes": 202, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8219,6 +8292,7 @@ "destination.bytes": 195, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8328,6 +8402,7 @@ "destination.bytes": 90, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "208.83.246.20", @@ -8437,6 +8512,7 @@ "destination.bytes": 192, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8545,6 +8621,7 @@ "destination.bytes": 208, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8653,6 +8730,7 @@ "destination.bytes": 100, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8761,6 +8839,7 @@ "destination.bytes": 7237, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.6583, "destination.geo.location.lon": -77.2481, "destination.geo.region_iso_code": "US-VA", @@ -8871,6 +8950,7 @@ "destination.bytes": 109, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -8980,6 +9060,7 @@ "destination.bytes": 116, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -9089,6 +9170,7 @@ "destination.bytes": 96, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -9199,6 +9281,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9311,6 +9394,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9423,6 +9507,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9534,6 +9619,7 @@ "destination.bytes": 7820, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "104.254.150.9", @@ -9644,6 +9730,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9756,6 +9843,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9868,6 +9956,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -9980,6 +10069,7 @@ "destination.geo.city_name": "Ashburn", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 39.0481, "destination.geo.location.lon": -77.4728, "destination.geo.region_iso_code": "US-VA", @@ -10092,6 +10182,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -10203,6 +10294,7 @@ "destination.bytes": 172, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10312,6 +10404,7 @@ "destination.bytes": 588, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10421,6 +10514,7 @@ "destination.bytes": 94, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10530,6 +10624,7 @@ "destination.bytes": 170, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10639,6 +10734,7 @@ "destination.bytes": 94, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10748,6 +10844,7 @@ "destination.bytes": 94, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -10857,6 +10954,7 @@ "destination.bytes": 166, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", diff --git a/x-pack/filebeat/module/snort/log/test/generated.log-expected.json b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json index f0150dcb87f..d1a9aa8535f 100644 --- a/x-pack/filebeat/module/snort/log/test/generated.log-expected.json +++ b/x-pack/filebeat/module/snort/log/test/generated.log-expected.json @@ -61,8 +61,8 @@ "uptatev4292.www.invalid" ], "related.ip": [ - "10.212.11.114", - "10.38.77.13" + "10.38.77.13", + "10.212.11.114" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "uam", @@ -826,8 +826,8 @@ "apari5002.api.test" ], "related.ip": [ - "10.9.200.197", - "10.182.213.195" + "10.182.213.195", + "10.9.200.197" ], "rsa.crypto.sig_type": "fugiatnu", "rsa.internal.messageid": "27813", @@ -1006,8 +1006,8 @@ "unturmag6190.api.lan" ], "related.ip": [ - "10.52.190.18", - "10.238.223.171" + "10.238.223.171", + "10.52.190.18" ], "rsa.crypto.sig_type": "Finibus", "rsa.internal.messageid": "16539", @@ -1209,8 +1209,8 @@ "iqu4858.mail.invalid" ], "related.ip": [ - "10.213.100.153", - "10.116.175.84" + "10.116.175.84", + "10.213.100.153" ], "rsa.crypto.sig_type": "exercit", "rsa.internal.messageid": "11634", @@ -1643,8 +1643,8 @@ "urau1660.www.lan" ], "related.ip": [ - "10.201.132.114", - "10.140.209.249" + "10.140.209.249", + "10.201.132.114" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "lor", @@ -1731,8 +1731,8 @@ "nofde7732.internal.test" ], "related.ip": [ - "10.198.44.231", - "10.36.122.169" + "10.36.122.169", + "10.198.44.231" ], "rsa.crypto.sig_type": "umquam", "rsa.internal.messageid": "13228", @@ -2113,8 +2113,8 @@ "uovol2459.www5.invalid" ], "related.ip": [ - "10.60.137.215", - "10.28.105.106" + "10.28.105.106", + "10.60.137.215" ], "rsa.crypto.sig_type": "tionu", "rsa.internal.messageid": "5155", @@ -2229,10 +2229,10 @@ "Loremips5368.www5.corp" ], "related.ip": [ + "10.20.167.114", "10.49.190.163", - "10.166.40.137", "10.65.144.119", - "10.20.167.114" + "10.166.40.137" ], "rsa.internal.event_desc": "Offloaded TCP Flow for connection", "rsa.internal.messageid": "FTD_events", @@ -2361,8 +2361,8 @@ "magn3657.api.invalid" ], "related.ip": [ - "10.180.28.156", - "10.234.234.205" + "10.234.234.205", + "10.180.28.156" ], "rsa.crypto.sig_type": "mnihil", "rsa.internal.messageid": "5315", @@ -2578,8 +2578,8 @@ "laparia5374.api.domain" ], "related.ip": [ - "10.147.155.100", - "10.232.67.182" + "10.232.67.182", + "10.147.155.100" ], "rsa.crypto.sig_type": "eufugi", "rsa.internal.messageid": "26152", @@ -2828,8 +2828,8 @@ "borios1685.www.localhost" ], "related.ip": [ - "10.231.10.63", - "10.38.22.60" + "10.38.22.60", + "10.231.10.63" ], "rsa.crypto.sig_type": "taliquip", "rsa.internal.messageid": "10329", @@ -2886,8 +2886,8 @@ "Bonoru5658.mail.invalid" ], "related.ip": [ - "10.29.231.11", - "10.46.57.181" + "10.46.57.181", + "10.29.231.11" ], "rsa.internal.messageid": "NGIPS_events", "rsa.internal.msg_id": "remape", @@ -3160,8 +3160,8 @@ "onsecte5119.www.invalid" ], "related.ip": [ - "10.198.207.31", - "10.5.88.183" + "10.5.88.183", + "10.198.207.31" ], "rsa.internal.event_desc": "Failed to locate egress interface", "rsa.internal.messageid": "FTD_events", @@ -3836,9 +3836,9 @@ "erunt3957.internal.lan" ], "related.ip": [ - "10.118.103.185", "10.32.195.34", "10.240.77.10", + "10.118.103.185", "10.125.130.61" ], "rsa.internal.event_desc": "TCP Flow is no longer offloaded for connection", diff --git a/x-pack/filebeat/module/sonicwall/firewall/test/general.log-expected.json b/x-pack/filebeat/module/sonicwall/firewall/test/general.log-expected.json index 9f972c2e6fc..37d6d4325b7 100644 --- a/x-pack/filebeat/module/sonicwall/firewall/test/general.log-expected.json +++ b/x-pack/filebeat/module/sonicwall/firewall/test/general.log-expected.json @@ -28,6 +28,7 @@ "source.as.organization.name": "Orange", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 48.8582, "source.geo.location.lon": 2.3387, "source.ip": [ @@ -95,6 +96,7 @@ "source.as.organization.name": "Orange", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 48.8582, "source.geo.location.lon": 2.3387, "source.ip": [ @@ -243,6 +245,7 @@ "source.as.organization.name": "Orange", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 48.8582, "source.geo.location.lon": 2.3387, "source.ip": [ @@ -310,6 +313,7 @@ "source.as.organization.name": "Orange", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "FR", + "source.geo.country_name": "France", "source.geo.location.lat": 48.8582, "source.geo.location.lon": 2.3387, "source.ip": [ @@ -347,6 +351,7 @@ "service.type": "sonicwall", "source.geo.continent_name": "Oceania", "source.geo.country_iso_code": "NZ", + "source.geo.country_name": "New Zealand", "source.geo.location.lat": -41.0, "source.geo.location.lon": 174.0, "source.ip": [ @@ -436,6 +441,7 @@ "source.as.organization.name": "Cloudflare, Inc.", "source.geo.continent_name": "Oceania", "source.geo.country_iso_code": "AU", + "source.geo.country_name": "Australia", "source.geo.location.lat": -33.494, "source.geo.location.lon": 143.2104, "source.ip": [ diff --git a/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json b/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json index 5b84648b930..bd92a3aa08a 100644 --- a/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json +++ b/x-pack/filebeat/module/sonicwall/firewall/test/generated.log-expected.json @@ -23,8 +23,8 @@ "oreetdol1714.internal.corp" ], "related.ip": [ - "10.49.111.67", - "10.92.136.230" + "10.92.136.230", + "10.49.111.67" ], "rsa.internal.messageid": "914", "rsa.internal.msg": "lupt", @@ -86,8 +86,8 @@ "observer.vendor": "Sonicwall", "related.ip": [ "10.227.15.1", - "10.149.203.46", - "10.150.156.22" + "10.150.156.22", + "10.149.203.46" ], "rsa.internal.event_desc": "ctetur", "rsa.internal.messageid": "1369", @@ -171,8 +171,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.13.70.213", - "10.95.245.65" + "10.95.245.65", + "10.13.70.213" ], "rsa.internal.messageid": "372", "rsa.internal.msg": "llu", @@ -478,8 +478,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.78.151.178", - "10.157.161.103" + "10.157.161.103", + "10.78.151.178" ], "rsa.internal.event_desc": "taut", "rsa.internal.messageid": "24", @@ -551,9 +551,9 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.34.161.166", "10.245.200.97", - "10.219.116.137" + "10.219.116.137", + "10.34.161.166" ], "rsa.internal.event_desc": "rehend", "rsa.internal.messageid": "428", @@ -599,8 +599,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.118.80.140", - "10.252.122.195" + "10.252.122.195", + "10.118.80.140" ], "rsa.internal.messageid": "401", "rsa.internal.msg": "inesci", @@ -845,8 +845,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.248.101.25", - "10.60.129.15" + "10.60.129.15", + "10.248.101.25" ], "rsa.internal.messageid": "372", "rsa.internal.msg": "ommodico", @@ -1006,8 +1006,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.101.74.44", - "10.251.20.13" + "10.251.20.13", + "10.101.74.44" ], "related.user": [ "rsitv" @@ -1219,8 +1219,8 @@ "ise5905.www.local" ], "related.ip": [ - "10.97.124.211", - "10.53.113.23" + "10.53.113.23", + "10.97.124.211" ], "rsa.identity.user_sid_dst": "iumdol", "rsa.internal.messageid": "1154", @@ -1279,8 +1279,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.187.201.250", - "10.64.229.79" + "10.64.229.79", + "10.187.201.250" ], "rsa.db.index": "rumwrit", "rsa.internal.messageid": "83", @@ -1389,8 +1389,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.31.190.145", - "10.147.88.219" + "10.147.88.219", + "10.31.190.145" ], "related.user": [ "corpori" @@ -1431,9 +1431,9 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.108.84.24", "10.251.248.228", - "10.113.100.237" + "10.113.100.237", + "10.108.84.24" ], "rsa.internal.event_desc": "volupt", "rsa.internal.messageid": "606", @@ -1777,8 +1777,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.165.48.224", - "10.191.242.168" + "10.191.242.168", + "10.165.48.224" ], "rsa.internal.event_desc": "equep", "rsa.internal.messageid": "995", @@ -1831,8 +1831,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.185.37.32", - "10.116.173.79" + "10.116.173.79", + "10.185.37.32" ], "rsa.internal.messageid": "178", "rsa.internal.msg": "ende", @@ -1863,8 +1863,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.57.85.98", - "10.219.42.212" + "10.219.42.212", + "10.57.85.98" ], "rsa.internal.event_desc": "mquisno", "rsa.internal.messageid": "995", @@ -1917,8 +1917,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.135.70.159", - "10.195.223.82" + "10.195.223.82", + "10.135.70.159" ], "rsa.internal.messageid": "351", "rsa.internal.msg": "CSe", @@ -2068,8 +2068,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.56.10.84", - "10.12.54.142" + "10.12.54.142", + "10.56.10.84" ], "rsa.internal.messageid": "658", "rsa.internal.msg": "osquirat", @@ -2105,8 +2105,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.117.63.181", - "10.222.169.140" + "10.222.169.140", + "10.117.63.181" ], "rsa.internal.messageid": "195", "rsa.internal.msg": "magnaal", @@ -2247,8 +2247,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.129.101.147", - "10.206.229.61" + "10.206.229.61", + "10.129.101.147" ], "rsa.internal.messageid": "413", "rsa.internal.msg": "upta", @@ -2383,8 +2383,8 @@ "observer.type": "Firewall", "observer.vendor": "Sonicwall", "related.ip": [ - "10.29.120.226", - "10.203.146.137" + "10.203.146.137", + "10.29.120.226" ], "rsa.internal.messageid": "712", "rsa.misc.action": [ diff --git a/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json index b57ab7067ab..392ac679e44 100644 --- a/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json +++ b/x-pack/filebeat/module/sophos/utm/test/generated.log-expected.json @@ -59,9 +59,9 @@ "10.57.170.140" ], "related.user": [ - "sunt", + "dexeac", "icistatuscode=giatquov", - "dexeac" + "sunt" ], "rsa.db.index": "run", "rsa.identity.logon_type": "nofdeF", @@ -70,8 +70,8 @@ "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", "rsa.misc.action": [ - "block", - "ugiatnu" + "ugiatnu", + "block" ], "rsa.misc.comments": "colabo", "rsa.misc.content_type": "sedd", @@ -163,8 +163,8 @@ "10.106.239.55" ], "related.user": [ - "itquiin", - "eaq" + "eaq", + "itquiin" ], "rsa.identity.logon_type": "stquidol", "rsa.internal.event_desc": "bor", @@ -638,8 +638,8 @@ "10.54.169.175" ], "related.user": [ - "taspe", - "scipit" + "scipit", + "taspe" ], "rsa.identity.logon_type": "olores", "rsa.internal.event_desc": "secil", @@ -974,8 +974,8 @@ "10.232.108.32" ], "related.user": [ - "rsp", - "llum" + "llum", + "rsp" ], "rsa.identity.logon_type": "ntut", "rsa.internal.event_desc": "ittenb", @@ -1033,13 +1033,13 @@ "Duis583.api.local" ], "related.ip": [ - "10.17.51.153", - "10.89.41.97" + "10.89.41.97", + "10.17.51.153" ], "related.user": [ - "tcustatuscode=eumiu", "tio", - "pteurs" + "pteurs", + "tcustatuscode=eumiu" ], "rsa.db.index": "eavolupt", "rsa.identity.logon_type": "ursintoc", @@ -1610,8 +1610,8 @@ "10.244.96.61" ], "related.user": [ - "itsedqui", - "iumt" + "iumt", + "itsedqui" ], "rsa.identity.logon_type": "psamvolu", "rsa.internal.event_desc": "orroqui", @@ -1851,13 +1851,13 @@ "tenbyCi4371.www5.localdomain" ], "related.ip": [ - "10.98.126.206", - "10.214.167.164" + "10.214.167.164", + "10.98.126.206" ], "related.user": [ - "hen", + "amremapstatuscode=dolorsit", "isnostru", - "amremapstatuscode=dolorsit" + "hen" ], "rsa.db.index": "spernatu", "rsa.identity.logon_type": "untutl", @@ -1866,8 +1866,8 @@ "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", "rsa.misc.action": [ - "nsectetu", - "block" + "block", + "nsectetu" ], "rsa.misc.comments": "uaer", "rsa.misc.content_type": "eaqu", @@ -1924,8 +1924,8 @@ "observer.vendor": "Sophos", "process.pid": 6722, "related.ip": [ - "10.32.236.117", - "10.203.157.250" + "10.203.157.250", + "10.32.236.117" ], "rsa.internal.event_desc": "Packet", "rsa.internal.messageid": "ulogd", @@ -2033,10 +2033,10 @@ "10.92.93.236" ], "related.user": [ - "ulpaq", + "ntoccae", "Sedutper", "dolorsistatuscode=acc", - "ntoccae" + "ulpaq" ], "rsa.db.index": "snisiut", "rsa.identity.logon_type": "umdol", @@ -2045,8 +2045,8 @@ "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", "rsa.misc.action": [ - "icons", - "block" + "block", + "icons" ], "rsa.misc.comments": "porincid", "rsa.misc.content_type": "temvele", @@ -2124,9 +2124,9 @@ "10.202.65.2" ], "related.user": [ - "atatno", "iscivelistatuscode=urve", - "tasu" + "tasu", + "atatno" ], "rsa.db.index": "amrem", "rsa.identity.logon_type": "nulamcol", @@ -2314,13 +2314,13 @@ "obea2960.mail.corp" ], "related.ip": [ - "10.33.138.154", - "10.45.12.53" + "10.45.12.53", + "10.33.138.154" ], "related.user": [ - "eturadip", + "porincid", "umqustatuscode=ntexpli", - "porincid" + "eturadip" ], "rsa.db.index": "dolor", "rsa.identity.logon_type": "eturadi", @@ -2481,8 +2481,8 @@ "10.32.85.21" ], "related.user": [ - "antium", - "etconsec" + "etconsec", + "antium" ], "rsa.identity.logon_type": "umiurere", "rsa.internal.event_desc": "serro", @@ -2628,14 +2628,14 @@ "nisiuta4810.api.test" ], "related.ip": [ - "10.85.200.58", - "10.210.175.52" + "10.210.175.52", + "10.85.200.58" ], "related.user": [ - "Loremi", - "rExce", "reetd", - "inimastatuscode=emipsum" + "inimastatuscode=emipsum", + "Loremi", + "rExce" ], "rsa.db.index": "apa", "rsa.identity.logon_type": "sedquia", @@ -2644,8 +2644,8 @@ "rsa.investigations.event_cat": 1901000000, "rsa.investigations.event_cat_name": "Other.Default", "rsa.misc.action": [ - "cancel", - "odte" + "odte", + "cancel" ], "rsa.misc.comments": "emquia", "rsa.misc.content_type": "sauteir", @@ -3619,8 +3619,8 @@ "10.96.200.83" ], "related.user": [ - "lapariat", - "acommod" + "acommod", + "lapariat" ], "rsa.identity.logon_type": "remeumf", "rsa.internal.event_desc": "dol", diff --git a/x-pack/filebeat/module/sophos/xg/test/anti-spam.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/anti-spam.log-expected.json index 90a40d0b095..a78e3c1ccb0 100644 --- a/x-pack/filebeat/module/sophos/xg/test/anti-spam.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/anti-spam.log-expected.json @@ -70,6 +70,7 @@ "destination.geo.city_name": "Saint-Prex", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "CH", + "destination.geo.country_name": "Switzerland", "destination.geo.location.lat": 46.4796, "destination.geo.location.lon": 6.4599, "destination.geo.region_iso_code": "CH-VD", @@ -131,6 +132,7 @@ "source.geo.city_name": "Miami", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 25.7806, "source.geo.location.lon": -80.1826, "source.geo.region_iso_code": "US-FL", @@ -154,6 +156,7 @@ "destination.geo.city_name": "Saint-Prex", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "CH", + "destination.geo.country_name": "Switzerland", "destination.geo.location.lat": 46.4796, "destination.geo.location.lon": 6.4599, "destination.geo.region_iso_code": "CH-VD", @@ -217,6 +220,7 @@ "source.geo.city_name": "Cabreuva", "source.geo.continent_name": "South America", "source.geo.country_iso_code": "BR", + "source.geo.country_name": "Brazil", "source.geo.location.lat": -23.3149, "source.geo.location.lon": -47.0763, "source.geo.region_iso_code": "BR-SP", @@ -240,6 +244,7 @@ "destination.geo.city_name": "Saint-Prex", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "CH", + "destination.geo.country_name": "Switzerland", "destination.geo.location.lat": 46.4796, "destination.geo.location.lon": 6.4599, "destination.geo.region_iso_code": "CH-VD", @@ -302,6 +307,7 @@ "source.domain": "ELTOBGI.COM", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "GB", + "source.geo.country_name": "United Kingdom", "source.geo.location.lat": 51.4964, "source.geo.location.lon": -0.1224, "source.ip": "77.72.3.56", diff --git a/x-pack/filebeat/module/sophos/xg/test/anti-virus.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/anti-virus.log-expected.json index a78e27fa46e..42590edbb33 100644 --- a/x-pack/filebeat/module/sophos/xg/test/anti-virus.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/anti-virus.log-expected.json @@ -10,6 +10,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6348, "destination.geo.location.lon": -122.3451, "destination.geo.region_iso_code": "US-WA", @@ -87,6 +88,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6348, "destination.geo.location.lon": -122.3451, "destination.geo.region_iso_code": "US-WA", @@ -163,6 +165,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "South America", "destination.geo.country_iso_code": "UY", + "destination.geo.country_name": "Uruguay", "destination.geo.location.lat": -33.0, "destination.geo.location.lon": -56.0, "destination.ip": "186.8.209.194", @@ -225,6 +228,7 @@ "source.bytes": 0, "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 51.2993, "source.geo.location.lon": 9.491, "source.ip": "82.165.194.211", @@ -246,6 +250,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 51.2993, "destination.geo.location.lon": 9.491, "destination.ip": "185.7.209.194", @@ -309,6 +314,7 @@ "source.geo.city_name": "Seattle", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 47.4902, "source.geo.location.lon": -122.3004, "source.geo.region_iso_code": "US-WA", diff --git a/x-pack/filebeat/module/sophos/xg/test/atp.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/atp.log-expected.json index 7dbb6289456..38c2694478e 100644 --- a/x-pack/filebeat/module/sophos/xg/test/atp.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/atp.log-expected.json @@ -7,6 +7,7 @@ "destination.as.organization.name": "Petersburg Internet Network ltd.", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "RU", + "destination.geo.country_name": "Russia", "destination.geo.location.lat": 55.7386, "destination.geo.location.lon": 37.6068, "destination.ip": "46.161.30.47", @@ -76,6 +77,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6348, "destination.geo.location.lon": -122.3451, "destination.geo.region_iso_code": "US-WA", @@ -143,6 +145,7 @@ "destination.geo.city_name": "Seattle", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 47.6348, "destination.geo.location.lon": -122.3451, "destination.geo.region_iso_code": "US-WA", @@ -209,6 +212,7 @@ "destination.as.organization.name": "Accelerated IT Services & Consulting GmbH", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 51.2993, "destination.geo.location.lon": 9.491, "destination.ip": "82.211.30.202", diff --git a/x-pack/filebeat/module/sophos/xg/test/cfilter.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/cfilter.log-expected.json index a82d4550f57..84dc15e1aeb 100644 --- a/x-pack/filebeat/module/sophos/xg/test/cfilter.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/cfilter.log-expected.json @@ -7,6 +7,7 @@ "destination.as.organization.name": "BHARTI Airtel Ltd.", "destination.geo.continent_name": "Asia", "destination.geo.country_iso_code": "IN", + "destination.geo.country_name": "India", "destination.geo.location.lat": 20.0, "destination.geo.location.lon": 77.0, "destination.ip": "182.79.221.19", @@ -78,6 +79,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -134,6 +136,7 @@ "source.as.organization.name": "Telefonica Germany", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 51.2993, "source.geo.location.lon": 9.491, "source.ip": "5.5.5.15", @@ -153,6 +156,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "74.125.130.188", @@ -213,6 +217,7 @@ "source.as.organization.name": "Telefonica Germany", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 51.2993, "source.geo.location.lon": 9.491, "source.ip": "5.5.5.15", @@ -231,6 +236,7 @@ "destination.geo.city_name": "Dublin", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "IE", + "destination.geo.country_name": "Ireland", "destination.geo.location.lat": 53.3338, "destination.geo.location.lon": -6.2488, "destination.geo.region_iso_code": "IE-L", @@ -302,6 +308,7 @@ "destination.geo.city_name": "Washington", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.7095, "destination.geo.location.lon": -78.1539, "destination.geo.region_iso_code": "US-VA", @@ -375,6 +382,7 @@ "destination.geo.city_name": "Bratislava", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "SK", + "destination.geo.country_name": "Slovakia", "destination.geo.location.lat": 48.15, "destination.geo.location.lon": 17.1078, "destination.geo.region_iso_code": "SK-BL", @@ -498,6 +506,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "64.233.189.147", @@ -569,6 +578,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "64.233.188.94", diff --git a/x-pack/filebeat/module/sophos/xg/test/event.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/event.log-expected.json index d14c2bb9924..89d6878ec6f 100644 --- a/x-pack/filebeat/module/sophos/xg/test/event.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/event.log-expected.json @@ -59,6 +59,7 @@ "destination.as.organization.name": "DoD Network Information Center", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "214.167.51.66", @@ -105,6 +106,7 @@ "source.geo.city_name": "Elblag", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 54.172, "source.geo.location.lon": 19.4195, "source.geo.region_iso_code": "PL-28", @@ -199,6 +201,7 @@ "source.geo.city_name": "August\u00f3w", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 53.845, "source.geo.location.lon": 22.985, "source.geo.region_iso_code": "PL-20", @@ -336,6 +339,7 @@ "source.geo.city_name": "Schleidweiler", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.8808, "source.geo.location.lon": 6.6593, "source.geo.region_iso_code": "DE-RP", @@ -438,6 +442,7 @@ "source.geo.city_name": "Fell", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "DE", + "source.geo.country_name": "Germany", "source.geo.location.lat": 49.7667, "source.geo.location.lon": 6.7833, "source.geo.region_iso_code": "DE-RP", @@ -522,6 +527,7 @@ "sophos.xg.status": "Failed", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "172.66.35.15", diff --git a/x-pack/filebeat/module/sophos/xg/test/firewall.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/firewall.log-expected.json index d392790d795..7f1e5d9190b 100644 --- a/x-pack/filebeat/module/sophos/xg/test/firewall.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/firewall.log-expected.json @@ -13,6 +13,7 @@ "destination.geo.city_name": "Bratislava", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "SK", + "destination.geo.country_name": "Slovakia", "destination.geo.location.lat": 48.15, "destination.geo.location.lon": 17.1078, "destination.geo.region_iso_code": "SK-BL", @@ -98,6 +99,7 @@ "source.bytes": 459, "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RU", + "source.geo.country_name": "Russia", "source.geo.location.lat": 55.7386, "source.geo.location.lon": 37.6068, "source.ip": "172.17.34.15", @@ -125,6 +127,7 @@ "destination.geo.city_name": "Bratislava", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "SK", + "destination.geo.country_name": "Slovakia", "destination.geo.location.lat": 48.15, "destination.geo.location.lon": 17.1078, "destination.geo.region_iso_code": "SK-BL", @@ -211,6 +214,7 @@ "source.geo.city_name": "Saint-Prex", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "CH", + "source.geo.country_name": "Switzerland", "source.geo.location.lat": 46.4796, "source.geo.location.lon": 6.4599, "source.geo.region_iso_code": "CH-VD", @@ -410,6 +414,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 51.2993, "destination.geo.location.lon": 9.491, "destination.ip": "185.7.209.207", @@ -481,6 +486,7 @@ "source.geo.city_name": "Warsaw", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 52.25, "source.geo.location.lon": 21.0, "source.geo.region_iso_code": "PL-14", @@ -1030,6 +1036,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1437,6 +1444,7 @@ "destination.bytes": 0, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -1687,6 +1695,7 @@ "destination.geo.city_name": "Richardson", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 32.9473, "destination.geo.location.lon": -96.7028, "destination.geo.region_iso_code": "US-TX", diff --git a/x-pack/filebeat/module/sophos/xg/test/idp.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/idp.log-expected.json index 7caee4d72eb..d92a2b2e7e4 100644 --- a/x-pack/filebeat/module/sophos/xg/test/idp.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/idp.log-expected.json @@ -61,6 +61,7 @@ "source.as.organization.name": "Bestnet Service SRL", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RO", + "source.geo.country_name": "Romania", "source.geo.location.lat": 46.0, "source.geo.location.lon": 25.0, "source.ip": "89.40.182.58", @@ -132,6 +133,7 @@ "source.as.organization.name": "China Unicom Beijing Province Network", "source.geo.continent_name": "Asia", "source.geo.country_iso_code": "CN", + "source.geo.country_name": "China", "source.geo.location.lat": 31.0449, "source.geo.location.lon": 121.4012, "source.geo.region_iso_code": "CN-SH", @@ -205,6 +207,7 @@ "source.as.organization.name": "KPN B.V.", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "NL", + "source.geo.country_name": "Netherlands", "source.geo.location.lat": 52.3824, "source.geo.location.lon": 4.8995, "source.ip": "77.61.185.101", diff --git a/x-pack/filebeat/module/sophos/xg/test/waf.log-expected.json b/x-pack/filebeat/module/sophos/xg/test/waf.log-expected.json index fe6af644611..ceed76baef1 100644 --- a/x-pack/filebeat/module/sophos/xg/test/waf.log-expected.json +++ b/x-pack/filebeat/module/sophos/xg/test/waf.log-expected.json @@ -9,6 +9,7 @@ "destination.geo.city_name": "Saint-Prex", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "CH", + "destination.geo.country_name": "Switzerland", "destination.geo.location.lat": 46.4796, "destination.geo.location.lon": 6.4599, "destination.geo.region_iso_code": "CH-VD", @@ -66,6 +67,7 @@ "source.geo.city_name": "Gdynia", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 54.5055, "source.geo.location.lon": 18.5403, "source.geo.region_iso_code": "PL-22", @@ -88,6 +90,7 @@ "destination.geo.city_name": "Saint-Prex", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "CH", + "destination.geo.country_name": "Switzerland", "destination.geo.location.lat": 46.4796, "destination.geo.location.lon": 6.4599, "destination.geo.region_iso_code": "CH-VD", @@ -146,6 +149,7 @@ "source.geo.city_name": "Gdynia", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "PL", + "source.geo.country_name": "Poland", "source.geo.location.lat": 54.5055, "source.geo.location.lon": 18.5403, "source.geo.region_iso_code": "PL-22", @@ -303,6 +307,7 @@ "destination.bytes": 403, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "216.167.51.72", @@ -359,6 +364,7 @@ "source.geo.city_name": "Bucharest", "source.geo.continent_name": "Europe", "source.geo.country_iso_code": "RO", + "source.geo.country_name": "Romania", "source.geo.location.lat": 44.4176, "source.geo.location.lon": 26.1708, "source.geo.region_iso_code": "RO-B", diff --git a/x-pack/filebeat/module/squid/log/test/access1.log-expected.json b/x-pack/filebeat/module/squid/log/test/access1.log-expected.json index 26b891ba4f1..e9284eed554 100644 --- a/x-pack/filebeat/module/squid/log/test/access1.log-expected.json +++ b/x-pack/filebeat/module/squid/log/test/access1.log-expected.json @@ -5,6 +5,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -36,8 +37,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_MISS" + "TCP_MISS", + "CONNECT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -67,6 +68,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -89,8 +91,8 @@ "www.goonernews.com" ], "related.ip": [ - "10.105.21.199", - "207.58.145.61" + "207.58.145.61", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -101,8 +103,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -132,6 +134,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -155,8 +158,8 @@ "www.goonernews.com" ], "related.ip": [ - "10.105.21.199", - "207.58.145.61" + "207.58.145.61", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -167,8 +170,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -220,8 +223,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_HIT" + "TCP_HIT", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "200", @@ -273,8 +276,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_HIT", - "GET" + "GET", + "TCP_HIT" ], "rsa.misc.content_type": "text/javascript", "rsa.misc.result_code": "200", @@ -304,6 +307,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -338,8 +342,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -368,6 +372,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -389,8 +394,8 @@ "www.google-analytics.com" ], "related.ip": [ - "10.105.21.199", - "66.102.9.147" + "66.102.9.147", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -401,8 +406,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -432,6 +437,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -455,8 +461,8 @@ "www.goonernews.com" ], "related.ip": [ - "207.58.145.61", - "10.105.21.199" + "10.105.21.199", + "207.58.145.61" ], "related.user": [ "badeyek" @@ -467,8 +473,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -498,6 +504,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -521,8 +528,8 @@ "www.goonernews.com" ], "related.ip": [ - "10.105.21.199", - "207.58.145.61" + "207.58.145.61", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -533,8 +540,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -564,6 +571,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -652,8 +660,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_HIT", - "GET" + "GET", + "TCP_HIT" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -683,6 +691,7 @@ "destination.geo.city_name": "Dallas", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 32.9379, "destination.geo.location.lon": -96.8384, "destination.geo.region_iso_code": "US-TX", @@ -706,8 +715,8 @@ "as.casalemedia.com" ], "related.ip": [ - "10.105.21.199", - "209.85.16.38" + "209.85.16.38", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -746,6 +755,7 @@ "@timestamp": "2006-09-08T04:22:06.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -766,8 +776,8 @@ "us.bc.yahoo.com" ], "related.ip": [ - "10.105.21.199", - "68.142.213.132" + "68.142.213.132", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -777,8 +787,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "CONNECT", - "TCP_MISS" + "TCP_MISS", + "CONNECT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -807,6 +817,7 @@ "destination.as.organization.name": "Telia Company AB", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "SE", + "destination.geo.country_name": "Sweden", "destination.geo.location.lat": 59.3247, "destination.geo.location.lon": 18.056, "destination.ip": [ @@ -840,8 +851,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "302", @@ -871,6 +882,7 @@ "destination.geo.city_name": "Los Angeles", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 34.0675, "destination.geo.location.lon": -118.3521, "destination.geo.region_iso_code": "US-CA", @@ -894,8 +906,8 @@ "4.adbrite.com" ], "related.ip": [ - "10.105.21.199", - "206.169.136.22" + "206.169.136.22", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -959,8 +971,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_HIT" + "TCP_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -990,6 +1002,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -1013,8 +1026,8 @@ "www.goonernews.com" ], "related.ip": [ - "207.58.145.61", - "10.105.21.199" + "10.105.21.199", + "207.58.145.61" ], "related.user": [ "badeyek" @@ -1025,8 +1038,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -1056,6 +1069,7 @@ "destination.geo.city_name": "Falls Church", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.9307, "destination.geo.location.lon": -77.1673, "destination.geo.region_iso_code": "US-VA", @@ -1079,8 +1093,8 @@ "www.goonernews.com" ], "related.ip": [ - "207.58.145.61", - "10.105.21.199" + "10.105.21.199", + "207.58.145.61" ], "related.user": [ "badeyek" @@ -1119,6 +1133,7 @@ "@timestamp": "2006-09-08T04:22:10.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -1140,8 +1155,8 @@ "4.adbrite.com" ], "related.ip": [ - "10.105.21.199", - "64.127.126.178" + "64.127.126.178", + "10.105.21.199" ], "related.user": [ "badeyek" @@ -1152,8 +1167,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -1183,6 +1198,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -1206,8 +1222,8 @@ "ff.connextra.com" ], "related.ip": [ - "213.160.98.161", - "10.105.21.199" + "10.105.21.199", + "213.160.98.161" ], "related.user": [ "badeyek" @@ -1218,8 +1234,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "302", @@ -1249,6 +1265,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -1284,8 +1301,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -1336,8 +1353,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_DENIED" + "TCP_DENIED", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -1366,6 +1383,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -1397,8 +1415,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "CONNECT" + "CONNECT", + "TCP_MISS" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -1480,6 +1498,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -1542,6 +1561,7 @@ "destination.geo.city_name": "Victoria", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "CA", + "destination.geo.country_name": "Canada", "destination.geo.location.lat": 48.4267, "destination.geo.location.lon": -123.3655, "destination.geo.region_iso_code": "CA-BC", @@ -1607,6 +1627,7 @@ "destination.geo.city_name": "Victoria", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "CA", + "destination.geo.country_name": "Canada", "destination.geo.location.lat": 48.4267, "destination.geo.location.lon": -123.3655, "destination.geo.region_iso_code": "CA-BC", @@ -1630,8 +1651,8 @@ "hi5.com" ], "related.ip": [ - "10.105.47.218", - "204.13.51.238" + "204.13.51.238", + "10.105.47.218" ], "related.user": [ "nazsoau" @@ -1672,6 +1693,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -1692,8 +1714,8 @@ "shttp.msg.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "216.155.194.239" + "216.155.194.239", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -1809,8 +1831,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "304", @@ -1862,8 +1884,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_IMS_HIT", - "GET" + "GET", + "TCP_IMS_HIT" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "304", @@ -1893,6 +1915,7 @@ "destination.geo.city_name": "Victoria", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "CA", + "destination.geo.country_name": "Canada", "destination.geo.location.lat": 48.4267, "destination.geo.location.lon": -123.3655, "destination.geo.region_iso_code": "CA-BC", @@ -1915,8 +1938,8 @@ "hi5.com" ], "related.ip": [ - "204.13.51.238", - "10.105.47.218" + "10.105.47.218", + "204.13.51.238" ], "related.user": [ "nazsoau" @@ -1958,6 +1981,7 @@ "destination.geo.city_name": "Victoria", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "CA", + "destination.geo.country_name": "Canada", "destination.geo.location.lat": 48.4267, "destination.geo.location.lon": -123.3655, "destination.geo.region_iso_code": "CA-BC", @@ -1993,8 +2017,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/css", "rsa.misc.result_code": "200", @@ -2023,6 +2047,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2054,8 +2079,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "POST", - "TCP_MISS" + "TCP_MISS", + "POST" ], "rsa.misc.content_type": "text/plain", "rsa.misc.result_code": "200", @@ -2082,6 +2107,7 @@ "@timestamp": "2006-09-08T04:22:33.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2102,8 +2128,8 @@ "insider.msg.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "68.142.194.14" + "68.142.194.14", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2114,8 +2140,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -2144,6 +2170,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2165,8 +2192,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2177,8 +2204,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -2207,6 +2234,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2266,6 +2294,7 @@ "@timestamp": "2006-09-08T04:22:35.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2330,6 +2359,7 @@ "destination.geo.city_name": "Sacramento", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 38.6415, "destination.geo.location.lon": -121.5114, "destination.geo.region_iso_code": "US-CA", @@ -2395,6 +2425,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2455,6 +2486,7 @@ "@timestamp": "2006-09-08T04:22:37.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2487,8 +2519,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/xml", "rsa.misc.result_code": "200", @@ -2538,8 +2570,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "CONNECT" + "CONNECT", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2642,8 +2674,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "POST" + "POST", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -2723,6 +2755,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2837,6 +2870,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2900,6 +2934,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2920,8 +2955,8 @@ "shttp.msg.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "216.155.194.239" + "216.155.194.239", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -2961,6 +2996,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -2994,8 +3030,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3024,6 +3060,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3057,8 +3094,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3109,8 +3146,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "POST" + "POST", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -3161,8 +3198,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "POST", - "TCP_DENIED" + "TCP_DENIED", + "POST" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -3191,6 +3228,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3224,8 +3262,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3254,6 +3292,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3287,8 +3326,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3317,6 +3356,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3338,8 +3378,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -3350,8 +3390,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_REFRESH_HIT", - "GET" + "GET", + "TCP_REFRESH_HIT" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3380,6 +3420,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3401,8 +3442,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -3413,8 +3454,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_REFRESH_HIT" + "TCP_REFRESH_HIT", + "GET" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "304", @@ -3466,8 +3507,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -3519,8 +3560,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_IMS_HIT", - "GET" + "GET", + "TCP_IMS_HIT" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -3572,8 +3613,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_HIT" + "TCP_HIT", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -3602,6 +3643,7 @@ "destination.as.organization.name": "BBC", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.4964, "destination.geo.location.lon": -0.1224, "destination.ip": [ @@ -3623,8 +3665,8 @@ "newsrss.bbc.co.uk" ], "related.ip": [ - "212.58.226.33", - "10.105.21.199" + "10.105.21.199", + "212.58.226.33" ], "related.user": [ "badeyek" @@ -3665,6 +3707,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3834,6 +3877,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3855,8 +3899,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -3866,8 +3910,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "POST", - "TCP_MISS" + "TCP_MISS", + "POST" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "302", @@ -3897,6 +3941,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -3962,6 +4007,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -3983,8 +4029,8 @@ "radio.music.yahoo.com" ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -3995,8 +4041,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/xml", "rsa.misc.result_code": "200", @@ -4025,6 +4071,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4046,8 +4093,8 @@ "radio.music.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4058,8 +4105,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "text/xml", "rsa.misc.result_code": "200", @@ -4088,6 +4135,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4121,8 +4169,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "200", @@ -4227,8 +4275,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -4258,6 +4306,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -4281,8 +4330,8 @@ "us.news1.yimg.com" ], "related.ip": [ - "10.105.33.214", - "213.160.98.159" + "213.160.98.159", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4293,8 +4342,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "image/jpeg", "rsa.misc.result_code": "200", @@ -4323,6 +4372,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4344,8 +4394,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "68.142.219.132", - "10.105.33.214" + "10.105.33.214", + "68.142.219.132" ], "related.user": [ "adeolaegbedokun" @@ -4386,6 +4436,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4450,6 +4501,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -4473,8 +4525,8 @@ "us.a2.yimg.com" ], "related.ip": [ - "10.105.33.214", - "213.160.98.152" + "213.160.98.152", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4515,6 +4567,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4536,8 +4589,8 @@ "radio.launch.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "68.142.219.132" + "68.142.219.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4576,6 +4629,7 @@ "@timestamp": "2006-09-08T04:22:54.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4597,8 +4651,8 @@ "us.bc.yahoo.com" ], "related.ip": [ - "10.105.33.214", - "68.142.213.132" + "68.142.213.132", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4637,6 +4691,7 @@ "@timestamp": "2006-09-08T04:22:56.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4698,6 +4753,7 @@ "@timestamp": "2006-09-08T04:22:57.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4782,8 +4838,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_IMS_HIT" + "TCP_IMS_HIT", + "GET" ], "rsa.misc.content_type": "application/x-javascript", "rsa.misc.result_code": "304", @@ -4813,6 +4869,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -4836,8 +4893,8 @@ "a1568.g.akamai.net" ], "related.ip": [ - "10.105.33.214", - "213.160.98.159" + "213.160.98.159", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -4879,6 +4936,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -4914,8 +4972,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -4944,6 +5002,7 @@ "destination.as.organization.name": "Oath Holdings Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -4964,8 +5023,8 @@ "login.yahoo.com" ], "related.ip": [ - "209.73.177.115", - "10.105.21.199" + "10.105.21.199", + "209.73.177.115" ], "related.user": [ "badeyek" @@ -4975,8 +5034,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "CONNECT" + "CONNECT", + "TCP_MISS" ], "rsa.misc.content_type": "-", "rsa.misc.result_code": "200", @@ -5006,6 +5065,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5072,6 +5132,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5095,8 +5156,8 @@ "a1568.g.akamai.net" ], "related.ip": [ - "213.160.98.159", - "10.105.33.214" + "10.105.33.214", + "213.160.98.159" ], "related.user": [ "adeolaegbedokun" @@ -5191,6 +5252,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5257,6 +5319,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5323,6 +5386,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5346,8 +5410,8 @@ "a1568.g.akamai.net" ], "related.ip": [ - "10.105.33.214", - "213.160.98.167" + "213.160.98.167", + "10.105.33.214" ], "related.user": [ "adeolaegbedokun" @@ -5358,8 +5422,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "GET", - "TCP_MISS" + "TCP_MISS", + "GET" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "304", @@ -5411,8 +5475,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "GET" + "GET", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -5492,6 +5556,7 @@ "@timestamp": "2006-09-08T04:23:01.000Z", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": [ @@ -5513,8 +5578,8 @@ "launch.adserver.yahoo.com" ], "related.ip": [ - "216.109.125.112", - "10.105.33.214" + "10.105.33.214", + "216.109.125.112" ], "related.user": [ "adeolaegbedokun" @@ -5525,8 +5590,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_MISS", - "GET" + "GET", + "TCP_MISS" ], "rsa.misc.content_type": "image/gif", "rsa.misc.result_code": "200", @@ -5555,6 +5620,7 @@ "destination.as.organization.name": "Yahoo! UK Services Limited", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.4964, "destination.geo.location.lon": -0.1224, "destination.ip": [ @@ -5576,8 +5642,8 @@ "uk.f250.mail.yahoo.com" ], "related.ip": [ - "217.12.10.96", - "10.105.21.199" + "10.105.21.199", + "217.12.10.96" ], "related.user": [ "badeyek" @@ -5639,8 +5705,8 @@ "rsa.investigations.ec_subject": "NetworkComm", "rsa.investigations.ec_theme": "ALM", "rsa.misc.action": [ - "TCP_DENIED", - "CONNECT" + "CONNECT", + "TCP_DENIED" ], "rsa.misc.content_type": "text/html", "rsa.misc.result_code": "407", @@ -5670,6 +5736,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", @@ -5693,8 +5760,8 @@ "us.js2.yimg.com" ], "related.ip": [ - "213.160.98.169", - "10.105.21.199" + "10.105.21.199", + "213.160.98.169" ], "related.user": [ "badeyek" @@ -5789,6 +5856,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5064, "destination.geo.location.lon": -0.02, "destination.geo.region_iso_code": "GB-ENG", diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json index 68412b504dc..a63e2fd592a 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json @@ -9,6 +9,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -89,6 +90,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -169,6 +171,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -249,6 +252,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -329,6 +333,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -409,6 +414,7 @@ "destination.geo.city_name": "Norwell", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.1596, "destination.geo.location.lon": -70.8217, "destination.geo.region_iso_code": "US-MA", @@ -489,6 +495,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5132, "destination.geo.location.lon": -0.0961, "destination.geo.region_iso_code": "GB-ENG", @@ -569,6 +576,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -649,6 +657,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -729,6 +738,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5132, "destination.geo.location.lon": -0.0961, "destination.geo.region_iso_code": "GB-ENG", @@ -809,6 +819,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5132, "destination.geo.location.lon": -0.0961, "destination.geo.region_iso_code": "GB-ENG", @@ -889,6 +900,7 @@ "destination.geo.city_name": "London", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "GB", + "destination.geo.country_name": "United Kingdom", "destination.geo.location.lat": 51.5132, "destination.geo.location.lon": -0.0961, "destination.geo.region_iso_code": "GB-ENG", @@ -969,6 +981,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1049,6 +1062,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1129,6 +1143,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1209,6 +1224,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1289,6 +1305,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1369,6 +1386,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1449,6 +1467,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", @@ -1528,6 +1547,7 @@ "destination.geo.city_name": "Boston", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 42.3562, "destination.geo.location.lon": -71.0631, "destination.geo.region_iso_code": "US-MA", diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json index 5d113c8d370..4851f2db826 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json @@ -415,6 +415,7 @@ "destination.domain": "p33-btmmdns.icloud.com", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "17.142.164.13", diff --git a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json index 9b9183fe35a..0c6eccf2dcc 100644 --- a/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json +++ b/x-pack/filebeat/module/symantec/endpointprotection/test/generated.log-expected.json @@ -704,8 +704,8 @@ "bore5546.www.local" ], "related.ip": [ - "10.7.164.113", "10.175.83.138", + "10.7.164.113", "10.207.125.114" ], "related.user": [ @@ -2263,8 +2263,8 @@ "edi6108.internal.domain" ], "related.ip": [ - "10.72.200.11", - "10.132.171.142" + "10.132.171.142", + "10.72.200.11" ], "related.user": [ "ero" @@ -2579,8 +2579,8 @@ "dita2048.www5.home" ], "related.ip": [ - "10.171.13.85", - "10.40.133.90" + "10.40.133.90", + "10.171.13.85" ], "related.user": [ "bor" @@ -2795,8 +2795,8 @@ "urExcep6087.www5.localhost" ], "related.ip": [ - "10.155.163.6", - "10.31.231.57" + "10.31.231.57", + "10.155.163.6" ], "related.user": [ "norumetM" diff --git a/x-pack/filebeat/module/zeek/connection/test/connection-json.log-expected.json b/x-pack/filebeat/module/zeek/connection/test/connection-json.log-expected.json index ccb28ef2f92..b7c0e0bc8cb 100644 --- a/x-pack/filebeat/module/zeek/connection/test/connection-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/connection/test/connection-json.log-expected.json @@ -59,6 +59,7 @@ "destination.bytes": 206, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -116,6 +117,7 @@ "destination.bytes": 206, "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", @@ -154,6 +156,7 @@ "source.bytes": 103, "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "4.4.2.2", diff --git a/x-pack/filebeat/module/zeek/http/test/http-json.log-expected.json b/x-pack/filebeat/module/zeek/http/test/http-json.log-expected.json index c4364d77426..200950e922a 100644 --- a/x-pack/filebeat/module/zeek/http/test/http-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/http/test/http-json.log-expected.json @@ -7,6 +7,7 @@ "destination.geo.city_name": "San Jose", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.3388, "destination.geo.location.lon": -121.8914, "destination.geo.region_iso_code": "US-CA", diff --git a/x-pack/filebeat/module/zeek/irc/test/irc-json.log-expected.json b/x-pack/filebeat/module/zeek/irc/test/irc-json.log-expected.json index 245d1154e86..06d833b6a42 100644 --- a/x-pack/filebeat/module/zeek/irc/test/irc-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/irc/test/irc-json.log-expected.json @@ -6,6 +6,7 @@ "destination.as.organization.name": "Team Cymru Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "38.229.70.20", @@ -52,6 +53,7 @@ "destination.as.organization.name": "Team Cymru Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "38.229.70.20", @@ -103,6 +105,7 @@ "destination.as.organization.name": "Team Cymru Inc.", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "38.229.70.20", diff --git a/x-pack/filebeat/module/zeek/notice/test/notice-json.log-expected.json b/x-pack/filebeat/module/zeek/notice/test/notice-json.log-expected.json index a5838e9f3f1..90bb5e3145e 100644 --- a/x-pack/filebeat/module/zeek/notice/test/notice-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/notice/test/notice-json.log-expected.json @@ -40,6 +40,7 @@ "destination.geo.city_name": "Frankfurt am Main", "destination.geo.continent_name": "Europe", "destination.geo.country_iso_code": "DE", + "destination.geo.country_name": "Germany", "destination.geo.location.lat": 50.1188, "destination.geo.location.lon": 8.6843, "destination.geo.region_iso_code": "DE-HE", @@ -71,6 +72,7 @@ "source.geo.city_name": "Longmont", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 40.1559, "source.geo.location.lon": -105.1624, "source.geo.region_iso_code": "US-CO", diff --git a/x-pack/filebeat/module/zeek/sip/test/sip-json.log-expected.json b/x-pack/filebeat/module/zeek/sip/test/sip-json.log-expected.json index 79b38a0717d..71061cd293b 100644 --- a/x-pack/filebeat/module/zeek/sip/test/sip-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/sip/test/sip-json.log-expected.json @@ -6,6 +6,7 @@ "destination.as.organization.name": "Internap Corporation", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "74.63.41.218", @@ -72,6 +73,7 @@ "destination.geo.city_name": "Mexico City", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "MX", + "destination.geo.country_name": "Mexico", "destination.geo.location.lat": 19.4357, "destination.geo.location.lon": -99.1438, "destination.geo.region_iso_code": "MX-CMX", @@ -108,6 +110,7 @@ "source.geo.city_name": "Mexico City", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "MX", + "source.geo.country_name": "Mexico", "source.geo.location.lat": 19.4357, "source.geo.location.lon": -99.1438, "source.geo.region_iso_code": "MX-CMX", @@ -151,6 +154,7 @@ "destination.geo.city_name": "Mexico City", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "MX", + "destination.geo.country_name": "Mexico", "destination.geo.location.lat": 19.4357, "destination.geo.location.lon": -99.1438, "destination.geo.region_iso_code": "MX-CMX", @@ -187,6 +191,7 @@ "source.geo.city_name": "Mexico City", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "MX", + "source.geo.country_name": "Mexico", "source.geo.location.lat": 19.4357, "source.geo.location.lon": -99.1438, "source.geo.region_iso_code": "MX-CMX", diff --git a/x-pack/filebeat/module/zeek/ssl/test/ssl-json.log-expected.json b/x-pack/filebeat/module/zeek/ssl/test/ssl-json.log-expected.json index 805d20d2a54..67817ff0a42 100644 --- a/x-pack/filebeat/module/zeek/ssl/test/ssl-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/ssl/test/ssl-json.log-expected.json @@ -8,6 +8,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", @@ -88,6 +89,7 @@ "destination.geo.city_name": "Mountain View", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.4043, "destination.geo.location.lon": -122.0748, "destination.geo.region_iso_code": "US-CA", diff --git a/x-pack/filebeat/module/zeek/traceroute/test/traceroute-json.log-expected.json b/x-pack/filebeat/module/zeek/traceroute/test/traceroute-json.log-expected.json index 8fdfd983c94..34d600174ac 100644 --- a/x-pack/filebeat/module/zeek/traceroute/test/traceroute-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/traceroute/test/traceroute-json.log-expected.json @@ -6,6 +6,7 @@ "destination.as.organization.name": "Google LLC", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "8.8.8.8", diff --git a/x-pack/filebeat/module/zeek/tunnel/test/tunnel-json.log-expected.json b/x-pack/filebeat/module/zeek/tunnel/test/tunnel-json.log-expected.json index 1e00e616e36..3ef709508a3 100644 --- a/x-pack/filebeat/module/zeek/tunnel/test/tunnel-json.log-expected.json +++ b/x-pack/filebeat/module/zeek/tunnel/test/tunnel-json.log-expected.json @@ -6,6 +6,7 @@ "destination.as.organization.name": "Air Force Systems Networking", "destination.geo.continent_name": "North America", "destination.geo.country_iso_code": "US", + "destination.geo.country_name": "United States", "destination.geo.location.lat": 37.751, "destination.geo.location.lon": -97.822, "destination.ip": "132.16.110.133", @@ -33,6 +34,7 @@ "source.as.organization.name": "Air Force Systems Networking", "source.geo.continent_name": "North America", "source.geo.country_iso_code": "US", + "source.geo.country_name": "United States", "source.geo.location.lat": 37.751, "source.geo.location.lon": -97.822, "source.ip": "132.16.146.79", diff --git a/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json b/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json index b7bd436496b..1fbe44131f5 100644 --- a/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json +++ b/x-pack/filebeat/module/zscaler/zia/test/generated.log-expected.json @@ -26,8 +26,8 @@ "rci737.www5.example" ], "related.ip": [ - "10.176.10.114", - "10.206.191.17" + "10.206.191.17", + "10.176.10.114" ], "related.user": [ "sumdo" @@ -115,8 +115,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "luptat", "rsa.misc.action": [ - "Allowed", - "tur" + "tur", + "Allowed" ], "rsa.misc.category": "eius", "rsa.misc.filter": "ameaqu", @@ -176,8 +176,8 @@ "orsitame3262.domain" ], "related.ip": [ - "10.254.146.57", - "10.204.86.149" + "10.204.86.149", + "10.254.146.57" ], "related.user": [ "tenima" @@ -191,8 +191,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uptassi", "rsa.misc.action": [ - "giatq", - "Blocked" + "Blocked", + "giatq" ], "rsa.misc.category": "llu", "rsa.misc.filter": "tconsec", @@ -252,8 +252,8 @@ "tempor4496.www.localdomain" ], "related.ip": [ - "10.252.125.53", - "10.103.246.190" + "10.103.246.190", + "10.252.125.53" ], "related.user": [ "equun" @@ -267,8 +267,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ima", "rsa.misc.action": [ - "llam", - "Allowed" + "Allowed", + "llam" ], "rsa.misc.category": "aboris", "rsa.misc.filter": "atatnonp", @@ -328,8 +328,8 @@ "ore2933.www.test" ], "related.ip": [ - "10.61.78.108", - "10.136.153.149" + "10.136.153.149", + "10.61.78.108" ], "related.user": [ "ercit" @@ -343,8 +343,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "inim", "rsa.misc.action": [ - "reetdolo", - "Blocked" + "Blocked", + "reetdolo" ], "rsa.misc.category": "osquir", "rsa.misc.filter": "ipit", @@ -480,8 +480,8 @@ "cup1793.local" ], "related.ip": [ - "10.243.224.205", - "10.123.104.59" + "10.123.104.59", + "10.243.224.205" ], "related.user": [ "xercitat" @@ -495,8 +495,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "lupt", "rsa.misc.action": [ - "Blocked", - "dun" + "dun", + "Blocked" ], "rsa.misc.category": "rsitamet", "rsa.misc.filter": "usmod", @@ -632,8 +632,8 @@ "aperia4409.www5.invalid" ], "related.ip": [ - "10.78.151.178", - "10.25.192.202" + "10.25.192.202", + "10.78.151.178" ], "related.user": [ "quip" @@ -647,8 +647,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "atquovo", "rsa.misc.action": [ - "amvolup", - "Allowed" + "Allowed", + "amvolup" ], "rsa.misc.category": "hil", "rsa.misc.filter": "deFinibu", @@ -723,8 +723,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ihilm", "rsa.misc.action": [ - "Allowed", - "psaquae" + "psaquae", + "Allowed" ], "rsa.misc.category": "eFinib", "rsa.misc.filter": "inesci", @@ -784,8 +784,8 @@ "ite2026.www.invalid" ], "related.ip": [ - "10.19.145.131", - "10.223.247.86" + "10.223.247.86", + "10.19.145.131" ], "related.user": [ "tNequepo" @@ -860,8 +860,8 @@ "radipisc7020.home" ], "related.ip": [ - "10.2.53.125", - "10.181.80.139" + "10.181.80.139", + "10.2.53.125" ], "related.user": [ "ihilmo" @@ -936,8 +936,8 @@ "uamei2493.www.test" ], "related.ip": [ - "10.31.240.6", - "10.167.98.76" + "10.167.98.76", + "10.31.240.6" ], "related.user": [ "ratvolu" @@ -951,8 +951,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "catc", "rsa.misc.action": [ - "Allowed", - "veni" + "veni", + "Allowed" ], "rsa.misc.category": "sBono", "rsa.misc.filter": "isnisiu", @@ -1027,8 +1027,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iurer", "rsa.misc.action": [ - "ionevo", - "Allowed" + "Allowed", + "ionevo" ], "rsa.misc.category": "tinvolu", "rsa.misc.filter": "idex", @@ -1088,8 +1088,8 @@ "spi3544.www.host" ], "related.ip": [ - "10.63.250.128", - "10.111.187.12" + "10.111.187.12", + "10.63.250.128" ], "related.user": [ "saute" @@ -1164,8 +1164,8 @@ "tlab5981.www.host" ], "related.ip": [ - "10.5.126.127", - "10.252.124.150" + "10.252.124.150", + "10.5.126.127" ], "related.user": [ "inibusB" @@ -1179,8 +1179,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "mod", "rsa.misc.action": [ - "Allowed", - "xeacomm" + "xeacomm", + "Allowed" ], "rsa.misc.category": "sauteiru", "rsa.misc.filter": "antiu", @@ -1331,8 +1331,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "quid", "rsa.misc.action": [ - "itecto", - "Allowed" + "Allowed", + "itecto" ], "rsa.misc.category": "quam", "rsa.misc.filter": "adeser", @@ -1392,8 +1392,8 @@ "uamei2389.internal.example" ], "related.ip": [ - "10.215.205.216", - "10.31.198.58" + "10.31.198.58", + "10.215.205.216" ], "related.user": [ "aturve" @@ -1468,8 +1468,8 @@ "eacommod1930.internal.lan" ], "related.ip": [ - "10.229.83.165", - "10.29.155.171" + "10.29.155.171", + "10.229.83.165" ], "related.user": [ "ulapar" @@ -1483,8 +1483,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "vitaedi", "rsa.misc.action": [ - "llitanim", - "Allowed" + "Allowed", + "llitanim" ], "rsa.misc.category": "apariat", "rsa.misc.filter": "tasnulap", @@ -1544,8 +1544,8 @@ "tem6984.www5.domain" ], "related.ip": [ - "10.161.148.64", - "10.129.192.145" + "10.129.192.145", + "10.161.148.64" ], "related.user": [ "lor" @@ -1620,8 +1620,8 @@ "lapariat7287.internal.host" ], "related.ip": [ - "10.203.65.161", - "10.7.200.140" + "10.7.200.140", + "10.203.65.161" ], "related.user": [ "snost" @@ -1711,8 +1711,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iutali", "rsa.misc.action": [ - "atcupi", - "Blocked" + "Blocked", + "atcupi" ], "rsa.misc.category": "isetq", "rsa.misc.filter": "equinesc", @@ -1772,8 +1772,8 @@ "stenatu4844.www.invalid" ], "related.ip": [ - "10.39.31.115", - "10.24.111.229" + "10.24.111.229", + "10.39.31.115" ], "related.user": [ "fugi" @@ -1848,8 +1848,8 @@ "sitam5077.internal.host" ], "related.ip": [ - "10.32.39.220", - "10.179.210.218" + "10.179.210.218", + "10.32.39.220" ], "related.user": [ "boreetdo" @@ -2000,8 +2000,8 @@ "lloin4019.www.localhost" ], "related.ip": [ - "10.130.241.232", - "10.238.224.49" + "10.238.224.49", + "10.130.241.232" ], "related.user": [ "onse" @@ -2015,8 +2015,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "mnisiut", "rsa.misc.action": [ - "mod", - "Allowed" + "Allowed", + "mod" ], "rsa.misc.category": "uiinea", "rsa.misc.filter": "aturQu", @@ -2076,8 +2076,8 @@ "tamet6317.www.host" ], "related.ip": [ - "10.2.67.127", - "10.115.53.31" + "10.115.53.31", + "10.2.67.127" ], "related.user": [ "Cic" @@ -2091,8 +2091,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "quatD", "rsa.misc.action": [ - "tatem", - "Allowed" + "Allowed", + "tatem" ], "rsa.misc.category": "aincidun", "rsa.misc.filter": "uela", @@ -2167,8 +2167,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tasun", "rsa.misc.action": [ - "quasiarc", - "Allowed" + "Allowed", + "quasiarc" ], "rsa.misc.category": "autfugi", "rsa.misc.filter": "ritqu", @@ -2228,8 +2228,8 @@ "utaliqu4248.www.localhost" ], "related.ip": [ - "10.18.226.72", - "10.101.85.169" + "10.101.85.169", + "10.18.226.72" ], "related.user": [ "rroqu" @@ -2319,8 +2319,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "mag", "rsa.misc.action": [ - "tali", - "Allowed" + "Allowed", + "tali" ], "rsa.misc.category": "oconse", "rsa.misc.filter": "npr", @@ -2380,8 +2380,8 @@ "tatio6513.www.invalid" ], "related.ip": [ - "10.80.57.247", - "10.229.242.223" + "10.229.242.223", + "10.80.57.247" ], "related.user": [ "itasp" @@ -2471,8 +2471,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uteir", "rsa.misc.action": [ - "Allowed", - "Section" + "Section", + "Allowed" ], "rsa.misc.category": "cididu", "rsa.misc.filter": "Utenima", @@ -2532,8 +2532,8 @@ "aquioff3853.www.localdomain" ], "related.ip": [ - "10.54.159.1", - "10.236.230.136" + "10.236.230.136", + "10.54.159.1" ], "related.user": [ "mUteni" @@ -2547,8 +2547,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tec", "rsa.misc.action": [ - "tatema", - "Allowed" + "Allowed", + "tatema" ], "rsa.misc.category": "emullamc", "rsa.misc.filter": "emveleum", @@ -2623,8 +2623,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tvolup", "rsa.misc.action": [ - "utemvel", - "Allowed" + "Allowed", + "utemvel" ], "rsa.misc.category": "untutlab", "rsa.misc.filter": "dol", @@ -2684,8 +2684,8 @@ "iamea478.www5.host" ], "related.ip": [ - "10.142.120.198", - "10.166.10.42" + "10.166.10.42", + "10.142.120.198" ], "related.user": [ "olori" @@ -2699,8 +2699,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ende", "rsa.misc.action": [ - "doconse", - "Blocked" + "Blocked", + "doconse" ], "rsa.misc.category": "uovolupt", "rsa.misc.filter": "litesse", @@ -2775,8 +2775,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "issu", "rsa.misc.action": [ - "Allowed", - "sed" + "sed", + "Allowed" ], "rsa.misc.category": "atur", "rsa.misc.filter": "iciadese", @@ -2851,8 +2851,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ese", "rsa.misc.action": [ - "Allowed", - "litanim" + "litanim", + "Allowed" ], "rsa.misc.category": "idata", "rsa.misc.filter": "urerepre", @@ -2927,8 +2927,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "idolores", "rsa.misc.action": [ - "Blocked", - "lestia" + "lestia", + "Blocked" ], "rsa.misc.category": "risni", "rsa.misc.filter": "emacc", @@ -2988,8 +2988,8 @@ "pariatur7238.www5.invalid" ], "related.ip": [ - "10.202.224.79", - "10.33.144.10" + "10.33.144.10", + "10.202.224.79" ], "related.user": [ "rios" @@ -3079,8 +3079,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Loremip", "rsa.misc.action": [ - "quid", - "Allowed" + "Allowed", + "quid" ], "rsa.misc.category": "mini", "rsa.misc.filter": "uisnos", @@ -3140,8 +3140,8 @@ "mquisnos7453.home" ], "related.ip": [ - "10.134.128.27", - "10.118.177.136" + "10.118.177.136", + "10.134.128.27" ], "related.user": [ "Utenima" @@ -3155,8 +3155,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "voluptas", "rsa.misc.action": [ - "Allowed", - "olor" + "olor", + "Allowed" ], "rsa.misc.category": "ataevita", "rsa.misc.filter": "nderi", @@ -3307,8 +3307,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "etdol", "rsa.misc.action": [ - "mwrit", - "Blocked" + "Blocked", + "mwrit" ], "rsa.misc.category": "inim", "rsa.misc.filter": "aturQu", @@ -3368,8 +3368,8 @@ "etdolore4227.internal.corp" ], "related.ip": [ - "10.30.87.51", - "10.156.177.53" + "10.156.177.53", + "10.30.87.51" ], "related.user": [ "psaquaea" @@ -3383,8 +3383,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tatno", "rsa.misc.action": [ - "ptatev", - "Blocked" + "Blocked", + "ptatev" ], "rsa.misc.category": "udexerc", "rsa.misc.filter": "ptatemse", @@ -3444,8 +3444,8 @@ "rors1935.api.domain" ], "related.ip": [ - "10.83.138.34", - "10.111.249.184" + "10.111.249.184", + "10.83.138.34" ], "related.user": [ "dentsunt" @@ -3459,8 +3459,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tatemse", "rsa.misc.action": [ - "Blocked", - "upta" + "upta", + "Blocked" ], "rsa.misc.category": "tlabo", "rsa.misc.filter": "aliqui", @@ -3520,8 +3520,8 @@ "idexeac1655.internal.test" ], "related.ip": [ - "10.141.195.13", - "10.180.150.47" + "10.180.150.47", + "10.141.195.13" ], "related.user": [ "taliq" @@ -3535,8 +3535,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "itesse", "rsa.misc.action": [ - "Allowed", - "uip" + "uip", + "Allowed" ], "rsa.misc.category": "teturad", "rsa.misc.filter": "roquisqu", @@ -3670,8 +3670,8 @@ "tecto708.www5.example" ], "related.ip": [ - "10.22.122.43", - "10.100.143.226" + "10.100.143.226", + "10.22.122.43" ], "related.user": [ "ute" @@ -3685,8 +3685,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ento", "rsa.misc.action": [ - "Bonoru", - "Blocked" + "Blocked", + "Bonoru" ], "rsa.misc.category": "luptasnu", "rsa.misc.filter": "quamni", @@ -3746,8 +3746,8 @@ "ine3181.www.invalid" ], "related.ip": [ - "10.119.53.68", - "10.121.9.5" + "10.121.9.5", + "10.119.53.68" ], "related.user": [ "ssec" @@ -3822,8 +3822,8 @@ "tsunt3403.www5.test" ], "related.ip": [ - "10.31.153.177", - "10.237.0.173" + "10.237.0.173", + "10.31.153.177" ], "related.user": [ "sci" @@ -3837,8 +3837,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "eritqui", "rsa.misc.action": [ - "dolor", - "Blocked" + "Blocked", + "dolor" ], "rsa.misc.category": "taspe", "rsa.misc.filter": "oremipsu", @@ -3911,8 +3911,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "epor", "rsa.misc.action": [ - "etquasia", - "Allowed" + "Allowed", + "etquasia" ], "rsa.misc.category": "iaturE", "rsa.misc.filter": "rep", @@ -3983,8 +3983,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "adipisc", "rsa.misc.action": [ - "exer", - "Blocked" + "Blocked", + "exer" ], "rsa.misc.category": "remagna", "rsa.misc.filter": "emvel", @@ -4044,8 +4044,8 @@ "tamr1693.api.home" ], "related.ip": [ - "10.53.191.49", - "10.133.102.57" + "10.133.102.57", + "10.53.191.49" ], "related.user": [ "onsec" @@ -4059,8 +4059,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ecillum", "rsa.misc.action": [ - "Blocked", - "emp" + "emp", + "Blocked" ], "rsa.misc.category": "ciati", "rsa.misc.filter": "elit", @@ -4135,8 +4135,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iuntN", "rsa.misc.action": [ - "nim", - "Allowed" + "Allowed", + "nim" ], "rsa.misc.category": "etco", "rsa.misc.filter": "autodita", @@ -4272,8 +4272,8 @@ "pici1525.www5.corp" ], "related.ip": [ - "10.155.252.123", - "10.178.148.188" + "10.178.148.188", + "10.155.252.123" ], "related.user": [ "inrepreh" @@ -4348,8 +4348,8 @@ "dolo6418.internal.host" ], "related.ip": [ - "10.190.42.245", - "10.220.1.249" + "10.220.1.249", + "10.190.42.245" ], "related.user": [ "olup" @@ -4363,8 +4363,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uamquaer", "rsa.misc.action": [ - "Blocked", - "aerat" + "aerat", + "Blocked" ], "rsa.misc.category": "quela", "rsa.misc.filter": "qui", @@ -4422,8 +4422,8 @@ "imveni193.www5.host" ], "related.ip": [ - "10.55.38.153", - "10.112.190.154" + "10.112.190.154", + "10.55.38.153" ], "related.user": [ "oremeu" @@ -4498,8 +4498,8 @@ "ionu3320.api.localhost" ], "related.ip": [ - "10.250.48.82", - "10.195.153.42" + "10.195.153.42", + "10.250.48.82" ], "related.user": [ "tsedquia" @@ -4574,8 +4574,8 @@ "remips1499.www.local" ], "related.ip": [ - "10.252.164.230", - "10.60.52.219" + "10.60.52.219", + "10.252.164.230" ], "related.user": [ "gnamali" @@ -4589,8 +4589,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "rroq", "rsa.misc.action": [ - "fdeFin", - "Blocked" + "Blocked", + "fdeFin" ], "rsa.misc.category": "diduntut", "rsa.misc.filter": "ano", @@ -4646,8 +4646,8 @@ "mdoloree96.domain" ], "related.ip": [ - "10.187.16.73", - "10.122.102.156" + "10.122.102.156", + "10.187.16.73" ], "related.user": [ "emoen" @@ -4796,8 +4796,8 @@ "sBonoru1929.example" ], "related.ip": [ - "10.51.161.245", - "10.15.254.181" + "10.15.254.181", + "10.51.161.245" ], "related.user": [ "abo" @@ -4872,8 +4872,8 @@ "onorumet4871.lan" ], "related.ip": [ - "10.7.152.238", - "10.129.66.196" + "10.129.66.196", + "10.7.152.238" ], "related.user": [ "equamn" @@ -4887,8 +4887,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "vento", "rsa.misc.action": [ - "Blocked", - "reh" + "reh", + "Blocked" ], "rsa.misc.category": "atev", "rsa.misc.filter": "umq", @@ -4948,8 +4948,8 @@ "onproi4354.www5.invalid" ], "related.ip": [ - "10.185.107.27", - "10.29.162.157" + "10.29.162.157", + "10.185.107.27" ], "related.user": [ "evelite" @@ -4963,8 +4963,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "orinrep", "rsa.misc.action": [ - "Blocked", - "squirat" + "squirat", + "Blocked" ], "rsa.misc.category": "sequa", "rsa.misc.filter": "orainci", @@ -5024,8 +5024,8 @@ "beataevi7552.api.test" ], "related.ip": [ - "10.215.63.248", - "10.138.0.214" + "10.138.0.214", + "10.215.63.248" ], "related.user": [ "eavolupt" @@ -5039,8 +5039,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "odita", "rsa.misc.action": [ - "dqu", - "Blocked" + "Blocked", + "dqu" ], "rsa.misc.category": "ipex", "rsa.misc.filter": "ine", @@ -5115,8 +5115,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tNequepo", "rsa.misc.action": [ - "Allowed", - "rmagnido" + "rmagnido", + "Allowed" ], "rsa.misc.category": "luptatem", "rsa.misc.filter": "deritq", @@ -5191,8 +5191,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "plicab", "rsa.misc.action": [ - "Blocked", - "umq" + "umq", + "Blocked" ], "rsa.misc.category": "eruntmol", "rsa.misc.filter": "labore", @@ -5267,8 +5267,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "omnisi", "rsa.misc.action": [ - "Allowed", - "userro" + "userro", + "Allowed" ], "rsa.misc.category": "etd", "rsa.misc.filter": "loremeum", @@ -5328,8 +5328,8 @@ "olo7317.www5.localhost" ], "related.ip": [ - "10.249.1.143", - "10.124.177.226" + "10.124.177.226", + "10.249.1.143" ], "related.user": [ "isciveli" @@ -5343,8 +5343,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Utenim", "rsa.misc.action": [ - "onevo", - "Allowed" + "Allowed", + "onevo" ], "rsa.misc.category": "tdolore", "rsa.misc.filter": "ptasn", @@ -5419,8 +5419,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ect", "rsa.misc.action": [ - "Blocked", - "maccu" + "maccu", + "Blocked" ], "rsa.misc.category": "iaecon", "rsa.misc.filter": "eni", @@ -5480,8 +5480,8 @@ "agna5654.www.corp" ], "related.ip": [ - "10.203.47.23", - "10.200.74.101" + "10.200.74.101", + "10.203.47.23" ], "related.user": [ "litesse" @@ -5495,8 +5495,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "nde", "rsa.misc.action": [ - "Allowed", - "iqu" + "iqu", + "Allowed" ], "rsa.misc.category": "ametco", "rsa.misc.filter": "ntincul", @@ -5556,8 +5556,8 @@ "ites5711.internal.host" ], "related.ip": [ - "10.162.78.48", - "10.24.23.209" + "10.24.23.209", + "10.162.78.48" ], "related.user": [ "ntore" @@ -5571,8 +5571,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ereprehe", "rsa.misc.action": [ - "Blocked", - "tutl" + "tutl", + "Blocked" ], "rsa.misc.category": "mip", "rsa.misc.filter": "umSecti", @@ -5632,8 +5632,8 @@ "oluptat2848.api.home" ], "related.ip": [ - "10.211.66.68", - "10.55.151.53" + "10.55.151.53", + "10.211.66.68" ], "related.user": [ "squir" @@ -5647,8 +5647,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "diconseq", "rsa.misc.action": [ - "Allowed", - "umet" + "umet", + "Allowed" ], "rsa.misc.category": "ciad", "rsa.misc.filter": "oeiusmod", @@ -5708,8 +5708,8 @@ "ngelitse7535.internal.lan" ], "related.ip": [ - "10.110.16.169", - "10.209.203.156" + "10.209.203.156", + "10.110.16.169" ], "related.user": [ "mes" @@ -5723,8 +5723,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "iamquisn", "rsa.misc.action": [ - "Blocked", - "lupta" + "lupta", + "Blocked" ], "rsa.misc.category": "uasiarch", "rsa.misc.filter": "usBonor", @@ -5784,8 +5784,8 @@ "tiumtot3611.internal.localdomain" ], "related.ip": [ - "10.107.68.114", - "10.84.9.150" + "10.84.9.150", + "10.107.68.114" ], "related.user": [ "sequatDu" @@ -5799,8 +5799,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "omnis", "rsa.misc.action": [ - "uianonnu", - "Allowed" + "Allowed", + "uianonnu" ], "rsa.misc.category": "Excepteu", "rsa.misc.filter": "enimadmi", @@ -5875,8 +5875,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "lloin", "rsa.misc.action": [ - "ici", - "Blocked" + "Blocked", + "ici" ], "rsa.misc.category": "quidolor", "rsa.misc.filter": "nonproi", @@ -5936,8 +5936,8 @@ "psaqu6066.www5.localhost" ], "related.ip": [ - "10.164.190.2", - "10.223.11.164" + "10.223.11.164", + "10.164.190.2" ], "related.user": [ "ten" @@ -6012,8 +6012,8 @@ "iavol5202.api.example" ], "related.ip": [ - "10.121.181.243", - "10.14.37.8" + "10.14.37.8", + "10.121.181.243" ], "related.user": [ "umwr" @@ -6027,8 +6027,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "vitaedic", "rsa.misc.action": [ - "Blocked", - "rinc" + "rinc", + "Blocked" ], "rsa.misc.category": "prehende", "rsa.misc.filter": "rume", @@ -6103,8 +6103,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tat", "rsa.misc.action": [ - "nia", - "Blocked" + "Blocked", + "nia" ], "rsa.misc.category": "turQuis", "rsa.misc.filter": "nonp", @@ -6164,8 +6164,8 @@ "rsitame4049.internal.corp" ], "related.ip": [ - "10.77.102.206", - "10.34.98.144" + "10.34.98.144", + "10.77.102.206" ], "related.user": [ "tectobe" @@ -6179,8 +6179,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "Exce", "rsa.misc.action": [ - "Allowed", - "ulapa" + "ulapa", + "Allowed" ], "rsa.misc.category": "reprehen", "rsa.misc.filter": "itsedqui", @@ -6240,8 +6240,8 @@ "elit912.www5.test" ], "related.ip": [ - "10.176.233.249", - "10.75.144.118" + "10.75.144.118", + "10.176.233.249" ], "related.user": [ "isnos" @@ -6255,8 +6255,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "essequa", "rsa.misc.action": [ - "Blocked", - "odic" + "odic", + "Blocked" ], "rsa.misc.category": "cto", "rsa.misc.filter": "odite", @@ -6331,8 +6331,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "uis", "rsa.misc.action": [ - "Allowed", - "mvele" + "mvele", + "Allowed" ], "rsa.misc.category": "vitaedi", "rsa.misc.filter": "ndeomni", @@ -6620,8 +6620,8 @@ "archite4407.mail.invalid" ], "related.ip": [ - "10.247.255.107", - "10.234.34.40" + "10.234.34.40", + "10.247.255.107" ], "related.user": [ "aeabillo" @@ -6696,8 +6696,8 @@ "aria1424.mail.home" ], "related.ip": [ - "10.250.102.42", - "10.124.81.20" + "10.124.81.20", + "10.250.102.42" ], "related.user": [ "tNequ" @@ -6711,8 +6711,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "ilmoles", "rsa.misc.action": [ - "tatisetq", - "Blocked" + "Blocked", + "tatisetq" ], "rsa.misc.category": "ametco", "rsa.misc.filter": "liquide", @@ -6772,8 +6772,8 @@ "Bonoru7444.www5.example" ], "related.ip": [ - "10.166.205.159", - "10.154.188.132" + "10.154.188.132", + "10.166.205.159" ], "related.user": [ "uptat" @@ -6787,8 +6787,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "proid", "rsa.misc.action": [ - "Allowed", - "onevolu" + "onevolu", + "Allowed" ], "rsa.misc.category": "iratio", "rsa.misc.filter": "odita", @@ -6916,8 +6916,8 @@ "oloremeu5047.www5.invalid" ], "related.ip": [ - "10.172.159.251", - "10.254.119.31" + "10.254.119.31", + "10.172.159.251" ], "related.user": [ "usm" @@ -6931,8 +6931,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "imadmi", "rsa.misc.action": [ - "tatemacc", - "Blocked" + "Blocked", + "tatemacc" ], "rsa.misc.category": "tutlabor", "rsa.misc.filter": "eturad", @@ -6992,8 +6992,8 @@ "edutpe1255.internal.lan" ], "related.ip": [ - "10.195.62.230", - "10.98.126.206" + "10.98.126.206", + "10.195.62.230" ], "related.user": [ "ptassit" @@ -7007,8 +7007,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "isnost", "rsa.misc.action": [ - "Allowed", - "oriosa" + "oriosa", + "Allowed" ], "rsa.misc.category": "uis", "rsa.misc.filter": "nemul", @@ -7068,8 +7068,8 @@ "nderit1171.www5.domain" ], "related.ip": [ - "10.144.93.186", - "10.84.140.5" + "10.84.140.5", + "10.144.93.186" ], "related.user": [ "eroi" @@ -7220,8 +7220,8 @@ "oremeum4231.internal.host" ], "related.ip": [ - "10.139.90.218", - "10.131.81.172" + "10.131.81.172", + "10.139.90.218" ], "related.user": [ "hende" @@ -7235,8 +7235,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "rrorsi", "rsa.misc.action": [ - "Allowed", - "exe" + "exe", + "Allowed" ], "rsa.misc.category": "mnihi", "rsa.misc.filter": "consequa", @@ -7296,8 +7296,8 @@ "ueip6097.api.host" ], "related.ip": [ - "10.152.217.174", - "10.128.43.71" + "10.128.43.71", + "10.152.217.174" ], "related.user": [ "mquiado" @@ -7387,8 +7387,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "tionemu", "rsa.misc.action": [ - "Blocked", - "rehe" + "rehe", + "Blocked" ], "rsa.misc.category": "aecons", "rsa.misc.filter": "aturve", @@ -7448,8 +7448,8 @@ "onsequ3168.www.corp" ], "related.ip": [ - "10.172.17.6", - "10.109.192.53" + "10.109.192.53", + "10.172.17.6" ], "related.user": [ "eprehen" @@ -7463,8 +7463,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "temUte", "rsa.misc.action": [ - "Blocked", - "tassit" + "tassit", + "Blocked" ], "rsa.misc.category": "ita", "rsa.misc.filter": "scive", @@ -7524,8 +7524,8 @@ "oremquel3120.internal.localhost" ], "related.ip": [ - "10.135.38.213", - "10.119.106.108" + "10.119.106.108", + "10.135.38.213" ], "related.user": [ "ore" @@ -7539,8 +7539,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "exeacomm", "rsa.misc.action": [ - "Blocked", - "volup" + "volup", + "Blocked" ], "rsa.misc.category": "ten", "rsa.misc.filter": "ssecil", diff --git a/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json b/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json index bdf9957b55d..d2e89ea6140 100644 --- a/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json +++ b/x-pack/filebeat/module/zscaler/zia/test/test.log-expected.json @@ -31,8 +31,8 @@ "rsa.investigations.ec_theme": "Communication", "rsa.investigations.event_vcat": "", "rsa.misc.action": [ - "", - "" + "", + "" ], "rsa.misc.category": "", "rsa.misc.filter": "", From 48c60f8ae024057a3e9ac49382978345a2893f93 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Fri, 2 Oct 2020 10:03:33 +0200 Subject: [PATCH 104/216] [Ingest Manager] Split index restrictions into type,dataset, namespace parts (#21406) [Ingest Manager] Split index restrictions into type,dataset, namespace parts (#21406) --- .../application/filters/stream_checker.go | 91 ++++++++++--------- .../filters/stream_checker_test.go | 79 ++++++---------- 2 files changed, 77 insertions(+), 93 deletions(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker.go b/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker.go index 3a6a7843b72..4f9e753ba94 100644 --- a/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker.go +++ b/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker.go @@ -5,7 +5,6 @@ package filters import ( - "fmt" "strings" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" @@ -47,11 +46,7 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { if nsNode, found := inputNode.Find("data_stream.namespace"); found { nsKey, ok := nsNode.(*transpiler.Key) if ok { - newNamespace := nsKey.Value().(transpiler.Node).String() - if !isValid(newNamespace) { - return ErrInvalidNamespace - } - namespace = newNamespace + namespace = nsKey.Value().(transpiler.Node).String() } } else { dsNode, found := inputNode.Find("data_stream") @@ -63,17 +58,17 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { if found { nsKey, ok := nsNode.(*transpiler.Key) if ok { - newNamespace := nsKey.Value().(transpiler.Node).String() - if !isValid(newNamespace) { - return ErrInvalidNamespace - } - namespace = newNamespace + namespace = nsKey.Value().(transpiler.Node).String() } } } } } + if !matchesNamespaceContraints(namespace) { + return ErrInvalidNamespace + } + // get the type, longest type for now is metrics datasetType := "metrics" if nsNode, found := inputNode.Find("data_stream.type"); found { @@ -100,6 +95,10 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { } } + if !matchesTypeConstraints(datasetType) { + return ErrInvalidIndex + } + streamsNode, ok := inputNode.Find("streams") if ok { streamsList, ok := streamsNode.Value().(*transpiler.List) @@ -119,11 +118,8 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { if dsNameNode, found := streamMap.Find("data_stream.dataset"); found { dsKey, ok := dsNameNode.(*transpiler.Key) if ok { - newDataset := dsKey.Value().(transpiler.Node).String() - if !isValid(newDataset) { - return ErrInvalidDataset - } - datasetName = newDataset + datasetName = dsKey.Value().(transpiler.Node).String() + break } } else { datasetNode, found := streamMap.Find("data_stream") @@ -137,11 +133,8 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { if found { dsKey, ok := dsNameNode.(*transpiler.Key) if ok { - newDataset := dsKey.Value().(transpiler.Node).String() - if !isValid(newDataset) { - return ErrInvalidDataset - } - datasetName = newDataset + datasetName = dsKey.Value().(transpiler.Node).String() + break } } } @@ -149,49 +142,65 @@ func StreamChecker(log *logger.Logger, ast *transpiler.AST) error { } } } - - if indexName := fmt.Sprintf("%s-%s-%s", datasetType, datasetName, namespace); !matchesIndexContraints(indexName) { - return ErrInvalidIndex + if !matchesDatasetConstraints(datasetName) { + return ErrInvalidDataset } } return nil } -// The only two requirement are that it has only characters allowed in an Elasticsearch index name -// and does NOT contain a `-`. -func isValid(namespace string) bool { - return matchesIndexContraints(namespace) && !strings.Contains(namespace, "-") -} - // The only two requirement are that it has only characters allowed in an Elasticsearch index name // Index names must meet the following criteria: +// Not longer than 100 bytes // Lowercase only // Cannot include \, /, *, ?, ", <, >, |, ` ` (space character), ,, # +func matchesNamespaceContraints(namespace string) bool { + // length restriction is in bytes, not characters + if len(namespace) <= 0 || len(namespace) > 100 { + return false + } + + return isCharactersetValid(namespace) +} + +// matchesTypeConstraints fails for following rules. As type is first element of resulting index prefix restrictions need to be applied. +// Not longer than 20 bytes +// Lowercase only // Cannot start with -, _, + -// Cannot be . or .. -func matchesIndexContraints(namespace string) bool { - // Cannot be . or .. - if namespace == "." || namespace == ".." { +// Cannot include \, /, *, ?, ", <, >, |, ` ` (space character), ,, # +func matchesTypeConstraints(dsType string) bool { + // length restriction is in bytes, not characters + if len(dsType) <= 0 || len(dsType) > 20 { return false } - if len(namespace) <= 0 || len(namespace) > 255 { + if strings.HasPrefix(dsType, "-") || strings.HasPrefix(dsType, "_") || strings.HasPrefix(dsType, "+") { return false } - // Lowercase only - if strings.ToLower(namespace) != namespace { + return isCharactersetValid(dsType) +} + +// matchesDatasetConstraints fails for following rules +// Not longer than 100 bytes +// Lowercase only +// Cannot include \, /, *, ?, ", <, >, |, ` ` (space character), ,, # +func matchesDatasetConstraints(dataset string) bool { + // length restriction is in bytes, not characters + if len(dataset) <= 0 || len(dataset) > 100 { return false } - // Cannot include \, /, *, ?, ", <, >, |, ` ` (space character), ,, # - if strings.ContainsAny(namespace, "\\/*?\"<>| ,#") { + return isCharactersetValid(dataset) +} + +func isCharactersetValid(input string) bool { + if strings.ToLower(input) != input { return false } - // Cannot start with -, _, + - if strings.HasPrefix(namespace, "-") || strings.HasPrefix(namespace, "_") || strings.HasPrefix(namespace, "+") { + if strings.ContainsAny(input, "\\/*?\"<>| ,#:") { return false } diff --git a/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker_test.go b/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker_test.go index 1daa14a1ad6..5750734c477 100644 --- a/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/filters/stream_checker_test.go @@ -93,25 +93,6 @@ func TestStreamCheck(t *testing.T) { }, result: ErrInvalidDataset, }, - - { - name: "dataset invalid dot - compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{ - {"streams": []map[string]interface{}{{"data_stream.dataset": "."}}}, - }, - }, - result: ErrInvalidDataset, - }, - { - name: "dataset invalid dotdot- compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{ - {"streams": []map[string]interface{}{{"data_stream.dataset": ".."}}}, - }, - }, - result: ErrInvalidDataset, - }, { name: "dataset invalid uppercase - compact", configMap: map[string]interface{}{ @@ -139,16 +120,6 @@ func TestStreamCheck(t *testing.T) { }, result: ErrInvalidDataset, }, - { - name: "dataset invalid invalid prefix- compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{ - {"streams": []map[string]interface{}{{"data_stream.dataset": "_isthisvalid"}}}, - }, - }, - result: ErrInvalidDataset, - }, - { name: "namespace invalid - compact", configMap: map[string]interface{}{ @@ -156,22 +127,6 @@ func TestStreamCheck(t *testing.T) { }, result: ErrInvalidNamespace, }, - { - name: "namespace invalid name 1 - compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{ - {"data_stream.namespace": "."}, - }, - }, - result: ErrInvalidNamespace, - }, - { - name: "namespace invalid name 2 - compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{{"data_stream.namespace": ".."}}, - }, - result: ErrInvalidNamespace, - }, { name: "namespace invalid name uppercase - compact", configMap: map[string]interface{}{ @@ -193,13 +148,6 @@ func TestStreamCheck(t *testing.T) { }, result: ErrInvalidNamespace, }, - { - name: "namespace invalid name invalid prefix - compact", - configMap: map[string]interface{}{ - "inputs": []map[string]interface{}{{"data_stream.namespace": "+isitok"}}, - }, - result: ErrInvalidNamespace, - }, { name: "namespace invalid - long", configMap: map[string]interface{}{ @@ -274,6 +222,33 @@ func TestStreamCheck(t *testing.T) { }, result: nil, }, + { + name: "type invalid prefix _", + configMap: map[string]interface{}{ + "inputs": []map[string]interface{}{ + {"data_stream.type": "_type"}, + }, + }, + result: ErrInvalidIndex, + }, + { + name: "type invalid prefix -", + configMap: map[string]interface{}{ + "inputs": []map[string]interface{}{ + {"data_stream.type": "-type"}, + }, + }, + result: ErrInvalidIndex, + }, + { + name: "type invalid prefix +", + configMap: map[string]interface{}{ + "inputs": []map[string]interface{}{ + {"data_stream.type": "+type"}, + }, + }, + result: ErrInvalidIndex, + }, } log, err := logger.New("") From a119083d71136cc18eed23128a02ad836a22d66b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Fri, 2 Oct 2020 12:33:32 +0200 Subject: [PATCH 105/216] Add implementation of FSWatcher and FSScanner for filestream (#21444) ## What does this PR do? This PR adds the implementation for `FSWatcher` and `FSScanner` for the `filestream` input. The implementation of `FSScanner` is called `fileScanner`. It is responsible for * resolves recursive globs on creation * normalizes glob patterns on creation * finds files which match the configured paths and returns `FileInfo` for those This is the refactored version of the `log` input's scanner, globber functions. The implementation of `FSWatcher` is called `fileWatcher`. It checks the file list returned by `fileScanner` and creates events based on the result. ## Why is it important? It is required for the `filestream` input. ## Related issues Related #20243 --- filebeat/input/filestream/fswatch.go | 375 ++++++++++++++++++ filebeat/input/filestream/fswatch_test.go | 300 ++++++++++++++ .../input/filestream/testdata/excluded_file | 0 .../input/filestream/testdata/included_file | 0 .../testdata/symlink_to_included_file | 1 + 5 files changed, 676 insertions(+) create mode 100644 filebeat/input/filestream/fswatch.go create mode 100644 filebeat/input/filestream/fswatch_test.go create mode 100644 filebeat/input/filestream/testdata/excluded_file create mode 100644 filebeat/input/filestream/testdata/included_file create mode 120000 filebeat/input/filestream/testdata/symlink_to_included_file diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go new file mode 100644 index 00000000000..d4bc1b5ea08 --- /dev/null +++ b/filebeat/input/filestream/fswatch.go @@ -0,0 +1,375 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + "fmt" + "os" + "path/filepath" + "time" + + "github.com/elastic/beats/v7/filebeat/input/file" + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/match" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/go-concert/unison" +) + +const ( + recursiveGlobDepth = 8 + scannerName = "scanner" + watcherDebugKey = "file_watcher" +) + +var ( + watcherFactories = map[string]watcherFactory{ + scannerName: newScannerWatcher, + } +) + +type watcherFactory func(paths []string, cfg *common.Config) (loginp.FSWatcher, error) + +// fileScanner looks for files which match the patterns in paths. +// It is able to exclude files and symlinks. +type fileScanner struct { + paths []string + excludedFiles []match.Matcher + symlinks bool + + log *logp.Logger +} + +type fileWatcherConfig struct { + // Interval is the time between two scans. + Interval time.Duration + // Scanner is the configuration of the scanner. + Scanner fileScannerConfig +} + +// fileWatcher gets the list of files from a FSWatcher and creates events by +// comparing the files between its last two runs. +type fileWatcher struct { + interval time.Duration + prev map[string]os.FileInfo + scanner loginp.FSScanner + log *logp.Logger + events chan loginp.FSEvent +} + +func newFileWatcher(paths []string, ns *common.ConfigNamespace) (loginp.FSWatcher, error) { + if ns == nil { + return newScannerWatcher(paths, nil) + } + + watcherType := ns.Name() + f, ok := watcherFactories[watcherType] + if !ok { + return nil, fmt.Errorf("no such file watcher: %s", watcherType) + } + + return f(paths, ns.Config()) +} + +func newScannerWatcher(paths []string, c *common.Config) (loginp.FSWatcher, error) { + config := defaultFileWatcherConfig() + err := c.Unpack(&config) + if err != nil { + return nil, err + } + scanner, err := newFileScanner(paths, config.Scanner) + if err != nil { + return nil, err + } + return &fileWatcher{ + log: logp.NewLogger(watcherDebugKey), + interval: config.Interval, + prev: make(map[string]os.FileInfo, 0), + scanner: scanner, + events: make(chan loginp.FSEvent), + }, nil +} + +func defaultFileWatcherConfig() fileWatcherConfig { + return fileWatcherConfig{ + Interval: 10 * time.Second, + Scanner: defaultFileScannerConfig(), + } +} + +func (w *fileWatcher) Run(ctx unison.Canceler) { + defer close(w.events) + + ticker := time.NewTicker(w.interval) + defer ticker.Stop() + for { + select { + case <-ctx.Done(): + return + case <-ticker.C: + w.watch(ctx) + } + } +} + +func (w *fileWatcher) watch(ctx unison.Canceler) { + w.log.Info("Start next scan") + + paths := w.scanner.GetFiles() + + newFiles := make(map[string]os.FileInfo) + + for path, info := range paths { + + prevInfo, ok := w.prev[path] + if !ok { + newFiles[path] = paths[path] + continue + } + + if prevInfo.ModTime() != info.ModTime() { + select { + case <-ctx.Done(): + return + case w.events <- writeEvent(path, info): + } + } + + // delete from previous state, as we have more up to date info + delete(w.prev, path) + } + + // remaining files are in the prev map are the ones that are missing + // either because they have been deleted or renamed + for removedPath, removedInfo := range w.prev { + for newPath, newInfo := range newFiles { + if os.SameFile(removedInfo, newInfo) { + select { + case <-ctx.Done(): + return + case w.events <- renamedEvent(removedPath, newPath, newInfo): + delete(newFiles, newPath) + goto CHECK_NEXT_REMOVED + } + } + } + + select { + case <-ctx.Done(): + return + case w.events <- deleteEvent(removedPath, removedInfo): + } + CHECK_NEXT_REMOVED: + } + + // remaining files in newFiles are new + for path, info := range newFiles { + select { + case <-ctx.Done(): + return + case w.events <- createEvent(path, info): + } + + } + + w.log.Debugf("Found %d paths", len(paths)) + w.prev = paths +} + +func createEvent(path string, fi os.FileInfo) loginp.FSEvent { + return loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: path, Info: fi} +} + +func writeEvent(path string, fi os.FileInfo) loginp.FSEvent { + return loginp.FSEvent{Op: loginp.OpWrite, OldPath: path, NewPath: path, Info: fi} +} + +func renamedEvent(oldPath, path string, fi os.FileInfo) loginp.FSEvent { + return loginp.FSEvent{Op: loginp.OpRename, OldPath: oldPath, NewPath: path, Info: fi} +} + +func deleteEvent(path string, fi os.FileInfo) loginp.FSEvent { + return loginp.FSEvent{Op: loginp.OpDelete, OldPath: path, NewPath: "", Info: fi} +} + +func (w *fileWatcher) Event() loginp.FSEvent { + return <-w.events +} + +type fileScannerConfig struct { + Paths []string + ExcludedFiles []match.Matcher + Symlinks bool + RecursiveGlob bool +} + +func defaultFileScannerConfig() fileScannerConfig { + return fileScannerConfig{ + Symlinks: false, + RecursiveGlob: true, + } +} + +func newFileScanner(paths []string, cfg fileScannerConfig) (loginp.FSScanner, error) { + fs := fileScanner{ + paths: paths, + excludedFiles: cfg.ExcludedFiles, + symlinks: cfg.Symlinks, + log: logp.NewLogger(scannerName), + } + err := fs.resolveRecursiveGlobs(cfg) + if err != nil { + return nil, err + } + err = fs.normalizeGlobPatterns() + if err != nil { + return nil, err + } + + return &fs, nil +} + +// resolveRecursiveGlobs expands `**` from the globs in multiple patterns +func (s *fileScanner) resolveRecursiveGlobs(c fileScannerConfig) error { + if !c.RecursiveGlob { + s.log.Debug("recursive glob disabled") + return nil + } + + s.log.Debug("recursive glob enabled") + var paths []string + for _, path := range s.paths { + patterns, err := file.GlobPatterns(path, recursiveGlobDepth) + if err != nil { + return err + } + if len(patterns) > 1 { + s.log.Debugf("%q expanded to %#v", path, patterns) + } + paths = append(paths, patterns...) + } + s.paths = paths + return nil +} + +// normalizeGlobPatterns calls `filepath.Abs` on all the globs from config +func (s *fileScanner) normalizeGlobPatterns() error { + var paths []string + for _, path := range s.paths { + pathAbs, err := filepath.Abs(path) + if err != nil { + return fmt.Errorf("failed to get the absolute path for %s: %v", path, err) + } + paths = append(paths, pathAbs) + } + s.paths = paths + return nil +} + +// GetFiles returns a map of files and fileinfos which +// match the configured paths. +func (s *fileScanner) GetFiles() map[string]os.FileInfo { + pathInfo := map[string]os.FileInfo{} + + for _, path := range s.paths { + matches, err := filepath.Glob(path) + if err != nil { + s.log.Errorf("glob(%s) failed: %v", path, err) + continue + } + + for _, file := range matches { + if s.shouldSkipFile(file) { + continue + } + + // If symlink is enabled, it is checked that original is not part of same input + // If original is harvested by other input, states will potentially overwrite each other + if s.isOriginalAndSymlinkConfigured(file, pathInfo) { + continue + } + + fileInfo, err := os.Stat(file) + if err != nil { + s.log.Debug("stat(%s) failed: %s", file, err) + continue + } + pathInfo[file] = fileInfo + } + } + + return pathInfo +} + +func (s *fileScanner) shouldSkipFile(file string) bool { + if s.isFileExcluded(file) { + s.log.Debugf("Exclude file: %s", file) + return true + } + + fileInfo, err := os.Lstat(file) + if err != nil { + s.log.Debugf("lstat(%s) failed: %s", file, err) + return true + } + + if fileInfo.IsDir() { + s.log.Debugf("Skipping directory: %s", file) + return true + } + + isSymlink := fileInfo.Mode()&os.ModeSymlink > 0 + if isSymlink && !s.symlinks { + s.log.Debugf("File %s skipped as it is a symlink", file) + return true + } + + return false +} + +func (s *fileScanner) isOriginalAndSymlinkConfigured(file string, paths map[string]os.FileInfo) bool { + if s.symlinks { + fileInfo, err := os.Stat(file) + if err != nil { + s.log.Debugf("stat(%s) failed: %s", file, err) + return false + } + + for _, finfo := range paths { + if os.SameFile(finfo, fileInfo) { + s.log.Info("Same file found as symlink and original. Skipping file: %s (as it same as %s)", file, finfo.Name()) + return true + } + } + } + return false +} + +func (s *fileScanner) isFileExcluded(file string) bool { + return len(s.excludedFiles) > 0 && s.matchAny(s.excludedFiles, file) +} + +// matchAny checks if the text matches any of the regular expressions +func (s *fileScanner) matchAny(matchers []match.Matcher, text string) bool { + for _, m := range matchers { + if m.MatchString(text) { + return true + } + } + return false +} diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go new file mode 100644 index 00000000000..5e63987c868 --- /dev/null +++ b/filebeat/input/filestream/fswatch_test.go @@ -0,0 +1,300 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + "context" + "os" + "path/filepath" + "testing" + "time" + + "github.com/stretchr/testify/assert" + + loginp "github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile" + "github.com/elastic/beats/v7/libbeat/common/match" + "github.com/elastic/beats/v7/libbeat/logp" +) + +func TestFileScanner(t *testing.T) { + testCases := map[string]struct { + paths []string + excludedFiles []match.Matcher + symlinks bool + expectedFiles []string + }{ + "select all files": { + paths: []string{ + filepath.Join("testdata", "excluded_file"), + filepath.Join("testdata", "included_file"), + }, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "excluded_file")), + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + "skip excluded files": { + paths: []string{ + filepath.Join("testdata", "excluded_file"), + filepath.Join("testdata", "included_file"), + }, + excludedFiles: []match.Matcher{ + match.MustCompile(filepath.Join("testdata", "excluded_file")), + }, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + // covers test_input.py/test_skip_symlinks + "skip symlinks": { + paths: []string{ + filepath.Join("testdata", "symlink_to_included_file"), + filepath.Join("testdata", "included_file"), + }, + symlinks: false, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + "return a file once if symlinks are enabled": { + paths: []string{ + filepath.Join("testdata", "symlink_to_included_file"), + filepath.Join("testdata", "included_file"), + }, + symlinks: true, + expectedFiles: []string{ + mustAbsPath(filepath.Join("testdata", "included_file")), + }, + }, + "skip directories": { + paths: []string{ + filepath.Join("testdata", "unharvestable_dir"), + }, + expectedFiles: []string{}, + }, + } + + for name, test := range testCases { + test := test + + t.Run(name, func(t *testing.T) { + cfg := fileScannerConfig{ + ExcludedFiles: test.excludedFiles, + Symlinks: test.symlinks, + RecursiveGlob: false, + } + fs, err := newFileScanner(test.paths, cfg) + if err != nil { + t.Fatal(err) + } + files := fs.GetFiles() + paths := make([]string, 0) + for p, _ := range files { + paths = append(paths, p) + } + assert.Equal(t, test.expectedFiles, paths) + }) + } +} + +func TestFileWatchNewDeleteModified(t *testing.T) { + oldTs := time.Now() + newTs := oldTs.Add(5 * time.Second) + testCases := map[string]struct { + prevFiles map[string]os.FileInfo + nextFiles map[string]os.FileInfo + expectedEvents []loginp.FSEvent + }{ + "one new file": { + prevFiles: map[string]os.FileInfo{}, + nextFiles: map[string]os.FileInfo{ + "new_path": testFileInfo{"new_path", 5, oldTs}, + }, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: "new_path", Info: testFileInfo{"new_path", 5, oldTs}}, + }, + }, + "one deleted file": { + prevFiles: map[string]os.FileInfo{ + "old_path": testFileInfo{"old_path", 5, oldTs}, + }, + nextFiles: map[string]os.FileInfo{}, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpDelete, OldPath: "old_path", NewPath: "", Info: testFileInfo{"old_path", 5, oldTs}}, + }, + }, + "one modified file": { + prevFiles: map[string]os.FileInfo{ + "path": testFileInfo{"path", 5, oldTs}, + }, + nextFiles: map[string]os.FileInfo{ + "path": testFileInfo{"path", 10, newTs}, + }, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpWrite, OldPath: "path", NewPath: "path", Info: testFileInfo{"path", 10, newTs}}, + }, + }, + "two modified files": { + prevFiles: map[string]os.FileInfo{ + "path1": testFileInfo{"path1", 5, oldTs}, + "path2": testFileInfo{"path2", 5, oldTs}, + }, + nextFiles: map[string]os.FileInfo{ + "path1": testFileInfo{"path1", 10, newTs}, + "path2": testFileInfo{"path2", 10, newTs}, + }, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpWrite, OldPath: "path1", NewPath: "path1", Info: testFileInfo{"path1", 10, newTs}}, + loginp.FSEvent{Op: loginp.OpWrite, OldPath: "path2", NewPath: "path2", Info: testFileInfo{"path2", 10, newTs}}, + }, + }, + "one modified file, one new file": { + prevFiles: map[string]os.FileInfo{ + "path1": testFileInfo{"path1", 5, oldTs}, + }, + nextFiles: map[string]os.FileInfo{ + "path1": testFileInfo{"path1", 10, newTs}, + "path2": testFileInfo{"path2", 10, newTs}, + }, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpWrite, OldPath: "path1", NewPath: "path1", Info: testFileInfo{"path1", 10, newTs}}, + loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: "path2", Info: testFileInfo{"path2", 10, newTs}}, + }, + }, + "one new file, one deleted file": { + prevFiles: map[string]os.FileInfo{ + "path_deleted": testFileInfo{"path_deleted", 5, oldTs}, + }, + nextFiles: map[string]os.FileInfo{ + "path_new": testFileInfo{"path_new", 10, newTs}, + }, + expectedEvents: []loginp.FSEvent{ + loginp.FSEvent{Op: loginp.OpDelete, OldPath: "path_deleted", NewPath: "", Info: testFileInfo{"path_deleted", 5, oldTs}}, + loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: "path_new", Info: testFileInfo{"path_new", 10, newTs}}, + }, + }, + } + + for name, test := range testCases { + test := test + + t.Run(name, func(t *testing.T) { + w := fileWatcher{ + log: logp.L(), + prev: test.prevFiles, + scanner: &mockScanner{test.nextFiles}, + events: make(chan loginp.FSEvent), + } + + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + go w.watch(ctx) + + for _, expectedEvent := range test.expectedEvents { + evt := w.Event() + assert.Equal(t, expectedEvent, evt) + } + }) + } +} + +func TestFileWatcherRenamedFile(t *testing.T) { + testPath := mustAbsPath(filepath.Join("testdata", "first_name")) + renamedPath := mustAbsPath(filepath.Join("testdata", "renamed")) + + f, err := os.Create(testPath) + if err != nil { + t.Fatal(err) + } + f.Close() + fi, err := os.Stat(testPath) + if err != nil { + t.Fatal(err) + } + + cfg := fileScannerConfig{ + ExcludedFiles: nil, + Symlinks: false, + RecursiveGlob: false, + } + scanner, err := newFileScanner([]string{testPath, renamedPath}, cfg) + if err != nil { + t.Fatal(err) + } + w := fileWatcher{ + log: logp.L(), + scanner: scanner, + events: make(chan loginp.FSEvent), + } + + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + go w.watch(ctx) + assert.Equal(t, loginp.FSEvent{Op: loginp.OpCreate, OldPath: "", NewPath: testPath, Info: fi}, w.Event()) + + err = os.Rename(testPath, renamedPath) + if err != nil { + t.Fatal(err) + } + defer os.Remove(renamedPath) + fi, err = os.Stat(renamedPath) + if err != nil { + t.Fatal(err) + } + + go w.watch(ctx) + assert.Equal(t, loginp.FSEvent{Op: loginp.OpRename, OldPath: testPath, NewPath: renamedPath, Info: fi}, w.Event()) +} + +type mockScanner struct { + files map[string]os.FileInfo +} + +func (m *mockScanner) GetFiles() map[string]os.FileInfo { + return m.files +} + +type testFileInfo struct { + path string + size int64 + time time.Time +} + +func (t testFileInfo) Name() string { return t.path } +func (t testFileInfo) Size() int64 { return t.size } +func (t testFileInfo) Mode() os.FileMode { return 0 } +func (t testFileInfo) ModTime() time.Time { return t.time } +func (t testFileInfo) IsDir() bool { return false } +func (t testFileInfo) Sys() interface{} { return nil } + +func mustAbsPath(path string) string { + p, err := filepath.Abs(path) + if err != nil { + panic(err) + } + return p +} + +func mustDuration(durStr string) time.Duration { + dur, err := time.ParseDuration(durStr) + if err != nil { + panic(err) + } + return dur +} diff --git a/filebeat/input/filestream/testdata/excluded_file b/filebeat/input/filestream/testdata/excluded_file new file mode 100644 index 00000000000..e69de29bb2d diff --git a/filebeat/input/filestream/testdata/included_file b/filebeat/input/filestream/testdata/included_file new file mode 100644 index 00000000000..e69de29bb2d diff --git a/filebeat/input/filestream/testdata/symlink_to_included_file b/filebeat/input/filestream/testdata/symlink_to_included_file new file mode 120000 index 00000000000..40824f3f7d3 --- /dev/null +++ b/filebeat/input/filestream/testdata/symlink_to_included_file @@ -0,0 +1 @@ +filebeat/input/filestream/testdata/included_file \ No newline at end of file From b8fd5fc333d3bffc83a6590f15d7109ac83acdc8 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Fri, 2 Oct 2020 13:03:56 +0200 Subject: [PATCH 106/216] Remove duplicated sources url in dependencies report (#21462) It was added by mistake as part of the license URL. --- dev-tools/dependencies-report | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev-tools/dependencies-report b/dev-tools/dependencies-report index a2662a4ab9a..928de5367ca 100755 --- a/dev-tools/dependencies-report +++ b/dev-tools/dependencies-report @@ -48,7 +48,7 @@ go list -m -json all $@ | go run go.elastic.co/go-licence-detector \ # name,url,version,revision,license ubi8url='https://catalog.redhat.com/software/containers/ubi8/ubi-minimal/5c359a62bed8bd75a2c3fba8' ubi8source='https://oss-dependencies.elastic.co/redhat/ubi/ubi-minimal-8-source.tar.gz' -ubilicense='Custom;https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf,https://oss-dependencies.elastic.co/redhat/ubi/ubi-minimal-8-source.tar.gz' +ubilicense='Custom;https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf' cat <> $outfile Red Hat Universal Base Image,$ubi8url,8,,$ubilicense,$ubi8source EOF From 79ddbbfb642eda785f5ef76206e65c5a1690f0e9 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Fri, 2 Oct 2020 12:12:52 +0100 Subject: [PATCH 107/216] [CI] Send slack message with build status (#21428) --- Jenkinsfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Jenkinsfile b/Jenkinsfile index 119cea9b3ab..317a5c781e3 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -24,6 +24,7 @@ pipeline { PIPELINE_LOG_LEVEL = 'INFO' PYTEST_ADDOPTS = "${params.PYTEST_ADDOPTS}" RUNBLD_DISABLE_NOTIFICATIONS = 'true' + SLACK_CHANNEL = "#beats-ci-builds" TERRAFORM_VERSION = "0.12.24" XPACK_MODULE_PATTERN = '^x-pack\\/[a-z0-9]+beat\\/module\\/([^\\/]+)\\/.*' } @@ -121,7 +122,7 @@ pipeline { runbld(stashedTestReports: stashedTestReports, project: env.REPO) } cleanup { - notifyBuildResult(prComment: true) + notifyBuildResult(prComment: true, slackComment: true) } } } From 19453734455cc831422d236cdadc67e71ed5caba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Fri, 2 Oct 2020 13:13:31 +0200 Subject: [PATCH 108/216] Add new log file reader for filestream input (#21450) ## What does this PR do? This PR adds the new refactored version of the previous `Log` reader of the `log` input called `logFile`. The differences between the two readers are the following: * `logFile` calls `Stat` only once to avoid too many system calls (`Log` calls `Stat` 3 times after every read) * `logFile` starts separate go routines to check if `close.after_interval` or `close.inactive` has elapsed. `Log` checks `close_inactive` after every `Read`. Thus, if the output is blocked, it cannot stop the reader. * `logFile` does not check if the file has been removed or renamed if `close_removed` or `close_renamed` are enabled. Instead it is checked separately in the prospector, so if the output blocks, the reader can be closed. This prevents Filebeat keeping too many open files if the output is blocked. (The code mentioned is not yet included in any PR.) ## Why is it important? This is the improved version of the previous `log` reader. --- filebeat/input/filestream/config.go | 147 ++++++++++++++++ filebeat/input/filestream/filestream.go | 225 ++++++++++++++++++++++++ 2 files changed, 372 insertions(+) create mode 100644 filebeat/input/filestream/config.go create mode 100644 filebeat/input/filestream/filestream.go diff --git a/filebeat/input/filestream/config.go b/filebeat/input/filestream/config.go new file mode 100644 index 00000000000..93b23232594 --- /dev/null +++ b/filebeat/input/filestream/config.go @@ -0,0 +1,147 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + "fmt" + "time" + + "github.com/dustin/go-humanize" + + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/common/match" + "github.com/elastic/beats/v7/libbeat/reader/readfile" +) + +// Config stores the options of a file stream. +type config struct { + Paths []string `config:"paths"` + Close closerConfig `config:"close"` + FileWatcher *common.ConfigNamespace `config:"file_watcher"` + Reader readerConfig `config:"readers"` + FileIdentity *common.ConfigNamespace `config:"file_identity"` + CleanInactive time.Duration `config:"clean_inactive" validate:"min=0"` + CleanRemoved bool `config:"clean_removed"` + HarvesterLimit uint32 `config:"harvester_limit" validate:"min=0"` + IgnoreOlder time.Duration `config:"ignore_older"` +} + +type closerConfig struct { + OnStateChange stateChangeCloserConfig `config:"on_state_change"` + Reader readerCloserConfig `config:"reader"` +} + +type readerCloserConfig struct { + AfterInterval time.Duration + Inactive time.Duration + OnEOF bool +} + +type stateChangeCloserConfig struct { + CheckInterval time.Duration + Removed bool + Renamed bool +} + +// TODO should this be inline? +type readerConfig struct { + Backoff backoffConfig `config:"backoff"` + BufferSize int `config:"buffer_size"` + Encoding string `config:"encoding"` + ExcludeLines []match.Matcher `config:"exclude_lines"` + IncludeLines []match.Matcher `config:"include_lines"` + LineTerminator readfile.LineTerminator `config:"line_terminator"` + MaxBytes int `config:"message_max_bytes" validate:"min=0,nonzero"` + Tail bool `config:"seek_to_tail"` + + Parsers []*common.ConfigNamespace `config:"parsers"` // TODO multiline, json, syslog? +} + +type backoffConfig struct { + Init time.Duration `config:"init" validate:"nonzero"` + Max time.Duration `config:"max" validate:"nonzero"` +} + +func defaultConfig() config { + return config{ + Paths: []string{}, + Close: defaultCloserConfig(), + Reader: defaultReaderConfig(), + CleanInactive: 0, + CleanRemoved: true, + HarvesterLimit: 0, + IgnoreOlder: 0, + } +} + +func defaultCloserConfig() closerConfig { + return closerConfig{ + OnStateChange: stateChangeCloserConfig{ + CheckInterval: 5 * time.Second, + Removed: true, // TODO check clean_removed option + Renamed: false, + }, + Reader: readerCloserConfig{ + OnEOF: false, + Inactive: 0 * time.Second, + AfterInterval: 0 * time.Second, + }, + } +} + +func defaultReaderConfig() readerConfig { + return readerConfig{ + Backoff: backoffConfig{ + Init: 1 * time.Second, + Max: 10 * time.Second, + }, + BufferSize: 16 * humanize.KiByte, + LineTerminator: readfile.AutoLineTerminator, + MaxBytes: 10 * humanize.MiByte, + Tail: false, + Parsers: nil, + } +} + +func (c *config) Validate() error { + if len(c.Paths) == 0 { + return fmt.Errorf("no path is configured") + } + // TODO + //if c.CleanInactive != 0 && c.IgnoreOlder == 0 { + // return fmt.Errorf("ignore_older must be enabled when clean_inactive is used") + //} + + // TODO + //if c.CleanInactive != 0 && c.CleanInactive <= c.IgnoreOlder+c.ScanFrequency { + // return fmt.Errorf("clean_inactive must be > ignore_older + scan_frequency to make sure only files which are not monitored anymore are removed") + //} + + // TODO + //if c.JSON != nil && len(c.JSON.MessageKey) == 0 && + // c.Multiline != nil { + // return fmt.Errorf("When using the JSON decoder and multiline together, you need to specify a message_key value") + //} + + //if c.JSON != nil && len(c.JSON.MessageKey) == 0 && + // (len(c.IncludeLines) > 0 || len(c.ExcludeLines) > 0) { + // return fmt.Errorf("When using the JSON decoder and line filtering together, you need to specify a message_key value") + //} + + return nil +} diff --git a/filebeat/input/filestream/filestream.go b/filebeat/input/filestream/filestream.go new file mode 100644 index 00000000000..59f26ccca1b --- /dev/null +++ b/filebeat/input/filestream/filestream.go @@ -0,0 +1,225 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package filestream + +import ( + "context" + "errors" + "io" + "os" + "time" + + input "github.com/elastic/beats/v7/filebeat/input/v2" + "github.com/elastic/beats/v7/libbeat/common/backoff" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/go-concert/ctxtool" + "github.com/elastic/go-concert/unison" +) + +var ( + ErrFileTruncate = errors.New("detected file being truncated") + ErrClosed = errors.New("reader closed") +) + +// logFile contains all log related data +type logFile struct { + file *os.File + log *logp.Logger + ctx context.Context + cancelReading context.CancelFunc + + closeInactive time.Duration + closeAfterInterval time.Duration + closeOnEOF bool + + offset int64 + lastTimeRead time.Time + backoff backoff.Backoff + tg unison.TaskGroup +} + +// newFileReader creates a new log instance to read log sources +func newFileReader( + log *logp.Logger, + canceler input.Canceler, + f *os.File, + config readerConfig, + closerConfig readerCloserConfig, +) (*logFile, error) { + offset, err := f.Seek(0, os.SEEK_CUR) + if err != nil { + return nil, err + } + + l := &logFile{ + file: f, + log: log, + closeInactive: closerConfig.Inactive, + closeAfterInterval: closerConfig.AfterInterval, + closeOnEOF: closerConfig.OnEOF, + offset: offset, + lastTimeRead: time.Now(), + backoff: backoff.NewExpBackoff(canceler.Done(), config.Backoff.Init, config.Backoff.Max), + tg: unison.TaskGroup{}, + } + + l.ctx, l.cancelReading = ctxtool.WithFunc(ctxtool.FromCanceller(canceler), func() { + err := l.tg.Stop() + if err != nil { + l.log.Errorf("Error while stopping filestream logFile reader: %v", err) + } + }) + + l.startFileMonitoringIfNeeded() + + return l, nil +} + +// Read reads from the reader and updates the offset +// The total number of bytes read is returned. +func (f *logFile) Read(buf []byte) (int, error) { + totalN := 0 + + for f.ctx.Err() == nil { + n, err := f.file.Read(buf) + if n > 0 { + f.offset += int64(n) + f.lastTimeRead = time.Now() + } + totalN += n + + // Read from source completed without error + // Either end reached or buffer full + if err == nil { + // reset backoff for next read + f.backoff.Reset() + return totalN, nil + } + + // Move buffer forward for next read + buf = buf[n:] + + // Checks if an error happened or buffer is full + // If buffer is full, cannot continue reading. + // Can happen if n == bufferSize + io.EOF error + err = f.errorChecks(err) + if err != nil || len(buf) == 0 { + return totalN, err + } + + f.log.Debugf("End of file reached: %s; Backoff now.", f.file.Name()) + f.backoff.Wait() + } + + return 0, ErrClosed +} + +func (f *logFile) startFileMonitoringIfNeeded() { + if f.closeInactive == 0 && f.closeAfterInterval == 0 { + return + } + + if f.closeInactive > 0 { + f.tg.Go(func(ctx unison.Canceler) error { + f.closeIfTimeout(ctx) + return nil + }) + } + + if f.closeAfterInterval > 0 { + f.tg.Go(func(ctx unison.Canceler) error { + f.closeIfInactive(ctx) + return nil + }) + } +} + +func (f *logFile) closeIfTimeout(ctx unison.Canceler) { + timer := time.NewTimer(f.closeAfterInterval) + defer timer.Stop() + + for { + select { + case <-ctx.Done(): + return + case <-timer.C: + f.cancelReading() + return + } + } +} + +func (f *logFile) closeIfInactive(ctx unison.Canceler) { + // This can be made configureble if users need a more flexible + // cheking for inactive files. + ticker := time.NewTicker(5 * time.Minute) + defer ticker.Stop() + + for { + select { + case <-ctx.Done(): + return + case <-ticker.C: + age := time.Since(f.lastTimeRead) + if age > f.closeInactive { + f.cancelReading() + return + } + } + } +} + +// errorChecks determines the cause for EOF errors, and how the EOF event should be handled +// based on the config options. +func (f *logFile) errorChecks(err error) error { + if err != io.EOF { + f.log.Error("Unexpected state reading from %s; error: %s", f.file.Name(), err) + return err + } + + return f.handleEOF() +} + +func (f *logFile) handleEOF() error { + if f.closeOnEOF { + return io.EOF + } + + // Refetch fileinfo to check if the file was truncated. + // Errors if the file was removed/rotated after reading and before + // calling the stat function + info, statErr := f.file.Stat() + if statErr != nil { + f.log.Error("Unexpected error reading from %s; error: %s", f.file.Name(), statErr) + return statErr + } + + // check if file was truncated + if info.Size() < f.offset { + f.log.Debugf("File was truncated as offset (%d) > size (%d): %s", f.offset, info.Size(), f.file.Name()) + return ErrFileTruncate + } + + return nil +} + +// Close +func (f *logFile) Close() error { + f.cancelReading() + return f.file.Close() +} From 01dfa5e16eaccb2d650b89ddc5e724884f3e6c7f Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Fri, 2 Oct 2020 14:15:28 +0100 Subject: [PATCH 109/216] [CI] changeset from #20603 was not added to CI2.0 (#21464) --- Jenkinsfile.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Jenkinsfile.yml b/Jenkinsfile.yml index 2f720bf055b..2278ea93735 100644 --- a/Jenkinsfile.yml +++ b/Jenkinsfile.yml @@ -28,11 +28,13 @@ changeset: - "^\\.ci/scripts/.*" oss: - "^go.mod" + - "^pytest.ini" - "^dev-tools/.*" - "^libbeat/.*" - "^testing/.*" xpack: - "^go.mod" + - "^pytest.ini" - "^dev-tools/.*" - "^libbeat/.*" - "^testing/.*" From 35a76dfe2c3caa19969fde4484792355077b58e2 Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Fri, 2 Oct 2020 14:16:06 +0100 Subject: [PATCH 110/216] [CI] Change x-pack/auditbeat build events (comments, labels) (#21463) --- x-pack/auditbeat/Jenkinsfile.yml | 8 ++++---- x-pack/packetbeat/Jenkinsfile.yml | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/x-pack/auditbeat/Jenkinsfile.yml b/x-pack/auditbeat/Jenkinsfile.yml index fd73c10a1c5..3bb96fbbc64 100644 --- a/x-pack/auditbeat/Jenkinsfile.yml +++ b/x-pack/auditbeat/Jenkinsfile.yml @@ -5,11 +5,11 @@ when: - "@ci" ## special token regarding the changeset for the ci - "@xpack" ## special token regarding the changeset for the xpack comments: ## when PR comment contains any of those entries - - "/test auditbeat" + - "/test x-pack/auditbeat" labels: ## when PR labels matches any of those entries - - "auditbeat" + - "x-pack-auditbeat" parameters: ## when parameter was selected in the UI. - - "auditbeat" + - "x-pack-auditbeat" tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: @@ -22,7 +22,7 @@ stages: - "macosx" when: ## Override the top-level when. comments: - - "/test auditbeat for macos" + - "/test x-pack/auditbeat for macos" labels: - "macOS" parameters: diff --git a/x-pack/packetbeat/Jenkinsfile.yml b/x-pack/packetbeat/Jenkinsfile.yml index 8496265e0ac..41257081e1f 100644 --- a/x-pack/packetbeat/Jenkinsfile.yml +++ b/x-pack/packetbeat/Jenkinsfile.yml @@ -1,15 +1,15 @@ when: branches: true ## for all the branches changeset: ## when PR contains any of those entries in the changeset - - "^x-pack/winlogbeat/.*" + - "^x-pack/packetbeat/.*" - "@ci" ## special token regarding the changeset for the ci - "@xpack" ## special token regarding the changeset for the xpack comments: ## when PR comment contains any of those entries - - "/test x-pack/winlogbeat" + - "/test x-pack/packetbeat" labels: ## when PR labels matches any of those entries - - "x-pack-winlogbeat" + - "x-pack-packetbeat" parameters: ## when parameter was selected in the UI. - - "x-pack-winlogbeat" + - "x-pack-packetbeat" tags: true ## for all the tags platform: "linux && ubuntu-18" ## default label for all the stages stages: From 39e144dd05fab2310e1c5f3a63c9cfe68e6bf2cf Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Fri, 2 Oct 2020 19:20:53 +0200 Subject: [PATCH 111/216] Fix format of debug messages in tlscommon (#21482) --- libbeat/common/transport/tlscommon/tls.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libbeat/common/transport/tlscommon/tls.go b/libbeat/common/transport/tlscommon/tls.go index 3616a9f07e4..ba44310727c 100644 --- a/libbeat/common/transport/tlscommon/tls.go +++ b/libbeat/common/transport/tlscommon/tls.go @@ -66,7 +66,7 @@ func LoadCertificate(config *CertificateConfig) (*tls.Certificate, error) { return nil, err } - log.Debugf("tls", "loading certificate: %v and key %v", certificate, key) + log.Debugf("Loading certificate: %v and key %v", certificate, key) return &cert, nil } @@ -169,7 +169,7 @@ func LoadCertificateAuthorities(CAs []string) (*x509.CertPool, []error) { errors = append(errors, fmt.Errorf("%v adding %v to the list of known CAs", ErrNotACertificate, r)) continue } - log.Debugf("tls", "successfully loaded CA certificate: %v", r) + log.Debugf("Successfully loaded CA certificate: %v", r) } return roots, errors From bcb8da063f4dfe68c6ce413a7e7494a7a429ab8e Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Fri, 2 Oct 2020 18:29:22 +0100 Subject: [PATCH 112/216] Revert "Revert "[JJBB] Set shallow cloning to 10 (#21409)" (#21447)" (#21467) This reverts commit 514809a13cd078be71c0bccac03dccc0cc81f0e9. --- .ci/jobs/apm-beats-update.yml | 2 +- .ci/jobs/beats-tester.yml | 2 +- .ci/jobs/beats-windows-mbp.yml | 2 +- .ci/jobs/beats.yml | 2 +- .ci/jobs/golang-crossbuild-mbp.yml | 2 +- .ci/jobs/packaging.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.ci/jobs/apm-beats-update.yml b/.ci/jobs/apm-beats-update.yml index 8bdc322f65a..2ae688ffab7 100644 --- a/.ci/jobs/apm-beats-update.yml +++ b/.ci/jobs/apm-beats-update.yml @@ -48,7 +48,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-tester.yml b/.ci/jobs/beats-tester.yml index 522abfa5e5c..808123a225e 100644 --- a/.ci/jobs/beats-tester.yml +++ b/.ci/jobs/beats-tester.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats-windows-mbp.yml b/.ci/jobs/beats-windows-mbp.yml index 64efa009979..7ea26c9ba18 100644 --- a/.ci/jobs/beats-windows-mbp.yml +++ b/.ci/jobs/beats-windows-mbp.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 4 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/beats.yml b/.ci/jobs/beats.yml index b075d8bbdf2..6f59a9bcdf8 100644 --- a/.ci/jobs/beats.yml +++ b/.ci/jobs/beats.yml @@ -46,7 +46,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/golang-crossbuild-mbp.yml b/.ci/jobs/golang-crossbuild-mbp.yml index 46303790610..45175d169f6 100644 --- a/.ci/jobs/golang-crossbuild-mbp.yml +++ b/.ci/jobs/golang-crossbuild-mbp.yml @@ -31,7 +31,7 @@ before: true prune: true shallow-clone: true - depth: 4 + depth: 10 do-not-fetch-tags: true submodule: disable: false diff --git a/.ci/jobs/packaging.yml b/.ci/jobs/packaging.yml index 0dce4d4672b..fd6fb9f90c6 100644 --- a/.ci/jobs/packaging.yml +++ b/.ci/jobs/packaging.yml @@ -44,7 +44,7 @@ before: true prune: true shallow-clone: true - depth: 3 + depth: 10 do-not-fetch-tags: true submodule: disable: false From b0236ee8afacb87e47a98ab075b2b189e5911ff1 Mon Sep 17 00:00:00 2001 From: Fae Charlton Date: Fri, 2 Oct 2020 16:30:06 -0400 Subject: [PATCH 113/216] [libbeat] Add configurable exponential backoff for disk queue write errors (#21493) --- libbeat/publisher/queue/diskqueue/config.go | 52 +++++++++++++++++-- .../publisher/queue/diskqueue/deleter_loop.go | 9 +++- libbeat/publisher/queue/diskqueue/segments.go | 9 +++- libbeat/publisher/queue/diskqueue/util.go | 22 ++++++-- .../publisher/queue/diskqueue/writer_loop.go | 28 ++++++++-- 5 files changed, 104 insertions(+), 16 deletions(-) diff --git a/libbeat/publisher/queue/diskqueue/config.go b/libbeat/publisher/queue/diskqueue/config.go index 6a165a665db..b8ef456d03d 100644 --- a/libbeat/publisher/queue/diskqueue/config.go +++ b/libbeat/publisher/queue/diskqueue/config.go @@ -21,6 +21,7 @@ import ( "errors" "fmt" "path/filepath" + "time" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/cfgtype" @@ -61,16 +62,26 @@ type Settings struct { // A listener that should be sent ACKs when an event is successfully // written to disk. WriteToDiskListener queue.ACKListener + + // RetryInterval specifies how long to wait before retrying a fatal error + // writing to disk. If MaxRetryInterval is nonzero, subsequent retries will + // use exponential backoff up to the specified limit. + RetryInterval time.Duration + MaxRetryInterval time.Duration } // userConfig holds the parameters for a disk queue that are configurable // by the end user in the beats yml file. type userConfig struct { - Path string `config:"path"` - MaxSize cfgtype.ByteSize `config:"max_size" validate:"required"` - SegmentSize *cfgtype.ByteSize `config:"segment_size"` - ReadAheadLimit *int `config:"read_ahead"` - WriteAheadLimit *int `config:"write_ahead"` + Path string `config:"path"` + MaxSize cfgtype.ByteSize `config:"max_size" validate:"required"` + SegmentSize *cfgtype.ByteSize `config:"segment_size"` + + ReadAheadLimit *int `config:"read_ahead"` + WriteAheadLimit *int `config:"write_ahead"` + + RetryInterval *time.Duration `config:"retry_interval" validate:"positive"` + MaxRetryInterval *time.Duration `config:"max_retry_interval" validate:"positive"` } func (c *userConfig) Validate() error { @@ -96,6 +107,13 @@ func (c *userConfig) Validate() error { "Disk queue segment_size (%d) cannot be less than 1MB", *c.SegmentSize) } + if c.RetryInterval != nil && c.MaxRetryInterval != nil && + *c.MaxRetryInterval < *c.RetryInterval { + return fmt.Errorf( + "Disk queue max_retry_interval (%v) can't be less than retry_interval (%v)", + *c.MaxRetryInterval, *c.RetryInterval) + } + return nil } @@ -108,6 +126,9 @@ func DefaultSettings() Settings { ReadAheadLimit: 512, WriteAheadLimit: 2048, + + RetryInterval: 1 * time.Second, + MaxRetryInterval: 30 * time.Second, } } @@ -137,6 +158,13 @@ func SettingsForUserConfig(config *common.Config) (Settings, error) { settings.WriteAheadLimit = *userConfig.WriteAheadLimit } + if userConfig.RetryInterval != nil { + settings.RetryInterval = *userConfig.RetryInterval + } + if userConfig.MaxRetryInterval != nil { + settings.MaxRetryInterval = *userConfig.RetryInterval + } + return settings, nil } @@ -164,3 +192,17 @@ func (settings Settings) segmentPath(segmentID segmentID) string { func (settings Settings) maxSegmentOffset() segmentOffset { return segmentOffset(settings.MaxSegmentSize - segmentHeaderSize) } + +// Given a retry interval, nextRetryInterval returns the next higher level +// of backoff. +func (settings Settings) nextRetryInterval( + currentInterval time.Duration, +) time.Duration { + if settings.MaxRetryInterval > 0 { + currentInterval *= 2 + if currentInterval > settings.MaxRetryInterval { + currentInterval = settings.MaxRetryInterval + } + } + return currentInterval +} diff --git a/libbeat/publisher/queue/diskqueue/deleter_loop.go b/libbeat/publisher/queue/diskqueue/deleter_loop.go index 4e685285948..3948d200cbc 100644 --- a/libbeat/publisher/queue/diskqueue/deleter_loop.go +++ b/libbeat/publisher/queue/diskqueue/deleter_loop.go @@ -57,6 +57,7 @@ func newDeleterLoop(settings Settings) *deleterLoop { } func (dl *deleterLoop) run() { + currentRetryInterval := dl.settings.RetryInterval for { request, ok := <-dl.requestChan if !ok { @@ -87,10 +88,14 @@ func (dl *deleterLoop) run() { // The delay can be interrupted if the request channel is closed, // indicating queue shutdown. select { - // TODO: make the retry interval configurable. - case <-time.After(time.Second): + case <-time.After(currentRetryInterval): case <-dl.requestChan: } + currentRetryInterval = + dl.settings.nextRetryInterval(currentRetryInterval) + } else { + // If we made progress, reset the retry interval. + currentRetryInterval = dl.settings.RetryInterval } dl.responseChan <- deleterLoopResponse{ results: results, diff --git a/libbeat/publisher/queue/diskqueue/segments.go b/libbeat/publisher/queue/diskqueue/segments.go index 5ce0dc49962..617b089110e 100644 --- a/libbeat/publisher/queue/diskqueue/segments.go +++ b/libbeat/publisher/queue/diskqueue/segments.go @@ -207,10 +207,15 @@ func (segment *queueSegment) getWriter( // retry callback returns true. This is used for timed retries when // creating a queue segment from the writer loop. func (segment *queueSegment) getWriterWithRetry( - queueSettings Settings, retry func(error) bool, + queueSettings Settings, retry func(err error, firstTime bool) bool, ) (*os.File, error) { + firstTime := true file, err := segment.getWriter(queueSettings) - for err != nil && retry(err) { + for err != nil && retry(err, firstTime) { + // Set firstTime to false so the retry callback can perform backoff + // etc if needed. + firstTime = false + // Try again file, err = segment.getWriter(queueSettings) } diff --git a/libbeat/publisher/queue/diskqueue/util.go b/libbeat/publisher/queue/diskqueue/util.go index 60c529a9992..c54a26154e8 100644 --- a/libbeat/publisher/queue/diskqueue/util.go +++ b/libbeat/publisher/queue/diskqueue/util.go @@ -69,16 +69,32 @@ func writeErrorIsRetriable(err error) bool { // "wrapped" field in-place as long as it isn't captured by the callback. type callbackRetryWriter struct { wrapped io.Writer - retry func(error) bool + + // The retry callback is called with the error that was produced and whether + // this is the first (subsequent) error arising from this particular + // write call. + retry func(err error, firstTime bool) bool } func (w callbackRetryWriter) Write(p []byte) (int, error) { + // firstTime tracks whether the current error is the first subsequent error + // being passed to the retry callback. This is so that the callback can + // reset its internal counters in case it is using exponential backoff or + // a retry limit. + firstTime := true bytesWritten := 0 writer := w.wrapped n, err := writer.Write(p) for n < len(p) { - if err != nil && !w.retry(err) { - return bytesWritten + n, err + if err != nil { + shouldRetry := w.retry(err, firstTime) + firstTime = false + if !shouldRetry { + return bytesWritten + n, err + } + } else { + // If we made progress without an error, reset firstTime. + firstTime = true } // Advance p and try again. bytesWritten += n diff --git a/libbeat/publisher/queue/diskqueue/writer_loop.go b/libbeat/publisher/queue/diskqueue/writer_loop.go index b42e4573cab..ff1ff97616a 100644 --- a/libbeat/publisher/queue/diskqueue/writer_loop.go +++ b/libbeat/publisher/queue/diskqueue/writer_loop.go @@ -82,6 +82,8 @@ type writerLoop struct { // The file handle corresponding to currentSegment. When currentSegment // changes, this handle is closed and a new one is created. outputFile *os.File + + currentRetryInterval time.Duration } func newWriterLoop(logger *logp.Logger, settings Settings) *writerLoop { @@ -91,6 +93,8 @@ func newWriterLoop(logger *logp.Logger, settings Settings) *writerLoop { requestChan: make(chan writerLoopRequest, 1), responseChan: make(chan writerLoopResponse), + + currentRetryInterval: settings.RetryInterval, } } @@ -215,14 +219,31 @@ outerLoop: return append(bytesWritten, curBytesWritten) } -// retryCallback is called (by way of retryCallbackWriter) when there is +func (wl *writerLoop) applyRetryBackoff() { + wl.currentRetryInterval = + wl.settings.nextRetryInterval(wl.currentRetryInterval) +} + +func (wl *writerLoop) resetRetryBackoff() { + wl.currentRetryInterval = wl.settings.RetryInterval +} + +// retryCallback is called (by way of callbackRetryWriter) when there is // an error writing to a segment file. It pauses for a configurable // interval and returns true if the operation should be retried (which // it always should, unless the queue is being closed). -func (wl *writerLoop) retryCallback(err error) bool { +func (wl *writerLoop) retryCallback(err error, firstTime bool) bool { + if firstTime { + // Reset any exponential backoff in the retry interval. + wl.resetRetryBackoff() + } if writeErrorIsRetriable(err) { return true } + // If this error isn't immediately retriable, increase the exponential + // backoff afterwards. + defer wl.applyRetryBackoff() + // If the error is not immediately retriable, log the error // and wait for the retry interval before trying again, but // abort if the queue is closed (indicated by the request channel @@ -230,8 +251,7 @@ func (wl *writerLoop) retryCallback(err error) bool { wl.logger.Errorf("Writing to segment %v: %v", wl.currentSegment.id, err) select { - case <-time.After(time.Second): - // TODO: use a configurable interval here + case <-time.After(wl.currentRetryInterval): return true case <-wl.requestChan: return false From 7e36f5c6b7507b4d124db561771d886dc0994b38 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Fri, 2 Oct 2020 15:08:30 -0600 Subject: [PATCH 114/216] Migrate S3 Input to Filebeat Input V2 (#20005) *moving s3 input to v2 input API Co-authored-by: urso --- CHANGELOG.next.asciidoc | 1 + .../filebeat/input/default-inputs/inputs.go | 2 + x-pack/filebeat/input/s3/collector.go | 635 +++++++++++++++ .../s3/{input_test.go => collector_test.go} | 12 +- x-pack/filebeat/input/s3/config.go | 17 +- x-pack/filebeat/input/s3/input.go | 766 ++---------------- .../filebeat/input/s3/s3_integration_test.go | 302 ++----- 7 files changed, 797 insertions(+), 938 deletions(-) create mode 100644 x-pack/filebeat/input/s3/collector.go rename x-pack/filebeat/input/s3/{input_test.go => collector_test.go} (97%) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index a96a23db9d8..fb1fae91eb0 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -603,6 +603,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Always attempt community_id processor on zeek module {pull}21155[21155] - Add related.hosts ecs field to all modules {pull}21160[21160] - Keep cursor state between httpjson input restarts {pull}20751[20751] +- Convert aws s3 to v2 input {pull}20005[20005] *Heartbeat* diff --git a/x-pack/filebeat/input/default-inputs/inputs.go b/x-pack/filebeat/input/default-inputs/inputs.go index cd8562560da..4779b452f1d 100644 --- a/x-pack/filebeat/input/default-inputs/inputs.go +++ b/x-pack/filebeat/input/default-inputs/inputs.go @@ -14,6 +14,7 @@ import ( "github.com/elastic/beats/v7/x-pack/filebeat/input/http_endpoint" "github.com/elastic/beats/v7/x-pack/filebeat/input/httpjson" "github.com/elastic/beats/v7/x-pack/filebeat/input/o365audit" + "github.com/elastic/beats/v7/x-pack/filebeat/input/s3" ) func Init(info beat.Info, log *logp.Logger, store beater.StateStore) []v2.Plugin { @@ -29,5 +30,6 @@ func xpackInputs(info beat.Info, log *logp.Logger, store beater.StateStore) []v2 http_endpoint.Plugin(), httpjson.Plugin(log, store), o365audit.Plugin(log, store), + s3.Plugin(), } } diff --git a/x-pack/filebeat/input/s3/collector.go b/x-pack/filebeat/input/s3/collector.go new file mode 100644 index 00000000000..2976dd52a5b --- /dev/null +++ b/x-pack/filebeat/input/s3/collector.go @@ -0,0 +1,635 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package s3 + +import ( + "bufio" + "compress/gzip" + "context" + "crypto/sha256" + "encoding/hex" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "sync" + "time" + + awssdk "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/aws/awserr" + "github.com/aws/aws-sdk-go-v2/service/s3" + "github.com/aws/aws-sdk-go-v2/service/s3/s3iface" + "github.com/aws/aws-sdk-go-v2/service/sqs" + "github.com/aws/aws-sdk-go-v2/service/sqs/sqsiface" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/go-concert/unison" +) + +type s3Collector struct { + cancellation context.Context + logger *logp.Logger + + config *config + visibilityTimeout int64 + + sqs sqsiface.ClientAPI + s3 s3iface.ClientAPI + publisher beat.Client +} + +type s3Info struct { + name string + key string + region string + arn string + expandEventListFromField string +} + +type bucket struct { + Name string `json:"name"` + Arn string `json:"arn"` +} + +type object struct { + Key string `json:"key"` +} + +type s3BucketObject struct { + bucket `json:"bucket"` + object `json:"object"` +} + +type sqsMessage struct { + Records []struct { + EventSource string `json:"eventSource"` + AwsRegion string `json:"awsRegion"` + EventName string `json:"eventName"` + S3 s3BucketObject `json:"s3"` + } `json:"Records"` +} + +type s3Context struct { + mux sync.Mutex + refs int + err error // first error witnessed or multi error + errC chan error +} + +var ( + // The maximum number of messages to return. Amazon SQS never returns more messages + // than this value (however, fewer messages might be returned). + maxNumberOfMessage uint8 = 10 + + // The duration (in seconds) for which the call waits for a message to arrive + // in the queue before returning. If a message is available, the call returns + // sooner than WaitTimeSeconds. If no messages are available and the wait time + // expires, the call returns successfully with an empty list of messages. + waitTimeSecond uint8 = 10 +) + +func (c *s3Collector) run() { + defer c.logger.Info("s3 input worker has stopped.") + c.logger.Info("s3 input worker has started.") + for c.cancellation.Err() == nil { + // receive messages from sqs + output, err := c.receiveMessage(c.sqs, c.visibilityTimeout) + if err != nil { + if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == awssdk.ErrCodeRequestCanceled { + continue + } + c.logger.Error("SQS ReceiveMessageRequest failed: ", err) + continue + } + + if output == nil || len(output.Messages) == 0 { + c.logger.Debug("no message received from SQS") + continue + } + + // process messages received from sqs, get logs from s3 and create events + c.processor(c.config.QueueURL, output.Messages, c.visibilityTimeout, c.s3, c.sqs) + } +} + +func (c *s3Collector) processor(queueURL string, messages []sqs.Message, visibilityTimeout int64, svcS3 s3iface.ClientAPI, svcSQS sqsiface.ClientAPI) { + var grp unison.MultiErrGroup + numMessages := len(messages) + c.logger.Debugf("Processing %v messages", numMessages) + + // process messages received from sqs + for i := range messages { + i := i + errC := make(chan error) + grp.Go(func() (err error) { + return c.processMessage(svcS3, messages[i], errC) + }) + grp.Go(func() (err error) { + return c.processorKeepAlive(svcSQS, messages[i], queueURL, visibilityTimeout, errC) + }) + } + grp.Wait() +} + +func (c *s3Collector) processMessage(svcS3 s3iface.ClientAPI, message sqs.Message, errC chan error) error { + s3Infos, err := c.handleSQSMessage(message) + if err != nil { + c.logger.Error(fmt.Errorf("handleSQSMessage failed: %w", err)) + return err + } + c.logger.Debugf("handleSQSMessage succeed and returned %v sets of S3 log info", len(s3Infos)) + + // read from s3 object and create event for each log line + err = c.handleS3Objects(svcS3, s3Infos, errC) + if err != nil { + err = fmt.Errorf("handleS3Objects failed: %w", err) + c.logger.Error(err) + return err + } + c.logger.Debugf("handleS3Objects succeed") + return nil +} + +func (c *s3Collector) processorKeepAlive(svcSQS sqsiface.ClientAPI, message sqs.Message, queueURL string, visibilityTimeout int64, errC chan error) error { + for { + select { + case <-c.cancellation.Done(): + return nil + case err := <-errC: + if err != nil { + c.logger.Warn("Processing message failed, updating visibility timeout") + err := c.changeVisibilityTimeout(queueURL, visibilityTimeout, svcSQS, message.ReceiptHandle) + if err != nil { + c.logger.Error(fmt.Errorf("SQS ChangeMessageVisibilityRequest failed: %w", err)) + } + c.logger.Infof("Message visibility timeout updated to %v", visibilityTimeout) + } else { + // When ACK done, message will be deleted. Or when message is + // not s3 ObjectCreated event related(handleSQSMessage function + // failed), it will be removed as well. + c.logger.Debug("Deleting message from SQS: ", *message.MessageId) + // only delete sqs message when errC is closed with no error + err := c.deleteMessage(queueURL, *message.ReceiptHandle, svcSQS) + if err != nil { + c.logger.Error(fmt.Errorf("deleteMessages failed: %w", err)) + } + } + return err + case <-time.After(time.Duration(visibilityTimeout/2) * time.Second): + c.logger.Warn("Half of the set visibilityTimeout passed, visibility timeout needs to be updated") + // If half of the set visibilityTimeout passed and this is + // still ongoing, then change visibility timeout. + err := c.changeVisibilityTimeout(queueURL, visibilityTimeout, svcSQS, message.ReceiptHandle) + if err != nil { + c.logger.Error(fmt.Errorf("SQS ChangeMessageVisibilityRequest failed: %w", err)) + } + c.logger.Infof("Message visibility timeout updated to %v seconds", visibilityTimeout) + return err + } + } +} + +func (c *s3Collector) receiveMessage(svcSQS sqsiface.ClientAPI, visibilityTimeout int64) (*sqs.ReceiveMessageResponse, error) { + // receive messages from sqs + req := svcSQS.ReceiveMessageRequest( + &sqs.ReceiveMessageInput{ + QueueUrl: &c.config.QueueURL, + MessageAttributeNames: []string{"All"}, + MaxNumberOfMessages: awssdk.Int64(int64(maxNumberOfMessage)), + VisibilityTimeout: &visibilityTimeout, + WaitTimeSeconds: awssdk.Int64(int64(waitTimeSecond)), + }) + + // The Context will interrupt the request if the timeout expires. + sendCtx, cancelFn := context.WithTimeout(c.cancellation, c.config.APITimeout) + defer cancelFn() + + return req.Send(sendCtx) +} + +func (c *s3Collector) changeVisibilityTimeout(queueURL string, visibilityTimeout int64, svcSQS sqsiface.ClientAPI, receiptHandle *string) error { + req := svcSQS.ChangeMessageVisibilityRequest(&sqs.ChangeMessageVisibilityInput{ + QueueUrl: &queueURL, + VisibilityTimeout: &visibilityTimeout, + ReceiptHandle: receiptHandle, + }) + + // The Context will interrupt the request if the timeout expires. + sendCtx, cancelFn := context.WithTimeout(c.cancellation, c.config.APITimeout) + defer cancelFn() + + _, err := req.Send(sendCtx) + return err +} + +func getRegionFromQueueURL(queueURL string) (string, error) { + // get region from queueURL + // Example: https://sqs.us-east-1.amazonaws.com/627959692251/test-s3-logs + queueURLSplit := strings.Split(queueURL, ".") + if queueURLSplit[0] == "https://sqs" && queueURLSplit[2] == "amazonaws" { + return queueURLSplit[1], nil + } + return "", fmt.Errorf("queueURL is not in format: https://sqs.{REGION_ENDPOINT}.amazonaws.com/{ACCOUNT_NUMBER}/{QUEUE_NAME}") +} + +// handle message +func (c *s3Collector) handleSQSMessage(m sqs.Message) ([]s3Info, error) { + msg := sqsMessage{} + err := json.Unmarshal([]byte(*m.Body), &msg) + if err != nil { + return nil, fmt.Errorf("json unmarshal sqs message body failed: %w", err) + } + + var s3Infos []s3Info + for _, record := range msg.Records { + if record.EventSource != "aws:s3" || !strings.HasPrefix(record.EventName, "ObjectCreated:") { + return nil, fmt.Errorf("this SQS queue should be dedicated to s3 ObjectCreated event notifications") + } + // Unescape substrings from s3 log name. For example, convert "%3D" back to "=" + filename, err := url.QueryUnescape(record.S3.object.Key) + if err != nil { + return nil, fmt.Errorf("url.QueryUnescape failed for '%s': %w", record.S3.object.Key, err) + } + + if len(c.config.FileSelectors) == 0 { + s3Infos = append(s3Infos, s3Info{ + region: record.AwsRegion, + name: record.S3.bucket.Name, + key: filename, + arn: record.S3.bucket.Arn, + expandEventListFromField: c.config.ExpandEventListFromField, + }) + continue + } + + for _, fs := range c.config.FileSelectors { + if fs.Regex == nil { + continue + } + if fs.Regex.MatchString(filename) { + s3Infos = append(s3Infos, s3Info{ + region: record.AwsRegion, + name: record.S3.bucket.Name, + key: filename, + arn: record.S3.bucket.Arn, + expandEventListFromField: fs.ExpandEventListFromField, + }) + break + } + } + } + return s3Infos, nil +} + +func (c *s3Collector) handleS3Objects(svc s3iface.ClientAPI, s3Infos []s3Info, errC chan error) error { + s3Ctx := &s3Context{ + refs: 1, + errC: errC, + } + defer s3Ctx.done() + + for _, info := range s3Infos { + c.logger.Debugf("Processing file from s3 bucket \"%s\" with name \"%s\"", info.name, info.key) + err := c.createEventsFromS3Info(svc, info, s3Ctx) + if err != nil { + err = fmt.Errorf("createEventsFromS3Info failed processing file from s3 bucket \"%s\" with name \"%s\": %w", info.name, info.key, err) + c.logger.Error(err) + s3Ctx.setError(err) + } + } + return nil +} + +func (c *s3Collector) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, s3Ctx *s3Context) error { + objectHash := s3ObjectHash(info) + + // Download the S3 object using GetObjectRequest. + s3GetObjectInput := &s3.GetObjectInput{ + Bucket: awssdk.String(info.name), + Key: awssdk.String(info.key), + } + req := svc.GetObjectRequest(s3GetObjectInput) + + // The Context will interrupt the request if the timeout expires. + ctx, cancelFn := context.WithTimeout(c.cancellation, c.config.APITimeout) + defer cancelFn() + + resp, err := req.Send(ctx) + if err != nil { + if awsErr, ok := err.(awserr.Error); ok { + // If the SDK can determine the request or retry delay was canceled + // by a context the ErrCodeRequestCanceled error will be returned. + if awsErr.Code() == awssdk.ErrCodeRequestCanceled { + err = fmt.Errorf("s3 GetObjectRequest canceled for '%s' from S3 bucket '%s': %w", info.key, info.name, err) + c.logger.Error(err) + return err + } + + if awsErr.Code() == "NoSuchKey" { + c.logger.Warnf("Cannot find s3 file '%s' from S3 bucket '%s'", info.key, info.name) + return nil + } + } + return fmt.Errorf("s3 GetObjectRequest failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err) + } + + defer resp.Body.Close() + + reader := bufio.NewReader(resp.Body) + + isS3ObjGzipped, err := isStreamGzipped(reader) + if err != nil { + err = fmt.Errorf("could not determine if S3 object is gzipped: %w", err) + c.logger.Error(err) + return err + } + + if isS3ObjGzipped { + gzipReader, err := gzip.NewReader(reader) + if err != nil { + err = fmt.Errorf("gzip.NewReader failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err) + c.logger.Error(err) + return err + } + reader = bufio.NewReader(gzipReader) + gzipReader.Close() + } + + // Decode JSON documents when content-type is "application/json" or expand_event_list_from_field is given in config + if resp.ContentType != nil && *resp.ContentType == "application/json" || info.expandEventListFromField != "" { + decoder := json.NewDecoder(reader) + err := c.decodeJSON(decoder, objectHash, info, s3Ctx) + if err != nil { + err = fmt.Errorf("decodeJSONWithKey failed for '%s' from S3 bucket '%s': %w", info.key, info.name, err) + c.logger.Error(err) + return err + } + return nil + } + + // handle s3 objects that are not json content-type + offset := 0 + for { + log, err := readStringAndTrimDelimiter(reader) + if err == io.EOF { + // create event for last line + offset += len([]byte(log)) + event := createEvent(log, offset, info, objectHash, s3Ctx) + err = c.forwardEvent(event) + if err != nil { + err = fmt.Errorf("forwardEvent failed: %w", err) + c.logger.Error(err) + return err + } + return nil + } else if err != nil { + err = fmt.Errorf("readStringAndTrimDelimiter failed: %w", err) + c.logger.Error(err) + return err + } + + if log == "" { + break + } + + // create event per log line + offset += len([]byte(log)) + event := createEvent(log, offset, info, objectHash, s3Ctx) + err = c.forwardEvent(event) + if err != nil { + err = fmt.Errorf("forwardEvent failed: %w", err) + c.logger.Error(err) + return err + } + } + return nil +} + +func (c *s3Collector) decodeJSON(decoder *json.Decoder, objectHash string, s3Info s3Info, s3Ctx *s3Context) error { + offset := 0 + for { + var jsonFields interface{} + err := decoder.Decode(&jsonFields) + if jsonFields == nil { + return nil + } + + if err == io.EOF { + offsetNew, err := c.jsonFieldsType(jsonFields, offset, objectHash, s3Info, s3Ctx) + if err != nil { + return err + } + offset = offsetNew + } else if err != nil { + // decode json failed, skip this log file + err = fmt.Errorf("decode json failed for '%s' from S3 bucket '%s', skipping this file: %w", s3Info.key, s3Info.name, err) + c.logger.Warn(err) + return nil + } + + offset, err = c.jsonFieldsType(jsonFields, offset, objectHash, s3Info, s3Ctx) + if err != nil { + return err + } + } +} + +func (c *s3Collector) jsonFieldsType(jsonFields interface{}, offset int, objectHash string, s3Info s3Info, s3Ctx *s3Context) (int, error) { + switch f := jsonFields.(type) { + case map[string][]interface{}: + if s3Info.expandEventListFromField != "" { + textValues, ok := f[s3Info.expandEventListFromField] + if !ok { + err := fmt.Errorf("key '%s' not found", s3Info.expandEventListFromField) + c.logger.Error(err) + return offset, err + } + for _, v := range textValues { + offset, err := c.convertJSONToEvent(v, offset, objectHash, s3Info, s3Ctx) + if err != nil { + err = fmt.Errorf("convertJSONToEvent failed for '%s' from S3 bucket '%s': %w", s3Info.key, s3Info.name, err) + c.logger.Error(err) + return offset, err + } + } + return offset, nil + } + case map[string]interface{}: + if s3Info.expandEventListFromField != "" { + textValues, ok := f[s3Info.expandEventListFromField] + if !ok { + err := fmt.Errorf("key '%s' not found", s3Info.expandEventListFromField) + c.logger.Error(err) + return offset, err + } + + valuesConverted := textValues.([]interface{}) + for _, textValue := range valuesConverted { + offsetNew, err := c.convertJSONToEvent(textValue, offset, objectHash, s3Info, s3Ctx) + if err != nil { + err = fmt.Errorf("convertJSONToEvent failed for '%s' from S3 bucket '%s': %w", s3Info.key, s3Info.name, err) + c.logger.Error(err) + return offset, err + } + offset = offsetNew + } + return offset, nil + } + + offset, err := c.convertJSONToEvent(f, offset, objectHash, s3Info, s3Ctx) + if err != nil { + err = fmt.Errorf("convertJSONToEvent failed for '%s' from S3 bucket '%s': %w", s3Info.key, s3Info.name, err) + c.logger.Error(err) + return offset, err + } + return offset, nil + } + return offset, nil +} + +func (c *s3Collector) convertJSONToEvent(jsonFields interface{}, offset int, objectHash string, s3Info s3Info, s3Ctx *s3Context) (int, error) { + vJSON, _ := json.Marshal(jsonFields) + logOriginal := string(vJSON) + log := trimLogDelimiter(logOriginal) + offset += len([]byte(log)) + event := createEvent(log, offset, s3Info, objectHash, s3Ctx) + + err := c.forwardEvent(event) + if err != nil { + err = fmt.Errorf("forwardEvent failed: %w", err) + c.logger.Error(err) + return offset, err + } + return offset, nil +} + +func (c *s3Collector) forwardEvent(event beat.Event) error { + c.publisher.Publish(event) + return c.cancellation.Err() +} + +func (c *s3Collector) deleteMessage(queueURL string, messagesReceiptHandle string, svcSQS sqsiface.ClientAPI) error { + deleteMessageInput := &sqs.DeleteMessageInput{ + QueueUrl: awssdk.String(queueURL), + ReceiptHandle: awssdk.String(messagesReceiptHandle), + } + + req := svcSQS.DeleteMessageRequest(deleteMessageInput) + + // The Context will interrupt the request if the timeout expires. + ctx, cancelFn := context.WithTimeout(c.cancellation, c.config.APITimeout) + defer cancelFn() + + _, err := req.Send(ctx) + if err != nil { + if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == awssdk.ErrCodeRequestCanceled { + return nil + } + return fmt.Errorf("SQS DeleteMessageRequest failed: %w", err) + } + return nil +} + +func trimLogDelimiter(log string) string { + return strings.TrimSuffix(log, "\n") +} + +func readStringAndTrimDelimiter(reader *bufio.Reader) (string, error) { + logOriginal, err := reader.ReadString('\n') + if err != nil { + return logOriginal, err + } + return trimLogDelimiter(logOriginal), nil +} + +func createEvent(log string, offset int, info s3Info, objectHash string, s3Ctx *s3Context) beat.Event { + s3Ctx.Inc() + + event := beat.Event{ + Timestamp: time.Now().UTC(), + Fields: common.MapStr{ + "message": log, + "log": common.MapStr{ + "offset": int64(offset), + "file.path": constructObjectURL(info), + }, + "aws": common.MapStr{ + "s3": common.MapStr{ + "bucket": common.MapStr{ + "name": info.name, + "arn": info.arn}, + "object.key": info.key, + }, + }, + "cloud": common.MapStr{ + "provider": "aws", + "region": info.region, + }, + }, + Private: s3Ctx, + } + event.SetID(objectHash + "-" + fmt.Sprintf("%012d", offset)) + + return event +} + +func constructObjectURL(info s3Info) string { + return "https://" + info.name + ".s3-" + info.region + ".amazonaws.com/" + info.key +} + +// s3ObjectHash returns a short sha256 hash of the bucket arn + object key name. +func s3ObjectHash(s3Info s3Info) string { + h := sha256.New() + h.Write([]byte(s3Info.arn + s3Info.key)) + prefix := hex.EncodeToString(h.Sum(nil)) + return prefix[:10] +} + +func (c *s3Context) setError(err error) { + // only care about the last error for now + // TODO: add "Typed" error to error for context + c.mux.Lock() + defer c.mux.Unlock() + c.err = err +} + +func (c *s3Context) done() { + c.mux.Lock() + defer c.mux.Unlock() + c.refs-- + if c.refs == 0 { + c.errC <- c.err + close(c.errC) + } +} + +func (c *s3Context) Inc() { + c.mux.Lock() + defer c.mux.Unlock() + c.refs++ +} + +// isStreamGzipped determines whether the given stream of bytes (encapsulated in a buffered reader) +// represents gzipped content or not. A buffered reader is used so the function can peek into the byte +// stream without consuming it. This makes it convenient for code executed after this function call +// to consume the stream if it wants. +func isStreamGzipped(r *bufio.Reader) (bool, error) { + // Why 512? See https://godoc.org/net/http#DetectContentType + buf, err := r.Peek(512) + if err != nil && err != io.EOF { + return false, err + } + + switch http.DetectContentType(buf) { + case "application/x-gzip", "application/zip": + return true, nil + default: + return false, nil + } +} diff --git a/x-pack/filebeat/input/s3/input_test.go b/x-pack/filebeat/input/s3/collector_test.go similarity index 97% rename from x-pack/filebeat/input/s3/input_test.go rename to x-pack/filebeat/input/s3/collector_test.go index d1fab05cb3c..510f94d40d5 100644 --- a/x-pack/filebeat/input/s3/input_test.go +++ b/x-pack/filebeat/input/s3/collector_test.go @@ -120,7 +120,7 @@ func TestHandleMessage(t *testing.T) { }, } - p := &s3Input{context: &channelContext{}} + p := &s3Collector{config: &config{}} for _, c := range casesPositive { t.Run(c.title, func(t *testing.T) { s3Info, err := p.handleSQSMessage(c.message) @@ -165,7 +165,8 @@ func TestHandleMessage(t *testing.T) { } func TestNewS3BucketReader(t *testing.T) { - p := &s3Input{context: &channelContext{}} + config := defaultConfig() + p := &s3Collector{cancellation: context.TODO(), config: &config} s3GetObjectInput := &s3.GetObjectInput{ Bucket: awssdk.String(info.name), Key: awssdk.String(info.key), @@ -174,7 +175,7 @@ func TestNewS3BucketReader(t *testing.T) { // The Context will interrupt the request if the timeout expires. var cancelFn func() - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) + ctx, cancelFn := context.WithTimeout(p.cancellation, p.config.APITimeout) defer cancelFn() resp, err := req.Send(ctx) @@ -201,7 +202,8 @@ func TestNewS3BucketReader(t *testing.T) { } func TestCreateEvent(t *testing.T) { - p := &s3Input{context: &channelContext{}} + config := defaultConfig() + p := &s3Collector{cancellation: context.TODO(), config: &config} errC := make(chan error) s3Context := &s3Context{ refs: 1, @@ -225,7 +227,7 @@ func TestCreateEvent(t *testing.T) { // The Context will interrupt the request if the timeout expires. var cancelFn func() - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) + ctx, cancelFn := context.WithTimeout(p.cancellation, p.config.APITimeout) defer cancelFn() resp, err := req.Send(ctx) diff --git a/x-pack/filebeat/input/s3/config.go b/x-pack/filebeat/input/s3/config.go index f9780d82277..5f37a436d12 100644 --- a/x-pack/filebeat/input/s3/config.go +++ b/x-pack/filebeat/input/s3/config.go @@ -9,18 +9,16 @@ import ( "regexp" "time" - "github.com/elastic/beats/v7/filebeat/harvester" awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" ) type config struct { - harvester.ForwarderConfig `config:",inline"` - QueueURL string `config:"queue_url" validate:"nonzero,required"` - VisibilityTimeout time.Duration `config:"visibility_timeout"` - AwsConfig awscommon.ConfigAWS `config:",inline"` - ExpandEventListFromField string `config:"expand_event_list_from_field"` - APITimeout time.Duration `config:"api_timeout"` - FileSelectors []FileSelectorCfg `config:"file_selectors"` + QueueURL string `config:"queue_url" validate:"nonzero,required"` + VisibilityTimeout time.Duration `config:"visibility_timeout"` + AwsConfig awscommon.ConfigAWS `config:",inline"` + ExpandEventListFromField string `config:"expand_event_list_from_field"` + APITimeout time.Duration `config:"api_timeout"` + FileSelectors []FileSelectorCfg `config:"file_selectors"` } // FileSelectorCfg defines type and configuration of FileSelectors @@ -32,9 +30,6 @@ type FileSelectorCfg struct { func defaultConfig() config { return config{ - ForwarderConfig: harvester.ForwarderConfig{ - Type: "s3", - }, VisibilityTimeout: 300 * time.Second, APITimeout: 120 * time.Second, } diff --git a/x-pack/filebeat/input/s3/input.go b/x-pack/filebeat/input/s3/input.go index 83dc48428ee..a6b56d03970 100644 --- a/x-pack/filebeat/input/s3/input.go +++ b/x-pack/filebeat/input/s3/input.go @@ -5,748 +5,120 @@ package s3 import ( - "bufio" - "compress/gzip" - "context" - "crypto/sha256" - "encoding/hex" - "encoding/json" "fmt" - "io" - "net/http" - "net/url" - "strings" - "sync" - "time" - awssdk "github.com/aws/aws-sdk-go-v2/aws" - "github.com/aws/aws-sdk-go-v2/aws/awserr" "github.com/aws/aws-sdk-go-v2/service/s3" - "github.com/aws/aws-sdk-go-v2/service/s3/s3iface" "github.com/aws/aws-sdk-go-v2/service/sqs" - "github.com/aws/aws-sdk-go-v2/service/sqs/sqsiface" - "github.com/pkg/errors" - "github.com/elastic/beats/v7/filebeat/channel" - "github.com/elastic/beats/v7/filebeat/input" + v2 "github.com/elastic/beats/v7/filebeat/input/v2" "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/acker" - "github.com/elastic/beats/v7/libbeat/common/cfgwarn" - "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/feature" awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" + "github.com/elastic/go-concert/ctxtool" ) const inputName = "s3" -var ( - // The maximum number of messages to return. Amazon SQS never returns more messages - // than this value (however, fewer messages might be returned). - maxNumberOfMessage int64 = 10 - - // The duration (in seconds) for which the call waits for a message to arrive - // in the queue before returning. If a message is available, the call returns - // sooner than WaitTimeSeconds. If no messages are available and the wait time - // expires, the call returns successfully with an empty list of messages. - waitTimeSecond int64 = 10 - - errOutletClosed = errors.New("input outlet closed") -) - -func init() { - err := input.Register(inputName, NewInput) - if err != nil { - panic(err) +func Plugin() v2.Plugin { + return v2.Plugin{ + Name: inputName, + Stability: feature.Beta, + Deprecated: false, + Info: "Collect logs from s3", + Manager: v2.ConfigureWith(configure), } } -// s3Input is a input for s3 -type s3Input struct { - outlet channel.Outleter // Output of received s3 logs. - config config - awsConfig awssdk.Config - logger *logp.Logger - close chan struct{} - workerOnce sync.Once // Guarantees that the worker goroutine is only started once. - context *channelContext - workerWg sync.WaitGroup // Waits on s3 worker goroutine. - stopOnce sync.Once -} - -type s3Info struct { - name string - key string - region string - arn string - expandEventListFromField string -} - -type bucket struct { - Name string `json:"name"` - Arn string `json:"arn"` -} - -type object struct { - Key string `json:"key"` -} - -type s3BucketObject struct { - bucket `json:"bucket"` - object `json:"object"` -} - -type sqsMessage struct { - Records []struct { - EventSource string `json:"eventSource"` - AwsRegion string `json:"awsRegion"` - EventName string `json:"eventName"` - S3 s3BucketObject `json:"s3"` - } `json:"Records"` -} - -type s3Context struct { - mux sync.Mutex - refs int - err error // first error witnessed or multi error - errC chan error -} - -// channelContext implements context.Context by wrapping a channel -type channelContext struct { - done <-chan struct{} -} - -func (c *channelContext) Deadline() (time.Time, bool) { return time.Time{}, false } -func (c *channelContext) Done() <-chan struct{} { return c.done } -func (c *channelContext) Err() error { - select { - case <-c.done: - return context.Canceled - default: - return nil - } -} -func (c *channelContext) Value(key interface{}) interface{} { return nil } - -// NewInput creates a new s3 input -func NewInput(cfg *common.Config, connector channel.Connector, context input.Context) (input.Input, error) { - cfgwarn.Beta("s3 input type is used") - logger := logp.NewLogger(inputName) - +func configure(cfg *common.Config) (v2.Input, error) { config := defaultConfig() if err := cfg.Unpack(&config); err != nil { - return nil, errors.Wrap(err, "failed unpacking config") - } - - out, err := connector.ConnectWith(cfg, beat.ClientConfig{ - ACKHandler: acker.ConnectionOnly( - acker.EventPrivateReporter(func(_ int, privates []interface{}) { - for _, private := range privates { - if s3Context, ok := private.(*s3Context); ok { - s3Context.done() - } - } - }), - ), - }) - if err != nil { return nil, err } - awsConfig, err := awscommon.GetAWSCredentials(config.AwsConfig) - if err != nil { - return nil, errors.Wrap(err, "getAWSCredentials failed") - } - - closeChannel := make(chan struct{}) - p := &s3Input{ - outlet: out, - config: config, - awsConfig: awsConfig, - logger: logger, - close: closeChannel, - context: &channelContext{closeChannel}, - } - return p, nil -} - -// Run runs the input -func (p *s3Input) Run() { - p.workerOnce.Do(func() { - visibilityTimeout := int64(p.config.VisibilityTimeout.Seconds()) - p.logger.Infof("visibility timeout is set to %v seconds", visibilityTimeout) - p.logger.Infof("aws api timeout is set to %v", p.config.APITimeout) - - regionName, err := getRegionFromQueueURL(p.config.QueueURL) - if err != nil { - p.logger.Errorf("failed to get region name from queueURL: %v", p.config.QueueURL) - } - - awsConfig := p.awsConfig.Copy() - awsConfig.Region = regionName - - svcSQS := sqs.New(awscommon.EnrichAWSConfigWithEndpoint(p.config.AwsConfig.Endpoint, "sqs", regionName, awsConfig)) - svcS3 := s3.New(awscommon.EnrichAWSConfigWithEndpoint(p.config.AwsConfig.Endpoint, "s3", regionName, awsConfig)) - - p.workerWg.Add(1) - go p.run(svcSQS, svcS3, visibilityTimeout) - }) -} - -func (p *s3Input) run(svcSQS sqsiface.ClientAPI, svcS3 s3iface.ClientAPI, visibilityTimeout int64) { - defer p.workerWg.Done() - defer p.logger.Infof("s3 input worker for '%v' has stopped.", p.config.QueueURL) - - p.logger.Infof("s3 input worker has started. with queueURL: %v", p.config.QueueURL) - for p.context.Err() == nil { - // receive messages from sqs - output, err := p.receiveMessage(svcSQS, visibilityTimeout) - if err != nil { - if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == awssdk.ErrCodeRequestCanceled { - continue - } - p.logger.Error("SQS ReceiveMessageRequest failed: ", err) - time.Sleep(time.Duration(waitTimeSecond) * time.Second) - continue - } - - if output == nil || len(output.Messages) == 0 { - p.logger.Debug("no message received from SQS:", p.config.QueueURL) - continue - } - - // process messages received from sqs, get logs from s3 and create events - p.processor(p.config.QueueURL, output.Messages, visibilityTimeout, svcS3, svcSQS) - } -} - -// Stop stops the s3 input -func (p *s3Input) Stop() { - p.stopOnce.Do(func() { - defer p.outlet.Close() - close(p.close) - p.logger.Info("Stopping s3 input") - }) -} - -// Wait stops the s3 input. -func (p *s3Input) Wait() { - p.Stop() - p.workerWg.Wait() -} - -func (p *s3Input) processor(queueURL string, messages []sqs.Message, visibilityTimeout int64, svcS3 s3iface.ClientAPI, svcSQS sqsiface.ClientAPI) { - var wg sync.WaitGroup - numMessages := len(messages) - p.logger.Debugf("Processing %v messages", numMessages) - wg.Add(numMessages * 2) - - // process messages received from sqs - for i := range messages { - errC := make(chan error) - go p.processMessage(svcS3, messages[i], &wg, errC) - go p.processorKeepAlive(svcSQS, messages[i], queueURL, visibilityTimeout, &wg, errC) - } - wg.Wait() + return newInput(config) } -func (p *s3Input) processMessage(svcS3 s3iface.ClientAPI, message sqs.Message, wg *sync.WaitGroup, errC chan error) { - defer wg.Done() - - s3Infos, err := p.handleSQSMessage(message) - if err != nil { - p.logger.Error(errors.Wrap(err, "handleSQSMessage failed")) - return - } - p.logger.Debugf("handleSQSMessage succeed and returned %v sets of S3 log info", len(s3Infos)) - - // read from s3 object and create event for each log line - err = p.handleS3Objects(svcS3, s3Infos, errC) - if err != nil { - err = errors.Wrap(err, "handleS3Objects failed") - p.logger.Error(err) - return - } - p.logger.Debugf("handleS3Objects succeed") -} - -func (p *s3Input) processorKeepAlive(svcSQS sqsiface.ClientAPI, message sqs.Message, queueURL string, visibilityTimeout int64, wg *sync.WaitGroup, errC chan error) { - defer wg.Done() - for { - select { - case <-p.close: - return - case err := <-errC: - if err != nil { - p.logger.Warn("Processing message failed, updating visibility timeout") - err := p.changeVisibilityTimeout(queueURL, visibilityTimeout, svcSQS, message.ReceiptHandle) - if err != nil { - p.logger.Error(errors.Wrap(err, "SQS ChangeMessageVisibilityRequest failed")) - } - p.logger.Infof("Message visibility timeout updated to %v", visibilityTimeout) - } else { - // When ACK done, message will be deleted. Or when message is - // not s3 ObjectCreated event related(handleSQSMessage function - // failed), it will be removed as well. - p.logger.Debug("Deleting message from SQS: ", *message.MessageId) - // only delete sqs message when errC is closed with no error - err := p.deleteMessage(queueURL, *message.ReceiptHandle, svcSQS) - if err != nil { - p.logger.Error(errors.Wrap(err, "deleteMessages failed")) - } - } - return - case <-time.After(time.Duration(visibilityTimeout/2) * time.Second): - p.logger.Warn("Half of the set visibilityTimeout passed, visibility timeout needs to be updated") - // If half of the set visibilityTimeout passed and this is - // still ongoing, then change visibility timeout. - err := p.changeVisibilityTimeout(queueURL, visibilityTimeout, svcSQS, message.ReceiptHandle) - if err != nil { - p.logger.Error(errors.Wrap(err, "SQS ChangeMessageVisibilityRequest failed")) - } - p.logger.Infof("Message visibility timeout updated to %v seconds", visibilityTimeout) - } - } -} - -func (p *s3Input) receiveMessage(svcSQS sqsiface.ClientAPI, visibilityTimeout int64) (*sqs.ReceiveMessageResponse, error) { - // receive messages from sqs - req := svcSQS.ReceiveMessageRequest( - &sqs.ReceiveMessageInput{ - QueueUrl: &p.config.QueueURL, - MessageAttributeNames: []string{"All"}, - MaxNumberOfMessages: &maxNumberOfMessage, - VisibilityTimeout: &visibilityTimeout, - WaitTimeSeconds: &waitTimeSecond, - }) - - // The Context will interrupt the request if the timeout expires. - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) - defer cancelFn() - - return req.Send(ctx) +// s3Input is a input for s3 +type s3Input struct { + config config } -func (p *s3Input) changeVisibilityTimeout(queueURL string, visibilityTimeout int64, svcSQS sqsiface.ClientAPI, receiptHandle *string) error { - req := svcSQS.ChangeMessageVisibilityRequest(&sqs.ChangeMessageVisibilityInput{ - QueueUrl: &queueURL, - VisibilityTimeout: &visibilityTimeout, - ReceiptHandle: receiptHandle, - }) - - // The Context will interrupt the request if the timeout expires. - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) - defer cancelFn() - - _, err := req.Send(ctx) - return err +func newInput(config config) (*s3Input, error) { + return &s3Input{config: config}, nil } -func getRegionFromQueueURL(queueURL string) (string, error) { - // get region from queueURL - // Example: https://sqs.us-east-1.amazonaws.com/627959692251/test-s3-logs - queueURLSplit := strings.Split(queueURL, ".") - if queueURLSplit[0] == "https://sqs" && queueURLSplit[2] == "amazonaws" { - return queueURLSplit[1], nil - } - return "", errors.New("queueURL is not in format: https://sqs.{REGION_ENDPOINT}.amazonaws.com/{ACCOUNT_NUMBER}/{QUEUE_NAME}") -} +func (in *s3Input) Name() string { return inputName } -// handle message -func (p *s3Input) handleSQSMessage(m sqs.Message) ([]s3Info, error) { - msg := sqsMessage{} - err := json.Unmarshal([]byte(*m.Body), &msg) +func (in *s3Input) Test(ctx v2.TestContext) error { + _, err := awscommon.GetAWSCredentials(in.config.AwsConfig) if err != nil { - return nil, errors.Wrap(err, "json unmarshal sqs message body failed") - } - - var s3Infos []s3Info - for _, record := range msg.Records { - if record.EventSource != "aws:s3" || !strings.HasPrefix(record.EventName, "ObjectCreated:") { - return nil, errors.New("this SQS queue should be dedicated to s3 ObjectCreated event notifications") - } - // Unescape substrings from s3 log name. For example, convert "%3D" back to "=" - filename, err := url.QueryUnescape(record.S3.object.Key) - if err != nil { - return nil, errors.Wrapf(err, "url.QueryUnescape failed for '%s'", record.S3.object.Key) - } - - if len(p.config.FileSelectors) == 0 { - s3Infos = append(s3Infos, s3Info{ - region: record.AwsRegion, - name: record.S3.bucket.Name, - key: filename, - arn: record.S3.bucket.Arn, - expandEventListFromField: p.config.ExpandEventListFromField, - }) - continue - } - - for _, fs := range p.config.FileSelectors { - if fs.Regex == nil { - continue - } - if fs.Regex.MatchString(filename) { - s3Infos = append(s3Infos, s3Info{ - region: record.AwsRegion, - name: record.S3.bucket.Name, - key: filename, - arn: record.S3.bucket.Arn, - expandEventListFromField: fs.ExpandEventListFromField, - }) - break - } - } - } - return s3Infos, nil -} - -func (p *s3Input) handleS3Objects(svc s3iface.ClientAPI, s3Infos []s3Info, errC chan error) error { - s3Ctx := &s3Context{ - refs: 1, - errC: errC, - } - defer s3Ctx.done() - - for _, info := range s3Infos { - p.logger.Debugf("Processing file from s3 bucket \"%s\" with name \"%s\"", info.name, info.key) - err := p.createEventsFromS3Info(svc, info, s3Ctx) - if err != nil { - err = errors.Wrapf(err, "createEventsFromS3Info failed processing file from s3 bucket \"%s\" with name \"%s\"", info.name, info.key) - p.logger.Error(err) - s3Ctx.setError(err) - } + return fmt.Errorf("getAWSCredentials failed: %w", err) } return nil } -func (p *s3Input) createEventsFromS3Info(svc s3iface.ClientAPI, info s3Info, s3Ctx *s3Context) error { - objectHash := s3ObjectHash(info) - - // Download the S3 object using GetObjectRequest. - s3GetObjectInput := &s3.GetObjectInput{ - Bucket: awssdk.String(info.name), - Key: awssdk.String(info.key), - } - req := svc.GetObjectRequest(s3GetObjectInput) - - // The Context will interrupt the request if the timeout expires. - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) - defer cancelFn() - - resp, err := req.Send(ctx) +func (in *s3Input) Run(ctx v2.Context, pipeline beat.Pipeline) error { + collector, err := in.createCollector(ctx, pipeline) if err != nil { - if awsErr, ok := err.(awserr.Error); ok { - // If the SDK can determine the request or retry delay was canceled - // by a context the ErrCodeRequestCanceled error will be returned. - if awsErr.Code() == awssdk.ErrCodeRequestCanceled { - err = errors.Wrapf(err, "S3 GetObjectRequest canceled for '%s' from S3 bucket '%s'", info.key, info.name) - p.logger.Error(err) - return err - } - - if awsErr.Code() == "NoSuchKey" { - p.logger.Warnf("Cannot find s3 file '%s' from S3 bucket '%s'", info.key, info.name) - return nil - } - } - return errors.Wrapf(err, "S3 GetObjectRequest failed for '%s' from S3 bucket '%s'", info.key, info.name) - } - - defer resp.Body.Close() - - reader := bufio.NewReader(resp.Body) - - isS3ObjGzipped, err := isStreamGzipped(reader) - if err != nil { - err = errors.Wrap(err, "could not determine if S3 object is gzipped") - p.logger.Error(err) return err } - if isS3ObjGzipped { - gzipReader, err := gzip.NewReader(reader) - if err != nil { - err = errors.Wrapf(err, "gzip.NewReader failed for '%s' from S3 bucket '%s'", info.key, info.name) - p.logger.Error(err) - return err - } - reader = bufio.NewReader(gzipReader) - gzipReader.Close() - } - - // Decode JSON documents when content-type is "application/json" or expand_event_list_from_field is given in config - if resp.ContentType != nil && *resp.ContentType == "application/json" || info.expandEventListFromField != "" { - decoder := json.NewDecoder(reader) - err := p.decodeJSON(decoder, objectHash, info, s3Ctx) - if err != nil { - err = errors.Wrapf(err, "decodeJSONWithKey failed for '%s' from S3 bucket '%s'", info.key, info.name) - p.logger.Error(err) - return err - } - return nil - } - - // handle s3 objects that are not json content-type - offset := 0 - for { - log, err := readStringAndTrimDelimiter(reader) - if err == io.EOF { - // create event for last line - offset += len([]byte(log)) - event := createEvent(log, offset, info, objectHash, s3Ctx) - err = p.forwardEvent(event) - if err != nil { - err = errors.Wrap(err, "forwardEvent failed") - p.logger.Error(err) - return err - } - return nil - } else if err != nil { - err = errors.Wrap(err, "readStringAndTrimDelimiter failed") - p.logger.Error(err) - return err - } - - if log == "" { - break - } - - // create event per log line - offset += len([]byte(log)) - event := createEvent(log, offset, info, objectHash, s3Ctx) - err = p.forwardEvent(event) - if err != nil { - err = errors.Wrap(err, "forwardEvent failed") - p.logger.Error(err) - return err - } - } - return nil -} - -func (p *s3Input) decodeJSON(decoder *json.Decoder, objectHash string, s3Info s3Info, s3Ctx *s3Context) error { - offset := 0 - for { - var jsonFields interface{} - err := decoder.Decode(&jsonFields) - if jsonFields == nil { - return nil - } - - if err == io.EOF { - offset, err = p.jsonFieldsType(jsonFields, offset, objectHash, s3Info, s3Ctx) - if err != nil { - return err - } - } else if err != nil { - // decode json failed, skip this log file - err = errors.Wrapf(err, "decode json failed for '%s' from S3 bucket '%s', skipping this file", s3Info.key, s3Info.name) - p.logger.Warn(err) - return nil - } - - offsetNew, err := p.jsonFieldsType(jsonFields, offset, objectHash, s3Info, s3Ctx) - if err != nil { - return err - } - offset = offsetNew - } -} - -func (p *s3Input) jsonFieldsType(jsonFields interface{}, offset int, objectHash string, s3Info s3Info, s3Ctx *s3Context) (int, error) { - switch f := jsonFields.(type) { - case map[string][]interface{}: - if s3Info.expandEventListFromField != "" { - textValues, ok := f[s3Info.expandEventListFromField] - if !ok { - err := errors.Errorf("key '%s' not found", s3Info.expandEventListFromField) - p.logger.Error(err) - return offset, err - } - for _, v := range textValues { - offset, err := p.convertJSONToEvent(v, offset, objectHash, s3Info, s3Ctx) - if err != nil { - err = errors.Wrapf(err, "convertJSONToEvent failed for '%s' from S3 bucket '%s'", s3Info.key, s3Info.name) - p.logger.Error(err) - return offset, err - } - } - return offset, nil - } - case map[string]interface{}: - if s3Info.expandEventListFromField != "" { - textValues, ok := f[s3Info.expandEventListFromField] - if !ok { - err := errors.Errorf("key '%s' not found", s3Info.expandEventListFromField) - p.logger.Error(err) - return offset, err - } - - valuesConverted := textValues.([]interface{}) - for _, textValue := range valuesConverted { - offsetNew, err := p.convertJSONToEvent(textValue, offset, objectHash, s3Info, s3Ctx) - if err != nil { - err = errors.Wrapf(err, "convertJSONToEvent failed for '%s' from S3 bucket '%s'", s3Info.key, s3Info.name) - p.logger.Error(err) - return offset, err - } - offset = offsetNew - } - return offset, nil - } - - offset, err := p.convertJSONToEvent(f, offset, objectHash, s3Info, s3Ctx) - if err != nil { - err = errors.Wrapf(err, "convertJSONToEvent failed for '%s' from S3 bucket '%s'", s3Info.key, s3Info.name) - p.logger.Error(err) - return offset, err - } - return offset, nil - } - return offset, nil + defer collector.publisher.Close() + collector.run() + return ctx.Cancelation.Err() } -func (p *s3Input) convertJSONToEvent(jsonFields interface{}, offset int, objectHash string, s3Info s3Info, s3Ctx *s3Context) (int, error) { - vJSON, err := json.Marshal(jsonFields) - logOriginal := string(vJSON) - log := trimLogDelimiter(logOriginal) - offset += len([]byte(log)) - event := createEvent(log, offset, s3Info, objectHash, s3Ctx) +func (in *s3Input) createCollector(ctx v2.Context, pipeline beat.Pipeline) (*s3Collector, error) { + log := ctx.Logger.With("queue_url", in.config.QueueURL) - err = p.forwardEvent(event) + client, err := pipeline.ConnectWith(beat.ClientConfig{ + CloseRef: ctx.Cancelation, + ACKHandler: newACKHandler(), + }) if err != nil { - err = errors.Wrap(err, "forwardEvent failed") - p.logger.Error(err) - return offset, err - } - return offset, nil -} - -func (p *s3Input) forwardEvent(event beat.Event) error { - ok := p.outlet.OnEvent(event) - if !ok { - return errOutletClosed - } - return nil -} - -func (p *s3Input) deleteMessage(queueURL string, messagesReceiptHandle string, svcSQS sqsiface.ClientAPI) error { - deleteMessageInput := &sqs.DeleteMessageInput{ - QueueUrl: awssdk.String(queueURL), - ReceiptHandle: awssdk.String(messagesReceiptHandle), + return nil, err } - req := svcSQS.DeleteMessageRequest(deleteMessageInput) - - // The Context will interrupt the request if the timeout expires. - ctx, cancelFn := context.WithTimeout(p.context, p.config.APITimeout) - defer cancelFn() - - _, err := req.Send(ctx) + regionName, err := getRegionFromQueueURL(in.config.QueueURL) if err != nil { - if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == awssdk.ErrCodeRequestCanceled { - return nil - } - return errors.Wrapf(err, "SQS DeleteMessageRequest failed in queue %s", queueURL) + err := fmt.Errorf("getRegionFromQueueURL failed: %w", err) + log.Error(err) + return nil, err + } else { + log = log.With("region", regionName) } - return nil -} -func trimLogDelimiter(log string) string { - return strings.TrimSuffix(log, "\n") -} - -func readStringAndTrimDelimiter(reader *bufio.Reader) (string, error) { - logOriginal, err := reader.ReadString('\n') + awsConfig, err := awscommon.GetAWSCredentials(in.config.AwsConfig) if err != nil { - return logOriginal, err - } - return trimLogDelimiter(logOriginal), nil -} - -func createEvent(log string, offset int, info s3Info, objectHash string, s3Ctx *s3Context) beat.Event { - s3Ctx.Inc() - - event := beat.Event{ - Timestamp: time.Now().UTC(), - Fields: common.MapStr{ - "message": log, - "log": common.MapStr{ - "offset": int64(offset), - "file.path": constructObjectURL(info), - }, - "aws": common.MapStr{ - "s3": common.MapStr{ - "bucket": common.MapStr{ - "name": info.name, - "arn": info.arn}, - "object.key": info.key, - }, - }, - "cloud": common.MapStr{ - "provider": "aws", - "region": info.region, - }, - }, - Private: s3Ctx, - } - event.SetID(objectHash + "-" + fmt.Sprintf("%012d", offset)) - - return event -} - -func constructObjectURL(info s3Info) string { - return "https://" + info.name + ".s3-" + info.region + ".amazonaws.com/" + info.key -} - -// s3ObjectHash returns a short sha256 hash of the bucket arn + object key name. -func s3ObjectHash(s3Info s3Info) string { - h := sha256.New() - h.Write([]byte(s3Info.arn + s3Info.key)) - prefix := hex.EncodeToString(h.Sum(nil)) - return prefix[:10] -} - -func (c *s3Context) setError(err error) { - // only care about the last error for now - // TODO: add "Typed" error to error for context - c.mux.Lock() - defer c.mux.Unlock() - c.err = err -} - -func (c *s3Context) done() { - c.mux.Lock() - defer c.mux.Unlock() - c.refs-- - if c.refs == 0 { - c.errC <- c.err - close(c.errC) - } -} - -func (c *s3Context) Inc() { - c.mux.Lock() - defer c.mux.Unlock() - c.refs++ -} - -// isStreamGzipped determines whether the given stream of bytes (encapsulated in a buffered reader) -// represents gzipped content or not. A buffered reader is used so the function can peek into the byte -// stream without consuming it. This makes it convenient for code executed after this function call -// to consume the stream if it wants. -func isStreamGzipped(r *bufio.Reader) (bool, error) { - // Why 512? See https://godoc.org/net/http#DetectContentType - buf, err := r.Peek(512) - if err != nil && err != io.EOF { - return false, err - } - - switch http.DetectContentType(buf) { - case "application/x-gzip", "application/zip": - return true, nil - default: - return false, nil - } + return nil, fmt.Errorf("getAWSCredentials failed: %w", err) + } + awsConfig.Region = regionName + + visibilityTimeout := int64(in.config.VisibilityTimeout.Seconds()) + log.Infof("visibility timeout is set to %v seconds", visibilityTimeout) + log.Infof("aws api timeout is set to %v", in.config.APITimeout) + + return &s3Collector{ + cancellation: ctxtool.FromCanceller(ctx.Cancelation), + logger: log, + config: &in.config, + publisher: client, + visibilityTimeout: visibilityTimeout, + sqs: sqs.New(awscommon.EnrichAWSConfigWithEndpoint(in.config.AwsConfig.Endpoint, "sqs", regionName, awsConfig)), + s3: s3.New(awscommon.EnrichAWSConfigWithEndpoint(in.config.AwsConfig.Endpoint, "s3", regionName, awsConfig)), + }, nil +} + +func newACKHandler() beat.ACKer { + return acker.ConnectionOnly( + acker.EventPrivateReporter(func(_ int, privates []interface{}) { + for _, private := range privates { + if s3Context, ok := private.(*s3Context); ok { + s3Context.done() + } + } + }), + ) } diff --git a/x-pack/filebeat/input/s3/s3_integration_test.go b/x-pack/filebeat/input/s3/s3_integration_test.go index 1d6a400a7f1..cadb5da035b 100644 --- a/x-pack/filebeat/input/s3/s3_integration_test.go +++ b/x-pack/filebeat/input/s3/s3_integration_test.go @@ -16,21 +16,20 @@ import ( "testing" "time" - "github.com/stretchr/testify/assert" - - "github.com/aws/aws-sdk-go-v2/aws" awssdk "github.com/aws/aws-sdk-go-v2/aws" "github.com/aws/aws-sdk-go-v2/service/s3" - "github.com/aws/aws-sdk-go-v2/service/s3/s3iface" "github.com/aws/aws-sdk-go-v2/service/sqs" "github.com/aws/aws-sdk-go-v2/service/sqs/sqsiface" + "github.com/stretchr/testify/assert" - "github.com/elastic/beats/v7/filebeat/channel" - "github.com/elastic/beats/v7/filebeat/input" + v2 "github.com/elastic/beats/v7/filebeat/input/v2" "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" + pubtest "github.com/elastic/beats/v7/libbeat/publisher/testing" "github.com/elastic/beats/v7/libbeat/tests/resources" awscommon "github.com/elastic/beats/v7/x-pack/libbeat/common/aws" + "github.com/elastic/go-concert/unison" ) const ( @@ -77,228 +76,99 @@ func getConfigForTest(t *testing.T) config { return config } -func uploadSampleLogFile(t *testing.T, bucketName string, svcS3 s3iface.ClientAPI) { - t.Helper() - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() - - file, err := os.Open(filePath) - if err != nil { - t.Fatalf("Failed to open file %v", filePath) - } - defer file.Close() - - s3PutObjectInput := s3.PutObjectInput{ - Bucket: aws.String(bucketName), - Key: aws.String(filepath.Base(filePath)), - Body: file, - } - req := svcS3.PutObjectRequest(&s3PutObjectInput) - output, err := req.Send(ctx) - if err != nil { - t.Fatalf("failed to put object into s3 bucket: %v", output) - } -} - -func collectOldMessages(t *testing.T, queueURL string, visibilityTimeout int64, svcSQS sqsiface.ClientAPI) []string { - t.Helper() - ctx, cancel := context.WithCancel(context.Background()) - defer cancel() - - // receive messages from sqs - req := svcSQS.ReceiveMessageRequest( - &sqs.ReceiveMessageInput{ - QueueUrl: &queueURL, - MessageAttributeNames: []string{"All"}, - MaxNumberOfMessages: &maxNumberOfMessage, - VisibilityTimeout: &visibilityTimeout, - WaitTimeSeconds: &waitTimeSecond, - }) - - output, err := req.Send(ctx) - if err != nil { - t.Fatalf("failed to receive message from SQS: %v", output) - } - - var oldMessageHandles []string - for _, message := range output.Messages { - oldMessageHandles = append(oldMessageHandles, *message.ReceiptHandle) - } - - return oldMessageHandles -} - -func (input *s3Input) deleteAllMessages(t *testing.T, awsConfig awssdk.Config, queueURL string, visibilityTimeout int64, svcSQS sqsiface.ClientAPI) error { - var messageReceiptHandles []string - init := true - for init || len(messageReceiptHandles) > 0 { - init = false - messageReceiptHandles = collectOldMessages(t, queueURL, visibilityTimeout, svcSQS) - for _, receiptHandle := range messageReceiptHandles { - err := input.deleteMessage(queueURL, receiptHandle, svcSQS) - if err != nil { - return err - } - } - } - return nil -} - func defaultTestConfig() *common.Config { return common.MustNewConfigFrom(map[string]interface{}{ "queue_url": os.Getenv("QUEUE_URL"), }) } -func runTest(t *testing.T, cfg *common.Config, run func(t *testing.T, input *s3Input, out *stubOutleter)) { - // Simulate input.Context from Filebeat input runner. - inputCtx := newInputContext() - defer close(inputCtx.Done) - - // Stub outlet for receiving events generated by the input. - eventOutlet := newStubOutlet() - defer eventOutlet.Close() - - connector := channel.ConnectorFunc(func(_ *common.Config, _ beat.ClientConfig) (channel.Outleter, error) { - return eventOutlet, nil - }) +func newV2Context() (v2.Context, func()) { + ctx, cancel := context.WithCancel(context.Background()) + return v2.Context{ + Logger: logp.NewLogger("s3_test"), + ID: "test_id", + Cancelation: ctx, + }, cancel +} - in, err := NewInput(cfg, connector, inputCtx) +func setupInput(t *testing.T, cfg *common.Config) (*s3Collector, chan beat.Event) { + inp, err := Plugin().Manager.Create(cfg) if err != nil { t.Fatal(err) } - s3Input := in.(*s3Input) - defer s3Input.Stop() - run(t, s3Input, eventOutlet) -} + ctx, cancel := newV2Context() + t.Cleanup(cancel) -func newInputContext() input.Context { - return input.Context{ - Done: make(chan struct{}), + client := pubtest.NewChanClient(0) + pipeline := pubtest.ConstClient(client) + collector, err := inp.(*s3Input).createCollector(ctx, pipeline) + if err != nil { + t.Fatal(err) } + return collector, client.Channel } -type stubOutleter struct { - sync.Mutex - cond *sync.Cond - done bool - Events []beat.Event -} - -func newStubOutlet() *stubOutleter { - o := &stubOutleter{} - o.cond = sync.NewCond(o) - return o -} - -func (o *stubOutleter) waitForEvents(numEvents int) ([]beat.Event, bool) { - o.Lock() - defer o.Unlock() - - for len(o.Events) < numEvents && !o.done { - o.cond.Wait() +func setupCollector(t *testing.T, cfg *common.Config, mock bool) (*s3Collector, chan beat.Event) { + collector, receiver := setupInput(t, cfg) + if mock { + svcS3 := &MockS3Client{} + svcSQS := &MockSQSClient{} + collector.sqs = svcSQS + collector.s3 = svcS3 + return collector, receiver } - size := numEvents - if size >= len(o.Events) { - size = len(o.Events) + config := getConfigForTest(t) + awsConfig, err := awscommon.GetAWSCredentials(config.AwsConfig) + if err != nil { + t.Fatal("failed GetAWSCredentials with AWS Config: ", err) } - out := make([]beat.Event, size) - copy(out, o.Events) - return out, len(out) == numEvents + s3BucketRegion := os.Getenv("S3_BUCKET_REGION") + if s3BucketRegion == "" { + t.Log("S3_BUCKET_REGION is not set, default to us-west-1") + s3BucketRegion = "us-west-1" + } + awsConfig.Region = s3BucketRegion + awsConfig = awsConfig.Copy() + collector.sqs = sqs.New(awsConfig) + collector.s3 = s3.New(awsConfig) + return collector, receiver } -func (o *stubOutleter) Close() error { - o.Lock() - defer o.Unlock() - o.done = true - return nil -} - -func (o *stubOutleter) Done() <-chan struct{} { return nil } - -func (o *stubOutleter) OnEvent(event beat.Event) bool { - o.Lock() - defer o.Unlock() - o.Events = append(o.Events, event) - o.cond.Broadcast() - return !o.done +func runTest(t *testing.T, cfg *common.Config, mock bool, run func(t *testing.T, collector *s3Collector, receiver chan beat.Event)) { + collector, receiver := setupCollector(t, cfg, mock) + run(t, collector, receiver) } func TestS3Input(t *testing.T) { - inputConfig := defaultTestConfig() - config := getConfigForTest(t) - - runTest(t, inputConfig, func(t *testing.T, input *s3Input, out *stubOutleter) { - awsConfig, err := awscommon.GetAWSCredentials(config.AwsConfig) - if err != nil { - - } - s3BucketRegion := os.Getenv("S3_BUCKET_REGION") - if s3BucketRegion == "" { - t.Log("S3_BUCKET_REGION is not set, default to us-west-1") - s3BucketRegion = "us-west-1" - } - awsConfig.Region = s3BucketRegion - input.awsConfig = awsConfig.Copy() - svcSQS := sqs.New(awsConfig) - - // remove old messages from SQS - err = input.deleteAllMessages(t, awsConfig, config.QueueURL, int64(config.VisibilityTimeout.Seconds()), svcSQS) - if err != nil { - t.Fatalf("failed to delete message: %v", err.Error()) - } - + runTest(t, defaultTestConfig(), false, func(t *testing.T, collector *s3Collector, receiver chan beat.Event) { // upload a sample log file for testing s3BucketNameEnv := os.Getenv("S3_BUCKET_NAME") if s3BucketNameEnv == "" { t.Fatal("failed to get S3_BUCKET_NAME") } - svcS3 := s3.New(awsConfig) - uploadSampleLogFile(t, s3BucketNameEnv, svcS3) - time.Sleep(30 * time.Second) - wg := sync.WaitGroup{} wg.Add(1) go func() { defer wg.Done() - input.run(svcSQS, svcS3, 300) + collector.run() }() - events, ok := out.waitForEvents(2) - if !ok { - t.Fatalf("Expected 2 events, but got %d.", len(events)) - } - input.Stop() - - // check events - for i, event := range events { - bucketName, err := event.GetValue("aws.s3.bucket.name") - assert.NoError(t, err) - assert.Equal(t, s3BucketNameEnv, bucketName) - - objectKey, err := event.GetValue("aws.s3.object.key") - assert.NoError(t, err) - assert.Equal(t, fileName, objectKey) - - message, err := event.GetValue("message") - assert.NoError(t, err) - switch i { - case 0: - assert.Equal(t, "logline1\n", message) - case 1: - assert.Equal(t, "logline2\n", message) - } - } + event := <-receiver + bucketName, err := event.GetValue("aws.s3.bucket.name") + assert.NoError(t, err) + assert.Equal(t, s3BucketNameEnv, bucketName) - // delete messages from the queue - err = input.deleteAllMessages(t, awsConfig, config.QueueURL, int64(config.VisibilityTimeout.Seconds()), svcSQS) - if err != nil { - t.Fatalf("failed to delete message: %v", err.Error()) - } + objectKey, err := event.GetValue("aws.s3.object.key") + assert.NoError(t, err) + assert.Equal(t, fileName, objectKey) + + message, err := event.GetValue("message") + assert.NoError(t, err) + assert.Equal(t, "logline1\n", message) }) } @@ -354,41 +224,23 @@ func TestMockS3Input(t *testing.T) { "queue_url": "https://sqs.ap-southeast-1.amazonaws.com/123456/test", }) - runTest(t, cfg, func(t *testing.T, input *s3Input, out *stubOutleter) { - svcS3 := &MockS3Client{} - svcSQS := &MockSQSClient{} + runTest(t, cfg, true, func(t *testing.T, collector *s3Collector, receiver chan beat.Event) { + defer collector.cancellation.Done() + defer collector.publisher.Close() - wg := sync.WaitGroup{} - wg.Add(1) - go func() { - defer wg.Done() - input.run(svcSQS, svcS3, 300) - }() + output, err := collector.receiveMessage(collector.sqs, collector.visibilityTimeout) + assert.NoError(t, err) - events, ok := out.waitForEvents(2) - if !ok { - t.Fatalf("Expected 2 events, but got %d.", len(events)) - } - input.Wait() - - // check events - for i, event := range events { - bucketName, err := event.GetValue("aws.s3.bucket.name") - assert.NoError(t, err) - assert.Equal(t, "test-s3-ks-2", bucketName) - - objectKey, err := event.GetValue("aws.s3.object.key") - assert.NoError(t, err) - assert.Equal(t, "server-access-logging2019-06-21-16-16-54", objectKey) - - message, err := event.GetValue("message") - assert.NoError(t, err) - switch i { - case 0: - assert.Equal(t, s3LogString1, message) - case 1: - assert.Equal(t, s3LogString2, message) - } - } + var grp unison.MultiErrGroup + errC := make(chan error) + defer close(errC) + grp.Go(func() (err error) { + return collector.processMessage(collector.s3, output.Messages[0], errC) + }) + + event := <-receiver + bucketName, err := event.GetValue("aws.s3.bucket.name") + assert.NoError(t, err) + assert.Equal(t, "test-s3-ks-2", bucketName) }) } From 30a141519911c933372624c9aaf4b7fc9d0ce8d5 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Fri, 2 Oct 2020 23:12:59 +0200 Subject: [PATCH 115/216] Increase index pattern size check to 10MiB (#21487) --- libbeat/tests/system/beat/common_tests.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libbeat/tests/system/beat/common_tests.py b/libbeat/tests/system/beat/common_tests.py index c9cdbc52cc0..920ee35e72e 100644 --- a/libbeat/tests/system/beat/common_tests.py +++ b/libbeat/tests/system/beat/common_tests.py @@ -4,6 +4,12 @@ from beat.beat import INTEGRATION_TESTS +# Fail if the exported index pattern is larger than 10MiB +# This is to avoid problems with Kibana when the payload +# of the request to install the index pattern exceeds the +# default limit. +index_pattern_size_limit = 10 * 1024 * 1024 + class TestExportsMixin: @@ -56,7 +62,7 @@ def test_export_index_pattern(self): js = json.loads(output) assert "objects" in js size = len(output.encode('utf-8')) - assert size < 1024 * 1024, "Kibana index pattern must be less than 1MiB " \ + assert size < index_pattern_size_limit, "Kibana index pattern must be less than 10MiB " \ "to keep the Beat setup request size below " \ "Kibana's server.maxPayloadBytes." @@ -68,7 +74,7 @@ def test_export_index_pattern_migration(self): js = json.loads(output) assert "objects" in js size = len(output.encode('utf-8')) - assert size < 1024 * 1024, "Kibana index pattern must be less than 1MiB " \ + assert size < index_pattern_size_limit, "Kibana index pattern must be less than 10MiB " \ "to keep the Beat setup request size below " \ "Kibana's server.maxPayloadBytes." From e50c9b3929fdab157000e01adcd07a9d92b05b37 Mon Sep 17 00:00:00 2001 From: Pius Date: Fri, 2 Oct 2020 19:40:29 -0700 Subject: [PATCH 116/216] Clarify input type configuration options (#19284) Clarify that all input type configuration options must be specified within the external configuration file: https://github.com/elastic/beats/issues/19148 --- filebeat/docs/reload-configuration.asciidoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/filebeat/docs/reload-configuration.asciidoc b/filebeat/docs/reload-configuration.asciidoc index 10a706d4020..14c4826b6d8 100644 --- a/filebeat/docs/reload-configuration.asciidoc +++ b/filebeat/docs/reload-configuration.asciidoc @@ -33,9 +33,11 @@ definitions. TIP: The first line of each external configuration file must be an input definition that starts with `- type`. Make sure you omit the line -+{beatname_lc}.config.inputs+ from this file. - -For example: ++{beatname_lc}.config.inputs+ from this file. All <> +must be specified within each external configuration file. Specifying these +configuration options at the global `filebeat.config.inputs` level is not supported. + +Example external configuration file: [source,yaml] ------------------------------------------------------------------------------ From e9cb70f8805fe84889f27391314281f2a39514cc Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Sun, 4 Oct 2020 09:43:06 -0400 Subject: [PATCH 117/216] Bump version to ECS 1.6 in modules without ECS updates (#21455) For the Filebeat modules that required no changes to move to ECS 1.6 this updates the ecs.version field from 1.5.0 to 1.6.0. And update the ecs.version for Auditbeat, Packetbeat, and Winlogbeat. Relates #19472 --- auditbeat/cmd/root.go | 2 +- filebeat/module/apache/access/config/access.yml | 2 +- filebeat/module/apache/error/config/error.yml | 2 +- filebeat/module/auditd/log/config/log.yml | 2 +- filebeat/module/elasticsearch/audit/config/audit.yml | 2 +- filebeat/module/elasticsearch/deprecation/config/log.yml | 2 +- filebeat/module/elasticsearch/gc/config/gc.yml | 2 +- filebeat/module/elasticsearch/server/config/log.yml | 2 +- filebeat/module/elasticsearch/slowlog/config/slowlog.yml | 2 +- filebeat/module/haproxy/log/config/file.yml | 2 +- filebeat/module/haproxy/log/config/syslog.yml | 2 +- filebeat/module/icinga/debug/config/debug.yml | 2 +- filebeat/module/icinga/main/config/main.yml | 2 +- filebeat/module/icinga/startup/config/startup.yml | 2 +- filebeat/module/iis/access/config/iis-access.yml | 2 +- filebeat/module/iis/error/config/iis-error.yml | 2 +- filebeat/module/kafka/log/config/log.yml | 2 +- filebeat/module/kibana/log/config/log.yml | 2 +- filebeat/module/logstash/log/config/log.yml | 2 +- filebeat/module/logstash/slowlog/config/slowlog.yml | 2 +- filebeat/module/mongodb/log/config/log.yml | 2 +- filebeat/module/mysql/error/config/error.yml | 2 +- filebeat/module/mysql/slowlog/config/slowlog.yml | 2 +- filebeat/module/nats/log/config/log.yml | 2 +- filebeat/module/nginx/access/config/nginx-access.yml | 2 +- filebeat/module/nginx/error/config/nginx-error.yml | 2 +- .../nginx/ingress_controller/config/ingress_controller.yml | 2 +- filebeat/module/postgresql/log/config/log.yml | 2 +- filebeat/module/redis/log/config/log.yml | 2 +- filebeat/module/traefik/access/config/traefik-access.yml | 2 +- packetbeat/cmd/root.go | 2 +- winlogbeat/cmd/root.go | 2 +- x-pack/filebeat/module/activemq/audit/config/audit.yml | 2 +- x-pack/filebeat/module/activemq/log/config/log.yml | 2 +- x-pack/filebeat/module/aws/cloudtrail/config/file.yml | 2 +- x-pack/filebeat/module/aws/cloudtrail/config/s3.yml | 2 +- x-pack/filebeat/module/aws/cloudwatch/config/file.yml | 2 +- x-pack/filebeat/module/aws/cloudwatch/config/s3.yml | 2 +- x-pack/filebeat/module/aws/ec2/config/file.yml | 2 +- x-pack/filebeat/module/aws/ec2/config/s3.yml | 2 +- x-pack/filebeat/module/aws/elb/config/file.yml | 2 +- x-pack/filebeat/module/aws/elb/config/s3.yml | 2 +- x-pack/filebeat/module/aws/s3access/config/file.yml | 2 +- x-pack/filebeat/module/aws/s3access/config/s3.yml | 2 +- x-pack/filebeat/module/aws/vpcflow/config/input.yml | 2 +- .../module/azure/activitylogs/config/azure-eventhub.yml | 2 +- x-pack/filebeat/module/azure/activitylogs/config/file.yml | 2 +- .../filebeat/module/azure/auditlogs/config/azure-eventhub.yml | 2 +- x-pack/filebeat/module/azure/auditlogs/config/file.yml | 2 +- .../filebeat/module/azure/signinlogs/config/azure-eventhub.yml | 2 +- x-pack/filebeat/module/azure/signinlogs/config/file.yml | 2 +- x-pack/filebeat/module/cef/log/config/input.yml | 2 +- x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml | 2 +- x-pack/filebeat/module/coredns/log/config/coredns.yml | 2 +- x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml | 2 +- x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml | 2 +- x-pack/filebeat/module/googlecloud/audit/config/input.yml | 2 +- x-pack/filebeat/module/googlecloud/firewall/config/input.yml | 2 +- x-pack/filebeat/module/googlecloud/vpcflow/config/input.yml | 2 +- x-pack/filebeat/module/gsuite/admin/config/config.yml | 2 +- x-pack/filebeat/module/gsuite/drive/config/config.yml | 2 +- x-pack/filebeat/module/gsuite/groups/config/config.yml | 2 +- x-pack/filebeat/module/gsuite/login/config/config.yml | 2 +- x-pack/filebeat/module/gsuite/saml/config/config.yml | 2 +- x-pack/filebeat/module/gsuite/user_accounts/config/config.yml | 2 +- x-pack/filebeat/module/ibmmq/errorlog/config/errorlog.yml | 2 +- x-pack/filebeat/module/iptables/log/config/input.yml | 2 +- x-pack/filebeat/module/misp/threat/config/input.yml | 2 +- x-pack/filebeat/module/mssql/log/config/config.yml | 2 +- x-pack/filebeat/module/netflow/log/config/netflow.yml | 2 +- x-pack/filebeat/module/o365/audit/config/input.yml | 2 +- x-pack/filebeat/module/okta/system/config/input.yml | 2 +- x-pack/filebeat/module/rabbitmq/log/config/log.yml | 2 +- x-pack/filebeat/module/sophos/xg/config/config.yml | 2 +- .../filebeat/module/zeek/capture_loss/config/capture_loss.yml | 2 +- x-pack/filebeat/module/zeek/connection/config/connection.yml | 2 +- x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml | 2 +- x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml | 2 +- x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml | 2 +- x-pack/filebeat/module/zeek/dns/config/dns.yml | 2 +- x-pack/filebeat/module/zeek/dpd/config/dpd.yml | 2 +- x-pack/filebeat/module/zeek/files/config/files.yml | 2 +- x-pack/filebeat/module/zeek/ftp/config/ftp.yml | 2 +- x-pack/filebeat/module/zeek/http/config/http.yml | 2 +- x-pack/filebeat/module/zeek/intel/config/intel.yml | 2 +- x-pack/filebeat/module/zeek/irc/config/irc.yml | 2 +- x-pack/filebeat/module/zeek/modbus/config/modbus.yml | 2 +- x-pack/filebeat/module/zeek/mysql/config/mysql.yml | 2 +- x-pack/filebeat/module/zeek/notice/config/notice.yml | 2 +- x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml | 2 +- x-pack/filebeat/module/zeek/ocsp/config/ocsp.yml | 2 +- x-pack/filebeat/module/zeek/pe/config/pe.yml | 2 +- x-pack/filebeat/module/zeek/radius/config/radius.yml | 2 +- x-pack/filebeat/module/zeek/rdp/config/rdp.yml | 2 +- x-pack/filebeat/module/zeek/rfb/config/rfb.yml | 2 +- x-pack/filebeat/module/zeek/sip/config/sip.yml | 2 +- x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml | 2 +- x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml | 2 +- x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml | 2 +- x-pack/filebeat/module/zeek/smtp/config/smtp.yml | 2 +- x-pack/filebeat/module/zeek/snmp/config/snmp.yml | 2 +- x-pack/filebeat/module/zeek/socks/config/socks.yml | 2 +- x-pack/filebeat/module/zeek/ssh/config/ssh.yml | 2 +- x-pack/filebeat/module/zeek/stats/config/stats.yml | 2 +- x-pack/filebeat/module/zeek/syslog/config/syslog.yml | 2 +- x-pack/filebeat/module/zeek/traceroute/config/traceroute.yml | 2 +- x-pack/filebeat/module/zeek/tunnel/config/tunnel.yml | 2 +- x-pack/filebeat/module/zeek/weird/config/weird.yml | 2 +- x-pack/filebeat/module/zoom/webhook/config/webhook.yml | 2 +- 109 files changed, 109 insertions(+), 109 deletions(-) diff --git a/auditbeat/cmd/root.go b/auditbeat/cmd/root.go index 89d0bfd20ca..bf3167e7106 100644 --- a/auditbeat/cmd/root.go +++ b/auditbeat/cmd/root.go @@ -35,7 +35,7 @@ const ( Name = "auditbeat" // ecsVersion specifies the version of ECS that Auditbeat is implementing. - ecsVersion = "1.5.0" + ecsVersion = "1.6.0" ) // RootCmd for running auditbeat. diff --git a/filebeat/module/apache/access/config/access.yml b/filebeat/module/apache/access/config/access.yml index 183de629867..b39221031f3 100644 --- a/filebeat/module/apache/access/config/access.yml +++ b/filebeat/module/apache/access/config/access.yml @@ -8,4 +8,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/apache/error/config/error.yml b/filebeat/module/apache/error/config/error.yml index 7aa0cdb7cf8..b8aa75eef7c 100644 --- a/filebeat/module/apache/error/config/error.yml +++ b/filebeat/module/apache/error/config/error.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/auditd/log/config/log.yml b/filebeat/module/auditd/log/config/log.yml index 183de629867..b39221031f3 100644 --- a/filebeat/module/auditd/log/config/log.yml +++ b/filebeat/module/auditd/log/config/log.yml @@ -8,4 +8,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/elasticsearch/audit/config/audit.yml b/filebeat/module/elasticsearch/audit/config/audit.yml index 7aa0cdb7cf8..b8aa75eef7c 100644 --- a/filebeat/module/elasticsearch/audit/config/audit.yml +++ b/filebeat/module/elasticsearch/audit/config/audit.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/elasticsearch/deprecation/config/log.yml b/filebeat/module/elasticsearch/deprecation/config/log.yml index f6c37b9e426..aa6f7d220f0 100644 --- a/filebeat/module/elasticsearch/deprecation/config/log.yml +++ b/filebeat/module/elasticsearch/deprecation/config/log.yml @@ -15,4 +15,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/elasticsearch/gc/config/gc.yml b/filebeat/module/elasticsearch/gc/config/gc.yml index 5f62e00c54c..12b9a0f874d 100644 --- a/filebeat/module/elasticsearch/gc/config/gc.yml +++ b/filebeat/module/elasticsearch/gc/config/gc.yml @@ -13,4 +13,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/elasticsearch/server/config/log.yml b/filebeat/module/elasticsearch/server/config/log.yml index b0b9e3f55d0..45a7f84018d 100644 --- a/filebeat/module/elasticsearch/server/config/log.yml +++ b/filebeat/module/elasticsearch/server/config/log.yml @@ -15,4 +15,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/elasticsearch/slowlog/config/slowlog.yml b/filebeat/module/elasticsearch/slowlog/config/slowlog.yml index 2d98286de6d..4c861ea7dc7 100644 --- a/filebeat/module/elasticsearch/slowlog/config/slowlog.yml +++ b/filebeat/module/elasticsearch/slowlog/config/slowlog.yml @@ -16,4 +16,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/haproxy/log/config/file.yml b/filebeat/module/haproxy/log/config/file.yml index c3e104f56d4..ac3846087c3 100644 --- a/filebeat/module/haproxy/log/config/file.yml +++ b/filebeat/module/haproxy/log/config/file.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/haproxy/log/config/syslog.yml b/filebeat/module/haproxy/log/config/syslog.yml index 6fa56f8fe3c..e919d732e74 100644 --- a/filebeat/module/haproxy/log/config/syslog.yml +++ b/filebeat/module/haproxy/log/config/syslog.yml @@ -6,4 +6,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/icinga/debug/config/debug.yml b/filebeat/module/icinga/debug/config/debug.yml index 33c47850878..8b5c2ae7422 100644 --- a/filebeat/module/icinga/debug/config/debug.yml +++ b/filebeat/module/icinga/debug/config/debug.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/icinga/main/config/main.yml b/filebeat/module/icinga/main/config/main.yml index 33c47850878..8b5c2ae7422 100644 --- a/filebeat/module/icinga/main/config/main.yml +++ b/filebeat/module/icinga/main/config/main.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/icinga/startup/config/startup.yml b/filebeat/module/icinga/startup/config/startup.yml index a69343bd796..acc8bd2b782 100644 --- a/filebeat/module/icinga/startup/config/startup.yml +++ b/filebeat/module/icinga/startup/config/startup.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/iis/access/config/iis-access.yml b/filebeat/module/iis/access/config/iis-access.yml index b4797039397..2c845646a4e 100644 --- a/filebeat/module/iis/access/config/iis-access.yml +++ b/filebeat/module/iis/access/config/iis-access.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/iis/error/config/iis-error.yml b/filebeat/module/iis/error/config/iis-error.yml index b4797039397..2c845646a4e 100644 --- a/filebeat/module/iis/error/config/iis-error.yml +++ b/filebeat/module/iis/error/config/iis-error.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/kafka/log/config/log.yml b/filebeat/module/kafka/log/config/log.yml index a745c79562c..f3cfc687526 100644 --- a/filebeat/module/kafka/log/config/log.yml +++ b/filebeat/module/kafka/log/config/log.yml @@ -13,4 +13,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/kibana/log/config/log.yml b/filebeat/module/kibana/log/config/log.yml index 1ad204c62fe..93daa116791 100644 --- a/filebeat/module/kibana/log/config/log.yml +++ b/filebeat/module/kibana/log/config/log.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/logstash/log/config/log.yml b/filebeat/module/logstash/log/config/log.yml index af0e4c33735..407078dc115 100644 --- a/filebeat/module/logstash/log/config/log.yml +++ b/filebeat/module/logstash/log/config/log.yml @@ -16,4 +16,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/logstash/slowlog/config/slowlog.yml b/filebeat/module/logstash/slowlog/config/slowlog.yml index 080a2c4310d..4c6abc278c6 100644 --- a/filebeat/module/logstash/slowlog/config/slowlog.yml +++ b/filebeat/module/logstash/slowlog/config/slowlog.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/mongodb/log/config/log.yml b/filebeat/module/mongodb/log/config/log.yml index 183de629867..b39221031f3 100644 --- a/filebeat/module/mongodb/log/config/log.yml +++ b/filebeat/module/mongodb/log/config/log.yml @@ -8,4 +8,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/mysql/error/config/error.yml b/filebeat/module/mysql/error/config/error.yml index 818cbab297d..8ceba377810 100644 --- a/filebeat/module/mysql/error/config/error.yml +++ b/filebeat/module/mysql/error/config/error.yml @@ -16,4 +16,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/mysql/slowlog/config/slowlog.yml b/filebeat/module/mysql/slowlog/config/slowlog.yml index 7b1a3bc28fd..6893491d869 100644 --- a/filebeat/module/mysql/slowlog/config/slowlog.yml +++ b/filebeat/module/mysql/slowlog/config/slowlog.yml @@ -13,4 +13,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/nats/log/config/log.yml b/filebeat/module/nats/log/config/log.yml index 183de629867..b39221031f3 100644 --- a/filebeat/module/nats/log/config/log.yml +++ b/filebeat/module/nats/log/config/log.yml @@ -8,4 +8,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/nginx/access/config/nginx-access.yml b/filebeat/module/nginx/access/config/nginx-access.yml index 7aa0cdb7cf8..b8aa75eef7c 100644 --- a/filebeat/module/nginx/access/config/nginx-access.yml +++ b/filebeat/module/nginx/access/config/nginx-access.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/nginx/error/config/nginx-error.yml b/filebeat/module/nginx/error/config/nginx-error.yml index 797c45f6c38..173a43c5a1e 100644 --- a/filebeat/module/nginx/error/config/nginx-error.yml +++ b/filebeat/module/nginx/error/config/nginx-error.yml @@ -14,4 +14,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/nginx/ingress_controller/config/ingress_controller.yml b/filebeat/module/nginx/ingress_controller/config/ingress_controller.yml index 7aa0cdb7cf8..b8aa75eef7c 100644 --- a/filebeat/module/nginx/ingress_controller/config/ingress_controller.yml +++ b/filebeat/module/nginx/ingress_controller/config/ingress_controller.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/postgresql/log/config/log.yml b/filebeat/module/postgresql/log/config/log.yml index f69d3e4d387..eeac43780bf 100644 --- a/filebeat/module/postgresql/log/config/log.yml +++ b/filebeat/module/postgresql/log/config/log.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/redis/log/config/log.yml b/filebeat/module/redis/log/config/log.yml index 9d6cae46b38..1c6b6d6c084 100644 --- a/filebeat/module/redis/log/config/log.yml +++ b/filebeat/module/redis/log/config/log.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/filebeat/module/traefik/access/config/traefik-access.yml b/filebeat/module/traefik/access/config/traefik-access.yml index 183de629867..b39221031f3 100644 --- a/filebeat/module/traefik/access/config/traefik-access.yml +++ b/filebeat/module/traefik/access/config/traefik-access.yml @@ -8,4 +8,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/packetbeat/cmd/root.go b/packetbeat/cmd/root.go index 82ab41da374..0a22e98a1a0 100644 --- a/packetbeat/cmd/root.go +++ b/packetbeat/cmd/root.go @@ -37,7 +37,7 @@ const ( Name = "packetbeat" // ecsVersion specifies the version of ECS that Packetbeat is implementing. - ecsVersion = "1.5.0" + ecsVersion = "1.6.0" ) // withECSVersion is a modifier that adds ecs.version to events. diff --git a/winlogbeat/cmd/root.go b/winlogbeat/cmd/root.go index 2cd26a9fe8e..988ac6f9f6c 100644 --- a/winlogbeat/cmd/root.go +++ b/winlogbeat/cmd/root.go @@ -37,7 +37,7 @@ const ( Name = "winlogbeat" // ecsVersion specifies the version of ECS that Winlogbeat is implementing. - ecsVersion = "1.5.0" + ecsVersion = "1.6.0" ) // withECSVersion is a modifier that adds ecs.version to events. diff --git a/x-pack/filebeat/module/activemq/audit/config/audit.yml b/x-pack/filebeat/module/activemq/audit/config/audit.yml index 3e0ec415541..f40bf16116f 100644 --- a/x-pack/filebeat/module/activemq/audit/config/audit.yml +++ b/x-pack/filebeat/module/activemq/audit/config/audit.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/activemq/log/config/log.yml b/x-pack/filebeat/module/activemq/log/config/log.yml index 17f6bd869f2..55449d359f1 100644 --- a/x-pack/filebeat/module/activemq/log/config/log.yml +++ b/x-pack/filebeat/module/activemq/log/config/log.yml @@ -13,4 +13,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/cloudtrail/config/file.yml b/x-pack/filebeat/module/aws/cloudtrail/config/file.yml index 5a56f210c79..c4436629e21 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/config/file.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml index 2094f77c712..7c455f64f26 100644 --- a/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml +++ b/x-pack/filebeat/module/aws/cloudtrail/config/s3.yml @@ -58,4 +58,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/cloudwatch/config/file.yml b/x-pack/filebeat/module/aws/cloudwatch/config/file.yml index 5a56f210c79..c4436629e21 100644 --- a/x-pack/filebeat/module/aws/cloudwatch/config/file.yml +++ b/x-pack/filebeat/module/aws/cloudwatch/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml b/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml index 073eca58ab2..5d2d75dc5d8 100644 --- a/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml +++ b/x-pack/filebeat/module/aws/cloudwatch/config/s3.yml @@ -44,4 +44,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/ec2/config/file.yml b/x-pack/filebeat/module/aws/ec2/config/file.yml index 5a56f210c79..c4436629e21 100644 --- a/x-pack/filebeat/module/aws/ec2/config/file.yml +++ b/x-pack/filebeat/module/aws/ec2/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/ec2/config/s3.yml b/x-pack/filebeat/module/aws/ec2/config/s3.yml index 073eca58ab2..5d2d75dc5d8 100644 --- a/x-pack/filebeat/module/aws/ec2/config/s3.yml +++ b/x-pack/filebeat/module/aws/ec2/config/s3.yml @@ -44,4 +44,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/elb/config/file.yml b/x-pack/filebeat/module/aws/elb/config/file.yml index 498a7906457..e9470671e07 100644 --- a/x-pack/filebeat/module/aws/elb/config/file.yml +++ b/x-pack/filebeat/module/aws/elb/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/elb/config/s3.yml b/x-pack/filebeat/module/aws/elb/config/s3.yml index 073eca58ab2..5d2d75dc5d8 100644 --- a/x-pack/filebeat/module/aws/elb/config/s3.yml +++ b/x-pack/filebeat/module/aws/elb/config/s3.yml @@ -44,4 +44,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/s3access/config/file.yml b/x-pack/filebeat/module/aws/s3access/config/file.yml index 498a7906457..e9470671e07 100644 --- a/x-pack/filebeat/module/aws/s3access/config/file.yml +++ b/x-pack/filebeat/module/aws/s3access/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/s3access/config/s3.yml b/x-pack/filebeat/module/aws/s3access/config/s3.yml index 073eca58ab2..5d2d75dc5d8 100644 --- a/x-pack/filebeat/module/aws/s3access/config/s3.yml +++ b/x-pack/filebeat/module/aws/s3access/config/s3.yml @@ -44,4 +44,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/aws/vpcflow/config/input.yml b/x-pack/filebeat/module/aws/vpcflow/config/input.yml index c9e88b6a743..d0c18047ca4 100644 --- a/x-pack/filebeat/module/aws/vpcflow/config/input.yml +++ b/x-pack/filebeat/module/aws/vpcflow/config/input.yml @@ -173,4 +173,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml index a4567959194..77c7ea3f5d0 100644 --- a/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml @@ -13,4 +13,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/activitylogs/config/file.yml b/x-pack/filebeat/module/azure/activitylogs/config/file.yml index 498a7906457..e9470671e07 100644 --- a/x-pack/filebeat/module/azure/activitylogs/config/file.yml +++ b/x-pack/filebeat/module/azure/activitylogs/config/file.yml @@ -11,4 +11,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml index 3633cc4e5de..43a051f8dd3 100644 --- a/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/auditlogs/config/file.yml b/x-pack/filebeat/module/azure/auditlogs/config/file.yml index 937446eb523..8e77b860e99 100644 --- a/x-pack/filebeat/module/azure/auditlogs/config/file.yml +++ b/x-pack/filebeat/module/azure/auditlogs/config/file.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml index dd8e1473a68..b971be2783c 100644 --- a/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/azure/signinlogs/config/file.yml b/x-pack/filebeat/module/azure/signinlogs/config/file.yml index 937446eb523..8e77b860e99 100644 --- a/x-pack/filebeat/module/azure/signinlogs/config/file.yml +++ b/x-pack/filebeat/module/azure/signinlogs/config/file.yml @@ -10,4 +10,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/cef/log/config/input.yml b/x-pack/filebeat/module/cef/log/config/input.yml index 49a2b1829be..cc911a8611f 100644 --- a/x-pack/filebeat/module/cef/log/config/input.yml +++ b/x-pack/filebeat/module/cef/log/config/input.yml @@ -28,4 +28,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml b/x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml index 12440f8fffe..f447d2aacdf 100644 --- a/x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml +++ b/x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml @@ -23,4 +23,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/coredns/log/config/coredns.yml b/x-pack/filebeat/module/coredns/log/config/coredns.yml index be7f27f551f..4f9992ae2d4 100644 --- a/x-pack/filebeat/module/coredns/log/config/coredns.yml +++ b/x-pack/filebeat/module/coredns/log/config/coredns.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml b/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml index 689bd725530..2af0eeca092 100644 --- a/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml +++ b/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml @@ -23,4 +23,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml index be7f27f551f..4f9992ae2d4 100644 --- a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml +++ b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml @@ -9,4 +9,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/googlecloud/audit/config/input.yml b/x-pack/filebeat/module/googlecloud/audit/config/input.yml index 4c30e23b5e3..b5e392ee0b6 100644 --- a/x-pack/filebeat/module/googlecloud/audit/config/input.yml +++ b/x-pack/filebeat/module/googlecloud/audit/config/input.yml @@ -34,4 +34,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/googlecloud/firewall/config/input.yml b/x-pack/filebeat/module/googlecloud/firewall/config/input.yml index d6579aa9f47..39648636c59 100644 --- a/x-pack/filebeat/module/googlecloud/firewall/config/input.yml +++ b/x-pack/filebeat/module/googlecloud/firewall/config/input.yml @@ -35,4 +35,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/googlecloud/vpcflow/config/input.yml b/x-pack/filebeat/module/googlecloud/vpcflow/config/input.yml index cf89526bbe5..f1976195687 100644 --- a/x-pack/filebeat/module/googlecloud/vpcflow/config/input.yml +++ b/x-pack/filebeat/module/googlecloud/vpcflow/config/input.yml @@ -34,4 +34,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/gsuite/admin/config/config.yml b/x-pack/filebeat/module/gsuite/admin/config/config.yml index b5c62d3657f..9ec19a83615 100644 --- a/x-pack/filebeat/module/gsuite/admin/config/config.yml +++ b/x-pack/filebeat/module/gsuite/admin/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/gsuite/drive/config/config.yml b/x-pack/filebeat/module/gsuite/drive/config/config.yml index 5f1bd6ecbf3..92e464164b0 100644 --- a/x-pack/filebeat/module/gsuite/drive/config/config.yml +++ b/x-pack/filebeat/module/gsuite/drive/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/gsuite/groups/config/config.yml b/x-pack/filebeat/module/gsuite/groups/config/config.yml index 46a3ed338d9..ba6890c80e4 100644 --- a/x-pack/filebeat/module/gsuite/groups/config/config.yml +++ b/x-pack/filebeat/module/gsuite/groups/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/gsuite/login/config/config.yml b/x-pack/filebeat/module/gsuite/login/config/config.yml index b501012b3d2..95ccc04ed2c 100644 --- a/x-pack/filebeat/module/gsuite/login/config/config.yml +++ b/x-pack/filebeat/module/gsuite/login/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/gsuite/saml/config/config.yml b/x-pack/filebeat/module/gsuite/saml/config/config.yml index 1e703737e0d..8d1c7645fda 100644 --- a/x-pack/filebeat/module/gsuite/saml/config/config.yml +++ b/x-pack/filebeat/module/gsuite/saml/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/gsuite/user_accounts/config/config.yml b/x-pack/filebeat/module/gsuite/user_accounts/config/config.yml index 773ab620173..dc9e3d353e6 100644 --- a/x-pack/filebeat/module/gsuite/user_accounts/config/config.yml +++ b/x-pack/filebeat/module/gsuite/user_accounts/config/config.yml @@ -39,7 +39,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - script: lang: javascript id: gsuite-common diff --git a/x-pack/filebeat/module/ibmmq/errorlog/config/errorlog.yml b/x-pack/filebeat/module/ibmmq/errorlog/config/errorlog.yml index 2130bb419d2..bca14ecccaa 100644 --- a/x-pack/filebeat/module/ibmmq/errorlog/config/errorlog.yml +++ b/x-pack/filebeat/module/ibmmq/errorlog/config/errorlog.yml @@ -12,4 +12,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/iptables/log/config/input.yml b/x-pack/filebeat/module/iptables/log/config/input.yml index 6183661122a..bcfde17c3c5 100644 --- a/x-pack/filebeat/module/iptables/log/config/input.yml +++ b/x-pack/filebeat/module/iptables/log/config/input.yml @@ -55,4 +55,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/misp/threat/config/input.yml b/x-pack/filebeat/module/misp/threat/config/input.yml index 3ff985b07f3..26010fc478a 100644 --- a/x-pack/filebeat/module/misp/threat/config/input.yml +++ b/x-pack/filebeat/module/misp/threat/config/input.yml @@ -37,4 +37,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/mssql/log/config/config.yml b/x-pack/filebeat/module/mssql/log/config/config.yml index 31990fb32c3..0ac3d9da2c2 100644 --- a/x-pack/filebeat/module/mssql/log/config/config.yml +++ b/x-pack/filebeat/module/mssql/log/config/config.yml @@ -14,4 +14,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/netflow/log/config/netflow.yml b/x-pack/filebeat/module/netflow/log/config/netflow.yml index b34160bd6b9..f56ffeed226 100644 --- a/x-pack/filebeat/module/netflow/log/config/netflow.yml +++ b/x-pack/filebeat/module/netflow/log/config/netflow.yml @@ -31,4 +31,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/o365/audit/config/input.yml b/x-pack/filebeat/module/o365/audit/config/input.yml index d41a5bb9aab..ec30daef127 100644 --- a/x-pack/filebeat/module/o365/audit/config/input.yml +++ b/x-pack/filebeat/module/o365/audit/config/input.yml @@ -62,4 +62,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/okta/system/config/input.yml b/x-pack/filebeat/module/okta/system/config/input.yml index a544ab8dc65..487dfdf165e 100644 --- a/x-pack/filebeat/module/okta/system/config/input.yml +++ b/x-pack/filebeat/module/okta/system/config/input.yml @@ -67,4 +67,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/rabbitmq/log/config/log.yml b/x-pack/filebeat/module/rabbitmq/log/config/log.yml index bc46f2458c8..1f32bbf71cf 100644 --- a/x-pack/filebeat/module/rabbitmq/log/config/log.yml +++ b/x-pack/filebeat/module/rabbitmq/log/config/log.yml @@ -18,4 +18,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/sophos/xg/config/config.yml b/x-pack/filebeat/module/sophos/xg/config/config.yml index 86c12e9ec08..8585ff4a19c 100644 --- a/x-pack/filebeat/module/sophos/xg/config/config.yml +++ b/x-pack/filebeat/module/sophos/xg/config/config.yml @@ -27,7 +27,7 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 - add_fields: target: '_conf' fields: diff --git a/x-pack/filebeat/module/zeek/capture_loss/config/capture_loss.yml b/x-pack/filebeat/module/zeek/capture_loss/config/capture_loss.yml index 6b6fcf216f2..5794bd0ca6f 100644 --- a/x-pack/filebeat/module/zeek/capture_loss/config/capture_loss.yml +++ b/x-pack/filebeat/module/zeek/capture_loss/config/capture_loss.yml @@ -22,4 +22,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/connection/config/connection.yml b/x-pack/filebeat/module/zeek/connection/config/connection.yml index 8a79295724f..f6caa143689 100644 --- a/x-pack/filebeat/module/zeek/connection/config/connection.yml +++ b/x-pack/filebeat/module/zeek/connection/config/connection.yml @@ -102,4 +102,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml b/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml index 45010e08973..7d7f0c87353 100644 --- a/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml +++ b/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml @@ -58,4 +58,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml b/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml index f1a2f0ced3a..b049d571c14 100644 --- a/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml +++ b/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml @@ -120,4 +120,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml b/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml index 7730d2b6d85..67033a42cf2 100644 --- a/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml +++ b/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml @@ -68,4 +68,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/dns/config/dns.yml b/x-pack/filebeat/module/zeek/dns/config/dns.yml index 86a2022d695..9e0f7e952e2 100644 --- a/x-pack/filebeat/module/zeek/dns/config/dns.yml +++ b/x-pack/filebeat/module/zeek/dns/config/dns.yml @@ -203,4 +203,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/dpd/config/dpd.yml b/x-pack/filebeat/module/zeek/dpd/config/dpd.yml index acc6defd4df..67565ef21ab 100644 --- a/x-pack/filebeat/module/zeek/dpd/config/dpd.yml +++ b/x-pack/filebeat/module/zeek/dpd/config/dpd.yml @@ -57,4 +57,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/files/config/files.yml b/x-pack/filebeat/module/zeek/files/config/files.yml index 65c067609c9..0e0ce22e2bf 100644 --- a/x-pack/filebeat/module/zeek/files/config/files.yml +++ b/x-pack/filebeat/module/zeek/files/config/files.yml @@ -42,4 +42,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/ftp/config/ftp.yml b/x-pack/filebeat/module/zeek/ftp/config/ftp.yml index 51a3c053576..671a1162c66 100644 --- a/x-pack/filebeat/module/zeek/ftp/config/ftp.yml +++ b/x-pack/filebeat/module/zeek/ftp/config/ftp.yml @@ -86,4 +86,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/http/config/http.yml b/x-pack/filebeat/module/zeek/http/config/http.yml index 4c7c812d0cc..8a43f07f0dd 100644 --- a/x-pack/filebeat/module/zeek/http/config/http.yml +++ b/x-pack/filebeat/module/zeek/http/config/http.yml @@ -93,4 +93,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/intel/config/intel.yml b/x-pack/filebeat/module/zeek/intel/config/intel.yml index 5b73833ea35..80d565745f1 100644 --- a/x-pack/filebeat/module/zeek/intel/config/intel.yml +++ b/x-pack/filebeat/module/zeek/intel/config/intel.yml @@ -67,4 +67,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/irc/config/irc.yml b/x-pack/filebeat/module/zeek/irc/config/irc.yml index 54aaa9d4f4b..7e09f9fe376 100644 --- a/x-pack/filebeat/module/zeek/irc/config/irc.yml +++ b/x-pack/filebeat/module/zeek/irc/config/irc.yml @@ -72,4 +72,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/modbus/config/modbus.yml b/x-pack/filebeat/module/zeek/modbus/config/modbus.yml index d656ad0ab6a..a65bb88c0d0 100644 --- a/x-pack/filebeat/module/zeek/modbus/config/modbus.yml +++ b/x-pack/filebeat/module/zeek/modbus/config/modbus.yml @@ -73,4 +73,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/mysql/config/mysql.yml b/x-pack/filebeat/module/zeek/mysql/config/mysql.yml index 4c6e70d9f1c..963c8469fe1 100644 --- a/x-pack/filebeat/module/zeek/mysql/config/mysql.yml +++ b/x-pack/filebeat/module/zeek/mysql/config/mysql.yml @@ -72,4 +72,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/notice/config/notice.yml b/x-pack/filebeat/module/zeek/notice/config/notice.yml index 649d3f3ba97..07ccbfb76b4 100644 --- a/x-pack/filebeat/module/zeek/notice/config/notice.yml +++ b/x-pack/filebeat/module/zeek/notice/config/notice.yml @@ -104,4 +104,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml b/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml index c67f66b54b9..135086e19f9 100644 --- a/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml +++ b/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml @@ -86,4 +86,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/ocsp/config/ocsp.yml b/x-pack/filebeat/module/zeek/ocsp/config/ocsp.yml index 874a0fde6d9..933f829b747 100644 --- a/x-pack/filebeat/module/zeek/ocsp/config/ocsp.yml +++ b/x-pack/filebeat/module/zeek/ocsp/config/ocsp.yml @@ -64,4 +64,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/pe/config/pe.yml b/x-pack/filebeat/module/zeek/pe/config/pe.yml index 3df430d7dc9..cfb8ea8c4b0 100644 --- a/x-pack/filebeat/module/zeek/pe/config/pe.yml +++ b/x-pack/filebeat/module/zeek/pe/config/pe.yml @@ -33,4 +33,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/radius/config/radius.yml b/x-pack/filebeat/module/zeek/radius/config/radius.yml index 66fccaa3f5c..471275d5ece 100644 --- a/x-pack/filebeat/module/zeek/radius/config/radius.yml +++ b/x-pack/filebeat/module/zeek/radius/config/radius.yml @@ -58,4 +58,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/rdp/config/rdp.yml b/x-pack/filebeat/module/zeek/rdp/config/rdp.yml index de71448fb1b..071cc59fab9 100644 --- a/x-pack/filebeat/module/zeek/rdp/config/rdp.yml +++ b/x-pack/filebeat/module/zeek/rdp/config/rdp.yml @@ -88,4 +88,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/rfb/config/rfb.yml b/x-pack/filebeat/module/zeek/rfb/config/rfb.yml index 3adb14c55bf..417e9ab4dcd 100644 --- a/x-pack/filebeat/module/zeek/rfb/config/rfb.yml +++ b/x-pack/filebeat/module/zeek/rfb/config/rfb.yml @@ -73,4 +73,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/sip/config/sip.yml b/x-pack/filebeat/module/zeek/sip/config/sip.yml index 7aa30034de2..97885a1e2dc 100644 --- a/x-pack/filebeat/module/zeek/sip/config/sip.yml +++ b/x-pack/filebeat/module/zeek/sip/config/sip.yml @@ -95,4 +95,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml b/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml index 763379a7d88..885669e4c9c 100644 --- a/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml +++ b/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml @@ -101,4 +101,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml b/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml index c5f7c2e53e7..a3f02a7558f 100644 --- a/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml +++ b/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml @@ -61,4 +61,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml b/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml index 624454ed171..59a68e2054b 100644 --- a/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml +++ b/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml @@ -57,4 +57,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/smtp/config/smtp.yml b/x-pack/filebeat/module/zeek/smtp/config/smtp.yml index 5b2f6595df2..0af383a7187 100644 --- a/x-pack/filebeat/module/zeek/smtp/config/smtp.yml +++ b/x-pack/filebeat/module/zeek/smtp/config/smtp.yml @@ -67,4 +67,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/snmp/config/snmp.yml b/x-pack/filebeat/module/zeek/snmp/config/snmp.yml index 0c7e05ce6db..1fa024742be 100644 --- a/x-pack/filebeat/module/zeek/snmp/config/snmp.yml +++ b/x-pack/filebeat/module/zeek/snmp/config/snmp.yml @@ -69,4 +69,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/socks/config/socks.yml b/x-pack/filebeat/module/zeek/socks/config/socks.yml index f834e5d1bcc..99613e4bfe3 100644 --- a/x-pack/filebeat/module/zeek/socks/config/socks.yml +++ b/x-pack/filebeat/module/zeek/socks/config/socks.yml @@ -67,4 +67,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/ssh/config/ssh.yml b/x-pack/filebeat/module/zeek/ssh/config/ssh.yml index c855d49dff2..45f160cd99d 100644 --- a/x-pack/filebeat/module/zeek/ssh/config/ssh.yml +++ b/x-pack/filebeat/module/zeek/ssh/config/ssh.yml @@ -76,4 +76,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/stats/config/stats.yml b/x-pack/filebeat/module/zeek/stats/config/stats.yml index cdf243f7a45..45c22b6b3d2 100644 --- a/x-pack/filebeat/module/zeek/stats/config/stats.yml +++ b/x-pack/filebeat/module/zeek/stats/config/stats.yml @@ -97,4 +97,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/syslog/config/syslog.yml b/x-pack/filebeat/module/zeek/syslog/config/syslog.yml index a89601cb717..0d1b8fc05e5 100644 --- a/x-pack/filebeat/module/zeek/syslog/config/syslog.yml +++ b/x-pack/filebeat/module/zeek/syslog/config/syslog.yml @@ -57,4 +57,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/traceroute/config/traceroute.yml b/x-pack/filebeat/module/zeek/traceroute/config/traceroute.yml index 13a2a37cc69..741a0d7e454 100644 --- a/x-pack/filebeat/module/zeek/traceroute/config/traceroute.yml +++ b/x-pack/filebeat/module/zeek/traceroute/config/traceroute.yml @@ -45,4 +45,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/tunnel/config/tunnel.yml b/x-pack/filebeat/module/zeek/tunnel/config/tunnel.yml index ac636e9e7c0..243f83de760 100644 --- a/x-pack/filebeat/module/zeek/tunnel/config/tunnel.yml +++ b/x-pack/filebeat/module/zeek/tunnel/config/tunnel.yml @@ -56,4 +56,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zeek/weird/config/weird.yml b/x-pack/filebeat/module/zeek/weird/config/weird.yml index 5807f95927b..4a4bab4dc33 100644 --- a/x-pack/filebeat/module/zeek/weird/config/weird.yml +++ b/x-pack/filebeat/module/zeek/weird/config/weird.yml @@ -56,4 +56,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 diff --git a/x-pack/filebeat/module/zoom/webhook/config/webhook.yml b/x-pack/filebeat/module/zoom/webhook/config/webhook.yml index 207da5447e1..ac04136779c 100644 --- a/x-pack/filebeat/module/zoom/webhook/config/webhook.yml +++ b/x-pack/filebeat/module/zoom/webhook/config/webhook.yml @@ -33,4 +33,4 @@ processors: - add_fields: target: '' fields: - ecs.version: 1.5.0 + ecs.version: 1.6.0 From 92b34600fcb54985bb4b9ee35aa96c07086645ea Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Mon, 5 Oct 2020 10:33:06 +0300 Subject: [PATCH 118/216] Fix leftover delpoyment example (#21474) Signed-off-by: chrismark --- metricbeat/docs/running-on-kubernetes.asciidoc | 5 ----- 1 file changed, 5 deletions(-) diff --git a/metricbeat/docs/running-on-kubernetes.asciidoc b/metricbeat/docs/running-on-kubernetes.asciidoc index 786977cb294..f852c153e5e 100644 --- a/metricbeat/docs/running-on-kubernetes.asciidoc +++ b/metricbeat/docs/running-on-kubernetes.asciidoc @@ -192,11 +192,6 @@ $ kubectl --namespace=kube-system get ds/metricbeat NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE-SELECTOR AGE metricbeat 32 32 0 32 0 1m - -$ kubectl --namespace=kube-system get deploy/metricbeat - -NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE -metricbeat 1 1 1 1 1m ------------------------------------------------ Metrics should start flowing to Elasticsearch. From b9569ff7e7c4d6901e19bcdaf08bde084908de01 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Mon, 5 Oct 2020 09:38:22 +0200 Subject: [PATCH 119/216] Prompt only when agent is already enrolled (#21473) Prompt only when agent is already enrolled (#21473) --- x-pack/elastic-agent/pkg/agent/cmd/enroll.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go index 6a604554136..a92766b9c07 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/enroll.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/enroll.go @@ -119,7 +119,9 @@ func enroll(streams *cli.IOStreams, cmd *cobra.Command, flags *globalFlags, args if fromInstall { force = true } - if !force { + + // prompt only when it is not forced and is already enrolled + if !force && (cfg.Fleet != nil && cfg.Fleet.Enabled == true) { confirm, err := c.Confirm("This will replace your current settings. Do you want to continue?", true) if err != nil { return errors.New(err, "problem reading prompt response") From 3d8e7dd6fe114905610500ffdd0d8921ced759df Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 5 Oct 2020 10:51:51 +0200 Subject: [PATCH 120/216] Include original error when metricbeat fails to connect with Kafka (#21484) --- metricbeat/module/kafka/broker.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metricbeat/module/kafka/broker.go b/metricbeat/module/kafka/broker.go index b9e78c7dacc..2e558d7944a 100644 --- a/metricbeat/module/kafka/broker.go +++ b/metricbeat/module/kafka/broker.go @@ -119,7 +119,7 @@ func (b *Broker) Connect() error { c, err := getClusterWideClient(b.Addr(), b.cfg) if err != nil { closeBroker(b.broker) - return fmt.Errorf("Could not get cluster client for advertised broker with address %v", b.Addr()) + return fmt.Errorf("getting cluster client for advertised broker with address %v: %w", b.Addr(), err) } b.client = c From 67a2d38203dbf04fc1ae8a186253a1e61917eb28 Mon Sep 17 00:00:00 2001 From: Mariana Dima Date: Mon, 5 Oct 2020 10:52:49 +0200 Subject: [PATCH 121/216] Add support for app_state metricset (#20639) * mofidy doc * add metricset * chnagelog * config * work on app_state * remove extra * fix changelog * mage fmt update * work on mapping fields * work on tests * fix vis name * no default * fix tests * add headers --- CHANGELOG.next.asciidoc | 1 + metricbeat/docs/fields.asciidoc | 223 ++- .../metricbeat-azure-app-state-overview.png | Bin 0 -> 453884 bytes metricbeat/docs/modules/azure.asciidoc | 20 + .../docs/modules/azure/app_state.asciidoc | 24 + metricbeat/docs/modules_list.asciidoc | 3 +- x-pack/metricbeat/metricbeat.reference.yml | 8 + .../module/azure/_meta/config.reference.yml | 8 + .../metricbeat/module/azure/_meta/config.yml | 8 + .../module/azure/_meta/docs.asciidoc | 8 + .../metricbeat/module/azure/_meta/fields.yml | 4 + .../Metricbeat-azure-app-state-overview.json | 1509 +++++++++++++++++ .../module/azure/app_insights/_meta/data.json | 21 +- .../azure/app_insights/_meta/fields.yml | 4 - .../module/azure/app_insights/app_insights.go | 3 +- .../app_insights_integration_test.go | 10 + .../module/azure/app_insights/client.go | 3 - .../module/azure/app_insights/data.go | 229 ++- .../module/azure/app_insights/data_test.go | 20 +- .../module/azure/app_state/_meta/data.json | 32 + .../azure/app_state/_meta/docs.asciidoc | 12 + .../module/azure/app_state/_meta/fields.yml | 86 + .../app_state/app_state_integration_test.go | 38 + .../module/azure/app_state/app_state_test.go | 17 + .../module/azure/app_state/manifest.yml | 29 + x-pack/metricbeat/module/azure/data.go | 6 +- x-pack/metricbeat/module/azure/data_test.go | 4 +- x-pack/metricbeat/module/azure/fields.go | 2 +- x-pack/metricbeat/module/azure/module.yml | 1 + .../module/azure/test/integration.go | 20 + .../metricbeat/modules.d/azure.yml.disabled | 8 + 31 files changed, 2275 insertions(+), 86 deletions(-) create mode 100644 metricbeat/docs/images/metricbeat-azure-app-state-overview.png create mode 100644 metricbeat/docs/modules/azure/app_state.asciidoc create mode 100644 x-pack/metricbeat/module/azure/_meta/kibana/7/dashboard/Metricbeat-azure-app-state-overview.json create mode 100644 x-pack/metricbeat/module/azure/app_state/_meta/data.json create mode 100644 x-pack/metricbeat/module/azure/app_state/_meta/docs.asciidoc create mode 100644 x-pack/metricbeat/module/azure/app_state/_meta/fields.yml create mode 100644 x-pack/metricbeat/module/azure/app_state/app_state_integration_test.go create mode 100644 x-pack/metricbeat/module/azure/app_state/app_state_test.go create mode 100644 x-pack/metricbeat/module/azure/app_state/manifest.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index fb1fae91eb0..68b77a46037 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -349,6 +349,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add missing info about the rest of the azure metricsets in the documentation. {pull}19601[19601] - Fix k8s scheduler compatibility issue. {pull}19699[19699] - Fix SQL module mapping NULL values as string {pull}18955[18955] {issue}18898[18898 +- Add support for azure light metricset app_stats. {pull}20639[20639] - Fix ec2 disk and network metrics to use Sum statistic method. {pull}20680[20680] - Fill cloud.account.name with accountID if account alias doesn't exist. {pull}20736[20736] - The Kibana collector applies backoff when errored at getting usage stats {pull}20772[20772] diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index ae34419db2e..26e83c19050 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -4665,6 +4665,16 @@ type: keyword The subscription ID +type: keyword + +-- + +*`azure.application_id`*:: ++ +-- +The application ID + + type: keyword -- @@ -4696,17 +4706,44 @@ application insights -*`azure.app_insights.application_id`*:: +*`azure.app_insights.start_date`*:: + -- -The application ID +The start date -type: keyword +type: date -- -*`azure.app_insights.start_date`*:: +*`azure.app_insights.end_date`*:: ++ +-- +The end date + + +type: date + +-- + +*`azure.app_insights.metrics.*.*`*:: ++ +-- +The metrics + + +type: object + +-- + +[float] +=== app_state + +application state + + + +*`azure.app_state.start_date`*:: + -- The start date @@ -4716,7 +4753,7 @@ type: date -- -*`azure.app_insights.end_date`*:: +*`azure.app_state.end_date`*:: + -- The end date @@ -4726,13 +4763,183 @@ type: date -- -*`azure.app_insights.metrics.*.*`*:: +*`azure.app_state.requests_count.sum`*:: + -- -The metrics +Request count -type: object +type: float + +-- + +*`azure.app_state.requests_failed.sum`*:: ++ +-- +Request failed count + + +type: float + +-- + +*`azure.app_state.users_count.unique`*:: ++ +-- +User count + + +type: float + +-- + +*`azure.app_state.sessions_count.unique`*:: ++ +-- +Session count + + +type: float + +-- + +*`azure.app_state.users_authenticated.unique`*:: ++ +-- +Authenticated users count + + +type: float + +-- + +*`azure.app_state.browser_timings_network_duration.avg`*:: ++ +-- +Browser timings network duration + + +type: float + +-- + +*`azure.app_state.browser_timings_send_duration.avg`*:: ++ +-- +Browser timings send duration + + +type: float + +-- + +*`azure.app_state.browser_timings_receive_uration.avg`*:: ++ +-- +Browser timings receive duration + + +type: float + +-- + +*`azure.app_state.browser_timings_processing_duration.avg`*:: ++ +-- +Browser timings processing duration + + +type: float + +-- + +*`azure.app_state.browser_timings_total_duration.avg`*:: ++ +-- +Browser timings total duration + + +type: float + +-- + +*`azure.app_state.exceptions_count.sum`*:: ++ +-- +Exception count + + +type: float + +-- + +*`azure.app_state.exceptions_browser.sum`*:: ++ +-- +Exception count at browser level + + +type: float + +-- + +*`azure.app_state.exceptions_server.sum`*:: ++ +-- +Exception count at server level + + +type: float + +-- + +*`azure.app_state.performance_counters_memory_available_bytes.avg`*:: ++ +-- +Performance counters memory available bytes + + +type: float + +-- + +*`azure.app_state.performance_counters_process_private_bytes.avg`*:: ++ +-- +Performance counters process private bytes + + +type: float + +-- + +*`azure.app_state.performance_counters_process_cpu_percentage_total.avg`*:: ++ +-- +Performance counters process cpu percentage total + + +type: float + +-- + +*`azure.app_state.performance_counters_process_cpu_percentage.avg`*:: ++ +-- +Performance counters process cpu percentage + + +type: float + +-- + +*`azure.app_state.performance_counters_processiobytes_per_second.avg`*:: ++ +-- +Performance counters process IO bytes per second + + +type: float -- diff --git a/metricbeat/docs/images/metricbeat-azure-app-state-overview.png b/metricbeat/docs/images/metricbeat-azure-app-state-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..cffc6e4ef038e0e7132b0bc87b68b27df29b80b0 GIT binary patch literal 453884 zcmdqIc~p{X`!?);ddhY=H0(x0nypMNO-*pvW@Tw`g}sqvMRln2(X0j?An{^9}r`X%g&^(iHM*Dfyb;h%n% z7cG^Ps#4akc&-LM|9b13OPG?bmN)klUA5fv>dv7GN}_PhN0>r#C4 zqDne(;&}kx_G7uL>B{ojjsI&^^@dhNxYca6XM zBV2TzV%47uJ6}xW750nI@Cf6b17xIhxsOn)F}4d4lJwy3N2&2|My1%8h05UXRW)o_ zS=q!=X6RDn&5f}2?PEzlQolD5J@Zixj@Hvm^x%xo;+>#JT*2Ggs}_F$}~Adz4}E6c4BPT05JrIAPGQA3luKO^!ASoV2XumZ_T9S ztf|ondkMU5WqlbIJ6{)0h+q7!+&b9UX&N6Zo|e=_V9LvN+a1u$0b|Hnd1FeW?GKoP zgSKsUMaE~a0)FI3SFBruk(p#1gW@)}Mp+hWLaqRYb>3#=#v2HzakxSFq9cxDw!_r> z-BPw|e@IK#^75LHl<9QyUPTFI^Ama*zY^?%dWF)wm)|g2%IhC@ z2&bnPr3ruSAct^QyUz2J@Mr~(u*A*=|PaG@|yiN)c&BD-09a+9`c8(xUS?X zOAmCYKdes?Kbenq8{pd&>a(D(&Fg_^8l>5;3jHoVccv_+x~osVTZ2M9Nbj_05k1oO zy(RJY%yl_n9Jt%KP}2Y>ZQIW6EwO*AU{v&Q=-Y~DU!KhH{~0c-47Rd*-8j!am3tED zmRgq2Hl}AIICOCo%ViLPFjBS z1npyk9rea{rj4k_xZ2p*kaY^O&6>Ah{BrhKqvGkBRBHn zn~yBMJCLrH&8sY9m*5Y@_Bzc!KV%v{z}!T&b#&Ap%iTCJ+xxv^8WME_vA$J}&kGBu zQCE6~37LpEL6Cr?rWvlh9XTLtElJ$5TsuULO{veGhYm#-E-dwMDs;GfM@0SdGM#bT zx|f6Ei2M(X^Ck}I>`s0d#9%0dn4f!sxPZkckhwc_2uD^;f9 zyN!$Qp|_UlEF=$Ck-VKH81zAuT%Ouc9sH%F$8R{Shoe|hJTpgY9z_|UK=Ec64MQBZ zsY;GVP=lT7L59JP0@+#oAVCxv=`0!G&R-eHiOReNGVl99tW$Y3bg#+r!xXQ`ICS91 z)Gon>9JWvqHFf^5jMCBY<^T|Vx#mG;3jDhfxET(cf^hTDf&`XYRoJV84pZfV*P*z@ zKO)ad+9+GocJ$Y-8jeAS4>V$vo{8!fj6}zE^awL`kFGj-JhM=b^+-(FE@<3yOF2+L zL*g)<&V$YSwh(ksjazkHuX`xl_GH_p*ZULkZyTU!!V)n~Ox(7QGt8_Z=z&5Ro)Wgx zfY4t?f-2;@|2n$QWtYF~zh@@xxKs`|gi)Q`>ZWJJH_q1&whMR-%e9*O9E(DoVYGHO zwbfyh-n(+ER=M=`|3p%lI$yJ#q-j{nmr(sk30EO^G$1(|Z>fY9di&f8&mfdD+*D1# zb-7c?$kxhfg_t(|0*{tz5J=in@hg@K;tebxXPESR5_rFtXictZ5Z=A)Htc?ozkgPK z#Yl^W0XrLZkh(97gFZR}f_jQ;x#oj;k!}2t&g0U!>V@^hDb+iJo~#u!WuM-yk(h@L ze(i09{_|E|?YoOW{boqgRbO&_%Px-W?SVOz3$fnXR?8l99C$aqekHkH{K~3}KZA?Q zfH}QOkDME3o@ORp*BL#z6jxZ)?>L7R8GW+}ub zTFx2t;*Q=LYw)^kp)u5&Ua~I*s}{>!hg*&tTHuqVYR~z6^W|N_fm96_m#bi}hMnd3 z_xU&Ij?nN@2^?Xtyq#CQEMHg_i|;LnPbm1Gdf{AXNrkV`k+nX~lDP5JKNFKrTzFSw@*Y2(=x7)_ z62A8K;GA9u{~XN$tfvSYrK#PeMTb~oInLmHsNTzNZhpxXv~+XCa^n)%$}CAhX+8~Z zmnpC7oL#6wMStW^AhCoI3)3Y|%P8)1EGx-JnLYB{9Ll3G7iPP|hBIpD`H~D{-yD=| z)z=s@QCMQaF*MPC|9sN)V|-VrQHVWn@dG0}YZCc}P`~ZVg$K*1B3k`4A0b%$^w41< zzdrD$?29uLP3c*AY-BJJtv6S*P2BK70d=5?F*TI3It$n`bTsrEO+_KRSIH=%eCe@( zduqa1e(aU|S1#XXyBAZj_ax`Fk1TghQRABq&ZG1#B3oCYUvX*K@_dvCSzLeruXACk zG^_lj6Wr2?bMXX-LU;6OT7wLVxCWEZ7nYAW7R5NjdUvcXc)eZB=uVv%moUTCY$PVJ z;{5tdPu3sEh1Qs$5QoVZ_#*6d+u(_%?@UGH;vGD4EXDVdq>N_YYSHL^ZDmn}3gul% zkF*UECaUt|MUmWjMMD#Lm}+)9a%Vr?t`M?M?_!Kw@>Wa+mVs|gD?+s8%!ag;cLWZS zId^t^q6?ANU^UVUFw3TfF0LiRR~!Xy0Z zx}3YlMF{@754ILkh(9KTf=tSvGPxKt3Xhf~e6HSSj7SDqY$59DQRcEtlHC2!AiF|w z*NTxU-=iF#-V@eZ(UH?piD#G41N!r}=p)Zu1_kzQIgUK!s9ZL6D^uYN87OVKPCD{q zbX8K$OFhuFzHl_Ct;f<8deme_-M&3NL9w@&T^K}Rcv`{_FZ?(li65X_Asal*`K;)< z62C%2?4>Vmt52|jEOwAGI|03{o#r30+5t4(`@w|80OEuX;bNihnw=tdQB~Aps#XVa zveM&~v?3*&4FeVLIv$G4$jGRRQJV@{6!JsBEA|G9rA@@=Y&=^Jbs_vDZTdB599-N> zKr+8lO||B?t#nRF2@;u&Ibz9iOyrMoL)rD3FAq$;9w986Ho4=Q?n9oGau$~}>N~+= zB(h4eXBFVg327t@TbWFdTbvZ!d8x*8iP-I&wA%2eM=Lvt8Sa5csACa{V;7!3_r}_^s%bNZ}RZSo7s5Zh%7w3=CrxbG*E*N*HaBCA8WL=!Ig>$?UIYX`h%bp5Ss?Z_ zd;AG6US5MbKc7T`v(&!xO#Yb!4f^o?D(Ywgwshz<1t<&FhH%v}|HK0r)FSpRf_EG4<}@T#|)+P(?WOXQ{SYIl2MBLWNh4ym^&u?xM)J42HbHPSgCK z@g~6Dh>Nv5K4lt&B&iFwreu^a2lyJop``)bnc&z4&n8j~>ldIjwvulk1HP-#Uz>oF zs{NLWLcVuYjtU~p;nXU5O1O!Ukz!`VmMLRx&QSX{^fGZrVlDSb11YoueiugLEM*s; zO}t~svJiyWj=xUH&a>RZg25W;bhJPzt4-V40i)WLMnn%WXm5>`j}dD`Es`5ScBfhZH6YO)tOxpy?x`EAMp~{=s~(>a7>xvw zs2=tqug#iBJSKd#@12Xv$AXmAG#>@_TIws7`2H_qa?whcl?TILTuka;7#?MXpyDVU z&Y;>D|C!sp%o%mXO)+KY`z13yau);Jf7avivZ#pLr zDXd0y^GB|G`plE$9~jS{yUr)QRr6$`1gP5P$C;q_eVA3Ke9>}D{ifXtM&LMZU=YBI0;fT{6L2FIZe%tNZJ znj?-e;t9?4E$@+QhbZw=63@Z!z6x3nN>j$13iAdV$965(gdmKUW1{@TrqPoY@@s1{ zYggYy8*qv^C0yb}Alp~dfec=j{*JK!-0UV->0{C{K4!*d#cG{A{%3qBjtX9o{DC@} z7Sos?c430HS!Z$Qp1*bxURRNSsUxhlmb;D!+4t-atC{*7uhVX@i41C`T5v?7{J_J(GFe!|v#1y$#->E&k?=wx$idiOFI^so|&jN-DozVVg5 z{%-G@=3YmC8FyB;sxqeWClp*xTr*FuxF-D25>FZ;sErpw1Zoz8_`bfgPGhS5!^1~2 zx9R4-M36^(-?c%t%<3#azZaSbLwW|blb_cVHYnUTBgednCk(CCg`eBh67E-7IY5pD zDA%p5P8zwF;4_=(B-nrnX0#)B+bY)tik(Sq-VP4wJASC(yZn=y?pPdAZ1Y;mrw+~XZ<{xIHY zff@scU!-HqwH|8v$xK|Rdzg*v@YN111kBDnZmhK4x;=V;xxQFpi9kSdxaf+Z<|f6k zmXxGkO!yoHJW<_L5TE}$B2pX+{pOF}nr5a>rg>WUJxnHWXIBUWZx3s+PvHhof0eJxU&nK5rw+uqy(cY>oE28 zw0LYpwqKTpc!_=IA+>~kp!bYSqF`x&en-GJ%Wc*kw6H%Bi`XnP-~Trjt9BfxVNqbM zs?ksH_r|Am;CPHG8~O$8R)EqQGR0vdk8HVe*&2hpZ%wG%*@yCkrRSH0WF@Vi2kder zDB487WZ}(Kco0yJW}tkKbE6E&eKlUWTZy&$)w&`LBV5CekRA?ImcEdCLN_M%!L$)j zi@qC0BrOcq<9_KiuP#u1+bj3XCXnfo7C3Pnc0yG&LzV`hFEBwL>Q6poj0Rx?lAO zNfjAQt;36>AAdGKNIJ3dE*tS!C7#!oqli!lUnLWyJRdRfX(p;sS$&7@O|Y(!_6dG@ z{c=uX#dfSk2w2ah-@o>%&eUvmN(HER!6L#4ei7Nz>g2LB-^+B0pqJx$ zp6rhCLrn?zo#vWyj`<)1b&M>iyz8B(mSFxfO}wXDx_2txO@3YUQY>Y-h+J&Nrq|8t zTpLFN;80cVsYb#4B()HgJQcQeCAShVXa>DG zM4Yd_mqs=hLcHBCf0svh4-6b?&q8~~I|)#IFa21Elp^jk0$U6E7T?qyvDSF-|FO^n zMb4_fCi*W&9(A;;0I1hf-VqK8yaFs=^qWUEE(j%j%5x7`N@_Xjx-$$4lnEON!6rCn z0dF!LSu9pwDtWS8Y6%B@qGyIDB#`1Q*j1L4a#JmWU-o@9uB*C^$u#QUL#qFB<)Eg%+(rl9q^gKdggj%3#^Bpsqx?L}9 z2}0s+LTr1}6|{9Tx2N|g{v)78y$Az!iTI35! zo|%Bh8{wwyY3DHpiU5--5h$+f9w%@;w6K`b%{i;wB~?spj0Q-iPE!-@#djR7HDktem{0v(HV$(JHYQr;G03@D! zeNvkrY;yZ^LuMW006_3Br1Wq)ANFuq^>1h$Wj&nl%5P|j1$4UkW<&?CPod_dYo~-PHc*~M%v(8<`J5bd8yw5j-rO9Dwkp;3KMFABMMS$Q@b z<2_wZ{We-GaZFk($}uvVXy5FSeSq8EDT(n|j#^Y^`}_NM?k-mA;jYVxICh&`ojK7M z7&8d88FD>MK{(ym_ibDun`A-eeop-Cr1R>uWa#6iVl?6({{6 zGiCKuFTcVicA@4B$kpW(>4W z)y1SD(LrESCa&En9%hbe#juoXntM0{=)55xPGl~{Dg4Ye=yrmk36)mTc)Y1G8Bus_ zaLNmz(OQ_q<~XN#0wyo^V^B2HP$2HN8oAd$NUs)Nr>H064hF)8L5oQxuRWxmgPaQl zuNvl*&B$|hBuWJc+NOSasHfcH3#Ovkub5bc$>fHr!jW#T&-&3krtgL!Mbsoxrp@Yo&nqN$UGSedij7kCW@ zP_IY?IXRxy{n8n&!asOU>oxN0tJha9mlqxl0*XPG5lGeI{hSM;5(2c+hLce!wOBKO75ee|X0sWjD$3Xf-5K%wk zqua!C)f%s+L}c?5w8Pf;M)&dpgiTC-1(cF`d9=92c!abn6|%NC;S=OZ?8?~9d9qr6 zSH3j0QTpL}*vLXG*`4N~{6KKqBP!beBLM65`yHb>dMmMgCX-4b)lHSMkUK|n zr;ZKq9oRcO{b!3HjP1R*v3t6q$@>g6-&zN69zvVQz$tP1PwWw z1580Lb5GOB z$#$(_WU6KJjmRAoI|1JVQ9`m03W9qVxxt^h0su*~n3l6o5i>&AOSp|21$;E70Dp_$)wK>1H$ z0nliqL$lVE9m>@E$gl^g0;MU3)ssGl5~-P7Azm%lu*O2ihB_E1qE!U?c&+z2wLWLG#aDe8f$k+xIq+NHqM4%=arp)Bex) zgj*tVn~9Nkh(Z19=58jOdKr8Q1+WU%u}94!%_zmq%pCHdN-x)E zd4+dJIAsDpZHAAz0KMR^94zDB4nGG=5=@o9`VfA}A;d~~zs%~1rFd4YFwa~wRswpm z^MXq3RG=R%GcWU$AfR96354JYr_+5A>pxgp=c(=GjTSXMguL0_p|*#wRHkOZobUdA z3Vz&~>a@J(Jgph{KW60ESr6No!Vp@%1~UG`0_Rdvn20jqmBi8mh$K}MTM+h&8GfnX z1E#=g*YRG|DGc$eD)(7GHINSM@&3~%VyGn)69Zm802G(YQD)MbRpsL2s#%k!*Jb&G zKR_0NGlsd0RNthRGVRHsEs>)IDV>z9KS`mBXxbp=wv3>L;Kz$i){( z|K$rm$e9ca08mRW>Q~zkgD4f~+aUmvT`gLLTy`G#&{zqHp$dXN#Wsq>NHFy3jx1KQ z#Xl!$9-2bG3%xSD$5RxvAe9~2FccBnBYi_qSB$=H?vuKCczCW^@1@GGGn6$UlGH`i z@dPKH1PB+X2g7?zOhc6gwM7FWSs(1+hPqHFVpg8N-Q{;5^NGs+T4 zU+)e(2X`{})1Mvylu7;yqI%=Lh@*+fGAt=VK>7`2&!Vb)W%X=%G?FWd_kP#2b2*zc zw!k%DdsJX6Dh$wzQ$z4;8JV*~MO}|Q;k+A}ncF(}C1%*_&40bU-A}Owe$(ORyr%n@ zoGrdmnN-Q@&+zK^r7~Fk2;IKl!CHJ@Z6Yzc^caFdU~e=mZD^c9yqO*H5#9j(yhXV# z7F*cY0zurSPoC7x0T{6ZDs> z>JE6>0T(S&yW}+9PZdioBAoiYR`fNiYL!`DQT!L< z`cK^$$}ZEXrOZH$LycW;-}W%Ari(F7{z7@R`6ct0fB(+!jGo*z1wkjHi%s|V?p9Lz zJ;$4En}5heOCiWK{QWmn&_FaZeS*pve>*A-+cvgxzx@iFxdBp&UB2pp+sbd5t-0di zG9HH_GERp6kbV{X`}|5T0=O5NQh(^12;&MKOgF3iQ%Py9%>?-qao#bseZcUJeQ^ec z!FXmI7Tbz^$$R8pj!$ie@rv*ilW?FEur#fo-FKT z<#&Ubg$=)vK>smaxK6>%lMYTkiF-D6%l=%a-49m&k2&GCemleKK3MQKtT))8q_q3OE6FBEr5odY zrLJo)<37dwqldB6pTRKOxcoo99ll+fKgIO_+xT7bzA`wj z<98*cXWN@dH}n#b&^v!Mnfm{)lL4Bx25y55F~rUTD~)YDyT1$@%nI1eB%u_2~XNXYN$qK3EsD8t=UG3$T&u~PSc+c)6D z3rSfT2*GK6QsL)@aB|%*M5SqgQ4YF>se-3hNRfn&oJ@h52AK>uAG&Q6GjJ~V?(4Y0 z+lMR7&KCfZJ_FT+Udfq>UE#+jn!RdX`GPZo8<1D*#$w5KkvT~>dR0ELO+p#0efviP zTYSpGucfN&Y&<8v51)WJ?5+U|wNRLXJv*48K7zI~{V93;+~n}RldBrKkkivzHIhX5 z8YLFX@vujpPW_XXj3kSeY+58Jm1a=a-bC|j(;*1bRv;l%GPH>HprHCSUDS~7rT>`- zb{JZaE;i!g^=v%`;>^dYyXc@Kq{ys!s#D8nzI%OQe1-7%)cCR}%WK;!eEO3!YknWg&*1z4c<;dXdRbe<@cWaO2iqkDm~${?CZYc`NtG# zPkIPwalg1lk`){~J#RJFd_daqxE!iFRX6^W2gsqT=ddDu?o*RFUdCV=WlFoOv~fF0 z`1I1q*F(7)buH{wXI^Hn`uF$o4Wh?&&@ZBW^y+2?B)4YV&JAsMi!B;Z`(c#b&NJb6 zC^ZrMg0gpD##*1KhrJm&2Qq3)U)eb#>U@8>?oIYmU9F{`I-lp>lyGw?H99FOYy*iP z^WbPLNGrV}ih!0!K(L?PM^Dy|Evv@y7DcwV(?g^W!=riAAF53!+K4Lre@uSR-O@I* zk?*~NADR?&VQNR4ecPG>$b0(pqMTtP0jH<^w(;zmNESQu4m_T>DJrK7;_{^{+s*(R z%M8B-lkf*BgI|wLA4xCT$k|`g=%V*5v1fCrTZ?GZj_}HEVnoeY+>ZEYKYk{l&MWSX z4;i_$EV)d&2>VVaG%()>SBG3p0a@sHXs5^ccdG0y zleAQc2X)krfC;6UR8-hOe{d1=-uxy~4<3!tcxjM`Y@hG(8G3hD|3;LK?n&X5u`x_5u(b6Ohn9qtMqCf*i| z)4N0h6P3(gxx_2e;AO`xtJ980zKyjgM7c~R7|L+Tz*VZ$9`Wh|JVpiLcWrE8)sjgfdZnd%+c&R?Z;3e=JAW~I2$c*KzIs56g@aIP;tZH~wp#b2}V z!8X=wziaWX_)R!)psD0!HdLyzv>RcRRlhRm-pD3S<78KO4R+(nf-VZvrxyKLS}oIG z$=r2bPZabx)bU8lRQBPJhWhy#<=CQ2isLC8?|QOqyO!ds9X0#sQ3u=-(bb4`deLaz z>}_r93Al8o2rS-C?%Ks6C+ILL4j)dF?8S;eeBmBkkh3|42#42u0VGUyDcvW}$D_={Nee*%Hy*7zZjBr;o_YsQ@MP^z zL}tpeZ>&g%54AR4rf&)0bSX}6)ma*jj(fh3DFV)Rtg40_;#0ex0;%NR-DtN7u>OhA z^Js1FBKMjj*NPiwE?#r|ogYP6iTMP{z5O-s%;W^HtdSQ6s_FVEb*=Je{2>3yNX z&6|Ce>fHS>fiC9bsV(b>j?MW&w${*k1J|sR3>x&(LF8TLgLWKFL%56O$*Lk;%qU^I z?_n@ zALjb*yws0%tP9Kk$Kh^SnRA-z#VYeqbH+PL{}5yJvsWDI@UnV;{>ZG%yjKkMDDSM0N ziYKy~D;7^b+%a7+vkaXRH-OvNtCBiL1M~<1H%@5J+vUnBgB(`$JzM66 zS*yIi?~zE~0O|PndYsXY2-X}qH!bqHCtPWkzH9h^x`l8hTDk(M*)+{L<5yI?rxLSN z6ISqKWL%MSynJlF-e5e-KDl88+>s7F>)mSIEJIJz+mh7_ET|)FVZ|-<72hYF8Q=5B z7D>-jS~F5z^u2wvhBvvKr`kBt+A^T>_#UbGi$Sw5O<2J<95yt);Yc8GCgM~XuIo_7 zDTOp)z0~J{iFHFKDrIJ7XkJG;IorIX90p&GAI(Z-`gp;g@J*NzfsjougJ!AI$9{@a z97UZkwRuONEdksYcn__>k*FW4e0CkStK;2t=WHE0-Z?ZpUJ_HY%RI&|YZ{_uGCsXK zklx)Cnnz^+672=c#py6Cht9SlDIUD2Q3rAdF`isANJKa?2<^n`_0{6Z)h^z;%&Cem z{9V|UdvRQMPWx-auK2FR=j-*q7(akcJg7&w+&2;T?Dex?-TI!t@`c$9>aR#o7j+3T zCgXKDyb(P*sS^*A<^=pGT*N-u$NhXGg@)#EOn*W8^^vO?na4XL0xpOF`-Td(CT{bIcyJ$ z(}B(dM~=qN5U)6B)v(?66YL6fOx(hJtb^}18ir9C#S^d}#%t_bVe0A~igN`h}L;C}`+h9=!C5vUB;DUA5_t#2Eo*6P1$(9>l8fc;jy zkHaifPS0$a_9vM;nrt3tQ>=VE*oVt%tlE^G;S!G=9!}L8_48>J>?^P^u=Z_TA7K0D zi$}10YM7^5UN@sya&6StUZIWd1^wvEqP2^p*fh-aO0L{8H8zkO7+5&QRPgFZd!s*4 z_r^bSDPU;Qn%!x}IF0f0zN@hFH@oqZ^vI^f;LcgM5k^b&7OupxIwl!E)Zk#0^~rhA z;x1r}(xIW(bM(7&U)!%77FSLOFU{Qp(yHx9WIZ|5UCS@;00-Mikxe}ddW|!*s@IKl zn|a5s490q$)Ym(o5O%)(D}i4}(9N+N4m+dV7{or_m3>Aad0db^HZ!Zg!=P8jCL{K0 zMGBIqUUQbeoR54EB}mKS7hkF0(SOki=vS5lF_7*#0H_MRKTR^mI&f)h2l1}q)fR?4Sv!RB-fLn7<^T@Nx=palPA?&&%hvvf(X>Z5k@f+BBGsiQ z#Jza9X2!Yw+p{E3I1E_i5%#Xr))U~XZAnP&P@mQStMP8B)I`DlUTAL`7y ziROWcaRUL5_tVfF!11afOV-0Qkn@MS+Gm-lOob86w1a$GNA>H0y~JhTKij3 z$}>4ibepFq!)({7VSqD_tcm>Ptz#HDV?vODfTHDU?n2e7=N8b&w&eE|xdr0294FFd zYO6~X!^mW0`#Fwt=ky&Rh^s}WhmyC1pt9>BS&_2JFk*}#=faNf;7=8qA1^|ES{9L^ zkB!Hoq@Ruwwfr&9JmFz+k&0uf{Qmq53412lEVN)DHnt=#e*Y4^qoD~%o*CFx4W8Ne zySGGvmycO2R7VX1hbqSF&ZkC z10tkbcJUi)&3Zwvf*SXS{IgE7BbB433WK%mo=3fGAce>dM2`!;QFJ^h@w?>2a5cBhH$GV-jOaQA)Bd2y((*&vhXu(b@Sy0mz#{>^}wr)m}EfW zt3M4>uT_BF9k4{T` z*OvIH@a@`Gx>UXmEv=Ec4(2M$TqWJ@L;5)E$BEq#h~mW+2#$I6(0Xu>V;HQ3(o0X> z;^n1=>xbF4zP#X~KfRHN6}G3Lx|!@Ro~%urMTr>MrTzT{-Ugs6P9-6g+vYakMeT~N zaWKR&UrkS4Zgn%XD&+A^Bf#4dr&lRG98;hQ7NP^F(iG26+n*;)ghLv0sL zeD8ld47DkGTingmJNZ>Z9~Y2JH4|6fx@1+6p=q&~3-&c(^hz^_F;bSNb7Xtf`Z=I{ zdkGlH2M^GUYQs^@hJOTEjf&Rxiq5un4)Wc|;wQU|m~P_r9@enWwarhVIJfvO^_^QH zG&ja9E(3XpDKU;V^xfi7QC@yF^s!yL_D!Z6m=;;E)&Qp+dQz{_>cIoouD6)DiHg{QUnk$o!biBZ+4XUBzuV08EdPruvH|wLs zN&2Bv-ZgM#bn}HMZGeMH3ea;8BoZPvz+i$}=Dq8JroSixo*Uz&FX2VP^4|!ZS#D>2 zZDYzp@ZX{+3mT~hz?lPlL!0l#rnyy(=N=)yeo+}&I zR@fvVy>RCmLV^`pcj?7z4qM!|DUZuW1hqZYd=b=C8GL@?1{a$^DrwRS(Rt{}3Mlbj z`W8Re*XGbIjcRJyY!st?e7f+vyI zX@KqJTSRsHAFK5+(!C{DscWh~ufp#KklXT;VYdH+ewEI%ve!Gisw`SE;@3yE-5U8? zL6qYP^vAc1UHl+E|;)6d5d)4-^m1Z6KvevDH`2FP}AIo9ji7aXm@tQDj zLGIzte%PXw)5RU};*Ff)&FcKEI=ikVXZpc5Q=AXko)x9X`UR(x-cyt|+C@E@$NjcHY!9$6olNweoInQ+`)_m7s~(qr@a zOv~XPPmcOw1l6QrH%H0G^GlOK9NE1Pup;)sM_b1$y)T%+iG+2~W_!IkUkz4g?pwdPmW1x^%-li6#K& zHXGrX9MR@#m|u{FUaJOyDd?)>?^V@$>?VHvx}u3B%!sMqHc*(skhDP$#KbZV827Ti zRN}2hGL}c~@EFb73)$z}%>|%-N8=w)%hia+-&!rOIu zboo_o{EoS};$g@Ednd4kUS@Xr8~u=y;o!ubKT{JW_m>c7$?JVx<|GVehwhyC@k{L_ zB(mR<+HbN}=0SBLJ;)92B?wIah-U%*Qq){s-+eg<+%MS1BRcx{Vn|kxy$56wv1qQs zKXJ_Gv^p+JSSVyR-&O#2#I&%zqH~68RYdSGIthQYk11>0@0B6k{);%y)i&4}mWjh0 zN?5MjRU@pKKS1~x31azqwVO-SqFl1T?a7dM9MCB+v_3G}c{h|08HmEIA?NP-Y%yQy;(s)0JaGVs15r7h!$#0 zZVmq85zwNvl{NXEVdZ~|=j#Hf_@B@}00M$Twd+WQ76%!}19Y!bHXk_z#bHUy zfDL`3)L(nJBZ_W09K(qPJz(8jf5Tfed_H$1SBU%_R?lU~QA{W<&n9RmfaDz#8c0F+KJ-Fr)&);x zhKWx4idaC)!KPYrV8Vv-YoC_uuiKTbm(I$+KjMu!B|dH6g?050-!fF$?ofn>%nJ6$ z>LT|@8i;Jv1^-5Rv|D%P17;+m;U|rg(?EFZx|NgpJTsz6mo|Xzno93j*XVg2h}vrc z2+(Y@Fh~lJ@7!sT;hc}tOBL5@*jev_^d?^_#N~N^s0_%-yi3!r1&mBzlSZoZ*^|wh z3(-|^F2&6oO^5;Y4H&qno@ht;U+leSR8v_SFzUR{;HZ>wEQko$u+bC*q^qb%5d@`4 z6KP6|5<&|}R1|C!=}3uyC_NMb69`dJ=?OhRAVDbs0*MfkKnl4hPI;Zt_q*$^b=UoM z&mUlM_C9+*`)T{B&XaTbyt2bgeD0*P%m8a8h~mhcIyM(`2Gt8xH@RfSj-8!U(oAI6 zd8uDr@>A!pJowmBnbdisTykVs5M05jRwF)bpM#^YIwqD`hc(k^;|({NmNKl*TfiCe zYOodisw>@9z#+{JKImPX?HhXH5ufoTb<3QdXI%UDI>@t&;Zd5J5?olBKY!Q7z;Hj* zmQ03TIV}c)16*5hz)&Ml^`&HnI7qL#m1z+wGhnNGw?t`f^-ENG?kG_`zO69j%oNQW z(m7Sd22y1Pn=l!R8$lH{pFAr^rUL2%?rCqQp&HMomfv@sshw}a#1S`o6=`S5&HyF{ zvh8*>Y-@yMETl>c4E0oqh9o^F&RlQ8q?Q+#7{8KMa|w|znd*WiyT0IEBKAeQ2FB;F ztpzx3KEbwsQpvl()g@coU*TUkw`NVm)AF4I0UNP+gvgfbXn$3-`1hFJit+*_T4Vjn zbAO$Xw_ySE)-$vQwe_Srr4g;VH!l5JWnL$=yj%%M!Y&WBA(hZ*7dl#_)5)<;1D~56 zI1MCAcOKZ+9Ns$w7^QM_OE-S^U0oBvwXu4$)lg&mW-Z!p@vc-fLF%4-wbIeGKdm`& zb@Zl#v_TV)o0OfrlD(4VzWQmXL#vxM4QYxS>i?nFuxqFZ)2!s%*%jdAy;~Gx7i~rBD26BJD`N(}#axC`ncWWM93q%wBu|9EH9(Mb{{2FrM zcdAR5!I4r~g?~)erCr>KM||gapPqTQN{+O82lzWh;^+TMf9LAum1(c{$W+<4@d`Q2c4lt!=FhB8UB9>1-g`mDJZMKF1E? z@*2~q#gD2L%~*?;3|s^@d&kb@o8;uua3ORqS^xy%#EyYBGt`p9XFzj zcxI6HL9Gb5iVX&zpOt-DP+M;8>-!z%tnhjP zx7Ak7j%fCwKq-iRN;6{pAJbFh`p(m9l9npUEmvnxvd#<*25&tHe!fHAHMe3VCOY#U zJSX&y{@{2-FTUFRKZlGSYr<@mRy7Yi`NV&?5-?9bJHKRbw=wNkX#DrkS@Ry;3*>tz zbk6i_C@S&;X1=x=CY8%jd`I^9!Gab>fXOk3b0kU5*bu;e@qeEB>*aQuwS7QT5%8bS z3Fz0IMHoawzF$oq!(;iF(ZECv*%4zZ0ka5lxGUr^|*s zjuXj@uPfMHeyMfkQO&2c?^nMouc-;M^0H)Nz*J}P%4PV-NoTAD2e3Zty7Pj6{dMcckbV_Gih~w!LPguI5D2l*vZ`DN8 zXIjvW0;YgT@`9E@!)@xmhiaF3Fknz#cLSlXWxfq?4=*hq*-VV|5evD9eFwNRuT?+w zEyBz-de6prwJowt3RGWPJxpd;rcKr>8LOEWc+yQqy{K^FUANS8qaRY6mCax^$vfLp z@_PGih+AGO=e!Ur3W}5A=#mXjmX%+;xc>tb>_vIdR+}9)Ibyl;;6JS-=%qHAv8t8b z7ehr|1hujRGpLEH?*J=|*UqXU6Z0BQ9a;~Cr*M|%^sEQC3-cYkD{-Tj>vKFzI*2#) zHMxV+G`)|k&scUM%>T1Nqp8{QPTg6&dj82Svw^xj{1+SNZXH6nkAhJu z{a7i~i)uHMA62!PxmmoQo1M0FC}Z)0_nn_8271{ZjO2OuG{>05iMUOU>YN+cW5jv} z5$_q00>8NE30Q#xU{3XEUZyy&1A8gog*B{M+AjwbR7nZ49rRk5hKRjnY{Zs|q~U3n zSCyKY{X?~A=WWI=*Kbcu%B2)1v|}E@z`RzMeD&wfI7^yZ=%~S|0lT{l(*81el$oR6 zFuJS}?CExcvc){oNOZ9QtAaP4QhkK-9d8d}jH<+EjJhW3T;|S(5U^Gj$#Xr^w2!Ys z<8&yGt9Pe4dLvWEovJy*u;PL+uO*!ki13blipkoqEel z9^<#$$KGgU@QEM$_cAA~!KB+H-{Rze>U9`G8MXV+kj-b=K7ZEolHB2qQnn_lj1JzI zJSmiP_72fPywbI)($?IX+ciz(bgkHIkqJJ}A2y$=G+kQWpZp#iRx?$otboEP%oz$M zi{dxti}5zEDr={hvNP8QzT7(;&UaaXPJVgfk(&mTh0vd?dPdhMby6(x_G*)31f=W+ zES#j6ckJ~^KtRV`-mAv4`HdQ)(2+*izsV9%+Tuf`Xx<7%$qKQfSL|9;$_rD@<2kKe z05wIp7@QrfBmq8m%U~_zoO+Vc&J2e%iCrPL5Dvsr_%OcT+i5+tAsEsbS32;t^e!hq z8}QweJTFsL7pKS9=B<;9S4lKs(A72%K%>f7FZX!_BhY@4-a%2rfDLQ*)}%|QRZ2jm zot>s}p`^5J`IA)fwbox5OzH^oT^JeX;7J`;)FX@+vpvs;O&j2=i*!{ z>xe-k9wwaji5U!GAoT~bbLqEv`GM@$Q+hHhE4!JjJP^JG#+Xt(15};k18O!{TzFJ( z&y4$M^)HD}3~fJ3%B%GD^e7Uv_cP(m zPxFPz{3@;Ugil@>b*qJ!6gBz=F74;psU%(>7t^KcxT#BqHC>NT@QF)U2l+zN zB8bEw zSLreW)@IQTe?JR)^Y^Cr?i^!KGfX_2S$bc7K*dd11r}xzeMfAQN)$otHR#abXlCT& z`#XY_DaWnFBwV*>-gl@AxLWe*eR_O>oWB9gtTvo5K9_>Fj)$0jynyyweptwx@Uh!0 zpQZX?b-qB!b8uAPB=#Z`U{Ox(gipT<{U+b+M04o3tN3?0*iZVFO#r>LifgWOje-EN zA*ZRJ7#(I7)u3tB|1N)|c7}8AglRNbHeQd=YH6S?1cS{|rPvb4h=<#Bjc`((X?v(N zO!mcWnt1BuDg`F3;Z@4qfvo5j3|X=b?>^*=9AEU-LlKA2-Nf}h)Hi(nS;9l0WQ0-t zrb;(}rL_$&2qxa%yJtA$m#F{Qp}P%#!HGVJ=+(D$b@qkVW{J0>K9*uR>n5X zhLRCpD6wQ{s&OCRaUho+!)+a8k&zNPi+j$ou8XIppBb%b_CF# zmCrtQAJxbh>hWoF1-;SKnbO_NoJ?o3QnH;22rb!Fqv2V3Y`toGI1uf^#ips1gvdRy z&Cr|7wXd4wpq67GeqOwHkRIxaf4Cm+zUTbmWVA-LXNwbl!9$WZ(4G;6Z$wTW=S{RY zQwJUE%_bYbj!UowDVkmDNgo_q17M^bF8EawPmT=e1iHw%htihp^bwRIRaZ~_QVYf! zj%SfLVj-P3-C7gf;_<1i8D|nxI%gZcV+fgZ?#_gcou`SE8g0 zKJP?CcVuQC`amr9qBvt?Z+qWT_L#gR6M`@b4-P!J{LJMJQ=_RM%A^HsC7yCUBCa>a z%*{tgwL?c)&@ZHeSFTan-g;>SxT6>=77X3wRTTm-Yt928GL`G>m}xld;(pV^YtDW2 zICY1gL*08F927v3%p6sjk}17-6gV?qW2ApyKEB!AUJru5PA;Bn(J@HNn1Hcz;;Cn2 zZy@7e$xN|3-sEX7%_;yj9U&nX$|jvzHDiXLC*W9){)e!JJi7%JPIYOdcYoVOJergJ zS+a8oj96NDOP_~w$|kv$zc5U!xo@U<3kRr2W#@Lb%brrPBr><}a179REQvHMMlo#| z%j@w?;_JC$+s6%4r+lv6(&ye~US2SWUnSlPpZkbPXkb0cqUrH|7F*Lf`PO}K17k(o zNH!%=P|O^mF!&>-9mxSD-s#P}?qiIatN6F!;#oXtbfcttoaN`ExO9~y*6MLo?+_l{ z35QfXmYZ+Xny(1VV}>HDO(wdHRuJU^qq+dT!S9!5^|!&+y)G$#%A1uPz-Fmz&LS;J z-P=*`bDAFII5Z#$JNvq+<4G>#E@yY@&xF{z-jd5A-hM|I0SLowI(xCaBZS@r1enop6_G>66fT?t)CT_GKIZc5YzI4(IvgOQ4lU%= zTiBD&f7a=vI7;an`MgcZ>)eGFvVQxGRqY?0Fq#XLx{-paG#gk^7hmHxCLV|H2|2-` z_0xv+3rjG~6?Dgy8&_ZOx$V_-PK}8tzr{iZNps7tGc!cy914vLvnW4Zt0QtJ?Tu{0 zO!53pjleZt3JgqT48&k}3FD*u07Q+_*rh{%H+_=C)X@og1Uf>zb~qLjKlQo{zxjJY z@Bs*c9{({g0k~J>rYRbuc;l6hxoL;w0EZip+DbEXvO9f@)Zku9RnNCy)Zjh+RBqx~ z>#|j=)qV7(-LjpkKK4{j&re0hWX^1Y(uH?VtmK3Z*66x4v*OGd^uU;-`g+#2&jNE!Z}Ty&3Od+)xthxPS!!QyHtM0NzjLC zv|vw8npJ{6*jK-sx)$1^`U%FuubdQCT#1EBhCoc2VG+hqYbq_z46JoC*ihO%eZTxP6p(k8^o_xC&ayIT{zp&!fj^zn6v?^<3AQZQpi1RV!FWbOtN8By+-n*u~ zB-Ar}`X%dhn>E)au~KXrw4K;1(b}B}S1Hp}l99tKIX;!zAsAwUQGQ}7*+^W#6WjP~ zw->$H%t!k64+xaTQ~~Zl@j!f_&RJPR{As4x!b>QCwap|BSZ49EW+aZ3=UTt%_SUDH zM`K!8|M}fOn>f;M$C%YSk;4=tA~BQ|L-jSoyTUcHo0(QKHva3vGA&I%zP`QKX9GGj zavJ5%IQqp1Hw76FKm;!RIzyB2$UJ$4;-~V-k3e?KYTmyvPTFPLyumXQ0dWMe$l>d< zP)T8u`Hk%P@tjNsYpi$HXK1I#GiI3nXNj{=;hIyPM|9tY?`PHTA}=K6M`5_jG(?kX z`~j~fOih2#>eZB+H@s?>!d2WPBPdARoB~F|I!jFue1iq8FLSM$0>ZdB8!)IP}SRQ}vh23dsKC`>}t~n-BM{;VwPh=hkXgYX((7|=(mT#U>Kez5}-23efJwF|y zZZETQdHh*&DWhMdSHqK(d(npKhE^Xq;*bRnfT*sUYQcs|B@fYH@n>A4Eo8SZE<2r< zuz{ai=b-_34>#mvh3gr9(>mHMwKMpmt`PeQmQjv%vj%mC^L5Q#WZJ=r+Wf%w2GtjB zTA&)!G`-~G=hhAVjvd%Tysk0}PpAFNFj;z-{a_1>e}9Cv9C>KbRcdOvOl+gUOZ)V# zmicxU&o4PdlTrW4pzic>INMIk!wVhyC))g}l^7y9=7oA|PTtx?L4k1dTCc8Kt9YH# z1Vy}H30FI7DXoht@NYfGiCzOkAroUaciy05*Jja-j-H^yBIBwlU8%gw7lFK4!BS|f z_5~e1?I77`#F>jArv|1JOa)p}jVA}VsojLfhoRE!nqJ^Qs~)igaUu|Ocj zF{AL3nf(jH=1U^ZxDeva{N5B2@dCKL zkvV}mfGH)fpUv;J_5O`$Rrd?0mo|I!4vC~xlmg-4p8#RWrj%xr_E)cTsv=<+nJ}hQ z?93P2=M7D>k$t?re3l8}s)jiV$9xee7N zja-Jub}F3Vr0KR_U+)4}k9xzNa$8*uU;OR?zNR0Y-t2ozU%Q&+QK?^bxWMZC?T+4D zEDwl}#^g=40Rb_MldA_BP)EfEJ7ycmN3TlKxJY|O1bn@l$?iHiX6>Gl-NVq{4Zq_C z^2()E76f0S*CYXs8oS_ZY_+=jdxuw73r95dT^?qk^2IRb+29cQq{2^zDbo#|lWOK{ zFCqJ4Rpbq$@Gc`|h2PlK7reykzuHb({M?5vsiAk6!>)Sda21x^Sb1P(&Tg6Nb+!7I z10V9eHK`3)lY%xhXsYI_{d0+}k1?wu$JA^k&%S-jWajK;MnD>^f)%djcvKP2ZxN2W z{wCx&Ik`5SBztVu4;dtYI*2)=MtG5K?DW+japKDbmrtQjJUu%SPU2aejQjg?no3L> zQtIPhIhQ}QKOPV9-0ERfiu3|M9>84`peA2aGp4C~-Yy78?*>o0=slC=8_FC4VlG~u zk19NWU~;}PBZ&4|d4}_lqKk%kz7TI^lg+b9YB&WT#AVyMazu@DkDH&&vr&QRi=_G=f33K}hwT*&9C~-vK)G*G@Nwnf6CJWA z9)aQB*G$)yL=rhto@isw+wKRe7XuL)p>OI`EG`0;Q<8E%f3Lt>FE(v4HDx}MgG}B1~w?}0SOY41Jj;QZ3F+_>GPL;iu)rr&V z$WS$uyllH>S2Bwu>rWmpvTmW;hONek3T{gp;Yyf5IBIu>gMWHzF zA6T77#D{^TGNq~2Yja{ch=QX_L2~c2Urk+`_KL_>i0@Qy{g&UxABp>hAVLTdrVDMnk2t?=R;x-p@+hA7w3Ha)jntn6Xt8*RSQ)iAUa( zaF~V2GY-UCwkG6lppMMW2Sh|Uv3{xgGIU!#q(Jh5?E!tGP=`94_|ps(#fZR{)m~4* zd}x03D%YH{Fk=%ufad$>Dl5!qjgK=64wA1RWyFEadu0VNXlJMms}nmzA3{f3HYAyE zEZ|oeetbZv0Zfupm5xCz;mQ!CUkV<=ZO0l@&ylZFw*$hvDxg?@hfJSxQVmKX*&SSm zUYky4r6F%1dy9={yzeVVyw<{tu2xWnf=WAUr)p|Ab@`lU*paD<^3ZawGf1xtb^Bsf zz|>y6hp@_1FCLo5BXbuvh|?lakDw-cRC0mkSR|ui+Z^+Cj|)~qeTiz|8XsXKtq8SG2S*(1bdu?F zvb|()-!GtLfd`P8>G8cY|8Xp*et8W>qopd*Q5kpweghR95?DVHo*jn;WaI7!Ozrrh zRcEW#)QSR9{)4`kSa5b#GCKAjS!&I8_XC{V0g)XU86LC*SoWzYgMgs zv%!cEV?1H#z$e(3QP<>JLv1cMW4<98)&YR2^6CSui}3lK7!m$Vcfq<$juM?aD}QL-PWKF z%d#|e9lik0ZaD&ZhXgc0M}(G1%R6ku<5Xf5RPO;^<1ORP-R4lv`f4QvsN=TtXn9(U z%eG*T7zj<#4-W8R+dP?ky}f{lk71<@ zAVoy8ORl2dy<$~eYp=@-9k+VpRPu#%wDM)oU9(+#WI}NDWent0dt*T3Pi+-HncG&L z_ZGI2UyQHjR!!V0-#+UcqT{rm1BuhrBg)M^gu+9{G+e6EBvTs63tYqca}OJAZ*^W6 z90l*&>ysyQu(zE7yPD_8vnzXC;OWs0xzpT#yJ-(JQ)I0gO&xPa4M?{o`i!=ZZatD6 zplRZ@QnL2+I;Tz+S2DSkW))s{^HQolJ&SPzl+yD;-H}GBV=Qm2io`G>S6*vP!DC0E$fC-7YOA|FZp;C&ZFj-pe9W!N_#w zBl|{W!Cur!YWgZ=BgX0uGgP5>Yhqea)C2bM+elIv&SZFxr-OEw!qS3ls_V24KbUrf%+@+`JqKFglFQZ3v-;@v^)a(I4MfS6z-hPSArRf<#n)rZ-lG6RZ)A)H} zhO}(ho~Bo-p@VI*L4LmX8x25f`s5lPPAO~%pn3F`H`@>dSA*iuls2o-VYat#+Z$L_ z`&J;3p6_*t$qjK!tH0zlFK_S+8C$8o9DUEJq(18oc)sv7q24fF4n2~~(U@Xpbyzy#p38w0G$Z5m7rfl?s&=F5OZtd>^$p^gQYTZTtez4G{ z#%j;hcDdt(xK-8ZecHheb=XQXtq`Dep5>sSTsKf4D5to8w)7|KwWTM? zYi!dcB?3lw-DH$Jtm#=e|3-X$47$7N^_s3IR?836z%{`e<>Y~or2D)pmm5W?Vd9pQ z1Jz*5mKS?d66d>6kW5!LkoIiTm{;Df6b7Cd%ITcl{4P9`am#9Z5QV^uIrvT15q2me?7ku z&I3AjU*!4O9Z#PZV=ND=xjuQ=<_nB^y<`y882W!Vv}8wSxhc%Jx^Fhen8ct7jK1pJ)a+p`TvLfAfV$15POz+&G&CCI${4Suk-~LP@_pf zr-;DYHoI6LpmpS*4@P5^{&%p$3CS_AGD|TYiNiH?iUSp6vhN_TTuQ z>^6bLp1JCWr{Bd92cMV!9lJIbU4bON%DK6o*KokXrU|pUmLzq5$EEy|M!62JPTO$Y(0xfLO~_sfQs`(ybKS;Jy`JyxC>$4j>j~aDZ1^*47s5ucU-~qg7iuzkkFV zXAk^xo;DW%1UDXK=h?j3uc5ABOxf5oSe;=a?Wf92+UWWmP9(Yp4Se?(ke_Hb)k$ z+ZRfdzg}9h4Q(d{_~I*>Dbl+AlkN5sB&^9q2}`e&_Zu%~-}2dyMujE9h*mNdSZ6@_ zG3TNLg{P{2!R(gn;W=i^CCnv=&Z6VlK3uWo&L@`_ysbNr@7D`eNc{NGn<;JZ zZRw=K`Fk*Ul3AMSiqS@2nL!D-V{ohvs6>72CR$r;fjDdtO`q zwn1TiW6^raSuHp0Hg4L@zs}?YV>5fmxOm1#Mze+$#2RM3URw{8rqxDp?tJ?}UFSg` z?V@cf%G1U0Z4>yKgF@;F_|X{1e9ReEY-g1s=aw_5TtaRD*cH}lFf##v!O7`>5&uh6 zxY1Q%;v?8*56Z;!vp^T)BqrPo=j`|TH?DNhf7kFk8*S`USX7j<$dt}EZ2wiDpFdN~ z3so!EsQ9+ST3`1&!@3!9y3fh9jyba%<%$RC73DJUB2eP1CC%I@T>wQxH$d0+INEs! zYA{UrB|vYhI=<2pH_gp=c1I^Kr2_Z(?;Es$f?5VvSJ(F%NE}@)9d8Bvj z*fW%vY2GHDS`STjJ8$YNWx7xESbNG-F(5a@?c-nPE`pPfWM%LYQ=I7-&5?>16DCFj z`yN;|p82+*R^O+0hSd)gy^z1m7>&&Gb{;&42ON*MW2QjY#pD#XU*-BlFuypM8Gpn$ zM}D`0%H`izTyd+t8icd+N%tFzx;cBy7JgK@`Fc5q0MQqoE(1&8g z|HQk_7;cFD?Fs)O)t8oOEiXDr6OC^Cfye+gqDZv>GI1Is9D^C-4QZ>R{&WubVuqq6s_tT*W2{&s$q3nm(Yd@$AX>CyF?Aee|t!} zu7f^Wb}u8hT_Ww0i0$ktcXtt*K}xEFfWk|E9+OA^Q^-_jo9LXvLg{=v-gy|Y)~=d~X%OKG2MOWfXO%w|Y#@ammt z_Ud@2Pd)l;{m#Fzc=;Y|>Y461^YNXvCIy#)8{yOEWWHi-DnWe*;ARYn0+4FhI-eu0 zS6m{CRXJ41PKeZxNU$J>eT?)2HR<%fcL}fvGYrtp!L?L+xYb>hm-?ov*{n5yg890% z>RoaJEQDlVx%+7GtgflK+h*ND0HY&bj>$@K+_r}AnvFI6l)KlOx4fcO4Z6!0nms@^ zN&z@n_VAAKP^F4_Tq=~bhpKPA=rj*- zv_GCZ?+n4yr38&7jfb;JESsb&4n+RwquPPjXZD*IwuhZg&0eexePsZ`H1A|*Txtn# z-9APBIATDaTzH5HbO_MTF@pLx3pPrI%fhnF(hfAVdr%C&sqHp8_lptAI(x;jD`l8l zNVxs%Rc&@OmCE=yXtKsscPIG+f{Mk}%orux+Z7S=r7L*tu7=WerDjhfY zInu?RGS~3wdh#P%O>Z1Pi)%hP=TddV;hRZ=V zqIRb%#4~V>v71a5z(QUPTcJ>QNVcEdN5z2j8;1S6Rdq|H^>#%82c4%R>F_7ik?8vQ zY2DED&>8Iyba)EXv$yAg`X>S|@n{ky=`jd9KfrNP^!Q}1KE;V|zdLiiY8(o6d@!K~ ziLaTt@nENmM)wf)dPc)B^TV_AlWMJQj8Fh1o7Hr998B+q#IXbm9zP;^aVZdQGTx@QsoX$f=QRA2pO>j^%U)Yf&Q?t_G1}!p?rI`N{_YPv(n+lR)Tim)`uYrW+9a2SCaf;Ce4pfcRIVW0S3Seu`LOc+MQ9 zLhFUMv?s>4QhCK?>dnsb0dKO(=r*KqnKE36 zp`0l%fola-X0cu5kNWx1z^ZP0ld$0BAvO4JPB`MI*R5)lP7LS(h6sbdw)i3}*lG~} zAF6)&tC1L}7~f1@_6zPQ3ZWI`I9B-=eLVBo!0X7ZHY9YZ+7r#smuZ*MV5yscd=YTJ ztmmB-A;-kjlC|5EhH^97)o!Vira9FX%#?X^#L+LtLaGzIE@Iv62}Zc1-fRd{D5NZa zq*^?rRy!gEN$aSlxpdhY-M|~KwOVPCJNFRM!Bv52>t!LAG{YLs9!h7LhawSz0(~}! zTxkOH7K_h+xRbXj{1gMJomHv{*D$5uP=$VOH5q{c)h}jz)ZgiEt80hF3wwC}Q)&1B z+VOIOw3F)Y4WW`B=hd%%KFC?9niD8lhJr{#A%rM)7=G2QzGR1V$4xa^jfiw8R*#Z= zr-hkINEuR@UHPW1XkOnoe#2SFl+VdSvI8#JDYF0NyEWIDwT0UIx!Bc5d*2Fz6|fe# z5X!FxzpWTP9`JRjD`HiYH~t|*PK&uYWird^t(vqqce>>)4^4Pgu{#mLsyvg7to)|h zw283>geFfiJw-8%6_(=XS+&wG-Q;!A>p>~Z6<6DY#!rTXaip$WH@)Uq)e#AaGv11$ zh~ybk9#D#5<>wd((`QC!B^q2ZcND(+(Z+1Xd<8w*>fFbp)O40&l?Mh&_Fk?VlUT`s z8#oY5LHVZ_)27?7*Xi?rDJ5Nirt`NDbCRNI)yNNM0!qAuEokTDDuOqzo!)Un@= zFIC25Q1&UsFug>nwJ1Xv_SrrFo=|&aKaS*sp{8n==OUuU4zzLjWtqB-B4{{ zwJkk&&<$Nek7)KURDRMP7u}}TfcUfu$fO)eTyfe2YD(9tWtd?sc2jPh^y{cs9JLm3 zqt&reS-9j%^$1O0aOP%vMc_n(93_kt478~2@_Zmf33vuwU;fJxKKV3 ziM`O{9hcbL;j@;!CZNIHMJ0n~IPN4!f|>V{Y|_ zg+fO3$aUJ&lSZhEGmGhT4Fmff*(hX%8xKhCH00m6sAzUQVtO`xE5ZqBUP3w|8_Dyp zYtG!Kw-@}rySW0WNfZeq*N?R8lp899c67^D5f=>p!AGn9Jcr-D<^f#%nG*IIWFenW z(2l$BucRM*S|l))ow}>es}X@-(WC6{JjE#tJN80Cqtr~6yGv-wa2IT+iL|hde`X^@ zs4th-KkwufH^jc{nf$8Jvf<=dGhBGb|KZV6XvBwcdce%C03gWv3;5jeQop(k((8Q^ zF=?$?RD|N%)eqPl?ohtQ-sZpV3(pR0{F4O|4%!%<{!#URV|K2IhRLV*u#bFd{E* zn43j;YdT_Aw`K63)e8-z3;{t>v9|Q~ZBm8%sFn+{)?{k77Ag7UarLLBvQR#0?c(5@ zTOT4$xLG$F?rqNrj@NN-0HwGH4SldYK`*lP)>!4b#(g?KUhC+!c&h%3DRmY8>Z=_C zHH4UQRsWd#^UQBm^Fu1j;jyzFggZ7`rA~J6-N6?CHG0YNt+qTNZimm$bvV7y#_+ZI zAcrNlJ>4jlgvAY<1JPd8^Y`n;sMky#D8PaI$*MgasI&uc4M5AXAL(a+l8*YBH3&8; zj)&_#uD6{^M>vvKFm3WEXH^8Ftbr!`9(MJ5ZfH2bqsXIdBI;o_V>3{AJgez$>||No zQJvNep3&1pQmXm&4T6%)+wt=`)Tg*jbG&{{lxQ0`7Z4M9G` z&oDFGG-yw=Z?Gg|)hj)9YYY}l1nND}7sLV)+*^@5bw*PIFlK>s?k>DY{ax1;&Oby; zeWSoa8pf!a#TrH%&4wz<4|)C#bngC1D}p}Bx4s8)-LrQpAX?}qw;;Q?^ec1fz?`}Y z;E7S0QyYKvJBURxbvt)YCR$)ZT|^vC8LBBU%|9ZjH-BV-FH5Z^n9dL^#tQIFr@y^Qy;KjGd~PZLFP6(Ki_@ zO!KNMF772ijYoqmoGS0}#zLo%bF{mH-k72OrhYX`)3M56ef`*pv$6Rd zwR&eeld?cTiqz_~5rWvx2f(mKdUjpAL417T%*Oq#8p2suxG>A0Y@MfHU5h7E=e?R& z$7kCru;7#o^R=WLMYR`qy{|Xm(D8Gmbfw--2q@`*p`J&`diuqxrAU|)}-wrUB!l5ueL9VQYxYm3g+hCK*dbdU4d7Y-JU4a?$rhd zv-w^Ao?V&|VfOJiBRb6&-{W36Gjfaw$&nh@XmrGlPn&~~9BGq0HIU3ecH`%b8T>+d z;>xO;>Ns_}?6Z0jbMZ=d0AQ>RfCGJ*(Q z2Sr5Gk7x&`cyym1klM7kBRFCQu>SSC1I#(z68EJfViYur8x2XV= z`JEWFCpxI~m+ilrq&x%^$go(|@@1(Nz2e;ceKIR%RWUtTj%<*_T&l_S1(J^h%0LN{ zmT!^cU&81vcI5(vemLQLW?crt^t4cxZ+~V4Q80145VoYd>hbdoFM$q}6bdPe`P;;M zVir)Rt`u;Y;)2I{BuSc0nr)SLvOfED-JY95?Sg03-iZ(XYr{CWq#;|PVJPAwfsQNp zy8gIE+{3Q?sxdLMX%UchPZ*SJJ&He*k#r77o#nz60R|GR_Mz%}4{D;4A~f43eb?ph zdeSz#=QLs*bh+VYS6A~*B}8|zliJt&tC+FKRx7v&89Wmwk|Q#|SwZ1NK+WHudMR>S za+SNw#g=ElWYgL2$dPv)G5n2a8XayO>@?U|c?~!t(S_x2*nc(Cyzl8IXo&d3H#6Qp zs0kP@Hk%**x-I%_>BxV#HLZLZkT`$r;xFXBMLqzm8gFxB7di#fNx^=jf$zzalxAm~ z_v!vB;4)Ji_x~y2+(CxAj~b;+0kY(51WYx5&Gn44UL>)neYOD07480;!#(}gjD^ob zE`0S|>7D@^0Zq#$;GZ#!zsbi8=mz@09x45Y2@(QfeZ2#yDB*z8=OWw7p_j$&{kfo1 zHY!8zF0g-@)_PNrUK0$Xr+pRWEA`Uft{^!Pv-p)Xp8jb_oao;w{QW^H(AIm~Kdf^e zv|@rf5FqnyD}%hg0bArR1^y195W8}nT>#N_#~uVk3K{hc0d~h0j-3cnqAfa#{g)~? zSrg2^%Bn!X;LfNJt;i+wEA-MhO5dz6cyABkAn?`6YVmLEPa6K9^p?!GCr+!07Z6!v4@l-s&j>qpXQQ?zSq!{=aB{fBI}PPIwJ)Hbka=dqjQA zp06h@f`0H`fa!kQePQ}+O2^k#{Jk+&2k@DCT_vL4zOSE21OET7&s_S7RV&I--+a7~ zTJRN)+A6TvPzO#EQU06gU*YK{p%Qr)2%Yh-{ zv~SyFjAqUF=mYmh0C&dZQh`+z`k99~{2T6Ve<(qQ?cXB*Z1~Jqv=bo#=82-lKaesw z-|U~@xgX*E$2FBEmnixSO$5Gw9q-}e2_tR)1LgpAef;ydUNDSBSRmN&H>5Xh8odt~ z0|7$+9+Ut%iO$Qw5T*dsCI4m!gt(-!;h(G_5Wl361BeE|KK4aYG^(#gQSUprPktpH zRixK9h`kBut@M?2M8F+w`4??qtp5d`(+1VRXJ#LUh;UWA7+AQy&twGj+h!^dmtWQ; zIyt5h)W5-v`#?`YN8lrIaC4)S9!1($He*85G z{U84Q| z_4H|&1Nv$CHBry7ulOS39Cg~?9FaBA_J0w`A5B?Ar<(XZSv~)H?QHjv`Rh}np9X4z z$1i;(0kOMeS=>!Z7~a7etRWLWluV5Of;7$Lz=}%%Tif+Vb>|*%U}hx{UA^zcnKw(qcoOt zz@)WmZNE1HU<5grtC}!glhO@-7wjPdt`r{JJ;&!@>b_z?AqP^EXW^?Ixx0pDZ#K%7 z2&ySPO;LuXeWiD6&_RT-`?-ih@V<+7~|M20^;DjTmHCn;iw1w7rPCLSXhNm!zi{ zF{Yacv+~HpDQZSf9#Ro%lLX<*OAX7L+pExZAqiT#%Y)^kBNl~KC{)loRwszaBA}{329j<2`ViuG;;DL zPM+}~63bM|7-P2KQQ1Oxz$%S1t6eg&wFaEBG7P%<-Zvwi1~)hq3Q)^XgLk1=T1>$SrM z+JmXMH?ak%CWm)y6Q_o3#wwBD!GlXVaO>Z#;=`I&Py#{EBGd$Npe&Xj7liOZwh&( z8|`~?b8yz6%Kxoim47_=Wys6+iEgQubnPB5A5XYeghO3~6$ac8eCSJOuU%x4YHzbt zV)I$6#CROJH^_gUFW>5*Z~9Su=f2I}FU;|W7(Ewd_XTi&LsN9vg8cnx>a>4c7OFn& z(A2`_9B6QE6Q;>9X#=>(etug0k3R?*a|U9c=_y>X z8M+ko9ERWdB+IUmxs0eg{X~6-sW{ z%7q?r9%PUQF2hkVtE-%Dl81uFP#(X|)2Sp`m%W+M%ENH|4L^i*H}P zrOzHCWC1pfpTO+d`aj$Dh1#V;VP z$AuE2@DK$dBPfQ+lFPS4udRrgYFz_VwTy0=_$A5nJ#Lgf$1~4>zCll}-RQ*DuB-17 zZ^lr0FSbmx1kH$`WQ*+rb9D1gp+;yrF^5;NTm3}*CppG}(742`M^kI8MFDS@mb(er z0)T}Txjs(^ApYo&yHLoGk?N@@e}FuX>^lB7Qinrb_dIwx-{v?IR@C9JJLTfprvcPx zq2*yWS=HE>5n*ToAW5dr5=SC!&2VZ-O)G!zAqA92VHaJ%P3 zgPWg|S01a*fj40d1S5y%s!k(cP78^pX$psR_e@T1En`;`IY^{IPEHyE>ZDeuh(TcH zCt7=_n5M$6lK=0lbLGs%|`O=Te|qcdpw zuJR0qHTEXQkhYZp*)TzC(u_*U(C}_2aMtlA3?A<7HIkuHXJ2(` zUG(Tl;_PRY#L8ujL!~TLWeA8C$H88|%BV%IV7v~E6uOUAj3aXE5Sfo1-A04xO%0!1 zup=X@0gXJ84InP)um%<1=?vib4it#467xBK_A|p`+Yy;wV&HhesvHk?IfSkJg3*n+uO+@wxBot>yMsl9inGj#pl~DW0S4R~z$3k&H4Q5LyG+LUy z{eyYDc38`oyUp{aUv*iVyg%`fz6CJQ-U8~qq}`9W>W+NCXTKFD&+7$s3PVep@~i|i zDC;x|Qw^7VQw_HtXi^C^xfyf8r;+K}2X7NPc9UW2_98nCxXV{W-L?y=7Vm@>@np!e znzYGW;j;0x&wj3BDmi4}<4%ydxwM*XtEkH}R2aXy7;`}AZ@4aU`N;uK%4!r@{;HTW zL)hPBP4zM2bbIjX>R3T4-GbiTqs{9ikEYG&%#Jre>-5I{z#E=Sj=XvN46YGA6`sFp z6e4&m$~<)GDGCmsds){iN8VM|BIC%O2v|(gJJ4#$(6}0UqGl3W7BPNM5D4N1IR|uC3vh zt!aSE$;dJ6?G3OBEjbW=r`F033I6r)Rmh0E>E?8f>oP|4U6glg*M6k=R>r-(a)Clx91S=kUT8JOpwE2hdX3y&73YsLP7UQeUdcG%7C-dj zrh>-GeudPpDs@XvMQQsH@utBYz~9psD&C zrHeFaq7;!{11f|TI)+|U1f&bntMr~gAoQZ5p@b@s0HGRs=skpTCa(3qXYcQWNawY1{a}jFmoRn=0;~t6Mo}FM1 zaM!`UXz;%o>0}G6<4Pbd>0R`9cTv%ZR_4vyCS0BUV!{(;ud~5amu*1@~=9xA)D)%Q}CG$3uZd*_zcZ57>?{QGQIF z^^0u6TkGcPB2)ke>elk^tQRF2{-rOdU{d!l??9TL#BU|mR`yf9o7Z+Gtn2LC*GJBKDI9iRg$6Ik(!S(mm5DcX30-b+;;jt9I*aS zRkhP957>Vi`_!kYomqM2(S-}ag~EAB(O^(kL8;nWiP$lp>QnV^p9`LS3`mIhFfXVD z(y=zP;{cCscS%b>^UT782JGHQ9wDL#kjH8esT-dMsA-rY+e2LL-{)aII*yfC*VV%^ zvL}9MkdL_>=^N3Nb`J0M%9~vs>L8Q-`Zu-pSiVyAR(|oNz`(U;xq_SMKP=Bu(+~q@ z2!3Tx30#Y&=0lddMj4`gALd3hD9LzQB1?H^*1G8hyuRVEnn#fy#Z zs20OYBnlC>5R=q;e*7B@O5O5M8MQz2a7GA`@dWkS5+{7k=2?_lRBzi}LOuUHkHu5( zBvkLUX&3wV#Ec4*VCK@HrM@|1NF3u^F;_}(| z8@=83Db)yAmyJYaSLNh!xYVKfo!eS!+s_X5cq^H(!nC?4=gh-H-L|CjW=PQwQ!N@_ z2{azJ3Je^msxgRn`mMgQNy;t7o!HlG5Kh7)`&sRh7ka5$!M&e7H%EPaDXCp(z|~cgK!+u7!VR@xuV0B@$sXL<1ZZyW%M&)xJG3V_z!P( z)#VHfwAqpV@F-FFzB5q@cDQ*Vc_Y5vfA`X~fyh)Pr*Suexfy@S)mKr=jmVPX-oSu0 zkMQ1G>zjkJ99?8g1E0!M_bgYsFBw}Vo6XL`E38)Lgw9VhF_tHChr8gpa4B!FLz z(iHPqb7r^RU6H?K!OLO$W;Z|C{;c6_t($YHz6$KP1fh-K;r0KN#}cF82Y! zYXs+uR+3$Yk_1U@_CDD{Hznzaefr!t)Sf+ja9?-aNwQgjnmA=(q!}e2rGbfOw7Y5E z$Z`a1YanZ>4-y(8b|7PoocY^Qs}L~h=M8i0!p&f#OUE>pd^W3bP~@*->t^CL4bIhu zr`$uVnvbg9FUkGRY#G0LQhP_bu7;L8FQR_o+@>YeZF(p3WHxghyY&i1uf@;w83xc20A3-KY{GU_uA{vxES?FiH&A-g+X z-Nz6-2@kWRiIg zBwU*cI9ogA^UU6L8Sr@Wi8D15Q07iKovZG7J$U~wc7K%lPKg>NjRg2)AxK(psGj&mU;$FaIWrb{z1Rc+(dAs@82e0(>fl5WB_n zCv9Fb8mUk*Qe+nD@>n{Xb!Kf|I+M((*O|#g6m=vjE$7bAh^-6EnkIAW<&1M>&hSSk zD%i@)S9lfKeg$3XCXpsrNIm0U`rr9LG9L=Gal}YmH}rp0_bFiQ(wITzY-crCCb>he znJ&R8x141vaTdYvb@RP%8UJTUjS;oD)vl*W2eg8Z;J+*ui&X)(dnVHL4G(`9 za!l3TFu%d{CCr$3=bgfB*HU}4;*L@hl_=-ixsuJvpydJmRT zXD~P$R^-jPWwT`GgOLY z0|%ExK-C?4$sRFA?q##)-#N1DdZ_ssmf1!=xk3ZZ8ZZka+X!055A=hX`p%Gn=BKKR zN2#^G?dt|=2_JqG8i?9Tg47o0p8KcPC=q+j-VL#4uB4K_XRC99@!aYShLwVRQF zuFQ{SA)NV@N#Cto%WvYK{J^q=wkOd(?GUY!Q(R=U>2n!fzx(%Fb=4h@R_rTZ_0g3K z2!ap-sp$>Bgw-48)~3e42>l32u0;r)!;U*~y3Rv$Gj|jt3qtA^8m?2OCghCI(@?;} zx=c>b7(b_A1~&5h{0?l%Dr5P@O!k{GZ*e47;Fj<$0jD#czIk(N8^_LWb`1Z#o9FCm zRABWYK3VUsaNjDzuIT_f%6#QRBlVZ8EUhxZ%=-ca^zjGe`vSht?YA0f-hrQ(sU>6@ z!pb1e9MR0@tIqnbXq*!+fpu;2id-^j4wdiqFJ&#TH<0pJ@y@ljERtYr=X$RKU<0!O zCE00{u;NX)wEnJOTULLR3CTNqD|TK!${I*i?MlDxI7A?vBSs>p<#jaloA-cRPV z24BVQSOWX?s4smsdQ$$LmIgb`t-BNLA&92bh2^DS?2b>nps#@=ePCc1ENEK}FRAfI%Wj)v42M;+Nz3GtNm@s>s=w_{-t@nR|kTH_5p)doy; zR$?_P@r#+7tI2BOEXL3THh(xXDJOXFeB5JZ*p|th~rMaZ=;5(N~j!E?=i2% zEA1JizG#MqFiOM$4Du1GJ{)zDUiUbk)Vcp1;z4%M7B#(K;XCGo6DLTRl}3-|=RK>| z1PY(UB0m8$D3Qu8|8ESU#OWtv)AZ&#R3QA*Vm(u$xZD#h;HV%345&56cY+hYuDv`5 ztDS5cr<7RVUZ>PG-FY$)x>9JqCAMTrpJO}8v@PxTRl*(!-WcI@r-z?5%i@%f-+a}K zJ9NVG@MK3~!tDa*=Y$^!WL|TW{9H@`;dk7(h{@#?zZH)Q0X)30jkl;4hqbPiw z)W&R%IZA@uX`^AJ&5@Nin|MQgogq8y*QWO;=$-#c3M(vkaadHQ4gjF<^ZA2)Bk8Bo zfP}N2OU6D}Tv$-he|~oJs_F~fO;uVur-Mm@i#V<;&x&VwgT{Z%yh&TH4f|}}6fx){BxwO zB4D!*BWdjU!wZGygtUwdR+;6VTRcO_0JP13eWKX!CG0MQ{ga(T*PRFVx0@6ylu(N^ zYv_!`rlH-kn5|eUNvjSq05j1FGi?Fn$kL8zupE)`@vYQkZ=Wdhq=j&x+ zBwVEo|1Q{Y?MqWrtM6LDZ43FW#!^TSa>N!Gm)P_S=wR|j+7N$)IY|yhTeg(lvM1>S z=GPH(Ea!Uj4EdMrxO*KQ`)kvFhvnjb)jN-w&PT61$hJ2+Ge;Wqe))DJg)9rERO?^$ zyAgh?M9@+$F@rWQLIml9&2+kKbn!Pk8bzZ{kr&=xlu>w$76&aAg0*oV5xn9#y& zmU-r{fKaN?yitBKwIP)0?;z$vj+bkvR%)6ncCbL-YF*u7*c8@GAzBR^YljVUb0OSq{Ys*5*#K!}Hw)2&YqzumFd$v6i-W@G030KqqY6 zVkD1oXvc%?yEj{JtD!q9HVcL@e9M`ZoG%!1xvo<_|Ax(Yio?}p(sLw5V zAu38GZt+xCs>ufQ0qDB2ET7S9UOq!67;!|QM;=L4u@=(ua+33pdNOwtfPU*qceX}F zP5z}246?EoUah9>nVd%WT#n5_mnOVvD-bQYCdi>S)gWlrjqq_wr@C=%QVH~xRdfZE zceMeiXZ=-ew0=e%b4`GB9Fy}X<)Ckgneq-|S+Sj>P%ZJK^lF3f1Htnfb#)i*%1tlT zg1?wdoGEwS*c(R9Kd5ieP!>+UqBp^E3vA}#Y%W`5!aLddw!!z&KA}@WADt-tRM5$B zVL_Dg7y9dAv|K|Zofg>HY@+;DW^P#pU$H8q?xjfrfqBq@Xy6FR9CN6HJ#j>TIaWG< zxEXvld0bD{&(!DhPhC=ldl~|S211aBM?ep&0E_-a;KmN^1-I10Tu%_Q&)a)CbeyI> zMhC#Gz6?b{5nHj4fc=HV{&{&>4b#<=?)d=!HB-3+Q+hN4w%-S_tUnIQP&m`cCm|}})_rY? zeUplP%ZuV{@|<}rBk(wO{ol&kVNCECq5F(fu~bpmgd5^h|Mmk9o6lV}TfGG>cSObA}C{Cg=Pei+JtJ7*v6*7@&c9{K2@u zWBGi{KnMhwC;R>VTse%6PRh7h&SJyVMmrIhLx2r3Ny=!`O!xMb{Z(lRrSDEF8W)__ z6{c4%S9!82rxWN4-ON4)?@Z>14AU!?X>4MxwX4mQ{;FOJ>m+A97~Wt>bSI@r_S33Z|Znmd}Ju~9O5+7XXC{7iLeJKkoxn2PQjnD zt3Itv>{99CNHqZ`P2L0VO}SPKxugX9e~so(Fx+nAZj(OVs7C1j>926sx=WjnV%k70 zi&V)VLo-f{nILc!tJVVdX*8Dl2cDg#dL8MNZH10ctD6cO-ls2CCvixgPX~?P=Pr3s zIhzn~P`uV){mgc~b|IVx|7df#uf45!omBjr61G1kuTi!bDFvU@Em^sHuOO$PfJ~#i ztQIPv+ns^4KFo+qh6?(SO8nYa!a8f#n;G8@ZnNl>raS&mkvUo$>$`3Tfuu5V^`i#w z$nlZ1B3HI|cazy)F)?>^b!k}u;%`KZXWEu7-hwH4NS`_Lv(RnE-U?FzzBYBs)QM*Q zTIUY*(qznRAh5Pk8rBIDUcJ-CYau?mTVsz49If}>8qKGQi>JcJgAqM@Y5^=FyIgl? zJFJG%?M@}yHV*dX68_1Gt+!0`H%7%0!FbNz82ywC8)CsN3+X?%-k-+R5>j3Y$^2J^ zw7B1{G|)U$=wkfgv4p0Qm$f1P%=7rzu17yE(tPzWKi7!8_#2i=pOM)ZIGT!mQPX;5 zr=(doXevRZgsDq>6S0Lsml1nCIi&Bd(7l98)?Z*y!|3{ zoM?N-lGIM%)uX|U&alry8MeHCaK0apH@aSIr+ZGN&;IWpWa;d?RnLAY%fDOVzN^tY z0`s{T>b+4rMgyl`7QD`D>cWjRPrf;=P=0V|h`GjPC5v}a8 zyRxUK9j6~S+(4{#xpfvhwszZj0D330F%)b4JnNXAet@r`hrE9dN)i0aH^TR~L?VFg z`wzFPi>L&O56qv#RrIg^e){HRY5&hY{>wZm2xShO^*0Zvo|y}6 zJFfGLA9#s;OA>nKWBP7ti+g>9>1+$MhPr9~o@=kE{CL0li?!WIo+}b79*TST>l9)V zNzq}azy5Jq-aD!}87i4DJ^T;q8vrFaEad-pssPnyb1(kicr}b#k-gsHz1Dm^L!H3$ z+DfrAj4p7k80#iaQU&+Zq9?vD&mLa;F`eRbX4R=FG?#P2({Jtqllvin8Fp4Dv&Km@ zmpZRTlA$C#ftN!~J#zkU(Iwcz;vd59BTHz+MprVzQO|)HkOx~I+S|DPccM?Dr~$QU z@_ZZ*&Mch>A+hypB^g^Fogt7;1R-X(mSs<{@duKhx)ym%m+f(ItGAV$zaT(}*4@A_ zbgq@T?#`Jy+@6VtNs$U$TpD+N!Wk z7}uEate+$oOO);_x0PH6QAIsap_JW*EIF==40CI9f9@zV z3~1$&;{PzN``F&EZenC$Rh9beFHI|o0k{ux6#h(gzCFzTk1`B_qkp4r7_wTTG3q6b?40_b4 zm;9++-UZ$7g_Ii?rY~Abdqv{fZcZa5&(&ZizP2_=XnC)4ELBTo_3V)A4Lis-Uj(vT zjPt>16jOI!`@e_rUxUpD?kvDdiJ4S1#2_{Qik1FG3F!|#FU|Gdce{duzMPMF8eLXy zoSR-2XN9?a@I>6#T?VzYzKgo6BkwOIgRx-hQ$BrK@@i_5djBeUR`36R25rjPsGnvI#`ZP> z1ajW%f(w-NfxBz`HK3D@CIq!Pu zJow_*2V`oep3#r_Cja;9yH#9@n-~g-#YVRCmYq%tBVsZ`H!J%`d)2KRf%NzLTjf9Y z3!3;_Na(h11+m(>kMa}<#!OYy-_EeTkA~G4CmqdnK$IrJd8D_|--gPlfZU?WGHKj! zjV3GJb$HT*yDJ9e&Les^bP)#;i4eR2nEgmF|$x2@XmT|Rl>rOh#au>$c%ON zp?%e^$me9{S4IZxL>b^7NkH=bNe%0!4i`K9(W~=o*Be*pZoCgKr3bIv&ohFye=PZ$ zelxUonJr9;;B?DYWP(Wskbx@3?$6-8nv8$Uspt7 zHHn0p%i&=^@wG~Cpe-an4Gg#64pU6O=BLy7mj0!!*u{Up+_L%ILRUxzy0_M4y(py) zV=Rwh(*dx+0%4@Kaq%pyVN$-Yp0{1v9oVuCq&44o`IJT19;s~S$w_4L|MdhM{0&M5 zMjo=!;J(5C)M5TK-flNOLeC0t=b0IZRo^>Km_jF;??qb^5B-i)cxJCrQE_rgv1gdo ztWRm3a~!AqnRS!Cf9%(#z*lE9GYh7=l-ZSJB3gsc64b|2p&O5Ol4~9|{q=v@M7zQ) zy3;<4v88@JehuGjoie0dDpMd`bGArmw$^Jw5>`t7t|e9CHPwFB(u}_zCY}S4W?}tB zA{b{p6Y#jp`cw>6QesyG;)8|xA2F2;@FjRfM!WBvwg_1uqur$V2ulS8rOa%fEzNw6 zZS3v8AqjiVT=&n>!^U2K$Mfg(KdAiVkbpBNDgvM7*Y$Jnb3UbH06UI9**~~goD2;b zYxd`5h<7Tso{41tyJq?h9WBT%83Y9J%)_T@?lK5+sFu>bo>$n6Exzt8$%?I(`$4&f ztDSeJy;vad#T&0WSazTt?`{(1^e*cGGiR_req>7n4?N0N$NKu^M~@!$V=%HQ&9X$N zJ=ha9DB$WZD2QS+_Cp|Z}+BT8WqM{KQ6J~Eb_6ikB?-G;mvb&EC z4LKZ+3`*^~;CH!j=^Y&W|M)Wh2B_IyJzD7c*?8nfzl2cSUglJod2X05|6YeMB)X#Q zG{z6vvI~F&Xo35xYBx7I&)%!AZ_v`#f7ka>rM-t=$^RAi)i71PcLo!~TDqH8C63lg zB+@<}`v>wIzXz+OJKqM5urHc@nC-@!b>>Hb3FAUkU33=eQ4azDCZf?#H{5OPS3^IL|fH-$xzuYoF8 zJ_a0X-<1?22ey@&%gg`m;G=Rnb!IR}I}Q0Y`T5=F@ecx=KHsz1N`$Ca=2PQ5OCU?v z_e2>z0y(JZh=!4Hn@I^^cO}p3H>3BhJ5Y^3!V?)iP4vRQ$rIS0yyX2y+!NEzKy~{0 zw$gIqp#&xq>Vx&5gSB6lF;Gho1Xo^g`hlbi_y{ST^{nZj_D=o}^GK6ge<=o!bFI^E zBG>&r6eF=;SnG&CfuUiMYQ2K&S=sgD^U^*s;+&Ot|1No3FU@PzbD26nF_xQ z6e2%WWj%+F>H#Gj<^lK1N+Cw2@v);YnGk9Q8oTEC)~*@^?9=OviOn=qoxL4gK60A} ztDV6$QftAqKE|AvMp*aIj>U&={baqLf9d`bcI_V?d~J5Mu?(hc`G&=R#6vqC z0=_r#K3jN4KK~haGN5m@f}H~J_=pot3tc@OvPl#9;=)vWQ#R(4b7svRLl$7n1mL&< zsBV#?+Sz?GXPVUuPrksKwPgJ3{}bx{tKgpo?ZLw+T|gRjgC8gtpL|^mErqOAE+bA~ zc_v_%65CmmHS%i)2ESHT^LSwX08DKQ&%t~jHDaM&7SDuTx5Aty?!Q(ylDL1z*zbn) zUumdx@Fr;T$`#` zH|?-|T6bsjj~o|5DO+ElyBg)wPrE(Fn&G{Q5}SUS8pF*x&4fiTP#kk#_-qd+_s804 zxo}JOc)dPCu>#thytQ?rm&O1EO!IffYe24hxZmyf*aswdWHCy@5T0N)kTXdD~d0iYe(mU!VR=Q4or~M z#YOp-&J3#PPM7XBDxCYWvXRln!?g=ph+m>=1zqK-$?@TU_X^s>^*lpo{uasJ-VQa( zE4%-@1pLr@OmWY?Q75^u6bCp5Q~f=LBs*JNP1N780Ov*~K&|zS-9uqOpJGENT?2-F z*NG3FM>-j%j#vNKKROT=Q;SS~`c2<#auz@3y^P<3(sB-}7hV zZ0ru~2y^@jRlOB^M;|w-+P{pFGOxW`KzU1PUbbVaq#A-3OKs1^uAbL$KfbwCrsNWq zws#?#P^PTBt2U!w?Ry9Xq}~)>kw{$O(E|1ze{ZH$rvpQ@PIZj2p`-{LTLjzTbB+Vd zRI#Mn${_wt2A_;qiD1ytY2^|rE5(frmC4?okh{g=R5EeoNJF<{*tDU9+1epjDj`yW zHs?O$_P*;@7)-MkTh-=JmRaw8>G7gAt9SgdbG~<-r{J62A{53Yl64~nD?CL~ z6Fo&GgLImfYr`Qa-2oCACklFoj$4neDcWWbmw**o{q_j`!66RxHXu00E2PrAKqf=k z+wQ&WPgJ8mS{K?R4;w_BT7($i~J96^I!RYii@lY;Yb@Up)C+Q$E z0W%YLB~LmvE-gE1W4(XCuBFH}`ROx_Ho$)gxTtb4-QB!j0k2ZwYj~VH6`O2PlulF) zFmjAH0iT3k^k&Ar*Tk#z&)s9(ws*8Xf#bIaNwJ{WHdJ3sg$iv7aIXsVF2Wz zcJs3fMP};RhXKS(s~1%`ru^fWCi_%t6B;84fE|H?k}^8s*Q|ATR}`u>EIb7BI7H-5PbMLVA2Ds-x{SV+gQP`thY2*1uobaroBuZ>amM(G5>a>ME~Xqcsf$80aAEjs236<&Odvx@v>{gESXF0EITzeg6* z=-?tClK11L+F)}Vh%ljjVVS{al^0GQA-Ok~d(&{&#Gy`T(pa_yc^PEgs410cEA|sf zx_&eLZ`4D;SPtGD-%KNFJdc+ zM3JTLA9*hD0E3na+yff#)}aJ^+Mq6Ww0=8+FD@=F*(vhw9(t2%_C9#LFGO&H_xDny zG-gzM<@SFAfc>5IpmCW(CwqmL?dNmz=L;p`M8%O)T^HFcEoVzK-zB=jjKv>(Ol#yY zZJ>U;lv1Beyx{p)-?hnD?A1`l3s{RaEVI@?Jl{z5+Vw-5b00R*^|q=y6P(XAjs;$? z>L+tC>G|TicMnQ=I%_AcdvE_xehs*o_?!U5C+ZefJPORg_&Es+S@F;o;;vJ1Ave*k z!&UEa@TxN_YkFZ>iGg`I3U#m49hcjgEquNV@C_Hj10){Yuk1Qr%WUb_!=&5cw8I=6 zMAE~@5^j`rF-b{FXR}#Lw!-6rz}1F<-@feLuH3N;*o#Yklb6d|llQgZbl7@Pj{A(9 z-|p*e@2CBGBF%k#ZOyi5fj3ZS2~J^`U->mR4f;U)Qbx}&!af3)))u5@X3^QTxi|^Pf6lj>^Qw2SDNx|T z;mmt=om4*)DodCwQh;*|T^b@tq+LGkZu~;JSB4>X8x8Jty@htQtbd~mc)Z7OS#&~n z*LS%hx~KLLGk82p^}^wP-9{bBdkiUlYcFi0d6H?*99&-@d3=kGvG>R@tgd+E`nkPH zCU#(tvq!Vu9tqzyRSV@N6eEpaT|(FEfTWu4NuPu=YG3<}Z8>0KjI+V!Sc;}{ME0ddwzUIm^Zaa)^)&kEOS3K z0JG6GT6eB`b1IelgaiXjv%%N+xF(pqt@4h~UQ>}HgIlIj^(zM)UdK?kSXL4@Dh%;5 z(aT}8a7YFW@c@zu0gw!0!WV3WiGOVmfO!EQ5`Gw1tL3|S<9+MvL9QR@RO!vlaF>a# zOHmp15jyitF|i4hfzwBt>6yTp9;fnVzwZF8Kl6^` zsOko_!N4?9j7ee)a7DFVoLQ5KIG{ui@&Tv0Cu9Srs7sK^6gUm=Gu^rE+co;+^?!^8 zVTCnE=ZDlwVgd83-4p#}7d_sHj!AlQ^6-rXm$a0lU0@hltX&W%1I8E=ogZsxYEp?i zP85}t^4=S*7XJ*ZW=&r7@RigHYeY!jdT_y{dgWWsIN8vyrPcVwfCHv^0aJN1|Ezk= zr=fbg)TBG|<7`g8LIx2nno;9hh?)aq&bt=eD9qqsvq3DYCT?PZtdofoYblIy0tTa| z7Tgrp;Aqynac=R+Zh4;|D-Z8ASRvTZ^& ziNx5o9o)CV!qV^M8$MZZI2C|Xwe%f<4MU1fx^YZ9@&#=4ep3Y!4( zY}Cj3DE_7bSN)8!QBCoUP=o4kLk`T+@6EHl#th@#k4*P6USQW0AH|Agp&*B48^ouv zen!%Q+TTUl2%Rs{@-uWwYY#F=Fhjj+*k!{5f9}e@o8h@#MjR4V+DmG0=7Oe%F?qwj zUCjM=A6bLa7rdx}L=@5uADp_0A_$Up6kpGhNa^c`T$c5h!W+rEYBVVHlAme_HH$}@ z&zl*&?bYAU`d-zp#JYCQvv7}1-48_Zj11V1@!Z+D?6O~ULEWf%OY2fE89brnH?d*f zziSUwB^_{a-K2ts3`H}bHeItl4yhHfIxkC7;Jux?qt78RdzYumEO*1JJ#t+t)a)Ld8a%RNmoQ!; z_1a}fhT+|+0d>O;OR-0Nvh~Q(xo)!Y{>0=DF)mJVT!8MoD0UMJLc11!8gT*B;et{3 z^hV=<6Jjh1^uCF3OVUCxj{12$g=EpX#34l0y`Y+vmgNAaR3?Co1oWoa<3{U+bxIHU z-P(H2w|8_K?5V}ro*bfe|;aXEn1z%-nR~BkV=2v%3 zw{EgFuT_e*Jg6FdGpjdes%A)(*|v)2(vGyh0)M{IGyWcj*{C5qpBykq4>kVwEe+m( zb{HPPizuEYudpPB31L;j`t7Rq&;*aW7qY&QP1k?jJW$Wlx6%jMNXy}6hno3%Iy^xW z@#2$3SD?ahY)~y|Ei5x9*vyzFwmWaosRgB46Szc_oV$lzg?L)Fn5VH?Am)|Tp)0uz z{37K7lb5LQuF)Vh4UsD2RS(2g=11aT)Lm#+r4nv$n8Rh&3oi-(WmO<1Lf^7uMlWVj z758$8KXSvRBqCZzWHZIu&+O&l#N{Z3*FUb5#;v9E&dvK9XUOq(1-&Z!3JW6urt&XW zYh3wJ@h%}(ryTs*1eAX;VMku3K=2_L0+XD;4lJ7tg&cGR`$RBiUUwi5@1 zEEOEqUQMz3SF8J#86T0K{=5)se7OZFu`XRY>|FuP;5q?|o$JY;`W|dEW=aTYk4${g z=tIAR;ge6_7=7weBhtsr*(9_1++%Bq^E9b+b%(5wUm&M;ckVaFyoAn>qi2i2*k4qq zL_d~RIJ}gQ5?MUREz+RMsNY$|WYi2$7`s&M>)n9$i2YV!Om<0}@~qHj2NPhGP$4u! z)+fszz);Wx#@fcl!mm!ZiI}iC)bx(;F=F)uCKtKKt}puRbp6pZp-F z`BibNji10I?6QdKtq}ey+V@b;2&=mcdYe9~p02l7{>#&()00WD^9rAd%XJr2WKw56 z`83GJ%qG`rGtRY~XPNdZDIB0nPW0c8l8Ug6ziUg4!)&jHsBwVPfW3`-6k z^$^MCF*e$G$ATY>&iurq79~}a8@P{DrbdXkr@BaG;`lQEtfZMLbc)h%}ku z#-5~PgYL?P=UPh{hhE7CqeBcfMRFd5MGVBh=(66AqcS2({w$H%x_zGk zFGgB6S*h*D8P+hZl6U28Zv=TOt_&NwN9umV?#m3>n{w{ty7gE-@$@O|ZGgJxue{$PAS8GmBCc&P($0+;@9IxHIo3}#MchkrXA zworg4gJbPW4_Ii^)E^bezo!+eWsU4wx*tl#r(3yvP)emRhKL^UGCcIs;b{%Sg8F(Ju`n<*>D}{`i+cx z#hXbqy5|EGHhvnQb&GVuGPTc8Qif|si&0RVE=4_T3pmnp(CI{K&kZG@?Q5P35Oh0q zuVw?u^Hg#TkQDaka4kh(Ajg1po`6(5xU#!@O>7HBqY1`zhi701UE0OLIKf!$L4On6 z=wRtLZB>4LUW4d(j*6}eEL#g5K3GKnH+I&a9La?b@_j`(cpU<&=d@3&`FO%ko-^OY z=|$mYK%2AStz<`w(Qd-W{8=D8>rrx19WX|8edX!I;~sW!EKJR;rhIK(GVP%oEii5= zJm+X8f2Gms(r*W7*?}wth1c6e+Y!5wfgifda^7qWR2hujdYMvoBYo=+fR!K4yRq>4 zfVJt$%h!Bt4vqS=0P){%?;#ZnK)N(D?iFpW{s+?4T@??_TM+%6-%x7edjtvpJwXE= zFZL;(v6Cb~w$5{3%XqwWq3N^7PX+QhMpb_61~D6E8YJq-FpiQkD8mlb-%IBUpv-2} zyfDOi{aXc2?`K=$)5r~Ge&!{=#zlrmw2B4K)09cU89R>rs%K z9*;Zg$je_6wfRhHzwXz!khSQIZV(y;03R-Y5Bi1POWz3#>LrhJQi*CYL%!DrHV=&$ zViA?L?s$*zF5IUh!%`S*1+IVVOQ&z!r?cJh+Raf4Uug%Hd-L6V_Kd6T!XRa2)|jJm zb$tx0T&1I}GID4~wyKo30!WXZf2T*QMQj&j;9tI_x$tlGH8wIWn(;5#;j(X^_TGsD zV@>!g9%&;o^f~qwcp7VD0GE>NggaXh^SD;ioYbJCpi&b~V!@x`Lsr72w}Gb{cMTNx zKCncV^8z!QrYer&+2L3kEkOK=MBN+s7~Pct?4}d&Gn3vgT)Br-ujumD(9zIX5GT`ys!vuX1ER?j8~Y|F;RzZ@hZsP8OMuK8-@ZGB zJASth7+m#dC)N^=3$4&YVFkh>>(#72L*n#)b-F8xyLWRh>@9o6j^?ve+P4B+>QVm2 zPg9{|S#AQ`BiE~B*V4b9921#$_6OMLhxooLRI>wXAKQ=+F^uyTlr1=jBeL3qSUY5QJgvg&)x& z-`=by#JJV?JAUpmF0SA+Du&nGc6{S)q!s#>Hq)Yi=iHX8{>y@mTER%QG@8316l<&| z1=43-DI@2X*-Q^skLR@?%YIbCW0&f5M9vF-@CaSrN)LORH#cI^aJ>fYneOqkIrT_C zDU*GGqBehCA!;bL>w&blSrc7b{%h}`1#dGHbCdf`TCMKwv=b#POoUFVj3op)-=IUQ zYtB*g%agxLdBx%xBBltgwy_hm*0S5(djy9w^g;^h`laX?GQ)!m>-H`P5QAKxGAMys=`j#|s99ep=Cd(^IK@HQbfWJ3L$m zB$C1?`~+Cvjjo_*`zMP(wd4&(yh|4X#`DBqR=x|YlSK>FlvUi?chSI$qq@FwkE+I` z#1^Sm!&W7>Mk44+dX@4RX?5+zu!;>+at(A`^?f~K zJun!0gaWbaiHiA2-sY`D89#~V3lW}v?4%{Z*P;rA<_(t}%0AlJ7SDs1Ac;N`uk%eRdkh3)QVhrgGqy56Eiy#} z9P=I`Z-R93E%|neU7`GwEdL-E{@* z6hKsY8Vpi;?)b|$-}4MwOyW0pgEv+z8<0D5YvS658S`~yBHF%m*5?z}A^6@)l5986 z+igbl4)78)QV)$at+HRk_=7-zz=SOWl9WD<^U5ASDdlYA0q9YP3vCJP{{ii zjyL+>mMGr`zi@%Db(~%PusT-k@&tR-VJ=U}Pd$~$F5$G@+H7^A+au*(&gB$*}ZAIU{Q$d@CBdRZRYL)PSF^%Q%9|U#^0;Q|J#yF4%a(>)`E>E zi(udZ4na9hffSHH`Os&s{Am#dtPt#9^`vE)hU8pvhhMy)V@vcEtavsz)@wSfE4)(cq3=e!|1MaugRVQ4De8A9xjq2D- z`6)Skd8?yA>9cn&`+`$vUK5{1;JtU}zATpdA+S-{Qu%?ET#LEKDv6V>F|Fuew7GQpAPKL7Fa!M~&JPfdXRW3Ko) zR@!W;n7{W#`Onpd{IwC*-q#2#T9Qw5xvlN>-1waJ`o7Dz1%$caWaPuG+ey_PR7F(c zQ*ONI_#X9r2h+lv2Ny{IU>ju)uPobLFy*_xR{yy z!`*So=a$9uKW%JBqTnG~{RUS`)YqcEkimsRhX4GDeplBpP{%oz;?|V8`{13*{KTdAM zfO^Uz0;b{J&^IF4k=hwd@mWw}c-K=gbz|dmQ-MSAk)}emLsGVh$m}D;N%gZ`xuKoP zpwYdVHtPk^)qtuQ$+MCuD(N5Gne;hDu=ETE-%{>9heiP%nLQn|#EuLTuW`-Y`s)Kb zhZ;GiLO(8t-_UU6>F0l&I zaD%E0Z`jP-Y4(GE>1@nAUBP;R{+rLdg{cYsTM|J!24PE8j1ds&Ml`(Q9`$=}Q8<0` z2=r&2fDPUMlM$D?UwZyN81&2wyh29n4k&^VNQV)%Q)6z1Cb0I;DB6nt?{9^rM2ctG zwlLeJ(cw3i&U<=tG6QZweRNS5$txcBwlSCIg6AE4tPjKCxF2=P;sqY@hgm&f>eETz zE4=V_zKn>u%O5i=@!21D(Ens~|Fb5f+wIgq(#}^0#8BahfCimWTZZ-E&>zr~hWPhV zk!(o^0PzqP?dXPYB+h;uTaC;u6fVir1r!TQ%=AXOujkPwgY4?w^(l8oFI-K||03wWc2%Q||Z`#pj~+%?#SN3-+z!8QTLFx3B> zME5!#NJn5mTZR!k7$=%cY#-5$9G+pS1MRC3=m7Ia`*QuF}Tmml-+^)Y~U+f^n*bW+u~Qr z_qEKCW|Ys{w+wj+&y$)o-<~vwK$-Z6&P5CO0j%aLXRmnlkJNjXV%_^zg=ec*3#*@N zAQMi8B+evO!HVZk3{F$-W^loBvA6!mzHUm)8M7uF^f-pv(l}$p-vCW~7EJiYv{?!= zF{X7GKms6zv0vkznEvzuKplbJNt=mhR)?BvagPZvmD7j>*clMhsxx(}3H|T$X5+)9 z%S!0*orgVFjgEvO%9$l|(b15Ndob^oh_}dHph<7-fRt6>2soX}0z=CEf7Zu`HEDjW zqCe$5w0Z!&^?uU|B^c~+935a*|M{e}Sr#R8yG0+D<%xXF%D5+&Tc9mqA|&L>lD+zs zg^*{v;dB28h4OMnSfveFwmOrt_&g*!^1AMq)OUBI=#*K?$?bPgqZQKY-QDLyaVt<+h zbbIYRuq@*Vs9GFxmfuNuaugf&rFC{Uey~UJSGsQN{9uCE5H74~OX>s)9XbL=L$3o2ZZSnI=X7s_q@5p9JO^csObVbZ zdD$Bh^r?9x6uqpRAm3G3R5|S0gpT3QajI^=fZ1Ejf)=28=5ldvib^ z$$;?xi&a9GgPrwRlyMx8SYNY1^nE&c{HFIh9fv!eLcVyJ#$9Gx&lho4N7pL1Sy98s zAtV{~*~LTlmi*Wz7tWYZFBfA^r%jb$+Judb9SamI7y5ziaME${k58`>3Y(QhD5VJ0O-wiDOe^}dA`wptm)j9ij zlDTEyjGe$70;w1+1%2x4b+S)39-a5#_Wgc57}%sc?N`byt5#6qHL^43cI{cx%thCX z>b-$G(90~Ouo$4JK!HBXTTKIRVg0Js2P!h@^hoVD&*9TUmSXi^sDX_1i=e!Os%jv8 z_4W>_l9I09YNqDz{u0zo9E5^`)hVHfEck=NqUbVG{8t|`8=IOL)YJ5pRdqt=8X+z1 z^(zf`NO$yLsym~{89yu{f8&?^G|>S|(%EJLRxWcJa3Dd~FLMQAViBMoUjV0IKk%S0 zgfxN;twf*P#8eP;3YuJxFXHvHj~~cl+vHY(6c#+KfpT-Wm2uK42H5`JII`ElCDetkCYJpk8YqUpNP9X|bMTN~8QHIb-{xg(wi*pGie1fZZ4 zvE!je&}acC!Z@4s4AP?Hhw|5aRKvX6 z*g~W$)YeP9kIVB!w-#tJ9kgDg3+By*L}@vp+d3eUzr47NA)vn)eoCxqNM?ziI7kzo z5I#nS0=q5N(NPJZfN<0g#kDnUs(|}unSTJ2xHe^dZ+s=LQFoNy+ycpg2*qGwP^h z`aTer5i-yD+4X##`UevYji*J&S76)d;XS&*(?2SFWARJdNc*&V}gJe%C(w3TBK;(?fa}A#aUUgDHzkl&}$*hUI z2;1p{jX{9(VYtU;+x+;^lWVpJOV}Sgf*ceH{WdAp)i;1SJo~p>*U5ni`{Iv}dlal~ z=&OfNK4&v^z=a|sCuSp``i-yBy|ZsL7n6qx9uF2bHV1BZ+OZDpNn7~IcC$Bz#ouk5 zu?!LygHKkTtk6T}ifD9XSvl=RAb(H~Ob$9qy_b7Y@nOJ|11X57Bl%*8_;J3rFG+vC z(%IE4IH56#Xr7E;ha9S|AI(vSfs>#;&;9;g`$WcWS<^_pQbYa(+PiTpt{F8o=a>Ca^w*TRP@yr{A>iaM4vM`l3zXkPC#ggB@axyf7_|cAdOL-9{|J{1Ec!CRDq) z*yGK&13o5|_O;tvVzV@{4OF5DzpJ`i zXpe<=Yg?)Ms>6D~7z4V5)H`Z-6nCh`{Vmdk5Wyh zsHhomM|m(_+Z>iwR%%3o#M*@(r_^r;t81!UJ}V>NrC?2w_Ny!h3ZD)negnLLPX*o4 z;3s-{wf%m!e*VUK1t^Cmq7JYtn)zVUU&Tf}ip18H#y(p))F+1IN+)gILh%WAGfF`V zXUy8`_cnqbt1yo!Cr_+p-k>KZhYf){KE8#Gm{w{y24&F<4UBR^`yz9>|75#1g@E&r zFJ^xlC}DXR#Vc2cv3qN{goi-$dBX>poJXLQuHm|8m7`Tj%#;hCaUTsUeA~#Y2uqIy zGze`To6%QInM8MJGA6!{hi6}-FUkwJ)ETFpMGTf}& z6$CTsR-Y6y87m~COKzwaR^>R9kuIsMl#FDF&VQmzqe{1jNf$5kCw>9u@@vCQeh zgt!BB7rn})D1*%^KY+P?nY|F(DVk@k6VmIrb&-=R=Gaf5CWn8(>n>k=GpYihnp)`_ zsfWVR|74Bpy;`ykHETWzF|{DiGI2AJfGVwC%1*ZQSp zTG!oxBTJ=ay3G4*bxSV_(qRuhf3FN<(5vd0WQSmmneL-n>+%rfioc-3lTsn{wvGYn&e z0N6szTgP|*XqyKvU(O6rJrhu3TxWM-7Z7L#HgVRC`_v1yuDAUA|JDT3*i5_g-VTka z#?REyhV*KZ_pm||p}yHZzB@&TmsVCFd`^E^u%4Q(x*(fd7z zLBOuw1_%4Py6ma+@%8h$#~dGJlr?0+R7xTTjMMP5!n9mXO#31FVM}U+gNdnLuu~#F z%k-McJ*Ip2xLJJZE2Ka56duy~%5}7iE}%${_?jl=)@U#)-$Iti?NiQsJCiBY9tT_Teyz zNE7zSTyFG-*JyeZO}cv2dKRkUMtroo6VikHvEO4l8LQ9}O{C-2!rtM^iPj5w9p|hV zI5H-3I<|@H4cf>xeyZlp?pr9cQw-h9&>;5(^fE_)0%N35QRkyBv2o*YU20cRgZ#Ta(Yn zSJ@+1Il#_fYhD}+(+H2(c!3ad4nmV$dvbD)ilQOQ^NQ;TDyU*Me^_aH7&3s&^_K8I zI;;sk6LO{O$kYDgrt!mZ4%9kS`)c5Zbvn82P`puX`*4|}R&I1E$>i?OYs;r61}uE% zt9lr7wDJ&7PBgJ)iWYJRM2Qa+4P|hiv!qURRb1Y!bfxZvV`b~ssC3u@OY_rRccZc* z&xw;)(7BG$WyFv}a4H<9^z8u}ItnJe5ZY-iI&m31n5kLhfGSh7J;j)gWr-?nw4-H| zR?Gz$)djU^7`nH1-6bZbzwj&lR2>5;2}$oh#4p`16lT-XDh2bbo01R`5FmLp!CA$} zUn$WKz*}j>mRfx`|HJ}<9^Rr^a$%m+^5B+KN0Z8hnH#hnlnbAzH)8K{aUnIAN~Dh% zLgTY@_&Z&jH*PmFG^T~IBNkQNt7v$)Z+aW}c6e>=ndju1Nw$})qC~P%U1fpyA zP5a_kjEPGM-)WT=l#92$85-`&MwRg#uB4RY;bHjrTn-JW2evO@nxGorlLgGz2Z*&T zW)AMeT8|r7I#hbL>FE&wy;(v%t*3R;H=?wA$q%t2LWhy0#Ft0{bL%bmk;*kZ?0p>_L7P-HpjuHR3|quWqaVR4wBB! zxa>t6cESP@)qAPA)y55@n_w^mm5OZ_Fl<{o?d|!&?PKCo?4(p#oR3C1j(Xtx)?q1W zQ?l#NG3`9P0SxBS`1k_#J?CR`uJ%CX*}}_h{(VWpJU6K?qB$;ud&)rNJR@3WPhBQC zI9MJWBb}JxDvXirX+SBql1p2!Kqn_-xB;r~kQiz8K*sRKP!_c1g@MHQen>GR;JGb& z(;Iny<}qlb2jz{GVE{C7o2=YaNrdop!C*zyRLQLkU<{CwZ~F+ySxJTKOXgY{9bR|o z(IG6um~>zhRT*s)BAoGxl;05pYk8?g}w}G`1tXC?_?Cb$x1?|MrAni{D;<(9K8(S1*$F; zJmD8{D9m9vEjc|_>Zbx^P{70Z(WQD{SzX`akWXoZHosukjKyyE3(ca?lZ&$g`J@KX z>4_Rk4gD^fYK&KJ35E*#3tS_*4)?e!N1?>ZDG)T#We*{Y47TGxFZ-BXBciV#1$-Kw zS|a|PMD|(EtBF-F0N!Y>WS2Zn;a8V#^3x5%yghvE;VppBF46;TlJO=wMVGP5&%o7Q z-^k5Jy25VYIAzwZcPFGmvCn&Rir3@teAwG}c|v6RGL>WmMT~Mkx0z*PZ`);AcR#?{ zQw9i+^E{&u+Bbmi9V`b~Fe*6TUh`t7@80iu)j>gAXyy6C;8>GVaI`#?y!0rupl?@L zsau$u0Mw&$+4NQg+Fy}DIVt|?+L2w;yY}Bsv3&H?(sW_R9~LFK91snKt^8W^8cmac z(`=l0=MkvySi!8JGMzg-|AYGTUd&jPR{lT1d@>0t+r{cL5ko54NMPLBSgUZt0G2-0 z0|4nvIP#Fv(vYImGLp_iL^!71XBaB+SllgKdOS;`^&5Rrr*;C`|IK-a zM^C=F&r)+>%SxA)my7G+@@~J<()7mXugb)G|ZAf(k-l5-21k@WG ziZ!7J2f2jpmx6??9{1^4acS-eg(r%0u<0!O|H?D62G}6bykJiCCvw8*I1^zjra5K& z;zeT+kQT(<&$e2yW4Vu6zfx~A9_%wX(rRV1NCH}g41L|13jqeA4_wKYNct9 z_9r`RQZC5ReL`8+088^i$p=Pr88)?mq7PLeiYf$3 zYqQ#YU9!ZtmZ!jDer2uF%rZ4Sta2gIybN89G1B9O3e-_c6h9?DZ3m~0`Jn^jZg+o5 zBi{h{+J!wfH|I8PbIhWSYWEI1R^rkAueEHa-(sA9D3NGTt|(Jd$l`k3Xh6%$Lboa* zCZtxHOIA9!xTsP@$g*#rwZ;``RI_u0zH<=i+058#uMfTVv{MRAdt(81*N;Z^zfI90 z+6uIhVu7pZhL*O(^4mfiXGIorA+LZJvve=RVxHPw%;a&xCy4yCqVUqLe13-~W^3F= z>5fWQAsZ*>k@vM9oT$Z-NAfhWq1F$O-9`dW`Tfj9Tu)g?o6W6Dse*YAzL(?g+F&(; zL4lM`^|{D)SvBQKfK!D))tLioj1UGJ3;W1N9jg-D{|=OV#c8t5>1bfhkh%&K@vzVM z+5_8B-p{nRYrT&z8h9OPJT{rlo=&c=#%NS{2dh`oVnz#w1XC~_gs`BuH@7E1o&oZh z(11ymW}rpGQxfa#`h8wMAclJ0Nvy$y6>D#e7uK2GwC^wM_3Gp}QM`=eI-6VTj~5Dr zYrYX;)4RyRqNKUz<-6fK3zK(T1Q5r{{!cNyu3;}ZKe z8C6k7O}%jZ@%5#YG=0}@&F@E-T(+s;o53c3(yXl-##9fw5)lJ1S>0m_D(5{)>Sbha zGA)O&%4-#$7vDvP`S3$Yt!yc6w)7(^z$j&diZkcr96b8!C#ChgCy*3~P%RR9o2f)p zyrv{FLe?a`drh3Jr7-u9Nx3gL`rMOwdyx$y}Fb=LJ)^~PC z7dV{IS?^C@24G4NeZwo@!0YT8&L;048NsOKr_BBWe2ahi^aenuk;IvIGIvA6rD~Z7 zR6R-w{g05}n_KgnHW=%zV@!7TM>U5v(f%0-?@y%BG}#|OTsqw#Gx?VXCRuyE(D(`T zWebj?j}{E5_MiNB;SDrxOjZ>CG0J?o*Jy95CoL&S2m%LSMn;L_g{8G?d{0x5xn#hs zxW>sQp1T901%O32sV1qpDs8_0N2@P4%n-WXfkAM9uKM@!PnAtC-Qmb@&8=nbfz`kL zcCslgCZaZ0g|c{1vF2Lqe3w{*$B**M(yetpFE!s0zUX@M(G|bZ=ryAG6^_~`U>yJs zo5G*g_V-!8;t)JPmBS^wihwDJkZennPeOZgRtg|eI8BLl=VHJAvZTcyM#s_XC`iRZn{p?m-7+aW<|M4kW^u$r zclZz*E5EL?ykQwnnAI0Q)GttO5al|iGX(q?aPIyjaY1dQkodwA%9hD*2TGQ>x1D_~Kfe!fm0XE?Q&8Z)jzJ7Q{}<2A5O)F-+QX{ z>c>RIo)o*D_s2vOK%tTQ-{$*x|H^!<rqnSJB z`Qg0Vb&fdM@wE@YV*grfi&K$;!8Y7!>Xiolc)Z~MK4=F+Oz_8Y&NiQp*bhBTe!?BM z8sXIcD2Fi zBG>r1(&PYscHIVSXsuz-YHR;Z@mS4^umqb8L@4xszNL4%7yc(n!9Sujw^LcR=t#Jk zG&tVx=kGi;{cMGxk@MSojbD``@vRrz1s*H`8u}4sjFQ3KMu4lw_ucP!F&fOPV+?$u zhdtEL_+7VCct6#^eX$7VW6*ad`J#vi)s zpsZ%bGB(A8$&Z~_FI`q2%dM3pujkTF+l;#6gW>7i(o$Xci#vebMaf02anlB1geSM+ zEVqd0M)hlN27$Ti>$edhZ@-x}Ogpb~vccL?;}T;0>u8xNxyLU|B;2h7Bor`;RRXkj za^YY0eNL5I|F*NccOFm?1nZ>U-@9M~ukv{w-K*Xb1!9E)I4su$a(*uj6>QYwVYyRj z^Vw?F7N%Tf5z0_O;R~+pSHHjK1RG1(!&BKxhNPVZZ&luyYMK^Q2!Fj+=zs;A-=3Rq z0c5_f-*QY_+gj9{nrk@9+>{7 zpKe0QeO&*xFfYA!>{<70^;o2%4|SM^QgRfasbE$BtQ)8Pij8ii7jF5C3CZ5T)(jk{ z!rd(_AttotbegCd>3joZsr|=kV!`dRm8=g!dH&2x81MnaPIKN8tu|{CG?PRNv_b65`R6xpQ7UXQT1D!cq_@%}ioVoFP59A86r@9Lj)VYo9aqUFF0IVs#*2 zh@!3b=wQWeu8D4QGuAZrP)Vg>r2ODEJ9|;vPS8z)@%EoqGWq>Dm?Gy9yN8S7P5jVt~K?R*=r$eCDze|Y1 z1n1-f#Ou;)le=86oOk~H{XJxZWx*RmQ!1dvdkvCtr1Cj;;aK&Py_ePo_jF+2BDI`! zSQZ-}h!^bjLhERpZ;U&M8!0AUbF8GT)nBN|K+~<~ewCW_UXMqIe+-CFqBMC>J=0PqK6(^%iTOI>2joS@QQdM~#Y0ktMcR6gf0h>n9tLkhQpO(>M zb4wd#UtJ)++7q&{fIoypDR%stxfDlpbl_WriR;sSkBW?|(U^A6o7mEM{CIW}unzH~ zBM^nl1F|*uc$N?3VZnnl)!(J2W(X0Wum1B!_OHj}&y#B7R05!PT*Lk&Q88Ij-jr#n z%n{GA9V=|1f;==&KoSyssnFE5ssRb5ax5(0bfCIsmTkFQPdqO$oPM#doKd2iTw}B5 zW&O*fu|pJCWwC>=4X>poHA@M4dY`2#A^}uQbg9$WOhPsr%$8U0&%W9sb-oRd7xD3W zGhFf<%|fr-13-)-f+{OQ?Uead5~1SrcjQ;whpZ(H)7Z!=5Y@!g(d=YUovqYJU9U9| zWv$vhH01yO`x9gbm>nlqRH%=Pb$9!G{LUH?6*(Cjnn>Rg6$$%zqVPI)TD=LoGDfRh zO148~)?;Fd*YRp$M?<=)Zq0-bOO3W)N~7S@js~k>Yb)eX`i@L3*aPk{dT8KVTUgYC zdG><9v_UyjPQ0wLGTrjUVabONQ?w{=W>pxLr_({?dhLN%NXO7jRY(WDg)Jj9^> zV1qtqJ?1d{_QtmlN7uNQ?mvIMD%oJQV{_LE$}a%gqCnG0w5HI@_oexYKo)aRZ;$*9 z@l$Gw21FvAXbpuWn&inb3Wsab=G5X(f{kHWemD#){@B3c|I5kHPbS}43CM^Z{L$H+ zQ{{*tOae$CSOB(;!$k|WwCwv9xk}BfMPb8)u*)^C0|H4?)~tK4sv7pcbt|>~>NUye zM}lt6*9Z61W-W#V%Pj)ey(NB(j4=&=quRqpF65@Y#KXmOgDz`+cfgg2 zD#fU$0yGIV*GDj6i;-Q+pXz9P?NDnd#yAx*LHosGJDse{R|3CuO$(=#rK;)S_H&Vr zSGf7mr=v04_zdFJ35$ z11)2r9#GCc1h4(XnhtTxf=|xt5sR>X35WxC-#s`DlQ_zY$|5&E|lmh72&OfMV<6&})yZXUxN#dd+vVq8x#`z&9_?*{8bDmab3clX_n?`|2*Sov`1#ltpyyi5VU@ zd?d|uA<_ZQo>|2-D#jkU(X$+$j6{Nek;m^$LBceMg7a=KCnSUplFx_#^rv{H3dFsA z7xJx4j7!HxZqZ@*N`&as40^QwR(0T;!u|y=T|FIKKu!CGJmCy^SM_4EwW>2F%iqrr zB8X!}uPEf0Ikw3Q55dQ=C#t1_}4a~Cyf91RDV1n0>~cj)R5e{o7dLM(m=LbE%6 za%gbqBk8vn;@l+|v_l#l@9Eun37y~eU?LEkQ*QO#$8^u!FGt!NWU+RQ8D!mW4_j)D zCac+1Eu7zMfKG2RE@Z^`dAZ$>@Eg?m>b3EX{y~i<^1_w=aHUu+Gvxhd)c?hb%Flo5utKR2%P~Kbd`5E}h1FrDwJNt$? zv3fAmpk7R4l|@h^HKa7!S#A&6dTVB(GF4O}W3(?_9Q7=;|2x~LD5r#sE=aq*nBhbw zOe5;j?|zS3N(6xy{{3J=YfdEy?wcI;WoT+)xy6(&Bck|Ay3rh<8)a_+@`L5j!J zC#2$}p)7ao(N<@8+2LGn#aI`3BaOK``*)+v(Wg>TPWYLok@y6F z!J#-S@Q)`wwU5u7C$WD8u-$&0UU?}<9yCm7n;S(#JfoVym_cq4+JZL|^Zb3Tmy|y8 z3N%hJEVYQ{s1QA3?NKuJas<2Kxp>>SpSlNeWvdIVQGMK82bNwUN%RhuG+LBJO%-_q znW#+mIz)tFnj9i*8XBXO(4`G7z7qh{%cy#Q5PLrf}wYXG@Uv%#}djF)mkc4Q##5pgff0?s%6!0eCTPvIEjSeyeRLt_v>}ap1=1BF{qE{8 z&C5KF(VxV6tMUX6O0t{zXv^)ss6KTd*SQSNd6=slW;Q!D8k$y_sL^GB1KZR+vXSKC z#U8nwlQjcxwV??6+z40XH2Y9)cnjYbA!#L=p5_v!R57>RISWX*+ru8rXs}dr1>AcU zoWNa%K2Zjes1Ong=4Va5hNDUhK+5`2NeMDb%jcw|>n0d{E)=NTiHdoaR%V&|nh#vEV<>EU} zS77oI&<&#)>%t?grd_pa?JhxK#V!EY=PvI%3%(+DnzEt~MEo-8bE!HvcKkPDDM@yGc@#_mOng_FC-{ z;~Rv-e~i|6~Da9N+Qc%9#twZFtvT? zCxY7n{2wT)in-=^4nj)SFyVKW(v%tHRqi;dl=e|x}07u&4%!V++eg$MF zsTECIa-dPIAE6oJP=sjq;@`0l4^jE{a($RtlPlqc%SqH3Pk{FI5Wp{$LxlmFxQ&YO z@j;j}+wPV(Gf_Np+xR9yWTq8Dkf*SXgFIToj6Mo|4UagtUA0{@q<->U2455aY^@70 z8H}^<3t;J#NQTR{FawU}wC1m)UoNy&7cSd7>uwA1-sO*yWm8901kV^PQ>MmI+$Et( zeP)&5TFQ-$FfkqR-qXktn)5xd+jHrLYb(mxYB_rxU-900Dd``%1)K;?+-|4}&OdK? zMlM8xYhfT(_LiXh`7=jP zwW87c!q#2w*%K?UvwqzJA4wJs{rZ+%m=?gUjl2rTP+<%o&`!H&69j|r&eR3t@fF3!}N&<>u9m= zU8kWQ_!^r-LnTTtw9$Fp&RFOEg!+nj+QxN2%X_*T-}v$mjt}6)wxyHutYlvEy!_vt zO07kOd28O-4hpd{1q_N*^wb#hNtN=YBXwUN>6TL4FdPrKxQ}^}nHp`G*) zU~!r(^uorjsNFg#t{?^RuKsQ~E)8w*F;;cwBdAyHk z=-)ZL7*+Shfg}|Jb#@8t6be;os2%Sl@xScBPoo^`<0LEB`a!1i4(`b;#hL-4`n4Hz zr;G)6hZ)VW>`fcwG~w&Kwl72RxCYVQ>`X()N;h4`y5GKNL7eoeeMOewr0ld*NaWj2 z%=2eI-r+D14i90*_qK zHG~JowcsVKqjTwvYS9y6fs2YaRC|p5{mo`VDNlEE0Kg_CzV%?^oO2H!lW5d|gg_N= zI_@^HI&fWJK|mf=k;>;`#curc?`lIRuCTqFv`E!^H zETzEia2jNP7NzBok#m3t##*%Rq~4D`H7b$gWHld@IC;Ov4OM6C;FI47i?Eh8sP^-I zaDSVO*S~OGX3}v^d~-4biV$BMrV@B5{n3}f%iL;(l^OjBWE_-vvS3@plwZaSmiWN7 zv=l$Xq`-1k$eWiCqt;<|1)#xae~1zEeGVP)_l(T;IVKr=lsk3-#*WLhvX1Pu;Dl_dyR_9`Yn)QHPVoo0P6aCw7vNy-e~WdGz)~7@9>s#y#yJ z@>4XjO9}tuRR&mY|2_%a*xQK&jxiUv5fxxU$7uZi{e7&XhFX6Q$OgdS_>~s-gKsOytj1y#R!ZV7v^RqHLd? zh97|VAH=kTUrcD2mXq-jJ6-{r`;9tWB5i}`%qfQWO6EXOrx!o7f)CAk_VFJFO{hjX zUb=Wm8K&oBX`G5JvmN+94=sR%12AR5v_T}P6HJGG2dr-*a$*q$eZ0eEKd8l*OAYM) zw7fLoKi>bwpl!m#c(jpP+2OMT@>iz`T$YdD?!|Vs@}&wfiZ{J#e5vn#J^!8e1CWvo z4L5*Ay741Ibi)}7d_s6_C8ze@kr<+u*KB`$SiQ8{Y{BF;;P@M8%>^}n#&sx=JbN&I z%O3yhunZb8#CJ4AJA%y<505M(paQ-`wjktc+=%9Zt*&8-8LI|Xf>cazV~R{McRo9Al~pr=$XbikLsX=Xy0g)$<|A5C@Mt2(q-# zYH>gBxn#_n+jEB*?}^HWR+J^&CMyXHm#otnypQ?C#q; z0`6I(!^(T1Azu#^ z5S%=%V{*_p%&B^sk>z~1k^M2_`}}+g_|nq7d>5QhhlE|wrkOl}@^1Q1%6}8CETd+r z{mLAeY%jNNn5J^SgnNcnK;ZcwpG3H1S1YkYLcE)5kB%-*Ixc(L%88W-ntNE=8YF5r z+Jj+sx%|M6oIb@bHny|OnX~>jr~!_Y*6-rFsy2W9+Iox!#9*gu3kM@#7I@-v>2FKq z^8T^;tzTU>Fp=I6H(=a}@hV!8=KEssQ-N0ul7^;CD6K&gQ?^&*G-X9A=iUrEk0Upn z0YCL+LoUNt*AqSf0GGk~bVw!+{d^9QhI>N5%!QdDFV7^UpinoBsM$rIIDGa#-d5c0 zHi&u@vxYvp6k^<;@DK_SDf8M0q5m>?gKj>m)+?}ajRn{bgCjPrCy|SsEL_mAM_Yn9 zp+<_0hV6o#Vz{!Nsy{%D;^Rk;i^!e-Od%lRWtg>ALE1ApHQ2+$IX)1mHjER%$s8&! zqC7vx^%_?S_(XK!if=#;(=usnk{#}^9vS2?gHAf3oBwu^D@vjjx(+Zg0TA|JnD(3fSjw_n(ym$yj+D8ZFv#U5wpEk_$m19+Hx9qSvZZrcMGj4wMmlQZ* z7<%CaP#%qiCzfFqRcx4o;VdZ3(=D2EAhsy`*@~_?JJ_p9L z*+l!>aIUN5eCNi{rNNDzaIdKh+D3Iv-HU*@`qDcpC!nOJ^!YXNn+Vgo-s0loaT9Is zi6FETRZ8ObxvUo8-WIiVy9#iWRCF}mWeNn$x@)RKcwCM+P}-1}v#6RO&;FXKi~a_W zSA4q6XUMbsbOM0SX{f;L-DV7{F89KMjvWQDg9E_wn7Hqk@OMfIn1p(CB4YK%0Q^(N{<7(f!y563Ye?h zdB^X40o*_{v-6bGlw?On1e=;#B}7E_2RlpG$x*EMBOJuxsKVRxq0=IMKhTAH{i_GM}J-Qs%>~6N!4Fdw`=^ z!bF5KJynYA>o|R5M}BOM5!Xo7(3}@C0&89&-`dPxudD-=AVF4_`%s$CT!&(#)JZG8 zIP~al!A^C0W=4!DV83c+QC(xbO91$+Gw!nlbor>oa*)t-8{h(71jlLht4Nv=GP{nD z#0zRPRRqg3HMOxcfY7$r8cIf0Ge?j*zoMh-B(@!NR?Wo?}6J`QW&pRm5^w}z$dK)O$;9n-{5 zWSPz5T?CzDVYxr{_6Bwkq6P@D6r`n#V#;fk=h3?CoSa||A~0M-=m*l2fdzJ~>MM-tcOs5_n(wK+!YPBXV zxEOqir7f)8@r8?SQ`MQDjq}CCz^QS4c6z}*+i+yZywd)6jC{;AV#DJ+YO3Tt1=H}H z>^u=eLpC=zx7MA(=u%iOeaRatU65oIYxh(D9-|u?N;3qvvhrq01cn8#+<1h3T^)7y zJ9Ag&66+4UW}n)X0ev5rG#z_opV)GpVPZq z4-AuO$S9w>IMg?4cu1__|8kBNV02$DFO$3Mjgsj>P0Hz;wrV0fAW8<31>_4d?`Jzc zE*Yu%d>yipa%`Zuf2j#LmCkX1Y-T817q1TDF#KzPwdor$ooG84>9KwfgoC$dwbFXo zCo*2PW>YygUR|Np187VP0(iTfIU9-t0w|B%+Cd@_!bucG%(v9X#m)3QFq;^N4Q(D(hs`Yg8MBCMx(iZE)TY8D69UhOQ5sm!*P zG8ARxmTPykp<(kryMka|YcKmN!w}xOt=uBVos7pJqdf7yyjY*5*ane-cKhF$)*L2} zn|2SpK4XB$$Lr$E4A-2QuZvqC)n#86k;TAv<|3na_v8ewjDZ-#CWZ*4A!t?{noZ3R1QC4E*48dCo;{~qv%pVXB)LF&K^f%fDXr~~ zxJoA}F!T>fH}HR9*doa~<*UDYXF@ysu_VM(ppXWfpW|6W33;J;oS8?W=So6uu* zU!IHIVLf=v-M06rtu41~%CW`8J94k{LB?7YNI;|(pjVG{NYkaj-@gX@3|WaZ(+!OY zd}v=lux{|gNlq!!VG3{B$pU>>OgmwL>`4YusWcH#OuY13Y0l$^1VgXI%; z&Pz7YH^$xQ$(I`^zkBkKy3Ql-75O+kp7DMhHIgB+=kj5eU|oY3+;$80^{oK#sHXLC z5Yb}FQ=lH5^V`SH+`KF{8c=6U1)-Ny-~tXz`N7#o`g& z@&mVQ-Ho+6kW~Q|e#q#k^Ry^k^v#>m6JMGgzEwH$BzzHs)!$DNJnltc0u1R(41Wcn zt5X#ey2GiG%M#iGxc@_8TPy}^p9p8PgeNBx5lcrAR z)m7B9ZBpCYi?obUZxWoey8;wseCaPN0d}<$^7RAjw*9F6(G;J4nTz9QnV7m0Gng_q zwvsarMIIpYY57U~v!T`mN! zB#xu&y4*aanZ+d~Sv)>cYl8_bN%8R`moeR6R{IOAwtzvueb)`JDVwt=)a6ztLFH+U z0R$lu+q^N!<+;P5)GiBh13={oFzBBk5(Ii*u(&i%AA{Y&)^LsC-D+7tZe@sJnuEXSm+RvmxJM=t48_*%Qq z92vn61FPwMD(2$0qW@6ZtfnUwIe&++q>>9|VYj6wxEcveyEgROh|-X|efd7^rAfYo*1RO*wCSO%v@__{14w|uC zqLD;oqjnUWmY>D7{WEoP!Fon-N=M!3kz_A?X^o-|aC}i8R6=@9`y!XTYd0lt@j8(J z@yY{}=^^P3nEnkFd|Nn2^>%=)%o=2m1BX|StJD;l-`S_9<|>6?u0BIy!n?StzNsw+ zp-totooQecBpw@yA!&JyrsL>FA#rg+fz$m9Aq$Moo6i)HfU{mDulB6p_~R}g3DK<= zNRk{~3fK6yFV^K0Kp78RdjDNm3%Y5baQZU`{x6bz4#O{x9ynVQExaS7?3gwa*ztIl zTug%Sts4l!H-DHCP_Q@5kyEjGYdp*LwU$kF5Q0Z>!^%!D@Ao0wbR(o)qsX?Yz{p-xh#>-@p5+-EBy{(3Ym7=FWmZBzPdT#?sp{`m$`47r2%=v z`^wC&9||Lt;W+Dynsf^?ylR-C?Cv?!*j4Nd`K?B=5%12&0BzBmsG?-co#xi6br-q_ zz<-a6jty{DVO?7BF14jIb<^KgH;@%k3rJYk489d8#$fLTMKTUfja8o8>9sB|glj39 zR`v$OXkX#kmi|1~ufiHRU6>158C#we{u4@qs|CRrPHc+=8hqV;px(@$C}K=J;|gr2 zxmfQBND-@|vIi%H{nY!8pj?Kok|_jD3(QW7A9tVz--w^TvIovKP|jUioDJ;kAAlQs z(`KkZ5&n=WpMq`{bqweNK~WCA@1k4N_u2BR6@Ro7^vl-=SF0v`gb!CVc6Y`O@lN&( zP67>%_Pswi9+1NX`t`>)Eq`np<--fZ~kF= z8qN!9svCa%gJ0bYYh%YZ(hgXpFxyK4yDaxx=-;i$`)tg+yt~{iqM}^gdw#ib%Fy&C zvjm}0V25lONono$B8To)hp4VDZ$J?`ha9&~PD6j1`}UIEg#;I|+wdc&2!8KSi2FBu zOby~R9(~A@8C0KHQ3BmP9QiP5bs!`ObKHELJhg4Gol;ub0dl2P5+dz0@ySh`)MHHg z-Z1X0Ri|M_g4By1#v*o~Y%!S_peI9k1A546F=KJS_&6Tum}PI-?p?~Vit&=BrdOSocyrq8)^!0}W}1jxFhn(< z*mdb;sOQpOo3jH(iH9ePBeNPhvkBbCCzDzoabuOPyhVKi8Lf02W(vZz3Zavm;YJ^; zcdnOyA+w%*9*mP7JL(=Th6j6gjZ7^1TKzXQ)u8;uWzz9SX0&0{SAMS$veIk0y;QAS zUudhhPk=wcfnF-TKfl{Pa_!xH*Q+PGrR4p#zZHZF zjRHeUGc-s^4BgG|8f8D<``gdEzwi5Vj)Q|^=Dx3Mt#h5{xz<7q?p{xAOWGXg?0Lgw z^0H5QW#1rTUbQNXaYc=Zki}f*06){T{N>ijGaF1gDKAUfH*FNK`3nO6{$;`&> z%Z`>c0HDRImk9ycEuvEZJul-5C%uEES#$z+6Sd2plfmz^=^zjeL;z-!m(k~S<5qVW z|4!KZb*Zh5YEn1ygl25*DLtn2OD%29C<7SoXjY`g?VX0WZw!a}Q!ey74b?rYvCjSw zRMN(&YIJ>l;lA$L!*i0X?h{7`=YgJ{2aO``8kdDxWZ^=e+i}{JCR}$MS$!_VM`fqr z=|34{+Cn5&x4J5HS@lLG)3+Il7v>Khx}R{M&A(BO(ocF{_gtq)S;fH zvIqW>SI4DFE1NVK&%p=Ohy#@^gk97=VdbR18S`j(D0t3weCR?yuS%q>X{J)|^JrCe65A?2SiL;HA91@yanxsCny4pEs?Crhp~VOt4r}VOn7c8*3vA$r{OA z+~10B0nM$Z?iE#ir$iZLXyjh|SxLsV7MAfx?J`a8Rg6?{ITXLtJeG|M!KXbzm7yMk zrRT@BdiSNI=~WLo}3sV<=YqIsK4C$V=r?Pg$;Fd6`bX zH#Vd|Huza-hswMQ-fa!#B)oQm+O2N0N%A^_d7p=>ujFaUHb^?=HGOy9S$fKqc%$mLZhc>lA|t}GL=|yEV)0%3l8>U>FZm-HqLs3$>`RLo z;T$wHG)uM>-pe;Ygc5Edg>g;eJHW{RC{eAZ~#@8PN^lk-?Ta&)=#LS>;G=M5qCs`H{KlONp=5k{7 zbEFlSs+ca9J9M!u3=*RISui2Q zEaj-x+U?U|%aQ){b#cbXAp04K2{rz&L zBKQdR&%Kh$$JE@aF>Mk94%5V7r3k{_Y)3IEo4M#C^>gK4cxQUM4dJ>sj*?^Tbtgl| zR?1Mm=uboZUnsZYs=kzNZ(BT~iPVnqBM8X_uP^%q{;2V+&dgF-JxT|rrWs=P)Q9yF zcXs&~Gp=>4UEOmpR+%grGkr1K=df1z)%g;6GJ&M;8hEV=S@Ua@>|q*H`16NYtsC@q zqdz}BcdvsCiJrEiRe1O@p%th}9wS6&+efG8g$drPCVe71H4j~KJ%~AQ z>=~=fj=o-xTyx#3BK=$3bjOAwRZb)>t9HDM3hw&&&*MJ}U7kVnj) z!wO2>=z9q!mwx4$uFB=H(W53eYT9*d%zB+sX@5qq#yPJKVmQQ!oon(r(&V4kz}1Y! zSBII&f(;;MEluYe%)nA*ApOjEZLhoj&7|bKr}FlBT50iP)a?0PR(#d}=cPj%=mbJ0 zw<3Jq#SMIwx$q<{#YlK5IW)+&G@DM!k`5W|a$w!3CZnX>M#BJQWR0}M-Am{@U=aNmlyGWZk03yx{mtNL{Jq+ zx;?mGayq7a-#E-TtE;wods|%Z028?s$oc%R=_+9M;%IiK`|30@Nrnmas4$@R?zQCd z&*aKYmJ{u)f6c4mfCTHk&WuQ4LbE4KU;3kRWARUFy-7{_slByF%~3+&RU%Y9g@q%< zS*8o!cy`0(7A{rkSAD1&Vhx1kPbvfcCFE*zA&gcwjhW2@1(HE8tUj6;LA2CVjnI99$Z=dl<4edV#$Li5Ya_=5VdaZ%|hk$JcDDFkX{WF*JtH|cH>M z$r6RPi++@De!U-Ug`S>X`VcqTZ){zs9KFeEVALbjhM7Sysu!uU#4UlU_pl6@+`F#_ zuQ<}MXAL>F-lZuSRW93NgM3cJ3-RlY$8WeD>&NhOp`dv+&MJzFc~(t7D`?Q}xftW& zEURCiI(nr6-M5-avyN_iX;t~AdFPje=2?{OLF=k>7Bjolr}Z-*v!>G)MBLID+sfiC z*|GZ$ZD=UdM>_PgBe9EK9Y%q9x;{Q+s;a7lkK8{5VoDoy93S86PP4nNx*Tc$B;N1< zWEHl{rND@Q1iKWQx@uSH2Hr!M-47Z_O)bBFIwf&HzMTM-#sM#Uwnp)F;?8Nopo6|1WoEx`AD2SJ3L>LS4d0ND$?3AR3o~0p2-Qi8z3wwWkND-q(c2qFluL zl8#b4L`>f&hXM&G9ms}-tL-P>9QoCcB%wT{6fg{s9BR&)^zp~>)d@)n9khY~Pl*inDzF57XEsy;E{H;X( z$b?*ICgi?*i{0VHaeM8-@y`rasPmbR&8)N1tL05`FfuiEvcKy(VNYH2Ga0}68KGdU z1#J_vX^hOki>FvF#<*1C3vgdPmSi3bRmn%jCdec2pZkC`fmt@9L<#=ok(84%dwSvI zUCE`#JSAk=(z3m=C!ZD))*cc^hd)I)pimAjoz#S}ZuKEEh7(bu&d$nC?!3Fq>MD1q zcT{f~IDZq;^%ww52w#_oy}NHr31h?!zpoz%bR8u>)z+vp7JJPfnLP5|mH_qZ$tx^M zv}u$4Vii>4)1~3rNX-1Nu%?H)EcvFLd?FQCBTEfzL{TN=EqvHJ)%mQe&n%TN-UKRS z44L~eP3mIUw^|qz{yO!v>9a$!4tUu zIR zhP(DJU(l#1w54a&8bTje>#?u&@VVAKm}z7n2`PMLx%bvs8LqElOCnX=i0SH>@R~1^ z!~oviFsbN=ND}~8Gc9eR&`tPJ+d$B=mAWH3L*KO25Rd)7d&7;rUsde$zBePem)v+b zZ9QXE|c`KpCySv*E6K3B%tuDMKCS;ocOoDFnA z3X(w+<=YMO4&-TI#thb)!Q_!2UAch>Y_$o{j6L}sJ2>WM_mA39>p~>;p+$oyhalLU zjf4K=rS?DF7W}X>ccFTx8y6z>sb)h>AH5B8v{3bWGhcC;ESqsR?v6gL%@l_|MugMb zlS*V4-_=xkFh-gSqY>o}*JEv)zFR@Zur8rH{dWGqj8J;8nEa`@kzm)>a=O(PyLK&s zs>|JQ+vbJV*FvOhlgaDIKx3VVyrsxURkh4wl5vEwF8KPv8Kw`j)Asg@5B|~%oj5*0 z5W(xIZ2!2TVc^)MlOSYVVx7&h*#|Wu-gDtSqr`{QiO~zZ8G}?#=QG{P9G;Y^nKdg_ z@qc@dd1CQMw!2ofw1YTPhiS@(z`d|lAhdq}pc|Oe7#D&w?c!IF zZiAV3f1TJ%gA1us_jk;0>*--~bW(S7y)Zw9m0Sh=#?#VXzQE5O8lm|AhEVa#rMhcn zIRiVBX)>jAC?6N&<0CB5AEDhgSi;Q^+pH=ttW)}`J~NX*IPKd0!$NzvEc$m*+M^S! zVl)~rsgDJ!P^wFj%A7*R%8aG!Sw;LU5>;59PF1XrhpJfjGe_8#1W0BEasUX`Jhe@o<=yJafT_xt5XmxTFo|u9#@gD6W#fg zFz_B_6tX?S&HY(pM{Sy1M#hX+pGUA!CH5n;rDp}VD6U>n%&)*_Gs&>k6=D| zy;p^t&$~M#+#Wr>KgKIv6cu5$k5M7ka|B8Sn7!V@fA4*%*Zb{@Tjd4{grGFvx&#NV*0Aaez z#xTx9aOhp(bHvdLfpT<+WCFk3;V_k0Qp}K%AUwouy5_rpgmx2Vr_K8p_#QdzgKEL| z5SGej5%`rSGY&c09P02`vjKIi-M}Q{QR0<3he1K5n{X%qfeeXim-j6 zKR_3A5yQy6X}WA*4v?~^5=av zV)|M4H}1r^JX+4Ks3lj2X7!Vc`t|-GZw82@XU6`g@*-&uhR$}+j}R(kFh4BKDMX;E zswzGtjeOg5u|SF}wJx9eTm|~huRuBD;^MyAZWu^d9_*|TTJ48Dm+6-Dh(RUQZz$!e zi#nb$txSEY3K?sai;7y^2H;3Y5%;z3guutopCXPk<%Z$hI$M7Jm;qR@sdwLva4i|J z@L~hh5IkW&HsE^%n;|~kj~&qWxfQ8gUzK|v_@g)G%-HD$0(J&> z+wddkDZ`1&-Xt=$TFJwGzp{*H*I_^_7oMm=I5u(jE$2P)7y|Jt;|uX3->PEi8Zq8< zUBO3fch{dK4FvlJwD&;z_W=coYH3Af(J0x@udtoqt(kg?%cQS9_M7D2Ix^Z>>+{6D zghfOs`f%)DE1%wSH@_Y(Ny2_*K}dCDxqs_Ipo?ci%T;U0XFZPw;& zgn!VeOX>t)rk0C7BRyN(YsLaBPd^#xLH?b(3$ALid~vaNSm-0KV3WZ{B*7F-kJL4r z2TBoj^mP}rWZz6Bv3|9aP5N*?1W&C)#uy{#mbAq*iFc^?Qc-qyosaIU$`{)YGw?>SV6{jrnVn<4NX&OChrgI7 zvzXIEo3)(Y2*ulj4@t6DRh5uyyAwUh{`FY6;4j-YmXlwYn%DS*gk8U+r9YUt^lPjS z+ruJ8t%rE3&L#e8-_J@>&5iSwr^ZUOUh7-uSrAKrICu`g6HYD+-;g`}n1G5-CnCLB zp?r-QQbo{mKEA7LxWkbrG!<4t&(VLr!fQbi|I1O5;l#!zL zXtebsD161Xe6&bS}Z}al#qoNWwx1=+w%eyLJ?~6A@ z)K=Em*!iiO2+Sskt6KWa*QDP`F?LreX6FFZN=v&8xnDDX*wLZf9b6l77QDb)CQ#k#HA}f3cq7(U!K&xtZ zt%(UvM=xXRk8iK_8XhstmQ!XgK@{T^e{{r3>g@zX6T3Epk;?A}pbpxD^4;ahqcg!? z&iB(72HDPEx4K9yUo&hz#pY$4gnglYW@jGd?!LE1zT7M?Qesz=8YRg`Sx)w1SfcD}bj99;5L-q9^4Fdm}D>%A2W2bJTR_{YiUNka^Na#0!-RO|_3YBWe3%G=75ScVMU}Ny^rp?f-z_ z-TY?!=&S8gU zib~f%bC`r*T~m%2f9S(jfJ8=dqxNQ*1>D2HT(hKzPA}rECzj&|m;p^?(OvK?^;_2Dp53)H-Cu1ZDom`_?h_?UD5>c9BdWyNMc66O zY8_t0@2W1s68T#bRX4$x($b}#)uU|0PoZNC;*I?vO`Qg^14+qjt(kIS?}WT#=#E=BLPspC&pRjB7Q*p;T2^1XAjlxaK7Kwea%&P zllVeyY&GZmk|*BtP75*p=odSOCUGf=Gzg~>3IqRBs`i1U3$h*&`V3@;CPnyF0K1bNLT zCxnC33y-%|nh;{UC~~mC_{)b-5l2q8n+IVrC!GA5f8+yD(M)6c~Y?F4)DG- zHb!*?*J5;-^$3UDBO!<3Q=}7)O6hbxv6`K`pd;ycjX_nW}lnk$?TTS2njx=+Gf^4T@9Jn;+~g?ZF)1udW$$~NP(WcZeR=}U z^~P4qyeIY$I(OwPA@U6u_#x{s5Sxjh4xM9A#6u1aCx`vxM;`*DjogkYdc8dFgGn6C zErC>(MbnXSE`ogf55G)%2SH@T6?{H1Q8X3i^o1t6HY;f;Q;GHrPl>*r6#LYV8{54F z6MPXUE=Ex*1I@W?_kVDs3K-)J**4Bg?3+ zUTN{)i5rw4NOAL;b^kkYgDCL#Sx15%`f;5}xOHE**>s^EdRw6(YZq{mzjh;eaPT8Y zvG=pR71k^B<%fwM-!*@hxh8sTg%W+<@APQxpVhzfNGVam*Le$1h^Bwbqn7AEC3iOk z$m-#FF_C7`sD;UKfR!>G-JjRjBcufN?m5>zNWOn#y5i2EXcVUi z%V|cl27nu=VFRa&ijkeWuWvSF?EWvW!-XZ>C@s;gaIwm=3gjsCeoXT1mJ<=dW)$ zym*v5Jkq)4uOp6QcUSmZPfzIiQ`Mb!Iq9v81{x4i$?v0AF84gndUEsgq*D*#I62Wo zWzXZIHR)*gS(1OrU3cRM0&D>urUMu9^Cwy?Yp|2x_eL*bU`;#=8l^yzrxzY()XdBX zjZrw22t8VhEDZuuy6HEj24ETG6UrHnI=Rjv7_mcZ6diJ>-s>^N7bJ>z&)6Lo z%9B#_#(i#%#G^xQi)gl65K8#?2v!=>eS;@T-czn%h|v%hHY@TAV&R#8YQf*Qt7?Rh z#0x(oprX#u-f=ODOCfFf>%mD_zqb?mbmEL|Tq$Btz@yJMjDM(^i;I%d!+CG7k4-=z zKstgsi+u0h?9kIZ$upg{mPv;$9!@R{Ar3;nERFR}; z+x|Y+{6gf;Y7YmcPEQWQA5v(*@;o*vpIcRQU4Rn@1t}h4GH37^>8P_0b3i0=5(EoZXU}E6^^;Vb= zEK$zwv@`<)BO!4g9uNxFE`f+n{JfR6lOR?j4cy1nuUc_EDDb_vpQIze(g=(&dE4DE z!@u85L#=t7o$Xuqt)_m&1-=aHOrY3gf!>sp1K?Tp(DFWm5?Z zIt{X54KQNg?)UYEKDs*T78U9%@!2!?ays1I!@TfRPgn8)ab_jo+BT=2j-MLka&&8~ z(aHCflc)%g1R2ynZA6jtatekBi2JoHNo!8=mOHi*!DIk_*LfG0Tjz8{aYCr$C3Mkb zc)@yk*ypOOSFfb!EWHQs9vK@9XXJhFus>`@a(;S~(pZI!pPyQ^e&6mnSFNXfsg399 zx%0Z9$ELf&m%Tt}nKb?zoX=&i*P~c5yuFous#h0>n==h|#InPF*jE2^)!n2Dzk1Aq zhbc|gy=RR`NG7*$;-+nEfUMVpjbDk^Jr(~@^(o)!AO|X{faT4 zx?71X1z*ofiM|hbMB%%pNj7mDQJ3*#C=R7J&Ow0=(+3u2I0SnFTGAwGqxX3uO0x_M`+pyoYH9DTFqJLnLMkDh zV-h*5?=ainl~-sBEht3fSA?FNxPzwDg?(Ovot+$mvF(A_v2rtBVE0^f-&7E~YW?t1 z8cy6Am!g_TcfUiZHJqiVy3BKzw8Be|x4lx2=>ulI4 z!P-sC(3&|_UU>6_hVMHE+lS0@k|_+2x2gSFC!IU*tC=oh#9FCeJ^pF;foaXq#SLd_WR>unw2h(0S(?%w>r+Ag6yJfa_1__ff{=pkA~TR@iX)|#Vy!^ zF?Vu!7{vG9q)**LtRmq(#cVdmi>UK&@3XLSg7?;`FUj|op5;D9tyu0o6K2ih;jWqo zUX`(mWj14DoTaM>7VO(q=Qq(0N%=5l8F@`#jLej7Vv_1c?at$rh=5sYt6@nWM?NoW)YFR>;bqnwWNt2*;Z2{t?@k4u{KG20YNn8*cXUDF;o+To zLh(p=f)$~te7L#6nKter%EMFfZEV25c#}+v$&W>sHdXUljs3@&`CkA7d70T*ajBh5 zCA>0lp_MqQHL;Dwpz+YJX3>*0_=P2F{S6!bU|z?b-dHJ~ceu#E^>`lf;RcF$mu9s3@4-N%Mblw$> zqC&eBQD%S2WSUo`7I)nOL9>sogeaqt{2*A;Lc|qoT30kmvSMaBWx;6QTduNd(&sz! zh{#Az!-DqKv()b4QEMsp=q1f0B<8ds?7f3}3iUuIVdtJgk^rlykW!Qg%H}N-AZY}@b{v4X=2fU~H}IvA=rg@)m2pp%%C@Oeqw*0QEPbT)Y}TC^&?lxPW0eQc#cA79pA zKpbVp^UAPvj1e`%ys_a45Z~)Toa@|O9p7t&o2Wl#=SL^^DaHE1T(o;QR_+{;#K+K; zJwKM-QN7QD9qTOu)*Wt_6ZdKLmi&v@jUnE;cG1KRh zXWQm0aVCS$4uO@U>t;nYDa@Oyt2gB6Oe%$R*D=^6D20j)W!_5}1Aplk?ETlA{J}|H z?a_GaM!*tyYc-eJ&o*sQIdHmzN{3FHyTZb{Iu;WWK zTTSn>KblWLz^`5!c$%Onq}0&OCN1UtA=}b5cY0219k^Ju@Z}!pR;4~Ef4ITO_O1e2 zOCAgSQp=^Ncf}c%hC%r+VYV)-e)f>#jc|4Rz+3Ml8EB_snE0h+HCDE`Pva+5mq$6R z0369WFecaqHdniHp4QJw%w|^&_-?Y1;ahFnxU?N61_W8y##zFBOH$7qTX_z(m_9Vt zU2=LIp3uZs&7Mi%3rT9LKEzS}ae;qQ!N$k;0j$XCQpt^biYRj@V2ZghS%Vg-eRbLA zy1{_B9EM8LyFj%VfEi1Ny+YmVdD@u$>IXw*B0L-e^H;AH`yLK?5TM!5qYz5I(DY(O zt)_d#HgpfSt<1E^|c?czx4mV^&^1ceL2B}e> zH&t;CT`S8B#{6k;>BivavSUsLnj1cvcE&bddIr5P1mz)tss}KA&__^E7Ec;GXir_r z<`9RRX?s1-jOztHy}>j6BpOJ{{3X`tgvTr@ zR8n8n(tfIkJznq3YIl3eM0-^J--NcEKQ>A>JCFf3s0;#`T(vdjvbYI}l=M^%{pbf` z($b*XjnHP*>!Pe=e!Pc^iPkl>4}lH}_b^BgK1?OKATl0QWU(X1YYBHKZWlprtNj{L zoe+9^JcywumkWavOK#U>HjnbkJj7NF9QmA~I!-)vmT|d}1R5rckCtXUpB>lCKuMDZ=`1uhUN<(9ldDDU z_E4~Um$Y6Byf9`Is!?jNMRnz$dR+Yc!NO;0@p?OT*)=@fBV-)Qb|?(UB4p2ark_23zZ$m_W%+v&+f zg-W`Qm~wP)_!bt{xz+y>pr&Y8%a$9l&X^6%#ikC^ZFE(2X`2k6*r6zA;+g5Ob8E^m z;~$M@bzkNd!xzRzXS?1P2aOrpRPkwR>fLde1?#K3K9@hKBo{asggu265REPkx z29R+1w~;b3si>mh59)d?vO^Qo*-6j;!pO3<{EniJIM@jFo8w@}MvrE*_dwg2A%Et{ zf0Mb^2gZ@isA_22wp54bn7^6)Qzfe60Uf?#dA$=znU1M z0m;f!OowRHE5sXefZT@Dw2lKIsR z2P-vjcbrMdef0**TEiJ>Hdwv{Fa~YGqVyc(l&A2hSHRpFMB}Uw>o(+O8Q;v{vvRt1 z2xW0~grP4&++7z#+ZU|7Z31=F&COfBtiZ6lTU%Cmmi`}JC$3^9g1?3Vv|Ze(@IVPk zwF~_hd5an7UVsG%a9FsOIf{3;=kD3f)A zOuv#&;}=6N5Z; z4?3wC7V>ThX*3F%Nq4(q>nX_89}USK#^&0Zy*u;^I4^A(pCT^zSzrd$IJsG>(SRt^|g?84>NgaiDq>#&_9m zrq9l-DJS6L?)bIZR^o;Gt5;Gp0e3M|qOztCyeLby)OLMN%NMWLdi)7|lB>~yRaP=j zXUb>Zhu|o%`bShycU$S^5wHq4M`IxtXh6T1h#_pznmt%&@mm@Wy!}}<)A-Q8IBAeF zy|G*g9 z#-Q(2_CVE{DqvQE6R2{2yVz%II1U7G&fhc60n=D=s)`zMbVzpS9#VHs?frmu-^0sY zo|%?ttD&%MW7}$2ZJ&Nd@xh)9`-4<*dns!psw2oguf(M=l*X5>u zmpMu)s|S^{VAxGTOUHrgEaM7`RFZi~ELvK661`|D+qMXR;NgK(RF0?lI;u?FCh4g} z#IYa19QEh;?2`QIQD8Xo&{AW1KYez=B~ZXy=4yC zU9DR7+SxqqTXYX;J<+Y)@E@OIZSp;LQ&X71gQ@S_fbiN)N5_hjsFKu4=(6~3B8{ya zMRcDlD<6UX|D1{DhWYa1q(1y&R(iLXQ93%=ms&NM<0Eb7CFOH6Uk8`Fp9#(Y&5B{zT7LMm_2jY;`nh;eF z0(;sWPS}-aNcUH_CWr}SQamaM25oI*LNw;e*w32kYZjU1j!3#KHz@90`5ZKHG<{tH zI60EZ-g8$c0Lfn<`}Y6g*$CD`?x_Md*=UOIkK+jnL_^3Z@t3lb9C0x^sqp$*2yRoZu+Wf?yE0* zV|~7q+9zeGURO1Z@t|E{B}zMG!B1~_KV|}TzE=&b^Ph+XsSDpQ_9bC2YiC1q6qA3(-@Qsq4w{-hkE91OIG;Q? z4zOn{gP4@Kl4|T?&d_rD?A%6RtUX>vY%P>rx!pYyr%F+D!KRCj5v}?#ZTN-AAN2{( z`cZn2=dxYU!Okfe%ZWkklJgFsmYl3L@fG>(zoW0h{L;FPKZ1UKymxB~qj`83caYQZtH}{XXsFw!cgG)Dciilf{!WQ6 zV>h+!WYaS-wJ*kCKj*gT4O11$5sa{vev*46W7RKAs@32Pb;pzivl;3J*%HHrO67Q>w=yyNllIkvx z<4I%_6nJ&!FDbF;^D5yWt|K%W%did-m&}m8a;dbVhTGj5NXWt*#!}(dICv@QyiQI9 zW+OvP=;D)-qC_?Gjt`xDLArCw+HN!lwn&e*xu&r|Ajt^x949AZoIDp~R6p$F*%in&q$Ap<@_FWRN$ zuTsZ}*NYzP^%vYAX$JNJWtqlIkKAF>e9hxEe;$VCrj^+{kF(o&n-cI;rJ>-qH6Pg7 zCnJ&<;x;#Qif^YP7RBCd9Y3H+sam>wFGy7I$Sz>j?k^gIHT(Fuf6a@t9Cd8q^eHbd zlr=5+4>EY@Z_R#i+?wYED2Y2^*|)&jfxe;P;rZ8jiAmR!*Z#}u!)!4U<-D9CTxQUr z9V#z3H?VMDyW0KOA`}^J;4j;jW}WA^gmzq0js-vZBp?|D_V}|Uu4!-=RuF4*WoEoS zI|$Kv-^*$YiZo0%PEM1_!M{6i4hg#zKA3guvbi?}hsv%(Bn3333@x8Mb>rqa$#)P+ z$M#3RfKaQvaz}!HKHIwr?P?~{PuYqQ#=7$w^WCHf5 zRZQ-{eB`~i5wTq`d;W)0jnL}jd%be2t)13JcSz=1BmGC{z0Si0Kl((=3?4(ZsPT&> zUV$e=_zGR>945qg)r;eMG@!_-8vyFUY*TAnPrlf=;z@IkmMQ!1>WJ&U_GHU z(wkSii3{3XFd-A*k)i6Iqd{8~{hZ#J1u0re$V-xk!q1de8-H5|5t6bR)Dz^H-`q|( zLOrX}?e{#iC-9c0lcx=v9XFVy2C>;x@)pXG;>ziZzg-IAg(kym=+&OAxFB(QQ}Ci} zQZO?1Wr(^B1DnAAE>Yhu$}cU}3VDczonFl)DvEUHvRU)>EzY{@1y)^G|9GJKPt=6S zc0I&N{E(JrG?|B1qOCGi`kIyQ0kG6pstR9sXzr`N(m}AlUXj&)+db}d8(BikClwgy za?B~1qVwo$%q{vc;10**qGj}S(dJ}hzT=l4BiBP3#}4(GTcdxzL$M)1Q*c$xgl78Tl}47e@a{syGiUu6*16C2STn5&kaZO zKyi+XkB>$Wv6|c2gN{IW*LY8-j;cQgHB-+ zCn%Q&lGP#bx=$ATUVjPe@^lOq$5l?&ZJ=l=*aY(bWMHac=#h8Z40J{Q;GHQgydC?08#W1&aW1<&=j{QarpoftXa?|OLl>!o9|mJ?v|0*oJDcLwmsoz4k8&x&odZsT{b+B<5pN40bHEM4g0q)Q zw&Jof6hy42E!Cc7pmzt8jP0!c_Fg!qkq8uL`rSK1>#eUBaO5UBMGfsqW6j@$R{80_ zp5s3(h4uSCr1)nGUYGf{qB_9UVZwd4`5XB?AC21I5mEGMyn{m~BKdp9H@G_NLjf`m zNP(lZGRoU^z(|P>RzoLc4M7uxjw<^77)8U1nhmw`H>O)?%;Ukxs5g7~{e*eUG3ORi z*Y|nhk25NZRHQXPTx&EZ%xPnLi{ULQU?rc6DJwlRfU`1v3O#S2S-238)18%WAMjpz zA=ffQJ5)LQ7L?qJ!NA)2+5CUE-~S0#tiRtM+y972eV|Qc|I}k~sem0Qpo%FX(e{~f zDa(m;x2}2oyTYCU(w)j|_PP-UB~_`ATosn)8ai8NlzTzBF{;iHQfid3s?M6uy9l{$ zdG>DzDGCt4zn*<2x}*@W2&r50F4`x2NvN4sG<>gR-l=&Ml2YDjaB6QpBNOEk^-i3J~TFo{AzpV)7nOzQB#9wCC~oq z)zlStFkK0RJN}XNFFZ&gXujf3fCX(4$bzAgqlS8Y?Rj-|cJrkWOtajzG zY0K8WzmYUxDnN7!{ZE6!^~P5XVPLFDE-fxFC<)?~6CxuO2Zi<^XX&S?r0`Ny(tv;f zyjiyS7uQTBIS22{wvLJtGk5vA1Ga?nFOV!=&8*B^G*6ZS=#mG;<{}q8{?qsoJoZQY zjpaBwCi&2%S6G!nl$E~hl-Lh)84zZcvD#o!j>iCDiPWB%?;G-ofEiozZ;N{|=MCnE zKBS~~D_cl#{NiWqdLD>^N0hX|`vm!jB#pzG!Pf*Wm#qR)=H|R$fI?W)4Hc47cP2%xh(@E& zds|yg0yJ2Y1)SXSWP;eJ;7}57pqQnU=yqW5^^4=iYEUq+py$P(SlDsTcSc&e`!tz7 zbkE0j7jl@&CqiLDX(e^K;c^RaS}z)2dt>UsP-k9kU^BzV z9A5eu(fE=0!CyC~SS`K}Y|Gf}u(rm8+~#x5c|iZ@M{d!Is+SyFXu(jr-P45&H$rdk zfd*e3k4mq5Wk=1e)5*5vX^1IHA(bVg^sL)MnB?O=s@Ndf=>W?#Xyjmo6uqEd1;Y!O zk(v&m1HlR_RM65nR&UFSLCPOI0A-(qZ%TU6S%o#;5KDv7F_%bbn=uzp-IK~H-t<3+ zoeQMu*XbjG>3oXX7fNdIlErsJH3(Q)eMYX+B0~nNb4S-)7+iXUDQvJh9CMnB!q(GVc&j!oSGfKuH*h!trR(#PKUm8 zTn7jkNDC9@ay)3#e3ySO1?b0MUQmnr)nxUf*O*{Z%y&_EQG1xK>r&!NA-q5MICF7) zA15?hqPc!apX^^&=j@ z;N_GMjf%hN=;LixGE?!gVe4_sWS0zy@x<(R-w_fxI!$%mJ6kz2pv~EI*_gi7J)KC% zIPkI@dRs9^_~;53)Vc74|6o^Obp6)wlZ`~g0~O4d|14pCl&&&!a2;s%CgE}hTlD*QV$FSTO|K-N6$b#r2p>ymG#YN94F_BgVMhkyPDEJ zGG^~XE;yaIOT7fyq1%lFPdef@3ApJFXITBZUTQFTa#&MkF{3mr+R9n3QDhwV_E`N%>5vu3idM0B<1DgHu#g3@@Cni{O);A}8A0UxQ zrHkmipK8hk{88&D@VRx+(_MalhFBS^PD<7t?SIhy?IRO{h)8GA-8cmV3%jZNk=8=S z^Tjj$OntgfWO_)y2*b}zu+>Kn?o|`K8yIj9B5`NR*`vuc&FHhaj>B-F|F$H>f&NU& z^yrtB4<^;&@}2OB!`EaxQsF>;vzc}O3q9;d->eWjC#N51Ee9JJ#bccR*agxFv% zeSgY=hEM-N>j8^my+-<+lar0Ht(@<8{+-V2+TX zs5$9ib{u5h@>8|djYL4ZR6N)b%K*$PkNtGWk?8qN#LU=ROwpNpTk>_=ea?taG0Dub z>6;3A5uZ7}FpXiLGnO<2IVUuKM*Sesx&Q(yFe*`0r4kP8SUMWpWff!ijQYJ^UDMZY zZ15B%YVbxQ52Y0Gs(6|aZT1r=@!I=E`8+?zEJZ&^Qd9CVVGxweh#AZ9NJ+OZiu~=S||2t?VTb%dIhne=fr>!c4h&#AwHof6-=^nr(m*}lN=A#+%nI^;-8mXNKaE`dX zecQ!3KFI_6b}3OjmlMm^J9hjk90^4c5k9bX^cE)b2}Xf|?7ab= zh&7E0#PKu*7MpnPWagO95ilT=9>brcS1{vAk&TG4=!RbXbokwR37U^_L{3eqKC5!D ziHO)uc6kS<+xaU*B)*$lSzA5(&VlI2P}XZAg}^H@P8!DSK>FDo(fJ@nL&;4=ZW({O z8i&Lm=oq(VBA$6l$4+T@J+-#>r0rs~HcP9jfzfr>&Lgs8T*`^-z`Wt0l@D)*c|jZe zA>v<6U;i`P0o{d=h$vuoB=H!Tk!P>^M7PgG&s7^c&Gz8JE1R1KE4*sgNR%~^`^ac} z9*dv7bid>F3fhDLU49Kmjr#_lSH(R;J@o}UyE5anNbR#cn=%pneedcRjR?{z*`EtJ zZ6c!R#er)|xvOek>uf!x?QD-j>NXNQxcsTpmd4okZO#ZcavIyBERA-NB~B3wAV#RW zYu_LLH3-ZF{X;{6#l=AVM~RDfxWXjCLohj`{{Ug|ndT8DfirA1J?iW+51tbo!62tw zVwh4x?kA23dM@cejr=jXKrEX(-G-PnB|Ma*f(a$$0+#aY^2YHjhM0ZIBM?q^mwS79 zx)y>(%XU$fbqp@fxy=9fq8hY`I_UgnIxVuEm|KI&Ie`f@A(9*|c5;C!X=y41oxG*U z9@K+_uzTncZ9m?6Dp^96XoHvD-shPwFo(i1k#<DXEjQ2oqk)ayJlWYuUbsAVZR!iaY zHKvtZ?lkJEJKo$ED`~2hL7;2+{!mVe%K;e<+Y#q`9bWZe?X1YI`FzOz|-_75S<*1HXPXaG1UI{Is&l z9pamw{$mV%*4lMx*g$z3Z!)CRUgAyZfse=TGi}YnleivyV4_VeO#kIhF&6)C$^Uv2 zJ@?)kP{pnTTEC`jnZK*#GN$woiS$+=dU6iGfu0`JbNj=G{M_b0Rf-bn+N76C< z6_mH65z2aF^t2lc!o7sAYJR(p2iBmQB5Tu`<9PiLQI0);+foOpElN*e2P0f z1F=b<&VwCHSI<$@KO+Bo$w#`mlM~_nns+`Wqe@NIv|T2QxFHt33JtxXp2`(Kmrm<< zv{?HAxh)@{odAl74+WF2=igyW+Tj`jT&8e0ijpS_3olC;62T3S!tbD6?t$b^7!VL{ zzjyB_Zp}t~o80oD9A#}4Xd}NY$Cw3X?;=~N7;%7e|MzJCzZ<@hqB$cqzpgc)CQKhy zZp`s1!>7x(=tNG3(SWz3`Req`*3#*Zr>3UAj9*IqI>xYeps$Dy6A7#J|Y*DlaBvklP)?!jU+riAz}k{T`|Gu~I6UOOWidev@tKAQGMXT^R< z*#r*^LwRYn7Hn&+^WxuLIIv42A!@=)WCW4WKKhncvh!oS8(t!9MxjYxR_3I&d88Wj zqVW;GRi=4C|B$tms;pq~Ol`zwvWUC(!e@?8s!AU=4R9c`1>28#Zi6&s>nRA@Q;`q2 zeC35C1?Z1R_a17et0RkWxp-@g^&{Rgmxqc^DuTJuisXL5)8a-&XjCVgXbjS(zUJ{W z#USF#{~_(I!>Y{MxKSGfL_j(fq+41_X+gSMIyVT?sUV$_N=Qkw>4pu`(ulB$O-M_N zG>Cj_1J2C*&dhtxcg}w^m*ZUfd7icI`o--m{nf}*fUI8a+G!-i{8Cj$O{M%=WX~gju~5vYGgE5nuM5|dIji0hO2v?gyc@W4==;cY{vd(JN5-| zEEwB&z=LB$ul98`+TFGf`&HRI=eRDjbw&>f{kj}W%;EgP?z}vd5^;MC`0zj z)a?jwy*@IMlt(TOQNYl2-tj_NVXoMCs)_6~Dq-4+2`bqdA}>rs{U766JhaD ziJ{F}!K9C4Cu)Cho`@2u0S_v(<2v{ejI88%Z9F|D-4#OYp{umw9HAEvs~$Vm&{^B3 z)2(q|NQaYIkc3t)SyaZVZe8V>lMSX>Lrvg|rK0Ldt$^R{&VNnL&p}I&MSqW4IP{AG zuN0_hW9nAuHN0y}23*1P4^IOIP=f63Z450juWX2G=?{bfNe>aAc)xWk{l5Iu5b^f4 zL(QZz!5{wXGt19}pCY({Jd=6oef`TU>1e~7;M?Xcg8>zfz8V-5Xb!`IuRry7jr|rX zI>4=o1sEsbx_dZ^hpmG?pe7T^I9YKtZR?6^EXz`nB zsi_|WomyVb&P5rJp1E&{<;QDeXl#^jeEUWSpm_i3U%zY*!nlz0T93K- z6OM3le&3*=n+Uz~sDCRuknHULo;XBQK=bQvzbT;yy?MOtqRT_!h`_hT_cIqnY|Wcb z0(n;~04@b?+p@L=-H=QGZbbywNrNKqS^~Ux8{z zAC{Bfu(JH6=&7p1rD>UNw$}Dw=GK!qtK2w7WjSSi%%25^hGb|N-|BeuQ0YJYTM zwg`0UWlaqqBJST$-bJ~qDqoL@WI)gZjOk2q`oRqEF6Bd_H}IG^b#498-p=h-&dE?~ zJfJU$Oo~H~9;3|O{H+9d5Aia@h}#bMya~gU)vi}ipUBVU@G)c-Ex62C zRc^39MRl-idm4I1`CB4r{6&RH`ta4()=dQb-yhB8?6##NAI(5>|G1Te52&x$gilXS zzhNy2dL9j#P)~}V9S3aJ%FYBdjJ0Fj6TPB)r!J|6TRrbAibx{;KJ^l)j(Qg1x*iF& zQBt=sNlI(qz*07BefQRKty(p-w}HXKv+Nr7)(!KJT3(a*L(PlA6p%t0RpH6+-%E%X zG9VQ^Nc$Bq(g*}2(B{*2GLIkcZf{JXw*jrx|H|nC!2jtix5dm`LqVkwZ8BPk!VFA8 zkoQag@%$-WkM^{9(Y`iac&;MTdp-_vzhqvA3RIG!JUiyzRE<>Qw+l}z>`)nei41_S z9=)h_5lB*j5^@Xyz)pw=1k@uXKsbYY_J36S6Za;hpy*iVZ{oGz;RJmA?~Pt4Zxrp| z-CNfH5!!BHoEg~-{SQyN-_w$t;F?(+p7%`iHSaMs*&LSHj$k8c9@{p+eFQJWtWP=- zlD84p&0q~v_G$L_YWs1&r9g}UapR3LA^@QoHj0awhgS=5yYL!{}J(MKxSF<&tY&zIyd|0v*jaVt3m5s;_7z)Pnk=cl$4W za61sKvS*D{WD&4@Dqlxr(%`eC4r(Hcp1pU>ExY&dn=ZL|LS;# zgoAfu9if`e;``0Gx@SLBAn~uRhMzck-_?Hq{=SN<;ptS5X0fj;P3h-P++-QPKv&;Gcbp2%<;M zebm<`xL z)CH#O4{;x`KX27PT?NpiBIMrF6H&7d!-dq zfk_t!Hk0aRaA4lcuO%SBu`JnD!{*ke=;mk5ea=`?lp8xu3HCj)&y6&NP=LdZ%#Fa^%tz8&#MJ4;kWhj_3QZD0^? z0TafbiZ&!76lsuP^!8G;pmwO(B_wq__&NIT)7tW*u3Ca3s;`c#Dc&bHRPUgh!4%-o z#&AdY`md9Sl(~86+~|)EZ*98$6#{%E{7O$03h!O?`u(PqEk?~>C!_%pnvGs3T=le7 zRU6)Nb!@OI9%AiZEw#P2(@irWm2)Q@R;Y#X0Z3e&2Y4UE$6c7qy*Kl+#EF;{c{aX- zPt4=(=bxnIKo|qgXQ0;PE9I*4@3rae$w@RSU=V;0UjC#q{K3m_hE#ImtHtZ4*xdR` zGdbSa&2uXXn&Tn(1aVXEhJoED2=;0`KwjL($;}-eo!vjzTP1wdRDZHT%j^6LjfOUU z#uFH#(5*c!7T?(#%{~_?z~}_a{yGJrh?LkBpJv0f!I-WGn_>J0bo5^goSg7ghi@eDd6T`X zAvRvX(*i5CfaDefqjvGC;XmsQkuJi7UsjcX;SA%$R1RE<5RrAFSf(Ks=GE}Z+(<0k zTfWdwj9rz6jo$lJ8)g;7>zj6}tc`6BO_w$MPP)al`3NAWzaCj{-^ybP{wWGCipTY3 z&u$rR)RO0qF%d*EIwxNJN#6a#0qDJ1ZFgW(2&hDMiMt|nCCVyAOP()=0)hk;Qz0he zgmaWc1ueFzK*PuQ?J$x8wErW)?tVQ^VxeX6g5l*plsGD(Oki2(Y0iT|CqzNm|KFV( zmLEJ=noMPdGKZ^8I1&fYd`gE_!k?O=1H%rsAKyxTdL7JA>3pxFI@P(KwGyYkyil1w z&p_E#lm3=pki++=U5%5ws?(x+wjTH|7%y1PtLQ2M#r%_|)>aWs&7|p}!SKLu#scNP zLh};buHBFnWJTH6zJVPb86H=O8UIJi_BY7VN6k!gB#(dN#m|(}V_RNL-ji8lU4wKK ze;mbe*y|U^`YnyDW3~p`imer&J*m2D^{H=-%MptC^v`lX)WJJ0oPL!LJc&NWwWQQL zU?8DS#dDk^9%&_f5m#DzwDnJ8@zQKZvcK(lp&Ugzln?JP;)B3KDN8GNJ*N3Mj~Gyi z=xoVUn1mnnScbgCO3qzv8dkZwH_7N1UxZfo^UU|f)QJ({Vw+&zF^Kk zGA)m>2Ub@V&CEZZ3`kAXko*w2vgt?3s(;e_LCcvEts-5jUPBK8=9jyOw6|}QqNZ7? z3w=$Vp}L7iPh`O|5KiHAO?{m{MRe;^=wY#lr}F(@ZKTS7y5+tb(cv?#Uz$XN~%*L#UhPx?cYVu`IQCeJ9iB_8fQ*_c3_fDF?W@rgGKi$6hFIa zCmT<hv^x6igS_&3pxNqOhOh-pXXTem$#Da+Z zjFAvK);xS-M_Qy42X&QHE3&rv~SAQhgYrCmp&@0t0pq{`n5|4)O8b0^ykcN5+G zDRb+?+lmEvV8ZHl?dR~(F3KzO3J7JTX6YYMF!VjUgCDbzRix;W-2hr*3Riuyv)`yU1Tt5q0Xr3JOc7-eN$$}iiDCx5+q44|&>K%Ncg9enT9BcmMyBnLi^ z`Ofd?+|OPxG&IBkLHE7CE(P69WeW6mTrn8gr0P~|8XIz^GnPKgJ!^uZ<^l3#SJ z9*fmq)@IFr{?&_Ukf9C_JshJfF5Qa4r|VfWtlo63HoxrxpFGOK2b2*uVx4Udqlt?_ z5VF%wmW@#r-%_4m{^F|1=E)c0r{>J{;~P7rQB)cWL(9<6zHJ7;5RoPUh}}AQT~_9z zc332#=0`m7=?)p1832@nt-X}{A>s0(riF_@zWa-FAGjz3Q;DN9Q;BEKW0b8v6~ zTUXZbMwbMR|5@s1dZiYihf&!E!o3OMD6{#~!KF~H(=B4TMX|Z0t0uau*aoOa zq^BnyKAVj*jaAp0+3xk?F&|LcKiWS%wA7@<%-t{qi5<(G5A!37NgExJdU! z3^31VN8O6Jds&}@>Fa<`hfn|FWPh3KD*3@QYD}A|Gp7)H5CDQSbMW+8aZKR9emz!M zS(!JUD9*XB@@?mB@|{(&FVzIZjM+=!;bBx<926Fs*WV^3G>7gwA>&=Oqq|}cgu|(` zvu2hT_!?S!Tv4>MK#h=#YWtdLqPxW*Yl`ku(7}?QW7o-Pc-}AkeXx@{tPJ-Q{{lxB zSRZnHW8q50yZ;tc)bkkU*~8f#Hhc4Y=JkWL%ol%$bo>f%3FbUJ%1Eo1FEL*aJ&O8mXdbeWQYPi*fa4+iB(G4nryzKL5`Y360ojkFTSf!N)yrQpFAftr(l zHre2C0gKan(z(DD>|kDB=xj=$|MMsUE_~{9dNirOh2$nnh9|eTzIOLAbk+6b=+miw zrHj%h&_C5;rZ_zs3>a8fd?=Cj75Bf927ELv{CjXd4AverkZyV5sW0wU%QhbwMPpRDRn8-WUi_n=t!U$0I_MohwEikjfJD=RdOWbBUM-)Dtwub&dXfNyte= zLV}2xF%!4j=A-9Q*F3m4o1ri7=BS8|)|=c0f`+>^gN07%UytTHcWxIx30$rQaDhTz zQ?O^-Vd2}jV}}2mx#evwmWyZcH!CY+JJf&FIAUckRDFBcq9T}@!|Xm&rJUUGACxUFhNV_+cGSZ!bzf;&H>9_-=yMfL7WqhA2Um%)tym`Y}oUGk23hW(6c$C0rDW(^FYRY>pgB!QW_Oo^&5ct z5lGb&lFIqn*v$X+w_1R?FrJYca@wQj^H25ejG|LsQl8bs5mBDcARfADpOn;7vPvBV z1IcGMfw()^MBLxNUvYFGLP3>LP9Uc_%ZeE3`2Oytl2|*5LfZPP&upm&q(&3M=Ra5P zH+|Fy_*#Ost-K!dxFXHusns7az;Xg?+lFoSU*EGGt6jz@?%eqq>E!%xtmoeYpbHqa zK~K}`_n~-i8_`*6(=nqvuvA5d-$N>^`GhB2m(gbgj|)V_G!FYbmX@Cy42Xb8ZA8G! z0tr%7mKJ1w0luw#IakilH*ShmsQVdtIDJ^=+&^dd%sO663-S5$nBV8m?8YWbO`9vS z6ByM2aBiyqHE%d4A#3gahsmndw6!e?Ky*cm_7MXqFdruvSd_46E@HSd>h$DRinjQt zFZ=XycZmECy}Gn+MCyJ)pN@HGT_NP{@pFjR1&TT%>iCJ3ExiWL)vwvk^`Cd~-Md#! z1D7BcejeKabUwj9Ho$-wXx5*x4~3m|+W%x>2XHQ=a-du(s;mOcq-5g^5ai`L=l4?U zn28=4TaCoaRKZ%fAa|X3l#ZBXKbavALLnDfGF|iAnrcK?KTOg;gpB~_>qSr3`;!h zBv@R`-@xl(`Zv8n~bw z%d4v0!wRG?(TzA!)n~wh`cf!bzohB;iiXcCs^`mIMjnWrZhy|`_|(b#u@DxpRd;%b zawho!8dh))iXq~R7rnwiXp4YWf;NRoM*%5A-iirqJl24pSp048i}@}0J&df#x^L4v zG)LU9kRPv!!H=iH_G|id;I_8&<=Hlr5((F5ih`G}*ZN`dLn%vAU|w@vA}|V2c{v$B zR863Y4z?|6?SLMGrtEySWWIZ0c2E(=E-V}Y3?4BsG1D?D$lhtX0=Kr*q|)QvpfUjG zmP4NW>m!`WJ=*+|+#jB)T*&YIp}G6hbiUlFSCIJCa*y7Qdy(i#-@18`qgQTGbus$% z1dCsM3h}Sy-5g5_B_`4b7;_rZ2`E^3mTe7@53B)(#T>74aO8G#R+%`BaW%HhHFJrs z?B{>nKhGlva^wcaTOmICS;+?{r$4WH|3YXVd{bs!6F%VjfzJ6hIT`qE|N9gCx6fh9 zKTPN0g_3Q=JDa}%QUN6zso^dbJYY_x3j1pK|vkPCt&{cOS?{;K`VTi)l}U z*>1)F5P0MZi30pVss@WOVS5esor37@y07s%0lEOvaon! z$wfvvPk_L-6&ND7wq>XG4ZQ5^d?Mg^gbS>-?6-#=fUN!hIGc~vI9qxo0GzSMJN|;f z?Ewv0%g3*54qUrzoaGv}Ar=U}k6#X5ceHOP>LOmg*SiD2XX_>2i{YHrm*@=^jfTkp zuOi2s33rte1>`3=#!eo3ne0WpR-+vZ=JiPZwjV|dukh@l+Jt$NZ@N=bP$AMl{lY-w zxvI-700Pg5bbOXst8^L5ufW1N<>%WM!g66UFt^onxP5{11NU(&1Y(&S!7u;!O+ z>d{Aa)hR#~D2)kC50yT1qsBIc0*K~&jUpC3v9Sd%FI#{#JowK!<{wPgeoMf> zxV``aNZwN2N=?S(#d@dod|b|MZa2!x%FH2~Vp1*wY8xf{bp7q(fjcfB zZ}8qx4r49ME9q4C^K2kSia&xzC47HuC)nv-9O3iQ8cg7f92_v}_Q{&OPd17U)__{qJ6Q5V%PB=GMB)sSn$S9a1Icho(9#z`Ra zdiZ7TGyB@OJ0X&!vDIlNR9ay5;N9ne(NIU*!oJc%x{|)rN5H0?7XDC7kEM~oD$fXu<{{#@>EL#$9R>s|u_Upn7 zA(^{vlS~ri5zYJKy59=2NmdfEfo|yCJI$ICL(M8F;Dq~n_F@_dWtNwuFuK1+1FX(d zy;f<;@wn;YI=yU&^Llw5mC;ieEp?=ZGU^@IpAJJGV2YT@Ry4a}lxZo0q8}V}0A3Fr z)ek>If?v0pMAhU-i1Wca5&w_S1rQx@)&m1Wn}8+291!jkG@gL5M^)n~$&}Z=5g%lK zFZmgUum?ErL?R>68vckL4B4g2L0l74M2HeXum6qK=lIrRPN8R?3QY9{@msCCiP}igfLgr+Y7`vh0I%YwI>G-)O*d zH86F;=xx}k3Q93&;H|1W_cW)2%WIvC;m&uf($KGm2@Y`Xr?uAVY9?NfU1!>TkWU-C zE(+wO?NxSMqjq(Ki5{w>PHC4eV-FAH@S9kuFCX^(tiOQLg8o?jmXP36Sc{KjDt4Qp zOu4Lz{#!0wTa*{-lu0<`w@(ecrV@Q+{V0HUL) z3VG@M2vu5|Kq#lYchv8D&VAq(uArgxijl{6p*HYtSM|L&H>(M7d_5}gJC|Lnz4&p* ze^|OE1{x&;NQY>Q0Zb|uh`Y}a9n9{NWUyomydlcJm7ZasPx{0A2AF8SHksTEjIw!Z zcmo(a&(qe)KYa?+6mkuZGp8TWO*;%uSjH?&6q4ToaMI_g&kIpJUgzJo+)2RwVZi5f zj~$y+tjVd(biR8O?X{QN9*p$|HI&|_EsXz^Te~!Cr8xC4M*~9#(rLTaeq9w?NY>@$ zzLBVjP$+uGQqbqon5dVN%ND#bv3|;~*X`@9#51cihVOmQi3pUwYUmIqRRDQxsY_D2 z!au)-mUx^BSvSj#x68-n(Ztdm4F}853|7Mcc?c{&TWt#rQws2^eEbhT;DWe@=1y{YuE<9k^h%{HYSk(DHvWw0({nCbnN3DmQ z1z!5>VB{O91fanI*W+%a2H?RhS-YB~`o#B{QQoHWIVp`d+b)!FTKuMxmU zbEd0q_qtXDi{jCP6q+NkkA&Pd^7&p(Txe`I<>&F}qo^$dOWN)kR7BRHO ziZI(~=uc0VH2iAR*9-ZS=hiyR*=cC&t`l9jr;dNr;CER)iFGn*+ zf77YkW=sCC`6+9>A&h%mo9G* z2frE83mH`-qfBJL8dPAAuge|zC?6m2B36?(SGFZB{r;L-n~{tSXG2$TB=z*}ll|{{ zvm$WX29=F4^d`xznFDo0TyB~ULm6pGr>smvZwZ=kT^D|s9t_r6AZax z&s~|xzpcDc_!5fYt0=dMm#LR*C$)71ys9Jw;=ud~5WhO!*J-%`Y4fJ#y~1nilvMe6 zy`W7jyMS7Np3WKU!Sop(yrs&pisosG4mhiyen1aW2a6hOd=}NHdQPrZ6A^}g{myG1 z+_iv`FohoUs-fZLojb}uTIAf1j~3XGYj&4tGZ!eC%O2r-BK4j&f^gqaTp&^ctWfDKfQJi$b23L7Kk@8R+!#$ z!>-O{MSLbrzM1j3Mr!W`&bwzH_qrK89Cdxm^T^wNOj`!g!KOZ|8CY53aNnQmuu&zA zLRcxnr_-u=HK(S7aH6sOJRx-7EF|QdsUGmJzOgJ2O?PapRwGMKV8kBR2u3*iRcqY(31I_ zt?{a_P!HE!8k;COl-npiDU?y@qsr4Scve(?ZFs0bfgNDmA<}-GzP9) zZ_%kBXBD9daM@#~+2an{w898{A|)xRoT%gb?>_gb6`F7|?ldLnV-*#ApLBbyMBR|e z8Fl6(t%x^Jag%^SSL9%)OaKfO{=OC$_*T0AB=j6%0dkly$%u5JY`GG#y%$PqgJH@% z(#4>;tH}aC|Ghswp7a;t_WUg0R$G418K zYn#;YRMkECg`xOec9ZRHA(S}nRwn9z)z|#)mUn{~q%6|Sa^e_?xhJ=sZA#A4}M#!J!stIOG$+pp!RV!?*exKo&%`>oO_BHuoA@D@CJjU;}3^4 z_`qw#+ke^?Y8zqb#5Ej1P|@e$DOE& z4)wx#W8))k&$W~Y9kQ^fn2Js!(yQ+-cd2Ml1;Y%Zis<&^62b z*_TV853li<+hwSQZR3sc>P7iXu4uR{y`IYmy<4AXzvTDHzUb|EBH?`*7|E>Y_s1TD zLZM|g6eL0Nh8f>2bU1~|7WKE-4<-_N>7R_ozqx0d*u8=?0av?M+V#@dlko>}og&;u zv0m_91%cu?v-P(QKvQ#>q-&MX$8*wAn`zy}0T#XKV?mATaQll&y_FdFE`)1q!IP7c zd_Vx~g-YE2U`!>b9d>ioBK@0|US`K|;=Tb9VVttlTyz=RLv9<`?RF%D@5%t3D6D|p z@%pu|fUHR#w71h5Z}A8)+ypz4^neT0Iuh$^F;rAj^hL6TGwshW`QM4$=h%I3L+J)p z40RSI8}zynYmyMAr`E$Oh7QH`&yOP798D&h->Qh=p1bV*bO0`U^7fVR!v9*;l|Rj~ zYE?6{V+m3_gbsXC#5bM_?WC6$!SV?f?DIW3$<;% zRzx#WRV!3SmVR^dk(WG2RG6C>r>aJgIyTFyyMpF!KEASrCEVbX=0=B20rplHLLha=E8Z-D;rjMjXB{KkJi+$`itf zrIjlw0^zW?j&@^2pqS)^qGK<}W7|=vI0w>AONJg(*JY{84gMO`zX~=qtkr&KA3jzc zz<17=1aQi+kLGXM(7C>+(BvmCP$d+iyarn)z_`js#0Y3@LcO}Nd|GCoe;svQ6a2y4 z0CTtlCIa>;k`a>FcT&QEEYF}n%@%9#?#*ar`FU6Ql)enG{Ku?Mza!i;yLk00(duE4 z{ez;^{M-(w)n&@rpDna3_XM>~U_~_ZhyQ~a*WOi2CUyJx73EqhorHfo^z^xo0E9Fv z_(5yC@jW^QbVZ_voZ4~Z`e_CH9HEQphGLpkw}ZPLTk8ovjfhKP-KOf`8otNPK=ukg zcSGz$_x1}C{izgiN$r+6xhuM^duDFO41TeSI;KlDlLucPX^*aT0scU}wmCSy3Aii8 zIU?lA#bLGLC6D&O{+`>JFPkna6OZ;qy#0+Gb=q@%0xz7 zf_o$Ot=Fc1f;ED~yMdO4t*|4UgAv@XI^y`@R?5YacS3p(-yAT|V(6O&%x)K8dBhR< z$a9E%x6?uudRjt5-|9v(72h_sACK>D)SR-^GAd>LG_<8}M}@Sruc_*~r4A!Q+vK37 zKu(^dJ%rJoq&C%Z{itIy$v}=5e&3%R^FZK5IJo5JLzf+?kGpD>bL3>jAC=?xwg^|Q^AbN8#KwyA-5I3$mcObP8D#>) z+a9F=RC z!&?2eA{}368$gomvHaB5{Yzti5yc7bc^miXc88-qMdtQ8a%D36pPo0r`K9K&iQKzs z?ud?WyRIaVUp#o-M#8k2ZIejD5WNNl9l1hL6T}LG0)EBY=lLISQmDmdd_NqI<_Af7 zXjjZ$x&Orv&8oHBfIXK7nt=)8>}&40naTz%uUY{Q?KeS2)SdQ*n{tjAm3U$XFQ%>@ z%u5&=foi88wIkaCq)BR(sj1CIoweATEjO%$!XsX*E0H>V$o#6{gfF*%_cbbukVl3A zOGk|=1ootYSqf?;>fc01OSQxU7RL@TZjKDXy<)0v7Z24vrMFo_hTXMBegEDO&Qbf4 zOJ>kUlBmH%MeWZh8IKR01GCS(*3*ac&uk_OO~=SM#cAUwPKDxO@Ir~YY{-<)=)A;QO?p%1OT!OpP8s7lI`c0&=DD1ZB|JsD z-&{+~vAvtMTlQnStv9X}OmS}LZV7KbYeu}TBo;6)6nhTCui7Ej`MfY^Esif2mo;Pl z|!Np4VDl zru|nBhDUN@K-qQT0}E;65}urb8#A#t#FmM%^uL7Sdge3jv&e1YDZ96|g8o5a%dUAe zrK|Gs2ld^LJT;hL8iO<^CyO8Yemhr0&x;=nI)fW!kYE53VLum|v5Y(rAUW#*|GqSu zxPP2+wd<+T2PpY<3x?NXOt{XzN)F$O@gQ}ony6B_Rk8Ms-Nu<{U^QiV=O$Q5nQi=r zN2)@j`h?|&Mvx<+>+))R)iEG703+uDzn>ZgBbvWgk`@Bi<;9-l@>;>f$^}IxX#GUl1yG0UI?37d(Uc;_* z-ymu_F2*|XXfm|YPbG5Pv?C{nU*cwv+d+o|t@9o|_roI8A?W&72Vwuj!?j?89MFc@S|^&j2PT0`C2^a%f7l+q%?~=<9al zm`PzpO_fM+u%OxClybsTAw)!$Ho@`;&pX>i>8~Zqj`GF4;%^+)vlS#2>Wr%_y`(hm z36bQcH2#J%Hn<`r-3pc)3OWwP6I6I7$@WS`Sygzhld_-I3P7$nsI(O0Qm5>3qqs2~ zfA>+N!Ujy?UDy{BB3`v5AJ2qq*8LH$oSp9fipBQ7t>jZ8v`juFQ*Xw&uhm!;>&|ok z^=x!2s>eIhTPZ^>d{Ae3iHDdbCUY82EFe~W%7w)bw^b|Zgx6(0e639(UotFPdg;CH z^i4-)RvB1j&T22Ja@CBBF&=UaQDPBs_SJHbUqt;XQIOQUMty;EX*N{v92KmIoB5Xx zmlEzHkXm3R6OI2WjgOAKH-nD@@3MukYMy6Ffi_NjFjm+?CPXh(ps=}hiU2eTASGyZ z4gRrbwf}u73$yU~P(rP0Va-N}ib;+D&JgOuCjYe4x79 zfG;XjNkGK@j*YwG`>t_j*AWNj4>OOdUebrs6;iAmV-03Vi(*r#NlEeQ+W9i*f6T`T z6cpkkX;9?KnAN69fR)!1j^tH+ikb}Xwp_b8L<#)Uh9wr#-`9yfeF!U{Z)(Iz|L&!P z6(0NHE;J)tT=%xDU*;W?6EZsNHa+FUq*3jGGKG!aWlJ$NGr>WA3@P*c$70HSV5npV zt-Z9=Rrb98KAt<*)@aiHrPD5qrlX-c7goOSb@wOR+_X!aMQ1%dVhCxncfH>4T+*j$ zduF6W>Jf!gLd|y*p%i7(wEtXGC@nY^nrQt!{@t4-f=dQ+*D183&I%qc9=9U*IQ;Y-7q1*X*?90@gKH z!EWLkt5_x{LifvV(rA85ZkJM~rYy)7j}_D!U3BlLurV6Y@^-4-Pufma2G$QO3rJqdMMGb2O8^+w@vaMj z#x^50TN9sKU(eY1ZDww<1a7UkbT8RJLRjfnZEH)(H(X%MG_X@aS(lF;1mQxpViJ9+ z=i9AX!>gL$f7S2iXcUECf2qiKJ?XnsvNhWR(}02V-OG@T`@a8I-`5HrG0!}c+9hYd zRHGa)u@IjIM>H+LU8vi;4L3`Ybdnh9UVGaS`E*-hDNhDEu;*6Q5U8&E2KQff4x-zQ zufn8EE58%a!ce>gOpgm1CHM4{sCe`6hZkVMjW6K9iXDibe@n;yN1es>9$9CZcD*hg zVsdqDka>LzcZ6xy z%HkVV(5wn;#9M#S4bVW?;V_63IinqMZo$xEMbQyY;lWQn<_1EG@m}#ep!?0$7jA}w z5mHOR;n~(uXPQ4a{OPJIV;m0C^_XS-By12bf?euxf|*eN%l9*Ri~!IE)*n*JA<{Iu zUIeH(W8AAKB-2)o-ty83O!9H7D^#$vdt(qsmC%6CSHe@9iMGEYGhaSs+s*O(1Mf|Q zs^S49|22}qt6N^iJ!cJ7zyrzcUU|7OMoHsP0OY2vMlW!g9@*Ai#eu#bmN0n`nRQ$vB8l_7oH}(;faFj$NjYM!ip6 zOL(l)My ziVNCeeraV}Vd?*>TeTv=#sX6URzjHlxm7*<(SP^Ta&bLOZ=E~>0Ys3B-lf143bVw| zUfHNu{&8BipE9jzY*Bl9;+^C;)l=u{YzjXTe6g6s@kNkBa6NxKzG!7*g=G`Af8FH! zlsh99>XW;XkI0{(x}u1XKlya288s5CaD%oGiXo+)*H|&;Xu=aFKrdH?C za)X4d7uuHf_&Xt-zvV1&In}(hwNoyN_4k1Zouq(PtN zm7MsIIeo}to&81kKBSoC(xokCDGh?4Fyud8GQ4S^8=OvOSud_Za4FI}9UngY0Cp#+ zm_=L>H#SgQgNIO-80UUL;(Jw`T9ggk=34M~ww6}fLf~b_g}VaB?)*nRzHpsM3U)Rp zMpgYWD`f(TVl%TPM9e$`V|a!vw<@nbkc+{fbVa+Iy3fc+=5wP?XdWC-i8$g(b%oT1EMed*AnN?Ntpi@2&OWx;yU6x$`i7 z5$f$MDcVMdZ2Y=fS^l9J9ydIm6?{Xc@S!!oWrDT3Za(_{BI!oC4^>COhnkTe#BSCm zd)V&IlaJlK9;XTNQ1uJx>KJM(krWhs;F$HI*E@fa`RUxFU9~$8a7YYv!Ha3dX|BZ; zR~&Ld{^{K}IRs)F@#%EI>4w#)t2Z*{BJUbZ1_|jkRbj)gU%C`1yhI$Ku}RCSJ*~X2 z)hnqlfe|uk36U3GQycd5+VVnZO^~y*@oQ$r@>i)-l-%CisE}0V8NKt41mdMyxGoIG zDS0QQIMnNyS~ZCl&V^{`YpKkK^+Dlvhf?pLf({?!MmDSbxDL7VA0QeSy36}@s(B`- z=qC({79lU1rm{=9$L8vIMydEk)27Js3sKxDo>#!hpNu_=$fgD9JWk7+ccLUwiarD==-W zlkU3XNc_lHH_`Im*YJux52q-oC0*t0RApe8Sa7;cQCGcEPStmfkOc>_lAeqJYcp*q z`krOm)U7ZSh@)r_b3Vd$JO2elqD?PRtF}XkL9VI_-FcL;rgLwi;r=n={jI%keOyl7 zF!mz^6l;P2)G-`HOT5KT6S}*BE}(H zl_qA%>wPxmgI6V?xlTXx1ExEXkN@Z=WkJYY)YU7OF5Qj8I(z%}kus{Z$H^`9YbxAx`L#zJTzPoDS*CRa|9Kh=d4E!mcR$g*d=mm{MXt%kN6w^ymH zD4&nKhED1kCS-!fMC-e8kisW5AQabtgHS+?oI7zfApnxAIPUc&zNF}QFmQ87iYV5K~xZ>xyY;vFbEWQL%zjmY#PS4rG2T%HlQjwL;(qMAx zrVSzXpJ#;NenAL-1Tus@^59cex9t#e8-wO)^S=nH7~TOl={mG)&?d1or`2y>2%%)L zz)VYd!)((5k7s{;=O<;=m8F(ttF^hPWEKpK@e%TpS5k^9*0CZml;ejw)p|`+K1RK9 zBa`!L>yrrAQRqY+;`r1-O9l$zQ-Qp&?_Pt&Tygh;gbSANcKqUI?f)f2JN-T>c}Z=` zvoBxWbYWck1=?DM>+$+_TN^h-HHdlKW1w;^ufpd93RfW@Vf>B*0>Isd>o->^OU@4Z zBc^)=GK#q3VO7W%f+IWBT&tDkO!=4R&3Gc}^V;!CnY76M$7B)YRl3`d)CHJb1Qd1# zlY2>}fsaeHbLV$j_Quz)xO><%WReLGv-7%VGv=pFPL0Dl$fp{b$fqjCv((orX5VuY z{0bQo_&~?dkY7;Lg1J+!y;Z`Em>xFuONLage!|wSZk!O3VlG}9SsI;=o3B2JSqb7h z+}kM-aCb5-gz-|1=q0`}v+e7ta<1z2D4h#G20p%N|*$TRvq>ltW@V2kLIsL zoFGOzEkp296?9b~ZTNdbpmigvQ3HBbtJV8S@J&vf`Xbh~HP^ zMc({}7$GM3KF81T3yq7D`dQXdp~N?se1^K(&T^iljfxwl9!|S|_H!hOFRX%hZGaPU zH}mEAUUJyp;)IC1<>RIgMS1SU3)N7@{EBR)DugdTd~~`LKDJ0@f}Q9G5}DURIS(SQ zl;N1N?9{4ow0^tDdE!@Z#i0e4f=LO~wE5xuu@R;*shR;;r9l{`xe zqcO49D|vH!l=ewW2ct67l)ZXZ7$U~fR`jg$)+4GnF_g~V-)l$P6rVCQM4?t=uh37A zxP2i^|H8w{rl#%6XPpn-k6SF@o(27r`vY(AwQDV-f%r^I+AXeEyB>aYEMJRA5qbfK z(`JsZUC(C{q(X4t&m7yS>4xSlMy^8Wc8)uT_$nPcY}B`59aHsOlQ-m&o%SRCF~$U0 zYB;C=?Yg-iq5OH>gmmgW#^lV*v_@Xs))*<<*FN584!l>As_K>6omIqZF5ll(R#Y{j z;o2P(cyBzYFt0K?Zh91g9@4$mIb`g99|DD`zBS}WtWt8Lf#~Ly6I_dch^mJ5b}?7T zJL4mcJE`~f+Hu@1cD>w9pEL+^v5p}27skst>?axO(Y6{msXDH^2TOxesyu-Mt-D?-pu7X`-Na#nA`Amr?Pqk{ij4_1w$)tYv+6V zic*zXg`eTp6B|DDc*D0UJsbyjhdtbnih|ULk>MJq@Md*hU{l&?Tu{b}xlyuK*d8b=0@4Kn+FYoH&{8)G*^5W)z%uvR z`h52e!ymZ6FnS}{C@}qAE7D57x39v?baCtjM}5M3GuFPI5}w6{@eUa@>&5Y_m8RMi z>pj-xFuvY6^#My1>4y{2^+s3g&yK3?^}$_zICF^ z&pY`5DH1Z=G~OsdQHGC$y3*Q4wGdPR;?`J7xZ>h<$gD6vBU+hNFpiI>GX8UoA+aWV zP)LfUl0a<<5sm(0t&0I2;k3zM%s=yWiT_IkVzC26ff@i0X85!s)bTzB;ri4!2Uafcaytp^% z8Zt5(p6osep}q3|p(6KGmy}pDmPjCTU%U+m7&z2b(y0~8CUP*ZHkU|pEsW1^uWOJJ zp*FaoRvm_$lbnj;kwIyIj5GA zY%-Kj!ze#^)%uB7m}i{VM?Jk1TY2Wb657T2vFNfNYxG69vz}fcwLahSXEI^MBJP?Z1vMJEMX@o!^)SWvl9P;4(llW++N*&Tc_D2uo^t9sJA5DP&fZE zA-hS#31qG?X?6R&#x&0Y-T=#xKpk6VvQ?qi?44^z`nK5MKHqO<6i`6P$l+>3L-RGy zKf+`cR91DZU!T}x^@KT=*{LmbKXLb9i%kE7oDkV{7z|w9mNTLiR)lgqMrX~6nX{eJv zet=L5P{Q}-;scPbnNrs>RtBlgaCeWJ9wH7?T%>Z|>NdC}DEA-(r6Yj!GSj4oFSxR>U* zL4j0$%NI`G{X&dg##+mua|Kui(!8X-)SG&7`_#QmNy#kpZ*}tZ@FO5N3eElNPaW9~ zR`kZ{&bk##S2N5G9IKaC*K;E`Bg$VU6`2Gkd#${&@P22f5@sHYAvD*;RxhkP^Sp9} zbf1@SdlS_d6#@4IhUlV-TH$X><}L9Xp39w+OQh+jl^5_jKYFWGM&U=@JITF@8#f9q z8}-FjQ~Oe(cidhW5LTsL2Bp%ttsBmmd)R`iq&!T%vt)5JfM^gEz_awLA1cIe;Z8L} zd>dM5{r2ynnSGk>drEn(IHD-v!^hps%I(t9hc-L1%#>Bp8WU^W@53Tz6|f17VqvTk z6SCQ&Oq=Kz*tftP&ARD#(c2IAIgvUu@FZwYGj;aCe%&ITqPiqU$*eS8%mJbM?0`DB zu}jC-R1_1FM$%4o)l9y`-c9EAMZ191b7g7YL;aw52`|B`)8`vbF)yKfD65nV(?*@yY-k|;q%AhcH4a7dKPN-1uR@B5wwWxpT1siK0SvkH2T@eF_L zMH1p`{35tvXv0)Gr9nT>q9UmvUAhrTQv)POSr4cXIZ!(5T<3Z%YejCs7uB4pYqZM! zEM9-jOXb(LZcUt<+jQoEgTagOhG6S75ZfgX`A|W=9H|twO|Xwwe#bOUJ?N z?V#iJ1q!tRh2(zH;|rDksF|54jY9mp5F{=eY0e&@>8kKZ$(l|9c>enJ$xQl^#hub! zcn#?>y25U#Y=y0;EVA^|i6)hW0a4bj=!|AtJNMR>H)X9PYx^U|{GR(G%TI4*&2Pq$ zgwAnN_}y3X((#Q+sk+%Z>6u#t&fF+!mt-40*OUhMH95(bU;Xs9=E{BE(=p=ciTtgZ z@9sh)vcZkzQ^_>}8DSIeqqY`e%a$Iimw=2fvMWN1X0z6|Di_Y{yckFwP12)X$4pPE248xeWG} zqindYPDSsBb&Bfht{I6ooxPING1cdWvOz?nVSe52Q9~_Mrc?F7^CnD;-3c4o(i?Lj z^-?$5>vMHQ_4pNmp+FI$FHrF*O4#&#I#b`8?%|}VUf}^ap**-M;j^XF^GnEbReWZ> zVN*-RA`+p($fK}gcMesZGn{!X&PcLwgt<$fV;|OJCST_NoTFNBLcNe_TEAFE=1dki zAjcm)MH+jMxqbJ1c8}N*KdC$VWJKt-3P174M4ls@92Tp+358J`A(29Q3(&6_5#>Hd z7e+`+yK4wq*bBz=1fSa-B4eJ#*l|mF%bS5Pf=nqot|A!OhpEtL=kTj%+Inq&ipiRf-ouzPSDajSp&@ zU9S5NboN?s@0xNdGBSIwgIY9TXpW>sk`)<*-A3+C>gs6xXhdn%w)5RW3_go{6C1Y$BK5t$DV=mF^~;qG926hwYN=2C|Tei=U&x23e29+ zRQV|d2TBXc9zEPAO%)mqY9Y#!&3UOC194#$M6q;y+#bMfLK>4))qM0;X@z3(HvS*) zH>>UoubWPC=yM0Gu1btw6x2;@!t8j9${1@Z0b#C80*hNu@AnNcKK9&Q`NUc4 zZF7tO`2MdWKcnE!%1OwjGwY=~53|E)Rfum z-jU5z^055s-lJMAGR^ib-J%3kZTK2XM>8=)pwJJ zFuC3HAyDScD!A|0JArCEK)*$?%jC63zPt; zaHz?!a;4RuZ!9^nlN{Btjf4VfMWd`jxJrzFl=ZVas8kzE-$+x|c~K6r90&up_C99M zKPds2j?R|8Y3=`QJFP!Zh_^wD#*igl9`fByH*fCoip1NnKNV2I;#fjE3~@TFVF&iY zkb=1SK)o>dfUVutm(q6)k{+LkC&sIO{STY?5U7uHwWw-fiGRI{c9m|0OWoj2nU+01 zOOJx%T9eZr$iafBQCn0{-OGCGUc_%Hjy=cd8Nf1nfC|^dL2Uy>O>#A?Q%lmK}9pG9|; zqa|SPX;+;9k@KtUYQ~E+V<}rt0&KqyeS%r7Jt!P|b4dK_6R_?mqz$V*DFS}(oXZLn z%XvjEkt83e!%WJ(aV<_?QnZTy5Nt)LU;wm}s*0ZGo`HKV5U-$Ea=*|`Fy&wGQzIfx zssJbY5>&C>q)vmR8VD17(n+<*>-oO2rO4NfW=T%LZxOoKXR3e=Jn0NeV0CwTt1(a| z2I4PBm^%?SBe>|}#q~eJOrr+%P2Z*2R~Yu>HamKQR(_JMM=fot#ag~bF67gg9$;b1 zaN0rF(+qJ8)q+tjKq0d51r%FDnCNs33ji< z(}S745JV{Y!iDFbG!Y(x*p#E>y%MgJ+XH(Ct)-u?gcUiK)qMzT5-LOb=y(`nm+g^v zNBD-~z?);Nggp3{cot@`ad!TJ@o?n6k8a0}aT#7$he zUxvZM(q}UiECFXjYAB6YzR~?i68x^Lla^V@;cLNx3vt!Vp8aMb&rmvu?wu}thp(f+ zNgmzT@8$JHuDfL5U)*@Qsen~Ld7sH@O4ejPD2vkALiL2j}qdzboJWDea2uD6s|M$d@;wq@lvuwTf%hC$IHT(Q!M# zlEA)@Zqknu@on8ShfozjzvenS89#ryNs^3w=9a|9v19G7LM&OhuY5HD+DccY$kK`Z z)%6Q}D$es><(LwWAL#>pOVg{ypn3LfH%RIPB@KVPCCUt!O?3#KypqEyd|ckH;Z$=T zMsz3%=Fb2i=IE3L!;kV#wU(w(>H$*t*HPgr#EglPe)dcFVHA@;uDM?nQ~!i zdT5ZYWJN(QK58%hdV|Gz%a?PS*0ujxQU-usA`>jB1?82=+COz&UvW(_Pl88r?llH_ zwNDv?v!4qnC(I0V${xL%NvF`2O`Kf$Jc|lsvkg=t;_jA&1XlPTbtOA)Z5CIb!TF`c zehCc!31E2Y)3M2~@_mE#^2V?x8W85x@c9*l-Bje~zA#YYyn5w%8#WKRAWRo!7Gz`! z3rRqpHYe8`+aF85Po2G+sEF7LtA!i+X!lv=8N=x7rg;X~rM~{3tG9!XEma%h_1$x= z5X3Rs!zWJKk}1!Uip)z*lQpPf#6)`DmFJ5Z3%KorZB1FgUGq=Q8}RzQBlluJNXYd_ zyvn-_iIxI&Uoo*5bb)yfrsq_q! z)%Ns;#D;QK8i$`3NvU>r9Bo-NvJ1(656z`}mp6oq)x#Q4c%#k>fGR`WhQ5apZs0%j z0A5XkhdvD#$5T0@3h|ZixY0|GkuEl`Z)((-U^fLp5!hGZK$M;0`2spr$nLty`x4!x z6Ka%P`IPhevK7fdyF;~r<7dAFM1#=~BMk|N0bt_h=o*!U7^b-MBMz|)C(jdec)cEZt$nsRx+ysh zs(k>3VxE4_3PdI7)jZ)oaCPu??2*%*M@oj7AF(|{#4_aO!}yeRXqq3jstItk6wV4 zB^f|aF7lwa)5lLt*WIaOZ3v&S`VR+~EXU0y<0nC^I3cxLtnB~4;)Tz}D4*#7<~_PE zzg4qzX#LvWPjyhdFC@$$AI=W%J6Dj*$CKxOwk1{zLVf>IIp|j%ZFR>9ZBN(?>+)dj`=1(h}JsFVk!Um zZ|28SSqh9a|A^ZH!XWhV+dP;aoK3=_dt5n%`-96WF*jXUU0rcCD^9%dB286fP@0rk z?E(V0Zpb=@+;sZlA~~5$uxYTKNI`Te5;fdVty}1AxnSPbc97)Vx{lg#Vp%E1u5pcQ zj(LSF_;BM!H0i>)K7JTga!aoj%t}%xPc3DygPGg5B|QZ8uq3)$&y&RjHk10zi_qU_Egv9(Ap8nsikP;q9eruVK# zT6iRmhf8iSyWgi+C#Xza1S)rFbbO2{zr=X6*jSvG(dR0PxbGe%uZraP zt#z1o5)M-}nVi~5CwA>@Te^jfrSNLbp#g;G>jEfWdGAD-2+Lz`IL*NnmWjV-Xx^Hs znH~3wEEnar7F%R)E!@jEOawEkHOHgZ-_lFY^LPGBYo`gl&t;bWG&ge6A3+3cVy z(Tq{=-Gw19dhTHWP34+2a!c(41H3$cUpO|I z+tOH8+GtM=ZOcfx5d6s4hk2Gs)9oK!q1^-U%+apno9EcC++tp4fg>oD%JzR5y9cld zg6V3K7&}%~ZjE&odt;ru0^!#8{9YIo<^s+@yXQwWdREcbjdgs~?H%){8IAVn+fojt zc*wvpF2;yIeV{}C*uXhrtSPzAwuBVXlTh6halt8Za$X|Qa*JqV(?K^z)wnXhU(}tu zoL}&Ew0w4=bvD$XT7T-kk%AlpYOaL)&QWW|*q!xGS*IOpw8Fg?%SIceItJnr9r0-{ zMqf1)<-W!oEiuaQKG9!MFs2@Zu5DDBu3v`HwQYnMp_8Y5$31`fmQ+uf{jQlQ(k_hn zKwH5^^8_)D8SLbiw+62Hne2ztq|nKe@Je4A0?79Wn5~2R{!fJBiCey@z&+3HOLMKSU$Y-> zG`G@>4ot7?QvET3-6RkM1e5BdDd)Ip1GiLGt!v`6b`SySd1yn)6G<9lP5vcD>z)nY zc#G-~0zL48I%^cm>rZuW_0hH? zhmQrCzD5?ClM4!WuKh^k6E>1AlsIWJv%_079x2G;&1cg^BkSuax?M)S3H|mS&6z_% zO)jhqBa{;&lASG}H_7V90!M+Y>dg=*+GbgugwWZVnk(bh%<{bU6bqK^GyW7`5>@ZZ z0OJ@Y@Lf4DgxR@Tr7FJBx)|^rU@o6#f)XS0`&EKthHtYvmq()E8j#H~NJbBR|JM0N z(%tu*)bh!SbiuVkV(Vr*z|LokX%yE!{QC+3~g1{2W3I zFyUFxb=pMEeKDg0D$bge>dRkR}t``aOz8 zE_p%qJ@8Rn=Ald$S2tkryvD>;qLU5@&zC24!;C~caqIpVn# zl;&1i!_v(@L0iW}p+-|%?aBL!A2ybY)~ZJAS(_p_ZU6>1x6tH`;A8Cavw7`fXqJd| zrUM^bM2}>{D8BcWo;E^lWb{8u#JAxOJDr51dVEN-nYu zY(%N;(Wq7C#qE$vp(UIzbRUv`P=x_RrE8}8*Cyp&O4|&{gC_A(gHGI4igT+rr;h!v zN$R)F4BXhDq8h_ItS_SQ_NWm!gL&Hsg&f@3!Za6AxJaDW;9+~xEyw0@#DS@=OpA>P0uUwz15dFE>)?uy^XAqiNX@h|5OJSwLjX zcm@T*$G%-(-}GSCm@k~&AS+(D6wlBUKM~VrgJ+wBiP*HwJ!@ujhsIY3^OvqRUd##C z*PUsjzL`Zt*ousW-(i`eMon^~U*#ni#H?VtHKP{`KV6u$uN4{_kq(EP$6N>-#sSW4 z=R$6%X$r33(s-+U<)sp_!4!P@yBqU2P+0iw`DK~R)5^a%5>`iDp}bh6>O1{OiP05V zM+D9nI(>7=W29>x1%knn@xMx{t=rC{`isWsV5^F%^n~3pYq5rq*GZl0?Vpu=x@L9& zP^#Wvevr!2){X0orl-x)P5y660RS5yC$X((n|QcSDyBeYia06DIX%Qq7;Ce9XLFgc z*{HT}RP!ov?QF?xSb@z|jncQLtKQ@3-Z_0!Hkp?`3mWX5*Uc2rs_SM5i6`F_(+1ahzsu=5}-@y&X8doYQ;iI&QG8nCaI1!4EU*}Vf#tqK5U4}S~;1+2Zj&+ddfDWE&+D_6)-9h$^i|W zd%+ft%~R~m^aj2hy5e2##Dg*(roLVt*q9FB3k)uF5l_rsT|Ad)9$$WED%9@Yzdw*W zK4>Szm{XA6d&;uX8Q0__>!qqQXXG|DxFONL|1pQpq0$e|n66c{+xdmV`unDGFLt@c z4a+IcY6iCI>RTM7M7$GJ4Jj$dER=D+vWh`_urRO_coPT^4Amd??MBu7JacA@`V*+5 z&5+VCqGalr87YtpuC^-SOC(@KiMYP@LJ8l82bmMO@*6cUOh1-6P zmaYJ_#LaQ}7eLWxfe4lL_B3Uv#i(gZHLBQ-yS!1q?T zRf_H)(pvlecQHeP)1&^Z_Wr=>($*5yn!j4~L$I31*2H5(6Lz5X12*>3Gy{kyTF$tz zuv8c>kykETP`N^Qx6f-*UfYXYvE@-i@9^zWW>#zFx(c2;kpIdk%lAWDA zkocp|!&gcpuXCDv$kM(d9;>g(Qbyo8q?M|V%Ou#Ay)e(%7@XN-AeQy@X+*&k$&Y(F zy_OP6DbMt)nM8JR^SKZ%`m&UrjHz$VG+t^DXnYMSBQrZ;a{P$3W0w}Z3WZ0SvRr#6 zU+B291MyEFn?E%myoWCP<+O2{)tzR1vGZmaDu~b87CtS+ug0Er43&RcO5kJgFsr;#;W|{YKGT zUAL{!2Us(FUq8Y60!uMz>u!29x}m_R?}9|anHkurUR2x}xO90azZv*T!kbSw`GB5+ zy}?aw&K%H4z$^(W0)`2`2Gi*rildWP8QJvt^9his$S>4%C=GHeI5l6#516t`mWkS4Qf|)g_NEq-W(>Lp{)+&UbMff#A{VjDYNY@!Fcy0D$44{(n(a`U3aHu2VYRF@+f6dLwkS^N@*9qRHc~B<=weFZq zx1n{^L@YI4U_aVIOG$(=5Jn0)q|WeMYcUUk*|B(5--vk(ii`XMxAp2 z0^{WUWhn>1VbV3g{~ElaZ}(h00WMX*ihNU@6YKw=i3#_qZek7cY2IKHY+DSvHLcdU z35q0*_SW-;(%BL4%8N8^Gm8(cwz-D(Yl$H5E2^asmGK3_+eow5#do7@pmqrUm2!Io zOr&S)IB>KExVhjy@F8*?g;Lb*Fn5_74$?6LQ~> zlt%0%=z(fx;+05XRk8r}8DNxgFs$(|iCYd-FHsrrijuag>GmY5Wj7qNzZ}w9^NW17 zjX#Wno$_tDVuNyHZ)Ecy>_c7_LCDBTcskI+2=7Li{=67pk1mi zOZyXwQDc&jAoKSf8L>UkR@7JZmBDUvBXH9g?Y-}zd5F^U*-BohAhmbt2G|y8A?rNY z`^Q9k6%~{*Tl;{{>#$4oeR8SB8@wd}I;vh&7<8FER()Q6iY}0?^xobFOvu#!uyW3Q zaauuL);{?Ob@d`4d-f);L|`jBla$oe4FW4`w07qrbGskB{_MBw^We2%v584G%t1@f zgFmIOrLB#*kJ{h9Xxn)jfLCBXni^9n6xaW^;R7oTAE+Fb8N6d`;=vL5)9R{E{Eyfz z2*y#Wf#S)>j0i{Mzm8?MdN6^Uf%!D{NQpB-F7nWA*W`tMa_L5knGEj z#i{qpQb{CqFYsJ*#zq5-#4d=D5ia>elddgP7(u-_`K1|ne!{Vngw`>dg-5qIqq)4b zy8j-->VK3D1Z{>#P%~IW#BRH1yJI5zsui(q@>N{ z`eCik&wC4IrV;Nueb|HcOGF=DZI_=A#Ic87)*7EYIhGYd{mi^2z}4<=Z=H!0+}9nY zX80WVS;_O?brO>PmTshu+kfuZT`<=smA?VVOV8$t&#VO4=Q$bY{NG~AoTc?2$?bn= zDEM8__*=UFPc_{d(8>V)$o@{mR_mvR)<++We#zNl06R+PArO zwvxZy(5(wen8?*_O5JA8U{QbBA*G->XciiRVAuo}?yDdl$1xI*&kg z)y-m*|9?6pr+oi8;ia9LOY6t?fGzqn^Wa|};(uY>l6GsvfGgTNN9_#{th*>pPM7|E zk5Y{E&wjT#{_ToK2rZ|WcQ_$&NZ$6`xm?2OUZ2-?+Khev_#;kyt?Djow(^L?{Bwh{ zUowB;PlfNlKM?Bvw&b#Qop4Rx*Nk794BmQHENWDD!;8LB&M>W#-%_^dV^vX|_+^Do%Am>GH`KNN>zw!2kTv0svtd8PQ7~EhEuW7=% z=prK6-XU(?cL|A%$d18&*cy3;dLN}jhqqH|5s~VWyLhQTO}4o}wiMJZkgCE9}uV z=)lTh3B?_?{r8J`IT31opA0bP(g%}94ADs?ba9x~9VLo#_cX6T-S874lGq<_O}7ni zH-}f?Us7w@dM&<*B-0f>WahR$^b^hSG7rylV0|)*2rQynJmy5L{r_7;QP@++p+CSd z^Hvf>ACmkui~Htt8T$_genl#n`qIswIncxKr$sz+SzAnBt8OgXBI(nuC7;64Pndz^ zvGR&ZgKQ(?i+%f{HTyesK83_a7`jBWzuv5z(v-k^c|qGwC(25mXaQ#W5fP<0GWAHZ z{y5$mh8*Am)g%sa%-EaK(cWV^`vP|dn@vbdt7{-NffM{^X}F~jqP5l+I756!HugX* zgWtx)Xv7e!dL*#O(9(t3v5$bK?hGEue}7Y+P+iIZW~d61(449;>hlmZ95>=e9c-+- z;P?>Mi#w}ASjVOA?|)Ot=OocI&&%}`;>odK)2KmSV_AiwaTFEbu0}9eTh4vcRK9&g zF4K}1r=Z$ewq4P*@Wu2dWrh;w2-_ws;+^nhRYUJtkGzKO*fB0@t+Z69X4YsHD-s?N zZ~X0qCOpq^mh|tY)&>*Y+~j-jCZ_IDS7BoLF~`V1%y|E{BY*D>h6f3Hwef{s#nDY& z%yirWQh;envtw~%OB!`0fW4P5caRLdVv(m#SAfzmbssWQ>7ec4(Gri=^fDv_47{j- zt9M{;fl|@V#4BfM3lxA~V*q}EJ(D=mol2Wc*Ei6bhDgcKzuN)-GSq>yjwKKb^VWULUw=GxzW_5skHQlJz0TR zNA%Inu?1~FnehA6>W|Jjz>C3wHYPGi**ZaNS-xLj%jgQ-s+IiLR(ULRY(jZ=f#5Zd za$|HMyhi`E27)q1w90VvIUS>2QEqX@NowAaIS+_75J3JiV#mf4y^R%Nt7{#%oph1q zsK%>uHx`bSZ>L7=vc?A4l0%v1aQIuJPdd8E*uKSTLbii+2lH}eSB#y6P;bgDawA#HNH599YU*D}Bcv#w~uPeS-{|FwS1aG;~nJ%e@AyoiTkf*n=BL!K+BWm`AKSYD- zTHUUyEj~QK?kxSC0b>W%{|GMM1=88=3(gUXKSzL3mHxT}!1+y~)=?T%kpq-vO^3d7 znQ}JkLtC|43tA9m9XWbHo4Kx3b>NfE^fcznmB{|j#XN1Fo>Ui8QdjruVkX{PG|^r4 zzAbV^;!s#^_S5NjMRL`7?xNFsvdec)?4R2jgzryLMHgJPC6+%Q$!`D-EGj?;?RAe_;Wr`5h#EWQ7=>s-;_ zLKEmhwB+Uk&YA6;8haDHbd_iX5HyZn+aNNZS25By$Z~QYyV+at$KP%T-O!*b+|lU- z%!MTZ=QpUb^*8D$vJ(u3uDzqnlcir{V$l`*{K`b#vYZIe%0Kuqxzf@vH-rkB<_Hzs zVFA>%$A_^sH|N@8ZkRy|Khm=d#8E1vkRgq z23r{Hk&6w`Rjt=?*Y0`!IWc&VJ+hy4D-}h?c%%s&YMbvD6JaV!+DUg0dQ1^(>b(nbwGysS?e+S@iXy@wnY4B{0-L}fTA~Zg5LM2G$XrU?yuB$ zl~gEN5k&^&7VKo$g`Th%!1UIJkbrNqR9dHgJcfC>)SC%9L#e3Xtd2E1EvgdH2?8Pf z1UgFHDJ|IG8=g7V_y#Si3J#kn^$f(VVE1rQm9iTR%x{KP1EtE5Pf_a9m1|8H>yBaK(RdUKt7bycGc<$?| zJZRsAUQRm&G+#;amQQ^onIiU=c0LFD<^g}#o6UB`jfT_biD04M089QxOJK5>em(uy z?@%6|ErW!G6cHTAbjhp)+?N*)O|RYr;SV@e?)|u9uUXS8AzK_I=^U*|sd_Fjc2~D` zGccIuX=%jY>YllKgVQBx)m{)<6qZ0xZdCKbp*BYtHW{YuV*Ap=WzBQZ2uea{%7-l{P3mg**_+P!Sgg?cc=m9 zJs@w#dMgxh2|iuKs?~yHAg^8k^L41q*bX#>|Mqh+{7x4?ZMYUz&78^+PbU1aWbds0 zfl~PW!nPzyli}PyE3qde9r^zQqD$RdzyF3zpWg3Xaeut@A>og{^J{-H50zV_TDSD4 zF1-dFjDV+``?~ZEFhSBz?4QHZ-+xYq_wdJ9j6YtvW;FV9zU7af*mic#nYZxwR}Oza z`~R&1n638z_EnHol|yX8Wl4fi;;x)l!#ax5nLnN1K)IXy@*lF6G`A!>{`CQC?jlO* zDbQFL&CmONu;3rRbM3f9tOZ2G?|(#Q+;~o(1=FIseEKgA7`$%6@al@w^svtspv=?s zB+mJ>Aueel8R)4u9Ud8m^T(&9+MM(+T(X^OjF$f69d8{S^v?T(ZY1`ab7iOF)acUL z3zVg%o8Kg}JkkxtpZ`kc{&5W<=09M^vfp32^eua?TPoy{%j4(;wc|6!&vL+_mt0II z!lA#i_0W2{ln?m*H=Ij>HU9VbCbPv5kafVn_wO?2H5_Q(L1*GJu6$1}9~BO&=^_jn zbbb|!j?eBwR0V!@RT&@V7a{lb#c>D3WUX<2r1}`9_hbcfQkx5l$^GF%?$}T$RVnsX$5k@Bm|33_@z!|2K|eY#^Hp5 zo5xW(8XaGc1bZqfP~)bUY!S|ogLyBaM^>1{@*zEj0o0S^yj1dLq(v|PN$f|zkUN#k zFs9#QCM$GVxLGA`Cd=zR3eC*2h`yf1bsrOsbYKLCuIt3EkX^Wt&8A(5b~IbK@)?oiYBtiz9q5Zs9X)<~?5_00b!Lx~`ONcSJmF<%)@%={G$`fUM~PL;yC7G}y3}7$~K{i!K4>?L4e69x5{Z!n;L+D;vnwS%C+$@(A zZ{DQ7D}b3?kULW>=X7EF?c)ayU2IeJQ7Ek7=8Nr^#*)^fFG3$kHSYEdWMyw{bcasf zbULZ|xAHS;>O~l4ZX_baB7@u9(^{9;u|?UfHvs975adoQ3-qnIZ? zoE;#FZHp3N^qv!b%-hd`h9ra0n6nqc#F^P?4G!7id$`HVmAoW_Yd|$n21+^N#$75Z zD$vOM*MLU}6qjo7L*6bvb4Gtge+;?PIHi}Ud&443oCCnJpSascZ*n^-Qb!nS^pIqN z%r;Z!c9CBIu^&j47pHB{G+@FVeqE27g`h`oLDqk*wV0aN*bTLY|-+BEY9PU z^E4$);m)>vWIjmP97pZY1c}qX&4bdjIVD^qrTHvbfx`Mpo?dBnwqBqx8HVSAH5_rzFZzjthd$8wk*>9hH(GF`)U=l9(TAQi@(M;x=mbTL(bj`}0Ne^g z>6`q-ezXXU^_A;-okkzpoIpSMj?(Ft(lPM;hNDkHeJer z30w18mr-zDM}{{=&k(fapAy;)EeFCu2adxql$lF9Cb-@nGSp3cic_iuttB3cs zip7jrw|-WGLKD(Pqo>Fn<36Dor*V7I#0yZ-!XUF|F6N-Gcp{DJ{|pI_Gec&YqTV)C z$D7=&=6{=7o)cgkk#Q!cL?vfXn`D4a2-yVJ5AWL>4%@O9xnE&T7Sg2O<7GRhV)k$q zCo(RF>+c!bjk6Fn%#331)L0D0){r^WNH|u$pLv;jX%6H5(bF72e*1K^g{Q3hZ8A<& zTMpDb-mg#0w@6goMpcevxMEUa-^YcQu2TJ7USasnWPu5!u$00U4zBCzJAr3CTD4#( zxV9qo+?aD%-1fXN67mUln~r%vh?UAICcWJzm7Bf0%;D{^omV;w`)>a>YMv|U5wzjl z1E#81@8h@nVb6UXW?AG?FPmh&y{-YT+3`BnC;=uajx3Ih~PMAuv9gEMV&MgUsbnNRO#Qox<#%NL&i*oQn=J(kf3gII1J~ zfkG^pZuQa7xMH?ZZBK@)&8nR3&FM--No0MCVd#GA(5<$~0Z zN>?2u*08y~XkZWSrRuv}6ZHu{xnH2!Io}RPt2@-Nmxqe?$~}5JL_AviKH)MoBc3)f zsf}ydCko4-ccT}hvy&ezR_E4EOg<>bB{OwTWVP1Jce4?WB!BI5-Y+-2PCIF6j{^?G z2J-l#2V1pFY+tKD z3R4+vlqmF4cxP$T;hak11>al!jk$Ss?7{}m&$U9Uj7Woi@PYEEsXZN9(@ETo>=MQ{ z-EQrRik;j8i=p#N^1{T=re6&5_Mf|VPXcDZxRwyHrrc@gEqg9e0iWm`SUHc%76qow z_N1qb#G3{?It*R(>^%ePNAb!*Ehmjh0nNP^CL{xz)@vD+Fo9o z=GCsZ;0*wEBSOMpA{wP=^X-V*NVJt@AQ)?wsufbDt?Y$P_R5g-|1!&p-i6nmdgk;F zIvivtZm7E1MbUx`(FRT;a+f$tW&;!Uo&B9NR?ke*L>T}DFP+YJ z${AqL6-iada3@rWx&w(lJu9>L^j3KEo6bcxey95p6IBFu&Q!K+w|8}qzF)tdu&>Bs zI>fAcrU&+w^;~JDa)sII{n+;f9GohS#}Thx`CGVouTjgx+B)&_0~Fj;`HH?&s|$SG zzIt54MpF@8v_nt{NZB48KDE|xNI*Mv^YN~0L?nCGv9=Gg-oPmM>;3H@rZwcezQ&#m zO%bOnnPH%P#8YFMnV{5C{`tBd~L+t>a~gn6g2 zk}mNIJ-sj|;2KP4s};>FIW4z6db{Aocl-lWhyACVK59R$$f>Bu1$4=yqfy!exhW3} zXbr3-JLS?Dh1?lg6H1!-8xF?)fe)Q>fwN2wV{^}Gr$~EEngZd}rlHmqRk>v7g3hPj zNL~HiPn;hcF)12WTTJ5KwAmGj9loCWe!25CL|B=7+njjwXqD_GAInB{Mj<>TspIOV@Q{F1eg_U=u2Ez8D>7wf0d38h zDs!POwN@>}pDbHA@@-Adgp!dLyc&6C{_}~+eAklqH?!9~8tz7H^<%*@?s$KkbTQG+ zrEluQl@}fV&^B{iyb;%;ZePQmW*TX9>16T~Q$Ak+_W!PW%2dr0SFLII{==GZT90{X z11hUY`}UFffol)henbYz(^}7Q2g;SaQ#(pFuf7?dH?c8)9$mpVpC302=9opPtkT2g;GGIHqZ4t$56tRS?U zk}X6Vr!ZMz5y+z6c-CH;Gjot; zL!rnYay%8sHu;>u96(-hrTsa7Dt*7-cyDSQrFUpVeD|eQ zi(_&7jTP1uq?y2>+|StiqXt1VsCo+ z=}QYEJa5llj-vAdY%hxc)BQn1{?-je-I z3tpg0&qXoIf9V2@t*%vZWF2CsS~9Wkf*>{(Ilws3b>NHF=KRYi!w;E5ckIAHRkvgn z6D^omggy$Fa&dPSit>+S`;!+^C*zK4m#s4dP0v$rI^WcKZR{aV?2o##IAvvbZN2?7+v)?6;a_g#4luG-B)9 zQ_zemHb3c3Of5gmR9M{#Koer+zC(q~$PbSp>Fwi5hAPv=#4Gmz7{N`1Rk@fJkT)x) z9Y36rDy!z16d+gH_DC@!<>k~v`tgltWD@VMwYLKWo>IujhBNdLTx+LDhOmVgv^>HV zX5>TPu2lQ_-McX62o7dx3(H9D^;37Oc{U9bpG3l@`W9TG+5rCe()G+OQSo};2jrE+ zqqX|(ZK65Z z)NuH0hysHy(l+`v7ir>hAT6prL`&eY_RaXtQtN)pdmaU_d}Q|u4(M=a*10M6jh>yF z$wk7Ly8ieH1gfRZhL|zXff>oT*(J;glIzV=?JVnI>K4EVi6%E!ScBl7Ka{`ZAicj0 z^MoH!!yuW<>v$->;94e}WhQK9tV=68cPg*sN%MlnU_(c7FYrpj`CN5LJ1xK8ZC0o#|4$NL$=#LMMcf6+>Bid9^)agOqQ4cQ;rfHKgl>vwJMFreW zqr9S-Tw#vA2`pnMW$(#*nBj-1yn&8_kFsZ`?uE)68C?5YWr@*D_p&zIeMpa#&xdLA z2#1O6+$)1A!T%3!ZypZy`u~sXc&Ag6PI8pJjY?70B1?O+71{S>&nS#-43#7al_JE1 zWZ(B;j0j2gWiZCrhZ#(knPJAv{O-}IbKd9k`CQ+>esj6z@|t+f{^ z9reXk44^N zZ_eGm&F9_6EiM*H4W38cEIE;zEzohj^M|8BlO7Jj`#wG?aq2WyFhE2NW3rd>NM*R$ z(i?m(3mBho65<2-Svi#elc!Rym&opAN&^ zxa0foPr`zxypwWO4%cXV23c&qh9C0Lw{AJFbz^t{L@VaK8QYj~J?UM}l-M>VPD9ncOK$sMk9!S(r10SazK*1hzKYyhTmpRj9hG_WLy zB;nS>0gkf@ys}q0M=(%H(wZ<+%0`2!3u{9j0CaID$yd_x2QJXjS6RWGY9)Z;K)UfD7lH;`TsKP7Q- z*E@~L=B@1(MLltOgHtB5n6t`2A|LF}6l9gfP-83~zCRcSg>GbZk^zEpAfs8)Z;p=mL~2Ql4E1)4<^_5s80brD=Lj}>& zRrHm_fO<&q7dR_M9QJ1wnHVf_0b3xYIq*S#SeD{Rxdk7O;U3B1_{x~V5@{Yc9IltW zcmNJ?Gd%L*)e!=kv!ojt6?$-l;SE!oF(RrHD#^xc9x_C zM1x4gj&PZ(k6XN1c8B>CEdZFa$Y9|^Pt~(?MrM8r2R=Oh*jaN;hUBJfn?G-DVorJ_ zE^Kvn08n>g_%P39zWaQ)dw0~ZwtF8=;oODz;BZ1|L-CC1r!UtYLg3;#*=fvJCoSXM zRxv8@#S#*?{Axh%#^#rByVVfM>g2@OGQ~;GhBm?eO{*t!Mz;k8FVqW zS?CN36cr;y?P@;q_{CE|ThMO>3;Kv;Rn`uEQnaA>K!33QbjU|HMz5CW!nQ`*ORjsB zH~#WfojMKfr+~nSLI)wZ0WZJdV@82@lJL81?VIpT*L@(K6n(E_PvsPd6A|_)F!mO# z7ZaK2SN>>MWun@5}4x})o4MCOZ;3d}RK8=bl(k48R^yxSb=3Ur-v7^bf4`~yP z9xk1Q*WJAgXAWn4x_%~pjSVL z3DkH=zdUYlz0`Sg_U2wK(?VC=jM#sq?pYoz%!4(FDG=Wc54^^WF1gx#UU5#3wc)RN zpHBZx)uewPKeHwuCF7IZU9<>Llt!F2?#X~%!hC~B0s^z&hn{6&j07c{_CdQ8$hIDe z=kjDY$5p5j^_s)LtkJlMi{@N7v_G?_suX0HLL{;}Y2+P4PSbmltEIf&53GVm83GtEM04sA z#dTV;xF(YRhXJj7lZNYFyT_>{KQ;Wl$5TFRW!p2CBexLx&kAs_C!EHtihU#9iIIt0 z+*D83z$S!62Kps;@zojN$}vjETT)K-_+|*a@vNnV!PnMLaLiq>h2(51^{Q=6?0bN< zG!N|Vem&ZX+yKnUTkmE?@#85Vho5xq|Kc#pYUO|I!WB-{<_k|O@N{Qsx7_j6%xsRD z4NfdKmN7Zr^-*A&Mg8zSLiqf+Oyr?rz(S~h82ROGvML%x2Gdy#NuMTG(u;|^3`2BL9S+^GMd&H?S&>j|Op##58b5IuxsD zu6=#Ola^hbXRN((UQpH7=&fnHGtb=N6u=FrD#HjAow~OY7j(w40=2}7hp6>PCVcnM z4Q<(5*H@f4>)pj?a@P%7`m)d>o?|OVRMW+~?p3uipMMqrOXi$m@*-pbmz|DHpd~Ls zX}J3pmY414?eak5i&$tLjZVm{IPGCNOnuVO;mK8x18^p%sySP5XWIAZI)eLeRmBCs zP*q1}5Z?Kyu}41E`MH)KWuK|WsVNVas5d5?azQQwu2x|HN637yi&-aRG|X*$k|)2l zY8h4C#di5BifLRQD@}-twVmgo5jUzs&S}WY-{#~2&BX1ZDeQh-p{bdd%fw~(I*(LL zlNo&ieLG%`Gc-I9s_YE!EEW|DLS!3|s`&S;n`QVfjd8I)f1k*}!u(?S z!y>za3mPC$!WuwugOO>F`a3~+q3`tK3*I_4ybfyuQomIm1nB9^G^upz#i%rGd%?2) z_0xy~jPE}2_n^FlSFE>7iGki8kvg{kU}yD{9c1tS{Wy4H)Yr|8~vkjC2^-W`vl1-;7Zf=D=d=JiR)sDU@ zz9>B)c*n}kAjRY9>5zubBDkZYUTBhCql8K}yzoMdg`!q$6mhAqR7fn;?UiNzogE{) zz@&KGm>gO~ZG?7Sm^_A0cJmBbD^KDI&f^F;K*?#%blB!mIUc{|slmS?;OJo@PoZuW zbbD*Q;liA=cR-L%^{G2++EktR!m9HdJH8*!syThEeV0jJl^oS=Le8q7gIVEP4U&-y* z4}qP%f4iP9sOxT4PSkl42j4{MK8Em_FUH)_FFHVB7t3+ONYF7@LwR8 z74|%z3>5W9N8(-=&eZIuKrQ(W;$OUW%dEwReOB~!wB{RIu2kR?y>+dLpGfpJ4z(!@ zc?C$kLfRwNwT4>lVaV;GSZ~5m@j!!9@z`ImS6g(SgL|SaOGaH6vbjQCtpx_Xg$x%bZ3h{so#Y@bYh+hxO zh?~brtjfd)G$_YCN-9> zk>O#~l8V%2-V*C|3&|m0Q~k5wUxj|FN)SBmku;p*b9c@Y=2}yN^FI*9>~iZ=RqlVQ zEykZ^nsfiq@JvpQNG$?WLtYsEs1n$cK@6EIR=oMm*|vQp+7^u>YV3Xt)Z)shCl#H% zLQgyzXT(g*K4{Dfs?_N*4E038{o(Gb@CZC%D1t+Y}5ii+Z#!JCCEdQO2*hS;MZ z-{Gl{Ti|iU4_Zk)7P;F$3>7u%*mfw5IdnAio0wTG>c1uO)?TOsHgDYMx=W&mPP>nu zQSxKM8`|e9{WLa)>r%@5c8Nhwhe-J!7H_ZTBrbch{YUu*F~nGh%G1dod_tp~ic~qmofW3>>=Lz-Zqx&}plOxHTDWb-Yu= zsp>})y)!4gL(i0nxmqS^z!I?0WtuC_ynP;myD)bX$Z*w0zVB!DTWlAM(3VC5ThSC% zJxu_UI8KYr_8#%2u48y>Nmoog2U>xqfI&uV`z%p4vu)C6j}@O6j?C>T(mS=)ZAS7w zR8)P2Cnno9%_A#=l7%&O#jk$KRIuj0%pIU4fYi8Hz9R;bsl6?(VB{`2cwQ_rAmhAK z<^^oB6tas;QT+)ubn9gcr8l3PBaY*-a;{_X8iy{Y4s%LeF<&^1-~eVPkE)C92M1-P zjK;ZrG9YW3FYvo`!7NF0F8Whh)Lij~pbRjHbwA)au2^0Mcb81P@M=e(dxn!3tY5;- zi=o0d-(z=WD~bZYiG9g4;nw8DKD}B!ClTq2&n)_FPkc09>0xY#(yYR%cT{V7USBb) z0)eW&JX&`*OysbP1)mjn^{TZNHkC)H0AQz%GF=i;wAP*23WrV#_P2T*hYspLfBAaM zr=?Lfcy2+{9+VZJee|A?&`Vg5LLCDLgqrXGZ?i%R=61x`Ls_@?N|cmtcL5X|?gXP^ikAXSgy)sLXCi)emxkfD>F? zU*+`_S%p-3;Y|E&Z;t8aF1j6YSSlVaG2EAc;ZYnxhwD(z~|aQ?tN*NF1i|)hrZdpn9=a3;Y=B z3!0RG0?EW?=G|-8MUr<8s8Rb^zB3zwi@u%#mA$^Rv^_rJdW2vmlTi2WAT5D^F?htN@FU?RbPD#s})mm^6~S#3gw z;(#fhsZ?Mp(4M72t)mSU>@Mms-BP9Y1BdM2aZFXPxyZUi`pXNikoq$HyL*~0b!*-A zaB#S|<$()6{mKNthXm3_`bhb4ve|H@>qi~-W7Sh}6)z>R=7&}PD1h(V9YIwquwUj5 z72m*K9*)~^IL)Ikxd*=J%AV$5s}o~Uh30CwcK1a&6nlomxv8OMJu*cj?GL(){fT(V zwdgBY4x-32;BJM3N^SBsdU|U?)0pYy}YZ4 zD3yw!lg%Lbz@!$Q`b%C8AFt2y zo4F@HF8m7r7v##HcaC-ZI)#6Jv^(VA2=za|;fg&1_Uf;zrDOjqto*O<{q+9=dHnUs zXNiADGyVLk{?1Pw`R6A;BN-K){6HjfEU2IR^P8uRn<)`fVX90UHPG+Bq`=0Z*s`-j1ycEu5VFZk4@0}NlTP( zY_ggP%OPMI9)Ra8fo{cLfy9&P8d@;MO>BjFyHlt2RG@Zbd|uhBSE0)1f>ut``g1WO zj*X3tn2U(S@02BJo1*HKxJwyV@5}UcR{2B(H}l_oL7y~0mtpW5^>ju|xU3igfDvQE zc!fq7{G6Gnl=;8N_UTpO!#Ays2p8U=YY7^R*3Mvee)Z+Y%yEO5>JT=S#*ckh9l78? zs7sL6e^;h5O7HsE`PMnp0CE2zE{A9VBcKdUxO*1xJ{i>p@X_V@t=ZIX-i79^4@NLhSBV89?|05O}f*&e%_E_pM zreZbE-PUBTlNV?qL4D#uYvh8M)ks@*D~r{qQ(*8u_@$4pFIE}>_psGVa*#HNmbLgG zIg2F+-zF&^9{Td-Y0bR;%^N-~(bm)n9nWfw9uV`_6#40sx3cFaL&h>`XcWI;HQTe) z+J^V!KewTRt(H;n+0L1*5#j%3%T8E&Scfv#mz)<;ud)_}XA;}3&g-}Pj$*N%xtP0U zc;@&YNy-i>07_?;=afr1E?ffMU;~?klV)dqLXRtotValN1JJdtD*G=i)>;clbU`w0suXs)okn^5d3|>Vb(YC51Y~lBr5XU9`z9Q zy5N}L@Wo7w*qqXwDo#0QtAlj`J`)cx3uis9n9A?M)u+=8D!a-1U?Oa#>{T^my4ud2 z@4RBNNfc2i$|hzpGxp6m_nj+pY6O-Pi`zWvqo*tf!0VSd!;^d?q2i zF2;2{xP76}7u~f8q@cEbJexl`o2JIPaCMjeH zy@5as!udCvJDZI);!6=hcK>#8d$^$z`kI&p3 z6OMvL5`t+XKDc+)IwO;FXPG26BU^9%_LJl@XYJk?ms1CA5yc_A>Z6?~LZz#BNizE0 zC+cDwl>4evhs~JD_JK(jBV?l|4%X@SsbQKbG3wpx0H?2G0EWlNE-{UX0@I=Zz=%iD zA=4=>HRO<)-`ZI9|LK1J^q7(Jpj-%3n#}5*mm7tz(#tLG-|XI^^58a}OE04n3M({Tk1~r!lV=FvhiOjDsJVo41 zc>_Ka04ZwnCDZ0Sv+(KoTtfb*y@3*@`9rf#-57jV2p-QEQ&9PG(SFg{)}Kiy_250w zG-M+}jk9Ymac^dp*xjC<`g1shxvEkicW-9i98+jsaXUZXx^hUq)XNG#)|GmQ+NV%B z$dJ&xFEg*fo=Bp~v7O6eRzp||&T&b$v$7bp=K8#hnr~i9K9bRuZZP=ha@#@-jXi{; z8UVWRTHdiRN3emaN5X2byce3{@m_`F=n$4#+ep%6 zplhHUXG9fq3WT9-qfCJEl&QW<$Q*f$3e;0@>hP11ma{4On&MACLJJHI=tPWocTJjN z`l{PT8Dri;w+0+VRE}T`Q21i|UXx0XSx*X^NoM<0!j|XaK~@-6AEB`jXuRVA35D@+ zYB!&H^og^~r%e7QJ{@2L5B$>}@?LJ*Hs6gt=aKZP!W>9DOlEexm4Yqz?}}U(LZuYn zzb|0Da9=Y(obCjb#P4yR+MCnQ^`PCd!qVG2*F$e~DIeI4*{h|6gYN=#tiBj)%7`L; z)`h`-2>op|h;T?Pz^i_%Ck3XtvBoR3BL#ggfw_hb_E-@*0p%9eV6Ez?xSU6;sT6kM zY(x3?emHsTtV>}nwSYP0jD~K(_kcn+3#7^+Z=oSPi}fhuqhnQ3)`e2x*Eb9eebw_A zxiE66x%Z#Ld&$AVvtvAdwX|#zm(&N#p6u^M3$#&b)HdLI(R$3|lxJQuWD__orlNH@ z)KD?0%7FU{@MONAE}=Ea1?-7j^F?OBM79tP=1>2&U#0#+=T&m5lNUxZOd1i~YGHxJ zac$$Xxp8zYfnej!ExdQfE`UP7^Jq4JSnhTz98#!Nz;nYzt0iP(N}RDkmZ%u0pgskr zR0_4&PDGd=5=sYzzH2y2*pgA!OU<2@;P1Drs} zlnDA|;@P9ua^Jh@>p%1ut!)Q{h~UT&5E+wvKW5Z5P+!^z5j5kd5;1SfX4R4+T_%hu zE`37u7&fwHG?3sxB5F9TZ*8KM+OoRC+<9s7gTs_0u$P%b6x(PCP1jbep>>Q-Y*9{2 z+Px(_BB=XS#YZ#qfHx%g#wr2r2S2Q5k<))0<9W>sb%>$?xNa%I#vd0<3%@$A<+@JM zHWoa}9E5ccL$jRI>e{g6pb05OW4TM6=BVAk#6330D~FoCfF=fHV=}gz3UX1y!l5Bc zxti4)ZyNFw`;5_^Z3AKj1}jSdutDQhp#0XbCP?{hTwPk)@bIvj6(Q-g}h#I1Oz zj@^)G1{N|U61-;$57 z^G&9s6?Ju!n)?R&83pKcsj`0jeOuo;USrR}s(#9B9kt@&1dx?+4D~=;Odf76S>_Lp z?sLuRN1Euba*iB*aEJaLn5LgU2`Lo=bXzMQ>6{T-%Yg2 z$8V&I=%zN;HdMKNb6#jKXNYg)!geK6tU`Iph@@x6r1`N=JNzX0_I5qsVFu@q<@P%( z{eDStvdX3f$jQ0+?nM(5hA>u!3eJNX7_$%#%?vt?!|79I5r_&vQx7aJn-+SHrwKy3 zw3|~{)l}1vQ_l?y!r3z8>zH z#K6lE@a2r8Q@7N&ZN1j7X2}1syc}1vAVO_UlCTJ2-=~>@P!&kV;5T@|wp8Ol!Jz(U zg+v*p$}*&}JA!lCrxJnIX8q-seb*~)$3-e#jOg0eFXkms$y&yQEQ_<!+X=vQh?lxgcFu(wPd=Gzr5>go$W zin}T^M=Wtwm>H5_t!Ba6^F71>WMGb8)scX3Yl=7;g=)+X3}T1I)I>Pv=D4F(@?hNz zHMbHQz0n%i6=hoOYNe^Io>9ymlvNA;%jY`7i1(Q3AYjj zs$hk%Y8~&~sqVi`Ia63iP2nAm1`dV?5s#{cUwr4N2LQ+Byh{D}J3sbi9TOyheOPC>%`0*xYrlIC_B&e(8_8%$0-M9YA#sd>qpKl~-BvYEBa>Lx%y;FmY%piX) zlQF&0N%0&?oG=N70%$p5jGEzhc^5NN^&NT}*)2xoD}eudDUIg^DiO`Ia%%BR)>WhV z7WTS3Mq&q9T^Dh-6ITIb65e<>L&L3x;N&nmfFl%REARc z7Uj3|lK?2~wDU!`H&mVl{9E2xK9k+@_T6~uSz ztx8C?JKYZ|;f*1oceEVO!wwHXB!U$CHJBUjLaHDZLfGfMphF7?TR2`|8?4^eo`!;T zYLKYGl_o3wc05XSB|9x{6~$}k5157-DG5|3GLft+fPD=H(KaZF;sNu=VC!%EM&ODr zTHKn=pqablfs4YAQw1X=0;jgqG-lV=H^3o~ZwYFRXu1zTw}vZ`YD`K_7H0Y84hPeR zFpz1x`~mDBh@u)<0Eolz-Cyp6K`AQTW59MXvqj~`#gJ0_!o6q2MFxyd`Gvehmq4PJ zG+=f?1kwAWFwm)HQjac$GZni}5^n-t+0(|kfF#q8Xs!==daN&(7m$~MfLC?uqe+gj z=N0u-P1f9LjQ7zI+uIyF21f3CBeD>^{*Xe60_XP|DEgf;7F6XCbnfrGA)yUF^u{Ct z6pH(rFPdx9+F=d5ON>{r*1U+m`pF2~uJJ0RhHe=WvU~(KU)WhS`kJn#;4D`JRLht5 z!=UVYc!yD@;O})r`oR#`#8x4Bjh?>w(QSZ!f>&FG7S|)`=0y0M`q$y4$qS_t!5d*> zs(rIIr6wY>GKD@5F(3lgs}V_*n=8*2@>`xdrZP?jdKAu)6HW-Z1W)HE5v+OjZ5}f8 z>eA9S4+#oiIId#To-qESra{z@^%hWVkpt4sboG_~!%04TH*x{9%3haa&nB|6 zUH24X3@V9##YuYL|F5Bayk}8nr_xCz|^A5eLSbw{u5g9I$H1Z&Z zA+eDw@-}Vgn{yz!zj4%e3`E8Vpnk*C)kttT*|W1ep0i4tv+Dfnawyq$w?a(DciF$# z(cAT*Ut|2GPrA4(C=tqYRaI5%FUIN#VUea) zbv^zKNWD>V$G5M=Y}Pv2+VdiNH09M|a3^Sj06t@5&%2+}rYqWE>N`f=(o89nd%yHQE9ckP@UxsmVTOj*3o+<+Lz9pSgnX~z5+8%En2LbKgZx`?u+EC5ci~>>+L)ANuK#_%6CU@ z7oyf5l9ZyKTX~^3&A&nayA^#R;zBGG%18ZdBv<{y1r&zMw?d7AWn@@QvVgi#%CC_) z@moHqFd%a``;!0?(NN*`fsHW;nY>V&I0w`5`sxu5g)!(jt*9e9rZqDgC^YO#@DfS0 zn&ehXI0Mp#y;gQuKfT4Rws()oQy=D&ld`vR2_Liye*3IR@3gJ?#HH7MlG-O8x<#EI zwJR)AX?J=b%yU&k=6mjzgCVu-&I${l~7}js!K+#zrkKnd^+)-c5d|yU4&k!6Y9IlK~(3GO#E4f&GUrZ;?zJ60-4Q zJ~z;0539E{>6i=~ge+~VJotT^gkHI+ZAfP@gAv{$2y}#{^}adTz74V_D}y=h*=g~H zW`=2yQULJR#Irf8uvUXWpcYZ>|QX}F-T(g;6ynG7Ge zRDvluJtqUE=0Q^S|Ma>5xZ=0AW&U9z{zdn?cT_&|aK_9&C%^%incY~Kl1gRuDIz!u z3$__5rD)NN$0}+VZ$-M^pWl;s()yt;PCs?1QU>V(piV2!w)1Kw#*Q}( zg2OM2oK+dSh^;?HM)knb(50+V7XD`Fl?_5p+X!iyB{s(?Q3uot0OHL-i>Oj3db%w4 z0tK&sSDY!bE}FiJ7?7oTf7Kxqv2rAD6mym7#h*Jd;x?5wV7upJ)hJbm+Mx|yQSPbsUm=sht>6i|Qc*0#u39`QJ6tz}~$KS1k zXX(Wd3iTzB`CZIt#-QphaJhT|WW!^Ahp@M*EqM0WrOC6+X*HD1ReZ|#(-952Fe1M7 z=*n{B$c`-bdMph0tQa(0V(hLw_*%|s(3VYo2b8`i5V&&|?K_+qZn>a$DLwu^Fha#= z=9lC&TT`uLM8pRGqWKV|ewh~0?EU<*A8C_BcB^xcc7Rmz|G(3cGnHHq)G~jj3T|G5 zH{j|0cZ%50uXN-7fiA@LIrC?NiB=hiQ~@cwK`x~;g*&a6asMc5{_|O`NpBg{^M82L zHotf(cAjzmuOXkFGvTS)gmR9b`~~8)`()*C8z`6w0swxtv|H^FHS`}Mm)72Yz$q2~ zC_1%yZ#~Y#aMSbN?IQ!W^=7H{&B6dbTl&$bpBS>gJ}o}vqIvB{IoQoIkN3N_=z6=i zP`;i#y8T@JWq`x{t1l3YKWzW`f4KMGo|~N8_6rXN62Hslpz#at#Am~x20d;y?^T!j zub+YFeb9Jv+(qsXC@=9hu1@__L?5pq^9Ja_j{+1@v-L*|J@kgekWGHQ91JVj77h>J ze2w{DCOTw2qRN9l%{l)3luI`SJlxMu`R6SCC7AxW=k||^NShZAYT|iGHct&Xp#*j% zuQ7^ScaS!#lKdLvJwjIeW_|bna@+eXHZ+0gcZX0UKo>L`AM(hL9|rFeQ4L5TYcszxwzrPG^^qWJfExe8^5dpw|5l%J_2eI7@w01F z6JPpCrCs6S(B9JP7ihnpuJZ0{TQf1Ed6}8fUV);NtMb3Tns^a-o&Xy5X&Ar)EL)j8 zwY#KOG*0EXi~M{*BzJ!P+{(A*fU0=+{fKCT5#80)hbM)bW|1K-8FPKHCnpU4f3Romxk_Sg$u zl?@XY=i(acIGXQPRy!f=cP?#mj~Jrr{7D;Yep2AJbD1EfaU{)6Z5Stkl>XWGdLYpq zLVp)4+dsl|25k4dVN%H1wkHZM&|T`I02N$A9muQ!h7cu3R-mC#!mY z;$apoerad!L_eu*>+h_ZvcCF{0F8<;f%V+l7Xjh|ivp8J3PK`8Q+gFO0(Qh`jKg>PeF z-4Ry-pt91bi)_>xuci*$eZ{e(@V+*)QYD%1g)ITt#H^>uLz!tD;o<$c9e{YiUUEH`Vw7j4mJdCuKa9H(o4YT=Ii{R32`74<} zTjGOFwES^G2b(>_=p>)%P{6U7njLi15P1fdV%|n_MxdNyDw`Ds246Y0mD~v%FLu#Z zcHC<5>W$;{iG=@XpCah~apw?0RQ14ayN<)Z@0NUe?b5;BwFY>8Wc`&=uDwqoulm=5 z2atbu8Ta=a_n%^B@d~9J*xzFgZKT1{c#$s?D)Mq=q_3Y+b-+EXuI__-)PM8B40Ind zy&(7T^4mBWYp?KJQW|`NaHmH@w=O?vI(Ry3`_lD6xyn z+5gT2f8^|YXFHeA8%=@CHj1@6bEa_6eaO^#7?rktA)eFB<6m!gY+T8wY2pRG)azGG z5k9u0cz1ZHQ?nHc6cIbIIvO_Gcxo%|yPVTohR8Tf#A0wkLNso)E&~5)c79G}+M4MY z6Ai)1{i8un)781%Fhv}ECMD_$dEAWlKx&cwn9O|4zCrRyD9%&6U+SX!B(Gtyp3)Vm zi?Z(<>K9U#R`x2l7Rb#M3e?M%2I9-0^AIns3KlbnIY4{)gH{Gw8P!*DH{U?g%fWs%`XXS!^=N3cu&OP^ann8a0 zV@{$L0yzWlGxs0l{9eLUsph?^bzS$L9GgqDb*n~Ysh!p+Zaz9b1igrzv%40u{|ehn z+txp*r#E;1>lF9U9=(4q!sFdu;oUI4z|Kz_pSoEGyyY6cWw}2?j@u6Ii+F47_r!Ma zt(m40{TxdAzt#@?^5W$@hEnP!TuX5c-XY$+4JquN8R*dZ+PAUEI*J7~+nm+)W?@U+ z4a&<1TbBe^JBR$b8~q($&k&5a#JWPA*s!2fIG`MUb1zH>EF7M}AL}%+tJ-Lz7C2 zLuS9htcAj^jobK!8~KoXcoh1ekxddz6JK2 z@_RM!c6`Vwc1`bosNO-=8P`74&i|gI-4k_#P&el`vCcgArq_2i*LCq`fqPk=NXLtg z0{1t*7x$N?p|j%bB3PGezv#Y>C;VB%G%JR|H{02R7>sJk8;qKK_ZebqG9UeLb8w&K zd>!Ovd>yKXZdXdk_!b)cUfuYZta6F75_?|Kj;^MJ;ZQrTZdXVAYc572XHkjwu4Gc3 z7XmAK!8)jT5d`Ff>$>+s553(Sn2qBsk|~#=$J*0A^?c9vw@+94NxK8AKkgLH)SjZg z#GD>46yeOr7iLQ9>Cxn<6~&jG_IX!1?i%!>AaI6GrxPTt*IrQ`!C|Ez4yu0OT)8ePpR5A|L` zo1SnO@@eZ?fycI446B+q%f}Vp9dI0QhzfH&VRRxX!2G&X^+;`i5f4vc()l!ssSSj0 zw`WXw6vQ^e0mc2CVg{aQa!O#ak>$Eap zcI7+LOTU2TpF5VGEERV@al#?t_RzPsHLI8(4{?5aeo?lU{iHZtFr& zW9|vf4JDr~K8g(wKT!~%IZBgzM{PQyI-Wb?ELC8h*A~VV42|KsPr|P@$^qNfgK8J@ z>~nV>9-em6yPCm++118QJDsBlY10{Vl&5)nj`s_N*Z_ut|= z*V_afbHMB>8Sm>ux&D6fgNwZ>xwm6g4VLKIh8&134EMc7R68*_IWiAq;J5rWTddBd zmEL5fncZZ@{Cj`aNdMX_bc_8?9w}kIxiT~xLYVbopUxTGJox+8)@S#tnLlbv=apqr< z4)UiI8=`E$==T+gR5i(5Z@H%$SIQIiGE}RXGvmdMDpHZAeLj=tHZPa#Rb(Sg|Es$n zo&69>HaD3U4|&1w=svkhxH-@-w#vUtM+cifGz6Ns=RD5?>2;)yaxbS#Xr4NP{06bC zIm&cY7i*h)tKZ^#C|!VCi~05Ea^LYyAfGWvpKlJ>B#ns{h?P^k*>l?e_)#eG8#ug) z68qvvjSlkXXE|gZjs@eSL)<~guy*kM!wuCG7s(Y_r{xiX=>Inyk#h>$)tsUqYVTyZQ|!tnKqUE zgiDKu(~P$#YT1JO`iu-3MKPn5C3wbA&*L##ogwX@%W3zk;f{ zxMUst5dGKl$m14{xC2H5$!no)17ycQw8sDcI2y?!FKX( zrg_yKHJx>9kgv*gQ8;APS2!}(mbghSr$T%kO8lR%D0&|w{pb`QAlTYw*zu1DQa}6v z8^I=ojKqZmPk6LKc6oZEMIf)zZ4kEtI;>h9v}yIz+p zewkgkY|ZBgVjUjTe1?oEFPWN)r^pwn1W;nS|0&2SjMcF{yHZ|*(8Ct=-DN++U5XZN0p99QPSp~(z<&&rgh@%Xm2Ma z&6Bz-=5b4)pBF#oI7xQ>e8Cf;2+>$5zuP(mai?kgd)jEJ;YOp-^60DZ>8MVX>(uOQ z??GzH^>`>*<76kAfx3ebi__U^vB9)?Cild|=9>b(kdX@Un!%1D#RS@RBsS<=7$$u# zoxT__nVmU}BKux5hWS?uyX-)*Xv?i6{i`^L@X^2 zbITfuj&KNO;pFZZY*!%v0cpoJkng$M2A}nbCcvJC4Bm9hN&kt|2d#)Le=#V5%4emVd2|oyLW%-^h7_Z4!{3 z(O_Tnhp$Ap{+3@_0x7(MF2IJjRewEBmK{D2zbi!Z{<+AD_@p-|!x~HHMcjdMRpZ4w z_B7sXCDKJk=T0))ouvBi&F$n?KM$L=(?7|a>%pZv94<_|=U@Z4FK0P}!E%~ByZ$wE z=lp6ht0``F!AHb86K}BdutZ9bs90odiR|W~w_Yj|+vM;rGeO5Z{>MQw7}YkRG-{;( z6&c+UX!257mAzaPWcYp>>rk?I-kR#U+=H?3P5uIl^cm7@ebxvqX*lOx>~A6Mo9#F} z;U`U<1jkg8G&uo&PKq2xLqitAmtO_onqI**%0?59_$?W(2e$DW2IXltl-poS3f>Lx zO92t}Ukh#6HwKt5WXqk)hc?||n}d^lIfQfW|2!#PFdCn+>0?E3xY|6=V}A9CJ6isv z`#ya>M|S1bpEn0~8cE;z<~vLK2(Ej7@S8S>)t`k+DY*90x38g%3Zy?he~)*Ojx0CX zPeV*)8k{>3qp751>3)4$pj4wIPsWguEbDDHkbDBmGFUh6V@ZS%J&r+y_G=``%GiXM z1yc$I82uY70RUrKLe6p#=^k-T`;05 z1z+yUh=;hw60o6K9k0eDzm{OGZ5b*h56D{=w)rHN-v#H@O!a`4y!=TyZd8DRxn_Ra$WPu}A!T27S$bC~)Ae-KuYSl1OW# zL#5NG^-bq?sQbyt<0Ospn;p7$C7pfGoh#ODLt6Z<95!5;;cs^v^`&UF!eAs1Kyno7 zdG#gkuWXYhr92x%TbuhyuD+v|dVPdWynSNXJIzZTA!g~9)uwui@2tNGX3NF2KI0zROU)x4$Lz z_1cHE@XAKUT37Agvekpne{H~pMSMqYUeZf4FM^XxvUqFtyWZ4E? zb84Mi(Ignt^%hTcv%)~~Tt;oo7QFsH1&B+YN|+JTJ-dDUXdl(dZ3z3coHc_4nr zXv)#GCvnU>tyj)k>f|P;6b&=c|{8y0x1^*R(uA%E3yTJhA#} zrMf;6FArV+zQC|twf}tjZ(-=#C10BPB$Que#?cyg01R_RI{4vG5t0n9lQeTQa;%_N;o`g?I>ezCNf^bhV3Azo%)%;T#`U*e8k zpN}L%u=??rAuGKhA^u;%o&r)vxbfI~4ky{I_Ls=>tb~KHiE{*^Eylld(TR*ZK~hyf za6bL{8aZ3T$V>DeX*33>Wkne-F_|NU`!z$xoQ~|ydz1FcYbD-n)qU00F=0(cj^AMD z3PPYd=F6`QyW*@O)%!UR2sQd`e=Tk!#Oh;2i$B=Iw9#nFaK>6}`1Dfd|3}(;$FsTq zf51-X={`q|qgvWpH9|{KYV>p=R%^wIbO^O)s95c3b*W8=*&#GWQX^EXF14wZ)GoDS z)QAwob0zeg^L>8L_jk_k_4o%NckcTdpY?vfKbH_D_u+@oA0G>16xr9M&5mLehPx@) zt>EiQ}LAqHd~dP&cy= zEc}LIpO?{JrFsyo)l6%Eveb;ab?Hj+ycErDXytt-2#oHWMJl@|$(AyNB7t$bE7^kd z>F%l;Oy8KWYb;=7IYGKY{H7E6@>(#yQ;d(}5IK{&`2cUvgI&Ri(_I_t0iXw7Ziwi8 z3$gjjwQ820vM7`P`-Q5c>o(WQ=2bZN=~VWDfs|xNDn0ffk967THv1@%@bNnDnG@_6 zKQ{FW(XO%|?oH|R2zwUgIL2u65()0b!3enwWba?GAKjWpI`Xzk^@o)`=iJknm)iE@ ziAt=#ssAvyn-}5BDqUVdZ-h%neWpJlJlL}d{`e@R^b{q@HJM+9!pR-)EWH8m20_r~ z8^Jg8n(2;02moN6OXXavfTK;Wqaea&j8Tsb(!od=J ztN+8!y{Z3U;CgERbE3IE!hS51HxWOE!uLmHa_1~?3!L2K&--az$&Y2ja(r*bp@+@x z-eYgsJN}$ypbZcSf6jW@{O`BrzqaMO>RQ>~E(Wi-@A)yg?1$m3*|&kon2qpm^Bw0_ zt2UmK;lX*dJEeMm#s7EwH{96f|8fo1PqU`V>c|4i72gT$0Tl-U6vvGBAZ33{-O%P1 z`twcFKMZJ3_2y9ADg9v>-=_Q+u^;ynFdhg}cJSMtp1)$Ax8dQ@;6*qpTYn&&i&6u&2Ng0DrmWx8-1Tz;pfh znnn7q``B!nfA-z8L+d_vChU3=>}F0nz**0npElohE`T#PcLp}c;VpdQ-Zg$K?#=)E z1%XCjI97R!GW_ueDfcVvrR6TidHBcm|F6ycM)_~|T~vsAkjB2xV)wruX72A*kdMOb zZE!^unX^$~njYSm@y+{qB)4H0C)gzgFkTzeO96j%zXvw$GP`WUnI_Ip zn{VP84CT0vy+0mm`aCB#o&Ep6eAym}y+7I0y2{oubEb9k#rS6Wpqs6?-ltEl_k}q# z#oZD%>rvuPxEcQR?J6vRobwJ*N>AYxPkv66zJ)15nh$L|hIi6)J6_asVdEymT=dZ)GX zZyR!-y6RBkY5M8Yr}zGx+Yy!e*P|)NYIu{h;ebU8EfFc(F#aD)#r5mtp&t>G@zL$a zCBI;fA!~*3Ha^ntuB=L{ahu1;qLRFZYnpD%`a`P_S0STvO0`RkNdx6zC3A6cZ|B&; z-~QZ`A?&N48w3s!nZqBvv2l*hni32Yk-c>(CEPgu{a9>j0-s^&^(|PZ)ew&Kh;@OWt}N0N7rG!3y|ze zJXV1c;I>YYWyM(zrC9dtdtgNF5(&{9sy&7%_bw`|zcO=Y@4mhIJbsc2;1gtit5&rV zrCXOj4ia`kJv=mY?|`QAx4u%B>ZZWCy4GS`W$@9mZC;AGWzkc z@mw}S)1jj8z&|Zb&TeLlYwm7I!|tONOQCK&fG2TJAHglYHZe8Py?!~5XQq~SopN}W za}D>*#Oc}G@7hNlcl6EKM)1tkVG;-L6s9>vIYCldd;47Meiu9KFrwV{pWB5q?>v2k|m`suvd4-flPnPNc(j zVXmM&Sf&Ur)^iOw0ZuIDE&=R<1~pW3bK(=os--xeo8gl6d{Z^~a=o8Un)V%%Y=Xo@ zZw(pjh9A8<oe=iwH}BX%*ApyWW|2!GHwmZu&@-gN`LuM_kq^s_x9j( zxQg?oCoEe~Ue9q~04aZYEQYAJ;1AEp$tPgcPju@p**lZ=?t{nYOa>V5 zUYlNt^JFe`eouUi!aG=u_>l<%->;VVdEMy8;o>}Bu^zRzQw#~3eiIEtOy&cTXl$I* z6AZJwfLO4;QmX3sK#!^QxE{8hw1UKXJaptL0{)Hwu-6y-Qza znhIyXd-wZ%SG=rZ{j|E|2x(6!6nXo$d0E9Xl>_SHPX3B*D=&$7Vs7=b>KA#0=c%J) zy48?!W#HusmQt;=y?qhmR_}vc<9z#>pS*;kW+KGqRL2<1zKP{=KTI49JKP3O!jAdB zoT)_ZTd=gaG(G0@OJLZ7>ewk7)j#ZiG39?v;eLKIU0@7Mz{>K&Hy2$KY+l;>Fg@oL z6d0_k;Aa;;^Q zW>CB3a&^xss47Yq6zKi53!>)Qr+U>qH)k$sl}`6Xe#@A$OTnPhEEY0rqX{G%-6XP& zZY(0GTo07E{XyHEr=24a&6P5v&4}2(J`KO+4&_EwhzTavtfnp0=H!Y=cC>Phv~GX2 zTP5O{MleZoRfDx+uis*XvmerHn#k^#3u1}Qliy8P8cVHx7~~%gC9!hueO0Z5Y z_q=~0?>E$vDW*)k5)L}#7p*U~xiwT2-p*-WTWTXV&N?p4Ql|X%bm%oL-#D9icPePr z5Dl^Nt<@#2>XXU-4a}zv)?P9c`scN=o9dTwmwGNW%bsec-t2gvV-vHuxL=`dDpaoW zI<&;{mnOLrO4Vzue$ANjmHi2{XViMtnK6bIVm?GnS8VuPq6#04oTF#smYPk(R})50 zo;-PLcRpH%+*{(s-!OYAaZ0^)bWG*emUouRLj`W)#G6AaH(MC(16!SJ%ljE0Cf}nGN=z1HBYv>^ zE0z3e!*L+o@x6^Ub!5g4j<4a;R?CeiYWEfe7~h9{NpZ2tDDR%#c|hk979lk!RTXa` zd$(Pl<2Y!oAB%4|`ccz{qUJt(u1{}K!5)m9=Y2SA+sJm`EvxS<6l3_ns+iWqk50G% z(nO0(^5-ot`J|HM`lT2}BzT-yu%AA#_-@do%G+bUc132oLug2v#@LnQejrX%!HG&A|mzhL7LNq zha=Y1-ac>^M|CR|vb;sP**v5wpWBrxwY3O%(#s2*u8z~&1iZB_Uv8j{(<90*Gg)IR>C~|xDOy$nCxGRI zy%3j_0k*k(3)zTjIWGnf{tN{2#^hqtWL0eKI&#hZu4GBwD;nnPZ3`#^df)5hr=vVmaO+&0X>C7RE*r(QRjp(fHCMlAO6CFOrgu*cfSuA(*$vj$K7$G- zBXFayaP6(FPzxZM!{(Y1Lz;wgs(Nc^&ygm*l@%3y{{84t5n~OKU3$mZWIkEn-afv> zjM6}oV!jb+*6$aFj4)T<)dr3?`ZpW+90R)i5ezgJ7=c6B9(L7OBN!Q&!RkDO{JyNcNw66%+xdO55qp#3D!Ym+n z^Pg?g-C~4(t-V`0Q+HV^Vw*@^>APW}*<8K2w@f{Jzs*stpc66Y3~-0DRAh2tgt{+Z zKIS069K2ZxM-_eH^A>s8eI_c!_*z{wMK2RtNkv-z(e60}Iyp#PxKJDfQ}ZlueNVv1 zlH8YTUK%C|IFfqsEi;Iv`Rx3lZ%UHH?}-A4+%1_wB)j*dix^$hx~~yXp4Hbi#qSJW zP6(hk${SBFEN3_7jV<~N>#y}m(HxJ_pKArV*%;Pmv(ANKJ78c|2-!%u(*p#rpSt&D zL`sXPeJs5AIxW`LZW!wCKbl-eX0ldim*d^K<1_N|#*1h#jx&_4EPRU?+T(g3EFbie z1Dj*h4wh0WqvM{mm728%9~S_*Hz=VS%)I-V%(TGS6t(3AFS}sN3Lu?Hnk#s&=}*~P z0gb1j%bP$)i1Hi%E{StJ9!$to9yUzXkieFRc@8Z}dd2hu$n|*Nxs-G}zM9VYFyo+- zqm&=fkXykYsW<0n@J3YF@j1A9qJZpCV$MkqDd z8>B~BAtsOv$IjXDOL7SUZjdNiTvLN%*iO=$?ClnifQg3Ev>;Zlg2^wvZVCmc;;4wAk(TvM+g6$9I351&rvA{9x>79Kd zfd~b8uVK&xNeS1fjSi0@=5}Ak0A+O4sA4w>8_s$VEnKOn%imi;R_V+8i z@tuon6)?^?zIER$?|hZr@GfZ}o_rBbU*O-em|+Vwn&Xp{ny;G(J1YjsKDT4%!}MYz zBAPlA2|2r{8&Yg(meVJ-Toos;p&=CHpS-q?pE{Z1ST zos$;z^~LZI>5qb!-$`!otCdMRF~{d@5FgzmuYwvW+Y7o!&a+ed8*aCp+lyXj1DwKm zZEfou5I{jK(M6KIjtl+1(JVc{#!g~)}bkMs-SNo@JQfvzb4bua|gBNxZ@DRF(aSgI{)q=LK}1r z=#0SJHQt|I>lU=~w6l*;hVQ4b$ff?GevOwq3m9*0cUdrAR^vxsu5`U|C@q`stIqg2 zOQDTmQ>qh0r%5!@q#@Cce#N;{S$;XAI5E?deLe(aFNh){w21M1iKYH%*HT$2&tS3~ zL{eA<-J@p4TmzA2M!?x_|MY^rPU9qX@6;CHUger)m@%ghYe>C(dDFK+Q^v#m&#NQ^Z9p`>&I>y>ja>gZ`cA*IT8_kkNR&Yjrf@aLl+w{AuwdqtkF z7oD9^cif$YbTX=f@fAYeh&%qFNH;PYj4O*(lkAEKXL6uZkn7&I>!Zz*jM6W& zO>ivG;wkHoQ>EM|sB#s|hXIRKzH^}ugOrC$r1Bpff=s#5f#d{$cDX)h@jQCvA0fHMCdmghZ4zdkb1|*77QeOXRp?fA0A6+^vu9 zhhJ4}{-dbX%i{L}8_+%2>#wSo_{1n$`BOF0eT=*;wym*bK3)`3a4s>?s&TJow~ufv zMjD1A5)u0q561*bKBw_AHH0<{^qrOQV5=fUc+{LeHY35(sNOyY1V*KT%IBG!-p(srpk(;T62X)PxfF?!YLkkK)U!#wBehlHh- zbu5r4T`Pane0AakEL<7762e!~PdchWDWyLYzdZ0%&X5_H55sK~I2JZw56UvJ9B?3)U25C` zXgHjrC8y{u&KyN=-FnZ+XgdDhxL+%1Ajmqtgje9VWw7?vLQe3zJu}#!J`6?sL@gt~ z-sXT?AXms(hjg}dxkAY-QM-;5-LeWxNyw|n{K6ZvQ*xNMsps)uVkLQN@y2zf8QaS1 zM3CM2>EZ=OvP7t}MG?)-kVG6?d_Thf=H3e^n)LDfYA?=|0QK z|K#d4cqD*xjr~JGeGfk8tcHf{-NYT8BsqO>t9mR&FLv*^lBv`21g|hNK_^YL`j0TM0_ zw7r^aNY-`WFO)*Ry_w!c@TrkN5Mq5bm}aaz&lnlQJ{iH{wWFEM){)XKQ~Anb#_ZU@ zNohLTlvV`x32eth!o##9R-By$fKVxgdhxm!GzHv?`xdBgSdjHB1&{`Fe}+C2J<19o z#%Az92Qs`R5g;_^eLMHrKRQ|boqnh1ZCKvv!!q&Lo*RZA);I<`yQD789%P2_24s;8 z00{7F50dO*Gh`mo%;tUe)H_%xUkwWj)6vq3w|1FH*0YBd?>!Ka(CNLhvU8}eW50u= zYgBmC^yfFXlQTXP%Q8oJt&4qPWRUS88)e(|hJJuhoGX>2M)o7s|`B{j&veIlz zpXDwyinb0qkH@(_GT%00+i^~QFmJORX0P4*=`gIJ8Z1-ynmk2!I=pY$uDsbUYv%C zZ=U4pe)eR(?d1?zxE}loe?8}*cS{^BsA{v=>7MyXH(tNRcu!i0zt>dg%b^Ngo$I)v zsrtCVFo!`zocKH5=lA=oYmO6}FxIaX;dOITLkqP9t--m5mmg}`f;zEl&u<6TdB6v9 zopb)DO%RLvQKkN>@$%+PqbQ?W(3Faf@j<#-H{XTYwIeBai}QQrLh##-@d9CSR)|cJm-#tHuH-N;Pi`J5gHm({ak|2T6 z+q9>y&oUixrz_9bsa0`*fr$cdVN`PLf)vc}qwv+fefKNm5HV82rSn5q2!^uMl&E?M zIjGk+R! z2ZJ5)+l-#zZa5W5PB3F!<9ro)v(=1*EMZBOvi4Bg@cAhn72mnC!os53&nR(C_C2`o z;ds>l9U*zEj$UEnG+x#95{Z?LIGIab{P0yDsw5IjKG8HThNI26d(5^5H5* z`Lg<1(fbYfeD6KK4S*uYn;GqslF>01KdD@`l&GEvuMOD~pI%(4xoXTNbX+_3&uDI+ z;HHgIZxTK$Q9;KZEXc5n@5U(Cz7NOvmiHaPOYM17StEBBSgGmy_!nX0MkLP{g-*P; z19gOE3HtF9xh0;r5%|MR3s5*RH(AxsjO(>; zp_ycZZ=Qp?muNjvPJi5QwS_t!ND@d`>pQf|gz|{^MNSNV$>_Bhybjiz=m$Ia z^P2NA45vdU%i#N?<=&}>7-6lB(I1A_#w~__H#`pR;m*ZNY@>4R?q;O-KS1Z>n;^}d zv!_$aPVhRl>fu|{M&p2)4pfPWv|uAw*HGo#?mgeOU&q4?KjhjR+1eqr>td`gim&gQ z(b!6ygHcTKv5I|Iqkz}vwp3U;I6B0&HLwTmCJ>#-J8w=6pNC<0n! z_c$1yu??0P8jQ?Z_IoNb!#p3crw9r4Gbl+`3ot@=sUn~Gvh!!#`^{`p{?oCgHy~=h ztaZ={vpzeU)Y{$cOKqYt=>wn7xSU-5xn*JPbDF~1h0|WRW)+XYSig#-e=?wZa&!D| z23Ujc1-Nnm)jS|1A!PH$^jDh*t`4PL$F|4 z#V56^L~s{HNgFw4|N6vBbLip_^qSKN!Ge#as`>%aYIZwpvdgS^(bk2M@H+J>&vq+0 z^)Q##j;>?9aCP~UCvR(2vCC_+5=s7|*+sP%DDABUpkHW z_U&71z+$vX&cY)%WY&^=z0021`#tq0rlz_c2H4mmGTiH_TXs1&$JEgUj7U-_sGst0 z&~fHz{L=Gthn{5N@B=x8sZJPah)Zj)SJ)hgI(7{)Yxe2XsYx{xWRkey8MKjm`L51a zC@Gx*b!10pXXm-T)QU`|Lbhfpc^%{O@kq=rmA|q+I_(*fy%#T{R`Ye{H9|!Pg&l3euS-*(-c z4~$@TSoo!21MxcrAk-?cVRlibEMX z+XE~px&1dN)OJe!=g+9xCdrc#jLh`JY7Bwk%1%fn9VcLc&UrS{4#SpyQ(=q-uN5Y< zQI$sWHtW#0@=2uc+;68h?eFgXImfM{=SIclnSMgf*|xk__3>6>e)JvlmLZpLp3^3nVy$d>ztiKdqvBc$^EtjXnpC$#m&~n%Ok)J5hEUrUx8pl+6vRr=mka z5t_HPrRrCWqF|D&oZY+9F*=>$&XVvXRglZzwGHCxAQncYl@|?0OzU-KuB-SBvD2BF zYZo5__t{fvpv3rs;gq$XZ`XzRumDns%dgY4=nAxJNfX!2RVmp%S3QbQqIoA(meYN8 zEb}O8u+Z{g^VJuUer6`jk1>gom4N|KWsGQUIm%By;H94Dran$(OSXpk)+3vh#&EOWbA_`4q%*jgOP19lkgeDur!hN0% zR`+wEdw}C}OM+2DV;+91jAm%i?|G8-6D4E**W+wN8olA5u!t)H-J0%Q)@@}9jrm

R-__nQl5`=yxW; zi9#EZGdE3vNSmJrU%{oEwk71Z}5Y&#H_J)`sy`G8%@m(*v{CoDw({< zN|qmSzOwFz=J3&ynG9vlwuJgKY2*smHm!Rkd%TRFc%S2TMqYbjWvnHt zj4tPd^U%5E!489;xx&TnF&3JZeJy#P$v6l;0O5`kj(*o{soep(CxM6ULfwgmc8pgS z^ypa)6<7Di_U7jCm;QIr$rjWH9&9F`$h*10d*bjgnrGTsu1?m)Ob=YMz3?rvuV9^b z!-pr1Z^^$QThiVFTP+`!ZbLY8^A(*F1)Ah3|}KUY=mO9qVT( z5_%s>^c)B8#3}i8MDz~uqmEMm8%D@A@r7ZcivoU9r}b^r!L1C7;hN7n2gC|C3fDN+ zRXSWz-(df1N3rMwt6yETbl_XJA0-J|s6s#lqdB(Fgn4?nV2$jF#QG|ywl;Pu#Q(L7%z$o$QqI)*xC)g9cSO3o)vf(F zHAvLItZ*wdG>kv)pC`(z*}s&oE1*xfsgK=mHBaO=Cj3V8AR?960W^EIe9T)Pe{=Ij z2O+e(Dmax+Y$dwGTtgk^)9jAx7>~?(`fD21@%1_QiBN)}z?b`BII6ZbdZs|fxk_)g zC-&kZuD8&?uP!e;j8s*SKc&&0-MD|*8$^z(A`!eAu8Qi^^YZj*cvHf1OYkOXhE*Bd zFpQ7$_?z`@Rov9MAHc@E!0#v0|Da4<5~2MD8vJv)B$nP^_pZ=2u8*xod!Z-kt z#{Az~p$H%QfB*XbMKb(!==DDJ>vcW(BIOKvjrK{mianZ(eqA*y1@?WUko*|Opc zRktI0s@|70*r|5vMTi>UTNdCAbAE6Gg3hBX^S>YUM(7Vf$UQ_DJ}J&5^AaP_2q_5p zb9Q=9>0df2Q|K>bLE{A zCsBdLq^Yb^5yAXwG`K9`oCFvJv0zDS5ew8{)6YQ&u9(!f=$W$|@eUDxf*ODi@4P^4 zAiXVRW0XDaQXls!|3)+9l``&28B+Da%Zkpd+X zqD>RZM-+K@cz$6t#49pP3!2Mg9Jb3RLNg>`DfmNKJ!lli2Qi$@$DYD4T+qb95q-zDB}6IXzT=rX}m2a#E(~4;R9=$ z-zwh(ci~3_ge{-m_5HY^B!W_PM&~qdk!5QE2qL`-&|wj^I#R3y1dD+4qBvcHS zJ?`Ygiw&zLq4qc+=4d0r=xUfR4}UHF2HeN$#UX>PC~Hi470F^0~^msCX;R1UeATASOqU zdwt0>D+m(-%hILxRvX8i5kS;v#`}k~tw70pHgJFEeg0S|B-ak zA4%r}8LcxYP?+TD;-T=$Z4%|-(Y>-Czy0(6W_>rx!tApHr*Y7&ADhxaNPMVUrE4k#)YhX&MpAy(HA);xq45; zPAuXXM2w3G3<;PRlKT>%fpBE6ip2*A;$zQ7Wl1UxbiUj z?|}i=XKEIWIG4n6VkH(?e_GB<7VkxRBH|lzHym#f--I$LFc32A2`6V=pCtg^_zocI zqOJ1xC8`FH-9D(y`l8U3EfK9X^l{ZTeoGk!6r1j?KiR*!aB3Nlj{c!OURTe$=q*ic zBw}Bs(=E}dhe(#9`x_XF`{6nMF8AOXBICG$u(B=XKHKm1yaN7iPZt-dEV!JQQVIpz z_GwOe*%oM!SBnf;!B4&~ed)zf3`J#23^%at?ahxA51W0gWe?yxQ(*GxaT}(rmJz)T zX{VfeeaNu6Nv66gJ1R}v~!+BJyt}j8{ z!;z3V4hXEMnmi^Nrpq>N0TS_F1(O~^9Je;Sn;`83mC&#Z?GH|ZU&{(>oQ_9FD#UY; z6X9LuyVib9<=H`dn%p*@Zpf;N5wE{^=>zujxIPoqSayoGW~QQ4QS>~_okn;k_CI=s z@KDXa={tfUxZ;DfrJfOA<1Y@Nv+NbES*>1-KbPbeMn%uMgkE0C1-Bx_lxtt$W6|-F zrQn{%ww}>$e|_6xq#%KH{0KX{Ump)VYSx#crVtJE${*oe5}MizrZXS)#TSS%^Flr> z@r#hn_V}7`_YUWOjG6~t$Gu38dplY?`}UXFem!Jxn@Fl$2;<*a01eKv71&z(64?jQ z$f#}6;dWkT?$Qg}u};KUhbOBT<4JLO)fYO{T6b)m6oTohME)Zj?+*5oxm(U1?b;5g zkF`E#LA|{h$44HxcambwXPU8E*2jpctdg&1M8`R{63Ns>BN2D?szX>UpASu?@oK%t z>or*0U&m@`LU0vU`m@|u`g^|aeX_~kNj}FS{~(;sod}PhB+)2RBRtXWR{x&Q(gu}J z2HmP;{<&7Ql~$@{o#x8cY_c61{ent*4N;`aSd>_SZ>;L|`HCL*t*s1kocYL1j>Et( z!IiC7a#WP8>MMw+T3S4%wy-l_XrIKkyK9N-{feu^cIK4o(`4oK^@Z{CF*l=eYwDXz z`{v6rV%z;jO$tu{s6mg%-cg7Wo!L*&mbVu)YElvPNjlKOd@C zgD0mNbuP2!7%7gU%WP?xIG1Gx-^_DL_EX^5=~HaY<_f9(kwwkNW5h1l5DM?CzIUq$ zWn5-@hi{Vap`@a<_Q?8gJ+{+r(pp8O9xlpK)svNG6EbcW?yToO3@#s>7;6`VXkUXy z`59H`M9;A7e1-aZ5B!HVeV%(`^PaS)o!|LJ0<^j->W+=IeN#(-_t7P5Uddp04nfYN znZ$GgM|fjmDCs|eyGXVt z=C$k-YsftJUc_c1RiV{M?n{rHZPRlW+2}vYVi&!qP9DkVN8)4>xOF1YZ2S2`>}W4} z;H7uBeM`wx3I)2PdnktnXVq5aAWYkQ6pOvmj<)qsP_%RP$&==U2ThTSa_jQA_n`;RrGjSs0hw+0s& z9b9SSv5t*L6J~9#Cx ziHTQ=mb+wTH#q0KbiL%OwGZ*C3QAM?AS5Q^CcrnRS#3ASHX}IazK^ip1Jb*|*8bN$ zAvP~ymj~r~2E)D|@QictI7~D=F`ZNVr5h-v@|(jGUVh}aEBq#wO2NrM z+=!D%gGNCsg9#kDXS6|hzuNyp+FM4&xolgYAy@*z3GVLhp5X58?iSn~g1fuBHSX>f zXf)6eJh;2P&faJ5bKkw={d!|S|Mzj0l;}y!>P%g#W zpbotPjyIZ=t}Ei)PFJL-qvcL@QpTAVgh~?Q^oC1aj-{7?74j!Jw0w$ekM?|qZ|An% zg4rbdL(1k%@r;@s&v#W7q37UHP2g}Z`nMKzFo^mA3QSv(kBb$z!6RGFAi#jh!}o_$7HltH;RM~ry^ zb{QE3LtiimI-WUc!;>71G`idrV;|V|W_9QiHGF8LHl$~;378V{id{oxpe7vXe5eJ$ zQMEaWd9D^qe-|s$Y{{tDm9IY)dMdi=H;SHDRjqS=kfy5wX{(55o4*C0Bo55e`DJ5; zl-v4#&vu6m9x#EtnK<2BFYszT1E5mn^k3Ka7_I~M!w0{m>*Fw{iW0S1K0+zI zB?wWGN_5hHp&Bp%OLa=-7tK)l3QP-LoIi3Ppm|0-VjmG{l5@Bt!*_u^HxBe$371Y5 z^1!tVy9fCP-vO(XrC}*$Q1yX?@s>}_O# z*qJ*zHFVV!aQR~ba>bI=Twrn1+yU#Hi!5v_1dPmP4Xhaxhgx5!zTjy4oTUuEh4`vB zL&ud}Nh%xQxx3>*7bL2q)_lf>*818`0{$3<8LDwY_Y7W20x_Q5v7VjoOJ)=BV7LGr zs+=7=$7N{1*E^&ir2j2!LXjy8%AgWq`3G=odgFsYOUZv`*Ta_oDjcWTJS3gjP+D56 zJnNDaiDZdC7E|(yo03NtPo4+TH+UX1s{Y5E_cYi?z~=14>p%0>(|V{IQm@6e;b3b$ z5{?tc3QXOI4i)eW^X~cNOkaV`hDkF$-NXcnH)ox1?dcwu){YyoDcN%dO__lA*FKm_ z{WbSSY_Sze5F!#Hi6eirj97irD;K7(R8v*@JY{|vjl}Ht_~lCC?`k{;Wbxw! zX=J2WMA+j*@e&T>{+|F}f22sn$xy7aa+kuMkh9y>lHtShLo1LSq*?gY&?8HLuAr3m z^P&vmCKcigh$N_z;@i!oHqcJIVt51~*2|GDHcP^8uMANH^b|GZ$ z`3rTys8VE~HII}C@jieId(4E##|Z{IpCcjMzN5&ozJ#?G=-x5i-YvO@i$88aqd{MTWw6ogNe8(mFyfgJ% zVq(q70rOwgnF>OY+>TvH#J_<(#wU7)#GWevYikQY1bhoCf}@ zn~!MjJMIMbIU^)SNiYUEfBT;j#FzIF z65w?7FdqLh7@obKK*knWH^HZ8+CSa1V6zlu{KKu|3Al+K)xi2ebFJIO3Z}l}W6R|S z7)e-xW1^xHD% z15`V#8-zET+}{p(jyW0bm_m|F>1|_St>3bZ+eerFuPyaiBH{eB_X1 zHiax+M(Ew#+kwHq)?)rFG2|vm@z_oQKIKK+%iC?k(EWed1S}|m?}aMn0md6dig<~* zqNn?g|6cBxa2SBf_1l>;D^x0lp(f8xUSECZhs{5fyu0Q*xVh?uhye0EM1$wf?6mX1SB)LdAcdc{wZa)a1ej|I+?=o6^POfS7)s+7Z$nyI z8&2C&%o1#Q{5{T1;OW#Ol^}-$+wKQm|!q9ql05pYI=4##2%Wz{I~-d zG;#UV?ipsf1_p>)vTQ5|F+l=yIP9T4TDg5tH?a!@<$)_=Ty%=LjaFh1}+c zjQ5~+v3LKa!@aL1mF<~;BYkq1`E@sx!WzAJt=v#4UpHMVelgi+6!odfy!zz5%G15MG4Pw5ia*;J(tEYY1s6Nno1e-e0jzkB%eDLPSs6`a z4yfQpbVrMw^p2Squ1kiNSW4W{_b2samtuONtFqnb_hWIV%EkmY16)9N1LGcGrt5b= z#*p(ucV;8l_yQE&KVdulT9bA~!tRx4_%F#-2A-7v3jNa++&Qgzn>T}=uZ{^>OPtyE zC%xmE*elx#y-^FLX7&n>ayB};yBZn6K@Y8e$IuNU0&T0yB0pUv66;NSE;GB%%;i(f z?r?E@7f?lTX6wXsGJ`wd_)$IG>*b~Dgqj8G|Bzv&1~=@9qpNh^qbV7rCBXTkb-H>J z=hU~8%l&fdjQ%QIa|OWZ7rU%Cn)rgsw7c^unW8|CrHz?!ACgM1TTaj~>`7`uXrb4n z+;98r#@I5!<~2Pj9+kM%U5{opxmi=~l)il~@JDwT8V~3*HaHXH$`Rj1^~_JRXOz_E zl{K?%Jacf(dxTVt1rkeB`v9dHK;zqA{~vsrMYZwpi?8d((ctiFf+&)Fq0`7lXzJNs zJEb0F0)N0|`9qbL5wzExQdEY=(l-!VvV!Yprzrpisnt~HN0R)ErJ10#<4nsS+B&Hqr~pm6-vbI}y$fO6vo%PQ}PN^}0{5=UTK z7Ga_9%?n>0%}-No@s7WmqvTH=^*=~8U&~hI8KA0&WyaEU?9EJM8n^2I&eT216%D6K2K6+o*Vo| zMT|Z*Zx3WjN@a3;pxlvvp%%>5gJMSlw6=#lrz6#yoT9@pAy_e(^(Ca1wRy@^bUxF% z+l=u?6=ocdr8d;P>K^uUGFfi`cn1w>`l6UxeBf zt4y|bhIY;IrDNVqf3OhVet!*I6rfg1?@Lm?PQx$mJ^5*~r+Ixv*B9D@nM%#hV>GG< za(RaKY{$Vgtd6*JX+0xT;T4Fx8QttV@$8*=bB!q-1@vzytWb3(v4$wzh$K?gKj`exeVt*`2S6Cf3$ko&&)h4qC>{XIw}evlmA3M($jE789GSQ{^E#YNc0m+ma#B|oikh5 z@PZ0%MiyEKmy_MKh!+ua-|adIpJ~^1FEy4}?E-yC*Ol3H|Mh$2p8Aj0nJq+@_W1~o zxesg%Pt@c?g;aFiY0x+2cf5A zOQ;my(18)+iW+>O>C)X$B=aq9SD=~K154hJNa?w!!eB>HO=N2mWn+O2Mnd>{t3?%Y zjgCFx5AvG;fZR5*Ig+gHz_AV>;P{vc(!UQ9&_Q3=au)&?)cgPS1dqwj2_y!rnTLml zo*!*0N(JDO(7{lN_Yl|4ufRkkrK?MdOraA8>Z;S=XTNb+;j$>JEJdLjLrT<7LSkdN zSr>Fz+L`zEGGhLa%EWc)*8G&t^z|33Vbdw zXb%Y1VBJx60Xat?XbduMzt8(_8|wrf97g)@!i*QGzH8cafj4?J{zqCn3p&!~J&y{o zw!8qOvO{WS?;fpQ8oc-YLeE&c4)Fj?W6v+0`#(H8CGa_y#pQJhEO!$P)kl6<>h9m# zy+H>(nd{M?=trEG6MN^ynKZ1Q|pKx^90NO!uf+)Fa< zDQ%TGTbs`l>7yNVx|cNZ0N8S!W#PK^M2JnF37VCTml7}<-fFARx2II%l*Z{c1Xd6P z#r|(9emytzVA3K^8_8gF3yC&b)1DO~eQLHoDd@B@c-wBu+U5Kl*`ZnLpTVvp1_z-QF}+}=W-<}&E!jOeESluN#I0%aj#FV$rf z-^A(rk}JbP29+}T9NVXX7fX`V>y)IrA$}z+a2zqymq>6Xlle1U|1+%1{is`$#8cO2 zChHX!={$1SXHmz`d}1igTyQp=k3Z|^YfVg49_H^D?J;zQ!Fxs>X3wyzhn0g-ii|Jx zGA!3@x^*Uvd{*b`YHv0wp(%9@}ntZf39n!YEK97*O#LKdOd|Kl3>nN-AmaEKGZ zezqLHF)a91a#}CEBa9a4^cO~VaBB_DFedlb+Ggs1w|^X5Qsy z)i;U%%drn99{-s7aL3;7EwI2aXl#6vjFeP@D9-cE;cVN!s&$uZUhRaSqVS~G+sk%PCd+gd|l>&8_Zc|&&R{U+hfx<;Mu`^F7v<82fpwBk2O;wWwo?_MUX`jg=gbFM&YwXIegI4Zoafs zWbsMsWcJ=zaji99*^3^$^WbIlg8>f6c3zBWk&K;6<8mAmKJ?{HJvaIC zYsdEe#B&PZo2EzkKbFpFKvro}17+6gk=@Mr)rNylwEiNYv$(Bs8Yh7hr7sl1U!XUv^IEk(wt;b?gw zHSbGU=iQ3_y%!;j$M(gPO~hBWkH|(Qo5kp&>gRhgFQM_Z4v5|U{ly1i`!BTRfyQyrD=+mX>C zs}neU@mH5{A7S%7-0w+eRC_<0dW|2=KZ>;2 zklFvfS9!UczgSPXy@6&Ccd+Zjih$XPOaBhoJ+h+du{!*K7X}blR#O;1uaeQy=1^W$ z7}_v)93_~E4I5~W#>LX}{%DT$4(63qka~Hv;_=1=G4qS25j`U(hs%7Y#j@Zx*Umse zd+V=roFYW2@xmjlc0ZWD1%iNkVc!@H_RjljuE=mSmQJ#gQ#422LSy!#0t{I!i#_hl zth%er1{4J?(MT9u;wH0kf&0slW81u>3`EbnQtNA+4Z^k3y0Fs%O>xA;Ln6K-eT&ptR4oivpPvfO^R;e|!pZwlzz!zyQ-4IM5viF9}J$+>` z4{=(q>++%7_&SZXJU9|hWsdO4O(r9eHymC*`f7cjHoP$yD~B^2P;gPTe*cBX0=L9n z0pH&HR@~J*dLLF)IgNwq<}S1E{WSd}!~UM#UK76Kw{MgeLCTvaGwP_}rQ_}A*VCqb z=U+lPTXq>cL32`k>5^s>?$cQ4M#4PFj?=wg`#X->V~sQ8#ksJGITi;Vo7w9Oy&hf6 zs4)>4$$l#I<+^f!2bu^2oF%cc0b&4l4{9DM8f>b7Rr0c63>MYg@X z$>`}#=k0@Jt+|c zbetpuPH9^|H)q5Px03s}9vnJT zvjLxZ(MV{_Y0Y*QJt6)bk&@ggbUAZ#&$5IQQEYq=5uh;kz4eO{gK?zqAoc~42QPS| z=!Hx_q%?QOuQ2agLwkotmwnGyXDVz+7P0fLf(sL|N{?zo+Kw^9(Y%W+bv9^{&*IoS zQ-=5D#-o-iql+*21Na%sKNMswW*k49B0iu9V$Bb(YQH9PYGq)jsg9;YV>0nK=BP#^ zjJ#>sfF@TFWZ7E!H*HzL7?UmWw{&yJ4jJU=N{MLLZ$PjgoiXMC-e|Gq{rEtr{AGlI z9WC5$x3d!^xW!Kdee`20iwStpl6~W9Vr8%ElAJhxd)eNd>>d*vJE#VFW-clOd4(b%n{SSE2R06Q6Cq7yI_d zveoQwqX-%uQxht*(W?4hA6dN;Sl7B|NwAHt1i^hgS(eDci|99O_U>x)LMBR+G}}U+ zlWtk8e@sM(lSxJfsg9J~lZBdoA?u3K&ZwB3cnN7?t41$ zump{6xXJGvL$v+q4C?GuVkxvPUyFykW4G6z!M*tU;k1-S*L4i08HQ3R2|<>b$ee5d zHPd5&NLW36`{9cs@oebL^TQQY@Ff)vPdt2BUq$u7cEK*`>)Jtnz{??MkUUwyn;!Sl-mQeH9UA>Qcr8n9;~4s@j1Vo0m_4a@gXWL$1$Gg|l~;$6WWi10#B z+NmPdtIWSaZmP&q9N5>A{O-eUj5!@4;4w0GZk0|BScBwlEB)QF6eFR*dfTwLm5{@k zFR0L(_hxRRZ}G(1gY;f_yx+rSc@b(yDM>KCVZdYO$7J(w*iK-YCo(bL4(fQIi_I8K zF&Ax^f;a1#t>#SVqRueJ+xL3NuL{?(=qEZe6WW}@V#FKNSTop=PNOnx4ZBA-2cMw0 zKjHEO5F=!kN9{V8U7&{^ugO>_5DNpoeLs8kchR3Oj$M$ukt{k?ZnI^bI=T61OOe4I zSfHSsx(WSmly0|Exv=wP>@jA2a&}p4J$#Uw*N1EX5pNJn{v934*oZg@1ecT??t9@(jddB;u)8e+l*o3MwT~8mlfW? zbM+QYWd>kG|GaN|_cn3%xuxLFlP2N$CtO9`44GqiY8H$;@BDa_46h%jKk zVWnt~)&+P3H}roZL@sFiNEAk_nQmi$h*uK{Y_v8$-2Ku+&vAZnikt|$d+BQf>#_NM zi+71&>DLCQ{`Z1>QVZLA_+;KWB#1_i^E<}HL}k8=f?hKYJj1bzW(p4P3;SSk@6`Gg zTo1~Wfzi&{!9Ok#ZgWjCsTi0f?&d4ByBPfhB`W-BBDde84@sj5T=IM{>l`XVYw>D- z_!bt;6?x^>9yz05voyGD?K95* zVuCy(@LIb>E?&MWudeqVS(;1%^+Ek66a^wUi^^@*u%EDGSMs7e?@hm-eU3Ji_)wCq z*gFyrml3MhKblSJ(a@z1-q*>1`*ZM6*5&w4Gd^+h{L271!t{6waj|EmR?0b-|HhOg zKI@<3bs*mJ2w%BcI{wCB9wx98{RmgE!*Z#;vD^P__L?QPPe70+eqv7RA&5<4KZ@?l zc=<@cW2K5(__;rx6=|))$^bhRn*r7)$OWXV zO3A6*=IC_jvL`Vdn$K}5PGXBp@GM*cHe7DEM7H!mY0M6AM(uK6?SpCTKI}%0$W>^Q zNCK=@4|t5q8c8_Q`#lzfyYGGIzB@U)%ubm;>MjhkO&KV?AXIXO6LE#uQDUPCtJcR^ z0|!)iX8+zrF)v*pqRql>ZNM;iD+|n$p8dt=D$eN&^)7Rp_d5Yu+3JFs0Ej=}s=uw1 zkbWnsYHI#80!aQ9=bc3XIMM9L)2#`gUb*Qi$CcxRyBOl9dUCFW^HT&6kQK6#1I3hV z0C0CZcoL`BJNl*0#S3z3W&6QVk$APIh7{mLJ4-?Jcv~blfOv*Wa(d0qs35U2D*0(e zd1Qo_6V);TKx_|Zem7Ua;R6z~xR>Z(O7Dul<82D>Bv$5PR2k9lS>_zF`ECd~ zU=w}1dc-GZa-^?>gaHM|#mbmEx=-s-&7N~e%+=^Wx(Guw2<}B?&o<=Ak{^&Bh%pg2 z`YISX&}JA+Z59#N*XvSBOb|(XZiKrNJHXnBkYXR%w1i51dw0OzB#L*f1**B&YyZY7 z=0iKZjR(`i8JG#1=@aS7|PH13hVVezKlXbEHGCfK@Z*=>`VM$j+ikx$x7++ z48qZ!h}7mhV^u{=&*xf2)X*U|5791P`SB{$hseP;@3=Us6oI20u(y|eLVdK&CW>qE z>YB!MeeNKURUPdoSxSS10ynghJxaWGQ75Oa-Lu{?`Nvm6IvIKqn1^JRKajm>euKr$ z;9#lAi#t~*g!s{UHPB_8a%OBmCF1lwcv~(x?Ra~V56mXW9CSyNo|f>3gnz)X=nbLzcF^jGefYUN zn}M_mO;k%eSx{(0wY@{|aiKfWRTtRZQX}i;V*Nbpqxzb+1+M9+SYEDG^y#ye$b|QP zsL?1+CmA`V0dV_=dkoqZa2er_@D*j%(f5avlvfwwT;qy>!2b63_P{s2{g+o0fNj#z z(rnUihL7y@(u?&&(0#M{wH&baa&#!rP3cW+2DopnWfAQAatS8G0Tb`jz2Rl(xCj8u z;0?Sv^5A2liJ(AV-kusQ9CV48Smvi(Won~vGF!yx6dFvitwPN`3%nBhwf-2>%HPq5 z$-zntOJ+am)DQ5W#brrTF6;#88bzv0i;JXwiUk?vb7pTuL{gB;vgAM%$Cs2t$oZt$ zzghR`B_jnZN6C~})_44J^#x(*NaOV3RcM6s7XG}CgfLP)v5=-OlknQZ#?Y)+DIT4~ z99QY^_*Tt(MSmx^EMWHVd8gVIcA-7A+7 zKE_-Y=se_Pk5dvsXbQLO_^ZHjs^)+i;vEa*WRJQ5Nn&5g@}8bWeB{kdY@Jqpze>bx z6f~`I$c_2<`>k*pIO`?^tjw1yO`Bzkurw;)?d-|Gy(d|6Sc!HVOCqU?5|pF+7u!mP zzqXj4BK@1j{7z=?mYg9C-(B6V`0k2H4CYvhH8W*_l_jfIy z2kYg6OMbDXVevOH%SV@K*UlK`Ku@<_sh^tBvxKo1I{?>3GtciPRr75G`5_Q;pq!`d z@(T#DL(YaAtUm4p!2LNni54%f@6NA8k)-=1=+wew4)Kijqm?>SBbM-{l5`4dq~WCK z64PonRYg?0rM91%yy^JH1Ar+uQy8urXam`VMz#X_^5P9BZCTpPWAr`C=n+_nTALAT zS0@jW=&AMb!W)MNEsx$z;^eW=DF#-lPGpJ^C*meCnv3qqNUc-3jL9T=T$?GEV|r)A zbvPRg+5-T`<{I`^!KQ)qi)&6zX#7Q`4&JmXla|`--gq2GVFQ%4*tkh;qoTU1tT|ztEWHe1f>uX^dt0t@u&*zX z=0X{2*F0wuCQ*XoV)Y%o?Hum>#XM@{oF~&UDn$CO_5>xzVfdr38V1QUwcKFi?4E;T z@i7e42$F9^%OPs17)w$4kec@-qw6mspVWPQ14U9?Rm}P$-RlwvItxLoq651{N6G;x zX3yH}+E$+tKKq$8=7gKd9~h$2t89!`gB^hQ(Hpyj8do*ofPUCF)ib1~%OakxvZ<|i zmz-Fdb=o#XBg#&G-7*m>P4K+42WPhN&=Y~an2Ioz+L~QODJId$xC5wXeBH_Gw6k20SOC!0XL zih+;fpX3%A3?E!`EUe6hU9#YpX7(8Fh0Tsp`@*$2s=eWQ7UdGTdkw}uzmoanikB-l z7_S+Ge`831cbYQ{9561s;k~e4wNx&+j>a7FJYX`n6RU4+20t&+mH{hD1+m}wA~sx8 zYo-1hD}w0ENTTALDzzQiS@YM&oN-Ov6E%~i`0x9k-wS4Wl=0rBDKPXft@ zn*+GIoi_*KpVXQFQ>vLhhF0J6UIkuK)SBt5tLvse)rXTI#0&#?`{~)(pV7}y;pr?* zBYo1Ggmtqz9dnSjFA}5-yj*7Ybxj5gCF3*RF9D{?5>vUj=ZDIFd(=ejud^o`6^yIl zG}8m9URZqI5)|GpOTh`?i8?!{zLO(v%yZt94e_Z9tWk4gx zQ-#ZCLCvD2UI-A_xoJg{5w$`7Tx}USTq5rO*aIY5!_jlni;z526F_Rs>_;^jd zZq`BATts?z+Y4>oEIQ9Dyn`)`i*}%)90EoUsjzorrgCBOB8SX55J*08$hj`YsQtzZ zucZ$2(lB=?*I-oro)kq}sA++zs~&hgt+k#-^6iK%URzWiT=K4GatFCDfBcD!dvU5f z;o088Q%{*F5!}T2IqCM#1!0Lpl`=>uor;FIs%mLb1v3lgH$7FK;%CA%dcN`MwYTx* zKt)EDm}XjzUpqWlPr}=39viv%@K#dRnpHMMYHE9Y4S|m**m6@cDPbwPI34RNt7?tMAn+Wg|q%ApiR=Edb^O{`i(4I@Zs z;Nk--zvK*j&`gRHBVEn#6_ZxYn0HUZ-FsGT+1+Xp*t$gGY}g(F3mJ)7SX-BY`|vZ! zJvRd8DRyRw?TO7+1}u_fD^vP!>DfIz*gb=JKV#lTPU6CWsdyBc^ICk#ctqPj$AGT5 zCPvrmlN%zeOZ&Ln<5SW$Due?)lQ7DXB)NWr$=HS`lRhaBEZf3S^Y*5e1=>Hs$xOj$ z!5}>s0mxDJic#&0;SuG|4%&jp@W2jx;Gl zGOv3Bvi7_OHfi*!h0N(e_@i_b>yp}U9tGLrO}fh!b7Ug}P;cBYkr5RbJ$PGd4y5u7 ze!-(R(u0u$d%TVedS_-nKD4Wi2MToVU6dU<6=9KkY6Nc=JXPsjKHCFD5j6}^QDET8 zEvWt}Wwk}KA7#Pt;VBJwV)f!}S|!}t{7lCIqkYSB z@$~M6s{4}juLx(;ff`=s>oM16O;0Y$lXTh+)==LgzQ^iuM)Tq6t3?p{uhK%D2fFcO zO-wA|9+&p5+XT{L&f~b#O_f<6(sUK1(g-`Qv9(i%jsSC_H@Fwh^$F0sIGV?eHuaHd z44)Eal9uU|bu!jfcbf6_-&bFTaDDuF9X$n)3R-@b)4ol(*W=`Q+-HYYqoipsK^lW$+5nlr&gpx>V4(c-!7DLZ|0_-JKnX- zT&WpGVH>r`UCBu*q#7Er42=dinq!bm1Qsq%MU+EKOPWLf={Vod=>MH8ZRMm_+Fo(y zckW*MT#F)63TD$fpl@ZGYpzL1%SH%T&d@;_2y4%N(N>L`;Djw|2>jzE2k+9L{!>~C z>@x39HRodVT@1ZnQQEr>C&*B+tp&} zo%KJNvo3y>JvPG<{q2SS&KLC8)kcOzf$D#y*!kz@p7B>tuFu0N0r*|k)Ze_G0_?p$ zYgrCi?^eC@gWK6(2{f@!^QVpHkX&^$b( z6q)Qy5yM;qw9eWMT1FnL<N{fo`M?cJip}ZmU=_iRu4#K;Co%tRU5a%~o*#P} zbSQ^K%1h@@{A*!~AksSzeK1-E8h#=T2oF?t+P-lA(cNEywn@}i7ZcC)#j(JOpi|Fw z+9&se%N(}Uuj~5@FR4_vXr?}e4YgEe3Tvm#gc6nT7#H9xdzS==Ka3KCOlr z@l4mtmUH45P=qpfPScO`f!u}}P>j~Pe)+hVt}Lqy`&47~ao*Wa6vTBb12dhY{*F!4 z9PK?S&sxZZ2P`j+TH~Q)b?)1lIX6u!zhNg?1feXa%@*>t7Yr_|RgZ%5?3-z^!wOrb zWD;%^Q>OK)bcwq)P8d2nlZo*Y8z*+4iJM`q6e}|}Wy+_kmQl^X!UlYMr}|%yUwGdD zo!Lz>FyMhWFiB;372nP*ORCawMT@CJnk;_?^H z%Cwayh*ipxc4Q2WR=;!^O2!36>9skYL%SyE)>?i2)nNe@;8AI;!5K%zVZ4 z!oWfVVcqlleIJ(2)tMhnVVA!U=?c}d4U)-{*fM_gtd68*jj^nI`NjQeyKRQIpjzpnf0EeYyE{!>u?P zQ(Z|LuyOW+2z?74RRkvg4rT&6unT@j&B(Q-ed2h_Lb!TfFm7sTaBB#;4k6Xi{2g*L zWanG&As9RDhTmKfFTT_h)pV!2-pbCgZ90OKyT5x=O_%K!gs8Q6ylskjei%KcFac-` z@|z0lNQ8WzYL!x2nQVR(J8oTWHlsCX$e~E_8z@k{2dydw#Ak|gGt;1~yzCln`>l@X zH3cNBB1S;I?5=WS3JliA-$%KvrU(p4Bb}MJj5*p4>4AC=O%bZ}nv?N|74@D*$j!RF zFd}gt#vZ%)8YbC|Wu#B08dsc*4}G$YNk7MI6CQ7+9kx1a=FgZt<=9l|cBNvfbEM|HRoKuqS=#`tZ8F^OlUtWBH*PO< zLN?S5yAE}ZToly1enqP)%xveRdJHQzxILfnx*G>FFl_Yd?I=nyqM#%daA#ospsl9wN=i==S zH5hWm0j!@JCUu&jA|9qy#DegFn{_4SP_b?(AH2?Ibn^dri(sg}0az}A55{SEWdzTR z$GNjZo8TOF|3T#op?a0oI!yjtU_Y|4|BMy${V`_LeVANno8!{nldT_*9k5~Fk1S|@Kx=qy-z!}ogHtIHF*Ctn$PS2)ki)TzghPhv0Orr761oN-)a0t_mYPBpj?uwDkMTOC_Zb%j`S^+u%Q<~u@kgfYNQ>GS30NflL%P_7hnM!tni-F#D|e)Hh{i(rJG zapiJ73+`!2;+YfEn(SP6HYTC(rv*UF$kEZqb*yQh+iJe0PQ<6A>G1P|6>UJI{o+<|1>XUo2pr4v=Wk5*DXU2=U@!>h-<}IGvdd@2vSlTrr*2L(Ww-fT) zikgsU+e6h?JX%6+`j}d@a|X~@Vw-~-+l9cHNN8_cc4=ltz4qdT36Lf*7x8m*Q?V(M z?E;e(UbXvGu*P>A>0fn=0qP&oJ{^+1D?J?EzF9Y|)I%f1qpA{C1iAa@Nkv%6W-Bm> zXviDT$YoW8E*(+Zc4Yqe2qXOap}DVu<4GfmXr!Y*?Onh&p4gY89jQDc*29MKR{=~L?MeNV(2lEM_bR{@$aWyWu7zmdrG&{H53Inh! zM5=@86YQRZ&@D8+n{dxs@zY0oJ6*!+;qCREc@b=o{R0?-BtL4DXH$!`R;O}w(II#hQN((PX&~A(;-V7OPWb|3X-Ye$= zZt2WPv^^}ZW-Q0vhD^aJAZQ~Qk0D(-ts{eiCskvDV`S7FibFkU(FcCMRvs`FTYb*N z!w4h=)@LsyY)FKL%e-C{OYC8mzqkH;UfgK*y2yWx^|~v%S@Xaw{^}d}>jd2(Ki>|M zvBr-MGliqBdbc!-HbY-adqvS1_%&g|2bTL%GYQ?`4@wdE#@Mo}^+x=h?<+Y9YrWs) zGX~g>=sWYtldbPZJE+%$R7aN(o@}Plw{1u!52MLWdH)cM^J6_~$_8$pszky2h;v~~ zM2{T~_c${0S^;{7if?#VzR^#HJs5k(!;7C@iGs$6TQfPlejgugePfXu-!i%ZAm-=+GpxDojfJmR-31vt+Ds*3 z8EdE!-IUj`UcWo#ic6|;TPU_{yX@KbI@Xmxm{+|$Q*~Ws)zS$r4>3yhgU~sn+_)`8 zB-Pk|G+$D?a$SwIM@|V``$U7Ic(Eso$;}Oji{NrsSP(NL8tAO zppV&rY|67Kodce$qSVj&A;NjmZXHWwbV}5SA>6?~@38OaZfmk>0KwUH69iJse*~~7 zBcZCW^Wo!Dm3-mCBKc7)GZSEa2*m^WTZ*G<(!R73SY+IS`MLKKZ~>bv-}Btn0%&}| za>LDT zWfukG`M$T8X{?$ypeB3MjedYsLbDiRqaMXN8`sL`jJlc;C*#E z@z6b^K$%U9Hnm+StO~eVf#H#KcLT;hea+6mHK!6`D%!f*(PD!Y{v9C}rlz4>^1y@j z&sqS6^Tl&_-XB>jZLW|34Chbj)xXANenScKMC@f^OJ(u|014 z#c_3pS&ZV$6`{#S>y)A5y&TZ(L_)C@K8~2cE7L8j$%d8&vso4L3aV3fg3ws>0&QCt zkJ>sjOEP=^`}%YbW>ZderM>w{Q+|QMf|gbn2Z~vp_o`dyJz2V$_61(QsnZR`6muR# z-K^3^1nKNR@Z5Mx#>!Bdb*auX#@r>p2PPNjaJRtIF4bQNFw=P3ctkS=n zigMs=R@;I&ljL%x!@I7NT^j+Bu4!r8z~4r(3%-eG=(h>ZXx!toZOmYaAAGuV+O##l zJEz_BD?#O_%4bj>6MJv?4`P8yLPmYDgJ^=S-W|PHTOaFFUi}d?*&8TWr{v}3dV`c z)h!k2lo>c55yeW?m36h*M1>+Wy!}T{LUL(=>7OinBcdtHNt^4b=4%Rx-EQdllb?q6 zXy?Km8J;m8_d8I8>HI^N_NVc+Y3y>58X6K6e)OJXqExDtSlmafzR-M(aXa|^5s843 z?CTfjHBqNBGwt`8Bap%UIX35I7Vh41==7MaTZ7xIv$0`65EN)XkrU?7$U*N%MW|5b z#2myap1j+3cn4x~w1$(D75#Ydy974&Jr>W$($G*njnLp2Lz=RO!zJh_Ma8VPEe&XM z#VtN3LjS`vp#wNWbiZzo+ubagYy+x*!`0~8^FGxq=Q(UR!&WE5cA#w7Odjozp^LBM zhlAUUh;!K%dW03qv?`jsT>^Y!lWW>?lWBgOxE8n-si2>eTAR-t zAOgxw1Al*Dn7Fc|5i%moSk2F>dxk$gr&&QAxw9t+(G9|3>*>bOdt)x`pL!Z!`4sS^ zY-bD6$F}_4;t_DEm7G++(Sy~c1}fxiI48SSB`S2v`&dY*Gb?9?MIPx@KSZ3=lKmEX zy{B^zm?ewG9muXjv&Gf?H`mj8ZXvRU?Dl7U(_2+G`cU_=kXJFaCG?Trflo21p$KC$ zf?J8~Q#N%%+3l%B0%!WnHiPp4V7@AS1Zla1`mJbGAff2Qm&eC0e~U zuizr>g=`O=8@KsIIU!}FhrO_hk`dZQDk_sh`_}k=MS}PaY1+dnSBC1bZ4*XX@5k)h zI=TGNWHPS3AIQkYL+aW}CZ^U&|&4@-3NoK$jiu?uhqfq=_6E zzOC7mDYb=?^@iC}Mqn`zlY1t4mDSpgHQdgVwb}-tq1m@;(Y9bi{*6nbtO0&#BVaXsqfzX1AVDIH43)?8{UjXW;=%3alFVfA7cTUo z1|VHE&tedi3#H!M8huLkDI(A0y8r{s?7rvwuKP|NU1HG+H*jqo-VvdtFGmijr_ZFd zgh&OMaB@=S>9M@}c?HR1pAM52^AxOJHX6ID{Z6KaB5doxj&({DZHP7iyQa$=s} zoF*{pIe{v8HsrN)Z{*81)i&B~__dYs?N+#pG6}e21k<`_TLZJu(>|?b@e4y}P-v71 zS>)fO#If1(i|aZgDLN1?^Lta(xjp#DAH6G;Cd_htxDb6x4`hq$1m-7G*k??HSF&a| z8K#rX;SQubFYd(jXmT@?*+_GHruqUP%0T3QV848<0QH1Mor8`Re$++^atNXK=$L^{ zWQ+-{I(pm54UX$fyNE)FXZ3}1W9YrpKE=wi8^a~VYHP2{gv3~w+xa;SoH~MoI1_oM z>r2??6n^Wq?i6SWGf&}EPJIH&$y_^BoH1sxs9!j*%BiW4x2-*;9^CG3X(te~t6nQu zis(XJ0ItG|%~UOam@Qdoh}`PvHpDcE?(gH~-XWK!GztD3i`lKVaK)6CWM;_+dNo8Q z<|0gW#^)zw%w75N%qq9h+}@5{%iD=h!7jKWOu@yk)ti>PCQU;0v_E`)9nyS`bXGK9 zTF$fEPwWoDd#<7rc?E=#s;}=2-N@JHw_bgv7!C;#&cXsSi2!>xjmiUYSi#F`|VuTMj0z`;Jqwfmw{3>CwA}ok%`Lof1dMXlYg$e z`+6X*I;--V<&y&~R%qa%)0T+nN0T5WAd}Dy`U^wPAy&gv-duML(>S-jYM1YG&Si^9 z4+4-4BB*zB;PX-@(wcA|Q^{iA>DQ2EwAhLQX97yBImf5Qq$X^-dfO`;=jVWyZ^F-Mg*-I?)}mfW5ZW! zOS34|SqtrkR9P#|u&?56O6bqa=<1R}9ELH5*2@#Lr;9qK#xX;Ea7)I=j<#mnJIH>o z&IYeUeM*sqMKmm9(VE&4BjM>x*%%s53u7TA?IL!a)7B~b9`)tv#j17lZHX@@ytGxc zA#f;$QBI=Cdb6Wk#QAp{SDyW0#B+#z_7!QI{6ov$Z(?)!P) z^_}16$604q7Aw=Md-v|zRaaGARnyy~SHttcx9MXPQ0tO%ud1!2d0(be=H%J$W}_2p zvr)?h3wXtqa{0ZN5W>7+dc*ioerKLz`}^~0JE;E&`C3Y8ZA4nwj)AG4&(=Xq0gZp# zfkR=5*ZM{c{zgw;iNl&2CN>l~7fjRKhd?x54AV%7z@}RJ{Ts=?_31)7gHJc-Ozc|I z!nUh#sc=tAQ~74C)6Xndfq`Pb!c#q6P*M?+l7HJi6MvIhyF9UyU>R|9Rt;A(oHn$v z*6t!Y(>JJhB=t$fFbG^`x|*YbEorY;ggF@_F{r<+FZ*EcdplMsLAZfc(KjtS-tsNh zN08?VZT=bKoT}9>i{HJUNNZ_!QI zIzxyxOdN@Ti#V6jki!Dj58WQ+KLpA-JjBzq?+}sdzEm6Y?0YM{cdo-GGc=xYQscrx z;`eL~`T%iPN5C3;l0n9wi>;%Qv|S?Hxhwn|^`{|6W*=HXjDaeFXvfY)e{%UV+Bjr- zX_{YK2_)0dMEui7=)Wu#U^ z>8ih}wpTw&v-Vvj54O<|U@5Q)@5=+sZl)|e-&_!yn(+wz+F63rptl*kbY7!k;G3`# z=j@!{hT}M@n4_P^@A!7XS)~I+HV^>#!zvbxD^$! z(>HAr@YWXYOzi%0?Hbm5*Ap{CUgGhok6Nr#9yzqnZiupLyzc}%%eIKR9_ImyNEw6m*3hQ(UYDV!>cmDXuYF|P~ zuL!8nCev{(yqUMkD z4p1B=nrqkao}qtSNA?*D@spf#_@bu0KTsHh}06pe819JN&?p|nGrdz@SG#b6w1+w~yR zc*$%>d2i*r%Gkh`_u?P zG^@(E+hn{|C@QQHc#hvC?cLY?nXTCS#n1tdeY~2VNQ>0~CHGnhrzTI?2W{j1w_v5~ zdAjjaK>Gm#Z1f`FEpj5^A;1J6);@WHXpCg-*H(ykGYQi)$E z|8g?sL%=*EF&VJ2x;B^Y7Ph4%o;lz64Q1mn@bb8x(8k`DpCNIw{4ce%A*&m7O2^&5 zRM^^fBw+qrA&JP;^t3N<)s zcAaY0&k{yZEaAL)qT#EvR$Decg~}N@ksu zW*$gEhiC7^!2fN$CZf@LoKPozcwpUxm6_>0Ut9NZ^K78InygzBJx_uoaI%|gCdZhn1tEjU$#KZf4&@yE|) z$+3OzXblG_9b#L%_NfO5CiBwb(>61@9WlRTUZyCoxH6i;m~zal@ME;iZKM(@u@}`P z_)JY+l~6(+1Go78Vnrka9J@TE+_wzRT9q3v?-Y}HkKEN;TiE!ImWPrVa)UAgACqA0 zhwD8qf$*Z^KKXWJ#T1Xar2IG~lhh=SEQ0jq(@mPiqx6EQy{(p~-$oRqGK}gS32W3o ze;o-L;kzrcq{Qj(f2xmoSO=2ctc@LR%6uyL_RyXFLr2I$TFL}3P>17qMA=NGbdJtn zu4J-7PxS8b5vz)W_0!}P!&Cb#0snuBqussbD+Q?-v@8n@16juvFr<}W^4_7pcW$>vwra6gjOQ9iWIxz0$mup2O)jsix~0$i*c;L7=Nws8tnp*Do2a$18mZ ztvDrg+X%74HuzpH^)0&j~1XZ1#5N;xV(KdKI;489WX@7Fk-XR?Ddyj*`5;CdGMu-eX0sDFcZgW2qc!0ghW(y;pZ;ilE= z1g&$Kvgc_C#j*&vmJgN!y!T31+I+bkPbj(8H!-Bz+QZ0WsMg*pRDJ(>s)KLpZ9KJ~ zh(4#G-M7i2EOK?ys|&6xGAdFFhuY`-H(@9R@>>a020}9m9Nadv8*2pJvLZhPjN3bz z?!uQJQ6pbYlrXCwagUC^>o5(ey7t!>te!p^_UY=#zlZi93Gu%Hio9VsE>x>CIz!|bmnT+f0N<*TXBc5q)X_0? zxbru1a;-2Y2hB}cAV-_SbYiamGHM{EeEu z0Ge3thuR8c+1Xsn>v(H9jRVe)3xZy!XB?{Xdj!p6 z@ceGaLk=C(%E#-ka!sWM-v1r?Zs}t2=Y%n}P6l4pXF}S7Z7tX0)A}EYp&Tj|th!@* z6wf|&6bbIw<%QG4-Gt-aW~S0>tgla}?k){>J#?=XxCl;E#Z_66u`*W=KlQR7U-%v$ z_GM(R?IFgKnyKcFz0U@kUvt!~d|sHjbYvOLv(0J{w|%5C-#ww9IA~kfUU^b~6~Xe)M_(!W5Rid=cr>9cJH;?6~e_?!BSNL*Z7t0Plk0 z7!AL>tn-C^Hl%ugVMj%Z+S1?VOk#KbaD6|}jQOwfHHFZ1$s+eN$-Nka$+ye2I^PTy z&~$4b@GkEDD+rB8=N`n7gg1!8tGJ;E6W6|!A1vn!gsq!Q=)*}cZ#$*Pd% zQ1H$>GV{RS<`C%Qcx&R7fZPFzY4ijTK9^yW}S{n`+A;7_%JJ^uSO-G~hT?<>;hhA@D1} z-9y~ecyHThSC?-tH#xN5u!MXyrL^95*UGr}o8Jnb=KioKU0>wBm>vt}?Cx03NsFRhT>MH{$)PXRJO>F<4$lv%{eADL+%3%9D^-jaWsAttW1{waDuAA3=!O zn>?OnP6xj8VqZ0MeyZe6e)1x-3YnVJYWBp5m{?_}#X5O=FvEeQlVt5Qq=4}%lKj{2 zy91zg4mWsRd?2OXT>KOi3&zygx|&{zzo{pp+7!p= z9W7t$63|XtI9%;&;CPnmz!6q74N~<;>gzkJhnj}mkW529IA1>MvI}c@8J0VXL5D}> za24`|#Pe~dT15f3GO2}D`>a#(pT@WEH*yZ;z-GZ>Lf*;0cKq635vo^5#64WLHYVjR zvi&!A|2TRdZCGpxLwQFs9K>coMjr2Rv@owVjb!;o*az2lnaL+%FCh3WgjB`$qiH9X zJEoO_ST_fw(|(=S_mQ;kpN+45pmFv&jMtQrWwiQddxdP+Rdi@I-U1K5z7;`svD8@P zW3Z9}v?1RMS|GaSj-QUHvsLzp%poi3e0XxZVG_~)SZ@WagWr2_FN$3+twd>VQKcMpE;11 z%dqBVkotCcNxy=TC7E>L$+O18hY`)9$9jJ1NEuS9> z2fxiCfry?XuK~M9rDezGTbcMX`>Dxugs;t=&V5%*%ObA#@Kmr?K}cLJQ*p+oI>>Ny z6qs>*0UZMs}u^9#j8=p8xw&}fTx^xcyZL+n(){%zr zWWp-Pe>riz+|&Ndr+Z6QbOtOnnQJxKDYEWAsr*7T{Mp>B7T+8t=?y@9)CD5@iv_r* z$I{MtD2~Xo4U@HP3}Hrq+v&Pdp$J;qMODi+pn1=!R-MYq)pD>5URq^53~)O=|6^Avh~qhI!0OqqFFf5ql!Jq?gY#tsEe^fxoE z{nxmXKs7W@Wbh!`Cl!J^tz(c`WE#t(w3R&S#Y7o}6*h1bI?^e=%uXImRGGsa7-afB zprhw{EuwUs{FhF1%oqYqkb?Bt{$2LM?RPSTtCO@CLTiKNn8XO)3y)}d7moQ{SDj#f z;_RqAK0ck(umzGud75B11>^nrA$PMC;X>pChZiLD#+D{4J^GhpnJeC9flgPl=N&M? zy{WEnQfB#%+NbyU_OqnOoi!gDlj!v$2>au#Mtltl_Lrk^X|+L0x@u@M$r2m4eIP}N zVCMe7T0!y-!>IbD4B55=MpE4~riST(BZ1t3-L2KDtp%~#z^Y@T6aL+HK4LbAb5qny zAr$q``UM@R**}*U)O+$)8@x5mEYX4e!T}u;qW@=GzvUK(`lQ86#oH?k2*m8%#y4SX zV!+8m5PdAnMyDxCib8^TD=*XgDG7s)%(wfUJd(l%P=0!4{rO=MD=azq^eM1~R(T42 zqK--k6XHlvd2%mkQU`!%<|MaugN5*kEB@vODPFS0+?&Pbbsv$H)f$cRHIm($DA zh?7X=rW=Ull)U>QnWfAtnq0JOVitZrEe9A`l69?3hVj6(44AOy+RhXqVOp8D+9C@);!$yRdIuPBF$yCpkqu2YPFxFoq-zZX>t7Wlaf@ zz#wsAKZ+FVtmRa>l(iyhfo3Lkml-XU<|v^v!dTdok1xGlC3mj0RvGAb3_A^@1m>e% zE~yN7jgy~ra=`5l!hwpSORS_|E&{%+m8AjE{B3tm?z3U`5oQS_HK|>5^%kX{aIcgULy4#^RXn3Cr}Z=n z`>|7PzxGxfn-pL3rjP^M1O9O_k5z*HXA)J8rLr=J4u`(-} z5hqO5obSzG4>Kz)V6fX@Bz$4cz@t0?n#_O^J9<5Q=(bhns_{TAZ*P~Rc^&RpY$h^; z5fmGf6As&DU@qyx@n!UA-A`DE#eQ)`{nHE3#RTdN9};o@v_M+qo-}RgRGj(N z;eE*$XS)91?$Pr=A#oP=ag9%cnCrM?M?gzIX4&zQp@qGN`1ey1?=TUC{pEyQjYI;V z?fnUM+IrFFeeG7RBUty~!`54a>RscK=~rINOWn}q%bUoueM~;L%w&v4RG`zs4J2r3 zrqEF{==PnuIyk&uJ{X;$!d}r_Rf2~+dvnh(Y+|Z+el4s#!j`Fj?XwtpFo@T4|H+}o z=F{=8f$}1=a55%3w9Q>1^^6#I4Y3u5;M9 zx2wgTH0esgfsyUqvE*8nH+Toj(wCffh8mteh`>hXF>dT!T<Mg@U;@q98CJsV}sJtTXC%p_U&wy-#>h$8U zWv=N+G1`r-sa3$KghI$OS~JUujb=ZISM&aeshMl~Por(P zHBpg+-WQ5zx2c#S?xB9#_m8b906+hymzK(D-;?KVYq(r>J?-Gwti7Xrn~7zec7BT) zM{GrJYao2@2q=?~X#n~pK7=2~>vl)&*&M%O6Nl}zyL`ZR(Ux{xQx{Gob^k4JcVmZ4 zc%UFjsGTV_qy=cEYp9WI<0s51uZ9|N*{z>@kw5P6@PsLH^XW~>yaw+sl}ya9x4q`W z{~H-z{Wtns%$8JgdhQ-{w(Z(*W;Z@wqoq^xi_-Mf(d&(ubEg9?k*QBgCvknLL_(^! zURTv5TB=%UTa|+Q+h2FOc!rgGzY-KL+ePwz1*#(5ID%LvU{??%FdW2wp2QH!z(qmmxqaTN|p znklhEGoHAvPBX0c8&)vA29awKpK33A~Z*Qpx1JatEP3GB3WyD|}ns z^q40VdZ--7eb~?rzdPC0Z!iy?S2A3wPU~+}cPvbDD|Q`lTKT1?DsI=#F*dYbpIo$L}4Hu-Ss}V(vLmhH-OS)L8e^ ze20VgB;YmPr)BYz%fs4~5zI|QY_wlMz1?;^<`LgKNoV0@=9igfvXb)UkOhX3$M{bI zhRUh1^VWej#&pmmyW}FTK01$Yb6`D%l`GZuGjx0cdI-=DKelcdfxGxo^Qwt!NDT4a z2mjq|PC;R+fRa_a^GeI77^vtw=zn;Yt{n+xvPth7MmQ4~9ls`K;Y39SJVX1$zq0-F zM9VjFI8Ptb4>kxlDAM-_e63$%(~G( z%lj+85;bq_-N)u}yBRtYrAO3n**jZu`GSj$x4ZkOS%mDE&E1gfkwE<*ArEC58alaBZ;=X@!;0p z+Rd+D&^gnn42Ad9xRPb*Q!<`@>#F{BhQO;bb{x+RG#ewps?%kcy?VuQw&D{b=7d=< zl7k`dHjbWupisvWrT@tLshD?29i`DxdslGgwdhWIThf9q6NT)T75xvb=sa#wQBjX^ zhu`iTMj56+_*M7?(7!p)3Wo*k?}#%fGBT1?-(vN=K&t!1@K!~@LG`07uJY5s&2{mF`@t^m#uPjLjZW7C${9O}zw8%=)`Bhe!y2 zKGNE6n>FpKrJDFh5YSc`S=60T=RO6eoyih)1?7>Rd#rKHs4H7H8HF^8j_jgOqj@{l z&mL>oHutOdS6&Gnqp~=*;{}3tK6&ox$|O#}tGni~}1#43$;vgqD( zDnRGx%WE|xiWK@~MxxEb6~%T>XeVt;@Y3J=KYR9$yXke83x4c`x`-OsKYx2X25FEPSr(Z7OmXBd3@bK5MW`T3OZ8dBCG0J*tDoE;gU8se1ewm= z!|7k8c=SMhqBO4798e&++gzHoNl^-GYs zjPE$wo{Ra}Vb2PidIpC2`)cVoz3YHH9D8kHQ6pxNNWQiD2Hm7QSdK1u!WL1~10*}; zz4+0~^daYHG}d3*8#~o~9nlq7j(vfvp{tLVgyi2ICg4 zZG5Yp+^=S>_ z@~sv`EZ;?`TJd>3v--RIw@tam8Uw52D$1JfYUBXBb`jW{vi6RM598Q4NC!H`mfY@{+krf_;Qh z_QINpUn8XFpsc!H(QF`>t`^gDgY%F!^k9y)gue&uk1VhLYotPNo4pas3l()?8^E;I z=yhNDZm(OJO<~e?lQiBz2%hxBiZJf`mT+rVN(b0g-=1H39qO1uxnjzv%;GxsVh7l# ztW1#nk3BO9bGV?Eurdv}rEU*7^oSjv61`4Y{n1rM6DTYG##jEi$T?^60Etmp~TJJZG8MIJ)CJd_{QQu&`&gskZnyFvk-|`9Rb23CRgjB^8H6Q#^H957q(VH=B4qpArcx%66>w+YK45K zPQVjKs99?j-ONh(&w|T>b8r~10-BMwlDAB$+&p*n?C8-3Kl?d>b2^qsdQ!=+tJ$ShWNbl zk#TdHb;x}aHr*w~%&qjl7%jBE83;ko+YlPcl*zTO5-$(J(o_4%KR|w=u8dfqvCPMi z)&)%;)7~(sL5z@NOVjSZl_~3b6C+G0;??kVj75e>YF2%e>zqypYvvQTYK5$p%ehFR zcZ^7SI+*@B473vE{1wR;#UwJzb$!exX6$9{9b&gZWs2w++J*z{OC{=MdaN7~vN}iw4=PY7k{qgxh+K zDp$1stXcX{pT-o++pET=!~wJhN5c9wfo@0AkU2W1L3;b5N68B-YCoCYl3WxvRB{s> zdJz7oTtDqYjF|N;-wm(3(8GF!1RkS|n~hn$VDu$2gu>`hkTBv|%e2BD;t9XgGLsEU z9{1|&<-c>=Ga!@F&a8a8`#DM)y6<= zIIi&lH;SStI<-yzW(sV}eCL*d;g8K{qme-PV_+we=Y1sghckOtv-)J$5)AzgM?P|p z&w0rg=zO-x3 zuln`MYFt-RzNaR*g9$oCT{1%*(#90>1+?>HSuXOfSc2(XJDP`4#8bqmSuP~lr;L}L zaltNjHO@<=w81P717jB=Aj5!=el=-QEi>Thqv{J2*t>2p=;kikKWj$$v54|l=YAv> zdNBRI_`P@j8$=#$5;>Ndhh)CzRl@yEyQ%?ct#Mn!>~|ajjo- zAnwI)BuTdk_vSMOWno!TYww~ky{cb3cVBb#ph++-or>06j4t||AQr-5h!P7C_JUNc zu<)kV6p^-hN9fv>$gxELN0ggJaNP#b*CMrvfY<9NrUi%KQ{cx5QpPoa zR#sVltKBN6Srld^Ip?SUVu_n!uI|lxKgNBM!iArQMUj_2!D={2T77U-=(xTiV^^)$ zK`BF|O@Ym~XIHxnjfAb&T~HJ|_?bI_qQ(pGkU#m^6Y-tcc%Dzat3|?I>sX(0D;Q** z%H`8t3*q^89ITvu{gwt#h2~|zyALs%>J~R{Xq@@>cFfMqXF#&99w{xJkdRO`M+k^K zS#sQVzQ91JEG9CQEvlQr|HZYp@j}-^rMDU8DUk)gQ}Lzs@I(+6Cvm^f^U}`FZv>Gh zi%wDq2tU3wBnq71)~=3L$anx7hfQRfuW6)GUhOzfC4C49y6=Cb{!sdY$sO@OSb~6% zPU))Pw~DB}Aq}VHP+l8vOj95C(n@`m!Bp@%U6JNp!D3pNgu8LYEK@bf6H_KCvTp4ghcomqGr7&MRNcd zwWI1FZBYKu%A5pF{Z$}my@ySsrlSMN%zSxu=R4;-qQL)fdtzKtq*tp7)hGhDydR8z zZOmyg_*`cAGcsDm`xYb$L3d>hC@6|vNkdZdn?{L2(b>*KuLWmk>P)3|oJOHm20A`n z#W)*04a{S~D}dl}h(FkKk`iD`nQ$I|V7eDlSN|5BY6ihY8>2ODM@__sPpItggsevl zsbSsSLt#Ag`Iu}q>76HD7yDyUR6f}W9Om2M0{es3C5^ek!5A{C4i2T{*n#`a556v2 z!xB`!ml-scXWL_m+_s7RLKk{PhRp`x({Ww3=)l z6`7q*LDK2FN0tH*g)Zv_DOwi?Ixrz(_=N6C0XX=SJGhSDpaHGy2e$L$wi!%+>pxno zFJNkJzSGAspl)edK(p1$-aPu_g&2*DSRnRToy!i5jAWKdhO)G&scFye--DfDWHCue zP{kDf%3Vb`!oYsL&%cg*8(a8f51o9d*e4LALSnU7j0nrke3PwzgKe#}_`QsS1Comv z*7=Uh2pRU-2}io{#h>Y@P2}cT6c4ocqs648P+IxH!#KrN43?m@5~v$Eop2jd&Ih0#NE&rnhNeAR$$ zeC~j2GsHLLgwy5MLxET#?T31W8-1OIEdvVZlg%6Rdyz0fYcv0GzS0F7m)A3RRX6KD zq)xbJr_)`U>i0@KACj62d=e$p&~DTEcQ>Uc?d%8hI+FIsa_`u%22yf^?#y^BQt)qJ z8qNJ4^m=(&x}S5gFPl9lu7>)}L8oU~z%ge>V?P*Q^U&d}C6x_b8R zu1(mp*YCim)7B*gQW2DnyyVwyRQKsplpf+>=hIDj6X20R!7%Nbt z_qkjO?CI$lcA3zpkLn&xzb6;+`z+odY`)W~PKFBlNxoKR69Qhd|1hhiuSbOHkGcxqeN(v71T)8DM zT)FO8fvNinSC*7r?rBGslv8eSh4r46Y}IV{c^+f9OIa1n)ox;hJEqvU``Yo%PJUx* ztgq5wyldE0-sM67>s@Mkl>nPN?N;2$^cR;TH;870jcImXugMz?P{%XKe6N%rlh}ut zIL-XBGF8Hu7XhswBp`O9WGOF7w;R#MIANKtU(giNulLGYlnFc;fkPu> zW=t>SdsK}+6GN$$QEM0;B-FIOt6jGonnr7L(>zaB`9hh%>vnQ*4;>odN`9qR-dsa- ze%V^gW9gXYN26z+aS(U?ON9RXvZZAwW@LZ&tF7ODfAF2x`weU7q`QExd$E2uUt{gO zo}XVfVQLhZucM&P+*_TIFkw>});b2|8`A{E4apT$(RESsNU)5N+{|8gHD#1ml-NLh4d1*vuc1cPw5yiwXvwt?SDKHBoYPat$#gc+8UbfkJF|2MOleu| zT|9y--k+l}5(}$jCa=Uzg2f^C2(P-MiBxIG3p{biV6JJKcPxV%BoKUbh-@|qmMlkt z$s1DBH>4(eaLux?+MzN3XDa3X1%h+oaRc_DBm65%WAy_Uc+ z##(RQ>U#Gk(E8oNl&9rM<95QCP#FIP@tK{-!>r+E{i3Ij)9-!ZpV^m9JplWuD){fF%|j z*2v)muA*@2>MUS{L-oR-R!<-K;G!1k#KVzfmumRcE*;rTXS=FciE(wx13Ta90*G0jVqCWS+UcF*%2(@FlrH6u^{6^l?YWveeh`@moxtuOe;n>riGX*D#9SVvY zz-wUz=X}%avg%R=d`P%fo#i4vum*el8YC9VEL^MnL{xJ0*A%Kgf&$e7&~BrGYoWJJ z9javuFJOdnV-uz8AvxDw_a=Vqv}8B0eGVqZv#2`e@hi@@=kSAk-K~BA$}sdS^0ke6 zVt4lUm!OUhk&xwAObI_AFF_K<-zFOsuq6HEOSeR<=_Vn#WV|kayaX{B;39arY(0a` z(gyNSFo`xNOO0jaagxjc?d5@74&Q$wg2sQ!@rd}Uy4 z-Fjw)^~Dx{tBGR$!s~12pKb>RF8i~!+q#efb^?s8U!ReCy1Om+iaAM)7`c+|N(rz7 zEB*dNR5_LP!zPMdTKvwNKZZv}W^TQ{bWT>=rMv8Q+wH!6UYz>F+^xc;N6h^cG8K#GQ z_iMA~)Bp{%`xt&>#EXPHaiDi}mK>CxwWe460SH_hF7Q0kKLY2o<^LOFi&kEP-_xg& zLsRK4PBqJe6(K4v6OWGw^NvDN_t9nhh0=?2>x$vyAN?nKPPk;mH6G)XN5Qx?|7=bB zPcMLOhKi(c11I8#gYPf1 z-+%Jc#qBUt;*v%su~MIvSjOXUiCwKjdY%#048P^#=wC)b5r2#dBKZ;*@P&KRUeaA( z2r&W@&HMgVIH-)(_;-NFMK~p)h&(outwH~x z%BS8irCcCCuCjbszEfkL;!{=b8-nrqU%0k2wT9+v>%T43L2o1-)LuIQgM7rQ{qx|K z|Ct3cs{ada)9v{?sZlO^Iek_j`DR711+@KHQ5nax3Z9SR`U2+N@ADJBF4ZBWzb19m z2OO^G$Rcw!W4jGE6!51-b76GwXrt)u_DLQLZcXo1e^7y`F)XP}a zwk;w#K-u-{oGth4I15Hz$MU=GGL%ovPS07W^6~M#NsxyRfE3!ag8@h(v488Nn-BQUp?#s}b(=CxVUMyF zU9J+!Ac7@b786q&hD0lfu)fQ1r4DJ)gr@%Q!yitN0GIqYegb}rA=Qczcu7Dgx)LCU z8$kV``?)>Yb}&AvMQ;94ncTO3RYpOa*@PhyanKzQ|I#Cf zo+d(a;WhABfHt{U7R|vE2ZTI29TNOTb2BlhNq8v5P@xafpsPvKbqo3oO;b3a5I-in z|K6M+|BphzuK~1@;O{N|enU`w^e@j19FfMI^{YX z3r&r5N~wha98PFAH5o5m+?*{u+%5F<^+nU1ZH-9r%zhLrKTvx9ba1&Nq!QRJDJLh# zvi&=5-6~j)Mj~Peo>uzYoNp}!QiY!tRb7Wmh;?Nb(1zqlgb=}l!tKe@to_D|d4Q8$ zxSAR_+8WFd)A{-SbCvx}l3kt5Mw*}RZeT<8b1eK0jM+rHi@(Huw>qRp{mAtWN|**TL17ivK5YL-x4 z0Qs647wFL74JGqA0l@CEk>Vz6)u{EKvT7n3`n(1>GBP8{zDXOfp2&fXk&^+Dl0ZsN zX@D)0i)9%aEl?Y4^m2nGa7ek<>zk+fxVD}(++Xi(Pm~y@Z1|mKQFWV@bDbEBj#gT0 z&iP!-!6iBGbs)s5TP4pk=NxsuKL?EvzLw@N?^l2IY&1$qxZwWohFM6cv7f)VW*I}@ zV=aa&)p|FcleT`Y7)bY}!SDoAN%%@!F;9(_mKIW2IEsuTn2trpy;(V7Frwsp9QAc4 z|3GWfhI`KUW)C)X_qDigo9S$SPB##TYJB10-Yvyzzjk{lE3lt$gB**LQ(8&rOuey} zPJk$kBq~?kkVR&=gV?YTms--|Xu0Ez%`fw$oV7#M)3Z)8j5No-`A(zW?V#B0Dmj^a z&V41!^WpBoT5y5LxS*+NJa+e1z5~c!ydj;cWotR3q3~$~Ni@J(Shan_Vq#$#1$>Sw zf2?FUdBK-2NHVG_Dv`15hQ&i!QgX6$THx#mk$WuwlrSD4m2T)T$NsgYPwSlou%gw% z@_yAgHhrT9HfCluQ_~#R{n>)^y_sIC${t|+-#=dHRNJLwThPjSczD=QB=Oj5z>Tbv z#Jr+Mc+{+VW~|A_OGfozzR_jz7oyDYH!LzZ-vXeg;?&d>|4APQNJocB2JX=TN@4hn zjx1{Zyz#(Ci7pD*J6*;+#YMv=ZM?*=1h5xnu=BjfhUG?o3OsJ5iHV6}B*(6nejx2N zD$RF0m$0Mnf9PN}5`xD}Vn0}Sk|XVKBOS~S4ma9Iy!zdz$6VHb`C zr=%6-G--H9O zs+yVQhIVf1=3MT0GIgl}0SPVej%H*~fbU~DSk!U5qM`L;lulA+>CBlN$5 zwXmacpFxP|!oNwsf`=&m{o#$VDJez%XgIRLbeTjfTF+(RDmG)^Tm&s?;$Pw?2GVPh zyDcTpy~+ulHRN+8kvnz3Zc=Hsfaqr%Fo<2QkPf_=Jk#D-O8|jNCxmYg#bAkCawqGs z5YQ6v*s-eG+64n54|;&fsKR^zjDlZQsN}TXH&nggOQu`ZWPAhw)nZC0x1HlyuS zSq{ntofTll(~Vx${emZb*?ZxXLXa*hKRwlB<47BM9a(P{T6`+G?tUd84N`prWJZxy z&*ZvC!*i~)jaX=Pg+az!;=OrREVXlXclQ^~69Ac1=&;f$BYUT%)8Jm}do#0OwKHDS z)7u*&lm;nP2e<>3EXfY=(b)7mmOoAbAe25cChATBbA-Ar_*Bm`;!;OS?=Ea4JB0&m z6rBv*5?qcti0KRSua|KA@&WDvAdGeZV;T)6WZstdnoWk2cy~7!I{+#vU3%UM>w9kH zls@`}Ladh_!d52@XjyL@`vd@@_~CN5$E+{#f;MyF42C};A{&j^kME1!t_0!JcZRF^ zbiJgfm%3Q+YX%4lKx-jaCmTC)&9^yk-n`KH)Pk@!E!YahE_ZaPid6<^$e{q*Toy0sRVrDgh5+TB$=T0kr{)iUO`J zY;kf_KBp?X@b@W7p!&bvo30!IoI)kwMTlnd0JQtP=V}e;%^!CNP<~_eO8WJ#VS8R0 z8nHkSZ3>|IR!*E1U`TUGg2 zY$HU*@FNhVKe(sH6$@td<8L2^uPZExhnWB)g{TysI=CM$PL2)(u1dGsZVW(j<8nWn zg(m$0p^N0~@h~9xg@4ldA{T9G0pJ)e9}tG_lr%SW3OPGDIk^CI)!uBa8bEmh$PXmY z>Dim={=#WWVCNaz>aEXcl!I_r(9j@=MJ22UApHfc3;@-!1b4qq;UgU_c{xp&nTE`} zuVBr2?i2w~Q@R1{rjriP%Fx0>`Ol)F3*IMT*QZ<5j5=GOJH+EuAuppbt~7wIDO~98 z%&uiMY|;ags1!Q+c;%I*Z^)=m27$DQM#j+hD#y{u$(SnDe!f8)5PB3)=b3Ew^Ro#a z-kYhmez?DbXFun6=z(pCB7RNRXFGX-U+1<+P-e&m?k*?m%K{FQae}bNf`cM*Og7AQ zLvl=(jSGZrU;jCBoo)5ki2piz0oUE{bM@zdH`WAJOrB0nwriMY!JC@V6FW9KIv-%N z!Kys5#SO=@ciWoH!*HnpoGe7M#GsUEXFT{HIoFc(FuyCk+I|`N{Ut6V0S2@o^W99d zK>AxBC*5+tyrSxPPdUIIBS5{gnckGit*;7c`@{uBXC0k{27ANRzl zsI0A#Jh}fnC)Il{;|YX>W3^7^`o33dI(5zk!VkAjBu`LX_NGBAonavgjM@wFoOwXp zheqYC43H(I5ca^fjMv7U3 z2+$zU6BrL6b|Bm<0?$$R_CiGvWax7ilj^aaKuRbNBp73WPpI_1a)i^N@bt8-tZWom zRfYIhZ-EeYs8GB7bkaCN2J-O7okg?6-k+8DSpqQ1?|BLkj%BC*RJWqU`pzoAK1m0+ zHrDX0m&)2e^27F4(cM< zzFmh>(fFhQ8APX50X*UP)eIFs$Xmt~{+nf1jk<+ zhX4J4t=PC&!C^biiABM$e$a5DXzd2iQQ@CYbTQ-86bJ~Mjewc}Xjbs^r?PLep|-X* zJTO0K-7 z1_%}}0N%H>b?N7R(~TXgex174`R>r~Nb0j*!+TW#>!WDk2TwKzCV==39%92)4k(1h zw!Ht*wK4=mx%fZ@O780F$`f$7E^tyKQi`&mGzCzp9l&F%<|(H9smcHpOy>?@ZKFUC z&nV*w5RYR;x;*g6n2C{b2uv%-X**rP?;`>zH>KaL1Du)U_rCn;=;+Alyg8^PaR>zU zxqMFR7JweXgLk&(TgN%40ii#s4=_aKJDvS-JMb_H)VBblVl+z%CyYwOKrL6E?+O{7hr>Uj%;`XOt1}6& z*#QucFBiuK$B(nq5hXb=1}5g&W>&;DV9a$_>q(~ENoPQ)Ac0BDR#kr1i<5F{)_7D^qH0ppWJWk9cUgEkO%Q&~^cTQw>R@+UGbO1oqm@0#IWTDHAtm%4( zT;_%i3NK(MG{N3p5hl0Cxgz<1GEV5Y{IITH#RD9U0^sQ6kfMO6Q2srvP=H>aKW#V5 zA~zrIs*4xv>7{r3bO#sfKRv3@VW~y0Xfr3Z2=*SWis$mCI-m-Qf+_Sxk?;4 zLf|yL32g_tB6sJW7-}E^`ExR%S9+J_1HK*rxuL_=zG|Z`bSuES0{$LICB}g-mNc3v z210Wnw5;;Fa@HtT6#_CCcESkvjbA~^+S)}xHBtk7-pOLoDKj-xjnNXgb`%>zQ+O~CxhP5fIksPX|iiICI$JB?h*ogPpN$^R>+Dlsb8 zhZzAXwBkTGLM;|s0C>7Pc~fojfG^}CPQAe*2^n#}t>+rXQfK3FQe*0Ype#kmqXr1c zPJku#ZJ&Grw(~Blp#qvtIBR5`9@PT6`fP#^;8?u?%>(@ET}t?SBW}b82+5D(we!+3 zy51KiP1lEgTnT_mr2tI0@KQcUQ*!R=xbc&rYD^~g#NOEHgmw_P30UA#Q zC4 zq^fLq_|u){0Zc|rrqozf73b>O+MV|oxtfCB<$j&hYRbxVOz`v7hD-0Jlg*jhQmP(( z)^2@P$xn=K(}3r_V@80`72sQjfk5hx0`LNW3i!Hh#3i*hfE7a3K#?B~YtjP70K%w* zyW}7y2J43%gdpZOkZoz+QG7!-Kn4xKuGH{^o=-9GNoPR-0|SFmpEcmk7H!o5&PJ=o zGTKq_q3(b&JN1s%3FpXNh(-m(GoJx6nrm7cP+59r=J6VJ5>cBf)I4`&L8>nT?XFhTukb^@bE570qXc4?`B{*$?CKLOK9bkwB%vh=+@VbD#eJIvxkaN#;C;jCw1ra_iHl?mfX%c(!0}4g^&ODef`*5Ofi&nY-rKOc z22#O4fZ3T9YgXSeY>C?TA%HOwH16&AV+iK~V6Y7^Un2nS0nDEx;D*ON^rjsK`6TW# zK|n^zKqdmf93V9z)dRqjY2Tq8K*}k(xzz(Pw-byIZ>p5cp>_?RpHurpP8^=p@3IVO=BSxPCy!+Nju7dxm6VPdK2N=gtpBtsS%@vO# zWon#bE}bB4SSE}I z<{4ou&FX-X0x${?P7)R_C=b48{%^fyd0Tr0oTpyb(dB6AB#+*H>GM4C|6O`Vm#Z^5 z-Lb&uF7X=(WzW`_a@;HAf42gtHa`Aeo5Q|S)S&=2`yH_HTIajM!2R(yH0z%7{paof z$;Sdv_Rn8{nuFMX&4$2d{|`j&|1VDz)wFQ=D~^nJ!zgrcTBF}Cw?a~xkU@#yDk3G@>E}iLGl<~r_g8jA& zCeBC#c3qFC;Ygf<>!#s^$=AU0Km7r}d$MOx@9kF1e0d;qS;NPpv^GQr(azsCP2Wo0 zL%S>`vKb;9PmuA@8zEUXwHSDoaDKY#;WW2{7NW<{pf@phqUkuFC{na{dx#XjS*DF4 zHy-CU)SO`DuJ9s}_WT3RK!&znzlW@kYvVZCI*5?O4qoO#8yDp70EtE2E`;8#KJnRf$5UQNHL@&A&2{PUjTM z*(IQzR1ZX@v{t<=BNiKHQd+g>Q?6evLv6SIc*$x}Y=x$D`8zd!oPn~Tc*#U%hA^kf zy$1Ip^CNC)lln=e>@RqX-O7OUcA`_8L0-M(7&OMDIB^zePT6nlx>Bw`Gz#c*FlpH3 z&W;Ke5nc^_d@6m_r$C`GBe|)XTmqKc{9vE0v#oMr{fk~LfiA|bW*DNNHl2~SwtHur zw$js%PxfFL3Sm5Rh43K3nBTf2z}J}D)HEbnq3QMf8gutL(jbgGXoeli{izaXoW?iV zo*zwNUeC|ElJoi{%zyiP!Z85?P5V{ROz`OeN=d#YciPZ6eX4`r&^JI;ed=(p2rw+US8 znXg+7>P;}-aLpx*;Y5nfHQ;N4{e%)D>$i*kO<ls5VYNkHz|o>V>~>a9I*-2o|a9Yko+RRm@l-j zA{cH6aIZ3t3&bcd(3zd)ZaVyZGvwlX(|jT&cfCwIU5IvhBSCqbDwcIT#H2v)a>`L| zd|n%7YJRykQ+;kA5#f|k&hB_xcXi^rYvj&;v*{#LWoy$+nr>Ha8DpumH@33MQDqK) zj4;iR2n(%n?7Nly6Hp&xZ?@q_Hk+x}q+M{p!A=!lD7)HAm&nfkTc|I6lml)(F}p~6 z$_XYn6rKt>X_W`i!@Jcz9lp#>79j%IB&KG4YiJP=2y743%EZ zctSN`yhOPU!ugZ-kJs~`NpX#f#F#>48;?wDuW(eb}{r#QNuZS-E|hpy@@nGpV8qGxa-l3 zEHn@0tEzB~ZFMn3(b}-1FnE0;3s_?+5pj!gI|P#3*AJvb-zmHF7O~4UybFw49`xd@ zEZP|Dy293`4^RNZKbXV>O?3mGh^ECHSgmcsP`Vv)-L?-nQ!99GMDXV#ao zJP~4kjT%?(5J(|$N?);Rq~fh@5m@0^7@imrm+vxraWyMse#mldGPzjuOu;^i4PBgZYT!HUc;TX~_nlCNIJ(6jd>=nIap34)h-=%|YSvSb zfeSyLMYA9GMnAFx6R{VuM-Wmfl@d!`;Y=;5u6m3qNlow++mmG@T>B5^gXSdY5t@bX zWkeDTCRf>=qDmM*b^-JvlH8Qq3E^4Rs+#M?1=^S5j_!N0_;-yNX~NSxI0G!!X&RLE zT5xrfx4_G(mg=3@Li6;)61(nGf5l$+D>R|6wFLtX{rMw5WEp5OV7vXqvAVYM46Sfd8 zKZlq!^E678ed?4;n)>D^7V{Oh5V$g&XP52nYd2=cVpAa!d2_fJ76*t|`F$9q<5zvV zYPz`(8>ZdVZA$ZCYTyKLlR|qb!CU(?oa)MmKh^D5c{0Tqh*L}YvBh_<@_lv)3IkDl zhjW~~Kd+ljkJ|Ynuaer#&-1+v;z`{4PTXMfCGcnCwyse5ndaQ^9`L14=>#ckM}~?Z z;D*R)yh7P!o9}PDQs2v@t98b_QmHS|hA>#j2~0aw4R`5L8;Rw=?_?=3+!S~Y?~QqL zTO%%;m`phm?8g;bImV7cXLUHhu5tRN>QGFD(M$0c(~$RQvSzhs?t7WF0#BHBJoHLW zrD&F>y^JVsoMq~`c=b8>3arvceEYe6#X2p#(qu*BwR`@DYl%fNGxoW>|rCquiEW#<8N; z(xrXEFl4@{YWJ!jr`22H7iGP4qjRS0oWf+admNy+xuX}11S8l@KPgA5dFTczSS|$& zdcvMRsW5JE&I~{4IC&P^7&D4sBw%-@2W2<2pkLr>^6SNKFM)kW#UPlJCX?0gae?gs zo&c5&GrAG+I3pvG@S4B6<>P2Hddpx~e7+@7q@G}*QA|DmI{Tfo;nX|sa}?f}X)n|2 zep4@cn4kaT{QTMc676ip!#q{S9V(ZC{q#*oF8N2g4rIf9jFzRKv`Kq;&_}A;1Y%=8 ztQe=E-f~r6GZ(XFpZ;FmVpS1K%f1-hCU_jBd2Ws&i zjaL3TClZ|S6u?!onJihwoUfI)w`5Un)xZxUHhf&ZE$vNi2;n!m!bqAEp%%S zWk#QK_t1Q~PBeMOP9np-U#`&-Gsftx{|e0KMxEZR2RV7+)BECzSh)I;_tEe>>C(nn z244p2hA1+mm&-q_yU|W;f6w>@Op)~#1?Vkw&7;`jZ-g1FPdmCCKe%Cub{-J7E#Zq&CrPVw}HFiA$Z;2h9}^FUs- zKCCPt%&LBqb;%O0p@KTdS+Gx^NBNN}Y^6qGgnq(Z(wPKOJTF?-Oz2{8qi;+}DfN22+A8G-PKLGMrw4-xW6l-3vqliYE|lP-{$$pV)o(O5v0Z{ZE{~v_=j+iMh#j`1e~`$ z*T|VTP2;r8qB2O6VokTB)lT%v#oBJY#-cMnzV8paH7rU94SIHjM9(wC=%r@5mJ+ScT`{ zjPKqx3BF|=Oi{e$dc+xHjH#+2%qb!T%17zldiuLo+-lJLiBM6KQ^I(=hAW)O)g(UY ziCjCwV>30w)stvT6b4$Ota3>77n>dKWBpN8qcz`&DM>>G6mj^pa^JY}%Q3=%1_k6R z+e&z4IZ9RzAxEx%$FfxtQR1?dhwWrt#HGMfWWDwtED8dZc>EtMCZA=t7Py*34b`bD zBNWSm-@@tp-)DgRjoUX9a>Nl6Pk9y4E#Ov+js6);a~M6n)-5HGG3Mw7OmEKgMt)#o zp-oNi=j@iAIy~;n%xzEps`;p|fb9k1dykicKuEWFG1$Z~^Jcavlo; zR)Z9`pp5;f^gyM)KPK_(gAS$KHty0h)`N4a#}-?xsS=+f&|hkcE--8d>Ub`ZObT9S zCLk%Gzi^1)t5&b(!A?V<9tdSQ;u4u?*?0|5(x!@|Y&> zwKP_k)(i)!R)1+rF+=CVLOnQ`0_Hz~p$bP+=Uj9?UFakMmGm!nLh>3~F$%h#xj=PM zS(b$$+k5^QLcN_2mUjw8jKUE}A7c(4V)u6z>B(pOj_ODtX=kxb*>|A4!|;(YF`|9u z{wti@gTYD-8-`~(e11a5`&(hQ>)2?yYcVDnevQo)Ve@I)9bFHQ-CaE%2q#FZUNvO( z_mVu9&H~NBTR@|)c6R57eh`^<^yeUXxRw~9rJi{$D_8IIG@TuE=ALns84{>5>J5N` z^i21J&*e79W|J{&l)O&%RpY$9HDcvU+<%n#l zCg{u-?y@~rq9H0ON~5QS-E$-NnAUR1~aeT{G zcu_||iVQpOa5*|urz?vf6wq=cQdt<=D^i;BRTQe7Cy&SHCHE7oV+7KvVK3Y1v}7{8 znN;_TsG@RDHT1$K&QT9alE|1bRQR~F;gy*|9fK%Rs7q?HE+uUR^b}L9ILiH<^aSvF z41@lf15Jr%T*y&NInb~#>qg@^v9m{XA@5i%Y^ch-nPBEexMs0xA@OHeAzdyDir=bl zOustK5gb|P{M_4uVlswh4@J?Du zkdS)xF}&KFS{xEJx4lPzN9EoGT|$TXHdUY(@;O;XP&mvKvFok#k!QrUsO|PPLy3vX z5c(bmG&@CBZPVhqEgXt`Qj;r!2j^WvRxO0aSePkH3(V zwf4PuH!=BY%eBksJ2rnin^`i_cG3DFX?1$n4u)r$UJ;Gw=0k9b(`Xe|57}4X$)!gCpis^au57 zc3v0T*L!>5L6Aj4_ItimjT(mnhUvFQP`B%rN$|I+8o7dFzgVv;w~ft3T8uO#t@A`A z#g@hHBaHGf4M_FsvWVP=D`B@4Ith71M=rO7@(V>xQq7 z$w|*z*Tv@}iV{7nLp>1{l#5L;*{RPH;z_7Ny1dU1ako_u5tDJXy<;s70oFc9>CF#$ zt24lIj6=g>W*d^v{pcWVDvx=*(XJAp2H8-JWNboiwY8^%Qr!g09-BK~9;tk{B+i!0 zvx+J*CJNJ$UKlSm@Zsa?S_{++|1i__Y|*lx%jIGl15xh;-@ot`(4!ohj&(00@1M2@ zc_~C&?)kZ*mh!yM%ty+i;EJ++$CN-qUe2%-gypX|n?pinw3-Dif3d(@7tIZ3cQ?20 zTXONilz97IV7IO7x z1C`KVMOb}QadDTGN3AU%!nj^WUs$NAF^E%6Z=UCi$8W7sg3EHGJG3L)WX^m2z_%W; zo`vPzYI8RS%GiDB$Hv)vJ>)p)L%JkHMM?7UV+z|I;GjL!QJ(K{cE(7EZMM5?#dSK**{8LuIqtgX*tR z!{2<wd8n=5|x+Ptu`}~M~;dgDK ztp|z_P@VfwE0l<$b~`&>JsTng?-`*pk~T- zgAFkXDqd0Rx?%QkC-2m?y&Z=-?~9KJ8_WqGBTA1w1XeoeRcNB+ijoSq1jJPkw-(kj z?9tqnn<$a2(h#myfcJaui<0NSnCE%4K>g+R4crChA`nKa?kr$&A>Mp^-E=+WWV2tK zySF+$tDL&lYz1mqlJ~JT;PWxn>CuBVrZhI!M{`xaPZK0qyY$#yRjPkLUea`B?R_-R zsBu&^Q1p4fw~ZOe&&H07c-`^KVh>uCF8v&rR9?ER>xQC5MAn5gIq1(rfAt*TRwNEKU@!|_bv_G6^7V^W zan1_lH|Q5cu~C4W^Uv(7@1m$2D4tHizG~H?TcA@lv=q?=ozhC==N5z4>H`F=V4(px{H>n7M#@-VJ|x^NleJ(=wyrG^j3%3 zbg;E5y*NTqDRR+q8J*1$mIxi=|3xIQN>%hxK? zcs~5cN!FL7A_~P|HU~O}-PKiG%G;arMzZy;58M5k9qHb;2TE5*iMVW~buUX&B?T<` zuyI{(;=0%qR#m`AYG^(6sKD*vY=%0Iw#Fm5tXXjVMG=4BK9<1 zi1cB2C)_k(-K8H-JG1Hr1Z+{Pb}qk!=a9HId3{tAmfjwH2}%32;qYQmBSdBR-C;D_ zTCO0>UxI7RQa-2!-e^Z^)Ak@dMecE6fG4`H&yKS1CYrd^4l3sC#|Q#JLGfx09Gh^w z0!qF*v{b2Z+(Y89m-FMChi(LgO9Z}jyT63Ls*K?mGvTXby9N;+yv~|-{JPBhiU#K+ z3H3$7hcd&5$6qz@+UK}6)iK+JcJ&9|d|hK~^^nIj)p%O!w&CQ27q!P2x`^s7NtzO% zQj1l|(bT{e*tq>JZOVbIPnwNE6|+b{%6`VEeO)>sM1YjsEia{|SMIS41=Y;e1EMu$ zLzOr~P_+=e9!_5Gzyk@4f6O!3DTLDschYx$V=6{%Dj&WwXjh=9MI@y;bK7SX3Qt)ithT;zhTG|hNW~9p0MZZA_q$sX-`{@5X z+VkbAe!PWp%@<*&hLuMzT=~NoTSPYVSIEL;{Nn_t+@ISV|CmBUeIAl-G8HWe?DJHc zL%GSd+?X+jDNT9L02yLuX!GJ10GgsXcv+|1U!Ppr)|h-w7sUDGEN)vL{nlz^^Fkvi zuDGLjo3ft4gDYN9G16d0W9|FwH=QBzrD!ud6fMcqam+j|(Zf+*VqVhD7lWPj4@%wA zVwe2ATC~BJ$EXU|X0JNoT{g7SKUE(lDt*J0ebR|g1c6wQ`z(|_KaXP_H4Ix4BP;8lKQl0 zlf0Qp#VII)jR>?XVMhu4$R!o-z5dRoR+0AXcIlhzo^(;cmq#Y#Wh9^*YY>tGR+O<| zX%{6G=_aJ8u)RQCECU%oe9@UZn)eT9ui)IKyQH@ONf>5Bl_U&>>*Jgi!#h&Zf9l|FJa&!l3dR^W7-OVWj|J{V zt_nI&D-FFS(iNC z-#fUUjxv*%HRIj3rJ~1xU7e3#P%KGE?aoHj8&LaQHV+9fcX&uzd*PHe;8kX(v@DG- z@4{angh9%?xKd6@I?jrz%Up3=pYQWiQW2dRSgSj&UGygKi{=i1zu_vRnYb5UWe8_BATYXtQ!%tbFuE4tBZVV zRXZQ*IVkpCDH$*JH-b~Bs3s}Z$` zT0EHN}iBeLxYlD9VmU8ujv4YOT#Ovo4yXZn=26G4(vEg3-nYZ=H7Y1u>|*vV-Gv z{f5fwItyNS!Iq{}I&3*mFK%%7prrz zLeKBEJ()X_2XmhLZHDu+@k>_7M<<=-SSrnt0)ZJ9z;*bk=tNXE50+}e_gd!ar!byM zU`Mqcg!7>}w>G>Uo9W~;%bEX`h?tk(APL`r8Y3A13IluQm zOt!vGFfshys|r2#xL!c(V{S1Q8~mw=5c^6Uy;Iz@8onafXx2Y-(o8{Nw)MWL^#1C~ zQ_TtlkWHA$8vab^{eZ#R>a8!u-*JsEY0riX{$RKxqJVOOfB!7rz~9&QLu^~zn2Zj# zskO1@WLA)mciRSJ7|AjZ?=K2)?VO-M6vd){&*iT+$NT#~|NKs-z}f$2w7+8p%VIuv zy>lJ^bL2dI0{T1NzrU5fJ<|Q(E))Ic{l6prbD3@&%%q)%f8TUp7%&#K7vy&`GIaJ= zK12an%b6Klj2)VxS&pd>IMHvYzbUFnWaJP!$g=_LdJU34QeBh80nCzO2&Xkn;gt7& zJ~=%9PGdxFkm8YEbHrOIYX}xE~(uc?ZW&fp6~C!j27mW!3#0yB%Yc4*jE{t=C4-5jb1FUq4_?A>H9Dy>Y8M*hGrH<3WAZ&b}RATUM~cn;nLBR zHD9)ctK2UfS@GY6ldQxU;TkLNaofBT$h#$k0e91Knm)4&;skS6gibJb(pOfNFyAlK%uKz-0v~zdq3+h+ z{Rj5tLubxC^ek!R85lN2ZY)C)Wqtq6G;0YOP-MX_r^zp$5uM*1boS3wdki)WQ`^Ta!D{zsejAiP0rRbE?u9_sFr`qVNxNA5W(E ztKFTmqTNe3a)Pakgf!yY$6U?ly)@TDkbG|qsMrWZF6wdtPo?pq$@&W zt*M{D$X}mXTzqW_%`_i`9i9B9vQ6)P2F!#Snw+^e`nDI@+tp3B0N~N zR`*<)mjCLA?Bn5EHqM~L&tDA)^$E4vu0A2doHhi6gSQL#-`+3geWk2F@chcVKcSAa zu%gKx9TS6oUUI&8Yxd%&QmSgag^`L1mQAFw&RkwW|5MjSyGES0;9#i0&+JT}8j-|Z z^>lu5UDuVi)`Rukdwq-!d11`FFNgs>Dw9QG(O+y}=1Wwcd??va;&W(jUIP1tEmc7L z60?4Tfc^*zv;G|I2Z9^*wy|ar?4y+<#j0;eNaN?b>Z7LM^=jg(F%8QGV9@jvvQ?le z#hvuQ-**PodDP|fr4IH@5KNR4fG7)j`0X{`ZJs~0k-7;s(X~0_BTBg64&!I82y9X0 zz(oT$QfJm+6Ag7gs-N50@>Fj6_yssG@AQceBm9@|E3otgE83%k0FxB;9KX*g`7<;g zzwPZpqAkN;(iIAMp_S-J?~l*ylfuG11gja%9{Oq7v=efRl={!qY2i9k*lU`-C{YSa zhS^Q&`tqU7mJD%g`l=*MWdfd8#N8W0cV|rOA0nQ*8szD>v{W$4j-rMMCc|UeGaLv!m)iW6M~8(=O44IoC_p-JZLcpen{hSwgO-Nz~mo`>eua z4tKz;b>z4srJMy={sP zPA5Gq?RJd!HgwE`yRIFENS2x^%qzbV=~i}PjzlAQ#Xh&e@qxx)FFQ2_hnmalxodku zSor7t*CAwcV)h0ks&Y)G8gESRovByd4+*=}nppGQ~ zyt|);&L%L6J`^u_$OG5n2r5k?S`U1{`8o*&97zhF7LS?j7k9P_lo6OEGE>}xJRg}j znk(=`0{5RhOM9e0<;8k&*6j*remz8nloc?tz#ne~GXdAHa(3OuxrpKDZP1XBmj zac$Sy!rJHLUmtFN#rU}LKA1M<`1VGJ9~SxPa?y5LN@;ld%hu%gWHXS_hpvEr(aZkt zJ?!Ha3IGnb1ut^#y@r8|Dp2md6?;~4@{8g1;46_K{D6!473knlk7V-r*N0(WueD2( zezf0)K;(bW$)(T8cLnx~E|U=PGaJ(kn+3`ygn&-(<#0E>OCr4eONTbMx{}*lmwA`& z#_Nh6!qo03iD$q1csHp6Nl-R@94)(Le2%C4^y@cjAGIU@D$HSg814zb*Ezt*x@B1z7r3sEqFr~XBE(lH z*d3ckSsg8de-rU@%PMsRbied6?KYP3`JWT|zh{e81_g=KW_HW2HZYU6uUC$gld~UA z{;?y^1STXnrF*A1f2E4J$F1jYO&+j25Cle75B&nBzgclFy_}Id=?(oa|K0Rt_;yhb zu?HpL8Itw|9-4A;#L5_bwC;yHPv-Jtr>iZQgvg(VQDBBVR5mot>@2)d{<3^gjb^Lv z`zBmADy$OG|B{c0QqLpQ;~umCiJE>b!u>x2Y5RkJqp1I;DMt5CICO6=z_0%oL-b$1 zf6?aO4L1(`_)k#x|J`(C9fT~eP7~|gfnq|<$%Zk;ePVhyqZObgcNbf;KWTEC7Z+~+ z4ZE$pwyr^wJq?C%=P$!&pbjjE$RvmGCWXDlrw`CeJsqk=enMxVsjqB#|6KqD+233x zI)80t+tTY~a??kk^k_D0sD}vZO5*{#=sO=?7a43Dj%?y^*Vshd8B+T6(v1+zVAZO97M`sv?Ik({(;UyAq4mN?sWeyB&BppI)4J+FyJr zx#@?`I{6?;$miJX^UrIn*M8DpT0toE05;$_#jsf4#g+(&X$WMrQV6_nvs|eOT6VqoZw?tp95N#qx0xz zfgo%Wn*;WeQq)I(YR^nkg5WE!S$4M1ZZ+#ua62EM+rWHi^*~n!x`O)xmubAb{>M(Y z2~7$<=>j(^y1MvyhyP`&vKW7p)ST}wx-$?PVqcMk%Wb^3yDGC)R4BfYi8XfS;Z~`7 z0^MykH{S!j(5^4Xe3sLNk5Ih1tY((4qk=G^)J2>Z5|5cKxD}cvTT0ImUnTbHQw)74 ziLUn>1>COEB5Q+jCz#rhgLl{CkH6KPB<{eGpMG+hV+R)>MW-K$_?&7HXSj~>xE*&Q zdpFt8LSeNjpL{p^uJ@y(qwYhIJFyxUDE-x86QEmU+@JSBd||yaDbUoHt|2b`_KdWK zJF3~q{Nl%TyIffJlO&an+}-BXRB6NvzwUHrYBJF`wWGwdQ4W>~aC#`vNM}>hht$GX z7NOS2!E>&^++^6frR=oFcG~RDpC(jcgF*7(6sScjuCSz?J>dqQ+X$X?gUc>{aw)Go zn)Gz-bWgy$Dm-=~Hqi%>|Bo!${*h%UC7PvG2-3SR)&*w_8h#pFg&LU1ypTeLs5G#1 zcN?|Z<>Ky}7w5_mWRt^QNt6Vi^K?$6gt;vyv4m>`RZRL6VZ^0!N6C>qJ_HjJ=T<2K zK$qe%S`>O$N>WY8J$i%%J|S zDjI)zDtr3iUV?^^g5WUK2TR0tXO*7Uu;}gMriKXMwq9vrHin~w*Y)+kFt>x=lV_0G z26w&|dRXJ|!FbnH)jC)^1LOJxy6O6Xv1yln#|zx?*(14WPEVio%B^~U?6#{!1A?1d z6Mk5DwYThZb5*)2-)9H^NLqu|>-;Zb8#nxG#kNW7x>s}Og`KCBPI@&fT=IH)oJPqX z^c>AKftE21&X)#!1xMQ>fakz;s5;u0M=b>t z)z*g?TR@+XXgG62+P?G??@y=NMx{@Ui=VuD#!Rrf)4aTZcDm?93bBeJGQQr={aD7_IDmrV&OPDK{`GvaRo?tl78GVUfOnV^<+VJHxcg@ngo_Wug zgr9`zAC8(wd8I`LM6MC9c)8+Y6)!mtO77z4yF=Ef0B~((AMgWK)fspU<}2_x%qmcD z+KTeqH9v(VyF|KJ&EUIrCWUQ3wXE}B*!mK_z}Jj{8SOB*$fL0Li>O7ngNtF!Ud)?! z85*w*9`zY=q1eF7@MS%mR5Ci`=@Oc?l-cFEHs;r-b&S8G=^?&ICIc ziiJQUUP)@Z;Gn&oBP4@HQ!WPa;yA?Xp;Qp_$_g_!KRa1_LFh$`uhCB zgiG`a7jx!?SRv3M;>wM@^5b3K)BRygsQ9F`I~=Qh?(lU8EWERoRb0b_{$nv!8Nalr z1vcz=_yIA04T;%yYj^;+c&m1Jz?eF2HvW+sRzCwpvk8i>=O^(u6zt8hrIo8=-nV-y zYL%QKGt%5Dg(Va~{oio#T}|_J`(TKN>3U6G0 zv!qqCjQ+?i{_*xJxl@385a%khA@Wcf8C7Khhcbw3*r*QBDjiKgK6|@k*qF`!1TPT@ zo;O7>G7YrTNYY)S6rEq!PF=Ua8Gpu`1TBtTw(j{)L7Vk=_`al;ugr{&zp44-JL0d^fvO5wxjBiD)cpWTai!ot={vQ>Y3{h@n zpvWbO`o2>{%{mXEd-Js<{KC~=EQxC@$s{|8@4ogU3>tjeljEPI){;|G*(=Rv|K8W1 zXEMSiFGO_3d^*(Ondik?RsB~hptEN2cBB>2i6QCuqp!>3d&i*XSE4U$Yj<@iN%qPH zf(-qKz&$Od@7TnD!lBDE^L`VAzdO1TxTgQtL%U15f%avv{K7J z=VJ?`n*jDawxas+HUnEAo&X!@osX~r^>Ql$Q%I2ry+skcBWsu)de@jp}m zfFaHAGs!-(y>RQga9TFB2)L6>G|q_jCYI;Y!)>n(1CILb!X}#`AJuW_d`54GZ_EAR z+Q0>>3`^J{Bzlf`R6EmN)iOLIeZk%T^H^@Bg+f3hOe=!wlyea+$NB}HL2*4n;qSP& zUR;CYlG8V#Wn0^yW~^w3zN@YZcwqW*ZL_}Eemd&>(q`)+Q1bH#r!pu4`YkF*W^=kE ztJ0xeI}0_=E!XyRZ#ozDH|v95mB^GW^s;%-5{9W?UN`Yc)1{R0w zOP7vve2C@-3Pjhzcnj(v7=VAGN2zWQ1!@ghJaJhNPm!#Vkbrr!_2kpIZcB%ABw$0anGHE?RG-Kf5gL5<6z8LJ z=kt=QZo@W60HG9fnD8MV_f4w`j&5Ef4j*=9VY#$rOY63*1(bM?W@j$i0rn{LwrBXh;O0|AQook=d$}1(HKp2x4cGtXn;$5442Kh=w4SY1a{)cZpWB3Q1D{>LgNJ zsyfB<{O9V}J;%K*tyy()5_S?Z-mIYlPgMsQ!-*G^9|+>i2I@~9#sSOZOe;h=c*sk8 z@BoR(QlG9HE+koD5XarOP@9Szp7s*?cY$3NRcd4T^Ds8NgbxnJlQiOD*<_AR;>-oo zy~*vZb4NSfZcz?E%;e8>$Wjl(a9~a7+PpjR1q$ z?u~TaTxPm^KJgw&qCXoUqkw!}!sStf?R&Ddt=}FiXX3t2YfKWWd~xyJ>rEok9)H({ z;DH|K;EFD!AEEw)v0*8Su92}n+wTDt@`lG5tIaW~a5Z%Q)=8+)OfO|RBks~3Y+|Yh zbpWy2-k3dX=3K|PFn1*laArM^n1QS( zQRMf2*MaT%A=^%f@)L2X-Ra13ZxU18H>x^sR7nY#vRjkqmKAfJMRy%M?lj^oh5 zcYRD#Ij*%d!+y|yFe6XlxxuVFii0(0hF{;t{sNvunNcRh)m+jl|7NI|q6$~<|@U(jM>gpuwPJF%^y+s%S`4qlX^#!`o zoFmcr$I_b%9>ZI{w~k8=L(RCYOhu5QypCYbNc(pX?V?cDA|XOz~?4_3Vl z&u-kPAHa4|LTXKgZGg~`zbHkzAM}e&R5Hzd@P81-xVs26RdmF|ww zFug zA#vbHn}xy)5O|cLS9K9@<#*{KVkz;K*TWZRe)n+Vv2sPfLzo zu?p6Z*@IP{2jzZQfM(>GnKOjUN#N7eT<8?VdZAO-K!4>fmZ`O5!URFM){2tW&$!q# z02~5svt@LMT8kaAstrSvIKcj?a%iY3`0ZUIon0dR=%A^^5D%GE+7<9PfB}pV8RzZ__Dt)xB8@|zk+n156FPn@nE`Ph%ogcV>3t?~+h% z3|DXSOS~e8bFEU(Oz*k51>Z6E*5QAbBj@FEaulqN)V)3DX_X~6L3tmrAx70VJ zmDPz@tM(GM$uTpFPdIZ*)noLhFdNczsd~4>_SZ3?8^P3+d5J*;y05BpBVw4lSK^pV zvvc!OU5uC2d0Ptp;~gCT`$^ z32vY9riG6m?d|srar)hGjby6CO6XZBTc;{^=a?eCaTA=6K1v(JOZ>RuOs|djtxDm6 zi&#-X;eO&Xd}eSK^LS_R28OqRzDc-wRWGd(EJ)(;Af$=Yus#AXeQU%t<$%rvLLL4r z1Bu0{cMzt+`t~U|pFjE5neK!?wzT^lL~F5%gY^_bf@XrANXzs@LsVEknNNNc9Q>qm z3-kVEbd6-9SAou6m^Bvr8^VB;I+QbMBje76Ix4wU5qzl zxcE?aDR=LW+e>1Fb-H^j^eVj+*v>5`u#2D)i?fn39@D(9v`}=!V@DlQ6ID@bRVtg| z_y2XUsp53371|-2YkCzs@e?i%0?toT=FIqnA6{QWE5y@X%%#)l_io)L;4j>-R6EG2 z#EHeZtFQ?0A0+w4bMXQJ*%0Vme(?+?N#=o3e&%OGeh#YEc=#xV0Eyv~stP7C;V(h8 zD$lH$k$_+o2_X4KPjh5Y9k%A3g1?#~0n;X6-uhq))gPEY0h{uVE=D((v zMHR&>gt*!kzz3>^!ABK7u!q>R#~S(o^IWA;PvN6 zu!+H}$0o_7vdt^_Pg|j8UG#F~W#WT^h{Y&nQ6*QJxTHf}aJVWhxO2kGMm_7nQsa@yR}y+}A`G;#B7A)-vN_}vN@vG}9Gp2zUp>sfSv+-Vhy z_k8nYRkWsW-k9H8y*yHmi4*rGs!iajr?T^7hMl_!&~?jB229O9uf)hyuRF#drPfmK zC(*@yq3Ki9zi;+CCKfIxj*88s98D1|CNwRl7{O)ZpURQ;wmEN*ApdXP3!8f{9t!hE zcS%co`2~XEx2$;!T30Fh#i^SwuLYyCe&=H_)S1p-vF+6%+ay99LdRd3cD$oc4Zx3y zhraAr3MhUdycbMU-X{rf&83ohQ_886Idyi|5hev~oxhWW%)?`uD=R%A7g>H=d~8Tr zxIL?}JY*gi(V2?P3r$I4yGr_q&8EL6?%aS-!z;NzP?(su;j}dB=QL*KRVw<+!Jm2F zo2!*S|89DpHu2LtTi)6?P7CkzYg!z5TO3Mi5vP-D8{Wo0>fd%He@)3P>fILtcM*E}?gEdX%Hjd8sW}cfGE9xo(+zse8 z9jTPwQtbsRJ{3MaBqBa8IJTQ?(4Wel>n1kdDN|#Exjjlf`XmsY6SQ$Axm(sGYcVmU zQl3W!w$`RKXpSNnv~#vv``8*qY&pnTmWDheVymiYGF5LN7=c%OdEo3T>V8g>DSJl( z!YD|>*X!$}O9bVGB~jdkGsUEd0gfXc`f5LGZd6baig-35qog_WA|JKg(x}+&$q~37Oy`si} z){qfrybtqJq#%ZFAX@W@>{884sP=v*y>OElYOfgumV2n6QF+RCYX93=5OPe#~^73!~q!_)fcH5DmG(Fz0SoQkxEi8P&I$mCe zerKy3bGdZXhcKhMrS2ky(q}(Dwdb};RzJLontoJNuC^>rlyV(n`n9!b;PxJu z+I)5&f+Vm^_qZ`f=TxM%5}}!FbLS1g)SE~8FNm*+?p{5WiiF=L?0;AL!I)1kTIR_v z)MKu;hrk0CAt*F_$3;P`;8&zEz~oaCRZ|`r`X$3ze4tKwt({RyLEHA4d+0aA;ZsVI)|wHm@+6 zHRCtN34e!3V509r;k6n5j{SVMU$go^_9t=H1)j9|;^&9+xD2PQYR0{0AV8Fy>9hn# z{>K}#ak>=Qq%rT_u;WjHR<4g#POoXKo{@_|UO-0UC2@t9vmMOtWd+$;eh3w;r!|U( znAkVCvN=8fO}mE(>1(m~ZSTu0tqN$u(&O!&N&WdFYxB`g`-2OiKsUKmPmVnwCriV1 zbs0s;FTS~p@`=8=zF(&7yabh*It1>1DY-K9tFfjKh_9jn79;=7TlHxx(Kl1!VOKER zy0nreW6hF_o*JX{w;WXKDaWZ9ipnbtf!;P5nL9aIwT@Y?b^-S5M;^ zZt|=Wl(8yHYHT?L>59ta@+DFkyl9U6LU zW+F82cq;B>Zt>#mx=TY>Y|p&ICAUx7k%fL&KInMKAn)?Wv^$dEFtM9^T-a*^nVmXo z!dK`1S&yydtzvoettw}sJw-{0-TY5c#T9hA7E|W}RUIRX&py{P*bNiRr}*N7KpHkq z8&np8Rj*-nNl$Ixbe*3LTf!s6N!OS4$f?}pP8t;LQwX5{d46ldWG-i)%e9Wm1 z0+ltVFHXXdQ(AmWNA%3TQ!Yn(P}qeMMergtFqCg#@BI0{rtg;EnuQW^b@IVLv{3D? zQ@5=BJ+JQuWQEyv9>r!BVEYHPHMX++sCjrTeyofSkJn~ypL^Zwrm{%AYs{@V%-F_F zl-tQK5dxV!3N=m({SR-Q+uB$e7$*<6_J-__o?Yx~ujYHJlK<2;Xi848`(ZJlO!N+c ztXV)E1dM1MVqYyNsDdtXm@F78cAA-#^dVEC?8b)lrx1~%9zwU|GRLPehE~qbFO!#m zh9NDz9er8;X&Ja~R%a8juzr%g@5}^?6uS-E_T1ZEwVrB(0iYb#axd=aBn(?SlHdsH_#4OmpvAYv7XaAGP3;*ptTs0&IsEb$++%snKB-#L%r+IFx<8|#cicw z__4U2e+li-qgm)@)X-iz$=AYb0-9id#sqRsHmkW=*hICiOAP>l!y{#l>5RbnXNC$f z%rbrxce6cxiM|Je_Jccg8N~QDl2P)Vr&#mqdDCjx;1Q8>l)|$|wufg4Uzd*1?CQ|k z#CTM`zESzFYaW;Tap{PN!jF7Mf;<`@_Bm<<1p+Pfs;9+Hyn&V)LMP0Cc`DFG=%lf6 zZHiOLL-B1oo*1H(!7iJ!tl2rc+_esROpPVI`fCzrpcv7_;nL3c9zI?U{TYeTqOG{Z z`;3kDF|A^^*Q&M}V;`2(O(_DQpyQu=ShQJ36N0d^ekTrezLywH18|yejCE>jCfbjM zB2J8M@@*rl7{2?Q6Z@U4F52R}mPcD8V@B+wcfmOX?@f@~z{VU`01`u{$I}{kROo42 zG}8t4kb|ok8v2hJRUBgxX-=q#>U1Z+CFo=3rr1J1s3`ReYz271fPRw$*SdD)JR1L8 zawXU5`pflfyhWzP^R8fjmj+|~d4#-~ukfnRrb%+QG$?Fb)!i;PO-7*ow-f zM5ltyZ?VzJ7NymA1IVh%N9`ozwcGUg_wM-p`@`Ak_)1CAM$(P%( zTx!^`M4CXCk}%ZOL3)O|q!s4AkHk-wuM7wxh9xVe6N>zLy?`UK^SScL2N~kew$yF! zDl^lGNgH+>2?FM-Z8PO%t2f<-1_!;WcoC}qW{6)z;QfWw1a**$>D8ey0;lq<=$?|9 zXBrU2-K)()1*^Gt>X~jNU*^LoJnbwT7BAV$n+jSMAS8ur%DbeQVo?UWX+1;vPz!MH zL7pv-4E8j%6}x#?guNUXp>?LlwwhVzKQYd5zRm2h|GG1L-g*0%x_WA|oy%6Ssy@z8 zhG&iLrSyM8m%h;rmfwVb;usZ*YSHo0iV^#el>J?s{{8WaCYO_Bu35fxnz)0;rslxt zQqf;EPu&+U*khB|3Aa91d>UYo5N#eeF}$Cjvr!7mN#6<-M>`Rmnhu^sLdvh2t>E(sH#2gJg-(Y_V_oCOTU_kEsJ4s zG>^}09B&3HUx)W4Xh;WFk;vkRH2V-O8a9S6Xvo>vSso2~IImz(<8gDdldId19D>6( zffCs{wDBJ1I;;8Jj0&S%dacv)L3iEZIPCq&&>3sUORM=}(t5K4bHDnt_cX%{TJMH( z>er&%V8`9_?%KUiGG%%pm=(q?U} zb*J1A>gyYm*93u}K7jm5`YZ2#vh*8Q&bs-w=)+q8TZ=-MndNSul2OK^Sz#f6>(5L0 z4F1)Qe((O}prEurOs}ADD=6=0(4!>ZR%>(D_r1pLvRc=lP?;V=7A-71gD-lf6C`gg z+tw;>q|&0v=`C79Cpk-X{c3VuA9mL>q;*8!UzckJ!O3x$iCk~9AwmBIe-(bY|nl|4iPbr|Qq*)~D&Mgk5thhwss9?2%3V|)pxeSl;8KT(d*B^IY>`?=`s7IQz7c)J4 ze;&Nc<}D%hm0YqsOfZ)US?7kP8fIV7N&*{G0GY`HhIOU6A@^F#S2Z2whn6vyrN~3h z#r0p}j0Voy9=M=?b?Fy1`u~U)-C=LYDLmhr=$FHi!~Ltn`57PU3wzDBLqd1u<2hJF zOfl*1;&v8{mZapxZ|ZRxL2;ksLvzg>xr`BYVEYKdKHA34`-nJuf#Je?fY#dCs5xb_ zIvmJrpgHt0c;0=1J$`>|ewFRsPx2w(`TAF}4KuV^O*^??z+m$v(0_YY;vQ=K=XnAZ zmyT8UFXoU%$P!-Xw`R(7?0iyABK&gaxUIYt;2{k+ql4~*{{3Hv>)?^YWg2;;*}&Ie zAF<6>7dxisZV~5iY=zH(jX^}TInNoKcaFU>lP|=!Gtm3v@!jP%534xzMUq-OsM~HB zMR5>S4HwOxY3)&0C(+WL-sbWxJ_BrJN>x;;}|Fq!bkP-gFYT*{3tY=HcPC8q2of+FjpPjE@wc&c$ z(emTn^L6>b=~08{zk1fFe8Iz4{Ekib>RlBk=p#Xy~g9BxDKw)2D!DU{Aww z&sO)F&UxPn8O;oVcwN%+*L`U|QYpOW^4ZtjJJW}KExQTALEOVk8b3tiI}}M%?@oTe z*5qX{eK8HoaBBMP6I0w|50T&vZ(81hNAAD z^<)owT!V;@zP|pDF>o{Nj`KQI$X7<0yHfy%$a%JnhH5kG_hlHC%C6r&0RHf=qz`r- z{u##>B$C_pw(2S)>i~3K8Doz|CZ{i?)r*)b<>1#Fs2Yde?IrlV_UWoh78&~1FP;<7p#q}hXCR0A=$%OU~HwU;lZ=q?)oE|qo$+A zcPTM-lX^&em8_og;IXxg7&&tPTxfl`3P6JVV2`D-EKDWmQT^ZUuf8vgUvUu?JTeY~ z!Ye*K=x4u1&euwNQx>fyLQ15A#{HQ|bwXywTU0R);xX#!t z@L92zsU};3j#hoVVw!;`D?_|wPe!+m)5EG>d+hwfk)yYUpNa6j(_9YGXNO^{r>Jeu z{Nt%&n=Mr!eWX#2B=ZREaIf0{==rk+1$)NJ1&{r<+VplHkgyFEyK%}>&$NA51pA;U zmX~MFk`v?QBbV)!f`l%q`i#hoZ&MV+xB8Oq&1`&N*{`X%DJWannRV&2OUWJm#yStS zULMGaOv{Lhiw`lYSrQRn`RUYM%EPALocz?wVR0kX^-iZ_E7Me8U#HUhTh@D)^I(3? zvn~qBeRD;M-lnwGxpe>!dMWW*yhPrxh{E>PY<qHIxb2}|LI%z z@VhNOzk@yQgNP>M+%fD8Iz!(14ETkq&?4t`6{&rI9Q z4;^=m($WxX2H8s!^@sPwugCM7S5V#xPQxi_@?XJ2HPSgtR)ij*?84Bys@QnI%g2vG zIu+Y@{?PXDiGGSN^Wu2u?P6%n$PwqlKK?vVqD}e8o391W;-}5*^#-Rb%c9$CaUYTo z3Ayqk^vFjm4RtkcDa{8@eT+-LN7BwB&y1e8t8j0PzKMhEr<@3lW}xqfV9;yz zjaQhIfbCB=y#lTM0klPpEF(JpZWbWtl=Z0Ug%adm9L#*{gyLxS1ivLZpzd;Qt$Btl z&o88iR%6*F8YM+;`te%Af6nUe?b&)`l7TRlDZFQlb#r8xXmKea_ZJRJy&r&7aoJm2 z*q%u2g|WDOJ;IZawj!^lgyuYb%D}0i50BAIrWax>qG^s_8 zmTK#Eis$kzj}>88`OuSzLVEXIbuumVMrb6=cUQcTc+Xv>qh=pcFWe;6+tIvbEn~pE zC{E>xbPt3;8d>7Bo_5~aGkzC5@^Yzqo2GYX2y*Pwj{BzrYpI_Gg5CxERt)cZFnV_2 z_d3KNRp~d&IDPn-FV-LDIKbYq*To3)HrZATJZ3w6M`Y#i-29v;!KUay^nJBScy z@wxceJumP>{24;aby!4mm=~G4|KgNyGHG$x1K5^^a`aAg8;aX(?6n+TUj6p6KC4+> zeko!VkXaw?hAOday2i+@>PM8qE_&`%SjAno`}P=xU{oO zr-#7aG<3r`F(C8R&by~QzzOee`*(b;{*#x$UUH{uj+HcNxdTrfM|Ru2>7Yfa{5DwK z7ydcMFeW8>;d;zS**-+tsxRcu}ZO1>ym%0%4DOy)VrK#2a$UmImN2 zn7Pxg4yMYTZ_2z}wLJ0@p3B-DZ zpD-h4siiZ;x9{>ra}8Z7Ct0(&%50c?1i{uYQU!MJA9gxkKOyov&&|$)4uAxjdwZDB zvVQW{@-pCk2$~+7DeYJqA9wLx{}AX@swL5SxkHLQny8AZcb4S}nAsEKT`fn2Q!o!N z-!1?g>gcW?0|a*l7~TPPy+@2JUTUuzwF+HP6t^QtN5e1!PWvM~tWWH7--2J_-g;9p zG6o?jFOA|E+R?GKj$_L<`*>O>tRbL|uO4Kf%sx@QsN9L5u{YGK2vcxPyVV)b6U`hK zX~sZ@?HudbOZtBKDePF+1AU)!IB5EhNREpKNwsHW`rsvuSM?ofuB}@1CX4~k`<{T$ zx9YXohw&Zr-BC^U3sZf5!dW|1oB~foWnt$gn$k-V%{80!T!G4?nVmuhN>|NS_73wb z+M1H(WuJCWH#2?qn=OSx@^LldEFNiCES*umN%sm9?!8ui46Z9oKYjM{WsH!o@q~OR zmN>-Cm0vHxoLNku(wKuXBN~^-`?K$h`GMhaY1A_}AD6{xxtrg7UD(>6EQj6zZG)efN8k!+DQ4AM>5irQQ|8RKH%}q zgG+;n`u%!QU7uIbRk$sOGGVBp?Hz?+%dEGo5h6jok>pPxY1uc597Q5Wu_+&hJeqj( zcXnn2Q0N$HPq6ISZ2JeZYytZ1WyN~UEX2tfuubl#6L2byeMQGWus0Cp6!7%8>HZG% z&GILbeFl1BF&0sckcDc35I5_u(oul1({`suqZkzt3q(}C#bUw3*7sK)HdYi0q#hF8oqNH!*tbeP3(Byk-mYCD(aCTDtzz7Ttc>DLZ#mX+Ne|w-PN% zC0WzZ^E?M+GSGzt4Z4)euo&^t@_A79y3fj+y0r@=K4WveCnSX@__1;m+uphBx+J7w z^ryvf*FoF&kL4h^a0UMH`r@tyzu`BBDjxC-A9D2N-qEet$x@!7)H#=UYSAgQSERBY zszbttu5l3eh8uD08og9(zBwZA%EWYKxDnGru&nnD?0X>sSLJl`(%jF1ZnT#<225hI zh;|>icS|#!oe${)TS-PzT9ZBfSC{ljTLV!ZXgA52xOfIId_q9oF)7!CA3*@k&b8l<6V1Y?A zCzP;t;M&-cV1&Kc3CMtbo}`z;5oAJNMhxy?Nm8(BI?LghLP}I9+c0d~ro5T(HZC`2 z;u^9bQD0VS#!ye5tQ7_L_{U`2-Jbi$WRNe!lI>skM(xx!y98w~^vjmU?$q=8)jB{! zrW&Uw-GQA#*(LIEc0vgjj0-wxUiL!w0X^gblwfmZ&<1wm#{#8^{>*+Cd+_;gxe3>h z&(D3M{d~T;tl0&o`jy@|*uvvh5DQGgQDiR-e0N0HL#`DB2*Nks1uWd$NQ=be_`A)B zvqqoaT(QES*I0Ks{-NW5WW7?4lj}=VIADJFRU66TIM~Hlk8)#WjL8U0^0|^nQyCz* zMzbt)+blA2pdEeL5m-mF{?$-7-M}*Jw@QJa26d-%dDN>-h0OgH)Uj<*-xz1H`uj`S zFBVSfy)KPcpjxa?b{Dva`Wtn*+JqSSqgPt&JP%vAG%?4bnUmXkDgECO1dnp?Q3o#_ zJgm43y+9ir3__qds)=>8j*1l*XuTvCjua&rkBGsxnwT4vsh;g|Z|D1-4Ce`fE8Bp4 zT_wsCsga)+Llc75H{#5iU6XX6SR}kOY-BFl{j#`x4F|CeJW!@fj=ZckATTk^awg-{ z+%#b0mECJldjHP;2BZDVCPs1G!w+w7m@%Zvj;OV_X_%cRyf@P%(G<0C3vV!@X(+^P zQdZH_3^!ZinR%5dIfvEs!NspBJhRK~bsFSLuk?1<;CMtD;NHMy;Ae@0HIEIyh&aU0#AEAeTDN*lhP zDnHJV2ldbKYmZI#!emzZ8Clx;+v*ZaU@Vbix&w1W%i?#m09ua6uz*zR_V4C{t$m4Q zkvsgZZ{Hol+>9ms-dT=LBQ(2PUwzZZ(uHMjGiO`KZnE@R90qM3tAeG=_1tU?lx}1Q zHVwLObT+11SYNX{H?UGL+*&`QHop{C*i&=hZM+5kV6qWl8jIhCkv#i)%6)%x@)_{O z{r_SC=#0)QVrFs53qQ7B%6e*@58h7Zd`y}xO0O5lo3}gut-VZ?d87s`AcI5Gv%`3x z9yPx>#kY8uWdDZI% z>Bk7_@cVwdp@<$OxXT~CA}Mpr?H1}3ipg}kDFP5N$$cs&(2z#IolqQ`7HIl5zX3We zmw;@MGb)x6)rR)IAu`v*N%yovL*M|xnyRi!2-6WMwBKir!g@y^0Iklh3;HH3Y zBV1e@mz?_fT;_-`+y*UsBjNrFBJ25xRa?eFa79iVf4KJUPU@wzjNHyRSE>PJp#zz9 zHsOg2UiTW5y&Np}cKT`^o+Ie99^mQH zGe_ApLd-^6G21W@Rp%l){BnCXwsj1m#oqd&MeL6|n&))O&A+ZKpJMQ3xswxj%_ZdB z522^VU|GxPPZR5pAaqoaM_BDj1UlQNXdacwRz!SrZEy)}Iukp3{tHt5151P6Oo@iU zQ&R)gvYx8CR?;C2%0eF@oG0H?Ee^|zZkVC1;~EkG6ikAnGNj}r%4tc?fyRA^55A+F znxOekqE zkHq2ygj$|DWSYD=19-Ba9a5A|BBO-4|-+i>L|i! z?KRkBw>obEQmb^>7za_0yavP@x)`ApIyg50Lp`ts#ji7DUyuRlbzJ&U!{jlE zwfXlC)P&_fkHcAmjC+ZGM6XcZp7r@T4aWuIK%cfPTG|}e8kh_|L+b7zjN(*_#rmtEvlZ63kntV-%62_BHqF;4Wp_BVhVnN?y8ZhMu`z*X z6g-pfl4!E|<96Qj`KsZqgG?;Ea{uOB5yvP8BeOS>!#uW!jbk$x0LPv(adc0<6XP{I zNbnBH0tzF*QHcr^guxPz+LqdX*}3r76L>6H!r^3OMR!12yzX9t0rIk1pDW|e^3$L% zKDS1|6j#HhwAZWH!d|sB#T7@2L=Q^cikbVR;S>k!2i&gQSi$I`94&WT5ap(LW^2xF z4k|Yjf25$a^v)mUuqjWnA9Bz&*=bMv+n92Koc(sKxA{6#6c&PR2=hm*|(m zfT+kgdgI!;6JjCaCbOwuA7q^}Tfn(Bn9~gj(WZSPZ^BgL=6(mpo1>T&$Z5ssG@CG; z`vRI(lQ`Kyitg(Erm$8=wZVSxjJWtiKr}^|c;>HeCg#&*D$nZ3_FUsk>N*kdVkwA9 z(v>d6rF?ZGG-}AwDlblu)#`J~BUgQ|c|IZG=M+zUr>E6VD>mtFQ9rtR*G>G_Q2jgz`0fxo;J+u2v``=JbMy`;V`ht?AI|o@gY~c-dgX2k?Ou@6wxAW3 zBRm{FUblRG_jm3Q<{2(Rz)xB`qDfEwaouLLAs77>!A_s^_EY$b-9oapdqR?nR8R<&VKA;V!~WUE)5UA+tlCoXRI&Jw6Q5#=+7-xgHcQsF z97wKIr%;*64uYJLhyt8=%Ef(b92h^*KbDZ#uDAUlVk{F2ezG5D zKREO)<)O1xd=CB>3)$YO#@lpx7vJwZv7)OVBQ5!?T(tfA8|EdE`7lCtyHTXdjt8XP z7_ZhmR`xJW#)-xYVVhawBpZ`-6YwcO1(^I|Wy>1)7z(&~-9-Aj;qqqEa&%}rhGroktOtrl zjL|Hve@aiA{0n=--Xb$~@?%6Bn|WxNFR{l<;c}Uay{+HsC$U?_xM={~`ziwF5H2vH z=B#J5^}OI|^%_5qoM>Ai%GtxKmz|*yacs-u%gAa?_S5VVp|ABM{+Q(FF88Al>tLOt zWL!VY=_HiHE8;RFY#1#pH9N>mKp={su7eMH=?zHh5X@t-dPdj)46}QqJRWJ%%tCdp zK=U_x1xYzTLoNAkrZ#Ft$c2e0S2q5$-3vKlZ&Y{}Eo%19 z7R9|NBttk~7JXM6O_Vn0ktMZ?Hh1;DGVf=aRy5wfom!DrTe z5NGwp7gbsOfmpn>Ee&wBLVrzlU!NsQI)d2O;1gM@BYsJz&V`t>2j)Vs-R`AB`23i!dA3~dCKdzC))?%j zooH<45t5d4<6yBm_{0?Vd`9qMUpLw$#H_32;}@(d5&xq~)IK=;vD$rKv~M{{+_-b4 zKa>}(?HB$Ut6D0A*y7Vqf7_Qwu*NHoK(o}05n&~dCG5#iGlYInj(l!Vd{f~tG!(sG zpciI}Pk2i?dfC2(r&lHnPyq$T1RCLM^{NB}szuO4*4S$-9|G;ME)>~2rg z3-WO5rc2su0YMMWtYSUs_;TGYPbXq7)T%qtny=Gi(e+*g>jxqMNq9+o)5Hy5_X+?7$r_3SG8RZM)8G05(>37dRk#deRT=<=(Wt)`?eP_Bkl?FqZrTERK z(X9nflqzYABLuyT{&n`Hg6!ABIn8|6ewakrWlP-OKD^mU5giycr%j=3!vWsfBLp{M z9(ShtN|s7cT;WXTmvPcHaaZK01;rpH4btgx_^quiU(I;6(Mg+=Vtc;PZ0JaFp{kRy z$Ui&&_v*uWAr8}ed@&Ix6WilXDxZ?LX zJnCK>ny6Mu-r1f*IT=)t$4K+Fj0 zFcH~?*j`9ID3ILLmDvC?xxmr$sPdZ=zpjeBG9X0(cR^cA$)|R^BCJ{el<|GLVPA+0 zRT0{(NpC)IqapwkmR4Gd(yywbMl-uTRE^-^yq*4*T3>JM@}w)#+Ap@&ZOo0CC#*D` zrBJr#ylTLe-%;9oyTgd^O|4I_H1Bv;x?n?mwP&wY4ATRTbhPOSS?Vw}$qH7ml z2*l*_QkXxAZ)hIo7&S1g!6ECtTM+ttx#b!`8<~tt!^7X{+cW=h7n`Wqm%X&H#}UCD zDdztmyV#TgscH3$Z#`#@wCEhjsAER9J2??b3k}VSp07?1`vF=PZ}^sDTh<%`*R1Lb zXp~NKBpz|78Fv|=aRNxM`HOj6>9~o|ZZRwGUMZC~GxR!{t=>nbr%ot}*^6E)>zxP* zFcyj&jbk~A*@v=4-20_{-pszjuW7XC6MddP;`a9v!byZNYHhzuzJ@?(0~jfK^R(8g zS2RJ^r$0;aOGI8@A=DN?7> zgZ=ewN|mc&k!Z%K%PP>Z4NoV8=T9w7cG0c~yHuOK3D8RR{WOEQ(exIE zFH=ad-Wv_m0o1hZb+N+3I6w4QXhzN!*0sLH{kJijDh~HEjuW0+6U*AzY|oz7&THy+do6c;jr;J0g0#N;Tx<<@nyQOEw*L&~{^yGG`-0>2T%-BuI%~cOOzZnebvEj1rA4}-uAr4x zF&rECd+Vj2e>T2{iXM=t)m$A6u5%qJZaQ1E)!W}Ri<5nCxA^-cyWQ1tzvb*h$}To} z6c6JcOkY%T~t$%$~ul4==rxq=$Zth^pMz}8hlW0MhHpEoUL_s*?ydZ{Jv4P%jF z$SG*g=}Eo^0zPh^%je*_cH^vTtBS8fqea*zM|vSsN5ADAH!2!UZoMP2#1@ctHL&j+ z)s%AJ3LbHPaDs*EjPEvi*9b|vPNSS2>Ni#lg5lu_s;x&Jp2KYt)i)((Pv1$EeobS) z*}|3C;Qd|Mc4WqUEiX5V@DW>SYHuA@g02U@@BB9(8;ON2nm|AZEk|a zGrJTF)~z#-PRs2Lsr1jq&gWRu`Xo7Jd-iS0E-81k)ci`GyC=uMAJW5Q6r3Okt`dAb zF2LiQ&gi`5VXEiIu5YCN*++SCee;Fwy0d2gE>r!S`E*TAr@FpsOF%o@V!nehMPSc= zbqFh~t3KHn4hkZ3UYFrn3G5{so!0Fs(y(ftEn6Yq$-I>F3CoxQbl_ZbnLKXFf?5ul zyPxWE?7{%k*x39%mwVa9uSTv@H~Dy`rOXS4S(Xc4RdGx`h}oNJ{!X#suU)w| z;xxVxUK2dkEKyii%$5!0cin>fowv=@kWmXWAu|>{OSbN@m3iSXlPVy)h zUI^jwW24mrfhbg2y9b8sLYImG2Qb_S7<*^(5dwQuPs(9xZDl$dqEi=Sdd`41s7E=U z4|n^I;9)m7Ktut*`LO@JIb=ai<}DhF(^nv`!dg;6C2Lb-7l*be`m2pa+a^@B92#xZ zcw1PeY0|}}X&^7SYE&clOMQh>LGlS`Z4VM~$sGkEBLPp5GI&a7wzS&4JC#O>c|-7b*DXKQNJC z;Xrv)cx9z|Cy<-)mbG2E6AuRYue){fg}cLsmrV2Bm2{_BIsSuKdSYN=K5BrSUjnDe z&}GP81>)oheeli;4$Xxp_I7o&ani zXMDGBL1bh8hbCD6`89S{6uD}-JvFRSqdJWbF6fnN5!0)p7P|C=a(_iceCg*7>sc8Z zQqAwEb$*S~^ttf>wMEhDUxEUyGWIilAC?B%rsnpv?=K;b%&;wyPF{>R=_%z!i0wMb zzqRf^2}bPYt%fxun*eu82;~0h>5l*t)f~wvz!KzC+w*iRz~q1WUa(rtX!f7krvLmU z_HG&b>i?Z__WytLFLnMueg2>Mcd^bC$9R9qWBF}=xpC)piKG_0x+b3X1R#vIQ| z`mPqTzb8|YTF-?17V;<7JR3!}OnKOlqAe}f4W^Tf;R_Y(GmGsDhoGxRq2~w@^Sggr zvcA)atk`q2y)qJefc_meC1WnL-lw!v-lqIV@zP)XC%TC1?0DQrF!GK0OiwOsVmSz| zS`Pw#%7``%q6H(?>L0V!JMx~g0DAfk>aBsFIFClou$@YDGZA(Jo`GY#PZC_1onYCW zn1PEN?GMD+&DMe4BP&HtA&K_zufhlL!SUl4K9swPOEa18m0nPSp8w|e4)VcFp@MrKXN&g}bOa;T zk?9gNozzJ#Ns>e(WaZmcg5U{(Zx8EB2|xqtMrrhPZ>eE5gSYqI1EJQqd-Q}~$mYJm z#dDF|^~!tgnrZ%NGa)TM@QyMC2~tXb8(APE^%aLIX1bpc))zi?J|_ue#*J%{E(e~o z1$Z5~L~)T@DS&8}vIXfaEV-1_@ZC4L@RFkZgC$W6a0j~wP^l2BfHJ9jBB;KvYSZEu zpw-S918f&0ee_}nj|^?q6$@S~cpskSZx#R=v&3#hXSVB|y=3_it06BJ;}4QbGeHEk z%;u-rVaL*J!bG*0ilf$7KqaKs9XdaMd!u0bY3vCbY&#{a_2Z!xNOdE&A5thS=0lKq zZ85B^^eg5mo8}r9-sGctPHT&lpLizlnGNK?VEewfh10cgK;@`x=i`f8jsxYwbEqQ7 z!0lqbo(hg769H;ALK(g2ZW9b$fH6%^qGWxcdb`TO(hd(>c_~3JMNgNoOPx#%v@Cf0 zD_DTbP5E)Kw3OdGDqOsPdN|e+3 z+>B{$sH1^&3Q1hvg=ML>mq#1CQ_!@vrpkv>L$V^QxqSl`QVza{?n zmnVM(E%IMMYY%NHVbEKWtiO6hP*+2Qi=H&E%Q0Jx>h_Y?Tu*5Ggd7%ji8;Jm9Fq|D z^R<#QYQtIMz&xd<4$`xdJ{@A*j9>NbNH_QQYa_OS+cHgfy*ZyGS6GD<*;hw4oH(eK7DLrq_3^fsS{GC`RIBX(JluJENZYORLulSToo} zIr8o96=P$+&#|S&aApv<_#K({VO|2YPZYe;Rdt8_umtQdzeX#~jy#ek6I2z#wbmiH zVFNjfJ(g1W`$>zmR2i`LZkXS$B`dr?{L|5SCAQBieKo067p1`q*}9#D`j38j(l0i<*29%*S6=@tnQ z=?;e(VqOs#Lb^eE7#QjP=Joy7x7K&pU3c9-_nvd^dG@oPeb(9gqD%@s@1$8x-ZMJ& z+Mn-+m+ZL(;GQNqlx!~iVES4FhmK6&Uacz+W&EtO=-AGB^~Pz02{lQ%_Vvv6x6Rwo z09+kJHqN~9s*O`DUfaHsi#=}}ZwN_dlLF4itY|Cd1OI=6$$vnO0g(R`*b5HBnjWa9 z!0+L{#%&f^Myt01$oVB_+n^p2GCfsij8Y;!^gc(x4nwx-n=$a?TAb3FWRObmrf6Gv z6ZOI{DiEA&(VFAASz3!NFm6 zd#R#iSl1e*=)$`BQFI@_8Ef?J!t5mD)soG1O~cZPWFs{3cZeWf9pnfJbLo=C1{sT&A!!e=~uNrBdAz5j$D$H2Ig= zf@ySN!$|UCH$6dM`RbtNenXL{15Fo{{}-WThQJ}Tq3r6zWQK+9ub9z=LeXq9@fn#D z#h8B)qE|}(-#U;~*scI^&DRIS@1)qLlQl8PLF^DS`^qLq4Sp(K&1d~la#mpvy0MAL zKR4R`B$Bvm_8VnK8d%~Ep=1&1q{f8kpPtFPmeGsUOeZI(=U(@&1d6GJGY913L}FFS0vgYlK@A32p!IztkuNvQ#6Z1K$p$&c3zHNA zB@-9CtE=UucOFO}Cb%RnTjn9H3#{y4B1Ct&N1ezI$<|G?ZH5DhnhlfbyroZ{4#XS$ zdCDdlTnds_yEq~Uh;6N1xoZs+sn;%Zfg|n?+RLEePd`-CNgh6IAW+h15M`bIH1vYx zmC-{7QvU>+GG)O^YdzKwgU0L~ZLbb>mdQ0YhUMcI_(?RC)Wj-;UvNkoD(iakg7kGh zTRvqV{@66h&CKI@f9o_N$v1x{wIIgg-iIyTl82}5QV~VIiAVWc!O>$+vWa}b8Ma)) z(vYl`6{(@u4A9Y7sa&PyE~RaM+c2@192~%?(SE!Aw{X*Fbz%gfO29XrIe9!S=pyl; z`H-r}@AyrR#)3p^E1PrFIN`p0VJT$?vRXfgf3vv27Ei8bec zw=$#2yZce_>w)2$HCd$^4&P!jAI)tztzid8##fgKca8y60LhU*4Rr4lso9gsG@njj zb|MYv8+}rc8+JoI1X6lCysuI)&BFKX)7;z_4K?1mlBd%_Y+i+jv*6^{GTfBKPApCT zgvqCkd|bk>v$QgkmIC@1(bLJ1hWPCy*Vaj< zCS{UuUM>qjSmg4!Q1ai$Mw*%__e^PRBfhe339q7PfAs)2mqn-~a`Rd~_9AJAe+1RZ zbwnPlW*!(HHi{0v8lStAxWt2aSH)`a-guxH~+1r{uBxl*NTG72V*EI&pXoW94fZ z{bmeZMUW#IFnLQ{J4D z!3gOqU|K+NkqB-QLAnS~UXH$b97{xU$x_l${1TEJNFAz2I-o4%QGiTUAk$v#E(NKV+VOVCH!HU4XcS!{fspPF9{1--F&9Qd$FF3eD96h&k0?LF zy`QxD^s|2euyemfhgQSf0qAth3HAr*5=0tg1nI5MHVxfB17q2*@k+fze=_7qhvIul zMdw`L35=01(X2ug20EXxEnbW0tT4vak68D>Rgu4m?<~!5w`exE^rE-GbNSo8OQB5r zzIp!sr_xFxOndHxu}Kk`y&OeO21%QCnJcqS*-j#$WSc$_96{=#?|nmxdKGZpUoRx} zlP1?>ZNY`!kD}$W)#x9MsscOnNR0Ur4bi)v%DU*^fqTUr7HbXy{6r=VLC-4m7UO{* zdS`Yj&RZX?kq(Mq=Qs`-a=>ne!6iu|#jRwnn~#isJav`Q+z3?79^LE4n*XY>b7E>TJwAXhnpmSZcHoIkA{C!#zb>T+B|!{LlUw2(jO7$(H^tj zYU|B(wMRkcwhdoTL4GgD04xn>W$#c|`}uZ7P~16s-T>I>6ndpYaW}djT)R;38};=x z^1(-JQCdV*O^QG;R~1Oaqkc()!3z#!kxff~Yy}3+y+<@2Bz219YyA}jw zPwvIcio#J8f%;6nLhjd1|o!XA{wQh=9pi zogdmYI{z0-NN|dGxqj5=AyuS&Us3qX`3;K6dUC7sLa!`1$^x^HTib+Yu{~8QSbnb= zv}M*AyfQrQD={J@Do8Qf^6x(Uso*<2z4Qreg=>8AK@ z=NE$)zVjrWcpm$D`46+hNhO(fQWK4r*|PDiVrDBB8>B`fM}#9M($@GQS*8N~+1ium&?Hax?W_)x=Mk})% ziDk72`=q1mSG{|0MyzY(y%^BO`OAyju&fh%EABQ(`|h=|&akm3Z<~K`QutHp%rfo0 z$!0NaZ%D_86ay&baLfok2tgZK30qUi4;n+E=_f2<9C`B7H$TMOFF!gUT-HCPWmm155 zZAbWOj>K2)n!nUqB-OpW1n1OjqlyEWu8zUpHdHm$#?_sQ+vRnTV4VD{?HrE7qRt*e zL;Z+LK-<^twYf{tJ#}#N*3P39o{&w>ThdYE`dMWPIbf7rZZDM9M3)iwmC5l-}qCy-^VGm6dp9wAd|{0&z=XSQVHc z2xKuLHqJ#r{lH0Qj3hOSZ*O;pX&1g2%vv$^TIk-o>%-a{cy4J{Z+6c<-KYqC^1l^c zD*tpALcc*j|FyMt(Eel-<2A|cL(5ht(R|ajsEoqr52pxS;enl}bO-NK|8?_<(WKV* z|6zMrU+ZFZ#-U8ZYPbBAmX(IlZaLj8Zbs<-Kw*%L%6W{pu=rgWf?oEEMR3KKQFNc>-BI^oRI!RHmA}?q9|7_kyAncipiOHJT2X~d%mWO zQvY|N9eDp=cfyT)4>Pw8#K`s3o_Z}TH{aZMgZP_aJ2R;LvfgPnGr`{C+G>6olubCO z$271hwa+cl7tv_s{ttF!CV$`8S=3@Ao=;;38r-?!n=7x93*y zPgj@oXf50O6t>)WoU$=N0rf+;LLL!DePe_c|ote3{cPTX^ zr&uY5Bkdq1ubhVUfGi;;a7Eny`P$kICm2KVkNCP1@4DnEi@ldkV<%9I%M?FezkuyA z5!P(wi+J;|sTE}I;$)oF%HrzecM+1NI(Ti{YnC5h1bv*>f4G{G_5{r2d(1sG#%>5t zm?{`vTV~}FoHF|^9(}aWOzxDias`3?gepB$MbQvtunb&2js*kRpOi7i#PUVO2a*&* z9k1?Q6AGlmwAkMw#`!NVp2GSl&oBA|{j`ReqHREB2Kr((O^W9eR$Uge!!MhnE1WM+ zNDMK!=)h;hHU|cYi&IzhBeUyFIvYt8O(&qHlNErB5;hH>?abx`uwP6lvJw{Z`4Un9 zAesy&Xgnfz40*dUr`i=(ikXSMIJt)^WfRZyRPwI?b{b?yn{{bsk?a=O7%)0tHb5`4 zJ0?t_(#e;|<+Wkse6Ri9nToVhQ=Yb9)eoJ2t#|F)?8lW9&uYGpnQNDH%D@@w$SB&)M_W9PrCY1zR3BLhUu2 zfgarC$n|X6yVOvpOL~d9WYG{@-U)-7hKVSR^7;=hLvW9UyRM|uCA8?5F)y$fQPuRt zHbC3s5SrCMugMO-{6mm~J%d}jI0E!s!>RSTKhV;ywn=HcBQXURmo zcnF|(rw5?1KCI&&Hh@IhwnP?ob*RGs3Si~8CaruhvJE@jSeIO;xB=q(f)gsG>knz! z6!`dz7}lPbt@HLzUIG#Z^|JRoD873A%6jSkw)E(wXR zSJ=g^AaXkd!kSa~B~N|?S9=mAQhIxJyWDF$zwo!6()?@;28u1O2;Nbgjg5S;-%XeP zu{h`Of!9U4v+t*7b4Ih5j}~9G-^Yc?^eix37cR)X&zp<)Xu@@iol4^4i(L6#paVfEv#zMhR&+ zwmQM9Ts_tO)zJ)kysL}U59f78P27iQyn0x_emt_4$ej;nGs7}#W9dw5-F?x~bao3v` zuIy-DY#x`4GfXx-ZpFrJ(>TlmF+0nCxAD?Ys0HsgOfrCd0ykqDXHCWPk3fD2{)#;8 z?skAep*E$Ch7?%7rScBn4JdRVv^`xAG>odMTv6k?2`Lw71?%AQQx->JV2Y&AE+$ zR0h4>;JZc9wjJiB)Gq`B+(6ZKf`PX8%lTW{G`#oESShz;A&C~I*n)Tqml3~uh#l=Z z9u7?P-~;p)ZytxT?;m^kg?O)r&xX$wRg_K*K{}L8Yx%AJTQYby3WSkO9u+gIS@M9~ zyP#ecumsA&DyDz*x1L*JmQDlzofzvAtjoks4FBJWDYy3$F+k`T^V(!Jwn5suBJiyg zpxE}|?cP3I%%eBV#y)sn2Aw0)(($fyfx;_yR|n7dNsAPC@`IypPZT`3#q#NlJHA#; zZd=HVjI)g50eW7v(EiSR5FBLBR{OBT`&5!N>u|*3dfG)(D8Nj{(E)F8c-5L^KFGV+ zoAGQ8H+Q7Gl!z#wD|<&c%ENr2%CG#PXp6>SMH0b=sPWLMO-B?4x$)VU%uzZvOQcmN zqSxMMy5}B%XnmVAJ3LW3C}x|Sk@u&o`IDa+m|h3KSFPd>g7v^>;YF8AOtzQTYBVR# zEdAFK%b|>$iv9WRXuxgxMJOZYU;_xDPg4a9MMiXmS<21NrHxtDpEt&zHy1D(Hw4YD zRuMGK&TG9B5IOs}Qo)$b;jef`tPN%Ta@l1oA7A4-9M&G9^S|-<5{>h%taf1Y&?PY=cdsik;)H=#lx6V(7C-wU~ z&o3qu8O?#O;scwAGBk`#7B>+Rtw~q`d0^DK@HEw^=Ik`pV9N(X>Pe zvhP|XBNZ$fU+^W_nAPWLc`OJ9P1ye_KU^os8oZ9Pxt@oN9y`d!?=%9GsFQ6p+%~&Q z$Vz=id;(KJLCeu7yPde_Aa@ zAOG}0X$2EZ$Tdhg_HatI>ql&Evn3png&AP9T_HcMXD}UETMWwxZon!lEO=+y?z>Vt5w$4gZml^SJG)c*jkO2{q% literal 0 HcmV?d00001 diff --git a/metricbeat/docs/modules/cloudfoundry.asciidoc b/metricbeat/docs/modules/cloudfoundry.asciidoc index 3a8ba132280..4d153933c23 100644 --- a/metricbeat/docs/modules/cloudfoundry.asciidoc +++ b/metricbeat/docs/modules/cloudfoundry.asciidoc @@ -17,6 +17,22 @@ The cloudfoundry module metrics are numerical values that describe some aspect o The cloudfoundry module mericsets are `container`, `counter` and `value`. +[float] +=== Dashboards + +The Cloud Foundry module includes some dashboards. + +The overview dashboard can be used to visualize the current status of your Cloud +Foundry deployments. + +image::./images/metricbeat-cloudfoundry-overview.png[] + +The platform health dashboard includes visualizations that help diagnosting +issues related to the applications deployed in Cloud Foundry. + +image::./images/metricbeat-cloudfoundry-platform-health.png[] + + [float] === Module-specific configuration notes diff --git a/metricbeat/docs/modules_list.asciidoc b/metricbeat/docs/modules_list.asciidoc index 21f789dde86..bfe9052b8e6 100644 --- a/metricbeat/docs/modules_list.asciidoc +++ b/metricbeat/docs/modules_list.asciidoc @@ -60,7 +60,7 @@ This file is generated! See scripts/mage/docs_collector.go |<> |<> |<> -|<> beta[] |image:./images/icon-no.png[No prebuilt dashboards] | +|<> beta[] |image:./images/icon-yes.png[Prebuilt dashboards are available] | .3+| .3+| |<> beta[] |<> beta[] |<> beta[] diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc b/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc index b36a41bf891..4d908802358 100644 --- a/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/docs.asciidoc @@ -7,6 +7,22 @@ The cloudfoundry module metrics are numerical values that describe some aspect o The cloudfoundry module mericsets are `container`, `counter` and `value`. +[float] +=== Dashboards + +The Cloud Foundry module includes some dashboards. + +The overview dashboard can be used to visualize the current status of your Cloud +Foundry deployments. + +image::./images/metricbeat-cloudfoundry-overview.png[] + +The platform health dashboard includes visualizations that help diagnosting +issues related to the applications deployed in Cloud Foundry. + +image::./images/metricbeat-cloudfoundry-platform-health.png[] + + [float] === Module-specific configuration notes diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-overview.json b/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-overview.json new file mode 100644 index 00000000000..4d7fd18d965 --- /dev/null +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-overview.json @@ -0,0 +1,3992 @@ +{ + "objects": [ + { + "attributes": { + "description": "Overview of Cloud Foundry", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 2, + "i": "614e3c18-7b1d-4510-9308-a7c64077076b", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "614e3c18-7b1d-4510-9308-a7c64077076b", + "panelRefName": "panel_0", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Components health" + }, + "gridData": { + "h": 1, + "i": "efc5cc53-f0f5-4d09-850f-36baed6cea70", + "w": 15, + "x": 0, + "y": 2 + }, + "panelIndex": "efc5cc53-f0f5-4d09-850f-36baed6cea70", + "panelRefName": "panel_1", + "title": "Components health", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Job queue length" + }, + "gridData": { + "h": 7, + "i": "77151f90-5dd1-4c52-bbc8-eae071029c74", + "w": 14, + "x": 15, + "y": 2 + }, + "panelIndex": "77151f90-5dd1-4c52-bbc8-eae071029c74", + "panelRefName": "panel_2", + "title": "Job queue length", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top CPU usage" + }, + "gridData": { + "h": 13, + "i": "e3830a7f-00ba-4133-9be0-5bf881956830", + "w": 7, + "x": 29, + "y": 2 + }, + "panelIndex": "e3830a7f-00ba-4133-9be0-5bf881956830", + "panelRefName": "panel_3", + "title": "Top CPU usage", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top ephemeral disk usage" + }, + "gridData": { + "h": 13, + "i": "f9d0d4bf-f7b3-45f1-9bde-2ed389ecffe0", + "w": 6, + "x": 36, + "y": 2 + }, + "panelIndex": "f9d0d4bf-f7b3-45f1-9bde-2ed389ecffe0", + "panelRefName": "panel_4", + "title": "Top ephemeral disk usage", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top persistent disk usage" + }, + "gridData": { + "h": 13, + "i": "e00759d3-5853-4e0e-bb74-9c6be0f0cafe", + "w": 6, + "x": 42, + "y": 2 + }, + "panelIndex": "e00759d3-5853-4e0e-bb74-9c6be0f0cafe", + "panelRefName": "panel_5", + "title": "Top persistent disk usage", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "8ba21983-ee6b-464a-b9e6-083b8f9af911", + "w": 3, + "x": 0, + "y": 3 + }, + "panelIndex": "8ba21983-ee6b-464a-b9e6-083b8f9af911", + "panelRefName": "panel_6", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "ffb54b2e-36b9-477e-a722-96d4c4c6f493", + "w": 3, + "x": 3, + "y": 3 + }, + "panelIndex": "ffb54b2e-36b9-477e-a722-96d4c4c6f493", + "panelRefName": "panel_7", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "1695ac40-80fd-4164-8db3-41b31604c757", + "w": 3, + "x": 6, + "y": 3 + }, + "panelIndex": "1695ac40-80fd-4164-8db3-41b31604c757", + "panelRefName": "panel_8", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "8f111936-e953-45c2-859f-7adc28161741", + "w": 3, + "x": 9, + "y": 3 + }, + "panelIndex": "8f111936-e953-45c2-859f-7adc28161741", + "panelRefName": "panel_9", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "040843ca-cc51-4b6e-b15f-6cf8684ee63d", + "w": 3, + "x": 12, + "y": 3 + }, + "panelIndex": "040843ca-cc51-4b6e-b15f-6cf8684ee63d", + "panelRefName": "panel_10", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Outstanding requests" + }, + "gridData": { + "h": 7, + "i": "207fe6aa-ca8e-4931-abae-7c2b0f78cc1d", + "w": 14, + "x": 15, + "y": 9 + }, + "panelIndex": "207fe6aa-ca8e-4931-abae-7c2b0f78cc1d", + "panelRefName": "panel_11", + "title": "Outstanding requests", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "c4e3338c-f3d9-4c7d-bac7-e784f706bb57", + "w": 5, + "x": 0, + "y": 10 + }, + "panelIndex": "c4e3338c-f3d9-4c7d-bac7-e784f706bb57", + "panelRefName": "panel_12", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "30ed1180-cf4b-41b2-a60a-5332de7f6e46", + "w": 5, + "x": 5, + "y": 10 + }, + "panelIndex": "30ed1180-cf4b-41b2-a60a-5332de7f6e46", + "panelRefName": "panel_13", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "d77bfe2e-7057-4cfb-829b-c4011640ae2d", + "w": 5, + "x": 10, + "y": 10 + }, + "panelIndex": "d77bfe2e-7057-4cfb-829b-c4011640ae2d", + "panelRefName": "panel_14", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "b1ba0667-de29-4458-95d6-49217a6875cb", + "w": 5, + "x": 0, + "y": 15 + }, + "panelIndex": "b1ba0667-de29-4458-95d6-49217a6875cb", + "panelRefName": "panel_15", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "ff23d11d-8396-4245-a334-ddafc5cbc198", + "w": 5, + "x": 5, + "y": 15 + }, + "panelIndex": "ff23d11d-8396-4245-a334-ddafc5cbc198", + "panelRefName": "panel_16", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 5, + "i": "ee0d79d3-92f8-4360-b724-e9ebfd73b53e", + "w": 5, + "x": 10, + "y": 15 + }, + "panelIndex": "ee0d79d3-92f8-4360-b724-e9ebfd73b53e", + "panelRefName": "panel_17", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "GoRouter latency PAS" + }, + "gridData": { + "h": 8, + "i": "da31ae1e-e713-4d4f-b225-59824b203797", + "w": 19, + "x": 29, + "y": 15 + }, + "panelIndex": "da31ae1e-e713-4d4f-b225-59824b203797", + "panelRefName": "panel_18", + "title": "GoRouter latency PAS", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Diego cell time to sync" + }, + "gridData": { + "h": 7, + "i": "a7138e23-fa21-42b8-8d09-d124c2640293", + "w": 14, + "x": 15, + "y": 16 + }, + "panelIndex": "a7138e23-fa21-42b8-8d09-d124c2640293", + "panelRefName": "panel_19", + "title": "Diego cell time to sync", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 3, + "i": "2b4f53d8-a91c-447d-a8e4-f94589abe07f", + "w": 7, + "x": 0, + "y": 20 + }, + "panelIndex": "2b4f53d8-a91c-447d-a8e4-f94589abe07f", + "panelRefName": "panel_20", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 3, + "i": "fdd1c5d5-bd8f-41db-8d16-9d0b8adcb3a4", + "w": 8, + "x": 7, + "y": 20 + }, + "panelIndex": "fdd1c5d5-bd8f-41db-8d16-9d0b8adcb3a4", + "panelRefName": "panel_21", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Maximum CPU utilization" + }, + "gridData": { + "h": 10, + "i": "e2291bb2-2b6d-452b-8bb0-652ed6b4ea7b", + "w": 7, + "x": 0, + "y": 23 + }, + "panelIndex": "e2291bb2-2b6d-452b-8bb0-652ed6b4ea7b", + "panelRefName": "panel_22", + "title": "Maximum CPU utilization", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Available disk space" + }, + "gridData": { + "h": 10, + "i": "5db37b04-577a-4703-a8ef-07d70299023e", + "w": 8, + "x": 7, + "y": 23 + }, + "panelIndex": "5db37b04-577a-4703-a8ef-07d70299023e", + "panelRefName": "panel_23", + "title": "Available disk space", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Available memory by cell" + }, + "gridData": { + "h": 10, + "i": "dfb10794-82ba-4da3-80b7-5e4aa82dfd5c", + "w": 14, + "x": 15, + "y": 23 + }, + "panelIndex": "dfb10794-82ba-4da3-80b7-5e4aa82dfd5c", + "panelRefName": "panel_24", + "title": "Available memory by cell", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Total routes in GoRouter" + }, + "gridData": { + "h": 10, + "i": "a6c34327-7e71-4bf3-a057-f43de540247c", + "w": 19, + "x": 29, + "y": 23 + }, + "panelIndex": "a6c34327-7e71-4bf3-a057-f43de540247c", + "panelRefName": "panel_25", + "title": "Total routes in GoRouter", + "version": "7.9.0" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-15m", + "timeRestore": true, + "timeTo": "now", + "title": "[Metricbeat Cloud Foundry] Overview", + "version": 1 + }, + "id": "9c81cf34-f84e-11ea-a49d-f3f94f5e4fac", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "435133e4-f8d2-11ea-a49e-d36460a01dbe", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "9ca39c36-f84e-11ea-9b0e-af32e8072a87", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "9ca9737c-f84e-11ea-b8a5-9f245d6f7121", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "9c9f12b0-f84e-11ea-bfe0-8f64de3dbbbd", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "9c5e5c7a-f84e-11ea-9c79-3f5f46484ce3", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "9c975020-f84e-11ea-9d35-0ba5b289cee7", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "9caafdaa-f84e-11ea-8c78-43aac4b09aa5", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "9c7b602c-f84e-11ea-8762-e7aef60b5522", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "9cb33038-f84e-11ea-8929-07701f2b1c26", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "9ca526aa-f84e-11ea-aad5-ef2777854f3d", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "9caf798e-f84e-11ea-ac4b-4795663aee6b", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "9cbb8cd8-f84e-11ea-9a20-af708256c3a9", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "9c69684a-f84e-11ea-bf59-4bba486da283", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "9c93270c-f84e-11ea-8b23-c7a1cc31369e", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "9c7328ee-f84e-11ea-9259-772ddb1805fb", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "9c99314c-f84e-11ea-92d5-9bcd6abdce0f", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "9c635824-f84e-11ea-9b02-735b8407166a", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "9caddb24-f84e-11ea-b008-df9bd2aed7cc", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "9c58b248-f84e-11ea-87a9-67d346210280", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "9ca805fa-f84e-11ea-ab90-2b00dd50450c", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "9c89336e-f84e-11ea-bbcd-23e329286ac7", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "9c9d9c14-f84e-11ea-a575-a30e017a09e9", + "name": "panel_21", + "type": "visualization" + }, + { + "id": "9c8ed8fa-f84e-11ea-b20d-bb82d7a8e05d", + "name": "panel_22", + "type": "visualization" + }, + { + "id": "9c948fb6-f84e-11ea-96f5-dff115716ba4", + "name": "panel_23", + "type": "visualization" + }, + { + "id": "9cac69e2-f84e-11ea-b8d4-4b40313a5eb0", + "name": "panel_24", + "type": "visualization" + }, + { + "id": "9c77cf84-f84e-11ea-a3ff-7f7f73eabd57", + "name": "panel_25", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2020-09-17T10:38:25.337Z", + "version": "WzE5MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Dashboards Navigation Overview [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 12, + "markdown": "**Overview** | [Platform Health](#/dashboard/94364424-f851-11ea-8206-7b08cd60917a)", + "openLinksInNewTab": false + }, + "title": "Dashboards Navigation [Metricbeat Cloud Foundry]", + "type": "markdown" + } + }, + "id": "435133e4-f8d2-11ea-a49e-d36460a01dbe", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:37:54.081Z", + "version": "WzE4MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Components health title [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 12, + "markdown": "", + "openLinksInNewTab": false + }, + "title": "Components health title [Metricbeat Cloud Foundry]", + "type": "markdown" + } + }, + "id": "9ca39c36-f84e-11ea-9b0e-af32e8072a87", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk0LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Job Queue [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"cc\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(188,0,19,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"failed_job_count.total\" " + }, + "formatter": "number", + "hide_in_legend": 1, + "id": "9c9054dc-f84e-11ea-920b-1f1a72488310", + "label": "Avg Failed Job Count", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c91bfd4-f84e-11ea-a2df-b7ca8c11c9b1", + "type": "avg" + } + ], + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "terms", + "stacked": "none", + "terms_field": "cloudfoundry.envelope.deployment", + "type": "timeseries" + }, + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"job_queue_length.total\" " + }, + "formatter": "number", + "hide_in_legend": 1, + "id": "9c837802-f84e-11ea-8b5e-ef886d2383c6", + "label": "Avg Job Queue Length", + "line_width": 1, + "metrics": [ + { + "id": "9c84e098-f84e-11ea-b8dc-ff0b80823e94", + "type": "count" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "terms", + "stacked": "none", + "terms_field": "cloudfoundry.value.value", + "terms_order_by": "_count" + } + ], + "show_grid": 1, + "show_legend": 0, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Job queue [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9ca9737c-f84e-11ea-b8a5-9f245d6f7121", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk1LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell Top CPU user usage [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "bar_color": "rgba(104,188,0,1)", + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401", + "operator": "lt", + "value": 65 + }, + { + "bar_color": "rgba(252,220,0,1)", + "id": "9c87c1f0-f84e-11ea-abf6-9bcf7a4dd500", + "operator": "gte", + "value": 65 + }, + { + "bar_color": "rgba(244,78,59,1)", + "id": "9c95f1b2-f84e-11ea-9ca9-53ceca17b640", + "operator": "gt", + "value": 75 + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drilldown_url": "", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.cpu.user\" " + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max CPU utilization (Load)", + "line_width": "2", + "metrics": [ + { + "agg_with": "avg", + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "order": "desc", + "size": 1, + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.job", + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "top_n" + }, + "title": "Top CPU user usage [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c9f12b0-f84e-11ea-bfe0-8f64de3dbbbd", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk2LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Top ephemeral disk usage [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "bar_color": "rgba(104,188,0,1)", + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401", + "operator": "lt", + "value": 65 + }, + { + "bar_color": "rgba(252,220,0,1)", + "id": "9c87c1f0-f84e-11ea-abf6-9bcf7a4dd500", + "operator": "gte", + "value": 65 + }, + { + "bar_color": "rgba(244,78,59,1)", + "id": "9c95f1b2-f84e-11ea-9ca9-53ceca17b640", + "operator": "gt", + "value": 75 + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drilldown_url": "", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.disk.ephemeral.percent\" " + }, + "formatter": "00.00", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Top Max Ephemeral Disk Usage (%)", + "line_width": "2", + "metrics": [ + { + "agg_with": "avg", + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "order": "desc", + "size": 1, + "type": "max" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.job", + "terms_include": "", + "terms_order_by": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "timeseries", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "top_n" + }, + "title": "Top ephemeral disk usage [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c5e5c7a-f84e-11ea-9c79-3f5f46484ce3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk3LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Top persistent disk usage [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "bar_color": "rgba(104,188,0,1)", + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401", + "operator": "lt", + "value": 65 + }, + { + "bar_color": "rgba(252,220,0,1)", + "id": "9c87c1f0-f84e-11ea-abf6-9bcf7a4dd500", + "operator": "gte", + "value": 65 + }, + { + "bar_color": "rgba(244,78,59,1)", + "id": "9c95f1b2-f84e-11ea-9ca9-53ceca17b640", + "operator": "gt", + "value": 75 + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drilldown_url": "", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.disk.persistent.percent\" " + }, + "formatter": "00.00", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Top Max Ephemeral Disk Usage (%)", + "line_width": "2", + "metrics": [ + { + "agg_with": "avg", + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "order": "desc", + "size": 1, + "type": "max" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.job", + "terms_include": "", + "terms_order_by": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "timeseries", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "top_n" + }, + "title": "Top persistent disk usage [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c975020-f84e-11ea-9d35-0ba5b289cee7", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk4LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Doppler health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 1 + }, + { + "id": "9c6cce9a-f84e-11ea-9fea-039104d18522", + "operator": "lt", + "value": 1 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\" and cloudfoundry.envelope.job :\"doppler\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.healthy\"" + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Doppler", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "metric" + }, + "title": "Doppler health [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9caafdaa-f84e-11ea-8c78-43aac4b09aa5", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "Wzk5LDFd" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Router health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 1 + }, + { + "id": "9c6cce9a-f84e-11ea-9fea-039104d18522", + "operator": "lt", + "value": 1 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\" and cloudfoundry.envelope.job :\"router\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.healthy\"" + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Router", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Router health [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c7b602c-f84e-11ea-8762-e7aef60b5522", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Backup-Restore health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 1 + }, + { + "id": "9c6cce9a-f84e-11ea-9fea-039104d18522", + "operator": "lt", + "value": 1 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\" and cloudfoundry.envelope.job :\"backup_restore\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.healthy\"" + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Backup-Restore", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Backup-Restore health [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9cb33038-f84e-11ea-8929-07701f2b1c26", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego Brain health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 1 + }, + { + "id": "9c6cce9a-f84e-11ea-9fea-039104d18522", + "operator": "lt", + "value": 1 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\" and cloudfoundry.envelope.job :\"diego_brain\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.healthy\"" + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Diego Brain", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego Brain health [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9ca526aa-f84e-11ea-aad5-ef2777854f3d", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 1 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": null, + "id": "9c6cce9a-f84e-11ea-9fea-039104d18522", + "operator": "lt", + "value": 1 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9cb7224c-f84e-11ea-aedc-27587a803e41", + "operator": "lt", + "value": 0.5 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\" and cloudfoundry.envelope.job :\"diego_cell\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.healthy\"" + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Diego cell", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell health [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9caf798e-f84e-11ea-ac4b-4795663aee6b", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwMywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Outstanding Requests [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"cc\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"requests.outstanding\"" + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Avg Oustanding Requests", + "line_width": "1", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Outstanding Requests [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9cbb8cd8-f84e-11ea-9a20-af708256c3a9", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell time to sync [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "lt", + "value": 10000000000 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "gte", + "value": 10000000000 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "gt", + "value": 15000000000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: cloudfoundry and cloudfoundry.envelope.origin :\"rep\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"RepBulkSyncDuration\"" + }, + "formatter": "ns,s,2", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max Cell Rep Time to Sync", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "max" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} s" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell time to sync [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c69684a-f84e-11ea-bf59-4bba486da283", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell Missing LRPs [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "lt", + "value": 5 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "gte", + "value": 5 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "gt", + "value": 10 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"bbs\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"LRPsMissing\" " + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max Missing LRPs", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell Missing LRPs [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c93270c-f84e-11ea-8b23-c7a1cc31369e", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell fetch state times [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "lt", + "value": 5000000000 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "gte", + "value": 5000000000 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "gt", + "value": 10000000000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"auctioneer\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"AuctioneerFetchStatesDuration\" " + }, + "formatter": "ns,s,", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max fetch cell state times", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "max" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell fetch state times [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c7328ee-f84e-11ea-9259-772ddb1805fb", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell Apps domain freshness [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gte", + "value": 0.9 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "lte", + "value": 0.9 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "lt", + "value": 0.8 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"bbs\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Domain.cf-apps\" " + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Avg 'cf-apps' Domain Freshness", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": null, + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego-cell Apps domain freshness [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c99314c-f84e-11ea-92d5-9bcd6abdce0f", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwOCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell Router emitter sync duration [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "lt", + "value": 10000000000 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "gte", + "value": 10000000000 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "gt", + "value": 20000000000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"route_emitter\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"RouteEmitterSyncDuration\" " + }, + "formatter": "ns,s,", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max Router emitter sync duration", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "max" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} s" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell Router emitter sync duration [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c635824-f84e-11ea-9b02-735b8407166a", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzEwOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell convergence LRP duration [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(104,188,0,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "lt", + "value": 10000000000 + }, + { + "background_color": "rgba(252,220,0,1)", + "id": "9cb134b8-f84e-11ea-9fd8-cb6a1b33696f", + "operator": "gte", + "value": 10000000000 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9cb588d8-f84e-11ea-af5a-c3012766d944", + "operator": "gt", + "value": 20000000000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"bbs\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"ConvergenceLRPDuration\" " + }, + "formatter": "ns,s,", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max Convergence LRP Duration", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "max" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cf.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} s" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Diego cell convergence LRP duration [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9caddb24-f84e-11ea-b008-df9bd2aed7cc", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "GoRouter latency PAS [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"gorouter\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(123,100,255,1)", + "fill": "0.2", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"latency\"" + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "GoRouter latency", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} ms" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "GoRouter latency PAS [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c58b248-f84e-11ea-87a9-67d346210280", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell rep time to sync [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"rep\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"RepBulkSyncDuration\"" + }, + "formatter": "ns,ms,2", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Cell Rep Time to Sync", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.deployment", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} ms" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Diego cell rep time to sync [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9ca805fa-f84e-11ea-ab90-2b00dd50450c", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell total disk [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "9c8666fc-f84e-11ea-a43e-0f7a3a14396c" + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"rep\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"CapacityTotalDisk\" " + }, + "formatter": "0,0", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Total Disk", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.ip", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}} MiB" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "metric" + }, + "title": "Diego cell total disk [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c89336e-f84e-11ea-bbcd-23e329286ac7", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExMywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell total memory [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "9c8666fc-f84e-11ea-a43e-0f7a3a14396c" + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"rep\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"CapacityTotalMemory\" " + }, + "formatter": "bytes", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Total Memory", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + }, + { + "id": "9c9ac4da-f84e-11ea-8efa-7393d43821d0", + "script": "params.megabytes * 1024 * 1024", + "type": "math", + "variables": [ + { + "field": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "id": "9c9c36e4-f84e-11ea-bba1-abb4ba65473f", + "name": "megabytes" + } + ] + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.value.value", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "metric" + }, + "title": "Diego cell total memory [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c9d9c14-f84e-11ea-a575-a30e017a09e9", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell CPU utilization load [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"bosh-system-metrics-forwarder\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.cpu.user\" " + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Max CPU utilization Load", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "max" + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": null, + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Diego cell CPU utilization load [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c8ed8fa-f84e-11ea-b20d-bb82d7a8e05d", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell remaining disk [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "9c8666fc-f84e-11ea-a43e-0f7a3a14396c" + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin : \"rep\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(115,216,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"CapacityRemainingDisk\" " + }, + "formatter": "bytes", + "hidden": false, + "hide_in_legend": 1, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Remaining Disk", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + }, + { + "id": "9c79728a-f84e-11ea-a0b0-cbbc2af24ed3", + "script": "params.megabytes * 1024 * 1024", + "type": "math", + "variables": [ + { + "field": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "id": "9c8030c0-f84e-11ea-acf6-13a6b4ddcd67", + "name": "megabytes" + } + ] + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.ip", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Diego cell remaining disk [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c948fb6-f84e-11ea-96f5-dff115716ba4", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Diego cell available memory by cell [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"rep\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"CapacityRemainingMemory\"" + }, + "formatter": "bytes", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Available memory by cell", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "avg" + }, + { + "id": "9ca088ac-f84e-11ea-86ca-0f96c7565718", + "script": "params.megabytes*1024*1024", + "type": "math", + "variables": [ + { + "field": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "id": "9ca214c4-f84e-11ea-a6d7-0b115dba93eb", + "name": "megabytes" + } + ] + } + ], + "offset_time": "", + "point_size": "4", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_direction": "asc", + "terms_field": "cloudfoundry.envelope.ip", + "terms_include": "", + "terms_order_by": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 0, + "show_legend": 0, + "time_field": "@timestamp", + "tooltip_mode": "show_all", + "type": "timeseries" + }, + "title": "Diego cell available memory by cell [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9cac69e2-f84e-11ea-b8d4-4b40313a5eb0", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "GoRouter total routes [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "9c7cf130-f84e-11ea-bdee-833d96fe1a00", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9cb8a18a-f84e-11ea-bd11-836ecccfc401" + } + ], + "default_index_pattern": "metricbeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and cloudfoundry.envelope.origin :\"gorouter\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "9ca68d56-f84e-11ea-a6bb-f3164c0bb859", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "9c8aab7c-f84e-11ea-b4a3-e31a518913fa", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(123,100,255,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"total_routes\"" + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "9c8c18f4-f84e-11ea-97ff-b32117553dae", + "label": "Total routes (ISO)", + "line_width": "01", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9c8d7514-f84e-11ea-9457-93fdc9395544", + "type": "sum" + } + ], + "offset_time": "", + "point_size": "1.5", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9c753c7e-f84e-11ea-96e9-33ff984da2c7", + "label": "" + } + ], + "split_mode": "terms", + "stacked": "none", + "steps": 0, + "terms_field": "cloudfoundry.envelope.index", + "terms_include": "", + "terms_order_by": "_key", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "GoRouter total routes [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9c77cf84-f84e-11ea-a3ff-7f7f73eabd57", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:06.273Z", + "version": "WzExOCwxXQ==" + } + ], + "version": "7.9.0" +} diff --git a/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-platform-health.json b/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-platform-health.json new file mode 100644 index 00000000000..e95d7a62450 --- /dev/null +++ b/x-pack/metricbeat/module/cloudfoundry/_meta/kibana/7/dashboard/Metricbeat-cloudfoundry-platform-health.json @@ -0,0 +1,4385 @@ +{ + "objects": [ + { + "attributes": { + "description": "Cloud Foundry platform health", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 8, + "i": "1", + "w": 4, + "x": 15, + "y": 2 + }, + "panelIndex": "1", + "panelRefName": "panel_0", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 9, + "i": "8", + "w": 5, + "x": 38, + "y": 36 + }, + "panelIndex": "8", + "panelRefName": "panel_1", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 9, + "i": "9", + "w": 5, + "x": 33, + "y": 36 + }, + "panelIndex": "9", + "panelRefName": "panel_2", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 9, + "i": "11", + "w": 5, + "x": 43, + "y": 36 + }, + "panelIndex": "11", + "panelRefName": "panel_3", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 8, + "i": "13", + "w": 15, + "x": 0, + "y": 2 + }, + "panelIndex": "13", + "panelRefName": "panel_4", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "14", + "w": 7, + "x": 26, + "y": 10 + }, + "panelIndex": "14", + "panelRefName": "panel_5", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "15", + "w": 7, + "x": 19, + "y": 23 + }, + "panelIndex": "15", + "panelRefName": "panel_6", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "16", + "w": 5, + "x": 0, + "y": 27 + }, + "panelIndex": "16", + "panelRefName": "panel_7", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "17", + "w": 5, + "x": 10, + "y": 27 + }, + "panelIndex": "17", + "panelRefName": "panel_8", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "18", + "w": 5, + "x": 5, + "y": 27 + }, + "panelIndex": "18", + "panelRefName": "panel_9", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Applications availability" + }, + "gridData": { + "h": 10, + "i": "19", + "w": 19, + "x": 0, + "y": 17 + }, + "panelIndex": "19", + "panelRefName": "panel_10", + "title": "Applications availability", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 8, + "i": "26", + "w": 14, + "x": 19, + "y": 2 + }, + "panelIndex": "26", + "panelRefName": "panel_11", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Director health check" + }, + "gridData": { + "h": 9, + "i": "28", + "w": 14, + "x": 19, + "y": 36 + }, + "panelIndex": "28", + "panelRefName": "panel_12", + "title": "Director health check", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Test results" + }, + "gridData": { + "h": 12, + "i": "29", + "w": 19, + "x": 0, + "y": 33 + }, + "panelIndex": "29", + "panelRefName": "panel_13", + "title": "Test results", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top CPU user deployment" + }, + "gridData": { + "h": 16, + "i": "30", + "w": 15, + "x": 33, + "y": 2 + }, + "panelIndex": "30", + "panelRefName": "panel_14", + "title": "Top CPU user deployment", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "Top persistent disk deployment" + }, + "gridData": { + "h": 18, + "i": "31", + "w": 15, + "x": 33, + "y": 18 + }, + "panelIndex": "31", + "panelRefName": "panel_15", + "title": "Top persistent disk deployment", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "36", + "w": 7, + "x": 19, + "y": 10 + }, + "panelIndex": "36", + "panelRefName": "panel_16", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "37", + "w": 7, + "x": 26, + "y": 23 + }, + "panelIndex": "37", + "panelRefName": "panel_17", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "38", + "w": 4, + "x": 24, + "y": 17 + }, + "panelIndex": "38", + "panelRefName": "panel_18", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "39", + "w": 4, + "x": 24, + "y": 30 + }, + "panelIndex": "39", + "panelRefName": "panel_19", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "41", + "w": 5, + "x": 19, + "y": 30 + }, + "panelIndex": "41", + "panelRefName": "panel_20", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "42", + "w": 5, + "x": 28, + "y": 30 + }, + "panelIndex": "42", + "panelRefName": "panel_21", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "43", + "w": 5, + "x": 28, + "y": 17 + }, + "panelIndex": "43", + "panelRefName": "panel_22", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "44", + "w": 5, + "x": 19, + "y": 17 + }, + "panelIndex": "44", + "panelRefName": "panel_23", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "46", + "w": 5, + "x": 0, + "y": 10 + }, + "panelIndex": "46", + "panelRefName": "panel_24", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "47", + "w": 5, + "x": 10, + "y": 10 + }, + "panelIndex": "47", + "panelRefName": "panel_25", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "48", + "w": 5, + "x": 5, + "y": 10 + }, + "panelIndex": "48", + "panelRefName": "panel_26", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 2, + "i": "f770c0d9-bc9a-4250-ad73-35a8cae0bcda", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "f770c0d9-bc9a-4250-ad73-35a8cae0bcda", + "panelRefName": "panel_27", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 7, + "i": "8a83ab84-5aa6-4e68-97cc-fd8be2b65eb5", + "w": 4, + "x": 15, + "y": 10 + }, + "panelIndex": "8a83ab84-5aa6-4e68-97cc-fd8be2b65eb5", + "panelRefName": "panel_28", + "version": "7.9.0" + }, + { + "embeddableConfig": { + "title": "" + }, + "gridData": { + "h": 6, + "i": "fbd35912-3c3a-4ab9-878c-b68b598df8f0", + "w": 4, + "x": 15, + "y": 27 + }, + "panelIndex": "fbd35912-3c3a-4ab9-878c-b68b598df8f0", + "panelRefName": "panel_29", + "version": "7.9.0" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-1h", + "timeRestore": true, + "timeTo": "now", + "title": "[Metricbeat Cloud Foundry] Platform Health", + "version": 1 + }, + "id": "94364424-f851-11ea-8206-7b08cd60917a", + "migrationVersion": { + "dashboard": "7.3.0" + }, + "namespaces": [ + "default" + ], + "references": [ + { + "id": "93acc294-f851-11ea-a97a-53f837470423", + "name": "panel_0", + "type": "visualization" + }, + { + "id": "93f27abe-f851-11ea-90c1-670adf08e026", + "name": "panel_1", + "type": "visualization" + }, + { + "id": "93d1bce8-f851-11ea-9e6c-e3a6ffa65309", + "name": "panel_2", + "type": "visualization" + }, + { + "id": "93f86eec-f851-11ea-9ae8-ff70f6c28f02", + "name": "panel_3", + "type": "visualization" + }, + { + "id": "93f59bb8-f851-11ea-ab86-6757c64f8446", + "name": "panel_4", + "type": "visualization" + }, + { + "id": "93d3c40c-f851-11ea-ab6c-2b7686d129ce", + "name": "panel_5", + "type": "visualization" + }, + { + "id": "93edb394-f851-11ea-af40-bbda53487783", + "name": "panel_6", + "type": "visualization" + }, + { + "id": "9398519c-f851-11ea-9d16-0345f5e91a95", + "name": "panel_7", + "type": "visualization" + }, + { + "id": "93c2c184-f851-11ea-93fb-fb88ecfdafdb", + "name": "panel_8", + "type": "visualization" + }, + { + "id": "94200db2-f851-11ea-a8fa-9bfadc17852f", + "name": "panel_9", + "type": "visualization" + }, + { + "id": "93d9d39c-f851-11ea-b957-3f002cacae67", + "name": "panel_10", + "type": "visualization" + }, + { + "id": "939a9380-f851-11ea-9a72-a3f185bef2c4", + "name": "panel_11", + "type": "visualization" + }, + { + "id": "943dcad2-f851-11ea-8923-93b64d3cea46", + "name": "panel_12", + "type": "visualization" + }, + { + "id": "93c03f18-f851-11ea-8da1-eb649369fefa", + "name": "panel_13", + "type": "visualization" + }, + { + "id": "9430406a-f851-11ea-a96e-efef958606c3", + "name": "panel_14", + "type": "visualization" + }, + { + "id": "93fd890e-f851-11ea-96db-8342eb689011", + "name": "panel_15", + "type": "visualization" + }, + { + "id": "93dcb238-f851-11ea-8c49-fb9deba7fc48", + "name": "panel_16", + "type": "visualization" + }, + { + "id": "93e0d7d2-f851-11ea-a8ea-ab5761cc3b1c", + "name": "panel_17", + "type": "visualization" + }, + { + "id": "94402c0a-f851-11ea-b3d4-f3815d5ef910", + "name": "panel_18", + "type": "visualization" + }, + { + "id": "937d5f4a-f851-11ea-9321-07e4098558b1", + "name": "panel_19", + "type": "visualization" + }, + { + "id": "93deea94-f851-11ea-8186-777cfa34f466", + "name": "panel_20", + "type": "visualization" + }, + { + "id": "938e9490-f851-11ea-9fc4-93d53dd1c7c1", + "name": "panel_21", + "type": "visualization" + }, + { + "id": "943b6bf2-f851-11ea-99e0-b300881da4b1", + "name": "panel_22", + "type": "visualization" + }, + { + "id": "9417ef10-f851-11ea-bc5c-cbb3bfb4dc2a", + "name": "panel_23", + "type": "visualization" + }, + { + "id": "9398519c-f851-11ea-9d16-0345f5e91a95", + "name": "panel_24", + "type": "visualization" + }, + { + "id": "93a42468-f851-11ea-8393-7791ef366bdd", + "name": "panel_25", + "type": "visualization" + }, + { + "id": "9379c90c-f851-11ea-8313-f3c659aaac21", + "name": "panel_26", + "type": "visualization" + }, + { + "id": "f771b65c-f8d0-11ea-bf74-8bbda818957f", + "name": "panel_27", + "type": "visualization" + }, + { + "id": "9410e9ea-f851-11ea-b70d-9bda9c286e02", + "name": "panel_28", + "type": "visualization" + }, + { + "id": "93911f12-f851-11ea-9a0a-bb5ff28cf81a", + "name": "panel_29", + "type": "visualization" + } + ], + "type": "dashboard", + "updated_at": "2020-09-17T10:34:14.592Z", + "version": "WzE1MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Average push time [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.pushTime\"" + }, + "formatter": "ms,s,2", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Avg Push Time", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}} s" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "metric" + }, + "title": "Average push time [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93acc294-f851-11ea-a97a-53f837470423", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "VM ephemeral disk used [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93d69f74-f851-11ea-b007-0bb1f816b4f3", + "operator": "gt", + "value": 70 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93a1a36e-f851-11ea-840a-4ff3b85fd2ce", + "operator": "gt", + "value": 50 + }, + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "93ce25ba-f851-11ea-a28d-3339e0be69a9", + "operator": "lte", + "value": 50 + } + ], + "bar_color_rules": [ + { + "id": "93a6b4d0-f851-11ea-9ff5-af33dba0a2b7" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93941cda-f851-11ea-8449-bf49cca008e8", + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "1", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"system.disk.ephemeral.percent\"" + }, + "formatter": "00.00", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Ephemeral Disk Used", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9377407e-f851-11ea-a918-ab9d33748fd4" + } + ], + "split_mode": "everything", + "stacked": "none", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "VM ephemeral disk used [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93f27abe-f851-11ea-90c1-670adf08e026", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "VM disk used [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93d69f74-f851-11ea-b007-0bb1f816b4f3", + "operator": "gt", + "value": 70 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93a1a36e-f851-11ea-840a-4ff3b85fd2ce", + "operator": "gt", + "value": 50 + }, + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "93ce25ba-f851-11ea-a28d-3339e0be69a9", + "operator": "lte", + "value": 50 + } + ], + "bar_color_rules": [ + { + "id": "93a6b4d0-f851-11ea-9ff5-af33dba0a2b7" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93941cda-f851-11ea-8449-bf49cca008e8", + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "1", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"system.disk.system.percent\"" + }, + "formatter": "00.00", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "VM Disk Used", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9377407e-f851-11ea-a918-ab9d33748fd4" + } + ], + "split_mode": "everything", + "stacked": "none", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "VM disk used [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93d1bce8-f851-11ea-9e6c-e3a6ffa65309", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "VM persistent disk used [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93d69f74-f851-11ea-b007-0bb1f816b4f3", + "operator": "gt", + "value": 70 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93a1a36e-f851-11ea-840a-4ff3b85fd2ce", + "operator": "gt", + "value": 50 + }, + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "93ce25ba-f851-11ea-a28d-3339e0be69a9", + "operator": "lte", + "value": 50 + } + ], + "bar_color_rules": [ + { + "id": "93a6b4d0-f851-11ea-9ff5-af33dba0a2b7" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93941cda-f851-11ea-8449-bf49cca008e8", + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "1", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"system.disk.persistent.percent\"" + }, + "formatter": "00.00", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Persistent Disk Used", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "9377407e-f851-11ea-a918-ab9d33748fd4" + } + ], + "split_mode": "everything", + "stacked": "none", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "VM persistent disk used [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93f86eec-f851-11ea-9ae8-ff70f6c28f02", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyMywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Average push time line [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=5m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.pushTime\" " + }, + "formatter": "ms,s,2", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Avg Push Time", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}} s" + }, + { + "axis_max": "1", + "axis_min": "-1", + "axis_position": "left", + "chart_type": "line", + "color": "rgba(101,50,148,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.push\"" + }, + "formatter": "number", + "id": "93e9e1c4-f851-11ea-a721-73ca515dcf70", + "label": "Push Success", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93ebe050-f851-11ea-ba43-0f6c8946c755", + "type": "avg" + } + ], + "point_size": "2", + "separate_axis": 1, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "type": "timeseries" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Average push time line [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93f59bb8-f851-11ea-ab86-6757c64f8446", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Total disk 6GB free chunks [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 100 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 100 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93cfeee0-f851-11ea-b302-1f22d9deae5a", + "operator": "lte", + "value": 50 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.AvailableFreeChunksDisk\"" + }, + "formatter": "'0,0'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Available 6GB Free Disk Chunks", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Total disk 6GB disk chunks [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93d3c40c-f851-11ea-ab6c-2b7686d129ce", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "ISO memory 4GB free chunks [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 20 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 20 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "9374752e-f851-11ea-ad9f-cfee9493e6eb", + "operator": "lte", + "value": 15 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=5m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.AvailableFreeChunks\" and cloudfoundry.envelope.deployment: p-isolation-segment*" + }, + "formatter": "'0,0'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "ISO 4GB Free Memory Chunks", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "min" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "last_value", + "type": "metric" + }, + "title": "ISO memory 4GB free chunks [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93edb394-f851-11ea-af40-bbda53487783", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pushes past hour [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.CanaryApp.available\" " + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Past Hour", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "1h", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Pushes past hour [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9398519c-f851-11ea-9d16-0345f5e91a95", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Applications availability past month [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.CanaryApp.available\"" + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Past Month", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "1M", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Applications availability past month [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93c2c184-f851-11ea-93fb-fb88ecfdafdb", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyOCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Applications availability past day [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.CanaryApp.available\"" + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Past Day", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "1d", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Applications availability past day [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "94200db2-f851-11ea-a8fa-9bfadc17852f", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEyOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Applications availability line [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_max": "1", + "axis_min": "", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.CanaryApp.available\"" + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "App Availability", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 0, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Applications availability line [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93d9d39c-f851-11ea-b957-3f002cacae67", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzMCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "System CPU load [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(244,78,59,1)", + "color": null, + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 60000 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"system.cpu.sys\" " + }, + "formatter": "number", + "hidden": false, + "hide_in_legend": 0, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "System CPU Load", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "System CPU load [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "939a9380-f851-11ea-9a72-a3f185bef2c4", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzMSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Director health check [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_max": "1", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(30,125,77,0.84)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.bosh.director.probe.available\" " + }, + "formatter": "percent", + "hidden": false, + "hide_in_legend": 0, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Director Probe Availability", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 0, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Director health check [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "943dcad2-f851-11ea-8923-93b64d3cea46", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzMiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Test results [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_max": "1", + "axis_min": "", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=5m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_max": "1", + "axis_min": "-1", + "axis_position": "left", + "chart_type": "line", + "color": "rgba(30,125,77,0.84)", + "fill": "", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.delete\"" + }, + "formatter": "number", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Can Delete", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "type": "timeseries", + "value_template": "" + }, + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(226,115,0,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"health.check.cliCommand.login\" " + }, + "formatter": "number", + "id": "942618ec-f851-11ea-b48a-5b9430e2ce44", + "label": "Can Login", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "942c9cc6-f851-11ea-bf29-8bf7fdb78fbd", + "type": "avg" + } + ], + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "" + }, + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"health.check.cliCommand.push\" " + }, + "formatter": "number", + "id": "937fd70c-f851-11ea-a061-4fce22c4bd01", + "label": "Can Push", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "9381bac2-f851-11ea-8141-4fa88748817f", + "type": "avg" + } + ], + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "" + }, + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(176,0,188,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"health.check.cliCommand.logs\" " + }, + "formatter": "number", + "id": "938694d4-f851-11ea-9158-3fa2819fcf4a", + "label": "Receiving Logs", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93893126-f851-11ea-a544-3bbd4ce64fdd", + "type": "avg" + } + ], + "point_size": "2", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "type": "timeseries", + "value_template": "" + } + ], + "show_grid": 0, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries" + }, + "title": "Test results [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93c03f18-f851-11ea-8da1-eb649369fefa", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzMywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Top CPU user deployment [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "93965a18-f851-11ea-a8db-cf27e7c12197" + } + ], + "bar_color_rules": [ + { + "bar_color": "rgba(244,78,59,1)", + "id": "93bd39a8-f851-11ea-9b4f-0bee117f7e32", + "operator": "gte", + "value": 70 + }, + { + "bar_color": "rgba(252,220,0,1)", + "id": "93cc3e94-f851-11ea-8e33-6f86d8899090", + "operator": "lt", + "value": 70 + }, + { + "bar_color": "rgba(105,192,111,1)", + "id": "93e2a558-f851-11ea-a583-8ba487ea9a5e", + "operator": "lt", + "value": 50 + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drilldown_url": "", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "id": "93e46942-f851-11ea-b627-9f9d893aa443" + } + ], + "gauge_inner_width": 10, + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"system.cpu.user\" " + }, + "formatter": "number", + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Top CPU Users by Deployment", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "max" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "terms", + "stacked": "none", + "terms_field": "cloudfoundry.envelope.deployment", + "terms_order_by": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "top_n" + }, + "title": "Top CPU user deployment [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9430406a-f851-11ea-a96e-efef958606c3", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzNCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Top persistent disk deployment [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "93965a18-f851-11ea-a8db-cf27e7c12197" + } + ], + "bar_color_rules": [ + { + "bar_color": "rgba(244,78,59,1)", + "id": "93bd39a8-f851-11ea-9b4f-0bee117f7e32", + "operator": "gte", + "value": 70 + }, + { + "bar_color": "rgba(252,220,0,1)", + "id": "93cc3e94-f851-11ea-8e33-6f86d8899090", + "operator": "lt", + "value": 70 + }, + { + "bar_color": "rgba(105,192,111,1)", + "id": "93e2a558-f851-11ea-a583-8ba487ea9a5e", + "operator": "lt", + "value": 50 + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drilldown_url": "", + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "index_pattern": "metricbeat-*", + "interval": "", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name:\"system.disk.persistent.percent\"" + }, + "formatter": "number", + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Top CPU Users by Deployment", + "line_width": 1, + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "max" + } + ], + "point_size": 1, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "terms", + "stacked": "none", + "terms_field": "cloudfoundry.envelope.deployment", + "terms_order_by": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "value_template": "" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "top_n" + }, + "title": "Top persistent disk deployment [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93fd890e-f851-11ea-96db-8342eb689011", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzNSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Memory 4GB free chunks [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 20 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 20 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93aa1f08-f851-11ea-8561-cf622005b51f", + "operator": "lte", + "value": 10 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=5m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.AvailableFreeChunks\" and cloudfoundry.envelope.deployment: cf*" + }, + "formatter": "'0,0'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "CF 4GB Free Memory Chunks", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "metric" + }, + "title": "Memory 4GB free chunks [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93dcb238-f851-11ea-8c49-fb9deba7fc48", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzNiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "ISO disk 6GB free chunks [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 100 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 100 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "938c1710-f851-11ea-aacc-e3f9d23bdead", + "operator": "lte", + "value": 50 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=5m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.AvailableFreeChunksDisk\" and cloudfoundry.envelope.deployment: p-isolation-segment*" + }, + "formatter": "'0,0'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "ISO 6GB Free Disk Chunks", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "min" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "last_value", + "type": "metric" + }, + "title": "ISO disk 6GB free chunks [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93e0d7d2-f851-11ea-a8ea-ab5761cc3b1c", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzNywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Disk capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.TotalPercentageAvailableDiskCapacity.5M\" AND cloudfoundry.envelope.deployment: cf*" + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "CF Disk Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Disk capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "94402c0a-f851-11ea-b3d4-f3815d5ef910", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzOCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "ISO disk capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.TotalPercentageAvailableDiskCapacity.5M\" and cloudfoundry.envelope.deployment: p-isolation-segment*" + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "ISO Disk Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "ISO disk capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "937d5f4a-f851-11ea-9321-07e4098558b1", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzEzOSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "ISO memory capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.TotalPercentageAvailableMemoryCapacity.5M\" and cloudfoundry.envelope.deployment: p-isolation-segment*" + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "ISO Memory Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "ISO memory capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93deea94-f851-11ea-8186-777cfa34f466", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0MCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "ISO container capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset:\"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.TotalPercentageAvailableContainerCapacity.5M\" and cloudfoundry.envelope.deployment: p-isolation-segment*" + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "ISO Container Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "ISO container capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "938e9490-f851-11ea-9fc4-93d53dd1c7c1", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0MSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Container capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\"" + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"Diego.TotalPercentageAvailableContainerCapacity.5M\" AND cloudfoundry.envelope.deployment: cf*" + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "CF Container Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Container capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "943b6bf2-f851-11ea-99e0-b300881da4b1", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Memory capacity [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.4 + }, + { + "background_color": "rgba(252,220,0,1)", + "color": "rgba(255,255,255,1)", + "id": "93e80d0e-f851-11ea-ae0c-6f6e897b08b1", + "operator": "lte", + "value": 0.4 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "93c50fb6-f851-11ea-9589-1bd31d6a8c71", + "operator": "lte", + "value": 0.35 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset: \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.envelope.deployment:cf* and cloudfoundry.value.name: \"Diego.TotalPercentageAvailableMemoryCapacity.5M\" " + }, + "formatter": "'0.0%'", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "CF Memory Capacity", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Memory capacity [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9417ef10-f851-11ea-bc5c-cbb3bfb4dc2a", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0MywxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pushes past month [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.push\" " + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Past Month", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "1M", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Pushes past month [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "93a42468-f851-11ea-8393-7791ef366bdd", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0NCwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pushes past day [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "background_color": "rgba(105,192,111,1)", + "color": "rgba(255,255,255,1)", + "id": "939ee5ac-f851-11ea-9c98-1b6b4c058d58", + "operator": "gt", + "value": 0.95 + }, + { + "background_color": "rgba(244,78,59,1)", + "color": "rgba(255,255,255,1)", + "id": "93c76824-f851-11ea-b59a-ebcfb7da714a", + "operator": "lte", + "value": 0.95 + } + ], + "bar_color_rules": [ + { + "id": "9438fb38-f851-11ea-8cbf-2be67ccd287b" + } + ], + "default_index_pattern": "filebeat-*", + "default_timefield": "@timestamp", + "drop_last_bucket": 1, + "filter": { + "language": "kuery", + "query": "event.module: \"cloudfoundry\" and event.dataset : \"cloudfoundry.value\" " + }, + "gauge_color_rules": [ + { + "gauge": null, + "id": "93f0138c-f851-11ea-bbaa-dfc0137bc600", + "text": null, + "value": 0 + } + ], + "gauge_inner_width": 10, + "gauge_max": "300000", + "gauge_style": "half", + "gauge_width": 10, + "id": "93aed944-f851-11ea-ba70-fbde5471d6c0", + "ignore_global_filter": 0, + "index_pattern": "metricbeat-*", + "interval": "\u003e=1m", + "isModelInvalid": false, + "legend_position": "bottom", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "0", + "filter": { + "language": "kuery", + "query": "cloudfoundry.value.name: \"health.check.cliCommand.push\" " + }, + "formatter": "percent", + "hidden": false, + "id": "93b3d516-f851-11ea-b4ca-c32dfcb647e2", + "label": "Past Day", + "line_width": "2", + "metrics": [ + { + "field": "cloudfoundry.value.value", + "id": "93b9bc2e-f851-11ea-8d20-9b7927512450", + "type": "avg" + } + ], + "offset_time": "1d", + "point_size": "1", + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "#68BC00", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "93842b7c-f851-11ea-8281-37e3b8318172", + "label": "" + } + ], + "split_mode": "everything", + "stacked": "none", + "steps": 0, + "terms_field": "name.keyword", + "terms_include": "", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "type": "metric" + }, + "title": "Pushes past day [Metricbeat Cloud Foundry]", + "type": "metrics" + } + }, + "id": "9379c90c-f851-11ea-8313-f3c659aaac21", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0NSwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Dashboards Navigation Platform Health [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 12, + "markdown": "[Overview](#/dashboard/9c81cf34-f84e-11ea-a49d-f3f94f5e4fac) | **Platform Health**", + "openLinksInNewTab": false + }, + "title": "Dashboards Navigation [Metricbeat Cloud Foundry]", + "type": "markdown" + } + }, + "id": "f771b65c-f8d0-11ea-bf74-8bbda818957f", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:37:54.081Z", + "version": "WzE4MiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pushes md-2 [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 15, + "markdown": "**CF Push**\n**(99.0%)**", + "openLinksInNewTab": false + }, + "title": "Pushes md-2 [Metricbeat Cloud Foundry]", + "type": "markdown" + } + }, + "id": "9410e9ea-f851-11ea-b70d-9bda9c286e02", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0NiwxXQ==" + }, + { + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "title": "Pushes application availability md-2 [Metricbeat Cloud Foundry]", + "uiStateJSON": {}, + "version": 1, + "visState": { + "aggs": [], + "params": { + "fontSize": 15, + "markdown": "**App Avail**\n**(99.9%)**", + "openLinksInNewTab": false + }, + "title": "Pushes application availability md-2 [Metricbeat Cloud Foundry]", + "type": "markdown" + } + }, + "id": "93911f12-f851-11ea-9a0a-bb5ff28cf81a", + "migrationVersion": { + "visualization": "7.8.0" + }, + "namespaces": [ + "default" + ], + "references": [], + "type": "visualization", + "updated_at": "2020-09-17T10:33:07.259Z", + "version": "WzE0NywxXQ==" + } + ], + "version": "7.9.0" +} From 43f9bbcf6d102f2dd00b5541d24eeb11db5d01eb Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Fri, 18 Sep 2020 14:43:41 +0200 Subject: [PATCH 021/216] Remove billing from the list of AWS light metricsets (#21164) On tests, loading any metricset from the AWS module is trying to load the billing metricset as light metricset, what fails. This shouldn't happen after #15011, but it is probably happening because on tests, not all metricsets are registered. billing metricset was refactored to a native implementation recently, in #20527. By now, remove billing from the list so tests can be executed. --- x-pack/metricbeat/module/aws/module.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/x-pack/metricbeat/module/aws/module.yml b/x-pack/metricbeat/module/aws/module.yml index ce356c38e32..0be20d1d484 100644 --- a/x-pack/metricbeat/module/aws/module.yml +++ b/x-pack/metricbeat/module/aws/module.yml @@ -3,7 +3,6 @@ metricsets: - elb - ebs - usage - - billing - sns - lambda - dynamodb From 1932f9f0adbfbe4ee66ee27183429345a21cc2c5 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Fri, 18 Sep 2020 15:11:12 -0500 Subject: [PATCH 022/216] sync with recent changes in zeek package (#21155) - always attempt community_id processor - dnp3 reorder pipeline to be same as package --- CHANGELOG.next.asciidoc | 1 + .../module/zeek/connection/config/connection.yml | 2 -- .../filebeat/module/zeek/connection/manifest.yml | 2 -- .../module/zeek/dce_rpc/config/dce_rpc.yml | 2 -- x-pack/filebeat/module/zeek/dce_rpc/manifest.yml | 2 -- x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml | 2 -- x-pack/filebeat/module/zeek/dhcp/manifest.yml | 2 -- x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml | 2 -- .../module/zeek/dnp3/ingest/pipeline.yml | 16 ++++++++-------- x-pack/filebeat/module/zeek/dnp3/manifest.yml | 2 -- x-pack/filebeat/module/zeek/dns/config/dns.yml | 2 -- x-pack/filebeat/module/zeek/dns/manifest.yml | 2 -- x-pack/filebeat/module/zeek/dpd/config/dpd.yml | 2 -- x-pack/filebeat/module/zeek/dpd/manifest.yml | 2 -- x-pack/filebeat/module/zeek/ftp/config/ftp.yml | 2 -- x-pack/filebeat/module/zeek/ftp/manifest.yml | 2 -- x-pack/filebeat/module/zeek/http/config/http.yml | 2 -- x-pack/filebeat/module/zeek/http/manifest.yml | 2 -- .../filebeat/module/zeek/intel/config/intel.yml | 2 -- x-pack/filebeat/module/zeek/intel/manifest.yml | 2 -- x-pack/filebeat/module/zeek/irc/config/irc.yml | 2 -- x-pack/filebeat/module/zeek/irc/manifest.yml | 2 -- .../module/zeek/kerberos/config/kerberos.yml | 2 -- .../filebeat/module/zeek/kerberos/manifest.yml | 2 -- .../module/zeek/modbus/config/modbus.yml | 2 -- x-pack/filebeat/module/zeek/modbus/manifest.yml | 2 -- .../filebeat/module/zeek/mysql/config/mysql.yml | 2 -- x-pack/filebeat/module/zeek/mysql/manifest.yml | 2 -- .../module/zeek/notice/config/notice.yml | 2 -- x-pack/filebeat/module/zeek/notice/manifest.yml | 2 -- x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml | 2 -- x-pack/filebeat/module/zeek/ntlm/manifest.yml | 2 -- .../module/zeek/radius/config/radius.yml | 2 -- x-pack/filebeat/module/zeek/radius/manifest.yml | 2 -- x-pack/filebeat/module/zeek/rdp/config/rdp.yml | 2 -- x-pack/filebeat/module/zeek/rdp/manifest.yml | 2 -- x-pack/filebeat/module/zeek/rfb/config/rfb.yml | 2 -- x-pack/filebeat/module/zeek/rfb/manifest.yml | 2 -- x-pack/filebeat/module/zeek/sip/config/sip.yml | 2 -- x-pack/filebeat/module/zeek/sip/manifest.yml | 2 -- .../module/zeek/smb_cmd/config/smb_cmd.yml | 2 -- x-pack/filebeat/module/zeek/smb_cmd/manifest.yml | 2 -- .../module/zeek/smb_files/config/smb_files.yml | 2 -- .../filebeat/module/zeek/smb_files/manifest.yml | 2 -- .../zeek/smb_mapping/config/smb_mapping.yml | 2 -- .../module/zeek/smb_mapping/manifest.yml | 2 -- x-pack/filebeat/module/zeek/smtp/config/smtp.yml | 2 -- x-pack/filebeat/module/zeek/smtp/manifest.yml | 2 -- x-pack/filebeat/module/zeek/snmp/config/snmp.yml | 2 -- x-pack/filebeat/module/zeek/snmp/manifest.yml | 2 -- .../filebeat/module/zeek/socks/config/socks.yml | 2 -- x-pack/filebeat/module/zeek/socks/manifest.yml | 2 -- x-pack/filebeat/module/zeek/ssh/config/ssh.yml | 2 -- x-pack/filebeat/module/zeek/ssh/manifest.yml | 2 -- x-pack/filebeat/module/zeek/ssl/config/ssl.yml | 2 -- x-pack/filebeat/module/zeek/ssl/manifest.yml | 2 -- .../module/zeek/syslog/config/syslog.yml | 2 -- x-pack/filebeat/module/zeek/syslog/manifest.yml | 2 -- x-pack/filebeat/module/zeek/x509/manifest.yml | 2 -- 59 files changed, 9 insertions(+), 122 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0c18d59e009..03cd27f895d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -579,6 +579,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Improve Suricata Eve module with `x509` ECS mappings {pull}20973[20973] - Added new module for Zoom webhooks {pull}20414[20414] - Add type and sub_type to panw panos fileset {pull}20912[20912] +- Always attempt community_id processor on zeek module {pull}21155[21155] *Heartbeat* diff --git a/x-pack/filebeat/module/zeek/connection/config/connection.yml b/x-pack/filebeat/module/zeek/connection/config/connection.yml index eb6515c6171..8a79295724f 100644 --- a/x-pack/filebeat/module/zeek/connection/config/connection.yml +++ b/x-pack/filebeat/module/zeek/connection/config/connection.yml @@ -90,7 +90,6 @@ processors: kind: event category: - network -{{ if .community_id }} - if: equals.network.transport: icmp then: @@ -100,7 +99,6 @@ processors: icmp_code: zeek.connection.icmp.code else: community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/connection/manifest.yml b/x-pack/filebeat/module/zeek/connection/manifest.yml index 0acad34d69c..08f79bc28ca 100644 --- a/x-pack/filebeat/module/zeek/connection/manifest.yml +++ b/x-pack/filebeat/module/zeek/connection/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/conn.log - name: tags default: [zeek.connection] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/connection.yml diff --git a/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml b/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml index e99deb6c68f..45010e08973 100644 --- a/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml +++ b/x-pack/filebeat/module/zeek/dce_rpc/config/dce_rpc.yml @@ -54,9 +54,7 @@ processors: - connection - protocol - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/dce_rpc/manifest.yml b/x-pack/filebeat/module/zeek/dce_rpc/manifest.yml index 21ba27eac96..01bef572b67 100644 --- a/x-pack/filebeat/module/zeek/dce_rpc/manifest.yml +++ b/x-pack/filebeat/module/zeek/dce_rpc/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/dce_rpc.log - name: tags default: [zeek.dce_rpc] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/dce_rpc.yml diff --git a/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml b/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml index e0eb1831b77..f1a2f0ced3a 100644 --- a/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml +++ b/x-pack/filebeat/module/zeek/dhcp/config/dhcp.yml @@ -116,9 +116,7 @@ processors: - connection - protocol - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/dhcp/manifest.yml b/x-pack/filebeat/module/zeek/dhcp/manifest.yml index 7cb434b1955..ee4a7c24f3b 100644 --- a/x-pack/filebeat/module/zeek/dhcp/manifest.yml +++ b/x-pack/filebeat/module/zeek/dhcp/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/dhcp.log - name: tags default: [zeek.dhcp] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/dhcp.yml diff --git a/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml b/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml index 33890a55071..7730d2b6d85 100644 --- a/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml +++ b/x-pack/filebeat/module/zeek/dnp3/config/dnp3.yml @@ -64,9 +64,7 @@ processors: - connection - protocol - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/dnp3/ingest/pipeline.yml b/x-pack/filebeat/module/zeek/dnp3/ingest/pipeline.yml index 5585d24327e..e104312e1e1 100644 --- a/x-pack/filebeat/module/zeek/dnp3/ingest/pipeline.yml +++ b/x-pack/filebeat/module/zeek/dnp3/ingest/pipeline.yml @@ -23,14 +23,6 @@ processors: - lowercase: field: event.action ignore_missing: true -- append: - field: related.ip - value: '{{source.ip}}' - if: ctx?.source?.ip != null -- append: - field: related.ip - value: '{{destination.ip}}' - if: ctx?.destination?.ip != null - geoip: field: destination.ip target_field: destination.geo @@ -69,6 +61,14 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true +- append: + field: related.ip + value: '{{source.ip}}' + if: ctx?.source?.ip != null +- append: + field: related.ip + value: '{{destination.ip}}' + if: ctx?.destination?.ip != null on_failure: - set: field: error.message diff --git a/x-pack/filebeat/module/zeek/dnp3/manifest.yml b/x-pack/filebeat/module/zeek/dnp3/manifest.yml index 98de1c3af82..97829b3d0d0 100644 --- a/x-pack/filebeat/module/zeek/dnp3/manifest.yml +++ b/x-pack/filebeat/module/zeek/dnp3/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/dnp3.log - name: tags default: [zeek.dnp3] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/dnp3.yml diff --git a/x-pack/filebeat/module/zeek/dns/config/dns.yml b/x-pack/filebeat/module/zeek/dns/config/dns.yml index 82d0306ea63..86a2022d695 100644 --- a/x-pack/filebeat/module/zeek/dns/config/dns.yml +++ b/x-pack/filebeat/module/zeek/dns/config/dns.yml @@ -193,9 +193,7 @@ processors: - connection - info - protocol -{{ if .community_id }} - community_id: -{{ end }} - drop_fields: ignore_missing: true fields: diff --git a/x-pack/filebeat/module/zeek/dns/manifest.yml b/x-pack/filebeat/module/zeek/dns/manifest.yml index 0c81ed95c2d..4ff46df94b9 100644 --- a/x-pack/filebeat/module/zeek/dns/manifest.yml +++ b/x-pack/filebeat/module/zeek/dns/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/dns.log - name: tags default: [zeek.dns] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/dns.yml diff --git a/x-pack/filebeat/module/zeek/dpd/config/dpd.yml b/x-pack/filebeat/module/zeek/dpd/config/dpd.yml index 49e69972ef6..acc6defd4df 100644 --- a/x-pack/filebeat/module/zeek/dpd/config/dpd.yml +++ b/x-pack/filebeat/module/zeek/dpd/config/dpd.yml @@ -53,9 +53,7 @@ processors: type: - connection - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/dpd/manifest.yml b/x-pack/filebeat/module/zeek/dpd/manifest.yml index aeba0ef31fc..854eadbf491 100644 --- a/x-pack/filebeat/module/zeek/dpd/manifest.yml +++ b/x-pack/filebeat/module/zeek/dpd/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/dpd.log - name: tags default: [zeek.dpd] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/dpd.yml diff --git a/x-pack/filebeat/module/zeek/ftp/config/ftp.yml b/x-pack/filebeat/module/zeek/ftp/config/ftp.yml index 9be20cbd85b..51a3c053576 100644 --- a/x-pack/filebeat/module/zeek/ftp/config/ftp.yml +++ b/x-pack/filebeat/module/zeek/ftp/config/ftp.yml @@ -82,9 +82,7 @@ processors: - connection - info - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/ftp/manifest.yml b/x-pack/filebeat/module/zeek/ftp/manifest.yml index cf51575cf84..1f37ead03d0 100644 --- a/x-pack/filebeat/module/zeek/ftp/manifest.yml +++ b/x-pack/filebeat/module/zeek/ftp/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/ftp.log - name: tags default: [zeek.ftp] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/ftp.yml diff --git a/x-pack/filebeat/module/zeek/http/config/http.yml b/x-pack/filebeat/module/zeek/http/config/http.yml index 6f517c69320..4c7c812d0cc 100644 --- a/x-pack/filebeat/module/zeek/http/config/http.yml +++ b/x-pack/filebeat/module/zeek/http/config/http.yml @@ -89,9 +89,7 @@ processors: - connection - info - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/http/manifest.yml b/x-pack/filebeat/module/zeek/http/manifest.yml index ddd253bb218..acf134c2333 100644 --- a/x-pack/filebeat/module/zeek/http/manifest.yml +++ b/x-pack/filebeat/module/zeek/http/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/http.log - name: tags default: [zeek.http] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/http.yml diff --git a/x-pack/filebeat/module/zeek/intel/config/intel.yml b/x-pack/filebeat/module/zeek/intel/config/intel.yml index 4d35472f3ea..5b73833ea35 100644 --- a/x-pack/filebeat/module/zeek/intel/config/intel.yml +++ b/x-pack/filebeat/module/zeek/intel/config/intel.yml @@ -63,9 +63,7 @@ processors: kind: alert type: - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/intel/manifest.yml b/x-pack/filebeat/module/zeek/intel/manifest.yml index 281f6ed65fe..a84788f4d75 100644 --- a/x-pack/filebeat/module/zeek/intel/manifest.yml +++ b/x-pack/filebeat/module/zeek/intel/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/intel.log - name: tags default: [zeek.intel] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/intel.yml diff --git a/x-pack/filebeat/module/zeek/irc/config/irc.yml b/x-pack/filebeat/module/zeek/irc/config/irc.yml index 5125e82fac2..54aaa9d4f4b 100644 --- a/x-pack/filebeat/module/zeek/irc/config/irc.yml +++ b/x-pack/filebeat/module/zeek/irc/config/irc.yml @@ -68,9 +68,7 @@ processors: - connection - protocol - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/irc/manifest.yml b/x-pack/filebeat/module/zeek/irc/manifest.yml index 3bf899fd2c0..36cf10a5bb3 100644 --- a/x-pack/filebeat/module/zeek/irc/manifest.yml +++ b/x-pack/filebeat/module/zeek/irc/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/irc.log - name: tags default: [zeek.irc] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/irc.yml diff --git a/x-pack/filebeat/module/zeek/kerberos/config/kerberos.yml b/x-pack/filebeat/module/zeek/kerberos/config/kerberos.yml index dbb0c364ea8..f557da8ba7f 100644 --- a/x-pack/filebeat/module/zeek/kerberos/config/kerberos.yml +++ b/x-pack/filebeat/module/zeek/kerberos/config/kerberos.yml @@ -100,9 +100,7 @@ processors: tokenizer: "%{user.name}/%{user.domain}" field: zeek.kerberos.client target_prefix: "" -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/kerberos/manifest.yml b/x-pack/filebeat/module/zeek/kerberos/manifest.yml index 4a94434f1d4..3f527b15013 100644 --- a/x-pack/filebeat/module/zeek/kerberos/manifest.yml +++ b/x-pack/filebeat/module/zeek/kerberos/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/kerberos.log - name: tags default: [zeek.kerberos] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/kerberos.yml diff --git a/x-pack/filebeat/module/zeek/modbus/config/modbus.yml b/x-pack/filebeat/module/zeek/modbus/config/modbus.yml index c6a6c3bf9e1..d656ad0ab6a 100644 --- a/x-pack/filebeat/module/zeek/modbus/config/modbus.yml +++ b/x-pack/filebeat/module/zeek/modbus/config/modbus.yml @@ -69,9 +69,7 @@ processors: target: event fields: outcome: success -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/modbus/manifest.yml b/x-pack/filebeat/module/zeek/modbus/manifest.yml index e20412fadc6..c4afd6315d4 100644 --- a/x-pack/filebeat/module/zeek/modbus/manifest.yml +++ b/x-pack/filebeat/module/zeek/modbus/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/modbus.log - name: tags default: [zeek.modbus] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/modbus.yml diff --git a/x-pack/filebeat/module/zeek/mysql/config/mysql.yml b/x-pack/filebeat/module/zeek/mysql/config/mysql.yml index b3fd2c5484f..4c6e70d9f1c 100644 --- a/x-pack/filebeat/module/zeek/mysql/config/mysql.yml +++ b/x-pack/filebeat/module/zeek/mysql/config/mysql.yml @@ -68,9 +68,7 @@ processors: target: event fields: outcome: failure -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/mysql/manifest.yml b/x-pack/filebeat/module/zeek/mysql/manifest.yml index 1b7ec4edb19..bba253a418e 100644 --- a/x-pack/filebeat/module/zeek/mysql/manifest.yml +++ b/x-pack/filebeat/module/zeek/mysql/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/mysql.log - name: tags default: [zeek.mysql] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/mysql.yml diff --git a/x-pack/filebeat/module/zeek/notice/config/notice.yml b/x-pack/filebeat/module/zeek/notice/config/notice.yml index fa1cc38b31b..649d3f3ba97 100644 --- a/x-pack/filebeat/module/zeek/notice/config/notice.yml +++ b/x-pack/filebeat/module/zeek/notice/config/notice.yml @@ -100,9 +100,7 @@ processors: - intrusion_detection type: - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/notice/manifest.yml b/x-pack/filebeat/module/zeek/notice/manifest.yml index e2bdf695027..e14f7222065 100644 --- a/x-pack/filebeat/module/zeek/notice/manifest.yml +++ b/x-pack/filebeat/module/zeek/notice/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/notice.log - name: tags default: [zeek.notice] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/notice.yml diff --git a/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml b/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml index dcf1cb46f6f..c67f66b54b9 100644 --- a/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml +++ b/x-pack/filebeat/module/zeek/ntlm/config/ntlm.yml @@ -82,9 +82,7 @@ processors: target: event fields: outcome: failure -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/ntlm/manifest.yml b/x-pack/filebeat/module/zeek/ntlm/manifest.yml index 545bef85aaa..e16e6ec8b3a 100644 --- a/x-pack/filebeat/module/zeek/ntlm/manifest.yml +++ b/x-pack/filebeat/module/zeek/ntlm/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/ntlm.log - name: tags default: [zeek.ntlm] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/ntlm.yml diff --git a/x-pack/filebeat/module/zeek/radius/config/radius.yml b/x-pack/filebeat/module/zeek/radius/config/radius.yml index d133dbc014c..66fccaa3f5c 100644 --- a/x-pack/filebeat/module/zeek/radius/config/radius.yml +++ b/x-pack/filebeat/module/zeek/radius/config/radius.yml @@ -54,9 +54,7 @@ processors: type: - info - connection -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/radius/manifest.yml b/x-pack/filebeat/module/zeek/radius/manifest.yml index f881f404d7a..d3bdee065b0 100644 --- a/x-pack/filebeat/module/zeek/radius/manifest.yml +++ b/x-pack/filebeat/module/zeek/radius/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/radius.log - name: tags default: [zeek.radius] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/radius.yml diff --git a/x-pack/filebeat/module/zeek/rdp/config/rdp.yml b/x-pack/filebeat/module/zeek/rdp/config/rdp.yml index 1ea1c28520c..de71448fb1b 100644 --- a/x-pack/filebeat/module/zeek/rdp/config/rdp.yml +++ b/x-pack/filebeat/module/zeek/rdp/config/rdp.yml @@ -84,9 +84,7 @@ processors: type: - protocol - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/rdp/manifest.yml b/x-pack/filebeat/module/zeek/rdp/manifest.yml index b0c76c9f3a3..0a2bc7b77ec 100644 --- a/x-pack/filebeat/module/zeek/rdp/manifest.yml +++ b/x-pack/filebeat/module/zeek/rdp/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/rdp.log - name: tags default: [zeek.rdp] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/rdp.yml diff --git a/x-pack/filebeat/module/zeek/rfb/config/rfb.yml b/x-pack/filebeat/module/zeek/rfb/config/rfb.yml index d0eade39d0e..3adb14c55bf 100644 --- a/x-pack/filebeat/module/zeek/rfb/config/rfb.yml +++ b/x-pack/filebeat/module/zeek/rfb/config/rfb.yml @@ -69,9 +69,7 @@ processors: type: - connection - info -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/rfb/manifest.yml b/x-pack/filebeat/module/zeek/rfb/manifest.yml index 2b9daaab107..4bba4f4f37c 100644 --- a/x-pack/filebeat/module/zeek/rfb/manifest.yml +++ b/x-pack/filebeat/module/zeek/rfb/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/rfb.log - name: tags default: [zeek.rfb] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/rfb.yml diff --git a/x-pack/filebeat/module/zeek/sip/config/sip.yml b/x-pack/filebeat/module/zeek/sip/config/sip.yml index 7355ba353c7..7aa30034de2 100644 --- a/x-pack/filebeat/module/zeek/sip/config/sip.yml +++ b/x-pack/filebeat/module/zeek/sip/config/sip.yml @@ -91,9 +91,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/sip/manifest.yml b/x-pack/filebeat/module/zeek/sip/manifest.yml index 8da0cc443dd..2186e6b0f3f 100644 --- a/x-pack/filebeat/module/zeek/sip/manifest.yml +++ b/x-pack/filebeat/module/zeek/sip/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/sip.log - name: tags default: [zeek.sip] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/sip.yml diff --git a/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml b/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml index 693c439454a..763379a7d88 100644 --- a/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml +++ b/x-pack/filebeat/module/zeek/smb_cmd/config/smb_cmd.yml @@ -97,9 +97,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/smb_cmd/manifest.yml b/x-pack/filebeat/module/zeek/smb_cmd/manifest.yml index a4ad3a78ce1..331cafae30f 100644 --- a/x-pack/filebeat/module/zeek/smb_cmd/manifest.yml +++ b/x-pack/filebeat/module/zeek/smb_cmd/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/smb_cmd.log - name: tags default: [zeek.smb_cmd] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/smb_cmd.yml diff --git a/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml b/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml index 16fb3d36964..c5f7c2e53e7 100644 --- a/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml +++ b/x-pack/filebeat/module/zeek/smb_files/config/smb_files.yml @@ -57,9 +57,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/smb_files/manifest.yml b/x-pack/filebeat/module/zeek/smb_files/manifest.yml index f59a04153a5..bdbf0324fd9 100644 --- a/x-pack/filebeat/module/zeek/smb_files/manifest.yml +++ b/x-pack/filebeat/module/zeek/smb_files/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/smb_files.log - name: tags default: [zeek.smb_files] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/smb_files.yml diff --git a/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml b/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml index 168458ba1d0..624454ed171 100644 --- a/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml +++ b/x-pack/filebeat/module/zeek/smb_mapping/config/smb_mapping.yml @@ -53,9 +53,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/smb_mapping/manifest.yml b/x-pack/filebeat/module/zeek/smb_mapping/manifest.yml index 7382e529b27..f4afd881b54 100644 --- a/x-pack/filebeat/module/zeek/smb_mapping/manifest.yml +++ b/x-pack/filebeat/module/zeek/smb_mapping/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/smb_mapping.log - name: tags default: [zeek.smb_mapping] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/smb_mapping.yml diff --git a/x-pack/filebeat/module/zeek/smtp/config/smtp.yml b/x-pack/filebeat/module/zeek/smtp/config/smtp.yml index acc02bf91df..5b2f6595df2 100644 --- a/x-pack/filebeat/module/zeek/smtp/config/smtp.yml +++ b/x-pack/filebeat/module/zeek/smtp/config/smtp.yml @@ -63,9 +63,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/smtp/manifest.yml b/x-pack/filebeat/module/zeek/smtp/manifest.yml index 6d69b3b5e3e..bc0d180278b 100644 --- a/x-pack/filebeat/module/zeek/smtp/manifest.yml +++ b/x-pack/filebeat/module/zeek/smtp/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/smtp.log - name: tags default: [zeek.smtp] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/smtp.yml diff --git a/x-pack/filebeat/module/zeek/snmp/config/snmp.yml b/x-pack/filebeat/module/zeek/snmp/config/snmp.yml index 684ecd01d06..0c7e05ce6db 100644 --- a/x-pack/filebeat/module/zeek/snmp/config/snmp.yml +++ b/x-pack/filebeat/module/zeek/snmp/config/snmp.yml @@ -65,9 +65,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/snmp/manifest.yml b/x-pack/filebeat/module/zeek/snmp/manifest.yml index b980b6fb82e..e25fb364b1e 100644 --- a/x-pack/filebeat/module/zeek/snmp/manifest.yml +++ b/x-pack/filebeat/module/zeek/snmp/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/snmp.log - name: tags default: [zeek.snmp] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/snmp.yml diff --git a/x-pack/filebeat/module/zeek/socks/config/socks.yml b/x-pack/filebeat/module/zeek/socks/config/socks.yml index 9ce64d99076..f834e5d1bcc 100644 --- a/x-pack/filebeat/module/zeek/socks/config/socks.yml +++ b/x-pack/filebeat/module/zeek/socks/config/socks.yml @@ -63,9 +63,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/socks/manifest.yml b/x-pack/filebeat/module/zeek/socks/manifest.yml index 68fea837fde..55c4a387524 100644 --- a/x-pack/filebeat/module/zeek/socks/manifest.yml +++ b/x-pack/filebeat/module/zeek/socks/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/socks.log - name: tags default: [zeek.socks] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/socks.yml diff --git a/x-pack/filebeat/module/zeek/ssh/config/ssh.yml b/x-pack/filebeat/module/zeek/ssh/config/ssh.yml index 453c6b0fae5..c855d49dff2 100644 --- a/x-pack/filebeat/module/zeek/ssh/config/ssh.yml +++ b/x-pack/filebeat/module/zeek/ssh/config/ssh.yml @@ -72,9 +72,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/ssh/manifest.yml b/x-pack/filebeat/module/zeek/ssh/manifest.yml index 60249e25c21..9d2f39212b5 100644 --- a/x-pack/filebeat/module/zeek/ssh/manifest.yml +++ b/x-pack/filebeat/module/zeek/ssh/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/ssh.log - name: tags default: [zeek.ssh] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/ssh.yml diff --git a/x-pack/filebeat/module/zeek/ssl/config/ssl.yml b/x-pack/filebeat/module/zeek/ssl/config/ssl.yml index 897db4b9fff..c3ecbd94be9 100644 --- a/x-pack/filebeat/module/zeek/ssl/config/ssl.yml +++ b/x-pack/filebeat/module/zeek/ssl/config/ssl.yml @@ -75,9 +75,7 @@ processors: type: - connection - protocol -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/ssl/manifest.yml b/x-pack/filebeat/module/zeek/ssl/manifest.yml index 0b3da1331ff..49e474dfadc 100644 --- a/x-pack/filebeat/module/zeek/ssl/manifest.yml +++ b/x-pack/filebeat/module/zeek/ssl/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/ssl.log - name: tags default: [zeek.ssl] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/ssl.yml diff --git a/x-pack/filebeat/module/zeek/syslog/config/syslog.yml b/x-pack/filebeat/module/zeek/syslog/config/syslog.yml index 16c6ebb6187..a89601cb717 100644 --- a/x-pack/filebeat/module/zeek/syslog/config/syslog.yml +++ b/x-pack/filebeat/module/zeek/syslog/config/syslog.yml @@ -53,9 +53,7 @@ processors: target: event fields: kind: event -{{ if .community_id }} - community_id: -{{ end }} - add_fields: target: '' fields: diff --git a/x-pack/filebeat/module/zeek/syslog/manifest.yml b/x-pack/filebeat/module/zeek/syslog/manifest.yml index 8db76ab5b36..03a80586303 100644 --- a/x-pack/filebeat/module/zeek/syslog/manifest.yml +++ b/x-pack/filebeat/module/zeek/syslog/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/syslog.log - name: tags default: [zeek.syslog] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/syslog.yml diff --git a/x-pack/filebeat/module/zeek/x509/manifest.yml b/x-pack/filebeat/module/zeek/x509/manifest.yml index 674610886fc..a183f7dbc3d 100644 --- a/x-pack/filebeat/module/zeek/x509/manifest.yml +++ b/x-pack/filebeat/module/zeek/x509/manifest.yml @@ -10,8 +10,6 @@ var: - /usr/local/var/logs/current/x509.log - name: tags default: [zeek.x509] - - name: community_id - default: true ingest_pipeline: ingest/pipeline.yml input: config/x509.yml From 5defc747bdcdafc52f341fb44be6aaedf05bc704 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Krze=C5=9Bniak?= Date: Sat, 19 Sep 2020 02:12:46 +0200 Subject: [PATCH 023/216] [docs] typo (#21130) * [docs] typo * Make typo fix in source file and run make update Co-authored-by: DeDe Morton --- filebeat/docs/modules/logstash.asciidoc | 3 ++- filebeat/module/logstash/_meta/docs.asciidoc | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/filebeat/docs/modules/logstash.asciidoc b/filebeat/docs/modules/logstash.asciidoc index 5c9df956e05..73b285aa6da 100644 --- a/filebeat/docs/modules/logstash.asciidoc +++ b/filebeat/docs/modules/logstash.asciidoc @@ -86,7 +86,8 @@ image::./images/kibana-logstash-slowlog.png[] [float] === Known issues -When using the `log` fileset to parse plaintext logs, if a multiline plaintext log contains an embedded JSON objct such that + +When using the `log` fileset to parse plaintext logs, if a multiline plaintext log contains an embedded JSON object such that the JSON object starts on a new line, the fileset may not parse the multiline plaintext log event correctly. :has-dashboards!: diff --git a/filebeat/module/logstash/_meta/docs.asciidoc b/filebeat/module/logstash/_meta/docs.asciidoc index 8f4e0d33a3c..4fe73d8681a 100644 --- a/filebeat/module/logstash/_meta/docs.asciidoc +++ b/filebeat/module/logstash/_meta/docs.asciidoc @@ -81,7 +81,8 @@ image::./images/kibana-logstash-slowlog.png[] [float] === Known issues -When using the `log` fileset to parse plaintext logs, if a multiline plaintext log contains an embedded JSON objct such that + +When using the `log` fileset to parse plaintext logs, if a multiline plaintext log contains an embedded JSON object such that the JSON object starts on a new line, the fileset may not parse the multiline plaintext log event correctly. :has-dashboards!: From 52902ae6ad927cf5cc90c16009ad57ab6a59a070 Mon Sep 17 00:00:00 2001 From: Michael Hyatt Date: Sat, 19 Sep 2020 10:30:52 +1000 Subject: [PATCH 024/216] Added a link to phishbeat (#21062) * Added a link to phishbeat Added a link to phishbeat developed by Stric-co * Update libbeat/docs/communitybeats.asciidoc Sounds good. Co-authored-by: DeDe Morton * Update libbeat/docs/communitybeats.asciidoc Co-authored-by: DeDe Morton Co-authored-by: DeDe Morton --- libbeat/docs/communitybeats.asciidoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libbeat/docs/communitybeats.asciidoc b/libbeat/docs/communitybeats.asciidoc index c2ff8f5ec14..9fc12e4be96 100644 --- a/libbeat/docs/communitybeats.asciidoc +++ b/libbeat/docs/communitybeats.asciidoc @@ -91,7 +91,8 @@ https://github.com/aristanetworks/openconfigbeat[openconfigbeat]:: Streams data https://github.com/radoondas/owmbeat[owmbeat]:: Open Weather Map beat to pull weather data from all around the world and store and visualize them in Elastic Stack https://github.com/joehillen/packagebeat[packagebeat]:: Collects information about system packages from package managers. -https://github.com/WuerthIT/perfstatbeat[perfstatbeat]:: Collect performance metrics on the AIX operating system. +https://github.com/WuerthIT/perfstatbeat[perfstatbeat]:: Collects performance metrics on the AIX operating system. +https://github.com/stric-co/phishbeat[phishbeat]:: Monitors Certificate Transparency logs for phishing and defamatory domains. https://github.com/kozlice/phpfpmbeat[phpfpmbeat]:: Reads status from PHP-FPM. https://github.com/joshuar/pingbeat[pingbeat]:: Sends ICMP pings to a list of targets and stores the round trip time (RTT) in Elasticsearch. From b595bfebe2fdc5a5cbedfe2f4d870dffc9e39798 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Fri, 18 Sep 2020 18:17:00 -0700 Subject: [PATCH 025/216] fix minor typos in docs (#21074) (#21185) Co-authored-by: Guido Lena Cota --- filebeat/docs/filebeat-general-options.asciidoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/filebeat/docs/filebeat-general-options.asciidoc b/filebeat/docs/filebeat-general-options.asciidoc index ad471c64084..a1a844f37af 100644 --- a/filebeat/docs/filebeat-general-options.asciidoc +++ b/filebeat/docs/filebeat-general-options.asciidoc @@ -33,13 +33,13 @@ filebeat.registry.path: registry ------------------------------------------------------------------------------------- NOTE: The registry is only updated when new events are flushed and not on a predefined period. -That means in case there are some states where the TTL expired, these are only removed when new event are processed. +That means in case there are some states where the TTL expired, these are only removed when new events are processed. -NOTE: The registry stores it's data in the subdirectory filebeat/data.json. It +NOTE: The registry stores its data in the subdirectory filebeat/data.json. It also contains a meta data file named filebeat/meta.json. The meta file contains the file format version number. -NOTE: The content stored in filebeat/data.json is compatible to the old registry file data format. +NOTE: The content stored in filebeat/data.json is compatible with the old registry file data format. [float] ==== `registry.file_permissions` From e51494f729c8869d62aa2ef3e4cba0738d6ca425 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Mon, 21 Sep 2020 08:53:03 +0200 Subject: [PATCH 026/216] Add backwards compatibility for append allow_duplicates (#21159) --- CHANGELOG.next.asciidoc | 1 + filebeat/fileset/pipelines.go | 74 +++++++++++ filebeat/fileset/pipelines_test.go | 202 +++++++++++++++++++++++++++++ 3 files changed, 277 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 03cd27f895d..90ef659fc45 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -264,6 +264,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove wrongly mapped `tls.client.server_name` from `fortinet/firewall` fileset. {pull}20983[20983] - Fix an error updating file size being logged when EOF is reached. {pull}21048[21048] - Fix error when processing AWS Cloudtrail Digest logs. {pull}21086[21086] {issue}20943[20943] +- Provide backwards compatibility for the `append` processor when Elasticsearch is less than 7.10.0. {pull}21159[21159] *Heartbeat* diff --git a/filebeat/fileset/pipelines.go b/filebeat/fileset/pipelines.go index 3d89e607ec6..fe7eb86c884 100644 --- a/filebeat/fileset/pipelines.go +++ b/filebeat/fileset/pipelines.go @@ -132,6 +132,10 @@ func loadPipeline(esClient PipelineLoader, pipelineID string, content map[string return fmt.Errorf("failed to modify set processor in pipeline: %v", err) } + if err := modifyAppendProcessor(esClient.GetVersion(), pipelineID, content); err != nil { + return fmt.Errorf("failed to modify append processor in pipeline: %v", err) + } + body, err := esClient.LoadJSON(path, content) if err != nil { return interpretError(err, body) @@ -291,3 +295,73 @@ func modifySetProcessor(esVersion common.Version, pipelineID string, content map } return nil } + +// modifyAppendProcessor replaces allow_duplicates option with an if statement +// so ES less than 7.10 will still work +func modifyAppendProcessor(esVersion common.Version, pipelineID string, content map[string]interface{}) error { + flagVersion := common.MustNewVersion("7.10.0") + if !esVersion.LessThan(flagVersion) { + return nil + } + + p, ok := content["processors"] + if !ok { + return nil + } + processors, ok := p.([]interface{}) + if !ok { + return fmt.Errorf("'processors' in pipeline '%s' expected to be a list, found %T", pipelineID, p) + } + + for _, p := range processors { + processor, ok := p.(map[string]interface{}) + if !ok { + continue + } + if options, ok := processor["append"].(map[string]interface{}); ok { + allow, ok := options["allow_duplicates"].(bool) + if !ok { + // don't have allow_duplicates, nothing to do + continue + } + + logp.Debug("modules", "In pipeline %q removing unsupported 'allow_duplicates' in append processor", pipelineID) + delete(options, "allow_duplicates") + if allow { + // it was set to true, nothing else to do after removing the option + continue + } + + currIf, _ := options["if"].(string) + if strings.Contains(strings.ToLower(currIf), "contains") { + // if it has a contains statement, we assume it is checking for duplicates already + continue + } + field, ok := options["field"].(string) + if !ok { + continue + } + val, ok := options["value"].(string) + if !ok { + continue + } + + field = strings.ReplaceAll(field, ".", "?.") + + val = strings.TrimLeft(val, "{ ") + val = strings.TrimRight(val, "} ") + val = strings.ReplaceAll(val, ".", "?.") + + if currIf == "" { + // if there is not a previous if we add a value sanity check + currIf = fmt.Sprintf("ctx?.%s != null", val) + } + + newIf := fmt.Sprintf("%s && ((ctx?.%s instanceof List && !ctx?.%s.contains(ctx?.%s)) || ctx?.%s != ctx?.%s)", currIf, field, field, val, field, val) + + logp.Debug("modules", "In pipeline %q adding if %s to replace 'allow_duplicates: false' in append processor", pipelineID, newIf) + options["if"] = newIf + } + } + return nil +} diff --git a/filebeat/fileset/pipelines_test.go b/filebeat/fileset/pipelines_test.go index 65a10212b6b..7c617034f10 100644 --- a/filebeat/fileset/pipelines_test.go +++ b/filebeat/fileset/pipelines_test.go @@ -392,3 +392,205 @@ func TestModifySetProcessor(t *testing.T) { }) } } + +func TestModifyAppendProcessor(t *testing.T) { + cases := []struct { + name string + esVersion *common.Version + content map[string]interface{} + expected map[string]interface{} + isErrExpected bool + }{ + { + name: "ES < 7.10.0: set to true", + esVersion: common.MustNewVersion("7.9.0"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": true, + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + }, + }, + }, + }, + isErrExpected: false, + }, + { + name: "ES < 7.10.0: set to false", + esVersion: common.MustNewVersion("7.9.0"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "if": "ctx?.host?.hostname != null && ((ctx?.related?.hosts instanceof List && !ctx?.related?.hosts.contains(ctx?.host?.hostname)) || ctx?.related?.hosts != ctx?.host?.hostname)", + }, + }, + }, + }, + isErrExpected: false, + }, + { + name: "ES == 7.10.0", + esVersion: common.MustNewVersion("7.10.0"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + }, + }, + }, + }, + isErrExpected: false, + }, + { + name: "ES > 7.10.0", + esVersion: common.MustNewVersion("8.0.0"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + }, + }, + }, + }, + isErrExpected: false, + }, + { + name: "ES < 7.10.0: existing if", + esVersion: common.MustNewVersion("7.7.7"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + "if": "ctx?.host?.hostname != null", + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "if": "ctx?.host?.hostname != null && ((ctx?.related?.hosts instanceof List && !ctx?.related?.hosts.contains(ctx?.host?.hostname)) || ctx?.related?.hosts != ctx?.host?.hostname)", + }, + }, + }}, + isErrExpected: false, + }, + { + name: "ES < 7.10.0: existing if with contains", + esVersion: common.MustNewVersion("7.7.7"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "allow_duplicates": false, + "if": "!ctx?.related?.hosts.contains(ctx?.host?.hostname)", + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "value": "{{host.hostname}}", + "if": "!ctx?.related?.hosts.contains(ctx?.host?.hostname)", + }, + }, + }}, + isErrExpected: false, + }, + { + name: "ES < 7.10.0: no value", + esVersion: common.MustNewVersion("7.7.7"), + content: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + "allow_duplicates": false, + }, + }, + }}, + expected: map[string]interface{}{ + "processors": []interface{}{ + map[string]interface{}{ + "append": map[string]interface{}{ + "field": "related.hosts", + }, + }, + }}, + isErrExpected: false, + }, + } + + for _, test := range cases { + test := test + t.Run(test.name, func(t *testing.T) { + t.Parallel() + err := modifyAppendProcessor(*test.esVersion, "foo-pipeline", test.content) + if test.isErrExpected { + assert.Error(t, err) + } else { + assert.NoError(t, err) + assert.Equal(t, test.expected, test.content, test.name) + } + }) + } +} From ab3ee63c22e51d70d7bcb9b7ad9f8f1e3228d64c Mon Sep 17 00:00:00 2001 From: Victor Martinez Date: Mon, 21 Sep 2020 09:08:14 +0100 Subject: [PATCH 027/216] [JJBB][CI] Run beats-tester on master and release branches (#21169) --- .ci/beats-tester.groovy | 106 ++++++++++++++++++++++++++++++++++++++ .ci/jobs/beats-tester.yml | 56 ++++++++++++++++++++ README.md | 3 ++ 3 files changed, 165 insertions(+) create mode 100644 .ci/beats-tester.groovy create mode 100644 .ci/jobs/beats-tester.yml diff --git a/.ci/beats-tester.groovy b/.ci/beats-tester.groovy new file mode 100644 index 00000000000..eb1357700b6 --- /dev/null +++ b/.ci/beats-tester.groovy @@ -0,0 +1,106 @@ +#!/usr/bin/env groovy + +@Library('apm@current') _ + +pipeline { + agent none + environment { + BASE_DIR = 'src/github.com/elastic/beats' + PIPELINE_LOG_LEVEL = "INFO" + BEATS_TESTER_JOB = 'Beats/beats-tester-mbp/master' + } + options { + timeout(time: 1, unit: 'HOURS') + buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20', daysToKeepStr: '30')) + timestamps() + ansiColor('xterm') + disableResume() + durabilityHint('PERFORMANCE_OPTIMIZED') + disableConcurrentBuilds() + } + triggers { + issueCommentTrigger('(?i)^\\/beats-tester$') + upstream("Beats/packaging/${env.JOB_BASE_NAME}") + } + stages { + stage('Filter build') { + agent { label 'ubuntu && immutable' } + when { + beforeAgent true + anyOf { + triggeredBy cause: "IssueCommentCause" + expression { + def ret = isUserTrigger() || isUpstreamTrigger() + if(!ret){ + currentBuild.result = 'NOT_BUILT' + currentBuild.description = "The build has been skipped" + currentBuild.displayName = "#${BUILD_NUMBER}-(Skipped)" + echo("the build has been skipped due the trigger is a branch scan and the allow ones are manual, GitHub comment, and upstream job") + } + return ret + } + } + } + stages { + stage('Checkout') { + options { skipDefaultCheckout() } + steps { + deleteDir() + gitCheckout(basedir: "${BASE_DIR}") + setEnvVar('VERSION', sh(script: "grep ':stack-version:' ${BASE_DIR}/libbeat/docs/version.asciidoc | cut -d' ' -f2", returnStdout: true).trim()) + } + } + stage('Build master') { + options { skipDefaultCheckout() } + when { branch 'master' } + steps { + runBeatsTesterJob(version: "${env.VERSION}-SNAPSHOT") + } + } + stage('Build *.x branch') { + options { skipDefaultCheckout() } + when { branch '*.x' } + steps { + runBeatsTesterJob(version: "${env.VERSION}-SNAPSHOT") + } + } + stage('Build PullRequest') { + options { skipDefaultCheckout() } + when { changeRequest() } + steps { + runBeatsTesterJob(version: "${env.VERSION}-SNAPSHOT", + apm: "https://storage.googleapis.com/apm-ci-artifacts/jobs/pull-requests/pr-${env.CHANGE_ID}", + beats: "https://storage.googleapis.com/beats-ci-artifacts/pull-requests/pr-${env.CHANGE_ID}") + } + } + stage('Build release branch') { + options { skipDefaultCheckout() } + when { + not { + allOf { + branch comparator: 'REGEXP', pattern: '(master|.*x)' + changeRequest() + } + } + } + steps { + runBeatsTesterJob(version: "${env.VERSION}-SNAPSHOT") + } + } + } + } + } +} + +def runBeatsTesterJob(Map args = [:]) { + if (args.apm && args.beats) { + build(job: env.BEATS_TESTER_JOB, propagate: false, wait: false, + parameters: [ + string(name: 'APM_URL_BASE', value: args.apm), + string(name: 'BEATS_URL_BASE', value: args.beats), + string(name: 'VERSION', value: args.version) + ]) + } else { + build(job: env.BEATS_TESTER_JOB, propagate: false, wait: false, parameters: [ string(name: 'VERSION', value: args.version) ]) + } +} \ No newline at end of file diff --git a/.ci/jobs/beats-tester.yml b/.ci/jobs/beats-tester.yml new file mode 100644 index 00000000000..522abfa5e5c --- /dev/null +++ b/.ci/jobs/beats-tester.yml @@ -0,0 +1,56 @@ +--- +- job: + name: Beats/beats-tester + display-name: Beats Tester + description: Run the beats-tester + view: Beats + disabled: false + project-type: multibranch + script-path: .ci/beats-tester.groovy + scm: + - github: + branch-discovery: 'no-pr' + discover-pr-forks-strategy: 'merge-current' + discover-pr-forks-trust: 'permission' + discover-pr-origin: 'merge-current' + discover-tags: true + head-filter-regex: '(master|7\.([x9]|1\d+)|8\.\d+|PR-.*|v\d+\.\d+\.\d+)' + disable-pr-notifications: true + notification-context: 'beats-tester' + repo: 'beats' + repo-owner: 'elastic' + credentials-id: github-app-beats-ci + ssh-checkout: + credentials: f6c7695a-671e-4f4f-a331-acdce44ff9ba + build-strategies: + - skip-initial-build: true + - tags: + ignore-tags-older-than: -1 + ignore-tags-newer-than: 30 + - named-branches: + - exact-name: + name: 'master' + case-sensitive: true + - regex-name: + regex: '7\.([x9]|1\d+)' + case-sensitive: true + - regex-name: + regex: '8\.\d+' + case-sensitive: true + - change-request: + ignore-target-only-changes: true + clean: + after: true + before: true + prune: true + shallow-clone: true + depth: 3 + do-not-fetch-tags: true + submodule: + disable: false + recursive: true + parent-credentials: true + timeout: 100 + timeout: '15' + use-author: true + wipe-workspace: true diff --git a/README.md b/README.md index 03bf4b2a4a4..28965e1734c 100644 --- a/README.md +++ b/README.md @@ -103,7 +103,10 @@ It is possible to trigger some jobs by putting a comment on a GitHub PR. * `/run apm-beats-update` * [apm-beats-packaging][] * `/package` or `/packaging` will kick of a build to generate the packages for beats. +* [apm-beats-tester][] + * `/beats-tester` will kick of a build to validate the generated packages. [beats]: https://beats-ci.elastic.co/job/Beats/job/beats/ [apm-beats-update]: https://beats-ci.elastic.co/job/Beats/job/apm-beats-update/ [apm-beats-packaging]: https://beats-ci.elastic.co/job/Beats/job/packaging/ +[apm-beats-tester]: https://beats-ci.elastic.co/job/Beats/job/beats-tester/ From e770f32be7eea1cd0b097274aaf2752d3a7330f3 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Mon, 21 Sep 2020 11:29:09 +0300 Subject: [PATCH 028/216] Fix remote_write flaky test (#21173) --- CHANGELOG.next.asciidoc | 1 + .../module/prometheus/_meta/prometheus.yml | 2 +- metricbeat/module/prometheus/_meta/run.sh | 20 ------------------- .../module/prometheus/test_prometheus.py | 1 - 4 files changed, 2 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 90ef659fc45..6a938dc8ba9 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -346,6 +346,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Disable Kafka metricsets based on Jolokia by default. They require a different configuration. {pull}20989[20989] - Fix panic index out of range error when getting AWS account name. {pull}21101[21101] {issue}21095[21095] - Handle missing counters in the application_pool metricset. {pull}21071[21071] +- Fix remote_write flaky test. {pull}21173[21173] *Packetbeat* diff --git a/metricbeat/module/prometheus/_meta/prometheus.yml b/metricbeat/module/prometheus/_meta/prometheus.yml index 06707841f8d..b11de8df003 100644 --- a/metricbeat/module/prometheus/_meta/prometheus.yml +++ b/metricbeat/module/prometheus/_meta/prometheus.yml @@ -17,7 +17,7 @@ rule_files: # - "second_rules.yml" remote_write: - - url: "http://REMOTE/write" + - url: "http://0.0.0.0:9201/write" # A scrape configuration containing exactly one endpoint to scrape: # Here it's Prometheus itself. diff --git a/metricbeat/module/prometheus/_meta/run.sh b/metricbeat/module/prometheus/_meta/run.sh index b2cadc95a3e..87b83b6d705 100755 --- a/metricbeat/module/prometheus/_meta/run.sh +++ b/metricbeat/module/prometheus/_meta/run.sh @@ -1,25 +1,5 @@ #!/bin/sh - -for i in 1 2 3 4 5; -do - a=`nslookup host.docker.internal | grep "** server can't find " | wc -l`; - if [ $a -gt 0 ]; then - # this works only on Linux envs - HOST_DOMAIN="0.0.0.0" - else - # this works only on Mac envs - HOST_DOMAIN="host.docker.internal" - break - fi -done - - - -REMOTE="$HOST_DOMAIN:9201" - -sed -i "s/REMOTE/$REMOTE/g" /etc/prometheus/prometheus.yml - /bin/prometheus --config.file=/etc/prometheus/prometheus.yml \ --storage.tsdb.path=/prometheus \ --web.console.libraries=/usr/share/prometheus/console_libraries \ diff --git a/metricbeat/module/prometheus/test_prometheus.py b/metricbeat/module/prometheus/test_prometheus.py index 34b8d9daf37..f882cedb6df 100644 --- a/metricbeat/module/prometheus/test_prometheus.py +++ b/metricbeat/module/prometheus/test_prometheus.py @@ -65,7 +65,6 @@ def test_query(self): self.assert_fields_are_documented(evt) -@unittest.skip("Flaky test: https://github.com/elastic/beats/issues/20967") class TestRemoteWrite(metricbeat.BaseTest): COMPOSE_SERVICES = ['prometheus-host-network'] From 43354ffb18707e4b59a02f3fc5a6871b0b33703b Mon Sep 17 00:00:00 2001 From: Ravi Naik Date: Mon, 21 Sep 2020 05:57:28 -0700 Subject: [PATCH 029/216] Additional bucket name validation for S3 bucket regex (#20887) ## What does this PR do? This is a bug fix when functionbeat errors out with a blanket error message. According to me, this error can be mitigated pretty early by validating the S3 bucket name by creating the regex patterns from the rules for bucket naming. https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html#bucketnamingrules ## Why is it important? This will restrict users from shooting themselves in their foot when they pass an incorrect bucket name in the functionbeat configuration. ## Related issues Closes #17572 --- CHANGELOG.next.asciidoc | 1 + .../functionbeat/provider/aws/aws/config.go | 6 ++++ .../provider/aws/aws/config_test.go | 30 +++++++++++++++++++ 3 files changed, 37 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6a938dc8ba9..2e89512f722 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -364,6 +364,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix timeout option of GCP functions. {issue}16282[16282] {pull}16287[16287] - Do not need Google credentials if not required for the operation. {issue}17329[17329] {pull}21072[21072] - Fix dependency issues of GCP functions. {issue}20830[20830] {pull}21070[21070] +- Fix catchall bucket config errors by adding more validation. {issue}17572[16282] {pull}20887[16287] ==== Added diff --git a/x-pack/functionbeat/provider/aws/aws/config.go b/x-pack/functionbeat/provider/aws/aws/config.go index 604035522b5..932b8a1bc52 100644 --- a/x-pack/functionbeat/provider/aws/aws/config.go +++ b/x-pack/functionbeat/provider/aws/aws/config.go @@ -153,6 +153,12 @@ func (b *bucket) Unpack(s string) error { return fmt.Errorf("bucket name '%s' is too short, name need to be at least %d chars long", s, min) } + const bucketNamePattern = "^[a-z0-9][a-z0-9.\\-]{1,61}[a-z0-9]$" + var bucketRE = regexp.MustCompile(bucketNamePattern) + if !bucketRE.MatchString(s) { + return fmt.Errorf("invalid bucket name: '%s', bucket name must match pattern: '%s'", s, bucketNamePattern) + } + *b = bucket(s) return nil } diff --git a/x-pack/functionbeat/provider/aws/aws/config_test.go b/x-pack/functionbeat/provider/aws/aws/config_test.go index ac8e325804e..ef1045f188e 100644 --- a/x-pack/functionbeat/provider/aws/aws/config_test.go +++ b/x-pack/functionbeat/provider/aws/aws/config_test.go @@ -66,6 +66,36 @@ func TestBucket(t *testing.T) { err := b.Unpack("he") assert.Error(t, err) }) + + t.Run("bucket regex pattern, disallows semi-colon", func(t *testing.T) { + b := bucket("") + err := b.Unpack("asdfdaf;dfadsfadsf") + assert.Error(t, err) + }) + + t.Run("bucket regex pattern, disallows slash", func(t *testing.T) { + b := bucket("") + err := b.Unpack("asdfdaf/dfadsfadsf") + assert.Error(t, err) + }) + + t.Run("bucket regex pattern, allows dots", func(t *testing.T) { + b := bucket("") + err := b.Unpack("this.is.a.bucket") + if !assert.NoError(t, err) { + return + } + assert.Equal(t, bucket("this.is.a.bucket"), b) + }) + + t.Run("bucket regex pattern, allows hyphens", func(t *testing.T) { + b := bucket("") + err := b.Unpack("this-is-a-bucket") + if !assert.NoError(t, err) { + return + } + assert.Equal(t, bucket("this-is-a-bucket"), b) + }) } func TestNormalize(t *testing.T) { From 35272649826f10560eb9d481464ae930f46fa7ee Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 21 Sep 2020 16:17:50 +0200 Subject: [PATCH 030/216] Some fixes in Cloud Foundry fields (#21175) Remove redundant and undocumented `cloudfoundry.*.timestamp` fields. Add missing documentation about envelope fields. Update `data.json` files in metricbeat module. --- CHANGELOG.next.asciidoc | 1 + x-pack/libbeat/common/cloudfoundry/events.go | 5 +-- .../common/cloudfoundry/events_test.go | 22 ++++------ .../_meta/fields.yml | 40 +++++++++++++++--- .../cloudfoundry/container/_meta/data.json | 42 ++++++++----------- .../cloudfoundry/counter/_meta/data.json | 30 +++++-------- .../module/cloudfoundry/value/_meta/data.json | 34 ++++++--------- 7 files changed, 84 insertions(+), 90 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 2e89512f722..11e9a722d80 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -21,6 +21,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove the deprecated `xpack.monitoring.*` settings. Going forward only `monitoring.*` settings may be used. {issue}9424[9424] {pull}18608[18608] - Added `certificate` TLS verification mode to ignore server name mismatch. {issue}12283[12283] {pull}20293[20293] - Autodiscover doesn't generate any configuration when a variable is missing. Previously it generated an incomplete configuration. {pull}20898[20898] +- Remove redundant `cloudfoundry.*.timestamp` fields. This value is set in `@timestamp`. {pull}21175[21175] *Auditbeat* diff --git a/x-pack/libbeat/common/cloudfoundry/events.go b/x-pack/libbeat/common/cloudfoundry/events.go index f134585ac65..3006c472ccd 100644 --- a/x-pack/libbeat/common/cloudfoundry/events.go +++ b/x-pack/libbeat/common/cloudfoundry/events.go @@ -492,10 +492,7 @@ func envelopMap(evt Event) common.MapStr { func baseMap(evt Event) common.MapStr { return common.MapStr{ "cloudfoundry": common.MapStr{ - "type": evt.String(), - evt.String(): common.MapStr{ - "timestamp": evt.Timestamp(), - }, + "type": evt.String(), "envelope": envelopMap(evt), }, } diff --git a/x-pack/libbeat/common/cloudfoundry/events_test.go b/x-pack/libbeat/common/cloudfoundry/events_test.go index e4fe6f39caf..91145589969 100644 --- a/x-pack/libbeat/common/cloudfoundry/events_test.go +++ b/x-pack/libbeat/common/cloudfoundry/events_test.go @@ -76,9 +76,6 @@ func TestEventTypeHttpAccess(t *testing.T) { assert.Equal(t, common.MapStr{ "cloudfoundry": common.MapStr{ "type": "access", - "access": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), - }, "envelope": common.MapStr{ "origin": "origin", "deployment": "deployment", @@ -148,7 +145,6 @@ func TestEventTypeLog(t *testing.T) { "cloudfoundry": common.MapStr{ "type": "log", "log": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), "source": common.MapStr{ "instance": evt.SourceID(), "type": evt.SourceType(), @@ -200,10 +196,9 @@ func TestEventCounter(t *testing.T) { "cloudfoundry": common.MapStr{ "type": "counter", "counter": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), - "name": "name", - "delta": uint64(10), - "total": uint64(999), + "name": "name", + "delta": uint64(10), + "total": uint64(999), }, "envelope": common.MapStr{ "origin": "origin", @@ -246,10 +241,9 @@ func TestEventValueMetric(t *testing.T) { "cloudfoundry": common.MapStr{ "type": "value", "value": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), - "name": "name", - "value": 10.1, - "unit": "unit", + "name": "name", + "value": 10.1, + "unit": "unit", }, "envelope": common.MapStr{ "origin": "origin", @@ -304,7 +298,6 @@ func TestEventContainerMetric(t *testing.T) { "cloudfoundry": common.MapStr{ "type": "container", "container": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), "instance_index": int32(1), "cpu.pct": 0.2, "memory.bytes": uint64(1024), @@ -356,8 +349,7 @@ func TestEventError(t *testing.T) { "cloudfoundry": common.MapStr{ "type": "error", "error": common.MapStr{ - "timestamp": time.Unix(0, 1587469726082), - "source": "source", + "source": "source", }, "envelope": common.MapStr{ "origin": "origin", diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml b/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml index bd6e158bb36..0ac4a813d50 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml @@ -11,29 +11,57 @@ - name: app.id type: keyword description: > - Cloud Foundry application ID + Cloud Foundry application identifier. - name: app.name type: keyword description: > - Cloud Foundry application name + Cloud Foundry application name. - name: space.id type: keyword description: > - Cloud Foundry space name + Cloud Foundry space identifier. - name: space.name type: keyword description: > - Cloud Foundry space name + Cloud Foundry space name. - name: org.id type: keyword description: > - Cloud Foundry organization ID + Cloud Foundry organization identifier. - name: org.name type: keyword description: > - Cloud Foundry organization name + Cloud Foundry organization name. + + - name: envelope + type: group + fields: + - name: deployment + type: keyword + description: > + Identifier of the Cloud Foundry deployment where this event was created. + + - name: index + type: keyword + description: > + Envelope index. + + - name: ip + type: ip + description: > + IP address of the node where the job that created this event is running. + + - name: job + type: keyword + description: > + Job name. + + - name: origin + type: keyword + description: > + Name of the deployment that created this event. diff --git a/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json index 3d1f51694e4..389b0bc54f9 100644 --- a/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json @@ -1,35 +1,27 @@ { - "@timestamp": "2020-02-27T18:09:35.583Z", + "@timestamp": "2017-10-12T08:05:34.853Z", "cloudfoundry": { + "app": { + "id": "c0874969-2811-4d80-837a-301fd485a7bf" + }, "container": { - "instance_index": 0, - "cpu.pct": 0.18815706013687805, - "memory.bytes": 23320985, - "memory.quota.bytes": 134217728, - "disk.bytes": 186187776, - "timestamp": "2020-02-27T18:09:35.583Z", - "type": "container", - "disk.quota.bytes": 2122136037 + "cpu.pct": 0.45456369228159, + "disk.bytes": 21970944, + "disk.quota.bytes": 1073741824, + "instance_index": 1, + "memory.bytes": 14101162, + "memory.quota.bytes": 67108864 }, "envelope": { - "origin": "rep", - "deployment": "cf", - "ip": "10.144.0.13", - "job": "diego-cell", - "index": "3a0034ac-59ef-43e2-8b06-b14b32fe62f0" + "deployment": "cf-6b7aee31c8d07637ad78", + "index": "8895cf68-2e4f-4c50-9842-e73febd65c2d", + "ip": "192.168.16.31", + "job": "diego_cell", + "origin": "rep" }, - "app": { - "id": "8cfc6857-3576-45a9-b1cd-890b28aa9c4a" - } - }, - "event": { - "dataset": "cloudfoundry.container", - "module": "cloudfoundry" - }, - "metricset": { - "name": "container" + "type": "container" }, "service": { "type": "cloudfoundry" } -} +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json index d6f155213af..b9104346eac 100644 --- a/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json @@ -1,29 +1,21 @@ { - "@timestamp": "2020-02-24T18:49:02.674Z", + "@timestamp": "2017-10-12T08:05:34.853Z", "cloudfoundry": { "counter": { - "total": 0, - "name": "promhttp_metric_handler_errors_total", "delta": 0, - "timestamp": "2020-02-24T18:49:02.674Z", - "type": "counter" + "name": "sinks.dropped", + "total": 89547093 }, "envelope": { - "origin": "loggregator_forwarder_agent", - "deployment": "cf", - "ip": "10.144.0.13", - "job": "diego-cell", - "index": "1e58e943-a498-4339-9d5f-2885bf223db9" - } - }, - "event": { - "dataset": "cloudfoundry.counter", - "module": "cloudfoundry" - }, - "metricset": { - "name": "counter" + "deployment": "cf-6b7aee31c8d07637ad78", + "index": "9adedbd0-3af3-47af-9707-99016050b123", + "ip": "192.168.16.54", + "job": "doppler", + "origin": "loggregator.doppler" + }, + "type": "counter" }, "service": { "type": "cloudfoundry" } -} +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json index bf70762fd38..feeb2ce72ba 100644 --- a/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json @@ -1,29 +1,21 @@ { - "@timestamp": "2020-02-27T18:20:48.379Z", + "@timestamp": "2017-10-12T08:05:34.853Z", "cloudfoundry": { - "value": { - "unit": "", - "value": 5.125735912782789e-05, - "timestamp": "2020-02-27T18:20:48.379Z", - "type": "value", - "name": "go_memstats_gc_cpu_fraction" - }, "envelope": { - "origin": "loggregator_forwarder_agent", - "deployment": "cf", - "ip": "10.144.0.11", - "job": "scheduler", - "index": "d6b7bb59-ac57-4ed5-a0a7-0b23e19d9f8f" + "deployment": "cf-6b7aee31c8d07637ad78", + "index": "439bb519-3e68-4d08-a973-8f013f364d61", + "ip": "192.168.16.18", + "job": "cloud_controller", + "origin": "routing_api" + }, + "type": "value", + "value": { + "name": "memoryStats.lastGCPauseTimeNS", + "unit": "count", + "value": 77499 } }, - "event": { - "dataset": "cloudfoundry.value", - "module": "cloudfoundry" - }, - "metricset": { - "name": "value" - }, "service": { "type": "cloudfoundry" } -} +} \ No newline at end of file From 578a0f90dfc35ef3587ac4c2d93ba2a6dc29cb5c Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Mon, 21 Sep 2020 20:06:37 +0200 Subject: [PATCH 031/216] [Filebeat][Azure Module] Fixing event.outcome from result_type issue (#20998) * fixing a small typo in result type and adding more event.outcome possibilities * Updating changelog --- CHANGELOG.next.asciidoc | 1 + .../filebeat/module/azure/activitylogs/ingest/pipeline.yml | 7 ++++++- .../test/supporttickets_write.log-expected.json | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 11e9a722d80..214e3640732 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -577,6 +577,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Convert httpjson to v2 input {pull}20226[20226] - Improve Zeek x509 module with `x509` ECS mappings {pull}20867[20867] - Improve Zeek SSL module with `x509` ECS mappings {pull}20927[20927] +- Added new properties field support for event.outcome in azure module {pull}20998[20998] - Improve Zeek Kerberos module with `x509` ECS mappings {pull}20958[20958] - Improve Fortinet firewall module with `x509` ECS mappings {pull}20983[20983] - Improve Santa module with `x509` ECS mappings {pull}20976[20976] diff --git a/x-pack/filebeat/module/azure/activitylogs/ingest/pipeline.yml b/x-pack/filebeat/module/azure/activitylogs/ingest/pipeline.yml index f8f10132a0d..2d75cb07241 100644 --- a/x-pack/filebeat/module/azure/activitylogs/ingest/pipeline.yml +++ b/x-pack/filebeat/module/azure/activitylogs/ingest/pipeline.yml @@ -74,7 +74,12 @@ processors: field: azure.activitylogs.result_type target_field: event.outcome type: string - if: "ctx?.azure?.activitylogs?.resultType != null && ctx.azure.activitylogs.resultType instanceof String && (ctx.azure.activitylogs.resultType.toLowerCase() == 'success' || ctx.azure.activitylogs.resultType.toLowerCase() == 'failure')" + if: "ctx?.azure?.activitylogs?.result_type != null && ctx.azure.activitylogs.result_type instanceof String && (ctx.azure.activitylogs.result_type.toLowerCase() == 'success' || ctx.azure.activitylogs.result_type.toLowerCase() == 'failure')" +- convert: + field: azure.activitylogs.properties.result + target_field: event.outcome + type: string + if: "ctx?.event?.outcome == null && ctx?.azure?.activitylogs?.properties?.result != null && ctx?.azure?.activitylogs?.properties?.result instanceof String && ['success', 'failure', 'unknown'].contains(ctx.azure?.activitylogs?.properties?.result)" - rename: field: azure.activitylogs.operationName target_field: azure.activitylogs.operation_name diff --git a/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json b/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json index 7ba307ee669..db962bd4df6 100644 --- a/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json +++ b/x-pack/filebeat/module/azure/activitylogs/test/supporttickets_write.log-expected.json @@ -45,6 +45,7 @@ "event.duration": -1468967296, "event.kind": "event", "event.module": "azure", + "event.outcome": "success", "event.type": [ "change" ], From 4a275620fd336a536e7e934103d11151458e7c79 Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Mon, 21 Sep 2020 15:34:00 -0600 Subject: [PATCH 032/216] Add host inventory metrics to system module (#20415) * Add host inventory metrics to system module * Update data.json files --- CHANGELOG.next.asciidoc | 1 + metricbeat/module/system/cpu/_meta/data.json | 46 +++++++++--------- metricbeat/module/system/cpu/cpu.go | 4 +- .../module/system/diskio/_meta/data.json | 23 ++++----- metricbeat/module/system/diskio/diskio.go | 32 +++++++++++++ .../module/system/network/_meta/data.json | 19 ++++---- metricbeat/module/system/network/network.go | 47 ++++++++++++++++++- metricbeat/module/system/test_system.py | 38 +++++++++++---- 8 files changed, 154 insertions(+), 56 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 214e3640732..e5e910bd06b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -700,6 +700,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add state_daemonset metricset for Kubernetes Metricbeat module {pull}20649[20649] - Add host inventory metrics to azure compute_vm metricset. {pull}20641[20641] - Add host inventory metrics to googlecloud compute metricset. {pull}20391[20391] +- Add host inventory metrics to system module. {pull}20415[20415] - Add billing data collection from Cost Explorer into aws billing metricset. {pull}20527[20527] {issue}20103[20103] - Migrate `compute_vm` metricset to a light one, map `cloud.instance.id` field. {pull}20889[20889] - Request prometheus endpoints to be gzipped by default {pull}20766[20766] diff --git a/metricbeat/module/system/cpu/_meta/data.json b/metricbeat/module/system/cpu/_meta/data.json index ff6b7a15491..4a5fd7c8ff7 100644 --- a/metricbeat/module/system/cpu/_meta/data.json +++ b/metricbeat/module/system/cpu/_meta/data.json @@ -1,36 +1,38 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.cpu", "duration": 115000, "module": "system" }, + "host": { + "cpu": { + "pct": 0.0816 + } + }, "metricset": { - "name": "cpu" + "name": "cpu", + "period": 10000 }, "service": { "type": "system" }, "system": { "cpu": { - "cores": 4, + "cores": 12, "idle": { "norm": { - "pct": 0.7198 + "pct": 0.9184 }, - "pct": 2.8792, - "ticks": 81308898 + "pct": 11.0208, + "ticks": 1964402 }, "iowait": { "norm": { "pct": 0 }, "pct": 0, - "ticks": 499109 + "ticks": 5083 }, "irq": { "norm": { @@ -44,14 +46,14 @@ "pct": 0 }, "pct": 0, - "ticks": 172471 + "ticks": 9752 }, "softirq": { "norm": { - "pct": 0 + "pct": 0.0058 }, - "pct": 0, - "ticks": 578041 + "pct": 0.0699, + "ticks": 10386 }, "steal": { "norm": { @@ -62,23 +64,23 @@ }, "system": { "norm": { - "pct": 0.0591 + "pct": 0.005 }, - "pct": 0.2365, - "ticks": 25140781 + "pct": 0.06, + "ticks": 22274 }, "total": { "norm": { - "pct": 0.2802 + "pct": 0.0816 }, - "pct": 1.1208 + "pct": 0.9792 }, "user": { "norm": { - "pct": 0.2211 + "pct": 0.0708 }, - "pct": 0.8843, - "ticks": 75216920 + "pct": 0.8493, + "ticks": 123767 } } } diff --git a/metricbeat/module/system/cpu/cpu.go b/metricbeat/module/system/cpu/cpu.go index 8d017f0d373..7333df6dec7 100644 --- a/metricbeat/module/system/cpu/cpu.go +++ b/metricbeat/module/system/cpu/cpu.go @@ -70,7 +70,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { } event := common.MapStr{"cores": cpu.NumCores} - + hostFields := common.MapStr{} for _, metric := range m.config.Metrics { switch strings.ToLower(metric) { case percentages: @@ -95,6 +95,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { event.Put("softirq.norm.pct", normalizedPct.SoftIRQ) event.Put("steal.norm.pct", normalizedPct.Steal) event.Put("total.norm.pct", normalizedPct.Total) + hostFields.Put("host.cpu.pct", normalizedPct.Total) case ticks: ticks := sample.Ticks() event.Put("user.ticks", ticks.User) @@ -109,6 +110,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { } r.Event(mb.Event{ + RootFields: hostFields, MetricSetFields: event, }) diff --git a/metricbeat/module/system/diskio/_meta/data.json b/metricbeat/module/system/diskio/_meta/data.json index 291b1d23840..b9c8533b0c8 100644 --- a/metricbeat/module/system/diskio/_meta/data.json +++ b/metricbeat/module/system/diskio/_meta/data.json @@ -1,16 +1,13 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.diskio", "duration": 115000, "module": "system" }, "metricset": { - "name": "diskio" + "name": "diskio", + "period": 10000 }, "service": { "type": "system" @@ -18,7 +15,7 @@ "system": { "diskio": { "io": { - "time": 656 + "time": 364 }, "iostat": { "await": 0, @@ -51,16 +48,16 @@ } } }, - "name": "nvme0n1p1", + "name": "loop1", "read": { - "bytes": 8028160, - "count": 3290, - "time": 130016 + "bytes": 5267456, + "count": 4124, + "time": 557 }, "write": { - "bytes": 5120, - "count": 3, - "time": 12 + "bytes": 0, + "count": 0, + "time": 0 } } } diff --git a/metricbeat/module/system/diskio/diskio.go b/metricbeat/module/system/diskio/diskio.go index 80c494409a3..9da3a3c2344 100644 --- a/metricbeat/module/system/diskio/diskio.go +++ b/metricbeat/module/system/diskio/diskio.go @@ -38,6 +38,13 @@ type MetricSet struct { mb.BaseMetricSet statistics *DiskIOStat includeDevices []string + prevCounters diskCounter +} + +// diskCounter stores previous disk counter values for calculating gauges in next collection +type diskCounter struct { + prevDiskReadBytes uint64 + prevDiskWriteBytes uint64 } // New is a mb.MetricSetFactory that returns a new MetricSet. @@ -54,6 +61,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { BaseMetricSet: base, statistics: NewDiskIOStat(), includeDevices: config.IncludeDevices, + prevCounters: diskCounter{}, }, nil } @@ -70,6 +78,7 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { // Store the last cpu counter when finished defer m.statistics.CloseSampling() + var diskReadBytes, diskWriteBytes uint64 for _, counters := range stats { event := common.MapStr{ "name": counters.Name, @@ -87,6 +96,11 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { "time": counters.IoTime, }, } + + // accumulate values from all interfaces + diskReadBytes += counters.ReadBytes + diskWriteBytes += counters.WriteBytes + var extraMetrics DiskIOMetric err := m.statistics.CalIOStatistics(&extraMetrics, counters) if err == nil { @@ -135,5 +149,23 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { } } + if m.prevCounters != (diskCounter{}) { + // convert network metrics from counters to gauges + r.Event(mb.Event{ + RootFields: common.MapStr{ + "host": common.MapStr{ + "disk": common.MapStr{ + "read.bytes": diskReadBytes - m.prevCounters.prevDiskReadBytes, + "write.bytes": diskWriteBytes - m.prevCounters.prevDiskWriteBytes, + }, + }, + }, + }) + } + + // update prevCounters + m.prevCounters.prevDiskReadBytes = diskReadBytes + m.prevCounters.prevDiskWriteBytes = diskWriteBytes + return nil } diff --git a/metricbeat/module/system/network/_meta/data.json b/metricbeat/module/system/network/_meta/data.json index 8cf8a5f69a6..81c174c93e8 100644 --- a/metricbeat/module/system/network/_meta/data.json +++ b/metricbeat/module/system/network/_meta/data.json @@ -1,16 +1,13 @@ { "@timestamp": "2017-10-12T08:05:34.853Z", - "agent": { - "hostname": "host.example.com", - "name": "host.example.com" - }, "event": { "dataset": "system.network", "duration": 115000, "module": "system" }, "metricset": { - "name": "network" + "name": "network", + "period": 10000 }, "service": { "type": "system" @@ -18,17 +15,17 @@ "system": { "network": { "in": { - "bytes": 37904869172, - "dropped": 32, + "bytes": 0, + "dropped": 0, "errors": 0, - "packets": 32143403 + "packets": 0 }, - "name": "wlp4s0", + "name": "br-18285ad7f418", "out": { - "bytes": 6299331926, + "bytes": 0, "dropped": 0, "errors": 0, - "packets": 13362703 + "packets": 0 } } } diff --git a/metricbeat/module/system/network/network.go b/metricbeat/module/system/network/network.go index d9c04d83420..4796b5af841 100644 --- a/metricbeat/module/system/network/network.go +++ b/metricbeat/module/system/network/network.go @@ -43,7 +43,16 @@ func init() { // MetricSet for fetching system network IO metrics. type MetricSet struct { mb.BaseMetricSet - interfaces map[string]struct{} + interfaces map[string]struct{} + prevCounters networkCounter +} + +// networkCounter stores previous network counter values for calculating gauges in next collection +type networkCounter struct { + prevNetworkInBytes uint64 + prevNetworkInPackets uint64 + prevNetworkOutBytes uint64 + prevNetworkOutPackets uint64 } // New is a mb.MetricSetFactory that returns a new MetricSet. @@ -69,6 +78,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) { return &MetricSet{ BaseMetricSet: base, interfaces: interfaceSet, + prevCounters: networkCounter{}, }, nil } @@ -79,6 +89,8 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { return errors.Wrap(err, "network io counters") } + var networkInBytes, networkOutBytes, networkInPackets, networkOutPackets uint64 + for _, counters := range stats { if m.interfaces != nil { // Select stats by interface name. @@ -91,11 +103,44 @@ func (m *MetricSet) Fetch(r mb.ReporterV2) error { isOpen := r.Event(mb.Event{ MetricSetFields: ioCountersToMapStr(counters), }) + + // accumulate values from all interfaces + networkInBytes += counters.BytesRecv + networkOutBytes += counters.BytesSent + networkInPackets += counters.PacketsRecv + networkOutPackets += counters.PacketsSent + if !isOpen { return nil } } + if m.prevCounters != (networkCounter{}) { + // convert network metrics from counters to gauges + r.Event(mb.Event{ + RootFields: common.MapStr{ + "host": common.MapStr{ + "network": common.MapStr{ + "in": common.MapStr{ + "bytes": networkInBytes - m.prevCounters.prevNetworkInBytes, + "packets": networkInPackets - m.prevCounters.prevNetworkInPackets, + }, + "out": common.MapStr{ + "bytes": networkOutBytes - m.prevCounters.prevNetworkOutBytes, + "packets": networkOutPackets - m.prevCounters.prevNetworkOutPackets, + }, + }, + }, + }, + }) + } + + // update prevCounters + m.prevCounters.prevNetworkInBytes = networkInBytes + m.prevCounters.prevNetworkInPackets = networkInPackets + m.prevCounters.prevNetworkOutBytes = networkOutBytes + m.prevCounters.prevNetworkOutPackets = networkOutPackets + return nil } diff --git a/metricbeat/module/system/test_system.py b/metricbeat/module/system/test_system.py index ce8670781db..f689b99fb4c 100644 --- a/metricbeat/module/system/test_system.py +++ b/metricbeat/module/system/test_system.py @@ -45,6 +45,12 @@ SYSTEM_NETWORK_FIELDS = ["name", "out.bytes", "in.bytes", "out.packets", "in.packets", "in.error", "out.error", "in.dropped", "out.dropped"] +SYSTEM_CPU_HOST_FIELDS = ["pct"] + +SYSTEM_NETWORK_HOST_FIELDS = ["in.bytes", "out.bytes", "in.packets", "out.packets"] + +SYSTEM_DISK_HOST_FIELDS = ["read.bytes", "write.bytes"] + # cmdline is also part of the system process fields, but it may not be present # for some kernel level processes. fd is also part of the system process, but # is not available on all OSes and requires root to read for all processes. @@ -74,8 +80,12 @@ def test_cpu(self): evt = output[0] self.assert_fields_are_documented(evt) - cpu = evt["system"]["cpu"] - self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS), cpu.keys()) + if "system" in evt: + cpu = evt["system"]["cpu"] + self.assertCountEqual(self.de_dot(SYSTEM_CPU_FIELDS), cpu.keys()) + else: + host_cpu = evt["host"]["cpu"] + self.assertCountEqual(self.de_dot(SYSTEM_CPU_HOST_FIELDS), host_cpu.keys()) @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd|openbsd", sys.platform), "os") def test_cpu_ticks_option(self): @@ -196,8 +206,12 @@ def test_diskio(self): for evt in output: self.assert_fields_are_documented(evt) if 'error' not in evt: - diskio = evt["system"]["diskio"] - self.assertCountEqual(self.de_dot(SYSTEM_DISKIO_FIELDS), diskio.keys()) + if "system" in evt: + diskio = evt["system"]["diskio"] + self.assertCountEqual(self.de_dot(SYSTEM_DISKIO_FIELDS), diskio.keys()) + elif "host" in evt: + host_disk = evt["host"]["disk"] + self.assertCountEqual(SYSTEM_DISK_HOST_FIELDS, host_disk.keys()) @unittest.skipUnless(re.match("(?i)linux", sys.platform), "os") def test_diskio_linux(self): @@ -219,8 +233,12 @@ def test_diskio_linux(self): for evt in output: self.assert_fields_are_documented(evt) - diskio = evt["system"]["diskio"] - self.assertCountEqual(self.de_dot(SYSTEM_DISKIO_FIELDS_LINUX), diskio.keys()) + if "system" in evt: + diskio = evt["system"]["diskio"] + self.assertCountEqual(self.de_dot(SYSTEM_DISKIO_FIELDS_LINUX), diskio.keys()) + else: + host_disk = evt["host"]["disk"] + self.assertCountEqual(SYSTEM_DISK_HOST_FIELDS, host_disk.keys()) @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd|openbsd", sys.platform), "os") def test_filesystem(self): @@ -328,8 +346,12 @@ def test_network(self): for evt in output: self.assert_fields_are_documented(evt) - network = evt["system"]["network"] - self.assertCountEqual(self.de_dot(SYSTEM_NETWORK_FIELDS), network.keys()) + if "system" in evt: + network = evt["system"]["network"] + self.assertCountEqual(self.de_dot(SYSTEM_NETWORK_FIELDS), network.keys()) + else: + host_network = evt["host"]["network"] + self.assertCountEqual(self.de_dot(SYSTEM_NETWORK_HOST_FIELDS), host_network.keys()) @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd", sys.platform), "os") def test_process_summary(self): From 6fd63e75d6acfba37ee43ee42278e9e36770121d Mon Sep 17 00:00:00 2001 From: Andrew Wilkins Date: Tue, 22 Sep 2020 10:14:57 +0800 Subject: [PATCH 033/216] [packaging] use docker.elastic.co/ubi8/ubi-minimal (#21154) Use the docker.elastic.co registry for sourcing the UBI. --- dev-tools/packaging/packages.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml index fec57894775..1cfd2402193 100644 --- a/dev-tools/packaging/packages.yml +++ b/dev-tools/packaging/packages.yml @@ -509,7 +509,7 @@ shared: - &docker_ubi_spec extra_vars: image_name: '{{.BeatName}}-ubi8' - from: 'registry.access.redhat.com/ubi8/ubi-minimal' + from: 'docker.elastic.co/ubi8/ubi-minimal' - &elastic_docker_spec extra_vars: From 78dc0cfea8a13e9303992f4350368a5d6f7e3802 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 22 Sep 2020 10:19:22 +0200 Subject: [PATCH 034/216] Fix libbeat.output.*.bytes metrics of Elasticsearch output (#21197) ## What does this PR do? This PR passes a missing parameter to the constructor `elasticsearch.Client`. ## Why is it important? The missing parameter prevented Beats from reporting the metrics `libbeat.output.write.bytes` and `libbeat.output.read.bytes` in case of Elasticsearch output. ## Related issues Closes #20752 --- CHANGELOG.next.asciidoc | 1 + libbeat/outputs/elasticsearch/client.go | 1 + .../elasticsearch/client_integration_test.go | 31 ++++++++++++++----- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e5e910bd06b..417e4ccc0e2 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -172,6 +172,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add missing country_name geo field in `add_host_metadata` and `add_observer_metadata` processors. {issue}20796[20796] {pull}20811[20811] - [Autodiscover] Handle input-not-finished errors in config reload. {pull}20915[20915] - Explicitly detect missing variables in autodiscover configuration, log them at the debug level. {issue}20568[20568] {pull}20898[20898] +- Fix `libbeat.output.write.bytes` and `libbeat.output.read.bytes` metrics of the Elasticsearch output. {issue}20752[20752] {pull}21197[21197] *Auditbeat* diff --git a/libbeat/outputs/elasticsearch/client.go b/libbeat/outputs/elasticsearch/client.go index 3afa7084057..0794ee1c13b 100644 --- a/libbeat/outputs/elasticsearch/client.go +++ b/libbeat/outputs/elasticsearch/client.go @@ -90,6 +90,7 @@ func NewClient( Kerberos: s.Kerberos, Proxy: s.Proxy, ProxyDisable: s.ProxyDisable, + Observer: s.Observer, Parameters: s.Parameters, CompressionLevel: s.CompressionLevel, EscapeHTML: s.EscapeHTML, diff --git a/libbeat/outputs/elasticsearch/client_integration_test.go b/libbeat/outputs/elasticsearch/client_integration_test.go index 9abbbe39873..e243cb7d1e4 100644 --- a/libbeat/outputs/elasticsearch/client_integration_test.go +++ b/libbeat/outputs/elasticsearch/client_integration_test.go @@ -40,6 +40,7 @@ import ( "github.com/elastic/beats/v7/libbeat/esleg/eslegtest" "github.com/elastic/beats/v7/libbeat/idxmgmt" "github.com/elastic/beats/v7/libbeat/logp" + "github.com/elastic/beats/v7/libbeat/monitoring" "github.com/elastic/beats/v7/libbeat/outputs" "github.com/elastic/beats/v7/libbeat/outputs/outest" ) @@ -78,7 +79,7 @@ func TestClientPublishEventKerberosAware(t *testing.T) { } func testPublishEvent(t *testing.T, index string, cfg map[string]interface{}) { - output, client := connectTestEs(t, cfg) + output, client := connectTestEsWithStats(t, cfg, index) // drop old index preparing test client.conn.Delete(index, "", "", nil) @@ -107,6 +108,12 @@ func testPublishEvent(t *testing.T, index string, cfg map[string]interface{}) { } assert.Equal(t, 1, resp.Count) + + outputSnapshot := monitoring.CollectFlatSnapshot(monitoring.Default.GetRegistry("output-"+index), monitoring.Full, true) + assert.Greater(t, outputSnapshot.Ints["write.bytes"], int64(0), "output.events.write.bytes must be greater than 0") + assert.Greater(t, outputSnapshot.Ints["read.bytes"], int64(0), "output.events.read.bytes must be greater than 0") + assert.Equal(t, int64(0), outputSnapshot.Ints["write.errors"]) + assert.Equal(t, int64(0), outputSnapshot.Ints["read.errors"]) } func TestClientPublishEventWithPipeline(t *testing.T) { @@ -117,7 +124,7 @@ func TestClientPublishEventWithPipeline(t *testing.T) { index := "beat-int-pub-single-with-pipeline" pipeline := "beat-int-pub-single-pipeline" - output, client := connectTestEs(t, obj{ + output, client := connectTestEsWithoutStats(t, obj{ "index": index, "pipeline": "%{[pipeline]}", }) @@ -199,7 +206,7 @@ func TestClientBulkPublishEventsWithPipeline(t *testing.T) { index := "beat-int-pub-bulk-with-pipeline" pipeline := "beat-int-pub-bulk-pipeline" - output, client := connectTestEs(t, obj{ + output, client := connectTestEsWithoutStats(t, obj{ "index": index, "pipeline": "%{[pipeline]}", }) @@ -276,7 +283,7 @@ func TestClientBulkPublishEventsWithPipeline(t *testing.T) { func TestClientPublishTracer(t *testing.T) { index := "beat-apm-tracer-test" - output, client := connectTestEs(t, map[string]interface{}{ + output, client := connectTestEsWithoutStats(t, map[string]interface{}{ "index": index, }) @@ -314,7 +321,17 @@ func TestClientPublishTracer(t *testing.T) { assert.Equal(t, "/_bulk", secondSpan.Context.HTTP.URL.Path) } -func connectTestEs(t *testing.T, cfg interface{}) (outputs.Client, *Client) { +func connectTestEsWithStats(t *testing.T, cfg interface{}, suffix string) (outputs.Client, *Client) { + m := monitoring.Default.NewRegistry("output-" + suffix) + s := outputs.NewStats(m) + return connectTestEs(t, cfg, s) +} + +func connectTestEsWithoutStats(t *testing.T, cfg interface{}) (outputs.Client, *Client) { + return connectTestEs(t, cfg, outputs.NewNilObserver()) +} + +func connectTestEs(t *testing.T, cfg interface{}, stats outputs.Observer) (outputs.Client, *Client) { config, err := common.NewConfigFrom(map[string]interface{}{ "hosts": eslegtest.GetEsHost(), "username": eslegtest.GetUser(), @@ -337,7 +354,7 @@ func connectTestEs(t *testing.T, cfg interface{}) (outputs.Client, *Client) { info := beat.Info{Beat: "libbeat"} im, _ := idxmgmt.DefaultSupport(nil, info, nil) - output, err := makeES(im, info, outputs.NewNilObserver(), config) + output, err := makeES(im, info, stats, config) if err != nil { t.Fatal(err) } @@ -356,7 +373,7 @@ func connectTestEs(t *testing.T, cfg interface{}) (outputs.Client, *Client) { // setupRoleMapping sets up role mapping for the Kerberos user beats@ELASTIC func setupRoleMapping(t *testing.T, host string) error { - _, client := connectTestEs(t, map[string]interface{}{ + _, client := connectTestEsWithoutStats(t, map[string]interface{}{ "hosts": host, "username": "elastic", "password": "changeme", From f5cd53ee9aebf6e4454cdab38f7e1b48c8e77bf8 Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 22 Sep 2020 13:41:26 +0200 Subject: [PATCH 035/216] [Ingest Manager] Support for UPGRADE_ACTION (#21002) [Ingest Manager] Support for UPGRADE_ACTION (#21002) --- x-pack/elastic-agent/CHANGELOG.asciidoc | 1 + .../pkg/agent/application/application.go | 11 +- .../application/handler_action_upgrade.go | 31 +++ .../pkg/agent/application/managed_mode.go | 22 ++ .../application/upgrade/step_download.go | 41 ++++ .../agent/application/upgrade/step_mark.go | 123 ++++++++++ .../agent/application/upgrade/step_relink.go | 42 ++++ .../agent/application/upgrade/step_unpack.go | 219 ++++++++++++++++++ .../pkg/agent/application/upgrade/upgrade.go | 139 +++++++++++ x-pack/elastic-agent/pkg/agent/cmd/run.go | 2 +- x-pack/elastic-agent/pkg/fleetapi/action.go | 51 +++- 11 files changed, 676 insertions(+), 6 deletions(-) create mode 100644 x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go create mode 100644 x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go create mode 100644 x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go create mode 100644 x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go create mode 100644 x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go create mode 100644 x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go diff --git a/x-pack/elastic-agent/CHANGELOG.asciidoc b/x-pack/elastic-agent/CHANGELOG.asciidoc index abaeb87fa64..bd3983e5716 100644 --- a/x-pack/elastic-agent/CHANGELOG.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.asciidoc @@ -108,3 +108,4 @@ - Pick up version from libbeat {pull}18350[18350] - More clear output of inspect command {pull}18405[18405] - When not port are specified and the https is used fallback to 443 {pull}18844[18844] +- Basic upgrade process {pull}21002[21002] diff --git a/x-pack/elastic-agent/pkg/agent/application/application.go b/x-pack/elastic-agent/pkg/agent/application/application.go index d0b16f11f13..e003eed61a6 100644 --- a/x-pack/elastic-agent/pkg/agent/application/application.go +++ b/x-pack/elastic-agent/pkg/agent/application/application.go @@ -21,8 +21,12 @@ type Application interface { AgentInfo() *info.AgentInfo } +type reexecManager interface { + ReExec(argOverrides ...string) +} + // New creates a new Agent and bootstrap the required subsystem. -func New(log *logger.Logger, pathConfigFile string) (Application, error) { +func New(log *logger.Logger, pathConfigFile string, reexec reexecManager) (Application, error) { // Load configuration from disk to understand in which mode of operation // we must start the elastic-agent, the mode of operation cannot be changed without restarting the // elastic-agent. @@ -35,13 +39,14 @@ func New(log *logger.Logger, pathConfigFile string) (Application, error) { return nil, err } - return createApplication(log, pathConfigFile, rawConfig) + return createApplication(log, pathConfigFile, rawConfig, reexec) } func createApplication( log *logger.Logger, pathConfigFile string, rawConfig *config.Config, + reexec reexecManager, ) (Application, error) { warn.LogNotGA(log) log.Info("Detecting execution mode") @@ -58,7 +63,7 @@ func createApplication( } log.Info("Agent is managed by Fleet") - return newManaged(ctx, log, rawConfig) + return newManaged(ctx, log, rawConfig, reexec) } // missing of fleet.enabled: true or fleet.{access_token,kibana} will place Elastic Agent into standalone mode. diff --git a/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go b/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go new file mode 100644 index 00000000000..4d0026d4d79 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/handler_action_upgrade.go @@ -0,0 +1,31 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package application + +import ( + "context" + "fmt" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/upgrade" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" +) + +// After running Upgrade agent should download its own version specified by action +// from repository specified by fleet. +type handlerUpgrade struct { + log *logger.Logger + upgrader *upgrade.Upgrader +} + +func (h *handlerUpgrade) Handle(ctx context.Context, a action, acker fleetAcker) error { + h.log.Debugf("handlerUpgrade: action '%+v' received", a) + action, ok := a.(*fleetapi.ActionUpgrade) + if !ok { + return fmt.Errorf("invalid type, expected ActionUpgrade and received %T", a) + } + + return h.upgrader.Upgrade(ctx, action) +} diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index 76d9d0bed46..a4e4bf92379 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -15,6 +15,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/filters" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/upgrade" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/operation" @@ -53,12 +54,14 @@ type Managed struct { router *router srv *server.Server as *actionStore + upgrader *upgrade.Upgrader } func newManaged( ctx context.Context, log *logger.Logger, rawConfig *config.Config, + reexec reexecManager, ) (*Managed, error) { agentInfo, err := info.NewAgentInfo() if err != nil { @@ -196,6 +199,13 @@ func newManaged( return nil, err } + managedApplication.upgrader = upgrade.NewUpgrader( + cfg.Settings.DownloadConfig, + log, + []context.CancelFunc{managedApplication.cancelCtxFn}, + reexec, + acker) + actionDispatcher.MustRegister( &fleetapi.ActionConfigChange{}, &handlerConfigChange{ @@ -215,6 +225,14 @@ func newManaged( }, ) + actionDispatcher.MustRegister( + &fleetapi.ActionUpgrade{}, + &handlerUpgrade{ + upgrader: managedApplication.upgrader, + log: log, + }, + ) + actionDispatcher.MustRegister( &fleetapi.ActionUnknown{}, &handlerUnknown{log: log}, @@ -256,6 +274,10 @@ func (m *Managed) Start() error { return nil } + if err := m.upgrader.Ack(m.bgContext); err != nil { + m.log.Warnf("failed to ack update %v", err) + } + m.gateway.Start() return nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go new file mode 100644 index 00000000000..9bcb941d7e9 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -0,0 +1,41 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package upgrade + +import ( + "context" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + downloader "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/download/localremote" +) + +func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI string) (string, error) { + // do not update source config + settings := *u.settings + if sourceURI != "" { + settings.SourceURI = sourceURI + } + + verifier, err := downloader.NewVerifier(u.log, &settings) + if err != nil { + return "", errors.New(err, "initiating verifier") + } + + fetcher := downloader.NewDownloader(u.log, &settings) + path, err := fetcher.Download(ctx, agentName, agentArtifactName, version) + if err != nil { + return "", errors.New(err, "failed upgrade of agent binary") + } + + matches, err := verifier.Verify(agentName, version) + if err != nil { + return "", errors.New(err, "failed verification of agent binary") + } + if !matches { + return "", errors.New("failed verification of agent binary, hash does not match", errors.TypeSecurity) + } + + return path, nil +} diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go new file mode 100644 index 00000000000..0d8253bb9ca --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_mark.go @@ -0,0 +1,123 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package upgrade + +import ( + "context" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "runtime" + "time" + + "gopkg.in/yaml.v2" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" +) + +const markerFilename = ".update-marker" + +type updateMarker struct { + // Hash agent is updated to + Hash string `json:"hash" yaml:"hash"` + //UpdatedOn marks a date when update happened + UpdatedOn time.Time `json:"updated_on" yaml:"updated_on"` + + // PrevVersion is a version agent is updated from + PrevVersion string `json:"prev_version" yaml:"prev_version"` + // PrevHash is a hash agent is updated from + PrevHash string `json:"prev_hash" yaml:"prev_hash"` + + // Acked is a flag marking whether or not action was acked + Acked bool `json:"acked" yaml:"acked"` + Action *fleetapi.ActionUpgrade `json:"action" yaml:"action"` +} + +// markUpgrade marks update happened so we can handle grace period +func (h *Upgrader) markUpgrade(ctx context.Context, hash string, action *fleetapi.ActionUpgrade) error { + if err := updateHomePath(hash); err != nil { + return err + } + + prevVersion := release.Version() + prevHash := release.Commit() + if len(prevHash) > hashLen { + prevHash = prevHash[:hashLen] + } + + marker := updateMarker{ + Hash: hash, + UpdatedOn: time.Now(), + PrevVersion: prevVersion, + PrevHash: prevHash, + Action: action, + } + + markerBytes, err := yaml.Marshal(marker) + if err != nil { + return errors.New(err, errors.TypeConfig, "failed to parse marker file") + } + + markerPath := filepath.Join(paths.Data(), markerFilename) + if err := ioutil.WriteFile(markerPath, markerBytes, 0600); err != nil { + return errors.New(err, errors.TypeFilesystem, "failed to create update marker file", errors.M(errors.MetaKeyPath, markerPath)) + } + + activeCommitPath := filepath.Join(paths.Config(), agentCommitFile) + if err := ioutil.WriteFile(activeCommitPath, []byte(hash), 0644); err != nil { + return errors.New(err, errors.TypeFilesystem, "failed to update active commit", errors.M(errors.MetaKeyPath, activeCommitPath)) + } + + return nil +} + +func updateHomePath(hash string) error { + if err := createPathsSymlink(hash); err != nil { + return errors.New(err, errors.TypeFilesystem, "failed to create paths symlink") + } + + pathsMap := make(map[string]string) + pathsFilepath := filepath.Join(paths.Data(), "paths.yml") + + pathsBytes, err := ioutil.ReadFile(pathsFilepath) + if err != nil { + return errors.New(err, errors.TypeConfig, "failed to read paths file") + } + + if err := yaml.Unmarshal(pathsBytes, &pathsMap); err != nil { + return errors.New(err, errors.TypeConfig, "failed to parse paths file") + } + + pathsMap["path.home"] = filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, hash)) + + pathsBytes, err = yaml.Marshal(pathsMap) + if err != nil { + return errors.New(err, errors.TypeConfig, "failed to marshal paths file") + } + + return ioutil.WriteFile(pathsFilepath, pathsBytes, 0740) +} + +func createPathsSymlink(hash string) error { + // only on windows, as windows resolves PWD using symlinks in a different way. + // we create symlink for each versioned agent inside `data/` directory + // on other systems path is shared + if runtime.GOOS != "windows" { + return nil + } + + dir := filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash)) + versionedPath := filepath.Join(dir, "data", "paths.yml") + if err := os.MkdirAll(filepath.Dir(versionedPath), 0700); err != nil { + return err + } + + pathsCfgPath := filepath.Join(paths.Data(), "paths.yml") + return os.Symlink(pathsCfgPath, versionedPath) +} diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go new file mode 100644 index 00000000000..48d22de36cf --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_relink.go @@ -0,0 +1,42 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package upgrade + +import ( + "context" + "fmt" + "os" + "path/filepath" + "runtime" + + "github.com/elastic/beats/v7/libbeat/common/file" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" +) + +// changeSymlink changes root symlink so it points to updated version +func (u *Upgrader) changeSymlink(ctx context.Context, newHash string) error { + // create symlink to elastic-agent-{hash} + hashedDir := fmt.Sprintf("%s-%s", agentName, newHash) + + agentBakName := agentName + ".bak" + symlinkPath := filepath.Join(paths.Config(), agentName) + newPath := filepath.Join(paths.Data(), hashedDir, agentName) + + // handle windows suffixes + if runtime.GOOS == "windows" { + agentBakName = agentName + ".exe.back" //.bak is already used + symlinkPath += ".exe" + newPath += ".exe" + } + + bakNewPath := filepath.Join(paths.Config(), agentBakName) + if err := os.Symlink(newPath, bakNewPath); err != nil { + return errors.New(err, errors.TypeFilesystem, "failed to update agent symlink") + } + + // safely rotate + return file.SafeFileRotate(symlinkPath, bakNewPath) +} diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go new file mode 100644 index 00000000000..ae3d05edd16 --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_unpack.go @@ -0,0 +1,219 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package upgrade + +import ( + "archive/tar" + "archive/zip" + "compress/gzip" + "context" + "fmt" + "io" + "io/ioutil" + "os" + "path/filepath" + "runtime" + "strings" + + "github.com/hashicorp/go-multierror" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" +) + +// untar unpacks archive correctly, skips root (symlink, config...) unpacks data/* +func (u *Upgrader) unpack(ctx context.Context, version, sourceURI, archivePath string) (string, error) { + // unpack must occur in directory that holds the installation directory + // or the extraction will be double nested + var hash string + var err error + if runtime.GOOS == "windows" { + hash, err = unzip(version, archivePath) + } else { + hash, err = untar(version, archivePath) + } + if err != nil { + return "", err + } + + return hash, nil +} + +func unzip(version, archivePath string) (string, error) { + var hash, rootDir string + r, err := zip.OpenReader(archivePath) + if err != nil { + return "", err + } + defer r.Close() + + fileNamePrefix := strings.TrimSuffix(filepath.Base(archivePath), ".zip") + "/" // omitting `elastic-agent-{version}-{os}-{arch}/` in filename + + unpackFile := func(f *zip.File) (err error) { + rc, err := f.Open() + if err != nil { + return err + } + defer func() { + if cerr := rc.Close(); cerr != nil { + err = multierror.Append(err, cerr) + } + }() + + //get hash + fileName := strings.TrimPrefix(f.Name, fileNamePrefix) + if fileName == agentCommitFile { + hashBytes, err := ioutil.ReadAll(rc) + if err != nil || len(hashBytes) < hashLen { + return err + } + + hash = string(hashBytes[:hashLen]) + return nil + } + + // skip everything outside data/ + if !strings.HasPrefix(fileName, "data/") { + return nil + } + + path := filepath.Join(paths.Data(), strings.TrimPrefix(fileName, "data/")) + + if f.FileInfo().IsDir() { + os.MkdirAll(path, f.Mode()) + } else { + os.MkdirAll(filepath.Dir(path), f.Mode()) + f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode()) + if err != nil { + return err + } + defer func() { + if cerr := f.Close(); cerr != nil { + err = multierror.Append(err, cerr) + } + }() + + if _, err = io.Copy(f, rc); err != nil { + return err + } + } + return nil + } + + for _, f := range r.File { + if rootDir == "" && filepath.Base(f.Name) == filepath.Dir(f.Name) { + return f.Name, nil + } + if currentDir := filepath.Dir(f.Name); rootDir == "" || len(currentDir) < len(rootDir) { + rootDir = currentDir + } + + if err := unpackFile(f); err != nil { + return "", err + } + } + + return hash, nil +} + +func untar(version, archivePath string) (string, error) { + r, err := os.Open(archivePath) + if err != nil { + return "", errors.New(fmt.Sprintf("artifact for 'elastic-agent' version '%s' could not be found at '%s'", version, archivePath), errors.TypeFilesystem, errors.M(errors.MetaKeyPath, archivePath)) + } + defer r.Close() + + zr, err := gzip.NewReader(r) + if err != nil { + return "", errors.New("requires gzip-compressed body", err, errors.TypeFilesystem) + } + + tr := tar.NewReader(zr) + var rootDir string + var hash string + fileNamePrefix := strings.TrimSuffix(filepath.Base(archivePath), ".tar.gz") + "/" // omitting `elastic-agent-{version}-{os}-{arch}/` in filename + + // go through all the content of a tar archive + // if elastic-agent.active.commit file is found, get commit of the version unpacked + // otherwise copy everything inside data directory (everything related to new version), + // pieces outside of data we already have and should not be overwritten as they are usually configs + for { + f, err := tr.Next() + if err == io.EOF { + break + } + if err != nil { + return "", err + } + + if !validFileName(f.Name) { + return "", errors.New("tar contained invalid filename: %q", f.Name, errors.TypeFilesystem, errors.M(errors.MetaKeyPath, f.Name)) + } + + //get hash + fileName := strings.TrimPrefix(f.Name, fileNamePrefix) + + if fileName == agentCommitFile { + hashBytes, err := ioutil.ReadAll(tr) + if err != nil || len(hashBytes) < hashLen { + return "", err + } + + hash = string(hashBytes[:hashLen]) + continue + } + + // skip everything outside data/ + if !strings.HasPrefix(fileName, "data/") { + continue + } + + rel := filepath.FromSlash(strings.TrimPrefix(fileName, "data/")) + abs := filepath.Join(paths.Data(), rel) + + // find the root dir + if currentDir := filepath.Dir(abs); rootDir == "" || len(filepath.Dir(rootDir)) > len(currentDir) { + rootDir = currentDir + } + + fi := f.FileInfo() + mode := fi.Mode() + switch { + case mode.IsRegular(): + // just to be sure, it should already be created by Dir type + if err := os.MkdirAll(filepath.Dir(abs), 0755); err != nil { + return "", errors.New(err, "TarInstaller: creating directory for file "+abs, errors.TypeFilesystem, errors.M(errors.MetaKeyPath, abs)) + } + + wf, err := os.OpenFile(abs, os.O_RDWR|os.O_CREATE|os.O_TRUNC, mode.Perm()) + if err != nil { + return "", errors.New(err, "TarInstaller: creating file "+abs, errors.TypeFilesystem, errors.M(errors.MetaKeyPath, abs)) + } + + _, err = io.Copy(wf, tr) + if closeErr := wf.Close(); closeErr != nil && err == nil { + err = closeErr + } + if err != nil { + return "", fmt.Errorf("TarInstaller: error writing to %s: %v", abs, err) + } + case mode.IsDir(): + if err := os.MkdirAll(abs, 0755); err != nil { + return "", errors.New(err, "TarInstaller: creating directory for file "+abs, errors.TypeFilesystem, errors.M(errors.MetaKeyPath, abs)) + } + default: + return "", errors.New(fmt.Sprintf("tar file entry %s contained unsupported file type %v", fileName, mode), errors.TypeFilesystem, errors.M(errors.MetaKeyPath, fileName)) + } + } + + return hash, nil +} + +func validFileName(p string) bool { + if p == "" || strings.Contains(p, `\`) || strings.HasPrefix(p, "/") || strings.Contains(p, "../") { + return false + } + return true +} diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go new file mode 100644 index 00000000000..cc27846051f --- /dev/null +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -0,0 +1,139 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package upgrade + +import ( + "context" + "fmt" + "io/ioutil" + "os" + "path/filepath" + "strings" + + "gopkg.in/yaml.v2" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" +) + +const ( + agentName = "elastic-agent" + hashLen = 6 + agentCommitFile = ".elastic-agent.active.commit" + agentArtifactName = "beats/" + agentName +) + +// Upgrader performs an upgrade +type Upgrader struct { + settings *artifact.Config + log *logger.Logger + closers []context.CancelFunc + reexec reexecManager + acker acker +} + +type reexecManager interface { + ReExec(argOverrides ...string) +} + +type acker interface { + Ack(ctx context.Context, action fleetapi.Action) error + Commit(ctx context.Context) error +} + +// NewUpgrader creates an upgrader which is capable of performing upgrade operation +func NewUpgrader(settings *artifact.Config, log *logger.Logger, closers []context.CancelFunc, reexec reexecManager, a acker) *Upgrader { + return &Upgrader{ + settings: settings, + log: log, + closers: closers, + reexec: reexec, + acker: a, + } +} + +// Upgrade upgrades running agent +func (u *Upgrader) Upgrade(ctx context.Context, a *fleetapi.ActionUpgrade) error { + archivePath, err := u.downloadArtifact(ctx, a.Version, a.SourceURI) + if err != nil { + return err + } + + newHash, err := u.unpack(ctx, a.Version, a.SourceURI, archivePath) + if err != nil { + return err + } + + if newHash == "" { + return errors.New("unknown hash") + } + + if strings.HasPrefix(release.Commit(), newHash) { + return errors.New("upgrading to same version") + } + + if err := u.changeSymlink(ctx, newHash); err != nil { + rollbackInstall(newHash) + return err + } + + if err := u.markUpgrade(ctx, newHash, a); err != nil { + rollbackInstall(newHash) + return err + } + + u.reexec.ReExec() + return nil +} + +// Ack acks last upgrade action +func (u *Upgrader) Ack(ctx context.Context) error { + // get upgrade action + markerFile := filepath.Join(paths.Data(), markerFilename) + markerBytes, err := ioutil.ReadFile(markerFile) + if err != nil && os.IsNotExist(err) { + return nil + } else if err != nil { + return err + } + + marker := &updateMarker{} + if err := yaml.Unmarshal(markerBytes, marker); err != nil { + return err + } + + if marker.Acked { + return nil + } + + if err := u.acker.Ack(ctx, marker.Action); err != nil { + return err + } + + if err := u.acker.Commit(ctx); err != nil { + return err + } + + marker.Acked = true + markerBytes, err = yaml.Marshal(marker) + if err != nil { + return err + } + + return ioutil.WriteFile(markerFile, markerBytes, 0600) +} + +func isSubdir(base, target string) (bool, error) { + relPath, err := filepath.Rel(base, target) + return strings.HasPrefix(relPath, ".."), err +} + +func rollbackInstall(hash string) { + os.RemoveAll(filepath.Join(paths.Data(), fmt.Sprintf("%s-%s", agentName, hash))) +} diff --git a/x-pack/elastic-agent/pkg/agent/cmd/run.go b/x-pack/elastic-agent/pkg/agent/cmd/run.go index a60c8a87c93..a7b56a664ba 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/run.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/run.go @@ -96,7 +96,7 @@ func run(flags *globalFlags, streams *cli.IOStreams) error { // Windows: Mark se } defer control.Stop() - app, err := application.New(logger, pathConfigFile) + app, err := application.New(logger, pathConfigFile, rex) if err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/fleetapi/action.go b/x-pack/elastic-agent/pkg/fleetapi/action.go index bf7024e304f..efb4e1672aa 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/action.go +++ b/x-pack/elastic-agent/pkg/fleetapi/action.go @@ -12,6 +12,15 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" ) +const ( + // ActionTypeUpgrade specifies upgrade action. + ActionTypeUpgrade = "UPGRADE" + // ActionTypeUnenroll specifies unenroll action. + ActionTypeUnenroll = "UNENROLL" + // ActionTypeConfigChange specifies config change action. + ActionTypeConfigChange = "CONFIG_CHANGE" +) + // Action base interface for all the implemented action from the fleet API. type Action interface { fmt.Stringer @@ -83,6 +92,33 @@ func (a *ActionConfigChange) ID() string { return a.ActionID } +// ActionUpgrade is a request for agent to upgrade. +type ActionUpgrade struct { + ActionID string `json:"id" yaml:"id"` + ActionType string `json:"type" yaml:"type"` + Version string `json:"version" yaml:"version"` + SourceURI string `json:"source_uri" yaml:"source_uri"` +} + +func (a *ActionUpgrade) String() string { + var s strings.Builder + s.WriteString("action_id: ") + s.WriteString(a.ActionID) + s.WriteString(", type: ") + s.WriteString(a.ActionType) + return s.String() +} + +// Type returns the type of the Action. +func (a *ActionUpgrade) Type() string { + return a.ActionType +} + +// ID returns the ID of the Action. +func (a *ActionUpgrade) ID() string { + return a.ActionID +} + // ActionUnenroll is a request for agent to unhook from fleet. type ActionUnenroll struct { ActionID string @@ -133,7 +169,7 @@ func (a *Actions) UnmarshalJSON(data []byte) error { for _, response := range responses { switch response.ActionType { - case "CONFIG_CHANGE": + case ActionTypeConfigChange: action = &ActionConfigChange{ ActionID: response.ActionID, ActionType: response.ActionType, @@ -143,11 +179,22 @@ func (a *Actions) UnmarshalJSON(data []byte) error { "fail to decode CONFIG_CHANGE action", errors.TypeConfig) } - case "UNENROLL": + case ActionTypeUnenroll: action = &ActionUnenroll{ ActionID: response.ActionID, ActionType: response.ActionType, } + case ActionTypeUpgrade: + action = &ActionUpgrade{ + ActionID: response.ActionID, + ActionType: response.ActionType, + } + + if err := json.Unmarshal(response.Data, action); err != nil { + return errors.New(err, + "fail to decode UPGRADE_ACTION action", + errors.TypeConfig) + } default: action = &ActionUnknown{ ActionID: response.ActionID, From 17615155c11cdc4ec6e4e2097d69c328da329aa8 Mon Sep 17 00:00:00 2001 From: Chris Mark Date: Tue, 22 Sep 2020 15:42:01 +0300 Subject: [PATCH 036/216] Add compatibility note about ingress-controller-v0.34.1 (#21209) --- filebeat/docs/modules/nginx.asciidoc | 2 +- filebeat/module/nginx/_meta/docs.asciidoc | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/filebeat/docs/modules/nginx.asciidoc b/filebeat/docs/modules/nginx.asciidoc index b5d52d7d0d9..46b3bf34795 100644 --- a/filebeat/docs/modules/nginx.asciidoc +++ b/filebeat/docs/modules/nginx.asciidoc @@ -28,7 +28,7 @@ The Nginx module was tested with logs from version 1.10. On Windows, the module was tested with Nginx installed from the Chocolatey repository. -`ingress_controller` fileset was tested with version 0.28.0 of `nginx-ingress-controller`. +`ingress_controller` fileset was tested with version v0.28.0 and v0.34.1 of `nginx-ingress-controller`. include::../include/configuring-intro.asciidoc[] diff --git a/filebeat/module/nginx/_meta/docs.asciidoc b/filebeat/module/nginx/_meta/docs.asciidoc index e365dd079d8..e5d0ff17f95 100644 --- a/filebeat/module/nginx/_meta/docs.asciidoc +++ b/filebeat/module/nginx/_meta/docs.asciidoc @@ -23,7 +23,7 @@ The Nginx module was tested with logs from version 1.10. On Windows, the module was tested with Nginx installed from the Chocolatey repository. -`ingress_controller` fileset was tested with version 0.28.0 of `nginx-ingress-controller`. +`ingress_controller` fileset was tested with version v0.28.0 and v0.34.1 of `nginx-ingress-controller`. include::../include/configuring-intro.asciidoc[] From aebddba1b0f3015f20368606235f12b7592326be Mon Sep 17 00:00:00 2001 From: Michal Pristas Date: Tue, 22 Sep 2020 16:38:07 +0200 Subject: [PATCH 037/216] [Ingest Manager] Agent includes pgp file (#19480) [Ingest Manager] Agent includes pgp file (#19480) --- dev-tools/mage/crossbuild.go | 1 + dev-tools/mage/settings.go | 7 ++ x-pack/elastic-agent/GPG-KEY-elasticsearch | 31 +++++ .../dev-tools/cmd/buildpgp/build_pgp.go | 113 ++++++++++++++++++ x-pack/elastic-agent/magefile.go | 22 +++- .../pkg/agent/application/stream.go | 4 +- .../application/upgrade/step_download.go | 4 +- x-pack/elastic-agent/pkg/artifact/config.go | 6 - .../pkg/artifact/download/fs/verifier.go | 63 ++++------ .../pkg/artifact/download/fs/verifier_test.go | 4 +- .../artifact/download/http/elastic_test.go | 2 +- .../pkg/artifact/download/http/verifier.go | 71 ++++------- .../artifact/download/localremote/verifier.go | 8 +- .../artifact/download/snapshot/downloader.go | 1 - .../artifact/download/snapshot/verifier.go | 4 +- x-pack/elastic-agent/pkg/release/pgp.go | 25 ++++ x-pack/elastic-agent/pkg/release/version.go | 6 +- 17 files changed, 265 insertions(+), 107 deletions(-) create mode 100644 x-pack/elastic-agent/GPG-KEY-elasticsearch create mode 100644 x-pack/elastic-agent/dev-tools/cmd/buildpgp/build_pgp.go create mode 100644 x-pack/elastic-agent/pkg/release/pgp.go diff --git a/dev-tools/mage/crossbuild.go b/dev-tools/mage/crossbuild.go index 22b0ae574df..4340c7fdb4e 100644 --- a/dev-tools/mage/crossbuild.go +++ b/dev-tools/mage/crossbuild.go @@ -267,6 +267,7 @@ func (b GolangCrossBuilder) Build() error { "--env", "MAGEFILE_VERBOSE="+verbose, "--env", "MAGEFILE_TIMEOUT="+EnvOr("MAGEFILE_TIMEOUT", ""), "--env", fmt.Sprintf("SNAPSHOT=%v", Snapshot), + "--env", fmt.Sprintf("DEV=%v", DevBuild), "-v", repoInfo.RootDir+":"+mountPoint, "-w", workDir, image, diff --git a/dev-tools/mage/settings.go b/dev-tools/mage/settings.go index 08a619c3df3..037d4838d03 100644 --- a/dev-tools/mage/settings.go +++ b/dev-tools/mage/settings.go @@ -77,6 +77,7 @@ var ( BeatProjectType ProjectType Snapshot bool + DevBuild bool versionQualified bool versionQualifier string @@ -117,6 +118,11 @@ func init() { panic(errors.Wrap(err, "failed to parse SNAPSHOT env value")) } + DevBuild, err = strconv.ParseBool(EnvOr("DEV", "false")) + if err != nil { + panic(errors.Wrap(err, "failed to parse DEV env value")) + } + versionQualifier, versionQualified = os.LookupEnv("VERSION_QUALIFIER") } @@ -165,6 +171,7 @@ func varMap(args ...map[string]interface{}) map[string]interface{} { "BeatURL": BeatURL, "BeatUser": BeatUser, "Snapshot": Snapshot, + "DEV": DevBuild, "Qualifier": versionQualifier, } diff --git a/x-pack/elastic-agent/GPG-KEY-elasticsearch b/x-pack/elastic-agent/GPG-KEY-elasticsearch new file mode 100644 index 00000000000..1b50dcca799 --- /dev/null +++ b/x-pack/elastic-agent/GPG-KEY-elasticsearch @@ -0,0 +1,31 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Version: GnuPG v2.0.14 (GNU/Linux) + +mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBD +A+bGFOwyhbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9 +CUliQe324qvObU2QRtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZ +j3SF1SPO+TB5QrHkrQHBsmX+Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd +1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD +2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEBAAG0RUVsYXN0aWNzZWFyY2gg +KEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3BzQGVsYXN0aWNzZWFy +Y2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC +F4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75 +nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/ +7C2GuGCOlbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKm +TxcDTFrV7SmVPxCBcQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe +8d7sw+XvxB2aN4gnTlRzjL1nTRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/ +eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUl +zcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNMKGTABFG1yRx9r+wa/fvqP6OT +RzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hplnpU+PBQZJ5XJ2I+ +1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA07xx7Bj+ +Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt +KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0Kww +EwSk/UDuToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0 +c3MIAIE9hAR20mqJWLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12J +TavnJ5MLaETlggXY+zDef9syTPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j +6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZEyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7 +vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWgR7U2r+a210W6vnUxU4oN0PmM +cursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNtfllxIu9XYmiBERQ/ +qPDlGRlOgVTd9xUfHFkzB52c70E= +=92oX +-----END PGP PUBLIC KEY BLOCK----- diff --git a/x-pack/elastic-agent/dev-tools/cmd/buildpgp/build_pgp.go b/x-pack/elastic-agent/dev-tools/cmd/buildpgp/build_pgp.go new file mode 100644 index 00000000000..55bb33f1fc0 --- /dev/null +++ b/x-pack/elastic-agent/dev-tools/cmd/buildpgp/build_pgp.go @@ -0,0 +1,113 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package main + +import ( + "bytes" + "flag" + "fmt" + "go/format" + "io/ioutil" + "os" + "text/template" + + "github.com/elastic/beats/v7/licenses" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/packer" +) + +var ( + input string + output string + license string +) + +func init() { + flag.StringVar(&input, "in", "", "Source of input. \"-\" means reading from stdin") + flag.StringVar(&output, "out", "-", "Output path. \"-\" means writing to stdout") + flag.StringVar(&license, "license", "Elastic", "License header for generated file.") +} + +var tmplPgp = template.Must(template.New("pgp").Parse(` +{{ .License }} +// Code generated by x-pack/dev-tools/cmd/buildspec/buildPgp.go - DO NOT EDIT. + +package release + +import ( + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/packer" +) + +// pgp bytes is a packed in public gpg key +var pgpBytes []byte + +func init() { + // Packed Files + {{ range $i, $f := .Files -}} + // {{ $f }} + {{ end -}} + pgpBytes = packer.MustUnpack("{{ .Pack }}")["GPG-KEY-elasticsearch"] +} + +// PGP return pgpbytes and a flag describing whether or not no pgp is valid. +func PGP() (bool, []byte) { + return allowEmptyPgp == "true", pgpBytes +} +`)) + +func main() { + flag.Parse() + + if len(input) == 0 { + fmt.Fprintln(os.Stderr, "Invalid input source") + os.Exit(1) + } + + l, err := licenses.Find(license) + if err != nil { + fmt.Fprintf(os.Stderr, "problem to retrieve the license, error: %+v", err) + os.Exit(1) + return + } + + data, err := gen(input, l) + if err != nil { + fmt.Fprintf(os.Stderr, "Error while generating the file, err: %+v\n", err) + os.Exit(1) + } + + if output == "-" { + os.Stdout.Write(data) + return + } else { + ioutil.WriteFile(output, data, 0640) + } + + return +} + +func gen(path string, l string) ([]byte, error) { + pack, files, err := packer.Pack(input) + if err != nil { + return nil, err + } + + var buf bytes.Buffer + tmplPgp.Execute(&buf, struct { + Pack string + Files []string + License string + }{ + Pack: pack, + Files: files, + License: l, + }) + + formatted, err := format.Source(buf.Bytes()) + if err != nil { + return nil, err + } + + return formatted, nil +} diff --git a/x-pack/elastic-agent/magefile.go b/x-pack/elastic-agent/magefile.go index 499e1d251a2..ec6e76a0995 100644 --- a/x-pack/elastic-agent/magefile.go +++ b/x-pack/elastic-agent/magefile.go @@ -14,6 +14,7 @@ import ( "os/exec" "path/filepath" "runtime" + "strconv" "strings" "time" @@ -40,6 +41,7 @@ const ( buildDir = "build" metaDir = "_meta" snapshotEnv = "SNAPSHOT" + devEnv = "DEV" configFile = "elastic-agent.yml" agentDropPath = "AGENT_DROP_PATH" ) @@ -345,7 +347,7 @@ func commitID() string { // Update is an alias for executing control protocol, configs, and specs. func Update() { - mg.SerialDeps(Config, BuildSpec, BuildFleetCfg) + mg.SerialDeps(Config, BuildSpec, BuildPGP, BuildFleetCfg) } // CrossBuild cross-builds the beat for all target platforms. @@ -370,7 +372,7 @@ func ControlProto() error { // BuildSpec make sure that all the suppported program spec are built into the binary. func BuildSpec() error { - // go run x-pack/agent/dev-tools/cmd/buildspec/buildspec.go --in x-pack/agent/spec/*.yml --out x-pack/agent/pkg/agent/program/supported.go + // go run x-pack/elastic-agent/dev-tools/cmd/buildspec/buildspec.go --in x-pack/agent/spec/*.yml --out x-pack/elastic-agent/pkg/agent/program/supported.go goF := filepath.Join("dev-tools", "cmd", "buildspec", "buildspec.go") in := filepath.Join("spec", "*.yml") out := filepath.Join("pkg", "agent", "program", "supported.go") @@ -379,6 +381,16 @@ func BuildSpec() error { return RunGo("run", goF, "--in", in, "--out", out) } +func BuildPGP() error { + // go run x-pack/elastic-agent/dev-tools/cmd/buildpgp/build_pgp.go --in x-pack/agent/spec/GPG-KEY-elasticsearch --out x-pack/elastic-agent/pkg/release/pgp.go + goF := filepath.Join("dev-tools", "cmd", "buildpgp", "build_pgp.go") + in := "GPG-KEY-elasticsearch" + out := filepath.Join("pkg", "release", "pgp.go") + + fmt.Printf(">> BuildPGP from %s to %s\n", in, out) + return RunGo("run", goF, "--in", in, "--out", out) +} + func configYML() error { return devtools.Config(devtools.AllConfigTypes, ConfigFileParams(), ".") } @@ -620,6 +632,12 @@ func buildVars() map[string]string { isSnapshot, _ := os.LookupEnv(snapshotEnv) vars["github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release.snapshot"] = isSnapshot + if isDevFlag, devFound := os.LookupEnv(devEnv); devFound { + if isDev, err := strconv.ParseBool(isDevFlag); err == nil && isDev { + vars["github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release.allowEmptyPgp"] = "true" + } + } + return vars } diff --git a/x-pack/elastic-agent/pkg/agent/application/stream.go b/x-pack/elastic-agent/pkg/agent/application/stream.go index ee2b1f2d019..41999fcb832 100644 --- a/x-pack/elastic-agent/pkg/agent/application/stream.go +++ b/x-pack/elastic-agent/pkg/agent/application/stream.go @@ -19,6 +19,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/monitoring" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/server" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/state" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) type operatorStream struct { @@ -56,7 +57,8 @@ func streamFactory(ctx context.Context, cfg *configuration.SettingsConfig, srv * func newOperator(ctx context.Context, log *logger.Logger, id routingKey, config *configuration.SettingsConfig, srv *server.Server, r state.Reporter, m monitoring.Monitor) (*operation.Operator, error) { fetcher := downloader.NewDownloader(log, config.DownloadConfig) - verifier, err := downloader.NewVerifier(log, config.DownloadConfig) + allowEmptyPgp, pgp := release.PGP() + verifier, err := downloader.NewVerifier(log, config.DownloadConfig, allowEmptyPgp, pgp) if err != nil { return nil, errors.New(err, "initiating verifier") } diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go index 9bcb941d7e9..28e93949fbf 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -9,6 +9,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" downloader "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/download/localremote" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI string) (string, error) { @@ -18,7 +19,8 @@ func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI stri settings.SourceURI = sourceURI } - verifier, err := downloader.NewVerifier(u.log, &settings) + allowEmptyPgp, pgp := release.PGP() + verifier, err := downloader.NewVerifier(u.log, &settings, allowEmptyPgp, pgp) if err != nil { return "", errors.New(err, "initiating verifier") } diff --git a/x-pack/elastic-agent/pkg/artifact/config.go b/x-pack/elastic-agent/pkg/artifact/config.go index 6faa9861710..5b0766cb257 100644 --- a/x-pack/elastic-agent/pkg/artifact/config.go +++ b/x-pack/elastic-agent/pkg/artifact/config.go @@ -30,10 +30,6 @@ type Config struct { // Timeout: timeout for downloading package Timeout time.Duration `json:"timeout" config:"timeout"` - // PgpFile: filepath to a public key used for verifying downloaded artifacts - // if not file is present elastic-agent will try to load public key from elastic.co website. - PgpFile string `json:"pgpfile" config:"pgpfile"` - // InstallPath: path to the directory containing installed packages InstallPath string `yaml:"installPath" config:"install_path"` @@ -48,12 +44,10 @@ type Config struct { // DefaultConfig creates a config with pre-set default values. func DefaultConfig() *Config { homePath := paths.Home() - dataPath := paths.Data() return &Config{ SourceURI: "https://artifacts.elastic.co/downloads/", TargetDirectory: filepath.Join(homePath, "downloads"), Timeout: 30 * time.Second, - PgpFile: filepath.Join(dataPath, "elastic.pgp"), InstallPath: filepath.Join(homePath, "install"), } } diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go index 20bff381a39..d934b20faef 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier.go @@ -14,11 +14,9 @@ import ( "os" "path/filepath" "strings" - "sync" "golang.org/x/crypto/openpgp" - "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" ) @@ -30,15 +28,22 @@ const ( // Verifier verifies a downloaded package by comparing with public ASC // file from elastic.co website. type Verifier struct { - config *artifact.Config - pgpBytes []byte + config *artifact.Config + pgpBytes []byte + allowEmptyPgp bool } // NewVerifier create a verifier checking downloaded package on preconfigured // location agains a key stored on elastic.co website. -func NewVerifier(config *artifact.Config) (*Verifier, error) { +func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Verifier, error) { + if len(pgp) == 0 && !allowEmptyPgp { + return nil, errors.New("expecting PGP but retrieved none", errors.TypeSecurity) + } + v := &Verifier{ - config: config, + config: config, + allowEmptyPgp: allowEmptyPgp, + pgpBytes: pgp, } return v, nil @@ -59,9 +64,11 @@ func (v *Verifier) Verify(programName, version string) (bool, error) { // remove bits so they can be redownloaded os.Remove(fullPath) os.Remove(fullPath + ".sha512") + os.Remove(fullPath + ".asc") + return isMatch, err } - return isMatch, err + return v.verifyAsc(filename, fullPath) } func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { @@ -87,7 +94,7 @@ func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { } if expectedHash == "" { - return false, fmt.Errorf("hash for '%s' not found", filename) + return false, fmt.Errorf("hash for '%s' not found in '%s'", filename, hashFilePath) } // compute file hash @@ -107,19 +114,16 @@ func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { } func (v *Verifier) verifyAsc(filename, fullPath string) (bool, error) { - var err error - var pgpBytesLoader sync.Once - - pgpBytesLoader.Do(func() { - err = v.loadPGP(v.config.PgpFile) - }) - - if err != nil { - return false, errors.New(err, "loading PGP") + if len(v.pgpBytes) == 0 { + // no pgp available skip verification process + return true, nil } - ascBytes, err := v.getPublicAsc(filename) - if err != nil { + ascBytes, err := v.getPublicAsc(fullPath) + if err != nil && v.allowEmptyPgp { + // asc not available but we allow empty for dev use-case + return true, nil + } else if err != nil { return false, err } @@ -143,10 +147,8 @@ func (v *Verifier) verifyAsc(filename, fullPath string) (bool, error) { return true, nil } -func (v *Verifier) getPublicAsc(filename string) ([]byte, error) { - ascFile := fmt.Sprintf("%s%s", filename, ascSuffix) - fullPath := filepath.Join(paths.Home(), "downloads", ascFile) - +func (v *Verifier) getPublicAsc(fullPath string) ([]byte, error) { + fullPath = fmt.Sprintf("%s%s", fullPath, ascSuffix) b, err := ioutil.ReadFile(fullPath) if err != nil { return nil, errors.New(err, fmt.Sprintf("fetching asc file from '%s'", fullPath), errors.TypeFilesystem, errors.M(errors.MetaKeyPath, fullPath)) @@ -154,18 +156,3 @@ func (v *Verifier) getPublicAsc(filename string) ([]byte, error) { return b, nil } - -func (v *Verifier) loadPGP(file string) error { - var err error - - if file == "" { - return errors.New("pgp file not specified for verifier", errors.TypeConfig) - } - - v.pgpBytes, err = ioutil.ReadFile(file) - if err != nil { - return errors.New(err, errors.TypeFilesystem) - } - - return nil -} diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go index 4787656d8b0..4fd845482c5 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/verifier_test.go @@ -59,7 +59,7 @@ func TestFetchVerify(t *testing.T) { assert.NoError(t, err) downloader := NewDownloader(config) - verifier, err := NewVerifier(config) + verifier, err := NewVerifier(config, true, nil) assert.NoError(t, err) // first download verify should fail: @@ -157,7 +157,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - testVerifier, err := NewVerifier(config) + testVerifier, err := NewVerifier(config, true, nil) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go index a1e1ced0b66..0edb979a320 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/elastic_test.go @@ -105,7 +105,7 @@ func TestVerify(t *testing.T) { t.Fatal(err) } - testVerifier, err := NewVerifier(config) + testVerifier, err := NewVerifier(config, true, nil) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go index 171b3363aec..9f2eacd9395 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/http/verifier.go @@ -16,7 +16,6 @@ import ( "os" "path" "strings" - "sync" "golang.org/x/crypto/openpgp" @@ -32,20 +31,27 @@ const ( // Verifier verifies a downloaded package by comparing with public ASC // file from elastic.co website. type Verifier struct { - config *artifact.Config - client http.Client - pgpBytes []byte + config *artifact.Config + client http.Client + pgpBytes []byte + allowEmptyPgp bool } // NewVerifier create a verifier checking downloaded package on preconfigured // location agains a key stored on elastic.co website. -func NewVerifier(config *artifact.Config) (*Verifier, error) { +func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Verifier, error) { + if len(pgp) == 0 && !allowEmptyPgp { + return nil, errors.New("expecting PGP but retrieved none", errors.TypeSecurity) + } + client := http.Client{Timeout: config.Timeout} rtt := withHeaders(client.Transport, headers) client.Transport = rtt v := &Verifier{ - config: config, - client: client, + config: config, + client: client, + allowEmptyPgp: allowEmptyPgp, + pgpBytes: pgp, } return v, nil @@ -71,9 +77,11 @@ func (v *Verifier) Verify(programName, version string) (bool, error) { // remove bits so they can be redownloaded os.Remove(fullPath) os.Remove(fullPath + ".sha512") + os.Remove(fullPath + ".asc") + return isMatch, err } - return isMatch, err + return v.verifyAsc(programName, version) } func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { @@ -120,15 +128,9 @@ func (v *Verifier) verifyHash(filename, fullPath string) (bool, error) { } func (v *Verifier) verifyAsc(programName, version string) (bool, error) { - var err error - var pgpBytesLoader sync.Once - - pgpBytesLoader.Do(func() { - err = v.loadPGP(v.config.PgpFile) - }) - - if err != nil { - return false, errors.New(err, "loading PGP") + if len(v.pgpBytes) == 0 { + // no pgp available skip verification process + return true, nil } filename, err := artifact.GetArtifactName(programName, version, v.config.OS(), v.config.Arch()) @@ -147,7 +149,10 @@ func (v *Verifier) verifyAsc(programName, version string) (bool, error) { } ascBytes, err := v.getPublicAsc(ascURI) - if err != nil { + if err != nil && v.allowEmptyPgp { + // asc not available but we allow empty for dev use-case + return true, nil + } else if err != nil { return false, errors.New(err, fmt.Sprintf("fetching asc file from %s", ascURI), errors.TypeNetwork, errors.M(errors.MetaKeyURI, ascURI)) } @@ -202,33 +207,3 @@ func (v *Verifier) getPublicAsc(sourceURI string) ([]byte, error) { return ioutil.ReadAll(resp.Body) } - -func (v *Verifier) loadPGP(file string) error { - var err error - - if file == "" { - v.pgpBytes, err = v.loadPGPFromWeb() - return err - } - - v.pgpBytes, err = ioutil.ReadFile(file) - if err != nil { - return errors.New(err, errors.TypeFilesystem, errors.M(errors.MetaKeyPath, file)) - } - - return nil -} - -func (v *Verifier) loadPGPFromWeb() ([]byte, error) { - resp, err := v.client.Get(publicKeyURI) - if err != nil { - return nil, errors.New(err, "failed loading public key", errors.TypeNetwork, errors.M(errors.MetaKeyURI, publicKeyURI)) - } - defer resp.Body.Close() - - if resp.StatusCode != 200 { - return nil, errors.New(fmt.Sprintf("call to '%s' returned unsuccessful status code: %d", publicKeyURI, resp.StatusCode), errors.TypeNetwork, errors.M(errors.MetaKeyURI, publicKeyURI)) - } - - return ioutil.ReadAll(resp.Body) -} diff --git a/x-pack/elastic-agent/pkg/artifact/download/localremote/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/localremote/verifier.go index 34863270679..4f33cbbdb8e 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/localremote/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/localremote/verifier.go @@ -17,10 +17,10 @@ import ( // NewVerifier creates a downloader which first checks local directory // and then fallbacks to remote if configured. -func NewVerifier(log *logger.Logger, config *artifact.Config) (download.Verifier, error) { +func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool, pgp []byte) (download.Verifier, error) { verifiers := make([]download.Verifier, 0, 3) - fsVer, err := fs.NewVerifier(config) + fsVer, err := fs.NewVerifier(config, allowEmptyPgp, pgp) if err != nil { return nil, err } @@ -28,7 +28,7 @@ func NewVerifier(log *logger.Logger, config *artifact.Config) (download.Verifier // try snapshot repo before official if release.Snapshot() { - snapshotVerifier, err := snapshot.NewVerifier(config) + snapshotVerifier, err := snapshot.NewVerifier(config, allowEmptyPgp, pgp) if err != nil { log.Error(err) } else { @@ -36,7 +36,7 @@ func NewVerifier(log *logger.Logger, config *artifact.Config) (download.Verifier } } - remoteVer, err := http.NewVerifier(config) + remoteVer, err := http.NewVerifier(config, allowEmptyPgp, pgp) if err != nil { return nil, err } diff --git a/x-pack/elastic-agent/pkg/artifact/download/snapshot/downloader.go b/x-pack/elastic-agent/pkg/artifact/download/snapshot/downloader.go index f45a38d3f97..6f28ad8d926 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/snapshot/downloader.go +++ b/x-pack/elastic-agent/pkg/artifact/download/snapshot/downloader.go @@ -38,7 +38,6 @@ func snapshotConfig(config *artifact.Config) (*artifact.Config, error) { SourceURI: snapshotURI, TargetDirectory: config.TargetDirectory, Timeout: config.Timeout, - PgpFile: config.PgpFile, InstallPath: config.InstallPath, DropPath: config.DropPath, }, nil diff --git a/x-pack/elastic-agent/pkg/artifact/download/snapshot/verifier.go b/x-pack/elastic-agent/pkg/artifact/download/snapshot/verifier.go index 91626a6b55b..e9d8bbd4dc1 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/snapshot/verifier.go +++ b/x-pack/elastic-agent/pkg/artifact/download/snapshot/verifier.go @@ -12,10 +12,10 @@ import ( // NewVerifier creates a downloader which first checks local directory // and then fallbacks to remote if configured. -func NewVerifier(config *artifact.Config, downloaders ...download.Downloader) (download.Verifier, error) { +func NewVerifier(config *artifact.Config, allowEmptyPgp bool, pgp []byte) (download.Verifier, error) { cfg, err := snapshotConfig(config) if err != nil { return nil, err } - return http.NewVerifier(cfg) + return http.NewVerifier(cfg, allowEmptyPgp, pgp) } diff --git a/x-pack/elastic-agent/pkg/release/pgp.go b/x-pack/elastic-agent/pkg/release/pgp.go new file mode 100644 index 00000000000..00ca6add25a --- /dev/null +++ b/x-pack/elastic-agent/pkg/release/pgp.go @@ -0,0 +1,25 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +// Code generated by x-pack/dev-tools/cmd/buildspec/buildPgp.go - DO NOT EDIT. + +package release + +import ( + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/packer" +) + +// pgp bytes is a packed in public gpg key +var pgpBytes []byte + +func init() { + // Packed Files + // GPG-KEY-elasticsearch + pgpBytes = packer.MustUnpack("eJyMlsuOtLoBhPd5jH9/JBua0U+ksxguhobGjI0v4B1gNDQ2NNPNTNNEeffoRMoqipR1Va1KVfr+8Sv5SP7I4+aPwbaP7do/hvbej7/+/utSge1SwZBynbFrQCh8/+RIhCy20TnekKyCkMV+VL3+8oEttMr2C1475/R2jvW3FkF6TpvXZXr/Lhj5zGNdisovWunBITR5OENKuRdSY44qxT/E4ICiMdZJVlazd2pssJMJOTT2AHHx3iYclLVKZI1bNtmMwfWQdlz6SI9Vst6wwTkxJCfVdqVAfWjX3pqZuE1NDixX2lod6AN9FA6eZY0vRMJkqLagn3BRxRi3sDk6uB59vAYE0kwB/NKOd29l8VOSNRJyX7nkRzHRXRv/KlhG+UIJjtWjSNe6cdT1AouTEPZNwLGuuILVgrA23GMSVZKhq4Yi1Mv600vksFi34Xw7OGh2DoOPHNIQC/Sqku3F+Rj2DmxysJqGKYORfejo80dHKtIGugqiskuzx2DsRyk0z6Et8bKy3MV7lZC8EPZycZDCNbp1YC/b9N2jL/88JOPEoYpasO8lwkwnt13a284P+6V5Rjo4ykKsNZuzEzVeqoF/uwBPUWc39P32ah0YqgkrBfCu+P5WJejWA4T6VAUdGzmZY5czWxcTispUBcSIkHCUFigTYsFKxqdnI3Q52LWmi1XFrJfQbOh/aYJlj27Oti4V7cCzQtrx3sc2HpKtlWidmwmHg0Xpf+dNLlm2aHk+qtkjnbOFDCAqYkQrjjIFRSTkOqnaLpXMAg1tQSBaqhi5FdcJlzoiEP2wOAslx4EGIqoSjchzTXCMAuLoO2fBdyHhlc32g9dZNcxroAB6CCRoIeHSHfi7OlRI4XhtJ9oQvjparDE9gnPF91XU5N6j4HuYehjO3qGmoBTOuPOJehSoR1cHsHHpQhzIabidB2uBmOzcR3YXL/+qoYKVwaWOt6Y98KHSVRGeqRzaRxFjO1x/5xgUL+qKlAD/0cynZ5eKiFnikWXMu/kTdLzw2tCfKmCOgYkvbW+udpCjHQ6Kmtqe9ztGzZ1KP+HO6WA2uHRk5UOCYxGrl5g064QiQ4zDBqI3xd6fDVhvfZpdhmSD0kDCkdr7OGM5WGeKEBisoDT0Cw7U3MbjVylFnMPRhtNosIvdHI7OEJ9fDT8B5Xi8Q9lba557Z2nVR8GtuPoZA/reCztXvPd6qzcO9rJLxxuZMpA7xZMv+EvFGuPwd65E9uBIe12srsLACdfBRtMg02l2FxB/DyabWwc2LMIOO7KmgNrRDmR0trSZt5AiVHHgnTDYAi51gPkquvf1rQGwxpU/6dq2fBrHDuGxAdveInzVs8/6Gl0HM14aKKic4WMwHq6A5oRnCT2Qx5dPr79ublP5s14Qwcbnoc3euKGOsMVP49pJu8VJik+XJhR2TJ/KVGQlE9eytrao/GZg4ruDAerYONFwu/XJ/t0jfudxRqW5QRnfXlX1yAv59NhsT0NEXA2DVCYi6uJ9bxz6XSTIU+Hm5DBz1VT8SCTyflFTA/qXFKtoRQxaq9vW8U89iJ/YHU8YZF/5cy3++iRqthS7+MyNcpQIEsGClh8qp8unR8G6txaHjRkrPm9jVz2AkrAuXFErqGa5jFA7WBDntDe1LRXMQGi2lS6N11r0UkfGK6GRXlY1RBYMtebEHaccqIQJHXRJFg2zuXeM1jTcqBC6VobSInr3ROXXjAX3/ggu2u1zWmvWvnxBU8E7d0w7s4lippSILOAcha1ASJksVCD7a8c5sSj/T+9tijHh6Kcyoqwm23b1qtp5uxTv61QAmBFuUSnHgE/nZ1ejXIB96t2x0GlW9YeCzDS7WLInuT5Ad/0NsUACO/6JMLQKk31gYxPN6K5cnBQsy0NLRz17OeawaLjgXaIXicx9MNSqyR6DoEQmPm1c+hxmPDKr4k4Ko53fO3dsUUQYMulfu9h3hBtgfvVVkdxyvGQbBnbpDawFpw1FgdPBIG0NfBRLvLeC2oGPdyZWNAiRlwhfeged24h+icm6fWQvHS9O5PXwiKuxlluBn6vDmHDLBC/arD+k1kcf4aSbuEfqsdbJWBZwzKXE30wqppMt00IvfNKiWM73hp33AvWOnj0xIA46cHryBOJwxrBfsOKptWIKShn6Fy6FUNzDGmhOzdnhfGQXB33zGaVcCreV6723VnWQljpRjy4dM81sIyVciREVr37nvQjiLtZVF/uLsNSU9SiUGZPWXUPMsgkfAfogN79k2Y98v/2bbS5clDT8Pxjo888/f/3zb/8KAAD///dAGpU=")["GPG-KEY-elasticsearch"] +} + +// PGP return pgpbytes and a flag describing whether or not no pgp is valid. +func PGP() (bool, []byte) { + return allowEmptyPgp == "true", pgpBytes +} diff --git a/x-pack/elastic-agent/pkg/release/version.go b/x-pack/elastic-agent/pkg/release/version.go index 542ea829417..37579ac86de 100644 --- a/x-pack/elastic-agent/pkg/release/version.go +++ b/x-pack/elastic-agent/pkg/release/version.go @@ -15,6 +15,10 @@ import ( // snapshot is a flag marking build as a snapshot. var snapshot = "" +// allowEmptyPgp is used as a debug flag and allows working +// without valid pgp +var allowEmptyPgp string + // Commit returns the current build hash or unknown if it was not injected in the build process. func Commit() string { return libbeatVersion.Commit() @@ -54,7 +58,7 @@ func Info() VersionInfo { } } -// String returns the string format for the version informaiton. +// String returns the string format for the version information. func (v *VersionInfo) String() string { var sb strings.Builder From c9ea2cf5b00cd60ba431383c8852e51c4996feae Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 22 Sep 2020 16:55:49 +0200 Subject: [PATCH 038/216] Add cloudfoundry tags to events (#21177) --- CHANGELOG.next.asciidoc | 1 + x-pack/libbeat/common/cloudfoundry/events.go | 9 ++++++++ .../common/cloudfoundry/events_test.go | 18 +++++++++++++++ .../_meta/fields.yml | 6 +++++ .../cloudfoundry/container/_meta/data.json | 22 +++++++++++-------- .../container/container_integration_test.go | 1 + .../cloudfoundry/counter/_meta/data.json | 18 ++++++++++----- .../counter/counter_integration_test.go | 1 + .../module/cloudfoundry/mtest/config.go | 6 +++++ .../module/cloudfoundry/value/_meta/data.json | 17 ++++++++------ .../value/value_integration_test.go | 1 + 11 files changed, 78 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 417e4ccc0e2..aee7bcc0f57 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -433,6 +433,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Added experimental dataset `fortinet/fortimanager`. {pull}20820[20820] - Added experimental dataset `juniper/netscreen`. {pull}20820[20820] - Added experimental dataset `sophos/utm`. {pull}20820[20820] +- Add Cloud Foundry tags in related events. {pull}21177[21177] *Auditbeat* diff --git a/x-pack/libbeat/common/cloudfoundry/events.go b/x-pack/libbeat/common/cloudfoundry/events.go index 3006c472ccd..3a0f1756b6e 100644 --- a/x-pack/libbeat/common/cloudfoundry/events.go +++ b/x-pack/libbeat/common/cloudfoundry/events.go @@ -494,10 +494,19 @@ func baseMap(evt Event) common.MapStr { "cloudfoundry": common.MapStr{ "type": evt.String(), "envelope": envelopMap(evt), + "tags": dedotedTags(evt.Tags()), }, } } +func dedotedTags(tags map[string]string) common.MapStr { + result := common.MapStr{} + for name, value := range tags { + result[common.DeDot(name)] = value + } + return result +} + func baseMapWithApp(evt EventWithAppID) common.MapStr { base := baseMap(evt) appID := evt.AppGuid() diff --git a/x-pack/libbeat/common/cloudfoundry/events_test.go b/x-pack/libbeat/common/cloudfoundry/events_test.go index 91145589969..7dfd9bdcbd7 100644 --- a/x-pack/libbeat/common/cloudfoundry/events_test.go +++ b/x-pack/libbeat/common/cloudfoundry/events_test.go @@ -86,6 +86,9 @@ func TestEventTypeHttpAccess(t *testing.T) { "app": common.MapStr{ "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", }, + "tags": common.MapStr{ + "tag": "value", + }, }, "http": common.MapStr{ "response": common.MapStr{ @@ -160,6 +163,9 @@ func TestEventTypeLog(t *testing.T) { "app": common.MapStr{ "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", }, + "tags": common.MapStr{ + "tag": "value", + }, }, "message": "log message", "stream": "stdout", @@ -207,6 +213,9 @@ func TestEventCounter(t *testing.T) { "job": "job", "index": "index", }, + "tags": common.MapStr{ + "tag": "value", + }, }, }, evt.ToFields()) } @@ -252,6 +261,9 @@ func TestEventValueMetric(t *testing.T) { "job": "job", "index": "index", }, + "tags": common.MapStr{ + "tag": "value", + }, }, }, evt.ToFields()) } @@ -315,6 +327,9 @@ func TestEventContainerMetric(t *testing.T) { "app": common.MapStr{ "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479", }, + "tags": common.MapStr{ + "tag": "value", + }, }, }, evt.ToFields()) } @@ -358,6 +373,9 @@ func TestEventError(t *testing.T) { "job": "job", "index": "index", }, + "tags": common.MapStr{ + "tag": "value", + }, }, "message": "message", "code": int32(100), diff --git a/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml b/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml index 0ac4a813d50..33d63e362f8 100644 --- a/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml +++ b/x-pack/libbeat/processors/add_cloudfoundry_metadata/_meta/fields.yml @@ -38,6 +38,12 @@ description: > Cloud Foundry organization name. + - name: tags.* + type: object + object_type: keyword + description: > + Cloud Foundry tags. + - name: envelope type: group fields: diff --git a/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json index 389b0bc54f9..16a4f1ef128 100644 --- a/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/container/_meta/data.json @@ -2,23 +2,27 @@ "@timestamp": "2017-10-12T08:05:34.853Z", "cloudfoundry": { "app": { - "id": "c0874969-2811-4d80-837a-301fd485a7bf" + "id": "3ce55e14-de73-49af-836d-adc93f3fee39" }, "container": { - "cpu.pct": 0.45456369228159, - "disk.bytes": 21970944, - "disk.quota.bytes": 1073741824, - "instance_index": 1, - "memory.bytes": 14101162, - "memory.quota.bytes": 67108864 + "cpu.pct": 0.19431789913648675, + "disk.bytes": 16678912, + "disk.quota.bytes": 33554432, + "instance_index": 0, + "memory.bytes": 8529920, + "memory.quota.bytes": 33554432 }, "envelope": { "deployment": "cf-6b7aee31c8d07637ad78", - "index": "8895cf68-2e4f-4c50-9842-e73febd65c2d", - "ip": "192.168.16.31", + "index": "c2bcf5d6-7ff9-4876-890f-6f8fc6c58668", + "ip": "192.168.16.51", "job": "diego_cell", "origin": "rep" }, + "tags": { + "product": "Pivotal Application Service", + "source_id": "3ce55e14-de73-49af-836d-adc93f3fee39" + }, "type": "container" }, "service": { diff --git a/x-pack/metricbeat/module/cloudfoundry/container/container_integration_test.go b/x-pack/metricbeat/module/cloudfoundry/container/container_integration_test.go index e871a5823fc..605f7145f64 100644 --- a/x-pack/metricbeat/module/cloudfoundry/container/container_integration_test.go +++ b/x-pack/metricbeat/module/cloudfoundry/container/container_integration_test.go @@ -49,5 +49,6 @@ func TestData(t *testing.T) { require.NotEmpty(t, events) beatEvent := mbtest.StandardizeEvent(ms, events[0]) + mtest.CleanFields(beatEvent) mbtest.WriteEventToDataJSON(t, beatEvent, "") } diff --git a/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json index b9104346eac..5889e632b6b 100644 --- a/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/counter/_meta/data.json @@ -3,15 +3,21 @@ "cloudfoundry": { "counter": { "delta": 0, - "name": "sinks.dropped", - "total": 89547093 + "name": "dropped", + "total": 0 }, "envelope": { "deployment": "cf-6b7aee31c8d07637ad78", - "index": "9adedbd0-3af3-47af-9707-99016050b123", - "ip": "192.168.16.54", - "job": "doppler", - "origin": "loggregator.doppler" + "index": "995eb273-f871-4fea-a834-dbc0a4a72efc", + "ip": "192.168.16.37", + "job": "syslog_adapter", + "origin": "loggregator.metron" + }, + "tags": { + "direction": "ingress", + "metric_version": "2.0", + "product": "Pivotal Application Service", + "source_id": "metron" }, "type": "counter" }, diff --git a/x-pack/metricbeat/module/cloudfoundry/counter/counter_integration_test.go b/x-pack/metricbeat/module/cloudfoundry/counter/counter_integration_test.go index 44cb4935e70..f7c13b1a603 100644 --- a/x-pack/metricbeat/module/cloudfoundry/counter/counter_integration_test.go +++ b/x-pack/metricbeat/module/cloudfoundry/counter/counter_integration_test.go @@ -49,5 +49,6 @@ func TestData(t *testing.T) { require.NotEmpty(t, events) beatEvent := mbtest.StandardizeEvent(ms, events[0]) + mtest.CleanFields(beatEvent) mbtest.WriteEventToDataJSON(t, beatEvent, "") } diff --git a/x-pack/metricbeat/module/cloudfoundry/mtest/config.go b/x-pack/metricbeat/module/cloudfoundry/mtest/config.go index c0756c57cca..8f98d528f58 100644 --- a/x-pack/metricbeat/module/cloudfoundry/mtest/config.go +++ b/x-pack/metricbeat/module/cloudfoundry/mtest/config.go @@ -7,6 +7,7 @@ package mtest import ( "testing" + "github.com/elastic/beats/v7/libbeat/beat" cftest "github.com/elastic/beats/v7/x-pack/libbeat/common/cloudfoundry/test" ) @@ -19,3 +20,8 @@ func GetConfig(t *testing.T, metricset string) map[string]interface{} { return config } + +// CleanFields removes fields that can contain data of real deployments +func CleanFields(e beat.Event) { + e.Fields.Delete("cloudfoundry.tags.system_domain") +} diff --git a/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json b/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json index feeb2ce72ba..1d17070a200 100644 --- a/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json +++ b/x-pack/metricbeat/module/cloudfoundry/value/_meta/data.json @@ -3,16 +3,19 @@ "cloudfoundry": { "envelope": { "deployment": "cf-6b7aee31c8d07637ad78", - "index": "439bb519-3e68-4d08-a973-8f013f364d61", - "ip": "192.168.16.18", - "job": "cloud_controller", - "origin": "routing_api" + "index": "dffd1799-d03a-405a-9309-3fcce23f536f", + "ip": "192.168.16.15", + "job": "diego_database", + "origin": "silk-controller" + }, + "tags": { + "source_id": "silk-controller" }, "type": "value", "value": { - "name": "memoryStats.lastGCPauseTimeNS", - "unit": "count", - "value": 77499 + "name": "LeasesIndexRequestTime", + "unit": "ms", + "value": 0.681265 } }, "service": { diff --git a/x-pack/metricbeat/module/cloudfoundry/value/value_integration_test.go b/x-pack/metricbeat/module/cloudfoundry/value/value_integration_test.go index 610a0a8e029..af815a3d4b7 100644 --- a/x-pack/metricbeat/module/cloudfoundry/value/value_integration_test.go +++ b/x-pack/metricbeat/module/cloudfoundry/value/value_integration_test.go @@ -49,5 +49,6 @@ func TestData(t *testing.T) { require.NotEmpty(t, events) beatEvent := mbtest.StandardizeEvent(ms, events[0]) + mtest.CleanFields(beatEvent) mbtest.WriteEventToDataJSON(t, beatEvent, "") } From 6a130ebf4e89bb104c2575aca099158ab186cc09 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 22 Sep 2020 17:19:08 +0200 Subject: [PATCH 039/216] Add elastic-agent to gitignore (#21219) --- x-pack/elastic-agent/.gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/x-pack/elastic-agent/.gitignore b/x-pack/elastic-agent/.gitignore index 34b1341919e..22e2de50947 100644 --- a/x-pack/elastic-agent/.gitignore +++ b/x-pack/elastic-agent/.gitignore @@ -1,5 +1,6 @@ # agent build/ +elastic-agent elastic-agent.dev.yml pkg/agent/operation/tests/scripts/short--1.0.yml pkg/agent/operation/tests/scripts/configurable-1.0-darwin-x86/configurable From 499cc94b309ca0553589c9e7ea9bc1ca38dc7ba8 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Tue, 22 Sep 2020 11:00:03 -0500 Subject: [PATCH 040/216] Add acceptable event log keys to winlog (#21205) when running filebeat under elasti-agent 'id', 'meta' and 'revision' are sent as config keys to the winlog input type. This change allows those config keys to pass validation. --- winlogbeat/eventlog/factory.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/winlogbeat/eventlog/factory.go b/winlogbeat/eventlog/factory.go index 965ddbdac10..f66c158b2f2 100644 --- a/winlogbeat/eventlog/factory.go +++ b/winlogbeat/eventlog/factory.go @@ -28,7 +28,7 @@ import ( ) var commonConfigKeys = []string{"type", "api", "name", "fields", "fields_under_root", - "tags", "processors", "index"} + "tags", "processors", "index", "id", "meta", "revision"} // ConfigCommon is the common configuration data used to instantiate a new // EventLog. Each implementation is free to support additional configuration From 77503cf20d43704f605d2622075a24a5ecf7f92f Mon Sep 17 00:00:00 2001 From: kaiyan-sheng Date: Tue, 22 Sep 2020 11:49:03 -0600 Subject: [PATCH 041/216] Fix aws, azure and googlecloud compute dashboards (#21098) * Remove [Metricbeat Azure] from VM Filters visualization and fix Google Cloud Uptime Gauge * Remove [Metricbeat AWS] from all visualizations in ec2 dashboard --- CHANGELOG.next.asciidoc | 1 + .../images/metricbeat-aws-ec2-overview.png | Bin 612646 -> 863618 bytes .../Metricbeat-aws-ec2-overview.json | 1676 +++++++++-------- .../Metricbeat-azure-vm-overview.json | 120 +- ...tricbeat-googlecloud-compute-overview.json | 127 +- 5 files changed, 1085 insertions(+), 839 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index aee7bcc0f57..4af5bb53655 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -349,6 +349,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix panic index out of range error when getting AWS account name. {pull}21101[21101] {issue}21095[21095] - Handle missing counters in the application_pool metricset. {pull}21071[21071] - Fix remote_write flaky test. {pull}21173[21173] +- Visualization title fixes in aws, azure and googlecloud compute dashboards. {pull}21098[21098] *Packetbeat* diff --git a/metricbeat/docs/images/metricbeat-aws-ec2-overview.png b/metricbeat/docs/images/metricbeat-aws-ec2-overview.png index f9b2d621f4f2938de71ab6910d2e60f018ab3abe..67d90263c1039d64d7d62d23e55e40960d2decc3 100644 GIT binary patch literal 863618 zcmcG0bzGC(|2HKPBHW;&AT3?e4GJn9f^vKNwet#|^wKNpTNN7lKaB#?!m0oD$;7}dl;E)It z5n_+9D=F1tf2=qtC}=4wC@^ZdyVyE7+2G(PMJA=(exoz@;2F|?i|H%ti)SjE>Tw!4 zoJ_SiB$LnI$WtnD2;_aSRIqj>=zAYQRKz05mGkyd)GP&Q{qw4~-p>eeZ65Q?Y6+2_ zg{GbF+_Ya0G)wqrW%>^qqiwTp<4AmDd0^MIjbj~Y9pBF==NBN)Ooygr#L-=|!YO)O z{$}`N1QC9O+IIU8h7ae{)~~U>>*ufF=gJf(A&M@&hOhlx($lw{^$ecuox0$;03X}iN_1$D4j-RWp}G9{ETC! zsHZ**Wez=}INcx-mk#~h`u3IHOpXA({4C`mHU6^#=3%9C)#2Lq9?jRi2-nF(=?Pfl z%GC#LH#WPin{)f?25Xx^c3>(?^piLOMP?&fUocwe!3QqGL_zj|_z$gaH*OF5L#)`+ zxNTT91Y>_Od|S+rV0Vhw`4H@6^Z1dJU;O!GP?2&nPt=>q&OsIri{m zjUUPBQ_zVGNOa9gB=C$xkYu4OIQJ-h^Qys6j(!&|moL?5o-Ol>`_)PQHt#pz+8{HF zFV2}a-l#dWR*TXv%e@_Bf3?M*e9j4s6kCFmI=0dq&nVM>2*x&<#Ke-hCYfuJN+lUsnK@%Orn=ias6FErq@ zS6SkeE)KuYlsTqZ)n&!F9Xp}&U&SSCNSlZ|CaiHH$aF-9&T)#+_^#*o^!WzTD!=wY zp9T?4uzX~f6418T5rzv{K70mTzNsG+mo+NHoNcpp@ar~m&G@K6*-Z_e1XLxhqX38KUdf0b%3g@-XtwPX`ibGy&B6Vdh;d96{R8C$wI17~jM1 zk^hiO`MQ{c_#NvvBHgfWuYPm*Zue<5PzIf8|EvnQz<7{t6P4KS8|^uoCIrg zZ{cq7rm2atW8$d>1W|vrEjF;rc00D zjmV@UMEp59qKH4dT-Bb@I@RXWz9=&Ib}LC;z3_n!xsFs(w^6#$s8N-XYAsithNI_{ zmN1YeBUyPtN$S;34k)`o?vunPIp?L?W`~9X(0F$FUdafIZ?YT)Ex9rbFQ@vF@U_OU zP#F=)X9P3yF5kCY%4(+e3@^|r^w&UW@TY^FE)--8#*Fy2UDDw6Z99G}7laqjFD$S2 zE)XZ-ckBtFgj1pSvy!fw^dj3Nod)(@CZa5HRP01$LGvvZn|W`TJBjM z0w@3s0CWN9hi_gHSjqgVmg-#^10`WN(VFz-^n$Tg^npI}ezrdJ$B$EO1ft~}k)>w* zR{SwAKn1|1*}EDY3ty6bCHoli4q^vogGw)hpjT?#wvtB_M@f)2$oGm)B>qrH-TNQg zu_$sBKMF}SekX#sh{%V={&DI916uLNYm~J-MIsNW9@Df+oY5OYMr>e};R=iLdZ8vn ztRG%|&Lt+n`$W`#Wq0le=@8+uG>J)6k z>^~{3sL-r2!=$MVo@VCps@fLXuz=`u)eUpQFD;C~&aDscNF_*P*{$M##gnrIu7(1? zNw9G4CVoq_;EQhggo#HCaj%o1+Rj)nuisQm$4>_fSJd)4gy1nePkXD>PpL;_UU<6@ zsd5wdS9X=0!skaRhL8_qDx;E2llN>Q_;>^jYOP-v&b~6?*dIOZho{T%5GU;>$WNY6 z+CIAfD6xEqcYS%l-@O&c1(fBBF%1Za?4_KD-%%|~DL0;n(57Oh1dj#xtLxWa4e9eE z4LeP${8?)SZEO~}5_E5sT%g{g?v}EZj~ZO5LP22V>lP6=M?*=wDjn)IaWy+vuMB>bH zsGs(ziE^v2ee*FwF|aGAQ=l$>{@0?v-kHpcFFvu~258vtOaJAbQ`S?HznZr+a8>wG zLpOUyvhDEBp<3sop1H*uma?BSUx5w?zl8_&GLj5|*P|brs3rNr%vu9D4<^sOY%y~~ zW+|GchmGz(xqiKy5`j5>f|-_!UH(L=Dug>K{vvCj9T8h{srMM&mIe+XW||hR8~B$j zmYcl1N0&y+Q_C^v_8QEQ;QWo?7O0p!Vq-q{B&tUi*x9ix*`7 z5ZQFivptt<20#ui=e2{jxP3IhW-~6c=0YptuJ4|@9&AMW@?V%mnaA9{e_ej)|ATu- zU+!iV(|59ZwhD#C!=l7?mbY7%Zbr{d7nHvDPoWKwigNcr)8{@bRKIjEh{mz2-01cd zXkuX9#XO4lc){vrvOLp*H)wh=|fu8R3e*=Q)zbnGV2xNE@94!rfiVGr6I3_?GbN1rMd5siiE}J(m;Q zjyjwJ-5jlt`&t~({g+W7oM(=w-%aG$2>YdarOBSeR+gL_)1QT_4PORs9YSb6>aN_m zF1{hK0W$n}lL;}$y1dCY2FkYT>Ns53G7-)#TuK~#YzY_phl5LlbL(Ga92^x~+W#zT z<8u7F4jv9pxC0Kszv~!bzkk2tuy1VZe}Ci0hvD4D{-VUbL%-ntM{TNuFZlmaCK1M- z!+EZwpsbAj*0FN8u>k<>T|7D_1wLU95W6ZF0&#F2u>OAIDr-N%`s;X}4sQ%R4Aj*m ztz4Y>EUaBDZTNhgU4Qq3Bkd!JEjrtHSTOoHI{|=_J~GVzsv(Ij|31vm%=oV=9*#21 z2I^Xj3NG$8j3Ru(d{3EWNf;R!rQNMfy(a#GTpq0CWtA~RNfbn;~7M3oa9x}|# zzX$ry*WcG^^}aIpRVH2Zz#?`Hp+*WbfQ|L#mu z7iiGzQ>0``67239;NU#NQGW6KjSueb(k-9+ z`WJnNVkA!*9o;zh%Wp*`*K2uy@oUJ(ds9T(v$SOTzJ&lyfcIGj87h&M zvB>fD14`xwA!rvfGK?5iiw9+2U*i%N5Z%Hhpm>J!CqE|d5vkRrX#DA6DB?mx379%! zX>tGLWUy-$e20i)B?b3M7-J9)9?_rsFqy~0#l@8mTFwWNyPo{PfqqZn5rvYH5@QEH zzQ&#Be^eSM8o%Gd!^0ywX!(xB_lgl8kC>R4;LN5YlIagGU`k^U;n}U!KuSKh z+kbjmIKdvb@TTZGasK$8qQJXsB>uztfucVM2N(S4nI+Mm+)a!@9r?Tz3=I5OrDrmK z$3*7O4u*rbMM_X07y8#97CR!wXF&|;KdOiRRu8{*gVG<@4Yju@DJes7+Ep?1E8Bnl zS-T|2NI^mIEXbTN^WpnHy@0sjMf^W433=@Q7VkW(MQ;V{&qz@LeNEI`5F&iOaEA)vnQc?O@zo`es0%kyO9u-k%g7B~?bo z&cs^6@o*eGDBhJme?sJfC`Q!mtv}t6UL3}8x~*e0YU&SqAuB&0Fm@n+USE%%?^>ZX z6C1mMtk;_=$`R4kJGa90<2ouyDBt9T5UiIuFYuoX?nK)TMS=XO9=(76gpot*3FAuF zTLHsNVz)zPH@DIAX+9&h3t=ZWi%eR(;6JBFI^>=O;j{;Kq@*UPj;}z4qym#eQ){px z3QrC$xHI3SX)WaPqQZ=gs=?U{4}&NFoY4*d{Y!Q43tc^;yiObHc+3c=_!Ybta49qfRel(>9 zjmMFSwT`XNP_$3kWwwbK*CueClQhaW{mI?V7>yTfnAulLYOr!#j}IQ(H|fH7bk1HS ztQ{ASUzJ~Jx@6V^jeoKd-ZDK~1^E@=;xhY{7t8{^PtR`uNsqOfiz4$!Q@D^{y#b?aCA zbp!0YJ`J*tStJ1=erIDZ!QGg}B!!{-?%(F_!x81QEk}05->%WO&#rWr6--){IwJMH!afalX!JOcZ8Vss}8| zZ^KGhd{Jvq4roPm&rMFp@R~9qA)$&Z8{+9D9%aN*ph?Up^R$ge>m0_jTd}e5%#Frj zuU>txj2V?igeK9pEeG(oUrNrJ>8%gm&sX1h5HIBo zDAvx8e^YFtj9MGm3q|jVGJ#c-c@nmSY=^?gGBP{l$c}bE$Sn7%Pi>iQUQAp>nfHla z{rq`9V$SR7NCG)uX5a6dk+{)V>cy5hdacz_noWB28$oE7XWZ~8eJt^Smpw;Q`3I`! zCQ8Bm&Yv*4Sg^w0XSq98mU9Q@;_(Vrp|9wNhU(BvSL}FuMN;;>l$#GUN48}8wqKtX zexw&NBLvGR*$!v&LIO{jn84r@zNOxvARGw(PudLGp!by==5o^Ram3wdH+hsFNt152i8#$FMMlSJy5(8+M5*lPjp)=) z1wHd3`TqTTe`XWu6InhDqk1Pc33ux&J7uqIYDcDjP%;iQDaOZT$&gbN?Tby_>yd$S z%u6kvqtp4i#oEed`$w4`J2T4Jpz>I%O>gH4<4g*O1C4aW#I*1BPXJnMN%O$W{5F2VV13mZukc zV==GD4oUA+#L=l%5#nu;sAWs4>b)#IlHwB z=?+H5+)>k<#d>w|9^2z=Q-vPGm+ud*Vnfu4l8ABM!3}7pOOm!kt|O@mMpCi-!YlEV z)3?ZlQPro~(*rfQU<*TX(~I>KIqQp$bKrJ7GLK1|cAFu+eq`XCIxDU>9QDVQ2ZXvso&sA3Jk}bi(!IOx5 zI~~x*-N)h_4B+E5Dc$*cXI6bLH5nWuoqqjNgY}Q(q(iLyZD*xfJ9^A4=>DIqL)Lrq zC)MvxXy%$dTi%qvdH!y?(d3(68P6wLkvRDeB+cDfd&Q|bsL>XN^V%jU5l6kTH$lr_ zpgMzZ`G6^VnKL}Vcm3QBqU0Fi1aH-S_3^RQHOJhOg$86C6?;ye>#Dr=X|>>FuXOjj z6fu`UB+GfuAzPm7#LxU{_w{#(Z1W~AdF(2&r<0f$YN$I*R|c;Qr=6fv{iVrXn$-G4 zexwyst_LjewRr6%r>0JgRt+Y#sY!b8Gm_Cxr*w4Scn`9+?Hvtf2s+QJ^?dQSc| z6(*DPCer_;qc+F-~BSUBlFLar9oBD4;UJPrM`>?)6Nge2%w}dAN_@qDK*uY{Isp zsTwf-z|LRxS~)_>O*Z*Tv0MVt?xNgEtf*r4UOh;|V1hZm#hRFNE~j{n$AIyi;&hCp z)TB*M)ES;!-goetDlb)_?R0xo`xlC9E9Qp#wtW!9Ec^i(-LQ&;`&v<{(5i+Jmo5*& z>0HrzA;z@YZAvfvrm*k&lEdS2SU+z}dZt`=nOReAxdaNB?EG z`ybU!-kgQ9zJngVt8zE$6VS!b>n+7-LJRQa>VkGd`3+D-Kq7%`;`M|qEb;RejZ&IX z(DEva;#wUHGq^ijNJ_{WCdYihif2z`skc1D|g)3d($m%h&J8?a#uIQRrJi+}fnuN2ZZ zFm@h*?Ca^7JCK!`u|6`372L>RUV`#Y1aG>J1D|k%tlgowY+wn)athUn=k-o6r`%TRnDrE!|S07i-GC*B|tEh1T|tW<=g1p||N% z#$-X}QTO=P_6D^;gVT>j-2?@FFsF3xeWv973ocORy@iI6{=~qwhh*C=&5HVuWGz1e zK^Ob%tw@G*UEu3~Fj5Gt>gcGr9ZA@_E}Hg&UE{_1W7Ci`QNSY4RKb}0drW}jNDS>- z;a3pN8mwMj^?V)HIS?-4xFZ0*a;{v2Vao4arC4^y=MQBK0j8Qis6hmb>A`EtTSt>M zKMC1vQzF4)3>i**WUoD9>nwg1>>A0c?pUh^Enhb2RC~Cx*{Cyad%SNI;#Lvv7&Got zz|VU%@wV7TRwRl*Di}Nup{RjL@fh!PzMQw)@k^Ps^c^zWFagM$WIkSQ8bVAqsAqEB z)-U@!gKXnm?a?7WLZx{S?@Qktv&4(JSSsb4L80S!)86K0NwL^$M!2~jj9Vz$bmeVP zTE3rOQvAfcfa=jrAvg>Fs%~5B``edJSqp>MfouUcDkq=p9ZIT4rypu%BQ?9fY*y z1D1>^DQUQxH{O4Uwpnac7VSXodCR)S=*)*c$HqGs(k_0nHu}ETP3-wjbAk?hg-lrk z(S-XlC&SUQt00;|pQ%qU<+Ai2tUNp^M}5m@kvi7t#2X$%v@TF?w+(M1vCMJjo2|m- zfG&*R=`NG^l3NM!ZC>W^;jtdM@H;8k2nKm)x!R`Wcn4;FjTt1}KfdF9601!{e4MP3 z#5JfccAV(GJ|sC}+yF@F3<)2c_oUseq&5rC1#{@AeA6p-THvc2Bps9EU267n|84M% zQs&ozZU3Om5?QxAvtFa8`i3s7*{8Yzf1i724{2x&4oKqG_rP1(hE;Iua_PH=VV%&| z$*BQkWM394EfSUwWXbZUa(3PULI|fFW*JytuPi|;h7=jlKS*>Sce`=Mj<9}Om0epV9>O>Q%PuWG{5r^!Z0yfM&ImiQX_ma2DZYX|J* zBOlQE0x8A#8MrYpId)rokA0Z@!!2Yhzq6c=G2Z+4y9Qjvqyz*6N?+gK%G4a8(aoZ0 z-x5MdP`!%H;Hh&o;2e`gLDE9)@%rs=9aW6`w58Qxk8E1*xB+}CTJo4qin z&RKFA^gf&B^;f^W61w?@zsPhvhBUG1KYIB(g{P>?8qL`&tOGlEgW^#(T zuPXQq+8&w?Y`mxX_H7VxW+{l%OcM6-A4CK?eE)j*)HSXKaOLNjIZTXZ98kDiJP>PG zUJ`w30lsM3>fKS(T4bap+&p#kf!G?_Pkebc;x%CfT|`KD6B)C7>GY$CD|!ybA_!Du zdb^lWM>c8}@8p0O205mR_Ve=J(Um*muJ??0dpHlT4?WxGW-ofJF<89ISQLsDjzId* zY@!#ob=W%iU&yO0Czs)Zzut#D{Tf76wj<}9DGFBeTO*GAB+GeQuk5okRiRSTDBYA{@ctU!bGGAyX2+Ja#Ay!0YNz}u znSf~m-%aR30=eg@h{wB)-ScV?0x;Kp^X18tCra0s=Xo*2SB_d0^=tiqZF^^n_V)G; zqLMaR=IeFpu?nJ46XGUMz^%{6&zm8Z9Jg|8Uen@*{Oq|SHjwT~%gV)N6!n19n$nM3 zsfLa0J8eYbwsLCB5679I^g3GWqvXBOb822~0~(Q17LgKtb;tB6Y8Uw@DSXDP+`}>r zV1Alu$GD}9aF;{Nm-#Re)66m{{n#4oEtNjwSSo62{`-UG zY@cXnl2q;wHFb{;VV$1mIU3nsGk3{VufXE`x6wQoi1EL+2+zpqlJB{1q@@Eym@UiH z(j*n?k+YmMJVy1qHrm)wsn{^LnJPIsAQ*dp;mXX}vR27^MwPBr0ha@aQSjl7*t`W0GAx4ly7N6#mN#EDNmzM~H{b2oF+>ie zXPc(g^I@Zzg$1orxMZ`%M-A{LLZVPr}S z-F*JpEsq@HN#i!ZPdvuiXJ%77wY4;{-TLrSA=K96Th9Pp%6fC%2W+xzVc`z=XLM-Q5H9hSZ| zl{wlRC6{@bBdJ|{AbU@f(na{ZCr3r*Oro#l1DTRTZj%qJ$b~QHOd+qb8qDusJ=&<4 z7LtpF`=iNxH|A0@0U*Kxjf{1Ib%*XMtG*G8*t|yD;YD`+ewhan-a~lifXSBe7kZp3 z(YJ`C6$4ZcE&2BGy2G*>=C9W7lYymuQF-cu%a+h?!kuNUb9>XqwA7dDB8t6Hc^*>Zi{CF z)xFX>iX-T6!QnKQ`XzdvM@QxIQT{KM+knFojuUbw$Ts$Me;oxOyG#(9$Kut-Iq6W6 zYDvBQN&(s~0vt$lsq{~hN-OgB#&=^Tta_yiXIju%r}soQ)k98&T{VYV*p$lEGm`6< z&0pU5gUG&4Wd_?p0_Ps(%yGiU#rFcwKC@?8y^|?f^|+3?(X`ho;Y#8jP+(JVJdC$- z$7G?UPIcAjRc)heKWuteg0Eg-ecxy>gR(8GfB3LkQuNBYxU_t@)#-j}^?Ge7oI0ae zq~UQ)g08K`NKTL1iWvrY_mGr`B<1lBjLKV|TZZjYD%te48eSO(vbEcTVs3>l7qTgI4Gbk6+6bT9pvHFm;T! z9?1ZrsN@lQv(8l?l#=Z+>M$JX2Bz>uG@V#&q{Ml{F={c82=|Ok=e2CmsK^~!3A5~gOIc2T zLk9@h+s^a5-xqnd6 z;#$>)A4!^@__8fJg%i(m>-65Bzv9NhpH+U$3=h+~M&!e=PG|fPFWcpA`1c27gUy(7 zV~~8V@U%0md`VX4G!6L+VSep8znw}UCD!3GlI~e=s!&AofQOO)#CORKz%*50p$D&e z8U5gpcBR4RP}_GqEhV69&_jTXaay}r`{nt{mDrVR!)Q>=%^f;X6*w4y?~w@6HX77uXkBqos#iI3ERo>@C+*tLUT+Vu}g#)W9rUFwlK7`$QrAE1{Wg3 zf8$L`Sa-x3a&5UCwmtVs$8Dr;@9S;khzAxYJ8B&@uk7cW+ZsI8{vI0C+&4L1hc#BI zu3dv(AN9WJmN~tj?%G9HS`VP^;etsY@YDm-#T+f=X{i)?h1Yh^4u5Tsf6hZM@EyS? z{rh><(}mqjIP2k0+wWx+Ja2CyZBxtG#|&Q~&I<#w1p*Pv-)w*rh%V1`yDp@k$&a2# zG&D5Zq4TUyzDr@&hf;v`12+R{Ea93u&)x=&fsLeo$#i<$B3VPz-b)F9hFyMoikrPJ zp_%%04y)Ac3((ij3-w7yyR7C4A)YtrtrRaZB=Dn`bD?RjQ1kIp5u#gK^l%6n*7GGVryTlLlbgTm<^tg)!#P} zyH^=-?vC2n0S)_?zh7YOQ}2hsstSoecq!m7J?{>WO|JUI*4#3Qg+U!=YO9uDgCEms z_9O?!mh2d%{>iAo1P4!bI54*&-+eu5@(b7$B9t!MZC#j}bI!i?0qx7aZIG3_8rU30 zc+&JT_G{my>oXZI+Zj*TS)q%Fy~}KzITpkA^gEki&mW5(vz=7|QfCWc1FF%Y85+1Z z6CrDFU!UrV+||%!p~-SZiH6OVHdsoEzeq`O0tZ@}ytWD=KaQ{`Z}qEbz`%Nr~G^E<@u4yuP|jf16b+ON{C?Ks`euZ+jvbMNLYmK zHv_ zVeH2dW;XO^(<(?(6OqDgY~;bqdlB+80c;*kxXH@z2fk`QpBsgN+fKi2+=ief!Iw4> z#5ePa0nJMc(jJLqNFDDh_;K!X$b-7Toh40B7v}g7_qL^hOM;ZZW`bxyJjQh$O@9xBnTYN4@}aGy4q@ISNU zohlfqE-W8w5{n!0dQw7=UfBkQfEn>G0=EP9cR(q0pM~u1vL9$K98=NL+hSUi@;4qG zCky7Q`g-e>L1clw2rzU|y2fw#SmiF&!%g)B*q4zhwnk0Wse(_LaZ=u&itQA{mq6Gj zF82Ir;f2noEl)nwXYU+s(knEKNyGYDcBX&huq5}n7-_OMfA7gAT}T;?db;#dy@L`& zmi-ZLhN#OSHj2oq2u`OFY_vk~Ei4wj#y5sVg*o`C1_Zo6k|Xh1xNI|S4bE^jYUrPC z@`n|~{FC96Inzqm@m3%Ul9vXL`cYFKanKRrfp1@)E)q*Hj+&S%z)%m+2K!ZQplPaG zSSKR{-R!xyMsO(Oh<7ebA<%{zst8$MRm}F-*jywPY1OPys7a@!N}p`uy13B`E}9~) zmgACDMQDjj3*-uLxHu0OBBdgwq!mYZFO?}RPi=hKuvsthxqjxvM0Zm@N1qOb=hhD% zCRBkDH-cb zl}o0^WrODR@vkhht3KF}A|+1Ly{0yt1^xG#9VSY@`rEhsaD7IW(}Et&$O|LB z1`g%)4B3ophGZ>8i0s(F_GL5-vKEj_+f5ElP&;pjrRqo>*mx-!ZG$+X;;Ju(F6FOW z_I^*87x3bQf$pd$2F6i=E=7x;^GG1b;F=%ZOp%aOM0cFp#0jxvDN)v-frp^vj5#HSE=nT z;&Ev^kCK|UYjK1D>~5mG%Ce3)?7O5y#^0SCOl&l1-oY$FLE(2UuI+qRu3Pp@K%!XP z(q8RmrOmP4esfYOEQ)LNGU}cew6FmKw(ss04s~%_nrFi){ZiArzw{ZkWoJHj5|wVZ zaSiuY?hZQ{#xQ;-p1T-sY=NC+xVemf$rif)9KN66k8J8DHVHspX=aL&y}LXN57v;G z9)@Y!4)wqOwR`XCE)bz{=W=hdDfjYnh(QAqwk~tL(#DC`mM-Gp)E-D?H{GEiHtifD z;9j9XU94LYRx85!%a7l|u+=9`lOsLjT{+0}lOgJOr=)z_vTLHip+Uzi@R#W$3p`%` zXicxSg) zwqCl3<8BRPCWc;dSqvayFK?lm$g#gzfhCoz(cfp?sMZhr=mi7w2pSc#_G-6;_P_=P zslpDE{d00K!~~yTeGc-L>CH7}KR)XIpz2z-%w!jV(Yvkr6O}Xx#~2+LMVs@2R|J?E zUOi2K@I{_$WJ&t8OqC*+13S)HCbP`Hy-`M(nzx&o_F2u8HvJ|-=R_`AFT(=RBh;hN zu#Ih@+_5joA2!;SuA@XXOmF6D9cspW9TtWSkJcs>>Bqn69M5I7zx~|eSl&`xrt?n+ zQ9&}i=@u)z?O9~e!0yvl(4%6e$6cptqTSTLm_S0Y0|}LejATSNR%t-Y;bXgUl0b^)Jh) z#RB&e+fU8{dpa8)M-EL|%qNp41&R)f?DOdbyw-oS9v?93f)r1ksaMP*{sG_8SN^+uEshnQLBR?{L{d{qPDH zD``0kEp~V~Y3jYmxP13QUHD;z$~uXc6Kc@3VR?lLUU-FNi$8zTI9QgqI~z6qEIP|~ z9$XhlLBM z678j`tK8W{H8grM-S85-fahjbqV#Md`SW$oyr6DbFT7OYMF%Vcl(YH{UTwMlZbFN* z;Wu|0FvHKuG3xByaG|=Qe?^5Pcb+mg5`H+&n__OJD~nn7M{WKZo26)%yLoJZe<>`k zp<14){2YYc!4Iwc@|_p-Q1!$!z>sd?OFkBxjt=BnB_iwWDArsxUnO!Zh0tM(zvUL` zgT!lm$_mwPxS7wjG8I8e9};ESVzPCagMhoN51QHH-B}nQ6I*hK%^esWib* zGKFP}y5oaD8!C3g{BjH&um5dRkt>Ei;*B|b%k{bhzl zwHC@OVgNyqW=Ccp6jCMRcAL$~HW96O<9Cx>ju|5U+4g5&jcwC| z1RH9fT6`W*ttt4Fh12~TQuE?9uTnYA&Bul)lg+xo3Cs@aoo<$$-oi~3YDM8DIi6KD z&$kH6oO0Qyq`3Fm6Kz95n7y-~+30jCJR>e_gR=YZ*C2L>MLK~4As1L3J3Qka zn>FXjUw4@9kh>g9c=m}#Mg#k-F9$Z2>TAN+oCg=CGMAeP)xQy)z|DVW6+t;t@%W=^ z)}9FQx+;uhinbz8Sb^(D5jLpVT~0xtA-}mmu6g3aAw!JN!0Rizi8$FnY$C1yfMHt& z6&$_oLd(js3Ths$6$!uMRWxQJz*CUl-3)CsFfNSu4aU2Lnp0-icyj&r2O(L8Bi1AO zO%S@b5N{vpcXh?TAET|<-lvlT1yWnNRsI-ymgTh1*FITm(x zj%NGL)hB+Qj`J7rHf1Kw`a`FeA${|yI|usT(pNeNPbeYCvooJagO<*_#+6UEGLemS zDcG1!ii44{gZLDPrsmTi`85fZtScE(Kriv}OCQ-s9mslXKwBd_9e%^lvj#V4_wI{2 zY$&zZ)NILuI(%(aZerX464VMBw zsm65+ObV}Nn+YZIsfk3fK&_NncTVdn2oMf8CzqRESV~H(*-)w_R+WaKrm14*51=2* zJui+O(u5^AAMYe*R5W165dpNEylUFm-XG<+ycn7-Uy4+og9`wzf-%T?i_d@zLhm*d z>S({5s;j}naI&q!A^?C*ZPJGv$TqY+yS~g(9tETcvTn6<>v6cq--5(Xp*l8RS zBY}Nl_FAwq$v#+I*^w@rU%6uJS0-OT@#|mihhep!XvGHhs*U&f&7qk~=FLv|W&8$> zvojeYssWlmD)js69fDS`Yhd+27=YHS0AHJwdQJL7HB74ZxK!#Yw*!B7BIbdA#cRoSOaaqIS3i?qs ze!OnXW0~!#c(J6nYLMr4-dK_a?ck+wQ2QDwghWd?`%SheV@}8`OgFAwRT10^ExJ^@ z-hi=O(@m$}Zp$&&{w!V4?|ay2cdUO`R_>btUp*27%WG#q83c_qAQDzx&kN^PW2FNi zSczDe`0`waHs_nOknN~fOP<5jtNQZQI4L!XBIDNQU*N9aSydC@&e0EeJ;O5~ND%3)%)9w5J=tgG56*IwF*Y8>~=;_6qY+2uy1<2l2J&eAzh6Y<6^&lFpmt(+ZlNO9_yXV&jmTPJ>bBaMPAHuh7n{KM5$7VavT7b<==>a=?7R0o0?&ba3w8ILHId@`G(FMO zZdl~)1L^%r=hqX(w+nPjjFhn+$=>W*(qIx-|Ihr$U?Xe@T@@U>;I&(;P?9d9&3%4^ z5Mh$_eTjb-LnpOQaPQV_Odz|1(hBtI_IgLBg8NDb(_EuN$?k00z2pHX>nN}0bA4U$z^Ca0y=w7pHO6hcWUqf-^WP-6IWfGR8{2`HoWoWIt z!_>8#++W(=9DHUGwB02rEWbHE4!xS|wNAn+|N55-v#l16_1$kQ~xU}yJ-?i2uCRPqe7XA)MAzqjqFB>tgPot>(4(ZvS6=GZ5 z3AhKc4JTu8PT8NSOQ6!;5VhATyw=8yG{}jor(0ePPu-{-#yI|{PP6yPPCh@PmR$Wn zqa^BoDqX04<1k$W)qycK5VBmF2IrAC_~Hdk@?7=uw%APm2A z{aUZogqP--xbp>1->8%x5{cOl9B!f(9zT@l9thOP91MFqTwCt;JwgC=PL0187e=-- zq>$~ZvGDoT%XVrP318HkZx-HgHzT?G31{@43kvTOTfX_*ouf)zGWS2{_71R+ zFZ0ir+w^|Si<2a~nCg&gutppeIW}{m_b&z-vZOo{zjjk9P{7I;-hzAg;sx!N!~OW+ z2&h$fUS<2*&XeWkq}{86z`XoZfZH-{^DArXpEv9{Wsc%S(4iBV9Gghr-s8n%I$68@ zfWoq%^DGp+#U+J3+plxZ++JSv2Po|T(a*{rl1OL>9UOKgS zjd(m1U8DBh{LG%YmKh|(2<=DC9pR*w~TYAN3Y6#*pin!Qa!kQmrBw812cKI zmz0z^&VL8t-i4`8ABU3b@x+4)bFSX0M=vs66q|jCGckuo%{@rKK71kZ6@<-qW-WRv zgym;~E10c8*4jAf%RQIE?;^~zO%~0-_JY$MPCH&weEPw8jA9E)tlfAt9EfBr2HK?C zvIMnC8BVWxrdMjj{rdGagj#A=$6>w^I&56|J=B>MtWWa>y+qzF#X@qQhw)@*CUIkg z<^fgt`hWZ{0F_nwTQW5PC0LIh<$SPvi;&RoRJ)>}4m!$Z`mHf5;Ml-2wNSJXMng}} z##BszYNAq2;aMd(+q%Z)+UC9O%+ng^R*V_kZHl&@___W&Kge69pdO%<(5|c)OW!bp zbq?u|3qwe#`Fy~5mpN43wB5jb`b2w8l(gPpGA|2FbDjMJC4vK+7My4YId9Nmkn+lr zsU{Q`aabJRFVvgE5`KG=&pH$t{O9)zbtSB!c4C!WWp2eM4nf9xQG~bsRNt-o!v!3E zh!FAA#=v;^dpvJRmziCiEbCBq)EJU?vf87V*8OM_EfNPDmKbGz*J6o<&Ts z88`-yrEirbWnE#R$9pnj4WSuGHeY)KpX%{?!y1H2-`%}M&e3|eUxdH2*~CxQx%DCm zTgtGh*)gwGkup=QzErd;2*L7~80Y)kaQWD^o|hy`LaY zTv|`EO`+QPQK)^X3T1mG?TG9>wcH%Jh1T_h)o$%ppWZI z#}cO##6?<>pSays&+(q;tb!_d)3{$(*-f^cMRea@|ACdvfb7=Ee6?E+Iytoj>l|Jh ztDq(z;a~8S@_=ppQyv2zc4o9VJ}QxqwJGYJ2I#5G7Rif!WfIOI2!F-cnHyEXz@}RQ zXnrv(F77R-Zgr#6QvH+z$(;kT=_#DAfpYW4ShkW^r(jH=(@Xg|kj7ffZBPvXM3ljl zy9t#oB=#@n>O4a}Y8z{Y^e<8ZCAYF%H`FW{?e`CkyQfiW$}~W%c^=k)nKXbC0^m3P zk+HGfOcXlY+%55Zgudq<=~Upv6|SW+HJ*`kXoRiPUPVt zep;G$xs_&5CJM{3yI?%5UD;;?3LTOHHbAR{XIYX-KD#=F@%uNm8y7oMb{Yx`!mSlp zZg6niBKMLEIN!P&Tzq#hEas4HcElJg)@gpBT=Mae6w}Kf^F1RGP(i6^um!hXd9^c5 zKZ2L$4DmqhnbT>eFCanKdA@%}$cR&?pq47nYiI;E6!F<=ZKMI-pwst}E)b4?iRC*t zTaR|13u#SIs9`1=)&W(<|5JTG`OjC2xw?YWWST z)ml5jfWTMvlKQG3&8J`XE6m$pi{INH?QJQ!18hdO8|kdfe=NWgw71ukd(SnS~AZ6VedPm znoPI01q%uyDhMh9Iu0t*MVgc_qJkixbO;c7krHYsfgm!7ihxS*q7;!5=_Qb;^xg>& zNGMW6Zy}_84|9&^eb2kT<9pV3X8wKii#4nz&;8u{-uv3uzOMTj2^y9aX;n}z3O#8%~ex)R0J%OXaF7;h%;)pnm#BZmpT5I6n?zI@U*60l2bj3f{Q z%jY^T7beTb1N5gxvGv^sKGHG?)B4u#{%;nr+ed``H@_EOCM8NV0V5+ouo5>7w7k$; zbF_~!FILCaK4)EQ@Uqytz`d`u=PdgE450;R;ty%XuN|xE)1Q15`z?&Ettm1kHB;2| zW*lmzR{C;(>chh0>>abe0a6r_i3fpxa29cGrawN3kA3t(p<|21od#2!`8$=VVt{K7 zcviNF#{0gIebuF{ZrJ+fa(GbgtMk%BS8K(Ax%;81@;Lj>S7B~nqiR@Wwyz@8MH#aDZ(|ti3f}u9cr#E0+mj%ALaaYWaaoYZP5ZI$mA~JBYFw`Q^`aclol)T?)`l$UVB| zJpMP`HlRHTnAQsXhNB!aq!^5 zV{2ZLV$YT_$-mzpSU6--MSP_+?nw^)9%eYHdsFdY&fS&Q;=jb>&;|NCX)og?ag{CG zXFj!vifXDe?kh;uz3Tb^v~v^5J|z={q?v}1n^?0ecZ%L0yY$}H+>)Ag&U5xbLFtnt z82^KzhR6|1o|RED>w>490-&3|IkWY>_0?e$ZrMzqJ*UC<#ZnGyJ-sECkE|UBs9~Dj z;3tHrv^OgYd*ds^aRZQx!MauUbgKW%_jEn&o{3(YX2FbO6PksNa+%3VtA^8Q<2QNLch)>2U&ry3qzH7Me`3Gea;W@>b-L z$DoCN{nfaL=u>|DtXzxyE)>Hd83Mh32?hWa(lJ9#;&DwbaeI{X(FgU#V&8Sk98YER zgKh9hcnNW6?vclhO^xzef?B5K7`PYEivfl2+%aivdhOCkX>)EXyCU21<0qA(gD9sn zUIdai>_=TErvzckH9pSm3}poN8Ks)<{A*uy#IpeZgUws`eftifK3!59z@jBVdO2P0 zE2=ol>*tTo9@zzkyyg`yBacyanbxBp0mWYBn^TvYZ`texN%lk)>gT=ZTIZCIeY_>- z&j{67u6k1+yy>5dizPmvOKOAYD`>d+UDAIC2GH_l=^FaD9O5Y$K*(I zVEi^wwhb^?wC>B)ckHs>d)>s`*);JMh4wyF5e;x@%NBn9`t`+-gq0acs!`D;gzP|v zkkut70Nz2(-YDR{QOw>HD^#fKFP*C%IkX@8&p7bzxTyQF<1Ycl zuJ8l(XheKU&wCSb^py{8XmF0=P8lH5cy@*1Z+hD^9K!s|+}vp+wSt)YdiJA@3O&$flcqVR#_b(Y4y(#ZGB!m8#^p`9=DwaYZ9=kJi*7hs zSG+xO#C#-p;@!Oep0K2(j*dK#41}W&LL5o_CKO zJ?g%wp!D@g$dj}4L5a}QD#`w;>FpK90I7q_DrLrQB$ z{LPb@1m{U_m+Vi$)xmWw6P{%`jh2D~Ec)vUa{#fr$O1Y;#x;jrL?x&J%7r%oRj&_B zhXnyF#!a)(6TYfrC$e^x<6Ncnj?KY~U7;Q}Eq- z;uWprMWiNrchNaxXK#CPly)Nha|r~&=dyxofH$0w11CLx00R6F`;ASCQb+<|BQ8-@ zfH@}oQmdoDle|{`ikn34nD_G?0|uGnp8yvx#3E=0r0th_q(zWXyGGU1woFp^t$yom z!aa5(?h4co64S(<=KFqG5xg&oaviObY|XM`V@z5NelqZ2X4!`KcmMt(W|{i^3{AWC zk}sh8(p3KbbQt@j0&voec#&z*nKA=CG6C0{qXiP?(t{iOf9Wf770w76H?e*@DIkr} ztGZiHITE-H>Yb?e5?$7se^)dY5BR&gk2F-f;tQXR)om=|@K<`Jsd2Se)OUbUwky`? zAUbXt=Q~V;xyI~`H37qmai1Hgy2VdLu(si1&JJ4QmRFhPTvUblhq$T62o3Va%+eYp znAQ($IhuDXCUA3^qYDKIW>L2QjLG&XfWXEG44w3^xE?D$r$`#j1F4QZ)E!4Ah>#(; zYk#Wt>pAl_@v8k(NA$iKHc-15ke+tYkr8s(!G|J7O@5=$XO6mmzTyF$2k4Gq*S^>nkZ8~V|n=PW8U z*4@byU0F{)AJ?fp#8Lz_nDY*_jCw&&`fd4Y#uI}U^Y>NWON>0OJcIg*N3B&)o|(|r zHZwM6z6iJugZVfOjdEeSmT5(XMK0%1j(~QvV#RP@+aHS9s~_JU;aB$5$1hRxsPZna z0%_w&&#hsP48-_IsV~M=7+g_Sm=WC;jXD125g)NQENKq53D>D$Yg5=IxBtC$0(4PwF&N;d!tef>Yt+avq z*1x5jX33IjGxLmyEEaZDA0tAy;`(zr4_+ysey*GXt%EklUN_Laxhq<}0jR-R`m%*x zd;vuYRo=Ghl|Tm938PYbpI&#-O7DfYTwUeuheFV_u5h7r%-|_!t)9{LeU_u89a$>` z*{gs>y2D@6#5C>X<`#V%_kH3w4tf3l->N^ev<0n{E?G6Cj{hIWJ&I zZpw85kWKv@b#{j~j$@#ywcSFs>$9l$8T;)STovi@>evg^ zbP-D`u-I+C%HhFcpkE+E>DMD{qRUV)4Pg)U-49m^09$nRw^$&hAU1=iP>@-Z0>Db*g4S1FdkUpSB(CPcvB*#V{oAD9cWELlE1M ziknNCH*D^;F+$$mpT36|swlEbcI%bE!_q(BsWcBYulJns^!-!usQYhh-& zR4p>?*Xpik9gg!uK-UJC`z+)Uzg%~EoflVE5IY9*(#en+&olUt4BT1J?!>5NTyz>K zC_XmyY3g@l*PBcafrdn z_*UI~{IGebTg?u0Oe>&tm64^_T(Pg>9I5p|iI~=!!PHjD!%;I$SrbyOBDS{^SL!ye zkOO*m}*O`f&#~gK@q~r=?-_p`(?~LckQ$4V$l@Sx~5xc+>pm9b|k` zKGAKwLT^^w?D4k=7*5ip(DCE278bJn`;Eo(dugsW2s-t9K3V#$Qzfnx?Q;rNpB&w7 zUH*KW?ELVyZ!4d>H-qs-cjARWbr+EH)Dl92s(6K=vyu2$RY(r%QJz`-yS5^ z;IdTVUIKAqg1jAAsNk<$LG{)+AAB*ncJ znl>Cp^XeQNw;QjC)NV;H%DZHA-VZzQ`>Dt76M>x1=R~n);mwK%;2Oa-N~o< z`NaS>bn6&ze|dVqhUDs702kWr_j+%P=#=>WqOXquZ;5-6EXH3}1cKIxM;gya&84H< zN-2?ADruAm^47W1nLXasSeZhwdRMBv*6Z0(u36aoT;2BH-v&fjgg!g-IMJFR4qAti z3w2V`x$wCMZ+Sb;`KDGrsz;B3eklu@%F64b;1!lm%ARy-d3~xvOE{p8t^sU$cFi%V z0SOgoUYv%XE8sz^T_4rl_}j6+=&_e>XR>~>r29*9w1_hi}!^o*Sj(lW}r%RLeSdgDSR%L3z%hod#d`~ zd+eAzAN=-teGxZh{~3DJ3!_?uZ!G6*$l+5CFJxq1Zj#5!0jzAV&W3I!jJtZfzM1_+Od)&g+_a*{*n%tPs>N$J`#!0qz4EB3uMa#(>`UG> z+Lo65s(Jna;HyBuTe{LlaRK*)>-rl=? z``F3X=L6U>@2}RWUw!Aj8*x#qhU<~arzh&C?jC-0>d+f}{!!xt3w44jrzMtGK&ux} zBjY$t%y%(=3+0qF5@4b7pBq8hdfQ{Xe9@Rb(9Wn=r8+WRgH8009kZH;qG%|3q-lM`A*1;)k4182wmcUz_GKE{LT)>D+GZh}g(oGvsMPTIxsuz8 zq_ItZFl#DmGC}qXHaCpR)9@%+7`*NS_*J#n3zc9mc!Q-E2ywopYc*RMn;O48jS;RS z;J4r@ds!JD?9jyn-)rWGdv?E-3SC25#(m@D7!F33U?Bb7c1{R%h!6Fj5^XaeQ==8htJhBt0}4GW%dR*M?p^bo3-}f$IS#=KtV_ccMqPh?SPdL6)mkdvn<4 zFdlR65BDP7WD3V&3#wG32ke%6O+y66PG3e-p~qJU(mTeLkkk_5>2H*rZ+ZzsJnAp9lmfh?@A8~G zso;Y0PlXR1Bg0u6@(gtufZtw9X7ru^N3BK7z(nKp@2h;==5q_WuA9c6p{sIqcz82w zd+>+Fy_*T+F#MIBapweeE8jwc05OT+RKKxPy}7@atRNAG?EgaPWlNq!N;??-ym%-CXU?gDZXLX!%84@$S33?G;IQjpXSSlnbxW zM`THsL{khp*w%aD#zN_*jNdk2u(Pkv7)@`O`=sRtsOZip+S}Jvxb=a$g$fEwvNH0# zt&OiKtbBHby~Wl62g$eP+vgm8Lu159)$F3?<*-}>;dWal7@%nwkP~Bz*TBfe2_AMc zM=a?4(s?ONz;$IeG$uNt zo`V7_CFf);+`f0O=lA^-iyG_M2TXz4Go2zQ z-92aeb=0_2cXctY75G|{lV+N@+;?TS?^}f+(R%@z$(URQldh@Eu;s9AvxQfrfhI~v zCabVVvYOzzDZc5?Gpa%8@3v%J(G2n6ahQxPJcBoafEFC`ycv3?MLP~>X>pzCv%z|<#-K;7dhZa5vP5iSh2@ao*Sh%V1RbTKDbO81&WW)@kz z>>=j%pu&H2EdPG09c7tO%QbrZXd}_u)$cJ;ou!I&cOvq#C{orXZNAcyKpoaS(b6Vd zcoytd>|_={lS|#$%ilofLG13^+M}jOD115ucXDHgja|e$l3&Pag;5?8dqSU&V2&zqsNc$Xj=*pqpHBgin{DUpY2Fjcb!GnX;@zLRt>zRE83JIf zxOXKch@Sq>^-aZEOtu)@`x*B%r?W*SSd$roOS4q^p`{rkRo~+5tRgiQ|2h|mv>pVQinRP;u!GebS@6XU3L6il}&V8 z=;{^JR}nM$#{(a!B+IS&-d;gARFky&_Pe5fiRtcyK8MU1 zzJ5d>{hlodC8X|I+{hitbxp2N@GyJMm#@VmgrtQ-DBn1hj@C$W>(z{==8^81VUKBR zJipR=DEFGldHdnM3U-r+-@#A}r$A6FeP!W%ge{Y4f6R*FMrrp{M7LTav&lP$ONFTH zpsxGNt>TAIqZwbrCG9&BMZWk<8cR^9rmSv-iaYR?YETqty{uOLFev9@dxb75Cc*|y zy}{kWObggvl-6R1buLajIy!dHX=jsY;9V#FrwIrSZez<3kvpaKhB|^2lGPqUz=3=x z_jCOV&a1P*vcL9^ib!~%m*y@WhG};bJoJX+2LFR{^p9$0S#xMqm;R7-80Qu~ZnHHn z*=TeBw?Lq%niMOGvIPSKhTL?==F60<2d_a?I@a|%&IU#St$nHYSRw^KyqO%wCgkoB z7Z={qW-fy>3IcQ?%l9nP_nbI{l1D?qWnjJCq37a|!kX5q7ayhz-*7auKok>L$Og+< zZ&Vacsaxr=*@u7^q?H82V%d#9Lg>lq%ML>_`<3WSJf+E-J>j_S1flGAdfbX5-i5F* zI4am#3gxzpwJ0=c3Y3-+Kob@Dz+STJ9a7zKkr=W)ua3bQc;uc`aUWonS^Cvu57fLx z<~p6@FjZ!H;gd33+l9{$8Pq}R+&tqq%*FBNYrpGn72vatkRlRNa4qM&!op6~Io-9f zSFz-|6!AW1H{n+CFi~yS32W9Q)U>#--EWav7=n%wm0m80IY%>39c+I4bT7c3@hl6w zB-T%%$f4%Us~KGHa7e;aa=vHUtv@3_U3@6kQwOiCqV};(O{hk9sZw?8u27%>nxit2 zZ=N#g`9aPr494AOCKk%x>{6K9s#=h(Y-mSPD@7DNbdgD@vJDO4rnN~*$Icr1*|TSf zlLs(Y`BA>Ji)URw9p+xfbCt*r@;*>)wwr^p{&IeOCOFqh*!mPv-JjH6~k;Ig#Y*{VI_MKo7a!Z+HpLX>va zwv&IWAa}O|y)76LnE;_ffsynr{=oS+fz|Hn^`#RS02>Msa(ZUdRDOGh{yb3^#9Dw2 zwya&>068pv2Taf>>lC^<1p<3x4~+IrjNjUhJPbeX=%v zWGhBJORE+aiBrJlwS|&(9})&)MJtDI;t(10Sm@Whg`#e=YdyomXPK#^WEPAChG`vz zwTKeG`YOXot;DgCpKN>?ol1qsw2M?tKfvXN08qTg@K94A+2;u)LA&rq_Fe9C!`G+J z#~ui2Wg8e8YAR_LQ6g&(o&Jvz```Al;}o;dlU0_h0z7I0K8}i%C9m}_q0tSL)!?43 zy@`72S&HbeEXSf|5SF(>yP$UCwK~%i){xd?N7qtPwG~XTEi3nTY#H^M1rj4^~SyVw?;=@1ejX)@Hf z3>-adJ=wV7VF=m!Ja0@8#h)juzv8D@c^44R12E+6VUp{4;4UriXQaXOBlA)^Sij({ z`R7d{4al6dLsQw+_JW<}msBhl4_$eXcs2;$%`4P^)Kg>J(N0UY_%q7aKh|Zra?-J5 zqb`fH^HRq4rS{{k(YE()Q+53a9EK*sHAB8F&5OoZQA5c0&s6Df2`!S92)0y*e*!C4 zeChEbF$bP%Qf-y&eBEhcb2gq8nSMNl&g3-TLKEeEGluo4pb;TD@R7w`HSs z2|?WEl`sz<$@NN*lf$7;;$_W4JHGN3f-K+Ud`OX#{6!P(vMJap*(ojDSY1iJpK|d} zI-&oSs6#4*AL{9GZoB#h*vlv}3pGHK$nd6vt96`=y`_Gk6OuYX;lmDVH;NIM5WOV@ zS>LmYtJLE4UqYu=WFZkv>zwa%RCn@YXw2oUZ^KC0@;Ps3Q)i3*^M?5!JNx4Y2^;1} zldgmVm~&DtG2mPY^w!>fr0!Hgx(S$63A9U5dk0p^kXUM2fQ71fciyJP0y^WerPsS_ z`I75YHGzB6RUM^8VviReYyfPMc{19JbdrNn?&d-)5r z=^Sq5XnO}isxSW`{_OT$kk;)uORfm<_) ziNif|UPm&z9xXn0e&4NVZd08ev{B8T?n_^|&}#puzot*36sfopPe8r@{OH*adjJsw zrCmx{P3^b;@$UXyZQO0~i=X=+=S1Bv2CtnafLU z#bLMqq6HKK3$OtaMYF)WyuT(>6r2KZ>6r;x=a0)_|If$iXGdrhrQ!+)9oW43-_rM= z_=iew1GlmlJgngOOZL~1#0<1dG`0Bye@PvCSAH0{)9dyVh_f(n#-I37{%b#gBjD;< z`2UZQt)EG>?vx=k01q}Ba773ROT;BS!=vLo~m0^uoN_FA;p`fIX#fvTL$|Q=1T#tRO!?Yg!G{N3wSlMrEBPyy`9BV(&bJ<3UE!RmZlb)V6e<= zJA{!`CvDHTt7-#CQFzF5T@;PaB0uf#d#)T-W?1W|q+$mie5$CBxrdM(^11oCqA|{j|&R8V|CM;Ea`G`bDpWs{EAnny`;WL#nk3Q?= zo+x$SgWdh{`XtJkw?|sRw=#%5k_yoFuK5zL8j<={qEzihW7(DSDJ7JR8GR>pSI*M! zv&d!-Joe7C&QH_CXpu^Dl#i>gr(U9o7EGzqJqTEkkfq7LzhU;7DwA}yVzBs3RaR=e zNR!|=C4pPd7-A|GJDRMxAh@_#f;Mr7Xc_9@?2$PtiCxT8Rzp0%0sfI4T{YghqlbhJ z@7i7UC@(j;=e4eg^saUqjf7m?osmb32(Yt9_8JpThIyot%JZVJwm;2EAAji)LRA+k zC4Ad9!TRGia~)UyXH@>!bQOdn4$+VqLijGuVR_gE{P__hShdI@3jSaZPsH*ujB z@x!~>7cosD?b+xe^uoR76MPDHE-l$<*Ly1d{f~s~h`i1fcVKzlh12ze1Y{q=+C%71 z{K-Vl!@AcXmwb_E)o>uv3JPyF3x;jaB#HXN@3_XV^(Fe`b*elrSwrh13-e#>DIU7w zyfoYe^-JXhIX2(bqV9PwSA<4F7i~jV-No%w_5`}^0OncZ@bJS6 zxiJSY%yB<|w$YC&a7;$04_;<3)XwzZT*XBRBesD-nZp$WgAP`RunP$ynaJ1EeX+#1 zGnKX)T1uta1IWb9w=-zl5wY!ZX&?Xa(a{}R!&LQN?$@t>#|>U(DxKIlXX(fhf3Svi z`r-jhlVWf66@`NZNw2lJ(ny`Xplc_h{`q+RQ!4y&;nyDgs)MjuhEJOBiM>qkYya-k z_pBUdC6Na0<;BWPqBPAVn+5Og*qH>GyoChJl*f)69bIYPla{&peOm-0zUch;{N@47 z?Qod*^goKOSE9-S*%Z+gpEjKBh5AMYPu6AEcWIM0(Am>v14jSLaB}pS3W5m6CAN8Y zyx-a@AlCLXIdcBH0d%p4l{p)D_#u0%poKU(<<^(%-SnNbLe2Y#$OVjIEiw->TBHn4 z(Lv_qEYzKuz14ULMDxBwU24mpZVaYN?Tp!whOHwybE+aw{5TlZYL{L|R z-h%j%gnquOj@`^LE2|MrTs=ld?S;OV$6f$)e}C&~-WMG9E}@BQcuPH&=6E?kSayV`A_E;)ojGdlpgXtWjYEoX5w;d@p-*A zVjNrCX7ZTNQopu>lm&b`GVu9c&0f{oQ-Qmrm2u(l0#nBPbhHhD7CuMh_gnkAOBgQp z*fGhS+upi34Oq}?tIQ|)TPZ6Tac!mLSGBa(-1L`p8qX`&%8{C3q^M|FZgqvAtk=&I z@{f1+F6ih3G94{aB!0Lo&^&o#FZniQLjvPs=jy68z;mnP6$!X8F#j-_48|033H>m@Ps+=AEgN*)3&<`H&>kmfO>?O<5UJ1w$ z*IF(|-wVjT;n-vCK`RGEZ@tF%>H61Id7GPxnT0-RpJU9Y4!dI0`mHT=9W57>o`rIQ z%bf1Uf%HCFIuZCP2(S_+#2*_t4cwi3C7sf|*;p6Fuat9kg0$7&J^Nc|SX>IU;=Txa z_uXx2e9+wZl&9(L9Ef31kSnP<7udnzi$lVf%drtbecv?2>vRn>;^IK`g$h5)^8IG_ zFLcTsK-KwD&r#D$RJ-lR3Hkw<{#BK=4^iRoPhh-(8Jb;#`$0{mB-?N0L0w+%M0|sr zO4bQRN{UW%?QwuCF;#PT%Eow6?S@A2j;Zs^G}jQ%te$D`dSh_Y$Xu$C@fjBWs^H^% zHLzm0AG;@!dz7mS$vSsCETDYa`Bu5}Ehd-6jI5k= z&C2^aN0}=gVEf57E*o0fn_*MaSRjePlctX|EnKxr7jHqW2n2p%FH44 zZB~AJ0oe}i>`vK;sV^X4r}bCmX@z0cT8yLp7&}DZnG_@E{P`P3`iuY)AsLulJgJYA zF#}NqPM;#-eS@hK0z=4jY%d(t*m{*uAc(TliM!6{FgrJvY{SFR@{{OQL7n+nn?8U) z@hhexUaQ7EvTz}22QpVT6A#XRMk=fryM9D^QS3SQ!msHfn~W({3h*5LfnCEGP^Zz zhvMQ}w?&tYjML-k*+IGX7+Lzps5(=4(B4)QFnZ>JjV#qkxDk|trjl~`qm3;51>?;; zTY)CVdB_(g%{6O091Ko(wu<@(*#Aka?*B@nj+v~aH_{Xa&rQZ_uCAtRv5pCl+ zm}VxHCEgU*npQ3rzx{K^3$0Be!52W{b2`L*$!oqF3B#a?(|0Q2)9Y8$MZk;ge)RLjwdjJgxJ5Wr6yWK1TrSNb@Xre>9ST81+VQe>Zsc|i)r1jH}NSu8b z0(@VgY225fr&!a-Bfupj;ntBTKE2?O{$eg8Sn|k;3nzgBDambOJ86w+3rny-2wDUz zWc!iENgEA|Vcd%Xn(X`+fDET^g5^>nAz*X^Q)T+@^pyYPVm>lC$m+e0htDl0I)#uC zfwh1uDL~<%eR0oH`zcLZ8}W0SowAT(h}C2lihiE6Nv9=$f$BZ(gKh0*gZNE``AxOv zZirippgLr&)nSS;!VKDK{(5w0*fi~`B*jKUd;Eyy0f)gX?B9h|FF z=iHc{vqIh6=7Pgi*c_yVooA6C4$6Rd_ufqo`kL#0;pbs-jYl23s4cg^Viy^DM3ftA z;boBJj0)Qr^I|+V_a#UH4c7GqS~`3sLbP(MwkLZj2vGKkqIA~AWAG7!*bAmZz+EmG zod>CH=W)jSs>TKzAh^9o%E$XQ*6O31s*0!IyLVP?)%XQiny!j8KqCi@gvYZ+HukHs zjsrGW@BY`|gxUxBjt>Xy zbo|9)y;rB(#p_NZG4y~;p`kj@fNWlF4|yJ zTr?pnX)(;1EMSKv2?SGL_z??zOPom&&5QYkraqLi$bXY(4XOC$^=(FSF1GX8h`Hy; z84sLmB@ZcZjxV_Fw$>+>-JtbGp7rHW4&fb95yjn!`ZpGNwHtjACRKPvvM1|l`RR_* zX$K>VG^{W~j`}%t8W73}vC%)Kb_+o3UCNY>d3+%l z*a-o^6BIZ%Q4dy3*F(5lU+|t_vcqL*?7eMfs>g6b(c6ZlK7(kL{(^oiyHG<-nM+Bl ztY$uWBX6X7@kYCdxr+`{Xn#PLl4wQ$Em&soq!~u8*Ci8NS>*9mr)ytgTUIu5<6lt= ze;^QpL;FpEJ@yu~i~qn-C6rKtUtqEa$unx@<`u%ZalxCY6!7siVc1^4C8c-EVE7WZ zEPXL&>eJOymaOHfdRSus*i8L5&%qTfDp?u};4$Z>g-mE1wo!K6c3SAjE^Qe~YVc^z z&{qUtvQqWg317O7*z?@<$E+k_n4?wZ7QW>e=amNexpaX9h=<)EKEJR+!_0d!I^ydK zz<6duof;*kY}4q+uFkot@p~Bai^x@1=S1n%oJe0es7^W<8{a0`UryZ&4zwESR$t60 zVuBz>8jB~75EIbF-LR z!LUHx#;tBS>P+FxAZMvNhAY)~McyF}xm&a2#C^O9t4uLcBB8c9g4@2)0`9Wb3&#RN z=<7QpzJ7{tf=*>;dyXzRGy)&5Jmrw)VJayH+`@x@HNG<}ta}oWHb4E~JM4trrFCM2 z5SbrLF#{FD?;~OhZ!wyA?yTbLZ2Co7keUf%sh z1lkFgUiUu=`EM-E21XWQ4M@Q|%m1>FhREw%wimVuw3zxQRx-%5B{@SYkcv_nQ!;U! z6x+FkV_}DK&!=9d8LiKEq_tE6=(z7r6Vx@M$d}rc& zTd&@=iBV#K0LPfGFU%FO-Zt28kdaKBSV->}9j%eufitjE%0;^)28}E-2`~-p6B1Ad z{1#uRy$@y}vhziL?9l(hUA^l(3TUh<+@25w=zd`Sr@G6}^&YnOX^I=T4%*^sd{_D5 ztF%HtVrS(vorPayhp+bg+v2^&{Mqfjy*(=JQ$F%VyBNcySjTkO@dNvNHJN*?CPJ|p z=KelgVE3Qv2C4TwRG z+UjN<49XZ@mym^5`l(xo%+#zVlIsoWBr6sjvarsTm`SR$2IFVda!g@SfLxinLBh^L=Rqfr}zYC@`z)z0qzM&MgKDd;m5DlL5z* z8@HVZRSaic=|znG z3FWQl_FugK9Q3G`+yn;1wX`A(y=holA?lKi~78=D&^pqJd|t<+|5E;X%9#k0xIcart2y223so?S|X z75z70()C+{nOs>kpzd?$q=fI%$U2zlIK%V0E~Wpfzxrdx0X89Jq`pC;y(iN-!LU8P zU%HjZFM!N&>(Iz(pb#cc?=v>)&H^63qMgWLz9Y6x}V4pOtuL zkW)7>@l{e8e$>M*FK~B!qg|XwNL@0HtIK!4$jRQvey;3ZF<-Ipd=can< z9yf8?p4!VW_wl*l{slb}196UU&1RcR_cDZi7%|+}r>kdP&I2sVrP=0F&7fPd+>pSB z_;@!MWnD+?CBITY19h`IA-p)&$M6TU(ILnjZkGuQ=Yy$xx7>~gT6`W4AX{GN_h+2} zzWin8y);~GvbNc)#&?P^YExOeY6x~a#d2XcE%B-XPbw5meu)!641Wc%1SIzGE_(-B z?oHP?>r6fp-F9%XFX1`>R%7M?CB2#Na`y)`T5R=(eMiE2g2L)`?`SoFAVrQKF_~DA ztR9S4m$H;@)x_m!MQ+scBf4EE*U`jpYs%EM`YOr_T%+Pu6{QGglVpc}Q)#|lnm_eQ zs#~lGLxGY22HmNHL}0udM&pVU9GW-k1B)UfBj0@65JP|82n=FfM-h>}%~1+2MoWPGQ>%4pW$d; z4t}*VUNh6|xf(=jwt(xfPN3I~WRI;0Q(_JNbsF;u|FRs6u3l299DAHw5@45IPBB_R ziVlJRuvM}kQr2_ZZaeAGIR%&tf>yB=V&*g^Z3uC-KTh~$Q&9D7likr#V>uhT%DULOq6~*;(9eth3w*HMxoEw{wJgzCvplX|%LAbrS@r%eyz@U^ z&uHqt-iLT(x3lXqKTxk@mG8=gC1m9`ptpg1>y({>(Vf44UFh1(vM>I{U2co2D)i^q zPxbm@e1zLIgxQ7I?B%!CK3D^8yjKQB=JGPe!L;Gs6kY?j_u79)7>UF~Clt0OtmjA9 z4(^Dut!bVWu!V>i%dw4vftISxrHj%V4YV$AidSlgfF+6@xH(`~Z)7j8FiWB)!(uC@ zWJT!s>a>pXiv&o3V0ysbLW$369m&F^uFSJ1gr(s&+je(KU+s{I!?H-rYOi&IFTr(G zCTKFV48V?b0JaRIcbyXmo@zY{atp+Z9-hqJSR!P!6WD@XiplotcuLG{DgLuh1QQ~! z8>s0rBL^@8R}Wt*s%g7kP4Qy*DN9QW3%N+tiP0AhlX+y4eH=5b>_-h(rpRx_UuF3$ zv|nAg0IJiy|8-8>f;;zNy<+3#M1-4AuDT!g0rb^(vm7|X%)RBE}ixhI5hxSQH zC$C!i9?@=lp-|s~g#Z-QmyoLUDUQ zs(5IWs0G`N2JK}nU8%f12M~%ypN)6Y)AduHYO@L|#qA`n24Nm{W}HBE%77bXz|eE$ z<>igAAJkY#^Vv7``H9s{)|f|(E?h#Za?PBIJn-U8qF12ph*!x zH1tYZez^@Kq5OCm9S?u|VZ)X0BMuCUA@2n{qdNiR`hDH)0H^z*sHiAgZ1iWdijG0% zgWRScMJ!ioBm&^HG`D@G)u&p?%7OoMK}6{xNftw%@iw0>yx{EiG5Wmp^__9XmmA#- zg}s(x_t5PWKKk#+IHz(_5WK;i{IH$qB`e@&Ud|NPn+MtBuwVOW2ePwmxR09ngT8Eb zV-m{?4Ms&F+9a0PcmqR=>az1f$8~?ymmf^XKk~po|DXass~(L>r$kRZwiVmE2oSR5YMC z{gAD9Pou)4-$0AFS<<5IaY-nJ-e09>Y;FIxC%ln%7~2CmRN$sn>lCWzDp zS%?tWXVm40;dAl+1o&!DKcI9ibrGI3b26?*o6_2m=$C+#uB&ErXY`*J{f|ihZER6PRS~dq!$p-gQC$U&eCaTXTc-^{{hMMQD-DiZUsG{e(K|8 z4&fm-wuMR8dX8IiblNI|E7_D*w{d<2a6P9id-c3)Y~z1QT7j?15M$2Q0AH&fvhWv0 zyJY{ndSxKRYyFYnr_BTMvfE&o?IEzXRZ}Gq?Xqr}GS&?(_LD)XhGv&4hOJB0=U#PV)^4XVrrE&50ei^_<~zLW z&7g6^vE6zOkcb!$H*iSznD1TZQ-Hk^Gp}j*lwa^x0G*g@bt?(-!4}AAk}+{6tT@!RMp<4aM#?`{DKF-G%S-qYYzh%RjX%+F4#oso&-avX=5&onqo5*n z`dbVAxn-Ij)!@d1)fNHdxT%^yxW(#%JTSHu)R7Ob++gXb+go(D!|_}fy15p{Va>17FRs^9#>u)2(Kb}waqp{1zn`^ED{fYSvgxz~f zRhw>-0b7aR9!kvwRnNo=p-#}FMUH#6FV(=E{HNBhYUUSj_4Olk>_-k<|Cc@LKhq?R zq0B55Q;?PJZF z7tn_1IyL~gT8d3Hc33X|C5)WCF`EKy+@GSrq|8}wpPG;@ui5*%6v*qtm#Z1JbB2(p z7viOx`FFWZeysp*4M@FoxEH|n&eK(H*_Z6<$6z=?-}@y0Y? zdU*j20I|>0m3UfkeFvZC3f4lYzi+_B+mDFl73h2LDF(r^1;-oZ2r=Sp&Gb2fks5zq2r382>e zX}}C2QnV5;)~EG6Yyg<;()*o1diTTab1({L5(h{#yF2{tY%Y8h80MsxZNjRhX(HyV{h+#8T z!*6`uXYcs|^hm8O0(g@3Auu$daCI=>sF=Rb03e}zuEolw-0@(yk&?_l9&NF@rI%+B zUl9J!w-y|zpIvD8cxBRziW1W>@$oj%3IMF!*qBf2^q*>YvECmc9=T7_6}PXTmQU}` zX07YIGl6DoAIn~&^)(FPmQL;$*#ZS`$5$B=%KSlF>s9n;ka#z4)$k(o0-c3a_&t~0 zn>#?GZIr5J3ixyd{ts=}9oIyU8sD?AGx+Qf(tF(8 z*&PsT5c6lRwmGU()KK{oHyv0|XKF`$Qsgn=&Ja!HRxbqd+rQq+Xu2U-Tvms zlJGtjv{m&Pu`g;_^rCciw)L%nfiuT8P=C}sr^JfZt=akc68i%yAhUa8Vf65c6A3SB z9E44GCn6qI({HO@?JARXd#3~8j5n;^n`d)~HANn}F3nv5O?@(&p%d^pT#OM7ScM;Y zmgI=~TuC>dy_K4;)KlZXRNJE3fZ7MmOcb(-4RZ}Exs|U;xoVR=}X7#3BFFipK*Tf7c1PPDc-3Ka(K`_bH~MI4q)E!NgpZvIsTSV;leDaS_ed0KAYTSpB9k)vW`}e<8siD;q?kWzj>uT3}l7Zmt{L1Pac_OD< zW990ap$VPtJ7kJnsu>tu7*zlKQhIUE=AvORe^vCxD;zp7LWBOvNXM@L>MIGKI&xoz zn0W47)q$ALVQlr-Cr>x&s}zZ%z7kFQ~&#F{rL>)|&AAqW?V`6FEE zq*d&Yd%kFI^3SB|tGXAbgq+uC;qbY1z>0hpzQk+V&y`nk_XxiXr#AlFBST|(zHHLT zJaxVLRzx2Q>hb8K$9ofZWSbO0y0}kf5u+K)h0celAY-zF@u#?Fds4HkSaDo?QN&|z zT}3?5(le7@ZBpUleQk$I>$^VZ(wAG85*k~E*GiW=)tu463kI+e{gJ3V@DUc5_E-(# z{?l3Jd+cwehFhy{h^&{q(LQ45`$pq{XEp7%k`N>DgaGC-jI~JdI3$J$!33 zV?^Bvgk5!h{}_nPF-=wa(0V(n@7g#l@}8s>c824~Ci%t}LCn!%;&9Q1nxvs>%Ga6$VA}6^L^(8YN|@HHgD_hsXG^!LbwWce+HjzK{$WT-32Fksjt- zA|^g^RmFLH+b~*9i`brvxR-g(N?|o^A;SlhhHUaWbPs(E6t>m*SS$!NnU=p5VZhU} z;6Bb9dM`11)qdz>(nhSo;oY|k9}R}1IMj|zmW^g9bORtcpEy<*2iFve1&d-Nj&ua0 z`bYngi%!q3iwi8h*)PiFd9Pc-e3X>PSQ#0FD-* zK9Xca?B!*)TplL)TYb~5fl+Hp><3QOP88r9_5=7A?@_c!kJX;th*xDo4FGn<=CWDB zXp0=;jea%hey{5PL0Kzy1UqnPb@+3^M>WGc9HMVv%TRlz0&s_`P>;=rkAM!?WZ%qh zRnHW4iTMLy%55_y2dCAy37EIimx&vguEUR0?Yx25S3kf08hMQwhi0&zpPj3aBErAYCTr!^IO z56qvQXP_(t2RK-Kuh{bOOKOv?ugwLk^Fqj>0>dpVqIUP2|H?Bn(G+K-zKTcGFpu4% z0{6-Idqs<)$V(4x?vL012s zNt7#oZ`e#vkA82>3;X-84CD!6zn-DnEN33I`Ax=MnBr&gunPJ$xbBC*B6x`sC?|42 z-^Yi8mU0~L(*QvNsW4HIw2(++RSg}Q5{}%yU-9KX5bM83{Eu$&oP87}p!^ETaQc{s z<8OZN_6=}jqYNHM?FF(Bkj)|eh1A)%{44wORFn|AUZRg3{c_tsci6<gGVU}GDsNtRc zrRd|jsLq^+adr;@B$qD~sDA7{)58Zq#CM%~LS1>|qg=;alcSAF%#yIw1JV++?ouCj zU7nT_0dS(AkmHJg&cf4$pV}j*oUy0{0xm3DxqG1y$5C+HdV%oEWm$z5obI$6)*JiZwD(PzA z_e=BhbwA379j5+=db@>)=1D$ynIA<-73YNo8!2v z{Qd9$dUV~!rvNMvh|Y>utiOL;_VQD%`}>^&jzI?z4-XHJ-(3U^^83{+)s{?5r)cD1 z`o9nVtvCPv;rY|xkr8d6Tvt8e>Xl<3xB()Ux{(}I>0jg_eRtSyo1da4*zKTx>3&Qf z*k5nL_oNGC6#gO>^F_U0&Hr~)lOh@5QK|2e8UfYxA71SgMR1r8LEA#dJX zf72biJ;Cwr-IEo)d;;l9Arl3}ZWQ^N$_3ydiYiT|`;uXm^}EqI0Q-`D>e|4ltQTTVXZ zoDLHt`%m_N`(q~%i8+eqj*c63`I{4BPC@^{){H-Rl}-975fPD1{Cx`(L_i$jZ|jz* ziocI6c~Wra>~EL8TlU{wgKgvQW53CH5m%h}ZC`%(fW!}f2_|Avx(scz&zBgiSN~7; zBl^+jU?KQcR#rgC0iSAK3!-C;?*H*fVlvQMMdRz*8LZ?FC;tC<_3z&Yv%wb>6g-+# z6^F%{|JZAPw0;u6q{^$RE&}tiBKoh-%LRYU%IegvTJ`AXp#L&uu*OI@DUjlUC|1)y zGW;F#{rk%ee$Vo>X!y)}wo920-L?N)2LAH3x1 z@vc!QUghTpN~gVd))^xIFLOrei#GQ5jCJ|RCVKHR@Gt0R!Ds1`+Karu_5$Rw_8P>tWDP$*^+z?-2jg{^gHU zko=SToz|!G=>N_yf6wiH$d>-^Bj98Li;9YGTHEK{$dB~{U_7vL{Ij=YnGoH^g6H9~ zLGb_sutehpw~?}Zzfk2@~f zQ>r$Tg)jpn_jWg5r=qZ!Q1(pQmO^nW$bN-kC{O;lf*a4Od9MGGJ zZex2EE3x|W=JlWN<&W-8-F$ixf1g$wc3j@1>HrSJYBYDn)?T6zSwJMc2D~#PS0QD! z3M2QOY#m2j@2mlNc%clSeJ!)WS_!d3hXfZFmpID74(Wd|Jf$ai{LcKgTuV%ij6WLw zkFMF2o;sMQ&;*U_O8b4rw%26U!J&L0PA{ak1>c6%8H=%EY2hzlXv5xoVS4mW1Wn?3 zaNG**2779-@v-TG^+R1Fj%}`s&R@Y@(aXw!2_Uo{=E649d`C|9+m;9yt@3r9rLl^X zH@<4Zl$?I%$ED-%o=em{H6|(obRVPCy8OMm{Ik<{Qw99ygTS6^FQrjwx;9&~_Q|s( z=eUY^*_Q7CJu@j#-@beQ|2=kp`rf1S$VY<*lD_!$xIM;|$WKMe;;tj=IgK1)C6UN| z>C?sV5>sxv>81!Ip`d!w24{QK?;NlnshG-F#Egg)1W=Zx%-{M13^X;{MsrEZrh7mxCmwdwsN(Ud{<|-P0#dk7}R||_xjT) zx)C*_!93Bs95zv)tBJ0F^T>2}-#<0WbzCq85_{;-BGzl$0#4MK z=h0s+F*isY#2GH#b)D&Oj!!ULtt1hu<^tN~p4N5r(H%atqvL^{hHtHTXzhI_c&x%cterB009ZJ!RfaZ_6e`#>LV4X4=Zm(0#^I^P1iCCe*uy(CeTQ z24&T|upW07-#w>#8PD0-c_W8C)(HCD<)12h3mJ8vQruftKlhJ}Q=vC&178#nDDB+ta8}#L2e!}=% z3ro88Cr?{j*|{}$hD-hYhu*rBW7rvGu#jtYzbFDN-&_YWD@YvUfzBsW}c3Z zph6SZsufGdZLu9aCFU$@v;TngCia}2ou9ujrLnX|O(SzWhTX{xE)M9ktNK=`S>>1= zIaexfVm_El^DG|O94e4)arub;l9H|&_q$p5eFUp1C@2)PHc*U|n5#T}=j-dsV?Cf+ z*3@`ljzW%==s<8d+#Ha-S2(gtJg6r;R4YgI`_(+on80$3Q`6HAUm2uT=vZ7j=I;~l z5$$3yA4Y4l)N`LawFIbL8P65b+|k0(Z6GR=BN1!1j@l|2>F4*VbbIsmlrSA)0huvs z$rsztKvALsiRCxH4uA#fRi4+96)dr=Mn7Yye=-TyKnW|WAQ$zR@xrfmn zTs5Vb+j}AINKVMs$D79^SS4-n38=)whvNDpOVXVx=Fni@#|l1c6z({mQyYS@kdTnn zSSg~jIF)#iljQ5pfkcvHF4A`c2ft^V0%S@?x0X5JMmFbFCscV59E$^d=uQ7C^o(5$uU~G8nPHArI5c2 zr0P43C@>yxM}CtgM;wzvudcpcN`wu=OguVyaFXx^4ik9c;zdTpJVIlHMT$%hIGk-!Ojz&7K-q0Pf(!|50V1szBi78N=gWGK*WyI{db zt)Ne0$rjT`O1MItR!0zfds1yD z_~Wv{vfsYF=x^;W{Itj){NaP@-dYudgIY9?#ZcV}>pEzE*H)`?n`?Y+ZuJI^6UheP zPKB1EPFe+a5v7&`IhhWKA<40^F`{;U8a|6LCS_&ex%KJ#CuwpNelQhTx9vq{5C}AX z9=EpQ5gi@f=&6;RuN>{P+B5u2A7Fhsngve`vMYChAi?)#Wo7l1I}zn6vPOHGa8wcb zOA)eFl1bx^7{81RU)=51W63O=w*)bLW*qWmT&$3ytdh26m|D@>l5M2?!3Xnvs+avm z0bTFd_YuO`pu9`eJTMcz)|KJ>78ON>K`7%L8fWAL8?p=AowNB5&{v7Hi!cW~(Al$o zcb|Q`v}gNOQK0}?KEvkxm%N7XE&B{_em*o7j^}r3ufL0!CMUq(Qx%wqcOGYR zN3XHn<|?$(ixx-HWk@=+23XJ58{YT%HYW~r(O|Ofif6ob?V37-XspV)`J_6|dk=Z} z%)0whnnvz&?MCA=;9TqyJA7gc-+rIqK3<|B?{V+-m?PSAK->7)B2MZ>>#Uzph?Pkn zCzX&z`LIzg9fdMp9U|lS)}x2VFRYAhEpUZA49}ogberoJ^m&WU{KPtj{4`DG-(g%d ze}F~8?dl(w2?4$8y>}P{u4<58VP75)1POQmv_F^N?tA$Rgqu>o!mNaxNZ|exmEQLB zyY7?KuGzioVveu*C*s(E?!cze@ol;fd@da)}omIRnuIqP8EGkB(sttz+@R?-(U=L$f^ZEtMJbTXp$+SzA{xXPM8 z`Zg}E*J9s}8KL6keZ(O8OySG{1CZkS-LRI!n%yiB%+NWuYHLjK*@d1tJC0)=_TO>j zg=mRk&#b+3b(!Z&fG$m1CY6V^?z8?~;*on>6QT5?l{%{op8J_hH*RR5fM&t!#$sCr z*%Mi6@~)_e;ms9pMR_16KWE1pj??F}8p&B^WnV89UW*(Ws#iZ;RA!uuFPjW;Upoly zPyalt@3BOYOF?bxwb}XO4l3_O7y@{ zqjb#OX|nHvCuY+L6^93l$8iCwU{OEal`Dy(s@OzH4XxF@OMR|1JTR_{jlrR{o>+lL z%6aZPDMz(EuP zNR!EOw0J-gG+KuIIA61au%HronV5&Js?O)J?9pUaNJwAyr##F%dD7e4d#;IrQp;ZT z*@U~by#M76N1e$w%sXg)aP{7RaOJ@$Qhs*Q>o5Wk=ZkJyIG6o`rMt5eRVX{gw`Ac- zGD=g;AdsctC5@dA9mg-uRUT8fjZr8!U zQJNU84uUo}Oq2C}=*S(-{M|@8(b8cE;=3L7;&qek|44xQP}(><=j-BuSamtQ>U5o) zO25zwF-<0%gK_uI1btb0?&K82e(3Hq%$_1cTJ{;Mnv$QNUya>~Ep%Mw6J_3?EsM7v z`uH`bH&N1)N??jLJCBHe+`&6<)PfHO`gXsP{5?yd)2f@EhPYJ~%9yRX%Ys(iDu7}t zV}#Fg;<{&>K%I4WBHsMcHukC^()bnB>|LN}&dGh+)A7c0Z)x&M0ITzf#`f~^`6=f` zr5wk%v5F&FBr?-Lbg$ji(_+}|`&dRXu?f?o;v~A3B*eGHnms%EyBJLqsy4-G5Y(zq6LEK5PMu(@Lw3Or3X#bH$8xTiNG9schqHIq{q}f;eTI}* zTO_4WpIVwH)(K-YSpcZn*&_vpgvzGAJH8MIWDJDO-FX}a7#G><`K2SA)gOJ-_=pb< z4wCWlIy`|*e2CE>Xj&0lMbCG{K18kC_&RPH*efUmNqK3hRyr>uK0YF0{BXN{_Z8}E z%0}h*IUydx%pFB>tS+E)U(FuODQJwwHPrB%5A;2I@KH`t#Pz<6OpG*6zr;+}__S4|kHj zCV&QFbMu~3!f`-7f|=xd6YY%b?CtDA)q`1TZIy4m3CV=EqUe~$D!9ctqV$$9w$d8v!wQt zpYyi>kk;(WO*r6LNp`+8b@3)(zouGgGMYZgrugJ(vM9EP!8EgRiE^Py=rX1D8v|m$ zZMOrKS9q*-Wv3}a;E##&rvg+}6)(0!y#jw<-yQduZC4>_XLVE-qc@=u!)MAKNW&i% z6kkPo#>c#;yukY~luZ;?wFd>7uzKjd#y{yV;;f|f6(_Bbe(_Hg@b7Q5>PisoIhv2j!dpFT zFSAET%ruhB;hYzm`6myqdU5Dn!|vb=b9-URQZx3~MQ7Kl*3NTr4Z?5tXutX=c%6wd zU~H#sp4!cPT9yyr8~7H(=NNX*eF~JF5E-d{wOY|}AeZJED--998*0J0xxvX)*Dd1# z5jB^Yj*3EuC4bau)_1T0{@G86}UCUA=N420!KvAXrQ)zy^A4hHysrDopBWLJ)y znOTg*PUS)>FzX>EJrs7us-c8!{Xyp z0QnayBEBqb-WgM3o~GUrQ<*R2yE7nCGEZs1UW_n1h$_gqcc>~0@N5J~QIX6qM`w^a z`}0Xkt^+;jQS!uQ-N$Kl1Fg%|)zvw3eU59xMT1!o+3BYa#r1`b*AbeIbC@;vtsFO3 z%D$qnxjGulJc=S4#Y`+LI*uq}z?1OObRapfFX-h}{t1t&ep$TlY56D1U&o7wN_$^o z*3VSk#mgyk?Ulqee8iSfk#R>DrM^p22zdj)*JcZg8wfaY8{SmlV~NgRxyP%Eco7Eb zrnNnl#vRlb0PCCeg#ukKgR8FUu0CLLYn7MDtVXLgtYz+|$sDfNf$SygYiDNDK`cAtKd#fSh#M(-!jf&yR1DvT{^N^*cO zAiu`=V|#3wgwxtc8df%lnhn{3l{f-+fvQ7QfW>d!5qldHaEjoxHfn+r6}GoUsfiLs zRt`?b znJAAU4{JUr!K>LAeZ_CW_X{>)H(l^tdWJEO?lLM<259pWcdI|P+kVzcP6 zB5o!??;_e$N%Anh4He7)8h6}nIa9?Q40s<~n;1I6vrp?Y8aGc?Ixb7stONr_Fpwxp zYcpV+K6oRw$_O3 zRv7A$FH{8<=SdZcCQ-p9RW?G(wQ{97_(z_r?Dr7?mWh z@((hnVOdA;<>RB@Vv$uE^zJWWPMtn25cg3wcx`jfgrS9?Wb-pxH6sH8sgD9`47ac_ zcwS|-;W~WQ311t@rmF;ONuy44uC{Kh?-%{W)s29TTS-|lH1bZQqH+wmGL$Mn&DUZ7f@ID|dhJ;zg>9+q_TPFv%^Y_SV+0 zp?crB-GZ4X848wXNl7_xH)=^~Ysb(EU1D2WTDm|@%?ea5a9;ADqN2J$>8yGb?=d#k zN5^_7r8hI}b;t{77feh{({4e0r9pGFK2QIO3X%4Qx;rXDPO$~+95N?$e$=}7lNZ1ANd zBLG1a79Y+=Xm~NT5Qh}=yte<>delbGLCbRG15((*xyPn9=O>9D0oYivJ zTXf3}k~PN>*}v4}FL5Y^(L$2dH`%j_l6PF)+~jK9LenM^h>TV8!)RGw!q7W174b?Vbm{>8IDf0M+G3!0VI`UO>vMvn^oZ~rA|EO%pSZJIM7 zEvAL(??{+m&Mp`q-`3WaU_>F~)8HW5A)TA@wcO3a?PzYyW#@Bc$t?ftavJ_Xe@!#)SP#NtxQe@Zj-d3W_sV$jNO% zdIB2eXH!#C7ww)tP3)JM-oG$KB>-P5E6SduvPriCm28}gGe8R?&Bou?EC$3~aIiqTLNu;1vZ&ovNR@j{d+8x3hTY0)O{iUw07I}hPk>!2BtLOw zmL_s=!El?(k&6tTOqo)4AAg_jCi$SCV3f&JTy^e^%9{z`3%2p$-ma%RTSm2${l8KD zfzeUrr{!=Qh0}yRMNz(sZUw`B7-NMCB z+uub3DuD?qWhdB|hHn+VKX~yp$+zO@T0ZbFdTwubzTepO;`f(cJ{2dFEA{ z0M27?y7Cu%pjEfdxQKj8V?K-h-OqW^AMTo{K5YrRae;#3My^g7a~(3E)&A~pUjuKR zSHkn;#iwcR@!VpXzF#aR4Ktuy(mPbB_}G{xo$!QUG*bg+uzI~Ivr|_mFO@0@l*u~F zwe?~VO1=i6#5mtw@3I&)3}X`JPZ@GlG?9=qehnL({-D>uIWsq%QNNELSSL=gqR~Kv z<3_Na>Mn~p<&s$kKfhsvW_1!h{iEId?%LG*SFy1`s9v7Lo$n*dejEKyD77=;6{gNm zS=JV}V=sSq07Unq7l z6i=a_^(?eHg@1)M{BAbi!7z1#tmkRmHStfLOcgn(SP_(KG`eP^ek$2%Ei6~3 z6!4HH19dF*F#1k@fZmo6QDf7y^{}z14XBuU*B23h$7m_o$FcYYp=d7j!STT-g=-=&V^Pu z8LbjlYcBvNi@?*+zow!4Rby=2|DaIX#2<9fFj#1@M`Svg7dQsQHUUW12;Ww;mL1a? zY|N#ew90=3SI^3?UW6;44HO;UVWRA*b+c_C!mL+s<}_3>D?U)D{@eId3w=Z+>JvF5Z$p}nEJs9 z_$kH^C7c*+a{BXHAkL9eT|rKWdC~*xox?8z)c$5dA^IbL&`-HZG01}=7)IV zx#E!rHvmXF@+4t$nsUnN#u{rj^q6PWo40QT;$!3Du1|u{DHg+pj{(%5RbM}$ac|_| zC|~aOq==%TV#XG$c}i84Fi^k@HD6$ToKyHm0r9UR%bF$eirgwge;N<5})>IaM7lVaM4(b?(s z2deAPtYt_r5tg{0J}>9b_^5y|{;1P^EtZK2bH&V)`*s0SxeEa{C0y|RMr}okS}Z6O zWXW@{gE_!`=uC^f^P)zC0SNc_`Sa(*#iRVdQ5-jY1tsc^5m-`I#(RknxHGm#nUR{F z-cr7yVw6kXZtRt#RixjyT*Yv?#sAPIRdjEnW= zBcF@vr85p|TBdnw1Vc63o3zScKg8mAw(oJ5xVrrzit zgdo%8WnWZF@&KTrJ8RbGB0{Pd0+t~&5ShR=d#l0TBu`6uB0M}iaB^DqJ}ywn zx5#~_RX>>4FPzXf_$ypxeiwky-nn%^4-59K2OcebP01dfThDtfYSJDz*Inw4)>r02 z@muWpcge*LaL{4UtD{^qEDH7lQ0l~k$jqmGXngqbt5x;WRlxLNumjO0a` zMX}{D4P8X-^FbT?tq)fj+W`$@&xgv0V$->B?V>ROj^K)=SVHIF%$MhipMT7(I`P2X zO{L8ksmZq5H;!R0*JTWp-x*k%o*$7M89;E6f68s$XGK=yj9WTdA^>dVO48GD`I-a& zB7>sOSPW{JQ9~CLt#AId3*M?I&N1MrpOA3Zsr`(vJ?tqTcQtZA$13DB2|{=~HUdCm zqNH)PjAjsv@yf>&9?PN+A3d^LY%@@veoYp5CEL4NbrOdj=K%b^zZk&244?r(5BY*j zgXlwS4Q1z{3ZhU6Q>0d{k#1IFBmKZ9D+A8`0U}ce)8}UiJu$-&AOh44L`YUG2Xs_6 zY8zOs)Fa@SaG$i<+w>J7dV`1QzPL44&E{L!(+c;uA~z>N zTbaE4Y-~DwmLu%T{1$u()6V|mtF3D0+gB(i&~1ta{t$>sfjukc6;P7EY_e?r@}aQq zSV?Mz$(2SjQ*&OYp_5XndZX$`tdV_p{i5O&TGtg{=TBV5uAACZvh{FRD5+WucNcBBj#E|!(%xzwOCiU9zNk# zt%K?{L&9WVhSwD5xIyH?4DKaEEZpuD{Zv%TiX-fy*!K&wITKb@CFq`a4eVH}GH%=06 zLkecnTcKVY5JhnvSUoOF^=u*L)}>1~S4G*%pKNg0Pq@hX!YITyw`DxgIa-Q827sT%oK3-?{1l~IKBw5yv)8(T5>J|-3*wQq+B zp+H6a#aou6rIGZFlZn^RWP_4PTVlJ-m4s%mh|sECQ9`FlR=C1h0x5vhLp>xA!%c2B z@>nJ?Ar(293;BQ&y_+Ji$TQ6|fhJ z>bk)}H~dk`VwHP;B;oTCQvqk&b@=6+n)2CqJXpVQZG5>_QH1kv2y%3M zMRawv+_s2*0!UQJQ?S2+UUe4NM%fz5Xio!{4#8d~9}o*b%DdAkZ1vR$H8bfItT~71 zug|r!^#KIRdpI0gY}qU4wzJ3#bg{|lz6JG6pbT&s&E*$*gO0u^6XYUMYB8Rk4P?25 zCWux=>kVK(d4DbZWFut9)OqIWxljeVQNcG(S|{T#9cdoI&TEmWsfI_%V>P}ZQ!3Zq zDx@!_8#V>Cy(NidYCPlK*53Ysnm0>+kTaeZ|9pIh+JaVzTke-e`pCq@tEMBx1w3Y& z286eSX!1vn@@RHemED3eGBSW3Vxs~YvKjVr?p-Tgs|fmj?yu>N@{B_TNu-*w2a76p zQxabfR|Ej=2DmpFv1GI#wznMs-^J=^Nr`xkl-8<|Y#-;i6QKJEZ)eIK<@m@3=LrEZ z{|HAQVOOVYwHqxZ>VGm1q46|NsEjCWtj0Y*N3ZM?QLxHPe^KJ=NjC>1>j4O~IdqYm zxZR-0xQ15P=}~eZHieX8w#;SYf?iNS&a&N9T7uFi5RYlk0{~Y}jVCW0>^L)4wJ<>_ zUsE3}cA(o;Q+PNBu<;7b60@Yu^>@$iKI>t`&}W&5es-zt-#|}hZzGH0aCiU>)&`s? zN^uHyz?sLr7LOTydKwVvm(!3~=^A$-oN)Ky`&ywoE)I^z$pI$v1cC{~vQ}2WOcp)| z&QkxW@^-8nQ`-a{A}8*VQ1V4cq$7L2)hTTJ?bchYXKrsreFbH4 zvG5lSIm(OI8OLqGKn={Y6jcFbzHstQlQ-DR5OKy8MZln_gNJ|elF`whGI-}w=}uWi zfAWXJ5YPi#mx?bxae=zhQ*5JGcMeKcHLQLWQJ>6v}oVJER{wcGlu{qahA zDk`A4aCx^Ww8J=Di>sO)3R3^*)xJ2bun-k^>sIDnw|1uCm#4gj8Ccm@e6+Y%Vrg4} z_~gybs;#-)3Z!sxYy{!k2}VHm_SJH9Iou8Bn)NxX`PQAzdhOb$%`q=%*g!6)!=j24 zSB;1)Xm`WJ*GWwo8z(rUyfjc!Bn9<+W$8t8&7TW#C4!CxJq+ELELDXkck)$MsIj%I5tEsGc|bz z%j|2XK9K3fb>RZ_w{DFJwxhKAHJawNU%{xKSoJ^L^8W?Zr!3Bt`^BDe%l=rUa+vf? z8Qa|Y5Ym_PCHxae1_mX^K(f3KH}MZtyA8}_lJ78cZ7cemh+GJb4re~w=#>Zwaq3R% zJr!52PPc7x>X0De95(yg#dPlzxEk*x81f8`*vVA%^bgZepK{sUHZ98WJ7}$KN!vs$ z`t+2ld-9Q(t2k>&6BmRi`IOHPHaD)b0DALma?#OOQ8`P;JSM0 z_YTH!loWWmBi0WB$q=mmg8X{Ncbk^tX~t_z5VhnpK+_6CE%Uz*4h{y&ue^<4Y0-mu!Uixf-T?U zvKs6JKJXhL@Ko;U(^vc3z0b$R7XqE{6V#E=c27PFgnI3D5FxYmMRkRoUb5V2L}j0l zqqHT-U^c&<0+0$D2X;U&faZ3^N6P&tNPNwfBv!2=*~^Lbv~zk)r@Q)uQZ${4?bcF zHG8C>5K2PBzkJXbNPStTQ_I&a!SMNWM~&b$y*QFvg}G(qq(dK{d1{r4SkpNgaMi*x z5_*$7N3Sm=aK+08)0c3TcyF`|3-=-27CPx(_>q5j$skeT-lZ>EZP?@#X1cF$JzA+Z zK;=b~oI-YF+opQ@mOjbYA?S=`FI-It79YeRsB+YbWI_$uR5CEJ${2WK#FE@F+g~}g zz8CO+z~BIk`7%MZh{uhgl*m)q0XtJlQ<+zjppl-rP)=$FM**Sz-d zPZZfHlowl>5~dk5Ujcic-L!69dk$IW$>UvoQD=}yzLOz!=x}1HWlG$D!UOjC;NF+E z@v8&*!_Bo=f{wW~Nx(r_(w>%Te*Vh1ItcFo3d_ z^J_)qefNf)^K>g@j!e~Y2b`m~Q6J3r%V?YYAQ|2Jh|m<~#gCF$LE}Au?=9cHr{=X^ zaLY~_-u9)Vd^}h1CF;T`#=~2#N^7eUvlUSzm{V;DNptG{Rs0 zJKwogGEpIS%1$%l#y{ek;2z>#ceMyJ5J>>!fs&F^DDm7-;f))N6K941T%{MuI@NUs z(`L^7`S5OFw>aae+x;&GlU_Y%v+L+xYVUjq`Ev0NX0BBT)L1g_vrmQRC6*+#-<6Xc zBHo`q(cjjwD^B_Y3mQ?oAP7cL+J&O9gECxxZH1_+0L?t|tv z9~nBcy!`YHlCJo5DLwTa^@%uc9e_nza^SEGUI;rJCKQOVdPX|^lu}oz?F=gBDw@oZ zK79uWTtQR}>WWHW489I(t568hEYR=Nomc*3vlk4c5Vk0abAB*t(`ZhEY?lHqZ~+Q8 zftM0qbW>%nZG1rIRH~%su7@k@3kING`OH0)jDU+2#YXh4sL-X0a}C4!59RFM!)}+q zI^k7OjZEuFeaJXmE1FeD-yhe8(Pd|ywaz9ded+aKCn3T(cxQnlE9djsvMbC8mrXxY zQm}W{W1ow8niV5N?5dV|v}RpUuZ z=iZ$rO}O>ImvA4T`$-qkUA4!okJfL^2&#hp7e=OC^YqRS{(ozl#3|y_TO~Z{FMA8B zup0+FDPdvJA(U$wCvokG@bGJ1RIK}44;8N9y#fqkM&Vx&8<}|7nxN){=Y#7u=r9Ru zz_;Q8c*1Iy3xipGfhew>g&8WP6}NLg@}|SC;3J5y$+^dM>S}cEeF^Vs_1kvHkn*gq znJbWGS*~5lVK)!RSjg-a$liGIsg_Gvcoad;@APKOqt_8|*5`V!u6Qp*0&#)>CK37N z3sW?ZCE~goL7C&4clq1QMcTJw2Sb;9KUR8wy>k~3h#1<7EaI&Gpxq~9W1IIjN-f9p z7WBQw`@hZ1%zO;WIx>n71G$E$@MHjk;pxYyD9!Qoc_HD`WR*Ptq)46py74Igx}FCB zy;)%^b)Ty3)6&wYBt32oP$pT7RI3Fa0s-+yHk3cCyN*oUWi&?{iMqc0-ffrx&?oJ> z1%mA~WQ(7@_=Sv|05amtsWuFa9I3bllkpe1_T~?De zq2dbna^XI;Ih-rQQr#CC>+(_w29gY}5XVjH5KNV7U(&tZzR>9C%*l%vHWRGXl;Mhc zLe3u+pzf_0JqB*KHzKHQFKL3^OeGoAIiRC~S{KKfuQsv)q94vGGiA7}PI;NXx@S8Z z9vHz{mv6lK;SA%iwE$4bD*SALVl@9M0s$`KwApRmD5@po`;q+m>uYhQcm`b(%K5jw znhvk@4~qe@xH8>Gs7%DoOsYnC-_;vSPvMs+4xBe5vb;~Itxw)57*@c^Hgyh&#Fxg6 zu?t3mG~r)-g5O|WPCpD$j5?KRBTlyoD1lT+L>m4fzQ?_WNj6RV>U&@6YkF`CP8m`y zx_{tquqk|m{1qo!E!L`U>WFwgQsniHEcC#kZpLeCT-@k{HJqzIN!>>;ifT$DR~yDV zJ5(@pf&7^o9Z^=7NS4prDCtZfRR^R+;zU3Z$!oRpz!fwgFXZx=z}l7aVviBO9%aXE zF|`WoW-nSGxL@af{K)1?d(#}ybaVjh$QrTu`Denzr@#3)>gGs!a zTpP#cTm$?nIfb6r`fjhI(OiAIK;raKl7C_U8S*jmlA=1nK5dzFs90fPp;23;W#w3+ zB(A#g!hXO=g?uEZ9<#91$^|v`1y01x4pHH8(aR+a{TVyCL43J7+IRt#pVnmW-?yyN z{@NhwzS9Ex8or%q{FtU~CRovtIv~m`;^9RZe>WhgpB;NJ%!RDQf`KfBw2gCc_KFHV zI`wETQdIB7GsMKb#QQq!_U5Ob3;=$w;4(6u96O**@O5@Tbe7p+X zT8W||CRx|n97Q+cIw&ZvWW8oEaK~}rgtI?OifgY2@mOeXPRiG`5bb(k0hy?H#8d;dRPLPyf3lD(CRC~I~_QkE%evW&8fUG`;+ zL8X)>WM4*v6b6&s7$G}jAF{7wow1KGi{Dk}-1q66``q{MeD3?}507hHi)-HR*ZO>I zL4tu_i5JE3&kj*Fn%h{Z8m&5y;Ekc?n5qJ$byKF@9M|Ag{`5F}WMqm%@;RgMtkj*u z&spUVNl7n`F2r#xaZG=@xx3bKc^ee7&+q1W<>z#t7cUV<4>tWpg67+}nyqv2CL(k! zwys$&PuD?lExLDjOjX2DLN)O@spK0r<|Y6^hk)eneQdq&*18@qZyS2(jGO176Ao5< zH*RFp6Yk%995rY%K2nYK*A5IMa{=hX$9+^i)PY|6k%d~nbFcE585tk!6Dc1ci}$uX z=sDOkRA&47(296nb?-EQ721bUnUug|RIOuP8y}o>?RR!|j?YPR`}tL+FmJ;O#@T`S zBr>yC7fqKlJeOH>3lvd6Dd-pByZ6#qca_(tZBD%0o|_T}3NA17`=RcYI+?Ac9gq;7 zpIAzb@r=k%rKp>vmc!C4>E+eh1bzCok9>l>2n^*z&F-P{j#fBfaO%Vj)M=U6PwY zX+<=d@|wlI95*0W3VERYZ74eXw{yy8d^RepB3fH<`KCbG>SHUQF1x$Z&?|er#Bu1| zP~SilkEGo*<2s<=$jHi&6{wjh4erl1ssr--_0$d3)%AG?JU1-2&AhjB*7-uiBZ0iI z0Z?HJP;LdhWmb_w z74jjF2cK(+ejXWA5L)JARk%|f&b+xeA3Flwnq8F9*Sag~`B6vx(zQ!>)a2#O04m#= zO^!P+pZoAk#%pJTN3Nx#t{I0`bg^~sR0?HJ7i}kmKG8odFD&{76gE~2Ed@&I%4+lg zRlSIF?p~fHdiH(P&vhxbli3|gW7hi=>$Q8BSJoj+G(Roq{Qg68qQI-_oqmEUD?d>V zetsP2dl5-I0#*4pLgqg}8-KW?|2$5@14KwhUmN{ z0J3ewJ&KK(r%xJQp}h=UI({Fy{du3rm1A?JS}$l!jq~!n^ z8dS(znSXhM@!=CqP1-S`$$C==)A#CGBH4E;?i)BR(1=eF*V%~Tw~AbQX7HxS7IeyN zycWJ5TFD9&J9U9$79REvzjAe-@4iz_UE?M%EE28eXrxyMuAr3k9*oo?tNXOpi=zUjLx0!`6``*tyZ*Lb_gpmlkfe!6qrz@lQt|UsMvVbrcFx6n*rmsEdz@YBl zXA3q!J0yQYTxX$$oDqPa9!)GY7AY@_b1L19jEp?PE#*|=+&u%t+~&PDRhU{l4lSGa zwbyD}Xh9kQ)#2f$u3iAZ6TGWiYp$nGvb#0C%fD=g%nOAfO^Vf|xF|rQmvOQy+muCP z#A3OAP>|~LlYn>o5J%Z4e_#zDSt3KbFQtN5*ZDJnjDQgf`Z|Y!b9dQ0g6xyi54!QzBQPH83Orhcw!1X4Kbgmhw!KPpM5nfnWSaP%dB5k3@*JA4CMwDc)6l5b0L4 zW1Z$%>;-;=at^tJ+c3*fibu|#xm@1pGY@E7PpTV~lI1|vp5HF!>G_Q>D%&I z3c#|zi5iadj7@I?eLJ2Py>l;9;+aRjSR{svd&mBl?6YuzEnM1BWoYih^woQ_ubpaN z?yRV>pB}zwzo3NmjtP*)Hqh6qzUmwij(Nv)!c&fOuSBF0H$~`LAx5XGQ1f4MW;#n5 zA|IgGmTdiycQWXa%q)$X-dJY3mNzIaXAih(2{+ZDsL;qM7&W&Q#)lbU+DeAQ{hmUd ztaK^y@z5s$`Juc;=r%sLo2BRceZy0Sz*(XQ_bRq+eSQ5_i(Q}EhV5?RvQmW7C0|WJ z-bGEWl7~Ru1RJ&w*VkH%skrN^dAcP*Le`5&+bu`}vUj8JXIxHJF%p#|%&1m4VWva| zyXq@l-JTN2A*wgsG2)rG871l2dzHdI^Lq4709DKvA@Qb)n;UNFU8N<_YNRZ!l(Pu` z66Ji%gf)36rL=@~bp$&0)DeUlVqeY~+LLn87yL*nNg?ztZF>T;8Z>2Mw7{HH1YLTBwyOw0TN1rgweF1!HbpzN}UO zVPe=Tv-t@eD@XS&rLIrFTUi8odKT>UvE)TCv2bcrVZbWRh)@m|8;jVmrvhQ{6JZcS zRZlqKnrYYE6dVC>CJb4{r7Y=;S%mEjK6p>|MbE|=mh4n#KHXTv&qGpCQ-=pIFlrCq zsQ@KaE%)M0ugtyMM~21zN5~IQ{Ekd(ez(%s3xZZ14;K%Gf6Wk>HMFwuXA{^lM7-K5 zenn4MK``%f={9~deb3?b%tA|N@bg)pufC{(fz7Y$G?mPY4+L%nid|}xL>ZlAYR#-! z68+_1%uP0WLMHRBYuj%8pV;Wg02kwA$OnmA3tBeFFZG+64%po6#*OZ$P;GNjS{Vw2 zL|w>k&ZN9Af?wIIgf9JZomZNsljHR83afN=Oy88FZb{{w49)hNbx3)Js=MX!S~hoEt<~&1 z{5{>w`2{dNsc=5q!=4sIgd1w_Hk7YT4EwCr@zYeRJ^JUxEE*)Z$9=aW8>c63(;bms z!-co+`ukTym!~4+TA05`G;BsA=r={SN4>0O+m=;Te7QEeAOgI&~+6D5ga;)q2!o_$0b*?l8yR@Ga71o8IVAtlwIFKK!P2F+k% zRbyC4u>w&8ENe#JoP#@DTwQX*#x44L6c_j7C}X>$o>Q>fygu<^qX$e3zQcl&4|^VPyOM zoed;hzuJplIs&wCAlPuP^dS3)u-#+jYl3mjoFUS=>Q}AXYGCRfh?x%s# z8~X`@avj5?{?6OsKD+rlgEK{qgvz_&g13SB#|q_J71JaUT6F0z zF0E5tHj__fkulFXk(29;TI0xGRhs4;C<89A0V(xBBt*Z%SgwfT4C7b-6+lXpW;!OI zk5}E;!1ZXmV+Z5-M%-}i$e!iv+zaA`)ixQbnmq6VO|L39>&n}g+PO!Z#>@v-!%~oO zjf&*rs>;bO5q{gPc=jFBDs1_Ly}wUp@-F(d;}Jr|F6HT5vZ7Y?$N7wlg$-hwA2bd)zZLo)aN#*v{Psp+;siZ*sBhe7qJ623E>)GkP=A6Lz=!? zx>nqSEy1U5Z8{fM;wI`|G?!LyvXMU59gX>srko{N<=G78RaZhHu?dcv08)Rvt*`!iD(k9wB0>+vm>t+sPDh))cwq1?NU5jZC z9ie@?+KP9yuhZuYD%~{S+#kcNYi%Guetei;vGdKK(L)8}Vbk{HQYg5L**$N8xqASb*PRneD$IJO4+^Ch*FIBO51Pc4U$* z#72XH_YV(%n?h)|Pmtg0cRyw}H|*NA`No(!zwA{%d$iSiB=ykC1{Ix=s&5^GCg*U5 z!e7g|$QsPM5^LFA7zTJq2rXe8+*wbjsKGf(wFO_MF8%#XI2u#R^ECfA$g zDY>uCSvfQxLerPHEEmG=OgV6s?~D+g-^Q8wx3l%xQWt<(i;=HIWx=mrecKf}=8pmS zyM8@vHFRmHX(~eL0$`}rpi>4>UQzoF4}hwvnNzn^j8nAcvE%C=RC#I3}C+s_6&9cdBOHo_vUhK4Q5+ko0xr~W71@T+n;Xug-W>$ACw;BDQ- z$_0#lrMoO@#0nQmi#@7+Mt4ye{%Xwu3|>Yd2fM(-1546%tWHPwD(*9Wh6bZAA_Dz4 zJsl#GCd3PF4N&@CuW`;9Iyasy=lp&F>@~*be7`VToeSd^0?3UfR*_SrEJsi+pe?ViWW&_yXX-@VCwSgiJVH6A7s2DcKIlzw5^9F>{%?#-Lksm8mvSIau`QIG1>1|Jw* zD*s}_Dd!n#D>a8$n)mydlM|EK8msZ>Mj$UTvf3d#wHn}~MhD{U#(C^HpctSKtK{o` z>xD}L!2~I10iaZZJELKo;w>9uvWM<^;(bFMk9H!TXU$r3ciImQ`Cs7)X=*v~>3!8O zwN9A#naU6%ayTO|Dn>|)SkI{45Y9O=Sl~(7q&)Q>m1r=!=BipbMSFDHOIE~m#CdCs zv!dcafAi5inu$7Ua%t5-{f^V~gUy`wNL(K{_wzMOK?pf>cBfN~ee2V;NK9-e zqSC2h!%FW4(sZb*zvGjgxbF1MYlm@U6XWiIpiCVeVd4$rF~GqttV4@44AoDt_ov2%EE& z$BKB2)Ne?9z&m8eHZS*HXCHAZarDE6u1)qX!%p4rSvsr{!jjLVJ%%ogRFnh{NHF4}FP%ErQXeu^3H!)= zFk5S=WC%acGBac4*|9Z!M&;Fan8He~s;}(VT{aL+e53+*cCnMLb>tMm<<*^2J4o#J zW`>BSjTslQm@`x9e6V&Oc|PufHhOr}xlM|SR}g#z?GNWfp1H^1Pn#JTSNw1G=Z~<& zT$XY*{N!jZ02IMZwSQ?t1zEtG$H5s!xMgP42v2i*ZQQE99DgTI zjyUqZAU9X6yW&NU^Nr7r9nhKs;nRnw#mXIT0%8E)roHFt6cgtkWtoF@;JwdX!K6gp zNOVESlC6!XjG&6&BlcmpaOvAog=n?)#jGc}_s_0cbI%O5m7t{5xl}>G!TLXMnp_0cqy$J-$by$2!Hx?azMlIV9H}S zZDoWZPc|hq6~~n`>nHx0CT*OdeEwun7y3=`=Go?^R1wJ!*_1?g zgj<_%oj`Z?yR|obps!?ihhfIP{p-`D#Q0R)vyHY~3?E7Z!%T{rP=H`~EmZtE%Bn1r zMIB9QOkU^QQhvI5ZY_I=mnkqkc3yx$+e0cFgIrge^x zjv4Zl*r>%Y;}%zKOmhrNntrP>yWGHW$7vCHZs`OOs^TUmO-m)5x zW)0aI6CK7yId^&nz^x8|>$a8M$aPM#+cF(4TP>RH%g)^^lho{7dy z%fVtwltvis0=0Cqr;1c6aTNm^j_Fj!K$YVdQk)9?qu}++ge_rPtp=a|Ar+8U5 z4||)CddH}xy6Bwb5Z!Mz`|F0oODvzXg^mXI*gD7iTEAvmDo?lgQ_6a6&u?_04F2W( zqzi*TY;UXNf0cyu$2`Y0x4?jqai%r3)_dX*aex^1LD}Bv&57z*?SpgC-GboFn_QJC z>h-8{hlmDMP0a$p98W=&D_3LcgV|EX5e>WDPvJ~A*eUCR8E{3==_C!YpK2xp{m&f< zk=Af~Z+25E6;kVKt>BOj)$#;uIDn>nD@1t!brH6f@C#V1EY1XUKAkq3ursN)gbYj` zPi5YASGbau?V`YIK}tFeu8BK9Ot=b`I9}X^?w&lrPH5#o2o7+RHvO~+MaNgX6&R^S zpC6z42f6$Y(#7G--mvj`VWtG<(_DuIE#Lw>xFcd+O6=rMxXci`q?+B5r^R(n03$XW zDpQ~RwB`4V?O-C*NQhP3tlpl%Uupw#7XGz-=2+9Et5^lqmIJqwti;x`zhG)>I^W-J z5EA=I0R(O_6nfW(%{|vt$1-oX>D2kYvq6U~+M0`&r@UIZ^)Lv^HP-pn^r|>ChtKQ;ViiNG(_56B0^$@u3ec*zNV0w1K6I~CmCP)`m%KV9{icp z3Ve2CWl;;1|NKA24F9GWHa4h%ob|p?er{RVXyZy^x<^jam|ErMFG}n*w_1RX0DH7_ zQENps^5xdxz6MRdf-Iln6vKXN{{(q7WJBk(P;EVI?ohm$9fB|7Jn2HCgg|2=twV-ujJr)&J6w>n zXZ_@7Rgy#zUK%xsJ2up_{CUO9F0^551Cx?cn94&mpPd~1U0wU0elyj4W*oOqTKoUO zgtEXJXW!t3j-|A&H(L3nd!MyF>mSqH3I5QXYj{VczOCYO7lzALA`-)#0<4MUWB^P? z@|K+{ev|FBc(tZ>IOvs5Atrs;m79(#R06P88Wa84B~7M1tnG@C$)PyQ-#1LzI`Bzu zbHloWH@1HLW+bz8ZQO8N=;FNZ0~P3OS@4cT8O}ikR)M)Q2|E?lK|Kyrs&!8HDX$K) z^ur3L1en#}j*X(eC{#Lbm0Nfy$OukB$?5l<1%3h{cJ7`&8FqAKQOG3!?@lZEPptM- zqb7PPW^(+hoW}iGNYC6Wc9L5iJmnnYqvdpBU zMA|22L6u(w&=`LEH|3zUW`)KtS1)t&ZRJG0I72p>D;?TWv*;Wz?%zOi| zZ0iYtr`Hr0J;ga}BG3DiV0C0X7Q(m}BPHPQ|6nopFeI6tzAX`CXoo-gJbHN%ccORD z3TR_hNeQV>)M`WCU8vLVJ|gD!AOl{ZNdOpxooX*}rbdmO^143pn`s8g^L!i3pcNk9`GF zImGrVa`*RmaF6%UxMu7>H+pcsI^UQ@>~UicnG1k!5rzxs(r?3NGtYKO6+nV~xyIc{ z+3CJ}!&c`jjJ~Y{Dtlg>g64yJnI#tfyzOrU-b6>M)QGk})&GgX{;@%S)W$#QgnxI! zT=|!6bh*xC9uT&Cl}j)@=g&oQ1N^y$*ga`#^qb8CV3o@|f>BKi6$+g13sYJIQsN*U zzJVb-CuRU#T)kEY|?*Z7o20sBlg6WF~CNKJ{5k+?DF8G3!h^IVj$RwlonfcL-U|bhHl; zJu%BFeM|EhQu*$SgWPR;^4vcW%|5l$d=cy`+*gSwrCDbfrY03Z2$~I8L54IuUMS7$Ogo3&C}spITzD{eRf=nkhW&hNzIVjU?9K+glXHZ zMEik5jBs;cjTPion-Z<#_cGwWNfrk!2A6fWs^E>A_t}Vm+rzSQp;VXBJqavG_B*ut zW#G3WiZ28ZpHBy`2sYXW`H-7eQX5F_Tk&at-Rlqv7&&CmQ1(F$W^!A#o;Rp8brVGaXY()M$BKZHM6XvP_=|;h?Unaf>wj+8R&MG^N zi&`?k=f7YIn0G(E@2aPBX>EYwxDGFTy2NE4`!OrVGd8ge8O7gO1B3?Kavv#$(GtqQ z?^x(F6pi;aOKuDSd!5Z@S;ZKByi=grNp```To z?siBjLlAJw4FxQ;1S8UO&G-+Zg81V8W)4np!y;gp)9*SiVM8dk8=xt;HsjSX2dJw& zC$jlR)pp<)p(EjvcbZh!6VC~haEM=1FtxM6=1P~c5$3O>Ky^?@3%@RJo0YQ(g6lp( zQppetXik$^O&lVWnBW+;Fn^63r@^{Jh6&U{N{wrwiXiiQ#;Z?$79pKVjFYR^_hRU) z22VJCKJj0xo^g)O52p7EzPrtN4H3x&2zHuA@UFxTrV1T+d$+oQ)|Lw-I_!v3l08iA_C)@ej%(h^syg+EB`Mx4 zntP;Yz)Zs%6mj94pKYtUSQDPF=LmvRIzBs@2N{Atp?>cvH0MJq+X~q@2xtt?4fM_94z{0Gs2PZu&^CsZ@vX1~tXuKya74>;l zA#B+;4b(W-Jt$@2_UGVxVBUQ|pgNB1#hm!m-&%CS-jWt)(T!V!_{lL4`tqu`Nkcf72+AvQ6oRaK{{O&-+!L60EA8}EJ@?q4HV{wP3$0;f zw<`Uk)(Tcwayz?F356v{A5{*cNxn~qcX?l2zXiR1^XYw$cOC#m9lHU3$3~MW#4rFp z!=!(BAgYaYxOp}z^t(MSRjGXOTYM-X;R)al)(U*aH;|G$Q&GLA5&20gsq9m3wSF)% z%?Fj?z7jN=9KeR3*?FyV6m9tg8?r2OUs13sI}$)8v5aK*kubu{Yv~tz9QM~Q{ZYVH zTzZ4@V5S}mc~(Vj;4!Ll*Ox2!R>9om6DhN`n*Dm_g9_=bd72meD3>%6Y@}}w9$MTi zseEw-Z85(lIXiahNHdnTWyN(psrR4u=zmR+0QJ_KW?%7P(20`k{vLUr_~BE5#kLHc z)8U&rb6}PFCGjtqVD&JGL>L!+vGvmNJdPA;DUsF%s{{M2bWRCJGhkSFm|tW~!kY&k zxq@@p`0W@w@hsLJT0j+HP5-5|)gEh#g1QBC2i^2+vu#Or)4@{o#AFXlst9rurX7#v z%x?W6KQp~O{4zCoQ=$lx;p=ajSdeO1=gSo3-$ral6)He-!-xqk?O{hX^!46;1sOc$ zjDh^_Vt$vxJ0Z&Qd}BKd{*mf>e9#?9?s>P-7sKYtuMVtV5EQ(VF{_2`v?Po9gi8l`ywOGDsV|p@cI6?tBFZsX^K@{^~}=N9w7lN>b5J$ zntJNPSsj!p49M{6odWi{bC+oY8pS>II$_1^y;&_F%K!$iH$DrMs^z#7Oin(HKxxL? zv&~*IpY-MG?5Rm*$F)j!p*NNT1Ubi0?-US5(iZ!q+5ppPqQ_C(9+M`WWqpU4>O1w& z54fB#7NHbW{8@;FoLvhXe5FdMY!aYq{t5`d8D*V);=)YG^=YR=%N z-)-5?eO9tNZf{;e2#bMKUV+VL4>ovH#le`lDShD5jsN zlyySQ)HG#83N&t%zawAn60sEv)oNd#6X z^TI8$M<&mKo>?vBecEyJcxlNOOXRxN7k9tDbWMP(K4nIqmo8@qn^4l`YX011LKaqWn^t&xpOB)8)hh1$MrxHOf(2l7#& zgj`*nyoDMYafO=iDPml1VCFre z07cGE*)4KeHm^yFK}H#5yfK41CVFrD2TX}eK(c`^nfiKWi<)t0MA!9c^TkK{9x1sG z0h|eJD4{*Kq$~X!z{C>>OsgFT81un{g{4QfE49M6ZL2^?eK2^8fLFvz8vRW;A?a-A zz<|xJ!%ZWj1aI`HR{3%KU*35&jq#t6&|3zikyAN9+|zPgv^@9oDzKNkgTJIP@A?e})N|bCrcpM(2r)8@@pZaSim$ zf5nYPs~j58r&bfhZ9WqVv%!uhi0c$sx|^U9(D`IP@xCiD#igGp}X8%09U3zKnt#H6Bj%kufG zG3U+dJ%3BbC=*%bx5uBZ4MGsjWIRIDq9Jsi#xeftFLn6AV}X9VN4k6-e0dfMI`%qA&!3zb#trlH^AqBzm_qT9o|dO!IhZ$bzjU09==EL9D7=5U^7Zk|$6j0{=tK<3vM-Ts%a?0aj=cS}sKQg%O+D3{z{b7U!=B|N zu5FD?6xho?*mGyf7epgz0qLo+PtIRfR?sSTFL7im$R5NaG}K$+zkCYr-3{J@{?$ zChKy|(dR==p-1<(1V&f)ZHB zw0(AwpK+M!4|oUQ%s+it6CI7(WTFa$@?H{$XvUVWV+x$})s|-4jLq?Y0j;M0_PZ}P zm}Uwg(m6B??po>RDVUh(oo?i-E@hea8J_S*fDS3yc=>EAi4KmN!BnD!jSJNp!Z_!{ z=N)G9yp&2FDJUpftvwjDFXes6)`ydun4?VxzCc8KpFP7`{XhiTF=|#dI=zS?o3)ZH zZb!U%N=h0bP*t`NSGZ31&i7#B1_HpJZaDn9EpMI&1aCQ2%##$tw~rEA84}L?CFA~c z4}Uw`X%YDC+e4q7`E0AfBCDcDDr@}H%d20nAN^}x?R!gE#acFQCam2X{p`HvoO1>@ z$*tC(Ez%B!)LAMC*<-h-po?)&U13%zZiyUF*85y)KqkrF=JOR!5+J${Nbba)q`FPQ zJ9N%x_gV4BL(9WRnZ({V2ywW_Z1MaHSDMJ2IX351AK?uy_2&G0 z)tw5*Pbv6*HgWlSf-s0P^-8Iqf{{2}M>rlc{WZgsyi~4968s0W#kH<+m;y-2V7kOM zL_>pA^ni66plcMpSCw>**RpEC4o^rHVfAelO$N-k+3hO{N6$`QbqXS4T&s# zUz%CY5iaEY*K6=cPmJ+`>WO>* z=ml^@oyA+8?~;g!r-FM@0HXEFfxjeWW3=)O^AB^vM%0*L8+qZ)oB{;ft}Rvc#GYJM z$G5@vT0PN&2z6CxJE?UDY`@RH6iwUpT~1Uee=`=n7`y>wODUbeY24b9$mLLfO&oNg z--M>Rg$JKZ_|vNa9|Hr0)8L2NrQh(Ul@dpYq~_2Z_T}88n9@MAaX1 zbN(!c|A`+v+z8Cd5}-g1yScg!TMZ3$DJ8`(9|!WOjvug+OLlpxd79_Ykl>{F)uzz_ zC;3B&Kqqsy?stC7%=6qsVU3gGoou-`WZzR|HC`zgXiu_1@V*n(sAM zS-OCE{vMEJiVtgV<-F|k<(&>+n;)pX>mdLk+_fnCCM-#aGm%nrx3&Hr_^ue?$y;0t zdi`;9Zq3_pKbj9?b6wPCAGD&abZ9TwRpG-I1!&bwe5I(Qz_^ga{c1lTZLrceCpX*{ zclG!TNe)$em%E-6C=r_H9)qnh*lEaCkV5?7V~IaAL!k0EK7-$^6LXCNa|pJKwf<(g ztFWQfB6qT#k>eyxHqWG38yM7Qg+rS~)IWCVnz{diU`4Xp`GRkyCh0Jd%L!I3cV9G_ zRW6S^c@;+?lBg-wK|!%_m-PJV!cV%_f1U53jQGX<_-ZAg0x^WESSk|Atgbf8au7HA zt~k>z{(>C-ilTqGqKfI#f^6F|@H5%c$kt-!;DGf}xz<1z+_07Nf$KyxYN_4cEidrQ zIM77S)qGgeYcPqS14?wT)>xkry$%we?zk+7@uF`)oA*=5-CHn2)nDgn?a=vPM%c zgI7UyR`{chFT<97)`ovU1d}D2@TBAF`7A^qH{UaB$Jj#}+773S_rxA~QcX{pi7nf2 z=GOY--G__3>OMKM?8T$KVvQ&HyxXq`{rDcOqio3P3yd3R!SPb^v?0>W!uJ;@9X-9z zWHWam|IB#uW<#=!+e|b_sdTqyLMmFY8JH%Fx~00)gLXK&$L#oC#-fue-X%o=V?nos zESrn^PTDNIbrEygcqvjC9DBTSFQy^O+RLGa7?<^+NsW3}<5m6CYFVR{Rc68IF$FXr z;%5XVaVa@hF*9B(AMGpXIH?LZ(}rJt%}(CHlB1Y)ET%~z#T%jVZzRc|mFq#BKq@s> ziM1>zVxY70wEsHfB>DBJq{}i-uwJ83h|CkjGdW_;k3C8?d$G=(|LZFo3|;(Yo3A`M?+MYvD%fNOC5#fvg4u`_cz;eE6JbNz zk}GMuJF|6WM`?7)3G%Rf={85p%cFJ1Y(sCccRsON4V0~BVVXEzpKL8`q4>@`(U8yi@6S zxXm-MJP#@i%gibn4F?99=^0#81faL)Og@0YbDk|stH?K)*x)Nk9o?bR z(QU=7Z8Ea+X5YKYzRBrv03z?*gyz6#R_=~c#wyZTAfA5o( zL<{Cw*MVn0K#Ra!rsS7n%U;75K#JthoK}t&pfv9a1ipB%GIjI$slPcw;^5W5pr9bL z%Bjso+)x1c>N57~*0-r&prI6o*! zZU*a|GB~lhF)%kd&&y|lA3r`$sTubJSFY;;iY!C&dL!^Jl8N?SsjslgUZ0uq5Afnw zuOsr|3Vl?NlAH6~Ium%~`Z&kyuhY^PN{0MelLcYZeP&fKwFDJR_IGb)67a^`dYDMh z`fW#2$7@^P7Z!FYNWtmZ>FY3((s>TQ-AbV7P1_|R6Gw$H_)^Tw{AV_E`IYy*cHHL=l&r+?n*e2VO5f-f zQ9FY+E?BBqj6i-Y-^zC~o;9>rn6zMz>cw`p@s>El0`jh0Ua1b*g5fKbY&;G-SChl% zs7)C9xzb_keonb8SY>V>OHLTjfZ4D=&v>lsohL;Alz80+aC%0ZJ{{QBk|?b7!u#2c z>4i{legq)k1BK6jT!v;Mc;PKJ{amWt7qKcgKx31 zyg0YkCHUI1(w5z-GzC(In{%+*DPf;ZIjmUt0_YxTDl_qcc3u>Df$zh9DZTzCR%Es4 z!@)kh%-Xnu<@8I-Lf7E(((e{k>Mq7>_Kwfs5#4)NJ`Z&qMxrGRKiV%WTf01>C|#Vp zhUJ#VIRQ|0@!XuC?0;oG#5zrlT; zH%1w2)18;Tidm>SA;)HdMoZmvx5 zKe!rVO>BB~bS;{H_e0N=@Aym{INA`bv6HobkMxXN_YAA+lbT;_a(hBZ^SJeSu#&!j zR^sWM!7^HSrDG@v!%wAvNkhcv34EHEh`zoHP;1_>Jn?rRT6LzbGrjHuFS>trI2$}- ztY3pHI1K_Ym@|NvS=`|^d*uz5<4PQhh0y!l&kr`Z2P)X~iyrs+a*w)=hH?V)h_9Y{ zBGnEuzg2|KA9~HaCXr5h#>ygyNlk z07RS-!reuMOwp#g@KzN*Ft&}a>DQn{4a3|*i&SdXX~RrrOerr-D3 z2r(R9x3}lE?CRDp0x*;m+s5Tm7lRQiAEOYDP6%{vOf(U~eQ7TSqrbEgv)dk7Jgey8 zOUU$^UKHdfq=HS2ogLj@1T(xouzsuVS%<_f>Z{mTJhJhsi9p~Y*jNzc*WKOZk_x+}^}yYKm`Bcf z=SaCZVxr@nnNc{GJ}`&He^tO#!@}z@ed;JQY${ytuD>7oLOShC%GNh~ubyiMS^!hV zwlUdbc0T=!Jj8cBuXOn%GtOzZHB71m&oktKGo9YgVQP2IAFHtYxH4c&9INR3BAi=V zjZigZeP>s){=0RfRIzlIdljhPN41^>pa$a?KXec%sJY`PSTPK40%{)L%FiruFsB4 z@Zs?AN#*MenEKvuW&S$be#Mn>rR7!h*05_Ga3H*cPiU);QTEIhb9w{@B)q<9q4H~>3C z*|XRA9<@4+aahJ2N3({vD)L4TBhEGNvKPS>6ukbI9+U;;Od@c*%&N-tOvj$VMf-YZ zEmPHe1y^^7N(CBT7aX=W@q&MF{gC2zfD-~KNX4&a53h@q&rzJJKwfrDAd+njNRXEj z)&nYD+^I8m7EDt5ZbE+YM)0kByH0OgL=^4C;J|R*+Q^rTRDT7_Y>*OdxM2^*wI%N1 zS4#2}*IVd!$%-c7)!p3GU3C@S3-oaKZckX&5R)LuvkjEwb&1(*igWdhryOAk)$yjP z$^`%9Q>Ge5k-n`6Yw+DOb_z?IH!y;|GRjf|y=Ulkwo9 zMR6@vhX+0hre6LJfa-fc38IA&5bdlBj!9b7e!Fa~>2}DgOf%l8XE;JJR`jGuRN^<; z1bLry%@I#-&THwJrM)B25Y_ax>Q&=%*BCv0Lk(NooTbk_nh96^O6xHS!cbf6i#p{?weiX8T9xkpbMyFm z8F1XrAe55lWkr4!GfNBQ#$5uGi4?Ctp&Q$?c|jwtSrFkTVBen`15A-_6{&2q+f4n; ziyWFqa)hZ_O+H&K8rkY`Y%0iDU0O6TpK7@4vz7x{4p_&^;lfBV5Sw~pFVcU|UvX1> zrw{4Z?EbZ?W5P*vabaP`*=q!Xm7^_!9Z9gfA&#Zng5H|W?YIa61U3AMe%=!Z&$R;a z&p0o|ZPnTd^-5gd5!3sR0+%X!J|EiW)xlD^biI#yein5UQ$U{m=6P9&_bhXbXmWucZc4v%P^dw!0hW#Y4HpYt7_Dk+4(uBKX}NtWhtt;$G4%qZDVD z_Z2lREn7}*-=D7>*<7`_-STKZK|mC}RZX7lTQlL7>TgSG>x|<(&f{_()EaX=VDVVF6VY6`At{kLfAz|Yf|pF%-nnwgSP|nQ z4{L+iR}XxSBg!O#xslX>woEkqr-tR<58i^N?@P`bQRJBPY{;9cT#G@besVhNT%Jn` zN6AJt`=99bJJyu^@$zJCCNHHcBCkZp&)&Ue5uI+fxK)Zz4x~@$;{Nwe=-=MBk~PJ< zDdcZ_!~e*G-A}H==I3<+`1xps|B;QWb)tTOib7m{9;cpYWsf^)`kigZsnO;GM$g+&kUelbHN~n%XHB7oH`&r9LOtqoZ(g#e^Tm%C z;4;=qG2?qXIt~M|u(FYSu}b$EMneZ*uNtMZ9pK$hZ(Qdww$-ze=#vL)({Nb+b&Fcc zm(?mV5&Hs>ccNn|IjPI5FHnWea;40BYnuIcL&c*03r>^GRo`e?`9x*1d2jGsjCtB6&m z$*f8SpII$KaSoY>#%7f2vVpO!$unfVq`p5ogaa6d=2H*rw$jYqe}87((4@ zdxGYdl!D+iw?JZhb{KW*q`bO5opa|trfW&SovE6&V{C(7u=rOZW49@Vl05OgJ$;v# zz88HiS5=mpeWx5MhI$_OYZ_n;ONv@;n>*DKe>;0|t|FIZ{4jx$wPx!*y6U|@5!mKT ze`{MC>xwdW7hT-@z1RZKlUFW?p!%OcmG^axWkVgD z%XF6@615JqOBBS;qJx3B&KO>$(jl{t9kKk{fYkAGnb;A*Q?8bmOBbP$I*T`-Wp)IO4rl74OMf|E-|>+I@fW zp&EP}W;4gqo9!6PaZxnq03t#0S|NiJF2PnFVyMuYRqR+KlUVH{C_IV-1go zEEm;;5^WB*K&CVAE;{t71q@lw2LO6MULMPZIc_}d$8mZP*>4N+c=J{%X44XuIF(S( z_r_-ndn`$Mhn;=NZrgc8$pwc2#$@qJOG`8Gs)#~)@~G&js7e(5c@B}Jggl{%`D)*< zMs>0W_eRU^^j@G!@2x0f3to+iq9}A!f#-q0KR0ES5a~}!lVtG+%y+fcDJlUqzkPOv7jqGAhz#>LTA0N2-; z9^q9?7rtK-*@alFDO=y$M@t=Yd8o+#(&GgH>0u^gV0W&H>M?+1dQuuY2?sqyF9)Zo%4xJ^4Le%$n z6ZB>1+kjR<*@*ix;O6@cae&NA6eDOuX5*mBh7aw9^xDy{K~Sj(55RE)lUa#1~FJixE6=ul+Dn`29VdK_igiaEya%o}H zHVU4dU7Ff79=o;8pBn+$$>&=`ox3IK+KpyT8=fjX2Fgl3w zYsc1F?ZIz^qxFFJW1TfFA^gUbAzMU^>2gf>jyPmNx9;q2Fip7Unka3ax4G?TIj>+{ z1vBDu5|Ua>(~^;U`qM21-N1l4z+|}_1y4*uvsBQO=`cu zy=?FS$YyzS*u5T52Axr0OCDPq4Ww#rN9G?D(mipcfE!eG!K0(V4A=WkcG;U(JJuG9 z?`Jju4$g_7EY=x$u9jdxr{i(72fc|eZfCu4Mi}N)fk&kg3Y!sIE5$(e?=-)?s6P7` zs&ABL8!EmTga1x)QsDeEb#+S?2hq7A1s10@f*U#k|QYRJZ~!FSF{n8ZGf2Fhne}=A)HKTK*MtY#_`*!vGpLnAy zxC-xKHOPLC6@X+a1e!NVzLds zFz>@0_jh*y-^dURzDU!raGrywESc5Z)4#n`OkYor&0DBjEwR>qKkL>@(J$y2-`WP_ zT9{KJ=K6w4%i-^|6o3||#9-Nr=@(hHt9uA;!IqcH)0qKHc-_;7w_;O3d`pkN+up6k zi2r#;>0b@hA7HoN{o8pb-~N(G2C4dtg!s-6N5?{b8FOWkEI0O) z%&!`AW<7j%j}}ac+2_gM3l`t&D_*VLrVcJPaB8J?=;X

VvU6cdC`& zP_vg45{7iEloEz{th|jia?$+S`-m@RKu|k=z$*xnV$%>gBIE;YK)L>5DTCjBEtJmG zwjV_7H&>3h6^nE#3p$%*mmlz7*!k%7s!)69##`6$^r+t=3#UE3Jk6a~qUouN#F7CC z%IW5I)ZEGmVB4%_)o1+BQmMwA!)0oJG9>&S=X0h#gj+Wgs@}rJ02faq(5Ck+HGWzY z%m&}O>F1vUxT8E@^yBycrRjsVsmUN)QRZR@2UqB3NJ+p8>)D`b!hSldC(<}(@8Z>z zyNOT)Lnh3CpMU9&#mR?NelC)?9%HHN(Jb@@h;hwX8JH&?8FBOCzs0AVh&Ct+)i@bjq*vwUxuYd#u@cX=66 z?YjULWp3PZd*G&9_E{v*9Ly6y`$l1z`5@d17ODXd~?~Uo*Z<Hkc!81`LC7f%5rkr31$uD{t3W? zJjbNTC+D>VDUG{F$0d(t6v}eC!G@-5G}|YBUMRa(_&`4!5Z?JJT%9Ij3kU`oyN(Nxnm(VwRbjh1CE{n*zA`C4TG*&Ij$%$bg*R9q(C@8z zqwU%ox)XHyFH1#yHlzG9U!L25+5DPJ&P8kHe%fLVpq$0so06NAcLNkJ@QE@ z-~ju}vM@*9!U%2UA>J7*>v!I5O3sBJEh!yZyeHdRZy0LGqqe_4YZURk z@h_T5c%UPDvY@jx?kd=4>TGtYnWyhk(mwBV8x=s+k47DLhIm3|GDFf*dA6KWHKry; zQtdZ)W#@`BEmqyu59J3+N`M2mK9lvW5aF{1nM{1ngE5I^9j6i*P34fWnfsI+2N9^w zz%mhC2<7f5VLELW#~Bb47!bx6Xi@v5ntWmCVTt&nM8mk@kkuEOvAI=VwL&W@J=4vl z*=(kSh1(~hV;n9Bm&NOGfZRPX9dXv#)P5>59D-#`6u&}2V|_f%ur7%(;NzZs^Ubbi zqDc7K`j$FPuQ)vOt;&Gu_Zu5Y*ze_^sk;6bckdb2RJX2;+I>-j1r?>E0wMy^rA9>Q zML|HiNH3vED1jgrR8T;WUZV8g0)!TV1&|tg3n9{bhfqS`8?1fSUhjAI+I!(T*Smk5 ze_XVgImejKc*noHCxWHpCH$t8z@^dwyAE9S&GtW)%)PvY003i7Oo>Bl!IKCuRxN7AP6 z2`fI5V|x?TD(eHaJ~PBJQc-gx&h}1v0?x5*J=$NFmQh^x*lAX~1!v|70OlpfXRsrh zV?~R; z{eV3(Qp);}a>WMAVAYE7fOAbl@p4$%x(YbF*3nf$!pV;UgR=0Qny$exVpWH~kuB;a z=UcQXR-atfWu>}{xG!h1OYK`HC*+uZyY3S>7`9c_YBnY0yZGxYV`tjeu&?5Ug!Qg! zl7iw3Psgd1+=a)G+)m1P4@q7z<%C%Ogo7NQDhsXf*pWL>3XmotDeFbW&D9mwdewLaL6@Oiu;WD5IdYa@FC+k4ScFy3G@hf83x>Y;-#h1>|U}Tql*6McAM_i zkq?gk)rHJpw4ytw8r8od`bxd-x?yR^O))=r2CsGeM8f&_Fs<$!0vmQ=Q|Q;tYuA1p z;pPoxms4o)g;J}JJR2~tkO1h$a~S)+6ISkY=RXnrzdxJoBzF634@tJ?n@VGhbZa%@ z>@gyr)D9#4fu^c6=jfu#VQSpV)hY@t!huI87oIs_As=KUnV33j z=w+dasQjQaQ>1kkyE5yxb7HL;hw12JLZGm`2RriX9^h07{`%ei$y2BhexS^?Oe;zP zmTI){58E{`j4SBHf!Vff6K3;iE%=Ln%=marITV@4bpb8Ce7bDe; zvLY})ndltSC-T(ARXqZ&+MYK6UNXggaz$D8m)FIgXXA*kbjFHgwFs&nq5f@M!e8ap zqY~28UN2j~7Te_MexwblGt8&5YpY+>L(&DL$|_pnITi0U+j4&9-sDMQuuo%mYbgoJ z@U!(%oow%2(z1xBIomm5_>v-gP3dsHFk3x0LtNw&WOq$eYgUbl?mLvPD5GIlnU)>h zrwFFr6w^mr4joT!LO4zWLUrv&x8(b1MalR6rDMW=s(t9=;@|sIj`@u>#@6}c#zb8^ z@5nK0y)5viOw%&-ihB0jGhR$L3FxXyQ@b9a)u|>|EgbbA@Yn;JpT=O;23w3H_fSP^ zVFF)_O*K1jZ(Jm%spr`4RY#(4)xW1Mk2S;Y9#e^VUcSQF+9;WZ~Tos{P2ut5zD)!R=%wUBbROwbrQV(3eEbNoDZUP4`t?%E}tE8?o^d7JU$GK@mV z0PDwtAFtM_dg#f}h4y@F%1TCO#dmzLP;U5sdiA5g2q!3OsEMZjo6BPYJrD1pqCJ99 z2!`#o0j=E-lVgxbVrrfYBRDA)BMk_>2!rF@0AI_{X{F$6IWIK^%lY!wE7GG`t$?HKaWAEN9 zgrQWQ4^9^skO#gipAU<@5fS#C^Hht}u`5cJ_O7gxl8pm4^S32Td=$)ucEw0XZt;Ps zcuSHjF~+5$pyNOllw{%u$Hk3rcCg(Rfd`=aS|?Od9MY$y#fW?%P*gmMoMk?qWE#1W z82Q$JocXp#?-BBah(W9aW&-Oqcg!{ZbpMKNPii#eZAU@TB=wixbWFZ1mFN~h^WcMC z(SXe1uB<`(!vb9oeP)U;+Sp`xPx2;Hf2?@fKX2lKV< zaO746x=KU%56!~~@sx+(nb%@8;-tR&pU?FC^5ST6ns~yXo&M@$X@>>tgpYb;=G=)? zzZh&eX_{QXytyCiI6s{1on6eFeU|8K5$Q&0nfG$!(;fd2mp_gaeyScy;%bTvd(lMy zvJ!VGDupw;!JMiT$d6=zbHY`UwyVDGFFA@<4C!u>_lBE5VlNqF2OCRie#=x0 zs%*%HJ~q(x7NlT?uy9tgmWLnen3a@7U!N2V<>|`O4L?ot?RaH1D(DAf?pRODm>zmf zZcL`Rs=BCZ%;@dhL-c`_)>9U++zj7R*{?Imq)%uUn$uhsUPREGIQ0p5-Td5>p|4v2 zJ+o(%tvbT#N-vd#2a@zw$R%@O!N+@@<2IRPT<+;(rtI;)P3chkUNr*QXjUNY-UsrD z&mBJcU=avUFRHo&Lx>hwWxk6E>5WBKrih?B*<6h6Mp9k3Q`Ig}I+GV@khoXJv z-!i-gJyAv0gO7F=K1AAA9P>_(k0`e5Q9&Vg*>eoUB6kr~4g-wa41B6P2_x<6rkG>h z`_w#12N0zk}q%RA)uxI2Jbpo1T)M{wcytF2!P`_V#6wVKJbYnO?b5 zdjJ9R$@|!061hvAwcFf`BqbY`6~axh8ve99HOKNj$gcB_cuE)As0X*Tb$k;@ZjKQg zcX+h32JB1(dIPYb6%{2p+Omf>a|cI!ov9id@>ngx=327(8=2_7IB1#b=<*?R!c7& zP{#|kAr*p|F@7ct2g3E8YulZ;AqEZB;#NpeYbW}#ExOi_yO2KDyA|!{THTY6Elyz* zO<@d2E?K<50?ilm7vK8J7j&$AA=(}5_T-a(@6@R#Wu4;FXmhzqkSK-oF_@k$B-2p3 z*eZFJ_*z{%hF>*_*R@q^#b^2NcwWSwUQ4LALHf3l)Z!COQ}H;dJDCH9_5Qn4c$c*F zcpt8qYH>(wqdnk(6`#5+qke+^1{<%clkt?MDOq~fFsmaC-+MqE@dAvSsTsj%<#p_u5({pNIyIDG_8-K`(wk{|>r26xL6)eor5pqxX z;XCf!;Q2JOtO|dXR5x`m7B85OTvGhV4p9Zd%~W+mf81W>vd4}){`JVeMy~40Rg<=B zaJmKq?4B>NyCJ{2q8d|}gszfSR+x2n#parP4XWMGm+Y6Jw=;2+^M`%QqPQ(d1+uC# z!^WU4V83Ba7$|)xS7G0N+fy9qwrJ$gCiu?Vp7s~d2S#n zKIzOQzBmNYF6RQHSWVv@87!P(JS|0S=Avk;#=?C_wo1+_78eY0>}0#cieZld}`)S!?H zcqJB#ygfT;-B*|lCV+||JOq`(ksMV;3VI6EDTEdU@G9NGfJPyI5tRQjj4zQqq0;YefB*cjM4U zn%oj_uaPu&+Kf{w`*Pye)v4ZQzq8(UR_dkl>T2 z^JcqE-d*5|TWHLyid-Muy%)i2!VNG@AD`Y2d`mZ;R;P!C$4eW2raAX6$aoaYW(1o` zV8n7FU%anA#&$m2i}&P(8&Ox9G$eu0V;kA7FEPVt8p>-h@U%w(6pr0S^9_AytGP3M zYQOxo1YKvn)@%txpf+F{DIgFyE10OGR*?<#dWvq#A{koJQ*?5s;ZvI$ii&SLbLc)! zr|C3*qDrqfH*F1FRT!nPA_ds5v$rQ9tn!RR7S&ZKLe=OdcF90m3n;tyOlPI_C#^*ks0ab$qtv<-X-DFDW>lZ4^n@U zeJAF6v>m%<__VQG4KJQz0hd%cmwbl0X~=CI4AkUo92V&F$g&J z%FOGN^r2$Lz7KaOeLbA_oIX(}s~O}sewdwB@;kIS=PZ0jtuZSP3yaL4q7myXdDFA9 zvc?2@LN91EKr}jJNYTH?oF|hT_P0t=1AHZXf}-o|zrygKkf1 zF&bukeOXSbLwR$m#flc1hB&01%C#pIbda+j72FMwHs0z%8@o-k#D|HIyi95}-iG3F z+d4a&17XH<>46y7F04b9N)hUtTpA{Q%e}1AKoat zK(E7jUo8xP0LeKmohANkT~I3fxX!yt!)YDhhOgqpq|%cF%eW z0h&r}1;M3ryfdD0{;ZJDoJogu6+%6Jz^EkE$37+T{by`E83zB_Bio^<=W zw$2^PBdhBi`&7dWi8w&Isi@-bwXZb?^_9xS^aoc+91AlQBk!YK?X@HM;zxl+%Q7tD zw9HoUdlqS9piIvLBNVB&QBqa{pCx|H5nOWufaC$yDwg9&EZI&{TNP78jLpwmS}@&VbwMO>ediMEPZ&m4S$%r5N3r!D2;<00${2Bwv(^NI85+| zm}Kgd_1W#BX=s3c)TDM~^oJim?p>C7T12$i$oJFCzjH8;2s{zFh+eA^z?rGRXMK)Lluvl213VeS$kCqEV&6VWUzQxF=rcZIIXof{xB1n76T%`mFi-p<7pwaI z?r(e9v)R#XSmaFI+OMmGUp8lJm2sb{M#lDqQ>%XeW%Rphb5_N&pw zlIgC@QrO`^%HtSOJ1&8f^c8M?eg|Ddhq8&}^%abY6-r}=S_V;Zl|YHR%5Omzqlz2| zdfkq1-7@*h<3Qp7vIymt1T~r3_LRoCGTYC4v7Ea}Is8P}bXQitt3iQF*Zn&6tcNcL zS$vm08AWyTjA3OfE%PNaDJ&H&ufZFh-=W$3{Sl_au1CgKLEK|81XwmYiayIjVEByR zNO=klV!2|3gH(rd*BvSF`XRT6VQFO)B)LY6>?Ptj_-OBi+*8M2GQsz*xi?FveDR&S z0Lk3m>lqwp-BCC}&vz}aY8$@_FPLNacH8NJ%Y&!b^0V_YZ-SXVDzGAITh!!uK`?5f1}a^r$A{_QbST1J@$ zf3|XFz5TT9|1V9Eox2CAu|o%ahc-@q*k|ZogkEU{?UCp+XmL5KB%i!TeFd(Od*+h< zVcI$85~lM-RBstod3##4C8iVtk`3@maLS}gkhV>XM z|Hg`iN_JU4zY?lu@SOPZzbVk;HL?2I?pkxJ5{C7K_M6J2W*c5nu zyw*P%mO13lv_QS)ik?}MY7JSv;9TyEL?G8Dyt^GZ}b zr`#0UaZhPCT!M5(S)IoYDz6{$kOzSIt)UJhufugsHq)Zz_(;>j7!m8m2+I$!Gs*CB z;t^P?uCezfWN-EYj5p-=GK><+Y3R-kfEW#F{a9oEBVV?}q4s^>@;n07yXI{6CYAAg z)S$DC!vD2__JNIUr(0|sSNLq=rC79IO^mlidAi+#$@J4{rbu-X&yc83|4jfUNZ#Cx zhMGhxFRiSE1p)I>kOW!Y{bs4mAACp9*B9y@ygcSuG~^2QP$&ygq5`0p+sy7I^ypJ(EcH6d&+!3=S8%Un`7<-G2x=9)ykwSsn%U%cN41`{D^m4xs<1iO0-~#`NAMoGUdqy-Yje2cnpwwV*6A0X+HmJL$M)X}kVbfi5*#KILpy2t+@tI-T5jZ$;c!=3&Xalr?2h8roP5 z{m-N>;=*nB`N~r!7kFJua#{*q&7c1LNB?aMuQuWSg=*F?hB?0(g|uwyvW)XHO769@ zq&=QKO*Gub+fwGg?n`C@T&miQ7i0l?Z5p#d-wVHb$0fS;$nAysRCOV%mNWIyXmfvZ zeXLmUXt>nn=@~*jp5Gwgi4aM~{;Cu2$qgVWP?mi0Nwhw(*n6;vd7rI?zwepClIJ_J zCWoknWRa)ve|g(~dmeWp&R;jVf|`7@AMF2seS(I0hjw<5!|vDwsfqm_lK=CV;lKZB zb;^lroSbJT-7`F9-~88)@-M2Y|Nj5}lYiwzJ#meL)fm~r^qZ@&kFfveUjbsl zhYlV31BeAnk@txh{_~&zeeL)2y;9`SbLU#X6a3$~El{ZfbG4M=0@i)vAO6Wo>}T1k z*LZ#{ENFZttsyqWUH4g_{hN!rr-Q621+Mk~yW6_$EAtU(A=j8e|KcY&qg#!~2j9WX ztS`Hc?=MRIn;YZ6p-8@vdtj|b3b_92EqEiuWAFLRtPQ&k{?#|d9>UA$hm8DMm-`oA zsVCz(3WYjim^RU3lXlffaOcwxz?sbIaR_E;T zu!Fkh*N$zX&b=iR8b#z8@_e{DqYT7+e~?HTK=_QO!?Gn@4{ergv7)G?tQ_i0msUSW zJ)Q!~N^J*7LUEA9p4x^bXFo1hcgTFKZrh#yl)`INr950>9|l-BifB&AD4<~p+S-5G zbCv)NCMD&_n@iBKy83_f2sT6=N?AD{dZR`~`Ofp*HJWO@e_adpL_fDIT;d|-q5~5K zr>50De)@F%LPKP@JW#oWh|66AU`)CedcHE(iBL#E?CcrPZV6v2aMrx#D`V4^{pD|t z;ZFIhll^Tajsun2KvA7%0*{J}y5E?x{lVf|qK-&Ca0na~7!l52GP%i?Zd=BJ^VxTcXXP%>Zr zRnBE=^>PN?Lp310Fo0yYL@_o-gdRSwN{JRa#}p?ARGa}gLPvDyxi}G-qU^7n%jnVo zgtdthI=}as{_*Md^_8F9eKz19zMUIhFNnu!up!87_2E2e8=D*?mZdcH`t75EV?W-7 zwU=AaNuD*@tC!C68ve98=-_iMwKGpdJFbEy6iUeDh~~EF3M#6N`{fKBDuPPEffw^a(lgN491{jy@I<4z zc2~YHH9)PaDz4DJhCv)OLSYi#qftL#gPa_91CS+|9$nX!2V0uY&8{Z|K*t*LaKRy94~=b?t-vcD_-&U2gN+1P$TCSwJ+)<)tSWlY zPsHxgN3Eqa^R4X7;Yi-tqRNzylA=8Od7z*`en-b;vAc74uUQF#gKj3)U=5+i{f(jK`GfzZZb2Ju;^v=N7pm)3U*QM$NEtFHlKg>zOm4`R)?GY8{fY<-(`{VxZZ462AZ?tZquL6-y$j0$4ib;^X+;Z z#9ha;qaBsR-FM<<2MSd9;LY)6M~-Z$Jbp|gxduioQ}b!e@kn|}((~#AG(2agyK17% z1XhjMsXt^GW1o-*SZrCU3ag{lSQZe%%9(nI9PM`SHW9;34T*4T~Gq?b5 zux0bRh+Z`V`_CreFj0O}(wwsTn%~Vz$P8#p=){QFu%Rbve-@6}T@&DLL%zehrge`8 z&U#kXTJ6vMIv3*SNhelH2jS7Zv+Byx0KCgbn=yl7fYWmaxKjr`dgHyehOzki;&uD= zLO<_~uLc?9&Fw%(i|tp}+ZM~ANQyw0jQUt;O5@nqHwi_tBwtGOt2eqOGaXhJ9%`YV3_v2?c3-i0XU2TSVBxZg8D_ zJfILKP7u@F`ST9k3AU{8Dlp44EYnZ$-a2a2QxaZDo<3Psp-kEd?p-WrAy)kC(2$<) zN{EWOhMk}0SsJJC2&D!`QYo~G!3pb%V7@#CAcY=lZldQ};?X{Lh4uG?t5J2Vu~brnezgvu^*-K%(}w%m;| zd0qN+@7B=wW6EHfGdw`zmWT}~ce^q=U$GD(QEZoDtv;h~d&we69x@u8#oxlPeBH#P2RBSi)Jwh>C2%?xSId0n4BKXtNeVtz%ssR2^SOO(@WR~Z$2OaT1J+_b zqm6Ldo;IziFLVjvgT1)j=fKU>*$N-c1uTCBN!mYAM_F!ppwY|Wb3kcO}(j}bryrzkPtS8A0^(K%9kY_5}V>NcdB;Du5BTeoeh5z zp3tsn1i}-EzHc>gvBQ6x(cFR(yWymB^q4;X&HMK{LqdK%A&v7?#rJrVY6KRUwu=0<*<-?pW!W{yy(;a`wpX{wkvH|?w5AG-dh$uF9wK zv9SGo9qL$vuE{Q2uoSt-d!;K497PB7WTu!6b{{1BZ}A$G+%0h+@TI7PKU+5`w=b)x z0&_+LcCB2}BBM`11-MAZW#XPi^P3pc$xOihDK}mvmvn~b0?()QX|2phQDrRDy+Qg% z%yI8)CO%8=80~Kl3{=c?*C~SmNwO6_*O)R@3&X%e78e_g*Fc~6BhZ{uNbnjrSze3W zEvYhQZt`F71eVA8UPL$4O)v=&{)KlBs-l?KOA4vi5BX-q2C=eQoK7;0Gm>zx>}9w4 z?M7m5%ySb_X#F-yv&yz(ta`t1zOD)z_7>C%&_2?9b~6QSS8q$MRvaG8Z!9q5N=BqF z(It*94qeS4GrF@o@pjcVrg!E`Ld+1&N3zytcGDqt21V8xpwpUi$*r!%NYH#z(Gz$} zkG9n%6#JZJks9rC1YFnUZ-IG%d|c`=SMW0Hp{w&9CYJbUD~e6&P`O)11wNLZcWG&< zy+Do;gya;X;2`5kk)0HKkaaau*ViIsu!#DW_=+*WaZSF&d9}`=_j4{$1K*5JkBk6- z0(hDE6zZU_{#iQo&u-w^+sK#K4Xq1ecE@8C)(J$LNs+zrIb;N}U2q)c^Qco8Lv-C^ zv!(zjwP>%?w^#KgHXxZ<-Z{QoGQ*GCh?`^`Y*Msozot2eoVh?)!=9w1VN9HyXl+Qj zALdGsM)qDr{tRi}w9aE4uI}SI4UPCf6sw7=O7lC3-|V}UZXMd1dr~#!v6gpOXkX>o z!6Sv0&yTHH6q%66N%?3U^=n=lF_s4GoaKV0IIgPxL|L_+sp7+s zY+e$Cw_#(MA|(rR#Q6yAte$eC^?3r9R$5C4f7O<{vF93Zw76aFWEsG18K}qI=4O^~ ziyT~+dUAMlAf7M#Jt~UnOi#JCt4-JPMFYu}rWxh%L3e=b)h}>y3t$&=ne9I-GKV}# z&j(-se^_OT0D-u=091lZimcxea(f)U&}?^*PmDP}o5`zfV14zkC*Uit5P2U>}+^3K)R`ST`)==8%3OfV7(F5Z@O2b(^$jv^UqZo^~(QF ze|~Qf3*T3R&-lk`qoD4~cl(UQdXJt^YF|bt^i{rN6vS$HNdn?E+Ni(8#wHTDQWrKV zg{7vJ+11h3%lhDU1ys+`(P6iEALl=yWtF)C%(*{qZ>}JUjaq8kIT|fK(!^#NV>4Cb zrSxlqSZ)HDw@=?*pR9krE>lw1xdfy=uLnb;nTE+b2*-wjzA%fe&VpsIi3zvR0L@|` z%+!hoc!#@tpo1j&9X_;``ln27hY0(=!ZM@6O=?+g_#U9+vXCXgjO4wdrde!zp+1s7 z4{}@zK3iHr8p|GS2yZ;rk|SvP3bZ>0z6g5F23%+)JgEYhvL=ys+`}83rOtsO)(>z& zj|3*tzxtpjn%wIK^G%arj-BaM8=FR0oQ>D&q`>Al0X17WKiO6jkILN}VLJdi`y&7} zP^7?f=HimfE_$xHir&!91T4sT8;bQt(y`mq#a^FxebggWd9U&v;iz>O`1BM90Qhf_ z!a(2n5_Dq`n%D#Kzrt}A8jZGH7aqRxQOOd2N88dA8K{vXt{D>z`^|Uw4x0+iq`PO{ zAVv>;{%F{KF)E5Gzcdd~+ZkpwXV&-u2Un(le(=w5dC<1>&Xl9SCF{d*pcEXKduVxG z)R*rHeRF*Al3raV^R*>&lCx*lrsd!I6K%N9>Kj&VZfU)Xx!vwxWJ8<iiz&Sdl#22ipbM5%Ym4cEQC+#}qJ? zcQ7%E7KNn}tBSP{gdY5n9U|NgVIT(ca)~9DHu>&h<*(Wk%bS_Glj_Lp>ybbG*X%=# z3q4X}^C+ar3;-wsF zvFydUQ{5N%6TAo3X3Vr!VFN`UCexJACG8l})xFHD4KYJPRa$*Nt~KiveZfY2leWTr zL57ZRBO?d7nKF@U`#5P~;P+o|O}fSP^{cJ?BA2HBT&Vv~QKB&7PSdv<(Zw9MneoJf zaDCyMd7dk&AXqPjTG*(UuDq_U`tn`A+y_2C!0S4}7veJ3(7z~!89I@DTlOVj>R>DP zpi%&b1L{{m!E6M>XT&QJyPm!^(69OjMqKP5Sq^e?rJlC$Oe)#qV4Q9}FY_vXX z&ms|HOWHX+?`5fbu7$JL2)xP3y~SE-@L}&&WS3`-9$KBnbJa#1KI;*%6RG7az=d}X z0|3VOgRFfM+j?~7fEL<`j&}R~7j$pxtaK+L?sC}O|7n^2w49}>N53^(C{0{JfxXA< z*pb@2yqx7&ZdO<8P&6}Ar=S$yUp(N24+oV;ifXi`pli1wfZU_b^Xm5=A#%LwBeqfD z_*`9cEYN^juASiryljd-K!;jDCG!2x$}IKDX@0(gL@+@fbSzKXIT9>vcV`E&by*UK z2O&M=8c|T$*vj=6;oUhsS}@uA#e2OTc2iRh?^r=B)?!AK@r3S`qEez5x-M5c%b%$6 za=Se0fILd%3WVvsW(cc%x?*qyZwpHrGI$ZZ<~ z=s*}px6~4m^AGZruwKPE#q)7}X7oJzKaQ>1gpe}3?BD#HS+8d4a$v*) z?0=Q)5_#UxGDoobGFZ!O9GZujzRvDFS@blFGFrsen_+>eov=R5r7xR zzMmcp_1&E~d0D_E+k5e=?`#R$Q9c43*Z1TO7Xz_GL81{rG>n!_B;@-c+uD3v`pWY5 zK*k`G(qgu9XTU#)S4D+QJYgu>1gqSaNpIqGoUl{1iO2W)O~FG!*O*yZRE44eH=C?I~eRF#-ZLX&|1I_;k;f+0ga?JY@-NGXJBX zMZ+@yEsIQWe-<9{>zD94P_ONO?L46btZ6f;dwA@%zu~cip>E1x8Uy@Fk1hZFPPG6S z!S>HcBgWMd?;2%74^V_LVZ-f-s?BI+=|C!&8T6a%2Hrb>;L@;oHVL*4`Z%e#7?Er#eG82@6Ke8df~KMzOj<49GALThTcGI-qjo^vBWZ()u`Yv|7~dK0xbWjU{`}uTDv_HR0fM z45=pPBvH=OtInXGn$SDyg{w{OsPmkC-QoUh_PsdPp)1QMVbwx1R!g`b=!;c?54)82 zkE9p(1J4H;4`1Bh>-vvMXrt}qMA^@X%XAEjE_XeDVS~ z>wdJl$3cGDOSgqpiMcSI#wdaBmly0wxy5S>(B5OGn4XrS27bnf1g=dE)>KV);S)TT z`AtLlbm6KF?Y*wzF6J2J@Eg5}_f=+3Ye>O@sq>h35qbFozu0M(N;abUKx@Dpi&)3_ zZc~p2CO!krp5mmsAb-y^rFhN(`329-@SZu=yd9Argw=1LQ9e6wBK0Iz%&|b%#B;C# z5ZP3n0Zh2Wvr(s_(3NuL95|UB-X6d4Gs2K9=ia-gI#{o+GZC?3zJB*-&gslb?Y1rN zEYAjtx=o+TGQkBAo#gO~Eso{0w6>VKFocSi#1#Uf z+3nf91YLKPq92Ek)7A#Pvs7c`k}yuBk%U`Y?Rt(dGw!hpyc!`xQ$0JI^1UX!2BMhS z4|L!BPaKsYPs)*d7f^*0+fkWX6{&TH(eh{|vd-7oHIY22sZa)9L+YD$7wpO^-gei=jigltC*zW zO~+1MVq!Y~()>>`XVHg-Nz(HhEsNw+8x4+a3~9aCFyjBE7XCM6l9LTha^a&0c9?`p z{Ee=Z;vsw9KXtdDcl{piVB;1WMVv9QdrS4lcEwhX{k8Un4yO{KsD1xi6 zXG43M3cc}eYGY9Fi5q94ga;pE^}BBQQm;zRy>WDHik2iL!c-+llzD0y_lxu|AxX8( zVn*)rPc$g%Nm_MqU>;HH1f7EB=!=||#qAtE*2gPmvOsx)ylpIK)nboBE+*Uy!#H$( zI|gC6cnA(q;skQ5PfLues;{fw zBI%_%k{(LtaJD1PuWhtD{h<$H*8OzNH+Qe0AcAAb>Qo0Ie<*2|x(=o3xDf&;7E900 zS2%pYij{{+I3N-yzzEYJML9e_#{lz2aj4C#E_?Sm`_LE&Q}@H-oe7nCbl{Alx1VhN zNN&wrC@z}V;Mk?1g@S|)`jYrVKeR|MFCOkrnQ>!(+*2RyiWOs!h)80G zV!MlM%%H6ODVJ6{R+TVX4{N(~a`Uqgh8IrK%df!NOTS>(NxQvvc~q`m1$GtY!_BcG zCC6De!ly31XPs~fNR@W__2gL(kQKaue5&z-_zt>m*PYJt0tqzVg47;nXuftbsnZZv zj=XW19QGnc+;#MA!uX$#R=)+qCo_ITQTLV11#j`2|E%Kq)qe3hD$n|lEu;Pu_R@cj zceH+CTpEuvk2Z>Kk=8`B3`-V+&2k=}JW^%lXM`Xdq`sfxHS=F3t%UMBILoEw707nz z^krxbov$j5UUE2crqukX^7)?*m}1<(vN_(Po*{qeUj$9Vx78861i%b7(@Az>KYa?x zd{WhhTJYK4hm9fZa)o&-*A9{V ztLwwKU?Zu`?8tO*d@xaI;_wTb97c>(nJ4|p8q1gd z=QsGzKMke7{&?}*6-zKfFS)4~zy(EL!;d#be|OOjx`t06eFyJy{8=GMoV(zKLlgX; z-=++Ig03nutaNN$qerXGm$7;g^<@6E+W%r{{`RT2i;k?mLEx!Y-+c86P2GRGll=gD z{}H|R`IS@Kp{04!>iZ{>)#GD6lkPJt!~e;P@b|m_^Lg}d ze$P+k!LQMJICxHMVd+8~eY#Tf^i#nU6APwv3Y59e_z_CH|xM5 zdUmJj^We6AjpY2*x0PPaO`7kFoGd~2{l%C1!|>DIQVowZ|HT)I%mmj_al@mDfANLr zIqtMBByM;J{k8j{I^}xEjquCho}BUMzxv_PbA(7}+rB{3bNr0muL9KXMZNz#5crh* zw5qx?`0IJClK$dLohkiePm_agwc-!xV8Fk11{)S00_FyV-`@oH3hdTAJ9Y>t-xPsP z%Ax%LSgScWLT+f^P(dic1Q-K<_xjs!kHTlS8+NGO3f%?73p!ZalzVpNc0DYJu{BK2 zqjyi?ZkV75ao5y)dBG@QV(t4_`!2pbb0djjQEH-f`xo3X>XH=|HZsl&pZOr2b7!Zr z#En2Z)8U)0ece48xZJZ%8Q8ZCk9AvBKd6{XwaW%zX{*W|ADIG+891dUmh~}KLL^%| zP(A`A(f0ybZ+Rr=kn-z+C%EI$6Qe@X2_gujeaxzikF0N%<%h_Mg*nPHo?Uvj* z)uL^Zh=pp6oThqhcKo{|yp6;2Jw~qK7R{mJQaPXdj$l|NkpacaQ;gkN7t~lBNZ#vo zjnP*t+^l=P4SKC>fnME9qK6U2i4i(fzQ#BgzYfKWt1&!AbFR$-SrYQL%5LF}@CJkR zto}L;hKjtkKCG4Ftn+rfCP(1wF_5A37X@LrXbWBkM(71QFlW2exD+Viwrnvz-H6XN zTV&E zrHq2!*=n%@lA$W19Iwi|v{3@fq!#`*kp*AsU@iKK_oM*uiaG?MWi`9#6 z=P+Agl6acUt5+__w0r*qy|8qGfNO$?&7-#=hDqu+-KV&J_iq;UUOi$^Zl98}=99kGDG({5646Tu z8}wZGZd~F{LQ*!F#a^vn^PzgPIQAEIB_M`SUz1;&U_x1-6GFiYt}#73R1@5>QTK_G z2u`)>1=qHT;+u0S@h266Sx!!nzkGkg>swVB(H2Y)wrP)Z9*D!M>gMQKVYg0|*yYUw z&(w<&C`??B@Rn3t>(WJt5ju!T#ui$Un`NX^es5J6v!58hoqTjv@(+{Uyb0)(n#IU| z^^06n`H5fbQx=ko)spPz%U>V=y%)e@tO=u z)vMD>L+@zrA& zC`djeqe{54cylyz2p0945$nfu%cQR)E#k{+`y#MChb1MY z4a3{31_~`=>)zA8exgpEwPHC9M5jss_GN49B4&guh#-HO6bC~o%!G=<7{EN;`mx(l z_m(vowM%O5C39-Ad^rl50oP)#>DS$TeIntkLqNBJ<8{rVd~U(;fmWnAa<=rs&BxVX zd}7_U#0-VW`^q>bNU@YCZ|Z&vB}D2;$%jLIt2XprQ`)>xbA|&2W@#ucidmiSvzFu{ zXwvI!y^0ny=v21i$Gn$<^*OOY1xzf}PuZL@XqZ-3e6kc~o*_Ay1Das#cuqC6SF=}^ z;nd9a*i`LBM*=y%#G~FN%b-I4Z5Bs--JSl$$8P?Ox0(_U6642F2mfCkiZXq}OX={E3d7M&_3kK6G#{e9V-TIoB#-;kO zdR=DP0`ybzS&Ss(&Pr+hvL70@FfIT3z4kG0@b3MuH|}>v9CsEp2 zI(g`vs%+3n-!uCcK=1BqG-QUd}f6UFU zT=&~LcMk4_$NiJ^%Lgpvch#M5WD_bkRqht$Yf&PGD6eGj$7wHLc!9i6U6B>IE51!# zbDyi7sW6Dw*FO9;h`GZ44LMIE?@OJ*HiG0GJfxkY*@i>KZThHw`2iG=U%LfVbxbm~ zZx{P2pV!##iyyoiJk`$SoiJU|;5)c;JkY`g z(r8J`B49x(5XMkN01EeSEF2+;>-2S~Y4A$2EmE z`9F-Ec{tR6-0pv^q(n6+GSZ?D5|O7^T%_}^ZSd-Ix`pF@B4GV@B4KRkgLjjMtFc9L|F%sc}i7!M_|MV6Pnrr`PzQCYMRQ9LLeiK$somUyt z3TxJ0h%vbF^m5@riU2W+1Xli?Cipf>FBn z8v3vMhyUmC-MfT!J;?Ss12?Fp{u=kMH(DdCAHY)c3>uLTh*t_i$E&o-Op_=p$;hek z5~=bhE79cT)4Dem2C>ZWv6CE^JY!K1%5K}=OVQ!#Rtq`KTKOUvPG55~E_hnt4gEd! z9%GT}FkmvpA2e?VI0Nfc6d8}D2L$GDol$YPMuiBjNh|_S8vr_}VO#R9=AdU^l>?q_ zk=i06tb@hLk7oHj_5n2?cI%&u`@YR#jSff{V)*YSp!VztmJ?81YXA*0Uy>eRFz1LMhXEX8lLaN?(^WTR&-o zq#qnw$CCc{VpY5jD^x(eYcdGGVb;g8%`C8l&P}|Zue^h_&ZcG#rb{8Wo9RMr*dg-^ z9hEFV9ba9hXN!X3LK`Z^c>J31$S$O}oAIclwE@@5SJluO;F`7T`;_`z@)sbc&!{2b z65RZk?>iTF98QKASGaOf_Yqd4sU)5c%h7MrWoLsm@5?Y~MST_8Skc?^PM}`eVu!39 zAvVmMRgToYw#G?_BfqxNb(xc{qL4PHln|{7(}z9COe!mF{KQ$XBIv4Ly3%&RKR{I# zpQ^nW+hC6uA}<0cPSBR2NW1^J&++!~#Jc%KKy%!2p0yhIESK!?D@}4*F4{%WuyDsB zeDTQ-Da)H&x?}e=B&B+O);c~>&MQk7t&~A^xu-)y6c95WnTn<6SD^FuseDZPp|8_w z%~ioQor1@k2xXRy-;a3%6-zb9F!oxvQ2(=p5A*p`zx%i{w=!w1Ft3gXqUK=n4PbC61X*m!N znHne!-jR%rs379>*Q+1r9tDfca@$75UUpr-SZZ08QH5pWlksi;(oz2H%P#B~;}W%> zhpwhqssDB+MM}KZti<*OcD|q^20t3|YWo#SLeos-ld%eug&$xRWgBfiRGgTC`DFQI zg_Z)xAQ!=V_C4pl%S%h&eJ&K5m2t1KYYSktc^LJoPxq_m+n9vLbNM%?fJ(@2?%Y@N2k*xeX(so(nYI$& zyo;U|>`m5%6;-p#>vD^mIa)W@kxd?Q(1j@qLG!lzjn!XA3u0sZ+;*x*Z1_P}+)bIk z@h60D4<%6dZ}hN8g?g6!a(e`~Y&;j9g@X>hE?g}ls(G9zWXqr)Q-OJNxJQY8$i{lg6AnDnDAimZ;{dV>|xWkR_XbBnA7R)ZXW!0Z_!__n{}*!LC^f4T&ArLG!_cIpDEcBXr&!_8^*v z@}Dw;aSMO9uyIgI`!=-0v&g*+5A9KKX#4Rt7OAptn0J3TWbosA&Vy5@ZVdzH5pbDF zk;Z){0JwFC-wd-KvVv^kU=;^VZ0;nL6_Nt_x6ksFz3JAx8oNT3@A z*{9xeWMnV<5edGi_iM zHDf&wNoFZCj>*Y>V?075W>3SPMP>2ImS3=St#g#9=A9^AFYr4H>0Q_Kxf8VoL}lz0 z6uo5wD5-__vn=v!!dGX!#oVX!KC$3VPDv-Wsy{>kXUG`u&y&`$_iPrpxwZwBy1}TL)Rn*`%_M36oOO>%dFm1!Fxhamz_e@gZBN4^^p;jYz{lB_Qm(Vo@ z@6bU%VMu@gV0WSDxA&NDiUc0DFcMySr{k*K4aG^b#%Cp*M&rBrS2C2tfLF_gT~RR= ztyagIQCW;HgMb~;O;G5&%qX5DT0U}Yg^^zJ(WYn5LCHQvNT$b_xm~;>+@hB*6gw$O zj=ml=dPtcpv7Fna=z{VLe(L))S+&7^#|bk}rDBS5WQLOG&n zI`x+E^~kH5)I%Q#vaItk*}mqz0OhGhU)9hjkuL)=!Fg~N(d=TJ$5f8-!Kc(hqp9-n zmI3!)^%7kH*D{vMB`{&Eeq{~L^LLKV~TXGq77e$k`?KSj6h??}uO^ z3p}jH*Ep>%aIn;d>Q8eMfbTEyOt!lm+n2Dbf-@S8D)ols8xdEzzl|~ zstzRRtgv&?cbc*n;F=;9;Za^*pv7?_8~54W;Cb7`tDBV1q9%cEbG0R32rGBxi$EIu zt4sY2SlMXYWJ7U<^@_-WjO(r9`?ll9-2&9@G8F?-6mV>KqvpNRArCtrIml<-%~O!il~+7|>N_VQYUW}n??E#|ZphU$xm!i@T+yLq&zIppa-K3O)}^-Fbj(bC)8~gGyS;z=?}i9hm!ML` ztUdC3b=XD*q~XeD`w1TArt{5ik46IwzZqcOk@J=PK&)F^;=8Dd5JpHLQn1IWAuCGB zbOu)%=)~S7WO+96-w1gJGRKJul1>Z>;zIA&be4aqo_^OgemOXpFCoR8^>-^r(j zZc{H_(?~cK*N^{kFVhDezd^p zC!?RWqYTufMR#7}zuOP$c(Fde_z+jaaXwZ$UrOYocv*!%1v6FA#V$Y8l3xMKjizwz)}!GOsO;FhT%acQfLyG(2bkiW1nlFrh7 zok^u%lw=xaSDw7L7EtLwR?2|hqmkk+i9)7fq3fR5Mtt-TYhku+VdWJoaoGc z`R=dDkjJ9De|Pce)@3I{b$>wawCcMWEsRXf9djD-30_oudUSsf%yC(ymqfb1iY|dAgMAfT zsPy~u%|2SJ-s%s3CEbXfVMhfvjDnwi=(XWE=Se*H`sUMgtz&$)@``cQ7m2VJ?{fL& zLa&ctyEHzW?sE$NEf#TfVeb9@Yx4VSMI|$7H)lZ3b7$L7SKGbgkw0nqu~aJs-=G}u>2=9?G0t=J@N?+PidkbzhO?G~**JyxLjhJVg2y%o zXvQV^m77j^F(atgGIv*Jz0Z7ZDgOpL9i})WD{_2EI`IN{0bL)GiQBJ+<$1lJQP+|j zM71BbJG<}vGy6t;U^d@0_^A$zN_t7})ds_U^V!CWDw$D!xp~1D;{GDx`+EM{D@e-W zsTEAN7X~=sZ{_P!qi~69{LnJX{a;voWPrgxmG5GtQ!7jz-YPvVe&r-xA7Q5$o2nFM ztd%M5abJbPe%TYy-#C(Q`J&nuI5U?ebv=^Fxs4bBCZ)<_zE^pyRz7XB zx;0&QD35Ot2A|@W3{|bal^8wL7!i?$#uDJayNX(c&fdoXX4%(w<_fjVl^(ZTet zo^?N@QyF`2ID-DuAdso1J4KM74=~7^nLpM5fhC&YHvgt)sd@OG_xGGnGA^6XtWh6~ zC-+Aj6Bjq`e-86in}iX07e8&Yr^xDpMHi_rNf{&?CN_9X@0nL|pAwgok-JoRlZ2+A zMwTBNpU8G`vE7&0ReET$>~VIk*3VzAzT%CQV_>op6l#C3SKor@qE!!S*mKGUZavBd(s@_%k^%dfu~=mN`#UK z!!u{xW}6?5K9N|jS(a>C2sB`Ir0sVkZUIf!4S+1+kQee5S<82?oTt-orZ?#ZJmKK? zS2=~>Wq(c6RO_K^Hz3IuI|!u^Bb^Pi$jG&JwoxgIR~6(*+^bQ)F(`o8lS?XE{8*z zR0NJAQRRH6By@Ktrx&u%P>l3V8oEE@1Pxwxp>8EJ&47(SvX1Y3VuL4OpQ^usM7RT) z%|@Aus{8o;yMjkmZXB^RkO@9h@}VyW@b9g?&ZmKGet7_=M$$iKs#ip3<_${>UI-`V z3m?dKSxZ=zdj~&3iT2d^QsiE=JeSM7=M+IqIo)cs<$^M4!@cS&-#$DX6kIR*KKiGm z?pcjwd;>TxQ^qdgo~LPFs6UP~du(rkf-jmZ!|RplS3C{YVcP%x_#*LUKX$&Z zStC42W9QmwH5BwW*_1{(nN)(n6F*^OEL%nAn-eG%x}H%4Za zw$9i|FE+{2&;VCcV-92^A!MKb&TLABg&oNc!&X;iTKR#Ur1v$?y2W>ub*a%7>|!u` zr!3|am#o2MZNUdoQ=nr8tao_Z_P5w;)S@<*`_6J$AI5g81U%g55RkKl1uu#Ka3sO` z)S1K+?6|~Z49lGMDp+F;+$+=87p>T9KFYtMi4sMJ%({OWB;H9;#^PH^@&kW9RTKDq zhxae_+|19lb09W9NwEtgbFP@x`a7@=1#FDZj239Sb9P`pvTU3@%fI@t)o!vl0>?>; zv(gGJ%b9Wjj{&pg^0!NqjRAFc`c1%RvVp&Hmn?C@mFedTmEY7}Hv@|I^-!}POVK3P zDAN~tJhazq(*tT=f;kxKJ+^h>z`}QEpreAOU{T505{A#WGOp`goow(kA5#P#QLbl} ztKcItuv%1O6>}jw>fE(lt9|}{zR1q^ox;z2pcF4qy)N1YefIMGmpzKHCPj`$Zj;~O zedy8X;`KU-cJ8aul%Y(2X%7qJJhQk-fN5R?bTdxb^m zCQG!xiT5!jn?b=c{+$e>aIskXVRW?u$^lN#cLHEo-?T77lft z|7O(;R!7~`hM|#YY-r#vr~SqbJ$QInQl@jxzg%QUZs8hCl=c;|+gfQ{WZY2AdICQm zj#=RZ(FW;3z1(GVI+|ts?2<}W7c`VS;k}K$IN6fpSL@qTYZKDS5DBLLxCv1U*O3}& z(0r|7c?~`9>%r>9!LK}Y463CxZzdcp{JZF9R;6gv=~WI)(|o>LRbFoFjX?b9Jny|? z{vq^9lG`*3oI~S7hI7+`ueQ5o{^~|!xxlg5{7orU?46f8KRFF1A`HIjqVxX2ctPoY ziPDaH*tyr{!RCMXR+{dqM?c_x6~y-W3(uAic-z~SjkCs8 zR&FFLYL`?0gn_hs|L7_heP3$mycoi~NwjP3PbY-!V>odavqTbAXiA*-9cf}i&W16) zaMKuuW9%u<`PvCkJ9SkF(WneLc|C)fbYr00e4kIXS$ntX5U|m^v{^&)HB-6!3gfRv zFlqbdxM3LxE(F?6NN?d z%FYFQq)oIRo<^pv9^P)#!DTE#q#S?8b}#`GD=>6F8UTVea{+x~ONZ%Fhz}i=5ZSJ4 z(9jNx=>c0LlQT$}UT*U4)9eN|T`8<_N(AT|7oWxd$!+hAKfnCGBXpl*ByH+Z5&oNY z<|Jc>s@Zu>{Qw{x+Cjq(8+J^8`~oZoHy{Hq1Z3Uykf0Uw8e5}xhFJm2V-h;qcg1E! z7e7@W?8dq1x1 z02MZJ-*e~Pxnr-jj9w0;;D7}fx0{~CQbx(tm!mJOhhA_V)qP^g2KveKMw5-gPkivD zS2a;tSf)_VghJd%hOf2@U{iJL><2HahF?&E-*cEr6{L-KuRtoQob%vGnn-eFPNu4M z9fY4$=R09$@Qo1JmjQB(jb47M|63R7!njvv?WsceXuNG9*JV$!(6ewu!XcBtQgd^g zbC*po2kMx{ko>I%0iv_4OC`>h{%yT>R4;Z)ADUG=5 z0a25kb(7aqRDflMJJNbJ1@C{m888|TsxkL!pFy=1Lao#JY<-_#3a&T}aK|gUr~aZ41svOGbt(n9x4v$X zx6xi3N>;`97tg6g2U0NZqjVnIkdo&ye%k2r@0h@-tGbDSUq$(W2N02E9~;oH zQ8blIFeJ#DnGDF9_tC~Gf%K!CodF|?Ty7uUgof(u1Ff6qY%@lr zcbfp@z|M+no3(^&*dyOqG3%O{J!-_}bcaFSKRF3pQD*}@v1vx*Is-FJ_y_lkWDi@4 zKNbufuJaZ`KKB;QExk6%>Kf78(i@ogiN(aNLAnzK_+!dwt)C_lvIq z7aNd)p=svW5=hw2a4sj+ZKVF;lu6Uv_}EONtK%gdmInq@8XM2;mkL2!Y<(Mm*P=_V z;N?>LVO$qwQ~qPmN}ebkk(G4T!%vRm(&l}=9Q~yS>gTzxd|^&{pdrk{vkPtk3eG=o zSqnfWFQ0lnx$bvsBRn~*yc*-kq&*KdK4;AC(Ug~`($;9c#Vf$H3c2;T?7$9`KQ50d zwd(PN=f->?`&nY%H0op0h6!Q6}V_kBC7wHKKvaH45v1=WSm(H`YaAT^(?WKoloZ1FIugCZQc58 zNe7AiZssP8T#K!0ljj~9?gqditUqdW_|Y%6XRTwdBxQ}9P?Vz%wAgf%npC+;Fi6N0 zAa9l!>s||EE*}Y-TyYdLlV*Qi|2JAp=MZ`{%b?I;+UI1{{XqiZo4Uy93%bg70+541 z)}}{sFe#_(xsblW$^Is-PuEVQ=jkOE>et_h*qZ4;_aNyh1R!iSx1v%ME>N)Ny^_J%?=}I@ zFMw8;9ZKYT1KY9&_vzT3P#{iq0XH^vd|@n030xbpGRTZBunf~~dZdLzd%X;vEj1!= zPHar&dQ3Hq6(Y}2@^WJA?&=;SeBZL^Mi#Lhj3VnT&xV{< zw67a2ZMC7jQ`L<9XM+S3nVascs#@5mzRROp9tDo*F$s3kJCb2-1i zhsiJ)b3ya27a*{BqFn`$&7Q3EC_6}%SZDm{KUMPsU~pIuQ`0WKhQ+?hdj#Nf*^ZR_ zbv%75k<$Lsj01m}!RVuaMZcL+;khXkXFC+#`Btn?wNrPYkrS* zWnd^1@KuA4Pp<`KTZ{|{&u^m<3zOxR_}q#Mz$pK5=S8m3b3OceO}-sTlXxJ6b(0#=*h5Fpm>T;Tc`WDuD#uX~Fv^ki_W%3@NT9 z)>8O-Q$&|z;`0g)eZ>>S%P~g{QC5%wDBK|yDt~(gArSs)y@dd&M!od{rv4Wu(q0!E zHStE_?hR;%J-cPVTXq^-{5V}TDAxa;t6m?BN}+a@PZJ^8oi{tWCH7kxA$Rw+6sHB5kbsFN-;AQa453z+h1^cz@C9gf3et0&29uU(3K$@oyf+pS`zf>Nc=$r0%}x=eFBlHIJQ) zuiphyxXb87zCD*ObR2O@sOS`^u&q$@roy72uKJy@eLmiy z9+)NiUdxLZ4AIiJGG@_V{MK4AE>WP1rik*%U3rMvIi3d4xxpZ0_{u z<=TC*sy@e*RAud_(l~ztHO-m#$cxS$GZS{`!gsKUyxjc)627{R9$JR|4fuXkAJri6 zd|3-4AB{9Pk~hQSG=8YQxBF?9-S{M%EezZGQAPYiiJdyttgk#8&fGlswY^Zn#WeUJ z{ubINVOFmfTvZ4#5K;vOPK^}-InN(RC)}}~yIgz|`*peCYw-&~Y&$OINqh>5d-t8! zoz3e!^Q*8+i&b{mZ@`|uEJIg~IXkQ@AZz0~#cZAYvgZZ`?12~P`%iociP;9fbwgX% zdK4Ugew^=$In3)nKljV7u1^^|S;@T|J`y*hssG48Qsu;r(>x4$i_#5HyWx&8>Z1Ci zuHEy4ugw3=wh{;qCNo&r5De`|y!XTZE;IO_ZrcC4E?tD0yxfn*6~azmaw`<480SZ@ zJtOYjfoY5h#dms0B}Tds1@25mMC^OiEUE|Z5miDI$BX`1{Fr;qz4wCz5OtiXNky#B zNzCFW8|va=cjU;lp7|F|5o&4b5bG4%AYLHQ-6+c-1SM|RpUDL&$^J-f8F;JlHyg?A z5tnW9vN{NMM6kLsc=vf3H;-wVVaXd7y61>}P441M&JoyO|6DncFSJEsht@|{I#+Mo!4e+3xFhyrOWXEwdR@r{dj_9(+QBbjhiCk4vOG)Q~_ub zr)BHFO27zwveUTS!hvniWr0h?@Xl>(V28>Za9drq%9y=EFAh^_V&~;bBN8q)V#)A=|o_dhT z%*wfv4k|gu!{oL|yk@G#hwR0r{LPwInO4Ms4xU=epUQ(!Guyj2Pb~QlP7XKZImBs9*89wHY8!n0d;2^I-5-`vx|lif zH*E^uYiN`4s=Bz;%IbVDbzmE{ zX{&yrvaM&%?1#AeMbfmzk9_}FlOB!}iy$2Xcku{&BxSJjFe8SB@|v>GQhJqYIZ`)f z_q(~j=$cEBdy(cu-Y0Pnd0ESqzVUg^QlWctuAVrCs0&OB;%M-OqeF4jx<9-&P+pYjEB=JD}u!Q1E5fBjw>}EAT5=hj8nQDP^pVKzFG7WGZ2cF#q=apb3?vs(I*JP~o1Q1nxyU z)?sc}ORf}|B93%*DYv%!M%`(H{1Gni!KFxxcg)%P#c6V5v2EDABS) z3n0UUL!C&&RyPsa?-(wv>!D#3?JH(;JpYFUP{YSB3M{*;)3+;-ks1JBP!Lfm{10`5 z=hQ-rw9odeoLYOW9aYpFj*yv0mbrl6O$6YwVGEZt7pAxW?0M(rB~m%S&!p3p5yX7A zu1n#J$b?-ru===+=8}3AADi-K+Hgqbv`SqbvJ0RFlac*zz*4#!!HKXG>i-}>{BNNm z-25mdE4~Wq_6MCIO8B?5uY)J2ES!Ji+oldSq#UOoay+c}K;PvK)PGRnFt8>VD~lbF z6BchQW1&g|@CjL&!QS{x4}b_E2sQ!idQ*gj-mF_g`&Cec2a-v0$dn3-c*o8qVtR#} zFy_lGW_6ys=we^Ji_``B=UdsF+|R#@N7Q?a-DTKpMJOjmU5`K9=s9vMCfWrk4+eXZ zbg{-JkyJX%nfFRTH9-lX>l)YI_GRb!2o6*NMvq|hmK>oI2UHh!dEm_Mb$J})ptw8| zROz{N@2{}#xx)NQ1_5+-g=v`CJ>*wqMhA~C6tz7^CM)2>{@kdu9IJE7YdXs(BcixH zRpYT0Qc+eo;YQWzYqpihhWjmkKY~UuA8c)Spo6-%t=F^czyl+X#fO7dzwqCtjO><@ z%>FF3hi%j2aU|BKqdt3ogwfz8@!kDo9X_UM-=B{CS^lB9A_lFz??ci6s0Y!tRhWs7 zrAs67^5;U)5}k6DhvVfBhb3yb6UDh+13;^&izYxc0BxNO?9y}(eN&?zqvbhTZt%0g zjVqoDKKcZbGZ-$@Xb^dF^K_zLXn57jAK`*SO|GQYN4t{hTWjK`?l)q2NLP$gIBm?D zBJu~bn(iDg0-bH&ZS@2MKqGW}h+D9i6-OpN`Qn&3hldMs#(Sr8r_UAdO9d>YH&VZMXfEVSV=jy9d<-oM60j_pLyc z%h+`qdoaH!Tad^mH~Wc;=z4coKw092%hE8o#IBk$6xaK4a)a~a_fnGz&{bD!+>D)h zW7Z|+hqWT}9;*G_(Am%43F|(fQ{$3_cZ!Zi^UpN0j#1dCwK6PK2Zvv=@U@2iDg_oD zmX*N6R$;>;kK4xeA1$X#8s-A1q$R3Rz1Pq^-6++DZSy7^>n9~k1o2uQK+ud1P(d?3 zz!06$Gd!_T+w&c=vkRC7688aVDF?3^Kh8K!4^jNJ|Aj?1p#9I#mup{RV&90E7C~Bn zy)C3Ln){G-cJM(go%gGR?lz}gg<*|5tKX)Ag@4CHO)hhOwR;t-%b+Ivaok z^DINI{-?k4BQ?TAL`qQ}^vu7SY$cA+Yv7Rpt^=O()Azp)um2sf;6FchaPsJ1N(tVq z#kWC;(Wlb4RvmsA>kZvmTrzIbshA?{29+9B*#6~6_^jNV2G|0Mrk@wof=)@cxrGHL z!ieTAFcqkB*k*sT#)Pb3DW~z}2|!@^oG3b?iqV zAaymekT;;1Kd&`bQrJSqb?dsDUQ=NoDmL=_#O4H6?SU55qcsQ0og!f}6P<98FE7HZ z@+c&^@OM36QjY#;;)~72=ul{V+G(3VI=%qj+&*u1!^c(rCClK6r|k?jl?LL^nVj5w zB}V<^9&okVa_3?N>Nf&e4TaZ={>iX?F|BAEWQi1|*U6c@dxRtA7`D_Fs78uJXvBuN z9GY>cH`IpQ*ZCo@&c-En+bAzB=AW_d`M+ICnHxtWqJDt(+op28UxMc2)(T#(tiqAC z6x`-Ltb0pe72s=g*id|YkzJjU0G4x2{UUy@@m{D^(+wqX`OECa616sNAomixV=#hh z^685FSb5c*t&+52ka+> zD_3}9l!W9UYZm4q^1q8e!X{02YfqBSE3cp`7CCx@#)WG?E_$-) z>1re-=axO5p@uu%B(kw!1JW?))|PD7U_am4GeS+8U)z8D*Pva&%sIF8Rf|FaQ1^D& z; z*!#EDL`%h&y&Q8|v3^Ao%OW|Fq<5THDtb@bC$WwH^e06~pIj)hIYxqq8nP4c>V5=x z1d>Hy+tf}|?7DlvC|leeS-<=Qi;0@l@9VypsJ_W497I2RsMfP4Zhzafe*7c{pId{Q zg=a;$f&+n}*-=q1KnN9&ekK9L=}Qo$D<&Og4hxAJN^4EZ_odyQ zBgF~K#`~~OQci(x6YVwenfE7@8SMxzB6dMMacd)73xAfkgl?9t6efel+hF*?LKBB( z3sn_k^tNQxg4Tp`%eIkP0FiaDeyXv%%98C*!@i#ZCc1J?elq$%d2F}btuxlh%{`%S zyV7}b=L7v~Z&Q_C?$JiuQDU`KERW}O?Hs1&$|J)D9Zg!Rq~~(I_n8Lwky{7Cy`|q@ zUb0rXv|*O-w*G5EAza`?%`b4!M2&z7QEs9HqQ!S7*#6z_MrgAald+RtK-gk)ySN{~QKRW&~e+fPjQ zqftKH3$%Q1&9nV)xC}d%Z0k@hCZ#D5K5#?Q>)+fcfLp_Bt*2LGMb%_ zYpuz)M`TQQG?#PQOQ2Py+c*hc_%ZUTEpXCq;@oRHT*Km$b;F|i%^EyE`R`5H^<0ro z(jeJhILHFv@X;}HNyk-Z8ay0K>YZKxGP6R!s(kY9_EXUtV@@yd63S<==_=OnYB8h= z^|Qmyl$LLPa7}mamp_G1Hd+AXq0cIoW~=)ZF6DmU+y;mRNkH;7k?X{`atSa(-_!v%gR*fqbglMROSwSq>&HAb!t!uyn=Oz>Bby0;^Nh46mcuV zd6#V$H`Ab?C>yZ(;Zc=32f(EZ)fo1oMfS`1j+_1khjkouj*)+rG3$Xn-OOo;c3!Y1 zUI}J?A_>GkerrQ8+b_NzY#(y4#G*P3xc$1Z?Gwkek;=^HX+6ohifa$k1IPygjLSns z@?bMVi#2z(hed$Pus8r00bvDgDmn3WMHA)F1MSh@ZwTgCZ-0osn&F1>I`gAYwdh*W zh+AvL^OEp)A{7J|kl9|MB7w=%2F8%xo{A-!LF9s7$80{O28bGL;YvC`*TjIcMV*@F zgBvs_q5+-HRSTzIy^p$=AzTeQ(Xt7MWO*-RZ*FL!_6xYaXA67dW=qhot;O7~#%UEhQfis3`>eY;5Y5cER~l@% z`P)rrZe~JhQ+m{1Z!AAbFm#=>cK9*Z8$TAM#~73>bni1u7ihoqc}x2}4?|Q}_zCS# zonOjOA?sdMbKza-OZq1`v<@(z-#j-^+MA%n3K@6X1yL$Wd=&2=36pulfMg1(WUpWbB=|5btzQ0qOA;Ymg@D}8P)o9Gr`DWk1FGa z=d5)u4Sy<{Cxw|R9-kUtEQzZNUEp_8-W6PcB^M5{E!|z{5JE0TwBIT$4o>e4T|mZu z+90XJ#ZO@`SnVM*ei!1+*w#;|SVz=nS*z%z8S87}%un!%8r^ntS?PT9(CWa)PV;V~ zycN2^llx5s@FS(wiRA4$rxhh{ZWWMcxoPf)u!1IDFvQ?W)57;9hNYv6sY<#<5a|mz z{Mlu>I9SX!w(fb~_NYUdJGnio#v`t9?B0V(-o1YO+1LOX7sH!dq6wd{3;RC7 z^r6Cuy{8l(lW}C`6f5-_`PS@+jBsc1%Wp%k52_1Py-C=K+5kS8D81Y~e|aI0?>v5Y z(E0jT;gS6ArV$3}o^2fqfODJUn+45pg*qtw&1IAL@7zAFI`&NmNWIm6hdkaA>xC* zJa3#cy0j#oR6f7m|-%n*mZ{dXf-%b-^*SCDlWvp>$5y z@qGp0z~dos*WJCDjD=s#o71tzG;9s=n@^+h5xfbBz;@Vl$^PnitI#brxxh{kM|UML z1bq4&z!Pq$`3lyWkZcITGrY5gAr*+c*ZgQ}n=Z`+4#5YOPPO*G>`|1%>o>LYJ@oGT z{caZC{)374GCz{oKOg9)tHoP(hHvOUtC|0Q*n;q)qYMS<(O4|A@&P~(hGi-`WT=n9fjlA^COcmvyKoSrnIxi_9F5Kgw?4*? ze009WdH@(vJpRt_KLkUS3(V=+8q|b2HPgzVDh?&$r<)_+V(b5Ag>2CFpdPK6Mm+Dl z6l61PirBBj(^0%|>ToV!cj_$vNp^1RH`Vn zA(Z5*8OQdzjYEZUn@kavP{DjkYOO&5MH>Q*PpA)j``KG$JV%8h4gXRQpZO}|wdAXy z?PP&4JUtNy;QboVURswQeMop;lpX#%Lso&H*t{KW?vbwF3-;fhEDvbm-9Wo=z!_rRXP0nDID0I|-Y}DW_{p*P=0koiE+J1T7LPM;lL;1M~ z%rCsCaed&*(9UH9hUek|CX7=r{7J5S)ZyLGXCei;D~6I4U%}>aiOoH_RW5;Bvkr2# zPFkSYIGE4|y^cO)JL(eh;d`R?15CoQSF9L=Q*HMlJ;C$o$Xq`7p+V%1YA*nW^(bPA zM+R2j%z|}(z_;(W0K^F??$=uK@yl@$3tD$0lL6UQeGvTtDu>29ldI93s$wS-d zqyAyD(k4S+m+Gjhn1Y46NzE|OqX{aH#0wjI#7+x~v_ec;el`#zsb#;ccsG(#N!}?@ zeYcDL=2o(H0pf)UO9FQIS=Klp7J0BQlqDWojvL+0JNT9`{U>@kkps-orc&1I4aFs26AqOSQjclS zeTENcV#rh~`#|y(Kukv|(`{cV(P=8@D^emtZ2L#K$Vge`>b~q?Wm-Fkku zebHa~?fXLJVwbL(w4SbURba?ggA)wepV74b5-2*0RVsSWKVqlZwIW?|L6vJH3{-1S zFUG5>XzGKS+mHG_J?b!!UxW-*a2YkE=9#D%bgS8sw_0q>x%>h7Vds+Lji;cx&55#T z4}cf^;{_&bG%mBro!v&Zhqj5TvXh-1mU>3fPPJ_Etk{X@S&=U7N#ERUu|i2N^i8!8 z$~XytAI*<-rboiy$EP1^(J@6C_dLR*+Y;sy_-CR}F^L!X!?145@M~LDDPoy1X)vpw zz*{AN4s4SFpn;zg@fK=*BMZ!3JSV~6-CklMbD?GaycG(61adG^v=l*aewR0?PgNtd z(#etDxvC-@O!DhHI49VCBY>^VLfr-Wu$%@nWY{DTgwQTIp{Jq0-S)Udji;%2=<-N< z7y8Py zN|N)S=JcOm=_@R8hy6lreNqOoha05RfG)0diI(UH!&;#HdH>QP@43lNeG`^a`=`pM zOa7F^bwZVG7{F7Y^h&A>K0nv;N7ZYFgNKhWM&oK7$h^5Pn{e1cU|`5qP0H0=qNsx) zJpU5;Zx-ZuoAakPW{)niV<+|wY{blKT(de3e(?$J$U>K%o5O7b4j{OG1E=X7{gwRw zP9QC;t7DXHag#K{pEalTly)96FXYz8LN=h1RGW}mrhyXa?0aKhY$oRZ;!#P0MvzF1h4Ln~O&%?>7JfO5A zlG*V6pavjuj7g-gOT61m^&rM^`(eatkzpLQ*vbvt)q#|=$yJt!e)zh={bwk+2VuwL zq7(9kGn$_201esK#?VeA960z2{4361#KqT1B+(Z`d57*+_)|`nM|x<|b4~YT+-L0p zGWqF;HKnO0PXZh7DLzXTHPOkG^K0~&t{r3x?Y`PFLMj~+3@t)|>O?JD?R}GPgl_k% zD7$jdDChWO+&^ol-MR5-^{&&eKZt9R3o@RwmkS{qJ&53+xBRvsO05Ak^Bq+5e{z#U zn{7Ai(*?r||2H)`&A6sR0pC0ggkKSpgck)we=^dS__1=NDF z>PM}2n7ln=_eRTNIce>B!i6GOl8W37Im~s;b)DsIANRhw-ji=Pw50|09zIq*@i9`Q zm`6_{pBa`q)%77(tXfRt7u^!&Oy24sn=Q1OTncxI zAfBIC-+OPMqb$jwKpE=wqBY5v@&4$B?>3d!j=jEwa8vHh_Vpc0bV==7!pLRAl%-s$ z&HJHHOcPY;?who0Y6)`6Uv6W=srj9dX#RTL7iI&XQKb zmRAI*dU7YF$_O`*xeL@;uLe_c?104kuWj>` zW*S6+z16J0&RQ${AQ8$(r{bAr&T!aZq7xkdR-nCLrk6tETZYn*h!QY!14fHDjsNhd zuzvx%1Y40{Qkk({kd*-zu6fFs%3=63ag+<;l|vlA{7(UL&=AI)d7#U53&7nD!!;bN zsL(7L8YQ5s*f0339xBTMv-hFr58LCcoL3&a`mVs0CSzxOi2t!$Q+E7qRmW!1I;v@3 z!E(Ze38%S}ia%-gU0Z=AR6z)hB6pfY2U}ec;%$H0f96<$nnm2Y^ z?kiuO`^AzNw!d{r)TF{wvJ1Fabf@g4V!T4}Mn0j3IU$F?pL|dzryX>vK<;s;Of3}K zB~+%s?goSc_e2HHc1G#N7uo0O|@ef|G=DF5*(=PySu zZ7Li>c)FLL_>~=2Shto^vXMc2;|g~v`vmZc03^@M;pFHhb|B^gS!z%14$3-6JDkq9 z@Lsb|1uPIM^*AL?MtWSf!*0CTuJmA*cuAtWqG@)VNYf4dc&@1mNGSF&sZge2UU>3K zP2W5lucQCA6yk7WFXVm7NCz+mb;Fn_mG=tU2R^j*p|(t8=zNG%AM8uc3$gH2iSW&2 zfw(~2OwTb6OpM6Iuw;LI@Bbg#2Fi-u>;~+1=~z-0?p@YLfRo&-0w;obUOb??L=5=G)0E--yxK zh)%ex<1n>oN!||Q^9tp3swjis1ZQ|R3z_o4_r&ErJrXy0Eg`0k!sCX|(o)%;z_5+0 zW*oz*D!HE7&`6c=m8Td%m64T?>)Y-D&3+V30<-^G7OpB05H@lc=X1J8dVApVgfV81W0&+#KkkKf$nL^VOhiOC1tXOuyA^IIMO+j)*1=G3)iqm z7jm0yL}P+frkDMzgE()V05Xh+i_Ip6gRzdYPY8dz7YA7NSKs2vOt8aMFIHhoKS^fn#FPa42 z2>eM4MEh*W$_m$1(hKvH0yp?8wdUHp7E?pLfkF#|Hyl=%pqa zdMCs#KK$LXsLJoX#?+F~_G{(qM&C>qgFKxF=B)p>M~g5y<8>jMF&t97v7y7UN7uw; zr|(_XrEc(#@hILB47k&Hfz=XdxAj=dux?rHOZ3aESQ%?|I8PZ*p>`$Oowc?MudlfR z4BE*($-u3yejQa%_nSYZ-;Wjm9o0zk%302Ky=$hw z%5~nw4JNGNKd-P+W-kn4%#9RHY9oUl{qrUHzuB_P{HMsU)v};R)BVBwcE(~1*LWt} z*WC{!Og`0_>i)2ow@wL{5KCj-Eo-hqq0k4kA#s2=C=7@Jx(~fhF6nOu+LCh(vTcle zkze=m{NEntpT`JZrw-b=-t3}XP`zE|9b>Kk2I-!zT<*c1EBB$KwW-_1uL>$R@8pGg zHHdD6b%T>rVS*7h>y+;_KGyW4bWzG68mf0AQ(2)O&b0BT2le@G{|7t%-+rSH_r-4u zxVaxK;YxQaIX?5{t#5|+=6P?T77rGVUM`y%t_e_Fbb$dAJ4_QXOeRPY?*H)>pS%VIrU!G-uO^Snb~9Bl1^I@vndUpRe-o&d&e%_?Q=OU`dz1YUhv@ zPu+(jL~GDS6;pLJ>BJd~vgaW0s^4n&Yh4zKzbH&Z%jL>efzIZ_&V8b&s3_!B$3_pn z{Lg>#U--Yjdn~6XyB~#>E#(Ns8_o8XPhPs&;7h%Apep0Z-~FFIur&YtQM-or&04bd zb|!oeAF%gerE)}l{lQC^e*e22Pru7gSfDOKtx-AP5}oV6{Q7O<{sF_4-MSa>$`D$T zp3HUp4}AQe+x_o%WrT^$J79?~VNAkcH@?q8SiHVyZJn6|meiEVzw&*oWR>&!wM`c? zSyZg&9|N5~!EO;I=eh=JExV9>BK$^Y{@#9n))l+64j}<~fR%KvI0A$Gyv-h2P!v;Urp?K-q?c6N3z+hW{XPW-RI>L2)? zf4ziGl-);;9O=$aCUmd-A*c8B$;Iqj){q;R(}rNv0J9F_&p8`G> zW2;Yt^Qynkp4)pgAi}yqU?2M^Gtz1MyKD)snSHZ!bHFcXHAwUR-q62$;XkxfK8(x0 zv+SZR={#HeF6VOZ(W;A+h-;THx^W&M-^WCIfh>Y+Q+U_YZkd1Bi+_rVPM<79BKcP| znx~b&&qmUF_}_)b)aMQi)qivIa$k~4Qc(}u??p&6I=G++h-fw^1MG;Mx?_DHj z(TAz%v-Q=qz<(Yb9XzJ`V7ErVB6s-mLRZl6_X$;nP6OWF?@^duTY076_i>d6_X!Bh z0&&Ufnw#Gxcl&Vs%wLic+CjAx|L=mR?EQ-?ivxUF*Z1>fPCfZ?z@6wLweVf=%7a3e z|0^jGzU-O)*JJP}dHVlyUlC$gauA4Hz@7LV*WseBZY1E6SE|qd^)UVYo%w(EqpFwp z3J3-OA>wK57mq*HI)8o452t^0a&kJhqVbrdeD$BWoNt9T-+m~)XCDyOaoy89_ago9 zk4_^f4IA^?pHpPPAZn&>aIEx#3=*YCOEz1ZT^<0?)0G*L(k;!f2LNPQ*Wv?=?v4iJ zp;}z+g@Fo8^lRPy*mtiZ^KJ?j+&g?u=i9&jANvq5vxB`v;^9r>P4lf{t*47X60XNbPxG>JVr_qcWjRR{EJBqTx*N+Kf$SXit78{R05L zCpjyKiBhA9C`)4PW_#@9yn+FgpNY@^$Gr3Zyia~wy0y>$@FvQro^y}}sDS!zjp~Fd z*;u2`$j_UCO^LQOj)b7|i?xjHQ%XL8q1zSN@lnc0=y?qyFvnjEVk7o!wj{%?kNHuw zd~GuLLE9Rf5rv5qCaU1jo-kHOK&uMIHzXr)tGxTIKK10>>Yl&up8xyq_}lteGyv&V zYoX`DOGQk8!97#8OX?4t_#Lytt_!Kmrk*@8SmkP}x!wC_W~9z2biPSN52&`}>QnJ_ zeHAeOPUREOWNNK;ABH%ZFAnmq3x=(9@vb*q5D*Z^4aaDE4~kQ-0Zht?ES9Kyxy|?3 zITy#?9V;w3v7#Y$w6{U=Gs0RO>!`zsUY~jD5uXQonxlfVfUkVRVTEzwx+6t8^Sal%pL&k;LgHgdP3H0P4~^xe5&Rj ziQT`ozdnqgxeW%3x*vsqPNTl&FO+SVWwlN=tmE2IN!o`SP;IZ0!egN9g00o-m+d+pL?Qd7N-7%VeQ> zbJg=oy7Cd$ku^Xm@w9C~bNN3^u*F z{#Y(=BI#vobHZZ1j!4+b=Ycwi<4)}uC#xpA|HwSC-oM@L-?!7hf84x|?Ot64@Sg+Y zc8O;$Yz{zjfuV5HQb5nhkC=@T(dgfd3b1KPbGd*WH`l)MorS3>2S1?oSGoZwY%-r| zBP^Bx5^?QMp$sWDk45a6m^zW*YSFsqKeQ=HI6|1h<4;V+P)76PF#McFp$IWZ3DEKq zzc3tdg|#NF6A)%MpNaaWdp>aN9Ea(XU90*quE6q;Q20n;8xo~Q#b-{uI82Dn)L`gp zu8Pl^Vwh+82+->@v=^~1xISY#hAlJm{}Z-vT5n0_@DA}WD^pY2#CGwMk+xGI%XDcQ0-;B1ZAzg}v>i3w9-C)bgOIjCvfp{pzoaT|Y|QkQL#zT8 z?E89<=;|}AI&yM&)rBNg|EZ;++?(WViD9eF+2z{pA)J^FhUpRiO12{oM49VQxD{G%z?s(HvWt5Wc9WrVGG1FTF$uLdvM3YQU z$`oxsq}Msd#V%4(HO;40obGXUinVDZaLBvB&n5H~1*3^&eSE^!*5rgZZsOH%JriGI z39jY%p=Cjv@H}-NIqSCxp98o!3s#QY+ug z`^*mx^q&GRBI3C1D6Rm}Eq+x{@fIlHJZo4CbE3g5w?gMwNZIfQ_3p9M<)`}&^JAMGvttkA zwZzl|W`8`|{$TY>5 z_dv|lsyneej!I7_?81H?kz5$n~L$s<$II&_x+~Or3QzDM{?MiZ(mZr*q?3kd5p{$WO?YZT6-J z_awpZ)s|LeIUusz9yC&+myrE6RSJxLUr(hdy$Ww+^Q)m*k)qgspIcyPON*S>Jq&m% zzcl?@*I=bU#MTPTz_K!}$veK;dc`cWnz&^1--n`i64uMHtQK$eS>3;#Hgs?2@@ zeG~>V2LifVH&RvAY_gc`+KGrv$||7c)cVNu zmuKhDs_~R;q(1BLW@oBWO&XB`w^>5$XUm^a@f+$$T^@n89UK=8T_jq}L!!O_)Zvm% z$VZT7$HSo!ek#0nFjhK6(zv>ov3Ot-s$wO~pS(0gf(*VVUa$4E<;tj%J&m%tnKJAP z6>m(*{>@Ef1=mFeL=}s3z^$8U2iWr3@Z+uevg#_z?n8GvWp&Mg$0)O|K{Su&o7`{V z-Yhe3K*W5`R9<{@a;~&fMa<)Cxl3Q#kdZXn^ISxeMVIIHqbKy{mxRB>)v3put{+=0 z%(p+VLNnSoW+TN?zITy)GW=Q4=3(FKrS6vjHcwTC!l>9}_*YJ=pkO*Fn@9cu5tx}m z|C}&tv5&P}2k1{W$I8kUuBnB42-pwKPp}sqwaq)lv$HKP`!R5JA=lMBKvr(rJ7Hhc za=Zl9uk~oj*kF=#dBc^pH4)IMj(1iG@*+%K3#~WG6l!0lb;SxvYY#MTq)2IP}&RfoL(az8o4rW;(6vRqb$~1B6y^@9glBVlf~= zsD>D_=q)8Uq^Op%;d9{aiYVHy)gd^vf> z7nBH1&qj@t-h;V3ZG!1_;yG>y z;sfCNQVyC9^GZrSsb<4qvi7id?!*4lDWBEs9>42M@2&tse3OXx(}@)*(;A+89^qzyC=oYNX=G435eD#)N^Jc=tFGG9jjBj>2ar(5fLXm=qjWgl$s%FVx+K*& zYJ4q|Z0YI}bmRIhNqz(rRb|$b2RpD0*V%BZ0^c-9Igp^Ke0p(<9x3P2yEOZ?5>5Mv z%|pM|u1-n4x1SE2!sT^#Yk>|gczuFsYs+=W;h6j$FHm+!wb@i6yU!r3FlMdqRz|vK zeRa&fX*#$n*gg6;eEbfxQ*?U<4RDUj>YJ~inc}9*;$O+j=U!qlzcP!97g4wE~wa&`JJx1$OCVOSKw>`Hp zCvo#beP$CegjN&}EJ6SJz4FQQVfXUe8{?gwNwkKNz{x68FfUTd;*PE3r2dqr(~6Wg zN(hu2;_#(c^=tFw1Q08h{AA4tGC8coDsbnzv^F=~;A6JbKA}3k4k4-7TJa=Z71Jzcgb+x* zW65Iw@sK3fS%_#@xMGT5z+x}GQ=A!!BL*a=LK=L+94^S~*;vl$7s?|!#1x+5>7K6q z)3fAIE%@i4eCLKWN>zlnVS2W$nY>-j5tCOD2>y)l83rWN6wR!YHDtf=70J`xTce2>OZB9Cr1z$#&AC1v+e>&BWV1ufyUEYA z^&x7puCB8YPLpEbAU2jXOWz`ELr<-jjO%dCuS`ys7FM0`QVRoKo43U4(C*`|Kk#KP zYGJ~^DAsJSve|tSifKeMh9L+QH1g%^J-us30^mW@Yp!7-7!_&_HC1RUm}&Dg`&*g& z2ZF>H$Aw*SC|Kw35C8w32`q_TyEpirB5qRs%Prv$+m2TnvLXVUyP?aFn#BqZ$TQe) zqdm}>Bq@Ey2Bg%kI=amJQR8-oQ+6`@@mZgvjFVEZo8lI5dQIMbo^$sr z>A!k+9J3(vzHd+bSO*8Xe^S1hpK;GSGYOsR$Jksgt$(n17n-fadK<`&i|a0Pg-fij ze!(3sp0OrtqaZAL=ED`!t!j>$CjnUv*bYdlWNIx0 z4Q9H@b#lM8zfuB?&Zm?Ukh{cHnWMvDLMN`DTWp;}x>%sA-DJpl9g;O#0Hh?*Q4Qcv zJ9%=?`vZ)7G$@`qC6~&Y*y5elIJ=1fofy%ON}&$)5VTG46|cQF#Hqp^`Nj4?dlc|T zcn(?2xN<25C-V$8rnTO7f)b+3cc9~f72i45dDjIp(vxp5AopWp)Fm6~406TY1GgS0 z!Wq(#IM55+#rv&auElBAABxS?UYwfUB>Xhdbvm--)X+LMyXcb>5gZc4br;RoqF>Oc z-Q%#6v(q~=Y_rmh+E*(AI%JyC80~U2YeZs(uDjh{AJWznW48;CFz3)#=d-51#nLa2 zqjs>(xB6gdUr#CeCv7=I^MwYus}6Rms0R|lRpK|(bvi}L+GHPlCpeS9!-;0nUs5CL ziUF+4N4o$KbMhEUoHr~+ay(!?7!*NqAh0xzBq5}qy( z+Uc%nHX^i+y$1)4m?ni_%k4FSki#KUXne-1tzTxGV8|W5)sS)_;*-Ph<|rRRI~$PZ zd~+gR5^G1mt}s$5w1^&T=3N9?i&>+h>`@#aLZbN$YGSjbvGZ7>c2K(_1Pj8~)PFK}C)G9p#D4_l=lFLp<5qzOG?0 z=v=(UTIx<}nySQVX=Bfg1i4M2)QOq-bqGzkdxi!lyYhK4hDv|5%i!WCJcUdhh0&B6CE&q-g8m)gsU;r5-q!dmVhGuvd?A+E8 z`;+C0fjqg)BvH7y{H!SWNz!5?>vgKtCvRZlPw{0FLeg`KsBDk=@!3;`k6b_t!86?j z#a`q!-i3Bm^ZnyC=Ocdzpj+@O{d!y@0|Y87FR$a;ZvEMoVXZN{)FeEhXuqc~p-4F?e?=EYe<6 zA};{+gH?k+REcSHOW*_{SySu3H9VDwtsI+u6Hv-{!){e5EB$q~NlyRQ zK5js>0C|g&y{Rhp7_^b5X&=lNd}9)3k?-8vdek3?@(K<`cAmqYrzYL6(WJ@?`QPU< zCWUa;d7oJEVdJ#(>#wDtsvBea{3K4d3W2`hoW^U=th`z_o@Lv-bYEPtMiFR_$elG) z%GMh?D%4f;c*Wr^Yb4*OARi74uC>zA4xSm4cwriHS}e0>G|clAq-K4@GrTxBcsy5} zo=GF~fz&lzx;{u~*Z8rjC2H3qED=bQl23O2&G6UFqvBzDph3`(b;?`qS`{v~;CsUmyh3g69+RLdb?eww(l zTOg|WSioK1w)H8MSR8;2v~LV!>dE$RX!WkLu@$#OEv+%gBnFG6)2Ja|4QIZF@!yhS z=3C-4mq}GjGjP9-_ZQzj=snly=(Te)$mCz0NqY{Y}E$$!Wb|~M>AC%G zgk=*`LC~yHH%S0csjPE2s+>VO)e&FhrcEygOE7y$A-*Z8jh*6OMC$gZjN0`_6_)dk*IvjwRTu7k zDZirRHj_1AcI}-*(!iHhqKyd9Z6kfUa6y{H^bc!$*aMV5Cm7l62Ye`8PB(bFj|~4n ze4)D0JXw72ZdBF|biMVZlbHO$P?s-$Gn+#dg~>1UJ}(6YQ22Mdzhh%3Oz2zoOxo$I8=3=PCP*H_|L z?jksM-AYC;YFz$YZ4jfscC4{tV%66FF4wUAjd`Hgswf5I)0-nPru6nox%><~qBxGS zZYOjB;>e@9b%krw9k#21)lwopoy_VgFhI_ts=`f@+Q=}U`8AQC#;}w`IpkN_4uq7# zCpg41S{yGkUI#nwFz+#*`&Jy?_crEySYxepK_@@28H! zVW2{S-iR;6#{m_9=I5s)i>dN4DW{uF_1`TT=x|=mfOkj4i6b^J95UvvuXXKAZ$5K+ zbt@gS+08pUC#r#y=d8+ds;}TrHiPUNK)jvhZy(Qj0G-tKXh&o3N^X#{s4KB7mLF_! z`^k0A3XitYf{{oKccJ||*}PXrC?adJoVBu30qxOr(j1~N8YYLgDg(O6CYv((*N^xeG;dwD84xtK7fnU*>9I(4b5NAs^e6vCP;!u$g z=WNN0C5aiv3DCCAYzj(fYnzzo&E5$>`utM5u|P^$(JU=1>su;&zn*^*jM>bTST@x# z2;i$gQ?{4r2_ttN1&)@4j8(iW=u@_Q6oG8z!J!=$R|wlPHN~!SO)+Fi!%vOXoH1bB zIx1vUg4xl!4(2ekao*7U7>01be4C4Pkj+B)e2}>ATZLgp=Y0!}P z$OZ8v)tW0(zEf=4fT5UeZ(Cl;v-^Is=8bRa$=2S3`@D^#Qyg*>^8Cr`YYXD-s;9LB zaUqs&>S8b)Zp|bmAH3nu z2WzBnN&-lsjWrwbIoVP5f}Rb3pHp=c`23|7E5cI`RCxw9Ppph4@p=$ww7iq~GIKvI z+HNrja@Y5B>ew4zo2|B|9*E2NYE+hJu#|`tbG4C5rPb((W*=i*f6U+srxDW^RmfY5 z!p5o!1a{?x|2+)^L;+s&7RqM-2GCFL4pr;^`}7l`{@n&T3Q9vszmiiYubCV#?a}X= z(+kitYe|v+(2p3k9B=3l*ts(3Z+RQj6#atj9?C#GK&R)dF9$X~<%t7A{H<4-^#OBt zTGr+BiTTYP^4x1=&K6Hv|Hh{bc=1LSbh@ZKtSQUPCMr=rDoL)4`_OdTK_hMWrIJmR z$Qx|dY8+<^i(#1LeC@2#zO&mXSMeEB2|MG17a}8Bf@1Bf z+TkBRNi-@WGV(zCGnAnwcCf`<+itWj>!c^{hnZ~lxTi{{PKgOpno5YO-HeI7-so$P zghUHXlDAg$#2{YK%@tT*3DJ12?Y6D-T_WOCcF^W|`W8%0e4>ULOnCC;0-+p+SpWrL zgI%Z8(pWFN+qnfDmgIDO!nd=viIuk(M)0=Q3*MyIWs#SL&9Gw1%pLrKZ#&yNtWJc1 z?#TEBaXf!Fe9G-aq8K*dR zji&riU#O5#82(-VrziT5&NRPngp`JJ`-;RJ#mc?gM-`X%WF1hDsaqNeoQ%6kkJMN! zd2~xRUcl_kExi`d+9&+=<6I>07PAD-TJSod1gXXF~FdG?o)Z?_y&xIn~sW=mAVugSuH zvZL`<;@;UZ%7btzwbX6BVn4g*^g-SO9p|i&>?`fT$xIOiTQk0uj^|TyVo|Lf=DsD9 zujIOb@X;MTJL}DulSK}yw67)`qNc?r9X68lPOi)uK1%P@YaI{>K;1@@Vl*6nl+_J6 zAOON?PF5OCB=SDodK$jXR1F?5>{IgF^3E$hHXK2M(=pt;js`2Jn_0@}2B{HD+x?!u zu1*wJPfe^D_P`VjFk>1;MXYl(9W(rWcBnXO)lhT+#2vWe;(`?$sCLiZAu>(`-I{K5 zm8I1IC_S&FzM`kDcLz%sZ4*6&^Q zZ!Q;?Cx+T(T%g$p;i*;YJwR0^j=tI27~o&>C>WTxgv7@}^qVVAKD&`^(e@63Kp*>G{)bM?4$L zsoQrK4{Nk*Ni`)y^poV6bTDQ)Q{pF8ySAKD-YZ=a`%{_8kszcrI2ncIeLg=tK}x3D z?7zoU5s1aU_mNfm`erg0Qqg6PjTcTUWoY6Crk+qSe&h~6O5ICl9qi0B(Lf!`tZ^rN zi{>2>An`mK6gq`>RfL$;Sn`wD5~n-+=d*&=>Lh+nZpbh!lon5`4E$Om z9<21{$z^M(wH37GD!s~cJ13^SOg7>z_l?X46W-mg%?k_H@^59Tw=BL#6ZH?e&=Q9~ zKQ!83>XMjuU-tm~;&5Df;OFlntsn+%v4ow32cEMO#A&QMa5cArZJm$F@Rwv~12qDx7gQIHyD1p|!zHt7W&p-N-K-`)n_^flB&mO8E}H9QE_m=MSY{VGeDjNnEkNLt zD}LOxAE*OKGhS{7BNK79& z+gOOAchW%TBpcol>e3@BsrnBujLNEWN>QY$v&G5)%0T~uL+)^@OmZJc?{Q)^j(472 zwmPSWiuqv?bt9^NSzxxmOrKA5n6(38#ci-i!&#hMJMot6@%l>qz46QdogXpFiI!`Fp*A%@#{E_uF`1oe_GCCkCZz1p zfbflx3r*=kBg+F@m4+H<9rwEI2cxuCw9j&tS4L8jyd19`JgcLUcSxTU%<${eatog$ z{9rv~=Y-g3gS-L<>9i*jsVtA$U+_||J7HUts`KB$nmz^x6Vch&=1Oh`>j}45w+S071ZnI{Sp0X^eJ{zJbRKlTMO=R~T5JM7%0FFYg5B;FEe)rjaxQ>^3Ain;L= z4JbgAO0S*3P=$O+oy^s<=+}*@MtCy_MD3Q+OBDGfE7QA&z3&90Zfg`ygnhG*>S*%C zu&9e&wA;?ZN52&j{EeFBHE^gSi{-OJ;SQq(Xd9m~)l*u)_Lo^sdSaF+658b^-^e+If(HbTgV#~OiCc-0X(r>9f^6F9z0037VEGRoiuvaZJpxJcS zHFp3=Wi=}1$`1CTN_jImxd|Y1I-3UJ##fi*52cpBC#E1{#`Sp4)8@=kXY=j=RgoY& zE7$PxYL}0w?a$1c87o$HIbV5nm~-NLi8apAPwX-1%~hIlITF^4%A~gnrcZp-%PO26 zDB0U1U#;}^F&9CDRarY;FNxC}Rw-Mo9;QWe5pF~e`r5>o7i1jM-`@@hE4zb9jehbw<}> zW7k-=qD`oC7~j1HI?B}eq>l3-_d|OtDTu#XYgT9|Om>)X(SAQ~x~Hp$x#u-Ly##@7 z+hioFI#(#N&YKZus*;)B$=}AH)%P2p%#r@N#0UVKKq+tU-zGQ{i^MM94+1TKf!n>dI!6$`0)-PNs7@@niF6 zN);>y5a(jvW!%Uv5)XzGndi^O4LTws_pil{i*LR- zIuv%-+fveaF+zr&K}}J_5~}=a!dT0Z4a*1Ptpbvf1dwSyPOw z3yxBKR8c-B74r2xrB5s0-5eZW+2Q4i2%zQIiy%Kn9x!1xk398Xs5hm3&Y8(r4pE&f z4U%44?5n6JWCq~B_RVb=)bD5r#|tQ4kiX~hErM}`uK4rp)5rf~WFcj@>vhfZkylXH zFFLJv>srq1K0Ufna&YK`ftKYXV_UhKzVi1de?L|VD zn~Z;Them6=%f2oJqJg`o3yk#5+=98@j{37ky*rcPcOyQ)er2<2!cG+=c@5trg8OV) zo#AcwdUxmOH0^>hQMzRcBS62b=YA7GT;`PB#YgK z`q$6N?70VGx4#?Qxvo(9ZcAyBvhi734OoB|c6||ncwDp}4(yx>wqvGRb|a$h1sb)olVZb%K{W-RLVCu8C3sb1?#r&*8N5sh1)*1uq&8q=L% zv#TE+I>U;ZDOm}=cp?6(59Aq$-rZeI*sN4De3hIu{$rImZwej7y#N$Ls$vAS+4H@s z4H+7ancCG?H9cLqF6M`4IfBNA?xbMyn&<12>m1%l=|z3sOqqQ3u}-r_FJ86Y0{iKz z{zSx65#$6Iv{@1div`NoF9F^lIe*=3p=v7&NoI{f`szZqQVr>|%gL0PYN0&`R*<$} zSybasVP<$%tgL21v!qJPrxyJf%LZO%u%lcn_Y3Ls)BzIF@|v70;HUBIvG|aQINrIA z3l{0Tzv2>!?)%4fC`1;@1nf}T!1QCs{A(nBZF)DjINlxYA5^EzpZt6jSdvq^*PoY~ zB1Nid6rlvyufWU@aLKy8M}upP%uS?H_`Al(n*jN`sEq*#D&i5Jf}7ffNE$?_C zxO1bX=rBt@_YNm2!FQ^>?SsuVGD3#vplc143bg-?FH#>av{PopzlBp#chnpeA1nd9 zh&M<)jc??!%kagI1krIoa^_=Uw5Si-nln%N%<%1- zRifX{GPSpaTRm9RAXP<(=hgx=SBYz>bDht}teKiti0MdCP=jC>25bf3mvofqh%jee z7MwudTum@0-oSfqO`gDMvfu~p$OH9I%Pp2l*s;iV28gdS5ovFyIQeL_osK{FwP`ZD zIJayg7+<27fJp2{YtmTBsZ+n5g~>Rau(dP?U%SZ|A_S6+PW*!1fhTrh>cr!NO!yqM z>N4~|mxaJ7b+s9iL8IvRUfv@{Vbs6Kcv5&sN$Ji4tE+yAyFR|6pp%&KyM|eJ6PuiS z9E~wLJ|7!7j@(KKO$FN95wpR6X-d0;uOm?!@oLo2A$ZPx5`?kchxE*L;iM_w6?rpS zCyrN#w$2Bx(7B91$m&+^6dwF!1(bZQs3k0mEC<$!y2nb&VtxY1xp%LMFqr)(PGrR? z+|qbkpYVp!%Nx>34v56ja>gm@ZPY9YjDq}PT6vQw9Fkr>^wJ<$Qgtv?Tja#wVwZo~ zwGaVLy13na{SpS8gjoF#)Ha?LUHpYYYL5pdyuUv*WZ&gX>%Kj4L+tt#ExO>B z`%<<7Q|iv;YjsgDe4M63pq-n?@Y;emAVpbec6EP3T7sayovhez1T7uOd@Y@dD+}tz za+Lt-hFfa#SG9V-1zu`)h=ZohnOorPp@5PZvnY=I&wh*M1;&O2z^%upVij($DIa!u z%hEjG+ME_eR56iz$K7h*E0yQL5-jO2Ewgpl7%~=DXWohSM{TzX?sV=fjubt{>`%Vf zJHne5T>dyS*tBFMge-q>^@(g)S@SD@_=N$yOFSq;oihR`v07cDi=01R!X4RX>)%OD zxl{o=0L)PVxeu?w^3Kw8O+@%~e?=&^a;2o2h?1gjvw=&$xLDY)hVH5FD$&_)DKrgV$3s@b0& zwhh@)m}?OZ(7L@l;D~Xfq?i?m)i4_gH%Y9rQh}R-EzMdQeFUo*VN02j;f{?9EpSKE zVbmmoRpMS1t|Q7}ky*BN*REj)DOTF_6$ZV1KFIJ;bl(VOx)_%*Ym(Uzx%a6jVqqiA zPjCXqSz7fsUH(|3Z5dDNH9EQ<^TqX7uEL$JqnK{{!qVyttKH$CA8}5TGrZg-(n#R? zc+w(2qUt=cK7=z?U4G;P)mdqKX&fjomi+X_n`Nn{kh(Iy5)r ziHNWS?_)1pbgoY#MjJ{FLbS;ae%b$D=RQ857xLs@Wm08|v7Z zYO`-Ir@G^njI{v3%d(aW`mzp`B|&`!3b4Ry(NWsw6H(zTCOFPubUjhRW3!GBmV1Sl z7DF2e)#Hj=E4}Oos$mTrF*P0U+**S56toOg2~J3YSsqFTHSmkhG zor-PuVQ<$0eC=hDOWoKAsN8L^xVEeVh0O{@$m8zW)bP5wS%x)Jhx^a-iAu zHUf0;;>nF>ETSlW)sj-*8FE8_;^)#@N8L z{EK3Hct=*&aJ%g z$sRV0SJ;yV;&+pg>(fM{@UF*8KFC|_+zeXWGB+HsNK)a%FvkdL&2%Q50(=n&rc~4iO31FxT z_k7QT${N(QZ`QVibR*Obn;2UPYT4f7`_g{UkngPovOmnBOA5aA>hwGAbt&sQKrf!T zB@q=sL9T!+{Go1=^aj`g3IQ0c)Lh702aF=19*4A@BNg*zwJ({reoR4{Szk?+pHCWp z&AkDH&WJ-t?FY)L?H)?%UY#69rO*~g6$LTY?t}HxfV82-zFeSzN?7-4#_ip%p4&21 z?o(wl-VIis*!WC)H?8Z zVOAOF3}SL6dRGj+I9<)%=C|D7 zz@=l~fpnzf=@_)rZ+tgyu+}bBa}T&nE1yj|*!N)@V}6YKoa`{U3ZjeMZhBn3)YkB22lTUX0l;5c@*p4Q$T5-iQ~ z=Gq}qeSzt68mXe@(65V<-X$4%8^JPleO5YH4X3V$%cwRL3{Mi{O&Wos>Y|Szzs(rV zsBrEgsbe#IU7DggDH)y!ygo-BEMJ*AUcROu#jOGlN=&STnTVi;&arH6+dkKE0jW4V z;9GCMXpQe{BrV@k1v2ncYN2L)e41MfR=ZL%wU8c{W6okS0)5fb8Ja`#fO>0t{TgYR zuf*2CyOY?HS3RZqInbi@le~kOhNxh>oaecZxYzbaMZ!9Q7N-4PdRO141mDcgU}@78L15fmU~k*~zJX=! zBD_DHV)v=wAbd}l>0s+)@3Y3DqgAc}8zZgq)$T2h z27aY#DcTg9yOur~ppIeVY0ivo5<{#enHe)eZRMTDopMHJF$$CkJ~nPcNeow4J{oSa zgUP7BMUBM1uU~(F#Op7Jqz|`4@Zto*d!I&B%>6J#wVjpOhB74|okpSZFl$%0n5&;EQM?cgw)HQt2xR>L5 zJZH6G)v`h}cA+$%szq(}G?*e?P@$OWH+m#Yb+VfByT^z1;!jzOx-OF&GssnH*;rsq z$B0eqmXG$E0CYCPesI~iFIE1sS?r$He%QFeGP0xbjl$HES7SMB)tXc>`u{O-AGW;GyLYt;@UK4A+V9@%=%}T zcOz@JCp9GOX@W#}IY1vAm&oFD0Gvs7N2bq#8xJpP?7D>UKPB?5Xft9`YRMlx1HYec zwOo)x_SQa~X~$6Gcln6T_HR>baM@Lu?Qf~gsSvwI+M3Upt5N@w{orV0CW|<1PAzL) zy=4<#v&Oj9+8Z_s`+u~(cUY6@*7iLkD&wdiC<4+(*@!4bKq=BxR8&Azq?agBkZwR~ zAQ3xV2O)G+q$nj)Lyt%a5G0_|LJ1N`=m7$R^zUNtW536K_cO=i%)FofazJu(-B(%H zTIc$mrMwY7v;VMf9OtRwg zvclDQ(*>l+dN|`O#>eS^08Ez$INaQUmn1!dE=(D(^+6;@+*x=_+AI(e?7dYBGl&JEP(IN;EfMI5qB~?98h*~x-#cZe>c4O zudn-4Uy)(*(yALxPgj;#_`_T8|KlJ=#2x7VJbYlP|H`Guu)p(s|M_$K33%pzL*l!S^LM_YJ94wVed-qOi5{lLwLkUN{_0~) z{q`@wqs)Y(#E(Hu-8~S|*JphSd+Bb&j>Nw+2;ZH3C!YR`r7Wl`{`k8!tM7^8{_qJi z&cCdv0IOklhMMt@Sq(x5ew*q)b?M=aAF~vwq5wr2&+0mUGy8`;|IeFbPQKh2A%XO* z#(%gP|8QLY!fcJWbgQ(g@{_HR8QZJ2v`Gpnm^vm^KKjibf2La&m#E_(> z^N(4`yFiz)%=j^h&41xv{__XN-Gl$)#&_Lqjrl>V_~8cN@mS!~=XDl>B`|XCdLPC& zE;l!~YVLEi%iKVMknZQczP>7QF&uQjQgJD6nX)Lyuv1_AJ(XqePyCQW{lv?Yo{|Y5 zZq`=^jwi85=8X1h2p^%27*3YIj{sH*kw!eSQPH{X9M66oT3uQ8TL%nT=Rn%Q@9tUu za~q07owS6aruso5b0)4|)(iFT6*E@9YpQRIFT<$6gR%I7xs!2f>_ddWeFTnmMqwr+ zXhcfbfMW{)B(+3NoQxh>j?aXUlR$4s+X86u>0PTU=Jbd1>ljK zGM10yqEvUTX86o)HT(A*TFl;36Ew}rwpmpDqZw$Fuxaoa{m7}frMJHB?y(#F<_Q*t zUn(aB*bH0&y2}@iC>P|i8L_HPHPZ7c=>KzN`U@Lk#>tny7}=g$H^yx*uc^)1$Itx1 zaQ)}vUU%QJuR|?t_X^uxEPk2E+T;L0Tq-Im-ZWPOb$&TyImD8Yn{4Rq;TX&d>2)Jw zY3hIUzy0S&{;kdLu31D<5;!BF;U0jPHa_g{dInSM1m!;731iO(nP75#V2w;_>xFC! z{hLA63uBEB#$z-uMPC7EvgJ(0|L3p&qap5wZLxQ707%-^X?I|=;@_2dg=<&sXQk|1 zcMN2zc4zUv#=?jzmhr0#UO&bnVN@WZwG|M+$+jc>Nxb;{f`VwU2h3O)j@AZ2 zIw9|W1NR!pSsoa)IO^cq5HSjt1Lp+(1z6fm|!3c4@uh35X)2B~Mob75AEu7_D7@v`S5GKmEnX_d(Nzr8PyFCH_-gN%G zs=qrrU{hG+iT{gYnVAc%!191clBJG7Yjz?veZn!b5?&cL$!$Ed8E?-!O6Q zArgsenSwuT-rA>Tmym_f^mwn{cgIUWnP3XABsi_&NZrRmGNQsp%fSKHZ5(0loLUky zc0CBfdJsHcv8BZI6LA3J3jx%>q9&Pj&}K{Ss+D{CT>dc*SXlFu$hFypn(zfrSYOH) zGLXva+^h%IhrpfBNJNd0E@cpUtc6MKe7e0WO~l+>h88R=S@lDfrcTtqxTjYf;|5KK zFy83O-i=$mme*}%$8sHed;8bL#fG_=8oFDBq<2Aa>DRV!H>g8wVd<&Mr?4BWqsJhp zM&p@WeCq3b*VE&~J9AG@&rbO2YVh*3xXaL*jJn_Yd*eQE;u(i=hcKVKYn|JP4mW^X^HjREb!goI-+n`iw7t6-M;>tpgI zuQ;7KK{RLen{8vsnr_Z@E6bfT70&gcXQ9T>)v9dH>V&3R^9bmnHa8!64QJA=@s*;g zVRMmg*(D|4o?3yCAwNR7;ZiGRfh^2u&xR;^Zn)yeLJjrR;h%zuD@y9_<5lv8)W1b{ z{@%j5dozN?3I)4a$o+G1(z4*Bi~f{`0aELFd7(KHWZtLk+3t5QNhmBQeq$m6S1HpS za$3h~0_XkopU~ql2B5SiVg2y|yQ2!Z{sC&j4cmBWsdRf~`%-1lJX^XxsuCnq>g;do zug~~+L>=~VAXzKm>V{DoI@5qWTxJokOQ+a0o&+HLHvR9XWd5&L@@IB~mzKYjp9{~E za8s1I33M^zxdfi$aaK5-an97#^lM_&c)OxS3=E2EejJA$!6j*zUf@E^6FG#wy=k{E=OJuq7Q4m- z3`F=2iEbnCnnbbeA*{%5{A`A|?wzrdVY9WEv+)b&u(cS_qrwbXFAc|a<@??~gd02# zV3fqsF5F03YSabKIbwYt@!U|_5Ao9iYw1O9>PF)Cf@CSX7s7K4V9IMf%Nbr&A#DbX<$efX$L?X>DB1g;*8qyH|p8Yj)_Qx zhuSPBiN+FA%e!9Bf5L=-W*es83qzarVUaGs0<6o1HnLF;jbt3T#kxLF#Sp+ z@K&&A`8;kM<8s{e8YI}=y3nr75HJH|k=!82+scvQVbKt;jWcDalJ?YMG}wD(`pc1h zQc}>_O79XRpSQ6&R4lByl)wp@Q=>(1n}3pun;!6r`Q9G%cXn%>1K@ZY&crh=A^I@< zG2?h(X*dXJO;T|ngIkByqN=%lYFfdEkwQCvGL~b6ygDB2sV8Pdb2flZJiVcQ=Oh*c zZE&*187JK+fCTj`WXnSzORDJK>Szx3=Dh~|A!tAhlQkT&-39P>V88%3@Euvp_D6(F zZ%%?O^Vn-0#HQN7`8X^K0*M20fe8pxTt2@^Fx~7M437TeeZB({{?vwjKz3-jp6cuR|vJ=jHmxuOHeTX8MAASy>A*?m=@ z2?I*}dZ7hsq0b#Q1-pc$W9Wbu(U>0*rAL zuf}tntUbEx!PcEm!L_OxAPdN={o*Y&-l$x2rf8KzjaSIr5JoLEH8qa<4DrspAGOWW z!Eaf*;aHuBd?&+$M)lZzFeb9VF!;hSV+^`9$iytS-Zw-v8^08x`L)XzLjUk-i{k@N~CH?9)>ZwgTaY z6d6w9pHj9j*8yN(sgYXkmUmX3<4keqC{QIk11=xq&Clfv#+(EV_B8!Lt?$35@&DML z5HTlB!IH&j@slg+{>YQ#KL>#(6|qc;1XG4QI0v9noHPhGXFZxv1N^2nnWZVHg*B2$ zD+QwpWWEYOPgvOY@%5ws{DA-8?jt7}K-%c_#!I*84_oiJ?c)P>n_0e0ZQ#NQ7XZ14 zjWl9m`QbYxHP)Xp>b^S)e>oJ}2zO*`Kx2kZRvOp`*4rvo!PU;KI>Id8rA?8nT9Do~&}0~M5m=1GrkoSX#yIC}h*i7fhlIJq@WcS5JH7$QgF zE~vm}g%<$+jC&_+nt?bnv+QO2w_g7D1_#9IU;BGaK(y|zxNo9?%l>CVLs)TWfmxK6 zU0toaZ=V!-8Lt}mCD%glrnX|Hj>g8y-G^sOa%-7vObZA(gza!YB)hU}s%n!UxIVAw z_2s!y3I|KV*=rtUS?lXNm)H;%2G%v`Rym(rTwEN*Mn|u$zGsz2qa{c~u@v>qzh^eTVdJ2VN zi@jkyM^c*#+MFc*BPLS!&;PRXiCYb^E4^t~(Y|1A-ZPN1Wa5Juf4JmLqm7hlg97GI zCj3WjaxZgoth#BoS(&elA74uwet!e194@~QR2~i_gsniS=mjqb0>|vYdbYql?;}6x zF=%f=WEuUERAMOLmKhRS(GG@w9fG7YmRPgVaRX=l{Y`<@gz3_Qp@ny&v&15Y7zx7- zhPq#Kjq~41{{4@G^1ohgM4V#xz<@-ojIV75{0s^bc!kqs#5MIAtW(&lVlNF2BdiR{ z$?r-!e8Eor`boYm76H{~4{u-UZi;W|%Fru#AQL{`rV}vp0+bDD!-Bpm-`i3C&i=hF zDKdcNgW#yduzw>T0^v>)S|I#Sq<^|FfI}O`mI<;!##N%7>)|b{{Z6|932R#I-^lEMb#@LkSs(k_ zZvurvzoN4C{;z@Le@)as{WMcy|I+W^*yXp%(SVhYgKJk>{GD0%-33Q`eG)9#uh?jI z*^wXezx=k?u~6mC z01)kidn8RJ{w051(^cO~;#uYrSt zTe|)YuhnIWiUV}%_et1z{x|j8WA}*fdI{2BfNmH%@;Fuy*s$lmR zDgSX1=%=MRPDlC_2@8qYr(3w3!e@=QkqcCu_U*%$FrMCMdVGfFa;JRqLj)xm00g{9 z)u5dz;Nsocz(xJJky@KjGc2<@P!1_^P?(QorCG8_@@cQHhV$%>4P zn>^G@l6Fs{80FSg)Maijhv0coZ>&VhL&xqRO5DFB*_L{pjgd5XCv8cp^sYoMj^oRq z{0M=0hzC4EDn*^K*O4XO=ygW?%J?F@46XupdMGNWvHD=he zy{32x;7%l(XP$P|Ad5kq^=21F*NlJ30Ux{}MLed}P(8xo0F7{S>+&G+_g5w9X~tWH zqrmoOrG|FEmJm%+;|^8Mqr%xy^B-G!91#gDr3A(1F29{`sL4I@9-R%Rhd z9Z0xTNNJpnPHF~qK4K=OXl1YPnm8lCZ%O{t|H_b8@vySZC$Y4aU6Yk(#@~kKec}znDTUl&FyP?EL7|zoaJ9J zUzd@EPV{skEEvFMzFsit9Kq0;43~^_?T{|N(fEBK6UQ0W&<^(0=&~urpGOT?`Vxi< zbEwV&GJAJ3X`|d4T0^g4e9J5WtD^~;V0Y)4XMNTZk826^{;t;{C_r!wn_rP^r`xjU z{{eNVx^qRJw{A%bF1I|GCCz-K`B$>JWA&nKG>wM!<@Cb`8K&Cd2Woce9Glu`iW=|J zTZny|pxCNt80fw2wamUZY@YB!qyc=b8PGRH#50lB4m%11^{ctnXw|2*5kDI-Zow9A zQqr@*A`D4Nu3=_b{y+#b1x(9G&<9>@yqW7K9dEc~=6EfRmfi1UrB_~=MXFt0&?$Q; zs40Yk^o377SClutS&{RqVSf$kq)qEWvC<{7>H7TQtyN+GY{^<<$Fc7G_!cKC&8W`PRu;)$jq_+9H9^Q^-A2yN7o zxlw?h7*#AF`l^(pg z!CH*H!UKe)VCTt+XS=ty-sBac0}#EZJ4`h0NJiQC?lA+pgsxN6#CV1$g5 z(mZi#ef`7XDaP%=wFSS}-b@UHb~|1h^>P%L)H$pgOsa9$(6S<~ojNWHn97@X-n;1< zNg8xAQ$(s9oz<>1$qg?xxdeJ2kN21*6ckfyqq!fF7h7w9uR>JqLU?}Eu>}AkVLfJP zWU+9)ay7@gbi6(0vuW#Ync1Hdx^&*AKWTzy(}JP2&w^`m19HNKpxYB7bzovMz?VHV)==$227cU`}jG4MyZSMmK`b0OSN0O(zfISW zGxf#lx8>iXyS#^1!vXGAvQb*g>-|eeTGaQ-(~Ai4+e-X!NH>j(NRpBJ3&-7<_pcM^ zgQJjfFG*8Rcim-iF%q0FUlK%XNHz#Uge^uDnE;CMXa#88ZaY8V{w4PX11?iaO-f1% zW(|r%`+-k`p5Ozo>W>iug74-jglrXNs1Li|`RYG#Sz9d(xh`T21xJ1^Uo+jhQ&<*v z3hNluIrV(0WENe#$wo@cM-_qINJ~p0*;wp8EZYI{^oslw4C#!rW7R)^egM)kk{L?L zsRYoP*~c#q4Rlx)K-qB_Jy-~7#{Y;7I&!C!wiUVKx(gfp#<)gzU)e*R-vyjBsRtpv z8X-E}vDDXPY)G=qq^1WKObYY4zA{UF(df>|p^F^v#j#V~Gz0#4r{5^!#Ta?i15qx_ z0;pyq*K~E228Y*BNoh_6gl8tE)+tP~Ip6~T*OBorsvLoLAimD)?P<6E7whDWBs=$3 zOo0tr<#~%6lrk663uv(PtT=G{>}{Y2Z=8N|{HZ4eyPURukwwlhgBKpzjLY$uX-jeq zD=mjrbrHiCmTV)BkNT6EdP6=5yP0V`c(haDd=P8pt<_0&Mpi$rP#2x#zitK^s2}wr zJdpDwJh%Zf~AXU1gN= z!VzeO5%S6~z3B-V&!>7W3G(}Wt$Uh?>wa8fsTZ?jJr9k@i&}LGn7pO1X#kUIG_40L zaMr6WoWv6pB<45CfxMRLq)T85&{W-RfaL;70rY}mQdR0nGMq~xp%@`{O zhr^_08{v7llvfqfO-Z7M@m#}hBmLLnaWS%1EzA4xj1!s<`w=My?B2tb$3wp^+Sd9&>ooj*(zUqV z>-OwbPjIP}D)3%Cyj02Yzq*YB`19>cSl+^srB&aNeOMMVD;{*2SQXHQEA*079VA1P z>pOV;phg8MqtT$~X+z7>xaA@yFkI>O zH;&q|bgLU(c`UKY*}IC6ubbYaHe0US+WHa&^ty3_(!+fM3J~OdVZ%x;S zIhv_b6{#NpdIGxKPA;%@aYj|IsL+2SKz+2EUPwiUJXW;OxpDcpuP6CkY=}vu9Yxw6 zLg9W8eIRXr09AcyzTx-A79bfy&AJ$il}b5QY8H0ZXBr4O6F{9e-w=eI;A6`-Ig|6Tz{nT6OHz%3cNzdv( z6{iAyBY7yiKmmz8Ggjx}AL+0`fx9oCG|OD2%6(I6kY7veSH6cf-D+3>_L4{TDG%=b(`%P-o`v zJ>rN-Z2&d!M&VKDL)hMB95RI(erEFWpUq3W+`Y|fq^9UhxK_)6=!uSXLg{in23T9| z8ZiyK{qfKrHR7+?m3*cMMz#u}W9QRNZbb zJ#4lPg4us)*OS$RX^>TAK|wg)@9!IGN*5 z;FORF>w|*mszc5x$I(%nd{pBko%M*nGv2dAxgLkuUhXR2N=jE$PgPkYohJg?k2d)^ zh<2yHRN@}Q>r2Wb-33FAB##bFZ zny{Rb|5VH2xgH%ewk5g?6t{AJ)l?e;g<<%rZ#&by6`O(9NQ6gAJjBn)V zWU^vL*rMKK#XOauFKl7B8aB-DCab?{=4foK4#!n$P&12Ng0kwCh%=m3x$$Xg^bwWtRI0n{)i}0`Yqe@EDw))kQJZbr-&(~o zMzz>!=9=`2hUte5*1K8U4AU@Q=ISf5*XGd+0+R8a@D^}^7m{r<)hu8;x9-&}P4?$* zkbnAg!)i0XONAjTJR>;(1eSBnty+ACxMU{sTh0vTV4Q?up$f2^nr!#w1hxa?2c5gmh|Q5Sk0J#U}>+#Z4cg6 z*|l~RSI;aTzM9z7(LFpT8Y%_<9BFmW-EG?$?mtYomN1&av*?$FVSz z$cy!h*rVc1jNz6?4WEtWF*!yOL@ri*Fz9sf}^H^;6o#uUkfLFaVY)#QlRmb<-a0aYF zG^;=*8oyc@MB_<7Tp&=>IyCSiFR2oWK~6qcdVML zEHw|ioon5TD$zx@u1ekF(@0hQ@R_Q9&JjlRmfkTPxD1D=t?ej z*nS(b^K+;sI?P zLLqwca0>&viW)y#@26_&7M#^!HT@Jd<;KnuE6#Bee)b6F zih(L}QokC+W=H4%LetuI^mePDfANG?ZpMjf`ye31>17ldvFUOJluM&-&WC|@k`bCT zOrfiF7P5CBVV1hE@RUfBE-^wS=Nu+W#B+B=Xz*T>dyR7pCF_;y}+=(}RFJC0kHu|eBe zGA833m6+-Yaiz?#nZe~PS#-SbHiPv?nH-Hl70l?B@W$Wz+tpqjLy^|p|9oXj=E85# z8+$*b)gMyxTb%w2RKPYrtZoT7uTd9lr zbIr0N1)j?B+Jp-TR|nms9jckv3=k>#7l#49x)Y?EqEQ>Z}wQ7o*zvKIN8AdeB4q z3(>5!qX?f3>G$z9yqW?3X#nEu`qspC=Y12>Z&g56B-%HevDSgf8OCV5L8&(aWFDsS z;;JT>U_|W{HG@~2Inr+f%{(!AeFyEC7(SuYBi*LY>Dp^IkUBao)}E%ddj0OgVgUZ_ zQ_w45<6l~xQ@y#@y2U`@ZW7}QhynxKW+WBhW3LoP!;0nYrWFJ{?+-NaNjz zgCkcCH`d3rXlJ}y7$DC=m19wPBGke1=)@JO!(kRoM$$?0TD z`vSXJ|I93>Fe3lsN*MQ@=(MzY*zMIp!|+gmxr;N1mluHXznMY`DX@9}T2l!%bT7!^ zON*|+3t$*zz1tw^)~!sfW72gPpwVnRbgOGNMtO84MXG@78my`Ec!%t@)9Gc}Rv~3K&Br)-^uu*UkMrKM%cv*I(4N7=18)6nVwj5179sj^WLIPNd=l@zO z%S%~FX3X60P#@7;PBCr0sY&Vo`t`WR`Baf+%Z`eW!4}_9 zf#Uxx+x_QHBFIY5_^}*Ce(R?t=|T3*p#(+qLPYdz=5k9E=Kz$KqE3#P*?v^5Zv7$v z0GFKj{CK$~p+_;!gZ*)UJ+UbBr+d)rgg09k*~&~wJUKWWF~{6RWGOQ&{v18+>0k?78SCu&ZBl*zSX9d zeHXb7;nkhVIC!n6q(ng!rCwxkE8XE@*wLoTeAa5(5b~Io*TA*bQ3*+Mhr$;ZN#O!C z8l7o_P8_q^+DcT@3!0DHf>wL$JOep>+x@a0s#-i%dHCft;yAZt2RkxiT)Jrk%4mi6x*wi8Wikx$4QbsuCb5~mE7}baZE{J znGuMJ0VJ_58nrJeU0gizHgv0r<_hLz^9Mg3r-jd9ALb?9Xd#x~o$m0+ym{Vxp>9jb z4RWrijkGPC{VYq@x0u(RlQ?7md>yk*V)ZAu#Dw%{QZ+N~0lmf^jYvSE*OSNfO ztM>>Sq~douca7XKk=q{&{_lTM$2EDk;r*F>Y z2v7{uv9X{(j9`OHxKSNL?@e0K@g}|q&V8uKpUvVBI`+#ylN|R#8c?L=7SBzn7!8$i z^j=VD*YBxjC$B#5pZ%!u#8390F5a3HPv-Uk()8~=RrZ}~MtV0m7l4VR6cO+e{BfV2w(D#2}@g?sBi5$ccmU)si*KXR(ZXTx#US{)l^Ky6*qa04E_;!YP2 z`Lg3=td1^~TjrIIKs9bMR?5^SXL@xz$OLvzga!(DYB9=&XrV73azTPA1n&rPLqp-k ztn0PdWp3Rijdcvr8+Rz8KkeA;YO8Minv9E!19=PyFroPea+79#?YHSs!nL7czCrDt zy2x+gk0ompk!l{MtxQ#YemDH;eEmvW)%Dg3a7L)+uJom5e}ZAXy$a1zDtgJz&CFgI}Ue!Od zAA8J?wPFbciTYmg5}}YUe_s8!D7#(Rsj_ZgBj}zb$Ma{AQ5gy^%EngD_IhrJdK?3% z&n}tpnf%xa&;F#N-BA(-tY$`Vb0D&C%SKCpX_9h0OLUA?fMs7CqNJszW#=?cIS0dB z|GBLKP^ILhG>wqcVk>F7aOcQ;nf#B)eh9tM__Sw*@U1ar>_AO@C%OqWY;kUjlVcpsx z6S3Cf!4G=je-~WDt<~Jhk38^^4C8!ML%gf>5Zhe~IwG>++v=TyS#OuXRi#x%;aU<- z@4ZuV(Y%03$osL?mY%$a=iudfjC%IUyG^hPZxHXTcno1s>N%?$fw;F4IUF;x+I0A& z7BKVP=v5r=1Ib~?`ihBgWJd*Q{+?)X-Lil&jfs z;u{}qJsTcrnt6HCvkiluINzvM5vgraN+CuO}e&nLgguZ>WLFv-%|m1o^to}c$YzsL zhFwOj{lv=cSqgTWcj{qfh^3DFQ{BB5oVL{Vlb^UrHsKfqOhjs2R(FQAq}c1n%Tek1bL_qMHDo+AS18VR{-ih#OT+gPQ+ z&G$2M4a-G`Hw82@-Oe&{b1NCkjgKZP*b7Ky;PCfo*{Ndzcu@BrJ^<`Cnozqht{gEk z^6#sw0@PM%(U(IF;U!z;fBzNn@HF;@A4!tpJ2mQmu@(XOOl^k~gbK)Hr zJ=dox&}X-v*_~^5DV0bH!lsZHLKW=J6;;@i5@whDGX?xz7c{AbXnX=GMN8N3=(kxF z=4i*ycXXfn&Lv+tJ0y#kh#W_ppsyrE-D`5RF=au7dPCQrD_RDRJ(f8368Y-`seR#B z0h)KrnLaE0!Sq#!~Wpn^vT2}Yw;>*|dvzEU>Rduh;Yoi=@ zA3t6JW4%>8BNXchT24Lq^hf;XPvpM#q5DFYgNi*VF-m7I4~4gfVNVGR`Kl(FUVTc6 znNGNx@g;DuPvl4v+7Xmt(MrUCi5r6RccP@5F`#gJ*P*yP}YkB@9D|eLa{k`>plIhz$+a#*Yl)dBIUjs63+F8HQy+Mo~~u~7(bb_8I~)s zE^>#A2;p_#c=II_p!^g|7hsuMa;N9__0_XBd!W@7MS9YUzZ%J!y?Rj*5CEe{D&}17 zxiF1DU)*0F9o7A*Z-jmv9|1dJT^LuAZL+sO+iUpR!{!S7RIrHKKnz4L*<@tm=1tu%xQl2c6}YH7 zy3|YECLqW8pbPtkMoJqoml)&Qk=#767Q+uVaEp-9p2aNlu*odG>cPAV0wEfY|2(Pf zMA}KuLw#igLverVs2sLtZ2WbkZkzA*Ut#v3X;0aH{d7sOMV4Vk5tB&YyT$LNz0jZ( zaFOpEMTUy(N@~I{Q}6AWd0|YjM%#&-qKXG5&A6@S}~SC+OYb$bVjNLS$F z+*_XQnL-J?ODeJzLqP(MxnGdqg*`*>= z9%T6GSf35C6S1~RI-R{W?{WntiBdH~l(PKoT8M~OqHzgtK8+MF$DO#}_U&@*k&21{ z7}bf^hipKoc4)Kiy{A?24|IYyBAaT99?neTDi)_=bkC^wkMvBo=Vh9Hv&Xx1Z8O1r*rPLG4?6yN2QI^`e=WsBb1E!C zbmQ~F!sWuIN?aIT%eA%CoJvMKISxql0}5h-@~$^Y-$@eSCe?kE@HDUxx>L)nto>ZI zZoWbr(!P}9?{$~fR}?^3B{5k9^PeB;p7dGC|JJewrx@BgqNJsR+9KHE5pHtq?!mL& z5TWZ1^{$MF9Nn1ZkvxJ@T>H<-@Un?rT|i)-d%bK`UGY&}MJfi76+HaB#h~`UBi>{< z>9&&jw};ge*E{2p>-E!_#W6z*b$P#ljq*ObHJoris+O6nJhxn7AOe!|0+ZJ__We zXC&)G*AAWDpJlt~^=sTPG4PtzukQ;kMg%g4buX7TG#L7rvl0B6t?$vlD zQzL|@NNR_V9R3`RIVcO~ymgA3>n(Guaf9R7qwsU;x#&7du5HT4o&N8yBOZI7CsaIc zeVl&@3{$e2pq*=iw0#iQJZKO3sGv3Ay6h!HNf#3hM&y|_6m`b!6K+Croi}nq3K4uP zQUqJGxa>rHUVQo2K4ld%dVMMZqp)R8uF}t%*L>OjKU=uObHzLRol7oJv)+38-#2e z!;M9vl4&>m>D%}6zauY?z+4$y#co~k_PS=HXO(Gt+1fhupuJI6DWdD}QID@}dj`H5XytWhWBE_e<;VTO4e9LV&$MtBy`{!SN#Ap# zO~iXh z3@~2^771R}<}do54JOU>dPeU;fBDSxYy0}joe#`Qaa>`2`^{FX<~I_6lacD_Og}I; zZqOGx-d*djP>Lx$@W_9%`y;r8iQn*}>9JRA^e4sy+*;3~921Bv7m;%)fwDkV-Sinx z66;h?Ws#Ep5sW(KTNBMlvm(IySnjieCvqXBI?K-<2n{e7CA3{{iby00(7M9<(+@0q zjXx}T{-DF}&S2X&+t(#Akx$UKT46PsB>v45`qy^<9WdniZg-qmN z0}-&$U*(6LEz?@tEYIEseB%YF zMtjSIlbw^bk89=dG8|WwXf~Or_ZcmY2Ibr-Ii`B`Wq;dObe~_#aqYd0*JG77d$ZSw z`R7l$>VBBlq=r}hBIh}xhBU(7xv-(*RHiIaPL@bZC(Wwf-}0r}|2?suE~`AVKF01c z8*)x{$r#EM7*MU}5MO76gei2dSz%Nd3nQ9c>}J7nK|Z~pGN9$7&l(AqhbjOSx&q6i zgRy#EvRZesI#h$aoUx8mEiCEG^&%Q4s3&VpkH^b1+Nb+)_3fT~l)%8_H`l8&@MGnM zzVPvOH}VHN&7e`vV+8eb9U-0l{53&))X#0AhJIXUA-U=5hw+i6ApT0M#EaA9O0N<7 z&25v5&E$C9*E%Lz*y%nJNHr_QnKnkrA9!-l@Oh>-pTlpkj9Hpgx_eYmpEA1=YAS2P z7-d}N%%M%q|DJU@QZJ(J$p@l8>qbv``$AiFHhqoYym9^>}kvFpGxGFIwrDXhM z$0ewrZ6|Uf^1wB0)l3)%)#=5;BRymgWGT!sjkkBgyUf*G?Y^VM310q+m$Nt@ zQX}j)cHQY$F%alDPmcAk5ng2sk-zI)KXoXgl)ztt@Sw$Ei}#!q?E=1DAYE9cV7LbC zIr>sG#7V-4%|w&$N2^9wGYodI3F)$+RaF>@NPVMqsD6tUHb=+8=kh2bf}=IWu^!bw zbqjKsfOZfgG*tOPJW4A?f9u}1g%wB>DSHwd{Vr+*8(Xtm%OT-=iklCHO78=?Nv}u3 z;Wl}fOMZ9hvYo9f>7%X5;2U*AgowE+$6IFVj}y@FUuPW3C@p)QR^O-CR7YSFNUcS}i%pVBa;q<6aq$>c{bO;UwXGi1mWcTgB{u&g!od1UguMhy1%{q+@PE9 zdFI#N6KhjV=WLag&<8zMn{m`))o^8QF6F>kl_ytsn!SP+ zDG1)4{OO}oLTlc$l5ZPq#Hqd_4I#rj{Hf=}D*yIZuGR6zR|mcV@cz{*NAnodK;1AE zOtw}EFpk8mXY|KPY94SkOOsa23N{mwNS-YyDvI`2it!le-hWo&TNkx0BIVO36{W?w zoR>v&sr7zFrJh1;kMOvOHL68`hmFvunY549M3i*s@xadfyTy%X*+gGYvxrdL7hWIN zOM0|3j_|waN6La4c=JYs2L-(*E3xb2ES-s$c1mCUZ5{Lge#&_>b@D@ryV6N7>SuW; z66;vs;~kQF65BDlPVte`sgs^x8&=GIhUva3+`k2BZZ?0|G?z)7^rx;(+$md9`b8O% zrAbIm*d!}hZd50cz_q+%JIm9(=C%9=_WXg2h566nA!d}Lt*n~II)}H|P+*@McAW1& zM$r7!K>ppqGvyd8Ok`6(OAkp6rw2>v-?<(mXH-*l?$amt^c?jp8NcMAg^R{Dipz8@ z2x_e>L>CisZMlnV@I-_%R@=ubCuwKNGu%d4JJ0^&ER=?az7KC_n9AzqOv5=&C=&kIA5PHN{TWL!_n1F$15t% z)`xUr){Y!Eij94IEY~EL?Rydyrd~-mPdT7LA21m27J#1lwZ0RoCAir&`&;`lQa^K4 z&dA3MmKnBChg^U*_%Jhpa$>6zMQg&p!Z58A+JK_J?f7EQuldNGan(?_ z-n;1mX|NF7aX#FFur`;5zSUqvUo}fFfw1(Rv+p{FIy2^ava8VGT|OzNu=OBmVZxJi z#s#F{MbnGX&)W3Q`R#JiA}GX{={L~n`}v>R7>$iezZ^9ZSk`5@wv$~OQzuJqej(Nm z?x2ot-_#T;{8Zp^+~9V%z>EKDGvL~r4^kP_{?LWraanemyf4AcE0In1;0-+31X9P* zNM1+(cnL1+c3PW`&+x$d5T9+cl!!(cINR3!BTj$3dmWEmCm&n-aD3pw3cB{)&a}$h z_JfJ;qF)=1N3J|}qu?qm43a6qVwlC*1+)xkjO%v3ewTC#Hrl9omhaKnFz=-NT}4vd zuHf-Ov9lG~PlOL`3cqMMb;4TbB~TH=8KQ7r zT?VSYA2ZFZa?1Vw=oLIoemVbGSXGcA{gHT|!rsbzzI9xRol(Chx&7AR5d4WRO7Fw1 zM8jRUr}9?p=hL*2|Kte;nWtm4aO9jP?y_HDG;%5&8K$BJpc;9r65 zMO-1%fS|kb-Ql_TLuGO|o{9MD;(BSL(ryZFEf(^`m_uPkpFNa8n83?Rx#6<%`t)^C z{1tgN{qYSc(4iAk;wbz(b@7JTr%@Y|m1bYBT+Ap=N<59J^=5SLbs#P^uTBq9XFbEG zU0ES*NO~8%sQ+z;FQs9w?&jbHf4pQWYV4P91L6IlK1}I`hJgZtRVbO)Qy6aHsaA{& z+RrCzVd1m*Wu(HE>Jjueo$g;`RDLWs(ntnpm^L##3wS?jr9au(;71I3Bh+gtpAhtl ziz3tz*0?zOJVN~I<3T1zZ6%zeZoa@Dm-_uT%1p_h#HxQSul^bI|MkVn3q|(t$Hgr4 z8Gs~|`{vDcPpkc1c88kFmWIvl;894edBYNMHYbf(%~QMEc6W1ahAV(IxsstLB>K`Z z9M>mO;fN3#GOf_I-s9_;_a$>rKV?o{XpY$pXHi2WS;3b?bNdFyi`K^*7AyG^2&1F=ZQ9MQ)6leu= z!G&j5nME6BOB9Lt{A`x|yql^iT#&60_o#Q^`ZxOcJifd9R&J-io-_vbvmW5b8vEZz zya#%$afKI%o9yXA8nLCGbCq2EysnF}oFf@RqV_YelBMx#G&2$%z!-QlXjtmF9w^?L zkAqhH6y*7H&0CJ|o-13$c~R-|JRl6(qY3Wz&Q2YuIjRh)7OANl)bv+5{DOFI}GnQ3YO`1o(Zv>kigSQv=rk?;p=N-M{R|Nb|}@IU|M@vARmCw{TH}6-{GITEAVyxaG0Z<&>E~&52xu0bAGh_VY>GMMO zzdnBL(&mzeJg>qAHKCRRz0^KDR(v7e%W-M8)e-{`tB z2A>r1A(h1d#tY`CWX+ZiXE<2)ejZ!sM6cg*EkCCkQ5U(nkSQ7`oq8#RUqQs0DF0i1 zeZBPO8`IlgU1$BrbI4UfHwfg4M{sm3zw&0~qxB&)@`ClLE3|M)gFh5peu8oU?^GTO zrs#vfBjYmA^Yny}@ra1h&5alfQZc0>)@d|g$aT|(7<{}PL;2ja|7Qnb+vf4tjhc+z zDJ^-gb(fV*v1?EvVPVQ- zTKZ21nEpIlmFB(~b2?)7qXFIWIUmmg3ct-hdhbt1asPb3#}VJfMK@oRGofe}bg{*H z*WYt(dqn_D3QB;^>^2;3u%XRGc2+qVyZz6sJnm~yU|pwyVlca5wlG-dOdnDGuj}%+ zdzUD*7fj9XUm~^hx>5RgE!)S1ozwf?6>c?pCOebmHQx_4umrUu;-+P1Z1KjUat z?AUukq6pU7)^>EDT;~p$zfR6_Bp^@3L|c%$ptY#f)N`69Ca2`uYMPq+$Scf(ZC-7@ zo}U#_2p1s3lY&bUkaX%fHq&lX?RUs7N1qsV)#}k@Z}WQxA>voOSLdwMdt~5=lQMt3 z7XK!}9Q56JLp7Ums)x!>S!6NRCR}^R^zcLO4A5mzi;-V%{l>{JW7Jy-cj)(+i4$YJ zy)evyW@(9efU4hl`LZ9qrOP1*i>c4tz~5>+$_(f28u_tnRkVt^7_z*4NQ^Z^04(*? zt%>nFR?5m-0QY#Ti^sx%?uTvPJd^Ktl1jR34oMC2=^4YJm-XkhTkA$b70z#NIcP1_PKw%*m!y61a<5W4; zyawRVU;tiofk{#IBxEoYV^VCP!`P70<8d~Ur@S8-LE0oh!o$N|n_wk1zhe>{NY3Wo z^u=&IR&Wmk7Np@b8Vi~yIV}M)=sHxZrwoOfkWf5-vl;*KuSD8DV1G45-2=xI)^ZaH zU#=Gw1I{)9N$0_%Qemy$v~+AI~NSE>QK_%FEk*$R0B$`LcUfwg3YuQKKahOsvBC)k?ej}ss;+gJeQ z=exF#m(C2rDVc@aH2obr;~qQ)T-vTf%8^?wD&6pGT z(3rMjBWIj6YGZ`I#tzebuSw{Ypw{`?d;;I`u`!un$FT!YbSe$G%)fbQb2$O0|6+M; zM?3B{*g@nDj1-2?&#`LW~ViTN$|rRZ$5~ZmEXg=A_|Ic z>M_z{8y^o>lc<%s$nc2mZfj!LzAOW*WW;5I6L9uk{APnfofLkdvzSLWb=_5AZLkD@ zH;`J@$B`ligT+ldx9J)79-f@udBa&P(TvS>jG;S>ruUU>d7nY|t_q9hSkA!172sBl zl7zbXEF3^XxVgu~oClw~PQ-a)<}1e89h+h@rAuI*R)G7{wLaD|=u1@>GTv+PLr)=G zbymvjv9_-6Z6zhkj;_wyXDDW}QAy;?ba#n{YkwD%^l08pYi4NMb`2H)uu3H-D>K^~ zOl_K@idAQR{TPX5=a(%UpQVmG(#tHm5r8J1kI$=u)$2Anj32Sh5*PHUx;#Z*omSr@LQ@uS2=N`DNW zo)o2aROk^eijqA=3H3S-Bg3k>uYf`!0YhZE9Gql5A`4xr4{E6bq+TW>ceUKL@^dcl z*%aKitG%)3yjtvG?(lF;JtJQ9dN=wcCf4UxYfF)X+3N-oyfn&vVJsik&}EVEij&~k ztZvKw$9nwf!T#5a$zOcO)2w|_r+)P5j-_j!u~%FsQc@ za7YWrn(NzY>Pqe6aQPwEb)D{7K*K#;Fo8T<7Xs<+3N{r?2NnL#&TihXD6o^Y#g#e5 zX(IPkRa45ryu;@9{kQwR*%ET1SNCyDjdLzm47&t#I5He*v{u7;AW*|JCp|r&T_c8* zehBg&eQCQ(sQ4pJ;LYdG`{d(t0|+c5NP(3Sb;W$unNLJiRD<)BM)0ncg#6VL>pabs zpsA;HqeQ9}sFaSxuEz4TW7PVRire0`O_K4>S;j@@?d|PJ#o2~f$;Et7I0)%_gD(!= z{;zA_3&34q81&nfbQ8=S9i2`Q%5;2JTtpRPQC`k_smH2M#hbtLII1MWIV!2v!k=SHvR1xpnfAJhUnUKt^a=E4)Fids$piHGJr)K zfbzM46Y*#Pb(!_8AhyvYL|8~D__;Ne-;<0$%U*NWZ0tiD0uuPzN^my;=7!o{oA~ku zG2K5y(4V|eoH*L!jQg(F=^KDwr>E>h zw#4>-`|~}~F)_P0V0o^i9W_iF_0UgR=aoTGtplUsuH_EgU8Hy)H5x=329j}d& zb#-iv6)U40JFwkHYk}|i_248wfzSPkxP*iIhD9OB?yDs1ZGihQ5;OLa9zoXPIZu`f#7 zrm~eT`2r^QNBU-*0x!fHA7(Me@IkPdE&>`wRdH=^Dp5v#qV!VXo<2*})KEY-^>i-8 z_SCk2F_6;~o}!eFA@byPu)lx#Y}GKri?6&m7bhbM$VE;zu}->`&~hfwE0xz*wfKV< z7n|Yt*l$ce`h6 z-~`riRq5J0q0@N2;{5#ly^9sgT{6jn!cr117IQ55P@DTr`MphsxbSX1$*EMfA6`hKG(DWOPzP z#4E#g_&6rvC>2hu7(QUec$80E922ta$xDj+wBGj*+MXULCYt%T;cxs~ATWA+%+4gbYLO<<*C2d@|R@IRxPahC- znw^Zgf^w8yYpKqEGSzl{^v$l-{_mZ)|1YrUA?&_?|9*1TM-P67qVb;?-8!@B*hWLrA{r4sBtA4g6Q;(P|0Z0m76B6_f zcavS*7b?u~IFNy&@}GSFtY7S-oSy>%+_?0y=s%X%i@v9B2^7^vZ0;CrC^%lE^7-DB z^TxYNXJY==`OO0Lg3~R|DsScJnP?UY=-Xfj=ORsy2l0w-#X)!Czoc*f(UHoJJJR23 znwmlyv~0;z_+|clYf6xEJ4QW@Z%dh|$eDr2GR3CpOIg(9AybX|{up+iJnXxV=~pv* z#IhZ)5DvS`yz~>LLf__dE$^bW2Fs#5iVO>^8oG|jSbIE3ke2|hPo7(R-!+;lryzja zy)QMzAL9M6F}?`>-unPqL~`4=-09h5*z{#zXS?=Ai75gXjM6QEM_mvT)iBypQf)WSIP&WujisZ_mUrW5|5 zrsfg0Sp}s;GXz(|-|pLAHYKlnk9TSdj@Hcd+Ug;QNK?eOy?YlWM}KyG>^*0SO(>)l zFtQ)JX06Q_g!6}j2|4QWiv53oy#E$ud&%tCy@8GEYgYcdu=_tgZ$-@a9oG-fFFURc zZ~2LZs^N2*A50$uK8vWy-U5}@Fd};Hn(O?{0?Vowu5^8(_@9DzKmCeI*bac14Y-s@ z96WaAw`RFj%htBfB$GbL(eELtsi{!B@L!hZ@At(Q3ykPIZcKyT21Jy;C3L+jnaIO) zpeK>pnLgXiTYmBNe6JXNhj(jN->rgk48pd?)kQ%4yea$4tNY=A3@`=+Wtx+%uxq zsF`_D^m5GUM(3qT&4nb6cuq6=MoEyCuC6W@Coi5!B?p1-JOD zuCKqJQmDH0G3=?u_cklQVVZVPSSV;U&Rw^1b=I?_NE{;wct-dG7C7s;!%j#6i#>D* z?9D%L7R{I6One0gB(z;UPD{K1*gc>W>;Djw1>NprDn1U~zol-rL`q4P(J8iGjy(lWmvCr+4SGY>>i6dd>)n0EU$4;t4fNJat{yJ$Z z!Pp8oJ32aUH?2fZc2?*;h`l0zNk~X0Par$6AYj^Q(-E3^`N${_WprHryA5 zggC*C#(M#CelFn_{myH?BY^ZEM8d)JHPDqjb|n#g@Wk~i05k{HDA>%T^*^cSiTJjC zZUZ5o{wQxB&QMTDC=@j{R@{!!c*Pm2APMy8Htj1&cYYe6{1JZqs|XsVh?hg^0IPz) zV9OQSMiGOGvW}B2!|kA6c4JaBl0tF_)PTXlALC6rvi`F;$9M3Mz#m)y|9gdfON^|9dva0J;)imw3NJSyGhYV=2I`T!b^rI9{~DNX-MxGE0DOD*24!kyBaXEO z$QIW-olE;@3JB9!`lnC;%B-K1@7l3_cc-y$l(%bTQWJ~G(Bk-izU+U8W|N>0Gs|6jf~Pjqh~ z@cr$PQ(*~fEvBc&zGJUx{<$v8x&G;&*?B zlP4+x>@9lF2E}d&V2A*CNd*^~y@NwLM#R3&6NqVQ>*y)3I)!WM=zz<8jNedq;MpLt{89rRMzVMp&C5P0%?>H?nwBIb3!nw&3f$62)-{b#6m#S0 zKZ;@p-z%~&A{ejsEX*@hEWdxY%J*5Xzj#mL5WoE8Exk@QesP&JkivqhsdEO3ZQJV9 zzDUi)!b0sWpIS_7d&{~hNqgFHa!I*>#y6+*40B-9Pps-~o-mSx}LXhNU8-}VIH4s~_w335^)@*8`T zP*CY@U%ZK#K!a6E*-no-Iyh?vU?iUj1yr7Dlo?%8BDI8v?9mQg_;x0=#0>i3-}lE) zPPfN?->twdbdzqgP<24{>0X)x)L7NsU6#(MT3gUS9|vT=P9~J?i#U700l3$Xhyy1Ya(y^&l7#V;-RR+5hzSx6Epwj$d~QY-plc`@2<2S5 zbZNyRC@y;2&p&%H&#^a9zi{%Ug%ufv9EnN^3Fs~02mrHhUXy_IXbv%_dJ`1`_}4I& zozoJncr^Z$(EQ)^2>$0+duRd?a2|ja!=Zqi!BE>w*A&9P@#V&X?`py+kk;0gr-Vw& zT0clQL6x6*4xmAPQn7PrTH5)ox7_UbnLOH`{tPtvd~Zvw6b)dOvce9_$Gc$X|La z&8)V?_!&KC^hsf|va;5Cvk@i7QSufLbG6Gdauvc@|Da-kwA8rdm zUZ?TD5@ogH?X6^rxVrUsFsW zk=T1b!yFh(6ZjBNSiC+q8U`F#WEHFLY2M%a!oQxf@;pWMB_V1RlO$w9U%{hAMJk4) zi`~IYj`%BAkV$QI7-OMG(ye><8e>);_j}Nw|FS0F#h@{l|ATi6p!g+3E)1dSl z%y>uIs-ueFMgybdk@lcMQmdsQ#~D0TTRf0ij^Q2533B!sk%2ZfiIy=L6Y`w9*w}52 zY<&N#x%_F8e|h0?&R14X9V8>T_2Ub{L63L{=%1>ZFv_Wf>xEd?#1g%WPY_7)=Jpu5t%V_ z*aF~_EBnX1gfEb`8$JJ^a7T$D4H@l`EXg+27i5=S=lL&EKCgHE)B^r6x-Yo1zuk1= zFv}jqB9u1^MZws}mLob8e8}$Bh!D{>>te1gI>73GFW?^^^ndoyBDi~t;0zNdjj>hz z{{;@I8pwqTqmp_s;u6E#_cTx_^~iRYE>CLrRz=Y}zSN5-M;jhe;ScJ}><0Z7)k5(L z9a`#vVd}CXAS5w$tq9-lXDU8+-ZvWAD`H%FaSk_u^V(cj26K|N%35`=kDnSL1P7;t z$X>1svef1`dC z2HisaF-#*M5$40fZ%#;5Gghom#%=$au8jTyuHB$A7Y_Ngd3JMDHevJ`9su&CJvN{k zlbwm&KExp+`q1#vi7^vgBqIMgh@yh~qWhBfbar-%*)%V>HnysOmdRT7?E7B>#k`lk zT~u`z)ZMmeE7}~@2cz|kaWc8KZSzCb!-ZNCHCYDN&KRB^C!)o3@KX```98{h6Pw@Y zD^u+i*Cfo0w*TS&`#yg10I1*tDV=^$+9{qUBUUO#R*5X^lb_9dJ`!aa5sG zp3PB9Hq-q&+qJ1LFqgN{wF3ab3JpVJX zX5XQ`eQUBg5+&|xaqy(1xNesIall<;wUws>7Nh2KxeiWFA`$-VCyxT=y^9gde*i9X z?v9QzN?wX#tMaVB95Ma?7GWiO||%wAedbo zZa*ZFk~3Vm){Tgt_{V=Q$E?;?C$}a}qsWWj!4VEuetk@g0V^s80?L|? z9xaxyAS*oUIYklxwW)sP6L{rJA*bhcBxtki_hc~unGQ_*eI#MB^^8T=W_xm>2O;a5 zuu*Xx&_Ics*5?7OtYYxt(xvm`u9}*f`AW!bk4}6Uq5zFw>_ossOcr@ZqZ1Ru|zgK)WR_I8sfeZGOU~_@}M;mKY?; zj^%W9wudz%-<@wLk^5-BEqqf0$+`6mLJLF1geK+QC3UQl~a9BsViN)X#6DxCm&u zI~bwhNoQZKhTj1ZF6Q8Z19YNGd}`5%yslYU>ZJ7kWB7V@1EnEYihM*vf#$=9>hWFJ zEFj)xIt8FvgBrs)`UIg=?2KjIlAv9cwW{pOsMf+4AbEd}z<=B(UhIP8M=2@Rc$>p; zn^2A_{XvNDu8or1uB(4;)K6Z_D*H0ry0?_My;%0)#FJfhJ(O2)!5*Iic9q(ZO?m{ajP_xr7q2IL`@Q zsfozb-5p(b;NBnHL%HmGaiiXDMg>IITyz;lv|V_<_uK8RFh&wi8f90y=fwFFtBMEd8N63T-LwvbZ}_DzihAzL!s{SDo=ACOc0TzvQY{t3=Yw-6N@W3o$&~pEt(-ReGgfW%)CpnH(P{DVjSKP zbYbPz@Y&He?^Eswqc+xOwGwTcIX(JkKu=tiXhVcR3B^v%uqJ|bYW~{&b0xwEn@m|# zPZ9X#v9kJg<^F8T+#<7Vx^+W8OSj#r!qt8Nzg+R@(+!hVsB!|ptX7ke zcCW41s;(R_2_baRDl5q>(}X7ja?28{7^Glhn2J)4sEMDfh+BmrF>~&(UZ(NMu=v>>c|cda2<3cE0rtuAQ-jfw}umN~n-Ax}XC6 z>88xPTn9C2XC;)#NBMCCC46q#N0@f4d>PkhdDd)o#qx#T`I%IZlzhS&bYv+yG34%gJy4Mj3Xs(+29+T^$@Itl-UK;llGlwlpU|M4$E~IXv~9jVrtoxWhW)1D zXAd}Ix~gF$g_N|V?)0gdQ<^{IMu7)SiaP+1o+;E>s z^5+koajL|6-CLL-vThqa*2$U37dKnnn(pAN3$>GBJ*V*p&9ras`gJ8#VZFZ$Izy|n z(lbq{Dk&zgHN*8Tn|_u>A(+{&D<3d5OP|7?_K339hC)T}nj^wp=PtMOK!?|*8us5W6#f>IhyED!`j zlChj2AveDl6^;G^h@#*ka}P$~L&>Si`j#xvHti_AMgFGUs0q!!#+EL}_{O<4{cbV! zj$8RReaMK)$4EVXFy1LfUT*ckIpkndCs$orG9^XJ#-Z}K-$cq7<=5A~d;p}n7r4H9 z-&mX9WaAG8EE-%u@$S;CzLk@*dB+fN*+ad~4`+rJMiN+QdwJ>oHVUS@gNmSc4*-6g zSFH6ZWig?q1|+dU!wLUMzgggYq$%9Qm7mY8Wk+q4-68dc9k%ex16~br3yi8-F%jeNd3uE4n6k03wKzuaWr zZ0XeTZRl;T9_oYF%(7{z?LEfX4^-n{QxQLQ*)@jpiDi}YejcEB4xS{+mRuQ#DH6LZ zC&MnY_Do!ay-&bPBtZy2&*+^n3xEn5i?Ss{kTn8Rrq{06?L-dJ#8#Loz|MYneG786i$A13g@_1$6yc&?YiX6 z?3vvy@4q(Yib8n%Wf^17yFD99e_K6VDy||&L^=;R`*YHNI`$!b_cy%9LjbbXAs4^z zaV0@LadUj&U zTM}Ns?sVwlaZYb^zHd_KWf$vHC1$tS)!_V$PsUn%X?ma_>hfxN{_Ndt;~|63zO*e3 z_hJ&@@{df7jyw>zYAZdRICDrlpEy@8yaxg8Fa5OFsy?pAR7-33^*DIly;dRY`_lYR zVp|;ByB&mq=8gOk&XWK{VNLbW?myc6xZX$Z`nGc0AZ90>M|RoKQC;+8bCS0V+s0U4 zp0J?!B{uXaafEd%rayu2mnbDL@$e(NU0ptBuS>l z$yIN2CGDHJuDiOdx4$(AgzDOfB7yxOyxq`?x6<4W>xZcP(yb{^GNyuQs{b zpwJAl!8#DGl={fI{btTC<#1?!L-)id@fE35cZIlHWo~#wrNzbF!+f!x&imhDR_>g-;FlM`I9F3|Y=rao(kYLVNf30-VDC^Lu zy_20trOksFF1E&4-Hs0vvDPd;w=ST%clt_J{wKkgy9Z5PWQ{$<@ok1H;hb0lSk0K6 zA%Z+(&?8rui=Yr$)hSXo+jqJ{m>Q#mHGOc?47l#IJlMRmd&qHyyAO=V72Jey-e{pT zdNv8x)ok_f>tTMugOQxnNS)B2dsETli3NPklF<5^WSoy9dr0NgJ>6rt@gHA7R#PcG z7bAt=Yt;yg_h}PrEzzKgLv*>AXaTYe|MhEk(!Nv~OMXO%MDj(Ky4yKAzHSoC62@!O z!|Ro3{Gn`*TpmNrUcxKl+NwEUrg*sE4^{dmL+(YQB-U^P%@*J8vT~q|{+&*SI*@M9J$kd8F z`gr2g^m)~{mW2C!q_7$@d4z6#V-4qpk(v+JBZB%nvqb`rp3^*vpki0mli&PuuMo~U zDcy2zFOO#8Zhc~N@-N1*h%DfP;IMGV2A6>L!GazNmlvY`3_R3(RxFScBJCqybBH^;ohER? zP99yBW!VpNg!Hn`g)@RvZBz6>s-Q&)IYH=E{);OrGTs^= z{HHyzF%=Jv$+S&(gHkO_^Yud_Z9;DEC;9`TlCl&mv~qs&BuXs?eTDvJ9`^{((hCM;>?tnG8)yR3?bhvUE2o~xCl zt$Y&5N*{v_T#V0fFpprYv_WZ6MqnJBM+I8`xKc?-LvGAtnhH0z7 z%X}__cD}N;q^MX_!Us*fTXWp4JJB|n?m{MQf=Id%$}?qC`<~0&zVD-}Ro(-!3$;UB zWo`Zox~HOpJljglhG{FG3u0dE)$O!eqAhS!W7%;rlXfOQl7& zs41~Rr%u`19}Cq#a6np!IQlBO|&CO%|yM_n}QV$cEJ!0H=X zS*pGghbXM(ID`_Ps)CAd{;ai{Trq5Uq#Ge$|3+2kBqb;r3Wyn&9vd<9%1tU(y%T4j z>}{v?l*#NCPDxDQX}J+6i+atR_9XTRCjzsKyc>=y&5?0?7!O45Ky==C< z!oLXGeyPWS{nM~Fpk%`rPnh`(;MU4Mgx{2)h8Tpf&2cf>T0TPuXl1-Mr25X8TP+%^ zVYiTOmKl zPiW3)b^r+k*P-g{WmC$CYA$Yy)RbRAE$_^oIWKV8Yv>l)1x1E?ng@h_r;Z$~J;*C; zFhqQIxgql?qg|pHNpRAVofqXtUYrdo?(94h$l9PP6j?!ZD|?>@1PWeS#3+t7$_U-E zFDDS=h4-6l$$4fR*Z|G5Lc0aHVV5sot{lA*a!SEmEn57u!1E0=E}tMCZSP0j*wdk* zKI^ENfy@}f#L=uWvrPP2r&h7cLSVh^;Lgylss5%Y$^5H3Ke;c8qWEMO@{e9hH*nWL7IM5%VXdOYyMT7D+}B zx$a)5)%1zu(rf1%=II*52PP%JiB`Ga>~8Gz%V`SF>@rYcJ%q_|jQBS@RWr%@~c9*N($_@*|LvG zfsXdvj+3*GJ$59)b2COjqS+TaWSnAujeP+ zI`iV^D68Y5htSle%fbBKx|OrUl)$@Wafgodn*o}2M=e&SV@sf~722;csOg){S){z$ zt3IfWYK}pNsm&6jx$+V;lRm+y%qe?Pu|OI^>^`jc%Z{J?u{Ttt9T8y$;G+lYZ5)x; ztREEY*hM#6NGH;3Dr$owdw+ka>a(-&hS3Bkq$_9OF;Mu#4%6-1MT^MMqhUh{Z6_6c z<^nZrvnCP_ddo9#>64Wj8+Q*T6duRN;y5^$eRwq9qEDZ`iO-N`y#A@r{tu_gD|@S? zZkKVlbVeOKXBjDFQMNPGLh$#_mNRfpLhxs@cj4TRq?E26OQ+U{iMCCBYAd4!qA&Np z{T;c1tuh&?c)H*G6PC{2mz&@vvYW}}b^o4v{_zs^LLe^Yb?lNg(TnTBjzTsCsfK9e zVLFMjaItp8deAlK&?K3lo7-zE>fN7?CdU^)>9wbY)-U&HWgw?$1&+k{T`S`xs{iBg zVl*{tD(!k)vTh$<*vQil8r$4(AopCI#Z#7Ci9gKlv~2(qo=5qhP{}i_D#k+6X45+T zDlUZ>l}RiYAHC(6=Sg%*gT=2relPz`FJHWtBLO|NJRcpQbJnS@q&<;c3xJY+Veqgqo)uBEd~OJ=4w#Q~5) zlbx`sr+ai@My*8Y=3ft81>GJY5RwcOqdw91p{k%5N)Vap#j5r=xw+Mf_kwOy4gtv` z;((_=vmMXqiMVXWJ*;c!UzhY;<<{u5`|9A(j?WlqB!5tj)yotQJ`-ury5kzAKG8ih5X!~;&O=DpQT^a)mH+wJmb%SyT~`i zf5ZeX>(=hg^{@glp1tzXzZIx~Ob-?DbV72PpWk}F;bKd{_?>p#|8Z=MO;yGHF88R` zl?OKo1^h3@c)Ul|1!^^`{a+k2E8LM?@Z1^Q^CpI&l+FR)yXdkvTkgk1%e5eZd2ZoM zcy?gFvJzpiLeJ9(@0uyRJl~ysPDp95WBWLTJ4p%el;U97+`sB$rsdeS)+%t7CtHcG z09({AA#o2wy??z}`czJ7N1>HamtWM76mIhklbpcVNbcm~;a-PfNhvQ)n8({Y_RD!- zendBSlhLa&n+Mb9wQqwNICB)_v(n@Pp;l)9Cri>{4;d=aJ-FIG^kq-qwqM zr9kUH<_m~#c=~W#ET84yHP(MFE+M4lEYznpDsh@$Od&;O@4}7^7b^qrab~wz{gE`EFK$ z+&By58*RpByql$#yex7QBE`7^wC-y7eiw<8i5~Z!>HRn}OU18dyUg|xGn9z(a(M2~ zGo1wvr4ihhwV#Q$Pw3B>9;7dSmE**lwU&Ei<7sorho`lT=ienJu-(&$Yd&yO9|VHz z?|kqc0=#oql+hQ)KG6-n)=b7u zdUqjH15!@I7hCf$?caFLS}*x(+(4cGC1d!RTsdt2uhQqU_4tqF(&zI0AtTRG<-ejA zW-wLQjsfyD^w8%30iS`-P@BC!o-Vp1TcA!zqs#qfFc{K!woKM@72QyHmIuZeQU6g4 zNB%wp>2O_|AywnZOqtGRBMzYvg`dQn|MFk`zwJQ&nDj5;c51mJ?~qC9EU3`TiH!5XKV&09QnC-|H}oiroZ!~l=FeN37^6U1~aD0e*C?^`$^t=cn8w4>o-YsyiMEg_6q%O0W^7JlpjQ*h&LgcE%jf zbrS8ayyWyXc}&2&8|z@>(DzXjcmh;MhLyXPkLr%pq8TZFD=yXPA=k7pj2neRv=Vab z0Vg4Jzj@a3$&#LNVVMWMUowMtLEw){FI}sdIVv~o(Gm~e>^z+E?v;FpXP6OAmM+ZE zpXv|QHJNY?6~cnN<>_YCo|suN@!EDSYj0??Y-nj`$q)o5Gk!#HPn39CneQ!=6Z_o+ zB`=V_LShk=|!?7R(&N~FL)q0bmM3?ORHO}MI z#d=uU568U?g43yYJFkZJz$RPjqP?^18Kp;t7}R<9PP|!eo_uYFDVk;?wD#L1rYC%- zp;Et1oHOm)Tg%NI#0e!X)tmUs9Pp`)SAN3|-c-9#H=R=(E@PqB3J2j-(S2fKCL<>T zFI;NFJo^a1g!L&e^;lW%xtD7c!Dp-0thF-XC5Q5F3bQxFA|@wnVo8`<(WkvsfA9Gj zAd^_6RaW-(_JQe)_T?P+94hxhSkQPZd!=0^&pxs87{WmgvI1yK za;$=8uXHaDiIVk>E47!k7JWjbsKrDKAs1MhHI!W3dgoeX&J3by@B8y_2DOOTqq0Wg#1-gMc2e^^orKwG?q5UR`jX z_(+cP&cTz%vYXo&A2O2eT6&;7pyTTjZLLbsKxz9)#7iFXN=w{nk8=N|{!W@L2rtc# zGgSm0#m#h&S90EZKD8HrHk=55mL|9b$m z-(!#-R3+g)KHKXeza*8SL4^z%9L_$ok#RT6hnvu`oT{m-Yrj9wbl&Dgd=Q3lJg)P% z>T(Z9=jwrE`%0IgWNv}O8E>-2t@Tb>jadoErZZ8CA0olh5ZbdHRN9%5bF0%gq#mwm zqQg#C+sa83sB~D0Wyf{z*;2GE!eBm*-u(OFMlBELXN29P4P=@NGzqO=aqEQ~!b411 zc)3KCSosucNK#y-&JvQ75K45NAHuE2!^fy{V(PLkW<+@U} z*f}+kH17&Xz387IgUy?zOe$mZ2||2yeW4Y>KpR_Xi$wH zFMbJ2cJl0(Ja;>$lJW#Zy`RYn%fAa7mQRDrHbgZE#|g36U?4sHnC+5?)ma`3WMHb` zB<8o66-@#B#c|9SmxlI>OcN5H*2jlOZYmEvrQY~4Gnt`$iI7ySqI681qvUam?yzro_9F}~-z@=|Yv&7Z%j(!A{FrT!G5?n?l z&0*x(|+c~d|`YwifJo?84fImcrZnl9n2P#PN^~;%2Ffl zNs*iryaua7QYD{uJY1bUhX2NmkNmXLDw;FnN2FhKXvlIR;j~f zc=-8#rNE&gJEnOlHH)pKzM)=NPMDHh`muQd#Zjev=DSi1g*5hpe$ks^h_`p5G~_lN zG6(sFQ-)-Y9%z`0zc zdw|sP4AgzlyZb4nmv@{^=uI~<<()T=_Nl;nkg^pMs0FmmN(hBW7KtP2iFBo@WzJtV zD17oVdui>H-#A3$nAGR1UAn^}-cMs!ZOt?MHDTnbzJ!t07Z&eIG!pn$ux_dRJ}F*5 zVw|!3gDDfiepUYEzm`yYtQ-blEniSWrUuxj&!PQ=!ZlNVUb3R7$^ItPNSq79Fw`Qc z^`W-t_mSt`U6-z;|L7-CMV8+DFh@)Vt!m5fTAuwtZ)UiJUNTO1G3`vUjhow{%s1Ab z>dqD#Kj(%ox%G<%vGc&@Yt1*;Hp@7(F-hcvzytN72hn#g?M%NhW5P7mb8&g4z`rC# zQ%y*)YAT5FyFpphpC$VA9)z^yo<>c-t;@zy=v18WtpAEK9rGA-D}%x$Yod8@w87+g z+!{v+Ip4j6g*384G7Zj=C1xa*EA-bTx|IR|-U{(%1dM;2Sv?VGJpBQrx#Jl^<>`3R z0ojmJ1l4!G6Nvb;-QELQ_%-)Ef_KTs^IhY#T}!#BS<4*=c+D9ZH#hm>pTAl zR~0E-w&PzjWvEf8CK=3O4d}7`%M>#D;_jrYa=MtLwE_E3cHt$(j@Nda)edno#T;Mr zYgP69(_4Sxuo9FHr`_yOrER#$J}a(GF;G}vr{219e@L83Pfv*_9(Npbr;2lVKe{U% zajXCW=?=UTLI5G7m&az+%lVt-Wf)p@e^qKj_w6A44=UXtn({$wAf8O$+UqT0*MD($ zEthlq!*A)Z%!tlknOr?V=V}Eia7XNX|>fP}1n>h=mKO{p3l$CB?RK|*uRrT;%%3`n(~4C|q=d28^9j zaJ?EUx@TdS`ZCH{qv2A3F6`nY46AhHD_Bm$lM3A++Rp7y%b{80gqxN-zBM}ycbn3- z(s|Kx^<)YU50Br>eFc7b?<_aDR%-4_QR&C)K5OnCjqf@o(p_TxP8-KaQm@pWt?<6$ zZX13jy2|kYk1)qVo>+<>5K?)5X;q+=n3?QtIG%E_N$-@47WFWcR0yvSHY=;6&hSWn zc^=)0vPVkWw0>(4+S?s&_N%!qshq89L0RfK%etZX)JmI>drFDHojc_NG7f%LwF3>| z_{w@IYGuX6njOv+uyaNiGKi*W|{D=Uysg{>of> z9W~?H{4z*SUo`Yt2t@4TqEZu z0RibM3M$e>=@9896e*!6h$0|WM0yED0qHe#B1Mqi2@oJs0|Y_|Nq`Xe_L-SGbMJgJ zqvzhw?=SWD+uQ8D-}SC{t!F)JJ@Sm7-=(B6v%ohA8>`yG!h&Lgw*(*L=-VH{6+}<$ z32N1#*)_<1j_N zYf093J0Hy0q;5i#rHJ;WohuTcll{5C?gWWz#gxBDt zz|6;NznzZoSf1%BiXf_`~iOX4?$qSgkbs&J@()8QhmLaP3@*9GL%)< z`e(8{cD{*G7r```e(tb^(q5JOxP7v?ivt6r;1SXxtxBn!6YM<%oSN$y$W*gwj7b&t z^kSo+HHoA|%WT-5Fap(LoJ1S;0K_VSN1;1gqh>d=T4zLI0N%>-res!_)ZjPw8p8)N6lu^zsMr-Q{@J<43obI_ljv=l3j1O$lP+vmO*-wEu^a{BcJk%wYW; zI$B=jGfwXj}@4*E6GkPodtTFrilgE!rrRnn6WsIxL!VcxDw_1YEN!qh! z>e0*J$YszU$*`EJT7Oq*2lPDClp{C*(O}x;nOb1hY#RBc-dDL$4%uy9c3+)-O|iyN zVTILd$DD-)POtQ$3&)60be54L{(mzs5USfIVFIrxlkd)t;7geujQ-rmdZT<8marJEeiqZiT7z z%zeJk9qLp&b-hB=XPS5Ll7@{dXrSV=<_>6|KFY_T-_AYq!$3BA*C7wA^e`2`srhay&gJ2_qo62&Yk@!4$rz{k7O+?1_Ikxkg zwU3XXKJE=swynN%O=xet;Ng7+Cvq}zwe_t|EdE336-|%?EQo zW^PLZ7M6OB9a2`ti$r6N4-QKx9aasB=KUS<9Pyyh8jHFYu*Kc-iJ^`&2AkKRmWXR8K;U4%k=Y{Qv7O>$*V}Q%!UZSZKo?= zW$#^per4nkde*x2J%gXmBex{2x9UhPd}l^+gkl&q%E@&P59rTlsOro4IC$8E-MFUQ<{pxd5j6AjNnu`nLk`9>(| zo1&lXzpFY@%9wBe(d(Ng4!Zq~ZwB->j%NWq8Ft|56LqLy^IsK-zx_>UD%a;fX94^z z!1~Y1#>QL5ox{e%necc`_b&hXbHMT;G{4Kbd_8)7vqMMDgHVP$*m$C^fl$m%2k(EZ z7b;4R+kb+1mEU2Xq?L2RD(QO0+Z)nU{GPiZv--v5frfJCP0emU{M4J7m@o5Td}mxGl6u$jx@`FC;HbctgNucjLNFq2#)>Yu zajT!k_o&JO4KiBN&a7G#W|&DAQRLLf$e|L_W=abskT&Z9tS*MtUNs99PCzY%RCOte z&qRx%uSH{^pMq0xBDn<3x(kBBAq4GwRTMeBees&T8(;4tk(I;p5h*wNu7he+>PEjY z-0I$=}{baXa_ zc7QPNz3H2pC7)DV*e!j&Ph&(wJyI#&Zy2B5=li?^(+<%9g1u&Lpu&exPTXlK?ppgm zpUb{2x9G;cz{=bs^YpR0GS2GoKzZh9Fp3tT`q)j3qk3@9W7k-tPYsj@Rj%F{$Lctfg#1e-E?qtgJMacJn(!6LPIzCO@ zqTw0oCxHZ&Crb_|W z>3Z2MlV1=SfP}sRu|G>8w@p$C)HU*7bPxFCQ}b?5;hnpgnp91WGAbErL)DTbi8nHv zW2o|gGW_qi={m0Uc3kmYWGUX0v9E^gKw3s;&3zXYP)AUvHq=I;1n(UBaradL&Bci` znkZZB9#OR!%GncOf--}6WuGKbP0*jyxb|{bkh%$vDG$5Oa-cPhJau-o#Rl^D>R}+( zVMUzREp>~vy&f|{;j5R2I8`O4;$@{;pm7vCkAuY1NL7v8iqDO3PfRxfq;U>jX*M+a z!XdN|HWN@MA{GH|A8FKks?nbH&XB!)$myyow;K~rlzB8TxlW3Xo?|0iB@Qc)DqBI6 zX*1g2^||KdFj+5LUlmXPdloTfk>cvfGTB3_&PX%yF^SgtDmRDVaikd*uMbEoU>Ip! zpB~KUO20=DXtqm7J0&%13RacbzvA2rok-88me`b=i6V@&Wmss3)yJG*+Z5w0*wFgT zbpxyJ9kj>#6fZ%^1kqD2bkWUFR~bDV=P1_Y`>1UISL%C#jfstchrXoufVv-CN^F4Vf zf*(pEcd)7*?%TvqFAzawHGhkXVl~0~=G%AmJ1t`Po*KA-cj>sA;c}j9%zb^qjb459 zYKiS8RYBiArZM?wIE*(AJ=!-+oa>9L0bLyFuXm%R`VroYBV9?y>kiW}&9IM-tCJ0s z%-q~pv7tWG!^L`D#c3U(Cvb~msk5A=q|$_Umke+y@E>$uHbzf z$>+#>DOE)!qgyuyE@G83o}Cf78IuW#?;Xv@1tS){-bnk~qqzG~QJU{<;R9p|zgI&v zPb}z)pxsumIXo$SxDe7FcIEcU(48Etc#{uliCZyMd?0?P6&bmPF|AO9{|MpxhdTGp zHr@M}7{{FwzR_k}IMfzP7{X>mRnxz*341(n6~?;eICRB?{WqP*t3Y_)E#)wAw)urx zT;ZvK>#%o)=1)U)dE`9A?@>eLJ&;pbuAwhU%Og|AnU~HTaS4rc+@=V9`=uD1$bh5bzug%rmk2N02RjUka6=|S29rxwxc9bcM=E!oI%y0<2)+}|d zNeo(;TP`6AZm z?6re?6tC-e9Lnd~y^L99lT8d^IHQoXO*2@!(@Y1_PXVIfTbw#qB1mf@4BE2y8KLl- zV4Zei=W3NOKmSx)1lL(}unL87byOBxC65T(TM(VJ&`x+PmhXuZJ*C|QP*q5o zCEu5ayvgNYMJ}@cY_&FDQ1-ioqL`VM<3ZFrl!JMo+DT6FMtUvhZ8Y_S&OPH{w6ep5 z#T8Ug&R%EUlsA#q<5rCXNx#9fo9XyzfdDuFC_VTP$Lzj z%$HuWQiczf62)*mo@$1?>!zU=wqJ%E!t1 z;dZCUOV~$BBICA*iatY%Vw7f)ex-%ILjw}Omd5}_8B=id_whVGc6DcQo9LK931 zE2Z8tpqi6ik2)12x+9M(lEU}enZay&)0j)u=tgcj>u<{6zfKD8_jX#xk7#{Z2ZFDe z#E<=-+AzekK{jKYO438MUY6RpxsUC?Rr%a3`K-zdg)OB>LMAR%<7F~&>11U#wXgf` zAofii_U*5F(+pio`=5N3UubnT0L9!FnoHB@hKz-23f_IUv(kgOWabg(f5AIMGe{wC zN7KhJsgnEvuglW6T+6*6c4sX(WjiU&K>I?)Se7qj(ln!1j6b-o@YAf3g7c!NzO^?U z2PKCLUWCXG<}z3!rl(rmT((1+W|W8K^wJ+J-$i-s`Bpon_f6?mJfl$6093Va)R&M1 z>Lo2t%Kr&)fHgm5Zxl?*dOG0D>Ph70F6S{CW%_J$93yB&c7Rw`N&ma#Hc`cY{klJ4 z`CyRrdEpdD)*hHi&d{|~Yd2ozyYryx~}P)@wOOGyz7K7MYY_ z>|60$`a_ca*oZ==O~S#ctAAX}sd4UO>8fWN{_#n%(X0L$!+e(YU)Aw6dX47S82S@i?=E8qMxR1I+Bd^bm=m5uSf*j*-;2WzLyauYo@8Y~GJv(I@ZDoX*4;zaY8Bg}LK z*^jx;G~4CV&Xe#%5-Bkc=TzT}WganQlm8+kjMpk(N%ty@PQzfZ@XmpKwYD>{QiAD4UPtQ z12_sK=M+WT_vD)g=qA65-(RmN7SKpz6sw2B37C1mTZiuLMGAa3JY(9wWWF@qJ_v$q zxcV7<1#xse35NiH8a(P_AdBOuUc{z_YM|EG>?a}R)l!{(?j z-@&Kbh$Eo`{iUaPW&7RF+rdTLnU_Fb2cOW6y_25G`of}z;b0|izN?-%$Ev{e#A*L9 z@R_K?#Y9%oVN!vwu2~Her%2$J)XXy966Qi(e6z$Cw)d%++-Zk+F?M{A33 zXw4LUpgaiFG}K=crsO{$Yq~+r^)Anra`>hmi+;KIy$D7T{HKKk0xRaZv93y}F^9F+K(p()) zE^kLv{F$aRkaoj72K$1G*kE4OM}oMIIF9PLr;b_%ZB`nTwVqs}w+DJayDC>jdp6U!Rb@5s|JLQ`ZE;}t^H zR}NYFNjX{tMX>wi?S1)Kyv{e5OeGtrA`}=OIEL0OFt#})BTx*WiN#$2`;hWCwL7Se z!>_g%_yfFlu@3gpRl=R&MvzQ+P;)e}NhoG@K7?yKxxQY*8%;CkAu?01YgG<5X7Oa_ zLkg#vlDq$#xecoQNBW;HU~3JxDp85fhpAFYQPaQ_ z#evpOjWC~aN+T70@GwlF#qv#UcxK1hJ1<74s^&^io9&Nu>;Pv0KR41TE zMk|T)Y#8|L#>m+@3gDW*aL{p&<~vJQuGrdjeAY9L1pgGx{7XCMEqLCAf{$jpwe%ma zEgIh^7G)N18fo9loovzfrn^70plP3mAm0ZXvWvGXiz4)J^^WT2q|3~d=>s>k_7Cu5 zrxg?{hm?%~@{fU1l%=Ho@P)tgYR~$ zm*yFGsxz@&EHrWhh(%7ep~f7ka=6XxI8Y(CSq%t|Un~`+i(==WSa)Nh_ua{Dq))zi zSF4x*Q436IXz1Fj$L;d^mHvkrtk#3nZ65%XU+d4XK(2pjDoM*$=l1^Qrc6o;Vbg zqrlVxSa(ksOGb{I^<(lkldtqgalVh$&F<_9GA1M?nXh3M1LySiHMKu&Z~J6dPhX8v zwOcwGz(MNT4w+D=`Hmlt$`TcUXK8 zBRYW0hk5;CQyCp<46y6Vy3bgZp*Q{hOtV8f1$(n8P7`HQKowg#ck`v()j?=e3wQ$Y zL@A!J;!m8LP=`aZPK6<#J$YiEuUpKbq(U`aJaCkMcMG<%!@4locvUe6e+M%Z5;vm9 z1Ia(z(^7+8ckipDe90=>oUDKK0+GG5J3yj*i(hAP5f#oE$n-`Ax5x%kpEZ@=1;?8Q zRjDVl6OswHy(|9vzZ&o1|w;o8p?e4fV5nFnG&V-{HvRwKkl^^I}8QwlW zT*i%)Z$`QhJ)&5ps?y*MD$1A=F1y9Ql+Nj1U z5BxoUkZvosLUHP-f{%M8?Lht+yEYrL`y`8y&yqHq)D&t$*9aAS&f1Djxlogu{b1oW zxVlcbYDqH^k{|Ma!$9IC0< zT@yLkA^?wL%ltHv)>cp945oqR`bJj>cHV)%<*MS`*RMXvv3PPp^Y@XfX$Gapu)};@ zS{l^HbV=TJsiF2jvQI{q-X};i?N*zLxBL@oQHGn?7et|JNYOI|Bhdcj6ew+#J#N6C z{YtEndkSvqo^}I}R+U++CqEU*v8kJ`YN4pIwGb7thSW`9dGq}mm-Kyiu}QN`Uk^N2 zY`vWD>rFs?s|72yMqN3SttO{ zxsyxW&lJAwFy^7fAZvgK9$rCS9cLv%eiY7e=gK^_pYL9=|ye; zi!CCN@_F2#cUm@2qQ9b@io`qu$2L z#;L-?*oJx5qWa0&?b_ZuuloFpJrhw;hAKD{moG`Rqpwrf5zXOxayjC+{h`!2Iup>mAFxyfvzs<%+rPn@B{M*<*;I6bH|3Dt*gi0Uo$VXs`Zfz9R~i2Xx( z@gFdz{}GT%cVe);yD)O`o?e*7v(}{3&SSp|MM5iGYR0~gOncT~!D|WmzTiyN=Cb{x zQTgW{zLoCHsa?CgN9LCLmPgR5*HxusU#%UrjW@TJRB-1tRs8I|Il66J!{!zWnXPtr z_8ZQiT)p&XOo3Z^a6pAjRqaroQW}Z^AY%E1hLMKsx%x?> zBz)I0YG?&JqC(q-grQ8kWU5Dr@Jd)HoOg8vO!FDqlH@3jK=uIk{Xf3cKlG3&=Dk#` z79ne6Tetpqd;f_o@e`N$jnXmf!A6UJi{$bYZo{6*9hD{UYoyvC*XS&X{JwNc?gT)!&5f8^J`bUK-Vbvu8?t<+}S)CkZMR5it`)2N2tHQZr;sk;By zpE98K0&6~#oIw>?EW>F{#5e3e%XB}1y!`b`UYHzth$e|lyBh=;Wj`+IO_ehxQ{t(> zgvcr3vsuMnGQ6g$|B9Xd@Lv0v+jn1a-9d3H^3$l4N?^X1G1~BqyUHKGc&k>LUWjAm zU-IPded3o;Twg!=XLle3T~r0dOBuSjxKt*eSMaH3=9L--kff1=G|pda`Sww_Yt|n< zSsPDP>QxwTgyql{M@yLl2CyvqV(?~6nY4Y9^qs7=iOqT|->X^@u zDfuB{h9(-fztR`D#cO28+yK5uvb=ZwQz36CgG>Am4wM34g6$uL0wTMkaB6=0b-B7k$BD8Lq$7q6?#WLHhW-p@ z`V$NDzg;pM4hXyh{y8b5zT5Eh>1NSmu$gAMu5aH;+SIu*9XdGxorpg!A;GpK=oE6l z-Vaj=sp8<|1Y6&)|0~^%KXLl~_e->rj{y)W!`{@lGw)-Dt`#VX0(>o>J#RVqejtf3 zKDA9uk#QbRcEgrRLeRlh8i?LMH>Boqyvi?KO?#~if`V_;!OT9UWqCm2j;T&oHS+eZ zDKtVg^#a)%;D?x$MD?r38V~!FDjIw#ZzxvQ)(IL6NB_Dz|0{Q-lbP5#<5{=sqH_e# zhK)-%Zc5@OD$A{;A@&`D9a2_X$GSS~tS*20|8hIS96NpH%n88GVt}te3Pn8{iqNCHi2uwt= zKYDzdh+Qyj7=9{eq;G4}cXn@G$NB%4&jv`2RO&MqhK)Ssf3ehW=DQPJi~+;(a!8+^ ziLkf_0I+U|v~`L)_zE6JHy#Kl)Ao|Hf4lJOP3_W^D~37G?(|5&4(& zhH#&%t6S5253GFWBB}~XO0E_(rl)^_Zw<8rHGnkQ3%3PpdKR9deHmcL=V^<#u}Vbd zUwS&eyuHQ|^3@zTr1rKy#K&VcEd(6!qieDGB0@stK<8_qf2?R5EG9PAiboDvH9!Bc zT5tF4UvUC|-SefB89x{mkO{_9Q{{ny5G>{6yk)W^(c_$qdBSDC57MU8EBdE@@goG$ zbw294{y7M}n+P^}^r%c>zn{}_(WGh|n0v8Wj3O#@b#_)1A1o_NxqnL!^D}=d*45jK zoWG>ea{tEu|8}tb_v7ThUw4~_{ek*pfE-z2;-oCVbk5BVcvanjCewVIm|bSPG+_8pFFymjQdw(9A5lon~m1qrp?4xtg-b8LYJXCRG+X0SE*=F8=f}+tAQZ0Y8)< zOrxyB+5w_)?Lb}g-mi|AA6($$vo8Jj^9Ya%7Fy#yY*)fG!l-NAi4wX%6?0)>!Q)_3 zrb{6e!gN-o)PEmw=pdk(R@=?(#r2D~1M)dr#Wn{)(-H5qbPuN%Un`aLbihhrz`<0J*aEtEr z>C=A(XF7FK?n;E8%c2=u9Ff3`XV z(tn|AYin!mtw36-0*C~R*+~ABgRTN1TFfiDu+_<$i#pw+IZz?B&Ej8;YRF#DGSvW_ zNZOUJ`=I?n+^Rs70w@z+j8a5zuV+TTd#+IDS;_aB-q759_C9Ks{#QFSK`lZZM}BG@ zxxHM^bILneVM_p9R#8!5&yokDBFWPJH1#39zeH93>(+F8itRz3T%Dmb*&P_N4djcb zAQKgzfjqKpaA@eyzFz}CVCFH(sMh^cs*GEkkNdjy>)?|mZ|9tm$C=Ak+L}t^f8u2M zS1yS?a*TFO(0(y_m&iFz6s*ImxU{}{NU>=atez|H702f>rJh7L=W+VKs z{MZlg{gT7aN_Cf_j!$0`L-mn&aZA5)L!}d#E?r7s+s>!rqWS+m75W8EZzqt>{Dhd= zUSQR3;`k&`CUu|?6m+$;UZ}TEetc*F3{%Rue6{@BFMf*Lks}L@p2uiT{erSy8}DFq z$^LFVki$-XFp?g%{qpiHUTi$>_+bik0O zMz7?=#sbM<=m=g|6!nGBh}Xqqt8!B1Jf{~M6|jp9s4;-Ry;4ldgVDEx{@LBK!A2LE z(ow1ZsGIxJC;wK@vRgmSfNqQvW+(yi&fsa>%|c z_`kJ!XG6P6s@gSDDi8;=6y%GJN05=S8bISi-_GtcM?5>&^(HQ~*LStA0PZt!88t`u z4?b@mKMcMRCbmA8|TL!<3lQNMu3nIw4%`U>t#XA z+G}7<+dCWf^%}PCSNlCy0Em-#WDlKrJkkt%td?(c z?e19)4g>fBmk=PX?Q5W~Z(CEd3t$mW4<9}R;nhwCpn8lv#+sB>Tf{G4{)BX*S+g8j z98VZ%v7Z?zRr{ru`X!bQD2iV;@n(aE-6kDjK4)oA3^H+;_6=KmYhzkAT9{;HV35co z2OsoUoqzx%NXo*)_dv9;@pl0*M?5l>JS*g^Pbo?TG9x0=qs1CBnVS)DUaDk|dE?rT zed~|R^#6Eut$eypfG@v7)Cuzx;p1z{)&SWs%dbjP)^?G0T~g()<=fjglW#hGh~SbO zejg*`6P+qoSp~2Jk?~;PuElOx-}W?l&2_a1<9wnEJ=cg`o)Dm2JM)^USGbj5k5fA)y|xgfIA;Lp6fKx+L0HRxY3f}i=Z+m7r& zJ>l|_-Z{;a)WDzov5mvAy7j9H`EpIfsz(M_>9y{jK5{JNg7`&TO4jc=$f-5L__(56 zLyjkTRpv}@kc=D9K0cu^H|>IPs!Mgu?2uv9`i+nE&XEsqE}rg`89spP)!+ZjdR&07 z6oKJ?whTj1P9S^{IR`I#IDcB}>-NikmvtGdqf1IkqN9-sg03DvEfM!0H~*9nT!}Oz zkk>Qptwo%fOZiz*s=x9Bx1X<{wY9fDy^X2M`8NL3N>o44d-?~_tS{47{}i2Fs*=_S zcl$MJp$$g2`<>U*cx`~p>90K6PhRZ%`L>&zo87cpUyt1{`9!}3H0Y&&x(~cVDvyoI zuX%_3+iEHL#AzSb-k(=y{)ct^(Z^ctIr0kbOI*Dr{g*e=&+LUU2;DK7<+qBczs&+5 zPkeSU|3$lw3D|Ny<#Ut2X3G_`+uC0PR=YTbTj2h$S?%)MZaQwu)zXM`H~zo5tDpGF z`+UcMdPt|z;XJv_Yq`v|r7}K#Ao%=t@YtFuDrybm`2iRcm|cH(u;NOJ<%}at)yB3X zd>ZR-%zPSkTc4;@ld+u-SjZI%j%{I)t9D=N&mc8u?k)Ckt$$GE^+y`RzTSuOA}VMC z4G0`H3s5nXa+uV2YMkj5e-6kIE0+0?lD0e#X$VC>;RF0AjY^7e<28wtBj*n0cowr@ z!`1P!H%$5-S}f!V ziCk}QS9EijuCLjj$9cwc2R8dr@ zYuZSg5aQ2rPO91%y8EWi0khM-ws~-F2rKgG(`IKdm>yn&kS7Cb&gQ)cp_nV0!v1?C zqs|h(*NT%j8mY^o{ygnq?I<~irSB%w$>OBStuM-&ae#QoXF%2K^MV}q(9Qtq;Ek86 z@i@*rfik6J(DOcpopaWJFUM|eSoD415zCQz?{IkZ_y<5Lsvum!`tkBexvIsGNuv{> zAS1uMG&HiZc&<2H()$6PYPZ+6?b$h}87ay%ZDPD7tEsTCd_W!gAAUZ`Q$O^4FFbJpe6XwMVPF$xk?MCCjJm4Iw_ zRmSwFJ(BmJ7TP<|d|$1T6ZHbxJ@T^5yDM&Mk|-LtDO#_uTV!kkh##AvXSs4xjd9}W zhiOEj3u-~O!vcyQtt9yX>Ru*|)Ypi3!c<*6q`0=asP2=apOJL9^C|fk4|ZpJ&>!9~ z#kU&P=dT&n`S}l#;^W0s!$o$xjT+6Zyf3v8cOc^TG!l>l;6pT)vMhKPIU>}D`by;~^h@(jRQ=+VBd(4FhJ8F+v7K=#Lr28|2 zIw#mJ2^JM+P`-$S)xrIH$8+M`de2j$(L=aI+?Cjzx$|yC#dUk{y+Ak7Yg-L9#IqlA z=4!;&BDg+T$e+=aKS=O$O40G55XNhZ#|o|+)_*J_ayj>e8kK(PJ(SclHTI#b>_(H~ zdAlWVEiBkUBX~Vm6Z9>3r?K9Xlv#rp*rQP+GWf~QI+H@GAHqa$)onYtp&Z6*CCQtH zT!;JfwIDag6o0ba!cx{LXDCFWW9JHmIvL2>B{3%u%SL}n7~Dvz9jzj6mR=p*w$KbO z?u!A6foSS(fkay@9Omm^ZL-RbP@@DA<;oX_@wcvwY8PRUlr5yAOiuALOuZ^K5WR~_ z0a2Du)XDR1r7U)vXu-F_>N;y|QqNLWI||z;O3W-0|LDs<5d$vjOP+D*#kI+Uh)twI zgL32~^~;>qqSKe2b4`Z%!-Inv=Y-X_{IbXYLL~5Af;B;I zeJX^tM;M?{3ULX_Sq_JcdJWmUkoDboCu~JpsbqU=sEu@-GBwP+9Cw`Si>&Q@3Bz@0 z(Poi1ku&Z@jA^9ppdDMGY@Pe^;I2;U+=L|lA~zX6{>Sf)O0D|jX`qyqUyT0kS(*+t z9gAdmxv+VhWg2zzd_M~0I+WeBP%3~B68&0#&=K!s3xmyNtFuY?=BX5uqe`aOf_b@J z>I&Ij8R^6SaA`kR9JXOlKkBi165Q}~I?O_zIypa@4vrTwvEO%YdUanieMHKSvI21) zUCa53M&3b%8#L6taN#=NR2SZ3l`BL^M)$)l)A6*}{1qt9*E?-@eG$v5x5}mch3_?s zEh>L&6jQF2!@y~MUAVn7q^)6Vj0yjw$JLJxZx zIF(o~`z~-+P3g2)2A@x%sOcE|v02tL1KYU6|0p<;rxVZ^g!HdcmHf(6qzHkoKwkBs z$Sjs0Z4$)D5`NWeok19R@0$Z@qH-ZEeyUxTQz|NZ458}x4$a6(U&br9`inWTAm zjRq!?^NPBl=QK?#;*zzWxUw_l{uso>!E<2OCXVm*sgTO*&)p%g^Pb(&pY)1NvI3m@ zQh3-(J?9R1xdJL^_O|Pl(%8`SvCoCU-uTpUtB3bU$a@T8N1XsPYq7`3K15jAvB8HN zjyKYQLvb|88@FyQnrXE%Lb@GR@K!3_O(e9jAt3zrwA)UQ>#DEkz-*bqUC)S8+s(nP z7GA6=(50wT6h1bde)RaLzHu#*$4(y7TR$jw(Yi)a;*pHyw<2O%v8b1)wn3%6I$kVW zRcpPS?V!t72K}&oY(1$O?7tUQ*EN`cVd|C3nm%-lipAo*t*#2Am5avxOmC`yY}zp8 zc_tX&3s|f(iU2L=DecK;E2^gzQ7!7y7QTfrS*H`S@2%y3&jwsiw!|+cRK3hO%uu1i9Em8qV~gzk;i3hdeV#< zDJ|e2i+0x~K7M@p&2`i|?K>yiW<8l7_nz8^L%)tvd^YC=s64?Nhh>3L1o{V?2>4mb z^LBC9)&Np<4A@69(?jT@u@`jtTtI_-yiJ>Cc?5+YW=Kbx0|!L=t^hk)^6lR&M@#wB)O#&5o05i^K~E37N$}bkv+oH2>>rZ~uDo z-gY%&F&?$g>Hnl9&n_N+1-OF6g8xgE;^=__+f`!@O4ldO)H8j}8c>slGtnI<;nu^h zR`Pgm{^Iq>I^F`8rjuHy-rB&@xBR3mYf z{I86-JXc05AW#pA<336w3T^SQpt_lYR^-ib;)-o^Kx?dQ!J zBxXUDZkje1N&)^H)M2yeEYS`6#?4QOZ>s2JI}T}` z;9jR?7ki)LvH}Ea^cu+63dgwyfi$>cpPd1l&UojBB9+e|-`Se?=on0zFZnZDz&U*yV0L=1bx@7#1LEoaD3j5q zP<>7}{)rL(Sxe#~$|%by0{Z^W7a$~5c;#Jg|MEIZniQ8(S2SBm3ZgB=a_9OX9;135 z{s4B!LPLLLGj&kXtw-hU<4{x$E|>59gMj|p9(k6b!s_1j;$@QbbY1|e&9|m0_jOSG znMk?X<2+IFen8v+-5ZOU!%sBKhU;AHl>SK40;1Q#Hm(<#KYlMXmWydoYO(O9N#DC# zTH|8Tn$xR933oNVcXa3)OrT-=QR`G%aX=mU4$4@9MRDIU_0SmQsH$>`*r3QpKgp#g zcj1*kzEks}VLTeTU#dFtVoFee$LNasG}k2v@3yb_s9qmvs>>`(b;P&8qP-omU+mZ~ zN{Qv?w-B1`D{*?gg5tbx{1i?v=W^BKpo@z3GsR zSp(8R2X2Y!3^+8`Vts3b!DX?b`pT;)EUl>zzv-raibp)xkCrdJ=9*%x+NbFy*qo%+ z^;RIfaNRKkXRC5_XtSBvJ84C2^R9%6A#Aw5c0rS}9aW3UIW2^7<@oFn4eNf22v0c}=cUuh9#3 zOd%MJ-tyu)n{vb3zGfDPW2vQ$1eTbSM;9k?3JN%7gS`HdD2y3XG7=moDtVy(!po}_cS*sph&(L z2-!rO?>&G}k!x(SD>_c~gwPO4X4};~mB_TW{ZC9aBaa535<#mz1xU`ILQHom#i`~n zL*QaTMVTdO{hc;{CpqN7nnx>@6#sC}P{PA=@NIjXf!ks`wAYz=uP5ZzxCNVoVU0bM z`PeBgzuU~xYuLs5iFIG?WAozm$Xn)GTqT{q8JmKG=C-^5H|_dKH4SWG`2o_|RUA9R z_S?DBGhes$%dJi9c~SO%!o*v8IWWL`!!dOATHYg*xDkhr&km;9bEkUx1vRi!8L z?K=aNI>J6lc_F%;|2MBLD5+r|zl^&w$}szu?X;g@@4~W;z;Lc!W4u}M$?XOOH>Zf< z1qjo0#5bdESWrHYbe)MVy)3C4$5%P-wzzO*VPk+EUF^Sv;znaVP=I@lt~HGUlFANS z%Sb^szV1rdy?5FRn>lGhI@yi7A|c;QEi7-~!-q8T%$hNTTGaXTZsJ0{3RwvBEsHq6F$C;1Pz@*71~UM5w$KGU9D$It!Y2JH`-krW@7Af$%-T3;%+>7&`-7Cst5 zWmy6vTe-azMu$p5Iu{ZoA*Kz|ZnW-*vAGJgb!%xL7CJ7+MdE* zRVu^c?C}t>xe%^=x$Sqa4LuX_+YoR~>9n3Vcrk&z7hYz&`91-6246n^zFJS>Y@)8` z6j2LrLj)!t8fo|Ot#?eNLY!hK`+FhpPlf1Xeh186Vo~B6P7wue@NsNVbxo6CMFYd* zM{&kMS0rBD;!lg8|6H!jp^WodRq?rsU7-eX{aeC| z!GuyWvjKt{ScimcNzjFf)6EzMR@5;Z%Y) zUFS&=;kFiSn_D%hhrJtS2Z?9;2;0u*TDreX4eMdA+NAhAp-m9pS)rV!?2m0Egxp-L zSw#39pC|GkO|eUv>DV8CSNbK$yAiS3>eon$q~2&ZTJJ8x#q=TC`ijEWtx`5e?3_m# z=1ROwQ@r;cF3g{4A4OOlZlv(p|4PE2|6j0K95+Iutqvz;Aw6q zR{9lc-6M%Pi2b+tbf{`0-;b~}|K9@kSsJ7cebE%B#5pvBE+9iS`hnr*CR>> zzD2imerNb-<-S5y+P}|y)#}olgL8_`6C0IF0*S@(nwC<~x8O zU+H}5AsGcLuD@aTC?dkjkFe&s_`#RpUjff%ORrThw^6&8Bz5tK86XUw-&BdBjd~gt z&owNp$2-HQ2>S;sFK?kv3N-9&RdCDX$?XNAMvINW;sT=#O;%&;7&fEM2PUS@LD=jD zsfPXSc$7%~tgMH$)V+^FEkP0&S8sZ0sm!0s!x6(U>w;?W!o|D~slmLy+45{IHAw!W zewd5d2~8E@b_?F}XUveA5>of)A-;Y{-`3BrmXi)WNtIT{_o}(YP;GE=59ot?c>w%j zV45UexarDFRFHr_VP;M9Bri)2?-&QtORUCaX(CJ|8EdT9CPwjnOW?L1agEqJ)!_>Z z-)v`AZoz}LeZIO(M206gVjCN#5FsLM+4@-1LTt%COV^Sh<_zMy3#*#H~EjIitYWCc&7sGY9xk0pgPUKJ3HFH8mUXN zqCJx9N99cqI=nl-=&Q5?NKTEKyHKCd>u|23b8f8}o2HnC4?ddkg)nq{`9y2&)^viT zFPynea?}wO!UXc`53w&5o=u2|zEdh}gp7;1cs9YT-I(4YN-;C&`?N`QwUd-YCX5Sz z-nW|#T11@gj>gF;rSSnO3X5g>T{7)la;t-%+@`WO^@7LN>2RsqjU?$q#Yq;2dSg`f z*Vj?<&v5g=ksq-$6D)=@k=p;xYe({!RO7NZFXe8dUqbWX^6|A>so*Z}x@r^&0CCTX z<=X-97ugHh%h6Mm6E8}{%zq1+1E3*MH~#PO7B31A#w-eCjC1^M2St1pI7RM<#l`vW z=OAMJciMT;w``^%5evzibe)2!GaA#RT*qF0qIQz!4U-&X#xon0R^d%P7)QRNB|WfC{-Ci zr39pe5)zaWBtSq)fKU_&0RjXFA%wKM`OfeD?wotSbDWub`~&_WVefapd#!h^XFcm# z4UW5v_b(C>^r2v`u(_RvE3;BWLju5cZ`M)Y6m!%``TH6AfonZ>1IiCCQJmqwH{ueC zN~@R=%zTCMP^2*4aa`J*vU>IAYa_ljE^7%YPO*l zF$U-?KEFfKo>V{Fc{s9lTKt^8XWPx9tkIf4#~tcGc0E{1M8$^A0Ark{ouM}+z<%!2 zgSi%rN>JAgAbyKinv4T&B&Aw!$yd=671j(l??}7YTrRm-vdb99szq_#ep100LR~>iY>F<6;ceeRV#XI~ox&!7V>CFO9gH8P8}+SpB|)b~G@NZg5I^#WiNj-iM9)0POKiAHD_|@|`W=@MR z%>&vYlP6P|HU&ZPhWJzd7Y*Gz77GVhH%vl6d3RB$3`6l}6$tU)NN)#*xccJ(@tk0e zCS8RxOTyr6JB;be07|hTuuQDWEoAm%6>=0({oZW9MxpNb+(0kw(YBA8W*v@Z(ma_{zh@B*lAeFRmErl%ts#Ybao%>{~Mf^Y&^FaAa=PG($5EWu2YQ zVpIrPT87}ejAUOoeq$T8!zWs@9gQN75l&YaX{&z*~$oVN_tTqg+?F&g5VqBdA$V{^CoumSE3*pO69Z z!}Z$oIy$hGp|!R_;n^$d7{TJU)XB2Rw9!>p(?h{^B5Ib&_$X`4gMyjI5i(88E(B{Y zdGt2M%+k~_bu(jqmzUC+p(tjT}Co>5*x-Wh~&6ta~I0ofP z)07QcI9mjJzM&vr!ZN0$uPuf@C$?{L1%!H~9(W@(d@^0Kgj(VcHKk~oKAr0f@O-o} z*r!as7MaT;J}Ogh?d>Vo2t!AKnqC13rvpgwSf<~-VPfntX=~Y#iO-VxtqYE86O?FK zc#V?75;*>m+l7-RexM|&eLj2Xb&ipC7AaAqYw@%ysIdXFrhAn!94tWr0<~a7d#9aQ z3xe|O0UpSklXDUbl*G*YhHpLc;=_`>e)_OD__H{kbbGXI+f$mCx4b{dlN95cusprL zt6|jr^w_=WfuIS))GktLq2xs;Iaaa{H$QxHuezB|XsaTvZogtH1%SX!f2+j`R(%L$ z(fiP1j6PD}QYT>*7s}kH)*=nkkd`g2N2wbbf6EOJXrfadi@QXqj-{EK-&SE_nhzcj zuf-*%)M1Z2%uGA7rd=>A;iZ|A1Y(k)6JFJqn_JWoXv#C9Rc$3A9*!8I;K=He6zz?0 zizC@+FQbO%@yDHc!0<%Qmp2L)UZ(0~Sg^cFF33)sVpG4r_qBalD8wTObA_7~yy zaxR*gKvGZVf~mS5sJK9*%Hrv6Vn$W1GjpXvt+X$Er5}?Syroa83C2vm%qrjkz%eHuA{g5dsO@Ws z%x~VIaW42m8*|=_9+F3gXM(ZjJ*USXIF9LgnCbY_VL9(IVI2Ym|2ksEi6PDfWHS!PUrWG7l$Bw=XchT0Q|xEx=$?&pW3~XhO6?G z;!LVYH5o5?3|Nydy?xLlc37(!sGvUyhkKxwr$SV29bzUme_0*ikf_We;NiDbcRXVh z3e)Y&@`fTBlHE)d~Mdh42P22pMCGEj`r{ybN7&wK+-h zc*cfdE4{>K9+y=bUYN{JB9A&rRToneP`Y`(!iZ|&E7DAm_bA8kdv(PAy&Ji_UHV9v zo0W9C+TVh}>|Lh6(A;$B4bG18S6-B2#uE+SXI_n>s9(7!GO>Dr z9m$lrit*7@;?Nv1il9c)nf^dKh@?0!nzU(`p~EQo!tf3X*jC+uLq+WrKkC^?T!MiP zky2gcccyf`U4tK(cD=P*b(0-QzMs?4R?V(xhJZBQGtIMABmEkpcX$t5`E(zCV+}fU zL+Wf%rF`TK^LSmQbK%3JFK*1_*d%naf4($i9kvcLQnbZEh1KfP_e2MM zIZYc2SA2NYv9(o)JXz7+`)<)ab9^%9cefbkcr%cnzo(>97PLid{lKzbFN&Ftw|Qvj z3`4=hCVs(T`O}e$T2-ioQ_y)BpOwT2bP5@Hsd+j@ZhlZ<;}!A9S9`A(fAq)CnKw6U zd5>I&SjGY6|DFpF+n+?-W5GRvU-o>flm^W5Y0tu@=odl(F9nF6Q{2R(!+~--Tc9Ss zr|sEILaeG~ydMR%1l~LrFg&Z07t+1Mt~}F2;KEOSfQ1YrAmdqtUW%9^{s7Slh@G4h z;{#6vC+QNxl%+nnIxNS>nSLq>b4vw6;;nY($3J-grqmFN!E4oRVFMkVPO@F;x&w;+e@`_vXJSP$6WuK}y~h#@wFFGCfr? zccB0v+2~9%1WQ3f98gpnw~eQ^DHJ4bLA|YH zJB5AIrP&1!*+sqrc74EGM=g=Pq=-qD0k}ODM~?JM->e#rk4?%qL-~b1(jgbCRjg1a z2911XuhLrN%_#K7FZO5xZZ31F-LZ~5Q+0eE4R&)JqL7wlng)0JP}3nYCtau)v2|7I4g)EyJ61CtB`LY6~YOW72_x z@LQVZ@sO35-0jw5H)@G%gpy42A$V;>rNDSegAh}(IRB=JM#4JTMP}_7 z=Zo$=9nC__{O&fZrl0cw?h00|T^*`Q%x@;QIcQFysS}|Suz+iAy>Y5mid>C}rI>L` z6t8ZMl_yxFiu93YU_T)!a9;fkuVtM40tiK`(nI)NMTdv^mzwRfWR2DONMHRVdlA~g z%YQ`cY>$gAuHV9HBDcL7YB+rd!fWq+#cP&Y}y{io^b%W zY;JVKxpV^=nUlL|zakU~+QCaB@Q6!5=QW}DCI%&v(OzkhEN+eI0N{;zvjAdd~PyGhL#i(>!vr~5hw)7QOl`KzHL8d`hE5%N_ zZ7!N?8P9bvtI-Rb=~*d~Y?+b9#G~$aqkXD_&|hscuM_)6=bK-}>~Qx}7A#5jnYJmJ z13-b`Qu93UG8W7*)X?ksyVLH)kARz5;{rzsOWioZun?~m(pfKwZ9Ox5LR{2(+m%|X zvk?wDC#~se8qWa`_MpJ2fij{B;|~ChVzXb0zb0ivIvC>7GS`+^pxIWWwyPs3ii9NW z6EB$5;h?aZeP^jq&J*Zzf+i(sqWUyepIFHh6+nSXKYeF?uPovs%r#1aBz983w1v4vrMp|{ZZ2wbA75# z!;*8PsN@Cm7;n(635kUB;9@<)7qqU`JP1i-V!CSjv)Z>Nn zrpQoPYNf9tQ5tRvH{9f3-Qhv3X${o9x3EET3mW!HtxQl8tO&pf1=2cq7tABn=U2YU zTO~_jY70@4x^L!HHzln{A99Vy$j5;KfN*I%YuG{9q)p(T^_y$3CV6xNxhE-C{1S=% zp|*dl9A46@h(n+M{Nj7h(G~s@dJF&}DFapX zB_2wooakZSd?Wu7TzM>7@rY-24qt#pcCIb%5a&dUw_`~nwwwshw?Yb&B_FoIWu(bb zIEoaHv~5;{eEB_PL=yp?(4}!bUM!OF2rq_ksX|ULoA5>ZVJ4{CX<>e>W~WBx8b?&Z zssi;oNsz0Dh{#ndQJoX0s}7nl2&!xQdbcc~0~DCR;XILq zFJ9~61Hlb#60{@4%N8Cb$|nfq*lbjm`$4U&?cBlr=uAk0v_=gcO%LGICH8dE<0;Ny zOP%?tJ~&O=x#5GOf%(pZ{YW%L!{?PTbP3TepyOG)S&eL(W(7I1%I%GhNprrDKdvW&I4Mf_<;Js8WP+7m6leQ)DvBir(lM{;GbLUptqhfS7II;vS%B&NoClX zm;q3A;wrV2HnlAxKK3AWG=fnpULH<}!l?_VX9m4RU~ zSJe9}T-mLXeyuHbQE$}utnd<0gdGPvv0KtDYN3T z**xtANSB_sPGUdbrnWh-T00NNm)PQK7%khr0PxZY*rf7t?65zQ3xLfrjA=RWaBBgk z&cWm%{78TD`0!&3S5X{kDkj(M_B%mK%TcHxUx;4#9W@2)Z zm>r2R6b5a2aqp3kpmXtBDJ@oR(hH@>i0E}_nsh`jPS`Hu zLRxV@|H=sBoqwT-5j4d#x_wnl>=r}@_Cg7Q){@tet~(F(KDFC&gwvS1?{G6e_iK{n zL8_!2Y4-+aA|WKvk+kD%wn!eEy&#c!7%f@%pdveL{>_&E?e90C;mceDZ|mss5m}YJXMHGCG*zLZ{#( ztQlph4Z$$F>RYcmf4r_72*;4?1F7&YkB@AXjq{jEqvbJFG2a?+DKs^7s7Us7fc^A7 z@k+4=lUd0Hw&-^8pV~q^%|_I9vTrUW|RC*7&L0WfLXq#B&q#A22;mLjH;*831fezVc zxTeSDc78~dNBTU`xK3m8riq~X*=roX?FAa5SgoS*2o1GvV`A|F!H3Z96iK%>`&%8P z!T}gbUxVJK<5|226d@vR!RckkvLXSB_Hodwwh-q8)M+E2@Jp-E9yw_TL0paS@o@Tp z=YE8QqL%S=yt$Y3(t3f_2t)Nr+JMVR)C07p$JwZfqC|RtwKcIuB_IK)M@~wT?ML>b zGax3Ic=Bm{-naUg#kzx~Ur_!*iS(cvtAyLPN7789#opiSaS#vWuLL8mTPApPRoFqU zAo0U^8jBePH7W(Tu?{4-;LvyleaRCagvOo%r$ny z;*g9qEZm;KVkRYggMTjyTZld|wVME2NJBElcEL?~e}~XNd-#Ebd>&?zp84t|^q>?T<%Yt;yDcRnnYy)RZ`H4(Zx*0(lqCt}L!o37TJ|1CG6B7PE8zBL%~In@Eie>0_s!C!5- znstvaww6mNz*wnvkG^skzmT615K+y@j3%iqMpn&WdXX+>E23xJ99!At;nIy0!eZD7~W9?1Zufx^%|vNC|UH8nTS zlYLkEaqp4h%GxfBFEaq(R3(QW(MlnPKYM%)NXcU?6KH>%PZ53)`HcYb% z-d$t4v@dbwBA{x;c6-El6r(w*N~x6LG7aWQrIzYDQ_d2^BHYB3P3-f}A1|5H0f2jk zG<#;CLTqXjJLgE~=2*BI8u9zPYa_IvH=t0%TT}i60NmIcmMbmAG7MP|7E#+#_g&2d zD%A_Kl8v5ldHl2#7-SfJ;>{z8Xwe%5QtPitc|FG|ZW38`+U+glT#qbU_w#?KLLs1G z3%WGue)!ll-K*TYA?mW5&1NZ$EkRcbNvcDBH1jupchF}m#a!G|y}HKS#Nkd?i*fu< zHD*?cx1EJ|^hZK~azY$+{sg^QH~roxHMX$z)P(AhNo{>scX|0gQYoq8t<4vbK8l+I zq5lTi(_{5Z?uB%xvQR|)DHmuO|JBvc-?r{7`dEbu)f)5Ug0~!DB3D1}VK=KEsk~Fj zU9Mh!1DgpPLU1;T8>fRlR^bCL-@5A!V520rQhd$q(Xf}ic4)fX22!wm0{7D9HuaR0 zv&{wsuK4*haeBlzu17D7G)GOOsbN8&wkyLx(#dm8*6!t&@F z6=Ipa3$qj>9e4a<3zXbU#!4_?hsX20v$R2fwAs5Alb1;xfEW$eeE1UJVZ2m3l?mhW z+X0s3;lN?HdSCOQ1(2?jq?ZcP2RNas5+5C7L=OrySEd@g9%*Dzxn+m5?Bd2l1pvX^ z>x?G!Rs15q5#8DvqLLmo6U+8+84rYfH{Q!U&|eCz%^uA(3pV(k=lm1+pQ!p&?X_4& z;PjC0n1@`vj+?>EI){rSj(erS91a*6$VUS+TFiTVFYZWOCk1TDRX>NmTI_#JPU1ms zh4|U<3fzGWxhNyI+e|5l;M{=mr<=O!nJNBdsN3!FZz=0+P%li?+aamLcq>T|;)w`L zefI2~fe>g|I&$yyYnP`BqpOYxW=Iq#)b}K@t>&3uugZJfod!Uo zpju{goMG6koywE@{i4+ot5()t@Goi4Xv^J}CohX13?F+(_q=q6mmuTT|MV@WDx&>q&kl-{t-ReX)2Wl>GDnIJ4PZMShwd~k_jyGry*It|A#^$AgZzrF!b4wx zi>NFJ-doR*>?+J@MyW8{(jC27qd);rkX ze|Zg!_6+XbFOiazka*vDQ?7sKF8rk6skUiY4|AN&`Q+L$#0|Xcwog4Wz?-;X)7JSt z%OtY%ZiY%EVp{X~m}{+6XuJH8-8$oQ4w~=RSsz%9;y&qbH3$K(Jk!D_iPy#xW%A?{ zlfV(VQIkv6fcSHEOp7yEeP`;&TBq@NuiLduvB!wTNiPzT+ZX(v{&idAPC2bV43<{Q zGtA~( z5FOgF30jLma`OUA8jj&eUSvr_Lwi_K;)e-9FV=6;TPbtvU3*6@GbPC% z#Mz;?kh>hp+n7plFgsU#YeeBh=sMSEdAhqGVmifZyn6K;3mMFM>ZQl5$;-=l@Fl%$ z@3_&(ZvR?hW<)VgO)!^A-Ki-I4KyIL)+EQ%V?H)-^*VhTiU}3xinW!vjnmKhP=!_1 z^Q?+B{g;r#PO^&>KNVGY)e+esFIz4KQe%)g5>3LyzvGYML2gVI#5;tMAtCwuY-Zvp{HL zs1&F1{i)Uv*QovEwk#Vt9j%pd#eWOH{i#6EpR|!n@X)Rku6*JPq5~#go2*Qf%EZ-! z+ZeIDn#GVg1g-+nHRODC0HAdN&|ybWY+Krt(`}^8=WVEe7n^ za0~R2`qI@CSIc7b6*fLj=-nfIATjY!_j>=wI1xy9dxv`_{zDYepov##}#?Uk| zH_GyWd2$uADsMUdJbQ_=h4E6_Kwil623#jt{*Ii)JuiZQ$z!6ZZod_HHG;xdP@#K~ zYw+LU`1txsWyjW6nhej*Q{x`t-7WXsjk?v_D5~dt=a|(v0t+$Q^KRTXa1fNj*bUUY zJla~5{YTH=^A09=H*a7Gov;YF>8bGYEmWX4p%TJ+ne?D0Q;rqE_g+D7XcQZ!;St?s zssi=ZLB&jEKt68GduJ)x+Yu>iT22WNo8XMnHUl5}8=~on!7RcJJzG0v%gxC=4Qmmev}E z#Qz=Uj;{D^AD@$(j>sTiU~??01@c59j`qnf-g} z`oA?!BlC^QfLL43z`YayjivnaKb1sp4!S#fcnTX`C=>NJw)Fo*GT&Rbk=4e_mw_eZ zbMGnt^ZWd7u28Np8mTFF=1|f4ci0%>oq{R;*kHX1@Le8 z@-Myt>+AWKipLLJPj)V#?!aW7eqH?dpFNZBd}{@D#@adw2#Q|^?fZ@m{S9OI(*s;J z*#0je5_sm(o{Ar{>zU%am#G>Z3Fp4|hX3id{`z9FG#*S&PJZF*)*eOwAm1Te-KY#W z4`hU!`Cq@UzhR;e$Z2ORoUQ;vIo~+#`u}<3|7+t0s0@IH$GL&O#bWr&OZW;qc4&%I zopw#a^oQ(m_&GoZ#_G8K-|77R>o*cn4ETwQ;>$dz%kSd8+ZgbdAIhI@;DO=c&Y>Qq zDeSRqnaJ;0{68{+%|?)o%Ko}C#t`&`=Suk*3kwT}n!BM66=9bL@ZRCmKt=%4yLDyy zOD;<#|AQMT<-=?phcu(fo1$C~vaH+CXJRs}L$6|awiIH>zMQ6omN;s8V((Fc(@41Q z`RV>rlX#)?J)r}wMJ8?pQ@pkBDC6(XQ%|Er_*?#PE+KEE=& zH7Z`pxary5AL0KV)LCSkM7y6Q)OlT8$te45Kbj;y50oMB7$ogiT1>;P6VWny@A;q6 zzQ=)|uLQ$?N<7*{AA*7EklC}Ox35EnTzg3SRKs%88%kwDb~ z)^kKZaOQgD`Eq9aH1kDwbA~<8Bhnl87A0cO4;NfY)yZ}8pXL@}0G+e%?e0Ht-@J!s zEJ!=g65u!AtTe-%>Hv${Q;OdJaFO)q!%CFwtE%o&D~qH{ME3!bkUS}tn5cZ&f6TG+ zZV_^AdD=!Vc)lm>1V{+59=t+*xlh)r6J#nB9Q`AHz*$ufR(-ldbALr0;?+vWULXfD z*|Au+yi~r86{zTu6?$=?>&rFSaMuWjh50vMaxKsSvue=R_q|>g>rQ}fnPD7ocz6t! zoBM*z&|YU+AtvD8?GybcPu#_Ke}7G2TK4FOo^CiV6hP&Q%1!Hi0Y5;)2nZOjv-7pd^notpe{clMGB!Hv1)Y?6^@_tL z`3b+{`4&$6{2_M|sUUn|uSK=V4rYS?C8xwnQSM@R-C?;~>|g_g8MQHZJDXhpKtNg- z^oiObbpz{I9&*P4$elrmuTP)5{r(Sb^!p(s?|FTK3>8Q-a<@~{Ix2vfA+&7qhSo2+ z%w#$^q*QZ;GYd;1@q;CjKSr*o4%Y_8XG5X`mbODlX@KIAZ%0Tz_)~LyTI-|Vty^1d z3P=hP8D-keDX<@La@XhY0i>=>rdQupmWw|K+SuOSPJ2&MRRTIDbB2QG0$SIxOl81d zDl#a($K~ahwdW_sFRGMCuQzjD3WtYr7scb$w=^(Mn9rE2w42 zJ^#QPeP`nV)jx@TJUkjOE#u4KOwh`@7p02Ektf#c)$9J}`7^@Dtzt^~SwYu8odgIY zc9vYM7xKq@0!sjN$1nIQ8M^n&r_-g$tpu!0ERFpy# zt{?nBghV3ZM_1xiob|AReCBuHoIk~Qf87z5Sp72FkIy;HO!Aoj<40WJ%>8rF7^tJx_js4f@!~gT9&Ze!~!b1davPakJJKppE`SSOD1n`=#D*YTZ+phww!SX(I z??3w=|NXb>@xVh`kIH>5Gs=$sjm7_^`(MBI1M;>100_#`evE5NO@-@W_2(|0so z&*Qrk(Z6aH|LL{P$_3Jixa?66-3dv(tmn*-}Bdh^}|^efXe3?mIr)Kg4JLB&fmNC%J~gIkn7)HLuYzPn!n5D{Hza)5RGy;c83i&%L1%W2KzBU7B0mJcF-$U9VzKmH#O zfvROX?8mqYvTe4)&QbnA=EIyHvV?UrZ~?M>;8YkX*ME`VRN`l{$PFhYh zChR>n((b<3cWn5Ub}bl_RQQ}2t347A)h~s9eslcEoBr^vF=h{^>LlK9j5K({o%f2)RO1IzluNiL!vVji8s^~%9!!Qf~) zNbQFhc)HJnoicjc)-vXQFG2p#JeL3KthtTcNKB9cSf$8r_r@Rcl>BObo|&21EU@JK z)^Geno>IB-gQ%!2X9+9X-ey1M9LjeD!i}q)%zIW31^?MN{)ZNHhPU_j?c2M5>^4YB z0Wa$h-G;Tbuphb&kZgxe=Caj8@xL64{+<0f6TbJh=iNQaUcO20xF2H+TekJ|ZePpT z(CxDAhg_huWAhAy@v~rXARVOgch>%YxrP5ag-G83)MMixB0TC14sQG*S18wbP*VfE zM?qR1Q5HWW>hrh{2;i4xkAhC^iuw@=(1wk3m$HkCEjuw8?JvLmZNQ@*q~bTx(xo%f z9}<=LW#PNQ+5^b-?CNS=J^mZ1Ma17bC9-nsYuHlb@gSJ%QX|Q=Ei`BF?%LOnCW~v! z1Eqn~gw;ukTns;o(MRg@rj7$7>O`O&wQ&wR)VY?cl?Xww+wCjdoiEk6MxY4yoY;ej zvZ3lV_ok(>!x8X%Gd-p4Yt;lmQQb&|F#Ej9^^<}(n1>VfSHpsF{6Un?z10g5;{_b7 z8gNiQ!H$4;lkAG(G4Sckw-`)fF3GmJZGbhlx;Wl@MN02CMRV2+Z2{5IyM1}N61`c0qrZ=#|5 zGF8S6q*d|DX3~a1O7jGIWvVvPU&#@#hvz@8ZN*F7=p$|2x>Fj324{!^g0is%M=!^i zMDMgia+s9-^j&)gXH_Y_N<`iY?)+j0|2&t@14QF%o64o~8}ADRKx5M@?5Rmrr#;<1 zRazY~Mt`^o_%7@QXLVDwXtiA1A0DoNNHu+ z=ch*kf-+Bx;9*Ux7R^lyHzTRIVA@QeT3tGs*t$r64qI36Jg6HG;uN;{xOX&sWj+pI zof*{xP4D3hg~IO554~&Gs$}+qtc*DqmyZ)+qr=$d*=lCv8wJJpy7NFiEG>{D(Ev1n zY3SXXweO(4^9C0PO5dZVo+Jfv{JT>6ky0tdTDEg${D0UUDwr49c0_vg9cM|fh;yqWFmU`wms4GqM%_j^E!ac zb_Ldkfb|{)Veo1iE3+ex0%yAwYF+9Mkil_)=lxt~0Mnj^>@W_R8`-LJg-^b;Q|_Q2OYTd-6|Ch!7oCbUXKMDBp?Yr3T27uhtTTb0-(8N+~v642Yc{4kGnvJ;0)#DLdoehXGRjEXUbVcyM?d!V3{w z$;LF7lvY_~=^n%TiRNh3&(tk~rPKpTH*Pdh)u&Q7eB}O`()e}{A?+T`t;j5R>?Umc z8ZcljR}W%|P=g}t!ZY^n#Z;9mOrg7Q%1obvhYvtW1&?Rd#dL2i+~2b~yjWn_tjWS|Vjt3_llk?viH-EBjIGNIDb8rPFRdV&x|X^ z!)6B1t?VEN&AuC^tlQhCX}HNzHjVzs1ctlj`cNX7E9$@?ihiN@?wrU_PZW)232jJ~ zEUp0>CQVq2S8bZQO1CZ0Iv}zspfsoN$-6t3cD2z`;ofRH2LAe0_h3-BHkq@7hLdzU zhYHTv_m=AD8p|4Skk${H_tfmbZGI(BUL@Fch)}x`DHa`PGwGn1w$7pG^BRs!4NO6~ zoI~+va+pC8Cn>R82M~!Egmp689enMsw%|OpwNhB6L-d&$#%96$m+bG+G9thmxw%nt z{J>XPlx?%oe>sR)58vvK?Q8joGRT%1Yx$OAV?Y0LkAqbB$55L?vlEwZ_0I!}Mo&}? z{XEjp0a9@XR1-54=GhKP)pa@Mi8jwFZu~SqF*m7ao{)Z!^_g*NR?+b`sFf6`KGFyD z$L=!78}ix0>?<0zUkN_4LmN8js5UlqQ?3TVDCL(S`HpHKo%cV)=Ku%XN(gi<{bUNK zGchX$^I~-rIAh8SGru(gr9hj~DjS6vY*FE84lm|p0J^Jze`x86jo0{_Qo0@Uvwx98 z?dvd{8>zCT#Fe7rY{_@t7#4o<`rJsZulIn^gMG;44re&fg54dK1~TVGGKIuF%M8#a ziwmdF_W-!S{N9PHRoF@87@)UDt0u@$tvLeT+PfDz!dFm3etTXu`^De?bCZNEORemY zETzy{uDf*&l%XH6e7jf{I3!R^;YVXk-{*s)d3zedC#&r)-u1WLKUG`Vc%b`TB|m3W z7=Q9oNa3S}zLZj+W^Yk?Yr6I1SP*+cam*1SI>#?y3jMj^XSa_zUujZc4LMXs1n$R^ z{GbWnBpjCbt#cS71IcVn@y3 zbgvbs{T!Eaz4Q|>NJR_JR)oX|6;9bZ>g^vzI!1U=$TOOZvG83+l4JwX#r@IJMtA+# zgHh^uZ)&hE4X)m$6i3M;C&=-qO80EXiA*p# z&3nq*6fj-mG=FHdJM3;n$xRUS0rMC+M_Z z3QQZzJ!=uQFY(23m-!qv{stzkv>wL+Ccs>g3HLTAqP!cRAuREnaxgPemLB?w^U@$X zF$HEs>;X!St*V^fu-Qi)n=n##@Ns|6W33xagGmfbA@YBd*F%{gd-1v>US+>?GiCm%?*UT)*vaoP*~krUu4M-!1?l zZ9&Ile<<-q_UNaR3)+>^!QP+ehQcZBiyp{D7u@p9vJL?i3>?F1@aCa|dbj+B5F~bm zjU$5c$$dJ@80eyWLJ)q-S?noOT@Tt0GfOjy+x&5Pnu$0nbj zZQ@;AUicU-7gy~|R;ACg6=Xw{+}qNnKz6(t^!$mdWdX(fjieQs+Ob~B2DJ5OqP+*3CEvFTcoKD+0@zc@+;@Wwt*wM9{ZCn zQ<|VwMvx3^&@v#7@Ff6FGj#b{k0>o^)I(#OWYA!P%F5W3(F$)j9Tjpr|MU1-w`k1; zw=~$+s%>&#$|BX@?j^@S`%Cx;zp2z$^kAmO0ejP0T6sgw&4#E(o4vDo5r2%>k_fAr40|$Fj)RY`*j@TB1?VRPDFD?Z1cb-*Se6pB));o7O zY&v<`=8$?j428C;s%krr^-MOvXqZ*in1VQSqmYLWoL%o#Yr!&b#0j7;v&juoV24Q@ z4(Hf@B&gBjl{lGkgO66^&0t)EueEXJ8V`}Ok6;dtqXv54qh7Y@oy``onvQuQ{ri>8a~OTRc940 ztTbAyUN0>|#lZ&^I2zwRSX>FUcks&;zIpRjLvxC;*8;1Y_T~q(keC5f_=nYNx4yw7{uBfxp zZ_e@%0P$k{&k9FVK34v2=Va@BBqz?I6}L;a-?*5t^4=ce8VgeLl36D0*Jufz>)kv4 z*#nFM4vY6k;=(y|akb2J+c&p{je~Ti1DYOLK+nfMbqn!dGH)ZT1r*<^FLjKa>`hrz z2&ugN`NK&c^lNN+xW~8WCvRyNZk|PS(O%NQ@5b)yqO0e|751(Eo?;*YWS4!Zx*p)| zUy9-jj>1>Dm4rts8e@I6kF;T*VK-qflMFn()Ce<=m#kz(O;FXh9T-sANEoCOQwg36 z775|4tBE$oT&GM(=={h%fu_Rk;NSPZbgH`T;B;*a8Hzv-sRx*DZ*)fdjx+SVDQ$4? z?G3~DCBCSLz$#GK*G~vDDA=r`p@*gnCCKQL;Pec8r?CfKtrgU|%~J_4TEJ1$fJn4B zl0}8QE2g6ogJyNZO|ZaJ>8@fD{;ED>Mk;$JNcZ^}hG^#jdlylW$(qiEI<`4rF} z5#^?mi78)Q6a4Q~8{-@%v5u5tg%`RXY9x$S7sj7GXz0o@H-&EB)^U>F_ddV}fZ|tg z(4L?D1dM5UHWSgFJ(-Z9@RNPt0HAF;FM2Nznsa?o*7z=BfO7uQ}_}Dc-K1B1KPQ!10yG{7GN*FWej>1D_wnW z*;}P{(_(}jF}&BrsaLb)PodfjZ)J&{1xw`oBV;mejnAsKrts+v{s9hhV$65 z1Qr$_dL+uGZ!L~#=+rdW>>Pr)bx8>g02Rd1)jl+}add5Yen0Wz#K}#tA~XuTLr&|r zEn-uUpIM0ImZZ|4xu~iSjct1OR+r^=bfgZgOAR^Qh206HaUPo&o}iLW4Fp;rH7D$` zH1J)nwn+y@NDZ&|G@fitCTQHi<~CMrNg;yr3pPF&S1msBm^;|BhogVxp%>$#f$vO3 z(i{Bdu2*SRv+{HoAzz{EwdoE=Ro=yY-XdXSQP$e^#I)8Gi5Gr@QSpvr1YQxO!1Y%3 zgLDR}_%d$k!$JS~&M}JWhzcy3#~3IxCmE@q3U2SUGi`1}@PUDEEIX?j1C_dv*<-)N z62o|Cgih)>OFl0PDoIfe#FF7Ec!`s^AH#g zch|&%Na>JsuYlGg6<&4ajbjvY)~~8M82021S%8#THt2)rT-aXUn=FENKBrqoDZuca zu#~fHr;USGJ7*+GQ#TWiVLlp|8~c3rat{e5lQ11IJ9H5M7;r9f-7OG_37&NOZsk9^!^)HRhVs6(>l-rxSVpC(D>^?#u$l1g{R zG9!4TUctg}5w&1(VrYF($go6f-P_W4Y6uZTXvxlOaJwWDCW;I);lhg4E5%(yE5{tv zPlZtCuuVH?2fKBlPvq)O+ik$p6k<}pbs+^vq0c>KwR$m6;pZ$kK`%jUO&L;}H{{Vr zlu=L#v5Iw@Tmq7;_j@2tp70??COr6-)z4{8GZ@ZjC?Bz{-t6}dZs z6D`kLG9g=Vw&>2j2a#LH*Y-@1V(b!%e7AcVviJpyMOjV1s!D1fU5D;8Gb12TL>1MK zrSpb0HV?{QmeGOV!{I9_XGS0B1owBI{E|#1D~#VY4&}e(0PxIUg|A3xrM|q&$%EeE ztT0w}s5vEM=&tz`S+ zxWksMFa)4V)*qIf7?I8hQhHq_rdbJAR~cCJ*w7%BOjGxnP0c$0rKYkl?4~a97>aNl z42RlQ2q%6=H)TH%ID$o?vbTPl!vKIB5E}+HRCsq3Se4a@?Uz-h2W|l|E>@_pP-&HS z<0T+3!QMx6LO>Z7WlpN-!8N#r^ipI>dSZvOUe>l|8AIDTV+sj=YqJ_!>`M{2%xE$t zl{yi-_x};O)1*Z^xoRGWsD4SKN%TjlHtROUqDCGLR#0PvR@? z4!l3vSCRjSCtJm-JgKC0`|JHZ+YD};7t?rx-cT+UQ~{nLIl%>r9PH+KPmEjn!eT!7 zt$_OuscK(U*oY5m{#Q_&GE~2Q3J!Zy3-0$TV#tM+FL|Hee&zpcF_yPy2Ln)DC*i-S zo7^%C4^q8~mse1!RBDFk6)Sw``!E)5(9${hEr4IwaYrh!mQ$Pty`XCzKnRspb*TLC z%Qu?AD4baC8BzUNEaS4WT9bnUKg4qT>&uxTp%&Zb1hod!jS-?>p3#RaFl}$o!62fg zI%Znjt`JhRQAJMU*jn-_2yu^c+Z9OW>+#l#U|x~-b*ApMPvMFdJ@f48vayeHhO#2S zMB3Gf3V!zIq5$!!ShXB0)5ROiLs(c<<1T%)cM!?NMfVu&bNxt8qM@T@kF#{zrf zSj{QbbWpjMH~hl5B!+~&b%@o65q+*g;=WiDE;u(Iw-$44($SgjM7Qc)+NRU?;wA>kPiYRK{d*nc$Wx&Ny z6W)-yA+LDHZ$!8$XCVI zJvCMLhPNsBbUr?(hkQXa)%w$WLEKZk`~&9pwllJu8+pM<#*;Rg(} zuF4nJipAiH@}E|A>fmBN7FY(w-?!S%o{EFw?_15$;v?gBtgLuQ=c(oB4y%`=)IDQ4 zUUTa(%fhyBaXKzW;1|CsrpY*4LCU7pM=E!s+1r{x1c!X?bJMxu=4(Bl!W?{>FA5r4 z5P$ocTsm4{{glL9HLC9$5)v%Bu zN3=R^=UzN|19iq&qOtdGrKXpXNW!@q7xA%}nDPiL8L=Ywv9cGRA%Mfb9{Up&kej9S z%cj7c!RV<+WoAfHb{ffS)ItEUm_TCPgjVEEJbu|U0Tu^W&bv) zZ#*?~1rd4J#{~-Uj1?NH>o2v3AM|fMeK&27L!y4uZb3Pim}-2YHOx@Mix!$e2C8T| za-#bEK-GA)GDnB1e-%Ou-;1zYIGvE7UnJj0SR2}tPw3f8Z-ZC;?t=E2!GXz6jd_K? z5paE_1t6Lq$jEUg(?*Y2;JeZn&P73K!g|qZAqP?2Lo?deIzFh4v5fRfgb{EEj}Hob zp~9?FglQJ$QBnz-uAK^nT`y^&&>+oTgPO9Ws57n(4_v}#g4RmymG+uzF-oyY{S3fE z6F;Kr8VV*d@hrwCH(vSdPf2j*rxByGN)r(YaX0K>Tj_%GAT>x83s1=ZFs1qS&lQgq zX(u0}gKkcx^d%e+>AQ|CqQwEmY?btU%|vGDo=+V=fKExTu3s1U9e>~C(%?piE7upl zs`QO9Lsgo{5ZAe>{ke*@b;9W7m4~i&p}}bOU~+MO!!KDdjq2UH`J}39TaEG^CNKqU z*a>Prsi^uXcQhPEMjeuencG&#YX-WP`)Vg3K1K{is(G0nJn2{N4_%55TyoEYmCDQ4 zjWzgsNLzX}K4qNu6aEdqU>PlNj#VYii21d^@({#I3}hu?j#*c8&YP7p?8c}u>Dr>M zt%>_d>+4%@npnfq-J9pIpg%k*s0s(eXrrA@s9jhOxsEc@TDfb(Hvzj`IiEZ%w~%|> zt}RIrRJ7TLO$N1>zI7FQ&2N19)1-;wCamav_Ml;k0xSPynRiDOT|Z<_cV}@0+HjFI z0NS!nkQ2DhT%JicsQ1_%=BF8zo)oSD_Z#gZg+SZJqZ*4G(mZ!<>Q? z)=Ty#+cw^Fia4xLx0|T7I=N?a>fZ#FzPEN$fBUYkGB{~e!Kwdww0Zeb%Vq1PzQf6f zb=*c?!a<=M;_bYicQV$~EyNWMjwM!9DuN!_XY7jK2~U#|KJD)~`YHYznN3k-%suN_ zOotZ~@>wi#m_B0>Ggg*UN>3uhE0kl`U`?Y*`opI$JO`8hJd|R~D;AL|Ar;NXoy<0^ zu=Y5Zi8mcH!FqcoUz;jdTE6hfd2@zuL{_H`RT{7hu`H6__OS=}L@DflX#s!`69#4{ z(V%y_R|?f#@?d4q+kRvGC<<(mGzv{Kj1Xi~ot@iEi zbMtcP3ShEW$Zjs0_zYZeB_oxr9d_yPiu7asL)oGCZK*b2=+ie8zMOscx0<56_MXEk z*`66(R9ku?0l}(E@rrM}1}?6A8?mmpTlt2D1BuQtq<4wpubBwuFNBxGI-v=OsD*ay zQir(l1DtZu_5U{){ofK-_Tw$W5*A`}L!(IV5^Z1+aTD4wynrhTQELO7~qQ zd(SpgCMuE(A&ZrZ9k)L@fgWj|JFx!nCN}I;aaBYJ05D)~YBA2) zG$;0Nq9Hb0pMo^3?Dhnq{>{|I>!d2K=cT+WJ$`TZ`;Pz_lT!>gdHhVg;$EKo1quid%ol0px2lWcci+yI z7Y{_Rzu^on1$}CQozC37Whxm|Z@0G%#mm8s+OA<}f>x{ZL*lu36q45hQa#5jdN}7# ztDv=@y<)c|?Gh^TN*oz!ZX0=FM>1hny^gGoY4%>nG;v|n5P`KcX}bz%R@CO~C-(+P72_M| zE_be^7vI!ok+Wu|oq#MVN!cMB-5Rj6p15F1otvD{tPF~`N!^$l26d3WrQ6~*>Aj}n zG?x)rYJygaiUKISb1JQToBP)|flLh%?aeJZ-tn9v7=ve;A zn7aKmu^R;=9c1>Gb_aqZNg$z>x{;xm_F+6Vkfw^U8W}RDQ5U{SkueN^5jFP@4O?gh zm@)JUwH&uXUe_mW+mm3-_z(fJyL0+NWO;*)I=6>UESt~>XB~k@63D0`2YM}{$Vr11 zUL9E%s12sfL@pVF!T8D)=$Z`p7 zS_E?$JxyfQ?=^YUQnxUfVHN3Dps8<*X`UyZi|@54yXUiVEkrezuS9cY81Eb>VO+-T!ucCb!^&_P3YfxA3l&R%Vz#=%HEgh|Q+yz?9a;f2(T07a&m0+fc?qEq6#8 zoE_G4>yaI$deK5AZ;&z&02j#~w<{$jiEpAmLd{dXk#h2J=@xZk><;NSl?CQBAU0W$ zpD-kPKjl50N|dvLl_9%&y8u%M!c@`kJv}L1W z?^p*7m`9^`r^clM%K%XWSOMD3T9dh~Uu;XQ7)QU^Jum{p)Ylx6Xyrs=?^zxUOlGY< zPK3I^uFC(4(|oF_y0K=kQNlBxlq+Q2)axb>zJAMt(9>i-ov@-*)SHo!v0G`%&v$iJ z?4=CMI6wVs`5ArN?!y^vx#UE@235?)Sz%VVbcHI~l=$JigRtEZm8IbaFd{U|9-sWc z#=+-}=7&^4;Xj->>lgup)`#Xn0!rs!Ni?L8So75?OY~3W(!q(O)7U#5oex}=m`zQY z-^?YwDZJtWm9dT)74Pg}7Q**ge++nD81O{#LTy}u0`_s+tfuvdMo5iA)CD!9ZU>+|LpbyZKD(*~ML6daR!1-r=Iqf!J zP?hryxKSgU>GL@PVgVcP`&w2ONmu?XvY3RbcrW}pvuB*{?RG>MO*4)gzOMgd{Vqi1+kBRvH-Q|!r;M(N_? zvO3k>U|%0kV2|8JDMplePDIT>)9JZFY`VVWbABwq#~8=dMBG5vdiX(?rqrNK2_imd zCsHwhQ4W|~98$br;ehWIQun@d@DRXD-72@i6?`)~Zz$Z}BK`IbRn_U_*PPLgN>>_a zJj&SkYIx0sf{t-R?-CTZ*Ojaeyj1hY-Q{HCcla^pA=LQ-lp-p=<0BAojsIp$iSKbs zjR0xpK-eCy(Fg#=`ja^}0~@d7 zJs$A6wI-i&jr<(UXL7FEsus!io2a`fmBZ54CQKBL*tk8}x3aHi5nz#W!|cfwOQvok z8=Q6Hk5z-Kj##BTm7XI(CxzmvlP@NSLVeHAZGEesz=+aF2exxafI?OX+9!HT)TSWa z=F1|P_$@}tJdN1r1~s;R0`w|!wfhFJiQfB`FrzLea8LzPSu<}vQ`C+TJK!QiKz#T{Qq~+`=x>A!Qx1IMJsRTQy z?jugDGT;8YQbGJV++ay%L+g@KsoVznnZFiV5!I`H*3{2{Fg@sTB-hzag!VZ;qRJW4 zcZFcp^lfRl<+TODk*eU|&Z4u4MR&FfI&yVl=`Sc(@Go#i{z{kovUEqyU6mM>AZ>~_ zqMvh-AJpn+Eo`_Y zR0dK_^5@)ul5i1XK1=u>k`K4P)XNph*q+dZE-=^8!CK0Z*@cCc&h+a2iH6O{` zFn@Qt5AWfo!PMYlkJ8e8Xw9rE@{YYOAH?`hoNWenihWs`n9c{<=Vpzh^ebb9;=anGudu&k7Rz_!xT>@5x#RHi zUF+mvnTiUdR?U6;X_tzKpx8)oRp#nDrJMu0180e{8-$R4{tEc_Hm76KeTSV2}LwN0%eum{`K2%wxRoMf3Yt?=X;&4?`6FI(^cPxY#D&>Uv`9)dIUuxxsRS8>WUS> zVREFD((0&GBdXzr%Uc?b%`J=&8>z+lP$DDZa(kOb16Xfe(?@%1WK9agwfq>3wiA#C zbXed&ujqf`ieGC1Ru!OCl?R8a@5imxqbo0Nl))7H89H27?y-V2Wr@wh{$ko4pxuCQ z-o*-_eN1nlLogs$ydLr-m=}yp(PG!GT|-cuRm(@8;{FrY^v_TFzTlR9`}TpIWt~Z= zKWCRmo0K;AUdG+a7PI&AXS*0t49U+na~!$hr|B2 zp6cLBApP<7HQX<$NGTxCs@6R;aE-w=UY;Fz+jhe*-kUU6Ir^K))vDh;=LYxh6IIs@ zVs9RAc3MAY5z#x9m6dm{mnSqo;G1x|{~;Rm&DZNQJgI{!m!gDV9RIQ1Y2P)6{x_EH ztcJkmNO;{-8FoSX-`URJfB5!K&jtjb0pCnv|MqkL{AT<>LHa*!&wqR!@XgFN*=C79 z&NlmQ3X7)&!S$gZ~KcGd7Y~)^y?2E zJAdzf%2Xd^W?lmP*E0@HKZm!N1qZA`*d_z^$b(8uDF0+xfEUP}_~%d35~u~CG#qFN zcy-y;e|N3^PWb=l&umIMP-otLo)&xhU$=lVs;+BXMO#BB=>UuM|cFU;i z?Xm7RkI6hPU*n-pO#jyi+5Z*}$gEC_7#%r%=!ra5|p#P8pgc^${N?b>5#h!E* zD*2OM;s^gX7RnXp|CD`LKXAOg{RZTl*O}{iHvh6P{QubKzdSOO{Yy;D>p`e<>Oa3G z|B+;ha0$p*9Xp3DMOcgO|0(BoiuwN)SuwY^kok{X^FKY&N2NE%`imz3$z!4c*e3mq zEvZ(%#lyqnF)Ay*zxStT>y0@b_)DNf032A>C~v6vf!Xa3 zWTW5XAGT*#fV&;BIsl`K3fAp8mO{t5q=x;wKBDwve zk}xcA`YvMd-@3<#y}LliWY2o4N9oL;{}iqMGj}u=yGL1775svmt;XLB06(@PAC+GJ zOJaqVmu$4-=jiWeSpr!VkSE8=4*i^pF~tM)TJ1+-)sOy^V6mpTDF*a*gWew#@B?A; z2g1su(kp*e5_w5CcKnbW#@{|>)5Fgq2lP3V5*dx3p>z!1Ir~>YhSTg!2Jd&LjQ`d% z)E0lln@)6@B|9D5WG#9Fs=jq|NgQIfe^E$lW;oIFb8Hnr4RmB&xZu$r85vn@O-}M& zjGHcYXXXG{3-YQ^AmVB*;>zB`{amN_2+JQ>oxi)2Q^;FZ?3s(uI>X~d0l0#-Qml7T z*fN;IJ6US^oSz*iRoz(60Q2jaaydU3_AXKrQ16Os>pZ(w46n4(-k1V%0lP@kYq`HT zens!8HJo|67Cf(ZyCI1UFncg;O!H@|h9^wtzq3lET>4QQobMSHqgs@mQH1Ig^&>-&zVt8HJV9RbwS!cPHU-GNMzhJwp5 zQ^9R=;p9SJwjr(x5V_uX6(Yx{?cvNX0p2k`79juL>f66LixdXj_g894bN8+S>6KHP z__w#fm_kkphD8`U4He67U#1#L28zA~BNAQ_HKDC6MtFf$OF3|ViIXl(f{-bCkd=q}4_hhKp#zd3-GRvCUJGc2hT7P?fuIC#b zdMHLmyec*cE-${m9-6@U8STJFO4nXzWPonq)#TV!wY04}_?isT{pAlq%*06Sb-_(Z zhBp`tMm=^@%>v3OMwX-#s%L!1yK>mrEhI&9Tcq!@@9XVKN&dp{m@CBkz}wYSfR%0fCy_ zzGzX6L#}A_QBT_F5mk~JIe@mv^Y`}GkA-W3`(`Ps8>|%Yyvb{7wKwk#HZ02U2vZ*kVG-(nDJUt$1a>)KvX#nZLf1c8duuoRF$fUWeQIKc_xx+<{uYPCeDEy1SFOSFeF8C}zwAXeH)y%8{S&irR;Q3im>ewmzZ9;fI9{|JDKa$ne+=LqjQ0z$wp# z{H<^N=xq`X1HD)FMbK?U<`wQ9r)k^=2nQQ!RE?T|<#vpx>XU%pO1K0zrz{P4ns3%+09znVU4 zWmU7do_h-roGs8;B&A?ETqf`2&azJnlr|z`=c}nxQWa)sJF6ruN~HVOZIrA~N`%%pr;GWiVosxT`BmY2kVU*3 za;csVxlm|Yt&UzFWV=(Z^<@Hy$;>s>U<9;{+SA?rZWQgCiI}*QML!m0U}R*}Mk{Aq zuOzKZzc;bVjFAdDNNw?RJ>{*D4@1ja1F#T!|wOS zCBRc^Jg9@7E6O_2lzgv4;)}lIXFJ5JG(20z7(%U7y_ch$MWi_>iSv3J$<(W~O8;64k#4M3*MfCX6#YR5j2 z8&G$q2!-=WUnvQm+Y)%*2a5^ltkR?%yDpTFlbhR_rsdaF_6pg#5wN3^!x$N@bHPJk z$(2W=CphkuIn_+SI?P^#C>af>Ypp1A;k` zqO3)X7UI4i(A?lziN|NQS#%;HS0R0VYef>%GCF}JYnB0I>1>lUJ-LMHLhP$}Or@rk z``33)9@l+xi;ESAA61xXex+-@lbq-l#_B=l1^{})@oimQMD&Z*xuNv=7E1qndELb+uY$e15#qk7B@s_YZfJbg_&@cay^ z(3MWrV_6%eQAz=jf826HTW#=GdbBX|befhzmWJ27ds&Y;y21zFt1PQCam+wnHS&l? zPLH2GRTVJ@6d_;oPO8C3+5xu!)QIcI1)312h;NdYh#`-*vI5_|nKGeV@r*S@1uSt6JbH2KhE$d(@OJRK);I{d>xzk-y0dm$!6yDd=Zjb&~0 z;pL$!2V{~GBT^)3W~F!sM>3Pqtpthd3i|*XS}@a{mgMyskQR)8O#%xV{)c{W$lArr zE`V}44cVAv7&_0zEao{V!Q_S_MHG~;z4CWC{O~yD(8uzu^gw9v9KqpWn4j|~yKZAx z*|&Q^z%cy&om1fCB0T!2+WCm%L1yt8=Uw67R`;;w-P`RPyVj&+dCdJQp`YH1EL$v0 zX=JMhV!nN9*4wu(=NHK2riGU zM03r0&@vg~p96KT0x;BNc6gV*@&cgC$S&e8h9|@wzeiS!(cRk>!jBqH8|s{^w1oS} zI*-)Mg)ADeU28UGmZuFyQ)}GkUQi}l+#+%dYn1mr*e?-229I!VF5&C67pu!^r9BKw zv>dYaj*__a4ME!23cbYe-8IP}B;s^?;NvmOs; zJS{PP>k97x=gTKba_L7_=Lzy=ct3r;ft5H6qLceV+vaXdIs>o{8AJvikCg^8b z?(1xh@i!U>YpOV6$rH*`&&?9zbIaD%n^Xh8YWQ%H1T_7p%Y@ty6LAeLo7V62cQio?D>p0>akrq)_itKHHp< z6c~!kKg3(ra=zXQ2+#g;e2*b^&8TENi zZoj0YYv4KrRoL%Bgz-;q5}7-J!xcWGSqwUVrra`1$j6eU!ybWT{y{OgjA)ZOzcy(I ziNA5D?hvA7PgY98g#i7|JdycYE@mhhcMyIGUaStNr6;UjF$SQ~I;+BcD{wATJoBbh zP`SBk#DvuN6FPFQ!ed{4TJ6GPI-a_RWM(<;P)YI)2+eF0 zus4_9StioM9_-_u;FRjD-I^I;jj5c(L1(Nyy>*MPKP91L!Xd}7LD3(3sf7H?Td z69X{}(Oz!uuGXiNfumxXprPNg$fb}rY}O|VQPnO9t4a3q=}T zW9RgmZ1_afZmc5m()S_iD)hY@g{=K?HN6P7cVR`Frc*71^u0;Xqv$I~H&T7WNl({4 z@Y-O1sHV*_KRSN9%bxJZ=iq&RpnX>^(?`8!wVq!vuo~i7kaRx~h}I17tXZAWx4`AO zotlo^=BhV8oml*CLX;7oKh${yg`^i`9_Cqpjed+Pakz?E@2>F=O~N>P};I3qLs#P?r(~2%Rql- zg$t1$i#UKU4VRtKW5SwmmL(&P=a*oowu+O(b7pb`62ca*so6Un*08(h3rL*dhEJI; zRr4)&FQuVlf)p=+6rKDw9I=ez{c5G@aV2V>Ct^-g zeM*lGgT&NzyuGBHj!YSHhO|WjW^)4;#as?Q(OWxS5?(_3`o-MHh&P=) zap~Ks^MQ+q(FVk{E0#GTFmnV*vLSL(kc}XNpAlFHUmF2Qv0IgsEjW{bX4@aG*xKJO zIzg<%ignAJm@Pd6UM8!Unv&Y3YJr1}E8`ii)m1BGgM%}u~r?aBjiqEb!9F_8}`Zi+gF#Z(bqb(+4)7nGx=h|l@ z(-?fCf%ZxM8x7W?6c50$jC*L&id|b9r|9^UT@a<0Z|3=EKgRoXt@YdMsgQt*R=iC? z3Mm9CfW0gRd$NP~@)K8~=Y`V?%PXz{Issh0=yy8J#dvM#$toXwMVX=nj?*qHE){=y z9^?q<)=(867-MDtz1CRmiD%4r#0Rie%Ko1l?D|K@r%08V9Q&zY|Rj1(;`P#L| z0iTTfd>f;seaZ&r+5AlUk`QGH$c|>EbH=lmpNZU??J3nW%PQe|6P~)J=s#7E zWx0-aWI!Y*0Y7Hlx>`ji`i+-*Q6SdcK|2e@S&uE3d{cRUv7}5Ar!--92`EGkS%kZ@V_wHj*HX9BX z|47-Kb@`~Z-jLVq6%#AOA2WTG2IlcLfIeOK5)0l^e)XQ-%nhi2`H3C*lI;g1-nWzl z;G&j$hr+vxB%UCPT>Qx7{Tp>!xI)wtU8XB}kKp?b==y<-vS}r_zCO}v8V_G{4>guE zTSu+KqMluBl|OID@04@~=@M1qe3dbIAFkU3^R@LH3>-T<^I~hDm0MyFuu7FyKjS!B zw+zZT{rb6i4VMRE@P?g7+`LboH@LenE~})!vxp2mQ^W1zBB$4&ki{ap(HJYe=`F zg(v!Q$2E;9?YA2WP!mYLcj@feP=OM4Z&+$qN!=VUJ6-bT3(iKhwQF||@x%SJf)5d! zV~XiSt*lu`FUDB(LAN};}Ppuxw__WjP(wft)sOm<|>{F@gJ$5YFP9>s& zEM3+5nL=TdSLkJ{rv$s!wB$6@e4IOIJB!jX+o+&Jk<-dFDuwh(GPgWT#5)!Uh~}=l+X1%NFm9Kkw2Z3EAKoCCx?ghw7sf5s3?^CrNU*`f0tLQesf&sV0H< ztR+F6m%e2?gN;28@MCw5tq?wT?RFat3HuH>MK$@)Df1XQWUs8 zLklR@)c2gUr{cR{*Z8{}g_kW#mY*ofNXZ{YF2_wHO8`&vme8Y*1JG7M%3Ae>o0y#& z=(UzSk=+61JZqA%YK+Kd(E6Iw0pv=tD_h+zLz- zUm{u)Lrdu%(WYOqYi~*Nxs9bNkCXfuv-(ncjVUM@KWscoHM-i5SFy>mfY^5?ZRH5^ z10?N{PfJ4juT*3`u^0Gm=-4`n~qYA&* z3#-o-2nj3%*ti_!xgVMQK0Le)_GhWV$x$Gs)t3dBsM6#D!}Vz?>{Wea1LV9j z|76%0{AtogA9#==#WNPxHv(76U9+HtZ3Yx_yCo0BI`nL}oT^o_OWk}t{xXQX(6tBBcDZosMt?I8#~KTaJx=_Z4Va-*XS*K> zEQcS3>8{Bq`n!Z0Tth#+6{>Hv#V8f&|L_K{OAmQ5AGB5)>ds8Q?g12@u8Te+JC7BZ z)k@3_R%>_&w?p+x8*2r` zA9Hl83aZyTMQo2eZ;BL+OIst;9V~d2F5Sr^yEWPhk}voAP2-@y^d@eFy(FY3j+gHo z5G4wH#e%s&mh+Hj>=!Giu0*K_{;u%8RT?RM3R`^~jrG4+9b`f|YinDrwBwLHrG21N zvT!eAOgYO<7g8`69k}lOpw+h2K2#?PsZFJgqT{M(QxX{4a@J_4b zFAYEbts_3sk+Z%cHxYRn)~`1^|6XLEmfYmn8Ne7$T54#KsPXD#h;Lk6Pj>ZJV$$jG|5;`GtB`@zN9@O-n^eX|r3<3hvHcch5Vbxg4OO?tvnRLRE1E zSFwyCYz&RE>%mSL;hlO6e2>BM|3CxBLcLXcn=Z^2q|Ep>&JE~_PUPW77 zp58(G15X#S9x7z7UXU*8*DU1gjJ4VL%s{<3<2;Zwk;%x~;yWtZsDM*OHLRIlzY8kzXKtvpS@t(T$c``OcLy!AGxla^hWYG=-$8OM6Ur zR{QYu!Tm1Q%qQXX+w+&kcQ7?8C&#*~N2H!@M_FR&~ zgd%6+DSAA-6A20U7dqH8uIIvjv#Pt5@b+0T5${%X>QhMS61BKNMFi?*YX0g%DE|yK z{j(GQ<=L3G58p0P6=)Xn;2pN!b+*D^?vqUd-0d!1A4oJBP_7HX#~&hQa|`R1pAxcs z^qet5DW603yIrQWRgTI{h$ubKrL&`r7^3Rjb6cadAUpQW!U^>HNBg7IJm)&4IUh|> zQXDdu&03z_)7ACdU%WhwS}siMz(hiayZdiT`Y)n%J6y2jbz_2r81jVn_~0sV=eYP3 zF7Zq73%o1F5(fsbGoI+(Yzq(NxDXt7lvCZkjwgXfzOUu zOzvOw)%|+OzAMC_iBW9n+p%prR3;rljNZvm*+Dj+EkCw{Jr0Ygf}P^uZuN4jFF&&u zx`T5PIrpNjZ~(f!#=mjqZIFt^Y)MbT-9rpojmVeq3BBhu5@$%q5k_efsSh8suWIlu z)>TG=!or7F{ttwX%NPE7a9n4i0@hoFj5n^A8 z8@54ph3LnoM$^zfTqbv&K}~3i5{o+|2Q#m5U{+SyOMVeX)Q7}hy082uLm^P|j8H~> zwqQ!SR7&bCOKR06Ao6?#P50PP<<6w55}$?S8_#2HwD`u8u(fMw_r+%~>Dn@JOaWY# zjE;WRc@O9H~H^lMe#>xpS}j_NpVe4 z)5$P@A3NyzhEB;?708ZAN&g;oyW4S_1Fq#Jc4cQSNEY~yB(Ka+r87N0#v%>-3W6tm zWR!*%p*il%_kx+PN-6JcX>tY=NO#%uP6_1agRe!@hpK##yOJ7<1*gW$Y#mN57S&9( z8`X&+>b0SR-JT8s+9%pj9xyX$>)Vhz<+uK#5+8dUd*c*RoZ4Nf6{6B-4#ni04zT$+ zl$}$PGmE75Iz!(WC5$9p`AuFjfPeY$8TW@w_B#6+G+sp|zuBg0Y6jnu7&LjqBc)mJ;L4c%N-ZfP5|Qe~2Tbf}CUT znZS=4(DTM|0E=NUbzXP34ua;Kt;d*e!}XW>IEHp#ye#WvXUm`?-<@vq*VO0f_5>k% zw$zPa1oig>eVceS3n5pcO_$|2eK2@4e9;pRIs3ny`05w9}S6l!nPl(U2yoU5fhrlCf7S8j*O?BJ=KSma4uEe$5 z*rvo0ReaL)779ulloYq5O1X_e-gv}G6X+=jn68`39s#(vjzqBN0^RQ@5iY` zL&ih3{8o>D&d$k^XTW&O^x5({u9cHe4jq@)d=B&ZTzk>rOGaRstw}{RmH%sPNRbPv zSjw4%DSgV3{2<)tIrHpgSQp8ELW683rlZspeZ(qlTCR}Ou?qKb9$DWfy<5%c+iPRG zG{M#_DniWJp;c^gFZQ%fX^n@5zj#B+-Y!$?;k&+{%S|ce&B4 z2J_twDxlYWZs9-a8_3KNiPw0p{UsfE6j}udV1)+z`%Pg( zX%i;=I*!#5ZIAL4-s)vCbWCqn_;4aCZ&ix$)-J!L+!A=;@E2z0+TL8poR5j5MuL7VbWNRHsx*wQ0?U5HW! zd|N~?=C?nYDcND-TmG1w=vGyJ7bJp7QlOT*GelK^)EzMPqa!F}$I=oW{7Fi8tx2KC z`r-KaQvo`9rJk`1qz@t*PSv{g&Yz$*hCBm<@(8)>b^~QT`o3SuW+y%c@l$f14xFK! zg|F#eT@1~FsZ~)my=KN!mT-?n-qcRD=qK|rm&yhlu0^#6tUs#l>J;G%{|)Hh?dfcT z9x~Zgpi<}`3$aEup;!!Bmu8RFlN-|5%PhF627b7nX2aC<(AvsmA%R1Z`%hMkg>n>ZC&dgaWTfca~gV z0zK5meY*2K&*Y~Mb0yBKRRO#3F&o=ZA#+`6s@v?Mst&hVnX&TB;S#Snu#$r6jbBRW zkz5x-RPU^7M4MNO#Rcfza|W0|Tlp1Q-?~_K9#S)1>bP(pgFFoe0vzv(>^vo}(Z}5< z^yY(j9YinY)rqG|xeUD5r~U@FxnL6(eI0ta&oh+1-eDl7pX{bK->ENuS&&>Ug!l}~ z%2&n(=0guwfb(R$qlOmA5joXnu<5utU~k%}$0Gp2e{HYO*QA;^F$Xc}dLuLMt33G& z!l~_Up)7S{XW_hX`zv_cK;G*WmOuuSEf5o)_?5+cb-*T_(Ud%$LG+irhQ4!azy#~B zWkc|E*#E#uE9Z${b>_ zLc5SmWt&Fbi)v02yp|ffeR8oeVEq=RPZs~wpR~dn-b(fnqO43=gtycIFtK3`cXUWL zm(xO2Q7I=2kF+-}m^dG>;pGb1C*!;720k)xSf$CfLB!T2(^SYDO#`|Aw%7jqbn(Bi zoMZ05pD|V50rw-jHbwH$z9Xt}cT9NRXtSnS=5s6AS@5e$c0@d_@QNTM(G>swnBE%z z>4*o-XB0$h15fE}x|ZDK(Ps(UVlCGfUMO`)MH5Hf^qf2Y03eVveByQ<%eShOxY&Pk z3#wSx-+_^)HC-oiJN)zzDC1v>`OLmr?vyR9>Q+3Ng2 zf-hr!fIYbA&yT1JNgqK{+NPt1T<(v)JF%l*QmjI4l=!tW^}zX+eKArac1!jV}EY6 zoon0_8@oXQ5|dp3J=^6&NqY%^$zFAz)u&e^6Dxqlr2E8*muj$}jr|@HN;R0bHj~6$ zqPQ*0J-m#VXlk3rvKiQGg#;g|MwPJR#tplqmOKU;1>fn@aR59MJL=>0M-tS}MLT*? zZ{KefA`7Ev))lo=l79S$*hcyd(l#y^*||@9c=JVyE7W?yxaXuo3%H_p^wPT#G~I-d z0w7=4DiBwD3MV}w=F3WLbXd)Goea2s8PotoiI4Ko-D=8u8!!msOGQT2PEFp!YDZU~ z2U;V(Z5DHMRQx*&*J}CT-yz45_CDIZmE7sC%QSAK4zZ(rM&K=V0PPpGvw%=svu(Ns zsA!9!Qoy07ZBo#8(8tpGvs0U_7*24c)`(*ucvzKhrB_iSuER# z+!zj>Xc3ZZKU~;|=AQ?bqt97lhyQ7vx1Yat=Yo-Sye${XKFqj1^d5te(0Q4V>D|Pc zqKKbTs4p6d6}2J7*#<_vYFbUOa=W`>rYJoUPg#Wr%neB&@S#~%-Zs{c#O2JBRf2eh zO?$zt+-g_7@#E;lS(IbPxck>wI=c&i z0)Qi9w!2XG)`Y#O?EsJ(9gKbQUMiSRA0ck~y}3dCH0b-0tO9Cyr_{a|O8zURZ2lpB z{pk5?xqW%W;u_KEC46S4e5yv}dev%@Z0D#*qIt2kM^0g(&iEbvxEUaO8C4=D`{@0U z3uZpV<0M44LC)GvXT5m>R1JpVA$>VLRJWq}IDvv>wY&Z^9cYVCLoFbmIjzGcap6e{ zjxM|>oe9PDat>{SE7F$^7Uz8Z96VVy`g$3F)G{mG&N_EZ$=L?NSxq|cx$6mVh(vx1 zVh9z5L;)<(@@D=F6wY!B3gm-Fj59eqX58}TTZ}2<5@q4?DYqrz{4wgiov}%snHOv} z(H6Yc=;V#1Kz~^|f9i;UPwh-txW485044Ka;m(%wvZ&WXANW6aVYcpAVxBq?{3`LY zd5=+#bj8811*6bOLH(zANxMp&!Xt~h{e6o~xE9{1rOJ?y{Gp;^pW2yQ&7;MUyJ-v3VOYhOksuE&8{1l6}VPtn;en?Y=J*0MjTIybG$9g zXfbl^+>iB_*fF5p0A(>d8E z{mD(s&mCgJiX@JtS2zvD+mY$ncx^-!|BG9nT0afm1Gh2uh25<}jQXV+(7@ z=qn^W&%72`-XKM*TM2S=mQoWcE(sad+L)v_oD&%ia)?FW@;&W7lch6=RP8Sv z4V$?>I$kOe5r|sa(6C6o$h>tdHHf6y9Xlp1i%MauKrY(^vpnA0LGI)J(=}?X#488DBErAfuR);X&72c zx&)*_Kt)1Aq?MHJ&JmREZV&-!=?t8Rf*ED=;`w*<$*vmgCzY75#_6c^8-kTbL-9EZeE?- z{wz?3mm10Qc(;hN@rGU^(lB+;8*y&VNH6F!yGBGX)B^14%R4GJRw314o=awtHx&cd zeLjLKEE}!o5;tlWfxB0ATg=j)Yz|*}P=C>#JQWZaH{U>yJrJGL`krLJ{Rp`*`^(ky zy|DF-_1W8FV0=URqi@^2^a)Y5LL#Sm-)F~BM=qt|{a$i&kCsS!o7b`3Vn&EG2##*X z{J?NQ9VWm%o|cC|&Yg(X8UQ&t>h^EftqEm=zBjf8{m`HCY%vk8OH_n5&@)q@EI3T6_mefxmz6F#^VHb5lLY^AU zFiwPmjL=LOb|_%%(%up`=Y;FM`T8$-@EKIkfOKqb=IzotkZreSN|(rXQ|d=H`n2cq zYA%~~pE}w(E8`K%N!nYrU>f;!Ili0Au7@}Zbvb>D^Ut2DS>6}>qjIXV9<+m9)-fMr zky@jFDuk%U5VdJY01c&`p%iZ7r^h_Nz$LTmXt`YZG9kPypO`dr4AXl#Kb#sbq~%3u zUk`+^9*A8`@~s1YCrfs5f`~alO(kk>c(LVwnujzt)eqX?;`2^5fN>pZU~vBG+eT%AbGL1DK@i0ozu) z*VYZ3@>t!gK@;T(SdKvHpu6xcmc4Ap#x*1;#cgO3Vz%krVG2-_4wN^1V@z>A&sD3` z+0-y>B6xfWxW;VJ#lY4m?bPzQ3_eLJ#_1qD8+3LGF_wzLTuH&Vq+YL*2#4CefPM0B=`M?)~ z^=Zg(=6ii+7Yt+tg15qhX<}Tz>O7NYNcHXXr|Ugk@x}+A z`=$@GetOT7Z`7oTm|WhTVl@N^g5$xCJc%?H1I*8hx%5NNrmcajFTIPP8;4h$V+D@@KAeD~dgZy))*Yh8clz{4C$++=umf$_ z%H>%ozBjKPx3KP^aP59jcv<7g!Tnchsmm@LyPL0F?eXelop`nw!pQC0gFs!gk!Qvx z!QAsYp(Od`M)G-BbDgTG-P6qSb3XeWm5f;Ar#*h6Nb&UD-AUzHWsbz4eLctVT*jqZ zmcS>=qDyrEJRS$ME@AUkON5)jKqFS2_i3PnvcdUJ|B=RMi zDDW&H4iWtaVvV%jJ4;FX7v%|cB(89Kqu_<>)7A^q78|{v&@HC zN1}46CG4JI7@st>{PqWf{AbLaX0dME{M=3jxMlOLs4_km=5F{TVkwjfS%0p7apDRj zV?)Kwhj*G;cVIzBo%f;N++4&ncavMMHf<4Yro*BLD)TpZ0rQ!W#D}aWgr|nU!|mD* zABstbStly{9_-x53A^OVNF=xkb*DL1>CmTiyt3PA5>(jZM?BMQ40;Q&yfc#6}xpYMg)jci;*m1y86X;rOnCXN?%+906X*B4176w)v@;xpDO0!WLvKV z9&Mxw*jd)HU-6ly8b0}iS7lm>GEQJMpx8gfRci{Kz%la^sNa4*$!_?ULLz7bg7}a$ zRnV4W(`v4UK|@0`*T=ot-blV0C$94`#)H%Y8tF5LeRvXfgegejWdk#U zT<6@?0@YKsX4s{&N8AY|I<@)Z?h+;9jGqnSC9c^gF)M!TTnwUTlJ8)83_c{@7Zfy}}(%0;{hm3rdmQ;sD&$k?Be^+hC4Y zOU~u`1HpCFziN#h0bB-b+0EMk+_8&VsV@?eM;QeVwbXU*>crtW5eiIDaC7R1F};6F z@WHb2Nsog`MrEU;n-vh1inN=KVX)xY9VQn<1f3ch;0jZa%Vb+`wyKIONn1?FxE?H%wQPVC2Otf1ja8(6Hlcg;M`D=P*pv&=+9) zcnUlbm#qLoXsSz52goA9F=uM?Qy_wync;?%ABnT9cd9aevq)DS+;T?8E=_G&Sm}ZI(^-4{qrkr{i3AQ%?gD8^5t^^ zJj(-bAi0BuTdGwne!M*=A`4vN!{R+8>C6)lPfh5aj_#ow!m8&olot8*N;JgXY0oD~ z1))W5MlBO2kWgnzFdnv`Gx^bbpj&{a)-j34N4!gviuau)_T8>W1a3MfH<+tF;fHg{ znf~_5U3__~*JPVrSNe@UGWEmDdurl-FeaXHtRgGIe0Gx{KkVtdFxCvm{ecj>1-4Ox!R#@epSUnR zErfxn|59D~a8jhsK{KU&qnk~)n7iApb7#}>%_YsWud@%+Hs_&4Mp3z*cgv0CVYN=B zi_D|B*ls><`74k3LyAXMcGwr4m9!b8JRhxv5u`6$h06LwakA>T;Qi2VR3a|9Q2&cW zv&j^JO-IPSWJr*C2bNKAru_bk5O{wVAO z#pkjUZAH3P zOnEyx5~(j-EiYQ_De~j;Og(+KU|Lyr`N?ojg z@mI$b_N44R&YIx5`8-9P(YRh@jp!DE0gdIYd~uS&*;k{|Exw!l{{30XZqKGZpayMA zgg&Ho1KIiQI^*J!FT#sAGz;GQW$NSq%x(RC|Gh20;N~;D`!1(MY&uk*;r|R1@#{(> zstcOv@k&n3%X6Cj*B2>m-HdxL2Vs#Gt@-`yPr7|SZPILtDvkR*yp$lm6q)yiST@f$ zd*=C`n;8I^eIbUy6fr^X<=xgyJjfRXy#^O00CSwN1=eZ+H=sNcnYdv?P9GfZmtJm8 zh-4%gKu%%X`Kyx;4QOUh%Q($527K5qPyYZj84WA#Apk6=#%TU8AoVUhK(i<;8U+gS z5;+@J-dDYCM^pji2~|eOp|N_k{4uWXD*z|e7aSdymtDMZARkn z9i6X{RZzZOMLqltz)*HXFDyK4eOCT=!>xWG=;#BLc;EI`--y%Bz<*$2|0|lZMurN+ z58nGwEvu3<{=Iv5Gko?x?oeaP~kgZ_2G zHZnO$`=>7lpjYlsT@L*GIDhVP09uOGtUamH?0>5>ppiOn+H1tj;WrnNo@5cqe}R6k zHG_>c$|Ly}UZkP^+oBzao`QCbXLJ_wTM@1zd0qe3%)?>`vjF%zrfdO>e;YQ|(fSml z_tM7xdmrXErW*h5%B7O}YacIzE{oA`Tq=3&@E@-NkDDI-vHhTDWI)98H%~H&HvwzCH@M^;pvi>*(A&W6nuIWFWcFn zqCKvW9Oj(+nV+Z2u?8#W%K7m}t%bjzbSNG(puQJ5lTm(ut`k4Bkjzfw+*6*iVgE1i zBhXQ%udOYdzpxA+*<#Y$G2u8BY&$V!Bsl&n=4HBG5`a-Hv_Ts2i~b#5L#3U?Drayr zk*(am@ZaO`ug?5C0690#Vx|S*iAwXK4akZEMJPq1UE!%}*4EY(JYG*J#I4@lG$3+> z(!76%v@#tosnJLt4E9-th)W)@ z0Qj?f;Z86r!C#F@9%I%`Pya*8Bz3C#I?*$6pzi)$jg!f+Eeho1Yn?D{w5 z+2k6lxdiH)b;9*Vi8J>Ur}==f9Qjke1@`pc*`kFt)ct&m&rW;0@&@fie=P667rx(o z3H>SNI-3SC%|**aQbgM{o==bEDj<*g&Gfg(m<{9p z_NLHSqAw3;sID%b?R+==+aG^(xBtsjR;m5MCHHtc6!#XO$Ib(K<`safz9LZAXCYpK zP1uzyetroU`RE{FJopnRHH^7*AeO^Ke_4t7l? zpJj2Gg8!wHLO9KduWN1PAurHQpj0Lar%oSjX}&x-Y`i$4K4TZte(kz5$1qO4nkk>2 z`#>ob1PJ3~xshvOVTo{WiM0zoD$uH>3~o48!c`1su1IzUblS-CEYBM=Cd?CwNZH(eMj_*LCR6@rqb{?$OmAo^|LnEFB0Ww zke!fmTa}B^qTNfOz=cV`#?qnQxSx_c(4}Mi?ZV9h-x-@2`@A#P@cFSXNDH$iQeh3g*40pC7lKeha=RS6KE186>kVJ${Lnp z{?ah}{=;tE+h2g7imAfP)^jytbFQb>G_VoKf5_GQpEdynm6-$B%Eeuk+cFQDwJ#F@ zp3!sC7s7(g&F`LhoaILXNK@XzzYwQ@3YVYZFuh+2*+;ao9Pe*u=RaYvrsMxgmekll zZ?^UZ0~Zn{ep%o-+9XJlH<(%r*vSokip*}uDS z{QIx$^Z*J3v!q%hoW6y{|IR4=N2EOvK*|TG!7l5F9CecAX|-*x2eU!w<)2gZ3-{+x9o_+RS+VL^uVpMCiM(v?nR(85BX z#R|`{`fl8xvo68`D-fGy&{$7_@keI#U(@(ha#?_x8!2no%xTr0G9+-hE3_m ze}DV|%i{l= zDB*ufYN0NSBXRO-bER^|-2a-G{Lxui{#aNS&QW(vlK$w(e@P*ZwEW6c!;ZNr{uEWQ zMhoyFP_0OlGySJV{5RLBq5_`-Pb}x<2=~+gbvZJ4i6)o6^9dUGmDJ$;%_sX4?(dT zbw6DQWXX7ChJ-Pr9hK;@q5@Q^*!$n6Z!6AUSI-~sc%;KlrYkt6UL{1KNw1_i4hbXE z_^?K9oAV10N_=2Gtak3PMe+u-i<4&O;gZMBORnGFfiY44v=8qcOiqKAEeF$tZvpmb zcxZTDK6nsekJ;_n>h5?}y`S-%8cTMLfEyr1rIK^8BMBh3NG5bOYDceR& z%z?=oCmxOX1|E$V;-Mz{?g3&jHhWhNU;L9JyFvX#JcnA}c!7r4#Si$^b*@6@FH+pb zKx&U3jbfEYzTs z(UJplD1O6@ubpNXaPA$qS9(XgYTu*B>V7yd(N(>xp@e^qQhUZmkd+!t>@ zRbkR-3Bx0GusKe_?K